xmrig | e8e332cd5abdee542031946e1139bc40eb6b4ddf6e8125c2fad0d5076d8fc6ac

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
Size

1.8MB
MD5

0c4ef8797d32acee7f1edfe62e0e21d6
SHA1

e6d2e8fbce5ee96ffa7b4e0fdf11a7b59200125c
SHA256

e8e332cd5abdee542031946e1139bc40eb6b4ddf6e8125c2fad0d5076d8fc6ac
SHA512

cf556d5e710f2eb2e5687b53b14fc2bc40bfb0e7eb908f7dd2a4c998922487fc6e87a6465bf4e4642388bc684a6cb85278805f9d996bc7c08012d1edaad63fc6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5f:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 19 IoCs

miner

resource	yara_rule
behavioral1/memory/2732-54-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/960-45-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2044-72-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2616-68-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/2580-67-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2724-64-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2716-62-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2648-60-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2256-58-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/824-55-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2580-5230-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2648-5227-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/960-5222-0x000000013F520000-0x000000013F912000-memory.dmp	xmrig
behavioral1/memory/2724-5229-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2044-5238-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2732-5254-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2616-5277-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig
behavioral1/memory/3000-5306-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2244-5310-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
960	hrCUDUm.exe
2732	mSqSSVg.exe
2256	FQTXDlo.exe
2648	inbCirE.exe
2716	RAuscmj.exe
2724	aZzzqeM.exe
2580	ovpRVKj.exe
2044	bDTvSIw.exe
2616	tVHETFI.exe
2244	DhJeQAf.exe
3000	PvetDrP.exe
2820	SQoyZay.exe
1624	RumZsed.exe
1588	pacEBZN.exe
2844	JctvNkb.exe
1684	lgQsdoj.exe
1524	naloMnc.exe
2872	SJhSaHh.exe
1812	lHDZjpn.exe
2800	irvJeHe.exe
2688	zLNxmxf.exe
2832	hXGbpKN.exe
1456	sXMrwek.exe
1104	UDycwtJ.exe
392	TqfFAhV.exe
848	VoUTgPs.exe
1512	JjiyRHU.exe
1092	ONerngT.exe
1048	DovZqQQ.exe
2904	QKWEqst.exe
1564	gISislQ.exe
1140	IATdVXH.exe
2916	XBhwmip.exe
864	wXXyLDy.exe
1000	nofAzxU.exe
2900	bURmaeq.exe
1660	OkomSAF.exe
616	HZUPHFP.exe
1832	tSzaqnx.exe
1828	EuYqsrM.exe
1600	hnRSkOJ.exe
2308	kzOikru.exe
2128	sXFnVDv.exe
2488	mxkQqzo.exe
2672	ZJtSMXg.exe
1968	iobrrFM.exe
2736	NcjVlZN.exe
1432	TsiwTdH.exe
2028	SoKafBW.exe
1556	qfFSukO.exe
404	roBHyAk.exe
2268	awNTxHX.exe
2924	zZEmByt.exe
2392	YkEPznl.exe
1776	aVsKALo.exe
2012	jFyLjMh.exe
772	XTVSVCd.exe
1480	SgvPbGT.exe
1988	jwUhSFX.exe
2124	AaOxBjw.exe
2400	MeuZadC.exe
1840	XLsbZXb.exe
1992	vFvRnKp.exe
112	LPnIfpQ.exe

Loads dropped DLL 64 IoCs

pid	Process
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/824-0-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x000b0000000149f5-7.dat	upx
behavioral1/files/0x000f000000005578-14.dat	upx
behavioral1/files/0x0009000000015605-18.dat	upx
behavioral1/files/0x0007000000015626-26.dat	upx
behavioral1/files/0x000a000000015c52-36.dat	upx
behavioral1/files/0x000a000000015c6b-37.dat	upx
behavioral1/memory/2732-54-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/960-45-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2044-72-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x0006000000015d07-101.dat	upx
behavioral1/files/0x0006000000015d1a-116.dat	upx
behavioral1/files/0x0006000000015d31-124.dat	upx
behavioral1/files/0x0006000000016448-169.dat	upx
behavioral1/files/0x0007000000015c83-76.dat	upx
behavioral1/files/0x0006000000016be2-186.dat	upx
behavioral1/files/0x00060000000167d5-179.dat	upx
behavioral1/files/0x000600000001650c-171.dat	upx
behavioral1/files/0x0006000000015d98-126.dat	upx
behavioral1/files/0x0006000000015d27-118.dat	upx
behavioral1/files/0x0006000000016287-163.dat	upx
behavioral1/files/0x0006000000015cf6-106.dat	upx
behavioral1/files/0x0006000000015d0f-104.dat	upx
behavioral1/files/0x0006000000015cfe-98.dat	upx
behavioral1/files/0x00060000000160af-155.dat	upx
behavioral1/files/0x0006000000015cee-90.dat	upx
behavioral1/memory/2244-84-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/files/0x0006000000015cb6-82.dat	upx
behavioral1/files/0x0006000000015f01-141.dat	upx
behavioral1/files/0x0006000000016bfb-191.dat	upx
behavioral1/files/0x0006000000016a29-184.dat	upx
behavioral1/files/0x00060000000165ae-177.dat	upx
behavioral1/files/0x0006000000016176-162.dat	upx
behavioral1/files/0x0006000000015f7a-154.dat	upx
behavioral1/files/0x0006000000015df1-133.dat	upx
behavioral1/memory/3000-97-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000015cce-95.dat	upx
behavioral1/files/0x0007000000015c9f-80.dat	upx
behavioral1/files/0x000a000000015b6f-28.dat	upx
behavioral1/memory/2616-68-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2580-67-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2724-64-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2716-62-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2648-60-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2256-58-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0007000000015c78-53.dat	upx
behavioral1/files/0x0007000000015616-22.dat	upx
behavioral1/memory/2580-5230-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2648-5227-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/960-5222-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2724-5229-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2044-5238-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/2732-5254-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2616-5277-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/3000-5306-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2244-5310-0x000000013FF60000-0x0000000140352000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\kJpoztK.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\UTvMpuC.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\bXjApNw.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\RUBdgLz.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\WMSUdmm.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\CrzNQdy.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\YNscHkL.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\jryIOKf.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ozcnGJf.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\SPRiYqV.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\vhyeDCs.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\YGwvDnT.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\TKKCJrV.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\jpymaKM.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ZXBnnGY.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\fACNlxq.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\DJnFCxc.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\vapzOKr.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\PeLoFgl.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\cQxLMRn.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ousvtlO.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\qtZljTT.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\jYdahGj.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\QZnTfrP.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\UgeIkIb.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\PNfhOix.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\tiIgvYV.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\GQkJnAd.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ZOPWOVY.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\jhXQQDw.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\QCMKwhA.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\DovYoKm.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\EmwokaI.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\eziJzqs.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\JLyThoO.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\gEjbsgs.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\kcBMast.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\hTgvxpt.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\kEyQZha.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\RzkaJAH.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\gxQpjMc.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\DJrUILQ.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\jpaqVwG.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\bRufaDy.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\RhZsMfa.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ZUeBkRb.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\kmFiZbb.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\oDHEjbj.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\wKgrJQz.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\XdInukL.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\FbPfAYg.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\hrCUDUm.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\DYGygmW.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\BtecHUl.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\DfRyDPd.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\xmRCHnj.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\SRoeYdW.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\fCiZGjA.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\cCmjxQA.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\HtgVSLS.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\ypAboFw.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\VvyBJJh.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\JRaUrKu.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
File created	C:\Windows\System\shdVeTq.exe	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2536	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	29
PID 824 wrote to memory of 2536	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	29
PID 824 wrote to memory of 2536	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	29
PID 824 wrote to memory of 960	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	30
PID 824 wrote to memory of 960	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	30
PID 824 wrote to memory of 960	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	30
PID 824 wrote to memory of 2732	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	31
PID 824 wrote to memory of 2732	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	31
PID 824 wrote to memory of 2732	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	31
PID 824 wrote to memory of 2256	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	32
PID 824 wrote to memory of 2256	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	32
PID 824 wrote to memory of 2256	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	32
PID 824 wrote to memory of 2648	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	33
PID 824 wrote to memory of 2648	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	33
PID 824 wrote to memory of 2648	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	33
PID 824 wrote to memory of 2716	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	34
PID 824 wrote to memory of 2716	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	34
PID 824 wrote to memory of 2716	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	34
PID 824 wrote to memory of 2580	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	35
PID 824 wrote to memory of 2580	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	35
PID 824 wrote to memory of 2580	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	35
PID 824 wrote to memory of 2724	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	36
PID 824 wrote to memory of 2724	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	36
PID 824 wrote to memory of 2724	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	36
PID 824 wrote to memory of 2044	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	37
PID 824 wrote to memory of 2044	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	37
PID 824 wrote to memory of 2044	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	37
PID 824 wrote to memory of 2616	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	38
PID 824 wrote to memory of 2616	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	38
PID 824 wrote to memory of 2616	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	38
PID 824 wrote to memory of 2244	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	39
PID 824 wrote to memory of 2244	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	39
PID 824 wrote to memory of 2244	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	39
PID 824 wrote to memory of 3000	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	40
PID 824 wrote to memory of 3000	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	40
PID 824 wrote to memory of 3000	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	40
PID 824 wrote to memory of 2872	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	41
PID 824 wrote to memory of 2872	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	41
PID 824 wrote to memory of 2872	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	41
PID 824 wrote to memory of 2820	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	42
PID 824 wrote to memory of 2820	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	42
PID 824 wrote to memory of 2820	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	42
PID 824 wrote to memory of 1812	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	43
PID 824 wrote to memory of 1812	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	43
PID 824 wrote to memory of 1812	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	43
PID 824 wrote to memory of 1624	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	44
PID 824 wrote to memory of 1624	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	44
PID 824 wrote to memory of 1624	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	44
PID 824 wrote to memory of 2800	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	45
PID 824 wrote to memory of 2800	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	45
PID 824 wrote to memory of 2800	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	45
PID 824 wrote to memory of 1588	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	46
PID 824 wrote to memory of 1588	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	46
PID 824 wrote to memory of 1588	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	46
PID 824 wrote to memory of 2688	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	47
PID 824 wrote to memory of 2688	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	47
PID 824 wrote to memory of 2688	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	47
PID 824 wrote to memory of 2844	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	48
PID 824 wrote to memory of 2844	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	48
PID 824 wrote to memory of 2844	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	48
PID 824 wrote to memory of 2832	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	49
PID 824 wrote to memory of 2832	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	49
PID 824 wrote to memory of 2832	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	49
PID 824 wrote to memory of 1684	824	0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c4ef8797d32acee7f1edfe62e0e21d6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System\hrCUDUm.exe
  C:\Windows\System\hrCUDUm.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\mSqSSVg.exe
  C:\Windows\System\mSqSSVg.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\FQTXDlo.exe
  C:\Windows\System\FQTXDlo.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\inbCirE.exe
  C:\Windows\System\inbCirE.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\RAuscmj.exe
  C:\Windows\System\RAuscmj.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ovpRVKj.exe
  C:\Windows\System\ovpRVKj.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\aZzzqeM.exe
  C:\Windows\System\aZzzqeM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\bDTvSIw.exe
  C:\Windows\System\bDTvSIw.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\tVHETFI.exe
  C:\Windows\System\tVHETFI.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\DhJeQAf.exe
  C:\Windows\System\DhJeQAf.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\PvetDrP.exe
  C:\Windows\System\PvetDrP.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\SJhSaHh.exe
  C:\Windows\System\SJhSaHh.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\SQoyZay.exe
  C:\Windows\System\SQoyZay.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\lHDZjpn.exe
  C:\Windows\System\lHDZjpn.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\RumZsed.exe
  C:\Windows\System\RumZsed.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\irvJeHe.exe
  C:\Windows\System\irvJeHe.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\pacEBZN.exe
  C:\Windows\System\pacEBZN.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\zLNxmxf.exe
  C:\Windows\System\zLNxmxf.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\JctvNkb.exe
  C:\Windows\System\JctvNkb.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\hXGbpKN.exe
  C:\Windows\System\hXGbpKN.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\lgQsdoj.exe
  C:\Windows\System\lgQsdoj.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\sXMrwek.exe
  C:\Windows\System\sXMrwek.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\naloMnc.exe
  C:\Windows\System\naloMnc.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\YkEPznl.exe
  C:\Windows\System\YkEPznl.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\UDycwtJ.exe
  C:\Windows\System\UDycwtJ.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\jFyLjMh.exe
  C:\Windows\System\jFyLjMh.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\TqfFAhV.exe
  C:\Windows\System\TqfFAhV.exe
  2⤵
  - Executes dropped EXE
  PID:392
- C:\Windows\System\XTVSVCd.exe
  C:\Windows\System\XTVSVCd.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\VoUTgPs.exe
  C:\Windows\System\VoUTgPs.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\SgvPbGT.exe
  C:\Windows\System\SgvPbGT.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\JjiyRHU.exe
  C:\Windows\System\JjiyRHU.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\jwUhSFX.exe
  C:\Windows\System\jwUhSFX.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ONerngT.exe
  C:\Windows\System\ONerngT.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\AaOxBjw.exe
  C:\Windows\System\AaOxBjw.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\DovZqQQ.exe
  C:\Windows\System\DovZqQQ.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\MeuZadC.exe
  C:\Windows\System\MeuZadC.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\QKWEqst.exe
  C:\Windows\System\QKWEqst.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\XLsbZXb.exe
  C:\Windows\System\XLsbZXb.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\gISislQ.exe
  C:\Windows\System\gISislQ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vFvRnKp.exe
  C:\Windows\System\vFvRnKp.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\IATdVXH.exe
  C:\Windows\System\IATdVXH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\LPnIfpQ.exe
  C:\Windows\System\LPnIfpQ.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\XBhwmip.exe
  C:\Windows\System\XBhwmip.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\aTTuAgX.exe
  C:\Windows\System\aTTuAgX.exe
  2⤵
  PID:1856
- C:\Windows\System\wXXyLDy.exe
  C:\Windows\System\wXXyLDy.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\IUkZyUT.exe
  C:\Windows\System\IUkZyUT.exe
  2⤵
  PID:1208
- C:\Windows\System\nofAzxU.exe
  C:\Windows\System\nofAzxU.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\WUEhDuf.exe
  C:\Windows\System\WUEhDuf.exe
  2⤵
  PID:3052
- C:\Windows\System\bURmaeq.exe
  C:\Windows\System\bURmaeq.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\yrIUJzE.exe
  C:\Windows\System\yrIUJzE.exe
  2⤵
  PID:3048
- C:\Windows\System\OkomSAF.exe
  C:\Windows\System\OkomSAF.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\mIbtwNS.exe
  C:\Windows\System\mIbtwNS.exe
  2⤵
  PID:3064
- C:\Windows\System\HZUPHFP.exe
  C:\Windows\System\HZUPHFP.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\cEnYRXT.exe
  C:\Windows\System\cEnYRXT.exe
  2⤵
  PID:2956
- C:\Windows\System\tSzaqnx.exe
  C:\Windows\System\tSzaqnx.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\GWPQFAQ.exe
  C:\Windows\System\GWPQFAQ.exe
  2⤵
  PID:472
- C:\Windows\System\EuYqsrM.exe
  C:\Windows\System\EuYqsrM.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ZSTwEsD.exe
  C:\Windows\System\ZSTwEsD.exe
  2⤵
  PID:2100
- C:\Windows\System\hnRSkOJ.exe
  C:\Windows\System\hnRSkOJ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\JRkThmq.exe
  C:\Windows\System\JRkThmq.exe
  2⤵
  PID:1604
- C:\Windows\System\kzOikru.exe
  C:\Windows\System\kzOikru.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\cjjyexs.exe
  C:\Windows\System\cjjyexs.exe
  2⤵
  PID:1956
- C:\Windows\System\sXFnVDv.exe
  C:\Windows\System\sXFnVDv.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\OZBwqLn.exe
  C:\Windows\System\OZBwqLn.exe
  2⤵
  PID:2644
- C:\Windows\System\mxkQqzo.exe
  C:\Windows\System\mxkQqzo.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\dHNZLyw.exe
  C:\Windows\System\dHNZLyw.exe
  2⤵
  PID:2868
- C:\Windows\System\ZJtSMXg.exe
  C:\Windows\System\ZJtSMXg.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\mtcqyJL.exe
  C:\Windows\System\mtcqyJL.exe
  2⤵
  PID:2700
- C:\Windows\System\iobrrFM.exe
  C:\Windows\System\iobrrFM.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\pKRINNG.exe
  C:\Windows\System\pKRINNG.exe
  2⤵
  PID:2804
- C:\Windows\System\NcjVlZN.exe
  C:\Windows\System\NcjVlZN.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\aKodaxM.exe
  C:\Windows\System\aKodaxM.exe
  2⤵
  PID:2460
- C:\Windows\System\TsiwTdH.exe
  C:\Windows\System\TsiwTdH.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\jTlDqBZ.exe
  C:\Windows\System\jTlDqBZ.exe
  2⤵
  PID:1420
- C:\Windows\System\SoKafBW.exe
  C:\Windows\System\SoKafBW.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\xDCjRqK.exe
  C:\Windows\System\xDCjRqK.exe
  2⤵
  PID:812
- C:\Windows\System\qfFSukO.exe
  C:\Windows\System\qfFSukO.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\uLpIDNO.exe
  C:\Windows\System\uLpIDNO.exe
  2⤵
  PID:2140
- C:\Windows\System\roBHyAk.exe
  C:\Windows\System\roBHyAk.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\qRYKmGF.exe
  C:\Windows\System\qRYKmGF.exe
  2⤵
  PID:1192
- C:\Windows\System\awNTxHX.exe
  C:\Windows\System\awNTxHX.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\PvEBHPK.exe
  C:\Windows\System\PvEBHPK.exe
  2⤵
  PID:2592
- C:\Windows\System\zZEmByt.exe
  C:\Windows\System\zZEmByt.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\nTAcghB.exe
  C:\Windows\System\nTAcghB.exe
  2⤵
  PID:2596
- C:\Windows\System\aVsKALo.exe
  C:\Windows\System\aVsKALo.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\dDjhUQz.exe
  C:\Windows\System\dDjhUQz.exe
  2⤵
  PID:1704
- C:\Windows\System\TusOxiG.exe
  C:\Windows\System\TusOxiG.exe
  2⤵
  PID:1640
- C:\Windows\System\fCUGHlR.exe
  C:\Windows\System\fCUGHlR.exe
  2⤵
  PID:3088
- C:\Windows\System\ajOkuZd.exe
  C:\Windows\System\ajOkuZd.exe
  2⤵
  PID:3104
- C:\Windows\System\hLubjvI.exe
  C:\Windows\System\hLubjvI.exe
  2⤵
  PID:3120
- C:\Windows\System\XbTZGBd.exe
  C:\Windows\System\XbTZGBd.exe
  2⤵
  PID:3136
- C:\Windows\System\PLaHONT.exe
  C:\Windows\System\PLaHONT.exe
  2⤵
  PID:3152
- C:\Windows\System\hutnmmd.exe
  C:\Windows\System\hutnmmd.exe
  2⤵
  PID:3168
- C:\Windows\System\MFFakKO.exe
  C:\Windows\System\MFFakKO.exe
  2⤵
  PID:3184
- C:\Windows\System\vaRmMYE.exe
  C:\Windows\System\vaRmMYE.exe
  2⤵
  PID:3200
- C:\Windows\System\iAseKcM.exe
  C:\Windows\System\iAseKcM.exe
  2⤵
  PID:3216
- C:\Windows\System\ttASFPf.exe
  C:\Windows\System\ttASFPf.exe
  2⤵
  PID:3232
- C:\Windows\System\eOzIpEK.exe
  C:\Windows\System\eOzIpEK.exe
  2⤵
  PID:3248
- C:\Windows\System\OwWAire.exe
  C:\Windows\System\OwWAire.exe
  2⤵
  PID:3264
- C:\Windows\System\bSoJmPq.exe
  C:\Windows\System\bSoJmPq.exe
  2⤵
  PID:3280
- C:\Windows\System\TPeYLqC.exe
  C:\Windows\System\TPeYLqC.exe
  2⤵
  PID:3296
- C:\Windows\System\rpZSUij.exe
  C:\Windows\System\rpZSUij.exe
  2⤵
  PID:3312
- C:\Windows\System\IWgRYuI.exe
  C:\Windows\System\IWgRYuI.exe
  2⤵
  PID:3328
- C:\Windows\System\lQlLGnk.exe
  C:\Windows\System\lQlLGnk.exe
  2⤵
  PID:3344
- C:\Windows\System\xgdLSBt.exe
  C:\Windows\System\xgdLSBt.exe
  2⤵
  PID:3360
- C:\Windows\System\MWyvKtf.exe
  C:\Windows\System\MWyvKtf.exe
  2⤵
  PID:3376
- C:\Windows\System\WAEbDHF.exe
  C:\Windows\System\WAEbDHF.exe
  2⤵
  PID:3392
- C:\Windows\System\FCuIgda.exe
  C:\Windows\System\FCuIgda.exe
  2⤵
  PID:3408
- C:\Windows\System\ihqZUZB.exe
  C:\Windows\System\ihqZUZB.exe
  2⤵
  PID:3424
- C:\Windows\System\dZcBDFY.exe
  C:\Windows\System\dZcBDFY.exe
  2⤵
  PID:3440
- C:\Windows\System\vZDJnjZ.exe
  C:\Windows\System\vZDJnjZ.exe
  2⤵
  PID:3456
- C:\Windows\System\SIolejC.exe
  C:\Windows\System\SIolejC.exe
  2⤵
  PID:3472
- C:\Windows\System\yBajBHV.exe
  C:\Windows\System\yBajBHV.exe
  2⤵
  PID:3488
- C:\Windows\System\lewEbOW.exe
  C:\Windows\System\lewEbOW.exe
  2⤵
  PID:3504
- C:\Windows\System\LZZEqat.exe
  C:\Windows\System\LZZEqat.exe
  2⤵
  PID:3520
- C:\Windows\System\qfFFpgc.exe
  C:\Windows\System\qfFFpgc.exe
  2⤵
  PID:3536
- C:\Windows\System\ZTbHTLY.exe
  C:\Windows\System\ZTbHTLY.exe
  2⤵
  PID:3552
- C:\Windows\System\zebRYpb.exe
  C:\Windows\System\zebRYpb.exe
  2⤵
  PID:3568
- C:\Windows\System\puFJQby.exe
  C:\Windows\System\puFJQby.exe
  2⤵
  PID:3584
- C:\Windows\System\gMIzqTS.exe
  C:\Windows\System\gMIzqTS.exe
  2⤵
  PID:3600
- C:\Windows\System\SzWvKsn.exe
  C:\Windows\System\SzWvKsn.exe
  2⤵
  PID:3616
- C:\Windows\System\vpfZOaz.exe
  C:\Windows\System\vpfZOaz.exe
  2⤵
  PID:3632
- C:\Windows\System\CVZEcBK.exe
  C:\Windows\System\CVZEcBK.exe
  2⤵
  PID:3648
- C:\Windows\System\UdvlWmX.exe
  C:\Windows\System\UdvlWmX.exe
  2⤵
  PID:3664
- C:\Windows\System\vAZilrt.exe
  C:\Windows\System\vAZilrt.exe
  2⤵
  PID:3680
- C:\Windows\System\tNDekKe.exe
  C:\Windows\System\tNDekKe.exe
  2⤵
  PID:3696
- C:\Windows\System\QkkOCrn.exe
  C:\Windows\System\QkkOCrn.exe
  2⤵
  PID:3712
- C:\Windows\System\dCUUwwU.exe
  C:\Windows\System\dCUUwwU.exe
  2⤵
  PID:3728
- C:\Windows\System\nMquPkV.exe
  C:\Windows\System\nMquPkV.exe
  2⤵
  PID:3744
- C:\Windows\System\TbDEbfE.exe
  C:\Windows\System\TbDEbfE.exe
  2⤵
  PID:3760
- C:\Windows\System\PMBqATv.exe
  C:\Windows\System\PMBqATv.exe
  2⤵
  PID:3780
- C:\Windows\System\ObmtQnA.exe
  C:\Windows\System\ObmtQnA.exe
  2⤵
  PID:3796
- C:\Windows\System\SaqRChm.exe
  C:\Windows\System\SaqRChm.exe
  2⤵
  PID:3812
- C:\Windows\System\vOWxKQH.exe
  C:\Windows\System\vOWxKQH.exe
  2⤵
  PID:3832
- C:\Windows\System\kTvSmYx.exe
  C:\Windows\System\kTvSmYx.exe
  2⤵
  PID:3852
- C:\Windows\System\ycDnhPd.exe
  C:\Windows\System\ycDnhPd.exe
  2⤵
  PID:3896
- C:\Windows\System\YBnHpkQ.exe
  C:\Windows\System\YBnHpkQ.exe
  2⤵
  PID:3912
- C:\Windows\System\tInsYvY.exe
  C:\Windows\System\tInsYvY.exe
  2⤵
  PID:3928
- C:\Windows\System\qccHaYq.exe
  C:\Windows\System\qccHaYq.exe
  2⤵
  PID:3944
- C:\Windows\System\bzLqCcR.exe
  C:\Windows\System\bzLqCcR.exe
  2⤵
  PID:3960
- C:\Windows\System\KdCFOjA.exe
  C:\Windows\System\KdCFOjA.exe
  2⤵
  PID:3976
- C:\Windows\System\LQfVIwX.exe
  C:\Windows\System\LQfVIwX.exe
  2⤵
  PID:3992
- C:\Windows\System\FbmSuuy.exe
  C:\Windows\System\FbmSuuy.exe
  2⤵
  PID:4008
- C:\Windows\System\ntXIapU.exe
  C:\Windows\System\ntXIapU.exe
  2⤵
  PID:4024
- C:\Windows\System\bvHTOrI.exe
  C:\Windows\System\bvHTOrI.exe
  2⤵
  PID:4044
- C:\Windows\System\ZtRhBaP.exe
  C:\Windows\System\ZtRhBaP.exe
  2⤵
  PID:4060
- C:\Windows\System\EleAEVm.exe
  C:\Windows\System\EleAEVm.exe
  2⤵
  PID:4076
- C:\Windows\System\qYjXojX.exe
  C:\Windows\System\qYjXojX.exe
  2⤵
  PID:4092
- C:\Windows\System\hNedLAt.exe
  C:\Windows\System\hNedLAt.exe
  2⤵
  PID:2448
- C:\Windows\System\eHbpKFA.exe
  C:\Windows\System\eHbpKFA.exe
  2⤵
  PID:2992
- C:\Windows\System\zLkubAG.exe
  C:\Windows\System\zLkubAG.exe
  2⤵
  PID:2016
- C:\Windows\System\grjlEcS.exe
  C:\Windows\System\grjlEcS.exe
  2⤵
  PID:1304
- C:\Windows\System\dxDjlUH.exe
  C:\Windows\System\dxDjlUH.exe
  2⤵
  PID:2780
- C:\Windows\System\EwtinUI.exe
  C:\Windows\System\EwtinUI.exe
  2⤵
  PID:2636
- C:\Windows\System\ATbALPf.exe
  C:\Windows\System\ATbALPf.exe
  2⤵
  PID:2984
- C:\Windows\System\qEwNXue.exe
  C:\Windows\System\qEwNXue.exe
  2⤵
  PID:1536
- C:\Windows\System\CrRzHmi.exe
  C:\Windows\System\CrRzHmi.exe
  2⤵
  PID:2680
- C:\Windows\System\dLLGfoY.exe
  C:\Windows\System\dLLGfoY.exe
  2⤵
  PID:988
- C:\Windows\System\kxtIYEB.exe
  C:\Windows\System\kxtIYEB.exe
  2⤵
  PID:1076
- C:\Windows\System\yONAGDP.exe
  C:\Windows\System\yONAGDP.exe
  2⤵
  PID:1728
- C:\Windows\System\omSDhYR.exe
  C:\Windows\System\omSDhYR.exe
  2⤵
  PID:3080
- C:\Windows\System\OmlbOLx.exe
  C:\Windows\System\OmlbOLx.exe
  2⤵
  PID:3116
- C:\Windows\System\nOUziTc.exe
  C:\Windows\System\nOUziTc.exe
  2⤵
  PID:3180
- C:\Windows\System\drmWmQM.exe
  C:\Windows\System\drmWmQM.exe
  2⤵
  PID:3244
- C:\Windows\System\nrhtwUt.exe
  C:\Windows\System\nrhtwUt.exe
  2⤵
  PID:3308
- C:\Windows\System\VfSqMYm.exe
  C:\Windows\System\VfSqMYm.exe
  2⤵
  PID:3372
- C:\Windows\System\yTajiOn.exe
  C:\Windows\System\yTajiOn.exe
  2⤵
  PID:2168
- C:\Windows\System\EJNtZxr.exe
  C:\Windows\System\EJNtZxr.exe
  2⤵
  PID:1516
- C:\Windows\System\XNgalZa.exe
  C:\Windows\System\XNgalZa.exe
  2⤵
  PID:2412
- C:\Windows\System\LJnGOmq.exe
  C:\Windows\System\LJnGOmq.exe
  2⤵
  PID:1740
- C:\Windows\System\vFKiMxh.exe
  C:\Windows\System\vFKiMxh.exe
  2⤵
  PID:2624
- C:\Windows\System\PfictIR.exe
  C:\Windows\System\PfictIR.exe
  2⤵
  PID:2520
- C:\Windows\System\aHAFAlJ.exe
  C:\Windows\System\aHAFAlJ.exe
  2⤵
  PID:696
- C:\Windows\System\RLAgdux.exe
  C:\Windows\System\RLAgdux.exe
  2⤵
  PID:3756
- C:\Windows\System\vToXuww.exe
  C:\Windows\System\vToXuww.exe
  2⤵
  PID:3824
- C:\Windows\System\oOKlLpZ.exe
  C:\Windows\System\oOKlLpZ.exe
  2⤵
  PID:3868
- C:\Windows\System\ISXqJzf.exe
  C:\Windows\System\ISXqJzf.exe
  2⤵
  PID:3884
- C:\Windows\System\mwzoIdg.exe
  C:\Windows\System\mwzoIdg.exe
  2⤵
  PID:3924
- C:\Windows\System\GVsKtWV.exe
  C:\Windows\System\GVsKtWV.exe
  2⤵
  PID:3988
- C:\Windows\System\uyMPxuw.exe
  C:\Windows\System\uyMPxuw.exe
  2⤵
  PID:4056
- C:\Windows\System\JdUIoSS.exe
  C:\Windows\System\JdUIoSS.exe
  2⤵
  PID:3032
- C:\Windows\System\mFDQdeJ.exe
  C:\Windows\System\mFDQdeJ.exe
  2⤵
  PID:2756
- C:\Windows\System\JMjmXfG.exe
  C:\Windows\System\JMjmXfG.exe
  2⤵
  PID:1904
- C:\Windows\System\PIsyKGd.exe
  C:\Windows\System\PIsyKGd.exe
  2⤵
  PID:3112
- C:\Windows\System\MuJzmQs.exe
  C:\Windows\System\MuJzmQs.exe
  2⤵
  PID:3368
- C:\Windows\System\EcduHBf.exe
  C:\Windows\System\EcduHBf.exe
  2⤵
  PID:2968
- C:\Windows\System\AvsJmuo.exe
  C:\Windows\System\AvsJmuo.exe
  2⤵
  PID:1784
- C:\Windows\System\UTvMpuC.exe
  C:\Windows\System\UTvMpuC.exe
  2⤵
  PID:1952
- C:\Windows\System\rJWbuUJ.exe
  C:\Windows\System\rJWbuUJ.exe
  2⤵
  PID:1692
- C:\Windows\System\vooUsTv.exe
  C:\Windows\System\vooUsTv.exe
  2⤵
  PID:3040
- C:\Windows\System\Pakvtne.exe
  C:\Windows\System\Pakvtne.exe
  2⤵
  PID:1892
- C:\Windows\System\WnZsKWj.exe
  C:\Windows\System\WnZsKWj.exe
  2⤵
  PID:3132
- C:\Windows\System\zcZKiuI.exe
  C:\Windows\System\zcZKiuI.exe
  2⤵
  PID:4108
- C:\Windows\System\xeHTAKw.exe
  C:\Windows\System\xeHTAKw.exe
  2⤵
  PID:4124
- C:\Windows\System\WfoZsgM.exe
  C:\Windows\System\WfoZsgM.exe
  2⤵
  PID:4144
- C:\Windows\System\WDURIvz.exe
  C:\Windows\System\WDURIvz.exe
  2⤵
  PID:4160
- C:\Windows\System\fwMosXx.exe
  C:\Windows\System\fwMosXx.exe
  2⤵
  PID:4176
- C:\Windows\System\TUHkaWf.exe
  C:\Windows\System\TUHkaWf.exe
  2⤵
  PID:4196
- C:\Windows\System\XUvlklL.exe
  C:\Windows\System\XUvlklL.exe
  2⤵
  PID:4212
- C:\Windows\System\gGUlcVC.exe
  C:\Windows\System\gGUlcVC.exe
  2⤵
  PID:4228
- C:\Windows\System\FCUUFCQ.exe
  C:\Windows\System\FCUUFCQ.exe
  2⤵
  PID:4244
- C:\Windows\System\dAQmNeE.exe
  C:\Windows\System\dAQmNeE.exe
  2⤵
  PID:4260
- C:\Windows\System\LHdwgBb.exe
  C:\Windows\System\LHdwgBb.exe
  2⤵
  PID:4280
- C:\Windows\System\JxVTUBL.exe
  C:\Windows\System\JxVTUBL.exe
  2⤵
  PID:4296
- C:\Windows\System\RuVYWzq.exe
  C:\Windows\System\RuVYWzq.exe
  2⤵
  PID:4312
- C:\Windows\System\vytNjKS.exe
  C:\Windows\System\vytNjKS.exe
  2⤵
  PID:4328
- C:\Windows\System\KsPoriP.exe
  C:\Windows\System\KsPoriP.exe
  2⤵
  PID:4344
- C:\Windows\System\lhVeaiL.exe
  C:\Windows\System\lhVeaiL.exe
  2⤵
  PID:4360
- C:\Windows\System\vbpiRrH.exe
  C:\Windows\System\vbpiRrH.exe
  2⤵
  PID:4376
- C:\Windows\System\EPZJKiD.exe
  C:\Windows\System\EPZJKiD.exe
  2⤵
  PID:4396
- C:\Windows\System\VwDjblZ.exe
  C:\Windows\System\VwDjblZ.exe
  2⤵
  PID:4412
- C:\Windows\System\DSmsGkN.exe
  C:\Windows\System\DSmsGkN.exe
  2⤵
  PID:4432
- C:\Windows\System\NYSYBlz.exe
  C:\Windows\System\NYSYBlz.exe
  2⤵
  PID:4448
- C:\Windows\System\qlPbCSg.exe
  C:\Windows\System\qlPbCSg.exe
  2⤵
  PID:4464
- C:\Windows\System\rxpUjZp.exe
  C:\Windows\System\rxpUjZp.exe
  2⤵
  PID:4480
- C:\Windows\System\mftsDsE.exe
  C:\Windows\System\mftsDsE.exe
  2⤵
  PID:4496
- C:\Windows\System\WoknWWs.exe
  C:\Windows\System\WoknWWs.exe
  2⤵
  PID:4512
- C:\Windows\System\VwCBKat.exe
  C:\Windows\System\VwCBKat.exe
  2⤵
  PID:4532
- C:\Windows\System\MGAzfid.exe
  C:\Windows\System\MGAzfid.exe
  2⤵
  PID:4548
- C:\Windows\System\FPOqPft.exe
  C:\Windows\System\FPOqPft.exe
  2⤵
  PID:4564
- C:\Windows\System\NHwkQwk.exe
  C:\Windows\System\NHwkQwk.exe
  2⤵
  PID:4580
- C:\Windows\System\bXWBomQ.exe
  C:\Windows\System\bXWBomQ.exe
  2⤵
  PID:4596
- C:\Windows\System\aCBExEm.exe
  C:\Windows\System\aCBExEm.exe
  2⤵
  PID:4612
- C:\Windows\System\IcmGtUd.exe
  C:\Windows\System\IcmGtUd.exe
  2⤵
  PID:4632
- C:\Windows\System\uFtWSFa.exe
  C:\Windows\System\uFtWSFa.exe
  2⤵
  PID:4648
- C:\Windows\System\Agbruys.exe
  C:\Windows\System\Agbruys.exe
  2⤵
  PID:4668
- C:\Windows\System\ZpIrCsv.exe
  C:\Windows\System\ZpIrCsv.exe
  2⤵
  PID:4684
- C:\Windows\System\PuMiNwp.exe
  C:\Windows\System\PuMiNwp.exe
  2⤵
  PID:4700
- C:\Windows\System\RCSeIAk.exe
  C:\Windows\System\RCSeIAk.exe
  2⤵
  PID:4716
- C:\Windows\System\knLZihP.exe
  C:\Windows\System\knLZihP.exe
  2⤵
  PID:4732
- C:\Windows\System\JsVDxFU.exe
  C:\Windows\System\JsVDxFU.exe
  2⤵
  PID:4752
- C:\Windows\System\hugDgsm.exe
  C:\Windows\System\hugDgsm.exe
  2⤵
  PID:4768
- C:\Windows\System\vsnhdFp.exe
  C:\Windows\System\vsnhdFp.exe
  2⤵
  PID:4784
- C:\Windows\System\LzrCdsu.exe
  C:\Windows\System\LzrCdsu.exe
  2⤵
  PID:4800
- C:\Windows\System\KCSREQm.exe
  C:\Windows\System\KCSREQm.exe
  2⤵
  PID:4816
- C:\Windows\System\VRyqInS.exe
  C:\Windows\System\VRyqInS.exe
  2⤵
  PID:4832
- C:\Windows\System\XEYkAZJ.exe
  C:\Windows\System\XEYkAZJ.exe
  2⤵
  PID:4852
- C:\Windows\System\FCpAtFw.exe
  C:\Windows\System\FCpAtFw.exe
  2⤵
  PID:4868
- C:\Windows\System\aWtcKkW.exe
  C:\Windows\System\aWtcKkW.exe
  2⤵
  PID:4884
- C:\Windows\System\vPfxlsp.exe
  C:\Windows\System\vPfxlsp.exe
  2⤵
  PID:4900
- C:\Windows\System\iJGUrPT.exe
  C:\Windows\System\iJGUrPT.exe
  2⤵
  PID:4916
- C:\Windows\System\UmIoFyc.exe
  C:\Windows\System\UmIoFyc.exe
  2⤵
  PID:4932
- C:\Windows\System\arqFbKe.exe
  C:\Windows\System\arqFbKe.exe
  2⤵
  PID:4948
- C:\Windows\System\OnsslrO.exe
  C:\Windows\System\OnsslrO.exe
  2⤵
  PID:4968
- C:\Windows\System\amAZwmc.exe
  C:\Windows\System\amAZwmc.exe
  2⤵
  PID:4984
- C:\Windows\System\USgRMOq.exe
  C:\Windows\System\USgRMOq.exe
  2⤵
  PID:5000
- C:\Windows\System\sauVbqA.exe
  C:\Windows\System\sauVbqA.exe
  2⤵
  PID:5016
- C:\Windows\System\hMDeRzx.exe
  C:\Windows\System\hMDeRzx.exe
  2⤵
  PID:5032
- C:\Windows\System\KlJoMgo.exe
  C:\Windows\System\KlJoMgo.exe
  2⤵
  PID:5048
- C:\Windows\System\aBOsUFc.exe
  C:\Windows\System\aBOsUFc.exe
  2⤵
  PID:5068
- C:\Windows\System\QfVGtXC.exe
  C:\Windows\System\QfVGtXC.exe
  2⤵
  PID:5084
- C:\Windows\System\DyUihoz.exe
  C:\Windows\System\DyUihoz.exe
  2⤵
  PID:5100
- C:\Windows\System\gkSLbaB.exe
  C:\Windows\System\gkSLbaB.exe
  2⤵
  PID:5116
- C:\Windows\System\QMVQtmf.exe
  C:\Windows\System\QMVQtmf.exe
  2⤵
  PID:3292
- C:\Windows\System\vhECtyg.exe
  C:\Windows\System\vhECtyg.exe
  2⤵
  PID:3388
- C:\Windows\System\lWpIPKS.exe
  C:\Windows\System\lWpIPKS.exe
  2⤵
  PID:3484
- C:\Windows\System\jNEYGKS.exe
  C:\Windows\System\jNEYGKS.exe
  2⤵
  PID:3576
- C:\Windows\System\agOurOi.exe
  C:\Windows\System\agOurOi.exe
  2⤵
  PID:5132
- C:\Windows\System\DcWtYdN.exe
  C:\Windows\System\DcWtYdN.exe
  2⤵
  PID:5152
- C:\Windows\System\WAbAlLm.exe
  C:\Windows\System\WAbAlLm.exe
  2⤵
  PID:5168
- C:\Windows\System\dgNjeRA.exe
  C:\Windows\System\dgNjeRA.exe
  2⤵
  PID:5184
- C:\Windows\System\kepqiPC.exe
  C:\Windows\System\kepqiPC.exe
  2⤵
  PID:5200
- C:\Windows\System\JmkRAqn.exe
  C:\Windows\System\JmkRAqn.exe
  2⤵
  PID:5216
- C:\Windows\System\sahMmZE.exe
  C:\Windows\System\sahMmZE.exe
  2⤵
  PID:5296
- C:\Windows\System\FpCXqbn.exe
  C:\Windows\System\FpCXqbn.exe
  2⤵
  PID:5312
- C:\Windows\System\OgDfaDk.exe
  C:\Windows\System\OgDfaDk.exe
  2⤵
  PID:5328
- C:\Windows\System\LtxJTfQ.exe
  C:\Windows\System\LtxJTfQ.exe
  2⤵
  PID:5344
- C:\Windows\System\nHIebOn.exe
  C:\Windows\System\nHIebOn.exe
  2⤵
  PID:5360
- C:\Windows\System\VnGMuwQ.exe
  C:\Windows\System\VnGMuwQ.exe
  2⤵
  PID:5376
- C:\Windows\System\bBpScTl.exe
  C:\Windows\System\bBpScTl.exe
  2⤵
  PID:5392
- C:\Windows\System\fCMomKq.exe
  C:\Windows\System\fCMomKq.exe
  2⤵
  PID:5408
- C:\Windows\System\NsVMpfb.exe
  C:\Windows\System\NsVMpfb.exe
  2⤵
  PID:5424
- C:\Windows\System\zkHOimh.exe
  C:\Windows\System\zkHOimh.exe
  2⤵
  PID:5440
- C:\Windows\System\tAXJzEx.exe
  C:\Windows\System\tAXJzEx.exe
  2⤵
  PID:5456
- C:\Windows\System\NuuFpOw.exe
  C:\Windows\System\NuuFpOw.exe
  2⤵
  PID:5472
- C:\Windows\System\RZObONN.exe
  C:\Windows\System\RZObONN.exe
  2⤵
  PID:5488
- C:\Windows\System\jjBHfEt.exe
  C:\Windows\System\jjBHfEt.exe
  2⤵
  PID:5504
- C:\Windows\System\DQhnHWm.exe
  C:\Windows\System\DQhnHWm.exe
  2⤵
  PID:5520
- C:\Windows\System\iYDpkFy.exe
  C:\Windows\System\iYDpkFy.exe
  2⤵
  PID:5536
- C:\Windows\System\yyljLBK.exe
  C:\Windows\System\yyljLBK.exe
  2⤵
  PID:5552
- C:\Windows\System\oFWacHD.exe
  C:\Windows\System\oFWacHD.exe
  2⤵
  PID:5568
- C:\Windows\System\onWJZEy.exe
  C:\Windows\System\onWJZEy.exe
  2⤵
  PID:5584
- C:\Windows\System\hwNibOT.exe
  C:\Windows\System\hwNibOT.exe
  2⤵
  PID:5600
- C:\Windows\System\wWBxEUe.exe
  C:\Windows\System\wWBxEUe.exe
  2⤵
  PID:5616
- C:\Windows\System\paZBByv.exe
  C:\Windows\System\paZBByv.exe
  2⤵
  PID:5632
- C:\Windows\System\ksZuKHr.exe
  C:\Windows\System\ksZuKHr.exe
  2⤵
  PID:5648
- C:\Windows\System\aAROxyJ.exe
  C:\Windows\System\aAROxyJ.exe
  2⤵
  PID:5664
- C:\Windows\System\kllsMmp.exe
  C:\Windows\System\kllsMmp.exe
  2⤵
  PID:5680
- C:\Windows\System\LgVLBUZ.exe
  C:\Windows\System\LgVLBUZ.exe
  2⤵
  PID:5696
- C:\Windows\System\nGviBTv.exe
  C:\Windows\System\nGviBTv.exe
  2⤵
  PID:5712
- C:\Windows\System\JeXfpXC.exe
  C:\Windows\System\JeXfpXC.exe
  2⤵
  PID:5736
- C:\Windows\System\cZgApYl.exe
  C:\Windows\System\cZgApYl.exe
  2⤵
  PID:5752
- C:\Windows\System\woOvAFX.exe
  C:\Windows\System\woOvAFX.exe
  2⤵
  PID:5768
- C:\Windows\System\qEilyiL.exe
  C:\Windows\System\qEilyiL.exe
  2⤵
  PID:5784
- C:\Windows\System\jqxluDQ.exe
  C:\Windows\System\jqxluDQ.exe
  2⤵
  PID:5808
- C:\Windows\System\AiGmSlz.exe
  C:\Windows\System\AiGmSlz.exe
  2⤵
  PID:5824
- C:\Windows\System\EPUFDwb.exe
  C:\Windows\System\EPUFDwb.exe
  2⤵
  PID:5840
- C:\Windows\System\GQelcTq.exe
  C:\Windows\System\GQelcTq.exe
  2⤵
  PID:5856
- C:\Windows\System\CepRosM.exe
  C:\Windows\System\CepRosM.exe
  2⤵
  PID:5872
- C:\Windows\System\fzfiNda.exe
  C:\Windows\System\fzfiNda.exe
  2⤵
  PID:5888
- C:\Windows\System\yEnEora.exe
  C:\Windows\System\yEnEora.exe
  2⤵
  PID:5916
- C:\Windows\System\BSjTTcF.exe
  C:\Windows\System\BSjTTcF.exe
  2⤵
  PID:5936
- C:\Windows\System\BGzzcYX.exe
  C:\Windows\System\BGzzcYX.exe
  2⤵
  PID:5952
- C:\Windows\System\osvFKUC.exe
  C:\Windows\System\osvFKUC.exe
  2⤵
  PID:5972
- C:\Windows\System\cttcStK.exe
  C:\Windows\System\cttcStK.exe
  2⤵
  PID:5992
- C:\Windows\System\jaPQesD.exe
  C:\Windows\System\jaPQesD.exe
  2⤵
  PID:6012
- C:\Windows\System\JNjMVAU.exe
  C:\Windows\System\JNjMVAU.exe
  2⤵
  PID:6032
- C:\Windows\System\xUAaYfk.exe
  C:\Windows\System\xUAaYfk.exe
  2⤵
  PID:6056
- C:\Windows\System\xmWWMbf.exe
  C:\Windows\System\xmWWMbf.exe
  2⤵
  PID:6076
- C:\Windows\System\mHlIYpa.exe
  C:\Windows\System\mHlIYpa.exe
  2⤵
  PID:6092
- C:\Windows\System\rmqzFIt.exe
  C:\Windows\System\rmqzFIt.exe
  2⤵
  PID:6108
- C:\Windows\System\zTRxAIC.exe
  C:\Windows\System\zTRxAIC.exe
  2⤵
  PID:6124
- C:\Windows\System\buBYrPv.exe
  C:\Windows\System\buBYrPv.exe
  2⤵
  PID:6140
- C:\Windows\System\pWlBtzO.exe
  C:\Windows\System\pWlBtzO.exe
  2⤵
  PID:3704
- C:\Windows\System\iXkQjul.exe
  C:\Windows\System\iXkQjul.exe
  2⤵
  PID:3772
- C:\Windows\System\duBOnOs.exe
  C:\Windows\System\duBOnOs.exe
  2⤵
  PID:3808
- C:\Windows\System\gTtcsNS.exe
  C:\Windows\System\gTtcsNS.exe
  2⤵
  PID:3844
- C:\Windows\System\BpLCZUt.exe
  C:\Windows\System\BpLCZUt.exe
  2⤵
  PID:3904
- C:\Windows\System\RuNQfMs.exe
  C:\Windows\System\RuNQfMs.exe
  2⤵
  PID:3968
- C:\Windows\System\RsXIkeW.exe
  C:\Windows\System\RsXIkeW.exe
  2⤵
  PID:3892
- C:\Windows\System\CfgYXhP.exe
  C:\Windows\System\CfgYXhP.exe
  2⤵
  PID:4032
- C:\Windows\System\saDyXgo.exe
  C:\Windows\System\saDyXgo.exe
  2⤵
  PID:2640
- C:\Windows\System\iFWNPQC.exe
  C:\Windows\System\iFWNPQC.exe
  2⤵
  PID:1868
- C:\Windows\System\JKKdEuj.exe
  C:\Windows\System\JKKdEuj.exe
  2⤵
  PID:2792
- C:\Windows\System\GAMyMEY.exe
  C:\Windows\System\GAMyMEY.exe
  2⤵
  PID:2776
- C:\Windows\System\sWQaNDH.exe
  C:\Windows\System\sWQaNDH.exe
  2⤵
  PID:636
- C:\Windows\System\nluEKNT.exe
  C:\Windows\System\nluEKNT.exe
  2⤵
  PID:1264
- C:\Windows\System\xekuoem.exe
  C:\Windows\System\xekuoem.exe
  2⤵
  PID:2036
- C:\Windows\System\uxYRADs.exe
  C:\Windows\System\uxYRADs.exe
  2⤵
  PID:2184
- C:\Windows\System\JeNJvAt.exe
  C:\Windows\System\JeNJvAt.exe
  2⤵
  PID:4120
- C:\Windows\System\QPXTMhy.exe
  C:\Windows\System\QPXTMhy.exe
  2⤵
  PID:4188
- C:\Windows\System\wyXfBZC.exe
  C:\Windows\System\wyXfBZC.exe
  2⤵
  PID:4252
- C:\Windows\System\HabIlDk.exe
  C:\Windows\System\HabIlDk.exe
  2⤵
  PID:4320
- C:\Windows\System\HyNiHnW.exe
  C:\Windows\System\HyNiHnW.exe
  2⤵
  PID:4384
- C:\Windows\System\ncmWLtQ.exe
  C:\Windows\System\ncmWLtQ.exe
  2⤵
  PID:4424
- C:\Windows\System\jKoDgik.exe
  C:\Windows\System\jKoDgik.exe
  2⤵
  PID:4488
- C:\Windows\System\ebuhYYB.exe
  C:\Windows\System\ebuhYYB.exe
  2⤵
  PID:4528
- C:\Windows\System\jMsOLGP.exe
  C:\Windows\System\jMsOLGP.exe
  2⤵
  PID:4592
- C:\Windows\System\ewgArso.exe
  C:\Windows\System\ewgArso.exe
  2⤵
  PID:4656
- C:\Windows\System\atjgbdn.exe
  C:\Windows\System\atjgbdn.exe
  2⤵
  PID:4724
- C:\Windows\System\bkbqVcI.exe
  C:\Windows\System\bkbqVcI.exe
  2⤵
  PID:4760
- C:\Windows\System\fMepupD.exe
  C:\Windows\System\fMepupD.exe
  2⤵
  PID:4828
- C:\Windows\System\dAtPPJe.exe
  C:\Windows\System\dAtPPJe.exe
  2⤵
  PID:4896
- C:\Windows\System\YJLbmMF.exe
  C:\Windows\System\YJLbmMF.exe
  2⤵
  PID:4960
- C:\Windows\System\NaVbAnZ.exe
  C:\Windows\System\NaVbAnZ.exe
  2⤵
  PID:4996
- C:\Windows\System\VtJUYoc.exe
  C:\Windows\System\VtJUYoc.exe
  2⤵
  PID:5064
- C:\Windows\System\TBEyrzi.exe
  C:\Windows\System\TBEyrzi.exe
  2⤵
  PID:3288
- C:\Windows\System\yjUWnTd.exe
  C:\Windows\System\yjUWnTd.exe
  2⤵
  PID:5128
- C:\Windows\System\TAdVZSf.exe
  C:\Windows\System\TAdVZSf.exe
  2⤵
  PID:5196
- C:\Windows\System\EyNSenw.exe
  C:\Windows\System\EyNSenw.exe
  2⤵
  PID:5240
- C:\Windows\System\jnXTmYq.exe
  C:\Windows\System\jnXTmYq.exe
  2⤵
  PID:5256
- C:\Windows\System\BEnyviV.exe
  C:\Windows\System\BEnyviV.exe
  2⤵
  PID:5272
- C:\Windows\System\hdqPFrz.exe
  C:\Windows\System\hdqPFrz.exe
  2⤵
  PID:5288
- C:\Windows\System\QXeNlps.exe
  C:\Windows\System\QXeNlps.exe
  2⤵
  PID:1948
- C:\Windows\System\qCoGkiK.exe
  C:\Windows\System\qCoGkiK.exe
  2⤵
  PID:3164
- C:\Windows\System\tCvkrKv.exe
  C:\Windows\System\tCvkrKv.exe
  2⤵
  PID:3192
- C:\Windows\System\tNwIHvf.exe
  C:\Windows\System\tNwIHvf.exe
  2⤵
  PID:3260
- C:\Windows\System\gzFAPti.exe
  C:\Windows\System\gzFAPti.exe
  2⤵
  PID:5356
- C:\Windows\System\NOBZkAb.exe
  C:\Windows\System\NOBZkAb.exe
  2⤵
  PID:5420
- C:\Windows\System\kpmgUOj.exe
  C:\Windows\System\kpmgUOj.exe
  2⤵
  PID:5484
- C:\Windows\System\AMgfCmw.exe
  C:\Windows\System\AMgfCmw.exe
  2⤵
  PID:4644
- C:\Windows\System\FUjtrTL.exe
  C:\Windows\System\FUjtrTL.exe
  2⤵
  PID:4680
- C:\Windows\System\gRXcsCa.exe
  C:\Windows\System\gRXcsCa.exe
  2⤵
  PID:4776
- C:\Windows\System\ofZtXeA.exe
  C:\Windows\System\ofZtXeA.exe
  2⤵
  PID:868
- C:\Windows\System\rjFAHaA.exe
  C:\Windows\System\rjFAHaA.exe
  2⤵
  PID:5548
- C:\Windows\System\VTBUGRS.exe
  C:\Windows\System\VTBUGRS.exe
  2⤵
  PID:3548
- C:\Windows\System\DwyUfOC.exe
  C:\Windows\System\DwyUfOC.exe
  2⤵
  PID:5108
- C:\Windows\System\bAGBXCz.exe
  C:\Windows\System\bAGBXCz.exe
  2⤵
  PID:5612
- C:\Windows\System\NmMajXc.exe
  C:\Windows\System\NmMajXc.exe
  2⤵
  PID:3612
- C:\Windows\System\sCqhOLg.exe
  C:\Windows\System\sCqhOLg.exe
  2⤵
  PID:3644
- C:\Windows\System\IKuTvLa.exe
  C:\Windows\System\IKuTvLa.exe
  2⤵
  PID:1288
- C:\Windows\System\QnNSQak.exe
  C:\Windows\System\QnNSQak.exe
  2⤵
  PID:5304
- C:\Windows\System\VxQPTSm.exe
  C:\Windows\System\VxQPTSm.exe
  2⤵
  PID:5308
- C:\Windows\System\UGHhlUk.exe
  C:\Windows\System\UGHhlUk.exe
  2⤵
  PID:2588
- C:\Windows\System\yrOWRVQ.exe
  C:\Windows\System\yrOWRVQ.exe
  2⤵
  PID:5176
- C:\Windows\System\YUxUvDf.exe
  C:\Windows\System\YUxUvDf.exe
  2⤵
  PID:3404
- C:\Windows\System\oUqyMkM.exe
  C:\Windows\System\oUqyMkM.exe
  2⤵
  PID:3464
- C:\Windows\System\qyvDFVw.exe
  C:\Windows\System\qyvDFVw.exe
  2⤵
  PID:3528
- C:\Windows\System\peHNcVY.exe
  C:\Windows\System\peHNcVY.exe
  2⤵
  PID:3592
- C:\Windows\System\fLHozbH.exe
  C:\Windows\System\fLHozbH.exe
  2⤵
  PID:3656
- C:\Windows\System\BVqREhI.exe
  C:\Windows\System\BVqREhI.exe
  2⤵
  PID:3692
- C:\Windows\System\VEJWJea.exe
  C:\Windows\System\VEJWJea.exe
  2⤵
  PID:1672
- C:\Windows\System\LoDrvRT.exe
  C:\Windows\System\LoDrvRT.exe
  2⤵
  PID:2812
- C:\Windows\System\fesstwO.exe
  C:\Windows\System\fesstwO.exe
  2⤵
  PID:3876
- C:\Windows\System\yOVHbDu.exe
  C:\Windows\System\yOVHbDu.exe
  2⤵
  PID:4088
- C:\Windows\System\zOHBmKy.exe
  C:\Windows\System\zOHBmKy.exe
  2⤵
  PID:1656
- C:\Windows\System\mZVkWAR.exe
  C:\Windows\System\mZVkWAR.exe
  2⤵
  PID:1436
- C:\Windows\System\cRTgVAG.exe
  C:\Windows\System\cRTgVAG.exe
  2⤵
  PID:2892
- C:\Windows\System\zjWltdN.exe
  C:\Windows\System\zjWltdN.exe
  2⤵
  PID:4136
- C:\Windows\System\jLjoRCH.exe
  C:\Windows\System\jLjoRCH.exe
  2⤵
  PID:4172
- C:\Windows\System\IFJlRUN.exe
  C:\Windows\System\IFJlRUN.exe
  2⤵
  PID:4240
- C:\Windows\System\UoJpaku.exe
  C:\Windows\System\UoJpaku.exe
  2⤵
  PID:4304
- C:\Windows\System\RDnItfA.exe
  C:\Windows\System\RDnItfA.exe
  2⤵
  PID:4368
- C:\Windows\System\iMOOvTi.exe
  C:\Windows\System\iMOOvTi.exe
  2⤵
  PID:4440
- C:\Windows\System\rXItKBF.exe
  C:\Windows\System\rXItKBF.exe
  2⤵
  PID:4504
- C:\Windows\System\hjfbQcY.exe
  C:\Windows\System\hjfbQcY.exe
  2⤵
  PID:4572
- C:\Windows\System\aBeHUaX.exe
  C:\Windows\System\aBeHUaX.exe
  2⤵
  PID:4840
- C:\Windows\System\ycFYbGt.exe
  C:\Windows\System\ycFYbGt.exe
  2⤵
  PID:4880
- C:\Windows\System\AQBatrZ.exe
  C:\Windows\System\AQBatrZ.exe
  2⤵
  PID:4944
- C:\Windows\System\HYKpiue.exe
  C:\Windows\System\HYKpiue.exe
  2⤵
  PID:5012
- C:\Windows\System\ZWmaExQ.exe
  C:\Windows\System\ZWmaExQ.exe
  2⤵
  PID:5336
- C:\Windows\System\rQImvuu.exe
  C:\Windows\System\rQImvuu.exe
  2⤵
  PID:5404
- C:\Windows\System\INgDpXA.exe
  C:\Windows\System\INgDpXA.exe
  2⤵
  PID:5776
- C:\Windows\System\XiYgWjV.exe
  C:\Windows\System\XiYgWjV.exe
  2⤵
  PID:5496
- C:\Windows\System\ItIVKhc.exe
  C:\Windows\System\ItIVKhc.exe
  2⤵
  PID:5564
- C:\Windows\System\CNJRanL.exe
  C:\Windows\System\CNJRanL.exe
  2⤵
  PID:5628
- C:\Windows\System\zlbsIgJ.exe
  C:\Windows\System\zlbsIgJ.exe
  2⤵
  PID:5780
- C:\Windows\System\jaRaBjM.exe
  C:\Windows\System\jaRaBjM.exe
  2⤵
  PID:5820
- C:\Windows\System\GogCqyF.exe
  C:\Windows\System\GogCqyF.exe
  2⤵
  PID:5852
- C:\Windows\System\HXGAeBz.exe
  C:\Windows\System\HXGAeBz.exe
  2⤵
  PID:5792
- C:\Windows\System\bhtCmtu.exe
  C:\Windows\System\bhtCmtu.exe
  2⤵
  PID:5868
- C:\Windows\System\YQgFLdk.exe
  C:\Windows\System\YQgFLdk.exe
  2⤵
  PID:5896
- C:\Windows\System\HRgCNXf.exe
  C:\Windows\System\HRgCNXf.exe
  2⤵
  PID:5944
- C:\Windows\System\sYKbPyh.exe
  C:\Windows\System\sYKbPyh.exe
  2⤵
  PID:6040
- C:\Windows\System\nrtCMtD.exe
  C:\Windows\System\nrtCMtD.exe
  2⤵
  PID:2296
- C:\Windows\System\UXDNmme.exe
  C:\Windows\System\UXDNmme.exe
  2⤵
  PID:6064
- C:\Windows\System\tPjUYJk.exe
  C:\Windows\System\tPjUYJk.exe
  2⤵
  PID:6104
- C:\Windows\System\ajvhzHs.exe
  C:\Windows\System\ajvhzHs.exe
  2⤵
  PID:3672
- C:\Windows\System\ZFNWPXn.exe
  C:\Windows\System\ZFNWPXn.exe
  2⤵
  PID:2660
- C:\Windows\System\KTcmKQc.exe
  C:\Windows\System\KTcmKQc.exe
  2⤵
  PID:2440
- C:\Windows\System\ECxJOWc.exe
  C:\Windows\System\ECxJOWc.exe
  2⤵
  PID:3936
- C:\Windows\System\NuoZysH.exe
  C:\Windows\System\NuoZysH.exe
  2⤵
  PID:4000
- C:\Windows\System\amyLoNw.exe
  C:\Windows\System\amyLoNw.exe
  2⤵
  PID:1372
- C:\Windows\System\WDVLupJ.exe
  C:\Windows\System\WDVLupJ.exe
  2⤵
  PID:3084
- C:\Windows\System\POqcfPz.exe
  C:\Windows\System\POqcfPz.exe
  2⤵
  PID:2132
- C:\Windows\System\XPTpVQF.exe
  C:\Windows\System\XPTpVQF.exe
  2⤵
  PID:3128
- C:\Windows\System\crLwPEV.exe
  C:\Windows\System\crLwPEV.exe
  2⤵
  PID:2896
- C:\Windows\System\tYPpzud.exe
  C:\Windows\System\tYPpzud.exe
  2⤵
  PID:4352
- C:\Windows\System\xhxLOCu.exe
  C:\Windows\System\xhxLOCu.exe
  2⤵
  PID:4456
- C:\Windows\System\MNAyDmA.exe
  C:\Windows\System\MNAyDmA.exe
  2⤵
  PID:4420
- C:\Windows\System\xSVLoMc.exe
  C:\Windows\System\xSVLoMc.exe
  2⤵
  PID:4664
- C:\Windows\System\nCXeDIZ.exe
  C:\Windows\System\nCXeDIZ.exe
  2⤵
  PID:4628
- C:\Windows\System\akUOqcg.exe
  C:\Windows\System\akUOqcg.exe
  2⤵
  PID:4928
- C:\Windows\System\fRLdGfx.exe
  C:\Windows\System\fRLdGfx.exe
  2⤵
  PID:4864
- C:\Windows\System\qTouhWw.exe
  C:\Windows\System\qTouhWw.exe
  2⤵
  PID:4992
- C:\Windows\System\yHflaUy.exe
  C:\Windows\System\yHflaUy.exe
  2⤵
  PID:1964
- C:\Windows\System\PLnoSZO.exe
  C:\Windows\System\PLnoSZO.exe
  2⤵
  PID:1848
- C:\Windows\System\hJWBJlR.exe
  C:\Windows\System\hJWBJlR.exe
  2⤵
  PID:5096
- C:\Windows\System\osTInZG.exe
  C:\Windows\System\osTInZG.exe
  2⤵
  PID:5192
- C:\Windows\System\CFDEePE.exe
  C:\Windows\System\CFDEePE.exe
  2⤵
  PID:5264
- C:\Windows\System\VfviTFE.exe
  C:\Windows\System\VfviTFE.exe
  2⤵
  PID:2524
- C:\Windows\System\ldjNxMj.exe
  C:\Windows\System\ldjNxMj.exe
  2⤵
  PID:2092
- C:\Windows\System\yTLbFGs.exe
  C:\Windows\System\yTLbFGs.exe
  2⤵
  PID:5352
- C:\Windows\System\FSJAsTY.exe
  C:\Windows\System\FSJAsTY.exe
  2⤵
  PID:2504
- C:\Windows\System\vGeCEnq.exe
  C:\Windows\System\vGeCEnq.exe
  2⤵
  PID:3420
- C:\Windows\System\NHcMbjd.exe
  C:\Windows\System\NHcMbjd.exe
  2⤵
  PID:4808
- C:\Windows\System\ZqNJZqJ.exe
  C:\Windows\System\ZqNJZqJ.exe
  2⤵
  PID:4744
- C:\Windows\System\Dmoptzr.exe
  C:\Windows\System\Dmoptzr.exe
  2⤵
  PID:5040
- C:\Windows\System\UumvItM.exe
  C:\Windows\System\UumvItM.exe
  2⤵
  PID:3676
- C:\Windows\System\Jeqlxli.exe
  C:\Windows\System\Jeqlxli.exe
  2⤵
  PID:5608
- C:\Windows\System\EIbQAKs.exe
  C:\Windows\System\EIbQAKs.exe
  2⤵
  PID:3708
- C:\Windows\System\SxjdThI.exe
  C:\Windows\System\SxjdThI.exe
  2⤵
  PID:5672
- C:\Windows\System\HdyIWLq.exe
  C:\Windows\System\HdyIWLq.exe
  2⤵
  PID:3432
- C:\Windows\System\KFjPrkW.exe
  C:\Windows\System\KFjPrkW.exe
  2⤵
  PID:3660
- C:\Windows\System\pOQVqqt.exe
  C:\Windows\System\pOQVqqt.exe
  2⤵
  PID:3984
- C:\Windows\System\FSqDkYZ.exe
  C:\Windows\System\FSqDkYZ.exe
  2⤵
  PID:3008
- C:\Windows\System\ppfiTmK.exe
  C:\Windows\System\ppfiTmK.exe
  2⤵
  PID:4236
- C:\Windows\System\kNZMXXQ.exe
  C:\Windows\System\kNZMXXQ.exe
  2⤵
  PID:4476
- C:\Windows\System\rjACfjQ.exe
  C:\Windows\System\rjACfjQ.exe
  2⤵
  PID:4940
- C:\Windows\System\KYUJAqA.exe
  C:\Windows\System\KYUJAqA.exe
  2⤵
  PID:2320
- C:\Windows\System\rSLbnDM.exe
  C:\Windows\System\rSLbnDM.exe
  2⤵
  PID:5660
- C:\Windows\System\xaOQglr.exe
  C:\Windows\System\xaOQglr.exe
  2⤵
  PID:2996
- C:\Windows\System\ftNcZcw.exe
  C:\Windows\System\ftNcZcw.exe
  2⤵
  PID:5848
- C:\Windows\System\kQvLoHQ.exe
  C:\Windows\System\kQvLoHQ.exe
  2⤵
  PID:5864
- C:\Windows\System\XLrxRax.exe
  C:\Windows\System\XLrxRax.exe
  2⤵
  PID:2148
- C:\Windows\System\tKibXjx.exe
  C:\Windows\System\tKibXjx.exe
  2⤵
  PID:6100
- C:\Windows\System\dwzuPoK.exe
  C:\Windows\System\dwzuPoK.exe
  2⤵
  PID:3740
- C:\Windows\System\btGaLlM.exe
  C:\Windows\System\btGaLlM.exe
  2⤵
  PID:564
- C:\Windows\System\zlfALbE.exe
  C:\Windows\System\zlfALbE.exe
  2⤵
  PID:2856
- C:\Windows\System\lPgAwMd.exe
  C:\Windows\System\lPgAwMd.exe
  2⤵
  PID:4116
- C:\Windows\System\lYeXGZa.exe
  C:\Windows\System\lYeXGZa.exe
  2⤵
  PID:4980
- C:\Windows\System\kCwaLbo.exe
  C:\Windows\System\kCwaLbo.exe
  2⤵
  PID:5372
- C:\Windows\System\aEsvqdc.exe
  C:\Windows\System\aEsvqdc.exe
  2⤵
  PID:1528
- C:\Windows\System\mrqwcbK.exe
  C:\Windows\System\mrqwcbK.exe
  2⤵
  PID:5056
- C:\Windows\System\phtexdq.exe
  C:\Windows\System\phtexdq.exe
  2⤵
  PID:2652
- C:\Windows\System\STdeZrd.exe
  C:\Windows\System\STdeZrd.exe
  2⤵
  PID:5236
- C:\Windows\System\NOZnAVH.exe
  C:\Windows\System\NOZnAVH.exe
  2⤵
  PID:1616
- C:\Windows\System\AdjGmgT.exe
  C:\Windows\System\AdjGmgT.exe
  2⤵
  PID:3100
- C:\Windows\System\bNfiogJ.exe
  C:\Windows\System\bNfiogJ.exe
  2⤵
  PID:5320
- C:\Windows\System\IiyXcbj.exe
  C:\Windows\System\IiyXcbj.exe
  2⤵
  PID:3256
- C:\Windows\System\WegUPuL.exe
  C:\Windows\System\WegUPuL.exe
  2⤵
  PID:3276
- C:\Windows\System\yqHRCfi.exe
  C:\Windows\System\yqHRCfi.exe
  2⤵
  PID:3724
- C:\Windows\System\uELHRFo.exe
  C:\Windows\System\uELHRFo.exe
  2⤵
  PID:2768
- C:\Windows\System\SmJuXgg.exe
  C:\Windows\System\SmJuXgg.exe
  2⤵
  PID:2420
- C:\Windows\System\gtRqtnS.exe
  C:\Windows\System\gtRqtnS.exe
  2⤵
  PID:1760
- C:\Windows\System\WOIMzej.exe
  C:\Windows\System\WOIMzej.exe
  2⤵
  PID:4272
- C:\Windows\System\LsrjCkU.exe
  C:\Windows\System\LsrjCkU.exe
  2⤵
  PID:5140
- C:\Windows\System\JYfGfdT.exe
  C:\Windows\System\JYfGfdT.exe
  2⤵
  PID:5464
- C:\Windows\System\qkcWCTd.exe
  C:\Windows\System\qkcWCTd.exe
  2⤵
  PID:5724
- C:\Windows\System\uJmhmaX.exe
  C:\Windows\System\uJmhmaX.exe
  2⤵
  PID:5960
- C:\Windows\System\ZAuYKwJ.exe
  C:\Windows\System\ZAuYKwJ.exe
  2⤵
  PID:6116
- C:\Windows\System\dfuowCI.exe
  C:\Windows\System\dfuowCI.exe
  2⤵
  PID:6132
- C:\Windows\System\IKsLYEZ.exe
  C:\Windows\System\IKsLYEZ.exe
  2⤵
  PID:320
- C:\Windows\System\SAAfOGq.exe
  C:\Windows\System\SAAfOGq.exe
  2⤵
  PID:3864
- C:\Windows\System\jislvQB.exe
  C:\Windows\System\jislvQB.exe
  2⤵
  PID:5076
- C:\Windows\System\VwqGPov.exe
  C:\Windows\System\VwqGPov.exe
  2⤵
  PID:2468
- C:\Windows\System\SLRYOrH.exe
  C:\Windows\System\SLRYOrH.exe
  2⤵
  PID:4692
- C:\Windows\System\ATeOhUH.exe
  C:\Windows\System\ATeOhUH.exe
  2⤵
  PID:5124
- C:\Windows\System\RKQBizw.exe
  C:\Windows\System\RKQBizw.exe
  2⤵
  PID:2572
- C:\Windows\System\xUJqpWr.exe
  C:\Windows\System\xUJqpWr.exe
  2⤵
  PID:5416
- C:\Windows\System\PZCthOL.exe
  C:\Windows\System\PZCthOL.exe
  2⤵
  PID:5640
- C:\Windows\System\iOJCqqN.exe
  C:\Windows\System\iOJCqqN.exe
  2⤵
  PID:4912
- C:\Windows\System\qDpMugf.exe
  C:\Windows\System\qDpMugf.exe
  2⤵
  PID:2068
- C:\Windows\System\mlEsIcD.exe
  C:\Windows\System\mlEsIcD.exe
  2⤵
  PID:944
- C:\Windows\System\tDJQLdD.exe
  C:\Windows\System\tDJQLdD.exe
  2⤵
  PID:6004
- C:\Windows\System\uTWrRlT.exe
  C:\Windows\System\uTWrRlT.exe
  2⤵
  PID:1476
- C:\Windows\System\woLlWAF.exe
  C:\Windows\System\woLlWAF.exe
  2⤵
  PID:3840
- C:\Windows\System\aBMSHqR.exe
  C:\Windows\System\aBMSHqR.exe
  2⤵
  PID:6084
- C:\Windows\System\rWoLjpd.exe
  C:\Windows\System\rWoLjpd.exe
  2⤵
  PID:4520
- C:\Windows\System\hMQZniT.exe
  C:\Windows\System\hMQZniT.exe
  2⤵
  PID:3028
- C:\Windows\System\nSkNURl.exe
  C:\Windows\System\nSkNURl.exe
  2⤵
  PID:3804
- C:\Windows\System\MCSZxvN.exe
  C:\Windows\System\MCSZxvN.exe
  2⤵
  PID:784
- C:\Windows\System\Hssmydt.exe
  C:\Windows\System\Hssmydt.exe
  2⤵
  PID:2828
- C:\Windows\System\UVTcjqJ.exe
  C:\Windows\System\UVTcjqJ.exe
  2⤵
  PID:952
- C:\Windows\System\nGnxGwj.exe
  C:\Windows\System\nGnxGwj.exe
  2⤵
  PID:4404
- C:\Windows\System\MOtsKtB.exe
  C:\Windows\System\MOtsKtB.exe
  2⤵
  PID:4168
- C:\Windows\System\gqlvfek.exe
  C:\Windows\System\gqlvfek.exe
  2⤵
  PID:3628
- C:\Windows\System\NIAJyen.exe
  C:\Windows\System\NIAJyen.exe
  2⤵
  PID:4748
- C:\Windows\System\KQbyUPZ.exe
  C:\Windows\System\KQbyUPZ.exe
  2⤵
  PID:3384
- C:\Windows\System\PnxSpkS.exe
  C:\Windows\System\PnxSpkS.exe
  2⤵
  PID:5984
- C:\Windows\System\YUrxeDf.exe
  C:\Windows\System\YUrxeDf.exe
  2⤵
  PID:4392
- C:\Windows\System\kNHiron.exe
  C:\Windows\System\kNHiron.exe
  2⤵
  PID:2472
- C:\Windows\System\ZqegMZo.exe
  C:\Windows\System\ZqegMZo.exe
  2⤵
  PID:948
- C:\Windows\System\OHlgaSj.exe
  C:\Windows\System\OHlgaSj.exe
  2⤵
  PID:2500
- C:\Windows\System\lTLotBh.exe
  C:\Windows\System\lTLotBh.exe
  2⤵
  PID:5452
- C:\Windows\System\seQWUDU.exe
  C:\Windows\System\seQWUDU.exe
  2⤵
  PID:2324
- C:\Windows\System\nfRxCwC.exe
  C:\Windows\System\nfRxCwC.exe
  2⤵
  PID:5560
- C:\Windows\System\GMSiuuL.exe
  C:\Windows\System\GMSiuuL.exe
  2⤵
  PID:2824
- C:\Windows\System\SRoeYdW.exe
  C:\Windows\System\SRoeYdW.exe
  2⤵
  PID:2740
- C:\Windows\System\oIbsyQN.exe
  C:\Windows\System\oIbsyQN.exe
  2⤵
  PID:4356
- C:\Windows\System\SXxNQNj.exe
  C:\Windows\System\SXxNQNj.exe
  2⤵
  PID:2840
- C:\Windows\System\bJpVJWb.exe
  C:\Windows\System\bJpVJWb.exe
  2⤵
  PID:3496
- C:\Windows\System\AkpTPWV.exe
  C:\Windows\System\AkpTPWV.exe
  2⤵
  PID:3792
- C:\Windows\System\wencMQW.exe
  C:\Windows\System\wencMQW.exe
  2⤵
  PID:5268
- C:\Windows\System\LPKXeKy.exe
  C:\Windows\System\LPKXeKy.exe
  2⤵
  PID:5624
- C:\Windows\System\DqLipVo.exe
  C:\Windows\System\DqLipVo.exe
  2⤵
  PID:828
- C:\Windows\System\mBAavue.exe
  C:\Windows\System\mBAavue.exe
  2⤵
  PID:3564
- C:\Windows\System\MrxUZCO.exe
  C:\Windows\System\MrxUZCO.exe
  2⤵
  PID:1724
- C:\Windows\System\MzQJMtf.exe
  C:\Windows\System\MzQJMtf.exe
  2⤵
  PID:3560
- C:\Windows\System\PjTVxzo.exe
  C:\Windows\System\PjTVxzo.exe
  2⤵
  PID:5148
- C:\Windows\System\nRlkTgt.exe
  C:\Windows\System\nRlkTgt.exe
  2⤵
  PID:2712
- C:\Windows\System\EqZoXlB.exe
  C:\Windows\System\EqZoXlB.exe
  2⤵
  PID:1976
- C:\Windows\System\eHCVirX.exe
  C:\Windows\System\eHCVirX.exe
  2⤵
  PID:4540
- C:\Windows\System\ufQuFax.exe
  C:\Windows\System\ufQuFax.exe
  2⤵
  PID:2476
- C:\Windows\System\iavVxeR.exe
  C:\Windows\System\iavVxeR.exe
  2⤵
  PID:4336
- C:\Windows\System\wliMYsY.exe
  C:\Windows\System\wliMYsY.exe
  2⤵
  PID:1568
- C:\Windows\System\EiZzLHK.exe
  C:\Windows\System\EiZzLHK.exe
  2⤵
  PID:1284
- C:\Windows\System\KazIBAW.exe
  C:\Windows\System\KazIBAW.exe
  2⤵
  PID:5924
- C:\Windows\System\uIXDjsQ.exe
  C:\Windows\System\uIXDjsQ.exe
  2⤵
  PID:4876
- C:\Windows\System\rMRBJLZ.exe
  C:\Windows\System\rMRBJLZ.exe
  2⤵
  PID:6152
- C:\Windows\System\bTZRdXb.exe
  C:\Windows\System\bTZRdXb.exe
  2⤵
  PID:6168
- C:\Windows\System\OZPhIZK.exe
  C:\Windows\System\OZPhIZK.exe
  2⤵
  PID:6184
- C:\Windows\System\hAuDTPF.exe
  C:\Windows\System\hAuDTPF.exe
  2⤵
  PID:6200
- C:\Windows\System\znzZkCO.exe
  C:\Windows\System\znzZkCO.exe
  2⤵
  PID:6216
- C:\Windows\System\vgLAdlR.exe
  C:\Windows\System\vgLAdlR.exe
  2⤵
  PID:6232
- C:\Windows\System\dqeJXEX.exe
  C:\Windows\System\dqeJXEX.exe
  2⤵
  PID:6248
- C:\Windows\System\SaZIqiE.exe
  C:\Windows\System\SaZIqiE.exe
  2⤵
  PID:6264
- C:\Windows\System\ZdAHSBa.exe
  C:\Windows\System\ZdAHSBa.exe
  2⤵
  PID:6280
- C:\Windows\System\UihovMI.exe
  C:\Windows\System\UihovMI.exe
  2⤵
  PID:6300
- C:\Windows\System\AydTyNu.exe
  C:\Windows\System\AydTyNu.exe
  2⤵
  PID:6316
- C:\Windows\System\enPwAeh.exe
  C:\Windows\System\enPwAeh.exe
  2⤵
  PID:6332
- C:\Windows\System\egRDYvx.exe
  C:\Windows\System\egRDYvx.exe
  2⤵
  PID:6348
- C:\Windows\System\ddbEPWA.exe
  C:\Windows\System\ddbEPWA.exe
  2⤵
  PID:6364
- C:\Windows\System\eCwZCOn.exe
  C:\Windows\System\eCwZCOn.exe
  2⤵
  PID:6392
- C:\Windows\System\ddDOHbg.exe
  C:\Windows\System\ddDOHbg.exe
  2⤵
  PID:6408
- C:\Windows\System\nEhmQGT.exe
  C:\Windows\System\nEhmQGT.exe
  2⤵
  PID:6424
- C:\Windows\System\fQzaGjS.exe
  C:\Windows\System\fQzaGjS.exe
  2⤵
  PID:6440
- C:\Windows\System\HBgceqd.exe
  C:\Windows\System\HBgceqd.exe
  2⤵
  PID:6456
- C:\Windows\System\tkoQpIM.exe
  C:\Windows\System\tkoQpIM.exe
  2⤵
  PID:6472
- C:\Windows\System\YYARwnH.exe
  C:\Windows\System\YYARwnH.exe
  2⤵
  PID:6488
- C:\Windows\System\YVBHrve.exe
  C:\Windows\System\YVBHrve.exe
  2⤵
  PID:6504
- C:\Windows\System\LSkbjMg.exe
  C:\Windows\System\LSkbjMg.exe
  2⤵
  PID:6520
- C:\Windows\System\xhWAitd.exe
  C:\Windows\System\xhWAitd.exe
  2⤵
  PID:6536
- C:\Windows\System\QKwANtk.exe
  C:\Windows\System\QKwANtk.exe
  2⤵
  PID:6552
- C:\Windows\System\YbrLIEs.exe
  C:\Windows\System\YbrLIEs.exe
  2⤵
  PID:6568
- C:\Windows\System\rRPSxYD.exe
  C:\Windows\System\rRPSxYD.exe
  2⤵
  PID:6584
- C:\Windows\System\ZnzePdw.exe
  C:\Windows\System\ZnzePdw.exe
  2⤵
  PID:6600
- C:\Windows\System\kyroBvq.exe
  C:\Windows\System\kyroBvq.exe
  2⤵
  PID:6616
- C:\Windows\System\EnOdYbv.exe
  C:\Windows\System\EnOdYbv.exe
  2⤵
  PID:6632
- C:\Windows\System\adTWEJV.exe
  C:\Windows\System\adTWEJV.exe
  2⤵
  PID:6652
- C:\Windows\System\PannDqG.exe
  C:\Windows\System\PannDqG.exe
  2⤵
  PID:6668
- C:\Windows\System\MIFubuj.exe
  C:\Windows\System\MIFubuj.exe
  2⤵
  PID:6684
- C:\Windows\System\vbYRILL.exe
  C:\Windows\System\vbYRILL.exe
  2⤵
  PID:6700
- C:\Windows\System\bDupBtv.exe
  C:\Windows\System\bDupBtv.exe
  2⤵
  PID:6716
- C:\Windows\System\WxgPzEj.exe
  C:\Windows\System\WxgPzEj.exe
  2⤵
  PID:6732
- C:\Windows\System\KAzYGWe.exe
  C:\Windows\System\KAzYGWe.exe
  2⤵
  PID:6748
- C:\Windows\System\swbuQAw.exe
  C:\Windows\System\swbuQAw.exe
  2⤵
  PID:6764
- C:\Windows\System\qfzOmeM.exe
  C:\Windows\System\qfzOmeM.exe
  2⤵
  PID:6780
- C:\Windows\System\WjOQbsv.exe
  C:\Windows\System\WjOQbsv.exe
  2⤵
  PID:6796
- C:\Windows\System\eXrONzz.exe
  C:\Windows\System\eXrONzz.exe
  2⤵
  PID:6812
- C:\Windows\System\WrxHJMG.exe
  C:\Windows\System\WrxHJMG.exe
  2⤵
  PID:6828
- C:\Windows\System\XeTlXhi.exe
  C:\Windows\System\XeTlXhi.exe
  2⤵
  PID:6992
- C:\Windows\System\EEiRFgo.exe
  C:\Windows\System\EEiRFgo.exe
  2⤵
  PID:7008
- C:\Windows\System\xoDcNnW.exe
  C:\Windows\System\xoDcNnW.exe
  2⤵
  PID:7024
- C:\Windows\System\GRWNIUu.exe
  C:\Windows\System\GRWNIUu.exe
  2⤵
  PID:7044
- C:\Windows\System\PVULBeE.exe
  C:\Windows\System\PVULBeE.exe
  2⤵
  PID:7064
- C:\Windows\System\SmRzHST.exe
  C:\Windows\System\SmRzHST.exe
  2⤵
  PID:7092
- C:\Windows\System\iHMbKjJ.exe
  C:\Windows\System\iHMbKjJ.exe
  2⤵
  PID:7108
- C:\Windows\System\osHGvmt.exe
  C:\Windows\System\osHGvmt.exe
  2⤵
  PID:7124
- C:\Windows\System\zdMiSIC.exe
  C:\Windows\System\zdMiSIC.exe
  2⤵
  PID:7140
- C:\Windows\System\leZTVnX.exe
  C:\Windows\System\leZTVnX.exe
  2⤵
  PID:7156
- C:\Windows\System\umuwiLy.exe
  C:\Windows\System\umuwiLy.exe
  2⤵
  PID:6160
- C:\Windows\System\VRGaGLV.exe
  C:\Windows\System\VRGaGLV.exe
  2⤵
  PID:6344
- C:\Windows\System\rVZvSXu.exe
  C:\Windows\System\rVZvSXu.exe
  2⤵
  PID:6548
- C:\Windows\System\wADeqwe.exe
  C:\Windows\System\wADeqwe.exe
  2⤵
  PID:6696
- C:\Windows\System\DIUERCl.exe
  C:\Windows\System\DIUERCl.exe
  2⤵
  PID:6644
- C:\Windows\System\NPKeSer.exe
  C:\Windows\System\NPKeSer.exe
  2⤵
  PID:6868
- C:\Windows\System\ujYBTtT.exe
  C:\Windows\System\ujYBTtT.exe
  2⤵
  PID:6856
- C:\Windows\System\yzBBUWF.exe
  C:\Windows\System\yzBBUWF.exe
  2⤵
  PID:6972
- C:\Windows\System\AObkGjb.exe
  C:\Windows\System\AObkGjb.exe
  2⤵
  PID:7084
- C:\Windows\System\gvNLNzo.exe
  C:\Windows\System\gvNLNzo.exe
  2⤵
  PID:6148
- C:\Windows\System\hvFBWHC.exe
  C:\Windows\System\hvFBWHC.exe
  2⤵
  PID:6224
- C:\Windows\System\maERpTX.exe
  C:\Windows\System\maERpTX.exe
  2⤵
  PID:7104
- C:\Windows\System\HHGAVTX.exe
  C:\Windows\System\HHGAVTX.exe
  2⤵
  PID:5368
- C:\Windows\System\wDcuGlk.exe
  C:\Windows\System\wDcuGlk.exe
  2⤵
  PID:6276
- C:\Windows\System\pomwNwh.exe
  C:\Windows\System\pomwNwh.exe
  2⤵
  PID:6308
- C:\Windows\System\cJdOphd.exe
  C:\Windows\System\cJdOphd.exe
  2⤵
  PID:6244
- C:\Windows\System\tDvVVrO.exe
  C:\Windows\System\tDvVVrO.exe
  2⤵
  PID:6288
- C:\Windows\System\MMkAHHq.exe
  C:\Windows\System\MMkAHHq.exe
  2⤵
  PID:6340
- C:\Windows\System\JGqAMOr.exe
  C:\Windows\System\JGqAMOr.exe
  2⤵
  PID:6376
- C:\Windows\System\pyBYcNo.exe
  C:\Windows\System\pyBYcNo.exe
  2⤵
  PID:6400
- C:\Windows\System\XiFYEox.exe
  C:\Windows\System\XiFYEox.exe
  2⤵
  PID:6496
- C:\Windows\System\FsymRXt.exe
  C:\Windows\System\FsymRXt.exe
  2⤵
  PID:6532
- C:\Windows\System\FWtcyPe.exe
  C:\Windows\System\FWtcyPe.exe
  2⤵
  PID:6560
- C:\Windows\System\uZJOHJd.exe
  C:\Windows\System\uZJOHJd.exe
  2⤵
  PID:6964
- C:\Windows\System\ysZAzis.exe
  C:\Windows\System\ysZAzis.exe
  2⤵
  PID:7072
- C:\Windows\System\gqdDfZc.exe
  C:\Windows\System\gqdDfZc.exe
  2⤵
  PID:6272
- C:\Windows\System\kGgixiq.exe
  C:\Windows\System\kGgixiq.exe
  2⤵
  PID:6356
- C:\Windows\System\TxzkpeO.exe
  C:\Windows\System\TxzkpeO.exe
  2⤵
  PID:1696
- C:\Windows\System\nXqYcNE.exe
  C:\Windows\System\nXqYcNE.exe
  2⤵
  PID:6612
- C:\Windows\System\NlaiBgU.exe
  C:\Windows\System\NlaiBgU.exe
  2⤵
  PID:6640
- C:\Windows\System\DLjsPip.exe
  C:\Windows\System\DLjsPip.exe
  2⤵
  PID:7148
- C:\Windows\System\ADXHAjr.exe
  C:\Windows\System\ADXHAjr.exe
  2⤵
  PID:2204
- C:\Windows\System\cMhPTKc.exe
  C:\Windows\System\cMhPTKc.exe
  2⤵
  PID:6760
- C:\Windows\System\CYuBDXc.exe
  C:\Windows\System\CYuBDXc.exe
  2⤵
  PID:6824
- C:\Windows\System\YEEVJZt.exe
  C:\Windows\System\YEEVJZt.exe
  2⤵
  PID:6848
- C:\Windows\System\cLBFgCR.exe
  C:\Windows\System\cLBFgCR.exe
  2⤵
  PID:6884
- C:\Windows\System\nBdcEDb.exe
  C:\Windows\System\nBdcEDb.exe
  2⤵
  PID:6808
- C:\Windows\System\xdTfvht.exe
  C:\Windows\System\xdTfvht.exe
  2⤵
  PID:7016
- C:\Windows\System\YjDvASC.exe
  C:\Windows\System\YjDvASC.exe
  2⤵
  PID:6976
- C:\Windows\System\WiqNhwe.exe
  C:\Windows\System\WiqNhwe.exe
  2⤵
  PID:6648
- C:\Windows\System\anRcPmf.exe
  C:\Windows\System\anRcPmf.exe
  2⤵
  PID:7164
- C:\Windows\System\PsnhFsQ.exe
  C:\Windows\System\PsnhFsQ.exe
  2⤵
  PID:6888
- C:\Windows\System\rBplzXP.exe
  C:\Windows\System\rBplzXP.exe
  2⤵
  PID:6420
- C:\Windows\System\HaTGXHV.exe
  C:\Windows\System\HaTGXHV.exe
  2⤵
  PID:6480
- C:\Windows\System\qxawGih.exe
  C:\Windows\System\qxawGih.exe
  2⤵
  PID:7292
- C:\Windows\System\rwBHuXz.exe
  C:\Windows\System\rwBHuXz.exe
  2⤵
  PID:7308
- C:\Windows\System\oOikGUt.exe
  C:\Windows\System\oOikGUt.exe
  2⤵
  PID:7324
- C:\Windows\System\BymbeEq.exe
  C:\Windows\System\BymbeEq.exe
  2⤵
  PID:7340
- C:\Windows\System\FuyDsBu.exe
  C:\Windows\System\FuyDsBu.exe
  2⤵
  PID:7364
- C:\Windows\System\ZhGhApy.exe
  C:\Windows\System\ZhGhApy.exe
  2⤵
  PID:7380
- C:\Windows\System\WoKmIGg.exe
  C:\Windows\System\WoKmIGg.exe
  2⤵
  PID:7396
- C:\Windows\System\PyfIUMV.exe
  C:\Windows\System\PyfIUMV.exe
  2⤵
  PID:7416
- C:\Windows\System\YdKczre.exe
  C:\Windows\System\YdKczre.exe
  2⤵
  PID:7432
- C:\Windows\System\RrnImyd.exe
  C:\Windows\System\RrnImyd.exe
  2⤵
  PID:7448
- C:\Windows\System\IcLbkCO.exe
  C:\Windows\System\IcLbkCO.exe
  2⤵
  PID:7468
- C:\Windows\System\docTvhe.exe
  C:\Windows\System\docTvhe.exe
  2⤵
  PID:7484
- C:\Windows\System\EENhPfD.exe
  C:\Windows\System\EENhPfD.exe
  2⤵
  PID:7504
- C:\Windows\System\HjBMUsI.exe
  C:\Windows\System\HjBMUsI.exe
  2⤵
  PID:7524
- C:\Windows\System\iPQvqqE.exe
  C:\Windows\System\iPQvqqE.exe
  2⤵
  PID:7540
- C:\Windows\System\qHEmTMR.exe
  C:\Windows\System\qHEmTMR.exe
  2⤵
  PID:7560
- C:\Windows\System\wokAVSz.exe
  C:\Windows\System\wokAVSz.exe
  2⤵
  PID:7580
- C:\Windows\System\dicQKVO.exe
  C:\Windows\System\dicQKVO.exe
  2⤵
  PID:7596
- C:\Windows\System\FPEuAcb.exe
  C:\Windows\System\FPEuAcb.exe
  2⤵
  PID:7616
- C:\Windows\System\VxHXJni.exe
  C:\Windows\System\VxHXJni.exe
  2⤵
  PID:7632
- C:\Windows\System\fEJdDkn.exe
  C:\Windows\System\fEJdDkn.exe
  2⤵
  PID:7648
- C:\Windows\System\wGauEtb.exe
  C:\Windows\System\wGauEtb.exe
  2⤵
  PID:7672
- C:\Windows\System\ovzWtuz.exe
  C:\Windows\System\ovzWtuz.exe
  2⤵
  PID:7692
- C:\Windows\System\ySUDVOt.exe
  C:\Windows\System\ySUDVOt.exe
  2⤵
  PID:7708
- C:\Windows\System\ZrrWZJI.exe
  C:\Windows\System\ZrrWZJI.exe
  2⤵
  PID:7724
- C:\Windows\System\AnrNjjO.exe
  C:\Windows\System\AnrNjjO.exe
  2⤵
  PID:7748
- C:\Windows\System\fbvAUia.exe
  C:\Windows\System\fbvAUia.exe
  2⤵
  PID:7764
- C:\Windows\System\ZZBTBkE.exe
  C:\Windows\System\ZZBTBkE.exe
  2⤵
  PID:7784
- C:\Windows\System\VrTEPSm.exe
  C:\Windows\System\VrTEPSm.exe
  2⤵
  PID:7800
- C:\Windows\System\FyQcapH.exe
  C:\Windows\System\FyQcapH.exe
  2⤵
  PID:7820
- C:\Windows\System\stozslm.exe
  C:\Windows\System\stozslm.exe
  2⤵
  PID:8080
- C:\Windows\System\XzcPnri.exe
  C:\Windows\System\XzcPnri.exe
  2⤵
  PID:8096
- C:\Windows\System\fjRlKWW.exe
  C:\Windows\System\fjRlKWW.exe
  2⤵
  PID:8112
- C:\Windows\System\bYrVZqk.exe
  C:\Windows\System\bYrVZqk.exe
  2⤵
  PID:6940
- C:\Windows\System\prbHVXx.exe
  C:\Windows\System\prbHVXx.exe
  2⤵
  PID:6516
- C:\Windows\System\aUNLgnq.exe
  C:\Windows\System\aUNLgnq.exe
  2⤵
  PID:7000
- C:\Windows\System\xfVxNsG.exe
  C:\Windows\System\xfVxNsG.exe
  2⤵
  PID:6580
- C:\Windows\System\mKeMZGr.exe
  C:\Windows\System\mKeMZGr.exe
  2⤵
  PID:6464
- C:\Windows\System\swjRSSn.exe
  C:\Windows\System\swjRSSn.exe
  2⤵
  PID:6960
- C:\Windows\System\xcoIJyJ.exe
  C:\Windows\System\xcoIJyJ.exe
  2⤵
  PID:7052
- C:\Windows\System\oByLnhe.exe
  C:\Windows\System\oByLnhe.exe
  2⤵
  PID:6956
- C:\Windows\System\RjzNwtm.exe
  C:\Windows\System\RjzNwtm.exe
  2⤵
  PID:7184
- C:\Windows\System\sZJskya.exe
  C:\Windows\System\sZJskya.exe
  2⤵
  PID:7204
- C:\Windows\System\pkTvMiU.exe
  C:\Windows\System\pkTvMiU.exe
  2⤵
  PID:7288
- C:\Windows\System\jYtJZLf.exe
  C:\Windows\System\jYtJZLf.exe
  2⤵
  PID:7360
- C:\Windows\System\IDxvPZa.exe
  C:\Windows\System\IDxvPZa.exe
  2⤵
  PID:7428
- C:\Windows\System\dqoBFFL.exe
  C:\Windows\System\dqoBFFL.exe
  2⤵
  PID:7496
- C:\Windows\System\sQBaWyA.exe
  C:\Windows\System\sQBaWyA.exe
  2⤵
  PID:7576
- C:\Windows\System\rrDHCfP.exe
  C:\Windows\System\rrDHCfP.exe
  2⤵
  PID:7644
- C:\Windows\System\xDpoZxA.exe
  C:\Windows\System\xDpoZxA.exe
  2⤵
  PID:7720
- C:\Windows\System\zQEQAml.exe
  C:\Windows\System\zQEQAml.exe
  2⤵
  PID:7796
- C:\Windows\System\nurjRsu.exe
  C:\Windows\System\nurjRsu.exe
  2⤵
  PID:7228
- C:\Windows\System\xcctSmN.exe
  C:\Windows\System\xcctSmN.exe
  2⤵
  PID:7248
- C:\Windows\System\dKlfPFD.exe
  C:\Windows\System\dKlfPFD.exe
  2⤵
  PID:7264
- C:\Windows\System\siluVip.exe
  C:\Windows\System\siluVip.exe
  2⤵
  PID:7376
- C:\Windows\System\WQUDzoy.exe
  C:\Windows\System\WQUDzoy.exe
  2⤵
  PID:7304
- C:\Windows\System\lJSfJQh.exe
  C:\Windows\System\lJSfJQh.exe
  2⤵
  PID:7356
- C:\Windows\System\hVQZiiZ.exe
  C:\Windows\System\hVQZiiZ.exe
  2⤵
  PID:7604
- C:\Windows\System\mwVEWKp.exe
  C:\Windows\System\mwVEWKp.exe
  2⤵
  PID:7836
- C:\Windows\System\vviWwCm.exe
  C:\Windows\System\vviWwCm.exe
  2⤵
  PID:7440
- C:\Windows\System\uEmQMCp.exe
  C:\Windows\System\uEmQMCp.exe
  2⤵
  PID:7480
- C:\Windows\System\DLDyWyR.exe
  C:\Windows\System\DLDyWyR.exe
  2⤵
  PID:7556
- C:\Windows\System\QdFLsBP.exe
  C:\Windows\System\QdFLsBP.exe
  2⤵
  PID:7656
- C:\Windows\System\hUmiClV.exe
  C:\Windows\System\hUmiClV.exe
  2⤵
  PID:7860
- C:\Windows\System\LTVcSBm.exe
  C:\Windows\System\LTVcSBm.exe
  2⤵
  PID:7808
- C:\Windows\System\SOSnKha.exe
  C:\Windows\System\SOSnKha.exe
  2⤵
  PID:7772
- C:\Windows\System\bQpvekH.exe
  C:\Windows\System\bQpvekH.exe
  2⤵
  PID:7812
- C:\Windows\System\nFMtXUD.exe
  C:\Windows\System\nFMtXUD.exe
  2⤵
  PID:7880
- C:\Windows\System\xHsNzNy.exe
  C:\Windows\System\xHsNzNy.exe
  2⤵
  PID:7512
- C:\Windows\System\YpIXcOb.exe
  C:\Windows\System\YpIXcOb.exe
  2⤵
  PID:7916
- C:\Windows\System\xyZkXID.exe
  C:\Windows\System\xyZkXID.exe
  2⤵
  PID:7888
- C:\Windows\System\TkHZKxI.exe
  C:\Windows\System\TkHZKxI.exe
  2⤵
  PID:7904
- C:\Windows\System\NNdZvKW.exe
  C:\Windows\System\NNdZvKW.exe
  2⤵
  PID:7928
- C:\Windows\System\HdcKAIT.exe
  C:\Windows\System\HdcKAIT.exe
  2⤵
  PID:7948
- C:\Windows\System\oRaORzT.exe
  C:\Windows\System\oRaORzT.exe
  2⤵
  PID:7964
- C:\Windows\System\iVXWXyS.exe
  C:\Windows\System\iVXWXyS.exe
  2⤵
  PID:7980
- C:\Windows\System\Ufqftdh.exe
  C:\Windows\System\Ufqftdh.exe
  2⤵
  PID:7992
- C:\Windows\System\anqUYNY.exe
  C:\Windows\System\anqUYNY.exe
  2⤵
  PID:8008
- C:\Windows\System\FCEtJcG.exe
  C:\Windows\System\FCEtJcG.exe
  2⤵
  PID:8028
- C:\Windows\System\HjFiemw.exe
  C:\Windows\System\HjFiemw.exe
  2⤵
  PID:8044
- C:\Windows\System\WPqfZfg.exe
  C:\Windows\System\WPqfZfg.exe
  2⤵
  PID:8060
- C:\Windows\System\lNKzrka.exe
  C:\Windows\System\lNKzrka.exe
  2⤵
  PID:8108
- C:\Windows\System\VQmCVFq.exe
  C:\Windows\System\VQmCVFq.exe
  2⤵
  PID:8120
- C:\Windows\System\fNxUHyL.exe
  C:\Windows\System\fNxUHyL.exe
  2⤵
  PID:8160
- C:\Windows\System\Rhwdnfd.exe
  C:\Windows\System\Rhwdnfd.exe
  2⤵
  PID:8140
- C:\Windows\System\AKFuaJq.exe
  C:\Windows\System\AKFuaJq.exe
  2⤵
  PID:8176
- C:\Windows\System\MCGIBcb.exe
  C:\Windows\System\MCGIBcb.exe
  2⤵
  PID:8188
- C:\Windows\System\KrccjYI.exe
  C:\Windows\System\KrccjYI.exe
  2⤵
  PID:7056
- C:\Windows\System\gcnuzcR.exe
  C:\Windows\System\gcnuzcR.exe
  2⤵
  PID:6744
- C:\Windows\System\qpgLpPf.exe
  C:\Windows\System\qpgLpPf.exe
  2⤵
  PID:6936
- C:\Windows\System\qSgrIEW.exe
  C:\Windows\System\qSgrIEW.exe
  2⤵
  PID:6924
- C:\Windows\System\MpBjXGO.exe
  C:\Windows\System\MpBjXGO.exe
  2⤵
  PID:6916
- C:\Windows\System\zuVwknC.exe
  C:\Windows\System\zuVwknC.exe
  2⤵
  PID:6920
- C:\Windows\System\puFoHbD.exe
  C:\Windows\System\puFoHbD.exe
  2⤵
  PID:6844
- C:\Windows\System\jZocDOs.exe
  C:\Windows\System\jZocDOs.exe
  2⤵
  PID:6324
- C:\Windows\System\qvKIErW.exe
  C:\Windows\System\qvKIErW.exe
  2⤵
  PID:6384
- C:\Windows\System\fjvpNhB.exe
  C:\Windows\System\fjvpNhB.exe
  2⤵
  PID:7036
- C:\Windows\System\bejRFeW.exe
  C:\Windows\System\bejRFeW.exe
  2⤵
  PID:6624
- C:\Windows\System\jBrGovK.exe
  C:\Windows\System\jBrGovK.exe
  2⤵
  PID:7212
- C:\Windows\System\nXGWBfn.exe
  C:\Windows\System\nXGWBfn.exe
  2⤵
  PID:7176
- C:\Windows\System\CuOGVjT.exe
  C:\Windows\System\CuOGVjT.exe
  2⤵
  PID:7424
- C:\Windows\System\hAUxSyR.exe
  C:\Windows\System\hAUxSyR.exe
  2⤵
  PID:7216
- C:\Windows\System\zvkAGOd.exe
  C:\Windows\System\zvkAGOd.exe
  2⤵
  PID:7348
- C:\Windows\System\EuhVuoe.exe
  C:\Windows\System\EuhVuoe.exe
  2⤵
  PID:7500
- C:\Windows\System\mBUFsmq.exe
  C:\Windows\System\mBUFsmq.exe
  2⤵
  PID:7192
- C:\Windows\System\GLqXymZ.exe
  C:\Windows\System\GLqXymZ.exe
  2⤵
  PID:7316
- C:\Windows\System\kPPNrqX.exe
  C:\Windows\System\kPPNrqX.exe
  2⤵
  PID:7760
- C:\Windows\System\gTDFbyB.exe
  C:\Windows\System\gTDFbyB.exe
  2⤵
  PID:7236
- C:\Windows\System\miLODtU.exe
  C:\Windows\System\miLODtU.exe
  2⤵
  PID:7844
- C:\Windows\System\pzUjPPM.exe
  C:\Windows\System\pzUjPPM.exe
  2⤵
  PID:7852
- C:\Windows\System\dkVKrzq.exe
  C:\Windows\System\dkVKrzq.exe
  2⤵
  PID:7628
- C:\Windows\System\uqOvojT.exe
  C:\Windows\System\uqOvojT.exe
  2⤵
  PID:7776
- C:\Windows\System\isFpacF.exe
  C:\Windows\System\isFpacF.exe
  2⤵
  PID:7876
- C:\Windows\System\qzxseVL.exe
  C:\Windows\System\qzxseVL.exe
  2⤵
  PID:7896
- C:\Windows\System\SVQQNQW.exe
  C:\Windows\System\SVQQNQW.exe
  2⤵
  PID:7972
- C:\Windows\System\yHQOQRT.exe
  C:\Windows\System\yHQOQRT.exe
  2⤵
  PID:8004
- C:\Windows\System\gLFsAzr.exe
  C:\Windows\System\gLFsAzr.exe
  2⤵
  PID:8076
- C:\Windows\System\mEzeGbu.exe
  C:\Windows\System\mEzeGbu.exe
  2⤵
  PID:8128
- C:\Windows\System\EmDViNc.exe
  C:\Windows\System\EmDViNc.exe
  2⤵
  PID:7100
- C:\Windows\System\oFpMMHn.exe
  C:\Windows\System\oFpMMHn.exe
  2⤵
  PID:6948
- C:\Windows\System\MmBsXBu.exe
  C:\Windows\System\MmBsXBu.exe
  2⤵
  PID:8016
- C:\Windows\System\VtCKMic.exe
  C:\Windows\System\VtCKMic.exe
  2⤵
  PID:7884
- C:\Windows\System\lIeFJKt.exe
  C:\Windows\System\lIeFJKt.exe
  2⤵
  PID:7988
- C:\Windows\System\UFydZjJ.exe
  C:\Windows\System\UFydZjJ.exe
  2⤵
  PID:8068
- C:\Windows\System\MHmdtXr.exe
  C:\Windows\System\MHmdtXr.exe
  2⤵
  PID:8184
- C:\Windows\System\ZmmevQX.exe
  C:\Windows\System\ZmmevQX.exe
  2⤵
  PID:6984
- C:\Windows\System\FHhLWRv.exe
  C:\Windows\System\FHhLWRv.exe
  2⤵
  PID:7268
- C:\Windows\System\lmoaxRR.exe
  C:\Windows\System\lmoaxRR.exe
  2⤵
  PID:6680
- C:\Windows\System\lfALknO.exe
  C:\Windows\System\lfALknO.exe
  2⤵
  PID:7536
- C:\Windows\System\VYVlbXs.exe
  C:\Windows\System\VYVlbXs.exe
  2⤵
  PID:7332
- C:\Windows\System\UCmfJla.exe
  C:\Windows\System\UCmfJla.exe
  2⤵
  PID:6212
- C:\Windows\System\AVTtZyO.exe
  C:\Windows\System\AVTtZyO.exe
  2⤵
  PID:6292
- C:\Windows\System\UDULJLY.exe
  C:\Windows\System\UDULJLY.exe
  2⤵
  PID:7240
- C:\Windows\System\BYZBvpy.exe
  C:\Windows\System\BYZBvpy.exe
  2⤵
  PID:7736
- C:\Windows\System\HxQBbZd.exe
  C:\Windows\System\HxQBbZd.exe
  2⤵
  PID:7200
- C:\Windows\System\gyeNCLA.exe
  C:\Windows\System\gyeNCLA.exe
  2⤵
  PID:2980
- C:\Windows\System\GVSbZQB.exe
  C:\Windows\System\GVSbZQB.exe
  2⤵
  PID:7592
- C:\Windows\System\lDjLcMX.exe
  C:\Windows\System\lDjLcMX.exe
  2⤵
  PID:1576
- C:\Windows\System\txMxJGY.exe
  C:\Windows\System\txMxJGY.exe
  2⤵
  PID:8092
- C:\Windows\System\frLUQWd.exe
  C:\Windows\System\frLUQWd.exe
  2⤵
  PID:8024
- C:\Windows\System\WpVITzX.exe
  C:\Windows\System\WpVITzX.exe
  2⤵
  PID:7940
- C:\Windows\System\amHjgLs.exe
  C:\Windows\System\amHjgLs.exe
  2⤵
  PID:7960
- C:\Windows\System\DKlyyNz.exe
  C:\Windows\System\DKlyyNz.exe
  2⤵
  PID:8040
- C:\Windows\System\CLuStiP.exe
  C:\Windows\System\CLuStiP.exe
  2⤵
  PID:6912
- C:\Windows\System\zPoAwED.exe
  C:\Windows\System\zPoAwED.exe
  2⤵
  PID:7336
- C:\Windows\System\GFgwepQ.exe
  C:\Windows\System\GFgwepQ.exe
  2⤵
  PID:7700
- C:\Windows\System\GQvjNzp.exe
  C:\Windows\System\GQvjNzp.exe
  2⤵
  PID:7976
- C:\Windows\System\mDUcvkY.exe
  C:\Windows\System\mDUcvkY.exe
  2⤵
  PID:8156
- C:\Windows\System\htJufbb.exe
  C:\Windows\System\htJufbb.exe
  2⤵
  PID:6452
- C:\Windows\System\OhiLTSG.exe
  C:\Windows\System\OhiLTSG.exe
  2⤵
  PID:6876
- C:\Windows\System\gvWIvhR.exe
  C:\Windows\System\gvWIvhR.exe
  2⤵
  PID:8088
- C:\Windows\System\oTGeIAo.exe
  C:\Windows\System\oTGeIAo.exe
  2⤵
  PID:7284
- C:\Windows\System\yWrwWqR.exe
  C:\Windows\System\yWrwWqR.exe
  2⤵
  PID:7352
- C:\Windows\System\AMaWWnf.exe
  C:\Windows\System\AMaWWnf.exe
  2⤵
  PID:7828
- C:\Windows\System\DXBqcjf.exe
  C:\Windows\System\DXBqcjf.exe
  2⤵
  PID:6988
- C:\Windows\System\XRypbzj.exe
  C:\Windows\System\XRypbzj.exe
  2⤵
  PID:7040
- C:\Windows\System\rtOFZoT.exe
  C:\Windows\System\rtOFZoT.exe
  2⤵
  PID:6792
- C:\Windows\System\FkNVDOz.exe
  C:\Windows\System\FkNVDOz.exe
  2⤵
  PID:7032
- C:\Windows\System\JZEncuk.exe
  C:\Windows\System\JZEncuk.exe
  2⤵
  PID:7412
- C:\Windows\System\WKHSNpu.exe
  C:\Windows\System\WKHSNpu.exe
  2⤵
  PID:8196
- C:\Windows\System\KyTSiiq.exe
  C:\Windows\System\KyTSiiq.exe
  2⤵
  PID:8212
- C:\Windows\System\edncXxT.exe
  C:\Windows\System\edncXxT.exe
  2⤵
  PID:8228
- C:\Windows\System\eautswT.exe
  C:\Windows\System\eautswT.exe
  2⤵
  PID:8244
- C:\Windows\System\FLnDMLC.exe
  C:\Windows\System\FLnDMLC.exe
  2⤵
  PID:8260
- C:\Windows\System\WQqCxLU.exe
  C:\Windows\System\WQqCxLU.exe
  2⤵
  PID:8276
- C:\Windows\System\yhEZHbM.exe
  C:\Windows\System\yhEZHbM.exe
  2⤵
  PID:8296
- C:\Windows\System\aeWpThO.exe
  C:\Windows\System\aeWpThO.exe
  2⤵
  PID:8312
- C:\Windows\System\UztBzXE.exe
  C:\Windows\System\UztBzXE.exe
  2⤵
  PID:8328
- C:\Windows\System\qyDgjFF.exe
  C:\Windows\System\qyDgjFF.exe
  2⤵
  PID:8344
- C:\Windows\System\htNfAOL.exe
  C:\Windows\System\htNfAOL.exe
  2⤵
  PID:8360
- C:\Windows\System\elMrlXd.exe
  C:\Windows\System\elMrlXd.exe
  2⤵
  PID:8376
- C:\Windows\System\jcTOPKJ.exe
  C:\Windows\System\jcTOPKJ.exe
  2⤵
  PID:8400
- C:\Windows\System\boQQtYY.exe
  C:\Windows\System\boQQtYY.exe
  2⤵
  PID:8416
- C:\Windows\System\wOWeOiS.exe
  C:\Windows\System\wOWeOiS.exe
  2⤵
  PID:8432
- C:\Windows\System\iGSdikZ.exe
  C:\Windows\System\iGSdikZ.exe
  2⤵
  PID:8448
- C:\Windows\System\SrBZMyr.exe
  C:\Windows\System\SrBZMyr.exe
  2⤵
  PID:8464
- C:\Windows\System\hezGHEG.exe
  C:\Windows\System\hezGHEG.exe
  2⤵
  PID:8480
- C:\Windows\System\erGDVMt.exe
  C:\Windows\System\erGDVMt.exe
  2⤵
  PID:8496
- C:\Windows\System\NZqVBKT.exe
  C:\Windows\System\NZqVBKT.exe
  2⤵
  PID:8512
- C:\Windows\System\cdljYcu.exe
  C:\Windows\System\cdljYcu.exe
  2⤵
  PID:8528
- C:\Windows\System\MIGyuNi.exe
  C:\Windows\System\MIGyuNi.exe
  2⤵
  PID:8544
- C:\Windows\System\ZwgMNrq.exe
  C:\Windows\System\ZwgMNrq.exe
  2⤵
  PID:8560
- C:\Windows\System\LflZZUd.exe
  C:\Windows\System\LflZZUd.exe
  2⤵
  PID:8576
- C:\Windows\System\AUYCOXm.exe
  C:\Windows\System\AUYCOXm.exe
  2⤵
  PID:8592
- C:\Windows\System\tgbUbAV.exe
  C:\Windows\System\tgbUbAV.exe
  2⤵
  PID:8608
- C:\Windows\System\dikcjBV.exe
  C:\Windows\System\dikcjBV.exe
  2⤵
  PID:8624
- C:\Windows\System\rnxmXAS.exe
  C:\Windows\System\rnxmXAS.exe
  2⤵
  PID:8640
- C:\Windows\System\BkTLQoX.exe
  C:\Windows\System\BkTLQoX.exe
  2⤵
  PID:8656
- C:\Windows\System\rtJRpZi.exe
  C:\Windows\System\rtJRpZi.exe
  2⤵
  PID:8672
- C:\Windows\System\FrPDDoO.exe
  C:\Windows\System\FrPDDoO.exe
  2⤵
  PID:8688
- C:\Windows\System\BSNIWth.exe
  C:\Windows\System\BSNIWth.exe
  2⤵
  PID:8704
- C:\Windows\System\OHMysxi.exe
  C:\Windows\System\OHMysxi.exe
  2⤵
  PID:8720
- C:\Windows\System\iTPEXgA.exe
  C:\Windows\System\iTPEXgA.exe
  2⤵
  PID:8736
- C:\Windows\System\wEHZRfU.exe
  C:\Windows\System\wEHZRfU.exe
  2⤵
  PID:8752
- C:\Windows\System\euiOEnZ.exe
  C:\Windows\System\euiOEnZ.exe
  2⤵
  PID:8768
- C:\Windows\System\paGHUrg.exe
  C:\Windows\System\paGHUrg.exe
  2⤵
  PID:8784
- C:\Windows\System\orvOnZh.exe
  C:\Windows\System\orvOnZh.exe
  2⤵
  PID:8800
- C:\Windows\System\veMoudh.exe
  C:\Windows\System\veMoudh.exe
  2⤵
  PID:8816
- C:\Windows\System\ymhTuWx.exe
  C:\Windows\System\ymhTuWx.exe
  2⤵
  PID:8836
- C:\Windows\System\rSfSfbQ.exe
  C:\Windows\System\rSfSfbQ.exe
  2⤵
  PID:8852
- C:\Windows\System\TfLssdT.exe
  C:\Windows\System\TfLssdT.exe
  2⤵
  PID:8868
- C:\Windows\System\XvKCacq.exe
  C:\Windows\System\XvKCacq.exe
  2⤵
  PID:8884
- C:\Windows\System\cQwVdCS.exe
  C:\Windows\System\cQwVdCS.exe
  2⤵
  PID:8900
- C:\Windows\System\PLPsbli.exe
  C:\Windows\System\PLPsbli.exe
  2⤵
  PID:8916
- C:\Windows\System\pyvVMai.exe
  C:\Windows\System\pyvVMai.exe
  2⤵
  PID:8932
- C:\Windows\System\oVdDrWN.exe
  C:\Windows\System\oVdDrWN.exe
  2⤵
  PID:8948
- C:\Windows\System\FsTEMGv.exe
  C:\Windows\System\FsTEMGv.exe
  2⤵
  PID:8964
- C:\Windows\System\LZkqobj.exe
  C:\Windows\System\LZkqobj.exe
  2⤵
  PID:8980
- C:\Windows\System\QPDfrsx.exe
  C:\Windows\System\QPDfrsx.exe
  2⤵
  PID:8996
- C:\Windows\System\lSfgaFd.exe
  C:\Windows\System\lSfgaFd.exe
  2⤵
  PID:9012
- C:\Windows\System\JfTjtmZ.exe
  C:\Windows\System\JfTjtmZ.exe
  2⤵
  PID:9028
- C:\Windows\System\kJceQVH.exe
  C:\Windows\System\kJceQVH.exe
  2⤵
  PID:9044
- C:\Windows\System\SYsWLXy.exe
  C:\Windows\System\SYsWLXy.exe
  2⤵
  PID:9060
- C:\Windows\System\hviXEIG.exe
  C:\Windows\System\hviXEIG.exe
  2⤵
  PID:9084
- C:\Windows\System\zIDGrOZ.exe
  C:\Windows\System\zIDGrOZ.exe
  2⤵
  PID:9104
- C:\Windows\System\PqfMJcE.exe
  C:\Windows\System\PqfMJcE.exe
  2⤵
  PID:9120
- C:\Windows\System\foBUfrH.exe
  C:\Windows\System\foBUfrH.exe
  2⤵
  PID:9136
- C:\Windows\System\VMsPcpi.exe
  C:\Windows\System\VMsPcpi.exe
  2⤵
  PID:9152
- C:\Windows\System\lwbhsbk.exe
  C:\Windows\System\lwbhsbk.exe
  2⤵
  PID:9168
- C:\Windows\System\VPfqoiC.exe
  C:\Windows\System\VPfqoiC.exe
  2⤵
  PID:9184
- C:\Windows\System\pLWlBvQ.exe
  C:\Windows\System\pLWlBvQ.exe
  2⤵
  PID:9200
- C:\Windows\System\IBLCPbE.exe
  C:\Windows\System\IBLCPbE.exe
  2⤵
  PID:8136
- C:\Windows\System\jbVwrqQ.exe
  C:\Windows\System\jbVwrqQ.exe
  2⤵
  PID:8224
- C:\Windows\System\IkTwtAA.exe
  C:\Windows\System\IkTwtAA.exe
  2⤵
  PID:8292
- C:\Windows\System\hNCOEzR.exe
  C:\Windows\System\hNCOEzR.exe
  2⤵
  PID:8240
- C:\Windows\System\tCxVGjX.exe
  C:\Windows\System\tCxVGjX.exe
  2⤵
  PID:8428
- C:\Windows\System\kSPNTvt.exe
  C:\Windows\System\kSPNTvt.exe
  2⤵
  PID:8208
- C:\Windows\System\idNSBWP.exe
  C:\Windows\System\idNSBWP.exe
  2⤵
  PID:7856
- C:\Windows\System\eRYjlgf.exe
  C:\Windows\System\eRYjlgf.exe
  2⤵
  PID:8236
- C:\Windows\System\ZRiuACz.exe
  C:\Windows\System\ZRiuACz.exe
  2⤵
  PID:8472
- C:\Windows\System\UDBNTLJ.exe
  C:\Windows\System\UDBNTLJ.exe
  2⤵
  PID:8304
- C:\Windows\System\tXAeDrn.exe
  C:\Windows\System\tXAeDrn.exe
  2⤵
  PID:8572
- C:\Windows\System\zYOOLQa.exe
  C:\Windows\System\zYOOLQa.exe
  2⤵
  PID:8664
- C:\Windows\System\ZPwVliT.exe
  C:\Windows\System\ZPwVliT.exe
  2⤵
  PID:8728
- C:\Windows\System\emDYneb.exe
  C:\Windows\System\emDYneb.exe
  2⤵
  PID:8412
- C:\Windows\System\JmvNNoM.exe
  C:\Windows\System\JmvNNoM.exe
  2⤵
  PID:8584
- C:\Windows\System\JgndicK.exe
  C:\Windows\System\JgndicK.exe
  2⤵
  PID:8620
- C:\Windows\System\BseilJp.exe
  C:\Windows\System\BseilJp.exe
  2⤵
  PID:8680
- C:\Windows\System\GCUnbYx.exe
  C:\Windows\System\GCUnbYx.exe
  2⤵
  PID:8776
- C:\Windows\System\wbjHRhc.exe
  C:\Windows\System\wbjHRhc.exe
  2⤵
  PID:8848
- C:\Windows\System\gWHsJbF.exe
  C:\Windows\System\gWHsJbF.exe
  2⤵
  PID:8908
- C:\Windows\System\JZLzmGh.exe
  C:\Windows\System\JZLzmGh.exe
  2⤵
  PID:8972
- C:\Windows\System\LYzRpCd.exe
  C:\Windows\System\LYzRpCd.exe
  2⤵
  PID:9036
- C:\Windows\System\GvDtGzV.exe
  C:\Windows\System\GvDtGzV.exe
  2⤵
  PID:8732
- C:\Windows\System\HtZZrNp.exe
  C:\Windows\System\HtZZrNp.exe
  2⤵
  PID:9056
- C:\Windows\System\JkvDIXe.exe
  C:\Windows\System\JkvDIXe.exe
  2⤵
  PID:8864
- C:\Windows\System\CmEYyGh.exe
  C:\Windows\System\CmEYyGh.exe
  2⤵
  PID:8828
- C:\Windows\System\ybisjgw.exe
  C:\Windows\System\ybisjgw.exe
  2⤵
  PID:8924
- C:\Windows\System\brXpBXv.exe
  C:\Windows\System\brXpBXv.exe
  2⤵
  PID:8992
- C:\Windows\System\wVCZYvF.exe
  C:\Windows\System\wVCZYvF.exe
  2⤵
  PID:9112
- C:\Windows\System\mSjvoab.exe
  C:\Windows\System\mSjvoab.exe
  2⤵
  PID:9128
- C:\Windows\System\ltNiIDb.exe
  C:\Windows\System\ltNiIDb.exe
  2⤵
  PID:9164
- C:\Windows\System\DXWRtdC.exe
  C:\Windows\System\DXWRtdC.exe
  2⤵
  PID:8256
- C:\Windows\System\isHUDlF.exe
  C:\Windows\System\isHUDlF.exe
  2⤵
  PID:8284
- C:\Windows\System\RGGgLYt.exe
  C:\Windows\System\RGGgLYt.exe
  2⤵
  PID:8456
- C:\Windows\System\BrHKGDc.exe
  C:\Windows\System\BrHKGDc.exe
  2⤵
  PID:8336
- C:\Windows\System\ihMCwIF.exe
  C:\Windows\System\ihMCwIF.exe
  2⤵
  PID:9196
- C:\Windows\System\bhDnFTf.exe
  C:\Windows\System\bhDnFTf.exe
  2⤵
  PID:8700
- C:\Windows\System\aWFijeh.exe
  C:\Windows\System\aWFijeh.exe
  2⤵
  PID:8476
- C:\Windows\System\GAacusd.exe
  C:\Windows\System\GAacusd.exe
  2⤵
  PID:8352
- C:\Windows\System\NKlZMNk.exe
  C:\Windows\System\NKlZMNk.exe
  2⤵
  PID:8812
- C:\Windows\System\KseyRSU.exe
  C:\Windows\System\KseyRSU.exe
  2⤵
  PID:8204
- C:\Windows\System\MvyPitj.exe
  C:\Windows\System\MvyPitj.exe
  2⤵
  PID:8636
- C:\Windows\System\vajPvvN.exe
  C:\Windows\System\vajPvvN.exe
  2⤵
  PID:8568
- C:\Windows\System\zRMbCiE.exe
  C:\Windows\System\zRMbCiE.exe
  2⤵
  PID:8892
- C:\Windows\System\cMmTFfw.exe
  C:\Windows\System\cMmTFfw.exe
  2⤵
  PID:9160
- C:\Windows\System\IGCYVDY.exe
  C:\Windows\System\IGCYVDY.exe
  2⤵
  PID:8880
- C:\Windows\System\fDoSgje.exe
  C:\Windows\System\fDoSgje.exe
  2⤵
  PID:8000
- C:\Windows\System\KicDJrW.exe
  C:\Windows\System\KicDJrW.exe
  2⤵
  PID:8540
- C:\Windows\System\QiPPBrO.exe
  C:\Windows\System\QiPPBrO.exe
  2⤵
  PID:9008
- C:\Windows\System\PCFNwOl.exe
  C:\Windows\System\PCFNwOl.exe
  2⤵
  PID:9052
- C:\Windows\System\hDaKOhA.exe
  C:\Windows\System\hDaKOhA.exe
  2⤵
  PID:8632
- C:\Windows\System\glesVfy.exe
  C:\Windows\System\glesVfy.exe
  2⤵
  PID:8808
- C:\Windows\System\NELlDRB.exe
  C:\Windows\System\NELlDRB.exe
  2⤵
  PID:8764
- C:\Windows\System\NOdQlTd.exe
  C:\Windows\System\NOdQlTd.exe
  2⤵
  PID:7924
- C:\Windows\System\aIQSWVY.exe
  C:\Windows\System\aIQSWVY.exe
  2⤵
  PID:9132
- C:\Windows\System\dLDfGZS.exe
  C:\Windows\System\dLDfGZS.exe
  2⤵
  PID:8324
- C:\Windows\System\GkcMQwb.exe
  C:\Windows\System\GkcMQwb.exe
  2⤵
  PID:8944
- C:\Windows\System\anQyRhp.exe
  C:\Windows\System\anQyRhp.exe
  2⤵
  PID:8744
- C:\Windows\System\zwTCSWB.exe
  C:\Windows\System\zwTCSWB.exe
  2⤵
  PID:8648
- C:\Windows\System\gUqSpLd.exe
  C:\Windows\System\gUqSpLd.exe
  2⤵
  PID:9024
- C:\Windows\System\mVHnTrL.exe
  C:\Windows\System\mVHnTrL.exe
  2⤵
  PID:9232
- C:\Windows\System\xohAzBp.exe
  C:\Windows\System\xohAzBp.exe
  2⤵
  PID:9252
- C:\Windows\System\PyRMIRf.exe
  C:\Windows\System\PyRMIRf.exe
  2⤵
  PID:9268
- C:\Windows\System\ZgQmBzS.exe
  C:\Windows\System\ZgQmBzS.exe
  2⤵
  PID:9288
- C:\Windows\System\odZvPUi.exe
  C:\Windows\System\odZvPUi.exe
  2⤵
  PID:9368
- C:\Windows\System\JJKHjUm.exe
  C:\Windows\System\JJKHjUm.exe
  2⤵
  PID:9384
- C:\Windows\System\MStymVa.exe
  C:\Windows\System\MStymVa.exe
  2⤵
  PID:9400
- C:\Windows\System\jhXQQDw.exe
  C:\Windows\System\jhXQQDw.exe
  2⤵
  PID:9424
- C:\Windows\System\nnmMzIZ.exe
  C:\Windows\System\nnmMzIZ.exe
  2⤵
  PID:9452
- C:\Windows\System\mdbYdPv.exe
  C:\Windows\System\mdbYdPv.exe
  2⤵
  PID:9468
- C:\Windows\System\qkrAbMr.exe
  C:\Windows\System\qkrAbMr.exe
  2⤵
  PID:9484
- C:\Windows\System\ZhtEgft.exe
  C:\Windows\System\ZhtEgft.exe
  2⤵
  PID:9508
- C:\Windows\System\usQOQhT.exe
  C:\Windows\System\usQOQhT.exe
  2⤵
  PID:9524
- C:\Windows\System\adEzLIv.exe
  C:\Windows\System\adEzLIv.exe
  2⤵
  PID:9540
- C:\Windows\System\kitvTUm.exe
  C:\Windows\System\kitvTUm.exe
  2⤵
  PID:9556
- C:\Windows\System\XXWChaC.exe
  C:\Windows\System\XXWChaC.exe
  2⤵
  PID:9580
- C:\Windows\System\AicxzAK.exe
  C:\Windows\System\AicxzAK.exe
  2⤵
  PID:9596
- C:\Windows\System\bexhoJO.exe
  C:\Windows\System\bexhoJO.exe
  2⤵
  PID:9612
- C:\Windows\System\DxgGZiZ.exe
  C:\Windows\System\DxgGZiZ.exe
  2⤵
  PID:9628
- C:\Windows\System\ZgljPVM.exe
  C:\Windows\System\ZgljPVM.exe
  2⤵
  PID:9652
- C:\Windows\System\YtpCAWR.exe
  C:\Windows\System\YtpCAWR.exe
  2⤵
  PID:9668
- C:\Windows\System\hbPimTl.exe
  C:\Windows\System\hbPimTl.exe
  2⤵
  PID:9684
- C:\Windows\System\LigyVpJ.exe
  C:\Windows\System\LigyVpJ.exe
  2⤵
  PID:9700
- C:\Windows\System\yKOYmST.exe
  C:\Windows\System\yKOYmST.exe
  2⤵
  PID:9716
- C:\Windows\System\EwNOJvU.exe
  C:\Windows\System\EwNOJvU.exe
  2⤵
  PID:9732
- C:\Windows\System\qmLiYTE.exe
  C:\Windows\System\qmLiYTE.exe
  2⤵
  PID:9752
- C:\Windows\System\LrqaVpx.exe
  C:\Windows\System\LrqaVpx.exe
  2⤵
  PID:9768
- C:\Windows\System\qlOMElZ.exe
  C:\Windows\System\qlOMElZ.exe
  2⤵
  PID:9784
- C:\Windows\System\fHRiSNj.exe
  C:\Windows\System\fHRiSNj.exe
  2⤵
  PID:9800
- C:\Windows\System\VxjWUTQ.exe
  C:\Windows\System\VxjWUTQ.exe
  2⤵
  PID:9816
- C:\Windows\System\yVbWEKk.exe
  C:\Windows\System\yVbWEKk.exe
  2⤵
  PID:9836
- C:\Windows\System\YwfgcEc.exe
  C:\Windows\System\YwfgcEc.exe
  2⤵
  PID:9852
- C:\Windows\System\DdOfCZM.exe
  C:\Windows\System\DdOfCZM.exe
  2⤵
  PID:9868
- C:\Windows\System\CYgMRuV.exe
  C:\Windows\System\CYgMRuV.exe
  2⤵
  PID:9896
- C:\Windows\System\UmPAiCW.exe
  C:\Windows\System\UmPAiCW.exe
  2⤵
  PID:9912
- C:\Windows\System\GLtGdpO.exe
  C:\Windows\System\GLtGdpO.exe
  2⤵
  PID:9932
- C:\Windows\System\lgZlGYp.exe
  C:\Windows\System\lgZlGYp.exe
  2⤵
  PID:9948
- C:\Windows\System\QgkDeWZ.exe
  C:\Windows\System\QgkDeWZ.exe
  2⤵
  PID:9964
- C:\Windows\System\xOkCEaC.exe
  C:\Windows\System\xOkCEaC.exe
  2⤵
  PID:9992
- C:\Windows\System\iogDzDJ.exe
  C:\Windows\System\iogDzDJ.exe
  2⤵
  PID:10012
- C:\Windows\System\pfrDbOB.exe
  C:\Windows\System\pfrDbOB.exe
  2⤵
  PID:10032
- C:\Windows\System\IEqVKCW.exe
  C:\Windows\System\IEqVKCW.exe
  2⤵
  PID:10048
- C:\Windows\System\LczKVbt.exe
  C:\Windows\System\LczKVbt.exe
  2⤵
  PID:10064
- C:\Windows\System\FDNEpWv.exe
  C:\Windows\System\FDNEpWv.exe
  2⤵
  PID:10080
- C:\Windows\System\UxLFjYg.exe
  C:\Windows\System\UxLFjYg.exe
  2⤵
  PID:10100
- C:\Windows\System\JSrKfss.exe
  C:\Windows\System\JSrKfss.exe
  2⤵
  PID:10116
- C:\Windows\System\NkOgCNq.exe
  C:\Windows\System\NkOgCNq.exe
  2⤵
  PID:10132
- C:\Windows\System\HxOYAlT.exe
  C:\Windows\System\HxOYAlT.exe
  2⤵
  PID:10152
- C:\Windows\System\VCurKpY.exe
  C:\Windows\System\VCurKpY.exe
  2⤵
  PID:10168
- C:\Windows\System\eswrYhL.exe
  C:\Windows\System\eswrYhL.exe
  2⤵
  PID:10184
- C:\Windows\System\LFdSTtd.exe
  C:\Windows\System\LFdSTtd.exe
  2⤵
  PID:10200
- C:\Windows\System\hirwChn.exe
  C:\Windows\System\hirwChn.exe
  2⤵
  PID:10220
- C:\Windows\System\lDfnMAd.exe
  C:\Windows\System\lDfnMAd.exe
  2⤵
  PID:9624
- C:\Windows\System\ousvtlO.exe
  C:\Windows\System\ousvtlO.exe
  2⤵
  PID:9824
- C:\Windows\System\FMKKUUN.exe
  C:\Windows\System\FMKKUUN.exe
  2⤵
  PID:9904
- C:\Windows\System\RlSwwBd.exe
  C:\Windows\System\RlSwwBd.exe
  2⤵
  PID:9972
- C:\Windows\System\EUDZKgL.exe
  C:\Windows\System\EUDZKgL.exe
  2⤵
  PID:10020
- C:\Windows\System\TfugAoy.exe
  C:\Windows\System\TfugAoy.exe
  2⤵
  PID:10088
- C:\Windows\System\bdlULtk.exe
  C:\Windows\System\bdlULtk.exe
  2⤵
  PID:10128
- C:\Windows\System\GsMcxMa.exe
  C:\Windows\System\GsMcxMa.exe
  2⤵
  PID:10192
- C:\Windows\System\xUqZIsk.exe
  C:\Windows\System\xUqZIsk.exe
  2⤵
  PID:8524
- C:\Windows\System\AvGUQMn.exe
  C:\Windows\System\AvGUQMn.exe
  2⤵
  PID:8960
- C:\Windows\System\OeZgXtX.exe
  C:\Windows\System\OeZgXtX.exe
  2⤵
  PID:9316
- C:\Windows\System\FZtPpeU.exe
  C:\Windows\System\FZtPpeU.exe
  2⤵
  PID:10024
- C:\Windows\System\zkexhEj.exe
  C:\Windows\System\zkexhEj.exe
  2⤵
  PID:9264
- C:\Windows\System\undgKnT.exe
  C:\Windows\System\undgKnT.exe
  2⤵
  PID:8424
- C:\Windows\System\ZSQlgDX.exe
  C:\Windows\System\ZSQlgDX.exe
  2⤵
  PID:9444
- C:\Windows\System\mQNusUF.exe
  C:\Windows\System\mQNusUF.exe
  2⤵
  PID:9476
- C:\Windows\System\RlsUezs.exe
  C:\Windows\System\RlsUezs.exe
  2⤵
  PID:9396
- C:\Windows\System\epEwdWu.exe
  C:\Windows\System\epEwdWu.exe
  2⤵
  PID:8652
- C:\Windows\System\NqeNJGc.exe
  C:\Windows\System\NqeNJGc.exe
  2⤵
  PID:9588
- C:\Windows\System\Nqgwmih.exe
  C:\Windows\System\Nqgwmih.exe
  2⤵
  PID:9660
- C:\Windows\System\xGtSaFW.exe
  C:\Windows\System\xGtSaFW.exe
  2⤵
  PID:9876
- C:\Windows\System\jvyMAPi.exe
  C:\Windows\System\jvyMAPi.exe
  2⤵
  PID:9536
- C:\Windows\System\jQSLzJC.exe
  C:\Windows\System\jQSLzJC.exe
  2⤵
  PID:9576
- C:\Windows\System\ZotZKCZ.exe
  C:\Windows\System\ZotZKCZ.exe
  2⤵
  PID:9640
- C:\Windows\System\ESkXwSk.exe
  C:\Windows\System\ESkXwSk.exe
  2⤵
  PID:9744
- C:\Windows\System\nJUKOFc.exe
  C:\Windows\System\nJUKOFc.exe
  2⤵
  PID:9812
- C:\Windows\System\JMNUeqW.exe
  C:\Windows\System\JMNUeqW.exe
  2⤵
  PID:9888
- C:\Windows\System\zriQorg.exe
  C:\Windows\System\zriQorg.exe
  2⤵
  PID:9956
- C:\Windows\System\OXdAyyb.exe
  C:\Windows\System\OXdAyyb.exe
  2⤵
  PID:10008
- C:\Windows\System\OVuPFqF.exe
  C:\Windows\System\OVuPFqF.exe
  2⤵
  PID:10180
- C:\Windows\System\QVClWHN.exe
  C:\Windows\System\QVClWHN.exe
  2⤵
  PID:9792
- C:\Windows\System\ODqITbv.exe
  C:\Windows\System\ODqITbv.exe
  2⤵
  PID:9724
- C:\Windows\System\EtWSeoV.exe
  C:\Windows\System\EtWSeoV.exe
  2⤵
  PID:9988
- C:\Windows\System\QhWgyKP.exe
  C:\Windows\System\QhWgyKP.exe
  2⤵
  PID:9240
- C:\Windows\System\jUskcrS.exe
  C:\Windows\System\jUskcrS.exe
  2⤵
  PID:10236
- C:\Windows\System\gEjbsgs.exe
  C:\Windows\System\gEjbsgs.exe
  2⤵
  PID:9284
- C:\Windows\System\DQAnRvS.exe
  C:\Windows\System\DQAnRvS.exe
  2⤵
  PID:9944
- C:\Windows\System\PLRzApj.exe
  C:\Windows\System\PLRzApj.exe
  2⤵
  PID:10164
- C:\Windows\System\URdGPGd.exe
  C:\Windows\System\URdGPGd.exe
  2⤵
  PID:9980
- C:\Windows\System\oMqDYHp.exe
  C:\Windows\System\oMqDYHp.exe
  2⤵
  PID:9480
- C:\Windows\System\zFKlsYd.exe
  C:\Windows\System\zFKlsYd.exe
  2⤵
  PID:9092
- C:\Windows\System\rejhYvx.exe
  C:\Windows\System\rejhYvx.exe
  2⤵
  PID:9776
- C:\Windows\System\nanAUOI.exe
  C:\Windows\System\nanAUOI.exe
  2⤵
  PID:9924
- C:\Windows\System\MZwWNlT.exe
  C:\Windows\System\MZwWNlT.exe
  2⤵
  PID:10176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DhJeQAf.exe

Filesize
1.8MB

MD5
e18d80ebec9e38a465abccda3e6bc7f1

SHA1
8f2f6d8a4ec2d4d769699bbc24a579e52a9376ab

SHA256
b10c4bf77a3f031d9b77990382706012bd9778c35cbc3a84fecf6f9c3df32d2f

SHA512
b7a14f43081927e9e20be161bae7ca02626dd5dec20521492d4228d48f0901e71e578c73f9b76d66d9111bf154d7d6ec05abbd5738457794829e43fcd96f6f54

Download Submit
C:\Windows\system\DovZqQQ.exe

Filesize
1.8MB

MD5
f3f816fcad955eacc0d3cfd87d2165bc

SHA1
0c437cc25a34a5007f0ddab686fd89d046e74ae1

SHA256
3047d13dda0c8ba1800386d01558a08a94be75a6eaa8a1838fce7e6d0397565c

SHA512
2444402e17619c51681e004737ee1775d61c326b2f82b6bc14249d062d6f051989d93f19507ba9f4285e43f50b83f08e01643dea133e4d88e8db55829463fa54

Download Submit
C:\Windows\system\FQTXDlo.exe

Filesize
1.8MB

MD5
83bbb109cf75bc1d464e5d4940e22ad7

SHA1
f7bd96f59e87f9e39f102f5dd515f891dc4cb3b6

SHA256
c47aa53fcd710b2eabc0227b93ee58d605d4577f2ee8789a29ef4fa55629da8a

SHA512
de60d3b1fe59ae9c63528be44cbcd765410578f97bfb2c70557b45b12eee5aa1128372dbefcf49b81c285841bc08668990769635970e7a4149f4941603d7339b

Download Submit
C:\Windows\system\JctvNkb.exe

Filesize
1.8MB

MD5
012fa55d60c1bd9af0382453082ef955

SHA1
1f7ed5577e4e057f3f6c2aa792f5b1276dde1371

SHA256
ff0192c0d02c5de17ea4e2e53c13bb6e652c6773e00d94fdbbdc53890fcd07ef

SHA512
dedf24b5dca1f736d117235e671e6c427b1126e83ce9e307183bfe580fdda54d5e5601436edcf8298327d33727057692f5b68143df2f1e7eed04e6aabc6b3da4

Download Submit
C:\Windows\system\JjiyRHU.exe

Filesize
1.8MB

MD5
ccbdab76e2b80edc16be23856b2f58ae

SHA1
87995bb9a994b6508357d513358a56ebe38186c2

SHA256
783575e22c85574362ed8d44477e0e7cbb4b91ec7e8bb59d7163225d227b8db5

SHA512
0a72ec8081f23293d4d949be11d6792ca1fbccb7a2fbb76f6d8800addf64025215e0fc04eafd70b17dac9291cf8ec6da63918072c95ae19413bb9577eaa3024e

Download Submit
C:\Windows\system\ONerngT.exe

Filesize
1.8MB

MD5
8bcde841141f242178e82bb696027eb1

SHA1
ce492afafac2c3773103221e7c935a12e11a2795

SHA256
73f112c8c414896026f2fa691f1e74b2cc1de985539b7221ebae157c8fad4b6e

SHA512
d217fc0d17d9781dd4e162d2538e1c45bad5eb13bfa20c5b4292bec260cc514966d8237dc978d0d3ec622704e0aca70e67d2a4fb52ab7e31fce4d4d4a5703172

Download Submit
C:\Windows\system\PvetDrP.exe

Filesize
1.8MB

MD5
52768fc047b299463399a4ab957e4e3f

SHA1
e252982a10a923da5413422e91e709b9f9ec9287

SHA256
a52e2a408e68a08ec120efd1d955b43b856b6b3497170baafaf35fa636969c36

SHA512
aa70eadbf281206413b53d6567855d03e1ec64de3427b7f30d1dabe398ebe9ce343ea8ca3ad19aad16f6ac8f3d3270a1ea1225503ef2cc7b4cc07c8d3aa7cc8a

Download Submit
C:\Windows\system\RAuscmj.exe

Filesize
1.8MB

MD5
e6eda50f8722a57f5a9112ad497d7d9a

SHA1
0811e374d5eacd735807feebea02751a6eb66d3c

SHA256
f2200a3d2fc4991f76bc51050945e6f87d0273d9898a7064ca7af67209f1a80e

SHA512
447637ba175f85670211d9255a99d09488d76dc0ae4fc5c4a66912ef9d798723a563ae36fb791453ee1b074447b5fc5320a76d647ba4e6f9f649342325c934bc

Download Submit
C:\Windows\system\RumZsed.exe

Filesize
1.8MB

MD5
e947bb950c36e02d56137527f3efad7f

SHA1
e5384277f91be34e03c6b73861c9e6bebbad97c2

SHA256
9c4a94c2a7b72a492d7d12847e07bda2a69f7cee486b5aef302d7c697db51911

SHA512
a178334b2b6249fe37cc0c6f3daae4ff4393fb2d2ac9e9ac22603a7755367333da5bb5a53a21a9fca236540a17fa43cb0bff926c7cfc0bcfcf605267c35c7582

Download Submit
C:\Windows\system\SQoyZay.exe

Filesize
1.8MB

MD5
bd10e5a47384d006c68571bb1307fd13

SHA1
98fb3d97e2e7dc65946a8236297cbf164ab48ec2

SHA256
66becbd226f6cf02f7d9bf0ca088965ae944b6d2a17acd699db7248342e843b5

SHA512
56f45efa6b8efb6ae4f168a273bfe53b7308876887ebfbb1a7a9ff270423fcb7e58c52f193e1eb1a8465aaae5a5e5b324a642469e221bf13a790da8783abe3d0

Download Submit
C:\Windows\system\TqfFAhV.exe

Filesize
1.8MB

MD5
c200f3a54cf73cac77187d9a37046bf7

SHA1
ea3fc448bed40beb8f7f89608b2eb66e0308c691

SHA256
fce38f7aa03949834e3683f744d1675c42c15ee16c15c97eee92e78aaf0753ae

SHA512
897abe09a777dd8f7d816647ae920d4208698146ad26205f15319dcd9934819229159ead66ec8706d15f3e93bce8f7916da95352500ed4f154825e1b95a849ca

Download Submit
C:\Windows\system\UDycwtJ.exe

Filesize
1.8MB

MD5
6493bb8564fac7fdc6822068982448d6

SHA1
8355d3e838dd19991af07372b1a6fe1be6a7cb98

SHA256
a430bad540a188b27d0be0d474df6ec5375d5683730b90eda5fb36b581e3c920

SHA512
41d1bab0878a9dedeabd7298b059c8a55ab87765db001e5cec1f13ea1950fcc88f5302c20a27cb15500e7e9c2d2740b4e03e327457c1bf4f5c388237921ceb98

Download Submit
C:\Windows\system\VoUTgPs.exe

Filesize
1.8MB

MD5
e823e3910067db3363ad696d64416116

SHA1
d996a2e483f755ae844518576b2e5191c18c9fb6

SHA256
16e6a6780aa76202aff2e904e64fea774d768a63fb205af903569f61204b578d

SHA512
1f24fa1f23a77eb0f8888d3e81a4d959c35bf9b64e483ad1a4a7346cb358f228491d946a479d6c3c8fefd3d915634388cc50f4d33728d6662aec1519c8fa2408

Download Submit
C:\Windows\system\aZzzqeM.exe

Filesize
1.8MB

MD5
eed315d3dca9d74a3576ceb200bb16ae

SHA1
09e619f24222b024c820551d5defcb9c2a44451b

SHA256
88ec28ce1a75feb17ccb9d94b4e119f7c6eca85036e026a3a53817ad5e837912

SHA512
694a9b57a01b1832eb0fcb087411a2c882efd6e697f600a20abd48ad1c5c872719918086a11cb9f6ffda1d58ca5561910f3cd4a6791c1dc0913f25b95f3c61c6

Download Submit
C:\Windows\system\inbCirE.exe

Filesize
1.8MB

MD5
1f34f23fcec85762795c41f65b6fbfdf

SHA1
efa073b3a3f1d27db55759dd1171f415cba0438b

SHA256
68b770deb57e9ff1e1da939ad714c9b76a00f1322e45510dc360cbb3d17b53bf

SHA512
ddd552e7e65d7611b30b95dac611c1b384c97851f8c3e49285a24c41e19e4475491897412b7b989f26add56a0baf5f99a8a39bc7792fecbc169ec03b609447aa

Download Submit
C:\Windows\system\lgQsdoj.exe

Filesize
1.8MB

MD5
28c4d31e188dd7b9775ba9662c9a06c4

SHA1
7f74f30902a85acbdc800667439f08649fbc1b5e

SHA256
d80e6addbc61385023a90d39c540ccab0003ef04d3118f0045b9dcebe46ff589

SHA512
3bae2b0799f05eb7c42be05f4a1ab2f9a06adcf3fe6afbd6a4cfe90835d628c0df2024b4d02ac3a65e448971efe5401486b5d63c94f82aeae424bcaa57abdbbf

Download Submit
C:\Windows\system\mSqSSVg.exe

Filesize
1.8MB

MD5
e16c9605e0293ddde6be671d7830222f

SHA1
32eed53a91b6eef93f29eeb48856bc58c51a87ae

SHA256
c66420b7763d13799db49e6fa4f361d5f603e76262d7fbf2d84b8356643beddc

SHA512
735c01187f556ec62b77c2ebc5883187ef70ee3caa40fd8a0d45b5e742eab4f2b19af3c3ef09921e007cf04365854b7708ca4788ae03d9205061032c55fcb931

Download Submit
C:\Windows\system\naloMnc.exe

Filesize
1.8MB

MD5
4ab894afca307e58c0de4c815dbb865d

SHA1
dc1af8ce240c25c8239671710f307b8d43e1f157

SHA256
6f98e1672bef992e8c589d62c9cde7128447848f56163853d054ddb6daa47ddb

SHA512
8916d7dffbd014dc373b5b7f7468566fbfd2014cfe1faf6dd621c7a77706ddaf34ea47509a58f443ecebfb72b25cc0fac0edd0f1c2d9dcc233e8989487c47eb8

Download Submit
C:\Windows\system\tVHETFI.exe

Filesize
1.8MB

MD5
cf5632720d776c5f14c89bbad11a32f1

SHA1
dac0b36bcce7252985c78f0e425fdb1c911fbe26

SHA256
faed59a66977dc4737fe1f75273561615561c5e999c378d6a5e6250a84d954fd

SHA512
4d033308bd61ac7802b3a53b8e15acc1d3684aa8aa60c11ada1b27e6d69cbd9ebbbd60e41755d365a174eddbe05e3a026e2d39d0e6e90bddc48b832046fc4c4d

Download Submit
\Windows\system\AaOxBjw.exe

Filesize
1.8MB

MD5
854ce896c5bdd23f3f276ed7a868dab9

SHA1
0206e202db6d54c6c272845dff3cad081537d0f9

SHA256
e80ced645012a6418658e18064b6e723b90fffe696429034f2019e61f26a07ca

SHA512
9dc1a72ea27cd3ff58d3f628261e38aff49f791cabde3047ee77fb286162705289cb3fb8619684b5e9d78021d1bf7c6bb6ae89bba50f6bb47e9ff837966a3f9a

Download Submit
\Windows\system\SJhSaHh.exe

Filesize
1.8MB

MD5
ee88b539300d9f1ea16d5b78afd7db6d

SHA1
4a835efd809159cb506fe785f5d9d70a734372d8

SHA256
7a8667d70aba4ad114e75cc9f8ebc8efdd682e65beff8086bf6dc4bf40d441f3

SHA512
9a868dfacb8fad3c5fb79ba412feb6156ed6b3643bb54ac75cfbacd7b85cec43f3ccc1318fedd89184faef91fa36eacd878fcfcd5bee915afe263018f28b7c49

Download Submit
\Windows\system\SgvPbGT.exe

Filesize
1.8MB

MD5
750fb33b557b32768c2cd747827cbfbd

SHA1
e7532363397a50742153297b7c32432b49b3702f

SHA256
e74d8ac3fbffb45974252a8792b35471423c8dc4268a5109be6097bd418839d8

SHA512
accb667e020a656af66114d474aa511f6f8a1cfffa0b3e3a08deb31e45d19ddd8de94bcde75a4ffe9bf43536483f24a2820162b2c186d9cd3781fe84735b5b49

Download Submit
\Windows\system\XTVSVCd.exe

Filesize
1.8MB

MD5
671f9bb8c8649ab374c1221676269674

SHA1
2b1b6efb829a662d3a50588afd0160aa1da01360

SHA256
63669b8810c6875ed9ae8fd44a6b54cdd6528949e8f6e4d5bf45b3a92da63f2a

SHA512
08748a0d873168b9a1c1c38c33f397005309de5004806143e873e704d8484d8c5036089eb696d63c80bbaf672e0e18b39b138854334d6a7c66bb2195c3ec42aa

Download Submit
\Windows\system\YkEPznl.exe

Filesize
1.8MB

MD5
78f5c000bdd068da8b95300763e6db45

SHA1
0f7790c6c65f0c60a57034dd0181aef7e333f34e

SHA256
5f9f9cb32ff615be54773d0dab9b494cf462c69793c4e9fe3e2ee1e17b492ad7

SHA512
1a3e8007cbfd3b0f5fe84d991b2d01a7897bcf6e475dee85048b10f2f135b2188e24d4018d8d6cf6ef1c5853a2c06e0673064b81c8a39ea222296a3bcc3574ab

Download Submit
\Windows\system\bDTvSIw.exe

Filesize
1.8MB

MD5
4246bd5ba0ac3c5c39409e89990abdba

SHA1
c329843778a110221e85a270c56f507cf22b6fac

SHA256
768325ed1573114df65aade2dff3a5d5477730edb65d31a918c65e9417b1d960

SHA512
5159afda05202534d03fa284ba3f0d31d16cd93596133f05a8d5859b6d5b5c45b43339518149082859a468e212553cc00fde41655482403ba1a7d061694761ef

Download Submit
\Windows\system\hXGbpKN.exe

Filesize
1.8MB

MD5
dff866aec39e8417f05a63f562cc93d6

SHA1
ee2858284d1d9bb63d89f2775be4851fc119cc61

SHA256
0aa6e8f28d9965c25ffea54dc3df16f36cab5dbbdbac3433debf30e3524e40bd

SHA512
4267cbf42cac359d62fda0a5d3186c33f83dd2002252d1527733878842ec6f6720047d431b83c1f14dab4c40f4f772b3064ff4cb671ae3bf3bc51110e3ba994f

Download Submit
\Windows\system\hrCUDUm.exe

Filesize
1.8MB

MD5
4dae5d194272e38b86f344cd0117c338

SHA1
1d6db588e8a2d81be5d33f63bc1f5f23ddb267f5

SHA256
c5e1659986414171421bc78688055c97b26af939eecbf7c5924925b243397e67

SHA512
630822cef4874c14492bc548cb84a0a4be79536929ccdf5cb1748afa81343275699b9f4973f9e985ff883389dc775c1f44f0376527c58522670db3068b40d193

Download Submit
\Windows\system\irvJeHe.exe

Filesize
1.8MB

MD5
b2c456b06ecb8bde775a02d8a4bf64d2

SHA1
e6037858d61718827bd06fde2a44cac54e8f2297

SHA256
36327e4b215b8a58c8aa660947a24d9854fc1c35c9f27d0876355646484af000

SHA512
32ba8bec30ff07d236afd99acbf544d0f6ba938ee3bce0a78f1671d4f48329bd0b3c5e7804495f17067fdf97d909e3419fdb5841f8be30f3c049fd8afdde9dff

Download Submit
\Windows\system\jFyLjMh.exe

Filesize
1.8MB

MD5
5c513dbdab42a1135278b0e2b01671a5

SHA1
f0d0806ecfa57cd6f3a67047faf53402cfba42d0

SHA256
730d809e89bbeaafce928879d3eb10994624ef1c1970485577f48a5a84a204a5

SHA512
a1fa280159865f2825988dcdf134d6f1c652ed18781c2feeeb501eae284ebf0b5bb6bf0f000039fa83f5e0bd2e2b0d3b682b1a4059efc41e6db928c78d648a03

Download Submit
\Windows\system\jwUhSFX.exe

Filesize
1.8MB

MD5
fba4b18a52621dfe4e2b44f1f5802742

SHA1
39e9beae879d526f1f83fea98ab80fc99109be1a

SHA256
e8e93ed7655c9833a593802eba0899eb825b2653db77a707021a628864ac125d

SHA512
7079b3174f3bedd888fadea19a197327ccc6224813d155f4a03e6298f7fa0cb3334fefae6539fa64cbf6a6f9a77098f4f8d48ef33cee7fa6c98445d18f1eec48

Download Submit
\Windows\system\lHDZjpn.exe

Filesize
1.8MB

MD5
3863760cee9ff031d92aa7ef31e71da5

SHA1
070fb0ba65a6c6e30081d486780543dc4ec24e04

SHA256
a23e3441fa2fb32e25b380035eb7b5c89a3c00a55d4983b7ad9d51c5643cd860

SHA512
a6e09982076b42251231654e86f181b0da51706acd6a2131a9b791488f2ba753fabd1e36bb66708953c4d8b3f9742c1a44417f6ee8209897a5298d3f22ec0885

Download Submit
\Windows\system\ovpRVKj.exe

Filesize
1.8MB

MD5
a895f6ab0bda81f9bc75c97a8779bb61

SHA1
f7d7472d7060af88ea75e26d88042e3db73b71ec

SHA256
5b2bde07084a32e7569c325d6b0e2d90b2ff873ed0edbcf461195e3b955d3909

SHA512
8acc4e10e60551d2780151aafb94a16d7e53182dd54e01c3e50125b724b9b63a6f6ecbca9cdabf21486304837d641661d2ccca947da1a14885d7760900d2e20b

Download Submit
\Windows\system\pacEBZN.exe

Filesize
1.8MB

MD5
631c65ebc7cc53c5fbd7ee8c1301948c

SHA1
8f7f0ce3b02e47dbde9dff3d784d4e4bb90bd71d

SHA256
22670811a6738d0639fd7b8198baeda85629992a7854614db03dc9417e34d6f3

SHA512
1285b56e294c228602b5af4573067c07ed8e8d4209b4a76b7864b2e8ed35b28c735ddd37228350488d847299056c1c57e31829254b96a1a2387495763694d57e

Download Submit
\Windows\system\sXMrwek.exe

Filesize
1.8MB

MD5
b3fa3a9ffefd114bd7fe3d7ab6489e29

SHA1
d326f17341a0ddb9d614b737a41dc898d01dcada

SHA256
452a933b53b370e4a2d9e63f341a05853474400ee0601babd076fa86edf63468

SHA512
67acf286c6734b1938bc98d728a3e462e0b41ef6d85aa5dc82760657c669a99ab6c646fd3df6d3fb826a07d3c11a764f01756551b530091d26bcb255a945f139

Download Submit
\Windows\system\zLNxmxf.exe

Filesize
1.8MB

MD5
a45c45cedfd342e26de243b18ec166b8

SHA1
c0a16afd0a25b3689ee76970e19245b0b4eebdf6

SHA256
6fc0684e4589e3c10491fa910820d36ee8a61ddc7db7326e2c8312e0d013abd9

SHA512
cebf43861c8115f609e2e201cafe74222a8505d84dfb032c764ef81d3fb031887af61bc659bac443392f92c5033798e51b4b6c0143a985d4aae2f74b240c373c

Download Submit
memory/824-0-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/824-27-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/824-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/824-50-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/824-70-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/824-63-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/824-61-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/824-59-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/824-89-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/824-81-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/824-65-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/824-55-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/824-71-0x0000000003510000-0x0000000003902000-memory.dmp

Filesize
3.9MB

Download
memory/960-5222-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/960-45-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2044-5238-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2044-72-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2244-84-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2244-5310-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2256-58-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2536-113-0x0000000001DD0000-0x0000000001DD8000-memory.dmp

Filesize
32KB

Download
memory/2536-69-0x000007FEF633E000-0x000007FEF633F000-memory.dmp

Filesize
4KB

Download
memory/2536-66-0x000000001B7E0000-0x000000001BAC2000-memory.dmp

Filesize
2.9MB

Download
memory/2536-46-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/2580-5230-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-67-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-68-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-5277-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-60-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2648-5227-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2716-62-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2724-64-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2724-5229-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2732-5254-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2732-54-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-97-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-5306-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download