xmrig | d02ce75b13763d3e05d6df498124591364fa9d220a04e277bd5acc26a57e2a4c

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
Size

2.1MB
MD5

0da8ac75f6318043d98175cf8f0bcaf8
SHA1

31d8dcb63402d9e60acac59e11d8f88de5d31dfc
SHA256

d02ce75b13763d3e05d6df498124591364fa9d220a04e277bd5acc26a57e2a4c
SHA512

5a94c6d75594ee9468126e7841811f88db73eb0b6a6d1ab796eb13d45dcb282af4328decdfa93538de639f497bf4c9b498e87bfbb252bdd478b4293118a9e1ae
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrK:NABH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2436-51-0x0000000003080000-0x0000000003472000-memory.dmp	xmrig
behavioral1/memory/2532-55-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2072-58-0x000000013F630000-0x000000013FA22000-memory.dmp	xmrig
behavioral1/memory/2384-57-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2436-54-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2484-1262-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig
behavioral1/memory/2532-1283-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2508-117-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2436-87-0x0000000003560000-0x0000000003952000-memory.dmp	xmrig
behavioral1/memory/2436-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/768-68-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2396-53-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2576-50-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2484-46-0x000000013F380000-0x000000013F772000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2508	zqStSpy.exe
2072	YYZPAOL.exe
2484	hvCWuAB.exe
2576	KoiLHsU.exe
2396	GkHzuca.exe
2532	bwQpIBO.exe
2384	TfcgFiP.exe
768	JKwnYJc.exe
2412	EgIPecr.exe
2676	yECaqQd.exe
2704	ffsiYbV.exe
284	RItwUhI.exe
2108	PpXiwcj.exe
1568	iyeTteN.exe
344	OJmLzED.exe
2024	yTUNGrm.exe
2656	OMgYcvV.exe
1988	MJOWilK.exe
1944	nzQGXVO.exe
1560	XIIhWCz.exe
336	DwbwGEl.exe
1648	AtIKVTI.exe
2916	vSDKdSO.exe
1768	oOuaHRD.exe
1684	hNtJEWE.exe
2180	ZWbGzjH.exe
880	lyrUZYm.exe
716	ARAAelD.exe
1716	VqpZHAp.exe
2848	PPyjkNl.exe
2240	EfWmqkV.exe
2968	PXSSdtM.exe
2736	QLhGZtX.exe
2580	AxjleMH.exe
2404	vNARBzl.exe
2644	dwEvjQp.exe
1124	xBBhWTB.exe
1700	CMYyJWO.exe
1912	gOqHPPc.exe
2320	xNXzLsO.exe
2908	MUCZocj.exe
2600	ZXhzlMG.exe
1532	rmunHon.exe
2360	BZJTYGL.exe
1020	LGXkZOK.exe
2316	TzaOuQi.exe
3008	kQvewtQ.exe
3092	sXhULtz.exe
3124	CnHTyup.exe
3156	mOnWito.exe
3188	ImewOxu.exe
3220	PnrvxPv.exe
3252	CmGFhkF.exe
3284	daRoqdi.exe
3316	HUglbpD.exe
3348	wzxlxJm.exe
3380	dYToosE.exe
3412	ASUDamR.exe
3444	RdLpFhS.exe
3476	WxdnbRY.exe
3508	UgQNYwV.exe
3540	zgCdxfr.exe
3572	fcLQYeP.exe
3604	pgOhkJM.exe

Loads dropped DLL 64 IoCs

pid	Process
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2436-1-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-3.dat	upx
behavioral1/memory/2508-8-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x002d000000014983-25.dat	upx
behavioral1/files/0x0008000000015023-18.dat	upx
behavioral1/files/0x0007000000015136-36.dat	upx
behavioral1/files/0x0007000000015362-39.dat	upx
behavioral1/files/0x00070000000153cf-44.dat	upx
behavioral1/memory/2532-55-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-59.dat	upx
behavioral1/memory/2436-60-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2072-58-0x000000013F630000-0x000000013FA22000-memory.dmp	upx
behavioral1/memory/2384-57-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x0006000000016cfe-179.dat	upx
behavioral1/files/0x0006000000016d1f-193.dat	upx
behavioral1/files/0x0006000000016d27-196.dat	upx
behavioral1/memory/2484-1262-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/memory/2532-1283-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d0e-192.dat	upx
behavioral1/files/0x0006000000016d17-189.dat	upx
behavioral1/files/0x0006000000016d06-182.dat	upx
behavioral1/files/0x0006000000016cf5-176.dat	upx
behavioral1/files/0x0006000000016ce1-154.dat	upx
behavioral1/files/0x0006000000016cab-148.dat	upx
behavioral1/files/0x002d0000000149ea-141.dat	upx
behavioral1/files/0x00060000000167ef-137.dat	upx
behavioral1/files/0x0006000000016525-136.dat	upx
behavioral1/files/0x0006000000016277-134.dat	upx
behavioral1/files/0x0006000000016056-133.dat	upx
behavioral1/files/0x0006000000016c26-131.dat	upx
behavioral1/files/0x0006000000016a45-121.dat	upx
behavioral1/memory/2508-117-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x0006000000016597-114.dat	upx
behavioral1/files/0x0006000000016411-108.dat	upx
behavioral1/files/0x00060000000160f8-102.dat	upx
behavioral1/files/0x0006000000015f9e-95.dat	upx
behavioral1/files/0x0006000000015d6e-88.dat	upx
behavioral1/files/0x0006000000015d06-81.dat	upx
behavioral1/files/0x0006000000016ced-175.dat	upx
behavioral1/files/0x0006000000016cc9-174.dat	upx
behavioral1/files/0x0006000000016c7a-173.dat	upx
behavioral1/files/0x0006000000016c2e-172.dat	upx
behavioral1/files/0x0006000000016c17-171.dat	upx
behavioral1/files/0x0006000000015cec-160.dat	upx
behavioral1/files/0x0006000000015f1b-130.dat	upx
behavioral1/files/0x0006000000015d5d-129.dat	upx
behavioral1/files/0x0006000000015cf7-128.dat	upx
behavioral1/files/0x0006000000015cdb-127.dat	upx
behavioral1/memory/2436-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/memory/768-68-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2396-53-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2576-50-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2484-46-0x000000013F380000-0x000000013F772000-memory.dmp	upx
behavioral1/files/0x001400000000549e-24.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IcxjQwh.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\YmEmFGw.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\dYToosE.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\HRauiAT.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\zjbbPEB.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\xNXzLsO.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\UgQNYwV.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\vjTpHke.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\PrcDHrf.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\lNvzDjG.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\XLTdiPG.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ShduJZd.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ldhaRnx.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\kzfrkhk.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\mayNHeT.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\lWigQov.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\FJQynXV.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\PsUzMCf.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ZNEnVnB.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\nuKtxRD.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\BlnJksO.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\rqPqVFf.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\lNBUDBE.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\OmDCfox.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\cNyGwPQ.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ovDLoTG.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ocCcRWa.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\TQdAIIS.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\seacxEU.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\VTOGoun.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\oqoWEzL.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\dRCApez.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\JsmNQeC.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\iIIlIxE.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\mQpWaGL.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\KwCyIZL.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\JyVGkUS.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\pXZkhMQ.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\hMsMtXh.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\zuLRXAc.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\BLHIvKd.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\MKDPAYM.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\FolWEhG.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ZZRqxzJ.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\nyjDWOp.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ZgenEbs.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ygDzMDR.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ZaJPMPX.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\BJMGylN.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ofwlxJN.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\PJiUtZG.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\NdGNFah.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\sPFHZHr.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\IFUGnOV.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\RItwUhI.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\fQPlxKj.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ZXVPybN.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\CgPEPBR.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\CQIpodj.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\uaeItnZ.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\VHKrPLK.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\ffsiYbV.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\lspJaZy.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
File created	C:\Windows\System\UCbpQPr.exe	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
Token: SeDebugPrivilege	2884	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2884	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2884	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2884	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	29
PID 2436 wrote to memory of 2508	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	30
PID 2436 wrote to memory of 2508	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	30
PID 2436 wrote to memory of 2508	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	30
PID 2436 wrote to memory of 2484	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	31
PID 2436 wrote to memory of 2484	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	31
PID 2436 wrote to memory of 2484	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	31
PID 2436 wrote to memory of 2072	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2072	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2072	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	32
PID 2436 wrote to memory of 2576	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	33
PID 2436 wrote to memory of 2576	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	33
PID 2436 wrote to memory of 2576	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	33
PID 2436 wrote to memory of 2396	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2396	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2396	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	34
PID 2436 wrote to memory of 2532	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	35
PID 2436 wrote to memory of 2532	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	35
PID 2436 wrote to memory of 2532	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	35
PID 2436 wrote to memory of 2384	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	36
PID 2436 wrote to memory of 2384	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	36
PID 2436 wrote to memory of 2384	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	36
PID 2436 wrote to memory of 768	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	37
PID 2436 wrote to memory of 768	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	37
PID 2436 wrote to memory of 768	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	37
PID 2436 wrote to memory of 2412	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	38
PID 2436 wrote to memory of 2412	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	38
PID 2436 wrote to memory of 2412	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	38
PID 2436 wrote to memory of 2656	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	39
PID 2436 wrote to memory of 2656	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	39
PID 2436 wrote to memory of 2656	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	39
PID 2436 wrote to memory of 2676	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	40
PID 2436 wrote to memory of 2676	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	40
PID 2436 wrote to memory of 2676	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	40
PID 2436 wrote to memory of 2240	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	41
PID 2436 wrote to memory of 2240	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	41
PID 2436 wrote to memory of 2240	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	41
PID 2436 wrote to memory of 2704	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	42
PID 2436 wrote to memory of 2704	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	42
PID 2436 wrote to memory of 2704	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	42
PID 2436 wrote to memory of 276	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	43
PID 2436 wrote to memory of 276	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	43
PID 2436 wrote to memory of 276	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	43
PID 2436 wrote to memory of 284	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	44
PID 2436 wrote to memory of 284	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	44
PID 2436 wrote to memory of 284	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	44
PID 2436 wrote to memory of 108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	45
PID 2436 wrote to memory of 108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	45
PID 2436 wrote to memory of 108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	45
PID 2436 wrote to memory of 2108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	46
PID 2436 wrote to memory of 2108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	46
PID 2436 wrote to memory of 2108	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	46
PID 2436 wrote to memory of 2120	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	47
PID 2436 wrote to memory of 2120	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	47
PID 2436 wrote to memory of 2120	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	47
PID 2436 wrote to memory of 1568	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	48
PID 2436 wrote to memory of 1568	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	48
PID 2436 wrote to memory of 1568	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	48
PID 2436 wrote to memory of 2640	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	49
PID 2436 wrote to memory of 2640	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	49
PID 2436 wrote to memory of 2640	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	49
PID 2436 wrote to memory of 344	2436	0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0da8ac75f6318043d98175cf8f0bcaf8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\System\zqStSpy.exe
  C:\Windows\System\zqStSpy.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\hvCWuAB.exe
  C:\Windows\System\hvCWuAB.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\YYZPAOL.exe
  C:\Windows\System\YYZPAOL.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\KoiLHsU.exe
  C:\Windows\System\KoiLHsU.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\GkHzuca.exe
  C:\Windows\System\GkHzuca.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\bwQpIBO.exe
  C:\Windows\System\bwQpIBO.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\TfcgFiP.exe
  C:\Windows\System\TfcgFiP.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\JKwnYJc.exe
  C:\Windows\System\JKwnYJc.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\EgIPecr.exe
  C:\Windows\System\EgIPecr.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\OMgYcvV.exe
  C:\Windows\System\OMgYcvV.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\yECaqQd.exe
  C:\Windows\System\yECaqQd.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\EfWmqkV.exe
  C:\Windows\System\EfWmqkV.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\ffsiYbV.exe
  C:\Windows\System\ffsiYbV.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\LqLytFv.exe
  C:\Windows\System\LqLytFv.exe
  2⤵
  PID:276
- C:\Windows\System\RItwUhI.exe
  C:\Windows\System\RItwUhI.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\GevamRY.exe
  C:\Windows\System\GevamRY.exe
  2⤵
  PID:108
- C:\Windows\System\PpXiwcj.exe
  C:\Windows\System\PpXiwcj.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\kzfrkhk.exe
  C:\Windows\System\kzfrkhk.exe
  2⤵
  PID:2120
- C:\Windows\System\iyeTteN.exe
  C:\Windows\System\iyeTteN.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\WOojbrR.exe
  C:\Windows\System\WOojbrR.exe
  2⤵
  PID:2640
- C:\Windows\System\OJmLzED.exe
  C:\Windows\System\OJmLzED.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\hNwSAMz.exe
  C:\Windows\System\hNwSAMz.exe
  2⤵
  PID:2272
- C:\Windows\System\yTUNGrm.exe
  C:\Windows\System\yTUNGrm.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\mayNHeT.exe
  C:\Windows\System\mayNHeT.exe
  2⤵
  PID:2036
- C:\Windows\System\MJOWilK.exe
  C:\Windows\System\MJOWilK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\AKStroj.exe
  C:\Windows\System\AKStroj.exe
  2⤵
  PID:2980
- C:\Windows\System\nzQGXVO.exe
  C:\Windows\System\nzQGXVO.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\fsBuxsC.exe
  C:\Windows\System\fsBuxsC.exe
  2⤵
  PID:2164
- C:\Windows\System\XIIhWCz.exe
  C:\Windows\System\XIIhWCz.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\smZudwv.exe
  C:\Windows\System\smZudwv.exe
  2⤵
  PID:1036
- C:\Windows\System\DwbwGEl.exe
  C:\Windows\System\DwbwGEl.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\PjRLrcz.exe
  C:\Windows\System\PjRLrcz.exe
  2⤵
  PID:1832
- C:\Windows\System\AtIKVTI.exe
  C:\Windows\System\AtIKVTI.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\kowsfAE.exe
  C:\Windows\System\kowsfAE.exe
  2⤵
  PID:2712
- C:\Windows\System\vSDKdSO.exe
  C:\Windows\System\vSDKdSO.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\abRwnZB.exe
  C:\Windows\System\abRwnZB.exe
  2⤵
  PID:2536
- C:\Windows\System\oOuaHRD.exe
  C:\Windows\System\oOuaHRD.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\rQzVqZP.exe
  C:\Windows\System\rQzVqZP.exe
  2⤵
  PID:380
- C:\Windows\System\hNtJEWE.exe
  C:\Windows\System\hNtJEWE.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\xuhOJWh.exe
  C:\Windows\System\xuhOJWh.exe
  2⤵
  PID:1788
- C:\Windows\System\ZWbGzjH.exe
  C:\Windows\System\ZWbGzjH.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\XKQAEXW.exe
  C:\Windows\System\XKQAEXW.exe
  2⤵
  PID:992
- C:\Windows\System\lyrUZYm.exe
  C:\Windows\System\lyrUZYm.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\jxWPhll.exe
  C:\Windows\System\jxWPhll.exe
  2⤵
  PID:3068
- C:\Windows\System\ARAAelD.exe
  C:\Windows\System\ARAAelD.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\HGvzjHR.exe
  C:\Windows\System\HGvzjHR.exe
  2⤵
  PID:2776
- C:\Windows\System\VqpZHAp.exe
  C:\Windows\System\VqpZHAp.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\zrAYbLg.exe
  C:\Windows\System\zrAYbLg.exe
  2⤵
  PID:1936
- C:\Windows\System\PPyjkNl.exe
  C:\Windows\System\PPyjkNl.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\dvNECrn.exe
  C:\Windows\System\dvNECrn.exe
  2⤵
  PID:1644
- C:\Windows\System\PXSSdtM.exe
  C:\Windows\System\PXSSdtM.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\yZxwMUs.exe
  C:\Windows\System\yZxwMUs.exe
  2⤵
  PID:2748
- C:\Windows\System\QLhGZtX.exe
  C:\Windows\System\QLhGZtX.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\IWZPWlI.exe
  C:\Windows\System\IWZPWlI.exe
  2⤵
  PID:1652
- C:\Windows\System\AxjleMH.exe
  C:\Windows\System\AxjleMH.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\KoLCzWr.exe
  C:\Windows\System\KoLCzWr.exe
  2⤵
  PID:2368
- C:\Windows\System\vNARBzl.exe
  C:\Windows\System\vNARBzl.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\wvZrAgG.exe
  C:\Windows\System\wvZrAgG.exe
  2⤵
  PID:2864
- C:\Windows\System\dwEvjQp.exe
  C:\Windows\System\dwEvjQp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\AEsbLEZ.exe
  C:\Windows\System\AEsbLEZ.exe
  2⤵
  PID:2648
- C:\Windows\System\xBBhWTB.exe
  C:\Windows\System\xBBhWTB.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\ciqZxem.exe
  C:\Windows\System\ciqZxem.exe
  2⤵
  PID:1548
- C:\Windows\System\CMYyJWO.exe
  C:\Windows\System\CMYyJWO.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\IIyVxnO.exe
  C:\Windows\System\IIyVxnO.exe
  2⤵
  PID:1976
- C:\Windows\System\gOqHPPc.exe
  C:\Windows\System\gOqHPPc.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\ifcowKA.exe
  C:\Windows\System\ifcowKA.exe
  2⤵
  PID:1776
- C:\Windows\System\xNXzLsO.exe
  C:\Windows\System\xNXzLsO.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\yMHhgwk.exe
  C:\Windows\System\yMHhgwk.exe
  2⤵
  PID:2284
- C:\Windows\System\MUCZocj.exe
  C:\Windows\System\MUCZocj.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\XFCzCGV.exe
  C:\Windows\System\XFCzCGV.exe
  2⤵
  PID:1544
- C:\Windows\System\ZXhzlMG.exe
  C:\Windows\System\ZXhzlMG.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\cJWQqDY.exe
  C:\Windows\System\cJWQqDY.exe
  2⤵
  PID:624
- C:\Windows\System\rmunHon.exe
  C:\Windows\System\rmunHon.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\zHeOqDU.exe
  C:\Windows\System\zHeOqDU.exe
  2⤵
  PID:1592
- C:\Windows\System\BZJTYGL.exe
  C:\Windows\System\BZJTYGL.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ZSgcNTe.exe
  C:\Windows\System\ZSgcNTe.exe
  2⤵
  PID:2388
- C:\Windows\System\LGXkZOK.exe
  C:\Windows\System\LGXkZOK.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\cgzFZPK.exe
  C:\Windows\System\cgzFZPK.exe
  2⤵
  PID:1180
- C:\Windows\System\TzaOuQi.exe
  C:\Windows\System\TzaOuQi.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\jnwpGdu.exe
  C:\Windows\System\jnwpGdu.exe
  2⤵
  PID:1320
- C:\Windows\System\kQvewtQ.exe
  C:\Windows\System\kQvewtQ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\BLHIvKd.exe
  C:\Windows\System\BLHIvKd.exe
  2⤵
  PID:3076
- C:\Windows\System\sXhULtz.exe
  C:\Windows\System\sXhULtz.exe
  2⤵
  - Executes dropped EXE
  PID:3092
- C:\Windows\System\IKgNxYz.exe
  C:\Windows\System\IKgNxYz.exe
  2⤵
  PID:3108
- C:\Windows\System\CnHTyup.exe
  C:\Windows\System\CnHTyup.exe
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Windows\System\GfDOpHd.exe
  C:\Windows\System\GfDOpHd.exe
  2⤵
  PID:3140
- C:\Windows\System\mOnWito.exe
  C:\Windows\System\mOnWito.exe
  2⤵
  - Executes dropped EXE
  PID:3156
- C:\Windows\System\AkDPXcd.exe
  C:\Windows\System\AkDPXcd.exe
  2⤵
  PID:3172
- C:\Windows\System\ImewOxu.exe
  C:\Windows\System\ImewOxu.exe
  2⤵
  - Executes dropped EXE
  PID:3188
- C:\Windows\System\JNpWgod.exe
  C:\Windows\System\JNpWgod.exe
  2⤵
  PID:3204
- C:\Windows\System\PnrvxPv.exe
  C:\Windows\System\PnrvxPv.exe
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\System\ZyZaNXc.exe
  C:\Windows\System\ZyZaNXc.exe
  2⤵
  PID:3236
- C:\Windows\System\CmGFhkF.exe
  C:\Windows\System\CmGFhkF.exe
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Windows\System\zLrzyFi.exe
  C:\Windows\System\zLrzyFi.exe
  2⤵
  PID:3268
- C:\Windows\System\daRoqdi.exe
  C:\Windows\System\daRoqdi.exe
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Windows\System\FioUULq.exe
  C:\Windows\System\FioUULq.exe
  2⤵
  PID:3300
- C:\Windows\System\HUglbpD.exe
  C:\Windows\System\HUglbpD.exe
  2⤵
  - Executes dropped EXE
  PID:3316
- C:\Windows\System\WNulJuB.exe
  C:\Windows\System\WNulJuB.exe
  2⤵
  PID:3332
- C:\Windows\System\wzxlxJm.exe
  C:\Windows\System\wzxlxJm.exe
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\System\UKuXvBO.exe
  C:\Windows\System\UKuXvBO.exe
  2⤵
  PID:3364
- C:\Windows\System\dYToosE.exe
  C:\Windows\System\dYToosE.exe
  2⤵
  - Executes dropped EXE
  PID:3380
- C:\Windows\System\bDlZIpW.exe
  C:\Windows\System\bDlZIpW.exe
  2⤵
  PID:3396
- C:\Windows\System\ASUDamR.exe
  C:\Windows\System\ASUDamR.exe
  2⤵
  - Executes dropped EXE
  PID:3412
- C:\Windows\System\cZLBRxW.exe
  C:\Windows\System\cZLBRxW.exe
  2⤵
  PID:3428
- C:\Windows\System\RdLpFhS.exe
  C:\Windows\System\RdLpFhS.exe
  2⤵
  - Executes dropped EXE
  PID:3444
- C:\Windows\System\KexuRKp.exe
  C:\Windows\System\KexuRKp.exe
  2⤵
  PID:3460
- C:\Windows\System\WxdnbRY.exe
  C:\Windows\System\WxdnbRY.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\xkGoOKp.exe
  C:\Windows\System\xkGoOKp.exe
  2⤵
  PID:3492
- C:\Windows\System\UgQNYwV.exe
  C:\Windows\System\UgQNYwV.exe
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\System\WMUldOn.exe
  C:\Windows\System\WMUldOn.exe
  2⤵
  PID:3524
- C:\Windows\System\zgCdxfr.exe
  C:\Windows\System\zgCdxfr.exe
  2⤵
  - Executes dropped EXE
  PID:3540
- C:\Windows\System\JaPIHbu.exe
  C:\Windows\System\JaPIHbu.exe
  2⤵
  PID:3556
- C:\Windows\System\fcLQYeP.exe
  C:\Windows\System\fcLQYeP.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\tXaOaht.exe
  C:\Windows\System\tXaOaht.exe
  2⤵
  PID:3588
- C:\Windows\System\pgOhkJM.exe
  C:\Windows\System\pgOhkJM.exe
  2⤵
  - Executes dropped EXE
  PID:3604
- C:\Windows\System\LTkoSMu.exe
  C:\Windows\System\LTkoSMu.exe
  2⤵
  PID:3620
- C:\Windows\System\ijVaTqx.exe
  C:\Windows\System\ijVaTqx.exe
  2⤵
  PID:3636
- C:\Windows\System\scvkLon.exe
  C:\Windows\System\scvkLon.exe
  2⤵
  PID:3652
- C:\Windows\System\hVEdAws.exe
  C:\Windows\System\hVEdAws.exe
  2⤵
  PID:3668
- C:\Windows\System\liBuQxr.exe
  C:\Windows\System\liBuQxr.exe
  2⤵
  PID:3684
- C:\Windows\System\cgCTIpz.exe
  C:\Windows\System\cgCTIpz.exe
  2⤵
  PID:3700
- C:\Windows\System\nMGZfDc.exe
  C:\Windows\System\nMGZfDc.exe
  2⤵
  PID:3716
- C:\Windows\System\TSxtoyu.exe
  C:\Windows\System\TSxtoyu.exe
  2⤵
  PID:3732
- C:\Windows\System\nvCvppG.exe
  C:\Windows\System\nvCvppG.exe
  2⤵
  PID:3748
- C:\Windows\System\sDHouWd.exe
  C:\Windows\System\sDHouWd.exe
  2⤵
  PID:3764
- C:\Windows\System\YYhJbpY.exe
  C:\Windows\System\YYhJbpY.exe
  2⤵
  PID:3780
- C:\Windows\System\gRKPKHM.exe
  C:\Windows\System\gRKPKHM.exe
  2⤵
  PID:3796
- C:\Windows\System\cJHnpIF.exe
  C:\Windows\System\cJHnpIF.exe
  2⤵
  PID:3812
- C:\Windows\System\HoBIVpH.exe
  C:\Windows\System\HoBIVpH.exe
  2⤵
  PID:3828
- C:\Windows\System\oImTLda.exe
  C:\Windows\System\oImTLda.exe
  2⤵
  PID:3844
- C:\Windows\System\lWigQov.exe
  C:\Windows\System\lWigQov.exe
  2⤵
  PID:3860
- C:\Windows\System\TVYqRLm.exe
  C:\Windows\System\TVYqRLm.exe
  2⤵
  PID:3876
- C:\Windows\System\akecUhA.exe
  C:\Windows\System\akecUhA.exe
  2⤵
  PID:3892
- C:\Windows\System\azAXwKl.exe
  C:\Windows\System\azAXwKl.exe
  2⤵
  PID:3908
- C:\Windows\System\KAxMZOR.exe
  C:\Windows\System\KAxMZOR.exe
  2⤵
  PID:3924
- C:\Windows\System\cIVhKnP.exe
  C:\Windows\System\cIVhKnP.exe
  2⤵
  PID:3940
- C:\Windows\System\ESctLII.exe
  C:\Windows\System\ESctLII.exe
  2⤵
  PID:3956
- C:\Windows\System\oNuwGBr.exe
  C:\Windows\System\oNuwGBr.exe
  2⤵
  PID:3972
- C:\Windows\System\oBpudKZ.exe
  C:\Windows\System\oBpudKZ.exe
  2⤵
  PID:3988
- C:\Windows\System\MLagtKp.exe
  C:\Windows\System\MLagtKp.exe
  2⤵
  PID:4004
- C:\Windows\System\vFHvYma.exe
  C:\Windows\System\vFHvYma.exe
  2⤵
  PID:4020
- C:\Windows\System\EzOCRsv.exe
  C:\Windows\System\EzOCRsv.exe
  2⤵
  PID:4036
- C:\Windows\System\YFDfbFx.exe
  C:\Windows\System\YFDfbFx.exe
  2⤵
  PID:4052
- C:\Windows\System\vvRCFLk.exe
  C:\Windows\System\vvRCFLk.exe
  2⤵
  PID:4068
- C:\Windows\System\fQPlxKj.exe
  C:\Windows\System\fQPlxKj.exe
  2⤵
  PID:4084
- C:\Windows\System\emdMABI.exe
  C:\Windows\System\emdMABI.exe
  2⤵
  PID:2020
- C:\Windows\System\lFOlImM.exe
  C:\Windows\System\lFOlImM.exe
  2⤵
  PID:2612
- C:\Windows\System\Aortvsi.exe
  C:\Windows\System\Aortvsi.exe
  2⤵
  PID:3132
- C:\Windows\System\CxWzKWL.exe
  C:\Windows\System\CxWzKWL.exe
  2⤵
  PID:3196
- C:\Windows\System\VMloaFU.exe
  C:\Windows\System\VMloaFU.exe
  2⤵
  PID:3232
- C:\Windows\System\QLlmWGM.exe
  C:\Windows\System\QLlmWGM.exe
  2⤵
  PID:3296
- C:\Windows\System\zuJXtsG.exe
  C:\Windows\System\zuJXtsG.exe
  2⤵
  PID:3360
- C:\Windows\System\SVdaXlP.exe
  C:\Windows\System\SVdaXlP.exe
  2⤵
  PID:3424
- C:\Windows\System\ucxoCCm.exe
  C:\Windows\System\ucxoCCm.exe
  2⤵
  PID:4144
- C:\Windows\System\aIvIoPj.exe
  C:\Windows\System\aIvIoPj.exe
  2⤵
  PID:4160
- C:\Windows\System\eqppQWX.exe
  C:\Windows\System\eqppQWX.exe
  2⤵
  PID:4176
- C:\Windows\System\lMxGKIX.exe
  C:\Windows\System\lMxGKIX.exe
  2⤵
  PID:4192
- C:\Windows\System\gBDXiqb.exe
  C:\Windows\System\gBDXiqb.exe
  2⤵
  PID:4208
- C:\Windows\System\aamTnyM.exe
  C:\Windows\System\aamTnyM.exe
  2⤵
  PID:4224
- C:\Windows\System\YskRnjY.exe
  C:\Windows\System\YskRnjY.exe
  2⤵
  PID:4240
- C:\Windows\System\pxakhnr.exe
  C:\Windows\System\pxakhnr.exe
  2⤵
  PID:4256
- C:\Windows\System\wNsqRaQ.exe
  C:\Windows\System\wNsqRaQ.exe
  2⤵
  PID:4276
- C:\Windows\System\pbVlDGV.exe
  C:\Windows\System\pbVlDGV.exe
  2⤵
  PID:4292
- C:\Windows\System\RFtOUAx.exe
  C:\Windows\System\RFtOUAx.exe
  2⤵
  PID:4308
- C:\Windows\System\lGybUwg.exe
  C:\Windows\System\lGybUwg.exe
  2⤵
  PID:4324
- C:\Windows\System\YcWyWgv.exe
  C:\Windows\System\YcWyWgv.exe
  2⤵
  PID:4340
- C:\Windows\System\mISMhqe.exe
  C:\Windows\System\mISMhqe.exe
  2⤵
  PID:4356
- C:\Windows\System\wfnYKCD.exe
  C:\Windows\System\wfnYKCD.exe
  2⤵
  PID:4372
- C:\Windows\System\XhtzQKd.exe
  C:\Windows\System\XhtzQKd.exe
  2⤵
  PID:4388
- C:\Windows\System\lDnlIrz.exe
  C:\Windows\System\lDnlIrz.exe
  2⤵
  PID:4404
- C:\Windows\System\gvzBvct.exe
  C:\Windows\System\gvzBvct.exe
  2⤵
  PID:4420
- C:\Windows\System\ZaJPMPX.exe
  C:\Windows\System\ZaJPMPX.exe
  2⤵
  PID:4436
- C:\Windows\System\cTUyZdH.exe
  C:\Windows\System\cTUyZdH.exe
  2⤵
  PID:4452
- C:\Windows\System\aAwtgBO.exe
  C:\Windows\System\aAwtgBO.exe
  2⤵
  PID:4468
- C:\Windows\System\GBKLuMq.exe
  C:\Windows\System\GBKLuMq.exe
  2⤵
  PID:4484
- C:\Windows\System\UYLlYzf.exe
  C:\Windows\System\UYLlYzf.exe
  2⤵
  PID:4500
- C:\Windows\System\lrGoJqX.exe
  C:\Windows\System\lrGoJqX.exe
  2⤵
  PID:4516
- C:\Windows\System\qSgmclO.exe
  C:\Windows\System\qSgmclO.exe
  2⤵
  PID:4532
- C:\Windows\System\KRilWfb.exe
  C:\Windows\System\KRilWfb.exe
  2⤵
  PID:4548
- C:\Windows\System\asnRkcC.exe
  C:\Windows\System\asnRkcC.exe
  2⤵
  PID:4564
- C:\Windows\System\xDGqPNe.exe
  C:\Windows\System\xDGqPNe.exe
  2⤵
  PID:4580
- C:\Windows\System\zXZvsnq.exe
  C:\Windows\System\zXZvsnq.exe
  2⤵
  PID:4596
- C:\Windows\System\cfDRfXu.exe
  C:\Windows\System\cfDRfXu.exe
  2⤵
  PID:4612
- C:\Windows\System\rEMsPVh.exe
  C:\Windows\System\rEMsPVh.exe
  2⤵
  PID:4628
- C:\Windows\System\zUaEDaH.exe
  C:\Windows\System\zUaEDaH.exe
  2⤵
  PID:4644
- C:\Windows\System\eIdfdQl.exe
  C:\Windows\System\eIdfdQl.exe
  2⤵
  PID:4660
- C:\Windows\System\cEUumoy.exe
  C:\Windows\System\cEUumoy.exe
  2⤵
  PID:4676
- C:\Windows\System\NowZreP.exe
  C:\Windows\System\NowZreP.exe
  2⤵
  PID:4692
- C:\Windows\System\fsvUIOs.exe
  C:\Windows\System\fsvUIOs.exe
  2⤵
  PID:4708
- C:\Windows\System\ubcclUP.exe
  C:\Windows\System\ubcclUP.exe
  2⤵
  PID:4724
- C:\Windows\System\QsDzWrK.exe
  C:\Windows\System\QsDzWrK.exe
  2⤵
  PID:4740
- C:\Windows\System\MRSkjYv.exe
  C:\Windows\System\MRSkjYv.exe
  2⤵
  PID:4756
- C:\Windows\System\Invkmik.exe
  C:\Windows\System\Invkmik.exe
  2⤵
  PID:4772
- C:\Windows\System\CAlOZGD.exe
  C:\Windows\System\CAlOZGD.exe
  2⤵
  PID:4788
- C:\Windows\System\qWSaLZw.exe
  C:\Windows\System\qWSaLZw.exe
  2⤵
  PID:4804
- C:\Windows\System\nzLKyKF.exe
  C:\Windows\System\nzLKyKF.exe
  2⤵
  PID:4820
- C:\Windows\System\kQrbjoE.exe
  C:\Windows\System\kQrbjoE.exe
  2⤵
  PID:4836
- C:\Windows\System\KydWOle.exe
  C:\Windows\System\KydWOle.exe
  2⤵
  PID:4852
- C:\Windows\System\oDRYZTh.exe
  C:\Windows\System\oDRYZTh.exe
  2⤵
  PID:4868
- C:\Windows\System\vPlmJNu.exe
  C:\Windows\System\vPlmJNu.exe
  2⤵
  PID:4884
- C:\Windows\System\fzQecAm.exe
  C:\Windows\System\fzQecAm.exe
  2⤵
  PID:4900
- C:\Windows\System\RrHAwIp.exe
  C:\Windows\System\RrHAwIp.exe
  2⤵
  PID:4916
- C:\Windows\System\IJCpMbl.exe
  C:\Windows\System\IJCpMbl.exe
  2⤵
  PID:4932
- C:\Windows\System\BNnGwJZ.exe
  C:\Windows\System\BNnGwJZ.exe
  2⤵
  PID:4948
- C:\Windows\System\LLsbuzF.exe
  C:\Windows\System\LLsbuzF.exe
  2⤵
  PID:4964
- C:\Windows\System\NDAmRpw.exe
  C:\Windows\System\NDAmRpw.exe
  2⤵
  PID:4980
- C:\Windows\System\acrmVnQ.exe
  C:\Windows\System\acrmVnQ.exe
  2⤵
  PID:4996
- C:\Windows\System\zbITtvY.exe
  C:\Windows\System\zbITtvY.exe
  2⤵
  PID:5012
- C:\Windows\System\VmnCpez.exe
  C:\Windows\System\VmnCpez.exe
  2⤵
  PID:5028
- C:\Windows\System\nlUmjpb.exe
  C:\Windows\System\nlUmjpb.exe
  2⤵
  PID:5044
- C:\Windows\System\byTXSxI.exe
  C:\Windows\System\byTXSxI.exe
  2⤵
  PID:5060
- C:\Windows\System\OTBcxEi.exe
  C:\Windows\System\OTBcxEi.exe
  2⤵
  PID:5076
- C:\Windows\System\KfhrCPI.exe
  C:\Windows\System\KfhrCPI.exe
  2⤵
  PID:5092
- C:\Windows\System\mifpTcN.exe
  C:\Windows\System\mifpTcN.exe
  2⤵
  PID:5108
- C:\Windows\System\AlHVCkY.exe
  C:\Windows\System\AlHVCkY.exe
  2⤵
  PID:3936
- C:\Windows\System\iXEOtVS.exe
  C:\Windows\System\iXEOtVS.exe
  2⤵
  PID:4000
- C:\Windows\System\bunRAtF.exe
  C:\Windows\System\bunRAtF.exe
  2⤵
  PID:4064
- C:\Windows\System\PeqmHGD.exe
  C:\Windows\System\PeqmHGD.exe
  2⤵
  PID:1704
- C:\Windows\System\yDpjOpX.exe
  C:\Windows\System\yDpjOpX.exe
  2⤵
  PID:2280
- C:\Windows\System\YYjSYlb.exe
  C:\Windows\System\YYjSYlb.exe
  2⤵
  PID:2244
- C:\Windows\System\EdpMZBM.exe
  C:\Windows\System\EdpMZBM.exe
  2⤵
  PID:1040
- C:\Windows\System\vhvRGvE.exe
  C:\Windows\System\vhvRGvE.exe
  2⤵
  PID:588
- C:\Windows\System\RPTAMjX.exe
  C:\Windows\System\RPTAMjX.exe
  2⤵
  PID:2928
- C:\Windows\System\Svhzcxh.exe
  C:\Windows\System\Svhzcxh.exe
  2⤵
  PID:1472
- C:\Windows\System\qLsFGkU.exe
  C:\Windows\System\qLsFGkU.exe
  2⤵
  PID:1616
- C:\Windows\System\adcbMcv.exe
  C:\Windows\System\adcbMcv.exe
  2⤵
  PID:600
- C:\Windows\System\NvehfQf.exe
  C:\Windows\System\NvehfQf.exe
  2⤵
  PID:3064
- C:\Windows\System\cjsXpSo.exe
  C:\Windows\System\cjsXpSo.exe
  2⤵
  PID:2876
- C:\Windows\System\pcRLKyc.exe
  C:\Windows\System\pcRLKyc.exe
  2⤵
  PID:4108
- C:\Windows\System\MKDPAYM.exe
  C:\Windows\System\MKDPAYM.exe
  2⤵
  PID:4124
- C:\Windows\System\RQvzbBh.exe
  C:\Windows\System\RQvzbBh.exe
  2⤵
  PID:4168
- C:\Windows\System\Lmvoiwj.exe
  C:\Windows\System\Lmvoiwj.exe
  2⤵
  PID:4232
- C:\Windows\System\vHXfrUd.exe
  C:\Windows\System\vHXfrUd.exe
  2⤵
  PID:4300
- C:\Windows\System\ALCUphc.exe
  C:\Windows\System\ALCUphc.exe
  2⤵
  PID:4364
- C:\Windows\System\xIbZtoh.exe
  C:\Windows\System\xIbZtoh.exe
  2⤵
  PID:4428
- C:\Windows\System\zRoZKbJ.exe
  C:\Windows\System\zRoZKbJ.exe
  2⤵
  PID:4492
- C:\Windows\System\AFWwQEQ.exe
  C:\Windows\System\AFWwQEQ.exe
  2⤵
  PID:4556
- C:\Windows\System\ZlgwKPm.exe
  C:\Windows\System\ZlgwKPm.exe
  2⤵
  PID:3104
- C:\Windows\System\YGpcsqD.exe
  C:\Windows\System\YGpcsqD.exe
  2⤵
  PID:4656
- C:\Windows\System\SuVuoOX.exe
  C:\Windows\System\SuVuoOX.exe
  2⤵
  PID:4720
- C:\Windows\System\mQpWaGL.exe
  C:\Windows\System\mQpWaGL.exe
  2⤵
  PID:4784
- C:\Windows\System\zxDtsGb.exe
  C:\Windows\System\zxDtsGb.exe
  2⤵
  PID:4848
- C:\Windows\System\kyFJVHg.exe
  C:\Windows\System\kyFJVHg.exe
  2⤵
  PID:4908
- C:\Windows\System\bRxCWff.exe
  C:\Windows\System\bRxCWff.exe
  2⤵
  PID:4972
- C:\Windows\System\rqPqVFf.exe
  C:\Windows\System\rqPqVFf.exe
  2⤵
  PID:2592
- C:\Windows\System\PYzRZtn.exe
  C:\Windows\System\PYzRZtn.exe
  2⤵
  PID:2372
- C:\Windows\System\hmGfZjK.exe
  C:\Windows\System\hmGfZjK.exe
  2⤵
  PID:2700
- C:\Windows\System\uBfuAHT.exe
  C:\Windows\System\uBfuAHT.exe
  2⤵
  PID:1624
- C:\Windows\System\ddyjGIw.exe
  C:\Windows\System\ddyjGIw.exe
  2⤵
  PID:2920
- C:\Windows\System\BYYFMSh.exe
  C:\Windows\System\BYYFMSh.exe
  2⤵
  PID:2628
- C:\Windows\System\ONYljph.exe
  C:\Windows\System\ONYljph.exe
  2⤵
  PID:5040
- C:\Windows\System\UawRIue.exe
  C:\Windows\System\UawRIue.exe
  2⤵
  PID:5100
- C:\Windows\System\GyscUYX.exe
  C:\Windows\System\GyscUYX.exe
  2⤵
  PID:2720
- C:\Windows\System\uQRusiD.exe
  C:\Windows\System\uQRusiD.exe
  2⤵
  PID:2232
- C:\Windows\System\OoDSrMS.exe
  C:\Windows\System\OoDSrMS.exe
  2⤵
  PID:1892
- C:\Windows\System\tptzMgf.exe
  C:\Windows\System\tptzMgf.exe
  2⤵
  PID:1240
- C:\Windows\System\DEVWkPi.exe
  C:\Windows\System\DEVWkPi.exe
  2⤵
  PID:2520
- C:\Windows\System\ALauQEP.exe
  C:\Windows\System\ALauQEP.exe
  2⤵
  PID:2464
- C:\Windows\System\jKzhoUX.exe
  C:\Windows\System\jKzhoUX.exe
  2⤵
  PID:4572
- C:\Windows\System\kUJwXsO.exe
  C:\Windows\System\kUJwXsO.exe
  2⤵
  PID:4988
- C:\Windows\System\XMVjUpr.exe
  C:\Windows\System\XMVjUpr.exe
  2⤵
  PID:2596
- C:\Windows\System\ZXtwEkl.exe
  C:\Windows\System\ZXtwEkl.exe
  2⤵
  PID:3456
- C:\Windows\System\FMnjSYv.exe
  C:\Windows\System\FMnjSYv.exe
  2⤵
  PID:356
- C:\Windows\System\PJOJiIz.exe
  C:\Windows\System\PJOJiIz.exe
  2⤵
  PID:280
- C:\Windows\System\wWsquvB.exe
  C:\Windows\System\wWsquvB.exe
  2⤵
  PID:4384
- C:\Windows\System\itRfcVd.exe
  C:\Windows\System\itRfcVd.exe
  2⤵
  PID:4448
- C:\Windows\System\AotdGWF.exe
  C:\Windows\System\AotdGWF.exe
  2⤵
  PID:4608
- C:\Windows\System\QNTMMLW.exe
  C:\Windows\System\QNTMMLW.exe
  2⤵
  PID:4700
- C:\Windows\System\TaWHenT.exe
  C:\Windows\System\TaWHenT.exe
  2⤵
  PID:4764
- C:\Windows\System\xJtImpD.exe
  C:\Windows\System\xJtImpD.exe
  2⤵
  PID:4828
- C:\Windows\System\zUBNfMV.exe
  C:\Windows\System\zUBNfMV.exe
  2⤵
  PID:4892
- C:\Windows\System\QzQYkMY.exe
  C:\Windows\System\QzQYkMY.exe
  2⤵
  PID:4956
- C:\Windows\System\JNxSiOo.exe
  C:\Windows\System\JNxSiOo.exe
  2⤵
  PID:5024
- C:\Windows\System\MMkUgzV.exe
  C:\Windows\System\MMkUgzV.exe
  2⤵
  PID:5088
- C:\Windows\System\JmmuztI.exe
  C:\Windows\System\JmmuztI.exe
  2⤵
  PID:3932
- C:\Windows\System\SQiujvs.exe
  C:\Windows\System\SQiujvs.exe
  2⤵
  PID:2552
- C:\Windows\System\HkFgvmo.exe
  C:\Windows\System\HkFgvmo.exe
  2⤵
  PID:4248
- C:\Windows\System\NNssQGy.exe
  C:\Windows\System\NNssQGy.exe
  2⤵
  PID:4156
- C:\Windows\System\alDWTsi.exe
  C:\Windows\System\alDWTsi.exe
  2⤵
  PID:3292
- C:\Windows\System\IcxjQwh.exe
  C:\Windows\System\IcxjQwh.exe
  2⤵
  PID:2556
- C:\Windows\System\qxcAJoI.exe
  C:\Windows\System\qxcAJoI.exe
  2⤵
  PID:4048
- C:\Windows\System\IUoBhHW.exe
  C:\Windows\System\IUoBhHW.exe
  2⤵
  PID:3984
- C:\Windows\System\xLnmBwd.exe
  C:\Windows\System\xLnmBwd.exe
  2⤵
  PID:3916
- C:\Windows\System\xTBGovN.exe
  C:\Windows\System\xTBGovN.exe
  2⤵
  PID:3852
- C:\Windows\System\DmeaWoo.exe
  C:\Windows\System\DmeaWoo.exe
  2⤵
  PID:3788
- C:\Windows\System\kzCiiDX.exe
  C:\Windows\System\kzCiiDX.exe
  2⤵
  PID:3724
- C:\Windows\System\XaOIoDX.exe
  C:\Windows\System\XaOIoDX.exe
  2⤵
  PID:3660
- C:\Windows\System\JsDqLhO.exe
  C:\Windows\System\JsDqLhO.exe
  2⤵
  PID:3596
- C:\Windows\System\EvRkIQS.exe
  C:\Windows\System\EvRkIQS.exe
  2⤵
  PID:3532
- C:\Windows\System\MklGRfd.exe
  C:\Windows\System\MklGRfd.exe
  2⤵
  PID:3468
- C:\Windows\System\uSkKyLI.exe
  C:\Windows\System\uSkKyLI.exe
  2⤵
  PID:3404
- C:\Windows\System\giaiClN.exe
  C:\Windows\System\giaiClN.exe
  2⤵
  PID:3340
- C:\Windows\System\hxejhhW.exe
  C:\Windows\System\hxejhhW.exe
  2⤵
  PID:3280
- C:\Windows\System\OCquiPf.exe
  C:\Windows\System\OCquiPf.exe
  2⤵
  PID:3216
- C:\Windows\System\rVvduUe.exe
  C:\Windows\System\rVvduUe.exe
  2⤵
  PID:3152
- C:\Windows\System\TQdAIIS.exe
  C:\Windows\System\TQdAIIS.exe
  2⤵
  PID:3088
- C:\Windows\System\CftDjRz.exe
  C:\Windows\System\CftDjRz.exe
  2⤵
  PID:2324
- C:\Windows\System\LHjcxUc.exe
  C:\Windows\System\LHjcxUc.exe
  2⤵
  PID:3980
- C:\Windows\System\rZEpGWB.exe
  C:\Windows\System\rZEpGWB.exe
  2⤵
  PID:2312
- C:\Windows\System\TVlafrl.exe
  C:\Windows\System\TVlafrl.exe
  2⤵
  PID:1448
- C:\Windows\System\sPwXsMX.exe
  C:\Windows\System\sPwXsMX.exe
  2⤵
  PID:2364
- C:\Windows\System\ycGyglP.exe
  C:\Windows\System\ycGyglP.exe
  2⤵
  PID:2752
- C:\Windows\System\HqHoazY.exe
  C:\Windows\System\HqHoazY.exe
  2⤵
  PID:952
- C:\Windows\System\dwvQyOa.exe
  C:\Windows\System\dwvQyOa.exe
  2⤵
  PID:576
- C:\Windows\System\FyjITCt.exe
  C:\Windows\System\FyjITCt.exe
  2⤵
  PID:3020
- C:\Windows\System\IDsafUC.exe
  C:\Windows\System\IDsafUC.exe
  2⤵
  PID:4120
- C:\Windows\System\urwyHsx.exe
  C:\Windows\System\urwyHsx.exe
  2⤵
  PID:4336
- C:\Windows\System\vRZdIbN.exe
  C:\Windows\System\vRZdIbN.exe
  2⤵
  PID:4460
- C:\Windows\System\BZOgKuS.exe
  C:\Windows\System\BZOgKuS.exe
  2⤵
  PID:4396
- C:\Windows\System\ZCnyazN.exe
  C:\Windows\System\ZCnyazN.exe
  2⤵
  PID:4592
- C:\Windows\System\UvswMNq.exe
  C:\Windows\System\UvswMNq.exe
  2⤵
  PID:4816
- C:\Windows\System\liclcDk.exe
  C:\Windows\System\liclcDk.exe
  2⤵
  PID:4944
- C:\Windows\System\lspJaZy.exe
  C:\Windows\System\lspJaZy.exe
  2⤵
  PID:2408
- C:\Windows\System\ssxhaqY.exe
  C:\Windows\System\ssxhaqY.exe
  2⤵
  PID:2424
- C:\Windows\System\UXJcmXn.exe
  C:\Windows\System\UXJcmXn.exe
  2⤵
  PID:1672
- C:\Windows\System\eaLcOCi.exe
  C:\Windows\System\eaLcOCi.exe
  2⤵
  PID:2416
- C:\Windows\System\tSOInsM.exe
  C:\Windows\System\tSOInsM.exe
  2⤵
  PID:640
- C:\Windows\System\hWReucN.exe
  C:\Windows\System\hWReucN.exe
  2⤵
  PID:4780
- C:\Windows\System\myKfcEz.exe
  C:\Windows\System\myKfcEz.exe
  2⤵
  PID:4508
- C:\Windows\System\ulSimfj.exe
  C:\Windows\System\ulSimfj.exe
  2⤵
  PID:4412
- C:\Windows\System\IbxDCsE.exe
  C:\Windows\System\IbxDCsE.exe
  2⤵
  PID:2452
- C:\Windows\System\qPDHSYT.exe
  C:\Windows\System\qPDHSYT.exe
  2⤵
  PID:5008
- C:\Windows\System\wluAkhK.exe
  C:\Windows\System\wluAkhK.exe
  2⤵
  PID:1516
- C:\Windows\System\UCbpQPr.exe
  C:\Windows\System\UCbpQPr.exe
  2⤵
  PID:2816
- C:\Windows\System\ZXVPybN.exe
  C:\Windows\System\ZXVPybN.exe
  2⤵
  PID:2880
- C:\Windows\System\SaMtmrc.exe
  C:\Windows\System\SaMtmrc.exe
  2⤵
  PID:4512
- C:\Windows\System\EydYfAe.exe
  C:\Windows\System\EydYfAe.exe
  2⤵
  PID:5084
- C:\Windows\System\rOoHtFA.exe
  C:\Windows\System\rOoHtFA.exe
  2⤵
  PID:4188
- C:\Windows\System\sPCNfyt.exe
  C:\Windows\System\sPCNfyt.exe
  2⤵
  PID:2376
- C:\Windows\System\DPsQuzl.exe
  C:\Windows\System\DPsQuzl.exe
  2⤵
  PID:4016
- C:\Windows\System\jPsZxOg.exe
  C:\Windows\System\jPsZxOg.exe
  2⤵
  PID:3728
- C:\Windows\System\JSKjgxE.exe
  C:\Windows\System\JSKjgxE.exe
  2⤵
  PID:3600
- C:\Windows\System\fbZorkY.exe
  C:\Windows\System\fbZorkY.exe
  2⤵
  PID:3472
- C:\Windows\System\bRNZSNr.exe
  C:\Windows\System\bRNZSNr.exe
  2⤵
  PID:1436
- C:\Windows\System\VeviFNH.exe
  C:\Windows\System\VeviFNH.exe
  2⤵
  PID:4864
- C:\Windows\System\VbJOJfH.exe
  C:\Windows\System\VbJOJfH.exe
  2⤵
  PID:5116
- C:\Windows\System\yXeUndy.exe
  C:\Windows\System\yXeUndy.exe
  2⤵
  PID:3420
- C:\Windows\System\JGMzASe.exe
  C:\Windows\System\JGMzASe.exe
  2⤵
  PID:3920
- C:\Windows\System\rLuhizy.exe
  C:\Windows\System\rLuhizy.exe
  2⤵
  PID:3372
- C:\Windows\System\NWTjJSS.exe
  C:\Windows\System\NWTjJSS.exe
  2⤵
  PID:3664
- C:\Windows\System\PdXuqeP.exe
  C:\Windows\System\PdXuqeP.exe
  2⤵
  PID:2740
- C:\Windows\System\TzomhLF.exe
  C:\Windows\System\TzomhLF.exe
  2⤵
  PID:2444
- C:\Windows\System\fHOuYNN.exe
  C:\Windows\System\fHOuYNN.exe
  2⤵
  PID:2264
- C:\Windows\System\TZqAYEP.exe
  C:\Windows\System\TZqAYEP.exe
  2⤵
  PID:2840
- C:\Windows\System\ftRpTSB.exe
  C:\Windows\System\ftRpTSB.exe
  2⤵
  PID:4132
- C:\Windows\System\VJfgSKZ.exe
  C:\Windows\System\VJfgSKZ.exe
  2⤵
  PID:4940
- C:\Windows\System\pZzxzFj.exe
  C:\Windows\System\pZzxzFj.exe
  2⤵
  PID:2004
- C:\Windows\System\YkeQckL.exe
  C:\Windows\System\YkeQckL.exe
  2⤵
  PID:3184
- C:\Windows\System\GXRGNYj.exe
  C:\Windows\System\GXRGNYj.exe
  2⤵
  PID:4716
- C:\Windows\System\MSMKrbH.exe
  C:\Windows\System\MSMKrbH.exe
  2⤵
  PID:2692
- C:\Windows\System\KLBjRCk.exe
  C:\Windows\System\KLBjRCk.exe
  2⤵
  PID:2212
- C:\Windows\System\XeKqEKl.exe
  C:\Windows\System\XeKqEKl.exe
  2⤵
  PID:4204
- C:\Windows\System\IghmSlZ.exe
  C:\Windows\System\IghmSlZ.exe
  2⤵
  PID:4264
- C:\Windows\System\uXARcMq.exe
  C:\Windows\System\uXARcMq.exe
  2⤵
  PID:1720
- C:\Windows\System\kRTjOdR.exe
  C:\Windows\System\kRTjOdR.exe
  2⤵
  PID:2572
- C:\Windows\System\rbDoPur.exe
  C:\Windows\System\rbDoPur.exe
  2⤵
  PID:1556
- C:\Windows\System\quMkTOc.exe
  C:\Windows\System\quMkTOc.exe
  2⤵
  PID:3996
- C:\Windows\System\OUNQVhP.exe
  C:\Windows\System\OUNQVhP.exe
  2⤵
  PID:1200
- C:\Windows\System\ToWGkGn.exe
  C:\Windows\System\ToWGkGn.exe
  2⤵
  PID:2112
- C:\Windows\System\TFEycuM.exe
  C:\Windows\System\TFEycuM.exe
  2⤵
  PID:4924
- C:\Windows\System\mFBIexO.exe
  C:\Windows\System\mFBIexO.exe
  2⤵
  PID:3856
- C:\Windows\System\recxeGQ.exe
  C:\Windows\System\recxeGQ.exe
  2⤵
  PID:2680
- C:\Windows\System\VChSgtP.exe
  C:\Windows\System\VChSgtP.exe
  2⤵
  PID:3164
- C:\Windows\System\akeVdLd.exe
  C:\Windows\System\akeVdLd.exe
  2⤵
  PID:3792
- C:\Windows\System\ZdoKvya.exe
  C:\Windows\System\ZdoKvya.exe
  2⤵
  PID:2100
- C:\Windows\System\FJQynXV.exe
  C:\Windows\System\FJQynXV.exe
  2⤵
  PID:1688
- C:\Windows\System\VvlaYXH.exe
  C:\Windows\System\VvlaYXH.exe
  2⤵
  PID:1260
- C:\Windows\System\fJDbqcZ.exe
  C:\Windows\System\fJDbqcZ.exe
  2⤵
  PID:4752
- C:\Windows\System\WujDghX.exe
  C:\Windows\System\WujDghX.exe
  2⤵
  PID:4796
- C:\Windows\System\ddtLTQR.exe
  C:\Windows\System\ddtLTQR.exe
  2⤵
  PID:4352
- C:\Windows\System\kzYDLPq.exe
  C:\Windows\System\kzYDLPq.exe
  2⤵
  PID:3692
- C:\Windows\System\IKxvuBA.exe
  C:\Windows\System\IKxvuBA.exe
  2⤵
  PID:1880
- C:\Windows\System\wYfugSx.exe
  C:\Windows\System\wYfugSx.exe
  2⤵
  PID:3564
- C:\Windows\System\GKaJAIR.exe
  C:\Windows\System\GKaJAIR.exe
  2⤵
  PID:1656
- C:\Windows\System\SBZfWYY.exe
  C:\Windows\System\SBZfWYY.exe
  2⤵
  PID:1288
- C:\Windows\System\seacxEU.exe
  C:\Windows\System\seacxEU.exe
  2⤵
  PID:2080
- C:\Windows\System\XBDBVFd.exe
  C:\Windows\System\XBDBVFd.exe
  2⤵
  PID:1932
- C:\Windows\System\IvXoKUy.exe
  C:\Windows\System\IvXoKUy.exe
  2⤵
  PID:3884
- C:\Windows\System\qXMomPk.exe
  C:\Windows\System\qXMomPk.exe
  2⤵
  PID:1784
- C:\Windows\System\eMGaAev.exe
  C:\Windows\System\eMGaAev.exe
  2⤵
  PID:3180
- C:\Windows\System\ovlyDdR.exe
  C:\Windows\System\ovlyDdR.exe
  2⤵
  PID:4220
- C:\Windows\System\NaBNFaP.exe
  C:\Windows\System\NaBNFaP.exe
  2⤵
  PID:1000
- C:\Windows\System\ZNEnVnB.exe
  C:\Windows\System\ZNEnVnB.exe
  2⤵
  PID:3948
- C:\Windows\System\CAgZqHm.exe
  C:\Windows\System\CAgZqHm.exe
  2⤵
  PID:1712
- C:\Windows\System\krZuAYQ.exe
  C:\Windows\System\krZuAYQ.exe
  2⤵
  PID:5104
- C:\Windows\System\gqCMSCp.exe
  C:\Windows\System\gqCMSCp.exe
  2⤵
  PID:3344
- C:\Windows\System\ZwGfdzg.exe
  C:\Windows\System\ZwGfdzg.exe
  2⤵
  PID:4524
- C:\Windows\System\OpkIBox.exe
  C:\Windows\System\OpkIBox.exe
  2⤵
  PID:3756
- C:\Windows\System\IlxNLWX.exe
  C:\Windows\System\IlxNLWX.exe
  2⤵
  PID:3116
- C:\Windows\System\hbWEBFc.exe
  C:\Windows\System\hbWEBFc.exe
  2⤵
  PID:5128
- C:\Windows\System\gmiUnZF.exe
  C:\Windows\System\gmiUnZF.exe
  2⤵
  PID:5144
- C:\Windows\System\HAcjlQk.exe
  C:\Windows\System\HAcjlQk.exe
  2⤵
  PID:5160
- C:\Windows\System\dVseIEa.exe
  C:\Windows\System\dVseIEa.exe
  2⤵
  PID:5176
- C:\Windows\System\RgYpDTQ.exe
  C:\Windows\System\RgYpDTQ.exe
  2⤵
  PID:5192
- C:\Windows\System\rysCGda.exe
  C:\Windows\System\rysCGda.exe
  2⤵
  PID:5208
- C:\Windows\System\xFxeAKM.exe
  C:\Windows\System\xFxeAKM.exe
  2⤵
  PID:5224
- C:\Windows\System\sxdhTPh.exe
  C:\Windows\System\sxdhTPh.exe
  2⤵
  PID:5240
- C:\Windows\System\nSglvsD.exe
  C:\Windows\System\nSglvsD.exe
  2⤵
  PID:5256
- C:\Windows\System\CuIJXJD.exe
  C:\Windows\System\CuIJXJD.exe
  2⤵
  PID:5272
- C:\Windows\System\hGUNUck.exe
  C:\Windows\System\hGUNUck.exe
  2⤵
  PID:5288
- C:\Windows\System\WRLVUAh.exe
  C:\Windows\System\WRLVUAh.exe
  2⤵
  PID:5304
- C:\Windows\System\msmitTf.exe
  C:\Windows\System\msmitTf.exe
  2⤵
  PID:5320
- C:\Windows\System\aDLBPTM.exe
  C:\Windows\System\aDLBPTM.exe
  2⤵
  PID:5336
- C:\Windows\System\lyyWvpe.exe
  C:\Windows\System\lyyWvpe.exe
  2⤵
  PID:5352
- C:\Windows\System\IyaMoUB.exe
  C:\Windows\System\IyaMoUB.exe
  2⤵
  PID:5368
- C:\Windows\System\OJWrmFp.exe
  C:\Windows\System\OJWrmFp.exe
  2⤵
  PID:5384
- C:\Windows\System\tuJZoZJ.exe
  C:\Windows\System\tuJZoZJ.exe
  2⤵
  PID:5400
- C:\Windows\System\yJNCLal.exe
  C:\Windows\System\yJNCLal.exe
  2⤵
  PID:5416
- C:\Windows\System\BKQBQxu.exe
  C:\Windows\System\BKQBQxu.exe
  2⤵
  PID:5432
- C:\Windows\System\XyYphfD.exe
  C:\Windows\System\XyYphfD.exe
  2⤵
  PID:5452
- C:\Windows\System\NQUJbIw.exe
  C:\Windows\System\NQUJbIw.exe
  2⤵
  PID:5468
- C:\Windows\System\ZiCiUav.exe
  C:\Windows\System\ZiCiUav.exe
  2⤵
  PID:5484
- C:\Windows\System\CXhlfbN.exe
  C:\Windows\System\CXhlfbN.exe
  2⤵
  PID:5500
- C:\Windows\System\xTxoUyA.exe
  C:\Windows\System\xTxoUyA.exe
  2⤵
  PID:5516
- C:\Windows\System\nJPASuX.exe
  C:\Windows\System\nJPASuX.exe
  2⤵
  PID:5532
- C:\Windows\System\evjKgJQ.exe
  C:\Windows\System\evjKgJQ.exe
  2⤵
  PID:5548
- C:\Windows\System\zjIHsRO.exe
  C:\Windows\System\zjIHsRO.exe
  2⤵
  PID:5564
- C:\Windows\System\ICnMNWm.exe
  C:\Windows\System\ICnMNWm.exe
  2⤵
  PID:5580
- C:\Windows\System\hUfhQwk.exe
  C:\Windows\System\hUfhQwk.exe
  2⤵
  PID:5596
- C:\Windows\System\IhgVZQa.exe
  C:\Windows\System\IhgVZQa.exe
  2⤵
  PID:5612
- C:\Windows\System\TKfJzYR.exe
  C:\Windows\System\TKfJzYR.exe
  2⤵
  PID:5628
- C:\Windows\System\wTTcXbE.exe
  C:\Windows\System\wTTcXbE.exe
  2⤵
  PID:5644
- C:\Windows\System\BtEtXgR.exe
  C:\Windows\System\BtEtXgR.exe
  2⤵
  PID:5660
- C:\Windows\System\jqQXqWG.exe
  C:\Windows\System\jqQXqWG.exe
  2⤵
  PID:5676
- C:\Windows\System\lMUplCm.exe
  C:\Windows\System\lMUplCm.exe
  2⤵
  PID:5692
- C:\Windows\System\mRPKBdb.exe
  C:\Windows\System\mRPKBdb.exe
  2⤵
  PID:5708
- C:\Windows\System\znNDsKZ.exe
  C:\Windows\System\znNDsKZ.exe
  2⤵
  PID:5724
- C:\Windows\System\yIKfTSz.exe
  C:\Windows\System\yIKfTSz.exe
  2⤵
  PID:5740
- C:\Windows\System\ZqBOkyA.exe
  C:\Windows\System\ZqBOkyA.exe
  2⤵
  PID:5756
- C:\Windows\System\GvpBiMR.exe
  C:\Windows\System\GvpBiMR.exe
  2⤵
  PID:5772
- C:\Windows\System\JNVrCYn.exe
  C:\Windows\System\JNVrCYn.exe
  2⤵
  PID:5788
- C:\Windows\System\qmYeMvy.exe
  C:\Windows\System\qmYeMvy.exe
  2⤵
  PID:5804
- C:\Windows\System\lUHaVML.exe
  C:\Windows\System\lUHaVML.exe
  2⤵
  PID:5820
- C:\Windows\System\vroQiOn.exe
  C:\Windows\System\vroQiOn.exe
  2⤵
  PID:5836
- C:\Windows\System\jmuxtbR.exe
  C:\Windows\System\jmuxtbR.exe
  2⤵
  PID:5852
- C:\Windows\System\gBMbEYc.exe
  C:\Windows\System\gBMbEYc.exe
  2⤵
  PID:5868
- C:\Windows\System\DnUtVfm.exe
  C:\Windows\System\DnUtVfm.exe
  2⤵
  PID:5884
- C:\Windows\System\gwFjNpF.exe
  C:\Windows\System\gwFjNpF.exe
  2⤵
  PID:5900
- C:\Windows\System\lBuBdpy.exe
  C:\Windows\System\lBuBdpy.exe
  2⤵
  PID:5916
- C:\Windows\System\XWWcBnH.exe
  C:\Windows\System\XWWcBnH.exe
  2⤵
  PID:5932
- C:\Windows\System\DUIsAJJ.exe
  C:\Windows\System\DUIsAJJ.exe
  2⤵
  PID:5948
- C:\Windows\System\XmiBMbE.exe
  C:\Windows\System\XmiBMbE.exe
  2⤵
  PID:5964
- C:\Windows\System\YcbZRoN.exe
  C:\Windows\System\YcbZRoN.exe
  2⤵
  PID:5980
- C:\Windows\System\YjYDSVl.exe
  C:\Windows\System\YjYDSVl.exe
  2⤵
  PID:5996
- C:\Windows\System\AbJYBEB.exe
  C:\Windows\System\AbJYBEB.exe
  2⤵
  PID:6012
- C:\Windows\System\ssXjobP.exe
  C:\Windows\System\ssXjobP.exe
  2⤵
  PID:6028
- C:\Windows\System\hKFBKCU.exe
  C:\Windows\System\hKFBKCU.exe
  2⤵
  PID:6044
- C:\Windows\System\LffSZhx.exe
  C:\Windows\System\LffSZhx.exe
  2⤵
  PID:6060
- C:\Windows\System\plQUvwx.exe
  C:\Windows\System\plQUvwx.exe
  2⤵
  PID:6076
- C:\Windows\System\KwCyIZL.exe
  C:\Windows\System\KwCyIZL.exe
  2⤵
  PID:6092
- C:\Windows\System\uaeItnZ.exe
  C:\Windows\System\uaeItnZ.exe
  2⤵
  PID:6108
- C:\Windows\System\KvsWyix.exe
  C:\Windows\System\KvsWyix.exe
  2⤵
  PID:6124
- C:\Windows\System\uIrmeID.exe
  C:\Windows\System\uIrmeID.exe
  2⤵
  PID:6140
- C:\Windows\System\WFjtvLi.exe
  C:\Windows\System\WFjtvLi.exe
  2⤵
  PID:4076
- C:\Windows\System\XsGCAJu.exe
  C:\Windows\System\XsGCAJu.exe
  2⤵
  PID:4060
- C:\Windows\System\DtMvBYG.exe
  C:\Windows\System\DtMvBYG.exe
  2⤵
  PID:5172
- C:\Windows\System\VllNqmJ.exe
  C:\Windows\System\VllNqmJ.exe
  2⤵
  PID:1244
- C:\Windows\System\bhZethj.exe
  C:\Windows\System\bhZethj.exe
  2⤵
  PID:4800
- C:\Windows\System\nEWECAL.exe
  C:\Windows\System\nEWECAL.exe
  2⤵
  PID:936
- C:\Windows\System\qGqfoLk.exe
  C:\Windows\System\qGqfoLk.exe
  2⤵
  PID:5156
- C:\Windows\System\QyPkJPt.exe
  C:\Windows\System\QyPkJPt.exe
  2⤵
  PID:5200
- C:\Windows\System\ZNejQbh.exe
  C:\Windows\System\ZNejQbh.exe
  2⤵
  PID:5188
- C:\Windows\System\JwwLVej.exe
  C:\Windows\System\JwwLVej.exe
  2⤵
  PID:1460
- C:\Windows\System\WpPNpCJ.exe
  C:\Windows\System\WpPNpCJ.exe
  2⤵
  PID:5360
- C:\Windows\System\wqSNKbl.exe
  C:\Windows\System\wqSNKbl.exe
  2⤵
  PID:5216
- C:\Windows\System\zVWCtiq.exe
  C:\Windows\System\zVWCtiq.exe
  2⤵
  PID:5448
- C:\Windows\System\oeJRGQJ.exe
  C:\Windows\System\oeJRGQJ.exe
  2⤵
  PID:5316
- C:\Windows\System\gsxbqHb.exe
  C:\Windows\System\gsxbqHb.exe
  2⤵
  PID:5380
- C:\Windows\System\Bytbnom.exe
  C:\Windows\System\Bytbnom.exe
  2⤵
  PID:5476
- C:\Windows\System\Qixekyp.exe
  C:\Windows\System\Qixekyp.exe
  2⤵
  PID:5460
- C:\Windows\System\CvfqRdT.exe
  C:\Windows\System\CvfqRdT.exe
  2⤵
  PID:5496
- C:\Windows\System\adBoLiu.exe
  C:\Windows\System\adBoLiu.exe
  2⤵
  PID:5560
- C:\Windows\System\DuPnevB.exe
  C:\Windows\System\DuPnevB.exe
  2⤵
  PID:272
- C:\Windows\System\pTtJKFU.exe
  C:\Windows\System\pTtJKFU.exe
  2⤵
  PID:5656
- C:\Windows\System\dOtuJsk.exe
  C:\Windows\System\dOtuJsk.exe
  2⤵
  PID:5716
- C:\Windows\System\AmeNYfX.exe
  C:\Windows\System\AmeNYfX.exe
  2⤵
  PID:5780
- C:\Windows\System\FLJeber.exe
  C:\Windows\System\FLJeber.exe
  2⤵
  PID:5844
- C:\Windows\System\lRdtZZT.exe
  C:\Windows\System\lRdtZZT.exe
  2⤵
  PID:5508
- C:\Windows\System\HtUsUJm.exe
  C:\Windows\System\HtUsUJm.exe
  2⤵
  PID:5572
- C:\Windows\System\pzVeqGV.exe
  C:\Windows\System\pzVeqGV.exe
  2⤵
  PID:5640
- C:\Windows\System\nYXKHIH.exe
  C:\Windows\System\nYXKHIH.exe
  2⤵
  PID:5944
- C:\Windows\System\CELgkXF.exe
  C:\Windows\System\CELgkXF.exe
  2⤵
  PID:5976
- C:\Windows\System\ijwwtUH.exe
  C:\Windows\System\ijwwtUH.exe
  2⤵
  PID:5860
- C:\Windows\System\kNTIWNW.exe
  C:\Windows\System\kNTIWNW.exe
  2⤵
  PID:6100
- C:\Windows\System\zuDjptJ.exe
  C:\Windows\System\zuDjptJ.exe
  2⤵
  PID:5700
- C:\Windows\System\kcPjuZK.exe
  C:\Windows\System\kcPjuZK.exe
  2⤵
  PID:5736
- C:\Windows\System\drWbeOZ.exe
  C:\Windows\System\drWbeOZ.exe
  2⤵
  PID:5800
- C:\Windows\System\HrRKiTq.exe
  C:\Windows\System\HrRKiTq.exe
  2⤵
  PID:1736
- C:\Windows\System\tcfUlNj.exe
  C:\Windows\System\tcfUlNj.exe
  2⤵
  PID:5140
- C:\Windows\System\SjnYLVM.exe
  C:\Windows\System\SjnYLVM.exe
  2⤵
  PID:1580
- C:\Windows\System\RrhJnwy.exe
  C:\Windows\System\RrhJnwy.exe
  2⤵
  PID:5896
- C:\Windows\System\RZhXyJS.exe
  C:\Windows\System\RZhXyJS.exe
  2⤵
  PID:5296
- C:\Windows\System\GXbybvV.exe
  C:\Windows\System\GXbybvV.exe
  2⤵
  PID:5992
- C:\Windows\System\pHBiNxF.exe
  C:\Windows\System\pHBiNxF.exe
  2⤵
  PID:6056
- C:\Windows\System\fOhCgjI.exe
  C:\Windows\System\fOhCgjI.exe
  2⤵
  PID:6120
- C:\Windows\System\JyVGkUS.exe
  C:\Windows\System\JyVGkUS.exe
  2⤵
  PID:3028
- C:\Windows\System\efbTeig.exe
  C:\Windows\System\efbTeig.exe
  2⤵
  PID:5124
- C:\Windows\System\AscHymE.exe
  C:\Windows\System\AscHymE.exe
  2⤵
  PID:5332
- C:\Windows\System\JeMwhpn.exe
  C:\Windows\System\JeMwhpn.exe
  2⤵
  PID:5312
- C:\Windows\System\RyXaPuW.exe
  C:\Windows\System\RyXaPuW.exe
  2⤵
  PID:5492
- C:\Windows\System\ZZmgjFL.exe
  C:\Windows\System\ZZmgjFL.exe
  2⤵
  PID:5688
- C:\Windows\System\JvGEjqi.exe
  C:\Windows\System\JvGEjqi.exe
  2⤵
  PID:5348
- C:\Windows\System\jTlJIby.exe
  C:\Windows\System\jTlJIby.exe
  2⤵
  PID:5528
- C:\Windows\System\muWVind.exe
  C:\Windows\System\muWVind.exe
  2⤵
  PID:5752
- C:\Windows\System\FolWEhG.exe
  C:\Windows\System\FolWEhG.exe
  2⤵
  PID:5544
- C:\Windows\System\nxGyMYg.exe
  C:\Windows\System\nxGyMYg.exe
  2⤵
  PID:5608
- C:\Windows\System\eUTmXPc.exe
  C:\Windows\System\eUTmXPc.exe
  2⤵
  PID:5732
- C:\Windows\System\kMUitjJ.exe
  C:\Windows\System\kMUitjJ.exe
  2⤵
  PID:5880
- C:\Windows\System\HHmeaZk.exe
  C:\Windows\System\HHmeaZk.exe
  2⤵
  PID:816
- C:\Windows\System\BflzCwo.exe
  C:\Windows\System\BflzCwo.exe
  2⤵
  PID:6052
- C:\Windows\System\gZKHbto.exe
  C:\Windows\System\gZKHbto.exe
  2⤵
  PID:5168
- C:\Windows\System\ABjfuEm.exe
  C:\Windows\System\ABjfuEm.exe
  2⤵
  PID:5540
- C:\Windows\System\FcmZpHQ.exe
  C:\Windows\System\FcmZpHQ.exe
  2⤵
  PID:5796
- C:\Windows\System\hOvEIWE.exe
  C:\Windows\System\hOvEIWE.exe
  2⤵
  PID:5864
- C:\Windows\System\ANQZiUJ.exe
  C:\Windows\System\ANQZiUJ.exe
  2⤵
  PID:6116
- C:\Windows\System\IGqfQGq.exe
  C:\Windows\System\IGqfQGq.exe
  2⤵
  PID:5652
- C:\Windows\System\lGtVMDn.exe
  C:\Windows\System\lGtVMDn.exe
  2⤵
  PID:6132
- C:\Windows\System\BJMGylN.exe
  C:\Windows\System\BJMGylN.exe
  2⤵
  PID:5252
- C:\Windows\System\pXZkhMQ.exe
  C:\Windows\System\pXZkhMQ.exe
  2⤵
  PID:5376
- C:\Windows\System\weKgaWg.exe
  C:\Windows\System\weKgaWg.exe
  2⤵
  PID:6068
- C:\Windows\System\eqFobIM.exe
  C:\Windows\System\eqFobIM.exe
  2⤵
  PID:6024
- C:\Windows\System\IlYpCxg.exe
  C:\Windows\System\IlYpCxg.exe
  2⤵
  PID:5816
- C:\Windows\System\cmtukGg.exe
  C:\Windows\System\cmtukGg.exe
  2⤵
  PID:5988
- C:\Windows\System\ScbPUgy.exe
  C:\Windows\System\ScbPUgy.exe
  2⤵
  PID:5832
- C:\Windows\System\ZWduiZv.exe
  C:\Windows\System\ZWduiZv.exe
  2⤵
  PID:5672
- C:\Windows\System\WmoEliQ.exe
  C:\Windows\System\WmoEliQ.exe
  2⤵
  PID:3100
- C:\Windows\System\rHkUHZI.exe
  C:\Windows\System\rHkUHZI.exe
  2⤵
  PID:5480
- C:\Windows\System\rHTZIWZ.exe
  C:\Windows\System\rHTZIWZ.exe
  2⤵
  PID:6160
- C:\Windows\System\ZjVnXlz.exe
  C:\Windows\System\ZjVnXlz.exe
  2⤵
  PID:6176
- C:\Windows\System\tqmzaKc.exe
  C:\Windows\System\tqmzaKc.exe
  2⤵
  PID:6192
- C:\Windows\System\WJwervt.exe
  C:\Windows\System\WJwervt.exe
  2⤵
  PID:6208
- C:\Windows\System\cnyQkNd.exe
  C:\Windows\System\cnyQkNd.exe
  2⤵
  PID:6224
- C:\Windows\System\tyWXZaW.exe
  C:\Windows\System\tyWXZaW.exe
  2⤵
  PID:6244
- C:\Windows\System\AAyEimv.exe
  C:\Windows\System\AAyEimv.exe
  2⤵
  PID:6260
- C:\Windows\System\IakmSoh.exe
  C:\Windows\System\IakmSoh.exe
  2⤵
  PID:6276
- C:\Windows\System\hJZfKXV.exe
  C:\Windows\System\hJZfKXV.exe
  2⤵
  PID:6292
- C:\Windows\System\aSZEPQp.exe
  C:\Windows\System\aSZEPQp.exe
  2⤵
  PID:6308
- C:\Windows\System\mLovKVM.exe
  C:\Windows\System\mLovKVM.exe
  2⤵
  PID:6324
- C:\Windows\System\OgQoOCf.exe
  C:\Windows\System\OgQoOCf.exe
  2⤵
  PID:6340
- C:\Windows\System\pMIgEHt.exe
  C:\Windows\System\pMIgEHt.exe
  2⤵
  PID:6356
- C:\Windows\System\ZGfGQsT.exe
  C:\Windows\System\ZGfGQsT.exe
  2⤵
  PID:6372
- C:\Windows\System\DNQBxQi.exe
  C:\Windows\System\DNQBxQi.exe
  2⤵
  PID:6388
- C:\Windows\System\UvoKhzX.exe
  C:\Windows\System\UvoKhzX.exe
  2⤵
  PID:6404
- C:\Windows\System\QgLzhsK.exe
  C:\Windows\System\QgLzhsK.exe
  2⤵
  PID:6424
- C:\Windows\System\qCsgtYG.exe
  C:\Windows\System\qCsgtYG.exe
  2⤵
  PID:6440
- C:\Windows\System\lalNJUn.exe
  C:\Windows\System\lalNJUn.exe
  2⤵
  PID:6456
- C:\Windows\System\cxGLIXB.exe
  C:\Windows\System\cxGLIXB.exe
  2⤵
  PID:6472
- C:\Windows\System\VTOGoun.exe
  C:\Windows\System\VTOGoun.exe
  2⤵
  PID:6488
- C:\Windows\System\YmEmFGw.exe
  C:\Windows\System\YmEmFGw.exe
  2⤵
  PID:6504
- C:\Windows\System\eCrlkuB.exe
  C:\Windows\System\eCrlkuB.exe
  2⤵
  PID:6520
- C:\Windows\System\rrHshzh.exe
  C:\Windows\System\rrHshzh.exe
  2⤵
  PID:6536
- C:\Windows\System\wYjxgxF.exe
  C:\Windows\System\wYjxgxF.exe
  2⤵
  PID:6552
- C:\Windows\System\ofwlxJN.exe
  C:\Windows\System\ofwlxJN.exe
  2⤵
  PID:6568
- C:\Windows\System\SVITLHx.exe
  C:\Windows\System\SVITLHx.exe
  2⤵
  PID:6584
- C:\Windows\System\jTGgMNB.exe
  C:\Windows\System\jTGgMNB.exe
  2⤵
  PID:6600
- C:\Windows\System\mYfOQrn.exe
  C:\Windows\System\mYfOQrn.exe
  2⤵
  PID:6616
- C:\Windows\System\yQCPRxy.exe
  C:\Windows\System\yQCPRxy.exe
  2⤵
  PID:6632
- C:\Windows\System\PsUzMCf.exe
  C:\Windows\System\PsUzMCf.exe
  2⤵
  PID:6648
- C:\Windows\System\DYwwODi.exe
  C:\Windows\System\DYwwODi.exe
  2⤵
  PID:6664
- C:\Windows\System\IeMiqfO.exe
  C:\Windows\System\IeMiqfO.exe
  2⤵
  PID:6680
- C:\Windows\System\lYFvIsm.exe
  C:\Windows\System\lYFvIsm.exe
  2⤵
  PID:6696
- C:\Windows\System\SVNilno.exe
  C:\Windows\System\SVNilno.exe
  2⤵
  PID:6712
- C:\Windows\System\UpQsMll.exe
  C:\Windows\System\UpQsMll.exe
  2⤵
  PID:6728
- C:\Windows\System\pAgoybI.exe
  C:\Windows\System\pAgoybI.exe
  2⤵
  PID:6744
- C:\Windows\System\QeiAIpf.exe
  C:\Windows\System\QeiAIpf.exe
  2⤵
  PID:6760
- C:\Windows\System\IITTZOx.exe
  C:\Windows\System\IITTZOx.exe
  2⤵
  PID:6776
- C:\Windows\System\SjXAHcD.exe
  C:\Windows\System\SjXAHcD.exe
  2⤵
  PID:6792
- C:\Windows\System\OSniKdm.exe
  C:\Windows\System\OSniKdm.exe
  2⤵
  PID:6808
- C:\Windows\System\BxwWgMN.exe
  C:\Windows\System\BxwWgMN.exe
  2⤵
  PID:6828
- C:\Windows\System\TXPoWjs.exe
  C:\Windows\System\TXPoWjs.exe
  2⤵
  PID:6844
- C:\Windows\System\ADZYOAz.exe
  C:\Windows\System\ADZYOAz.exe
  2⤵
  PID:6860
- C:\Windows\System\DqgnbGZ.exe
  C:\Windows\System\DqgnbGZ.exe
  2⤵
  PID:6876
- C:\Windows\System\LycKBzS.exe
  C:\Windows\System\LycKBzS.exe
  2⤵
  PID:6892
- C:\Windows\System\nwqOJBW.exe
  C:\Windows\System\nwqOJBW.exe
  2⤵
  PID:6908
- C:\Windows\System\ZZRqxzJ.exe
  C:\Windows\System\ZZRqxzJ.exe
  2⤵
  PID:6924
- C:\Windows\System\FHZkBRy.exe
  C:\Windows\System\FHZkBRy.exe
  2⤵
  PID:6940
- C:\Windows\System\niDcrqT.exe
  C:\Windows\System\niDcrqT.exe
  2⤵
  PID:6956
- C:\Windows\System\XcVDzND.exe
  C:\Windows\System\XcVDzND.exe
  2⤵
  PID:6972
- C:\Windows\System\harqanp.exe
  C:\Windows\System\harqanp.exe
  2⤵
  PID:6988
- C:\Windows\System\tOZyOjT.exe
  C:\Windows\System\tOZyOjT.exe
  2⤵
  PID:7004
- C:\Windows\System\wXtMPTJ.exe
  C:\Windows\System\wXtMPTJ.exe
  2⤵
  PID:7020
- C:\Windows\System\HiLxFqI.exe
  C:\Windows\System\HiLxFqI.exe
  2⤵
  PID:7036
- C:\Windows\System\Ucnfmrw.exe
  C:\Windows\System\Ucnfmrw.exe
  2⤵
  PID:7052
- C:\Windows\System\UWQdhRF.exe
  C:\Windows\System\UWQdhRF.exe
  2⤵
  PID:7068
- C:\Windows\System\ydQIdlZ.exe
  C:\Windows\System\ydQIdlZ.exe
  2⤵
  PID:7084
- C:\Windows\System\ORHwJKM.exe
  C:\Windows\System\ORHwJKM.exe
  2⤵
  PID:7100
- C:\Windows\System\cEZBjZL.exe
  C:\Windows\System\cEZBjZL.exe
  2⤵
  PID:7116
- C:\Windows\System\oMHFVMt.exe
  C:\Windows\System\oMHFVMt.exe
  2⤵
  PID:7132
- C:\Windows\System\OvByYUp.exe
  C:\Windows\System\OvByYUp.exe
  2⤵
  PID:7148
- C:\Windows\System\IIlnqJt.exe
  C:\Windows\System\IIlnqJt.exe
  2⤵
  PID:7164
- C:\Windows\System\CsSTZYH.exe
  C:\Windows\System\CsSTZYH.exe
  2⤵
  PID:2340
- C:\Windows\System\xNlOqXZ.exe
  C:\Windows\System\xNlOqXZ.exe
  2⤵
  PID:6204
- C:\Windows\System\zfPchHJ.exe
  C:\Windows\System\zfPchHJ.exe
  2⤵
  PID:3048
- C:\Windows\System\KnrwioG.exe
  C:\Windows\System\KnrwioG.exe
  2⤵
  PID:6168
- C:\Windows\System\lIcwfjw.exe
  C:\Windows\System\lIcwfjw.exe
  2⤵
  PID:6304
- C:\Windows\System\LELnjyw.exe
  C:\Windows\System\LELnjyw.exe
  2⤵
  PID:6236
- C:\Windows\System\KxJXhRu.exe
  C:\Windows\System\KxJXhRu.exe
  2⤵
  PID:6336
- C:\Windows\System\mQSZXST.exe
  C:\Windows\System\mQSZXST.exe
  2⤵
  PID:6156
- C:\Windows\System\tWEcgHc.exe
  C:\Windows\System\tWEcgHc.exe
  2⤵
  PID:6220
- C:\Windows\System\osHWjeY.exe
  C:\Windows\System\osHWjeY.exe
  2⤵
  PID:6256
- C:\Windows\System\PJiUtZG.exe
  C:\Windows\System\PJiUtZG.exe
  2⤵
  PID:6352
- C:\Windows\System\oHQRvWP.exe
  C:\Windows\System\oHQRvWP.exe
  2⤵
  PID:6464
- C:\Windows\System\KiNqEJx.exe
  C:\Windows\System\KiNqEJx.exe
  2⤵
  PID:6500
- C:\Windows\System\FbKZFbY.exe
  C:\Windows\System\FbKZFbY.exe
  2⤵
  PID:6560
- C:\Windows\System\ZeOEgnD.exe
  C:\Windows\System\ZeOEgnD.exe
  2⤵
  PID:6596
- C:\Windows\System\PPTbnKz.exe
  C:\Windows\System\PPTbnKz.exe
  2⤵
  PID:6480
- C:\Windows\System\AWbXWil.exe
  C:\Windows\System\AWbXWil.exe
  2⤵
  PID:6544
- C:\Windows\System\vjTpHke.exe
  C:\Windows\System\vjTpHke.exe
  2⤵
  PID:6688
- C:\Windows\System\jWZBkji.exe
  C:\Windows\System\jWZBkji.exe
  2⤵
  PID:6752
- C:\Windows\System\oYMeAEo.exe
  C:\Windows\System\oYMeAEo.exe
  2⤵
  PID:6548
- C:\Windows\System\ZaantzG.exe
  C:\Windows\System\ZaantzG.exe
  2⤵
  PID:6612
- C:\Windows\System\wqDjBmS.exe
  C:\Windows\System\wqDjBmS.exe
  2⤵
  PID:6676
- C:\Windows\System\thnqwqi.exe
  C:\Windows\System\thnqwqi.exe
  2⤵
  PID:6740
- C:\Windows\System\XXCdXPe.exe
  C:\Windows\System\XXCdXPe.exe
  2⤵
  PID:6804
- C:\Windows\System\DlSrkAL.exe
  C:\Windows\System\DlSrkAL.exe
  2⤵
  PID:1356
- C:\Windows\System\sIqdNmM.exe
  C:\Windows\System\sIqdNmM.exe
  2⤵
  PID:6888
- C:\Windows\System\tjlJAMY.exe
  C:\Windows\System\tjlJAMY.exe
  2⤵
  PID:6980
- C:\Windows\System\mTGmlHZ.exe
  C:\Windows\System\mTGmlHZ.exe
  2⤵
  PID:7012
- C:\Windows\System\WOUPHqI.exe
  C:\Windows\System\WOUPHqI.exe
  2⤵
  PID:6872
- C:\Windows\System\lNBUDBE.exe
  C:\Windows\System\lNBUDBE.exe
  2⤵
  PID:6936
- C:\Windows\System\bUORUux.exe
  C:\Windows\System\bUORUux.exe
  2⤵
  PID:6968
- C:\Windows\System\GHGJzKy.exe
  C:\Windows\System\GHGJzKy.exe
  2⤵
  PID:7032
- C:\Windows\System\aLOpRqB.exe
  C:\Windows\System\aLOpRqB.exe
  2⤵
  PID:7112
- C:\Windows\System\Qmhnnfp.exe
  C:\Windows\System\Qmhnnfp.exe
  2⤵
  PID:6008
- C:\Windows\System\WuupZOB.exe
  C:\Windows\System\WuupZOB.exe
  2⤵
  PID:7064
- C:\Windows\System\jZrJCqL.exe
  C:\Windows\System\jZrJCqL.exe
  2⤵
  PID:2492
- C:\Windows\System\ujFswaR.exe
  C:\Windows\System\ujFswaR.exe
  2⤵
  PID:7128
- C:\Windows\System\fncsQVA.exe
  C:\Windows\System\fncsQVA.exe
  2⤵
  PID:6172
- C:\Windows\System\fsvcLDK.exe
  C:\Windows\System\fsvcLDK.exe
  2⤵
  PID:6320
- C:\Windows\System\ZLnByyR.exe
  C:\Windows\System\ZLnByyR.exe
  2⤵
  PID:6496
- C:\Windows\System\kclirxR.exe
  C:\Windows\System\kclirxR.exe
  2⤵
  PID:6400
- C:\Windows\System\VFyYMZz.exe
  C:\Windows\System\VFyYMZz.exe
  2⤵
  PID:6284
- C:\Windows\System\odXdwzk.exe
  C:\Windows\System\odXdwzk.exe
  2⤵
  PID:6420
- C:\Windows\System\nUuWjDT.exe
  C:\Windows\System\nUuWjDT.exe
  2⤵
  PID:6516
- C:\Windows\System\vzEejyZ.exe
  C:\Windows\System\vzEejyZ.exe
  2⤵
  PID:6608
- C:\Windows\System\jPrYOgf.exe
  C:\Windows\System\jPrYOgf.exe
  2⤵
  PID:6656
- C:\Windows\System\blMyyPn.exe
  C:\Windows\System\blMyyPn.exe
  2⤵
  PID:6644
- C:\Windows\System\QqeDxZV.exe
  C:\Windows\System\QqeDxZV.exe
  2⤵
  PID:6856
- C:\Windows\System\TXkpqlf.exe
  C:\Windows\System\TXkpqlf.exe
  2⤵
  PID:6920
- C:\Windows\System\jVDyeIy.exe
  C:\Windows\System\jVDyeIy.exe
  2⤵
  PID:6868
- C:\Windows\System\CIXWyRX.exe
  C:\Windows\System\CIXWyRX.exe
  2⤵
  PID:7108
- C:\Windows\System\SKYbndq.exe
  C:\Windows\System\SKYbndq.exe
  2⤵
  PID:7060
- C:\Windows\System\novkMIf.exe
  C:\Windows\System\novkMIf.exe
  2⤵
  PID:6904
- C:\Windows\System\XEyIbfa.exe
  C:\Windows\System\XEyIbfa.exe
  2⤵
  PID:7144
- C:\Windows\System\LASQwyb.exe
  C:\Windows\System\LASQwyb.exe
  2⤵
  PID:6300
- C:\Windows\System\ytimgDN.exe
  C:\Windows\System\ytimgDN.exe
  2⤵
  PID:6396
- C:\Windows\System\NGNuEiQ.exe
  C:\Windows\System\NGNuEiQ.exe
  2⤵
  PID:6200
- C:\Windows\System\ZKoPvym.exe
  C:\Windows\System\ZKoPvym.exe
  2⤵
  PID:6448
- C:\Windows\System\oKbkneH.exe
  C:\Windows\System\oKbkneH.exe
  2⤵
  PID:6784
- C:\Windows\System\AlAvmEI.exe
  C:\Windows\System\AlAvmEI.exe
  2⤵
  PID:6772
- C:\Windows\System\YliZhxq.exe
  C:\Windows\System\YliZhxq.exe
  2⤵
  PID:6964
- C:\Windows\System\YGtSpgU.exe
  C:\Windows\System\YGtSpgU.exe
  2⤵
  PID:7096
- C:\Windows\System\GyOSIuy.exe
  C:\Windows\System\GyOSIuy.exe
  2⤵
  PID:6348
- C:\Windows\System\BEFxjHi.exe
  C:\Windows\System\BEFxjHi.exe
  2⤵
  PID:5768
- C:\Windows\System\XarRMHT.exe
  C:\Windows\System\XarRMHT.exe
  2⤵
  PID:6580
- C:\Windows\System\aTIXtSv.exe
  C:\Windows\System\aTIXtSv.exe
  2⤵
  PID:6840
- C:\Windows\System\fIMMOJx.exe
  C:\Windows\System\fIMMOJx.exe
  2⤵
  PID:6820
- C:\Windows\System\kTyeQgf.exe
  C:\Windows\System\kTyeQgf.exe
  2⤵
  PID:6824
- C:\Windows\System\QexCcmm.exe
  C:\Windows\System\QexCcmm.exe
  2⤵
  PID:7172
- C:\Windows\System\EuTwOLQ.exe
  C:\Windows\System\EuTwOLQ.exe
  2⤵
  PID:7188
- C:\Windows\System\cNYAnFg.exe
  C:\Windows\System\cNYAnFg.exe
  2⤵
  PID:7204
- C:\Windows\System\qlVsRez.exe
  C:\Windows\System\qlVsRez.exe
  2⤵
  PID:7220
- C:\Windows\System\sATZFal.exe
  C:\Windows\System\sATZFal.exe
  2⤵
  PID:7236
- C:\Windows\System\svLWCWi.exe
  C:\Windows\System\svLWCWi.exe
  2⤵
  PID:7252
- C:\Windows\System\rlOyPyo.exe
  C:\Windows\System\rlOyPyo.exe
  2⤵
  PID:7268
- C:\Windows\System\ibJUOdG.exe
  C:\Windows\System\ibJUOdG.exe
  2⤵
  PID:7284
- C:\Windows\System\yXGkkyO.exe
  C:\Windows\System\yXGkkyO.exe
  2⤵
  PID:7300
- C:\Windows\System\aMaEpLw.exe
  C:\Windows\System\aMaEpLw.exe
  2⤵
  PID:7316
- C:\Windows\System\NcSqmTW.exe
  C:\Windows\System\NcSqmTW.exe
  2⤵
  PID:7332
- C:\Windows\System\lGsgIUc.exe
  C:\Windows\System\lGsgIUc.exe
  2⤵
  PID:7348
- C:\Windows\System\GulXgvs.exe
  C:\Windows\System\GulXgvs.exe
  2⤵
  PID:7364
- C:\Windows\System\bnMgzNl.exe
  C:\Windows\System\bnMgzNl.exe
  2⤵
  PID:7380
- C:\Windows\System\SgNYixf.exe
  C:\Windows\System\SgNYixf.exe
  2⤵
  PID:7396
- C:\Windows\System\WtAwqRF.exe
  C:\Windows\System\WtAwqRF.exe
  2⤵
  PID:7412
- C:\Windows\System\bAXDAAd.exe
  C:\Windows\System\bAXDAAd.exe
  2⤵
  PID:7428
- C:\Windows\System\yrkybWt.exe
  C:\Windows\System\yrkybWt.exe
  2⤵
  PID:7444
- C:\Windows\System\XAuuEnM.exe
  C:\Windows\System\XAuuEnM.exe
  2⤵
  PID:7460
- C:\Windows\System\lwRgCwH.exe
  C:\Windows\System\lwRgCwH.exe
  2⤵
  PID:7476
- C:\Windows\System\KYdgMFO.exe
  C:\Windows\System\KYdgMFO.exe
  2⤵
  PID:7492
- C:\Windows\System\hkeBDUq.exe
  C:\Windows\System\hkeBDUq.exe
  2⤵
  PID:7508
- C:\Windows\System\cwFIAXB.exe
  C:\Windows\System\cwFIAXB.exe
  2⤵
  PID:7524
- C:\Windows\System\GRhmddF.exe
  C:\Windows\System\GRhmddF.exe
  2⤵
  PID:7540
- C:\Windows\System\kRsjIaP.exe
  C:\Windows\System\kRsjIaP.exe
  2⤵
  PID:7556
- C:\Windows\System\GrxcBzG.exe
  C:\Windows\System\GrxcBzG.exe
  2⤵
  PID:7572
- C:\Windows\System\cPUjBoY.exe
  C:\Windows\System\cPUjBoY.exe
  2⤵
  PID:7588
- C:\Windows\System\EsMnOOS.exe
  C:\Windows\System\EsMnOOS.exe
  2⤵
  PID:7604
- C:\Windows\System\CgPEPBR.exe
  C:\Windows\System\CgPEPBR.exe
  2⤵
  PID:7620
- C:\Windows\System\nuKtxRD.exe
  C:\Windows\System\nuKtxRD.exe
  2⤵
  PID:7636
- C:\Windows\System\OmDCfox.exe
  C:\Windows\System\OmDCfox.exe
  2⤵
  PID:7652
- C:\Windows\System\NdGNFah.exe
  C:\Windows\System\NdGNFah.exe
  2⤵
  PID:7668
- C:\Windows\System\RprYLRB.exe
  C:\Windows\System\RprYLRB.exe
  2⤵
  PID:7684
- C:\Windows\System\nBADbCJ.exe
  C:\Windows\System\nBADbCJ.exe
  2⤵
  PID:7700
- C:\Windows\System\HwIJMXw.exe
  C:\Windows\System\HwIJMXw.exe
  2⤵
  PID:7716
- C:\Windows\System\AXyOsix.exe
  C:\Windows\System\AXyOsix.exe
  2⤵
  PID:7732
- C:\Windows\System\QGmmCaQ.exe
  C:\Windows\System\QGmmCaQ.exe
  2⤵
  PID:7748
- C:\Windows\System\NPpiEma.exe
  C:\Windows\System\NPpiEma.exe
  2⤵
  PID:7764
- C:\Windows\System\gWkyrWJ.exe
  C:\Windows\System\gWkyrWJ.exe
  2⤵
  PID:7780
- C:\Windows\System\HedxppZ.exe
  C:\Windows\System\HedxppZ.exe
  2⤵
  PID:7796
- C:\Windows\System\lmPVTuK.exe
  C:\Windows\System\lmPVTuK.exe
  2⤵
  PID:7812
- C:\Windows\System\aIWzwpF.exe
  C:\Windows\System\aIWzwpF.exe
  2⤵
  PID:7828
- C:\Windows\System\nkhylcv.exe
  C:\Windows\System\nkhylcv.exe
  2⤵
  PID:7844
- C:\Windows\System\gyhAIJR.exe
  C:\Windows\System\gyhAIJR.exe
  2⤵
  PID:7860
- C:\Windows\System\kfeSYrz.exe
  C:\Windows\System\kfeSYrz.exe
  2⤵
  PID:7876
- C:\Windows\System\UynhVIx.exe
  C:\Windows\System\UynhVIx.exe
  2⤵
  PID:7892
- C:\Windows\System\BRmzlXV.exe
  C:\Windows\System\BRmzlXV.exe
  2⤵
  PID:7908
- C:\Windows\System\hfhnmPw.exe
  C:\Windows\System\hfhnmPw.exe
  2⤵
  PID:7924
- C:\Windows\System\xNATAOh.exe
  C:\Windows\System\xNATAOh.exe
  2⤵
  PID:7940
- C:\Windows\System\sIiFRPC.exe
  C:\Windows\System\sIiFRPC.exe
  2⤵
  PID:7956
- C:\Windows\System\nlocINI.exe
  C:\Windows\System\nlocINI.exe
  2⤵
  PID:7972
- C:\Windows\System\AdXanbH.exe
  C:\Windows\System\AdXanbH.exe
  2⤵
  PID:7988
- C:\Windows\System\xmdTpsp.exe
  C:\Windows\System\xmdTpsp.exe
  2⤵
  PID:8004
- C:\Windows\System\dxhKmdN.exe
  C:\Windows\System\dxhKmdN.exe
  2⤵
  PID:8024
- C:\Windows\System\cYsSlWy.exe
  C:\Windows\System\cYsSlWy.exe
  2⤵
  PID:8040
- C:\Windows\System\ykmjxlT.exe
  C:\Windows\System\ykmjxlT.exe
  2⤵
  PID:8056
- C:\Windows\System\RaIpiAD.exe
  C:\Windows\System\RaIpiAD.exe
  2⤵
  PID:8072
- C:\Windows\System\CJjOiTV.exe
  C:\Windows\System\CJjOiTV.exe
  2⤵
  PID:8088
- C:\Windows\System\jOYijEy.exe
  C:\Windows\System\jOYijEy.exe
  2⤵
  PID:8104
- C:\Windows\System\TunKgQN.exe
  C:\Windows\System\TunKgQN.exe
  2⤵
  PID:8120
- C:\Windows\System\DOIizmM.exe
  C:\Windows\System\DOIizmM.exe
  2⤵
  PID:8136
- C:\Windows\System\XIvdrTI.exe
  C:\Windows\System\XIvdrTI.exe
  2⤵
  PID:8152
- C:\Windows\System\yvQCIOW.exe
  C:\Windows\System\yvQCIOW.exe
  2⤵
  PID:8168
- C:\Windows\System\inCwMZn.exe
  C:\Windows\System\inCwMZn.exe
  2⤵
  PID:8184
- C:\Windows\System\CQIpodj.exe
  C:\Windows\System\CQIpodj.exe
  2⤵
  PID:6412
- C:\Windows\System\DuqoFAa.exe
  C:\Windows\System\DuqoFAa.exe
  2⤵
  PID:7232
- C:\Windows\System\lPgZDTG.exe
  C:\Windows\System\lPgZDTG.exe
  2⤵
  PID:3488
- C:\Windows\System\EsEuXBw.exe
  C:\Windows\System\EsEuXBw.exe
  2⤵
  PID:7292
- C:\Windows\System\ZTxlCkn.exe
  C:\Windows\System\ZTxlCkn.exe
  2⤵
  PID:7280
- C:\Windows\System\UpzHjYT.exe
  C:\Windows\System\UpzHjYT.exe
  2⤵
  PID:7244
- C:\Windows\System\sPFHZHr.exe
  C:\Windows\System\sPFHZHr.exe
  2⤵
  PID:7356
- C:\Windows\System\giXHUGP.exe
  C:\Windows\System\giXHUGP.exe
  2⤵
  PID:7420
- C:\Windows\System\vjUADdb.exe
  C:\Windows\System\vjUADdb.exe
  2⤵
  PID:7456
- C:\Windows\System\OrirebG.exe
  C:\Windows\System\OrirebG.exe
  2⤵
  PID:7404
- C:\Windows\System\RTvhGhf.exe
  C:\Windows\System\RTvhGhf.exe
  2⤵
  PID:7312
- C:\Windows\System\dvVHtST.exe
  C:\Windows\System\dvVHtST.exe
  2⤵
  PID:7468
- C:\Windows\System\yRTNeFo.exe
  C:\Windows\System\yRTNeFo.exe
  2⤵
  PID:7516
- C:\Windows\System\CamftoE.exe
  C:\Windows\System\CamftoE.exe
  2⤵
  PID:7584
- C:\Windows\System\nTUCNbp.exe
  C:\Windows\System\nTUCNbp.exe
  2⤵
  PID:7648
- C:\Windows\System\pWQnqnl.exe
  C:\Windows\System\pWQnqnl.exe
  2⤵
  PID:7708
- C:\Windows\System\hMsMtXh.exe
  C:\Windows\System\hMsMtXh.exe
  2⤵
  PID:7772
- C:\Windows\System\xugAhGC.exe
  C:\Windows\System\xugAhGC.exe
  2⤵
  PID:7804
- C:\Windows\System\YTfSnlU.exe
  C:\Windows\System\YTfSnlU.exe
  2⤵
  PID:7536
- C:\Windows\System\mUShxkS.exe
  C:\Windows\System\mUShxkS.exe
  2⤵
  PID:7600
- C:\Windows\System\Khbxfti.exe
  C:\Windows\System\Khbxfti.exe
  2⤵
  PID:7696
- C:\Windows\System\qHIqITv.exe
  C:\Windows\System\qHIqITv.exe
  2⤵
  PID:7728
- C:\Windows\System\xXMicZm.exe
  C:\Windows\System\xXMicZm.exe
  2⤵
  PID:7792
- C:\Windows\System\OiyKvoT.exe
  C:\Windows\System\OiyKvoT.exe
  2⤵
  PID:7872
- C:\Windows\System\bQhbnrY.exe
  C:\Windows\System\bQhbnrY.exe
  2⤵
  PID:7936
- C:\Windows\System\Brhrkti.exe
  C:\Windows\System\Brhrkti.exe
  2⤵
  PID:8000
- C:\Windows\System\RrCKdjR.exe
  C:\Windows\System\RrCKdjR.exe
  2⤵
  PID:8036
- C:\Windows\System\XusLFOr.exe
  C:\Windows\System\XusLFOr.exe
  2⤵
  PID:8064
- C:\Windows\System\lnfaOXy.exe
  C:\Windows\System\lnfaOXy.exe
  2⤵
  PID:8012
- C:\Windows\System\DFIrOwI.exe
  C:\Windows\System\DFIrOwI.exe
  2⤵
  PID:8068
- C:\Windows\System\MTWpVlr.exe
  C:\Windows\System\MTWpVlr.exe
  2⤵
  PID:8096
- C:\Windows\System\HRauiAT.exe
  C:\Windows\System\HRauiAT.exe
  2⤵
  PID:8128
- C:\Windows\System\wfeWPWk.exe
  C:\Windows\System\wfeWPWk.exe
  2⤵
  PID:6152
- C:\Windows\System\BgOUaiv.exe
  C:\Windows\System\BgOUaiv.exe
  2⤵
  PID:7276
- C:\Windows\System\idDDvwy.exe
  C:\Windows\System\idDDvwy.exe
  2⤵
  PID:7324
- C:\Windows\System\dVAdTxz.exe
  C:\Windows\System\dVAdTxz.exe
  2⤵
  PID:7484
- C:\Windows\System\Selxlys.exe
  C:\Windows\System\Selxlys.exe
  2⤵
  PID:8180
- C:\Windows\System\tBqpCVR.exe
  C:\Windows\System\tBqpCVR.exe
  2⤵
  PID:7388
- C:\Windows\System\TYRGkAT.exe
  C:\Windows\System\TYRGkAT.exe
  2⤵
  PID:7504
- C:\Windows\System\vjyRGYO.exe
  C:\Windows\System\vjyRGYO.exe
  2⤵
  PID:7228
- C:\Windows\System\UkIsxrq.exe
  C:\Windows\System\UkIsxrq.exe
  2⤵
  PID:6724
- C:\Windows\System\CUDQXTx.exe
  C:\Windows\System\CUDQXTx.exe
  2⤵
  PID:8148
- C:\Windows\System\vSLDSLO.exe
  C:\Windows\System\vSLDSLO.exe
  2⤵
  PID:7776
- C:\Windows\System\ZUnubwO.exe
  C:\Windows\System\ZUnubwO.exe
  2⤵
  PID:7664
- C:\Windows\System\kADJBQE.exe
  C:\Windows\System\kADJBQE.exe
  2⤵
  PID:7820
- C:\Windows\System\yLfpuua.exe
  C:\Windows\System\yLfpuua.exe
  2⤵
  PID:7904
- C:\Windows\System\hvxqsJE.exe
  C:\Windows\System\hvxqsJE.exe
  2⤵
  PID:7868
- C:\Windows\System\ovWwyeG.exe
  C:\Windows\System\ovWwyeG.exe
  2⤵
  PID:7948
- C:\Windows\System\nyjDWOp.exe
  C:\Windows\System\nyjDWOp.exe
  2⤵
  PID:8048
- C:\Windows\System\DhygLaU.exe
  C:\Windows\System\DhygLaU.exe
  2⤵
  PID:8084
- C:\Windows\System\uKLpanU.exe
  C:\Windows\System\uKLpanU.exe
  2⤵
  PID:8116
- C:\Windows\System\EoUZuPn.exe
  C:\Windows\System\EoUZuPn.exe
  2⤵
  PID:7452
- C:\Windows\System\uMxGGqY.exe
  C:\Windows\System\uMxGGqY.exe
  2⤵
  PID:7180
- C:\Windows\System\SwXtIRT.exe
  C:\Windows\System\SwXtIRT.exe
  2⤵
  PID:7632
- C:\Windows\System\CURHHaW.exe
  C:\Windows\System\CURHHaW.exe
  2⤵
  PID:7788
- C:\Windows\System\MjNISOx.exe
  C:\Windows\System\MjNISOx.exe
  2⤵
  PID:7996
- C:\Windows\System\eCzRMYs.exe
  C:\Windows\System\eCzRMYs.exe
  2⤵
  PID:7884
- C:\Windows\System\CeYMHrf.exe
  C:\Windows\System\CeYMHrf.exe
  2⤵
  PID:7392
- C:\Windows\System\xlTYUZN.exe
  C:\Windows\System\xlTYUZN.exe
  2⤵
  PID:6816
- C:\Windows\System\YhJVhKg.exe
  C:\Windows\System\YhJVhKg.exe
  2⤵
  PID:7724
- C:\Windows\System\ErAJFsN.exe
  C:\Windows\System\ErAJFsN.exe
  2⤵
  PID:8100
- C:\Windows\System\NpUDbZl.exe
  C:\Windows\System\NpUDbZl.exe
  2⤵
  PID:7260
- C:\Windows\System\fvHjaXw.exe
  C:\Windows\System\fvHjaXw.exe
  2⤵
  PID:7952
- C:\Windows\System\snuTCgm.exe
  C:\Windows\System\snuTCgm.exe
  2⤵
  PID:8200
- C:\Windows\System\lOktRbM.exe
  C:\Windows\System\lOktRbM.exe
  2⤵
  PID:8216
- C:\Windows\System\poMzcIk.exe
  C:\Windows\System\poMzcIk.exe
  2⤵
  PID:8232
- C:\Windows\System\eKerxXD.exe
  C:\Windows\System\eKerxXD.exe
  2⤵
  PID:8248
- C:\Windows\System\oJOSiQT.exe
  C:\Windows\System\oJOSiQT.exe
  2⤵
  PID:8264
- C:\Windows\System\UcjfUOe.exe
  C:\Windows\System\UcjfUOe.exe
  2⤵
  PID:8280
- C:\Windows\System\HnUZqID.exe
  C:\Windows\System\HnUZqID.exe
  2⤵
  PID:8296
- C:\Windows\System\guYSXHY.exe
  C:\Windows\System\guYSXHY.exe
  2⤵
  PID:8312
- C:\Windows\System\ToeTwgI.exe
  C:\Windows\System\ToeTwgI.exe
  2⤵
  PID:8328
- C:\Windows\System\MgYUsZy.exe
  C:\Windows\System\MgYUsZy.exe
  2⤵
  PID:8344
- C:\Windows\System\cblsXqc.exe
  C:\Windows\System\cblsXqc.exe
  2⤵
  PID:8360
- C:\Windows\System\lhGsgds.exe
  C:\Windows\System\lhGsgds.exe
  2⤵
  PID:8376
- C:\Windows\System\nCFZOzP.exe
  C:\Windows\System\nCFZOzP.exe
  2⤵
  PID:8392
- C:\Windows\System\AdPmnSt.exe
  C:\Windows\System\AdPmnSt.exe
  2⤵
  PID:8408
- C:\Windows\System\qNOXKph.exe
  C:\Windows\System\qNOXKph.exe
  2⤵
  PID:8424
- C:\Windows\System\uIKXMZw.exe
  C:\Windows\System\uIKXMZw.exe
  2⤵
  PID:8440
- C:\Windows\System\sCTKbEz.exe
  C:\Windows\System\sCTKbEz.exe
  2⤵
  PID:8456
- C:\Windows\System\PdDSMAT.exe
  C:\Windows\System\PdDSMAT.exe
  2⤵
  PID:8472
- C:\Windows\System\PaHUbJM.exe
  C:\Windows\System\PaHUbJM.exe
  2⤵
  PID:8488
- C:\Windows\System\tBVIYKc.exe
  C:\Windows\System\tBVIYKc.exe
  2⤵
  PID:8504
- C:\Windows\System\BlnJksO.exe
  C:\Windows\System\BlnJksO.exe
  2⤵
  PID:8520
- C:\Windows\System\ZDhwTFj.exe
  C:\Windows\System\ZDhwTFj.exe
  2⤵
  PID:8536
- C:\Windows\System\mSvcnQz.exe
  C:\Windows\System\mSvcnQz.exe
  2⤵
  PID:8552
- C:\Windows\System\IIqyVzR.exe
  C:\Windows\System\IIqyVzR.exe
  2⤵
  PID:8568
- C:\Windows\System\OqzIbgA.exe
  C:\Windows\System\OqzIbgA.exe
  2⤵
  PID:8588
- C:\Windows\System\qanIcSk.exe
  C:\Windows\System\qanIcSk.exe
  2⤵
  PID:8604
- C:\Windows\System\WBbxXpW.exe
  C:\Windows\System\WBbxXpW.exe
  2⤵
  PID:8620
- C:\Windows\System\CaWGHRa.exe
  C:\Windows\System\CaWGHRa.exe
  2⤵
  PID:8636
- C:\Windows\System\xSgWJVZ.exe
  C:\Windows\System\xSgWJVZ.exe
  2⤵
  PID:8652
- C:\Windows\System\FjOjlth.exe
  C:\Windows\System\FjOjlth.exe
  2⤵
  PID:8668
- C:\Windows\System\mXsKByw.exe
  C:\Windows\System\mXsKByw.exe
  2⤵
  PID:8684
- C:\Windows\System\bfdsfVp.exe
  C:\Windows\System\bfdsfVp.exe
  2⤵
  PID:8700
- C:\Windows\System\hEvfpwD.exe
  C:\Windows\System\hEvfpwD.exe
  2⤵
  PID:8716
- C:\Windows\System\TZSbWgS.exe
  C:\Windows\System\TZSbWgS.exe
  2⤵
  PID:8732
- C:\Windows\System\yYAhNWG.exe
  C:\Windows\System\yYAhNWG.exe
  2⤵
  PID:8748
- C:\Windows\System\xlPmAyu.exe
  C:\Windows\System\xlPmAyu.exe
  2⤵
  PID:8764
- C:\Windows\System\xItzFIu.exe
  C:\Windows\System\xItzFIu.exe
  2⤵
  PID:8780
- C:\Windows\System\uwsnhpO.exe
  C:\Windows\System\uwsnhpO.exe
  2⤵
  PID:8796
- C:\Windows\System\QTgRHaL.exe
  C:\Windows\System\QTgRHaL.exe
  2⤵
  PID:8812
- C:\Windows\System\rZpxkKG.exe
  C:\Windows\System\rZpxkKG.exe
  2⤵
  PID:8828
- C:\Windows\System\nfwFdyq.exe
  C:\Windows\System\nfwFdyq.exe
  2⤵
  PID:8844
- C:\Windows\System\zCvFISN.exe
  C:\Windows\System\zCvFISN.exe
  2⤵
  PID:8860
- C:\Windows\System\xNjRSMm.exe
  C:\Windows\System\xNjRSMm.exe
  2⤵
  PID:8876
- C:\Windows\System\rQZNFwd.exe
  C:\Windows\System\rQZNFwd.exe
  2⤵
  PID:8892
- C:\Windows\System\gXJojHJ.exe
  C:\Windows\System\gXJojHJ.exe
  2⤵
  PID:8908
- C:\Windows\System\hXTPfhd.exe
  C:\Windows\System\hXTPfhd.exe
  2⤵
  PID:8924
- C:\Windows\System\vUhNlmP.exe
  C:\Windows\System\vUhNlmP.exe
  2⤵
  PID:8940
- C:\Windows\System\XKecDvz.exe
  C:\Windows\System\XKecDvz.exe
  2⤵
  PID:8956
- C:\Windows\System\zURSJbO.exe
  C:\Windows\System\zURSJbO.exe
  2⤵
  PID:8972
- C:\Windows\System\lGqbPUt.exe
  C:\Windows\System\lGqbPUt.exe
  2⤵
  PID:8988
- C:\Windows\System\zMcGpWC.exe
  C:\Windows\System\zMcGpWC.exe
  2⤵
  PID:9004
- C:\Windows\System\RiQmpaz.exe
  C:\Windows\System\RiQmpaz.exe
  2⤵
  PID:9020
- C:\Windows\System\ensSJPz.exe
  C:\Windows\System\ensSJPz.exe
  2⤵
  PID:9036
- C:\Windows\System\eHXtIEc.exe
  C:\Windows\System\eHXtIEc.exe
  2⤵
  PID:9052
- C:\Windows\System\LHGRIPl.exe
  C:\Windows\System\LHGRIPl.exe
  2⤵
  PID:9068
- C:\Windows\System\rKoSZGP.exe
  C:\Windows\System\rKoSZGP.exe
  2⤵
  PID:9084
- C:\Windows\System\DJJxqOa.exe
  C:\Windows\System\DJJxqOa.exe
  2⤵
  PID:9100
- C:\Windows\System\OurrMho.exe
  C:\Windows\System\OurrMho.exe
  2⤵
  PID:9120
- C:\Windows\System\pEBpsJT.exe
  C:\Windows\System\pEBpsJT.exe
  2⤵
  PID:9136
- C:\Windows\System\SAjiSrw.exe
  C:\Windows\System\SAjiSrw.exe
  2⤵
  PID:9152
- C:\Windows\System\PePPbTN.exe
  C:\Windows\System\PePPbTN.exe
  2⤵
  PID:9168
- C:\Windows\System\YTrzAWh.exe
  C:\Windows\System\YTrzAWh.exe
  2⤵
  PID:9184
- C:\Windows\System\bVjHwBF.exe
  C:\Windows\System\bVjHwBF.exe
  2⤵
  PID:9200
- C:\Windows\System\NZRrYov.exe
  C:\Windows\System\NZRrYov.exe
  2⤵
  PID:7568
- C:\Windows\System\aOEvHAo.exe
  C:\Windows\System\aOEvHAo.exe
  2⤵
  PID:8208
- C:\Windows\System\oPQZhOL.exe
  C:\Windows\System\oPQZhOL.exe
  2⤵
  PID:8240
- C:\Windows\System\AgCVvgk.exe
  C:\Windows\System\AgCVvgk.exe
  2⤵
  PID:8272
- C:\Windows\System\cIISZxP.exe
  C:\Windows\System\cIISZxP.exe
  2⤵
  PID:8276
- C:\Windows\System\jbTxYvS.exe
  C:\Windows\System\jbTxYvS.exe
  2⤵
  PID:8372
- C:\Windows\System\drTsNwt.exe
  C:\Windows\System\drTsNwt.exe
  2⤵
  PID:8352
- C:\Windows\System\LJHvMNP.exe
  C:\Windows\System\LJHvMNP.exe
  2⤵
  PID:8356
- C:\Windows\System\Wfpspyl.exe
  C:\Windows\System\Wfpspyl.exe
  2⤵
  PID:8432
- C:\Windows\System\lDOjuEM.exe
  C:\Windows\System\lDOjuEM.exe
  2⤵
  PID:8500
- C:\Windows\System\RgMovXR.exe
  C:\Windows\System\RgMovXR.exe
  2⤵
  PID:8564
- C:\Windows\System\LdLXokv.exe
  C:\Windows\System\LdLXokv.exe
  2⤵
  PID:8452
- C:\Windows\System\FXtcVrA.exe
  C:\Windows\System\FXtcVrA.exe
  2⤵
  PID:8484
- C:\Windows\System\ICQKcYw.exe
  C:\Windows\System\ICQKcYw.exe
  2⤵
  PID:8548
- C:\Windows\System\VezZBzc.exe
  C:\Windows\System\VezZBzc.exe
  2⤵
  PID:8660
- C:\Windows\System\eXGngse.exe
  C:\Windows\System\eXGngse.exe
  2⤵
  PID:8692
- C:\Windows\System\Lqnqvat.exe
  C:\Windows\System\Lqnqvat.exe
  2⤵
  PID:1920
- C:\Windows\System\fPKOjVd.exe
  C:\Windows\System\fPKOjVd.exe
  2⤵
  PID:8760
- C:\Windows\System\NZvQROo.exe
  C:\Windows\System\NZvQROo.exe
  2⤵
  PID:8708
- C:\Windows\System\XMtTVcr.exe
  C:\Windows\System\XMtTVcr.exe
  2⤵
  PID:8824
- C:\Windows\System\zHwNvkX.exe
  C:\Windows\System\zHwNvkX.exe
  2⤵
  PID:8852
- C:\Windows\System\iPaUMIP.exe
  C:\Windows\System\iPaUMIP.exe
  2⤵
  PID:8740
- C:\Windows\System\GzVhqMh.exe
  C:\Windows\System\GzVhqMh.exe
  2⤵
  PID:8840
- C:\Windows\System\HIimfzi.exe
  C:\Windows\System\HIimfzi.exe
  2⤵
  PID:8888
- C:\Windows\System\RCjlVEQ.exe
  C:\Windows\System\RCjlVEQ.exe
  2⤵
  PID:8952
- C:\Windows\System\iDupaDl.exe
  C:\Windows\System\iDupaDl.exe
  2⤵
  PID:9016
- C:\Windows\System\QsVugyc.exe
  C:\Windows\System\QsVugyc.exe
  2⤵
  PID:8936
- C:\Windows\System\yollWmw.exe
  C:\Windows\System\yollWmw.exe
  2⤵
  PID:8968
- C:\Windows\System\kcfSfIi.exe
  C:\Windows\System\kcfSfIi.exe
  2⤵
  PID:9060
- C:\Windows\System\ZgenEbs.exe
  C:\Windows\System\ZgenEbs.exe
  2⤵
  PID:9128
- C:\Windows\System\ABBqYno.exe
  C:\Windows\System\ABBqYno.exe
  2⤵
  PID:9092
- C:\Windows\System\SiJduIz.exe
  C:\Windows\System\SiJduIz.exe
  2⤵
  PID:8996
- C:\Windows\System\JUXUxKR.exe
  C:\Windows\System\JUXUxKR.exe
  2⤵
  PID:9196
- C:\Windows\System\nDapvxr.exe
  C:\Windows\System\nDapvxr.exe
  2⤵
  PID:8224
- C:\Windows\System\iWbuPkb.exe
  C:\Windows\System\iWbuPkb.exe
  2⤵
  PID:7692
- C:\Windows\System\ISZzdCW.exe
  C:\Windows\System\ISZzdCW.exe
  2⤵
  PID:8292
- C:\Windows\System\RRsNETV.exe
  C:\Windows\System\RRsNETV.exe
  2⤵
  PID:8496
- C:\Windows\System\exabnmv.exe
  C:\Windows\System\exabnmv.exe
  2⤵
  PID:8600
- C:\Windows\System\lQzTJpA.exe
  C:\Windows\System\lQzTJpA.exe
  2⤵
  PID:8792
- C:\Windows\System\MtXVRss.exe
  C:\Windows\System\MtXVRss.exe
  2⤵
  PID:8324
- C:\Windows\System\qOMrILa.exe
  C:\Windows\System\qOMrILa.exe
  2⤵
  PID:8288
- C:\Windows\System\AfHOCAF.exe
  C:\Windows\System\AfHOCAF.exe
  2⤵
  PID:8528
- C:\Windows\System\SIyWOvr.exe
  C:\Windows\System\SIyWOvr.exe
  2⤵
  PID:8584
- C:\Windows\System\mHrnFIg.exe
  C:\Windows\System\mHrnFIg.exe
  2⤵
  PID:8772
- C:\Windows\System\nxpXnKD.exe
  C:\Windows\System\nxpXnKD.exe
  2⤵
  PID:9076
- C:\Windows\System\qkNIuSA.exe
  C:\Windows\System\qkNIuSA.exe
  2⤵
  PID:9108
- C:\Windows\System\MjuopiI.exe
  C:\Windows\System\MjuopiI.exe
  2⤵
  PID:8256
- C:\Windows\System\pAYlHrf.exe
  C:\Windows\System\pAYlHrf.exe
  2⤵
  PID:8596
- C:\Windows\System\fQTlacs.exe
  C:\Windows\System\fQTlacs.exe
  2⤵
  PID:8680
- C:\Windows\System\SzRsiqJ.exe
  C:\Windows\System\SzRsiqJ.exe
  2⤵
  PID:8664
- C:\Windows\System\rOvzFXc.exe
  C:\Windows\System\rOvzFXc.exe
  2⤵
  PID:8808
- C:\Windows\System\KdiuYkF.exe
  C:\Windows\System\KdiuYkF.exe
  2⤵
  PID:9048
- C:\Windows\System\hxhBXny.exe
  C:\Windows\System\hxhBXny.exe
  2⤵
  PID:8872
- C:\Windows\System\GtcuYOs.exe
  C:\Windows\System\GtcuYOs.exe
  2⤵
  PID:9208
- C:\Windows\System\UkFCmRs.exe
  C:\Windows\System\UkFCmRs.exe
  2⤵
  PID:9180
- C:\Windows\System\cWDqCXi.exe
  C:\Windows\System\cWDqCXi.exe
  2⤵
  PID:9212
- C:\Windows\System\JpnMQWt.exe
  C:\Windows\System\JpnMQWt.exe
  2⤵
  PID:8632
- C:\Windows\System\VHKrPLK.exe
  C:\Windows\System\VHKrPLK.exe
  2⤵
  PID:8904
- C:\Windows\System\LKpJygz.exe
  C:\Windows\System\LKpJygz.exe
  2⤵
  PID:8932
- C:\Windows\System\RQEwpUL.exe
  C:\Windows\System\RQEwpUL.exe
  2⤵
  PID:8884
- C:\Windows\System\niscbrV.exe
  C:\Windows\System\niscbrV.exe
  2⤵
  PID:8228
- C:\Windows\System\sYHIJPn.exe
  C:\Windows\System\sYHIJPn.exe
  2⤵
  PID:8756
- C:\Windows\System\ubNwHfR.exe
  C:\Windows\System\ubNwHfR.exe
  2⤵
  PID:8464
- C:\Windows\System\cNyGwPQ.exe
  C:\Windows\System\cNyGwPQ.exe
  2⤵
  PID:9192
- C:\Windows\System\KprxOsD.exe
  C:\Windows\System\KprxOsD.exe
  2⤵
  PID:2196
- C:\Windows\System\kBjnBup.exe
  C:\Windows\System\kBjnBup.exe
  2⤵
  PID:9232
- C:\Windows\System\YsKKrqm.exe
  C:\Windows\System\YsKKrqm.exe
  2⤵
  PID:9248
- C:\Windows\System\eNWReAM.exe
  C:\Windows\System\eNWReAM.exe
  2⤵
  PID:9264
- C:\Windows\System\FJQlooC.exe
  C:\Windows\System\FJQlooC.exe
  2⤵
  PID:9284
- C:\Windows\System\fLazCpz.exe
  C:\Windows\System\fLazCpz.exe
  2⤵
  PID:9304
- C:\Windows\System\NDTULtD.exe
  C:\Windows\System\NDTULtD.exe
  2⤵
  PID:9320
- C:\Windows\System\DWOFrQt.exe
  C:\Windows\System\DWOFrQt.exe
  2⤵
  PID:9340
- C:\Windows\System\KCGJMmg.exe
  C:\Windows\System\KCGJMmg.exe
  2⤵
  PID:9360
- C:\Windows\System\HNgcOmH.exe
  C:\Windows\System\HNgcOmH.exe
  2⤵
  PID:9376
- C:\Windows\System\CXutsrT.exe
  C:\Windows\System\CXutsrT.exe
  2⤵
  PID:9392
- C:\Windows\System\SwwFFrQ.exe
  C:\Windows\System\SwwFFrQ.exe
  2⤵
  PID:9408
- C:\Windows\System\CImZPCA.exe
  C:\Windows\System\CImZPCA.exe
  2⤵
  PID:9424
- C:\Windows\System\mgmtqUK.exe
  C:\Windows\System\mgmtqUK.exe
  2⤵
  PID:9440
- C:\Windows\System\rOSEvrn.exe
  C:\Windows\System\rOSEvrn.exe
  2⤵
  PID:9456
- C:\Windows\System\ZtjAFTl.exe
  C:\Windows\System\ZtjAFTl.exe
  2⤵
  PID:9472
- C:\Windows\System\fWTQmXy.exe
  C:\Windows\System\fWTQmXy.exe
  2⤵
  PID:9488
- C:\Windows\System\rOuzlJu.exe
  C:\Windows\System\rOuzlJu.exe
  2⤵
  PID:9504
- C:\Windows\System\vZRDdil.exe
  C:\Windows\System\vZRDdil.exe
  2⤵
  PID:9520
- C:\Windows\System\RjqBsiD.exe
  C:\Windows\System\RjqBsiD.exe
  2⤵
  PID:9536
- C:\Windows\System\UxAEgXJ.exe
  C:\Windows\System\UxAEgXJ.exe
  2⤵
  PID:9552
- C:\Windows\System\pEBZHTF.exe
  C:\Windows\System\pEBZHTF.exe
  2⤵
  PID:9568
- C:\Windows\System\FpsWyfZ.exe
  C:\Windows\System\FpsWyfZ.exe
  2⤵
  PID:9584
- C:\Windows\System\xvjZyvE.exe
  C:\Windows\System\xvjZyvE.exe
  2⤵
  PID:9600
- C:\Windows\System\FjcGhSp.exe
  C:\Windows\System\FjcGhSp.exe
  2⤵
  PID:9616
- C:\Windows\System\frBICnE.exe
  C:\Windows\System\frBICnE.exe
  2⤵
  PID:9632
- C:\Windows\System\ftNARcu.exe
  C:\Windows\System\ftNARcu.exe
  2⤵
  PID:9648
- C:\Windows\System\PZSQBGH.exe
  C:\Windows\System\PZSQBGH.exe
  2⤵
  PID:9664
- C:\Windows\System\dOUnhQN.exe
  C:\Windows\System\dOUnhQN.exe
  2⤵
  PID:9680
- C:\Windows\System\TPAnAmF.exe
  C:\Windows\System\TPAnAmF.exe
  2⤵
  PID:9696
- C:\Windows\System\plqUfkl.exe
  C:\Windows\System\plqUfkl.exe
  2⤵
  PID:9712
- C:\Windows\System\OcOGdRK.exe
  C:\Windows\System\OcOGdRK.exe
  2⤵
  PID:9728
- C:\Windows\System\peQAzGy.exe
  C:\Windows\System\peQAzGy.exe
  2⤵
  PID:9744
- C:\Windows\System\NepIycW.exe
  C:\Windows\System\NepIycW.exe
  2⤵
  PID:9760
- C:\Windows\System\piStCRY.exe
  C:\Windows\System\piStCRY.exe
  2⤵
  PID:9776
- C:\Windows\System\tGltoln.exe
  C:\Windows\System\tGltoln.exe
  2⤵
  PID:9792
- C:\Windows\System\FAHwdJQ.exe
  C:\Windows\System\FAHwdJQ.exe
  2⤵
  PID:9808
- C:\Windows\System\CspGesM.exe
  C:\Windows\System\CspGesM.exe
  2⤵
  PID:9824
- C:\Windows\System\pVsWBwA.exe
  C:\Windows\System\pVsWBwA.exe
  2⤵
  PID:9840
- C:\Windows\System\dSfGiEs.exe
  C:\Windows\System\dSfGiEs.exe
  2⤵
  PID:9888
- C:\Windows\System\zOiPBJL.exe
  C:\Windows\System\zOiPBJL.exe
  2⤵
  PID:9908
- C:\Windows\System\wHbvVts.exe
  C:\Windows\System\wHbvVts.exe
  2⤵
  PID:9924
- C:\Windows\System\JlSzaKV.exe
  C:\Windows\System\JlSzaKV.exe
  2⤵
  PID:9940
- C:\Windows\System\lQWNEAL.exe
  C:\Windows\System\lQWNEAL.exe
  2⤵
  PID:9960
- C:\Windows\System\cqTGCOI.exe
  C:\Windows\System\cqTGCOI.exe
  2⤵
  PID:9980
- C:\Windows\System\BTJCmwh.exe
  C:\Windows\System\BTJCmwh.exe
  2⤵
  PID:9996
- C:\Windows\System\mhxofaA.exe
  C:\Windows\System\mhxofaA.exe
  2⤵
  PID:10016
- C:\Windows\System\jcwPSiL.exe
  C:\Windows\System\jcwPSiL.exe
  2⤵
  PID:10040
- C:\Windows\System\KPjcdFK.exe
  C:\Windows\System\KPjcdFK.exe
  2⤵
  PID:10056
- C:\Windows\System\ljqPdSU.exe
  C:\Windows\System\ljqPdSU.exe
  2⤵
  PID:10072
- C:\Windows\System\daZFecC.exe
  C:\Windows\System\daZFecC.exe
  2⤵
  PID:10088
- C:\Windows\System\XLTdiPG.exe
  C:\Windows\System\XLTdiPG.exe
  2⤵
  PID:10104
- C:\Windows\System\BFcDHRL.exe
  C:\Windows\System\BFcDHRL.exe
  2⤵
  PID:10120
- C:\Windows\System\koupkBv.exe
  C:\Windows\System\koupkBv.exe
  2⤵
  PID:10144
- C:\Windows\System\MOCRsqW.exe
  C:\Windows\System\MOCRsqW.exe
  2⤵
  PID:10224
- C:\Windows\System\NUsDSUh.exe
  C:\Windows\System\NUsDSUh.exe
  2⤵
  PID:9116
- C:\Windows\System\ZKFlmRR.exe
  C:\Windows\System\ZKFlmRR.exe
  2⤵
  PID:9312
- C:\Windows\System\IFUGnOV.exe
  C:\Windows\System\IFUGnOV.exe
  2⤵
  PID:8544
- C:\Windows\System\UZrovlJ.exe
  C:\Windows\System\UZrovlJ.exe
  2⤵
  PID:9260
- C:\Windows\System\kyqWOuM.exe
  C:\Windows\System\kyqWOuM.exe
  2⤵
  PID:9328
- C:\Windows\System\JIXzSkS.exe
  C:\Windows\System\JIXzSkS.exe
  2⤵
  PID:9372
- C:\Windows\System\vMOTOXa.exe
  C:\Windows\System\vMOTOXa.exe
  2⤵
  PID:9348
- C:\Windows\System\KCanKAe.exe
  C:\Windows\System\KCanKAe.exe
  2⤵
  PID:9496
- C:\Windows\System\qVujCiO.exe
  C:\Windows\System\qVujCiO.exe
  2⤵
  PID:9404
- C:\Windows\System\lmfiwzV.exe
  C:\Windows\System\lmfiwzV.exe
  2⤵
  PID:9720
- C:\Windows\System\PfcICOx.exe
  C:\Windows\System\PfcICOx.exe
  2⤵
  PID:9788
- C:\Windows\System\HYBLDck.exe
  C:\Windows\System\HYBLDck.exe
  2⤵
  PID:9736
- C:\Windows\System\djaLWzO.exe
  C:\Windows\System\djaLWzO.exe
  2⤵
  PID:9800
- C:\Windows\System\TGdtcRY.exe
  C:\Windows\System\TGdtcRY.exe
  2⤵
  PID:2460
- C:\Windows\System\GEezlPh.exe
  C:\Windows\System\GEezlPh.exe
  2⤵
  PID:9856
- C:\Windows\System\ShduJZd.exe
  C:\Windows\System\ShduJZd.exe
  2⤵
  PID:9880
- C:\Windows\System\YzTBllD.exe
  C:\Windows\System\YzTBllD.exe
  2⤵
  PID:9948
- C:\Windows\System\UKdAKIX.exe
  C:\Windows\System\UKdAKIX.exe
  2⤵
  PID:10024
- C:\Windows\System\OSCmINJ.exe
  C:\Windows\System\OSCmINJ.exe
  2⤵
  PID:10116
- C:\Windows\System\bSFXPQs.exe
  C:\Windows\System\bSFXPQs.exe
  2⤵
  PID:10052
- C:\Windows\System\ihEKadO.exe
  C:\Windows\System\ihEKadO.exe
  2⤵
  PID:10068
- C:\Windows\System\mZgqIqa.exe
  C:\Windows\System\mZgqIqa.exe
  2⤵
  PID:9228
- C:\Windows\System\zjbbPEB.exe
  C:\Windows\System\zjbbPEB.exe
  2⤵
  PID:10008
- C:\Windows\System\oqQEunA.exe
  C:\Windows\System\oqQEunA.exe
  2⤵
  PID:9256
- C:\Windows\System\tDyeztw.exe
  C:\Windows\System\tDyeztw.exe
  2⤵
  PID:9240
- C:\Windows\System\Ygismwh.exe
  C:\Windows\System\Ygismwh.exe
  2⤵
  PID:10160
- C:\Windows\System\GeIAFaK.exe
  C:\Windows\System\GeIAFaK.exe
  2⤵
  PID:9688
- C:\Windows\System\ignTngw.exe
  C:\Windows\System\ignTngw.exe
  2⤵
  PID:10100
- C:\Windows\System\xcHBuxI.exe
  C:\Windows\System\xcHBuxI.exe
  2⤵
  PID:9676
- C:\Windows\System\OShjrgC.exe
  C:\Windows\System\OShjrgC.exe
  2⤵
  PID:9484
- C:\Windows\System\OqThHys.exe
  C:\Windows\System\OqThHys.exe
  2⤵
  PID:9768
- C:\Windows\System\GkPAuid.exe
  C:\Windows\System\GkPAuid.exe
  2⤵
  PID:9816
- C:\Windows\System\KQhMQqB.exe
  C:\Windows\System\KQhMQqB.exe
  2⤵
  PID:2564
- C:\Windows\System\PgnWqqP.exe
  C:\Windows\System\PgnWqqP.exe
  2⤵
  PID:4272
- C:\Windows\System\MuKPJYH.exe
  C:\Windows\System\MuKPJYH.exe
  2⤵
  PID:9936
- C:\Windows\System\TaHTdkw.exe
  C:\Windows\System\TaHTdkw.exe
  2⤵
  PID:9976
- C:\Windows\System\nnKhEGj.exe
  C:\Windows\System\nnKhEGj.exe
  2⤵
  PID:9968
- C:\Windows\System\TswkNmr.exe
  C:\Windows\System\TswkNmr.exe
  2⤵
  PID:10080
- C:\Windows\System\XAlhwUS.exe
  C:\Windows\System\XAlhwUS.exe
  2⤵
  PID:10004
- C:\Windows\System\AKjgmBb.exe
  C:\Windows\System\AKjgmBb.exe
  2⤵
  PID:10236
- C:\Windows\System\mtxCmTz.exe
  C:\Windows\System\mtxCmTz.exe
  2⤵
  PID:10208
- C:\Windows\System\LicSBxs.exe
  C:\Windows\System\LicSBxs.exe
  2⤵
  PID:10168
- C:\Windows\System\EUevIFc.exe
  C:\Windows\System\EUevIFc.exe
  2⤵
  PID:10180
- C:\Windows\System\tvptHIH.exe
  C:\Windows\System\tvptHIH.exe
  2⤵
  PID:10140
- C:\Windows\System\LIAxjxm.exe
  C:\Windows\System\LIAxjxm.exe
  2⤵
  PID:9356
- C:\Windows\System\dHOhlEi.exe
  C:\Windows\System\dHOhlEi.exe
  2⤵
  PID:10232
- C:\Windows\System\LQQoYam.exe
  C:\Windows\System\LQQoYam.exe
  2⤵
  PID:9612
- C:\Windows\System\knUkZax.exe
  C:\Windows\System\knUkZax.exe
  2⤵
  PID:9580
- C:\Windows\System\dPBcYxv.exe
  C:\Windows\System\dPBcYxv.exe
  2⤵
  PID:9544
- C:\Windows\System\bvLRFRJ.exe
  C:\Windows\System\bvLRFRJ.exe
  2⤵
  PID:9932
- C:\Windows\System\pfElKzx.exe
  C:\Windows\System\pfElKzx.exe
  2⤵
  PID:9276
- C:\Windows\System\MyQFBKt.exe
  C:\Windows\System\MyQFBKt.exe
  2⤵
  PID:10248
- C:\Windows\System\zuLRXAc.exe
  C:\Windows\System\zuLRXAc.exe
  2⤵
  PID:10268
- C:\Windows\System\UDJqwHz.exe
  C:\Windows\System\UDJqwHz.exe
  2⤵
  PID:10284
- C:\Windows\System\PzMbGqb.exe
  C:\Windows\System\PzMbGqb.exe
  2⤵
  PID:10308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AtIKVTI.exe

Filesize
2.2MB

MD5
275cdffaca6b32136a7f458e42697b7b

SHA1
3d96d907f14a458ed71e97f3f16d407b16709c78

SHA256
f5229d5da330b058f71942b39b108028b5ae5ef00a0531e5a927c9400d82befb

SHA512
4ca8d3e57647770316f07ae3f7608a75b3f5c61cc194ec0b105e9e7849c04bff430e151573f9c70a2a85c2f5d407828495404ed1884cdd702d4d262a3114a712

Download Submit
C:\Windows\system\DwbwGEl.exe

Filesize
2.2MB

MD5
a4794597f59b9a5e33d6dd9e79fba231

SHA1
8882e32d044b264c169cdfe6ddc45522756be038

SHA256
e6246eb64378f04e68b927fa35d69e4801353a8afb916058cfd34d802161751b

SHA512
968178ec38f3aadf65381927a38ee6dd100f93fa788eb5fe585c172c648deb4f311c49db81d65a1f63279b25b942f04cc5f97a9b8c156ad5137cfb51b3f981dd

Download Submit
C:\Windows\system\EgIPecr.exe

Filesize
2.2MB

MD5
fbd151e50a672a6aefcd21257d33c908

SHA1
a87d2a3777c779ce87a2236a55a9612fe9d958e8

SHA256
0c911970dfaaf1927bcdeac231f18108a34bb64ef8a3a3d0fc99100aa15f5622

SHA512
b107c625814ff3cfdb8bdd533664074eed84bfe6af2da14c1ffe4e1a9cd2e627617fb5356fcd6115a99238ac8847b2afdae327485933914c8858c1cc58c3be61

Download Submit
C:\Windows\system\GkHzuca.exe

Filesize
2.2MB

MD5
33ed910cb6bcda557822e7a6526904ac

SHA1
dc8a93214849e863048da0cf514b7e4bf13e33c0

SHA256
a55cd2b2d879fa8131047ca9a2998a01b071cb30cd0ca2925ccea93bdb379dd7

SHA512
a2a541977ed8cfb8873e0a71e3c661e27ab23111af0e3a004828345c31745351e62a6760d1f587e14cb4a0ebc2d2e114b70b370b9a09b2fc1482540af4bee4c8

Download Submit
C:\Windows\system\KoiLHsU.exe

Filesize
2.2MB

MD5
b190fd0ab62e63c9a3e67ea057f88ed1

SHA1
cfb2598b452775afe8fc211f85f03979b56bcd68

SHA256
0f5ddc5068a2b29569833b970609972e543ae1e4527bdbec7a455446aa80f4c9

SHA512
839b216c3088116d6ff0e845608750e58ac80964bd104c4e5b7f03a78ef3947e6215f844fc46c1d3ca0c35e885b7d87e3f4fff4ccea7e28c8aab7dd40300f6df

Download Submit
C:\Windows\system\MJOWilK.exe

Filesize
2.2MB

MD5
cde6f76497e81576159b430af8154b25

SHA1
65650c2c569f2edc80a380c498485c0fc590804c

SHA256
3494317e98f9c44ffa3e3617dd4ed2c70590cc26b90018fcbf90b2eca2179fc8

SHA512
8c1f81ede996582706d1974a8498cc61cb015ed88fdef236559a125f104258c16bf3de7d47cd5362da581f123b41f94560e0a710fa6f71273caa345892ffba9f

Download Submit
C:\Windows\system\OJmLzED.exe

Filesize
2.2MB

MD5
26cfa32e3a44ddb59b98f1f1f9aa5122

SHA1
b8489c669f1265d89b8b0e02987f6f3618d9365f

SHA256
f878ccd40a7cdf8b3691aca09ee488238b36997b0ae431a173f0f515042e9275

SHA512
8c0f4789185dc26524ed0028db2ef3c7ffad34036521a752031eeb8cf6e90ee7e52ae7661fd027a97e1eb439c9bad9189914f388558e4e998335b135be5eedd1

Download Submit
C:\Windows\system\OMgYcvV.exe

Filesize
2.2MB

MD5
15c3f6e1761b5085167ce34816e858b5

SHA1
340ca45339a603ec044096c8fc3e894313533fcb

SHA256
432025af15eda6ea795cca1a4b66235ce3c8706c438ee95c01a4b2259d369f02

SHA512
b835542f62c194e26b70535e9851ab3f594e38ac886e0e11d712e472a263caee284ad1f93eca2e247142180a36db9d734403abbda883975429b40781454acbd5

Download Submit
C:\Windows\system\PpXiwcj.exe

Filesize
2.2MB

MD5
34950ca893842570620698be446706cc

SHA1
33cc0dcf0b97baa1c989372fab68b95033f47fe7

SHA256
cebd40432e8095dbc1cc84d157b499f2df39224904c92c75db06a481c5ad80c6

SHA512
dfd8668bfdac406170da98a66d6e5af56fd3f23756a3ae4b18642bb7d64d13bcac64426594ac3eb95ba42e60bac2d5eaa1e21d91d4f17108322de7e9c12ad1a0

Download Submit
C:\Windows\system\RItwUhI.exe

Filesize
2.2MB

MD5
1f9739ec12a6d5d33737c2f39443e131

SHA1
99f5d7e69ea26a95086276a5eb1602f30bc2fab6

SHA256
8a4c1090d7f2cf1af7d7ce3072861e2e2c28c04244273026a7e742e34c46aee5

SHA512
7b79deafc5fb19ee51d0682f4ce9cd0d90f6fc487cfd53c8025e2c66176d58790da631264a20cb7f6099c8989eccbfb9c5ccbdc1fb4328677570b8172e42ff58

Download Submit
C:\Windows\system\TfcgFiP.exe

Filesize
2.2MB

MD5
daf2302908b4c9467b924e7d6b486e55

SHA1
90082e12387ff00cbd1a4333f868e89f2f02c579

SHA256
dc0061d03c1d0d69d6840949cfd260802dbceecf0f18f4517d62027b38b3c7f0

SHA512
50b9579a1224d0584ca29791a22aa32d4a02be8a285df4bc65a19a2b10ad5b01b4b0658fb35a622ac339db7cf1e745505fa2825983f586c02d4050b768bccd74

Download Submit
C:\Windows\system\XIIhWCz.exe

Filesize
2.2MB

MD5
ad1186a1ead21a9169fc34d72fa15f21

SHA1
b57b1d878b0e1d13b9535c79bc8c7ed684c1f28f

SHA256
7cdbe9d83b9b2703d07c3c919792542019a327c5e1af039c79233c597da27424

SHA512
03e3fceee085aa7009906bd8fb2215a39482a3bf5e58f3c1d33cc0cb7a2ce42228749c1c5926343629af24b99228d97ba2330cca3dcb60252b030bb3e0ff8755

Download Submit
C:\Windows\system\YYZPAOL.exe

Filesize
2.1MB

MD5
f5582ba08b75b26dfc4fac7320bdc469

SHA1
66b47f0d6e2a71041f23d28027b89e0e3fbe7865

SHA256
a7713895e7b9df28aa48af1036d3c0186803779fb9f193cc5c401c60a414f407

SHA512
2188597054ee1b715b113175cfd2cfc391ea055fa7c69b7cbd98bd683239db15cee89876921f6dc7ab3c9ab1b10a5f3af11db262d641ccc4dc892219f89ec04a

Download Submit
C:\Windows\system\bwQpIBO.exe

Filesize
2.2MB

MD5
147a3f6d0c4b8e0682a0098244da4b8d

SHA1
7040e00f8cf705a14dd63a5fcd126b4cc963984b

SHA256
3ebb07023d9fa66be5d695e96aab932beeafbed0b2e7cd302326312981f43abe

SHA512
a4acf6a3a084d8bdf154c15d1fdf2c65f57a8144884b81e4edd1d8c8397d5684f821dd723f719e7bef1847164fc81012469dd780a353985f8d57d398aefa146e

Download Submit
C:\Windows\system\ffsiYbV.exe

Filesize
2.2MB

MD5
438561980e8e2adf94818d9cb88e97bf

SHA1
2ef3840f3fc48a208afc5adc8aec90df828774df

SHA256
1613383457ade2f07d9d161c9546b0eab3d46c52a94d564384aa8a47febaa9e6

SHA512
481ff671cfaaf03bd285cb595d5b8a6d07e54df17656482c15722878963cd3e70b15fbf717c0a93f7c5a416ebb4bd9a9b3f00e7a6c2ff6ea471894650dc3aa99

Download Submit
C:\Windows\system\hvCWuAB.exe

Filesize
2.1MB

MD5
6666d89947203a7fd5e328aa961f15d7

SHA1
02ab48702489370b66bfa25465bf7801be38d794

SHA256
bb756e885077c4920dfc6e8a3940c6853437fe223ef44936a74126e13a84bb69

SHA512
258bc24d6258087a6e8f05faf0e42636dbf6e64fc1718c2b1814874c084c9a1cbc4488b35aecd5c7a4d2ea5cc673c96d7fb141f2073f08c594c89adb3b4eec6a

Download Submit
C:\Windows\system\iyeTteN.exe

Filesize
2.2MB

MD5
ef279ca34725a251e02068b6f7d9d0eb

SHA1
e25171ab9c7428774662fc5b1509594e4ef103b6

SHA256
0ee1d08cc6bed459fec4ec09d2e46d608e6fea5ecb04dee724368598977326e3

SHA512
f27afa07274fb02fe36fc148cb3a16a0f5743b373cc44e6bfa31e236c68c867793555c0a276fa55b506d06c6d5e3cd47a8acd91ff925c374a52d5c807e918206

Download Submit
C:\Windows\system\nzQGXVO.exe

Filesize
2.2MB

MD5
06375f9b74f7f54524b8132b8bc1c649

SHA1
4188ffa47069daf43940836571b34aa714ecd5d1

SHA256
f040a696b2a34b751884f54de0cbd66a44f7f810460cabae8629be3da8c682dc

SHA512
b3ed2aa54877140d4a4871539063b976a80df3d277c27bf62ce8826902ba62d6f55ccb678a274a0440b6a4de465ddc25a2e1ab5b4a673fc82c7ecdd694892f1e

Download Submit
C:\Windows\system\oOuaHRD.exe

Filesize
2.2MB

MD5
77fa45f2913a490da04fe783f764dc44

SHA1
66841d3f325ca1c81d4901799790ea347af4c3d5

SHA256
1d42797f0a1cd5c4b63c3ed0a7f0c5a83ce05e7df4cdb701fa8e8f57be7d62f8

SHA512
f8b5675f8ea881e1fe5e8935cb36b58b8df9727d3fa8cff77762a39af67a88ef9a85708f535af6f1bb49f2fced6120fdfc68a3535246327aeef60fe2350595a6

Download Submit
C:\Windows\system\yECaqQd.exe

Filesize
2.2MB

MD5
a0c2f152801fa5c1082eefffc247263d

SHA1
0ccd608c25b2f05bb868f42acf57401657ba5bac

SHA256
8b857e0b2bfc30c9eb5ba8f0659d8d8e47540e7ac5848852f4f972fd4e7fddad

SHA512
5f15749e77c79f0e62439fd0d274c758c00261c3057d7e4b3a2482ebf0a8032e00a893312c91537631ec6eddf17603771445792efb5ef1db7f170ab04d39ae32

Download Submit
C:\Windows\system\yTUNGrm.exe

Filesize
2.2MB

MD5
265837c5d15a6c6db9d03919a0027003

SHA1
733b27b12155e96c7ae755242be4d1da2a25f17c

SHA256
0419c1875e3d3ae39808c85c4858205b2538eb9bb1c93e219402c1149fda6dbd

SHA512
c2e0eb8a8fb7062880171097a30149ec131bba3182d48eec7dcad066be486f22303ac60658d38547e8990c8eb37fdca37311b41bbd051e25509cc00d5b16c1d4

Download Submit
\Windows\system\AKStroj.exe

Filesize
2.2MB

MD5
b87e7222755604cd66e0b07319446104

SHA1
cfaa3986d56f3df2e882338d6c4c88b73c5ce18d

SHA256
42e7216937caa0492493bc294e9c37f46e9df97c9b45fc838e23de2f4e51b625

SHA512
c6df239a6b4d7a4187aa4e5bc587affbf06731015edf4770c6037be7a39bbeb0c5751bc3335ec168abbe040f958c39f6dbb3aca4cd674df2af078b165bde5b87

Download Submit
\Windows\system\EfWmqkV.exe

Filesize
2.2MB

MD5
4c905bd98a27185a6e19ae7afa150a97

SHA1
0e347a78a527763edf7522e3b818db5e75eefc82

SHA256
4174c2abfffde916788daafd1d2bd79b832f50abfc42bbc681619e17486da3ac

SHA512
07e30566a85f3f1a45eef549275fd4dd0428a982249f2710e4157d39d340c1992936af5110d1bab8efaab417f28e4f390f3dd8d6ab0fd2169d8d9f30c6d50bff

Download Submit
\Windows\system\GevamRY.exe

Filesize
2.2MB

MD5
99abda170f254aa9c613bacbbba66e8c

SHA1
965a6515bf120127c3a996550f40e715f130499e

SHA256
2709e8075cb6b549abdb99fb4588a98e41304f7ff4ebc2511fbb6661cc7dfb78

SHA512
0a667fa0981cdf529ad91e7283b54b7b26d127824f431f75dbaabff8d3c7bae1b58318e0399cc0351967cb75592e597fac0602df4d4269e7bbc9c42647e67f97

Download Submit
\Windows\system\JKwnYJc.exe

Filesize
2.2MB

MD5
006c7ff1f549cd2eed802f8bc32b04ba

SHA1
a5618234cd3dee815744ba56f7d0632f32228b6e

SHA256
47178670cd43c42ac242eb40c6d9d33759d832b1916a13d5978d5a2252ea57d8

SHA512
d894d8cdc3f2223ee39ad4a1b83d74b43424b2868fddc798072740d6b1e51c8e18e901f7fdcd42840deb540b9fd37ebf77da9a9aa671a56582806e8ad24c04d1

Download Submit
\Windows\system\LqLytFv.exe

Filesize
2.2MB

MD5
b6574f33c275d00bc9e1bcd25bb73a8e

SHA1
41d02b0f8f288e4ecbc4cbf1d90c676a9e00f4e4

SHA256
0583a8e657773bd9db9866894c8e1adf8951b57630072ffd0942a9f05423e43c

SHA512
d0cf4f3acfbbab6ce6d52b46c538e1f379b1679093c61d522aad23dc4b7f2d142314960d62c2e32215be4689435094eefc809ef4550b2a436ede3cff9c2fabbc

Download Submit
\Windows\system\PjRLrcz.exe

Filesize
2.2MB

MD5
d2de5d173e20faf7cd95adef91f9d8d3

SHA1
dc90bc888e1489fe99504b4ac17d35415e3b9628

SHA256
fb140782606cfeda31ab3e95f435871c848c8c574dcdf4cc70013fe243d18e4b

SHA512
7c7ff52b791d42b19b4a53dd177e763fd8d44f5a28693850f8863fb3ddbaf0de69854c644741e32fb2b737877850add04ec412eebaa3f07ff4918e46df0b5ac6

Download Submit
\Windows\system\WOojbrR.exe

Filesize
2.2MB

MD5
ddf007e1f2dd5cd7ef2a2bae244af8a1

SHA1
f5317432436946f7b4dd1a88c47c9cb39b860d9d

SHA256
b8eda43e33d67ada6c0e750325933c17c7196070ff8a2ba36b201dd1efc992a6

SHA512
5c2d40b6b77a3411a727e1267d45555af078cd9c4b5f53982ccac388e67a95a8dac1570a4c5a8f02390465a8a1e1199486103a71959f9719dbcf275aff0fa63a

Download Submit
\Windows\system\abRwnZB.exe

Filesize
2.2MB

MD5
f065dfc433e00b262ee9bb21b2cd1cc8

SHA1
9d1b044a2348864c85dcf2de708ca7f04a20fa2d

SHA256
93c15105f5dabe98ee3f5350107719a1db7c5b74b61db1d407ab8c45bb24b4ec

SHA512
25b98cb2be6059c7e1cb63de909e7a2e69d0eec1573534f16cfc023f5210bd059c7d28de3be439dc40f22e266c727227eeadb862c9d40d0bcd21ef4de37c94f0

Download Submit
\Windows\system\fsBuxsC.exe

Filesize
2.2MB

MD5
ff3034cfaa7674410eb33edb8995c2ee

SHA1
8bb2b8facfc11b480aba992ce8e3c79d4b037bfd

SHA256
37f11f9fa42eddfa5aeed2500e2429174f40700ea0cdc49374e7d73accca78a4

SHA512
e6726c4154b3a8c4d87aba9d23ff8772bb729d41d6bf4086be20fbd766b2623c42084d1ced2a943d4bd836427e835235a6e7874b0bd40a8fdcf4c018fe04d83f

Download Submit
\Windows\system\hNtJEWE.exe

Filesize
2.2MB

MD5
f6dc2cdba1fe1d502933fbccae33d7fe

SHA1
98be8d37476ec93bbc100703b25e85445754046a

SHA256
c35fad9592d880f1424814b984aab3db4e710fa690d47516069d1c4f4a9a3deb

SHA512
a9b75d8f6378b33961445b6efd4263ea58af12b789afb8517b6b8120443462d72c0216a33c045f73ff61cbe50665018c71075523fcb4f529343e6acc9ae68534

Download Submit
\Windows\system\hNwSAMz.exe

Filesize
2.2MB

MD5
59462ff7b608618ca5ca1a1a4157d25f

SHA1
747d4e578dbb91c19656e9b49d0f2a61ab4e40b3

SHA256
48610dc63034ad5bf5cd89ce9c6d0580624d47a0e1a9e6f7d3fbb0baf4574d9d

SHA512
b3da7b7d93c48317311a8c7ea3dfd2493de497f7e3b8f077e9594261225429688f2a3749e19f0956e4ea533ca5cb33a4320c8738f53a328768ca52125403cc12

Download Submit
\Windows\system\kowsfAE.exe

Filesize
2.2MB

MD5
4db222d0ccc574a8f5e9263f73927230

SHA1
a8f5f93dabca3f77afdf3ea42babf7097b47af4b

SHA256
1d30a44fb1db8c6a959670b4f9a24f6e6330793f73cfb6730ad20c552ae755dd

SHA512
31c32dbbb5251521790414753f7ee917018afb4ef97392b563470347d7b6775b2f0c7578f0fff79d712429b76513f2afcce6d336333ac95ff21c01219508c3de

Download Submit
\Windows\system\kzfrkhk.exe

Filesize
2.2MB

MD5
9949baf3f6a8b0eceb50367001cad2ee

SHA1
0f6a4eb903b92dd09a14501befad5e9061043686

SHA256
e1b22422ec72ea4b38655497cb0cf4fe4a82624d0191748d4e177892182383b9

SHA512
982f3242df3e39d1adba0b774551c277618f50df50645ee29544c1b8c999528dc1556a9004cd0d73c95f6c9046492d346375706d5129f4e0383268e288f9a871

Download Submit
\Windows\system\mayNHeT.exe

Filesize
2.2MB

MD5
a6db28c3cfcb04fe798bfacb1cd0cbee

SHA1
9a69b25c8d1b2f8c48928512b0d62029357f677d

SHA256
4f0413475b699024bed3d7551f38bc2b6bbde2651342d8ffaec761a3097bc2f5

SHA512
d80f64b772ab344c5ea75393ab5fabd040b658ee544435f4dff74cdb79adc385bef52fac6317b45021c37c9b4107193de24e83943af867cb3d060e8831ffc060

Download Submit
\Windows\system\rQzVqZP.exe

Filesize
2.2MB

MD5
18f4a36b420bad281ae307a1733a3205

SHA1
07336b89a438cf7cd3c8dd50994b13bf9f387ce3

SHA256
64d716048805e3e02133cdb9ee44241c1d54c262b478c78c9e71d63cba99867f

SHA512
af586e9d89dbe0b8a6ee349cb9154963dd531f0fcb7093d6e6e13e79230e401d8173b6ec5b58a546518084510d94cba51b38d388ebd0df47ddad94fc022822f5

Download Submit
\Windows\system\smZudwv.exe

Filesize
2.2MB

MD5
aa86527235646558e83f90bb79d629d2

SHA1
b813c59b45d007e3ffb25f823ef56c4dd850c657

SHA256
02346644a7f08077709f369810c2640aba40541dcc7caaab4092997717c90563

SHA512
b8f3cca6b61cd932f0386f7c4c6ca5ce6cd7dc8201a787a6bb52d1e68208cb49ecfe28c1a35d9c4c77c809041080775cbc276bda5de5ed00f558ee2b6fc269d4

Download Submit
\Windows\system\vSDKdSO.exe

Filesize
2.2MB

MD5
86a7f4ae4e2a24db7293c2fbe0ab8481

SHA1
707fea08a30cbf32d7dd92f185bb1b7fbc86b597

SHA256
2c6cee3b55c482dece384227dafca15a0d0998e6a0333fed3e6244ca62d31152

SHA512
4ae129a884f1c23e47aaa72e151a7d2ae19d5a8942cccd4b845e27131995b21792758fccada3988e68589393d96af697e7882e887c587bbff8b945477da474a8

Download Submit
\Windows\system\xuhOJWh.exe

Filesize
2.2MB

MD5
996f7ee090b6e19b1df04e340386ea51

SHA1
563bc76d67e9a489af1793355adf14a8624af7cd

SHA256
df321f42d49453844366feaee14a10564a9ace95f7e8dbf97bbb640e7e2916e2

SHA512
e98bbb2ef7eb2474c62604a91c1244cdad7b98f1747815b9f7b204b2d8c4a1ffe9ea845305edba424df1d3e7cb421743f335a2fb770f5ae91a8325ecab7b795b

Download Submit
\Windows\system\zqStSpy.exe

Filesize
2.1MB

MD5
99b0b2a213809fcfa27c5489335a52bd

SHA1
dc539754703eab1ef005e9675675a7f6718f25cf

SHA256
ab256fa58e3cdc22d5aedd47eb2ec0c927b932dd2ffaacc3b4f625d6fd40fb5e

SHA512
3a0ca7523e3da216d769b6836d1931cc3305bad38e68d299d2847bb11a6cde03babdb845f03b17157071b47f84c808a2c214c878a1501ac8dabe1d13851fc910

Download Submit
memory/768-68-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2072-58-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2384-57-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2396-53-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2436-19-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2436-54-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2436-144-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2436-20-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2436-101-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2436-76-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2436-56-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2436-60-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2436-426-0x000000013F630000-0x000000013FA22000-memory.dmp

Filesize
3.9MB

Download
memory/2436-80-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-51-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2436-170-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2436-47-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2436-87-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2436-7-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/2436-94-0x0000000003560000-0x0000000003952000-memory.dmp

Filesize
3.9MB

Download
memory/2436-1-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-1262-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2484-46-0x000000013F380000-0x000000013F772000-memory.dmp

Filesize
3.9MB

Download
memory/2508-117-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2508-8-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2532-55-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-1283-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-50-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2884-67-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2884-427-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2884-65-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download
memory/2884-440-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download
memory/2884-23-0x000007FEF5ADE000-0x000007FEF5ADF000-memory.dmp

Filesize
4KB

Download
memory/2884-22-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2884-21-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2884-45-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download
memory/2884-61-0x000000001B530000-0x000000001B812000-memory.dmp

Filesize
2.9MB

Download
memory/2884-2134-0x000007FEF5820000-0x000007FEF61BD000-memory.dmp

Filesize
9.6MB

Download