xmrig | cfec838ba62a67d8254961c15241e969465e15aff54e257d2eec71d406723694

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
Size

2.1MB
MD5

0fc7c1287eae843c4a7ef618f698dc49
SHA1

e5e94f099888af853ff3300c6317fc0b5fef29ab
SHA256

cfec838ba62a67d8254961c15241e969465e15aff54e257d2eec71d406723694
SHA512

b2b0140e4c2cb8818d62559768645eb4ea8988af6fa58e4de9e1481339925ab3657d9625943b1323e291e2adbbb6a8a50d4c31bab77eebb6ed2cc2cb6e8061fd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrr:NABu

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2960-9-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2656-121-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2596-144-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2668-143-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/1916-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/868-138-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2376-136-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2476-133-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2500-131-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2620-126-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/1940-125-0x0000000003160000-0x0000000003552000-memory.dmp	xmrig
behavioral1/memory/2480-117-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2056-26-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2960-5288-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2480-5292-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2500-5291-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/2056-5290-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	xmrig
behavioral1/memory/2376-5295-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2668-5294-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2596-5293-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2620-5289-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/868-5314-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/1916-5323-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2476-5331-0x000000013FA60000-0x000000013FE52000-memory.dmp	xmrig
behavioral1/memory/2656-5313-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2960	AooGqTX.exe
2056	PabKWaR.exe
2668	vpQcIdQ.exe
2596	wIojptJ.exe
2480	OpVCNly.exe
2656	mOPVZxL.exe
2620	JwDsoil.exe
2500	isiFhWq.exe
2476	fvhVofD.exe
2376	uJBpQZU.exe
868	AtvXlgT.exe
1916	VBPMTGd.exe
2680	rHLEjDS.exe
2776	nJKVmSn.exe
2752	XIVezke.exe
2820	SlsAEJV.exe
1220	LpgBnxs.exe
2332	htAguFk.exe
1748	yIWhavB.exe
1880	GOcBiIG.exe
2360	mjlzlln.exe
2872	dBnCDCt.exe
2544	AflDKvp.exe
324	IhjNacz.exe
2084	GaWNFjP.exe
588	jLreInC.exe
636	KvmADQT.exe
2832	YvnJOni.exe
1484	ARNzoDD.exe
900	xnVrtTr.exe
1184	eEmpPtr.exe
1304	fpDkmpt.exe
1804	ocHTxlv.exe
1952	xoPLlyz.exe
960	uVErWlJ.exe
1100	AmHWINi.exe
2008	yBbIDKn.exe
2228	XhkZGBc.exe
1996	roTOAws.exe
3044	PyJxrxx.exe
988	iFgBXmL.exe
2884	lYLjQIH.exe
1764	EsEqxqX.exe
1624	KpyaWEf.exe
1284	BuRTyVJ.exe
380	rqBRlAl.exe
1728	oVHGTcS.exe
1740	gGcyJXK.exe
2952	srBkKgz.exe
1724	NTFdIZv.exe
2836	BLQjYIC.exe
2632	LgWJhbg.exe
2636	lotDnQv.exe
2608	qRHynjl.exe
2612	ARpBjLE.exe
2972	NkzpSOY.exe
2464	DDUzzgD.exe
2108	jbaJxyF.exe
1736	ZGOdqjx.exe
2816	rnFrmfu.exe
2788	yesXIHm.exe
2336	TIoFeQN.exe
1680	SDwegOZ.exe
1968	vDayyMS.exe

Loads dropped DLL 64 IoCs

pid	Process
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1940-0-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x000b000000013413-6.dat	upx
behavioral1/memory/2960-9-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0008000000013acb-19.dat	upx
behavioral1/files/0x000e0000000054ab-31.dat	upx
behavioral1/files/0x0008000000014175-36.dat	upx
behavioral1/files/0x0009000000014228-45.dat	upx
behavioral1/files/0x0007000000014186-40.dat	upx
behavioral1/files/0x0007000000014712-50.dat	upx
behavioral1/files/0x0006000000014a9a-71.dat	upx
behavioral1/files/0x0006000000014b4c-80.dat	upx
behavioral1/files/0x0006000000014bbc-85.dat	upx
behavioral1/files/0x000600000001564f-103.dat	upx
behavioral1/files/0x0006000000014e71-91.dat	upx
behavioral1/files/0x000600000001535e-108.dat	upx
behavioral1/files/0x000600000001565d-123.dat	upx
behavioral1/memory/2656-121-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x0006000000015653-110.dat	upx
behavioral1/files/0x0006000000014fa2-96.dat	upx
behavioral1/files/0x0006000000015684-147.dat	upx
behavioral1/files/0x0006000000015c87-159.dat	upx
behavioral1/files/0x0032000000013a46-156.dat	upx
behavioral1/memory/2596-144-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2668-143-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x0006000000015cae-164.dat	upx
behavioral1/files/0x0006000000015ccd-176.dat	upx
behavioral1/files/0x0006000000015cb6-184.dat	upx
behavioral1/files/0x0006000000015cff-195.dat	upx
behavioral1/files/0x0006000000015cd9-178.dat	upx
behavioral1/files/0x0006000000015c9e-172.dat	upx
behavioral1/files/0x0006000000015ce3-188.dat	upx
behavioral1/memory/1916-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/868-138-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2376-136-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2476-133-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2500-131-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2620-126-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x0006000000015677-124.dat	upx
behavioral1/memory/2480-117-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0006000000014b18-75.dat	upx
behavioral1/files/0x000600000001487f-65.dat	upx
behavioral1/files/0x0006000000014826-60.dat	upx
behavioral1/files/0x000600000001471a-54.dat	upx
behavioral1/memory/2056-26-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/files/0x0033000000013a3a-18.dat	upx
behavioral1/memory/2960-5288-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2480-5292-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2500-5291-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/memory/2056-5290-0x000000013F6D0000-0x000000013FAC2000-memory.dmp	upx
behavioral1/memory/2376-5295-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2668-5294-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/memory/2596-5293-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2620-5289-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/868-5314-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/1916-5323-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2476-5331-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/memory/2656-5313-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\UbcsCtj.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\QWNSgMh.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\RoackFx.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\KMdKITI.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\HNKRKCn.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\lCRzTJX.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\SeqjiiY.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\BLQjYIC.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ITGJzLh.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\RhnPAKC.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\JbuWVaZ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\GhDomUj.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\QDeYzNR.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\EYvkaZK.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\oVObCuD.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\LoCkvza.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\xcsGYMk.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\BokJCRv.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\IQvCWft.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\tDvQZvs.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\QgBQusi.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\gslipbv.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\bFFOCLj.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\qnUnFzl.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\vpQcIdQ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\LgWJhbg.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\Wjyjcjs.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\TQHXwWJ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\alRoNyM.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\dnwrNyO.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\SnFhBAB.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\LUmhhJF.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\EGlbJlv.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\YjPSTMQ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ksTDauf.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\pPJUfmT.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\DGMUmVY.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\BJgTLYH.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\sRatyZT.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\woGGcAl.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\uujiEbS.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\XJQWKjx.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\VlyrtwO.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\rqFIpiw.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\nTApvHr.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\UtAccNc.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\WflfpnB.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\nldOZkZ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\bmvhQcK.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\uJBpQZU.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\rZfcVdk.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ORLsHyL.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\jaAtewo.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\SfmcwVd.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\zXoDGhz.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\BZWCrnW.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ZcDeLer.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ZNiKWGG.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\XkiAaqc.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\BPUmXQK.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\fvYJlBJ.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\gcPYQwR.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\ctKJTuF.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
File created	C:\Windows\System\togfePk.exe	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
Token: SeDebugPrivilege	2916	powershell.exe
Token: SeLockMemoryPrivilege	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	29
PID 1940 wrote to memory of 2916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	29
PID 1940 wrote to memory of 2916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	29
PID 1940 wrote to memory of 2960	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2960	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2960	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	30
PID 1940 wrote to memory of 2056	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	31
PID 1940 wrote to memory of 2056	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	31
PID 1940 wrote to memory of 2056	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	31
PID 1940 wrote to memory of 2668	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	32
PID 1940 wrote to memory of 2668	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	32
PID 1940 wrote to memory of 2668	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	32
PID 1940 wrote to memory of 2596	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	33
PID 1940 wrote to memory of 2596	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	33
PID 1940 wrote to memory of 2596	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	33
PID 1940 wrote to memory of 2480	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	34
PID 1940 wrote to memory of 2480	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	34
PID 1940 wrote to memory of 2480	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	34
PID 1940 wrote to memory of 2656	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	35
PID 1940 wrote to memory of 2656	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	35
PID 1940 wrote to memory of 2656	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	35
PID 1940 wrote to memory of 2620	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	36
PID 1940 wrote to memory of 2620	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	36
PID 1940 wrote to memory of 2620	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	36
PID 1940 wrote to memory of 2500	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	37
PID 1940 wrote to memory of 2500	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	37
PID 1940 wrote to memory of 2500	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	37
PID 1940 wrote to memory of 2476	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	38
PID 1940 wrote to memory of 2476	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	38
PID 1940 wrote to memory of 2476	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	38
PID 1940 wrote to memory of 2376	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	39
PID 1940 wrote to memory of 2376	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	39
PID 1940 wrote to memory of 2376	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	39
PID 1940 wrote to memory of 868	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	40
PID 1940 wrote to memory of 868	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	40
PID 1940 wrote to memory of 868	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	40
PID 1940 wrote to memory of 1916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	41
PID 1940 wrote to memory of 1916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	41
PID 1940 wrote to memory of 1916	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	41
PID 1940 wrote to memory of 2680	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	42
PID 1940 wrote to memory of 2680	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	42
PID 1940 wrote to memory of 2680	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	42
PID 1940 wrote to memory of 2776	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	43
PID 1940 wrote to memory of 2776	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	43
PID 1940 wrote to memory of 2776	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	43
PID 1940 wrote to memory of 2752	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	44
PID 1940 wrote to memory of 2752	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	44
PID 1940 wrote to memory of 2752	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	44
PID 1940 wrote to memory of 2820	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	45
PID 1940 wrote to memory of 2820	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	45
PID 1940 wrote to memory of 2820	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	45
PID 1940 wrote to memory of 1220	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	46
PID 1940 wrote to memory of 1220	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	46
PID 1940 wrote to memory of 1220	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	46
PID 1940 wrote to memory of 1748	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	47
PID 1940 wrote to memory of 1748	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	47
PID 1940 wrote to memory of 1748	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	47
PID 1940 wrote to memory of 2332	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	48
PID 1940 wrote to memory of 2332	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	48
PID 1940 wrote to memory of 2332	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	48
PID 1940 wrote to memory of 2360	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	49
PID 1940 wrote to memory of 2360	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	49
PID 1940 wrote to memory of 2360	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	49
PID 1940 wrote to memory of 1880	1940	0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fc7c1287eae843c4a7ef618f698dc49_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System\AooGqTX.exe
  C:\Windows\System\AooGqTX.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\PabKWaR.exe
  C:\Windows\System\PabKWaR.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vpQcIdQ.exe
  C:\Windows\System\vpQcIdQ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\wIojptJ.exe
  C:\Windows\System\wIojptJ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\OpVCNly.exe
  C:\Windows\System\OpVCNly.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\mOPVZxL.exe
  C:\Windows\System\mOPVZxL.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\JwDsoil.exe
  C:\Windows\System\JwDsoil.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\isiFhWq.exe
  C:\Windows\System\isiFhWq.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\fvhVofD.exe
  C:\Windows\System\fvhVofD.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\uJBpQZU.exe
  C:\Windows\System\uJBpQZU.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\AtvXlgT.exe
  C:\Windows\System\AtvXlgT.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\VBPMTGd.exe
  C:\Windows\System\VBPMTGd.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\rHLEjDS.exe
  C:\Windows\System\rHLEjDS.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\nJKVmSn.exe
  C:\Windows\System\nJKVmSn.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\XIVezke.exe
  C:\Windows\System\XIVezke.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\SlsAEJV.exe
  C:\Windows\System\SlsAEJV.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\LpgBnxs.exe
  C:\Windows\System\LpgBnxs.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\yIWhavB.exe
  C:\Windows\System\yIWhavB.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\htAguFk.exe
  C:\Windows\System\htAguFk.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\mjlzlln.exe
  C:\Windows\System\mjlzlln.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\GOcBiIG.exe
  C:\Windows\System\GOcBiIG.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\AflDKvp.exe
  C:\Windows\System\AflDKvp.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\dBnCDCt.exe
  C:\Windows\System\dBnCDCt.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\GaWNFjP.exe
  C:\Windows\System\GaWNFjP.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\IhjNacz.exe
  C:\Windows\System\IhjNacz.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\KvmADQT.exe
  C:\Windows\System\KvmADQT.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\jLreInC.exe
  C:\Windows\System\jLreInC.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\ARNzoDD.exe
  C:\Windows\System\ARNzoDD.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\YvnJOni.exe
  C:\Windows\System\YvnJOni.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\xnVrtTr.exe
  C:\Windows\System\xnVrtTr.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\eEmpPtr.exe
  C:\Windows\System\eEmpPtr.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\fpDkmpt.exe
  C:\Windows\System\fpDkmpt.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\ocHTxlv.exe
  C:\Windows\System\ocHTxlv.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\xoPLlyz.exe
  C:\Windows\System\xoPLlyz.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\uVErWlJ.exe
  C:\Windows\System\uVErWlJ.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\AmHWINi.exe
  C:\Windows\System\AmHWINi.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\yBbIDKn.exe
  C:\Windows\System\yBbIDKn.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\XhkZGBc.exe
  C:\Windows\System\XhkZGBc.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\roTOAws.exe
  C:\Windows\System\roTOAws.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\iFgBXmL.exe
  C:\Windows\System\iFgBXmL.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\PyJxrxx.exe
  C:\Windows\System\PyJxrxx.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\lYLjQIH.exe
  C:\Windows\System\lYLjQIH.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\EsEqxqX.exe
  C:\Windows\System\EsEqxqX.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\KpyaWEf.exe
  C:\Windows\System\KpyaWEf.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\BuRTyVJ.exe
  C:\Windows\System\BuRTyVJ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\oVHGTcS.exe
  C:\Windows\System\oVHGTcS.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\rqBRlAl.exe
  C:\Windows\System\rqBRlAl.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\gGcyJXK.exe
  C:\Windows\System\gGcyJXK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\srBkKgz.exe
  C:\Windows\System\srBkKgz.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\NTFdIZv.exe
  C:\Windows\System\NTFdIZv.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BLQjYIC.exe
  C:\Windows\System\BLQjYIC.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\LgWJhbg.exe
  C:\Windows\System\LgWJhbg.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\lotDnQv.exe
  C:\Windows\System\lotDnQv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\qRHynjl.exe
  C:\Windows\System\qRHynjl.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\ARpBjLE.exe
  C:\Windows\System\ARpBjLE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\NkzpSOY.exe
  C:\Windows\System\NkzpSOY.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\DDUzzgD.exe
  C:\Windows\System\DDUzzgD.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\jbaJxyF.exe
  C:\Windows\System\jbaJxyF.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ZGOdqjx.exe
  C:\Windows\System\ZGOdqjx.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\rnFrmfu.exe
  C:\Windows\System\rnFrmfu.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\yesXIHm.exe
  C:\Windows\System\yesXIHm.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\TIoFeQN.exe
  C:\Windows\System\TIoFeQN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\SDwegOZ.exe
  C:\Windows\System\SDwegOZ.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\vDayyMS.exe
  C:\Windows\System\vDayyMS.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\ulnKdVx.exe
  C:\Windows\System\ulnKdVx.exe
  2⤵
  PID:2112
- C:\Windows\System\FwajXvq.exe
  C:\Windows\System\FwajXvq.exe
  2⤵
  PID:488
- C:\Windows\System\ODbBHPf.exe
  C:\Windows\System\ODbBHPf.exe
  2⤵
  PID:2076
- C:\Windows\System\qCijbXF.exe
  C:\Windows\System\qCijbXF.exe
  2⤵
  PID:2664
- C:\Windows\System\iejILHQ.exe
  C:\Windows\System\iejILHQ.exe
  2⤵
  PID:776
- C:\Windows\System\OCIMsqY.exe
  C:\Windows\System\OCIMsqY.exe
  2⤵
  PID:2144
- C:\Windows\System\KkPSUvt.exe
  C:\Windows\System\KkPSUvt.exe
  2⤵
  PID:1864
- C:\Windows\System\xqbnBLH.exe
  C:\Windows\System\xqbnBLH.exe
  2⤵
  PID:3008
- C:\Windows\System\icALjrj.exe
  C:\Windows\System\icALjrj.exe
  2⤵
  PID:1688
- C:\Windows\System\pmlBNSg.exe
  C:\Windows\System\pmlBNSg.exe
  2⤵
  PID:864
- C:\Windows\System\DXPrHUI.exe
  C:\Windows\System\DXPrHUI.exe
  2⤵
  PID:1876
- C:\Windows\System\LhZZOQy.exe
  C:\Windows\System\LhZZOQy.exe
  2⤵
  PID:2032
- C:\Windows\System\BSSVICy.exe
  C:\Windows\System\BSSVICy.exe
  2⤵
  PID:2340
- C:\Windows\System\gIGaxcN.exe
  C:\Windows\System\gIGaxcN.exe
  2⤵
  PID:2472
- C:\Windows\System\nCkslYl.exe
  C:\Windows\System\nCkslYl.exe
  2⤵
  PID:1052
- C:\Windows\System\bRYsyla.exe
  C:\Windows\System\bRYsyla.exe
  2⤵
  PID:1524
- C:\Windows\System\RQEzEuf.exe
  C:\Windows\System\RQEzEuf.exe
  2⤵
  PID:2712
- C:\Windows\System\GidKaXJ.exe
  C:\Windows\System\GidKaXJ.exe
  2⤵
  PID:876
- C:\Windows\System\XYpGXUT.exe
  C:\Windows\System\XYpGXUT.exe
  2⤵
  PID:1520
- C:\Windows\System\kpyIrYp.exe
  C:\Windows\System\kpyIrYp.exe
  2⤵
  PID:356
- C:\Windows\System\Ooudwka.exe
  C:\Windows\System\Ooudwka.exe
  2⤵
  PID:2096
- C:\Windows\System\veLZHWK.exe
  C:\Windows\System\veLZHWK.exe
  2⤵
  PID:2964
- C:\Windows\System\uUiUNSW.exe
  C:\Windows\System\uUiUNSW.exe
  2⤵
  PID:2492
- C:\Windows\System\SHzAery.exe
  C:\Windows\System\SHzAery.exe
  2⤵
  PID:2616
- C:\Windows\System\cwJvYwU.exe
  C:\Windows\System\cwJvYwU.exe
  2⤵
  PID:2512
- C:\Windows\System\vbYkxBr.exe
  C:\Windows\System\vbYkxBr.exe
  2⤵
  PID:1048
- C:\Windows\System\FEknkWX.exe
  C:\Windows\System\FEknkWX.exe
  2⤵
  PID:2768
- C:\Windows\System\avenhlh.exe
  C:\Windows\System\avenhlh.exe
  2⤵
  PID:2548
- C:\Windows\System\gZyqIxd.exe
  C:\Windows\System\gZyqIxd.exe
  2⤵
  PID:1964
- C:\Windows\System\GGcwmtq.exe
  C:\Windows\System\GGcwmtq.exe
  2⤵
  PID:1824
- C:\Windows\System\xsqSqAu.exe
  C:\Windows\System\xsqSqAu.exe
  2⤵
  PID:956
- C:\Windows\System\MWjzLsM.exe
  C:\Windows\System\MWjzLsM.exe
  2⤵
  PID:904
- C:\Windows\System\jfXvNyH.exe
  C:\Windows\System\jfXvNyH.exe
  2⤵
  PID:696
- C:\Windows\System\FWUaYvv.exe
  C:\Windows\System\FWUaYvv.exe
  2⤵
  PID:2236
- C:\Windows\System\yOVNbLD.exe
  C:\Windows\System\yOVNbLD.exe
  2⤵
  PID:112
- C:\Windows\System\Wjyjcjs.exe
  C:\Windows\System\Wjyjcjs.exe
  2⤵
  PID:1612
- C:\Windows\System\traBaOC.exe
  C:\Windows\System\traBaOC.exe
  2⤵
  PID:2260
- C:\Windows\System\sRatyZT.exe
  C:\Windows\System\sRatyZT.exe
  2⤵
  PID:2440
- C:\Windows\System\OUibLGY.exe
  C:\Windows\System\OUibLGY.exe
  2⤵
  PID:3024
- C:\Windows\System\uTraJDX.exe
  C:\Windows\System\uTraJDX.exe
  2⤵
  PID:580
- C:\Windows\System\kLrpibd.exe
  C:\Windows\System\kLrpibd.exe
  2⤵
  PID:2540
- C:\Windows\System\fikytvs.exe
  C:\Windows\System\fikytvs.exe
  2⤵
  PID:2560
- C:\Windows\System\qKRGYsq.exe
  C:\Windows\System\qKRGYsq.exe
  2⤵
  PID:2204
- C:\Windows\System\mFjJoQA.exe
  C:\Windows\System\mFjJoQA.exe
  2⤵
  PID:2136
- C:\Windows\System\hoiyBgA.exe
  C:\Windows\System\hoiyBgA.exe
  2⤵
  PID:2904
- C:\Windows\System\DqnddTf.exe
  C:\Windows\System\DqnddTf.exe
  2⤵
  PID:3056
- C:\Windows\System\TGdIlMy.exe
  C:\Windows\System\TGdIlMy.exe
  2⤵
  PID:1516
- C:\Windows\System\YngGHTw.exe
  C:\Windows\System\YngGHTw.exe
  2⤵
  PID:2648
- C:\Windows\System\SoujsUP.exe
  C:\Windows\System\SoujsUP.exe
  2⤵
  PID:2716
- C:\Windows\System\msKXXJG.exe
  C:\Windows\System\msKXXJG.exe
  2⤵
  PID:2760
- C:\Windows\System\RVbfvPk.exe
  C:\Windows\System\RVbfvPk.exe
  2⤵
  PID:2392
- C:\Windows\System\SdoUotQ.exe
  C:\Windows\System\SdoUotQ.exe
  2⤵
  PID:2132
- C:\Windows\System\tDvQZvs.exe
  C:\Windows\System\tDvQZvs.exe
  2⤵
  PID:2412
- C:\Windows\System\qCSlpqg.exe
  C:\Windows\System\qCSlpqg.exe
  2⤵
  PID:2908
- C:\Windows\System\oVnaVUs.exe
  C:\Windows\System\oVnaVUs.exe
  2⤵
  PID:2040
- C:\Windows\System\PUyNhPq.exe
  C:\Windows\System\PUyNhPq.exe
  2⤵
  PID:1832
- C:\Windows\System\dvdghJQ.exe
  C:\Windows\System\dvdghJQ.exe
  2⤵
  PID:1276
- C:\Windows\System\wxYSPym.exe
  C:\Windows\System\wxYSPym.exe
  2⤵
  PID:2748
- C:\Windows\System\fcrKqJn.exe
  C:\Windows\System\fcrKqJn.exe
  2⤵
  PID:2216
- C:\Windows\System\AuEjTmU.exe
  C:\Windows\System\AuEjTmU.exe
  2⤵
  PID:2124
- C:\Windows\System\AbRxAOD.exe
  C:\Windows\System\AbRxAOD.exe
  2⤵
  PID:2348
- C:\Windows\System\ewqdzeA.exe
  C:\Windows\System\ewqdzeA.exe
  2⤵
  PID:3080
- C:\Windows\System\CJNlhYj.exe
  C:\Windows\System\CJNlhYj.exe
  2⤵
  PID:3096
- C:\Windows\System\sutSrte.exe
  C:\Windows\System\sutSrte.exe
  2⤵
  PID:3112
- C:\Windows\System\hmLveOA.exe
  C:\Windows\System\hmLveOA.exe
  2⤵
  PID:3132
- C:\Windows\System\SWJUMIu.exe
  C:\Windows\System\SWJUMIu.exe
  2⤵
  PID:3148
- C:\Windows\System\ETPpTaM.exe
  C:\Windows\System\ETPpTaM.exe
  2⤵
  PID:3164
- C:\Windows\System\QAidtph.exe
  C:\Windows\System\QAidtph.exe
  2⤵
  PID:3180
- C:\Windows\System\ctKJTuF.exe
  C:\Windows\System\ctKJTuF.exe
  2⤵
  PID:3200
- C:\Windows\System\cQDIupp.exe
  C:\Windows\System\cQDIupp.exe
  2⤵
  PID:3216
- C:\Windows\System\MdtFaeo.exe
  C:\Windows\System\MdtFaeo.exe
  2⤵
  PID:3232
- C:\Windows\System\SXFRDQC.exe
  C:\Windows\System\SXFRDQC.exe
  2⤵
  PID:3248
- C:\Windows\System\mBFaGJs.exe
  C:\Windows\System\mBFaGJs.exe
  2⤵
  PID:3268
- C:\Windows\System\vViAqLu.exe
  C:\Windows\System\vViAqLu.exe
  2⤵
  PID:3284
- C:\Windows\System\NHEQaQs.exe
  C:\Windows\System\NHEQaQs.exe
  2⤵
  PID:3300
- C:\Windows\System\LVMPzVX.exe
  C:\Windows\System\LVMPzVX.exe
  2⤵
  PID:3316
- C:\Windows\System\DkRBixQ.exe
  C:\Windows\System\DkRBixQ.exe
  2⤵
  PID:3332
- C:\Windows\System\OlFIHcS.exe
  C:\Windows\System\OlFIHcS.exe
  2⤵
  PID:3352
- C:\Windows\System\cNgsLvx.exe
  C:\Windows\System\cNgsLvx.exe
  2⤵
  PID:3368
- C:\Windows\System\fTsFRrR.exe
  C:\Windows\System\fTsFRrR.exe
  2⤵
  PID:3384
- C:\Windows\System\DLGoQVF.exe
  C:\Windows\System\DLGoQVF.exe
  2⤵
  PID:3456
- C:\Windows\System\ZeQCoXL.exe
  C:\Windows\System\ZeQCoXL.exe
  2⤵
  PID:3500
- C:\Windows\System\FNftxTt.exe
  C:\Windows\System\FNftxTt.exe
  2⤵
  PID:3520
- C:\Windows\System\EUFAMir.exe
  C:\Windows\System\EUFAMir.exe
  2⤵
  PID:3536
- C:\Windows\System\lFEOjlU.exe
  C:\Windows\System\lFEOjlU.exe
  2⤵
  PID:3552
- C:\Windows\System\UeEdKUn.exe
  C:\Windows\System\UeEdKUn.exe
  2⤵
  PID:3568
- C:\Windows\System\EYvkaZK.exe
  C:\Windows\System\EYvkaZK.exe
  2⤵
  PID:3584
- C:\Windows\System\JjcKAcz.exe
  C:\Windows\System\JjcKAcz.exe
  2⤵
  PID:3600
- C:\Windows\System\wNYTSXF.exe
  C:\Windows\System\wNYTSXF.exe
  2⤵
  PID:3616
- C:\Windows\System\ITGJzLh.exe
  C:\Windows\System\ITGJzLh.exe
  2⤵
  PID:3636
- C:\Windows\System\mfGBQXC.exe
  C:\Windows\System\mfGBQXC.exe
  2⤵
  PID:3652
- C:\Windows\System\NmkmOFU.exe
  C:\Windows\System\NmkmOFU.exe
  2⤵
  PID:3668
- C:\Windows\System\rNdCWDV.exe
  C:\Windows\System\rNdCWDV.exe
  2⤵
  PID:3688
- C:\Windows\System\QlZqLph.exe
  C:\Windows\System\QlZqLph.exe
  2⤵
  PID:3780
- C:\Windows\System\uglKJma.exe
  C:\Windows\System\uglKJma.exe
  2⤵
  PID:3804
- C:\Windows\System\YKWKVDN.exe
  C:\Windows\System\YKWKVDN.exe
  2⤵
  PID:3852
- C:\Windows\System\CqsJdmg.exe
  C:\Windows\System\CqsJdmg.exe
  2⤵
  PID:3876
- C:\Windows\System\AjxVogS.exe
  C:\Windows\System\AjxVogS.exe
  2⤵
  PID:3896
- C:\Windows\System\KCbXyKL.exe
  C:\Windows\System\KCbXyKL.exe
  2⤵
  PID:3916
- C:\Windows\System\UTCuDsO.exe
  C:\Windows\System\UTCuDsO.exe
  2⤵
  PID:3932
- C:\Windows\System\bzpLbPA.exe
  C:\Windows\System\bzpLbPA.exe
  2⤵
  PID:3948
- C:\Windows\System\qkWGWjy.exe
  C:\Windows\System\qkWGWjy.exe
  2⤵
  PID:3968
- C:\Windows\System\LJwxxKj.exe
  C:\Windows\System\LJwxxKj.exe
  2⤵
  PID:3996
- C:\Windows\System\JHPapRw.exe
  C:\Windows\System\JHPapRw.exe
  2⤵
  PID:4012
- C:\Windows\System\fJwrcnW.exe
  C:\Windows\System\fJwrcnW.exe
  2⤵
  PID:4028
- C:\Windows\System\svcKLHb.exe
  C:\Windows\System\svcKLHb.exe
  2⤵
  PID:4056
- C:\Windows\System\kYtTHOO.exe
  C:\Windows\System\kYtTHOO.exe
  2⤵
  PID:4072
- C:\Windows\System\UdyuqOh.exe
  C:\Windows\System\UdyuqOh.exe
  2⤵
  PID:4092
- C:\Windows\System\RNYMaAZ.exe
  C:\Windows\System\RNYMaAZ.exe
  2⤵
  PID:2580
- C:\Windows\System\TOoCydB.exe
  C:\Windows\System\TOoCydB.exe
  2⤵
  PID:2932
- C:\Windows\System\BnjtDCQ.exe
  C:\Windows\System\BnjtDCQ.exe
  2⤵
  PID:2592
- C:\Windows\System\PaxvayJ.exe
  C:\Windows\System\PaxvayJ.exe
  2⤵
  PID:848
- C:\Windows\System\EqZomDc.exe
  C:\Windows\System\EqZomDc.exe
  2⤵
  PID:2012
- C:\Windows\System\fMXqzaX.exe
  C:\Windows\System\fMXqzaX.exe
  2⤵
  PID:2160
- C:\Windows\System\gJbnUPB.exe
  C:\Windows\System\gJbnUPB.exe
  2⤵
  PID:3140
- C:\Windows\System\SyNMnzg.exe
  C:\Windows\System\SyNMnzg.exe
  2⤵
  PID:2696
- C:\Windows\System\XxZwFCX.exe
  C:\Windows\System\XxZwFCX.exe
  2⤵
  PID:3156
- C:\Windows\System\nQAqGnv.exe
  C:\Windows\System\nQAqGnv.exe
  2⤵
  PID:3208
- C:\Windows\System\gVDxxoZ.exe
  C:\Windows\System\gVDxxoZ.exe
  2⤵
  PID:3276
- C:\Windows\System\kPFRJYO.exe
  C:\Windows\System\kPFRJYO.exe
  2⤵
  PID:3348
- C:\Windows\System\tvTrWtp.exe
  C:\Windows\System\tvTrWtp.exe
  2⤵
  PID:3228
- C:\Windows\System\gByammx.exe
  C:\Windows\System\gByammx.exe
  2⤵
  PID:2556
- C:\Windows\System\zhJzfMH.exe
  C:\Windows\System\zhJzfMH.exe
  2⤵
  PID:3464
- C:\Windows\System\GBRErgX.exe
  C:\Windows\System\GBRErgX.exe
  2⤵
  PID:3480
- C:\Windows\System\ZvfAFBj.exe
  C:\Windows\System\ZvfAFBj.exe
  2⤵
  PID:3324
- C:\Windows\System\jXzSvMD.exe
  C:\Windows\System\jXzSvMD.exe
  2⤵
  PID:3364
- C:\Windows\System\AYJJKxY.exe
  C:\Windows\System\AYJJKxY.exe
  2⤵
  PID:3560
- C:\Windows\System\UPJJKPQ.exe
  C:\Windows\System\UPJJKPQ.exe
  2⤵
  PID:3628
- C:\Windows\System\WwCNoFr.exe
  C:\Windows\System\WwCNoFr.exe
  2⤵
  PID:3696
- C:\Windows\System\yKUMmqL.exe
  C:\Windows\System\yKUMmqL.exe
  2⤵
  PID:3716
- C:\Windows\System\dCyNMtL.exe
  C:\Windows\System\dCyNMtL.exe
  2⤵
  PID:3732
- C:\Windows\System\TUkJZgB.exe
  C:\Windows\System\TUkJZgB.exe
  2⤵
  PID:3436
- C:\Windows\System\yXyWkhj.exe
  C:\Windows\System\yXyWkhj.exe
  2⤵
  PID:3740
- C:\Windows\System\WGgCvPi.exe
  C:\Windows\System\WGgCvPi.exe
  2⤵
  PID:3756
- C:\Windows\System\HSWqYHE.exe
  C:\Windows\System\HSWqYHE.exe
  2⤵
  PID:3772
- C:\Windows\System\LaWLJeH.exe
  C:\Windows\System\LaWLJeH.exe
  2⤵
  PID:788
- C:\Windows\System\MTgvQvE.exe
  C:\Windows\System\MTgvQvE.exe
  2⤵
  PID:3192
- C:\Windows\System\sILzIqz.exe
  C:\Windows\System\sILzIqz.exe
  2⤵
  PID:3824
- C:\Windows\System\PZNEvNl.exe
  C:\Windows\System\PZNEvNl.exe
  2⤵
  PID:3428
- C:\Windows\System\nRqCIkU.exe
  C:\Windows\System\nRqCIkU.exe
  2⤵
  PID:2660
- C:\Windows\System\nAJiWNU.exe
  C:\Windows\System\nAJiWNU.exe
  2⤵
  PID:3512
- C:\Windows\System\siRTrTI.exe
  C:\Windows\System\siRTrTI.exe
  2⤵
  PID:3576
- C:\Windows\System\nojyLVM.exe
  C:\Windows\System\nojyLVM.exe
  2⤵
  PID:3644
- C:\Windows\System\ZEdgIJn.exe
  C:\Windows\System\ZEdgIJn.exe
  2⤵
  PID:3676
- C:\Windows\System\ivvdnrQ.exe
  C:\Windows\System\ivvdnrQ.exe
  2⤵
  PID:1696
- C:\Windows\System\HdPmngj.exe
  C:\Windows\System\HdPmngj.exe
  2⤵
  PID:2928
- C:\Windows\System\KMwKtgU.exe
  C:\Windows\System\KMwKtgU.exe
  2⤵
  PID:3816
- C:\Windows\System\gPrxVHR.exe
  C:\Windows\System\gPrxVHR.exe
  2⤵
  PID:3872
- C:\Windows\System\EIaKjeg.exe
  C:\Windows\System\EIaKjeg.exe
  2⤵
  PID:2244
- C:\Windows\System\KCaTxZU.exe
  C:\Windows\System\KCaTxZU.exe
  2⤵
  PID:3868
- C:\Windows\System\IESByOr.exe
  C:\Windows\System\IESByOr.exe
  2⤵
  PID:3888
- C:\Windows\System\UtabOJr.exe
  C:\Windows\System\UtabOJr.exe
  2⤵
  PID:1064
- C:\Windows\System\emqgaQv.exe
  C:\Windows\System\emqgaQv.exe
  2⤵
  PID:3924
- C:\Windows\System\AtElHSx.exe
  C:\Windows\System\AtElHSx.exe
  2⤵
  PID:3956
- C:\Windows\System\uegyecL.exe
  C:\Windows\System\uegyecL.exe
  2⤵
  PID:1136
- C:\Windows\System\qqsCpNu.exe
  C:\Windows\System\qqsCpNu.exe
  2⤵
  PID:3992
- C:\Windows\System\CERuKGE.exe
  C:\Windows\System\CERuKGE.exe
  2⤵
  PID:2448
- C:\Windows\System\zyUuuUs.exe
  C:\Windows\System\zyUuuUs.exe
  2⤵
  PID:2456
- C:\Windows\System\sKZCbmZ.exe
  C:\Windows\System\sKZCbmZ.exe
  2⤵
  PID:4052
- C:\Windows\System\QZOhMsc.exe
  C:\Windows\System\QZOhMsc.exe
  2⤵
  PID:2944
- C:\Windows\System\Lzgkndk.exe
  C:\Windows\System\Lzgkndk.exe
  2⤵
  PID:3120
- C:\Windows\System\ereXJLi.exe
  C:\Windows\System\ereXJLi.exe
  2⤵
  PID:3196
- C:\Windows\System\YwQltSZ.exe
  C:\Windows\System\YwQltSZ.exe
  2⤵
  PID:3308
- C:\Windows\System\IZdmRvg.exe
  C:\Windows\System\IZdmRvg.exe
  2⤵
  PID:352
- C:\Windows\System\AHoocls.exe
  C:\Windows\System\AHoocls.exe
  2⤵
  PID:3224
- C:\Windows\System\lNMtBJl.exe
  C:\Windows\System\lNMtBJl.exe
  2⤵
  PID:2036
- C:\Windows\System\AzcNGtb.exe
  C:\Windows\System\AzcNGtb.exe
  2⤵
  PID:3468
- C:\Windows\System\YymNmoE.exe
  C:\Windows\System\YymNmoE.exe
  2⤵
  PID:3664
- C:\Windows\System\QvmXJSu.exe
  C:\Windows\System\QvmXJSu.exe
  2⤵
  PID:3360
- C:\Windows\System\dzhVKgh.exe
  C:\Windows\System\dzhVKgh.exe
  2⤵
  PID:3624
- C:\Windows\System\JsCOpCN.exe
  C:\Windows\System\JsCOpCN.exe
  2⤵
  PID:2488
- C:\Windows\System\PurgGHW.exe
  C:\Windows\System\PurgGHW.exe
  2⤵
  PID:692
- C:\Windows\System\jVdusBV.exe
  C:\Windows\System\jVdusBV.exe
  2⤵
  PID:3424
- C:\Windows\System\FjEsyFT.exe
  C:\Windows\System\FjEsyFT.exe
  2⤵
  PID:1264
- C:\Windows\System\MEjnxXZ.exe
  C:\Windows\System\MEjnxXZ.exe
  2⤵
  PID:3508
- C:\Windows\System\elFeDXn.exe
  C:\Windows\System\elFeDXn.exe
  2⤵
  PID:3848
- C:\Windows\System\AQTvmAh.exe
  C:\Windows\System\AQTvmAh.exe
  2⤵
  PID:3160
- C:\Windows\System\XCsoQvC.exe
  C:\Windows\System\XCsoQvC.exe
  2⤵
  PID:3960
- C:\Windows\System\DQSqiks.exe
  C:\Windows\System\DQSqiks.exe
  2⤵
  PID:4048
- C:\Windows\System\rjneFmI.exe
  C:\Windows\System\rjneFmI.exe
  2⤵
  PID:2408
- C:\Windows\System\ZmHMymw.exe
  C:\Windows\System\ZmHMymw.exe
  2⤵
  PID:3844
- C:\Windows\System\VjzMDbz.exe
  C:\Windows\System\VjzMDbz.exe
  2⤵
  PID:4008
- C:\Windows\System\qSllRfF.exe
  C:\Windows\System\qSllRfF.exe
  2⤵
  PID:3812
- C:\Windows\System\AoFIzll.exe
  C:\Windows\System\AoFIzll.exe
  2⤵
  PID:3548
- C:\Windows\System\NoAvOvH.exe
  C:\Windows\System\NoAvOvH.exe
  2⤵
  PID:2792
- C:\Windows\System\goUhWzG.exe
  C:\Windows\System\goUhWzG.exe
  2⤵
  PID:3904
- C:\Windows\System\nBHwmTm.exe
  C:\Windows\System\nBHwmTm.exe
  2⤵
  PID:3940
- C:\Windows\System\BdlryMt.exe
  C:\Windows\System\BdlryMt.exe
  2⤵
  PID:4064
- C:\Windows\System\hRECEwR.exe
  C:\Windows\System\hRECEwR.exe
  2⤵
  PID:4088
- C:\Windows\System\QgBQusi.exe
  C:\Windows\System\QgBQusi.exe
  2⤵
  PID:1812
- C:\Windows\System\iEOiiJh.exe
  C:\Windows\System\iEOiiJh.exe
  2⤵
  PID:2080
- C:\Windows\System\cnpjlRs.exe
  C:\Windows\System\cnpjlRs.exe
  2⤵
  PID:1856
- C:\Windows\System\rKHZobd.exe
  C:\Windows\System\rKHZobd.exe
  2⤵
  PID:2424
- C:\Windows\System\GxzEGFT.exe
  C:\Windows\System\GxzEGFT.exe
  2⤵
  PID:3488
- C:\Windows\System\ZEOIadU.exe
  C:\Windows\System\ZEOIadU.exe
  2⤵
  PID:3264
- C:\Windows\System\MDIKpTl.exe
  C:\Windows\System\MDIKpTl.exe
  2⤵
  PID:1712
- C:\Windows\System\aPxLHJA.exe
  C:\Windows\System\aPxLHJA.exe
  2⤵
  PID:2824
- C:\Windows\System\KZkebAj.exe
  C:\Windows\System\KZkebAj.exe
  2⤵
  PID:3380
- C:\Windows\System\bcxZJAI.exe
  C:\Windows\System\bcxZJAI.exe
  2⤵
  PID:4112
- C:\Windows\System\fYzoNNu.exe
  C:\Windows\System\fYzoNNu.exe
  2⤵
  PID:4132
- C:\Windows\System\TJBupHB.exe
  C:\Windows\System\TJBupHB.exe
  2⤵
  PID:4148
- C:\Windows\System\QUcOkZe.exe
  C:\Windows\System\QUcOkZe.exe
  2⤵
  PID:4164
- C:\Windows\System\nWOvNLN.exe
  C:\Windows\System\nWOvNLN.exe
  2⤵
  PID:4184
- C:\Windows\System\ECzLMya.exe
  C:\Windows\System\ECzLMya.exe
  2⤵
  PID:4200
- C:\Windows\System\TjsOeGD.exe
  C:\Windows\System\TjsOeGD.exe
  2⤵
  PID:4216
- C:\Windows\System\sXYgXVz.exe
  C:\Windows\System\sXYgXVz.exe
  2⤵
  PID:4232
- C:\Windows\System\OMRBOFf.exe
  C:\Windows\System\OMRBOFf.exe
  2⤵
  PID:4248
- C:\Windows\System\TQyQtTW.exe
  C:\Windows\System\TQyQtTW.exe
  2⤵
  PID:4264
- C:\Windows\System\vEZRxoL.exe
  C:\Windows\System\vEZRxoL.exe
  2⤵
  PID:4284
- C:\Windows\System\lmvCnGJ.exe
  C:\Windows\System\lmvCnGJ.exe
  2⤵
  PID:4300
- C:\Windows\System\ufiANZi.exe
  C:\Windows\System\ufiANZi.exe
  2⤵
  PID:4316
- C:\Windows\System\yzuAwSD.exe
  C:\Windows\System\yzuAwSD.exe
  2⤵
  PID:4332
- C:\Windows\System\ZeomxMX.exe
  C:\Windows\System\ZeomxMX.exe
  2⤵
  PID:4348
- C:\Windows\System\FLzaDZq.exe
  C:\Windows\System\FLzaDZq.exe
  2⤵
  PID:4364
- C:\Windows\System\sNvgGCg.exe
  C:\Windows\System\sNvgGCg.exe
  2⤵
  PID:4380
- C:\Windows\System\FJLIGDw.exe
  C:\Windows\System\FJLIGDw.exe
  2⤵
  PID:4396
- C:\Windows\System\VzaXevo.exe
  C:\Windows\System\VzaXevo.exe
  2⤵
  PID:4416
- C:\Windows\System\DJmAotM.exe
  C:\Windows\System\DJmAotM.exe
  2⤵
  PID:4432
- C:\Windows\System\dmaOVib.exe
  C:\Windows\System\dmaOVib.exe
  2⤵
  PID:4448
- C:\Windows\System\EuTDEGM.exe
  C:\Windows\System\EuTDEGM.exe
  2⤵
  PID:4464
- C:\Windows\System\vKcyvSd.exe
  C:\Windows\System\vKcyvSd.exe
  2⤵
  PID:4480
- C:\Windows\System\nyZsBVb.exe
  C:\Windows\System\nyZsBVb.exe
  2⤵
  PID:4496
- C:\Windows\System\OcoNRNN.exe
  C:\Windows\System\OcoNRNN.exe
  2⤵
  PID:4516
- C:\Windows\System\HeJEkYN.exe
  C:\Windows\System\HeJEkYN.exe
  2⤵
  PID:4532
- C:\Windows\System\ZPClRGt.exe
  C:\Windows\System\ZPClRGt.exe
  2⤵
  PID:4548
- C:\Windows\System\bBbpfSt.exe
  C:\Windows\System\bBbpfSt.exe
  2⤵
  PID:4564
- C:\Windows\System\GleqSqZ.exe
  C:\Windows\System\GleqSqZ.exe
  2⤵
  PID:4764
- C:\Windows\System\ivXQyZi.exe
  C:\Windows\System\ivXQyZi.exe
  2⤵
  PID:4788
- C:\Windows\System\gwvUPvJ.exe
  C:\Windows\System\gwvUPvJ.exe
  2⤵
  PID:4808
- C:\Windows\System\paQtWFU.exe
  C:\Windows\System\paQtWFU.exe
  2⤵
  PID:4824
- C:\Windows\System\TtNObTb.exe
  C:\Windows\System\TtNObTb.exe
  2⤵
  PID:4840
- C:\Windows\System\VvFogfP.exe
  C:\Windows\System\VvFogfP.exe
  2⤵
  PID:4856
- C:\Windows\System\pGCkiPr.exe
  C:\Windows\System\pGCkiPr.exe
  2⤵
  PID:4872
- C:\Windows\System\JRyruhp.exe
  C:\Windows\System\JRyruhp.exe
  2⤵
  PID:4888
- C:\Windows\System\hWfmztm.exe
  C:\Windows\System\hWfmztm.exe
  2⤵
  PID:4904
- C:\Windows\System\vXSYtqY.exe
  C:\Windows\System\vXSYtqY.exe
  2⤵
  PID:4920
- C:\Windows\System\EvzUgSi.exe
  C:\Windows\System\EvzUgSi.exe
  2⤵
  PID:4936
- C:\Windows\System\DpKIeYy.exe
  C:\Windows\System\DpKIeYy.exe
  2⤵
  PID:4952
- C:\Windows\System\kGdXqvr.exe
  C:\Windows\System\kGdXqvr.exe
  2⤵
  PID:4968
- C:\Windows\System\raOyAAs.exe
  C:\Windows\System\raOyAAs.exe
  2⤵
  PID:4984
- C:\Windows\System\mHObiUK.exe
  C:\Windows\System\mHObiUK.exe
  2⤵
  PID:5004
- C:\Windows\System\ubmevpT.exe
  C:\Windows\System\ubmevpT.exe
  2⤵
  PID:5020
- C:\Windows\System\JtyetBs.exe
  C:\Windows\System\JtyetBs.exe
  2⤵
  PID:5036
- C:\Windows\System\WqgOKlQ.exe
  C:\Windows\System\WqgOKlQ.exe
  2⤵
  PID:5052
- C:\Windows\System\iltrwij.exe
  C:\Windows\System\iltrwij.exe
  2⤵
  PID:5068
- C:\Windows\System\luZUbKW.exe
  C:\Windows\System\luZUbKW.exe
  2⤵
  PID:5084
- C:\Windows\System\RzWnIAe.exe
  C:\Windows\System\RzWnIAe.exe
  2⤵
  PID:5100
- C:\Windows\System\jwsnVUa.exe
  C:\Windows\System\jwsnVUa.exe
  2⤵
  PID:5116
- C:\Windows\System\nCvAxIc.exe
  C:\Windows\System\nCvAxIc.exe
  2⤵
  PID:3660
- C:\Windows\System\OSelLMy.exe
  C:\Windows\System\OSelLMy.exe
  2⤵
  PID:3416
- C:\Windows\System\KPJEpfG.exe
  C:\Windows\System\KPJEpfG.exe
  2⤵
  PID:2416
- C:\Windows\System\KKrvwvP.exe
  C:\Windows\System\KKrvwvP.exe
  2⤵
  PID:3068
- C:\Windows\System\YaesXEx.exe
  C:\Windows\System\YaesXEx.exe
  2⤵
  PID:3012
- C:\Windows\System\DBNtsnF.exe
  C:\Windows\System\DBNtsnF.exe
  2⤵
  PID:3752
- C:\Windows\System\xUumkbT.exe
  C:\Windows\System\xUumkbT.exe
  2⤵
  PID:3516
- C:\Windows\System\umECWwa.exe
  C:\Windows\System\umECWwa.exe
  2⤵
  PID:4244
- C:\Windows\System\tqCjPnA.exe
  C:\Windows\System\tqCjPnA.exe
  2⤵
  PID:4172
- C:\Windows\System\ZWeAvcZ.exe
  C:\Windows\System\ZWeAvcZ.exe
  2⤵
  PID:4224
- C:\Windows\System\kQifCVU.exe
  C:\Windows\System\kQifCVU.exe
  2⤵
  PID:4156
- C:\Windows\System\qYSVgcp.exe
  C:\Windows\System\qYSVgcp.exe
  2⤵
  PID:4196
- C:\Windows\System\eykzqyz.exe
  C:\Windows\System\eykzqyz.exe
  2⤵
  PID:4328
- C:\Windows\System\qQxXGrx.exe
  C:\Windows\System\qQxXGrx.exe
  2⤵
  PID:4208
- C:\Windows\System\IyFZtmc.exe
  C:\Windows\System\IyFZtmc.exe
  2⤵
  PID:4476
- C:\Windows\System\qJBlVpf.exe
  C:\Windows\System\qJBlVpf.exe
  2⤵
  PID:4460
- C:\Windows\System\KMBqplt.exe
  C:\Windows\System\KMBqplt.exe
  2⤵
  PID:4524
- C:\Windows\System\TwpwYoK.exe
  C:\Windows\System\TwpwYoK.exe
  2⤵
  PID:4540
- C:\Windows\System\XCTmblT.exe
  C:\Windows\System\XCTmblT.exe
  2⤵
  PID:4576
- C:\Windows\System\zQFijPr.exe
  C:\Windows\System\zQFijPr.exe
  2⤵
  PID:4628
- C:\Windows\System\ORMJovH.exe
  C:\Windows\System\ORMJovH.exe
  2⤵
  PID:4660
- C:\Windows\System\RJZfGip.exe
  C:\Windows\System\RJZfGip.exe
  2⤵
  PID:4668
- C:\Windows\System\rswNpwb.exe
  C:\Windows\System\rswNpwb.exe
  2⤵
  PID:4684
- C:\Windows\System\teWHHXU.exe
  C:\Windows\System\teWHHXU.exe
  2⤵
  PID:2300
- C:\Windows\System\NVlCWXW.exe
  C:\Windows\System\NVlCWXW.exe
  2⤵
  PID:4724
- C:\Windows\System\JWSishZ.exe
  C:\Windows\System\JWSishZ.exe
  2⤵
  PID:2736
- C:\Windows\System\eAMhTKq.exe
  C:\Windows\System\eAMhTKq.exe
  2⤵
  PID:4736
- C:\Windows\System\VTAEXnC.exe
  C:\Windows\System\VTAEXnC.exe
  2⤵
  PID:2700
- C:\Windows\System\evblnzT.exe
  C:\Windows\System\evblnzT.exe
  2⤵
  PID:4852
- C:\Windows\System\RFKflnj.exe
  C:\Windows\System\RFKflnj.exe
  2⤵
  PID:4916
- C:\Windows\System\ybmlthx.exe
  C:\Windows\System\ybmlthx.exe
  2⤵
  PID:4980
- C:\Windows\System\GBFNXCo.exe
  C:\Windows\System\GBFNXCo.exe
  2⤵
  PID:5076
- C:\Windows\System\hxwfYyS.exe
  C:\Windows\System\hxwfYyS.exe
  2⤵
  PID:3432
- C:\Windows\System\hIEDVUM.exe
  C:\Windows\System\hIEDVUM.exe
  2⤵
  PID:5044
- C:\Windows\System\cWEmdME.exe
  C:\Windows\System\cWEmdME.exe
  2⤵
  PID:2772
- C:\Windows\System\HvIPpbf.exe
  C:\Windows\System\HvIPpbf.exe
  2⤵
  PID:4080
- C:\Windows\System\gKsaZrc.exe
  C:\Windows\System\gKsaZrc.exe
  2⤵
  PID:3528
- C:\Windows\System\VstDPxa.exe
  C:\Windows\System\VstDPxa.exe
  2⤵
  PID:5064
- C:\Windows\System\WGNdJrc.exe
  C:\Windows\System\WGNdJrc.exe
  2⤵
  PID:5028
- C:\Windows\System\papmOGk.exe
  C:\Windows\System\papmOGk.exe
  2⤵
  PID:4932
- C:\Windows\System\AZabCui.exe
  C:\Windows\System\AZabCui.exe
  2⤵
  PID:4180
- C:\Windows\System\DehqKNO.exe
  C:\Windows\System\DehqKNO.exe
  2⤵
  PID:3596
- C:\Windows\System\zhAXIOb.exe
  C:\Windows\System\zhAXIOb.exe
  2⤵
  PID:3592
- C:\Windows\System\gKSUWJw.exe
  C:\Windows\System\gKSUWJw.exe
  2⤵
  PID:3532
- C:\Windows\System\QRzwnGx.exe
  C:\Windows\System\QRzwnGx.exe
  2⤵
  PID:1808
- C:\Windows\System\CgLwHAY.exe
  C:\Windows\System\CgLwHAY.exe
  2⤵
  PID:2728
- C:\Windows\System\PANViLX.exe
  C:\Windows\System\PANViLX.exe
  2⤵
  PID:2184
- C:\Windows\System\RXtfojv.exe
  C:\Windows\System\RXtfojv.exe
  2⤵
  PID:3092
- C:\Windows\System\TxtvRvI.exe
  C:\Windows\System\TxtvRvI.exe
  2⤵
  PID:4388
- C:\Windows\System\kmPNDjv.exe
  C:\Windows\System\kmPNDjv.exe
  2⤵
  PID:4140
- C:\Windows\System\YHgpWOl.exe
  C:\Windows\System\YHgpWOl.exe
  2⤵
  PID:4312
- C:\Windows\System\oVLCckJ.exe
  C:\Windows\System\oVLCckJ.exe
  2⤵
  PID:4192
- C:\Windows\System\dYctwDm.exe
  C:\Windows\System\dYctwDm.exe
  2⤵
  PID:4324
- C:\Windows\System\HgeigCA.exe
  C:\Windows\System\HgeigCA.exe
  2⤵
  PID:4260
- C:\Windows\System\yhVMWxs.exe
  C:\Windows\System\yhVMWxs.exe
  2⤵
  PID:4404
- C:\Windows\System\MxDVHlr.exe
  C:\Windows\System\MxDVHlr.exe
  2⤵
  PID:4444
- C:\Windows\System\IfYZESH.exe
  C:\Windows\System\IfYZESH.exe
  2⤵
  PID:4508
- C:\Windows\System\QejLCAb.exe
  C:\Windows\System\QejLCAb.exe
  2⤵
  PID:4572
- C:\Windows\System\JyuMlTb.exe
  C:\Windows\System\JyuMlTb.exe
  2⤵
  PID:4588
- C:\Windows\System\FEvvmmc.exe
  C:\Windows\System\FEvvmmc.exe
  2⤵
  PID:4624
- C:\Windows\System\zXMaLfN.exe
  C:\Windows\System\zXMaLfN.exe
  2⤵
  PID:4640
- C:\Windows\System\JSBGJne.exe
  C:\Windows\System\JSBGJne.exe
  2⤵
  PID:4672
- C:\Windows\System\JBEOjEH.exe
  C:\Windows\System\JBEOjEH.exe
  2⤵
  PID:4704
- C:\Windows\System\iDgugqk.exe
  C:\Windows\System\iDgugqk.exe
  2⤵
  PID:4696
- C:\Windows\System\RlwoTQu.exe
  C:\Windows\System\RlwoTQu.exe
  2⤵
  PID:4740
- C:\Windows\System\EfUUemX.exe
  C:\Windows\System\EfUUemX.exe
  2⤵
  PID:4744
- C:\Windows\System\HovgyYk.exe
  C:\Windows\System\HovgyYk.exe
  2⤵
  PID:4848
- C:\Windows\System\HLKlNde.exe
  C:\Windows\System\HLKlNde.exe
  2⤵
  PID:5112
- C:\Windows\System\vqDZAFz.exe
  C:\Windows\System\vqDZAFz.exe
  2⤵
  PID:3820
- C:\Windows\System\LDMbxMN.exe
  C:\Windows\System\LDMbxMN.exe
  2⤵
  PID:4784
- C:\Windows\System\GdUXuIB.exe
  C:\Windows\System\GdUXuIB.exe
  2⤵
  PID:4912
- C:\Windows\System\bnQTcAW.exe
  C:\Windows\System\bnQTcAW.exe
  2⤵
  PID:3648
- C:\Windows\System\dtjaBuz.exe
  C:\Windows\System\dtjaBuz.exe
  2⤵
  PID:4868
- C:\Windows\System\rKqbtMB.exe
  C:\Windows\System\rKqbtMB.exe
  2⤵
  PID:4896
- C:\Windows\System\nneCaGF.exe
  C:\Windows\System\nneCaGF.exe
  2⤵
  PID:5092
- C:\Windows\System\kpqFCQO.exe
  C:\Windows\System\kpqFCQO.exe
  2⤵
  PID:3048
- C:\Windows\System\pEEzKzE.exe
  C:\Windows\System\pEEzKzE.exe
  2⤵
  PID:1028
- C:\Windows\System\AQJSpRq.exe
  C:\Windows\System\AQJSpRq.exe
  2⤵
  PID:4120
- C:\Windows\System\HqcLMIU.exe
  C:\Windows\System\HqcLMIU.exe
  2⤵
  PID:4356
- C:\Windows\System\gsiaTJe.exe
  C:\Windows\System\gsiaTJe.exe
  2⤵
  PID:4456
- C:\Windows\System\jgmocPO.exe
  C:\Windows\System\jgmocPO.exe
  2⤵
  PID:4652
- C:\Windows\System\iuuiiwR.exe
  C:\Windows\System\iuuiiwR.exe
  2⤵
  PID:4700
- C:\Windows\System\dVgBHYX.exe
  C:\Windows\System\dVgBHYX.exe
  2⤵
  PID:4816
- C:\Windows\System\jaRnZuF.exe
  C:\Windows\System\jaRnZuF.exe
  2⤵
  PID:1084
- C:\Windows\System\UxIRjVK.exe
  C:\Windows\System\UxIRjVK.exe
  2⤵
  PID:5124
- C:\Windows\System\cQgYABr.exe
  C:\Windows\System\cQgYABr.exe
  2⤵
  PID:5140
- C:\Windows\System\FNVDCuf.exe
  C:\Windows\System\FNVDCuf.exe
  2⤵
  PID:5156
- C:\Windows\System\hHLWDvI.exe
  C:\Windows\System\hHLWDvI.exe
  2⤵
  PID:5172
- C:\Windows\System\XjcNuNZ.exe
  C:\Windows\System\XjcNuNZ.exe
  2⤵
  PID:5188
- C:\Windows\System\hZplykU.exe
  C:\Windows\System\hZplykU.exe
  2⤵
  PID:5204
- C:\Windows\System\sXOxSAQ.exe
  C:\Windows\System\sXOxSAQ.exe
  2⤵
  PID:5220
- C:\Windows\System\Ndoyxos.exe
  C:\Windows\System\Ndoyxos.exe
  2⤵
  PID:5236
- C:\Windows\System\JShQrKS.exe
  C:\Windows\System\JShQrKS.exe
  2⤵
  PID:5256
- C:\Windows\System\mnLFRfZ.exe
  C:\Windows\System\mnLFRfZ.exe
  2⤵
  PID:5272
- C:\Windows\System\kljDGKm.exe
  C:\Windows\System\kljDGKm.exe
  2⤵
  PID:5288
- C:\Windows\System\yfuuhZa.exe
  C:\Windows\System\yfuuhZa.exe
  2⤵
  PID:5304
- C:\Windows\System\KswaaeI.exe
  C:\Windows\System\KswaaeI.exe
  2⤵
  PID:5320
- C:\Windows\System\iyOGdxa.exe
  C:\Windows\System\iyOGdxa.exe
  2⤵
  PID:5336
- C:\Windows\System\lwWWevL.exe
  C:\Windows\System\lwWWevL.exe
  2⤵
  PID:5360
- C:\Windows\System\vNLAqZt.exe
  C:\Windows\System\vNLAqZt.exe
  2⤵
  PID:5376
- C:\Windows\System\spMdwcd.exe
  C:\Windows\System\spMdwcd.exe
  2⤵
  PID:5392
- C:\Windows\System\PWiEUIa.exe
  C:\Windows\System\PWiEUIa.exe
  2⤵
  PID:5408
- C:\Windows\System\kpIzQDc.exe
  C:\Windows\System\kpIzQDc.exe
  2⤵
  PID:5424
- C:\Windows\System\SgNrgAt.exe
  C:\Windows\System\SgNrgAt.exe
  2⤵
  PID:5440
- C:\Windows\System\obAHaRT.exe
  C:\Windows\System\obAHaRT.exe
  2⤵
  PID:5460
- C:\Windows\System\HRWrblZ.exe
  C:\Windows\System\HRWrblZ.exe
  2⤵
  PID:5476
- C:\Windows\System\HHGUfQA.exe
  C:\Windows\System\HHGUfQA.exe
  2⤵
  PID:5492
- C:\Windows\System\ztvpmMD.exe
  C:\Windows\System\ztvpmMD.exe
  2⤵
  PID:5512
- C:\Windows\System\mwekQhw.exe
  C:\Windows\System\mwekQhw.exe
  2⤵
  PID:5528
- C:\Windows\System\pqDHflQ.exe
  C:\Windows\System\pqDHflQ.exe
  2⤵
  PID:5544
- C:\Windows\System\EzvCVCf.exe
  C:\Windows\System\EzvCVCf.exe
  2⤵
  PID:5560
- C:\Windows\System\pVpZwrB.exe
  C:\Windows\System\pVpZwrB.exe
  2⤵
  PID:5580
- C:\Windows\System\nlFYIxc.exe
  C:\Windows\System\nlFYIxc.exe
  2⤵
  PID:5596
- C:\Windows\System\CRFnVtT.exe
  C:\Windows\System\CRFnVtT.exe
  2⤵
  PID:5716
- C:\Windows\System\iDikTra.exe
  C:\Windows\System\iDikTra.exe
  2⤵
  PID:5792
- C:\Windows\System\CULZNJz.exe
  C:\Windows\System\CULZNJz.exe
  2⤵
  PID:5812
- C:\Windows\System\QcqfBqL.exe
  C:\Windows\System\QcqfBqL.exe
  2⤵
  PID:5828
- C:\Windows\System\wfcZuOm.exe
  C:\Windows\System\wfcZuOm.exe
  2⤵
  PID:5844
- C:\Windows\System\ApkfBmi.exe
  C:\Windows\System\ApkfBmi.exe
  2⤵
  PID:5860
- C:\Windows\System\ArQXbXU.exe
  C:\Windows\System\ArQXbXU.exe
  2⤵
  PID:5876
- C:\Windows\System\PHLtKjg.exe
  C:\Windows\System\PHLtKjg.exe
  2⤵
  PID:5896
- C:\Windows\System\pYpQzDU.exe
  C:\Windows\System\pYpQzDU.exe
  2⤵
  PID:5912
- C:\Windows\System\dAyXHqY.exe
  C:\Windows\System\dAyXHqY.exe
  2⤵
  PID:5928
- C:\Windows\System\SoYpqNp.exe
  C:\Windows\System\SoYpqNp.exe
  2⤵
  PID:5944
- C:\Windows\System\acuxrBV.exe
  C:\Windows\System\acuxrBV.exe
  2⤵
  PID:5960
- C:\Windows\System\riLpXHZ.exe
  C:\Windows\System\riLpXHZ.exe
  2⤵
  PID:5980
- C:\Windows\System\jwIvwTU.exe
  C:\Windows\System\jwIvwTU.exe
  2⤵
  PID:5996
- C:\Windows\System\TkYYlGl.exe
  C:\Windows\System\TkYYlGl.exe
  2⤵
  PID:6012
- C:\Windows\System\lcbxlqU.exe
  C:\Windows\System\lcbxlqU.exe
  2⤵
  PID:6056
- C:\Windows\System\RiWGFlC.exe
  C:\Windows\System\RiWGFlC.exe
  2⤵
  PID:6076
- C:\Windows\System\IvVQvZB.exe
  C:\Windows\System\IvVQvZB.exe
  2⤵
  PID:6092
- C:\Windows\System\CFABhVt.exe
  C:\Windows\System\CFABhVt.exe
  2⤵
  PID:6108
- C:\Windows\System\gslipbv.exe
  C:\Windows\System\gslipbv.exe
  2⤵
  PID:6124
- C:\Windows\System\MJcbCIY.exe
  C:\Windows\System\MJcbCIY.exe
  2⤵
  PID:1592
- C:\Windows\System\sbkRzHb.exe
  C:\Windows\System\sbkRzHb.exe
  2⤵
  PID:800
- C:\Windows\System\MncZDdp.exe
  C:\Windows\System\MncZDdp.exe
  2⤵
  PID:5148
- C:\Windows\System\COWzTEW.exe
  C:\Windows\System\COWzTEW.exe
  2⤵
  PID:4712
- C:\Windows\System\gtlOgNv.exe
  C:\Windows\System\gtlOgNv.exe
  2⤵
  PID:4212
- C:\Windows\System\NpGMcMp.exe
  C:\Windows\System\NpGMcMp.exe
  2⤵
  PID:5196
- C:\Windows\System\sLVkPqC.exe
  C:\Windows\System\sLVkPqC.exe
  2⤵
  PID:5264
- C:\Windows\System\ToXnABL.exe
  C:\Windows\System\ToXnABL.exe
  2⤵
  PID:5328
- C:\Windows\System\jFabbWI.exe
  C:\Windows\System\jFabbWI.exe
  2⤵
  PID:5400
- C:\Windows\System\ONdKGUk.exe
  C:\Windows\System\ONdKGUk.exe
  2⤵
  PID:5468
- C:\Windows\System\BicWOhA.exe
  C:\Windows\System\BicWOhA.exe
  2⤵
  PID:5508
- C:\Windows\System\dIevGvP.exe
  C:\Windows\System\dIevGvP.exe
  2⤵
  PID:4832
- C:\Windows\System\AvfUpBO.exe
  C:\Windows\System\AvfUpBO.exe
  2⤵
  PID:3492
- C:\Windows\System\bGdcIjB.exe
  C:\Windows\System\bGdcIjB.exe
  2⤵
  PID:3344
- C:\Windows\System\nBoxigD.exe
  C:\Windows\System\nBoxigD.exe
  2⤵
  PID:4344
- C:\Windows\System\FUInLwe.exe
  C:\Windows\System\FUInLwe.exe
  2⤵
  PID:3400
- C:\Windows\System\zwpmCKe.exe
  C:\Windows\System\zwpmCKe.exe
  2⤵
  PID:4620
- C:\Windows\System\MbxjLeT.exe
  C:\Windows\System\MbxjLeT.exe
  2⤵
  PID:4688
- C:\Windows\System\YyMwHbG.exe
  C:\Windows\System\YyMwHbG.exe
  2⤵
  PID:2072
- C:\Windows\System\jahllBs.exe
  C:\Windows\System\jahllBs.exe
  2⤵
  PID:4900
- C:\Windows\System\ACNgVzc.exe
  C:\Windows\System\ACNgVzc.exe
  2⤵
  PID:5108
- C:\Windows\System\BZsdBzE.exe
  C:\Windows\System\BZsdBzE.exe
  2⤵
  PID:5572
- C:\Windows\System\jCGhtfT.exe
  C:\Windows\System\jCGhtfT.exe
  2⤵
  PID:5180
- C:\Windows\System\YUYGQqm.exe
  C:\Windows\System\YUYGQqm.exe
  2⤵
  PID:5212
- C:\Windows\System\YlqRAeb.exe
  C:\Windows\System\YlqRAeb.exe
  2⤵
  PID:5280
- C:\Windows\System\wwjXnGz.exe
  C:\Windows\System\wwjXnGz.exe
  2⤵
  PID:5384
- C:\Windows\System\VvkGQBG.exe
  C:\Windows\System\VvkGQBG.exe
  2⤵
  PID:5484
- C:\Windows\System\tceifOa.exe
  C:\Windows\System\tceifOa.exe
  2⤵
  PID:5632
- C:\Windows\System\LOERBif.exe
  C:\Windows\System\LOERBif.exe
  2⤵
  PID:5356
- C:\Windows\System\qthhlHt.exe
  C:\Windows\System\qthhlHt.exe
  2⤵
  PID:5488
- C:\Windows\System\AfgmaPE.exe
  C:\Windows\System\AfgmaPE.exe
  2⤵
  PID:5592
- C:\Windows\System\nTAAAus.exe
  C:\Windows\System\nTAAAus.exe
  2⤵
  PID:5096
- C:\Windows\System\XYezwFV.exe
  C:\Windows\System\XYezwFV.exe
  2⤵
  PID:984
- C:\Windows\System\ClNiHao.exe
  C:\Windows\System\ClNiHao.exe
  2⤵
  PID:5648
- C:\Windows\System\iWVVMep.exe
  C:\Windows\System\iWVVMep.exe
  2⤵
  PID:5664
- C:\Windows\System\hmQplSE.exe
  C:\Windows\System\hmQplSE.exe
  2⤵
  PID:5728
- C:\Windows\System\dPkYoGe.exe
  C:\Windows\System\dPkYoGe.exe
  2⤵
  PID:5740
- C:\Windows\System\vAEIDWH.exe
  C:\Windows\System\vAEIDWH.exe
  2⤵
  PID:5756
- C:\Windows\System\MVHgRCN.exe
  C:\Windows\System\MVHgRCN.exe
  2⤵
  PID:5776
- C:\Windows\System\kdSIyhc.exe
  C:\Windows\System\kdSIyhc.exe
  2⤵
  PID:5712
- C:\Windows\System\gNuJnZA.exe
  C:\Windows\System\gNuJnZA.exe
  2⤵
  PID:5704
- C:\Windows\System\ikXUmLL.exe
  C:\Windows\System\ikXUmLL.exe
  2⤵
  PID:5788
- C:\Windows\System\EvJDaAC.exe
  C:\Windows\System\EvJDaAC.exe
  2⤵
  PID:5852
- C:\Windows\System\XJQWKjx.exe
  C:\Windows\System\XJQWKjx.exe
  2⤵
  PID:5920
- C:\Windows\System\rfCwRct.exe
  C:\Windows\System\rfCwRct.exe
  2⤵
  PID:5988
- C:\Windows\System\MZbKUBR.exe
  C:\Windows\System\MZbKUBR.exe
  2⤵
  PID:5804
- C:\Windows\System\OzsuuUl.exe
  C:\Windows\System\OzsuuUl.exe
  2⤵
  PID:5840
- C:\Windows\System\TegnEEf.exe
  C:\Windows\System\TegnEEf.exe
  2⤵
  PID:5936
- C:\Windows\System\KPQCPdR.exe
  C:\Windows\System\KPQCPdR.exe
  2⤵
  PID:5972
- C:\Windows\System\QBkcIiU.exe
  C:\Windows\System\QBkcIiU.exe
  2⤵
  PID:6028
- C:\Windows\System\qsRxQuv.exe
  C:\Windows\System\qsRxQuv.exe
  2⤵
  PID:6044
- C:\Windows\System\wkhOfPV.exe
  C:\Windows\System\wkhOfPV.exe
  2⤵
  PID:6084
- C:\Windows\System\pxWsxjA.exe
  C:\Windows\System\pxWsxjA.exe
  2⤵
  PID:5048
- C:\Windows\System\AaiNNNg.exe
  C:\Windows\System\AaiNNNg.exe
  2⤵
  PID:6068
- C:\Windows\System\QsLiQoR.exe
  C:\Windows\System\QsLiQoR.exe
  2⤵
  PID:5296
- C:\Windows\System\MHNjVXa.exe
  C:\Windows\System\MHNjVXa.exe
  2⤵
  PID:5540
- C:\Windows\System\iwUaYBN.exe
  C:\Windows\System\iwUaYBN.exe
  2⤵
  PID:6100
- C:\Windows\System\tLbeEgu.exe
  C:\Windows\System\tLbeEgu.exe
  2⤵
  PID:6140
- C:\Windows\System\gEPubeQ.exe
  C:\Windows\System\gEPubeQ.exe
  2⤵
  PID:2652
- C:\Windows\System\uQxMlPm.exe
  C:\Windows\System\uQxMlPm.exe
  2⤵
  PID:5500
- C:\Windows\System\VvhhKEk.exe
  C:\Windows\System\VvhhKEk.exe
  2⤵
  PID:824
- C:\Windows\System\VlErOnw.exe
  C:\Windows\System\VlErOnw.exe
  2⤵
  PID:4800
- C:\Windows\System\VfwGRsU.exe
  C:\Windows\System\VfwGRsU.exe
  2⤵
  PID:5504
- C:\Windows\System\dZbKQtR.exe
  C:\Windows\System\dZbKQtR.exe
  2⤵
  PID:5344
- C:\Windows\System\CYrwurc.exe
  C:\Windows\System\CYrwurc.exe
  2⤵
  PID:5628
- C:\Windows\System\GNORPSB.exe
  C:\Windows\System\GNORPSB.exe
  2⤵
  PID:5576
- C:\Windows\System\wJsWvqF.exe
  C:\Windows\System\wJsWvqF.exe
  2⤵
  PID:4104
- C:\Windows\System\znfmUBe.exe
  C:\Windows\System\znfmUBe.exe
  2⤵
  PID:5316
- C:\Windows\System\kSBgkaL.exe
  C:\Windows\System\kSBgkaL.exe
  2⤵
  PID:5616
- C:\Windows\System\ZNiKWGG.exe
  C:\Windows\System\ZNiKWGG.exe
  2⤵
  PID:5456
- C:\Windows\System\lBRTXrz.exe
  C:\Windows\System\lBRTXrz.exe
  2⤵
  PID:5152
- C:\Windows\System\YnLyrrl.exe
  C:\Windows\System\YnLyrrl.exe
  2⤵
  PID:5736
- C:\Windows\System\PKiJXJy.exe
  C:\Windows\System\PKiJXJy.exe
  2⤵
  PID:5164
- C:\Windows\System\PasjzTs.exe
  C:\Windows\System\PasjzTs.exe
  2⤵
  PID:5856
- C:\Windows\System\hvGeCrz.exe
  C:\Windows\System\hvGeCrz.exe
  2⤵
  PID:5644
- C:\Windows\System\ZdcEHpE.exe
  C:\Windows\System\ZdcEHpE.exe
  2⤵
  PID:5772
- C:\Windows\System\gGppxPy.exe
  C:\Windows\System\gGppxPy.exe
  2⤵
  PID:5888
- C:\Windows\System\oxbemwV.exe
  C:\Windows\System\oxbemwV.exe
  2⤵
  PID:5872
- C:\Windows\System\tJUVagN.exe
  C:\Windows\System\tJUVagN.exe
  2⤵
  PID:6040
- C:\Windows\System\mxgugrl.exe
  C:\Windows\System\mxgugrl.exe
  2⤵
  PID:6036
- C:\Windows\System\ksBNOHA.exe
  C:\Windows\System\ksBNOHA.exe
  2⤵
  PID:5836
- C:\Windows\System\IpTJLtv.exe
  C:\Windows\System\IpTJLtv.exe
  2⤵
  PID:6072
- C:\Windows\System\fwlmIgq.exe
  C:\Windows\System\fwlmIgq.exe
  2⤵
  PID:4760
- C:\Windows\System\VFgvAFf.exe
  C:\Windows\System\VFgvAFf.exe
  2⤵
  PID:2028
- C:\Windows\System\FqRaWwr.exe
  C:\Windows\System\FqRaWwr.exe
  2⤵
  PID:4144
- C:\Windows\System\SaaRCCS.exe
  C:\Windows\System\SaaRCCS.exe
  2⤵
  PID:5432
- C:\Windows\System\ptqLNMt.exe
  C:\Windows\System\ptqLNMt.exe
  2⤵
  PID:6132
- C:\Windows\System\ytWFefR.exe
  C:\Windows\System\ytWFefR.exe
  2⤵
  PID:5636
- C:\Windows\System\jxrfrsR.exe
  C:\Windows\System\jxrfrsR.exe
  2⤵
  PID:2848
- C:\Windows\System\hIJgfcc.exe
  C:\Windows\System\hIJgfcc.exe
  2⤵
  PID:5652
- C:\Windows\System\rGWRlho.exe
  C:\Windows\System\rGWRlho.exe
  2⤵
  PID:5372
- C:\Windows\System\EseTnEo.exe
  C:\Windows\System\EseTnEo.exe
  2⤵
  PID:4976
- C:\Windows\System\GhfPSjS.exe
  C:\Windows\System\GhfPSjS.exe
  2⤵
  PID:6020
- C:\Windows\System\JETokLx.exe
  C:\Windows\System\JETokLx.exe
  2⤵
  PID:5696
- C:\Windows\System\KynOVnz.exe
  C:\Windows\System\KynOVnz.exe
  2⤵
  PID:5672
- C:\Windows\System\NjsyVwG.exe
  C:\Windows\System\NjsyVwG.exe
  2⤵
  PID:4584
- C:\Windows\System\jrUzTZl.exe
  C:\Windows\System\jrUzTZl.exe
  2⤵
  PID:5136
- C:\Windows\System\hecvYXI.exe
  C:\Windows\System\hecvYXI.exe
  2⤵
  PID:5552
- C:\Windows\System\JBOdRSO.exe
  C:\Windows\System\JBOdRSO.exe
  2⤵
  PID:5232
- C:\Windows\System\QtXFHJq.exe
  C:\Windows\System\QtXFHJq.exe
  2⤵
  PID:5452
- C:\Windows\System\nHtsPDx.exe
  C:\Windows\System\nHtsPDx.exe
  2⤵
  PID:3748
- C:\Windows\System\NbivZIn.exe
  C:\Windows\System\NbivZIn.exe
  2⤵
  PID:5448
- C:\Windows\System\FyApKms.exe
  C:\Windows\System\FyApKms.exe
  2⤵
  PID:5168
- C:\Windows\System\lRWTZuO.exe
  C:\Windows\System\lRWTZuO.exe
  2⤵
  PID:5800
- C:\Windows\System\hkLINHr.exe
  C:\Windows\System\hkLINHr.exe
  2⤵
  PID:5248
- C:\Windows\System\FkBkXLb.exe
  C:\Windows\System\FkBkXLb.exe
  2⤵
  PID:4748
- C:\Windows\System\OjRdMac.exe
  C:\Windows\System\OjRdMac.exe
  2⤵
  PID:4272
- C:\Windows\System\ZXFWTWW.exe
  C:\Windows\System\ZXFWTWW.exe
  2⤵
  PID:4836
- C:\Windows\System\LUTddUV.exe
  C:\Windows\System\LUTddUV.exe
  2⤵
  PID:5676
- C:\Windows\System\MaNcLrG.exe
  C:\Windows\System\MaNcLrG.exe
  2⤵
  PID:6160
- C:\Windows\System\GPgBWif.exe
  C:\Windows\System\GPgBWif.exe
  2⤵
  PID:6176
- C:\Windows\System\RrKLjgB.exe
  C:\Windows\System\RrKLjgB.exe
  2⤵
  PID:6192
- C:\Windows\System\RPjAvnQ.exe
  C:\Windows\System\RPjAvnQ.exe
  2⤵
  PID:6208
- C:\Windows\System\oBbCxkC.exe
  C:\Windows\System\oBbCxkC.exe
  2⤵
  PID:6224
- C:\Windows\System\wkiTmqo.exe
  C:\Windows\System\wkiTmqo.exe
  2⤵
  PID:6240
- C:\Windows\System\BqltXeK.exe
  C:\Windows\System\BqltXeK.exe
  2⤵
  PID:6256
- C:\Windows\System\sgYJooK.exe
  C:\Windows\System\sgYJooK.exe
  2⤵
  PID:6272
- C:\Windows\System\mKXqFwZ.exe
  C:\Windows\System\mKXqFwZ.exe
  2⤵
  PID:6288
- C:\Windows\System\iRkUhRy.exe
  C:\Windows\System\iRkUhRy.exe
  2⤵
  PID:6304
- C:\Windows\System\qFclXyC.exe
  C:\Windows\System\qFclXyC.exe
  2⤵
  PID:6320
- C:\Windows\System\eNKosDB.exe
  C:\Windows\System\eNKosDB.exe
  2⤵
  PID:6336
- C:\Windows\System\BDEmAbP.exe
  C:\Windows\System\BDEmAbP.exe
  2⤵
  PID:6352
- C:\Windows\System\TbfAqve.exe
  C:\Windows\System\TbfAqve.exe
  2⤵
  PID:6368
- C:\Windows\System\EEgAVyk.exe
  C:\Windows\System\EEgAVyk.exe
  2⤵
  PID:6384
- C:\Windows\System\wEDvEwY.exe
  C:\Windows\System\wEDvEwY.exe
  2⤵
  PID:6400
- C:\Windows\System\Qaeiaqs.exe
  C:\Windows\System\Qaeiaqs.exe
  2⤵
  PID:6416
- C:\Windows\System\qOrVAJf.exe
  C:\Windows\System\qOrVAJf.exe
  2⤵
  PID:6432
- C:\Windows\System\ENhPgXO.exe
  C:\Windows\System\ENhPgXO.exe
  2⤵
  PID:6448
- C:\Windows\System\CLYzEgI.exe
  C:\Windows\System\CLYzEgI.exe
  2⤵
  PID:6464
- C:\Windows\System\WbibCiD.exe
  C:\Windows\System\WbibCiD.exe
  2⤵
  PID:6480
- C:\Windows\System\meBPgbU.exe
  C:\Windows\System\meBPgbU.exe
  2⤵
  PID:6496
- C:\Windows\System\OFXKYYR.exe
  C:\Windows\System\OFXKYYR.exe
  2⤵
  PID:6512
- C:\Windows\System\HOduJfx.exe
  C:\Windows\System\HOduJfx.exe
  2⤵
  PID:6528
- C:\Windows\System\BTmsmRy.exe
  C:\Windows\System\BTmsmRy.exe
  2⤵
  PID:6544
- C:\Windows\System\oAQRees.exe
  C:\Windows\System\oAQRees.exe
  2⤵
  PID:6560
- C:\Windows\System\BxnxCGA.exe
  C:\Windows\System\BxnxCGA.exe
  2⤵
  PID:6576
- C:\Windows\System\UoUdDLI.exe
  C:\Windows\System\UoUdDLI.exe
  2⤵
  PID:6592
- C:\Windows\System\hnSWXEJ.exe
  C:\Windows\System\hnSWXEJ.exe
  2⤵
  PID:6608
- C:\Windows\System\JacZrtF.exe
  C:\Windows\System\JacZrtF.exe
  2⤵
  PID:6624
- C:\Windows\System\BWkTkiV.exe
  C:\Windows\System\BWkTkiV.exe
  2⤵
  PID:6640
- C:\Windows\System\QUqZWZn.exe
  C:\Windows\System\QUqZWZn.exe
  2⤵
  PID:6656
- C:\Windows\System\AUggWMv.exe
  C:\Windows\System\AUggWMv.exe
  2⤵
  PID:6672
- C:\Windows\System\gFPaWcr.exe
  C:\Windows\System\gFPaWcr.exe
  2⤵
  PID:6688
- C:\Windows\System\hVMkSLi.exe
  C:\Windows\System\hVMkSLi.exe
  2⤵
  PID:6704
- C:\Windows\System\FtyPGKb.exe
  C:\Windows\System\FtyPGKb.exe
  2⤵
  PID:6720
- C:\Windows\System\pIeYGSj.exe
  C:\Windows\System\pIeYGSj.exe
  2⤵
  PID:6736
- C:\Windows\System\QxPcbuQ.exe
  C:\Windows\System\QxPcbuQ.exe
  2⤵
  PID:6752
- C:\Windows\System\nlBLFuK.exe
  C:\Windows\System\nlBLFuK.exe
  2⤵
  PID:6768
- C:\Windows\System\qZMYLcU.exe
  C:\Windows\System\qZMYLcU.exe
  2⤵
  PID:6784
- C:\Windows\System\mJwdJHb.exe
  C:\Windows\System\mJwdJHb.exe
  2⤵
  PID:6800
- C:\Windows\System\IQYVwtw.exe
  C:\Windows\System\IQYVwtw.exe
  2⤵
  PID:6816
- C:\Windows\System\zIlOZoC.exe
  C:\Windows\System\zIlOZoC.exe
  2⤵
  PID:6832
- C:\Windows\System\QxbKgRr.exe
  C:\Windows\System\QxbKgRr.exe
  2⤵
  PID:6848
- C:\Windows\System\PsILzNK.exe
  C:\Windows\System\PsILzNK.exe
  2⤵
  PID:6864
- C:\Windows\System\MsctymI.exe
  C:\Windows\System\MsctymI.exe
  2⤵
  PID:6880
- C:\Windows\System\ZUtaXNy.exe
  C:\Windows\System\ZUtaXNy.exe
  2⤵
  PID:6896
- C:\Windows\System\FnJAAlT.exe
  C:\Windows\System\FnJAAlT.exe
  2⤵
  PID:6912
- C:\Windows\System\YeibNIP.exe
  C:\Windows\System\YeibNIP.exe
  2⤵
  PID:6928
- C:\Windows\System\xxUowCG.exe
  C:\Windows\System\xxUowCG.exe
  2⤵
  PID:6944
- C:\Windows\System\amooorF.exe
  C:\Windows\System\amooorF.exe
  2⤵
  PID:6960
- C:\Windows\System\hHUAxUp.exe
  C:\Windows\System\hHUAxUp.exe
  2⤵
  PID:6976
- C:\Windows\System\GbFdpPs.exe
  C:\Windows\System\GbFdpPs.exe
  2⤵
  PID:6992
- C:\Windows\System\XsiyLSC.exe
  C:\Windows\System\XsiyLSC.exe
  2⤵
  PID:7012
- C:\Windows\System\fBrupkX.exe
  C:\Windows\System\fBrupkX.exe
  2⤵
  PID:7028
- C:\Windows\System\gnDgnRX.exe
  C:\Windows\System\gnDgnRX.exe
  2⤵
  PID:7044
- C:\Windows\System\PRhDznS.exe
  C:\Windows\System\PRhDznS.exe
  2⤵
  PID:7064
- C:\Windows\System\gnEHDhD.exe
  C:\Windows\System\gnEHDhD.exe
  2⤵
  PID:7080
- C:\Windows\System\UIytCPP.exe
  C:\Windows\System\UIytCPP.exe
  2⤵
  PID:7096
- C:\Windows\System\SBKxiYk.exe
  C:\Windows\System\SBKxiYk.exe
  2⤵
  PID:7112
- C:\Windows\System\qOKCXWs.exe
  C:\Windows\System\qOKCXWs.exe
  2⤵
  PID:7128
- C:\Windows\System\TdNScAZ.exe
  C:\Windows\System\TdNScAZ.exe
  2⤵
  PID:7144
- C:\Windows\System\EQsrHNo.exe
  C:\Windows\System\EQsrHNo.exe
  2⤵
  PID:7160
- C:\Windows\System\XrVqzNf.exe
  C:\Windows\System\XrVqzNf.exe
  2⤵
  PID:6152
- C:\Windows\System\IOeBLed.exe
  C:\Windows\System\IOeBLed.exe
  2⤵
  PID:4376
- C:\Windows\System\IQmBdmJ.exe
  C:\Windows\System\IQmBdmJ.exe
  2⤵
  PID:6204
- C:\Windows\System\CSojAkp.exe
  C:\Windows\System\CSojAkp.exe
  2⤵
  PID:6236
- C:\Windows\System\dkvomvv.exe
  C:\Windows\System\dkvomvv.exe
  2⤵
  PID:6252
- C:\Windows\System\iywGmxd.exe
  C:\Windows\System\iywGmxd.exe
  2⤵
  PID:6312
- C:\Windows\System\CqPJRiv.exe
  C:\Windows\System\CqPJRiv.exe
  2⤵
  PID:1928
- C:\Windows\System\wsbdebg.exe
  C:\Windows\System\wsbdebg.exe
  2⤵
  PID:6328
- C:\Windows\System\TOKwQtW.exe
  C:\Windows\System\TOKwQtW.exe
  2⤵
  PID:6392
- C:\Windows\System\MNTwmJo.exe
  C:\Windows\System\MNTwmJo.exe
  2⤵
  PID:6428
- C:\Windows\System\WiTPOQj.exe
  C:\Windows\System\WiTPOQj.exe
  2⤵
  PID:6380
- C:\Windows\System\KKzrvBM.exe
  C:\Windows\System\KKzrvBM.exe
  2⤵
  PID:6524
- C:\Windows\System\boeMLeZ.exe
  C:\Windows\System\boeMLeZ.exe
  2⤵
  PID:6536
- C:\Windows\System\ZrXAPeE.exe
  C:\Windows\System\ZrXAPeE.exe
  2⤵
  PID:6472
- C:\Windows\System\OkQpGIV.exe
  C:\Windows\System\OkQpGIV.exe
  2⤵
  PID:6600
- C:\Windows\System\ztZuMMq.exe
  C:\Windows\System\ztZuMMq.exe
  2⤵
  PID:6636
- C:\Windows\System\SbWQDsC.exe
  C:\Windows\System\SbWQDsC.exe
  2⤵
  PID:6588
- C:\Windows\System\qFVQHVf.exe
  C:\Windows\System\qFVQHVf.exe
  2⤵
  PID:6652
- C:\Windows\System\oavqlNW.exe
  C:\Windows\System\oavqlNW.exe
  2⤵
  PID:6696
- C:\Windows\System\bngqlPs.exe
  C:\Windows\System\bngqlPs.exe
  2⤵
  PID:6728
- C:\Windows\System\uTjXKkk.exe
  C:\Windows\System\uTjXKkk.exe
  2⤵
  PID:6792
- C:\Windows\System\bvxipql.exe
  C:\Windows\System\bvxipql.exe
  2⤵
  PID:6796
- C:\Windows\System\wKpLztR.exe
  C:\Windows\System\wKpLztR.exe
  2⤵
  PID:6860
- C:\Windows\System\GbEobRg.exe
  C:\Windows\System\GbEobRg.exe
  2⤵
  PID:6780
- C:\Windows\System\NVhQbah.exe
  C:\Windows\System\NVhQbah.exe
  2⤵
  PID:6840
- C:\Windows\System\gVjlLow.exe
  C:\Windows\System\gVjlLow.exe
  2⤵
  PID:6904
- C:\Windows\System\HDNMRRt.exe
  C:\Windows\System\HDNMRRt.exe
  2⤵
  PID:6936
- C:\Windows\System\sZHIjOG.exe
  C:\Windows\System\sZHIjOG.exe
  2⤵
  PID:6988
- C:\Windows\System\LKAmWXC.exe
  C:\Windows\System\LKAmWXC.exe
  2⤵
  PID:6940
- C:\Windows\System\EdJqvsx.exe
  C:\Windows\System\EdJqvsx.exe
  2⤵
  PID:7088
- C:\Windows\System\nMycezJ.exe
  C:\Windows\System\nMycezJ.exe
  2⤵
  PID:7120
- C:\Windows\System\iVmLLiG.exe
  C:\Windows\System\iVmLLiG.exe
  2⤵
  PID:6184
- C:\Windows\System\vlImELS.exe
  C:\Windows\System\vlImELS.exe
  2⤵
  PID:6216
- C:\Windows\System\PliZOmI.exe
  C:\Windows\System\PliZOmI.exe
  2⤵
  PID:7076
- C:\Windows\System\ZesBUFR.exe
  C:\Windows\System\ZesBUFR.exe
  2⤵
  PID:7000
- C:\Windows\System\AsEaZTp.exe
  C:\Windows\System\AsEaZTp.exe
  2⤵
  PID:7072
- C:\Windows\System\AqNacru.exe
  C:\Windows\System\AqNacru.exe
  2⤵
  PID:7036
- C:\Windows\System\TYwZYGT.exe
  C:\Windows\System\TYwZYGT.exe
  2⤵
  PID:6364
- C:\Windows\System\BhkBjwl.exe
  C:\Windows\System\BhkBjwl.exe
  2⤵
  PID:6348
- C:\Windows\System\mZAsqje.exe
  C:\Windows\System\mZAsqje.exe
  2⤵
  PID:6440
- C:\Windows\System\WeESyGj.exe
  C:\Windows\System\WeESyGj.exe
  2⤵
  PID:6620
- C:\Windows\System\gXXwwbt.exe
  C:\Windows\System\gXXwwbt.exe
  2⤵
  PID:6744
- C:\Windows\System\xAVWfvj.exe
  C:\Windows\System\xAVWfvj.exe
  2⤵
  PID:6568
- C:\Windows\System\fmQkNmZ.exe
  C:\Windows\System\fmQkNmZ.exe
  2⤵
  PID:6668
- C:\Windows\System\eKYrNsB.exe
  C:\Windows\System\eKYrNsB.exe
  2⤵
  PID:6856
- C:\Windows\System\blekhdT.exe
  C:\Windows\System\blekhdT.exe
  2⤵
  PID:6956
- C:\Windows\System\JBisRwH.exe
  C:\Windows\System\JBisRwH.exe
  2⤵
  PID:6504
- C:\Windows\System\byqnhYY.exe
  C:\Windows\System\byqnhYY.exe
  2⤵
  PID:6892
- C:\Windows\System\vrkyQgG.exe
  C:\Windows\System\vrkyQgG.exe
  2⤵
  PID:7152
- C:\Windows\System\iTpxuFX.exe
  C:\Windows\System\iTpxuFX.exe
  2⤵
  PID:5824
- C:\Windows\System\mRDDpfx.exe
  C:\Windows\System\mRDDpfx.exe
  2⤵
  PID:7108
- C:\Windows\System\XDYSgPL.exe
  C:\Windows\System\XDYSgPL.exe
  2⤵
  PID:6360
- C:\Windows\System\EYesLRs.exe
  C:\Windows\System\EYesLRs.exe
  2⤵
  PID:2000
- C:\Windows\System\TQBKdCl.exe
  C:\Windows\System\TQBKdCl.exe
  2⤵
  PID:2328
- C:\Windows\System\xZOiqio.exe
  C:\Windows\System\xZOiqio.exe
  2⤵
  PID:6700
- C:\Windows\System\weKUhBt.exe
  C:\Windows\System\weKUhBt.exe
  2⤵
  PID:6004
- C:\Windows\System\HQpXMkS.exe
  C:\Windows\System\HQpXMkS.exe
  2⤵
  PID:6952
- C:\Windows\System\nWLeXPD.exe
  C:\Windows\System\nWLeXPD.exe
  2⤵
  PID:6300
- C:\Windows\System\MtaLnKe.exe
  C:\Windows\System\MtaLnKe.exe
  2⤵
  PID:6172
- C:\Windows\System\HeGcDdB.exe
  C:\Windows\System\HeGcDdB.exe
  2⤵
  PID:6220
- C:\Windows\System\JpPrzAY.exe
  C:\Windows\System\JpPrzAY.exe
  2⤵
  PID:6492
- C:\Windows\System\vsARqjs.exe
  C:\Windows\System\vsARqjs.exe
  2⤵
  PID:6584
- C:\Windows\System\PyNXtnY.exe
  C:\Windows\System\PyNXtnY.exe
  2⤵
  PID:7184
- C:\Windows\System\gTlLOGB.exe
  C:\Windows\System\gTlLOGB.exe
  2⤵
  PID:7200
- C:\Windows\System\NpXWOyM.exe
  C:\Windows\System\NpXWOyM.exe
  2⤵
  PID:7216
- C:\Windows\System\rEYnIOr.exe
  C:\Windows\System\rEYnIOr.exe
  2⤵
  PID:7232
- C:\Windows\System\ndRHzVT.exe
  C:\Windows\System\ndRHzVT.exe
  2⤵
  PID:7248
- C:\Windows\System\yQnDaZn.exe
  C:\Windows\System\yQnDaZn.exe
  2⤵
  PID:7264
- C:\Windows\System\CimugCN.exe
  C:\Windows\System\CimugCN.exe
  2⤵
  PID:7280
- C:\Windows\System\RcDQFMb.exe
  C:\Windows\System\RcDQFMb.exe
  2⤵
  PID:7296
- C:\Windows\System\eixmRyd.exe
  C:\Windows\System\eixmRyd.exe
  2⤵
  PID:7312
- C:\Windows\System\QGnPRGJ.exe
  C:\Windows\System\QGnPRGJ.exe
  2⤵
  PID:7328
- C:\Windows\System\hSwYRvY.exe
  C:\Windows\System\hSwYRvY.exe
  2⤵
  PID:7344
- C:\Windows\System\gyslPmq.exe
  C:\Windows\System\gyslPmq.exe
  2⤵
  PID:7360
- C:\Windows\System\QgxVOWE.exe
  C:\Windows\System\QgxVOWE.exe
  2⤵
  PID:7376
- C:\Windows\System\uliosRV.exe
  C:\Windows\System\uliosRV.exe
  2⤵
  PID:7392
- C:\Windows\System\lHtOyFV.exe
  C:\Windows\System\lHtOyFV.exe
  2⤵
  PID:7408
- C:\Windows\System\fVYstrO.exe
  C:\Windows\System\fVYstrO.exe
  2⤵
  PID:7424
- C:\Windows\System\ArsmDqO.exe
  C:\Windows\System\ArsmDqO.exe
  2⤵
  PID:7440
- C:\Windows\System\zLtlCFl.exe
  C:\Windows\System\zLtlCFl.exe
  2⤵
  PID:7456
- C:\Windows\System\volBrxG.exe
  C:\Windows\System\volBrxG.exe
  2⤵
  PID:7472
- C:\Windows\System\sLsONxE.exe
  C:\Windows\System\sLsONxE.exe
  2⤵
  PID:7488
- C:\Windows\System\jftwWIt.exe
  C:\Windows\System\jftwWIt.exe
  2⤵
  PID:7504
- C:\Windows\System\VPGebvN.exe
  C:\Windows\System\VPGebvN.exe
  2⤵
  PID:7520
- C:\Windows\System\YooGfPL.exe
  C:\Windows\System\YooGfPL.exe
  2⤵
  PID:7536
- C:\Windows\System\ZzlbKEH.exe
  C:\Windows\System\ZzlbKEH.exe
  2⤵
  PID:7552
- C:\Windows\System\BQqTaMQ.exe
  C:\Windows\System\BQqTaMQ.exe
  2⤵
  PID:7568
- C:\Windows\System\UCgrZuw.exe
  C:\Windows\System\UCgrZuw.exe
  2⤵
  PID:7584
- C:\Windows\System\vKlBfZw.exe
  C:\Windows\System\vKlBfZw.exe
  2⤵
  PID:7600
- C:\Windows\System\ftneRkg.exe
  C:\Windows\System\ftneRkg.exe
  2⤵
  PID:7616
- C:\Windows\System\PokQmRq.exe
  C:\Windows\System\PokQmRq.exe
  2⤵
  PID:7632
- C:\Windows\System\DvXqGmZ.exe
  C:\Windows\System\DvXqGmZ.exe
  2⤵
  PID:7648
- C:\Windows\System\CaaaoLg.exe
  C:\Windows\System\CaaaoLg.exe
  2⤵
  PID:7664
- C:\Windows\System\czTQdbe.exe
  C:\Windows\System\czTQdbe.exe
  2⤵
  PID:7680
- C:\Windows\System\FEFDpOD.exe
  C:\Windows\System\FEFDpOD.exe
  2⤵
  PID:7696
- C:\Windows\System\lTeRKwA.exe
  C:\Windows\System\lTeRKwA.exe
  2⤵
  PID:7712
- C:\Windows\System\FEOysfg.exe
  C:\Windows\System\FEOysfg.exe
  2⤵
  PID:7728
- C:\Windows\System\ecAifYj.exe
  C:\Windows\System\ecAifYj.exe
  2⤵
  PID:7744
- C:\Windows\System\eszyyuv.exe
  C:\Windows\System\eszyyuv.exe
  2⤵
  PID:7760
- C:\Windows\System\maMnSlC.exe
  C:\Windows\System\maMnSlC.exe
  2⤵
  PID:7776
- C:\Windows\System\YQTymPF.exe
  C:\Windows\System\YQTymPF.exe
  2⤵
  PID:7792
- C:\Windows\System\vYUjNhM.exe
  C:\Windows\System\vYUjNhM.exe
  2⤵
  PID:7808
- C:\Windows\System\dbeicTD.exe
  C:\Windows\System\dbeicTD.exe
  2⤵
  PID:7824
- C:\Windows\System\LfpHCam.exe
  C:\Windows\System\LfpHCam.exe
  2⤵
  PID:7840
- C:\Windows\System\eStvSco.exe
  C:\Windows\System\eStvSco.exe
  2⤵
  PID:7856
- C:\Windows\System\WkZWkJW.exe
  C:\Windows\System\WkZWkJW.exe
  2⤵
  PID:7872
- C:\Windows\System\bALgMZS.exe
  C:\Windows\System\bALgMZS.exe
  2⤵
  PID:7888
- C:\Windows\System\rmUJnwO.exe
  C:\Windows\System\rmUJnwO.exe
  2⤵
  PID:7904
- C:\Windows\System\AnsaRSv.exe
  C:\Windows\System\AnsaRSv.exe
  2⤵
  PID:7920
- C:\Windows\System\jSKLinh.exe
  C:\Windows\System\jSKLinh.exe
  2⤵
  PID:7936
- C:\Windows\System\gIUmhbL.exe
  C:\Windows\System\gIUmhbL.exe
  2⤵
  PID:7952
- C:\Windows\System\RgsNTer.exe
  C:\Windows\System\RgsNTer.exe
  2⤵
  PID:7968
- C:\Windows\System\sOzrhEz.exe
  C:\Windows\System\sOzrhEz.exe
  2⤵
  PID:7984
- C:\Windows\System\PGjvNwt.exe
  C:\Windows\System\PGjvNwt.exe
  2⤵
  PID:8000
- C:\Windows\System\jSxwdUl.exe
  C:\Windows\System\jSxwdUl.exe
  2⤵
  PID:8016
- C:\Windows\System\ePZvMTC.exe
  C:\Windows\System\ePZvMTC.exe
  2⤵
  PID:8032
- C:\Windows\System\MVuNjpV.exe
  C:\Windows\System\MVuNjpV.exe
  2⤵
  PID:8052
- C:\Windows\System\qPGfsfZ.exe
  C:\Windows\System\qPGfsfZ.exe
  2⤵
  PID:8068
- C:\Windows\System\CUjCGPk.exe
  C:\Windows\System\CUjCGPk.exe
  2⤵
  PID:8084
- C:\Windows\System\ajyllYa.exe
  C:\Windows\System\ajyllYa.exe
  2⤵
  PID:8160
- C:\Windows\System\CVvqSXA.exe
  C:\Windows\System\CVvqSXA.exe
  2⤵
  PID:8180
- C:\Windows\System\bxOkXkG.exe
  C:\Windows\System\bxOkXkG.exe
  2⤵
  PID:6268
- C:\Windows\System\xzKoGiR.exe
  C:\Windows\System\xzKoGiR.exe
  2⤵
  PID:820
- C:\Windows\System\yOuCGMK.exe
  C:\Windows\System\yOuCGMK.exe
  2⤵
  PID:6556
- C:\Windows\System\lneTzTo.exe
  C:\Windows\System\lneTzTo.exe
  2⤵
  PID:7224
- C:\Windows\System\WiFKUDR.exe
  C:\Windows\System\WiFKUDR.exe
  2⤵
  PID:7288
- C:\Windows\System\matIzKN.exe
  C:\Windows\System\matIzKN.exe
  2⤵
  PID:7356
- C:\Windows\System\RCErExK.exe
  C:\Windows\System\RCErExK.exe
  2⤵
  PID:7212
- C:\Windows\System\bFFOCLj.exe
  C:\Windows\System\bFFOCLj.exe
  2⤵
  PID:7272
- C:\Windows\System\oVObCuD.exe
  C:\Windows\System\oVObCuD.exe
  2⤵
  PID:7336
- C:\Windows\System\rTjeMjl.exe
  C:\Windows\System\rTjeMjl.exe
  2⤵
  PID:7388
- C:\Windows\System\qVJqlKD.exe
  C:\Windows\System\qVJqlKD.exe
  2⤵
  PID:7452
- C:\Windows\System\FMmOuvV.exe
  C:\Windows\System\FMmOuvV.exe
  2⤵
  PID:7512
- C:\Windows\System\pfIXICh.exe
  C:\Windows\System\pfIXICh.exe
  2⤵
  PID:7404
- C:\Windows\System\FSzOykg.exe
  C:\Windows\System\FSzOykg.exe
  2⤵
  PID:7468
- C:\Windows\System\JGBLCAT.exe
  C:\Windows\System\JGBLCAT.exe
  2⤵
  PID:7564
- C:\Windows\System\hJurXxU.exe
  C:\Windows\System\hJurXxU.exe
  2⤵
  PID:7624
- C:\Windows\System\ASchyLB.exe
  C:\Windows\System\ASchyLB.exe
  2⤵
  PID:7692
- C:\Windows\System\qnUnFzl.exe
  C:\Windows\System\qnUnFzl.exe
  2⤵
  PID:7736
- C:\Windows\System\FTRheGP.exe
  C:\Windows\System\FTRheGP.exe
  2⤵
  PID:7676
- C:\Windows\System\IWuRnqG.exe
  C:\Windows\System\IWuRnqG.exe
  2⤵
  PID:7608
- C:\Windows\System\aiTNymU.exe
  C:\Windows\System\aiTNymU.exe
  2⤵
  PID:7740
- C:\Windows\System\tecmJdi.exe
  C:\Windows\System\tecmJdi.exe
  2⤵
  PID:7756
- C:\Windows\System\JtLurUf.exe
  C:\Windows\System\JtLurUf.exe
  2⤵
  PID:7816
- C:\Windows\System\sFLqgTQ.exe
  C:\Windows\System\sFLqgTQ.exe
  2⤵
  PID:7836
- C:\Windows\System\cjHgJtA.exe
  C:\Windows\System\cjHgJtA.exe
  2⤵
  PID:7864
- C:\Windows\System\XkiAaqc.exe
  C:\Windows\System\XkiAaqc.exe
  2⤵
  PID:7928
- C:\Windows\System\uHsFvvQ.exe
  C:\Windows\System\uHsFvvQ.exe
  2⤵
  PID:7964
- C:\Windows\System\SSflXMg.exe
  C:\Windows\System\SSflXMg.exe
  2⤵
  PID:8024
- C:\Windows\System\BPUmXQK.exe
  C:\Windows\System\BPUmXQK.exe
  2⤵
  PID:7980
- C:\Windows\System\pxiDjkt.exe
  C:\Windows\System\pxiDjkt.exe
  2⤵
  PID:8008
- C:\Windows\System\GRmcGhI.exe
  C:\Windows\System\GRmcGhI.exe
  2⤵
  PID:8048
- C:\Windows\System\XiBigId.exe
  C:\Windows\System\XiBigId.exe
  2⤵
  PID:8100
- C:\Windows\System\oTwipJG.exe
  C:\Windows\System\oTwipJG.exe
  2⤵
  PID:8116
- C:\Windows\System\xEFDzZn.exe
  C:\Windows\System\xEFDzZn.exe
  2⤵
  PID:8132
- C:\Windows\System\AhXsRrr.exe
  C:\Windows\System\AhXsRrr.exe
  2⤵
  PID:8148
- C:\Windows\System\DlieqMz.exe
  C:\Windows\System\DlieqMz.exe
  2⤵
  PID:8172
- C:\Windows\System\dWysPUa.exe
  C:\Windows\System\dWysPUa.exe
  2⤵
  PID:6248
- C:\Windows\System\KfDROeH.exe
  C:\Windows\System\KfDROeH.exe
  2⤵
  PID:7180
- C:\Windows\System\RLgFMdl.exe
  C:\Windows\System\RLgFMdl.exe
  2⤵
  PID:7308
- C:\Windows\System\SCEOQnI.exe
  C:\Windows\System\SCEOQnI.exe
  2⤵
  PID:7432
- C:\Windows\System\Tmujyuj.exe
  C:\Windows\System\Tmujyuj.exe
  2⤵
  PID:7528
- C:\Windows\System\UWMAbFS.exe
  C:\Windows\System\UWMAbFS.exe
  2⤵
  PID:7704
- C:\Windows\System\qihcsmC.exe
  C:\Windows\System\qihcsmC.exe
  2⤵
  PID:7464
- C:\Windows\System\JmroPuk.exe
  C:\Windows\System\JmroPuk.exe
  2⤵
  PID:7324
- C:\Windows\System\Llmrqyk.exe
  C:\Windows\System\Llmrqyk.exe
  2⤵
  PID:7400
- C:\Windows\System\AHTvVvQ.exe
  C:\Windows\System\AHTvVvQ.exe
  2⤵
  PID:7576
- C:\Windows\System\IokfdTV.exe
  C:\Windows\System\IokfdTV.exe
  2⤵
  PID:7752
- C:\Windows\System\gYVAPvD.exe
  C:\Windows\System\gYVAPvD.exe
  2⤵
  PID:7772
- C:\Windows\System\TzIZqSN.exe
  C:\Windows\System\TzIZqSN.exe
  2⤵
  PID:7900
- C:\Windows\System\llwoEpx.exe
  C:\Windows\System\llwoEpx.exe
  2⤵
  PID:8060
- C:\Windows\System\VdnJVLu.exe
  C:\Windows\System\VdnJVLu.exe
  2⤵
  PID:8140
- C:\Windows\System\YNCuYSN.exe
  C:\Windows\System\YNCuYSN.exe
  2⤵
  PID:7304
- C:\Windows\System\QBBvXsT.exe
  C:\Windows\System\QBBvXsT.exe
  2⤵
  PID:7532
- C:\Windows\System\LpvppCy.exe
  C:\Windows\System\LpvppCy.exe
  2⤵
  PID:8040
- C:\Windows\System\NKVZXLF.exe
  C:\Windows\System\NKVZXLF.exe
  2⤵
  PID:7544
- C:\Windows\System\gQyvuYS.exe
  C:\Windows\System\gQyvuYS.exe
  2⤵
  PID:7896
- C:\Windows\System\HUGtZWJ.exe
  C:\Windows\System\HUGtZWJ.exe
  2⤵
  PID:8092
- C:\Windows\System\yjMrlWA.exe
  C:\Windows\System\yjMrlWA.exe
  2⤵
  PID:8156
- C:\Windows\System\lmZImcs.exe
  C:\Windows\System\lmZImcs.exe
  2⤵
  PID:7320
- C:\Windows\System\ivgzjHN.exe
  C:\Windows\System\ivgzjHN.exe
  2⤵
  PID:7720
- C:\Windows\System\GCGbCHq.exe
  C:\Windows\System\GCGbCHq.exe
  2⤵
  PID:8108
- C:\Windows\System\trEhvpS.exe
  C:\Windows\System\trEhvpS.exe
  2⤵
  PID:7944
- C:\Windows\System\sJVbcrE.exe
  C:\Windows\System\sJVbcrE.exe
  2⤵
  PID:7352
- C:\Windows\System\NMWFxvf.exe
  C:\Windows\System\NMWFxvf.exe
  2⤵
  PID:7996
- C:\Windows\System\yDhPhBw.exe
  C:\Windows\System\yDhPhBw.exe
  2⤵
  PID:7848
- C:\Windows\System\vGYrVVI.exe
  C:\Windows\System\vGYrVVI.exe
  2⤵
  PID:7256
- C:\Windows\System\vtyXinx.exe
  C:\Windows\System\vtyXinx.exe
  2⤵
  PID:7580
- C:\Windows\System\HBzcNwg.exe
  C:\Windows\System\HBzcNwg.exe
  2⤵
  PID:7912
- C:\Windows\System\GmrMSWC.exe
  C:\Windows\System\GmrMSWC.exe
  2⤵
  PID:8112
- C:\Windows\System\RIOESKI.exe
  C:\Windows\System\RIOESKI.exe
  2⤵
  PID:8212
- C:\Windows\System\XyqeJcc.exe
  C:\Windows\System\XyqeJcc.exe
  2⤵
  PID:8228
- C:\Windows\System\ERnpXNP.exe
  C:\Windows\System\ERnpXNP.exe
  2⤵
  PID:8248
- C:\Windows\System\RMkYFrI.exe
  C:\Windows\System\RMkYFrI.exe
  2⤵
  PID:8268
- C:\Windows\System\wpYLdvc.exe
  C:\Windows\System\wpYLdvc.exe
  2⤵
  PID:8284
- C:\Windows\System\ckkJFgO.exe
  C:\Windows\System\ckkJFgO.exe
  2⤵
  PID:8304
- C:\Windows\System\YPdHenU.exe
  C:\Windows\System\YPdHenU.exe
  2⤵
  PID:8320
- C:\Windows\System\SSPEWLQ.exe
  C:\Windows\System\SSPEWLQ.exe
  2⤵
  PID:8340
- C:\Windows\System\EDojJWu.exe
  C:\Windows\System\EDojJWu.exe
  2⤵
  PID:8356
- C:\Windows\System\LWucuFF.exe
  C:\Windows\System\LWucuFF.exe
  2⤵
  PID:8372
- C:\Windows\System\hvAJLgm.exe
  C:\Windows\System\hvAJLgm.exe
  2⤵
  PID:8392
- C:\Windows\System\GMhVqqT.exe
  C:\Windows\System\GMhVqqT.exe
  2⤵
  PID:8408
- C:\Windows\System\ZOGkLPK.exe
  C:\Windows\System\ZOGkLPK.exe
  2⤵
  PID:8424
- C:\Windows\System\PLxORrv.exe
  C:\Windows\System\PLxORrv.exe
  2⤵
  PID:8440
- C:\Windows\System\kutKQmW.exe
  C:\Windows\System\kutKQmW.exe
  2⤵
  PID:8456
- C:\Windows\System\yZwcOMK.exe
  C:\Windows\System\yZwcOMK.exe
  2⤵
  PID:8472
- C:\Windows\System\dvlCZoH.exe
  C:\Windows\System\dvlCZoH.exe
  2⤵
  PID:8488
- C:\Windows\System\fYjJXKq.exe
  C:\Windows\System\fYjJXKq.exe
  2⤵
  PID:8504
- C:\Windows\System\PTfivmM.exe
  C:\Windows\System\PTfivmM.exe
  2⤵
  PID:8520
- C:\Windows\System\QCKRdGt.exe
  C:\Windows\System\QCKRdGt.exe
  2⤵
  PID:8536
- C:\Windows\System\YtpVWeQ.exe
  C:\Windows\System\YtpVWeQ.exe
  2⤵
  PID:8552
- C:\Windows\System\mJDMPQd.exe
  C:\Windows\System\mJDMPQd.exe
  2⤵
  PID:8568
- C:\Windows\System\SQMnLPU.exe
  C:\Windows\System\SQMnLPU.exe
  2⤵
  PID:8584
- C:\Windows\System\xtYmHUp.exe
  C:\Windows\System\xtYmHUp.exe
  2⤵
  PID:8600
- C:\Windows\System\xJbSVUE.exe
  C:\Windows\System\xJbSVUE.exe
  2⤵
  PID:8616
- C:\Windows\System\VCSnKmQ.exe
  C:\Windows\System\VCSnKmQ.exe
  2⤵
  PID:8632
- C:\Windows\System\bUxTBtY.exe
  C:\Windows\System\bUxTBtY.exe
  2⤵
  PID:8648
- C:\Windows\System\wBVWZrH.exe
  C:\Windows\System\wBVWZrH.exe
  2⤵
  PID:8664
- C:\Windows\System\UuAHzTs.exe
  C:\Windows\System\UuAHzTs.exe
  2⤵
  PID:8680
- C:\Windows\System\ZpwVxgH.exe
  C:\Windows\System\ZpwVxgH.exe
  2⤵
  PID:8696
- C:\Windows\System\teFpaVl.exe
  C:\Windows\System\teFpaVl.exe
  2⤵
  PID:8712
- C:\Windows\System\ziIBckL.exe
  C:\Windows\System\ziIBckL.exe
  2⤵
  PID:8728
- C:\Windows\System\GNdPbnh.exe
  C:\Windows\System\GNdPbnh.exe
  2⤵
  PID:8744
- C:\Windows\System\aPhyZpX.exe
  C:\Windows\System\aPhyZpX.exe
  2⤵
  PID:8760
- C:\Windows\System\zyyhaPl.exe
  C:\Windows\System\zyyhaPl.exe
  2⤵
  PID:8776
- C:\Windows\System\UPYjuFS.exe
  C:\Windows\System\UPYjuFS.exe
  2⤵
  PID:8792
- C:\Windows\System\gBfwPKo.exe
  C:\Windows\System\gBfwPKo.exe
  2⤵
  PID:8808
- C:\Windows\System\CASNqZb.exe
  C:\Windows\System\CASNqZb.exe
  2⤵
  PID:8824
- C:\Windows\System\jWdAHjP.exe
  C:\Windows\System\jWdAHjP.exe
  2⤵
  PID:8840
- C:\Windows\System\xivNdOx.exe
  C:\Windows\System\xivNdOx.exe
  2⤵
  PID:8856
- C:\Windows\System\CqVrVfC.exe
  C:\Windows\System\CqVrVfC.exe
  2⤵
  PID:8872
- C:\Windows\System\zzSiHPR.exe
  C:\Windows\System\zzSiHPR.exe
  2⤵
  PID:8888
- C:\Windows\System\alRoNyM.exe
  C:\Windows\System\alRoNyM.exe
  2⤵
  PID:8904
- C:\Windows\System\YxjvMNN.exe
  C:\Windows\System\YxjvMNN.exe
  2⤵
  PID:8920
- C:\Windows\System\ZzqJskM.exe
  C:\Windows\System\ZzqJskM.exe
  2⤵
  PID:8936
- C:\Windows\System\TzyaFjf.exe
  C:\Windows\System\TzyaFjf.exe
  2⤵
  PID:8952
- C:\Windows\System\VPykmhc.exe
  C:\Windows\System\VPykmhc.exe
  2⤵
  PID:8968
- C:\Windows\System\HzFwyHB.exe
  C:\Windows\System\HzFwyHB.exe
  2⤵
  PID:8984
- C:\Windows\System\EORaTNX.exe
  C:\Windows\System\EORaTNX.exe
  2⤵
  PID:9000
- C:\Windows\System\PNgjnys.exe
  C:\Windows\System\PNgjnys.exe
  2⤵
  PID:9016
- C:\Windows\System\zsVXFJL.exe
  C:\Windows\System\zsVXFJL.exe
  2⤵
  PID:9032
- C:\Windows\System\TsxaqSX.exe
  C:\Windows\System\TsxaqSX.exe
  2⤵
  PID:9048
- C:\Windows\System\eJGXQgo.exe
  C:\Windows\System\eJGXQgo.exe
  2⤵
  PID:9064
- C:\Windows\System\LnWwFRw.exe
  C:\Windows\System\LnWwFRw.exe
  2⤵
  PID:9080
- C:\Windows\System\gNwMykZ.exe
  C:\Windows\System\gNwMykZ.exe
  2⤵
  PID:9096
- C:\Windows\System\XdgAsGK.exe
  C:\Windows\System\XdgAsGK.exe
  2⤵
  PID:9112
- C:\Windows\System\MsIgBMi.exe
  C:\Windows\System\MsIgBMi.exe
  2⤵
  PID:9128
- C:\Windows\System\wziihPu.exe
  C:\Windows\System\wziihPu.exe
  2⤵
  PID:9144
- C:\Windows\System\uCMYVUF.exe
  C:\Windows\System\uCMYVUF.exe
  2⤵
  PID:9160
- C:\Windows\System\kQwosCr.exe
  C:\Windows\System\kQwosCr.exe
  2⤵
  PID:9176
- C:\Windows\System\yeoEGHj.exe
  C:\Windows\System\yeoEGHj.exe
  2⤵
  PID:9192
- C:\Windows\System\PSLNDXy.exe
  C:\Windows\System\PSLNDXy.exe
  2⤵
  PID:9208
- C:\Windows\System\ZAjfTjx.exe
  C:\Windows\System\ZAjfTjx.exe
  2⤵
  PID:8220
- C:\Windows\System\CyoMqTr.exe
  C:\Windows\System\CyoMqTr.exe
  2⤵
  PID:8292
- C:\Windows\System\mhyPmzZ.exe
  C:\Windows\System\mhyPmzZ.exe
  2⤵
  PID:8336
- C:\Windows\System\DKxiWVu.exe
  C:\Windows\System\DKxiWVu.exe
  2⤵
  PID:8404
- C:\Windows\System\UqhcRYG.exe
  C:\Windows\System\UqhcRYG.exe
  2⤵
  PID:8464
- C:\Windows\System\ifmEVFM.exe
  C:\Windows\System\ifmEVFM.exe
  2⤵
  PID:8496
- C:\Windows\System\iYemYeS.exe
  C:\Windows\System\iYemYeS.exe
  2⤵
  PID:8560
- C:\Windows\System\liazvvC.exe
  C:\Windows\System\liazvvC.exe
  2⤵
  PID:8624
- C:\Windows\System\FmmNiaj.exe
  C:\Windows\System\FmmNiaj.exe
  2⤵
  PID:8688
- C:\Windows\System\ohhOnCH.exe
  C:\Windows\System\ohhOnCH.exe
  2⤵
  PID:8720
- C:\Windows\System\lAmLBsG.exe
  C:\Windows\System\lAmLBsG.exe
  2⤵
  PID:7372
- C:\Windows\System\zXoDGhz.exe
  C:\Windows\System\zXoDGhz.exe
  2⤵
  PID:8784
- C:\Windows\System\MrPgksS.exe
  C:\Windows\System\MrPgksS.exe
  2⤵
  PID:8848
- C:\Windows\System\AimhYwL.exe
  C:\Windows\System\AimhYwL.exe
  2⤵
  PID:8708
- C:\Windows\System\mayCEVg.exe
  C:\Windows\System\mayCEVg.exe
  2⤵
  PID:8388
- C:\Windows\System\kmEaNZC.exe
  C:\Windows\System\kmEaNZC.exe
  2⤵
  PID:8864
- C:\Windows\System\yXxZEoP.exe
  C:\Windows\System\yXxZEoP.exe
  2⤵
  PID:8644
- C:\Windows\System\DYzkhRk.exe
  C:\Windows\System\DYzkhRk.exe
  2⤵
  PID:8280
- C:\Windows\System\EmRKRwv.exe
  C:\Windows\System\EmRKRwv.exe
  2⤵
  PID:8384
- C:\Windows\System\LDlmezU.exe
  C:\Windows\System\LDlmezU.exe
  2⤵
  PID:8452
- C:\Windows\System\ydCKqRr.exe
  C:\Windows\System\ydCKqRr.exe
  2⤵
  PID:8836
- C:\Windows\System\DktarIA.exe
  C:\Windows\System\DktarIA.exe
  2⤵
  PID:8640
- C:\Windows\System\bDBQEQo.exe
  C:\Windows\System\bDBQEQo.exe
  2⤵
  PID:8800
- C:\Windows\System\GlyGNis.exe
  C:\Windows\System\GlyGNis.exe
  2⤵
  PID:8900
- C:\Windows\System\TWIiRSQ.exe
  C:\Windows\System\TWIiRSQ.exe
  2⤵
  PID:8976
- C:\Windows\System\fvXsSqb.exe
  C:\Windows\System\fvXsSqb.exe
  2⤵
  PID:8932
- C:\Windows\System\vnkZItJ.exe
  C:\Windows\System\vnkZItJ.exe
  2⤵
  PID:9076
- C:\Windows\System\iuskKSQ.exe
  C:\Windows\System\iuskKSQ.exe
  2⤵
  PID:9140
- C:\Windows\System\yNCfkdQ.exe
  C:\Windows\System\yNCfkdQ.exe
  2⤵
  PID:9204
- C:\Windows\System\ckuGDdR.exe
  C:\Windows\System\ckuGDdR.exe
  2⤵
  PID:9028
- C:\Windows\System\HEdEmMR.exe
  C:\Windows\System\HEdEmMR.exe
  2⤵
  PID:8960
- C:\Windows\System\dUYKyLF.exe
  C:\Windows\System\dUYKyLF.exe
  2⤵
  PID:8964
- C:\Windows\System\rzZdaYc.exe
  C:\Windows\System\rzZdaYc.exe
  2⤵
  PID:9120
- C:\Windows\System\zmEIoew.exe
  C:\Windows\System\zmEIoew.exe
  2⤵
  PID:7852
- C:\Windows\System\tRIRmUF.exe
  C:\Windows\System\tRIRmUF.exe
  2⤵
  PID:8368
- C:\Windows\System\MLbxNzl.exe
  C:\Windows\System\MLbxNzl.exe
  2⤵
  PID:8436
- C:\Windows\System\SloIRUN.exe
  C:\Windows\System\SloIRUN.exe
  2⤵
  PID:8528
- C:\Windows\System\DTuvTVr.exe
  C:\Windows\System\DTuvTVr.exe
  2⤵
  PID:8656
- C:\Windows\System\VEgJiTr.exe
  C:\Windows\System\VEgJiTr.exe
  2⤵
  PID:8756
- C:\Windows\System\phGluwP.exe
  C:\Windows\System\phGluwP.exe
  2⤵
  PID:8912
- C:\Windows\System\edJeicb.exe
  C:\Windows\System\edJeicb.exe
  2⤵
  PID:7660
- C:\Windows\System\AkVUoRC.exe
  C:\Windows\System\AkVUoRC.exe
  2⤵
  PID:8772
- C:\Windows\System\fcrrBov.exe
  C:\Windows\System\fcrrBov.exe
  2⤵
  PID:8448
- C:\Windows\System\TWtlEex.exe
  C:\Windows\System\TWtlEex.exe
  2⤵
  PID:8896
- C:\Windows\System\aZewMKQ.exe
  C:\Windows\System\aZewMKQ.exe
  2⤵
  PID:8676
- C:\Windows\System\ramoMQA.exe
  C:\Windows\System\ramoMQA.exe
  2⤵
  PID:8948
- C:\Windows\System\bpfMnBE.exe
  C:\Windows\System\bpfMnBE.exe
  2⤵
  PID:8928
- C:\Windows\System\AruaGDn.exe
  C:\Windows\System\AruaGDn.exe
  2⤵
  PID:9108
- C:\Windows\System\XKYPAXX.exe
  C:\Windows\System\XKYPAXX.exe
  2⤵
  PID:9156
- C:\Windows\System\nLLPNCH.exe
  C:\Windows\System\nLLPNCH.exe
  2⤵
  PID:9088
- C:\Windows\System\tdsgyhJ.exe
  C:\Windows\System\tdsgyhJ.exe
  2⤵
  PID:8432
- C:\Windows\System\FVVmqEb.exe
  C:\Windows\System\FVVmqEb.exe
  2⤵
  PID:9200
- C:\Windows\System\VqcfxWn.exe
  C:\Windows\System\VqcfxWn.exe
  2⤵
  PID:8332
- C:\Windows\System\ZntzQCE.exe
  C:\Windows\System\ZntzQCE.exe
  2⤵
  PID:8884
- C:\Windows\System\bIiBynr.exe
  C:\Windows\System\bIiBynr.exe
  2⤵
  PID:8752
- C:\Windows\System\TfzkdHC.exe
  C:\Windows\System\TfzkdHC.exe
  2⤵
  PID:8276
- C:\Windows\System\IUvdQkl.exe
  C:\Windows\System\IUvdQkl.exe
  2⤵
  PID:8816
- C:\Windows\System\NJEfMLD.exe
  C:\Windows\System\NJEfMLD.exe
  2⤵
  PID:9060
- C:\Windows\System\WflfpnB.exe
  C:\Windows\System\WflfpnB.exe
  2⤵
  PID:1580
- C:\Windows\System\qvxnmfI.exe
  C:\Windows\System\qvxnmfI.exe
  2⤵
  PID:8516
- C:\Windows\System\ieHOLJZ.exe
  C:\Windows\System\ieHOLJZ.exe
  2⤵
  PID:9024
- C:\Windows\System\trnKsNJ.exe
  C:\Windows\System\trnKsNJ.exe
  2⤵
  PID:8512
- C:\Windows\System\jPHXiPP.exe
  C:\Windows\System\jPHXiPP.exe
  2⤵
  PID:9220
- C:\Windows\System\fOHxZbx.exe
  C:\Windows\System\fOHxZbx.exe
  2⤵
  PID:9240
- C:\Windows\System\IzAUlCa.exe
  C:\Windows\System\IzAUlCa.exe
  2⤵
  PID:9256
- C:\Windows\System\YSLSmng.exe
  C:\Windows\System\YSLSmng.exe
  2⤵
  PID:9272
- C:\Windows\System\PdbDsAV.exe
  C:\Windows\System\PdbDsAV.exe
  2⤵
  PID:9288
- C:\Windows\System\fzDzGEr.exe
  C:\Windows\System\fzDzGEr.exe
  2⤵
  PID:9304
- C:\Windows\System\vPvzJMf.exe
  C:\Windows\System\vPvzJMf.exe
  2⤵
  PID:9320
- C:\Windows\System\xHAQzvi.exe
  C:\Windows\System\xHAQzvi.exe
  2⤵
  PID:9336
- C:\Windows\System\xEuKnIZ.exe
  C:\Windows\System\xEuKnIZ.exe
  2⤵
  PID:9352
- C:\Windows\System\CrxpVWF.exe
  C:\Windows\System\CrxpVWF.exe
  2⤵
  PID:9368
- C:\Windows\System\jzJlwUP.exe
  C:\Windows\System\jzJlwUP.exe
  2⤵
  PID:9384
- C:\Windows\System\AWcfXwy.exe
  C:\Windows\System\AWcfXwy.exe
  2⤵
  PID:9400
- C:\Windows\System\KjwSxDf.exe
  C:\Windows\System\KjwSxDf.exe
  2⤵
  PID:9416
- C:\Windows\System\HkpMNPZ.exe
  C:\Windows\System\HkpMNPZ.exe
  2⤵
  PID:9432
- C:\Windows\System\XqdqZwl.exe
  C:\Windows\System\XqdqZwl.exe
  2⤵
  PID:9448
- C:\Windows\System\JNfUmYx.exe
  C:\Windows\System\JNfUmYx.exe
  2⤵
  PID:9464
- C:\Windows\System\gfASAdN.exe
  C:\Windows\System\gfASAdN.exe
  2⤵
  PID:9480
- C:\Windows\System\RoUhyQS.exe
  C:\Windows\System\RoUhyQS.exe
  2⤵
  PID:9500
- C:\Windows\System\tJJhrFP.exe
  C:\Windows\System\tJJhrFP.exe
  2⤵
  PID:9516
- C:\Windows\System\RQxWjxe.exe
  C:\Windows\System\RQxWjxe.exe
  2⤵
  PID:9532
- C:\Windows\System\bJeZXtF.exe
  C:\Windows\System\bJeZXtF.exe
  2⤵
  PID:9548
- C:\Windows\System\wDlEpeT.exe
  C:\Windows\System\wDlEpeT.exe
  2⤵
  PID:9564
- C:\Windows\System\olFyPQf.exe
  C:\Windows\System\olFyPQf.exe
  2⤵
  PID:9580
- C:\Windows\System\FtQzOeK.exe
  C:\Windows\System\FtQzOeK.exe
  2⤵
  PID:9596
- C:\Windows\System\SqYlFJH.exe
  C:\Windows\System\SqYlFJH.exe
  2⤵
  PID:9612
- C:\Windows\System\oYxETdl.exe
  C:\Windows\System\oYxETdl.exe
  2⤵
  PID:9628
- C:\Windows\System\VGaeSzB.exe
  C:\Windows\System\VGaeSzB.exe
  2⤵
  PID:9644
- C:\Windows\System\VdIcIeO.exe
  C:\Windows\System\VdIcIeO.exe
  2⤵
  PID:9660
- C:\Windows\System\FcRHkKN.exe
  C:\Windows\System\FcRHkKN.exe
  2⤵
  PID:9676
- C:\Windows\System\gAsiUds.exe
  C:\Windows\System\gAsiUds.exe
  2⤵
  PID:9692
- C:\Windows\System\AFmDQXz.exe
  C:\Windows\System\AFmDQXz.exe
  2⤵
  PID:9708
- C:\Windows\System\XDLdJjK.exe
  C:\Windows\System\XDLdJjK.exe
  2⤵
  PID:9724
- C:\Windows\System\EXBDUPv.exe
  C:\Windows\System\EXBDUPv.exe
  2⤵
  PID:9740
- C:\Windows\System\sRtrtNV.exe
  C:\Windows\System\sRtrtNV.exe
  2⤵
  PID:9756
- C:\Windows\System\LYMKUxz.exe
  C:\Windows\System\LYMKUxz.exe
  2⤵
  PID:9772
- C:\Windows\System\HHqlvPm.exe
  C:\Windows\System\HHqlvPm.exe
  2⤵
  PID:9788
- C:\Windows\System\TULiGFQ.exe
  C:\Windows\System\TULiGFQ.exe
  2⤵
  PID:9804
- C:\Windows\System\LRwNMAa.exe
  C:\Windows\System\LRwNMAa.exe
  2⤵
  PID:9820
- C:\Windows\System\dLKalKf.exe
  C:\Windows\System\dLKalKf.exe
  2⤵
  PID:9836
- C:\Windows\System\ehpadWu.exe
  C:\Windows\System\ehpadWu.exe
  2⤵
  PID:9856
- C:\Windows\System\PEYIcSR.exe
  C:\Windows\System\PEYIcSR.exe
  2⤵
  PID:9872
- C:\Windows\System\sBPxnHh.exe
  C:\Windows\System\sBPxnHh.exe
  2⤵
  PID:9888
- C:\Windows\System\SSDNkCe.exe
  C:\Windows\System\SSDNkCe.exe
  2⤵
  PID:9904
- C:\Windows\System\gPqVqqv.exe
  C:\Windows\System\gPqVqqv.exe
  2⤵
  PID:9920
- C:\Windows\System\DdpeSWa.exe
  C:\Windows\System\DdpeSWa.exe
  2⤵
  PID:9936
- C:\Windows\System\sFnbAYh.exe
  C:\Windows\System\sFnbAYh.exe
  2⤵
  PID:9952
- C:\Windows\System\aTSoALt.exe
  C:\Windows\System\aTSoALt.exe
  2⤵
  PID:9968
- C:\Windows\System\VNZxdMK.exe
  C:\Windows\System\VNZxdMK.exe
  2⤵
  PID:9984
- C:\Windows\System\tEeItdL.exe
  C:\Windows\System\tEeItdL.exe
  2⤵
  PID:10000
- C:\Windows\System\zytVrMJ.exe
  C:\Windows\System\zytVrMJ.exe
  2⤵
  PID:10020
- C:\Windows\System\iecMovR.exe
  C:\Windows\System\iecMovR.exe
  2⤵
  PID:10036
- C:\Windows\System\XzUkvqF.exe
  C:\Windows\System\XzUkvqF.exe
  2⤵
  PID:10056
- C:\Windows\System\pKXNPWO.exe
  C:\Windows\System\pKXNPWO.exe
  2⤵
  PID:10076
- C:\Windows\System\kGEjIFa.exe
  C:\Windows\System\kGEjIFa.exe
  2⤵
  PID:10092
- C:\Windows\System\eAEPbYc.exe
  C:\Windows\System\eAEPbYc.exe
  2⤵
  PID:10108
- C:\Windows\System\XZIjrCm.exe
  C:\Windows\System\XZIjrCm.exe
  2⤵
  PID:10124
- C:\Windows\System\RbUtPKP.exe
  C:\Windows\System\RbUtPKP.exe
  2⤵
  PID:10140
- C:\Windows\System\fOoErOb.exe
  C:\Windows\System\fOoErOb.exe
  2⤵
  PID:10156
- C:\Windows\System\IsIBxyq.exe
  C:\Windows\System\IsIBxyq.exe
  2⤵
  PID:10172
- C:\Windows\System\QOKTAvk.exe
  C:\Windows\System\QOKTAvk.exe
  2⤵
  PID:10188
- C:\Windows\System\npGRtKR.exe
  C:\Windows\System\npGRtKR.exe
  2⤵
  PID:10204
- C:\Windows\System\MOzyDlK.exe
  C:\Windows\System\MOzyDlK.exe
  2⤵
  PID:10220
- C:\Windows\System\iFZLRzf.exe
  C:\Windows\System\iFZLRzf.exe
  2⤵
  PID:10236
- C:\Windows\System\BtardMU.exe
  C:\Windows\System\BtardMU.exe
  2⤵
  PID:9232
- C:\Windows\System\sYrCyBO.exe
  C:\Windows\System\sYrCyBO.exe
  2⤵
  PID:9296
- C:\Windows\System\hdIGAoe.exe
  C:\Windows\System\hdIGAoe.exe
  2⤵
  PID:9364
- C:\Windows\System\dnwrNyO.exe
  C:\Windows\System\dnwrNyO.exe
  2⤵
  PID:9396
- C:\Windows\System\UTQJItB.exe
  C:\Windows\System\UTQJItB.exe
  2⤵
  PID:9488
- C:\Windows\System\SLISWWC.exe
  C:\Windows\System\SLISWWC.exe
  2⤵
  PID:9524
- C:\Windows\System\JZDPMuF.exe
  C:\Windows\System\JZDPMuF.exe
  2⤵
  PID:9588
- C:\Windows\System\JaeJlYa.exe
  C:\Windows\System\JaeJlYa.exe
  2⤵
  PID:9652
- C:\Windows\System\PfHLRqO.exe
  C:\Windows\System\PfHLRqO.exe
  2⤵
  PID:9636
- C:\Windows\System\lYdopkk.exe
  C:\Windows\System\lYdopkk.exe
  2⤵
  PID:9252
- C:\Windows\System\uewLkOi.exe
  C:\Windows\System\uewLkOi.exe
  2⤵
  PID:9316
- C:\Windows\System\lfizyUW.exe
  C:\Windows\System\lfizyUW.exe
  2⤵
  PID:9376
- C:\Windows\System\cLOEzIR.exe
  C:\Windows\System\cLOEzIR.exe
  2⤵
  PID:9408
- C:\Windows\System\WBWBDjA.exe
  C:\Windows\System\WBWBDjA.exe
  2⤵
  PID:9440
- C:\Windows\System\xCMWbMv.exe
  C:\Windows\System\xCMWbMv.exe
  2⤵
  PID:9508
- C:\Windows\System\gkYjQhW.exe
  C:\Windows\System\gkYjQhW.exe
  2⤵
  PID:9572
- C:\Windows\System\VgYHJkt.exe
  C:\Windows\System\VgYHJkt.exe
  2⤵
  PID:9640
- C:\Windows\System\KQwDsRT.exe
  C:\Windows\System\KQwDsRT.exe
  2⤵
  PID:9748
- C:\Windows\System\EUHhhvB.exe
  C:\Windows\System\EUHhhvB.exe
  2⤵
  PID:9700
- C:\Windows\System\ZTmrYAQ.exe
  C:\Windows\System\ZTmrYAQ.exe
  2⤵
  PID:9704
- C:\Windows\System\pQceBfg.exe
  C:\Windows\System\pQceBfg.exe
  2⤵
  PID:9732
- C:\Windows\System\ACHwCGt.exe
  C:\Windows\System\ACHwCGt.exe
  2⤵
  PID:9880
- C:\Windows\System\agPrOMa.exe
  C:\Windows\System\agPrOMa.exe
  2⤵
  PID:9868
- C:\Windows\System\ZQQVFtW.exe
  C:\Windows\System\ZQQVFtW.exe
  2⤵
  PID:9864
- C:\Windows\System\iwsTmlK.exe
  C:\Windows\System\iwsTmlK.exe
  2⤵
  PID:9916
- C:\Windows\System\vGdjypv.exe
  C:\Windows\System\vGdjypv.exe
  2⤵
  PID:9928
- C:\Windows\System\OSwRngM.exe
  C:\Windows\System\OSwRngM.exe
  2⤵
  PID:9980
- C:\Windows\System\ASRtbel.exe
  C:\Windows\System\ASRtbel.exe
  2⤵
  PID:10044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ARNzoDD.exe

Filesize
2.1MB

MD5
63aa2eca169a2c9cf0a2271de0b15a29

SHA1
08d2a5637f552ee51b0f5c20a6b5f3177af07182

SHA256
692d01e62478522095374d0419d3e53304a8c5152e89e08616b6616cf5c02ced

SHA512
156d6efac849797d7eb6ff5ab109f92608acbd1f702d6911e00023e6ae45950df9f828b55acba31491265e7695d5b3ea09d523039de2238a9ec472562ba16450

Download Submit
C:\Windows\system\AooGqTX.exe

Filesize
2.1MB

MD5
476a31ea8ba9d28d90462e952f7fb55a

SHA1
1a87b4819384fb704d75d1986ee28d10ed8bb5cd

SHA256
0e65d358b7bf77cb85d23950d3d8d99c38380e1ddf313b7995bc80566bf75129

SHA512
4448ef3163afc4fd7af82c0b8e3283a9d43d9c5f06f548d61a2dd0f32f43ed61e40ac3c86d585ee7bad2060f55ac78dca61335c375ba769b7ac2e2d75b707e6b

Download Submit
C:\Windows\system\AtvXlgT.exe

Filesize
2.1MB

MD5
5cf4102162bd6bfc4711320fa0db11a1

SHA1
ceb048a206d54ed06951cf2ade808b0e9749bbc5

SHA256
06ccfb5247ab6379c3e2b1fca187260b2f15131ea4ab0299015fc3adfaeb2ff4

SHA512
828c4973e2ea6c72d3e9c32a5791bb2e71f7213cbd86916da29ea54b193a33f311d965134fa41a0702b513f7d1c2f4509f335a6193bc8d4e690eb3bf951c8888

Download Submit
C:\Windows\system\GOcBiIG.exe

Filesize
2.1MB

MD5
3bd4491321c2d632b1656f0e5b31e08d

SHA1
00519c0adca1433016c1d1bda760bf283953162a

SHA256
a2c222a0d314540e56a222e5ef57d22bb412a001f65e88bb5e8e83f0890f43d3

SHA512
002c7a3e2c12c1ecd2283f32b7e784bd3c0bb9ee124da0e9cd031ed75e97b3562394181936eaa61325bbd67ba6009d5e53fcd2972bdd8fe60b1d318f23c74f4c

Download Submit
C:\Windows\system\GaWNFjP.exe

Filesize
2.1MB

MD5
bcb095e181004b4b1f8b30823108e11a

SHA1
12542178b4158269a4ac7db1de07ac719464ca5d

SHA256
fe6ae0f833e2cb08094bc117bcddc65f0db7be53739c6254d0daaf705dac4ac0

SHA512
44e4a39358dd44f3e696e26c04c9a80d40c6b82f55de9f68d4aef7c33de04332581efd5556fad667d7a72f988e19583e979349556f11767e8dc7d71cb784d975

Download Submit
C:\Windows\system\IhjNacz.exe

Filesize
2.1MB

MD5
2446a942168b9143a0777ed9c97fec16

SHA1
7e1bcc0c947bd4eefa3a34609f0183d2e8a74ba6

SHA256
3deb9eca1e848610a510eb1db571ef488ca956764893d5ee724da8add91ad80d

SHA512
18e89f419d43610bad8d1d8d480122ee459ceba07db4fcdfdc0d74a228da608068127b84d61829064fbec942d51c5f51c2b98e102c5dbfd269c4a5ea61e5de65

Download Submit
C:\Windows\system\JwDsoil.exe

Filesize
2.1MB

MD5
ae8570d31a833d56bc5cc88910b12779

SHA1
d8b49a27798d0b19ad4eb128d01f1c29943efc1d

SHA256
ac3ac3c1e4b5934999895785da787c9a1c7d4e3e85ac0caa6893116393428849

SHA512
d88526a8a730b4e2838a88cd334bbaf17e1529a62f5e6a6e92b404e02130188e19afea9637c96eb386700bfdd9614b78f3b02ec643111df0bad37ea50460ec7a

Download Submit
C:\Windows\system\KvmADQT.exe

Filesize
2.1MB

MD5
7daf2bb58bc5d41e10ec33cf431b5b6d

SHA1
ebc744e32583667dbf77c36630b4dd99f757018b

SHA256
7dab7c42c2307b6404532234418f76cc1e0df719d4ed0cf9b1fb950b114bdc28

SHA512
7e5bd26f049a35e762af82918e10ca7f8c2a06cdc59bd752272852a0576038f948f576481c874d2a476f363ab61e0f82363d1c7d7d120194eb621e1d3bb83a49

Download Submit
C:\Windows\system\LpgBnxs.exe

Filesize
2.1MB

MD5
75336cc9c27a05a2d4f70755d646c83a

SHA1
91a049388d22b8a395c666bc5d9a7eef4464ac3b

SHA256
c711102452c9ca0d646990807795e65bb69801e37d8a38910efd8b81b8a5c1db

SHA512
b5b1a6c6df97f05c4350e5be898046a293e9a15889f04c3d8950d3a4f62708c8bfd586d9e063d940d1eabc9da3bdca476d9c6e76121538d088a92af5bbb11ef5

Download Submit
C:\Windows\system\OpVCNly.exe

Filesize
2.1MB

MD5
25acc9a5c90bb6f1da1b34e4cd7fc349

SHA1
726181554818adc9277c691b57eeab2ab4afffe8

SHA256
4d6c4b1c11eacda4646b6f396a5b24001d7b29c44f6ca388513379e38baca4f4

SHA512
6f9d3bb7242259cd007d1be9ed7eedb05535ba88fdf7750aca71fb3bcdf85b8c0c2cb7f46b156f68daf20aba34128fbd4e9753ea362ce482338addc0e8292acd

Download Submit
C:\Windows\system\PabKWaR.exe

Filesize
2.1MB

MD5
3aeca5dee8448fdc329029fc0d98a7cd

SHA1
5e1453768174f051803acab6455212a1b61d9a1a

SHA256
fba769a5d72fa7a1bb50145849fcda905aeba89c7c23fb715eca9b7393c99312

SHA512
0047d6acd141597796a0b4426c06eca8b79235699948931fa375c0c5e0dda7cc57c1b1311a2e102fcbb340fe1d3447f6846b2d6a25b18fe577b1b31ea356616a

Download Submit
C:\Windows\system\SlsAEJV.exe

Filesize
2.1MB

MD5
e9aceec42311ea2782f98e01006bf9ee

SHA1
824cd84a550b218a9dd06ef2e3d382b3e0e06bbd

SHA256
bb49fbaaa635bcad697bdc8b2512d8266416776ce86ac0787c678fe63cf1c9c6

SHA512
2d1eca390d5c413bcf2390d3779265176c1dd6dd5dc0836ff932f8f96521f146543dc5f230deb2727713adb87c5132269a182dd71a7c54a0f86f80df54540157

Download Submit
C:\Windows\system\VBPMTGd.exe

Filesize
2.1MB

MD5
2f1811c7f09e616835ee8eff0a0357d5

SHA1
877be3129f058106ebb868fd084f6565a53ac517

SHA256
f4a991a93028912ea8d3fc79c3551e5196db26e4f39828eae6f68fb893634aed

SHA512
776671479653ab8caa4034ce7b369c69a0336eb3e535431b62708bdc5de7b94ebe761caf279155d3fafcae4db08918e8cc0c1cd2bad142ea0479bbaf81f37381

Download Submit
C:\Windows\system\XIVezke.exe

Filesize
2.1MB

MD5
dbc8356022d30b38338b74cff3e457a1

SHA1
dbde26460a4bc93e74191619d14aa0fa68d10d47

SHA256
d50b10d6840a09db3e5e9092ae0926fe26f68af33a6b32aac431b46fc9a1fdbb

SHA512
3ec51aa4efbe1bb9b044121a120b3c58b459e38ec9f2d6d0355595f819c39be3f8aa602b3d96ccbe8f60f7f5386eb8080a392dd01ff1e38f9c7327b836ed5a17

Download Submit
C:\Windows\system\YvnJOni.exe

Filesize
2.1MB

MD5
dbf6b29850d5b95cc74aa04c9ac27904

SHA1
d186b7d5536d48a7e272559aaa3a246996f35316

SHA256
f06d95883dc78d8ad970e9aa11ac89dfa202773a30ac7fc1505b2e8a24ed14ca

SHA512
79fd6c1f52691181a507d1ebdd1f02ef7bf5ce1610c540667d35354ec9864d356ccd581c0d2807cb8b1dca2a8d633928bbbfcc1bf933ed333c1fa2349377987a

Download Submit
C:\Windows\system\dBnCDCt.exe

Filesize
2.1MB

MD5
6933bc5d0d1a740dbeba14c23a6c73a5

SHA1
8739f183efd4f07e502cab200e445d41eb66007a

SHA256
c76b9d35063906856c0dfc52a301e3039dd3890d45ddefd312db38b8ab00c434

SHA512
0c968ef96d6dd21c62210097d662a649fe1dee48f5a493ebd443d77eb3baad15d990032c9277aec41ca63d286a2c59f0f6b8266b5778edce624e9927429039dc

Download Submit
C:\Windows\system\eEmpPtr.exe

Filesize
2.1MB

MD5
777e602bf64854ee8e963514bbfce881

SHA1
a864bbb2ae9c97ae05acec4d9e5191a76e60d03d

SHA256
30dd1a19a0a77a391ccd67d8e30840668ee38b585e77d03b1aa99afc454d3043

SHA512
eec785e3787f3eef587ded0f78346b378fe0e2dcbafc3d66c30f621663e4d1ddc3c3daebf796520b658ffb122c35775eec6728c2239b0d35cd9b121a755a682d

Download Submit
C:\Windows\system\fpDkmpt.exe

Filesize
2.1MB

MD5
5925f71c4c6bcf549d595faf5014e530

SHA1
bcdb005ebf5229ace09c87927a466260cb611db0

SHA256
ce3982f1fe5d332e0fd108cd47920972431376e1a276a97710aad8f860853882

SHA512
8b820535e4c2f4914520dca5770c16e588420a342743ab218c18c275b4929ea06ba209f9e08392988d0168af1ba41dff39dc2e6f976819096db21768fe1f473d

Download Submit
C:\Windows\system\fvhVofD.exe

Filesize
2.1MB

MD5
4cf11adf1236a57942880152f25d4b35

SHA1
93e74d76781af06d38c92e503991be803f8d00b3

SHA256
3dfe9fc021e9eda4bbb6a8bff7af61891a8d3f0ede64995fe2dc51ddc07c4b61

SHA512
234228a7b45d717eb4ec8f086ab707d6f0f6746418398595f7caefc5a97042aea23cc5664d0fc335961439f0ee0472c46f5f468ede598603090709313073281b

Download Submit
C:\Windows\system\isiFhWq.exe

Filesize
2.1MB

MD5
7ea60022c327aab59b9e29c71593fc1e

SHA1
e3270e0453aa57622d8585da0cf65b76704eb45b

SHA256
c65294a6ba51a0b99e4a4046d3f43cc949564cf447df793f51c4b5ce5ca21a9c

SHA512
36c7ef4250c8effadfbba01abfc89a84bea45d5b8fcba9745b76b5f9e89199ef26eb18144fcf1c07afb481c2a8a2b813b2803dde2d40f4d541e2fb28b75f4e40

Download Submit
C:\Windows\system\mOPVZxL.exe

Filesize
2.1MB

MD5
bc62e7d9421d562acd40b80a2d1ba494

SHA1
834018824ca83cb13d521da3f92675678b1b362c

SHA256
b700bfba15e8e600c75848f39a5c1d39430ac2af3923aa64a6eef6d431a3f373

SHA512
941b65dff4638ce89e68820617fac72e25a5dd4efaefca476169520524ed35a498db6e831d63409756f9f23032e5a7082cb313e18f441e90ea0c1a22999cae8a

Download Submit
C:\Windows\system\nJKVmSn.exe

Filesize
2.1MB

MD5
89d892110d551b5853eab68278e0a87a

SHA1
7d91b985ede9045e08daa673fa4462c86f46d572

SHA256
03bc425fc15d85af68af219411da35e745fcf32447caafa4af817633d97854b6

SHA512
49056491cb631ceb78d94b2dda887dd15b041d32b9a17e32d0b1b60e5a03758f0b0ccb07a47fdc0c6a15e3a032b628c299b748412ce2a168400f14d158e1f9ad

Download Submit
C:\Windows\system\rHLEjDS.exe

Filesize
2.1MB

MD5
c1f0a5cf73b020f288b0161432c813b4

SHA1
960748aafc59ed321bed12e31361cadb9b33ccdf

SHA256
339a2d847766a72955f9200388964ed02113ec8fb4da643ca9e4b71d4792b3f6

SHA512
a26145a2c293db3733fd382eef2655f0b4965bdae469646fcb3c9d43f8159295eac318569141fd0743e36c515460e1ed1dd3d516988807b871e66a622305888a

Download Submit
C:\Windows\system\uJBpQZU.exe

Filesize
2.1MB

MD5
94b8d710375a68b167ced6c2af729178

SHA1
8314225c2b4458deccc9787f63c513f6846e7790

SHA256
f664b1af45091cc9732325250e3717e5cc527c4ed3d52454bc8c40c6a2fef317

SHA512
fb4cae619c582d5aa8d726fc77893453fc7d526a4980c6a52b6e60c7b5934e10e82eac9995726f965b7ba881b2f8757dc82f92d31d3efabb66f6d9dd6eb250a1

Download Submit
C:\Windows\system\wIojptJ.exe

Filesize
2.1MB

MD5
71eb4bd75478d69f05d243912fbd1689

SHA1
6f8d5b32a24be480e6b0a6457afaeb51ead4e90c

SHA256
29697544b32c3062ecd27918aea1a67953338299e404eced674fc409cdae258a

SHA512
9233fc473036e1c1db4e157537a0d525c8d55e772a3efe4696237688a41e2a642a503eb792ce6c57a768b3e4bbab82f9897bc3f69b19a3bf2af70ce0e0f6cf77

Download Submit
C:\Windows\system\yIWhavB.exe

Filesize
2.1MB

MD5
8e5f6177f5565985f3b965e6dab3962c

SHA1
0b7aaade85759ba68846ff1f416ed1b9456127c8

SHA256
e817427fb1d1c0a628dafd451ab461d6c487e221fc9b49d5b8c3500bcd1a5a20

SHA512
fa8f664e8bf3246a8e702ce6defe2f3c6ed44376fe7daa12783f4622a0766543ae3fe4ebfb151be753ce36526164b465eea734b3fbca77be326b825a5fdbd571

Download Submit
\Windows\system\AflDKvp.exe

Filesize
2.1MB

MD5
195af901a4889615ee404e0b88167e64

SHA1
01c1f62c9a33eaded3ed6ab73d1c79a939f1e966

SHA256
c43786878b417fa9d7631a82f106b405474c3cce9ace627f7602b3c845a1f1d7

SHA512
2acc16795e76f81d53eb23bd2ec9957f656b6cef63072cad164e64a80b51f395d29f0ba8f3dbfd3d64ba1efb490aa73f95ca45de1fd149f07eb2cba39da7c775

Download Submit
\Windows\system\htAguFk.exe

Filesize
2.1MB

MD5
4ed99a002166d23b1be7fa97c3d80bf9

SHA1
3c3d4c6afd1fda349e0cedd2366389afbaa01017

SHA256
a852ef8f6247700a3f5c0037270a2424e383bfeebe0c799f4a1bc1ecd2af9578

SHA512
95e35b48195f9e6c7b4f78b1b3b306fb16a422798ecbc5b5b4d327c1da21dd7f73ccc3b2f63df2cde94452f110c7ff8102392c58334cfa4b742c449ecb83e898

Download Submit
\Windows\system\jLreInC.exe

Filesize
2.1MB

MD5
4fb06b035469e5963cac5f243b1304dc

SHA1
e32afa14ef277c632c10ced6eb77826254c67b0b

SHA256
01b218ef2f47e2c76d74e311bf689382de9636c3031dbdb79304c8b7776a7084

SHA512
02e6e8bc7c50a5f4462c4cca740d823d8ac4cb0b4501eae5a9b41b03ea28d56190dd74bdf82299ff97e2303a3b236a5b924df100fbad76dce2fff7112572a8fd

Download Submit
\Windows\system\mjlzlln.exe

Filesize
2.1MB

MD5
6f92f7ddeac0f29554eb8b2573db3a44

SHA1
8bdc607e0d9ecb2bc5c041e7145ad1f95d44b8ac

SHA256
b3faefbe61910de7a563d870da417ebe3fc0633ecf9e9571c0b3e7b675166585

SHA512
482419d0b17ebfceac589858fb6c405493054ae1ed3fa11502e6fadeb8dee9e04228dd2e3338869d18ebe45bf04cb0421637d9f844e0feccc00643b623aaedf7

Download Submit
\Windows\system\vpQcIdQ.exe

Filesize
2.1MB

MD5
b5feb1f9154133052b832188f77285db

SHA1
58fc5e5b980757842fe2bd612aefea436a8f14ea

SHA256
55aea4f05da6017f3527ed8553b31aa7bceab3d68201f733a83c9479235778e4

SHA512
8c52ef7040cd748dc92f56c0f77ff1445b2e1b7f1bc03fff22c1abd681817bfb6487699e8edd4a29ee55618f7960637951194120ef7afa3fbbd6bda019477a2c

Download Submit
\Windows\system\xnVrtTr.exe

Filesize
2.1MB

MD5
240231d6080721921dea18300c1e487a

SHA1
7859733f6f46135a302a2fc4fa56266dcc43aedd

SHA256
552fb55ebec65edb5b240b28f473b9811e7990d8aef699240f6365473e5194e4

SHA512
5e9f3ecbf5f85f3e4122951dd5a3079ffbcc6041301cebfd8a9a503a4ffcdfc025b8c9b3db7a826467deea06c2c8f82b5f308c6fa9376657dc2524a4935d73a4

Download Submit
memory/868-138-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/868-5314-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/1916-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1916-5323-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-8-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-28-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-139-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/1940-141-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-137-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-17-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-135-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-116-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-0-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/1940-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1940-125-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-118-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/1940-130-0x0000000003160000-0x0000000003552000-memory.dmp

Filesize
3.9MB

Download
memory/1940-132-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2056-26-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2056-5290-0x000000013F6D0000-0x000000013FAC2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-136-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-5295-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-133-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2476-5331-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2480-117-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2480-5292-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2500-131-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2500-5291-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2596-5293-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-144-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-5289-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2620-126-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2656-121-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2656-5313-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2668-5294-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2668-143-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2916-113-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-30-0x000007FEF54DE000-0x000007FEF54DF000-memory.dmp

Filesize
4KB

Download
memory/2916-101-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/2916-93-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2916-182-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-114-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

Filesize
9.6MB

Download
memory/2916-115-0x000007FEF5220000-0x000007FEF5BBD000-memory.dmp

Filesize
9.6MB

Download
memory/2960-5288-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-9-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download