xmrig | b1e13a4686e82a5bf9f9a4746e9f0b9e551d68f7c73ade85634062c1ba7ad1fe

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
Size

2.3MB
MD5

3c7b11a7b7f4549d9bc7624290e2844c
SHA1

96d88e73bdbf0bf63a3c6ccba116ee487f3560ff
SHA256

b1e13a4686e82a5bf9f9a4746e9f0b9e551d68f7c73ade85634062c1ba7ad1fe
SHA512

026b115b138715a6e124ef90482e2955165ae69e375703ae86f5c4981380c0b4f1e3f67d4079b11ae1268a1a4b0d162cf60c6e8bad273b68d238ee39f529839d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrT:NABK

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 17 IoCs

miner

resource	yara_rule
behavioral1/memory/2616-9-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2484-120-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2520-107-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2756-105-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/1936-31-0x0000000003420000-0x0000000003812000-memory.dmp	xmrig
behavioral1/memory/2740-29-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2756-3462-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2616-3473-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2520-3488-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/2740-3483-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2576-4081-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2548-4077-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2472-4084-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2484-4083-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/1928-4090-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/3020-4096-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2700-4085-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2584	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2616	oMEZObY.exe
2740	XnkgPTP.exe
2756	KDuCsdq.exe
2484	bBryYyk.exe
2520	VvUtFIf.exe
2472	EuShZDI.exe
2548	bsMfwsH.exe
3020	sGRfFAn.exe
2988	TaOnWsd.exe
1928	DTTfOLJ.exe
2576	Yazzewi.exe
2700	KRVAUMX.exe
2792	yDFWwSB.exe
2856	FNoCoik.exe
1604	RvlQWNL.exe
2964	AKqKgkH.exe
1912	XThOgvG.exe
2176	IlUpaeR.exe
2160	IHrToOt.exe
796	CyYDEov.exe
1596	ygAxyVj.exe
2264	IIQJORy.exe
1624	rFgPxVw.exe
1840	dIoVTYE.exe
2016	FOkBatk.exe
264	GueqoIz.exe
764	aRNpNnq.exe
580	bZnHaWA.exe
2892	RrlckSb.exe
1428	GqbZIOS.exe
1736	lMBgVkj.exe
1544	LzgjlAn.exe
2332	Naeekfj.exe
692	QMdEVAv.exe
2444	FvskARh.exe
1312	cIJvJbz.exe
1196	JsKtZRA.exe
1008	bPtrzmN.exe
1212	mMxJSvl.exe
1208	wrLnwpz.exe
1956	puTuCUc.exe
1284	SzOMaKq.exe
2228	MEhDTiu.exe
2128	ldpTnXs.exe
2100	ebIHXVN.exe
2316	wLryciW.exe
1940	zBjwaSz.exe
2460	WYSiYuE.exe
2864	kvrEwqP.exe
2804	WxSAeeI.exe
2024	RrmgPLB.exe
2496	VkQePAH.exe
2908	LicHoWN.exe
1472	ZJlxNLW.exe
1632	vnUStit.exe
2820	zrolrYN.exe
2868	nhcLwCf.exe
2480	DKBWZtF.exe
2784	XToIPcw.exe
1504	ESrEnFu.exe
1200	zadLZzb.exe
2976	CfioeUm.exe
2968	UBnARxl.exe
1256	gYLASeQ.exe

Loads dropped DLL 64 IoCs

pid	Process
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe

UPX packed file 56 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-0-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x000c00000001226d-6.dat	upx
behavioral1/memory/2616-9-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0007000000015ce2-15.dat	upx
behavioral1/files/0x0008000000015cbf-16.dat	upx
behavioral1/files/0x000f000000003683-37.dat	upx
behavioral1/files/0x0037000000015bc7-10.dat	upx
behavioral1/files/0x0008000000015d09-47.dat	upx
behavioral1/files/0x0006000000016824-54.dat	upx
behavioral1/files/0x0006000000016c4a-62.dat	upx
behavioral1/files/0x0006000000016d22-90.dat	upx
behavioral1/files/0x0006000000016d44-124.dat	upx
behavioral1/files/0x0006000000016d70-147.dat	upx
behavioral1/files/0x0006000000016dc8-163.dat	upx
behavioral1/files/0x0006000000016db2-159.dat	upx
behavioral1/files/0x0006000000016da0-155.dat	upx
behavioral1/files/0x0006000000016d78-151.dat	upx
behavioral1/files/0x0006000000016d6c-143.dat	upx
behavioral1/files/0x0006000000016d68-139.dat	upx
behavioral1/files/0x0006000000016d55-135.dat	upx
behavioral1/files/0x0006000000016d4c-131.dat	upx
behavioral1/files/0x0037000000015c82-127.dat	upx
behavioral1/memory/2484-120-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/files/0x0006000000016d33-98.dat	upx
behavioral1/memory/2700-119-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2576-118-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/1928-116-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/2988-114-0x000000013F240000-0x000000013F632000-memory.dmp	upx
behavioral1/memory/3020-112-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2548-111-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2472-109-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2520-107-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2756-105-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x0006000000016d3b-102.dat	upx
behavioral1/files/0x0006000000016d2b-94.dat	upx
behavioral1/files/0x0006000000016d1a-86.dat	upx
behavioral1/files/0x0006000000016d05-82.dat	upx
behavioral1/files/0x0006000000016cde-78.dat	upx
behavioral1/files/0x0006000000016caf-74.dat	upx
behavioral1/files/0x0006000000016c67-70.dat	upx
behavioral1/files/0x0006000000016c5d-66.dat	upx
behavioral1/files/0x0006000000016a7d-58.dat	upx
behavioral1/files/0x00070000000165d4-50.dat	upx
behavioral1/files/0x0008000000015cf3-43.dat	upx
behavioral1/memory/2740-29-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2756-3462-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/memory/2616-3473-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2520-3488-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/2740-3483-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/2576-4081-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2548-4077-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2472-4084-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2484-4083-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/1928-4090-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/memory/3020-4096-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2700-4085-0x000000013F020000-0x000000013F412000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fnshENC.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\GcjoxqE.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\IZWgSzd.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\ZuGriBG.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\pklTDIW.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\bwiCRSL.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\kVlJKkM.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\dVKvZai.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\RsxDvkj.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\aaSbdRo.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\CotWUgo.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\aAHQPKf.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\orUFidF.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\jbPbjEh.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\xsVbqvk.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\oKtjkdA.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\sJTjYfk.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\FKNPfYn.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\vfyQFsS.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\mHqyVeC.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\gzziAfi.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\HFkxNGx.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\kGYcqdE.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\IiWPADh.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\SnnqGPH.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\fvcrcHt.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\sEPmGLJ.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\zrolrYN.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\LoSVXPd.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\wTsSNgo.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\xtbCnCA.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\GQzMnFT.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\nldFgqt.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\ioKVDnH.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\NtaRIcc.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\dhYrXaL.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\jzVKzFY.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\wcqpZNE.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\KRVAUMX.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\RDjLytZ.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\TYuLqiR.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\czwRooI.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\TlexkwN.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\KvrOzSZ.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\JOzIcZA.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\iROQbFa.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\YJIYYgn.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\CdZGCQV.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\WuTQvmi.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\ZPwCQWx.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\bjjeANx.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\DzbRsWR.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\gInXEmG.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\ChLGBgl.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\YJbTqtS.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\yDneKTY.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\IfJTMmq.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\SOxNZjt.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\omaUJhh.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\jMzefhO.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\SyoUVqN.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\IPgWXPw.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\guxhrnm.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
File created	C:\Windows\System\wJvzuJy.exe	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2584	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
Token: SeDebugPrivilege	2584	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2584	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2584	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2584	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	29
PID 1936 wrote to memory of 2616	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2616	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2616	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	30
PID 1936 wrote to memory of 2756	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2756	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2756	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	31
PID 1936 wrote to memory of 2740	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2740	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2740	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	32
PID 1936 wrote to memory of 2484	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2484	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2484	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	33
PID 1936 wrote to memory of 2520	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2520	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2520	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	34
PID 1936 wrote to memory of 2472	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2472	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2472	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	35
PID 1936 wrote to memory of 2548	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2548	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	36
PID 1936 wrote to memory of 2548	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	36
PID 1936 wrote to memory of 3020	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	37
PID 1936 wrote to memory of 3020	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	37
PID 1936 wrote to memory of 3020	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	37
PID 1936 wrote to memory of 2988	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2988	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	38
PID 1936 wrote to memory of 2988	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	38
PID 1936 wrote to memory of 1928	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	39
PID 1936 wrote to memory of 1928	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	39
PID 1936 wrote to memory of 1928	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	39
PID 1936 wrote to memory of 2576	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2576	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2576	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	40
PID 1936 wrote to memory of 2700	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2700	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2700	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	41
PID 1936 wrote to memory of 2792	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2792	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2792	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	42
PID 1936 wrote to memory of 2856	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2856	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	43
PID 1936 wrote to memory of 2856	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	43
PID 1936 wrote to memory of 1604	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	44
PID 1936 wrote to memory of 1604	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	44
PID 1936 wrote to memory of 1604	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	44
PID 1936 wrote to memory of 2964	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2964	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	45
PID 1936 wrote to memory of 2964	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	45
PID 1936 wrote to memory of 1912	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1912	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	46
PID 1936 wrote to memory of 1912	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	46
PID 1936 wrote to memory of 2176	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	47
PID 1936 wrote to memory of 2176	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	47
PID 1936 wrote to memory of 2176	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	47
PID 1936 wrote to memory of 2160	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	48
PID 1936 wrote to memory of 2160	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	48
PID 1936 wrote to memory of 2160	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	48
PID 1936 wrote to memory of 796	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	49
PID 1936 wrote to memory of 796	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	49
PID 1936 wrote to memory of 796	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	49
PID 1936 wrote to memory of 1596	1936	3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c7b11a7b7f4549d9bc7624290e2844c_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\System\oMEZObY.exe
  C:\Windows\System\oMEZObY.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\KDuCsdq.exe
  C:\Windows\System\KDuCsdq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\XnkgPTP.exe
  C:\Windows\System\XnkgPTP.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\bBryYyk.exe
  C:\Windows\System\bBryYyk.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\VvUtFIf.exe
  C:\Windows\System\VvUtFIf.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\EuShZDI.exe
  C:\Windows\System\EuShZDI.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\bsMfwsH.exe
  C:\Windows\System\bsMfwsH.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\sGRfFAn.exe
  C:\Windows\System\sGRfFAn.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\TaOnWsd.exe
  C:\Windows\System\TaOnWsd.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\DTTfOLJ.exe
  C:\Windows\System\DTTfOLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\Yazzewi.exe
  C:\Windows\System\Yazzewi.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\KRVAUMX.exe
  C:\Windows\System\KRVAUMX.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\yDFWwSB.exe
  C:\Windows\System\yDFWwSB.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\FNoCoik.exe
  C:\Windows\System\FNoCoik.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\RvlQWNL.exe
  C:\Windows\System\RvlQWNL.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\AKqKgkH.exe
  C:\Windows\System\AKqKgkH.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\XThOgvG.exe
  C:\Windows\System\XThOgvG.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\IlUpaeR.exe
  C:\Windows\System\IlUpaeR.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\IHrToOt.exe
  C:\Windows\System\IHrToOt.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\CyYDEov.exe
  C:\Windows\System\CyYDEov.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\ygAxyVj.exe
  C:\Windows\System\ygAxyVj.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\IIQJORy.exe
  C:\Windows\System\IIQJORy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\rFgPxVw.exe
  C:\Windows\System\rFgPxVw.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\dIoVTYE.exe
  C:\Windows\System\dIoVTYE.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\FOkBatk.exe
  C:\Windows\System\FOkBatk.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\GueqoIz.exe
  C:\Windows\System\GueqoIz.exe
  2⤵
  - Executes dropped EXE
  PID:264
- C:\Windows\System\aRNpNnq.exe
  C:\Windows\System\aRNpNnq.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\bZnHaWA.exe
  C:\Windows\System\bZnHaWA.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\RrlckSb.exe
  C:\Windows\System\RrlckSb.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\GqbZIOS.exe
  C:\Windows\System\GqbZIOS.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\lMBgVkj.exe
  C:\Windows\System\lMBgVkj.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\LzgjlAn.exe
  C:\Windows\System\LzgjlAn.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\Naeekfj.exe
  C:\Windows\System\Naeekfj.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\QMdEVAv.exe
  C:\Windows\System\QMdEVAv.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\FvskARh.exe
  C:\Windows\System\FvskARh.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\cIJvJbz.exe
  C:\Windows\System\cIJvJbz.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\JsKtZRA.exe
  C:\Windows\System\JsKtZRA.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\bPtrzmN.exe
  C:\Windows\System\bPtrzmN.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\mMxJSvl.exe
  C:\Windows\System\mMxJSvl.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\wrLnwpz.exe
  C:\Windows\System\wrLnwpz.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\puTuCUc.exe
  C:\Windows\System\puTuCUc.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\SzOMaKq.exe
  C:\Windows\System\SzOMaKq.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\MEhDTiu.exe
  C:\Windows\System\MEhDTiu.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ldpTnXs.exe
  C:\Windows\System\ldpTnXs.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\ebIHXVN.exe
  C:\Windows\System\ebIHXVN.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\RrmgPLB.exe
  C:\Windows\System\RrmgPLB.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\wLryciW.exe
  C:\Windows\System\wLryciW.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\LicHoWN.exe
  C:\Windows\System\LicHoWN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\zBjwaSz.exe
  C:\Windows\System\zBjwaSz.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\ZJlxNLW.exe
  C:\Windows\System\ZJlxNLW.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\WYSiYuE.exe
  C:\Windows\System\WYSiYuE.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\vnUStit.exe
  C:\Windows\System\vnUStit.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\kvrEwqP.exe
  C:\Windows\System\kvrEwqP.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\zrolrYN.exe
  C:\Windows\System\zrolrYN.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\WxSAeeI.exe
  C:\Windows\System\WxSAeeI.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\nhcLwCf.exe
  C:\Windows\System\nhcLwCf.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\VkQePAH.exe
  C:\Windows\System\VkQePAH.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\DKBWZtF.exe
  C:\Windows\System\DKBWZtF.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\XToIPcw.exe
  C:\Windows\System\XToIPcw.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\ESrEnFu.exe
  C:\Windows\System\ESrEnFu.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\zadLZzb.exe
  C:\Windows\System\zadLZzb.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\CfioeUm.exe
  C:\Windows\System\CfioeUm.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\UBnARxl.exe
  C:\Windows\System\UBnARxl.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\gYLASeQ.exe
  C:\Windows\System\gYLASeQ.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\OLCTemX.exe
  C:\Windows\System\OLCTemX.exe
  2⤵
  PID:1400
- C:\Windows\System\NwcGkEJ.exe
  C:\Windows\System\NwcGkEJ.exe
  2⤵
  PID:2896
- C:\Windows\System\uHFGLnQ.exe
  C:\Windows\System\uHFGLnQ.exe
  2⤵
  PID:1700
- C:\Windows\System\VxZgRDU.exe
  C:\Windows\System\VxZgRDU.exe
  2⤵
  PID:404
- C:\Windows\System\GQXFyeA.exe
  C:\Windows\System\GQXFyeA.exe
  2⤵
  PID:3048
- C:\Windows\System\aQzWIlY.exe
  C:\Windows\System\aQzWIlY.exe
  2⤵
  PID:1656
- C:\Windows\System\QOLNuaz.exe
  C:\Windows\System\QOLNuaz.exe
  2⤵
  PID:1016
- C:\Windows\System\oyEeqEY.exe
  C:\Windows\System\oyEeqEY.exe
  2⤵
  PID:1784
- C:\Windows\System\tTAWuEE.exe
  C:\Windows\System\tTAWuEE.exe
  2⤵
  PID:2268
- C:\Windows\System\doaARty.exe
  C:\Windows\System\doaARty.exe
  2⤵
  PID:888
- C:\Windows\System\pYgwEwh.exe
  C:\Windows\System\pYgwEwh.exe
  2⤵
  PID:1528
- C:\Windows\System\DqTJkIu.exe
  C:\Windows\System\DqTJkIu.exe
  2⤵
  PID:1944
- C:\Windows\System\oTEMPwC.exe
  C:\Windows\System\oTEMPwC.exe
  2⤵
  PID:2380
- C:\Windows\System\LFIcONk.exe
  C:\Windows\System\LFIcONk.exe
  2⤵
  PID:2808
- C:\Windows\System\ZdSOeZR.exe
  C:\Windows\System\ZdSOeZR.exe
  2⤵
  PID:344
- C:\Windows\System\CuHWRio.exe
  C:\Windows\System\CuHWRio.exe
  2⤵
  PID:944
- C:\Windows\System\mdqwIff.exe
  C:\Windows\System\mdqwIff.exe
  2⤵
  PID:2224
- C:\Windows\System\PLsjgWY.exe
  C:\Windows\System\PLsjgWY.exe
  2⤵
  PID:2556
- C:\Windows\System\MqwoUlt.exe
  C:\Windows\System\MqwoUlt.exe
  2⤵
  PID:2612
- C:\Windows\System\zpUYXAq.exe
  C:\Windows\System\zpUYXAq.exe
  2⤵
  PID:1640
- C:\Windows\System\JiBWZnb.exe
  C:\Windows\System\JiBWZnb.exe
  2⤵
  PID:2236
- C:\Windows\System\MOpXZcw.exe
  C:\Windows\System\MOpXZcw.exe
  2⤵
  PID:2716
- C:\Windows\System\HkjHvAu.exe
  C:\Windows\System\HkjHvAu.exe
  2⤵
  PID:328
- C:\Windows\System\lRZHqwC.exe
  C:\Windows\System\lRZHqwC.exe
  2⤵
  PID:2692
- C:\Windows\System\FByayvP.exe
  C:\Windows\System\FByayvP.exe
  2⤵
  PID:1420
- C:\Windows\System\ZNIiqBi.exe
  C:\Windows\System\ZNIiqBi.exe
  2⤵
  PID:1904
- C:\Windows\System\oRtFXGP.exe
  C:\Windows\System\oRtFXGP.exe
  2⤵
  PID:1996
- C:\Windows\System\mrVDzcj.exe
  C:\Windows\System\mrVDzcj.exe
  2⤵
  PID:2064
- C:\Windows\System\zKxsFqV.exe
  C:\Windows\System\zKxsFqV.exe
  2⤵
  PID:1396
- C:\Windows\System\KvrOzSZ.exe
  C:\Windows\System\KvrOzSZ.exe
  2⤵
  PID:2320
- C:\Windows\System\yiwgIeg.exe
  C:\Windows\System\yiwgIeg.exe
  2⤵
  PID:1952
- C:\Windows\System\vsytbzP.exe
  C:\Windows\System\vsytbzP.exe
  2⤵
  PID:1460
- C:\Windows\System\vXlwaVg.exe
  C:\Windows\System\vXlwaVg.exe
  2⤵
  PID:1124
- C:\Windows\System\cENqHvd.exe
  C:\Windows\System\cENqHvd.exe
  2⤵
  PID:2748
- C:\Windows\System\tCOMfBm.exe
  C:\Windows\System\tCOMfBm.exe
  2⤵
  PID:1668
- C:\Windows\System\aikxgHF.exe
  C:\Windows\System\aikxgHF.exe
  2⤵
  PID:2532
- C:\Windows\System\QnFEjKe.exe
  C:\Windows\System\QnFEjKe.exe
  2⤵
  PID:880
- C:\Windows\System\ursVcYH.exe
  C:\Windows\System\ursVcYH.exe
  2⤵
  PID:1348
- C:\Windows\System\GKDaMOZ.exe
  C:\Windows\System\GKDaMOZ.exe
  2⤵
  PID:2188
- C:\Windows\System\Wescbor.exe
  C:\Windows\System\Wescbor.exe
  2⤵
  PID:2340
- C:\Windows\System\CkzMhdX.exe
  C:\Windows\System\CkzMhdX.exe
  2⤵
  PID:2872
- C:\Windows\System\sKYyleP.exe
  C:\Windows\System\sKYyleP.exe
  2⤵
  PID:1620
- C:\Windows\System\AcWAahu.exe
  C:\Windows\System\AcWAahu.exe
  2⤵
  PID:2676
- C:\Windows\System\pSurLoU.exe
  C:\Windows\System\pSurLoU.exe
  2⤵
  PID:1584
- C:\Windows\System\uaxrswi.exe
  C:\Windows\System\uaxrswi.exe
  2⤵
  PID:1916
- C:\Windows\System\ajRNNLd.exe
  C:\Windows\System\ajRNNLd.exe
  2⤵
  PID:696
- C:\Windows\System\wolMAGO.exe
  C:\Windows\System\wolMAGO.exe
  2⤵
  PID:3084
- C:\Windows\System\xExINzv.exe
  C:\Windows\System\xExINzv.exe
  2⤵
  PID:3104
- C:\Windows\System\aeuQDRO.exe
  C:\Windows\System\aeuQDRO.exe
  2⤵
  PID:3124
- C:\Windows\System\eqCtyXk.exe
  C:\Windows\System\eqCtyXk.exe
  2⤵
  PID:3144
- C:\Windows\System\zOQaLyz.exe
  C:\Windows\System\zOQaLyz.exe
  2⤵
  PID:3164
- C:\Windows\System\xcRNChS.exe
  C:\Windows\System\xcRNChS.exe
  2⤵
  PID:3184
- C:\Windows\System\eZwtQTI.exe
  C:\Windows\System\eZwtQTI.exe
  2⤵
  PID:3200
- C:\Windows\System\XTWwEWp.exe
  C:\Windows\System\XTWwEWp.exe
  2⤵
  PID:3224
- C:\Windows\System\IcwAEjn.exe
  C:\Windows\System\IcwAEjn.exe
  2⤵
  PID:3240
- C:\Windows\System\Rtnvmnd.exe
  C:\Windows\System\Rtnvmnd.exe
  2⤵
  PID:3260
- C:\Windows\System\APxaPHu.exe
  C:\Windows\System\APxaPHu.exe
  2⤵
  PID:3280
- C:\Windows\System\unTWbwp.exe
  C:\Windows\System\unTWbwp.exe
  2⤵
  PID:3304
- C:\Windows\System\NkPbJBG.exe
  C:\Windows\System\NkPbJBG.exe
  2⤵
  PID:3324
- C:\Windows\System\SscKwop.exe
  C:\Windows\System\SscKwop.exe
  2⤵
  PID:3344
- C:\Windows\System\ntIQJno.exe
  C:\Windows\System\ntIQJno.exe
  2⤵
  PID:3360
- C:\Windows\System\Nhavtap.exe
  C:\Windows\System\Nhavtap.exe
  2⤵
  PID:3380
- C:\Windows\System\ZzAoNGH.exe
  C:\Windows\System\ZzAoNGH.exe
  2⤵
  PID:3396
- C:\Windows\System\cuSStqS.exe
  C:\Windows\System\cuSStqS.exe
  2⤵
  PID:3416
- C:\Windows\System\MOGmpQS.exe
  C:\Windows\System\MOGmpQS.exe
  2⤵
  PID:3444
- C:\Windows\System\fLKuEPe.exe
  C:\Windows\System\fLKuEPe.exe
  2⤵
  PID:3464
- C:\Windows\System\HulHsLr.exe
  C:\Windows\System\HulHsLr.exe
  2⤵
  PID:3480
- C:\Windows\System\UeCfdbX.exe
  C:\Windows\System\UeCfdbX.exe
  2⤵
  PID:3500
- C:\Windows\System\dFPwsNr.exe
  C:\Windows\System\dFPwsNr.exe
  2⤵
  PID:3524
- C:\Windows\System\WqfFLCQ.exe
  C:\Windows\System\WqfFLCQ.exe
  2⤵
  PID:3544
- C:\Windows\System\PFAxTCS.exe
  C:\Windows\System\PFAxTCS.exe
  2⤵
  PID:3560
- C:\Windows\System\gpnVQzw.exe
  C:\Windows\System\gpnVQzw.exe
  2⤵
  PID:3580
- C:\Windows\System\sJTjYfk.exe
  C:\Windows\System\sJTjYfk.exe
  2⤵
  PID:3604
- C:\Windows\System\XBFGkEh.exe
  C:\Windows\System\XBFGkEh.exe
  2⤵
  PID:3624
- C:\Windows\System\OJEMHFO.exe
  C:\Windows\System\OJEMHFO.exe
  2⤵
  PID:3640
- C:\Windows\System\yrmMUHd.exe
  C:\Windows\System\yrmMUHd.exe
  2⤵
  PID:3660
- C:\Windows\System\qZHiibl.exe
  C:\Windows\System\qZHiibl.exe
  2⤵
  PID:3684
- C:\Windows\System\GpGrEuY.exe
  C:\Windows\System\GpGrEuY.exe
  2⤵
  PID:3704
- C:\Windows\System\CNwZANn.exe
  C:\Windows\System\CNwZANn.exe
  2⤵
  PID:3720
- C:\Windows\System\DpBLLlX.exe
  C:\Windows\System\DpBLLlX.exe
  2⤵
  PID:3740
- C:\Windows\System\dwSFzZs.exe
  C:\Windows\System\dwSFzZs.exe
  2⤵
  PID:3760
- C:\Windows\System\RvUpbHu.exe
  C:\Windows\System\RvUpbHu.exe
  2⤵
  PID:3780
- C:\Windows\System\zLcqNcT.exe
  C:\Windows\System\zLcqNcT.exe
  2⤵
  PID:3796
- C:\Windows\System\tcOvCTp.exe
  C:\Windows\System\tcOvCTp.exe
  2⤵
  PID:3816
- C:\Windows\System\TWtOtDh.exe
  C:\Windows\System\TWtOtDh.exe
  2⤵
  PID:3832
- C:\Windows\System\dNAswOO.exe
  C:\Windows\System\dNAswOO.exe
  2⤵
  PID:3856
- C:\Windows\System\QYYCRCt.exe
  C:\Windows\System\QYYCRCt.exe
  2⤵
  PID:3872
- C:\Windows\System\ANOQzOe.exe
  C:\Windows\System\ANOQzOe.exe
  2⤵
  PID:3896
- C:\Windows\System\SoKZqvm.exe
  C:\Windows\System\SoKZqvm.exe
  2⤵
  PID:3912
- C:\Windows\System\AHqupim.exe
  C:\Windows\System\AHqupim.exe
  2⤵
  PID:3936
- C:\Windows\System\eMoIZhd.exe
  C:\Windows\System\eMoIZhd.exe
  2⤵
  PID:3952
- C:\Windows\System\DxeUIUB.exe
  C:\Windows\System\DxeUIUB.exe
  2⤵
  PID:3972
- C:\Windows\System\cBSgTOA.exe
  C:\Windows\System\cBSgTOA.exe
  2⤵
  PID:4004
- C:\Windows\System\rJGrVJs.exe
  C:\Windows\System\rJGrVJs.exe
  2⤵
  PID:4024
- C:\Windows\System\tKuEyyg.exe
  C:\Windows\System\tKuEyyg.exe
  2⤵
  PID:4040
- C:\Windows\System\XORqXdO.exe
  C:\Windows\System\XORqXdO.exe
  2⤵
  PID:4064
- C:\Windows\System\qMRIGKN.exe
  C:\Windows\System\qMRIGKN.exe
  2⤵
  PID:4084
- C:\Windows\System\QqFrSPp.exe
  C:\Windows\System\QqFrSPp.exe
  2⤵
  PID:1964
- C:\Windows\System\EYpryGo.exe
  C:\Windows\System\EYpryGo.exe
  2⤵
  PID:1864
- C:\Windows\System\htaGmTi.exe
  C:\Windows\System\htaGmTi.exe
  2⤵
  PID:324
- C:\Windows\System\Xpxjioi.exe
  C:\Windows\System\Xpxjioi.exe
  2⤵
  PID:1744
- C:\Windows\System\uoERpQN.exe
  C:\Windows\System\uoERpQN.exe
  2⤵
  PID:684
- C:\Windows\System\PdPsAgM.exe
  C:\Windows\System\PdPsAgM.exe
  2⤵
  PID:1844
- C:\Windows\System\vkaVcVe.exe
  C:\Windows\System\vkaVcVe.exe
  2⤵
  PID:2072
- C:\Windows\System\jWCnfqX.exe
  C:\Windows\System\jWCnfqX.exe
  2⤵
  PID:2900
- C:\Windows\System\WcXbtXz.exe
  C:\Windows\System\WcXbtXz.exe
  2⤵
  PID:1520
- C:\Windows\System\YCDcthE.exe
  C:\Windows\System\YCDcthE.exe
  2⤵
  PID:756
- C:\Windows\System\GndoOcT.exe
  C:\Windows\System\GndoOcT.exe
  2⤵
  PID:3092
- C:\Windows\System\tfiKKPw.exe
  C:\Windows\System\tfiKKPw.exe
  2⤵
  PID:3132
- C:\Windows\System\fQWXeet.exe
  C:\Windows\System\fQWXeet.exe
  2⤵
  PID:3076
- C:\Windows\System\WCYIEFb.exe
  C:\Windows\System\WCYIEFb.exe
  2⤵
  PID:3120
- C:\Windows\System\pwbQckw.exe
  C:\Windows\System\pwbQckw.exe
  2⤵
  PID:3212
- C:\Windows\System\HfOtTHh.exe
  C:\Windows\System\HfOtTHh.exe
  2⤵
  PID:3252
- C:\Windows\System\tpYYbEJ.exe
  C:\Windows\System\tpYYbEJ.exe
  2⤵
  PID:3300
- C:\Windows\System\oCfZCps.exe
  C:\Windows\System\oCfZCps.exe
  2⤵
  PID:3272
- C:\Windows\System\IRYZqLw.exe
  C:\Windows\System\IRYZqLw.exe
  2⤵
  PID:3336
- C:\Windows\System\IWFlMIv.exe
  C:\Windows\System\IWFlMIv.exe
  2⤵
  PID:3412
- C:\Windows\System\pImmkDt.exe
  C:\Windows\System\pImmkDt.exe
  2⤵
  PID:3456
- C:\Windows\System\EsUlhyZ.exe
  C:\Windows\System\EsUlhyZ.exe
  2⤵
  PID:3352
- C:\Windows\System\KgrKdYs.exe
  C:\Windows\System\KgrKdYs.exe
  2⤵
  PID:3392
- C:\Windows\System\YesUSda.exe
  C:\Windows\System\YesUSda.exe
  2⤵
  PID:3532
- C:\Windows\System\cWRyHnO.exe
  C:\Windows\System\cWRyHnO.exe
  2⤵
  PID:3572
- C:\Windows\System\GVLDIed.exe
  C:\Windows\System\GVLDIed.exe
  2⤵
  PID:3616
- C:\Windows\System\SnHKYhn.exe
  C:\Windows\System\SnHKYhn.exe
  2⤵
  PID:3516
- C:\Windows\System\abnKRvH.exe
  C:\Windows\System\abnKRvH.exe
  2⤵
  PID:3692
- C:\Windows\System\VrDnfio.exe
  C:\Windows\System\VrDnfio.exe
  2⤵
  PID:3768
- C:\Windows\System\YwHVlZu.exe
  C:\Windows\System\YwHVlZu.exe
  2⤵
  PID:3592
- C:\Windows\System\XqtPBAp.exe
  C:\Windows\System\XqtPBAp.exe
  2⤵
  PID:3804
- C:\Windows\System\YBkDTcR.exe
  C:\Windows\System\YBkDTcR.exe
  2⤵
  PID:3808
- C:\Windows\System\ABIBGfp.exe
  C:\Windows\System\ABIBGfp.exe
  2⤵
  PID:3852
- C:\Windows\System\PfmolMp.exe
  C:\Windows\System\PfmolMp.exe
  2⤵
  PID:3884
- C:\Windows\System\bkJZVWS.exe
  C:\Windows\System\bkJZVWS.exe
  2⤵
  PID:3920
- C:\Windows\System\EjffUts.exe
  C:\Windows\System\EjffUts.exe
  2⤵
  PID:3924
- C:\Windows\System\LapmlGA.exe
  C:\Windows\System\LapmlGA.exe
  2⤵
  PID:3788
- C:\Windows\System\fYnbzBy.exe
  C:\Windows\System\fYnbzBy.exe
  2⤵
  PID:2840
- C:\Windows\System\zWjsrMG.exe
  C:\Windows\System\zWjsrMG.exe
  2⤵
  PID:3984
- C:\Windows\System\orUFidF.exe
  C:\Windows\System\orUFidF.exe
  2⤵
  PID:3992
- C:\Windows\System\cgjzhAG.exe
  C:\Windows\System\cgjzhAG.exe
  2⤵
  PID:3904
- C:\Windows\System\RVlwMjt.exe
  C:\Windows\System\RVlwMjt.exe
  2⤵
  PID:4056
- C:\Windows\System\mxwAzsl.exe
  C:\Windows\System\mxwAzsl.exe
  2⤵
  PID:1536
- C:\Windows\System\vJKbrri.exe
  C:\Windows\System\vJKbrri.exe
  2⤵
  PID:980
- C:\Windows\System\qOiMUGs.exe
  C:\Windows\System\qOiMUGs.exe
  2⤵
  PID:3036
- C:\Windows\System\QJdWtfp.exe
  C:\Windows\System\QJdWtfp.exe
  2⤵
  PID:1876
- C:\Windows\System\jbPbjEh.exe
  C:\Windows\System\jbPbjEh.exe
  2⤵
  PID:3028
- C:\Windows\System\uEfnNum.exe
  C:\Windows\System\uEfnNum.exe
  2⤵
  PID:2736
- C:\Windows\System\qpsWzkZ.exe
  C:\Windows\System\qpsWzkZ.exe
  2⤵
  PID:2812
- C:\Windows\System\lrRCbgb.exe
  C:\Windows\System\lrRCbgb.exe
  2⤵
  PID:1496
- C:\Windows\System\ITnMHRx.exe
  C:\Windows\System\ITnMHRx.exe
  2⤵
  PID:3160
- C:\Windows\System\FIKSZHy.exe
  C:\Windows\System\FIKSZHy.exe
  2⤵
  PID:2272
- C:\Windows\System\LdtamSY.exe
  C:\Windows\System\LdtamSY.exe
  2⤵
  PID:3296
- C:\Windows\System\iAwuZzA.exe
  C:\Windows\System\iAwuZzA.exe
  2⤵
  PID:3332
- C:\Windows\System\bngRwnd.exe
  C:\Windows\System\bngRwnd.exe
  2⤵
  PID:3488
- C:\Windows\System\ZPwCQWx.exe
  C:\Windows\System\ZPwCQWx.exe
  2⤵
  PID:3196
- C:\Windows\System\GXgSVXl.exe
  C:\Windows\System\GXgSVXl.exe
  2⤵
  PID:3540
- C:\Windows\System\OCcTthu.exe
  C:\Windows\System\OCcTthu.exe
  2⤵
  PID:3368
- C:\Windows\System\aUYevnM.exe
  C:\Windows\System\aUYevnM.exe
  2⤵
  PID:3372
- C:\Windows\System\ZKYPPHy.exe
  C:\Windows\System\ZKYPPHy.exe
  2⤵
  PID:3696
- C:\Windows\System\enGDeaf.exe
  C:\Windows\System\enGDeaf.exe
  2⤵
  PID:3736
- C:\Windows\System\EWGXTlk.exe
  C:\Windows\System\EWGXTlk.exe
  2⤵
  PID:3620
- C:\Windows\System\ZMYXnJn.exe
  C:\Windows\System\ZMYXnJn.exe
  2⤵
  PID:3840
- C:\Windows\System\eKwWiSb.exe
  C:\Windows\System\eKwWiSb.exe
  2⤵
  PID:3712
- C:\Windows\System\jPhYfEv.exe
  C:\Windows\System\jPhYfEv.exe
  2⤵
  PID:1564
- C:\Windows\System\ilveGnd.exe
  C:\Windows\System\ilveGnd.exe
  2⤵
  PID:3964
- C:\Windows\System\uVigHhf.exe
  C:\Windows\System\uVigHhf.exe
  2⤵
  PID:3968
- C:\Windows\System\VVZyaqk.exe
  C:\Windows\System\VVZyaqk.exe
  2⤵
  PID:4000
- C:\Windows\System\MWnOksU.exe
  C:\Windows\System\MWnOksU.exe
  2⤵
  PID:4036
- C:\Windows\System\ONdpfkM.exe
  C:\Windows\System\ONdpfkM.exe
  2⤵
  PID:1004
- C:\Windows\System\nZXmlOX.exe
  C:\Windows\System\nZXmlOX.exe
  2⤵
  PID:4080
- C:\Windows\System\WNykdso.exe
  C:\Windows\System\WNykdso.exe
  2⤵
  PID:896
- C:\Windows\System\SUCMDtK.exe
  C:\Windows\System\SUCMDtK.exe
  2⤵
  PID:2624
- C:\Windows\System\kbkwihU.exe
  C:\Windows\System\kbkwihU.exe
  2⤵
  PID:2592
- C:\Windows\System\pNprRfH.exe
  C:\Windows\System\pNprRfH.exe
  2⤵
  PID:2232
- C:\Windows\System\bbLlaDZ.exe
  C:\Windows\System\bbLlaDZ.exe
  2⤵
  PID:3100
- C:\Windows\System\epabSTR.exe
  C:\Windows\System\epabSTR.exe
  2⤵
  PID:2640
- C:\Windows\System\tMCWPOL.exe
  C:\Windows\System\tMCWPOL.exe
  2⤵
  PID:3192
- C:\Windows\System\QrJAgOW.exe
  C:\Windows\System\QrJAgOW.exe
  2⤵
  PID:3508
- C:\Windows\System\oBgILbd.exe
  C:\Windows\System\oBgILbd.exe
  2⤵
  PID:3428
- C:\Windows\System\YbTjaaL.exe
  C:\Windows\System\YbTjaaL.exe
  2⤵
  PID:2596
- C:\Windows\System\MqVHvOz.exe
  C:\Windows\System\MqVHvOz.exe
  2⤵
  PID:3812
- C:\Windows\System\rnWmdwx.exe
  C:\Windows\System\rnWmdwx.exe
  2⤵
  PID:3776
- C:\Windows\System\BieBVbh.exe
  C:\Windows\System\BieBVbh.exe
  2⤵
  PID:3672
- C:\Windows\System\DCRsErO.exe
  C:\Windows\System\DCRsErO.exe
  2⤵
  PID:3948
- C:\Windows\System\BFfkBoE.exe
  C:\Windows\System\BFfkBoE.exe
  2⤵
  PID:1592
- C:\Windows\System\CRaoAKV.exe
  C:\Windows\System\CRaoAKV.exe
  2⤵
  PID:3828
- C:\Windows\System\BeBLQyd.exe
  C:\Windows\System\BeBLQyd.exe
  2⤵
  PID:1408
- C:\Windows\System\psPeTTy.exe
  C:\Windows\System\psPeTTy.exe
  2⤵
  PID:2696
- C:\Windows\System\CojRkRX.exe
  C:\Windows\System\CojRkRX.exe
  2⤵
  PID:3988
- C:\Windows\System\XagIzyS.exe
  C:\Windows\System\XagIzyS.exe
  2⤵
  PID:1892
- C:\Windows\System\IHXHHNY.exe
  C:\Windows\System\IHXHHNY.exe
  2⤵
  PID:4060
- C:\Windows\System\eFfBsJL.exe
  C:\Windows\System\eFfBsJL.exe
  2⤵
  PID:3156
- C:\Windows\System\QLEdQbI.exe
  C:\Windows\System\QLEdQbI.exe
  2⤵
  PID:1888
- C:\Windows\System\FJDAeOf.exe
  C:\Windows\System\FJDAeOf.exe
  2⤵
  PID:3288
- C:\Windows\System\NxYZsPZ.exe
  C:\Windows\System\NxYZsPZ.exe
  2⤵
  PID:3216
- C:\Windows\System\oVGIFEW.exe
  C:\Windows\System\oVGIFEW.exe
  2⤵
  PID:1908
- C:\Windows\System\zfCkIyw.exe
  C:\Windows\System\zfCkIyw.exe
  2⤵
  PID:3600
- C:\Windows\System\xaBIkXR.exe
  C:\Windows\System\xaBIkXR.exe
  2⤵
  PID:1896
- C:\Windows\System\tdDZNSr.exe
  C:\Windows\System\tdDZNSr.exe
  2⤵
  PID:3612
- C:\Windows\System\tawUCxV.exe
  C:\Windows\System\tawUCxV.exe
  2⤵
  PID:924
- C:\Windows\System\QMsaGnu.exe
  C:\Windows\System\QMsaGnu.exe
  2⤵
  PID:440
- C:\Windows\System\dGHfLFt.exe
  C:\Windows\System\dGHfLFt.exe
  2⤵
  PID:2672
- C:\Windows\System\FGsVLVJ.exe
  C:\Windows\System\FGsVLVJ.exe
  2⤵
  PID:824
- C:\Windows\System\gpWHvwW.exe
  C:\Windows\System\gpWHvwW.exe
  2⤵
  PID:2544
- C:\Windows\System\koawlmm.exe
  C:\Windows\System\koawlmm.exe
  2⤵
  PID:1060
- C:\Windows\System\jAcOdYt.exe
  C:\Windows\System\jAcOdYt.exe
  2⤵
  PID:1444
- C:\Windows\System\iMdsBLS.exe
  C:\Windows\System\iMdsBLS.exe
  2⤵
  PID:2372
- C:\Windows\System\PEBTQEw.exe
  C:\Windows\System\PEBTQEw.exe
  2⤵
  PID:2452
- C:\Windows\System\wNbdGjg.exe
  C:\Windows\System\wNbdGjg.exe
  2⤵
  PID:1724
- C:\Windows\System\OUhrXcQ.exe
  C:\Windows\System\OUhrXcQ.exe
  2⤵
  PID:2368
- C:\Windows\System\oUnPiGH.exe
  C:\Windows\System\oUnPiGH.exe
  2⤵
  PID:3960
- C:\Windows\System\SCcrIKr.exe
  C:\Windows\System\SCcrIKr.exe
  2⤵
  PID:664
- C:\Windows\System\XyBDehp.exe
  C:\Windows\System\XyBDehp.exe
  2⤵
  PID:2200
- C:\Windows\System\RUZSThM.exe
  C:\Windows\System\RUZSThM.exe
  2⤵
  PID:1884
- C:\Windows\System\xJfVroA.exe
  C:\Windows\System\xJfVroA.exe
  2⤵
  PID:1524
- C:\Windows\System\udNFSVD.exe
  C:\Windows\System\udNFSVD.exe
  2⤵
  PID:1732
- C:\Windows\System\dVKvZai.exe
  C:\Windows\System\dVKvZai.exe
  2⤵
  PID:2768
- C:\Windows\System\AvWRGiF.exe
  C:\Windows\System\AvWRGiF.exe
  2⤵
  PID:3476
- C:\Windows\System\ozoEKgw.exe
  C:\Windows\System\ozoEKgw.exe
  2⤵
  PID:3652
- C:\Windows\System\izWWmKB.exe
  C:\Windows\System\izWWmKB.exe
  2⤵
  PID:2168
- C:\Windows\System\RCQmVVo.exe
  C:\Windows\System\RCQmVVo.exe
  2⤵
  PID:2504
- C:\Windows\System\JIMLChS.exe
  C:\Windows\System\JIMLChS.exe
  2⤵
  PID:2824
- C:\Windows\System\ACRZbkm.exe
  C:\Windows\System\ACRZbkm.exe
  2⤵
  PID:288
- C:\Windows\System\tSlgfmy.exe
  C:\Windows\System\tSlgfmy.exe
  2⤵
  PID:1612
- C:\Windows\System\xLkLDet.exe
  C:\Windows\System\xLkLDet.exe
  2⤵
  PID:1556
- C:\Windows\System\jQPolxK.exe
  C:\Windows\System\jQPolxK.exe
  2⤵
  PID:3908
- C:\Windows\System\kcClAMw.exe
  C:\Windows\System\kcClAMw.exe
  2⤵
  PID:1464
- C:\Windows\System\JbRhwZQ.exe
  C:\Windows\System\JbRhwZQ.exe
  2⤵
  PID:1532
- C:\Windows\System\nQaEIVI.exe
  C:\Windows\System\nQaEIVI.exe
  2⤵
  PID:2648
- C:\Windows\System\IGsEPlR.exe
  C:\Windows\System\IGsEPlR.exe
  2⤵
  PID:2204
- C:\Windows\System\rgtdTtQ.exe
  C:\Windows\System\rgtdTtQ.exe
  2⤵
  PID:2464
- C:\Windows\System\CgEVvhG.exe
  C:\Windows\System\CgEVvhG.exe
  2⤵
  PID:2336
- C:\Windows\System\tNBrWDc.exe
  C:\Windows\System\tNBrWDc.exe
  2⤵
  PID:3752
- C:\Windows\System\rEBuQnC.exe
  C:\Windows\System\rEBuQnC.exe
  2⤵
  PID:644
- C:\Windows\System\KIBbFuk.exe
  C:\Windows\System\KIBbFuk.exe
  2⤵
  PID:268
- C:\Windows\System\SHNQVDa.exe
  C:\Windows\System\SHNQVDa.exe
  2⤵
  PID:2776
- C:\Windows\System\OHNYwGq.exe
  C:\Windows\System\OHNYwGq.exe
  2⤵
  PID:4100
- C:\Windows\System\kEUMeEL.exe
  C:\Windows\System\kEUMeEL.exe
  2⤵
  PID:4160
- C:\Windows\System\oREMGQj.exe
  C:\Windows\System\oREMGQj.exe
  2⤵
  PID:4176
- C:\Windows\System\qHjoyHt.exe
  C:\Windows\System\qHjoyHt.exe
  2⤵
  PID:4192
- C:\Windows\System\tLlOaqQ.exe
  C:\Windows\System\tLlOaqQ.exe
  2⤵
  PID:4224
- C:\Windows\System\fZjDdEe.exe
  C:\Windows\System\fZjDdEe.exe
  2⤵
  PID:4240
- C:\Windows\System\LUhVZKM.exe
  C:\Windows\System\LUhVZKM.exe
  2⤵
  PID:4256
- C:\Windows\System\hXxRyUE.exe
  C:\Windows\System\hXxRyUE.exe
  2⤵
  PID:4288
- C:\Windows\System\mQwBhvY.exe
  C:\Windows\System\mQwBhvY.exe
  2⤵
  PID:4304
- C:\Windows\System\guxhrnm.exe
  C:\Windows\System\guxhrnm.exe
  2⤵
  PID:4344
- C:\Windows\System\RJDQoyM.exe
  C:\Windows\System\RJDQoyM.exe
  2⤵
  PID:4364
- C:\Windows\System\XodNmFW.exe
  C:\Windows\System\XodNmFW.exe
  2⤵
  PID:4380
- C:\Windows\System\OaQsJtn.exe
  C:\Windows\System\OaQsJtn.exe
  2⤵
  PID:4396
- C:\Windows\System\ZlWyplB.exe
  C:\Windows\System\ZlWyplB.exe
  2⤵
  PID:4412
- C:\Windows\System\LXEERhQ.exe
  C:\Windows\System\LXEERhQ.exe
  2⤵
  PID:4428
- C:\Windows\System\WoNtBDA.exe
  C:\Windows\System\WoNtBDA.exe
  2⤵
  PID:4444
- C:\Windows\System\NhbgBfb.exe
  C:\Windows\System\NhbgBfb.exe
  2⤵
  PID:4460
- C:\Windows\System\UaAjVVB.exe
  C:\Windows\System\UaAjVVB.exe
  2⤵
  PID:4476
- C:\Windows\System\VaOLyuH.exe
  C:\Windows\System\VaOLyuH.exe
  2⤵
  PID:4492
- C:\Windows\System\QJBVMya.exe
  C:\Windows\System\QJBVMya.exe
  2⤵
  PID:4508
- C:\Windows\System\RCfZqQP.exe
  C:\Windows\System\RCfZqQP.exe
  2⤵
  PID:4524
- C:\Windows\System\rGSUEUL.exe
  C:\Windows\System\rGSUEUL.exe
  2⤵
  PID:4540
- C:\Windows\System\DyidURE.exe
  C:\Windows\System\DyidURE.exe
  2⤵
  PID:4556
- C:\Windows\System\oIJjdSB.exe
  C:\Windows\System\oIJjdSB.exe
  2⤵
  PID:4572
- C:\Windows\System\JRnlIki.exe
  C:\Windows\System\JRnlIki.exe
  2⤵
  PID:4588
- C:\Windows\System\DlAgaXN.exe
  C:\Windows\System\DlAgaXN.exe
  2⤵
  PID:4616
- C:\Windows\System\OFnYCXE.exe
  C:\Windows\System\OFnYCXE.exe
  2⤵
  PID:4632
- C:\Windows\System\seOkeml.exe
  C:\Windows\System\seOkeml.exe
  2⤵
  PID:4652
- C:\Windows\System\icLPIPu.exe
  C:\Windows\System\icLPIPu.exe
  2⤵
  PID:4668
- C:\Windows\System\agGBUzL.exe
  C:\Windows\System\agGBUzL.exe
  2⤵
  PID:4696
- C:\Windows\System\zmFrXnZ.exe
  C:\Windows\System\zmFrXnZ.exe
  2⤵
  PID:4712
- C:\Windows\System\zxibKsD.exe
  C:\Windows\System\zxibKsD.exe
  2⤵
  PID:4728
- C:\Windows\System\edjfjRp.exe
  C:\Windows\System\edjfjRp.exe
  2⤵
  PID:4744
- C:\Windows\System\hHqRZHE.exe
  C:\Windows\System\hHqRZHE.exe
  2⤵
  PID:4764
- C:\Windows\System\JaIEJAM.exe
  C:\Windows\System\JaIEJAM.exe
  2⤵
  PID:4780
- C:\Windows\System\KaxvTBI.exe
  C:\Windows\System\KaxvTBI.exe
  2⤵
  PID:4796
- C:\Windows\System\YnARaXX.exe
  C:\Windows\System\YnARaXX.exe
  2⤵
  PID:4812
- C:\Windows\System\AXDKppp.exe
  C:\Windows\System\AXDKppp.exe
  2⤵
  PID:4828
- C:\Windows\System\sdsRCgF.exe
  C:\Windows\System\sdsRCgF.exe
  2⤵
  PID:4844
- C:\Windows\System\FKNPfYn.exe
  C:\Windows\System\FKNPfYn.exe
  2⤵
  PID:4860
- C:\Windows\System\TDuXKPN.exe
  C:\Windows\System\TDuXKPN.exe
  2⤵
  PID:4876
- C:\Windows\System\ahyCnLI.exe
  C:\Windows\System\ahyCnLI.exe
  2⤵
  PID:4896
- C:\Windows\System\RRMUqdV.exe
  C:\Windows\System\RRMUqdV.exe
  2⤵
  PID:4912
- C:\Windows\System\eNaaWXx.exe
  C:\Windows\System\eNaaWXx.exe
  2⤵
  PID:4944
- C:\Windows\System\prNDUoh.exe
  C:\Windows\System\prNDUoh.exe
  2⤵
  PID:4960
- C:\Windows\System\NCQZSlo.exe
  C:\Windows\System\NCQZSlo.exe
  2⤵
  PID:4976
- C:\Windows\System\NMyYWoY.exe
  C:\Windows\System\NMyYWoY.exe
  2⤵
  PID:4992
- C:\Windows\System\WQUpwNw.exe
  C:\Windows\System\WQUpwNw.exe
  2⤵
  PID:5008
- C:\Windows\System\MxUAjjF.exe
  C:\Windows\System\MxUAjjF.exe
  2⤵
  PID:5028
- C:\Windows\System\pcjhYll.exe
  C:\Windows\System\pcjhYll.exe
  2⤵
  PID:5044
- C:\Windows\System\PUmYIyh.exe
  C:\Windows\System\PUmYIyh.exe
  2⤵
  PID:5060
- C:\Windows\System\KxeuaRu.exe
  C:\Windows\System\KxeuaRu.exe
  2⤵
  PID:5080
- C:\Windows\System\mQxgDGJ.exe
  C:\Windows\System\mQxgDGJ.exe
  2⤵
  PID:5096
- C:\Windows\System\MDWQIuT.exe
  C:\Windows\System\MDWQIuT.exe
  2⤵
  PID:5112
- C:\Windows\System\WDxqidO.exe
  C:\Windows\System\WDxqidO.exe
  2⤵
  PID:2212
- C:\Windows\System\iJxRjHK.exe
  C:\Windows\System\iJxRjHK.exe
  2⤵
  PID:4032
- C:\Windows\System\vatOqwM.exe
  C:\Windows\System\vatOqwM.exe
  2⤵
  PID:1588
- C:\Windows\System\KTARTlO.exe
  C:\Windows\System\KTARTlO.exe
  2⤵
  PID:1252
- C:\Windows\System\bhdjCIy.exe
  C:\Windows\System\bhdjCIy.exe
  2⤵
  PID:4124
- C:\Windows\System\GbrOBGR.exe
  C:\Windows\System\GbrOBGR.exe
  2⤵
  PID:4136
- C:\Windows\System\WZDSHhI.exe
  C:\Windows\System\WZDSHhI.exe
  2⤵
  PID:4152
- C:\Windows\System\tmLuoNz.exe
  C:\Windows\System\tmLuoNz.exe
  2⤵
  PID:4184
- C:\Windows\System\TECDUOA.exe
  C:\Windows\System\TECDUOA.exe
  2⤵
  PID:4208
- C:\Windows\System\QcAEoyI.exe
  C:\Windows\System\QcAEoyI.exe
  2⤵
  PID:4264
- C:\Windows\System\vSaLXDD.exe
  C:\Windows\System\vSaLXDD.exe
  2⤵
  PID:4284
- C:\Windows\System\xgtCHYm.exe
  C:\Windows\System\xgtCHYm.exe
  2⤵
  PID:4312
- C:\Windows\System\ZqmioBw.exe
  C:\Windows\System\ZqmioBw.exe
  2⤵
  PID:4332
- C:\Windows\System\HWDDUZZ.exe
  C:\Windows\System\HWDDUZZ.exe
  2⤵
  PID:4376
- C:\Windows\System\anDDrVQ.exe
  C:\Windows\System\anDDrVQ.exe
  2⤵
  PID:2760
- C:\Windows\System\JGhSDvd.exe
  C:\Windows\System\JGhSDvd.exe
  2⤵
  PID:4328
- C:\Windows\System\TbonjII.exe
  C:\Windows\System\TbonjII.exe
  2⤵
  PID:4440
- C:\Windows\System\WSDonrL.exe
  C:\Windows\System\WSDonrL.exe
  2⤵
  PID:4532
- C:\Windows\System\MMnTolE.exe
  C:\Windows\System\MMnTolE.exe
  2⤵
  PID:4568
- C:\Windows\System\axvqslc.exe
  C:\Windows\System\axvqslc.exe
  2⤵
  PID:4420
- C:\Windows\System\Aiovzdq.exe
  C:\Windows\System\Aiovzdq.exe
  2⤵
  PID:4640
- C:\Windows\System\gDsTsmv.exe
  C:\Windows\System\gDsTsmv.exe
  2⤵
  PID:4452
- C:\Windows\System\BsHyXEy.exe
  C:\Windows\System\BsHyXEy.exe
  2⤵
  PID:4660
- C:\Windows\System\UzuETYO.exe
  C:\Windows\System\UzuETYO.exe
  2⤵
  PID:5004
- C:\Windows\System\iMJDFKD.exe
  C:\Windows\System\iMJDFKD.exe
  2⤵
  PID:4708
- C:\Windows\System\xzLoEdM.exe
  C:\Windows\System\xzLoEdM.exe
  2⤵
  PID:4836
- C:\Windows\System\jlbabLs.exe
  C:\Windows\System\jlbabLs.exe
  2⤵
  PID:1440
- C:\Windows\System\zHFQCeI.exe
  C:\Windows\System\zHFQCeI.exe
  2⤵
  PID:4108
- C:\Windows\System\eMJbyVE.exe
  C:\Windows\System\eMJbyVE.exe
  2⤵
  PID:4172
- C:\Windows\System\PoRPPuq.exe
  C:\Windows\System\PoRPPuq.exe
  2⤵
  PID:5016
- C:\Windows\System\QOVUnzF.exe
  C:\Windows\System\QOVUnzF.exe
  2⤵
  PID:1340
- C:\Windows\System\LmekAHF.exe
  C:\Windows\System\LmekAHF.exe
  2⤵
  PID:4148
- C:\Windows\System\uoinTlE.exe
  C:\Windows\System\uoinTlE.exe
  2⤵
  PID:4296
- C:\Windows\System\LCPlmYz.exe
  C:\Windows\System\LCPlmYz.exe
  2⤵
  PID:4340
- C:\Windows\System\zzMQGXq.exe
  C:\Windows\System\zzMQGXq.exe
  2⤵
  PID:4280
- C:\Windows\System\yAOeLCB.exe
  C:\Windows\System\yAOeLCB.exe
  2⤵
  PID:4604
- C:\Windows\System\CUTitBv.exe
  C:\Windows\System\CUTitBv.exe
  2⤵
  PID:4648
- C:\Windows\System\wvONaBW.exe
  C:\Windows\System\wvONaBW.exe
  2⤵
  PID:4536
- C:\Windows\System\BptFVyS.exe
  C:\Windows\System\BptFVyS.exe
  2⤵
  PID:4336
- C:\Windows\System\aqiXCaT.exe
  C:\Windows\System\aqiXCaT.exe
  2⤵
  PID:4548
- C:\Windows\System\XSxGiBK.exe
  C:\Windows\System\XSxGiBK.exe
  2⤵
  PID:4824
- C:\Windows\System\JsVTCiS.exe
  C:\Windows\System\JsVTCiS.exe
  2⤵
  PID:4756
- C:\Windows\System\eFAmXcH.exe
  C:\Windows\System\eFAmXcH.exe
  2⤵
  PID:4852
- C:\Windows\System\YPemmww.exe
  C:\Windows\System\YPemmww.exe
  2⤵
  PID:4624
- C:\Windows\System\vuIQRSQ.exe
  C:\Windows\System\vuIQRSQ.exe
  2⤵
  PID:4972
- C:\Windows\System\NFIJlxV.exe
  C:\Windows\System\NFIJlxV.exe
  2⤵
  PID:5068
- C:\Windows\System\SgDnldB.exe
  C:\Windows\System\SgDnldB.exe
  2⤵
  PID:5072
- C:\Windows\System\ppFlsKx.exe
  C:\Windows\System\ppFlsKx.exe
  2⤵
  PID:4808
- C:\Windows\System\kXEQFpC.exe
  C:\Windows\System\kXEQFpC.exe
  2⤵
  PID:4116
- C:\Windows\System\QwlvCPV.exe
  C:\Windows\System\QwlvCPV.exe
  2⤵
  PID:4952
- C:\Windows\System\zPXPUFQ.exe
  C:\Windows\System\zPXPUFQ.exe
  2⤵
  PID:4168
- C:\Windows\System\ticIuZb.exe
  C:\Windows\System\ticIuZb.exe
  2⤵
  PID:4988
- C:\Windows\System\THVbvvw.exe
  C:\Windows\System\THVbvvw.exe
  2⤵
  PID:5052
- C:\Windows\System\YveNRng.exe
  C:\Windows\System\YveNRng.exe
  2⤵
  PID:5088
- C:\Windows\System\aJvDmRU.exe
  C:\Windows\System\aJvDmRU.exe
  2⤵
  PID:4272
- C:\Windows\System\dQWdmwE.exe
  C:\Windows\System\dQWdmwE.exe
  2⤵
  PID:4356
- C:\Windows\System\utieujD.exe
  C:\Windows\System\utieujD.exe
  2⤵
  PID:1976
- C:\Windows\System\JFaTrUZ.exe
  C:\Windows\System\JFaTrUZ.exe
  2⤵
  PID:2728
- C:\Windows\System\ueUuOcI.exe
  C:\Windows\System\ueUuOcI.exe
  2⤵
  PID:4692
- C:\Windows\System\LJnIYgo.exe
  C:\Windows\System\LJnIYgo.exe
  2⤵
  PID:4144
- C:\Windows\System\FJgeXJp.exe
  C:\Windows\System\FJgeXJp.exe
  2⤵
  PID:1600
- C:\Windows\System\gaRfBiZ.exe
  C:\Windows\System\gaRfBiZ.exe
  2⤵
  PID:4472
- C:\Windows\System\NqDwGwO.exe
  C:\Windows\System\NqDwGwO.exe
  2⤵
  PID:4676
- C:\Windows\System\gkRsQEe.exe
  C:\Windows\System\gkRsQEe.exe
  2⤵
  PID:4516
- C:\Windows\System\qneYbhf.exe
  C:\Windows\System\qneYbhf.exe
  2⤵
  PID:4772
- C:\Windows\System\mGeBjFX.exe
  C:\Windows\System\mGeBjFX.exe
  2⤵
  PID:4724
- C:\Windows\System\SLgIynr.exe
  C:\Windows\System\SLgIynr.exe
  2⤵
  PID:4920
- C:\Windows\System\ihSgZPI.exe
  C:\Windows\System\ihSgZPI.exe
  2⤵
  PID:2284
- C:\Windows\System\jptUZYz.exe
  C:\Windows\System\jptUZYz.exe
  2⤵
  PID:4736
- C:\Windows\System\CjQUlMU.exe
  C:\Windows\System\CjQUlMU.exe
  2⤵
  PID:5024
- C:\Windows\System\rjgoMpo.exe
  C:\Windows\System\rjgoMpo.exe
  2⤵
  PID:4884
- C:\Windows\System\vDBCJEC.exe
  C:\Windows\System\vDBCJEC.exe
  2⤵
  PID:5108
- C:\Windows\System\loElnEt.exe
  C:\Windows\System\loElnEt.exe
  2⤵
  PID:5036
- C:\Windows\System\WsLIFSl.exe
  C:\Windows\System\WsLIFSl.exe
  2⤵
  PID:5104
- C:\Windows\System\IXjSLBd.exe
  C:\Windows\System\IXjSLBd.exe
  2⤵
  PID:4788
- C:\Windows\System\zsAeKzq.exe
  C:\Windows\System\zsAeKzq.exe
  2⤵
  PID:4580
- C:\Windows\System\VqPETvP.exe
  C:\Windows\System\VqPETvP.exe
  2⤵
  PID:4924
- C:\Windows\System\dJMcZym.exe
  C:\Windows\System\dJMcZym.exe
  2⤵
  PID:4888
- C:\Windows\System\QjruvuF.exe
  C:\Windows\System\QjruvuF.exe
  2⤵
  PID:5140
- C:\Windows\System\ZtjRmXS.exe
  C:\Windows\System\ZtjRmXS.exe
  2⤵
  PID:5168
- C:\Windows\System\cfVTkcU.exe
  C:\Windows\System\cfVTkcU.exe
  2⤵
  PID:5188
- C:\Windows\System\mICZtKo.exe
  C:\Windows\System\mICZtKo.exe
  2⤵
  PID:5204
- C:\Windows\System\JTKdMvh.exe
  C:\Windows\System\JTKdMvh.exe
  2⤵
  PID:5220
- C:\Windows\System\qhSYkmS.exe
  C:\Windows\System\qhSYkmS.exe
  2⤵
  PID:5236
- C:\Windows\System\WCpNUpy.exe
  C:\Windows\System\WCpNUpy.exe
  2⤵
  PID:5260
- C:\Windows\System\aTgycqw.exe
  C:\Windows\System\aTgycqw.exe
  2⤵
  PID:5276
- C:\Windows\System\JafilKl.exe
  C:\Windows\System\JafilKl.exe
  2⤵
  PID:5292
- C:\Windows\System\BhiuHgi.exe
  C:\Windows\System\BhiuHgi.exe
  2⤵
  PID:5308
- C:\Windows\System\mthzRfv.exe
  C:\Windows\System\mthzRfv.exe
  2⤵
  PID:5328
- C:\Windows\System\ghFvniW.exe
  C:\Windows\System\ghFvniW.exe
  2⤵
  PID:5344
- C:\Windows\System\QsnwbDs.exe
  C:\Windows\System\QsnwbDs.exe
  2⤵
  PID:5360
- C:\Windows\System\zUFWjiT.exe
  C:\Windows\System\zUFWjiT.exe
  2⤵
  PID:5376
- C:\Windows\System\RsxDvkj.exe
  C:\Windows\System\RsxDvkj.exe
  2⤵
  PID:5396
- C:\Windows\System\jJDStlN.exe
  C:\Windows\System\jJDStlN.exe
  2⤵
  PID:5412
- C:\Windows\System\zyAcjZA.exe
  C:\Windows\System\zyAcjZA.exe
  2⤵
  PID:5428
- C:\Windows\System\zNFQALt.exe
  C:\Windows\System\zNFQALt.exe
  2⤵
  PID:5448
- C:\Windows\System\CuUaSsQ.exe
  C:\Windows\System\CuUaSsQ.exe
  2⤵
  PID:5464
- C:\Windows\System\MayrEuO.exe
  C:\Windows\System\MayrEuO.exe
  2⤵
  PID:5480
- C:\Windows\System\ISRAgTk.exe
  C:\Windows\System\ISRAgTk.exe
  2⤵
  PID:5496
- C:\Windows\System\rslGnrg.exe
  C:\Windows\System\rslGnrg.exe
  2⤵
  PID:5516
- C:\Windows\System\RVjjRPp.exe
  C:\Windows\System\RVjjRPp.exe
  2⤵
  PID:5532
- C:\Windows\System\txocUna.exe
  C:\Windows\System\txocUna.exe
  2⤵
  PID:5548
- C:\Windows\System\VHgZJLy.exe
  C:\Windows\System\VHgZJLy.exe
  2⤵
  PID:5568
- C:\Windows\System\VJmIqxK.exe
  C:\Windows\System\VJmIqxK.exe
  2⤵
  PID:5584
- C:\Windows\System\PPXyAly.exe
  C:\Windows\System\PPXyAly.exe
  2⤵
  PID:5660
- C:\Windows\System\XdoXLIM.exe
  C:\Windows\System\XdoXLIM.exe
  2⤵
  PID:5680
- C:\Windows\System\mbKlsJO.exe
  C:\Windows\System\mbKlsJO.exe
  2⤵
  PID:5704
- C:\Windows\System\kLMlZoA.exe
  C:\Windows\System\kLMlZoA.exe
  2⤵
  PID:5720
- C:\Windows\System\FRkgqQt.exe
  C:\Windows\System\FRkgqQt.exe
  2⤵
  PID:5736
- C:\Windows\System\mBQAavl.exe
  C:\Windows\System\mBQAavl.exe
  2⤵
  PID:5760
- C:\Windows\System\EPYqPhM.exe
  C:\Windows\System\EPYqPhM.exe
  2⤵
  PID:5780
- C:\Windows\System\hVALkcv.exe
  C:\Windows\System\hVALkcv.exe
  2⤵
  PID:5824
- C:\Windows\System\FhKYLtk.exe
  C:\Windows\System\FhKYLtk.exe
  2⤵
  PID:5840
- C:\Windows\System\BxaTHLV.exe
  C:\Windows\System\BxaTHLV.exe
  2⤵
  PID:5860
- C:\Windows\System\VZcmrfg.exe
  C:\Windows\System\VZcmrfg.exe
  2⤵
  PID:5876
- C:\Windows\System\lRVDYcj.exe
  C:\Windows\System\lRVDYcj.exe
  2⤵
  PID:5896
- C:\Windows\System\JxPasJZ.exe
  C:\Windows\System\JxPasJZ.exe
  2⤵
  PID:5912
- C:\Windows\System\GRfCQmn.exe
  C:\Windows\System\GRfCQmn.exe
  2⤵
  PID:5928
- C:\Windows\System\VYnejIP.exe
  C:\Windows\System\VYnejIP.exe
  2⤵
  PID:5944
- C:\Windows\System\shUYMJf.exe
  C:\Windows\System\shUYMJf.exe
  2⤵
  PID:5964
- C:\Windows\System\lbFZxdT.exe
  C:\Windows\System\lbFZxdT.exe
  2⤵
  PID:5980
- C:\Windows\System\ogBecMk.exe
  C:\Windows\System\ogBecMk.exe
  2⤵
  PID:5996
- C:\Windows\System\aSlPSnd.exe
  C:\Windows\System\aSlPSnd.exe
  2⤵
  PID:6016
- C:\Windows\System\FXGpUxb.exe
  C:\Windows\System\FXGpUxb.exe
  2⤵
  PID:6032
- C:\Windows\System\WllbzFT.exe
  C:\Windows\System\WllbzFT.exe
  2⤵
  PID:6080
- C:\Windows\System\bGWEreR.exe
  C:\Windows\System\bGWEreR.exe
  2⤵
  PID:6096
- C:\Windows\System\tRYBrOr.exe
  C:\Windows\System\tRYBrOr.exe
  2⤵
  PID:6112
- C:\Windows\System\vkZrtGH.exe
  C:\Windows\System\vkZrtGH.exe
  2⤵
  PID:6128
- C:\Windows\System\qPVUvvV.exe
  C:\Windows\System\qPVUvvV.exe
  2⤵
  PID:4612
- C:\Windows\System\deflzcJ.exe
  C:\Windows\System\deflzcJ.exe
  2⤵
  PID:5156
- C:\Windows\System\FazhHXN.exe
  C:\Windows\System\FazhHXN.exe
  2⤵
  PID:4132
- C:\Windows\System\zLalrPq.exe
  C:\Windows\System\zLalrPq.exe
  2⤵
  PID:5132
- C:\Windows\System\xUqmSZZ.exe
  C:\Windows\System\xUqmSZZ.exe
  2⤵
  PID:5196
- C:\Windows\System\MvvYNee.exe
  C:\Windows\System\MvvYNee.exe
  2⤵
  PID:5272
- C:\Windows\System\KFyzAkQ.exe
  C:\Windows\System\KFyzAkQ.exe
  2⤵
  PID:5212
- C:\Windows\System\USzxbLj.exe
  C:\Windows\System\USzxbLj.exe
  2⤵
  PID:5288
- C:\Windows\System\QytxJKu.exe
  C:\Windows\System\QytxJKu.exe
  2⤵
  PID:5372
- C:\Windows\System\bzPjzGs.exe
  C:\Windows\System\bzPjzGs.exe
  2⤵
  PID:5472
- C:\Windows\System\PegYgAG.exe
  C:\Windows\System\PegYgAG.exe
  2⤵
  PID:5512
- C:\Windows\System\ehKcVsX.exe
  C:\Windows\System\ehKcVsX.exe
  2⤵
  PID:5424
- C:\Windows\System\DMFBPBs.exe
  C:\Windows\System\DMFBPBs.exe
  2⤵
  PID:5544
- C:\Windows\System\UJkuCCi.exe
  C:\Windows\System\UJkuCCi.exe
  2⤵
  PID:5676
- C:\Windows\System\rYhqriy.exe
  C:\Windows\System\rYhqriy.exe
  2⤵
  PID:5716
- C:\Windows\System\xuGDHTY.exe
  C:\Windows\System\xuGDHTY.exe
  2⤵
  PID:5788
- C:\Windows\System\aMAAbPw.exe
  C:\Windows\System\aMAAbPw.exe
  2⤵
  PID:5688
- C:\Windows\System\BAJHwmj.exe
  C:\Windows\System\BAJHwmj.exe
  2⤵
  PID:5644
- C:\Windows\System\OxpSJmB.exe
  C:\Windows\System\OxpSJmB.exe
  2⤵
  PID:5560
- C:\Windows\System\KGkAYdE.exe
  C:\Windows\System\KGkAYdE.exe
  2⤵
  PID:5772
- C:\Windows\System\UgLIaaQ.exe
  C:\Windows\System\UgLIaaQ.exe
  2⤵
  PID:5248
- C:\Windows\System\dvfUgIx.exe
  C:\Windows\System\dvfUgIx.exe
  2⤵
  PID:5804
- C:\Windows\System\GpzrxeM.exe
  C:\Windows\System\GpzrxeM.exe
  2⤵
  PID:4820
- C:\Windows\System\ygeDTxo.exe
  C:\Windows\System\ygeDTxo.exe
  2⤵
  PID:5848
- C:\Windows\System\DwydbKr.exe
  C:\Windows\System\DwydbKr.exe
  2⤵
  PID:5920
- C:\Windows\System\JRkJIFa.exe
  C:\Windows\System\JRkJIFa.exe
  2⤵
  PID:5868
- C:\Windows\System\cdIJjwj.exe
  C:\Windows\System\cdIJjwj.exe
  2⤵
  PID:6024
- C:\Windows\System\teDaWle.exe
  C:\Windows\System\teDaWle.exe
  2⤵
  PID:5908
- C:\Windows\System\kfJbGTt.exe
  C:\Windows\System\kfJbGTt.exe
  2⤵
  PID:6120
- C:\Windows\System\NqHryqF.exe
  C:\Windows\System\NqHryqF.exe
  2⤵
  PID:5904
- C:\Windows\System\DrCimaX.exe
  C:\Windows\System\DrCimaX.exe
  2⤵
  PID:2540
- C:\Windows\System\tiQLyrk.exe
  C:\Windows\System\tiQLyrk.exe
  2⤵
  PID:6104
- C:\Windows\System\LoFDsWM.exe
  C:\Windows\System\LoFDsWM.exe
  2⤵
  PID:6012
- C:\Windows\System\tBgsYWU.exe
  C:\Windows\System\tBgsYWU.exe
  2⤵
  PID:5972
- C:\Windows\System\kZSzrHY.exe
  C:\Windows\System\kZSzrHY.exe
  2⤵
  PID:6072
- C:\Windows\System\UBScCvc.exe
  C:\Windows\System\UBScCvc.exe
  2⤵
  PID:5180
- C:\Windows\System\fJwYLmk.exe
  C:\Windows\System\fJwYLmk.exe
  2⤵
  PID:5092
- C:\Windows\System\TbtJuQL.exe
  C:\Windows\System\TbtJuQL.exe
  2⤵
  PID:5256
- C:\Windows\System\PZWTFTK.exe
  C:\Windows\System\PZWTFTK.exe
  2⤵
  PID:5352
- C:\Windows\System\fUnFLku.exe
  C:\Windows\System\fUnFLku.exe
  2⤵
  PID:5392
- C:\Windows\System\dIvxRjr.exe
  C:\Windows\System\dIvxRjr.exe
  2⤵
  PID:5816
- C:\Windows\System\DBIytCY.exe
  C:\Windows\System\DBIytCY.exe
  2⤵
  PID:5892
- C:\Windows\System\OALjqqM.exe
  C:\Windows\System\OALjqqM.exe
  2⤵
  PID:5872
- C:\Windows\System\CQRWLSd.exe
  C:\Windows\System\CQRWLSd.exe
  2⤵
  PID:5832
- C:\Windows\System\dbDjtrx.exe
  C:\Windows\System\dbDjtrx.exe
  2⤵
  PID:5176
- C:\Windows\System\YJvGiYu.exe
  C:\Windows\System\YJvGiYu.exe
  2⤵
  PID:5384
- C:\Windows\System\smLscUf.exe
  C:\Windows\System\smLscUf.exe
  2⤵
  PID:5444
- C:\Windows\System\ZsOeZHD.exe
  C:\Windows\System\ZsOeZHD.exe
  2⤵
  PID:5580
- C:\Windows\System\UomnpzS.exe
  C:\Windows\System\UomnpzS.exe
  2⤵
  PID:5952
- C:\Windows\System\OhHWMIj.exe
  C:\Windows\System\OhHWMIj.exe
  2⤵
  PID:5336
- C:\Windows\System\vihBWLL.exe
  C:\Windows\System\vihBWLL.exe
  2⤵
  PID:6092
- C:\Windows\System\ewgUhXP.exe
  C:\Windows\System\ewgUhXP.exe
  2⤵
  PID:6076
- C:\Windows\System\uAsYasc.exe
  C:\Windows\System\uAsYasc.exe
  2⤵
  PID:5184
- C:\Windows\System\qXHwZsm.exe
  C:\Windows\System\qXHwZsm.exe
  2⤵
  PID:5320
- C:\Windows\System\FPZKLKP.exe
  C:\Windows\System\FPZKLKP.exe
  2⤵
  PID:5648
- C:\Windows\System\iwKnTBc.exe
  C:\Windows\System\iwKnTBc.exe
  2⤵
  PID:5556
- C:\Windows\System\VqxKPxn.exe
  C:\Windows\System\VqxKPxn.exe
  2⤵
  PID:5700
- C:\Windows\System\VJrARde.exe
  C:\Windows\System\VJrARde.exe
  2⤵
  PID:5596
- C:\Windows\System\yxdYHGN.exe
  C:\Windows\System\yxdYHGN.exe
  2⤵
  PID:6068
- C:\Windows\System\BdPgsxW.exe
  C:\Windows\System\BdPgsxW.exe
  2⤵
  PID:5492
- C:\Windows\System\CzbxIdM.exe
  C:\Windows\System\CzbxIdM.exe
  2⤵
  PID:4892
- C:\Windows\System\XYWYcRZ.exe
  C:\Windows\System\XYWYcRZ.exe
  2⤵
  PID:5696
- C:\Windows\System\yEOrgVM.exe
  C:\Windows\System\yEOrgVM.exe
  2⤵
  PID:5628
- C:\Windows\System\FLQaXAb.exe
  C:\Windows\System\FLQaXAb.exe
  2⤵
  PID:5856
- C:\Windows\System\QIDiHYn.exe
  C:\Windows\System\QIDiHYn.exe
  2⤵
  PID:5616
- C:\Windows\System\cwrcNTC.exe
  C:\Windows\System\cwrcNTC.exe
  2⤵
  PID:5632
- C:\Windows\System\yQKexrE.exe
  C:\Windows\System\yQKexrE.exe
  2⤵
  PID:5800
- C:\Windows\System\ZCBfMCY.exe
  C:\Windows\System\ZCBfMCY.exe
  2⤵
  PID:5748
- C:\Windows\System\LhKjImS.exe
  C:\Windows\System\LhKjImS.exe
  2⤵
  PID:5576
- C:\Windows\System\TXVepqN.exe
  C:\Windows\System\TXVepqN.exe
  2⤵
  PID:5528
- C:\Windows\System\ufzTblw.exe
  C:\Windows\System\ufzTblw.exe
  2⤵
  PID:5600
- C:\Windows\System\AspcmnD.exe
  C:\Windows\System\AspcmnD.exe
  2⤵
  PID:5612
- C:\Windows\System\ozBuqmm.exe
  C:\Windows\System\ozBuqmm.exe
  2⤵
  PID:5620
- C:\Windows\System\jkuOyfs.exe
  C:\Windows\System\jkuOyfs.exe
  2⤵
  PID:5768
- C:\Windows\System\iZSWfjo.exe
  C:\Windows\System\iZSWfjo.exe
  2⤵
  PID:6148
- C:\Windows\System\KmlHjoT.exe
  C:\Windows\System\KmlHjoT.exe
  2⤵
  PID:6164
- C:\Windows\System\xJPCYlb.exe
  C:\Windows\System\xJPCYlb.exe
  2⤵
  PID:6184
- C:\Windows\System\kqSqqoP.exe
  C:\Windows\System\kqSqqoP.exe
  2⤵
  PID:6200
- C:\Windows\System\bZtYhcT.exe
  C:\Windows\System\bZtYhcT.exe
  2⤵
  PID:6216
- C:\Windows\System\sXMZkYp.exe
  C:\Windows\System\sXMZkYp.exe
  2⤵
  PID:6232
- C:\Windows\System\VRZgyIc.exe
  C:\Windows\System\VRZgyIc.exe
  2⤵
  PID:6248
- C:\Windows\System\XTjgcvB.exe
  C:\Windows\System\XTjgcvB.exe
  2⤵
  PID:6268
- C:\Windows\System\NWxPPtT.exe
  C:\Windows\System\NWxPPtT.exe
  2⤵
  PID:6284
- C:\Windows\System\jzkWmnm.exe
  C:\Windows\System\jzkWmnm.exe
  2⤵
  PID:6300
- C:\Windows\System\UNwyhgY.exe
  C:\Windows\System\UNwyhgY.exe
  2⤵
  PID:6316
- C:\Windows\System\RQIuHdi.exe
  C:\Windows\System\RQIuHdi.exe
  2⤵
  PID:6332
- C:\Windows\System\UpkqpBH.exe
  C:\Windows\System\UpkqpBH.exe
  2⤵
  PID:6348
- C:\Windows\System\RTyjQKw.exe
  C:\Windows\System\RTyjQKw.exe
  2⤵
  PID:6364
- C:\Windows\System\OLqVFjf.exe
  C:\Windows\System\OLqVFjf.exe
  2⤵
  PID:6380
- C:\Windows\System\KMSfPck.exe
  C:\Windows\System\KMSfPck.exe
  2⤵
  PID:6396
- C:\Windows\System\QNkKFNH.exe
  C:\Windows\System\QNkKFNH.exe
  2⤵
  PID:6412
- C:\Windows\System\LQzchGp.exe
  C:\Windows\System\LQzchGp.exe
  2⤵
  PID:6440
- C:\Windows\System\JxZitsd.exe
  C:\Windows\System\JxZitsd.exe
  2⤵
  PID:6456
- C:\Windows\System\gwuhDyw.exe
  C:\Windows\System\gwuhDyw.exe
  2⤵
  PID:6472
- C:\Windows\System\NhRlVpO.exe
  C:\Windows\System\NhRlVpO.exe
  2⤵
  PID:6488
- C:\Windows\System\XiYmVwk.exe
  C:\Windows\System\XiYmVwk.exe
  2⤵
  PID:6504
- C:\Windows\System\WoUiEes.exe
  C:\Windows\System\WoUiEes.exe
  2⤵
  PID:6524
- C:\Windows\System\RvTloJE.exe
  C:\Windows\System\RvTloJE.exe
  2⤵
  PID:6540
- C:\Windows\System\zSvdAXL.exe
  C:\Windows\System\zSvdAXL.exe
  2⤵
  PID:6556
- C:\Windows\System\rfqTIpQ.exe
  C:\Windows\System\rfqTIpQ.exe
  2⤵
  PID:6576
- C:\Windows\System\sYtdpaa.exe
  C:\Windows\System\sYtdpaa.exe
  2⤵
  PID:6592
- C:\Windows\System\PyPXKQQ.exe
  C:\Windows\System\PyPXKQQ.exe
  2⤵
  PID:6608
- C:\Windows\System\NseiLmC.exe
  C:\Windows\System\NseiLmC.exe
  2⤵
  PID:6740
- C:\Windows\System\pljZktl.exe
  C:\Windows\System\pljZktl.exe
  2⤵
  PID:6812
- C:\Windows\System\ouVZqFA.exe
  C:\Windows\System\ouVZqFA.exe
  2⤵
  PID:6828
- C:\Windows\System\fkjoNle.exe
  C:\Windows\System\fkjoNle.exe
  2⤵
  PID:6844
- C:\Windows\System\wMNBxvQ.exe
  C:\Windows\System\wMNBxvQ.exe
  2⤵
  PID:6860
- C:\Windows\System\tWfkBTt.exe
  C:\Windows\System\tWfkBTt.exe
  2⤵
  PID:6876
- C:\Windows\System\UrPaJmE.exe
  C:\Windows\System\UrPaJmE.exe
  2⤵
  PID:6892
- C:\Windows\System\PmMINkn.exe
  C:\Windows\System\PmMINkn.exe
  2⤵
  PID:6908
- C:\Windows\System\pmcSoyC.exe
  C:\Windows\System\pmcSoyC.exe
  2⤵
  PID:6928
- C:\Windows\System\ASBLrCN.exe
  C:\Windows\System\ASBLrCN.exe
  2⤵
  PID:6944
- C:\Windows\System\kvQXJQc.exe
  C:\Windows\System\kvQXJQc.exe
  2⤵
  PID:6960
- C:\Windows\System\mDnFXtg.exe
  C:\Windows\System\mDnFXtg.exe
  2⤵
  PID:6996
- C:\Windows\System\UaTrTis.exe
  C:\Windows\System\UaTrTis.exe
  2⤵
  PID:7012
- C:\Windows\System\YTRGFgT.exe
  C:\Windows\System\YTRGFgT.exe
  2⤵
  PID:7028
- C:\Windows\System\OeqliYl.exe
  C:\Windows\System\OeqliYl.exe
  2⤵
  PID:7044
- C:\Windows\System\vyFPBIt.exe
  C:\Windows\System\vyFPBIt.exe
  2⤵
  PID:7060
- C:\Windows\System\KLaUXWy.exe
  C:\Windows\System\KLaUXWy.exe
  2⤵
  PID:7076
- C:\Windows\System\vtANnzX.exe
  C:\Windows\System\vtANnzX.exe
  2⤵
  PID:7092
- C:\Windows\System\iZIERkj.exe
  C:\Windows\System\iZIERkj.exe
  2⤵
  PID:7108
- C:\Windows\System\lGaJMql.exe
  C:\Windows\System\lGaJMql.exe
  2⤵
  PID:7124
- C:\Windows\System\xuyBduu.exe
  C:\Windows\System\xuyBduu.exe
  2⤵
  PID:7140
- C:\Windows\System\KUCMiAC.exe
  C:\Windows\System\KUCMiAC.exe
  2⤵
  PID:7156
- C:\Windows\System\ZMhFyxL.exe
  C:\Windows\System\ZMhFyxL.exe
  2⤵
  PID:6180
- C:\Windows\System\sKLxomE.exe
  C:\Windows\System\sKLxomE.exe
  2⤵
  PID:6256
- C:\Windows\System\swTPAYN.exe
  C:\Windows\System\swTPAYN.exe
  2⤵
  PID:6292
- C:\Windows\System\HIsNnsU.exe
  C:\Windows\System\HIsNnsU.exe
  2⤵
  PID:6328
- C:\Windows\System\POTKZjq.exe
  C:\Windows\System\POTKZjq.exe
  2⤵
  PID:5228
- C:\Windows\System\tlgDJgx.exe
  C:\Windows\System\tlgDJgx.exe
  2⤵
  PID:5148
- C:\Windows\System\LUGWcoV.exe
  C:\Windows\System\LUGWcoV.exe
  2⤵
  PID:6276
- C:\Windows\System\hSlbcQO.exe
  C:\Windows\System\hSlbcQO.exe
  2⤵
  PID:6360
- C:\Windows\System\sRDrTks.exe
  C:\Windows\System\sRDrTks.exe
  2⤵
  PID:6388
- C:\Windows\System\XRUxfBY.exe
  C:\Windows\System\XRUxfBY.exe
  2⤵
  PID:6496
- C:\Windows\System\DTWdtBg.exe
  C:\Windows\System\DTWdtBg.exe
  2⤵
  PID:6564
- C:\Windows\System\vYISqQQ.exe
  C:\Windows\System\vYISqQQ.exe
  2⤵
  PID:6468
- C:\Windows\System\taSxKIn.exe
  C:\Windows\System\taSxKIn.exe
  2⤵
  PID:6452
- C:\Windows\System\SQKgOdL.exe
  C:\Windows\System\SQKgOdL.exe
  2⤵
  PID:6644
- C:\Windows\System\YOXsGPN.exe
  C:\Windows\System\YOXsGPN.exe
  2⤵
  PID:6664
- C:\Windows\System\HEjkouP.exe
  C:\Windows\System\HEjkouP.exe
  2⤵
  PID:6680
- C:\Windows\System\OYlXGgw.exe
  C:\Windows\System\OYlXGgw.exe
  2⤵
  PID:6704
- C:\Windows\System\WjWARRg.exe
  C:\Windows\System\WjWARRg.exe
  2⤵
  PID:6712
- C:\Windows\System\tDwDbad.exe
  C:\Windows\System\tDwDbad.exe
  2⤵
  PID:6756
- C:\Windows\System\OGLPjls.exe
  C:\Windows\System\OGLPjls.exe
  2⤵
  PID:6760
- C:\Windows\System\dPsAtkw.exe
  C:\Windows\System\dPsAtkw.exe
  2⤵
  PID:6776
- C:\Windows\System\xcaFNEI.exe
  C:\Windows\System\xcaFNEI.exe
  2⤵
  PID:6792
- C:\Windows\System\wtYbTyW.exe
  C:\Windows\System\wtYbTyW.exe
  2⤵
  PID:6804
- C:\Windows\System\Gtelgzw.exe
  C:\Windows\System\Gtelgzw.exe
  2⤵
  PID:6900
- C:\Windows\System\YluLtCm.exe
  C:\Windows\System\YluLtCm.exe
  2⤵
  PID:6872
- C:\Windows\System\aSnrhcP.exe
  C:\Windows\System\aSnrhcP.exe
  2⤵
  PID:6856
- C:\Windows\System\IinDIff.exe
  C:\Windows\System\IinDIff.exe
  2⤵
  PID:6916
- C:\Windows\System\MIzMrUy.exe
  C:\Windows\System\MIzMrUy.exe
  2⤵
  PID:6984
- C:\Windows\System\OCLyWDD.exe
  C:\Windows\System\OCLyWDD.exe
  2⤵
  PID:6820
- C:\Windows\System\SKpoaUl.exe
  C:\Windows\System\SKpoaUl.exe
  2⤵
  PID:7084
- C:\Windows\System\DQNqUbB.exe
  C:\Windows\System\DQNqUbB.exe
  2⤵
  PID:7120
- C:\Windows\System\SjxfXeN.exe
  C:\Windows\System\SjxfXeN.exe
  2⤵
  PID:6108
- C:\Windows\System\atRoJRa.exe
  C:\Windows\System\atRoJRa.exe
  2⤵
  PID:5732
- C:\Windows\System\HqyJLFg.exe
  C:\Windows\System\HqyJLFg.exe
  2⤵
  PID:6420
- C:\Windows\System\cffWOvB.exe
  C:\Windows\System\cffWOvB.exe
  2⤵
  PID:6372
- C:\Windows\System\kJgYtCv.exe
  C:\Windows\System\kJgYtCv.exe
  2⤵
  PID:6408
- C:\Windows\System\JnQOQxI.exe
  C:\Windows\System\JnQOQxI.exe
  2⤵
  PID:6212
- C:\Windows\System\MXWNqqO.exe
  C:\Windows\System\MXWNqqO.exe
  2⤵
  PID:5672
- C:\Windows\System\xaFsKtP.exe
  C:\Windows\System\xaFsKtP.exe
  2⤵
  PID:6628
- C:\Windows\System\XwnzmTU.exe
  C:\Windows\System\XwnzmTU.exe
  2⤵
  PID:6512
- C:\Windows\System\dlNRsyK.exe
  C:\Windows\System\dlNRsyK.exe
  2⤵
  PID:7072
- C:\Windows\System\viwLCqi.exe
  C:\Windows\System\viwLCqi.exe
  2⤵
  PID:5624
- C:\Windows\System\NAfHFrD.exe
  C:\Windows\System\NAfHFrD.exe
  2⤵
  PID:7052
- C:\Windows\System\BdfCLml.exe
  C:\Windows\System\BdfCLml.exe
  2⤵
  PID:6716
- C:\Windows\System\YlGvxAJ.exe
  C:\Windows\System\YlGvxAJ.exe
  2⤵
  PID:6980
- C:\Windows\System\dRjPVlN.exe
  C:\Windows\System\dRjPVlN.exe
  2⤵
  PID:6448
- C:\Windows\System\lCumFNO.exe
  C:\Windows\System\lCumFNO.exe
  2⤵
  PID:6800
- C:\Windows\System\McwfBPR.exe
  C:\Windows\System\McwfBPR.exe
  2⤵
  PID:6728
- C:\Windows\System\HKDVxeM.exe
  C:\Windows\System\HKDVxeM.exe
  2⤵
  PID:6884
- C:\Windows\System\jgrdsis.exe
  C:\Windows\System\jgrdsis.exe
  2⤵
  PID:6308
- C:\Windows\System\zycLLnW.exe
  C:\Windows\System\zycLLnW.exe
  2⤵
  PID:6228
- C:\Windows\System\ZuXxmKl.exe
  C:\Windows\System\ZuXxmKl.exe
  2⤵
  PID:6356
- C:\Windows\System\YngwZPP.exe
  C:\Windows\System\YngwZPP.exe
  2⤵
  PID:6156
- C:\Windows\System\RoIbLGm.exe
  C:\Windows\System\RoIbLGm.exe
  2⤵
  PID:6484
- C:\Windows\System\slwFZTz.exe
  C:\Windows\System\slwFZTz.exe
  2⤵
  PID:6552
- C:\Windows\System\vXQzkQP.exe
  C:\Windows\System\vXQzkQP.exe
  2⤵
  PID:6432
- C:\Windows\System\JPADrdA.exe
  C:\Windows\System\JPADrdA.exe
  2⤵
  PID:7068
- C:\Windows\System\FSpVdqA.exe
  C:\Windows\System\FSpVdqA.exe
  2⤵
  PID:6340
- C:\Windows\System\DAEXFhu.exe
  C:\Windows\System\DAEXFhu.exe
  2⤵
  PID:6404
- C:\Windows\System\IujzoVE.exe
  C:\Windows\System\IujzoVE.exe
  2⤵
  PID:6656
- C:\Windows\System\AVdUFND.exe
  C:\Windows\System\AVdUFND.exe
  2⤵
  PID:6924
- C:\Windows\System\dFAPYIv.exe
  C:\Windows\System\dFAPYIv.exe
  2⤵
  PID:6676
- C:\Windows\System\UGCCxeB.exe
  C:\Windows\System\UGCCxeB.exe
  2⤵
  PID:6808
- C:\Windows\System\ALPqHxx.exe
  C:\Windows\System\ALPqHxx.exe
  2⤵
  PID:6536
- C:\Windows\System\LnTyhSr.exe
  C:\Windows\System\LnTyhSr.exe
  2⤵
  PID:7148
- C:\Windows\System\uEHQXeA.exe
  C:\Windows\System\uEHQXeA.exe
  2⤵
  PID:6464
- C:\Windows\System\cFiBzdn.exe
  C:\Windows\System\cFiBzdn.exe
  2⤵
  PID:5368
- C:\Windows\System\rYDwDUE.exe
  C:\Windows\System\rYDwDUE.exe
  2⤵
  PID:6160
- C:\Windows\System\HUFjyGQ.exe
  C:\Windows\System\HUFjyGQ.exe
  2⤵
  PID:6240
- C:\Windows\System\mtVdFkG.exe
  C:\Windows\System\mtVdFkG.exe
  2⤵
  PID:7188
- C:\Windows\System\zDtmYah.exe
  C:\Windows\System\zDtmYah.exe
  2⤵
  PID:7204
- C:\Windows\System\VqscHBs.exe
  C:\Windows\System\VqscHBs.exe
  2⤵
  PID:7244
- C:\Windows\System\cYEHSjd.exe
  C:\Windows\System\cYEHSjd.exe
  2⤵
  PID:7276
- C:\Windows\System\oHGpYmI.exe
  C:\Windows\System\oHGpYmI.exe
  2⤵
  PID:7292
- C:\Windows\System\tXnRDcJ.exe
  C:\Windows\System\tXnRDcJ.exe
  2⤵
  PID:7308
- C:\Windows\System\hbWETBo.exe
  C:\Windows\System\hbWETBo.exe
  2⤵
  PID:7324
- C:\Windows\System\ohtlRVY.exe
  C:\Windows\System\ohtlRVY.exe
  2⤵
  PID:7340
- C:\Windows\System\UniDjHI.exe
  C:\Windows\System\UniDjHI.exe
  2⤵
  PID:7356
- C:\Windows\System\RRlNvbE.exe
  C:\Windows\System\RRlNvbE.exe
  2⤵
  PID:7372
- C:\Windows\System\duKCsbs.exe
  C:\Windows\System\duKCsbs.exe
  2⤵
  PID:7388
- C:\Windows\System\KbDAetr.exe
  C:\Windows\System\KbDAetr.exe
  2⤵
  PID:7404
- C:\Windows\System\UBwjzoN.exe
  C:\Windows\System\UBwjzoN.exe
  2⤵
  PID:7420
- C:\Windows\System\nWEpIBW.exe
  C:\Windows\System\nWEpIBW.exe
  2⤵
  PID:7436
- C:\Windows\System\MnCQLrC.exe
  C:\Windows\System\MnCQLrC.exe
  2⤵
  PID:7452
- C:\Windows\System\ypJXafs.exe
  C:\Windows\System\ypJXafs.exe
  2⤵
  PID:7468
- C:\Windows\System\NlhZQeO.exe
  C:\Windows\System\NlhZQeO.exe
  2⤵
  PID:7484
- C:\Windows\System\xebXrKQ.exe
  C:\Windows\System\xebXrKQ.exe
  2⤵
  PID:7500
- C:\Windows\System\mHqyVeC.exe
  C:\Windows\System\mHqyVeC.exe
  2⤵
  PID:7516
- C:\Windows\System\zfkoSQf.exe
  C:\Windows\System\zfkoSQf.exe
  2⤵
  PID:7532
- C:\Windows\System\pIcBqeY.exe
  C:\Windows\System\pIcBqeY.exe
  2⤵
  PID:7548
- C:\Windows\System\UPNlOfy.exe
  C:\Windows\System\UPNlOfy.exe
  2⤵
  PID:7564
- C:\Windows\System\aXHkrmK.exe
  C:\Windows\System\aXHkrmK.exe
  2⤵
  PID:7580
- C:\Windows\System\KCTpmyj.exe
  C:\Windows\System\KCTpmyj.exe
  2⤵
  PID:7596
- C:\Windows\System\FaIlusj.exe
  C:\Windows\System\FaIlusj.exe
  2⤵
  PID:7612
- C:\Windows\System\ApWbUSO.exe
  C:\Windows\System\ApWbUSO.exe
  2⤵
  PID:7628
- C:\Windows\System\PDZgsFY.exe
  C:\Windows\System\PDZgsFY.exe
  2⤵
  PID:7644
- C:\Windows\System\mQlebGK.exe
  C:\Windows\System\mQlebGK.exe
  2⤵
  PID:7660
- C:\Windows\System\kNRChqc.exe
  C:\Windows\System\kNRChqc.exe
  2⤵
  PID:7676
- C:\Windows\System\caXZvPR.exe
  C:\Windows\System\caXZvPR.exe
  2⤵
  PID:7692
- C:\Windows\System\IajbesP.exe
  C:\Windows\System\IajbesP.exe
  2⤵
  PID:7708
- C:\Windows\System\KQvoXOB.exe
  C:\Windows\System\KQvoXOB.exe
  2⤵
  PID:7724
- C:\Windows\System\eqxGdHi.exe
  C:\Windows\System\eqxGdHi.exe
  2⤵
  PID:7740
- C:\Windows\System\XQyhNvG.exe
  C:\Windows\System\XQyhNvG.exe
  2⤵
  PID:7756
- C:\Windows\System\EvrmKuJ.exe
  C:\Windows\System\EvrmKuJ.exe
  2⤵
  PID:7772
- C:\Windows\System\wpmFxvX.exe
  C:\Windows\System\wpmFxvX.exe
  2⤵
  PID:7788
- C:\Windows\System\dmygFPv.exe
  C:\Windows\System\dmygFPv.exe
  2⤵
  PID:7804
- C:\Windows\System\GQvmePj.exe
  C:\Windows\System\GQvmePj.exe
  2⤵
  PID:7820
- C:\Windows\System\BjMOLrI.exe
  C:\Windows\System\BjMOLrI.exe
  2⤵
  PID:7836
- C:\Windows\System\BhgWgLO.exe
  C:\Windows\System\BhgWgLO.exe
  2⤵
  PID:7852
- C:\Windows\System\PNnRjGs.exe
  C:\Windows\System\PNnRjGs.exe
  2⤵
  PID:7868
- C:\Windows\System\KPMgasu.exe
  C:\Windows\System\KPMgasu.exe
  2⤵
  PID:7884
- C:\Windows\System\dXfwBlq.exe
  C:\Windows\System\dXfwBlq.exe
  2⤵
  PID:7900
- C:\Windows\System\VPLPfPq.exe
  C:\Windows\System\VPLPfPq.exe
  2⤵
  PID:7916
- C:\Windows\System\UKQjxHh.exe
  C:\Windows\System\UKQjxHh.exe
  2⤵
  PID:7932
- C:\Windows\System\SLBpyCd.exe
  C:\Windows\System\SLBpyCd.exe
  2⤵
  PID:7948
- C:\Windows\System\iJSqaCH.exe
  C:\Windows\System\iJSqaCH.exe
  2⤵
  PID:7964
- C:\Windows\System\WIjggBZ.exe
  C:\Windows\System\WIjggBZ.exe
  2⤵
  PID:7980
- C:\Windows\System\LbqOMlb.exe
  C:\Windows\System\LbqOMlb.exe
  2⤵
  PID:8000
- C:\Windows\System\rqeTcMI.exe
  C:\Windows\System\rqeTcMI.exe
  2⤵
  PID:8016
- C:\Windows\System\XkNcieo.exe
  C:\Windows\System\XkNcieo.exe
  2⤵
  PID:8032
- C:\Windows\System\EfGrYmu.exe
  C:\Windows\System\EfGrYmu.exe
  2⤵
  PID:8048
- C:\Windows\System\sznAQYb.exe
  C:\Windows\System\sznAQYb.exe
  2⤵
  PID:8064
- C:\Windows\System\PlVUnTF.exe
  C:\Windows\System\PlVUnTF.exe
  2⤵
  PID:8080
- C:\Windows\System\jtJlCcb.exe
  C:\Windows\System\jtJlCcb.exe
  2⤵
  PID:8096
- C:\Windows\System\sGYGkyD.exe
  C:\Windows\System\sGYGkyD.exe
  2⤵
  PID:8112
- C:\Windows\System\XObTRLa.exe
  C:\Windows\System\XObTRLa.exe
  2⤵
  PID:8128
- C:\Windows\System\Vtfihfz.exe
  C:\Windows\System\Vtfihfz.exe
  2⤵
  PID:8144
- C:\Windows\System\bjjeANx.exe
  C:\Windows\System\bjjeANx.exe
  2⤵
  PID:8160
- C:\Windows\System\petCBYy.exe
  C:\Windows\System\petCBYy.exe
  2⤵
  PID:8176
- C:\Windows\System\ZMsgNcI.exe
  C:\Windows\System\ZMsgNcI.exe
  2⤵
  PID:7136
- C:\Windows\System\wGvYKRE.exe
  C:\Windows\System\wGvYKRE.exe
  2⤵
  PID:6624
- C:\Windows\System\rzHppwO.exe
  C:\Windows\System\rzHppwO.exe
  2⤵
  PID:6660
- C:\Windows\System\VLphnuG.exe
  C:\Windows\System\VLphnuG.exe
  2⤵
  PID:7236
- C:\Windows\System\iXOziiV.exe
  C:\Windows\System\iXOziiV.exe
  2⤵
  PID:7024
- C:\Windows\System\WNFyacm.exe
  C:\Windows\System\WNFyacm.exe
  2⤵
  PID:7232
- C:\Windows\System\jfNjtcC.exe
  C:\Windows\System\jfNjtcC.exe
  2⤵
  PID:7196
- C:\Windows\System\TlhjIuI.exe
  C:\Windows\System\TlhjIuI.exe
  2⤵
  PID:6700
- C:\Windows\System\OlxEhmH.exe
  C:\Windows\System\OlxEhmH.exe
  2⤵
  PID:7264
- C:\Windows\System\pzqenxK.exe
  C:\Windows\System\pzqenxK.exe
  2⤵
  PID:6244
- C:\Windows\System\CNtuqHG.exe
  C:\Windows\System\CNtuqHG.exe
  2⤵
  PID:7104
- C:\Windows\System\LYHcflJ.exe
  C:\Windows\System\LYHcflJ.exe
  2⤵
  PID:7288
- C:\Windows\System\CASEtan.exe
  C:\Windows\System\CASEtan.exe
  2⤵
  PID:7352
- C:\Windows\System\lkLytQl.exe
  C:\Windows\System\lkLytQl.exe
  2⤵
  PID:7268
- C:\Windows\System\pCEWcnc.exe
  C:\Windows\System\pCEWcnc.exe
  2⤵
  PID:7412
- C:\Windows\System\GDJQuCt.exe
  C:\Windows\System\GDJQuCt.exe
  2⤵
  PID:7476
- C:\Windows\System\QrUUEyy.exe
  C:\Windows\System\QrUUEyy.exe
  2⤵
  PID:7368
- C:\Windows\System\flDTIwP.exe
  C:\Windows\System\flDTIwP.exe
  2⤵
  PID:7508
- C:\Windows\System\YvdBUel.exe
  C:\Windows\System\YvdBUel.exe
  2⤵
  PID:7396
- C:\Windows\System\psJjeIl.exe
  C:\Windows\System\psJjeIl.exe
  2⤵
  PID:7544
- C:\Windows\System\dbFpzBR.exe
  C:\Windows\System\dbFpzBR.exe
  2⤵
  PID:7572
- C:\Windows\System\WKvDVcV.exe
  C:\Windows\System\WKvDVcV.exe
  2⤵
  PID:7604
- C:\Windows\System\SaRhtss.exe
  C:\Windows\System\SaRhtss.exe
  2⤵
  PID:7636
- C:\Windows\System\woiNtst.exe
  C:\Windows\System\woiNtst.exe
  2⤵
  PID:7652
- C:\Windows\System\gbnZyDJ.exe
  C:\Windows\System\gbnZyDJ.exe
  2⤵
  PID:7704
- C:\Windows\System\CUowryC.exe
  C:\Windows\System\CUowryC.exe
  2⤵
  PID:7736
- C:\Windows\System\TSYzHtQ.exe
  C:\Windows\System\TSYzHtQ.exe
  2⤵
  PID:7720
- C:\Windows\System\UPJqxIz.exe
  C:\Windows\System\UPJqxIz.exe
  2⤵
  PID:7800
- C:\Windows\System\ftvuoJw.exe
  C:\Windows\System\ftvuoJw.exe
  2⤵
  PID:7864
- C:\Windows\System\NxrOZdN.exe
  C:\Windows\System\NxrOZdN.exe
  2⤵
  PID:7816
- C:\Windows\System\RITecGM.exe
  C:\Windows\System\RITecGM.exe
  2⤵
  PID:7880
- C:\Windows\System\lJFQGUM.exe
  C:\Windows\System\lJFQGUM.exe
  2⤵
  PID:7928
- C:\Windows\System\GEeKDCg.exe
  C:\Windows\System\GEeKDCg.exe
  2⤵
  PID:7960
- C:\Windows\System\RVJNbKI.exe
  C:\Windows\System\RVJNbKI.exe
  2⤵
  PID:8060
- C:\Windows\System\rSnEMzW.exe
  C:\Windows\System\rSnEMzW.exe
  2⤵
  PID:8124
- C:\Windows\System\spUDWqF.exe
  C:\Windows\System\spUDWqF.exe
  2⤵
  PID:8012
- C:\Windows\System\gjpyNZE.exe
  C:\Windows\System\gjpyNZE.exe
  2⤵
  PID:8108
- C:\Windows\System\HZUnBxq.exe
  C:\Windows\System\HZUnBxq.exe
  2⤵
  PID:7944
- C:\Windows\System\miNOKth.exe
  C:\Windows\System\miNOKth.exe
  2⤵
  PID:8076
- C:\Windows\System\XwvRzYz.exe
  C:\Windows\System\XwvRzYz.exe
  2⤵
  PID:7116
- C:\Windows\System\YXLjzac.exe
  C:\Windows\System\YXLjzac.exe
  2⤵
  PID:8104
- C:\Windows\System\TcpuySM.exe
  C:\Windows\System\TcpuySM.exe
  2⤵
  PID:7908
- C:\Windows\System\EkZFYOp.exe
  C:\Windows\System\EkZFYOp.exe
  2⤵
  PID:7036
- C:\Windows\System\zZxHKMz.exe
  C:\Windows\System\zZxHKMz.exe
  2⤵
  PID:6176
- C:\Windows\System\goziePo.exe
  C:\Windows\System\goziePo.exe
  2⤵
  PID:7252
- C:\Windows\System\GLiggAs.exe
  C:\Windows\System\GLiggAs.exe
  2⤵
  PID:7348
- C:\Windows\System\vfHTQmD.exe
  C:\Windows\System\vfHTQmD.exe
  2⤵
  PID:7284
- C:\Windows\System\BzXNukb.exe
  C:\Windows\System\BzXNukb.exe
  2⤵
  PID:7384
- C:\Windows\System\SMQuKSW.exe
  C:\Windows\System\SMQuKSW.exe
  2⤵
  PID:7460
- C:\Windows\System\OtlojfV.exe
  C:\Windows\System\OtlojfV.exe
  2⤵
  PID:7556
- C:\Windows\System\qXpKszf.exe
  C:\Windows\System\qXpKszf.exe
  2⤵
  PID:7620
- C:\Windows\System\lNzgamP.exe
  C:\Windows\System\lNzgamP.exe
  2⤵
  PID:7688
- C:\Windows\System\UNLXuEx.exe
  C:\Windows\System\UNLXuEx.exe
  2⤵
  PID:7668
- C:\Windows\System\NJPVBuv.exe
  C:\Windows\System\NJPVBuv.exe
  2⤵
  PID:7796
- C:\Windows\System\YxpAsPs.exe
  C:\Windows\System\YxpAsPs.exe
  2⤵
  PID:7876
- C:\Windows\System\hlcYzjR.exe
  C:\Windows\System\hlcYzjR.exe
  2⤵
  PID:8056
- C:\Windows\System\YYMIaEu.exe
  C:\Windows\System\YYMIaEu.exe
  2⤵
  PID:8120
- C:\Windows\System\jbbiULF.exe
  C:\Windows\System\jbbiULF.exe
  2⤵
  PID:8024
- C:\Windows\System\uqEKSjl.exe
  C:\Windows\System\uqEKSjl.exe
  2⤵
  PID:8008
- C:\Windows\System\UndNTAX.exe
  C:\Windows\System\UndNTAX.exe
  2⤵
  PID:6992
- C:\Windows\System\BaygHqE.exe
  C:\Windows\System\BaygHqE.exe
  2⤵
  PID:7256
- C:\Windows\System\tScFvBD.exe
  C:\Windows\System\tScFvBD.exe
  2⤵
  PID:8168
- C:\Windows\System\jkoPLUh.exe
  C:\Windows\System\jkoPLUh.exe
  2⤵
  PID:7444
- C:\Windows\System\KKPCCPs.exe
  C:\Windows\System\KKPCCPs.exe
  2⤵
  PID:7540
- C:\Windows\System\CLgivFt.exe
  C:\Windows\System\CLgivFt.exe
  2⤵
  PID:6428
- C:\Windows\System\GEiGDnC.exe
  C:\Windows\System\GEiGDnC.exe
  2⤵
  PID:7528
- C:\Windows\System\iMfbEdi.exe
  C:\Windows\System\iMfbEdi.exe
  2⤵
  PID:7748
- C:\Windows\System\Xendbal.exe
  C:\Windows\System\Xendbal.exe
  2⤵
  PID:7784
- C:\Windows\System\lMYhtYi.exe
  C:\Windows\System\lMYhtYi.exe
  2⤵
  PID:7496
- C:\Windows\System\YxcRwzu.exe
  C:\Windows\System\YxcRwzu.exe
  2⤵
  PID:6836
- C:\Windows\System\VtAYytZ.exe
  C:\Windows\System\VtAYytZ.exe
  2⤵
  PID:6616
- C:\Windows\System\BdOXyOJ.exe
  C:\Windows\System\BdOXyOJ.exe
  2⤵
  PID:7320
- C:\Windows\System\CUvkgdO.exe
  C:\Windows\System\CUvkgdO.exe
  2⤵
  PID:7976
- C:\Windows\System\JwrZnRT.exe
  C:\Windows\System\JwrZnRT.exe
  2⤵
  PID:7212
- C:\Windows\System\bBjTeOJ.exe
  C:\Windows\System\bBjTeOJ.exe
  2⤵
  PID:7912
- C:\Windows\System\MNGvcnz.exe
  C:\Windows\System\MNGvcnz.exe
  2⤵
  PID:7132
- C:\Windows\System\mcSuMxB.exe
  C:\Windows\System\mcSuMxB.exe
  2⤵
  PID:7848
- C:\Windows\System\AUpCACp.exe
  C:\Windows\System\AUpCACp.exe
  2⤵
  PID:7304
- C:\Windows\System\haYYyhl.exe
  C:\Windows\System\haYYyhl.exe
  2⤵
  PID:8208
- C:\Windows\System\kPfvMzR.exe
  C:\Windows\System\kPfvMzR.exe
  2⤵
  PID:8224
- C:\Windows\System\pKuKobP.exe
  C:\Windows\System\pKuKobP.exe
  2⤵
  PID:8240
- C:\Windows\System\EdTQPdl.exe
  C:\Windows\System\EdTQPdl.exe
  2⤵
  PID:8256
- C:\Windows\System\AKgCCFy.exe
  C:\Windows\System\AKgCCFy.exe
  2⤵
  PID:8272
- C:\Windows\System\kwelOsx.exe
  C:\Windows\System\kwelOsx.exe
  2⤵
  PID:8288
- C:\Windows\System\vJIhYIP.exe
  C:\Windows\System\vJIhYIP.exe
  2⤵
  PID:8304
- C:\Windows\System\ytjOIeb.exe
  C:\Windows\System\ytjOIeb.exe
  2⤵
  PID:8320
- C:\Windows\System\wyVdIsX.exe
  C:\Windows\System\wyVdIsX.exe
  2⤵
  PID:8336
- C:\Windows\System\VPcNMUm.exe
  C:\Windows\System\VPcNMUm.exe
  2⤵
  PID:8352
- C:\Windows\System\xWRCuOr.exe
  C:\Windows\System\xWRCuOr.exe
  2⤵
  PID:8368
- C:\Windows\System\Rfamssq.exe
  C:\Windows\System\Rfamssq.exe
  2⤵
  PID:8384
- C:\Windows\System\LvZKVFR.exe
  C:\Windows\System\LvZKVFR.exe
  2⤵
  PID:8400
- C:\Windows\System\PtqYzkX.exe
  C:\Windows\System\PtqYzkX.exe
  2⤵
  PID:8416
- C:\Windows\System\FyyaaOb.exe
  C:\Windows\System\FyyaaOb.exe
  2⤵
  PID:8432
- C:\Windows\System\VbsGzhZ.exe
  C:\Windows\System\VbsGzhZ.exe
  2⤵
  PID:8448
- C:\Windows\System\QFQuTWL.exe
  C:\Windows\System\QFQuTWL.exe
  2⤵
  PID:8464
- C:\Windows\System\DJRqODE.exe
  C:\Windows\System\DJRqODE.exe
  2⤵
  PID:8480
- C:\Windows\System\tNFSIgB.exe
  C:\Windows\System\tNFSIgB.exe
  2⤵
  PID:8496
- C:\Windows\System\zZJHGwE.exe
  C:\Windows\System\zZJHGwE.exe
  2⤵
  PID:8512
- C:\Windows\System\ipXSQnH.exe
  C:\Windows\System\ipXSQnH.exe
  2⤵
  PID:8532
- C:\Windows\System\aTfYHNq.exe
  C:\Windows\System\aTfYHNq.exe
  2⤵
  PID:8548
- C:\Windows\System\MvcFibc.exe
  C:\Windows\System\MvcFibc.exe
  2⤵
  PID:8564
- C:\Windows\System\HMaAWNl.exe
  C:\Windows\System\HMaAWNl.exe
  2⤵
  PID:8584
- C:\Windows\System\NqRHBSC.exe
  C:\Windows\System\NqRHBSC.exe
  2⤵
  PID:8600
- C:\Windows\System\JdMgJCK.exe
  C:\Windows\System\JdMgJCK.exe
  2⤵
  PID:8616
- C:\Windows\System\spqEIgC.exe
  C:\Windows\System\spqEIgC.exe
  2⤵
  PID:8632
- C:\Windows\System\SGOEtHF.exe
  C:\Windows\System\SGOEtHF.exe
  2⤵
  PID:8648
- C:\Windows\System\urlkyYM.exe
  C:\Windows\System\urlkyYM.exe
  2⤵
  PID:8664
- C:\Windows\System\OtLBDwE.exe
  C:\Windows\System\OtLBDwE.exe
  2⤵
  PID:8680
- C:\Windows\System\wJvzuJy.exe
  C:\Windows\System\wJvzuJy.exe
  2⤵
  PID:8696
- C:\Windows\System\gRsNgsA.exe
  C:\Windows\System\gRsNgsA.exe
  2⤵
  PID:8712
- C:\Windows\System\CjeIumD.exe
  C:\Windows\System\CjeIumD.exe
  2⤵
  PID:8728
- C:\Windows\System\BuIqTie.exe
  C:\Windows\System\BuIqTie.exe
  2⤵
  PID:8744
- C:\Windows\System\VIBPCZX.exe
  C:\Windows\System\VIBPCZX.exe
  2⤵
  PID:8760
- C:\Windows\System\wTaWcgw.exe
  C:\Windows\System\wTaWcgw.exe
  2⤵
  PID:8776
- C:\Windows\System\BHMPuFK.exe
  C:\Windows\System\BHMPuFK.exe
  2⤵
  PID:8792
- C:\Windows\System\CjWrDVa.exe
  C:\Windows\System\CjWrDVa.exe
  2⤵
  PID:8808
- C:\Windows\System\guwZijO.exe
  C:\Windows\System\guwZijO.exe
  2⤵
  PID:8824
- C:\Windows\System\PLFOuEE.exe
  C:\Windows\System\PLFOuEE.exe
  2⤵
  PID:8840
- C:\Windows\System\TLWBJfN.exe
  C:\Windows\System\TLWBJfN.exe
  2⤵
  PID:8856
- C:\Windows\System\KeaojxT.exe
  C:\Windows\System\KeaojxT.exe
  2⤵
  PID:8872
- C:\Windows\System\tlaSqPW.exe
  C:\Windows\System\tlaSqPW.exe
  2⤵
  PID:8888
- C:\Windows\System\UqUrAet.exe
  C:\Windows\System\UqUrAet.exe
  2⤵
  PID:8904
- C:\Windows\System\wHvrGbM.exe
  C:\Windows\System\wHvrGbM.exe
  2⤵
  PID:8920
- C:\Windows\System\uFAetyT.exe
  C:\Windows\System\uFAetyT.exe
  2⤵
  PID:8936
- C:\Windows\System\WJFoyGg.exe
  C:\Windows\System\WJFoyGg.exe
  2⤵
  PID:8952
- C:\Windows\System\lKNMlnY.exe
  C:\Windows\System\lKNMlnY.exe
  2⤵
  PID:8968
- C:\Windows\System\dhDGSVg.exe
  C:\Windows\System\dhDGSVg.exe
  2⤵
  PID:8984
- C:\Windows\System\ZyaFVOr.exe
  C:\Windows\System\ZyaFVOr.exe
  2⤵
  PID:9000
- C:\Windows\System\EImmbpN.exe
  C:\Windows\System\EImmbpN.exe
  2⤵
  PID:9016
- C:\Windows\System\YSXMsQv.exe
  C:\Windows\System\YSXMsQv.exe
  2⤵
  PID:9032
- C:\Windows\System\gsPAITo.exe
  C:\Windows\System\gsPAITo.exe
  2⤵
  PID:9048
- C:\Windows\System\irbnykn.exe
  C:\Windows\System\irbnykn.exe
  2⤵
  PID:9064
- C:\Windows\System\bPhyEHa.exe
  C:\Windows\System\bPhyEHa.exe
  2⤵
  PID:9080
- C:\Windows\System\tgosYSc.exe
  C:\Windows\System\tgosYSc.exe
  2⤵
  PID:9096
- C:\Windows\System\ZbZjqCc.exe
  C:\Windows\System\ZbZjqCc.exe
  2⤵
  PID:9112
- C:\Windows\System\GfTGhGI.exe
  C:\Windows\System\GfTGhGI.exe
  2⤵
  PID:9128
- C:\Windows\System\mkHFzaS.exe
  C:\Windows\System\mkHFzaS.exe
  2⤵
  PID:9144
- C:\Windows\System\HOGiZwv.exe
  C:\Windows\System\HOGiZwv.exe
  2⤵
  PID:9160
- C:\Windows\System\esiQClr.exe
  C:\Windows\System\esiQClr.exe
  2⤵
  PID:9176
- C:\Windows\System\qaEhVUs.exe
  C:\Windows\System\qaEhVUs.exe
  2⤵
  PID:9192
- C:\Windows\System\aaSbdRo.exe
  C:\Windows\System\aaSbdRo.exe
  2⤵
  PID:9208
- C:\Windows\System\yIHzQgK.exe
  C:\Windows\System\yIHzQgK.exe
  2⤵
  PID:8204
- C:\Windows\System\HmizXue.exe
  C:\Windows\System\HmizXue.exe
  2⤵
  PID:7464
- C:\Windows\System\tlmabyS.exe
  C:\Windows\System\tlmabyS.exe
  2⤵
  PID:8236
- C:\Windows\System\HGfKHHh.exe
  C:\Windows\System\HGfKHHh.exe
  2⤵
  PID:8264
- C:\Windows\System\KGSeGMn.exe
  C:\Windows\System\KGSeGMn.exe
  2⤵
  PID:8328
- C:\Windows\System\OonWFVu.exe
  C:\Windows\System\OonWFVu.exe
  2⤵
  PID:8280
- C:\Windows\System\dwiwwni.exe
  C:\Windows\System\dwiwwni.exe
  2⤵
  PID:8396
- C:\Windows\System\VJfkisv.exe
  C:\Windows\System\VJfkisv.exe
  2⤵
  PID:8488
- C:\Windows\System\dDDFcxj.exe
  C:\Windows\System\dDDFcxj.exe
  2⤵
  PID:8472
- C:\Windows\System\HisHejG.exe
  C:\Windows\System\HisHejG.exe
  2⤵
  PID:8440
- C:\Windows\System\GxSBFwB.exe
  C:\Windows\System\GxSBFwB.exe
  2⤵
  PID:8380
- C:\Windows\System\jSEVIIs.exe
  C:\Windows\System\jSEVIIs.exe
  2⤵
  PID:8412
- C:\Windows\System\hlqxfsy.exe
  C:\Windows\System\hlqxfsy.exe
  2⤵
  PID:8560
- C:\Windows\System\ryuBIhv.exe
  C:\Windows\System\ryuBIhv.exe
  2⤵
  PID:8572
- C:\Windows\System\vvkQoeI.exe
  C:\Windows\System\vvkQoeI.exe
  2⤵
  PID:8628
- C:\Windows\System\hbNSSVU.exe
  C:\Windows\System\hbNSSVU.exe
  2⤵
  PID:8644
- C:\Windows\System\sZtlSOQ.exe
  C:\Windows\System\sZtlSOQ.exe
  2⤵
  PID:8708
- C:\Windows\System\viPQtNf.exe
  C:\Windows\System\viPQtNf.exe
  2⤵
  PID:8768
- C:\Windows\System\QAWbLnn.exe
  C:\Windows\System\QAWbLnn.exe
  2⤵
  PID:8720
- C:\Windows\System\lNetkZx.exe
  C:\Windows\System\lNetkZx.exe
  2⤵
  PID:8788
- C:\Windows\System\SicSIUA.exe
  C:\Windows\System\SicSIUA.exe
  2⤵
  PID:8864
- C:\Windows\System\XWTPYTq.exe
  C:\Windows\System\XWTPYTq.exe
  2⤵
  PID:8944
- C:\Windows\System\PRJHDmG.exe
  C:\Windows\System\PRJHDmG.exe
  2⤵
  PID:8900
- C:\Windows\System\QazEgOz.exe
  C:\Windows\System\QazEgOz.exe
  2⤵
  PID:9012
- C:\Windows\System\WjotYce.exe
  C:\Windows\System\WjotYce.exe
  2⤵
  PID:9072
- C:\Windows\System\RXPqjdK.exe
  C:\Windows\System\RXPqjdK.exe
  2⤵
  PID:9140
- C:\Windows\System\GclbJlW.exe
  C:\Windows\System\GclbJlW.exe
  2⤵
  PID:8964
- C:\Windows\System\VTHTkdn.exe
  C:\Windows\System\VTHTkdn.exe
  2⤵
  PID:9028
- C:\Windows\System\bAUfLfS.exe
  C:\Windows\System\bAUfLfS.exe
  2⤵
  PID:9124
- C:\Windows\System\namfKIF.exe
  C:\Windows\System\namfKIF.exe
  2⤵
  PID:8360
- C:\Windows\System\HeYpfWi.exe
  C:\Windows\System\HeYpfWi.exe
  2⤵
  PID:9092
- C:\Windows\System\sQLoTjj.exe
  C:\Windows\System\sQLoTjj.exe
  2⤵
  PID:9152
- C:\Windows\System\WKORsEL.exe
  C:\Windows\System\WKORsEL.exe
  2⤵
  PID:8300
- C:\Windows\System\nwQuvUY.exe
  C:\Windows\System\nwQuvUY.exe
  2⤵
  PID:8504
- C:\Windows\System\wPkjIxC.exe
  C:\Windows\System\wPkjIxC.exe
  2⤵
  PID:9056
- C:\Windows\System\WUsqVdo.exe
  C:\Windows\System\WUsqVdo.exe
  2⤵
  PID:8508
- C:\Windows\System\OqWokaI.exe
  C:\Windows\System\OqWokaI.exe
  2⤵
  PID:8528
- C:\Windows\System\XpPLCby.exe
  C:\Windows\System\XpPLCby.exe
  2⤵
  PID:8544
- C:\Windows\System\DiDHfvh.exe
  C:\Windows\System\DiDHfvh.exe
  2⤵
  PID:8612
- C:\Windows\System\bBqSKbV.exe
  C:\Windows\System\bBqSKbV.exe
  2⤵
  PID:8724
- C:\Windows\System\XknWEXI.exe
  C:\Windows\System\XknWEXI.exe
  2⤵
  PID:8784
- C:\Windows\System\KOSbAhl.exe
  C:\Windows\System\KOSbAhl.exe
  2⤵
  PID:8836
- C:\Windows\System\phcUZQj.exe
  C:\Windows\System\phcUZQj.exe
  2⤵
  PID:8916
- C:\Windows\System\fwPanoS.exe
  C:\Windows\System\fwPanoS.exe
  2⤵
  PID:9136
- C:\Windows\System\SVzkTXZ.exe
  C:\Windows\System\SVzkTXZ.exe
  2⤵
  PID:9044
- C:\Windows\System\tlKQIQm.exe
  C:\Windows\System\tlKQIQm.exe
  2⤵
  PID:7992
- C:\Windows\System\MvBdpSI.exe
  C:\Windows\System\MvBdpSI.exe
  2⤵
  PID:8852
- C:\Windows\System\SHZcmye.exe
  C:\Windows\System\SHZcmye.exe
  2⤵
  PID:9188
- C:\Windows\System\UIObxuI.exe
  C:\Windows\System\UIObxuI.exe
  2⤵
  PID:8460
- C:\Windows\System\nLBXwlw.exe
  C:\Windows\System\nLBXwlw.exe
  2⤵
  PID:8624
- C:\Windows\System\AIYckBI.exe
  C:\Windows\System\AIYckBI.exe
  2⤵
  PID:8524
- C:\Windows\System\WBCXngN.exe
  C:\Windows\System\WBCXngN.exe
  2⤵
  PID:9104
- C:\Windows\System\AVnADTx.exe
  C:\Windows\System\AVnADTx.exe
  2⤵
  PID:8932
- C:\Windows\System\FOohlKI.exe
  C:\Windows\System\FOohlKI.exe
  2⤵
  PID:8660
- C:\Windows\System\HLFnwkm.exe
  C:\Windows\System\HLFnwkm.exe
  2⤵
  PID:8688
- C:\Windows\System\gxzHFKb.exe
  C:\Windows\System\gxzHFKb.exe
  2⤵
  PID:8252
- C:\Windows\System\hVIftPo.exe
  C:\Windows\System\hVIftPo.exe
  2⤵
  PID:8232
- C:\Windows\System\OigvShi.exe
  C:\Windows\System\OigvShi.exe
  2⤵
  PID:8200
- C:\Windows\System\vMIIyrK.exe
  C:\Windows\System\vMIIyrK.exe
  2⤵
  PID:8444
- C:\Windows\System\wpdwRyS.exe
  C:\Windows\System\wpdwRyS.exe
  2⤵
  PID:9224
- C:\Windows\System\aYsUbZg.exe
  C:\Windows\System\aYsUbZg.exe
  2⤵
  PID:9240
- C:\Windows\System\JVBFUtg.exe
  C:\Windows\System\JVBFUtg.exe
  2⤵
  PID:9256
- C:\Windows\System\Nbksdwe.exe
  C:\Windows\System\Nbksdwe.exe
  2⤵
  PID:9272
- C:\Windows\System\tnSzjaa.exe
  C:\Windows\System\tnSzjaa.exe
  2⤵
  PID:9288
- C:\Windows\System\wulatzK.exe
  C:\Windows\System\wulatzK.exe
  2⤵
  PID:9304
- C:\Windows\System\iTSUsRz.exe
  C:\Windows\System\iTSUsRz.exe
  2⤵
  PID:9320
- C:\Windows\System\KNwFeVW.exe
  C:\Windows\System\KNwFeVW.exe
  2⤵
  PID:9336
- C:\Windows\System\uSKQGVO.exe
  C:\Windows\System\uSKQGVO.exe
  2⤵
  PID:9352
- C:\Windows\System\NrzarKc.exe
  C:\Windows\System\NrzarKc.exe
  2⤵
  PID:9456
- C:\Windows\System\kIilFOU.exe
  C:\Windows\System\kIilFOU.exe
  2⤵
  PID:9500
- C:\Windows\System\vxANOwH.exe
  C:\Windows\System\vxANOwH.exe
  2⤵
  PID:9516
- C:\Windows\System\CTrPJll.exe
  C:\Windows\System\CTrPJll.exe
  2⤵
  PID:9532
- C:\Windows\System\XfvPVEi.exe
  C:\Windows\System\XfvPVEi.exe
  2⤵
  PID:9548
- C:\Windows\System\oTYyPBw.exe
  C:\Windows\System\oTYyPBw.exe
  2⤵
  PID:9564
- C:\Windows\System\hWUpHmd.exe
  C:\Windows\System\hWUpHmd.exe
  2⤵
  PID:9580
- C:\Windows\System\areGStW.exe
  C:\Windows\System\areGStW.exe
  2⤵
  PID:9596
- C:\Windows\System\qpQWurW.exe
  C:\Windows\System\qpQWurW.exe
  2⤵
  PID:9612
- C:\Windows\System\lUfAlWQ.exe
  C:\Windows\System\lUfAlWQ.exe
  2⤵
  PID:9628
- C:\Windows\System\FGcdpUE.exe
  C:\Windows\System\FGcdpUE.exe
  2⤵
  PID:9644
- C:\Windows\System\NtoJnHL.exe
  C:\Windows\System\NtoJnHL.exe
  2⤵
  PID:9664
- C:\Windows\System\zUuEbPJ.exe
  C:\Windows\System\zUuEbPJ.exe
  2⤵
  PID:9680
- C:\Windows\System\JZzzfGv.exe
  C:\Windows\System\JZzzfGv.exe
  2⤵
  PID:9696
- C:\Windows\System\xNCEpfb.exe
  C:\Windows\System\xNCEpfb.exe
  2⤵
  PID:9712
- C:\Windows\System\vXBJQRa.exe
  C:\Windows\System\vXBJQRa.exe
  2⤵
  PID:9728
- C:\Windows\System\PDczNfv.exe
  C:\Windows\System\PDczNfv.exe
  2⤵
  PID:9744
- C:\Windows\System\AGALCoA.exe
  C:\Windows\System\AGALCoA.exe
  2⤵
  PID:9760
- C:\Windows\System\Uoorzer.exe
  C:\Windows\System\Uoorzer.exe
  2⤵
  PID:9776
- C:\Windows\System\bjbnrWH.exe
  C:\Windows\System\bjbnrWH.exe
  2⤵
  PID:9792
- C:\Windows\System\krGtHFh.exe
  C:\Windows\System\krGtHFh.exe
  2⤵
  PID:9572
- C:\Windows\System\jozHgcn.exe
  C:\Windows\System\jozHgcn.exe
  2⤵
  PID:9800
- C:\Windows\System\KPjNCYw.exe
  C:\Windows\System\KPjNCYw.exe
  2⤵
  PID:9704
- C:\Windows\System\HKyLAkp.exe
  C:\Windows\System\HKyLAkp.exe
  2⤵
  PID:9864
- C:\Windows\System\wfhoVlz.exe
  C:\Windows\System\wfhoVlz.exe
  2⤵
  PID:9880
- C:\Windows\System\viXtGkI.exe
  C:\Windows\System\viXtGkI.exe
  2⤵
  PID:9928
- C:\Windows\System\QkjTuLQ.exe
  C:\Windows\System\QkjTuLQ.exe
  2⤵
  PID:9948
- C:\Windows\System\STLdVel.exe
  C:\Windows\System\STLdVel.exe
  2⤵
  PID:10072
- C:\Windows\System\PdEAquT.exe
  C:\Windows\System\PdEAquT.exe
  2⤵
  PID:10132
- C:\Windows\System\whzuTBh.exe
  C:\Windows\System\whzuTBh.exe
  2⤵
  PID:10152
- C:\Windows\System\nnZQqsR.exe
  C:\Windows\System\nnZQqsR.exe
  2⤵
  PID:10212
- C:\Windows\System\TIqbjZe.exe
  C:\Windows\System\TIqbjZe.exe
  2⤵
  PID:10232
- C:\Windows\System\GZYxLQA.exe
  C:\Windows\System\GZYxLQA.exe
  2⤵
  PID:8960
- C:\Windows\System\BrXePGd.exe
  C:\Windows\System\BrXePGd.exe
  2⤵
  PID:9296
- C:\Windows\System\RVmJuzY.exe
  C:\Windows\System\RVmJuzY.exe
  2⤵
  PID:9576
- C:\Windows\System\qHXqEEK.exe
  C:\Windows\System\qHXqEEK.exe
  2⤵
  PID:9804
- C:\Windows\System\rABHEPt.exe
  C:\Windows\System\rABHEPt.exe
  2⤵
  PID:9692
- C:\Windows\System\DtErXii.exe
  C:\Windows\System\DtErXii.exe
  2⤵
  PID:9024
- C:\Windows\System\wPefToF.exe
  C:\Windows\System\wPefToF.exe
  2⤵
  PID:8344
- C:\Windows\System\LzxwWkO.exe
  C:\Windows\System\LzxwWkO.exe
  2⤵
  PID:9752
- C:\Windows\System\aNkIFTd.exe
  C:\Windows\System\aNkIFTd.exe
  2⤵
  PID:9836
- C:\Windows\System\VvJgPZi.exe
  C:\Windows\System\VvJgPZi.exe
  2⤵
  PID:9884
- C:\Windows\System\cehBxQY.exe
  C:\Windows\System\cehBxQY.exe
  2⤵
  PID:9828
- C:\Windows\System\NXorYEe.exe
  C:\Windows\System\NXorYEe.exe
  2⤵
  PID:9408
- C:\Windows\System\ltEyiJz.exe
  C:\Windows\System\ltEyiJz.exe
  2⤵
  PID:9436
- C:\Windows\System\DWhJRAY.exe
  C:\Windows\System\DWhJRAY.exe
  2⤵
  PID:8692
- C:\Windows\System\KIvHJyg.exe
  C:\Windows\System\KIvHJyg.exe
  2⤵
  PID:9476
- C:\Windows\System\evxOixi.exe
  C:\Windows\System\evxOixi.exe
  2⤵
  PID:9268
- C:\Windows\System\lZceemT.exe
  C:\Windows\System\lZceemT.exe
  2⤵
  PID:9688
- C:\Windows\System\VfUGrBC.exe
  C:\Windows\System\VfUGrBC.exe
  2⤵
  PID:8896
- C:\Windows\System\pBeIhDl.exe
  C:\Windows\System\pBeIhDl.exe
  2⤵
  PID:9492
- C:\Windows\System\UyEYDKz.exe
  C:\Windows\System\UyEYDKz.exe
  2⤵
  PID:9388
- C:\Windows\System\BBsdnzq.exe
  C:\Windows\System\BBsdnzq.exe
  2⤵
  PID:9416
- C:\Windows\System\YpZcpex.exe
  C:\Windows\System\YpZcpex.exe
  2⤵
  PID:9872
- C:\Windows\System\yUdbnRh.exe
  C:\Windows\System\yUdbnRh.exe
  2⤵
  PID:9524
- C:\Windows\System\LCixyxy.exe
  C:\Windows\System\LCixyxy.exe
  2⤵
  PID:9544
- C:\Windows\System\dLLsEMC.exe
  C:\Windows\System\dLLsEMC.exe
  2⤵
  PID:9708
- C:\Windows\System\zFcVjZm.exe
  C:\Windows\System\zFcVjZm.exe
  2⤵
  PID:9916
- C:\Windows\System\NhucDWz.exe
  C:\Windows\System\NhucDWz.exe
  2⤵
  PID:9924
- C:\Windows\System\HHjMNHV.exe
  C:\Windows\System\HHjMNHV.exe
  2⤵
  PID:10004
- C:\Windows\System\crQSjnv.exe
  C:\Windows\System\crQSjnv.exe
  2⤵
  PID:9968
- C:\Windows\System\JpJPIXQ.exe
  C:\Windows\System\JpJPIXQ.exe
  2⤵
  PID:10028
- C:\Windows\System\WFHADYU.exe
  C:\Windows\System\WFHADYU.exe
  2⤵
  PID:10036
- C:\Windows\System\GPmXUVM.exe
  C:\Windows\System\GPmXUVM.exe
  2⤵
  PID:10052
- C:\Windows\System\RViDYfG.exe
  C:\Windows\System\RViDYfG.exe
  2⤵
  PID:10068
- C:\Windows\System\tHdhbHL.exe
  C:\Windows\System\tHdhbHL.exe
  2⤵
  PID:10164
- C:\Windows\System\GisrrEQ.exe
  C:\Windows\System\GisrrEQ.exe
  2⤵
  PID:10104
- C:\Windows\System\KtTpJed.exe
  C:\Windows\System\KtTpJed.exe
  2⤵
  PID:10140
- C:\Windows\System\MiTFrYC.exe
  C:\Windows\System\MiTFrYC.exe
  2⤵
  PID:10128
- C:\Windows\System\lRvvQBv.exe
  C:\Windows\System\lRvvQBv.exe
  2⤵
  PID:10116
- C:\Windows\System\bNrkarw.exe
  C:\Windows\System\bNrkarw.exe
  2⤵
  PID:10184
- C:\Windows\System\GItkPIE.exe
  C:\Windows\System\GItkPIE.exe
  2⤵
  PID:10200
- C:\Windows\System\ARQcvUS.exe
  C:\Windows\System\ARQcvUS.exe
  2⤵
  PID:10196
- C:\Windows\System\LxQWWoL.exe
  C:\Windows\System\LxQWWoL.exe
  2⤵
  PID:10180
- C:\Windows\System\jVzswcZ.exe
  C:\Windows\System\jVzswcZ.exe
  2⤵
  PID:9280
- C:\Windows\System\YPMRNPA.exe
  C:\Windows\System\YPMRNPA.exe
  2⤵
  PID:9252
- C:\Windows\System\wvMWclk.exe
  C:\Windows\System\wvMWclk.exe
  2⤵
  PID:9360
- C:\Windows\System\XDOgnCI.exe
  C:\Windows\System\XDOgnCI.exe
  2⤵
  PID:9808
- C:\Windows\System\AxvcEjW.exe
  C:\Windows\System\AxvcEjW.exe
  2⤵
  PID:9724
- C:\Windows\System\FZmfCvq.exe
  C:\Windows\System\FZmfCvq.exe
  2⤵
  PID:9236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKqKgkH.exe

Filesize
2.3MB

MD5
8d1bb737c3ce5d8594b4a5dd41939bc3

SHA1
c6c86e5e04c445b2a78f5122a1808258a926eba5

SHA256
4f976b2f53af481952c47ce5353a42d6ad3fa34c35c537888d1d5b13b92112a3

SHA512
66edc0d743d777cc005eb48d3de9f7d9f0e7643df029604a918d34fb178805f7d82d404823c5f4833b67a649abccbbddddb11e625aa891dbab97838e8f6d81c4

Download Submit
C:\Windows\system\CyYDEov.exe

Filesize
2.3MB

MD5
7fddc51c8a82f65030c94461a7257c3d

SHA1
859b64c60d762dccee5238e9ebc23df1735b5804

SHA256
0c6c17bec1b9245a49b6e420ef87034df55d63a372c460c3365f2f19a3692571

SHA512
184643097e8c96ff3a6721a0381ec9596ae7d9b0bf8f80e425bf072230610222204563fcaf2b67f200f746ffd011de162af235d7894d04f03834d4e284d23ff2

Download Submit
C:\Windows\system\DTTfOLJ.exe

Filesize
2.3MB

MD5
5a2d03578341b13fd8928b26e420f8d3

SHA1
a2a50e7e654ca4c2db2c4b284a08e33bde4f3b0d

SHA256
3241594210c42f986adff72a1a0a09ea24f46e5236f8cfa8fba3caa43dbe035e

SHA512
f25aaccfe15cb561a24d3a6285e897c08100c905dca7db4dedd94af4af2ae744de99529ad4b81343322fa774c4ba0be54bba685138b10b61faf567933b2b5768

Download Submit
C:\Windows\system\EuShZDI.exe

Filesize
2.3MB

MD5
c75291d0d78dfeb0f9ad159d4232121e

SHA1
e97c8f0ca6f3483bff67b4c21761772f22d00173

SHA256
aa2103ca15ff551c7211d021c7af497c7450a6328286081ece5d8f7bc31889bf

SHA512
445e40c0c9492fb57627a4fa0faa33d42c552ff04ef7bc7ca6b266814ed2f00637bd9c2f74ede080d39cdbf15ffe2cfb91f154fc3bfaacd891f2861cebe3424c

Download Submit
C:\Windows\system\FNoCoik.exe

Filesize
2.3MB

MD5
f6dc0d011ea12563fedccab77dff98af

SHA1
581131101c77db7c348b324736faac80c24bdf69

SHA256
390c066fe791e72b5e1670eff0ab967a013d32312996b30f13555fc49e0f3231

SHA512
433dc0feb3b2b4d056f0661464416ad76a953e7121c9af514920e99ec84ba400996c78ded3e5ecd9ba60f620fdb1211ddbfc57b748d4fec0acf69d17e7b63bfc

Download Submit
C:\Windows\system\FOkBatk.exe

Filesize
2.3MB

MD5
0aa46a3b72f9f26ce0cf388f02f66c37

SHA1
075bfac54f74c82ba5b64189981e7d5017caacba

SHA256
09f6f778058d662808a448bdc63112b6d6ad5fc594b485daadcdb81bdff47b30

SHA512
91636e79857fbee8fed8e0fbd312f594aff0488afdf7d45e874516dd44548f16d906107ab305f26178944e8ef64a1ef4f2070ed19bf65c25aaa0c7c5a536cbc1

Download Submit
C:\Windows\system\GqbZIOS.exe

Filesize
2.3MB

MD5
e2e47db1c568249f13af5da47bb57749

SHA1
99b1691afbc4cd405c25ad09d1a669606efdf1c8

SHA256
5ebe017166b693039f6f113b162b71451e6bd4f1ca81af46b9f852b5fd0860d5

SHA512
41e67f3cd58b0282a9ac993a93fc5f07e8f9b130aa6582755f89cc70c90c30ea88c298ab00bacb22ce3bd21d4322f3d3b966cd50a52898730f1c88c673f58484

Download Submit
C:\Windows\system\GueqoIz.exe

Filesize
2.3MB

MD5
94b9ef9c679f58cc4f7e0d8413405b10

SHA1
57513b0aacca0d054f77a1bb346b22cb94d693ba

SHA256
58ed81a40d8f294de16e0ca12171eaf5c58d0f89570427aa320314f246ab5d13

SHA512
1af9e565901f3edd08e19adbaba2341a464f4f6eeddca4c33e866985d33bf6420c4ae822bf27b3c9d14a419c728c267452470cafc4dfcdbe961b1f475e7bd0c5

Download Submit
C:\Windows\system\IHrToOt.exe

Filesize
2.3MB

MD5
4a811ad60a001eb146fd68f91440c40c

SHA1
45941d39dfa0e28741c13f55e567105d3df7c5e8

SHA256
0f3feacf104c806172555c87f7e872800996b9e6eeec860ca125d752ae93867c

SHA512
838df101717b3b6f17975d36d2440b8e990739f6f02c6574131b79a3b33f80578f6d5435083b56c3ef8d350d97cac09c5bf043e1968d565f1248d9a03624ec1e

Download Submit
C:\Windows\system\IIQJORy.exe

Filesize
2.3MB

MD5
d6f9971aec1218528fdbee731a1c73d6

SHA1
46b8476627bb72c04d6570f31ee993b1a7477edf

SHA256
2ca432a9e1f0234ca0ee58cadc852c5b37b0cbb5a7c5eea59417011f530329af

SHA512
186aed0e7e12af308f377803daebed3ece467eab3139f3c7f2c0fb9a6b4a6b0cb498216f2274496bfb523ca1664793feede8815ea15ca5830d92f5c88c182ff1

Download Submit
C:\Windows\system\IlUpaeR.exe

Filesize
2.3MB

MD5
83d1ffc95c8928bfa5fd40709b1a9292

SHA1
957b28f0769af9db22c24ff26b8eb9bf2f72c9c1

SHA256
d00a614f78fa4a83ab66d822d2db8994a9aa5d667ae78ea3c2385ca0594d8f55

SHA512
d1ecece7e0881d2fd7550d36ee9f0d08a4825cf1786014e8dec6cbb514cad8f4984bc464aadeb4589b2825e4a2d78343616aeccacd9d3404def86f8c2e911073

Download Submit
C:\Windows\system\KRVAUMX.exe

Filesize
2.3MB

MD5
6936c161bfc9bc0d647a075891e7e12f

SHA1
eabb5ec52752c1bf74584427bab4dbca7ca7c208

SHA256
15ffbb49fb7410ce8922f3d002d98a354e827070e3b559909952ad967de454c8

SHA512
f9fa46e50aee9c51f8c1f5820852dd9f9821f1805d61ff317baf6baddcfb3b491e0c6ee09b7431c16c7673be81ad990e6e3c83c046b03052f818db38882a48ad

Download Submit
C:\Windows\system\LzgjlAn.exe

Filesize
2.3MB

MD5
90fdf6b93b37c31df23586d07f2fc9d7

SHA1
f8b3def75b9aded7aac1d9e39856bee5f77f9460

SHA256
5530a3fbe61529b13fb6b8e718a3e0511838e309908c9e1bc3e1b47fb84313c1

SHA512
be210c2b590cf0b617207088af6a4ff4bbf8f090ce1309991a40b12182848947b4e44963aaf79bd179344625428c9ccd9b6f72d632ab0eea02562e00e29ea9d1

Download Submit
C:\Windows\system\RrlckSb.exe

Filesize
2.3MB

MD5
25f5b3e983ceaf1e1436c7b87de5145c

SHA1
76cf4c58ee9aec70c74a390447cccecb6099294c

SHA256
3cf0d5841dab18f3d0301fa38c9ce9735bd99850ed20a6181552f0bff7794798

SHA512
c302de5b424f55183b06d1cc0d49e5c2f7c5c7325cabbf911e00d24d56b55bf03ab67717de2377eb9f6ed228633a249734a117a341c246c781f53c85ded699c1

Download Submit
C:\Windows\system\RvlQWNL.exe

Filesize
2.3MB

MD5
6f3088d1a6f72da075c791009fafe29d

SHA1
5ca1deea49190c4ca9860d97c321ce6a720a048e

SHA256
e792e6550861a7c13b51590286985fd3b058a5ac1c582192d462a4f09c805cdb

SHA512
30b1585b649bcee3926fda04c4ddbafa7631ad88ab3779eb88b8499264fa4443c55fcfcdd83a6f0d08a7fda72826ec9a0fd9395c5f74cc54716d350a60994728

Download Submit
C:\Windows\system\TaOnWsd.exe

Filesize
2.3MB

MD5
7707a484f844a58e16c4ba904daca542

SHA1
7340bc06890d0edbfd34a42633eef51cade7161a

SHA256
72d3ddf98b1bae203589f40b1b74ec9514b8052146cfd160d5c94de81faf427c

SHA512
8525a93a50478090cbdf7469dfe825dbb67f117d5eb433031232a6e4b033e847e308a6e18c27264e55b3421da427c7f2ec286afd1510fd15235a2cbfdda7d3ae

Download Submit
C:\Windows\system\VvUtFIf.exe

Filesize
2.3MB

MD5
e7357bdb83a707b548802d3bb2d6901e

SHA1
4dca61131e32e1863978fda3429f19f08774334a

SHA256
a6338dcfe72bf54c53e6f348e714a9446533ebf5fae4c389ef12eb7dea5a6223

SHA512
76f1b6bf9c8536f9d4a1a0035a074207af446594b4d55dd8b9a4b6609e638719f7f12394fb912457b3c95a55e72640beb3d5da71a2d29939c0ccf48a41d7dc36

Download Submit
C:\Windows\system\XThOgvG.exe

Filesize
2.3MB

MD5
4dfe4b65aed1a1ea48d5f665be3e2f18

SHA1
5e396bcf7bbb6a7ae872d318967ca8db101c2b31

SHA256
93c2c9d7a0253a4dbd099f0a998a7700a5ebc99b5278a020fed162167cd78fee

SHA512
f9eebc0d11fc30d70eac3700a381c81d779a32ce24bf5dc4ff4e93f74f06a21102f16d88885a80634b9711d076f4ca8c8d9c62b007feb7a1935051a0ebd59638

Download Submit
C:\Windows\system\XnkgPTP.exe

Filesize
2.3MB

MD5
6aba3bde0ff8cdca93b0c159f64e01d2

SHA1
c3f09c4e2c48f2e2216a05f9d3d5b3e6510e1f17

SHA256
910c357ea0d95c45c3d5dbe740c8e72cff3f0706c836b5a765f797446295b551

SHA512
fcbef7c7429ebb6779b114a73c4928f5211aeb62cccbefd9261d0c2eb3becfcc59ec820a151b4331dc78a90357fa54190a1f32f752c8a9764c72f16041158bda

Download Submit
C:\Windows\system\Yazzewi.exe

Filesize
2.3MB

MD5
f831bd7d05e50e0490e86d523f42ef4a

SHA1
e94918b1380dc245aeb3e4524666c226f820b9d9

SHA256
b50582321f5fa65daf73dc3188792bf56b7b8224393c91916b7ac58f681429f4

SHA512
ed26b319eef8ea618570d235480c28cfe284328045bec3bc5eb70127830a06822adc2907421e9f936db966e48a6152465ea4cfcb47218bc26d9fbcac4f3a67d9

Download Submit
C:\Windows\system\aRNpNnq.exe

Filesize
2.3MB

MD5
9805905be43510f30a8876554ead7ce1

SHA1
e138a8b890e00b3589c3eacc625e6dff0c03b0d9

SHA256
dd52b55ae178c7a78642da208d1a60217da53bf676418e69ec9e7fb174ac2dbf

SHA512
79ebe3de5681d8da04750100f7cf6f2c9c84c78278ba0fb5306d8be6387ee7df3372a7cdf957995684f4a800be107d1118a3ad7cdc33ffd1a70f0878806e8fc1

Download Submit
C:\Windows\system\bBryYyk.exe

Filesize
2.3MB

MD5
e1d810b5eafabf009e8d147b842dfddf

SHA1
d0f23f37946bd2c821c05054408367e08c6d1c07

SHA256
e84e110a39d2c39b99ea715824bd5ac2ed4f0026830c57884af3c143b6b318b6

SHA512
5f7fa236d1962c1cbf612368ee45d19e4c90196167e7c172f763514c0c250e9c0ad6f0e05338eec4b237016e47dfcd455e776740548b77a02af8f7c1f8613512

Download Submit
C:\Windows\system\bZnHaWA.exe

Filesize
2.3MB

MD5
9e057b9057ab982aba3612712d49d9ad

SHA1
cdc0ae95bd3b5cdb4c4b59e0b7d960eca4778868

SHA256
eef889a239f80994e6af413da44d41554c6e4c2e5aeaf14b9885d02dce068411

SHA512
d845bd2c050ed7565cd2e48c822e76fc69c9741cd038812aa01821c927c0dc1ea953528213fd0db350cceef44c5358ada9a02568f4531a14e3b74bd3cbda2aa5

Download Submit
C:\Windows\system\bsMfwsH.exe

Filesize
2.3MB

MD5
301437171780bd802379d545b4730c81

SHA1
ce40a23c117213f1ff0cd88bcdc8b948493360c7

SHA256
3d502f22fef2990e9ef6b926b92a7b88d24a43acb0d6a3ca69d96ec2fea12d29

SHA512
fa242f80fca4f41033ded981b77084918bcae58ef5d5746899038ebb7e45b99b68e6a7612961d5b1b2fb1eb95a97980047c8dca209ab23089224e5c6ecba8d50

Download Submit
C:\Windows\system\dIoVTYE.exe

Filesize
2.3MB

MD5
c55b3e563d72d50e77f94d5bb5f88b7c

SHA1
b12ce82c118cb5d29d61c77476ad6b4cabc7c3b7

SHA256
bb812c7037fb3968e0de6858cc2391fc413cd7d4dacf136c03d8ce5cd044818a

SHA512
1691014e402aef1371d1f6284b51262585dff4aa8c2d0818a617a9926824d70b9101e7c8007c6b4d2e971ac25ffa9ec4e325b57b46ab6e0d45cced2e55283722

Download Submit
C:\Windows\system\lMBgVkj.exe

Filesize
2.3MB

MD5
3fb7c5bb5bc0ce0b7577b3b7b78393fd

SHA1
03146037d922f06fd358ade39a102983335d083b

SHA256
91f91f73029c00517d79a2f4e41e183f0359dc0a087dd383d9ecc97aaee86e74

SHA512
03543ff3db790bd0a0f5e9bef4d67236912c9629b8ccc60d00cfaff80ea4cd92674b8b03ab3cdb231c5785ea163b875b198eaf896e4d56a39515f59910819b6a

Download Submit
C:\Windows\system\oMEZObY.exe

Filesize
2.3MB

MD5
f774b005c81c7bfc6ce9ae1cbe87ff88

SHA1
9c31636379050a38f217910e8c6fc6ee06e82591

SHA256
782fab5a2eb1fac7afc8605dd5e91838dd5a1ecd959038c6eca27c591680921a

SHA512
da79609b3e4ffe851aae392ce8adfd481408f7a012fa7fc63531e0c58eddf12c7c812d013c632cc7801f57af2577f4174c1de5cefc2f6945b20764b34f3c2182

Download Submit
C:\Windows\system\rFgPxVw.exe

Filesize
2.3MB

MD5
ecda49f7eb7028db22abc67e0839cd2c

SHA1
da76c1bacb0b8f7c4e193f451bcb4569279ece7a

SHA256
201ff5024ca893fb8c650726203eb32f9d27bd8f1f115a5e4f246122cac6a3c2

SHA512
d84b531424361162b4628b692659a9da4860ac7a02092d794515b1cda340566f62b7d21a4de504be9ac92087f3526eedf4a335a135374915af9309452b7567f7

Download Submit
C:\Windows\system\sGRfFAn.exe

Filesize
2.3MB

MD5
5ca52a6737f8a63601bf56b5fbf40fe4

SHA1
bf89c7eb824e5baacd7ee05937045d06f9bbf701

SHA256
323f9bcc8e3a4f179c6387f9648d5ad6a1a0f9dd13c372c544a4a76a2b5e6cd2

SHA512
4fbcaef2616bf0becb38fa048d2bb33e66ddc98afb6b966e07fd0b5de0ec4bd2b26a74188500e555f9a442027c063e82fe47f5fc0687605a616a8af3047b3623

Download Submit
C:\Windows\system\yDFWwSB.exe

Filesize
2.3MB

MD5
d7f8d884737c87102d70f324cfa8d2d2

SHA1
ce7b7b9bc0db516ec2eced7ec83c3fe47142af6e

SHA256
0d10062081429b72caca9cf67bc3594364e1d8db886bf3e8543b5cae5ceafcdb

SHA512
da98dd8aeacc60d4454572eb73d2526f5323938c263fdbea023158bf96f59fe35ec3273c75dee561faaf5cd02a8a06a293dae3f02d0055d4a24217f6665ca906

Download Submit
C:\Windows\system\ygAxyVj.exe

Filesize
2.3MB

MD5
dbb72926906709a6719ebc2690feb529

SHA1
5a04d33aef1e69cfd136f339d1ae1a4ac18c95ea

SHA256
4f9abbff938d3e75f44b203abf60fde7ca849c4d986c0534f4e41eaf01f664b7

SHA512
83690fc9c7a4e1082a65d600a82eee43924911f3b4ca5edd0dc5c89ab539347502d02cbe40c5240a9c08043a02275d50e765591df702c65eed1baa85268856b2

Download Submit
\Windows\system\KDuCsdq.exe

Filesize
2.3MB

MD5
f185ee26f799da8b0a91fe111dd0f1a2

SHA1
ed3468c178c9481add282a7cb797798e0e8d4c67

SHA256
2b4abead9e41bc24700464297dedea46dae96dc431c1d97c04cf475a018b4e97

SHA512
c5ebe6a700de5f08b1cb36dc53b83ed29084492dedd167aa7f9d99846119097d804edd1d707ab9e401afcebfa82ff78c3eec84f7ef85485828030783eab9e585

Download Submit
memory/1928-116-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/1928-4090-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/1936-31-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1936-117-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/1936-110-0x0000000003960000-0x0000000003D52000-memory.dmp

Filesize
3.9MB

Download
memory/1936-27-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1936-108-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-28-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/1936-106-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/1936-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1936-0-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/1936-8-0x0000000003420000-0x0000000003812000-memory.dmp

Filesize
3.9MB

Download
memory/1936-113-0x0000000003960000-0x0000000003D52000-memory.dmp

Filesize
3.9MB

Download
memory/1936-115-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2472-109-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-4084-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-4083-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-120-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-3488-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-107-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-4077-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-111-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-4081-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2576-118-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2584-32-0x000007FEF55EE000-0x000007FEF55EF000-memory.dmp

Filesize
4KB

Download
memory/2584-104-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2584-30-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2584-39-0x0000000002330000-0x0000000002338000-memory.dmp

Filesize
32KB

Download
memory/2584-1050-0x000007FEF5330000-0x000007FEF5CCD000-memory.dmp

Filesize
9.6MB

Download
memory/2616-9-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2616-3473-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2700-119-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2700-4085-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2740-3483-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2740-29-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2756-3462-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2756-105-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2988-114-0x000000013F240000-0x000000013F632000-memory.dmp

Filesize
3.9MB

Download
memory/3020-112-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/3020-4096-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download