xmrig | e398bcf19b32e401d2aa1a2db5b72e1ca87d486f854dd75f0366e0cd6478f8c5

Analysis

max time kernel
149s
max time network
146s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Size

1.7MB
MD5

05322ddd930755aa1fd8024095bab90e
SHA1

a75e7a4cab4fc592cf6536743c41c2d3b7e9a76e
SHA256

e398bcf19b32e401d2aa1a2db5b72e1ca87d486f854dd75f0366e0cd6478f8c5
SHA512

905b09cb62434b73cb7026925909d2387905ab7d8cca125f9f20bd6dc1ff5e35534775de8a40ac018891b1860218f01d61e6ab557877d49fb19b35a1f9e8e505
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXeu+:NABm

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-13-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/1900-228-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/1596-222-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2912-83-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2704-81-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2676-79-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2720-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2968-75-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2928-73-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2792-70-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2808-68-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2832-65-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2704-3817-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/1596-3816-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2808-3804-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2640-3800-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2720-3799-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2928-3802-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2912-4657-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2832-4664-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2676-4672-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/1900-4667-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2968-4674-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2792-4660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/1984-9908-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2916	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2640	gunISaq.exe
2832	hqJRQzV.exe
2808	jLbPqtD.exe
2792	RYpjUwI.exe
2928	PIjgaxE.exe
2968	PGkUgwI.exe
2720	AIBlSbX.exe
2676	AAkSnAu.exe
2704	oEtSudS.exe
2912	HrTwvdA.exe
1596	WpuuaHS.exe
1900	RYUtlNE.exe
2136	mAcPcQZ.exe
2292	oUhFJjP.exe
3040	woUzHbg.exe
2376	VNUukqI.exe
2200	NGGnhyU.exe
2196	AfxokmI.exe
316	qQagenB.exe
548	isgZLZQ.exe
2500	UufDHxz.exe
2992	gZXyfpg.exe
576	nTaJeqC.exe
1508	wcthycj.exe
2856	ZjScOpy.exe
2460	taKxihj.exe
924	ExxFizE.exe
1052	pfdqQDH.exe
2456	rGVbkSr.exe
2908	TgAmjfZ.exe
2612	ieHzXdj.exe
812	raFVRQY.exe
2624	PfwSOvX.exe
592	phOiKdD.exe
560	CWgqvhm.exe
2296	WHTSScD.exe
1604	VyplsdP.exe
2860	gkeicjj.exe
2372	ToMFQug.exe
2976	tAHKGDZ.exe
2692	QesvqBX.exe
2636	MXQjiiN.exe
2160	jFaTAwp.exe
696	MQOJESh.exe
2264	zxKwfjr.exe
1160	AFavHHk.exe
1552	IsFtFoH.exe
1536	DdKbBVs.exe
1736	IKpseIa.exe
272	FQUeAHd.exe
2868	kOCFism.exe
2184	BmpVZWH.exe
1520	lrPTFeE.exe
700	RgPrQfv.exe
2084	ACaDYnW.exe
2948	nyrYiWc.exe
2272	jAVlyDr.exe
2812	xaLoWYm.exe
1964	UxkrzVl.exe
1948	zCKUTGs.exe
2872	NxLvAHQ.exe
2772	yKdLgQy.exe
1492	sOZiotM.exe
1628	JUCIqie.exe

Loads dropped DLL 64 IoCs

pid	Process
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe

UPX packed file 61 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x00080000000120f9-3.dat	upx
behavioral1/memory/2640-13-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0009000000016433-16.dat	upx
behavioral1/files/0x000800000001659d-26.dat	upx
behavioral1/files/0x00080000000167b4-31.dat	upx
behavioral1/files/0x0007000000016a93-34.dat	upx
behavioral1/files/0x0009000000016c5a-50.dat	upx
behavioral1/files/0x00050000000193bb-52.dat	upx
behavioral1/files/0x00050000000193c5-56.dat	upx
behavioral1/files/0x0007000000016c51-47.dat	upx
behavioral1/files/0x0007000000016c49-42.dat	upx
behavioral1/files/0x000f00000000549c-23.dat	upx
behavioral1/files/0x0037000000015fd2-94.dat	upx
behavioral1/files/0x0005000000019409-99.dat	upx
behavioral1/files/0x0005000000019452-110.dat	upx
behavioral1/files/0x0005000000019609-139.dat	upx
behavioral1/files/0x0005000000019619-167.dat	upx
behavioral1/files/0x0005000000019613-159.dat	upx
behavioral1/files/0x000500000001961f-182.dat	upx
behavioral1/files/0x000500000001961d-174.dat	upx
behavioral1/files/0x000500000001960d-151.dat	upx
behavioral1/memory/1900-228-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/1596-222-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x0005000000019620-186.dat	upx
behavioral1/files/0x000500000001961e-181.dat	upx
behavioral1/files/0x000500000001961b-172.dat	upx
behavioral1/files/0x0005000000019615-165.dat	upx
behavioral1/files/0x000500000001960f-157.dat	upx
behavioral1/files/0x000500000001960b-142.dat	upx
behavioral1/files/0x0005000000019607-134.dat	upx
behavioral1/files/0x00050000000195d8-130.dat	upx
behavioral1/files/0x0005000000019585-126.dat	upx
behavioral1/files/0x000500000001950b-122.dat	upx
behavioral1/files/0x00050000000194f7-118.dat	upx
behavioral1/files/0x000500000001945a-114.dat	upx
behavioral1/files/0x0005000000019427-106.dat	upx
behavioral1/files/0x000500000001940b-102.dat	upx
behavioral1/files/0x00050000000193df-91.dat	upx
behavioral1/memory/2912-83-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2704-81-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2676-79-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2720-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2968-75-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2928-73-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2792-70-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/2808-68-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2832-65-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2704-3817-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/1596-3816-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2808-3804-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2640-3800-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2720-3799-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/memory/2928-3802-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2912-4657-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2832-4664-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2676-4672-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/1900-4667-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2968-4674-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2792-4660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/memory/1984-9908-0x000000013F460000-0x000000013F852000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wGBeqyo.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\BpeegBz.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\RKQuTpG.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ZSdduEl.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\XRzbDei.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\XMWIsms.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\UaRLwUv.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\aXUchYp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\xrslbLD.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\NDoKbbN.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\uGxcNHE.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\LirXZIQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\woVFyre.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ceVCNuO.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\LnJXCpo.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\tYGshfa.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\nZnQzIH.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\SlfhjRe.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\NSGgIoP.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\QWczlPR.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\acpBBvP.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\IoYnrKT.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\HJCqGyp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\RTlpuUO.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\trfMOtp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\AORfWJo.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\cDtdWXq.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\PuomskD.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\blMsVta.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\UeOzETQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\GUzxsGl.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\PeGYkgJ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\QBgBbxl.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\orHGUxN.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\pXovysV.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\bTqlbqC.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\JUCIqie.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\uWPLEFp.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\vwbGDLy.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\oZpOxwN.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\wYNLSns.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\bqUhPVJ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\wivVnsK.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\CDWBsiQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\vJlIURL.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\dtvookv.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\moyDGLX.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ACaDYnW.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ipHUerq.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\tAkjYDk.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ZefcBQX.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\gdNAxrb.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\eVFXoyu.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\lCcxaWS.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\aBzyzAo.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\jmfGEXW.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\rNGwqZQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\LsvtvsX.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\WlkfIft.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\jHDMsph.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\DjuOXYt.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\DstvsYK.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\FVcCueQ.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
File created	C:\Windows\System\ckkAQbl.exe	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2916	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
Token: SeDebugPrivilege	2916	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2916	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	31
PID 1984 wrote to memory of 2916	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	31
PID 1984 wrote to memory of 2916	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	31
PID 1984 wrote to memory of 2640	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	32
PID 1984 wrote to memory of 2640	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	32
PID 1984 wrote to memory of 2640	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	32
PID 1984 wrote to memory of 2832	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2832	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2832	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	33
PID 1984 wrote to memory of 2808	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	34
PID 1984 wrote to memory of 2808	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	34
PID 1984 wrote to memory of 2808	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	34
PID 1984 wrote to memory of 2792	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2792	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2792	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	35
PID 1984 wrote to memory of 2928	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	36
PID 1984 wrote to memory of 2928	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	36
PID 1984 wrote to memory of 2928	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	36
PID 1984 wrote to memory of 2968	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	37
PID 1984 wrote to memory of 2968	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	37
PID 1984 wrote to memory of 2968	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	37
PID 1984 wrote to memory of 2720	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2720	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2720	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	38
PID 1984 wrote to memory of 2676	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	39
PID 1984 wrote to memory of 2676	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	39
PID 1984 wrote to memory of 2676	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	39
PID 1984 wrote to memory of 2704	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	40
PID 1984 wrote to memory of 2704	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	40
PID 1984 wrote to memory of 2704	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	40
PID 1984 wrote to memory of 2912	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	41
PID 1984 wrote to memory of 2912	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	41
PID 1984 wrote to memory of 2912	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	41
PID 1984 wrote to memory of 1596	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	42
PID 1984 wrote to memory of 1596	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	42
PID 1984 wrote to memory of 1596	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	42
PID 1984 wrote to memory of 1900	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	43
PID 1984 wrote to memory of 1900	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	43
PID 1984 wrote to memory of 1900	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	43
PID 1984 wrote to memory of 2136	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	44
PID 1984 wrote to memory of 2136	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	44
PID 1984 wrote to memory of 2136	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	44
PID 1984 wrote to memory of 2292	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	45
PID 1984 wrote to memory of 2292	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	45
PID 1984 wrote to memory of 2292	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	45
PID 1984 wrote to memory of 3040	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	46
PID 1984 wrote to memory of 3040	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	46
PID 1984 wrote to memory of 3040	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	46
PID 1984 wrote to memory of 2376	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	47
PID 1984 wrote to memory of 2376	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	47
PID 1984 wrote to memory of 2376	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	47
PID 1984 wrote to memory of 2200	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	48
PID 1984 wrote to memory of 2200	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	48
PID 1984 wrote to memory of 2200	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	48
PID 1984 wrote to memory of 2196	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	49
PID 1984 wrote to memory of 2196	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	49
PID 1984 wrote to memory of 2196	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	49
PID 1984 wrote to memory of 316	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	50
PID 1984 wrote to memory of 316	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	50
PID 1984 wrote to memory of 316	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	50
PID 1984 wrote to memory of 548	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	51
PID 1984 wrote to memory of 548	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	51
PID 1984 wrote to memory of 548	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	51
PID 1984 wrote to memory of 2500	1984	05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe	52

C:\Users\Admin\AppData\Local\Temp\05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05322ddd930755aa1fd8024095bab90e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2916
- C:\Windows\System\gunISaq.exe
  C:\Windows\System\gunISaq.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\hqJRQzV.exe
  C:\Windows\System\hqJRQzV.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\jLbPqtD.exe
  C:\Windows\System\jLbPqtD.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\RYpjUwI.exe
  C:\Windows\System\RYpjUwI.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\PIjgaxE.exe
  C:\Windows\System\PIjgaxE.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\PGkUgwI.exe
  C:\Windows\System\PGkUgwI.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\AIBlSbX.exe
  C:\Windows\System\AIBlSbX.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\AAkSnAu.exe
  C:\Windows\System\AAkSnAu.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\oEtSudS.exe
  C:\Windows\System\oEtSudS.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\HrTwvdA.exe
  C:\Windows\System\HrTwvdA.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\WpuuaHS.exe
  C:\Windows\System\WpuuaHS.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RYUtlNE.exe
  C:\Windows\System\RYUtlNE.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\mAcPcQZ.exe
  C:\Windows\System\mAcPcQZ.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\oUhFJjP.exe
  C:\Windows\System\oUhFJjP.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\woUzHbg.exe
  C:\Windows\System\woUzHbg.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\VNUukqI.exe
  C:\Windows\System\VNUukqI.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\NGGnhyU.exe
  C:\Windows\System\NGGnhyU.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\AfxokmI.exe
  C:\Windows\System\AfxokmI.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\qQagenB.exe
  C:\Windows\System\qQagenB.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\isgZLZQ.exe
  C:\Windows\System\isgZLZQ.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\UufDHxz.exe
  C:\Windows\System\UufDHxz.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\gZXyfpg.exe
  C:\Windows\System\gZXyfpg.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\nTaJeqC.exe
  C:\Windows\System\nTaJeqC.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\wcthycj.exe
  C:\Windows\System\wcthycj.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\ZjScOpy.exe
  C:\Windows\System\ZjScOpy.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\MXQjiiN.exe
  C:\Windows\System\MXQjiiN.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\taKxihj.exe
  C:\Windows\System\taKxihj.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\MQOJESh.exe
  C:\Windows\System\MQOJESh.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\ExxFizE.exe
  C:\Windows\System\ExxFizE.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\zxKwfjr.exe
  C:\Windows\System\zxKwfjr.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\pfdqQDH.exe
  C:\Windows\System\pfdqQDH.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\AFavHHk.exe
  C:\Windows\System\AFavHHk.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\rGVbkSr.exe
  C:\Windows\System\rGVbkSr.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\IsFtFoH.exe
  C:\Windows\System\IsFtFoH.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\TgAmjfZ.exe
  C:\Windows\System\TgAmjfZ.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\DdKbBVs.exe
  C:\Windows\System\DdKbBVs.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\ieHzXdj.exe
  C:\Windows\System\ieHzXdj.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\IKpseIa.exe
  C:\Windows\System\IKpseIa.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\raFVRQY.exe
  C:\Windows\System\raFVRQY.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\FQUeAHd.exe
  C:\Windows\System\FQUeAHd.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\PfwSOvX.exe
  C:\Windows\System\PfwSOvX.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\kOCFism.exe
  C:\Windows\System\kOCFism.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\phOiKdD.exe
  C:\Windows\System\phOiKdD.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\BmpVZWH.exe
  C:\Windows\System\BmpVZWH.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\CWgqvhm.exe
  C:\Windows\System\CWgqvhm.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\lrPTFeE.exe
  C:\Windows\System\lrPTFeE.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\WHTSScD.exe
  C:\Windows\System\WHTSScD.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\RgPrQfv.exe
  C:\Windows\System\RgPrQfv.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\VyplsdP.exe
  C:\Windows\System\VyplsdP.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ACaDYnW.exe
  C:\Windows\System\ACaDYnW.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\gkeicjj.exe
  C:\Windows\System\gkeicjj.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\nyrYiWc.exe
  C:\Windows\System\nyrYiWc.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\ToMFQug.exe
  C:\Windows\System\ToMFQug.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\jAVlyDr.exe
  C:\Windows\System\jAVlyDr.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\tAHKGDZ.exe
  C:\Windows\System\tAHKGDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\xaLoWYm.exe
  C:\Windows\System\xaLoWYm.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\QesvqBX.exe
  C:\Windows\System\QesvqBX.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\UxkrzVl.exe
  C:\Windows\System\UxkrzVl.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\jFaTAwp.exe
  C:\Windows\System\jFaTAwp.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\zCKUTGs.exe
  C:\Windows\System\zCKUTGs.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\NxLvAHQ.exe
  C:\Windows\System\NxLvAHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\yKdLgQy.exe
  C:\Windows\System\yKdLgQy.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\sOZiotM.exe
  C:\Windows\System\sOZiotM.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\JUCIqie.exe
  C:\Windows\System\JUCIqie.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ZqBkRwY.exe
  C:\Windows\System\ZqBkRwY.exe
  2⤵
  PID:2072
- C:\Windows\System\eaqgfCN.exe
  C:\Windows\System\eaqgfCN.exe
  2⤵
  PID:2784
- C:\Windows\System\aiSvFDZ.exe
  C:\Windows\System\aiSvFDZ.exe
  2⤵
  PID:2244
- C:\Windows\System\RQtooYF.exe
  C:\Windows\System\RQtooYF.exe
  2⤵
  PID:2728
- C:\Windows\System\KIKmIpB.exe
  C:\Windows\System\KIKmIpB.exe
  2⤵
  PID:1252
- C:\Windows\System\dGJdeWw.exe
  C:\Windows\System\dGJdeWw.exe
  2⤵
  PID:2484
- C:\Windows\System\lJWNJug.exe
  C:\Windows\System\lJWNJug.exe
  2⤵
  PID:1208
- C:\Windows\System\lSSCPOl.exe
  C:\Windows\System\lSSCPOl.exe
  2⤵
  PID:1676
- C:\Windows\System\KneBmDx.exe
  C:\Windows\System\KneBmDx.exe
  2⤵
  PID:1908
- C:\Windows\System\hXEtuRx.exe
  C:\Windows\System\hXEtuRx.exe
  2⤵
  PID:1952
- C:\Windows\System\qWpbJAS.exe
  C:\Windows\System\qWpbJAS.exe
  2⤵
  PID:468
- C:\Windows\System\DbrKCTh.exe
  C:\Windows\System\DbrKCTh.exe
  2⤵
  PID:1892
- C:\Windows\System\BhlIqvK.exe
  C:\Windows\System\BhlIqvK.exe
  2⤵
  PID:1748
- C:\Windows\System\vslEsMz.exe
  C:\Windows\System\vslEsMz.exe
  2⤵
  PID:1760
- C:\Windows\System\StGAlnw.exe
  C:\Windows\System\StGAlnw.exe
  2⤵
  PID:2756
- C:\Windows\System\teQkCyG.exe
  C:\Windows\System\teQkCyG.exe
  2⤵
  PID:2132
- C:\Windows\System\bxnLfyY.exe
  C:\Windows\System\bxnLfyY.exe
  2⤵
  PID:1640
- C:\Windows\System\IVPygbM.exe
  C:\Windows\System\IVPygbM.exe
  2⤵
  PID:280
- C:\Windows\System\SLcmxWJ.exe
  C:\Windows\System\SLcmxWJ.exe
  2⤵
  PID:2148
- C:\Windows\System\SLhXZyS.exe
  C:\Windows\System\SLhXZyS.exe
  2⤵
  PID:1616
- C:\Windows\System\KgfTeOW.exe
  C:\Windows\System\KgfTeOW.exe
  2⤵
  PID:1716
- C:\Windows\System\TybXZZJ.exe
  C:\Windows\System\TybXZZJ.exe
  2⤵
  PID:2308
- C:\Windows\System\fHjKxjW.exe
  C:\Windows\System\fHjKxjW.exe
  2⤵
  PID:2508
- C:\Windows\System\YkENnmj.exe
  C:\Windows\System\YkENnmj.exe
  2⤵
  PID:768
- C:\Windows\System\SQHKnyX.exe
  C:\Windows\System\SQHKnyX.exe
  2⤵
  PID:1708
- C:\Windows\System\SSfNcmj.exe
  C:\Windows\System\SSfNcmj.exe
  2⤵
  PID:1980
- C:\Windows\System\tWwyEGU.exe
  C:\Windows\System\tWwyEGU.exe
  2⤵
  PID:976
- C:\Windows\System\kiZOiPx.exe
  C:\Windows\System\kiZOiPx.exe
  2⤵
  PID:1880
- C:\Windows\System\OcMydsF.exe
  C:\Windows\System\OcMydsF.exe
  2⤵
  PID:744
- C:\Windows\System\kbJPKMJ.exe
  C:\Windows\System\kbJPKMJ.exe
  2⤵
  PID:3068
- C:\Windows\System\zWKtaJI.exe
  C:\Windows\System\zWKtaJI.exe
  2⤵
  PID:2716
- C:\Windows\System\Hfyfxpl.exe
  C:\Windows\System\Hfyfxpl.exe
  2⤵
  PID:2004
- C:\Windows\System\fETbsHy.exe
  C:\Windows\System\fETbsHy.exe
  2⤵
  PID:2848
- C:\Windows\System\ViHZtaF.exe
  C:\Windows\System\ViHZtaF.exe
  2⤵
  PID:1656
- C:\Windows\System\SJNnYtd.exe
  C:\Windows\System\SJNnYtd.exe
  2⤵
  PID:2888
- C:\Windows\System\vymHWMn.exe
  C:\Windows\System\vymHWMn.exe
  2⤵
  PID:896
- C:\Windows\System\QHhQxew.exe
  C:\Windows\System\QHhQxew.exe
  2⤵
  PID:2592
- C:\Windows\System\qWnFtVX.exe
  C:\Windows\System\qWnFtVX.exe
  2⤵
  PID:900
- C:\Windows\System\Cjvrmzk.exe
  C:\Windows\System\Cjvrmzk.exe
  2⤵
  PID:1680
- C:\Windows\System\msrvFxf.exe
  C:\Windows\System\msrvFxf.exe
  2⤵
  PID:1692
- C:\Windows\System\HEMuRNl.exe
  C:\Windows\System\HEMuRNl.exe
  2⤵
  PID:276
- C:\Windows\System\xVvZouc.exe
  C:\Windows\System\xVvZouc.exe
  2⤵
  PID:2900
- C:\Windows\System\rGcpccW.exe
  C:\Windows\System\rGcpccW.exe
  2⤵
  PID:2824
- C:\Windows\System\NsGYhEs.exe
  C:\Windows\System\NsGYhEs.exe
  2⤵
  PID:3052
- C:\Windows\System\Wdngqjh.exe
  C:\Windows\System\Wdngqjh.exe
  2⤵
  PID:2996
- C:\Windows\System\uiZgGAX.exe
  C:\Windows\System\uiZgGAX.exe
  2⤵
  PID:2116
- C:\Windows\System\nlRqcWT.exe
  C:\Windows\System\nlRqcWT.exe
  2⤵
  PID:2324
- C:\Windows\System\AyeUeRZ.exe
  C:\Windows\System\AyeUeRZ.exe
  2⤵
  PID:2844
- C:\Windows\System\SueQPzH.exe
  C:\Windows\System\SueQPzH.exe
  2⤵
  PID:1756
- C:\Windows\System\NGaKujw.exe
  C:\Windows\System\NGaKujw.exe
  2⤵
  PID:556
- C:\Windows\System\UWyZdhN.exe
  C:\Windows\System\UWyZdhN.exe
  2⤵
  PID:436
- C:\Windows\System\GHwisxC.exe
  C:\Windows\System\GHwisxC.exe
  2⤵
  PID:680
- C:\Windows\System\fiOMWJc.exe
  C:\Windows\System\fiOMWJc.exe
  2⤵
  PID:2964
- C:\Windows\System\BvVJgaa.exe
  C:\Windows\System\BvVJgaa.exe
  2⤵
  PID:2952
- C:\Windows\System\KEKsLRo.exe
  C:\Windows\System\KEKsLRo.exe
  2⤵
  PID:2356
- C:\Windows\System\OojMpJj.exe
  C:\Windows\System\OojMpJj.exe
  2⤵
  PID:3044
- C:\Windows\System\CysDpLr.exe
  C:\Windows\System\CysDpLr.exe
  2⤵
  PID:2828
- C:\Windows\System\ZIjQAbc.exe
  C:\Windows\System\ZIjQAbc.exe
  2⤵
  PID:2732
- C:\Windows\System\xpzzpPi.exe
  C:\Windows\System\xpzzpPi.exe
  2⤵
  PID:1480
- C:\Windows\System\hnTmHTY.exe
  C:\Windows\System\hnTmHTY.exe
  2⤵
  PID:2520
- C:\Windows\System\gSoZBED.exe
  C:\Windows\System\gSoZBED.exe
  2⤵
  PID:2224
- C:\Windows\System\MsKfCIj.exe
  C:\Windows\System\MsKfCIj.exe
  2⤵
  PID:1324
- C:\Windows\System\iGWqOme.exe
  C:\Windows\System\iGWqOme.exe
  2⤵
  PID:1784
- C:\Windows\System\aqCXoJj.exe
  C:\Windows\System\aqCXoJj.exe
  2⤵
  PID:2864
- C:\Windows\System\gWEcVTw.exe
  C:\Windows\System\gWEcVTw.exe
  2⤵
  PID:2840
- C:\Windows\System\XKhIsTp.exe
  C:\Windows\System\XKhIsTp.exe
  2⤵
  PID:1344
- C:\Windows\System\ZysFXoU.exe
  C:\Windows\System\ZysFXoU.exe
  2⤵
  PID:2800
- C:\Windows\System\BGpdqil.exe
  C:\Windows\System\BGpdqil.exe
  2⤵
  PID:2112
- C:\Windows\System\nhfChjS.exe
  C:\Windows\System\nhfChjS.exe
  2⤵
  PID:1704
- C:\Windows\System\iUCHmRH.exe
  C:\Windows\System\iUCHmRH.exe
  2⤵
  PID:2984
- C:\Windows\System\ehqmtxY.exe
  C:\Windows\System\ehqmtxY.exe
  2⤵
  PID:2152
- C:\Windows\System\MxSIeEN.exe
  C:\Windows\System\MxSIeEN.exe
  2⤵
  PID:2336
- C:\Windows\System\AAMjfdq.exe
  C:\Windows\System\AAMjfdq.exe
  2⤵
  PID:1644
- C:\Windows\System\ITbcURT.exe
  C:\Windows\System\ITbcURT.exe
  2⤵
  PID:2924
- C:\Windows\System\ODXxPVl.exe
  C:\Windows\System\ODXxPVl.exe
  2⤵
  PID:1652
- C:\Windows\System\FVOWdxF.exe
  C:\Windows\System\FVOWdxF.exe
  2⤵
  PID:1280
- C:\Windows\System\ePlDGoP.exe
  C:\Windows\System\ePlDGoP.exe
  2⤵
  PID:2804
- C:\Windows\System\uKwenOc.exe
  C:\Windows\System\uKwenOc.exe
  2⤵
  PID:2328
- C:\Windows\System\fUIskIh.exe
  C:\Windows\System\fUIskIh.exe
  2⤵
  PID:2988
- C:\Windows\System\aceEvtU.exe
  C:\Windows\System\aceEvtU.exe
  2⤵
  PID:2684
- C:\Windows\System\vWdSnjS.exe
  C:\Windows\System\vWdSnjS.exe
  2⤵
  PID:2232
- C:\Windows\System\ZPzSXzs.exe
  C:\Windows\System\ZPzSXzs.exe
  2⤵
  PID:2044
- C:\Windows\System\qPVNvEK.exe
  C:\Windows\System\qPVNvEK.exe
  2⤵
  PID:2056
- C:\Windows\System\kJHpHfd.exe
  C:\Windows\System\kJHpHfd.exe
  2⤵
  PID:920
- C:\Windows\System\cucREqe.exe
  C:\Windows\System\cucREqe.exe
  2⤵
  PID:1752
- C:\Windows\System\pegnAWZ.exe
  C:\Windows\System\pegnAWZ.exe
  2⤵
  PID:1932
- C:\Windows\System\FmjaRpI.exe
  C:\Windows\System\FmjaRpI.exe
  2⤵
  PID:2820
- C:\Windows\System\qJSWMmK.exe
  C:\Windows\System\qJSWMmK.exe
  2⤵
  PID:2492
- C:\Windows\System\dAVpIoX.exe
  C:\Windows\System\dAVpIoX.exe
  2⤵
  PID:2304
- C:\Windows\System\OBhcQlW.exe
  C:\Windows\System\OBhcQlW.exe
  2⤵
  PID:580
- C:\Windows\System\BigMpKY.exe
  C:\Windows\System\BigMpKY.exe
  2⤵
  PID:2552
- C:\Windows\System\TigiMRM.exe
  C:\Windows\System\TigiMRM.exe
  2⤵
  PID:1872
- C:\Windows\System\uUOooQG.exe
  C:\Windows\System\uUOooQG.exe
  2⤵
  PID:2464
- C:\Windows\System\IpNlGBF.exe
  C:\Windows\System\IpNlGBF.exe
  2⤵
  PID:3036
- C:\Windows\System\ZTbRckU.exe
  C:\Windows\System\ZTbRckU.exe
  2⤵
  PID:3092
- C:\Windows\System\yCRVTmD.exe
  C:\Windows\System\yCRVTmD.exe
  2⤵
  PID:3108
- C:\Windows\System\eZCXkob.exe
  C:\Windows\System\eZCXkob.exe
  2⤵
  PID:3124
- C:\Windows\System\ksfOUOj.exe
  C:\Windows\System\ksfOUOj.exe
  2⤵
  PID:3140
- C:\Windows\System\vLLarNC.exe
  C:\Windows\System\vLLarNC.exe
  2⤵
  PID:3156
- C:\Windows\System\rifQUAs.exe
  C:\Windows\System\rifQUAs.exe
  2⤵
  PID:3172
- C:\Windows\System\PQZqmqB.exe
  C:\Windows\System\PQZqmqB.exe
  2⤵
  PID:3188
- C:\Windows\System\XCEaVeW.exe
  C:\Windows\System\XCEaVeW.exe
  2⤵
  PID:3204
- C:\Windows\System\lWSVNzz.exe
  C:\Windows\System\lWSVNzz.exe
  2⤵
  PID:3220
- C:\Windows\System\BpEhpqg.exe
  C:\Windows\System\BpEhpqg.exe
  2⤵
  PID:3236
- C:\Windows\System\SFvHJkF.exe
  C:\Windows\System\SFvHJkF.exe
  2⤵
  PID:3252
- C:\Windows\System\HSxfuGW.exe
  C:\Windows\System\HSxfuGW.exe
  2⤵
  PID:3268
- C:\Windows\System\irNeSey.exe
  C:\Windows\System\irNeSey.exe
  2⤵
  PID:3288
- C:\Windows\System\zhjyWPX.exe
  C:\Windows\System\zhjyWPX.exe
  2⤵
  PID:3304
- C:\Windows\System\bxMEUDp.exe
  C:\Windows\System\bxMEUDp.exe
  2⤵
  PID:3332
- C:\Windows\System\aEHkAOf.exe
  C:\Windows\System\aEHkAOf.exe
  2⤵
  PID:3348
- C:\Windows\System\suTOERq.exe
  C:\Windows\System\suTOERq.exe
  2⤵
  PID:3372
- C:\Windows\System\QwPKCJY.exe
  C:\Windows\System\QwPKCJY.exe
  2⤵
  PID:3388
- C:\Windows\System\GRLfjmW.exe
  C:\Windows\System\GRLfjmW.exe
  2⤵
  PID:3404
- C:\Windows\System\urfXjzq.exe
  C:\Windows\System\urfXjzq.exe
  2⤵
  PID:3420
- C:\Windows\System\xcMKceP.exe
  C:\Windows\System\xcMKceP.exe
  2⤵
  PID:3436
- C:\Windows\System\IqFQfdT.exe
  C:\Windows\System\IqFQfdT.exe
  2⤵
  PID:3452
- C:\Windows\System\dIztAmo.exe
  C:\Windows\System\dIztAmo.exe
  2⤵
  PID:3468
- C:\Windows\System\eMOFbmC.exe
  C:\Windows\System\eMOFbmC.exe
  2⤵
  PID:3484
- C:\Windows\System\Wyoqaot.exe
  C:\Windows\System\Wyoqaot.exe
  2⤵
  PID:3500
- C:\Windows\System\AHaGbkM.exe
  C:\Windows\System\AHaGbkM.exe
  2⤵
  PID:3516
- C:\Windows\System\HNXnxlC.exe
  C:\Windows\System\HNXnxlC.exe
  2⤵
  PID:3532
- C:\Windows\System\bLIGJvX.exe
  C:\Windows\System\bLIGJvX.exe
  2⤵
  PID:3548
- C:\Windows\System\hZulikH.exe
  C:\Windows\System\hZulikH.exe
  2⤵
  PID:3564
- C:\Windows\System\OndQJNZ.exe
  C:\Windows\System\OndQJNZ.exe
  2⤵
  PID:3580
- C:\Windows\System\EcWfhrO.exe
  C:\Windows\System\EcWfhrO.exe
  2⤵
  PID:3596
- C:\Windows\System\aNQksqa.exe
  C:\Windows\System\aNQksqa.exe
  2⤵
  PID:3612
- C:\Windows\System\MQHRpra.exe
  C:\Windows\System\MQHRpra.exe
  2⤵
  PID:3628
- C:\Windows\System\AGLANzR.exe
  C:\Windows\System\AGLANzR.exe
  2⤵
  PID:3644
- C:\Windows\System\zwqUKuT.exe
  C:\Windows\System\zwqUKuT.exe
  2⤵
  PID:3660
- C:\Windows\System\uPiPhHR.exe
  C:\Windows\System\uPiPhHR.exe
  2⤵
  PID:3676
- C:\Windows\System\ueLRYra.exe
  C:\Windows\System\ueLRYra.exe
  2⤵
  PID:3692
- C:\Windows\System\sLGZEPI.exe
  C:\Windows\System\sLGZEPI.exe
  2⤵
  PID:3708
- C:\Windows\System\YXqDWdT.exe
  C:\Windows\System\YXqDWdT.exe
  2⤵
  PID:3724
- C:\Windows\System\HYEUOJz.exe
  C:\Windows\System\HYEUOJz.exe
  2⤵
  PID:3740
- C:\Windows\System\OfPBixN.exe
  C:\Windows\System\OfPBixN.exe
  2⤵
  PID:3756
- C:\Windows\System\joMrYAw.exe
  C:\Windows\System\joMrYAw.exe
  2⤵
  PID:3772
- C:\Windows\System\FnZFSdN.exe
  C:\Windows\System\FnZFSdN.exe
  2⤵
  PID:3788
- C:\Windows\System\QfJhhWV.exe
  C:\Windows\System\QfJhhWV.exe
  2⤵
  PID:3804
- C:\Windows\System\UQztoDJ.exe
  C:\Windows\System\UQztoDJ.exe
  2⤵
  PID:3820
- C:\Windows\System\dxBOssc.exe
  C:\Windows\System\dxBOssc.exe
  2⤵
  PID:3836
- C:\Windows\System\zRHvGEV.exe
  C:\Windows\System\zRHvGEV.exe
  2⤵
  PID:3852
- C:\Windows\System\fLAgkhA.exe
  C:\Windows\System\fLAgkhA.exe
  2⤵
  PID:3868
- C:\Windows\System\PiecMyN.exe
  C:\Windows\System\PiecMyN.exe
  2⤵
  PID:3884
- C:\Windows\System\IWWJvzD.exe
  C:\Windows\System\IWWJvzD.exe
  2⤵
  PID:3900
- C:\Windows\System\XCKlXxq.exe
  C:\Windows\System\XCKlXxq.exe
  2⤵
  PID:3916
- C:\Windows\System\sSeQduV.exe
  C:\Windows\System\sSeQduV.exe
  2⤵
  PID:3932
- C:\Windows\System\QAFqIMG.exe
  C:\Windows\System\QAFqIMG.exe
  2⤵
  PID:3948
- C:\Windows\System\CCwCjND.exe
  C:\Windows\System\CCwCjND.exe
  2⤵
  PID:3964
- C:\Windows\System\cBodCFG.exe
  C:\Windows\System\cBodCFG.exe
  2⤵
  PID:3980
- C:\Windows\System\eUEfLMu.exe
  C:\Windows\System\eUEfLMu.exe
  2⤵
  PID:3996
- C:\Windows\System\njkCOMY.exe
  C:\Windows\System\njkCOMY.exe
  2⤵
  PID:4012
- C:\Windows\System\AOyMjsJ.exe
  C:\Windows\System\AOyMjsJ.exe
  2⤵
  PID:4028
- C:\Windows\System\AeyPTGg.exe
  C:\Windows\System\AeyPTGg.exe
  2⤵
  PID:4044
- C:\Windows\System\GplGkaR.exe
  C:\Windows\System\GplGkaR.exe
  2⤵
  PID:4060
- C:\Windows\System\frmshlR.exe
  C:\Windows\System\frmshlR.exe
  2⤵
  PID:4076
- C:\Windows\System\thQeoHU.exe
  C:\Windows\System\thQeoHU.exe
  2⤵
  PID:4092
- C:\Windows\System\ukdcJSD.exe
  C:\Windows\System\ukdcJSD.exe
  2⤵
  PID:1600
- C:\Windows\System\DxtvAfD.exe
  C:\Windows\System\DxtvAfD.exe
  2⤵
  PID:848
- C:\Windows\System\uPJMAEN.exe
  C:\Windows\System\uPJMAEN.exe
  2⤵
  PID:3168
- C:\Windows\System\DSJYwdd.exe
  C:\Windows\System\DSJYwdd.exe
  2⤵
  PID:3232
- C:\Windows\System\YYYXShb.exe
  C:\Windows\System\YYYXShb.exe
  2⤵
  PID:1000
- C:\Windows\System\jbpimBx.exe
  C:\Windows\System\jbpimBx.exe
  2⤵
  PID:3152
- C:\Windows\System\ICQTyUS.exe
  C:\Windows\System\ICQTyUS.exe
  2⤵
  PID:3244
- C:\Windows\System\ZtfcTAz.exe
  C:\Windows\System\ZtfcTAz.exe
  2⤵
  PID:3180
- C:\Windows\System\fmXeasi.exe
  C:\Windows\System\fmXeasi.exe
  2⤵
  PID:3264
- C:\Windows\System\TkSvmZc.exe
  C:\Windows\System\TkSvmZc.exe
  2⤵
  PID:3300
- C:\Windows\System\iMJrorT.exe
  C:\Windows\System\iMJrorT.exe
  2⤵
  PID:3328
- C:\Windows\System\JqnlVxx.exe
  C:\Windows\System\JqnlVxx.exe
  2⤵
  PID:3380
- C:\Windows\System\lcDKevb.exe
  C:\Windows\System\lcDKevb.exe
  2⤵
  PID:3412
- C:\Windows\System\VjWvTxM.exe
  C:\Windows\System\VjWvTxM.exe
  2⤵
  PID:3428
- C:\Windows\System\zBoJyWi.exe
  C:\Windows\System\zBoJyWi.exe
  2⤵
  PID:3448
- C:\Windows\System\xMAIkGY.exe
  C:\Windows\System\xMAIkGY.exe
  2⤵
  PID:3512
- C:\Windows\System\hiHhleo.exe
  C:\Windows\System\hiHhleo.exe
  2⤵
  PID:3576
- C:\Windows\System\hFQMgtu.exe
  C:\Windows\System\hFQMgtu.exe
  2⤵
  PID:3492
- C:\Windows\System\jNhWVtb.exe
  C:\Windows\System\jNhWVtb.exe
  2⤵
  PID:3608
- C:\Windows\System\cPjeCIH.exe
  C:\Windows\System\cPjeCIH.exe
  2⤵
  PID:3672
- C:\Windows\System\ZqduLGQ.exe
  C:\Windows\System\ZqduLGQ.exe
  2⤵
  PID:3556
- C:\Windows\System\VwTevQk.exe
  C:\Windows\System\VwTevQk.exe
  2⤵
  PID:3592
- C:\Windows\System\QjEoSxG.exe
  C:\Windows\System\QjEoSxG.exe
  2⤵
  PID:3656
- C:\Windows\System\NEjVEpN.exe
  C:\Windows\System\NEjVEpN.exe
  2⤵
  PID:3720
- C:\Windows\System\fMiwhTo.exe
  C:\Windows\System\fMiwhTo.exe
  2⤵
  PID:3796
- C:\Windows\System\PbHJout.exe
  C:\Windows\System\PbHJout.exe
  2⤵
  PID:3864
- C:\Windows\System\tGDQdvg.exe
  C:\Windows\System\tGDQdvg.exe
  2⤵
  PID:3924
- C:\Windows\System\DnKVUGC.exe
  C:\Windows\System\DnKVUGC.exe
  2⤵
  PID:3960
- C:\Windows\System\AzDrCTS.exe
  C:\Windows\System\AzDrCTS.exe
  2⤵
  PID:4020
- C:\Windows\System\SnbGoKe.exe
  C:\Windows\System\SnbGoKe.exe
  2⤵
  PID:4088
- C:\Windows\System\ZefcBQX.exe
  C:\Windows\System\ZefcBQX.exe
  2⤵
  PID:3196
- C:\Windows\System\RpGWzjJ.exe
  C:\Windows\System\RpGWzjJ.exe
  2⤵
  PID:3816
- C:\Windows\System\JvjskZt.exe
  C:\Windows\System\JvjskZt.exe
  2⤵
  PID:3844
- C:\Windows\System\fQSToks.exe
  C:\Windows\System\fQSToks.exe
  2⤵
  PID:3880
- C:\Windows\System\UScoZJB.exe
  C:\Windows\System\UScoZJB.exe
  2⤵
  PID:3848
- C:\Windows\System\ryLGSMW.exe
  C:\Windows\System\ryLGSMW.exe
  2⤵
  PID:3368
- C:\Windows\System\ZdoAYCY.exe
  C:\Windows\System\ZdoAYCY.exe
  2⤵
  PID:3260
- C:\Windows\System\SIBvUtR.exe
  C:\Windows\System\SIBvUtR.exe
  2⤵
  PID:3908
- C:\Windows\System\YTJzYRN.exe
  C:\Windows\System\YTJzYRN.exe
  2⤵
  PID:3464
- C:\Windows\System\WvuFUuQ.exe
  C:\Windows\System\WvuFUuQ.exe
  2⤵
  PID:3560
- C:\Windows\System\bqXSVAs.exe
  C:\Windows\System\bqXSVAs.exe
  2⤵
  PID:912
- C:\Windows\System\qMxYMVx.exe
  C:\Windows\System\qMxYMVx.exe
  2⤵
  PID:1104
- C:\Windows\System\xpQpstd.exe
  C:\Windows\System\xpQpstd.exe
  2⤵
  PID:448
- C:\Windows\System\skUcknM.exe
  C:\Windows\System\skUcknM.exe
  2⤵
  PID:4008
- C:\Windows\System\VyzXhEK.exe
  C:\Windows\System\VyzXhEK.exe
  2⤵
  PID:3972
- C:\Windows\System\GIJfiLL.exe
  C:\Windows\System\GIJfiLL.exe
  2⤵
  PID:3136
- C:\Windows\System\TjkuMhl.exe
  C:\Windows\System\TjkuMhl.exe
  2⤵
  PID:3768
- C:\Windows\System\JgsqlEw.exe
  C:\Windows\System\JgsqlEw.exe
  2⤵
  PID:3528
- C:\Windows\System\WcsVAqG.exe
  C:\Windows\System\WcsVAqG.exe
  2⤵
  PID:3956
- C:\Windows\System\oncefUW.exe
  C:\Windows\System\oncefUW.exe
  2⤵
  PID:3812
- C:\Windows\System\afQwyQz.exe
  C:\Windows\System\afQwyQz.exe
  2⤵
  PID:3432
- C:\Windows\System\wpowOju.exe
  C:\Windows\System\wpowOju.exe
  2⤵
  PID:3780
- C:\Windows\System\pwrDonU.exe
  C:\Windows\System\pwrDonU.exe
  2⤵
  PID:3228
- C:\Windows\System\HCvPTzd.exe
  C:\Windows\System\HCvPTzd.exe
  2⤵
  PID:1884
- C:\Windows\System\YxmpUOL.exe
  C:\Windows\System\YxmpUOL.exe
  2⤵
  PID:3084
- C:\Windows\System\GFSjwgy.exe
  C:\Windows\System\GFSjwgy.exe
  2⤵
  PID:3764
- C:\Windows\System\ZBlWmDO.exe
  C:\Windows\System\ZBlWmDO.exe
  2⤵
  PID:3588
- C:\Windows\System\uxdKcfa.exe
  C:\Windows\System\uxdKcfa.exe
  2⤵
  PID:3460
- C:\Windows\System\IzlVwsa.exe
  C:\Windows\System\IzlVwsa.exe
  2⤵
  PID:3784
- C:\Windows\System\MALEiqN.exe
  C:\Windows\System\MALEiqN.exe
  2⤵
  PID:3832
- C:\Windows\System\uPgMDxE.exe
  C:\Windows\System\uPgMDxE.exe
  2⤵
  PID:3976
- C:\Windows\System\QRQwwWU.exe
  C:\Windows\System\QRQwwWU.exe
  2⤵
  PID:3992
- C:\Windows\System\KcmGAGa.exe
  C:\Windows\System\KcmGAGa.exe
  2⤵
  PID:3892
- C:\Windows\System\TqXZtmP.exe
  C:\Windows\System\TqXZtmP.exe
  2⤵
  PID:3508
- C:\Windows\System\UdvtFzt.exe
  C:\Windows\System\UdvtFzt.exe
  2⤵
  PID:772
- C:\Windows\System\FrRtClE.exe
  C:\Windows\System\FrRtClE.exe
  2⤵
  PID:3344
- C:\Windows\System\GxKGJkp.exe
  C:\Windows\System\GxKGJkp.exe
  2⤵
  PID:1696
- C:\Windows\System\kOQWUXK.exe
  C:\Windows\System\kOQWUXK.exe
  2⤵
  PID:4108
- C:\Windows\System\yyyiVnt.exe
  C:\Windows\System\yyyiVnt.exe
  2⤵
  PID:4124
- C:\Windows\System\QDJSLbw.exe
  C:\Windows\System\QDJSLbw.exe
  2⤵
  PID:4140
- C:\Windows\System\KhKVsdz.exe
  C:\Windows\System\KhKVsdz.exe
  2⤵
  PID:4156
- C:\Windows\System\HVIsHlR.exe
  C:\Windows\System\HVIsHlR.exe
  2⤵
  PID:4172
- C:\Windows\System\kFPglBn.exe
  C:\Windows\System\kFPglBn.exe
  2⤵
  PID:4188
- C:\Windows\System\FAPgIDn.exe
  C:\Windows\System\FAPgIDn.exe
  2⤵
  PID:4204
- C:\Windows\System\LJcwNzK.exe
  C:\Windows\System\LJcwNzK.exe
  2⤵
  PID:4220
- C:\Windows\System\aYkzrzv.exe
  C:\Windows\System\aYkzrzv.exe
  2⤵
  PID:4236
- C:\Windows\System\WhyyAvT.exe
  C:\Windows\System\WhyyAvT.exe
  2⤵
  PID:4252
- C:\Windows\System\pYBIeHC.exe
  C:\Windows\System\pYBIeHC.exe
  2⤵
  PID:4268
- C:\Windows\System\cUoRqVa.exe
  C:\Windows\System\cUoRqVa.exe
  2⤵
  PID:4284
- C:\Windows\System\HOVxzSL.exe
  C:\Windows\System\HOVxzSL.exe
  2⤵
  PID:4300
- C:\Windows\System\IrkwhID.exe
  C:\Windows\System\IrkwhID.exe
  2⤵
  PID:4316
- C:\Windows\System\zwqAxJP.exe
  C:\Windows\System\zwqAxJP.exe
  2⤵
  PID:4332
- C:\Windows\System\ODbGXWe.exe
  C:\Windows\System\ODbGXWe.exe
  2⤵
  PID:4348
- C:\Windows\System\qigwIRB.exe
  C:\Windows\System\qigwIRB.exe
  2⤵
  PID:4364
- C:\Windows\System\blikJHj.exe
  C:\Windows\System\blikJHj.exe
  2⤵
  PID:4380
- C:\Windows\System\hKxWadT.exe
  C:\Windows\System\hKxWadT.exe
  2⤵
  PID:4396
- C:\Windows\System\UeOzETQ.exe
  C:\Windows\System\UeOzETQ.exe
  2⤵
  PID:4412
- C:\Windows\System\yxcRNGW.exe
  C:\Windows\System\yxcRNGW.exe
  2⤵
  PID:4428
- C:\Windows\System\ToeoZxl.exe
  C:\Windows\System\ToeoZxl.exe
  2⤵
  PID:4444
- C:\Windows\System\bqbEBvW.exe
  C:\Windows\System\bqbEBvW.exe
  2⤵
  PID:4460
- C:\Windows\System\YNWRqnp.exe
  C:\Windows\System\YNWRqnp.exe
  2⤵
  PID:4476
- C:\Windows\System\cHlCVnr.exe
  C:\Windows\System\cHlCVnr.exe
  2⤵
  PID:4492
- C:\Windows\System\zHiKVbB.exe
  C:\Windows\System\zHiKVbB.exe
  2⤵
  PID:4508
- C:\Windows\System\vsowzQx.exe
  C:\Windows\System\vsowzQx.exe
  2⤵
  PID:4524
- C:\Windows\System\zYrwMHg.exe
  C:\Windows\System\zYrwMHg.exe
  2⤵
  PID:4540
- C:\Windows\System\IFzjWvj.exe
  C:\Windows\System\IFzjWvj.exe
  2⤵
  PID:4556
- C:\Windows\System\UKKuahp.exe
  C:\Windows\System\UKKuahp.exe
  2⤵
  PID:4572
- C:\Windows\System\jGAHVfP.exe
  C:\Windows\System\jGAHVfP.exe
  2⤵
  PID:4588
- C:\Windows\System\YVyKiUF.exe
  C:\Windows\System\YVyKiUF.exe
  2⤵
  PID:4604
- C:\Windows\System\DmhORfw.exe
  C:\Windows\System\DmhORfw.exe
  2⤵
  PID:4620
- C:\Windows\System\uYfHPiK.exe
  C:\Windows\System\uYfHPiK.exe
  2⤵
  PID:4636
- C:\Windows\System\TvSAXee.exe
  C:\Windows\System\TvSAXee.exe
  2⤵
  PID:4652
- C:\Windows\System\vhVCsGg.exe
  C:\Windows\System\vhVCsGg.exe
  2⤵
  PID:4668
- C:\Windows\System\vpjxtJC.exe
  C:\Windows\System\vpjxtJC.exe
  2⤵
  PID:4684
- C:\Windows\System\XlWvwDp.exe
  C:\Windows\System\XlWvwDp.exe
  2⤵
  PID:4700
- C:\Windows\System\JWbFnWK.exe
  C:\Windows\System\JWbFnWK.exe
  2⤵
  PID:4716
- C:\Windows\System\owdgfyO.exe
  C:\Windows\System\owdgfyO.exe
  2⤵
  PID:4732
- C:\Windows\System\VYXKlsP.exe
  C:\Windows\System\VYXKlsP.exe
  2⤵
  PID:4748
- C:\Windows\System\sHNMKdq.exe
  C:\Windows\System\sHNMKdq.exe
  2⤵
  PID:4764
- C:\Windows\System\wemrNet.exe
  C:\Windows\System\wemrNet.exe
  2⤵
  PID:4780
- C:\Windows\System\iecVUtx.exe
  C:\Windows\System\iecVUtx.exe
  2⤵
  PID:4796
- C:\Windows\System\vBYhepK.exe
  C:\Windows\System\vBYhepK.exe
  2⤵
  PID:4812
- C:\Windows\System\JfqdOLo.exe
  C:\Windows\System\JfqdOLo.exe
  2⤵
  PID:4828
- C:\Windows\System\DOkQqUW.exe
  C:\Windows\System\DOkQqUW.exe
  2⤵
  PID:4844
- C:\Windows\System\YKTboHU.exe
  C:\Windows\System\YKTboHU.exe
  2⤵
  PID:4860
- C:\Windows\System\AllkYSp.exe
  C:\Windows\System\AllkYSp.exe
  2⤵
  PID:4876
- C:\Windows\System\rRtlPdk.exe
  C:\Windows\System\rRtlPdk.exe
  2⤵
  PID:4892
- C:\Windows\System\HyNUIuJ.exe
  C:\Windows\System\HyNUIuJ.exe
  2⤵
  PID:4908
- C:\Windows\System\wvpibnX.exe
  C:\Windows\System\wvpibnX.exe
  2⤵
  PID:4924
- C:\Windows\System\GXnjuzk.exe
  C:\Windows\System\GXnjuzk.exe
  2⤵
  PID:4940
- C:\Windows\System\HNVZdzP.exe
  C:\Windows\System\HNVZdzP.exe
  2⤵
  PID:4956
- C:\Windows\System\ttSOzGY.exe
  C:\Windows\System\ttSOzGY.exe
  2⤵
  PID:4972
- C:\Windows\System\EVrEwEO.exe
  C:\Windows\System\EVrEwEO.exe
  2⤵
  PID:4988
- C:\Windows\System\VfzyYqR.exe
  C:\Windows\System\VfzyYqR.exe
  2⤵
  PID:5004
- C:\Windows\System\ffSdgoK.exe
  C:\Windows\System\ffSdgoK.exe
  2⤵
  PID:5020
- C:\Windows\System\nCQdWNw.exe
  C:\Windows\System\nCQdWNw.exe
  2⤵
  PID:5036
- C:\Windows\System\aqcWaGr.exe
  C:\Windows\System\aqcWaGr.exe
  2⤵
  PID:5052
- C:\Windows\System\POKErmU.exe
  C:\Windows\System\POKErmU.exe
  2⤵
  PID:5068
- C:\Windows\System\LOTsZHW.exe
  C:\Windows\System\LOTsZHW.exe
  2⤵
  PID:5084
- C:\Windows\System\DcRqZoi.exe
  C:\Windows\System\DcRqZoi.exe
  2⤵
  PID:5100
- C:\Windows\System\tKzEqtS.exe
  C:\Windows\System\tKzEqtS.exe
  2⤵
  PID:5116
- C:\Windows\System\fjltPfs.exe
  C:\Windows\System\fjltPfs.exe
  2⤵
  PID:3164
- C:\Windows\System\CvRthqF.exe
  C:\Windows\System\CvRthqF.exe
  2⤵
  PID:4116
- C:\Windows\System\lTcZkTe.exe
  C:\Windows\System\lTcZkTe.exe
  2⤵
  PID:4164
- C:\Windows\System\qJLBkVj.exe
  C:\Windows\System\qJLBkVj.exe
  2⤵
  PID:4200
- C:\Windows\System\XBUTluU.exe
  C:\Windows\System\XBUTluU.exe
  2⤵
  PID:4148
- C:\Windows\System\Xghvvtl.exe
  C:\Windows\System\Xghvvtl.exe
  2⤵
  PID:3312
- C:\Windows\System\EEhQrPx.exe
  C:\Windows\System\EEhQrPx.exe
  2⤵
  PID:4260
- C:\Windows\System\rkzxaJq.exe
  C:\Windows\System\rkzxaJq.exe
  2⤵
  PID:4328
- C:\Windows\System\FLEWVop.exe
  C:\Windows\System\FLEWVop.exe
  2⤵
  PID:2260
- C:\Windows\System\HOOhDYG.exe
  C:\Windows\System\HOOhDYG.exe
  2⤵
  PID:4420
- C:\Windows\System\KLuTdEg.exe
  C:\Windows\System\KLuTdEg.exe
  2⤵
  PID:4212
- C:\Windows\System\aHHDRyO.exe
  C:\Windows\System\aHHDRyO.exe
  2⤵
  PID:4488
- C:\Windows\System\DjPajzN.exe
  C:\Windows\System\DjPajzN.exe
  2⤵
  PID:4408
- C:\Windows\System\xYAAoQz.exe
  C:\Windows\System\xYAAoQz.exe
  2⤵
  PID:4440
- C:\Windows\System\cmRPmRu.exe
  C:\Windows\System\cmRPmRu.exe
  2⤵
  PID:4248
- C:\Windows\System\UEylOnn.exe
  C:\Windows\System\UEylOnn.exe
  2⤵
  PID:4376
- C:\Windows\System\OWvPOiQ.exe
  C:\Windows\System\OWvPOiQ.exe
  2⤵
  PID:4280
- C:\Windows\System\lcwyhsc.exe
  C:\Windows\System\lcwyhsc.exe
  2⤵
  PID:4584
- C:\Windows\System\ipxXgUt.exe
  C:\Windows\System\ipxXgUt.exe
  2⤵
  PID:4616
- C:\Windows\System\oOPtQIr.exe
  C:\Windows\System\oOPtQIr.exe
  2⤵
  PID:4644
- C:\Windows\System\ZMOdAjZ.exe
  C:\Windows\System\ZMOdAjZ.exe
  2⤵
  PID:4708
- C:\Windows\System\DYpOILt.exe
  C:\Windows\System\DYpOILt.exe
  2⤵
  PID:4724
- C:\Windows\System\iHUvIEB.exe
  C:\Windows\System\iHUvIEB.exe
  2⤵
  PID:4664
- C:\Windows\System\djiGojI.exe
  C:\Windows\System\djiGojI.exe
  2⤵
  PID:4776
- C:\Windows\System\tcyxIWd.exe
  C:\Windows\System\tcyxIWd.exe
  2⤵
  PID:4804
- C:\Windows\System\auqhomC.exe
  C:\Windows\System\auqhomC.exe
  2⤵
  PID:4840
- C:\Windows\System\ohgTdMA.exe
  C:\Windows\System\ohgTdMA.exe
  2⤵
  PID:4852
- C:\Windows\System\RiseSIh.exe
  C:\Windows\System\RiseSIh.exe
  2⤵
  PID:4936
- C:\Windows\System\uFlQnfv.exe
  C:\Windows\System\uFlQnfv.exe
  2⤵
  PID:5000
- C:\Windows\System\vOHufkw.exe
  C:\Windows\System\vOHufkw.exe
  2⤵
  PID:4856
- C:\Windows\System\SOaWDqt.exe
  C:\Windows\System\SOaWDqt.exe
  2⤵
  PID:5064
- C:\Windows\System\DkvkFXk.exe
  C:\Windows\System\DkvkFXk.exe
  2⤵
  PID:4136
- C:\Windows\System\VnZcAZW.exe
  C:\Windows\System\VnZcAZW.exe
  2⤵
  PID:4120
- C:\Windows\System\qahZsMr.exe
  C:\Windows\System\qahZsMr.exe
  2⤵
  PID:4388
- C:\Windows\System\uNmjBaW.exe
  C:\Windows\System\uNmjBaW.exe
  2⤵
  PID:5016
- C:\Windows\System\vDaeaNW.exe
  C:\Windows\System\vDaeaNW.exe
  2⤵
  PID:4548
- C:\Windows\System\vWoQzEG.exe
  C:\Windows\System\vWoQzEG.exe
  2⤵
  PID:5112
- C:\Windows\System\wYMBeoS.exe
  C:\Windows\System\wYMBeoS.exe
  2⤵
  PID:3276
- C:\Windows\System\yCxEfUo.exe
  C:\Windows\System\yCxEfUo.exe
  2⤵
  PID:4952
- C:\Windows\System\pffzbDC.exe
  C:\Windows\System\pffzbDC.exe
  2⤵
  PID:4456
- C:\Windows\System\sVnmMgP.exe
  C:\Windows\System\sVnmMgP.exe
  2⤵
  PID:4168
- C:\Windows\System\LOfNMir.exe
  C:\Windows\System\LOfNMir.exe
  2⤵
  PID:4292
- C:\Windows\System\kdqpMYY.exe
  C:\Windows\System\kdqpMYY.exe
  2⤵
  PID:4564
- C:\Windows\System\XJumWwR.exe
  C:\Windows\System\XJumWwR.exe
  2⤵
  PID:4632
- C:\Windows\System\ZNvYxuD.exe
  C:\Windows\System\ZNvYxuD.exe
  2⤵
  PID:4344
- C:\Windows\System\GDKarvh.exe
  C:\Windows\System\GDKarvh.exe
  2⤵
  PID:4996
- C:\Windows\System\iXAJKUc.exe
  C:\Windows\System\iXAJKUc.exe
  2⤵
  PID:5060
- C:\Windows\System\CcNuEOW.exe
  C:\Windows\System\CcNuEOW.exe
  2⤵
  PID:4744
- C:\Windows\System\SirCdIU.exe
  C:\Windows\System\SirCdIU.exe
  2⤵
  PID:5012
- C:\Windows\System\wRObnRz.exe
  C:\Windows\System\wRObnRz.exe
  2⤵
  PID:4100
- C:\Windows\System\dnOfnVu.exe
  C:\Windows\System\dnOfnVu.exe
  2⤵
  PID:4600
- C:\Windows\System\xtLglvA.exe
  C:\Windows\System\xtLglvA.exe
  2⤵
  PID:4436
- C:\Windows\System\RQJfGPE.exe
  C:\Windows\System\RQJfGPE.exe
  2⤵
  PID:4760
- C:\Windows\System\SKrmkVT.exe
  C:\Windows\System\SKrmkVT.exe
  2⤵
  PID:4580
- C:\Windows\System\orHASSh.exe
  C:\Windows\System\orHASSh.exe
  2⤵
  PID:4372
- C:\Windows\System\LygbkxA.exe
  C:\Windows\System\LygbkxA.exe
  2⤵
  PID:5108
- C:\Windows\System\DyFCRIs.exe
  C:\Windows\System\DyFCRIs.exe
  2⤵
  PID:5136
- C:\Windows\System\TpgOeRm.exe
  C:\Windows\System\TpgOeRm.exe
  2⤵
  PID:5152
- C:\Windows\System\PwzjDPj.exe
  C:\Windows\System\PwzjDPj.exe
  2⤵
  PID:5168
- C:\Windows\System\ENlXHsw.exe
  C:\Windows\System\ENlXHsw.exe
  2⤵
  PID:5184
- C:\Windows\System\jBafGuD.exe
  C:\Windows\System\jBafGuD.exe
  2⤵
  PID:5200
- C:\Windows\System\PlBsINc.exe
  C:\Windows\System\PlBsINc.exe
  2⤵
  PID:5216
- C:\Windows\System\bYRPacP.exe
  C:\Windows\System\bYRPacP.exe
  2⤵
  PID:5232
- C:\Windows\System\kalClbm.exe
  C:\Windows\System\kalClbm.exe
  2⤵
  PID:5248
- C:\Windows\System\vgABFyK.exe
  C:\Windows\System\vgABFyK.exe
  2⤵
  PID:5264
- C:\Windows\System\GaUkamz.exe
  C:\Windows\System\GaUkamz.exe
  2⤵
  PID:5280
- C:\Windows\System\oUMhTKN.exe
  C:\Windows\System\oUMhTKN.exe
  2⤵
  PID:5296
- C:\Windows\System\HSiqADA.exe
  C:\Windows\System\HSiqADA.exe
  2⤵
  PID:5312
- C:\Windows\System\THxSjEK.exe
  C:\Windows\System\THxSjEK.exe
  2⤵
  PID:5328
- C:\Windows\System\OYGNVXm.exe
  C:\Windows\System\OYGNVXm.exe
  2⤵
  PID:5344
- C:\Windows\System\VBDrkiA.exe
  C:\Windows\System\VBDrkiA.exe
  2⤵
  PID:5360
- C:\Windows\System\mdPVNah.exe
  C:\Windows\System\mdPVNah.exe
  2⤵
  PID:5376
- C:\Windows\System\EKdLtrW.exe
  C:\Windows\System\EKdLtrW.exe
  2⤵
  PID:5392
- C:\Windows\System\XMGkMSy.exe
  C:\Windows\System\XMGkMSy.exe
  2⤵
  PID:5408
- C:\Windows\System\NhRHITb.exe
  C:\Windows\System\NhRHITb.exe
  2⤵
  PID:5424
- C:\Windows\System\eTgyLuu.exe
  C:\Windows\System\eTgyLuu.exe
  2⤵
  PID:5440
- C:\Windows\System\eaoLZkU.exe
  C:\Windows\System\eaoLZkU.exe
  2⤵
  PID:5456
- C:\Windows\System\KThejfb.exe
  C:\Windows\System\KThejfb.exe
  2⤵
  PID:5472
- C:\Windows\System\ZWDexlP.exe
  C:\Windows\System\ZWDexlP.exe
  2⤵
  PID:5488
- C:\Windows\System\hTwwWpT.exe
  C:\Windows\System\hTwwWpT.exe
  2⤵
  PID:5504
- C:\Windows\System\GHRsHMT.exe
  C:\Windows\System\GHRsHMT.exe
  2⤵
  PID:5520
- C:\Windows\System\RdxzZtc.exe
  C:\Windows\System\RdxzZtc.exe
  2⤵
  PID:5536
- C:\Windows\System\wYHTpBw.exe
  C:\Windows\System\wYHTpBw.exe
  2⤵
  PID:5552
- C:\Windows\System\aTJIEPS.exe
  C:\Windows\System\aTJIEPS.exe
  2⤵
  PID:5568
- C:\Windows\System\LegdIei.exe
  C:\Windows\System\LegdIei.exe
  2⤵
  PID:5584
- C:\Windows\System\BtOVKjN.exe
  C:\Windows\System\BtOVKjN.exe
  2⤵
  PID:5600
- C:\Windows\System\sStuoKe.exe
  C:\Windows\System\sStuoKe.exe
  2⤵
  PID:5616
- C:\Windows\System\enBCYke.exe
  C:\Windows\System\enBCYke.exe
  2⤵
  PID:5632
- C:\Windows\System\QFtpLMT.exe
  C:\Windows\System\QFtpLMT.exe
  2⤵
  PID:5648
- C:\Windows\System\XzSsRzp.exe
  C:\Windows\System\XzSsRzp.exe
  2⤵
  PID:5664
- C:\Windows\System\rDxoGmI.exe
  C:\Windows\System\rDxoGmI.exe
  2⤵
  PID:5680
- C:\Windows\System\pxPyHMP.exe
  C:\Windows\System\pxPyHMP.exe
  2⤵
  PID:5696
- C:\Windows\System\cfOFYnB.exe
  C:\Windows\System\cfOFYnB.exe
  2⤵
  PID:5712
- C:\Windows\System\EiSfPuo.exe
  C:\Windows\System\EiSfPuo.exe
  2⤵
  PID:5728
- C:\Windows\System\cdYVGGo.exe
  C:\Windows\System\cdYVGGo.exe
  2⤵
  PID:5744
- C:\Windows\System\EFZKAbN.exe
  C:\Windows\System\EFZKAbN.exe
  2⤵
  PID:5760
- C:\Windows\System\fBTPZBd.exe
  C:\Windows\System\fBTPZBd.exe
  2⤵
  PID:5776
- C:\Windows\System\eXMItJa.exe
  C:\Windows\System\eXMItJa.exe
  2⤵
  PID:5792
- C:\Windows\System\ZRrYKYX.exe
  C:\Windows\System\ZRrYKYX.exe
  2⤵
  PID:5808
- C:\Windows\System\EazZwzJ.exe
  C:\Windows\System\EazZwzJ.exe
  2⤵
  PID:5824
- C:\Windows\System\WBdTuJN.exe
  C:\Windows\System\WBdTuJN.exe
  2⤵
  PID:5840
- C:\Windows\System\CtHZTEk.exe
  C:\Windows\System\CtHZTEk.exe
  2⤵
  PID:5856
- C:\Windows\System\XdrQUah.exe
  C:\Windows\System\XdrQUah.exe
  2⤵
  PID:5872
- C:\Windows\System\FccJtqM.exe
  C:\Windows\System\FccJtqM.exe
  2⤵
  PID:5888
- C:\Windows\System\kbqsSKv.exe
  C:\Windows\System\kbqsSKv.exe
  2⤵
  PID:5904
- C:\Windows\System\wcNhHTz.exe
  C:\Windows\System\wcNhHTz.exe
  2⤵
  PID:5920
- C:\Windows\System\lYwkRgi.exe
  C:\Windows\System\lYwkRgi.exe
  2⤵
  PID:5936
- C:\Windows\System\qhOosNF.exe
  C:\Windows\System\qhOosNF.exe
  2⤵
  PID:5952
- C:\Windows\System\ysfjxXN.exe
  C:\Windows\System\ysfjxXN.exe
  2⤵
  PID:5968
- C:\Windows\System\ckdtrlf.exe
  C:\Windows\System\ckdtrlf.exe
  2⤵
  PID:5984
- C:\Windows\System\AXUNoxY.exe
  C:\Windows\System\AXUNoxY.exe
  2⤵
  PID:6000
- C:\Windows\System\CJwdliy.exe
  C:\Windows\System\CJwdliy.exe
  2⤵
  PID:6016
- C:\Windows\System\RGwymMX.exe
  C:\Windows\System\RGwymMX.exe
  2⤵
  PID:6032
- C:\Windows\System\gnIMDVb.exe
  C:\Windows\System\gnIMDVb.exe
  2⤵
  PID:6048
- C:\Windows\System\ocCzOqH.exe
  C:\Windows\System\ocCzOqH.exe
  2⤵
  PID:6064
- C:\Windows\System\QQKkiyZ.exe
  C:\Windows\System\QQKkiyZ.exe
  2⤵
  PID:6080
- C:\Windows\System\nDzDePu.exe
  C:\Windows\System\nDzDePu.exe
  2⤵
  PID:6096
- C:\Windows\System\fzzQuPY.exe
  C:\Windows\System\fzzQuPY.exe
  2⤵
  PID:6112
- C:\Windows\System\hskTeWn.exe
  C:\Windows\System\hskTeWn.exe
  2⤵
  PID:6128
- C:\Windows\System\OGpBieJ.exe
  C:\Windows\System\OGpBieJ.exe
  2⤵
  PID:4552
- C:\Windows\System\zydLFuQ.exe
  C:\Windows\System\zydLFuQ.exe
  2⤵
  PID:4836
- C:\Windows\System\GqyDJtM.exe
  C:\Windows\System\GqyDJtM.exe
  2⤵
  PID:5164
- C:\Windows\System\oKPTEzC.exe
  C:\Windows\System\oKPTEzC.exe
  2⤵
  PID:5228
- C:\Windows\System\KkoFQtd.exe
  C:\Windows\System\KkoFQtd.exe
  2⤵
  PID:5260
- C:\Windows\System\RmCiCXw.exe
  C:\Windows\System\RmCiCXw.exe
  2⤵
  PID:5324
- C:\Windows\System\JvZfCCa.exe
  C:\Windows\System\JvZfCCa.exe
  2⤵
  PID:5420
- C:\Windows\System\fSxUEEG.exe
  C:\Windows\System\fSxUEEG.exe
  2⤵
  PID:5484
- C:\Windows\System\BMDwOpE.exe
  C:\Windows\System\BMDwOpE.exe
  2⤵
  PID:4628
- C:\Windows\System\kuBfCch.exe
  C:\Windows\System\kuBfCch.exe
  2⤵
  PID:5368
- C:\Windows\System\VouGYyn.exe
  C:\Windows\System\VouGYyn.exe
  2⤵
  PID:5496
- C:\Windows\System\cujuuIA.exe
  C:\Windows\System\cujuuIA.exe
  2⤵
  PID:4968
- C:\Windows\System\UrfCvcR.exe
  C:\Windows\System\UrfCvcR.exe
  2⤵
  PID:5548
- C:\Windows\System\GcqVnjx.exe
  C:\Windows\System\GcqVnjx.exe
  2⤵
  PID:5212
- C:\Windows\System\XxsTVEg.exe
  C:\Windows\System\XxsTVEg.exe
  2⤵
  PID:5176
- C:\Windows\System\FGRuijO.exe
  C:\Windows\System\FGRuijO.exe
  2⤵
  PID:5092
- C:\Windows\System\AyeepNq.exe
  C:\Windows\System\AyeepNq.exe
  2⤵
  PID:5028
- C:\Windows\System\FqJWFhA.exe
  C:\Windows\System\FqJWFhA.exe
  2⤵
  PID:4984
- C:\Windows\System\yKyGZnN.exe
  C:\Windows\System\yKyGZnN.exe
  2⤵
  PID:5640
- C:\Windows\System\gpGRNwN.exe
  C:\Windows\System\gpGRNwN.exe
  2⤵
  PID:5532
- C:\Windows\System\jQjfBtm.exe
  C:\Windows\System\jQjfBtm.exe
  2⤵
  PID:5740
- C:\Windows\System\xgyPPqC.exe
  C:\Windows\System\xgyPPqC.exe
  2⤵
  PID:5804
- C:\Windows\System\oydSpZq.exe
  C:\Windows\System\oydSpZq.exe
  2⤵
  PID:5836
- C:\Windows\System\ktZApLT.exe
  C:\Windows\System\ktZApLT.exe
  2⤵
  PID:5308
- C:\Windows\System\VFzGwzY.exe
  C:\Windows\System\VFzGwzY.exe
  2⤵
  PID:5432
- C:\Windows\System\vogXHin.exe
  C:\Windows\System\vogXHin.exe
  2⤵
  PID:5928
- C:\Windows\System\JkXoqDZ.exe
  C:\Windows\System\JkXoqDZ.exe
  2⤵
  PID:5992
- C:\Windows\System\fMfYquT.exe
  C:\Windows\System\fMfYquT.exe
  2⤵
  PID:6056
- C:\Windows\System\hAaMfFN.exe
  C:\Windows\System\hAaMfFN.exe
  2⤵
  PID:4676
- C:\Windows\System\xnyVwsN.exe
  C:\Windows\System\xnyVwsN.exe
  2⤵
  PID:4520
- C:\Windows\System\Qnlyvxu.exe
  C:\Windows\System\Qnlyvxu.exe
  2⤵
  PID:6092
- C:\Windows\System\VMqMZxK.exe
  C:\Windows\System\VMqMZxK.exe
  2⤵
  PID:4792
- C:\Windows\System\SaFaQeN.exe
  C:\Windows\System\SaFaQeN.exe
  2⤵
  PID:5224
- C:\Windows\System\AjCHIpt.exe
  C:\Windows\System\AjCHIpt.exe
  2⤵
  PID:5480
- C:\Windows\System\wUKKbgq.exe
  C:\Windows\System\wUKKbgq.exe
  2⤵
  PID:5276
- C:\Windows\System\GOViqkX.exe
  C:\Windows\System\GOViqkX.exe
  2⤵
  PID:5208
- C:\Windows\System\alpInCI.exe
  C:\Windows\System\alpInCI.exe
  2⤵
  PID:4740
- C:\Windows\System\EvUhbsZ.exe
  C:\Windows\System\EvUhbsZ.exe
  2⤵
  PID:5912
- C:\Windows\System\yzbqryw.exe
  C:\Windows\System\yzbqryw.exe
  2⤵
  PID:5976
- C:\Windows\System\hHnbjKG.exe
  C:\Windows\System\hHnbjKG.exe
  2⤵
  PID:5672
- C:\Windows\System\xYzXxQY.exe
  C:\Windows\System\xYzXxQY.exe
  2⤵
  PID:5896
- C:\Windows\System\LEzUGUv.exe
  C:\Windows\System\LEzUGUv.exe
  2⤵
  PID:6028
- C:\Windows\System\gKPmUok.exe
  C:\Windows\System\gKPmUok.exe
  2⤵
  PID:4308
- C:\Windows\System\mkDrGdo.exe
  C:\Windows\System\mkDrGdo.exe
  2⤵
  PID:5080
- C:\Windows\System\fhtpYcw.exe
  C:\Windows\System\fhtpYcw.exe
  2⤵
  PID:5884
- C:\Windows\System\RoSJeGu.exe
  C:\Windows\System\RoSJeGu.exe
  2⤵
  PID:6024
- C:\Windows\System\hqhTvqZ.exe
  C:\Windows\System\hqhTvqZ.exe
  2⤵
  PID:6076
- C:\Windows\System\zbNHqhg.exe
  C:\Windows\System\zbNHqhg.exe
  2⤵
  PID:6160
- C:\Windows\System\FjeTzsE.exe
  C:\Windows\System\FjeTzsE.exe
  2⤵
  PID:6176
- C:\Windows\System\FlbTbzX.exe
  C:\Windows\System\FlbTbzX.exe
  2⤵
  PID:6192
- C:\Windows\System\hdbFzKs.exe
  C:\Windows\System\hdbFzKs.exe
  2⤵
  PID:6208
- C:\Windows\System\LsVdGzR.exe
  C:\Windows\System\LsVdGzR.exe
  2⤵
  PID:6224
- C:\Windows\System\ZGkspux.exe
  C:\Windows\System\ZGkspux.exe
  2⤵
  PID:6240
- C:\Windows\System\KpztCCC.exe
  C:\Windows\System\KpztCCC.exe
  2⤵
  PID:6256
- C:\Windows\System\bhmlLCF.exe
  C:\Windows\System\bhmlLCF.exe
  2⤵
  PID:6272
- C:\Windows\System\BhRqGbT.exe
  C:\Windows\System\BhRqGbT.exe
  2⤵
  PID:6288
- C:\Windows\System\OcafrjN.exe
  C:\Windows\System\OcafrjN.exe
  2⤵
  PID:6304
- C:\Windows\System\xknnuTW.exe
  C:\Windows\System\xknnuTW.exe
  2⤵
  PID:6320
- C:\Windows\System\PgSRJZO.exe
  C:\Windows\System\PgSRJZO.exe
  2⤵
  PID:6336
- C:\Windows\System\DivVYVz.exe
  C:\Windows\System\DivVYVz.exe
  2⤵
  PID:6352
- C:\Windows\System\rTgFHji.exe
  C:\Windows\System\rTgFHji.exe
  2⤵
  PID:6368
- C:\Windows\System\lJtTbcz.exe
  C:\Windows\System\lJtTbcz.exe
  2⤵
  PID:6384
- C:\Windows\System\cBdIPDQ.exe
  C:\Windows\System\cBdIPDQ.exe
  2⤵
  PID:6400
- C:\Windows\System\CPZdQnX.exe
  C:\Windows\System\CPZdQnX.exe
  2⤵
  PID:6416
- C:\Windows\System\TsnnRcf.exe
  C:\Windows\System\TsnnRcf.exe
  2⤵
  PID:6432
- C:\Windows\System\rOEOABI.exe
  C:\Windows\System\rOEOABI.exe
  2⤵
  PID:6448
- C:\Windows\System\xlcravs.exe
  C:\Windows\System\xlcravs.exe
  2⤵
  PID:6464
- C:\Windows\System\qFygvJW.exe
  C:\Windows\System\qFygvJW.exe
  2⤵
  PID:6480
- C:\Windows\System\KIkGvBb.exe
  C:\Windows\System\KIkGvBb.exe
  2⤵
  PID:6496
- C:\Windows\System\XClMowv.exe
  C:\Windows\System\XClMowv.exe
  2⤵
  PID:6512
- C:\Windows\System\HLLKTtM.exe
  C:\Windows\System\HLLKTtM.exe
  2⤵
  PID:6528
- C:\Windows\System\qneIzdj.exe
  C:\Windows\System\qneIzdj.exe
  2⤵
  PID:6544
- C:\Windows\System\SlEhPQo.exe
  C:\Windows\System\SlEhPQo.exe
  2⤵
  PID:6560
- C:\Windows\System\zZwXGBj.exe
  C:\Windows\System\zZwXGBj.exe
  2⤵
  PID:6576
- C:\Windows\System\XcVLbDl.exe
  C:\Windows\System\XcVLbDl.exe
  2⤵
  PID:6592
- C:\Windows\System\RgHOwsv.exe
  C:\Windows\System\RgHOwsv.exe
  2⤵
  PID:6608
- C:\Windows\System\jJPqisq.exe
  C:\Windows\System\jJPqisq.exe
  2⤵
  PID:6624
- C:\Windows\System\gQfbUqj.exe
  C:\Windows\System\gQfbUqj.exe
  2⤵
  PID:6644
- C:\Windows\System\UyRrxgF.exe
  C:\Windows\System\UyRrxgF.exe
  2⤵
  PID:6660
- C:\Windows\System\FRflcsm.exe
  C:\Windows\System\FRflcsm.exe
  2⤵
  PID:6676
- C:\Windows\System\hRuZucR.exe
  C:\Windows\System\hRuZucR.exe
  2⤵
  PID:6692
- C:\Windows\System\qzPqcaD.exe
  C:\Windows\System\qzPqcaD.exe
  2⤵
  PID:6708
- C:\Windows\System\AuaIAWu.exe
  C:\Windows\System\AuaIAWu.exe
  2⤵
  PID:6724
- C:\Windows\System\lNZVhNA.exe
  C:\Windows\System\lNZVhNA.exe
  2⤵
  PID:6740
- C:\Windows\System\MtlWJTL.exe
  C:\Windows\System\MtlWJTL.exe
  2⤵
  PID:6756
- C:\Windows\System\aBknLxt.exe
  C:\Windows\System\aBknLxt.exe
  2⤵
  PID:6772
- C:\Windows\System\QFDfZFC.exe
  C:\Windows\System\QFDfZFC.exe
  2⤵
  PID:6788
- C:\Windows\System\PbomGtg.exe
  C:\Windows\System\PbomGtg.exe
  2⤵
  PID:6804
- C:\Windows\System\dSCMCWQ.exe
  C:\Windows\System\dSCMCWQ.exe
  2⤵
  PID:6820
- C:\Windows\System\WaGjeay.exe
  C:\Windows\System\WaGjeay.exe
  2⤵
  PID:6836
- C:\Windows\System\MKVFFGt.exe
  C:\Windows\System\MKVFFGt.exe
  2⤵
  PID:6852
- C:\Windows\System\wUtzpQZ.exe
  C:\Windows\System\wUtzpQZ.exe
  2⤵
  PID:6868
- C:\Windows\System\GKNeZVs.exe
  C:\Windows\System\GKNeZVs.exe
  2⤵
  PID:6884
- C:\Windows\System\mywQLMi.exe
  C:\Windows\System\mywQLMi.exe
  2⤵
  PID:6900
- C:\Windows\System\oyzdsDX.exe
  C:\Windows\System\oyzdsDX.exe
  2⤵
  PID:6916
- C:\Windows\System\VhHuTwr.exe
  C:\Windows\System\VhHuTwr.exe
  2⤵
  PID:6932
- C:\Windows\System\ZswOxQr.exe
  C:\Windows\System\ZswOxQr.exe
  2⤵
  PID:6948
- C:\Windows\System\laOXdwD.exe
  C:\Windows\System\laOXdwD.exe
  2⤵
  PID:6964
- C:\Windows\System\seKICaB.exe
  C:\Windows\System\seKICaB.exe
  2⤵
  PID:6980
- C:\Windows\System\PVLDtcf.exe
  C:\Windows\System\PVLDtcf.exe
  2⤵
  PID:6996
- C:\Windows\System\QllXezx.exe
  C:\Windows\System\QllXezx.exe
  2⤵
  PID:7012
- C:\Windows\System\TrmZHaH.exe
  C:\Windows\System\TrmZHaH.exe
  2⤵
  PID:7028
- C:\Windows\System\VVCnBRs.exe
  C:\Windows\System\VVCnBRs.exe
  2⤵
  PID:7044
- C:\Windows\System\SDlpsju.exe
  C:\Windows\System\SDlpsju.exe
  2⤵
  PID:7060
- C:\Windows\System\ZeUMnpd.exe
  C:\Windows\System\ZeUMnpd.exe
  2⤵
  PID:7076
- C:\Windows\System\cLZrmap.exe
  C:\Windows\System\cLZrmap.exe
  2⤵
  PID:7092
- C:\Windows\System\GAGLsTb.exe
  C:\Windows\System\GAGLsTb.exe
  2⤵
  PID:7108
- C:\Windows\System\rJBXSBl.exe
  C:\Windows\System\rJBXSBl.exe
  2⤵
  PID:7124
- C:\Windows\System\qttuMbg.exe
  C:\Windows\System\qttuMbg.exe
  2⤵
  PID:7140
- C:\Windows\System\uoTbDLd.exe
  C:\Windows\System\uoTbDLd.exe
  2⤵
  PID:7156
- C:\Windows\System\ZzlSmbn.exe
  C:\Windows\System\ZzlSmbn.exe
  2⤵
  PID:6012
- C:\Windows\System\WUYyVlV.exe
  C:\Windows\System\WUYyVlV.exe
  2⤵
  PID:6184
- C:\Windows\System\wivVnsK.exe
  C:\Windows\System\wivVnsK.exe
  2⤵
  PID:6108
- C:\Windows\System\PYRocvH.exe
  C:\Windows\System\PYRocvH.exe
  2⤵
  PID:5132
- C:\Windows\System\YVJdABs.exe
  C:\Windows\System\YVJdABs.exe
  2⤵
  PID:6284
- C:\Windows\System\WoTYiln.exe
  C:\Windows\System\WoTYiln.exe
  2⤵
  PID:6344
- C:\Windows\System\ZPRmZwm.exe
  C:\Windows\System\ZPRmZwm.exe
  2⤵
  PID:6408
- C:\Windows\System\NxXvEYB.exe
  C:\Windows\System\NxXvEYB.exe
  2⤵
  PID:6472
- C:\Windows\System\jHMfZZj.exe
  C:\Windows\System\jHMfZZj.exe
  2⤵
  PID:6540
- C:\Windows\System\NCBuKRj.exe
  C:\Windows\System\NCBuKRj.exe
  2⤵
  PID:5596
- C:\Windows\System\ZSdduEl.exe
  C:\Windows\System\ZSdduEl.exe
  2⤵
  PID:5244
- C:\Windows\System\eiPCkQS.exe
  C:\Windows\System\eiPCkQS.exe
  2⤵
  PID:6332
- C:\Windows\System\CTghlPT.exe
  C:\Windows\System\CTghlPT.exe
  2⤵
  PID:6396
- C:\Windows\System\gFeRJLQ.exe
  C:\Windows\System\gFeRJLQ.exe
  2⤵
  PID:6492
- C:\Windows\System\owYcmPD.exe
  C:\Windows\System\owYcmPD.exe
  2⤵
  PID:4680
- C:\Windows\System\thnBamx.exe
  C:\Windows\System\thnBamx.exe
  2⤵
  PID:5788
- C:\Windows\System\bMGKbdl.exe
  C:\Windows\System\bMGKbdl.exe
  2⤵
  PID:5852
- C:\Windows\System\GZCaCJe.exe
  C:\Windows\System\GZCaCJe.exe
  2⤵
  PID:6552
- C:\Windows\System\zJMkdzA.exe
  C:\Windows\System\zJMkdzA.exe
  2⤵
  PID:5356
- C:\Windows\System\oTsmXUN.exe
  C:\Windows\System\oTsmXUN.exe
  2⤵
  PID:5400
- C:\Windows\System\WLuufRq.exe
  C:\Windows\System\WLuufRq.exe
  2⤵
  PID:4536
- C:\Windows\System\tBnnuKq.exe
  C:\Windows\System\tBnnuKq.exe
  2⤵
  PID:6268
- C:\Windows\System\OhPMGkg.exe
  C:\Windows\System\OhPMGkg.exe
  2⤵
  PID:6204
- C:\Windows\System\UtxlOSJ.exe
  C:\Windows\System\UtxlOSJ.exe
  2⤵
  PID:6040
- C:\Windows\System\vfIQvEm.exe
  C:\Windows\System\vfIQvEm.exe
  2⤵
  PID:5800
- C:\Windows\System\IrOAzCm.exe
  C:\Windows\System\IrOAzCm.exe
  2⤵
  PID:5692
- C:\Windows\System\VIOihve.exe
  C:\Windows\System\VIOihve.exe
  2⤵
  PID:5624
- C:\Windows\System\agmseId.exe
  C:\Windows\System\agmseId.exe
  2⤵
  PID:5404
- C:\Windows\System\QgUhHUF.exe
  C:\Windows\System\QgUhHUF.exe
  2⤵
  PID:6072
- C:\Windows\System\HDqasHa.exe
  C:\Windows\System\HDqasHa.exe
  2⤵
  PID:5708
- C:\Windows\System\zvMdzrE.exe
  C:\Windows\System\zvMdzrE.exe
  2⤵
  PID:6668
- C:\Windows\System\pysxGyz.exe
  C:\Windows\System\pysxGyz.exe
  2⤵
  PID:6732
- C:\Windows\System\LYUtLyz.exe
  C:\Windows\System\LYUtLyz.exe
  2⤵
  PID:6652
- C:\Windows\System\PPWkEaQ.exe
  C:\Windows\System\PPWkEaQ.exe
  2⤵
  PID:6716
- C:\Windows\System\ZiqFRIG.exe
  C:\Windows\System\ZiqFRIG.exe
  2⤵
  PID:6780
- C:\Windows\System\JkfEvhN.exe
  C:\Windows\System\JkfEvhN.exe
  2⤵
  PID:6832
- C:\Windows\System\tVLVDZs.exe
  C:\Windows\System\tVLVDZs.exe
  2⤵
  PID:6896
- C:\Windows\System\OCqetvb.exe
  C:\Windows\System\OCqetvb.exe
  2⤵
  PID:6960
- C:\Windows\System\rqEytLv.exe
  C:\Windows\System\rqEytLv.exe
  2⤵
  PID:6988
- C:\Windows\System\bAmfXYz.exe
  C:\Windows\System\bAmfXYz.exe
  2⤵
  PID:7052
- C:\Windows\System\ZKvqxsm.exe
  C:\Windows\System\ZKvqxsm.exe
  2⤵
  PID:6844
- C:\Windows\System\oDGopLU.exe
  C:\Windows\System\oDGopLU.exe
  2⤵
  PID:6908
- C:\Windows\System\vxlqWpm.exe
  C:\Windows\System\vxlqWpm.exe
  2⤵
  PID:6784
- C:\Windows\System\RVGhsNG.exe
  C:\Windows\System\RVGhsNG.exe
  2⤵
  PID:7036
- C:\Windows\System\ifDVFKv.exe
  C:\Windows\System\ifDVFKv.exe
  2⤵
  PID:7100
- C:\Windows\System\RxOvgWE.exe
  C:\Windows\System\RxOvgWE.exe
  2⤵
  PID:7148
- C:\Windows\System\fpVeCEo.exe
  C:\Windows\System\fpVeCEo.exe
  2⤵
  PID:6136
- C:\Windows\System\SnWPCkm.exe
  C:\Windows\System\SnWPCkm.exe
  2⤵
  PID:6440
- C:\Windows\System\ZJelzSg.exe
  C:\Windows\System\ZJelzSg.exe
  2⤵
  PID:5608
- C:\Windows\System\gAJfGkv.exe
  C:\Windows\System\gAJfGkv.exe
  2⤵
  PID:5756
- C:\Windows\System\foseYbH.exe
  C:\Windows\System\foseYbH.exe
  2⤵
  PID:5516
- C:\Windows\System\XurQNJV.exe
  C:\Windows\System\XurQNJV.exe
  2⤵
  PID:6168
- C:\Windows\System\zIzBCgz.exe
  C:\Windows\System\zIzBCgz.exe
  2⤵
  PID:6504
- C:\Windows\System\RxKIvyn.exe
  C:\Windows\System\RxKIvyn.exe
  2⤵
  PID:6364
- C:\Windows\System\ImnEkvD.exe
  C:\Windows\System\ImnEkvD.exe
  2⤵
  PID:5820
- C:\Windows\System\qEkVMEg.exe
  C:\Windows\System\qEkVMEg.exe
  2⤵
  PID:6616
- C:\Windows\System\RgQVzik.exe
  C:\Windows\System\RgQVzik.exe
  2⤵
  PID:4472
- C:\Windows\System\huADbxg.exe
  C:\Windows\System\huADbxg.exe
  2⤵
  PID:6380
- C:\Windows\System\tHiRmTA.exe
  C:\Windows\System\tHiRmTA.exe
  2⤵
  PID:6104
- C:\Windows\System\GmmDpyU.exe
  C:\Windows\System\GmmDpyU.exe
  2⤵
  PID:7164
- C:\Windows\System\SkZsNrQ.exe
  C:\Windows\System\SkZsNrQ.exe
  2⤵
  PID:5960
- C:\Windows\System\OutgwvK.exe
  C:\Windows\System\OutgwvK.exe
  2⤵
  PID:6704
- C:\Windows\System\rmbNrsL.exe
  C:\Windows\System\rmbNrsL.exe
  2⤵
  PID:6828
- C:\Windows\System\bkQdKNO.exe
  C:\Windows\System\bkQdKNO.exe
  2⤵
  PID:6640
- C:\Windows\System\zxbyIqt.exe
  C:\Windows\System\zxbyIqt.exe
  2⤵
  PID:6752
- C:\Windows\System\ELOQSVo.exe
  C:\Windows\System\ELOQSVo.exe
  2⤵
  PID:6864
- C:\Windows\System\uLReYAG.exe
  C:\Windows\System\uLReYAG.exe
  2⤵
  PID:6876
- C:\Windows\System\Pnmjcqz.exe
  C:\Windows\System\Pnmjcqz.exe
  2⤵
  PID:6976
- C:\Windows\System\fXLZGwe.exe
  C:\Windows\System\fXLZGwe.exe
  2⤵
  PID:6460
- C:\Windows\System\SJXwdde.exe
  C:\Windows\System\SJXwdde.exe
  2⤵
  PID:6456
- C:\Windows\System\LtLFkOW.exe
  C:\Windows\System\LtLFkOW.exe
  2⤵
  PID:6152
- C:\Windows\System\MLHQwwG.exe
  C:\Windows\System\MLHQwwG.exe
  2⤵
  PID:6156
- C:\Windows\System\hNRLeTJ.exe
  C:\Windows\System\hNRLeTJ.exe
  2⤵
  PID:7008
- C:\Windows\System\EeudDkS.exe
  C:\Windows\System\EeudDkS.exe
  2⤵
  PID:5240
- C:\Windows\System\vnICqyM.exe
  C:\Windows\System\vnICqyM.exe
  2⤵
  PID:6232
- C:\Windows\System\EtKLGEp.exe
  C:\Windows\System\EtKLGEp.exe
  2⤵
  PID:6220
- C:\Windows\System\vhaVFUW.exe
  C:\Windows\System\vhaVFUW.exe
  2⤵
  PID:5880
- C:\Windows\System\isMWhci.exe
  C:\Windows\System\isMWhci.exe
  2⤵
  PID:6688
- C:\Windows\System\upCxJNV.exe
  C:\Windows\System\upCxJNV.exe
  2⤵
  PID:6636
- C:\Windows\System\wUZAuQJ.exe
  C:\Windows\System\wUZAuQJ.exe
  2⤵
  PID:6536
- C:\Windows\System\DXQxGuO.exe
  C:\Windows\System\DXQxGuO.exe
  2⤵
  PID:6768
- C:\Windows\System\tCosSnK.exe
  C:\Windows\System\tCosSnK.exe
  2⤵
  PID:6880
- C:\Windows\System\DpGmiyj.exe
  C:\Windows\System\DpGmiyj.exe
  2⤵
  PID:5512
- C:\Windows\System\DteQYpt.exe
  C:\Windows\System\DteQYpt.exe
  2⤵
  PID:4532
- C:\Windows\System\TQkGOcH.exe
  C:\Windows\System\TQkGOcH.exe
  2⤵
  PID:5736
- C:\Windows\System\atOfMmK.exe
  C:\Windows\System\atOfMmK.exe
  2⤵
  PID:6316
- C:\Windows\System\MiIrQMe.exe
  C:\Windows\System\MiIrQMe.exe
  2⤵
  PID:7180
- C:\Windows\System\AORfWJo.exe
  C:\Windows\System\AORfWJo.exe
  2⤵
  PID:7196
- C:\Windows\System\fzGjCoQ.exe
  C:\Windows\System\fzGjCoQ.exe
  2⤵
  PID:7212
- C:\Windows\System\ppTTocf.exe
  C:\Windows\System\ppTTocf.exe
  2⤵
  PID:7228
- C:\Windows\System\ofQWFLz.exe
  C:\Windows\System\ofQWFLz.exe
  2⤵
  PID:7244
- C:\Windows\System\PEFXMNk.exe
  C:\Windows\System\PEFXMNk.exe
  2⤵
  PID:7260
- C:\Windows\System\ElTaBGE.exe
  C:\Windows\System\ElTaBGE.exe
  2⤵
  PID:7276
- C:\Windows\System\DjXZRIp.exe
  C:\Windows\System\DjXZRIp.exe
  2⤵
  PID:7292
- C:\Windows\System\sOYpwYd.exe
  C:\Windows\System\sOYpwYd.exe
  2⤵
  PID:7308
- C:\Windows\System\FSCmpml.exe
  C:\Windows\System\FSCmpml.exe
  2⤵
  PID:7324
- C:\Windows\System\nPJFpfB.exe
  C:\Windows\System\nPJFpfB.exe
  2⤵
  PID:7340
- C:\Windows\System\NrcSlcg.exe
  C:\Windows\System\NrcSlcg.exe
  2⤵
  PID:7356
- C:\Windows\System\RXxQYEq.exe
  C:\Windows\System\RXxQYEq.exe
  2⤵
  PID:7372
- C:\Windows\System\daZDYqP.exe
  C:\Windows\System\daZDYqP.exe
  2⤵
  PID:7388
- C:\Windows\System\uWPLEFp.exe
  C:\Windows\System\uWPLEFp.exe
  2⤵
  PID:7404
- C:\Windows\System\BPORQNW.exe
  C:\Windows\System\BPORQNW.exe
  2⤵
  PID:7420
- C:\Windows\System\jxyEPNs.exe
  C:\Windows\System\jxyEPNs.exe
  2⤵
  PID:7436
- C:\Windows\System\vagWpYn.exe
  C:\Windows\System\vagWpYn.exe
  2⤵
  PID:7452
- C:\Windows\System\fSVuMRf.exe
  C:\Windows\System\fSVuMRf.exe
  2⤵
  PID:7468
- C:\Windows\System\tGRpcLG.exe
  C:\Windows\System\tGRpcLG.exe
  2⤵
  PID:7484
- C:\Windows\System\prMXPCd.exe
  C:\Windows\System\prMXPCd.exe
  2⤵
  PID:7500
- C:\Windows\System\GwEcyed.exe
  C:\Windows\System\GwEcyed.exe
  2⤵
  PID:7520
- C:\Windows\System\XudtNuL.exe
  C:\Windows\System\XudtNuL.exe
  2⤵
  PID:7536
- C:\Windows\System\AfoZSOE.exe
  C:\Windows\System\AfoZSOE.exe
  2⤵
  PID:7552
- C:\Windows\System\hgoTaqf.exe
  C:\Windows\System\hgoTaqf.exe
  2⤵
  PID:7568
- C:\Windows\System\VIxticb.exe
  C:\Windows\System\VIxticb.exe
  2⤵
  PID:7584
- C:\Windows\System\zIErWxw.exe
  C:\Windows\System\zIErWxw.exe
  2⤵
  PID:7600
- C:\Windows\System\vemAOtZ.exe
  C:\Windows\System\vemAOtZ.exe
  2⤵
  PID:7616
- C:\Windows\System\gLUIbfs.exe
  C:\Windows\System\gLUIbfs.exe
  2⤵
  PID:7632
- C:\Windows\System\ixLbgug.exe
  C:\Windows\System\ixLbgug.exe
  2⤵
  PID:7648
- C:\Windows\System\hcDDbfO.exe
  C:\Windows\System\hcDDbfO.exe
  2⤵
  PID:7664
- C:\Windows\System\gdNAxrb.exe
  C:\Windows\System\gdNAxrb.exe
  2⤵
  PID:7680
- C:\Windows\System\gUveFdg.exe
  C:\Windows\System\gUveFdg.exe
  2⤵
  PID:7696
- C:\Windows\System\MFyIezG.exe
  C:\Windows\System\MFyIezG.exe
  2⤵
  PID:7712
- C:\Windows\System\OTzhcOo.exe
  C:\Windows\System\OTzhcOo.exe
  2⤵
  PID:7728
- C:\Windows\System\AUnIWgN.exe
  C:\Windows\System\AUnIWgN.exe
  2⤵
  PID:7744
- C:\Windows\System\TfMtaBy.exe
  C:\Windows\System\TfMtaBy.exe
  2⤵
  PID:7760
- C:\Windows\System\FDMJbxq.exe
  C:\Windows\System\FDMJbxq.exe
  2⤵
  PID:7776
- C:\Windows\System\CPMVXHo.exe
  C:\Windows\System\CPMVXHo.exe
  2⤵
  PID:7792
- C:\Windows\System\CgrYCIH.exe
  C:\Windows\System\CgrYCIH.exe
  2⤵
  PID:7808
- C:\Windows\System\gPIepJO.exe
  C:\Windows\System\gPIepJO.exe
  2⤵
  PID:7824
- C:\Windows\System\DmOihsV.exe
  C:\Windows\System\DmOihsV.exe
  2⤵
  PID:7840
- C:\Windows\System\dIDtWBb.exe
  C:\Windows\System\dIDtWBb.exe
  2⤵
  PID:7856
- C:\Windows\System\VQkOvJl.exe
  C:\Windows\System\VQkOvJl.exe
  2⤵
  PID:7872
- C:\Windows\System\XirXehV.exe
  C:\Windows\System\XirXehV.exe
  2⤵
  PID:7888
- C:\Windows\System\HjBHPLU.exe
  C:\Windows\System\HjBHPLU.exe
  2⤵
  PID:7904
- C:\Windows\System\RLekyoG.exe
  C:\Windows\System\RLekyoG.exe
  2⤵
  PID:7920
- C:\Windows\System\rPCussB.exe
  C:\Windows\System\rPCussB.exe
  2⤵
  PID:7936
- C:\Windows\System\dkYdOlH.exe
  C:\Windows\System\dkYdOlH.exe
  2⤵
  PID:7952
- C:\Windows\System\JcHlcQx.exe
  C:\Windows\System\JcHlcQx.exe
  2⤵
  PID:7968
- C:\Windows\System\jRMcvwH.exe
  C:\Windows\System\jRMcvwH.exe
  2⤵
  PID:7984
- C:\Windows\System\rULQdkX.exe
  C:\Windows\System\rULQdkX.exe
  2⤵
  PID:8000
- C:\Windows\System\wGoPjpR.exe
  C:\Windows\System\wGoPjpR.exe
  2⤵
  PID:8016
- C:\Windows\System\clYZbmh.exe
  C:\Windows\System\clYZbmh.exe
  2⤵
  PID:8032
- C:\Windows\System\sqgxqfP.exe
  C:\Windows\System\sqgxqfP.exe
  2⤵
  PID:8048
- C:\Windows\System\FoXIpMX.exe
  C:\Windows\System\FoXIpMX.exe
  2⤵
  PID:8064
- C:\Windows\System\ZqGjbSa.exe
  C:\Windows\System\ZqGjbSa.exe
  2⤵
  PID:8080
- C:\Windows\System\XiUWXfA.exe
  C:\Windows\System\XiUWXfA.exe
  2⤵
  PID:8096
- C:\Windows\System\rbdWkSf.exe
  C:\Windows\System\rbdWkSf.exe
  2⤵
  PID:8112
- C:\Windows\System\TFpQTSx.exe
  C:\Windows\System\TFpQTSx.exe
  2⤵
  PID:8128
- C:\Windows\System\ibEiMao.exe
  C:\Windows\System\ibEiMao.exe
  2⤵
  PID:8144
- C:\Windows\System\HzTIZhB.exe
  C:\Windows\System\HzTIZhB.exe
  2⤵
  PID:8160
- C:\Windows\System\SPTMdLt.exe
  C:\Windows\System\SPTMdLt.exe
  2⤵
  PID:8176
- C:\Windows\System\nenRdpi.exe
  C:\Windows\System\nenRdpi.exe
  2⤵
  PID:5964
- C:\Windows\System\LwbUdoj.exe
  C:\Windows\System\LwbUdoj.exe
  2⤵
  PID:5544
- C:\Windows\System\kqyICsW.exe
  C:\Windows\System\kqyICsW.exe
  2⤵
  PID:7192
- C:\Windows\System\ZRvkoEy.exe
  C:\Windows\System\ZRvkoEy.exe
  2⤵
  PID:7256
- C:\Windows\System\RqsSmrq.exe
  C:\Windows\System\RqsSmrq.exe
  2⤵
  PID:6280
- C:\Windows\System\yDnWNgZ.exe
  C:\Windows\System\yDnWNgZ.exe
  2⤵
  PID:7272
- C:\Windows\System\wJfguCr.exe
  C:\Windows\System\wJfguCr.exe
  2⤵
  PID:7240
- C:\Windows\System\cOLCPVU.exe
  C:\Windows\System\cOLCPVU.exe
  2⤵
  PID:7316
- C:\Windows\System\jfGxYoE.exe
  C:\Windows\System\jfGxYoE.exe
  2⤵
  PID:7300
- C:\Windows\System\LiVuzzj.exe
  C:\Windows\System\LiVuzzj.exe
  2⤵
  PID:7332
- C:\Windows\System\ZiToFTR.exe
  C:\Windows\System\ZiToFTR.exe
  2⤵
  PID:7384
- C:\Windows\System\EicambT.exe
  C:\Windows\System\EicambT.exe
  2⤵
  PID:7476
- C:\Windows\System\iefgvYb.exe
  C:\Windows\System\iefgvYb.exe
  2⤵
  PID:7512
- C:\Windows\System\nttDQFT.exe
  C:\Windows\System\nttDQFT.exe
  2⤵
  PID:7460
- C:\Windows\System\GYBwgbW.exe
  C:\Windows\System\GYBwgbW.exe
  2⤵
  PID:7608
- C:\Windows\System\lqwgKSd.exe
  C:\Windows\System\lqwgKSd.exe
  2⤵
  PID:7672
- C:\Windows\System\RtAmVdx.exe
  C:\Windows\System\RtAmVdx.exe
  2⤵
  PID:7368
- C:\Windows\System\NkZINSF.exe
  C:\Windows\System\NkZINSF.exe
  2⤵
  PID:7708
- C:\Windows\System\ueyBswq.exe
  C:\Windows\System\ueyBswq.exe
  2⤵
  PID:7772
- C:\Windows\System\KodcStP.exe
  C:\Windows\System\KodcStP.exe
  2⤵
  PID:7804
- C:\Windows\System\tfcqBDt.exe
  C:\Windows\System\tfcqBDt.exe
  2⤵
  PID:7868
- C:\Windows\System\NTrEtrf.exe
  C:\Windows\System\NTrEtrf.exe
  2⤵
  PID:7932
- C:\Windows\System\AUAxyOF.exe
  C:\Windows\System\AUAxyOF.exe
  2⤵
  PID:7432
- C:\Windows\System\fdkVvHd.exe
  C:\Windows\System\fdkVvHd.exe
  2⤵
  PID:7496
- C:\Windows\System\YRJczZz.exe
  C:\Windows\System\YRJczZz.exe
  2⤵
  PID:7964
- C:\Windows\System\JbOCiOv.exe
  C:\Windows\System\JbOCiOv.exe
  2⤵
  PID:7656
- C:\Windows\System\jXTPXmf.exe
  C:\Windows\System\jXTPXmf.exe
  2⤵
  PID:7976
- C:\Windows\System\nNbLQqy.exe
  C:\Windows\System\nNbLQqy.exe
  2⤵
  PID:7848
- C:\Windows\System\FzwtYSc.exe
  C:\Windows\System\FzwtYSc.exe
  2⤵
  PID:7916
- C:\Windows\System\EdwjsHg.exe
  C:\Windows\System\EdwjsHg.exe
  2⤵
  PID:7992
- C:\Windows\System\SqcXaRq.exe
  C:\Windows\System\SqcXaRq.exe
  2⤵
  PID:8056
- C:\Windows\System\mCortLI.exe
  C:\Windows\System\mCortLI.exe
  2⤵
  PID:8120
- C:\Windows\System\oOpRZHj.exe
  C:\Windows\System\oOpRZHj.exe
  2⤵
  PID:8044
- C:\Windows\System\NWhCaiG.exe
  C:\Windows\System\NWhCaiG.exe
  2⤵
  PID:8184
- C:\Windows\System\ssIGGDz.exe
  C:\Windows\System\ssIGGDz.exe
  2⤵
  PID:7288
- C:\Windows\System\AyBvIRx.exe
  C:\Windows\System\AyBvIRx.exe
  2⤵
  PID:7068
- C:\Windows\System\JwSpTnD.exe
  C:\Windows\System\JwSpTnD.exe
  2⤵
  PID:7444
- C:\Windows\System\ERPJPcZ.exe
  C:\Windows\System\ERPJPcZ.exe
  2⤵
  PID:7400
- C:\Windows\System\VwtUNbF.exe
  C:\Windows\System\VwtUNbF.exe
  2⤵
  PID:8012
- C:\Windows\System\JNrCWwK.exe
  C:\Windows\System\JNrCWwK.exe
  2⤵
  PID:7864
- C:\Windows\System\LSzNijM.exe
  C:\Windows\System\LSzNijM.exe
  2⤵
  PID:7752
- C:\Windows\System\vxTtSMW.exe
  C:\Windows\System\vxTtSMW.exe
  2⤵
  PID:7704
- C:\Windows\System\COnnyci.exe
  C:\Windows\System\COnnyci.exe
  2⤵
  PID:8076
- C:\Windows\System\hotRqhx.exe
  C:\Windows\System\hotRqhx.exe
  2⤵
  PID:7644
- C:\Windows\System\ihToKvF.exe
  C:\Windows\System\ihToKvF.exe
  2⤵
  PID:7900
- C:\Windows\System\rgprBqR.exe
  C:\Windows\System\rgprBqR.exe
  2⤵
  PID:7948
- C:\Windows\System\lsTVZKU.exe
  C:\Windows\System\lsTVZKU.exe
  2⤵
  PID:6940
- C:\Windows\System\iDgyWVY.exe
  C:\Windows\System\iDgyWVY.exe
  2⤵
  PID:7224
- C:\Windows\System\GtLtldY.exe
  C:\Windows\System\GtLtldY.exe
  2⤵
  PID:7756
- C:\Windows\System\dPOsvsg.exe
  C:\Windows\System\dPOsvsg.exe
  2⤵
  PID:8028
- C:\Windows\System\uIXGaNy.exe
  C:\Windows\System\uIXGaNy.exe
  2⤵
  PID:7188
- C:\Windows\System\PkabnEG.exe
  C:\Windows\System\PkabnEG.exe
  2⤵
  PID:7788
- C:\Windows\System\gFsvcQy.exe
  C:\Windows\System\gFsvcQy.exe
  2⤵
  PID:7204
- C:\Windows\System\kXvwKYQ.exe
  C:\Windows\System\kXvwKYQ.exe
  2⤵
  PID:7784
- C:\Windows\System\ohLlTMt.exe
  C:\Windows\System\ohLlTMt.exe
  2⤵
  PID:8092
- C:\Windows\System\vODUJGW.exe
  C:\Windows\System\vODUJGW.exe
  2⤵
  PID:7768
- C:\Windows\System\yVJpPyA.exe
  C:\Windows\System\yVJpPyA.exe
  2⤵
  PID:6588
- C:\Windows\System\hcwbUKA.exe
  C:\Windows\System\hcwbUKA.exe
  2⤵
  PID:7004
- C:\Windows\System\NqyAcbp.exe
  C:\Windows\System\NqyAcbp.exe
  2⤵
  PID:7268
- C:\Windows\System\NMvYhFs.exe
  C:\Windows\System\NMvYhFs.exe
  2⤵
  PID:7236
- C:\Windows\System\UHzVdea.exe
  C:\Windows\System\UHzVdea.exe
  2⤵
  PID:8188
- C:\Windows\System\ooeLbar.exe
  C:\Windows\System\ooeLbar.exe
  2⤵
  PID:8088
- C:\Windows\System\gyWtojW.exe
  C:\Windows\System\gyWtojW.exe
  2⤵
  PID:8196
- C:\Windows\System\lpWDqTu.exe
  C:\Windows\System\lpWDqTu.exe
  2⤵
  PID:8212
- C:\Windows\System\GvmZJuy.exe
  C:\Windows\System\GvmZJuy.exe
  2⤵
  PID:8228
- C:\Windows\System\nqwzJid.exe
  C:\Windows\System\nqwzJid.exe
  2⤵
  PID:8244
- C:\Windows\System\qYyokoC.exe
  C:\Windows\System\qYyokoC.exe
  2⤵
  PID:8260
- C:\Windows\System\UXJmSus.exe
  C:\Windows\System\UXJmSus.exe
  2⤵
  PID:8276
- C:\Windows\System\syYVJeQ.exe
  C:\Windows\System\syYVJeQ.exe
  2⤵
  PID:8292
- C:\Windows\System\HPBxbVC.exe
  C:\Windows\System\HPBxbVC.exe
  2⤵
  PID:8308
- C:\Windows\System\jOnWLcB.exe
  C:\Windows\System\jOnWLcB.exe
  2⤵
  PID:8324
- C:\Windows\System\ehOLbIv.exe
  C:\Windows\System\ehOLbIv.exe
  2⤵
  PID:8340
- C:\Windows\System\tPcXajH.exe
  C:\Windows\System\tPcXajH.exe
  2⤵
  PID:8356
- C:\Windows\System\aytGyOo.exe
  C:\Windows\System\aytGyOo.exe
  2⤵
  PID:8372
- C:\Windows\System\LYBcWNT.exe
  C:\Windows\System\LYBcWNT.exe
  2⤵
  PID:8388
- C:\Windows\System\niJBOph.exe
  C:\Windows\System\niJBOph.exe
  2⤵
  PID:8404
- C:\Windows\System\qoxVnjL.exe
  C:\Windows\System\qoxVnjL.exe
  2⤵
  PID:8420
- C:\Windows\System\JfxhCXD.exe
  C:\Windows\System\JfxhCXD.exe
  2⤵
  PID:8436
- C:\Windows\System\MfXXMOA.exe
  C:\Windows\System\MfXXMOA.exe
  2⤵
  PID:8452
- C:\Windows\System\UtIkqHe.exe
  C:\Windows\System\UtIkqHe.exe
  2⤵
  PID:8468
- C:\Windows\System\GXfoKAw.exe
  C:\Windows\System\GXfoKAw.exe
  2⤵
  PID:8484
- C:\Windows\System\LTXBCmt.exe
  C:\Windows\System\LTXBCmt.exe
  2⤵
  PID:8500
- C:\Windows\System\wpRDNJi.exe
  C:\Windows\System\wpRDNJi.exe
  2⤵
  PID:8516
- C:\Windows\System\eijIEAT.exe
  C:\Windows\System\eijIEAT.exe
  2⤵
  PID:8532
- C:\Windows\System\UAzDWLn.exe
  C:\Windows\System\UAzDWLn.exe
  2⤵
  PID:8548
- C:\Windows\System\NSGgIoP.exe
  C:\Windows\System\NSGgIoP.exe
  2⤵
  PID:8564
- C:\Windows\System\PsvAuoh.exe
  C:\Windows\System\PsvAuoh.exe
  2⤵
  PID:8580
- C:\Windows\System\qBWoKQF.exe
  C:\Windows\System\qBWoKQF.exe
  2⤵
  PID:8596
- C:\Windows\System\Qkkdjqa.exe
  C:\Windows\System\Qkkdjqa.exe
  2⤵
  PID:8612
- C:\Windows\System\KoNfolK.exe
  C:\Windows\System\KoNfolK.exe
  2⤵
  PID:8628
- C:\Windows\System\YMeluAt.exe
  C:\Windows\System\YMeluAt.exe
  2⤵
  PID:8644
- C:\Windows\System\fxRAFan.exe
  C:\Windows\System\fxRAFan.exe
  2⤵
  PID:8660
- C:\Windows\System\JySZGQq.exe
  C:\Windows\System\JySZGQq.exe
  2⤵
  PID:8676
- C:\Windows\System\ANolmUX.exe
  C:\Windows\System\ANolmUX.exe
  2⤵
  PID:8692
- C:\Windows\System\bDApAmd.exe
  C:\Windows\System\bDApAmd.exe
  2⤵
  PID:8708
- C:\Windows\System\PghkxjE.exe
  C:\Windows\System\PghkxjE.exe
  2⤵
  PID:8724
- C:\Windows\System\xwfzJGP.exe
  C:\Windows\System\xwfzJGP.exe
  2⤵
  PID:8740
- C:\Windows\System\gsdIqxQ.exe
  C:\Windows\System\gsdIqxQ.exe
  2⤵
  PID:8756
- C:\Windows\System\wKHlyvO.exe
  C:\Windows\System\wKHlyvO.exe
  2⤵
  PID:8772
- C:\Windows\System\EyZGbCJ.exe
  C:\Windows\System\EyZGbCJ.exe
  2⤵
  PID:8788
- C:\Windows\System\eHcilag.exe
  C:\Windows\System\eHcilag.exe
  2⤵
  PID:8804
- C:\Windows\System\FZtkJoT.exe
  C:\Windows\System\FZtkJoT.exe
  2⤵
  PID:8820
- C:\Windows\System\ChsNJnM.exe
  C:\Windows\System\ChsNJnM.exe
  2⤵
  PID:8836
- C:\Windows\System\XZzqmNp.exe
  C:\Windows\System\XZzqmNp.exe
  2⤵
  PID:8852
- C:\Windows\System\dGJfmNS.exe
  C:\Windows\System\dGJfmNS.exe
  2⤵
  PID:8868
- C:\Windows\System\nYEZyJW.exe
  C:\Windows\System\nYEZyJW.exe
  2⤵
  PID:8884
- C:\Windows\System\kCdsUAN.exe
  C:\Windows\System\kCdsUAN.exe
  2⤵
  PID:8900
- C:\Windows\System\SQxWWhj.exe
  C:\Windows\System\SQxWWhj.exe
  2⤵
  PID:8916
- C:\Windows\System\JAutOdi.exe
  C:\Windows\System\JAutOdi.exe
  2⤵
  PID:8932
- C:\Windows\System\WxPHJsE.exe
  C:\Windows\System\WxPHJsE.exe
  2⤵
  PID:8948
- C:\Windows\System\QOuhmFd.exe
  C:\Windows\System\QOuhmFd.exe
  2⤵
  PID:8964
- C:\Windows\System\GUzxsGl.exe
  C:\Windows\System\GUzxsGl.exe
  2⤵
  PID:8980
- C:\Windows\System\JkOShtn.exe
  C:\Windows\System\JkOShtn.exe
  2⤵
  PID:8996
- C:\Windows\System\mnrUURN.exe
  C:\Windows\System\mnrUURN.exe
  2⤵
  PID:9012
- C:\Windows\System\WmzSJWZ.exe
  C:\Windows\System\WmzSJWZ.exe
  2⤵
  PID:9028
- C:\Windows\System\PhlgZyg.exe
  C:\Windows\System\PhlgZyg.exe
  2⤵
  PID:9044
- C:\Windows\System\VElGYRX.exe
  C:\Windows\System\VElGYRX.exe
  2⤵
  PID:9060
- C:\Windows\System\ckqkZPJ.exe
  C:\Windows\System\ckqkZPJ.exe
  2⤵
  PID:9076
- C:\Windows\System\OxYSCcJ.exe
  C:\Windows\System\OxYSCcJ.exe
  2⤵
  PID:9092
- C:\Windows\System\WIVrIKb.exe
  C:\Windows\System\WIVrIKb.exe
  2⤵
  PID:9116
- C:\Windows\System\feZfBWm.exe
  C:\Windows\System\feZfBWm.exe
  2⤵
  PID:9132
- C:\Windows\System\ebIkYEq.exe
  C:\Windows\System\ebIkYEq.exe
  2⤵
  PID:9148
- C:\Windows\System\WtdqIXk.exe
  C:\Windows\System\WtdqIXk.exe
  2⤵
  PID:9164
- C:\Windows\System\IlgAGSR.exe
  C:\Windows\System\IlgAGSR.exe
  2⤵
  PID:9180
- C:\Windows\System\gAldkyV.exe
  C:\Windows\System\gAldkyV.exe
  2⤵
  PID:9196
- C:\Windows\System\NLwnwjg.exe
  C:\Windows\System\NLwnwjg.exe
  2⤵
  PID:9212
- C:\Windows\System\iqzUvEm.exe
  C:\Windows\System\iqzUvEm.exe
  2⤵
  PID:8040
- C:\Windows\System\vCoNoXh.exe
  C:\Windows\System\vCoNoXh.exe
  2⤵
  PID:8220
- C:\Windows\System\GpLDYWi.exe
  C:\Windows\System\GpLDYWi.exe
  2⤵
  PID:8284
- C:\Windows\System\olcnkrH.exe
  C:\Windows\System\olcnkrH.exe
  2⤵
  PID:8348
- C:\Windows\System\fVmMvQA.exe
  C:\Windows\System\fVmMvQA.exe
  2⤵
  PID:7176
- C:\Windows\System\MdGyuCj.exe
  C:\Windows\System\MdGyuCj.exe
  2⤵
  PID:8272
- C:\Windows\System\noCzeWb.exe
  C:\Windows\System\noCzeWb.exe
  2⤵
  PID:8364
- C:\Windows\System\ntrJWzw.exe
  C:\Windows\System\ntrJWzw.exe
  2⤵
  PID:7820
- C:\Windows\System\HIFCrGE.exe
  C:\Windows\System\HIFCrGE.exe
  2⤵
  PID:7596
- C:\Windows\System\sGOrUYU.exe
  C:\Windows\System\sGOrUYU.exe
  2⤵
  PID:8416
- C:\Windows\System\IhTGTcD.exe
  C:\Windows\System\IhTGTcD.exe
  2⤵
  PID:8448
- C:\Windows\System\PPvSITC.exe
  C:\Windows\System\PPvSITC.exe
  2⤵
  PID:8204
- C:\Windows\System\ZALBIUI.exe
  C:\Windows\System\ZALBIUI.exe
  2⤵
  PID:8476
- C:\Windows\System\aGhlCJk.exe
  C:\Windows\System\aGhlCJk.exe
  2⤵
  PID:8496
- C:\Windows\System\JkkifUa.exe
  C:\Windows\System\JkkifUa.exe
  2⤵
  PID:8572
- C:\Windows\System\GTarxtY.exe
  C:\Windows\System\GTarxtY.exe
  2⤵
  PID:8544
- C:\Windows\System\LvsbirH.exe
  C:\Windows\System\LvsbirH.exe
  2⤵
  PID:8640
- C:\Windows\System\uaJYWIN.exe
  C:\Windows\System\uaJYWIN.exe
  2⤵
  PID:8588
- C:\Windows\System\UnJMKVT.exe
  C:\Windows\System\UnJMKVT.exe
  2⤵
  PID:8700
- C:\Windows\System\GfvguVe.exe
  C:\Windows\System\GfvguVe.exe
  2⤵
  PID:8768
- C:\Windows\System\GHjpWbg.exe
  C:\Windows\System\GHjpWbg.exe
  2⤵
  PID:8832
- C:\Windows\System\jxXCEZo.exe
  C:\Windows\System\jxXCEZo.exe
  2⤵
  PID:8892
- C:\Windows\System\bKmTZMn.exe
  C:\Windows\System\bKmTZMn.exe
  2⤵
  PID:8924
- C:\Windows\System\YAicQOK.exe
  C:\Windows\System\YAicQOK.exe
  2⤵
  PID:9020
- C:\Windows\System\DFfAJpF.exe
  C:\Windows\System\DFfAJpF.exe
  2⤵
  PID:8876
- C:\Windows\System\gtVjOyw.exe
  C:\Windows\System\gtVjOyw.exe
  2⤵
  PID:8560
- C:\Windows\System\mMccSCq.exe
  C:\Windows\System\mMccSCq.exe
  2⤵
  PID:1056
- C:\Windows\System\MBOpOjS.exe
  C:\Windows\System\MBOpOjS.exe
  2⤵
  PID:9088
- C:\Windows\System\FpQqSKl.exe
  C:\Windows\System\FpQqSKl.exe
  2⤵
  PID:9068
- C:\Windows\System\dLdHpEk.exe
  C:\Windows\System\dLdHpEk.exe
  2⤵
  PID:9004
- C:\Windows\System\NsjRKzK.exe
  C:\Windows\System\NsjRKzK.exe
  2⤵
  PID:8752
- C:\Windows\System\SAonpRz.exe
  C:\Windows\System\SAonpRz.exe
  2⤵
  PID:8844
- C:\Windows\System\ulWtYLb.exe
  C:\Windows\System\ulWtYLb.exe
  2⤵
  PID:8944
- C:\Windows\System\ufhIFsy.exe
  C:\Windows\System\ufhIFsy.exe
  2⤵
  PID:9128
- C:\Windows\System\cvnXYXD.exe
  C:\Windows\System\cvnXYXD.exe
  2⤵
  PID:9160
- C:\Windows\System\AQELYcW.exe
  C:\Windows\System\AQELYcW.exe
  2⤵
  PID:8256
- C:\Windows\System\ruRbEsH.exe
  C:\Windows\System\ruRbEsH.exe
  2⤵
  PID:9204
- C:\Windows\System\YfPTxKS.exe
  C:\Windows\System\YfPTxKS.exe
  2⤵
  PID:9176
- C:\Windows\System\mEkyIry.exe
  C:\Windows\System\mEkyIry.exe
  2⤵
  PID:7120
- C:\Windows\System\NJoPJQf.exe
  C:\Windows\System\NJoPJQf.exe
  2⤵
  PID:8268
- C:\Windows\System\pXdoBSn.exe
  C:\Windows\System\pXdoBSn.exe
  2⤵
  PID:7580
- C:\Windows\System\cwzxwEf.exe
  C:\Windows\System\cwzxwEf.exe
  2⤵
  PID:8444
- C:\Windows\System\EJOrlKn.exe
  C:\Windows\System\EJOrlKn.exe
  2⤵
  PID:8508
- C:\Windows\System\YvaXiaJ.exe
  C:\Windows\System\YvaXiaJ.exe
  2⤵
  PID:8656
- C:\Windows\System\dQCgXMv.exe
  C:\Windows\System\dQCgXMv.exe
  2⤵
  PID:8928
- C:\Windows\System\oUcexHa.exe
  C:\Windows\System\oUcexHa.exe
  2⤵
  PID:8620
- C:\Windows\System\cRpSjbu.exe
  C:\Windows\System\cRpSjbu.exe
  2⤵
  PID:9008
- C:\Windows\System\wFJvmLB.exe
  C:\Windows\System\wFJvmLB.exe
  2⤵
  PID:9188
- C:\Windows\System\vYYqWOq.exe
  C:\Windows\System\vYYqWOq.exe
  2⤵
  PID:7816
- C:\Windows\System\eBuercj.exe
  C:\Windows\System\eBuercj.exe
  2⤵
  PID:8672
- C:\Windows\System\SMDdpgD.exe
  C:\Windows\System\SMDdpgD.exe
  2⤵
  PID:8800
- C:\Windows\System\IYOFrdu.exe
  C:\Windows\System\IYOFrdu.exe
  2⤵
  PID:8732
- C:\Windows\System\EXQuUUz.exe
  C:\Windows\System\EXQuUUz.exe
  2⤵
  PID:8492
- C:\Windows\System\JOyaPOn.exe
  C:\Windows\System\JOyaPOn.exe
  2⤵
  PID:1548
- C:\Windows\System\VOeENWq.exe
  C:\Windows\System\VOeENWq.exe
  2⤵
  PID:2288
- C:\Windows\System\KjyEuoh.exe
  C:\Windows\System\KjyEuoh.exe
  2⤵
  PID:9084
- C:\Windows\System\cDotlud.exe
  C:\Windows\System\cDotlud.exe
  2⤵
  PID:8604
- C:\Windows\System\IYgCFqf.exe
  C:\Windows\System\IYgCFqf.exe
  2⤵
  PID:8784
- C:\Windows\System\ycLaeSj.exe
  C:\Windows\System\ycLaeSj.exe
  2⤵
  PID:9124
- C:\Windows\System\JGbTzJr.exe
  C:\Windows\System\JGbTzJr.exe
  2⤵
  PID:8320
- C:\Windows\System\KzcPkwZ.exe
  C:\Windows\System\KzcPkwZ.exe
  2⤵
  PID:7380
- C:\Windows\System\RznqRdL.exe
  C:\Windows\System\RznqRdL.exe
  2⤵
  PID:8460
- C:\Windows\System\wzWxszO.exe
  C:\Windows\System\wzWxszO.exe
  2⤵
  PID:8540
- C:\Windows\System\VxjqGZP.exe
  C:\Windows\System\VxjqGZP.exe
  2⤵
  PID:2516
- C:\Windows\System\BaiotDb.exe
  C:\Windows\System\BaiotDb.exe
  2⤵
  PID:8716
- C:\Windows\System\wVrvfNy.exe
  C:\Windows\System\wVrvfNy.exe
  2⤵
  PID:8236
- C:\Windows\System\HcjGTEW.exe
  C:\Windows\System\HcjGTEW.exe
  2⤵
  PID:8400
- C:\Windows\System\OBZqKLp.exe
  C:\Windows\System\OBZqKLp.exe
  2⤵
  PID:8464
- C:\Windows\System\IdrsvKo.exe
  C:\Windows\System\IdrsvKo.exe
  2⤵
  PID:8252
- C:\Windows\System\lYlsuGO.exe
  C:\Windows\System\lYlsuGO.exe
  2⤵
  PID:9056
- C:\Windows\System\lJLlsfB.exe
  C:\Windows\System\lJLlsfB.exe
  2⤵
  PID:8908
- C:\Windows\System\eZuvqKJ.exe
  C:\Windows\System\eZuvqKJ.exe
  2⤵
  PID:8512
- C:\Windows\System\UHtXyWf.exe
  C:\Windows\System\UHtXyWf.exe
  2⤵
  PID:8748
- C:\Windows\System\pvNeekL.exe
  C:\Windows\System\pvNeekL.exe
  2⤵
  PID:8332
- C:\Windows\System\zXpbUEK.exe
  C:\Windows\System\zXpbUEK.exe
  2⤵
  PID:8828
- C:\Windows\System\gUvtxiY.exe
  C:\Windows\System\gUvtxiY.exe
  2⤵
  PID:9224
- C:\Windows\System\lUYZcDu.exe
  C:\Windows\System\lUYZcDu.exe
  2⤵
  PID:9240
- C:\Windows\System\nneXMVy.exe
  C:\Windows\System\nneXMVy.exe
  2⤵
  PID:9256
- C:\Windows\System\rvXPZsS.exe
  C:\Windows\System\rvXPZsS.exe
  2⤵
  PID:9272
- C:\Windows\System\eaawxYo.exe
  C:\Windows\System\eaawxYo.exe
  2⤵
  PID:9288
- C:\Windows\System\kPqdgcC.exe
  C:\Windows\System\kPqdgcC.exe
  2⤵
  PID:9304
- C:\Windows\System\faeYfHD.exe
  C:\Windows\System\faeYfHD.exe
  2⤵
  PID:9324
- C:\Windows\System\jPNFlpW.exe
  C:\Windows\System\jPNFlpW.exe
  2⤵
  PID:9340
- C:\Windows\System\XcFQBGU.exe
  C:\Windows\System\XcFQBGU.exe
  2⤵
  PID:9356
- C:\Windows\System\mnWjABp.exe
  C:\Windows\System\mnWjABp.exe
  2⤵
  PID:9372
- C:\Windows\System\aQKZAhJ.exe
  C:\Windows\System\aQKZAhJ.exe
  2⤵
  PID:9388
- C:\Windows\System\YMxrtye.exe
  C:\Windows\System\YMxrtye.exe
  2⤵
  PID:9404
- C:\Windows\System\eoiQpha.exe
  C:\Windows\System\eoiQpha.exe
  2⤵
  PID:9420
- C:\Windows\System\RPqujdx.exe
  C:\Windows\System\RPqujdx.exe
  2⤵
  PID:9436
- C:\Windows\System\mGzpQVc.exe
  C:\Windows\System\mGzpQVc.exe
  2⤵
  PID:9452
- C:\Windows\System\VQnpYhZ.exe
  C:\Windows\System\VQnpYhZ.exe
  2⤵
  PID:9468
- C:\Windows\System\KbiJTTy.exe
  C:\Windows\System\KbiJTTy.exe
  2⤵
  PID:9484
- C:\Windows\System\kYHjGtf.exe
  C:\Windows\System\kYHjGtf.exe
  2⤵
  PID:9500
- C:\Windows\System\ARHjktm.exe
  C:\Windows\System\ARHjktm.exe
  2⤵
  PID:9516
- C:\Windows\System\EdZdLCR.exe
  C:\Windows\System\EdZdLCR.exe
  2⤵
  PID:9532
- C:\Windows\System\opQNxLt.exe
  C:\Windows\System\opQNxLt.exe
  2⤵
  PID:9548
- C:\Windows\System\WQqqrWO.exe
  C:\Windows\System\WQqqrWO.exe
  2⤵
  PID:9572
- C:\Windows\System\NeuHfVy.exe
  C:\Windows\System\NeuHfVy.exe
  2⤵
  PID:9588
- C:\Windows\System\PmqVmSz.exe
  C:\Windows\System\PmqVmSz.exe
  2⤵
  PID:9604
- C:\Windows\System\VwcwKAA.exe
  C:\Windows\System\VwcwKAA.exe
  2⤵
  PID:9620
- C:\Windows\System\idAEOxa.exe
  C:\Windows\System\idAEOxa.exe
  2⤵
  PID:9636
- C:\Windows\System\eJLJqFz.exe
  C:\Windows\System\eJLJqFz.exe
  2⤵
  PID:9652
- C:\Windows\System\ZFHGckf.exe
  C:\Windows\System\ZFHGckf.exe
  2⤵
  PID:9668
- C:\Windows\System\UbqyVlk.exe
  C:\Windows\System\UbqyVlk.exe
  2⤵
  PID:9684
- C:\Windows\System\YmMUjzK.exe
  C:\Windows\System\YmMUjzK.exe
  2⤵
  PID:9700
- C:\Windows\System\tWKRaar.exe
  C:\Windows\System\tWKRaar.exe
  2⤵
  PID:9716
- C:\Windows\System\BGANfNx.exe
  C:\Windows\System\BGANfNx.exe
  2⤵
  PID:9732
- C:\Windows\System\vDcaoQN.exe
  C:\Windows\System\vDcaoQN.exe
  2⤵
  PID:9748
- C:\Windows\System\eUksLmC.exe
  C:\Windows\System\eUksLmC.exe
  2⤵
  PID:9764
- C:\Windows\System\vaIePro.exe
  C:\Windows\System\vaIePro.exe
  2⤵
  PID:9780
- C:\Windows\System\uBYqdrQ.exe
  C:\Windows\System\uBYqdrQ.exe
  2⤵
  PID:9796
- C:\Windows\System\inQatuf.exe
  C:\Windows\System\inQatuf.exe
  2⤵
  PID:9812
- C:\Windows\System\cuvUBpD.exe
  C:\Windows\System\cuvUBpD.exe
  2⤵
  PID:9832
- C:\Windows\System\kYpAbDI.exe
  C:\Windows\System\kYpAbDI.exe
  2⤵
  PID:9848
- C:\Windows\System\UEaxcpy.exe
  C:\Windows\System\UEaxcpy.exe
  2⤵
  PID:9868
- C:\Windows\System\zhDRqfj.exe
  C:\Windows\System\zhDRqfj.exe
  2⤵
  PID:9884
- C:\Windows\System\avJJxXG.exe
  C:\Windows\System\avJJxXG.exe
  2⤵
  PID:9900
- C:\Windows\System\YfCeFxm.exe
  C:\Windows\System\YfCeFxm.exe
  2⤵
  PID:9916
- C:\Windows\System\AfPFkMD.exe
  C:\Windows\System\AfPFkMD.exe
  2⤵
  PID:9932
- C:\Windows\System\oIJcAtO.exe
  C:\Windows\System\oIJcAtO.exe
  2⤵
  PID:9952
- C:\Windows\System\MVFKWTV.exe
  C:\Windows\System\MVFKWTV.exe
  2⤵
  PID:9968
- C:\Windows\System\dzjArXI.exe
  C:\Windows\System\dzjArXI.exe
  2⤵
  PID:9984
- C:\Windows\System\RrTbGvl.exe
  C:\Windows\System\RrTbGvl.exe
  2⤵
  PID:10000
- C:\Windows\System\UWPwlop.exe
  C:\Windows\System\UWPwlop.exe
  2⤵
  PID:10016
- C:\Windows\System\pvfHFOA.exe
  C:\Windows\System\pvfHFOA.exe
  2⤵
  PID:10036
- C:\Windows\System\OpMNIwQ.exe
  C:\Windows\System\OpMNIwQ.exe
  2⤵
  PID:10052
- C:\Windows\System\OZIkmIG.exe
  C:\Windows\System\OZIkmIG.exe
  2⤵
  PID:10068
- C:\Windows\System\ASlaMnV.exe
  C:\Windows\System\ASlaMnV.exe
  2⤵
  PID:10084
- C:\Windows\System\NzTvmuQ.exe
  C:\Windows\System\NzTvmuQ.exe
  2⤵
  PID:10100
- C:\Windows\System\wnSowyB.exe
  C:\Windows\System\wnSowyB.exe
  2⤵
  PID:10116
- C:\Windows\System\hndiApX.exe
  C:\Windows\System\hndiApX.exe
  2⤵
  PID:10132
- C:\Windows\System\OZdxIVU.exe
  C:\Windows\System\OZdxIVU.exe
  2⤵
  PID:10152
- C:\Windows\System\crQINjm.exe
  C:\Windows\System\crQINjm.exe
  2⤵
  PID:10168
- C:\Windows\System\nQizZsI.exe
  C:\Windows\System\nQizZsI.exe
  2⤵
  PID:10184
- C:\Windows\System\BkUfCcB.exe
  C:\Windows\System\BkUfCcB.exe
  2⤵
  PID:10200
- C:\Windows\System\thhKPFc.exe
  C:\Windows\System\thhKPFc.exe
  2⤵
  PID:10216
- C:\Windows\System\mmzOwlL.exe
  C:\Windows\System\mmzOwlL.exe
  2⤵
  PID:10232
- C:\Windows\System\AuxVJus.exe
  C:\Windows\System\AuxVJus.exe
  2⤵
  PID:9236
- C:\Windows\System\UlcqnTe.exe
  C:\Windows\System\UlcqnTe.exe
  2⤵
  PID:9300
- C:\Windows\System\zuJFdMy.exe
  C:\Windows\System\zuJFdMy.exe
  2⤵
  PID:9332
- C:\Windows\System\FVuYouf.exe
  C:\Windows\System\FVuYouf.exe
  2⤵
  PID:9316
- C:\Windows\System\EZGvSHJ.exe
  C:\Windows\System\EZGvSHJ.exe
  2⤵
  PID:9368
- C:\Windows\System\sEmfLyB.exe
  C:\Windows\System\sEmfLyB.exe
  2⤵
  PID:9396
- C:\Windows\System\tvKxWkK.exe
  C:\Windows\System\tvKxWkK.exe
  2⤵
  PID:9428
- C:\Windows\System\hEXMtKR.exe
  C:\Windows\System\hEXMtKR.exe
  2⤵
  PID:9448
- C:\Windows\System\LMDnOau.exe
  C:\Windows\System\LMDnOau.exe
  2⤵
  PID:9476
- C:\Windows\System\vfTsMsC.exe
  C:\Windows\System\vfTsMsC.exe
  2⤵
  PID:9508
- C:\Windows\System\ACJLPed.exe
  C:\Windows\System\ACJLPed.exe
  2⤵
  PID:9556
- C:\Windows\System\OWdlswP.exe
  C:\Windows\System\OWdlswP.exe
  2⤵
  PID:9540
- C:\Windows\System\xQGVSIK.exe
  C:\Windows\System\xQGVSIK.exe
  2⤵
  PID:9544
- C:\Windows\System\EsIqKYG.exe
  C:\Windows\System\EsIqKYG.exe
  2⤵
  PID:9628
- C:\Windows\System\LndLbwk.exe
  C:\Windows\System\LndLbwk.exe
  2⤵
  PID:9664
- C:\Windows\System\zhKlscx.exe
  C:\Windows\System\zhKlscx.exe
  2⤵
  PID:9676
- C:\Windows\System\LrynqEv.exe
  C:\Windows\System\LrynqEv.exe
  2⤵
  PID:9712
- C:\Windows\System\GJhbCuh.exe
  C:\Windows\System\GJhbCuh.exe
  2⤵
  PID:9788
- C:\Windows\System\XRzbDei.exe
  C:\Windows\System\XRzbDei.exe
  2⤵
  PID:9828
- C:\Windows\System\PxiEsZn.exe
  C:\Windows\System\PxiEsZn.exe
  2⤵
  PID:9804
- C:\Windows\System\wIrKSVn.exe
  C:\Windows\System\wIrKSVn.exe
  2⤵
  PID:9864
- C:\Windows\System\CoMQlVd.exe
  C:\Windows\System\CoMQlVd.exe
  2⤵
  PID:9876
- C:\Windows\System\RtlSfCm.exe
  C:\Windows\System\RtlSfCm.exe
  2⤵
  PID:9928
- C:\Windows\System\KXklaTJ.exe
  C:\Windows\System\KXklaTJ.exe
  2⤵
  PID:9964
- C:\Windows\System\jbLiqzs.exe
  C:\Windows\System\jbLiqzs.exe
  2⤵
  PID:9992
- C:\Windows\System\kxXBvFc.exe
  C:\Windows\System\kxXBvFc.exe
  2⤵
  PID:10008
- C:\Windows\System\SUrODQv.exe
  C:\Windows\System\SUrODQv.exe
  2⤵
  PID:10060
- C:\Windows\System\zeXyKnD.exe
  C:\Windows\System\zeXyKnD.exe
  2⤵
  PID:10076
- C:\Windows\System\dTBlXyn.exe
  C:\Windows\System\dTBlXyn.exe
  2⤵
  PID:10124
- C:\Windows\System\IDqZilS.exe
  C:\Windows\System\IDqZilS.exe
  2⤵
  PID:10112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AAkSnAu.exe

Filesize
1.7MB

MD5
97306d2dc25240d70da5fc4fc0ed69b1

SHA1
676a796ba4006e7212a516077856a1b8acebdb67

SHA256
bb28c9569ed8aae35e6edc5cd2be415b053f073260ec98d37f66314403b5f964

SHA512
5206c1bc335ee9c1d7e0402f2cdf468849eaaa21510b066d34da394001329ba9acade62653ac185815c6f572ecb6b4d1ded70d75d4ca985bd3cb14a7a2cec57b

Download Submit
C:\Windows\system\AIBlSbX.exe

Filesize
1.7MB

MD5
89623b0725331cb6e32709faa9ca7c50

SHA1
7f08710b2b5f2cbbc905478ce62fe84332320921

SHA256
6ab0211ff663147cf7937a06fb3ab0d547c981069b641902cdb9daec9a4f6dc1

SHA512
003c1301214001e4166b03ee38e93c0cdab3a88b5fd89ec178135498d5592e47862c02736a7f4fc4d4d6215f1c883f739f4252d0bc881fc7c2db6f78620ff191

Download Submit
C:\Windows\system\AfxokmI.exe

Filesize
1.7MB

MD5
8ed851244c71aa1b0261892464e68c44

SHA1
954f309dbc748ed3c7b5fc6aa73a20592a2d92e8

SHA256
c0b4eff9dd3983a674e4a2ddcdcaa1ae0d13d0c2ffcc05171528956d5bf256c9

SHA512
8ce8c9ebea61f564e693c76c83ad3c99826448d21382bc92858348eec3a5bb1eb9ddd3ed00254602cdbf968b4248f73804a9ddd443b4f3fe2ec899fb63b891bd

Download Submit
C:\Windows\system\ExxFizE.exe

Filesize
1.7MB

MD5
f23e7dfcee38dc948eefb0289427db05

SHA1
f23d6cf97b014b64fed038334c201bf722f0196e

SHA256
7b48b54c36d4f7a74abb91bcf50880a223b2e4f8684be8ff4832c638ac03187d

SHA512
4dc397128649041b9d6b68148e565b5f4d2c2086a30d99c0633693e85b4666605ea261f895620f7dd7949659586bd4beeb0c928f4f1b1ebc9c7cde2beeddc4e0

Download Submit
C:\Windows\system\NGGnhyU.exe

Filesize
1.7MB

MD5
63c844b9fc2e407ac0dc8e1dd2a63057

SHA1
f974c356ec00ff626a009f767b1af44b528239ff

SHA256
d07d793728d7604157f1bea5ba9bdfb5578eefa6a1dc11f40a84949ba5152c8c

SHA512
0d7d88130b7ae5ae9dd31ae45c9ff06cb84c9929d413a52ab995cec2126bb4718fd1f019d19fef725ac0692619817f3a43d1c53d6c5f5c6011ca12f4e971b0d7

Download Submit
C:\Windows\system\PGkUgwI.exe

Filesize
1.7MB

MD5
a41817fe25395fe24aa60e730a636d76

SHA1
23b9fd93eb7b4e1e02b2bc79e8098ed683bce00d

SHA256
6054cb57810cba7f080023c4ca50f5b660619e7c6333b39d228646a0c26d22ce

SHA512
3f2d526cdf457403d1bf32e83174d9050058c9943118d13fc8b2ef918832cf58b829b785623719bcabafa25b223edd694266ea784230187c31fbfb1ff459bf1b

Download Submit
C:\Windows\system\PIjgaxE.exe

Filesize
1.7MB

MD5
be5ba56002e9ab3d40463039aeb6ce0a

SHA1
0006dc7cbb358dc7083aa8457199246cebe6a559

SHA256
c390ed3605998471e22574cf5dc92949f89de7e76c4d77f9256430e72eac2774

SHA512
4f9c1096e588b44439ec1e85b9a0930414fd3207a3c40e225c1508e494ab6e3fb3555286d56b7b75c4164407c643765b328de6931909a973dec9898f50c43c5d

Download Submit
C:\Windows\system\RYUtlNE.exe

Filesize
1.7MB

MD5
2d4baf38d4d81510d8a57da726969949

SHA1
4dee7ef95a7dda8b8b2de5494bd515b870de456e

SHA256
0d0095f8240c038e8d5bece8b0fb2507b23879a24bb99a8c4ff2ccb905100867

SHA512
6f7806b6e5b8eaa2edcfc350afe8add261ee09bc791ec9b351dc3580f33824a7f6169d5ca69b9b627c00ed1cd7ab8db8f3f1754f365143ba7c9aa70d1a4aa39f

Download Submit
C:\Windows\system\RYpjUwI.exe

Filesize
1.7MB

MD5
a1e72ba72df04d7682fbe2dc8e6d80af

SHA1
d5e4cf630476ba0e3e6f81b567e298b36668692e

SHA256
4edb3f4e20c25d82d0c8ab8d067ae0b27f9168034f1108ab2ce1ea055a3e7ead

SHA512
c3dead9258a3b624adf2c23df70375cb82d9ec137f9955b044675713a016f765cd06d8319cec0c6165a73bf0010127ae02fb71110c0a9789048cfe7f43b35a44

Download Submit
C:\Windows\system\UufDHxz.exe

Filesize
1.7MB

MD5
b29d1cdb9f47faf88d3f72d8ec2830db

SHA1
b5da161fe27c8173ce62c209feff57995bcec565

SHA256
3cf323dc585e79f2033a1b28781c02f7b563c7340b8b374054b5d26726d91bbd

SHA512
e347e11436728b9389ea57eb475de7e18f5fb25a77d3082e1d4a7885636509594035700ebc3c797bc0640517676391ff01995a19811ea943f5e20e4d862ac6ea

Download Submit
C:\Windows\system\VNUukqI.exe

Filesize
1.7MB

MD5
48ecd74a25a1a269157a47c7c5ace04d

SHA1
4036db9b0ed28ba83ace11407e98ed326e938776

SHA256
03ea1d6a63be603e0925ae090da56ecdc428b134ff4a0ca2c6883e2fe4b950c0

SHA512
fcbb3abd0a5a9a0a7e8c268de7d8293201dd18fa163022f668f9adba445a8beb8db5e3fd06d6843605d573575a30ace8b4abb9f86937d781300f3a6fc173ba66

Download Submit
C:\Windows\system\ZjScOpy.exe

Filesize
1.7MB

MD5
99eb92e5f6f98a33153bb9359b31dbcc

SHA1
4f9c2f7381ffe8ecbc784956e645fa88b03c4750

SHA256
65f0e627e34752b7c607a4e32475ba47a5081049c6c5deb1ca15224e5a1e9ce7

SHA512
5f9cf718dab3ee70f96ce0b3cd7fe5a7f74247c13c519aa6cf4b875b64277897e279189a458efe961454e874c91e47369785697026f70cb5832cb9a910c663f3

Download Submit
C:\Windows\system\gZXyfpg.exe

Filesize
1.7MB

MD5
cdf32a194772e06504687f70ab200642

SHA1
d6fdcc0a6e28f7d9f3442bc00a2355b05f8860d0

SHA256
61a2332b8df8b677dd79060ab5eed9253a865faf9099c04c6c13ac4d9a98e4d7

SHA512
89f82c41c2d987649de96dfe6aa701dad177dd058e21ca7a9571763143522ad04b23b92c033864a852eb2833b6dbd669c1c5a593fe06f17804b09b202ea423d3

Download Submit
C:\Windows\system\isgZLZQ.exe

Filesize
1.7MB

MD5
c74593ce4d0e15bbe32f5b374f91acd0

SHA1
41526998b6aa9fb95b0df8eca63ddf4b9c8bf1e0

SHA256
73554d62dfab6c7763817cd57b7bfa46b681d8be180937877655940f9fb15fc5

SHA512
be94f36e0ca5426dbb0ad1a15e03baf79b46c70f7410c382a251bd7432d54579c8b244447e17969eb4cb25c3237336236397de963f6ba4475a64c17fe0740bdb

Download Submit
C:\Windows\system\jLbPqtD.exe

Filesize
1.7MB

MD5
5f70b44df63c9925b583c5b35d8fb8bd

SHA1
8baa98121758dc388e75a088eb611d12bc14c3cb

SHA256
41c8c92def2135526181f643ada234e22e88e66124f56d7b90e2f1d910f40c26

SHA512
9d268a56979ae65c665b7de9b1a23a3dd39cfd7f3a051d5cd8d3be99b305675696fe0548da213ea39574a293db840ead40f1f74c9e6c736e50ed9ca14cedc3a5

Download Submit
C:\Windows\system\mAcPcQZ.exe

Filesize
1.7MB

MD5
67f9601cffd011ded3e028334a937002

SHA1
e726333c6b7c61d92d2ad3d23fa6a2da8b5cfb0f

SHA256
4d9264d6fcafc825f45352f1d15c506a8ddb1adba9f295503d44e760a4031afe

SHA512
a79fe8aaac485ace0c8c4070462b19190896a5e465d5fcf4a7ee1f7ba482c2a76c7f4d9162cc465207fbf3e2479693008eb25a2a0efe8ef2c910c64e6af5e546

Download Submit
C:\Windows\system\nTaJeqC.exe

Filesize
1.7MB

MD5
843aba6c5011866d1941cadb6b55a752

SHA1
152d0bc2b6cfe39d2311a3f65f2387c4e95e672d

SHA256
b1f1f759521b7e7d5276b0fa0ec0cffad0053724f63fa58ba629e615aa5aaf74

SHA512
4ac02161a4a0aebcc824963a3cf1fe2a8794864ce81119fe00fed4947832b21ab712eecf094b924b65a06b1767b93fbdce0278813b62860e80be9bd313f6f2b0

Download Submit
C:\Windows\system\nppgVrU.exe

Filesize
8B

MD5
8a9416a5ba3f4513ce86ee25fcd9ed2c

SHA1
a36f3dd1333c8cfee404b646d4c6809d7e653313

SHA256
fb7dd3a16f87fe8b7e98987069f2b605508df1550402bd2a9bfdec4856b1a59a

SHA512
c747d417c3e282ae9ec82b691c8fea9cb7d0729d1dda54d2144fa9c71dd39f2ab11cee5a6768a89cb91fd4a7ae6e579302cb4e4de8d6384014994320074580a4

Download Submit
C:\Windows\system\oEtSudS.exe

Filesize
1.7MB

MD5
04cd8da09de51b5dd721d9d78f70f3be

SHA1
82a41ced305d7ce387c7e2bc02834dd0ed55d914

SHA256
ee67f496ed781fa522619e4f53c605c343dd624de27c7c2dc1af90060d6231a0

SHA512
5912d5efe4cd10df0fbdfa9dd1228fc86f821d5d000005dca9073c53732a48a341206b0557b002b9432d2b2901cacc72c993086ec376407eea3d15ae5f6a82c1

Download Submit
C:\Windows\system\oUhFJjP.exe

Filesize
1.7MB

MD5
f84671ead98307ca144bfc5026e15c0d

SHA1
b3f3ee42d85ae91f71577a7db4d1d8fcac3e5baa

SHA256
d2c8326c4f5f24d4451784b623d6ee2375d2de5964127f82d4b65cfc039fb3c8

SHA512
2819380aefb3db538a7c1a6dd8e02fc6a39082b962d6bca29b1aa70ba70da6cc27dcb7cb3bbc84f98832ab79d9e93da9b2f0ab2190a213986c74cc5fc8ebab63

Download Submit
C:\Windows\system\pfdqQDH.exe

Filesize
1.7MB

MD5
22a8b96627bf03594fa8fa615f1738d8

SHA1
58caaa83a9a90a8c1b6ba363eeabeb87f767cd59

SHA256
93fbf347454734d0958bc9765acb3c4db2661f1d9b445338cfb920d3b33ef3ca

SHA512
cb482c21c81610c1ba8f5151d71d06dd7fcf3951d1cd231d07468206b42c4f7ff8eab19b74be478dcd5de4bda7def694b3eca61ab95eab5aa2069f75405af591

Download Submit
C:\Windows\system\qQagenB.exe

Filesize
1.7MB

MD5
a195b27a068ec0c0d984ccda1e810a12

SHA1
a949f53313de94e5edd4d2215bc554babae01f53

SHA256
61a74e9777d933961d974700e4720373bb0fdc9c5fbac747c5f08516b83df2fc

SHA512
e37f3533e45a36d285d6b79648c2e42ebdd855af04b39297247be3fb71bb15e42125e66afc30b47fd0e13ca4f47a69e3d3dc301d5d6ba902760accc2c86d5789

Download Submit
C:\Windows\system\rGVbkSr.exe

Filesize
1.7MB

MD5
26b23c17e9bf0654985f68eff349fade

SHA1
1db1369949fa6f07afbfeaa7a6b8071cc0867da9

SHA256
cee4370b87b22daed682a78be15b3d449d9b7796f713408bf8ba8a02d9168a8d

SHA512
be8801a1f66332b6e3c33596f049dee552a07eb9edbb6e75adfbbe4205d3a8718aaf6b9e1dbfdad59b485f1381743eb895d205d82521b263e0022fc012a43993

Download Submit
C:\Windows\system\taKxihj.exe

Filesize
1.7MB

MD5
fad82cae77cb7eb978e27f62461c8e70

SHA1
eac8f24cfb2948b2b53d8645aaa55e2584af87b4

SHA256
262f702efb2155faf8cb2c7a7d951ebe1bb78fafe0c019c21179046d91ec3685

SHA512
7630eff25d8dd0b6c6061ddeedc030efb40f7f7d30e1844b864acaf89a1c7538d64df9a4ba18cc88807d107ef88a18d96d3e7598d5033a0a97c782d7268f22bd

Download Submit
C:\Windows\system\wcthycj.exe

Filesize
1.7MB

MD5
563479298c7f81092334a73797bd18c4

SHA1
5c07bf96aec20ed782ac184ba0855f5f8481869d

SHA256
339c8fd0ef79cf931581a8b86adefe5d69530c567176826d92ce6d521a36657f

SHA512
aaa04266f42d29d8eaecb2af2b3f06e0038a25bd8c53c4a78318debdc74813a5a400f25cc0aa28ba74a1f51774d19e6901b905883555c035b4c487701853b7e0

Download Submit
C:\Windows\system\woUzHbg.exe

Filesize
1.7MB

MD5
9f243968cb2eb46f50049f7b6fced81f

SHA1
37308ac06f21f2ce1b1d5364520d4883ea8275ff

SHA256
127023be7442132516574f8c30976df6d0a44246343961da61fb10615ee08979

SHA512
ddb6eecb77278db2616d0decbe67967b2a3be81e5737e1eb79f4ce96c13f53650543c81a5759e7a5436d4a4a2e1ea84ff2692233ed5f5550530309f0015dfdff

Download Submit
\Windows\system\AFavHHk.exe

Filesize
1.7MB

MD5
c7c246b66e73f476a06cadd651a0acef

SHA1
ec34587b76de0b68043c5db68909b9814d305948

SHA256
2958d0a45bc1954829f844f4fd6b0b42644fd16212f798b310185e81096fa94e

SHA512
96b85b230220a1b5312d733ebafdca1c493aa6ee405cc45559c25f2e71a85d16c2c70db8d08a0ae8226c909b7bfa81f37adb6bed50f466b49da2b2960c4878c0

Download Submit
\Windows\system\HrTwvdA.exe

Filesize
1.7MB

MD5
cf21ecbdbbbf1afadd113d0fa74118b3

SHA1
653efb3feedb5f4b2c3b0c65dde1a74f559a2edf

SHA256
91f07898ce16fbdb82659d95d091079ae9a74fdde4716005c0f62e045ea61b47

SHA512
511855aeeae8726ce2f5b4abdfcb8c5d8a5c466a45fa47447275ec5abc53e05869f4158cad7bffa2f8d30d79904dfd0f38e5d521745969423ad876a6b47780a3

Download Submit
\Windows\system\IsFtFoH.exe

Filesize
1.7MB

MD5
4b037a5f4486926c6a0f22fca02e9b9e

SHA1
d6a6773baf54493b7e713bcd4705de80045bf537

SHA256
a04f2bb9c4adaec2ddbd7ba124f8bc5722c0dda2be86fee9d928341f909f8cbd

SHA512
67825cc9b6402fa33c6cbd4164b335fb736aa2088aaab561ddbc8a6710c3cec7c27f5ad38a2911c2e76c1a30bd1272859c4b15d963875fbea34f897ff3987983

Download Submit
\Windows\system\MQOJESh.exe

Filesize
1.7MB

MD5
5a47ed1db0a3f426d8914446283a9e33

SHA1
b0dc57855fbcca597cfc39f0355771394eac6c69

SHA256
166768963f7b246406f6c259e845aaf7a2c8bdd644b14f5e208b221c1a3b7f4e

SHA512
de54a3590535cf4890d39232e607b476474bbdeec8d9b17ca1078fed62b16bf0c489bed6b9157fcb7761aa78b2e5f3e61bf95dd06cfe13645fdae2651a00af97

Download Submit
\Windows\system\MXQjiiN.exe

Filesize
1.7MB

MD5
fc62de0cc9575818fea10c057888f05c

SHA1
bb7df02dedab97fb9ed2efe559c1bb73bfd5f6a7

SHA256
89935a71d5cdd3c1eca0eeeac1556283787c1a2903c0681f8038d6ab048a705a

SHA512
80e230a2e48bf7a6f64cde0416460ddb56dda0a2c18b7e459d0189b31238d2582e75c7319d5cea961bdfdb51c907239de4be5f9d44e9c210739aee90bff98ab5

Download Submit
\Windows\system\TgAmjfZ.exe

Filesize
1.7MB

MD5
5030e1049c233b3d89901a8134524869

SHA1
05a1f6821d66e9fdd882ec1b7ab153e29c133af0

SHA256
7d7596f246d9415168ff52a2a67f0254f9dd95b763f1a682a2f8d483a0134409

SHA512
4573756323fe1dab049ee7e60b999da4c054c60454b896233f52efd28bafbc1726ea9dfffbeeb6bbbca55d4ad210387a0712209167d12f5862e9447c00d24378

Download Submit
\Windows\system\WpuuaHS.exe

Filesize
1.7MB

MD5
a042679d1c67368ed46a86686eab4743

SHA1
49ac4cd81dba15a9ec70ca734efc5be4e168aabe

SHA256
ea23c090f77bd9a171c5cc4f168186a63fbaf1c61c4d12593dddf52e3b338ac4

SHA512
6f0bae1d9862195346d8598467e45a75455bccdbf5285013debeff5d833f616d71248f8d1bdd9c7fd43bac59484fadb113ad771d3a6d2cbb1b284562f0fa4636

Download Submit
\Windows\system\gunISaq.exe

Filesize
1.7MB

MD5
7aece39226491b9c7ea2904a2e9f4928

SHA1
252c522111b6f1f8eee09e897d746290c30d4630

SHA256
8d0119faf8d2c56a3c3da122514fae6ca23b4654597f99ff7a72129b4e66b910

SHA512
6ef9d4c01420f4f7516d7fa7d1e0f6a4bb5e9a08554b76fb9983ca8b7776f0dbbea6e79e3e6b7a643dfde9be64a5fa400aff47d78323ff2458d417d1dcfbf588

Download Submit
\Windows\system\hqJRQzV.exe

Filesize
1.7MB

MD5
5b55113038ba4b67431e00968d6d8a4d

SHA1
7bae099aa0b55cf0a2f8976d3761023fa154c10d

SHA256
b770d4c3fedf4586387ce0f89fcfd79f12d18011b6943dcb3ebb5292a92aaf75

SHA512
052e1e2757970a6a23b4255b8b1bd0be293fb9c690c0b5ab7f275bb5b24d388bf279c9594df018d4d9bec3b74fccb02ec597db46848cbe98cc9117198de4f8f8

Download Submit
\Windows\system\zxKwfjr.exe

Filesize
1.7MB

MD5
68c423e12b4a78f5fda9e9de22778ba3

SHA1
505eb3cc2d7e653ffb53888e250bc5d77adb7402

SHA256
b8f33b7df6b1680ff539b134d6e6eaa38fd65a5521995a5e42cafec5a49599d4

SHA512
a6ccdf80733e7474e686413729d869fe4b01cf53dd2f2ddfe09a61a97fe4d51d0deddfce21670788010fea491f578d95d5023e84dbad80cb87cee1702d86b9ff

Download Submit
memory/1596-222-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1596-3816-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1900-228-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1900-4667-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-78-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1984-69-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-12-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-10606-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/1984-10549-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-9908-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1984-211-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-84-0x00000000030A0000-0x0000000003492000-memory.dmp

Filesize
3.9MB

Download
memory/1984-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1984-82-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-234-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/1984-80-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-66-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/1984-0-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/1984-72-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/1984-76-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/1984-74-0x0000000002F50000-0x0000000003342000-memory.dmp

Filesize
3.9MB

Download
memory/2640-13-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-3800-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-4672-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2676-79-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2704-81-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2704-3817-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2720-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2720-3799-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-70-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2792-4660-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2808-68-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2808-3804-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2832-65-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2832-4664-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2912-83-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-4657-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1918-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-58-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-85-0x000007FEF5BF0000-0x000007FEF658D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-63-0x0000000002040000-0x0000000002048000-memory.dmp

Filesize
32KB

Download
memory/2916-57-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/2916-15-0x000007FEF5EAE000-0x000007FEF5EAF000-memory.dmp

Filesize
4KB

Download
memory/2916-14-0x0000000001F40000-0x0000000001FC0000-memory.dmp

Filesize
512KB

Download
memory/2928-3802-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2928-73-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2968-75-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2968-4674-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download