xmrig | bdc4ab702989f58059b60e69c296c831f94efd19d67ba3f489f522f8ae8c9db5

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 07:43 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
Size

1.1MB
MD5

0037f01b8037018674f8edf2dc7d2aef
SHA1

233a9c43f07070b288445beacfbb87f753266b4c
SHA256

bdc4ab702989f58059b60e69c296c831f94efd19d67ba3f489f522f8ae8c9db5
SHA512

23124840e65b596a5145e5cfab43eef17a47fb3d1a11d29aa08d11dc35370dc2740d569c79ea97226997c0e4db01238f967d6d42df19233608f44331c77643cb
SSDEEP

24576:RVIl/WDGCi7/qkat6zqxG2/yJeUU0Vw0q0D2zLzdUvOln:ROdWCCi7/raWf/U0VZyf

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 28 IoCs

miner

resource	yara_rule
behavioral1/memory/2656-37-0x000000013FA60000-0x000000013FDB1000-memory.dmp	xmrig
behavioral1/memory/1044-35-0x000000013FBE0000-0x000000013FF31000-memory.dmp	xmrig
behavioral1/memory/1044-52-0x0000000001E60000-0x00000000021B1000-memory.dmp	xmrig
behavioral1/memory/2880-46-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/808-88-0x000000013FBD0000-0x000000013FF21000-memory.dmp	xmrig
behavioral1/memory/2608-87-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2616-177-0x000000013F070000-0x000000013F3C1000-memory.dmp	xmrig
behavioral1/memory/1044-176-0x0000000001E60000-0x00000000021B1000-memory.dmp	xmrig
behavioral1/memory/1044-116-0x0000000001E60000-0x00000000021B1000-memory.dmp	xmrig
behavioral1/memory/2760-95-0x000000013FA90000-0x000000013FDE1000-memory.dmp	xmrig
behavioral1/memory/2128-78-0x000000013FD50000-0x00000001400A1000-memory.dmp	xmrig
behavioral1/memory/2548-76-0x000000013FE00000-0x0000000140151000-memory.dmp	xmrig
behavioral1/memory/2848-75-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2536-74-0x000000013FF00000-0x0000000140251000-memory.dmp	xmrig
behavioral1/memory/2836-66-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2504-504-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/2128-3918-0x000000013FD50000-0x00000001400A1000-memory.dmp	xmrig
behavioral1/memory/2880-3917-0x000000013F7F0000-0x000000013FB41000-memory.dmp	xmrig
behavioral1/memory/2608-3963-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2760-4000-0x000000013FA90000-0x000000013FDE1000-memory.dmp	xmrig
behavioral1/memory/2656-4017-0x000000013FA60000-0x000000013FDB1000-memory.dmp	xmrig
behavioral1/memory/2836-4048-0x000000013F170000-0x000000013F4C1000-memory.dmp	xmrig
behavioral1/memory/2616-4052-0x000000013F070000-0x000000013F3C1000-memory.dmp	xmrig
behavioral1/memory/2548-4061-0x000000013FE00000-0x0000000140151000-memory.dmp	xmrig
behavioral1/memory/808-4130-0x000000013FBD0000-0x000000013FF21000-memory.dmp	xmrig
behavioral1/memory/2848-4131-0x000000013F7D0000-0x000000013FB21000-memory.dmp	xmrig
behavioral1/memory/2504-4132-0x000000013FED0000-0x0000000140221000-memory.dmp	xmrig
behavioral1/memory/2536-4133-0x000000013FF00000-0x0000000140251000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2880	qgyZzKs.exe
2128	ytyHiAp.exe
2608	firZFrJ.exe
2760	mfJsSAp.exe
2656	jGEprcR.exe
2616	ghVpZuA.exe
2836	ibdfzQR.exe
2536	ByQjHzn.exe
2848	XLdbEEF.exe
2548	JjCTuEG.exe
2504	pqPpRvq.exe
808	sxIgLsS.exe
648	CWGSyka.exe
2488	sbTcyux.exe
2828	opqQlsd.exe
2588	YbHzAtH.exe
1712	XwGDzRp.exe
1672	vtOHrUa.exe
1636	IZcyRXR.exe
664	VkCUhGr.exe
1820	gFybLnk.exe
552	uCqPova.exe
2832	rJjQIdA.exe
2016	XfvyHBc.exe
2476	DHSUqVj.exe
1740	OcTGaoK.exe
1508	wIqDEhk.exe
2248	EXJsqdB.exe
2900	nvYAzOO.exe
2088	xcqjBTe.exe
2320	uyTwZwG.exe
1708	sPnSHoQ.exe
2352	mclfTAe.exe
1720	XNxksKb.exe
444	EwoMQWi.exe
2160	FXNUQMa.exe
316	IFDgecq.exe
2376	fKVpWVk.exe
1324	cdhZJGH.exe
1880	WBIVwBW.exe
1788	TglIJHM.exe
2044	usiwJYZ.exe
1832	DStWtVG.exe
944	QoBLNEr.exe
1444	aZbSpRt.exe
1652	hadxRRm.exe
916	qRmSPda.exe
2180	XIBRVNh.exe
2084	DUKRCsV.exe
2164	PNDBvPG.exe
2244	jIbDzCb.exe
2240	vLDQDrR.exe
2436	GsSvxwX.exe
2276	pdBhTeG.exe
3020	ABcEBeH.exe
892	anpUoKq.exe
2372	fYsfqtb.exe
3056	zVGxqAl.exe
2280	gyHvMqm.exe
1732	ADWCydD.exe
2644	zSXtIDh.exe
2296	gfWxNgu.exe
2728	QTfTuAf.exe
2780	cJafVKO.exe

Loads dropped DLL 64 IoCs

pid	Process
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1044-0-0x000000013FBE0000-0x000000013FF31000-memory.dmp	upx
behavioral1/memory/1044-6-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2880-9-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/files/0x000a00000001225c-7.dat	upx
behavioral1/files/0x000c000000014afa-10.dat	upx
behavioral1/memory/2128-15-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/files/0x0008000000014b28-12.dat	upx
behavioral1/memory/2608-22-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/files/0x0008000000014bda-24.dat	upx
behavioral1/memory/2760-29-0x000000013FA90000-0x000000013FDE1000-memory.dmp	upx
behavioral1/files/0x0007000000014c23-30.dat	upx
behavioral1/memory/2656-37-0x000000013FA60000-0x000000013FDB1000-memory.dmp	upx
behavioral1/memory/1044-35-0x000000013FBE0000-0x000000013FF31000-memory.dmp	upx
behavioral1/files/0x003500000001487e-38.dat	upx
behavioral1/files/0x0007000000015016-48.dat	upx
behavioral1/files/0x0007000000014f7b-50.dat	upx
behavioral1/files/0x0007000000016cf8-55.dat	upx
behavioral1/memory/2880-46-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/files/0x0007000000014cde-54.dat	upx
behavioral1/files/0x0006000000016d11-58.dat	upx
behavioral1/memory/808-88-0x000000013FBD0000-0x000000013FF21000-memory.dmp	upx
behavioral1/memory/2608-87-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2504-79-0x000000013FED0000-0x0000000140221000-memory.dmp	upx
behavioral1/files/0x0006000000016dd2-107.dat	upx
behavioral1/files/0x0006000000016d4e-114.dat	upx
behavioral1/files/0x0006000000016ee0-149.dat	upx
behavioral1/files/0x0005000000018669-153.dat	upx
behavioral1/files/0x00060000000175d2-152.dat	upx
behavioral1/files/0x00060000000175c6-151.dat	upx
behavioral1/files/0x0006000000016db3-161.dat	upx
behavioral1/files/0x0006000000016dd6-165.dat	upx
behavioral1/files/0x0006000000017051-120.dat	upx
behavioral1/files/0x0031000000018654-142.dat	upx
behavioral1/files/0x00060000000175cc-133.dat	upx
behavioral1/files/0x0006000000017546-126.dat	upx
behavioral1/files/0x0006000000016dc7-104.dat	upx
behavioral1/files/0x00060000000170b5-150.dat	upx
behavioral1/memory/2616-177-0x000000013F070000-0x000000013F3C1000-memory.dmp	upx
behavioral1/files/0x0006000000016db8-115.dat	upx
behavioral1/files/0x0006000000016d4a-108.dat	upx
behavioral1/memory/2760-95-0x000000013FA90000-0x000000013FDE1000-memory.dmp	upx
behavioral1/memory/2128-78-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/memory/2548-76-0x000000013FE00000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/2848-75-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2536-74-0x000000013FF00000-0x0000000140251000-memory.dmp	upx
behavioral1/memory/2836-66-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2616-64-0x000000013F070000-0x000000013F3C1000-memory.dmp	upx
behavioral1/files/0x0006000000016d33-83.dat	upx
behavioral1/files/0x00050000000186d2-179.dat	upx
behavioral1/files/0x00050000000186de-183.dat	upx
behavioral1/files/0x00050000000186ee-190.dat	upx
behavioral1/files/0x000500000001875d-194.dat	upx
behavioral1/memory/2504-504-0x000000013FED0000-0x0000000140221000-memory.dmp	upx
behavioral1/memory/2128-3918-0x000000013FD50000-0x00000001400A1000-memory.dmp	upx
behavioral1/memory/2880-3917-0x000000013F7F0000-0x000000013FB41000-memory.dmp	upx
behavioral1/memory/2608-3963-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2760-4000-0x000000013FA90000-0x000000013FDE1000-memory.dmp	upx
behavioral1/memory/2656-4017-0x000000013FA60000-0x000000013FDB1000-memory.dmp	upx
behavioral1/memory/2836-4048-0x000000013F170000-0x000000013F4C1000-memory.dmp	upx
behavioral1/memory/2616-4052-0x000000013F070000-0x000000013F3C1000-memory.dmp	upx
behavioral1/memory/2548-4061-0x000000013FE00000-0x0000000140151000-memory.dmp	upx
behavioral1/memory/808-4130-0x000000013FBD0000-0x000000013FF21000-memory.dmp	upx
behavioral1/memory/2848-4131-0x000000013F7D0000-0x000000013FB21000-memory.dmp	upx
behavioral1/memory/2504-4132-0x000000013FED0000-0x0000000140221000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QvxIWvZ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\UZXchaN.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\JYCbhXm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\WqYjfXz.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\yeZpMtz.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\XUavCln.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\lvWUOyd.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\JmWsXGx.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\NsdINPg.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\vBisUsp.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\WFJIWss.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\btFAaei.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GnyJOdR.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\DTXBRsR.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\fGhKVXU.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\onEmwjr.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\oqEWpBz.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ghVpZuA.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\FGPWrlz.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\vSBOqpq.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\kWqKUCj.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\mOxJwSR.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\HmXEpEv.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GOgcnpx.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ekYlCuF.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\UHqDjTn.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GexNyzJ.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\BzFDqmp.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\MWBnKXW.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\TUYjCQH.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\YVhhQNa.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\MkjUWfv.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\jrpiHvq.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\bfztHpX.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\VYOGVHu.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\GyApflA.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\Adeogfa.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\dQfSMhm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\xMttuUk.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\txVZusi.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ajMVpEV.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\hZANVIG.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\VtAUbof.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\TTdbOjo.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\zwkCzZH.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\CLtZJFP.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\SHjJXFY.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\lHogXwR.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ONCYCCi.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ilmKzVX.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\anFuWEB.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\zknJCvD.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\IqbOBpw.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\egxqVxm.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\XyZsOsC.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\mafRBJW.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\JBecTVn.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\CFfNpLb.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\fPhiMds.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\qhCUOEz.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\ApbgCcu.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\nqiWTrt.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\EvkhgIF.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
File created	C:\Windows\System\UqeeDNl.exe	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 2880	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2880	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2880	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	29
PID 1044 wrote to memory of 2128	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	30
PID 1044 wrote to memory of 2128	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	30
PID 1044 wrote to memory of 2128	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	30
PID 1044 wrote to memory of 2608	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	31
PID 1044 wrote to memory of 2608	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	31
PID 1044 wrote to memory of 2608	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	31
PID 1044 wrote to memory of 2760	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	32
PID 1044 wrote to memory of 2760	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	32
PID 1044 wrote to memory of 2760	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	32
PID 1044 wrote to memory of 2656	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	33
PID 1044 wrote to memory of 2656	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	33
PID 1044 wrote to memory of 2656	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	33
PID 1044 wrote to memory of 2616	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	34
PID 1044 wrote to memory of 2616	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	34
PID 1044 wrote to memory of 2616	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	34
PID 1044 wrote to memory of 2536	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	35
PID 1044 wrote to memory of 2536	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	35
PID 1044 wrote to memory of 2536	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	35
PID 1044 wrote to memory of 2836	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	36
PID 1044 wrote to memory of 2836	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	36
PID 1044 wrote to memory of 2836	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	36
PID 1044 wrote to memory of 2848	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	37
PID 1044 wrote to memory of 2848	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	37
PID 1044 wrote to memory of 2848	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	37
PID 1044 wrote to memory of 2548	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	38
PID 1044 wrote to memory of 2548	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	38
PID 1044 wrote to memory of 2548	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	38
PID 1044 wrote to memory of 2504	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	39
PID 1044 wrote to memory of 2504	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	39
PID 1044 wrote to memory of 2504	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	39
PID 1044 wrote to memory of 808	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	40
PID 1044 wrote to memory of 808	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	40
PID 1044 wrote to memory of 808	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	40
PID 1044 wrote to memory of 648	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	41
PID 1044 wrote to memory of 648	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	41
PID 1044 wrote to memory of 648	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	41
PID 1044 wrote to memory of 2488	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	42
PID 1044 wrote to memory of 2488	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	42
PID 1044 wrote to memory of 2488	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	42
PID 1044 wrote to memory of 552	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	43
PID 1044 wrote to memory of 552	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	43
PID 1044 wrote to memory of 552	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	43
PID 1044 wrote to memory of 2828	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	44
PID 1044 wrote to memory of 2828	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	44
PID 1044 wrote to memory of 2828	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	44
PID 1044 wrote to memory of 2832	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	45
PID 1044 wrote to memory of 2832	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	45
PID 1044 wrote to memory of 2832	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	45
PID 1044 wrote to memory of 2588	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	46
PID 1044 wrote to memory of 2588	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	46
PID 1044 wrote to memory of 2588	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	46
PID 1044 wrote to memory of 2016	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	47
PID 1044 wrote to memory of 2016	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	47
PID 1044 wrote to memory of 2016	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	47
PID 1044 wrote to memory of 1712	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	48
PID 1044 wrote to memory of 1712	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	48
PID 1044 wrote to memory of 1712	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	48
PID 1044 wrote to memory of 2476	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	49
PID 1044 wrote to memory of 2476	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	49
PID 1044 wrote to memory of 2476	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	49
PID 1044 wrote to memory of 1672	1044	0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0037f01b8037018674f8edf2dc7d2aef_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\System\qgyZzKs.exe
  C:\Windows\System\qgyZzKs.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ytyHiAp.exe
  C:\Windows\System\ytyHiAp.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\firZFrJ.exe
  C:\Windows\System\firZFrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\mfJsSAp.exe
  C:\Windows\System\mfJsSAp.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\jGEprcR.exe
  C:\Windows\System\jGEprcR.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ghVpZuA.exe
  C:\Windows\System\ghVpZuA.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\ByQjHzn.exe
  C:\Windows\System\ByQjHzn.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ibdfzQR.exe
  C:\Windows\System\ibdfzQR.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\XLdbEEF.exe
  C:\Windows\System\XLdbEEF.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\JjCTuEG.exe
  C:\Windows\System\JjCTuEG.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\pqPpRvq.exe
  C:\Windows\System\pqPpRvq.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\sxIgLsS.exe
  C:\Windows\System\sxIgLsS.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\CWGSyka.exe
  C:\Windows\System\CWGSyka.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\sbTcyux.exe
  C:\Windows\System\sbTcyux.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\uCqPova.exe
  C:\Windows\System\uCqPova.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\opqQlsd.exe
  C:\Windows\System\opqQlsd.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\rJjQIdA.exe
  C:\Windows\System\rJjQIdA.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\YbHzAtH.exe
  C:\Windows\System\YbHzAtH.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\XfvyHBc.exe
  C:\Windows\System\XfvyHBc.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\XwGDzRp.exe
  C:\Windows\System\XwGDzRp.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\DHSUqVj.exe
  C:\Windows\System\DHSUqVj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\vtOHrUa.exe
  C:\Windows\System\vtOHrUa.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\OcTGaoK.exe
  C:\Windows\System\OcTGaoK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\IZcyRXR.exe
  C:\Windows\System\IZcyRXR.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\wIqDEhk.exe
  C:\Windows\System\wIqDEhk.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\VkCUhGr.exe
  C:\Windows\System\VkCUhGr.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\EXJsqdB.exe
  C:\Windows\System\EXJsqdB.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\gFybLnk.exe
  C:\Windows\System\gFybLnk.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\nvYAzOO.exe
  C:\Windows\System\nvYAzOO.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\xcqjBTe.exe
  C:\Windows\System\xcqjBTe.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\uyTwZwG.exe
  C:\Windows\System\uyTwZwG.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\sPnSHoQ.exe
  C:\Windows\System\sPnSHoQ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\mclfTAe.exe
  C:\Windows\System\mclfTAe.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\XNxksKb.exe
  C:\Windows\System\XNxksKb.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\EwoMQWi.exe
  C:\Windows\System\EwoMQWi.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\FXNUQMa.exe
  C:\Windows\System\FXNUQMa.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\IFDgecq.exe
  C:\Windows\System\IFDgecq.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\fKVpWVk.exe
  C:\Windows\System\fKVpWVk.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\cdhZJGH.exe
  C:\Windows\System\cdhZJGH.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\WBIVwBW.exe
  C:\Windows\System\WBIVwBW.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\TglIJHM.exe
  C:\Windows\System\TglIJHM.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\usiwJYZ.exe
  C:\Windows\System\usiwJYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\aZbSpRt.exe
  C:\Windows\System\aZbSpRt.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\DStWtVG.exe
  C:\Windows\System\DStWtVG.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\qRmSPda.exe
  C:\Windows\System\qRmSPda.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\QoBLNEr.exe
  C:\Windows\System\QoBLNEr.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\XIBRVNh.exe
  C:\Windows\System\XIBRVNh.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\hadxRRm.exe
  C:\Windows\System\hadxRRm.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\DUKRCsV.exe
  C:\Windows\System\DUKRCsV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\PNDBvPG.exe
  C:\Windows\System\PNDBvPG.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\jIbDzCb.exe
  C:\Windows\System\jIbDzCb.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\vLDQDrR.exe
  C:\Windows\System\vLDQDrR.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\anpUoKq.exe
  C:\Windows\System\anpUoKq.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\GsSvxwX.exe
  C:\Windows\System\GsSvxwX.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\gyHvMqm.exe
  C:\Windows\System\gyHvMqm.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\pdBhTeG.exe
  C:\Windows\System\pdBhTeG.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\ADWCydD.exe
  C:\Windows\System\ADWCydD.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\ABcEBeH.exe
  C:\Windows\System\ABcEBeH.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\zSXtIDh.exe
  C:\Windows\System\zSXtIDh.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\fYsfqtb.exe
  C:\Windows\System\fYsfqtb.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\gfWxNgu.exe
  C:\Windows\System\gfWxNgu.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\zVGxqAl.exe
  C:\Windows\System\zVGxqAl.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\QTfTuAf.exe
  C:\Windows\System\QTfTuAf.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\cJafVKO.exe
  C:\Windows\System\cJafVKO.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\UfltzmG.exe
  C:\Windows\System\UfltzmG.exe
  2⤵
  PID:2708
- C:\Windows\System\UGQIYmU.exe
  C:\Windows\System\UGQIYmU.exe
  2⤵
  PID:2500
- C:\Windows\System\wKGiJol.exe
  C:\Windows\System\wKGiJol.exe
  2⤵
  PID:1156
- C:\Windows\System\OQVRNVh.exe
  C:\Windows\System\OQVRNVh.exe
  2⤵
  PID:2532
- C:\Windows\System\qHoOLZQ.exe
  C:\Windows\System\qHoOLZQ.exe
  2⤵
  PID:2520
- C:\Windows\System\stqBFUQ.exe
  C:\Windows\System\stqBFUQ.exe
  2⤵
  PID:1492
- C:\Windows\System\dFSCRpL.exe
  C:\Windows\System\dFSCRpL.exe
  2⤵
  PID:2676
- C:\Windows\System\XmmwZnw.exe
  C:\Windows\System\XmmwZnw.exe
  2⤵
  PID:1836
- C:\Windows\System\SdaZZja.exe
  C:\Windows\System\SdaZZja.exe
  2⤵
  PID:2612
- C:\Windows\System\bLAYsYP.exe
  C:\Windows\System\bLAYsYP.exe
  2⤵
  PID:1676
- C:\Windows\System\ccHdnFR.exe
  C:\Windows\System\ccHdnFR.exe
  2⤵
  PID:2360
- C:\Windows\System\mZbzQLr.exe
  C:\Windows\System\mZbzQLr.exe
  2⤵
  PID:1868
- C:\Windows\System\tkLxndM.exe
  C:\Windows\System\tkLxndM.exe
  2⤵
  PID:1816
- C:\Windows\System\ndxSmlA.exe
  C:\Windows\System\ndxSmlA.exe
  2⤵
  PID:1756
- C:\Windows\System\QvYmlWj.exe
  C:\Windows\System\QvYmlWj.exe
  2⤵
  PID:1796
- C:\Windows\System\tUfWkfF.exe
  C:\Windows\System\tUfWkfF.exe
  2⤵
  PID:1112
- C:\Windows\System\fvwZMTI.exe
  C:\Windows\System\fvwZMTI.exe
  2⤵
  PID:604
- C:\Windows\System\yGrAajh.exe
  C:\Windows\System\yGrAajh.exe
  2⤵
  PID:2596
- C:\Windows\System\mneVkUN.exe
  C:\Windows\System\mneVkUN.exe
  2⤵
  PID:2868
- C:\Windows\System\DyOnMpx.exe
  C:\Windows\System\DyOnMpx.exe
  2⤵
  PID:2040
- C:\Windows\System\ssHkBGg.exe
  C:\Windows\System\ssHkBGg.exe
  2⤵
  PID:1876
- C:\Windows\System\akdVjLg.exe
  C:\Windows\System\akdVjLg.exe
  2⤵
  PID:1080
- C:\Windows\System\GAcfVWl.exe
  C:\Windows\System\GAcfVWl.exe
  2⤵
  PID:1988
- C:\Windows\System\slcPjnS.exe
  C:\Windows\System\slcPjnS.exe
  2⤵
  PID:1500
- C:\Windows\System\ueOUZzl.exe
  C:\Windows\System\ueOUZzl.exe
  2⤵
  PID:332
- C:\Windows\System\EKguAgU.exe
  C:\Windows\System\EKguAgU.exe
  2⤵
  PID:596
- C:\Windows\System\kswldlg.exe
  C:\Windows\System\kswldlg.exe
  2⤵
  PID:2404
- C:\Windows\System\dpYlZJE.exe
  C:\Windows\System\dpYlZJE.exe
  2⤵
  PID:2768
- C:\Windows\System\iDjrkwK.exe
  C:\Windows\System\iDjrkwK.exe
  2⤵
  PID:2428
- C:\Windows\System\LrrLdhx.exe
  C:\Windows\System\LrrLdhx.exe
  2⤵
  PID:2356
- C:\Windows\System\weLJllq.exe
  C:\Windows\System\weLJllq.exe
  2⤵
  PID:1244
- C:\Windows\System\gndbJeS.exe
  C:\Windows\System\gndbJeS.exe
  2⤵
  PID:1640
- C:\Windows\System\wwzHMmP.exe
  C:\Windows\System\wwzHMmP.exe
  2⤵
  PID:2204
- C:\Windows\System\qoGkvqn.exe
  C:\Windows\System\qoGkvqn.exe
  2⤵
  PID:2188
- C:\Windows\System\ylFTSRy.exe
  C:\Windows\System\ylFTSRy.exe
  2⤵
  PID:1328
- C:\Windows\System\horCZTd.exe
  C:\Windows\System\horCZTd.exe
  2⤵
  PID:964
- C:\Windows\System\FZVpGun.exe
  C:\Windows\System\FZVpGun.exe
  2⤵
  PID:1624
- C:\Windows\System\TTUyLwb.exe
  C:\Windows\System\TTUyLwb.exe
  2⤵
  PID:1168
- C:\Windows\System\PzEXWIL.exe
  C:\Windows\System\PzEXWIL.exe
  2⤵
  PID:2328
- C:\Windows\System\UNYMIfZ.exe
  C:\Windows\System\UNYMIfZ.exe
  2⤵
  PID:1556
- C:\Windows\System\nwixERH.exe
  C:\Windows\System\nwixERH.exe
  2⤵
  PID:1320
- C:\Windows\System\QjtBftU.exe
  C:\Windows\System\QjtBftU.exe
  2⤵
  PID:1228
- C:\Windows\System\IbcaDkz.exe
  C:\Windows\System\IbcaDkz.exe
  2⤵
  PID:2224
- C:\Windows\System\KMBkpYY.exe
  C:\Windows\System\KMBkpYY.exe
  2⤵
  PID:996
- C:\Windows\System\jZZnKpH.exe
  C:\Windows\System\jZZnKpH.exe
  2⤵
  PID:2924
- C:\Windows\System\tdvfTPD.exe
  C:\Windows\System\tdvfTPD.exe
  2⤵
  PID:1736
- C:\Windows\System\uhZOCGV.exe
  C:\Windows\System\uhZOCGV.exe
  2⤵
  PID:2716
- C:\Windows\System\lZbXbxI.exe
  C:\Windows\System\lZbXbxI.exe
  2⤵
  PID:2640
- C:\Windows\System\YyJbaEM.exe
  C:\Windows\System\YyJbaEM.exe
  2⤵
  PID:3040
- C:\Windows\System\xdzAWUs.exe
  C:\Windows\System\xdzAWUs.exe
  2⤵
  PID:1588
- C:\Windows\System\ehFwDfU.exe
  C:\Windows\System\ehFwDfU.exe
  2⤵
  PID:2628
- C:\Windows\System\vJdJNlZ.exe
  C:\Windows\System\vJdJNlZ.exe
  2⤵
  PID:2756
- C:\Windows\System\mwcEOvB.exe
  C:\Windows\System\mwcEOvB.exe
  2⤵
  PID:2668
- C:\Windows\System\JwfmylB.exe
  C:\Windows\System\JwfmylB.exe
  2⤵
  PID:2824
- C:\Windows\System\HMowdfy.exe
  C:\Windows\System\HMowdfy.exe
  2⤵
  PID:1336
- C:\Windows\System\TPcEPkI.exe
  C:\Windows\System\TPcEPkI.exe
  2⤵
  PID:1096
- C:\Windows\System\Yvfxhil.exe
  C:\Windows\System\Yvfxhil.exe
  2⤵
  PID:2004
- C:\Windows\System\FbMSNQn.exe
  C:\Windows\System\FbMSNQn.exe
  2⤵
  PID:1960
- C:\Windows\System\pDwGHDH.exe
  C:\Windows\System\pDwGHDH.exe
  2⤵
  PID:1964
- C:\Windows\System\OuaXHDw.exe
  C:\Windows\System\OuaXHDw.exe
  2⤵
  PID:2336
- C:\Windows\System\kpUGYpb.exe
  C:\Windows\System\kpUGYpb.exe
  2⤵
  PID:2184
- C:\Windows\System\siYteuN.exe
  C:\Windows\System\siYteuN.exe
  2⤵
  PID:1804
- C:\Windows\System\ivpdXCO.exe
  C:\Windows\System\ivpdXCO.exe
  2⤵
  PID:2572
- C:\Windows\System\OkNxTsb.exe
  C:\Windows\System\OkNxTsb.exe
  2⤵
  PID:2368
- C:\Windows\System\SntSoOW.exe
  C:\Windows\System\SntSoOW.exe
  2⤵
  PID:2992
- C:\Windows\System\jWdWVyr.exe
  C:\Windows\System\jWdWVyr.exe
  2⤵
  PID:2400
- C:\Windows\System\PxvvVOB.exe
  C:\Windows\System\PxvvVOB.exe
  2⤵
  PID:1992
- C:\Windows\System\FORPrdK.exe
  C:\Windows\System\FORPrdK.exe
  2⤵
  PID:2456
- C:\Windows\System\qPifWof.exe
  C:\Windows\System\qPifWof.exe
  2⤵
  PID:2552
- C:\Windows\System\gTjMwpH.exe
  C:\Windows\System\gTjMwpH.exe
  2⤵
  PID:2000
- C:\Windows\System\RVJvxfY.exe
  C:\Windows\System\RVJvxfY.exe
  2⤵
  PID:2920
- C:\Windows\System\GkCJYoj.exe
  C:\Windows\System\GkCJYoj.exe
  2⤵
  PID:1440
- C:\Windows\System\LMItDJi.exe
  C:\Windows\System\LMItDJi.exe
  2⤵
  PID:2232
- C:\Windows\System\IephKtl.exe
  C:\Windows\System\IephKtl.exe
  2⤵
  PID:408
- C:\Windows\System\huiRJNC.exe
  C:\Windows\System\huiRJNC.exe
  2⤵
  PID:2300
- C:\Windows\System\XlaIUxq.exe
  C:\Windows\System\XlaIUxq.exe
  2⤵
  PID:928
- C:\Windows\System\ORuggUR.exe
  C:\Windows\System\ORuggUR.exe
  2⤵
  PID:904
- C:\Windows\System\uhgiYAu.exe
  C:\Windows\System\uhgiYAu.exe
  2⤵
  PID:2228
- C:\Windows\System\rkyYfgb.exe
  C:\Windows\System\rkyYfgb.exe
  2⤵
  PID:2720
- C:\Windows\System\APCZzrq.exe
  C:\Windows\System\APCZzrq.exe
  2⤵
  PID:2292
- C:\Windows\System\cqpgBEX.exe
  C:\Windows\System\cqpgBEX.exe
  2⤵
  PID:2752
- C:\Windows\System\dEPNvLj.exe
  C:\Windows\System\dEPNvLj.exe
  2⤵
  PID:2524
- C:\Windows\System\bmkEesr.exe
  C:\Windows\System\bmkEesr.exe
  2⤵
  PID:792
- C:\Windows\System\kRKJTxQ.exe
  C:\Windows\System\kRKJTxQ.exe
  2⤵
  PID:1536
- C:\Windows\System\LxIojYp.exe
  C:\Windows\System\LxIojYp.exe
  2⤵
  PID:324
- C:\Windows\System\slllxGK.exe
  C:\Windows\System\slllxGK.exe
  2⤵
  PID:1764
- C:\Windows\System\eYeCRay.exe
  C:\Windows\System\eYeCRay.exe
  2⤵
  PID:1996
- C:\Windows\System\fJaIqAZ.exe
  C:\Windows\System\fJaIqAZ.exe
  2⤵
  PID:1560
- C:\Windows\System\fiLuzQJ.exe
  C:\Windows\System\fiLuzQJ.exe
  2⤵
  PID:1340
- C:\Windows\System\gwwcrOO.exe
  C:\Windows\System\gwwcrOO.exe
  2⤵
  PID:1664
- C:\Windows\System\acLzMhh.exe
  C:\Windows\System\acLzMhh.exe
  2⤵
  PID:2064
- C:\Windows\System\aqDEBaz.exe
  C:\Windows\System\aqDEBaz.exe
  2⤵
  PID:2680
- C:\Windows\System\mGxXdrP.exe
  C:\Windows\System\mGxXdrP.exe
  2⤵
  PID:676
- C:\Windows\System\yjBuLnS.exe
  C:\Windows\System\yjBuLnS.exe
  2⤵
  PID:1032
- C:\Windows\System\tmYkDls.exe
  C:\Windows\System\tmYkDls.exe
  2⤵
  PID:720
- C:\Windows\System\CNesilN.exe
  C:\Windows\System\CNesilN.exe
  2⤵
  PID:1768
- C:\Windows\System\ZAhOXLW.exe
  C:\Windows\System\ZAhOXLW.exe
  2⤵
  PID:2176
- C:\Windows\System\DeODzYH.exe
  C:\Windows\System\DeODzYH.exe
  2⤵
  PID:2692
- C:\Windows\System\SiWGbyq.exe
  C:\Windows\System\SiWGbyq.exe
  2⤵
  PID:2624
- C:\Windows\System\kiFaDQq.exe
  C:\Windows\System\kiFaDQq.exe
  2⤵
  PID:2508
- C:\Windows\System\IVcWtdc.exe
  C:\Windows\System\IVcWtdc.exe
  2⤵
  PID:2764
- C:\Windows\System\yVACqnV.exe
  C:\Windows\System\yVACqnV.exe
  2⤵
  PID:1116
- C:\Windows\System\lFCTFpe.exe
  C:\Windows\System\lFCTFpe.exe
  2⤵
  PID:2460
- C:\Windows\System\QFvLUmJ.exe
  C:\Windows\System\QFvLUmJ.exe
  2⤵
  PID:1980
- C:\Windows\System\rKPwdzg.exe
  C:\Windows\System\rKPwdzg.exe
  2⤵
  PID:2540
- C:\Windows\System\XSPeFyh.exe
  C:\Windows\System\XSPeFyh.exe
  2⤵
  PID:3036
- C:\Windows\System\AYUqZcB.exe
  C:\Windows\System\AYUqZcB.exe
  2⤵
  PID:2912
- C:\Windows\System\lowrnld.exe
  C:\Windows\System\lowrnld.exe
  2⤵
  PID:1632
- C:\Windows\System\YXgQIXd.exe
  C:\Windows\System\YXgQIXd.exe
  2⤵
  PID:2092
- C:\Windows\System\FzGaAWy.exe
  C:\Windows\System\FzGaAWy.exe
  2⤵
  PID:1088
- C:\Windows\System\kLuApxt.exe
  C:\Windows\System\kLuApxt.exe
  2⤵
  PID:1956
- C:\Windows\System\zavqOZA.exe
  C:\Windows\System\zavqOZA.exe
  2⤵
  PID:2972
- C:\Windows\System\EFlkYXu.exe
  C:\Windows\System\EFlkYXu.exe
  2⤵
  PID:2788
- C:\Windows\System\dRSghPH.exe
  C:\Windows\System\dRSghPH.exe
  2⤵
  PID:1036
- C:\Windows\System\EBGNqWK.exe
  C:\Windows\System\EBGNqWK.exe
  2⤵
  PID:2028
- C:\Windows\System\vBPslDW.exe
  C:\Windows\System\vBPslDW.exe
  2⤵
  PID:2908
- C:\Windows\System\vEuQYpY.exe
  C:\Windows\System\vEuQYpY.exe
  2⤵
  PID:2124
- C:\Windows\System\flJDwCS.exe
  C:\Windows\System\flJDwCS.exe
  2⤵
  PID:2888
- C:\Windows\System\QjqWIDh.exe
  C:\Windows\System\QjqWIDh.exe
  2⤵
  PID:3108
- C:\Windows\System\ugZLTMn.exe
  C:\Windows\System\ugZLTMn.exe
  2⤵
  PID:3124
- C:\Windows\System\QRAHPaG.exe
  C:\Windows\System\QRAHPaG.exe
  2⤵
  PID:3140
- C:\Windows\System\tIFArzX.exe
  C:\Windows\System\tIFArzX.exe
  2⤵
  PID:3160
- C:\Windows\System\aOQvdsF.exe
  C:\Windows\System\aOQvdsF.exe
  2⤵
  PID:3176
- C:\Windows\System\VKlCdTV.exe
  C:\Windows\System\VKlCdTV.exe
  2⤵
  PID:3192
- C:\Windows\System\ZRqgqec.exe
  C:\Windows\System\ZRqgqec.exe
  2⤵
  PID:3212
- C:\Windows\System\VdaiKTo.exe
  C:\Windows\System\VdaiKTo.exe
  2⤵
  PID:3232
- C:\Windows\System\bEoFZsU.exe
  C:\Windows\System\bEoFZsU.exe
  2⤵
  PID:3248
- C:\Windows\System\rPfaQIJ.exe
  C:\Windows\System\rPfaQIJ.exe
  2⤵
  PID:3268
- C:\Windows\System\rDxqQhs.exe
  C:\Windows\System\rDxqQhs.exe
  2⤵
  PID:3284
- C:\Windows\System\hyBHbOY.exe
  C:\Windows\System\hyBHbOY.exe
  2⤵
  PID:3304
- C:\Windows\System\cfnMMla.exe
  C:\Windows\System\cfnMMla.exe
  2⤵
  PID:3320
- C:\Windows\System\cJSsVgb.exe
  C:\Windows\System\cJSsVgb.exe
  2⤵
  PID:3336
- C:\Windows\System\QKvkZYe.exe
  C:\Windows\System\QKvkZYe.exe
  2⤵
  PID:3356
- C:\Windows\System\zFqMnRU.exe
  C:\Windows\System\zFqMnRU.exe
  2⤵
  PID:3372
- C:\Windows\System\leoOywR.exe
  C:\Windows\System\leoOywR.exe
  2⤵
  PID:3396
- C:\Windows\System\XFsaGSf.exe
  C:\Windows\System\XFsaGSf.exe
  2⤵
  PID:3412
- C:\Windows\System\ZgGEbjd.exe
  C:\Windows\System\ZgGEbjd.exe
  2⤵
  PID:3460
- C:\Windows\System\twofwAj.exe
  C:\Windows\System\twofwAj.exe
  2⤵
  PID:3512
- C:\Windows\System\oiPdCJG.exe
  C:\Windows\System\oiPdCJG.exe
  2⤵
  PID:3528
- C:\Windows\System\jDbjkqc.exe
  C:\Windows\System\jDbjkqc.exe
  2⤵
  PID:3544
- C:\Windows\System\dyrYEAQ.exe
  C:\Windows\System\dyrYEAQ.exe
  2⤵
  PID:3560
- C:\Windows\System\IhDYPdC.exe
  C:\Windows\System\IhDYPdC.exe
  2⤵
  PID:3576
- C:\Windows\System\BeZPPpW.exe
  C:\Windows\System\BeZPPpW.exe
  2⤵
  PID:3592
- C:\Windows\System\VgEDpEc.exe
  C:\Windows\System\VgEDpEc.exe
  2⤵
  PID:3608
- C:\Windows\System\ISYVsUw.exe
  C:\Windows\System\ISYVsUw.exe
  2⤵
  PID:3624
- C:\Windows\System\hZVbsoD.exe
  C:\Windows\System\hZVbsoD.exe
  2⤵
  PID:3644
- C:\Windows\System\FQQzDKR.exe
  C:\Windows\System\FQQzDKR.exe
  2⤵
  PID:3660
- C:\Windows\System\jFHSLjx.exe
  C:\Windows\System\jFHSLjx.exe
  2⤵
  PID:3676
- C:\Windows\System\HxOgdrn.exe
  C:\Windows\System\HxOgdrn.exe
  2⤵
  PID:3692
- C:\Windows\System\KyJfMMB.exe
  C:\Windows\System\KyJfMMB.exe
  2⤵
  PID:3708
- C:\Windows\System\aZQcqNG.exe
  C:\Windows\System\aZQcqNG.exe
  2⤵
  PID:3724
- C:\Windows\System\LsiJjKg.exe
  C:\Windows\System\LsiJjKg.exe
  2⤵
  PID:3744
- C:\Windows\System\NekzvMw.exe
  C:\Windows\System\NekzvMw.exe
  2⤵
  PID:3760
- C:\Windows\System\vFvOaGl.exe
  C:\Windows\System\vFvOaGl.exe
  2⤵
  PID:3776
- C:\Windows\System\dHAQaba.exe
  C:\Windows\System\dHAQaba.exe
  2⤵
  PID:3792
- C:\Windows\System\KkOBCCZ.exe
  C:\Windows\System\KkOBCCZ.exe
  2⤵
  PID:3812
- C:\Windows\System\cgGudzx.exe
  C:\Windows\System\cgGudzx.exe
  2⤵
  PID:3828
- C:\Windows\System\MAfObTS.exe
  C:\Windows\System\MAfObTS.exe
  2⤵
  PID:3844
- C:\Windows\System\ukZpWYV.exe
  C:\Windows\System\ukZpWYV.exe
  2⤵
  PID:3860
- C:\Windows\System\tURKLKV.exe
  C:\Windows\System\tURKLKV.exe
  2⤵
  PID:3876
- C:\Windows\System\uxjbfvA.exe
  C:\Windows\System\uxjbfvA.exe
  2⤵
  PID:3892
- C:\Windows\System\JrJnZbj.exe
  C:\Windows\System\JrJnZbj.exe
  2⤵
  PID:3912
- C:\Windows\System\wyJdMQY.exe
  C:\Windows\System\wyJdMQY.exe
  2⤵
  PID:3960
- C:\Windows\System\mRUwyly.exe
  C:\Windows\System\mRUwyly.exe
  2⤵
  PID:3976
- C:\Windows\System\FrjUYpK.exe
  C:\Windows\System\FrjUYpK.exe
  2⤵
  PID:3992
- C:\Windows\System\RAVLzBN.exe
  C:\Windows\System\RAVLzBN.exe
  2⤵
  PID:4008
- C:\Windows\System\GVKlJKk.exe
  C:\Windows\System\GVKlJKk.exe
  2⤵
  PID:4024
- C:\Windows\System\CjQKIHR.exe
  C:\Windows\System\CjQKIHR.exe
  2⤵
  PID:4044
- C:\Windows\System\SNipgYQ.exe
  C:\Windows\System\SNipgYQ.exe
  2⤵
  PID:4060
- C:\Windows\System\XXIHDpN.exe
  C:\Windows\System\XXIHDpN.exe
  2⤵
  PID:4080
- C:\Windows\System\lornaFI.exe
  C:\Windows\System\lornaFI.exe
  2⤵
  PID:3068
- C:\Windows\System\rkpRjOw.exe
  C:\Windows\System\rkpRjOw.exe
  2⤵
  PID:2812
- C:\Windows\System\gpVqCto.exe
  C:\Windows\System\gpVqCto.exe
  2⤵
  PID:1496
- C:\Windows\System\JDSMOPM.exe
  C:\Windows\System\JDSMOPM.exe
  2⤵
  PID:3076
- C:\Windows\System\amvFVQy.exe
  C:\Windows\System\amvFVQy.exe
  2⤵
  PID:3092
- C:\Windows\System\qPCAYPk.exe
  C:\Windows\System\qPCAYPk.exe
  2⤵
  PID:1540
- C:\Windows\System\MGOKgVi.exe
  C:\Windows\System\MGOKgVi.exe
  2⤵
  PID:1564
- C:\Windows\System\KIPrYuX.exe
  C:\Windows\System\KIPrYuX.exe
  2⤵
  PID:3172
- C:\Windows\System\XpmyZmk.exe
  C:\Windows\System\XpmyZmk.exe
  2⤵
  PID:3240
- C:\Windows\System\fizKqbr.exe
  C:\Windows\System\fizKqbr.exe
  2⤵
  PID:3116
- C:\Windows\System\SIOsKBQ.exe
  C:\Windows\System\SIOsKBQ.exe
  2⤵
  PID:3296
- C:\Windows\System\RgQGcxV.exe
  C:\Windows\System\RgQGcxV.exe
  2⤵
  PID:3368
- C:\Windows\System\qfUrkeG.exe
  C:\Windows\System\qfUrkeG.exe
  2⤵
  PID:3408
- C:\Windows\System\nRlKnAG.exe
  C:\Windows\System\nRlKnAG.exe
  2⤵
  PID:3280
- C:\Windows\System\bQZPGCe.exe
  C:\Windows\System\bQZPGCe.exe
  2⤵
  PID:3348
- C:\Windows\System\OhGWOPk.exe
  C:\Windows\System\OhGWOPk.exe
  2⤵
  PID:3388
- C:\Windows\System\DFeljHZ.exe
  C:\Windows\System\DFeljHZ.exe
  2⤵
  PID:3220
- C:\Windows\System\XyFSFqI.exe
  C:\Windows\System\XyFSFqI.exe
  2⤵
  PID:3188
- C:\Windows\System\YVhhQNa.exe
  C:\Windows\System\YVhhQNa.exe
  2⤵
  PID:3456
- C:\Windows\System\gMgWFPt.exe
  C:\Windows\System\gMgWFPt.exe
  2⤵
  PID:3520
- C:\Windows\System\DmzPlcc.exe
  C:\Windows\System\DmzPlcc.exe
  2⤵
  PID:3536
- C:\Windows\System\dsoExub.exe
  C:\Windows\System\dsoExub.exe
  2⤵
  PID:3604
- C:\Windows\System\wlaAkKy.exe
  C:\Windows\System\wlaAkKy.exe
  2⤵
  PID:3672
- C:\Windows\System\QIaBTcM.exe
  C:\Windows\System\QIaBTcM.exe
  2⤵
  PID:3736
- C:\Windows\System\mplZbJM.exe
  C:\Windows\System\mplZbJM.exe
  2⤵
  PID:3800
- C:\Windows\System\PxwriOC.exe
  C:\Windows\System\PxwriOC.exe
  2⤵
  PID:3588
- C:\Windows\System\LMTJUEC.exe
  C:\Windows\System\LMTJUEC.exe
  2⤵
  PID:3756
- C:\Windows\System\ZptbBNo.exe
  C:\Windows\System\ZptbBNo.exe
  2⤵
  PID:3656
- C:\Windows\System\MJwTVDg.exe
  C:\Windows\System\MJwTVDg.exe
  2⤵
  PID:3852
- C:\Windows\System\hdZvHND.exe
  C:\Windows\System\hdZvHND.exe
  2⤵
  PID:3928
- C:\Windows\System\GZocoTq.exe
  C:\Windows\System\GZocoTq.exe
  2⤵
  PID:3948
- C:\Windows\System\phisxLj.exe
  C:\Windows\System\phisxLj.exe
  2⤵
  PID:3984
- C:\Windows\System\wOjuLrs.exe
  C:\Windows\System\wOjuLrs.exe
  2⤵
  PID:4056
- C:\Windows\System\TKTgHmR.exe
  C:\Windows\System\TKTgHmR.exe
  2⤵
  PID:2844
- C:\Windows\System\ZNADbKr.exe
  C:\Windows\System\ZNADbKr.exe
  2⤵
  PID:4036
- C:\Windows\System\SrHAMuF.exe
  C:\Windows\System\SrHAMuF.exe
  2⤵
  PID:3084
- C:\Windows\System\SuphYWr.exe
  C:\Windows\System\SuphYWr.exe
  2⤵
  PID:3204
- C:\Windows\System\vgQqGqS.exe
  C:\Windows\System\vgQqGqS.exe
  2⤵
  PID:3972
- C:\Windows\System\cPLpEsA.exe
  C:\Windows\System\cPLpEsA.exe
  2⤵
  PID:3424
- C:\Windows\System\IhVVlZL.exe
  C:\Windows\System\IhVVlZL.exe
  2⤵
  PID:3364
- C:\Windows\System\BxHGjoL.exe
  C:\Windows\System\BxHGjoL.exe
  2⤵
  PID:3380
- C:\Windows\System\TChYlhV.exe
  C:\Windows\System\TChYlhV.exe
  2⤵
  PID:2484
- C:\Windows\System\xoUpCrx.exe
  C:\Windows\System\xoUpCrx.exe
  2⤵
  PID:3168
- C:\Windows\System\HJWYBJI.exe
  C:\Windows\System\HJWYBJI.exe
  2⤵
  PID:3228
- C:\Windows\System\pwbMOkx.exe
  C:\Windows\System\pwbMOkx.exe
  2⤵
  PID:3500
- C:\Windows\System\tOaGhWz.exe
  C:\Windows\System\tOaGhWz.exe
  2⤵
  PID:3768
- C:\Windows\System\iIiiFjM.exe
  C:\Windows\System\iIiiFjM.exe
  2⤵
  PID:3572
- C:\Windows\System\LBZZsrE.exe
  C:\Windows\System\LBZZsrE.exe
  2⤵
  PID:3872
- C:\Windows\System\uhHSYOD.exe
  C:\Windows\System\uhHSYOD.exe
  2⤵
  PID:3600
- C:\Windows\System\qzqJJpF.exe
  C:\Windows\System\qzqJJpF.exe
  2⤵
  PID:3684
- C:\Windows\System\olweAZb.exe
  C:\Windows\System\olweAZb.exe
  2⤵
  PID:3556
- C:\Windows\System\iKOlkLp.exe
  C:\Windows\System\iKOlkLp.exe
  2⤵
  PID:3820
- C:\Windows\System\PfHBmSt.exe
  C:\Windows\System\PfHBmSt.exe
  2⤵
  PID:3956
- C:\Windows\System\adXDoMu.exe
  C:\Windows\System\adXDoMu.exe
  2⤵
  PID:4076
- C:\Windows\System\PfimVWp.exe
  C:\Windows\System\PfimVWp.exe
  2⤵
  PID:3568
- C:\Windows\System\xLCSUfc.exe
  C:\Windows\System\xLCSUfc.exe
  2⤵
  PID:3784
- C:\Windows\System\HFbEYKq.exe
  C:\Windows\System\HFbEYKq.exe
  2⤵
  PID:4016
- C:\Windows\System\VScksYc.exe
  C:\Windows\System\VScksYc.exe
  2⤵
  PID:4032
- C:\Windows\System\rtIJWmE.exe
  C:\Windows\System\rtIJWmE.exe
  2⤵
  PID:3420
- C:\Windows\System\zYizBRV.exe
  C:\Windows\System\zYizBRV.exe
  2⤵
  PID:3276
- C:\Windows\System\QyehihY.exe
  C:\Windows\System\QyehihY.exe
  2⤵
  PID:3476
- C:\Windows\System\JhEZXwu.exe
  C:\Windows\System\JhEZXwu.exe
  2⤵
  PID:3484
- C:\Windows\System\ZxJRwcr.exe
  C:\Windows\System\ZxJRwcr.exe
  2⤵
  PID:3888
- C:\Windows\System\uQrVwxr.exe
  C:\Windows\System\uQrVwxr.exe
  2⤵
  PID:280
- C:\Windows\System\xXAbLHc.exe
  C:\Windows\System\xXAbLHc.exe
  2⤵
  PID:3836
- C:\Windows\System\tBqVIWm.exe
  C:\Windows\System\tBqVIWm.exe
  2⤵
  PID:3100
- C:\Windows\System\VacskVP.exe
  C:\Windows\System\VacskVP.exe
  2⤵
  PID:3620
- C:\Windows\System\xTSDurs.exe
  C:\Windows\System\xTSDurs.exe
  2⤵
  PID:2268
- C:\Windows\System\nGdgzmj.exe
  C:\Windows\System\nGdgzmj.exe
  2⤵
  PID:3104
- C:\Windows\System\EPUXtyo.exe
  C:\Windows\System\EPUXtyo.exe
  2⤵
  PID:3772
- C:\Windows\System\woPKRWS.exe
  C:\Windows\System\woPKRWS.exe
  2⤵
  PID:3944
- C:\Windows\System\CCzbnyb.exe
  C:\Windows\System\CCzbnyb.exe
  2⤵
  PID:4004
- C:\Windows\System\zwFXvrT.exe
  C:\Windows\System\zwFXvrT.exe
  2⤵
  PID:3404
- C:\Windows\System\KjPRYyO.exe
  C:\Windows\System\KjPRYyO.exe
  2⤵
  PID:4092
- C:\Windows\System\bOkJvRZ.exe
  C:\Windows\System\bOkJvRZ.exe
  2⤵
  PID:3496
- C:\Windows\System\yXgHuYr.exe
  C:\Windows\System\yXgHuYr.exe
  2⤵
  PID:3472
- C:\Windows\System\nEQuOAu.exe
  C:\Windows\System\nEQuOAu.exe
  2⤵
  PID:4100
- C:\Windows\System\KEQyCam.exe
  C:\Windows\System\KEQyCam.exe
  2⤵
  PID:4116
- C:\Windows\System\acjBetM.exe
  C:\Windows\System\acjBetM.exe
  2⤵
  PID:4136
- C:\Windows\System\dAJtMYp.exe
  C:\Windows\System\dAJtMYp.exe
  2⤵
  PID:4152
- C:\Windows\System\bXfqFyZ.exe
  C:\Windows\System\bXfqFyZ.exe
  2⤵
  PID:4168
- C:\Windows\System\VUdRzlu.exe
  C:\Windows\System\VUdRzlu.exe
  2⤵
  PID:4184
- C:\Windows\System\tgnfeNI.exe
  C:\Windows\System\tgnfeNI.exe
  2⤵
  PID:4200
- C:\Windows\System\UZXchaN.exe
  C:\Windows\System\UZXchaN.exe
  2⤵
  PID:4216
- C:\Windows\System\QuzLyUX.exe
  C:\Windows\System\QuzLyUX.exe
  2⤵
  PID:4236
- C:\Windows\System\kNvVVUq.exe
  C:\Windows\System\kNvVVUq.exe
  2⤵
  PID:4252
- C:\Windows\System\ccsIbTV.exe
  C:\Windows\System\ccsIbTV.exe
  2⤵
  PID:4268
- C:\Windows\System\IyLTbyS.exe
  C:\Windows\System\IyLTbyS.exe
  2⤵
  PID:4284
- C:\Windows\System\CFKPlHW.exe
  C:\Windows\System\CFKPlHW.exe
  2⤵
  PID:4300
- C:\Windows\System\xyKksbk.exe
  C:\Windows\System\xyKksbk.exe
  2⤵
  PID:4316
- C:\Windows\System\gmNbWOz.exe
  C:\Windows\System\gmNbWOz.exe
  2⤵
  PID:4332
- C:\Windows\System\URgUMTn.exe
  C:\Windows\System\URgUMTn.exe
  2⤵
  PID:4348
- C:\Windows\System\PIYHFii.exe
  C:\Windows\System\PIYHFii.exe
  2⤵
  PID:4364
- C:\Windows\System\FQUlsZt.exe
  C:\Windows\System\FQUlsZt.exe
  2⤵
  PID:4380
- C:\Windows\System\PncTHba.exe
  C:\Windows\System\PncTHba.exe
  2⤵
  PID:4396
- C:\Windows\System\WpbdGIi.exe
  C:\Windows\System\WpbdGIi.exe
  2⤵
  PID:4412
- C:\Windows\System\aAybQaq.exe
  C:\Windows\System\aAybQaq.exe
  2⤵
  PID:4428
- C:\Windows\System\jKFbnKA.exe
  C:\Windows\System\jKFbnKA.exe
  2⤵
  PID:4448
- C:\Windows\System\XszDfYO.exe
  C:\Windows\System\XszDfYO.exe
  2⤵
  PID:4464
- C:\Windows\System\TmDLreD.exe
  C:\Windows\System\TmDLreD.exe
  2⤵
  PID:4480
- C:\Windows\System\QTdVHVy.exe
  C:\Windows\System\QTdVHVy.exe
  2⤵
  PID:4496
- C:\Windows\System\TYXYQGN.exe
  C:\Windows\System\TYXYQGN.exe
  2⤵
  PID:4512
- C:\Windows\System\fxrWarb.exe
  C:\Windows\System\fxrWarb.exe
  2⤵
  PID:4528
- C:\Windows\System\QFNOxIv.exe
  C:\Windows\System\QFNOxIv.exe
  2⤵
  PID:4544
- C:\Windows\System\yJxOgAz.exe
  C:\Windows\System\yJxOgAz.exe
  2⤵
  PID:4564
- C:\Windows\System\OhzVImj.exe
  C:\Windows\System\OhzVImj.exe
  2⤵
  PID:4580
- C:\Windows\System\cqAhUkM.exe
  C:\Windows\System\cqAhUkM.exe
  2⤵
  PID:4596
- C:\Windows\System\ZZgmntN.exe
  C:\Windows\System\ZZgmntN.exe
  2⤵
  PID:4612
- C:\Windows\System\InXiLaG.exe
  C:\Windows\System\InXiLaG.exe
  2⤵
  PID:4628
- C:\Windows\System\IPsQOqY.exe
  C:\Windows\System\IPsQOqY.exe
  2⤵
  PID:4644
- C:\Windows\System\mOFrhGg.exe
  C:\Windows\System\mOFrhGg.exe
  2⤵
  PID:4660
- C:\Windows\System\EMNTOQY.exe
  C:\Windows\System\EMNTOQY.exe
  2⤵
  PID:4680
- C:\Windows\System\MeKbhyR.exe
  C:\Windows\System\MeKbhyR.exe
  2⤵
  PID:4696
- C:\Windows\System\CwruVDk.exe
  C:\Windows\System\CwruVDk.exe
  2⤵
  PID:4712
- C:\Windows\System\upmdkHa.exe
  C:\Windows\System\upmdkHa.exe
  2⤵
  PID:4728
- C:\Windows\System\HxFmztu.exe
  C:\Windows\System\HxFmztu.exe
  2⤵
  PID:4744
- C:\Windows\System\fvRmhTv.exe
  C:\Windows\System\fvRmhTv.exe
  2⤵
  PID:4764
- C:\Windows\System\QBTBkab.exe
  C:\Windows\System\QBTBkab.exe
  2⤵
  PID:4780
- C:\Windows\System\vrKrMFc.exe
  C:\Windows\System\vrKrMFc.exe
  2⤵
  PID:4796
- C:\Windows\System\myqWidm.exe
  C:\Windows\System\myqWidm.exe
  2⤵
  PID:4812
- C:\Windows\System\ULfMQeE.exe
  C:\Windows\System\ULfMQeE.exe
  2⤵
  PID:4828
- C:\Windows\System\DgZqTLV.exe
  C:\Windows\System\DgZqTLV.exe
  2⤵
  PID:4844
- C:\Windows\System\DuoTIZH.exe
  C:\Windows\System\DuoTIZH.exe
  2⤵
  PID:4860
- C:\Windows\System\CVwJVhm.exe
  C:\Windows\System\CVwJVhm.exe
  2⤵
  PID:4880
- C:\Windows\System\MkjUWfv.exe
  C:\Windows\System\MkjUWfv.exe
  2⤵
  PID:4896
- C:\Windows\System\SyzpOLf.exe
  C:\Windows\System\SyzpOLf.exe
  2⤵
  PID:4912
- C:\Windows\System\fGhKVXU.exe
  C:\Windows\System\fGhKVXU.exe
  2⤵
  PID:4928
- C:\Windows\System\mYlqpnF.exe
  C:\Windows\System\mYlqpnF.exe
  2⤵
  PID:4944
- C:\Windows\System\ZdEMfjJ.exe
  C:\Windows\System\ZdEMfjJ.exe
  2⤵
  PID:4964
- C:\Windows\System\zMMwnxX.exe
  C:\Windows\System\zMMwnxX.exe
  2⤵
  PID:4980
- C:\Windows\System\IaHBVyD.exe
  C:\Windows\System\IaHBVyD.exe
  2⤵
  PID:4996
- C:\Windows\System\MlbUjrb.exe
  C:\Windows\System\MlbUjrb.exe
  2⤵
  PID:5012
- C:\Windows\System\oQUJrTi.exe
  C:\Windows\System\oQUJrTi.exe
  2⤵
  PID:5028
- C:\Windows\System\CKQiKCS.exe
  C:\Windows\System\CKQiKCS.exe
  2⤵
  PID:5048
- C:\Windows\System\LTdxvqj.exe
  C:\Windows\System\LTdxvqj.exe
  2⤵
  PID:5064
- C:\Windows\System\qbyHNMk.exe
  C:\Windows\System\qbyHNMk.exe
  2⤵
  PID:5080
- C:\Windows\System\VhSlder.exe
  C:\Windows\System\VhSlder.exe
  2⤵
  PID:5100
- C:\Windows\System\Jubjlxs.exe
  C:\Windows\System\Jubjlxs.exe
  2⤵
  PID:5116
- C:\Windows\System\hUGlUnC.exe
  C:\Windows\System\hUGlUnC.exe
  2⤵
  PID:3224
- C:\Windows\System\PjIzhVn.exe
  C:\Windows\System\PjIzhVn.exe
  2⤵
  PID:3652
- C:\Windows\System\gikDWht.exe
  C:\Windows\System\gikDWht.exe
  2⤵
  PID:4148
- C:\Windows\System\CLtZJFP.exe
  C:\Windows\System\CLtZJFP.exe
  2⤵
  PID:4232
- C:\Windows\System\AmiVkHl.exe
  C:\Windows\System\AmiVkHl.exe
  2⤵
  PID:4296
- C:\Windows\System\VfuHKHg.exe
  C:\Windows\System\VfuHKHg.exe
  2⤵
  PID:4360
- C:\Windows\System\UQDImjl.exe
  C:\Windows\System\UQDImjl.exe
  2⤵
  PID:4424
- C:\Windows\System\afiqGvm.exe
  C:\Windows\System\afiqGvm.exe
  2⤵
  PID:4404
- C:\Windows\System\DxwNjyk.exe
  C:\Windows\System\DxwNjyk.exe
  2⤵
  PID:4308
- C:\Windows\System\DDvAnxL.exe
  C:\Windows\System\DDvAnxL.exe
  2⤵
  PID:4244
- C:\Windows\System\EGUyyHN.exe
  C:\Windows\System\EGUyyHN.exe
  2⤵
  PID:4456
- C:\Windows\System\yNBrZzx.exe
  C:\Windows\System\yNBrZzx.exe
  2⤵
  PID:4520
- C:\Windows\System\cceujjU.exe
  C:\Windows\System\cceujjU.exe
  2⤵
  PID:4560
- C:\Windows\System\zHqpXio.exe
  C:\Windows\System\zHqpXio.exe
  2⤵
  PID:4504
- C:\Windows\System\EFGcTpl.exe
  C:\Windows\System\EFGcTpl.exe
  2⤵
  PID:4572
- C:\Windows\System\zQNAMok.exe
  C:\Windows\System\zQNAMok.exe
  2⤵
  PID:4444
- C:\Windows\System\LmKAklF.exe
  C:\Windows\System\LmKAklF.exe
  2⤵
  PID:4624
- C:\Windows\System\dLQbZAk.exe
  C:\Windows\System\dLQbZAk.exe
  2⤵
  PID:4720
- C:\Windows\System\qAtcvIy.exe
  C:\Windows\System\qAtcvIy.exe
  2⤵
  PID:4760
- C:\Windows\System\zbaWVSy.exe
  C:\Windows\System\zbaWVSy.exe
  2⤵
  PID:4820
- C:\Windows\System\fDkrQlt.exe
  C:\Windows\System\fDkrQlt.exe
  2⤵
  PID:4920
- C:\Windows\System\VdWDDij.exe
  C:\Windows\System\VdWDDij.exe
  2⤵
  PID:4960
- C:\Windows\System\SCHHcCw.exe
  C:\Windows\System\SCHHcCw.exe
  2⤵
  PID:5024
- C:\Windows\System\HPHsIYi.exe
  C:\Windows\System\HPHsIYi.exe
  2⤵
  PID:4672
- C:\Windows\System\jxovWXH.exe
  C:\Windows\System\jxovWXH.exe
  2⤵
  PID:4736
- C:\Windows\System\sbsDntb.exe
  C:\Windows\System\sbsDntb.exe
  2⤵
  PID:4840
- C:\Windows\System\BFeXkAB.exe
  C:\Windows\System\BFeXkAB.exe
  2⤵
  PID:4904
- C:\Windows\System\FucbxzN.exe
  C:\Windows\System\FucbxzN.exe
  2⤵
  PID:5008
- C:\Windows\System\mgbGdUw.exe
  C:\Windows\System\mgbGdUw.exe
  2⤵
  PID:4940
- C:\Windows\System\OvikRdZ.exe
  C:\Windows\System\OvikRdZ.exe
  2⤵
  PID:5040
- C:\Windows\System\RxxJEZT.exe
  C:\Windows\System\RxxJEZT.exe
  2⤵
  PID:5092
- C:\Windows\System\wYaglPM.exe
  C:\Windows\System\wYaglPM.exe
  2⤵
  PID:4124
- C:\Windows\System\JUKmsmH.exe
  C:\Windows\System\JUKmsmH.exe
  2⤵
  PID:4196
- C:\Windows\System\hSSWgcJ.exe
  C:\Windows\System\hSSWgcJ.exe
  2⤵
  PID:4420
- C:\Windows\System\jgjedXO.exe
  C:\Windows\System\jgjedXO.exe
  2⤵
  PID:4552
- C:\Windows\System\SroJisl.exe
  C:\Windows\System\SroJisl.exe
  2⤵
  PID:5020
- C:\Windows\System\zWASGjq.exe
  C:\Windows\System\zWASGjq.exe
  2⤵
  PID:4440
- C:\Windows\System\rGQeXDx.exe
  C:\Windows\System\rGQeXDx.exe
  2⤵
  PID:3636
- C:\Windows\System\QfHNGYA.exe
  C:\Windows\System\QfHNGYA.exe
  2⤵
  PID:4356
- C:\Windows\System\pVECzcm.exe
  C:\Windows\System\pVECzcm.exe
  2⤵
  PID:4536
- C:\Windows\System\ZAKpjfl.exe
  C:\Windows\System\ZAKpjfl.exe
  2⤵
  PID:4472
- C:\Windows\System\QWZNYrS.exe
  C:\Windows\System\QWZNYrS.exe
  2⤵
  PID:4312
- C:\Windows\System\qEMOdIh.exe
  C:\Windows\System\qEMOdIh.exe
  2⤵
  PID:4856
- C:\Windows\System\QETnkGJ.exe
  C:\Windows\System\QETnkGJ.exe
  2⤵
  PID:4876
- C:\Windows\System\TgDidCy.exe
  C:\Windows\System\TgDidCy.exe
  2⤵
  PID:4476
- C:\Windows\System\REEaMvw.exe
  C:\Windows\System\REEaMvw.exe
  2⤵
  PID:3940
- C:\Windows\System\qcOHgwD.exe
  C:\Windows\System\qcOHgwD.exe
  2⤵
  PID:4956
- C:\Windows\System\oDGSfdJ.exe
  C:\Windows\System\oDGSfdJ.exe
  2⤵
  PID:4640
- C:\Windows\System\QiyIysj.exe
  C:\Windows\System\QiyIysj.exe
  2⤵
  PID:4836
- C:\Windows\System\TvyJHYP.exe
  C:\Windows\System\TvyJHYP.exe
  2⤵
  PID:5036
- C:\Windows\System\xfMArRx.exe
  C:\Windows\System\xfMArRx.exe
  2⤵
  PID:5112
- C:\Windows\System\hGsFdPB.exe
  C:\Windows\System\hGsFdPB.exe
  2⤵
  PID:4292
- C:\Windows\System\RQNKlxM.exe
  C:\Windows\System\RQNKlxM.exe
  2⤵
  PID:4228
- C:\Windows\System\vzCAxBI.exe
  C:\Windows\System\vzCAxBI.exe
  2⤵
  PID:4592
- C:\Windows\System\cDTtfDW.exe
  C:\Windows\System\cDTtfDW.exe
  2⤵
  PID:4276
- C:\Windows\System\MQeEzzy.exe
  C:\Windows\System\MQeEzzy.exe
  2⤵
  PID:4488
- C:\Windows\System\QhvzqUM.exe
  C:\Windows\System\QhvzqUM.exe
  2⤵
  PID:4852
- C:\Windows\System\XIQsuZx.exe
  C:\Windows\System\XIQsuZx.exe
  2⤵
  PID:4756
- C:\Windows\System\lSLYdkU.exe
  C:\Windows\System\lSLYdkU.exe
  2⤵
  PID:4160
- C:\Windows\System\DYfJHPs.exe
  C:\Windows\System\DYfJHPs.exe
  2⤵
  PID:4620
- C:\Windows\System\CvoWclU.exe
  C:\Windows\System\CvoWclU.exe
  2⤵
  PID:4804
- C:\Windows\System\NLLfauN.exe
  C:\Windows\System\NLLfauN.exe
  2⤵
  PID:4668
- C:\Windows\System\RmhWHRT.exe
  C:\Windows\System\RmhWHRT.exe
  2⤵
  PID:5088
- C:\Windows\System\MWIbCzE.exe
  C:\Windows\System\MWIbCzE.exe
  2⤵
  PID:2956
- C:\Windows\System\xZOqcek.exe
  C:\Windows\System\xZOqcek.exe
  2⤵
  PID:5004
- C:\Windows\System\ghMYuOS.exe
  C:\Windows\System\ghMYuOS.exe
  2⤵
  PID:4340
- C:\Windows\System\EtImLOa.exe
  C:\Windows\System\EtImLOa.exe
  2⤵
  PID:4688
- C:\Windows\System\YVVVDxA.exe
  C:\Windows\System\YVVVDxA.exe
  2⤵
  PID:4888
- C:\Windows\System\SkRvUQM.exe
  C:\Windows\System\SkRvUQM.exe
  2⤵
  PID:5136
- C:\Windows\System\fVvmTeH.exe
  C:\Windows\System\fVvmTeH.exe
  2⤵
  PID:5152
- C:\Windows\System\rMZOvFG.exe
  C:\Windows\System\rMZOvFG.exe
  2⤵
  PID:5168
- C:\Windows\System\LvEVLUJ.exe
  C:\Windows\System\LvEVLUJ.exe
  2⤵
  PID:5188
- C:\Windows\System\veobkNn.exe
  C:\Windows\System\veobkNn.exe
  2⤵
  PID:5204
- C:\Windows\System\iSIaiCR.exe
  C:\Windows\System\iSIaiCR.exe
  2⤵
  PID:5224
- C:\Windows\System\vUFimha.exe
  C:\Windows\System\vUFimha.exe
  2⤵
  PID:5240
- C:\Windows\System\gURhpEV.exe
  C:\Windows\System\gURhpEV.exe
  2⤵
  PID:5256
- C:\Windows\System\YNZORCJ.exe
  C:\Windows\System\YNZORCJ.exe
  2⤵
  PID:5272
- C:\Windows\System\DHIvTPL.exe
  C:\Windows\System\DHIvTPL.exe
  2⤵
  PID:5292
- C:\Windows\System\TkUaplQ.exe
  C:\Windows\System\TkUaplQ.exe
  2⤵
  PID:5308
- C:\Windows\System\MvIRlTn.exe
  C:\Windows\System\MvIRlTn.exe
  2⤵
  PID:5324
- C:\Windows\System\zWuyNlH.exe
  C:\Windows\System\zWuyNlH.exe
  2⤵
  PID:5340
- C:\Windows\System\zqdsHhM.exe
  C:\Windows\System\zqdsHhM.exe
  2⤵
  PID:5360
- C:\Windows\System\AizALGl.exe
  C:\Windows\System\AizALGl.exe
  2⤵
  PID:5376
- C:\Windows\System\OUvwtVN.exe
  C:\Windows\System\OUvwtVN.exe
  2⤵
  PID:5392
- C:\Windows\System\zsUmane.exe
  C:\Windows\System\zsUmane.exe
  2⤵
  PID:5412
- C:\Windows\System\NfwNXMs.exe
  C:\Windows\System\NfwNXMs.exe
  2⤵
  PID:5428
- C:\Windows\System\TfbYMTA.exe
  C:\Windows\System\TfbYMTA.exe
  2⤵
  PID:5444
- C:\Windows\System\qemrEKD.exe
  C:\Windows\System\qemrEKD.exe
  2⤵
  PID:5460
- C:\Windows\System\YuIDxUM.exe
  C:\Windows\System\YuIDxUM.exe
  2⤵
  PID:5480
- C:\Windows\System\VYOGVHu.exe
  C:\Windows\System\VYOGVHu.exe
  2⤵
  PID:5508
- C:\Windows\System\xgLXaCC.exe
  C:\Windows\System\xgLXaCC.exe
  2⤵
  PID:5528
- C:\Windows\System\AoVyFYV.exe
  C:\Windows\System\AoVyFYV.exe
  2⤵
  PID:5588
- C:\Windows\System\hZkErpc.exe
  C:\Windows\System\hZkErpc.exe
  2⤵
  PID:5664
- C:\Windows\System\dlPiIaC.exe
  C:\Windows\System\dlPiIaC.exe
  2⤵
  PID:5696
- C:\Windows\System\qjEVLnT.exe
  C:\Windows\System\qjEVLnT.exe
  2⤵
  PID:5784
- C:\Windows\System\bJypQuc.exe
  C:\Windows\System\bJypQuc.exe
  2⤵
  PID:5820
- C:\Windows\System\UkAGZKQ.exe
  C:\Windows\System\UkAGZKQ.exe
  2⤵
  PID:5844
- C:\Windows\System\GUJhlnH.exe
  C:\Windows\System\GUJhlnH.exe
  2⤵
  PID:5872
- C:\Windows\System\FWIgdOF.exe
  C:\Windows\System\FWIgdOF.exe
  2⤵
  PID:5900
- C:\Windows\System\gnMnTia.exe
  C:\Windows\System\gnMnTia.exe
  2⤵
  PID:5916
- C:\Windows\System\SLrrckT.exe
  C:\Windows\System\SLrrckT.exe
  2⤵
  PID:5956
- C:\Windows\System\crixAoO.exe
  C:\Windows\System\crixAoO.exe
  2⤵
  PID:5972
- C:\Windows\System\tzKvzOw.exe
  C:\Windows\System\tzKvzOw.exe
  2⤵
  PID:5988
- C:\Windows\System\UkaIrFa.exe
  C:\Windows\System\UkaIrFa.exe
  2⤵
  PID:6004
- C:\Windows\System\ZPdJZUd.exe
  C:\Windows\System\ZPdJZUd.exe
  2⤵
  PID:6032
- C:\Windows\System\pwKmSQM.exe
  C:\Windows\System\pwKmSQM.exe
  2⤵
  PID:6052
- C:\Windows\System\aaQfGHk.exe
  C:\Windows\System\aaQfGHk.exe
  2⤵
  PID:6068
- C:\Windows\System\yjZJwff.exe
  C:\Windows\System\yjZJwff.exe
  2⤵
  PID:6084
- C:\Windows\System\HaIzLPO.exe
  C:\Windows\System\HaIzLPO.exe
  2⤵
  PID:6104
- C:\Windows\System\OmamxXP.exe
  C:\Windows\System\OmamxXP.exe
  2⤵
  PID:6120
- C:\Windows\System\ikkHIej.exe
  C:\Windows\System\ikkHIej.exe
  2⤵
  PID:4436
- C:\Windows\System\BmrtJif.exe
  C:\Windows\System\BmrtJif.exe
  2⤵
  PID:5148
- C:\Windows\System\wdPizxE.exe
  C:\Windows\System\wdPizxE.exe
  2⤵
  PID:5180
- C:\Windows\System\xLpfiSq.exe
  C:\Windows\System\xLpfiSq.exe
  2⤵
  PID:5216
- C:\Windows\System\djeTdKF.exe
  C:\Windows\System\djeTdKF.exe
  2⤵
  PID:5232
- C:\Windows\System\dpcwLwk.exe
  C:\Windows\System\dpcwLwk.exe
  2⤵
  PID:5280
- C:\Windows\System\zLWUaia.exe
  C:\Windows\System\zLWUaia.exe
  2⤵
  PID:5320
- C:\Windows\System\eJVmRkD.exe
  C:\Windows\System\eJVmRkD.exe
  2⤵
  PID:5356
- C:\Windows\System\ofkOnFH.exe
  C:\Windows\System\ofkOnFH.exe
  2⤵
  PID:5400
- C:\Windows\System\dVJWSAU.exe
  C:\Windows\System\dVJWSAU.exe
  2⤵
  PID:5408
- C:\Windows\System\PcflGfR.exe
  C:\Windows\System\PcflGfR.exe
  2⤵
  PID:5472
- C:\Windows\System\GbGtLjJ.exe
  C:\Windows\System\GbGtLjJ.exe
  2⤵
  PID:5488
- C:\Windows\System\tGzlgfU.exe
  C:\Windows\System\tGzlgfU.exe
  2⤵
  PID:5500
- C:\Windows\System\JClEzyq.exe
  C:\Windows\System\JClEzyq.exe
  2⤵
  PID:5516
- C:\Windows\System\wkPkWIH.exe
  C:\Windows\System\wkPkWIH.exe
  2⤵
  PID:5556
- C:\Windows\System\xOHzzek.exe
  C:\Windows\System\xOHzzek.exe
  2⤵
  PID:5704
- C:\Windows\System\rTbcMWI.exe
  C:\Windows\System\rTbcMWI.exe
  2⤵
  PID:5724
- C:\Windows\System\mwWhOYH.exe
  C:\Windows\System\mwWhOYH.exe
  2⤵
  PID:6040
- C:\Windows\System\WtAfFiH.exe
  C:\Windows\System\WtAfFiH.exe
  2⤵
  PID:6080
- C:\Windows\System\UUiclGQ.exe
  C:\Windows\System\UUiclGQ.exe
  2⤵
  PID:5184
- C:\Windows\System\YudHWpW.exe
  C:\Windows\System\YudHWpW.exe
  2⤵
  PID:5304
- C:\Windows\System\TaAdlWi.exe
  C:\Windows\System\TaAdlWi.exe
  2⤵
  PID:5896
- C:\Windows\System\ojefeUT.exe
  C:\Windows\System\ojefeUT.exe
  2⤵
  PID:5492
- C:\Windows\System\ihiFEvK.exe
  C:\Windows\System\ihiFEvK.exe
  2⤵
  PID:5928
- C:\Windows\System\nHOkbPA.exe
  C:\Windows\System\nHOkbPA.exe
  2⤵
  PID:5936
- C:\Windows\System\sIyiykq.exe
  C:\Windows\System\sIyiykq.exe
  2⤵
  PID:5952
- C:\Windows\System\cCqRYYQ.exe
  C:\Windows\System\cCqRYYQ.exe
  2⤵
  PID:5164
- C:\Windows\System\NmVGPTd.exe
  C:\Windows\System\NmVGPTd.exe
  2⤵
  PID:5436
- C:\Windows\System\avflJuQ.exe
  C:\Windows\System\avflJuQ.exe
  2⤵
  PID:6060
- C:\Windows\System\BGYPkpe.exe
  C:\Windows\System\BGYPkpe.exe
  2⤵
  PID:5612
- C:\Windows\System\MMEZQdt.exe
  C:\Windows\System\MMEZQdt.exe
  2⤵
  PID:5600
- C:\Windows\System\AChNeVS.exe
  C:\Windows\System\AChNeVS.exe
  2⤵
  PID:5316
- C:\Windows\System\kSpbCus.exe
  C:\Windows\System\kSpbCus.exe
  2⤵
  PID:5468
- C:\Windows\System\hcQhgul.exe
  C:\Windows\System\hcQhgul.exe
  2⤵
  PID:5636
- C:\Windows\System\NdkkqTN.exe
  C:\Windows\System\NdkkqTN.exe
  2⤵
  PID:5424
- C:\Windows\System\UqXbzJO.exe
  C:\Windows\System\UqXbzJO.exe
  2⤵
  PID:5548
- C:\Windows\System\qRxWdCO.exe
  C:\Windows\System\qRxWdCO.exe
  2⤵
  PID:5628
- C:\Windows\System\vhemREg.exe
  C:\Windows\System\vhemREg.exe
  2⤵
  PID:5684
- C:\Windows\System\GlNDucq.exe
  C:\Windows\System\GlNDucq.exe
  2⤵
  PID:5720
- C:\Windows\System\zBZTXcl.exe
  C:\Windows\System\zBZTXcl.exe
  2⤵
  PID:5752
- C:\Windows\System\OPxpnxg.exe
  C:\Windows\System\OPxpnxg.exe
  2⤵
  PID:5736
- C:\Windows\System\BxhxtKm.exe
  C:\Windows\System\BxhxtKm.exe
  2⤵
  PID:5804
- C:\Windows\System\juLjbVF.exe
  C:\Windows\System\juLjbVF.exe
  2⤵
  PID:5688
- C:\Windows\System\RSIPYVv.exe
  C:\Windows\System\RSIPYVv.exe
  2⤵
  PID:5864
- C:\Windows\System\xwpRyTu.exe
  C:\Windows\System\xwpRyTu.exe
  2⤵
  PID:5816
- C:\Windows\System\ttjVBfu.exe
  C:\Windows\System\ttjVBfu.exe
  2⤵
  PID:5964
- C:\Windows\System\nbRgJFe.exe
  C:\Windows\System\nbRgJFe.exe
  2⤵
  PID:5892
- C:\Windows\System\CKmgTMx.exe
  C:\Windows\System\CKmgTMx.exe
  2⤵
  PID:5888
- C:\Windows\System\IFyRqaR.exe
  C:\Windows\System\IFyRqaR.exe
  2⤵
  PID:5144
- C:\Windows\System\Jnekksy.exe
  C:\Windows\System\Jnekksy.exe
  2⤵
  PID:5564
- C:\Windows\System\QDTDBmt.exe
  C:\Windows\System\QDTDBmt.exe
  2⤵
  PID:5944
- C:\Windows\System\uAdOxoA.exe
  C:\Windows\System\uAdOxoA.exe
  2⤵
  PID:5176
- C:\Windows\System\jVRIHGu.exe
  C:\Windows\System\jVRIHGu.exe
  2⤵
  PID:6020
- C:\Windows\System\BhCJDWA.exe
  C:\Windows\System\BhCJDWA.exe
  2⤵
  PID:5980
- C:\Windows\System\yFMzIPj.exe
  C:\Windows\System\yFMzIPj.exe
  2⤵
  PID:5288
- C:\Windows\System\SkCjxRL.exe
  C:\Windows\System\SkCjxRL.exe
  2⤵
  PID:5620
- C:\Windows\System\ZFoRAJQ.exe
  C:\Windows\System\ZFoRAJQ.exe
  2⤵
  PID:5572
- C:\Windows\System\bbQwwUN.exe
  C:\Windows\System\bbQwwUN.exe
  2⤵
  PID:5672
- C:\Windows\System\IZzRrGi.exe
  C:\Windows\System\IZzRrGi.exe
  2⤵
  PID:5640
- C:\Windows\System\ligtGcx.exe
  C:\Windows\System\ligtGcx.exe
  2⤵
  PID:5728
- C:\Windows\System\JWMrSmm.exe
  C:\Windows\System\JWMrSmm.exe
  2⤵
  PID:5756
- C:\Windows\System\lhtjrdG.exe
  C:\Windows\System\lhtjrdG.exe
  2⤵
  PID:5852
- C:\Windows\System\esJKwHx.exe
  C:\Windows\System\esJKwHx.exe
  2⤵
  PID:6000
- C:\Windows\System\UyhmGPv.exe
  C:\Windows\System\UyhmGPv.exe
  2⤵
  PID:5352
- C:\Windows\System\gAMHfFb.exe
  C:\Windows\System\gAMHfFb.exe
  2⤵
  PID:5716
- C:\Windows\System\SISNxyw.exe
  C:\Windows\System\SISNxyw.exe
  2⤵
  PID:5604
- C:\Windows\System\QEiMIHV.exe
  C:\Windows\System\QEiMIHV.exe
  2⤵
  PID:5544
- C:\Windows\System\SXBPagk.exe
  C:\Windows\System\SXBPagk.exe
  2⤵
  PID:6044
- C:\Windows\System\FEQIJCI.exe
  C:\Windows\System\FEQIJCI.exe
  2⤵
  PID:5796
- C:\Windows\System\yIbspqv.exe
  C:\Windows\System\yIbspqv.exe
  2⤵
  PID:5840
- C:\Windows\System\FvHMtLU.exe
  C:\Windows\System\FvHMtLU.exe
  2⤵
  PID:5568
- C:\Windows\System\LeDkhVH.exe
  C:\Windows\System\LeDkhVH.exe
  2⤵
  PID:5932
- C:\Windows\System\BnoDqEt.exe
  C:\Windows\System\BnoDqEt.exe
  2⤵
  PID:5536
- C:\Windows\System\xDRnhtV.exe
  C:\Windows\System\xDRnhtV.exe
  2⤵
  PID:6148
- C:\Windows\System\WldbeHf.exe
  C:\Windows\System\WldbeHf.exe
  2⤵
  PID:6164
- C:\Windows\System\gcwBBMU.exe
  C:\Windows\System\gcwBBMU.exe
  2⤵
  PID:6184
- C:\Windows\System\FebcIKH.exe
  C:\Windows\System\FebcIKH.exe
  2⤵
  PID:6252
- C:\Windows\System\hSBnLRh.exe
  C:\Windows\System\hSBnLRh.exe
  2⤵
  PID:6268
- C:\Windows\System\WmPRJOx.exe
  C:\Windows\System\WmPRJOx.exe
  2⤵
  PID:6284
- C:\Windows\System\fMVrwPq.exe
  C:\Windows\System\fMVrwPq.exe
  2⤵
  PID:6300
- C:\Windows\System\Kmkixza.exe
  C:\Windows\System\Kmkixza.exe
  2⤵
  PID:6316
- C:\Windows\System\HSdJrgt.exe
  C:\Windows\System\HSdJrgt.exe
  2⤵
  PID:6348
- C:\Windows\System\yctEkHy.exe
  C:\Windows\System\yctEkHy.exe
  2⤵
  PID:6364
- C:\Windows\System\gYTalBE.exe
  C:\Windows\System\gYTalBE.exe
  2⤵
  PID:6380
- C:\Windows\System\gHLWHoZ.exe
  C:\Windows\System\gHLWHoZ.exe
  2⤵
  PID:6396
- C:\Windows\System\UuVxrNx.exe
  C:\Windows\System\UuVxrNx.exe
  2⤵
  PID:6412
- C:\Windows\System\ZMSaxrf.exe
  C:\Windows\System\ZMSaxrf.exe
  2⤵
  PID:6448
- C:\Windows\System\LZXQUBS.exe
  C:\Windows\System\LZXQUBS.exe
  2⤵
  PID:6468
- C:\Windows\System\JKxWQoG.exe
  C:\Windows\System\JKxWQoG.exe
  2⤵
  PID:6484
- C:\Windows\System\ZCxtGjD.exe
  C:\Windows\System\ZCxtGjD.exe
  2⤵
  PID:6500
- C:\Windows\System\fqHPsRh.exe
  C:\Windows\System\fqHPsRh.exe
  2⤵
  PID:6516
- C:\Windows\System\TjTQOWH.exe
  C:\Windows\System\TjTQOWH.exe
  2⤵
  PID:6532
- C:\Windows\System\NTqCJvi.exe
  C:\Windows\System\NTqCJvi.exe
  2⤵
  PID:6552
- C:\Windows\System\LrWpDEj.exe
  C:\Windows\System\LrWpDEj.exe
  2⤵
  PID:6568
- C:\Windows\System\rHgdVOr.exe
  C:\Windows\System\rHgdVOr.exe
  2⤵
  PID:6588
- C:\Windows\System\bowTJwm.exe
  C:\Windows\System\bowTJwm.exe
  2⤵
  PID:6604
- C:\Windows\System\XvNpXYp.exe
  C:\Windows\System\XvNpXYp.exe
  2⤵
  PID:6620
- C:\Windows\System\ayBKRUB.exe
  C:\Windows\System\ayBKRUB.exe
  2⤵
  PID:6640
- C:\Windows\System\pzVCDxZ.exe
  C:\Windows\System\pzVCDxZ.exe
  2⤵
  PID:6656
- C:\Windows\System\lvFUEzz.exe
  C:\Windows\System\lvFUEzz.exe
  2⤵
  PID:6672
- C:\Windows\System\IVIFQxj.exe
  C:\Windows\System\IVIFQxj.exe
  2⤵
  PID:6688
- C:\Windows\System\yRMUZpD.exe
  C:\Windows\System\yRMUZpD.exe
  2⤵
  PID:6704
- C:\Windows\System\GsbWXUk.exe
  C:\Windows\System\GsbWXUk.exe
  2⤵
  PID:6720
- C:\Windows\System\GyApflA.exe
  C:\Windows\System\GyApflA.exe
  2⤵
  PID:6740
- C:\Windows\System\yOHuGwE.exe
  C:\Windows\System\yOHuGwE.exe
  2⤵
  PID:6756
- C:\Windows\System\XJtNPqU.exe
  C:\Windows\System\XJtNPqU.exe
  2⤵
  PID:6772
- C:\Windows\System\MpZDlwD.exe
  C:\Windows\System\MpZDlwD.exe
  2⤵
  PID:6788
- C:\Windows\System\FOrlBhb.exe
  C:\Windows\System\FOrlBhb.exe
  2⤵
  PID:6812
- C:\Windows\System\BBkNXXY.exe
  C:\Windows\System\BBkNXXY.exe
  2⤵
  PID:6828
- C:\Windows\System\UtxsVrz.exe
  C:\Windows\System\UtxsVrz.exe
  2⤵
  PID:6844
- C:\Windows\System\NdfGGFP.exe
  C:\Windows\System\NdfGGFP.exe
  2⤵
  PID:6864
- C:\Windows\System\geYLicA.exe
  C:\Windows\System\geYLicA.exe
  2⤵
  PID:6880
- C:\Windows\System\wWKMdCL.exe
  C:\Windows\System\wWKMdCL.exe
  2⤵
  PID:6900
- C:\Windows\System\GSvNeKf.exe
  C:\Windows\System\GSvNeKf.exe
  2⤵
  PID:6916
- C:\Windows\System\yOyQcQS.exe
  C:\Windows\System\yOyQcQS.exe
  2⤵
  PID:6936
- C:\Windows\System\WklRWpk.exe
  C:\Windows\System\WklRWpk.exe
  2⤵
  PID:6952
- C:\Windows\System\sVrevgu.exe
  C:\Windows\System\sVrevgu.exe
  2⤵
  PID:6972
- C:\Windows\System\TDOXCzD.exe
  C:\Windows\System\TDOXCzD.exe
  2⤵
  PID:6988
- C:\Windows\System\VMlMeat.exe
  C:\Windows\System\VMlMeat.exe
  2⤵
  PID:7004
- C:\Windows\System\KXhmWLW.exe
  C:\Windows\System\KXhmWLW.exe
  2⤵
  PID:7024
- C:\Windows\System\ODVjDas.exe
  C:\Windows\System\ODVjDas.exe
  2⤵
  PID:7040
- C:\Windows\System\NkTGrzL.exe
  C:\Windows\System\NkTGrzL.exe
  2⤵
  PID:7056
- C:\Windows\System\gKPCJBz.exe
  C:\Windows\System\gKPCJBz.exe
  2⤵
  PID:7076
- C:\Windows\System\deCnrkF.exe
  C:\Windows\System\deCnrkF.exe
  2⤵
  PID:7092
- C:\Windows\System\EiRlbQH.exe
  C:\Windows\System\EiRlbQH.exe
  2⤵
  PID:7108
- C:\Windows\System\qtMSJVW.exe
  C:\Windows\System\qtMSJVW.exe
  2⤵
  PID:7128
- C:\Windows\System\ZFsoyGH.exe
  C:\Windows\System\ZFsoyGH.exe
  2⤵
  PID:7144
- C:\Windows\System\MOAHeln.exe
  C:\Windows\System\MOAHeln.exe
  2⤵
  PID:5624
- C:\Windows\System\nqnDNqw.exe
  C:\Windows\System\nqnDNqw.exe
  2⤵
  PID:6180
- C:\Windows\System\HKxEOqk.exe
  C:\Windows\System\HKxEOqk.exe
  2⤵
  PID:5616
- C:\Windows\System\fVVacCq.exe
  C:\Windows\System\fVVacCq.exe
  2⤵
  PID:6216
- C:\Windows\System\KZJylck.exe
  C:\Windows\System\KZJylck.exe
  2⤵
  PID:6232
- C:\Windows\System\EfIXnti.exe
  C:\Windows\System\EfIXnti.exe
  2⤵
  PID:6248
- C:\Windows\System\ClEUqlr.exe
  C:\Windows\System\ClEUqlr.exe
  2⤵
  PID:6296
- C:\Windows\System\WpdqNLX.exe
  C:\Windows\System\WpdqNLX.exe
  2⤵
  PID:6308
- C:\Windows\System\hXgWoiH.exe
  C:\Windows\System\hXgWoiH.exe
  2⤵
  PID:6344
- C:\Windows\System\dFmsRUs.exe
  C:\Windows\System\dFmsRUs.exe
  2⤵
  PID:6360
- C:\Windows\System\hOpePAA.exe
  C:\Windows\System\hOpePAA.exe
  2⤵
  PID:6408
- C:\Windows\System\XyOeKpS.exe
  C:\Windows\System\XyOeKpS.exe
  2⤵
  PID:6392
- C:\Windows\System\KjkDVoB.exe
  C:\Windows\System\KjkDVoB.exe
  2⤵
  PID:6444
- C:\Windows\System\FMgxTHk.exe
  C:\Windows\System\FMgxTHk.exe
  2⤵
  PID:6464
- C:\Windows\System\yKgynip.exe
  C:\Windows\System\yKgynip.exe
  2⤵
  PID:6548
- C:\Windows\System\QlLxzml.exe
  C:\Windows\System\QlLxzml.exe
  2⤵
  PID:6580
- C:\Windows\System\auOHpVi.exe
  C:\Windows\System\auOHpVi.exe
  2⤵
  PID:6648
- C:\Windows\System\ToAQmWM.exe
  C:\Windows\System\ToAQmWM.exe
  2⤵
  PID:6748
- C:\Windows\System\hBMnOjJ.exe
  C:\Windows\System\hBMnOjJ.exe
  2⤵
  PID:7032
- C:\Windows\System\OaJNkda.exe
  C:\Windows\System\OaJNkda.exe
  2⤵
  PID:7104
- C:\Windows\System\fdSCHjn.exe
  C:\Windows\System\fdSCHjn.exe
  2⤵
  PID:7036
- C:\Windows\System\DepgFee.exe
  C:\Windows\System\DepgFee.exe
  2⤵
  PID:7136
- C:\Windows\System\vNhlsgM.exe
  C:\Windows\System\vNhlsgM.exe
  2⤵
  PID:6732
- C:\Windows\System\SOAaJJf.exe
  C:\Windows\System\SOAaJJf.exe
  2⤵
  PID:6796
- C:\Windows\System\aNfXREX.exe
  C:\Windows\System\aNfXREX.exe
  2⤵
  PID:6836
- C:\Windows\System\tvPwzZp.exe
  C:\Windows\System\tvPwzZp.exe
  2⤵
  PID:6564
- C:\Windows\System\JVwWkdd.exe
  C:\Windows\System\JVwWkdd.exe
  2⤵
  PID:5348
- C:\Windows\System\IoatQee.exe
  C:\Windows\System\IoatQee.exe
  2⤵
  PID:7048
- C:\Windows\System\EKhpaVw.exe
  C:\Windows\System\EKhpaVw.exe
  2⤵
  PID:7120
- C:\Windows\System\codFrea.exe
  C:\Windows\System\codFrea.exe
  2⤵
  PID:7020
- C:\Windows\System\XkPIewt.exe
  C:\Windows\System\XkPIewt.exe
  2⤵
  PID:7152
- C:\Windows\System\pwdUMqY.exe
  C:\Windows\System\pwdUMqY.exe
  2⤵
  PID:6664
- C:\Windows\System\UpFFrtu.exe
  C:\Windows\System\UpFFrtu.exe
  2⤵
  PID:5540
- C:\Windows\System\nXDffbe.exe
  C:\Windows\System\nXDffbe.exe
  2⤵
  PID:5132
- C:\Windows\System\yYWGDEQ.exe
  C:\Windows\System\yYWGDEQ.exe
  2⤵
  PID:6196
- C:\Windows\System\qQtAfVV.exe
  C:\Windows\System\qQtAfVV.exe
  2⤵
  PID:6212
- C:\Windows\System\NlXcMhP.exe
  C:\Windows\System\NlXcMhP.exe
  2⤵
  PID:6224
- C:\Windows\System\ZCXfkQh.exe
  C:\Windows\System\ZCXfkQh.exe
  2⤵
  PID:6328
- C:\Windows\System\qIYOQKY.exe
  C:\Windows\System\qIYOQKY.exe
  2⤵
  PID:6456
- C:\Windows\System\scebWfR.exe
  C:\Windows\System\scebWfR.exe
  2⤵
  PID:6264
- C:\Windows\System\kdWjuIK.exe
  C:\Windows\System\kdWjuIK.exe
  2⤵
  PID:6376
- C:\Windows\System\kwukxNl.exe
  C:\Windows\System\kwukxNl.exe
  2⤵
  PID:6480
- C:\Windows\System\RDOeDBJ.exe
  C:\Windows\System\RDOeDBJ.exe
  2⤵
  PID:6544
- C:\Windows\System\KjZvioW.exe
  C:\Windows\System\KjZvioW.exe
  2⤵
  PID:6896
- C:\Windows\System\dCyGIpK.exe
  C:\Windows\System\dCyGIpK.exe
  2⤵
  PID:6712
- C:\Windows\System\skDEmCR.exe
  C:\Windows\System\skDEmCR.exe
  2⤵
  PID:7100
- C:\Windows\System\cwpAlAa.exe
  C:\Windows\System\cwpAlAa.exe
  2⤵
  PID:6764
- C:\Windows\System\ThOeQjb.exe
  C:\Windows\System\ThOeQjb.exe
  2⤵
  PID:6876
- C:\Windows\System\IRgZgMM.exe
  C:\Windows\System\IRgZgMM.exe
  2⤵
  PID:7088
- C:\Windows\System\uxdgTjB.exe
  C:\Windows\System\uxdgTjB.exe
  2⤵
  PID:6700
- C:\Windows\System\HOowaKf.exe
  C:\Windows\System\HOowaKf.exe
  2⤵
  PID:6860
- C:\Windows\System\OITxXfU.exe
  C:\Windows\System\OITxXfU.exe
  2⤵
  PID:7164
- C:\Windows\System\dayKkde.exe
  C:\Windows\System\dayKkde.exe
  2⤵
  PID:6912
- C:\Windows\System\dWiDopE.exe
  C:\Windows\System\dWiDopE.exe
  2⤵
  PID:5160
- C:\Windows\System\OgJVhRm.exe
  C:\Windows\System\OgJVhRm.exe
  2⤵
  PID:6160
- C:\Windows\System\cpakqIV.exe
  C:\Windows\System\cpakqIV.exe
  2⤵
  PID:6428
- C:\Windows\System\oKmqyXZ.exe
  C:\Windows\System\oKmqyXZ.exe
  2⤵
  PID:6208
- C:\Windows\System\gIstbgq.exe
  C:\Windows\System\gIstbgq.exe
  2⤵
  PID:5832
- C:\Windows\System\DqrnYNL.exe
  C:\Windows\System\DqrnYNL.exe
  2⤵
  PID:6200
- C:\Windows\System\dNlWrNx.exe
  C:\Windows\System\dNlWrNx.exe
  2⤵
  PID:6512
- C:\Windows\System\RTcqqmE.exe
  C:\Windows\System\RTcqqmE.exe
  2⤵
  PID:6628
- C:\Windows\System\mkGFplb.exe
  C:\Windows\System\mkGFplb.exe
  2⤵
  PID:6784
- C:\Windows\System\hxiEUVe.exe
  C:\Windows\System\hxiEUVe.exe
  2⤵
  PID:6996
- C:\Windows\System\HmXEpEv.exe
  C:\Windows\System\HmXEpEv.exe
  2⤵
  PID:6048
- C:\Windows\System\iZlPjwo.exe
  C:\Windows\System\iZlPjwo.exe
  2⤵
  PID:6964
- C:\Windows\System\owgfkba.exe
  C:\Windows\System\owgfkba.exe
  2⤵
  PID:7016
- C:\Windows\System\jREppsm.exe
  C:\Windows\System\jREppsm.exe
  2⤵
  PID:5912
- C:\Windows\System\rWJkkSI.exe
  C:\Windows\System\rWJkkSI.exe
  2⤵
  PID:7180
- C:\Windows\System\OwWCFLD.exe
  C:\Windows\System\OwWCFLD.exe
  2⤵
  PID:7200
- C:\Windows\System\DebETXu.exe
  C:\Windows\System\DebETXu.exe
  2⤵
  PID:7216
- C:\Windows\System\jiogfRk.exe
  C:\Windows\System\jiogfRk.exe
  2⤵
  PID:7232
- C:\Windows\System\evYOjhi.exe
  C:\Windows\System\evYOjhi.exe
  2⤵
  PID:7252
- C:\Windows\System\RKjMHtl.exe
  C:\Windows\System\RKjMHtl.exe
  2⤵
  PID:7268
- C:\Windows\System\SHjJXFY.exe
  C:\Windows\System\SHjJXFY.exe
  2⤵
  PID:7284
- C:\Windows\System\dWqTuza.exe
  C:\Windows\System\dWqTuza.exe
  2⤵
  PID:7304
- C:\Windows\System\qJBkNnF.exe
  C:\Windows\System\qJBkNnF.exe
  2⤵
  PID:7324
- C:\Windows\System\vabPOvp.exe
  C:\Windows\System\vabPOvp.exe
  2⤵
  PID:7340
- C:\Windows\System\ArqBTYF.exe
  C:\Windows\System\ArqBTYF.exe
  2⤵
  PID:7360
- C:\Windows\System\ZdxqyvN.exe
  C:\Windows\System\ZdxqyvN.exe
  2⤵
  PID:7376
- C:\Windows\System\dSAKKOE.exe
  C:\Windows\System\dSAKKOE.exe
  2⤵
  PID:7392
- C:\Windows\System\niyMhcC.exe
  C:\Windows\System\niyMhcC.exe
  2⤵
  PID:7412
- C:\Windows\System\ZiimiSL.exe
  C:\Windows\System\ZiimiSL.exe
  2⤵
  PID:7432
- C:\Windows\System\OioEaVI.exe
  C:\Windows\System\OioEaVI.exe
  2⤵
  PID:7456
- C:\Windows\System\JXMqroy.exe
  C:\Windows\System\JXMqroy.exe
  2⤵
  PID:7472
- C:\Windows\System\KjxcWpR.exe
  C:\Windows\System\KjxcWpR.exe
  2⤵
  PID:7488
- C:\Windows\System\SWYfhqF.exe
  C:\Windows\System\SWYfhqF.exe
  2⤵
  PID:7504
- C:\Windows\System\nrLVlFP.exe
  C:\Windows\System\nrLVlFP.exe
  2⤵
  PID:7520
- C:\Windows\System\SJFRoPh.exe
  C:\Windows\System\SJFRoPh.exe
  2⤵
  PID:7536
- C:\Windows\System\zHOaYgk.exe
  C:\Windows\System\zHOaYgk.exe
  2⤵
  PID:7552
- C:\Windows\System\iUsHPbB.exe
  C:\Windows\System\iUsHPbB.exe
  2⤵
  PID:7568
- C:\Windows\System\wqAZbmv.exe
  C:\Windows\System\wqAZbmv.exe
  2⤵
  PID:7584
- C:\Windows\System\GOgcnpx.exe
  C:\Windows\System\GOgcnpx.exe
  2⤵
  PID:7600
- C:\Windows\System\iZMfQXA.exe
  C:\Windows\System\iZMfQXA.exe
  2⤵
  PID:7616
- C:\Windows\System\emhWSBp.exe
  C:\Windows\System\emhWSBp.exe
  2⤵
  PID:7632
- C:\Windows\System\EvyKAps.exe
  C:\Windows\System\EvyKAps.exe
  2⤵
  PID:7648
- C:\Windows\System\LGKcgqo.exe
  C:\Windows\System\LGKcgqo.exe
  2⤵
  PID:7664
- C:\Windows\System\qZWMhCw.exe
  C:\Windows\System\qZWMhCw.exe
  2⤵
  PID:7680
- C:\Windows\System\tWjljbk.exe
  C:\Windows\System\tWjljbk.exe
  2⤵
  PID:7696
- C:\Windows\System\qsIEHoq.exe
  C:\Windows\System\qsIEHoq.exe
  2⤵
  PID:7712
- C:\Windows\System\dEfGDlh.exe
  C:\Windows\System\dEfGDlh.exe
  2⤵
  PID:7728
- C:\Windows\System\ZtTVAOB.exe
  C:\Windows\System\ZtTVAOB.exe
  2⤵
  PID:7744
- C:\Windows\System\WcMrreD.exe
  C:\Windows\System\WcMrreD.exe
  2⤵
  PID:7760
- C:\Windows\System\IefYzls.exe
  C:\Windows\System\IefYzls.exe
  2⤵
  PID:7776
- C:\Windows\System\DhVqXhp.exe
  C:\Windows\System\DhVqXhp.exe
  2⤵
  PID:7792
- C:\Windows\System\epCJUvu.exe
  C:\Windows\System\epCJUvu.exe
  2⤵
  PID:7808
- C:\Windows\System\wSZdTar.exe
  C:\Windows\System\wSZdTar.exe
  2⤵
  PID:7824
- C:\Windows\System\GuHutTk.exe
  C:\Windows\System\GuHutTk.exe
  2⤵
  PID:7840
- C:\Windows\System\pMzcbll.exe
  C:\Windows\System\pMzcbll.exe
  2⤵
  PID:7856
- C:\Windows\System\AEvVwgz.exe
  C:\Windows\System\AEvVwgz.exe
  2⤵
  PID:7872
- C:\Windows\System\PrrcDVw.exe
  C:\Windows\System\PrrcDVw.exe
  2⤵
  PID:7888
- C:\Windows\System\JfMrEPQ.exe
  C:\Windows\System\JfMrEPQ.exe
  2⤵
  PID:7904
- C:\Windows\System\sOGEAQF.exe
  C:\Windows\System\sOGEAQF.exe
  2⤵
  PID:7920
- C:\Windows\System\WfTIqCY.exe
  C:\Windows\System\WfTIqCY.exe
  2⤵
  PID:7936
- C:\Windows\System\FkKFhiY.exe
  C:\Windows\System\FkKFhiY.exe
  2⤵
  PID:7952
- C:\Windows\System\EDaxvmx.exe
  C:\Windows\System\EDaxvmx.exe
  2⤵
  PID:7968
- C:\Windows\System\PpHfeTX.exe
  C:\Windows\System\PpHfeTX.exe
  2⤵
  PID:7988
- C:\Windows\System\QUTZYXX.exe
  C:\Windows\System\QUTZYXX.exe
  2⤵
  PID:8004
- C:\Windows\System\OplVKqt.exe
  C:\Windows\System\OplVKqt.exe
  2⤵
  PID:8020
- C:\Windows\System\rUXXEsC.exe
  C:\Windows\System\rUXXEsC.exe
  2⤵
  PID:8036
- C:\Windows\System\umhqbFx.exe
  C:\Windows\System\umhqbFx.exe
  2⤵
  PID:8052
- C:\Windows\System\rgClBLd.exe
  C:\Windows\System\rgClBLd.exe
  2⤵
  PID:8072
- C:\Windows\System\cxKcWfM.exe
  C:\Windows\System\cxKcWfM.exe
  2⤵
  PID:8088
- C:\Windows\System\xZrNqeO.exe
  C:\Windows\System\xZrNqeO.exe
  2⤵
  PID:8104
- C:\Windows\System\wADGAuQ.exe
  C:\Windows\System\wADGAuQ.exe
  2⤵
  PID:8120
- C:\Windows\System\AtQwjQJ.exe
  C:\Windows\System\AtQwjQJ.exe
  2⤵
  PID:8136
- C:\Windows\System\EroTtFp.exe
  C:\Windows\System\EroTtFp.exe
  2⤵
  PID:8156
- C:\Windows\System\JYWiyzD.exe
  C:\Windows\System\JYWiyzD.exe
  2⤵
  PID:8172
- C:\Windows\System\NcWOadS.exe
  C:\Windows\System\NcWOadS.exe
  2⤵
  PID:8188
- C:\Windows\System\lHogXwR.exe
  C:\Windows\System\lHogXwR.exe
  2⤵
  PID:6476
- C:\Windows\System\HhUnKiU.exe
  C:\Windows\System\HhUnKiU.exe
  2⤵
  PID:6612
- C:\Windows\System\qmcgSGT.exe
  C:\Windows\System\qmcgSGT.exe
  2⤵
  PID:6824
- C:\Windows\System\ARNGYDT.exe
  C:\Windows\System\ARNGYDT.exe
  2⤵
  PID:7176
- C:\Windows\System\ekYlCuF.exe
  C:\Windows\System\ekYlCuF.exe
  2⤵
  PID:7316
- C:\Windows\System\mXQLMcx.exe
  C:\Windows\System\mXQLMcx.exe
  2⤵
  PID:7248
- C:\Windows\System\hmipgzN.exe
  C:\Windows\System\hmipgzN.exe
  2⤵
  PID:7424
- C:\Windows\System\yTwcSHb.exe
  C:\Windows\System\yTwcSHb.exe
  2⤵
  PID:7352
- C:\Windows\System\bdseaZy.exe
  C:\Windows\System\bdseaZy.exe
  2⤵
  PID:5268
- C:\Windows\System\IEXPdTo.exe
  C:\Windows\System\IEXPdTo.exe
  2⤵
  PID:7156
- C:\Windows\System\tLEauYa.exe
  C:\Windows\System\tLEauYa.exe
  2⤵
  PID:6100
- C:\Windows\System\zsDmwTE.exe
  C:\Windows\System\zsDmwTE.exe
  2⤵
  PID:6596
- C:\Windows\System\sOEdtuI.exe
  C:\Windows\System\sOEdtuI.exe
  2⤵
  PID:7072
- C:\Windows\System\DnMrsYb.exe
  C:\Windows\System\DnMrsYb.exe
  2⤵
  PID:7192
- C:\Windows\System\RKlBluG.exe
  C:\Windows\System\RKlBluG.exe
  2⤵
  PID:7264
- C:\Windows\System\mXmdeVW.exe
  C:\Windows\System\mXmdeVW.exe
  2⤵
  PID:7300
- C:\Windows\System\aykkJti.exe
  C:\Windows\System\aykkJti.exe
  2⤵
  PID:7372
- C:\Windows\System\RmLUenO.exe
  C:\Windows\System\RmLUenO.exe
  2⤵
  PID:7408
- C:\Windows\System\yUQuBmt.exe
  C:\Windows\System\yUQuBmt.exe
  2⤵
  PID:7500
- C:\Windows\System\tUVXuBf.exe
  C:\Windows\System\tUVXuBf.exe
  2⤵
  PID:7564
- C:\Windows\System\NWpILxB.exe
  C:\Windows\System\NWpILxB.exe
  2⤵
  PID:7448
- C:\Windows\System\JTYBjjc.exe
  C:\Windows\System\JTYBjjc.exe
  2⤵
  PID:7516
- C:\Windows\System\xJolKXQ.exe
  C:\Windows\System\xJolKXQ.exe
  2⤵
  PID:7580
- C:\Windows\System\PdEeszp.exe
  C:\Windows\System\PdEeszp.exe
  2⤵
  PID:7644
- C:\Windows\System\VgHakVa.exe
  C:\Windows\System\VgHakVa.exe
  2⤵
  PID:7688
- C:\Windows\System\tvLFaix.exe
  C:\Windows\System\tvLFaix.exe
  2⤵
  PID:7724
- C:\Windows\System\QgJzMnj.exe
  C:\Windows\System\QgJzMnj.exe
  2⤵
  PID:7756
- C:\Windows\System\iCleGlX.exe
  C:\Windows\System\iCleGlX.exe
  2⤵
  PID:7788
- C:\Windows\System\rSIUHYm.exe
  C:\Windows\System\rSIUHYm.exe
  2⤵
  PID:7772
- C:\Windows\System\QmtNTWD.exe
  C:\Windows\System\QmtNTWD.exe
  2⤵
  PID:7832
- C:\Windows\System\XSfhyjz.exe
  C:\Windows\System\XSfhyjz.exe
  2⤵
  PID:7884
- C:\Windows\System\VpQnaBS.exe
  C:\Windows\System\VpQnaBS.exe
  2⤵
  PID:7896
- C:\Windows\System\WxNKHNJ.exe
  C:\Windows\System\WxNKHNJ.exe
  2⤵
  PID:7932
- C:\Windows\System\osXMzYH.exe
  C:\Windows\System\osXMzYH.exe
  2⤵
  PID:7964
- C:\Windows\System\xFeAEUC.exe
  C:\Windows\System\xFeAEUC.exe
  2⤵
  PID:7980
- C:\Windows\System\JnLMbbn.exe
  C:\Windows\System\JnLMbbn.exe
  2⤵
  PID:8028
- C:\Windows\System\tVftnby.exe
  C:\Windows\System\tVftnby.exe
  2⤵
  PID:8064
- C:\Windows\System\WbIGWGb.exe
  C:\Windows\System\WbIGWGb.exe
  2⤵
  PID:8112
- C:\Windows\System\HAZCOBe.exe
  C:\Windows\System\HAZCOBe.exe
  2⤵
  PID:8144
- C:\Windows\System\NQAkJjn.exe
  C:\Windows\System\NQAkJjn.exe
  2⤵
  PID:8164
- C:\Windows\System\jDZLHHG.exe
  C:\Windows\System\jDZLHHG.exe
  2⤵
  PID:6600
- C:\Windows\System\tSWTBtW.exe
  C:\Windows\System\tSWTBtW.exe
  2⤵
  PID:5236
- C:\Windows\System\kOVAZtt.exe
  C:\Windows\System\kOVAZtt.exe
  2⤵
  PID:7464
- C:\Windows\System\DxBIMXW.exe
  C:\Windows\System\DxBIMXW.exe
  2⤵
  PID:7480
- C:\Windows\System\PzrDORf.exe
  C:\Windows\System\PzrDORf.exe
  2⤵
  PID:7628
- C:\Windows\System\eAkPtui.exe
  C:\Windows\System\eAkPtui.exe
  2⤵
  PID:7576
- C:\Windows\System\NspLnSI.exe
  C:\Windows\System\NspLnSI.exe
  2⤵
  PID:7656
- C:\Windows\System\JBqRZhq.exe
  C:\Windows\System\JBqRZhq.exe
  2⤵
  PID:7624
- C:\Windows\System\yYBukdF.exe
  C:\Windows\System\yYBukdF.exe
  2⤵
  PID:7784
- C:\Windows\System\BvXBjlM.exe
  C:\Windows\System\BvXBjlM.exe
  2⤵
  PID:7868
- C:\Windows\System\QlBBGZW.exe
  C:\Windows\System\QlBBGZW.exe
  2⤵
  PID:8000
- C:\Windows\System\WdhANAC.exe
  C:\Windows\System\WdhANAC.exe
  2⤵
  PID:8096
- C:\Windows\System\SQqiGtb.exe
  C:\Windows\System\SQqiGtb.exe
  2⤵
  PID:7820
- C:\Windows\System\OUVCbdh.exe
  C:\Windows\System\OUVCbdh.exe
  2⤵
  PID:8084
- C:\Windows\System\GjneWcH.exe
  C:\Windows\System\GjneWcH.exe
  2⤵
  PID:8180
- C:\Windows\System\wNbaKlr.exe
  C:\Windows\System\wNbaKlr.exe
  2⤵
  PID:6440
- C:\Windows\System\wFtgVBF.exe
  C:\Windows\System\wFtgVBF.exe
  2⤵
  PID:6176
- C:\Windows\System\GYbSZnC.exe
  C:\Windows\System\GYbSZnC.exe
  2⤵
  PID:7420
- C:\Windows\System\qJgCmCH.exe
  C:\Windows\System\qJgCmCH.exe
  2⤵
  PID:5440
- C:\Windows\System\JzrPwFL.exe
  C:\Windows\System\JzrPwFL.exe
  2⤵
  PID:6028
- C:\Windows\System\ekMItQg.exe
  C:\Windows\System\ekMItQg.exe
  2⤵
  PID:7532
- C:\Windows\System\JHTXnUW.exe
  C:\Windows\System\JHTXnUW.exe
  2⤵
  PID:7548
- C:\Windows\System\OrVdnxc.exe
  C:\Windows\System\OrVdnxc.exe
  2⤵
  PID:7224
- C:\Windows\System\nnCNRNA.exe
  C:\Windows\System\nnCNRNA.exe
  2⤵
  PID:7660
- C:\Windows\System\ykbMCdj.exe
  C:\Windows\System\ykbMCdj.exe
  2⤵
  PID:7912
- C:\Windows\System\bZzrjin.exe
  C:\Windows\System\bZzrjin.exe
  2⤵
  PID:7996
- C:\Windows\System\GjtloWK.exe
  C:\Windows\System\GjtloWK.exe
  2⤵
  PID:7768
- C:\Windows\System\rsDcIVD.exe
  C:\Windows\System\rsDcIVD.exe
  2⤵
  PID:8132
- C:\Windows\System\eBGpGwt.exe
  C:\Windows\System\eBGpGwt.exe
  2⤵
  PID:6888
- C:\Windows\System\YJRYPcG.exe
  C:\Windows\System\YJRYPcG.exe
  2⤵
  PID:7348
- C:\Windows\System\Kwvxotr.exe
  C:\Windows\System\Kwvxotr.exe
  2⤵
  PID:7388
- C:\Windows\System\qwIJwUe.exe
  C:\Windows\System\qwIJwUe.exe
  2⤵
  PID:6856
- C:\Windows\System\qCRFESN.exe
  C:\Windows\System\qCRFESN.exe
  2⤵
  PID:7672
- C:\Windows\System\ksNYjus.exe
  C:\Windows\System\ksNYjus.exe
  2⤵
  PID:7260
- C:\Windows\System\MCWHMZN.exe
  C:\Windows\System\MCWHMZN.exe
  2⤵
  PID:6636
- C:\Windows\System\tuIVfrp.exe
  C:\Windows\System\tuIVfrp.exe
  2⤵
  PID:7296
- C:\Windows\System\hUJqqLZ.exe
  C:\Windows\System\hUJqqLZ.exe
  2⤵
  PID:7000
- C:\Windows\System\pUfKjnd.exe
  C:\Windows\System\pUfKjnd.exe
  2⤵
  PID:6388
- C:\Windows\System\YjrFkmI.exe
  C:\Windows\System\YjrFkmI.exe
  2⤵
  PID:8048
- C:\Windows\System\nWwyYjW.exe
  C:\Windows\System\nWwyYjW.exe
  2⤵
  PID:7312
- C:\Windows\System\ytVhYuE.exe
  C:\Windows\System\ytVhYuE.exe
  2⤵
  PID:7752
- C:\Windows\System\WOePVRy.exe
  C:\Windows\System\WOePVRy.exe
  2⤵
  PID:8204
- C:\Windows\System\vnFPYfZ.exe
  C:\Windows\System\vnFPYfZ.exe
  2⤵
  PID:8220
- C:\Windows\System\KMgtMPd.exe
  C:\Windows\System\KMgtMPd.exe
  2⤵
  PID:8240
- C:\Windows\System\geNuqpU.exe
  C:\Windows\System\geNuqpU.exe
  2⤵
  PID:8256
- C:\Windows\System\nFglSKV.exe
  C:\Windows\System\nFglSKV.exe
  2⤵
  PID:8272
- C:\Windows\System\FuoCGJZ.exe
  C:\Windows\System\FuoCGJZ.exe
  2⤵
  PID:8304
- C:\Windows\System\miPxxrR.exe
  C:\Windows\System\miPxxrR.exe
  2⤵
  PID:8384
- C:\Windows\System\wBTtfvx.exe
  C:\Windows\System\wBTtfvx.exe
  2⤵
  PID:8400
- C:\Windows\System\uKRUADm.exe
  C:\Windows\System\uKRUADm.exe
  2⤵
  PID:8416
- C:\Windows\System\DKGuPSa.exe
  C:\Windows\System\DKGuPSa.exe
  2⤵
  PID:8432
- C:\Windows\System\YqUJMez.exe
  C:\Windows\System\YqUJMez.exe
  2⤵
  PID:8448
- C:\Windows\System\TYMHQcv.exe
  C:\Windows\System\TYMHQcv.exe
  2⤵
  PID:8464
- C:\Windows\System\pyWmhzv.exe
  C:\Windows\System\pyWmhzv.exe
  2⤵
  PID:8480
- C:\Windows\System\rvgzbmf.exe
  C:\Windows\System\rvgzbmf.exe
  2⤵
  PID:8500
- C:\Windows\System\DdyYafz.exe
  C:\Windows\System\DdyYafz.exe
  2⤵
  PID:8556
- C:\Windows\System\QQCNwog.exe
  C:\Windows\System\QQCNwog.exe
  2⤵
  PID:8692
- C:\Windows\System\VGZianK.exe
  C:\Windows\System\VGZianK.exe
  2⤵
  PID:8712
- C:\Windows\System\MbpeHil.exe
  C:\Windows\System\MbpeHil.exe
  2⤵
  PID:8728
- C:\Windows\System\rlLvaSE.exe
  C:\Windows\System\rlLvaSE.exe
  2⤵
  PID:8744
- C:\Windows\System\UnjrLqZ.exe
  C:\Windows\System\UnjrLqZ.exe
  2⤵
  PID:8760
- C:\Windows\System\qDCOgKm.exe
  C:\Windows\System\qDCOgKm.exe
  2⤵
  PID:8776
- C:\Windows\System\cstNMmQ.exe
  C:\Windows\System\cstNMmQ.exe
  2⤵
  PID:8792
- C:\Windows\System\DLJHRjw.exe
  C:\Windows\System\DLJHRjw.exe
  2⤵
  PID:8808
- C:\Windows\System\dUvetVP.exe
  C:\Windows\System\dUvetVP.exe
  2⤵
  PID:8824
- C:\Windows\System\siFEPlR.exe
  C:\Windows\System\siFEPlR.exe
  2⤵
  PID:8840
- C:\Windows\System\MTzcuty.exe
  C:\Windows\System\MTzcuty.exe
  2⤵
  PID:8856
- C:\Windows\System\qgxxlvy.exe
  C:\Windows\System\qgxxlvy.exe
  2⤵
  PID:8872
- C:\Windows\System\GTpmpyy.exe
  C:\Windows\System\GTpmpyy.exe
  2⤵
  PID:8888
- C:\Windows\System\UtlANbz.exe
  C:\Windows\System\UtlANbz.exe
  2⤵
  PID:8904
- C:\Windows\System\awFbhLc.exe
  C:\Windows\System\awFbhLc.exe
  2⤵
  PID:8920
- C:\Windows\System\VMCvowV.exe
  C:\Windows\System\VMCvowV.exe
  2⤵
  PID:8936
- C:\Windows\System\DtNJhxy.exe
  C:\Windows\System\DtNJhxy.exe
  2⤵
  PID:8952
- C:\Windows\System\oIdxsCA.exe
  C:\Windows\System\oIdxsCA.exe
  2⤵
  PID:8968
- C:\Windows\System\owELbHp.exe
  C:\Windows\System\owELbHp.exe
  2⤵
  PID:8984
- C:\Windows\System\iwSZfqy.exe
  C:\Windows\System\iwSZfqy.exe
  2⤵
  PID:9000
- C:\Windows\System\dRAFCjN.exe
  C:\Windows\System\dRAFCjN.exe
  2⤵
  PID:9016
- C:\Windows\System\uRJVQAf.exe
  C:\Windows\System\uRJVQAf.exe
  2⤵
  PID:9032
- C:\Windows\System\rVmscaw.exe
  C:\Windows\System\rVmscaw.exe
  2⤵
  PID:9048
- C:\Windows\System\qkjoGlP.exe
  C:\Windows\System\qkjoGlP.exe
  2⤵
  PID:9064
- C:\Windows\System\aVeYTkG.exe
  C:\Windows\System\aVeYTkG.exe
  2⤵
  PID:9080
- C:\Windows\System\JKWtooZ.exe
  C:\Windows\System\JKWtooZ.exe
  2⤵
  PID:9096
- C:\Windows\System\OvOUztX.exe
  C:\Windows\System\OvOUztX.exe
  2⤵
  PID:9112
- C:\Windows\System\zIdwRYL.exe
  C:\Windows\System\zIdwRYL.exe
  2⤵
  PID:9128
- C:\Windows\System\hZANVIG.exe
  C:\Windows\System\hZANVIG.exe
  2⤵
  PID:9144
- C:\Windows\System\yInKyTJ.exe
  C:\Windows\System\yInKyTJ.exe
  2⤵
  PID:9164
- C:\Windows\System\mQrkVNW.exe
  C:\Windows\System\mQrkVNW.exe
  2⤵
  PID:9180
- C:\Windows\System\wIbLNNs.exe
  C:\Windows\System\wIbLNNs.exe
  2⤵
  PID:9196
- C:\Windows\System\IIgZdnm.exe
  C:\Windows\System\IIgZdnm.exe
  2⤵
  PID:9212
- C:\Windows\System\FUoQQbf.exe
  C:\Windows\System\FUoQQbf.exe
  2⤵
  PID:8232
- C:\Windows\System\tSPQUaY.exe
  C:\Windows\System\tSPQUaY.exe
  2⤵
  PID:8268
- C:\Windows\System\EuPXblv.exe
  C:\Windows\System\EuPXblv.exe
  2⤵
  PID:8032
- C:\Windows\System\Vfhojhc.exe
  C:\Windows\System\Vfhojhc.exe
  2⤵
  PID:8280
- C:\Windows\System\SoHXzAK.exe
  C:\Windows\System\SoHXzAK.exe
  2⤵
  PID:8216
- C:\Windows\System\XCTCQJh.exe
  C:\Windows\System\XCTCQJh.exe
  2⤵
  PID:8292
- C:\Windows\System\WSIDakR.exe
  C:\Windows\System\WSIDakR.exe
  2⤵
  PID:8316
- C:\Windows\System\zrUXKAk.exe
  C:\Windows\System\zrUXKAk.exe
  2⤵
  PID:8332
- C:\Windows\System\enSuAua.exe
  C:\Windows\System\enSuAua.exe
  2⤵
  PID:8360
- C:\Windows\System\WpAKINP.exe
  C:\Windows\System\WpAKINP.exe
  2⤵
  PID:8356
- C:\Windows\System\BXXMRJK.exe
  C:\Windows\System\BXXMRJK.exe
  2⤵
  PID:8380
- C:\Windows\System\RazYAwx.exe
  C:\Windows\System\RazYAwx.exe
  2⤵
  PID:8444
- C:\Windows\System\ffucUdF.exe
  C:\Windows\System\ffucUdF.exe
  2⤵
  PID:8396
- C:\Windows\System\DfFpqnS.exe
  C:\Windows\System\DfFpqnS.exe
  2⤵
  PID:8588
- C:\Windows\System\fanuMQF.exe
  C:\Windows\System\fanuMQF.exe
  2⤵
  PID:9160
- C:\Windows\System\sztWLVp.exe
  C:\Windows\System\sztWLVp.exe
  2⤵
  PID:9204
- C:\Windows\System\WVAZskj.exe
  C:\Windows\System\WVAZskj.exe
  2⤵
  PID:8236
- C:\Windows\System\OPClFOs.exe
  C:\Windows\System\OPClFOs.exe
  2⤵
  PID:7848
- C:\Windows\System\COvOmJb.exe
  C:\Windows\System\COvOmJb.exe
  2⤵
  PID:8288
- C:\Windows\System\acaziTa.exe
  C:\Windows\System\acaziTa.exe
  2⤵
  PID:8412
- C:\Windows\System\IUJvrgd.exe
  C:\Windows\System\IUJvrgd.exe
  2⤵
  PID:8496
- C:\Windows\System\qZWuKZm.exe
  C:\Windows\System\qZWuKZm.exe
  2⤵
  PID:8516
- C:\Windows\System\OofeBCD.exe
  C:\Windows\System\OofeBCD.exe
  2⤵
  PID:8532
- C:\Windows\System\acadebM.exe
  C:\Windows\System\acadebM.exe
  2⤵
  PID:8552
- C:\Windows\System\QYyzzpE.exe
  C:\Windows\System\QYyzzpE.exe
  2⤵
  PID:8580
- C:\Windows\System\hqYsLhX.exe
  C:\Windows\System\hqYsLhX.exe
  2⤵
  PID:8608
- C:\Windows\System\HZiIqcX.exe
  C:\Windows\System\HZiIqcX.exe
  2⤵
  PID:8616
- C:\Windows\System\LzREzMv.exe
  C:\Windows\System\LzREzMv.exe
  2⤵
  PID:8664
- C:\Windows\System\qQIuybl.exe
  C:\Windows\System\qQIuybl.exe
  2⤵
  PID:8668
- C:\Windows\System\CQeGcbb.exe
  C:\Windows\System\CQeGcbb.exe
  2⤵
  PID:8684
- C:\Windows\System\EatDXAe.exe
  C:\Windows\System\EatDXAe.exe
  2⤵
  PID:8708
- C:\Windows\System\fdCwdRH.exe
  C:\Windows\System\fdCwdRH.exe
  2⤵
  PID:8736
- C:\Windows\System\YaylNye.exe
  C:\Windows\System\YaylNye.exe
  2⤵
  PID:8804
- C:\Windows\System\nPxyoDG.exe
  C:\Windows\System\nPxyoDG.exe
  2⤵
  PID:8976
- C:\Windows\System\zrxRlqH.exe
  C:\Windows\System\zrxRlqH.exe
  2⤵
  PID:8900
- C:\Windows\System\DuMLVkE.exe
  C:\Windows\System\DuMLVkE.exe
  2⤵
  PID:8816
- C:\Windows\System\mlUUzpz.exe
  C:\Windows\System\mlUUzpz.exe
  2⤵
  PID:8880
- C:\Windows\System\PTUjdlf.exe
  C:\Windows\System\PTUjdlf.exe
  2⤵
  PID:9012
- C:\Windows\System\gEqdTTo.exe
  C:\Windows\System\gEqdTTo.exe
  2⤵
  PID:9072
- C:\Windows\System\pAXxGgI.exe
  C:\Windows\System\pAXxGgI.exe
  2⤵
  PID:9092
- C:\Windows\System\pQgaoac.exe
  C:\Windows\System\pQgaoac.exe
  2⤵
  PID:9108
- C:\Windows\System\VRmvgFZ.exe
  C:\Windows\System\VRmvgFZ.exe
  2⤵
  PID:8212
- C:\Windows\System\yXjypHn.exe
  C:\Windows\System\yXjypHn.exe
  2⤵
  PID:8300
- C:\Windows\System\QIjjOan.exe
  C:\Windows\System\QIjjOan.exe
  2⤵
  PID:9192
- C:\Windows\System\yYPfjmq.exe
  C:\Windows\System\yYPfjmq.exe
  2⤵
  PID:8392
- C:\Windows\System\YkfOnwE.exe
  C:\Windows\System\YkfOnwE.exe
  2⤵
  PID:8344
- C:\Windows\System\xIkkNbH.exe
  C:\Windows\System\xIkkNbH.exe
  2⤵
  PID:8372
- C:\Windows\System\FooQauJ.exe
  C:\Windows\System\FooQauJ.exe
  2⤵
  PID:8548
- C:\Windows\System\IQXmZQt.exe
  C:\Windows\System\IQXmZQt.exe
  2⤵
  PID:8568
- C:\Windows\System\gxEDlUX.exe
  C:\Windows\System\gxEDlUX.exe
  2⤵
  PID:8772
- C:\Windows\System\AOyTBtz.exe
  C:\Windows\System\AOyTBtz.exe
  2⤵
  PID:8836
- C:\Windows\System\GrsnfHm.exe
  C:\Windows\System\GrsnfHm.exe
  2⤵
  PID:8640
- C:\Windows\System\OPXSYaI.exe
  C:\Windows\System\OPXSYaI.exe
  2⤵
  PID:8932
- C:\Windows\System\FmArWUC.exe
  C:\Windows\System\FmArWUC.exe
  2⤵
  PID:8740
- C:\Windows\System\DFXUAXb.exe
  C:\Windows\System\DFXUAXb.exe
  2⤵
  PID:8636
- C:\Windows\System\ikKAeof.exe
  C:\Windows\System\ikKAeof.exe
  2⤵
  PID:9028
- C:\Windows\System\SscMimB.exe
  C:\Windows\System\SscMimB.exe
  2⤵
  PID:9044
- C:\Windows\System\bpQlKje.exe
  C:\Windows\System\bpQlKje.exe
  2⤵
  PID:9188
- C:\Windows\System\fovBRlL.exe
  C:\Windows\System\fovBRlL.exe
  2⤵
  PID:8852
- C:\Windows\System\zWdNXTv.exe
  C:\Windows\System\zWdNXTv.exe
  2⤵
  PID:9208
- C:\Windows\System\LOrODUv.exe
  C:\Windows\System\LOrODUv.exe
  2⤵
  PID:8352
- C:\Windows\System\fAzLSuJ.exe
  C:\Windows\System\fAzLSuJ.exe
  2⤵
  PID:9056
- C:\Windows\System\hidwznT.exe
  C:\Windows\System\hidwznT.exe
  2⤵
  PID:8964
- C:\Windows\System\sLvqArO.exe
  C:\Windows\System\sLvqArO.exe
  2⤵
  PID:8520
- C:\Windows\System\MikMBhv.exe
  C:\Windows\System\MikMBhv.exe
  2⤵
  PID:9136
- C:\Windows\System\LuNVilV.exe
  C:\Windows\System\LuNVilV.exe
  2⤵
  PID:8996
- C:\Windows\System\LjTyRdI.exe
  C:\Windows\System\LjTyRdI.exe
  2⤵
  PID:8604
- C:\Windows\System\welNxJt.exe
  C:\Windows\System\welNxJt.exe
  2⤵
  PID:8752
- C:\Windows\System\fIlBVLJ.exe
  C:\Windows\System\fIlBVLJ.exe
  2⤵
  PID:7852
- C:\Windows\System\HnFiwGg.exe
  C:\Windows\System\HnFiwGg.exe
  2⤵
  PID:8652
- C:\Windows\System\hNxoLfl.exe
  C:\Windows\System\hNxoLfl.exe
  2⤵
  PID:8832
- C:\Windows\System\KLRunwA.exe
  C:\Windows\System\KLRunwA.exe
  2⤵
  PID:9040
- C:\Windows\System\JaqQFUY.exe
  C:\Windows\System\JaqQFUY.exe
  2⤵
  PID:8488
- C:\Windows\System\ouojqIP.exe
  C:\Windows\System\ouojqIP.exe
  2⤵
  PID:8620
- C:\Windows\System\yHZfrQT.exe
  C:\Windows\System\yHZfrQT.exe
  2⤵
  PID:9024
- C:\Windows\System\FyJUgPw.exe
  C:\Windows\System\FyJUgPw.exe
  2⤵
  PID:8948
- C:\Windows\System\tyLwiWk.exe
  C:\Windows\System\tyLwiWk.exe
  2⤵
  PID:8820
- C:\Windows\System\dLRMcax.exe
  C:\Windows\System\dLRMcax.exe
  2⤵
  PID:9228
- C:\Windows\System\zDTUFdu.exe
  C:\Windows\System\zDTUFdu.exe
  2⤵
  PID:9244
- C:\Windows\System\vsrvucE.exe
  C:\Windows\System\vsrvucE.exe
  2⤵
  PID:9264
- C:\Windows\System\rzdobJw.exe
  C:\Windows\System\rzdobJw.exe
  2⤵
  PID:9284
- C:\Windows\System\KctWMle.exe
  C:\Windows\System\KctWMle.exe
  2⤵
  PID:9300
- C:\Windows\System\rAEEbVe.exe
  C:\Windows\System\rAEEbVe.exe
  2⤵
  PID:9320
- C:\Windows\System\nqoBwNe.exe
  C:\Windows\System\nqoBwNe.exe
  2⤵
  PID:9336
- C:\Windows\System\qdiLVZL.exe
  C:\Windows\System\qdiLVZL.exe
  2⤵
  PID:9352
- C:\Windows\System\RQjTluU.exe
  C:\Windows\System\RQjTluU.exe
  2⤵
  PID:9372
- C:\Windows\System\NrPtBIH.exe
  C:\Windows\System\NrPtBIH.exe
  2⤵
  PID:9392
- C:\Windows\System\hPDgwXI.exe
  C:\Windows\System\hPDgwXI.exe
  2⤵
  PID:9408
- C:\Windows\System\EJVBhnq.exe
  C:\Windows\System\EJVBhnq.exe
  2⤵
  PID:9428
- C:\Windows\System\fbzkNTn.exe
  C:\Windows\System\fbzkNTn.exe
  2⤵
  PID:9452
- C:\Windows\System\gPnjIzo.exe
  C:\Windows\System\gPnjIzo.exe
  2⤵
  PID:9472
- C:\Windows\System\rnqjHSJ.exe
  C:\Windows\System\rnqjHSJ.exe
  2⤵
  PID:9488
- C:\Windows\System\GGuvgqz.exe
  C:\Windows\System\GGuvgqz.exe
  2⤵
  PID:9504
- C:\Windows\System\GAIxdQI.exe
  C:\Windows\System\GAIxdQI.exe
  2⤵
  PID:9524
- C:\Windows\System\xMttuUk.exe
  C:\Windows\System\xMttuUk.exe
  2⤵
  PID:9548
- C:\Windows\System\EitDBzi.exe
  C:\Windows\System\EitDBzi.exe
  2⤵
  PID:9600
- C:\Windows\System\saljwHW.exe
  C:\Windows\System\saljwHW.exe
  2⤵
  PID:9616
- C:\Windows\System\dLBBiMu.exe
  C:\Windows\System\dLBBiMu.exe
  2⤵
  PID:9636
- C:\Windows\System\sPRwXXe.exe
  C:\Windows\System\sPRwXXe.exe
  2⤵
  PID:9652
- C:\Windows\System\CqatgWM.exe
  C:\Windows\System\CqatgWM.exe
  2⤵
  PID:9668
- C:\Windows\System\RQypIMj.exe
  C:\Windows\System\RQypIMj.exe
  2⤵
  PID:9700
- C:\Windows\System\XmeGrUe.exe
  C:\Windows\System\XmeGrUe.exe
  2⤵
  PID:9748
- C:\Windows\System\ZVHpOmC.exe
  C:\Windows\System\ZVHpOmC.exe
  2⤵
  PID:9764
- C:\Windows\System\GcOrkUi.exe
  C:\Windows\System\GcOrkUi.exe
  2⤵
  PID:9780
- C:\Windows\System\baAUdch.exe
  C:\Windows\System\baAUdch.exe
  2⤵
  PID:9800
- C:\Windows\System\JYCbhXm.exe
  C:\Windows\System\JYCbhXm.exe
  2⤵
  PID:9816
- C:\Windows\System\JpcnAwl.exe
  C:\Windows\System\JpcnAwl.exe
  2⤵
  PID:9832
- C:\Windows\System\OnZLJef.exe
  C:\Windows\System\OnZLJef.exe
  2⤵
  PID:9852
- C:\Windows\System\UUBAWtY.exe
  C:\Windows\System\UUBAWtY.exe
  2⤵
  PID:9868
- C:\Windows\System\tvcmgjx.exe
  C:\Windows\System\tvcmgjx.exe
  2⤵
  PID:9908
- C:\Windows\System\hKiqLVU.exe
  C:\Windows\System\hKiqLVU.exe
  2⤵
  PID:9928
- C:\Windows\System\OfdTiAD.exe
  C:\Windows\System\OfdTiAD.exe
  2⤵
  PID:9960
- C:\Windows\System\OwDrSHb.exe
  C:\Windows\System\OwDrSHb.exe
  2⤵
  PID:9976
- C:\Windows\System\TXAQIhM.exe
  C:\Windows\System\TXAQIhM.exe
  2⤵
  PID:9992
- C:\Windows\System\EEAFeaY.exe
  C:\Windows\System\EEAFeaY.exe
  2⤵
  PID:10016
- C:\Windows\System\YiwulCx.exe
  C:\Windows\System\YiwulCx.exe
  2⤵
  PID:10036
- C:\Windows\System\VyYNFDo.exe
  C:\Windows\System\VyYNFDo.exe
  2⤵
  PID:10052
- C:\Windows\System\MHoWTAJ.exe
  C:\Windows\System\MHoWTAJ.exe
  2⤵
  PID:10072
- C:\Windows\System\YjwCYtg.exe
  C:\Windows\System\YjwCYtg.exe
  2⤵
  PID:10088
- C:\Windows\System\kaxnIBV.exe
  C:\Windows\System\kaxnIBV.exe
  2⤵
  PID:10208
- C:\Windows\System\ZgRDfxW.exe
  C:\Windows\System\ZgRDfxW.exe
  2⤵
  PID:10224
- C:\Windows\System\nJnAvVD.exe
  C:\Windows\System\nJnAvVD.exe
  2⤵
  PID:8700
- C:\Windows\System\RsyeUXU.exe
  C:\Windows\System\RsyeUXU.exe
  2⤵
  PID:9104
- C:\Windows\System\JpHUGNj.exe
  C:\Windows\System\JpHUGNj.exe
  2⤵
  PID:9280
- C:\Windows\System\cxXZeRc.exe
  C:\Windows\System\cxXZeRc.exe
  2⤵
  PID:9344
- C:\Windows\System\yEueqYg.exe
  C:\Windows\System\yEueqYg.exe
  2⤵
  PID:9388
- C:\Windows\System\ylPuXJA.exe
  C:\Windows\System\ylPuXJA.exe
  2⤵
  PID:9368
- C:\Windows\System\aSFfqXC.exe
  C:\Windows\System\aSFfqXC.exe
  2⤵
  PID:9252
- C:\Windows\System\qHbJSwU.exe
  C:\Windows\System\qHbJSwU.exe
  2⤵
  PID:9328
- C:\Windows\System\drvhxfA.exe
  C:\Windows\System\drvhxfA.exe
  2⤵
  PID:9424
- C:\Windows\System\nzlcQzV.exe
  C:\Windows\System\nzlcQzV.exe
  2⤵
  PID:9468
- C:\Windows\System\yHVgtYd.exe
  C:\Windows\System\yHVgtYd.exe
  2⤵
  PID:9540
- C:\Windows\System\QNsFkQq.exe
  C:\Windows\System\QNsFkQq.exe
  2⤵
  PID:9480
- C:\Windows\System\AcWnfcw.exe
  C:\Windows\System\AcWnfcw.exe
  2⤵
  PID:9556
- C:\Windows\System\cFHXFGJ.exe
  C:\Windows\System\cFHXFGJ.exe
  2⤵
  PID:9580
- C:\Windows\System\aOuloMQ.exe
  C:\Windows\System\aOuloMQ.exe
  2⤵
  PID:9608
- C:\Windows\System\yzciCaS.exe
  C:\Windows\System\yzciCaS.exe
  2⤵
  PID:9684
- C:\Windows\System\yEgTdee.exe
  C:\Windows\System\yEgTdee.exe
  2⤵
  PID:9680
- C:\Windows\System\BrBuNEG.exe
  C:\Windows\System\BrBuNEG.exe
  2⤵
  PID:9660
- C:\Windows\System\tTwreqF.exe
  C:\Windows\System\tTwreqF.exe
  2⤵
  PID:9724
- C:\Windows\System\azTSmDh.exe
  C:\Windows\System\azTSmDh.exe
  2⤵
  PID:9736
- C:\Windows\System\EpfoFdB.exe
  C:\Windows\System\EpfoFdB.exe
  2⤵
  PID:9760
- C:\Windows\System\rBbAEYe.exe
  C:\Windows\System\rBbAEYe.exe
  2⤵
  PID:9828
- C:\Windows\System\scwUAJH.exe
  C:\Windows\System\scwUAJH.exe
  2⤵
  PID:9844
- C:\Windows\System\posypOy.exe
  C:\Windows\System\posypOy.exe
  2⤵
  PID:9776
- C:\Windows\System\hujVBvW.exe
  C:\Windows\System\hujVBvW.exe
  2⤵
  PID:9904
- C:\Windows\System\JNnSxWB.exe
  C:\Windows\System\JNnSxWB.exe
  2⤵
  PID:9948
- C:\Windows\System\YWCCfOV.exe
  C:\Windows\System\YWCCfOV.exe
  2⤵
  PID:9988
- C:\Windows\System\PGlpFyc.exe
  C:\Windows\System\PGlpFyc.exe
  2⤵
  PID:10064
- C:\Windows\System\aezsIVr.exe
  C:\Windows\System\aezsIVr.exe
  2⤵
  PID:10044
- C:\Windows\System\AIszsFu.exe
  C:\Windows\System\AIszsFu.exe
  2⤵
  PID:10048
- C:\Windows\System\FFnouBo.exe
  C:\Windows\System\FFnouBo.exe
  2⤵
  PID:10104
- C:\Windows\System\RBXYqHY.exe
  C:\Windows\System\RBXYqHY.exe
  2⤵
  PID:10124
- C:\Windows\System\BFmukYd.exe
  C:\Windows\System\BFmukYd.exe
  2⤵
  PID:9720
- C:\Windows\System\qAmOtoh.exe
  C:\Windows\System\qAmOtoh.exe
  2⤵
  PID:10232
- C:\Windows\System\bscExUq.exe
  C:\Windows\System\bscExUq.exe
  2⤵
  PID:8800
- C:\Windows\System\LKJHvgf.exe
  C:\Windows\System\LKJHvgf.exe
  2⤵
  PID:9380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ByQjHzn.exe

Filesize
1.1MB

MD5
5bc04e64d1145575b92d6e2e395e22a1

SHA1
e4c80d14d0d3d4da26f2307a99d12efde5aac2cd

SHA256
d24d359a56df23ccff4037ca0dc529a1036453d53fafc5923f2e272bf9c1a862

SHA512
eea6c88865079263d68edd94c2a11108d3936be218be4e1a2e1ef7b465119e2953b2eecfc0d68c1a0b0afd0f096bddd9827b0590b1119829de72540ebf969944

Download Submit
C:\Windows\system\CWGSyka.exe

Filesize
1.1MB

MD5
12882a7cb964fc4f7140874ac83778d4

SHA1
46167d4b8030e1f261683e03ce3a6a8f9782d391

SHA256
0840b4c4da7c1a99c7b5772a8daf0c8e0a1a1ffcf249e651820a7ab26d6f26ce

SHA512
23a79c9cbf3a4f8cd960bd094d7dc86b49c6b872ab317a4ff51bef0eabadf284f352190d532641d64181c8437f0346def69acfd8fb69ce7602a0c40a3b83fa5c

Download Submit
C:\Windows\system\IZcyRXR.exe

Filesize
1.1MB

MD5
d1436a35a339f713eadc0458650b3188

SHA1
82d3636b179ce023e1f283f44627b828b98c9309

SHA256
86cb45d8d336b4814585f184bbaedf3658de35102239f67fb4bd1ec32494c12c

SHA512
8933eb6e1818a7baebe3470f41fd8b8c6cd674705207c400e0bb9c5d9a1748eea47b85e0f004b9e919e52b118856ff079800b5c026aea14b92539906bec5c417

Download Submit
C:\Windows\system\VkCUhGr.exe

Filesize
1.1MB

MD5
105db07df365bdbe349e70ef61d70c87

SHA1
cbab5eae4d82ee20fe08e89938c7c891b4ff30e8

SHA256
70ad886e28b8ba7bd0f5315c2a0eca21b15d83ca1f7cf4e26adfa52ab4444722

SHA512
92a818a2829ec9bb2656a712b3305e157602b9d72b3658c4ecadf1e4f82dd0dbc2061ff337678c7bc83ceaa9248eb20e741ab78be766623826b35e6c8722038f

Download Submit
C:\Windows\system\XfvyHBc.exe

Filesize
1.1MB

MD5
c570c3833a868bce47972c2b0fc1a27b

SHA1
26901b65b53d593cbe80886d3b83e11d224a934a

SHA256
ddfaff4e54dfaaa8db874750c69c55a141ca957fc0e29075aa3b57185afd5cda

SHA512
bb630c82d3c9e4eb94ebf19f02aaf0cbafaae31f8f5b78e5c24684223a7065657abddc5f8051fd9c53d12286a2ae9491bb04f8528187249c1d486f00c06d0c8b

Download Submit
C:\Windows\system\XwGDzRp.exe

Filesize
1.1MB

MD5
b41bf5eb7bf70ed088b5329ce43f3581

SHA1
9002617c84fa6609359b1a84d8f120a84ccc7419

SHA256
ea095fc6482dfb24cfebb67e74caac3092f80b15ef091e8e624da0e39643a995

SHA512
917cad9440f34eba89ad412289cffc8210c2ba6c1e8f51094e930a8621871c6df72012661fbc38a92d9d30c04170fe21c4a1341cedd7cbf5c89c9bc6ebd9534d

Download Submit
C:\Windows\system\firZFrJ.exe

Filesize
1.1MB

MD5
c89ec7eec54760c4ef0296442fa741f3

SHA1
7a7ba4cc2ec37d29fe6ca699c910e263a2eccd21

SHA256
b0cb5fd9c8527985c62590a0269e53d7ac13466148d1a56c58689757a47ec112

SHA512
3d68b48715df300ccdbd9625efeb3737a59f9428a3dff6c691c789a4d6177c6fbd2299dba15c189c8993949a97dc521dc43ed952aac997031cc3d7c04fa24942

Download Submit
C:\Windows\system\gFybLnk.exe

Filesize
1.1MB

MD5
197553123874ed5ccd14116cc25d86e6

SHA1
f80692d96bec058a73e7dcd018630d2db47282c1

SHA256
d7126cd4c1c878e72eb8c415a90b16396f3108986007ef68a3c458abdd440805

SHA512
d2e76abdf73ae92b618fc7f57ddd0a9a933e570b5e85f0c12c80d64492c1c48be091c30a96734bbb49b407f5d9307efdb97abfde06018874b470ff2cb3170cd5

Download Submit
C:\Windows\system\ibdfzQR.exe

Filesize
1.1MB

MD5
a211a820ae7d3d5530ddc17bef08906b

SHA1
2f16cfa16132b54a82fe51de971b1cd1776a1b9c

SHA256
eac2a1962c02c608491953094ddcc249cce6445205922b61def2491a69733ad8

SHA512
70a5d2405fadb8a39f9a4669b4822e16b06ce737d35236c249b1a50a2cf58dcefbe319b70841815c9dd30d87e27d8010c166695bb314876681c2cd8daacdcf33

Download Submit
C:\Windows\system\opqQlsd.exe

Filesize
1.1MB

MD5
145d6011f8bcb914469f26e31ac65fac

SHA1
8141ca59c2462949b98dfde8cb23515ca9cbff46

SHA256
c9cdd72cb4ace34800c65accf805734dd83402fa45ebf6f27d00b566522d51d8

SHA512
5f5af335bfced715f657e9b572a4f9333a9af8f9a9bfc6a34b8a0c4d43c6d7429f701d3d224076908637ab6fffeb3eedc81aa685e0a7a22a1c1b0e2225c5d812

Download Submit
C:\Windows\system\qgyZzKs.exe

Filesize
1.1MB

MD5
203e3424e731815565c236c903d66fca

SHA1
10205efdd49061813cde2a77148037f98442228b

SHA256
caf32110b81eab36a43b29d9646466118094478d7bf4d107929aa0b01ed21da4

SHA512
34ea286180d8b090e3fc1732fbe3ca0e4b84808d36e7d5331873afc68e184409d048a5033aa5bc20b5dbbef22eba32515b278a07c15fdd5c05149d9b2d3684b6

Download Submit
C:\Windows\system\sbTcyux.exe

Filesize
1.1MB

MD5
174d70ce291653793596d92b7623f62e

SHA1
786d77e06fedb69d19a1d328019c954e7e77b680

SHA256
3061cbc4a68f7d834475828b47656cafb7f2a83c94eb2bad74efbf8b1bb25f89

SHA512
5fc6ecdbfd2b71187d1692217584f50c2522fb8f53eeeebc8ba5f5d3a92ac9d0b20da5aceef981d174b174efe9c5e7c54f1f36bf6532c082a10a579290ae5a39

Download Submit
C:\Windows\system\sxIgLsS.exe

Filesize
1.1MB

MD5
277a2c61929003e969b7e03600856ac4

SHA1
233621e8c31c810b12daf5e83022d47d341134a4

SHA256
70409e171422e8c5badded4880e33298638253da1417310669b8160c45c3a9f9

SHA512
f741862752eb76d68481c2de0537c0b00e717e1358d3aaa3cd02b3d7b2aa46890b228f78279044f977882c0aebd1ac05d2a5a783f9d0e04d817bf4512c02dda0

Download Submit
C:\Windows\system\uCqPova.exe

Filesize
1.1MB

MD5
60405ed3641437b56510b15edb3b01ff

SHA1
7f2a9e55e4375e552f7a66e01908a8bd5677c7eb

SHA256
329e0b97d5fb1aa98a1bf6d7d2cf5577f58555f15346169ffde853c5fde068d7

SHA512
717e73a96953234759dd934871ee221059c31e22154671eeaa219f2764545e2e756cc6021945da89dd2f120bee9ef0c04523734fe8554a94fd3154090b5f4139

Download Submit
C:\Windows\system\uyTwZwG.exe

Filesize
1.1MB

MD5
e4c5b9f5d47d1aa1d264e20281d58476

SHA1
e12e06c757d027d9f95fb8d95ab1cac0fcfeb760

SHA256
c67271bb3524458bc36386ecec437305493516e416dccfd5bd4be8ea292f6ba1

SHA512
08c6609955c98f41540de1b0270304347cf26443bc3bdda34f401317cc1265882a6aeb93ba48eca415b4d9e91bbcfe457d626d1a63d141354e2b06719f2d37a6

Download Submit
C:\Windows\system\vtOHrUa.exe

Filesize
1.1MB

MD5
e36ca5bd2f86412b950c5c02be8a5aac

SHA1
cdec49618efcefa35f3ae2a28d204d05d9e39b6d

SHA256
267daf01c040ddb8707afcb3faa1c053d2a0f9c25bc7b3c48411737cc5853fee

SHA512
ab4e452befc530cf20cf1d02cf93543ed835914735e038c2118cac7d63413fa486e4521de08c547a2ec7b2d2f9505e66cf6fa937eda37de1e339135e4086d6a5

Download Submit
\Windows\system\DHSUqVj.exe

Filesize
1.1MB

MD5
141cee311b56d5a339d2ad6d8276a09b

SHA1
0925b7c5ab85f8e00e8ab8633ccc083141162c9e

SHA256
bd63c836713de98e233950eeec0dfb365692504a1e5002337b4cbaf0a771a66c

SHA512
6500eb8e6464c4c6eb534d4913d0d2f4ed116f2dde31c1391015f8f373d15f902ea643b0b1dc5034899484e648b3f464d8822f797c37a25a2831831662933a43

Download Submit
\Windows\system\EXJsqdB.exe

Filesize
1.1MB

MD5
149f92a9d6d45db864dbed91cf169441

SHA1
7d87042085da5f4d587f485e4299b2e8236955b3

SHA256
24910716c3d26dbbcf4946075b5a025b83d54e2d53ea209115f065a03dc47ac4

SHA512
0be75d536b8b221278f26835ce9b3623507de1882ab4bb42951480319ea86fcdfacabada0a5c1ee48be3337e38b004a2b05a323623e520c8c28b68336255ff30

Download Submit
\Windows\system\JjCTuEG.exe

Filesize
1.1MB

MD5
c597b29f602bad6ecbc5b0afed3d7f66

SHA1
35293114b1a0c43815bf2e95f1c44ea3a87c851f

SHA256
918bcf9b7af9a65a8bd725a1aecb7613a447de8a7332c6332449e94ae66b6f50

SHA512
d6eef1d3e70aac64ce1690f18a84872ea03ce3ffd2b613d3e5337f0b938e2ac24135664cbb5e11f0933cf05bf284e25a7d1ef7503e25b051f6a383c5963ecb6c

Download Submit
\Windows\system\OcTGaoK.exe

Filesize
1.1MB

MD5
e0646ff9f36842bb30a5c23b19eeb0d9

SHA1
71b611508591da8aeeb4b718c8b8dc09ca2f76c2

SHA256
731c97757839678b4b3f2bc0544faf762f73968b5b96cf54b5f5c346f089269f

SHA512
2aaa24d21877763cf7a1f0e5fa1f3c2332c5757e07f3b03fb9ab28917582fe238ba29228a04775edd2c4f601d6c76b75a2a3ea82100897a023e373d909745279

Download Submit
\Windows\system\XLdbEEF.exe

Filesize
1.1MB

MD5
7fc02f1a2973bebce7dfc552e738d454

SHA1
da6897268c68b2173b7cbeaba8702d04858d5a06

SHA256
aca83cad29de1934794cec170b67fd1234959e4b67025a73183252e96b9674ee

SHA512
ce25c8512f25a7b33c09fbe0035a971c18f8493015defed2aa6538a2eefa0597da1389ae343392c464abf53abf69c7ae96e8f6746e99ca9e2742a9b22d768206

Download Submit
\Windows\system\YbHzAtH.exe

Filesize
1.1MB

MD5
6d829e620244a3c27021659666c3799e

SHA1
469c1b3da062a191e724e80b34453a9c3b79f979

SHA256
0ceb3f51bba00b79d06d5d581c8e3519a596c4ee9b9734849357dbb253e398d3

SHA512
df46f0115b9997ac0ae6d8e5306a3d77978709bf885cd66284f65add21171760ebabfa6950f23ec81b0635903ab55dc73263d0279cf6ee8740d94cadf61e9e6a

Download Submit
\Windows\system\ghVpZuA.exe

Filesize
1.1MB

MD5
b5a375a6f775a7d25dd363b38395c7d2

SHA1
ed1c8c64bb28ab255d76c2fab8f595ac41c34873

SHA256
7ac8fd0fd3613794ec7fd894195bb1adf82af27fbd6bc3523287c9439db1492a

SHA512
29e414ff860381f950abf7bd11f19ae5e7657f43db7746625f236dcad3357cb0beb1ddfd7691218dd6ef0fad2c9a10a7347625e065a5451cf550a42374d956e3

Download Submit
\Windows\system\jGEprcR.exe

Filesize
1.1MB

MD5
afad81b40c3a1e22fa565226c96415b9

SHA1
0ae01b9884c254c431881a9831f80305bc787619

SHA256
a1125d84c0a47f0f6303c3b800ac5b58e4416df0550692e861e74bf00d581af5

SHA512
5c77156770f28a7158eec7fe70de042bbf4edd35c5b864f8bb7767ba94b06662ffac415ed66ba604881fd0308a01fe1aff3c0e508af034da150847662ae83b9a

Download Submit
\Windows\system\mfJsSAp.exe

Filesize
1.1MB

MD5
e0163b34821c54cabb91fab74d5378b7

SHA1
c1bba0e20aee619bd559e2a93f00e5cba780510f

SHA256
f1a7a15f5d54b0d3a2c30efd4d7154a07d69c27eaafe480ee332d28ea95bbd77

SHA512
079fd2662a3a9702727935c6ffdecfe82555519fd28993573fe600e7979afc8a0fbf619ae45f3ed9a93e53a5729dd0ea42a71293ce76a2f1df32c678f9f3dc56

Download Submit
\Windows\system\nvYAzOO.exe

Filesize
1.1MB

MD5
6a8f8826ee32f137fb923fb5453d9801

SHA1
cc129880ea6d4dab8c3479581a8fa6a3a100bce1

SHA256
b993fbe00f3cc4b3ae209a6bf1678220410cde681af5afb00c5a419eefefc468

SHA512
66ebc6e6a879b8d6e03197aad90263b7282d901854d7bf961ba95e59b5afeabb5d90f0fa8cdf835e2d968ba539668625ed4d0d20507b4413ca9075a853437802

Download Submit
\Windows\system\pqPpRvq.exe

Filesize
1.1MB

MD5
e4e92223ee60bea998a6ccc018d4f47c

SHA1
c6ccc138217abb365e1820247f8b7d3c90abe8c4

SHA256
c0e66e6935e9c085d28bea662c1d8e06593fbaa6d26715cf5f0a9a29503e84e0

SHA512
aba527a300053dddd611f4a2f79806d30d7221f914e5d94429d3ea8fa52cda78198ad7fb119c8051677bfd3b93fac7025b159bd0196235c7f8582bc2eb9d18c6

Download Submit
\Windows\system\rJjQIdA.exe

Filesize
1.1MB

MD5
23023c56b0fc59fa0b6c88d508786fcd

SHA1
8d499537e77616cafd47bd92d25d64f04dcb4b2b

SHA256
5ba24b3805947b1211244feae0d1ea65411463c996d3b31fd12a89eb9fb74b07

SHA512
358d45fcf2b91b7a2eb202b6d26852d5d93e257382e3c6770c3eb06e2f9e501b49aecf5e04be3692187490d589914365f04c4f0c16e89397ac9aae0fe55c331c

Download Submit
\Windows\system\sPnSHoQ.exe

Filesize
1.1MB

MD5
fb627e0b9b21ec69d5913417b3d5086d

SHA1
52329e1c1bc794180cb7b112baabdb073688dab7

SHA256
b73bf2a8b03df5f150fa7d14ed275f5e7cd250b54c10a0c19a479d9324f84368

SHA512
464270ae3fa3f8c20967bf55f205fe10fa09505e25e26c7523c8114f689dce3710508f6b715063529273a9df4b427fca1b6bb62a8adb630e237573a6ce0d1499

Download Submit
\Windows\system\wIqDEhk.exe

Filesize
1.1MB

MD5
2b45a807a69473c00aa8e47e47cbab5f

SHA1
2537ee882f670aa055c46a50a19416f08207ea39

SHA256
2ab83ddcefe625add24d61a8839ad03ec1b11b3c1b4c83fb90ac555b062f0439

SHA512
eeb2144c8a2b26fad2c0def37db3042e67c51911bd3d3f75b88a569e631f120ad2c87c8532bba9fbab37d3e6882cb4f29d5abb906094ec395cdd688c22f6d1ce

Download Submit
\Windows\system\xcqjBTe.exe

Filesize
1.1MB

MD5
7b4a24ce495c153369f520d7f32624c2

SHA1
276efcf194301afa727f174af93c1b7de82d9727

SHA256
3fba308ef9bb0fdde464119c84e3b9b9651af61af04c0a426c1ae375c7139323

SHA512
9104d65fec1d380279c8438bceb7bfcfc9941090ef8d655082c13382fa4dce5f6c112c646b9ccfd5bc5702fcf03fec35f5ba66881a437ef11d604235ec23afa0

Download Submit
\Windows\system\ytyHiAp.exe

Filesize
1.1MB

MD5
32c322b495977be4e7a9b23f1e370335

SHA1
ade7fa650b7bd6f66a5e10ff28f5e116fcb51e08

SHA256
52256a749f2beac8b463cd79f57a462186664c68198d200aae691c237d3e2929

SHA512
6b1e98e4d5e70fa4dacc3d72e483e09b429a191f3dbd89d5c21d7ccb16874fec9b55cc38874075486af77628b76d340c4d43d6808fef30a45a13cc922c32986e

Download Submit
memory/808-4130-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Filesize
3.3MB

Download
memory/808-88-0x000000013FBD0000-0x000000013FF21000-memory.dmp

Filesize
3.3MB

Download
memory/1044-515-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-1632-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-84-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-1868-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-1749-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-145-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-19-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/1044-34-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-13-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-52-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-93-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-175-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-90-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-35-0x000000013FBE0000-0x000000013FF31000-memory.dmp

Filesize
3.3MB

Download
memory/1044-141-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-1631-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-176-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-116-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-154-0x000000013F030000-0x000000013F381000-memory.dmp

Filesize
3.3MB

Download
memory/1044-289-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/1044-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1044-0-0x000000013FBE0000-0x000000013FF31000-memory.dmp

Filesize
3.3MB

Download
memory/1044-6-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/1044-69-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-71-0x0000000001E60000-0x00000000021B1000-memory.dmp

Filesize
3.3MB

Download
memory/1044-73-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/1044-72-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2128-3918-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2128-15-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2128-78-0x000000013FD50000-0x00000001400A1000-memory.dmp

Filesize
3.3MB

Download
memory/2504-79-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2504-4132-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2504-504-0x000000013FED0000-0x0000000140221000-memory.dmp

Filesize
3.3MB

Download
memory/2536-4133-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2536-74-0x000000013FF00000-0x0000000140251000-memory.dmp

Filesize
3.3MB

Download
memory/2548-76-0x000000013FE00000-0x0000000140151000-memory.dmp

Filesize
3.3MB

Download
memory/2548-4061-0x000000013FE00000-0x0000000140151000-memory.dmp

Filesize
3.3MB

Download
memory/2608-87-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2608-3963-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2608-22-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2616-177-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2616-4052-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2616-64-0x000000013F070000-0x000000013F3C1000-memory.dmp

Filesize
3.3MB

Download
memory/2656-37-0x000000013FA60000-0x000000013FDB1000-memory.dmp

Filesize
3.3MB

Download
memory/2656-4017-0x000000013FA60000-0x000000013FDB1000-memory.dmp

Filesize
3.3MB

Download
memory/2760-95-0x000000013FA90000-0x000000013FDE1000-memory.dmp

Filesize
3.3MB

Download
memory/2760-4000-0x000000013FA90000-0x000000013FDE1000-memory.dmp

Filesize
3.3MB

Download
memory/2760-29-0x000000013FA90000-0x000000013FDE1000-memory.dmp

Filesize
3.3MB

Download
memory/2836-4048-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2836-66-0x000000013F170000-0x000000013F4C1000-memory.dmp

Filesize
3.3MB

Download
memory/2848-4131-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2848-75-0x000000013F7D0000-0x000000013FB21000-memory.dmp

Filesize
3.3MB

Download
memory/2880-3917-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2880-9-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download
memory/2880-46-0x000000013F7F0000-0x000000013FB41000-memory.dmp

Filesize
3.3MB

Download