xmrig | c6b95a92cea1a5e30a85dbdeb140fd5893b5812241cafe1a0f74f3612c550bc5

Analysis

max time kernel
55s
max time network
43s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/04/2024, 21:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
Size

2.2MB
MD5

001152efbe8e521df04e21310439dbad
SHA1

1e28c42f16315d913e661e20432c00d514dad433
SHA256

c6b95a92cea1a5e30a85dbdeb140fd5893b5812241cafe1a0f74f3612c550bc5
SHA512

e401d4983128b1df07d9daa357245b1f3e2127172b89970f4424cc58780a2add9989c97046bd09bbf8de5a37562dac339b52ac13bb521951147fce98e99bfca9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9c0ULNz:NABd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 25 IoCs

miner

resource	yara_rule
behavioral1/memory/2636-155-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2872-160-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2728-163-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2264-189-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2548-190-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2196-192-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2820-198-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig
behavioral1/memory/2608-199-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	xmrig
behavioral1/memory/2484-200-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2516-203-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2440-202-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2956-207-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/3004-208-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/1712-209-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/1120-210-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2028-211-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2816-212-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/1652-213-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/1276-217-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/1540-218-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2796-220-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2704-219-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	xmrig
behavioral1/memory/2708-224-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2864-164-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2196-157-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig

Executes dropped EXE 35 IoCs

pid	Process
2264	FGrxsIh.exe
2548	AFRsANu.exe
2636	cyIrTku.exe
2196	hDvTxNi.exe
2872	SFkbsai.exe
2728	ZKZFqQB.exe
2820	XLNmapb.exe
2608	xEDCFfB.exe
2484	cFGZkWV.exe
2440	PwPkVqT.exe
2516	yYZHbgh.exe
2956	wZJXFlo.exe
3004	WYoLRUS.exe
1120	WtzzZIo.exe
2816	BXbKXkz.exe
1276	XZnIzeN.exe
2704	bHFcGKI.exe
2708	ooJhXYL.exe
2944	LMipXqn.exe
856	gXXSuKG.exe
1240	aJtRTTa.exe
1712	JmGczhP.exe
2028	sWmNVXy.exe
1652	cNmkkVG.exe
1540	kUWFlzn.exe
2796	DsYzMPb.exe
2840	kZnTNtO.exe
2496	iobJcpu.exe
852	ETTbDIU.exe
1624	AKSsPYe.exe
1508	mHrMblT.exe
2392	PHiHhqH.exe
588	oDFuaAs.exe
1788	tANYAld.exe
412	licMXdx.exe

Loads dropped DLL 36 IoCs

pid	Process
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe

UPX packed file 63 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2864-0-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0009000000012256-3.dat	upx
behavioral1/files/0x000c000000014454-8.dat	upx
behavioral1/files/0x0037000000014708-19.dat	upx
behavioral1/files/0x0008000000014b63-27.dat	upx
behavioral1/files/0x0008000000014e51-35.dat	upx
behavioral1/files/0x0006000000015ceb-42.dat	upx
behavioral1/files/0x0006000000015d28-48.dat	upx
behavioral1/files/0x0006000000015d07-46.dat	upx
behavioral1/files/0x0007000000015ce1-38.dat	upx
behavioral1/files/0x0007000000014baa-30.dat	upx
behavioral1/files/0x0007000000004e76-23.dat	upx
behavioral1/files/0x003700000001471d-52.dat	upx
behavioral1/memory/2264-53-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/files/0x0006000000015d4a-73.dat	upx
behavioral1/files/0x0006000000015d9b-89.dat	upx
behavioral1/files/0x0006000000015eaf-93.dat	upx
behavioral1/files/0x0006000000015fe9-100.dat	upx
behavioral1/files/0x0006000000015e3a-90.dat	upx
behavioral1/files/0x00060000000164b2-116.dat	upx
behavioral1/files/0x0006000000016117-151.dat	upx
behavioral1/files/0x000600000001630b-154.dat	upx
behavioral1/memory/2636-155-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0006000000015f6d-96.dat	upx
behavioral1/memory/2872-160-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0006000000016572-162.dat	upx
behavioral1/memory/2728-163-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000016c4a-176.dat	upx
behavioral1/files/0x0006000000016c63-179.dat	upx
behavioral1/files/0x0006000000016a9a-173.dat	upx
behavioral1/memory/2264-189-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2548-190-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x000600000001661c-167.dat	upx
behavioral1/memory/2196-192-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2820-198-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/memory/2608-199-0x000000013F8F0000-0x000000013FCE2000-memory.dmp	upx
behavioral1/memory/2484-200-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2516-203-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2440-202-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2956-207-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/3004-208-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/1712-209-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/memory/1120-210-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2028-211-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2816-212-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/1652-213-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/1276-217-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/1540-218-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0006000000016843-170.dat	upx
behavioral1/memory/2796-220-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2704-219-0x000000013FBF0000-0x000000013FFE2000-memory.dmp	upx
behavioral1/memory/2708-224-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2864-164-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2196-157-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/files/0x0006000000015d8f-144.dat	upx
behavioral1/files/0x0006000000015d79-140.dat	upx
behavioral1/files/0x0006000000015d67-135.dat	upx
behavioral1/files/0x0006000000015d56-130.dat	upx
behavioral1/files/0x0006000000015d87-85.dat	upx
behavioral1/files/0x0006000000015d6f-84.dat	upx
behavioral1/files/0x0006000000015d5e-82.dat	upx
behavioral1/memory/2548-63-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x00060000000161e7-109.dat	upx

Drops file in Windows directory 36 IoCs

description	ioc	Process
File created	C:\Windows\System\ZKZFqQB.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\bHFcGKI.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\aJtRTTa.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\AKSsPYe.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\mHrMblT.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\WtzzZIo.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\ETTbDIU.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\oDFuaAs.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\licMXdx.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\cyIrTku.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\xEDCFfB.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\cFGZkWV.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\kUWFlzn.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\LMipXqn.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\PHiHhqH.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\SFkbsai.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\sWmNVXy.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\BXbKXkz.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\iobJcpu.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\ooJhXYL.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\MYBnhNB.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\hDvTxNi.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\WYoLRUS.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\JmGczhP.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\cNmkkVG.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\DsYzMPb.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\FGrxsIh.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\AFRsANu.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\gXXSuKG.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\tANYAld.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\kZnTNtO.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\XLNmapb.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\PwPkVqT.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\yYZHbgh.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\wZJXFlo.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
File created	C:\Windows\System\XZnIzeN.exe	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2860	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2860	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2860	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	29
PID 2864 wrote to memory of 2264	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2264	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2264	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	30
PID 2864 wrote to memory of 2548	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2548	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2548	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	31
PID 2864 wrote to memory of 2636	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2636	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2636	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	32
PID 2864 wrote to memory of 2196	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2196	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2196	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	33
PID 2864 wrote to memory of 2872	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2872	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2872	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	34
PID 2864 wrote to memory of 2728	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2728	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2728	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	35
PID 2864 wrote to memory of 2820	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2820	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2820	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	36
PID 2864 wrote to memory of 2608	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2608	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2608	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	37
PID 2864 wrote to memory of 2484	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2484	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2484	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	38
PID 2864 wrote to memory of 2440	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2440	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2440	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	39
PID 2864 wrote to memory of 2516	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2516	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2516	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	40
PID 2864 wrote to memory of 2956	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2956	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	41
PID 2864 wrote to memory of 2956	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	41
PID 2864 wrote to memory of 3004	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	42
PID 2864 wrote to memory of 3004	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	42
PID 2864 wrote to memory of 3004	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	42
PID 2864 wrote to memory of 1712	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	43
PID 2864 wrote to memory of 1712	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	43
PID 2864 wrote to memory of 1712	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	43
PID 2864 wrote to memory of 1120	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	44
PID 2864 wrote to memory of 1120	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	44
PID 2864 wrote to memory of 1120	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	44
PID 2864 wrote to memory of 2028	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	45
PID 2864 wrote to memory of 2028	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	45
PID 2864 wrote to memory of 2028	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	45
PID 2864 wrote to memory of 2816	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	46
PID 2864 wrote to memory of 2816	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	46
PID 2864 wrote to memory of 2816	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	46
PID 2864 wrote to memory of 1652	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1652	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1652	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	47
PID 2864 wrote to memory of 1276	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1276	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1276	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	48
PID 2864 wrote to memory of 1540	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	49
PID 2864 wrote to memory of 1540	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	49
PID 2864 wrote to memory of 1540	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	49
PID 2864 wrote to memory of 2704	2864	001152efbe8e521df04e21310439dbad_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\001152efbe8e521df04e21310439dbad_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\001152efbe8e521df04e21310439dbad_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System\FGrxsIh.exe
  C:\Windows\System\FGrxsIh.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\AFRsANu.exe
  C:\Windows\System\AFRsANu.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\cyIrTku.exe
  C:\Windows\System\cyIrTku.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\hDvTxNi.exe
  C:\Windows\System\hDvTxNi.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\SFkbsai.exe
  C:\Windows\System\SFkbsai.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\ZKZFqQB.exe
  C:\Windows\System\ZKZFqQB.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\XLNmapb.exe
  C:\Windows\System\XLNmapb.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\xEDCFfB.exe
  C:\Windows\System\xEDCFfB.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\cFGZkWV.exe
  C:\Windows\System\cFGZkWV.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\PwPkVqT.exe
  C:\Windows\System\PwPkVqT.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yYZHbgh.exe
  C:\Windows\System\yYZHbgh.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\wZJXFlo.exe
  C:\Windows\System\wZJXFlo.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\WYoLRUS.exe
  C:\Windows\System\WYoLRUS.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\JmGczhP.exe
  C:\Windows\System\JmGczhP.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\WtzzZIo.exe
  C:\Windows\System\WtzzZIo.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\sWmNVXy.exe
  C:\Windows\System\sWmNVXy.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\BXbKXkz.exe
  C:\Windows\System\BXbKXkz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\cNmkkVG.exe
  C:\Windows\System\cNmkkVG.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\XZnIzeN.exe
  C:\Windows\System\XZnIzeN.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\kUWFlzn.exe
  C:\Windows\System\kUWFlzn.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\bHFcGKI.exe
  C:\Windows\System\bHFcGKI.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\DsYzMPb.exe
  C:\Windows\System\DsYzMPb.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\ooJhXYL.exe
  C:\Windows\System\ooJhXYL.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\kZnTNtO.exe
  C:\Windows\System\kZnTNtO.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\LMipXqn.exe
  C:\Windows\System\LMipXqn.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\iobJcpu.exe
  C:\Windows\System\iobJcpu.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\gXXSuKG.exe
  C:\Windows\System\gXXSuKG.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\ETTbDIU.exe
  C:\Windows\System\ETTbDIU.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\aJtRTTa.exe
  C:\Windows\System\aJtRTTa.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\oDFuaAs.exe
  C:\Windows\System\oDFuaAs.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\AKSsPYe.exe
  C:\Windows\System\AKSsPYe.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\tANYAld.exe
  C:\Windows\System\tANYAld.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\mHrMblT.exe
  C:\Windows\System\mHrMblT.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\licMXdx.exe
  C:\Windows\System\licMXdx.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\PHiHhqH.exe
  C:\Windows\System\PHiHhqH.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\MYBnhNB.exe
  C:\Windows\System\MYBnhNB.exe
  2⤵
  PID:1556
- C:\Windows\System\OMltlXd.exe
  C:\Windows\System\OMltlXd.exe
  2⤵
  PID:1396
- C:\Windows\System\KKgNmBC.exe
  C:\Windows\System\KKgNmBC.exe
  2⤵
  PID:764
- C:\Windows\System\vWITMvK.exe
  C:\Windows\System\vWITMvK.exe
  2⤵
  PID:1980
- C:\Windows\System\ifqbCaJ.exe
  C:\Windows\System\ifqbCaJ.exe
  2⤵
  PID:2084
- C:\Windows\System\HpZSqJI.exe
  C:\Windows\System\HpZSqJI.exe
  2⤵
  PID:1760
- C:\Windows\System\uEbZMqT.exe
  C:\Windows\System\uEbZMqT.exe
  2⤵
  PID:2228
- C:\Windows\System\QdDMNTC.exe
  C:\Windows\System\QdDMNTC.exe
  2⤵
  PID:2052
- C:\Windows\System\qYVEoSe.exe
  C:\Windows\System\qYVEoSe.exe
  2⤵
  PID:3056
- C:\Windows\System\UcbEcLU.exe
  C:\Windows\System\UcbEcLU.exe
  2⤵
  PID:2612
- C:\Windows\System\HnKapeI.exe
  C:\Windows\System\HnKapeI.exe
  2⤵
  PID:2468
- C:\Windows\System\ytGkRiV.exe
  C:\Windows\System\ytGkRiV.exe
  2⤵
  PID:1452
- C:\Windows\System\ZzpQXMP.exe
  C:\Windows\System\ZzpQXMP.exe
  2⤵
  PID:2640
- C:\Windows\System\NNmVtBR.exe
  C:\Windows\System\NNmVtBR.exe
  2⤵
  PID:2644
- C:\Windows\System\bbhtOki.exe
  C:\Windows\System\bbhtOki.exe
  2⤵
  PID:2464
- C:\Windows\System\CqGmszs.exe
  C:\Windows\System\CqGmszs.exe
  2⤵
  PID:2736
- C:\Windows\System\YoMSctz.exe
  C:\Windows\System\YoMSctz.exe
  2⤵
  PID:2492
- C:\Windows\System\BcRVRnn.exe
  C:\Windows\System\BcRVRnn.exe
  2⤵
  PID:2584
- C:\Windows\System\XiWXOcE.exe
  C:\Windows\System\XiWXOcE.exe
  2⤵
  PID:2476
- C:\Windows\System\pQDFQAC.exe
  C:\Windows\System\pQDFQAC.exe
  2⤵
  PID:2696
- C:\Windows\System\jheMhSc.exe
  C:\Windows\System\jheMhSc.exe
  2⤵
  PID:2772
- C:\Windows\System\jyyveSM.exe
  C:\Windows\System\jyyveSM.exe
  2⤵
  PID:2856
- C:\Windows\System\fRBnKHG.exe
  C:\Windows\System\fRBnKHG.exe
  2⤵
  PID:1248
- C:\Windows\System\wEHQgpa.exe
  C:\Windows\System\wEHQgpa.exe
  2⤵
  PID:2676
- C:\Windows\System\sMjtkpl.exe
  C:\Windows\System\sMjtkpl.exe
  2⤵
  PID:1960
- C:\Windows\System\TVrGIAN.exe
  C:\Windows\System\TVrGIAN.exe
  2⤵
  PID:1988
- C:\Windows\System\pgtYPTB.exe
  C:\Windows\System\pgtYPTB.exe
  2⤵
  PID:1940
- C:\Windows\System\cVcaZGP.exe
  C:\Windows\System\cVcaZGP.exe
  2⤵
  PID:2904
- C:\Windows\System\haQRYTH.exe
  C:\Windows\System\haQRYTH.exe
  2⤵
  PID:400
- C:\Windows\System\HkyEpnm.exe
  C:\Windows\System\HkyEpnm.exe
  2⤵
  PID:1804
- C:\Windows\System\LxEWkDn.exe
  C:\Windows\System\LxEWkDn.exe
  2⤵
  PID:488
- C:\Windows\System\QZxKsKH.exe
  C:\Windows\System\QZxKsKH.exe
  2⤵
  PID:1868
- C:\Windows\System\kyapHbh.exe
  C:\Windows\System\kyapHbh.exe
  2⤵
  PID:1744
- C:\Windows\System\PXudtdi.exe
  C:\Windows\System\PXudtdi.exe
  2⤵
  PID:2776
- C:\Windows\System\PzNafbn.exe
  C:\Windows\System\PzNafbn.exe
  2⤵
  PID:1284
- C:\Windows\System\XVUpgJp.exe
  C:\Windows\System\XVUpgJp.exe
  2⤵
  PID:2916
- C:\Windows\System\qiAYzlb.exe
  C:\Windows\System\qiAYzlb.exe
  2⤵
  PID:1588
- C:\Windows\System\qnHVYfE.exe
  C:\Windows\System\qnHVYfE.exe
  2⤵
  PID:632
- C:\Windows\System\lGcZoIr.exe
  C:\Windows\System\lGcZoIr.exe
  2⤵
  PID:1692
- C:\Windows\System\dawrvgu.exe
  C:\Windows\System\dawrvgu.exe
  2⤵
  PID:688
- C:\Windows\System\DZdmSDJ.exe
  C:\Windows\System\DZdmSDJ.exe
  2⤵
  PID:1028
- C:\Windows\System\ldHmEkx.exe
  C:\Windows\System\ldHmEkx.exe
  2⤵
  PID:824
- C:\Windows\System\alSkGNK.exe
  C:\Windows\System\alSkGNK.exe
  2⤵
  PID:1688
- C:\Windows\System\ZgWVhYi.exe
  C:\Windows\System\ZgWVhYi.exe
  2⤵
  PID:1784
- C:\Windows\System\aJjSUQx.exe
  C:\Windows\System\aJjSUQx.exe
  2⤵
  PID:2652
- C:\Windows\System\PKlkXCS.exe
  C:\Windows\System\PKlkXCS.exe
  2⤵
  PID:1324
- C:\Windows\System\qnuZmWD.exe
  C:\Windows\System\qnuZmWD.exe
  2⤵
  PID:1256
- C:\Windows\System\xzMQApI.exe
  C:\Windows\System\xzMQApI.exe
  2⤵
  PID:2688
- C:\Windows\System\TPiAcmy.exe
  C:\Windows\System\TPiAcmy.exe
  2⤵
  PID:2712
- C:\Windows\System\XqHRcmz.exe
  C:\Windows\System\XqHRcmz.exe
  2⤵
  PID:2716
- C:\Windows\System\NDQPQcf.exe
  C:\Windows\System\NDQPQcf.exe
  2⤵
  PID:380
- C:\Windows\System\mVJgBjr.exe
  C:\Windows\System\mVJgBjr.exe
  2⤵
  PID:2528
- C:\Windows\System\IeyYahU.exe
  C:\Windows\System\IeyYahU.exe
  2⤵
  PID:1380
- C:\Windows\System\KIPpbPx.exe
  C:\Windows\System\KIPpbPx.exe
  2⤵
  PID:2992
- C:\Windows\System\dOfjZTk.exe
  C:\Windows\System\dOfjZTk.exe
  2⤵
  PID:2220
- C:\Windows\System\nbRyIKP.exe
  C:\Windows\System\nbRyIKP.exe
  2⤵
  PID:2824
- C:\Windows\System\BGOiVxE.exe
  C:\Windows\System\BGOiVxE.exe
  2⤵
  PID:2180
- C:\Windows\System\YEQcPJh.exe
  C:\Windows\System\YEQcPJh.exe
  2⤵
  PID:2388
- C:\Windows\System\mplCRPW.exe
  C:\Windows\System\mplCRPW.exe
  2⤵
  PID:1040
- C:\Windows\System\LrAxGGN.exe
  C:\Windows\System\LrAxGGN.exe
  2⤵
  PID:2380
- C:\Windows\System\egPkoJP.exe
  C:\Windows\System\egPkoJP.exe
  2⤵
  PID:1860
- C:\Windows\System\PezHgnR.exe
  C:\Windows\System\PezHgnR.exe
  2⤵
  PID:1880
- C:\Windows\System\cVEeFfk.exe
  C:\Windows\System\cVEeFfk.exe
  2⤵
  PID:2384
- C:\Windows\System\jnNOgUW.exe
  C:\Windows\System\jnNOgUW.exe
  2⤵
  PID:2024
- C:\Windows\System\jFQIHeB.exe
  C:\Windows\System\jFQIHeB.exe
  2⤵
  PID:1332
- C:\Windows\System\miaipbB.exe
  C:\Windows\System\miaipbB.exe
  2⤵
  PID:2112
- C:\Windows\System\PIwlLbJ.exe
  C:\Windows\System\PIwlLbJ.exe
  2⤵
  PID:1808
- C:\Windows\System\lLuElDG.exe
  C:\Windows\System\lLuElDG.exe
  2⤵
  PID:1716
- C:\Windows\System\bQAlCfB.exe
  C:\Windows\System\bQAlCfB.exe
  2⤵
  PID:1768
- C:\Windows\System\yCYkRPi.exe
  C:\Windows\System\yCYkRPi.exe
  2⤵
  PID:2164
- C:\Windows\System\DizpuZM.exe
  C:\Windows\System\DizpuZM.exe
  2⤵
  PID:1820
- C:\Windows\System\uThjAxn.exe
  C:\Windows\System\uThjAxn.exe
  2⤵
  PID:660
- C:\Windows\System\fDWKYob.exe
  C:\Windows\System\fDWKYob.exe
  2⤵
  PID:1192
- C:\Windows\System\AzzQciZ.exe
  C:\Windows\System\AzzQciZ.exe
  2⤵
  PID:1496
- C:\Windows\System\RWZkLie.exe
  C:\Windows\System\RWZkLie.exe
  2⤵
  PID:3076
- C:\Windows\System\gWVFpEg.exe
  C:\Windows\System\gWVFpEg.exe
  2⤵
  PID:3092
- C:\Windows\System\uiWwmnq.exe
  C:\Windows\System\uiWwmnq.exe
  2⤵
  PID:3108
- C:\Windows\System\XhsIhWJ.exe
  C:\Windows\System\XhsIhWJ.exe
  2⤵
  PID:3124
- C:\Windows\System\aXGCNQJ.exe
  C:\Windows\System\aXGCNQJ.exe
  2⤵
  PID:3140
- C:\Windows\System\kTEHrKZ.exe
  C:\Windows\System\kTEHrKZ.exe
  2⤵
  PID:3156
- C:\Windows\System\SMYxoiL.exe
  C:\Windows\System\SMYxoiL.exe
  2⤵
  PID:3172
- C:\Windows\System\szaZesv.exe
  C:\Windows\System\szaZesv.exe
  2⤵
  PID:3188
- C:\Windows\System\lWdaekY.exe
  C:\Windows\System\lWdaekY.exe
  2⤵
  PID:3204
- C:\Windows\System\RzFyxTh.exe
  C:\Windows\System\RzFyxTh.exe
  2⤵
  PID:3220
- C:\Windows\System\UrWWPqH.exe
  C:\Windows\System\UrWWPqH.exe
  2⤵
  PID:3236
- C:\Windows\System\UyVEpIV.exe
  C:\Windows\System\UyVEpIV.exe
  2⤵
  PID:3252
- C:\Windows\System\YzEArbD.exe
  C:\Windows\System\YzEArbD.exe
  2⤵
  PID:3268
- C:\Windows\System\hlsAeGs.exe
  C:\Windows\System\hlsAeGs.exe
  2⤵
  PID:3284
- C:\Windows\System\eSMCwLQ.exe
  C:\Windows\System\eSMCwLQ.exe
  2⤵
  PID:3300
- C:\Windows\System\Keoehuu.exe
  C:\Windows\System\Keoehuu.exe
  2⤵
  PID:3316
- C:\Windows\System\VeLOhzS.exe
  C:\Windows\System\VeLOhzS.exe
  2⤵
  PID:3332
- C:\Windows\System\SzyGFKw.exe
  C:\Windows\System\SzyGFKw.exe
  2⤵
  PID:3348
- C:\Windows\System\UvlAjrJ.exe
  C:\Windows\System\UvlAjrJ.exe
  2⤵
  PID:3364
- C:\Windows\System\fcGEjAx.exe
  C:\Windows\System\fcGEjAx.exe
  2⤵
  PID:3380
- C:\Windows\System\kKpkjgY.exe
  C:\Windows\System\kKpkjgY.exe
  2⤵
  PID:3396
- C:\Windows\System\ZsxuJHJ.exe
  C:\Windows\System\ZsxuJHJ.exe
  2⤵
  PID:3412
- C:\Windows\System\nMYCWrK.exe
  C:\Windows\System\nMYCWrK.exe
  2⤵
  PID:3428
- C:\Windows\System\uSZVtyO.exe
  C:\Windows\System\uSZVtyO.exe
  2⤵
  PID:3444
- C:\Windows\System\LutqBrn.exe
  C:\Windows\System\LutqBrn.exe
  2⤵
  PID:3460
- C:\Windows\System\yZMYPaU.exe
  C:\Windows\System\yZMYPaU.exe
  2⤵
  PID:3476
- C:\Windows\System\NtfXllQ.exe
  C:\Windows\System\NtfXllQ.exe
  2⤵
  PID:3492
- C:\Windows\System\LHsNlam.exe
  C:\Windows\System\LHsNlam.exe
  2⤵
  PID:3508
- C:\Windows\System\dlXVNhs.exe
  C:\Windows\System\dlXVNhs.exe
  2⤵
  PID:3524
- C:\Windows\System\Foihlum.exe
  C:\Windows\System\Foihlum.exe
  2⤵
  PID:3540
- C:\Windows\System\OckekKM.exe
  C:\Windows\System\OckekKM.exe
  2⤵
  PID:3556
- C:\Windows\System\tuPvJyz.exe
  C:\Windows\System\tuPvJyz.exe
  2⤵
  PID:3572
- C:\Windows\System\RYPzeuQ.exe
  C:\Windows\System\RYPzeuQ.exe
  2⤵
  PID:3588
- C:\Windows\System\KKRyqkd.exe
  C:\Windows\System\KKRyqkd.exe
  2⤵
  PID:3604
- C:\Windows\System\dhaiRpE.exe
  C:\Windows\System\dhaiRpE.exe
  2⤵
  PID:3620
- C:\Windows\System\RAQnIdC.exe
  C:\Windows\System\RAQnIdC.exe
  2⤵
  PID:3636
- C:\Windows\System\WeEzWuc.exe
  C:\Windows\System\WeEzWuc.exe
  2⤵
  PID:3652
- C:\Windows\System\HmLZdKQ.exe
  C:\Windows\System\HmLZdKQ.exe
  2⤵
  PID:3668
- C:\Windows\System\oQGSxVP.exe
  C:\Windows\System\oQGSxVP.exe
  2⤵
  PID:3684
- C:\Windows\System\MTbAOdS.exe
  C:\Windows\System\MTbAOdS.exe
  2⤵
  PID:3700
- C:\Windows\System\nYPmduA.exe
  C:\Windows\System\nYPmduA.exe
  2⤵
  PID:3716
- C:\Windows\System\MkhPBSR.exe
  C:\Windows\System\MkhPBSR.exe
  2⤵
  PID:3732
- C:\Windows\System\SWWbdpK.exe
  C:\Windows\System\SWWbdpK.exe
  2⤵
  PID:3748
- C:\Windows\System\ZfUJFgh.exe
  C:\Windows\System\ZfUJFgh.exe
  2⤵
  PID:3764
- C:\Windows\System\lkRupLV.exe
  C:\Windows\System\lkRupLV.exe
  2⤵
  PID:3780
- C:\Windows\System\HpVVtwl.exe
  C:\Windows\System\HpVVtwl.exe
  2⤵
  PID:3796
- C:\Windows\System\xniBnfu.exe
  C:\Windows\System\xniBnfu.exe
  2⤵
  PID:3812
- C:\Windows\System\IwnwWOs.exe
  C:\Windows\System\IwnwWOs.exe
  2⤵
  PID:3828
- C:\Windows\System\jGuSKLu.exe
  C:\Windows\System\jGuSKLu.exe
  2⤵
  PID:3844
- C:\Windows\System\FfOhCgH.exe
  C:\Windows\System\FfOhCgH.exe
  2⤵
  PID:3860
- C:\Windows\System\DtvJKHV.exe
  C:\Windows\System\DtvJKHV.exe
  2⤵
  PID:3876
- C:\Windows\System\DLrDPCF.exe
  C:\Windows\System\DLrDPCF.exe
  2⤵
  PID:3892
- C:\Windows\System\lEKhhXr.exe
  C:\Windows\System\lEKhhXr.exe
  2⤵
  PID:3908
- C:\Windows\System\BVJTqci.exe
  C:\Windows\System\BVJTqci.exe
  2⤵
  PID:3924
- C:\Windows\System\ywLurwU.exe
  C:\Windows\System\ywLurwU.exe
  2⤵
  PID:3940
- C:\Windows\System\nqgllyu.exe
  C:\Windows\System\nqgllyu.exe
  2⤵
  PID:3956
- C:\Windows\System\DtkqpRi.exe
  C:\Windows\System\DtkqpRi.exe
  2⤵
  PID:3976
- C:\Windows\System\CzkpHcV.exe
  C:\Windows\System\CzkpHcV.exe
  2⤵
  PID:3992
- C:\Windows\System\uBNJWLx.exe
  C:\Windows\System\uBNJWLx.exe
  2⤵
  PID:4008
- C:\Windows\System\sRXhter.exe
  C:\Windows\System\sRXhter.exe
  2⤵
  PID:4024
- C:\Windows\System\SBxjvIE.exe
  C:\Windows\System\SBxjvIE.exe
  2⤵
  PID:4040
- C:\Windows\System\JFSwWhs.exe
  C:\Windows\System\JFSwWhs.exe
  2⤵
  PID:4056
- C:\Windows\System\XJguxbx.exe
  C:\Windows\System\XJguxbx.exe
  2⤵
  PID:4072
- C:\Windows\System\VjIyzLF.exe
  C:\Windows\System\VjIyzLF.exe
  2⤵
  PID:4088
- C:\Windows\System\yzAStDT.exe
  C:\Windows\System\yzAStDT.exe
  2⤵
  PID:2552
- C:\Windows\System\iFweqPN.exe
  C:\Windows\System\iFweqPN.exe
  2⤵
  PID:4112
- C:\Windows\System\fTkSXFV.exe
  C:\Windows\System\fTkSXFV.exe
  2⤵
  PID:4132
- C:\Windows\System\EVrqnLW.exe
  C:\Windows\System\EVrqnLW.exe
  2⤵
  PID:4148
- C:\Windows\System\mVRFDTI.exe
  C:\Windows\System\mVRFDTI.exe
  2⤵
  PID:4164
- C:\Windows\System\vFMhRHT.exe
  C:\Windows\System\vFMhRHT.exe
  2⤵
  PID:4180
- C:\Windows\System\HPoTukd.exe
  C:\Windows\System\HPoTukd.exe
  2⤵
  PID:4196
- C:\Windows\System\ncBCDBa.exe
  C:\Windows\System\ncBCDBa.exe
  2⤵
  PID:4212
- C:\Windows\System\SVJWEYb.exe
  C:\Windows\System\SVJWEYb.exe
  2⤵
  PID:4228
- C:\Windows\System\zqvTjLC.exe
  C:\Windows\System\zqvTjLC.exe
  2⤵
  PID:4244
- C:\Windows\System\OjgWIdz.exe
  C:\Windows\System\OjgWIdz.exe
  2⤵
  PID:4260
- C:\Windows\System\BkYmSVE.exe
  C:\Windows\System\BkYmSVE.exe
  2⤵
  PID:4276
- C:\Windows\System\jllKzxl.exe
  C:\Windows\System\jllKzxl.exe
  2⤵
  PID:4292
- C:\Windows\System\orLBrda.exe
  C:\Windows\System\orLBrda.exe
  2⤵
  PID:4308
- C:\Windows\System\AeKfZhZ.exe
  C:\Windows\System\AeKfZhZ.exe
  2⤵
  PID:4324
- C:\Windows\System\mgfrGaX.exe
  C:\Windows\System\mgfrGaX.exe
  2⤵
  PID:4340
- C:\Windows\System\sGurcrh.exe
  C:\Windows\System\sGurcrh.exe
  2⤵
  PID:4356
- C:\Windows\System\MMYWBza.exe
  C:\Windows\System\MMYWBza.exe
  2⤵
  PID:4372
- C:\Windows\System\AAkAVqT.exe
  C:\Windows\System\AAkAVqT.exe
  2⤵
  PID:4388
- C:\Windows\System\HjmTOBe.exe
  C:\Windows\System\HjmTOBe.exe
  2⤵
  PID:4404
- C:\Windows\System\RHIRtcd.exe
  C:\Windows\System\RHIRtcd.exe
  2⤵
  PID:4420
- C:\Windows\System\HfbnMPK.exe
  C:\Windows\System\HfbnMPK.exe
  2⤵
  PID:4436
- C:\Windows\System\swzjvTi.exe
  C:\Windows\System\swzjvTi.exe
  2⤵
  PID:4452
- C:\Windows\System\WiLrxyf.exe
  C:\Windows\System\WiLrxyf.exe
  2⤵
  PID:4468
- C:\Windows\System\nluLEol.exe
  C:\Windows\System\nluLEol.exe
  2⤵
  PID:4484
- C:\Windows\System\FcMzYHd.exe
  C:\Windows\System\FcMzYHd.exe
  2⤵
  PID:4500
- C:\Windows\System\IQxIRly.exe
  C:\Windows\System\IQxIRly.exe
  2⤵
  PID:4516
- C:\Windows\System\jpZUAhu.exe
  C:\Windows\System\jpZUAhu.exe
  2⤵
  PID:4532
- C:\Windows\System\GIduqlN.exe
  C:\Windows\System\GIduqlN.exe
  2⤵
  PID:4656
- C:\Windows\System\erFhLQv.exe
  C:\Windows\System\erFhLQv.exe
  2⤵
  PID:4672
- C:\Windows\System\bBEADtu.exe
  C:\Windows\System\bBEADtu.exe
  2⤵
  PID:4688
- C:\Windows\System\XMiqCiu.exe
  C:\Windows\System\XMiqCiu.exe
  2⤵
  PID:4704
- C:\Windows\System\cUTPwLT.exe
  C:\Windows\System\cUTPwLT.exe
  2⤵
  PID:4720
- C:\Windows\System\XSYjcND.exe
  C:\Windows\System\XSYjcND.exe
  2⤵
  PID:4736
- C:\Windows\System\NWUuqPj.exe
  C:\Windows\System\NWUuqPj.exe
  2⤵
  PID:4752
- C:\Windows\System\pwTZjAV.exe
  C:\Windows\System\pwTZjAV.exe
  2⤵
  PID:4768
- C:\Windows\System\mOBLugh.exe
  C:\Windows\System\mOBLugh.exe
  2⤵
  PID:4784
- C:\Windows\System\PecUEXD.exe
  C:\Windows\System\PecUEXD.exe
  2⤵
  PID:4800
- C:\Windows\System\ksigTyy.exe
  C:\Windows\System\ksigTyy.exe
  2⤵
  PID:4820
- C:\Windows\System\eDJAeDm.exe
  C:\Windows\System\eDJAeDm.exe
  2⤵
  PID:4836
- C:\Windows\System\zcetzNg.exe
  C:\Windows\System\zcetzNg.exe
  2⤵
  PID:4852
- C:\Windows\System\wlxdJel.exe
  C:\Windows\System\wlxdJel.exe
  2⤵
  PID:4868
- C:\Windows\System\VseDgvA.exe
  C:\Windows\System\VseDgvA.exe
  2⤵
  PID:4884
- C:\Windows\System\nsxsUDL.exe
  C:\Windows\System\nsxsUDL.exe
  2⤵
  PID:4900
- C:\Windows\System\yydQBCX.exe
  C:\Windows\System\yydQBCX.exe
  2⤵
  PID:4916
- C:\Windows\System\RLPNCFf.exe
  C:\Windows\System\RLPNCFf.exe
  2⤵
  PID:4932
- C:\Windows\System\YzxMTJC.exe
  C:\Windows\System\YzxMTJC.exe
  2⤵
  PID:4948
- C:\Windows\System\ZwPKppz.exe
  C:\Windows\System\ZwPKppz.exe
  2⤵
  PID:4964
- C:\Windows\System\UqPZXHo.exe
  C:\Windows\System\UqPZXHo.exe
  2⤵
  PID:4980
- C:\Windows\System\rhMRXfe.exe
  C:\Windows\System\rhMRXfe.exe
  2⤵
  PID:4996
- C:\Windows\System\yHxFUjH.exe
  C:\Windows\System\yHxFUjH.exe
  2⤵
  PID:5012
- C:\Windows\System\XfPufdb.exe
  C:\Windows\System\XfPufdb.exe
  2⤵
  PID:5028
- C:\Windows\System\nsOnBqX.exe
  C:\Windows\System\nsOnBqX.exe
  2⤵
  PID:5044
- C:\Windows\System\QnASzHe.exe
  C:\Windows\System\QnASzHe.exe
  2⤵
  PID:5060
- C:\Windows\System\vNiSgiw.exe
  C:\Windows\System\vNiSgiw.exe
  2⤵
  PID:5076
- C:\Windows\System\NyhGojO.exe
  C:\Windows\System\NyhGojO.exe
  2⤵
  PID:5092
- C:\Windows\System\utxCpUB.exe
  C:\Windows\System\utxCpUB.exe
  2⤵
  PID:5108
- C:\Windows\System\GheaSZJ.exe
  C:\Windows\System\GheaSZJ.exe
  2⤵
  PID:2248
- C:\Windows\System\qmnXsKR.exe
  C:\Windows\System\qmnXsKR.exe
  2⤵
  PID:2032
- C:\Windows\System\uDKeChG.exe
  C:\Windows\System\uDKeChG.exe
  2⤵
  PID:1084
- C:\Windows\System\BtaTjop.exe
  C:\Windows\System\BtaTjop.exe
  2⤵
  PID:1516
- C:\Windows\System\QdkvLXY.exe
  C:\Windows\System\QdkvLXY.exe
  2⤵
  PID:2100
- C:\Windows\System\ahhrLnm.exe
  C:\Windows\System\ahhrLnm.exe
  2⤵
  PID:2000
- C:\Windows\System\bLERdjq.exe
  C:\Windows\System\bLERdjq.exe
  2⤵
  PID:2136
- C:\Windows\System\DvCndpu.exe
  C:\Windows\System\DvCndpu.exe
  2⤵
  PID:2368
- C:\Windows\System\yroPVKc.exe
  C:\Windows\System\yroPVKc.exe
  2⤵
  PID:2844
- C:\Windows\System\aAhyzVQ.exe
  C:\Windows\System\aAhyzVQ.exe
  2⤵
  PID:996
- C:\Windows\System\YbSQGAW.exe
  C:\Windows\System\YbSQGAW.exe
  2⤵
  PID:3116
- C:\Windows\System\bvrmowX.exe
  C:\Windows\System\bvrmowX.exe
  2⤵
  PID:3180
- C:\Windows\System\rrKRKip.exe
  C:\Windows\System\rrKRKip.exe
  2⤵
  PID:3308
- C:\Windows\System\jUYJIKp.exe
  C:\Windows\System\jUYJIKp.exe
  2⤵
  PID:2148
- C:\Windows\System\LxytHHq.exe
  C:\Windows\System\LxytHHq.exe
  2⤵
  PID:3516
- C:\Windows\System\uqIsnBc.exe
  C:\Windows\System\uqIsnBc.exe
  2⤵
  PID:2680
- C:\Windows\System\pylHTUR.exe
  C:\Windows\System\pylHTUR.exe
  2⤵
  PID:2460
- C:\Windows\System\lugzcOT.exe
  C:\Windows\System\lugzcOT.exe
  2⤵
  PID:2540
- C:\Windows\System\MQLPbMd.exe
  C:\Windows\System\MQLPbMd.exe
  2⤵
  PID:1312
- C:\Windows\System\WLkqiFX.exe
  C:\Windows\System\WLkqiFX.exe
  2⤵
  PID:1864
- C:\Windows\System\sJxgPcA.exe
  C:\Windows\System\sJxgPcA.exe
  2⤵
  PID:2792
- C:\Windows\System\tGczUco.exe
  C:\Windows\System\tGczUco.exe
  2⤵
  PID:2280
- C:\Windows\System\QOFGKgw.exe
  C:\Windows\System\QOFGKgw.exe
  2⤵
  PID:2156
- C:\Windows\System\XlVYgwv.exe
  C:\Windows\System\XlVYgwv.exe
  2⤵
  PID:1288
- C:\Windows\System\FnDxbon.exe
  C:\Windows\System\FnDxbon.exe
  2⤵
  PID:2684
- C:\Windows\System\tyFqqER.exe
  C:\Windows\System\tyFqqER.exe
  2⤵
  PID:1132
- C:\Windows\System\aMKqCHd.exe
  C:\Windows\System\aMKqCHd.exe
  2⤵
  PID:2244
- C:\Windows\System\rZZPuWj.exe
  C:\Windows\System\rZZPuWj.exe
  2⤵
  PID:944
- C:\Windows\System\jzSHTVw.exe
  C:\Windows\System\jzSHTVw.exe
  2⤵
  PID:1636
- C:\Windows\System\pvqwQbM.exe
  C:\Windows\System\pvqwQbM.exe
  2⤵
  PID:2444
- C:\Windows\System\qqfKEds.exe
  C:\Windows\System\qqfKEds.exe
  2⤵
  PID:3104
- C:\Windows\System\iOuKUJS.exe
  C:\Windows\System\iOuKUJS.exe
  2⤵
  PID:3168
- C:\Windows\System\LtEFZUV.exe
  C:\Windows\System\LtEFZUV.exe
  2⤵
  PID:3232
- C:\Windows\System\skAKJjA.exe
  C:\Windows\System\skAKJjA.exe
  2⤵
  PID:3296
- C:\Windows\System\yeavrcn.exe
  C:\Windows\System\yeavrcn.exe
  2⤵
  PID:3356
- C:\Windows\System\TEIQODC.exe
  C:\Windows\System\TEIQODC.exe
  2⤵
  PID:3424
- C:\Windows\System\UrnSYsA.exe
  C:\Windows\System\UrnSYsA.exe
  2⤵
  PID:3488
- C:\Windows\System\IZoTUZl.exe
  C:\Windows\System\IZoTUZl.exe
  2⤵
  PID:3580
- C:\Windows\System\JLriqJt.exe
  C:\Windows\System\JLriqJt.exe
  2⤵
  PID:3616
- C:\Windows\System\OMkiqBF.exe
  C:\Windows\System\OMkiqBF.exe
  2⤵
  PID:3676
- C:\Windows\System\TZbjbmv.exe
  C:\Windows\System\TZbjbmv.exe
  2⤵
  PID:3744
- C:\Windows\System\nbvRutu.exe
  C:\Windows\System\nbvRutu.exe
  2⤵
  PID:3808
- C:\Windows\System\FDKfuAh.exe
  C:\Windows\System\FDKfuAh.exe
  2⤵
  PID:3872
- C:\Windows\System\cKwdBIm.exe
  C:\Windows\System\cKwdBIm.exe
  2⤵
  PID:3936
- C:\Windows\System\HSrpXOH.exe
  C:\Windows\System\HSrpXOH.exe
  2⤵
  PID:4004
- C:\Windows\System\EfCpOWv.exe
  C:\Windows\System\EfCpOWv.exe
  2⤵
  PID:4068
- C:\Windows\System\dxRNVjy.exe
  C:\Windows\System\dxRNVjy.exe
  2⤵
  PID:4124
- C:\Windows\System\vzewfsW.exe
  C:\Windows\System\vzewfsW.exe
  2⤵
  PID:4188
- C:\Windows\System\jFJcnrz.exe
  C:\Windows\System\jFJcnrz.exe
  2⤵
  PID:4252
- C:\Windows\System\syDZxzi.exe
  C:\Windows\System\syDZxzi.exe
  2⤵
  PID:4316
- C:\Windows\System\oEPHwdX.exe
  C:\Windows\System\oEPHwdX.exe
  2⤵
  PID:4380
- C:\Windows\System\MVvrvEh.exe
  C:\Windows\System\MVvrvEh.exe
  2⤵
  PID:4444
- C:\Windows\System\vaomapF.exe
  C:\Windows\System\vaomapF.exe
  2⤵
  PID:4508
- C:\Windows\System\KylqsNU.exe
  C:\Windows\System\KylqsNU.exe
  2⤵
  PID:2592
- C:\Windows\System\zIpyyHu.exe
  C:\Windows\System\zIpyyHu.exe
  2⤵
  PID:3216
- C:\Windows\System\IkkcOkc.exe
  C:\Windows\System\IkkcOkc.exe
  2⤵
  PID:3888
- C:\Windows\System\jSHcdnQ.exe
  C:\Windows\System\jSHcdnQ.exe
  2⤵
  PID:3952
- C:\Windows\System\NSVJJqB.exe
  C:\Windows\System\NSVJJqB.exe
  2⤵
  PID:4020
- C:\Windows\System\FiLUjxv.exe
  C:\Windows\System\FiLUjxv.exe
  2⤵
  PID:4104
- C:\Windows\System\WcwGDDu.exe
  C:\Windows\System\WcwGDDu.exe
  2⤵
  PID:4560
- C:\Windows\System\MllKQtx.exe
  C:\Windows\System\MllKQtx.exe
  2⤵
  PID:4588
- C:\Windows\System\LBlfHhP.exe
  C:\Windows\System\LBlfHhP.exe
  2⤵
  PID:4620
- C:\Windows\System\ZawUTbT.exe
  C:\Windows\System\ZawUTbT.exe
  2⤵
  PID:4648
- C:\Windows\System\pPCdyLL.exe
  C:\Windows\System\pPCdyLL.exe
  2⤵
  PID:292
- C:\Windows\System\SeoCijs.exe
  C:\Windows\System\SeoCijs.exe
  2⤵
  PID:5136
- C:\Windows\System\LRMaRPB.exe
  C:\Windows\System\LRMaRPB.exe
  2⤵
  PID:5152
- C:\Windows\System\TjlrANm.exe
  C:\Windows\System\TjlrANm.exe
  2⤵
  PID:5168
- C:\Windows\System\RtBVqEi.exe
  C:\Windows\System\RtBVqEi.exe
  2⤵
  PID:5184
- C:\Windows\System\NJtvwUN.exe
  C:\Windows\System\NJtvwUN.exe
  2⤵
  PID:5200
- C:\Windows\System\wtPPGvh.exe
  C:\Windows\System\wtPPGvh.exe
  2⤵
  PID:5216
- C:\Windows\System\igWevRr.exe
  C:\Windows\System\igWevRr.exe
  2⤵
  PID:5232
- C:\Windows\System\uqVMDTW.exe
  C:\Windows\System\uqVMDTW.exe
  2⤵
  PID:5248
- C:\Windows\System\FXbDNqF.exe
  C:\Windows\System\FXbDNqF.exe
  2⤵
  PID:5264
- C:\Windows\System\uZkjLbg.exe
  C:\Windows\System\uZkjLbg.exe
  2⤵
  PID:5280
- C:\Windows\System\UXtFiKg.exe
  C:\Windows\System\UXtFiKg.exe
  2⤵
  PID:5296
- C:\Windows\System\ORXMlAy.exe
  C:\Windows\System\ORXMlAy.exe
  2⤵
  PID:5312
- C:\Windows\System\sVPiyRq.exe
  C:\Windows\System\sVPiyRq.exe
  2⤵
  PID:5328
- C:\Windows\System\jYoqvOn.exe
  C:\Windows\System\jYoqvOn.exe
  2⤵
  PID:5344
- C:\Windows\System\JbGJedm.exe
  C:\Windows\System\JbGJedm.exe
  2⤵
  PID:5360
- C:\Windows\System\Jakfnyf.exe
  C:\Windows\System\Jakfnyf.exe
  2⤵
  PID:5376
- C:\Windows\System\uKXHfBa.exe
  C:\Windows\System\uKXHfBa.exe
  2⤵
  PID:5392
- C:\Windows\System\iDeujOH.exe
  C:\Windows\System\iDeujOH.exe
  2⤵
  PID:5408
- C:\Windows\System\qPjoxLh.exe
  C:\Windows\System\qPjoxLh.exe
  2⤵
  PID:5424
- C:\Windows\System\rvlUkMV.exe
  C:\Windows\System\rvlUkMV.exe
  2⤵
  PID:5440
- C:\Windows\System\tcIgGMi.exe
  C:\Windows\System\tcIgGMi.exe
  2⤵
  PID:5456
- C:\Windows\System\pEBPXLq.exe
  C:\Windows\System\pEBPXLq.exe
  2⤵
  PID:5472
- C:\Windows\System\OBIzxNt.exe
  C:\Windows\System\OBIzxNt.exe
  2⤵
  PID:5488
- C:\Windows\System\cPwpyBi.exe
  C:\Windows\System\cPwpyBi.exe
  2⤵
  PID:5504
- C:\Windows\System\hFVVGiN.exe
  C:\Windows\System\hFVVGiN.exe
  2⤵
  PID:5520
- C:\Windows\System\XBgKPZv.exe
  C:\Windows\System\XBgKPZv.exe
  2⤵
  PID:5536
- C:\Windows\System\IlyYPpC.exe
  C:\Windows\System\IlyYPpC.exe
  2⤵
  PID:5552
- C:\Windows\System\fMwTemM.exe
  C:\Windows\System\fMwTemM.exe
  2⤵
  PID:5568
- C:\Windows\System\vMobVWK.exe
  C:\Windows\System\vMobVWK.exe
  2⤵
  PID:5584
- C:\Windows\System\JIxEPhD.exe
  C:\Windows\System\JIxEPhD.exe
  2⤵
  PID:5600
- C:\Windows\System\EPBbteE.exe
  C:\Windows\System\EPBbteE.exe
  2⤵
  PID:5616
- C:\Windows\System\ABLiBOE.exe
  C:\Windows\System\ABLiBOE.exe
  2⤵
  PID:5632
- C:\Windows\System\rNlngbL.exe
  C:\Windows\System\rNlngbL.exe
  2⤵
  PID:5648
- C:\Windows\System\GMWykzq.exe
  C:\Windows\System\GMWykzq.exe
  2⤵
  PID:5664
- C:\Windows\System\ciXqQUD.exe
  C:\Windows\System\ciXqQUD.exe
  2⤵
  PID:5680
- C:\Windows\System\OFusBcz.exe
  C:\Windows\System\OFusBcz.exe
  2⤵
  PID:5696
- C:\Windows\System\QPzlIKR.exe
  C:\Windows\System\QPzlIKR.exe
  2⤵
  PID:5712
- C:\Windows\System\HwDYeej.exe
  C:\Windows\System\HwDYeej.exe
  2⤵
  PID:5728
- C:\Windows\System\JSmQUfQ.exe
  C:\Windows\System\JSmQUfQ.exe
  2⤵
  PID:5744
- C:\Windows\System\HGZYWzl.exe
  C:\Windows\System\HGZYWzl.exe
  2⤵
  PID:5760
- C:\Windows\System\mXvjTUm.exe
  C:\Windows\System\mXvjTUm.exe
  2⤵
  PID:5776
- C:\Windows\System\hBxJpdt.exe
  C:\Windows\System\hBxJpdt.exe
  2⤵
  PID:5792
- C:\Windows\System\wNdInoU.exe
  C:\Windows\System\wNdInoU.exe
  2⤵
  PID:5808
- C:\Windows\System\HnwcHoc.exe
  C:\Windows\System\HnwcHoc.exe
  2⤵
  PID:5824
- C:\Windows\System\lEtTcXj.exe
  C:\Windows\System\lEtTcXj.exe
  2⤵
  PID:5840
- C:\Windows\System\LkqGiUC.exe
  C:\Windows\System\LkqGiUC.exe
  2⤵
  PID:5856
- C:\Windows\System\dffJwWK.exe
  C:\Windows\System\dffJwWK.exe
  2⤵
  PID:5872
- C:\Windows\System\mwSGHIS.exe
  C:\Windows\System\mwSGHIS.exe
  2⤵
  PID:5888
- C:\Windows\System\iwxpekD.exe
  C:\Windows\System\iwxpekD.exe
  2⤵
  PID:5904
- C:\Windows\System\dZyVWWQ.exe
  C:\Windows\System\dZyVWWQ.exe
  2⤵
  PID:5920
- C:\Windows\System\oSwVFJm.exe
  C:\Windows\System\oSwVFJm.exe
  2⤵
  PID:5936
- C:\Windows\System\PZrPxlI.exe
  C:\Windows\System\PZrPxlI.exe
  2⤵
  PID:5952
- C:\Windows\System\DRuaAbL.exe
  C:\Windows\System\DRuaAbL.exe
  2⤵
  PID:5968
- C:\Windows\System\gPFsFIB.exe
  C:\Windows\System\gPFsFIB.exe
  2⤵
  PID:5984
- C:\Windows\System\eSxzzLF.exe
  C:\Windows\System\eSxzzLF.exe
  2⤵
  PID:6000
- C:\Windows\System\TNNLiGb.exe
  C:\Windows\System\TNNLiGb.exe
  2⤵
  PID:6016
- C:\Windows\System\HNxjVTo.exe
  C:\Windows\System\HNxjVTo.exe
  2⤵
  PID:6032
- C:\Windows\System\WRjcRUj.exe
  C:\Windows\System\WRjcRUj.exe
  2⤵
  PID:6048
- C:\Windows\System\XcLOByq.exe
  C:\Windows\System\XcLOByq.exe
  2⤵
  PID:6064
- C:\Windows\System\WBoCZnJ.exe
  C:\Windows\System\WBoCZnJ.exe
  2⤵
  PID:6080
- C:\Windows\System\dsosHVl.exe
  C:\Windows\System\dsosHVl.exe
  2⤵
  PID:6096
- C:\Windows\System\fgsTyBI.exe
  C:\Windows\System\fgsTyBI.exe
  2⤵
  PID:6112
- C:\Windows\System\lTBTglA.exe
  C:\Windows\System\lTBTglA.exe
  2⤵
  PID:6128
- C:\Windows\System\KEugcXi.exe
  C:\Windows\System\KEugcXi.exe
  2⤵
  PID:6148
- C:\Windows\System\kNKNrqh.exe
  C:\Windows\System\kNKNrqh.exe
  2⤵
  PID:6164
- C:\Windows\System\BTnTebV.exe
  C:\Windows\System\BTnTebV.exe
  2⤵
  PID:6180
- C:\Windows\System\uKhcLqt.exe
  C:\Windows\System\uKhcLqt.exe
  2⤵
  PID:6196
- C:\Windows\System\LOZUZCg.exe
  C:\Windows\System\LOZUZCg.exe
  2⤵
  PID:6212
- C:\Windows\System\XtsIPsq.exe
  C:\Windows\System\XtsIPsq.exe
  2⤵
  PID:6228
- C:\Windows\System\dPFbSgB.exe
  C:\Windows\System\dPFbSgB.exe
  2⤵
  PID:6244
- C:\Windows\System\edKpTvw.exe
  C:\Windows\System\edKpTvw.exe
  2⤵
  PID:6260
- C:\Windows\System\NksEliK.exe
  C:\Windows\System\NksEliK.exe
  2⤵
  PID:6276
- C:\Windows\System\geavNeh.exe
  C:\Windows\System\geavNeh.exe
  2⤵
  PID:6292
- C:\Windows\System\PjAaKNb.exe
  C:\Windows\System\PjAaKNb.exe
  2⤵
  PID:6308
- C:\Windows\System\GGouYBk.exe
  C:\Windows\System\GGouYBk.exe
  2⤵
  PID:6324
- C:\Windows\System\twRIATK.exe
  C:\Windows\System\twRIATK.exe
  2⤵
  PID:6340
- C:\Windows\System\eddVVxk.exe
  C:\Windows\System\eddVVxk.exe
  2⤵
  PID:6356
- C:\Windows\System\ZCUPItc.exe
  C:\Windows\System\ZCUPItc.exe
  2⤵
  PID:6372
- C:\Windows\System\wNbTgxS.exe
  C:\Windows\System\wNbTgxS.exe
  2⤵
  PID:6388
- C:\Windows\System\ANgBIYo.exe
  C:\Windows\System\ANgBIYo.exe
  2⤵
  PID:6404
- C:\Windows\System\WwyDJql.exe
  C:\Windows\System\WwyDJql.exe
  2⤵
  PID:6420
- C:\Windows\System\nkyaOAH.exe
  C:\Windows\System\nkyaOAH.exe
  2⤵
  PID:6436
- C:\Windows\System\kBuUpDO.exe
  C:\Windows\System\kBuUpDO.exe
  2⤵
  PID:6452
- C:\Windows\System\tPZMteo.exe
  C:\Windows\System\tPZMteo.exe
  2⤵
  PID:6468
- C:\Windows\System\sUBiAEo.exe
  C:\Windows\System\sUBiAEo.exe
  2⤵
  PID:6484
- C:\Windows\System\EUTfTnZ.exe
  C:\Windows\System\EUTfTnZ.exe
  2⤵
  PID:6500
- C:\Windows\System\ildNjFy.exe
  C:\Windows\System\ildNjFy.exe
  2⤵
  PID:6516
- C:\Windows\System\Ernhwzb.exe
  C:\Windows\System\Ernhwzb.exe
  2⤵
  PID:6532
- C:\Windows\System\leQAyRq.exe
  C:\Windows\System\leQAyRq.exe
  2⤵
  PID:6548
- C:\Windows\System\aFqbWMO.exe
  C:\Windows\System\aFqbWMO.exe
  2⤵
  PID:6564
- C:\Windows\System\VHyyiEi.exe
  C:\Windows\System\VHyyiEi.exe
  2⤵
  PID:6580
- C:\Windows\System\kLVMJqa.exe
  C:\Windows\System\kLVMJqa.exe
  2⤵
  PID:6596
- C:\Windows\System\leUGeaf.exe
  C:\Windows\System\leUGeaf.exe
  2⤵
  PID:6612
- C:\Windows\System\gAJAXaN.exe
  C:\Windows\System\gAJAXaN.exe
  2⤵
  PID:6628
- C:\Windows\System\HYthKGx.exe
  C:\Windows\System\HYthKGx.exe
  2⤵
  PID:6644
- C:\Windows\System\JbwFMNF.exe
  C:\Windows\System\JbwFMNF.exe
  2⤵
  PID:6660
- C:\Windows\System\HkldApK.exe
  C:\Windows\System\HkldApK.exe
  2⤵
  PID:6676
- C:\Windows\System\pmKcmmF.exe
  C:\Windows\System\pmKcmmF.exe
  2⤵
  PID:6692
- C:\Windows\System\BoBwqpF.exe
  C:\Windows\System\BoBwqpF.exe
  2⤵
  PID:6708
- C:\Windows\System\eaqWrzA.exe
  C:\Windows\System\eaqWrzA.exe
  2⤵
  PID:6724
- C:\Windows\System\YYJFrDG.exe
  C:\Windows\System\YYJFrDG.exe
  2⤵
  PID:6740
- C:\Windows\System\KhfOEHv.exe
  C:\Windows\System\KhfOEHv.exe
  2⤵
  PID:6756
- C:\Windows\System\uCzgjMr.exe
  C:\Windows\System\uCzgjMr.exe
  2⤵
  PID:6772
- C:\Windows\System\vPuzTWz.exe
  C:\Windows\System\vPuzTWz.exe
  2⤵
  PID:6788
- C:\Windows\System\YfabUDm.exe
  C:\Windows\System\YfabUDm.exe
  2⤵
  PID:6804
- C:\Windows\System\FshXIIh.exe
  C:\Windows\System\FshXIIh.exe
  2⤵
  PID:6820
- C:\Windows\System\SSQhRJN.exe
  C:\Windows\System\SSQhRJN.exe
  2⤵
  PID:6836
- C:\Windows\System\LJTNgGB.exe
  C:\Windows\System\LJTNgGB.exe
  2⤵
  PID:6852
- C:\Windows\System\UxcfBfz.exe
  C:\Windows\System\UxcfBfz.exe
  2⤵
  PID:6868
- C:\Windows\System\lgWLbqA.exe
  C:\Windows\System\lgWLbqA.exe
  2⤵
  PID:6884
- C:\Windows\System\CqwWCrG.exe
  C:\Windows\System\CqwWCrG.exe
  2⤵
  PID:6900
- C:\Windows\System\AoKMNEs.exe
  C:\Windows\System\AoKMNEs.exe
  2⤵
  PID:6916
- C:\Windows\System\oRpHjLV.exe
  C:\Windows\System\oRpHjLV.exe
  2⤵
  PID:6932
- C:\Windows\System\nIbySsa.exe
  C:\Windows\System\nIbySsa.exe
  2⤵
  PID:6948
- C:\Windows\System\rvRfrpK.exe
  C:\Windows\System\rvRfrpK.exe
  2⤵
  PID:6964
- C:\Windows\System\AhWiiIW.exe
  C:\Windows\System\AhWiiIW.exe
  2⤵
  PID:6980
- C:\Windows\System\YFSmuUt.exe
  C:\Windows\System\YFSmuUt.exe
  2⤵
  PID:6996
- C:\Windows\System\ADRxhNP.exe
  C:\Windows\System\ADRxhNP.exe
  2⤵
  PID:7012
- C:\Windows\System\iAQSXKA.exe
  C:\Windows\System\iAQSXKA.exe
  2⤵
  PID:7028
- C:\Windows\System\dsiNTcE.exe
  C:\Windows\System\dsiNTcE.exe
  2⤵
  PID:7044
- C:\Windows\System\ePMGFAp.exe
  C:\Windows\System\ePMGFAp.exe
  2⤵
  PID:7060
- C:\Windows\System\IoYckQK.exe
  C:\Windows\System\IoYckQK.exe
  2⤵
  PID:7076
- C:\Windows\System\sEzgwra.exe
  C:\Windows\System\sEzgwra.exe
  2⤵
  PID:7092
- C:\Windows\System\fHXYCyR.exe
  C:\Windows\System\fHXYCyR.exe
  2⤵
  PID:7108
- C:\Windows\System\fExHWId.exe
  C:\Windows\System\fExHWId.exe
  2⤵
  PID:7124
- C:\Windows\System\WNPXmFr.exe
  C:\Windows\System\WNPXmFr.exe
  2⤵
  PID:7140
- C:\Windows\System\btIdoLB.exe
  C:\Windows\System\btIdoLB.exe
  2⤵
  PID:7156
- C:\Windows\System\fMjvCYU.exe
  C:\Windows\System\fMjvCYU.exe
  2⤵
  PID:7176
- C:\Windows\System\RvBdORk.exe
  C:\Windows\System\RvBdORk.exe
  2⤵
  PID:7192
- C:\Windows\System\BbcyWdd.exe
  C:\Windows\System\BbcyWdd.exe
  2⤵
  PID:7208
- C:\Windows\System\xsYEcre.exe
  C:\Windows\System\xsYEcre.exe
  2⤵
  PID:7224
- C:\Windows\System\xYwsSDd.exe
  C:\Windows\System\xYwsSDd.exe
  2⤵
  PID:7240
- C:\Windows\System\uqVUSrU.exe
  C:\Windows\System\uqVUSrU.exe
  2⤵
  PID:7256
- C:\Windows\System\WLTOgWU.exe
  C:\Windows\System\WLTOgWU.exe
  2⤵
  PID:7272
- C:\Windows\System\sjoBXOa.exe
  C:\Windows\System\sjoBXOa.exe
  2⤵
  PID:7288
- C:\Windows\System\LITQMVL.exe
  C:\Windows\System\LITQMVL.exe
  2⤵
  PID:7304
- C:\Windows\System\FgGjvLq.exe
  C:\Windows\System\FgGjvLq.exe
  2⤵
  PID:7320
- C:\Windows\System\eqXHwJr.exe
  C:\Windows\System\eqXHwJr.exe
  2⤵
  PID:7336
- C:\Windows\System\sgbfyRO.exe
  C:\Windows\System\sgbfyRO.exe
  2⤵
  PID:7352
- C:\Windows\System\pExqnAp.exe
  C:\Windows\System\pExqnAp.exe
  2⤵
  PID:7368
- C:\Windows\System\Sxemkpy.exe
  C:\Windows\System\Sxemkpy.exe
  2⤵
  PID:7384
- C:\Windows\System\ibcruCa.exe
  C:\Windows\System\ibcruCa.exe
  2⤵
  PID:7400
- C:\Windows\System\cwrXtUW.exe
  C:\Windows\System\cwrXtUW.exe
  2⤵
  PID:7416
- C:\Windows\System\xukvmrv.exe
  C:\Windows\System\xukvmrv.exe
  2⤵
  PID:7432
- C:\Windows\System\StoeYFD.exe
  C:\Windows\System\StoeYFD.exe
  2⤵
  PID:7448
- C:\Windows\System\SWpcbVM.exe
  C:\Windows\System\SWpcbVM.exe
  2⤵
  PID:7464
- C:\Windows\System\FdegCPO.exe
  C:\Windows\System\FdegCPO.exe
  2⤵
  PID:7480
- C:\Windows\System\MYelaKW.exe
  C:\Windows\System\MYelaKW.exe
  2⤵
  PID:7496
- C:\Windows\System\zIRmCqO.exe
  C:\Windows\System\zIRmCqO.exe
  2⤵
  PID:7512
- C:\Windows\System\uzRedUP.exe
  C:\Windows\System\uzRedUP.exe
  2⤵
  PID:7528
- C:\Windows\System\SdhMRvP.exe
  C:\Windows\System\SdhMRvP.exe
  2⤵
  PID:7544
- C:\Windows\System\EWqRMWj.exe
  C:\Windows\System\EWqRMWj.exe
  2⤵
  PID:7560
- C:\Windows\System\XdCiTch.exe
  C:\Windows\System\XdCiTch.exe
  2⤵
  PID:7576
- C:\Windows\System\DZJStFE.exe
  C:\Windows\System\DZJStFE.exe
  2⤵
  PID:7592
- C:\Windows\System\WpSQxkc.exe
  C:\Windows\System\WpSQxkc.exe
  2⤵
  PID:7608
- C:\Windows\System\yrJDQob.exe
  C:\Windows\System\yrJDQob.exe
  2⤵
  PID:7624
- C:\Windows\System\sEGOKUh.exe
  C:\Windows\System\sEGOKUh.exe
  2⤵
  PID:7640
- C:\Windows\System\XTAvMVZ.exe
  C:\Windows\System\XTAvMVZ.exe
  2⤵
  PID:7656
- C:\Windows\System\TODKSYS.exe
  C:\Windows\System\TODKSYS.exe
  2⤵
  PID:7672
- C:\Windows\System\RUNvrkn.exe
  C:\Windows\System\RUNvrkn.exe
  2⤵
  PID:7688
- C:\Windows\System\eqpGxJo.exe
  C:\Windows\System\eqpGxJo.exe
  2⤵
  PID:7704
- C:\Windows\System\hzYwwEn.exe
  C:\Windows\System\hzYwwEn.exe
  2⤵
  PID:7720
- C:\Windows\System\WteCVTl.exe
  C:\Windows\System\WteCVTl.exe
  2⤵
  PID:7736
- C:\Windows\System\AYIKspK.exe
  C:\Windows\System\AYIKspK.exe
  2⤵
  PID:7752
- C:\Windows\System\eBJrVHn.exe
  C:\Windows\System\eBJrVHn.exe
  2⤵
  PID:7768
- C:\Windows\System\QNbTkhB.exe
  C:\Windows\System\QNbTkhB.exe
  2⤵
  PID:7784
- C:\Windows\System\kWCJcnb.exe
  C:\Windows\System\kWCJcnb.exe
  2⤵
  PID:7800
- C:\Windows\System\HKfNVmw.exe
  C:\Windows\System\HKfNVmw.exe
  2⤵
  PID:7816
- C:\Windows\System\xySDiyQ.exe
  C:\Windows\System\xySDiyQ.exe
  2⤵
  PID:7832
- C:\Windows\System\WrzWRpA.exe
  C:\Windows\System\WrzWRpA.exe
  2⤵
  PID:7848
- C:\Windows\System\nxblwLc.exe
  C:\Windows\System\nxblwLc.exe
  2⤵
  PID:7864
- C:\Windows\System\kTQLdyr.exe
  C:\Windows\System\kTQLdyr.exe
  2⤵
  PID:7880
- C:\Windows\System\MruBtmz.exe
  C:\Windows\System\MruBtmz.exe
  2⤵
  PID:7896
- C:\Windows\System\KWGMtBb.exe
  C:\Windows\System\KWGMtBb.exe
  2⤵
  PID:7912
- C:\Windows\System\kFDIOjm.exe
  C:\Windows\System\kFDIOjm.exe
  2⤵
  PID:7928
- C:\Windows\System\dbqagxo.exe
  C:\Windows\System\dbqagxo.exe
  2⤵
  PID:7944
- C:\Windows\System\hNGsQFu.exe
  C:\Windows\System\hNGsQFu.exe
  2⤵
  PID:7960
- C:\Windows\System\PYrVFUE.exe
  C:\Windows\System\PYrVFUE.exe
  2⤵
  PID:7976
- C:\Windows\System\VPfRStV.exe
  C:\Windows\System\VPfRStV.exe
  2⤵
  PID:7992
- C:\Windows\System\duSVyac.exe
  C:\Windows\System\duSVyac.exe
  2⤵
  PID:8008
- C:\Windows\System\mCJRrPj.exe
  C:\Windows\System\mCJRrPj.exe
  2⤵
  PID:8024
- C:\Windows\System\cRdiJyA.exe
  C:\Windows\System\cRdiJyA.exe
  2⤵
  PID:8040
- C:\Windows\System\bKdfegz.exe
  C:\Windows\System\bKdfegz.exe
  2⤵
  PID:8056
- C:\Windows\System\ezznSDG.exe
  C:\Windows\System\ezznSDG.exe
  2⤵
  PID:8072
- C:\Windows\System\EPDoPhx.exe
  C:\Windows\System\EPDoPhx.exe
  2⤵
  PID:8088
- C:\Windows\System\fZyCeDZ.exe
  C:\Windows\System\fZyCeDZ.exe
  2⤵
  PID:8104
- C:\Windows\System\MuzadNN.exe
  C:\Windows\System\MuzadNN.exe
  2⤵
  PID:8120
- C:\Windows\System\mFnUSDE.exe
  C:\Windows\System\mFnUSDE.exe
  2⤵
  PID:8136
- C:\Windows\System\TRQUHZR.exe
  C:\Windows\System\TRQUHZR.exe
  2⤵
  PID:8152
- C:\Windows\System\EOvioys.exe
  C:\Windows\System\EOvioys.exe
  2⤵
  PID:8168
- C:\Windows\System\lcNckGO.exe
  C:\Windows\System\lcNckGO.exe
  2⤵
  PID:8184
- C:\Windows\System\DioqTdI.exe
  C:\Windows\System\DioqTdI.exe
  2⤵
  PID:8204
- C:\Windows\System\ukXgRpd.exe
  C:\Windows\System\ukXgRpd.exe
  2⤵
  PID:8220
- C:\Windows\System\hHbCwSm.exe
  C:\Windows\System\hHbCwSm.exe
  2⤵
  PID:8236
- C:\Windows\System\jcsnFZu.exe
  C:\Windows\System\jcsnFZu.exe
  2⤵
  PID:8252
- C:\Windows\System\NapWviS.exe
  C:\Windows\System\NapWviS.exe
  2⤵
  PID:8268
- C:\Windows\System\bYhooch.exe
  C:\Windows\System\bYhooch.exe
  2⤵
  PID:8284
- C:\Windows\System\BeRtOcF.exe
  C:\Windows\System\BeRtOcF.exe
  2⤵
  PID:8300
- C:\Windows\System\CGkzJpr.exe
  C:\Windows\System\CGkzJpr.exe
  2⤵
  PID:8316
- C:\Windows\System\IvTwxZW.exe
  C:\Windows\System\IvTwxZW.exe
  2⤵
  PID:8332
- C:\Windows\System\eIyeWJF.exe
  C:\Windows\System\eIyeWJF.exe
  2⤵
  PID:8348
- C:\Windows\System\FitRIjW.exe
  C:\Windows\System\FitRIjW.exe
  2⤵
  PID:8364
- C:\Windows\System\soLzxNe.exe
  C:\Windows\System\soLzxNe.exe
  2⤵
  PID:8380
- C:\Windows\System\fVbFlMR.exe
  C:\Windows\System\fVbFlMR.exe
  2⤵
  PID:8396
- C:\Windows\System\jplURLg.exe
  C:\Windows\System\jplURLg.exe
  2⤵
  PID:8412
- C:\Windows\System\fLoUxDX.exe
  C:\Windows\System\fLoUxDX.exe
  2⤵
  PID:8428
- C:\Windows\System\dQYlNKe.exe
  C:\Windows\System\dQYlNKe.exe
  2⤵
  PID:8444
- C:\Windows\System\GmUQKfU.exe
  C:\Windows\System\GmUQKfU.exe
  2⤵
  PID:8460
- C:\Windows\System\sYrFzwi.exe
  C:\Windows\System\sYrFzwi.exe
  2⤵
  PID:8476
- C:\Windows\System\iEuIAlE.exe
  C:\Windows\System\iEuIAlE.exe
  2⤵
  PID:8492
- C:\Windows\System\ZoJnkEQ.exe
  C:\Windows\System\ZoJnkEQ.exe
  2⤵
  PID:8508
- C:\Windows\System\shSrNBQ.exe
  C:\Windows\System\shSrNBQ.exe
  2⤵
  PID:8524
- C:\Windows\System\oBXHTjE.exe
  C:\Windows\System\oBXHTjE.exe
  2⤵
  PID:8540
- C:\Windows\System\bdQNkhG.exe
  C:\Windows\System\bdQNkhG.exe
  2⤵
  PID:8556
- C:\Windows\System\EuzmttU.exe
  C:\Windows\System\EuzmttU.exe
  2⤵
  PID:8572
- C:\Windows\System\TfJlRtp.exe
  C:\Windows\System\TfJlRtp.exe
  2⤵
  PID:8588
- C:\Windows\System\hvRwNIy.exe
  C:\Windows\System\hvRwNIy.exe
  2⤵
  PID:8604
- C:\Windows\System\BVzrnWL.exe
  C:\Windows\System\BVzrnWL.exe
  2⤵
  PID:8620
- C:\Windows\System\JRulaIr.exe
  C:\Windows\System\JRulaIr.exe
  2⤵
  PID:8636
- C:\Windows\System\xofUpoR.exe
  C:\Windows\System\xofUpoR.exe
  2⤵
  PID:8652
- C:\Windows\System\wjLsNNc.exe
  C:\Windows\System\wjLsNNc.exe
  2⤵
  PID:8668
- C:\Windows\System\wRvOqwr.exe
  C:\Windows\System\wRvOqwr.exe
  2⤵
  PID:8684
- C:\Windows\System\dRzvtRw.exe
  C:\Windows\System\dRzvtRw.exe
  2⤵
  PID:8700
- C:\Windows\System\YcKSkXA.exe
  C:\Windows\System\YcKSkXA.exe
  2⤵
  PID:8716
- C:\Windows\System\oOKnLhw.exe
  C:\Windows\System\oOKnLhw.exe
  2⤵
  PID:8732
- C:\Windows\System\uWENgkB.exe
  C:\Windows\System\uWENgkB.exe
  2⤵
  PID:8748
- C:\Windows\System\SRkflRw.exe
  C:\Windows\System\SRkflRw.exe
  2⤵
  PID:8764
- C:\Windows\System\CGgDoSb.exe
  C:\Windows\System\CGgDoSb.exe
  2⤵
  PID:8780
- C:\Windows\System\VDPPDhx.exe
  C:\Windows\System\VDPPDhx.exe
  2⤵
  PID:8796
- C:\Windows\System\BHYYdjB.exe
  C:\Windows\System\BHYYdjB.exe
  2⤵
  PID:8812
- C:\Windows\System\PbTXcMG.exe
  C:\Windows\System\PbTXcMG.exe
  2⤵
  PID:8828
- C:\Windows\System\JYlKwLm.exe
  C:\Windows\System\JYlKwLm.exe
  2⤵
  PID:8844
- C:\Windows\System\lIyieyh.exe
  C:\Windows\System\lIyieyh.exe
  2⤵
  PID:8860
- C:\Windows\System\YTjfSBc.exe
  C:\Windows\System\YTjfSBc.exe
  2⤵
  PID:8876
- C:\Windows\System\DqXZICC.exe
  C:\Windows\System\DqXZICC.exe
  2⤵
  PID:8892
- C:\Windows\System\uWcDMes.exe
  C:\Windows\System\uWcDMes.exe
  2⤵
  PID:8908
- C:\Windows\System\VqOgAgn.exe
  C:\Windows\System\VqOgAgn.exe
  2⤵
  PID:8924
- C:\Windows\System\aTLcUgp.exe
  C:\Windows\System\aTLcUgp.exe
  2⤵
  PID:8940
- C:\Windows\System\klPsWyO.exe
  C:\Windows\System\klPsWyO.exe
  2⤵
  PID:8956
- C:\Windows\System\BMOTYjC.exe
  C:\Windows\System\BMOTYjC.exe
  2⤵
  PID:8972
- C:\Windows\System\FUKlOEc.exe
  C:\Windows\System\FUKlOEc.exe
  2⤵
  PID:8988
- C:\Windows\System\vxhhjfn.exe
  C:\Windows\System\vxhhjfn.exe
  2⤵
  PID:9004
- C:\Windows\System\XRtyPGC.exe
  C:\Windows\System\XRtyPGC.exe
  2⤵
  PID:9020
- C:\Windows\System\gUBTJSX.exe
  C:\Windows\System\gUBTJSX.exe
  2⤵
  PID:9036
- C:\Windows\System\RjihoJS.exe
  C:\Windows\System\RjihoJS.exe
  2⤵
  PID:9052
- C:\Windows\System\jydbCDi.exe
  C:\Windows\System\jydbCDi.exe
  2⤵
  PID:9068
- C:\Windows\System\myvdAMP.exe
  C:\Windows\System\myvdAMP.exe
  2⤵
  PID:9084
- C:\Windows\System\ercopjj.exe
  C:\Windows\System\ercopjj.exe
  2⤵
  PID:9100
- C:\Windows\System\pfmuubA.exe
  C:\Windows\System\pfmuubA.exe
  2⤵
  PID:9116
- C:\Windows\System\PmfJbZH.exe
  C:\Windows\System\PmfJbZH.exe
  2⤵
  PID:9132
- C:\Windows\System\rwYXuEu.exe
  C:\Windows\System\rwYXuEu.exe
  2⤵
  PID:9148
- C:\Windows\System\pYGeprM.exe
  C:\Windows\System\pYGeprM.exe
  2⤵
  PID:9164
- C:\Windows\System\XaNGIhZ.exe
  C:\Windows\System\XaNGIhZ.exe
  2⤵
  PID:9180
- C:\Windows\System\gweFLzD.exe
  C:\Windows\System\gweFLzD.exe
  2⤵
  PID:9196
- C:\Windows\System\dXUMHlH.exe
  C:\Windows\System\dXUMHlH.exe
  2⤵
  PID:9212
- C:\Windows\System\ODNcord.exe
  C:\Windows\System\ODNcord.exe
  2⤵
  PID:2812
- C:\Windows\System\OjmqmZQ.exe
  C:\Windows\System\OjmqmZQ.exe
  2⤵
  PID:9220
- C:\Windows\System\jQgAGKy.exe
  C:\Windows\System\jQgAGKy.exe
  2⤵
  PID:9236
- C:\Windows\System\VzsvwDT.exe
  C:\Windows\System\VzsvwDT.exe
  2⤵
  PID:9252
- C:\Windows\System\uRJCXMc.exe
  C:\Windows\System\uRJCXMc.exe
  2⤵
  PID:9268
- C:\Windows\System\MyCfRbe.exe
  C:\Windows\System\MyCfRbe.exe
  2⤵
  PID:9284
- C:\Windows\System\wwPkmHR.exe
  C:\Windows\System\wwPkmHR.exe
  2⤵
  PID:9300
- C:\Windows\System\uWSqnWA.exe
  C:\Windows\System\uWSqnWA.exe
  2⤵
  PID:9316
- C:\Windows\System\MwOvqir.exe
  C:\Windows\System\MwOvqir.exe
  2⤵
  PID:9332
- C:\Windows\System\WPKRajb.exe
  C:\Windows\System\WPKRajb.exe
  2⤵
  PID:9348
- C:\Windows\System\tSEdZRi.exe
  C:\Windows\System\tSEdZRi.exe
  2⤵
  PID:9364
- C:\Windows\System\APqfCWM.exe
  C:\Windows\System\APqfCWM.exe
  2⤵
  PID:9380
- C:\Windows\System\SGHCunx.exe
  C:\Windows\System\SGHCunx.exe
  2⤵
  PID:9396
- C:\Windows\System\QbVEeYG.exe
  C:\Windows\System\QbVEeYG.exe
  2⤵
  PID:9412
- C:\Windows\System\LVloJIe.exe
  C:\Windows\System\LVloJIe.exe
  2⤵
  PID:9428
- C:\Windows\System\vEEopaO.exe
  C:\Windows\System\vEEopaO.exe
  2⤵
  PID:9444
- C:\Windows\System\JQclaTX.exe
  C:\Windows\System\JQclaTX.exe
  2⤵
  PID:9460
- C:\Windows\System\iiVrgPs.exe
  C:\Windows\System\iiVrgPs.exe
  2⤵
  PID:9476
- C:\Windows\System\HDMpPnF.exe
  C:\Windows\System\HDMpPnF.exe
  2⤵
  PID:9492
- C:\Windows\System\YydCftj.exe
  C:\Windows\System\YydCftj.exe
  2⤵
  PID:9508
- C:\Windows\System\BnAcMzH.exe
  C:\Windows\System\BnAcMzH.exe
  2⤵
  PID:9524
- C:\Windows\System\JPnWqWD.exe
  C:\Windows\System\JPnWqWD.exe
  2⤵
  PID:9540
- C:\Windows\System\HFeEAjs.exe
  C:\Windows\System\HFeEAjs.exe
  2⤵
  PID:9556
- C:\Windows\System\nkvxFgS.exe
  C:\Windows\System\nkvxFgS.exe
  2⤵
  PID:9572
- C:\Windows\System\cPlgSZh.exe
  C:\Windows\System\cPlgSZh.exe
  2⤵
  PID:9588
- C:\Windows\System\JrEOcgN.exe
  C:\Windows\System\JrEOcgN.exe
  2⤵
  PID:9604
- C:\Windows\System\DGfFzUK.exe
  C:\Windows\System\DGfFzUK.exe
  2⤵
  PID:9620
- C:\Windows\System\AnfyQhV.exe
  C:\Windows\System\AnfyQhV.exe
  2⤵
  PID:9636
- C:\Windows\System\lNiaCrD.exe
  C:\Windows\System\lNiaCrD.exe
  2⤵
  PID:9652
- C:\Windows\System\hyZnIUq.exe
  C:\Windows\System\hyZnIUq.exe
  2⤵
  PID:9668
- C:\Windows\System\FcPFZok.exe
  C:\Windows\System\FcPFZok.exe
  2⤵
  PID:9684
- C:\Windows\System\LBVTEFN.exe
  C:\Windows\System\LBVTEFN.exe
  2⤵
  PID:9700
- C:\Windows\System\TWfoeHz.exe
  C:\Windows\System\TWfoeHz.exe
  2⤵
  PID:9716
- C:\Windows\System\ycTvuqj.exe
  C:\Windows\System\ycTvuqj.exe
  2⤵
  PID:9732
- C:\Windows\System\QpDzIbs.exe
  C:\Windows\System\QpDzIbs.exe
  2⤵
  PID:9748
- C:\Windows\System\gzWRyUM.exe
  C:\Windows\System\gzWRyUM.exe
  2⤵
  PID:9764
- C:\Windows\System\KRTVUJB.exe
  C:\Windows\System\KRTVUJB.exe
  2⤵
  PID:9780
- C:\Windows\System\NqIgXyq.exe
  C:\Windows\System\NqIgXyq.exe
  2⤵
  PID:9796
- C:\Windows\System\tUEFHaU.exe
  C:\Windows\System\tUEFHaU.exe
  2⤵
  PID:9812
- C:\Windows\System\fdOsHBO.exe
  C:\Windows\System\fdOsHBO.exe
  2⤵
  PID:9828
- C:\Windows\System\TFaXYoK.exe
  C:\Windows\System\TFaXYoK.exe
  2⤵
  PID:9844
- C:\Windows\System\xIOkzjU.exe
  C:\Windows\System\xIOkzjU.exe
  2⤵
  PID:9860
- C:\Windows\System\TLeCNPw.exe
  C:\Windows\System\TLeCNPw.exe
  2⤵
  PID:9876
- C:\Windows\System\LDqdhlN.exe
  C:\Windows\System\LDqdhlN.exe
  2⤵
  PID:9892
- C:\Windows\System\aFtJTrK.exe
  C:\Windows\System\aFtJTrK.exe
  2⤵
  PID:9908
- C:\Windows\System\YOYhSwz.exe
  C:\Windows\System\YOYhSwz.exe
  2⤵
  PID:9924
- C:\Windows\System\Fznnpcl.exe
  C:\Windows\System\Fznnpcl.exe
  2⤵
  PID:9940
- C:\Windows\System\FFGGBEe.exe
  C:\Windows\System\FFGGBEe.exe
  2⤵
  PID:9956
- C:\Windows\System\sgCgNxf.exe
  C:\Windows\System\sgCgNxf.exe
  2⤵
  PID:9972
- C:\Windows\System\chLdyQJ.exe
  C:\Windows\System\chLdyQJ.exe
  2⤵
  PID:9988
- C:\Windows\System\IykjINl.exe
  C:\Windows\System\IykjINl.exe
  2⤵
  PID:10004
- C:\Windows\System\TaDvkER.exe
  C:\Windows\System\TaDvkER.exe
  2⤵
  PID:10020
- C:\Windows\System\IGCmHpF.exe
  C:\Windows\System\IGCmHpF.exe
  2⤵
  PID:10036
- C:\Windows\System\hpVLPiM.exe
  C:\Windows\System\hpVLPiM.exe
  2⤵
  PID:10052
- C:\Windows\System\xySzMxX.exe
  C:\Windows\System\xySzMxX.exe
  2⤵
  PID:10068
- C:\Windows\System\FpgVpjq.exe
  C:\Windows\System\FpgVpjq.exe
  2⤵
  PID:10084
- C:\Windows\System\SXCpdze.exe
  C:\Windows\System\SXCpdze.exe
  2⤵
  PID:10100
- C:\Windows\System\ttxMOio.exe
  C:\Windows\System\ttxMOio.exe
  2⤵
  PID:10116
- C:\Windows\System\FLWekZa.exe
  C:\Windows\System\FLWekZa.exe
  2⤵
  PID:10132
- C:\Windows\System\dUkHonh.exe
  C:\Windows\System\dUkHonh.exe
  2⤵
  PID:10148
- C:\Windows\System\SgrdYRQ.exe
  C:\Windows\System\SgrdYRQ.exe
  2⤵
  PID:10164
- C:\Windows\System\hLxzUsa.exe
  C:\Windows\System\hLxzUsa.exe
  2⤵
  PID:10180
- C:\Windows\System\RBSTSdt.exe
  C:\Windows\System\RBSTSdt.exe
  2⤵
  PID:10196
- C:\Windows\System\muSLwuR.exe
  C:\Windows\System\muSLwuR.exe
  2⤵
  PID:10212
- C:\Windows\System\ouXCudp.exe
  C:\Windows\System\ouXCudp.exe
  2⤵
  PID:10228
- C:\Windows\System\BtkNEiV.exe
  C:\Windows\System\BtkNEiV.exe
  2⤵
  PID:10248
- C:\Windows\System\xZgbgoT.exe
  C:\Windows\System\xZgbgoT.exe
  2⤵
  PID:10264
- C:\Windows\System\FBnlUSm.exe
  C:\Windows\System\FBnlUSm.exe
  2⤵
  PID:10280
- C:\Windows\System\YIGAqJW.exe
  C:\Windows\System\YIGAqJW.exe
  2⤵
  PID:10296
- C:\Windows\System\uZRnRmU.exe
  C:\Windows\System\uZRnRmU.exe
  2⤵
  PID:10312
- C:\Windows\System\hgKqCSy.exe
  C:\Windows\System\hgKqCSy.exe
  2⤵
  PID:10328
- C:\Windows\System\jircENa.exe
  C:\Windows\System\jircENa.exe
  2⤵
  PID:10344
- C:\Windows\System\PEeyFXr.exe
  C:\Windows\System\PEeyFXr.exe
  2⤵
  PID:10360
- C:\Windows\System\dQiXzun.exe
  C:\Windows\System\dQiXzun.exe
  2⤵
  PID:10376
- C:\Windows\System\bGhKQNO.exe
  C:\Windows\System\bGhKQNO.exe
  2⤵
  PID:10392
- C:\Windows\System\PpWrMvB.exe
  C:\Windows\System\PpWrMvB.exe
  2⤵
  PID:10408
- C:\Windows\System\arpkakp.exe
  C:\Windows\System\arpkakp.exe
  2⤵
  PID:10424
- C:\Windows\System\fQsONnN.exe
  C:\Windows\System\fQsONnN.exe
  2⤵
  PID:10440
- C:\Windows\System\uCCryOS.exe
  C:\Windows\System\uCCryOS.exe
  2⤵
  PID:10456
- C:\Windows\System\GZycjEG.exe
  C:\Windows\System\GZycjEG.exe
  2⤵
  PID:10472
- C:\Windows\System\sxMukDF.exe
  C:\Windows\System\sxMukDF.exe
  2⤵
  PID:10488
- C:\Windows\System\euoRyIc.exe
  C:\Windows\System\euoRyIc.exe
  2⤵
  PID:10504
- C:\Windows\System\kOdUqMh.exe
  C:\Windows\System\kOdUqMh.exe
  2⤵
  PID:10520
- C:\Windows\System\qetVXfx.exe
  C:\Windows\System\qetVXfx.exe
  2⤵
  PID:10536
- C:\Windows\System\flgqmje.exe
  C:\Windows\System\flgqmje.exe
  2⤵
  PID:10552
- C:\Windows\System\gpFnZkB.exe
  C:\Windows\System\gpFnZkB.exe
  2⤵
  PID:10568
- C:\Windows\System\fYkilqM.exe
  C:\Windows\System\fYkilqM.exe
  2⤵
  PID:10584
- C:\Windows\System\vKcxkGM.exe
  C:\Windows\System\vKcxkGM.exe
  2⤵
  PID:10600
- C:\Windows\System\Nuonlhb.exe
  C:\Windows\System\Nuonlhb.exe
  2⤵
  PID:10616
- C:\Windows\System\ZKnvFRT.exe
  C:\Windows\System\ZKnvFRT.exe
  2⤵
  PID:10632
- C:\Windows\System\jopNPqV.exe
  C:\Windows\System\jopNPqV.exe
  2⤵
  PID:10648
- C:\Windows\System\etoDDud.exe
  C:\Windows\System\etoDDud.exe
  2⤵
  PID:10664
- C:\Windows\System\OjkSyhJ.exe
  C:\Windows\System\OjkSyhJ.exe
  2⤵
  PID:10680
- C:\Windows\System\vexsZaI.exe
  C:\Windows\System\vexsZaI.exe
  2⤵
  PID:10696
- C:\Windows\System\MvPoWoi.exe
  C:\Windows\System\MvPoWoi.exe
  2⤵
  PID:10712
- C:\Windows\System\SVyotDi.exe
  C:\Windows\System\SVyotDi.exe
  2⤵
  PID:10728
- C:\Windows\System\orMFFIU.exe
  C:\Windows\System\orMFFIU.exe
  2⤵
  PID:10744
- C:\Windows\System\qBXnLLv.exe
  C:\Windows\System\qBXnLLv.exe
  2⤵
  PID:10760
- C:\Windows\System\HFvMmBz.exe
  C:\Windows\System\HFvMmBz.exe
  2⤵
  PID:10776
- C:\Windows\System\WsIVZbi.exe
  C:\Windows\System\WsIVZbi.exe
  2⤵
  PID:10792
- C:\Windows\System\mFrCqLr.exe
  C:\Windows\System\mFrCqLr.exe
  2⤵
  PID:10808
- C:\Windows\System\iJinLKA.exe
  C:\Windows\System\iJinLKA.exe
  2⤵
  PID:10824
- C:\Windows\System\EQddXio.exe
  C:\Windows\System\EQddXio.exe
  2⤵
  PID:10840
- C:\Windows\System\pPwumMV.exe
  C:\Windows\System\pPwumMV.exe
  2⤵
  PID:10856
- C:\Windows\System\AskotVh.exe
  C:\Windows\System\AskotVh.exe
  2⤵
  PID:10872
- C:\Windows\System\LPOmswx.exe
  C:\Windows\System\LPOmswx.exe
  2⤵
  PID:10888
- C:\Windows\System\bcCyEEc.exe
  C:\Windows\System\bcCyEEc.exe
  2⤵
  PID:10904
- C:\Windows\System\NKmpTAr.exe
  C:\Windows\System\NKmpTAr.exe
  2⤵
  PID:10920
- C:\Windows\System\mJAAAcc.exe
  C:\Windows\System\mJAAAcc.exe
  2⤵
  PID:10936
- C:\Windows\System\HOoDnyb.exe
  C:\Windows\System\HOoDnyb.exe
  2⤵
  PID:10952
- C:\Windows\System\sNoTfYr.exe
  C:\Windows\System\sNoTfYr.exe
  2⤵
  PID:10968
- C:\Windows\System\CWjabMv.exe
  C:\Windows\System\CWjabMv.exe
  2⤵
  PID:10984
- C:\Windows\System\OWGsPcy.exe
  C:\Windows\System\OWGsPcy.exe
  2⤵
  PID:11000
- C:\Windows\System\OVMtuZY.exe
  C:\Windows\System\OVMtuZY.exe
  2⤵
  PID:11016
- C:\Windows\System\jkyLlZc.exe
  C:\Windows\System\jkyLlZc.exe
  2⤵
  PID:11032
- C:\Windows\System\jdJQLny.exe
  C:\Windows\System\jdJQLny.exe
  2⤵
  PID:11048
- C:\Windows\System\lplrwGc.exe
  C:\Windows\System\lplrwGc.exe
  2⤵
  PID:11064
- C:\Windows\System\CXqyxZz.exe
  C:\Windows\System\CXqyxZz.exe
  2⤵
  PID:11080
- C:\Windows\System\aoanUAe.exe
  C:\Windows\System\aoanUAe.exe
  2⤵
  PID:11096
- C:\Windows\System\mqvuFRy.exe
  C:\Windows\System\mqvuFRy.exe
  2⤵
  PID:11112
- C:\Windows\System\oljersf.exe
  C:\Windows\System\oljersf.exe
  2⤵
  PID:11128
- C:\Windows\System\hNodHqG.exe
  C:\Windows\System\hNodHqG.exe
  2⤵
  PID:11144
- C:\Windows\System\DljRXkR.exe
  C:\Windows\System\DljRXkR.exe
  2⤵
  PID:11160
- C:\Windows\System\CyhMwvC.exe
  C:\Windows\System\CyhMwvC.exe
  2⤵
  PID:11176
- C:\Windows\System\ggKxpLs.exe
  C:\Windows\System\ggKxpLs.exe
  2⤵
  PID:11192
- C:\Windows\System\XOakzuW.exe
  C:\Windows\System\XOakzuW.exe
  2⤵
  PID:11208
- C:\Windows\System\EZqqLkE.exe
  C:\Windows\System\EZqqLkE.exe
  2⤵
  PID:11224
- C:\Windows\System\AnBOlym.exe
  C:\Windows\System\AnBOlym.exe
  2⤵
  PID:11240
- C:\Windows\System\tcsbyMo.exe
  C:\Windows\System\tcsbyMo.exe
  2⤵
  PID:11256
- C:\Windows\System\jtTOrYc.exe
  C:\Windows\System\jtTOrYc.exe
  2⤵
  PID:11276
- C:\Windows\System\VbxEMRU.exe
  C:\Windows\System\VbxEMRU.exe
  2⤵
  PID:11292
- C:\Windows\System\YFrQZmY.exe
  C:\Windows\System\YFrQZmY.exe
  2⤵
  PID:11308
- C:\Windows\System\bYZTgcn.exe
  C:\Windows\System\bYZTgcn.exe
  2⤵
  PID:11324
- C:\Windows\System\uljhQbq.exe
  C:\Windows\System\uljhQbq.exe
  2⤵
  PID:11340
- C:\Windows\System\erAcoyJ.exe
  C:\Windows\System\erAcoyJ.exe
  2⤵
  PID:11356
- C:\Windows\System\hyRCsvg.exe
  C:\Windows\System\hyRCsvg.exe
  2⤵
  PID:11372
- C:\Windows\System\NLZZlBI.exe
  C:\Windows\System\NLZZlBI.exe
  2⤵
  PID:11388
- C:\Windows\System\zIytKtd.exe
  C:\Windows\System\zIytKtd.exe
  2⤵
  PID:11404
- C:\Windows\System\CMFhKXe.exe
  C:\Windows\System\CMFhKXe.exe
  2⤵
  PID:11420
- C:\Windows\System\VteOrxD.exe
  C:\Windows\System\VteOrxD.exe
  2⤵
  PID:11436
- C:\Windows\System\fKKoRgx.exe
  C:\Windows\System\fKKoRgx.exe
  2⤵
  PID:11452
- C:\Windows\System\LHFZUlL.exe
  C:\Windows\System\LHFZUlL.exe
  2⤵
  PID:11468
- C:\Windows\System\USDCsFl.exe
  C:\Windows\System\USDCsFl.exe
  2⤵
  PID:11484
- C:\Windows\System\iGGfhuX.exe
  C:\Windows\System\iGGfhuX.exe
  2⤵
  PID:11500
- C:\Windows\System\elwGbJt.exe
  C:\Windows\System\elwGbJt.exe
  2⤵
  PID:11516
- C:\Windows\System\yGPTaQi.exe
  C:\Windows\System\yGPTaQi.exe
  2⤵
  PID:11532
- C:\Windows\System\UmcsIEG.exe
  C:\Windows\System\UmcsIEG.exe
  2⤵
  PID:11548
- C:\Windows\System\bdhkoiW.exe
  C:\Windows\System\bdhkoiW.exe
  2⤵
  PID:11564
- C:\Windows\System\bJKNmmp.exe
  C:\Windows\System\bJKNmmp.exe
  2⤵
  PID:11580
- C:\Windows\System\kkxZrFI.exe
  C:\Windows\System\kkxZrFI.exe
  2⤵
  PID:11596
- C:\Windows\System\VebcnFy.exe
  C:\Windows\System\VebcnFy.exe
  2⤵
  PID:11612
- C:\Windows\System\tBFvOrp.exe
  C:\Windows\System\tBFvOrp.exe
  2⤵
  PID:11628
- C:\Windows\System\BjQpKiz.exe
  C:\Windows\System\BjQpKiz.exe
  2⤵
  PID:11644
- C:\Windows\System\UgCQffS.exe
  C:\Windows\System\UgCQffS.exe
  2⤵
  PID:11660
- C:\Windows\System\MDpCPGc.exe
  C:\Windows\System\MDpCPGc.exe
  2⤵
  PID:11676
- C:\Windows\System\XFUTXdL.exe
  C:\Windows\System\XFUTXdL.exe
  2⤵
  PID:11692
- C:\Windows\System\YqYvVCX.exe
  C:\Windows\System\YqYvVCX.exe
  2⤵
  PID:11708
- C:\Windows\System\aPwnGvv.exe
  C:\Windows\System\aPwnGvv.exe
  2⤵
  PID:11724
- C:\Windows\System\DkGCPFH.exe
  C:\Windows\System\DkGCPFH.exe
  2⤵
  PID:11740
- C:\Windows\System\TFcOlUY.exe
  C:\Windows\System\TFcOlUY.exe
  2⤵
  PID:11756
- C:\Windows\System\VmeOZyr.exe
  C:\Windows\System\VmeOZyr.exe
  2⤵
  PID:11772
- C:\Windows\System\KtkPQhF.exe
  C:\Windows\System\KtkPQhF.exe
  2⤵
  PID:11788
- C:\Windows\System\UtKSktR.exe
  C:\Windows\System\UtKSktR.exe
  2⤵
  PID:11804
- C:\Windows\System\PTiKIDz.exe
  C:\Windows\System\PTiKIDz.exe
  2⤵
  PID:11820
- C:\Windows\System\wxxQojI.exe
  C:\Windows\System\wxxQojI.exe
  2⤵
  PID:11836
- C:\Windows\System\ANLcxUO.exe
  C:\Windows\System\ANLcxUO.exe
  2⤵
  PID:11852
- C:\Windows\System\LmVAnyS.exe
  C:\Windows\System\LmVAnyS.exe
  2⤵
  PID:11868
- C:\Windows\System\HWPVnpt.exe
  C:\Windows\System\HWPVnpt.exe
  2⤵
  PID:11884
- C:\Windows\System\jOiowDO.exe
  C:\Windows\System\jOiowDO.exe
  2⤵
  PID:11900
- C:\Windows\System\REqcruo.exe
  C:\Windows\System\REqcruo.exe
  2⤵
  PID:11916
- C:\Windows\System\ECZMmow.exe
  C:\Windows\System\ECZMmow.exe
  2⤵
  PID:11932
- C:\Windows\System\jLqcqpW.exe
  C:\Windows\System\jLqcqpW.exe
  2⤵
  PID:11948
- C:\Windows\System\wOOhZPD.exe
  C:\Windows\System\wOOhZPD.exe
  2⤵
  PID:11964
- C:\Windows\System\MvWrgYs.exe
  C:\Windows\System\MvWrgYs.exe
  2⤵
  PID:11980
- C:\Windows\System\diteJFn.exe
  C:\Windows\System\diteJFn.exe
  2⤵
  PID:11996
- C:\Windows\System\RoOTtWP.exe
  C:\Windows\System\RoOTtWP.exe
  2⤵
  PID:12016
- C:\Windows\System\kTPUaAi.exe
  C:\Windows\System\kTPUaAi.exe
  2⤵
  PID:12032
- C:\Windows\System\nIBgoex.exe
  C:\Windows\System\nIBgoex.exe
  2⤵
  PID:12048
- C:\Windows\System\rGmswIH.exe
  C:\Windows\System\rGmswIH.exe
  2⤵
  PID:12064
- C:\Windows\System\iXrIHml.exe
  C:\Windows\System\iXrIHml.exe
  2⤵
  PID:12084
- C:\Windows\System\vEGtJPD.exe
  C:\Windows\System\vEGtJPD.exe
  2⤵
  PID:12100
- C:\Windows\System\lexPHHe.exe
  C:\Windows\System\lexPHHe.exe
  2⤵
  PID:12116
- C:\Windows\System\CJXbBML.exe
  C:\Windows\System\CJXbBML.exe
  2⤵
  PID:12132
- C:\Windows\System\gPsFBNK.exe
  C:\Windows\System\gPsFBNK.exe
  2⤵
  PID:12148
- C:\Windows\System\OhxmutK.exe
  C:\Windows\System\OhxmutK.exe
  2⤵
  PID:12164
- C:\Windows\System\HsbZZij.exe
  C:\Windows\System\HsbZZij.exe
  2⤵
  PID:12180
- C:\Windows\System\DsqZiNo.exe
  C:\Windows\System\DsqZiNo.exe
  2⤵
  PID:12196
- C:\Windows\System\DcekJnB.exe
  C:\Windows\System\DcekJnB.exe
  2⤵
  PID:12212
- C:\Windows\System\fdPIaCA.exe
  C:\Windows\System\fdPIaCA.exe
  2⤵
  PID:12228
- C:\Windows\System\Xxeopqr.exe
  C:\Windows\System\Xxeopqr.exe
  2⤵
  PID:12244
- C:\Windows\System\isRXZzi.exe
  C:\Windows\System\isRXZzi.exe
  2⤵
  PID:12260
- C:\Windows\System\DEvgtYE.exe
  C:\Windows\System\DEvgtYE.exe
  2⤵
  PID:12276
- C:\Windows\System\JZmwCAM.exe
  C:\Windows\System\JZmwCAM.exe
  2⤵
  PID:4616
- C:\Windows\System\cdacvjG.exe
  C:\Windows\System\cdacvjG.exe
  2⤵
  PID:4748
- C:\Windows\System\WiVjPBo.exe
  C:\Windows\System\WiVjPBo.exe
  2⤵
  PID:4812
- C:\Windows\System\bkoaPWM.exe
  C:\Windows\System\bkoaPWM.exe
  2⤵
  PID:4880
- C:\Windows\System\QJPAROh.exe
  C:\Windows\System\QJPAROh.exe
  2⤵
  PID:4944
- C:\Windows\System\rpjcaiE.exe
  C:\Windows\System\rpjcaiE.exe
  2⤵
  PID:7100
- C:\Windows\System\qtTWTLn.exe
  C:\Windows\System\qtTWTLn.exe
  2⤵
  PID:7300
- C:\Windows\System\gMiXzwi.exe
  C:\Windows\System\gMiXzwi.exe
  2⤵
  PID:7524
- C:\Windows\System\vUpHawI.exe
  C:\Windows\System\vUpHawI.exe
  2⤵
  PID:5004
- C:\Windows\System\UjertaF.exe
  C:\Windows\System\UjertaF.exe
  2⤵
  PID:5068
- C:\Windows\System\miquIIu.exe
  C:\Windows\System\miquIIu.exe
  2⤵
  PID:3008
- C:\Windows\System\uoSpHLQ.exe
  C:\Windows\System\uoSpHLQ.exe
  2⤵
  PID:2292
- C:\Windows\System\JhMmkCZ.exe
  C:\Windows\System\JhMmkCZ.exe
  2⤵
  PID:2316
- C:\Windows\System\MuVCueO.exe
  C:\Windows\System\MuVCueO.exe
  2⤵
  PID:2308
- C:\Windows\System\ZszlDpz.exe
  C:\Windows\System\ZszlDpz.exe
  2⤵
  PID:2040
- C:\Windows\System\wAAeOmE.exe
  C:\Windows\System\wAAeOmE.exe
  2⤵
  PID:1896
- C:\Windows\System\znhmuWy.exe
  C:\Windows\System\znhmuWy.exe
  2⤵
  PID:1936
- C:\Windows\System\dHGteWu.exe
  C:\Windows\System\dHGteWu.exe
  2⤵
  PID:2208
- C:\Windows\System\wzVKVeX.exe
  C:\Windows\System\wzVKVeX.exe
  2⤵
  PID:3292
- C:\Windows\System\vGteGWA.exe
  C:\Windows\System\vGteGWA.exe
  2⤵
  PID:3552
- C:\Windows\System\MAueSoc.exe
  C:\Windows\System\MAueSoc.exe
  2⤵
  PID:3804
- C:\Windows\System\dbnZkwT.exe
  C:\Windows\System\dbnZkwT.exe
  2⤵
  PID:4064
- C:\Windows\System\faGhKRa.exe
  C:\Windows\System\faGhKRa.exe
  2⤵
  PID:4288
- C:\Windows\System\zQLrLfH.exe
  C:\Windows\System\zQLrLfH.exe
  2⤵
  PID:684
- C:\Windows\System\FDYzvIN.exe
  C:\Windows\System\FDYzvIN.exe
  2⤵
  PID:4016
- C:\Windows\System\mpKNRZk.exe
  C:\Windows\System\mpKNRZk.exe
  2⤵
  PID:4612
- C:\Windows\System\KCLSRtj.exe
  C:\Windows\System\KCLSRtj.exe
  2⤵
  PID:5148
- C:\Windows\System\XzRqAHz.exe
  C:\Windows\System\XzRqAHz.exe
  2⤵
  PID:5212
- C:\Windows\System\EBuzDVV.exe
  C:\Windows\System\EBuzDVV.exe
  2⤵
  PID:5276
- C:\Windows\System\HMZzeOh.exe
  C:\Windows\System\HMZzeOh.exe
  2⤵
  PID:5340
- C:\Windows\System\VcifGTN.exe
  C:\Windows\System\VcifGTN.exe
  2⤵
  PID:5404
- C:\Windows\System\VyhLFIq.exe
  C:\Windows\System\VyhLFIq.exe
  2⤵
  PID:5496
- C:\Windows\System\poHDWgF.exe
  C:\Windows\System\poHDWgF.exe
  2⤵
  PID:5532
- C:\Windows\System\MQlSDQO.exe
  C:\Windows\System\MQlSDQO.exe
  2⤵
  PID:5596
- C:\Windows\System\FCWlhQU.exe
  C:\Windows\System\FCWlhQU.exe
  2⤵
  PID:5660
- C:\Windows\System\LZAiBnS.exe
  C:\Windows\System\LZAiBnS.exe
  2⤵
  PID:5724
- C:\Windows\System\jmqbZby.exe
  C:\Windows\System\jmqbZby.exe
  2⤵
  PID:5788
- C:\Windows\System\XSiCTZA.exe
  C:\Windows\System\XSiCTZA.exe
  2⤵
  PID:5852
- C:\Windows\System\IXyspfT.exe
  C:\Windows\System\IXyspfT.exe
  2⤵
  PID:5916
- C:\Windows\System\biNnIZx.exe
  C:\Windows\System\biNnIZx.exe
  2⤵
  PID:5980
- C:\Windows\System\yzrgDWI.exe
  C:\Windows\System\yzrgDWI.exe
  2⤵
  PID:6044
- C:\Windows\System\asiajMl.exe
  C:\Windows\System\asiajMl.exe
  2⤵
  PID:6108
- C:\Windows\System\GYVrnXA.exe
  C:\Windows\System\GYVrnXA.exe
  2⤵
  PID:6176
- C:\Windows\System\EXqWjuE.exe
  C:\Windows\System\EXqWjuE.exe
  2⤵
  PID:6240
- C:\Windows\System\DbNEpll.exe
  C:\Windows\System\DbNEpll.exe
  2⤵
  PID:6304
- C:\Windows\System\xwqhjUd.exe
  C:\Windows\System\xwqhjUd.exe
  2⤵
  PID:6368
- C:\Windows\System\yxuYpXJ.exe
  C:\Windows\System\yxuYpXJ.exe
  2⤵
  PID:6432
- C:\Windows\System\pnwlRUI.exe
  C:\Windows\System\pnwlRUI.exe
  2⤵
  PID:6496
- C:\Windows\System\wvfcjoR.exe
  C:\Windows\System\wvfcjoR.exe
  2⤵
  PID:6560
- C:\Windows\System\wVekDsM.exe
  C:\Windows\System\wVekDsM.exe
  2⤵
  PID:6624
- C:\Windows\System\vJRTTCm.exe
  C:\Windows\System\vJRTTCm.exe
  2⤵
  PID:6720
- C:\Windows\System\Ysdcviy.exe
  C:\Windows\System\Ysdcviy.exe
  2⤵
  PID:6784
- C:\Windows\System\CcRtcVe.exe
  C:\Windows\System\CcRtcVe.exe
  2⤵
  PID:6848
- C:\Windows\System\QyqyPDN.exe
  C:\Windows\System\QyqyPDN.exe
  2⤵
  PID:6912
- C:\Windows\System\xdnuOEW.exe
  C:\Windows\System\xdnuOEW.exe
  2⤵
  PID:6976
- C:\Windows\System\TxEOLEO.exe
  C:\Windows\System\TxEOLEO.exe
  2⤵
  PID:7040
- C:\Windows\System\qsjepHE.exe
  C:\Windows\System\qsjepHE.exe
  2⤵
  PID:7164
- C:\Windows\System\xySaEqd.exe
  C:\Windows\System\xySaEqd.exe
  2⤵
  PID:7232
- C:\Windows\System\zIDvUFA.exe
  C:\Windows\System\zIDvUFA.exe
  2⤵
  PID:7328
- C:\Windows\System\KjzTmsy.exe
  C:\Windows\System\KjzTmsy.exe
  2⤵
  PID:7424
- C:\Windows\System\PSKQyhV.exe
  C:\Windows\System\PSKQyhV.exe
  2⤵
  PID:7488
- C:\Windows\System\ocEFvMT.exe
  C:\Windows\System\ocEFvMT.exe
  2⤵
  PID:7556
- C:\Windows\System\zFVNBDx.exe
  C:\Windows\System\zFVNBDx.exe
  2⤵
  PID:7648
- C:\Windows\System\URfjtZF.exe
  C:\Windows\System\URfjtZF.exe
  2⤵
  PID:7712
- C:\Windows\System\YwTcIYK.exe
  C:\Windows\System\YwTcIYK.exe
  2⤵
  PID:7776
- C:\Windows\System\wSlNsFW.exe
  C:\Windows\System\wSlNsFW.exe
  2⤵
  PID:7840
- C:\Windows\System\oJGcRzJ.exe
  C:\Windows\System\oJGcRzJ.exe
  2⤵
  PID:7904
- C:\Windows\System\xtQIiXB.exe
  C:\Windows\System\xtQIiXB.exe
  2⤵
  PID:7968
- C:\Windows\System\FezaqGH.exe
  C:\Windows\System\FezaqGH.exe
  2⤵
  PID:8032
- C:\Windows\System\BGMdEEW.exe
  C:\Windows\System\BGMdEEW.exe
  2⤵
  PID:8096
- C:\Windows\System\VhybDID.exe
  C:\Windows\System\VhybDID.exe
  2⤵
  PID:8160
- C:\Windows\System\ARtNuAE.exe
  C:\Windows\System\ARtNuAE.exe
  2⤵
  PID:8228
- C:\Windows\System\ngxJIzK.exe
  C:\Windows\System\ngxJIzK.exe
  2⤵
  PID:8292
- C:\Windows\System\NwLMyqv.exe
  C:\Windows\System\NwLMyqv.exe
  2⤵
  PID:8356
- C:\Windows\System\PouUcAK.exe
  C:\Windows\System\PouUcAK.exe
  2⤵
  PID:8420
- C:\Windows\System\XmynAnf.exe
  C:\Windows\System\XmynAnf.exe
  2⤵
  PID:8484
- C:\Windows\System\UoVFxjx.exe
  C:\Windows\System\UoVFxjx.exe
  2⤵
  PID:8548
- C:\Windows\System\raGALhd.exe
  C:\Windows\System\raGALhd.exe
  2⤵
  PID:11636
- C:\Windows\System\xdBbARu.exe
  C:\Windows\System\xdBbARu.exe
  2⤵
  PID:8584
- C:\Windows\System\KbJkGsY.exe
  C:\Windows\System\KbJkGsY.exe
  2⤵
  PID:8648
- C:\Windows\System\zseKLtW.exe
  C:\Windows\System\zseKLtW.exe
  2⤵
  PID:8712
- C:\Windows\System\XoxCfAw.exe
  C:\Windows\System\XoxCfAw.exe
  2⤵
  PID:8776
- C:\Windows\System\BxlyePk.exe
  C:\Windows\System\BxlyePk.exe
  2⤵
  PID:8840
- C:\Windows\System\PyhrmCA.exe
  C:\Windows\System\PyhrmCA.exe
  2⤵
  PID:8904
- C:\Windows\System\lVINCwn.exe
  C:\Windows\System\lVINCwn.exe
  2⤵
  PID:8968
- C:\Windows\System\fHfqQiW.exe
  C:\Windows\System\fHfqQiW.exe
  2⤵
  PID:9032
- C:\Windows\System\cRQWyJU.exe
  C:\Windows\System\cRQWyJU.exe
  2⤵
  PID:9096
- C:\Windows\System\eQvZjJd.exe
  C:\Windows\System\eQvZjJd.exe
  2⤵
  PID:9160
- C:\Windows\System\nJoddGq.exe
  C:\Windows\System\nJoddGq.exe
  2⤵
  PID:2456
- C:\Windows\System\PQhtFAT.exe
  C:\Windows\System\PQhtFAT.exe
  2⤵
  PID:9292
- C:\Windows\System\qKzimqm.exe
  C:\Windows\System\qKzimqm.exe
  2⤵
  PID:9328
- C:\Windows\System\yoOWHTa.exe
  C:\Windows\System\yoOWHTa.exe
  2⤵
  PID:9392
- C:\Windows\System\kxbbdOX.exe
  C:\Windows\System\kxbbdOX.exe
  2⤵
  PID:9456
- C:\Windows\System\AmcBoQQ.exe
  C:\Windows\System\AmcBoQQ.exe
  2⤵
  PID:9520
- C:\Windows\System\ybrQWRO.exe
  C:\Windows\System\ybrQWRO.exe
  2⤵
  PID:9584
- C:\Windows\System\MwkZAGb.exe
  C:\Windows\System\MwkZAGb.exe
  2⤵
  PID:9648
- C:\Windows\System\MhRMwWc.exe
  C:\Windows\System\MhRMwWc.exe
  2⤵
  PID:9712
- C:\Windows\System\uBjxTbZ.exe
  C:\Windows\System\uBjxTbZ.exe
  2⤵
  PID:9776
- C:\Windows\System\YnBadhX.exe
  C:\Windows\System\YnBadhX.exe
  2⤵
  PID:9840
- C:\Windows\System\XeatjdT.exe
  C:\Windows\System\XeatjdT.exe
  2⤵
  PID:9904
- C:\Windows\System\zkFEEgx.exe
  C:\Windows\System\zkFEEgx.exe
  2⤵
  PID:9968
- C:\Windows\System\sbzaUMu.exe
  C:\Windows\System\sbzaUMu.exe
  2⤵
  PID:10032
- C:\Windows\System\BLHjbJG.exe
  C:\Windows\System\BLHjbJG.exe
  2⤵
  PID:10096
- C:\Windows\System\EWhiEQp.exe
  C:\Windows\System\EWhiEQp.exe
  2⤵
  PID:10160
- C:\Windows\System\FKFwkyZ.exe
  C:\Windows\System\FKFwkyZ.exe
  2⤵
  PID:10224
- C:\Windows\System\OzXToHs.exe
  C:\Windows\System\OzXToHs.exe
  2⤵
  PID:10292
- C:\Windows\System\azoVfUB.exe
  C:\Windows\System\azoVfUB.exe
  2⤵
  PID:10356
- C:\Windows\System\wauZNXQ.exe
  C:\Windows\System\wauZNXQ.exe
  2⤵
  PID:10420
- C:\Windows\System\LlDUANf.exe
  C:\Windows\System\LlDUANf.exe
  2⤵
  PID:10484
- C:\Windows\System\syoMyGl.exe
  C:\Windows\System\syoMyGl.exe
  2⤵
  PID:10548
- C:\Windows\System\uTXSiWV.exe
  C:\Windows\System\uTXSiWV.exe
  2⤵
  PID:10612
- C:\Windows\System\KiXCBzF.exe
  C:\Windows\System\KiXCBzF.exe
  2⤵
  PID:10676
- C:\Windows\System\QNgXoNy.exe
  C:\Windows\System\QNgXoNy.exe
  2⤵
  PID:2400
- C:\Windows\System\HBHmbOR.exe
  C:\Windows\System\HBHmbOR.exe
  2⤵
  PID:10800
- C:\Windows\System\BpRsxeF.exe
  C:\Windows\System\BpRsxeF.exe
  2⤵
  PID:10864
- C:\Windows\System\NQzMumS.exe
  C:\Windows\System\NQzMumS.exe
  2⤵
  PID:10928
- C:\Windows\System\StanPzB.exe
  C:\Windows\System\StanPzB.exe
  2⤵
  PID:10964
- C:\Windows\System\NumKPXw.exe
  C:\Windows\System\NumKPXw.exe
  2⤵
  PID:11056
- C:\Windows\System\EHsttJw.exe
  C:\Windows\System\EHsttJw.exe
  2⤵
  PID:11120
- C:\Windows\System\rrZEZaq.exe
  C:\Windows\System\rrZEZaq.exe
  2⤵
  PID:11184
- C:\Windows\System\OuFNqWP.exe
  C:\Windows\System\OuFNqWP.exe
  2⤵
  PID:11248
- C:\Windows\System\NSKCdji.exe
  C:\Windows\System\NSKCdji.exe
  2⤵
  PID:11416
- C:\Windows\System\VsnnJAz.exe
  C:\Windows\System\VsnnJAz.exe
  2⤵
  PID:11480
- C:\Windows\System\pCkmJuK.exe
  C:\Windows\System\pCkmJuK.exe
  2⤵
  PID:11544
- C:\Windows\System\YwfxYGZ.exe
  C:\Windows\System\YwfxYGZ.exe
  2⤵
  PID:11640
- C:\Windows\System\eMUUnpM.exe
  C:\Windows\System\eMUUnpM.exe
  2⤵
  PID:11704
- C:\Windows\System\UVWSRIv.exe
  C:\Windows\System\UVWSRIv.exe
  2⤵
  PID:11768
- C:\Windows\System\RcNcfIn.exe
  C:\Windows\System\RcNcfIn.exe
  2⤵
  PID:11832
- C:\Windows\System\PmZZPBL.exe
  C:\Windows\System\PmZZPBL.exe
  2⤵
  PID:11896
- C:\Windows\System\njduSdX.exe
  C:\Windows\System\njduSdX.exe
  2⤵
  PID:2168
- C:\Windows\System\bNWlbID.exe
  C:\Windows\System\bNWlbID.exe
  2⤵
  PID:1752
- C:\Windows\System\xRYtbEN.exe
  C:\Windows\System\xRYtbEN.exe
  2⤵
  PID:2672
- C:\Windows\System\EIJmpJO.exe
  C:\Windows\System\EIJmpJO.exe
  2⤵
  PID:3376
- C:\Windows\System\kUoAsVA.exe
  C:\Windows\System\kUoAsVA.exe
  2⤵
  PID:3440
- C:\Windows\System\XMVPQyJ.exe
  C:\Windows\System\XMVPQyJ.exe
  2⤵
  PID:3532
- C:\Windows\System\SgeJHem.exe
  C:\Windows\System\SgeJHem.exe
  2⤵
  PID:3600
- C:\Windows\System\TiRyHfa.exe
  C:\Windows\System\TiRyHfa.exe
  2⤵
  PID:3664
- C:\Windows\System\gQnBzMD.exe
  C:\Windows\System\gQnBzMD.exe
  2⤵
  PID:3756
- C:\Windows\System\BAcYMGr.exe
  C:\Windows\System\BAcYMGr.exe
  2⤵
  PID:3824
- C:\Windows\System\WuCyOHU.exe
  C:\Windows\System\WuCyOHU.exe
  2⤵
  PID:4700
- C:\Windows\System\VhwaCvK.exe
  C:\Windows\System\VhwaCvK.exe
  2⤵
  PID:4176
- C:\Windows\System\GeVcLrL.exe
  C:\Windows\System\GeVcLrL.exe
  2⤵
  PID:4268
- C:\Windows\System\MgKdlpP.exe
  C:\Windows\System\MgKdlpP.exe
  2⤵
  PID:4364
- C:\Windows\System\OOfTptJ.exe
  C:\Windows\System\OOfTptJ.exe
  2⤵
  PID:4432
- C:\Windows\System\HkSJSEU.exe
  C:\Windows\System\HkSJSEU.exe
  2⤵
  PID:1536
- C:\Windows\System\IbsKWjM.exe
  C:\Windows\System\IbsKWjM.exe
  2⤵
  PID:11956
- C:\Windows\System\QvintOp.exe
  C:\Windows\System\QvintOp.exe
  2⤵
  PID:12028
- C:\Windows\System\hxqxyqv.exe
  C:\Windows\System\hxqxyqv.exe
  2⤵
  PID:12096
- C:\Windows\System\Eyoiwbi.exe
  C:\Windows\System\Eyoiwbi.exe
  2⤵
  PID:12160
- C:\Windows\System\mwuRQWB.exe
  C:\Windows\System\mwuRQWB.exe
  2⤵
  PID:12224
- C:\Windows\System\oDnfcix.exe
  C:\Windows\System\oDnfcix.exe
  2⤵
  PID:4584
- C:\Windows\System\fxuYuSk.exe
  C:\Windows\System\fxuYuSk.exe
  2⤵
  PID:4912
- C:\Windows\System\AzICpZA.exe
  C:\Windows\System\AzICpZA.exe
  2⤵
  PID:11284
- C:\Windows\System\zNVpqEp.exe
  C:\Windows\System\zNVpqEp.exe
  2⤵
  PID:1740
- C:\Windows\System\uSdhvWy.exe
  C:\Windows\System\uSdhvWy.exe
  2⤵
  PID:4860
- C:\Windows\System\UoMBSDm.exe
  C:\Windows\System\UoMBSDm.exe
  2⤵
  PID:4764
- C:\Windows\System\uRBuRLu.exe
  C:\Windows\System\uRBuRLu.exe
  2⤵
  PID:8048
- C:\Windows\System\vExFeUP.exe
  C:\Windows\System\vExFeUP.exe
  2⤵
  PID:7696
- C:\Windows\System\OAXpvcJ.exe
  C:\Windows\System\OAXpvcJ.exe
  2⤵
  PID:7536
- C:\Windows\System\kvtACPh.exe
  C:\Windows\System\kvtACPh.exe
  2⤵
  PID:7408
- C:\Windows\System\uwfMQKW.exe
  C:\Windows\System\uwfMQKW.exe
  2⤵
  PID:7248
- C:\Windows\System\DNwnzTS.exe
  C:\Windows\System\DNwnzTS.exe
  2⤵
  PID:7020
- C:\Windows\System\DmCREBP.exe
  C:\Windows\System\DmCREBP.exe
  2⤵
  PID:6860
- C:\Windows\System\pCdYOyW.exe
  C:\Windows\System\pCdYOyW.exe
  2⤵
  PID:6572
- C:\Windows\System\cKqrfRD.exe
  C:\Windows\System\cKqrfRD.exe
  2⤵
  PID:6380
- C:\Windows\System\VFqjYPo.exe
  C:\Windows\System\VFqjYPo.exe
  2⤵
  PID:6252
- C:\Windows\System\dlwhTvT.exe
  C:\Windows\System\dlwhTvT.exe
  2⤵
  PID:6056
- C:\Windows\System\KDzuPSV.exe
  C:\Windows\System\KDzuPSV.exe
  2⤵
  PID:5928
- C:\Windows\System\CMjjCKw.exe
  C:\Windows\System\CMjjCKw.exe
  2⤵
  PID:5800
- C:\Windows\System\hYjEbjN.exe
  C:\Windows\System\hYjEbjN.exe
  2⤵
  PID:5576
- C:\Windows\System\HepjyHt.exe
  C:\Windows\System\HepjyHt.exe
  2⤵
  PID:5448
- C:\Windows\System\bYyKvFy.exe
  C:\Windows\System\bYyKvFy.exe
  2⤵
  PID:5320
- C:\Windows\System\HjLNmEq.exe
  C:\Windows\System\HjLNmEq.exe
  2⤵
  PID:5192
- C:\Windows\System\EpRtITm.exe
  C:\Windows\System\EpRtITm.exe
  2⤵
  PID:4572
- C:\Windows\System\dIwokZU.exe
  C:\Windows\System\dIwokZU.exe
  2⤵
  PID:4476
- C:\Windows\System\pddofuS.exe
  C:\Windows\System\pddofuS.exe
  2⤵
  PID:3712
- C:\Windows\System\XmtGjeF.exe
  C:\Windows\System\XmtGjeF.exe
  2⤵
  PID:1648
- C:\Windows\System\qTxZwhp.exe
  C:\Windows\System\qTxZwhp.exe
  2⤵
  PID:1032
- C:\Windows\System\IpfqmgQ.exe
  C:\Windows\System\IpfqmgQ.exe
  2⤵
  PID:720
- C:\Windows\System\lOavRjD.exe
  C:\Windows\System\lOavRjD.exe
  2⤵
  PID:4956
- C:\Windows\System\DzKSJzF.exe
  C:\Windows\System\DzKSJzF.exe
  2⤵
  PID:4864
- C:\Windows\System\jHHQaUf.exe
  C:\Windows\System\jHHQaUf.exe
  2⤵
  PID:8276
- C:\Windows\System\RMlsRmP.exe
  C:\Windows\System\RMlsRmP.exe
  2⤵
  PID:7952
- C:\Windows\System\QedsamW.exe
  C:\Windows\System\QedsamW.exe
  2⤵
  PID:7760
- C:\Windows\System\NLrwQZR.exe
  C:\Windows\System\NLrwQZR.exe
  2⤵
  PID:7148
- C:\Windows\System\dtpeGlt.exe
  C:\Windows\System\dtpeGlt.exe
  2⤵
  PID:6796
- C:\Windows\System\oUYIpxu.exe
  C:\Windows\System\oUYIpxu.exe
  2⤵
  PID:6540
- C:\Windows\System\zrRVlAT.exe
  C:\Windows\System\zrRVlAT.exe
  2⤵
  PID:5704
- C:\Windows\System\mfboCpq.exe
  C:\Windows\System\mfboCpq.exe
  2⤵
  PID:872
- C:\Windows\System\ORacLFB.exe
  C:\Windows\System\ORacLFB.exe
  2⤵
  PID:2604
- C:\Windows\System\Ybazypn.exe
  C:\Windows\System\Ybazypn.exe
  2⤵
  PID:5020
- C:\Windows\System\MuRWcaF.exe
  C:\Windows\System\MuRWcaF.exe
  2⤵
  PID:8312
- C:\Windows\System\ByPALPl.exe
  C:\Windows\System\ByPALPl.exe
  2⤵
  PID:8408
- C:\Windows\System\OqESmdX.exe
  C:\Windows\System\OqESmdX.exe
  2⤵
  PID:7268
- C:\Windows\System\IygFEPc.exe
  C:\Windows\System\IygFEPc.exe
  2⤵
  PID:5884
- C:\Windows\System\FgdOwzn.exe
  C:\Windows\System\FgdOwzn.exe
  2⤵
  PID:7872
- C:\Windows\System\PKNAEnA.exe
  C:\Windows\System\PKNAEnA.exe
  2⤵
  PID:3164
- C:\Windows\System\wGqgwdi.exe
  C:\Windows\System\wGqgwdi.exe
  2⤵
  PID:4284
- C:\Windows\System\dJEgDgB.exe
  C:\Windows\System\dJEgDgB.exe
  2⤵
  PID:5144
- C:\Windows\System\cLVaIbY.exe
  C:\Windows\System\cLVaIbY.exe
  2⤵
  PID:5400
- C:\Windows\System\CLBXLPE.exe
  C:\Windows\System\CLBXLPE.exe
  2⤵
  PID:5784
- C:\Windows\System\PPsqqam.exe
  C:\Windows\System\PPsqqam.exe
  2⤵
  PID:6172
- C:\Windows\System\APsaHfX.exe
  C:\Windows\System\APsaHfX.exe
  2⤵
  PID:6400
- C:\Windows\System\xMibpHT.exe
  C:\Windows\System\xMibpHT.exe
  2⤵
  PID:6716
- C:\Windows\System\WZhtGpj.exe
  C:\Windows\System\WZhtGpj.exe
  2⤵
  PID:7072
- C:\Windows\System\CffmHPm.exe
  C:\Windows\System\CffmHPm.exe
  2⤵
  PID:7460
- C:\Windows\System\zzLzIPr.exe
  C:\Windows\System\zzLzIPr.exe
  2⤵
  PID:7876
- C:\Windows\System\XeAkTFS.exe
  C:\Windows\System\XeAkTFS.exe
  2⤵
  PID:8132
- C:\Windows\System\FSHHNwh.exe
  C:\Windows\System\FSHHNwh.exe
  2⤵
  PID:8388
- C:\Windows\System\MBYHKaH.exe
  C:\Windows\System\MBYHKaH.exe
  2⤵
  PID:1620
- C:\Windows\System\PVJKHIb.exe
  C:\Windows\System\PVJKHIb.exe
  2⤵
  PID:8836
- C:\Windows\System\bqOWocr.exe
  C:\Windows\System\bqOWocr.exe
  2⤵
  PID:9092
- C:\Windows\System\wrHwFkF.exe
  C:\Windows\System\wrHwFkF.exe
  2⤵
  PID:4564
- C:\Windows\System\zVWaiNs.exe
  C:\Windows\System\zVWaiNs.exe
  2⤵
  PID:9452
- C:\Windows\System\TjWbiwD.exe
  C:\Windows\System\TjWbiwD.exe
  2⤵
  PID:332
- C:\Windows\System\JSiRAxG.exe
  C:\Windows\System\JSiRAxG.exe
  2⤵
  PID:10404
- C:\Windows\System\hWETRhV.exe
  C:\Windows\System\hWETRhV.exe
  2⤵
  PID:10468
- C:\Windows\System\nOcAAcd.exe
  C:\Windows\System\nOcAAcd.exe
  2⤵
  PID:10532
- C:\Windows\System\jfWliVF.exe
  C:\Windows\System\jfWliVF.exe
  2⤵
  PID:10596
- C:\Windows\System\xzNLnjR.exe
  C:\Windows\System\xzNLnjR.exe
  2⤵
  PID:10660
- C:\Windows\System\Bqlewyl.exe
  C:\Windows\System\Bqlewyl.exe
  2⤵
  PID:10752
- C:\Windows\System\jHcSjEO.exe
  C:\Windows\System\jHcSjEO.exe
  2⤵
  PID:10816
- C:\Windows\System\dzzKxju.exe
  C:\Windows\System\dzzKxju.exe
  2⤵
  PID:10880
- C:\Windows\System\VWYRvLr.exe
  C:\Windows\System\VWYRvLr.exe
  2⤵
  PID:10944
- C:\Windows\System\zChbImB.exe
  C:\Windows\System\zChbImB.exe
  2⤵
  PID:11008
- C:\Windows\System\HTNKRAs.exe
  C:\Windows\System\HTNKRAs.exe
  2⤵
  PID:11076
- C:\Windows\System\gkVqucm.exe
  C:\Windows\System\gkVqucm.exe
  2⤵
  PID:11140
- C:\Windows\System\bAzfitP.exe
  C:\Windows\System\bAzfitP.exe
  2⤵
  PID:11236
- C:\Windows\System\OhNsycZ.exe
  C:\Windows\System\OhNsycZ.exe
  2⤵
  PID:11332
- C:\Windows\System\gTvyYLO.exe
  C:\Windows\System\gTvyYLO.exe
  2⤵
  PID:11396
- C:\Windows\System\kaNPIuO.exe
  C:\Windows\System\kaNPIuO.exe
  2⤵
  PID:11460
- C:\Windows\System\BwHIZai.exe
  C:\Windows\System\BwHIZai.exe
  2⤵
  PID:11524
- C:\Windows\System\OIKuFXW.exe
  C:\Windows\System\OIKuFXW.exe
  2⤵
  PID:11592
- C:\Windows\System\vMgEKkh.exe
  C:\Windows\System\vMgEKkh.exe
  2⤵
  PID:2900
- C:\Windows\System\UvMwJqS.exe
  C:\Windows\System\UvMwJqS.exe
  2⤵
  PID:11720
- C:\Windows\System\BkeEjoG.exe
  C:\Windows\System\BkeEjoG.exe
  2⤵
  PID:11784
- C:\Windows\System\mnNZsac.exe
  C:\Windows\System\mnNZsac.exe
  2⤵
  PID:8564
- C:\Windows\System\ZsEIBbX.exe
  C:\Windows\System\ZsEIBbX.exe
  2⤵
  PID:10308
- C:\Windows\System\bYapsQc.exe
  C:\Windows\System\bYapsQc.exe
  2⤵
  PID:10236
- C:\Windows\System\QewHBfb.exe
  C:\Windows\System\QewHBfb.exe
  2⤵
  PID:10140
- C:\Windows\System\FVGVblS.exe
  C:\Windows\System\FVGVblS.exe
  2⤵
  PID:10016
- C:\Windows\System\MIiXzhK.exe
  C:\Windows\System\MIiXzhK.exe
  2⤵
  PID:9952
- C:\Windows\System\VWYOKyA.exe
  C:\Windows\System\VWYOKyA.exe
  2⤵
  PID:9888
- C:\Windows\System\sSEFFRX.exe
  C:\Windows\System\sSEFFRX.exe
  2⤵
  PID:9824
- C:\Windows\System\SVPPCWo.exe
  C:\Windows\System\SVPPCWo.exe
  2⤵
  PID:9760
- C:\Windows\System\uBHLcxy.exe
  C:\Windows\System\uBHLcxy.exe
  2⤵
  PID:9696
- C:\Windows\System\OrWuTIV.exe
  C:\Windows\System\OrWuTIV.exe
  2⤵
  PID:9628
- C:\Windows\System\KmCBmMX.exe
  C:\Windows\System\KmCBmMX.exe
  2⤵
  PID:9564
- C:\Windows\System\bKBnQhB.exe
  C:\Windows\System\bKBnQhB.exe
  2⤵
  PID:9472
- C:\Windows\System\IHBpZIa.exe
  C:\Windows\System\IHBpZIa.exe
  2⤵
  PID:9408
- C:\Windows\System\YqkTwZO.exe
  C:\Windows\System\YqkTwZO.exe
  2⤵
  PID:9344
- C:\Windows\System\MXPofHL.exe
  C:\Windows\System\MXPofHL.exe
  2⤵
  PID:9280
- C:\Windows\System\yOMlvsu.exe
  C:\Windows\System\yOMlvsu.exe
  2⤵
  PID:9204
- C:\Windows\System\ObWyZQi.exe
  C:\Windows\System\ObWyZQi.exe
  2⤵
  PID:9048
- C:\Windows\System\jEeTRrx.exe
  C:\Windows\System\jEeTRrx.exe
  2⤵
  PID:8984
- C:\Windows\System\HujuZPX.exe
  C:\Windows\System\HujuZPX.exe
  2⤵
  PID:8920
- C:\Windows\System\xidYcRK.exe
  C:\Windows\System\xidYcRK.exe
  2⤵
  PID:8856
- C:\Windows\System\HsEqOeB.exe
  C:\Windows\System\HsEqOeB.exe
  2⤵
  PID:8792
- C:\Windows\System\dDUSANp.exe
  C:\Windows\System\dDUSANp.exe
  2⤵
  PID:8728
- C:\Windows\System\oBNnHJg.exe
  C:\Windows\System\oBNnHJg.exe
  2⤵
  PID:8664
- C:\Windows\System\UBfzZXy.exe
  C:\Windows\System\UBfzZXy.exe
  2⤵
  PID:10272
- C:\Windows\System\lVbOvjQ.exe
  C:\Windows\System\lVbOvjQ.exe
  2⤵
  PID:10076
- C:\Windows\System\haHkWnL.exe
  C:\Windows\System\haHkWnL.exe
  2⤵
  PID:9276
- C:\Windows\System\IvqtoaP.exe
  C:\Windows\System\IvqtoaP.exe
  2⤵
  PID:9112
- C:\Windows\System\MnRcJIp.exe
  C:\Windows\System\MnRcJIp.exe
  2⤵
  PID:11908
- C:\Windows\System\FcBSmAm.exe
  C:\Windows\System\FcBSmAm.exe
  2⤵
  PID:12008
- C:\Windows\System\ccWlxTw.exe
  C:\Windows\System\ccWlxTw.exe
  2⤵
  PID:12076
- C:\Windows\System\SeOlyss.exe
  C:\Windows\System\SeOlyss.exe
  2⤵
  PID:12204
- C:\Windows\System\NTMZAWH.exe
  C:\Windows\System\NTMZAWH.exe
  2⤵
  PID:12268
- C:\Windows\System\EBXONjZ.exe
  C:\Windows\System\EBXONjZ.exe
  2⤵
  PID:12300
- C:\Windows\System\IjAYEJA.exe
  C:\Windows\System\IjAYEJA.exe
  2⤵
  PID:12316
- C:\Windows\System\RbCmJwT.exe
  C:\Windows\System\RbCmJwT.exe
  2⤵
  PID:12332
- C:\Windows\System\DvAadkn.exe
  C:\Windows\System\DvAadkn.exe
  2⤵
  PID:12348
- C:\Windows\System\IhfObiH.exe
  C:\Windows\System\IhfObiH.exe
  2⤵
  PID:12368
- C:\Windows\System\QdTTtZY.exe
  C:\Windows\System\QdTTtZY.exe
  2⤵
  PID:12384
- C:\Windows\System\ECfSDWG.exe
  C:\Windows\System\ECfSDWG.exe
  2⤵
  PID:12400
- C:\Windows\System\NKnHSQN.exe
  C:\Windows\System\NKnHSQN.exe
  2⤵
  PID:12416
- C:\Windows\System\ArVsoHE.exe
  C:\Windows\System\ArVsoHE.exe
  2⤵
  PID:12432
- C:\Windows\System\liaTiew.exe
  C:\Windows\System\liaTiew.exe
  2⤵
  PID:12448
- C:\Windows\System\wwhnyLs.exe
  C:\Windows\System\wwhnyLs.exe
  2⤵
  PID:12464
- C:\Windows\System\tREYXJY.exe
  C:\Windows\System\tREYXJY.exe
  2⤵
  PID:12480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BXbKXkz.exe

Filesize
2.2MB

MD5
6a522d222ed421d97ca6dd25ff9d2385

SHA1
05568649ae7f73377b1d77084bfbac29e5a8212f

SHA256
74e1ebb31c167569b653171a83a7d64dff0481ca1bbec14f75bf5ec7b7e7fd4f

SHA512
3714f110838fbf4901ec3267d11893a4184708ed5343df84173dc00a7388227c964c3e99bc1e223b133c961bf69a32fb7b1c09accf541f559c28695e315aaa83

Download Submit
C:\Windows\system\ETTbDIU.exe

Filesize
2.2MB

MD5
de31d92633dd28fb7aff248457a83dc2

SHA1
a8fc161f35e0f14b869bd8360a44e72b3fefafab

SHA256
8919b9bccbbd5d7c3d76d3d20413a1602bcd4d1d83b5ce8a2c4152916449b852

SHA512
b1dd0b31b26ddaf90cd3acad5b5432ade468030e7fff301e87cff237968972ada057e122bf1adbf581d2ed4cbd184f8c4d3b2e91042f6999b7c285bf1765cb1c

Download Submit
C:\Windows\system\JmGczhP.exe

Filesize
2.2MB

MD5
74f179b127693130a06b6f1dd23a0672

SHA1
256dbd3e387a6dedf44956fc4f73434250f26b8c

SHA256
6eab12d33d52ac491126af480167e906565698f52b52524834b2ac0d742daa26

SHA512
ca24e3f30880478234a31065047b541484ee4e1989982a431a606c50fff4f9bfbabc3302476c5b9908082d3b3d1dbbc7f1f9fd014ef4c2d264fa52278e03833b

Download Submit
C:\Windows\system\PwPkVqT.exe

Filesize
2.2MB

MD5
b2eedefc77a0c3a120f13a4e219d1da2

SHA1
9c671f0557b2ed3533b5e1f0b70480f75bff858d

SHA256
3aa56a0323bc93d2cabd66b729605c2499c85b63a315ceab8758e06af6caeb87

SHA512
c954bc86e39bb6ec07262281cda40590aad47f4ae0f60eb5ed738907fe6b6ace322adbcacf10b2532aed16308657b6d0aeb62db5f3a586455a93dd80928508ce

Download Submit
C:\Windows\system\SFkbsai.exe

Filesize
2.2MB

MD5
2d4641bce4a86a5dbbe260708af682a9

SHA1
e36239c63b68f90a26c8ff0887c66fe89a751d7d

SHA256
37b9beec3ecd1d3d2e3859f35fb679b84351272b714399e84eae91a32c69c86c

SHA512
07f4cac77d50b113e7041b7c330f2380a4686dd52f08fa22efcccf3cc93727fb48ba50a523972babd0a404e9c15fee56f31bd97308e61317dde5051e6cf9c18a

Download Submit
C:\Windows\system\WYoLRUS.exe

Filesize
2.2MB

MD5
caaf5a37de84117c67a8415e6b6c7f04

SHA1
2400e1df49d38579ed0ca772c5cd263642c2926d

SHA256
f77b5b9ca45e71764699c1d929118fe7ed04f903268e977985dc463cb4ae3d65

SHA512
bdbc9eb698f1db39d4e2299faf703eb96b5db61e98134c9da4cc9318f934241f026433b8c677dd3f9a6b489df3fb16db180997887353e654f5cccf0fb7546975

Download Submit
C:\Windows\system\WtzzZIo.exe

Filesize
2.2MB

MD5
df034dc57d6afa1508dafd617d16f4ae

SHA1
029c0e7ac203d8cbc793395e5312260bf5522510

SHA256
15f24b67d012f8c47846d066b660591bb827f0b659376d9785724a716f0761f4

SHA512
70368321a4605e4f0ddd3d1160c57a809a96e3477c6c29313af944d549865e00e8d4ae12155fa9f4db5b8d7f2813df0a5faf16b119b3e4ebd089755d43e5517a

Download Submit
C:\Windows\system\XLNmapb.exe

Filesize
2.2MB

MD5
b1fb1d60f028645b0b97e38fa4e1cd0c

SHA1
8916cc780f8d0a92942e5fffd458a79bb7d75b50

SHA256
cd95b289edee33b54a25df9681eb89f23481d09243e05926c1c5db51590722d6

SHA512
16b9717140e02097112c5b205db2c3d5dccdd268773f6acc262c270be19172092148001fcbb0c089a6a7a6e39ca27ce40d3f5e5f661d815f8ef88a4d6b061bb3

Download Submit
C:\Windows\system\XZnIzeN.exe

Filesize
2.2MB

MD5
b50910d0128c17087601bb0a53a42077

SHA1
0146f7f2cd129dd0ffe5205f7fb225f5b5247466

SHA256
b5fafad13999f272e2effa71ad7c751c7b3977ad0fe9489c007c53562fd10ba4

SHA512
d3d4e5082284cb423301c4a6e70e72e9e47ee9b5e1e455c245f5af69ce88664681d323e49122be8b314d2977606fc703bd051861886b0f3f22f595b9d2b9e5b5

Download Submit
C:\Windows\system\ZKZFqQB.exe

Filesize
2.2MB

MD5
297c11bacb1e5ee84d37592ab58c6939

SHA1
e91ee186b86d3b2938f00bd53bccb596b81e8a6b

SHA256
663ce5c9c0731a0e427b1e49735b0eb7eeaf28ca72c9ada0e1721fb7c24291de

SHA512
bca8da48d027c80bb5bbb915c131571550bd6a7f05008f86b4396ce9a136c04e35f1b44bf01ac6dd8f8e627d192807aecea6edc5fca66a65ac146f7d0e74215a

Download Submit
C:\Windows\system\aJtRTTa.exe

Filesize
2.2MB

MD5
8e4e50e0b955ca451ddc417e02a31919

SHA1
45bebd149901dafa09be48be8e86b972b37c6e00

SHA256
4fe0235405c0ea82d3697ff402c8edf88fedae5e8d676a72c4be5d4ef9d0d420

SHA512
6d9650a7339f56dd8f47ddb82cb8eddcaf87cd2ba7672ae582288cc913131e7676a70f97e8af81aa290ebb2b4106cc6ceaf72a4b87c1f143c3d5be42f318b961

Download Submit
C:\Windows\system\bHFcGKI.exe

Filesize
2.2MB

MD5
27e5df7d735a2f2cb72160e062ff2444

SHA1
a6d98a934c8dfdbe54d10f29089f3103cd3a0dca

SHA256
2bbcff8376f7decd66a45f18706fe91825fe5b61a15f313dbf4fa7e7e2c62416

SHA512
e983cb1a70c943d86a142d078c5f7d0e968bb0c2184a45d3ac6a21518a08b16857c911da1b213097341e9f6022a71bee31a7edebf8b0764763c36022ca256e6b

Download Submit
C:\Windows\system\cFGZkWV.exe

Filesize
2.2MB

MD5
2bbba31e86d59a948ce3f0df4a232ceb

SHA1
8708170cfdd2f613e21332a737462cd6bf015867

SHA256
62c6cef5d538bbeccfa8dcc2a7cb99df6e8698b09f80fc69a3c616c660da234c

SHA512
cdc0d3212434dfee2fa9a40674af4541d9c17017a3092972fbe4c5f46170015da3e9538a37cf74e26a6c0baa38d5d07db77ed89dba59b97fc2fe29fcb7d40167

Download Submit
C:\Windows\system\cNmkkVG.exe

Filesize
2.2MB

MD5
a73f124a284b7fd29c8332e653124f69

SHA1
478b20cd8498c96289cac0f2f653976b552d04e3

SHA256
0346960fc75eec7da1ab26c775941f3451f98cf81eae11be258c7fbc67e46a24

SHA512
65d311654eb05bba0746be02b626b9a9e554665af69d2c05b541175f5a49c5e6fa96c8a7bd3a8216619e69119664ca4049c1bbdac13206e31aef893c191b9081

Download Submit
C:\Windows\system\cyIrTku.exe

Filesize
2.2MB

MD5
7df5e3e7e8718888898410cecc623139

SHA1
c4373221adab9c3f9859c45102195b897561044f

SHA256
80885df3a42ec74fc76a70ad6788d88486d61e5bb98f125dd638829a77290f68

SHA512
4d5cb8c58efbd34288bcf2d00738690b7d50ed9f7497c9949c96e23896ff2f7e8aa472b44fec7458bc29e3f5fb0ab1bad4847a6f4109336972d7b2667b5b80d2

Download Submit
C:\Windows\system\gXXSuKG.exe

Filesize
2.2MB

MD5
73110676fb3ef2a4c99bd94866fe2d5a

SHA1
f6961d46d7ae5b2d390be8c81caff3e3b070fbdf

SHA256
21fbf0dba01f6fd28f7248af24a874be548bed1f6f6e94e13751c6cb4e5e8bd3

SHA512
1392ad3a77d585d90111fcde463b3e1012d98fae85e578e9871a451d585a90d739f0146ee2f891a665aa6903b1e4ad8c34ba64329a0151b82bbc6ef532fab74f

Download Submit
C:\Windows\system\hDvTxNi.exe

Filesize
2.2MB

MD5
8e4d505f09428e97fcb793f855f9a962

SHA1
b54e377fff5d57c2cb1dd8c77235fb1bd71ef468

SHA256
ddd76ff8beacdd9f06e7c0fa585a2b4822909477a8bfbacbbad423ea9b9efdb8

SHA512
6119b8b1cc8612f000aba302892afdf4ebb9a494861f15634d6749b564b4d9abe7808252d501bb5ec7a2114f8e54b26a52adc3cfdb462aac14b3ee29678b35d0

Download Submit
C:\Windows\system\iobJcpu.exe

Filesize
2.2MB

MD5
dcfdf0f51e70eb92f7cdca6f912c878a

SHA1
af018963949e90ca00ab38162c2ee9795722582b

SHA256
1b8605c17cc7d2a82cbcfa7dae123cf2211b2177e942cd6054dc46011634dcc5

SHA512
5f267f52cb1b18f98fad1533bf3c91351260591e690c0589a061d8829b1f02b535a9938b0e051cb2308eee81411747212c5fe9a562805636f717813376e18c05

Download Submit
C:\Windows\system\kUWFlzn.exe

Filesize
2.2MB

MD5
4f45dab3e90cb863b9de640272e62321

SHA1
a1a73361c116454b91f74245b0f897e857fa9be2

SHA256
a83e83bb01b5ded92b8f83bf2decf4d64b9082cd475a6204f1442f01ba8f86ed

SHA512
f54eb276be82f19a9506ca35df5eca38b8ea8eeb2f87ca09be763df3b92891972c3c4542f4add93c456c8641906b2b89be54446be35b3e7de4ec0a62f3ecddc7

Download Submit
C:\Windows\system\sWmNVXy.exe

Filesize
2.2MB

MD5
dcd66b491e41a6697611720cd7cbec42

SHA1
db07dc42faf0a73fc03d56e272daca219a6af039

SHA256
a097377cd53f0eac29625afce88642d9d2d3595ab5419493d0e1dc408a844e13

SHA512
3cd03660c1e3a11cebce33f07d30a1a6b7ea7167f66fb170203cfb2e78daee050c5238fefd942d3c19e3c74c849bb5472917d71dde9743772ac063b5e1f907ec

Download Submit
C:\Windows\system\xEDCFfB.exe

Filesize
2.2MB

MD5
269de943cbd1153ff57260d8101671c3

SHA1
aa2aa90c232841a29319035b38d713836f0d224b

SHA256
dcb73a1e6055ff51f4175cca1510a06814768b0923d4ecd7502e00217a641134

SHA512
4f744bb5af2b079421fa0ce51a35a96729b7bf2b3c9cae0ebc9ad9522d40ddf4979db3b1dc65fd777021f0773d82cf47d679bd66319664e9a85dcdca03cbaefd

Download Submit
\Windows\system\AFRsANu.exe

Filesize
2.2MB

MD5
05c6de3f5d71e58900bdfbcc5733cabb

SHA1
5eefac32971cad53f4bb0687e7504b29ef6535d7

SHA256
05fdcc9b530c3859b5f74526425664d6b18e9fc9d2f7cf39f03371edc1e58eaf

SHA512
9c46f5ba4502c239e015496471b2ab2eb17c500f04a65dfa27c1d96d1fa3027d6f59168139f9ac3317162c367cbd5e89604c8c889dbdb114186638b510566e38

Download Submit
\Windows\system\AKSsPYe.exe

Filesize
2.2MB

MD5
9d865e65be0bf30ff516096299341ce9

SHA1
e4133aeba85ac4b8aeac6d7b8639866f0e6e2275

SHA256
2c91df87a29fbdf89e5493121cba655bf4da95d7aa3fb60795bd096e546dbdda

SHA512
1468ac74d23b9d2343ee4eab2b5deadfa0065cb374ca17a76cfc633d21f6959a92aae7b04575b647ed25eacbf148bd46c6e3d48a5a1de490beee8b38700ea117

Download Submit
\Windows\system\DsYzMPb.exe

Filesize
2.2MB

MD5
2fb2b8a9e8c5d7ad7fa9e3bca11ba931

SHA1
edc6a3b06a8ae425938270ce7afce4f4bca7027c

SHA256
3adf7f37af39c903d6d44935212239ce0f525f495434efafebb6fa90282143df

SHA512
9398f745a70d1a1e814c1fcdeec6f6f18c2f416eee6c2e785c38849e22b98b7cea0e2fc6adc964ed115b2f76b25eddeb4d6d75014c215da9bb0744cdffd2630e

Download Submit
\Windows\system\FGrxsIh.exe

Filesize
2.2MB

MD5
3be439e8d7c8821df9920f53fa798e4f

SHA1
9c2045cf65cecf48535829e60b957a7d70c56991

SHA256
b7e89c063169b41b771e39ef317f6d5ac302d944f02a88304511f7b9adfd89fe

SHA512
acbc14808f9d91d33c2cfa64442f6fab1b5aeaafc4ac56a32eb30bc84deca4b4fff695d7b7af5ddc99e7b64b6492a8abbc3d07bcecb30457d47aa9ab3af18ace

Download Submit
\Windows\system\LMipXqn.exe

Filesize
2.2MB

MD5
e739ecf6b184189421220d1e79802e78

SHA1
f611d0f557494c3a6273883d5d4e8ee246d23b7d

SHA256
8ff76eddb8ae4293a56f2c29eb1e78f7de4a8dce974cffca57f36d9cf55f0644

SHA512
220bfd23f243a6eec5fb648be45dd22c6099fe8cb229cb19c8d8b3aeb82b6fb66b0a73132988f306b20625679aa2de27f48ddc4ecf50f5ca542298c4fe8625c2

Download Submit
\Windows\system\PHiHhqH.exe

Filesize
2.2MB

MD5
a7d9c6c512fb8a195b4403e0569f8c74

SHA1
010389b1c8632203d0c445033b992220dda30333

SHA256
6e875b41154a95b626227140cbdb860f3ddba8ba40f12ee83364a3fad7b504c5

SHA512
824d95e7e1e5def6833cb3b18532eb35e674f297068c2fc3e177dc0b3e5a9635ef7e8c6299f691bd1b3d8af7b7708970f6fd33ea10cc9bdac4ce92079b66f298

Download Submit
\Windows\system\kZnTNtO.exe

Filesize
2.2MB

MD5
44c977b6a77d80d656f57659324022fa

SHA1
01e42d109bc1f2ad86f359682e3071435b72af67

SHA256
93dd93e0f23635ab10b6bf913ab5e0d28029f2dd3fbe4e3606381629012d122a

SHA512
8f1203901883527bc06cbb9a5821d6889140b0076e8ac2adee965f1111b50232d69a066b358896a31b6844b0db8e84c61d74e5e5370c9eaa65ebb04c4ae70280

Download Submit
\Windows\system\licMXdx.exe

Filesize
2.2MB

MD5
af0e3eeff4d771de22f00b541a4f5ab1

SHA1
61856aedcc63e02038089b673530970f7a0101ce

SHA256
33c1fafff88b451590debaaf2c2245d904c4941860f8e5f32293e0363e8e9c35

SHA512
4b7e31f672f74cd67c3f8156636630cddad08973c0e3c442e575600ecaa0882e3b2162b2c283553fd317c8df8cf11aac109fd3d4b8bcb89935b04eb463ba71a3

Download Submit
\Windows\system\mHrMblT.exe

Filesize
2.2MB

MD5
2887e02cbbbafb7059ae34024b4aea91

SHA1
2f464dfc37c27bf568f49d582390188e156c6b7e

SHA256
b2bfee2edd321c0bda373430a0d2b41db12c99d3544bb8a375ca173e1912a58c

SHA512
4d4ffc2396840c703ca1c2b6a4e9a7b095fccfde012b4d50ac76cfc8309c3217018cce51c7a76f028e66e9d6bfc767636a8bbd55431ec8a3f4b79f976e052328

Download Submit
\Windows\system\oDFuaAs.exe

Filesize
2.2MB

MD5
cf238f5fb4ae0fec292e25325ba38896

SHA1
db86be8e8372650c1c8b3ace5a2c8c56a0a32938

SHA256
26a33cd61895bb33fda5ddf6d8b2b401ad0f1f3be0efe422f426c5be0e2f18cd

SHA512
30f18940e18e9e9fa364717f87e8c0adb5f295abfb8e00b918642214bf240a5c880fe913cad093dab2eb565759a87773cc85a491c6cde709f2b9bf78cd25bc7f

Download Submit
\Windows\system\ooJhXYL.exe

Filesize
2.2MB

MD5
09ac1fb878287afe74bcaae0745560ff

SHA1
d51d5f906716a57b65a3bd6a84f8eb90bcb02c70

SHA256
3675910dfa98fe4034309b8a1693684728c9900a56e843ba8d19544581d3bcd9

SHA512
272a835138182a0792311f387c54165c6c4672aaf0ae1536a6ba9b97afddbda71a834f32bbedd9d15f9bdc87f616d2d0eb64801b96fab5d7128266a5c9f579a1

Download Submit
\Windows\system\tANYAld.exe

Filesize
2.2MB

MD5
cd5fa737cfa64962b3f5075c95b679b6

SHA1
e7e21199fce5055335371b0a35d448c1712c10c3

SHA256
449c219f01f9066476ea60ca6220a86bb62c5e376473a2e375395ada95ecd982

SHA512
eeba0be050b1e5aad50fc18250a8c7048f85b8af5ce99da6a35bcbdd2c1e54edced5893d7577da29e160ae0d9921741d7f7b35eb1a757bfe7bfec088e3009f00

Download Submit
\Windows\system\wZJXFlo.exe

Filesize
2.2MB

MD5
848eda8490bb7649bb52c0d63af6335a

SHA1
c7115421d26bd2c220695f4cb6ee48a24c8807da

SHA256
12cc32e5e21317bb716bdcd46eddd076a4023882602cd826b652a11143c6ac8f

SHA512
bb5cca80cd28f2897fe90ad96e939e1ed69b404a2e5d32202b04d2e7ccfe82d5adfed87cd79df235cc774e310c865e47bb0290a280f146d1b686324bcf406584

Download Submit
\Windows\system\yYZHbgh.exe

Filesize
2.2MB

MD5
efd6266c86cb8281baf5946ce77118ea

SHA1
51c2e263d1727e742262fbf56637c5de6c4a07bb

SHA256
f4be60b502151e104ae672c503ca4ff50f09169bc359b71f74689dbefd0e1591

SHA512
be2fc5057bf2ac94f9da7694dcec212502846f4ec64862b0df342ca6224ad11985bd3f25bae4b519bb165363b4d7e115dbed08b819b8d25567f4dd327851ed23

Download Submit
memory/1120-210-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/1276-217-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1540-218-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/1652-213-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/1712-209-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2028-211-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2196-192-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2196-157-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2264-189-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2264-53-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2440-202-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-200-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2516-203-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-190-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2548-63-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2608-199-0x000000013F8F0000-0x000000013FCE2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-155-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-219-0x000000013FBF0000-0x000000013FFE2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-224-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2728-163-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-220-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-212-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2820-198-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2860-133-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2860-201-0x0000000002E24000-0x0000000002E27000-memory.dmp

Filesize
12KB

Download
memory/2860-158-0x0000000001D70000-0x0000000001D78000-memory.dmp

Filesize
32KB

Download
memory/2860-1658-0x000007FEF5AA0000-0x000007FEF643D000-memory.dmp

Filesize
9.6MB

Download
memory/2860-2089-0x0000000002E2B000-0x0000000002E92000-memory.dmp

Filesize
412KB

Download
memory/2864-164-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2864-161-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-159-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/2864-235-0x0000000002E40000-0x0000000003232000-memory.dmp

Filesize
3.9MB

Download
memory/2864-7-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2864-1-0x0000000000580000-0x0000000000590000-memory.dmp

Filesize
64KB

Download
memory/2864-0-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2872-160-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2956-207-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/3004-208-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download