xmrig | f4281336c75c9d06c40cf3d722709d7e806d635729b5f93bb63258796b684342

Analysis

max time kernel
24s
max time network
18s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
Size

2.2MB
MD5

03af2bdb6f1fe7e004f9d39efe7386bb
SHA1

2fab8949831febb3a6a05a8de00354ce663238c3
SHA256

f4281336c75c9d06c40cf3d722709d7e806d635729b5f93bb63258796b684342
SHA512

ae829fbc6ec8cd9657992fb10aeb24bc6f13b4fc6f427230d658e3faa6f43897ea37dbbadf52309e581a2b30d922d1f13d7da68a5aade626e24f3819a1aa0584
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfT:NABE

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1728-13-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2644-109-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2260-115-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig
behavioral1/memory/2608-119-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/1624-122-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2648-117-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/1264-113-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2628-111-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2108-107-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1728	UDNdUkc.exe
2108	tWTKyqq.exe
2644	rZuGqVI.exe
2628	DnYlmEE.exe
1264	iqpVPuR.exe
2260	hQoEREY.exe
2648	MftjgJE.exe
2608	wFDnQZF.exe
1624	rRVlIYZ.exe
2456	hzbqwwY.exe
2604	kxrptwt.exe
2928	oJHfXyo.exe
1080	XPCoBZi.exe
2764	ItgaWTA.exe
2804	lfiSYuj.exe
2664	nbMDdfk.exe
2168	oNQRkOo.exe
2416	BUpLGoM.exe
1920	grOzDYy.exe
1344	QAYZyBe.exe
2112	jiXcXOU.exe
2096	sGlmxqg.exe
568	vYmrXbZ.exe
1876	nEgnaGX.exe
2420	CGkLigd.exe
2328	kvVAhJe.exe
580	NUdHWrL.exe
788	EzJSkFE.exe
2024	mIbzmTd.exe
1820	KnceVzN.exe
2408	IEffKVp.exe
832	mxRxxKg.exe
1388	iPmYCSC.exe
1324	LYHWCub.exe
764	FpLdADw.exe
292	hetGVOw.exe
3060	YmBbXns.exe
2916	xGfFneH.exe
1948	EXPOSQu.exe
1064	UcUHZDk.exe
1832	IaFuEJU.exe
2020	nIeEiQO.exe
1904	CSblBSR.exe
412	WEXYvIZ.exe
3040	PeoaNSc.exe
1536	ldEZgnQ.exe
1556	LysADdn.exe
1828	RIDxEFb.exe
2724	PgTKmtX.exe
760	CtPzByk.exe
912	fHlaXqT.exe
1404	dMpkrjB.exe
2920	bFrsyvi.exe
2252	DhfQfle.exe
2212	DAPQvqk.exe
1824	CRSjlgk.exe
2036	VHZyXTZ.exe
2492	GDDdjTF.exe
2700	UvomChR.exe
2944	dOHgsLv.exe
2824	AsPHHbX.exe
2940	zYZwcyP.exe
2536	yHzvRYa.exe
2520	dsJoOJQ.exe

Loads dropped DLL 64 IoCs

pid	Process
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2844-0-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x000b000000015cff-6.dat	upx
behavioral1/memory/1728-13-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/files/0x0038000000015d6b-15.dat	upx
behavioral1/files/0x000e0000000054ab-19.dat	upx
behavioral1/files/0x0007000000015f65-32.dat	upx
behavioral1/files/0x0008000000015ecc-27.dat	upx
behavioral1/files/0x000900000001621e-43.dat	upx
behavioral1/files/0x0006000000016d20-51.dat	upx
behavioral1/files/0x0007000000016d18-47.dat	upx
behavioral1/files/0x0006000000016d3a-62.dat	upx
behavioral1/files/0x0006000000016d74-81.dat	upx
behavioral1/files/0x0006000000016d8e-88.dat	upx
behavioral1/files/0x0006000000016db1-102.dat	upx
behavioral1/memory/2644-109-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2260-115-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2608-119-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0031000000018649-172.dat	upx
behavioral1/files/0x000500000001875a-186.dat	upx
behavioral1/files/0x00050000000186f6-179.dat	upx
behavioral1/files/0x0006000000017437-161.dat	upx
behavioral1/files/0x000600000001708b-147.dat	upx
behavioral1/files/0x0006000000016dbe-137.dat	upx
behavioral1/files/0x00060000000171df-151.dat	upx
behavioral1/files/0x000600000001704a-140.dat	upx
behavioral1/files/0x0006000000016db9-127.dat	upx
behavioral1/files/0x00050000000186fa-181.dat	upx
behavioral1/files/0x0005000000018665-174.dat	upx
behavioral1/files/0x0015000000018644-169.dat	upx
behavioral1/files/0x00060000000173d0-156.dat	upx
behavioral1/memory/1624-122-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0035000000015d7f-131.dat	upx
behavioral1/memory/2648-117-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/1264-113-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2628-111-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2108-107-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0006000000016da5-97.dat	upx
behavioral1/files/0x0006000000016d9d-92.dat	upx
behavioral1/files/0x0006000000016d5f-78.dat	upx
behavioral1/files/0x0006000000016d43-72.dat	upx
behavioral1/files/0x0006000000016d3e-67.dat	upx
behavioral1/files/0x0006000000016d34-57.dat	upx
behavioral1/files/0x0007000000015fe5-37.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\mDUawzF.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\LuSTaRy.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\SWVNPSO.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\dtCnSZH.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\qXhfCtt.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\bMXRjsy.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\XsiupCI.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\nlfmWkg.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\FFHaJlz.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\GlMEFLF.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\lxHNula.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\mottXxn.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\UeoobLl.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\yIojxGx.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\IiSOAaK.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\pEGZVNC.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\cUFnFpW.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\EKheOgj.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\XUDxzxU.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\DAPQvqk.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\myTWupB.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\nwZKzcY.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\UBDCLzE.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ikEOevp.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\GfEcWfa.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OKxNkch.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\lcDRroP.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\hetGVOw.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\zSRnWFv.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\BpOuhyF.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OoHEzoV.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\wabbULx.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\GHsoCdt.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\vQMzOPD.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\nEgnaGX.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\vFSzWmx.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\iNphlUc.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\WlJHLVF.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\irpHrII.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\rxBpegi.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\UmnxidP.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\slpEgLK.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\dpIBOpz.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\aYoiHAJ.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\JpjifAO.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\BCJGgAl.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\yqiYxuu.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\YJQybmL.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\OSRGCQX.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\XAaQRFa.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\lASxVkE.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\SefUynM.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\UrLKRmi.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\IPXgXvv.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\CuNgfeh.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\KDVZSjN.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\JlwBVWu.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\UlDHOrj.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\jnoUYdq.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\oQAPFJy.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ssbKhZQ.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\mYgpSVo.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\qeBCnZR.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
File created	C:\Windows\System\ysOnQlD.exe	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2376	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
Token: SeDebugPrivilege	2376	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2376	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	29
PID 2844 wrote to memory of 2376	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	29
PID 2844 wrote to memory of 2376	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	29
PID 2844 wrote to memory of 1728	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	30
PID 2844 wrote to memory of 1728	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	30
PID 2844 wrote to memory of 1728	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	30
PID 2844 wrote to memory of 2108	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2108	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2108	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	31
PID 2844 wrote to memory of 2644	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2644	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2644	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	32
PID 2844 wrote to memory of 2628	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2628	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	33
PID 2844 wrote to memory of 2628	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	33
PID 2844 wrote to memory of 1264	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	34
PID 2844 wrote to memory of 1264	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	34
PID 2844 wrote to memory of 1264	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	34
PID 2844 wrote to memory of 2260	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2260	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2260	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	35
PID 2844 wrote to memory of 2648	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2648	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2648	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	36
PID 2844 wrote to memory of 2608	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	37
PID 2844 wrote to memory of 2608	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	37
PID 2844 wrote to memory of 2608	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	37
PID 2844 wrote to memory of 1624	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	38
PID 2844 wrote to memory of 1624	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	38
PID 2844 wrote to memory of 1624	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	38
PID 2844 wrote to memory of 2456	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2456	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2456	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	39
PID 2844 wrote to memory of 2604	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2604	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2604	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	40
PID 2844 wrote to memory of 2928	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	41
PID 2844 wrote to memory of 2928	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	41
PID 2844 wrote to memory of 2928	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	41
PID 2844 wrote to memory of 1080	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	42
PID 2844 wrote to memory of 1080	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	42
PID 2844 wrote to memory of 1080	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	42
PID 2844 wrote to memory of 2764	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2764	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2764	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	43
PID 2844 wrote to memory of 2804	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2804	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2804	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	44
PID 2844 wrote to memory of 2664	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2664	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2664	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	45
PID 2844 wrote to memory of 2168	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	46
PID 2844 wrote to memory of 2168	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	46
PID 2844 wrote to memory of 2168	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	46
PID 2844 wrote to memory of 2416	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	47
PID 2844 wrote to memory of 2416	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	47
PID 2844 wrote to memory of 2416	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	47
PID 2844 wrote to memory of 1920	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	48
PID 2844 wrote to memory of 1920	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	48
PID 2844 wrote to memory of 1920	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	48
PID 2844 wrote to memory of 1344	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	49
PID 2844 wrote to memory of 1344	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	49
PID 2844 wrote to memory of 1344	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	49
PID 2844 wrote to memory of 2112	2844	03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03af2bdb6f1fe7e004f9d39efe7386bb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\System\UDNdUkc.exe
  C:\Windows\System\UDNdUkc.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\tWTKyqq.exe
  C:\Windows\System\tWTKyqq.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\rZuGqVI.exe
  C:\Windows\System\rZuGqVI.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\DnYlmEE.exe
  C:\Windows\System\DnYlmEE.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\iqpVPuR.exe
  C:\Windows\System\iqpVPuR.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\hQoEREY.exe
  C:\Windows\System\hQoEREY.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\MftjgJE.exe
  C:\Windows\System\MftjgJE.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\wFDnQZF.exe
  C:\Windows\System\wFDnQZF.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\rRVlIYZ.exe
  C:\Windows\System\rRVlIYZ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\hzbqwwY.exe
  C:\Windows\System\hzbqwwY.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\kxrptwt.exe
  C:\Windows\System\kxrptwt.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\oJHfXyo.exe
  C:\Windows\System\oJHfXyo.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\XPCoBZi.exe
  C:\Windows\System\XPCoBZi.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\ItgaWTA.exe
  C:\Windows\System\ItgaWTA.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\lfiSYuj.exe
  C:\Windows\System\lfiSYuj.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\nbMDdfk.exe
  C:\Windows\System\nbMDdfk.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\oNQRkOo.exe
  C:\Windows\System\oNQRkOo.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\BUpLGoM.exe
  C:\Windows\System\BUpLGoM.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\grOzDYy.exe
  C:\Windows\System\grOzDYy.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\QAYZyBe.exe
  C:\Windows\System\QAYZyBe.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\jiXcXOU.exe
  C:\Windows\System\jiXcXOU.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\sGlmxqg.exe
  C:\Windows\System\sGlmxqg.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\vYmrXbZ.exe
  C:\Windows\System\vYmrXbZ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\nEgnaGX.exe
  C:\Windows\System\nEgnaGX.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\CGkLigd.exe
  C:\Windows\System\CGkLigd.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\kvVAhJe.exe
  C:\Windows\System\kvVAhJe.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\NUdHWrL.exe
  C:\Windows\System\NUdHWrL.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\EzJSkFE.exe
  C:\Windows\System\EzJSkFE.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\mIbzmTd.exe
  C:\Windows\System\mIbzmTd.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\CSblBSR.exe
  C:\Windows\System\CSblBSR.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\KnceVzN.exe
  C:\Windows\System\KnceVzN.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\WEXYvIZ.exe
  C:\Windows\System\WEXYvIZ.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\IEffKVp.exe
  C:\Windows\System\IEffKVp.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\PeoaNSc.exe
  C:\Windows\System\PeoaNSc.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\mxRxxKg.exe
  C:\Windows\System\mxRxxKg.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\ldEZgnQ.exe
  C:\Windows\System\ldEZgnQ.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\iPmYCSC.exe
  C:\Windows\System\iPmYCSC.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\LysADdn.exe
  C:\Windows\System\LysADdn.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\LYHWCub.exe
  C:\Windows\System\LYHWCub.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\RIDxEFb.exe
  C:\Windows\System\RIDxEFb.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\FpLdADw.exe
  C:\Windows\System\FpLdADw.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\CtPzByk.exe
  C:\Windows\System\CtPzByk.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\hetGVOw.exe
  C:\Windows\System\hetGVOw.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\fHlaXqT.exe
  C:\Windows\System\fHlaXqT.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\YmBbXns.exe
  C:\Windows\System\YmBbXns.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\dMpkrjB.exe
  C:\Windows\System\dMpkrjB.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\xGfFneH.exe
  C:\Windows\System\xGfFneH.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\bFrsyvi.exe
  C:\Windows\System\bFrsyvi.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\EXPOSQu.exe
  C:\Windows\System\EXPOSQu.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\DhfQfle.exe
  C:\Windows\System\DhfQfle.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\UcUHZDk.exe
  C:\Windows\System\UcUHZDk.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\DAPQvqk.exe
  C:\Windows\System\DAPQvqk.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\IaFuEJU.exe
  C:\Windows\System\IaFuEJU.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\CRSjlgk.exe
  C:\Windows\System\CRSjlgk.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\nIeEiQO.exe
  C:\Windows\System\nIeEiQO.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\VHZyXTZ.exe
  C:\Windows\System\VHZyXTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\PgTKmtX.exe
  C:\Windows\System\PgTKmtX.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\UvomChR.exe
  C:\Windows\System\UvomChR.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\GDDdjTF.exe
  C:\Windows\System\GDDdjTF.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\dOHgsLv.exe
  C:\Windows\System\dOHgsLv.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\AsPHHbX.exe
  C:\Windows\System\AsPHHbX.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\zYZwcyP.exe
  C:\Windows\System\zYZwcyP.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\yHzvRYa.exe
  C:\Windows\System\yHzvRYa.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\XIHHeqU.exe
  C:\Windows\System\XIHHeqU.exe
  2⤵
  PID:540
- C:\Windows\System\dsJoOJQ.exe
  C:\Windows\System\dsJoOJQ.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\nOQRlVU.exe
  C:\Windows\System\nOQRlVU.exe
  2⤵
  PID:1092
- C:\Windows\System\TzcmCyP.exe
  C:\Windows\System\TzcmCyP.exe
  2⤵
  PID:1872
- C:\Windows\System\OSRGCQX.exe
  C:\Windows\System\OSRGCQX.exe
  2⤵
  PID:2084
- C:\Windows\System\wuKRZwT.exe
  C:\Windows\System\wuKRZwT.exe
  2⤵
  PID:1308
- C:\Windows\System\iiFQtpZ.exe
  C:\Windows\System\iiFQtpZ.exe
  2⤵
  PID:2272
- C:\Windows\System\qXhfCtt.exe
  C:\Windows\System\qXhfCtt.exe
  2⤵
  PID:3028
- C:\Windows\System\UbQUDPe.exe
  C:\Windows\System\UbQUDPe.exe
  2⤵
  PID:1796
- C:\Windows\System\uljINSj.exe
  C:\Windows\System\uljINSj.exe
  2⤵
  PID:2852
- C:\Windows\System\nXGjVEw.exe
  C:\Windows\System\nXGjVEw.exe
  2⤵
  PID:2572
- C:\Windows\System\vNuhiDI.exe
  C:\Windows\System\vNuhiDI.exe
  2⤵
  PID:880
- C:\Windows\System\OPuuagc.exe
  C:\Windows\System\OPuuagc.exe
  2⤵
  PID:2960
- C:\Windows\System\MgzrTob.exe
  C:\Windows\System\MgzrTob.exe
  2⤵
  PID:2100
- C:\Windows\System\jHbJxky.exe
  C:\Windows\System\jHbJxky.exe
  2⤵
  PID:2872
- C:\Windows\System\gJiYIIQ.exe
  C:\Windows\System\gJiYIIQ.exe
  2⤵
  PID:1144
- C:\Windows\System\EmTteCn.exe
  C:\Windows\System\EmTteCn.exe
  2⤵
  PID:1888
- C:\Windows\System\HRZPefJ.exe
  C:\Windows\System\HRZPefJ.exe
  2⤵
  PID:2256
- C:\Windows\System\HjfBwIV.exe
  C:\Windows\System\HjfBwIV.exe
  2⤵
  PID:1600
- C:\Windows\System\SrGUkDt.exe
  C:\Windows\System\SrGUkDt.exe
  2⤵
  PID:1576
- C:\Windows\System\fRZqFHM.exe
  C:\Windows\System\fRZqFHM.exe
  2⤵
  PID:2448
- C:\Windows\System\hFvzgcX.exe
  C:\Windows\System\hFvzgcX.exe
  2⤵
  PID:2732
- C:\Windows\System\zcvEVHh.exe
  C:\Windows\System\zcvEVHh.exe
  2⤵
  PID:496
- C:\Windows\System\sMkXWkM.exe
  C:\Windows\System\sMkXWkM.exe
  2⤵
  PID:2580
- C:\Windows\System\imhHPYG.exe
  C:\Windows\System\imhHPYG.exe
  2⤵
  PID:488
- C:\Windows\System\bfFeJXk.exe
  C:\Windows\System\bfFeJXk.exe
  2⤵
  PID:840
- C:\Windows\System\qoZttDd.exe
  C:\Windows\System\qoZttDd.exe
  2⤵
  PID:1924
- C:\Windows\System\uKCvqzK.exe
  C:\Windows\System\uKCvqzK.exe
  2⤵
  PID:2352
- C:\Windows\System\YpXVdMW.exe
  C:\Windows\System\YpXVdMW.exe
  2⤵
  PID:2516
- C:\Windows\System\rplqHIZ.exe
  C:\Windows\System\rplqHIZ.exe
  2⤵
  PID:2720
- C:\Windows\System\XowURAk.exe
  C:\Windows\System\XowURAk.exe
  2⤵
  PID:2932
- C:\Windows\System\OVnSFFW.exe
  C:\Windows\System\OVnSFFW.exe
  2⤵
  PID:2548
- C:\Windows\System\yqiYxuu.exe
  C:\Windows\System\yqiYxuu.exe
  2⤵
  PID:2684
- C:\Windows\System\qxgGqkH.exe
  C:\Windows\System\qxgGqkH.exe
  2⤵
  PID:2320
- C:\Windows\System\bMXRjsy.exe
  C:\Windows\System\bMXRjsy.exe
  2⤵
  PID:1540
- C:\Windows\System\YVSJxFX.exe
  C:\Windows\System\YVSJxFX.exe
  2⤵
  PID:2924
- C:\Windows\System\NNXdDJp.exe
  C:\Windows\System\NNXdDJp.exe
  2⤵
  PID:1988
- C:\Windows\System\gbPDmlV.exe
  C:\Windows\System\gbPDmlV.exe
  2⤵
  PID:836
- C:\Windows\System\ppOrlbO.exe
  C:\Windows\System\ppOrlbO.exe
  2⤵
  PID:2388
- C:\Windows\System\xnePQGB.exe
  C:\Windows\System\xnePQGB.exe
  2⤵
  PID:2308
- C:\Windows\System\XsiupCI.exe
  C:\Windows\System\XsiupCI.exe
  2⤵
  PID:1548
- C:\Windows\System\khpWixD.exe
  C:\Windows\System\khpWixD.exe
  2⤵
  PID:308
- C:\Windows\System\UJSmDvW.exe
  C:\Windows\System\UJSmDvW.exe
  2⤵
  PID:2332
- C:\Windows\System\YeFVreh.exe
  C:\Windows\System\YeFVreh.exe
  2⤵
  PID:2068
- C:\Windows\System\snMenAY.exe
  C:\Windows\System\snMenAY.exe
  2⤵
  PID:2380
- C:\Windows\System\LFpOBBl.exe
  C:\Windows\System\LFpOBBl.exe
  2⤵
  PID:560
- C:\Windows\System\igmhaon.exe
  C:\Windows\System\igmhaon.exe
  2⤵
  PID:2120
- C:\Windows\System\lNtCZLq.exe
  C:\Windows\System\lNtCZLq.exe
  2⤵
  PID:1908
- C:\Windows\System\IfYlEij.exe
  C:\Windows\System\IfYlEij.exe
  2⤵
  PID:1356
- C:\Windows\System\MwCgWbJ.exe
  C:\Windows\System\MwCgWbJ.exe
  2⤵
  PID:956
- C:\Windows\System\AOnGkLX.exe
  C:\Windows\System\AOnGkLX.exe
  2⤵
  PID:1696
- C:\Windows\System\YOfcmhL.exe
  C:\Windows\System\YOfcmhL.exe
  2⤵
  PID:1628
- C:\Windows\System\TKqFkCU.exe
  C:\Windows\System\TKqFkCU.exe
  2⤵
  PID:1660
- C:\Windows\System\ZcNjWTV.exe
  C:\Windows\System\ZcNjWTV.exe
  2⤵
  PID:2544
- C:\Windows\System\KcaFHLr.exe
  C:\Windows\System\KcaFHLr.exe
  2⤵
  PID:1112
- C:\Windows\System\yEYUmgx.exe
  C:\Windows\System\yEYUmgx.exe
  2⤵
  PID:1304
- C:\Windows\System\rUkuDZA.exe
  C:\Windows\System\rUkuDZA.exe
  2⤵
  PID:2556
- C:\Windows\System\fAjTNUX.exe
  C:\Windows\System\fAjTNUX.exe
  2⤵
  PID:2800
- C:\Windows\System\XkJdXLG.exe
  C:\Windows\System\XkJdXLG.exe
  2⤵
  PID:1768
- C:\Windows\System\yEpgxUm.exe
  C:\Windows\System\yEpgxUm.exe
  2⤵
  PID:2072
- C:\Windows\System\MrpkdOV.exe
  C:\Windows\System\MrpkdOV.exe
  2⤵
  PID:2792
- C:\Windows\System\iXXlfeT.exe
  C:\Windows\System\iXXlfeT.exe
  2⤵
  PID:2876
- C:\Windows\System\LVKQkcu.exe
  C:\Windows\System\LVKQkcu.exe
  2⤵
  PID:712
- C:\Windows\System\TaXrjFS.exe
  C:\Windows\System\TaXrjFS.exe
  2⤵
  PID:2164
- C:\Windows\System\DdnGJZG.exe
  C:\Windows\System\DdnGJZG.exe
  2⤵
  PID:2004
- C:\Windows\System\MeUeQmi.exe
  C:\Windows\System\MeUeQmi.exe
  2⤵
  PID:1072
- C:\Windows\System\dtCALqh.exe
  C:\Windows\System\dtCALqh.exe
  2⤵
  PID:2076
- C:\Windows\System\rxnzNYt.exe
  C:\Windows\System\rxnzNYt.exe
  2⤵
  PID:2028
- C:\Windows\System\cfOiDYv.exe
  C:\Windows\System\cfOiDYv.exe
  2⤵
  PID:3032
- C:\Windows\System\COHeeEo.exe
  C:\Windows\System\COHeeEo.exe
  2⤵
  PID:3020
- C:\Windows\System\lmJrxpe.exe
  C:\Windows\System\lmJrxpe.exe
  2⤵
  PID:1596
- C:\Windows\System\OVYZAEr.exe
  C:\Windows\System\OVYZAEr.exe
  2⤵
  PID:2756
- C:\Windows\System\LlBVTjt.exe
  C:\Windows\System\LlBVTjt.exe
  2⤵
  PID:3044
- C:\Windows\System\TctDfni.exe
  C:\Windows\System\TctDfni.exe
  2⤵
  PID:2704
- C:\Windows\System\sXmpPOK.exe
  C:\Windows\System\sXmpPOK.exe
  2⤵
  PID:784
- C:\Windows\System\zdHxhTf.exe
  C:\Windows\System\zdHxhTf.exe
  2⤵
  PID:2324
- C:\Windows\System\ptVbKqK.exe
  C:\Windows\System\ptVbKqK.exe
  2⤵
  PID:868
- C:\Windows\System\UxaXMiM.exe
  C:\Windows\System\UxaXMiM.exe
  2⤵
  PID:2988
- C:\Windows\System\Eiwfows.exe
  C:\Windows\System\Eiwfows.exe
  2⤵
  PID:616
- C:\Windows\System\taaEAue.exe
  C:\Windows\System\taaEAue.exe
  2⤵
  PID:1992
- C:\Windows\System\Zgkcpjt.exe
  C:\Windows\System\Zgkcpjt.exe
  2⤵
  PID:2144
- C:\Windows\System\fqSYswu.exe
  C:\Windows\System\fqSYswu.exe
  2⤵
  PID:2776
- C:\Windows\System\NKJfkRZ.exe
  C:\Windows\System\NKJfkRZ.exe
  2⤵
  PID:2472
- C:\Windows\System\cughnEw.exe
  C:\Windows\System\cughnEw.exe
  2⤵
  PID:1100
- C:\Windows\System\UrevUNu.exe
  C:\Windows\System\UrevUNu.exe
  2⤵
  PID:2636
- C:\Windows\System\CMEuaPi.exe
  C:\Windows\System\CMEuaPi.exe
  2⤵
  PID:2296
- C:\Windows\System\occdWTH.exe
  C:\Windows\System\occdWTH.exe
  2⤵
  PID:1980
- C:\Windows\System\WziAFBv.exe
  C:\Windows\System\WziAFBv.exe
  2⤵
  PID:2560
- C:\Windows\System\ukjDqFQ.exe
  C:\Windows\System\ukjDqFQ.exe
  2⤵
  PID:2740
- C:\Windows\System\XONMbqx.exe
  C:\Windows\System\XONMbqx.exe
  2⤵
  PID:1748
- C:\Windows\System\ZpbnfOX.exe
  C:\Windows\System\ZpbnfOX.exe
  2⤵
  PID:2032
- C:\Windows\System\yKgrxBI.exe
  C:\Windows\System\yKgrxBI.exe
  2⤵
  PID:1440
- C:\Windows\System\ikEOevp.exe
  C:\Windows\System\ikEOevp.exe
  2⤵
  PID:1192
- C:\Windows\System\rVfdmFx.exe
  C:\Windows\System\rVfdmFx.exe
  2⤵
  PID:2632
- C:\Windows\System\eUEhhVA.exe
  C:\Windows\System\eUEhhVA.exe
  2⤵
  PID:2948
- C:\Windows\System\sBgtBPR.exe
  C:\Windows\System\sBgtBPR.exe
  2⤵
  PID:2512
- C:\Windows\System\GnmFiqG.exe
  C:\Windows\System\GnmFiqG.exe
  2⤵
  PID:1524
- C:\Windows\System\GcwAZbn.exe
  C:\Windows\System\GcwAZbn.exe
  2⤵
  PID:2624
- C:\Windows\System\jBsNIDD.exe
  C:\Windows\System\jBsNIDD.exe
  2⤵
  PID:2188
- C:\Windows\System\GEsyXmg.exe
  C:\Windows\System\GEsyXmg.exe
  2⤵
  PID:1488
- C:\Windows\System\YrFAOmQ.exe
  C:\Windows\System\YrFAOmQ.exe
  2⤵
  PID:2708
- C:\Windows\System\fayDHVj.exe
  C:\Windows\System\fayDHVj.exe
  2⤵
  PID:2300
- C:\Windows\System\dZMscCe.exe
  C:\Windows\System\dZMscCe.exe
  2⤵
  PID:1520
- C:\Windows\System\gQZLrFn.exe
  C:\Windows\System\gQZLrFn.exe
  2⤵
  PID:2588
- C:\Windows\System\ZQaXhdH.exe
  C:\Windows\System\ZQaXhdH.exe
  2⤵
  PID:2312
- C:\Windows\System\IiSOAaK.exe
  C:\Windows\System\IiSOAaK.exe
  2⤵
  PID:1984
- C:\Windows\System\JprKCJO.exe
  C:\Windows\System\JprKCJO.exe
  2⤵
  PID:2540
- C:\Windows\System\wabbULx.exe
  C:\Windows\System\wabbULx.exe
  2⤵
  PID:2468
- C:\Windows\System\GVqljGC.exe
  C:\Windows\System\GVqljGC.exe
  2⤵
  PID:3084
- C:\Windows\System\xYGTsxN.exe
  C:\Windows\System\xYGTsxN.exe
  2⤵
  PID:3100
- C:\Windows\System\ebvjlUy.exe
  C:\Windows\System\ebvjlUy.exe
  2⤵
  PID:3124
- C:\Windows\System\rfmVQPT.exe
  C:\Windows\System\rfmVQPT.exe
  2⤵
  PID:3140
- C:\Windows\System\VpRycLH.exe
  C:\Windows\System\VpRycLH.exe
  2⤵
  PID:3156
- C:\Windows\System\tyMUOGt.exe
  C:\Windows\System\tyMUOGt.exe
  2⤵
  PID:3172
- C:\Windows\System\sPINjPf.exe
  C:\Windows\System\sPINjPf.exe
  2⤵
  PID:3188
- C:\Windows\System\dMvLsUZ.exe
  C:\Windows\System\dMvLsUZ.exe
  2⤵
  PID:3204
- C:\Windows\System\lVoIcFx.exe
  C:\Windows\System\lVoIcFx.exe
  2⤵
  PID:3220
- C:\Windows\System\fnLZFPe.exe
  C:\Windows\System\fnLZFPe.exe
  2⤵
  PID:3256
- C:\Windows\System\AcxJOho.exe
  C:\Windows\System\AcxJOho.exe
  2⤵
  PID:3272
- C:\Windows\System\sptrpRh.exe
  C:\Windows\System\sptrpRh.exe
  2⤵
  PID:3288
- C:\Windows\System\BLBeZUq.exe
  C:\Windows\System\BLBeZUq.exe
  2⤵
  PID:3304
- C:\Windows\System\qGDSACw.exe
  C:\Windows\System\qGDSACw.exe
  2⤵
  PID:3320
- C:\Windows\System\qwjtvHW.exe
  C:\Windows\System\qwjtvHW.exe
  2⤵
  PID:3336
- C:\Windows\System\DZTuAHF.exe
  C:\Windows\System\DZTuAHF.exe
  2⤵
  PID:3352
- C:\Windows\System\tpaeaRU.exe
  C:\Windows\System\tpaeaRU.exe
  2⤵
  PID:3368
- C:\Windows\System\JlwBVWu.exe
  C:\Windows\System\JlwBVWu.exe
  2⤵
  PID:3384
- C:\Windows\System\hcheIRP.exe
  C:\Windows\System\hcheIRP.exe
  2⤵
  PID:3400
- C:\Windows\System\OqWBtZD.exe
  C:\Windows\System\OqWBtZD.exe
  2⤵
  PID:3424
- C:\Windows\System\HCQlLik.exe
  C:\Windows\System\HCQlLik.exe
  2⤵
  PID:3440
- C:\Windows\System\RpizSrM.exe
  C:\Windows\System\RpizSrM.exe
  2⤵
  PID:3456
- C:\Windows\System\gPxQuUi.exe
  C:\Windows\System\gPxQuUi.exe
  2⤵
  PID:3472
- C:\Windows\System\ISQkaAi.exe
  C:\Windows\System\ISQkaAi.exe
  2⤵
  PID:3488
- C:\Windows\System\kqaULTI.exe
  C:\Windows\System\kqaULTI.exe
  2⤵
  PID:3504
- C:\Windows\System\tdqoRtU.exe
  C:\Windows\System\tdqoRtU.exe
  2⤵
  PID:3520
- C:\Windows\System\GHsoCdt.exe
  C:\Windows\System\GHsoCdt.exe
  2⤵
  PID:3536
- C:\Windows\System\dVVtHri.exe
  C:\Windows\System\dVVtHri.exe
  2⤵
  PID:3552
- C:\Windows\System\jHAuCRI.exe
  C:\Windows\System\jHAuCRI.exe
  2⤵
  PID:3568
- C:\Windows\System\DkNYYpX.exe
  C:\Windows\System\DkNYYpX.exe
  2⤵
  PID:3584
- C:\Windows\System\OmzTQNg.exe
  C:\Windows\System\OmzTQNg.exe
  2⤵
  PID:3600
- C:\Windows\System\XlZmTeU.exe
  C:\Windows\System\XlZmTeU.exe
  2⤵
  PID:3616
- C:\Windows\System\PSTHGQE.exe
  C:\Windows\System\PSTHGQE.exe
  2⤵
  PID:3632
- C:\Windows\System\xCZAWBP.exe
  C:\Windows\System\xCZAWBP.exe
  2⤵
  PID:3648
- C:\Windows\System\yjorToU.exe
  C:\Windows\System\yjorToU.exe
  2⤵
  PID:3664
- C:\Windows\System\MIEGQQJ.exe
  C:\Windows\System\MIEGQQJ.exe
  2⤵
  PID:3680
- C:\Windows\System\aiabqlD.exe
  C:\Windows\System\aiabqlD.exe
  2⤵
  PID:3696
- C:\Windows\System\qpxsiZB.exe
  C:\Windows\System\qpxsiZB.exe
  2⤵
  PID:3712
- C:\Windows\System\nhgySHp.exe
  C:\Windows\System\nhgySHp.exe
  2⤵
  PID:3728
- C:\Windows\System\yWHYVai.exe
  C:\Windows\System\yWHYVai.exe
  2⤵
  PID:3744
- C:\Windows\System\gzluKCJ.exe
  C:\Windows\System\gzluKCJ.exe
  2⤵
  PID:3764
- C:\Windows\System\zWWWjAI.exe
  C:\Windows\System\zWWWjAI.exe
  2⤵
  PID:3780
- C:\Windows\System\rxBpegi.exe
  C:\Windows\System\rxBpegi.exe
  2⤵
  PID:3796
- C:\Windows\System\rzDpFNH.exe
  C:\Windows\System\rzDpFNH.exe
  2⤵
  PID:3920
- C:\Windows\System\GKqsrju.exe
  C:\Windows\System\GKqsrju.exe
  2⤵
  PID:3940
- C:\Windows\System\pbJhGgK.exe
  C:\Windows\System\pbJhGgK.exe
  2⤵
  PID:3956
- C:\Windows\System\cNdxfKN.exe
  C:\Windows\System\cNdxfKN.exe
  2⤵
  PID:3976
- C:\Windows\System\PbjtWFC.exe
  C:\Windows\System\PbjtWFC.exe
  2⤵
  PID:3992
- C:\Windows\System\OtZFXaY.exe
  C:\Windows\System\OtZFXaY.exe
  2⤵
  PID:4008
- C:\Windows\System\gGHtLJH.exe
  C:\Windows\System\gGHtLJH.exe
  2⤵
  PID:4028
- C:\Windows\System\gZXFJKt.exe
  C:\Windows\System\gZXFJKt.exe
  2⤵
  PID:4044
- C:\Windows\System\ZmISxxU.exe
  C:\Windows\System\ZmISxxU.exe
  2⤵
  PID:4060
- C:\Windows\System\aQvjYYa.exe
  C:\Windows\System\aQvjYYa.exe
  2⤵
  PID:4076
- C:\Windows\System\MdUIdqQ.exe
  C:\Windows\System\MdUIdqQ.exe
  2⤵
  PID:4092
- C:\Windows\System\HJGZzwv.exe
  C:\Windows\System\HJGZzwv.exe
  2⤵
  PID:536
- C:\Windows\System\sXfgjVx.exe
  C:\Windows\System\sXfgjVx.exe
  2⤵
  PID:3092
- C:\Windows\System\cOLyYDk.exe
  C:\Windows\System\cOLyYDk.exe
  2⤵
  PID:3120
- C:\Windows\System\ROtjEAx.exe
  C:\Windows\System\ROtjEAx.exe
  2⤵
  PID:3136
- C:\Windows\System\sggdWUg.exe
  C:\Windows\System\sggdWUg.exe
  2⤵
  PID:3184
- C:\Windows\System\hiuNJwT.exe
  C:\Windows\System\hiuNJwT.exe
  2⤵
  PID:3252
- C:\Windows\System\rPfNWOZ.exe
  C:\Windows\System\rPfNWOZ.exe
  2⤵
  PID:3240
- C:\Windows\System\PFKglvP.exe
  C:\Windows\System\PFKglvP.exe
  2⤵
  PID:3196
- C:\Windows\System\EgQjwBR.exe
  C:\Windows\System\EgQjwBR.exe
  2⤵
  PID:3312
- C:\Windows\System\blVXqSc.exe
  C:\Windows\System\blVXqSc.exe
  2⤵
  PID:3412
- C:\Windows\System\jEYqDwV.exe
  C:\Windows\System\jEYqDwV.exe
  2⤵
  PID:1484
- C:\Windows\System\cGXsejQ.exe
  C:\Windows\System\cGXsejQ.exe
  2⤵
  PID:3300
- C:\Windows\System\QjrBFsX.exe
  C:\Windows\System\QjrBFsX.exe
  2⤵
  PID:1900
- C:\Windows\System\vFSzWmx.exe
  C:\Windows\System\vFSzWmx.exe
  2⤵
  PID:3420
- C:\Windows\System\vLMAjyO.exe
  C:\Windows\System\vLMAjyO.exe
  2⤵
  PID:3468
- C:\Windows\System\RZVzKoC.exe
  C:\Windows\System\RZVzKoC.exe
  2⤵
  PID:3532
- C:\Windows\System\MzqUYtm.exe
  C:\Windows\System\MzqUYtm.exe
  2⤵
  PID:3624
- C:\Windows\System\pNgxplu.exe
  C:\Windows\System\pNgxplu.exe
  2⤵
  PID:3688
- C:\Windows\System\dyhXRIj.exe
  C:\Windows\System\dyhXRIj.exe
  2⤵
  PID:3752
- C:\Windows\System\IBCnjFd.exe
  C:\Windows\System\IBCnjFd.exe
  2⤵
  PID:3792
- C:\Windows\System\gqzIIzJ.exe
  C:\Windows\System\gqzIIzJ.exe
  2⤵
  PID:3932
- C:\Windows\System\sgeBZMC.exe
  C:\Windows\System\sgeBZMC.exe
  2⤵
  PID:3812
- C:\Windows\System\bPKDeln.exe
  C:\Windows\System\bPKDeln.exe
  2⤵
  PID:3348
- C:\Windows\System\UxaMCQe.exe
  C:\Windows\System\UxaMCQe.exe
  2⤵
  PID:3836
- C:\Windows\System\xQCucMB.exe
  C:\Windows\System\xQCucMB.exe
  2⤵
  PID:3480
- C:\Windows\System\nlfmWkg.exe
  C:\Windows\System\nlfmWkg.exe
  2⤵
  PID:3848
- C:\Windows\System\cNinnrN.exe
  C:\Windows\System\cNinnrN.exe
  2⤵
  PID:3856
- C:\Windows\System\kXSZRMc.exe
  C:\Windows\System\kXSZRMc.exe
  2⤵
  PID:3868
- C:\Windows\System\mgwYktB.exe
  C:\Windows\System\mgwYktB.exe
  2⤵
  PID:3888
- C:\Windows\System\QlzJAsU.exe
  C:\Windows\System\QlzJAsU.exe
  2⤵
  PID:3904
- C:\Windows\System\wbZJPIY.exe
  C:\Windows\System\wbZJPIY.exe
  2⤵
  PID:3916
- C:\Windows\System\cuPPYjg.exe
  C:\Windows\System\cuPPYjg.exe
  2⤵
  PID:4104
- C:\Windows\System\qyyZEou.exe
  C:\Windows\System\qyyZEou.exe
  2⤵
  PID:4120
- C:\Windows\System\MjtSRdW.exe
  C:\Windows\System\MjtSRdW.exe
  2⤵
  PID:4140
- C:\Windows\System\haYdMWT.exe
  C:\Windows\System\haYdMWT.exe
  2⤵
  PID:4156
- C:\Windows\System\vAinaBj.exe
  C:\Windows\System\vAinaBj.exe
  2⤵
  PID:4172
- C:\Windows\System\ublfqNl.exe
  C:\Windows\System\ublfqNl.exe
  2⤵
  PID:4188
- C:\Windows\System\VSXlNGK.exe
  C:\Windows\System\VSXlNGK.exe
  2⤵
  PID:4204
- C:\Windows\System\rMcJigu.exe
  C:\Windows\System\rMcJigu.exe
  2⤵
  PID:4220
- C:\Windows\System\QttLWGs.exe
  C:\Windows\System\QttLWGs.exe
  2⤵
  PID:4236
- C:\Windows\System\hZayfel.exe
  C:\Windows\System\hZayfel.exe
  2⤵
  PID:4256
- C:\Windows\System\yQoQSOl.exe
  C:\Windows\System\yQoQSOl.exe
  2⤵
  PID:4272
- C:\Windows\System\mYgpSVo.exe
  C:\Windows\System\mYgpSVo.exe
  2⤵
  PID:4288
- C:\Windows\System\WapNjxC.exe
  C:\Windows\System\WapNjxC.exe
  2⤵
  PID:4304
- C:\Windows\System\zGQBKPV.exe
  C:\Windows\System\zGQBKPV.exe
  2⤵
  PID:4320
- C:\Windows\System\JLOkEeV.exe
  C:\Windows\System\JLOkEeV.exe
  2⤵
  PID:4336
- C:\Windows\System\znKHasb.exe
  C:\Windows\System\znKHasb.exe
  2⤵
  PID:4352
- C:\Windows\System\mCYKQVh.exe
  C:\Windows\System\mCYKQVh.exe
  2⤵
  PID:4368
- C:\Windows\System\iXBaiMz.exe
  C:\Windows\System\iXBaiMz.exe
  2⤵
  PID:4384
- C:\Windows\System\dBXjAej.exe
  C:\Windows\System\dBXjAej.exe
  2⤵
  PID:4400
- C:\Windows\System\VNYTdnO.exe
  C:\Windows\System\VNYTdnO.exe
  2⤵
  PID:4416
- C:\Windows\System\pQJzBrV.exe
  C:\Windows\System\pQJzBrV.exe
  2⤵
  PID:4432
- C:\Windows\System\QrlPfPK.exe
  C:\Windows\System\QrlPfPK.exe
  2⤵
  PID:4448
- C:\Windows\System\GAaQloB.exe
  C:\Windows\System\GAaQloB.exe
  2⤵
  PID:4464
- C:\Windows\System\CPCJGmy.exe
  C:\Windows\System\CPCJGmy.exe
  2⤵
  PID:4480
- C:\Windows\System\hFLItKd.exe
  C:\Windows\System\hFLItKd.exe
  2⤵
  PID:4496
- C:\Windows\System\XVFoNBC.exe
  C:\Windows\System\XVFoNBC.exe
  2⤵
  PID:4512
- C:\Windows\System\UrLKRmi.exe
  C:\Windows\System\UrLKRmi.exe
  2⤵
  PID:4712
- C:\Windows\System\kAlTgYG.exe
  C:\Windows\System\kAlTgYG.exe
  2⤵
  PID:4744
- C:\Windows\System\pGXlOmN.exe
  C:\Windows\System\pGXlOmN.exe
  2⤵
  PID:4840
- C:\Windows\System\fkxTWaj.exe
  C:\Windows\System\fkxTWaj.exe
  2⤵
  PID:4860
- C:\Windows\System\fVIGFyU.exe
  C:\Windows\System\fVIGFyU.exe
  2⤵
  PID:4876
- C:\Windows\System\DoaRRPM.exe
  C:\Windows\System\DoaRRPM.exe
  2⤵
  PID:4892
- C:\Windows\System\MnKfOkS.exe
  C:\Windows\System\MnKfOkS.exe
  2⤵
  PID:4908
- C:\Windows\System\EtFGfXS.exe
  C:\Windows\System\EtFGfXS.exe
  2⤵
  PID:4924
- C:\Windows\System\zejGRhk.exe
  C:\Windows\System\zejGRhk.exe
  2⤵
  PID:4940
- C:\Windows\System\rzHSjIp.exe
  C:\Windows\System\rzHSjIp.exe
  2⤵
  PID:4956
- C:\Windows\System\QwWUWYS.exe
  C:\Windows\System\QwWUWYS.exe
  2⤵
  PID:4976
- C:\Windows\System\AcYkRlm.exe
  C:\Windows\System\AcYkRlm.exe
  2⤵
  PID:4992
- C:\Windows\System\NOLVoaM.exe
  C:\Windows\System\NOLVoaM.exe
  2⤵
  PID:5040
- C:\Windows\System\VmiQmMm.exe
  C:\Windows\System\VmiQmMm.exe
  2⤵
  PID:5056
- C:\Windows\System\ndZBfIV.exe
  C:\Windows\System\ndZBfIV.exe
  2⤵
  PID:5072
- C:\Windows\System\yfrQEHg.exe
  C:\Windows\System\yfrQEHg.exe
  2⤵
  PID:5088
- C:\Windows\System\HUhTnLD.exe
  C:\Windows\System\HUhTnLD.exe
  2⤵
  PID:5104
- C:\Windows\System\iRcyjFB.exe
  C:\Windows\System\iRcyjFB.exe
  2⤵
  PID:3948
- C:\Windows\System\TQuJqba.exe
  C:\Windows\System\TQuJqba.exe
  2⤵
  PID:3984
- C:\Windows\System\oAmRgfM.exe
  C:\Windows\System\oAmRgfM.exe
  2⤵
  PID:4056
- C:\Windows\System\xiZwQur.exe
  C:\Windows\System\xiZwQur.exe
  2⤵
  PID:3704
- C:\Windows\System\UAseffk.exe
  C:\Windows\System\UAseffk.exe
  2⤵
  PID:3168
- C:\Windows\System\GjGwGeh.exe
  C:\Windows\System\GjGwGeh.exe
  2⤵
  PID:3776
- C:\Windows\System\NANEIUU.exe
  C:\Windows\System\NANEIUU.exe
  2⤵
  PID:3500
- C:\Windows\System\KNyIfMv.exe
  C:\Windows\System\KNyIfMv.exe
  2⤵
  PID:3880
- C:\Windows\System\XkZEqTu.exe
  C:\Windows\System\XkZEqTu.exe
  2⤵
  PID:3864
- C:\Windows\System\emWOCMU.exe
  C:\Windows\System\emWOCMU.exe
  2⤵
  PID:4100
- C:\Windows\System\KhVuPkw.exe
  C:\Windows\System\KhVuPkw.exe
  2⤵
  PID:4164
- C:\Windows\System\qARBwkY.exe
  C:\Windows\System\qARBwkY.exe
  2⤵
  PID:3448
- C:\Windows\System\BehtAbD.exe
  C:\Windows\System\BehtAbD.exe
  2⤵
  PID:3724
- C:\Windows\System\ruUVdaW.exe
  C:\Windows\System\ruUVdaW.exe
  2⤵
  PID:3912
- C:\Windows\System\AYerrPD.exe
  C:\Windows\System\AYerrPD.exe
  2⤵
  PID:3216
- C:\Windows\System\YJQybmL.exe
  C:\Windows\System\YJQybmL.exe
  2⤵
  PID:4332
- C:\Windows\System\GaJaAVS.exe
  C:\Windows\System\GaJaAVS.exe
  2⤵
  PID:4344
- C:\Windows\System\jRxGbgx.exe
  C:\Windows\System\jRxGbgx.exe
  2⤵
  PID:3164
- C:\Windows\System\YqqjZOT.exe
  C:\Windows\System\YqqjZOT.exe
  2⤵
  PID:3232
- C:\Windows\System\LERpKzH.exe
  C:\Windows\System\LERpKzH.exe
  2⤵
  PID:4000
- C:\Windows\System\ULoyAoU.exe
  C:\Windows\System\ULoyAoU.exe
  2⤵
  PID:4068
- C:\Windows\System\BRnVCLs.exe
  C:\Windows\System\BRnVCLs.exe
  2⤵
  PID:3096
- C:\Windows\System\NgTekRJ.exe
  C:\Windows\System\NgTekRJ.exe
  2⤵
  PID:3876
- C:\Windows\System\hoAEegt.exe
  C:\Windows\System\hoAEegt.exe
  2⤵
  PID:3108
- C:\Windows\System\pEGZVNC.exe
  C:\Windows\System\pEGZVNC.exe
  2⤵
  PID:3772
- C:\Windows\System\myTWupB.exe
  C:\Windows\System\myTWupB.exe
  2⤵
  PID:3436
- C:\Windows\System\DPfuzJa.exe
  C:\Windows\System\DPfuzJa.exe
  2⤵
  PID:3824
- C:\Windows\System\MJDSwxD.exe
  C:\Windows\System\MJDSwxD.exe
  2⤵
  PID:4116
- C:\Windows\System\oNxLtBv.exe
  C:\Windows\System\oNxLtBv.exe
  2⤵
  PID:4212
- C:\Windows\System\IZrBYPv.exe
  C:\Windows\System\IZrBYPv.exe
  2⤵
  PID:4460
- C:\Windows\System\HIZZodx.exe
  C:\Windows\System\HIZZodx.exe
  2⤵
  PID:4536
- C:\Windows\System\mDUawzF.exe
  C:\Windows\System\mDUawzF.exe
  2⤵
  PID:4552
- C:\Windows\System\YMkXSih.exe
  C:\Windows\System\YMkXSih.exe
  2⤵
  PID:4568
- C:\Windows\System\jNnTKHs.exe
  C:\Windows\System\jNnTKHs.exe
  2⤵
  PID:4580
- C:\Windows\System\qWTjqDL.exe
  C:\Windows\System\qWTjqDL.exe
  2⤵
  PID:4596
- C:\Windows\System\kRfMVfv.exe
  C:\Windows\System\kRfMVfv.exe
  2⤵
  PID:4612
- C:\Windows\System\RIuQryz.exe
  C:\Windows\System\RIuQryz.exe
  2⤵
  PID:4636
- C:\Windows\System\BMSHKVa.exe
  C:\Windows\System\BMSHKVa.exe
  2⤵
  PID:4652
- C:\Windows\System\otTuZeJ.exe
  C:\Windows\System\otTuZeJ.exe
  2⤵
  PID:4504
- C:\Windows\System\QnriqIP.exe
  C:\Windows\System\QnriqIP.exe
  2⤵
  PID:4456
- C:\Windows\System\UcqPsAY.exe
  C:\Windows\System\UcqPsAY.exe
  2⤵
  PID:4676
- C:\Windows\System\DBGwybV.exe
  C:\Windows\System\DBGwybV.exe
  2⤵
  PID:4692
- C:\Windows\System\vvYMcTo.exe
  C:\Windows\System\vvYMcTo.exe
  2⤵
  PID:4708
- C:\Windows\System\vDFhwEE.exe
  C:\Windows\System\vDFhwEE.exe
  2⤵
  PID:4728
- C:\Windows\System\DjfPQoG.exe
  C:\Windows\System\DjfPQoG.exe
  2⤵
  PID:4740
- C:\Windows\System\AAxCAcZ.exe
  C:\Windows\System\AAxCAcZ.exe
  2⤵
  PID:1132
- C:\Windows\System\jNVUGxd.exe
  C:\Windows\System\jNVUGxd.exe
  2⤵
  PID:4768
- C:\Windows\System\FDEheFm.exe
  C:\Windows\System\FDEheFm.exe
  2⤵
  PID:4788
- C:\Windows\System\VAAsZqs.exe
  C:\Windows\System\VAAsZqs.exe
  2⤵
  PID:4856
- C:\Windows\System\SNRyIQB.exe
  C:\Windows\System\SNRyIQB.exe
  2⤵
  PID:5004
- C:\Windows\System\JBHwSja.exe
  C:\Windows\System\JBHwSja.exe
  2⤵
  PID:5048
- C:\Windows\System\UWapmXe.exe
  C:\Windows\System\UWapmXe.exe
  2⤵
  PID:5068
- C:\Windows\System\DQFsUDZ.exe
  C:\Windows\System\DQFsUDZ.exe
  2⤵
  PID:3676
- C:\Windows\System\yGosmuF.exe
  C:\Windows\System\yGosmuF.exe
  2⤵
  PID:3132
- C:\Windows\System\gBlMPbp.exe
  C:\Windows\System\gBlMPbp.exe
  2⤵
  PID:3376
- C:\Windows\System\yRohNXX.exe
  C:\Windows\System\yRohNXX.exe
  2⤵
  PID:3396
- C:\Windows\System\UmnxidP.exe
  C:\Windows\System\UmnxidP.exe
  2⤵
  PID:3804
- C:\Windows\System\GOPBaNh.exe
  C:\Windows\System\GOPBaNh.exe
  2⤵
  PID:3484
- C:\Windows\System\HpWdEDq.exe
  C:\Windows\System\HpWdEDq.exe
  2⤵
  PID:4200
- C:\Windows\System\mEyoqhu.exe
  C:\Windows\System\mEyoqhu.exe
  2⤵
  PID:3988
- C:\Windows\System\HdpPUTv.exe
  C:\Windows\System\HdpPUTv.exe
  2⤵
  PID:3592
- C:\Windows\System\SLwgRRs.exe
  C:\Windows\System\SLwgRRs.exe
  2⤵
  PID:3464
- C:\Windows\System\EJXWKWp.exe
  C:\Windows\System\EJXWKWp.exe
  2⤵
  PID:3452
- C:\Windows\System\TfxDuSM.exe
  C:\Windows\System\TfxDuSM.exe
  2⤵
  PID:4376
- C:\Windows\System\PwoUwtT.exe
  C:\Windows\System\PwoUwtT.exe
  2⤵
  PID:4248
- C:\Windows\System\GxXTzMk.exe
  C:\Windows\System\GxXTzMk.exe
  2⤵
  PID:4040
- C:\Windows\System\ePpgMqv.exe
  C:\Windows\System\ePpgMqv.exe
  2⤵
  PID:4180
- C:\Windows\System\hgcjrRj.exe
  C:\Windows\System\hgcjrRj.exe
  2⤵
  PID:3332
- C:\Windows\System\ahMVBlp.exe
  C:\Windows\System\ahMVBlp.exe
  2⤵
  PID:4252
- C:\Windows\System\GCdUuAM.exe
  C:\Windows\System\GCdUuAM.exe
  2⤵
  PID:4528
- C:\Windows\System\NzOllhZ.exe
  C:\Windows\System\NzOllhZ.exe
  2⤵
  PID:4628
- C:\Windows\System\rGucsQK.exe
  C:\Windows\System\rGucsQK.exe
  2⤵
  PID:4684
- C:\Windows\System\kkxDjxv.exe
  C:\Windows\System\kkxDjxv.exe
  2⤵
  PID:2488
- C:\Windows\System\UXPNYxN.exe
  C:\Windows\System\UXPNYxN.exe
  2⤵
  PID:4884
- C:\Windows\System\qaVyROo.exe
  C:\Windows\System\qaVyROo.exe
  2⤵
  PID:4964
- C:\Windows\System\yGUQUDr.exe
  C:\Windows\System\yGUQUDr.exe
  2⤵
  PID:4972
- C:\Windows\System\fYonJDX.exe
  C:\Windows\System\fYonJDX.exe
  2⤵
  PID:4948
- C:\Windows\System\gAFUIsy.exe
  C:\Windows\System\gAFUIsy.exe
  2⤵
  PID:4024
- C:\Windows\System\voHpdsZ.exe
  C:\Windows\System\voHpdsZ.exe
  2⤵
  PID:2424
- C:\Windows\System\RAuXltk.exe
  C:\Windows\System\RAuXltk.exe
  2⤵
  PID:3660
- C:\Windows\System\RFAMSXx.exe
  C:\Windows\System\RFAMSXx.exe
  2⤵
  PID:4228
- C:\Windows\System\ySCzoKZ.exe
  C:\Windows\System\ySCzoKZ.exe
  2⤵
  PID:5016
- C:\Windows\System\FFHaJlz.exe
  C:\Windows\System\FFHaJlz.exe
  2⤵
  PID:4084
- C:\Windows\System\lWVbZGk.exe
  C:\Windows\System\lWVbZGk.exe
  2⤵
  PID:4280
- C:\Windows\System\xbdnsxz.exe
  C:\Windows\System\xbdnsxz.exe
  2⤵
  PID:4392
- C:\Windows\System\YGaOsvi.exe
  C:\Windows\System\YGaOsvi.exe
  2⤵
  PID:4296
- C:\Windows\System\PqCUydX.exe
  C:\Windows\System\PqCUydX.exe
  2⤵
  PID:5024
- C:\Windows\System\SoIfGBL.exe
  C:\Windows\System\SoIfGBL.exe
  2⤵
  PID:4488
- C:\Windows\System\vrwHOHv.exe
  C:\Windows\System\vrwHOHv.exe
  2⤵
  PID:4576
- C:\Windows\System\lQeWfkD.exe
  C:\Windows\System\lQeWfkD.exe
  2⤵
  PID:4608
- C:\Windows\System\PabSssV.exe
  C:\Windows\System\PabSssV.exe
  2⤵
  PID:4764
- C:\Windows\System\EZOPnrm.exe
  C:\Windows\System\EZOPnrm.exe
  2⤵
  PID:3760
- C:\Windows\System\UlDHOrj.exe
  C:\Windows\System\UlDHOrj.exe
  2⤵
  PID:4312
- C:\Windows\System\iNBSqDq.exe
  C:\Windows\System\iNBSqDq.exe
  2⤵
  PID:3280
- C:\Windows\System\JmJJnVo.exe
  C:\Windows\System\JmJJnVo.exe
  2⤵
  PID:3720
- C:\Windows\System\KNxJkmg.exe
  C:\Windows\System\KNxJkmg.exe
  2⤵
  PID:4560
- C:\Windows\System\ARHunzD.exe
  C:\Windows\System\ARHunzD.exe
  2⤵
  PID:4440
- C:\Windows\System\MIuCjXl.exe
  C:\Windows\System\MIuCjXl.exe
  2⤵
  PID:2132
- C:\Windows\System\cUFnFpW.exe
  C:\Windows\System\cUFnFpW.exe
  2⤵
  PID:4868
- C:\Windows\System\dvjzmTV.exe
  C:\Windows\System\dvjzmTV.exe
  2⤵
  PID:5116
- C:\Windows\System\SVrxipS.exe
  C:\Windows\System\SVrxipS.exe
  2⤵
  PID:4852
- C:\Windows\System\SovuokU.exe
  C:\Windows\System\SovuokU.exe
  2⤵
  PID:1292
- C:\Windows\System\LuSTaRy.exe
  C:\Windows\System\LuSTaRy.exe
  2⤵
  PID:4752
- C:\Windows\System\uxerSHu.exe
  C:\Windows\System\uxerSHu.exe
  2⤵
  PID:4268
- C:\Windows\System\WFHKvov.exe
  C:\Windows\System\WFHKvov.exe
  2⤵
  PID:4548
- C:\Windows\System\FiHONQY.exe
  C:\Windows\System\FiHONQY.exe
  2⤵
  PID:4624
- C:\Windows\System\UNmjsyG.exe
  C:\Windows\System\UNmjsyG.exe
  2⤵
  PID:5136
- C:\Windows\System\vYLRkKP.exe
  C:\Windows\System\vYLRkKP.exe
  2⤵
  PID:5152
- C:\Windows\System\bcBqrSZ.exe
  C:\Windows\System\bcBqrSZ.exe
  2⤵
  PID:5168
- C:\Windows\System\oyterdm.exe
  C:\Windows\System\oyterdm.exe
  2⤵
  PID:5188
- C:\Windows\System\WcXoJqA.exe
  C:\Windows\System\WcXoJqA.exe
  2⤵
  PID:5204
- C:\Windows\System\OuTwCGB.exe
  C:\Windows\System\OuTwCGB.exe
  2⤵
  PID:5220
- C:\Windows\System\XKGnSfz.exe
  C:\Windows\System\XKGnSfz.exe
  2⤵
  PID:5236
- C:\Windows\System\HcQUTEZ.exe
  C:\Windows\System\HcQUTEZ.exe
  2⤵
  PID:5252
- C:\Windows\System\RnTcTiT.exe
  C:\Windows\System\RnTcTiT.exe
  2⤵
  PID:5268
- C:\Windows\System\aYoiHAJ.exe
  C:\Windows\System\aYoiHAJ.exe
  2⤵
  PID:5288
- C:\Windows\System\IcmHFWK.exe
  C:\Windows\System\IcmHFWK.exe
  2⤵
  PID:5304
- C:\Windows\System\LjRcCzq.exe
  C:\Windows\System\LjRcCzq.exe
  2⤵
  PID:5320
- C:\Windows\System\dpWWMlW.exe
  C:\Windows\System\dpWWMlW.exe
  2⤵
  PID:5336
- C:\Windows\System\BnPAnnp.exe
  C:\Windows\System\BnPAnnp.exe
  2⤵
  PID:5352
- C:\Windows\System\DqlWxJm.exe
  C:\Windows\System\DqlWxJm.exe
  2⤵
  PID:5372
- C:\Windows\System\xUubwIk.exe
  C:\Windows\System\xUubwIk.exe
  2⤵
  PID:5388
- C:\Windows\System\LRAFvcP.exe
  C:\Windows\System\LRAFvcP.exe
  2⤵
  PID:5404
- C:\Windows\System\yrJSpCJ.exe
  C:\Windows\System\yrJSpCJ.exe
  2⤵
  PID:5420
- C:\Windows\System\ynqzYkv.exe
  C:\Windows\System\ynqzYkv.exe
  2⤵
  PID:5436
- C:\Windows\System\nXhvTld.exe
  C:\Windows\System\nXhvTld.exe
  2⤵
  PID:5456
- C:\Windows\System\GfEcWfa.exe
  C:\Windows\System\GfEcWfa.exe
  2⤵
  PID:5472
- C:\Windows\System\rtzImyZ.exe
  C:\Windows\System\rtzImyZ.exe
  2⤵
  PID:5572
- C:\Windows\System\WATNUuN.exe
  C:\Windows\System\WATNUuN.exe
  2⤵
  PID:5592
- C:\Windows\System\RKIaHCI.exe
  C:\Windows\System\RKIaHCI.exe
  2⤵
  PID:5612
- C:\Windows\System\PAGNzRW.exe
  C:\Windows\System\PAGNzRW.exe
  2⤵
  PID:5628
- C:\Windows\System\nrdxJLs.exe
  C:\Windows\System\nrdxJLs.exe
  2⤵
  PID:5644
- C:\Windows\System\TtaJGZd.exe
  C:\Windows\System\TtaJGZd.exe
  2⤵
  PID:5660
- C:\Windows\System\kaAjPdp.exe
  C:\Windows\System\kaAjPdp.exe
  2⤵
  PID:5676
- C:\Windows\System\ynzqtvK.exe
  C:\Windows\System\ynzqtvK.exe
  2⤵
  PID:5692
- C:\Windows\System\fObRbGR.exe
  C:\Windows\System\fObRbGR.exe
  2⤵
  PID:5712
- C:\Windows\System\SePtEbc.exe
  C:\Windows\System\SePtEbc.exe
  2⤵
  PID:5728
- C:\Windows\System\xgJGcYK.exe
  C:\Windows\System\xgJGcYK.exe
  2⤵
  PID:5744
- C:\Windows\System\EVVFsOJ.exe
  C:\Windows\System\EVVFsOJ.exe
  2⤵
  PID:5760
- C:\Windows\System\EGNpoKE.exe
  C:\Windows\System\EGNpoKE.exe
  2⤵
  PID:5776
- C:\Windows\System\qeBCnZR.exe
  C:\Windows\System\qeBCnZR.exe
  2⤵
  PID:5796
- C:\Windows\System\AQBZsVo.exe
  C:\Windows\System\AQBZsVo.exe
  2⤵
  PID:5812
- C:\Windows\System\vjRcpDR.exe
  C:\Windows\System\vjRcpDR.exe
  2⤵
  PID:5828
- C:\Windows\System\SIFAhbE.exe
  C:\Windows\System\SIFAhbE.exe
  2⤵
  PID:5844
- C:\Windows\System\vGSJHAV.exe
  C:\Windows\System\vGSJHAV.exe
  2⤵
  PID:5860
- C:\Windows\System\VrrlCZJ.exe
  C:\Windows\System\VrrlCZJ.exe
  2⤵
  PID:5880
- C:\Windows\System\UqnbmRo.exe
  C:\Windows\System\UqnbmRo.exe
  2⤵
  PID:5896
- C:\Windows\System\tJATnlt.exe
  C:\Windows\System\tJATnlt.exe
  2⤵
  PID:5912
- C:\Windows\System\pWyFrNd.exe
  C:\Windows\System\pWyFrNd.exe
  2⤵
  PID:5928
- C:\Windows\System\uQcdXyp.exe
  C:\Windows\System\uQcdXyp.exe
  2⤵
  PID:5944
- C:\Windows\System\GbtyfRY.exe
  C:\Windows\System\GbtyfRY.exe
  2⤵
  PID:5960
- C:\Windows\System\TEhDbDx.exe
  C:\Windows\System\TEhDbDx.exe
  2⤵
  PID:5980
- C:\Windows\System\DoYAjhZ.exe
  C:\Windows\System\DoYAjhZ.exe
  2⤵
  PID:5996
- C:\Windows\System\EKheOgj.exe
  C:\Windows\System\EKheOgj.exe
  2⤵
  PID:6024
- C:\Windows\System\dWKykek.exe
  C:\Windows\System\dWKykek.exe
  2⤵
  PID:6044
- C:\Windows\System\fvwmuge.exe
  C:\Windows\System\fvwmuge.exe
  2⤵
  PID:6068
- C:\Windows\System\ISKTSze.exe
  C:\Windows\System\ISKTSze.exe
  2⤵
  PID:6084
- C:\Windows\System\GMOiQnX.exe
  C:\Windows\System\GMOiQnX.exe
  2⤵
  PID:6104
- C:\Windows\System\YkDqoOm.exe
  C:\Windows\System\YkDqoOm.exe
  2⤵
  PID:6120
- C:\Windows\System\ePfteDe.exe
  C:\Windows\System\ePfteDe.exe
  2⤵
  PID:4444
- C:\Windows\System\zcCRrbq.exe
  C:\Windows\System\zcCRrbq.exe
  2⤵
  PID:1216
- C:\Windows\System\RvpJuRV.exe
  C:\Windows\System\RvpJuRV.exe
  2⤵
  PID:4932
- C:\Windows\System\nfydVoX.exe
  C:\Windows\System\nfydVoX.exe
  2⤵
  PID:3840
- C:\Windows\System\cgyguMQ.exe
  C:\Windows\System\cgyguMQ.exe
  2⤵
  PID:5032
- C:\Windows\System\AiuLspI.exe
  C:\Windows\System\AiuLspI.exe
  2⤵
  PID:3180
- C:\Windows\System\JxPQHnv.exe
  C:\Windows\System\JxPQHnv.exe
  2⤵
  PID:4424
- C:\Windows\System\momRkuJ.exe
  C:\Windows\System\momRkuJ.exe
  2⤵
  PID:1204
- C:\Windows\System\hbtjvDk.exe
  C:\Windows\System\hbtjvDk.exe
  2⤵
  PID:4732
- C:\Windows\System\yvzYqYX.exe
  C:\Windows\System\yvzYqYX.exe
  2⤵
  PID:5180
- C:\Windows\System\CmWsigG.exe
  C:\Windows\System\CmWsigG.exe
  2⤵
  PID:5012
- C:\Windows\System\LFHqlkK.exe
  C:\Windows\System\LFHqlkK.exe
  2⤵
  PID:4632
- C:\Windows\System\oTtsYZk.exe
  C:\Windows\System\oTtsYZk.exe
  2⤵
  PID:4796
- C:\Windows\System\bQNVBHP.exe
  C:\Windows\System\bQNVBHP.exe
  2⤵
  PID:5000
- C:\Windows\System\bAxpemg.exe
  C:\Windows\System\bAxpemg.exe
  2⤵
  PID:5284
- C:\Windows\System\yHOhtde.exe
  C:\Windows\System\yHOhtde.exe
  2⤵
  PID:5312
- C:\Windows\System\bpTsjoq.exe
  C:\Windows\System\bpTsjoq.exe
  2⤵
  PID:5384
- C:\Windows\System\AVrxQYb.exe
  C:\Windows\System\AVrxQYb.exe
  2⤵
  PID:5480
- C:\Windows\System\AXAGJaw.exe
  C:\Windows\System\AXAGJaw.exe
  2⤵
  PID:5504
- C:\Windows\System\OnzuvSU.exe
  C:\Windows\System\OnzuvSU.exe
  2⤵
  PID:5516
- C:\Windows\System\nwZKzcY.exe
  C:\Windows\System\nwZKzcY.exe
  2⤵
  PID:5528
- C:\Windows\System\ZrAngCJ.exe
  C:\Windows\System\ZrAngCJ.exe
  2⤵
  PID:5544
- C:\Windows\System\puFPDgT.exe
  C:\Windows\System\puFPDgT.exe
  2⤵
  PID:5280
- C:\Windows\System\ygopfpH.exe
  C:\Windows\System\ygopfpH.exe
  2⤵
  PID:5468
- C:\Windows\System\UUGwgkS.exe
  C:\Windows\System\UUGwgkS.exe
  2⤵
  PID:4812
- C:\Windows\System\gYHTZBa.exe
  C:\Windows\System\gYHTZBa.exe
  2⤵
  PID:5604
- C:\Windows\System\waeqlNO.exe
  C:\Windows\System\waeqlNO.exe
  2⤵
  PID:5672
- C:\Windows\System\GZxsmsZ.exe
  C:\Windows\System\GZxsmsZ.exe
  2⤵
  PID:5708
- C:\Windows\System\AAPfUMl.exe
  C:\Windows\System\AAPfUMl.exe
  2⤵
  PID:5232
- C:\Windows\System\IJrbiLd.exe
  C:\Windows\System\IJrbiLd.exe
  2⤵
  PID:5300
- C:\Windows\System\GkCvOJi.exe
  C:\Windows\System\GkCvOJi.exe
  2⤵
  PID:5368
- C:\Windows\System\FdmzVWK.exe
  C:\Windows\System\FdmzVWK.exe
  2⤵
  PID:5432
- C:\Windows\System\YPeehPA.exe
  C:\Windows\System\YPeehPA.exe
  2⤵
  PID:5808
- C:\Windows\System\jOldQGB.exe
  C:\Windows\System\jOldQGB.exe
  2⤵
  PID:5936
- C:\Windows\System\MnmSdaY.exe
  C:\Windows\System\MnmSdaY.exe
  2⤵
  PID:5872
- C:\Windows\System\FeTxnHz.exe
  C:\Windows\System\FeTxnHz.exe
  2⤵
  PID:6020
- C:\Windows\System\YVeKAte.exe
  C:\Windows\System\YVeKAte.exe
  2⤵
  PID:5988
- C:\Windows\System\ZyVZFGN.exe
  C:\Windows\System\ZyVZFGN.exe
  2⤵
  PID:5584
- C:\Windows\System\UVhtrqe.exe
  C:\Windows\System\UVhtrqe.exe
  2⤵
  PID:5624
- C:\Windows\System\raOQDrJ.exe
  C:\Windows\System\raOQDrJ.exe
  2⤵
  PID:5688
- C:\Windows\System\MFkmwCf.exe
  C:\Windows\System\MFkmwCf.exe
  2⤵
  PID:5784
- C:\Windows\System\fBBeeNj.exe
  C:\Windows\System\fBBeeNj.exe
  2⤵
  PID:5840
- C:\Windows\System\UdkySYy.exe
  C:\Windows\System\UdkySYy.exe
  2⤵
  PID:5892
- C:\Windows\System\JZLmzvj.exe
  C:\Windows\System\JZLmzvj.exe
  2⤵
  PID:5836
- C:\Windows\System\BHOSEYd.exe
  C:\Windows\System\BHOSEYd.exe
  2⤵
  PID:6064
- C:\Windows\System\cUTGsYf.exe
  C:\Windows\System\cUTGsYf.exe
  2⤵
  PID:6128
- C:\Windows\System\xiVKvBK.exe
  C:\Windows\System\xiVKvBK.exe
  2⤵
  PID:4300
- C:\Windows\System\iVxPTWp.exe
  C:\Windows\System\iVxPTWp.exe
  2⤵
  PID:4828
- C:\Windows\System\QmFKsGA.exe
  C:\Windows\System\QmFKsGA.exe
  2⤵
  PID:4808
- C:\Windows\System\XAaQRFa.exe
  C:\Windows\System\XAaQRFa.exe
  2⤵
  PID:5216
- C:\Windows\System\AMSIjBL.exe
  C:\Windows\System\AMSIjBL.exe
  2⤵
  PID:5276
- C:\Windows\System\JpjifAO.exe
  C:\Windows\System\JpjifAO.exe
  2⤵
  PID:5500
- C:\Windows\System\Xymnabj.exe
  C:\Windows\System\Xymnabj.exe
  2⤵
  PID:5448
- C:\Windows\System\aNMPLBa.exe
  C:\Windows\System\aNMPLBa.exe
  2⤵
  PID:5488
- C:\Windows\System\ajCHxpR.exe
  C:\Windows\System\ajCHxpR.exe
  2⤵
  PID:4816
- C:\Windows\System\lASxVkE.exe
  C:\Windows\System\lASxVkE.exe
  2⤵
  PID:5600
- C:\Windows\System\QHbrmPR.exe
  C:\Windows\System\QHbrmPR.exe
  2⤵
  PID:5160
- C:\Windows\System\urDXtbH.exe
  C:\Windows\System\urDXtbH.exe
  2⤵
  PID:5508
- C:\Windows\System\DLePEpD.exe
  C:\Windows\System\DLePEpD.exe
  2⤵
  PID:4804
- C:\Windows\System\FMZIqFR.exe
  C:\Windows\System\FMZIqFR.exe
  2⤵
  PID:3152
- C:\Windows\System\gDGABdG.exe
  C:\Windows\System\gDGABdG.exe
  2⤵
  PID:4412
- C:\Windows\System\tVCwLlp.exe
  C:\Windows\System\tVCwLlp.exe
  2⤵
  PID:5176
- C:\Windows\System\AoHQnmt.exe
  C:\Windows\System\AoHQnmt.exe
  2⤵
  PID:3248
- C:\Windows\System\OOaHUWw.exe
  C:\Windows\System\OOaHUWw.exe
  2⤵
  PID:5536
- C:\Windows\System\jJDNqyr.exe
  C:\Windows\System\jJDNqyr.exe
  2⤵
  PID:5360
- C:\Windows\System\XRvuEGO.exe
  C:\Windows\System\XRvuEGO.exe
  2⤵
  PID:5196
- C:\Windows\System\KqWxTcF.exe
  C:\Windows\System\KqWxTcF.exe
  2⤵
  PID:5772
- C:\Windows\System\IMmjdmY.exe
  C:\Windows\System\IMmjdmY.exe
  2⤵
  PID:6012
- C:\Windows\System\amcUfQJ.exe
  C:\Windows\System\amcUfQJ.exe
  2⤵
  PID:5400
- C:\Windows\System\qJFaELt.exe
  C:\Windows\System\qJFaELt.exe
  2⤵
  PID:5976
- C:\Windows\System\mEaFNWb.exe
  C:\Windows\System\mEaFNWb.exe
  2⤵
  PID:5656
- C:\Windows\System\lQjztlM.exe
  C:\Windows\System\lQjztlM.exe
  2⤵
  PID:5752
- C:\Windows\System\QglRzet.exe
  C:\Windows\System\QglRzet.exe
  2⤵
  PID:5824
- C:\Windows\System\rjWcGjE.exe
  C:\Windows\System\rjWcGjE.exe
  2⤵
  PID:3512
- C:\Windows\System\VbuoFdk.exe
  C:\Windows\System\VbuoFdk.exe
  2⤵
  PID:4588
- C:\Windows\System\FSfaCWb.exe
  C:\Windows\System\FSfaCWb.exe
  2⤵
  PID:5956
- C:\Windows\System\rXBeEbu.exe
  C:\Windows\System\rXBeEbu.exe
  2⤵
  PID:5344
- C:\Windows\System\IghRBpU.exe
  C:\Windows\System\IghRBpU.exe
  2⤵
  PID:5212
- C:\Windows\System\rJcPOKf.exe
  C:\Windows\System\rJcPOKf.exe
  2⤵
  PID:4476
- C:\Windows\System\FimrAuU.exe
  C:\Windows\System\FimrAuU.exe
  2⤵
  PID:5132
- C:\Windows\System\oIDsrsk.exe
  C:\Windows\System\oIDsrsk.exe
  2⤵
  PID:5416
- C:\Windows\System\zeDWJlh.exe
  C:\Windows\System\zeDWJlh.exe
  2⤵
  PID:3672
- C:\Windows\System\puFBQSS.exe
  C:\Windows\System\puFBQSS.exe
  2⤵
  PID:4648
- C:\Windows\System\ysOnQlD.exe
  C:\Windows\System\ysOnQlD.exe
  2⤵
  PID:5332
- C:\Windows\System\OKxNkch.exe
  C:\Windows\System\OKxNkch.exe
  2⤵
  PID:5444
- C:\Windows\System\SefUynM.exe
  C:\Windows\System\SefUynM.exe
  2⤵
  PID:6008
- C:\Windows\System\SbAAjZu.exe
  C:\Windows\System\SbAAjZu.exe
  2⤵
  PID:6132
- C:\Windows\System\TKAgMGf.exe
  C:\Windows\System\TKAgMGf.exe
  2⤵
  PID:5560
- C:\Windows\System\DKHNuma.exe
  C:\Windows\System\DKHNuma.exe
  2⤵
  PID:4736
- C:\Windows\System\wwcJggA.exe
  C:\Windows\System\wwcJggA.exe
  2⤵
  PID:5552
- C:\Windows\System\LPPlQwg.exe
  C:\Windows\System\LPPlQwg.exe
  2⤵
  PID:5968
- C:\Windows\System\nERWdcg.exe
  C:\Windows\System\nERWdcg.exe
  2⤵
  PID:4920
- C:\Windows\System\YvUSshy.exe
  C:\Windows\System\YvUSshy.exe
  2⤵
  PID:5264
- C:\Windows\System\jHagvUb.exe
  C:\Windows\System\jHagvUb.exe
  2⤵
  PID:6116
- C:\Windows\System\rfxnAMY.exe
  C:\Windows\System\rfxnAMY.exe
  2⤵
  PID:5820
- C:\Windows\System\QHhHdyd.exe
  C:\Windows\System\QHhHdyd.exe
  2⤵
  PID:5952
- C:\Windows\System\wUihuGH.exe
  C:\Windows\System\wUihuGH.exe
  2⤵
  PID:5904
- C:\Windows\System\CiCvBFa.exe
  C:\Windows\System\CiCvBFa.exe
  2⤵
  PID:4872
- C:\Windows\System\EUymWYn.exe
  C:\Windows\System\EUymWYn.exe
  2⤵
  PID:4532
- C:\Windows\System\pKmnvFJ.exe
  C:\Windows\System\pKmnvFJ.exe
  2⤵
  PID:5620
- C:\Windows\System\OkmhPPB.exe
  C:\Windows\System\OkmhPPB.exe
  2⤵
  PID:5668
- C:\Windows\System\rVuiyBj.exe
  C:\Windows\System\rVuiyBj.exe
  2⤵
  PID:5724
- C:\Windows\System\GVGkIvF.exe
  C:\Windows\System\GVGkIvF.exe
  2⤵
  PID:6156
- C:\Windows\System\IktWLxE.exe
  C:\Windows\System\IktWLxE.exe
  2⤵
  PID:6172
- C:\Windows\System\VEDAbnI.exe
  C:\Windows\System\VEDAbnI.exe
  2⤵
  PID:6188
- C:\Windows\System\SWVNPSO.exe
  C:\Windows\System\SWVNPSO.exe
  2⤵
  PID:6204
- C:\Windows\System\mJUsKyV.exe
  C:\Windows\System\mJUsKyV.exe
  2⤵
  PID:6220
- C:\Windows\System\HntODPb.exe
  C:\Windows\System\HntODPb.exe
  2⤵
  PID:6236
- C:\Windows\System\HmmAAWI.exe
  C:\Windows\System\HmmAAWI.exe
  2⤵
  PID:6252
- C:\Windows\System\Dquujpk.exe
  C:\Windows\System\Dquujpk.exe
  2⤵
  PID:6268
- C:\Windows\System\lxHNula.exe
  C:\Windows\System\lxHNula.exe
  2⤵
  PID:6292
- C:\Windows\System\CsZLHID.exe
  C:\Windows\System\CsZLHID.exe
  2⤵
  PID:6308
- C:\Windows\System\VleVkum.exe
  C:\Windows\System\VleVkum.exe
  2⤵
  PID:6324
- C:\Windows\System\JgWqytI.exe
  C:\Windows\System\JgWqytI.exe
  2⤵
  PID:6340
- C:\Windows\System\IoKrZsh.exe
  C:\Windows\System\IoKrZsh.exe
  2⤵
  PID:6356
- C:\Windows\System\slpEgLK.exe
  C:\Windows\System\slpEgLK.exe
  2⤵
  PID:6372
- C:\Windows\System\HoIgVAX.exe
  C:\Windows\System\HoIgVAX.exe
  2⤵
  PID:6388
- C:\Windows\System\rgUatIr.exe
  C:\Windows\System\rgUatIr.exe
  2⤵
  PID:6404
- C:\Windows\System\PFqPgbK.exe
  C:\Windows\System\PFqPgbK.exe
  2⤵
  PID:6420
- C:\Windows\System\AcIhtkb.exe
  C:\Windows\System\AcIhtkb.exe
  2⤵
  PID:6436
- C:\Windows\System\VfugIlR.exe
  C:\Windows\System\VfugIlR.exe
  2⤵
  PID:6452
- C:\Windows\System\GnmViwz.exe
  C:\Windows\System\GnmViwz.exe
  2⤵
  PID:6468
- C:\Windows\System\eQnsIEN.exe
  C:\Windows\System\eQnsIEN.exe
  2⤵
  PID:6484
- C:\Windows\System\jfitDnS.exe
  C:\Windows\System\jfitDnS.exe
  2⤵
  PID:6500
- C:\Windows\System\LEXAoSE.exe
  C:\Windows\System\LEXAoSE.exe
  2⤵
  PID:6516
- C:\Windows\System\yVXBuki.exe
  C:\Windows\System\yVXBuki.exe
  2⤵
  PID:6532
- C:\Windows\System\QyOcxFY.exe
  C:\Windows\System\QyOcxFY.exe
  2⤵
  PID:6548
- C:\Windows\System\NvtptTY.exe
  C:\Windows\System\NvtptTY.exe
  2⤵
  PID:6564
- C:\Windows\System\fGnmEKg.exe
  C:\Windows\System\fGnmEKg.exe
  2⤵
  PID:6588
- C:\Windows\System\VDchRmw.exe
  C:\Windows\System\VDchRmw.exe
  2⤵
  PID:6604
- C:\Windows\System\wYEJmID.exe
  C:\Windows\System\wYEJmID.exe
  2⤵
  PID:6620
- C:\Windows\System\IvpThPT.exe
  C:\Windows\System\IvpThPT.exe
  2⤵
  PID:6636
- C:\Windows\System\hOqyIfX.exe
  C:\Windows\System\hOqyIfX.exe
  2⤵
  PID:6652
- C:\Windows\System\kxudenB.exe
  C:\Windows\System\kxudenB.exe
  2⤵
  PID:6680
- C:\Windows\System\RdVkMpV.exe
  C:\Windows\System\RdVkMpV.exe
  2⤵
  PID:6696
- C:\Windows\System\sRJGEmX.exe
  C:\Windows\System\sRJGEmX.exe
  2⤵
  PID:6712
- C:\Windows\System\AlzjSCy.exe
  C:\Windows\System\AlzjSCy.exe
  2⤵
  PID:6728
- C:\Windows\System\DJAWleK.exe
  C:\Windows\System\DJAWleK.exe
  2⤵
  PID:6768
- C:\Windows\System\jXbXCIU.exe
  C:\Windows\System\jXbXCIU.exe
  2⤵
  PID:6784
- C:\Windows\System\ooaiogo.exe
  C:\Windows\System\ooaiogo.exe
  2⤵
  PID:6800
- C:\Windows\System\VkgqoZF.exe
  C:\Windows\System\VkgqoZF.exe
  2⤵
  PID:6816
- C:\Windows\System\RrzZGtl.exe
  C:\Windows\System\RrzZGtl.exe
  2⤵
  PID:6840
- C:\Windows\System\GHWPhur.exe
  C:\Windows\System\GHWPhur.exe
  2⤵
  PID:6860
- C:\Windows\System\BgbJZUU.exe
  C:\Windows\System\BgbJZUU.exe
  2⤵
  PID:6876
- C:\Windows\System\OGlVcBc.exe
  C:\Windows\System\OGlVcBc.exe
  2⤵
  PID:6896
- C:\Windows\System\MZzJDVs.exe
  C:\Windows\System\MZzJDVs.exe
  2⤵
  PID:6912
- C:\Windows\System\DEgBurv.exe
  C:\Windows\System\DEgBurv.exe
  2⤵
  PID:6928
- C:\Windows\System\NoAapPP.exe
  C:\Windows\System\NoAapPP.exe
  2⤵
  PID:6944
- C:\Windows\System\fRgydXP.exe
  C:\Windows\System\fRgydXP.exe
  2⤵
  PID:6960
- C:\Windows\System\ngraVXC.exe
  C:\Windows\System\ngraVXC.exe
  2⤵
  PID:6976
- C:\Windows\System\xFqUQRO.exe
  C:\Windows\System\xFqUQRO.exe
  2⤵
  PID:6996
- C:\Windows\System\YBkcwBu.exe
  C:\Windows\System\YBkcwBu.exe
  2⤵
  PID:7012
- C:\Windows\System\CSIKzva.exe
  C:\Windows\System\CSIKzva.exe
  2⤵
  PID:7028
- C:\Windows\System\dJALcLO.exe
  C:\Windows\System\dJALcLO.exe
  2⤵
  PID:7044
- C:\Windows\System\zMlZdAY.exe
  C:\Windows\System\zMlZdAY.exe
  2⤵
  PID:7060
- C:\Windows\System\fssawQo.exe
  C:\Windows\System\fssawQo.exe
  2⤵
  PID:7080
- C:\Windows\System\KrNwfeB.exe
  C:\Windows\System\KrNwfeB.exe
  2⤵
  PID:7096
- C:\Windows\System\ikiKVqY.exe
  C:\Windows\System\ikiKVqY.exe
  2⤵
  PID:7112
- C:\Windows\System\DMoFyLQ.exe
  C:\Windows\System\DMoFyLQ.exe
  2⤵
  PID:7132
- C:\Windows\System\bAurgsb.exe
  C:\Windows\System\bAurgsb.exe
  2⤵
  PID:7148
- C:\Windows\System\wazoejl.exe
  C:\Windows\System\wazoejl.exe
  2⤵
  PID:6148
- C:\Windows\System\sPGUeQU.exe
  C:\Windows\System\sPGUeQU.exe
  2⤵
  PID:6216
- C:\Windows\System\vcCLUMF.exe
  C:\Windows\System\vcCLUMF.exe
  2⤵
  PID:5464
- C:\Windows\System\EQZMLmE.exe
  C:\Windows\System\EQZMLmE.exe
  2⤵
  PID:6232
- C:\Windows\System\HoofOIS.exe
  C:\Windows\System\HoofOIS.exe
  2⤵
  PID:6228
- C:\Windows\System\dNTDpuh.exe
  C:\Windows\System\dNTDpuh.exe
  2⤵
  PID:6284
- C:\Windows\System\XeaDZrp.exe
  C:\Windows\System\XeaDZrp.exe
  2⤵
  PID:6348
- C:\Windows\System\BmGFVAZ.exe
  C:\Windows\System\BmGFVAZ.exe
  2⤵
  PID:6332
- C:\Windows\System\ffLucac.exe
  C:\Windows\System\ffLucac.exe
  2⤵
  PID:6396
- C:\Windows\System\HUhXJfv.exe
  C:\Windows\System\HUhXJfv.exe
  2⤵
  PID:6384
- C:\Windows\System\okOqBdH.exe
  C:\Windows\System\okOqBdH.exe
  2⤵
  PID:6432
- C:\Windows\System\wuOtGXr.exe
  C:\Windows\System\wuOtGXr.exe
  2⤵
  PID:6476
- C:\Windows\System\MmNSZQr.exe
  C:\Windows\System\MmNSZQr.exe
  2⤵
  PID:6508
- C:\Windows\System\yTXzQcb.exe
  C:\Windows\System\yTXzQcb.exe
  2⤵
  PID:6544
- C:\Windows\System\zSRnWFv.exe
  C:\Windows\System\zSRnWFv.exe
  2⤵
  PID:6560
- C:\Windows\System\aCTUNHN.exe
  C:\Windows\System\aCTUNHN.exe
  2⤵
  PID:6632
- C:\Windows\System\uXIIDtA.exe
  C:\Windows\System\uXIIDtA.exe
  2⤵
  PID:6704
- C:\Windows\System\VCVHkFH.exe
  C:\Windows\System\VCVHkFH.exe
  2⤵
  PID:6664
- C:\Windows\System\jkbTSMS.exe
  C:\Windows\System\jkbTSMS.exe
  2⤵
  PID:6752
- C:\Windows\System\ZPvBltS.exe
  C:\Windows\System\ZPvBltS.exe
  2⤵
  PID:6764
- C:\Windows\System\RgxxAiT.exe
  C:\Windows\System\RgxxAiT.exe
  2⤵
  PID:6644
- C:\Windows\System\seQOGMm.exe
  C:\Windows\System\seQOGMm.exe
  2⤵
  PID:6720
- C:\Windows\System\LLebntQ.exe
  C:\Windows\System\LLebntQ.exe
  2⤵
  PID:6808
- C:\Windows\System\nwrhgKW.exe
  C:\Windows\System\nwrhgKW.exe
  2⤵
  PID:6832
- C:\Windows\System\mluyIUA.exe
  C:\Windows\System\mluyIUA.exe
  2⤵
  PID:6828
- C:\Windows\System\FlvuslM.exe
  C:\Windows\System\FlvuslM.exe
  2⤵
  PID:6872
- C:\Windows\System\dtCnSZH.exe
  C:\Windows\System\dtCnSZH.exe
  2⤵
  PID:6884
- C:\Windows\System\PUbMYER.exe
  C:\Windows\System\PUbMYER.exe
  2⤵
  PID:6924
- C:\Windows\System\IPXgXvv.exe
  C:\Windows\System\IPXgXvv.exe
  2⤵
  PID:6952
- C:\Windows\System\nUiXcpD.exe
  C:\Windows\System\nUiXcpD.exe
  2⤵
  PID:6992
- C:\Windows\System\bhwMMAQ.exe
  C:\Windows\System\bhwMMAQ.exe
  2⤵
  PID:7008
- C:\Windows\System\QkicVJE.exe
  C:\Windows\System\QkicVJE.exe
  2⤵
  PID:7036
- C:\Windows\System\EHRjcvL.exe
  C:\Windows\System\EHRjcvL.exe
  2⤵
  PID:7128
- C:\Windows\System\GzAbtpi.exe
  C:\Windows\System\GzAbtpi.exe
  2⤵
  PID:6276
- C:\Windows\System\lqrqDfI.exe
  C:\Windows\System\lqrqDfI.exe
  2⤵
  PID:6320
- C:\Windows\System\aPblFNW.exe
  C:\Windows\System\aPblFNW.exe
  2⤵
  PID:6464
- C:\Windows\System\nberlyG.exe
  C:\Windows\System\nberlyG.exe
  2⤵
  PID:6556
- C:\Windows\System\WsAluEo.exe
  C:\Windows\System\WsAluEo.exe
  2⤵
  PID:6748
- C:\Windows\System\DrqCnfz.exe
  C:\Windows\System\DrqCnfz.exe
  2⤵
  PID:6780
- C:\Windows\System\XZIpVwE.exe
  C:\Windows\System\XZIpVwE.exe
  2⤵
  PID:6856
- C:\Windows\System\DidiKvS.exe
  C:\Windows\System\DidiKvS.exe
  2⤵
  PID:7040
- C:\Windows\System\BsZUtlq.exe
  C:\Windows\System\BsZUtlq.exe
  2⤵
  PID:7124
- C:\Windows\System\BipwqIM.exe
  C:\Windows\System\BipwqIM.exe
  2⤵
  PID:6280
- C:\Windows\System\uRtklyz.exe
  C:\Windows\System\uRtklyz.exe
  2⤵
  PID:7004
- C:\Windows\System\tsHgJqW.exe
  C:\Windows\System\tsHgJqW.exe
  2⤵
  PID:7172
- C:\Windows\System\ySKeLiE.exe
  C:\Windows\System\ySKeLiE.exe
  2⤵
  PID:7188
- C:\Windows\System\rHjCduZ.exe
  C:\Windows\System\rHjCduZ.exe
  2⤵
  PID:7204
- C:\Windows\System\RRNnJhz.exe
  C:\Windows\System\RRNnJhz.exe
  2⤵
  PID:7220
- C:\Windows\System\bEgqgwj.exe
  C:\Windows\System\bEgqgwj.exe
  2⤵
  PID:7236
- C:\Windows\System\bpJXZZz.exe
  C:\Windows\System\bpJXZZz.exe
  2⤵
  PID:7252
- C:\Windows\System\IdDVqis.exe
  C:\Windows\System\IdDVqis.exe
  2⤵
  PID:7268
- C:\Windows\System\pIlhOpX.exe
  C:\Windows\System\pIlhOpX.exe
  2⤵
  PID:7284
- C:\Windows\System\HVOCefT.exe
  C:\Windows\System\HVOCefT.exe
  2⤵
  PID:7304
- C:\Windows\System\cGwETjn.exe
  C:\Windows\System\cGwETjn.exe
  2⤵
  PID:7320
- C:\Windows\System\KtPHdpy.exe
  C:\Windows\System\KtPHdpy.exe
  2⤵
  PID:7336
- C:\Windows\System\dfesWtQ.exe
  C:\Windows\System\dfesWtQ.exe
  2⤵
  PID:7352
- C:\Windows\System\xTjYehY.exe
  C:\Windows\System\xTjYehY.exe
  2⤵
  PID:7368
- C:\Windows\System\pMXbnpW.exe
  C:\Windows\System\pMXbnpW.exe
  2⤵
  PID:7384
- C:\Windows\System\mottXxn.exe
  C:\Windows\System\mottXxn.exe
  2⤵
  PID:7400
- C:\Windows\System\ImCUnbp.exe
  C:\Windows\System\ImCUnbp.exe
  2⤵
  PID:7416
- C:\Windows\System\eEckySc.exe
  C:\Windows\System\eEckySc.exe
  2⤵
  PID:7432
- C:\Windows\System\dpvkyut.exe
  C:\Windows\System\dpvkyut.exe
  2⤵
  PID:7448
- C:\Windows\System\siupBFR.exe
  C:\Windows\System\siupBFR.exe
  2⤵
  PID:7464
- C:\Windows\System\ygXQoHU.exe
  C:\Windows\System\ygXQoHU.exe
  2⤵
  PID:7480
- C:\Windows\System\hGVIfOG.exe
  C:\Windows\System\hGVIfOG.exe
  2⤵
  PID:7496
- C:\Windows\System\XJtTzvT.exe
  C:\Windows\System\XJtTzvT.exe
  2⤵
  PID:7512
- C:\Windows\System\jnoUYdq.exe
  C:\Windows\System\jnoUYdq.exe
  2⤵
  PID:7528
- C:\Windows\System\ZvfIrnE.exe
  C:\Windows\System\ZvfIrnE.exe
  2⤵
  PID:7544
- C:\Windows\System\iuaHBhz.exe
  C:\Windows\System\iuaHBhz.exe
  2⤵
  PID:7564
- C:\Windows\System\bwpaGky.exe
  C:\Windows\System\bwpaGky.exe
  2⤵
  PID:7580
- C:\Windows\System\FNdoGHi.exe
  C:\Windows\System\FNdoGHi.exe
  2⤵
  PID:7596
- C:\Windows\System\aQAFJdy.exe
  C:\Windows\System\aQAFJdy.exe
  2⤵
  PID:7612
- C:\Windows\System\USkZTiD.exe
  C:\Windows\System\USkZTiD.exe
  2⤵
  PID:7628
- C:\Windows\System\CxcYSYx.exe
  C:\Windows\System\CxcYSYx.exe
  2⤵
  PID:7644
- C:\Windows\System\WkkJpDc.exe
  C:\Windows\System\WkkJpDc.exe
  2⤵
  PID:7660
- C:\Windows\System\boKeFKp.exe
  C:\Windows\System\boKeFKp.exe
  2⤵
  PID:7676
- C:\Windows\System\XADyhRc.exe
  C:\Windows\System\XADyhRc.exe
  2⤵
  PID:7692
- C:\Windows\System\Jooobge.exe
  C:\Windows\System\Jooobge.exe
  2⤵
  PID:7708
- C:\Windows\System\bldbOhR.exe
  C:\Windows\System\bldbOhR.exe
  2⤵
  PID:7724
- C:\Windows\System\izmpZca.exe
  C:\Windows\System\izmpZca.exe
  2⤵
  PID:7740
- C:\Windows\System\okIccFt.exe
  C:\Windows\System\okIccFt.exe
  2⤵
  PID:7756
- C:\Windows\System\TlnKWVM.exe
  C:\Windows\System\TlnKWVM.exe
  2⤵
  PID:7772
- C:\Windows\System\jspvFFC.exe
  C:\Windows\System\jspvFFC.exe
  2⤵
  PID:7788
- C:\Windows\System\wDjtSXb.exe
  C:\Windows\System\wDjtSXb.exe
  2⤵
  PID:7804
- C:\Windows\System\ppEcXeV.exe
  C:\Windows\System\ppEcXeV.exe
  2⤵
  PID:7820
- C:\Windows\System\hceCIlx.exe
  C:\Windows\System\hceCIlx.exe
  2⤵
  PID:7836
- C:\Windows\System\psBByLI.exe
  C:\Windows\System\psBByLI.exe
  2⤵
  PID:7852
- C:\Windows\System\asjGthw.exe
  C:\Windows\System\asjGthw.exe
  2⤵
  PID:7868
- C:\Windows\System\HIEEuZK.exe
  C:\Windows\System\HIEEuZK.exe
  2⤵
  PID:7884
- C:\Windows\System\dpIBOpz.exe
  C:\Windows\System\dpIBOpz.exe
  2⤵
  PID:7900
- C:\Windows\System\plStiQY.exe
  C:\Windows\System\plStiQY.exe
  2⤵
  PID:7916
- C:\Windows\System\ZGHmliN.exe
  C:\Windows\System\ZGHmliN.exe
  2⤵
  PID:7932
- C:\Windows\System\QjxtvXL.exe
  C:\Windows\System\QjxtvXL.exe
  2⤵
  PID:7948
- C:\Windows\System\UmqCzQC.exe
  C:\Windows\System\UmqCzQC.exe
  2⤵
  PID:7964
- C:\Windows\System\HiSaWzZ.exe
  C:\Windows\System\HiSaWzZ.exe
  2⤵
  PID:8036
- C:\Windows\System\jxdbvOz.exe
  C:\Windows\System\jxdbvOz.exe
  2⤵
  PID:8052
- C:\Windows\System\cjIRafi.exe
  C:\Windows\System\cjIRafi.exe
  2⤵
  PID:8068
- C:\Windows\System\MVDEWHG.exe
  C:\Windows\System\MVDEWHG.exe
  2⤵
  PID:8084
- C:\Windows\System\LTMIzjt.exe
  C:\Windows\System\LTMIzjt.exe
  2⤵
  PID:8100
- C:\Windows\System\ulFuhuz.exe
  C:\Windows\System\ulFuhuz.exe
  2⤵
  PID:8116
- C:\Windows\System\jSuriFO.exe
  C:\Windows\System\jSuriFO.exe
  2⤵
  PID:8132
- C:\Windows\System\MXzZMkC.exe
  C:\Windows\System\MXzZMkC.exe
  2⤵
  PID:8148
- C:\Windows\System\mTHuWcX.exe
  C:\Windows\System\mTHuWcX.exe
  2⤵
  PID:8164
- C:\Windows\System\iNphlUc.exe
  C:\Windows\System\iNphlUc.exe
  2⤵
  PID:8180
- C:\Windows\System\SuxRMXA.exe
  C:\Windows\System\SuxRMXA.exe
  2⤵
  PID:7196
- C:\Windows\System\lNyQBjG.exe
  C:\Windows\System\lNyQBjG.exe
  2⤵
  PID:7260
- C:\Windows\System\AFcNraH.exe
  C:\Windows\System\AFcNraH.exe
  2⤵
  PID:7104
- C:\Windows\System\OXaJWXg.exe
  C:\Windows\System\OXaJWXg.exe
  2⤵
  PID:7280
- C:\Windows\System\HNVCNTj.exe
  C:\Windows\System\HNVCNTj.exe
  2⤵
  PID:7140
- C:\Windows\System\jQlIFRy.exe
  C:\Windows\System\jQlIFRy.exe
  2⤵
  PID:6184
- C:\Windows\System\ugvcolL.exe
  C:\Windows\System\ugvcolL.exe
  2⤵
  PID:6352
- C:\Windows\System\pLEXeCW.exe
  C:\Windows\System\pLEXeCW.exe
  2⤵
  PID:6448
- C:\Windows\System\ltwFmpF.exe
  C:\Windows\System\ltwFmpF.exe
  2⤵
  PID:6736
- C:\Windows\System\UvHILFo.exe
  C:\Windows\System\UvHILFo.exe
  2⤵
  PID:6688
- C:\Windows\System\iTICcaX.exe
  C:\Windows\System\iTICcaX.exe
  2⤵
  PID:6904
- C:\Windows\System\LXhRDnG.exe
  C:\Windows\System\LXhRDnG.exe
  2⤵
  PID:6984
- C:\Windows\System\kMQYAFT.exe
  C:\Windows\System\kMQYAFT.exe
  2⤵
  PID:7160
- C:\Windows\System\dkSqqWv.exe
  C:\Windows\System\dkSqqWv.exe
  2⤵
  PID:6572
- C:\Windows\System\BywUykg.exe
  C:\Windows\System\BywUykg.exe
  2⤵
  PID:7024
- C:\Windows\System\GEICxcd.exe
  C:\Windows\System\GEICxcd.exe
  2⤵
  PID:7180
- C:\Windows\System\lXPGPJe.exe
  C:\Windows\System\lXPGPJe.exe
  2⤵
  PID:7244
- C:\Windows\System\KkyJHEb.exe
  C:\Windows\System\KkyJHEb.exe
  2⤵
  PID:7316
- C:\Windows\System\RcdvtNy.exe
  C:\Windows\System\RcdvtNy.exe
  2⤵
  PID:7328
- C:\Windows\System\zJcSDWs.exe
  C:\Windows\System\zJcSDWs.exe
  2⤵
  PID:7396
- C:\Windows\System\FUPruqF.exe
  C:\Windows\System\FUPruqF.exe
  2⤵
  PID:7380
- C:\Windows\System\UxRjYHw.exe
  C:\Windows\System\UxRjYHw.exe
  2⤵
  PID:7428
- C:\Windows\System\MKLYwYC.exe
  C:\Windows\System\MKLYwYC.exe
  2⤵
  PID:7456
- C:\Windows\System\BluGLAI.exe
  C:\Windows\System\BluGLAI.exe
  2⤵
  PID:7556
- C:\Windows\System\qXJwyGj.exe
  C:\Windows\System\qXJwyGj.exe
  2⤵
  PID:7592
- C:\Windows\System\ZOMWAeH.exe
  C:\Windows\System\ZOMWAeH.exe
  2⤵
  PID:7508
- C:\Windows\System\zOTWDMa.exe
  C:\Windows\System\zOTWDMa.exe
  2⤵
  PID:7572
- C:\Windows\System\YAEDXUu.exe
  C:\Windows\System\YAEDXUu.exe
  2⤵
  PID:7620
- C:\Windows\System\DiYONGK.exe
  C:\Windows\System\DiYONGK.exe
  2⤵
  PID:7688
- C:\Windows\System\VmJctEO.exe
  C:\Windows\System\VmJctEO.exe
  2⤵
  PID:7640
- C:\Windows\System\SeYAHGl.exe
  C:\Windows\System\SeYAHGl.exe
  2⤵
  PID:7780
- C:\Windows\System\fqPKMfm.exe
  C:\Windows\System\fqPKMfm.exe
  2⤵
  PID:7816
- C:\Windows\System\ekfdtAJ.exe
  C:\Windows\System\ekfdtAJ.exe
  2⤵
  PID:7876
- C:\Windows\System\HOyfgIw.exe
  C:\Windows\System\HOyfgIw.exe
  2⤵
  PID:7668
- C:\Windows\System\ZHkMsZE.exe
  C:\Windows\System\ZHkMsZE.exe
  2⤵
  PID:7800
- C:\Windows\System\geJWtVI.exe
  C:\Windows\System\geJWtVI.exe
  2⤵
  PID:7928
- C:\Windows\System\QokMKOu.exe
  C:\Windows\System\QokMKOu.exe
  2⤵
  PID:7832
- C:\Windows\System\QIWiMmw.exe
  C:\Windows\System\QIWiMmw.exe
  2⤵
  PID:7896
- C:\Windows\System\BNhWBIs.exe
  C:\Windows\System\BNhWBIs.exe
  2⤵
  PID:7972
- C:\Windows\System\eIuCvra.exe
  C:\Windows\System\eIuCvra.exe
  2⤵
  PID:7988
- C:\Windows\System\CuNgfeh.exe
  C:\Windows\System\CuNgfeh.exe
  2⤵
  PID:8004
- C:\Windows\System\DxoUQYl.exe
  C:\Windows\System\DxoUQYl.exe
  2⤵
  PID:6848
- C:\Windows\System\bbUlOUJ.exe
  C:\Windows\System\bbUlOUJ.exe
  2⤵
  PID:8060
- C:\Windows\System\mcjjjFa.exe
  C:\Windows\System\mcjjjFa.exe
  2⤵
  PID:8124
- C:\Windows\System\UBDCLzE.exe
  C:\Windows\System\UBDCLzE.exe
  2⤵
  PID:6496
- C:\Windows\System\jKxzJlb.exe
  C:\Windows\System\jKxzJlb.exe
  2⤵
  PID:7068
- C:\Windows\System\pqrJNsI.exe
  C:\Windows\System\pqrJNsI.exe
  2⤵
  PID:1712
- C:\Windows\System\GLlcIec.exe
  C:\Windows\System\GLlcIec.exe
  2⤵
  PID:8140
- C:\Windows\System\pmKLinf.exe
  C:\Windows\System\pmKLinf.exe
  2⤵
  PID:8172
- C:\Windows\System\MmgHLhq.exe
  C:\Windows\System\MmgHLhq.exe
  2⤵
  PID:6052
- C:\Windows\System\slTRoYZ.exe
  C:\Windows\System\slTRoYZ.exe
  2⤵
  PID:8044
- C:\Windows\System\KbuTviO.exe
  C:\Windows\System\KbuTviO.exe
  2⤵
  PID:6576
- C:\Windows\System\BNsJnDx.exe
  C:\Windows\System\BNsJnDx.exe
  2⤵
  PID:6824
- C:\Windows\System\JBiZxQB.exe
  C:\Windows\System\JBiZxQB.exe
  2⤵
  PID:7296
- C:\Windows\System\axuqdVo.exe
  C:\Windows\System\axuqdVo.exe
  2⤵
  PID:7488
- C:\Windows\System\KFEDeTh.exe
  C:\Windows\System\KFEDeTh.exe
  2⤵
  PID:7440
- C:\Windows\System\poIgvnI.exe
  C:\Windows\System\poIgvnI.exe
  2⤵
  PID:6760
- C:\Windows\System\lAZQHCm.exe
  C:\Windows\System\lAZQHCm.exe
  2⤵
  PID:7312
- C:\Windows\System\RkJSxkV.exe
  C:\Windows\System\RkJSxkV.exe
  2⤵
  PID:7276
- C:\Windows\System\jBpihiV.exe
  C:\Windows\System\jBpihiV.exe
  2⤵
  PID:6892
- C:\Windows\System\pXYFwcH.exe
  C:\Windows\System\pXYFwcH.exe
  2⤵
  PID:6776
- C:\Windows\System\fmHqcQI.exe
  C:\Windows\System\fmHqcQI.exe
  2⤵
  PID:7764
- C:\Windows\System\IVLFFRY.exe
  C:\Windows\System\IVLFFRY.exe
  2⤵
  PID:7472
- C:\Windows\System\lAKWyhQ.exe
  C:\Windows\System\lAKWyhQ.exe
  2⤵
  PID:7636
- C:\Windows\System\KyqBRXG.exe
  C:\Windows\System\KyqBRXG.exe
  2⤵
  PID:7704
- C:\Windows\System\MgCCUFU.exe
  C:\Windows\System\MgCCUFU.exe
  2⤵
  PID:7924
- C:\Windows\System\OAECXtx.exe
  C:\Windows\System\OAECXtx.exe
  2⤵
  PID:8028
- C:\Windows\System\smLsUgl.exe
  C:\Windows\System\smLsUgl.exe
  2⤵
  PID:8012
- C:\Windows\System\LfiGWQK.exe
  C:\Windows\System\LfiGWQK.exe
  2⤵
  PID:8156
- C:\Windows\System\wujzZqw.exe
  C:\Windows\System\wujzZqw.exe
  2⤵
  PID:7292
- C:\Windows\System\nHngsEL.exe
  C:\Windows\System\nHngsEL.exe
  2⤵
  PID:8112
- C:\Windows\System\xMtzJdz.exe
  C:\Windows\System\xMtzJdz.exe
  2⤵
  PID:7056
- C:\Windows\System\zWtbuLf.exe
  C:\Windows\System\zWtbuLf.exe
  2⤵
  PID:8076
- C:\Windows\System\PHkjpoW.exe
  C:\Windows\System\PHkjpoW.exe
  2⤵
  PID:6336
- C:\Windows\System\goFHssq.exe
  C:\Windows\System\goFHssq.exe
  2⤵
  PID:7672
- C:\Windows\System\AHxpdFV.exe
  C:\Windows\System\AHxpdFV.exe
  2⤵
  PID:7228
- C:\Windows\System\YsMhVII.exe
  C:\Windows\System\YsMhVII.exe
  2⤵
  PID:6600
- C:\Windows\System\aVuJQur.exe
  C:\Windows\System\aVuJQur.exe
  2⤵
  PID:7656
- C:\Windows\System\mdXwjQr.exe
  C:\Windows\System\mdXwjQr.exe
  2⤵
  PID:7908
- C:\Windows\System\UeoobLl.exe
  C:\Windows\System\UeoobLl.exe
  2⤵
  PID:7864
- C:\Windows\System\knUNOqe.exe
  C:\Windows\System\knUNOqe.exe
  2⤵
  PID:7608
- C:\Windows\System\mSHKvWR.exe
  C:\Windows\System\mSHKvWR.exe
  2⤵
  PID:8092
- C:\Windows\System\JEbwQqA.exe
  C:\Windows\System\JEbwQqA.exe
  2⤵
  PID:7892
- C:\Windows\System\NigaiVL.exe
  C:\Windows\System\NigaiVL.exe
  2⤵
  PID:7216
- C:\Windows\System\BBolNxz.exe
  C:\Windows\System\BBolNxz.exe
  2⤵
  PID:6444
- C:\Windows\System\PJdTdOy.exe
  C:\Windows\System\PJdTdOy.exe
  2⤵
  PID:8032
- C:\Windows\System\hbPmjmh.exe
  C:\Windows\System\hbPmjmh.exe
  2⤵
  PID:8200
- C:\Windows\System\cVOQETw.exe
  C:\Windows\System\cVOQETw.exe
  2⤵
  PID:8216
- C:\Windows\System\KbtFcDa.exe
  C:\Windows\System\KbtFcDa.exe
  2⤵
  PID:8236
- C:\Windows\System\tAhiRwE.exe
  C:\Windows\System\tAhiRwE.exe
  2⤵
  PID:8252
- C:\Windows\System\mVrlswC.exe
  C:\Windows\System\mVrlswC.exe
  2⤵
  PID:8268
- C:\Windows\System\JGcMkIo.exe
  C:\Windows\System\JGcMkIo.exe
  2⤵
  PID:8284
- C:\Windows\System\uAQooOJ.exe
  C:\Windows\System\uAQooOJ.exe
  2⤵
  PID:8300
- C:\Windows\System\ENGgWph.exe
  C:\Windows\System\ENGgWph.exe
  2⤵
  PID:8316
- C:\Windows\System\YQFjcxE.exe
  C:\Windows\System\YQFjcxE.exe
  2⤵
  PID:8332
- C:\Windows\System\JnnzIcx.exe
  C:\Windows\System\JnnzIcx.exe
  2⤵
  PID:8348
- C:\Windows\System\rKaVAEX.exe
  C:\Windows\System\rKaVAEX.exe
  2⤵
  PID:8364
- C:\Windows\System\LSoZigM.exe
  C:\Windows\System\LSoZigM.exe
  2⤵
  PID:8380
- C:\Windows\System\MZBEhmI.exe
  C:\Windows\System\MZBEhmI.exe
  2⤵
  PID:8396
- C:\Windows\System\rLgJwnz.exe
  C:\Windows\System\rLgJwnz.exe
  2⤵
  PID:8412
- C:\Windows\System\ndBaSSF.exe
  C:\Windows\System\ndBaSSF.exe
  2⤵
  PID:8428
- C:\Windows\System\jsKpDJW.exe
  C:\Windows\System\jsKpDJW.exe
  2⤵
  PID:8444
- C:\Windows\System\FXInRXE.exe
  C:\Windows\System\FXInRXE.exe
  2⤵
  PID:8460
- C:\Windows\System\yFnJEzK.exe
  C:\Windows\System\yFnJEzK.exe
  2⤵
  PID:8476
- C:\Windows\System\QXaSYpQ.exe
  C:\Windows\System\QXaSYpQ.exe
  2⤵
  PID:8492
- C:\Windows\System\VkhcWbE.exe
  C:\Windows\System\VkhcWbE.exe
  2⤵
  PID:8508
- C:\Windows\System\XJwqehX.exe
  C:\Windows\System\XJwqehX.exe
  2⤵
  PID:8524
- C:\Windows\System\xrCzpWa.exe
  C:\Windows\System\xrCzpWa.exe
  2⤵
  PID:8540
- C:\Windows\System\gphyCzk.exe
  C:\Windows\System\gphyCzk.exe
  2⤵
  PID:8556
- C:\Windows\System\czxpMtr.exe
  C:\Windows\System\czxpMtr.exe
  2⤵
  PID:8572
- C:\Windows\System\nyUcUhi.exe
  C:\Windows\System\nyUcUhi.exe
  2⤵
  PID:8588
- C:\Windows\System\dfPeJYo.exe
  C:\Windows\System\dfPeJYo.exe
  2⤵
  PID:8604
- C:\Windows\System\GvmeUEj.exe
  C:\Windows\System\GvmeUEj.exe
  2⤵
  PID:8620
- C:\Windows\System\tlzHNhr.exe
  C:\Windows\System\tlzHNhr.exe
  2⤵
  PID:8636
- C:\Windows\System\MQtFMKE.exe
  C:\Windows\System\MQtFMKE.exe
  2⤵
  PID:8652
- C:\Windows\System\MwYetDA.exe
  C:\Windows\System\MwYetDA.exe
  2⤵
  PID:8668
- C:\Windows\System\FBlImaX.exe
  C:\Windows\System\FBlImaX.exe
  2⤵
  PID:8684
- C:\Windows\System\qawVFmD.exe
  C:\Windows\System\qawVFmD.exe
  2⤵
  PID:8700
- C:\Windows\System\zhSVsev.exe
  C:\Windows\System\zhSVsev.exe
  2⤵
  PID:8716
- C:\Windows\System\lYkYsfm.exe
  C:\Windows\System\lYkYsfm.exe
  2⤵
  PID:8732
- C:\Windows\System\CjxXqCR.exe
  C:\Windows\System\CjxXqCR.exe
  2⤵
  PID:8748
- C:\Windows\System\wBuaFoA.exe
  C:\Windows\System\wBuaFoA.exe
  2⤵
  PID:8764
- C:\Windows\System\jNMRkPw.exe
  C:\Windows\System\jNMRkPw.exe
  2⤵
  PID:8780
- C:\Windows\System\AmVIeug.exe
  C:\Windows\System\AmVIeug.exe
  2⤵
  PID:8796
- C:\Windows\System\BpOuhyF.exe
  C:\Windows\System\BpOuhyF.exe
  2⤵
  PID:8812
- C:\Windows\System\xscIDms.exe
  C:\Windows\System\xscIDms.exe
  2⤵
  PID:8828
- C:\Windows\System\QsGLoWK.exe
  C:\Windows\System\QsGLoWK.exe
  2⤵
  PID:8844
- C:\Windows\System\lDRfqYq.exe
  C:\Windows\System\lDRfqYq.exe
  2⤵
  PID:8860
- C:\Windows\System\tCUiwun.exe
  C:\Windows\System\tCUiwun.exe
  2⤵
  PID:8876
- C:\Windows\System\UMoPQLH.exe
  C:\Windows\System\UMoPQLH.exe
  2⤵
  PID:8892
- C:\Windows\System\dmqQZiW.exe
  C:\Windows\System\dmqQZiW.exe
  2⤵
  PID:8908
- C:\Windows\System\UcviCQb.exe
  C:\Windows\System\UcviCQb.exe
  2⤵
  PID:8924
- C:\Windows\System\hzSMPYF.exe
  C:\Windows\System\hzSMPYF.exe
  2⤵
  PID:8940
- C:\Windows\System\RktKDQN.exe
  C:\Windows\System\RktKDQN.exe
  2⤵
  PID:8956
- C:\Windows\System\CwpDEnI.exe
  C:\Windows\System\CwpDEnI.exe
  2⤵
  PID:8972
- C:\Windows\System\KgTwfiE.exe
  C:\Windows\System\KgTwfiE.exe
  2⤵
  PID:8988
- C:\Windows\System\NXMjMzw.exe
  C:\Windows\System\NXMjMzw.exe
  2⤵
  PID:9004
- C:\Windows\System\hoAAbPR.exe
  C:\Windows\System\hoAAbPR.exe
  2⤵
  PID:9020
- C:\Windows\System\ycoBCYn.exe
  C:\Windows\System\ycoBCYn.exe
  2⤵
  PID:9036
- C:\Windows\System\aJnDiap.exe
  C:\Windows\System\aJnDiap.exe
  2⤵
  PID:9052
- C:\Windows\System\JlENrmn.exe
  C:\Windows\System\JlENrmn.exe
  2⤵
  PID:9068
- C:\Windows\System\waihMgd.exe
  C:\Windows\System\waihMgd.exe
  2⤵
  PID:9084
- C:\Windows\System\NlCawuo.exe
  C:\Windows\System\NlCawuo.exe
  2⤵
  PID:9100
- C:\Windows\System\VCdSzZV.exe
  C:\Windows\System\VCdSzZV.exe
  2⤵
  PID:9116
- C:\Windows\System\QSLFfxO.exe
  C:\Windows\System\QSLFfxO.exe
  2⤵
  PID:9132
- C:\Windows\System\cugWfzQ.exe
  C:\Windows\System\cugWfzQ.exe
  2⤵
  PID:9148
- C:\Windows\System\FvGDZId.exe
  C:\Windows\System\FvGDZId.exe
  2⤵
  PID:9164
- C:\Windows\System\wZcoSLs.exe
  C:\Windows\System\wZcoSLs.exe
  2⤵
  PID:9180
- C:\Windows\System\YbhBxhq.exe
  C:\Windows\System\YbhBxhq.exe
  2⤵
  PID:9196
- C:\Windows\System\yppLsvE.exe
  C:\Windows\System\yppLsvE.exe
  2⤵
  PID:9212
- C:\Windows\System\FWnjuTi.exe
  C:\Windows\System\FWnjuTi.exe
  2⤵
  PID:8016
- C:\Windows\System\rEnHXvy.exe
  C:\Windows\System\rEnHXvy.exe
  2⤵
  PID:7720
- C:\Windows\System\TajaYTs.exe
  C:\Windows\System\TajaYTs.exe
  2⤵
  PID:7684
- C:\Windows\System\vLmeeVP.exe
  C:\Windows\System\vLmeeVP.exe
  2⤵
  PID:7444
- C:\Windows\System\WIUITSI.exe
  C:\Windows\System\WIUITSI.exe
  2⤵
  PID:7552
- C:\Windows\System\IOnnIAE.exe
  C:\Windows\System\IOnnIAE.exe
  2⤵
  PID:8260
- C:\Windows\System\XTvQMSq.exe
  C:\Windows\System\XTvQMSq.exe
  2⤵
  PID:8324
- C:\Windows\System\mbQwWEr.exe
  C:\Windows\System\mbQwWEr.exe
  2⤵
  PID:8276
- C:\Windows\System\dUZkNIQ.exe
  C:\Windows\System\dUZkNIQ.exe
  2⤵
  PID:8340
- C:\Windows\System\awEwXRn.exe
  C:\Windows\System\awEwXRn.exe
  2⤵
  PID:8392
- C:\Windows\System\lnHyeRY.exe
  C:\Windows\System\lnHyeRY.exe
  2⤵
  PID:8408
- C:\Windows\System\YPgZwPq.exe
  C:\Windows\System\YPgZwPq.exe
  2⤵
  PID:8484
- C:\Windows\System\OTbQrYf.exe
  C:\Windows\System\OTbQrYf.exe
  2⤵
  PID:8520
- C:\Windows\System\YdxqMqs.exe
  C:\Windows\System\YdxqMqs.exe
  2⤵
  PID:8472
- C:\Windows\System\wgYGHKK.exe
  C:\Windows\System\wgYGHKK.exe
  2⤵
  PID:8536
- C:\Windows\System\CnXIZGq.exe
  C:\Windows\System\CnXIZGq.exe
  2⤵
  PID:1572
- C:\Windows\System\zyePBFi.exe
  C:\Windows\System\zyePBFi.exe
  2⤵
  PID:8564
- C:\Windows\System\bWNQiQs.exe
  C:\Windows\System\bWNQiQs.exe
  2⤵
  PID:8660
- C:\Windows\System\afNnjey.exe
  C:\Windows\System\afNnjey.exe
  2⤵
  PID:8648
- C:\Windows\System\ykQbRKf.exe
  C:\Windows\System\ykQbRKf.exe
  2⤵
  PID:8708
- C:\Windows\System\boZVDzA.exe
  C:\Windows\System\boZVDzA.exe
  2⤵
  PID:8696
- C:\Windows\System\vQMzOPD.exe
  C:\Windows\System\vQMzOPD.exe
  2⤵
  PID:8772
- C:\Windows\System\XALpKPN.exe
  C:\Windows\System\XALpKPN.exe
  2⤵
  PID:8836
- C:\Windows\System\CMuDBob.exe
  C:\Windows\System\CMuDBob.exe
  2⤵
  PID:8820
- C:\Windows\System\sDxWvyN.exe
  C:\Windows\System\sDxWvyN.exe
  2⤵
  PID:8788
- C:\Windows\System\RNvVUcv.exe
  C:\Windows\System\RNvVUcv.exe
  2⤵
  PID:8888
- C:\Windows\System\wEbyAlD.exe
  C:\Windows\System\wEbyAlD.exe
  2⤵
  PID:8932
- C:\Windows\System\AFhXjQY.exe
  C:\Windows\System\AFhXjQY.exe
  2⤵
  PID:8948
- C:\Windows\System\cgMmntS.exe
  C:\Windows\System\cgMmntS.exe
  2⤵
  PID:9028
- C:\Windows\System\hgJonvj.exe
  C:\Windows\System\hgJonvj.exe
  2⤵
  PID:9092
- C:\Windows\System\bbZSWlf.exe
  C:\Windows\System\bbZSWlf.exe
  2⤵
  PID:9044
- C:\Windows\System\XUDxzxU.exe
  C:\Windows\System\XUDxzxU.exe
  2⤵
  PID:9108
- C:\Windows\System\NnhTXMU.exe
  C:\Windows\System\NnhTXMU.exe
  2⤵
  PID:9080
- C:\Windows\System\tUOdlci.exe
  C:\Windows\System\tUOdlci.exe
  2⤵
  PID:9160
- C:\Windows\System\rHDnuqJ.exe
  C:\Windows\System\rHDnuqJ.exe
  2⤵
  PID:9172
- C:\Windows\System\ZDePOZn.exe
  C:\Windows\System\ZDePOZn.exe
  2⤵
  PID:8224
- C:\Windows\System\lRzlWUi.exe
  C:\Windows\System\lRzlWUi.exe
  2⤵
  PID:8000
- C:\Windows\System\itAleWY.exe
  C:\Windows\System\itAleWY.exe
  2⤵
  PID:9208
- C:\Windows\System\bpLiLXJ.exe
  C:\Windows\System\bpLiLXJ.exe
  2⤵
  PID:8244
- C:\Windows\System\EVTKbas.exe
  C:\Windows\System\EVTKbas.exe
  2⤵
  PID:8360
- C:\Windows\System\iBMcHHB.exe
  C:\Windows\System\iBMcHHB.exe
  2⤵
  PID:8388
- C:\Windows\System\JhxZzMY.exe
  C:\Windows\System\JhxZzMY.exe
  2⤵
  PID:8516
- C:\Windows\System\hJHLouc.exe
  C:\Windows\System\hJHLouc.exe
  2⤵
  PID:8468
- C:\Windows\System\rySblEG.exe
  C:\Windows\System\rySblEG.exe
  2⤵
  PID:8532
- C:\Windows\System\oQAPFJy.exe
  C:\Windows\System\oQAPFJy.exe
  2⤵
  PID:8232
- C:\Windows\System\uGiuogX.exe
  C:\Windows\System\uGiuogX.exe
  2⤵
  PID:8680
- C:\Windows\System\ZhpaAUa.exe
  C:\Windows\System\ZhpaAUa.exe
  2⤵
  PID:8756
- C:\Windows\System\KyMJMkR.exe
  C:\Windows\System\KyMJMkR.exe
  2⤵
  PID:8900
- C:\Windows\System\omToslW.exe
  C:\Windows\System\omToslW.exe
  2⤵
  PID:9124
- C:\Windows\System\qFBBmxw.exe
  C:\Windows\System\qFBBmxw.exe
  2⤵
  PID:9144
- C:\Windows\System\XjzjVdn.exe
  C:\Windows\System\XjzjVdn.exe
  2⤵
  PID:8228
- C:\Windows\System\cvDZixm.exe
  C:\Windows\System\cvDZixm.exe
  2⤵
  PID:8504
- C:\Windows\System\EoosfNM.exe
  C:\Windows\System\EoosfNM.exe
  2⤵
  PID:9128
- C:\Windows\System\zwBHkeu.exe
  C:\Windows\System\zwBHkeu.exe
  2⤵
  PID:8856
- C:\Windows\System\hROTobn.exe
  C:\Windows\System\hROTobn.exe
  2⤵
  PID:9064
- C:\Windows\System\KrYmyvr.exe
  C:\Windows\System\KrYmyvr.exe
  2⤵
  PID:7844
- C:\Windows\System\HwAbehd.exe
  C:\Windows\System\HwAbehd.exe
  2⤵
  PID:8456
- C:\Windows\System\vXvZqMP.exe
  C:\Windows\System\vXvZqMP.exe
  2⤵
  PID:8804
- C:\Windows\System\sxmWjVR.exe
  C:\Windows\System\sxmWjVR.exe
  2⤵
  PID:9000
- C:\Windows\System\cLHJHgU.exe
  C:\Windows\System\cLHJHgU.exe
  2⤵
  PID:9048
- C:\Windows\System\BCJGgAl.exe
  C:\Windows\System\BCJGgAl.exe
  2⤵
  PID:8356
- C:\Windows\System\WxbSmFy.exe
  C:\Windows\System\WxbSmFy.exe
  2⤵
  PID:8312
- C:\Windows\System\ZXpkhja.exe
  C:\Windows\System\ZXpkhja.exe
  2⤵
  PID:9232
- C:\Windows\System\dMnExhF.exe
  C:\Windows\System\dMnExhF.exe
  2⤵
  PID:9248
- C:\Windows\System\DbZqxgn.exe
  C:\Windows\System\DbZqxgn.exe
  2⤵
  PID:9264
- C:\Windows\System\jnBSEdY.exe
  C:\Windows\System\jnBSEdY.exe
  2⤵
  PID:9280
- C:\Windows\System\BJGJqUS.exe
  C:\Windows\System\BJGJqUS.exe
  2⤵
  PID:9296
- C:\Windows\System\LIqEQXG.exe
  C:\Windows\System\LIqEQXG.exe
  2⤵
  PID:9312
- C:\Windows\System\bWuMbiG.exe
  C:\Windows\System\bWuMbiG.exe
  2⤵
  PID:9328
- C:\Windows\System\JsOyNIk.exe
  C:\Windows\System\JsOyNIk.exe
  2⤵
  PID:9344
- C:\Windows\System\WTCjvuE.exe
  C:\Windows\System\WTCjvuE.exe
  2⤵
  PID:9360
- C:\Windows\System\xUSgnZg.exe
  C:\Windows\System\xUSgnZg.exe
  2⤵
  PID:9376
- C:\Windows\System\gaxPzSG.exe
  C:\Windows\System\gaxPzSG.exe
  2⤵
  PID:9392
- C:\Windows\System\sAbLzxF.exe
  C:\Windows\System\sAbLzxF.exe
  2⤵
  PID:9408
- C:\Windows\System\TwkEKsb.exe
  C:\Windows\System\TwkEKsb.exe
  2⤵
  PID:9424
- C:\Windows\System\wanByms.exe
  C:\Windows\System\wanByms.exe
  2⤵
  PID:9440
- C:\Windows\System\xBqFYPg.exe
  C:\Windows\System\xBqFYPg.exe
  2⤵
  PID:9456
- C:\Windows\System\LASiwnP.exe
  C:\Windows\System\LASiwnP.exe
  2⤵
  PID:9472
- C:\Windows\System\TBTwkOz.exe
  C:\Windows\System\TBTwkOz.exe
  2⤵
  PID:9488
- C:\Windows\System\OPJsxRh.exe
  C:\Windows\System\OPJsxRh.exe
  2⤵
  PID:9504
- C:\Windows\System\sDwGBzI.exe
  C:\Windows\System\sDwGBzI.exe
  2⤵
  PID:9520
- C:\Windows\System\TaMPzUR.exe
  C:\Windows\System\TaMPzUR.exe
  2⤵
  PID:9536
- C:\Windows\System\ALJSxUw.exe
  C:\Windows\System\ALJSxUw.exe
  2⤵
  PID:9552
- C:\Windows\System\oxbpngQ.exe
  C:\Windows\System\oxbpngQ.exe
  2⤵
  PID:9572
- C:\Windows\System\bSUAOQM.exe
  C:\Windows\System\bSUAOQM.exe
  2⤵
  PID:9588
- C:\Windows\System\zmRRIjR.exe
  C:\Windows\System\zmRRIjR.exe
  2⤵
  PID:9604
- C:\Windows\System\kIzvSuj.exe
  C:\Windows\System\kIzvSuj.exe
  2⤵
  PID:9620
- C:\Windows\System\PsIOgcz.exe
  C:\Windows\System\PsIOgcz.exe
  2⤵
  PID:9636
- C:\Windows\System\WOcOPOo.exe
  C:\Windows\System\WOcOPOo.exe
  2⤵
  PID:9652
- C:\Windows\System\YfzcNGh.exe
  C:\Windows\System\YfzcNGh.exe
  2⤵
  PID:9668
- C:\Windows\System\WlJHLVF.exe
  C:\Windows\System\WlJHLVF.exe
  2⤵
  PID:9684
- C:\Windows\System\pzOUmHD.exe
  C:\Windows\System\pzOUmHD.exe
  2⤵
  PID:9700
- C:\Windows\System\oaxzTig.exe
  C:\Windows\System\oaxzTig.exe
  2⤵
  PID:9716
- C:\Windows\System\AhhVQHU.exe
  C:\Windows\System\AhhVQHU.exe
  2⤵
  PID:9732
- C:\Windows\System\yOMuCAb.exe
  C:\Windows\System\yOMuCAb.exe
  2⤵
  PID:9748
- C:\Windows\System\Ztvizyh.exe
  C:\Windows\System\Ztvizyh.exe
  2⤵
  PID:9764
- C:\Windows\System\mCjcPcy.exe
  C:\Windows\System\mCjcPcy.exe
  2⤵
  PID:9780
- C:\Windows\System\MTQTXHl.exe
  C:\Windows\System\MTQTXHl.exe
  2⤵
  PID:9796
- C:\Windows\System\sGeHBEM.exe
  C:\Windows\System\sGeHBEM.exe
  2⤵
  PID:9812
- C:\Windows\System\ortenWf.exe
  C:\Windows\System\ortenWf.exe
  2⤵
  PID:9828
- C:\Windows\System\nlkZOLP.exe
  C:\Windows\System\nlkZOLP.exe
  2⤵
  PID:9844
- C:\Windows\System\KiGBneF.exe
  C:\Windows\System\KiGBneF.exe
  2⤵
  PID:9864
- C:\Windows\System\bqXIldh.exe
  C:\Windows\System\bqXIldh.exe
  2⤵
  PID:9880
- C:\Windows\System\yjqteYv.exe
  C:\Windows\System\yjqteYv.exe
  2⤵
  PID:9900
- C:\Windows\System\efprLjx.exe
  C:\Windows\System\efprLjx.exe
  2⤵
  PID:9916
- C:\Windows\System\EgecfXB.exe
  C:\Windows\System\EgecfXB.exe
  2⤵
  PID:9932
- C:\Windows\System\lcDRroP.exe
  C:\Windows\System\lcDRroP.exe
  2⤵
  PID:9948
- C:\Windows\System\TCTSNBf.exe
  C:\Windows\System\TCTSNBf.exe
  2⤵
  PID:9964
- C:\Windows\System\XKovzCJ.exe
  C:\Windows\System\XKovzCJ.exe
  2⤵
  PID:9980
- C:\Windows\System\WTIaaMo.exe
  C:\Windows\System\WTIaaMo.exe
  2⤵
  PID:9996
- C:\Windows\System\Dgnxxog.exe
  C:\Windows\System\Dgnxxog.exe
  2⤵
  PID:10012
- C:\Windows\System\kvYCLZA.exe
  C:\Windows\System\kvYCLZA.exe
  2⤵
  PID:10028
- C:\Windows\System\bOgtRbd.exe
  C:\Windows\System\bOgtRbd.exe
  2⤵
  PID:10044
- C:\Windows\System\yVVLAdH.exe
  C:\Windows\System\yVVLAdH.exe
  2⤵
  PID:10060
- C:\Windows\System\VjkwXcS.exe
  C:\Windows\System\VjkwXcS.exe
  2⤵
  PID:10076
- C:\Windows\System\OXdcIXj.exe
  C:\Windows\System\OXdcIXj.exe
  2⤵
  PID:10104
- C:\Windows\System\WAZjZgg.exe
  C:\Windows\System\WAZjZgg.exe
  2⤵
  PID:10224
- C:\Windows\System\WJabafF.exe
  C:\Windows\System\WJabafF.exe
  2⤵
  PID:9224
- C:\Windows\System\jWYkuUL.exe
  C:\Windows\System\jWYkuUL.exe
  2⤵
  PID:9288
- C:\Windows\System\jTrLewr.exe
  C:\Windows\System\jTrLewr.exe
  2⤵
  PID:8596
- C:\Windows\System\OYRjjvb.exe
  C:\Windows\System\OYRjjvb.exe
  2⤵
  PID:7588
- C:\Windows\System\JXfBmAh.exe
  C:\Windows\System\JXfBmAh.exe
  2⤵
  PID:8868
- C:\Windows\System\YYHHIHP.exe
  C:\Windows\System\YYHHIHP.exe
  2⤵
  PID:8872
- C:\Windows\System\mOuaLdd.exe
  C:\Windows\System\mOuaLdd.exe
  2⤵
  PID:9308
- C:\Windows\System\RwaxOaI.exe
  C:\Windows\System\RwaxOaI.exe
  2⤵
  PID:8884
- C:\Windows\System\KDVZSjN.exe
  C:\Windows\System\KDVZSjN.exe
  2⤵
  PID:9272
- C:\Windows\System\EhwdxSX.exe
  C:\Windows\System\EhwdxSX.exe
  2⤵
  PID:9368
- C:\Windows\System\RfhRsNw.exe
  C:\Windows\System\RfhRsNw.exe
  2⤵
  PID:9448
- C:\Windows\System\nZPIINJ.exe
  C:\Windows\System\nZPIINJ.exe
  2⤵
  PID:9484
- C:\Windows\System\yaQuktZ.exe
  C:\Windows\System\yaQuktZ.exe
  2⤵
  PID:9468
- C:\Windows\System\yEhPauP.exe
  C:\Windows\System\yEhPauP.exe
  2⤵
  PID:9548
- C:\Windows\System\pXRVhEb.exe
  C:\Windows\System\pXRVhEb.exe
  2⤵
  PID:9584
- C:\Windows\System\XHFIvXi.exe
  C:\Windows\System\XHFIvXi.exe
  2⤵
  PID:9644
- C:\Windows\System\NTfvCTC.exe
  C:\Windows\System\NTfvCTC.exe
  2⤵
  PID:9632
- C:\Windows\System\DaXFbxn.exe
  C:\Windows\System\DaXFbxn.exe
  2⤵
  PID:9712
- C:\Windows\System\ERjmDHR.exe
  C:\Windows\System\ERjmDHR.exe
  2⤵
  PID:9744
- C:\Windows\System\lBYiYsB.exe
  C:\Windows\System\lBYiYsB.exe
  2⤵
  PID:9728
- C:\Windows\System\yYiNSKl.exe
  C:\Windows\System\yYiNSKl.exe
  2⤵
  PID:9808
- C:\Windows\System\dIraUpa.exe
  C:\Windows\System\dIraUpa.exe
  2⤵
  PID:9788
- C:\Windows\System\quumEBI.exe
  C:\Windows\System\quumEBI.exe
  2⤵
  PID:9852
- C:\Windows\System\MzerMkF.exe
  C:\Windows\System\MzerMkF.exe
  2⤵
  PID:9912
- C:\Windows\System\AalNUBm.exe
  C:\Windows\System\AalNUBm.exe
  2⤵
  PID:10068
- C:\Windows\System\JjxJFZx.exe
  C:\Windows\System\JjxJFZx.exe
  2⤵
  PID:9924
- C:\Windows\System\hFfZmJs.exe
  C:\Windows\System\hFfZmJs.exe
  2⤵
  PID:9992
- C:\Windows\System\CioguJw.exe
  C:\Windows\System\CioguJw.exe
  2⤵
  PID:10084
- C:\Windows\System\QRFzaZm.exe
  C:\Windows\System\QRFzaZm.exe
  2⤵
  PID:10192
- C:\Windows\System\STbtUQY.exe
  C:\Windows\System\STbtUQY.exe
  2⤵
  PID:10220
- C:\Windows\System\FJxFWmS.exe
  C:\Windows\System\FJxFWmS.exe
  2⤵
  PID:9324
- C:\Windows\System\LvbbIhQ.exe
  C:\Windows\System\LvbbIhQ.exe
  2⤵
  PID:8600
- C:\Windows\System\dReJqoY.exe
  C:\Windows\System\dReJqoY.exe
  2⤵
  PID:9388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BUpLGoM.exe

Filesize
2.2MB

MD5
6e5e5e68ecc62fb367efec131f913fc1

SHA1
78b23db14511803c37d0769d2f4f0851f419e4c1

SHA256
ed56de91eb6ed64b6962a1d54874ca501ade9c93b0b04ea670a01fdc915fb2d8

SHA512
cc02cd53a47b8a6037e5add8eb15af7309a0a47cb3119124cc65894c72bbf0a7011e26f0ccf7aed7540f5a5ab279808ded677d66f413ca9bf2d5c13f69547d43

Download Submit
C:\Windows\system\CGkLigd.exe

Filesize
2.2MB

MD5
fe52cc2b11e2194f788742f2f7559b4c

SHA1
43b08d03388824c7ba9411e252c2a53cd4875dc7

SHA256
d86f349898efc89c269cf1eab1e943427332a62ac7b6299a940dd2df8bd75059

SHA512
af0ce6717200cb5531c1823a56fd250d410553d6217a880ef53ec5bb7147070bb3d7b60ac40cd2186e44c9e27254c2e13f1f353015ba3e01d96e40be4486dc05

Download Submit
C:\Windows\system\DnYlmEE.exe

Filesize
2.2MB

MD5
b723085368e3fd37d8882e8d173cc3e3

SHA1
64ee1b15cefa8d0ba4eadcf71473d58cdec39afa

SHA256
57499233f07d879ffa0c7af3af28dc66b8361f3ca45ad70b77f56fe87c8e79fa

SHA512
5456efe6c346944fb5a2066ade8884c1a3505be80e10fe51e0bb91516f8c017657302a2a3c73014025566e6dfdb86ab58c05d7d287cc3e26b3790483b2dd705b

Download Submit
C:\Windows\system\EzJSkFE.exe

Filesize
2.2MB

MD5
268095806a63f5f85072ac600c84132b

SHA1
9670944a601f09d80488d34bc3e05c8b88145b93

SHA256
64c31ef33153da1e733ea25f33feaf015fd44d6ba8307ac3c29251b0a1cdbd65

SHA512
7833cd5a0b7ef22ffeff09f911262308cfc850a7d930aa97c0405b75b33ee36ff6a221db72cef00acf7952c8b15bc91d7b1f58e97f880f599082eb8623c34879

Download Submit
C:\Windows\system\IEffKVp.exe

Filesize
2.2MB

MD5
14efd033a1fc51fad94743becb5cfdde

SHA1
6e5d5f17d775b3ac7abf4e5ff70ccce0eb767a1f

SHA256
f4cd45543e9f7a49bc6b07335dc828bd4604f96bd321d80f8da89b1fcb0cf8da

SHA512
ea48ff0a028cbd9b0da14d06552e11948e69e6c8991716c1e2545cfa6bd2e023ce36f079e27df06ceecc35bffe4c23ba2110414661a8a403d5061aeb2a116309

Download Submit
C:\Windows\system\ItgaWTA.exe

Filesize
2.2MB

MD5
a8f7aa423ebccf56cea50a4d9b55d17d

SHA1
7659eaa8e31472d125a5956db4f676d680e4e8d7

SHA256
bfef6868861e28e6030401a34519a456139b0ee100315f3ee366ddda2590f83a

SHA512
1e9a005b3addb5d81ca113718fae2db6821d3453396bd6846235c038b880312377b026635c8e5f8fbb55c36857022ef3990acc3f0fb0a90f37cc51269fb92577

Download Submit
C:\Windows\system\KnceVzN.exe

Filesize
2.2MB

MD5
31ad7d4b66166ffa96749acdfebf43d0

SHA1
e242309428b9b4ba3b04e8f9828c572abb6ce722

SHA256
6ba71769c226cbf971fa4e4caa3e7581e5a8fe7893e9b91e8a9ff68b4a52b46e

SHA512
747a2a73e22b245c20cfc6692a2a5551f186a8d982b66b46a72777be91ce72d4c41cd730bb01a86952c9e5237b8d3e9e9fba4c17d4de44dab3ee19c4785b8a22

Download Submit
C:\Windows\system\MftjgJE.exe

Filesize
2.2MB

MD5
56a36546b3da207480ee15c5dc7a5814

SHA1
6c5e2062fa5a57f0f7fe46e10c0acddfd993f606

SHA256
a90e84de308bb24237023a6c971cb79dcae18ee78f9ad67ace3a8e4d4a0e021b

SHA512
e1ba368dce316d53ab7412b8fee225e7576b38ace86438d52e33b742d164aa85f60788979391e489bdb52635ba3fd7bf143bf1918bb6fe2eb921924f7d662c95

Download Submit
C:\Windows\system\NUdHWrL.exe

Filesize
2.2MB

MD5
ae39e4f504cb9536b4a5b7a48af951dc

SHA1
480baeff1317868982000104e523a34525d8db32

SHA256
c27b4b2de008b499e284424469902535aaf969c1961960693546b01af98a4bac

SHA512
b718caa8ae6a53195068008b9ea1632aef9a76d15dfffe5d88e486259d3529084c9178dad796a39fdaecc8b20394ed88c77bd74d55a12ccb991c15d4fe6ad8c2

Download Submit
C:\Windows\system\QAYZyBe.exe

Filesize
2.2MB

MD5
73d83936fd6e406fdd9e000a29eca5c3

SHA1
fa633be8d6f134c93e1ff223383c56bedb3d931b

SHA256
4e20375dc833c5d7d54855279196f2e9d0757e1a52cd9f1c7180127375de7988

SHA512
8e249c66afc52adc5a7329053a3fd27e664e40e45895a4efffce06dea3713afdb41c51baa929976a3a9aa08d091e8ea0e63b073173044524fcfef79a92b22452

Download Submit
C:\Windows\system\UDNdUkc.exe

Filesize
2.2MB

MD5
975a84d40e9642b95d255387420e18da

SHA1
ba072020ff753c55b1ca28bf7ba6531a6ed1a7b4

SHA256
35b0151ff8cbdb49e89890ed72c956ce92762e76e13197fe062c088bc973a184

SHA512
65b101fb9153faba8fbc82c2f4d6f73f6d776d7980b24b2294fb1dffa75b341ac01999f2823eb49e4d19b64f87cbbc1dacea955edadeda6c2892b8641a01a75a

Download Submit
C:\Windows\system\XPCoBZi.exe

Filesize
2.2MB

MD5
a69a9b35a67623465e490899f045f0f6

SHA1
781b81e8647276007f2aac3f5d122f8f5d547019

SHA256
862cdecf6a5f59b4263cd8af129fe5b25766d32884c409f552070fa3a0c9c92a

SHA512
65286c840c5c42c4dda0b5eff0f62c96cf4d1a8b77498836ea981a2316aeb45348dac2ba546141ace7b674fbcb8ca4a4ac5622bb61d00a95f791ca731d4f0f00

Download Submit
C:\Windows\system\grOzDYy.exe

Filesize
2.2MB

MD5
1571745654263d55e189be80e1f5a2c3

SHA1
97091391dc21d9bdfac3a529c30aaf5248f136cc

SHA256
bad3ef657654e1ec7323b802619c5a0a66d28ea1093ea0d4246590829b19afd4

SHA512
52a75115b1d94b5e35a6a70f8e2776fbdc1b0793237ca98386ad3ef35fd7a6a71db75257c468924b948e054dd91245d0a6788ac8a27111966399cffa513aeb8b

Download Submit
C:\Windows\system\hQoEREY.exe

Filesize
2.2MB

MD5
b5aa4a9b14a691e7723d456aad62e1fd

SHA1
5d3f4695e11c672281fd12b34e4ed3f307121267

SHA256
69810f88a1ab8007ea9f8ab74e379736d266ebe63a97dbd7cadec05b6fd8ebb9

SHA512
8c9328f952721b13c2d0b9559c99f00608c9ccd2849043eaee5ae6de1eb0bce9612b04fae1e19f00c91e4a3af56721527e0ba0b5dbdca3b61e01250937f047c3

Download Submit
C:\Windows\system\hzbqwwY.exe

Filesize
2.2MB

MD5
cfdc54efb7a74dde3a9f8cdbfef1aa3c

SHA1
6cc6e10244a6725f0895c6e3de7cb361d07552eb

SHA256
71f95798987a3a906c38a19b1ae4f3a3a44cd0e9859b5f036017f241447889a9

SHA512
6adc2975ce9b92132860447882bbc6df606dc0ea3192bf31dd6f0107fbce41f5562b6e1ed783381b750d7017b31b0e30709d8db71cc91fba86d9b45e966a7e74

Download Submit
C:\Windows\system\iqpVPuR.exe

Filesize
2.2MB

MD5
391c8e6a751cd304565c15ba19e0c672

SHA1
538020d8802bc5fc3f7341696883a8fc5e210848

SHA256
27d7aa530c2a4f7ad901ee70c7e0efd5590d49b2190227623b3eacc4ad3367aa

SHA512
bd747100eaf6b4a720394d8747ffa90e9bb80d67cf45826bb1d6b84c8a97a492170b6a65c40209fabbc7b564beb599df1770a4b7a1c35627fee558d51506c4b8

Download Submit
C:\Windows\system\jiXcXOU.exe

Filesize
2.2MB

MD5
462fda3f7b1f144e83a1d932ba5bd9c2

SHA1
dd7d55b92f542f42d66988f52a168b5ebd043cdd

SHA256
df635f04d34b006d3543d14ba6e8ae149cc845e5d6f0194511c844a041531111

SHA512
ec5519778e400d0865ea156f2d2131e7e2c1c4bf14c954f7f34faf83c16c70ef69001c4657af9bf55627027b8a6b7189d90acc472b8e009b53756db4d3ba2b10

Download Submit
C:\Windows\system\kvVAhJe.exe

Filesize
2.2MB

MD5
bf90ca5555ea8d6582243fa821589aac

SHA1
b80d3a11074d4e8d21c3b6dc4130da96d1e580f4

SHA256
25f8f0d8b4d44234179b07edfa8aa8392eac8daac44ff2d06a2bf4aec0a5a004

SHA512
559ae27accbaf8d712cbbf7481aa20e78071db2c0013338731d11ac583790093b34e6e335396d7739c21ad7d847467175cfddae9ecea2969b68e71e715707e07

Download Submit
C:\Windows\system\kxrptwt.exe

Filesize
2.2MB

MD5
1561288dc62004a9aa039f8a557bd266

SHA1
e9c8b8e650fbe124b133ab488feb8679560f6d19

SHA256
d7c5b5904d41e0e9ae41eeca6fdeb7ba57a869d5e5a7b2aeea62c864f81928e9

SHA512
3c9b6a6ff0fe11436b61d6652dcd66bacbe79fc2b70e50d8b150ee28e80c86aa671438c8f58a7bbfc025db0b8a987db6a07918889e4acfaedc3f82244cb314e1

Download Submit
C:\Windows\system\lfiSYuj.exe

Filesize
2.2MB

MD5
7d2b3ed6a3fe5da03921d46a76676276

SHA1
d2b5d57ee05dfaaf498e2aaced4a7c4ffbea20cf

SHA256
c2e0a9e2f00e5f19b891c2b098e1ea073649e2487938edac07e35b2888185fc5

SHA512
a0ac2bee85e6e542c098745773bdd79e83695f1d8c4eaafe5b15af5766fc08429b265ba4400cbe4850769cd4d7e70114bdb8a52b83e7a227a2b086a63af937ec

Download Submit
C:\Windows\system\mIbzmTd.exe

Filesize
2.2MB

MD5
a3e8719177fbe3bc96f470e04c0b1b01

SHA1
ade6b412c4394500249ad2c4913438ab7eeb3fe0

SHA256
45e5446be702ba79dd4d5ee75aa8c3f8a1697b6451060df77e4f87acd2438d0d

SHA512
b340fba3bde0edf0dd60af33645b9753316b771d7039c56665f5c4cb6bfc205bd59b2e1cfaecc06084b124ff20a24623f5fea1368aed5739f78a03843b53b895

Download Submit
C:\Windows\system\nEgnaGX.exe

Filesize
2.2MB

MD5
9b49032316651ad47e4ddb2d80b101a9

SHA1
8838a5cc3a228e19b504ce7e490666bf5840e50d

SHA256
da8fa56098e1056d58957c709d03d8c1d310335122400531da2ceb868f704d58

SHA512
a84f914defac41d140c6a88dc93d3b5f41970836d431674cdf1bd4e619d267a59aec3843d54b2a5fb9c3a65b0f3af2308d204eb93b745e70045de66f5693bf8b

Download Submit
C:\Windows\system\nbMDdfk.exe

Filesize
2.2MB

MD5
cfa0a93ab848454a23be68c39dc3caad

SHA1
a94dd31f703746f05f40f6382b5be1ed1e9fdd39

SHA256
abd046384f8739250c30a18268837a7c5c949b26c675c545cdcca762a1cbea87

SHA512
d3df542bbce5a42e7bfe36e13c48200e3ff414cc2ae5ba38bf8ecdd7b1837301160492aeaea8495c7ef37fe38b33cab2fff2b17b3c7c3658711c0035bc3c3a79

Download Submit
C:\Windows\system\oJHfXyo.exe

Filesize
2.2MB

MD5
0de3cbac3beeed2d5aec808d6c85c84b

SHA1
770d8937dec8a96c0cdd4656b1f5d17c77ee213a

SHA256
5a210941578d3bea530c14f0da9c75c7d6faad2ad246788b78c68767a0339e94

SHA512
f33a1ffb1fdb44a2ad69cc76b8d10b05f4acb33b6e04905ffc8220eda146318fbb55e517fe15df21c9cf7922e14dc117c783a140baf750994c96da9e21bb157e

Download Submit
C:\Windows\system\oNQRkOo.exe

Filesize
2.2MB

MD5
90e5111f4fbea35abe613ac5b6c6da72

SHA1
dfe310435c931c366670a1d1a796e21176f4e5bb

SHA256
9b25c4644c6e9e644d12c0342b957b9602369a59e39c9744aeff1912c5d385ae

SHA512
c3f0c12193cb11f4f07bf782201c1b3b60359645656a51bd5a367a8d3698ec991bce5dbfbbe424475b931024f7ca6476eeb9e2a2a0c084db825176b7f171b274

Download Submit
C:\Windows\system\rRVlIYZ.exe

Filesize
2.2MB

MD5
f88e2228dd83c26ff6d3e9979cf3c890

SHA1
ba58ef3c9bc8952a39200dac076f40d87267c897

SHA256
65c12199ae3d44365ac552fa957e33444d537f636005bb9231d15550646a8728

SHA512
75c0310d0bc1030b3a63e551d88400869f2f0c816e94ed48e378a4d19655b108ece95af36ab932f010d751615e53664ee55218a82868ff69ab66f56c119a70be

Download Submit
C:\Windows\system\sGlmxqg.exe

Filesize
2.2MB

MD5
4f47b5e9ae6c356fff579ccaca5de703

SHA1
bfd6add53001e5a64a114fd3af18ecce0c9635a8

SHA256
898fc50973db888d022350959f150428278d7afa92e6a71459eb412bac4acb4b

SHA512
b7f9f729fc6fbfc51afa9a1fa571dfef382495bb87506187ffc4704709d217dd73eb7161837dbddcba063902cdadc0f1fd70d0eace99ab21d8a19ec3cb369614

Download Submit
C:\Windows\system\vYmrXbZ.exe

Filesize
2.2MB

MD5
eba6b6e5b3957cbf8d2733113973671f

SHA1
41aec8c87c8d9e20d8d22a59ba20c244753fd218

SHA256
5a914cd5fc946856bfab7f8f222ca8b3047636f2f72660904141b0dd557bc88b

SHA512
3c75ca74f29b1eab931b4c5f8b319c0372540accbdaced9dcdb01da714924662ea0acdab55ad1109f0f704522d472d3588fff9fee0b217869dbf078db690b568

Download Submit
C:\Windows\system\wFDnQZF.exe

Filesize
2.2MB

MD5
fc71c8e18afc64dc76e5d11a5fc7b67a

SHA1
1a7ade649f84de4b294a55230450c00ff3c27e95

SHA256
275dfd67887bdefc3ffc6a4df837ba41a718a130b071ae8131ece671790f49c0

SHA512
886e56e53be511e8893cdf445ee86f2a45566011fe28ff032ff35604b33196e7bf726f422674c5a4c33c4dc9176e708ec75389aae3b12bb3f2c3502ef1179be3

Download Submit
\Windows\system\CSblBSR.exe

Filesize
2.2MB

MD5
6356dd5601208dfc53c655e61712ea97

SHA1
a9483a2a06c32dbaeaececfc516e8cc2720269fc

SHA256
c4606a257cb69232520adaa0556d904baa2d447789a3dda902f3b6e65af2d8f6

SHA512
48f191cc878173a26abc3b8ce8a99392674e2acfbb26ba9d05d474398cffbb68fcc9177e6313441ec0c02ea98b8a582df6639f5371e31704079952d82b827021

Download Submit
\Windows\system\WEXYvIZ.exe

Filesize
2.2MB

MD5
4f3d27b2089898e7fbb182ada43ecf04

SHA1
75de2bc2c4283ccf500a0b5a196244e0cff16ff4

SHA256
8dac63b98eeef32fa6edc361bb5f384f973d3c33fb91a5b318c069faee206651

SHA512
541a20d315ec3347791a178f822706f1c35b86374dcaf2b9638a24d77ab682e1faed22911d3b298e22e9f5471550c3e58c817d881c234e3113d9c151c87c0db6

Download Submit
\Windows\system\rZuGqVI.exe

Filesize
2.2MB

MD5
faf3581093d0c2b3a32a79f2b9873b2e

SHA1
5a6dac37d496a78f68a6e73bbfeb3bfbc13a8905

SHA256
6cb479c9fcb1fa75d99de31edbe79581843b28cb4f380f65c013d764d6d50ec4

SHA512
655b8b054fbbd7ba199839c3863bdd105bf274810f9c1d27d730b44c84b51a28d2c68389c0dffa15f5f42213dfd343b4381bf6156e572e0ec6f38bc583be0459

Download Submit
\Windows\system\tWTKyqq.exe

Filesize
2.2MB

MD5
815742b69b31dbbddd41a2605e341e32

SHA1
cc0a50c281ef947bd4bb6d57adde59257e46dbc5

SHA256
66f188d9c4fbf66c87d8101347e77fcd94aff2d17af90990f5845953aca8cadc

SHA512
08cdaacd1e23e0e8b1d9aa7c3cecbb80da93e894605d56cd12c2636a6982ac7d790e7799cc9b2e68437e0774b8ff5e3725bb0e2e654b58540d3e4ae44b91a5bf

Download Submit
memory/1264-113-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/1624-122-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/1728-13-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2108-107-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2260-115-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2376-258-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-14-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2376-105-0x000007FEF5320000-0x000007FEF5CBD000-memory.dmp

Filesize
9.6MB

Download
memory/2376-165-0x0000000002340000-0x0000000002348000-memory.dmp

Filesize
32KB

Download
memory/2376-106-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2376-164-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2608-119-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-111-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2644-109-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2648-117-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2844-110-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2844-123-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-108-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2844-114-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2844-0-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2844-121-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2844-112-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2844-12-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2844-116-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2844-118-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2844-124-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2844-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download