xmrig | 18aa1b65bed50e5bee14dba50bc677ccb01a408789af4a05df4439597562ae85

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
Size

1.8MB
MD5

033622df54a5ad9135c124a8c07716a1
SHA1

99dbad9eeca7a8487e4cdc979b1d4a8d384dfb8b
SHA256

18aa1b65bed50e5bee14dba50bc677ccb01a408789af4a05df4439597562ae85
SHA512

bee4247cff8d7cff5cb90f48aa229c192c3bbfd008f71cfed88186fe66bd1058967b44c5daff7956aa914eb0b0a3308d797966ced523e2dfd581d135daa99796
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4puWFA:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2960-177-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2624-174-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2644-172-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2712-170-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2620-168-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2496-184-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/1888-182-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2036	XspjivK.exe
2620	txEpdsB.exe
2712	MikvjFZ.exe
2644	AhpOyCc.exe
2624	lynLcru.exe
1580	TMyGzRg.exe
2960	smtXWks.exe
1888	EXffGBF.exe
2496	fUcVzVZ.exe
2524	TwtDJIb.exe
2552	PyRyGNO.exe
3064	MVSOBLu.exe
2804	KbxTPSO.exe
3056	gHZQRMD.exe
1636	zFEwJUv.exe
2940	NgGwFYJ.exe
2792	TKKWCIm.exe
2908	DSAtUDg.exe
1352	YiZmUNM.exe
2900	HVhYhpN.exe
2728	vQgRYux.exe
2888	HnXSiyR.exe
1372	tmfkmLP.exe
1412	pmjlJQl.exe
2124	zLfbDqV.exe
2100	KJBqJrD.exe
2884	EtJUwGu.exe
600	pNcnkZb.exe
1488	baJFVka.exe
564	nMDcJHL.exe
1060	hRterYG.exe
2104	dbfNOkY.exe
1100	oOmUyTO.exe
1172	TBjekyV.exe
1688	sXyTfMt.exe
2060	vefaTnM.exe
1684	SpETxeD.exe
2992	iMhRixT.exe
1548	mqyGzwj.exe
1212	QtdaVtf.exe
2416	vSnDUWc.exe
1508	uqgzVgV.exe
288	AojXHzn.exe
3008	KhbvOza.exe
2404	fRVSpfS.exe
2096	aEIusfX.exe
1760	thHgOaI.exe
1648	VGmWXal.exe
1708	hftLQYF.exe
2292	KgsaCwo.exe
2028	ujvxQJF.exe
2816	gpMPQQb.exe
2200	DAMkowe.exe
2548	TfnUOyK.exe
2812	OImJRtm.exe
1608	zdJtOsp.exe
2388	ReUCbqL.exe
2876	JVaYWjM.exe
540	jJpXmXq.exe
772	GGjHGfS.exe
1788	rsKJawB.exe
376	KVyhKIc.exe
2412	rWpxrvA.exe
1644	dbYeKVp.exe

Loads dropped DLL 64 IoCs

pid	Process
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2268-0-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-6.dat	upx
behavioral1/memory/2036-12-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/files/0x000b000000012303-16.dat	upx
behavioral1/files/0x000f000000005578-17.dat	upx
behavioral1/files/0x000800000001269d-28.dat	upx
behavioral1/files/0x00080000000126ab-41.dat	upx
behavioral1/files/0x0008000000013172-57.dat	upx
behavioral1/files/0x00070000000133a8-64.dat	upx
behavioral1/files/0x00070000000133b9-72.dat	upx
behavioral1/files/0x000b000000012713-46.dat	upx
behavioral1/files/0x0007000000013a11-104.dat	upx
behavioral1/files/0x00060000000141a2-130.dat	upx
behavioral1/files/0x00060000000142c4-144.dat	upx
behavioral1/files/0x0006000000014316-161.dat	upx
behavioral1/files/0x00060000000142b0-159.dat	upx
behavioral1/files/0x0006000000014390-155.dat	upx
behavioral1/memory/2960-177-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/1580-176-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2624-174-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2644-172-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2712-170-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2620-168-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x00060000000143ec-162.dat	upx
behavioral1/files/0x00060000000141e6-143.dat	upx
behavioral1/files/0x00060000000141c0-136.dat	upx
behavioral1/memory/2496-184-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/1888-182-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x000600000001447e-178.dat	upx
behavioral1/files/0x0006000000014120-126.dat	upx
behavioral1/files/0x0007000000013a71-120.dat	upx
behavioral1/files/0x0007000000013a21-116.dat	upx
behavioral1/files/0x00070000000139e0-114.dat	upx
behavioral1/files/0x00070000000139d8-102.dat	upx
behavioral1/files/0x00070000000139b4-96.dat	upx
behavioral1/files/0x000700000001342b-86.dat	upx
behavioral1/files/0x0007000000013928-90.dat	upx
behavioral1/files/0x00070000000133b0-84.dat	upx
behavioral1/files/0x000800000001329e-82.dat	upx
behavioral1/files/0x0008000000013113-56.dat	upx
behavioral1/files/0x0009000000012d51-50.dat	upx
behavioral1/files/0x0009000000012678-27.dat	upx
behavioral1/files/0x000b0000000126e1-38.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\YFHIKPT.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\etGSZdp.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\LgiTdNb.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\XtJDaHT.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\sOJeTsG.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\EHKyEWQ.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\rfYIrlo.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\DAMkowe.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\JVaYWjM.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\gLsZQdA.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\ZvJdQgR.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\KuktKaE.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\DtSxvUx.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\UdGxJKH.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\vqOYJWI.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\lUwLhfh.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\xKjllRZ.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\AsFFZyR.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\oMRgNDP.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\DrwdqwY.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\VVBapFD.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\NTzFKxm.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\CUknuDy.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\AHvpjvN.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\iQHlTUo.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\zmRdQFH.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\ZbJzfca.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\diJtpEX.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\zguDHWT.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\kXRzyoV.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\FgBkvrV.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\ezdmEZD.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\vIImqyb.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\zFEwJUv.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\QAsIaQD.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\bTBlAla.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\PRcnvFq.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\vQgRYux.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\FrdleCY.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\RNiqUWs.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\LgdfNef.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\wInuQFk.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\qUynrzW.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\KnSqLve.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\NzPSSbh.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\okRnRLB.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\TVbzJnq.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\loWajCu.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\baJFVka.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\ujiULvv.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\QMcJCLA.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\wUdtZjv.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\STyTXPO.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\AyqSRLW.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\qDkRWon.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\Lqbjowp.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\QtdaVtf.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\lflCjny.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\xhOxzde.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\YDgwJOa.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\KYlTYWo.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\fzYgZkd.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\NqpQgVe.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
File created	C:\Windows\System\MwTtsEA.exe	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2196	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2196	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2196	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	29
PID 2268 wrote to memory of 2036	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2036	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2036	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	30
PID 2268 wrote to memory of 2620	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2620	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2620	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	31
PID 2268 wrote to memory of 2712	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2712	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2712	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	32
PID 2268 wrote to memory of 2644	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	33
PID 2268 wrote to memory of 2644	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	33
PID 2268 wrote to memory of 2644	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	33
PID 2268 wrote to memory of 2624	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2624	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2624	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	34
PID 2268 wrote to memory of 2960	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	35
PID 2268 wrote to memory of 2960	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	35
PID 2268 wrote to memory of 2960	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	35
PID 2268 wrote to memory of 1580	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	36
PID 2268 wrote to memory of 1580	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	36
PID 2268 wrote to memory of 1580	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	36
PID 2268 wrote to memory of 1888	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	37
PID 2268 wrote to memory of 1888	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	37
PID 2268 wrote to memory of 1888	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	37
PID 2268 wrote to memory of 2496	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	38
PID 2268 wrote to memory of 2496	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	38
PID 2268 wrote to memory of 2496	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	38
PID 2268 wrote to memory of 2524	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	39
PID 2268 wrote to memory of 2524	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	39
PID 2268 wrote to memory of 2524	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	39
PID 2268 wrote to memory of 2552	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	40
PID 2268 wrote to memory of 2552	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	40
PID 2268 wrote to memory of 2552	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	40
PID 2268 wrote to memory of 3056	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	41
PID 2268 wrote to memory of 3056	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	41
PID 2268 wrote to memory of 3056	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	41
PID 2268 wrote to memory of 3064	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	42
PID 2268 wrote to memory of 3064	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	42
PID 2268 wrote to memory of 3064	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	42
PID 2268 wrote to memory of 1636	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	43
PID 2268 wrote to memory of 1636	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	43
PID 2268 wrote to memory of 1636	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	43
PID 2268 wrote to memory of 2804	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	44
PID 2268 wrote to memory of 2804	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	44
PID 2268 wrote to memory of 2804	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	44
PID 2268 wrote to memory of 2940	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	45
PID 2268 wrote to memory of 2940	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	45
PID 2268 wrote to memory of 2940	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	45
PID 2268 wrote to memory of 2792	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	46
PID 2268 wrote to memory of 2792	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	46
PID 2268 wrote to memory of 2792	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	46
PID 2268 wrote to memory of 2908	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	47
PID 2268 wrote to memory of 2908	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	47
PID 2268 wrote to memory of 2908	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	47
PID 2268 wrote to memory of 1352	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	48
PID 2268 wrote to memory of 1352	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	48
PID 2268 wrote to memory of 1352	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	48
PID 2268 wrote to memory of 2728	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	49
PID 2268 wrote to memory of 2728	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	49
PID 2268 wrote to memory of 2728	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	49
PID 2268 wrote to memory of 2900	2268	033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\033622df54a5ad9135c124a8c07716a1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\XspjivK.exe
  C:\Windows\System\XspjivK.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\txEpdsB.exe
  C:\Windows\System\txEpdsB.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\MikvjFZ.exe
  C:\Windows\System\MikvjFZ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\AhpOyCc.exe
  C:\Windows\System\AhpOyCc.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\lynLcru.exe
  C:\Windows\System\lynLcru.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\smtXWks.exe
  C:\Windows\System\smtXWks.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\TMyGzRg.exe
  C:\Windows\System\TMyGzRg.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\EXffGBF.exe
  C:\Windows\System\EXffGBF.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\fUcVzVZ.exe
  C:\Windows\System\fUcVzVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\TwtDJIb.exe
  C:\Windows\System\TwtDJIb.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\PyRyGNO.exe
  C:\Windows\System\PyRyGNO.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\gHZQRMD.exe
  C:\Windows\System\gHZQRMD.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\MVSOBLu.exe
  C:\Windows\System\MVSOBLu.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\zFEwJUv.exe
  C:\Windows\System\zFEwJUv.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\KbxTPSO.exe
  C:\Windows\System\KbxTPSO.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\NgGwFYJ.exe
  C:\Windows\System\NgGwFYJ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\TKKWCIm.exe
  C:\Windows\System\TKKWCIm.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\DSAtUDg.exe
  C:\Windows\System\DSAtUDg.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\YiZmUNM.exe
  C:\Windows\System\YiZmUNM.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\vQgRYux.exe
  C:\Windows\System\vQgRYux.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\HVhYhpN.exe
  C:\Windows\System\HVhYhpN.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\HnXSiyR.exe
  C:\Windows\System\HnXSiyR.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\tmfkmLP.exe
  C:\Windows\System\tmfkmLP.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\pmjlJQl.exe
  C:\Windows\System\pmjlJQl.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\zLfbDqV.exe
  C:\Windows\System\zLfbDqV.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\KJBqJrD.exe
  C:\Windows\System\KJBqJrD.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\EtJUwGu.exe
  C:\Windows\System\EtJUwGu.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\nMDcJHL.exe
  C:\Windows\System\nMDcJHL.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\pNcnkZb.exe
  C:\Windows\System\pNcnkZb.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\hRterYG.exe
  C:\Windows\System\hRterYG.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\baJFVka.exe
  C:\Windows\System\baJFVka.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\oOmUyTO.exe
  C:\Windows\System\oOmUyTO.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\dbfNOkY.exe
  C:\Windows\System\dbfNOkY.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\mqyGzwj.exe
  C:\Windows\System\mqyGzwj.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\TBjekyV.exe
  C:\Windows\System\TBjekyV.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\QtdaVtf.exe
  C:\Windows\System\QtdaVtf.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\sXyTfMt.exe
  C:\Windows\System\sXyTfMt.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\vSnDUWc.exe
  C:\Windows\System\vSnDUWc.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\vefaTnM.exe
  C:\Windows\System\vefaTnM.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\AojXHzn.exe
  C:\Windows\System\AojXHzn.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\SpETxeD.exe
  C:\Windows\System\SpETxeD.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\KhbvOza.exe
  C:\Windows\System\KhbvOza.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\iMhRixT.exe
  C:\Windows\System\iMhRixT.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\fRVSpfS.exe
  C:\Windows\System\fRVSpfS.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\uqgzVgV.exe
  C:\Windows\System\uqgzVgV.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\aEIusfX.exe
  C:\Windows\System\aEIusfX.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\thHgOaI.exe
  C:\Windows\System\thHgOaI.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\biRyDOU.exe
  C:\Windows\System\biRyDOU.exe
  2⤵
  PID:880
- C:\Windows\System\VGmWXal.exe
  C:\Windows\System\VGmWXal.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\xITuMEP.exe
  C:\Windows\System\xITuMEP.exe
  2⤵
  PID:1572
- C:\Windows\System\hftLQYF.exe
  C:\Windows\System\hftLQYF.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\IevROjl.exe
  C:\Windows\System\IevROjl.exe
  2⤵
  PID:2228
- C:\Windows\System\KgsaCwo.exe
  C:\Windows\System\KgsaCwo.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\qknVhFO.exe
  C:\Windows\System\qknVhFO.exe
  2⤵
  PID:2704
- C:\Windows\System\ujvxQJF.exe
  C:\Windows\System\ujvxQJF.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\qgcVVnz.exe
  C:\Windows\System\qgcVVnz.exe
  2⤵
  PID:2628
- C:\Windows\System\gpMPQQb.exe
  C:\Windows\System\gpMPQQb.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\ALHyXgx.exe
  C:\Windows\System\ALHyXgx.exe
  2⤵
  PID:2528
- C:\Windows\System\DAMkowe.exe
  C:\Windows\System\DAMkowe.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\MXjZtnW.exe
  C:\Windows\System\MXjZtnW.exe
  2⤵
  PID:2000
- C:\Windows\System\TfnUOyK.exe
  C:\Windows\System\TfnUOyK.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\BHUowqo.exe
  C:\Windows\System\BHUowqo.exe
  2⤵
  PID:1660
- C:\Windows\System\OImJRtm.exe
  C:\Windows\System\OImJRtm.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\HPJopAu.exe
  C:\Windows\System\HPJopAu.exe
  2⤵
  PID:2856
- C:\Windows\System\zdJtOsp.exe
  C:\Windows\System\zdJtOsp.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\uODhCPb.exe
  C:\Windows\System\uODhCPb.exe
  2⤵
  PID:2932
- C:\Windows\System\ReUCbqL.exe
  C:\Windows\System\ReUCbqL.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\wnydIzM.exe
  C:\Windows\System\wnydIzM.exe
  2⤵
  PID:1136
- C:\Windows\System\JVaYWjM.exe
  C:\Windows\System\JVaYWjM.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\CkeSOLv.exe
  C:\Windows\System\CkeSOLv.exe
  2⤵
  PID:1952
- C:\Windows\System\jJpXmXq.exe
  C:\Windows\System\jJpXmXq.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\SWIfIGU.exe
  C:\Windows\System\SWIfIGU.exe
  2⤵
  PID:620
- C:\Windows\System\GGjHGfS.exe
  C:\Windows\System\GGjHGfS.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\hSWZbnv.exe
  C:\Windows\System\hSWZbnv.exe
  2⤵
  PID:1068
- C:\Windows\System\rsKJawB.exe
  C:\Windows\System\rsKJawB.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\mowhTjQ.exe
  C:\Windows\System\mowhTjQ.exe
  2⤵
  PID:1140
- C:\Windows\System\KVyhKIc.exe
  C:\Windows\System\KVyhKIc.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\PvXyDCr.exe
  C:\Windows\System\PvXyDCr.exe
  2⤵
  PID:2760
- C:\Windows\System\rWpxrvA.exe
  C:\Windows\System\rWpxrvA.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\hozevNr.exe
  C:\Windows\System\hozevNr.exe
  2⤵
  PID:3036
- C:\Windows\System\dbYeKVp.exe
  C:\Windows\System\dbYeKVp.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\pPXwznB.exe
  C:\Windows\System\pPXwznB.exe
  2⤵
  PID:1048
- C:\Windows\System\TMPPYwr.exe
  C:\Windows\System\TMPPYwr.exe
  2⤵
  PID:2016
- C:\Windows\System\zwZYNFz.exe
  C:\Windows\System\zwZYNFz.exe
  2⤵
  PID:1520
- C:\Windows\System\WzjjlAd.exe
  C:\Windows\System\WzjjlAd.exe
  2⤵
  PID:2748
- C:\Windows\System\jZiDtxx.exe
  C:\Windows\System\jZiDtxx.exe
  2⤵
  PID:2916
- C:\Windows\System\kLRgSWz.exe
  C:\Windows\System\kLRgSWz.exe
  2⤵
  PID:2384
- C:\Windows\System\DtRMDFA.exe
  C:\Windows\System\DtRMDFA.exe
  2⤵
  PID:2516
- C:\Windows\System\YtRgsoj.exe
  C:\Windows\System\YtRgsoj.exe
  2⤵
  PID:1632
- C:\Windows\System\QAsIaQD.exe
  C:\Windows\System\QAsIaQD.exe
  2⤵
  PID:2612
- C:\Windows\System\RQTfbjZ.exe
  C:\Windows\System\RQTfbjZ.exe
  2⤵
  PID:2720
- C:\Windows\System\bxdAsTa.exe
  C:\Windows\System\bxdAsTa.exe
  2⤵
  PID:2880
- C:\Windows\System\TJwqsiQ.exe
  C:\Windows\System\TJwqsiQ.exe
  2⤵
  PID:1944
- C:\Windows\System\oXbrjrz.exe
  C:\Windows\System\oXbrjrz.exe
  2⤵
  PID:1096
- C:\Windows\System\NoviBxh.exe
  C:\Windows\System\NoviBxh.exe
  2⤵
  PID:2912
- C:\Windows\System\Lhqlhga.exe
  C:\Windows\System\Lhqlhga.exe
  2⤵
  PID:352
- C:\Windows\System\KCwOEPJ.exe
  C:\Windows\System\KCwOEPJ.exe
  2⤵
  PID:2088
- C:\Windows\System\BFkGHVx.exe
  C:\Windows\System\BFkGHVx.exe
  2⤵
  PID:2360
- C:\Windows\System\SfBFvdX.exe
  C:\Windows\System\SfBFvdX.exe
  2⤵
  PID:2352
- C:\Windows\System\wIwRGDy.exe
  C:\Windows\System\wIwRGDy.exe
  2⤵
  PID:2976
- C:\Windows\System\chxeeYd.exe
  C:\Windows\System\chxeeYd.exe
  2⤵
  PID:2080
- C:\Windows\System\GRatynu.exe
  C:\Windows\System\GRatynu.exe
  2⤵
  PID:1740
- C:\Windows\System\zpKomtT.exe
  C:\Windows\System\zpKomtT.exe
  2⤵
  PID:2796
- C:\Windows\System\kpDYZvS.exe
  C:\Windows\System\kpDYZvS.exe
  2⤵
  PID:1296
- C:\Windows\System\UKXaArQ.exe
  C:\Windows\System\UKXaArQ.exe
  2⤵
  PID:1600
- C:\Windows\System\HfxHpgT.exe
  C:\Windows\System\HfxHpgT.exe
  2⤵
  PID:3080
- C:\Windows\System\ymOSvlU.exe
  C:\Windows\System\ymOSvlU.exe
  2⤵
  PID:3096
- C:\Windows\System\MkskXOh.exe
  C:\Windows\System\MkskXOh.exe
  2⤵
  PID:3112
- C:\Windows\System\KEfSGgS.exe
  C:\Windows\System\KEfSGgS.exe
  2⤵
  PID:3128
- C:\Windows\System\JZfFKBb.exe
  C:\Windows\System\JZfFKBb.exe
  2⤵
  PID:3144
- C:\Windows\System\rQVKFBB.exe
  C:\Windows\System\rQVKFBB.exe
  2⤵
  PID:3160
- C:\Windows\System\etGSZdp.exe
  C:\Windows\System\etGSZdp.exe
  2⤵
  PID:3176
- C:\Windows\System\YUeuFUf.exe
  C:\Windows\System\YUeuFUf.exe
  2⤵
  PID:3192
- C:\Windows\System\FrdleCY.exe
  C:\Windows\System\FrdleCY.exe
  2⤵
  PID:3208
- C:\Windows\System\ynCHfek.exe
  C:\Windows\System\ynCHfek.exe
  2⤵
  PID:3224
- C:\Windows\System\gCmXJML.exe
  C:\Windows\System\gCmXJML.exe
  2⤵
  PID:3240
- C:\Windows\System\pGPXLoB.exe
  C:\Windows\System\pGPXLoB.exe
  2⤵
  PID:3256
- C:\Windows\System\TOodvZw.exe
  C:\Windows\System\TOodvZw.exe
  2⤵
  PID:3272
- C:\Windows\System\kLByorV.exe
  C:\Windows\System\kLByorV.exe
  2⤵
  PID:3288
- C:\Windows\System\PJVVmrm.exe
  C:\Windows\System\PJVVmrm.exe
  2⤵
  PID:3304
- C:\Windows\System\wGZidKu.exe
  C:\Windows\System\wGZidKu.exe
  2⤵
  PID:3320
- C:\Windows\System\eOWudWq.exe
  C:\Windows\System\eOWudWq.exe
  2⤵
  PID:3336
- C:\Windows\System\QAjNQuy.exe
  C:\Windows\System\QAjNQuy.exe
  2⤵
  PID:3352
- C:\Windows\System\fmEOUPh.exe
  C:\Windows\System\fmEOUPh.exe
  2⤵
  PID:3372
- C:\Windows\System\jFFHibi.exe
  C:\Windows\System\jFFHibi.exe
  2⤵
  PID:3388
- C:\Windows\System\yQhPvGx.exe
  C:\Windows\System\yQhPvGx.exe
  2⤵
  PID:3404
- C:\Windows\System\eHFZkfn.exe
  C:\Windows\System\eHFZkfn.exe
  2⤵
  PID:3420
- C:\Windows\System\pVSiFeE.exe
  C:\Windows\System\pVSiFeE.exe
  2⤵
  PID:3436
- C:\Windows\System\WcwVNQl.exe
  C:\Windows\System\WcwVNQl.exe
  2⤵
  PID:3452
- C:\Windows\System\AvUhFfx.exe
  C:\Windows\System\AvUhFfx.exe
  2⤵
  PID:3468
- C:\Windows\System\eWdaMYN.exe
  C:\Windows\System\eWdaMYN.exe
  2⤵
  PID:3484
- C:\Windows\System\KnSqLve.exe
  C:\Windows\System\KnSqLve.exe
  2⤵
  PID:3500
- C:\Windows\System\FkfBXEC.exe
  C:\Windows\System\FkfBXEC.exe
  2⤵
  PID:3516
- C:\Windows\System\LgiTdNb.exe
  C:\Windows\System\LgiTdNb.exe
  2⤵
  PID:3532
- C:\Windows\System\mrHOghy.exe
  C:\Windows\System\mrHOghy.exe
  2⤵
  PID:3548
- C:\Windows\System\gRHghpr.exe
  C:\Windows\System\gRHghpr.exe
  2⤵
  PID:3564
- C:\Windows\System\XtJDaHT.exe
  C:\Windows\System\XtJDaHT.exe
  2⤵
  PID:3580
- C:\Windows\System\Kkwgvla.exe
  C:\Windows\System\Kkwgvla.exe
  2⤵
  PID:3596
- C:\Windows\System\zmRdQFH.exe
  C:\Windows\System\zmRdQFH.exe
  2⤵
  PID:3612
- C:\Windows\System\lZPIFKL.exe
  C:\Windows\System\lZPIFKL.exe
  2⤵
  PID:3628
- C:\Windows\System\FNLiGDK.exe
  C:\Windows\System\FNLiGDK.exe
  2⤵
  PID:3644
- C:\Windows\System\FGIvpBQ.exe
  C:\Windows\System\FGIvpBQ.exe
  2⤵
  PID:3660
- C:\Windows\System\mbIjYro.exe
  C:\Windows\System\mbIjYro.exe
  2⤵
  PID:3676
- C:\Windows\System\sruNOFt.exe
  C:\Windows\System\sruNOFt.exe
  2⤵
  PID:3692
- C:\Windows\System\ZVyhZFV.exe
  C:\Windows\System\ZVyhZFV.exe
  2⤵
  PID:3708
- C:\Windows\System\uAcPpHm.exe
  C:\Windows\System\uAcPpHm.exe
  2⤵
  PID:3724
- C:\Windows\System\OaKgCJF.exe
  C:\Windows\System\OaKgCJF.exe
  2⤵
  PID:3740
- C:\Windows\System\QxFOyjX.exe
  C:\Windows\System\QxFOyjX.exe
  2⤵
  PID:3756
- C:\Windows\System\tIDKbkE.exe
  C:\Windows\System\tIDKbkE.exe
  2⤵
  PID:3772
- C:\Windows\System\lUwLhfh.exe
  C:\Windows\System\lUwLhfh.exe
  2⤵
  PID:3788
- C:\Windows\System\axHzOtQ.exe
  C:\Windows\System\axHzOtQ.exe
  2⤵
  PID:3804
- C:\Windows\System\NQAcytR.exe
  C:\Windows\System\NQAcytR.exe
  2⤵
  PID:3820
- C:\Windows\System\gxqIomi.exe
  C:\Windows\System\gxqIomi.exe
  2⤵
  PID:3836
- C:\Windows\System\WeDiNLu.exe
  C:\Windows\System\WeDiNLu.exe
  2⤵
  PID:3852
- C:\Windows\System\SnTjgRu.exe
  C:\Windows\System\SnTjgRu.exe
  2⤵
  PID:3868
- C:\Windows\System\ZXKzHDC.exe
  C:\Windows\System\ZXKzHDC.exe
  2⤵
  PID:3884
- C:\Windows\System\FVtNHls.exe
  C:\Windows\System\FVtNHls.exe
  2⤵
  PID:3904
- C:\Windows\System\UTjMuaa.exe
  C:\Windows\System\UTjMuaa.exe
  2⤵
  PID:3920
- C:\Windows\System\qcQqKhJ.exe
  C:\Windows\System\qcQqKhJ.exe
  2⤵
  PID:3936
- C:\Windows\System\NDEhOTu.exe
  C:\Windows\System\NDEhOTu.exe
  2⤵
  PID:3952
- C:\Windows\System\SeNOpds.exe
  C:\Windows\System\SeNOpds.exe
  2⤵
  PID:3968
- C:\Windows\System\BwfiZNn.exe
  C:\Windows\System\BwfiZNn.exe
  2⤵
  PID:3984
- C:\Windows\System\BIVJfDE.exe
  C:\Windows\System\BIVJfDE.exe
  2⤵
  PID:4000
- C:\Windows\System\ftxhzyG.exe
  C:\Windows\System\ftxhzyG.exe
  2⤵
  PID:4016
- C:\Windows\System\cESaUGE.exe
  C:\Windows\System\cESaUGE.exe
  2⤵
  PID:4032
- C:\Windows\System\QuMSQPI.exe
  C:\Windows\System\QuMSQPI.exe
  2⤵
  PID:4048
- C:\Windows\System\lOkBNjr.exe
  C:\Windows\System\lOkBNjr.exe
  2⤵
  PID:4064
- C:\Windows\System\NOxpFZp.exe
  C:\Windows\System\NOxpFZp.exe
  2⤵
  PID:4080
- C:\Windows\System\IMIEbsf.exe
  C:\Windows\System\IMIEbsf.exe
  2⤵
  PID:1616
- C:\Windows\System\YNgEams.exe
  C:\Windows\System\YNgEams.exe
  2⤵
  PID:3104
- C:\Windows\System\uIVwufH.exe
  C:\Windows\System\uIVwufH.exe
  2⤵
  PID:3168
- C:\Windows\System\jAtUdsU.exe
  C:\Windows\System\jAtUdsU.exe
  2⤵
  PID:3232
- C:\Windows\System\ehuvlFr.exe
  C:\Windows\System\ehuvlFr.exe
  2⤵
  PID:3296
- C:\Windows\System\OzwLhrd.exe
  C:\Windows\System\OzwLhrd.exe
  2⤵
  PID:3028
- C:\Windows\System\cSefcHg.exe
  C:\Windows\System\cSefcHg.exe
  2⤵
  PID:2092
- C:\Windows\System\KUJrydo.exe
  C:\Windows\System\KUJrydo.exe
  2⤵
  PID:4112
- C:\Windows\System\VLAYmql.exe
  C:\Windows\System\VLAYmql.exe
  2⤵
  PID:4128
- C:\Windows\System\QGoVbuo.exe
  C:\Windows\System\QGoVbuo.exe
  2⤵
  PID:4144
- C:\Windows\System\LmscUKy.exe
  C:\Windows\System\LmscUKy.exe
  2⤵
  PID:4160
- C:\Windows\System\XMvFQIB.exe
  C:\Windows\System\XMvFQIB.exe
  2⤵
  PID:4176
- C:\Windows\System\cXHlmxK.exe
  C:\Windows\System\cXHlmxK.exe
  2⤵
  PID:4192
- C:\Windows\System\GuTQUFb.exe
  C:\Windows\System\GuTQUFb.exe
  2⤵
  PID:4208
- C:\Windows\System\RwKrQau.exe
  C:\Windows\System\RwKrQau.exe
  2⤵
  PID:4224
- C:\Windows\System\fOiiQZX.exe
  C:\Windows\System\fOiiQZX.exe
  2⤵
  PID:4240
- C:\Windows\System\PFeHVUx.exe
  C:\Windows\System\PFeHVUx.exe
  2⤵
  PID:4256
- C:\Windows\System\BxCPeaC.exe
  C:\Windows\System\BxCPeaC.exe
  2⤵
  PID:4272
- C:\Windows\System\henLjNu.exe
  C:\Windows\System\henLjNu.exe
  2⤵
  PID:4288
- C:\Windows\System\lflCjny.exe
  C:\Windows\System\lflCjny.exe
  2⤵
  PID:4304
- C:\Windows\System\wmZrzYZ.exe
  C:\Windows\System\wmZrzYZ.exe
  2⤵
  PID:4320
- C:\Windows\System\WDVsPxA.exe
  C:\Windows\System\WDVsPxA.exe
  2⤵
  PID:4336
- C:\Windows\System\bbHRTlq.exe
  C:\Windows\System\bbHRTlq.exe
  2⤵
  PID:4352
- C:\Windows\System\ozgWfSd.exe
  C:\Windows\System\ozgWfSd.exe
  2⤵
  PID:4368
- C:\Windows\System\uBDItIC.exe
  C:\Windows\System\uBDItIC.exe
  2⤵
  PID:4384
- C:\Windows\System\BIFmWeW.exe
  C:\Windows\System\BIFmWeW.exe
  2⤵
  PID:4400
- C:\Windows\System\ThzmEwN.exe
  C:\Windows\System\ThzmEwN.exe
  2⤵
  PID:4416
- C:\Windows\System\GdRmSoJ.exe
  C:\Windows\System\GdRmSoJ.exe
  2⤵
  PID:4432
- C:\Windows\System\BOkXtya.exe
  C:\Windows\System\BOkXtya.exe
  2⤵
  PID:4448
- C:\Windows\System\SSqvRjR.exe
  C:\Windows\System\SSqvRjR.exe
  2⤵
  PID:4464
- C:\Windows\System\DexwwiL.exe
  C:\Windows\System\DexwwiL.exe
  2⤵
  PID:4480
- C:\Windows\System\eLLSwuC.exe
  C:\Windows\System\eLLSwuC.exe
  2⤵
  PID:4496
- C:\Windows\System\WymqNEq.exe
  C:\Windows\System\WymqNEq.exe
  2⤵
  PID:4512
- C:\Windows\System\fdATdIA.exe
  C:\Windows\System\fdATdIA.exe
  2⤵
  PID:4528
- C:\Windows\System\vgodUDA.exe
  C:\Windows\System\vgodUDA.exe
  2⤵
  PID:4544
- C:\Windows\System\zRspIZn.exe
  C:\Windows\System\zRspIZn.exe
  2⤵
  PID:4560
- C:\Windows\System\HpVClvK.exe
  C:\Windows\System\HpVClvK.exe
  2⤵
  PID:4576
- C:\Windows\System\dTlRcue.exe
  C:\Windows\System\dTlRcue.exe
  2⤵
  PID:4592
- C:\Windows\System\gJmXVjI.exe
  C:\Windows\System\gJmXVjI.exe
  2⤵
  PID:4608
- C:\Windows\System\MBlAIhe.exe
  C:\Windows\System\MBlAIhe.exe
  2⤵
  PID:4624
- C:\Windows\System\PhyXJdv.exe
  C:\Windows\System\PhyXJdv.exe
  2⤵
  PID:4640
- C:\Windows\System\YVajoaW.exe
  C:\Windows\System\YVajoaW.exe
  2⤵
  PID:4656
- C:\Windows\System\tPvtKYC.exe
  C:\Windows\System\tPvtKYC.exe
  2⤵
  PID:4672
- C:\Windows\System\YoojXyM.exe
  C:\Windows\System\YoojXyM.exe
  2⤵
  PID:4688
- C:\Windows\System\oKguIWv.exe
  C:\Windows\System\oKguIWv.exe
  2⤵
  PID:4704
- C:\Windows\System\VVBapFD.exe
  C:\Windows\System\VVBapFD.exe
  2⤵
  PID:4720
- C:\Windows\System\VlLRubi.exe
  C:\Windows\System\VlLRubi.exe
  2⤵
  PID:4884
- C:\Windows\System\seclIWu.exe
  C:\Windows\System\seclIWu.exe
  2⤵
  PID:4904
- C:\Windows\System\WbFXUzq.exe
  C:\Windows\System\WbFXUzq.exe
  2⤵
  PID:4920
- C:\Windows\System\FhYRnXg.exe
  C:\Windows\System\FhYRnXg.exe
  2⤵
  PID:4936
- C:\Windows\System\cuczgJM.exe
  C:\Windows\System\cuczgJM.exe
  2⤵
  PID:4952
- C:\Windows\System\ujiULvv.exe
  C:\Windows\System\ujiULvv.exe
  2⤵
  PID:4968
- C:\Windows\System\jxrxnxn.exe
  C:\Windows\System\jxrxnxn.exe
  2⤵
  PID:4984
- C:\Windows\System\ngTeWZp.exe
  C:\Windows\System\ngTeWZp.exe
  2⤵
  PID:5000
- C:\Windows\System\BFsdzpK.exe
  C:\Windows\System\BFsdzpK.exe
  2⤵
  PID:5024
- C:\Windows\System\IkurFDI.exe
  C:\Windows\System\IkurFDI.exe
  2⤵
  PID:5040
- C:\Windows\System\knxsPyT.exe
  C:\Windows\System\knxsPyT.exe
  2⤵
  PID:5056
- C:\Windows\System\xnbbBKL.exe
  C:\Windows\System\xnbbBKL.exe
  2⤵
  PID:3496
- C:\Windows\System\caxeaZk.exe
  C:\Windows\System\caxeaZk.exe
  2⤵
  PID:3588
- C:\Windows\System\QfyVsor.exe
  C:\Windows\System\QfyVsor.exe
  2⤵
  PID:3652
- C:\Windows\System\QGQCPNm.exe
  C:\Windows\System\QGQCPNm.exe
  2⤵
  PID:3716
- C:\Windows\System\QMcJCLA.exe
  C:\Windows\System\QMcJCLA.exe
  2⤵
  PID:3752
- C:\Windows\System\dsZoIkl.exe
  C:\Windows\System\dsZoIkl.exe
  2⤵
  PID:3816
- C:\Windows\System\RGLrfwq.exe
  C:\Windows\System\RGLrfwq.exe
  2⤵
  PID:3880
- C:\Windows\System\yUpsvwS.exe
  C:\Windows\System\yUpsvwS.exe
  2⤵
  PID:3948
- C:\Windows\System\KuktKaE.exe
  C:\Windows\System\KuktKaE.exe
  2⤵
  PID:4040
- C:\Windows\System\WZZnbCy.exe
  C:\Windows\System\WZZnbCy.exe
  2⤵
  PID:3060
- C:\Windows\System\EviLofV.exe
  C:\Windows\System\EviLofV.exe
  2⤵
  PID:2144
- C:\Windows\System\XjSESwL.exe
  C:\Windows\System\XjSESwL.exe
  2⤵
  PID:4136
- C:\Windows\System\CDMDztk.exe
  C:\Windows\System\CDMDztk.exe
  2⤵
  PID:4200
- C:\Windows\System\uBFSHFb.exe
  C:\Windows\System\uBFSHFb.exe
  2⤵
  PID:4264
- C:\Windows\System\uLBxEfa.exe
  C:\Windows\System\uLBxEfa.exe
  2⤵
  PID:4328
- C:\Windows\System\EEOpMsd.exe
  C:\Windows\System\EEOpMsd.exe
  2⤵
  PID:4396
- C:\Windows\System\wUdtZjv.exe
  C:\Windows\System\wUdtZjv.exe
  2⤵
  PID:4460
- C:\Windows\System\ARDWDPf.exe
  C:\Windows\System\ARDWDPf.exe
  2⤵
  PID:4524
- C:\Windows\System\TwbpHkU.exe
  C:\Windows\System\TwbpHkU.exe
  2⤵
  PID:2872
- C:\Windows\System\bUdDTsK.exe
  C:\Windows\System\bUdDTsK.exe
  2⤵
  PID:1768
- C:\Windows\System\DUeOmVH.exe
  C:\Windows\System\DUeOmVH.exe
  2⤵
  PID:2220
- C:\Windows\System\bvaVIgt.exe
  C:\Windows\System\bvaVIgt.exe
  2⤵
  PID:576
- C:\Windows\System\nWtuZpn.exe
  C:\Windows\System\nWtuZpn.exe
  2⤵
  PID:2504
- C:\Windows\System\sddTRBG.exe
  C:\Windows\System\sddTRBG.exe
  2⤵
  PID:2588
- C:\Windows\System\bfYFBvS.exe
  C:\Windows\System\bfYFBvS.exe
  2⤵
  PID:696
- C:\Windows\System\fdcKQlQ.exe
  C:\Windows\System\fdcKQlQ.exe
  2⤵
  PID:2844
- C:\Windows\System\wOxdOic.exe
  C:\Windows\System\wOxdOic.exe
  2⤵
  PID:3120
- C:\Windows\System\wQmXPDw.exe
  C:\Windows\System\wQmXPDw.exe
  2⤵
  PID:3184
- C:\Windows\System\ULssjLQ.exe
  C:\Windows\System\ULssjLQ.exe
  2⤵
  PID:3248
- C:\Windows\System\Aetquvp.exe
  C:\Windows\System\Aetquvp.exe
  2⤵
  PID:3316
- C:\Windows\System\iMXdbvR.exe
  C:\Windows\System\iMXdbvR.exe
  2⤵
  PID:3384
- C:\Windows\System\hflikPs.exe
  C:\Windows\System\hflikPs.exe
  2⤵
  PID:3448
- C:\Windows\System\XMsTBRG.exe
  C:\Windows\System\XMsTBRG.exe
  2⤵
  PID:3512
- C:\Windows\System\EJWjJKt.exe
  C:\Windows\System\EJWjJKt.exe
  2⤵
  PID:3572
- C:\Windows\System\wQHJWDI.exe
  C:\Windows\System\wQHJWDI.exe
  2⤵
  PID:3636
- C:\Windows\System\BgrGuWa.exe
  C:\Windows\System\BgrGuWa.exe
  2⤵
  PID:2684
- C:\Windows\System\jJsFxRv.exe
  C:\Windows\System\jJsFxRv.exe
  2⤵
  PID:4892
- C:\Windows\System\eACoDzB.exe
  C:\Windows\System\eACoDzB.exe
  2⤵
  PID:3800
- C:\Windows\System\xKskVsL.exe
  C:\Windows\System\xKskVsL.exe
  2⤵
  PID:3864
- C:\Windows\System\HhCIAEK.exe
  C:\Windows\System\HhCIAEK.exe
  2⤵
  PID:4900
- C:\Windows\System\JSQTBBa.exe
  C:\Windows\System\JSQTBBa.exe
  2⤵
  PID:3004
- C:\Windows\System\gltqKnV.exe
  C:\Windows\System\gltqKnV.exe
  2⤵
  PID:3992
- C:\Windows\System\sSoGSzo.exe
  C:\Windows\System\sSoGSzo.exe
  2⤵
  PID:5136
- C:\Windows\System\lYgQJox.exe
  C:\Windows\System\lYgQJox.exe
  2⤵
  PID:5152
- C:\Windows\System\spBjHoB.exe
  C:\Windows\System\spBjHoB.exe
  2⤵
  PID:5168
- C:\Windows\System\DFjFaLi.exe
  C:\Windows\System\DFjFaLi.exe
  2⤵
  PID:5184
- C:\Windows\System\nYSYHUp.exe
  C:\Windows\System\nYSYHUp.exe
  2⤵
  PID:5200
- C:\Windows\System\TDRrUwB.exe
  C:\Windows\System\TDRrUwB.exe
  2⤵
  PID:5216
- C:\Windows\System\CZJsmOR.exe
  C:\Windows\System\CZJsmOR.exe
  2⤵
  PID:5232
- C:\Windows\System\ccwTYYD.exe
  C:\Windows\System\ccwTYYD.exe
  2⤵
  PID:5248
- C:\Windows\System\tsqnYoW.exe
  C:\Windows\System\tsqnYoW.exe
  2⤵
  PID:5264
- C:\Windows\System\PuWbKug.exe
  C:\Windows\System\PuWbKug.exe
  2⤵
  PID:5280
- C:\Windows\System\YfJHdnt.exe
  C:\Windows\System\YfJHdnt.exe
  2⤵
  PID:5296
- C:\Windows\System\zfSxOZd.exe
  C:\Windows\System\zfSxOZd.exe
  2⤵
  PID:5312
- C:\Windows\System\iceejMW.exe
  C:\Windows\System\iceejMW.exe
  2⤵
  PID:5328
- C:\Windows\System\JmYUVkY.exe
  C:\Windows\System\JmYUVkY.exe
  2⤵
  PID:5344
- C:\Windows\System\znCJndR.exe
  C:\Windows\System\znCJndR.exe
  2⤵
  PID:5360
- C:\Windows\System\BAiUeuw.exe
  C:\Windows\System\BAiUeuw.exe
  2⤵
  PID:5376
- C:\Windows\System\VYxAqGB.exe
  C:\Windows\System\VYxAqGB.exe
  2⤵
  PID:5392
- C:\Windows\System\iASuaPV.exe
  C:\Windows\System\iASuaPV.exe
  2⤵
  PID:5408
- C:\Windows\System\oTBTGXK.exe
  C:\Windows\System\oTBTGXK.exe
  2⤵
  PID:5424
- C:\Windows\System\ypvKMoo.exe
  C:\Windows\System\ypvKMoo.exe
  2⤵
  PID:5440
- C:\Windows\System\zKKtSZK.exe
  C:\Windows\System\zKKtSZK.exe
  2⤵
  PID:5456
- C:\Windows\System\zSpFZEk.exe
  C:\Windows\System\zSpFZEk.exe
  2⤵
  PID:5472
- C:\Windows\System\INcRvYD.exe
  C:\Windows\System\INcRvYD.exe
  2⤵
  PID:5488
- C:\Windows\System\jGXDmmw.exe
  C:\Windows\System\jGXDmmw.exe
  2⤵
  PID:5504
- C:\Windows\System\cDObCGF.exe
  C:\Windows\System\cDObCGF.exe
  2⤵
  PID:5520
- C:\Windows\System\soIvROL.exe
  C:\Windows\System\soIvROL.exe
  2⤵
  PID:5536
- C:\Windows\System\uIcHQKB.exe
  C:\Windows\System\uIcHQKB.exe
  2⤵
  PID:5552
- C:\Windows\System\voWqPgz.exe
  C:\Windows\System\voWqPgz.exe
  2⤵
  PID:5568
- C:\Windows\System\ZufJzhP.exe
  C:\Windows\System\ZufJzhP.exe
  2⤵
  PID:5584
- C:\Windows\System\KyBDOsv.exe
  C:\Windows\System\KyBDOsv.exe
  2⤵
  PID:5600
- C:\Windows\System\vGlDPof.exe
  C:\Windows\System\vGlDPof.exe
  2⤵
  PID:5616
- C:\Windows\System\DLqSSnE.exe
  C:\Windows\System\DLqSSnE.exe
  2⤵
  PID:5632
- C:\Windows\System\vCaJyhu.exe
  C:\Windows\System\vCaJyhu.exe
  2⤵
  PID:5648
- C:\Windows\System\rQoCBwy.exe
  C:\Windows\System\rQoCBwy.exe
  2⤵
  PID:5664
- C:\Windows\System\vIImqyb.exe
  C:\Windows\System\vIImqyb.exe
  2⤵
  PID:5680
- C:\Windows\System\rZMwiqj.exe
  C:\Windows\System\rZMwiqj.exe
  2⤵
  PID:5696
- C:\Windows\System\lFqvhqw.exe
  C:\Windows\System\lFqvhqw.exe
  2⤵
  PID:5712
- C:\Windows\System\NTzFKxm.exe
  C:\Windows\System\NTzFKxm.exe
  2⤵
  PID:5728
- C:\Windows\System\cGySWqi.exe
  C:\Windows\System\cGySWqi.exe
  2⤵
  PID:5744
- C:\Windows\System\VgjMIGj.exe
  C:\Windows\System\VgjMIGj.exe
  2⤵
  PID:5760
- C:\Windows\System\WlrIesp.exe
  C:\Windows\System\WlrIesp.exe
  2⤵
  PID:5776
- C:\Windows\System\rdDKngl.exe
  C:\Windows\System\rdDKngl.exe
  2⤵
  PID:5792
- C:\Windows\System\PfbjoVR.exe
  C:\Windows\System\PfbjoVR.exe
  2⤵
  PID:5808
- C:\Windows\System\EnRfoZF.exe
  C:\Windows\System\EnRfoZF.exe
  2⤵
  PID:5824
- C:\Windows\System\gqtkTWv.exe
  C:\Windows\System\gqtkTWv.exe
  2⤵
  PID:5844
- C:\Windows\System\bPsGuqg.exe
  C:\Windows\System\bPsGuqg.exe
  2⤵
  PID:5916
- C:\Windows\System\WUSvuOc.exe
  C:\Windows\System\WUSvuOc.exe
  2⤵
  PID:5932
- C:\Windows\System\InThSPq.exe
  C:\Windows\System\InThSPq.exe
  2⤵
  PID:5948
- C:\Windows\System\mifuqZv.exe
  C:\Windows\System\mifuqZv.exe
  2⤵
  PID:5964
- C:\Windows\System\MtwEdgy.exe
  C:\Windows\System\MtwEdgy.exe
  2⤵
  PID:5980
- C:\Windows\System\EhnPWdd.exe
  C:\Windows\System\EhnPWdd.exe
  2⤵
  PID:6004
- C:\Windows\System\eiVvBkO.exe
  C:\Windows\System\eiVvBkO.exe
  2⤵
  PID:6020
- C:\Windows\System\JtfChSo.exe
  C:\Windows\System\JtfChSo.exe
  2⤵
  PID:6036
- C:\Windows\System\aPlSsDv.exe
  C:\Windows\System\aPlSsDv.exe
  2⤵
  PID:6052
- C:\Windows\System\lIIJLzG.exe
  C:\Windows\System\lIIJLzG.exe
  2⤵
  PID:6068
- C:\Windows\System\tXfxlhs.exe
  C:\Windows\System\tXfxlhs.exe
  2⤵
  PID:6084
- C:\Windows\System\okRnRLB.exe
  C:\Windows\System\okRnRLB.exe
  2⤵
  PID:6100
- C:\Windows\System\tqDppYV.exe
  C:\Windows\System\tqDppYV.exe
  2⤵
  PID:6120
- C:\Windows\System\pxFCBei.exe
  C:\Windows\System\pxFCBei.exe
  2⤵
  PID:6136
- C:\Windows\System\PPNjuvQ.exe
  C:\Windows\System\PPNjuvQ.exe
  2⤵
  PID:4028
- C:\Windows\System\DvzjBAT.exe
  C:\Windows\System\DvzjBAT.exe
  2⤵
  PID:4960
- C:\Windows\System\HipwgEn.exe
  C:\Windows\System\HipwgEn.exe
  2⤵
  PID:5032
- C:\Windows\System\STyTXPO.exe
  C:\Windows\System\STyTXPO.exe
  2⤵
  PID:5072
- C:\Windows\System\kCenKJQ.exe
  C:\Windows\System\kCenKJQ.exe
  2⤵
  PID:5088
- C:\Windows\System\SIExRsX.exe
  C:\Windows\System\SIExRsX.exe
  2⤵
  PID:5104
- C:\Windows\System\EnIyXoU.exe
  C:\Windows\System\EnIyXoU.exe
  2⤵
  PID:1960
- C:\Windows\System\ImYLhVS.exe
  C:\Windows\System\ImYLhVS.exe
  2⤵
  PID:2680
- C:\Windows\System\lCYeviZ.exe
  C:\Windows\System\lCYeviZ.exe
  2⤵
  PID:1756
- C:\Windows\System\nObRdgc.exe
  C:\Windows\System\nObRdgc.exe
  2⤵
  PID:1728
- C:\Windows\System\uSEOwHF.exe
  C:\Windows\System\uSEOwHF.exe
  2⤵
  PID:2784
- C:\Windows\System\ztdBeUL.exe
  C:\Windows\System\ztdBeUL.exe
  2⤵
  PID:3368
- C:\Windows\System\XNfGchf.exe
  C:\Windows\System\XNfGchf.exe
  2⤵
  PID:3432
- C:\Windows\System\xKjllRZ.exe
  C:\Windows\System\xKjllRZ.exe
  2⤵
  PID:3592
- C:\Windows\System\WHZAObZ.exe
  C:\Windows\System\WHZAObZ.exe
  2⤵
  PID:4012
- C:\Windows\System\wnYilkp.exe
  C:\Windows\System\wnYilkp.exe
  2⤵
  PID:1424
- C:\Windows\System\XadDWOB.exe
  C:\Windows\System\XadDWOB.exe
  2⤵
  PID:3216
- C:\Windows\System\tKgIhoF.exe
  C:\Windows\System\tKgIhoF.exe
  2⤵
  PID:3480
- C:\Windows\System\XXrwtxu.exe
  C:\Windows\System\XXrwtxu.exe
  2⤵
  PID:3704
- C:\Windows\System\OYJWhRB.exe
  C:\Windows\System\OYJWhRB.exe
  2⤵
  PID:4928
- C:\Windows\System\jSJFRVP.exe
  C:\Windows\System\jSJFRVP.exe
  2⤵
  PID:1504
- C:\Windows\System\xTPLGsZ.exe
  C:\Windows\System\xTPLGsZ.exe
  2⤵
  PID:2172
- C:\Windows\System\Aqvzfre.exe
  C:\Windows\System\Aqvzfre.exe
  2⤵
  PID:3092
- C:\Windows\System\PIfXZND.exe
  C:\Windows\System\PIfXZND.exe
  2⤵
  PID:2700
- C:\Windows\System\Wttehzn.exe
  C:\Windows\System\Wttehzn.exe
  2⤵
  PID:2944
- C:\Windows\System\GODIptP.exe
  C:\Windows\System\GODIptP.exe
  2⤵
  PID:4216
- C:\Windows\System\ZnjkuEu.exe
  C:\Windows\System\ZnjkuEu.exe
  2⤵
  PID:5260
- C:\Windows\System\cCOkgVS.exe
  C:\Windows\System\cCOkgVS.exe
  2⤵
  PID:5448
- C:\Windows\System\rjixZMm.exe
  C:\Windows\System\rjixZMm.exe
  2⤵
  PID:5452
- C:\Windows\System\FgBkvrV.exe
  C:\Windows\System\FgBkvrV.exe
  2⤵
  PID:5576
- C:\Windows\System\IBkYpRI.exe
  C:\Windows\System\IBkYpRI.exe
  2⤵
  PID:5640
- C:\Windows\System\alvniZv.exe
  C:\Windows\System\alvniZv.exe
  2⤵
  PID:5704
- C:\Windows\System\rGpaTdb.exe
  C:\Windows\System\rGpaTdb.exe
  2⤵
  PID:5768
- C:\Windows\System\OFkkOQj.exe
  C:\Windows\System\OFkkOQj.exe
  2⤵
  PID:5832
- C:\Windows\System\tRMUCkU.exe
  C:\Windows\System\tRMUCkU.exe
  2⤵
  PID:4604
- C:\Windows\System\NzPSSbh.exe
  C:\Windows\System\NzPSSbh.exe
  2⤵
  PID:4696
- C:\Windows\System\rrFyLud.exe
  C:\Windows\System\rrFyLud.exe
  2⤵
  PID:584
- C:\Windows\System\AsFFZyR.exe
  C:\Windows\System\AsFFZyR.exe
  2⤵
  PID:4748
- C:\Windows\System\AobAvOs.exe
  C:\Windows\System\AobAvOs.exe
  2⤵
  PID:4764
- C:\Windows\System\vXanlrQ.exe
  C:\Windows\System\vXanlrQ.exe
  2⤵
  PID:4780
- C:\Windows\System\JvqUlTR.exe
  C:\Windows\System\JvqUlTR.exe
  2⤵
  PID:4804
- C:\Windows\System\hzwSwHk.exe
  C:\Windows\System\hzwSwHk.exe
  2⤵
  PID:4824
- C:\Windows\System\pXLvkGU.exe
  C:\Windows\System\pXLvkGU.exe
  2⤵
  PID:4840
- C:\Windows\System\oMRgNDP.exe
  C:\Windows\System\oMRgNDP.exe
  2⤵
  PID:4856
- C:\Windows\System\TvwjsSa.exe
  C:\Windows\System\TvwjsSa.exe
  2⤵
  PID:4872
- C:\Windows\System\TsKhqvz.exe
  C:\Windows\System\TsKhqvz.exe
  2⤵
  PID:4916
- C:\Windows\System\aRzCYuU.exe
  C:\Windows\System\aRzCYuU.exe
  2⤵
  PID:4980
- C:\Windows\System\kksqCED.exe
  C:\Windows\System\kksqCED.exe
  2⤵
  PID:5048
- C:\Windows\System\TVbzJnq.exe
  C:\Windows\System\TVbzJnq.exe
  2⤵
  PID:3556
- C:\Windows\System\JlemIFS.exe
  C:\Windows\System\JlemIFS.exe
  2⤵
  PID:3944
- C:\Windows\System\QntXTaj.exe
  C:\Windows\System\QntXTaj.exe
  2⤵
  PID:4108
- C:\Windows\System\AyqSRLW.exe
  C:\Windows\System\AyqSRLW.exe
  2⤵
  PID:4364
- C:\Windows\System\ywalLLj.exe
  C:\Windows\System\ywalLLj.exe
  2⤵
  PID:1992
- C:\Windows\System\SENmSUD.exe
  C:\Windows\System\SENmSUD.exe
  2⤵
  PID:1628
- C:\Windows\System\dpnqpXL.exe
  C:\Windows\System\dpnqpXL.exe
  2⤵
  PID:1824
- C:\Windows\System\esAMqvv.exe
  C:\Windows\System\esAMqvv.exe
  2⤵
  PID:3156
- C:\Windows\System\ezdmEZD.exe
  C:\Windows\System\ezdmEZD.exe
  2⤵
  PID:3544
- C:\Windows\System\guFHumu.exe
  C:\Windows\System\guFHumu.exe
  2⤵
  PID:3764
- C:\Windows\System\VZxtYFA.exe
  C:\Windows\System\VZxtYFA.exe
  2⤵
  PID:5144
- C:\Windows\System\vsVoeCQ.exe
  C:\Windows\System\vsVoeCQ.exe
  2⤵
  PID:5208
- C:\Windows\System\vyczXOe.exe
  C:\Windows\System\vyczXOe.exe
  2⤵
  PID:5272
- C:\Windows\System\mbZvwqv.exe
  C:\Windows\System\mbZvwqv.exe
  2⤵
  PID:5304
- C:\Windows\System\qDkRWon.exe
  C:\Windows\System\qDkRWon.exe
  2⤵
  PID:5372
- C:\Windows\System\DMKeBHz.exe
  C:\Windows\System\DMKeBHz.exe
  2⤵
  PID:5436
- C:\Windows\System\DrwdqwY.exe
  C:\Windows\System\DrwdqwY.exe
  2⤵
  PID:5500
- C:\Windows\System\SNuOidn.exe
  C:\Windows\System\SNuOidn.exe
  2⤵
  PID:5564
- C:\Windows\System\IQEjcTW.exe
  C:\Windows\System\IQEjcTW.exe
  2⤵
  PID:5628
- C:\Windows\System\MrVsQnu.exe
  C:\Windows\System\MrVsQnu.exe
  2⤵
  PID:5720
- C:\Windows\System\diJtpEX.exe
  C:\Windows\System\diJtpEX.exe
  2⤵
  PID:5788
- C:\Windows\System\iFmOnaO.exe
  C:\Windows\System\iFmOnaO.exe
  2⤵
  PID:1612
- C:\Windows\System\zlFEYFK.exe
  C:\Windows\System\zlFEYFK.exe
  2⤵
  PID:2248
- C:\Windows\System\zXOKcFz.exe
  C:\Windows\System\zXOKcFz.exe
  2⤵
  PID:1872
- C:\Windows\System\pNjWMhB.exe
  C:\Windows\System\pNjWMhB.exe
  2⤵
  PID:1716
- C:\Windows\System\DHqyBOb.exe
  C:\Windows\System\DHqyBOb.exe
  2⤵
  PID:6000
- C:\Windows\System\CzlUoyN.exe
  C:\Windows\System\CzlUoyN.exe
  2⤵
  PID:5988
- C:\Windows\System\pMmzcrw.exe
  C:\Windows\System\pMmzcrw.exe
  2⤵
  PID:5972
- C:\Windows\System\DtSxvUx.exe
  C:\Windows\System\DtSxvUx.exe
  2⤵
  PID:6044
- C:\Windows\System\zCDlbqJ.exe
  C:\Windows\System\zCDlbqJ.exe
  2⤵
  PID:3044
- C:\Windows\System\CbVmtqJ.exe
  C:\Windows\System\CbVmtqJ.exe
  2⤵
  PID:5840
- C:\Windows\System\PhvBxxi.exe
  C:\Windows\System\PhvBxxi.exe
  2⤵
  PID:6064
- C:\Windows\System\MvbtDHj.exe
  C:\Windows\System\MvbtDHj.exe
  2⤵
  PID:6080
- C:\Windows\System\IHkLNWU.exe
  C:\Windows\System\IHkLNWU.exe
  2⤵
  PID:6112
- C:\Windows\System\jVMPaRG.exe
  C:\Windows\System\jVMPaRG.exe
  2⤵
  PID:4060
- C:\Windows\System\VFxnhPU.exe
  C:\Windows\System\VFxnhPU.exe
  2⤵
  PID:5064
- C:\Windows\System\UDRULyd.exe
  C:\Windows\System\UDRULyd.exe
  2⤵
  PID:2616
- C:\Windows\System\cQFAmze.exe
  C:\Windows\System\cQFAmze.exe
  2⤵
  PID:5100
- C:\Windows\System\rhUdiUT.exe
  C:\Windows\System\rhUdiUT.exe
  2⤵
  PID:2676
- C:\Windows\System\AaIGZPK.exe
  C:\Windows\System\AaIGZPK.exe
  2⤵
  PID:2756
- C:\Windows\System\TMmsyyH.exe
  C:\Windows\System\TMmsyyH.exe
  2⤵
  PID:3460
- C:\Windows\System\BLxvbeP.exe
  C:\Windows\System\BLxvbeP.exe
  2⤵
  PID:4168
- C:\Windows\System\ZRULARV.exe
  C:\Windows\System\ZRULARV.exe
  2⤵
  PID:4124
- C:\Windows\System\MMWnSaM.exe
  C:\Windows\System\MMWnSaM.exe
  2⤵
  PID:4408
- C:\Windows\System\abOjybc.exe
  C:\Windows\System\abOjybc.exe
  2⤵
  PID:4428
- C:\Windows\System\IETnpYV.exe
  C:\Windows\System\IETnpYV.exe
  2⤵
  PID:4648
- C:\Windows\System\FSNbTVX.exe
  C:\Windows\System\FSNbTVX.exe
  2⤵
  PID:4684
- C:\Windows\System\AdRTsoS.exe
  C:\Windows\System\AdRTsoS.exe
  2⤵
  PID:1704
- C:\Windows\System\SWvRWkn.exe
  C:\Windows\System\SWvRWkn.exe
  2⤵
  PID:4088
- C:\Windows\System\fNSoWUa.exe
  C:\Windows\System\fNSoWUa.exe
  2⤵
  PID:3140
- C:\Windows\System\JWqBuzr.exe
  C:\Windows\System\JWqBuzr.exe
  2⤵
  PID:4152
- C:\Windows\System\PnvxwIa.exe
  C:\Windows\System\PnvxwIa.exe
  2⤵
  PID:4188
- C:\Windows\System\kkwGXyW.exe
  C:\Windows\System\kkwGXyW.exe
  2⤵
  PID:4284
- C:\Windows\System\ULXIETh.exe
  C:\Windows\System\ULXIETh.exe
  2⤵
  PID:4316
- C:\Windows\System\ltDnSmJ.exe
  C:\Windows\System\ltDnSmJ.exe
  2⤵
  PID:4440
- C:\Windows\System\UnkwIAO.exe
  C:\Windows\System\UnkwIAO.exe
  2⤵
  PID:4508
- C:\Windows\System\KXjDsUz.exe
  C:\Windows\System\KXjDsUz.exe
  2⤵
  PID:5224
- C:\Windows\System\dwUxNRo.exe
  C:\Windows\System\dwUxNRo.exe
  2⤵
  PID:5192
- C:\Windows\System\yZmMCmr.exe
  C:\Windows\System\yZmMCmr.exe
  2⤵
  PID:5352
- C:\Windows\System\QJZmapk.exe
  C:\Windows\System\QJZmapk.exe
  2⤵
  PID:2604
- C:\Windows\System\cVenNow.exe
  C:\Windows\System\cVenNow.exe
  2⤵
  PID:5292
- C:\Windows\System\uVTRtiW.exe
  C:\Windows\System\uVTRtiW.exe
  2⤵
  PID:4812
- C:\Windows\System\KFTSkWt.exe
  C:\Windows\System\KFTSkWt.exe
  2⤵
  PID:3784
- C:\Windows\System\YDgwJOa.exe
  C:\Windows\System\YDgwJOa.exe
  2⤵
  PID:708
- C:\Windows\System\ohENdLc.exe
  C:\Windows\System\ohENdLc.exe
  2⤵
  PID:3672
- C:\Windows\System\NothbGI.exe
  C:\Windows\System\NothbGI.exe
  2⤵
  PID:5404
- C:\Windows\System\zguDHWT.exe
  C:\Windows\System\zguDHWT.exe
  2⤵
  PID:5612
- C:\Windows\System\vPWlGtH.exe
  C:\Windows\System\vPWlGtH.exe
  2⤵
  PID:5692
- C:\Windows\System\fqnmyRD.exe
  C:\Windows\System\fqnmyRD.exe
  2⤵
  PID:5860
- C:\Windows\System\EvGFBmc.exe
  C:\Windows\System\EvGFBmc.exe
  2⤵
  PID:4964
- C:\Windows\System\GxrgjHj.exe
  C:\Windows\System\GxrgjHj.exe
  2⤵
  PID:3444
- C:\Windows\System\udJUeUr.exe
  C:\Windows\System\udJUeUr.exe
  2⤵
  PID:3960
- C:\Windows\System\AKUwfaS.exe
  C:\Windows\System\AKUwfaS.exe
  2⤵
  PID:5112
- C:\Windows\System\jmctQwg.exe
  C:\Windows\System\jmctQwg.exe
  2⤵
  PID:2112
- C:\Windows\System\KEEOQst.exe
  C:\Windows\System\KEEOQst.exe
  2⤵
  PID:2556
- C:\Windows\System\VHDHcHd.exe
  C:\Windows\System\VHDHcHd.exe
  2⤵
  PID:4376
- C:\Windows\System\MsvqHIP.exe
  C:\Windows\System\MsvqHIP.exe
  2⤵
  PID:2512
- C:\Windows\System\bTBlAla.exe
  C:\Windows\System\bTBlAla.exe
  2⤵
  PID:4476
- C:\Windows\System\OEKFhFQ.exe
  C:\Windows\System\OEKFhFQ.exe
  2⤵
  PID:4568
- C:\Windows\System\qsSpSMl.exe
  C:\Windows\System\qsSpSMl.exe
  2⤵
  PID:4312
- C:\Windows\System\glyVNrB.exe
  C:\Windows\System\glyVNrB.exe
  2⤵
  PID:3268
- C:\Windows\System\taaWewt.exe
  C:\Windows\System\taaWewt.exe
  2⤵
  PID:5164
- C:\Windows\System\YPWlQaV.exe
  C:\Windows\System\YPWlQaV.exe
  2⤵
  PID:3136
- C:\Windows\System\KfhOLxc.exe
  C:\Windows\System\KfhOLxc.exe
  2⤵
  PID:896
- C:\Windows\System\GPNABZl.exe
  C:\Windows\System\GPNABZl.exe
  2⤵
  PID:5384
- C:\Windows\System\VLYfyjz.exe
  C:\Windows\System\VLYfyjz.exe
  2⤵
  PID:644
- C:\Windows\System\SnzQifa.exe
  C:\Windows\System\SnzQifa.exe
  2⤵
  PID:3848
- C:\Windows\System\Xrogbie.exe
  C:\Windows\System\Xrogbie.exe
  2⤵
  PID:1752
- C:\Windows\System\jqWMNLy.exe
  C:\Windows\System\jqWMNLy.exe
  2⤵
  PID:2632
- C:\Windows\System\jAisjlU.exe
  C:\Windows\System\jAisjlU.exe
  2⤵
  PID:2492
- C:\Windows\System\tGGMUMb.exe
  C:\Windows\System\tGGMUMb.exe
  2⤵
  PID:5672
- C:\Windows\System\gLsZQdA.exe
  C:\Windows\System\gLsZQdA.exe
  2⤵
  PID:4668
- C:\Windows\System\OxPtHlT.exe
  C:\Windows\System\OxPtHlT.exe
  2⤵
  PID:5800
- C:\Windows\System\vPzpULr.exe
  C:\Windows\System\vPzpULr.exe
  2⤵
  PID:4776
- C:\Windows\System\pjeVNyE.exe
  C:\Windows\System\pjeVNyE.exe
  2⤵
  PID:4848
- C:\Windows\System\EAYWFBM.exe
  C:\Windows\System\EAYWFBM.exe
  2⤵
  PID:5016
- C:\Windows\System\EecdEAp.exe
  C:\Windows\System\EecdEAp.exe
  2⤵
  PID:5180
- C:\Windows\System\CYRKHVF.exe
  C:\Windows\System\CYRKHVF.exe
  2⤵
  PID:3152
- C:\Windows\System\xNIYvBG.exe
  C:\Windows\System\xNIYvBG.exe
  2⤵
  PID:5560
- C:\Windows\System\YKKdfeK.exe
  C:\Windows\System\YKKdfeK.exe
  2⤵
  PID:1860
- C:\Windows\System\GMKejIT.exe
  C:\Windows\System\GMKejIT.exe
  2⤵
  PID:1536
- C:\Windows\System\RWtMJlD.exe
  C:\Windows\System\RWtMJlD.exe
  2⤵
  PID:2820
- C:\Windows\System\inzXXbu.exe
  C:\Windows\System\inzXXbu.exe
  2⤵
  PID:4572
- C:\Windows\System\jGUXGEm.exe
  C:\Windows\System\jGUXGEm.exe
  2⤵
  PID:4632
- C:\Windows\System\CsjNkgV.exe
  C:\Windows\System\CsjNkgV.exe
  2⤵
  PID:4756
- C:\Windows\System\wbEfyZS.exe
  C:\Windows\System\wbEfyZS.exe
  2⤵
  PID:4800
- C:\Windows\System\LNdvTpt.exe
  C:\Windows\System\LNdvTpt.exe
  2⤵
  PID:4948
- C:\Windows\System\lVLqDad.exe
  C:\Windows\System\lVLqDad.exe
  2⤵
  PID:4076
- C:\Windows\System\WzbnFNE.exe
  C:\Windows\System\WzbnFNE.exe
  2⤵
  PID:1268
- C:\Windows\System\OUAJmZX.exe
  C:\Windows\System\OUAJmZX.exe
  2⤵
  PID:3416
- C:\Windows\System\KrEBvPW.exe
  C:\Windows\System\KrEBvPW.exe
  2⤵
  PID:3900
- C:\Windows\System\YFHIKPT.exe
  C:\Windows\System\YFHIKPT.exe
  2⤵
  PID:832
- C:\Windows\System\OWtbaAp.exe
  C:\Windows\System\OWtbaAp.exe
  2⤵
  PID:5624
- C:\Windows\System\AntIZJE.exe
  C:\Windows\System\AntIZJE.exe
  2⤵
  PID:2452
- C:\Windows\System\AkzwuWL.exe
  C:\Windows\System\AkzwuWL.exe
  2⤵
  PID:1540
- C:\Windows\System\lHndsqu.exe
  C:\Windows\System\lHndsqu.exe
  2⤵
  PID:5928
- C:\Windows\System\RApfgrJ.exe
  C:\Windows\System\RApfgrJ.exe
  2⤵
  PID:6012
- C:\Windows\System\lIVWvYW.exe
  C:\Windows\System\lIVWvYW.exe
  2⤵
  PID:6132
- C:\Windows\System\lUoPUUl.exe
  C:\Windows\System\lUoPUUl.exe
  2⤵
  PID:1672
- C:\Windows\System\sOJeTsG.exe
  C:\Windows\System\sOJeTsG.exe
  2⤵
  PID:548
- C:\Windows\System\hwIdQgj.exe
  C:\Windows\System\hwIdQgj.exe
  2⤵
  PID:4412
- C:\Windows\System\VxoOwGj.exe
  C:\Windows\System\VxoOwGj.exe
  2⤵
  PID:5084
- C:\Windows\System\KYlTYWo.exe
  C:\Windows\System\KYlTYWo.exe
  2⤵
  PID:892
- C:\Windows\System\cuSJRJo.exe
  C:\Windows\System\cuSJRJo.exe
  2⤵
  PID:452
- C:\Windows\System\OzqzZwu.exe
  C:\Windows\System\OzqzZwu.exe
  2⤵
  PID:5368
- C:\Windows\System\fzYgZkd.exe
  C:\Windows\System\fzYgZkd.exe
  2⤵
  PID:4556
- C:\Windows\System\hIVHCPJ.exe
  C:\Windows\System\hIVHCPJ.exe
  2⤵
  PID:4680
- C:\Windows\System\GLDkHBf.exe
  C:\Windows\System\GLDkHBf.exe
  2⤵
  PID:4588
- C:\Windows\System\fehveEH.exe
  C:\Windows\System\fehveEH.exe
  2⤵
  PID:1584
- C:\Windows\System\WLIdQUY.exe
  C:\Windows\System\WLIdQUY.exe
  2⤵
  PID:1596
- C:\Windows\System\EHKyEWQ.exe
  C:\Windows\System\EHKyEWQ.exe
  2⤵
  PID:1844
- C:\Windows\System\KHMZJtT.exe
  C:\Windows\System\KHMZJtT.exe
  2⤵
  PID:2664
- C:\Windows\System\ZbJzfca.exe
  C:\Windows\System\ZbJzfca.exe
  2⤵
  PID:5484
- C:\Windows\System\kFOGNfD.exe
  C:\Windows\System\kFOGNfD.exe
  2⤵
  PID:5012
- C:\Windows\System\PRcnvFq.exe
  C:\Windows\System\PRcnvFq.exe
  2⤵
  PID:5416
- C:\Windows\System\kQoiPhD.exe
  C:\Windows\System\kQoiPhD.exe
  2⤵
  PID:1456
- C:\Windows\System\ZTOYbyu.exe
  C:\Windows\System\ZTOYbyu.exe
  2⤵
  PID:5784
- C:\Windows\System\KKfHNEY.exe
  C:\Windows\System\KKfHNEY.exe
  2⤵
  PID:1400
- C:\Windows\System\RNiqUWs.exe
  C:\Windows\System\RNiqUWs.exe
  2⤵
  PID:3620
- C:\Windows\System\DhGfQFW.exe
  C:\Windows\System\DhGfQFW.exe
  2⤵
  PID:4836
- C:\Windows\System\ilaBRIX.exe
  C:\Windows\System\ilaBRIX.exe
  2⤵
  PID:4820
- C:\Windows\System\CgcCEfz.exe
  C:\Windows\System\CgcCEfz.exe
  2⤵
  PID:5276
- C:\Windows\System\LAluGEp.exe
  C:\Windows\System\LAluGEp.exe
  2⤵
  PID:2800
- C:\Windows\System\rRoCuMI.exe
  C:\Windows\System\rRoCuMI.exe
  2⤵
  PID:2840
- C:\Windows\System\YtYcNjz.exe
  C:\Windows\System\YtYcNjz.exe
  2⤵
  PID:4520
- C:\Windows\System\AesXTgr.exe
  C:\Windows\System\AesXTgr.exe
  2⤵
  PID:2116
- C:\Windows\System\iUuhLdS.exe
  C:\Windows\System\iUuhLdS.exe
  2⤵
  PID:2068
- C:\Windows\System\ommwbQm.exe
  C:\Windows\System\ommwbQm.exe
  2⤵
  PID:1248
- C:\Windows\System\aiiXwcG.exe
  C:\Windows\System\aiiXwcG.exe
  2⤵
  PID:4728
- C:\Windows\System\dWNFJbw.exe
  C:\Windows\System\dWNFJbw.exe
  2⤵
  PID:5116
- C:\Windows\System\wdnIzvu.exe
  C:\Windows\System\wdnIzvu.exe
  2⤵
  PID:3328
- C:\Windows\System\qkEczSm.exe
  C:\Windows\System\qkEczSm.exe
  2⤵
  PID:2032
- C:\Windows\System\bYcNjlp.exe
  C:\Windows\System\bYcNjlp.exe
  2⤵
  PID:2188
- C:\Windows\System\AZfqTiU.exe
  C:\Windows\System\AZfqTiU.exe
  2⤵
  PID:4664
- C:\Windows\System\yWqTQaC.exe
  C:\Windows\System\yWqTQaC.exe
  2⤵
  PID:3876
- C:\Windows\System\iKoQKTE.exe
  C:\Windows\System\iKoQKTE.exe
  2⤵
  PID:6048
- C:\Windows\System\KpJOukg.exe
  C:\Windows\System\KpJOukg.exe
  2⤵
  PID:5308
- C:\Windows\System\tqVTint.exe
  C:\Windows\System\tqVTint.exe
  2⤵
  PID:5756
- C:\Windows\System\NqpQgVe.exe
  C:\Windows\System\NqpQgVe.exe
  2⤵
  PID:3348
- C:\Windows\System\qJxaaxP.exe
  C:\Windows\System\qJxaaxP.exe
  2⤵
  PID:4248
- C:\Windows\System\Lqbjowp.exe
  C:\Windows\System\Lqbjowp.exe
  2⤵
  PID:4868
- C:\Windows\System\VNbqDmW.exe
  C:\Windows\System\VNbqDmW.exe
  2⤵
  PID:5976
- C:\Windows\System\WjUYoVg.exe
  C:\Windows\System\WjUYoVg.exe
  2⤵
  PID:4184
- C:\Windows\System\jewDHeo.exe
  C:\Windows\System\jewDHeo.exe
  2⤵
  PID:2212
- C:\Windows\System\EdMaaEs.exe
  C:\Windows\System\EdMaaEs.exe
  2⤵
  PID:1980
- C:\Windows\System\JWlaFaW.exe
  C:\Windows\System\JWlaFaW.exe
  2⤵
  PID:3608
- C:\Windows\System\lQnufsN.exe
  C:\Windows\System\lQnufsN.exe
  2⤵
  PID:4912
- C:\Windows\System\ZTQnuBT.exe
  C:\Windows\System\ZTQnuBT.exe
  2⤵
  PID:2896
- C:\Windows\System\UdGxJKH.exe
  C:\Windows\System\UdGxJKH.exe
  2⤵
  PID:2316
- C:\Windows\System\HLZwoBk.exe
  C:\Windows\System\HLZwoBk.exe
  2⤵
  PID:6160
- C:\Windows\System\sjhXFVm.exe
  C:\Windows\System\sjhXFVm.exe
  2⤵
  PID:6176
- C:\Windows\System\JhcuefN.exe
  C:\Windows\System\JhcuefN.exe
  2⤵
  PID:6192
- C:\Windows\System\ByJyWYc.exe
  C:\Windows\System\ByJyWYc.exe
  2⤵
  PID:6208
- C:\Windows\System\WroegJK.exe
  C:\Windows\System\WroegJK.exe
  2⤵
  PID:6224
- C:\Windows\System\GjYVGvI.exe
  C:\Windows\System\GjYVGvI.exe
  2⤵
  PID:6240
- C:\Windows\System\SADRNNM.exe
  C:\Windows\System\SADRNNM.exe
  2⤵
  PID:6256
- C:\Windows\System\lFuDejc.exe
  C:\Windows\System\lFuDejc.exe
  2⤵
  PID:6272
- C:\Windows\System\NWRBphi.exe
  C:\Windows\System\NWRBphi.exe
  2⤵
  PID:6288
- C:\Windows\System\FcjJmgU.exe
  C:\Windows\System\FcjJmgU.exe
  2⤵
  PID:6308
- C:\Windows\System\LOxGdOJ.exe
  C:\Windows\System\LOxGdOJ.exe
  2⤵
  PID:6324
- C:\Windows\System\mvSpcnv.exe
  C:\Windows\System\mvSpcnv.exe
  2⤵
  PID:6340
- C:\Windows\System\BCZiWNk.exe
  C:\Windows\System\BCZiWNk.exe
  2⤵
  PID:6356
- C:\Windows\System\yMqXUfJ.exe
  C:\Windows\System\yMqXUfJ.exe
  2⤵
  PID:6372
- C:\Windows\System\epVMWfG.exe
  C:\Windows\System\epVMWfG.exe
  2⤵
  PID:6388
- C:\Windows\System\jDzBjks.exe
  C:\Windows\System\jDzBjks.exe
  2⤵
  PID:6404
- C:\Windows\System\aCOmhQd.exe
  C:\Windows\System\aCOmhQd.exe
  2⤵
  PID:6420
- C:\Windows\System\oZCxyCZ.exe
  C:\Windows\System\oZCxyCZ.exe
  2⤵
  PID:6436
- C:\Windows\System\puUkfnH.exe
  C:\Windows\System\puUkfnH.exe
  2⤵
  PID:6492
- C:\Windows\System\bUqUedz.exe
  C:\Windows\System\bUqUedz.exe
  2⤵
  PID:6508
- C:\Windows\System\mzxJVDn.exe
  C:\Windows\System\mzxJVDn.exe
  2⤵
  PID:6524
- C:\Windows\System\RksZRSt.exe
  C:\Windows\System\RksZRSt.exe
  2⤵
  PID:6540
- C:\Windows\System\OkBDSrN.exe
  C:\Windows\System\OkBDSrN.exe
  2⤵
  PID:6556
- C:\Windows\System\stwHLIL.exe
  C:\Windows\System\stwHLIL.exe
  2⤵
  PID:6572
- C:\Windows\System\DdIlMcN.exe
  C:\Windows\System\DdIlMcN.exe
  2⤵
  PID:6588
- C:\Windows\System\LgdfNef.exe
  C:\Windows\System\LgdfNef.exe
  2⤵
  PID:6604
- C:\Windows\System\dDPqSCK.exe
  C:\Windows\System\dDPqSCK.exe
  2⤵
  PID:6620
- C:\Windows\System\rfYIrlo.exe
  C:\Windows\System\rfYIrlo.exe
  2⤵
  PID:6636
- C:\Windows\System\SDNedBi.exe
  C:\Windows\System\SDNedBi.exe
  2⤵
  PID:6652
- C:\Windows\System\IkaOmkI.exe
  C:\Windows\System\IkaOmkI.exe
  2⤵
  PID:6668
- C:\Windows\System\hAHgPqB.exe
  C:\Windows\System\hAHgPqB.exe
  2⤵
  PID:6688
- C:\Windows\System\oODbGiX.exe
  C:\Windows\System\oODbGiX.exe
  2⤵
  PID:6704
- C:\Windows\System\eZoeQRc.exe
  C:\Windows\System\eZoeQRc.exe
  2⤵
  PID:6720
- C:\Windows\System\TLwRRzU.exe
  C:\Windows\System\TLwRRzU.exe
  2⤵
  PID:6736
- C:\Windows\System\uEqQtFi.exe
  C:\Windows\System\uEqQtFi.exe
  2⤵
  PID:6756
- C:\Windows\System\sGvhluv.exe
  C:\Windows\System\sGvhluv.exe
  2⤵
  PID:6772
- C:\Windows\System\ykqWPxA.exe
  C:\Windows\System\ykqWPxA.exe
  2⤵
  PID:6788
- C:\Windows\System\wQdsmoY.exe
  C:\Windows\System\wQdsmoY.exe
  2⤵
  PID:6804
- C:\Windows\System\WwaFzEE.exe
  C:\Windows\System\WwaFzEE.exe
  2⤵
  PID:6820
- C:\Windows\System\NCgqRej.exe
  C:\Windows\System\NCgqRej.exe
  2⤵
  PID:6836
- C:\Windows\System\bXbIbzQ.exe
  C:\Windows\System\bXbIbzQ.exe
  2⤵
  PID:6852
- C:\Windows\System\pvWMUHP.exe
  C:\Windows\System\pvWMUHP.exe
  2⤵
  PID:6868
- C:\Windows\System\yFQzidP.exe
  C:\Windows\System\yFQzidP.exe
  2⤵
  PID:6884
- C:\Windows\System\nKwLhEa.exe
  C:\Windows\System\nKwLhEa.exe
  2⤵
  PID:6900
- C:\Windows\System\YvRncgj.exe
  C:\Windows\System\YvRncgj.exe
  2⤵
  PID:6916
- C:\Windows\System\cOEsmJZ.exe
  C:\Windows\System\cOEsmJZ.exe
  2⤵
  PID:6932
- C:\Windows\System\zuIaaJz.exe
  C:\Windows\System\zuIaaJz.exe
  2⤵
  PID:6948
- C:\Windows\System\Jklxcno.exe
  C:\Windows\System\Jklxcno.exe
  2⤵
  PID:6964
- C:\Windows\System\sqZVdxU.exe
  C:\Windows\System\sqZVdxU.exe
  2⤵
  PID:6980
- C:\Windows\System\JcBoJLi.exe
  C:\Windows\System\JcBoJLi.exe
  2⤵
  PID:6996
- C:\Windows\System\sQloboO.exe
  C:\Windows\System\sQloboO.exe
  2⤵
  PID:7012
- C:\Windows\System\SEYzzYJ.exe
  C:\Windows\System\SEYzzYJ.exe
  2⤵
  PID:7028
- C:\Windows\System\izvjUvZ.exe
  C:\Windows\System\izvjUvZ.exe
  2⤵
  PID:7044
- C:\Windows\System\xhMYFgn.exe
  C:\Windows\System\xhMYFgn.exe
  2⤵
  PID:7060
- C:\Windows\System\jgFYeNM.exe
  C:\Windows\System\jgFYeNM.exe
  2⤵
  PID:7076
- C:\Windows\System\LwPIJsK.exe
  C:\Windows\System\LwPIJsK.exe
  2⤵
  PID:7092
- C:\Windows\System\gRKWpVJ.exe
  C:\Windows\System\gRKWpVJ.exe
  2⤵
  PID:7108
- C:\Windows\System\kuTudEX.exe
  C:\Windows\System\kuTudEX.exe
  2⤵
  PID:7124
- C:\Windows\System\mSoaWZx.exe
  C:\Windows\System\mSoaWZx.exe
  2⤵
  PID:7140
- C:\Windows\System\OFAKCSb.exe
  C:\Windows\System\OFAKCSb.exe
  2⤵
  PID:7156
- C:\Windows\System\CUknuDy.exe
  C:\Windows\System\CUknuDy.exe
  2⤵
  PID:4380
- C:\Windows\System\wNcScqP.exe
  C:\Windows\System\wNcScqP.exe
  2⤵
  PID:4236
- C:\Windows\System\wKuxuRl.exe
  C:\Windows\System\wKuxuRl.exe
  2⤵
  PID:5740
- C:\Windows\System\UxZzbgf.exe
  C:\Windows\System\UxZzbgf.exe
  2⤵
  PID:3200
- C:\Windows\System\WeKFUjR.exe
  C:\Windows\System\WeKFUjR.exe
  2⤵
  PID:5532
- C:\Windows\System\GanlXwZ.exe
  C:\Windows\System\GanlXwZ.exe
  2⤵
  PID:3380
- C:\Windows\System\thPPDiE.exe
  C:\Windows\System\thPPDiE.exe
  2⤵
  PID:6156
- C:\Windows\System\xZNbGQX.exe
  C:\Windows\System\xZNbGQX.exe
  2⤵
  PID:6204
- C:\Windows\System\rXUtShJ.exe
  C:\Windows\System\rXUtShJ.exe
  2⤵
  PID:6236
- C:\Windows\System\XXZdagZ.exe
  C:\Windows\System\XXZdagZ.exe
  2⤵
  PID:6280
- C:\Windows\System\jcuoveL.exe
  C:\Windows\System\jcuoveL.exe
  2⤵
  PID:6300
- C:\Windows\System\yJiueSs.exe
  C:\Windows\System\yJiueSs.exe
  2⤵
  PID:6368
- C:\Windows\System\WgKvMGK.exe
  C:\Windows\System\WgKvMGK.exe
  2⤵
  PID:6352
- C:\Windows\System\ACHlCmv.exe
  C:\Windows\System\ACHlCmv.exe
  2⤵
  PID:6412
- C:\Windows\System\FdortUc.exe
  C:\Windows\System\FdortUc.exe
  2⤵
  PID:6264
- C:\Windows\System\LblPucx.exe
  C:\Windows\System\LblPucx.exe
  2⤵
  PID:6432
- C:\Windows\System\TiNVJxM.exe
  C:\Windows\System\TiNVJxM.exe
  2⤵
  PID:6460
- C:\Windows\System\orNkmDP.exe
  C:\Windows\System\orNkmDP.exe
  2⤵
  PID:6476
- C:\Windows\System\qvQEaTn.exe
  C:\Windows\System\qvQEaTn.exe
  2⤵
  PID:6500
- C:\Windows\System\icOwbDO.exe
  C:\Windows\System\icOwbDO.exe
  2⤵
  PID:6552
- C:\Windows\System\maQUkLG.exe
  C:\Windows\System\maQUkLG.exe
  2⤵
  PID:6532
- C:\Windows\System\wInuQFk.exe
  C:\Windows\System\wInuQFk.exe
  2⤵
  PID:6596
- C:\Windows\System\JPfgSKZ.exe
  C:\Windows\System\JPfgSKZ.exe
  2⤵
  PID:6660
- C:\Windows\System\VZkCGwu.exe
  C:\Windows\System\VZkCGwu.exe
  2⤵
  PID:6648
- C:\Windows\System\owcJAwF.exe
  C:\Windows\System\owcJAwF.exe
  2⤵
  PID:6680
- C:\Windows\System\lWkzfPE.exe
  C:\Windows\System\lWkzfPE.exe
  2⤵
  PID:6728
- C:\Windows\System\MwTtsEA.exe
  C:\Windows\System\MwTtsEA.exe
  2⤵
  PID:6764
- C:\Windows\System\vaTFIIE.exe
  C:\Windows\System\vaTFIIE.exe
  2⤵
  PID:6784
- C:\Windows\System\ljCBxNI.exe
  C:\Windows\System\ljCBxNI.exe
  2⤵
  PID:6860
- C:\Windows\System\hCYXaJq.exe
  C:\Windows\System\hCYXaJq.exe
  2⤵
  PID:6924
- C:\Windows\System\dbLkCBo.exe
  C:\Windows\System\dbLkCBo.exe
  2⤵
  PID:6988
- C:\Windows\System\xLQPUPu.exe
  C:\Windows\System\xLQPUPu.exe
  2⤵
  PID:6844
- C:\Windows\System\jMkcCav.exe
  C:\Windows\System\jMkcCav.exe
  2⤵
  PID:6876
- C:\Windows\System\pjyKqpB.exe
  C:\Windows\System\pjyKqpB.exe
  2⤵
  PID:6940
- C:\Windows\System\HCdTLKE.exe
  C:\Windows\System\HCdTLKE.exe
  2⤵
  PID:7052
- C:\Windows\System\dSwhOpW.exe
  C:\Windows\System\dSwhOpW.exe
  2⤵
  PID:7036
- C:\Windows\System\hJetxov.exe
  C:\Windows\System\hJetxov.exe
  2⤵
  PID:2192
- C:\Windows\System\eTUypgx.exe
  C:\Windows\System\eTUypgx.exe
  2⤵
  PID:4732
- C:\Windows\System\YmExVaN.exe
  C:\Windows\System\YmExVaN.exe
  2⤵
  PID:7040
- C:\Windows\System\abdSYBl.exe
  C:\Windows\System\abdSYBl.exe
  2⤵
  PID:7132
- C:\Windows\System\pAXJLDO.exe
  C:\Windows\System\pAXJLDO.exe
  2⤵
  PID:3896
- C:\Windows\System\loWajCu.exe
  C:\Windows\System\loWajCu.exe
  2⤵
  PID:6184
- C:\Windows\System\AJjMPzV.exe
  C:\Windows\System\AJjMPzV.exe
  2⤵
  PID:6336
- C:\Windows\System\FBnaFwI.exe
  C:\Windows\System\FBnaFwI.exe
  2⤵
  PID:6348
- C:\Windows\System\SeDyhOY.exe
  C:\Windows\System\SeDyhOY.exe
  2⤵
  PID:6252
- C:\Windows\System\vkFtEpe.exe
  C:\Windows\System\vkFtEpe.exe
  2⤵
  PID:6468
- C:\Windows\System\UQbWXjX.exe
  C:\Windows\System\UQbWXjX.exe
  2⤵
  PID:6564
- C:\Windows\System\ZZcsoGp.exe
  C:\Windows\System\ZZcsoGp.exe
  2⤵
  PID:6548
- C:\Windows\System\xCUTHAH.exe
  C:\Windows\System\xCUTHAH.exe
  2⤵
  PID:6752
- C:\Windows\System\XbNBThT.exe
  C:\Windows\System\XbNBThT.exe
  2⤵
  PID:6488
- C:\Windows\System\yHDQxgB.exe
  C:\Windows\System\yHDQxgB.exe
  2⤵
  PID:6632
- C:\Windows\System\tVNTaZB.exe
  C:\Windows\System\tVNTaZB.exe
  2⤵
  PID:6832
- C:\Windows\System\gqkViJG.exe
  C:\Windows\System\gqkViJG.exe
  2⤵
  PID:6780
- C:\Windows\System\yvHYJcv.exe
  C:\Windows\System\yvHYJcv.exe
  2⤵
  PID:6896
- C:\Windows\System\vqOYJWI.exe
  C:\Windows\System\vqOYJWI.exe
  2⤵
  PID:7024
- C:\Windows\System\ubMViiU.exe
  C:\Windows\System\ubMViiU.exe
  2⤵
  PID:2600
- C:\Windows\System\wtHyWzi.exe
  C:\Windows\System\wtHyWzi.exe
  2⤵
  PID:7004
- C:\Windows\System\NsNNcGr.exe
  C:\Windows\System\NsNNcGr.exe
  2⤵
  PID:7084
- C:\Windows\System\zgHhnQV.exe
  C:\Windows\System\zgHhnQV.exe
  2⤵
  PID:7068
- C:\Windows\System\xDhkuTj.exe
  C:\Windows\System\xDhkuTj.exe
  2⤵
  PID:6316
- C:\Windows\System\olCLaRM.exe
  C:\Windows\System\olCLaRM.exe
  2⤵
  PID:7100
- C:\Windows\System\FbUkSTP.exe
  C:\Windows\System\FbUkSTP.exe
  2⤵
  PID:6248
- C:\Windows\System\haJiqAg.exe
  C:\Windows\System\haJiqAg.exe
  2⤵
  PID:6516
- C:\Windows\System\cVcXAdK.exe
  C:\Windows\System\cVcXAdK.exe
  2⤵
  PID:6748
- C:\Windows\System\RXeDiEr.exe
  C:\Windows\System\RXeDiEr.exe
  2⤵
  PID:6664
- C:\Windows\System\biqaQqE.exe
  C:\Windows\System\biqaQqE.exe
  2⤵
  PID:6828
- C:\Windows\System\GzMCXxU.exe
  C:\Windows\System\GzMCXxU.exe
  2⤵
  PID:6960
- C:\Windows\System\WhrMRpQ.exe
  C:\Windows\System\WhrMRpQ.exe
  2⤵
  PID:6848
- C:\Windows\System\OdonObZ.exe
  C:\Windows\System\OdonObZ.exe
  2⤵
  PID:7116
- C:\Windows\System\DbVGWLw.exe
  C:\Windows\System\DbVGWLw.exe
  2⤵
  PID:2924
- C:\Windows\System\aZjdqOn.exe
  C:\Windows\System\aZjdqOn.exe
  2⤵
  PID:7088
- C:\Windows\System\FopMPCl.exe
  C:\Windows\System\FopMPCl.exe
  2⤵
  PID:6676
- C:\Windows\System\bESXowH.exe
  C:\Windows\System\bESXowH.exe
  2⤵
  PID:6172
- C:\Windows\System\MHGhhzJ.exe
  C:\Windows\System\MHGhhzJ.exe
  2⤵
  PID:6628
- C:\Windows\System\itJhqTC.exe
  C:\Windows\System\itJhqTC.exe
  2⤵
  PID:7184
- C:\Windows\System\kXRzyoV.exe
  C:\Windows\System\kXRzyoV.exe
  2⤵
  PID:7200
- C:\Windows\System\PuVVtRi.exe
  C:\Windows\System\PuVVtRi.exe
  2⤵
  PID:7216
- C:\Windows\System\ZhqESIO.exe
  C:\Windows\System\ZhqESIO.exe
  2⤵
  PID:7232
- C:\Windows\System\AHvpjvN.exe
  C:\Windows\System\AHvpjvN.exe
  2⤵
  PID:7252
- C:\Windows\System\cZBuKyy.exe
  C:\Windows\System\cZBuKyy.exe
  2⤵
  PID:7268
- C:\Windows\System\fQLioss.exe
  C:\Windows\System\fQLioss.exe
  2⤵
  PID:7284
- C:\Windows\System\liphqyh.exe
  C:\Windows\System\liphqyh.exe
  2⤵
  PID:7300
- C:\Windows\System\gOHGVay.exe
  C:\Windows\System\gOHGVay.exe
  2⤵
  PID:7316
- C:\Windows\System\TmbGTnB.exe
  C:\Windows\System\TmbGTnB.exe
  2⤵
  PID:7332
- C:\Windows\System\POYmqIS.exe
  C:\Windows\System\POYmqIS.exe
  2⤵
  PID:7348
- C:\Windows\System\iQHlTUo.exe
  C:\Windows\System\iQHlTUo.exe
  2⤵
  PID:7364
- C:\Windows\System\qOLVUnu.exe
  C:\Windows\System\qOLVUnu.exe
  2⤵
  PID:7380
- C:\Windows\System\rtegwJJ.exe
  C:\Windows\System\rtegwJJ.exe
  2⤵
  PID:7396
- C:\Windows\System\nzuLFGY.exe
  C:\Windows\System\nzuLFGY.exe
  2⤵
  PID:7412
- C:\Windows\System\xhOxzde.exe
  C:\Windows\System\xhOxzde.exe
  2⤵
  PID:7428
- C:\Windows\System\kpjljZc.exe
  C:\Windows\System\kpjljZc.exe
  2⤵
  PID:7444
- C:\Windows\System\FwhCtDr.exe
  C:\Windows\System\FwhCtDr.exe
  2⤵
  PID:7460
- C:\Windows\System\elRjkEy.exe
  C:\Windows\System\elRjkEy.exe
  2⤵
  PID:7476
- C:\Windows\System\gZBloLP.exe
  C:\Windows\System\gZBloLP.exe
  2⤵
  PID:7492
- C:\Windows\System\gnQxjuy.exe
  C:\Windows\System\gnQxjuy.exe
  2⤵
  PID:7508
- C:\Windows\System\sXBCvza.exe
  C:\Windows\System\sXBCvza.exe
  2⤵
  PID:7524
- C:\Windows\System\RyZdKGk.exe
  C:\Windows\System\RyZdKGk.exe
  2⤵
  PID:7540
- C:\Windows\System\GqvTVkq.exe
  C:\Windows\System\GqvTVkq.exe
  2⤵
  PID:7560
- C:\Windows\System\wZGiwac.exe
  C:\Windows\System\wZGiwac.exe
  2⤵
  PID:7576
- C:\Windows\System\DMXNush.exe
  C:\Windows\System\DMXNush.exe
  2⤵
  PID:7592
- C:\Windows\System\ZvJdQgR.exe
  C:\Windows\System\ZvJdQgR.exe
  2⤵
  PID:7608
- C:\Windows\System\UdAKOFT.exe
  C:\Windows\System\UdAKOFT.exe
  2⤵
  PID:7624
- C:\Windows\System\vAmbkZv.exe
  C:\Windows\System\vAmbkZv.exe
  2⤵
  PID:7640
- C:\Windows\System\wIgPACj.exe
  C:\Windows\System\wIgPACj.exe
  2⤵
  PID:7656
- C:\Windows\System\mPnCzYC.exe
  C:\Windows\System\mPnCzYC.exe
  2⤵
  PID:7672
- C:\Windows\System\KfhhTeE.exe
  C:\Windows\System\KfhhTeE.exe
  2⤵
  PID:7688
- C:\Windows\System\gAoAoej.exe
  C:\Windows\System\gAoAoej.exe
  2⤵
  PID:7704
- C:\Windows\System\XOmBlnJ.exe
  C:\Windows\System\XOmBlnJ.exe
  2⤵
  PID:7720
- C:\Windows\System\FmEABgz.exe
  C:\Windows\System\FmEABgz.exe
  2⤵
  PID:7736
- C:\Windows\System\MqbNwvq.exe
  C:\Windows\System\MqbNwvq.exe
  2⤵
  PID:7752
- C:\Windows\System\rmoGani.exe
  C:\Windows\System\rmoGani.exe
  2⤵
  PID:7768
- C:\Windows\System\WgwRFBX.exe
  C:\Windows\System\WgwRFBX.exe
  2⤵
  PID:7784
- C:\Windows\System\IviGzzk.exe
  C:\Windows\System\IviGzzk.exe
  2⤵
  PID:7800
- C:\Windows\System\OvkjuaV.exe
  C:\Windows\System\OvkjuaV.exe
  2⤵
  PID:7816
- C:\Windows\System\HpAglTs.exe
  C:\Windows\System\HpAglTs.exe
  2⤵
  PID:7832
- C:\Windows\System\EwocUZu.exe
  C:\Windows\System\EwocUZu.exe
  2⤵
  PID:7848
- C:\Windows\System\laNioHQ.exe
  C:\Windows\System\laNioHQ.exe
  2⤵
  PID:7864
- C:\Windows\System\BFFLaBh.exe
  C:\Windows\System\BFFLaBh.exe
  2⤵
  PID:7880
- C:\Windows\System\xrJdGZp.exe
  C:\Windows\System\xrJdGZp.exe
  2⤵
  PID:7896
- C:\Windows\System\qRufbxC.exe
  C:\Windows\System\qRufbxC.exe
  2⤵
  PID:7912
- C:\Windows\System\RZToAuc.exe
  C:\Windows\System\RZToAuc.exe
  2⤵
  PID:7928
- C:\Windows\System\VCfWxJf.exe
  C:\Windows\System\VCfWxJf.exe
  2⤵
  PID:7944
- C:\Windows\System\oChowTz.exe
  C:\Windows\System\oChowTz.exe
  2⤵
  PID:7960
- C:\Windows\System\qUynrzW.exe
  C:\Windows\System\qUynrzW.exe
  2⤵
  PID:7976
- C:\Windows\System\LszZoHq.exe
  C:\Windows\System\LszZoHq.exe
  2⤵
  PID:7992
- C:\Windows\System\vVpDXhU.exe
  C:\Windows\System\vVpDXhU.exe
  2⤵
  PID:8008
- C:\Windows\System\lhyWdKP.exe
  C:\Windows\System\lhyWdKP.exe
  2⤵
  PID:8024
- C:\Windows\System\bxasVmI.exe
  C:\Windows\System\bxasVmI.exe
  2⤵
  PID:8040
- C:\Windows\System\LgPOikK.exe
  C:\Windows\System\LgPOikK.exe
  2⤵
  PID:8056
- C:\Windows\System\HnVvZDA.exe
  C:\Windows\System\HnVvZDA.exe
  2⤵
  PID:8076
- C:\Windows\System\SZMqLpp.exe
  C:\Windows\System\SZMqLpp.exe
  2⤵
  PID:8092
- C:\Windows\System\eEAPGKG.exe
  C:\Windows\System\eEAPGKG.exe
  2⤵
  PID:8108
- C:\Windows\System\pEIlewl.exe
  C:\Windows\System\pEIlewl.exe
  2⤵
  PID:8124
- C:\Windows\System\FdeJoad.exe
  C:\Windows\System\FdeJoad.exe
  2⤵
  PID:8144
- C:\Windows\System\DBgbfAY.exe
  C:\Windows\System\DBgbfAY.exe
  2⤵
  PID:8160
- C:\Windows\System\JKvxvSa.exe
  C:\Windows\System\JKvxvSa.exe
  2⤵
  PID:8176
- C:\Windows\System\FgwXSLN.exe
  C:\Windows\System\FgwXSLN.exe
  2⤵
  PID:4360
- C:\Windows\System\BKCLdXw.exe
  C:\Windows\System\BKCLdXw.exe
  2⤵
  PID:7008
- C:\Windows\System\mJfVZMn.exe
  C:\Windows\System\mJfVZMn.exe
  2⤵
  PID:4172
- C:\Windows\System\RLDzWXk.exe
  C:\Windows\System\RLDzWXk.exe
  2⤵
  PID:6416
- C:\Windows\System\ZTwsUVI.exe
  C:\Windows\System\ZTwsUVI.exe
  2⤵
  PID:7196
- C:\Windows\System\oCnNyhK.exe
  C:\Windows\System\oCnNyhK.exe
  2⤵
  PID:7260
- C:\Windows\System\yxYXccO.exe
  C:\Windows\System\yxYXccO.exe
  2⤵
  PID:7324
- C:\Windows\System\igWJgmB.exe
  C:\Windows\System\igWJgmB.exe
  2⤵
  PID:7240
- C:\Windows\System\pjRefQm.exe
  C:\Windows\System\pjRefQm.exe
  2⤵
  PID:7276
- C:\Windows\System\yoTbcBa.exe
  C:\Windows\System\yoTbcBa.exe
  2⤵
  PID:7424
- C:\Windows\System\sXkYxgy.exe
  C:\Windows\System\sXkYxgy.exe
  2⤵
  PID:7248
- C:\Windows\System\HKYmbJZ.exe
  C:\Windows\System\HKYmbJZ.exe
  2⤵
  PID:7308
- C:\Windows\System\PVJcZbJ.exe
  C:\Windows\System\PVJcZbJ.exe
  2⤵
  PID:7488
- C:\Windows\System\uaRPWDl.exe
  C:\Windows\System\uaRPWDl.exe
  2⤵
  PID:7436
- C:\Windows\System\eikCDxH.exe
  C:\Windows\System\eikCDxH.exe
  2⤵
  PID:7504
- C:\Windows\System\RyCDYbP.exe
  C:\Windows\System\RyCDYbP.exe
  2⤵
  PID:7556
- C:\Windows\System\lIIMlXB.exe
  C:\Windows\System\lIIMlXB.exe
  2⤵
  PID:7616
- C:\Windows\System\ZbUhCpT.exe
  C:\Windows\System\ZbUhCpT.exe
  2⤵
  PID:7712
- C:\Windows\System\mkvAayB.exe
  C:\Windows\System\mkvAayB.exe
  2⤵
  PID:7680
- C:\Windows\System\cAdqiyG.exe
  C:\Windows\System\cAdqiyG.exe
  2⤵
  PID:7600
- C:\Windows\System\nWJRmZE.exe
  C:\Windows\System\nWJRmZE.exe
  2⤵
  PID:7636
- C:\Windows\System\eneqNpg.exe
  C:\Windows\System\eneqNpg.exe
  2⤵
  PID:7700
- C:\Windows\System\LCjonMq.exe
  C:\Windows\System\LCjonMq.exe
  2⤵
  PID:7780
- C:\Windows\System\WOLxppW.exe
  C:\Windows\System\WOLxppW.exe
  2⤵
  PID:7844
- C:\Windows\System\yVWJiSP.exe
  C:\Windows\System\yVWJiSP.exe
  2⤵
  PID:7904
- C:\Windows\System\woUcVAS.exe
  C:\Windows\System\woUcVAS.exe
  2⤵
  PID:7856
- C:\Windows\System\vGKeFuV.exe
  C:\Windows\System\vGKeFuV.exe
  2⤵
  PID:7824
- C:\Windows\System\hLegWfy.exe
  C:\Windows\System\hLegWfy.exe
  2⤵
  PID:7920
- C:\Windows\System\YSZylOC.exe
  C:\Windows\System\YSZylOC.exe
  2⤵
  PID:7968
- C:\Windows\System\wgyxyOq.exe
  C:\Windows\System\wgyxyOq.exe
  2⤵
  PID:8000
- C:\Windows\System\FBKdgyc.exe
  C:\Windows\System\FBKdgyc.exe
  2⤵
  PID:7984
- C:\Windows\System\mIgBXJg.exe
  C:\Windows\System\mIgBXJg.exe
  2⤵
  PID:8020
- C:\Windows\System\FnSqcpr.exe
  C:\Windows\System\FnSqcpr.exe
  2⤵
  PID:8100
- C:\Windows\System\LSVdJrN.exe
  C:\Windows\System\LSVdJrN.exe
  2⤵
  PID:8084
- C:\Windows\System\eYjcBpe.exe
  C:\Windows\System\eYjcBpe.exe
  2⤵
  PID:8140
- C:\Windows\System\HcQSdEg.exe
  C:\Windows\System\HcQSdEg.exe
  2⤵
  PID:8172
- C:\Windows\System\VJyXHDJ.exe
  C:\Windows\System\VJyXHDJ.exe
  2⤵
  PID:1932
- C:\Windows\System\WeRcxoP.exe
  C:\Windows\System\WeRcxoP.exe
  2⤵
  PID:7208
- C:\Windows\System\ZAZvAFw.exe
  C:\Windows\System\ZAZvAFw.exe
  2⤵
  PID:7404
- C:\Windows\System\zCSDAyQ.exe
  C:\Windows\System\zCSDAyQ.exe
  2⤵
  PID:7568
- C:\Windows\System\RhUHayG.exe
  C:\Windows\System\RhUHayG.exe
  2⤵
  PID:7532
- C:\Windows\System\uAkCXgZ.exe
  C:\Windows\System\uAkCXgZ.exe
  2⤵
  PID:7812
- C:\Windows\System\nMJmVNw.exe
  C:\Windows\System\nMJmVNw.exe
  2⤵
  PID:7828
- C:\Windows\System\YVTUmap.exe
  C:\Windows\System\YVTUmap.exe
  2⤵
  PID:7888
- C:\Windows\System\KBmiRnN.exe
  C:\Windows\System\KBmiRnN.exe
  2⤵
  PID:7584
- C:\Windows\System\aHFwLdN.exe
  C:\Windows\System\aHFwLdN.exe
  2⤵
  PID:7652
- C:\Windows\System\QJxLRSA.exe
  C:\Windows\System\QJxLRSA.exe
  2⤵
  PID:8052
- C:\Windows\System\KbMzeGo.exe
  C:\Windows\System\KbMzeGo.exe
  2⤵
  PID:7340
- C:\Windows\System\TTyValr.exe
  C:\Windows\System\TTyValr.exe
  2⤵
  PID:7192
- C:\Windows\System\hcmztlx.exe
  C:\Windows\System\hcmztlx.exe
  2⤵
  PID:7500
- C:\Windows\System\jKvvVyX.exe
  C:\Windows\System\jKvvVyX.exe
  2⤵
  PID:7748
- C:\Windows\System\cnvklVT.exe
  C:\Windows\System\cnvklVT.exe
  2⤵
  PID:8032
- C:\Windows\System\DbdzhSv.exe
  C:\Windows\System\DbdzhSv.exe
  2⤵
  PID:8168
- C:\Windows\System\AplmpzH.exe
  C:\Windows\System\AplmpzH.exe
  2⤵
  PID:8156
- C:\Windows\System\AgFnapp.exe
  C:\Windows\System\AgFnapp.exe
  2⤵
  PID:7668
- C:\Windows\System\FwdCcwG.exe
  C:\Windows\System\FwdCcwG.exe
  2⤵
  PID:8184
- C:\Windows\System\fiPLnUt.exe
  C:\Windows\System\fiPLnUt.exe
  2⤵
  PID:7876
- C:\Windows\System\abhJpXj.exe
  C:\Windows\System\abhJpXj.exe
  2⤵
  PID:7940
- C:\Windows\System\XhQoIoO.exe
  C:\Windows\System\XhQoIoO.exe
  2⤵
  PID:7892
- C:\Windows\System\AYIuIfZ.exe
  C:\Windows\System\AYIuIfZ.exe
  2⤵
  PID:6396
- C:\Windows\System\JitMQfE.exe
  C:\Windows\System\JitMQfE.exe
  2⤵
  PID:7164
- C:\Windows\System\qJXLbkC.exe
  C:\Windows\System\qJXLbkC.exe
  2⤵
  PID:6908
- C:\Windows\System\HkPmiYl.exe
  C:\Windows\System\HkPmiYl.exe
  2⤵
  PID:7716
- C:\Windows\System\tUdUkHj.exe
  C:\Windows\System\tUdUkHj.exe
  2⤵
  PID:7684
- C:\Windows\System\WhhmgCM.exe
  C:\Windows\System\WhhmgCM.exe
  2⤵
  PID:7452
- C:\Windows\System\fUuJkRS.exe
  C:\Windows\System\fUuJkRS.exe
  2⤵
  PID:7376
- C:\Windows\System\NNIoAFB.exe
  C:\Windows\System\NNIoAFB.exe
  2⤵
  PID:7228
- C:\Windows\System\REweSoP.exe
  C:\Windows\System\REweSoP.exe
  2⤵
  PID:7632
- C:\Windows\System\WMVvtbC.exe
  C:\Windows\System\WMVvtbC.exe
  2⤵
  PID:8132
- C:\Windows\System\JRYVPig.exe
  C:\Windows\System\JRYVPig.exe
  2⤵
  PID:8204
- C:\Windows\System\VrnCWXS.exe
  C:\Windows\System\VrnCWXS.exe
  2⤵
  PID:8220
- C:\Windows\System\LespoIY.exe
  C:\Windows\System\LespoIY.exe
  2⤵
  PID:8236
- C:\Windows\System\RUGhjbk.exe
  C:\Windows\System\RUGhjbk.exe
  2⤵
  PID:8252
- C:\Windows\System\supeIvG.exe
  C:\Windows\System\supeIvG.exe
  2⤵
  PID:8268
- C:\Windows\System\TRlwlbP.exe
  C:\Windows\System\TRlwlbP.exe
  2⤵
  PID:8284
- C:\Windows\System\YIUZPMi.exe
  C:\Windows\System\YIUZPMi.exe
  2⤵
  PID:8300
- C:\Windows\System\MojsXTo.exe
  C:\Windows\System\MojsXTo.exe
  2⤵
  PID:8316
- C:\Windows\System\RBLoYhX.exe
  C:\Windows\System\RBLoYhX.exe
  2⤵
  PID:8332
- C:\Windows\System\LhDsNlK.exe
  C:\Windows\System\LhDsNlK.exe
  2⤵
  PID:8348
- C:\Windows\System\wJHmLzM.exe
  C:\Windows\System\wJHmLzM.exe
  2⤵
  PID:8364
- C:\Windows\System\kqgQJXO.exe
  C:\Windows\System\kqgQJXO.exe
  2⤵
  PID:8380
- C:\Windows\System\RNLpeKT.exe
  C:\Windows\System\RNLpeKT.exe
  2⤵
  PID:8396
- C:\Windows\System\bMFBNvL.exe
  C:\Windows\System\bMFBNvL.exe
  2⤵
  PID:8412
- C:\Windows\System\qWqIvdj.exe
  C:\Windows\System\qWqIvdj.exe
  2⤵
  PID:8428
- C:\Windows\System\JnSnOnE.exe
  C:\Windows\System\JnSnOnE.exe
  2⤵
  PID:8444
- C:\Windows\System\CiFmnbr.exe
  C:\Windows\System\CiFmnbr.exe
  2⤵
  PID:8460
- C:\Windows\System\fYSbJIy.exe
  C:\Windows\System\fYSbJIy.exe
  2⤵
  PID:8476
- C:\Windows\System\gZHmdME.exe
  C:\Windows\System\gZHmdME.exe
  2⤵
  PID:8492
- C:\Windows\System\pXGrreP.exe
  C:\Windows\System\pXGrreP.exe
  2⤵
  PID:8508
- C:\Windows\System\pOPCois.exe
  C:\Windows\System\pOPCois.exe
  2⤵
  PID:8528
- C:\Windows\System\UlCGJtn.exe
  C:\Windows\System\UlCGJtn.exe
  2⤵
  PID:8544
- C:\Windows\System\UYjVmZH.exe
  C:\Windows\System\UYjVmZH.exe
  2⤵
  PID:8560
- C:\Windows\System\kwrEAmC.exe
  C:\Windows\System\kwrEAmC.exe
  2⤵
  PID:8576
- C:\Windows\System\phMWDiy.exe
  C:\Windows\System\phMWDiy.exe
  2⤵
  PID:8592
- C:\Windows\System\wubgexQ.exe
  C:\Windows\System\wubgexQ.exe
  2⤵
  PID:8608
- C:\Windows\System\AwCEslE.exe
  C:\Windows\System\AwCEslE.exe
  2⤵
  PID:8624
- C:\Windows\System\PJEAsat.exe
  C:\Windows\System\PJEAsat.exe
  2⤵
  PID:8640
- C:\Windows\System\oJtxAOV.exe
  C:\Windows\System\oJtxAOV.exe
  2⤵
  PID:8656
- C:\Windows\System\lRximDH.exe
  C:\Windows\System\lRximDH.exe
  2⤵
  PID:8672
- C:\Windows\System\dsUetiI.exe
  C:\Windows\System\dsUetiI.exe
  2⤵
  PID:8688
- C:\Windows\System\sktjzYz.exe
  C:\Windows\System\sktjzYz.exe
  2⤵
  PID:8704
- C:\Windows\System\OrFttdR.exe
  C:\Windows\System\OrFttdR.exe
  2⤵
  PID:8720
- C:\Windows\System\wSAZXRi.exe
  C:\Windows\System\wSAZXRi.exe
  2⤵
  PID:8736
- C:\Windows\System\lcdVJlJ.exe
  C:\Windows\System\lcdVJlJ.exe
  2⤵
  PID:8752
- C:\Windows\System\hwgLmRR.exe
  C:\Windows\System\hwgLmRR.exe
  2⤵
  PID:8768
- C:\Windows\System\lPRlLtZ.exe
  C:\Windows\System\lPRlLtZ.exe
  2⤵
  PID:8784
- C:\Windows\System\gtlwRIJ.exe
  C:\Windows\System\gtlwRIJ.exe
  2⤵
  PID:8800
- C:\Windows\System\nPcmAqJ.exe
  C:\Windows\System\nPcmAqJ.exe
  2⤵
  PID:8816
- C:\Windows\System\PQBUksZ.exe
  C:\Windows\System\PQBUksZ.exe
  2⤵
  PID:8832
- C:\Windows\System\hMxAPJx.exe
  C:\Windows\System\hMxAPJx.exe
  2⤵
  PID:8848
- C:\Windows\System\XhCVRBj.exe
  C:\Windows\System\XhCVRBj.exe
  2⤵
  PID:8864
- C:\Windows\System\qlIWvVE.exe
  C:\Windows\System\qlIWvVE.exe
  2⤵
  PID:8880
- C:\Windows\System\ceJItPL.exe
  C:\Windows\System\ceJItPL.exe
  2⤵
  PID:8896
- C:\Windows\System\mlyayAT.exe
  C:\Windows\System\mlyayAT.exe
  2⤵
  PID:8912
- C:\Windows\System\BnLvmsM.exe
  C:\Windows\System\BnLvmsM.exe
  2⤵
  PID:8928
- C:\Windows\System\JzmsekM.exe
  C:\Windows\System\JzmsekM.exe
  2⤵
  PID:8944
- C:\Windows\System\KyFqUcX.exe
  C:\Windows\System\KyFqUcX.exe
  2⤵
  PID:8960
- C:\Windows\System\bPBjTVu.exe
  C:\Windows\System\bPBjTVu.exe
  2⤵
  PID:8976
- C:\Windows\System\QntFhKT.exe
  C:\Windows\System\QntFhKT.exe
  2⤵
  PID:8992
- C:\Windows\System\czpIIUq.exe
  C:\Windows\System\czpIIUq.exe
  2⤵
  PID:9008
- C:\Windows\System\QSaSrMu.exe
  C:\Windows\System\QSaSrMu.exe
  2⤵
  PID:9024
- C:\Windows\System\OOnPbDh.exe
  C:\Windows\System\OOnPbDh.exe
  2⤵
  PID:9040
- C:\Windows\System\LKPdtbt.exe
  C:\Windows\System\LKPdtbt.exe
  2⤵
  PID:9056
- C:\Windows\System\MunevPt.exe
  C:\Windows\System\MunevPt.exe
  2⤵
  PID:9072
- C:\Windows\System\lQTMQkp.exe
  C:\Windows\System\lQTMQkp.exe
  2⤵
  PID:9088
- C:\Windows\System\prabOiN.exe
  C:\Windows\System\prabOiN.exe
  2⤵
  PID:9104
- C:\Windows\System\UuClcth.exe
  C:\Windows\System\UuClcth.exe
  2⤵
  PID:9120
- C:\Windows\System\KKRnMGG.exe
  C:\Windows\System\KKRnMGG.exe
  2⤵
  PID:9136
- C:\Windows\System\EXdwDRs.exe
  C:\Windows\System\EXdwDRs.exe
  2⤵
  PID:9152
- C:\Windows\System\AzXzxVk.exe
  C:\Windows\System\AzXzxVk.exe
  2⤵
  PID:9168
- C:\Windows\System\WIgSzNY.exe
  C:\Windows\System\WIgSzNY.exe
  2⤵
  PID:9184
- C:\Windows\System\aSALKGY.exe
  C:\Windows\System\aSALKGY.exe
  2⤵
  PID:9200
- C:\Windows\System\gkjbNmz.exe
  C:\Windows\System\gkjbNmz.exe
  2⤵
  PID:8196
- C:\Windows\System\FNMIXnD.exe
  C:\Windows\System\FNMIXnD.exe
  2⤵
  PID:8260
- C:\Windows\System\zdmmSPh.exe
  C:\Windows\System\zdmmSPh.exe
  2⤵
  PID:8328
- C:\Windows\System\xAvKOwW.exe
  C:\Windows\System\xAvKOwW.exe
  2⤵
  PID:8388
- C:\Windows\System\sKKCLNg.exe
  C:\Windows\System\sKKCLNg.exe
  2⤵
  PID:8420
- C:\Windows\System\RcVFfGh.exe
  C:\Windows\System\RcVFfGh.exe
  2⤵
  PID:8484
- C:\Windows\System\vhwOUEE.exe
  C:\Windows\System\vhwOUEE.exe
  2⤵
  PID:8552
- C:\Windows\System\QjvSnmt.exe
  C:\Windows\System\QjvSnmt.exe
  2⤵
  PID:8616
- C:\Windows\System\xDHQvVt.exe
  C:\Windows\System\xDHQvVt.exe
  2⤵
  PID:8404
- C:\Windows\System\dSZfTDi.exe
  C:\Windows\System\dSZfTDi.exe
  2⤵
  PID:8216
- C:\Windows\System\cbjiFXJ.exe
  C:\Windows\System\cbjiFXJ.exe
  2⤵
  PID:8632
- C:\Windows\System\mhCWLQU.exe
  C:\Windows\System\mhCWLQU.exe
  2⤵
  PID:8248
- C:\Windows\System\WWgPdox.exe
  C:\Windows\System\WWgPdox.exe
  2⤵
  PID:8652
- C:\Windows\System\KyIetJq.exe
  C:\Windows\System\KyIetJq.exe
  2⤵
  PID:8636
- C:\Windows\System\lSrJETu.exe
  C:\Windows\System\lSrJETu.exe
  2⤵
  PID:8436
- C:\Windows\System\SJpxlvZ.exe
  C:\Windows\System\SJpxlvZ.exe
  2⤵
  PID:8504
- C:\Windows\System\vvsfUrM.exe
  C:\Windows\System\vvsfUrM.exe
  2⤵
  PID:8604
- C:\Windows\System\MmYYQVT.exe
  C:\Windows\System\MmYYQVT.exe
  2⤵
  PID:8712
- C:\Windows\System\jvLnRiE.exe
  C:\Windows\System\jvLnRiE.exe
  2⤵
  PID:8776
- C:\Windows\System\rojPLZK.exe
  C:\Windows\System\rojPLZK.exe
  2⤵
  PID:8840
- C:\Windows\System\GVAsACg.exe
  C:\Windows\System\GVAsACg.exe
  2⤵
  PID:8904
- C:\Windows\System\TEbklKC.exe
  C:\Windows\System\TEbklKC.exe
  2⤵
  PID:8968
- C:\Windows\System\bJEMaQa.exe
  C:\Windows\System\bJEMaQa.exe
  2⤵
  PID:9036
- C:\Windows\System\dGQBKzy.exe
  C:\Windows\System\dGQBKzy.exe
  2⤵
  PID:9068
- C:\Windows\System\EmxeJYW.exe
  C:\Windows\System\EmxeJYW.exe
  2⤵
  PID:8956
- C:\Windows\System\RwVaotr.exe
  C:\Windows\System\RwVaotr.exe
  2⤵
  PID:8860
- C:\Windows\System\TetMHBD.exe
  C:\Windows\System\TetMHBD.exe
  2⤵
  PID:8892
- C:\Windows\System\qzYzvvT.exe
  C:\Windows\System\qzYzvvT.exe
  2⤵
  PID:9128
- C:\Windows\System\yUWJkOM.exe
  C:\Windows\System\yUWJkOM.exe
  2⤵
  PID:9052
- C:\Windows\System\CDzuGGQ.exe
  C:\Windows\System\CDzuGGQ.exe
  2⤵
  PID:9084
- C:\Windows\System\slzfHBF.exe
  C:\Windows\System\slzfHBF.exe
  2⤵
  PID:9016
- C:\Windows\System\CiclijF.exe
  C:\Windows\System\CiclijF.exe
  2⤵
  PID:9112
- C:\Windows\System\outHWab.exe
  C:\Windows\System\outHWab.exe
  2⤵
  PID:9164
- C:\Windows\System\RyRZOZE.exe
  C:\Windows\System\RyRZOZE.exe
  2⤵
  PID:8232
- C:\Windows\System\zDsTwWW.exe
  C:\Windows\System\zDsTwWW.exe
  2⤵
  PID:9176
- C:\Windows\System\eFIwoFx.exe
  C:\Windows\System\eFIwoFx.exe
  2⤵
  PID:7516
- C:\Windows\System\GmImqLO.exe
  C:\Windows\System\GmImqLO.exe
  2⤵
  PID:8588
- C:\Windows\System\hjgkkzj.exe
  C:\Windows\System\hjgkkzj.exe
  2⤵
  PID:8392
- C:\Windows\System\ggFXsls.exe
  C:\Windows\System\ggFXsls.exe
  2⤵
  PID:8212
- C:\Windows\System\EXBDKyK.exe
  C:\Windows\System\EXBDKyK.exe
  2⤵
  PID:8344
- C:\Windows\System\oWlGVPI.exe
  C:\Windows\System\oWlGVPI.exe
  2⤵
  PID:8540
- C:\Windows\System\fJbGUlz.exe
  C:\Windows\System\fJbGUlz.exe
  2⤵
  PID:8600
- C:\Windows\System\uugAwmu.exe
  C:\Windows\System\uugAwmu.exe
  2⤵
  PID:8812
- C:\Windows\System\LmlvuFE.exe
  C:\Windows\System\LmlvuFE.exe
  2⤵
  PID:9064
- C:\Windows\System\nPCxXRU.exe
  C:\Windows\System\nPCxXRU.exe
  2⤵
  PID:8732
- C:\Windows\System\eqXtisw.exe
  C:\Windows\System\eqXtisw.exe
  2⤵
  PID:8924
- C:\Windows\System\sVSTrGm.exe
  C:\Windows\System\sVSTrGm.exe
  2⤵
  PID:8228
- C:\Windows\System\EpdGDOW.exe
  C:\Windows\System\EpdGDOW.exe
  2⤵
  PID:8524
- C:\Windows\System\WkGhtGy.exe
  C:\Windows\System\WkGhtGy.exe
  2⤵
  PID:8696
- C:\Windows\System\ALjKwmf.exe
  C:\Windows\System\ALjKwmf.exe
  2⤵
  PID:8748
- C:\Windows\System\YVWvWIP.exe
  C:\Windows\System\YVWvWIP.exe
  2⤵
  PID:9000
- C:\Windows\System\SBysbKd.exe
  C:\Windows\System\SBysbKd.exe
  2⤵
  PID:8988
- C:\Windows\System\sUxYgHf.exe
  C:\Windows\System\sUxYgHf.exe
  2⤵
  PID:8324
- C:\Windows\System\taJaDeD.exe
  C:\Windows\System\taJaDeD.exe
  2⤵
  PID:8280
- C:\Windows\System\Vqhcuit.exe
  C:\Windows\System\Vqhcuit.exe
  2⤵
  PID:8500
- C:\Windows\System\KdmiRma.exe
  C:\Windows\System\KdmiRma.exe
  2⤵
  PID:8744
- C:\Windows\System\xtmdnqa.exe
  C:\Windows\System\xtmdnqa.exe
  2⤵
  PID:8984
- C:\Windows\System\OqguNot.exe
  C:\Windows\System\OqguNot.exe
  2⤵
  PID:9048
- C:\Windows\System\RVytDcg.exe
  C:\Windows\System\RVytDcg.exe
  2⤵
  PID:8872
- C:\Windows\System\mfymafR.exe
  C:\Windows\System\mfymafR.exe
  2⤵
  PID:8856
- C:\Windows\System\QDYwdSa.exe
  C:\Windows\System\QDYwdSa.exe
  2⤵
  PID:8244
- C:\Windows\System\BRyKMKM.exe
  C:\Windows\System\BRyKMKM.exe
  2⤵
  PID:9180
- C:\Windows\System\BUfSGRU.exe
  C:\Windows\System\BUfSGRU.exe
  2⤵
  PID:8408
- C:\Windows\System\FvkPzed.exe
  C:\Windows\System\FvkPzed.exe
  2⤵
  PID:8940
- C:\Windows\System\SVKIeHf.exe
  C:\Windows\System\SVKIeHf.exe
  2⤵
  PID:8808
- C:\Windows\System\KTjVMrX.exe
  C:\Windows\System\KTjVMrX.exe
  2⤵
  PID:8876
- C:\Windows\System\uaSGFxL.exe
  C:\Windows\System\uaSGFxL.exe
  2⤵
  PID:9196
- C:\Windows\System\ypYTjBk.exe
  C:\Windows\System\ypYTjBk.exe
  2⤵
  PID:8828
- C:\Windows\System\ASpuKbR.exe
  C:\Windows\System\ASpuKbR.exe
  2⤵
  PID:9228
- C:\Windows\System\XJmxfDP.exe
  C:\Windows\System\XJmxfDP.exe
  2⤵
  PID:9244
- C:\Windows\System\yyHDNik.exe
  C:\Windows\System\yyHDNik.exe
  2⤵
  PID:9260
- C:\Windows\System\GsxOzrk.exe
  C:\Windows\System\GsxOzrk.exe
  2⤵
  PID:9280
- C:\Windows\System\OmfkVxK.exe
  C:\Windows\System\OmfkVxK.exe
  2⤵
  PID:9296
- C:\Windows\System\IlxtqgO.exe
  C:\Windows\System\IlxtqgO.exe
  2⤵
  PID:9312
- C:\Windows\System\BNPSLmy.exe
  C:\Windows\System\BNPSLmy.exe
  2⤵
  PID:9328
- C:\Windows\System\UYVLJbc.exe
  C:\Windows\System\UYVLJbc.exe
  2⤵
  PID:9344
- C:\Windows\System\aArAmst.exe
  C:\Windows\System\aArAmst.exe
  2⤵
  PID:9360
- C:\Windows\System\uHajVeY.exe
  C:\Windows\System\uHajVeY.exe
  2⤵
  PID:9376
- C:\Windows\System\mpMQzyP.exe
  C:\Windows\System\mpMQzyP.exe
  2⤵
  PID:9392
- C:\Windows\System\YhDhSVI.exe
  C:\Windows\System\YhDhSVI.exe
  2⤵
  PID:9408
- C:\Windows\System\cwfKAFj.exe
  C:\Windows\System\cwfKAFj.exe
  2⤵
  PID:9424
- C:\Windows\System\sYapeiM.exe
  C:\Windows\System\sYapeiM.exe
  2⤵
  PID:9440
- C:\Windows\System\XNEIvpe.exe
  C:\Windows\System\XNEIvpe.exe
  2⤵
  PID:9456
- C:\Windows\System\CuJIDHb.exe
  C:\Windows\System\CuJIDHb.exe
  2⤵
  PID:9472
- C:\Windows\System\JiWYUJD.exe
  C:\Windows\System\JiWYUJD.exe
  2⤵
  PID:9488
- C:\Windows\System\xpgXsHj.exe
  C:\Windows\System\xpgXsHj.exe
  2⤵
  PID:9504
- C:\Windows\System\ErStfeC.exe
  C:\Windows\System\ErStfeC.exe
  2⤵
  PID:9520
- C:\Windows\System\wLgsGNa.exe
  C:\Windows\System\wLgsGNa.exe
  2⤵
  PID:9536
- C:\Windows\System\UHdwxvI.exe
  C:\Windows\System\UHdwxvI.exe
  2⤵
  PID:9556
- C:\Windows\System\IINtFxy.exe
  C:\Windows\System\IINtFxy.exe
  2⤵
  PID:9572
- C:\Windows\System\mugYdKm.exe
  C:\Windows\System\mugYdKm.exe
  2⤵
  PID:9588
- C:\Windows\System\JWIHgWx.exe
  C:\Windows\System\JWIHgWx.exe
  2⤵
  PID:9604
- C:\Windows\System\LhKhpuA.exe
  C:\Windows\System\LhKhpuA.exe
  2⤵
  PID:9620
- C:\Windows\System\TFmbHoi.exe
  C:\Windows\System\TFmbHoi.exe
  2⤵
  PID:9636
- C:\Windows\System\cCEClzL.exe
  C:\Windows\System\cCEClzL.exe
  2⤵
  PID:9652
- C:\Windows\System\kxPaWEE.exe
  C:\Windows\System\kxPaWEE.exe
  2⤵
  PID:9668
- C:\Windows\System\IYzAeqn.exe
  C:\Windows\System\IYzAeqn.exe
  2⤵
  PID:9684
- C:\Windows\System\BXHIPJd.exe
  C:\Windows\System\BXHIPJd.exe
  2⤵
  PID:9700
- C:\Windows\System\ywhpYkW.exe
  C:\Windows\System\ywhpYkW.exe
  2⤵
  PID:9716
- C:\Windows\System\MjVcGDP.exe
  C:\Windows\System\MjVcGDP.exe
  2⤵
  PID:9732
- C:\Windows\System\iYDLdhL.exe
  C:\Windows\System\iYDLdhL.exe
  2⤵
  PID:9764
- C:\Windows\System\hmPlwmp.exe
  C:\Windows\System\hmPlwmp.exe
  2⤵
  PID:9780
- C:\Windows\System\qkbWpKQ.exe
  C:\Windows\System\qkbWpKQ.exe
  2⤵
  PID:9796
- C:\Windows\System\vBoCByg.exe
  C:\Windows\System\vBoCByg.exe
  2⤵
  PID:9812
- C:\Windows\System\dxJFkLa.exe
  C:\Windows\System\dxJFkLa.exe
  2⤵
  PID:9828
- C:\Windows\System\PVJXJwe.exe
  C:\Windows\System\PVJXJwe.exe
  2⤵
  PID:9848
- C:\Windows\System\tWErWIv.exe
  C:\Windows\System\tWErWIv.exe
  2⤵
  PID:9864
- C:\Windows\System\LvKQofD.exe
  C:\Windows\System\LvKQofD.exe
  2⤵
  PID:9880
- C:\Windows\System\QRaCmXu.exe
  C:\Windows\System\QRaCmXu.exe
  2⤵
  PID:9896
- C:\Windows\System\zjZEPFQ.exe
  C:\Windows\System\zjZEPFQ.exe
  2⤵
  PID:9912
- C:\Windows\System\OuVtZbZ.exe
  C:\Windows\System\OuVtZbZ.exe
  2⤵
  PID:9928
- C:\Windows\System\BlnrRHi.exe
  C:\Windows\System\BlnrRHi.exe
  2⤵
  PID:9944
- C:\Windows\System\amfCwHV.exe
  C:\Windows\System\amfCwHV.exe
  2⤵
  PID:9960
- C:\Windows\System\foUMKvI.exe
  C:\Windows\System\foUMKvI.exe
  2⤵
  PID:9976
- C:\Windows\System\ICtqxEm.exe
  C:\Windows\System\ICtqxEm.exe
  2⤵
  PID:9992
- C:\Windows\System\lLwEINU.exe
  C:\Windows\System\lLwEINU.exe
  2⤵
  PID:10008
- C:\Windows\System\KzKZBOu.exe
  C:\Windows\System\KzKZBOu.exe
  2⤵
  PID:10024
- C:\Windows\System\pNllVuH.exe
  C:\Windows\System\pNllVuH.exe
  2⤵
  PID:10040
- C:\Windows\System\uuaungm.exe
  C:\Windows\System\uuaungm.exe
  2⤵
  PID:10056
- C:\Windows\System\bOPUjGh.exe
  C:\Windows\System\bOPUjGh.exe
  2⤵
  PID:10072
- C:\Windows\System\BOWlHmm.exe
  C:\Windows\System\BOWlHmm.exe
  2⤵
  PID:10088
- C:\Windows\System\VbacMFe.exe
  C:\Windows\System\VbacMFe.exe
  2⤵
  PID:10104
- C:\Windows\System\LHEWtUO.exe
  C:\Windows\System\LHEWtUO.exe
  2⤵
  PID:10120
- C:\Windows\System\fIgeaNy.exe
  C:\Windows\System\fIgeaNy.exe
  2⤵
  PID:10136
- C:\Windows\System\nFeHYAx.exe
  C:\Windows\System\nFeHYAx.exe
  2⤵
  PID:10152
- C:\Windows\System\fXlCRxM.exe
  C:\Windows\System\fXlCRxM.exe
  2⤵
  PID:10168
- C:\Windows\System\DahMqgK.exe
  C:\Windows\System\DahMqgK.exe
  2⤵
  PID:10184
- C:\Windows\System\vBPywTY.exe
  C:\Windows\System\vBPywTY.exe
  2⤵
  PID:10200
- C:\Windows\System\nQSRiOy.exe
  C:\Windows\System\nQSRiOy.exe
  2⤵
  PID:10216
- C:\Windows\System\mKplpTb.exe
  C:\Windows\System\mKplpTb.exe
  2⤵
  PID:10232
- C:\Windows\System\dWMjegQ.exe
  C:\Windows\System\dWMjegQ.exe
  2⤵
  PID:9224
- C:\Windows\System\EmtZasA.exe
  C:\Windows\System\EmtZasA.exe
  2⤵
  PID:9256
- C:\Windows\System\rUUAWBD.exe
  C:\Windows\System\rUUAWBD.exe
  2⤵
  PID:9308
- C:\Windows\System\BGECiJh.exe
  C:\Windows\System\BGECiJh.exe
  2⤵
  PID:9368
- C:\Windows\System\DeNvljs.exe
  C:\Windows\System\DeNvljs.exe
  2⤵
  PID:9292
- C:\Windows\System\WWudjxF.exe
  C:\Windows\System\WWudjxF.exe
  2⤵
  PID:9388
- C:\Windows\System\vUEZBOK.exe
  C:\Windows\System\vUEZBOK.exe
  2⤵
  PID:9436
- C:\Windows\System\ctQhhtT.exe
  C:\Windows\System\ctQhhtT.exe
  2⤵
  PID:9500
- C:\Windows\System\OrxVTrX.exe
  C:\Windows\System\OrxVTrX.exe
  2⤵
  PID:9564
- C:\Windows\System\Hfhkawi.exe
  C:\Windows\System\Hfhkawi.exe
  2⤵
  PID:9632
- C:\Windows\System\YvNDfvy.exe
  C:\Windows\System\YvNDfvy.exe
  2⤵
  PID:9420
- C:\Windows\System\PzBtgcm.exe
  C:\Windows\System\PzBtgcm.exe
  2⤵
  PID:9612
- C:\Windows\System\tCghviU.exe
  C:\Windows\System\tCghviU.exe
  2⤵
  PID:9512
- C:\Windows\System\ccknUyo.exe
  C:\Windows\System\ccknUyo.exe
  2⤵
  PID:9680
- C:\Windows\System\mfzrmwZ.exe
  C:\Windows\System\mfzrmwZ.exe
  2⤵
  PID:9580
- C:\Windows\System\SQDgQDH.exe
  C:\Windows\System\SQDgQDH.exe
  2⤵
  PID:9744
- C:\Windows\System\DKXpvGD.exe
  C:\Windows\System\DKXpvGD.exe
  2⤵
  PID:9776
- C:\Windows\System\NEQWlcr.exe
  C:\Windows\System\NEQWlcr.exe
  2⤵
  PID:9840
- C:\Windows\System\GIjmJsu.exe
  C:\Windows\System\GIjmJsu.exe
  2⤵
  PID:9792
- C:\Windows\System\rhDviyP.exe
  C:\Windows\System\rhDviyP.exe
  2⤵
  PID:9908
- C:\Windows\System\rHudEEc.exe
  C:\Windows\System\rHudEEc.exe
  2⤵
  PID:9856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AhpOyCc.exe

Filesize
1.8MB

MD5
a242ebdeb1b7fb2379c370b29bf2151d

SHA1
c7fd619b05042cd519f32ddb08a73c2928ac334e

SHA256
cf368962ebff8324577c0218886e319a7fa5dbb5094edce51d85320579862bca

SHA512
0b3ef3ca98064d553a719187093a759cf8bf9c5744ff083d65b38a61c64ac9d2b7a6a7777d421d568924ec25690c7bbf51abd6ecd26cbdbaec88356a2ccd1a0f

Download Submit
C:\Windows\system\DSAtUDg.exe

Filesize
1.8MB

MD5
893c2df956d1ff2baa9d381797c7195c

SHA1
2c2c24448e370b1ac8d5444474f15c32fa0be65f

SHA256
04b60942c12f22f685e3724dbddd037bfb5fc072a15c73093f16b9ec50476fe3

SHA512
e34472f254c7a168deaf06ebafd379f6b5022d8742e9ac453697c68d97b35e19b276a88cf9befc2af94d658ca38f075e51ef3d3a5accb90de04912fbf5394b37

Download Submit
C:\Windows\system\EXffGBF.exe

Filesize
1.8MB

MD5
b717f9c972df7a4624fc1a20abf3fb78

SHA1
8e844416db24083dfb00a504940bbc23429b2638

SHA256
410c619429a6cb757abc1e7d793e39c50d43195ae0526112b366b18ce732c87e

SHA512
64fe2ba903fb4bd6dff57a3394c5f3300075676521c94bc25aaa700ba3b5643ae5eee77119cc71128aca3f51a24f1a174df17b146c3e995aa1aeebce9971ddc3

Download Submit
C:\Windows\system\EtJUwGu.exe

Filesize
1.8MB

MD5
03f2080005e951f03199ab2c0cf7cf00

SHA1
edcb1de67ca01dfcc80cfb37a89a97d14a6f0fc1

SHA256
4ac211db01544fb311b494a832099237c06644ee3770deb2a5934a2dc06f974f

SHA512
b4487d298048edcef33265f06188177482eafc8bf88f8a1aeabda696672766e55a04bb76cc0ef85327213fe65027b07ad5a3179bd0bb963bf85604cbb988fb1d

Download Submit
C:\Windows\system\HnXSiyR.exe

Filesize
1.8MB

MD5
2de4fd6cce5db55752a0d4e2895ad3d9

SHA1
670bdfac91c8532f45f0d8192b438b351e3381fe

SHA256
da77b0acec9b989501050f1820a39b6894d420b26243a351611ddeef2970e672

SHA512
7499fbf9b362065b3cc3276f955273fc4614e288ab71116a021b3d19646ad7f8fa9c489b90d472d12bbccf879bafa6b385b9df50864dc85b2d88b1204a8ba59f

Download Submit
C:\Windows\system\KJBqJrD.exe

Filesize
1.8MB

MD5
34b0f918f034416ff48ab88f9bfe027e

SHA1
28fd90cf232ca726c0b7d0c7e44f332b00fc118f

SHA256
375aeacb9c0cc4cce32c2c98ff6e99eae1d2e860abdbbd9b4d1a96104ba6bf39

SHA512
bd8934d054c5795e9ad98bb8acfb9f959cde2a399e4b6134924aeef13d260e785175d97b865a3b8f4f3c62b99c7164c9dbe0116a197e690cdd476766ba2e88be

Download Submit
C:\Windows\system\MikvjFZ.exe

Filesize
1.8MB

MD5
a5057760bcbf1861147d5fe5ddfc72e4

SHA1
0e6629da3a1fa67dab9ab9964f625c5ab576d47c

SHA256
de0c8a2907929abc9d5970e02ab05299aa258499c8adf78319d7956299f95824

SHA512
fa59458a3b0f0fc1da9410d3d2721ac1d7ae44e81991dc894487521244ec5f3ff187d8777ac080fa4befcd42bf7b821e634bf521188dbb865ff348d317cfc9cb

Download Submit
C:\Windows\system\NgGwFYJ.exe

Filesize
1.8MB

MD5
91ad879cb4828eeb21e5b7df3e5c1d99

SHA1
72b6a6d0410671af3dbb49bb07269ca6d96d7b87

SHA256
35c6cf63bf268a0548dab7f13f5dc6acec4679c426d2dbaf134a3b1b442d5898

SHA512
e326cd6e2359c7b80f677000cedaa9b8e389275daabbc74e08cf1042d73f0c13c73b1c15804d98ebd67807304bb1b5497e8f018aa689a44d8469c2669de62f74

Download Submit
C:\Windows\system\TKKWCIm.exe

Filesize
1.8MB

MD5
9453543864a950e3d35410eaa2ac3572

SHA1
a596651ca5b1e2a6fae43562a3bbef63b181848c

SHA256
7ba14dce9a1bb60bd85e773f11140722d29bd536512a3b334cb0dd8e01713e9d

SHA512
7c503a21edc7c54171e887b2b517344ba1f1c451b19615fc58629927179265f10a506b6655cd715f5fb7d856b15d40603920bf61ba0c9ec582d00ccf0994a5a2

Download Submit
C:\Windows\system\TMyGzRg.exe

Filesize
1.8MB

MD5
52e83f84a4e9880a70e861950cb19ffc

SHA1
e62c41d4ab250e3a630bc88f778f986b4b70c117

SHA256
9d7a6b87addd728cea0c470b5a239ea9ab2517e721b15b7653267a5ace57e2c4

SHA512
ef07a733207cce99b8ae502142b8fed88a2d7891b7acac69e539a5d8ec9e84a66051b8612560d46539d055c933bd5ba91dcbca9ebdc320a5c27a29448d25e9b4

Download Submit
C:\Windows\system\TwtDJIb.exe

Filesize
1.8MB

MD5
8e8a32ca8e8d4728c46f9f8a0d8fe78e

SHA1
cb857ddc480eb74dd2a4bc48c03da4dc0f746530

SHA256
3991e4930fe009df9194807ddcc89b3ae76b0056b29aea171005bc8f35e2947b

SHA512
6d9520ebd5de175354324e5a004962ea5ca7ae7fc3a5a7ef63fbed6cea84b656e3ac2b006c6a6c9bb0f2996f0f9345a9084e5df20d7725960c2abbabeac207cd

Download Submit
C:\Windows\system\XspjivK.exe

Filesize
1.8MB

MD5
a84115d508f9ba455faac9d6df99b756

SHA1
cb23edc29485f0bd5547ee56d4b4c05661760a9a

SHA256
88b13ea21ce8acb1a514159c79244a7ff8f6efbcf81676651e2df7038eeeeb74

SHA512
3540cbec54b7a3ba25ff1606ec8b54a2fcefd4166033b6ad3d611fdecbd8531513277c2da476cec41c92102d3de8060420ab49241acd7e33fe680048f10f97ec

Download Submit
C:\Windows\system\YiZmUNM.exe

Filesize
1.8MB

MD5
24d81255a81aa90e598c8f20bda06d1e

SHA1
e2bd99531b1986eddd80abe3066834a34edc7eea

SHA256
59fea71111a8c636ff64024433f3065a25fa1e4adb9ad428e5a725857cb8782f

SHA512
8a13fe72cbeb9d23e475b37fda56dada8bec035e6f39d99e97d7ed2b430330c9458b9370a630225ece2a056073a21644d4ad127043e49137d2546b0c11d29424

Download Submit
C:\Windows\system\baJFVka.exe

Filesize
1.8MB

MD5
b0cec69e59827faf278db5ec467fa987

SHA1
efa8ca4db2c76b34590d7ed94b15f4328241bc88

SHA256
23da26d7d559841a2c620de884f1953972f7724c48a668f0df83dd8f434d9fce

SHA512
7a61115798fd27af7a89112f206287cfc49af42cb3ce811f54e4f05a489da6d73ac5566ad6a80c0ade490377e720ceca4583c53cd8c05d146e4249f866759c47

Download Submit
C:\Windows\system\fUcVzVZ.exe

Filesize
1.8MB

MD5
e95fa5c2d5ae9046391e23d675990a7d

SHA1
193d32dbe8564f1d9cd6fd6d9e0a5ae3eb7e0f5f

SHA256
97faf7e72952f01e4ae0599e7c358b06a1c3a5e4e6a561b47cd2ef5121c3477c

SHA512
47e7886afcccc3c886d60150c791e93043daddd627a742566642658fb1150d89990932e436a4a0dc2252f1de63d0e83bef1a431226faa59ae9ee4eb9b5ebf46f

Download Submit
C:\Windows\system\gHZQRMD.exe

Filesize
1.8MB

MD5
3bb3a15c84b503edf96877f1a6d07760

SHA1
f6593c1c558bff96cb1161076df2ba42e4738f80

SHA256
3e2c8b8530ea8095ac70f98056f90f51b3abe8b2e3e529fb48be4d339605cb9c

SHA512
62f2e9675cb73dd78372a186bc54ecb7a24934a026aabe2bb7cfa24100c6546c7e3454f415348713827dd6f7c1a3cdb1689a6abaf604d92e6ccdefc784788a48

Download Submit
C:\Windows\system\hRterYG.exe

Filesize
1.8MB

MD5
20e62f088a701c6de2cc2d2b5c463b72

SHA1
de1825a54b8c9a5498f24fc4c22add565c42d4fb

SHA256
cfcf4ac36c3ddacf129b0f42afc97fb38057814653ebbc7e531f1d16918ee08f

SHA512
95e7fb61e1060bf8ca0e14f4b587d5de3ac7777bb2fc0df55ae690f0c92e14dcd648b9a99c1a6167a335ef3a3ca852d6cf4704c043c791d8a78539f3d37d823f

Download Submit
C:\Windows\system\nMDcJHL.exe

Filesize
1.8MB

MD5
2f224e965c0ad3c87f5a066b44528367

SHA1
462eca1d2d7d121e583f2e9b3e85e0eaa0098a67

SHA256
642a9d4c49f43b02f1bbba5f8fca163cdaa4bf3c13e5acdac516663dc2d83c30

SHA512
088f99875bab1caf48901ad8bcc3504688f3452c060a2513051f32eb0ae763788438d21122be8bd28619b838d605f05029e4ad5459f8f4358c002a56373f4015

Download Submit
C:\Windows\system\pmjlJQl.exe

Filesize
1.8MB

MD5
f5c045adf90ab41e2f354e7bc2afd9d0

SHA1
c5887f0c4c88c65ce49ba9ec99103d894c475acb

SHA256
f834a558da4f543b6b2e0fe4f661d6dba70afc7f1ebf22c484c822557557861f

SHA512
ed218b5cb3a12d13d5595b6232742638644096aff3151d18a0722023b1cfdb3cbfad95b9ba5519aae231c223eca687ae516b2a10f05410763b70ee5afc2046f6

Download Submit
C:\Windows\system\smtXWks.exe

Filesize
1.8MB

MD5
0123945b01c79bac4566a5ce3dd1393e

SHA1
ea67a68cdd5572d035b5ee67cf976eb07fa02b4a

SHA256
bed85e5304559756e320d5344798f4faf12d8920ed4036ef40e2f84a01d88f8d

SHA512
0fcf166cf02d9e9be4911a2a9b3f7be57ba62750412a16f38bd7b12e097ebfbfc1694468bb66ffe46f8086ea204b9180a6a6219d959a0a772cf1ec60bcb829fb

Download Submit
C:\Windows\system\tmfkmLP.exe

Filesize
1.8MB

MD5
688ba7eedda7ef12f3b8e48fb6af3d76

SHA1
1a3f35b219ea3cd9b0b2f9dcb2ea61a9e12b3d88

SHA256
0758bd67104e18f50a16af0ed3a78f4cbca9c12a9988c3ef69c6d9d1d8480af4

SHA512
dd5b271d3ccde094ed274da7b6d76422c30f9ad246bb598ced15915fe32c83dd4c4e257f44cd383ee203f622d87cde41f3ef14d76104ca7eed335ddf8c5dc236

Download Submit
C:\Windows\system\txEpdsB.exe

Filesize
1.8MB

MD5
69ff816b1f5435d13ccf92d1f6cb757c

SHA1
f0f9532377df6d9c507d2626c5bd6f0e5125dd62

SHA256
261509da353bbeb8a26f9bbd329d031007044cdc8fcef1e1a83aa077fe8069c3

SHA512
4b2162fe6c07f1bfab3920bd1f251bae8c2be5e653194633c5e9e5888ba5536763ac1580a6e42bfedcb34337bff2981db55ac2ba90617865817db73678d37560

Download Submit
C:\Windows\system\vQgRYux.exe

Filesize
1.8MB

MD5
d2e78ca409a833b2ea67a16aae2f17c5

SHA1
5d0f908fdbe5e4271305ede77a588ffb321066f8

SHA256
97f1c3de343881e2c2cffa86e59ff22ac98f3765a7f0f9d1fc4c5da07064ba4e

SHA512
a3141be3c83405a22b7f74e3fc98439eb7d5b7551be7622e561851ca9f5b0d4f02f4652fcc676fee8dac39a45f2c1dbd1d6349eb470297aff9c46ab45b0ca054

Download Submit
C:\Windows\system\zFEwJUv.exe

Filesize
1.8MB

MD5
327434c1d36da06924e0fbdedf453ac8

SHA1
324653f6e12ac4ad9936e606313a904774b55dd6

SHA256
73fb214989f3086993984476a0515ffdb7b1d0d26064a2232f80b67c96dd3dd3

SHA512
9024768b24d6ed52de2ac05cb71d0cdc468f8f651a39d59be4a7f3d0dde78d069074cb2cf813660b7d7f7eff29fe3e37a8ebdcbb213f7aba76a564fabf5f468e

Download Submit
C:\Windows\system\zLfbDqV.exe

Filesize
1.8MB

MD5
d3b866bc12897b21629036760f33dade

SHA1
2b5bfb47ea20de7e8205319490d1308f90e26b74

SHA256
7b958df85a4ee2f82b63ae5dc326bb72d59f673cf4dcbb709e530717c35f9e5a

SHA512
652baee9a7f454afe3b48f766e8369fa0405de588c9e03ffe663aa7fd517a601387e59d1a8ea7f874ffc22c075ca4b4815b36546ca3ad49b06f88c25f2e984d8

Download Submit
\Windows\system\HVhYhpN.exe

Filesize
1.8MB

MD5
785bd40e08423098542038e25db4406e

SHA1
76119bc72c11c6e041554a2311c1431da051d7dc

SHA256
a44de60f54ae057841798e06282b80cd2bac7e9824f62f152b2782f900e0a3f8

SHA512
1bb9889b1d5a54014b16e565dbeb976db648c695a12f582557948f63a945fae8118e3288b14c16d6ccef03be8511f8b9ef670d0ad9373628f2c9df5717161ab0

Download Submit
\Windows\system\KbxTPSO.exe

Filesize
1.8MB

MD5
100ecf557e943ca207b828a476b976d9

SHA1
bcb86d8fc3b5ab482719cd092c01accd56780180

SHA256
1dd9c5efff61fb7db9573b2655ce04086cc92af5e72f1bc4ebe539528a208d49

SHA512
63c72c8829922d01d956bba8d86a9635bd523a9e2b769abc76d83a144120e23f31a8eb4dedd76102a5292dea89658c6f4335f577cd2abed631ed2daede45d086

Download Submit
\Windows\system\MVSOBLu.exe

Filesize
1.8MB

MD5
1b97626dc86115bb623e8f22d0b9841a

SHA1
3001d3ca438bc0994cc573b17e258f583cada6d2

SHA256
dfa6e7398612298c17e33f6d8b1ae4e995739e60d26844c42690927159da21c6

SHA512
91981359531a56f3f6c2e40b846d21472d0f818c60d8446831ab45b8c00fef4341e3506f11860b8a6080405609c2e359eeb53adad5096892c3043e3ac8a00974

Download Submit
\Windows\system\PyRyGNO.exe

Filesize
1.8MB

MD5
a8e58f934ccda7c50ad8d2b70ab4b2c0

SHA1
b0b72085ceab1651d96331eada452ef3d24b2b9f

SHA256
a04f610ca5fb4036b519dbabf1e17fb3b84d86fd937ed06193683d91be6091ab

SHA512
b967274b67605549762f422a3a300964dcfe5a1e8c47ccff6ff41121c097f601efa183404b818d68c85ee262f2f11e9663938f5573d55a5715aa04d29ec0b623

Download Submit
\Windows\system\dbfNOkY.exe

Filesize
1.8MB

MD5
9ce76a60da3fc0b58baae773d158718e

SHA1
5d866b973545542ebf6de03cb052d23a8ea43280

SHA256
616786eb62ebf489df4d2d4d93a69b9e5bcaaa3ec1d78d1d465aad52a1502a08

SHA512
794aa5cb5358558b41cd1a7e43ea024341fa2f7b711aaa879e1b52d42712710bb5b588a4281d7a570cb6940dc5c3bed25c5c21bd58f9147a77492fc8f5742201

Download Submit
\Windows\system\lynLcru.exe

Filesize
1.8MB

MD5
ab6b88e7e8a743cdd62ad5bb2f68766a

SHA1
6498a9c3abf12a18fcd619e4febf65ff90a7d400

SHA256
9500b4ce0dee650e99cae74e17aebc8cd4a0fa24d2a8cc95c62711fdba81c249

SHA512
469e7cdf3e3eaff2fb855d0d3268f6c37c5642ac9eb4a57d770cc4c21c14adf28b46b6b870f16d2248136912aac1f2c681a34a0425f421226bb75052be4b2b32

Download Submit
\Windows\system\oOmUyTO.exe

Filesize
1.8MB

MD5
1b5233348447d037b095a115c1ad7f04

SHA1
3de57118dd8077e719613436779f92f29f764178

SHA256
3826fb6860bbaa97c570f370661c6b0611116a2cee77bbf70f36a87610da9b88

SHA512
46efb04e8acb7abf13dedaf665d60d72734c188aff1ad92b0771eac88b45779e181c128da0d65af351e9d83c62d23fce35ead92c315835a8537e05c9ab825e8d

Download Submit
\Windows\system\pNcnkZb.exe

Filesize
1.8MB

MD5
9b80b9891bdb262ed2d608bb4c365ada

SHA1
0861982c97387b3fe64440dd52fd39c636de8b76

SHA256
b7a2d89e2c2227a90da7940084906ae8f397ee0ab6b66f24f85ea8e30957407b

SHA512
b96929e83692393612a3a3746d88c4558cc2811185a3d24b432da7b4f3befbf56b1c7c3f6442d0a6f97bc46732e26978b11c368f78b22585c84411e2f94c95b9

Download Submit
memory/1580-176-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-182-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2036-12-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2196-166-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-167-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2196-193-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2196-1786-0x000007FEF5410000-0x000007FEF5DAD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-13-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2196-215-0x0000000001E40000-0x0000000001E48000-memory.dmp

Filesize
32KB

Download
memory/2268-173-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-0-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2268-186-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2268-171-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2268-181-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2268-7-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2268-175-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2268-183-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2268-169-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2268-185-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2496-184-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2620-168-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2624-174-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2644-172-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2712-170-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2960-177-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download