xmrig | 20d6c1bdf73b99ed9f6119918530449d1a4cbd06d835f1d38c9c4a16b647cbc2

Analysis

max time kernel
89s
max time network
94s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
Size

2.3MB
MD5

036991855ee10bd1cd85d8887f64c31a
SHA1

782f667624981468ce1a324e37865c10312a2f9f
SHA256

20d6c1bdf73b99ed9f6119918530449d1a4cbd06d835f1d38c9c4a16b647cbc2
SHA512

7b2dd2865a6b596a2c7473c84f16b454089b1326735edc77d39c7788cf2deb72404f49164c2609d8d67b5f3bbf4974d40d4a173a92504f6807430d1a9edf4983
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiq6:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2868-9-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2656-36-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2272-236-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2668-94-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2400-79-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2420-127-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2620-61-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig
behavioral1/memory/2752-42-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2868-467-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2928-505-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2656-804-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2868	aJRrkrj.exe
2656	OxOtsNn.exe
2928	JkVCapG.exe
2752	BGEnvBT.exe
3036	OhKYpzc.exe
1808	lvvLyTK.exe
2620	NKnAxwO.exe
2420	iMQoVwY.exe
2400	esLxiBf.exe
2668	pXncysJ.exe
3064	oinHVLq.exe
2360	NBETdoF.exe
2576	BTiAPly.exe
1264	hWNnSRV.exe
1244	TgdmJwF.exe
1700	adpwUaP.exe
1932	eNtbHqk.exe
1780	nLzGIGk.exe
2676	XJJOvBZ.exe
2756	UxRPJjK.exe
2084	yOSCgSX.exe
2692	ITqteYN.exe
1600	gIGVcPn.exe
2324	sPyYTpw.exe
824	YtxpcNh.exe
1260	YWnzxbX.exe
604	fSZOKBh.exe
1696	PuNXZNJ.exe
1156	rYEoFFp.exe
2336	XGupljT.exe
1716	PGgKonh.exe
1636	caJKpMh.exe
936	ONyumNK.exe
588	EvsGtVW.exe
2748	uMMBKcd.exe
1816	QNndOHM.exe
2056	EmpKpHD.exe
948	ffGTNFK.exe
1352	ZuDdqta.exe
1500	NJldVdI.exe
1772	YCgBREr.exe
736	CvEYTAP.exe
2564	tKrAMGc.exe
696	uPGqymI.exe
2892	JDhJwiT.exe
3056	JeKyOKV.exe
760	nZZqeze.exe
928	jPKOFtz.exe
1460	xMUoyBq.exe
888	buCpjpq.exe
872	lHemllk.exe
2980	vgvcfoO.exe
2116	iVAkaUB.exe
1692	rtJLCoP.exe
3016	XHqLxnD.exe
1428	xGWZUcZ.exe
2712	GFCZoLb.exe
2772	qqlBGbj.exe
1652	kETLUVq.exe
592	MniWidG.exe
2624	eWATvHY.exe
2736	TVeLhHq.exe
2364	vwPMkqI.exe
1872	nllKrpB.exe

Loads dropped DLL 64 IoCs

pid	Process
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2272-0-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0009000000016c90-3.dat	upx
behavioral1/files/0x0007000000016d4f-17.dat	upx
behavioral1/files/0x0009000000016d55-24.dat	upx
behavioral1/files/0x0009000000016d01-13.dat	upx
behavioral1/files/0x0008000000016d4a-15.dat	upx
behavioral1/memory/2868-9-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2656-36-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/files/0x0008000000016d84-45.dat	upx
behavioral1/files/0x0009000000016d24-62.dat	upx
behavioral1/files/0x0005000000019521-80.dat	upx
behavioral1/files/0x00050000000195ba-125.dat	upx
behavioral1/files/0x000500000001996e-147.dat	upx
behavioral1/files/0x0005000000019bef-161.dat	upx
behavioral1/files/0x0005000000019ce6-171.dat	upx
behavioral1/files/0x0005000000019547-189.dat	upx
behavioral1/files/0x0005000000019d59-185.dat	upx
behavioral1/files/0x0005000000019f42-191.dat	upx
behavioral1/memory/2272-236-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x000500000001950c-182.dat	upx
behavioral1/files/0x0005000000019d4d-172.dat	upx
behavioral1/files/0x0005000000019cba-164.dat	upx
behavioral1/files/0x0005000000019bd7-160.dat	upx
behavioral1/files/0x0005000000019bd8-157.dat	upx
behavioral1/files/0x0005000000019bd6-150.dat	upx
behavioral1/files/0x0005000000019646-144.dat	upx
behavioral1/files/0x00050000000196d8-142.dat	upx
behavioral1/files/0x00050000000195a9-136.dat	upx
behavioral1/files/0x00050000000195ff-129.dat	upx
behavioral1/files/0x00050000000195a7-124.dat	upx
behavioral1/files/0x00050000000195a4-123.dat	upx
behavioral1/files/0x000500000001959e-122.dat	upx
behavioral1/files/0x00050000000195aa-119.dat	upx
behavioral1/files/0x00050000000195a8-113.dat	upx
behavioral1/files/0x00050000000195a6-105.dat	upx
behavioral1/files/0x00050000000195a2-99.dat	upx
behavioral1/files/0x00060000000194f2-98.dat	upx
behavioral1/memory/2668-94-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x0005000000019570-93.dat	upx
behavioral1/files/0x000500000001959c-89.dat	upx
behavioral1/memory/2400-79-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2420-127-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-71.dat	upx
behavioral1/files/0x00050000000194f4-69.dat	upx
behavioral1/memory/2620-61-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/3036-44-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2752-42-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0007000000018b42-52.dat	upx
behavioral1/memory/1808-47-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2928-23-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2868-467-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2928-505-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2656-804-0x000000013FC10000-0x0000000140002000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vbSmlwS.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\mtZoiPC.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\TWbnrev.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\swcUuYb.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\KdAetyW.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ITqteYN.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\bFYHsxb.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\xGGHAwZ.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ZsxSVsT.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\IYQYboI.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\kccUczk.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\AuRkHyx.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\FEILgBN.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\sncQEtK.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\aOnAMvY.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\JDhJwiT.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\xGWZUcZ.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\PsBbbBZ.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\aHVgZSq.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ZyxtRrF.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\JULDKmw.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\axCmwAC.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\rgqjLtq.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\PVofENh.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\qqlBGbj.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\kaewPzW.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\kDQndQA.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\mtqgqHw.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\vwPMkqI.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\WQmDULH.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\VmWchzS.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\bGgWbIz.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\esLxiBf.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\EmpKpHD.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\qWMhvZc.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\qGVyWZc.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\kYKiecy.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ABzadqF.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\kQVleZC.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\dfdLjPt.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\QchOqOb.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\asGdegi.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\MZOwVPY.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\YVwDLFu.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\VHVfNid.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\jAffUVO.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\JiPLqXK.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\snqFXAN.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\pGFANon.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ADcwjWO.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ypCxHyQ.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\pSjHDUe.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\HsLnGQo.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\ManacsJ.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\rpoSxPo.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\scIyYfm.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\IGmUatT.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\oEwwzDr.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\lSIyhFS.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\EgffhWt.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\tuGbhlK.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\AwmpRXc.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\pqILTSg.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
File created	C:\Windows\System\wWpvRmL.exe	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
Token: SeDebugPrivilege	2240	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2240	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	29
PID 2272 wrote to memory of 2240	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	29
PID 2272 wrote to memory of 2240	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	29
PID 2272 wrote to memory of 2868	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2868	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2868	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	30
PID 2272 wrote to memory of 2656	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2656	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2656	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	31
PID 2272 wrote to memory of 2928	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	32
PID 2272 wrote to memory of 2928	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	32
PID 2272 wrote to memory of 2928	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	32
PID 2272 wrote to memory of 3036	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	33
PID 2272 wrote to memory of 3036	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	33
PID 2272 wrote to memory of 3036	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	33
PID 2272 wrote to memory of 2752	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	34
PID 2272 wrote to memory of 2752	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	34
PID 2272 wrote to memory of 2752	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	34
PID 2272 wrote to memory of 1808	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	35
PID 2272 wrote to memory of 1808	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	35
PID 2272 wrote to memory of 1808	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	35
PID 2272 wrote to memory of 2620	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	36
PID 2272 wrote to memory of 2620	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	36
PID 2272 wrote to memory of 2620	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	36
PID 2272 wrote to memory of 2668	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	37
PID 2272 wrote to memory of 2668	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	37
PID 2272 wrote to memory of 2668	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	37
PID 2272 wrote to memory of 2420	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	38
PID 2272 wrote to memory of 2420	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	38
PID 2272 wrote to memory of 2420	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	38
PID 2272 wrote to memory of 2576	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	39
PID 2272 wrote to memory of 2576	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	39
PID 2272 wrote to memory of 2576	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	39
PID 2272 wrote to memory of 2400	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	40
PID 2272 wrote to memory of 2400	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	40
PID 2272 wrote to memory of 2400	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	40
PID 2272 wrote to memory of 2324	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	41
PID 2272 wrote to memory of 2324	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	41
PID 2272 wrote to memory of 2324	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	41
PID 2272 wrote to memory of 3064	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	42
PID 2272 wrote to memory of 3064	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	42
PID 2272 wrote to memory of 3064	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	42
PID 2272 wrote to memory of 1260	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	43
PID 2272 wrote to memory of 1260	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	43
PID 2272 wrote to memory of 1260	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	43
PID 2272 wrote to memory of 2360	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	44
PID 2272 wrote to memory of 2360	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	44
PID 2272 wrote to memory of 2360	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	44
PID 2272 wrote to memory of 604	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	45
PID 2272 wrote to memory of 604	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	45
PID 2272 wrote to memory of 604	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	45
PID 2272 wrote to memory of 1264	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	46
PID 2272 wrote to memory of 1264	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	46
PID 2272 wrote to memory of 1264	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	46
PID 2272 wrote to memory of 1696	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	47
PID 2272 wrote to memory of 1696	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	47
PID 2272 wrote to memory of 1696	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	47
PID 2272 wrote to memory of 1244	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	48
PID 2272 wrote to memory of 1244	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	48
PID 2272 wrote to memory of 1244	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	48
PID 2272 wrote to memory of 1156	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	49
PID 2272 wrote to memory of 1156	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	49
PID 2272 wrote to memory of 1156	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	49
PID 2272 wrote to memory of 1700	2272	036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\036991855ee10bd1cd85d8887f64c31a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2240
- C:\Windows\System\aJRrkrj.exe
  C:\Windows\System\aJRrkrj.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\OxOtsNn.exe
  C:\Windows\System\OxOtsNn.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\JkVCapG.exe
  C:\Windows\System\JkVCapG.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\OhKYpzc.exe
  C:\Windows\System\OhKYpzc.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\BGEnvBT.exe
  C:\Windows\System\BGEnvBT.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\lvvLyTK.exe
  C:\Windows\System\lvvLyTK.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\NKnAxwO.exe
  C:\Windows\System\NKnAxwO.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\pXncysJ.exe
  C:\Windows\System\pXncysJ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\iMQoVwY.exe
  C:\Windows\System\iMQoVwY.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\BTiAPly.exe
  C:\Windows\System\BTiAPly.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\esLxiBf.exe
  C:\Windows\System\esLxiBf.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\sPyYTpw.exe
  C:\Windows\System\sPyYTpw.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\oinHVLq.exe
  C:\Windows\System\oinHVLq.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\YWnzxbX.exe
  C:\Windows\System\YWnzxbX.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\NBETdoF.exe
  C:\Windows\System\NBETdoF.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\fSZOKBh.exe
  C:\Windows\System\fSZOKBh.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\hWNnSRV.exe
  C:\Windows\System\hWNnSRV.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\PuNXZNJ.exe
  C:\Windows\System\PuNXZNJ.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TgdmJwF.exe
  C:\Windows\System\TgdmJwF.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\rYEoFFp.exe
  C:\Windows\System\rYEoFFp.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\adpwUaP.exe
  C:\Windows\System\adpwUaP.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\XGupljT.exe
  C:\Windows\System\XGupljT.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\eNtbHqk.exe
  C:\Windows\System\eNtbHqk.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\PGgKonh.exe
  C:\Windows\System\PGgKonh.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\nLzGIGk.exe
  C:\Windows\System\nLzGIGk.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\ONyumNK.exe
  C:\Windows\System\ONyumNK.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\XJJOvBZ.exe
  C:\Windows\System\XJJOvBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\EvsGtVW.exe
  C:\Windows\System\EvsGtVW.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\UxRPJjK.exe
  C:\Windows\System\UxRPJjK.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\uMMBKcd.exe
  C:\Windows\System\uMMBKcd.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\yOSCgSX.exe
  C:\Windows\System\yOSCgSX.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\QNndOHM.exe
  C:\Windows\System\QNndOHM.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ITqteYN.exe
  C:\Windows\System\ITqteYN.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\EmpKpHD.exe
  C:\Windows\System\EmpKpHD.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\gIGVcPn.exe
  C:\Windows\System\gIGVcPn.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\ffGTNFK.exe
  C:\Windows\System\ffGTNFK.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\YtxpcNh.exe
  C:\Windows\System\YtxpcNh.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\NJldVdI.exe
  C:\Windows\System\NJldVdI.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\caJKpMh.exe
  C:\Windows\System\caJKpMh.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\YCgBREr.exe
  C:\Windows\System\YCgBREr.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\ZuDdqta.exe
  C:\Windows\System\ZuDdqta.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\CvEYTAP.exe
  C:\Windows\System\CvEYTAP.exe
  2⤵
  - Executes dropped EXE
  PID:736
- C:\Windows\System\tKrAMGc.exe
  C:\Windows\System\tKrAMGc.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\uPGqymI.exe
  C:\Windows\System\uPGqymI.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\JDhJwiT.exe
  C:\Windows\System\JDhJwiT.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\JeKyOKV.exe
  C:\Windows\System\JeKyOKV.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\nZZqeze.exe
  C:\Windows\System\nZZqeze.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\jPKOFtz.exe
  C:\Windows\System\jPKOFtz.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\xMUoyBq.exe
  C:\Windows\System\xMUoyBq.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\buCpjpq.exe
  C:\Windows\System\buCpjpq.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\lHemllk.exe
  C:\Windows\System\lHemllk.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\vgvcfoO.exe
  C:\Windows\System\vgvcfoO.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\iVAkaUB.exe
  C:\Windows\System\iVAkaUB.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KMmfico.exe
  C:\Windows\System\KMmfico.exe
  2⤵
  PID:2304
- C:\Windows\System\rtJLCoP.exe
  C:\Windows\System\rtJLCoP.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\YgsKoxv.exe
  C:\Windows\System\YgsKoxv.exe
  2⤵
  PID:2824
- C:\Windows\System\XHqLxnD.exe
  C:\Windows\System\XHqLxnD.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\HBCDxSS.exe
  C:\Windows\System\HBCDxSS.exe
  2⤵
  PID:2632
- C:\Windows\System\xGWZUcZ.exe
  C:\Windows\System\xGWZUcZ.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\bFYHsxb.exe
  C:\Windows\System\bFYHsxb.exe
  2⤵
  PID:2488
- C:\Windows\System\GFCZoLb.exe
  C:\Windows\System\GFCZoLb.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\yslORFC.exe
  C:\Windows\System\yslORFC.exe
  2⤵
  PID:2444
- C:\Windows\System\qqlBGbj.exe
  C:\Windows\System\qqlBGbj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\hjGuRdb.exe
  C:\Windows\System\hjGuRdb.exe
  2⤵
  PID:1884
- C:\Windows\System\kETLUVq.exe
  C:\Windows\System\kETLUVq.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\fVuwltx.exe
  C:\Windows\System\fVuwltx.exe
  2⤵
  PID:1708
- C:\Windows\System\MniWidG.exe
  C:\Windows\System\MniWidG.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\OgKRwbF.exe
  C:\Windows\System\OgKRwbF.exe
  2⤵
  PID:1136
- C:\Windows\System\eWATvHY.exe
  C:\Windows\System\eWATvHY.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\rVvXgSc.exe
  C:\Windows\System\rVvXgSc.exe
  2⤵
  PID:1372
- C:\Windows\System\TVeLhHq.exe
  C:\Windows\System\TVeLhHq.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\RGtXBtU.exe
  C:\Windows\System\RGtXBtU.exe
  2⤵
  PID:2396
- C:\Windows\System\vwPMkqI.exe
  C:\Windows\System\vwPMkqI.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\AEeKaMr.exe
  C:\Windows\System\AEeKaMr.exe
  2⤵
  PID:1280
- C:\Windows\System\nllKrpB.exe
  C:\Windows\System\nllKrpB.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\uhNnosi.exe
  C:\Windows\System\uhNnosi.exe
  2⤵
  PID:2208
- C:\Windows\System\CjmHZAZ.exe
  C:\Windows\System\CjmHZAZ.exe
  2⤵
  PID:924
- C:\Windows\System\YuOpJxm.exe
  C:\Windows\System\YuOpJxm.exe
  2⤵
  PID:2472
- C:\Windows\System\glYryiw.exe
  C:\Windows\System\glYryiw.exe
  2⤵
  PID:2688
- C:\Windows\System\UVuMYOQ.exe
  C:\Windows\System\UVuMYOQ.exe
  2⤵
  PID:552
- C:\Windows\System\dQNkoPY.exe
  C:\Windows\System\dQNkoPY.exe
  2⤵
  PID:1320
- C:\Windows\System\RPUsvmp.exe
  C:\Windows\System\RPUsvmp.exe
  2⤵
  PID:1680
- C:\Windows\System\hoctuHl.exe
  C:\Windows\System\hoctuHl.exe
  2⤵
  PID:1952
- C:\Windows\System\vkfVrIo.exe
  C:\Windows\System\vkfVrIo.exe
  2⤵
  PID:1764
- C:\Windows\System\LVPEXDS.exe
  C:\Windows\System\LVPEXDS.exe
  2⤵
  PID:2672
- C:\Windows\System\MInaNHx.exe
  C:\Windows\System\MInaNHx.exe
  2⤵
  PID:3012
- C:\Windows\System\MZOwVPY.exe
  C:\Windows\System\MZOwVPY.exe
  2⤵
  PID:2680
- C:\Windows\System\ddaXeyy.exe
  C:\Windows\System\ddaXeyy.exe
  2⤵
  PID:1668
- C:\Windows\System\EgffhWt.exe
  C:\Windows\System\EgffhWt.exe
  2⤵
  PID:3024
- C:\Windows\System\nPnDaea.exe
  C:\Windows\System\nPnDaea.exe
  2⤵
  PID:2248
- C:\Windows\System\VvLZEff.exe
  C:\Windows\System\VvLZEff.exe
  2⤵
  PID:1580
- C:\Windows\System\imVucZl.exe
  C:\Windows\System\imVucZl.exe
  2⤵
  PID:1868
- C:\Windows\System\fOQBdhH.exe
  C:\Windows\System\fOQBdhH.exe
  2⤵
  PID:2064
- C:\Windows\System\yxhBgoR.exe
  C:\Windows\System\yxhBgoR.exe
  2⤵
  PID:896
- C:\Windows\System\kVMPpkB.exe
  C:\Windows\System\kVMPpkB.exe
  2⤵
  PID:1852
- C:\Windows\System\dkfPSOB.exe
  C:\Windows\System\dkfPSOB.exe
  2⤵
  PID:3060
- C:\Windows\System\xzwpehl.exe
  C:\Windows\System\xzwpehl.exe
  2⤵
  PID:2296
- C:\Windows\System\psJncfv.exe
  C:\Windows\System\psJncfv.exe
  2⤵
  PID:2784
- C:\Windows\System\MxIjVDR.exe
  C:\Windows\System\MxIjVDR.exe
  2⤵
  PID:2236
- C:\Windows\System\rXKUMhY.exe
  C:\Windows\System\rXKUMhY.exe
  2⤵
  PID:1588
- C:\Windows\System\jRIoUxn.exe
  C:\Windows\System\jRIoUxn.exe
  2⤵
  PID:2308
- C:\Windows\System\jUhxTCU.exe
  C:\Windows\System\jUhxTCU.exe
  2⤵
  PID:2244
- C:\Windows\System\nhevYnE.exe
  C:\Windows\System\nhevYnE.exe
  2⤵
  PID:268
- C:\Windows\System\dsPgJVA.exe
  C:\Windows\System\dsPgJVA.exe
  2⤵
  PID:1028
- C:\Windows\System\zCEHfgW.exe
  C:\Windows\System\zCEHfgW.exe
  2⤵
  PID:2856
- C:\Windows\System\EkQCBhA.exe
  C:\Windows\System\EkQCBhA.exe
  2⤵
  PID:804
- C:\Windows\System\crQcYgy.exe
  C:\Windows\System\crQcYgy.exe
  2⤵
  PID:1616
- C:\Windows\System\udYWBhG.exe
  C:\Windows\System\udYWBhG.exe
  2⤵
  PID:2744
- C:\Windows\System\fbCamHw.exe
  C:\Windows\System\fbCamHw.exe
  2⤵
  PID:2524
- C:\Windows\System\LZAKtNv.exe
  C:\Windows\System\LZAKtNv.exe
  2⤵
  PID:2092
- C:\Windows\System\OmuujXS.exe
  C:\Windows\System\OmuujXS.exe
  2⤵
  PID:2120
- C:\Windows\System\CPeDKTD.exe
  C:\Windows\System\CPeDKTD.exe
  2⤵
  PID:1896
- C:\Windows\System\xrrlkJW.exe
  C:\Windows\System\xrrlkJW.exe
  2⤵
  PID:2436
- C:\Windows\System\NoGiSuk.exe
  C:\Windows\System\NoGiSuk.exe
  2⤵
  PID:1328
- C:\Windows\System\fTCbQrO.exe
  C:\Windows\System\fTCbQrO.exe
  2⤵
  PID:1712
- C:\Windows\System\jVSYmGC.exe
  C:\Windows\System\jVSYmGC.exe
  2⤵
  PID:1620
- C:\Windows\System\NlBvwzY.exe
  C:\Windows\System\NlBvwzY.exe
  2⤵
  PID:2520
- C:\Windows\System\mAzoOCD.exe
  C:\Windows\System\mAzoOCD.exe
  2⤵
  PID:860
- C:\Windows\System\zYkJSFm.exe
  C:\Windows\System\zYkJSFm.exe
  2⤵
  PID:1956
- C:\Windows\System\npbYcey.exe
  C:\Windows\System\npbYcey.exe
  2⤵
  PID:1732
- C:\Windows\System\VMIicPP.exe
  C:\Windows\System\VMIicPP.exe
  2⤵
  PID:1768
- C:\Windows\System\vbSmlwS.exe
  C:\Windows\System\vbSmlwS.exe
  2⤵
  PID:3080
- C:\Windows\System\LErbxob.exe
  C:\Windows\System\LErbxob.exe
  2⤵
  PID:3096
- C:\Windows\System\HrMlWWV.exe
  C:\Windows\System\HrMlWWV.exe
  2⤵
  PID:3144
- C:\Windows\System\yhyDaZm.exe
  C:\Windows\System\yhyDaZm.exe
  2⤵
  PID:3160
- C:\Windows\System\EclgGxx.exe
  C:\Windows\System\EclgGxx.exe
  2⤵
  PID:3176
- C:\Windows\System\ADjWdzP.exe
  C:\Windows\System\ADjWdzP.exe
  2⤵
  PID:3192
- C:\Windows\System\wWpvRmL.exe
  C:\Windows\System\wWpvRmL.exe
  2⤵
  PID:3208
- C:\Windows\System\ggiTdfr.exe
  C:\Windows\System\ggiTdfr.exe
  2⤵
  PID:3224
- C:\Windows\System\kCLRusn.exe
  C:\Windows\System\kCLRusn.exe
  2⤵
  PID:3240
- C:\Windows\System\kqIwUwW.exe
  C:\Windows\System\kqIwUwW.exe
  2⤵
  PID:3256
- C:\Windows\System\hlOigpp.exe
  C:\Windows\System\hlOigpp.exe
  2⤵
  PID:3288
- C:\Windows\System\wvddPwK.exe
  C:\Windows\System\wvddPwK.exe
  2⤵
  PID:3304
- C:\Windows\System\tyfrLKZ.exe
  C:\Windows\System\tyfrLKZ.exe
  2⤵
  PID:3324
- C:\Windows\System\NXFOGik.exe
  C:\Windows\System\NXFOGik.exe
  2⤵
  PID:3340
- C:\Windows\System\HCWsPuz.exe
  C:\Windows\System\HCWsPuz.exe
  2⤵
  PID:3356
- C:\Windows\System\OkhDwif.exe
  C:\Windows\System\OkhDwif.exe
  2⤵
  PID:3372
- C:\Windows\System\EpSDtHE.exe
  C:\Windows\System\EpSDtHE.exe
  2⤵
  PID:3388
- C:\Windows\System\xDhdvpz.exe
  C:\Windows\System\xDhdvpz.exe
  2⤵
  PID:3404
- C:\Windows\System\njtImgf.exe
  C:\Windows\System\njtImgf.exe
  2⤵
  PID:3420
- C:\Windows\System\BOYFhRY.exe
  C:\Windows\System\BOYFhRY.exe
  2⤵
  PID:3436
- C:\Windows\System\QoeQaRM.exe
  C:\Windows\System\QoeQaRM.exe
  2⤵
  PID:3452
- C:\Windows\System\PsBbbBZ.exe
  C:\Windows\System\PsBbbBZ.exe
  2⤵
  PID:3468
- C:\Windows\System\CBOfxAj.exe
  C:\Windows\System\CBOfxAj.exe
  2⤵
  PID:3484
- C:\Windows\System\IMcIThY.exe
  C:\Windows\System\IMcIThY.exe
  2⤵
  PID:3504
- C:\Windows\System\krRGDGR.exe
  C:\Windows\System\krRGDGR.exe
  2⤵
  PID:3520
- C:\Windows\System\ImknOYG.exe
  C:\Windows\System\ImknOYG.exe
  2⤵
  PID:3536
- C:\Windows\System\zbPpHEk.exe
  C:\Windows\System\zbPpHEk.exe
  2⤵
  PID:3552
- C:\Windows\System\pdbHhcB.exe
  C:\Windows\System\pdbHhcB.exe
  2⤵
  PID:3568
- C:\Windows\System\wIhzJux.exe
  C:\Windows\System\wIhzJux.exe
  2⤵
  PID:3584
- C:\Windows\System\hECwVvL.exe
  C:\Windows\System\hECwVvL.exe
  2⤵
  PID:3600
- C:\Windows\System\ANeJoqD.exe
  C:\Windows\System\ANeJoqD.exe
  2⤵
  PID:3620
- C:\Windows\System\fskcHOY.exe
  C:\Windows\System\fskcHOY.exe
  2⤵
  PID:3636
- C:\Windows\System\hdvSNOe.exe
  C:\Windows\System\hdvSNOe.exe
  2⤵
  PID:3652
- C:\Windows\System\ZtXnhEw.exe
  C:\Windows\System\ZtXnhEw.exe
  2⤵
  PID:3668
- C:\Windows\System\Pcnddyd.exe
  C:\Windows\System\Pcnddyd.exe
  2⤵
  PID:3684
- C:\Windows\System\bVhcoHE.exe
  C:\Windows\System\bVhcoHE.exe
  2⤵
  PID:3700
- C:\Windows\System\eMLGTJz.exe
  C:\Windows\System\eMLGTJz.exe
  2⤵
  PID:3724
- C:\Windows\System\xLKUACi.exe
  C:\Windows\System\xLKUACi.exe
  2⤵
  PID:3744
- C:\Windows\System\jrtDqhJ.exe
  C:\Windows\System\jrtDqhJ.exe
  2⤵
  PID:3760
- C:\Windows\System\hBjwQpb.exe
  C:\Windows\System\hBjwQpb.exe
  2⤵
  PID:3776
- C:\Windows\System\knUQfZn.exe
  C:\Windows\System\knUQfZn.exe
  2⤵
  PID:3792
- C:\Windows\System\QHspCdk.exe
  C:\Windows\System\QHspCdk.exe
  2⤵
  PID:3828
- C:\Windows\System\dNStVgs.exe
  C:\Windows\System\dNStVgs.exe
  2⤵
  PID:3844
- C:\Windows\System\DPsljTe.exe
  C:\Windows\System\DPsljTe.exe
  2⤵
  PID:3860
- C:\Windows\System\snqFXAN.exe
  C:\Windows\System\snqFXAN.exe
  2⤵
  PID:3876
- C:\Windows\System\nqPcDbR.exe
  C:\Windows\System\nqPcDbR.exe
  2⤵
  PID:3892
- C:\Windows\System\IWkOlsp.exe
  C:\Windows\System\IWkOlsp.exe
  2⤵
  PID:3908
- C:\Windows\System\ktMHqYH.exe
  C:\Windows\System\ktMHqYH.exe
  2⤵
  PID:3924
- C:\Windows\System\GeeBvht.exe
  C:\Windows\System\GeeBvht.exe
  2⤵
  PID:3940
- C:\Windows\System\YRvqvop.exe
  C:\Windows\System\YRvqvop.exe
  2⤵
  PID:3956
- C:\Windows\System\pWqOqZp.exe
  C:\Windows\System\pWqOqZp.exe
  2⤵
  PID:3972
- C:\Windows\System\mnZxqzp.exe
  C:\Windows\System\mnZxqzp.exe
  2⤵
  PID:3988
- C:\Windows\System\wLyKYNM.exe
  C:\Windows\System\wLyKYNM.exe
  2⤵
  PID:4004
- C:\Windows\System\EKvlJMA.exe
  C:\Windows\System\EKvlJMA.exe
  2⤵
  PID:4020
- C:\Windows\System\andBTXi.exe
  C:\Windows\System\andBTXi.exe
  2⤵
  PID:4036
- C:\Windows\System\YlrFfGU.exe
  C:\Windows\System\YlrFfGU.exe
  2⤵
  PID:4052
- C:\Windows\System\hkcZVNS.exe
  C:\Windows\System\hkcZVNS.exe
  2⤵
  PID:4068
- C:\Windows\System\LOjJqjk.exe
  C:\Windows\System\LOjJqjk.exe
  2⤵
  PID:1940
- C:\Windows\System\WBtISXo.exe
  C:\Windows\System\WBtISXo.exe
  2⤵
  PID:2728
- C:\Windows\System\SpoguVT.exe
  C:\Windows\System\SpoguVT.exe
  2⤵
  PID:2432
- C:\Windows\System\iWtFfkY.exe
  C:\Windows\System\iWtFfkY.exe
  2⤵
  PID:3076
- C:\Windows\System\WOqwwmX.exe
  C:\Windows\System\WOqwwmX.exe
  2⤵
  PID:3120
- C:\Windows\System\mYvqvWJ.exe
  C:\Windows\System\mYvqvWJ.exe
  2⤵
  PID:3108
- C:\Windows\System\GfLYtom.exe
  C:\Windows\System\GfLYtom.exe
  2⤵
  PID:3200
- C:\Windows\System\ruNcUKq.exe
  C:\Windows\System\ruNcUKq.exe
  2⤵
  PID:3264
- C:\Windows\System\NvbQtqk.exe
  C:\Windows\System\NvbQtqk.exe
  2⤵
  PID:3284
- C:\Windows\System\qRUPJDp.exe
  C:\Windows\System\qRUPJDp.exe
  2⤵
  PID:852
- C:\Windows\System\qWRTvSi.exe
  C:\Windows\System\qWRTvSi.exe
  2⤵
  PID:3412
- C:\Windows\System\diMqjSS.exe
  C:\Windows\System\diMqjSS.exe
  2⤵
  PID:3548
- C:\Windows\System\RCFqkwA.exe
  C:\Windows\System\RCFqkwA.exe
  2⤵
  PID:2012
- C:\Windows\System\lSyWteL.exe
  C:\Windows\System\lSyWteL.exe
  2⤵
  PID:3648
- C:\Windows\System\scIyYfm.exe
  C:\Windows\System\scIyYfm.exe
  2⤵
  PID:3720
- C:\Windows\System\bzbMuyd.exe
  C:\Windows\System\bzbMuyd.exe
  2⤵
  PID:3788
- C:\Windows\System\Jexzmpm.exe
  C:\Windows\System\Jexzmpm.exe
  2⤵
  PID:3840
- C:\Windows\System\bBLvJrK.exe
  C:\Windows\System\bBLvJrK.exe
  2⤵
  PID:2464
- C:\Windows\System\PlhERop.exe
  C:\Windows\System\PlhERop.exe
  2⤵
  PID:3932
- C:\Windows\System\BycDYmA.exe
  C:\Windows\System\BycDYmA.exe
  2⤵
  PID:2888
- C:\Windows\System\xrTYsLb.exe
  C:\Windows\System\xrTYsLb.exe
  2⤵
  PID:4000
- C:\Windows\System\eOoebMe.exe
  C:\Windows\System\eOoebMe.exe
  2⤵
  PID:2684
- C:\Windows\System\dykNJuL.exe
  C:\Windows\System\dykNJuL.exe
  2⤵
  PID:1888
- C:\Windows\System\dTTJaPt.exe
  C:\Windows\System\dTTJaPt.exe
  2⤵
  PID:3204
- C:\Windows\System\XpryeDK.exe
  C:\Windows\System\XpryeDK.exe
  2⤵
  PID:3476
- C:\Windows\System\oKJiZwJ.exe
  C:\Windows\System\oKJiZwJ.exe
  2⤵
  PID:2992
- C:\Windows\System\cREtLAc.exe
  C:\Windows\System\cREtLAc.exe
  2⤵
  PID:4108
- C:\Windows\System\jVCaHtn.exe
  C:\Windows\System\jVCaHtn.exe
  2⤵
  PID:4124
- C:\Windows\System\JxKKtoY.exe
  C:\Windows\System\JxKKtoY.exe
  2⤵
  PID:4140
- C:\Windows\System\VKnZFyD.exe
  C:\Windows\System\VKnZFyD.exe
  2⤵
  PID:4168
- C:\Windows\System\fPnViBv.exe
  C:\Windows\System\fPnViBv.exe
  2⤵
  PID:4184
- C:\Windows\System\kNAiHNm.exe
  C:\Windows\System\kNAiHNm.exe
  2⤵
  PID:4200
- C:\Windows\System\kYKiecy.exe
  C:\Windows\System\kYKiecy.exe
  2⤵
  PID:4220
- C:\Windows\System\SQGBjYP.exe
  C:\Windows\System\SQGBjYP.exe
  2⤵
  PID:4236
- C:\Windows\System\QydSSfo.exe
  C:\Windows\System\QydSSfo.exe
  2⤵
  PID:4252
- C:\Windows\System\McyQXLc.exe
  C:\Windows\System\McyQXLc.exe
  2⤵
  PID:4268
- C:\Windows\System\utzclNz.exe
  C:\Windows\System\utzclNz.exe
  2⤵
  PID:4284
- C:\Windows\System\xVQYAmJ.exe
  C:\Windows\System\xVQYAmJ.exe
  2⤵
  PID:4300
- C:\Windows\System\OzdseHx.exe
  C:\Windows\System\OzdseHx.exe
  2⤵
  PID:4332
- C:\Windows\System\JxISEwO.exe
  C:\Windows\System\JxISEwO.exe
  2⤵
  PID:4360
- C:\Windows\System\aleSBoe.exe
  C:\Windows\System\aleSBoe.exe
  2⤵
  PID:4384
- C:\Windows\System\vVtJecI.exe
  C:\Windows\System\vVtJecI.exe
  2⤵
  PID:4400
- C:\Windows\System\cMcRaqO.exe
  C:\Windows\System\cMcRaqO.exe
  2⤵
  PID:4416
- C:\Windows\System\QedNPqG.exe
  C:\Windows\System\QedNPqG.exe
  2⤵
  PID:4432
- C:\Windows\System\iMQAEVB.exe
  C:\Windows\System\iMQAEVB.exe
  2⤵
  PID:4448
- C:\Windows\System\aHVgZSq.exe
  C:\Windows\System\aHVgZSq.exe
  2⤵
  PID:4464
- C:\Windows\System\VBhwzPL.exe
  C:\Windows\System\VBhwzPL.exe
  2⤵
  PID:4480
- C:\Windows\System\XfxYQjU.exe
  C:\Windows\System\XfxYQjU.exe
  2⤵
  PID:4496
- C:\Windows\System\dxaqdim.exe
  C:\Windows\System\dxaqdim.exe
  2⤵
  PID:4512
- C:\Windows\System\SKLRChj.exe
  C:\Windows\System\SKLRChj.exe
  2⤵
  PID:4528
- C:\Windows\System\ZZvTdLU.exe
  C:\Windows\System\ZZvTdLU.exe
  2⤵
  PID:4544
- C:\Windows\System\MMaEQjh.exe
  C:\Windows\System\MMaEQjh.exe
  2⤵
  PID:4560
- C:\Windows\System\dODPIco.exe
  C:\Windows\System\dODPIco.exe
  2⤵
  PID:4576
- C:\Windows\System\zcYtzGy.exe
  C:\Windows\System\zcYtzGy.exe
  2⤵
  PID:4592
- C:\Windows\System\pGFANon.exe
  C:\Windows\System\pGFANon.exe
  2⤵
  PID:4608
- C:\Windows\System\eZnSpLS.exe
  C:\Windows\System\eZnSpLS.exe
  2⤵
  PID:4624
- C:\Windows\System\iLUlCcT.exe
  C:\Windows\System\iLUlCcT.exe
  2⤵
  PID:4640
- C:\Windows\System\LJcpPuf.exe
  C:\Windows\System\LJcpPuf.exe
  2⤵
  PID:4656
- C:\Windows\System\zpJFnpX.exe
  C:\Windows\System\zpJFnpX.exe
  2⤵
  PID:4672
- C:\Windows\System\YQsScJq.exe
  C:\Windows\System\YQsScJq.exe
  2⤵
  PID:4688
- C:\Windows\System\ZAwhsJF.exe
  C:\Windows\System\ZAwhsJF.exe
  2⤵
  PID:4704
- C:\Windows\System\kQVleZC.exe
  C:\Windows\System\kQVleZC.exe
  2⤵
  PID:4728
- C:\Windows\System\mtWOEYL.exe
  C:\Windows\System\mtWOEYL.exe
  2⤵
  PID:4744
- C:\Windows\System\lPNmiSQ.exe
  C:\Windows\System\lPNmiSQ.exe
  2⤵
  PID:4760
- C:\Windows\System\UnHJnrf.exe
  C:\Windows\System\UnHJnrf.exe
  2⤵
  PID:4868
- C:\Windows\System\NMFnHus.exe
  C:\Windows\System\NMFnHus.exe
  2⤵
  PID:4932
- C:\Windows\System\ouiOXSH.exe
  C:\Windows\System\ouiOXSH.exe
  2⤵
  PID:4952
- C:\Windows\System\tuOhtHA.exe
  C:\Windows\System\tuOhtHA.exe
  2⤵
  PID:4988
- C:\Windows\System\kjVqXsO.exe
  C:\Windows\System\kjVqXsO.exe
  2⤵
  PID:5044
- C:\Windows\System\raGXtBJ.exe
  C:\Windows\System\raGXtBJ.exe
  2⤵
  PID:5112
- C:\Windows\System\KppfCBq.exe
  C:\Windows\System\KppfCBq.exe
  2⤵
  PID:3644
- C:\Windows\System\tuGbhlK.exe
  C:\Windows\System\tuGbhlK.exe
  2⤵
  PID:2288
- C:\Windows\System\RPMVUjO.exe
  C:\Windows\System\RPMVUjO.exe
  2⤵
  PID:3004
- C:\Windows\System\QoQkxhn.exe
  C:\Windows\System\QoQkxhn.exe
  2⤵
  PID:4148
- C:\Windows\System\IDdNPVJ.exe
  C:\Windows\System\IDdNPVJ.exe
  2⤵
  PID:528
- C:\Windows\System\BDgoyAR.exe
  C:\Windows\System\BDgoyAR.exe
  2⤵
  PID:4152
- C:\Windows\System\pprSMKM.exe
  C:\Windows\System\pprSMKM.exe
  2⤵
  PID:3188
- C:\Windows\System\XyBCHMU.exe
  C:\Windows\System\XyBCHMU.exe
  2⤵
  PID:4260
- C:\Windows\System\fGGxPiz.exe
  C:\Windows\System\fGGxPiz.exe
  2⤵
  PID:4084
- C:\Windows\System\zVRcxrU.exe
  C:\Windows\System\zVRcxrU.exe
  2⤵
  PID:3464
- C:\Windows\System\HzJBrpD.exe
  C:\Windows\System\HzJBrpD.exe
  2⤵
  PID:3500
- C:\Windows\System\MLTUguK.exe
  C:\Windows\System\MLTUguK.exe
  2⤵
  PID:1664
- C:\Windows\System\jLfBGuv.exe
  C:\Windows\System\jLfBGuv.exe
  2⤵
  PID:3664
- C:\Windows\System\ZkZilDp.exe
  C:\Windows\System\ZkZilDp.exe
  2⤵
  PID:3768
- C:\Windows\System\VDuWDrl.exe
  C:\Windows\System\VDuWDrl.exe
  2⤵
  PID:3816
- C:\Windows\System\LrRifWa.exe
  C:\Windows\System\LrRifWa.exe
  2⤵
  PID:3952
- C:\Windows\System\vqTfjeW.exe
  C:\Windows\System\vqTfjeW.exe
  2⤵
  PID:4080
- C:\Windows\System\kaewPzW.exe
  C:\Windows\System\kaewPzW.exe
  2⤵
  PID:2284
- C:\Windows\System\zcPEETt.exe
  C:\Windows\System\zcPEETt.exe
  2⤵
  PID:576
- C:\Windows\System\ctxjdhW.exe
  C:\Windows\System\ctxjdhW.exe
  2⤵
  PID:3592
- C:\Windows\System\NkexdWz.exe
  C:\Windows\System\NkexdWz.exe
  2⤵
  PID:3692
- C:\Windows\System\RtObOCN.exe
  C:\Windows\System\RtObOCN.exe
  2⤵
  PID:3916
- C:\Windows\System\SxsJpfa.exe
  C:\Windows\System\SxsJpfa.exe
  2⤵
  PID:4048
- C:\Windows\System\VHjLgiW.exe
  C:\Windows\System\VHjLgiW.exe
  2⤵
  PID:2568
- C:\Windows\System\JlfQTYk.exe
  C:\Windows\System\JlfQTYk.exe
  2⤵
  PID:3352
- C:\Windows\System\lLqwiie.exe
  C:\Windows\System\lLqwiie.exe
  2⤵
  PID:3608
- C:\Windows\System\NSHeYzG.exe
  C:\Windows\System\NSHeYzG.exe
  2⤵
  PID:3712
- C:\Windows\System\IoJQRVo.exe
  C:\Windows\System\IoJQRVo.exe
  2⤵
  PID:3904
- C:\Windows\System\YvpULpf.exe
  C:\Windows\System\YvpULpf.exe
  2⤵
  PID:2640
- C:\Windows\System\qGQEOMc.exe
  C:\Windows\System\qGQEOMc.exe
  2⤵
  PID:3444
- C:\Windows\System\pJwUOLd.exe
  C:\Windows\System\pJwUOLd.exe
  2⤵
  PID:4180
- C:\Windows\System\mbsWocK.exe
  C:\Windows\System\mbsWocK.exe
  2⤵
  PID:4244
- C:\Windows\System\ssNsKFU.exe
  C:\Windows\System\ssNsKFU.exe
  2⤵
  PID:4312
- C:\Windows\System\FFIsVJK.exe
  C:\Windows\System\FFIsVJK.exe
  2⤵
  PID:4328
- C:\Windows\System\lJeqDyo.exe
  C:\Windows\System\lJeqDyo.exe
  2⤵
  PID:4380
- C:\Windows\System\XETUkqC.exe
  C:\Windows\System\XETUkqC.exe
  2⤵
  PID:4444
- C:\Windows\System\awqfIpX.exe
  C:\Windows\System\awqfIpX.exe
  2⤵
  PID:4536
- C:\Windows\System\GCjZEkY.exe
  C:\Windows\System\GCjZEkY.exe
  2⤵
  PID:4572
- C:\Windows\System\mgSIhlS.exe
  C:\Windows\System\mgSIhlS.exe
  2⤵
  PID:4664
- C:\Windows\System\jDvwHFq.exe
  C:\Windows\System\jDvwHFq.exe
  2⤵
  PID:4668
- C:\Windows\System\bNMOctq.exe
  C:\Windows\System\bNMOctq.exe
  2⤵
  PID:4788
- C:\Windows\System\nTThJik.exe
  C:\Windows\System\nTThJik.exe
  2⤵
  PID:4804
- C:\Windows\System\ogGgLtl.exe
  C:\Windows\System\ogGgLtl.exe
  2⤵
  PID:4816
- C:\Windows\System\HKnOBKj.exe
  C:\Windows\System\HKnOBKj.exe
  2⤵
  PID:4832
- C:\Windows\System\cLczCjK.exe
  C:\Windows\System\cLczCjK.exe
  2⤵
  PID:4848
- C:\Windows\System\MfzoqaX.exe
  C:\Windows\System\MfzoqaX.exe
  2⤵
  PID:4864
- C:\Windows\System\WtMfKJV.exe
  C:\Windows\System\WtMfKJV.exe
  2⤵
  PID:4996
- C:\Windows\System\AwmpRXc.exe
  C:\Windows\System\AwmpRXc.exe
  2⤵
  PID:5016
- C:\Windows\System\kCOIGtF.exe
  C:\Windows\System\kCOIGtF.exe
  2⤵
  PID:5028
- C:\Windows\System\rsxsxHb.exe
  C:\Windows\System\rsxsxHb.exe
  2⤵
  PID:2448
- C:\Windows\System\gLHOLhe.exe
  C:\Windows\System\gLHOLhe.exe
  2⤵
  PID:3616
- C:\Windows\System\hPaIyTa.exe
  C:\Windows\System\hPaIyTa.exe
  2⤵
  PID:3132
- C:\Windows\System\YfoLWGI.exe
  C:\Windows\System\YfoLWGI.exe
  2⤵
  PID:3020
- C:\Windows\System\YTGdaiT.exe
  C:\Windows\System\YTGdaiT.exe
  2⤵
  PID:4160
- C:\Windows\System\aVVDQrv.exe
  C:\Windows\System\aVVDQrv.exe
  2⤵
  PID:4888
- C:\Windows\System\jiIrNnN.exe
  C:\Windows\System\jiIrNnN.exe
  2⤵
  PID:2560
- C:\Windows\System\rMyVpeV.exe
  C:\Windows\System\rMyVpeV.exe
  2⤵
  PID:4392
- C:\Windows\System\jInMKrv.exe
  C:\Windows\System\jInMKrv.exe
  2⤵
  PID:4428
- C:\Windows\System\WXQOnFZ.exe
  C:\Windows\System\WXQOnFZ.exe
  2⤵
  PID:4896
- C:\Windows\System\ChUShZm.exe
  C:\Windows\System\ChUShZm.exe
  2⤵
  PID:3872
- C:\Windows\System\jUljydq.exe
  C:\Windows\System\jUljydq.exe
  2⤵
  PID:2968
- C:\Windows\System\PKcRZmJ.exe
  C:\Windows\System\PKcRZmJ.exe
  2⤵
  PID:4916
- C:\Windows\System\pqILTSg.exe
  C:\Windows\System\pqILTSg.exe
  2⤵
  PID:4948
- C:\Windows\System\pykhiWA.exe
  C:\Windows\System\pykhiWA.exe
  2⤵
  PID:5052
- C:\Windows\System\eZcsFLc.exe
  C:\Windows\System\eZcsFLc.exe
  2⤵
  PID:5068
- C:\Windows\System\gOUEmsy.exe
  C:\Windows\System\gOUEmsy.exe
  2⤵
  PID:5084
- C:\Windows\System\Sfctyao.exe
  C:\Windows\System\Sfctyao.exe
  2⤵
  PID:5100
- C:\Windows\System\tXIJSjz.exe
  C:\Windows\System\tXIJSjz.exe
  2⤵
  PID:2404
- C:\Windows\System\TdTAKKx.exe
  C:\Windows\System\TdTAKKx.exe
  2⤵
  PID:4488
- C:\Windows\System\kjlVKKi.exe
  C:\Windows\System\kjlVKKi.exe
  2⤵
  PID:4524
- C:\Windows\System\sBWuywe.exe
  C:\Windows\System\sBWuywe.exe
  2⤵
  PID:2932
- C:\Windows\System\CDqQZFt.exe
  C:\Windows\System\CDqQZFt.exe
  2⤵
  PID:2572
- C:\Windows\System\pONgInP.exe
  C:\Windows\System\pONgInP.exe
  2⤵
  PID:2492
- C:\Windows\System\wQpGbCS.exe
  C:\Windows\System\wQpGbCS.exe
  2⤵
  PID:4588
- C:\Windows\System\GcOIfUs.exe
  C:\Windows\System\GcOIfUs.exe
  2⤵
  PID:1752
- C:\Windows\System\gAnADFD.exe
  C:\Windows\System\gAnADFD.exe
  2⤵
  PID:1032
- C:\Windows\System\YKPYbGR.exe
  C:\Windows\System\YKPYbGR.exe
  2⤵
  PID:1036
- C:\Windows\System\ElmtIcQ.exe
  C:\Windows\System\ElmtIcQ.exe
  2⤵
  PID:1724
- C:\Windows\System\QYpHQph.exe
  C:\Windows\System\QYpHQph.exe
  2⤵
  PID:1656
- C:\Windows\System\EdzbPWJ.exe
  C:\Windows\System\EdzbPWJ.exe
  2⤵
  PID:972
- C:\Windows\System\ghidKrr.exe
  C:\Windows\System\ghidKrr.exe
  2⤵
  PID:2368
- C:\Windows\System\blviHFj.exe
  C:\Windows\System\blviHFj.exe
  2⤵
  PID:3184
- C:\Windows\System\onRUlKQ.exe
  C:\Windows\System\onRUlKQ.exe
  2⤵
  PID:3216
- C:\Windows\System\aeeYCbg.exe
  C:\Windows\System\aeeYCbg.exe
  2⤵
  PID:3300
- C:\Windows\System\soxAlCH.exe
  C:\Windows\System\soxAlCH.exe
  2⤵
  PID:3368
- C:\Windows\System\WIOMCvs.exe
  C:\Windows\System\WIOMCvs.exe
  2⤵
  PID:2920
- C:\Windows\System\KbJwKQl.exe
  C:\Windows\System\KbJwKQl.exe
  2⤵
  PID:2276
- C:\Windows\System\mhssqcy.exe
  C:\Windows\System\mhssqcy.exe
  2⤵
  PID:2204
- C:\Windows\System\tRrMJNT.exe
  C:\Windows\System\tRrMJNT.exe
  2⤵
  PID:4016
- C:\Windows\System\bGVbMBf.exe
  C:\Windows\System\bGVbMBf.exe
  2⤵
  PID:3716
- C:\Windows\System\UWWlycT.exe
  C:\Windows\System\UWWlycT.exe
  2⤵
  PID:4028
- C:\Windows\System\EnhbXWc.exe
  C:\Windows\System\EnhbXWc.exe
  2⤵
  PID:3460
- C:\Windows\System\KxAzqVj.exe
  C:\Windows\System\KxAzqVj.exe
  2⤵
  PID:3564
- C:\Windows\System\IGmUatT.exe
  C:\Windows\System\IGmUatT.exe
  2⤵
  PID:1804
- C:\Windows\System\kzNXFdi.exe
  C:\Windows\System\kzNXFdi.exe
  2⤵
  PID:3888
- C:\Windows\System\FkSUfVw.exe
  C:\Windows\System\FkSUfVw.exe
  2⤵
  PID:3580
- C:\Windows\System\EQGUoTG.exe
  C:\Windows\System\EQGUoTG.exe
  2⤵
  PID:4100
- C:\Windows\System\vVWIGJy.exe
  C:\Windows\System\vVWIGJy.exe
  2⤵
  PID:4376
- C:\Windows\System\UdNRJzC.exe
  C:\Windows\System\UdNRJzC.exe
  2⤵
  PID:4412
- C:\Windows\System\xGGHAwZ.exe
  C:\Windows\System\xGGHAwZ.exe
  2⤵
  PID:4540
- C:\Windows\System\uYRfMZN.exe
  C:\Windows\System\uYRfMZN.exe
  2⤵
  PID:4736
- C:\Windows\System\LNFoKuN.exe
  C:\Windows\System\LNFoKuN.exe
  2⤵
  PID:4780
- C:\Windows\System\AuRkHyx.exe
  C:\Windows\System\AuRkHyx.exe
  2⤵
  PID:4808
- C:\Windows\System\csfggzP.exe
  C:\Windows\System\csfggzP.exe
  2⤵
  PID:4840
- C:\Windows\System\BjmpJYS.exe
  C:\Windows\System\BjmpJYS.exe
  2⤵
  PID:4828
- C:\Windows\System\FEILgBN.exe
  C:\Windows\System\FEILgBN.exe
  2⤵
  PID:3812
- C:\Windows\System\UTooxnz.exe
  C:\Windows\System\UTooxnz.exe
  2⤵
  PID:3296
- C:\Windows\System\HQghhHC.exe
  C:\Windows\System\HQghhHC.exe
  2⤵
  PID:4940
- C:\Windows\System\nunEiBR.exe
  C:\Windows\System\nunEiBR.exe
  2⤵
  PID:5024
- C:\Windows\System\CVYCFmf.exe
  C:\Windows\System\CVYCFmf.exe
  2⤵
  PID:1192
- C:\Windows\System\DSRapXU.exe
  C:\Windows\System\DSRapXU.exe
  2⤵
  PID:4352
- C:\Windows\System\qoZYxWF.exe
  C:\Windows\System\qoZYxWF.exe
  2⤵
  PID:2972
- C:\Windows\System\XQzvLux.exe
  C:\Windows\System\XQzvLux.exe
  2⤵
  PID:2036
- C:\Windows\System\RXRYMTZ.exe
  C:\Windows\System\RXRYMTZ.exe
  2⤵
  PID:4196
- C:\Windows\System\IaklAmd.exe
  C:\Windows\System\IaklAmd.exe
  2⤵
  PID:932
- C:\Windows\System\ZzgXqhY.exe
  C:\Windows\System\ZzgXqhY.exe
  2⤵
  PID:4424
- C:\Windows\System\zxZachy.exe
  C:\Windows\System\zxZachy.exe
  2⤵
  PID:4276
- C:\Windows\System\awYYcUp.exe
  C:\Windows\System\awYYcUp.exe
  2⤵
  PID:4984
- C:\Windows\System\CVDKOCI.exe
  C:\Windows\System\CVDKOCI.exe
  2⤵
  PID:2508
- C:\Windows\System\uQgKnSN.exe
  C:\Windows\System\uQgKnSN.exe
  2⤵
  PID:2384
- C:\Windows\System\jeZZQtJ.exe
  C:\Windows\System\jeZZQtJ.exe
  2⤵
  PID:4492
- C:\Windows\System\uhwYiOV.exe
  C:\Windows\System\uhwYiOV.exe
  2⤵
  PID:4912
- C:\Windows\System\xxwhGlw.exe
  C:\Windows\System\xxwhGlw.exe
  2⤵
  PID:2956
- C:\Windows\System\DZUJUFS.exe
  C:\Windows\System\DZUJUFS.exe
  2⤵
  PID:1020
- C:\Windows\System\POnlFaZ.exe
  C:\Windows\System\POnlFaZ.exe
  2⤵
  PID:944
- C:\Windows\System\hbihdGp.exe
  C:\Windows\System\hbihdGp.exe
  2⤵
  PID:548
- C:\Windows\System\lgPEgFw.exe
  C:\Windows\System\lgPEgFw.exe
  2⤵
  PID:3276
- C:\Windows\System\BqbIrGY.exe
  C:\Windows\System\BqbIrGY.exe
  2⤵
  PID:3252
- C:\Windows\System\ABzadqF.exe
  C:\Windows\System\ABzadqF.exe
  2⤵
  PID:5080
- C:\Windows\System\xTdjPBD.exe
  C:\Windows\System\xTdjPBD.exe
  2⤵
  PID:4120
- C:\Windows\System\XUGWwhe.exe
  C:\Windows\System\XUGWwhe.exe
  2⤵
  PID:956
- C:\Windows\System\FkIRECG.exe
  C:\Windows\System\FkIRECG.exe
  2⤵
  PID:4176
- C:\Windows\System\nYgxwyk.exe
  C:\Windows\System\nYgxwyk.exe
  2⤵
  PID:3660
- C:\Windows\System\qtVqnZB.exe
  C:\Windows\System\qtVqnZB.exe
  2⤵
  PID:3532
- C:\Windows\System\HhgFwTK.exe
  C:\Windows\System\HhgFwTK.exe
  2⤵
  PID:3900
- C:\Windows\System\iwmgxhS.exe
  C:\Windows\System\iwmgxhS.exe
  2⤵
  PID:4600
- C:\Windows\System\iqQaywU.exe
  C:\Windows\System\iqQaywU.exe
  2⤵
  PID:2124
- C:\Windows\System\ubTtYDN.exe
  C:\Windows\System\ubTtYDN.exe
  2⤵
  PID:4092
- C:\Windows\System\CBZgiBc.exe
  C:\Windows\System\CBZgiBc.exe
  2⤵
  PID:4844
- C:\Windows\System\rsgrURT.exe
  C:\Windows\System\rsgrURT.exe
  2⤵
  PID:4768
- C:\Windows\System\SxxUPiQ.exe
  C:\Windows\System\SxxUPiQ.exe
  2⤵
  PID:3092
- C:\Windows\System\mtjoUyB.exe
  C:\Windows\System\mtjoUyB.exe
  2⤵
  PID:5008
- C:\Windows\System\aNRgNrf.exe
  C:\Windows\System\aNRgNrf.exe
  2⤵
  PID:1504
- C:\Windows\System\uLIyFIx.exe
  C:\Windows\System\uLIyFIx.exe
  2⤵
  PID:4552
- C:\Windows\System\kHBqiJS.exe
  C:\Windows\System\kHBqiJS.exe
  2⤵
  PID:3984
- C:\Windows\System\wVTlaeQ.exe
  C:\Windows\System\wVTlaeQ.exe
  2⤵
  PID:668
- C:\Windows\System\WnJFRQr.exe
  C:\Windows\System\WnJFRQr.exe
  2⤵
  PID:2704
- C:\Windows\System\kWaMBRB.exe
  C:\Windows\System\kWaMBRB.exe
  2⤵
  PID:2388
- C:\Windows\System\XRoYttz.exe
  C:\Windows\System\XRoYttz.exe
  2⤵
  PID:2148
- C:\Windows\System\SJWZMpe.exe
  C:\Windows\System\SJWZMpe.exe
  2⤵
  PID:3400
- C:\Windows\System\lsyWgNj.exe
  C:\Windows\System\lsyWgNj.exe
  2⤵
  PID:4476
- C:\Windows\System\QUYSMxS.exe
  C:\Windows\System\QUYSMxS.exe
  2⤵
  PID:3920
- C:\Windows\System\dYyLYaA.exe
  C:\Windows\System\dYyLYaA.exe
  2⤵
  PID:2544
- C:\Windows\System\fBjoJoP.exe
  C:\Windows\System\fBjoJoP.exe
  2⤵
  PID:3008
- C:\Windows\System\jundLUI.exe
  C:\Windows\System\jundLUI.exe
  2⤵
  PID:3480
- C:\Windows\System\ZsMJXMR.exe
  C:\Windows\System\ZsMJXMR.exe
  2⤵
  PID:3140
- C:\Windows\System\BYNkhoy.exe
  C:\Windows\System\BYNkhoy.exe
  2⤵
  PID:2900
- C:\Windows\System\JNsjHAP.exe
  C:\Windows\System\JNsjHAP.exe
  2⤵
  PID:2908
- C:\Windows\System\ugWmlFh.exe
  C:\Windows\System\ugWmlFh.exe
  2⤵
  PID:2348
- C:\Windows\System\xDyVpMx.exe
  C:\Windows\System\xDyVpMx.exe
  2⤵
  PID:4228
- C:\Windows\System\QbvTCqu.exe
  C:\Windows\System\QbvTCqu.exe
  2⤵
  PID:4396
- C:\Windows\System\qeqJdTj.exe
  C:\Windows\System\qeqJdTj.exe
  2⤵
  PID:4280
- C:\Windows\System\cSiwybU.exe
  C:\Windows\System\cSiwybU.exe
  2⤵
  PID:540
- C:\Windows\System\vSkddQW.exe
  C:\Windows\System\vSkddQW.exe
  2⤵
  PID:3432
- C:\Windows\System\ihvJcpX.exe
  C:\Windows\System\ihvJcpX.exe
  2⤵
  PID:4440
- C:\Windows\System\HzXiWFL.exe
  C:\Windows\System\HzXiWFL.exe
  2⤵
  PID:3528
- C:\Windows\System\SKnHqfy.exe
  C:\Windows\System\SKnHqfy.exe
  2⤵
  PID:1560
- C:\Windows\System\fWKXMIA.exe
  C:\Windows\System\fWKXMIA.exe
  2⤵
  PID:3172
- C:\Windows\System\dfdLjPt.exe
  C:\Windows\System\dfdLjPt.exe
  2⤵
  PID:4908
- C:\Windows\System\YVwDLFu.exe
  C:\Windows\System\YVwDLFu.exe
  2⤵
  PID:5128
- C:\Windows\System\FHdtBbm.exe
  C:\Windows\System\FHdtBbm.exe
  2⤵
  PID:5152
- C:\Windows\System\qxIBeFb.exe
  C:\Windows\System\qxIBeFb.exe
  2⤵
  PID:5168
- C:\Windows\System\QOYjlZX.exe
  C:\Windows\System\QOYjlZX.exe
  2⤵
  PID:5184
- C:\Windows\System\cWFBGKa.exe
  C:\Windows\System\cWFBGKa.exe
  2⤵
  PID:5208
- C:\Windows\System\mWfptVZ.exe
  C:\Windows\System\mWfptVZ.exe
  2⤵
  PID:5224
- C:\Windows\System\RADItwj.exe
  C:\Windows\System\RADItwj.exe
  2⤵
  PID:5244
- C:\Windows\System\JqMjWoz.exe
  C:\Windows\System\JqMjWoz.exe
  2⤵
  PID:5264
- C:\Windows\System\wgsmnpS.exe
  C:\Windows\System\wgsmnpS.exe
  2⤵
  PID:5280
- C:\Windows\System\kbMlcFw.exe
  C:\Windows\System\kbMlcFw.exe
  2⤵
  PID:5300
- C:\Windows\System\gindrcQ.exe
  C:\Windows\System\gindrcQ.exe
  2⤵
  PID:5320
- C:\Windows\System\TYoHNsA.exe
  C:\Windows\System\TYoHNsA.exe
  2⤵
  PID:5344
- C:\Windows\System\sJyzkqm.exe
  C:\Windows\System\sJyzkqm.exe
  2⤵
  PID:5396
- C:\Windows\System\sncQEtK.exe
  C:\Windows\System\sncQEtK.exe
  2⤵
  PID:5412
- C:\Windows\System\XvrPIBh.exe
  C:\Windows\System\XvrPIBh.exe
  2⤵
  PID:5428
- C:\Windows\System\TOBfrYj.exe
  C:\Windows\System\TOBfrYj.exe
  2⤵
  PID:5444
- C:\Windows\System\OqCikrE.exe
  C:\Windows\System\OqCikrE.exe
  2⤵
  PID:5460
- C:\Windows\System\JXKuNFn.exe
  C:\Windows\System\JXKuNFn.exe
  2⤵
  PID:5476
- C:\Windows\System\uYPLoVs.exe
  C:\Windows\System\uYPLoVs.exe
  2⤵
  PID:5496
- C:\Windows\System\oViMTnF.exe
  C:\Windows\System\oViMTnF.exe
  2⤵
  PID:5512
- C:\Windows\System\dUcIzKP.exe
  C:\Windows\System\dUcIzKP.exe
  2⤵
  PID:5528
- C:\Windows\System\dwrZHsZ.exe
  C:\Windows\System\dwrZHsZ.exe
  2⤵
  PID:5544
- C:\Windows\System\xjkyWxI.exe
  C:\Windows\System\xjkyWxI.exe
  2⤵
  PID:5560
- C:\Windows\System\iiWfelI.exe
  C:\Windows\System\iiWfelI.exe
  2⤵
  PID:5576
- C:\Windows\System\uoNjydH.exe
  C:\Windows\System\uoNjydH.exe
  2⤵
  PID:5592
- C:\Windows\System\SBOYItQ.exe
  C:\Windows\System\SBOYItQ.exe
  2⤵
  PID:5608
- C:\Windows\System\okRRXui.exe
  C:\Windows\System\okRRXui.exe
  2⤵
  PID:5624
- C:\Windows\System\MTzPdJw.exe
  C:\Windows\System\MTzPdJw.exe
  2⤵
  PID:5640
- C:\Windows\System\UPJWhIi.exe
  C:\Windows\System\UPJWhIi.exe
  2⤵
  PID:5664
- C:\Windows\System\kLWcEyx.exe
  C:\Windows\System\kLWcEyx.exe
  2⤵
  PID:5680
- C:\Windows\System\nGHNVHj.exe
  C:\Windows\System\nGHNVHj.exe
  2⤵
  PID:5700
- C:\Windows\System\qTHshlM.exe
  C:\Windows\System\qTHshlM.exe
  2⤵
  PID:5720
- C:\Windows\System\RfjCJLz.exe
  C:\Windows\System\RfjCJLz.exe
  2⤵
  PID:5736
- C:\Windows\System\TUvesBV.exe
  C:\Windows\System\TUvesBV.exe
  2⤵
  PID:5752
- C:\Windows\System\eapfdZN.exe
  C:\Windows\System\eapfdZN.exe
  2⤵
  PID:5768
- C:\Windows\System\OBxyGEW.exe
  C:\Windows\System\OBxyGEW.exe
  2⤵
  PID:5784
- C:\Windows\System\TLcWItZ.exe
  C:\Windows\System\TLcWItZ.exe
  2⤵
  PID:5800
- C:\Windows\System\XgEtESY.exe
  C:\Windows\System\XgEtESY.exe
  2⤵
  PID:5816
- C:\Windows\System\yOfLaeg.exe
  C:\Windows\System\yOfLaeg.exe
  2⤵
  PID:5836
- C:\Windows\System\IYQYboI.exe
  C:\Windows\System\IYQYboI.exe
  2⤵
  PID:5856
- C:\Windows\System\lGhxEtK.exe
  C:\Windows\System\lGhxEtK.exe
  2⤵
  PID:5872
- C:\Windows\System\qswkItK.exe
  C:\Windows\System\qswkItK.exe
  2⤵
  PID:5888
- C:\Windows\System\dEqQMQE.exe
  C:\Windows\System\dEqQMQE.exe
  2⤵
  PID:5904
- C:\Windows\System\nSAewGi.exe
  C:\Windows\System\nSAewGi.exe
  2⤵
  PID:5924
- C:\Windows\System\ZhjpeXa.exe
  C:\Windows\System\ZhjpeXa.exe
  2⤵
  PID:5944
- C:\Windows\System\vYEkLeH.exe
  C:\Windows\System\vYEkLeH.exe
  2⤵
  PID:5960
- C:\Windows\System\cDCZsNO.exe
  C:\Windows\System\cDCZsNO.exe
  2⤵
  PID:5976
- C:\Windows\System\MVKiZwr.exe
  C:\Windows\System\MVKiZwr.exe
  2⤵
  PID:5992
- C:\Windows\System\PhCOBNA.exe
  C:\Windows\System\PhCOBNA.exe
  2⤵
  PID:6016
- C:\Windows\System\gGyeXrB.exe
  C:\Windows\System\gGyeXrB.exe
  2⤵
  PID:6036
- C:\Windows\System\kccUczk.exe
  C:\Windows\System\kccUczk.exe
  2⤵
  PID:6052
- C:\Windows\System\cXPKOyS.exe
  C:\Windows\System\cXPKOyS.exe
  2⤵
  PID:6068
- C:\Windows\System\hHSWZCS.exe
  C:\Windows\System\hHSWZCS.exe
  2⤵
  PID:6088
- C:\Windows\System\PIgFmdO.exe
  C:\Windows\System\PIgFmdO.exe
  2⤵
  PID:6104
- C:\Windows\System\NadfWSv.exe
  C:\Windows\System\NadfWSv.exe
  2⤵
  PID:6120
- C:\Windows\System\QchOqOb.exe
  C:\Windows\System\QchOqOb.exe
  2⤵
  PID:6136
- C:\Windows\System\msBgMwz.exe
  C:\Windows\System\msBgMwz.exe
  2⤵
  PID:4344
- C:\Windows\System\WktiOdO.exe
  C:\Windows\System\WktiOdO.exe
  2⤵
  PID:5144
- C:\Windows\System\ExTjHsC.exe
  C:\Windows\System\ExTjHsC.exe
  2⤵
  PID:5180
- C:\Windows\System\ALPQvfJ.exe
  C:\Windows\System\ALPQvfJ.exe
  2⤵
  PID:5252
- C:\Windows\System\KMutrxD.exe
  C:\Windows\System\KMutrxD.exe
  2⤵
  PID:5292
- C:\Windows\System\DieKKhS.exe
  C:\Windows\System\DieKKhS.exe
  2⤵
  PID:5220
- C:\Windows\System\Cwujjgl.exe
  C:\Windows\System\Cwujjgl.exe
  2⤵
  PID:4216
- C:\Windows\System\RakwrTy.exe
  C:\Windows\System\RakwrTy.exe
  2⤵
  PID:5240
- C:\Windows\System\TDdVlJm.exe
  C:\Windows\System\TDdVlJm.exe
  2⤵
  PID:4944
- C:\Windows\System\qcrYtfx.exe
  C:\Windows\System\qcrYtfx.exe
  2⤵
  PID:2528
- C:\Windows\System\ExBscsq.exe
  C:\Windows\System\ExBscsq.exe
  2⤵
  PID:5196
- C:\Windows\System\myLwAtm.exe
  C:\Windows\System\myLwAtm.exe
  2⤵
  PID:5272
- C:\Windows\System\suevnrq.exe
  C:\Windows\System\suevnrq.exe
  2⤵
  PID:5352
- C:\Windows\System\hkIkqog.exe
  C:\Windows\System\hkIkqog.exe
  2⤵
  PID:5372
- C:\Windows\System\dhzBsZV.exe
  C:\Windows\System\dhzBsZV.exe
  2⤵
  PID:5388
- C:\Windows\System\epVBGfj.exe
  C:\Windows\System\epVBGfj.exe
  2⤵
  PID:5408
- C:\Windows\System\sZdFwuI.exe
  C:\Windows\System\sZdFwuI.exe
  2⤵
  PID:5472
- C:\Windows\System\aYJvzLn.exe
  C:\Windows\System\aYJvzLn.exe
  2⤵
  PID:5568
- C:\Windows\System\TIZSlri.exe
  C:\Windows\System\TIZSlri.exe
  2⤵
  PID:5636
- C:\Windows\System\kkOOGlW.exe
  C:\Windows\System\kkOOGlW.exe
  2⤵
  PID:5456
- C:\Windows\System\RQFlxRB.exe
  C:\Windows\System\RQFlxRB.exe
  2⤵
  PID:5552
- C:\Windows\System\SYSFEJb.exe
  C:\Windows\System\SYSFEJb.exe
  2⤵
  PID:5616
- C:\Windows\System\JfgBIOJ.exe
  C:\Windows\System\JfgBIOJ.exe
  2⤵
  PID:5692
- C:\Windows\System\hBJaoks.exe
  C:\Windows\System\hBJaoks.exe
  2⤵
  PID:5716
- C:\Windows\System\HFnFuzH.exe
  C:\Windows\System\HFnFuzH.exe
  2⤵
  PID:5728
- C:\Windows\System\CaesSWe.exe
  C:\Windows\System\CaesSWe.exe
  2⤵
  PID:5764
- C:\Windows\System\JdzRuCR.exe
  C:\Windows\System\JdzRuCR.exe
  2⤵
  PID:5796
- C:\Windows\System\CBExFZd.exe
  C:\Windows\System\CBExFZd.exe
  2⤵
  PID:5812
- C:\Windows\System\kjibiYD.exe
  C:\Windows\System\kjibiYD.exe
  2⤵
  PID:5844
- C:\Windows\System\LjmJWtV.exe
  C:\Windows\System\LjmJWtV.exe
  2⤵
  PID:5896
- C:\Windows\System\aQAltqT.exe
  C:\Windows\System\aQAltqT.exe
  2⤵
  PID:5984
- C:\Windows\System\GTOIUJt.exe
  C:\Windows\System\GTOIUJt.exe
  2⤵
  PID:6024
- C:\Windows\System\MaqUQXg.exe
  C:\Windows\System\MaqUQXg.exe
  2⤵
  PID:5968
- C:\Windows\System\jXQZoxO.exe
  C:\Windows\System\jXQZoxO.exe
  2⤵
  PID:6004
- C:\Windows\System\SuWVraF.exe
  C:\Windows\System\SuWVraF.exe
  2⤵
  PID:6012
- C:\Windows\System\qfHHNjE.exe
  C:\Windows\System\qfHHNjE.exe
  2⤵
  PID:6112
- C:\Windows\System\dWuuIAS.exe
  C:\Windows\System\dWuuIAS.exe
  2⤵
  PID:4264
- C:\Windows\System\VHVfNid.exe
  C:\Windows\System\VHVfNid.exe
  2⤵
  PID:768
- C:\Windows\System\RVHUwIc.exe
  C:\Windows\System\RVHUwIc.exe
  2⤵
  PID:5336
- C:\Windows\System\KkCFpzW.exe
  C:\Windows\System\KkCFpzW.exe
  2⤵
  PID:5332
- C:\Windows\System\mTNNoqy.exe
  C:\Windows\System\mTNNoqy.exe
  2⤵
  PID:5092
- C:\Windows\System\qbKqVkq.exe
  C:\Windows\System\qbKqVkq.exe
  2⤵
  PID:5036
- C:\Windows\System\TvSxIKp.exe
  C:\Windows\System\TvSxIKp.exe
  2⤵
  PID:2644
- C:\Windows\System\uSTSQAp.exe
  C:\Windows\System\uSTSQAp.exe
  2⤵
  PID:5356
- C:\Windows\System\LnhwfcW.exe
  C:\Windows\System\LnhwfcW.exe
  2⤵
  PID:5384
- C:\Windows\System\fWDlbZW.exe
  C:\Windows\System\fWDlbZW.exe
  2⤵
  PID:5440
- C:\Windows\System\qWMhvZc.exe
  C:\Windows\System\qWMhvZc.exe
  2⤵
  PID:5604
- C:\Windows\System\qDHwefX.exe
  C:\Windows\System\qDHwefX.exe
  2⤵
  PID:5452
- C:\Windows\System\kDAfFfo.exe
  C:\Windows\System\kDAfFfo.exe
  2⤵
  PID:5652
- C:\Windows\System\OJENjQZ.exe
  C:\Windows\System\OJENjQZ.exe
  2⤵
  PID:5672
- C:\Windows\System\ydbUhIt.exe
  C:\Windows\System\ydbUhIt.exe
  2⤵
  PID:5732
- C:\Windows\System\ZdueWmv.exe
  C:\Windows\System\ZdueWmv.exe
  2⤵
  PID:5884
- C:\Windows\System\bPzlhnw.exe
  C:\Windows\System\bPzlhnw.exe
  2⤵
  PID:5744
- C:\Windows\System\daulrAd.exe
  C:\Windows\System\daulrAd.exe
  2⤵
  PID:5824
- C:\Windows\System\sXeTwEO.exe
  C:\Windows\System\sXeTwEO.exe
  2⤵
  PID:5916
- C:\Windows\System\WOucOGh.exe
  C:\Windows\System\WOucOGh.exe
  2⤵
  PID:6080
- C:\Windows\System\ddQusUB.exe
  C:\Windows\System\ddQusUB.exe
  2⤵
  PID:5940
- C:\Windows\System\mbTdGAS.exe
  C:\Windows\System\mbTdGAS.exe
  2⤵
  PID:5956
- C:\Windows\System\eLQFGOq.exe
  C:\Windows\System\eLQFGOq.exe
  2⤵
  PID:4824
- C:\Windows\System\RvgafCi.exe
  C:\Windows\System\RvgafCi.exe
  2⤵
  PID:5288
- C:\Windows\System\EgYNYun.exe
  C:\Windows\System\EgYNYun.exe
  2⤵
  PID:5368
- C:\Windows\System\PKBbgxV.exe
  C:\Windows\System\PKBbgxV.exe
  2⤵
  PID:3088
- C:\Windows\System\btxvjuV.exe
  C:\Windows\System\btxvjuV.exe
  2⤵
  PID:5316
- C:\Windows\System\CPCxTKj.exe
  C:\Windows\System\CPCxTKj.exe
  2⤵
  PID:5420
- C:\Windows\System\zWpEGsw.exe
  C:\Windows\System\zWpEGsw.exe
  2⤵
  PID:5848
- C:\Windows\System\ovuVypY.exe
  C:\Windows\System\ovuVypY.exe
  2⤵
  PID:5200
- C:\Windows\System\wbdUpkv.exe
  C:\Windows\System\wbdUpkv.exe
  2⤵
  PID:5328
- C:\Windows\System\elphgsD.exe
  C:\Windows\System\elphgsD.exe
  2⤵
  PID:5136
- C:\Windows\System\UvwDwFS.exe
  C:\Windows\System\UvwDwFS.exe
  2⤵
  PID:5748
- C:\Windows\System\oEwwzDr.exe
  C:\Windows\System\oEwwzDr.exe
  2⤵
  PID:5424
- C:\Windows\System\DLhhqWm.exe
  C:\Windows\System\DLhhqWm.exe
  2⤵
  PID:5124
- C:\Windows\System\kgDKLTh.exe
  C:\Windows\System\kgDKLTh.exe
  2⤵
  PID:6000
- C:\Windows\System\oeYNWXf.exe
  C:\Windows\System\oeYNWXf.exe
  2⤵
  PID:5468
- C:\Windows\System\ChgAkAU.exe
  C:\Windows\System\ChgAkAU.exe
  2⤵
  PID:6044
- C:\Windows\System\dnWfUQb.exe
  C:\Windows\System\dnWfUQb.exe
  2⤵
  PID:6160
- C:\Windows\System\BMpexHd.exe
  C:\Windows\System\BMpexHd.exe
  2⤵
  PID:6180
- C:\Windows\System\gUsYOZB.exe
  C:\Windows\System\gUsYOZB.exe
  2⤵
  PID:6196
- C:\Windows\System\zVmigQa.exe
  C:\Windows\System\zVmigQa.exe
  2⤵
  PID:6220
- C:\Windows\System\WvFsucz.exe
  C:\Windows\System\WvFsucz.exe
  2⤵
  PID:6236
- C:\Windows\System\iwSYrCe.exe
  C:\Windows\System\iwSYrCe.exe
  2⤵
  PID:6252
- C:\Windows\System\lSIyhFS.exe
  C:\Windows\System\lSIyhFS.exe
  2⤵
  PID:6272
- C:\Windows\System\pVRyVLP.exe
  C:\Windows\System\pVRyVLP.exe
  2⤵
  PID:6288
- C:\Windows\System\lYUMYyC.exe
  C:\Windows\System\lYUMYyC.exe
  2⤵
  PID:6304
- C:\Windows\System\KIdSGoo.exe
  C:\Windows\System\KIdSGoo.exe
  2⤵
  PID:6320
- C:\Windows\System\pSjHDUe.exe
  C:\Windows\System\pSjHDUe.exe
  2⤵
  PID:6336
- C:\Windows\System\jAffUVO.exe
  C:\Windows\System\jAffUVO.exe
  2⤵
  PID:6352
- C:\Windows\System\AnbZvGR.exe
  C:\Windows\System\AnbZvGR.exe
  2⤵
  PID:6368
- C:\Windows\System\zHhECJq.exe
  C:\Windows\System\zHhECJq.exe
  2⤵
  PID:6384
- C:\Windows\System\RLiCbmG.exe
  C:\Windows\System\RLiCbmG.exe
  2⤵
  PID:6400
- C:\Windows\System\sKcIXrJ.exe
  C:\Windows\System\sKcIXrJ.exe
  2⤵
  PID:6416
- C:\Windows\System\jxrHpYQ.exe
  C:\Windows\System\jxrHpYQ.exe
  2⤵
  PID:6436
- C:\Windows\System\GVgIZDR.exe
  C:\Windows\System\GVgIZDR.exe
  2⤵
  PID:6452
- C:\Windows\System\TdJBahJ.exe
  C:\Windows\System\TdJBahJ.exe
  2⤵
  PID:6468
- C:\Windows\System\NVqxTmf.exe
  C:\Windows\System\NVqxTmf.exe
  2⤵
  PID:6500
- C:\Windows\System\BOBxnan.exe
  C:\Windows\System\BOBxnan.exe
  2⤵
  PID:6516
- C:\Windows\System\eipccmH.exe
  C:\Windows\System\eipccmH.exe
  2⤵
  PID:6532
- C:\Windows\System\klFwykg.exe
  C:\Windows\System\klFwykg.exe
  2⤵
  PID:6548
- C:\Windows\System\IuQjnjc.exe
  C:\Windows\System\IuQjnjc.exe
  2⤵
  PID:6564
- C:\Windows\System\QvOYVHh.exe
  C:\Windows\System\QvOYVHh.exe
  2⤵
  PID:6580
- C:\Windows\System\NkSZxrh.exe
  C:\Windows\System\NkSZxrh.exe
  2⤵
  PID:6596
- C:\Windows\System\wZmqERD.exe
  C:\Windows\System\wZmqERD.exe
  2⤵
  PID:6612
- C:\Windows\System\oDgZXHM.exe
  C:\Windows\System\oDgZXHM.exe
  2⤵
  PID:6628
- C:\Windows\System\tEopCHR.exe
  C:\Windows\System\tEopCHR.exe
  2⤵
  PID:6644
- C:\Windows\System\MDdyuSu.exe
  C:\Windows\System\MDdyuSu.exe
  2⤵
  PID:6660
- C:\Windows\System\XUSBnkB.exe
  C:\Windows\System\XUSBnkB.exe
  2⤵
  PID:6680
- C:\Windows\System\dmkHOtv.exe
  C:\Windows\System\dmkHOtv.exe
  2⤵
  PID:6704
- C:\Windows\System\oWrckIH.exe
  C:\Windows\System\oWrckIH.exe
  2⤵
  PID:6720
- C:\Windows\System\kDQndQA.exe
  C:\Windows\System\kDQndQA.exe
  2⤵
  PID:6740
- C:\Windows\System\PHiBaEa.exe
  C:\Windows\System\PHiBaEa.exe
  2⤵
  PID:6756
- C:\Windows\System\DWzlUZH.exe
  C:\Windows\System\DWzlUZH.exe
  2⤵
  PID:6772
- C:\Windows\System\omjVXYE.exe
  C:\Windows\System\omjVXYE.exe
  2⤵
  PID:6788
- C:\Windows\System\MkfMNmo.exe
  C:\Windows\System\MkfMNmo.exe
  2⤵
  PID:6804
- C:\Windows\System\IJWLtTZ.exe
  C:\Windows\System\IJWLtTZ.exe
  2⤵
  PID:6820
- C:\Windows\System\QnrfAhU.exe
  C:\Windows\System\QnrfAhU.exe
  2⤵
  PID:6836
- C:\Windows\System\tJsbrsU.exe
  C:\Windows\System\tJsbrsU.exe
  2⤵
  PID:6856
- C:\Windows\System\HbrPIdb.exe
  C:\Windows\System\HbrPIdb.exe
  2⤵
  PID:6888
- C:\Windows\System\hMwpGWA.exe
  C:\Windows\System\hMwpGWA.exe
  2⤵
  PID:6904
- C:\Windows\System\dLzSULZ.exe
  C:\Windows\System\dLzSULZ.exe
  2⤵
  PID:6920
- C:\Windows\System\SbQCHtu.exe
  C:\Windows\System\SbQCHtu.exe
  2⤵
  PID:6936
- C:\Windows\System\jUKmERg.exe
  C:\Windows\System\jUKmERg.exe
  2⤵
  PID:6956
- C:\Windows\System\ADcwjWO.exe
  C:\Windows\System\ADcwjWO.exe
  2⤵
  PID:6972
- C:\Windows\System\FBeiUEH.exe
  C:\Windows\System\FBeiUEH.exe
  2⤵
  PID:6988
- C:\Windows\System\TMwTxCK.exe
  C:\Windows\System\TMwTxCK.exe
  2⤵
  PID:7004
- C:\Windows\System\TvrDLtO.exe
  C:\Windows\System\TvrDLtO.exe
  2⤵
  PID:7024
- C:\Windows\System\izrQRqW.exe
  C:\Windows\System\izrQRqW.exe
  2⤵
  PID:7040
- C:\Windows\System\WbndXSm.exe
  C:\Windows\System\WbndXSm.exe
  2⤵
  PID:7056
- C:\Windows\System\OukEOxX.exe
  C:\Windows\System\OukEOxX.exe
  2⤵
  PID:7072
- C:\Windows\System\zKbfQbB.exe
  C:\Windows\System\zKbfQbB.exe
  2⤵
  PID:7092
- C:\Windows\System\NFnOnyZ.exe
  C:\Windows\System\NFnOnyZ.exe
  2⤵
  PID:7108
- C:\Windows\System\QaeuQFu.exe
  C:\Windows\System\QaeuQFu.exe
  2⤵
  PID:7124
- C:\Windows\System\nzUBuen.exe
  C:\Windows\System\nzUBuen.exe
  2⤵
  PID:7140
- C:\Windows\System\mktDyDV.exe
  C:\Windows\System\mktDyDV.exe
  2⤵
  PID:7156
- C:\Windows\System\pkTYfCq.exe
  C:\Windows\System\pkTYfCq.exe
  2⤵
  PID:6032
- C:\Windows\System\bMLmaeX.exe
  C:\Windows\System\bMLmaeX.exe
  2⤵
  PID:5808
- C:\Windows\System\lLhcIDk.exe
  C:\Windows\System\lLhcIDk.exe
  2⤵
  PID:6212
- C:\Windows\System\KJafZMK.exe
  C:\Windows\System\KJafZMK.exe
  2⤵
  PID:5540
- C:\Windows\System\iRSCDsM.exe
  C:\Windows\System\iRSCDsM.exe
  2⤵
  PID:5648
- C:\Windows\System\efDeitH.exe
  C:\Windows\System\efDeitH.exe
  2⤵
  PID:6188
- C:\Windows\System\dsbZQIC.exe
  C:\Windows\System\dsbZQIC.exe
  2⤵
  PID:6284
- C:\Windows\System\yNcmuro.exe
  C:\Windows\System\yNcmuro.exe
  2⤵
  PID:6316
- C:\Windows\System\nshainF.exe
  C:\Windows\System\nshainF.exe
  2⤵
  PID:6376
- C:\Windows\System\sJjXQcR.exe
  C:\Windows\System\sJjXQcR.exe
  2⤵
  PID:6444
- C:\Windows\System\hlGtYOV.exe
  C:\Windows\System\hlGtYOV.exe
  2⤵
  PID:6448
- C:\Windows\System\pVsCFqy.exe
  C:\Windows\System\pVsCFqy.exe
  2⤵
  PID:6396
- C:\Windows\System\cEZhxDr.exe
  C:\Windows\System\cEZhxDr.exe
  2⤵
  PID:6432
- C:\Windows\System\tPvTeOK.exe
  C:\Windows\System\tPvTeOK.exe
  2⤵
  PID:6528
- C:\Windows\System\KLnFhbE.exe
  C:\Windows\System\KLnFhbE.exe
  2⤵
  PID:6496
- C:\Windows\System\ZJzYgam.exe
  C:\Windows\System\ZJzYgam.exe
  2⤵
  PID:6588
- C:\Windows\System\cKycqwB.exe
  C:\Windows\System\cKycqwB.exe
  2⤵
  PID:6540
- C:\Windows\System\budYGGT.exe
  C:\Windows\System\budYGGT.exe
  2⤵
  PID:6656
- C:\Windows\System\hYpLykW.exe
  C:\Windows\System\hYpLykW.exe
  2⤵
  PID:6572
- C:\Windows\System\AnKqtyD.exe
  C:\Windows\System\AnKqtyD.exe
  2⤵
  PID:6676
- C:\Windows\System\gXXZvEJ.exe
  C:\Windows\System\gXXZvEJ.exe
  2⤵
  PID:6696
- C:\Windows\System\QmlCbKY.exe
  C:\Windows\System\QmlCbKY.exe
  2⤵
  PID:6736
- C:\Windows\System\cUbMcCk.exe
  C:\Windows\System\cUbMcCk.exe
  2⤵
  PID:6828
- C:\Windows\System\OeugUXB.exe
  C:\Windows\System\OeugUXB.exe
  2⤵
  PID:6784
- C:\Windows\System\xxHsvwx.exe
  C:\Windows\System\xxHsvwx.exe
  2⤵
  PID:6752
- C:\Windows\System\SlpNEjD.exe
  C:\Windows\System\SlpNEjD.exe
  2⤵
  PID:6876
- C:\Windows\System\UhdHQsX.exe
  C:\Windows\System\UhdHQsX.exe
  2⤵
  PID:7016
- C:\Windows\System\JwpscTR.exe
  C:\Windows\System\JwpscTR.exe
  2⤵
  PID:6928
- C:\Windows\System\pcrFuzh.exe
  C:\Windows\System\pcrFuzh.exe
  2⤵
  PID:7080
- C:\Windows\System\KGaShfL.exe
  C:\Windows\System\KGaShfL.exe
  2⤵
  PID:6932
- C:\Windows\System\pqTjctY.exe
  C:\Windows\System\pqTjctY.exe
  2⤵
  PID:7068
- C:\Windows\System\ONzAXyV.exe
  C:\Windows\System\ONzAXyV.exe
  2⤵
  PID:7148
- C:\Windows\System\XZLJJuT.exe
  C:\Windows\System\XZLJJuT.exe
  2⤵
  PID:5696
- C:\Windows\System\HsLnGQo.exe
  C:\Windows\System\HsLnGQo.exe
  2⤵
  PID:6156
- C:\Windows\System\dIAjTlO.exe
  C:\Windows\System\dIAjTlO.exe
  2⤵
  PID:6216
- C:\Windows\System\WFsjdGg.exe
  C:\Windows\System\WFsjdGg.exe
  2⤵
  PID:6412
- C:\Windows\System\OmwLJAR.exe
  C:\Windows\System\OmwLJAR.exe
  2⤵
  PID:6464
- C:\Windows\System\yzcKFlc.exe
  C:\Windows\System\yzcKFlc.exe
  2⤵
  PID:5660
- C:\Windows\System\QEAqdnM.exe
  C:\Windows\System\QEAqdnM.exe
  2⤵
  PID:5676
- C:\Windows\System\LJiNJtT.exe
  C:\Windows\System\LJiNJtT.exe
  2⤵
  PID:6344
- C:\Windows\System\dBkKepL.exe
  C:\Windows\System\dBkKepL.exe
  2⤵
  PID:6524
- C:\Windows\System\RhOkCSd.exe
  C:\Windows\System\RhOkCSd.exe
  2⤵
  PID:6652
- C:\Windows\System\DqdjJFU.exe
  C:\Windows\System\DqdjJFU.exe
  2⤵
  PID:6544
- C:\Windows\System\VxGQmHE.exe
  C:\Windows\System\VxGQmHE.exe
  2⤵
  PID:6800
- C:\Windows\System\pUyccLn.exe
  C:\Windows\System\pUyccLn.exe
  2⤵
  PID:6764
- C:\Windows\System\CWQzNKo.exe
  C:\Windows\System\CWQzNKo.exe
  2⤵
  PID:6844
- C:\Windows\System\rbZaWkW.exe
  C:\Windows\System\rbZaWkW.exe
  2⤵
  PID:6716
- C:\Windows\System\PvRtYHD.exe
  C:\Windows\System\PvRtYHD.exe
  2⤵
  PID:6884
- C:\Windows\System\WLdUQDq.exe
  C:\Windows\System\WLdUQDq.exe
  2⤵
  PID:6952
- C:\Windows\System\ROlHqfz.exe
  C:\Windows\System\ROlHqfz.exe
  2⤵
  PID:6900
- C:\Windows\System\ZsxSVsT.exe
  C:\Windows\System\ZsxSVsT.exe
  2⤵
  PID:7164
- C:\Windows\System\kKvAkRy.exe
  C:\Windows\System\kKvAkRy.exe
  2⤵
  PID:6232
- C:\Windows\System\zkeDYPz.exe
  C:\Windows\System\zkeDYPz.exe
  2⤵
  PID:7104
- C:\Windows\System\lrroamc.exe
  C:\Windows\System\lrroamc.exe
  2⤵
  PID:6172
- C:\Windows\System\oYcEGbb.exe
  C:\Windows\System\oYcEGbb.exe
  2⤵
  PID:6608
- C:\Windows\System\CEUqaGu.exe
  C:\Windows\System\CEUqaGu.exe
  2⤵
  PID:6712
- C:\Windows\System\LoVlWLE.exe
  C:\Windows\System\LoVlWLE.exe
  2⤵
  PID:4616
- C:\Windows\System\kPpefIB.exe
  C:\Windows\System\kPpefIB.exe
  2⤵
  PID:6428
- C:\Windows\System\zHRjFHZ.exe
  C:\Windows\System\zHRjFHZ.exe
  2⤵
  PID:6492
- C:\Windows\System\ALltrRt.exe
  C:\Windows\System\ALltrRt.exe
  2⤵
  PID:6912
- C:\Windows\System\gNIifPe.exe
  C:\Windows\System\gNIifPe.exe
  2⤵
  PID:6268
- C:\Windows\System\lqTkyrF.exe
  C:\Windows\System\lqTkyrF.exe
  2⤵
  PID:6208
- C:\Windows\System\tmzmzMZ.exe
  C:\Windows\System\tmzmzMZ.exe
  2⤵
  PID:6604
- C:\Windows\System\LXjkSxv.exe
  C:\Windows\System\LXjkSxv.exe
  2⤵
  PID:6796
- C:\Windows\System\SMiRzAR.exe
  C:\Windows\System\SMiRzAR.exe
  2⤵
  PID:7180
- C:\Windows\System\tzisKJc.exe
  C:\Windows\System\tzisKJc.exe
  2⤵
  PID:7196
- C:\Windows\System\kLshkat.exe
  C:\Windows\System\kLshkat.exe
  2⤵
  PID:7212
- C:\Windows\System\bAqzweJ.exe
  C:\Windows\System\bAqzweJ.exe
  2⤵
  PID:7228
- C:\Windows\System\mtZoiPC.exe
  C:\Windows\System\mtZoiPC.exe
  2⤵
  PID:7244
- C:\Windows\System\jJvKfon.exe
  C:\Windows\System\jJvKfon.exe
  2⤵
  PID:7260
- C:\Windows\System\cHUfuUj.exe
  C:\Windows\System\cHUfuUj.exe
  2⤵
  PID:7276
- C:\Windows\System\rTGoyun.exe
  C:\Windows\System\rTGoyun.exe
  2⤵
  PID:7292
- C:\Windows\System\ZgSWvSY.exe
  C:\Windows\System\ZgSWvSY.exe
  2⤵
  PID:7308
- C:\Windows\System\onZdIxv.exe
  C:\Windows\System\onZdIxv.exe
  2⤵
  PID:7324
- C:\Windows\System\oEcPEKL.exe
  C:\Windows\System\oEcPEKL.exe
  2⤵
  PID:7348
- C:\Windows\System\rYdIATp.exe
  C:\Windows\System\rYdIATp.exe
  2⤵
  PID:7364
- C:\Windows\System\brsRYnt.exe
  C:\Windows\System\brsRYnt.exe
  2⤵
  PID:7380
- C:\Windows\System\XCXSaUq.exe
  C:\Windows\System\XCXSaUq.exe
  2⤵
  PID:7396
- C:\Windows\System\qIyOekt.exe
  C:\Windows\System\qIyOekt.exe
  2⤵
  PID:7412
- C:\Windows\System\xnarSTJ.exe
  C:\Windows\System\xnarSTJ.exe
  2⤵
  PID:7428
- C:\Windows\System\StlFmFb.exe
  C:\Windows\System\StlFmFb.exe
  2⤵
  PID:7444
- C:\Windows\System\qfHURED.exe
  C:\Windows\System\qfHURED.exe
  2⤵
  PID:7460
- C:\Windows\System\idMCnNu.exe
  C:\Windows\System\idMCnNu.exe
  2⤵
  PID:7480
- C:\Windows\System\AFuLtYV.exe
  C:\Windows\System\AFuLtYV.exe
  2⤵
  PID:7508
- C:\Windows\System\ZLqJGsg.exe
  C:\Windows\System\ZLqJGsg.exe
  2⤵
  PID:7524
- C:\Windows\System\QmXFRYH.exe
  C:\Windows\System\QmXFRYH.exe
  2⤵
  PID:7540
- C:\Windows\System\UxjRxJn.exe
  C:\Windows\System\UxjRxJn.exe
  2⤵
  PID:7560
- C:\Windows\System\cXCGveF.exe
  C:\Windows\System\cXCGveF.exe
  2⤵
  PID:7576
- C:\Windows\System\ZsKFdnL.exe
  C:\Windows\System\ZsKFdnL.exe
  2⤵
  PID:7592
- C:\Windows\System\pkdkbta.exe
  C:\Windows\System\pkdkbta.exe
  2⤵
  PID:7608
- C:\Windows\System\ZIDnsGY.exe
  C:\Windows\System\ZIDnsGY.exe
  2⤵
  PID:7624
- C:\Windows\System\vYMMScI.exe
  C:\Windows\System\vYMMScI.exe
  2⤵
  PID:7640
- C:\Windows\System\HkeziJm.exe
  C:\Windows\System\HkeziJm.exe
  2⤵
  PID:7656
- C:\Windows\System\uufXCHN.exe
  C:\Windows\System\uufXCHN.exe
  2⤵
  PID:7676
- C:\Windows\System\MRUOXTZ.exe
  C:\Windows\System\MRUOXTZ.exe
  2⤵
  PID:7692
- C:\Windows\System\fvPZVLV.exe
  C:\Windows\System\fvPZVLV.exe
  2⤵
  PID:7708
- C:\Windows\System\RhIYIUt.exe
  C:\Windows\System\RhIYIUt.exe
  2⤵
  PID:7752
- C:\Windows\System\FtmQuuP.exe
  C:\Windows\System\FtmQuuP.exe
  2⤵
  PID:7768
- C:\Windows\System\LNuePOo.exe
  C:\Windows\System\LNuePOo.exe
  2⤵
  PID:7784
- C:\Windows\System\KdIjEac.exe
  C:\Windows\System\KdIjEac.exe
  2⤵
  PID:7808
- C:\Windows\System\aoRKqfQ.exe
  C:\Windows\System\aoRKqfQ.exe
  2⤵
  PID:7828
- C:\Windows\System\ALqbYni.exe
  C:\Windows\System\ALqbYni.exe
  2⤵
  PID:7844
- C:\Windows\System\LlNAPOe.exe
  C:\Windows\System\LlNAPOe.exe
  2⤵
  PID:7860
- C:\Windows\System\ngTeEaS.exe
  C:\Windows\System\ngTeEaS.exe
  2⤵
  PID:7876
- C:\Windows\System\bBRLXer.exe
  C:\Windows\System\bBRLXer.exe
  2⤵
  PID:7892
- C:\Windows\System\HaeoRrG.exe
  C:\Windows\System\HaeoRrG.exe
  2⤵
  PID:7908
- C:\Windows\System\jUIKHlB.exe
  C:\Windows\System\jUIKHlB.exe
  2⤵
  PID:7932
- C:\Windows\System\UIyMIIu.exe
  C:\Windows\System\UIyMIIu.exe
  2⤵
  PID:7956
- C:\Windows\System\jnBPTch.exe
  C:\Windows\System\jnBPTch.exe
  2⤵
  PID:7980
- C:\Windows\System\CBXxRhn.exe
  C:\Windows\System\CBXxRhn.exe
  2⤵
  PID:7996
- C:\Windows\System\lsCsuip.exe
  C:\Windows\System\lsCsuip.exe
  2⤵
  PID:8012
- C:\Windows\System\suSqATL.exe
  C:\Windows\System\suSqATL.exe
  2⤵
  PID:8028
- C:\Windows\System\xSuPiMy.exe
  C:\Windows\System\xSuPiMy.exe
  2⤵
  PID:8044
- C:\Windows\System\coXnajT.exe
  C:\Windows\System\coXnajT.exe
  2⤵
  PID:8060
- C:\Windows\System\BabgePD.exe
  C:\Windows\System\BabgePD.exe
  2⤵
  PID:8076
- C:\Windows\System\jyHxBFm.exe
  C:\Windows\System\jyHxBFm.exe
  2⤵
  PID:8092
- C:\Windows\System\wXqYJel.exe
  C:\Windows\System\wXqYJel.exe
  2⤵
  PID:8108
- C:\Windows\System\eeTgSzh.exe
  C:\Windows\System\eeTgSzh.exe
  2⤵
  PID:8124
- C:\Windows\System\saddLUL.exe
  C:\Windows\System\saddLUL.exe
  2⤵
  PID:8140
- C:\Windows\System\LWYrwmu.exe
  C:\Windows\System\LWYrwmu.exe
  2⤵
  PID:8156
- C:\Windows\System\UBQTxET.exe
  C:\Windows\System\UBQTxET.exe
  2⤵
  PID:8172
- C:\Windows\System\mFiHwOW.exe
  C:\Windows\System\mFiHwOW.exe
  2⤵
  PID:4620
- C:\Windows\System\swcUuYb.exe
  C:\Windows\System\swcUuYb.exe
  2⤵
  PID:7172
- C:\Windows\System\DSzewPo.exe
  C:\Windows\System\DSzewPo.exe
  2⤵
  PID:7236
- C:\Windows\System\NRbQHDH.exe
  C:\Windows\System\NRbQHDH.exe
  2⤵
  PID:6864
- C:\Windows\System\nKSUGLE.exe
  C:\Windows\System\nKSUGLE.exe
  2⤵
  PID:6984
- C:\Windows\System\OHOXdWJ.exe
  C:\Windows\System\OHOXdWJ.exe
  2⤵
  PID:6880
- C:\Windows\System\RzbRtqu.exe
  C:\Windows\System\RzbRtqu.exe
  2⤵
  PID:7036
- C:\Windows\System\lDBmkGW.exe
  C:\Windows\System\lDBmkGW.exe
  2⤵
  PID:6672
- C:\Windows\System\jxVJOGo.exe
  C:\Windows\System\jxVJOGo.exe
  2⤵
  PID:7452
- C:\Windows\System\pwlfEIO.exe
  C:\Windows\System\pwlfEIO.exe
  2⤵
  PID:7424
- C:\Windows\System\fFZfshm.exe
  C:\Windows\System\fFZfshm.exe
  2⤵
  PID:7492
- C:\Windows\System\uGLpkVj.exe
  C:\Windows\System\uGLpkVj.exe
  2⤵
  PID:7536
- C:\Windows\System\ilGEXim.exe
  C:\Windows\System\ilGEXim.exe
  2⤵
  PID:7332
- C:\Windows\System\rJmFJCj.exe
  C:\Windows\System\rJmFJCj.exe
  2⤵
  PID:7600
- C:\Windows\System\GWObZQe.exe
  C:\Windows\System\GWObZQe.exe
  2⤵
  PID:7408
- C:\Windows\System\iWUvheB.exe
  C:\Windows\System\iWUvheB.exe
  2⤵
  PID:7632
- C:\Windows\System\vYrOWnT.exe
  C:\Windows\System\vYrOWnT.exe
  2⤵
  PID:7552
- C:\Windows\System\VsoPLxF.exe
  C:\Windows\System\VsoPLxF.exe
  2⤵
  PID:7652
- C:\Windows\System\szzxpQS.exe
  C:\Windows\System\szzxpQS.exe
  2⤵
  PID:7684
- C:\Windows\System\gPtDSaz.exe
  C:\Windows\System\gPtDSaz.exe
  2⤵
  PID:7760
- C:\Windows\System\lGpLdUN.exe
  C:\Windows\System\lGpLdUN.exe
  2⤵
  PID:7792
- C:\Windows\System\FtJylij.exe
  C:\Windows\System\FtJylij.exe
  2⤵
  PID:7836
- C:\Windows\System\nNgYLmH.exe
  C:\Windows\System\nNgYLmH.exe
  2⤵
  PID:7900
- C:\Windows\System\XqXGMjO.exe
  C:\Windows\System\XqXGMjO.exe
  2⤵
  PID:7776
- C:\Windows\System\JbZgdSA.exe
  C:\Windows\System\JbZgdSA.exe
  2⤵
  PID:7852
- C:\Windows\System\YviXMNv.exe
  C:\Windows\System\YviXMNv.exe
  2⤵
  PID:7728
- C:\Windows\System\PHaVrjS.exe
  C:\Windows\System\PHaVrjS.exe
  2⤵
  PID:7856
- C:\Windows\System\uQfqMnc.exe
  C:\Windows\System\uQfqMnc.exe
  2⤵
  PID:7924
- C:\Windows\System\aIYGUEv.exe
  C:\Windows\System\aIYGUEv.exe
  2⤵
  PID:7976
- C:\Windows\System\LIQankE.exe
  C:\Windows\System\LIQankE.exe
  2⤵
  PID:7988
- C:\Windows\System\LFUKtLt.exe
  C:\Windows\System\LFUKtLt.exe
  2⤵
  PID:8024
- C:\Windows\System\tWYjorw.exe
  C:\Windows\System\tWYjorw.exe
  2⤵
  PID:8084
- C:\Windows\System\EyBfPca.exe
  C:\Windows\System\EyBfPca.exe
  2⤵
  PID:8148
- C:\Windows\System\vUrtgBE.exe
  C:\Windows\System\vUrtgBE.exe
  2⤵
  PID:8072
- C:\Windows\System\YPETJvR.exe
  C:\Windows\System\YPETJvR.exe
  2⤵
  PID:8100
- C:\Windows\System\uJAPtqs.exe
  C:\Windows\System\uJAPtqs.exe
  2⤵
  PID:7240
- C:\Windows\System\qGVyWZc.exe
  C:\Windows\System\qGVyWZc.exe
  2⤵
  PID:8188
- C:\Windows\System\TFhYsik.exe
  C:\Windows\System\TFhYsik.exe
  2⤵
  PID:6980
- C:\Windows\System\aBQcKHy.exe
  C:\Windows\System\aBQcKHy.exe
  2⤵
  PID:7488
- C:\Windows\System\OjFjkel.exe
  C:\Windows\System\OjFjkel.exe
  2⤵
  PID:6488
- C:\Windows\System\uIVxHQE.exe
  C:\Windows\System\uIVxHQE.exe
  2⤵
  PID:7356
- C:\Windows\System\eGuUXlB.exe
  C:\Windows\System\eGuUXlB.exe
  2⤵
  PID:7496
- C:\Windows\System\msfHZvb.exe
  C:\Windows\System\msfHZvb.exe
  2⤵
  PID:6152
- C:\Windows\System\qfQAqAv.exe
  C:\Windows\System\qfQAqAv.exe
  2⤵
  PID:7192
- C:\Windows\System\vFedOsz.exe
  C:\Windows\System\vFedOsz.exe
  2⤵
  PID:7700
- C:\Windows\System\VEuRyBz.exe
  C:\Windows\System\VEuRyBz.exe
  2⤵
  PID:6248
- C:\Windows\System\UjucXBO.exe
  C:\Windows\System\UjucXBO.exe
  2⤵
  PID:7220
- C:\Windows\System\EVHbeQZ.exe
  C:\Windows\System\EVHbeQZ.exe
  2⤵
  PID:7316
- C:\Windows\System\ofGWGxV.exe
  C:\Windows\System\ofGWGxV.exe
  2⤵
  PID:6868
- C:\Windows\System\ciyDEjJ.exe
  C:\Windows\System\ciyDEjJ.exe
  2⤵
  PID:7668
- C:\Windows\System\fRqbjpq.exe
  C:\Windows\System\fRqbjpq.exe
  2⤵
  PID:7944
- C:\Windows\System\OuVopVQ.exe
  C:\Windows\System\OuVopVQ.exe
  2⤵
  PID:7940
- C:\Windows\System\vFYMMqH.exe
  C:\Windows\System\vFYMMqH.exe
  2⤵
  PID:7920
- C:\Windows\System\ubTqLYz.exe
  C:\Windows\System\ubTqLYz.exe
  2⤵
  PID:7824
- C:\Windows\System\afFIqVM.exe
  C:\Windows\System\afFIqVM.exe
  2⤵
  PID:7744
- C:\Windows\System\InnuqJh.exe
  C:\Windows\System\InnuqJh.exe
  2⤵
  PID:8120
- C:\Windows\System\SNFXGLa.exe
  C:\Windows\System\SNFXGLa.exe
  2⤵
  PID:8164
- C:\Windows\System\ygYAyQw.exe
  C:\Windows\System\ygYAyQw.exe
  2⤵
  PID:7268
- C:\Windows\System\mIcWbav.exe
  C:\Windows\System\mIcWbav.exe
  2⤵
  PID:7208
- C:\Windows\System\PmBTVMm.exe
  C:\Windows\System\PmBTVMm.exe
  2⤵
  PID:7648
- C:\Windows\System\gCtqyLD.exe
  C:\Windows\System\gCtqyLD.exe
  2⤵
  PID:7392
- C:\Windows\System\jbFhCqp.exe
  C:\Windows\System\jbFhCqp.exe
  2⤵
  PID:7440
- C:\Windows\System\wAJqllS.exe
  C:\Windows\System\wAJqllS.exe
  2⤵
  PID:7252
- C:\Windows\System\TnXcBqx.exe
  C:\Windows\System\TnXcBqx.exe
  2⤵
  PID:7704
- C:\Windows\System\yqQgnFa.exe
  C:\Windows\System\yqQgnFa.exe
  2⤵
  PID:7968
- C:\Windows\System\CqNSLPO.exe
  C:\Windows\System\CqNSLPO.exe
  2⤵
  PID:8116
- C:\Windows\System\uVYHBNk.exe
  C:\Windows\System\uVYHBNk.exe
  2⤵
  PID:8068
- C:\Windows\System\GGzbdNc.exe
  C:\Windows\System\GGzbdNc.exe
  2⤵
  PID:7520
- C:\Windows\System\OTYNujy.exe
  C:\Windows\System\OTYNujy.exe
  2⤵
  PID:6280
- C:\Windows\System\zjxvpNP.exe
  C:\Windows\System\zjxvpNP.exe
  2⤵
  PID:6964
- C:\Windows\System\BkNtTFA.exe
  C:\Windows\System\BkNtTFA.exe
  2⤵
  PID:8052
- C:\Windows\System\oJsvqRJ.exe
  C:\Windows\System\oJsvqRJ.exe
  2⤵
  PID:7284
- C:\Windows\System\wKRisCO.exe
  C:\Windows\System\wKRisCO.exe
  2⤵
  PID:7388
- C:\Windows\System\ieQYXRM.exe
  C:\Windows\System\ieQYXRM.exe
  2⤵
  PID:8196
- C:\Windows\System\rOtvFEN.exe
  C:\Windows\System\rOtvFEN.exe
  2⤵
  PID:8212
- C:\Windows\System\XHXfmGI.exe
  C:\Windows\System\XHXfmGI.exe
  2⤵
  PID:8228
- C:\Windows\System\pIEvrGW.exe
  C:\Windows\System\pIEvrGW.exe
  2⤵
  PID:8244
- C:\Windows\System\ManacsJ.exe
  C:\Windows\System\ManacsJ.exe
  2⤵
  PID:8260
- C:\Windows\System\ZSgIHwp.exe
  C:\Windows\System\ZSgIHwp.exe
  2⤵
  PID:8276
- C:\Windows\System\HySLoig.exe
  C:\Windows\System\HySLoig.exe
  2⤵
  PID:8292
- C:\Windows\System\VLFCRNp.exe
  C:\Windows\System\VLFCRNp.exe
  2⤵
  PID:8308
- C:\Windows\System\qgvBGzI.exe
  C:\Windows\System\qgvBGzI.exe
  2⤵
  PID:8324
- C:\Windows\System\VMpySed.exe
  C:\Windows\System\VMpySed.exe
  2⤵
  PID:8340
- C:\Windows\System\yzYejIS.exe
  C:\Windows\System\yzYejIS.exe
  2⤵
  PID:8356
- C:\Windows\System\AGVBUzZ.exe
  C:\Windows\System\AGVBUzZ.exe
  2⤵
  PID:8372
- C:\Windows\System\PrYOEkY.exe
  C:\Windows\System\PrYOEkY.exe
  2⤵
  PID:8388
- C:\Windows\System\FIALwcK.exe
  C:\Windows\System\FIALwcK.exe
  2⤵
  PID:8404
- C:\Windows\System\EevOmhw.exe
  C:\Windows\System\EevOmhw.exe
  2⤵
  PID:8420
- C:\Windows\System\GhQsqFo.exe
  C:\Windows\System\GhQsqFo.exe
  2⤵
  PID:8444
- C:\Windows\System\cWVuMzP.exe
  C:\Windows\System\cWVuMzP.exe
  2⤵
  PID:8488
- C:\Windows\System\BjrxReN.exe
  C:\Windows\System\BjrxReN.exe
  2⤵
  PID:8504
- C:\Windows\System\pJXKGYr.exe
  C:\Windows\System\pJXKGYr.exe
  2⤵
  PID:8520
- C:\Windows\System\VmWchzS.exe
  C:\Windows\System\VmWchzS.exe
  2⤵
  PID:8536
- C:\Windows\System\KncCepv.exe
  C:\Windows\System\KncCepv.exe
  2⤵
  PID:8552
- C:\Windows\System\jEpjlLZ.exe
  C:\Windows\System\jEpjlLZ.exe
  2⤵
  PID:8572
- C:\Windows\System\ViTckni.exe
  C:\Windows\System\ViTckni.exe
  2⤵
  PID:8588
- C:\Windows\System\PWFFwLd.exe
  C:\Windows\System\PWFFwLd.exe
  2⤵
  PID:8604
- C:\Windows\System\SsBkOgA.exe
  C:\Windows\System\SsBkOgA.exe
  2⤵
  PID:8620
- C:\Windows\System\tYkSEqg.exe
  C:\Windows\System\tYkSEqg.exe
  2⤵
  PID:8636
- C:\Windows\System\WKQZzWp.exe
  C:\Windows\System\WKQZzWp.exe
  2⤵
  PID:8652
- C:\Windows\System\kAeqRBb.exe
  C:\Windows\System\kAeqRBb.exe
  2⤵
  PID:8672
- C:\Windows\System\RhKWqRt.exe
  C:\Windows\System\RhKWqRt.exe
  2⤵
  PID:8688
- C:\Windows\System\WszUWKW.exe
  C:\Windows\System\WszUWKW.exe
  2⤵
  PID:8704
- C:\Windows\System\egipwlX.exe
  C:\Windows\System\egipwlX.exe
  2⤵
  PID:8720
- C:\Windows\System\fWUeWAz.exe
  C:\Windows\System\fWUeWAz.exe
  2⤵
  PID:8736
- C:\Windows\System\qYoLtbr.exe
  C:\Windows\System\qYoLtbr.exe
  2⤵
  PID:8752
- C:\Windows\System\BijHCAr.exe
  C:\Windows\System\BijHCAr.exe
  2⤵
  PID:8768
- C:\Windows\System\QOoKdoT.exe
  C:\Windows\System\QOoKdoT.exe
  2⤵
  PID:8784
- C:\Windows\System\PfUdTcx.exe
  C:\Windows\System\PfUdTcx.exe
  2⤵
  PID:8800
- C:\Windows\System\OGIybqx.exe
  C:\Windows\System\OGIybqx.exe
  2⤵
  PID:8816
- C:\Windows\System\ObrfArN.exe
  C:\Windows\System\ObrfArN.exe
  2⤵
  PID:8832
- C:\Windows\System\XPpPKfJ.exe
  C:\Windows\System\XPpPKfJ.exe
  2⤵
  PID:8848
- C:\Windows\System\kJyxHze.exe
  C:\Windows\System\kJyxHze.exe
  2⤵
  PID:8864
- C:\Windows\System\bUFZkoN.exe
  C:\Windows\System\bUFZkoN.exe
  2⤵
  PID:8884
- C:\Windows\System\VFlmHLo.exe
  C:\Windows\System\VFlmHLo.exe
  2⤵
  PID:8900
- C:\Windows\System\PPXaygm.exe
  C:\Windows\System\PPXaygm.exe
  2⤵
  PID:8920
- C:\Windows\System\pBfNSXr.exe
  C:\Windows\System\pBfNSXr.exe
  2⤵
  PID:8936
- C:\Windows\System\lVoQtyi.exe
  C:\Windows\System\lVoQtyi.exe
  2⤵
  PID:8952
- C:\Windows\System\tgSHMrR.exe
  C:\Windows\System\tgSHMrR.exe
  2⤵
  PID:8968
- C:\Windows\System\CaMEXwC.exe
  C:\Windows\System\CaMEXwC.exe
  2⤵
  PID:8984
- C:\Windows\System\DZAnsFW.exe
  C:\Windows\System\DZAnsFW.exe
  2⤵
  PID:9000
- C:\Windows\System\MvadNfB.exe
  C:\Windows\System\MvadNfB.exe
  2⤵
  PID:9016
- C:\Windows\System\wOgSyzP.exe
  C:\Windows\System\wOgSyzP.exe
  2⤵
  PID:9036
- C:\Windows\System\mCZnklE.exe
  C:\Windows\System\mCZnklE.exe
  2⤵
  PID:9056
- C:\Windows\System\Yyotsxh.exe
  C:\Windows\System\Yyotsxh.exe
  2⤵
  PID:9072
- C:\Windows\System\ZvpVBEK.exe
  C:\Windows\System\ZvpVBEK.exe
  2⤵
  PID:9092
- C:\Windows\System\uXkeCuT.exe
  C:\Windows\System\uXkeCuT.exe
  2⤵
  PID:9108
- C:\Windows\System\WJyhOFE.exe
  C:\Windows\System\WJyhOFE.exe
  2⤵
  PID:9124
- C:\Windows\System\qtCwaxH.exe
  C:\Windows\System\qtCwaxH.exe
  2⤵
  PID:9140
- C:\Windows\System\atkKTMs.exe
  C:\Windows\System\atkKTMs.exe
  2⤵
  PID:9156
- C:\Windows\System\QOOQbdu.exe
  C:\Windows\System\QOOQbdu.exe
  2⤵
  PID:9172
- C:\Windows\System\RMmLrxh.exe
  C:\Windows\System\RMmLrxh.exe
  2⤵
  PID:9188
- C:\Windows\System\zscdVVV.exe
  C:\Windows\System\zscdVVV.exe
  2⤵
  PID:9204
- C:\Windows\System\rapypdL.exe
  C:\Windows\System\rapypdL.exe
  2⤵
  PID:7404
- C:\Windows\System\pRmmxnz.exe
  C:\Windows\System\pRmmxnz.exe
  2⤵
  PID:8008
- C:\Windows\System\iFXXeoe.exe
  C:\Windows\System\iFXXeoe.exe
  2⤵
  PID:8208
- C:\Windows\System\URQCnMe.exe
  C:\Windows\System\URQCnMe.exe
  2⤵
  PID:7620
- C:\Windows\System\wgqhFQW.exe
  C:\Windows\System\wgqhFQW.exe
  2⤵
  PID:7532
- C:\Windows\System\FFZCInf.exe
  C:\Windows\System\FFZCInf.exe
  2⤵
  PID:8332
- C:\Windows\System\GtNSHtO.exe
  C:\Windows\System\GtNSHtO.exe
  2⤵
  PID:7256
- C:\Windows\System\KtXPVZV.exe
  C:\Windows\System\KtXPVZV.exe
  2⤵
  PID:8288
- C:\Windows\System\xNlDpuE.exe
  C:\Windows\System\xNlDpuE.exe
  2⤵
  PID:8368
- C:\Windows\System\WugGEjR.exe
  C:\Windows\System\WugGEjR.exe
  2⤵
  PID:8400
- C:\Windows\System\aRwjcmx.exe
  C:\Windows\System\aRwjcmx.exe
  2⤵
  PID:8384
- C:\Windows\System\DdnmMcN.exe
  C:\Windows\System\DdnmMcN.exe
  2⤵
  PID:8496
- C:\Windows\System\FBQEwjC.exe
  C:\Windows\System\FBQEwjC.exe
  2⤵
  PID:8560
- C:\Windows\System\VrHPhdy.exe
  C:\Windows\System\VrHPhdy.exe
  2⤵
  PID:8628
- C:\Windows\System\pfSfUkM.exe
  C:\Windows\System\pfSfUkM.exe
  2⤵
  PID:8764
- C:\Windows\System\JjngOlt.exe
  C:\Windows\System\JjngOlt.exe
  2⤵
  PID:8728
- C:\Windows\System\wFbZNXS.exe
  C:\Windows\System\wFbZNXS.exe
  2⤵
  PID:8476
- C:\Windows\System\BnacvFU.exe
  C:\Windows\System\BnacvFU.exe
  2⤵
  PID:8484
- C:\Windows\System\LpqmeXX.exe
  C:\Windows\System\LpqmeXX.exe
  2⤵
  PID:8472
- C:\Windows\System\DtKIUVN.exe
  C:\Windows\System\DtKIUVN.exe
  2⤵
  PID:8796
- C:\Windows\System\FVXezUw.exe
  C:\Windows\System\FVXezUw.exe
  2⤵
  PID:8616
- C:\Windows\System\KdAetyW.exe
  C:\Windows\System\KdAetyW.exe
  2⤵
  PID:8712
- C:\Windows\System\pHEjWcL.exe
  C:\Windows\System\pHEjWcL.exe
  2⤵
  PID:8644
- C:\Windows\System\NwHIBZi.exe
  C:\Windows\System\NwHIBZi.exe
  2⤵
  PID:8860
- C:\Windows\System\zAFynJV.exe
  C:\Windows\System\zAFynJV.exe
  2⤵
  PID:8932
- C:\Windows\System\EvbmZGG.exe
  C:\Windows\System\EvbmZGG.exe
  2⤵
  PID:8996
- C:\Windows\System\btaMWwP.exe
  C:\Windows\System\btaMWwP.exe
  2⤵
  PID:8844
- C:\Windows\System\oNhTGHJ.exe
  C:\Windows\System\oNhTGHJ.exe
  2⤵
  PID:9064
- C:\Windows\System\GJqEvNx.exe
  C:\Windows\System\GJqEvNx.exe
  2⤵
  PID:9164
- C:\Windows\System\YMARdaW.exe
  C:\Windows\System\YMARdaW.exe
  2⤵
  PID:8908
- C:\Windows\System\jguFMUW.exe
  C:\Windows\System\jguFMUW.exe
  2⤵
  PID:8948
- C:\Windows\System\nFlUksy.exe
  C:\Windows\System\nFlUksy.exe
  2⤵
  PID:8976
- C:\Windows\System\rLcjNtk.exe
  C:\Windows\System\rLcjNtk.exe
  2⤵
  PID:9148
- C:\Windows\System\fcFmRjj.exe
  C:\Windows\System\fcFmRjj.exe
  2⤵
  PID:8204
- C:\Windows\System\WnrTaVH.exe
  C:\Windows\System\WnrTaVH.exe
  2⤵
  PID:8412
- C:\Windows\System\CWkGVLE.exe
  C:\Windows\System\CWkGVLE.exe
  2⤵
  PID:8760
- C:\Windows\System\HSsrfTF.exe
  C:\Windows\System\HSsrfTF.exe
  2⤵
  PID:8696
- C:\Windows\System\TGiWhOS.exe
  C:\Windows\System\TGiWhOS.exe
  2⤵
  PID:8684
- C:\Windows\System\IfPbzfS.exe
  C:\Windows\System\IfPbzfS.exe
  2⤵
  PID:9068
- C:\Windows\System\BeMifCT.exe
  C:\Windows\System\BeMifCT.exe
  2⤵
  PID:7948
- C:\Windows\System\eLRfAGy.exe
  C:\Windows\System\eLRfAGy.exe
  2⤵
  PID:9044
- C:\Windows\System\RvqdpLJ.exe
  C:\Windows\System\RvqdpLJ.exe
  2⤵
  PID:8716
- C:\Windows\System\SDXjqGI.exe
  C:\Windows\System\SDXjqGI.exe
  2⤵
  PID:8612
- C:\Windows\System\rTWDtiJ.exe
  C:\Windows\System\rTWDtiJ.exe
  2⤵
  PID:8928
- C:\Windows\System\KQfhgYq.exe
  C:\Windows\System\KQfhgYq.exe
  2⤵
  PID:9136
- C:\Windows\System\nwdgcCc.exe
  C:\Windows\System\nwdgcCc.exe
  2⤵
  PID:9116
- C:\Windows\System\wkoSVCc.exe
  C:\Windows\System\wkoSVCc.exe
  2⤵
  PID:8040
- C:\Windows\System\USlXftT.exe
  C:\Windows\System\USlXftT.exe
  2⤵
  PID:9212
- C:\Windows\System\gqZCtCI.exe
  C:\Windows\System\gqZCtCI.exe
  2⤵
  PID:8352
- C:\Windows\System\JStYJil.exe
  C:\Windows\System\JStYJil.exe
  2⤵
  PID:8596
- C:\Windows\System\XQhSqro.exe
  C:\Windows\System\XQhSqro.exe
  2⤵
  PID:6204
- C:\Windows\System\fjaeHnp.exe
  C:\Windows\System\fjaeHnp.exe
  2⤵
  PID:8336
- C:\Windows\System\TPvUgOG.exe
  C:\Windows\System\TPvUgOG.exe
  2⤵
  PID:8792
- C:\Windows\System\JitTaKm.exe
  C:\Windows\System\JitTaKm.exe
  2⤵
  PID:9012
- C:\Windows\System\aiYlWQh.exe
  C:\Windows\System\aiYlWQh.exe
  2⤵
  PID:8516
- C:\Windows\System\oreGquu.exe
  C:\Windows\System\oreGquu.exe
  2⤵
  PID:9152
- C:\Windows\System\mtqgqHw.exe
  C:\Windows\System\mtqgqHw.exe
  2⤵
  PID:8880
- C:\Windows\System\mDmfpKz.exe
  C:\Windows\System\mDmfpKz.exe
  2⤵
  PID:9052
- C:\Windows\System\EJFaEsS.exe
  C:\Windows\System\EJFaEsS.exe
  2⤵
  PID:9084
- C:\Windows\System\ZsVQztr.exe
  C:\Windows\System\ZsVQztr.exe
  2⤵
  PID:8320
- C:\Windows\System\LEyrmZr.exe
  C:\Windows\System\LEyrmZr.exe
  2⤵
  PID:8856
- C:\Windows\System\tRUwfxD.exe
  C:\Windows\System\tRUwfxD.exe
  2⤵
  PID:9232
- C:\Windows\System\YGTdEdf.exe
  C:\Windows\System\YGTdEdf.exe
  2⤵
  PID:9252
- C:\Windows\System\ovOWTJY.exe
  C:\Windows\System\ovOWTJY.exe
  2⤵
  PID:9268
- C:\Windows\System\hbYBfBx.exe
  C:\Windows\System\hbYBfBx.exe
  2⤵
  PID:9284
- C:\Windows\System\XvokxAa.exe
  C:\Windows\System\XvokxAa.exe
  2⤵
  PID:9312
- C:\Windows\System\zsSWqMJ.exe
  C:\Windows\System\zsSWqMJ.exe
  2⤵
  PID:9328
- C:\Windows\System\qWrqHKZ.exe
  C:\Windows\System\qWrqHKZ.exe
  2⤵
  PID:9344
- C:\Windows\System\suhFuas.exe
  C:\Windows\System\suhFuas.exe
  2⤵
  PID:9388
- C:\Windows\System\bGgWbIz.exe
  C:\Windows\System\bGgWbIz.exe
  2⤵
  PID:9516
- C:\Windows\System\qDhYTrY.exe
  C:\Windows\System\qDhYTrY.exe
  2⤵
  PID:9536
- C:\Windows\System\gacGXSZ.exe
  C:\Windows\System\gacGXSZ.exe
  2⤵
  PID:9552
- C:\Windows\System\hDSvAWG.exe
  C:\Windows\System\hDSvAWG.exe
  2⤵
  PID:9568
- C:\Windows\System\QnmaclE.exe
  C:\Windows\System\QnmaclE.exe
  2⤵
  PID:9584
- C:\Windows\System\dnaOhEw.exe
  C:\Windows\System\dnaOhEw.exe
  2⤵
  PID:9600
- C:\Windows\System\LeFSRXn.exe
  C:\Windows\System\LeFSRXn.exe
  2⤵
  PID:9616
- C:\Windows\System\lPnVdGd.exe
  C:\Windows\System\lPnVdGd.exe
  2⤵
  PID:9632
- C:\Windows\System\DVNbNER.exe
  C:\Windows\System\DVNbNER.exe
  2⤵
  PID:9648
- C:\Windows\System\JVBCPjX.exe
  C:\Windows\System\JVBCPjX.exe
  2⤵
  PID:9664
- C:\Windows\System\fwExeFp.exe
  C:\Windows\System\fwExeFp.exe
  2⤵
  PID:9680
- C:\Windows\System\FxPRjqz.exe
  C:\Windows\System\FxPRjqz.exe
  2⤵
  PID:9696
- C:\Windows\System\OQyatwr.exe
  C:\Windows\System\OQyatwr.exe
  2⤵
  PID:9712
- C:\Windows\System\KjtCTiV.exe
  C:\Windows\System\KjtCTiV.exe
  2⤵
  PID:9728
- C:\Windows\System\PVofENh.exe
  C:\Windows\System\PVofENh.exe
  2⤵
  PID:9744
- C:\Windows\System\HdboBcp.exe
  C:\Windows\System\HdboBcp.exe
  2⤵
  PID:9760
- C:\Windows\System\jOFhlmx.exe
  C:\Windows\System\jOFhlmx.exe
  2⤵
  PID:9776
- C:\Windows\System\uiolyCb.exe
  C:\Windows\System\uiolyCb.exe
  2⤵
  PID:9792
- C:\Windows\System\iDuqQlK.exe
  C:\Windows\System\iDuqQlK.exe
  2⤵
  PID:9808
- C:\Windows\System\oTxZkro.exe
  C:\Windows\System\oTxZkro.exe
  2⤵
  PID:9824
- C:\Windows\System\aTIiJLX.exe
  C:\Windows\System\aTIiJLX.exe
  2⤵
  PID:9840
- C:\Windows\System\IGBRRZC.exe
  C:\Windows\System\IGBRRZC.exe
  2⤵
  PID:9856
- C:\Windows\System\EKtNCkQ.exe
  C:\Windows\System\EKtNCkQ.exe
  2⤵
  PID:9872
- C:\Windows\System\fLIvUse.exe
  C:\Windows\System\fLIvUse.exe
  2⤵
  PID:9892
- C:\Windows\System\zrEPjyC.exe
  C:\Windows\System\zrEPjyC.exe
  2⤵
  PID:9908
- C:\Windows\System\pqmWloE.exe
  C:\Windows\System\pqmWloE.exe
  2⤵
  PID:9936
- C:\Windows\System\foCYxeN.exe
  C:\Windows\System\foCYxeN.exe
  2⤵
  PID:9960
- C:\Windows\System\jLNYOii.exe
  C:\Windows\System\jLNYOii.exe
  2⤵
  PID:10076
- C:\Windows\System\tENNDzE.exe
  C:\Windows\System\tENNDzE.exe
  2⤵
  PID:10096
- C:\Windows\System\sxAVJup.exe
  C:\Windows\System\sxAVJup.exe
  2⤵
  PID:10112
- C:\Windows\System\dtTmeMH.exe
  C:\Windows\System\dtTmeMH.exe
  2⤵
  PID:10128
- C:\Windows\System\xVXKkTf.exe
  C:\Windows\System\xVXKkTf.exe
  2⤵
  PID:10144
- C:\Windows\System\QluJxsC.exe
  C:\Windows\System\QluJxsC.exe
  2⤵
  PID:10160
- C:\Windows\System\QPdtNku.exe
  C:\Windows\System\QPdtNku.exe
  2⤵
  PID:10176
- C:\Windows\System\nJXxeDE.exe
  C:\Windows\System\nJXxeDE.exe
  2⤵
  PID:9248
- C:\Windows\System\ymDXLMx.exe
  C:\Windows\System\ymDXLMx.exe
  2⤵
  PID:8840
- C:\Windows\System\WorYNiI.exe
  C:\Windows\System\WorYNiI.exe
  2⤵
  PID:9324
- C:\Windows\System\heVqIRA.exe
  C:\Windows\System\heVqIRA.exe
  2⤵
  PID:9360
- C:\Windows\System\VfLAlWr.exe
  C:\Windows\System\VfLAlWr.exe
  2⤵
  PID:9304
- C:\Windows\System\HDXTSWf.exe
  C:\Windows\System\HDXTSWf.exe
  2⤵
  PID:8348
- C:\Windows\System\jCqSPJm.exe
  C:\Windows\System\jCqSPJm.exe
  2⤵
  PID:8668
- C:\Windows\System\rFPrhSj.exe
  C:\Windows\System\rFPrhSj.exe
  2⤵
  PID:8584
- C:\Windows\System\YYULzjX.exe
  C:\Windows\System\YYULzjX.exe
  2⤵
  PID:9228
- C:\Windows\System\iRrbthc.exe
  C:\Windows\System\iRrbthc.exe
  2⤵
  PID:9296
- C:\Windows\System\vIWzRFK.exe
  C:\Windows\System\vIWzRFK.exe
  2⤵
  PID:9308
- C:\Windows\System\sxinJmR.exe
  C:\Windows\System\sxinJmR.exe
  2⤵
  PID:9376
- C:\Windows\System\KXlBDNO.exe
  C:\Windows\System\KXlBDNO.exe
  2⤵
  PID:2072
- C:\Windows\System\sLORNer.exe
  C:\Windows\System\sLORNer.exe
  2⤵
  PID:2044
- C:\Windows\System\VAqOfYq.exe
  C:\Windows\System\VAqOfYq.exe
  2⤵
  PID:9424
- C:\Windows\System\UvIwDaT.exe
  C:\Windows\System\UvIwDaT.exe
  2⤵
  PID:9408
- C:\Windows\System\ypCxHyQ.exe
  C:\Windows\System\ypCxHyQ.exe
  2⤵
  PID:9432
- C:\Windows\System\aOnAMvY.exe
  C:\Windows\System\aOnAMvY.exe
  2⤵
  PID:9400
- C:\Windows\System\HLGbAFI.exe
  C:\Windows\System\HLGbAFI.exe
  2⤵
  PID:9428
- C:\Windows\System\gIoiboa.exe
  C:\Windows\System\gIoiboa.exe
  2⤵
  PID:9448
- C:\Windows\System\PAfTlSx.exe
  C:\Windows\System\PAfTlSx.exe
  2⤵
  PID:9488
- C:\Windows\System\wYFSZju.exe
  C:\Windows\System\wYFSZju.exe
  2⤵
  PID:9500
- C:\Windows\System\xPnknRO.exe
  C:\Windows\System\xPnknRO.exe
  2⤵
  PID:9524
- C:\Windows\System\NxHJHPs.exe
  C:\Windows\System\NxHJHPs.exe
  2⤵
  PID:9592
- C:\Windows\System\ztOoAwb.exe
  C:\Windows\System\ztOoAwb.exe
  2⤵
  PID:2596
- C:\Windows\System\zzIkKGO.exe
  C:\Windows\System\zzIkKGO.exe
  2⤵
  PID:9624
- C:\Windows\System\ZyxtRrF.exe
  C:\Windows\System\ZyxtRrF.exe
  2⤵
  PID:9688
- C:\Windows\System\zJpKcND.exe
  C:\Windows\System\zJpKcND.exe
  2⤵
  PID:9548
- C:\Windows\System\hbvmZVN.exe
  C:\Windows\System\hbvmZVN.exe
  2⤵
  PID:9640
- C:\Windows\System\diOuziu.exe
  C:\Windows\System\diOuziu.exe
  2⤵
  PID:1232
- C:\Windows\System\kmEgEBo.exe
  C:\Windows\System\kmEgEBo.exe
  2⤵
  PID:9804
- C:\Windows\System\OjHeWYO.exe
  C:\Windows\System\OjHeWYO.exe
  2⤵
  PID:9612
- C:\Windows\System\vLkikvB.exe
  C:\Windows\System\vLkikvB.exe
  2⤵
  PID:9704
- C:\Windows\System\IkEvfVC.exe
  C:\Windows\System\IkEvfVC.exe
  2⤵
  PID:9916
- C:\Windows\System\XQyUjBs.exe
  C:\Windows\System\XQyUjBs.exe
  2⤵
  PID:9820
- C:\Windows\System\assJESm.exe
  C:\Windows\System\assJESm.exe
  2⤵
  PID:9884
- C:\Windows\System\HSTuEDA.exe
  C:\Windows\System\HSTuEDA.exe
  2⤵
  PID:9968
- C:\Windows\System\OpIcJYE.exe
  C:\Windows\System\OpIcJYE.exe
  2⤵
  PID:9868
- C:\Windows\System\JiPLqXK.exe
  C:\Windows\System\JiPLqXK.exe
  2⤵
  PID:9956
- C:\Windows\System\OmrGOxJ.exe
  C:\Windows\System\OmrGOxJ.exe
  2⤵
  PID:9944
- C:\Windows\System\tKukOUN.exe
  C:\Windows\System\tKukOUN.exe
  2⤵
  PID:9952
- C:\Windows\System\tXOrejC.exe
  C:\Windows\System\tXOrejC.exe
  2⤵
  PID:9996
- C:\Windows\System\ckoBzOW.exe
  C:\Windows\System\ckoBzOW.exe
  2⤵
  PID:10136
- C:\Windows\System\gTwlhmd.exe
  C:\Windows\System\gTwlhmd.exe
  2⤵
  PID:10012
- C:\Windows\System\xzfFgWX.exe
  C:\Windows\System\xzfFgWX.exe
  2⤵
  PID:10028
- C:\Windows\System\mxdYyWO.exe
  C:\Windows\System\mxdYyWO.exe
  2⤵
  PID:10044
- C:\Windows\System\OOqhTHz.exe
  C:\Windows\System\OOqhTHz.exe
  2⤵
  PID:10060
- C:\Windows\System\ItJeBcC.exe
  C:\Windows\System\ItJeBcC.exe
  2⤵
  PID:10108
- C:\Windows\System\YnDGTIS.exe
  C:\Windows\System\YnDGTIS.exe
  2⤵
  PID:10200
- C:\Windows\System\ExaMexl.exe
  C:\Windows\System\ExaMexl.exe
  2⤵
  PID:8776
- C:\Windows\System\FYTcPzP.exe
  C:\Windows\System\FYTcPzP.exe
  2⤵
  PID:8980
- C:\Windows\System\VugZgcb.exe
  C:\Windows\System\VugZgcb.exe
  2⤵
  PID:9292
- C:\Windows\System\cGmfGZd.exe
  C:\Windows\System\cGmfGZd.exe
  2⤵
  PID:8960
- C:\Windows\System\GZxuAWX.exe
  C:\Windows\System\GZxuAWX.exe
  2⤵
  PID:9320
- C:\Windows\System\gNMRvTs.exe
  C:\Windows\System\gNMRvTs.exe
  2⤵
  PID:7952
- C:\Windows\System\RlBAssh.exe
  C:\Windows\System\RlBAssh.exe
  2⤵
  PID:10228
- C:\Windows\System\EHFNiXg.exe
  C:\Windows\System\EHFNiXg.exe
  2⤵
  PID:8872
- C:\Windows\System\GnbxfLN.exe
  C:\Windows\System\GnbxfLN.exe
  2⤵
  PID:9380
- C:\Windows\System\YdCektR.exe
  C:\Windows\System\YdCektR.exe
  2⤵
  PID:2340
- C:\Windows\System\ySGWSzO.exe
  C:\Windows\System\ySGWSzO.exe
  2⤵
  PID:1256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BTiAPly.exe

Filesize
2.3MB

MD5
46c77d5b7d7005c7bdc7a733bdd81a85

SHA1
4d2f13b78876db18bbde206fc5660c726aa994fa

SHA256
1dbcbc701164452421b15963b43f8c9bd06b9cf0110fafa72c7079cfadd111f7

SHA512
34f667aadc083dbf71e70df97fb615d608bbe18a00a1cda011747b1313b345edc554f49565edc127e765a152ec28f025938d85f6283372e877623a1ee4a644e5

Download Submit
C:\Windows\system\NBETdoF.exe

Filesize
2.3MB

MD5
eb76847fd355346e8dbc5dced34f48a1

SHA1
1a1392b5f96356586ec0ceed8e85646b745ec5a5

SHA256
0f6eb0deabadf374c7dfa4911832a3dd366f2767bb124edab6407ac5fac86339

SHA512
a2329e8efe93e405b028431412bd20bcbe7f8e4bb3e7449c6bf7e1fe908abd98b8e155a8be24ee20e8b661f0ef5c19fe2180da829ec8e7164052dca93802ccb2

Download Submit
C:\Windows\system\NKnAxwO.exe

Filesize
2.3MB

MD5
b16779f81f19083ec149b602499c08f7

SHA1
0f0f47ebaa73f9fb961484f3f65127b9fe9c3770

SHA256
7c2430a71ebe2df67609e55a5dc7b85886913457f164397bc5da7e79785ec3c0

SHA512
1b03c0118472aaf5ddd7a25ddbf452d031b9368724ee8fdcd19b3562c1727a886d5911292beb236f642ac183d962188a41e53ca8c8b2061a9e2cfccd7bbd43c5

Download Submit
C:\Windows\system\OhKYpzc.exe

Filesize
2.3MB

MD5
7348861d37e294eda90708b6d7055d13

SHA1
f0f28815458d88891ea144d1a2ab407709c8b9dc

SHA256
5a5a25b3ff65590cb0e27405f95518e91e1f3abea67fe190e1739d844e20eb6b

SHA512
1d86a3f42fb41ebd2e5fb17a9372d06f851e761fe17b11a00e9646dbce9175f6cb3f9aebf230c48b901ed6c28652023fa0612831515191fc8bb5de828cdb2553

Download Submit
C:\Windows\system\OxOtsNn.exe

Filesize
2.3MB

MD5
a632c7969e632cbe7b5ab734accb5313

SHA1
4a24c7c682a460a01156a34b2945f755e7eb31f5

SHA256
e8f8c5f45e03569b2278086206a1b675018e6f1c523abdb98c7460d63a5d1ae6

SHA512
331a5e034005533a6f2b3b4e69598f1e62384500e5db92b1836747221d05d12b4a6c022e9e1f3aec8f18dba26e94317f9ef4521a14284c82f15bcc2fcde7511e

Download Submit
C:\Windows\system\TgdmJwF.exe

Filesize
2.3MB

MD5
24d9dd647933570297f235b52ae97e79

SHA1
fc36d3275623bdf9b6499bdf7bf2f38a412db23f

SHA256
d81773dc449f9541dd7b3f7b09e3d1e3a92200cda5272c7b4dafb339317ba334

SHA512
499a1f7422597f0a95c70dcf3f7deb2b0a628e581ec1433f56159d6c3e35b922570ae12551760c88eee37a81896a61338364053257cc4c2eb2ff25a89020d3f3

Download Submit
C:\Windows\system\XJJOvBZ.exe

Filesize
2.3MB

MD5
bb225f6fbd6801e390b3d2b05c86e693

SHA1
80589760832b605cd9d43f95cfdde7b962bdf013

SHA256
e790943b2d233954c7e12f6fcdc67d2ab5f95b83e070567c173ea752b1d95fb4

SHA512
d9ab62dd4ab3a2f6e043ff0216fba75563fa8de01af5dce41977d68dcd74a568115ff5895566d5d940bf43b3c7a593f5e1372da94177336f4e0487691017e94d

Download Submit
C:\Windows\system\YWnzxbX.exe

Filesize
2.3MB

MD5
a6750fdcdb932ffb6854feba69376a72

SHA1
a118c35ddf91f2a857e873c8a63fd4c89eaf0883

SHA256
6fde2dc3db089860ec83dd36cc47d1fa9cf9a3ab1c6056cd6c6909d0bf80d684

SHA512
302a0304def56d68a9f5a2e51fb5b5971e442cb7783ee346150029f418848fa44536a789ae0c626b3438d03f982c32df39f54b597835086dd06ceb15ea4d8176

Download Submit
C:\Windows\system\YtxpcNh.exe

Filesize
2.3MB

MD5
9f83a7e4f88d07c2646a877eedcffba5

SHA1
db4f418912300eb25c08332a66c58713b57d9311

SHA256
5407f5b6edeff80e40da7df3c3564538c961571eead6806130b331d4eb36e167

SHA512
b219a5ea603bd97025462824dad493743ef0269a298f2ffabb00f25d20c6edf8caea8e59a3be75790020e036759d51486916d03a765b030061c409af9ab90db3

Download Submit
C:\Windows\system\adpwUaP.exe

Filesize
2.3MB

MD5
9868e940a73026346d6cbaa01d3b772e

SHA1
5c33292f01ae5736ee60b3b26a106dc7ad5cda63

SHA256
b5c6b05cd9138244a3f372ad6db05ba3c3b8639bb0daa965c3cd59d0d77864e9

SHA512
8fcfdb720bd7e0f3c7625b08cbef34edbd08aaa17cfdabdf4d10826f9e63876c5c082571e68740a9613ed2d7ad430a13e2c3120cd10f6b45a3e4be02eb9d53af

Download Submit
C:\Windows\system\eNtbHqk.exe

Filesize
2.3MB

MD5
97be4bd47f516da0df6fa2d44e01c9ab

SHA1
887be304111958ec9e97c4274e891e147c293a68

SHA256
de9eaea561b0564cb1e5d88574dc092bb5a30293fcb01b8fc7bd88fbe0a6245a

SHA512
fd11bb1faee238f5d40b88de7c6280ab11ff491d4ba16d00db98d6e5a6c3c800688eef694aafaf047f24db3035f2fcfd040c59b9f6c24828d9d460f8ce8e79dc

Download Submit
C:\Windows\system\esLxiBf.exe

Filesize
2.3MB

MD5
89eb5cc19c8546ada9923da2404d7162

SHA1
3f334069ab4832c3428e2821f133954eda6a4d37

SHA256
5686c4cd0b8c60f9a7ed885807b5d123d7fde5c1c57f4410840cd14d6651cca8

SHA512
f1e09528e195281355ede87a41055c2987b68e8b512a39a4f56e4d4102c97723309bab7a0f54a2a789cd87d017af99fe9a55c04072c911b5f06851366881f09c

Download Submit
C:\Windows\system\gIGVcPn.exe

Filesize
2.3MB

MD5
ce52adcf01fa8fb07c0b29e5b76fa86e

SHA1
6870313e712c307b93351f893e9b44c4a3931704

SHA256
9564774f462571a60489770c42dd2818ea207772c8204cf589515b99f1571c97

SHA512
eafe1c1817fe5c3e640fe5c1fa36b255e603eb73ab194eab17b89a78b15dd26b687984b91b8cb69052f155519f28403c3c59e7cff69547d0baacea3cf9070f4b

Download Submit
C:\Windows\system\hWNnSRV.exe

Filesize
2.3MB

MD5
216ef1da86941fab96a3e4f2d15b491c

SHA1
5eb915028064a4c8c038b68579c5eac14184bc56

SHA256
689850d3db8091d24068447acb686f775b13647ad115121405e7ff9c8cd83959

SHA512
1a05e8894953faa408e57714eff2e4a685d7a8495d30cc5c71a808270c25d7881df1b72fa11228ccd1e6afe9b1e6faa9529b2bddd02c516c8b6652b8d45d871b

Download Submit
C:\Windows\system\iMQoVwY.exe

Filesize
2.3MB

MD5
aa2a66e3677ef17a76f4e6d4731f71c0

SHA1
cb5197a0a6dae7660f00cd91ad029c9eb88b96a4

SHA256
2e36c22470cc86f395bd2b8dc9e44c3a989540d8afc95c0001f4356219745ed5

SHA512
fb6f918c1b6f231acb1eb3533bca53df3776e4dbafc98d40f2d454dca9c9c42c172c8566bc8c8926b99080f9731b8dca5efcf7094473b78b14a4cd65c86fe17c

Download Submit
C:\Windows\system\lvvLyTK.exe

Filesize
2.3MB

MD5
1292c71572ed04ed1bc77e4976cd9e1c

SHA1
6db007d68daef59d9e7d18501ef9cf2228328d16

SHA256
35f1e93c44d1ced2f9a065c2c75b1a231428e7258f79dd0f5158c462d3676e1c

SHA512
3e55d98f4461631700c57ee7319b1616c8d7dd551c692f054b38a498dd161fb6bb671cc6b495caf98c4e416db5eef32f8538446797c23ac0d521a2493a550345

Download Submit
C:\Windows\system\pXncysJ.exe

Filesize
2.3MB

MD5
bf967c162f1fa1f6a3e0be67aa9047f5

SHA1
56812ca1353d460788f796437f85228b269e0776

SHA256
f70201513dc5fdb728e5c02d66dbd222133723de388429c9792bb6c08a65f6fb

SHA512
054041488d42ce68e93bd447bd38dd6e66a1fc4128a525de40f0a38da455a913d6020658767f413fc32074083f3a1dbc3deff30a877141e80d9708ffdfd32737

Download Submit
C:\Windows\system\sPyYTpw.exe

Filesize
2.3MB

MD5
690df8b6471d76550d5f1d7beed6dd24

SHA1
d6a4bc66d58be1286205b735d81e662ccc94fcad

SHA256
cb59064ef599b7f38ac461e4b6951b5cb001da0986b4d1fc14ac3069d7ba53f3

SHA512
3a38e6a772c7d6510610d4c25f3d805d3262b362fd0b091d743fe3da504992759cff4003756c69b5f7f1e68e66575beae6fbada6110241a1680e925c06a6393d

Download Submit
C:\Windows\system\yOSCgSX.exe

Filesize
2.3MB

MD5
fa10d78ee0059725146a0bec30c579ab

SHA1
9534023e899fc8f5868dc52dea67d050b6ac40fb

SHA256
58f4c73ef920bdd84368c835b115627d98055c7cda6619f10d6a2ddd48701149

SHA512
99eb38c3897df6b045c579ee77d98598dbbec7aadaf2cd2b102db32351a0d13b4d2d94269bd83477dd1d19d0479e10fca7ccda0e5e96b80ea8645a0a0e57be80

Download Submit
\Windows\system\BGEnvBT.exe

Filesize
2.3MB

MD5
9e8f30beeaeee0e380edec1b01eadd11

SHA1
836ae7f4241496a4502785c914998409bc3d8214

SHA256
9f70ce0e68a64baab6c130c20841b5c3d2618c2ca3a4154d46aaa4739f77696c

SHA512
069c4b9c879a96e04a75724e13439f91bb0e28ae71ceabe2873e99433cb287ead4ab939baec5f4539f7b61162b59a04a2f4914e9bfae535b3626708508fd311e

Download Submit
\Windows\system\EmpKpHD.exe

Filesize
2.3MB

MD5
d67bb47101d140ba7d3f644cacf09091

SHA1
6b57fc27a51c1a18afebd92a9c1602f5a2aac247

SHA256
0cf8503b40d5adb806c3641aeaaffbe99f34ad31199adcd7acd8d8eb6b8e070b

SHA512
855ab6440f5c27e1e9b8e9310cd2864f3272d6ce4cbb114d7c8ba9dd89e7496ebb7ebe54beec2b37e7df9eea9fb3e47016f6f1250f96f90bdf14ec61162725db

Download Submit
\Windows\system\EvsGtVW.exe

Filesize
2.3MB

MD5
addca2c93a19bdddb0ef9f10b2c77a00

SHA1
341f7795f47ab9a28f37c9447fcd3125945e832b

SHA256
1d0a6de7cbb0801bee7d20d62f22d13779a3c37c85152093024dcbacedd4aecc

SHA512
7337238183cbf9bc0be96d1400d76762250e9b8aebdbc8d27df9895b64033ae627aa5d542a86a8489e255abee8d6bfdc4a80e8e611e4727d5768345612ed75a0

Download Submit
\Windows\system\ITqteYN.exe

Filesize
2.3MB

MD5
edf19cd9893164a3b2c5c1ce93128902

SHA1
0111bc16137104d357506b399f7693a8872b8ee8

SHA256
448aef01a1bd65862d2054958ab90c978b7af18f1af0448b172c693f19b80711

SHA512
734babe39dfa2326664ef361b00f76e3bb7c1893da1cf01c175ff2a2e24d1633ffe3e8be9e4c8cda0022adec394492083f8a98ea47f85cb13e7e9832b6339402

Download Submit
\Windows\system\JkVCapG.exe

Filesize
2.3MB

MD5
9cfc15c011d1516984afd3a397853022

SHA1
ab3f4d289c919c0a07450f1d9d25fc2489ee0690

SHA256
a3895d7542d0faa0b7fad6e0e9d5566785e0814e5abd1a254fa59407bb207f6a

SHA512
66b2afa1b782120bb811907166e4933af1ba32499dc662be4d114416d7703e487786725c9c91be919871218b1ceeb7a15c3b30d37b72a3203ea931af2675baff

Download Submit
\Windows\system\NJldVdI.exe

Filesize
2.3MB

MD5
547cf09d4e596ff0c97719e1a6d82358

SHA1
196beb269d4957ef3bc389b56bff0c934f274d25

SHA256
d42345b1b473f7303512e52dff3e218cc9c2643f318c494415a91f66c2c16e9b

SHA512
2f8eec09f79b9d2949c1771aee9b1ae8dbc4ac1f3b0edc4c20d1b10455d86bf01e60b1493947f67a1ac5eb693f3efd8fce4d272e296cf0835d5a63edf53290dd

Download Submit
\Windows\system\ONyumNK.exe

Filesize
2.3MB

MD5
c4d16e9e186d734b530e931e6424a7cc

SHA1
2aa0bdc45870c2feec1e1eda8e439c0788c45678

SHA256
dba39dbaeeb021f86926878c2969f9c495b66e513154ff113fdf81e8f32f7c20

SHA512
13f263d89cb48f927414ad368b2017f16b512bfd67c100d983cb4eb4793b073156d1178563e9685dd36a6b9872b3e6b18b42dd9f954891108d13a4dcd2ad443f

Download Submit
\Windows\system\PGgKonh.exe

Filesize
2.3MB

MD5
9f0003f37dbf1d20e8d789be8b8f60c7

SHA1
d7ba9a1422078231ae0ca674420f192cfffdb66e

SHA256
238fd01c1292079381cc16a5f785ae7248c27f24517c834089ac8e88b4a6d257

SHA512
7b51b5a8d3366ddc375a81048357c6d4e58a240dd88a8eddcc74e6f192c1a45234fc792877bcedf9d790e51fa5a2db9b285896a6a186dd675a449fe24041386c

Download Submit
\Windows\system\PuNXZNJ.exe

Filesize
2.3MB

MD5
248508db80adc25584a2d8bba23f0085

SHA1
b4432a5355d9c97a625df6d32f9db0a3f5c0fcf5

SHA256
b1cd890c1e3d99450368c6fcf8ca05053bfee262346a3cace75985fb413edd39

SHA512
6a94d597a8819d56954d2e44ab1a7fc385aa739bbdc85b46a25b103276eb3f3654388f91110bed36ceb4dbc92d9f8c6ad38e072f205cab4f67bb998ed905c9e1

Download Submit
\Windows\system\QNndOHM.exe

Filesize
2.3MB

MD5
610a7b45dbd16995cd68f7115a7e61c1

SHA1
6f693f309d3b0812ad9f1c1b0fda0aa9b8c80708

SHA256
34e0fc853ddc4a8a04e54056e27afe6a6100695d4dbf0b2eee4289f474b8be9a

SHA512
d95f31e5ca7bbbc8152d86da1116140bd5808c59830d43618571385ab1973a4acd10fbcdabab618433ef0fb5b2c30d8227fcd6784768920a292e9dce44659da6

Download Submit
\Windows\system\UxRPJjK.exe

Filesize
2.3MB

MD5
0cfb01a26e6167aba50936dbfccff589

SHA1
07bca3d43016750ec39ea2dd8220a2f7b8db70ff

SHA256
f7680ee6e7d9ab56c6f250972e8a1462f4648682a3c3747c98be23846977be13

SHA512
a47b22187aa58257978499c9094b00400dacbe338e3dcdf4a64ece45bff238d65c3e9ec9ee72ef63bae4bd8f736bbf60a712561368405356285a252163db4a70

Download Submit
\Windows\system\XGupljT.exe

Filesize
2.3MB

MD5
5f1f9a9da2634207ce36a27791b9ec71

SHA1
3c3f0a4f69291368c0e35a99d80ff7c87eed4bce

SHA256
6a0fd0388a317791f4db0f5ab2d58c0ec7c5be20e25f3e700ab2e2eacd20b461

SHA512
d93c65df0ad070b4013c9ac2fd132c0ca7364f791a512b286a555e06e8b523953d585c1c00f0c2b6b1b177fed5dbcb455698c4e5fa2cdbd4621f785f5573e201

Download Submit
\Windows\system\aJRrkrj.exe

Filesize
2.3MB

MD5
d5e9856372bc74fa3bc61f909a60aa78

SHA1
97d43c6a7b0ce77a9f2eda11b2f8ecbb78bae8fb

SHA256
d5f6025b965606da217c0c9793da45dd0fd24b9ac9b87261e11aa9025238411d

SHA512
2d268b1486cd9961ad5df85c410de2804b9f711fd114f2849f4a7f4798e89827a8c68bdd44e77168981c59ff80881e44fd8e2efd561e7f871426968d11ac24e3

Download Submit
\Windows\system\fSZOKBh.exe

Filesize
2.3MB

MD5
5214339741808063ece9034aea2d36a4

SHA1
e717f929e6af499b9403da21bf825c4d4e899208

SHA256
4cd4683c27a956e59a6a02c5ac643a87ded4e24c6053afcc9cf6a5724570aff4

SHA512
94ca5649eb994c59326aab43a8063858abce21bc6ccea10a6bd0147ad25bcdf33e4dbb657848597543990b3278e6ca65da5523727023a6f4b259af36ec4608f7

Download Submit
\Windows\system\ffGTNFK.exe

Filesize
2.3MB

MD5
dfeea7aef7f68e8730de63a6f992b76c

SHA1
92f015b793c0b47e4ca59cc33b8aa5da772ab9b3

SHA256
5b2739b0504b22231a0caea81077b3e3a4d9d7bad55f813b8666bf25a0c325e0

SHA512
b057eb85022b025ab2914351ba4242af32966a594a4efae09350e4e565dd5ccfc923cfb626df7bc76e253206c28b4dae52ec1cd01051283bcfbbd87cd529cf68

Download Submit
\Windows\system\nLzGIGk.exe

Filesize
2.3MB

MD5
8ae46fb6d1788d9eecb3eda979cc9484

SHA1
04092aa9289d127c284caa5955ff5298f3b8d516

SHA256
11c93ea6f692bee8f2f379eae849fc58b65b0bddb2aca4e03e2e02a74e031312

SHA512
fbc3d2564c14f65eb97811c520792ee81b6300834934c1bcb5ee76f8ce513503eb79e117483cc60be50f3478f4ed3337c7faafdccf3eb063d296a6249e8a7eb6

Download Submit
\Windows\system\oinHVLq.exe

Filesize
2.3MB

MD5
0bb57ce0ba4dadb7eb4fdf79182e4be3

SHA1
584d0a2285c7a761c9098784471b98b62c6f7e18

SHA256
a509939849b6588fa3e36c8c42d3af39b485fbead10aabc4d760a39310dd2d7a

SHA512
ce3b10b0f55994fd4201fc6c79d41e32472ab20785fce77864374eaa1b7bfd0fcff8005bdb46bb95dff5cad98be967b28f94477fb1559c11cd25de7f77a6b6ef

Download Submit
\Windows\system\rYEoFFp.exe

Filesize
2.3MB

MD5
8c96963437f7f7fbf1d054b164206309

SHA1
ed982d947458ba64df6e51adc0df5ea1b8f806cf

SHA256
7477789477a37447a8ac5db2122a787a8d4b07df020a221e8c924c5bd6c716c2

SHA512
3f898e10f186cb4d7d3a75644294d992d6730a280e9f6aa46935e67c3cb7ef0d947e8b00e304b81dcf8f1089ceef6a8c763158f2b62e45e1170c5fdfb3e75abb

Download Submit
\Windows\system\uMMBKcd.exe

Filesize
2.3MB

MD5
f372e44b61c7889a09b3befe44e209af

SHA1
b923de6a4f5da05005bbf5dcc2aeb8a7cf17ddf4

SHA256
b1518f63a00e5fbcef96b98e5dcf46b9d3a665ff58da7020d35ce4e9330d32e1

SHA512
54dc19194f9460f605ae5d26b3f29b4dd5c38b326b243ca76b8c84a8c22abc364655bc7a05f47c9dd68f89913091a5cf4b5af2a598835008b00c1c1041e82b1b

Download Submit
memory/1808-47-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-360-0x000000001B380000-0x000000001B662000-memory.dmp

Filesize
2.9MB

Download
memory/2240-362-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2272-21-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2272-146-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2272-38-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-7-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2272-140-0x00000000032A0000-0x0000000003692000-memory.dmp

Filesize
3.9MB

Download
memory/2272-488-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/2272-236-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2272-43-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-76-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2272-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2272-14-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/2272-70-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/2272-0-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2272-54-0x0000000002E30000-0x0000000003222000-memory.dmp

Filesize
3.9MB

Download
memory/2272-41-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-79-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2420-127-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-61-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-36-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2656-804-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2668-94-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2752-42-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-9-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2868-467-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2928-23-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2928-505-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/3036-44-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download