xmrig | b4baf991c7202c291c2416d75d4347b7cd2f0bc69a881f0520b5c739fe4c963d

Analysis

max time kernel
24s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Size

1.8MB
MD5

065bf697e2be3b30502ac4a40e0a8eff
SHA1

bb4b76f5045c3b858de2b778fc115902bf3a2d16
SHA256

b4baf991c7202c291c2416d75d4347b7cd2f0bc69a881f0520b5c739fe4c963d
SHA512

d627aaabd6c5dbcfe32b482de19dc2eede3754593bf02585291be160b0f3e50deb85f969b1bd0e52012b23ee3947a15392ec2afbcc120c03290b34cecc64abf5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlM:NABN

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2284-19-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2564-45-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2724-42-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2604-40-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2480-61-0x000000013F590000-0x000000013F982000-memory.dmp	xmrig
behavioral1/memory/2624-1295-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2936-370-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2624	eidKhtK.exe
2284	KVmtUHU.exe
2604	SZWMDFI.exe
2724	YhBOhWD.exe
2564	HzKokiC.exe
2728	DscPhoH.exe
2480	yZAtovS.exe
2492	pChdVeH.exe
2196	ruSgUbc.exe
2680	uTrexne.exe
2756	tPxoPOQ.exe
1960	RhHdSXz.exe
2332	hIbmMXj.exe
1196	rRSbsVj.exe
276	wWAQoSw.exe
1952	LQLpHGc.exe
2424	vqgmTbT.exe
1984	YdntgYl.exe
1660	XNbmnYv.exe
2136	GbZMjGM.exe
2432	hEJHGqc.exe
2856	nRRSKnX.exe
684	rFmMeQv.exe
1500	JYGRlVw.exe
1668	UIVPHbF.exe
1796	YqXNRfi.exe
2112	PulyQfE.exe
2544	HgEvVaV.exe
2260	baCPhzG.exe
2268	EWNJRRq.exe
2720	wYATwWY.exe
3016	pIYOGRl.exe
292	CByWyvz.exe
2320	mIpuRUO.exe
1772	bladhsY.exe
1352	Lzgxtcz.exe
1084	OhnfeJF.exe
920	rMfZPEN.exe
1544	uiuitoe.exe
2004	SecSNuz.exe
1548	RFahFdX.exe
1868	PTliPbS.exe
1240	TNXBpgz.exe
568	TgIVXYd.exe
1792	lNWZUbX.exe
2304	MdYGSTM.exe
1596	PgdzakL.exe
2020	wnPPBks.exe
1680	ljvstgo.exe
2120	NuIZAMw.exe
820	bFSOiEe.exe
2348	GncwWJm.exe
900	igsovra.exe
2264	luxMIVy.exe
2532	ezynRSE.exe
1644	SBaUmpC.exe
3008	lbrzHor.exe
2980	ioCNOHt.exe
2708	fwnqZDX.exe
2484	ErMCYAb.exe
2908	JWDDXZw.exe
2940	UImWeZj.exe
2900	CNQwUWe.exe
2476	bwmcOMK.exe

Loads dropped DLL 64 IoCs

pid	Process
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2936-0-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-3.dat	upx
behavioral1/memory/2624-7-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0033000000014983-12.dat	upx
behavioral1/memory/2284-19-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x0007000000014e5a-21.dat	upx
behavioral1/files/0x001400000000549e-25.dat	upx
behavioral1/files/0x0008000000015136-35.dat	upx
behavioral1/memory/2564-45-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/files/0x0007000000015362-48.dat	upx
behavioral1/files/0x00090000000155e3-54.dat	upx
behavioral1/memory/2728-53-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2724-42-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2604-40-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0007000000015cc1-64.dat	upx
behavioral1/memory/2480-61-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2492-67-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-68.dat	upx
behavioral1/files/0x00310000000149ea-75.dat	upx
behavioral1/memory/2196-74-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x0006000000015d06-100.dat	upx
behavioral1/files/0x0006000000015cf7-95.dat	upx
behavioral1/files/0x0006000000016597-140.dat	upx
behavioral1/files/0x0006000000016a45-146.dat	upx
behavioral1/files/0x0006000000016c7a-164.dat	upx
behavioral1/files/0x0006000000016cc9-175.dat	upx
behavioral1/files/0x0006000000016277-181.dat	upx
behavioral1/files/0x0006000000016525-183.dat	upx
behavioral1/files/0x0006000000016c17-187.dat	upx
behavioral1/files/0x00060000000160f8-129.dat	upx
behavioral1/files/0x0006000000016056-174.dat	upx
behavioral1/files/0x0006000000016c2e-192.dat	upx
behavioral1/memory/2624-1295-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/memory/2936-370-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/files/0x0006000000016ce1-188.dat	upx
behavioral1/files/0x0006000000016cab-169.dat	upx
behavioral1/files/0x00060000000167ef-143.dat	upx
behavioral1/files/0x0006000000016411-136.dat	upx
behavioral1/files/0x0006000000015f1b-115.dat	upx
behavioral1/files/0x0006000000015d5d-105.dat	upx
behavioral1/files/0x0006000000016c26-159.dat	upx
behavioral1/files/0x0006000000015f9e-120.dat	upx
behavioral1/files/0x0006000000015d6e-109.dat	upx
behavioral1/files/0x0006000000015cec-90.dat	upx
behavioral1/files/0x0006000000015cdb-84.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\usQRZsT.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\WDpazxf.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\qHQlELY.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\NuvfCfI.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\jbYtBje.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\RpVmEKG.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\SyvqdMh.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\trzqHyd.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\xpuTlwn.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\KLSCRIr.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\SLHcTMh.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\uahWqss.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\MepNMhe.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\tocZnkZ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\SrzYTgO.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\bKxbDVg.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ZktNHqk.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\STTGYWb.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\tdqOBzT.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\wTzHSJy.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\vcOCoVV.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\gcJzGsG.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\VvDxlSW.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\SgoHPIH.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zFJUQCW.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\wKXNvaS.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\EyGPmFk.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\DvDVLxB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\wpYbzEX.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\TUaDyHo.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\JEpQmio.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\czfDhNZ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\jBVMlxB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\CByWyvz.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\HlhAmfA.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\FpcqgyY.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\axypTvN.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\iaPajTV.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\gVbcfMg.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\nUoMSsH.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\FxdCrov.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\WontqGP.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\OxufBUE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\zujEWxQ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\mBmTkpO.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\sUmAWLv.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\VZwRIYO.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\qdCRSpf.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\cuFSneB.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\OBMWGjW.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\FaDYGPi.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\UMwfFMT.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\VhcfLxS.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\tYaOsXZ.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\CtCtuGR.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\NPIRqtt.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\DZuIdpr.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\YKktrAI.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\kIvYBqm.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\ezynRSE.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\iXehuTP.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\qviyHaV.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\kBUuhUF.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
File created	C:\Windows\System\AJxjPth.exe	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 3040	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	29
PID 2936 wrote to memory of 3040	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	29
PID 2936 wrote to memory of 3040	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	29
PID 2936 wrote to memory of 2624	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2624	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2624	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	30
PID 2936 wrote to memory of 2284	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2284	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2284	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	31
PID 2936 wrote to memory of 2604	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2604	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2604	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	32
PID 2936 wrote to memory of 2724	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2724	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2724	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	33
PID 2936 wrote to memory of 2564	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2564	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2564	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	34
PID 2936 wrote to memory of 2728	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2728	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2728	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	35
PID 2936 wrote to memory of 2480	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2480	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2480	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	36
PID 2936 wrote to memory of 2492	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2492	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2492	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	37
PID 2936 wrote to memory of 2196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	38
PID 2936 wrote to memory of 2680	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	39
PID 2936 wrote to memory of 2680	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	39
PID 2936 wrote to memory of 2680	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	39
PID 2936 wrote to memory of 2756	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2756	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	40
PID 2936 wrote to memory of 2756	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	40
PID 2936 wrote to memory of 1960	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	41
PID 2936 wrote to memory of 1960	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	41
PID 2936 wrote to memory of 1960	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	41
PID 2936 wrote to memory of 2332	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	42
PID 2936 wrote to memory of 2332	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	42
PID 2936 wrote to memory of 2332	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	42
PID 2936 wrote to memory of 1196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	43
PID 2936 wrote to memory of 1196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	43
PID 2936 wrote to memory of 1196	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	43
PID 2936 wrote to memory of 276	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	44
PID 2936 wrote to memory of 276	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	44
PID 2936 wrote to memory of 276	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	44
PID 2936 wrote to memory of 1952	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	45
PID 2936 wrote to memory of 1952	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	45
PID 2936 wrote to memory of 1952	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	45
PID 2936 wrote to memory of 2424	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2424	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	46
PID 2936 wrote to memory of 2424	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	46
PID 2936 wrote to memory of 1984	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1984	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1984	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	47
PID 2936 wrote to memory of 1668	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	48
PID 2936 wrote to memory of 1668	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	48
PID 2936 wrote to memory of 1668	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	48
PID 2936 wrote to memory of 1660	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1660	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	49
PID 2936 wrote to memory of 1660	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	49
PID 2936 wrote to memory of 2112	2936	065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\065bf697e2be3b30502ac4a40e0a8eff_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\eidKhtK.exe
  C:\Windows\System\eidKhtK.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\KVmtUHU.exe
  C:\Windows\System\KVmtUHU.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\SZWMDFI.exe
  C:\Windows\System\SZWMDFI.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\YhBOhWD.exe
  C:\Windows\System\YhBOhWD.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\HzKokiC.exe
  C:\Windows\System\HzKokiC.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\DscPhoH.exe
  C:\Windows\System\DscPhoH.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\yZAtovS.exe
  C:\Windows\System\yZAtovS.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\pChdVeH.exe
  C:\Windows\System\pChdVeH.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ruSgUbc.exe
  C:\Windows\System\ruSgUbc.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\uTrexne.exe
  C:\Windows\System\uTrexne.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\tPxoPOQ.exe
  C:\Windows\System\tPxoPOQ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\RhHdSXz.exe
  C:\Windows\System\RhHdSXz.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\hIbmMXj.exe
  C:\Windows\System\hIbmMXj.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\rRSbsVj.exe
  C:\Windows\System\rRSbsVj.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\wWAQoSw.exe
  C:\Windows\System\wWAQoSw.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\LQLpHGc.exe
  C:\Windows\System\LQLpHGc.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\vqgmTbT.exe
  C:\Windows\System\vqgmTbT.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\YdntgYl.exe
  C:\Windows\System\YdntgYl.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\UIVPHbF.exe
  C:\Windows\System\UIVPHbF.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\XNbmnYv.exe
  C:\Windows\System\XNbmnYv.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\PulyQfE.exe
  C:\Windows\System\PulyQfE.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\GbZMjGM.exe
  C:\Windows\System\GbZMjGM.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\HgEvVaV.exe
  C:\Windows\System\HgEvVaV.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\hEJHGqc.exe
  C:\Windows\System\hEJHGqc.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\baCPhzG.exe
  C:\Windows\System\baCPhzG.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\nRRSKnX.exe
  C:\Windows\System\nRRSKnX.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\EWNJRRq.exe
  C:\Windows\System\EWNJRRq.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\rFmMeQv.exe
  C:\Windows\System\rFmMeQv.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\wYATwWY.exe
  C:\Windows\System\wYATwWY.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\JYGRlVw.exe
  C:\Windows\System\JYGRlVw.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\pIYOGRl.exe
  C:\Windows\System\pIYOGRl.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\YqXNRfi.exe
  C:\Windows\System\YqXNRfi.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\mIpuRUO.exe
  C:\Windows\System\mIpuRUO.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CByWyvz.exe
  C:\Windows\System\CByWyvz.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\uiuitoe.exe
  C:\Windows\System\uiuitoe.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\bladhsY.exe
  C:\Windows\System\bladhsY.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\RFahFdX.exe
  C:\Windows\System\RFahFdX.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\Lzgxtcz.exe
  C:\Windows\System\Lzgxtcz.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\PTliPbS.exe
  C:\Windows\System\PTliPbS.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\OhnfeJF.exe
  C:\Windows\System\OhnfeJF.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\TNXBpgz.exe
  C:\Windows\System\TNXBpgz.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\rMfZPEN.exe
  C:\Windows\System\rMfZPEN.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\TgIVXYd.exe
  C:\Windows\System\TgIVXYd.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\SecSNuz.exe
  C:\Windows\System\SecSNuz.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\lNWZUbX.exe
  C:\Windows\System\lNWZUbX.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\MdYGSTM.exe
  C:\Windows\System\MdYGSTM.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\GncwWJm.exe
  C:\Windows\System\GncwWJm.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\PgdzakL.exe
  C:\Windows\System\PgdzakL.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\igsovra.exe
  C:\Windows\System\igsovra.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\wnPPBks.exe
  C:\Windows\System\wnPPBks.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\ezynRSE.exe
  C:\Windows\System\ezynRSE.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\ljvstgo.exe
  C:\Windows\System\ljvstgo.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\SBaUmpC.exe
  C:\Windows\System\SBaUmpC.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\NuIZAMw.exe
  C:\Windows\System\NuIZAMw.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\lbrzHor.exe
  C:\Windows\System\lbrzHor.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\bFSOiEe.exe
  C:\Windows\System\bFSOiEe.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\ioCNOHt.exe
  C:\Windows\System\ioCNOHt.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\luxMIVy.exe
  C:\Windows\System\luxMIVy.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\ErMCYAb.exe
  C:\Windows\System\ErMCYAb.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\fwnqZDX.exe
  C:\Windows\System\fwnqZDX.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JWDDXZw.exe
  C:\Windows\System\JWDDXZw.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\UImWeZj.exe
  C:\Windows\System\UImWeZj.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\CNQwUWe.exe
  C:\Windows\System\CNQwUWe.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\bwmcOMK.exe
  C:\Windows\System\bwmcOMK.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\NbpMcAS.exe
  C:\Windows\System\NbpMcAS.exe
  2⤵
  PID:2744
- C:\Windows\System\tGzOMGf.exe
  C:\Windows\System\tGzOMGf.exe
  2⤵
  PID:872
- C:\Windows\System\xPvzeGF.exe
  C:\Windows\System\xPvzeGF.exe
  2⤵
  PID:2548
- C:\Windows\System\YkZqkeY.exe
  C:\Windows\System\YkZqkeY.exe
  2⤵
  PID:2164
- C:\Windows\System\MepNMhe.exe
  C:\Windows\System\MepNMhe.exe
  2⤵
  PID:1752
- C:\Windows\System\dHDVEkL.exe
  C:\Windows\System\dHDVEkL.exe
  2⤵
  PID:2252
- C:\Windows\System\ZGuMsWg.exe
  C:\Windows\System\ZGuMsWg.exe
  2⤵
  PID:2636
- C:\Windows\System\smXawMe.exe
  C:\Windows\System\smXawMe.exe
  2⤵
  PID:2008
- C:\Windows\System\iuNRxmb.exe
  C:\Windows\System\iuNRxmb.exe
  2⤵
  PID:664
- C:\Windows\System\jzDBOcJ.exe
  C:\Windows\System\jzDBOcJ.exe
  2⤵
  PID:1516
- C:\Windows\System\jhDdQMK.exe
  C:\Windows\System\jhDdQMK.exe
  2⤵
  PID:1948
- C:\Windows\System\LvsXxnl.exe
  C:\Windows\System\LvsXxnl.exe
  2⤵
  PID:2340
- C:\Windows\System\NiFISaf.exe
  C:\Windows\System\NiFISaf.exe
  2⤵
  PID:796
- C:\Windows\System\RLvYTht.exe
  C:\Windows\System\RLvYTht.exe
  2⤵
  PID:2188
- C:\Windows\System\BrLfEjJ.exe
  C:\Windows\System\BrLfEjJ.exe
  2⤵
  PID:1028
- C:\Windows\System\PeUyaji.exe
  C:\Windows\System\PeUyaji.exe
  2⤵
  PID:2860
- C:\Windows\System\FpcqgyY.exe
  C:\Windows\System\FpcqgyY.exe
  2⤵
  PID:604
- C:\Windows\System\yGBrcDO.exe
  C:\Windows\System\yGBrcDO.exe
  2⤵
  PID:1316
- C:\Windows\System\cZtJIlt.exe
  C:\Windows\System\cZtJIlt.exe
  2⤵
  PID:992
- C:\Windows\System\EcVmbnb.exe
  C:\Windows\System\EcVmbnb.exe
  2⤵
  PID:1292
- C:\Windows\System\OdAvIlp.exe
  C:\Windows\System\OdAvIlp.exe
  2⤵
  PID:3068
- C:\Windows\System\wFVBBXS.exe
  C:\Windows\System\wFVBBXS.exe
  2⤵
  PID:2200
- C:\Windows\System\ugLhVSq.exe
  C:\Windows\System\ugLhVSq.exe
  2⤵
  PID:1756
- C:\Windows\System\UpcpmgZ.exe
  C:\Windows\System\UpcpmgZ.exe
  2⤵
  PID:1556
- C:\Windows\System\OimDqDL.exe
  C:\Windows\System\OimDqDL.exe
  2⤵
  PID:2448
- C:\Windows\System\tvnrcAc.exe
  C:\Windows\System\tvnrcAc.exe
  2⤵
  PID:776
- C:\Windows\System\jhtAvnS.exe
  C:\Windows\System\jhtAvnS.exe
  2⤵
  PID:1748
- C:\Windows\System\leIKVqL.exe
  C:\Windows\System\leIKVqL.exe
  2⤵
  PID:2032
- C:\Windows\System\jCoeqlO.exe
  C:\Windows\System\jCoeqlO.exe
  2⤵
  PID:2124
- C:\Windows\System\vJgBlXE.exe
  C:\Windows\System\vJgBlXE.exe
  2⤵
  PID:1616
- C:\Windows\System\OTPMWrW.exe
  C:\Windows\System\OTPMWrW.exe
  2⤵
  PID:2736
- C:\Windows\System\LswKAPA.exe
  C:\Windows\System\LswKAPA.exe
  2⤵
  PID:2556
- C:\Windows\System\hUwDpfi.exe
  C:\Windows\System\hUwDpfi.exe
  2⤵
  PID:2168
- C:\Windows\System\CuTztUv.exe
  C:\Windows\System\CuTztUv.exe
  2⤵
  PID:640
- C:\Windows\System\WontqGP.exe
  C:\Windows\System\WontqGP.exe
  2⤵
  PID:2796
- C:\Windows\System\nAklVVd.exe
  C:\Windows\System\nAklVVd.exe
  2⤵
  PID:1936
- C:\Windows\System\FaDYGPi.exe
  C:\Windows\System\FaDYGPi.exe
  2⤵
  PID:800
- C:\Windows\System\OxufBUE.exe
  C:\Windows\System\OxufBUE.exe
  2⤵
  PID:1628
- C:\Windows\System\kgQeCbu.exe
  C:\Windows\System\kgQeCbu.exe
  2⤵
  PID:324
- C:\Windows\System\OFRAnwh.exe
  C:\Windows\System\OFRAnwh.exe
  2⤵
  PID:1080
- C:\Windows\System\MKPgdEs.exe
  C:\Windows\System\MKPgdEs.exe
  2⤵
  PID:2384
- C:\Windows\System\XnlqAYS.exe
  C:\Windows\System\XnlqAYS.exe
  2⤵
  PID:1164
- C:\Windows\System\pMwcsBJ.exe
  C:\Windows\System\pMwcsBJ.exe
  2⤵
  PID:824
- C:\Windows\System\OMeabIr.exe
  C:\Windows\System\OMeabIr.exe
  2⤵
  PID:2712
- C:\Windows\System\qmkzgcw.exe
  C:\Windows\System\qmkzgcw.exe
  2⤵
  PID:2676
- C:\Windows\System\sDucVwQ.exe
  C:\Windows\System\sDucVwQ.exe
  2⤵
  PID:1560
- C:\Windows\System\kvqnXiV.exe
  C:\Windows\System\kvqnXiV.exe
  2⤵
  PID:816
- C:\Windows\System\zIPeetH.exe
  C:\Windows\System\zIPeetH.exe
  2⤵
  PID:2316
- C:\Windows\System\EGOIuvX.exe
  C:\Windows\System\EGOIuvX.exe
  2⤵
  PID:2596
- C:\Windows\System\MkolswO.exe
  C:\Windows\System\MkolswO.exe
  2⤵
  PID:1540
- C:\Windows\System\vcOCoVV.exe
  C:\Windows\System\vcOCoVV.exe
  2⤵
  PID:772
- C:\Windows\System\jxowCzU.exe
  C:\Windows\System\jxowCzU.exe
  2⤵
  PID:2416
- C:\Windows\System\hmSvaKF.exe
  C:\Windows\System\hmSvaKF.exe
  2⤵
  PID:2608
- C:\Windows\System\DvDVLxB.exe
  C:\Windows\System\DvDVLxB.exe
  2⤵
  PID:2692
- C:\Windows\System\CIsjWyV.exe
  C:\Windows\System\CIsjWyV.exe
  2⤵
  PID:2220
- C:\Windows\System\nSpscLn.exe
  C:\Windows\System\nSpscLn.exe
  2⤵
  PID:1912
- C:\Windows\System\zUrrDCc.exe
  C:\Windows\System\zUrrDCc.exe
  2⤵
  PID:380
- C:\Windows\System\KzdsWpu.exe
  C:\Windows\System\KzdsWpu.exe
  2⤵
  PID:2444
- C:\Windows\System\mpJPmNK.exe
  C:\Windows\System\mpJPmNK.exe
  2⤵
  PID:628
- C:\Windows\System\zmqFQzR.exe
  C:\Windows\System\zmqFQzR.exe
  2⤵
  PID:2672
- C:\Windows\System\WZaivFi.exe
  C:\Windows\System\WZaivFi.exe
  2⤵
  PID:1716
- C:\Windows\System\syVgaIp.exe
  C:\Windows\System\syVgaIp.exe
  2⤵
  PID:2716
- C:\Windows\System\bgaehAq.exe
  C:\Windows\System\bgaehAq.exe
  2⤵
  PID:2452
- C:\Windows\System\OjFMcTH.exe
  C:\Windows\System\OjFMcTH.exe
  2⤵
  PID:1656
- C:\Windows\System\caSwwSy.exe
  C:\Windows\System\caSwwSy.exe
  2⤵
  PID:2668
- C:\Windows\System\KGfsBEg.exe
  C:\Windows\System\KGfsBEg.exe
  2⤵
  PID:704
- C:\Windows\System\BBnrRhP.exe
  C:\Windows\System\BBnrRhP.exe
  2⤵
  PID:1236
- C:\Windows\System\ZlPhlHm.exe
  C:\Windows\System\ZlPhlHm.exe
  2⤵
  PID:2396
- C:\Windows\System\bprDBTI.exe
  C:\Windows\System\bprDBTI.exe
  2⤵
  PID:3084
- C:\Windows\System\ZpgvNZA.exe
  C:\Windows\System\ZpgvNZA.exe
  2⤵
  PID:3100
- C:\Windows\System\UopNWgH.exe
  C:\Windows\System\UopNWgH.exe
  2⤵
  PID:3120
- C:\Windows\System\FixcodP.exe
  C:\Windows\System\FixcodP.exe
  2⤵
  PID:3136
- C:\Windows\System\SwdNUom.exe
  C:\Windows\System\SwdNUom.exe
  2⤵
  PID:3152
- C:\Windows\System\nYLVbDt.exe
  C:\Windows\System\nYLVbDt.exe
  2⤵
  PID:3168
- C:\Windows\System\wLMCmko.exe
  C:\Windows\System\wLMCmko.exe
  2⤵
  PID:3184
- C:\Windows\System\iXehuTP.exe
  C:\Windows\System\iXehuTP.exe
  2⤵
  PID:3200
- C:\Windows\System\vrzyMUx.exe
  C:\Windows\System\vrzyMUx.exe
  2⤵
  PID:3216
- C:\Windows\System\nbVzapA.exe
  C:\Windows\System\nbVzapA.exe
  2⤵
  PID:3232
- C:\Windows\System\ruvGjPI.exe
  C:\Windows\System\ruvGjPI.exe
  2⤵
  PID:3248
- C:\Windows\System\PHAcaOi.exe
  C:\Windows\System\PHAcaOi.exe
  2⤵
  PID:3268
- C:\Windows\System\PvSJxtg.exe
  C:\Windows\System\PvSJxtg.exe
  2⤵
  PID:3284
- C:\Windows\System\jUuqdsQ.exe
  C:\Windows\System\jUuqdsQ.exe
  2⤵
  PID:3300
- C:\Windows\System\PWMABBT.exe
  C:\Windows\System\PWMABBT.exe
  2⤵
  PID:3316
- C:\Windows\System\eOtauSH.exe
  C:\Windows\System\eOtauSH.exe
  2⤵
  PID:3332
- C:\Windows\System\AECdMpr.exe
  C:\Windows\System\AECdMpr.exe
  2⤵
  PID:3348
- C:\Windows\System\qdCRSpf.exe
  C:\Windows\System\qdCRSpf.exe
  2⤵
  PID:3364
- C:\Windows\System\eCwfnDC.exe
  C:\Windows\System\eCwfnDC.exe
  2⤵
  PID:3380
- C:\Windows\System\EunQakb.exe
  C:\Windows\System\EunQakb.exe
  2⤵
  PID:3396
- C:\Windows\System\yznbioI.exe
  C:\Windows\System\yznbioI.exe
  2⤵
  PID:3412
- C:\Windows\System\VSdNDsT.exe
  C:\Windows\System\VSdNDsT.exe
  2⤵
  PID:3432
- C:\Windows\System\cRXohHL.exe
  C:\Windows\System\cRXohHL.exe
  2⤵
  PID:3448
- C:\Windows\System\AlIrTUr.exe
  C:\Windows\System\AlIrTUr.exe
  2⤵
  PID:3464
- C:\Windows\System\lleaNeJ.exe
  C:\Windows\System\lleaNeJ.exe
  2⤵
  PID:3480
- C:\Windows\System\eUcABxl.exe
  C:\Windows\System\eUcABxl.exe
  2⤵
  PID:3496
- C:\Windows\System\TBcRMVD.exe
  C:\Windows\System\TBcRMVD.exe
  2⤵
  PID:3512
- C:\Windows\System\tiBkHgs.exe
  C:\Windows\System\tiBkHgs.exe
  2⤵
  PID:3528
- C:\Windows\System\xiMnrdy.exe
  C:\Windows\System\xiMnrdy.exe
  2⤵
  PID:3548
- C:\Windows\System\kWnVYmR.exe
  C:\Windows\System\kWnVYmR.exe
  2⤵
  PID:3564
- C:\Windows\System\wKXNvaS.exe
  C:\Windows\System\wKXNvaS.exe
  2⤵
  PID:3580
- C:\Windows\System\oshPHBq.exe
  C:\Windows\System\oshPHBq.exe
  2⤵
  PID:3596
- C:\Windows\System\TOPRrgG.exe
  C:\Windows\System\TOPRrgG.exe
  2⤵
  PID:3612
- C:\Windows\System\BylgHhH.exe
  C:\Windows\System\BylgHhH.exe
  2⤵
  PID:3628
- C:\Windows\System\uspBrAn.exe
  C:\Windows\System\uspBrAn.exe
  2⤵
  PID:3644
- C:\Windows\System\xxzmpqb.exe
  C:\Windows\System\xxzmpqb.exe
  2⤵
  PID:3660
- C:\Windows\System\iFcBztt.exe
  C:\Windows\System\iFcBztt.exe
  2⤵
  PID:3676
- C:\Windows\System\CtCtuGR.exe
  C:\Windows\System\CtCtuGR.exe
  2⤵
  PID:3692
- C:\Windows\System\hsCYugj.exe
  C:\Windows\System\hsCYugj.exe
  2⤵
  PID:3712
- C:\Windows\System\rlEJTlW.exe
  C:\Windows\System\rlEJTlW.exe
  2⤵
  PID:3728
- C:\Windows\System\esKucjr.exe
  C:\Windows\System\esKucjr.exe
  2⤵
  PID:3744
- C:\Windows\System\ZktNHqk.exe
  C:\Windows\System\ZktNHqk.exe
  2⤵
  PID:3760
- C:\Windows\System\axypTvN.exe
  C:\Windows\System\axypTvN.exe
  2⤵
  PID:3776
- C:\Windows\System\WkSrnjC.exe
  C:\Windows\System\WkSrnjC.exe
  2⤵
  PID:3792
- C:\Windows\System\WvvrAiM.exe
  C:\Windows\System\WvvrAiM.exe
  2⤵
  PID:3808
- C:\Windows\System\uJyhnmx.exe
  C:\Windows\System\uJyhnmx.exe
  2⤵
  PID:3828
- C:\Windows\System\DKltAuL.exe
  C:\Windows\System\DKltAuL.exe
  2⤵
  PID:3844
- C:\Windows\System\NuvfCfI.exe
  C:\Windows\System\NuvfCfI.exe
  2⤵
  PID:3860
- C:\Windows\System\yPewqdG.exe
  C:\Windows\System\yPewqdG.exe
  2⤵
  PID:3876
- C:\Windows\System\GvzZpPq.exe
  C:\Windows\System\GvzZpPq.exe
  2⤵
  PID:3892
- C:\Windows\System\cvuFwxQ.exe
  C:\Windows\System\cvuFwxQ.exe
  2⤵
  PID:3912
- C:\Windows\System\NPkkqHi.exe
  C:\Windows\System\NPkkqHi.exe
  2⤵
  PID:3928
- C:\Windows\System\pzWoGxH.exe
  C:\Windows\System\pzWoGxH.exe
  2⤵
  PID:4068
- C:\Windows\System\usQRZsT.exe
  C:\Windows\System\usQRZsT.exe
  2⤵
  PID:4088
- C:\Windows\System\XjKmxtu.exe
  C:\Windows\System\XjKmxtu.exe
  2⤵
  PID:2972
- C:\Windows\System\AnaEtPW.exe
  C:\Windows\System\AnaEtPW.exe
  2⤵
  PID:2092
- C:\Windows\System\djhHcke.exe
  C:\Windows\System\djhHcke.exe
  2⤵
  PID:360
- C:\Windows\System\ROmxlkH.exe
  C:\Windows\System\ROmxlkH.exe
  2⤵
  PID:2832
- C:\Windows\System\UcGPhKf.exe
  C:\Windows\System\UcGPhKf.exe
  2⤵
  PID:2508
- C:\Windows\System\DnXUEEB.exe
  C:\Windows\System\DnXUEEB.exe
  2⤵
  PID:2888
- C:\Windows\System\rPdUkMV.exe
  C:\Windows\System\rPdUkMV.exe
  2⤵
  PID:3096
- C:\Windows\System\WuLGKvf.exe
  C:\Windows\System\WuLGKvf.exe
  2⤵
  PID:3224
- C:\Windows\System\FPPUdaS.exe
  C:\Windows\System\FPPUdaS.exe
  2⤵
  PID:3264
- C:\Windows\System\KhGfore.exe
  C:\Windows\System\KhGfore.exe
  2⤵
  PID:3328
- C:\Windows\System\ZXdevjc.exe
  C:\Windows\System\ZXdevjc.exe
  2⤵
  PID:3392
- C:\Windows\System\UpGPAZz.exe
  C:\Windows\System\UpGPAZz.exe
  2⤵
  PID:3456
- C:\Windows\System\kgLeavZ.exe
  C:\Windows\System\kgLeavZ.exe
  2⤵
  PID:3524
- C:\Windows\System\puyfknZ.exe
  C:\Windows\System\puyfknZ.exe
  2⤵
  PID:3588
- C:\Windows\System\SxvUSbV.exe
  C:\Windows\System\SxvUSbV.exe
  2⤵
  PID:3652
- C:\Windows\System\xgOuVFH.exe
  C:\Windows\System\xgOuVFH.exe
  2⤵
  PID:1488
- C:\Windows\System\rpAVYit.exe
  C:\Windows\System\rpAVYit.exe
  2⤵
  PID:1036
- C:\Windows\System\tZZlazR.exe
  C:\Windows\System\tZZlazR.exe
  2⤵
  PID:3604
- C:\Windows\System\UNACTUU.exe
  C:\Windows\System\UNACTUU.exe
  2⤵
  PID:2916
- C:\Windows\System\fkaqLNK.exe
  C:\Windows\System\fkaqLNK.exe
  2⤵
  PID:2368
- C:\Windows\System\BEZYUtk.exe
  C:\Windows\System\BEZYUtk.exe
  2⤵
  PID:912
- C:\Windows\System\wpYbzEX.exe
  C:\Windows\System\wpYbzEX.exe
  2⤵
  PID:1864
- C:\Windows\System\ODpIMBx.exe
  C:\Windows\System\ODpIMBx.exe
  2⤵
  PID:2588
- C:\Windows\System\ixjySoE.exe
  C:\Windows\System\ixjySoE.exe
  2⤵
  PID:336
- C:\Windows\System\sjfcPMi.exe
  C:\Windows\System\sjfcPMi.exe
  2⤵
  PID:3080
- C:\Windows\System\cazJDVP.exe
  C:\Windows\System\cazJDVP.exe
  2⤵
  PID:3176
- C:\Windows\System\AHwchEb.exe
  C:\Windows\System\AHwchEb.exe
  2⤵
  PID:3212
- C:\Windows\System\uDRttnv.exe
  C:\Windows\System\uDRttnv.exe
  2⤵
  PID:3280
- C:\Windows\System\GaXPBwe.exe
  C:\Windows\System\GaXPBwe.exe
  2⤵
  PID:3344
- C:\Windows\System\ozlJiaW.exe
  C:\Windows\System\ozlJiaW.exe
  2⤵
  PID:3408
- C:\Windows\System\OLXtcMt.exe
  C:\Windows\System\OLXtcMt.exe
  2⤵
  PID:3476
- C:\Windows\System\IcDIelD.exe
  C:\Windows\System\IcDIelD.exe
  2⤵
  PID:3544
- C:\Windows\System\NlCJJqC.exe
  C:\Windows\System\NlCJJqC.exe
  2⤵
  PID:3636
- C:\Windows\System\rrBMDmn.exe
  C:\Windows\System\rrBMDmn.exe
  2⤵
  PID:3700
- C:\Windows\System\uUZvYFq.exe
  C:\Windows\System\uUZvYFq.exe
  2⤵
  PID:3740
- C:\Windows\System\eNOnTTo.exe
  C:\Windows\System\eNOnTTo.exe
  2⤵
  PID:3804
- C:\Windows\System\gRDiFPn.exe
  C:\Windows\System\gRDiFPn.exe
  2⤵
  PID:3900
- C:\Windows\System\OXxobYy.exe
  C:\Windows\System\OXxobYy.exe
  2⤵
  PID:3948
- C:\Windows\System\JaWHbvZ.exe
  C:\Windows\System\JaWHbvZ.exe
  2⤵
  PID:3964
- C:\Windows\System\BaDUvTo.exe
  C:\Windows\System\BaDUvTo.exe
  2⤵
  PID:3980
- C:\Windows\System\xpuTlwn.exe
  C:\Windows\System\xpuTlwn.exe
  2⤵
  PID:3996
- C:\Windows\System\eXzcAhX.exe
  C:\Windows\System\eXzcAhX.exe
  2⤵
  PID:4012
- C:\Windows\System\svSmlbo.exe
  C:\Windows\System\svSmlbo.exe
  2⤵
  PID:4024
- C:\Windows\System\alOgMVn.exe
  C:\Windows\System\alOgMVn.exe
  2⤵
  PID:4040
- C:\Windows\System\INXvvtO.exe
  C:\Windows\System\INXvvtO.exe
  2⤵
  PID:4056
- C:\Windows\System\qpkGAFy.exe
  C:\Windows\System\qpkGAFy.exe
  2⤵
  PID:1268
- C:\Windows\System\lafdAix.exe
  C:\Windows\System\lafdAix.exe
  2⤵
  PID:3856
- C:\Windows\System\worRduG.exe
  C:\Windows\System\worRduG.exe
  2⤵
  PID:3924
- C:\Windows\System\AUxZMZW.exe
  C:\Windows\System\AUxZMZW.exe
  2⤵
  PID:3196
- C:\Windows\System\gcJzGsG.exe
  C:\Windows\System\gcJzGsG.exe
  2⤵
  PID:3720
- C:\Windows\System\cSDXJHv.exe
  C:\Windows\System\cSDXJHv.exe
  2⤵
  PID:4080
- C:\Windows\System\vLeeTwg.exe
  C:\Windows\System\vLeeTwg.exe
  2⤵
  PID:2276
- C:\Windows\System\RmnuiQk.exe
  C:\Windows\System\RmnuiQk.exe
  2⤵
  PID:3256
- C:\Windows\System\nwQYwYy.exe
  C:\Windows\System\nwQYwYy.exe
  2⤵
  PID:3784
- C:\Windows\System\iORtcJI.exe
  C:\Windows\System\iORtcJI.exe
  2⤵
  PID:2616
- C:\Windows\System\DTPxPCi.exe
  C:\Windows\System\DTPxPCi.exe
  2⤵
  PID:2012
- C:\Windows\System\hrzqkWj.exe
  C:\Windows\System\hrzqkWj.exe
  2⤵
  PID:1928
- C:\Windows\System\EhEGZCD.exe
  C:\Windows\System\EhEGZCD.exe
  2⤵
  PID:1932
- C:\Windows\System\eQaqTGV.exe
  C:\Windows\System\eQaqTGV.exe
  2⤵
  PID:2108
- C:\Windows\System\lEgQWYL.exe
  C:\Windows\System\lEgQWYL.exe
  2⤵
  PID:3324
- C:\Windows\System\XcBHtkm.exe
  C:\Windows\System\XcBHtkm.exe
  2⤵
  PID:3508
- C:\Windows\System\iMGZNOH.exe
  C:\Windows\System\iMGZNOH.exe
  2⤵
  PID:2788
- C:\Windows\System\kAuAsTV.exe
  C:\Windows\System\kAuAsTV.exe
  2⤵
  PID:2748
- C:\Windows\System\UMwfFMT.exe
  C:\Windows\System\UMwfFMT.exe
  2⤵
  PID:1956
- C:\Windows\System\uBqBZmU.exe
  C:\Windows\System\uBqBZmU.exe
  2⤵
  PID:2064
- C:\Windows\System\mNgqNbw.exe
  C:\Windows\System\mNgqNbw.exe
  2⤵
  PID:3244
- C:\Windows\System\LqzpFEc.exe
  C:\Windows\System\LqzpFEc.exe
  2⤵
  PID:3404
- C:\Windows\System\TtotKUh.exe
  C:\Windows\System\TtotKUh.exe
  2⤵
  PID:3672
- C:\Windows\System\uQDfLAD.exe
  C:\Windows\System\uQDfLAD.exe
  2⤵
  PID:1100
- C:\Windows\System\zjNCEDa.exe
  C:\Windows\System\zjNCEDa.exe
  2⤵
  PID:2056
- C:\Windows\System\AyqHGnY.exe
  C:\Windows\System\AyqHGnY.exe
  2⤵
  PID:3208
- C:\Windows\System\YbneopX.exe
  C:\Windows\System\YbneopX.exe
  2⤵
  PID:3472
- C:\Windows\System\fKuGZJz.exe
  C:\Windows\System\fKuGZJz.exe
  2⤵
  PID:3800
- C:\Windows\System\EqLInfn.exe
  C:\Windows\System\EqLInfn.exe
  2⤵
  PID:2568
- C:\Windows\System\SyvqdMh.exe
  C:\Windows\System\SyvqdMh.exe
  2⤵
  PID:3976
- C:\Windows\System\dHKXaqn.exe
  C:\Windows\System\dHKXaqn.exe
  2⤵
  PID:4036
- C:\Windows\System\BzNVNej.exe
  C:\Windows\System\BzNVNej.exe
  2⤵
  PID:3708
- C:\Windows\System\DmbrJMh.exe
  C:\Windows\System\DmbrJMh.exe
  2⤵
  PID:3956
- C:\Windows\System\PDHavCv.exe
  C:\Windows\System\PDHavCv.exe
  2⤵
  PID:4020
- C:\Windows\System\GpBkwUb.exe
  C:\Windows\System\GpBkwUb.exe
  2⤵
  PID:3132
- C:\Windows\System\SPIZHyr.exe
  C:\Windows\System\SPIZHyr.exe
  2⤵
  PID:3092
- C:\Windows\System\xBfJELG.exe
  C:\Windows\System\xBfJELG.exe
  2⤵
  PID:3816
- C:\Windows\System\zjhzvSp.exe
  C:\Windows\System\zjhzvSp.exe
  2⤵
  PID:1308
- C:\Windows\System\Cgwcfhn.exe
  C:\Windows\System\Cgwcfhn.exe
  2⤵
  PID:2428
- C:\Windows\System\gfxlsCv.exe
  C:\Windows\System\gfxlsCv.exe
  2⤵
  PID:1296
- C:\Windows\System\ZPQrIje.exe
  C:\Windows\System\ZPQrIje.exe
  2⤵
  PID:2208
- C:\Windows\System\WcemuwZ.exe
  C:\Windows\System\WcemuwZ.exe
  2⤵
  PID:1504
- C:\Windows\System\kvAzglu.exe
  C:\Windows\System\kvAzglu.exe
  2⤵
  PID:3076
- C:\Windows\System\nVpqyhG.exe
  C:\Windows\System\nVpqyhG.exe
  2⤵
  PID:3160
- C:\Windows\System\owavntm.exe
  C:\Windows\System\owavntm.exe
  2⤵
  PID:1848
- C:\Windows\System\LGtBSYY.exe
  C:\Windows\System\LGtBSYY.exe
  2⤵
  PID:2920
- C:\Windows\System\RMtffAU.exe
  C:\Windows\System\RMtffAU.exe
  2⤵
  PID:3988
- C:\Windows\System\fcDPwFe.exe
  C:\Windows\System\fcDPwFe.exe
  2⤵
  PID:1040
- C:\Windows\System\iwPOjaP.exe
  C:\Windows\System\iwPOjaP.exe
  2⤵
  PID:1400
- C:\Windows\System\nNXvCBp.exe
  C:\Windows\System\nNXvCBp.exe
  2⤵
  PID:3488
- C:\Windows\System\NPIRqtt.exe
  C:\Windows\System\NPIRqtt.exe
  2⤵
  PID:856
- C:\Windows\System\PRcPVeL.exe
  C:\Windows\System\PRcPVeL.exe
  2⤵
  PID:4016
- C:\Windows\System\LSXPmoi.exe
  C:\Windows\System\LSXPmoi.exe
  2⤵
  PID:4008
- C:\Windows\System\NiXxXDU.exe
  C:\Windows\System\NiXxXDU.exe
  2⤵
  PID:848
- C:\Windows\System\uZlQztQ.exe
  C:\Windows\System\uZlQztQ.exe
  2⤵
  PID:3756
- C:\Windows\System\STTGYWb.exe
  C:\Windows\System\STTGYWb.exe
  2⤵
  PID:3824
- C:\Windows\System\RtkcPKV.exe
  C:\Windows\System\RtkcPKV.exe
  2⤵
  PID:4108
- C:\Windows\System\BEthfCn.exe
  C:\Windows\System\BEthfCn.exe
  2⤵
  PID:4124
- C:\Windows\System\BHbZTWl.exe
  C:\Windows\System\BHbZTWl.exe
  2⤵
  PID:4140
- C:\Windows\System\krqNQcN.exe
  C:\Windows\System\krqNQcN.exe
  2⤵
  PID:4156
- C:\Windows\System\gjadoFv.exe
  C:\Windows\System\gjadoFv.exe
  2⤵
  PID:4172
- C:\Windows\System\wtuhvUA.exe
  C:\Windows\System\wtuhvUA.exe
  2⤵
  PID:4188
- C:\Windows\System\fCpkEWO.exe
  C:\Windows\System\fCpkEWO.exe
  2⤵
  PID:4204
- C:\Windows\System\nZXZxGm.exe
  C:\Windows\System\nZXZxGm.exe
  2⤵
  PID:4220
- C:\Windows\System\NFRbbzC.exe
  C:\Windows\System\NFRbbzC.exe
  2⤵
  PID:4236
- C:\Windows\System\cuvVcnt.exe
  C:\Windows\System\cuvVcnt.exe
  2⤵
  PID:4252
- C:\Windows\System\oLUFwpd.exe
  C:\Windows\System\oLUFwpd.exe
  2⤵
  PID:4268
- C:\Windows\System\FEnsgkP.exe
  C:\Windows\System\FEnsgkP.exe
  2⤵
  PID:4284
- C:\Windows\System\rSPcMSJ.exe
  C:\Windows\System\rSPcMSJ.exe
  2⤵
  PID:4300
- C:\Windows\System\xoEwTuU.exe
  C:\Windows\System\xoEwTuU.exe
  2⤵
  PID:4316
- C:\Windows\System\NUxxWWz.exe
  C:\Windows\System\NUxxWWz.exe
  2⤵
  PID:4332
- C:\Windows\System\kZxbTRD.exe
  C:\Windows\System\kZxbTRD.exe
  2⤵
  PID:4352
- C:\Windows\System\LkxnFSf.exe
  C:\Windows\System\LkxnFSf.exe
  2⤵
  PID:4372
- C:\Windows\System\WDpazxf.exe
  C:\Windows\System\WDpazxf.exe
  2⤵
  PID:4388
- C:\Windows\System\eUrbrUw.exe
  C:\Windows\System\eUrbrUw.exe
  2⤵
  PID:4404
- C:\Windows\System\qkdYdEk.exe
  C:\Windows\System\qkdYdEk.exe
  2⤵
  PID:4420
- C:\Windows\System\DfmTOtj.exe
  C:\Windows\System\DfmTOtj.exe
  2⤵
  PID:4436
- C:\Windows\System\FVdtFyl.exe
  C:\Windows\System\FVdtFyl.exe
  2⤵
  PID:4452
- C:\Windows\System\hjjGlqH.exe
  C:\Windows\System\hjjGlqH.exe
  2⤵
  PID:4468
- C:\Windows\System\ermZUnD.exe
  C:\Windows\System\ermZUnD.exe
  2⤵
  PID:4484
- C:\Windows\System\pBEjJkh.exe
  C:\Windows\System\pBEjJkh.exe
  2⤵
  PID:4500
- C:\Windows\System\XTkHNGL.exe
  C:\Windows\System\XTkHNGL.exe
  2⤵
  PID:4516
- C:\Windows\System\tdqOBzT.exe
  C:\Windows\System\tdqOBzT.exe
  2⤵
  PID:4532
- C:\Windows\System\IrayBOr.exe
  C:\Windows\System\IrayBOr.exe
  2⤵
  PID:4548
- C:\Windows\System\AanDjHs.exe
  C:\Windows\System\AanDjHs.exe
  2⤵
  PID:4564
- C:\Windows\System\EJJHXOr.exe
  C:\Windows\System\EJJHXOr.exe
  2⤵
  PID:4580
- C:\Windows\System\tJgYmoa.exe
  C:\Windows\System\tJgYmoa.exe
  2⤵
  PID:4596
- C:\Windows\System\dJrOQjv.exe
  C:\Windows\System\dJrOQjv.exe
  2⤵
  PID:4612
- C:\Windows\System\FXnNpsw.exe
  C:\Windows\System\FXnNpsw.exe
  2⤵
  PID:4628
- C:\Windows\System\JEQFqdn.exe
  C:\Windows\System\JEQFqdn.exe
  2⤵
  PID:4644
- C:\Windows\System\dLLTmNs.exe
  C:\Windows\System\dLLTmNs.exe
  2⤵
  PID:4660
- C:\Windows\System\cgdVSyC.exe
  C:\Windows\System\cgdVSyC.exe
  2⤵
  PID:4676
- C:\Windows\System\PuZIYwn.exe
  C:\Windows\System\PuZIYwn.exe
  2⤵
  PID:4692
- C:\Windows\System\tusHgYr.exe
  C:\Windows\System\tusHgYr.exe
  2⤵
  PID:4708
- C:\Windows\System\OnYizXh.exe
  C:\Windows\System\OnYizXh.exe
  2⤵
  PID:4724
- C:\Windows\System\uvWYDpI.exe
  C:\Windows\System\uvWYDpI.exe
  2⤵
  PID:4740
- C:\Windows\System\wywBXSu.exe
  C:\Windows\System\wywBXSu.exe
  2⤵
  PID:4756
- C:\Windows\System\MLQfOQN.exe
  C:\Windows\System\MLQfOQN.exe
  2⤵
  PID:4772
- C:\Windows\System\OuYoXJY.exe
  C:\Windows\System\OuYoXJY.exe
  2⤵
  PID:4788
- C:\Windows\System\SVciKMf.exe
  C:\Windows\System\SVciKMf.exe
  2⤵
  PID:4804
- C:\Windows\System\lzyglXK.exe
  C:\Windows\System\lzyglXK.exe
  2⤵
  PID:4820
- C:\Windows\System\WYyZvWY.exe
  C:\Windows\System\WYyZvWY.exe
  2⤵
  PID:4836
- C:\Windows\System\fSzZyFU.exe
  C:\Windows\System\fSzZyFU.exe
  2⤵
  PID:4852
- C:\Windows\System\kVbVeLN.exe
  C:\Windows\System\kVbVeLN.exe
  2⤵
  PID:4868
- C:\Windows\System\YVkQihC.exe
  C:\Windows\System\YVkQihC.exe
  2⤵
  PID:4884
- C:\Windows\System\WsNSmUM.exe
  C:\Windows\System\WsNSmUM.exe
  2⤵
  PID:4900
- C:\Windows\System\tocZnkZ.exe
  C:\Windows\System\tocZnkZ.exe
  2⤵
  PID:4916
- C:\Windows\System\yenIdvV.exe
  C:\Windows\System\yenIdvV.exe
  2⤵
  PID:4932
- C:\Windows\System\HQXbysZ.exe
  C:\Windows\System\HQXbysZ.exe
  2⤵
  PID:4948
- C:\Windows\System\hdemMLX.exe
  C:\Windows\System\hdemMLX.exe
  2⤵
  PID:4968
- C:\Windows\System\GqXlfaf.exe
  C:\Windows\System\GqXlfaf.exe
  2⤵
  PID:4984
- C:\Windows\System\gMltLiR.exe
  C:\Windows\System\gMltLiR.exe
  2⤵
  PID:5000
- C:\Windows\System\TmZhlcq.exe
  C:\Windows\System\TmZhlcq.exe
  2⤵
  PID:5016
- C:\Windows\System\cpKEyyg.exe
  C:\Windows\System\cpKEyyg.exe
  2⤵
  PID:5032
- C:\Windows\System\uGAnOTx.exe
  C:\Windows\System\uGAnOTx.exe
  2⤵
  PID:5048
- C:\Windows\System\FaymRFl.exe
  C:\Windows\System\FaymRFl.exe
  2⤵
  PID:5064
- C:\Windows\System\UIcqgLg.exe
  C:\Windows\System\UIcqgLg.exe
  2⤵
  PID:5080
- C:\Windows\System\HBhMMiI.exe
  C:\Windows\System\HBhMMiI.exe
  2⤵
  PID:5096
- C:\Windows\System\WyipujX.exe
  C:\Windows\System\WyipujX.exe
  2⤵
  PID:5112
- C:\Windows\System\xAtUeoC.exe
  C:\Windows\System\xAtUeoC.exe
  2⤵
  PID:3684
- C:\Windows\System\jbYtBje.exe
  C:\Windows\System\jbYtBje.exe
  2⤵
  PID:3944
- C:\Windows\System\HhKHddm.exe
  C:\Windows\System\HhKHddm.exe
  2⤵
  PID:384
- C:\Windows\System\TEmWcvM.exe
  C:\Windows\System\TEmWcvM.exe
  2⤵
  PID:3540
- C:\Windows\System\OapNEXc.exe
  C:\Windows\System\OapNEXc.exe
  2⤵
  PID:956
- C:\Windows\System\bekNauT.exe
  C:\Windows\System\bekNauT.exe
  2⤵
  PID:2084
- C:\Windows\System\DmZFGnC.exe
  C:\Windows\System\DmZFGnC.exe
  2⤵
  PID:4168
- C:\Windows\System\AdGaafx.exe
  C:\Windows\System\AdGaafx.exe
  2⤵
  PID:2176
- C:\Windows\System\TbwdvnB.exe
  C:\Windows\System\TbwdvnB.exe
  2⤵
  PID:3340
- C:\Windows\System\oZpVfeZ.exe
  C:\Windows\System\oZpVfeZ.exe
  2⤵
  PID:3868
- C:\Windows\System\PXhzXbp.exe
  C:\Windows\System\PXhzXbp.exe
  2⤵
  PID:4148
- C:\Windows\System\PGxjHNV.exe
  C:\Windows\System\PGxjHNV.exe
  2⤵
  PID:4212
- C:\Windows\System\VhcfLxS.exe
  C:\Windows\System\VhcfLxS.exe
  2⤵
  PID:4276
- C:\Windows\System\ZRXBoIb.exe
  C:\Windows\System\ZRXBoIb.exe
  2⤵
  PID:4340
- C:\Windows\System\ptIPSrk.exe
  C:\Windows\System\ptIPSrk.exe
  2⤵
  PID:4324
- C:\Windows\System\ADFAsQm.exe
  C:\Windows\System\ADFAsQm.exe
  2⤵
  PID:4264
- C:\Windows\System\Mhmyizh.exe
  C:\Windows\System\Mhmyizh.exe
  2⤵
  PID:4400
- C:\Windows\System\tUbrLLy.exe
  C:\Windows\System\tUbrLLy.exe
  2⤵
  PID:4464
- C:\Windows\System\WWSiVtT.exe
  C:\Windows\System\WWSiVtT.exe
  2⤵
  PID:4528
- C:\Windows\System\YmwKEhU.exe
  C:\Windows\System\YmwKEhU.exe
  2⤵
  PID:2116
- C:\Windows\System\mSjHzDP.exe
  C:\Windows\System\mSjHzDP.exe
  2⤵
  PID:4620
- C:\Windows\System\XuVQSVt.exe
  C:\Windows\System\XuVQSVt.exe
  2⤵
  PID:4656
- C:\Windows\System\KmsRHHX.exe
  C:\Windows\System\KmsRHHX.exe
  2⤵
  PID:4716
- C:\Windows\System\KdcXDAK.exe
  C:\Windows\System\KdcXDAK.exe
  2⤵
  PID:1144
- C:\Windows\System\WYplmKU.exe
  C:\Windows\System\WYplmKU.exe
  2⤵
  PID:4764
- C:\Windows\System\TilqVno.exe
  C:\Windows\System\TilqVno.exe
  2⤵
  PID:4844
- C:\Windows\System\fMbqIlx.exe
  C:\Windows\System\fMbqIlx.exe
  2⤵
  PID:4908
- C:\Windows\System\gCVKesu.exe
  C:\Windows\System\gCVKesu.exe
  2⤵
  PID:4380
- C:\Windows\System\pNacyYc.exe
  C:\Windows\System\pNacyYc.exe
  2⤵
  PID:4444
- C:\Windows\System\bhgvsvB.exe
  C:\Windows\System\bhgvsvB.exe
  2⤵
  PID:4508
- C:\Windows\System\TUaDyHo.exe
  C:\Windows\System\TUaDyHo.exe
  2⤵
  PID:4576
- C:\Windows\System\wouXsET.exe
  C:\Windows\System\wouXsET.exe
  2⤵
  PID:4640
- C:\Windows\System\QQronFi.exe
  C:\Windows\System\QQronFi.exe
  2⤵
  PID:4700
- C:\Windows\System\OPIBuzz.exe
  C:\Windows\System\OPIBuzz.exe
  2⤵
  PID:4828
- C:\Windows\System\bDMKCYp.exe
  C:\Windows\System\bDMKCYp.exe
  2⤵
  PID:4892
- C:\Windows\System\AsSlpLw.exe
  C:\Windows\System\AsSlpLw.exe
  2⤵
  PID:4956
- C:\Windows\System\TfMZMpD.exe
  C:\Windows\System\TfMZMpD.exe
  2⤵
  PID:4976
- C:\Windows\System\mEpXDAK.exe
  C:\Windows\System\mEpXDAK.exe
  2⤵
  PID:5040
- C:\Windows\System\iVMVLCA.exe
  C:\Windows\System\iVMVLCA.exe
  2⤵
  PID:5104
- C:\Windows\System\gVbcfMg.exe
  C:\Windows\System\gVbcfMg.exe
  2⤵
  PID:5056
- C:\Windows\System\wCUWMgx.exe
  C:\Windows\System\wCUWMgx.exe
  2⤵
  PID:4100
- C:\Windows\System\guwblvJ.exe
  C:\Windows\System\guwblvJ.exe
  2⤵
  PID:4228
- C:\Windows\System\eGSrIIO.exe
  C:\Windows\System\eGSrIIO.exe
  2⤵
  PID:4180
- C:\Windows\System\ozvMTJD.exe
  C:\Windows\System\ozvMTJD.exe
  2⤵
  PID:4232
- C:\Windows\System\SrgMyMM.exe
  C:\Windows\System\SrgMyMM.exe
  2⤵
  PID:5060
- C:\Windows\System\KLSCRIr.exe
  C:\Windows\System\KLSCRIr.exe
  2⤵
  PID:3888
- C:\Windows\System\eXvlYIA.exe
  C:\Windows\System\eXvlYIA.exe
  2⤵
  PID:1664
- C:\Windows\System\QSAtvBF.exe
  C:\Windows\System\QSAtvBF.exe
  2⤵
  PID:1856
- C:\Windows\System\EhmMLsn.exe
  C:\Windows\System\EhmMLsn.exe
  2⤵
  PID:4748
- C:\Windows\System\CXLehNs.exe
  C:\Windows\System\CXLehNs.exe
  2⤵
  PID:4540
- C:\Windows\System\XPNepwv.exe
  C:\Windows\System\XPNepwv.exe
  2⤵
  PID:4608
- C:\Windows\System\wOEpyWK.exe
  C:\Windows\System\wOEpyWK.exe
  2⤵
  PID:4796
- C:\Windows\System\rYRkhQA.exe
  C:\Windows\System\rYRkhQA.exe
  2⤵
  PID:5012
- C:\Windows\System\MDBMHIU.exe
  C:\Windows\System\MDBMHIU.exe
  2⤵
  PID:4200
- C:\Windows\System\ycLNTLs.exe
  C:\Windows\System\ycLNTLs.exe
  2⤵
  PID:4432
- C:\Windows\System\PjKGnAT.exe
  C:\Windows\System\PjKGnAT.exe
  2⤵
  PID:4120
- C:\Windows\System\GStbITk.exe
  C:\Windows\System\GStbITk.exe
  2⤵
  PID:4360
- C:\Windows\System\ubeYzwr.exe
  C:\Windows\System\ubeYzwr.exe
  2⤵
  PID:3180
- C:\Windows\System\HHqIoHQ.exe
  C:\Windows\System\HHqIoHQ.exe
  2⤵
  PID:4688
- C:\Windows\System\QdEFTvC.exe
  C:\Windows\System\QdEFTvC.exe
  2⤵
  PID:4880
- C:\Windows\System\davLnep.exe
  C:\Windows\System\davLnep.exe
  2⤵
  PID:4572
- C:\Windows\System\Fkdkkhq.exe
  C:\Windows\System\Fkdkkhq.exe
  2⤵
  PID:4560
- C:\Windows\System\cEGZlcq.exe
  C:\Windows\System\cEGZlcq.exe
  2⤵
  PID:5072
- C:\Windows\System\UKIBgle.exe
  C:\Windows\System\UKIBgle.exe
  2⤵
  PID:3560
- C:\Windows\System\cuFSneB.exe
  C:\Windows\System\cuFSneB.exe
  2⤵
  PID:5028
- C:\Windows\System\zujEWxQ.exe
  C:\Windows\System\zujEWxQ.exe
  2⤵
  PID:4476
- C:\Windows\System\xsNXBMs.exe
  C:\Windows\System\xsNXBMs.exe
  2⤵
  PID:4800
- C:\Windows\System\wFFFOeo.exe
  C:\Windows\System\wFFFOeo.exe
  2⤵
  PID:4928
- C:\Windows\System\vADuYbW.exe
  C:\Windows\System\vADuYbW.exe
  2⤵
  PID:5092
- C:\Windows\System\TvKcvrC.exe
  C:\Windows\System\TvKcvrC.exe
  2⤵
  PID:4412
- C:\Windows\System\wjTuyAt.exe
  C:\Windows\System\wjTuyAt.exe
  2⤵
  PID:5132
- C:\Windows\System\KegYzwr.exe
  C:\Windows\System\KegYzwr.exe
  2⤵
  PID:5148
- C:\Windows\System\LenRWcU.exe
  C:\Windows\System\LenRWcU.exe
  2⤵
  PID:5164
- C:\Windows\System\BWCkAME.exe
  C:\Windows\System\BWCkAME.exe
  2⤵
  PID:5180
- C:\Windows\System\QjsBMRE.exe
  C:\Windows\System\QjsBMRE.exe
  2⤵
  PID:5196
- C:\Windows\System\AdZKAwS.exe
  C:\Windows\System\AdZKAwS.exe
  2⤵
  PID:5212
- C:\Windows\System\kJKogVW.exe
  C:\Windows\System\kJKogVW.exe
  2⤵
  PID:5228
- C:\Windows\System\liksPOF.exe
  C:\Windows\System\liksPOF.exe
  2⤵
  PID:5244
- C:\Windows\System\DglLNeh.exe
  C:\Windows\System\DglLNeh.exe
  2⤵
  PID:5260
- C:\Windows\System\zQLNxbR.exe
  C:\Windows\System\zQLNxbR.exe
  2⤵
  PID:5276
- C:\Windows\System\IEbhRYX.exe
  C:\Windows\System\IEbhRYX.exe
  2⤵
  PID:5292
- C:\Windows\System\uckwaKj.exe
  C:\Windows\System\uckwaKj.exe
  2⤵
  PID:5308
- C:\Windows\System\HfhOJpm.exe
  C:\Windows\System\HfhOJpm.exe
  2⤵
  PID:5324
- C:\Windows\System\EgXuyEO.exe
  C:\Windows\System\EgXuyEO.exe
  2⤵
  PID:5340
- C:\Windows\System\UoZLhxU.exe
  C:\Windows\System\UoZLhxU.exe
  2⤵
  PID:5356
- C:\Windows\System\EXTrdBs.exe
  C:\Windows\System\EXTrdBs.exe
  2⤵
  PID:5372
- C:\Windows\System\FgWSaPq.exe
  C:\Windows\System\FgWSaPq.exe
  2⤵
  PID:5388
- C:\Windows\System\rVeQvOt.exe
  C:\Windows\System\rVeQvOt.exe
  2⤵
  PID:5404
- C:\Windows\System\qjRQWZh.exe
  C:\Windows\System\qjRQWZh.exe
  2⤵
  PID:5420
- C:\Windows\System\kAjTdMq.exe
  C:\Windows\System\kAjTdMq.exe
  2⤵
  PID:5436
- C:\Windows\System\rjofKga.exe
  C:\Windows\System\rjofKga.exe
  2⤵
  PID:5452
- C:\Windows\System\SrzYTgO.exe
  C:\Windows\System\SrzYTgO.exe
  2⤵
  PID:5468
- C:\Windows\System\koxfbIL.exe
  C:\Windows\System\koxfbIL.exe
  2⤵
  PID:5484
- C:\Windows\System\neHjgAN.exe
  C:\Windows\System\neHjgAN.exe
  2⤵
  PID:5500
- C:\Windows\System\VvDxlSW.exe
  C:\Windows\System\VvDxlSW.exe
  2⤵
  PID:5516
- C:\Windows\System\AARgJhz.exe
  C:\Windows\System\AARgJhz.exe
  2⤵
  PID:5532
- C:\Windows\System\jhOaBYR.exe
  C:\Windows\System\jhOaBYR.exe
  2⤵
  PID:5548
- C:\Windows\System\KvJOUll.exe
  C:\Windows\System\KvJOUll.exe
  2⤵
  PID:5564
- C:\Windows\System\NhNaHPj.exe
  C:\Windows\System\NhNaHPj.exe
  2⤵
  PID:5580
- C:\Windows\System\nVJNxzt.exe
  C:\Windows\System\nVJNxzt.exe
  2⤵
  PID:5596
- C:\Windows\System\pyCjuLt.exe
  C:\Windows\System\pyCjuLt.exe
  2⤵
  PID:5612
- C:\Windows\System\ycbCSdO.exe
  C:\Windows\System\ycbCSdO.exe
  2⤵
  PID:5628
- C:\Windows\System\zwVNLDx.exe
  C:\Windows\System\zwVNLDx.exe
  2⤵
  PID:5644
- C:\Windows\System\uxUJdxu.exe
  C:\Windows\System\uxUJdxu.exe
  2⤵
  PID:5660
- C:\Windows\System\TTQozIu.exe
  C:\Windows\System\TTQozIu.exe
  2⤵
  PID:5676
- C:\Windows\System\mroHQGe.exe
  C:\Windows\System\mroHQGe.exe
  2⤵
  PID:5692
- C:\Windows\System\AjPCsvL.exe
  C:\Windows\System\AjPCsvL.exe
  2⤵
  PID:5708
- C:\Windows\System\JgsiMLP.exe
  C:\Windows\System\JgsiMLP.exe
  2⤵
  PID:5724
- C:\Windows\System\MmXTvTD.exe
  C:\Windows\System\MmXTvTD.exe
  2⤵
  PID:5740
- C:\Windows\System\sagnncH.exe
  C:\Windows\System\sagnncH.exe
  2⤵
  PID:5756
- C:\Windows\System\yRHRVUa.exe
  C:\Windows\System\yRHRVUa.exe
  2⤵
  PID:5772
- C:\Windows\System\KxHEGtN.exe
  C:\Windows\System\KxHEGtN.exe
  2⤵
  PID:5788
- C:\Windows\System\trzqHyd.exe
  C:\Windows\System\trzqHyd.exe
  2⤵
  PID:5804
- C:\Windows\System\StRKQDo.exe
  C:\Windows\System\StRKQDo.exe
  2⤵
  PID:5820
- C:\Windows\System\oznVyrG.exe
  C:\Windows\System\oznVyrG.exe
  2⤵
  PID:5836
- C:\Windows\System\SkAdiig.exe
  C:\Windows\System\SkAdiig.exe
  2⤵
  PID:5852
- C:\Windows\System\GiqUWjq.exe
  C:\Windows\System\GiqUWjq.exe
  2⤵
  PID:5868
- C:\Windows\System\BfJbDXC.exe
  C:\Windows\System\BfJbDXC.exe
  2⤵
  PID:5884
- C:\Windows\System\FgTRCya.exe
  C:\Windows\System\FgTRCya.exe
  2⤵
  PID:5900
- C:\Windows\System\IugmguG.exe
  C:\Windows\System\IugmguG.exe
  2⤵
  PID:5916
- C:\Windows\System\NXqIIMj.exe
  C:\Windows\System\NXqIIMj.exe
  2⤵
  PID:5932
- C:\Windows\System\wlLJGbZ.exe
  C:\Windows\System\wlLJGbZ.exe
  2⤵
  PID:5948
- C:\Windows\System\djQfFUX.exe
  C:\Windows\System\djQfFUX.exe
  2⤵
  PID:5964
- C:\Windows\System\WwcJhpB.exe
  C:\Windows\System\WwcJhpB.exe
  2⤵
  PID:5980
- C:\Windows\System\wHwMgFe.exe
  C:\Windows\System\wHwMgFe.exe
  2⤵
  PID:5996
- C:\Windows\System\LKVMzQw.exe
  C:\Windows\System\LKVMzQw.exe
  2⤵
  PID:6012
- C:\Windows\System\jrzGSIh.exe
  C:\Windows\System\jrzGSIh.exe
  2⤵
  PID:6028
- C:\Windows\System\KHlkkzc.exe
  C:\Windows\System\KHlkkzc.exe
  2⤵
  PID:6044
- C:\Windows\System\EyGPmFk.exe
  C:\Windows\System\EyGPmFk.exe
  2⤵
  PID:6060
- C:\Windows\System\aUNUleo.exe
  C:\Windows\System\aUNUleo.exe
  2⤵
  PID:6076
- C:\Windows\System\jwtfgaq.exe
  C:\Windows\System\jwtfgaq.exe
  2⤵
  PID:6092
- C:\Windows\System\MeoBULG.exe
  C:\Windows\System\MeoBULG.exe
  2⤵
  PID:6108
- C:\Windows\System\aHFMkRN.exe
  C:\Windows\System\aHFMkRN.exe
  2⤵
  PID:6124
- C:\Windows\System\bCHCbDt.exe
  C:\Windows\System\bCHCbDt.exe
  2⤵
  PID:6140
- C:\Windows\System\DsNEvTx.exe
  C:\Windows\System\DsNEvTx.exe
  2⤵
  PID:4052
- C:\Windows\System\thLIuVB.exe
  C:\Windows\System\thLIuVB.exe
  2⤵
  PID:4624
- C:\Windows\System\AYvDBqn.exe
  C:\Windows\System\AYvDBqn.exe
  2⤵
  PID:4524
- C:\Windows\System\dmFUdQa.exe
  C:\Windows\System\dmFUdQa.exe
  2⤵
  PID:5204
- C:\Windows\System\xZSikCb.exe
  C:\Windows\System\xZSikCb.exe
  2⤵
  PID:5240
- C:\Windows\System\QUxfZBC.exe
  C:\Windows\System\QUxfZBC.exe
  2⤵
  PID:4592
- C:\Windows\System\VCfKlaI.exe
  C:\Windows\System\VCfKlaI.exe
  2⤵
  PID:5336
- C:\Windows\System\JmznRBn.exe
  C:\Windows\System\JmznRBn.exe
  2⤵
  PID:5396
- C:\Windows\System\kmVYxwU.exe
  C:\Windows\System\kmVYxwU.exe
  2⤵
  PID:4544
- C:\Windows\System\TEnOohj.exe
  C:\Windows\System\TEnOohj.exe
  2⤵
  PID:5024
- C:\Windows\System\qBbnKWZ.exe
  C:\Windows\System\qBbnKWZ.exe
  2⤵
  PID:5432
- C:\Windows\System\akYuijS.exe
  C:\Windows\System\akYuijS.exe
  2⤵
  PID:3388
- C:\Windows\System\JeKEAhM.exe
  C:\Windows\System\JeKEAhM.exe
  2⤵
  PID:5128
- C:\Windows\System\IOXfsAt.exe
  C:\Windows\System\IOXfsAt.exe
  2⤵
  PID:5384
- C:\Windows\System\pFugoJi.exe
  C:\Windows\System\pFugoJi.exe
  2⤵
  PID:5496
- C:\Windows\System\pzteesG.exe
  C:\Windows\System\pzteesG.exe
  2⤵
  PID:5348
- C:\Windows\System\oJAsOJA.exe
  C:\Windows\System\oJAsOJA.exe
  2⤵
  PID:5448
- C:\Windows\System\dyKrCEw.exe
  C:\Windows\System\dyKrCEw.exe
  2⤵
  PID:5256
- C:\Windows\System\LxrTdBl.exe
  C:\Windows\System\LxrTdBl.exe
  2⤵
  PID:5556
- C:\Windows\System\LtjUXEF.exe
  C:\Windows\System\LtjUXEF.exe
  2⤵
  PID:5560
- C:\Windows\System\sUmAWLv.exe
  C:\Windows\System\sUmAWLv.exe
  2⤵
  PID:5544
- C:\Windows\System\TFZiVRs.exe
  C:\Windows\System\TFZiVRs.exe
  2⤵
  PID:5620
- C:\Windows\System\yewDxGX.exe
  C:\Windows\System\yewDxGX.exe
  2⤵
  PID:5656
- C:\Windows\System\XJDFWIN.exe
  C:\Windows\System\XJDFWIN.exe
  2⤵
  PID:5608
- C:\Windows\System\ZuMfVWK.exe
  C:\Windows\System\ZuMfVWK.exe
  2⤵
  PID:5672
- C:\Windows\System\QDmtxNz.exe
  C:\Windows\System\QDmtxNz.exe
  2⤵
  PID:5736
- C:\Windows\System\IpWrqOr.exe
  C:\Windows\System\IpWrqOr.exe
  2⤵
  PID:5768
- C:\Windows\System\ocpVvMT.exe
  C:\Windows\System\ocpVvMT.exe
  2⤵
  PID:5748
- C:\Windows\System\YpgiAas.exe
  C:\Windows\System\YpgiAas.exe
  2⤵
  PID:5892
- C:\Windows\System\LSHVeOY.exe
  C:\Windows\System\LSHVeOY.exe
  2⤵
  PID:5844
- C:\Windows\System\xQYhFnV.exe
  C:\Windows\System\xQYhFnV.exe
  2⤵
  PID:5848
- C:\Windows\System\SaeXLiJ.exe
  C:\Windows\System\SaeXLiJ.exe
  2⤵
  PID:5912
- C:\Windows\System\uUFaUlZ.exe
  C:\Windows\System\uUFaUlZ.exe
  2⤵
  PID:5944
- C:\Windows\System\tfahWKU.exe
  C:\Windows\System\tfahWKU.exe
  2⤵
  PID:2244
- C:\Windows\System\SetEADy.exe
  C:\Windows\System\SetEADy.exe
  2⤵
  PID:5928
- C:\Windows\System\zwATvXw.exe
  C:\Windows\System\zwATvXw.exe
  2⤵
  PID:5992
- C:\Windows\System\sFJFrSc.exe
  C:\Windows\System\sFJFrSc.exe
  2⤵
  PID:6068
- C:\Windows\System\AayxNeN.exe
  C:\Windows\System\AayxNeN.exe
  2⤵
  PID:6100
- C:\Windows\System\QsZAAPY.exe
  C:\Windows\System\QsZAAPY.exe
  2⤵
  PID:6136
- C:\Windows\System\eKAnsZq.exe
  C:\Windows\System\eKAnsZq.exe
  2⤵
  PID:6084
- C:\Windows\System\MDaCXaZ.exe
  C:\Windows\System\MDaCXaZ.exe
  2⤵
  PID:5300
- C:\Windows\System\IBjzVOV.exe
  C:\Windows\System\IBjzVOV.exe
  2⤵
  PID:5464
- C:\Windows\System\WDBQRwb.exe
  C:\Windows\System\WDBQRwb.exe
  2⤵
  PID:6116
- C:\Windows\System\hIgegvl.exe
  C:\Windows\System\hIgegvl.exe
  2⤵
  PID:2740
- C:\Windows\System\SpObmUQ.exe
  C:\Windows\System\SpObmUQ.exe
  2⤵
  PID:5236
- C:\Windows\System\mSffnzY.exe
  C:\Windows\System\mSffnzY.exe
  2⤵
  PID:5480
- C:\Windows\System\oHvyPgR.exe
  C:\Windows\System\oHvyPgR.exe
  2⤵
  PID:5604
- C:\Windows\System\iKvFiLw.exe
  C:\Windows\System\iKvFiLw.exe
  2⤵
  PID:5316
- C:\Windows\System\SbrByTW.exe
  C:\Windows\System\SbrByTW.exe
  2⤵
  PID:5288
- C:\Windows\System\yLrxxlJ.exe
  C:\Windows\System\yLrxxlJ.exe
  2⤵
  PID:5220
- C:\Windows\System\oBlASiF.exe
  C:\Windows\System\oBlASiF.exe
  2⤵
  PID:5800
- C:\Windows\System\xGnjOzd.exe
  C:\Windows\System\xGnjOzd.exe
  2⤵
  PID:5528
- C:\Windows\System\puvdJal.exe
  C:\Windows\System\puvdJal.exe
  2⤵
  PID:5880
- C:\Windows\System\uckOrKi.exe
  C:\Windows\System\uckOrKi.exe
  2⤵
  PID:5960
- C:\Windows\System\FfZPHal.exe
  C:\Windows\System\FfZPHal.exe
  2⤵
  PID:5144
- C:\Windows\System\dOWUNqC.exe
  C:\Windows\System\dOWUNqC.exe
  2⤵
  PID:4860
- C:\Windows\System\IffdAOy.exe
  C:\Windows\System\IffdAOy.exe
  2⤵
  PID:5352
- C:\Windows\System\cfmeDCu.exe
  C:\Windows\System\cfmeDCu.exe
  2⤵
  PID:2612
- C:\Windows\System\dlJAsIu.exe
  C:\Windows\System\dlJAsIu.exe
  2⤵
  PID:5720
- C:\Windows\System\sCYxkYe.exe
  C:\Windows\System\sCYxkYe.exe
  2⤵
  PID:5864
- C:\Windows\System\eXTyGSr.exe
  C:\Windows\System\eXTyGSr.exe
  2⤵
  PID:5812
- C:\Windows\System\qviyHaV.exe
  C:\Windows\System\qviyHaV.exe
  2⤵
  PID:5796
- C:\Windows\System\kuHnVuR.exe
  C:\Windows\System\kuHnVuR.exe
  2⤵
  PID:5176
- C:\Windows\System\AvFTpIA.exe
  C:\Windows\System\AvFTpIA.exe
  2⤵
  PID:5160
- C:\Windows\System\GGzrgow.exe
  C:\Windows\System\GGzrgow.exe
  2⤵
  PID:4136
- C:\Windows\System\QjYokzH.exe
  C:\Windows\System\QjYokzH.exe
  2⤵
  PID:6040
- C:\Windows\System\JIytCbd.exe
  C:\Windows\System\JIytCbd.exe
  2⤵
  PID:5252
- C:\Windows\System\rvBNjyR.exe
  C:\Windows\System\rvBNjyR.exe
  2⤵
  PID:5940
- C:\Windows\System\OBMWGjW.exe
  C:\Windows\System\OBMWGjW.exe
  2⤵
  PID:4416
- C:\Windows\System\foAguMb.exe
  C:\Windows\System\foAguMb.exe
  2⤵
  PID:6160
- C:\Windows\System\JqPhuuM.exe
  C:\Windows\System\JqPhuuM.exe
  2⤵
  PID:6176
- C:\Windows\System\BTAsRMJ.exe
  C:\Windows\System\BTAsRMJ.exe
  2⤵
  PID:6192
- C:\Windows\System\HAUuhzc.exe
  C:\Windows\System\HAUuhzc.exe
  2⤵
  PID:6208
- C:\Windows\System\kBUuhUF.exe
  C:\Windows\System\kBUuhUF.exe
  2⤵
  PID:6224
- C:\Windows\System\LUkItse.exe
  C:\Windows\System\LUkItse.exe
  2⤵
  PID:6240
- C:\Windows\System\EpIhSaK.exe
  C:\Windows\System\EpIhSaK.exe
  2⤵
  PID:6256
- C:\Windows\System\XYEeBFq.exe
  C:\Windows\System\XYEeBFq.exe
  2⤵
  PID:6272
- C:\Windows\System\BcqRbbW.exe
  C:\Windows\System\BcqRbbW.exe
  2⤵
  PID:6288
- C:\Windows\System\hPCqPEe.exe
  C:\Windows\System\hPCqPEe.exe
  2⤵
  PID:6304
- C:\Windows\System\LcyACsf.exe
  C:\Windows\System\LcyACsf.exe
  2⤵
  PID:6320
- C:\Windows\System\tXukmUG.exe
  C:\Windows\System\tXukmUG.exe
  2⤵
  PID:6336
- C:\Windows\System\kmQioPb.exe
  C:\Windows\System\kmQioPb.exe
  2⤵
  PID:6352
- C:\Windows\System\lNXcbQF.exe
  C:\Windows\System\lNXcbQF.exe
  2⤵
  PID:6368
- C:\Windows\System\JbIudtZ.exe
  C:\Windows\System\JbIudtZ.exe
  2⤵
  PID:6384
- C:\Windows\System\eAXsxTj.exe
  C:\Windows\System\eAXsxTj.exe
  2⤵
  PID:6400
- C:\Windows\System\KWKqAsb.exe
  C:\Windows\System\KWKqAsb.exe
  2⤵
  PID:6416
- C:\Windows\System\bxOwQOJ.exe
  C:\Windows\System\bxOwQOJ.exe
  2⤵
  PID:6432
- C:\Windows\System\bKxbDVg.exe
  C:\Windows\System\bKxbDVg.exe
  2⤵
  PID:6448
- C:\Windows\System\kRlqBpo.exe
  C:\Windows\System\kRlqBpo.exe
  2⤵
  PID:6464
- C:\Windows\System\lwdFnKj.exe
  C:\Windows\System\lwdFnKj.exe
  2⤵
  PID:6480
- C:\Windows\System\FCPeFRu.exe
  C:\Windows\System\FCPeFRu.exe
  2⤵
  PID:6496
- C:\Windows\System\JEpQmio.exe
  C:\Windows\System\JEpQmio.exe
  2⤵
  PID:6512
- C:\Windows\System\rDhEnZB.exe
  C:\Windows\System\rDhEnZB.exe
  2⤵
  PID:6528
- C:\Windows\System\vXheLGo.exe
  C:\Windows\System\vXheLGo.exe
  2⤵
  PID:6544
- C:\Windows\System\NHKhZca.exe
  C:\Windows\System\NHKhZca.exe
  2⤵
  PID:6560
- C:\Windows\System\DiHESzr.exe
  C:\Windows\System\DiHESzr.exe
  2⤵
  PID:6576
- C:\Windows\System\jrkftFS.exe
  C:\Windows\System\jrkftFS.exe
  2⤵
  PID:6592
- C:\Windows\System\NsuFFTu.exe
  C:\Windows\System\NsuFFTu.exe
  2⤵
  PID:6608
- C:\Windows\System\yHgXVue.exe
  C:\Windows\System\yHgXVue.exe
  2⤵
  PID:6624
- C:\Windows\System\DQXNfyo.exe
  C:\Windows\System\DQXNfyo.exe
  2⤵
  PID:6640
- C:\Windows\System\UCEqtlw.exe
  C:\Windows\System\UCEqtlw.exe
  2⤵
  PID:6656
- C:\Windows\System\SLHcTMh.exe
  C:\Windows\System\SLHcTMh.exe
  2⤵
  PID:6672
- C:\Windows\System\EzsJGuG.exe
  C:\Windows\System\EzsJGuG.exe
  2⤵
  PID:6688
- C:\Windows\System\RpVmEKG.exe
  C:\Windows\System\RpVmEKG.exe
  2⤵
  PID:6704
- C:\Windows\System\ZFaNKvb.exe
  C:\Windows\System\ZFaNKvb.exe
  2⤵
  PID:6720
- C:\Windows\System\DbJcGXN.exe
  C:\Windows\System\DbJcGXN.exe
  2⤵
  PID:6736
- C:\Windows\System\UhNwChg.exe
  C:\Windows\System\UhNwChg.exe
  2⤵
  PID:6752
- C:\Windows\System\LGWscJE.exe
  C:\Windows\System\LGWscJE.exe
  2⤵
  PID:6768
- C:\Windows\System\VufYpkK.exe
  C:\Windows\System\VufYpkK.exe
  2⤵
  PID:6784
- C:\Windows\System\NQGSITS.exe
  C:\Windows\System\NQGSITS.exe
  2⤵
  PID:6800
- C:\Windows\System\VZwRIYO.exe
  C:\Windows\System\VZwRIYO.exe
  2⤵
  PID:6816
- C:\Windows\System\pHmTnzd.exe
  C:\Windows\System\pHmTnzd.exe
  2⤵
  PID:6832
- C:\Windows\System\XLyriuE.exe
  C:\Windows\System\XLyriuE.exe
  2⤵
  PID:6848
- C:\Windows\System\dazvIvz.exe
  C:\Windows\System\dazvIvz.exe
  2⤵
  PID:6864
- C:\Windows\System\ketfzbb.exe
  C:\Windows\System\ketfzbb.exe
  2⤵
  PID:6880
- C:\Windows\System\UQYSqCG.exe
  C:\Windows\System\UQYSqCG.exe
  2⤵
  PID:6896
- C:\Windows\System\piMLTrU.exe
  C:\Windows\System\piMLTrU.exe
  2⤵
  PID:6912
- C:\Windows\System\lHvEaIQ.exe
  C:\Windows\System\lHvEaIQ.exe
  2⤵
  PID:6928
- C:\Windows\System\BYxTOpu.exe
  C:\Windows\System\BYxTOpu.exe
  2⤵
  PID:6944
- C:\Windows\System\JsxzNFn.exe
  C:\Windows\System\JsxzNFn.exe
  2⤵
  PID:6960
- C:\Windows\System\JaINnCs.exe
  C:\Windows\System\JaINnCs.exe
  2⤵
  PID:6976
- C:\Windows\System\DZuIdpr.exe
  C:\Windows\System\DZuIdpr.exe
  2⤵
  PID:6992
- C:\Windows\System\eaBbkeU.exe
  C:\Windows\System\eaBbkeU.exe
  2⤵
  PID:7008
- C:\Windows\System\AJxjPth.exe
  C:\Windows\System\AJxjPth.exe
  2⤵
  PID:7024
- C:\Windows\System\aAKUDNM.exe
  C:\Windows\System\aAKUDNM.exe
  2⤵
  PID:7040
- C:\Windows\System\nUoMSsH.exe
  C:\Windows\System\nUoMSsH.exe
  2⤵
  PID:7056
- C:\Windows\System\MFJXDJn.exe
  C:\Windows\System\MFJXDJn.exe
  2⤵
  PID:7072
- C:\Windows\System\pepHSxi.exe
  C:\Windows\System\pepHSxi.exe
  2⤵
  PID:7088
- C:\Windows\System\DgADtgk.exe
  C:\Windows\System\DgADtgk.exe
  2⤵
  PID:7104
- C:\Windows\System\oyPjZEM.exe
  C:\Windows\System\oyPjZEM.exe
  2⤵
  PID:7120
- C:\Windows\System\XTeyphe.exe
  C:\Windows\System\XTeyphe.exe
  2⤵
  PID:7136
- C:\Windows\System\sgoPVfi.exe
  C:\Windows\System\sgoPVfi.exe
  2⤵
  PID:7152
- C:\Windows\System\AvxJnJA.exe
  C:\Windows\System\AvxJnJA.exe
  2⤵
  PID:6072
- C:\Windows\System\wHXOMNN.exe
  C:\Windows\System\wHXOMNN.exe
  2⤵
  PID:5688
- C:\Windows\System\IvDlwwF.exe
  C:\Windows\System\IvDlwwF.exe
  2⤵
  PID:6204
- C:\Windows\System\XbWBgDq.exe
  C:\Windows\System\XbWBgDq.exe
  2⤵
  PID:6268
- C:\Windows\System\NfHhyVS.exe
  C:\Windows\System\NfHhyVS.exe
  2⤵
  PID:4480
- C:\Windows\System\xlHVKyu.exe
  C:\Windows\System\xlHVKyu.exe
  2⤵
  PID:6220
- C:\Windows\System\WtLAoVf.exe
  C:\Windows\System\WtLAoVf.exe
  2⤵
  PID:5764
- C:\Windows\System\hBktLvg.exe
  C:\Windows\System\hBktLvg.exe
  2⤵
  PID:6252
- C:\Windows\System\SDwjehw.exe
  C:\Windows\System\SDwjehw.exe
  2⤵
  PID:6156
- C:\Windows\System\GXxsKIo.exe
  C:\Windows\System\GXxsKIo.exe
  2⤵
  PID:6316
- C:\Windows\System\XNXKfck.exe
  C:\Windows\System\XNXKfck.exe
  2⤵
  PID:6380
- C:\Windows\System\GUclUsx.exe
  C:\Windows\System\GUclUsx.exe
  2⤵
  PID:6444
- C:\Windows\System\wELgnXj.exe
  C:\Windows\System\wELgnXj.exe
  2⤵
  PID:6508
- C:\Windows\System\nMzAAFp.exe
  C:\Windows\System\nMzAAFp.exe
  2⤵
  PID:6572
- C:\Windows\System\vqQdvcd.exe
  C:\Windows\System\vqQdvcd.exe
  2⤵
  PID:6300
- C:\Windows\System\ihvyzVP.exe
  C:\Windows\System\ihvyzVP.exe
  2⤵
  PID:6396
- C:\Windows\System\YJFffWn.exe
  C:\Windows\System\YJFffWn.exe
  2⤵
  PID:6460
- C:\Windows\System\cEvGzKY.exe
  C:\Windows\System\cEvGzKY.exe
  2⤵
  PID:6524
- C:\Windows\System\GcgTUks.exe
  C:\Windows\System\GcgTUks.exe
  2⤵
  PID:6588
- C:\Windows\System\lJJTfCT.exe
  C:\Windows\System\lJJTfCT.exe
  2⤵
  PID:6636
- C:\Windows\System\qFZOCqH.exe
  C:\Windows\System\qFZOCqH.exe
  2⤵
  PID:6668
- C:\Windows\System\PrxDUCS.exe
  C:\Windows\System\PrxDUCS.exe
  2⤵
  PID:6732
- C:\Windows\System\aamxfEj.exe
  C:\Windows\System\aamxfEj.exe
  2⤵
  PID:6684
- C:\Windows\System\FxhEuuG.exe
  C:\Windows\System\FxhEuuG.exe
  2⤵
  PID:1624
- C:\Windows\System\LHPWJce.exe
  C:\Windows\System\LHPWJce.exe
  2⤵
  PID:6796
- C:\Windows\System\pxPdUkG.exe
  C:\Windows\System\pxPdUkG.exe
  2⤵
  PID:6780
- C:\Windows\System\ayrxpwp.exe
  C:\Windows\System\ayrxpwp.exe
  2⤵
  PID:6808
- C:\Windows\System\dEegQAd.exe
  C:\Windows\System\dEegQAd.exe
  2⤵
  PID:6872
- C:\Windows\System\MDfGjIp.exe
  C:\Windows\System\MDfGjIp.exe
  2⤵
  PID:6924
- C:\Windows\System\xycLPBz.exe
  C:\Windows\System\xycLPBz.exe
  2⤵
  PID:6988
- C:\Windows\System\CTNOseW.exe
  C:\Windows\System\CTNOseW.exe
  2⤵
  PID:7080
- C:\Windows\System\NlOIAAe.exe
  C:\Windows\System\NlOIAAe.exe
  2⤵
  PID:7116
- C:\Windows\System\keCfJRo.exe
  C:\Windows\System\keCfJRo.exe
  2⤵
  PID:6132
- C:\Windows\System\PFctiES.exe
  C:\Windows\System\PFctiES.exe
  2⤵
  PID:6904
- C:\Windows\System\aiagVXG.exe
  C:\Windows\System\aiagVXG.exe
  2⤵
  PID:6188
- C:\Windows\System\xiklCTg.exe
  C:\Windows\System\xiklCTg.exe
  2⤵
  PID:6940
- C:\Windows\System\YolpNFt.exe
  C:\Windows\System\YolpNFt.exe
  2⤵
  PID:6568
- C:\Windows\System\bQxdlPA.exe
  C:\Windows\System\bQxdlPA.exe
  2⤵
  PID:6968
- C:\Windows\System\XNPwOzM.exe
  C:\Windows\System\XNPwOzM.exe
  2⤵
  PID:7032
- C:\Windows\System\TxfXpdV.exe
  C:\Windows\System\TxfXpdV.exe
  2⤵
  PID:7096
- C:\Windows\System\Youpbcs.exe
  C:\Windows\System\Youpbcs.exe
  2⤵
  PID:7132
- C:\Windows\System\Tzliyhh.exe
  C:\Windows\System\Tzliyhh.exe
  2⤵
  PID:5444
- C:\Windows\System\hHEpPVk.exe
  C:\Windows\System\hHEpPVk.exe
  2⤵
  PID:6376
- C:\Windows\System\QRfrDMC.exe
  C:\Windows\System\QRfrDMC.exe
  2⤵
  PID:6604
- C:\Windows\System\OfJzPrL.exe
  C:\Windows\System\OfJzPrL.exe
  2⤵
  PID:6492
- C:\Windows\System\BPpghRd.exe
  C:\Windows\System\BPpghRd.exe
  2⤵
  PID:6728
- C:\Windows\System\hNHGntY.exe
  C:\Windows\System\hNHGntY.exe
  2⤵
  PID:6828
- C:\Windows\System\iaPajTV.exe
  C:\Windows\System\iaPajTV.exe
  2⤵
  PID:6840
- C:\Windows\System\NRPrcJJ.exe
  C:\Windows\System\NRPrcJJ.exe
  2⤵
  PID:6984
- C:\Windows\System\OPqcGhX.exe
  C:\Windows\System\OPqcGhX.exe
  2⤵
  PID:2500
- C:\Windows\System\HlhAmfA.exe
  C:\Windows\System\HlhAmfA.exe
  2⤵
  PID:6936
- C:\Windows\System\EFpicQo.exe
  C:\Windows\System\EFpicQo.exe
  2⤵
  PID:2380
- C:\Windows\System\gGgybwc.exe
  C:\Windows\System\gGgybwc.exe
  2⤵
  PID:6652
- C:\Windows\System\zSXgpTg.exe
  C:\Windows\System\zSXgpTg.exe
  2⤵
  PID:6860
- C:\Windows\System\AcnVAJm.exe
  C:\Windows\System\AcnVAJm.exe
  2⤵
  PID:7052
- C:\Windows\System\TgvercS.exe
  C:\Windows\System\TgvercS.exe
  2⤵
  PID:6248
- C:\Windows\System\fHnFGQI.exe
  C:\Windows\System\fHnFGQI.exe
  2⤵
  PID:7004
- C:\Windows\System\WJBTycF.exe
  C:\Windows\System\WJBTycF.exe
  2⤵
  PID:6216
- C:\Windows\System\nEyEGGz.exe
  C:\Windows\System\nEyEGGz.exe
  2⤵
  PID:6360
- C:\Windows\System\jUWSFrw.exe
  C:\Windows\System\jUWSFrw.exe
  2⤵
  PID:6476
- C:\Windows\System\OCxgISp.exe
  C:\Windows\System\OCxgISp.exe
  2⤵
  PID:6456
- C:\Windows\System\FUYpUWp.exe
  C:\Windows\System\FUYpUWp.exe
  2⤵
  PID:7068
- C:\Windows\System\GrPmkeY.exe
  C:\Windows\System\GrPmkeY.exe
  2⤵
  PID:6956
- C:\Windows\System\HtqrgtA.exe
  C:\Windows\System\HtqrgtA.exe
  2⤵
  PID:6888
- C:\Windows\System\XzLQHCZ.exe
  C:\Windows\System\XzLQHCZ.exe
  2⤵
  PID:7048
- C:\Windows\System\cHyyTcZ.exe
  C:\Windows\System\cHyyTcZ.exe
  2⤵
  PID:6712
- C:\Windows\System\RsHqfAr.exe
  C:\Windows\System\RsHqfAr.exe
  2⤵
  PID:6152
- C:\Windows\System\QBupOBG.exe
  C:\Windows\System\QBupOBG.exe
  2⤵
  PID:6748
- C:\Windows\System\OFmNgQt.exe
  C:\Windows\System\OFmNgQt.exe
  2⤵
  PID:5380
- C:\Windows\System\burvVBT.exe
  C:\Windows\System\burvVBT.exe
  2⤵
  PID:6920
- C:\Windows\System\RBnvgnE.exe
  C:\Windows\System\RBnvgnE.exe
  2⤵
  PID:6556
- C:\Windows\System\BKHKkfn.exe
  C:\Windows\System\BKHKkfn.exe
  2⤵
  PID:7176
- C:\Windows\System\mBmTkpO.exe
  C:\Windows\System\mBmTkpO.exe
  2⤵
  PID:7192
- C:\Windows\System\RVPpTPs.exe
  C:\Windows\System\RVPpTPs.exe
  2⤵
  PID:7212
- C:\Windows\System\DcDyQiH.exe
  C:\Windows\System\DcDyQiH.exe
  2⤵
  PID:7228
- C:\Windows\System\VOUBuhZ.exe
  C:\Windows\System\VOUBuhZ.exe
  2⤵
  PID:7244
- C:\Windows\System\eGECkfB.exe
  C:\Windows\System\eGECkfB.exe
  2⤵
  PID:7260
- C:\Windows\System\LlIEXQv.exe
  C:\Windows\System\LlIEXQv.exe
  2⤵
  PID:7276
- C:\Windows\System\mWPdGck.exe
  C:\Windows\System\mWPdGck.exe
  2⤵
  PID:7292
- C:\Windows\System\hfjXazr.exe
  C:\Windows\System\hfjXazr.exe
  2⤵
  PID:7308
- C:\Windows\System\vdYFLGP.exe
  C:\Windows\System\vdYFLGP.exe
  2⤵
  PID:7324
- C:\Windows\System\xNXcThW.exe
  C:\Windows\System\xNXcThW.exe
  2⤵
  PID:7340
- C:\Windows\System\MjyywFd.exe
  C:\Windows\System\MjyywFd.exe
  2⤵
  PID:7356
- C:\Windows\System\jXSjdnK.exe
  C:\Windows\System\jXSjdnK.exe
  2⤵
  PID:7372
- C:\Windows\System\qRQgEeg.exe
  C:\Windows\System\qRQgEeg.exe
  2⤵
  PID:7388
- C:\Windows\System\tMLJIbZ.exe
  C:\Windows\System\tMLJIbZ.exe
  2⤵
  PID:7404
- C:\Windows\System\owfrHvB.exe
  C:\Windows\System\owfrHvB.exe
  2⤵
  PID:7420
- C:\Windows\System\ntASzrq.exe
  C:\Windows\System\ntASzrq.exe
  2⤵
  PID:7436
- C:\Windows\System\wFrytgy.exe
  C:\Windows\System\wFrytgy.exe
  2⤵
  PID:7452
- C:\Windows\System\KiQpDZl.exe
  C:\Windows\System\KiQpDZl.exe
  2⤵
  PID:7468
- C:\Windows\System\HCofKqq.exe
  C:\Windows\System\HCofKqq.exe
  2⤵
  PID:7484
- C:\Windows\System\PYqzVNn.exe
  C:\Windows\System\PYqzVNn.exe
  2⤵
  PID:7500
- C:\Windows\System\friSmhR.exe
  C:\Windows\System\friSmhR.exe
  2⤵
  PID:7516
- C:\Windows\System\KDPxYGP.exe
  C:\Windows\System\KDPxYGP.exe
  2⤵
  PID:7532
- C:\Windows\System\jozTpOB.exe
  C:\Windows\System\jozTpOB.exe
  2⤵
  PID:7548
- C:\Windows\System\uyVMpzN.exe
  C:\Windows\System\uyVMpzN.exe
  2⤵
  PID:7564
- C:\Windows\System\BHdHgNk.exe
  C:\Windows\System\BHdHgNk.exe
  2⤵
  PID:7580
- C:\Windows\System\uKNQtap.exe
  C:\Windows\System\uKNQtap.exe
  2⤵
  PID:7596
- C:\Windows\System\mVTAcuI.exe
  C:\Windows\System\mVTAcuI.exe
  2⤵
  PID:7612
- C:\Windows\System\FxdCrov.exe
  C:\Windows\System\FxdCrov.exe
  2⤵
  PID:7628
- C:\Windows\System\CTLWtCK.exe
  C:\Windows\System\CTLWtCK.exe
  2⤵
  PID:7644
- C:\Windows\System\vDKxXQf.exe
  C:\Windows\System\vDKxXQf.exe
  2⤵
  PID:7660
- C:\Windows\System\XsCzghx.exe
  C:\Windows\System\XsCzghx.exe
  2⤵
  PID:7676
- C:\Windows\System\SgoHPIH.exe
  C:\Windows\System\SgoHPIH.exe
  2⤵
  PID:7692
- C:\Windows\System\cZbkDEV.exe
  C:\Windows\System\cZbkDEV.exe
  2⤵
  PID:7708
- C:\Windows\System\vtPPYiq.exe
  C:\Windows\System\vtPPYiq.exe
  2⤵
  PID:7724
- C:\Windows\System\DmUKOAQ.exe
  C:\Windows\System\DmUKOAQ.exe
  2⤵
  PID:7740
- C:\Windows\System\nqinlsr.exe
  C:\Windows\System\nqinlsr.exe
  2⤵
  PID:7756
- C:\Windows\System\fPYPtaM.exe
  C:\Windows\System\fPYPtaM.exe
  2⤵
  PID:7772
- C:\Windows\System\BKNsecD.exe
  C:\Windows\System\BKNsecD.exe
  2⤵
  PID:7788
- C:\Windows\System\yGTzlLZ.exe
  C:\Windows\System\yGTzlLZ.exe
  2⤵
  PID:7804
- C:\Windows\System\aEfkBCO.exe
  C:\Windows\System\aEfkBCO.exe
  2⤵
  PID:7820
- C:\Windows\System\jRPzAmr.exe
  C:\Windows\System\jRPzAmr.exe
  2⤵
  PID:7836
- C:\Windows\System\GTQEuXR.exe
  C:\Windows\System\GTQEuXR.exe
  2⤵
  PID:7852
- C:\Windows\System\MaQqSaY.exe
  C:\Windows\System\MaQqSaY.exe
  2⤵
  PID:7868
- C:\Windows\System\FfcTaTY.exe
  C:\Windows\System\FfcTaTY.exe
  2⤵
  PID:7884
- C:\Windows\System\ldvIzoW.exe
  C:\Windows\System\ldvIzoW.exe
  2⤵
  PID:7900
- C:\Windows\System\fkVcAah.exe
  C:\Windows\System\fkVcAah.exe
  2⤵
  PID:7916
- C:\Windows\System\PJHLRMj.exe
  C:\Windows\System\PJHLRMj.exe
  2⤵
  PID:7932
- C:\Windows\System\dagOANV.exe
  C:\Windows\System\dagOANV.exe
  2⤵
  PID:7948
- C:\Windows\System\YJyRfok.exe
  C:\Windows\System\YJyRfok.exe
  2⤵
  PID:7964
- C:\Windows\System\wTzHSJy.exe
  C:\Windows\System\wTzHSJy.exe
  2⤵
  PID:7980
- C:\Windows\System\lXinJhg.exe
  C:\Windows\System\lXinJhg.exe
  2⤵
  PID:7996
- C:\Windows\System\ebhZXYy.exe
  C:\Windows\System\ebhZXYy.exe
  2⤵
  PID:8012
- C:\Windows\System\cwCXPtE.exe
  C:\Windows\System\cwCXPtE.exe
  2⤵
  PID:8028
- C:\Windows\System\isuqSLN.exe
  C:\Windows\System\isuqSLN.exe
  2⤵
  PID:8044
- C:\Windows\System\VlKRVcR.exe
  C:\Windows\System\VlKRVcR.exe
  2⤵
  PID:8060
- C:\Windows\System\RSxjIBM.exe
  C:\Windows\System\RSxjIBM.exe
  2⤵
  PID:8076
- C:\Windows\System\utTRpov.exe
  C:\Windows\System\utTRpov.exe
  2⤵
  PID:8092
- C:\Windows\System\LzkXPdD.exe
  C:\Windows\System\LzkXPdD.exe
  2⤵
  PID:8108
- C:\Windows\System\BRqRjOE.exe
  C:\Windows\System\BRqRjOE.exe
  2⤵
  PID:8124
- C:\Windows\System\nJbASBb.exe
  C:\Windows\System\nJbASBb.exe
  2⤵
  PID:8140
- C:\Windows\System\pkMCOmq.exe
  C:\Windows\System\pkMCOmq.exe
  2⤵
  PID:8156
- C:\Windows\System\GetJuck.exe
  C:\Windows\System\GetJuck.exe
  2⤵
  PID:8172
- C:\Windows\System\oeCaUCU.exe
  C:\Windows\System\oeCaUCU.exe
  2⤵
  PID:8188
- C:\Windows\System\HTCJSgo.exe
  C:\Windows\System\HTCJSgo.exe
  2⤵
  PID:7200
- C:\Windows\System\mtVyimv.exe
  C:\Windows\System\mtVyimv.exe
  2⤵
  PID:7184
- C:\Windows\System\CbljvNS.exe
  C:\Windows\System\CbljvNS.exe
  2⤵
  PID:7240
- C:\Windows\System\XqKYZPI.exe
  C:\Windows\System\XqKYZPI.exe
  2⤵
  PID:7252
- C:\Windows\System\xOZwtBi.exe
  C:\Windows\System\xOZwtBi.exe
  2⤵
  PID:7304
- C:\Windows\System\HwNlCJM.exe
  C:\Windows\System\HwNlCJM.exe
  2⤵
  PID:7368
- C:\Windows\System\HPfotus.exe
  C:\Windows\System\HPfotus.exe
  2⤵
  PID:7432
- C:\Windows\System\BMEIYjb.exe
  C:\Windows\System\BMEIYjb.exe
  2⤵
  PID:7460
- C:\Windows\System\rRKxqvQ.exe
  C:\Windows\System\rRKxqvQ.exe
  2⤵
  PID:7316
- C:\Windows\System\PDdSOKG.exe
  C:\Windows\System\PDdSOKG.exe
  2⤵
  PID:7412
- C:\Windows\System\wrQDszP.exe
  C:\Windows\System\wrQDszP.exe
  2⤵
  PID:7448
- C:\Windows\System\hiXjkfA.exe
  C:\Windows\System\hiXjkfA.exe
  2⤵
  PID:7528
- C:\Windows\System\uahWqss.exe
  C:\Windows\System\uahWqss.exe
  2⤵
  PID:7560
- C:\Windows\System\NkkTjXP.exe
  C:\Windows\System\NkkTjXP.exe
  2⤵
  PID:7544
- C:\Windows\System\DQiHiIo.exe
  C:\Windows\System\DQiHiIo.exe
  2⤵
  PID:7624
- C:\Windows\System\nYmsiCy.exe
  C:\Windows\System\nYmsiCy.exe
  2⤵
  PID:7636
- C:\Windows\System\QqHJoIr.exe
  C:\Windows\System\QqHJoIr.exe
  2⤵
  PID:7716
- C:\Windows\System\updCUzC.exe
  C:\Windows\System\updCUzC.exe
  2⤵
  PID:7748
- C:\Windows\System\NIdidoO.exe
  C:\Windows\System\NIdidoO.exe
  2⤵
  PID:7704
- C:\Windows\System\aZJirWs.exe
  C:\Windows\System\aZJirWs.exe
  2⤵
  PID:7780
- C:\Windows\System\qHQlELY.exe
  C:\Windows\System\qHQlELY.exe
  2⤵
  PID:7768
- C:\Windows\System\EXJTZIz.exe
  C:\Windows\System\EXJTZIz.exe
  2⤵
  PID:7800
- C:\Windows\System\YKktrAI.exe
  C:\Windows\System\YKktrAI.exe
  2⤵
  PID:5332
- C:\Windows\System\dQTopaf.exe
  C:\Windows\System\dQTopaf.exe
  2⤵
  PID:7896
- C:\Windows\System\ZvfFTVW.exe
  C:\Windows\System\ZvfFTVW.exe
  2⤵
  PID:7928
- C:\Windows\System\DadiCgb.exe
  C:\Windows\System\DadiCgb.exe
  2⤵
  PID:7908
- C:\Windows\System\MwFzxjW.exe
  C:\Windows\System\MwFzxjW.exe
  2⤵
  PID:8004
- C:\Windows\System\xUAxwHr.exe
  C:\Windows\System\xUAxwHr.exe
  2⤵
  PID:8040
- C:\Windows\System\WeffyxR.exe
  C:\Windows\System\WeffyxR.exe
  2⤵
  PID:8100
- C:\Windows\System\ORVsOhM.exe
  C:\Windows\System\ORVsOhM.exe
  2⤵
  PID:8020
- C:\Windows\System\kUpoQBG.exe
  C:\Windows\System\kUpoQBG.exe
  2⤵
  PID:8084
- C:\Windows\System\DIzNFMV.exe
  C:\Windows\System\DIzNFMV.exe
  2⤵
  PID:8116
- C:\Windows\System\wrdEBAW.exe
  C:\Windows\System\wrdEBAW.exe
  2⤵
  PID:8152
- C:\Windows\System\owkXtFm.exe
  C:\Windows\System\owkXtFm.exe
  2⤵
  PID:2512
- C:\Windows\System\KIlBfUp.exe
  C:\Windows\System\KIlBfUp.exe
  2⤵
  PID:7300
- C:\Windows\System\kIvYBqm.exe
  C:\Windows\System\kIvYBqm.exe
  2⤵
  PID:2948
- C:\Windows\System\jRmCiIf.exe
  C:\Windows\System\jRmCiIf.exe
  2⤵
  PID:7444
- C:\Windows\System\zvOsoDa.exe
  C:\Windows\System\zvOsoDa.exe
  2⤵
  PID:7620
- C:\Windows\System\BTuMBHI.exe
  C:\Windows\System\BTuMBHI.exe
  2⤵
  PID:7700
- C:\Windows\System\QNUsWZi.exe
  C:\Windows\System\QNUsWZi.exe
  2⤵
  PID:4960
- C:\Windows\System\dyqmTns.exe
  C:\Windows\System\dyqmTns.exe
  2⤵
  PID:7972
- C:\Windows\System\pkJqKkk.exe
  C:\Windows\System\pkJqKkk.exe
  2⤵
  PID:8052
- C:\Windows\System\gKeePQU.exe
  C:\Windows\System\gKeePQU.exe
  2⤵
  PID:8148
- C:\Windows\System\gnPproW.exe
  C:\Windows\System\gnPproW.exe
  2⤵
  PID:7496
- C:\Windows\System\ecnzWyI.exe
  C:\Windows\System\ecnzWyI.exe
  2⤵
  PID:7672
- C:\Windows\System\SVGQcmq.exe
  C:\Windows\System\SVGQcmq.exe
  2⤵
  PID:7668
- C:\Windows\System\AAymiFi.exe
  C:\Windows\System\AAymiFi.exe
  2⤵
  PID:7796
- C:\Windows\System\qMYMygI.exe
  C:\Windows\System\qMYMygI.exe
  2⤵
  PID:8036
- C:\Windows\System\dNBXKgp.exe
  C:\Windows\System\dNBXKgp.exe
  2⤵
  PID:7556
- C:\Windows\System\BQHRATY.exe
  C:\Windows\System\BQHRATY.exe
  2⤵
  PID:7592
- C:\Windows\System\JkLIYVw.exe
  C:\Windows\System\JkLIYVw.exe
  2⤵
  PID:6540
- C:\Windows\System\FfnqFyj.exe
  C:\Windows\System\FfnqFyj.exe
  2⤵
  PID:8136
- C:\Windows\System\lteiEpf.exe
  C:\Windows\System\lteiEpf.exe
  2⤵
  PID:7892
- C:\Windows\System\JqaDSrl.exe
  C:\Windows\System\JqaDSrl.exe
  2⤵
  PID:8164
- C:\Windows\System\sqKLDxG.exe
  C:\Windows\System\sqKLDxG.exe
  2⤵
  PID:7428
- C:\Windows\System\ZerEIWh.exe
  C:\Windows\System\ZerEIWh.exe
  2⤵
  PID:7384
- C:\Windows\System\enTtgYi.exe
  C:\Windows\System\enTtgYi.exe
  2⤵
  PID:7352
- C:\Windows\System\OGESKCM.exe
  C:\Windows\System\OGESKCM.exe
  2⤵
  PID:7336
- C:\Windows\System\sTCcLcu.exe
  C:\Windows\System\sTCcLcu.exe
  2⤵
  PID:7848
- C:\Windows\System\viRcfme.exe
  C:\Windows\System\viRcfme.exe
  2⤵
  PID:7540
- C:\Windows\System\GjuvlUC.exe
  C:\Windows\System\GjuvlUC.exe
  2⤵
  PID:7380
- C:\Windows\System\rjSxNqZ.exe
  C:\Windows\System\rjSxNqZ.exe
  2⤵
  PID:7988
- C:\Windows\System\pQFlKnc.exe
  C:\Windows\System\pQFlKnc.exe
  2⤵
  PID:8168
- C:\Windows\System\FmlXSwE.exe
  C:\Windows\System\FmlXSwE.exe
  2⤵
  PID:7400
- C:\Windows\System\YIFwFEW.exe
  C:\Windows\System\YIFwFEW.exe
  2⤵
  PID:7224
- C:\Windows\System\jKugqiH.exe
  C:\Windows\System\jKugqiH.exe
  2⤵
  PID:2696
- C:\Windows\System\DmDtBQC.exe
  C:\Windows\System\DmDtBQC.exe
  2⤵
  PID:8208
- C:\Windows\System\NUOTnGC.exe
  C:\Windows\System\NUOTnGC.exe
  2⤵
  PID:8224
- C:\Windows\System\dAwnMJe.exe
  C:\Windows\System\dAwnMJe.exe
  2⤵
  PID:8240
- C:\Windows\System\zCltxBR.exe
  C:\Windows\System\zCltxBR.exe
  2⤵
  PID:8256
- C:\Windows\System\czfDhNZ.exe
  C:\Windows\System\czfDhNZ.exe
  2⤵
  PID:8272
- C:\Windows\System\tYaOsXZ.exe
  C:\Windows\System\tYaOsXZ.exe
  2⤵
  PID:8288
- C:\Windows\System\PvNIPhz.exe
  C:\Windows\System\PvNIPhz.exe
  2⤵
  PID:8308
- C:\Windows\System\nGwucaB.exe
  C:\Windows\System\nGwucaB.exe
  2⤵
  PID:8324
- C:\Windows\System\exzvFPQ.exe
  C:\Windows\System\exzvFPQ.exe
  2⤵
  PID:8340
- C:\Windows\System\QVgtScF.exe
  C:\Windows\System\QVgtScF.exe
  2⤵
  PID:8356
- C:\Windows\System\ZkGgpdq.exe
  C:\Windows\System\ZkGgpdq.exe
  2⤵
  PID:8372
- C:\Windows\System\ngGrmuL.exe
  C:\Windows\System\ngGrmuL.exe
  2⤵
  PID:8388
- C:\Windows\System\XNAvDda.exe
  C:\Windows\System\XNAvDda.exe
  2⤵
  PID:8404
- C:\Windows\System\LiStQhX.exe
  C:\Windows\System\LiStQhX.exe
  2⤵
  PID:8420
- C:\Windows\System\YLJlGea.exe
  C:\Windows\System\YLJlGea.exe
  2⤵
  PID:8436
- C:\Windows\System\IsohWXK.exe
  C:\Windows\System\IsohWXK.exe
  2⤵
  PID:8452
- C:\Windows\System\jBVMlxB.exe
  C:\Windows\System\jBVMlxB.exe
  2⤵
  PID:8468
- C:\Windows\System\sYFCJQY.exe
  C:\Windows\System\sYFCJQY.exe
  2⤵
  PID:8484
- C:\Windows\System\SofeWEt.exe
  C:\Windows\System\SofeWEt.exe
  2⤵
  PID:8500
- C:\Windows\System\sjvZpQT.exe
  C:\Windows\System\sjvZpQT.exe
  2⤵
  PID:8516
- C:\Windows\System\OLeNtWI.exe
  C:\Windows\System\OLeNtWI.exe
  2⤵
  PID:8532
- C:\Windows\System\zFJUQCW.exe
  C:\Windows\System\zFJUQCW.exe
  2⤵
  PID:8548
- C:\Windows\System\cpcfKMw.exe
  C:\Windows\System\cpcfKMw.exe
  2⤵
  PID:8564
- C:\Windows\System\pkTUmEi.exe
  C:\Windows\System\pkTUmEi.exe
  2⤵
  PID:8580
- C:\Windows\System\oOsvJdo.exe
  C:\Windows\System\oOsvJdo.exe
  2⤵
  PID:8596
- C:\Windows\System\rLBnUus.exe
  C:\Windows\System\rLBnUus.exe
  2⤵
  PID:8612
- C:\Windows\System\LtHXJaj.exe
  C:\Windows\System\LtHXJaj.exe
  2⤵
  PID:8628
- C:\Windows\System\yUHbfGT.exe
  C:\Windows\System\yUHbfGT.exe
  2⤵
  PID:8644
- C:\Windows\System\NfGucSo.exe
  C:\Windows\System\NfGucSo.exe
  2⤵
  PID:8660
- C:\Windows\System\zntSIKs.exe
  C:\Windows\System\zntSIKs.exe
  2⤵
  PID:8676
- C:\Windows\System\MGmmsbU.exe
  C:\Windows\System\MGmmsbU.exe
  2⤵
  PID:8692
- C:\Windows\System\yNgxnyL.exe
  C:\Windows\System\yNgxnyL.exe
  2⤵
  PID:8708
- C:\Windows\System\oGekjol.exe
  C:\Windows\System\oGekjol.exe
  2⤵
  PID:8724
- C:\Windows\System\zraECGZ.exe
  C:\Windows\System\zraECGZ.exe
  2⤵
  PID:8740
- C:\Windows\System\MfYwqxf.exe
  C:\Windows\System\MfYwqxf.exe
  2⤵
  PID:8756
- C:\Windows\System\qncLfbK.exe
  C:\Windows\System\qncLfbK.exe
  2⤵
  PID:8772
- C:\Windows\System\nLVXyGt.exe
  C:\Windows\System\nLVXyGt.exe
  2⤵
  PID:8788
- C:\Windows\System\uivvZzK.exe
  C:\Windows\System\uivvZzK.exe
  2⤵
  PID:8804
- C:\Windows\System\LUAuqOo.exe
  C:\Windows\System\LUAuqOo.exe
  2⤵
  PID:8820
- C:\Windows\System\rBxsDGl.exe
  C:\Windows\System\rBxsDGl.exe
  2⤵
  PID:8836
- C:\Windows\System\BekwxrU.exe
  C:\Windows\System\BekwxrU.exe
  2⤵
  PID:8852
- C:\Windows\System\fMCpUMN.exe
  C:\Windows\System\fMCpUMN.exe
  2⤵
  PID:8868
- C:\Windows\System\bSYbgBs.exe
  C:\Windows\System\bSYbgBs.exe
  2⤵
  PID:8884
- C:\Windows\System\ABRcxrz.exe
  C:\Windows\System\ABRcxrz.exe
  2⤵
  PID:8900
- C:\Windows\System\KXocyYe.exe
  C:\Windows\System\KXocyYe.exe
  2⤵
  PID:8972
- C:\Windows\System\uGbDZTF.exe
  C:\Windows\System\uGbDZTF.exe
  2⤵
  PID:9004
- C:\Windows\System\EkBecNz.exe
  C:\Windows\System\EkBecNz.exe
  2⤵
  PID:9024
- C:\Windows\System\ctxPDTY.exe
  C:\Windows\System\ctxPDTY.exe
  2⤵
  PID:9040
- C:\Windows\System\wCIrKXX.exe
  C:\Windows\System\wCIrKXX.exe
  2⤵
  PID:9056
- C:\Windows\System\cuvHBFw.exe
  C:\Windows\System\cuvHBFw.exe
  2⤵
  PID:9072
- C:\Windows\System\pYIfHTg.exe
  C:\Windows\System\pYIfHTg.exe
  2⤵
  PID:9096
- C:\Windows\System\dMKvqjI.exe
  C:\Windows\System\dMKvqjI.exe
  2⤵
  PID:9112
- C:\Windows\System\uGjyWnR.exe
  C:\Windows\System\uGjyWnR.exe
  2⤵
  PID:9128
- C:\Windows\System\OZFtaIV.exe
  C:\Windows\System\OZFtaIV.exe
  2⤵
  PID:9144
- C:\Windows\System\WYooZFt.exe
  C:\Windows\System\WYooZFt.exe
  2⤵
  PID:9160
- C:\Windows\System\jszdhIM.exe
  C:\Windows\System\jszdhIM.exe
  2⤵
  PID:9176
- C:\Windows\System\MHQHHus.exe
  C:\Windows\System\MHQHHus.exe
  2⤵
  PID:9192
- C:\Windows\System\sfkZAQR.exe
  C:\Windows\System\sfkZAQR.exe
  2⤵
  PID:9208
- C:\Windows\System\ezvkKju.exe
  C:\Windows\System\ezvkKju.exe
  2⤵
  PID:7876
- C:\Windows\System\fmMFkEK.exe
  C:\Windows\System\fmMFkEK.exe
  2⤵
  PID:8236
- C:\Windows\System\xAedpeM.exe
  C:\Windows\System\xAedpeM.exe
  2⤵
  PID:8216
- C:\Windows\System\GsCAXKD.exe
  C:\Windows\System\GsCAXKD.exe
  2⤵
  PID:8280
- C:\Windows\System\rJntECj.exe
  C:\Windows\System\rJntECj.exe
  2⤵
  PID:8336
- C:\Windows\System\gOsZQnA.exe
  C:\Windows\System\gOsZQnA.exe
  2⤵
  PID:8352
- C:\Windows\System\GtkBPdP.exe
  C:\Windows\System\GtkBPdP.exe
  2⤵
  PID:8400
- C:\Windows\System\WnkDemW.exe
  C:\Windows\System\WnkDemW.exe
  2⤵
  PID:8464
- C:\Windows\System\fFZIFqW.exe
  C:\Windows\System\fFZIFqW.exe
  2⤵
  PID:8380
- C:\Windows\System\BsJaYIQ.exe
  C:\Windows\System\BsJaYIQ.exe
  2⤵
  PID:8448
- C:\Windows\System\SuFmUAS.exe
  C:\Windows\System\SuFmUAS.exe
  2⤵
  PID:8496
- C:\Windows\System\yDOPesf.exe
  C:\Windows\System\yDOPesf.exe
  2⤵
  PID:8560
- C:\Windows\System\KewUUKc.exe
  C:\Windows\System\KewUUKc.exe
  2⤵
  PID:8572
- C:\Windows\System\YtIWEaf.exe
  C:\Windows\System\YtIWEaf.exe
  2⤵
  PID:8576
- C:\Windows\System\HLHRbNU.exe
  C:\Windows\System\HLHRbNU.exe
  2⤵
  PID:8624
- C:\Windows\System\tQpEHjb.exe
  C:\Windows\System\tQpEHjb.exe
  2⤵
  PID:8656
- C:\Windows\System\tocFjDf.exe
  C:\Windows\System\tocFjDf.exe
  2⤵
  PID:8688
- C:\Windows\System\XgBElIx.exe
  C:\Windows\System\XgBElIx.exe
  2⤵
  PID:8704
- C:\Windows\System\PtKGinM.exe
  C:\Windows\System\PtKGinM.exe
  2⤵
  PID:8784
- C:\Windows\System\rXzEktL.exe
  C:\Windows\System\rXzEktL.exe
  2⤵
  PID:8848
- C:\Windows\System\mkYmwOP.exe
  C:\Windows\System\mkYmwOP.exe
  2⤵
  PID:8732
- C:\Windows\System\GolnGjJ.exe
  C:\Windows\System\GolnGjJ.exe
  2⤵
  PID:8764
- C:\Windows\System\QvWHdMK.exe
  C:\Windows\System\QvWHdMK.exe
  2⤵
  PID:8832
- C:\Windows\System\UglYEZZ.exe
  C:\Windows\System\UglYEZZ.exe
  2⤵
  PID:8296
- C:\Windows\System\mboSbuq.exe
  C:\Windows\System\mboSbuq.exe
  2⤵
  PID:2880
- C:\Windows\System\rrhRmgw.exe
  C:\Windows\System\rrhRmgw.exe
  2⤵
  PID:9000
- C:\Windows\System\ZyLwhYH.exe
  C:\Windows\System\ZyLwhYH.exe
  2⤵
  PID:9016
- C:\Windows\System\atojeaU.exe
  C:\Windows\System\atojeaU.exe
  2⤵
  PID:9068
- C:\Windows\System\gOijVqQ.exe
  C:\Windows\System\gOijVqQ.exe
  2⤵
  PID:9084
- C:\Windows\System\cfTNZoA.exe
  C:\Windows\System\cfTNZoA.exe
  2⤵
  PID:9120
- C:\Windows\System\HwEBKyk.exe
  C:\Windows\System\HwEBKyk.exe
  2⤵
  PID:9184
- C:\Windows\System\DTOqBsa.exe
  C:\Windows\System\DTOqBsa.exe
  2⤵
  PID:7288
- C:\Windows\System\tGtytbo.exe
  C:\Windows\System\tGtytbo.exe
  2⤵
  PID:8320
- C:\Windows\System\LrlztFI.exe
  C:\Windows\System\LrlztFI.exe
  2⤵
  PID:8480
- C:\Windows\System\gEUPioC.exe
  C:\Windows\System\gEUPioC.exe
  2⤵
  PID:8508
- C:\Windows\System\IAtuKMM.exe
  C:\Windows\System\IAtuKMM.exe
  2⤵
  PID:8672
- C:\Windows\System\rBGFsQD.exe
  C:\Windows\System\rBGFsQD.exe
  2⤵
  PID:9140
- C:\Windows\System\PwxWmGH.exe
  C:\Windows\System\PwxWmGH.exe
  2⤵
  PID:8908
- C:\Windows\System\glfUHvj.exe
  C:\Windows\System\glfUHvj.exe
  2⤵
  PID:8368
- C:\Windows\System\FVpAvUm.exe
  C:\Windows\System\FVpAvUm.exe
  2⤵
  PID:8968
- C:\Windows\System\BCfJcJP.exe
  C:\Windows\System\BCfJcJP.exe
  2⤵
  PID:9048
- C:\Windows\System\bHCOSlQ.exe
  C:\Windows\System\bHCOSlQ.exe
  2⤵
  PID:8992
- C:\Windows\System\hhCISBl.exe
  C:\Windows\System\hhCISBl.exe
  2⤵
  PID:9172
- C:\Windows\System\ttQePVC.exe
  C:\Windows\System\ttQePVC.exe
  2⤵
  PID:8416
- C:\Windows\System\kHnqRsp.exe
  C:\Windows\System\kHnqRsp.exe
  2⤵
  PID:9156
- C:\Windows\System\KsyZGId.exe
  C:\Windows\System\KsyZGId.exe
  2⤵
  PID:8716
- C:\Windows\System\NqRwPQT.exe
  C:\Windows\System\NqRwPQT.exe
  2⤵
  PID:8860
- C:\Windows\System\YikXfmG.exe
  C:\Windows\System\YikXfmG.exe
  2⤵
  PID:9064
- C:\Windows\System\xXDiuxD.exe
  C:\Windows\System\xXDiuxD.exe
  2⤵
  PID:7220
- C:\Windows\System\axjJLdd.exe
  C:\Windows\System\axjJLdd.exe
  2⤵
  PID:8492
- C:\Windows\System\wbzdEgJ.exe
  C:\Windows\System\wbzdEgJ.exe
  2⤵
  PID:8232
- C:\Windows\System\exXiryp.exe
  C:\Windows\System\exXiryp.exe
  2⤵
  PID:8540
- C:\Windows\System\tMZJDYm.exe
  C:\Windows\System\tMZJDYm.exe
  2⤵
  PID:9092
- C:\Windows\System\rhQtAvD.exe
  C:\Windows\System\rhQtAvD.exe
  2⤵
  PID:8252
- C:\Windows\System\yELTYHY.exe
  C:\Windows\System\yELTYHY.exe
  2⤵
  PID:8996
- C:\Windows\System\eCWtGDu.exe
  C:\Windows\System\eCWtGDu.exe
  2⤵
  PID:8880
- C:\Windows\System\yCgXFpY.exe
  C:\Windows\System\yCgXFpY.exe
  2⤵
  PID:8796
- C:\Windows\System\fOeVblQ.exe
  C:\Windows\System\fOeVblQ.exe
  2⤵
  PID:8248
- C:\Windows\System\CIGBslV.exe
  C:\Windows\System\CIGBslV.exe
  2⤵
  PID:9088
- C:\Windows\System\vuxaTfZ.exe
  C:\Windows\System\vuxaTfZ.exe
  2⤵
  PID:8640
- C:\Windows\System\omJcXIq.exe
  C:\Windows\System\omJcXIq.exe
  2⤵
  PID:8780
- C:\Windows\System\oZkMUKd.exe
  C:\Windows\System\oZkMUKd.exe
  2⤵
  PID:9232
- C:\Windows\System\jnNrJNa.exe
  C:\Windows\System\jnNrJNa.exe
  2⤵
  PID:9252
- C:\Windows\System\kNqKBFP.exe
  C:\Windows\System\kNqKBFP.exe
  2⤵
  PID:9268
- C:\Windows\System\yKlwWrl.exe
  C:\Windows\System\yKlwWrl.exe
  2⤵
  PID:9308
- C:\Windows\System\mBtOIcs.exe
  C:\Windows\System\mBtOIcs.exe
  2⤵
  PID:9328
- C:\Windows\System\ZytruCI.exe
  C:\Windows\System\ZytruCI.exe
  2⤵
  PID:9344
- C:\Windows\System\rzdfqRu.exe
  C:\Windows\System\rzdfqRu.exe
  2⤵
  PID:9360
- C:\Windows\System\amZzQNs.exe
  C:\Windows\System\amZzQNs.exe
  2⤵
  PID:9376
- C:\Windows\System\zVAWZwk.exe
  C:\Windows\System\zVAWZwk.exe
  2⤵
  PID:9396
- C:\Windows\System\rwZiBxd.exe
  C:\Windows\System\rwZiBxd.exe
  2⤵
  PID:9412
- C:\Windows\System\tGfsNhQ.exe
  C:\Windows\System\tGfsNhQ.exe
  2⤵
  PID:9432
- C:\Windows\System\YzPBMDN.exe
  C:\Windows\System\YzPBMDN.exe
  2⤵
  PID:9448
- C:\Windows\System\efwAcdp.exe
  C:\Windows\System\efwAcdp.exe
  2⤵
  PID:9464
- C:\Windows\System\cfEjJXO.exe
  C:\Windows\System\cfEjJXO.exe
  2⤵
  PID:9480
- C:\Windows\System\nPXwYUt.exe
  C:\Windows\System\nPXwYUt.exe
  2⤵
  PID:9496
- C:\Windows\System\UwmBNUG.exe
  C:\Windows\System\UwmBNUG.exe
  2⤵
  PID:9512
- C:\Windows\System\JFeYnWd.exe
  C:\Windows\System\JFeYnWd.exe
  2⤵
  PID:9528
- C:\Windows\System\idqHZdp.exe
  C:\Windows\System\idqHZdp.exe
  2⤵
  PID:9544
- C:\Windows\System\SwJgOEm.exe
  C:\Windows\System\SwJgOEm.exe
  2⤵
  PID:9560
- C:\Windows\System\NtLdAUI.exe
  C:\Windows\System\NtLdAUI.exe
  2⤵
  PID:9576
- C:\Windows\System\KwTOScY.exe
  C:\Windows\System\KwTOScY.exe
  2⤵
  PID:9592
- C:\Windows\System\HHrdIMi.exe
  C:\Windows\System\HHrdIMi.exe
  2⤵
  PID:9608
- C:\Windows\System\TpDGTYX.exe
  C:\Windows\System\TpDGTYX.exe
  2⤵
  PID:9624
- C:\Windows\System\PmlErkN.exe
  C:\Windows\System\PmlErkN.exe
  2⤵
  PID:9640
- C:\Windows\System\pDzMhXs.exe
  C:\Windows\System\pDzMhXs.exe
  2⤵
  PID:9656
- C:\Windows\System\jtZneZs.exe
  C:\Windows\System\jtZneZs.exe
  2⤵
  PID:9672
- C:\Windows\System\DIoWcDI.exe
  C:\Windows\System\DIoWcDI.exe
  2⤵
  PID:9692
- C:\Windows\System\fnHOKbK.exe
  C:\Windows\System\fnHOKbK.exe
  2⤵
  PID:9708
- C:\Windows\System\ooulvJv.exe
  C:\Windows\System\ooulvJv.exe
  2⤵
  PID:9724
- C:\Windows\System\YDEeIqW.exe
  C:\Windows\System\YDEeIqW.exe
  2⤵
  PID:9740
- C:\Windows\System\drxReWV.exe
  C:\Windows\System\drxReWV.exe
  2⤵
  PID:9756
- C:\Windows\System\AXTjFqu.exe
  C:\Windows\System\AXTjFqu.exe
  2⤵
  PID:9772
- C:\Windows\System\MpwaisW.exe
  C:\Windows\System\MpwaisW.exe
  2⤵
  PID:9788
- C:\Windows\System\xiLLPge.exe
  C:\Windows\System\xiLLPge.exe
  2⤵
  PID:9804
- C:\Windows\System\aSmCLXC.exe
  C:\Windows\System\aSmCLXC.exe
  2⤵
  PID:9820
- C:\Windows\System\gacMlZt.exe
  C:\Windows\System\gacMlZt.exe
  2⤵
  PID:9836
- C:\Windows\System\ICecHKn.exe
  C:\Windows\System\ICecHKn.exe
  2⤵
  PID:9852
- C:\Windows\System\qDzPfNj.exe
  C:\Windows\System\qDzPfNj.exe
  2⤵
  PID:9868
- C:\Windows\System\mTPFjzm.exe
  C:\Windows\System\mTPFjzm.exe
  2⤵
  PID:9884
- C:\Windows\System\YEVaQXA.exe
  C:\Windows\System\YEVaQXA.exe
  2⤵
  PID:9900
- C:\Windows\System\CxoSdPa.exe
  C:\Windows\System\CxoSdPa.exe
  2⤵
  PID:9916
- C:\Windows\System\HAMmssK.exe
  C:\Windows\System\HAMmssK.exe
  2⤵
  PID:9932
- C:\Windows\System\lMXSwcI.exe
  C:\Windows\System\lMXSwcI.exe
  2⤵
  PID:9948
- C:\Windows\System\jLlVdai.exe
  C:\Windows\System\jLlVdai.exe
  2⤵
  PID:9964
- C:\Windows\System\zMXXfYD.exe
  C:\Windows\System\zMXXfYD.exe
  2⤵
  PID:9980
- C:\Windows\System\foQNtgN.exe
  C:\Windows\System\foQNtgN.exe
  2⤵
  PID:9996
- C:\Windows\System\JjyAQsN.exe
  C:\Windows\System\JjyAQsN.exe
  2⤵
  PID:10012
- C:\Windows\System\PxVYFTQ.exe
  C:\Windows\System\PxVYFTQ.exe
  2⤵
  PID:10028
- C:\Windows\System\mSRdxWF.exe
  C:\Windows\System\mSRdxWF.exe
  2⤵
  PID:10044
- C:\Windows\System\cHOVaID.exe
  C:\Windows\System\cHOVaID.exe
  2⤵
  PID:10060
- C:\Windows\System\LbWJZWw.exe
  C:\Windows\System\LbWJZWw.exe
  2⤵
  PID:10076
- C:\Windows\System\QeYweQW.exe
  C:\Windows\System\QeYweQW.exe
  2⤵
  PID:10096
- C:\Windows\System\OVBwtip.exe
  C:\Windows\System\OVBwtip.exe
  2⤵
  PID:10112
- C:\Windows\System\DmstqXN.exe
  C:\Windows\System\DmstqXN.exe
  2⤵
  PID:10128
- C:\Windows\System\DueUHGJ.exe
  C:\Windows\System\DueUHGJ.exe
  2⤵
  PID:10144
- C:\Windows\System\yDFOGeX.exe
  C:\Windows\System\yDFOGeX.exe
  2⤵
  PID:10160
- C:\Windows\System\eftykDJ.exe
  C:\Windows\System\eftykDJ.exe
  2⤵
  PID:10176
- C:\Windows\System\uGTLnRH.exe
  C:\Windows\System\uGTLnRH.exe
  2⤵
  PID:10192
- C:\Windows\System\ialYwOC.exe
  C:\Windows\System\ialYwOC.exe
  2⤵
  PID:10208
- C:\Windows\System\jKimmWs.exe
  C:\Windows\System\jKimmWs.exe
  2⤵
  PID:10224
- C:\Windows\System\fBFsAGe.exe
  C:\Windows\System\fBFsAGe.exe
  2⤵
  PID:8892
- C:\Windows\System\tMamwfA.exe
  C:\Windows\System\tMamwfA.exe
  2⤵
  PID:9240
- C:\Windows\System\tJPhyxB.exe
  C:\Windows\System\tJPhyxB.exe
  2⤵
  PID:9228
- C:\Windows\System\oveFdVs.exe
  C:\Windows\System\oveFdVs.exe
  2⤵
  PID:9264
- C:\Windows\System\ezuyYIs.exe
  C:\Windows\System\ezuyYIs.exe
  2⤵
  PID:8684
- C:\Windows\System\ojBFirO.exe
  C:\Windows\System\ojBFirO.exe
  2⤵
  PID:2072
- C:\Windows\System\iqkRzPG.exe
  C:\Windows\System\iqkRzPG.exe
  2⤵
  PID:9300
- C:\Windows\System\TWBUJag.exe
  C:\Windows\System\TWBUJag.exe
  2⤵
  PID:9320
- C:\Windows\System\cESHVfj.exe
  C:\Windows\System\cESHVfj.exe
  2⤵
  PID:9368
- C:\Windows\System\ifmJqRr.exe
  C:\Windows\System\ifmJqRr.exe
  2⤵
  PID:9420
- C:\Windows\System\xRSOwjJ.exe
  C:\Windows\System\xRSOwjJ.exe
  2⤵
  PID:9440
- C:\Windows\System\uPbKkbA.exe
  C:\Windows\System\uPbKkbA.exe
  2⤵
  PID:9504
- C:\Windows\System\xZyxNlr.exe
  C:\Windows\System\xZyxNlr.exe
  2⤵
  PID:9568
- C:\Windows\System\rLZYNPx.exe
  C:\Windows\System\rLZYNPx.exe
  2⤵
  PID:9424
- C:\Windows\System\rUpmVKX.exe
  C:\Windows\System\rUpmVKX.exe
  2⤵
  PID:9552
- C:\Windows\System\fHfJWAk.exe
  C:\Windows\System\fHfJWAk.exe
  2⤵
  PID:9488
- C:\Windows\System\RRfLRvj.exe
  C:\Windows\System\RRfLRvj.exe
  2⤵
  PID:9428
- C:\Windows\System\nyBzKza.exe
  C:\Windows\System\nyBzKza.exe
  2⤵
  PID:9664
- C:\Windows\System\xdePIcH.exe
  C:\Windows\System\xdePIcH.exe
  2⤵
  PID:9680
- C:\Windows\System\EfbUIFC.exe
  C:\Windows\System\EfbUIFC.exe
  2⤵
  PID:9704
- C:\Windows\System\sfeWEuz.exe
  C:\Windows\System\sfeWEuz.exe
  2⤵
  PID:9796
- C:\Windows\System\vDAKUTY.exe
  C:\Windows\System\vDAKUTY.exe
  2⤵
  PID:9860
- C:\Windows\System\lDZhBfQ.exe
  C:\Windows\System\lDZhBfQ.exe
  2⤵
  PID:9896
- C:\Windows\System\KxdVjOx.exe
  C:\Windows\System\KxdVjOx.exe
  2⤵
  PID:9988
- C:\Windows\System\fFpRqxF.exe
  C:\Windows\System\fFpRqxF.exe
  2⤵
  PID:10052
- C:\Windows\System\ImlOtpf.exe
  C:\Windows\System\ImlOtpf.exe
  2⤵
  PID:9912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EWNJRRq.exe

Filesize
1.9MB

MD5
7a813e253b1fab7e600a238c51fa9758

SHA1
783876e3ccb202543aa5fb1af1a04013573cfc86

SHA256
fc5f497256e9afc511209727c2626be43a949f59c5bf66546fd922f5551c22b4

SHA512
df2948626fc3d3e05607e419c575d7f36225cc05c9d0eb9bea1b600a2e77ad74c328295c32ead19f75a0894e17ff8d771dab0564adb596b56d005e4e7c837cc2

Download Submit
C:\Windows\system\GbZMjGM.exe

Filesize
1.9MB

MD5
fb8fcda1e5f19f9bc8e50174cd35546a

SHA1
46602d00af134050e03cadf7fb8c85227fcec800

SHA256
7ee63ce25c47ca1891e69dc220ce4ffda0aa7ad6ba15d50db2302451fd2111ba

SHA512
2cb44217a12f4682d39a8e18ab1ca101272a23266bb8cb0f77fd3e8ecfbd7b148278ddc33539ed5a7a95b4920330af7b722df24278f9e8253f77aed1d9299cf7

Download Submit
C:\Windows\system\HgEvVaV.exe

Filesize
1.9MB

MD5
6bb9fd161bc1d6b8b09fc5cd3e6d6957

SHA1
119b953418f61f4f65b8c7fe43d666904c531768

SHA256
8680184939c7feeebf36c4c4d35e956845bcace0a102814bf20ab0c243b7939b

SHA512
f6886679e25311d0f377c64b040ffa9642fd0bd1f65847ff67a6b7ea33d6718c7a265d2812045e8af2fff94914c49e9c14782b3de63d94df56963f462eeda281

Download Submit
C:\Windows\system\HzKokiC.exe

Filesize
1.8MB

MD5
715952a2a3646ea7beefc0dbcbd25066

SHA1
2231fb69ffceeda35b49ed64114482f98f3ab98f

SHA256
3433807ce1675d6f1d5b18f64dd2224727b2e51d6d7b98944734bf53e15c24c2

SHA512
3602e9d57ebef446de9dbb29babfd27e5a92c358252edb4cc2544948489bab52ce3954a61740c02ee93c00e59ea2b14e77402629991648f706062d44cf02e5b1

Download Submit
C:\Windows\system\KVmtUHU.exe

Filesize
1.8MB

MD5
4820b113d8947628edf9e7e0744108fc

SHA1
74d31595c1854572f607882f100d8c2c631674d9

SHA256
d84e4442b5a9b21aa7c1d3ce22c821a6528ccc4613169d77f18336a7baa7fe2e

SHA512
acad4b9c234e8a34f2d60115357c2ba0db0d2a605b467b04e546ecc336d8201d401afab9feb586822c779d5f14c435224e2b4eec9ed927a2007b9886cd71fe4f

Download Submit
C:\Windows\system\LQLpHGc.exe

Filesize
1.8MB

MD5
5fcc4b2e2faaf6d7f1883a412c198244

SHA1
b80b1f8301c757e4a57126371eaa43c70da716da

SHA256
130ec7f60a24bc26d5cd6e162b50fd8a4be1e12603f55095478f419ec1781eb1

SHA512
81db1dac56ecb2fd16d42a00c0f344d8d52fe40f173f014fe7c8c3a589ee6b2bd5ea6d463145e2c6dd39714297eb0e5db09b4cf0ea800b20002de810619fd082

Download Submit
C:\Windows\system\PulyQfE.exe

Filesize
1.9MB

MD5
be0a5abd9ab618a72fef978cd2d98475

SHA1
31e8eadbf3fcfbad7cccbbaf32b59a7b7e7e02ac

SHA256
9e0a21ae044f1d55475ed29ce150d8b9cf5bf2a570d14586170f7602caff526d

SHA512
5e28f3564fc6d0932800bcc2ba60ee69035e3edef6782b329c84f6d54379b4f198d8c2d59e4c95d236ae3a7967203621c497b46fd4b10273858d57724343372b

Download Submit
C:\Windows\system\RhHdSXz.exe

Filesize
1.8MB

MD5
842e8a6453edb3cab0896b760952ab58

SHA1
09ba51e0ed27a1974f142b91aa93969f84b27ecd

SHA256
8d915fe6282fcdcfebaae732c010d1ba96e109ae72a458c0cd6c02adce787963

SHA512
ac0cbb9cc6ade7bd608b819c75f399e7b52f7f6a574ca8cce6e1714c3bbbac53eeff6a5e0544df78134a2329499da7d792f40536c4fd304acaa5b173582c9951

Download Submit
C:\Windows\system\UIVPHbF.exe

Filesize
1.9MB

MD5
ad1ccc7d3b23901e8f31aa41c27111f8

SHA1
7a8eb7d32f6225ce8aa87cffd72a6834b8b24e14

SHA256
aa407e5653c35580026ff5c2ed0b9b6e37acec34a9d5ac0f4c71f4a747d6aeec

SHA512
a4ade7b704d80b2d246f33cfa5bbaaad2634bb49e8b10c9d1b3c9285799155975a599420c750f9689c00787fde107261551cabfda90fe8b6cf717365e1f0550b

Download Submit
C:\Windows\system\XNbmnYv.exe

Filesize
1.9MB

MD5
63deda785d84222301f033675dc611c5

SHA1
61a5c3b2f977bcd224b323492afec90e0fe62404

SHA256
914276b37ac59610c39e7c966f9d020dc99aaf5051da4e655cb3431cc020608b

SHA512
c66c84881f4bc9f8641398d31ca2fa5ea9e0c9773c76552260d3a8183dc999d66939eb470361b38c5de038216c3cf190ec546dd1a475f5d7bbce2ab3290d5774

Download Submit
C:\Windows\system\YdntgYl.exe

Filesize
1.9MB

MD5
e3b4f8cc911dda0c9159b2c6a1eab325

SHA1
1c7e88973453c8a08afa827a1219b85b91a0297f

SHA256
bdad2ef4d86663f5e6bad2d2f59771febcdcb21e1088c0eceb0b36eb0df46516

SHA512
fa9b0043ef161bafc0edc57e14cd68b17dd3eb7d7a4915ec12ba37879ae4d02a43571e3a4d717dd821a3f6bc49d4f291ba9147a39aaf429cfb6359b787e1ab7d

Download Submit
C:\Windows\system\dclwnig.exe

Filesize
8B

MD5
3277aa72bb7d7f1eb1043502fbd1c406

SHA1
8712dca2f3fbc82bf0cbbeecdc5d6a26c87f443c

SHA256
e94b62f30c9ce8b0b5cea14d4367a52fe08005d1bd56ca932a1fd7fc15c61bc9

SHA512
9fb0369549dba8937fb796cbc4ade6bacf540f10f98e02675f1b04c615cbb49e396cdbd25cd29de56c7bfb889c8464199939a84fa31434a75c020caeb4f9f503

Download Submit
C:\Windows\system\hEJHGqc.exe

Filesize
1.9MB

MD5
93261becd741c13da56011093e949070

SHA1
6f9cdf2c42b52c6c3c92c5c02647a6620cc15dfc

SHA256
c2527cb663b6a9be5d26b283bc9a32332d6fec0e4bcf428c862e846695a17103

SHA512
887ce2245b1b5a4db72879bb7be8a451607ab60ba107e32fc6184078e297d4c4f94dcc234161889d0a87663ae89e10e2f6fee3638b497452032a158ddd34c9b7

Download Submit
C:\Windows\system\hIbmMXj.exe

Filesize
1.8MB

MD5
c8045c2dad9df38aa0da0cc3f70d1a63

SHA1
af856bfc3d4e09490132c4e5947c48611666208c

SHA256
515d31ed1ed076ecde1c1ef7a5b51b7926698cf903300d8fd06153fc6a40918c

SHA512
0f2464d3395c130a069358732012bec0f49b9be8ab10eb84c8b7f1610f2027dcfc92bf6e4e34a87cc0bf31420b25b3d7cb05c6e32785a46744fa389630d18359

Download Submit
C:\Windows\system\pChdVeH.exe

Filesize
1.8MB

MD5
7ab5fe7ebb31f666599ac919a27e88db

SHA1
18e1d316191592c71923b724352c13bafe639b47

SHA256
5a8de54c4418aba4b139328314fec34845abc9d364c729ad389f5873ce8e34b1

SHA512
d300706a91b5297a7bb418e00995456cb070415e20fc8d27de0e5629edbab1713127e5687fadfc95b7ffefce89d3dcda3d57928482f5424c10f044bee55c4233

Download Submit
C:\Windows\system\rFmMeQv.exe

Filesize
1.9MB

MD5
d53328e4c503108ef3d7c567e6a0c4ca

SHA1
fde131cb2097ced2ba05d962754a2e641ea008f1

SHA256
d763c621ea040d35e039b00b4c594a6f309f778b9ee47f1f83c1c032b4e3dfd4

SHA512
92b7c8c04755241a67303f02745ac1ca42bfe48f40f7609df0b90cd5dfd9f52bbe062e0aa725d67bd692b0d64427dffc1fb35b86de6ac3d95e17fcde16b8c86d

Download Submit
C:\Windows\system\rRSbsVj.exe

Filesize
1.8MB

MD5
021a26677ddb6b5b8d4e223cfeb09175

SHA1
b2a5af7c984f570579f0b4e740620e61adb629e0

SHA256
417bf579fa546df5aecb7af63020536c808f8cd58c11fb64d4dce6733c1ebf4b

SHA512
1d772f47eacc64c1ee3308fc17f8a0a3a48b2127c006447615a63674f925c9067eb0a5bc97a77ce76dfff6761b54a14332a6a86411a168b2d5155c24bc5e8d32

Download Submit
C:\Windows\system\tPxoPOQ.exe

Filesize
1.8MB

MD5
1aa040c51649fa1bd5eef1edc5506c36

SHA1
1a11056b503ee5049608ec6caa773ea193d449c9

SHA256
bdbfe10cc34b94b3f29b1d25caf12a10b622816319178e365a9c0405b82184bf

SHA512
f433d54fb2669fd839917614d3e7a8c177b3dc24068fd3a4c5d91d0b898289d5ea224c65ee7aa00c8832942f40b08e5f6ba323344157a1d8feae66c32ada41e1

Download Submit
C:\Windows\system\vqgmTbT.exe

Filesize
1.8MB

MD5
9148b18e5340e7592e601ec8a3c209f0

SHA1
595eff9d7728fd67931c79e66db5701f905a2cea

SHA256
d1c853eaa7d3d1baf8063b77871e90fa6fb1e83ca45caee7b4b9a564dd467dcb

SHA512
b053c1fb1ba2e2a950bfdf8688452b7901e342d826ea572ed2a83536a3a5acadf42df5132796f16d8291e479c3897209767daf4a6c77bd4750a6b8da9138db1f

Download Submit
C:\Windows\system\wWAQoSw.exe

Filesize
1.8MB

MD5
47b23ba9ab101421edd97d4165e32ae4

SHA1
7a331f3adf52a05cd5f3f2dca8385f68a9e155a3

SHA256
c83ffc38996385ff8d4709dff85a8c0ef0eb8d8d8902a4d314b0af7345758e24

SHA512
de83d190211177a708e9e196b336d77422140b6da415c4a502c9a1037c53783d2c076c9e0ebcdafb49770778338589f006dfb042c8bfe253815317323ea58f35

Download Submit
C:\Windows\system\wYATwWY.exe

Filesize
1.9MB

MD5
b59d233acba427e39f79d0ebe74f243a

SHA1
8c73fa96b932ba37560e4a7456d4a9b56d23459c

SHA256
18b8affff3c0c6f3a6cf1558a6410273ba1c5ba4f9a2e08e17d6365b7dae12e0

SHA512
aedf3c9b706847bd9ce6291ddfcd1291f063ac5e3ff2066a2a5ae93719d24bab07a43ab04b4f09f32d454890f11e72b629965ee5fe00cab6658825e6a30afc69

Download Submit
\Windows\system\DscPhoH.exe

Filesize
1.8MB

MD5
e4b053d0fc367a85283edd8f755242f6

SHA1
287218c36c3e2cbd07830f4dc6495a7ed85e5c8f

SHA256
23e6b3d34248105a941953fcc922ddc0e851490b82dab7a834118fe17a84c5eb

SHA512
55b7906a8d725c8a7625511da00f253d9d1d7c599d66cd93b2686e38796587dc65f55e27f38e8bd670905c42d93aaa3ca439d333cb160430ca34d32e9281a9a8

Download Submit
\Windows\system\JYGRlVw.exe

Filesize
1.9MB

MD5
e5cbeb66c3131d8ef2c43f1b277a4aa3

SHA1
93215180c7831c3d73a2cad2e1cefa011cc17287

SHA256
2fe0723c7d98d3497a9fbc571234da748cf66744193b4846cce3f2e6f16e9212

SHA512
0f12e09e09138befdb9782157a299130527f2bf04793f67c6cac2b6b9088a5eb381101a23750156e8892e68080dcb3087c6737b3fa0107aed7599783f89e84ec

Download Submit
\Windows\system\SZWMDFI.exe

Filesize
1.8MB

MD5
d8b41a76ab0a50068e4df6c535b68ca1

SHA1
92f0b2b9b0a6242b676a7ea776a7a201de9a614c

SHA256
684401519948730d9c15aee7772be8d22a5b0e2bf7cf7e1a6e22c8b7ed0322f2

SHA512
7fe4e2bf0ff38326ca150dbec55260fd27249b75b0405a22e28ad973b56916507e20f2f8623e4aea43afc63d63f83f12c9194f614cffb63bb2409b864950d1c7

Download Submit
\Windows\system\YhBOhWD.exe

Filesize
1.8MB

MD5
3d8c18dacacfdf29175cfaa768968bb5

SHA1
71e601cecf049084993f0bd476f18f96540efe06

SHA256
81f2e92cadad95950622bc0aa583b9a5a8578f5df387d2284f2f6e8ca1656feb

SHA512
88386662c2362b6253c98d3a5c7d1334a7bb95b005d1bd048a7abde60727a28d258e967f89d95388a78f5fa805c2c84882130c9cd3fa6b7a45852d5a985cf802

Download Submit
\Windows\system\YqXNRfi.exe

Filesize
1.9MB

MD5
bdeb12e6f7d44b56f0b7d740fb415f62

SHA1
83bccfc22307401f678772181a29284ed2f18edb

SHA256
e353ecfc69c1384a6a474f24c24fba86a22911c936390202e2c35995a20d9264

SHA512
4890ea93ed3dce10ba5ab2d6b8968fe390c0cad62a943816b7c0322dbb9e76b0ec30b0c2ee8f64924ecc394206309d8497f921acf1d369107a50803a3aad95b3

Download Submit
\Windows\system\baCPhzG.exe

Filesize
1.9MB

MD5
3f43a8ab7652d683d8102880b15e6e5a

SHA1
b65b071a44ef54866e2c3533bac0cdca693b5ed1

SHA256
0111e4d0c2e74b189aa7acb0c6e527ae00478fb12540fd58a1140bdf8bc21486

SHA512
a06d2d4777d15ef3fc7b792bb3ac6e8163b6c5b30866e94b740a54771b62a997e07507b24ad8cb091d02db49be4106377ea8c7719aad09e85af58a6796b61392

Download Submit
\Windows\system\eidKhtK.exe

Filesize
1.8MB

MD5
430b076b814873806405e41e866044a8

SHA1
e3a2dac151457186c19d26f90c7fec1acc17e808

SHA256
3cfd65ab624a191ad86cc7bdc30ce07c3b7ccacb131f4f511074afa04e9b067a

SHA512
3ac38fe9a15eb5fc03cf900cb4a38b8482aabf96ae1ff58bf9ff5f27300e2fe8b14f8618ba1d043fced6f923734a93f985dd0a082b71824249a0959c74a255bb

Download Submit
\Windows\system\mIpuRUO.exe

Filesize
1.9MB

MD5
181f4dc8409819d918308cb86be232a9

SHA1
43923e1ee8c27ae14adf48109713a348abd44ffb

SHA256
10d4a1b98497ea8f9f3fd4703052e0cb9eaa8e55bf457c9b73e676bc6162199a

SHA512
45d264d268c97aae1c921f4b180c2a1aeb6c2404b4b2ae1099a44fcbc9afbbe2d9320f227cfd57830212bbebb232f0db7c4559fda5fce0da98afd5231357a9cd

Download Submit
\Windows\system\nRRSKnX.exe

Filesize
1.9MB

MD5
48cfcd5412c7c5ba5d0146d93dc94b2f

SHA1
26a6074f7a011540b032b4e6d51ea9b3b3b1a794

SHA256
524f88ef69ebb57d78a8f5828e19c6bc8edfa1c1eda951a809c5d4b893e8f61e

SHA512
497446b2fba6c3aa0f39831789d101be5da7c2547f1dec2b5d74682de10cc82ff80a03f1a29eb5395e02c784077b180ed6ac6eaa88180e89b54c761e48e0bec1

Download Submit
\Windows\system\pIYOGRl.exe

Filesize
1.9MB

MD5
42b9b21be1a1d461964bd90d51182d6c

SHA1
302d76dcf25fb78db66848cf59df8599980a7d6a

SHA256
c24e9d0f07839b640e40b466be38cc1a2c73230bd078233f01d8f8e295b0c99a

SHA512
339807afef0325aa55b87f515a8400068b97c18eedc6f5c8bf31e1f9460878044b76c34d35f6ccad5322321702c8d3b8bbe64bd69967d6a883aa1474b864fcf1

Download Submit
\Windows\system\ruSgUbc.exe

Filesize
1.8MB

MD5
e7c692c15b535162437142c1e0bfe2a6

SHA1
301831fe44949d9d7457fe574fe8577acf0a0624

SHA256
a9a411368d60635e39cbfe06febcbf2c4b45792d53b8da134a106a7ac1fe04c4

SHA512
6c987a1573b3e22e043f673533340d484acd3c16cd08d3642247cf21fb4da0297fc516b55f7cdca5a92e099afa614be00070016dbfb8b62e1cb04fd5d39b2076

Download Submit
\Windows\system\uTrexne.exe

Filesize
1.8MB

MD5
39ef45eca2588e1957bdbdd0638846de

SHA1
244019092234f56c5bbf44ee66e00a3c5cae15ab

SHA256
70d27fdec5e0fb5ddf19350186978d23707a6cf120ef36fd6c4ce58e7f4939db

SHA512
cfde4612601f632dc89ca120365f864a6a6b4a36622bf9df9d0bfb13297cfa1efd34a1b87b8f074b75794a7c1a689f6fadab0e4078c472345b118164c072e6b8

Download Submit
\Windows\system\yZAtovS.exe

Filesize
1.8MB

MD5
c9e4c477aa85b16af24e011afa156542

SHA1
f9b6b957c50102cb560ef4f209f9078b202e9db5

SHA256
3ed3b576d9997e2632e9e6100ce6d6d78344801269b33fbd281fa7610fd6cd5e

SHA512
3bfb4b4a4f21c90dc1e0de57d67e7e01215905696ab854322995c03b9eeb82691926ca44fa02d0820dc6870e9d4913468274e967af00d172fea5288c68fa2f56

Download Submit
memory/2196-74-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2284-19-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2480-61-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2492-67-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2564-45-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-40-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-1295-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-7-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-42-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2728-53-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-47-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2936-50-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2936-1302-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1288-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-1853-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2936-370-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2936-66-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2936-41-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2936-73-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-80-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2936-59-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2936-0-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2936-44-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/2936-18-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/3040-29-0x000000001B540000-0x000000001B822000-memory.dmp

Filesize
2.9MB

Download
memory/3040-32-0x00000000021D0000-0x00000000021D8000-memory.dmp

Filesize
32KB

Download
memory/3040-20-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/3040-46-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-43-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/3040-76-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-39-0x00000000022A0000-0x0000000002320000-memory.dmp

Filesize
512KB

Download
memory/3040-38-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download