xmrig | db19b759b2f45be311b9f6afe0649a17032b33d991237cbb741f129958dc4aa2

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Size

1.9MB
MD5

04f0eb27320d9bc03d998daff60220f7
SHA1

b2f716f8324c8e0554d95f7454e11feed429e642
SHA256

db19b759b2f45be311b9f6afe0649a17032b33d991237cbb741f129958dc4aa2
SHA512

2715d54ea4a1877c2b916dad1284a1e8156594b4855e4b92cd4eb34aab54051cebd124343e17ec08eee8dacfb49f684e44fdd45d127739f9c94aa6bda6307a6d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl2B:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2640-13-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2728-48-0x000000013FD60000-0x0000000140152000-memory.dmp	xmrig
behavioral1/memory/3044-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/1356-59-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2632-56-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2708-52-0x000000013F410000-0x000000013F802000-memory.dmp	xmrig
behavioral1/memory/2580-50-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/1428-76-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2836-73-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2932-1661-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2640	wCFyVmS.exe
2728	zurjPas.exe
2580	NYpKTWR.exe
2708	IQTEDwC.exe
3044	ktBOryN.exe
2632	mIiYLUx.exe
1356	JPMnpiR.exe
2836	hppMVzT.exe
1428	tcFEpMS.exe
1336	SZEPToi.exe
2692	KhQRYNF.exe
2344	EKkgFWW.exe
1208	kYstnEU.exe
1156	hCPwfLC.exe
1444	jlAMtZM.exe
2808	qKuCfdo.exe
2804	HRwfNnk.exe
2412	zbSeEsd.exe
1668	RPXhpLD.exe
1072	cKxuMvR.exe
348	ycNoAlu.exe
2796	yeDMqCE.exe
1732	eFgvZKk.exe
2876	zDErLmH.exe
1752	UEaUflp.exe
336	NjgthHb.exe
1040	BOkhTQn.exe
2228	kJUxIKA.exe
1660	DDwJFLE.exe
640	IkSUYXJ.exe
1092	JRrBnFs.exe
560	UUvqNgF.exe
1144	HPmatsb.exe
472	bUvmwpN.exe
2404	aJFTwoJ.exe
1788	CAmbVGP.exe
948	pRxtDqC.exe
620	pyxOUxk.exe
840	tFCIUwm.exe
2432	ahZjmWY.exe
2040	qutavkU.exe
708	UylAtnz.exe
2056	GBkpvOF.exe
2164	ufxTqam.exe
2872	KBtkuyS.exe
1804	yLdBghx.exe
1696	HTKCBvk.exe
1664	BGgjzGJ.exe
2540	fBCwGco.exe
2256	QkRfAUy.exe
2460	GpKCkxP.exe
2320	XVrObzP.exe
1976	nKZJqVZ.exe
3016	sgLJDEO.exe
880	kisgEBU.exe
2944	VuRtqHP.exe
1148	lEoUhGX.exe
1620	cUqWFne.exe
3036	uhvqqfT.exe
2588	vjcnhuM.exe
2592	lZxLyXm.exe
1568	FDqFIwn.exe
2104	fZuUyza.exe
1936	dsJcZXn.exe

Loads dropped DLL 64 IoCs

pid	Process
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2932-2-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x000a0000000144e9-3.dat	upx
behavioral1/memory/2640-13-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0033000000014817-18.dat	upx
behavioral1/files/0x001400000000549e-23.dat	upx
behavioral1/files/0x0008000000014e5a-27.dat	upx
behavioral1/files/0x0007000000015023-32.dat	upx
behavioral1/files/0x0007000000015136-35.dat	upx
behavioral1/files/0x0007000000015362-40.dat	upx
behavioral1/memory/2728-48-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/3044-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/1356-59-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2632-56-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2708-52-0x000000013F410000-0x000000013F802000-memory.dmp	upx
behavioral1/memory/2580-50-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/files/0x0007000000015cca-69.dat	upx
behavioral1/files/0x0008000000015cc1-74.dat	upx
behavioral1/memory/1428-76-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-80.dat	upx
behavioral1/files/0x0032000000014983-82.dat	upx
behavioral1/memory/2836-73-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x0006000000015cec-87.dat	upx
behavioral1/files/0x0006000000015cf7-93.dat	upx
behavioral1/files/0x0006000000015d5d-106.dat	upx
behavioral1/files/0x0006000000016056-125.dat	upx
behavioral1/files/0x0006000000016525-142.dat	upx
behavioral1/files/0x0006000000015f9e-121.dat	upx
behavioral1/files/0x0006000000016597-151.dat	upx
behavioral1/files/0x0006000000016a45-162.dat	upx
behavioral1/files/0x0006000000016cc9-185.dat	upx
behavioral1/files/0x0006000000016c26-179.dat	upx
behavioral1/files/0x0006000000016c7a-176.dat	upx
behavioral1/files/0x0006000000016ce1-190.dat	upx
behavioral1/files/0x0006000000016cab-184.dat	upx
behavioral1/files/0x0006000000016c2e-174.dat	upx
behavioral1/files/0x0006000000016c17-166.dat	upx
behavioral1/files/0x00060000000167ef-156.dat	upx
behavioral1/files/0x0006000000016411-137.dat	upx
behavioral1/files/0x00060000000160f8-132.dat	upx
behavioral1/files/0x0006000000016277-136.dat	upx
behavioral1/files/0x0006000000015d6e-112.dat	upx
behavioral1/files/0x0006000000015d06-101.dat	upx
behavioral1/files/0x0006000000015f1b-116.dat	upx
behavioral1/memory/2932-1661-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ifSaZOV.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\mkWEbeA.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OhOpwwc.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\GJnyyUN.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\XgrJTKR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UylAtnz.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\aCCxvpD.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\uRRQRwr.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\FrdgUty.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\NAJOBzU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\dNwWaCd.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\PfIkdmK.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\vgOBlZJ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\TFYEYRu.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UrIxcxE.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\xctHvzR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\JniDuHq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OkQHtcq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\wLbtyFO.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\RfmdlAF.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\IkWSeDh.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\WkeFJhp.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\wCFyVmS.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\xnZrYoP.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\OynmGEP.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\HsvHSLR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\wjKoRfY.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\sdKoPKB.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\PNidHtV.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\cWOyaLg.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\pnMqvIU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\rAdQLvf.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\CyUbrln.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\DjcVbiw.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\uysqcFe.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\CKUdnQx.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\kYJDOjI.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ZQHAbZm.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\wAHwlTm.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\degEDsJ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\pEMWcCu.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\RlgCoDq.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\xSjWdBe.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\zbSeEsd.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\mPdmAMM.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UXpxvmN.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ZnbNpfn.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\YqTOMhy.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\mamWLPj.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\PfEikHR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\mWIXHny.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\AERLBfU.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\iaGAbHI.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\dneFFsR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\KhCQJAz.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\LlSujJZ.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\gNZKqou.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\ucoZJWa.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UtmIYNb.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\UIyywSz.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\XVrObzP.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\AHEpXkR.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\zehGtiP.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
File created	C:\Windows\System\gmqNWus.exe	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2304	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
Token: SeDebugPrivilege	2304	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2304	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2304	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2304	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2640	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2640	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2640	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2728	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2728	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2728	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2580	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2580	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2580	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2708	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2708	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2708	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	33
PID 2932 wrote to memory of 3044	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	34
PID 2932 wrote to memory of 3044	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	34
PID 2932 wrote to memory of 3044	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	34
PID 2932 wrote to memory of 2632	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	35
PID 2932 wrote to memory of 2632	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	35
PID 2932 wrote to memory of 2632	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	35
PID 2932 wrote to memory of 1356	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	36
PID 2932 wrote to memory of 1356	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	36
PID 2932 wrote to memory of 1356	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	36
PID 2932 wrote to memory of 1428	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	37
PID 2932 wrote to memory of 1428	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	37
PID 2932 wrote to memory of 1428	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	37
PID 2932 wrote to memory of 2836	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	38
PID 2932 wrote to memory of 2836	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	38
PID 2932 wrote to memory of 2836	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	38
PID 2932 wrote to memory of 1336	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	39
PID 2932 wrote to memory of 1336	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	39
PID 2932 wrote to memory of 1336	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	39
PID 2932 wrote to memory of 2692	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2692	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2692	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2344	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	41
PID 2932 wrote to memory of 2344	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	41
PID 2932 wrote to memory of 2344	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	41
PID 2932 wrote to memory of 1208	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	42
PID 2932 wrote to memory of 1208	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	42
PID 2932 wrote to memory of 1208	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	42
PID 2932 wrote to memory of 1156	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1156	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1156	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1444	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	44
PID 2932 wrote to memory of 1444	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	44
PID 2932 wrote to memory of 1444	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	44
PID 2932 wrote to memory of 2808	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	45
PID 2932 wrote to memory of 2808	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	45
PID 2932 wrote to memory of 2808	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	45
PID 2932 wrote to memory of 2804	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	46
PID 2932 wrote to memory of 2804	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	46
PID 2932 wrote to memory of 2804	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	46
PID 2932 wrote to memory of 2412	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	47
PID 2932 wrote to memory of 2412	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	47
PID 2932 wrote to memory of 2412	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	47
PID 2932 wrote to memory of 1668	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	48
PID 2932 wrote to memory of 1668	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	48
PID 2932 wrote to memory of 1668	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	48
PID 2932 wrote to memory of 1072	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	49
PID 2932 wrote to memory of 1072	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	49
PID 2932 wrote to memory of 1072	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	49
PID 2932 wrote to memory of 348	2932	04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04f0eb27320d9bc03d998daff60220f7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System\wCFyVmS.exe
  C:\Windows\System\wCFyVmS.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\zurjPas.exe
  C:\Windows\System\zurjPas.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\NYpKTWR.exe
  C:\Windows\System\NYpKTWR.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\IQTEDwC.exe
  C:\Windows\System\IQTEDwC.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ktBOryN.exe
  C:\Windows\System\ktBOryN.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\mIiYLUx.exe
  C:\Windows\System\mIiYLUx.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JPMnpiR.exe
  C:\Windows\System\JPMnpiR.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\tcFEpMS.exe
  C:\Windows\System\tcFEpMS.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\hppMVzT.exe
  C:\Windows\System\hppMVzT.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\SZEPToi.exe
  C:\Windows\System\SZEPToi.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\KhQRYNF.exe
  C:\Windows\System\KhQRYNF.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\EKkgFWW.exe
  C:\Windows\System\EKkgFWW.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kYstnEU.exe
  C:\Windows\System\kYstnEU.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\hCPwfLC.exe
  C:\Windows\System\hCPwfLC.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\jlAMtZM.exe
  C:\Windows\System\jlAMtZM.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\qKuCfdo.exe
  C:\Windows\System\qKuCfdo.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\HRwfNnk.exe
  C:\Windows\System\HRwfNnk.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\zbSeEsd.exe
  C:\Windows\System\zbSeEsd.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RPXhpLD.exe
  C:\Windows\System\RPXhpLD.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\cKxuMvR.exe
  C:\Windows\System\cKxuMvR.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\ycNoAlu.exe
  C:\Windows\System\ycNoAlu.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\eFgvZKk.exe
  C:\Windows\System\eFgvZKk.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\yeDMqCE.exe
  C:\Windows\System\yeDMqCE.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\zDErLmH.exe
  C:\Windows\System\zDErLmH.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\UEaUflp.exe
  C:\Windows\System\UEaUflp.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\NjgthHb.exe
  C:\Windows\System\NjgthHb.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\BOkhTQn.exe
  C:\Windows\System\BOkhTQn.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\DDwJFLE.exe
  C:\Windows\System\DDwJFLE.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\kJUxIKA.exe
  C:\Windows\System\kJUxIKA.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\UUvqNgF.exe
  C:\Windows\System\UUvqNgF.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\IkSUYXJ.exe
  C:\Windows\System\IkSUYXJ.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\bUvmwpN.exe
  C:\Windows\System\bUvmwpN.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\JRrBnFs.exe
  C:\Windows\System\JRrBnFs.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\aJFTwoJ.exe
  C:\Windows\System\aJFTwoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\HPmatsb.exe
  C:\Windows\System\HPmatsb.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\CAmbVGP.exe
  C:\Windows\System\CAmbVGP.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\pRxtDqC.exe
  C:\Windows\System\pRxtDqC.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\pyxOUxk.exe
  C:\Windows\System\pyxOUxk.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\tFCIUwm.exe
  C:\Windows\System\tFCIUwm.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\ahZjmWY.exe
  C:\Windows\System\ahZjmWY.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\qutavkU.exe
  C:\Windows\System\qutavkU.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\BGgjzGJ.exe
  C:\Windows\System\BGgjzGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\UylAtnz.exe
  C:\Windows\System\UylAtnz.exe
  2⤵
  - Executes dropped EXE
  PID:708
- C:\Windows\System\XVrObzP.exe
  C:\Windows\System\XVrObzP.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\GBkpvOF.exe
  C:\Windows\System\GBkpvOF.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\nKZJqVZ.exe
  C:\Windows\System\nKZJqVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\ufxTqam.exe
  C:\Windows\System\ufxTqam.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\sgLJDEO.exe
  C:\Windows\System\sgLJDEO.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\KBtkuyS.exe
  C:\Windows\System\KBtkuyS.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\kisgEBU.exe
  C:\Windows\System\kisgEBU.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\yLdBghx.exe
  C:\Windows\System\yLdBghx.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\lEoUhGX.exe
  C:\Windows\System\lEoUhGX.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\HTKCBvk.exe
  C:\Windows\System\HTKCBvk.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\cUqWFne.exe
  C:\Windows\System\cUqWFne.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\fBCwGco.exe
  C:\Windows\System\fBCwGco.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\uhvqqfT.exe
  C:\Windows\System\uhvqqfT.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\QkRfAUy.exe
  C:\Windows\System\QkRfAUy.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\vjcnhuM.exe
  C:\Windows\System\vjcnhuM.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\GpKCkxP.exe
  C:\Windows\System\GpKCkxP.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\lZxLyXm.exe
  C:\Windows\System\lZxLyXm.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\VuRtqHP.exe
  C:\Windows\System\VuRtqHP.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\fZuUyza.exe
  C:\Windows\System\fZuUyza.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\FDqFIwn.exe
  C:\Windows\System\FDqFIwn.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\dsJcZXn.exe
  C:\Windows\System\dsJcZXn.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\fyjgTNo.exe
  C:\Windows\System\fyjgTNo.exe
  2⤵
  PID:1932
- C:\Windows\System\SRfKYFt.exe
  C:\Windows\System\SRfKYFt.exe
  2⤵
  PID:2788
- C:\Windows\System\aCRlDKs.exe
  C:\Windows\System\aCRlDKs.exe
  2⤵
  PID:1324
- C:\Windows\System\vfLrdip.exe
  C:\Windows\System\vfLrdip.exe
  2⤵
  PID:2512
- C:\Windows\System\clxONPE.exe
  C:\Windows\System\clxONPE.exe
  2⤵
  PID:2688
- C:\Windows\System\vTWnMHo.exe
  C:\Windows\System\vTWnMHo.exe
  2⤵
  PID:2060
- C:\Windows\System\GhddlxE.exe
  C:\Windows\System\GhddlxE.exe
  2⤵
  PID:1692
- C:\Windows\System\XqgoLal.exe
  C:\Windows\System\XqgoLal.exe
  2⤵
  PID:324
- C:\Windows\System\yCzelWH.exe
  C:\Windows\System\yCzelWH.exe
  2⤵
  PID:584
- C:\Windows\System\btzvrzf.exe
  C:\Windows\System\btzvrzf.exe
  2⤵
  PID:2156
- C:\Windows\System\vPMWZcm.exe
  C:\Windows\System\vPMWZcm.exe
  2⤵
  PID:2264
- C:\Windows\System\XyaDzkR.exe
  C:\Windows\System\XyaDzkR.exe
  2⤵
  PID:488
- C:\Windows\System\PezpRvg.exe
  C:\Windows\System\PezpRvg.exe
  2⤵
  PID:2456
- C:\Windows\System\ABmTaeV.exe
  C:\Windows\System\ABmTaeV.exe
  2⤵
  PID:1116
- C:\Windows\System\IWeVsuL.exe
  C:\Windows\System\IWeVsuL.exe
  2⤵
  PID:1784
- C:\Windows\System\WbudjAE.exe
  C:\Windows\System\WbudjAE.exe
  2⤵
  PID:1628
- C:\Windows\System\MsRmqIY.exe
  C:\Windows\System\MsRmqIY.exe
  2⤵
  PID:912
- C:\Windows\System\SYNcpgE.exe
  C:\Windows\System\SYNcpgE.exe
  2⤵
  PID:1220
- C:\Windows\System\IdAanVn.exe
  C:\Windows\System\IdAanVn.exe
  2⤵
  PID:1204
- C:\Windows\System\XbKEjhN.exe
  C:\Windows\System\XbKEjhN.exe
  2⤵
  PID:1520
- C:\Windows\System\MAKnJFo.exe
  C:\Windows\System\MAKnJFo.exe
  2⤵
  PID:1580
- C:\Windows\System\SceDhQc.exe
  C:\Windows\System\SceDhQc.exe
  2⤵
  PID:1564
- C:\Windows\System\nUnZmkr.exe
  C:\Windows\System\nUnZmkr.exe
  2⤵
  PID:2112
- C:\Windows\System\MrRLxUa.exe
  C:\Windows\System\MrRLxUa.exe
  2⤵
  PID:2616
- C:\Windows\System\FKLBsvM.exe
  C:\Windows\System\FKLBsvM.exe
  2⤵
  PID:1952
- C:\Windows\System\mamWLPj.exe
  C:\Windows\System\mamWLPj.exe
  2⤵
  PID:1512
- C:\Windows\System\bDXzVFH.exe
  C:\Windows\System\bDXzVFH.exe
  2⤵
  PID:1312
- C:\Windows\System\qrBSnga.exe
  C:\Windows\System\qrBSnga.exe
  2⤵
  PID:2652
- C:\Windows\System\OpqVVyr.exe
  C:\Windows\System\OpqVVyr.exe
  2⤵
  PID:2452
- C:\Windows\System\fARypyA.exe
  C:\Windows\System\fARypyA.exe
  2⤵
  PID:2724
- C:\Windows\System\sxfeXiW.exe
  C:\Windows\System\sxfeXiW.exe
  2⤵
  PID:1716
- C:\Windows\System\pRlQnIj.exe
  C:\Windows\System\pRlQnIj.exe
  2⤵
  PID:2680
- C:\Windows\System\kFMXOel.exe
  C:\Windows\System\kFMXOel.exe
  2⤵
  PID:1860
- C:\Windows\System\liwsPKm.exe
  C:\Windows\System\liwsPKm.exe
  2⤵
  PID:1680
- C:\Windows\System\MfSUfHu.exe
  C:\Windows\System\MfSUfHu.exe
  2⤵
  PID:952
- C:\Windows\System\ZAxTECt.exe
  C:\Windows\System\ZAxTECt.exe
  2⤵
  PID:1136
- C:\Windows\System\ZMiRtrM.exe
  C:\Windows\System\ZMiRtrM.exe
  2⤵
  PID:1708
- C:\Windows\System\jiIZWKZ.exe
  C:\Windows\System\jiIZWKZ.exe
  2⤵
  PID:3024
- C:\Windows\System\kBTOyyf.exe
  C:\Windows\System\kBTOyyf.exe
  2⤵
  PID:2720
- C:\Windows\System\ZxuFdzT.exe
  C:\Windows\System\ZxuFdzT.exe
  2⤵
  PID:1044
- C:\Windows\System\hqIrOzt.exe
  C:\Windows\System\hqIrOzt.exe
  2⤵
  PID:2896
- C:\Windows\System\FhoAbtY.exe
  C:\Windows\System\FhoAbtY.exe
  2⤵
  PID:2612
- C:\Windows\System\TwrlyPK.exe
  C:\Windows\System\TwrlyPK.exe
  2⤵
  PID:356
- C:\Windows\System\HYRkENj.exe
  C:\Windows\System\HYRkENj.exe
  2⤵
  PID:1192
- C:\Windows\System\vFTcagB.exe
  C:\Windows\System\vFTcagB.exe
  2⤵
  PID:1296
- C:\Windows\System\IkBmAEx.exe
  C:\Windows\System\IkBmAEx.exe
  2⤵
  PID:2976
- C:\Windows\System\vtWJHhU.exe
  C:\Windows\System\vtWJHhU.exe
  2⤵
  PID:292
- C:\Windows\System\zkoISYo.exe
  C:\Windows\System\zkoISYo.exe
  2⤵
  PID:572
- C:\Windows\System\jREgoUq.exe
  C:\Windows\System\jREgoUq.exe
  2⤵
  PID:2196
- C:\Windows\System\TEKNcTw.exe
  C:\Windows\System\TEKNcTw.exe
  2⤵
  PID:1612
- C:\Windows\System\pmaZAip.exe
  C:\Windows\System\pmaZAip.exe
  2⤵
  PID:2448
- C:\Windows\System\JVbjJCW.exe
  C:\Windows\System\JVbjJCW.exe
  2⤵
  PID:2548
- C:\Windows\System\xXBdaQk.exe
  C:\Windows\System\xXBdaQk.exe
  2⤵
  PID:1152
- C:\Windows\System\JniDuHq.exe
  C:\Windows\System\JniDuHq.exe
  2⤵
  PID:2772
- C:\Windows\System\tyWolhQ.exe
  C:\Windows\System\tyWolhQ.exe
  2⤵
  PID:1332
- C:\Windows\System\QSkAaYa.exe
  C:\Windows\System\QSkAaYa.exe
  2⤵
  PID:2800
- C:\Windows\System\vAOusSP.exe
  C:\Windows\System\vAOusSP.exe
  2⤵
  PID:2784
- C:\Windows\System\zBUsKST.exe
  C:\Windows\System\zBUsKST.exe
  2⤵
  PID:2664
- C:\Windows\System\CCnYpGm.exe
  C:\Windows\System\CCnYpGm.exe
  2⤵
  PID:296
- C:\Windows\System\dsTTHHx.exe
  C:\Windows\System\dsTTHHx.exe
  2⤵
  PID:1644
- C:\Windows\System\EkGjNRn.exe
  C:\Windows\System\EkGjNRn.exe
  2⤵
  PID:1100
- C:\Windows\System\vzNMAUu.exe
  C:\Windows\System\vzNMAUu.exe
  2⤵
  PID:1308
- C:\Windows\System\ccdYgFw.exe
  C:\Windows\System\ccdYgFw.exe
  2⤵
  PID:2128
- C:\Windows\System\yFcPonL.exe
  C:\Windows\System\yFcPonL.exe
  2⤵
  PID:2964
- C:\Windows\System\CPCojTw.exe
  C:\Windows\System\CPCojTw.exe
  2⤵
  PID:2824
- C:\Windows\System\vgOBlZJ.exe
  C:\Windows\System\vgOBlZJ.exe
  2⤵
  PID:852
- C:\Windows\System\NUsJzHb.exe
  C:\Windows\System\NUsJzHb.exe
  2⤵
  PID:2740
- C:\Windows\System\xzQwdTG.exe
  C:\Windows\System\xzQwdTG.exe
  2⤵
  PID:384
- C:\Windows\System\GTwavZh.exe
  C:\Windows\System\GTwavZh.exe
  2⤵
  PID:1592
- C:\Windows\System\gnnkviY.exe
  C:\Windows\System\gnnkviY.exe
  2⤵
  PID:2284
- C:\Windows\System\TQCquvi.exe
  C:\Windows\System\TQCquvi.exe
  2⤵
  PID:820
- C:\Windows\System\CfpkFxZ.exe
  C:\Windows\System\CfpkFxZ.exe
  2⤵
  PID:1584
- C:\Windows\System\LlSujJZ.exe
  C:\Windows\System\LlSujJZ.exe
  2⤵
  PID:2636
- C:\Windows\System\akoYjXI.exe
  C:\Windows\System\akoYjXI.exe
  2⤵
  PID:3088
- C:\Windows\System\xcivdJn.exe
  C:\Windows\System\xcivdJn.exe
  2⤵
  PID:3108
- C:\Windows\System\pLMIeGa.exe
  C:\Windows\System\pLMIeGa.exe
  2⤵
  PID:3124
- C:\Windows\System\IEIJXop.exe
  C:\Windows\System\IEIJXop.exe
  2⤵
  PID:3140
- C:\Windows\System\CWmXatf.exe
  C:\Windows\System\CWmXatf.exe
  2⤵
  PID:3156
- C:\Windows\System\lstcKmh.exe
  C:\Windows\System\lstcKmh.exe
  2⤵
  PID:3172
- C:\Windows\System\DatcKFf.exe
  C:\Windows\System\DatcKFf.exe
  2⤵
  PID:3188
- C:\Windows\System\KhCQJAz.exe
  C:\Windows\System\KhCQJAz.exe
  2⤵
  PID:3204
- C:\Windows\System\RwzfGEE.exe
  C:\Windows\System\RwzfGEE.exe
  2⤵
  PID:3220
- C:\Windows\System\PCzwlUX.exe
  C:\Windows\System\PCzwlUX.exe
  2⤵
  PID:3240
- C:\Windows\System\jErEMyv.exe
  C:\Windows\System\jErEMyv.exe
  2⤵
  PID:3256
- C:\Windows\System\JMzPaHP.exe
  C:\Windows\System\JMzPaHP.exe
  2⤵
  PID:3272
- C:\Windows\System\mPdmAMM.exe
  C:\Windows\System\mPdmAMM.exe
  2⤵
  PID:3288
- C:\Windows\System\XzbQjQg.exe
  C:\Windows\System\XzbQjQg.exe
  2⤵
  PID:3304
- C:\Windows\System\fChreIp.exe
  C:\Windows\System\fChreIp.exe
  2⤵
  PID:3320
- C:\Windows\System\JMdXeNC.exe
  C:\Windows\System\JMdXeNC.exe
  2⤵
  PID:3336
- C:\Windows\System\BnGkLMU.exe
  C:\Windows\System\BnGkLMU.exe
  2⤵
  PID:3352
- C:\Windows\System\pLxpNTo.exe
  C:\Windows\System\pLxpNTo.exe
  2⤵
  PID:3368
- C:\Windows\System\UYixLEn.exe
  C:\Windows\System\UYixLEn.exe
  2⤵
  PID:3388
- C:\Windows\System\bVKiWSX.exe
  C:\Windows\System\bVKiWSX.exe
  2⤵
  PID:3404
- C:\Windows\System\hpsBVnZ.exe
  C:\Windows\System\hpsBVnZ.exe
  2⤵
  PID:3420
- C:\Windows\System\LKIjgUH.exe
  C:\Windows\System\LKIjgUH.exe
  2⤵
  PID:3440
- C:\Windows\System\JRNTuEB.exe
  C:\Windows\System\JRNTuEB.exe
  2⤵
  PID:3456
- C:\Windows\System\yfpsGCh.exe
  C:\Windows\System\yfpsGCh.exe
  2⤵
  PID:3472
- C:\Windows\System\OGqFukf.exe
  C:\Windows\System\OGqFukf.exe
  2⤵
  PID:3488
- C:\Windows\System\HhABdqi.exe
  C:\Windows\System\HhABdqi.exe
  2⤵
  PID:3504
- C:\Windows\System\bZglsxW.exe
  C:\Windows\System\bZglsxW.exe
  2⤵
  PID:3520
- C:\Windows\System\pqytzme.exe
  C:\Windows\System\pqytzme.exe
  2⤵
  PID:3536
- C:\Windows\System\EzrbWnZ.exe
  C:\Windows\System\EzrbWnZ.exe
  2⤵
  PID:3556
- C:\Windows\System\SPhpCDu.exe
  C:\Windows\System\SPhpCDu.exe
  2⤵
  PID:3572
- C:\Windows\System\hozbpRX.exe
  C:\Windows\System\hozbpRX.exe
  2⤵
  PID:3588
- C:\Windows\System\YHLjnNk.exe
  C:\Windows\System\YHLjnNk.exe
  2⤵
  PID:3604
- C:\Windows\System\rYSUaev.exe
  C:\Windows\System\rYSUaev.exe
  2⤵
  PID:3620
- C:\Windows\System\sZWCJsV.exe
  C:\Windows\System\sZWCJsV.exe
  2⤵
  PID:3636
- C:\Windows\System\jMXLuiF.exe
  C:\Windows\System\jMXLuiF.exe
  2⤵
  PID:3652
- C:\Windows\System\EsjWuHz.exe
  C:\Windows\System\EsjWuHz.exe
  2⤵
  PID:3672
- C:\Windows\System\ontOnSw.exe
  C:\Windows\System\ontOnSw.exe
  2⤵
  PID:3688
- C:\Windows\System\fMwONTl.exe
  C:\Windows\System\fMwONTl.exe
  2⤵
  PID:3704
- C:\Windows\System\HnQIqhi.exe
  C:\Windows\System\HnQIqhi.exe
  2⤵
  PID:3724
- C:\Windows\System\cufyjGw.exe
  C:\Windows\System\cufyjGw.exe
  2⤵
  PID:3740
- C:\Windows\System\AuXaqOI.exe
  C:\Windows\System\AuXaqOI.exe
  2⤵
  PID:3756
- C:\Windows\System\uxhsfkJ.exe
  C:\Windows\System\uxhsfkJ.exe
  2⤵
  PID:3772
- C:\Windows\System\QnuQvUk.exe
  C:\Windows\System\QnuQvUk.exe
  2⤵
  PID:3788
- C:\Windows\System\gKPQDKN.exe
  C:\Windows\System\gKPQDKN.exe
  2⤵
  PID:3804
- C:\Windows\System\kPgLOxx.exe
  C:\Windows\System\kPgLOxx.exe
  2⤵
  PID:3820
- C:\Windows\System\wQHyZVv.exe
  C:\Windows\System\wQHyZVv.exe
  2⤵
  PID:3840
- C:\Windows\System\IjPqdqZ.exe
  C:\Windows\System\IjPqdqZ.exe
  2⤵
  PID:3880
- C:\Windows\System\RupslTu.exe
  C:\Windows\System\RupslTu.exe
  2⤵
  PID:3896
- C:\Windows\System\leeOawP.exe
  C:\Windows\System\leeOawP.exe
  2⤵
  PID:3916
- C:\Windows\System\EuPCuMe.exe
  C:\Windows\System\EuPCuMe.exe
  2⤵
  PID:3932
- C:\Windows\System\JggVuPD.exe
  C:\Windows\System\JggVuPD.exe
  2⤵
  PID:3952
- C:\Windows\System\upxFExM.exe
  C:\Windows\System\upxFExM.exe
  2⤵
  PID:3968
- C:\Windows\System\LXoKANR.exe
  C:\Windows\System\LXoKANR.exe
  2⤵
  PID:3988
- C:\Windows\System\YHweacT.exe
  C:\Windows\System\YHweacT.exe
  2⤵
  PID:4004
- C:\Windows\System\xpGJmvL.exe
  C:\Windows\System\xpGJmvL.exe
  2⤵
  PID:4020
- C:\Windows\System\stKpAhL.exe
  C:\Windows\System\stKpAhL.exe
  2⤵
  PID:4036
- C:\Windows\System\dJocqbT.exe
  C:\Windows\System\dJocqbT.exe
  2⤵
  PID:4052
- C:\Windows\System\lQqtWxr.exe
  C:\Windows\System\lQqtWxr.exe
  2⤵
  PID:4072
- C:\Windows\System\bIueqMX.exe
  C:\Windows\System\bIueqMX.exe
  2⤵
  PID:4088
- C:\Windows\System\eNxSJpp.exe
  C:\Windows\System\eNxSJpp.exe
  2⤵
  PID:3364
- C:\Windows\System\xYMffwc.exe
  C:\Windows\System\xYMffwc.exe
  2⤵
  PID:2276
- C:\Windows\System\fokAYPy.exe
  C:\Windows\System\fokAYPy.exe
  2⤵
  PID:3084
- C:\Windows\System\fkJMOiO.exe
  C:\Windows\System\fkJMOiO.exe
  2⤵
  PID:3152
- C:\Windows\System\LdNNnXi.exe
  C:\Windows\System\LdNNnXi.exe
  2⤵
  PID:3216
- C:\Windows\System\vyfBade.exe
  C:\Windows\System\vyfBade.exe
  2⤵
  PID:3312
- C:\Windows\System\xxfEcGg.exe
  C:\Windows\System\xxfEcGg.exe
  2⤵
  PID:3376
- C:\Windows\System\DpjCfeu.exe
  C:\Windows\System\DpjCfeu.exe
  2⤵
  PID:2608
- C:\Windows\System\PhwCXen.exe
  C:\Windows\System\PhwCXen.exe
  2⤵
  PID:2024
- C:\Windows\System\ULKyoaY.exe
  C:\Windows\System\ULKyoaY.exe
  2⤵
  PID:3480
- C:\Windows\System\dwBBBWJ.exe
  C:\Windows\System\dwBBBWJ.exe
  2⤵
  PID:2492
- C:\Windows\System\GlSkBeM.exe
  C:\Windows\System\GlSkBeM.exe
  2⤵
  PID:3548
- C:\Windows\System\fzkzWjw.exe
  C:\Windows\System\fzkzWjw.exe
  2⤵
  PID:3616
- C:\Windows\System\XbLCPWF.exe
  C:\Windows\System\XbLCPWF.exe
  2⤵
  PID:3684
- C:\Windows\System\ROKKSxQ.exe
  C:\Windows\System\ROKKSxQ.exe
  2⤵
  PID:3752
- C:\Windows\System\SzRbGOo.exe
  C:\Windows\System\SzRbGOo.exe
  2⤵
  PID:3816
- C:\Windows\System\XiaiXxS.exe
  C:\Windows\System\XiaiXxS.exe
  2⤵
  PID:3860
- C:\Windows\System\KcdiAgy.exe
  C:\Windows\System\KcdiAgy.exe
  2⤵
  PID:3876
- C:\Windows\System\fIwtKcw.exe
  C:\Windows\System\fIwtKcw.exe
  2⤵
  PID:3940
- C:\Windows\System\TNjbXcc.exe
  C:\Windows\System\TNjbXcc.exe
  2⤵
  PID:3980
- C:\Windows\System\BIMgSBj.exe
  C:\Windows\System\BIMgSBj.exe
  2⤵
  PID:4044
- C:\Windows\System\GEiWAri.exe
  C:\Windows\System\GEiWAri.exe
  2⤵
  PID:3732
- C:\Windows\System\KyWbKWu.exe
  C:\Windows\System\KyWbKWu.exe
  2⤵
  PID:3888
- C:\Windows\System\xrgbEUG.exe
  C:\Windows\System\xrgbEUG.exe
  2⤵
  PID:1972
- C:\Windows\System\pnMqvIU.exe
  C:\Windows\System\pnMqvIU.exe
  2⤵
  PID:1876
- C:\Windows\System\PfEikHR.exe
  C:\Windows\System\PfEikHR.exe
  2⤵
  PID:2240
- C:\Windows\System\uVWSCxW.exe
  C:\Windows\System\uVWSCxW.exe
  2⤵
  PID:3500
- C:\Windows\System\mBUxMFr.exe
  C:\Windows\System\mBUxMFr.exe
  2⤵
  PID:1488
- C:\Windows\System\cqrrUEr.exe
  C:\Windows\System\cqrrUEr.exe
  2⤵
  PID:3164
- C:\Windows\System\ptnWFMV.exe
  C:\Windows\System\ptnWFMV.exe
  2⤵
  PID:3232
- C:\Windows\System\YzVbSTO.exe
  C:\Windows\System\YzVbSTO.exe
  2⤵
  PID:3696
- C:\Windows\System\ZqcRufd.exe
  C:\Windows\System\ZqcRufd.exe
  2⤵
  PID:3836
- C:\Windows\System\cjtFtai.exe
  C:\Windows\System\cjtFtai.exe
  2⤵
  PID:4068
- C:\Windows\System\McHTzyQ.exe
  C:\Windows\System\McHTzyQ.exe
  2⤵
  PID:1492
- C:\Windows\System\oenvYXv.exe
  C:\Windows\System\oenvYXv.exe
  2⤵
  PID:3464
- C:\Windows\System\PaCKEMs.exe
  C:\Windows\System\PaCKEMs.exe
  2⤵
  PID:2700
- C:\Windows\System\iBaUdXr.exe
  C:\Windows\System\iBaUdXr.exe
  2⤵
  PID:2524
- C:\Windows\System\yJrxyYT.exe
  C:\Windows\System\yJrxyYT.exe
  2⤵
  PID:2564
- C:\Windows\System\vdNnFjt.exe
  C:\Windows\System\vdNnFjt.exe
  2⤵
  PID:3664
- C:\Windows\System\jYmhOOq.exe
  C:\Windows\System\jYmhOOq.exe
  2⤵
  PID:2336
- C:\Windows\System\EHrlMrp.exe
  C:\Windows\System\EHrlMrp.exe
  2⤵
  PID:2076
- C:\Windows\System\PPlHwAi.exe
  C:\Windows\System\PPlHwAi.exe
  2⤵
  PID:3080
- C:\Windows\System\nEqcFAB.exe
  C:\Windows\System\nEqcFAB.exe
  2⤵
  PID:308
- C:\Windows\System\RBfTRsd.exe
  C:\Windows\System\RBfTRsd.exe
  2⤵
  PID:3700
- C:\Windows\System\JYjqFeF.exe
  C:\Windows\System\JYjqFeF.exe
  2⤵
  PID:3852
- C:\Windows\System\mbbfRrZ.exe
  C:\Windows\System\mbbfRrZ.exe
  2⤵
  PID:4012
- C:\Windows\System\QWSUfHG.exe
  C:\Windows\System\QWSUfHG.exe
  2⤵
  PID:2532
- C:\Windows\System\LvaIeao.exe
  C:\Windows\System\LvaIeao.exe
  2⤵
  PID:3280
- C:\Windows\System\ZQHAbZm.exe
  C:\Windows\System\ZQHAbZm.exe
  2⤵
  PID:3448
- C:\Windows\System\gZCIeKb.exe
  C:\Windows\System\gZCIeKb.exe
  2⤵
  PID:3648
- C:\Windows\System\pnYOXgE.exe
  C:\Windows\System\pnYOXgE.exe
  2⤵
  PID:3868
- C:\Windows\System\hfdEgdd.exe
  C:\Windows\System\hfdEgdd.exe
  2⤵
  PID:4080
- C:\Windows\System\DIvsgXE.exe
  C:\Windows\System\DIvsgXE.exe
  2⤵
  PID:3720
- C:\Windows\System\teyQHYD.exe
  C:\Windows\System\teyQHYD.exe
  2⤵
  PID:3996
- C:\Windows\System\PIlEuAe.exe
  C:\Windows\System\PIlEuAe.exe
  2⤵
  PID:4032
- C:\Windows\System\ddfqySc.exe
  C:\Windows\System\ddfqySc.exe
  2⤵
  PID:3428
- C:\Windows\System\MhzgPpF.exe
  C:\Windows\System\MhzgPpF.exe
  2⤵
  PID:2160
- C:\Windows\System\DXkWtRX.exe
  C:\Windows\System\DXkWtRX.exe
  2⤵
  PID:3100
- C:\Windows\System\HesixHC.exe
  C:\Windows\System\HesixHC.exe
  2⤵
  PID:3228
- C:\Windows\System\lEPbsZw.exe
  C:\Windows\System\lEPbsZw.exe
  2⤵
  PID:3928
- C:\Windows\System\JVeBGNE.exe
  C:\Windows\System\JVeBGNE.exe
  2⤵
  PID:3596
- C:\Windows\System\YdkHGRt.exe
  C:\Windows\System\YdkHGRt.exe
  2⤵
  PID:2472
- C:\Windows\System\CvywRsD.exe
  C:\Windows\System\CvywRsD.exe
  2⤵
  PID:3296
- C:\Windows\System\VbAjITN.exe
  C:\Windows\System\VbAjITN.exe
  2⤵
  PID:1652
- C:\Windows\System\ralTKxT.exe
  C:\Windows\System\ralTKxT.exe
  2⤵
  PID:3212
- C:\Windows\System\xXOslFa.exe
  C:\Windows\System\xXOslFa.exe
  2⤵
  PID:3912
- C:\Windows\System\SFvhorB.exe
  C:\Windows\System\SFvhorB.exe
  2⤵
  PID:3544
- C:\Windows\System\igjoenX.exe
  C:\Windows\System\igjoenX.exe
  2⤵
  PID:4016
- C:\Windows\System\vRCxgIu.exe
  C:\Windows\System\vRCxgIu.exe
  2⤵
  PID:3400
- C:\Windows\System\NnpOJTw.exe
  C:\Windows\System\NnpOJTw.exe
  2⤵
  PID:3628
- C:\Windows\System\PYXRjRq.exe
  C:\Windows\System\PYXRjRq.exe
  2⤵
  PID:3348
- C:\Windows\System\EdmzqKU.exe
  C:\Windows\System\EdmzqKU.exe
  2⤵
  PID:2484
- C:\Windows\System\PdvXwcR.exe
  C:\Windows\System\PdvXwcR.exe
  2⤵
  PID:2516
- C:\Windows\System\iGPCbnf.exe
  C:\Windows\System\iGPCbnf.exe
  2⤵
  PID:2828
- C:\Windows\System\JJORRwg.exe
  C:\Windows\System\JJORRwg.exe
  2⤵
  PID:3668
- C:\Windows\System\fnqPItJ.exe
  C:\Windows\System\fnqPItJ.exe
  2⤵
  PID:2768
- C:\Windows\System\PZSMsNh.exe
  C:\Windows\System\PZSMsNh.exe
  2⤵
  PID:1588
- C:\Windows\System\uFyZnRa.exe
  C:\Windows\System\uFyZnRa.exe
  2⤵
  PID:2032
- C:\Windows\System\sdKoPKB.exe
  C:\Windows\System\sdKoPKB.exe
  2⤵
  PID:540
- C:\Windows\System\IPfXSZn.exe
  C:\Windows\System\IPfXSZn.exe
  2⤵
  PID:3828
- C:\Windows\System\akYJDhV.exe
  C:\Windows\System\akYJDhV.exe
  2⤵
  PID:2968
- C:\Windows\System\ZeJlpzn.exe
  C:\Windows\System\ZeJlpzn.exe
  2⤵
  PID:3908
- C:\Windows\System\DpKNHOy.exe
  C:\Windows\System\DpKNHOy.exe
  2⤵
  PID:3300
- C:\Windows\System\tmwIHmt.exe
  C:\Windows\System\tmwIHmt.exe
  2⤵
  PID:3964
- C:\Windows\System\FdLLXtC.exe
  C:\Windows\System\FdLLXtC.exe
  2⤵
  PID:2272
- C:\Windows\System\doPcIWR.exe
  C:\Windows\System\doPcIWR.exe
  2⤵
  PID:1008
- C:\Windows\System\oQyZSys.exe
  C:\Windows\System\oQyZSys.exe
  2⤵
  PID:3412
- C:\Windows\System\nXHqDiM.exe
  C:\Windows\System\nXHqDiM.exe
  2⤵
  PID:3612
- C:\Windows\System\gZOnsLW.exe
  C:\Windows\System\gZOnsLW.exe
  2⤵
  PID:3568
- C:\Windows\System\AekiUDk.exe
  C:\Windows\System\AekiUDk.exe
  2⤵
  PID:3200
- C:\Windows\System\tpcSqFr.exe
  C:\Windows\System\tpcSqFr.exe
  2⤵
  PID:1776
- C:\Windows\System\tvCIuTK.exe
  C:\Windows\System\tvCIuTK.exe
  2⤵
  PID:1768
- C:\Windows\System\JWOcjmM.exe
  C:\Windows\System\JWOcjmM.exe
  2⤵
  PID:2004
- C:\Windows\System\iHPfXFL.exe
  C:\Windows\System\iHPfXFL.exe
  2⤵
  PID:4108
- C:\Windows\System\DUpVTZD.exe
  C:\Windows\System\DUpVTZD.exe
  2⤵
  PID:4124
- C:\Windows\System\mtdXtUD.exe
  C:\Windows\System\mtdXtUD.exe
  2⤵
  PID:4140
- C:\Windows\System\IkWSeDh.exe
  C:\Windows\System\IkWSeDh.exe
  2⤵
  PID:4156
- C:\Windows\System\MXzOGxF.exe
  C:\Windows\System\MXzOGxF.exe
  2⤵
  PID:4172
- C:\Windows\System\GuGrrjT.exe
  C:\Windows\System\GuGrrjT.exe
  2⤵
  PID:4192
- C:\Windows\System\uYogeEq.exe
  C:\Windows\System\uYogeEq.exe
  2⤵
  PID:4208
- C:\Windows\System\sdPwtXo.exe
  C:\Windows\System\sdPwtXo.exe
  2⤵
  PID:4224
- C:\Windows\System\raLSEXA.exe
  C:\Windows\System\raLSEXA.exe
  2⤵
  PID:4240
- C:\Windows\System\cQqEAqx.exe
  C:\Windows\System\cQqEAqx.exe
  2⤵
  PID:4256
- C:\Windows\System\yqaJDCu.exe
  C:\Windows\System\yqaJDCu.exe
  2⤵
  PID:4272
- C:\Windows\System\dkIvPZk.exe
  C:\Windows\System\dkIvPZk.exe
  2⤵
  PID:4316
- C:\Windows\System\PcvHCUH.exe
  C:\Windows\System\PcvHCUH.exe
  2⤵
  PID:4332
- C:\Windows\System\PNAImgL.exe
  C:\Windows\System\PNAImgL.exe
  2⤵
  PID:4348
- C:\Windows\System\MLEXALQ.exe
  C:\Windows\System\MLEXALQ.exe
  2⤵
  PID:4364
- C:\Windows\System\BLkJIyM.exe
  C:\Windows\System\BLkJIyM.exe
  2⤵
  PID:4464
- C:\Windows\System\uSBUzAW.exe
  C:\Windows\System\uSBUzAW.exe
  2⤵
  PID:4516
- C:\Windows\System\wjKoRfY.exe
  C:\Windows\System\wjKoRfY.exe
  2⤵
  PID:4532
- C:\Windows\System\BvXhLTj.exe
  C:\Windows\System\BvXhLTj.exe
  2⤵
  PID:4548
- C:\Windows\System\jBGjvdU.exe
  C:\Windows\System\jBGjvdU.exe
  2⤵
  PID:4564
- C:\Windows\System\bnwYFTP.exe
  C:\Windows\System\bnwYFTP.exe
  2⤵
  PID:4580
- C:\Windows\System\zfqtySg.exe
  C:\Windows\System\zfqtySg.exe
  2⤵
  PID:4596
- C:\Windows\System\ouBiWWa.exe
  C:\Windows\System\ouBiWWa.exe
  2⤵
  PID:4612
- C:\Windows\System\VcnKoTN.exe
  C:\Windows\System\VcnKoTN.exe
  2⤵
  PID:4628
- C:\Windows\System\WypiKAg.exe
  C:\Windows\System\WypiKAg.exe
  2⤵
  PID:4644
- C:\Windows\System\MqNaKoe.exe
  C:\Windows\System\MqNaKoe.exe
  2⤵
  PID:4660
- C:\Windows\System\oPOgQoX.exe
  C:\Windows\System\oPOgQoX.exe
  2⤵
  PID:4684
- C:\Windows\System\pEYvRXj.exe
  C:\Windows\System\pEYvRXj.exe
  2⤵
  PID:4736
- C:\Windows\System\OlQgsEX.exe
  C:\Windows\System\OlQgsEX.exe
  2⤵
  PID:4756
- C:\Windows\System\uftYGlC.exe
  C:\Windows\System\uftYGlC.exe
  2⤵
  PID:4772
- C:\Windows\System\rKhuObK.exe
  C:\Windows\System\rKhuObK.exe
  2⤵
  PID:4788
- C:\Windows\System\XlXzTQt.exe
  C:\Windows\System\XlXzTQt.exe
  2⤵
  PID:4804
- C:\Windows\System\mJziylv.exe
  C:\Windows\System\mJziylv.exe
  2⤵
  PID:4820
- C:\Windows\System\qyhAMRk.exe
  C:\Windows\System\qyhAMRk.exe
  2⤵
  PID:4848
- C:\Windows\System\CebGRiv.exe
  C:\Windows\System\CebGRiv.exe
  2⤵
  PID:4872
- C:\Windows\System\aCsnzKt.exe
  C:\Windows\System\aCsnzKt.exe
  2⤵
  PID:4892
- C:\Windows\System\luZjRib.exe
  C:\Windows\System\luZjRib.exe
  2⤵
  PID:4912
- C:\Windows\System\ScScqCf.exe
  C:\Windows\System\ScScqCf.exe
  2⤵
  PID:4928
- C:\Windows\System\uGYVLSF.exe
  C:\Windows\System\uGYVLSF.exe
  2⤵
  PID:4956
- C:\Windows\System\vbioLwk.exe
  C:\Windows\System\vbioLwk.exe
  2⤵
  PID:4972
- C:\Windows\System\BramIKH.exe
  C:\Windows\System\BramIKH.exe
  2⤵
  PID:4988
- C:\Windows\System\WfuuilR.exe
  C:\Windows\System\WfuuilR.exe
  2⤵
  PID:5020
- C:\Windows\System\dtibitl.exe
  C:\Windows\System\dtibitl.exe
  2⤵
  PID:5036
- C:\Windows\System\FEcDcIQ.exe
  C:\Windows\System\FEcDcIQ.exe
  2⤵
  PID:5056
- C:\Windows\System\fmhNhHl.exe
  C:\Windows\System\fmhNhHl.exe
  2⤵
  PID:5072
- C:\Windows\System\RuXWQOR.exe
  C:\Windows\System\RuXWQOR.exe
  2⤵
  PID:5096
- C:\Windows\System\ZkVDDdu.exe
  C:\Windows\System\ZkVDDdu.exe
  2⤵
  PID:5112
- C:\Windows\System\cBdoAGj.exe
  C:\Windows\System\cBdoAGj.exe
  2⤵
  PID:1868
- C:\Windows\System\HTvAHlb.exe
  C:\Windows\System\HTvAHlb.exe
  2⤵
  PID:2508
- C:\Windows\System\FoKOMNn.exe
  C:\Windows\System\FoKOMNn.exe
  2⤵
  PID:3136
- C:\Windows\System\KvuKocG.exe
  C:\Windows\System\KvuKocG.exe
  2⤵
  PID:3048
- C:\Windows\System\sYEJniK.exe
  C:\Windows\System\sYEJniK.exe
  2⤵
  PID:3748
- C:\Windows\System\wIyGcBy.exe
  C:\Windows\System\wIyGcBy.exe
  2⤵
  PID:3056
- C:\Windows\System\KYtitwg.exe
  C:\Windows\System\KYtitwg.exe
  2⤵
  PID:4132
- C:\Windows\System\RDcUgNK.exe
  C:\Windows\System\RDcUgNK.exe
  2⤵
  PID:4200
- C:\Windows\System\xwHAvwc.exe
  C:\Windows\System\xwHAvwc.exe
  2⤵
  PID:4264
- C:\Windows\System\ZDIejjc.exe
  C:\Windows\System\ZDIejjc.exe
  2⤵
  PID:3960
- C:\Windows\System\syYnivv.exe
  C:\Windows\System\syYnivv.exe
  2⤵
  PID:1624
- C:\Windows\System\krmUUMZ.exe
  C:\Windows\System\krmUUMZ.exe
  2⤵
  PID:4148
- C:\Windows\System\BumYkHA.exe
  C:\Windows\System\BumYkHA.exe
  2⤵
  PID:320
- C:\Windows\System\dKJXleK.exe
  C:\Windows\System\dKJXleK.exe
  2⤵
  PID:2348
- C:\Windows\System\guEJAdj.exe
  C:\Windows\System\guEJAdj.exe
  2⤵
  PID:4216
- C:\Windows\System\OxaWbGe.exe
  C:\Windows\System\OxaWbGe.exe
  2⤵
  PID:4280
- C:\Windows\System\CHBPBHr.exe
  C:\Windows\System\CHBPBHr.exe
  2⤵
  PID:4328
- C:\Windows\System\YsFcsQi.exe
  C:\Windows\System\YsFcsQi.exe
  2⤵
  PID:4296
- C:\Windows\System\bIjrvkQ.exe
  C:\Windows\System\bIjrvkQ.exe
  2⤵
  PID:4340
- C:\Windows\System\MmSbmwI.exe
  C:\Windows\System\MmSbmwI.exe
  2⤵
  PID:4312
- C:\Windows\System\BHOujVS.exe
  C:\Windows\System\BHOujVS.exe
  2⤵
  PID:4396
- C:\Windows\System\kMEiHba.exe
  C:\Windows\System\kMEiHba.exe
  2⤵
  PID:4412
- C:\Windows\System\PzSBzlO.exe
  C:\Windows\System\PzSBzlO.exe
  2⤵
  PID:4428
- C:\Windows\System\jcwmwZE.exe
  C:\Windows\System\jcwmwZE.exe
  2⤵
  PID:4460
- C:\Windows\System\RlMRjDT.exe
  C:\Windows\System\RlMRjDT.exe
  2⤵
  PID:4476
- C:\Windows\System\KyRnvbh.exe
  C:\Windows\System\KyRnvbh.exe
  2⤵
  PID:2948
- C:\Windows\System\SGieXeu.exe
  C:\Windows\System\SGieXeu.exe
  2⤵
  PID:4496
- C:\Windows\System\hlTPScR.exe
  C:\Windows\System\hlTPScR.exe
  2⤵
  PID:4524
- C:\Windows\System\jVheJDH.exe
  C:\Windows\System\jVheJDH.exe
  2⤵
  PID:4576
- C:\Windows\System\ODpdiTO.exe
  C:\Windows\System\ODpdiTO.exe
  2⤵
  PID:4572
- C:\Windows\System\awgzGXQ.exe
  C:\Windows\System\awgzGXQ.exe
  2⤵
  PID:4636
- C:\Windows\System\NzBGwVi.exe
  C:\Windows\System\NzBGwVi.exe
  2⤵
  PID:4868
- C:\Windows\System\YxlCAiF.exe
  C:\Windows\System\YxlCAiF.exe
  2⤵
  PID:4904
- C:\Windows\System\ivlAUVD.exe
  C:\Windows\System\ivlAUVD.exe
  2⤵
  PID:4936
- C:\Windows\System\ncMZBjA.exe
  C:\Windows\System\ncMZBjA.exe
  2⤵
  PID:4948
- C:\Windows\System\zdQnzKj.exe
  C:\Windows\System\zdQnzKj.exe
  2⤵
  PID:4984
- C:\Windows\System\mKTCtSh.exe
  C:\Windows\System\mKTCtSh.exe
  2⤵
  PID:5008
- C:\Windows\System\wgJFnQu.exe
  C:\Windows\System\wgJFnQu.exe
  2⤵
  PID:5016
- C:\Windows\System\UMYNEHP.exe
  C:\Windows\System\UMYNEHP.exe
  2⤵
  PID:5052
- C:\Windows\System\uNHqapg.exe
  C:\Windows\System\uNHqapg.exe
  2⤵
  PID:5088
- C:\Windows\System\lkncytd.exe
  C:\Windows\System\lkncytd.exe
  2⤵
  PID:3512
- C:\Windows\System\SHlUOCE.exe
  C:\Windows\System\SHlUOCE.exe
  2⤵
  PID:4168
- C:\Windows\System\PPlBfdB.exe
  C:\Windows\System\PPlBfdB.exe
  2⤵
  PID:788
- C:\Windows\System\vXHqjdN.exe
  C:\Windows\System\vXHqjdN.exe
  2⤵
  PID:556
- C:\Windows\System\xgVlsLZ.exe
  C:\Windows\System\xgVlsLZ.exe
  2⤵
  PID:4360
- C:\Windows\System\kkvAkum.exe
  C:\Windows\System\kkvAkum.exe
  2⤵
  PID:3148
- C:\Windows\System\WAbNvXM.exe
  C:\Windows\System\WAbNvXM.exe
  2⤵
  PID:2952
- C:\Windows\System\UTsUVnX.exe
  C:\Windows\System\UTsUVnX.exe
  2⤵
  PID:1992
- C:\Windows\System\BIEdeOq.exe
  C:\Windows\System\BIEdeOq.exe
  2⤵
  PID:4188
- C:\Windows\System\jIOQKau.exe
  C:\Windows\System\jIOQKau.exe
  2⤵
  PID:4408
- C:\Windows\System\jnWoeEr.exe
  C:\Windows\System\jnWoeEr.exe
  2⤵
  PID:4288
- C:\Windows\System\OtxYAts.exe
  C:\Windows\System\OtxYAts.exe
  2⤵
  PID:4484
- C:\Windows\System\tboFTZy.exe
  C:\Windows\System\tboFTZy.exe
  2⤵
  PID:4420
- C:\Windows\System\FfONmwL.exe
  C:\Windows\System\FfONmwL.exe
  2⤵
  PID:4640
- C:\Windows\System\oYUZDNj.exe
  C:\Windows\System\oYUZDNj.exe
  2⤵
  PID:4440
- C:\Windows\System\CeDkHbV.exe
  C:\Windows\System\CeDkHbV.exe
  2⤵
  PID:4732
- C:\Windows\System\mKWoqvq.exe
  C:\Windows\System\mKWoqvq.exe
  2⤵
  PID:4780
- C:\Windows\System\nZPfFGZ.exe
  C:\Windows\System\nZPfFGZ.exe
  2⤵
  PID:4800
- C:\Windows\System\OPXkILt.exe
  C:\Windows\System\OPXkILt.exe
  2⤵
  PID:5068
- C:\Windows\System\wSUIYhI.exe
  C:\Windows\System\wSUIYhI.exe
  2⤵
  PID:3196
- C:\Windows\System\UrLaHSN.exe
  C:\Windows\System\UrLaHSN.exe
  2⤵
  PID:1052
- C:\Windows\System\gVYCYvy.exe
  C:\Windows\System\gVYCYvy.exe
  2⤵
  PID:4236
- C:\Windows\System\dsibxCd.exe
  C:\Windows\System\dsibxCd.exe
  2⤵
  PID:2748
- C:\Windows\System\LuQmpKB.exe
  C:\Windows\System\LuQmpKB.exe
  2⤵
  PID:3812
- C:\Windows\System\pDPkneO.exe
  C:\Windows\System\pDPkneO.exe
  2⤵
  PID:4404
- C:\Windows\System\TFYEYRu.exe
  C:\Windows\System\TFYEYRu.exe
  2⤵
  PID:4384
- C:\Windows\System\whtbXRK.exe
  C:\Windows\System\whtbXRK.exe
  2⤵
  PID:4488
- C:\Windows\System\TMzoDff.exe
  C:\Windows\System\TMzoDff.exe
  2⤵
  PID:4504
- C:\Windows\System\jcMhNWQ.exe
  C:\Windows\System\jcMhNWQ.exe
  2⤵
  PID:4512
- C:\Windows\System\dkkyFBn.exe
  C:\Windows\System\dkkyFBn.exe
  2⤵
  PID:4608
- C:\Windows\System\aCCxvpD.exe
  C:\Windows\System\aCCxvpD.exe
  2⤵
  PID:4676
- C:\Windows\System\wjnkvKk.exe
  C:\Windows\System\wjnkvKk.exe
  2⤵
  PID:4604
- C:\Windows\System\zBvMulA.exe
  C:\Windows\System\zBvMulA.exe
  2⤵
  PID:4724
- C:\Windows\System\RHBuFNz.exe
  C:\Windows\System\RHBuFNz.exe
  2⤵
  PID:4720
- C:\Windows\System\wNysqcE.exe
  C:\Windows\System\wNysqcE.exe
  2⤵
  PID:4812
- C:\Windows\System\YechcJj.exe
  C:\Windows\System\YechcJj.exe
  2⤵
  PID:4924
- C:\Windows\System\OLCmQwS.exe
  C:\Windows\System\OLCmQwS.exe
  2⤵
  PID:4796
- C:\Windows\System\qtjaDTu.exe
  C:\Windows\System\qtjaDTu.exe
  2⤵
  PID:4864
- C:\Windows\System\UKptIai.exe
  C:\Windows\System\UKptIai.exe
  2⤵
  PID:4944
- C:\Windows\System\bRpwnPh.exe
  C:\Windows\System\bRpwnPh.exe
  2⤵
  PID:5092
- C:\Windows\System\QAlpmnR.exe
  C:\Windows\System\QAlpmnR.exe
  2⤵
  PID:4292
- C:\Windows\System\VsIpwQK.exe
  C:\Windows\System\VsIpwQK.exe
  2⤵
  PID:4184
- C:\Windows\System\MnMhFQs.exe
  C:\Windows\System\MnMhFQs.exe
  2⤵
  PID:4656
- C:\Windows\System\lONfrAX.exe
  C:\Windows\System\lONfrAX.exe
  2⤵
  PID:5128
- C:\Windows\System\cdCslsI.exe
  C:\Windows\System\cdCslsI.exe
  2⤵
  PID:5148
- C:\Windows\System\ghihpfk.exe
  C:\Windows\System\ghihpfk.exe
  2⤵
  PID:5164
- C:\Windows\System\uozpmrj.exe
  C:\Windows\System\uozpmrj.exe
  2⤵
  PID:5180
- C:\Windows\System\ifBFuex.exe
  C:\Windows\System\ifBFuex.exe
  2⤵
  PID:5200
- C:\Windows\System\uRRQRwr.exe
  C:\Windows\System\uRRQRwr.exe
  2⤵
  PID:5216
- C:\Windows\System\KwQLFcQ.exe
  C:\Windows\System\KwQLFcQ.exe
  2⤵
  PID:5232
- C:\Windows\System\HhMEfVy.exe
  C:\Windows\System\HhMEfVy.exe
  2⤵
  PID:5248
- C:\Windows\System\wlkZSCX.exe
  C:\Windows\System\wlkZSCX.exe
  2⤵
  PID:5264
- C:\Windows\System\ojTxsqL.exe
  C:\Windows\System\ojTxsqL.exe
  2⤵
  PID:5364
- C:\Windows\System\JbMDqZL.exe
  C:\Windows\System\JbMDqZL.exe
  2⤵
  PID:5380
- C:\Windows\System\sfrqgRB.exe
  C:\Windows\System\sfrqgRB.exe
  2⤵
  PID:5400
- C:\Windows\System\xxzQKfD.exe
  C:\Windows\System\xxzQKfD.exe
  2⤵
  PID:5420
- C:\Windows\System\nXFHueb.exe
  C:\Windows\System\nXFHueb.exe
  2⤵
  PID:5436
- C:\Windows\System\JKrcqnO.exe
  C:\Windows\System\JKrcqnO.exe
  2⤵
  PID:5452
- C:\Windows\System\JnuzpOM.exe
  C:\Windows\System\JnuzpOM.exe
  2⤵
  PID:5468
- C:\Windows\System\plsGKpO.exe
  C:\Windows\System\plsGKpO.exe
  2⤵
  PID:5484
- C:\Windows\System\cLLSiNv.exe
  C:\Windows\System\cLLSiNv.exe
  2⤵
  PID:5504
- C:\Windows\System\pfoECQD.exe
  C:\Windows\System\pfoECQD.exe
  2⤵
  PID:5520
- C:\Windows\System\yVCLyGZ.exe
  C:\Windows\System\yVCLyGZ.exe
  2⤵
  PID:5540
- C:\Windows\System\PrwlGLS.exe
  C:\Windows\System\PrwlGLS.exe
  2⤵
  PID:5556
- C:\Windows\System\WiMGdoz.exe
  C:\Windows\System\WiMGdoz.exe
  2⤵
  PID:5572
- C:\Windows\System\TrHPZxm.exe
  C:\Windows\System\TrHPZxm.exe
  2⤵
  PID:5588
- C:\Windows\System\FrdgUty.exe
  C:\Windows\System\FrdgUty.exe
  2⤵
  PID:5604
- C:\Windows\System\GoRtVVE.exe
  C:\Windows\System\GoRtVVE.exe
  2⤵
  PID:5620
- C:\Windows\System\oQzPiEj.exe
  C:\Windows\System\oQzPiEj.exe
  2⤵
  PID:5636
- C:\Windows\System\WLRiUWo.exe
  C:\Windows\System\WLRiUWo.exe
  2⤵
  PID:5652
- C:\Windows\System\zUHAska.exe
  C:\Windows\System\zUHAska.exe
  2⤵
  PID:5672
- C:\Windows\System\QmaeQpN.exe
  C:\Windows\System\QmaeQpN.exe
  2⤵
  PID:5688
- C:\Windows\System\FhQZxbK.exe
  C:\Windows\System\FhQZxbK.exe
  2⤵
  PID:5704
- C:\Windows\System\lkvVgZo.exe
  C:\Windows\System\lkvVgZo.exe
  2⤵
  PID:5720
- C:\Windows\System\cFKLGJq.exe
  C:\Windows\System\cFKLGJq.exe
  2⤵
  PID:5736
- C:\Windows\System\knlsYBn.exe
  C:\Windows\System\knlsYBn.exe
  2⤵
  PID:5752
- C:\Windows\System\QRYwuAk.exe
  C:\Windows\System\QRYwuAk.exe
  2⤵
  PID:5772
- C:\Windows\System\joKULOh.exe
  C:\Windows\System\joKULOh.exe
  2⤵
  PID:5788
- C:\Windows\System\gNKqCGC.exe
  C:\Windows\System\gNKqCGC.exe
  2⤵
  PID:5804
- C:\Windows\System\drJTFeQ.exe
  C:\Windows\System\drJTFeQ.exe
  2⤵
  PID:5900
- C:\Windows\System\NFcxYdf.exe
  C:\Windows\System\NFcxYdf.exe
  2⤵
  PID:5916
- C:\Windows\System\GyCZbox.exe
  C:\Windows\System\GyCZbox.exe
  2⤵
  PID:5932
- C:\Windows\System\StxvLkz.exe
  C:\Windows\System\StxvLkz.exe
  2⤵
  PID:5988
- C:\Windows\System\RQKhgzU.exe
  C:\Windows\System\RQKhgzU.exe
  2⤵
  PID:6004
- C:\Windows\System\YRSxgsY.exe
  C:\Windows\System\YRSxgsY.exe
  2⤵
  PID:6020
- C:\Windows\System\TJLfhvV.exe
  C:\Windows\System\TJLfhvV.exe
  2⤵
  PID:6036
- C:\Windows\System\mHKifYM.exe
  C:\Windows\System\mHKifYM.exe
  2⤵
  PID:6052
- C:\Windows\System\DopZsWJ.exe
  C:\Windows\System\DopZsWJ.exe
  2⤵
  PID:6068
- C:\Windows\System\JTyjCwp.exe
  C:\Windows\System\JTyjCwp.exe
  2⤵
  PID:6084
- C:\Windows\System\vKRmUGy.exe
  C:\Windows\System\vKRmUGy.exe
  2⤵
  PID:6104
- C:\Windows\System\KMuVsaK.exe
  C:\Windows\System\KMuVsaK.exe
  2⤵
  PID:6120
- C:\Windows\System\XzIsyaM.exe
  C:\Windows\System\XzIsyaM.exe
  2⤵
  PID:6136
- C:\Windows\System\BOaWgyd.exe
  C:\Windows\System\BOaWgyd.exe
  2⤵
  PID:4828
- C:\Windows\System\TxvrvlO.exe
  C:\Windows\System\TxvrvlO.exe
  2⤵
  PID:4728
- C:\Windows\System\dxTBDet.exe
  C:\Windows\System\dxTBDet.exe
  2⤵
  PID:5084
- C:\Windows\System\aIAdGrk.exe
  C:\Windows\System\aIAdGrk.exe
  2⤵
  PID:5224
- C:\Windows\System\myhipwE.exe
  C:\Windows\System\myhipwE.exe
  2⤵
  PID:5156
- C:\Windows\System\EGEUYJz.exe
  C:\Windows\System\EGEUYJz.exe
  2⤵
  PID:300
- C:\Windows\System\QMHVKQC.exe
  C:\Windows\System\QMHVKQC.exe
  2⤵
  PID:5108
- C:\Windows\System\ddxqPna.exe
  C:\Windows\System\ddxqPna.exe
  2⤵
  PID:5300
- C:\Windows\System\OuooFEp.exe
  C:\Windows\System\OuooFEp.exe
  2⤵
  PID:5324
- C:\Windows\System\YsoeEBg.exe
  C:\Windows\System\YsoeEBg.exe
  2⤵
  PID:5340
- C:\Windows\System\kyqgNYs.exe
  C:\Windows\System\kyqgNYs.exe
  2⤵
  PID:3432
- C:\Windows\System\TVFokDy.exe
  C:\Windows\System\TVFokDy.exe
  2⤵
  PID:3768
- C:\Windows\System\ZIlLzLt.exe
  C:\Windows\System\ZIlLzLt.exe
  2⤵
  PID:4544
- C:\Windows\System\sSfDbas.exe
  C:\Windows\System\sSfDbas.exe
  2⤵
  PID:5328
- C:\Windows\System\Jtyxhqq.exe
  C:\Windows\System\Jtyxhqq.exe
  2⤵
  PID:5140
- C:\Windows\System\CcCYLUR.exe
  C:\Windows\System\CcCYLUR.exe
  2⤵
  PID:5196
- C:\Windows\System\LXUxBMd.exe
  C:\Windows\System\LXUxBMd.exe
  2⤵
  PID:5244
- C:\Windows\System\EELDFMo.exe
  C:\Windows\System\EELDFMo.exe
  2⤵
  PID:5296
- C:\Windows\System\SehUjyO.exe
  C:\Windows\System\SehUjyO.exe
  2⤵
  PID:5336
- C:\Windows\System\mWIXHny.exe
  C:\Windows\System\mWIXHny.exe
  2⤵
  PID:5360
- C:\Windows\System\UXpxvmN.exe
  C:\Windows\System\UXpxvmN.exe
  2⤵
  PID:5412
- C:\Windows\System\rAdQLvf.exe
  C:\Windows\System\rAdQLvf.exe
  2⤵
  PID:5448
- C:\Windows\System\ifSaZOV.exe
  C:\Windows\System\ifSaZOV.exe
  2⤵
  PID:5548
- C:\Windows\System\tHmAYPj.exe
  C:\Windows\System\tHmAYPj.exe
  2⤵
  PID:5612
- C:\Windows\System\njeDzIY.exe
  C:\Windows\System\njeDzIY.exe
  2⤵
  PID:5680
- C:\Windows\System\YIwuhfh.exe
  C:\Windows\System\YIwuhfh.exe
  2⤵
  PID:5744
- C:\Windows\System\cqoCCkm.exe
  C:\Windows\System\cqoCCkm.exe
  2⤵
  PID:5812
- C:\Windows\System\IwuNycS.exe
  C:\Windows\System\IwuNycS.exe
  2⤵
  PID:5836
- C:\Windows\System\AJXgrLj.exe
  C:\Windows\System\AJXgrLj.exe
  2⤵
  PID:5860
- C:\Windows\System\yAfJXfy.exe
  C:\Windows\System\yAfJXfy.exe
  2⤵
  PID:5872
- C:\Windows\System\CyUbrln.exe
  C:\Windows\System\CyUbrln.exe
  2⤵
  PID:5888
- C:\Windows\System\YrXmFYO.exe
  C:\Windows\System\YrXmFYO.exe
  2⤵
  PID:5396
- C:\Windows\System\iZMEVnP.exe
  C:\Windows\System\iZMEVnP.exe
  2⤵
  PID:5388
- C:\Windows\System\BCgFCkj.exe
  C:\Windows\System\BCgFCkj.exe
  2⤵
  PID:5460
- C:\Windows\System\eyOGDpk.exe
  C:\Windows\System\eyOGDpk.exe
  2⤵
  PID:5564
- C:\Windows\System\vSVFrPW.exe
  C:\Windows\System\vSVFrPW.exe
  2⤵
  PID:5600
- C:\Windows\System\sfXsnvC.exe
  C:\Windows\System\sfXsnvC.exe
  2⤵
  PID:5668
- C:\Windows\System\MPARAtc.exe
  C:\Windows\System\MPARAtc.exe
  2⤵
  PID:5732
- C:\Windows\System\PNidHtV.exe
  C:\Windows\System\PNidHtV.exe
  2⤵
  PID:5796
- C:\Windows\System\QlNguSo.exe
  C:\Windows\System\QlNguSo.exe
  2⤵
  PID:5928
- C:\Windows\System\qNhEutH.exe
  C:\Windows\System\qNhEutH.exe
  2⤵
  PID:5956
- C:\Windows\System\LfgSuVp.exe
  C:\Windows\System\LfgSuVp.exe
  2⤵
  PID:5972
- C:\Windows\System\yMejoqu.exe
  C:\Windows\System\yMejoqu.exe
  2⤵
  PID:5984
- C:\Windows\System\gKdGWtp.exe
  C:\Windows\System\gKdGWtp.exe
  2⤵
  PID:6000
- C:\Windows\System\rePQACj.exe
  C:\Windows\System\rePQACj.exe
  2⤵
  PID:6044
- C:\Windows\System\hUhFqBL.exe
  C:\Windows\System\hUhFqBL.exe
  2⤵
  PID:6064
- C:\Windows\System\oknsfhL.exe
  C:\Windows\System\oknsfhL.exe
  2⤵
  PID:5228
- C:\Windows\System\oMwdgqf.exe
  C:\Windows\System\oMwdgqf.exe
  2⤵
  PID:6116
- C:\Windows\System\TQZWaBx.exe
  C:\Windows\System\TQZWaBx.exe
  2⤵
  PID:5316
- C:\Windows\System\aKvFxqP.exe
  C:\Windows\System\aKvFxqP.exe
  2⤵
  PID:4680
- C:\Windows\System\RWbPtgO.exe
  C:\Windows\System\RWbPtgO.exe
  2⤵
  PID:4232
- C:\Windows\System\DUcYRLK.exe
  C:\Windows\System\DUcYRLK.exe
  2⤵
  PID:5000
- C:\Windows\System\yedCRgL.exe
  C:\Windows\System\yedCRgL.exe
  2⤵
  PID:5292
- C:\Windows\System\uqFGdfm.exe
  C:\Windows\System\uqFGdfm.exe
  2⤵
  PID:5280
- C:\Windows\System\iBvhYok.exe
  C:\Windows\System\iBvhYok.exe
  2⤵
  PID:5176
- C:\Windows\System\gwfevOF.exe
  C:\Windows\System\gwfevOF.exe
  2⤵
  PID:5348
- C:\Windows\System\sxdGqFa.exe
  C:\Windows\System\sxdGqFa.exe
  2⤵
  PID:5476
- C:\Windows\System\BnFPcaG.exe
  C:\Windows\System\BnFPcaG.exe
  2⤵
  PID:5716
- C:\Windows\System\VuQfIwr.exe
  C:\Windows\System\VuQfIwr.exe
  2⤵
  PID:5868
- C:\Windows\System\mbmDdUc.exe
  C:\Windows\System\mbmDdUc.exe
  2⤵
  PID:5432
- C:\Windows\System\vprjlbI.exe
  C:\Windows\System\vprjlbI.exe
  2⤵
  PID:5700
- C:\Windows\System\lJgMzQi.exe
  C:\Windows\System\lJgMzQi.exe
  2⤵
  PID:5912
- C:\Windows\System\vBuajaM.exe
  C:\Windows\System\vBuajaM.exe
  2⤵
  PID:6096
- C:\Windows\System\xZJUFGG.exe
  C:\Windows\System\xZJUFGG.exe
  2⤵
  PID:5512
- C:\Windows\System\zQxdgOU.exe
  C:\Windows\System\zQxdgOU.exe
  2⤵
  PID:5980
- C:\Windows\System\tjzTiYf.exe
  C:\Windows\System\tjzTiYf.exe
  2⤵
  PID:4952
- C:\Windows\System\JnbCuIw.exe
  C:\Windows\System\JnbCuIw.exe
  2⤵
  PID:5212
- C:\Windows\System\tRmAqjp.exe
  C:\Windows\System\tRmAqjp.exe
  2⤵
  PID:5376
- C:\Windows\System\rPlYUUZ.exe
  C:\Windows\System\rPlYUUZ.exe
  2⤵
  PID:5344
- C:\Windows\System\shefPVk.exe
  C:\Windows\System\shefPVk.exe
  2⤵
  PID:5896
- C:\Windows\System\YkAVDjr.exe
  C:\Windows\System\YkAVDjr.exe
  2⤵
  PID:5428
- C:\Windows\System\bPxTqGq.exe
  C:\Windows\System\bPxTqGq.exe
  2⤵
  PID:6160
- C:\Windows\System\mBOscFC.exe
  C:\Windows\System\mBOscFC.exe
  2⤵
  PID:6176
- C:\Windows\System\VglrLio.exe
  C:\Windows\System\VglrLio.exe
  2⤵
  PID:6192
- C:\Windows\System\FhSXNjV.exe
  C:\Windows\System\FhSXNjV.exe
  2⤵
  PID:6208
- C:\Windows\System\LleJiFt.exe
  C:\Windows\System\LleJiFt.exe
  2⤵
  PID:6224
- C:\Windows\System\wSzxkNe.exe
  C:\Windows\System\wSzxkNe.exe
  2⤵
  PID:6240
- C:\Windows\System\NzpubgA.exe
  C:\Windows\System\NzpubgA.exe
  2⤵
  PID:6256
- C:\Windows\System\NZRUfUi.exe
  C:\Windows\System\NZRUfUi.exe
  2⤵
  PID:6280
- C:\Windows\System\YtyZHJn.exe
  C:\Windows\System\YtyZHJn.exe
  2⤵
  PID:6296
- C:\Windows\System\ZjnAWvN.exe
  C:\Windows\System\ZjnAWvN.exe
  2⤵
  PID:6312
- C:\Windows\System\IAEDXkG.exe
  C:\Windows\System\IAEDXkG.exe
  2⤵
  PID:6328
- C:\Windows\System\EspeAHa.exe
  C:\Windows\System\EspeAHa.exe
  2⤵
  PID:6348
- C:\Windows\System\nWCLWgi.exe
  C:\Windows\System\nWCLWgi.exe
  2⤵
  PID:6368
- C:\Windows\System\TATnMqZ.exe
  C:\Windows\System\TATnMqZ.exe
  2⤵
  PID:6384
- C:\Windows\System\SExiYyC.exe
  C:\Windows\System\SExiYyC.exe
  2⤵
  PID:6400
- C:\Windows\System\LtcjNeX.exe
  C:\Windows\System\LtcjNeX.exe
  2⤵
  PID:6416
- C:\Windows\System\FByvtxg.exe
  C:\Windows\System\FByvtxg.exe
  2⤵
  PID:6432
- C:\Windows\System\VBmTARj.exe
  C:\Windows\System\VBmTARj.exe
  2⤵
  PID:6448
- C:\Windows\System\iKmPJLK.exe
  C:\Windows\System\iKmPJLK.exe
  2⤵
  PID:6468
- C:\Windows\System\yLInjAc.exe
  C:\Windows\System\yLInjAc.exe
  2⤵
  PID:6484
- C:\Windows\System\ffhoowQ.exe
  C:\Windows\System\ffhoowQ.exe
  2⤵
  PID:6500
- C:\Windows\System\qtDmrNX.exe
  C:\Windows\System\qtDmrNX.exe
  2⤵
  PID:6580
- C:\Windows\System\cmFphLK.exe
  C:\Windows\System\cmFphLK.exe
  2⤵
  PID:6596
- C:\Windows\System\DjcVbiw.exe
  C:\Windows\System\DjcVbiw.exe
  2⤵
  PID:6616
- C:\Windows\System\tVJSUhW.exe
  C:\Windows\System\tVJSUhW.exe
  2⤵
  PID:6636
- C:\Windows\System\bHxQusx.exe
  C:\Windows\System\bHxQusx.exe
  2⤵
  PID:6652
- C:\Windows\System\hbJTsud.exe
  C:\Windows\System\hbJTsud.exe
  2⤵
  PID:6672
- C:\Windows\System\HtFtcWT.exe
  C:\Windows\System\HtFtcWT.exe
  2⤵
  PID:6688
- C:\Windows\System\XubTWDZ.exe
  C:\Windows\System\XubTWDZ.exe
  2⤵
  PID:6712
- C:\Windows\System\MrQKmoZ.exe
  C:\Windows\System\MrQKmoZ.exe
  2⤵
  PID:6728
- C:\Windows\System\chvcCWL.exe
  C:\Windows\System\chvcCWL.exe
  2⤵
  PID:6744
- C:\Windows\System\oTUIrLj.exe
  C:\Windows\System\oTUIrLj.exe
  2⤵
  PID:6772
- C:\Windows\System\ntAfHQY.exe
  C:\Windows\System\ntAfHQY.exe
  2⤵
  PID:6792
- C:\Windows\System\ALMHzkZ.exe
  C:\Windows\System\ALMHzkZ.exe
  2⤵
  PID:6808
- C:\Windows\System\YorMmbk.exe
  C:\Windows\System\YorMmbk.exe
  2⤵
  PID:6824
- C:\Windows\System\uysqcFe.exe
  C:\Windows\System\uysqcFe.exe
  2⤵
  PID:6840
- C:\Windows\System\UrIxcxE.exe
  C:\Windows\System\UrIxcxE.exe
  2⤵
  PID:6856
- C:\Windows\System\LuIYePU.exe
  C:\Windows\System\LuIYePU.exe
  2⤵
  PID:6872
- C:\Windows\System\LLLdPGK.exe
  C:\Windows\System\LLLdPGK.exe
  2⤵
  PID:6896
- C:\Windows\System\EgIQqAX.exe
  C:\Windows\System\EgIQqAX.exe
  2⤵
  PID:6912
- C:\Windows\System\OFBSAsw.exe
  C:\Windows\System\OFBSAsw.exe
  2⤵
  PID:6932
- C:\Windows\System\ZcimAOM.exe
  C:\Windows\System\ZcimAOM.exe
  2⤵
  PID:6948
- C:\Windows\System\PxppipH.exe
  C:\Windows\System\PxppipH.exe
  2⤵
  PID:6964
- C:\Windows\System\XNvjELq.exe
  C:\Windows\System\XNvjELq.exe
  2⤵
  PID:6980
- C:\Windows\System\VOHXeoP.exe
  C:\Windows\System\VOHXeoP.exe
  2⤵
  PID:6996
- C:\Windows\System\cbsgXEB.exe
  C:\Windows\System\cbsgXEB.exe
  2⤵
  PID:7012
- C:\Windows\System\nZigOgT.exe
  C:\Windows\System\nZigOgT.exe
  2⤵
  PID:7028
- C:\Windows\System\FiFUnvD.exe
  C:\Windows\System\FiFUnvD.exe
  2⤵
  PID:7044
- C:\Windows\System\wAHwlTm.exe
  C:\Windows\System\wAHwlTm.exe
  2⤵
  PID:7060
- C:\Windows\System\kZRNGCO.exe
  C:\Windows\System\kZRNGCO.exe
  2⤵
  PID:7076
- C:\Windows\System\fRlpVUC.exe
  C:\Windows\System\fRlpVUC.exe
  2⤵
  PID:7092
- C:\Windows\System\OTWjJUb.exe
  C:\Windows\System\OTWjJUb.exe
  2⤵
  PID:7112
- C:\Windows\System\lsvMPmd.exe
  C:\Windows\System\lsvMPmd.exe
  2⤵
  PID:7132
- C:\Windows\System\qPPXbzl.exe
  C:\Windows\System\qPPXbzl.exe
  2⤵
  PID:7148
- C:\Windows\System\UQanbAu.exe
  C:\Windows\System\UQanbAu.exe
  2⤵
  PID:7164
- C:\Windows\System\jWARHxM.exe
  C:\Windows\System\jWARHxM.exe
  2⤵
  PID:6216
- C:\Windows\System\degEDsJ.exe
  C:\Windows\System\degEDsJ.exe
  2⤵
  PID:6152
- C:\Windows\System\MzgOpUW.exe
  C:\Windows\System\MzgOpUW.exe
  2⤵
  PID:6248
- C:\Windows\System\rqQlOKW.exe
  C:\Windows\System\rqQlOKW.exe
  2⤵
  PID:5844
- C:\Windows\System\AERLBfU.exe
  C:\Windows\System\AERLBfU.exe
  2⤵
  PID:4836
- C:\Windows\System\LMoKEXq.exe
  C:\Windows\System\LMoKEXq.exe
  2⤵
  PID:6100
- C:\Windows\System\qCwXCye.exe
  C:\Windows\System\qCwXCye.exe
  2⤵
  PID:6424
- C:\Windows\System\LDyxJfu.exe
  C:\Windows\System\LDyxJfu.exe
  2⤵
  PID:6492
- C:\Windows\System\slawuRm.exe
  C:\Windows\System\slawuRm.exe
  2⤵
  PID:5784
- C:\Windows\System\vRLsxPX.exe
  C:\Windows\System\vRLsxPX.exe
  2⤵
  PID:5500
- C:\Windows\System\iSepMsO.exe
  C:\Windows\System\iSepMsO.exe
  2⤵
  PID:5660
- C:\Windows\System\KOfyLCD.exe
  C:\Windows\System\KOfyLCD.exe
  2⤵
  PID:5940
- C:\Windows\System\AvFSVuT.exe
  C:\Windows\System\AvFSVuT.exe
  2⤵
  PID:4708
- C:\Windows\System\PTcJRyP.exe
  C:\Windows\System\PTcJRyP.exe
  2⤵
  PID:4448
- C:\Windows\System\ZwDmAMg.exe
  C:\Windows\System\ZwDmAMg.exe
  2⤵
  PID:4716
- C:\Windows\System\ggiYmXP.exe
  C:\Windows\System\ggiYmXP.exe
  2⤵
  PID:5924
- C:\Windows\System\oBBpPBJ.exe
  C:\Windows\System\oBBpPBJ.exe
  2⤵
  PID:5596
- C:\Windows\System\gNZKqou.exe
  C:\Windows\System\gNZKqou.exe
  2⤵
  PID:4832
- C:\Windows\System\UrLApqM.exe
  C:\Windows\System\UrLApqM.exe
  2⤵
  PID:5332
- C:\Windows\System\cWOyaLg.exe
  C:\Windows\System\cWOyaLg.exe
  2⤵
  PID:6340
- C:\Windows\System\bJwtBRr.exe
  C:\Windows\System\bJwtBRr.exe
  2⤵
  PID:6204
- C:\Windows\System\ibyZqpU.exe
  C:\Windows\System\ibyZqpU.exe
  2⤵
  PID:6540
- C:\Windows\System\IggMByc.exe
  C:\Windows\System\IggMByc.exe
  2⤵
  PID:6480
- C:\Windows\System\SuLQyfd.exe
  C:\Windows\System\SuLQyfd.exe
  2⤵
  PID:6276
- C:\Windows\System\hRjVbRQ.exe
  C:\Windows\System\hRjVbRQ.exe
  2⤵
  PID:6660
- C:\Windows\System\GXmHFUe.exe
  C:\Windows\System\GXmHFUe.exe
  2⤵
  PID:6704
- C:\Windows\System\igGdzNY.exe
  C:\Windows\System\igGdzNY.exe
  2⤵
  PID:6624
- C:\Windows\System\oBjSeXG.exe
  C:\Windows\System\oBjSeXG.exe
  2⤵
  PID:6788
- C:\Windows\System\xIKvwla.exe
  C:\Windows\System\xIKvwla.exe
  2⤵
  PID:6852
- C:\Windows\System\GcYBTPJ.exe
  C:\Windows\System\GcYBTPJ.exe
  2⤵
  PID:6884
- C:\Windows\System\GgrIroX.exe
  C:\Windows\System\GgrIroX.exe
  2⤵
  PID:6920
- C:\Windows\System\MmPFBJL.exe
  C:\Windows\System\MmPFBJL.exe
  2⤵
  PID:6528
- C:\Windows\System\YJLNoSg.exe
  C:\Windows\System\YJLNoSg.exe
  2⤵
  PID:6412
- C:\Windows\System\QahmmzX.exe
  C:\Windows\System\QahmmzX.exe
  2⤵
  PID:6612
- C:\Windows\System\djHbVkq.exe
  C:\Windows\System\djHbVkq.exe
  2⤵
  PID:6668
- C:\Windows\System\gROQkIi.exe
  C:\Windows\System\gROQkIi.exe
  2⤵
  PID:6956
- C:\Windows\System\asrsAIv.exe
  C:\Windows\System\asrsAIv.exe
  2⤵
  PID:6764
- C:\Windows\System\zbSYDuX.exe
  C:\Windows\System\zbSYDuX.exe
  2⤵
  PID:6832
- C:\Windows\System\luxdvSR.exe
  C:\Windows\System\luxdvSR.exe
  2⤵
  PID:6516
- C:\Windows\System\xnZrYoP.exe
  C:\Windows\System\xnZrYoP.exe
  2⤵
  PID:6908
- C:\Windows\System\OTCFJpk.exe
  C:\Windows\System\OTCFJpk.exe
  2⤵
  PID:6560
- C:\Windows\System\LUeCzjd.exe
  C:\Windows\System\LUeCzjd.exe
  2⤵
  PID:6988
- C:\Windows\System\VOwEejX.exe
  C:\Windows\System\VOwEejX.exe
  2⤵
  PID:6976
- C:\Windows\System\tGXtzhG.exe
  C:\Windows\System\tGXtzhG.exe
  2⤵
  PID:7056
- C:\Windows\System\sAgZQaC.exe
  C:\Windows\System\sAgZQaC.exe
  2⤵
  PID:7004
- C:\Windows\System\wtUlpYV.exe
  C:\Windows\System\wtUlpYV.exe
  2⤵
  PID:7100
- C:\Windows\System\xOooQEa.exe
  C:\Windows\System\xOooQEa.exe
  2⤵
  PID:7160
- C:\Windows\System\rdnWMQP.exe
  C:\Windows\System\rdnWMQP.exe
  2⤵
  PID:7072
- C:\Windows\System\bZGiuSi.exe
  C:\Windows\System\bZGiuSi.exe
  2⤵
  PID:6320
- C:\Windows\System\xctHvzR.exe
  C:\Windows\System\xctHvzR.exe
  2⤵
  PID:6188
- C:\Windows\System\AxgAsSa.exe
  C:\Windows\System\AxgAsSa.exe
  2⤵
  PID:6324
- C:\Windows\System\RxPSkgl.exe
  C:\Windows\System\RxPSkgl.exe
  2⤵
  PID:6428
- C:\Windows\System\UbdQHPr.exe
  C:\Windows\System\UbdQHPr.exe
  2⤵
  PID:5648
- C:\Windows\System\HazcdbH.exe
  C:\Windows\System\HazcdbH.exe
  2⤵
  PID:5832
- C:\Windows\System\EnGRjtP.exe
  C:\Windows\System\EnGRjtP.exe
  2⤵
  PID:6016
- C:\Windows\System\TbhCrRd.exe
  C:\Windows\System\TbhCrRd.exe
  2⤵
  PID:5308
- C:\Windows\System\tshaPOi.exe
  C:\Windows\System\tshaPOi.exe
  2⤵
  PID:6200
- C:\Windows\System\KKmVgAA.exe
  C:\Windows\System\KKmVgAA.exe
  2⤵
  PID:6700
- C:\Windows\System\zPebPBx.exe
  C:\Windows\System\zPebPBx.exe
  2⤵
  PID:6552
- C:\Windows\System\FwZtgVB.exe
  C:\Windows\System\FwZtgVB.exe
  2⤵
  PID:6172
- C:\Windows\System\YolPOic.exe
  C:\Windows\System\YolPOic.exe
  2⤵
  PID:6864
- C:\Windows\System\XFBGbDd.exe
  C:\Windows\System\XFBGbDd.exe
  2⤵
  PID:6756
- C:\Windows\System\LQOudBa.exe
  C:\Windows\System\LQOudBa.exe
  2⤵
  PID:6940
- C:\Windows\System\FSTBhIM.exe
  C:\Windows\System\FSTBhIM.exe
  2⤵
  PID:6632
- C:\Windows\System\coWjtzI.exe
  C:\Windows\System\coWjtzI.exe
  2⤵
  PID:6892
- C:\Windows\System\KnpYFWJ.exe
  C:\Windows\System\KnpYFWJ.exe
  2⤵
  PID:6292
- C:\Windows\System\pEMWcCu.exe
  C:\Windows\System\pEMWcCu.exe
  2⤵
  PID:6924
- C:\Windows\System\RfmdlAF.exe
  C:\Windows\System\RfmdlAF.exe
  2⤵
  PID:6508
- C:\Windows\System\fpegDQI.exe
  C:\Windows\System\fpegDQI.exe
  2⤵
  PID:6800
- C:\Windows\System\IAXKzhx.exe
  C:\Windows\System\IAXKzhx.exe
  2⤵
  PID:6720
- C:\Windows\System\GdaFngh.exe
  C:\Windows\System\GdaFngh.exe
  2⤵
  PID:7128
- C:\Windows\System\mkWEbeA.exe
  C:\Windows\System\mkWEbeA.exe
  2⤵
  PID:6356
- C:\Windows\System\HMsozzs.exe
  C:\Windows\System\HMsozzs.exe
  2⤵
  PID:6780
- C:\Windows\System\cpUJzJY.exe
  C:\Windows\System\cpUJzJY.exe
  2⤵
  PID:5532
- C:\Windows\System\BQutaGc.exe
  C:\Windows\System\BQutaGc.exe
  2⤵
  PID:6820
- C:\Windows\System\SRxUFNw.exe
  C:\Windows\System\SRxUFNw.exe
  2⤵
  PID:6060
- C:\Windows\System\xBXqNjO.exe
  C:\Windows\System\xBXqNjO.exe
  2⤵
  PID:5968
- C:\Windows\System\qNCzbTE.exe
  C:\Windows\System\qNCzbTE.exe
  2⤵
  PID:6548
- C:\Windows\System\DMeUQvG.exe
  C:\Windows\System\DMeUQvG.exe
  2⤵
  PID:6592
- C:\Windows\System\sIxboso.exe
  C:\Windows\System\sIxboso.exe
  2⤵
  PID:6476
- C:\Windows\System\gfVnsQX.exe
  C:\Windows\System\gfVnsQX.exe
  2⤵
  PID:7068
- C:\Windows\System\OYqHRAy.exe
  C:\Windows\System\OYqHRAy.exe
  2⤵
  PID:5768
- C:\Windows\System\ZhvTaft.exe
  C:\Windows\System\ZhvTaft.exe
  2⤵
  PID:6236
- C:\Windows\System\LhdGjpA.exe
  C:\Windows\System\LhdGjpA.exe
  2⤵
  PID:6848
- C:\Windows\System\ppBABHg.exe
  C:\Windows\System\ppBABHg.exe
  2⤵
  PID:5288
- C:\Windows\System\OhOpwwc.exe
  C:\Windows\System\OhOpwwc.exe
  2⤵
  PID:7052
- C:\Windows\System\HgnOWAB.exe
  C:\Windows\System\HgnOWAB.exe
  2⤵
  PID:6604
- C:\Windows\System\xEQiuta.exe
  C:\Windows\System\xEQiuta.exe
  2⤵
  PID:6272
- C:\Windows\System\CxaKOzk.exe
  C:\Windows\System\CxaKOzk.exe
  2⤵
  PID:6444
- C:\Windows\System\pjrOJop.exe
  C:\Windows\System\pjrOJop.exe
  2⤵
  PID:5536
- C:\Windows\System\XBfmjgx.exe
  C:\Windows\System\XBfmjgx.exe
  2⤵
  PID:6724
- C:\Windows\System\yFSrJKI.exe
  C:\Windows\System\yFSrJKI.exe
  2⤵
  PID:7176
- C:\Windows\System\GlbrYvh.exe
  C:\Windows\System\GlbrYvh.exe
  2⤵
  PID:7192
- C:\Windows\System\QWxVvBo.exe
  C:\Windows\System\QWxVvBo.exe
  2⤵
  PID:7212
- C:\Windows\System\wHBCrMQ.exe
  C:\Windows\System\wHBCrMQ.exe
  2⤵
  PID:7228
- C:\Windows\System\GJnyyUN.exe
  C:\Windows\System\GJnyyUN.exe
  2⤵
  PID:7244
- C:\Windows\System\sgsbmCP.exe
  C:\Windows\System\sgsbmCP.exe
  2⤵
  PID:7260
- C:\Windows\System\UycSgml.exe
  C:\Windows\System\UycSgml.exe
  2⤵
  PID:7276
- C:\Windows\System\tItjdTu.exe
  C:\Windows\System\tItjdTu.exe
  2⤵
  PID:7292
- C:\Windows\System\kocLRly.exe
  C:\Windows\System\kocLRly.exe
  2⤵
  PID:7308
- C:\Windows\System\TezHdDT.exe
  C:\Windows\System\TezHdDT.exe
  2⤵
  PID:7324
- C:\Windows\System\iCNfxgr.exe
  C:\Windows\System\iCNfxgr.exe
  2⤵
  PID:7340
- C:\Windows\System\FIMIBtC.exe
  C:\Windows\System\FIMIBtC.exe
  2⤵
  PID:7356
- C:\Windows\System\bHtGCgI.exe
  C:\Windows\System\bHtGCgI.exe
  2⤵
  PID:7372
- C:\Windows\System\PoNkhGj.exe
  C:\Windows\System\PoNkhGj.exe
  2⤵
  PID:7388
- C:\Windows\System\pCqCLwz.exe
  C:\Windows\System\pCqCLwz.exe
  2⤵
  PID:7404
- C:\Windows\System\qzUnjln.exe
  C:\Windows\System\qzUnjln.exe
  2⤵
  PID:7420
- C:\Windows\System\qJMzJKr.exe
  C:\Windows\System\qJMzJKr.exe
  2⤵
  PID:7436
- C:\Windows\System\zpywrHg.exe
  C:\Windows\System\zpywrHg.exe
  2⤵
  PID:7452
- C:\Windows\System\nMRofnt.exe
  C:\Windows\System\nMRofnt.exe
  2⤵
  PID:7468
- C:\Windows\System\IEXMuqA.exe
  C:\Windows\System\IEXMuqA.exe
  2⤵
  PID:7484
- C:\Windows\System\ETpfcLH.exe
  C:\Windows\System\ETpfcLH.exe
  2⤵
  PID:7500
- C:\Windows\System\evZCcMP.exe
  C:\Windows\System\evZCcMP.exe
  2⤵
  PID:7516
- C:\Windows\System\BvjFqzz.exe
  C:\Windows\System\BvjFqzz.exe
  2⤵
  PID:7532
- C:\Windows\System\RELISJG.exe
  C:\Windows\System\RELISJG.exe
  2⤵
  PID:7548
- C:\Windows\System\SuaGXev.exe
  C:\Windows\System\SuaGXev.exe
  2⤵
  PID:7564
- C:\Windows\System\WNFGhJV.exe
  C:\Windows\System\WNFGhJV.exe
  2⤵
  PID:7580
- C:\Windows\System\svjMhSd.exe
  C:\Windows\System\svjMhSd.exe
  2⤵
  PID:7596
- C:\Windows\System\FuXDwDC.exe
  C:\Windows\System\FuXDwDC.exe
  2⤵
  PID:7612
- C:\Windows\System\kBjwYcj.exe
  C:\Windows\System\kBjwYcj.exe
  2⤵
  PID:7628
- C:\Windows\System\nDYmtry.exe
  C:\Windows\System\nDYmtry.exe
  2⤵
  PID:7644
- C:\Windows\System\isHiCnP.exe
  C:\Windows\System\isHiCnP.exe
  2⤵
  PID:7660
- C:\Windows\System\OynmGEP.exe
  C:\Windows\System\OynmGEP.exe
  2⤵
  PID:7676
- C:\Windows\System\adizUJq.exe
  C:\Windows\System\adizUJq.exe
  2⤵
  PID:7692
- C:\Windows\System\QTUTKdp.exe
  C:\Windows\System\QTUTKdp.exe
  2⤵
  PID:7708
- C:\Windows\System\RAgKErP.exe
  C:\Windows\System\RAgKErP.exe
  2⤵
  PID:7724
- C:\Windows\System\pcryWkr.exe
  C:\Windows\System\pcryWkr.exe
  2⤵
  PID:7740
- C:\Windows\System\HXCIQqe.exe
  C:\Windows\System\HXCIQqe.exe
  2⤵
  PID:7756
- C:\Windows\System\kMdekoR.exe
  C:\Windows\System\kMdekoR.exe
  2⤵
  PID:7772
- C:\Windows\System\RixFvyF.exe
  C:\Windows\System\RixFvyF.exe
  2⤵
  PID:7788
- C:\Windows\System\SRBbVDN.exe
  C:\Windows\System\SRBbVDN.exe
  2⤵
  PID:7804
- C:\Windows\System\OkQHtcq.exe
  C:\Windows\System\OkQHtcq.exe
  2⤵
  PID:7860
- C:\Windows\System\FQlJNmB.exe
  C:\Windows\System\FQlJNmB.exe
  2⤵
  PID:7876
- C:\Windows\System\tJTscre.exe
  C:\Windows\System\tJTscre.exe
  2⤵
  PID:7892
- C:\Windows\System\Yrusxsk.exe
  C:\Windows\System\Yrusxsk.exe
  2⤵
  PID:7908
- C:\Windows\System\ccTbZOT.exe
  C:\Windows\System\ccTbZOT.exe
  2⤵
  PID:7924
- C:\Windows\System\Vzvmmzc.exe
  C:\Windows\System\Vzvmmzc.exe
  2⤵
  PID:8064
- C:\Windows\System\nNEntoa.exe
  C:\Windows\System\nNEntoa.exe
  2⤵
  PID:8080
- C:\Windows\System\UjmrZHC.exe
  C:\Windows\System\UjmrZHC.exe
  2⤵
  PID:8100
- C:\Windows\System\PhEjIzE.exe
  C:\Windows\System\PhEjIzE.exe
  2⤵
  PID:8116
- C:\Windows\System\DhzhYhe.exe
  C:\Windows\System\DhzhYhe.exe
  2⤵
  PID:8132
- C:\Windows\System\FZZWSTD.exe
  C:\Windows\System\FZZWSTD.exe
  2⤵
  PID:8148
- C:\Windows\System\TcoGXIw.exe
  C:\Windows\System\TcoGXIw.exe
  2⤵
  PID:8164
- C:\Windows\System\yTPSKih.exe
  C:\Windows\System\yTPSKih.exe
  2⤵
  PID:8180
- C:\Windows\System\iaGAbHI.exe
  C:\Windows\System\iaGAbHI.exe
  2⤵
  PID:6576
- C:\Windows\System\OSBAcMu.exe
  C:\Windows\System\OSBAcMu.exe
  2⤵
  PID:7208
- C:\Windows\System\bQEIoYt.exe
  C:\Windows\System\bQEIoYt.exe
  2⤵
  PID:6304
- C:\Windows\System\ucoZJWa.exe
  C:\Windows\System\ucoZJWa.exe
  2⤵
  PID:6572
- C:\Windows\System\vAJIpXy.exe
  C:\Windows\System\vAJIpXy.exe
  2⤵
  PID:7088
- C:\Windows\System\tUbEDKo.exe
  C:\Windows\System\tUbEDKo.exe
  2⤵
  PID:7236
- C:\Windows\System\HiRIqTy.exe
  C:\Windows\System\HiRIqTy.exe
  2⤵
  PID:7300
- C:\Windows\System\MRrcvNO.exe
  C:\Windows\System\MRrcvNO.exe
  2⤵
  PID:7368
- C:\Windows\System\iPbtuMO.exe
  C:\Windows\System\iPbtuMO.exe
  2⤵
  PID:7432
- C:\Windows\System\daMyNJQ.exe
  C:\Windows\System\daMyNJQ.exe
  2⤵
  PID:7348
- C:\Windows\System\cupIsWj.exe
  C:\Windows\System\cupIsWj.exe
  2⤵
  PID:7224
- C:\Windows\System\DehWGQE.exe
  C:\Windows\System\DehWGQE.exe
  2⤵
  PID:7288
- C:\Windows\System\pAHcsuR.exe
  C:\Windows\System\pAHcsuR.exe
  2⤵
  PID:7412
- C:\Windows\System\SauuGby.exe
  C:\Windows\System\SauuGby.exe
  2⤵
  PID:7480
- C:\Windows\System\zxZkfha.exe
  C:\Windows\System\zxZkfha.exe
  2⤵
  PID:7512
- C:\Windows\System\ZwxbaIL.exe
  C:\Windows\System\ZwxbaIL.exe
  2⤵
  PID:7576
- C:\Windows\System\MQFcGxU.exe
  C:\Windows\System\MQFcGxU.exe
  2⤵
  PID:7588
- C:\Windows\System\KJxbyWr.exe
  C:\Windows\System\KJxbyWr.exe
  2⤵
  PID:7652
- C:\Windows\System\maguaZh.exe
  C:\Windows\System\maguaZh.exe
  2⤵
  PID:7716
- C:\Windows\System\jwSpUVw.exe
  C:\Windows\System\jwSpUVw.exe
  2⤵
  PID:7704
- C:\Windows\System\RXpScHw.exe
  C:\Windows\System\RXpScHw.exe
  2⤵
  PID:7640
- C:\Windows\System\ZJNURZK.exe
  C:\Windows\System\ZJNURZK.exe
  2⤵
  PID:7812
- C:\Windows\System\ZppqSxX.exe
  C:\Windows\System\ZppqSxX.exe
  2⤵
  PID:7736
- C:\Windows\System\AHEpXkR.exe
  C:\Windows\System\AHEpXkR.exe
  2⤵
  PID:7104
- C:\Windows\System\neoaieA.exe
  C:\Windows\System\neoaieA.exe
  2⤵
  PID:7832
- C:\Windows\System\BbZhnNt.exe
  C:\Windows\System\BbZhnNt.exe
  2⤵
  PID:8000
- C:\Windows\System\zZhclap.exe
  C:\Windows\System\zZhclap.exe
  2⤵
  PID:8016
- C:\Windows\System\qyREVpi.exe
  C:\Windows\System\qyREVpi.exe
  2⤵
  PID:8032
- C:\Windows\System\hdwwKqR.exe
  C:\Windows\System\hdwwKqR.exe
  2⤵
  PID:8048
- C:\Windows\System\FdaZHML.exe
  C:\Windows\System\FdaZHML.exe
  2⤵
  PID:8088
- C:\Windows\System\oNcgfGD.exe
  C:\Windows\System\oNcgfGD.exe
  2⤵
  PID:8128
- C:\Windows\System\CXmYUQJ.exe
  C:\Windows\System\CXmYUQJ.exe
  2⤵
  PID:8144
- C:\Windows\System\Frkbccr.exe
  C:\Windows\System\Frkbccr.exe
  2⤵
  PID:8160
- C:\Windows\System\DNwqQMW.exe
  C:\Windows\System\DNwqQMW.exe
  2⤵
  PID:6524
- C:\Windows\System\Dnmqxrl.exe
  C:\Windows\System\Dnmqxrl.exe
  2⤵
  PID:7200
- C:\Windows\System\zouYBze.exe
  C:\Windows\System\zouYBze.exe
  2⤵
  PID:5480
- C:\Windows\System\tCNDSnP.exe
  C:\Windows\System\tCNDSnP.exe
  2⤵
  PID:7272
- C:\Windows\System\tBQNoUJ.exe
  C:\Windows\System\tBQNoUJ.exe
  2⤵
  PID:7428
- C:\Windows\System\NMCVgLV.exe
  C:\Windows\System\NMCVgLV.exe
  2⤵
  PID:7380
- C:\Windows\System\CVceAcz.exe
  C:\Windows\System\CVceAcz.exe
  2⤵
  PID:7544
- C:\Windows\System\CMRURgS.exe
  C:\Windows\System\CMRURgS.exe
  2⤵
  PID:7284
- C:\Windows\System\jhCAPCu.exe
  C:\Windows\System\jhCAPCu.exe
  2⤵
  PID:7620
- C:\Windows\System\VVZICuz.exe
  C:\Windows\System\VVZICuz.exe
  2⤵
  PID:7672
- C:\Windows\System\rPLTxRO.exe
  C:\Windows\System\rPLTxRO.exe
  2⤵
  PID:7560
- C:\Windows\System\uexsCkf.exe
  C:\Windows\System\uexsCkf.exe
  2⤵
  PID:7768
- C:\Windows\System\XgrJTKR.exe
  C:\Windows\System\XgrJTKR.exe
  2⤵
  PID:7828
- C:\Windows\System\lwniEfJ.exe
  C:\Windows\System\lwniEfJ.exe
  2⤵
  PID:7844
- C:\Windows\System\DAMjKck.exe
  C:\Windows\System\DAMjKck.exe
  2⤵
  PID:7872
- C:\Windows\System\npMcJgy.exe
  C:\Windows\System\npMcJgy.exe
  2⤵
  PID:7868
- C:\Windows\System\ShARImR.exe
  C:\Windows\System\ShARImR.exe
  2⤵
  PID:7920
- C:\Windows\System\OYSrYnn.exe
  C:\Windows\System\OYSrYnn.exe
  2⤵
  PID:7944
- C:\Windows\System\yPDgSkt.exe
  C:\Windows\System\yPDgSkt.exe
  2⤵
  PID:7968
- C:\Windows\System\QCfbHEy.exe
  C:\Windows\System\QCfbHEy.exe
  2⤵
  PID:7980
- C:\Windows\System\ufnMXcv.exe
  C:\Windows\System\ufnMXcv.exe
  2⤵
  PID:7988
- C:\Windows\System\kftzGUr.exe
  C:\Windows\System\kftzGUr.exe
  2⤵
  PID:8076
- C:\Windows\System\LAsqOXW.exe
  C:\Windows\System\LAsqOXW.exe
  2⤵
  PID:8024
- C:\Windows\System\IYbrKCr.exe
  C:\Windows\System\IYbrKCr.exe
  2⤵
  PID:7268
- C:\Windows\System\zcqZakU.exe
  C:\Windows\System\zcqZakU.exe
  2⤵
  PID:7476
- C:\Windows\System\eTvTKgZ.exe
  C:\Windows\System\eTvTKgZ.exe
  2⤵
  PID:7732
- C:\Windows\System\LSTlVwr.exe
  C:\Windows\System\LSTlVwr.exe
  2⤵
  PID:7824
- C:\Windows\System\zVltbsO.exe
  C:\Windows\System\zVltbsO.exe
  2⤵
  PID:7956
- C:\Windows\System\sakQaad.exe
  C:\Windows\System\sakQaad.exe
  2⤵
  PID:8096
- C:\Windows\System\sPNwaSM.exe
  C:\Windows\System\sPNwaSM.exe
  2⤵
  PID:8176
- C:\Windows\System\dhAcQhP.exe
  C:\Windows\System\dhAcQhP.exe
  2⤵
  PID:7220
- C:\Windows\System\daPznqH.exe
  C:\Windows\System\daPznqH.exe
  2⤵
  PID:8060
- C:\Windows\System\PbIuGSr.exe
  C:\Windows\System\PbIuGSr.exe
  2⤵
  PID:7508
- C:\Windows\System\oIVcsbX.exe
  C:\Windows\System\oIVcsbX.exe
  2⤵
  PID:7608
- C:\Windows\System\NNMKFvf.exe
  C:\Windows\System\NNMKFvf.exe
  2⤵
  PID:7940
- C:\Windows\System\gCsfdkI.exe
  C:\Windows\System\gCsfdkI.exe
  2⤵
  PID:7932
- C:\Windows\System\gcAsQYK.exe
  C:\Windows\System\gcAsQYK.exe
  2⤵
  PID:8172
- C:\Windows\System\dcFSKfz.exe
  C:\Windows\System\dcFSKfz.exe
  2⤵
  PID:7848
- C:\Windows\System\KlVOTtM.exe
  C:\Windows\System\KlVOTtM.exe
  2⤵
  PID:7972
- C:\Windows\System\OKDetMq.exe
  C:\Windows\System\OKDetMq.exe
  2⤵
  PID:7840
- C:\Windows\System\DpiZEfX.exe
  C:\Windows\System\DpiZEfX.exe
  2⤵
  PID:7332
- C:\Windows\System\UcvlAjh.exe
  C:\Windows\System\UcvlAjh.exe
  2⤵
  PID:8200
- C:\Windows\System\fUFrdhL.exe
  C:\Windows\System\fUFrdhL.exe
  2⤵
  PID:8216
- C:\Windows\System\RiVAknp.exe
  C:\Windows\System\RiVAknp.exe
  2⤵
  PID:8232
- C:\Windows\System\DqwmmAL.exe
  C:\Windows\System\DqwmmAL.exe
  2⤵
  PID:8248
- C:\Windows\System\QhguavR.exe
  C:\Windows\System\QhguavR.exe
  2⤵
  PID:8264
- C:\Windows\System\ySScyRC.exe
  C:\Windows\System\ySScyRC.exe
  2⤵
  PID:8280
- C:\Windows\System\ryHGsrA.exe
  C:\Windows\System\ryHGsrA.exe
  2⤵
  PID:8420
- C:\Windows\System\Fbhrbry.exe
  C:\Windows\System\Fbhrbry.exe
  2⤵
  PID:8436
- C:\Windows\System\ieXuevu.exe
  C:\Windows\System\ieXuevu.exe
  2⤵
  PID:8452
- C:\Windows\System\FltwYNV.exe
  C:\Windows\System\FltwYNV.exe
  2⤵
  PID:8468
- C:\Windows\System\tzfWktW.exe
  C:\Windows\System\tzfWktW.exe
  2⤵
  PID:8488
- C:\Windows\System\cWZvKuk.exe
  C:\Windows\System\cWZvKuk.exe
  2⤵
  PID:8504
- C:\Windows\System\UiFBPek.exe
  C:\Windows\System\UiFBPek.exe
  2⤵
  PID:8520
- C:\Windows\System\NuesYSC.exe
  C:\Windows\System\NuesYSC.exe
  2⤵
  PID:8540
- C:\Windows\System\jRIRpll.exe
  C:\Windows\System\jRIRpll.exe
  2⤵
  PID:8556
- C:\Windows\System\WHLpiso.exe
  C:\Windows\System\WHLpiso.exe
  2⤵
  PID:8572
- C:\Windows\System\TnCvdmC.exe
  C:\Windows\System\TnCvdmC.exe
  2⤵
  PID:8588
- C:\Windows\System\pDLrXUk.exe
  C:\Windows\System\pDLrXUk.exe
  2⤵
  PID:8608
- C:\Windows\System\LQYcpRI.exe
  C:\Windows\System\LQYcpRI.exe
  2⤵
  PID:8628
- C:\Windows\System\QmwQYwI.exe
  C:\Windows\System\QmwQYwI.exe
  2⤵
  PID:8644
- C:\Windows\System\HqMkAGL.exe
  C:\Windows\System\HqMkAGL.exe
  2⤵
  PID:8660
- C:\Windows\System\vbGsUxf.exe
  C:\Windows\System\vbGsUxf.exe
  2⤵
  PID:8676
- C:\Windows\System\HLUsRMZ.exe
  C:\Windows\System\HLUsRMZ.exe
  2⤵
  PID:8696
- C:\Windows\System\LmgQyDd.exe
  C:\Windows\System\LmgQyDd.exe
  2⤵
  PID:8712
- C:\Windows\System\gIWGisT.exe
  C:\Windows\System\gIWGisT.exe
  2⤵
  PID:8728
- C:\Windows\System\jDKYnPh.exe
  C:\Windows\System\jDKYnPh.exe
  2⤵
  PID:8744
- C:\Windows\System\beTYkLi.exe
  C:\Windows\System\beTYkLi.exe
  2⤵
  PID:8760
- C:\Windows\System\VcOxnJQ.exe
  C:\Windows\System\VcOxnJQ.exe
  2⤵
  PID:8776
- C:\Windows\System\BZIHfrN.exe
  C:\Windows\System\BZIHfrN.exe
  2⤵
  PID:8792
- C:\Windows\System\rlrQMtq.exe
  C:\Windows\System\rlrQMtq.exe
  2⤵
  PID:8808
- C:\Windows\System\ApiMKYU.exe
  C:\Windows\System\ApiMKYU.exe
  2⤵
  PID:8824
- C:\Windows\System\OVkCJXy.exe
  C:\Windows\System\OVkCJXy.exe
  2⤵
  PID:8840
- C:\Windows\System\vCwElLS.exe
  C:\Windows\System\vCwElLS.exe
  2⤵
  PID:8856
- C:\Windows\System\QmNWxEl.exe
  C:\Windows\System\QmNWxEl.exe
  2⤵
  PID:8872
- C:\Windows\System\VAgpRZS.exe
  C:\Windows\System\VAgpRZS.exe
  2⤵
  PID:8892
- C:\Windows\System\gQPZkQt.exe
  C:\Windows\System\gQPZkQt.exe
  2⤵
  PID:8908
- C:\Windows\System\LuZjZok.exe
  C:\Windows\System\LuZjZok.exe
  2⤵
  PID:8924
- C:\Windows\System\RDBOfAb.exe
  C:\Windows\System\RDBOfAb.exe
  2⤵
  PID:8944
- C:\Windows\System\vPEPoEt.exe
  C:\Windows\System\vPEPoEt.exe
  2⤵
  PID:8960
- C:\Windows\System\ovVVRAT.exe
  C:\Windows\System\ovVVRAT.exe
  2⤵
  PID:8976
- C:\Windows\System\qIsJoeE.exe
  C:\Windows\System\qIsJoeE.exe
  2⤵
  PID:8996
- C:\Windows\System\LieyinD.exe
  C:\Windows\System\LieyinD.exe
  2⤵
  PID:9012
- C:\Windows\System\wQAkssc.exe
  C:\Windows\System\wQAkssc.exe
  2⤵
  PID:9028
- C:\Windows\System\rismXju.exe
  C:\Windows\System\rismXju.exe
  2⤵
  PID:9044
- C:\Windows\System\ZjCiKqr.exe
  C:\Windows\System\ZjCiKqr.exe
  2⤵
  PID:9060
- C:\Windows\System\jizyDFK.exe
  C:\Windows\System\jizyDFK.exe
  2⤵
  PID:9076
- C:\Windows\System\SWfZTNV.exe
  C:\Windows\System\SWfZTNV.exe
  2⤵
  PID:9092
- C:\Windows\System\aljGXRc.exe
  C:\Windows\System\aljGXRc.exe
  2⤵
  PID:9108
- C:\Windows\System\AMFuxso.exe
  C:\Windows\System\AMFuxso.exe
  2⤵
  PID:9128
- C:\Windows\System\KMIBkVU.exe
  C:\Windows\System\KMIBkVU.exe
  2⤵
  PID:9144
- C:\Windows\System\RjDQtYD.exe
  C:\Windows\System\RjDQtYD.exe
  2⤵
  PID:9164
- C:\Windows\System\OMcREcK.exe
  C:\Windows\System\OMcREcK.exe
  2⤵
  PID:9180
- C:\Windows\System\nJgrtOU.exe
  C:\Windows\System\nJgrtOU.exe
  2⤵
  PID:9196
- C:\Windows\System\SajvSxN.exe
  C:\Windows\System\SajvSxN.exe
  2⤵
  PID:9212
- C:\Windows\System\HntouHl.exe
  C:\Windows\System\HntouHl.exe
  2⤵
  PID:7496
- C:\Windows\System\RUtzkxQ.exe
  C:\Windows\System\RUtzkxQ.exe
  2⤵
  PID:7336
- C:\Windows\System\FZzRymI.exe
  C:\Windows\System\FZzRymI.exe
  2⤵
  PID:8112
- C:\Windows\System\jXgNbqb.exe
  C:\Windows\System\jXgNbqb.exe
  2⤵
  PID:8124
- C:\Windows\System\moRikOD.exe
  C:\Windows\System\moRikOD.exe
  2⤵
  PID:8156
- C:\Windows\System\WeSXWUm.exe
  C:\Windows\System\WeSXWUm.exe
  2⤵
  PID:8276
- C:\Windows\System\xtREhgS.exe
  C:\Windows\System\xtREhgS.exe
  2⤵
  PID:8228
- C:\Windows\System\htiQfyS.exe
  C:\Windows\System\htiQfyS.exe
  2⤵
  PID:8304
- C:\Windows\System\SullZcq.exe
  C:\Windows\System\SullZcq.exe
  2⤵
  PID:8316
- C:\Windows\System\bOARojY.exe
  C:\Windows\System\bOARojY.exe
  2⤵
  PID:8336
- C:\Windows\System\gYWgdYh.exe
  C:\Windows\System\gYWgdYh.exe
  2⤵
  PID:8348
- C:\Windows\System\QfBbJhh.exe
  C:\Windows\System\QfBbJhh.exe
  2⤵
  PID:8364
- C:\Windows\System\rkypnIC.exe
  C:\Windows\System\rkypnIC.exe
  2⤵
  PID:8392
- C:\Windows\System\EfSfDbW.exe
  C:\Windows\System\EfSfDbW.exe
  2⤵
  PID:8412
- C:\Windows\System\SdWAAzw.exe
  C:\Windows\System\SdWAAzw.exe
  2⤵
  PID:8432
- C:\Windows\System\dneFFsR.exe
  C:\Windows\System\dneFFsR.exe
  2⤵
  PID:8532
- C:\Windows\System\WcdDcoi.exe
  C:\Windows\System\WcdDcoi.exe
  2⤵
  PID:8528
- C:\Windows\System\rwYIHZS.exe
  C:\Windows\System\rwYIHZS.exe
  2⤵
  PID:8568
- C:\Windows\System\CKUdnQx.exe
  C:\Windows\System\CKUdnQx.exe
  2⤵
  PID:8672
- C:\Windows\System\bHZeSzc.exe
  C:\Windows\System\bHZeSzc.exe
  2⤵
  PID:8740
- C:\Windows\System\SGLxHvw.exe
  C:\Windows\System\SGLxHvw.exe
  2⤵
  PID:8804
- C:\Windows\System\OMmQFBg.exe
  C:\Windows\System\OMmQFBg.exe
  2⤵
  PID:8868
- C:\Windows\System\gFwMHJT.exe
  C:\Windows\System\gFwMHJT.exe
  2⤵
  PID:8936
- C:\Windows\System\lgDXREN.exe
  C:\Windows\System\lgDXREN.exe
  2⤵
  PID:9004
- C:\Windows\System\XNhPhnE.exe
  C:\Windows\System\XNhPhnE.exe
  2⤵
  PID:9072
- C:\Windows\System\ZnbNpfn.exe
  C:\Windows\System\ZnbNpfn.exe
  2⤵
  PID:8512
- C:\Windows\System\XnQISlW.exe
  C:\Windows\System\XnQISlW.exe
  2⤵
  PID:9204
- C:\Windows\System\tylITah.exe
  C:\Windows\System\tylITah.exe
  2⤵
  PID:8580
- C:\Windows\System\sHiTPSL.exe
  C:\Windows\System\sHiTPSL.exe
  2⤵
  PID:8788
- C:\Windows\System\SVmBTsc.exe
  C:\Windows\System\SVmBTsc.exe
  2⤵
  PID:8480
- C:\Windows\System\jymcxUH.exe
  C:\Windows\System\jymcxUH.exe
  2⤵
  PID:7636
- C:\Windows\System\thRqLEp.exe
  C:\Windows\System\thRqLEp.exe
  2⤵
  PID:8688
- C:\Windows\System\RlgCoDq.exe
  C:\Windows\System\RlgCoDq.exe
  2⤵
  PID:8752
- C:\Windows\System\hOyBAid.exe
  C:\Windows\System\hOyBAid.exe
  2⤵
  PID:8852
- C:\Windows\System\UtmIYNb.exe
  C:\Windows\System\UtmIYNb.exe
  2⤵
  PID:8920
- C:\Windows\System\DEXWYCi.exe
  C:\Windows\System\DEXWYCi.exe
  2⤵
  PID:8988
- C:\Windows\System\dAESRPd.exe
  C:\Windows\System\dAESRPd.exe
  2⤵
  PID:9052
- C:\Windows\System\WsEuBNS.exe
  C:\Windows\System\WsEuBNS.exe
  2⤵
  PID:9116
- C:\Windows\System\gmUZLtV.exe
  C:\Windows\System\gmUZLtV.exe
  2⤵
  PID:9156
- C:\Windows\System\JAmmzXH.exe
  C:\Windows\System\JAmmzXH.exe
  2⤵
  PID:7960
- C:\Windows\System\hUUGNvk.exe
  C:\Windows\System\hUUGNvk.exe
  2⤵
  PID:7952
- C:\Windows\System\mklEJxf.exe
  C:\Windows\System\mklEJxf.exe
  2⤵
  PID:8272
- C:\Windows\System\JlbSUrD.exe
  C:\Windows\System\JlbSUrD.exe
  2⤵
  PID:8376
- C:\Windows\System\oVgWVFi.exe
  C:\Windows\System\oVgWVFi.exe
  2⤵
  PID:8500
- C:\Windows\System\OdvhFLN.exe
  C:\Windows\System\OdvhFLN.exe
  2⤵
  PID:8704
- C:\Windows\System\BuwcLCL.exe
  C:\Windows\System\BuwcLCL.exe
  2⤵
  PID:8968
- C:\Windows\System\WPqXlWj.exe
  C:\Windows\System\WPqXlWj.exe
  2⤵
  PID:8668
- C:\Windows\System\QhoNMBr.exe
  C:\Windows\System\QhoNMBr.exe
  2⤵
  PID:8292
- C:\Windows\System\ZmVJYXj.exe
  C:\Windows\System\ZmVJYXj.exe
  2⤵
  PID:5188
- C:\Windows\System\gflOCXg.exe
  C:\Windows\System\gflOCXg.exe
  2⤵
  PID:8380
- C:\Windows\System\hlDkeoX.exe
  C:\Windows\System\hlDkeoX.exe
  2⤵
  PID:8800
- C:\Windows\System\WnWXLhM.exe
  C:\Windows\System\WnWXLhM.exe
  2⤵
  PID:9104
- C:\Windows\System\HRrCVpS.exe
  C:\Windows\System\HRrCVpS.exe
  2⤵
  PID:8848
- C:\Windows\System\zehGtiP.exe
  C:\Windows\System\zehGtiP.exe
  2⤵
  PID:8816
- C:\Windows\System\cfnpmJY.exe
  C:\Windows\System\cfnpmJY.exe
  2⤵
  PID:9084
- C:\Windows\System\qUhNXYr.exe
  C:\Windows\System\qUhNXYr.exe
  2⤵
  PID:8584
- C:\Windows\System\vBgGyzB.exe
  C:\Windows\System\vBgGyzB.exe
  2⤵
  PID:9188
- C:\Windows\System\aqzQcXL.exe
  C:\Windows\System\aqzQcXL.exe
  2⤵
  PID:9020
- C:\Windows\System\KrXONGZ.exe
  C:\Windows\System\KrXONGZ.exe
  2⤵
  PID:9268
- C:\Windows\System\ZvQTAAo.exe
  C:\Windows\System\ZvQTAAo.exe
  2⤵
  PID:9288
- C:\Windows\System\QNmcXuU.exe
  C:\Windows\System\QNmcXuU.exe
  2⤵
  PID:9304
- C:\Windows\System\sAhDElJ.exe
  C:\Windows\System\sAhDElJ.exe
  2⤵
  PID:9320
- C:\Windows\System\cPSFYKU.exe
  C:\Windows\System\cPSFYKU.exe
  2⤵
  PID:9336
- C:\Windows\System\hWZrXOQ.exe
  C:\Windows\System\hWZrXOQ.exe
  2⤵
  PID:9356
- C:\Windows\System\plUAFjZ.exe
  C:\Windows\System\plUAFjZ.exe
  2⤵
  PID:9372
- C:\Windows\System\CMEdBtW.exe
  C:\Windows\System\CMEdBtW.exe
  2⤵
  PID:9388
- C:\Windows\System\JECItIo.exe
  C:\Windows\System\JECItIo.exe
  2⤵
  PID:9408
- C:\Windows\System\kiGWSlO.exe
  C:\Windows\System\kiGWSlO.exe
  2⤵
  PID:9424
- C:\Windows\System\tMdSKif.exe
  C:\Windows\System\tMdSKif.exe
  2⤵
  PID:9440
- C:\Windows\System\EpYDvch.exe
  C:\Windows\System\EpYDvch.exe
  2⤵
  PID:9456
- C:\Windows\System\SAmmAKg.exe
  C:\Windows\System\SAmmAKg.exe
  2⤵
  PID:9472
- C:\Windows\System\KfmnaJp.exe
  C:\Windows\System\KfmnaJp.exe
  2⤵
  PID:9492
- C:\Windows\System\OvPeHyQ.exe
  C:\Windows\System\OvPeHyQ.exe
  2⤵
  PID:9512
- C:\Windows\System\YbQhqLl.exe
  C:\Windows\System\YbQhqLl.exe
  2⤵
  PID:9528
- C:\Windows\System\ckOZsbw.exe
  C:\Windows\System\ckOZsbw.exe
  2⤵
  PID:9544
- C:\Windows\System\kwqYrou.exe
  C:\Windows\System\kwqYrou.exe
  2⤵
  PID:9560
- C:\Windows\System\XcyeqLw.exe
  C:\Windows\System\XcyeqLw.exe
  2⤵
  PID:9576
- C:\Windows\System\JydXyuc.exe
  C:\Windows\System\JydXyuc.exe
  2⤵
  PID:9592
- C:\Windows\System\jMGXjjX.exe
  C:\Windows\System\jMGXjjX.exe
  2⤵
  PID:9608
- C:\Windows\System\BHZWwPt.exe
  C:\Windows\System\BHZWwPt.exe
  2⤵
  PID:9624
- C:\Windows\System\RwAOlUv.exe
  C:\Windows\System\RwAOlUv.exe
  2⤵
  PID:9640
- C:\Windows\System\hxhoctu.exe
  C:\Windows\System\hxhoctu.exe
  2⤵
  PID:9656
- C:\Windows\System\NAJOBzU.exe
  C:\Windows\System\NAJOBzU.exe
  2⤵
  PID:9672
- C:\Windows\System\JvtNCUu.exe
  C:\Windows\System\JvtNCUu.exe
  2⤵
  PID:9688
- C:\Windows\System\tUlVRCn.exe
  C:\Windows\System\tUlVRCn.exe
  2⤵
  PID:9704
- C:\Windows\System\cDwrOsD.exe
  C:\Windows\System\cDwrOsD.exe
  2⤵
  PID:9720
- C:\Windows\System\ZQWUrgO.exe
  C:\Windows\System\ZQWUrgO.exe
  2⤵
  PID:9736
- C:\Windows\System\iFSvhAA.exe
  C:\Windows\System\iFSvhAA.exe
  2⤵
  PID:9752
- C:\Windows\System\GviTrYB.exe
  C:\Windows\System\GviTrYB.exe
  2⤵
  PID:9768
- C:\Windows\System\aJihIcH.exe
  C:\Windows\System\aJihIcH.exe
  2⤵
  PID:9784
- C:\Windows\System\aMTUZEE.exe
  C:\Windows\System\aMTUZEE.exe
  2⤵
  PID:9800
- C:\Windows\System\LKZjgHo.exe
  C:\Windows\System\LKZjgHo.exe
  2⤵
  PID:9816
- C:\Windows\System\usrDJMv.exe
  C:\Windows\System\usrDJMv.exe
  2⤵
  PID:9832
- C:\Windows\System\PldpsHr.exe
  C:\Windows\System\PldpsHr.exe
  2⤵
  PID:9848
- C:\Windows\System\MxfJhbc.exe
  C:\Windows\System\MxfJhbc.exe
  2⤵
  PID:9864
- C:\Windows\System\grevaIt.exe
  C:\Windows\System\grevaIt.exe
  2⤵
  PID:9880
- C:\Windows\System\jQpapFi.exe
  C:\Windows\System\jQpapFi.exe
  2⤵
  PID:9896
- C:\Windows\System\MdfzdTF.exe
  C:\Windows\System\MdfzdTF.exe
  2⤵
  PID:9912
- C:\Windows\System\MsntUQG.exe
  C:\Windows\System\MsntUQG.exe
  2⤵
  PID:9928
- C:\Windows\System\PSUKuQK.exe
  C:\Windows\System\PSUKuQK.exe
  2⤵
  PID:9944
- C:\Windows\System\eDTzdtN.exe
  C:\Windows\System\eDTzdtN.exe
  2⤵
  PID:9960
- C:\Windows\System\JJvygZb.exe
  C:\Windows\System\JJvygZb.exe
  2⤵
  PID:9976
- C:\Windows\System\UVzriIf.exe
  C:\Windows\System\UVzriIf.exe
  2⤵
  PID:9992
- C:\Windows\System\gmqNWus.exe
  C:\Windows\System\gmqNWus.exe
  2⤵
  PID:10008
- C:\Windows\System\LsOaapA.exe
  C:\Windows\System\LsOaapA.exe
  2⤵
  PID:10024
- C:\Windows\System\kTxyuok.exe
  C:\Windows\System\kTxyuok.exe
  2⤵
  PID:10040
- C:\Windows\System\WkraeyX.exe
  C:\Windows\System\WkraeyX.exe
  2⤵
  PID:10056
- C:\Windows\System\gLLFsGO.exe
  C:\Windows\System\gLLFsGO.exe
  2⤵
  PID:10072
- C:\Windows\System\gNXCPHZ.exe
  C:\Windows\System\gNXCPHZ.exe
  2⤵
  PID:10088
- C:\Windows\System\VNpRXac.exe
  C:\Windows\System\VNpRXac.exe
  2⤵
  PID:10104
- C:\Windows\System\HUCfhKz.exe
  C:\Windows\System\HUCfhKz.exe
  2⤵
  PID:10120
- C:\Windows\System\tXlEFbw.exe
  C:\Windows\System\tXlEFbw.exe
  2⤵
  PID:10136
- C:\Windows\System\IaWpywf.exe
  C:\Windows\System\IaWpywf.exe
  2⤵
  PID:10152
- C:\Windows\System\SrsHaHL.exe
  C:\Windows\System\SrsHaHL.exe
  2⤵
  PID:10168
- C:\Windows\System\cfODZlk.exe
  C:\Windows\System\cfODZlk.exe
  2⤵
  PID:10184
- C:\Windows\System\iZDZZGX.exe
  C:\Windows\System\iZDZZGX.exe
  2⤵
  PID:10200
- C:\Windows\System\rNZzdLe.exe
  C:\Windows\System\rNZzdLe.exe
  2⤵
  PID:10216
- C:\Windows\System\CEHoUUT.exe
  C:\Windows\System\CEHoUUT.exe
  2⤵
  PID:10232
- C:\Windows\System\oBNYSxR.exe
  C:\Windows\System\oBNYSxR.exe
  2⤵
  PID:8400
- C:\Windows\System\qBRgXRI.exe
  C:\Windows\System\qBRgXRI.exe
  2⤵
  PID:8836
- C:\Windows\System\YlqBvAg.exe
  C:\Windows\System\YlqBvAg.exe
  2⤵
  PID:8260
- C:\Windows\System\jXlqxGw.exe
  C:\Windows\System\jXlqxGw.exe
  2⤵
  PID:9068
- C:\Windows\System\LWadzMR.exe
  C:\Windows\System\LWadzMR.exe
  2⤵
  PID:8656
- C:\Windows\System\kDCfujK.exe
  C:\Windows\System\kDCfujK.exe
  2⤵
  PID:8916
- C:\Windows\System\hCFEpom.exe
  C:\Windows\System\hCFEpom.exe
  2⤵
  PID:7684
- C:\Windows\System\VMvvapC.exe
  C:\Windows\System\VMvvapC.exe
  2⤵
  PID:9124
- C:\Windows\System\WTCriTR.exe
  C:\Windows\System\WTCriTR.exe
  2⤵
  PID:8604
- C:\Windows\System\ydVykck.exe
  C:\Windows\System\ydVykck.exe
  2⤵
  PID:8904
- C:\Windows\System\yNDNTPk.exe
  C:\Windows\System\yNDNTPk.exe
  2⤵
  PID:8516
- C:\Windows\System\XOPTLnZ.exe
  C:\Windows\System\XOPTLnZ.exe
  2⤵
  PID:8756
- C:\Windows\System\dHZqaJi.exe
  C:\Windows\System\dHZqaJi.exe
  2⤵
  PID:9228
- C:\Windows\System\WTDJLPD.exe
  C:\Windows\System\WTDJLPD.exe
  2⤵
  PID:9244
- C:\Windows\System\jAYaVmc.exe
  C:\Windows\System\jAYaVmc.exe
  2⤵
  PID:8012
- C:\Windows\System\GQYuxXn.exe
  C:\Windows\System\GQYuxXn.exe
  2⤵
  PID:9280
- C:\Windows\System\JLPkntI.exe
  C:\Windows\System\JLPkntI.exe
  2⤵
  PID:9348
- C:\Windows\System\cJwpNRM.exe
  C:\Windows\System\cJwpNRM.exe
  2⤵
  PID:9296
- C:\Windows\System\pROGmws.exe
  C:\Windows\System\pROGmws.exe
  2⤵
  PID:9364
- C:\Windows\System\XzbVoda.exe
  C:\Windows\System\XzbVoda.exe
  2⤵
  PID:9416
- C:\Windows\System\HieIIWt.exe
  C:\Windows\System\HieIIWt.exe
  2⤵
  PID:9432
- C:\Windows\System\zRgUKXt.exe
  C:\Windows\System\zRgUKXt.exe
  2⤵
  PID:9480
- C:\Windows\System\AoEvdXK.exe
  C:\Windows\System\AoEvdXK.exe
  2⤵
  PID:9556
- C:\Windows\System\lZwxLAU.exe
  C:\Windows\System\lZwxLAU.exe
  2⤵
  PID:9620
- C:\Windows\System\cONBZNo.exe
  C:\Windows\System\cONBZNo.exe
  2⤵
  PID:9684
- C:\Windows\System\uCSLDUG.exe
  C:\Windows\System\uCSLDUG.exe
  2⤵
  PID:9748
- C:\Windows\System\fQraYXv.exe
  C:\Windows\System\fQraYXv.exe
  2⤵
  PID:9812
- C:\Windows\System\CsFVABn.exe
  C:\Windows\System\CsFVABn.exe
  2⤵
  PID:9436
- C:\Windows\System\EWqpGWI.exe
  C:\Windows\System\EWqpGWI.exe
  2⤵
  PID:9500
- C:\Windows\System\OXWTHlX.exe
  C:\Windows\System\OXWTHlX.exe
  2⤵
  PID:9904
- C:\Windows\System\eOvNEbu.exe
  C:\Windows\System\eOvNEbu.exe
  2⤵
  PID:9604
- C:\Windows\System\lDPBsNM.exe
  C:\Windows\System\lDPBsNM.exe
  2⤵
  PID:9632
- C:\Windows\System\UemrTxG.exe
  C:\Windows\System\UemrTxG.exe
  2⤵
  PID:9968
- C:\Windows\System\haPWRdD.exe
  C:\Windows\System\haPWRdD.exe
  2⤵
  PID:10004
- C:\Windows\System\BRURDNS.exe
  C:\Windows\System\BRURDNS.exe
  2⤵
  PID:9856
- C:\Windows\System\kzDdCOg.exe
  C:\Windows\System\kzDdCOg.exe
  2⤵
  PID:9668
- C:\Windows\System\BuChyBF.exe
  C:\Windows\System\BuChyBF.exe
  2⤵
  PID:10064
- C:\Windows\System\SzcwHHi.exe
  C:\Windows\System\SzcwHHi.exe
  2⤵
  PID:9828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BOkhTQn.exe

Filesize
1.9MB

MD5
38c1280f971ce9c235728d6a4070a319

SHA1
1fa99a5fb92f7cebcf47a55dc7b046d41325766a

SHA256
3fdfb408103db730e19a4384179cea04f75244f7e468eb5d87269e0fff1a5f55

SHA512
179ec021abc358b5755bef117b1ad2c81aa4fedb75e9a73bf117e4ee3f4c9a6a61c1169c3c7f940901c0d8fcc2324bb6d05cffb26141df550288bfe0d76efe28

Download Submit
C:\Windows\system\DDwJFLE.exe

Filesize
1.9MB

MD5
7f67fe59fcca7baa7aaca4c418ea0098

SHA1
94184596abf38ff11f9aab0ea8d4eb1864c62b9e

SHA256
9a3580b9721a104f95e505eca30c9ed1fff3972dcadf4477d81e0d387574571e

SHA512
9bbe8f29457fab98362bbf718b6380e8567e9cfd494906677001bd8821fd4e4c8f76c20e00283b4e7f9ba83be706f154ba231c964b22b6a4e038b03cd9225147

Download Submit
C:\Windows\system\HRwfNnk.exe

Filesize
1.9MB

MD5
f37e2e14c57d37f7d19b83faca7b344b

SHA1
e79943e0e91befa79a42445100af1de0ab910f5c

SHA256
8db22d3c454a55b5951eda22da7d74988a0516ce816e9aae366a1de4962f3899

SHA512
e42a22495ea6a427cdd621f36945d07a29dd6259a2f91095e4e17731e9b6f79c81ce36df112be6cb4c2dcb040d9164d4d0cd152e9a1b478dbb2547bdd6e29125

Download Submit
C:\Windows\system\IQTEDwC.exe

Filesize
1.9MB

MD5
4260ecc72a8bcc57f3f25415726a6bd3

SHA1
cab14c49fc8a60becee386b778b0be830d82f164

SHA256
adefbd5bd03942e1b552ac81be60b4bb4a05af458913c00cf23c915556da6e3f

SHA512
90ad17fde72f81d85828400a14298128f23ff1429b72f7720e7e74b36fee4566daa4ff7918b9649f7154dee955d163d149b8e2f1404a65288823c64d126f4ca9

Download Submit
C:\Windows\system\IkSUYXJ.exe

Filesize
1.9MB

MD5
e3148f7ca53165abd53b38fe87d0a6f2

SHA1
e4c43edac58cfbfa207b9265ce5f4050bd36f40d

SHA256
ea422a88c43d3386bdcb7bbac076a46b1c2846a454ab506aba65f421beb2d2c7

SHA512
6aea3d4cabc83593a898f20e7d17542000177f929a5e53b987ffc942318b8ae387e3b2a572c024f1b31099eee249941223855dab0a0da704fd5bfc6b6234c0a3

Download Submit
C:\Windows\system\JRrBnFs.exe

Filesize
1.9MB

MD5
90ac61cf45dbbe992b6017fb214227d2

SHA1
1e229645440406061dcf24914afd64b40393db42

SHA256
e71c6aaa755b1651afa53d8600b7af4c8a96d8f08d50ccedeac897327728935e

SHA512
f66b06a1c602d6571faec8d2f3be8d97c22e7dbbf92e25960264a1a73cba768583419ba2ae8a95969f1af52e48372a16116a31126b7e2fbdfc31f6e503f66fa9

Download Submit
C:\Windows\system\NYpKTWR.exe

Filesize
1.9MB

MD5
17ad6e9c9a97c404556453148a6bf847

SHA1
06f345a89efc9c226933e5ee1a0af22b909a4d00

SHA256
10082961b144d2d429c6526d5d81cfaa90e66af31ef553a5cca7b5ede223ef3b

SHA512
ffaa2db2b5a67517da04dcf755657968cea1a4f4de177fa1a2dfe87bdde2b64aea157d1bf00a0bba5815c6249037c16fb0703783ab05b1fc82eb3c814e59d5c6

Download Submit
C:\Windows\system\NjgthHb.exe

Filesize
1.9MB

MD5
e01f22a88c2f9e20953f0f906ea3a334

SHA1
d1f52ae132c38c8ebad10131b7dc743d222fbea2

SHA256
3eeae1a298322524ffe51da2d259b4dedd589a8004f890b958389a84eee27d1a

SHA512
3392ac97542be73579846a2b6708f8d25e3e29cf4beb7db28eb328ab391b24a018ce8c86a391e7751bf64976ec8d3062029bb59b94b822a98e54ff83a46215b6

Download Submit
C:\Windows\system\RPXhpLD.exe

Filesize
1.9MB

MD5
edc3a09eceb68bc711ba75bd60991c37

SHA1
4207b01dd08219e5f816cb98e46615a13a7621b5

SHA256
33e7b92e69b38eb29b7471c560a2732c9d43de6fcdc0c73e2863e88e0f667233

SHA512
785ebab08b4400b901432d195f492dbc6f3cb1936050ac33eeac64c49749bf4ec08a0ceb7dd658900e580707174bd0a4eabb51570de0f00bf78e5f2edfe25c85

Download Submit
C:\Windows\system\SZEPToi.exe

Filesize
1.9MB

MD5
b63ec93fbff01200ebbb391b122d6a72

SHA1
4620b28a06f5fab01e109c5c178a58a32b9e7c71

SHA256
25b5242ed4a3f1bf7618a3484278a4bc545ec13a61d0bdfd12f876d21af60664

SHA512
490c30653735ea2e218864bac4a55f796661f9807e2b18c92aa6cc86b67a1a55d37e4948be2016561bb977f631b3bb8b891413ff2b17b3dff02894cb8f1a318a

Download Submit
C:\Windows\system\UEaUflp.exe

Filesize
1.9MB

MD5
709071cb9a56675ce741b1ecb0b744bf

SHA1
924d4d1940fdbd5e8bc89b01e354f94a65dca415

SHA256
1e120c1db44a505aa76ebdc128b7227e7ab5de753ab8ad61d10e63551665beac

SHA512
412969b842ad5b751178b10c1e0408a9a7ad3a323c6913e7499ad9651a80d21b161e9b25bc4416209dbbc6b8ec62fb18b908aef4e34d109cb4ea01820b0460a0

Download Submit
C:\Windows\system\cKxuMvR.exe

Filesize
1.9MB

MD5
6cf9d4e44d1b98dc6c24247c24099c7a

SHA1
ae1028523b9017a38850b9cb74750c813a4c3c02

SHA256
a9ec8befc16aed5525ebebe074a82858da92a058560bb472942ed23f107b59b9

SHA512
b262caed3c4ccd9790dc495ae9be8f307103cafed791a7a43f8ae05dfa778178a1be76731be2806b76ec35df946ab7ffc186a7f6cf7b8ff2a98567abf7913b1d

Download Submit
C:\Windows\system\hCPwfLC.exe

Filesize
1.9MB

MD5
207f76b4dfc175d74423596261ad459f

SHA1
8542b4fe1aa270e4a647cc920d970b073a4f5816

SHA256
ab3aa49025ffd06009d25a466418b164b87ef50217df2539c7aa49b1bcc92bab

SHA512
9d142110545cdfde0358ae64b3090988511bd80d480470f7fd3414b955abdfe15f67f038cb1ea68b646c425836746d69eb3ff7c3f7bccb1e8413121c0bd61def

Download Submit
C:\Windows\system\hppMVzT.exe

Filesize
1.9MB

MD5
b89909d2850e99b7ad40801667549247

SHA1
a296b880cf6984ca2cb72d35b8c790442a55ef3d

SHA256
77dde3f7b8fa42548549f8297497c32514b8e51c6b8b63facd81ef22e68cb069

SHA512
0610efc97e5d6fc2b0e4792d5f1b77035c4a2c8b1bdd05352be6ca5c3abc81c8c5390cc583f3ed49682df42af6ea293b9e99827f3b96826a3676d763e5296924

Download Submit
C:\Windows\system\jlAMtZM.exe

Filesize
1.9MB

MD5
ff0d2e5aad931471e93034bda9efb8fe

SHA1
fdcf5ce27780af6f529cf79337ba35201ea10c9c

SHA256
0de4a132836fc8d34e56d3db31667061235ecb0b52916d2d13151ac5be8aa922

SHA512
60cec02cd22e30f5a08bdb54cabb3e256bcb177f436780e2bb7ac9be2733847914c287704b81c04cb30e77cb7eb1171ad910597553b79f0a280923bb3ccbaf0d

Download Submit
C:\Windows\system\kJUxIKA.exe

Filesize
1.9MB

MD5
a68fd22a8cc8897d9932ea9c6bd1ce92

SHA1
4fb5047923051ffdae78a7ff7dcbfdd5eb6f107b

SHA256
02e731ff3434674269f46a61bd03f8bbdd08a471a57871226cdd42db6a1a6011

SHA512
2b63a99cc73df4f179a9f0ae7c56950b9671f4958cc9fdd6e9b0ed60b659b40fceb381701d44242a070401f092ca994b35683ad05da7b04a62098875ca196cb1

Download Submit
C:\Windows\system\kYstnEU.exe

Filesize
1.9MB

MD5
f6c7e08394048c770bc1c9b417295bb1

SHA1
38198b3088f1975eb05d2ba581f6c83df95693d7

SHA256
4d4195e43bac4a53985bc554f44f59e69c51b419f115f6bc2e7bbdb5d3c7c741

SHA512
bd29fff67a212705693d1e86c55bfca5f54dc42b4b4679976b655a1009ef81e89a413afc71b45f6e6bd46b8691f77cf5d28870585b42996d6b419464c964b5da

Download Submit
C:\Windows\system\ktBOryN.exe

Filesize
1.9MB

MD5
65f24549641b8f50f15c7e27f1ef2e0b

SHA1
d40a6e28aee54036466321b14dc2fffd1eb5543c

SHA256
946fb2d57c2ef318f6a348d21d87cd63d4a2aa8429be6133096c5a64e602c15b

SHA512
6458183b778e2a1ff6f43909fedc3909cbda9944f215ecef056288df7a3a8a0acd6723fb7ff7a4eaf3ba59e2f7394f1e21e1c126743079befe12f49cfb7241f4

Download Submit
C:\Windows\system\qKuCfdo.exe

Filesize
1.9MB

MD5
9669acbea80f2c1c8b4a39f7afe1be47

SHA1
84305f20f41859627880dd67247e5d58a20bd76a

SHA256
412a8851a860b0aed6bcf00885c1a6779c765e4c62d7eef817110994f86e34c3

SHA512
bf1ddf50cb01b27bb135488ae9613f9a9385b951df16c355a45d6d215ab0e3fbef388aa0e383bec67a59d0f782d75d183c1f1308e6f9b59344b74cb23814c94c

Download Submit
C:\Windows\system\tcFEpMS.exe

Filesize
1.9MB

MD5
4cf68d70ad503630774337751e14d95a

SHA1
b5573a99258b97043c58d33020c4b18399792344

SHA256
704f3594f8ac62b8c7ed5666cc840526c601f383b5643b9c79324ebea15fd1b6

SHA512
fbdc3e399ed0081cc7c02f409e69b38fe716c0b1e4370a802f1edbf1c7b36152396f6a71f206b7cf30d88866e55252d6720b3f7a604d882a14a9c054f70f7c4c

Download Submit
C:\Windows\system\ycNoAlu.exe

Filesize
1.9MB

MD5
f85d5bd0c954352ca8d6ff03a3c5b075

SHA1
9922aaed8600964497aeabac2f983d38b400da33

SHA256
eccc73db20501cf60a11a44a87d6a74e55f627fb8d816105b7f212002b1eb6b7

SHA512
671f689f13dc48fb284a8fbc03a61d92c0df2dcc6abf61eb85b9c141ab2c24544ecaa7cacf7d5f2df736cfcb3d4f3d5cc96b8d9a2d2c69456a02e9cec231f2cb

Download Submit
C:\Windows\system\yeDMqCE.exe

Filesize
1.9MB

MD5
a613a408db16f92712de24be25a201fc

SHA1
27f218d4d8782268d69c8c5c1f92457eefb0c215

SHA256
159f3574790045f7b64651c7265cfc69985ba149ec4bca5f055b299e8ebd436c

SHA512
4d483d1de7db8a5c226dee210a1a4e74979670110acf51ff7f5b93ca7adf789840c1563e0465c2333278f73fed58db245be99eb68cb7802aff3b27b590dfeb83

Download Submit
C:\Windows\system\zDErLmH.exe

Filesize
1.9MB

MD5
78e1e8feec7f4ac0b83b487560228093

SHA1
78661e46ae9140ede7fe4797fd4993b8c5eacdaa

SHA256
39059d6b6a66a5bb08d389cdad4945b06c085210021f13e4207e8a77580f502e

SHA512
e69bbbf5a3f7ff0ac2947336b2ba371c006a99d8a10c8eebc14319cea37af52fbbfd8b8b2dd74ada7f63818d42c69359133e554f8073a20b2e0c613d679c8a3e

Download Submit
C:\Windows\system\zbSeEsd.exe

Filesize
1.9MB

MD5
cf76c9296e861c24c9adbef3cf417204

SHA1
0966ac851675e0afce07bc5da3918bec89eed60d

SHA256
13d3a79fe0d43f9f0175e13c79fe54d4cd5a03fad8af3414fb2fc242904f04e8

SHA512
74c73d53a96499f10952ff84066c7e75329b33b5bbe63ba76bd113a755ed506c23a8841821290a309ef85cc1795ae880e3e7c127b54b5471935df921b4f86386

Download Submit
C:\Windows\system\zurjPas.exe

Filesize
1.9MB

MD5
54feef3f2a8f511ab8f9d4b48286a256

SHA1
a4c0ee00eb0a5a98e60d8fb404ef179d8b472ae8

SHA256
1d33f63f0d44cc74cb64d244a955cea2c057d6d459b91b888f9e1a8c9f0eca87

SHA512
a6cc568ebcdd275a606183cb245cfd94f2f40171aa7590dd4060ab83b57539990f898aaeb7122ae1fff77ad781b1534aa3670459347cfd15f37e8df7ec895200

Download Submit
\Windows\system\EKkgFWW.exe

Filesize
1.9MB

MD5
fd6e704e338804ebee34054901a10d0f

SHA1
06d20abb260c0456218238eb0e7a8b383c97ba0b

SHA256
89f1d14d1a21682f6c89483efb708c63f778e7b512f6a10d7debbacedc33d4f1

SHA512
879f5d4b623d495a891544ccc7d985b4890331e881e6583534f30e5427de9671326810dab2b5bc7b87853335d2fec031553d1cc45a741c6ab70bdda6ac705f7f

Download Submit
\Windows\system\JPMnpiR.exe

Filesize
1.9MB

MD5
7e9da9777a25fcbd5919c10a997ba2b7

SHA1
7bd98c3d401a2c7383f9a87a0f54fe0a32ebae76

SHA256
48b920e5a657d1203758b4f80f2fdd101e934935fafb5720c34dc876b03b4aef

SHA512
d89e6c5ac16723b8a82309dde77f61eb6f14b554b7aec1f0a1da171b641aa0bd126f74c101f2df486891cd71f698399cb257a450e3c9af189b6def6a5796d71c

Download Submit
\Windows\system\KhQRYNF.exe

Filesize
1.9MB

MD5
179a52f25cb9e796183425bdf15eb63c

SHA1
8f8414463d7101c208da5e3389f606e383a59f76

SHA256
70ca878ba9fba5d6a1a9650391029a0d796aefa34814c2f7071c11a8a0633e8c

SHA512
cb2296f586ba7aa386d8c7fac925a61929000e141f91a450fc296cdcf9bd6a23151fdb647066b0a006f91c161cf574a3d185a30af52333621f5ea41152753fd6

Download Submit
\Windows\system\UUvqNgF.exe

Filesize
1.9MB

MD5
cfac058afa3c0bb4447ede6481f5fa90

SHA1
2ab0fc3b5f0cb7640ca7efe2fbda0eceb0b7d9b5

SHA256
ef176dba70a33f77559ad6278394171e668677f11b4fd2a2b122588413230813

SHA512
62463dd68f82c3ed3ce8d684340f26f6822088679e1ca51a6db6e8bd8d7505780cb4b1e7d4d5a7d128e5647c026297aedb480fc20a57d7650544f16759edc468

Download Submit
\Windows\system\bUvmwpN.exe

Filesize
1.9MB

MD5
d7cd62b91ece65fd68414c1e07c5bc93

SHA1
2a15edf45202ade0203b3672eb9a75cd943ee210

SHA256
d3c4403981d9d42b1bd370c774ce624fd4bc844c97304c137f4abec0d04ffb19

SHA512
f78b71038a7c7629e4b838e66c3dc95564f9103dd0d13c5b106b8affb5188d987d4c037dda05c379a9fbd0de341e6e6f4665a65fc57a51c6ed57f01c4ae5d9cb

Download Submit
\Windows\system\eFgvZKk.exe

Filesize
1.9MB

MD5
32001efb5cc95bd547954391c006aa09

SHA1
ff58edfab6a80c222c418c4d0265f5a6516627d2

SHA256
927d0c1cdc8f914cc39c47c0ed52278fc2b66a1b16983650d3feb165fd0332ae

SHA512
78d6237d3fd0a3c06c27e9e39f2ca403ed6c48dd76d68c564077a2326579f459cc99a1babb30db04e5b463db4ccbcab4de833912fae7df880e0757fc6d910323

Download Submit
\Windows\system\mIiYLUx.exe

Filesize
1.9MB

MD5
b21221f0c33273e44f14f9ca4add543c

SHA1
cc9a5e98b8b34452a2e3b2bfcaac64a7588fd0b6

SHA256
52acda47c3008544ecf9c237a0a5f73b70e692baa2f5904a92e69312bb4de645

SHA512
79e0b06cab204340100cc801229cfdc099609c3d21ba2d3ff19ef9edcfed5f3146b22b3d8e648e7ef5ccc4f7efc00d973d34768c1ffa1488af7ffd0bdb3111d2

Download Submit
\Windows\system\wCFyVmS.exe

Filesize
1.9MB

MD5
d86a70b71879f054873ade129b60c301

SHA1
f555c7eeb18f104266d64b4f34b58b6ea54102ba

SHA256
18797062bad96a4bbe559edda4aea1a16c5ddfab01ca67b40e3a27219d157bfd

SHA512
8f6163af5514d3518a152b2561b632e49c608d0e1d2dc20bfbd374b26186e7e946866e85a2ac8dfc61b397b109b2697c517edb13be31d52c66b8b7794e214e9d

Download Submit
memory/1356-59-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/1428-76-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-39-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2304-43-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2304-96-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2304-57-0x00000000028F0000-0x0000000002970000-memory.dmp

Filesize
512KB

Download
memory/2304-14-0x00000000028F0000-0x0000000002970000-memory.dmp

Filesize
512KB

Download
memory/2304-60-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2304-61-0x00000000028F0000-0x0000000002970000-memory.dmp

Filesize
512KB

Download
memory/2304-47-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2580-50-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2632-56-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2640-13-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2708-52-0x000000013F410000-0x000000013F802000-memory.dmp

Filesize
3.9MB

Download
memory/2728-48-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2836-73-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2932-12-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2932-81-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2932-49-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2932-55-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2932-53-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-72-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2932-62-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2932-51-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2932-58-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2932-2020-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2932-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2932-64-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1661-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/3044-54-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download