xmrig | 1194f0584653f19706fc2bd9b1e702a99174433635e79cf879377a0bd3ac4004

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
Size

1.7MB
MD5

05ccdd21a728f1b69ccac94145175e18
SHA1

30710097db20ff87e36c1b4cf1a24fa7d6049c94
SHA256

1194f0584653f19706fc2bd9b1e702a99174433635e79cf879377a0bd3ac4004
SHA512

7e097436db904b402d07c1c78781221dfde199363749a7d12d7d4c026fc944dd467673a1f52d8e89aae9ed243b17b0359eca589f086e490c82a250477d8996fb
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMK7:NABe

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2532-96-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2672-94-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2676-113-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2880-104-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2972-103-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2452-100-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2508-91-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	ojAPhvb.exe
2664	MagbHYB.exe
2676	WXHIjJm.exe
2508	ShaFyDU.exe
2672	lrtfzgz.exe
2532	rmGmKRw.exe
2452	vqwejLj.exe
2972	qFIZGnP.exe
2880	dqSQRzz.exe
352	nGKWNpV.exe
2644	VFyoFsv.exe
2780	EFuDyPX.exe
2724	nWziyOF.exe
1636	OEVWmhS.exe
2904	kCjutHL.exe
2488	MwrKYpf.exe
1264	nAhZseX.exe
3068	DycxaLk.exe
2224	nUtOgEo.exe
2236	SabZWAz.exe
2756	miWKVFq.exe
2232	esaiGRO.exe
572	zIxrwPG.exe
1416	jVeMUtn.exe
1720	XNrHFKs.exe
240	UGeTZlH.exe
1920	UDYCptl.exe
3028	mbHRjRF.exe
1696	JjeSQbp.exe
1304	JFZOwIv.exe
1996	BMrKzMQ.exe
680	KmKtFMN.exe
2092	iuTwCDX.exe
2260	VhyBsHe.exe
2356	uVSBZwc.exe
1740	GsbcFxA.exe
2156	lcveuMP.exe
2068	chOfCCV.exe
1924	ZsQeXwu.exe
2252	tIVUSij.exe
528	kGdxMEO.exe
784	HYKvwsj.exe
3000	FPRullH.exe
2628	LDvqTLg.exe
1132	KgCqMcs.exe
1952	cNHoyXU.exe
496	xgqNnvA.exe
1928	TESLtJP.exe
1556	hpiOmhQ.exe
1816	NcZGfNM.exe
2284	BcJuSPA.exe
2656	OoPwUel.exe
2012	vgAdtZd.exe
3044	jotvDXP.exe
1600	XtOVMNc.exe
996	FURCdoB.exe
2120	VTmutUR.exe
908	WMdVKSB.exe
2892	hqJtfNK.exe
2636	FrBcpDv.exe
2652	wJtYTjf.exe
2336	ohYKbFs.exe
2736	fMTvBIa.exe
848	KmIyWBd.exe

Loads dropped DLL 64 IoCs

pid	Process
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2916-0-0x000000013F3C0000-0x000000013F7B2000-memory.dmp	upx
behavioral1/files/0x000f000000012331-5.dat	upx
behavioral1/memory/2560-9-0x000000013FA60000-0x000000013FE52000-memory.dmp	upx
behavioral1/files/0x0032000000013a88-10.dat	upx
behavioral1/files/0x0007000000014183-12.dat	upx
behavioral1/memory/2664-19-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-27.dat	upx
behavioral1/files/0x0008000000014251-31.dat	upx
behavioral1/files/0x0009000000014367-44.dat	upx
behavioral1/files/0x000700000001431b-40.dat	upx
behavioral1/files/0x0007000000014a60-55.dat	upx
behavioral1/files/0x0006000000014b1c-53.dat	upx
behavioral1/files/0x0006000000014c2d-65.dat	upx
behavioral1/files/0x000600000001507a-73.dat	upx
behavioral1/files/0x0006000000014f57-67.dat	upx
behavioral1/files/0x0006000000015083-77.dat	upx
behavioral1/memory/2532-96-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/memory/2672-94-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x000600000001565a-107.dat	upx
behavioral1/memory/2676-113-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/files/0x0006000000015ae3-131.dat	upx
behavioral1/files/0x0006000000015d85-185.dat	upx
behavioral1/files/0x0006000000015d59-180.dat	upx
behavioral1/files/0x0006000000015d21-173.dat	upx
behavioral1/files/0x0006000000015cf8-166.dat	upx
behavioral1/files/0x0006000000015662-115.dat	upx
behavioral1/files/0x0006000000015cb1-147.dat	upx
behavioral1/files/0x0006000000015c9a-140.dat	upx
behavioral1/files/0x0006000000015b50-133.dat	upx
behavioral1/files/0x0006000000015d39-175.dat	upx
behavioral1/files/0x00060000000158d9-123.dat	upx
behavioral1/memory/2880-104-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2972-103-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2452-100-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x00060000000153ee-97.dat	upx
behavioral1/files/0x0006000000015ce3-159.dat	upx
behavioral1/files/0x0006000000015d61-182.dat	upx
behavioral1/files/0x0006000000015d0a-168.dat	upx
behavioral1/files/0x0006000000015cee-161.dat	upx
behavioral1/files/0x0006000000015cd2-154.dat	upx
behavioral1/files/0x0006000000015cc5-152.dat	upx
behavioral1/files/0x0006000000015ca8-145.dat	upx
behavioral1/files/0x0006000000015b85-138.dat	upx
behavioral1/files/0x0032000000013adc-130.dat	upx
behavioral1/memory/2508-91-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x00060000000150d9-89.dat	upx
behavioral1/files/0x0006000000014bd7-58.dat	upx
behavioral1/memory/2916-24-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fpoxDwM.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\DOfeAfe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\gOsOmte.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\SbfdANf.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\rXOLOGL.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\DOSNbDl.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\tQKMexj.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\erFQNLE.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ftIYagc.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\FrrzDBO.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\BUXAFhe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\sfDtFEg.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\YXvYuga.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\WrMBqdH.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\DLsHDQj.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ZyUZkfd.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\mvjviDb.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\kdFdTct.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\chOfCCV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\PJGXekp.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\vTsPISW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\wBjZoDo.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\JyRxRop.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\lQjIGpV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\fEsBSWB.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\kLOvFPj.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\yVNLnii.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\soEhwrX.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\NdMLFyI.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\oIuaMxi.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\sMhvglW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\qMljBEP.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\hXBhLPo.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ucIAFjc.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\ulCWYdW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\IbORjnp.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\AJeDzeD.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\VkhJgML.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\IrkNGLW.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\GsbcFxA.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\XObBmmo.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\DGUArUJ.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\YLieAXj.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\NDKEOAE.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\nBOjsDV.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\mkWAFat.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\canVRun.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\QmDQLwa.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\dOncAAe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\txuBuOo.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\zdSjOhr.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\OVrFzGk.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\VtUGKMG.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\cPEwSBX.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\fAolmfk.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\VKxPdsM.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\JTnlwIL.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\aEVrtnw.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\YnVuoTL.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\BusMteY.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\JvgCAJh.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\DECBfpF.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\VhyBsHe.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
File created	C:\Windows\System\RqTTmud.exe	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2740	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2740	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	29
PID 2916 wrote to memory of 2740	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	29
PID 2916 wrote to memory of 2740	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	29
PID 2916 wrote to memory of 2560	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2560	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2560	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	30
PID 2916 wrote to memory of 2664	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2664	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2664	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	31
PID 2916 wrote to memory of 2676	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2676	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2676	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	32
PID 2916 wrote to memory of 2508	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	33
PID 2916 wrote to memory of 2508	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	33
PID 2916 wrote to memory of 2508	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	33
PID 2916 wrote to memory of 2672	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2672	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2672	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	34
PID 2916 wrote to memory of 2532	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	35
PID 2916 wrote to memory of 2532	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	35
PID 2916 wrote to memory of 2532	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	35
PID 2916 wrote to memory of 2452	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2452	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2452	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	36
PID 2916 wrote to memory of 2880	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	37
PID 2916 wrote to memory of 2880	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	37
PID 2916 wrote to memory of 2880	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	37
PID 2916 wrote to memory of 2972	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	38
PID 2916 wrote to memory of 2972	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	38
PID 2916 wrote to memory of 2972	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	38
PID 2916 wrote to memory of 352	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	39
PID 2916 wrote to memory of 352	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	39
PID 2916 wrote to memory of 352	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	39
PID 2916 wrote to memory of 2644	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	40
PID 2916 wrote to memory of 2644	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	40
PID 2916 wrote to memory of 2644	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	40
PID 2916 wrote to memory of 2724	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	41
PID 2916 wrote to memory of 2724	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	41
PID 2916 wrote to memory of 2724	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	41
PID 2916 wrote to memory of 2780	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	42
PID 2916 wrote to memory of 2780	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	42
PID 2916 wrote to memory of 2780	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	42
PID 2916 wrote to memory of 1636	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	43
PID 2916 wrote to memory of 1636	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	43
PID 2916 wrote to memory of 1636	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	43
PID 2916 wrote to memory of 2904	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	44
PID 2916 wrote to memory of 2904	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	44
PID 2916 wrote to memory of 2904	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	44
PID 2916 wrote to memory of 1264	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	45
PID 2916 wrote to memory of 1264	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	45
PID 2916 wrote to memory of 1264	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	45
PID 2916 wrote to memory of 2488	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	46
PID 2916 wrote to memory of 2488	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	46
PID 2916 wrote to memory of 2488	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	46
PID 2916 wrote to memory of 3068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	47
PID 2916 wrote to memory of 3068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	47
PID 2916 wrote to memory of 3068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	47
PID 2916 wrote to memory of 2224	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	48
PID 2916 wrote to memory of 2224	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	48
PID 2916 wrote to memory of 2224	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	48
PID 2916 wrote to memory of 2068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	49
PID 2916 wrote to memory of 2068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	49
PID 2916 wrote to memory of 2068	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	49
PID 2916 wrote to memory of 2236	2916	05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05ccdd21a728f1b69ccac94145175e18_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\System\ojAPhvb.exe
  C:\Windows\System\ojAPhvb.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\MagbHYB.exe
  C:\Windows\System\MagbHYB.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\WXHIjJm.exe
  C:\Windows\System\WXHIjJm.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ShaFyDU.exe
  C:\Windows\System\ShaFyDU.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\lrtfzgz.exe
  C:\Windows\System\lrtfzgz.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\rmGmKRw.exe
  C:\Windows\System\rmGmKRw.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\vqwejLj.exe
  C:\Windows\System\vqwejLj.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\dqSQRzz.exe
  C:\Windows\System\dqSQRzz.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\qFIZGnP.exe
  C:\Windows\System\qFIZGnP.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\nGKWNpV.exe
  C:\Windows\System\nGKWNpV.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\VFyoFsv.exe
  C:\Windows\System\VFyoFsv.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\nWziyOF.exe
  C:\Windows\System\nWziyOF.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\EFuDyPX.exe
  C:\Windows\System\EFuDyPX.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\OEVWmhS.exe
  C:\Windows\System\OEVWmhS.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\kCjutHL.exe
  C:\Windows\System\kCjutHL.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nAhZseX.exe
  C:\Windows\System\nAhZseX.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\MwrKYpf.exe
  C:\Windows\System\MwrKYpf.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\DycxaLk.exe
  C:\Windows\System\DycxaLk.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\nUtOgEo.exe
  C:\Windows\System\nUtOgEo.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\chOfCCV.exe
  C:\Windows\System\chOfCCV.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\SabZWAz.exe
  C:\Windows\System\SabZWAz.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\ZsQeXwu.exe
  C:\Windows\System\ZsQeXwu.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\miWKVFq.exe
  C:\Windows\System\miWKVFq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\tIVUSij.exe
  C:\Windows\System\tIVUSij.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\esaiGRO.exe
  C:\Windows\System\esaiGRO.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\kGdxMEO.exe
  C:\Windows\System\kGdxMEO.exe
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Windows\System\zIxrwPG.exe
  C:\Windows\System\zIxrwPG.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\HYKvwsj.exe
  C:\Windows\System\HYKvwsj.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\jVeMUtn.exe
  C:\Windows\System\jVeMUtn.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\FPRullH.exe
  C:\Windows\System\FPRullH.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\XNrHFKs.exe
  C:\Windows\System\XNrHFKs.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\KgCqMcs.exe
  C:\Windows\System\KgCqMcs.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\UGeTZlH.exe
  C:\Windows\System\UGeTZlH.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\cNHoyXU.exe
  C:\Windows\System\cNHoyXU.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\UDYCptl.exe
  C:\Windows\System\UDYCptl.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\xgqNnvA.exe
  C:\Windows\System\xgqNnvA.exe
  2⤵
  - Executes dropped EXE
  PID:496
- C:\Windows\System\mbHRjRF.exe
  C:\Windows\System\mbHRjRF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\TESLtJP.exe
  C:\Windows\System\TESLtJP.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\JjeSQbp.exe
  C:\Windows\System\JjeSQbp.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\hpiOmhQ.exe
  C:\Windows\System\hpiOmhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\JFZOwIv.exe
  C:\Windows\System\JFZOwIv.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\NcZGfNM.exe
  C:\Windows\System\NcZGfNM.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BMrKzMQ.exe
  C:\Windows\System\BMrKzMQ.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\BcJuSPA.exe
  C:\Windows\System\BcJuSPA.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\KmKtFMN.exe
  C:\Windows\System\KmKtFMN.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\vgAdtZd.exe
  C:\Windows\System\vgAdtZd.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\iuTwCDX.exe
  C:\Windows\System\iuTwCDX.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jotvDXP.exe
  C:\Windows\System\jotvDXP.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\VhyBsHe.exe
  C:\Windows\System\VhyBsHe.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\XtOVMNc.exe
  C:\Windows\System\XtOVMNc.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\uVSBZwc.exe
  C:\Windows\System\uVSBZwc.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\FURCdoB.exe
  C:\Windows\System\FURCdoB.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\GsbcFxA.exe
  C:\Windows\System\GsbcFxA.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\VTmutUR.exe
  C:\Windows\System\VTmutUR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\lcveuMP.exe
  C:\Windows\System\lcveuMP.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\WMdVKSB.exe
  C:\Windows\System\WMdVKSB.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LDvqTLg.exe
  C:\Windows\System\LDvqTLg.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\wJtYTjf.exe
  C:\Windows\System\wJtYTjf.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\OoPwUel.exe
  C:\Windows\System\OoPwUel.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ohYKbFs.exe
  C:\Windows\System\ohYKbFs.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hqJtfNK.exe
  C:\Windows\System\hqJtfNK.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\fMTvBIa.exe
  C:\Windows\System\fMTvBIa.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\FrBcpDv.exe
  C:\Windows\System\FrBcpDv.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\BTZERCk.exe
  C:\Windows\System\BTZERCk.exe
  2⤵
  PID:2132
- C:\Windows\System\KmIyWBd.exe
  C:\Windows\System\KmIyWBd.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\xVZsUYR.exe
  C:\Windows\System\xVZsUYR.exe
  2⤵
  PID:580
- C:\Windows\System\rotIqsJ.exe
  C:\Windows\System\rotIqsJ.exe
  2⤵
  PID:2364
- C:\Windows\System\WVevitU.exe
  C:\Windows\System\WVevitU.exe
  2⤵
  PID:1992
- C:\Windows\System\DXTOagH.exe
  C:\Windows\System\DXTOagH.exe
  2⤵
  PID:1488
- C:\Windows\System\oqCGMzC.exe
  C:\Windows\System\oqCGMzC.exe
  2⤵
  PID:1680
- C:\Windows\System\UsluorJ.exe
  C:\Windows\System\UsluorJ.exe
  2⤵
  PID:2680
- C:\Windows\System\lsDpVGW.exe
  C:\Windows\System\lsDpVGW.exe
  2⤵
  PID:2008
- C:\Windows\System\SMkqkHv.exe
  C:\Windows\System\SMkqkHv.exe
  2⤵
  PID:712
- C:\Windows\System\ogMKZwN.exe
  C:\Windows\System\ogMKZwN.exe
  2⤵
  PID:2984
- C:\Windows\System\ZpahTNt.exe
  C:\Windows\System\ZpahTNt.exe
  2⤵
  PID:2784
- C:\Windows\System\YXvYuga.exe
  C:\Windows\System\YXvYuga.exe
  2⤵
  PID:2648
- C:\Windows\System\lAdFLwo.exe
  C:\Windows\System\lAdFLwo.exe
  2⤵
  PID:2812
- C:\Windows\System\DnFouIF.exe
  C:\Windows\System\DnFouIF.exe
  2⤵
  PID:1280
- C:\Windows\System\gRmKNml.exe
  C:\Windows\System\gRmKNml.exe
  2⤵
  PID:1576
- C:\Windows\System\NDZhBEC.exe
  C:\Windows\System\NDZhBEC.exe
  2⤵
  PID:2036
- C:\Windows\System\WBxMzOK.exe
  C:\Windows\System\WBxMzOK.exe
  2⤵
  PID:2492
- C:\Windows\System\KwwKLOg.exe
  C:\Windows\System\KwwKLOg.exe
  2⤵
  PID:1176
- C:\Windows\System\zOtZUoQ.exe
  C:\Windows\System\zOtZUoQ.exe
  2⤵
  PID:1224
- C:\Windows\System\ChGpihT.exe
  C:\Windows\System\ChGpihT.exe
  2⤵
  PID:1628
- C:\Windows\System\NdMLFyI.exe
  C:\Windows\System\NdMLFyI.exe
  2⤵
  PID:1580
- C:\Windows\System\RuyOKIV.exe
  C:\Windows\System\RuyOKIV.exe
  2⤵
  PID:2208
- C:\Windows\System\vTluslZ.exe
  C:\Windows\System\vTluslZ.exe
  2⤵
  PID:2084
- C:\Windows\System\nFvhOUI.exe
  C:\Windows\System\nFvhOUI.exe
  2⤵
  PID:1776
- C:\Windows\System\CqFYXtb.exe
  C:\Windows\System\CqFYXtb.exe
  2⤵
  PID:2316
- C:\Windows\System\IAwadAx.exe
  C:\Windows\System\IAwadAx.exe
  2⤵
  PID:1504
- C:\Windows\System\fgpRUwf.exe
  C:\Windows\System\fgpRUwf.exe
  2⤵
  PID:1536
- C:\Windows\System\xsohrpZ.exe
  C:\Windows\System\xsohrpZ.exe
  2⤵
  PID:1232
- C:\Windows\System\GLNuOtA.exe
  C:\Windows\System\GLNuOtA.exe
  2⤵
  PID:976
- C:\Windows\System\ylwVxTv.exe
  C:\Windows\System\ylwVxTv.exe
  2⤵
  PID:716
- C:\Windows\System\KqcPeZh.exe
  C:\Windows\System\KqcPeZh.exe
  2⤵
  PID:1620
- C:\Windows\System\AupsAxN.exe
  C:\Windows\System\AupsAxN.exe
  2⤵
  PID:1440
- C:\Windows\System\bHvuYHf.exe
  C:\Windows\System\bHvuYHf.exe
  2⤵
  PID:2308
- C:\Windows\System\aEVrtnw.exe
  C:\Windows\System\aEVrtnw.exe
  2⤵
  PID:2528
- C:\Windows\System\WrMBqdH.exe
  C:\Windows\System\WrMBqdH.exe
  2⤵
  PID:1876
- C:\Windows\System\GenLVFe.exe
  C:\Windows\System\GenLVFe.exe
  2⤵
  PID:536
- C:\Windows\System\fdVYrES.exe
  C:\Windows\System\fdVYrES.exe
  2⤵
  PID:2776
- C:\Windows\System\waDEMOk.exe
  C:\Windows\System\waDEMOk.exe
  2⤵
  PID:2708
- C:\Windows\System\kBmkIML.exe
  C:\Windows\System\kBmkIML.exe
  2⤵
  PID:1148
- C:\Windows\System\HuhtIEz.exe
  C:\Windows\System\HuhtIEz.exe
  2⤵
  PID:624
- C:\Windows\System\zAFOhpa.exe
  C:\Windows\System\zAFOhpa.exe
  2⤵
  PID:1116
- C:\Windows\System\mjTqAnY.exe
  C:\Windows\System\mjTqAnY.exe
  2⤵
  PID:2992
- C:\Windows\System\JCuaBDX.exe
  C:\Windows\System\JCuaBDX.exe
  2⤵
  PID:448
- C:\Windows\System\diwiRKK.exe
  C:\Windows\System\diwiRKK.exe
  2⤵
  PID:1368
- C:\Windows\System\ckbBNmm.exe
  C:\Windows\System\ckbBNmm.exe
  2⤵
  PID:2044
- C:\Windows\System\PvviahI.exe
  C:\Windows\System\PvviahI.exe
  2⤵
  PID:2416
- C:\Windows\System\OffFrVv.exe
  C:\Windows\System\OffFrVv.exe
  2⤵
  PID:2324
- C:\Windows\System\NpKGoIU.exe
  C:\Windows\System\NpKGoIU.exe
  2⤵
  PID:2728
- C:\Windows\System\zVtTdzS.exe
  C:\Windows\System\zVtTdzS.exe
  2⤵
  PID:2660
- C:\Windows\System\LrMfzgj.exe
  C:\Windows\System\LrMfzgj.exe
  2⤵
  PID:2576
- C:\Windows\System\kSImlMj.exe
  C:\Windows\System\kSImlMj.exe
  2⤵
  PID:2748
- C:\Windows\System\TueRaGW.exe
  C:\Windows\System\TueRaGW.exe
  2⤵
  PID:280
- C:\Windows\System\xIxWMKf.exe
  C:\Windows\System\xIxWMKf.exe
  2⤵
  PID:1612
- C:\Windows\System\KrVXeMV.exe
  C:\Windows\System\KrVXeMV.exe
  2⤵
  PID:2004
- C:\Windows\System\ogtVxIm.exe
  C:\Windows\System\ogtVxIm.exe
  2⤵
  PID:2572
- C:\Windows\System\BUcUdAe.exe
  C:\Windows\System\BUcUdAe.exe
  2⤵
  PID:1532
- C:\Windows\System\WZCaTkt.exe
  C:\Windows\System\WZCaTkt.exe
  2⤵
  PID:2964
- C:\Windows\System\rrktONf.exe
  C:\Windows\System\rrktONf.exe
  2⤵
  PID:596
- C:\Windows\System\hWcSQFQ.exe
  C:\Windows\System\hWcSQFQ.exe
  2⤵
  PID:2968
- C:\Windows\System\oKqCBEL.exe
  C:\Windows\System\oKqCBEL.exe
  2⤵
  PID:2840
- C:\Windows\System\CAeNzqt.exe
  C:\Windows\System\CAeNzqt.exe
  2⤵
  PID:1748
- C:\Windows\System\HucYQPL.exe
  C:\Windows\System\HucYQPL.exe
  2⤵
  PID:2556
- C:\Windows\System\difwEUj.exe
  C:\Windows\System\difwEUj.exe
  2⤵
  PID:992
- C:\Windows\System\YhkSGlm.exe
  C:\Windows\System\YhkSGlm.exe
  2⤵
  PID:2624
- C:\Windows\System\OVrFzGk.exe
  C:\Windows\System\OVrFzGk.exe
  2⤵
  PID:3080
- C:\Windows\System\gYptakw.exe
  C:\Windows\System\gYptakw.exe
  2⤵
  PID:3096
- C:\Windows\System\OQjlJIP.exe
  C:\Windows\System\OQjlJIP.exe
  2⤵
  PID:3124
- C:\Windows\System\sVJaQiQ.exe
  C:\Windows\System\sVJaQiQ.exe
  2⤵
  PID:3140
- C:\Windows\System\kfOkHRt.exe
  C:\Windows\System\kfOkHRt.exe
  2⤵
  PID:3156
- C:\Windows\System\ualxMrQ.exe
  C:\Windows\System\ualxMrQ.exe
  2⤵
  PID:3176
- C:\Windows\System\lGccAtX.exe
  C:\Windows\System\lGccAtX.exe
  2⤵
  PID:3192
- C:\Windows\System\vZVeNyH.exe
  C:\Windows\System\vZVeNyH.exe
  2⤵
  PID:3208
- C:\Windows\System\THnkdee.exe
  C:\Windows\System\THnkdee.exe
  2⤵
  PID:3224
- C:\Windows\System\NICNfFb.exe
  C:\Windows\System\NICNfFb.exe
  2⤵
  PID:3244
- C:\Windows\System\RYdxSLu.exe
  C:\Windows\System\RYdxSLu.exe
  2⤵
  PID:3260
- C:\Windows\System\TppKdBI.exe
  C:\Windows\System\TppKdBI.exe
  2⤵
  PID:3276
- C:\Windows\System\xWoDqBg.exe
  C:\Windows\System\xWoDqBg.exe
  2⤵
  PID:3292
- C:\Windows\System\imGArpc.exe
  C:\Windows\System\imGArpc.exe
  2⤵
  PID:3468
- C:\Windows\System\tsIMoky.exe
  C:\Windows\System\tsIMoky.exe
  2⤵
  PID:3484
- C:\Windows\System\SSOUbQc.exe
  C:\Windows\System\SSOUbQc.exe
  2⤵
  PID:3512
- C:\Windows\System\pjAfqNg.exe
  C:\Windows\System\pjAfqNg.exe
  2⤵
  PID:3528
- C:\Windows\System\bRpuFyB.exe
  C:\Windows\System\bRpuFyB.exe
  2⤵
  PID:3552
- C:\Windows\System\TmJXitm.exe
  C:\Windows\System\TmJXitm.exe
  2⤵
  PID:3568
- C:\Windows\System\Zakmozd.exe
  C:\Windows\System\Zakmozd.exe
  2⤵
  PID:3588
- C:\Windows\System\nmKIJFE.exe
  C:\Windows\System\nmKIJFE.exe
  2⤵
  PID:3608
- C:\Windows\System\ScmYcDL.exe
  C:\Windows\System\ScmYcDL.exe
  2⤵
  PID:3624
- C:\Windows\System\BsTATmc.exe
  C:\Windows\System\BsTATmc.exe
  2⤵
  PID:3648
- C:\Windows\System\MogGbrs.exe
  C:\Windows\System\MogGbrs.exe
  2⤵
  PID:3668
- C:\Windows\System\LlmCPHo.exe
  C:\Windows\System\LlmCPHo.exe
  2⤵
  PID:3688
- C:\Windows\System\PsTWsUi.exe
  C:\Windows\System\PsTWsUi.exe
  2⤵
  PID:3712
- C:\Windows\System\puurYOz.exe
  C:\Windows\System\puurYOz.exe
  2⤵
  PID:3728
- C:\Windows\System\oZFsliY.exe
  C:\Windows\System\oZFsliY.exe
  2⤵
  PID:3744
- C:\Windows\System\gAIwSCq.exe
  C:\Windows\System\gAIwSCq.exe
  2⤵
  PID:3764
- C:\Windows\System\pLgRHIg.exe
  C:\Windows\System\pLgRHIg.exe
  2⤵
  PID:3792
- C:\Windows\System\ScPYfNP.exe
  C:\Windows\System\ScPYfNP.exe
  2⤵
  PID:3808
- C:\Windows\System\GeNiqLs.exe
  C:\Windows\System\GeNiqLs.exe
  2⤵
  PID:3832
- C:\Windows\System\rNHjqDP.exe
  C:\Windows\System\rNHjqDP.exe
  2⤵
  PID:3848
- C:\Windows\System\rNMiuvG.exe
  C:\Windows\System\rNMiuvG.exe
  2⤵
  PID:3868
- C:\Windows\System\YGlfEJc.exe
  C:\Windows\System\YGlfEJc.exe
  2⤵
  PID:3884
- C:\Windows\System\EpPDFmN.exe
  C:\Windows\System\EpPDFmN.exe
  2⤵
  PID:3912
- C:\Windows\System\kdASAnF.exe
  C:\Windows\System\kdASAnF.exe
  2⤵
  PID:3928
- C:\Windows\System\aUXEJig.exe
  C:\Windows\System\aUXEJig.exe
  2⤵
  PID:3948
- C:\Windows\System\IfkVovV.exe
  C:\Windows\System\IfkVovV.exe
  2⤵
  PID:3968
- C:\Windows\System\DipYwLv.exe
  C:\Windows\System\DipYwLv.exe
  2⤵
  PID:3988
- C:\Windows\System\jMrLOui.exe
  C:\Windows\System\jMrLOui.exe
  2⤵
  PID:4008
- C:\Windows\System\WRxpCuH.exe
  C:\Windows\System\WRxpCuH.exe
  2⤵
  PID:4028
- C:\Windows\System\ZDqnNzE.exe
  C:\Windows\System\ZDqnNzE.exe
  2⤵
  PID:4048
- C:\Windows\System\WURAAAz.exe
  C:\Windows\System\WURAAAz.exe
  2⤵
  PID:4068
- C:\Windows\System\udkEbAY.exe
  C:\Windows\System\udkEbAY.exe
  2⤵
  PID:4088
- C:\Windows\System\LbcJhMk.exe
  C:\Windows\System\LbcJhMk.exe
  2⤵
  PID:644
- C:\Windows\System\khWUjXH.exe
  C:\Windows\System\khWUjXH.exe
  2⤵
  PID:2796
- C:\Windows\System\pxTVLqX.exe
  C:\Windows\System\pxTVLqX.exe
  2⤵
  PID:960
- C:\Windows\System\rEqERaO.exe
  C:\Windows\System\rEqERaO.exe
  2⤵
  PID:2520
- C:\Windows\System\yjOWsnf.exe
  C:\Windows\System\yjOWsnf.exe
  2⤵
  PID:340
- C:\Windows\System\dVGiVNE.exe
  C:\Windows\System\dVGiVNE.exe
  2⤵
  PID:2960
- C:\Windows\System\PVkKmju.exe
  C:\Windows\System\PVkKmju.exe
  2⤵
  PID:3112
- C:\Windows\System\KGLTtPI.exe
  C:\Windows\System\KGLTtPI.exe
  2⤵
  PID:3184
- C:\Windows\System\LwONWmu.exe
  C:\Windows\System\LwONWmu.exe
  2⤵
  PID:2256
- C:\Windows\System\QiCKjHZ.exe
  C:\Windows\System\QiCKjHZ.exe
  2⤵
  PID:1412
- C:\Windows\System\PaEPcLc.exe
  C:\Windows\System\PaEPcLc.exe
  2⤵
  PID:2616
- C:\Windows\System\uAOYvoG.exe
  C:\Windows\System\uAOYvoG.exe
  2⤵
  PID:2900
- C:\Windows\System\OhsVpgy.exe
  C:\Windows\System\OhsVpgy.exe
  2⤵
  PID:2620
- C:\Windows\System\fuQrotV.exe
  C:\Windows\System\fuQrotV.exe
  2⤵
  PID:484
- C:\Windows\System\WDCxqGJ.exe
  C:\Windows\System\WDCxqGJ.exe
  2⤵
  PID:2764
- C:\Windows\System\NPPsNby.exe
  C:\Windows\System\NPPsNby.exe
  2⤵
  PID:3132
- C:\Windows\System\ApAviOr.exe
  C:\Windows\System\ApAviOr.exe
  2⤵
  PID:3252
- C:\Windows\System\WvzimgH.exe
  C:\Windows\System\WvzimgH.exe
  2⤵
  PID:2976
- C:\Windows\System\pucIApi.exe
  C:\Windows\System\pucIApi.exe
  2⤵
  PID:1684
- C:\Windows\System\rBbzqli.exe
  C:\Windows\System\rBbzqli.exe
  2⤵
  PID:3220
- C:\Windows\System\ndZtZNd.exe
  C:\Windows\System\ndZtZNd.exe
  2⤵
  PID:3200
- C:\Windows\System\hqNEaAr.exe
  C:\Windows\System\hqNEaAr.exe
  2⤵
  PID:3236
- C:\Windows\System\XuJCeqQ.exe
  C:\Windows\System\XuJCeqQ.exe
  2⤵
  PID:3300
- C:\Windows\System\AVEeUqy.exe
  C:\Windows\System\AVEeUqy.exe
  2⤵
  PID:3320
- C:\Windows\System\pXNtMaD.exe
  C:\Windows\System\pXNtMaD.exe
  2⤵
  PID:3336
- C:\Windows\System\UERjPOe.exe
  C:\Windows\System\UERjPOe.exe
  2⤵
  PID:3352
- C:\Windows\System\GMmTzya.exe
  C:\Windows\System\GMmTzya.exe
  2⤵
  PID:3368
- C:\Windows\System\pjsRxkO.exe
  C:\Windows\System\pjsRxkO.exe
  2⤵
  PID:3384
- C:\Windows\System\AvUcWii.exe
  C:\Windows\System\AvUcWii.exe
  2⤵
  PID:3400
- C:\Windows\System\wOYuCBU.exe
  C:\Windows\System\wOYuCBU.exe
  2⤵
  PID:3416
- C:\Windows\System\PvpPnMl.exe
  C:\Windows\System\PvpPnMl.exe
  2⤵
  PID:3444
- C:\Windows\System\QmDQLwa.exe
  C:\Windows\System\QmDQLwa.exe
  2⤵
  PID:3460
- C:\Windows\System\VqexOFz.exe
  C:\Windows\System\VqexOFz.exe
  2⤵
  PID:1956
- C:\Windows\System\jpXIydI.exe
  C:\Windows\System\jpXIydI.exe
  2⤵
  PID:1632
- C:\Windows\System\uCHPOLE.exe
  C:\Windows\System\uCHPOLE.exe
  2⤵
  PID:2804
- C:\Windows\System\hxeEzfS.exe
  C:\Windows\System\hxeEzfS.exe
  2⤵
  PID:1380
- C:\Windows\System\cZVWgyY.exe
  C:\Windows\System\cZVWgyY.exe
  2⤵
  PID:3496
- C:\Windows\System\xFZBBKm.exe
  C:\Windows\System\xFZBBKm.exe
  2⤵
  PID:3536
- C:\Windows\System\NjAHaTw.exe
  C:\Windows\System\NjAHaTw.exe
  2⤵
  PID:3560
- C:\Windows\System\YhcyqRa.exe
  C:\Windows\System\YhcyqRa.exe
  2⤵
  PID:3580
- C:\Windows\System\UbMvOlq.exe
  C:\Windows\System\UbMvOlq.exe
  2⤵
  PID:3600
- C:\Windows\System\cpTjNTT.exe
  C:\Windows\System\cpTjNTT.exe
  2⤵
  PID:3632
- C:\Windows\System\kOOHRay.exe
  C:\Windows\System\kOOHRay.exe
  2⤵
  PID:792
- C:\Windows\System\mMRbGFp.exe
  C:\Windows\System\mMRbGFp.exe
  2⤵
  PID:3676
- C:\Windows\System\JbKWMOW.exe
  C:\Windows\System\JbKWMOW.exe
  2⤵
  PID:3704
- C:\Windows\System\TMSMJcN.exe
  C:\Windows\System\TMSMJcN.exe
  2⤵
  PID:3736
- C:\Windows\System\HXYtJlL.exe
  C:\Windows\System\HXYtJlL.exe
  2⤵
  PID:3752
- C:\Windows\System\JzPRifm.exe
  C:\Windows\System\JzPRifm.exe
  2⤵
  PID:268
- C:\Windows\System\MmHDZAA.exe
  C:\Windows\System\MmHDZAA.exe
  2⤵
  PID:3788
- C:\Windows\System\sqQDvJV.exe
  C:\Windows\System\sqQDvJV.exe
  2⤵
  PID:1252
- C:\Windows\System\XMZQstN.exe
  C:\Windows\System\XMZQstN.exe
  2⤵
  PID:3820
- C:\Windows\System\BDAqrWf.exe
  C:\Windows\System\BDAqrWf.exe
  2⤵
  PID:4016
- C:\Windows\System\cqCADAu.exe
  C:\Windows\System\cqCADAu.exe
  2⤵
  PID:4044
- C:\Windows\System\APFNTRT.exe
  C:\Windows\System\APFNTRT.exe
  2⤵
  PID:4060
- C:\Windows\System\UYAEFFH.exe
  C:\Windows\System\UYAEFFH.exe
  2⤵
  PID:2424
- C:\Windows\System\gtbobLz.exe
  C:\Windows\System\gtbobLz.exe
  2⤵
  PID:1276
- C:\Windows\System\twoYrcZ.exe
  C:\Windows\System\twoYrcZ.exe
  2⤵
  PID:1900
- C:\Windows\System\NJRCvJQ.exe
  C:\Windows\System\NJRCvJQ.exe
  2⤵
  PID:2020
- C:\Windows\System\jNpCwgF.exe
  C:\Windows\System\jNpCwgF.exe
  2⤵
  PID:1452
- C:\Windows\System\fkTKmQG.exe
  C:\Windows\System\fkTKmQG.exe
  2⤵
  PID:3104
- C:\Windows\System\xxXUWao.exe
  C:\Windows\System\xxXUWao.exe
  2⤵
  PID:3216
- C:\Windows\System\jqBySEM.exe
  C:\Windows\System\jqBySEM.exe
  2⤵
  PID:2116
- C:\Windows\System\cnlDOZh.exe
  C:\Windows\System\cnlDOZh.exe
  2⤵
  PID:668
- C:\Windows\System\npVYCmh.exe
  C:\Windows\System\npVYCmh.exe
  2⤵
  PID:1496
- C:\Windows\System\hjXpMhX.exe
  C:\Windows\System\hjXpMhX.exe
  2⤵
  PID:1820
- C:\Windows\System\WrDsTHL.exe
  C:\Windows\System\WrDsTHL.exe
  2⤵
  PID:3284
- C:\Windows\System\VrIsXsE.exe
  C:\Windows\System\VrIsXsE.exe
  2⤵
  PID:2428
- C:\Windows\System\bpltggf.exe
  C:\Windows\System\bpltggf.exe
  2⤵
  PID:3312
- C:\Windows\System\IKZUCct.exe
  C:\Windows\System\IKZUCct.exe
  2⤵
  PID:3408
- C:\Windows\System\lzphHHg.exe
  C:\Windows\System\lzphHHg.exe
  2⤵
  PID:2544
- C:\Windows\System\vkVdVzi.exe
  C:\Windows\System\vkVdVzi.exe
  2⤵
  PID:2408
- C:\Windows\System\vnBUexD.exe
  C:\Windows\System\vnBUexD.exe
  2⤵
  PID:3660
- C:\Windows\System\SuRVVXb.exe
  C:\Windows\System\SuRVVXb.exe
  2⤵
  PID:2312
- C:\Windows\System\CDBgtBJ.exe
  C:\Windows\System\CDBgtBJ.exe
  2⤵
  PID:3860
- C:\Windows\System\dwHVFLN.exe
  C:\Windows\System\dwHVFLN.exe
  2⤵
  PID:3892
- C:\Windows\System\XLcbxST.exe
  C:\Windows\System\XLcbxST.exe
  2⤵
  PID:1428
- C:\Windows\System\oFDoasG.exe
  C:\Windows\System\oFDoasG.exe
  2⤵
  PID:2444
- C:\Windows\System\AcNIquE.exe
  C:\Windows\System\AcNIquE.exe
  2⤵
  PID:3440
- C:\Windows\System\QVPETiw.exe
  C:\Windows\System\QVPETiw.exe
  2⤵
  PID:3268
- C:\Windows\System\MeIjkwG.exe
  C:\Windows\System\MeIjkwG.exe
  2⤵
  PID:3332
- C:\Windows\System\OYBgULz.exe
  C:\Windows\System\OYBgULz.exe
  2⤵
  PID:3396
- C:\Windows\System\YnVuoTL.exe
  C:\Windows\System\YnVuoTL.exe
  2⤵
  PID:1228
- C:\Windows\System\RKkajll.exe
  C:\Windows\System\RKkajll.exe
  2⤵
  PID:2392
- C:\Windows\System\tuViRPs.exe
  C:\Windows\System\tuViRPs.exe
  2⤵
  PID:3476
- C:\Windows\System\BgOVJKg.exe
  C:\Windows\System\BgOVJKg.exe
  2⤵
  PID:3604
- C:\Windows\System\ruUMAdE.exe
  C:\Windows\System\ruUMAdE.exe
  2⤵
  PID:3740
- C:\Windows\System\fwfsHtJ.exe
  C:\Windows\System\fwfsHtJ.exe
  2⤵
  PID:3824
- C:\Windows\System\HdDYnUs.exe
  C:\Windows\System\HdDYnUs.exe
  2⤵
  PID:3756
- C:\Windows\System\VtUGKMG.exe
  C:\Windows\System\VtUGKMG.exe
  2⤵
  PID:3896
- C:\Windows\System\gbsvCBs.exe
  C:\Windows\System\gbsvCBs.exe
  2⤵
  PID:3944
- C:\Windows\System\zuYzmaY.exe
  C:\Windows\System\zuYzmaY.exe
  2⤵
  PID:2948
- C:\Windows\System\FUzKhAH.exe
  C:\Windows\System\FUzKhAH.exe
  2⤵
  PID:3940
- C:\Windows\System\PJGXekp.exe
  C:\Windows\System\PJGXekp.exe
  2⤵
  PID:1660
- C:\Windows\System\GmgZTIo.exe
  C:\Windows\System\GmgZTIo.exe
  2⤵
  PID:4104
- C:\Windows\System\vmIxcKj.exe
  C:\Windows\System\vmIxcKj.exe
  2⤵
  PID:4124
- C:\Windows\System\PuGGoHi.exe
  C:\Windows\System\PuGGoHi.exe
  2⤵
  PID:4140
- C:\Windows\System\hWRQIsf.exe
  C:\Windows\System\hWRQIsf.exe
  2⤵
  PID:4156
- C:\Windows\System\eJFFbNn.exe
  C:\Windows\System\eJFFbNn.exe
  2⤵
  PID:4172
- C:\Windows\System\uywhroW.exe
  C:\Windows\System\uywhroW.exe
  2⤵
  PID:4188
- C:\Windows\System\OoePwgY.exe
  C:\Windows\System\OoePwgY.exe
  2⤵
  PID:4204
- C:\Windows\System\bnWqIaq.exe
  C:\Windows\System\bnWqIaq.exe
  2⤵
  PID:4220
- C:\Windows\System\Tydiaop.exe
  C:\Windows\System\Tydiaop.exe
  2⤵
  PID:4236
- C:\Windows\System\OFebvmi.exe
  C:\Windows\System\OFebvmi.exe
  2⤵
  PID:4256
- C:\Windows\System\oIuaMxi.exe
  C:\Windows\System\oIuaMxi.exe
  2⤵
  PID:4272
- C:\Windows\System\MnYYWdN.exe
  C:\Windows\System\MnYYWdN.exe
  2⤵
  PID:4288
- C:\Windows\System\sQMQnqP.exe
  C:\Windows\System\sQMQnqP.exe
  2⤵
  PID:4304
- C:\Windows\System\vTsPISW.exe
  C:\Windows\System\vTsPISW.exe
  2⤵
  PID:4320
- C:\Windows\System\RLvpUQi.exe
  C:\Windows\System\RLvpUQi.exe
  2⤵
  PID:4336
- C:\Windows\System\qsiVyon.exe
  C:\Windows\System\qsiVyon.exe
  2⤵
  PID:4352
- C:\Windows\System\YsrAEPV.exe
  C:\Windows\System\YsrAEPV.exe
  2⤵
  PID:4368
- C:\Windows\System\xZJztud.exe
  C:\Windows\System\xZJztud.exe
  2⤵
  PID:4388
- C:\Windows\System\CFqyfhB.exe
  C:\Windows\System\CFqyfhB.exe
  2⤵
  PID:4404
- C:\Windows\System\RqTTmud.exe
  C:\Windows\System\RqTTmud.exe
  2⤵
  PID:4420
- C:\Windows\System\mNzrxns.exe
  C:\Windows\System\mNzrxns.exe
  2⤵
  PID:4436
- C:\Windows\System\jNVlgHl.exe
  C:\Windows\System\jNVlgHl.exe
  2⤵
  PID:4452
- C:\Windows\System\vCbukXM.exe
  C:\Windows\System\vCbukXM.exe
  2⤵
  PID:4468
- C:\Windows\System\zNZBmiw.exe
  C:\Windows\System\zNZBmiw.exe
  2⤵
  PID:4488
- C:\Windows\System\rvhaUic.exe
  C:\Windows\System\rvhaUic.exe
  2⤵
  PID:4504
- C:\Windows\System\cAPHHGa.exe
  C:\Windows\System\cAPHHGa.exe
  2⤵
  PID:4520
- C:\Windows\System\vSGaOjO.exe
  C:\Windows\System\vSGaOjO.exe
  2⤵
  PID:4608
- C:\Windows\System\qsIXjhO.exe
  C:\Windows\System\qsIXjhO.exe
  2⤵
  PID:4652
- C:\Windows\System\zRzaVWe.exe
  C:\Windows\System\zRzaVWe.exe
  2⤵
  PID:4668
- C:\Windows\System\FKsgdxe.exe
  C:\Windows\System\FKsgdxe.exe
  2⤵
  PID:4684
- C:\Windows\System\hJZKFiP.exe
  C:\Windows\System\hJZKFiP.exe
  2⤵
  PID:4700
- C:\Windows\System\zcViWmj.exe
  C:\Windows\System\zcViWmj.exe
  2⤵
  PID:4720
- C:\Windows\System\FzFyvtB.exe
  C:\Windows\System\FzFyvtB.exe
  2⤵
  PID:4736
- C:\Windows\System\MuWcCAz.exe
  C:\Windows\System\MuWcCAz.exe
  2⤵
  PID:4752
- C:\Windows\System\TYuylJc.exe
  C:\Windows\System\TYuylJc.exe
  2⤵
  PID:4768
- C:\Windows\System\wsMDaBz.exe
  C:\Windows\System\wsMDaBz.exe
  2⤵
  PID:4784
- C:\Windows\System\SriehuL.exe
  C:\Windows\System\SriehuL.exe
  2⤵
  PID:4800
- C:\Windows\System\wEhifPP.exe
  C:\Windows\System\wEhifPP.exe
  2⤵
  PID:4816
- C:\Windows\System\xmmhWsz.exe
  C:\Windows\System\xmmhWsz.exe
  2⤵
  PID:4836
- C:\Windows\System\aArFVBi.exe
  C:\Windows\System\aArFVBi.exe
  2⤵
  PID:4852
- C:\Windows\System\IgjFidt.exe
  C:\Windows\System\IgjFidt.exe
  2⤵
  PID:4868
- C:\Windows\System\RsYFUBP.exe
  C:\Windows\System\RsYFUBP.exe
  2⤵
  PID:4884
- C:\Windows\System\yffZNMw.exe
  C:\Windows\System\yffZNMw.exe
  2⤵
  PID:4900
- C:\Windows\System\isOHHPg.exe
  C:\Windows\System\isOHHPg.exe
  2⤵
  PID:4916
- C:\Windows\System\VOGceNM.exe
  C:\Windows\System\VOGceNM.exe
  2⤵
  PID:4932
- C:\Windows\System\NkPbnvU.exe
  C:\Windows\System\NkPbnvU.exe
  2⤵
  PID:4948
- C:\Windows\System\ZbZwHTE.exe
  C:\Windows\System\ZbZwHTE.exe
  2⤵
  PID:4964
- C:\Windows\System\FgWIgkh.exe
  C:\Windows\System\FgWIgkh.exe
  2⤵
  PID:4980
- C:\Windows\System\hSNshnc.exe
  C:\Windows\System\hSNshnc.exe
  2⤵
  PID:4996
- C:\Windows\System\ETsyOpj.exe
  C:\Windows\System\ETsyOpj.exe
  2⤵
  PID:5012
- C:\Windows\System\SLRCMbf.exe
  C:\Windows\System\SLRCMbf.exe
  2⤵
  PID:5028
- C:\Windows\System\JwRidqk.exe
  C:\Windows\System\JwRidqk.exe
  2⤵
  PID:5044
- C:\Windows\System\bpanIpb.exe
  C:\Windows\System\bpanIpb.exe
  2⤵
  PID:5060
- C:\Windows\System\BhIrvKR.exe
  C:\Windows\System\BhIrvKR.exe
  2⤵
  PID:5076
- C:\Windows\System\wDuXPQD.exe
  C:\Windows\System\wDuXPQD.exe
  2⤵
  PID:5092
- C:\Windows\System\iPzwaIp.exe
  C:\Windows\System\iPzwaIp.exe
  2⤵
  PID:5108
- C:\Windows\System\guSrHOI.exe
  C:\Windows\System\guSrHOI.exe
  2⤵
  PID:2220
- C:\Windows\System\sScAIFO.exe
  C:\Windows\System\sScAIFO.exe
  2⤵
  PID:3092
- C:\Windows\System\KseiXDB.exe
  C:\Windows\System\KseiXDB.exe
  2⤵
  PID:3456
- C:\Windows\System\qTtiwYV.exe
  C:\Windows\System\qTtiwYV.exe
  2⤵
  PID:3856
- C:\Windows\System\ZnFGvvi.exe
  C:\Windows\System\ZnFGvvi.exe
  2⤵
  PID:3880
- C:\Windows\System\zmqveAf.exe
  C:\Windows\System\zmqveAf.exe
  2⤵
  PID:816
- C:\Windows\System\tBElTLD.exe
  C:\Windows\System\tBElTLD.exe
  2⤵
  PID:2476
- C:\Windows\System\tqhtrqp.exe
  C:\Windows\System\tqhtrqp.exe
  2⤵
  PID:3680
- C:\Windows\System\LVURyfX.exe
  C:\Windows\System\LVURyfX.exe
  2⤵
  PID:2136
- C:\Windows\System\ZyUZkfd.exe
  C:\Windows\System\ZyUZkfd.exe
  2⤵
  PID:3936
- C:\Windows\System\ErJeOWY.exe
  C:\Windows\System\ErJeOWY.exe
  2⤵
  PID:4132
- C:\Windows\System\bvtZJlX.exe
  C:\Windows\System\bvtZJlX.exe
  2⤵
  PID:4200
- C:\Windows\System\mDNDfzx.exe
  C:\Windows\System\mDNDfzx.exe
  2⤵
  PID:4348
- C:\Windows\System\sMhvglW.exe
  C:\Windows\System\sMhvglW.exe
  2⤵
  PID:4416
- C:\Windows\System\sbMfrnP.exe
  C:\Windows\System\sbMfrnP.exe
  2⤵
  PID:4412
- C:\Windows\System\uIuFirK.exe
  C:\Windows\System\uIuFirK.exe
  2⤵
  PID:1476
- C:\Windows\System\QqCDnXR.exe
  C:\Windows\System\QqCDnXR.exe
  2⤵
  PID:4020
- C:\Windows\System\YHOcnQN.exe
  C:\Windows\System\YHOcnQN.exe
  2⤵
  PID:576
- C:\Windows\System\jQMvnqQ.exe
  C:\Windows\System\jQMvnqQ.exe
  2⤵
  PID:1364
- C:\Windows\System\YfiPCcw.exe
  C:\Windows\System\YfiPCcw.exe
  2⤵
  PID:3520
- C:\Windows\System\BDgXvvm.exe
  C:\Windows\System\BDgXvvm.exe
  2⤵
  PID:3492
- C:\Windows\System\xSuaNyA.exe
  C:\Windows\System\xSuaNyA.exe
  2⤵
  PID:2712
- C:\Windows\System\aYmVWLU.exe
  C:\Windows\System\aYmVWLU.exe
  2⤵
  PID:3620
- C:\Windows\System\fEFMgeX.exe
  C:\Windows\System\fEFMgeX.exe
  2⤵
  PID:4004
- C:\Windows\System\EaUELev.exe
  C:\Windows\System\EaUELev.exe
  2⤵
  PID:604
- C:\Windows\System\jIEzpyI.exe
  C:\Windows\System\jIEzpyI.exe
  2⤵
  PID:4328
- C:\Windows\System\JRNXyYt.exe
  C:\Windows\System\JRNXyYt.exe
  2⤵
  PID:4212
- C:\Windows\System\jKqYzXx.exe
  C:\Windows\System\jKqYzXx.exe
  2⤵
  PID:4376
- C:\Windows\System\upZuPsy.exe
  C:\Windows\System\upZuPsy.exe
  2⤵
  PID:4552
- C:\Windows\System\HhhmJTa.exe
  C:\Windows\System\HhhmJTa.exe
  2⤵
  PID:4860
- C:\Windows\System\TeRDTHM.exe
  C:\Windows\System\TeRDTHM.exe
  2⤵
  PID:4796
- C:\Windows\System\yenTlpo.exe
  C:\Windows\System\yenTlpo.exe
  2⤵
  PID:4956
- C:\Windows\System\GaiTZAH.exe
  C:\Windows\System\GaiTZAH.exe
  2⤵
  PID:5020
- C:\Windows\System\ydZzRSQ.exe
  C:\Windows\System\ydZzRSQ.exe
  2⤵
  PID:5084
- C:\Windows\System\JrxMzoQ.exe
  C:\Windows\System\JrxMzoQ.exe
  2⤵
  PID:3348
- C:\Windows\System\sACHGkr.exe
  C:\Windows\System\sACHGkr.exe
  2⤵
  PID:3696
- C:\Windows\System\HZPDyhh.exe
  C:\Windows\System\HZPDyhh.exe
  2⤵
  PID:4300
- C:\Windows\System\PeEqIqA.exe
  C:\Windows\System\PeEqIqA.exe
  2⤵
  PID:4808
- C:\Windows\System\AjNUruf.exe
  C:\Windows\System\AjNUruf.exe
  2⤵
  PID:3644
- C:\Windows\System\MGsocWJ.exe
  C:\Windows\System\MGsocWJ.exe
  2⤵
  PID:4444
- C:\Windows\System\yHdpWOF.exe
  C:\Windows\System\yHdpWOF.exe
  2⤵
  PID:5004
- C:\Windows\System\wOGrGWF.exe
  C:\Windows\System\wOGrGWF.exe
  2⤵
  PID:4880
- C:\Windows\System\GpbZWNR.exe
  C:\Windows\System\GpbZWNR.exe
  2⤵
  PID:4252
- C:\Windows\System\YdDTPQS.exe
  C:\Windows\System\YdDTPQS.exe
  2⤵
  PID:1240
- C:\Windows\System\fivRvLI.exe
  C:\Windows\System\fivRvLI.exe
  2⤵
  PID:1360
- C:\Windows\System\OTeUZac.exe
  C:\Windows\System\OTeUZac.exe
  2⤵
  PID:4692
- C:\Windows\System\copevuw.exe
  C:\Windows\System\copevuw.exe
  2⤵
  PID:4792
- C:\Windows\System\KASGoWF.exe
  C:\Windows\System\KASGoWF.exe
  2⤵
  PID:4988
- C:\Windows\System\Wjqrxch.exe
  C:\Windows\System\Wjqrxch.exe
  2⤵
  PID:1880
- C:\Windows\System\IVObhGs.exe
  C:\Windows\System\IVObhGs.exe
  2⤵
  PID:4168
- C:\Windows\System\xlBFBfj.exe
  C:\Windows\System\xlBFBfj.exe
  2⤵
  PID:3428
- C:\Windows\System\vmBbMhV.exe
  C:\Windows\System\vmBbMhV.exe
  2⤵
  PID:4380
- C:\Windows\System\sVlSaMU.exe
  C:\Windows\System\sVlSaMU.exe
  2⤵
  PID:4516
- C:\Windows\System\VuTlWIx.exe
  C:\Windows\System\VuTlWIx.exe
  2⤵
  PID:3576
- C:\Windows\System\kYHPgTx.exe
  C:\Windows\System\kYHPgTx.exe
  2⤵
  PID:4940
- C:\Windows\System\NBivONu.exe
  C:\Windows\System\NBivONu.exe
  2⤵
  PID:4296
- C:\Windows\System\wSWUuRc.exe
  C:\Windows\System\wSWUuRc.exe
  2⤵
  PID:2200
- C:\Windows\System\Reakdem.exe
  C:\Windows\System\Reakdem.exe
  2⤵
  PID:2108
- C:\Windows\System\DHSdtGX.exe
  C:\Windows\System\DHSdtGX.exe
  2⤵
  PID:3504
- C:\Windows\System\OMzqUFJ.exe
  C:\Windows\System\OMzqUFJ.exe
  2⤵
  PID:4116
- C:\Windows\System\znUyMRM.exe
  C:\Windows\System\znUyMRM.exe
  2⤵
  PID:4080
- C:\Windows\System\AuhwcQQ.exe
  C:\Windows\System\AuhwcQQ.exe
  2⤵
  PID:3376
- C:\Windows\System\kpFCETJ.exe
  C:\Windows\System\kpFCETJ.exe
  2⤵
  PID:4148
- C:\Windows\System\zIvMEnp.exe
  C:\Windows\System\zIvMEnp.exe
  2⤵
  PID:4360
- C:\Windows\System\kEdivIW.exe
  C:\Windows\System\kEdivIW.exe
  2⤵
  PID:4432
- C:\Windows\System\WJjVfBa.exe
  C:\Windows\System\WJjVfBa.exe
  2⤵
  PID:4544
- C:\Windows\System\rmlvEKP.exe
  C:\Windows\System\rmlvEKP.exe
  2⤵
  PID:4512
- C:\Windows\System\kKHjBfU.exe
  C:\Windows\System\kKHjBfU.exe
  2⤵
  PID:4576
- C:\Windows\System\jTRGEYV.exe
  C:\Windows\System\jTRGEYV.exe
  2⤵
  PID:4284
- C:\Windows\System\iZsmLeB.exe
  C:\Windows\System\iZsmLeB.exe
  2⤵
  PID:1256
- C:\Windows\System\furKxIn.exe
  C:\Windows\System\furKxIn.exe
  2⤵
  PID:2460
- C:\Windows\System\lFbDlGr.exe
  C:\Windows\System\lFbDlGr.exe
  2⤵
  PID:5052
- C:\Windows\System\saIQFbv.exe
  C:\Windows\System\saIQFbv.exe
  2⤵
  PID:4164
- C:\Windows\System\sGPmAOT.exe
  C:\Windows\System\sGPmAOT.exe
  2⤵
  PID:3976
- C:\Windows\System\tIZfaOA.exe
  C:\Windows\System\tIZfaOA.exe
  2⤵
  PID:4764
- C:\Windows\System\xVHzuBe.exe
  C:\Windows\System\xVHzuBe.exe
  2⤵
  PID:884
- C:\Windows\System\QZHoqbb.exe
  C:\Windows\System\QZHoqbb.exe
  2⤵
  PID:4828
- C:\Windows\System\GFrJvDc.exe
  C:\Windows\System\GFrJvDc.exe
  2⤵
  PID:4832
- C:\Windows\System\cUsFiFu.exe
  C:\Windows\System\cUsFiFu.exe
  2⤵
  PID:4040
- C:\Windows\System\MwDIURM.exe
  C:\Windows\System\MwDIURM.exe
  2⤵
  PID:4748
- C:\Windows\System\QxOcNmQ.exe
  C:\Windows\System\QxOcNmQ.exe
  2⤵
  PID:5132
- C:\Windows\System\gaIHGgw.exe
  C:\Windows\System\gaIHGgw.exe
  2⤵
  PID:5148
- C:\Windows\System\dEmHHrw.exe
  C:\Windows\System\dEmHHrw.exe
  2⤵
  PID:5164
- C:\Windows\System\SUXjoaj.exe
  C:\Windows\System\SUXjoaj.exe
  2⤵
  PID:5180
- C:\Windows\System\Laqneoa.exe
  C:\Windows\System\Laqneoa.exe
  2⤵
  PID:5196
- C:\Windows\System\ygwuWDg.exe
  C:\Windows\System\ygwuWDg.exe
  2⤵
  PID:5212
- C:\Windows\System\kVsmCYR.exe
  C:\Windows\System\kVsmCYR.exe
  2⤵
  PID:5228
- C:\Windows\System\XfVbbex.exe
  C:\Windows\System\XfVbbex.exe
  2⤵
  PID:5244
- C:\Windows\System\rQVQoKr.exe
  C:\Windows\System\rQVQoKr.exe
  2⤵
  PID:5260
- C:\Windows\System\eXhpLpT.exe
  C:\Windows\System\eXhpLpT.exe
  2⤵
  PID:5276
- C:\Windows\System\bwhbGfM.exe
  C:\Windows\System\bwhbGfM.exe
  2⤵
  PID:5292
- C:\Windows\System\CHrGebG.exe
  C:\Windows\System\CHrGebG.exe
  2⤵
  PID:5308
- C:\Windows\System\zlYxYrM.exe
  C:\Windows\System\zlYxYrM.exe
  2⤵
  PID:5324
- C:\Windows\System\ZbyTiTW.exe
  C:\Windows\System\ZbyTiTW.exe
  2⤵
  PID:5340
- C:\Windows\System\guxXKSZ.exe
  C:\Windows\System\guxXKSZ.exe
  2⤵
  PID:5356
- C:\Windows\System\ouGjyAm.exe
  C:\Windows\System\ouGjyAm.exe
  2⤵
  PID:5372
- C:\Windows\System\cHGMIrs.exe
  C:\Windows\System\cHGMIrs.exe
  2⤵
  PID:5388
- C:\Windows\System\lGpOWRr.exe
  C:\Windows\System\lGpOWRr.exe
  2⤵
  PID:5404
- C:\Windows\System\iGQYUKT.exe
  C:\Windows\System\iGQYUKT.exe
  2⤵
  PID:5420
- C:\Windows\System\iBmdhXM.exe
  C:\Windows\System\iBmdhXM.exe
  2⤵
  PID:5440
- C:\Windows\System\QBOWCDD.exe
  C:\Windows\System\QBOWCDD.exe
  2⤵
  PID:5456
- C:\Windows\System\UlVTMNN.exe
  C:\Windows\System\UlVTMNN.exe
  2⤵
  PID:5472
- C:\Windows\System\VlHscBP.exe
  C:\Windows\System\VlHscBP.exe
  2⤵
  PID:5648
- C:\Windows\System\JiTSqIQ.exe
  C:\Windows\System\JiTSqIQ.exe
  2⤵
  PID:5668
- C:\Windows\System\RaNgeda.exe
  C:\Windows\System\RaNgeda.exe
  2⤵
  PID:5688
- C:\Windows\System\WrkDFuT.exe
  C:\Windows\System\WrkDFuT.exe
  2⤵
  PID:5704
- C:\Windows\System\xwVfghB.exe
  C:\Windows\System\xwVfghB.exe
  2⤵
  PID:5720
- C:\Windows\System\NjhwfRu.exe
  C:\Windows\System\NjhwfRu.exe
  2⤵
  PID:5736
- C:\Windows\System\hzuDALU.exe
  C:\Windows\System\hzuDALU.exe
  2⤵
  PID:5752
- C:\Windows\System\rpfRFzj.exe
  C:\Windows\System\rpfRFzj.exe
  2⤵
  PID:5768
- C:\Windows\System\AmeRwDw.exe
  C:\Windows\System\AmeRwDw.exe
  2⤵
  PID:5784
- C:\Windows\System\dTpnGtG.exe
  C:\Windows\System\dTpnGtG.exe
  2⤵
  PID:5808
- C:\Windows\System\YFgiWYy.exe
  C:\Windows\System\YFgiWYy.exe
  2⤵
  PID:5824
- C:\Windows\System\YLVPuKB.exe
  C:\Windows\System\YLVPuKB.exe
  2⤵
  PID:5840
- C:\Windows\System\XObBmmo.exe
  C:\Windows\System\XObBmmo.exe
  2⤵
  PID:5856
- C:\Windows\System\hmDYEiO.exe
  C:\Windows\System\hmDYEiO.exe
  2⤵
  PID:5872
- C:\Windows\System\RVmNRec.exe
  C:\Windows\System\RVmNRec.exe
  2⤵
  PID:5892
- C:\Windows\System\YbniaZR.exe
  C:\Windows\System\YbniaZR.exe
  2⤵
  PID:5908
- C:\Windows\System\JBUnUJf.exe
  C:\Windows\System\JBUnUJf.exe
  2⤵
  PID:5924
- C:\Windows\System\EdmtSzt.exe
  C:\Windows\System\EdmtSzt.exe
  2⤵
  PID:5940
- C:\Windows\System\nQPIbnR.exe
  C:\Windows\System\nQPIbnR.exe
  2⤵
  PID:5956
- C:\Windows\System\DOSNbDl.exe
  C:\Windows\System\DOSNbDl.exe
  2⤵
  PID:5972
- C:\Windows\System\fBEPsNZ.exe
  C:\Windows\System\fBEPsNZ.exe
  2⤵
  PID:5988
- C:\Windows\System\rOHsfNS.exe
  C:\Windows\System\rOHsfNS.exe
  2⤵
  PID:6004
- C:\Windows\System\IBZLmbU.exe
  C:\Windows\System\IBZLmbU.exe
  2⤵
  PID:6020
- C:\Windows\System\CipsDiF.exe
  C:\Windows\System\CipsDiF.exe
  2⤵
  PID:6036
- C:\Windows\System\VwxKgts.exe
  C:\Windows\System\VwxKgts.exe
  2⤵
  PID:6056
- C:\Windows\System\qjcmfmC.exe
  C:\Windows\System\qjcmfmC.exe
  2⤵
  PID:6072
- C:\Windows\System\YgLEkbn.exe
  C:\Windows\System\YgLEkbn.exe
  2⤵
  PID:6088
- C:\Windows\System\dtXMtTz.exe
  C:\Windows\System\dtXMtTz.exe
  2⤵
  PID:6104
- C:\Windows\System\AfVAWOI.exe
  C:\Windows\System\AfVAWOI.exe
  2⤵
  PID:6120
- C:\Windows\System\vKoFJQn.exe
  C:\Windows\System\vKoFJQn.exe
  2⤵
  PID:6136
- C:\Windows\System\ScHDAXE.exe
  C:\Windows\System\ScHDAXE.exe
  2⤵
  PID:3120
- C:\Windows\System\ZDilWER.exe
  C:\Windows\System\ZDilWER.exe
  2⤵
  PID:4316
- C:\Windows\System\eVQRqgI.exe
  C:\Windows\System\eVQRqgI.exe
  2⤵
  PID:2028
- C:\Windows\System\FWyQQJX.exe
  C:\Windows\System\FWyQQJX.exe
  2⤵
  PID:4976
- C:\Windows\System\Lncyuvi.exe
  C:\Windows\System\Lncyuvi.exe
  2⤵
  PID:5116
- C:\Windows\System\FLkpCjZ.exe
  C:\Windows\System\FLkpCjZ.exe
  2⤵
  PID:4844
- C:\Windows\System\dLELuTL.exe
  C:\Windows\System\dLELuTL.exe
  2⤵
  PID:2480
- C:\Windows\System\tLYvuIC.exe
  C:\Windows\System\tLYvuIC.exe
  2⤵
  PID:5128
- C:\Windows\System\Ssjuxrq.exe
  C:\Windows\System\Ssjuxrq.exe
  2⤵
  PID:5192
- C:\Windows\System\XYASzBh.exe
  C:\Windows\System\XYASzBh.exe
  2⤵
  PID:3664
- C:\Windows\System\IYjFQCE.exe
  C:\Windows\System\IYjFQCE.exe
  2⤵
  PID:4312
- C:\Windows\System\Bmovwos.exe
  C:\Windows\System\Bmovwos.exe
  2⤵
  PID:4428
- C:\Windows\System\jabZJSE.exe
  C:\Windows\System\jabZJSE.exe
  2⤵
  PID:4540
- C:\Windows\System\QCwnYbr.exe
  C:\Windows\System\QCwnYbr.exe
  2⤵
  PID:4152
- C:\Windows\System\XOcCNhW.exe
  C:\Windows\System\XOcCNhW.exe
  2⤵
  PID:4676
- C:\Windows\System\cqxJOKS.exe
  C:\Windows\System\cqxJOKS.exe
  2⤵
  PID:5140
- C:\Windows\System\PKaRxDq.exe
  C:\Windows\System\PKaRxDq.exe
  2⤵
  PID:5204
- C:\Windows\System\KoiVFdf.exe
  C:\Windows\System\KoiVFdf.exe
  2⤵
  PID:5208
- C:\Windows\System\DWMleLL.exe
  C:\Windows\System\DWMleLL.exe
  2⤵
  PID:5484
- C:\Windows\System\ZwcpwVh.exe
  C:\Windows\System\ZwcpwVh.exe
  2⤵
  PID:5480
- C:\Windows\System\ZrWQebN.exe
  C:\Windows\System\ZrWQebN.exe
  2⤵
  PID:5256
- C:\Windows\System\DbFMIDr.exe
  C:\Windows\System\DbFMIDr.exe
  2⤵
  PID:5332
- C:\Windows\System\hyQXTHR.exe
  C:\Windows\System\hyQXTHR.exe
  2⤵
  PID:5416
- C:\Windows\System\iEyzUVb.exe
  C:\Windows\System\iEyzUVb.exe
  2⤵
  PID:5508
- C:\Windows\System\gqCjZlr.exe
  C:\Windows\System\gqCjZlr.exe
  2⤵
  PID:5536
- C:\Windows\System\vkynBTw.exe
  C:\Windows\System\vkynBTw.exe
  2⤵
  PID:5556
- C:\Windows\System\BrjvkTe.exe
  C:\Windows\System\BrjvkTe.exe
  2⤵
  PID:5320
- C:\Windows\System\ptdYUfP.exe
  C:\Windows\System\ptdYUfP.exe
  2⤵
  PID:5524
- C:\Windows\System\JvrwcGb.exe
  C:\Windows\System\JvrwcGb.exe
  2⤵
  PID:5592
- C:\Windows\System\IQTiCDm.exe
  C:\Windows\System\IQTiCDm.exe
  2⤵
  PID:5588
- C:\Windows\System\ioDVvgR.exe
  C:\Windows\System\ioDVvgR.exe
  2⤵
  PID:5620
- C:\Windows\System\efYUaPF.exe
  C:\Windows\System\efYUaPF.exe
  2⤵
  PID:5632
- C:\Windows\System\tzXWVkK.exe
  C:\Windows\System\tzXWVkK.exe
  2⤵
  PID:5640
- C:\Windows\System\tOBkpws.exe
  C:\Windows\System\tOBkpws.exe
  2⤵
  PID:5684
- C:\Windows\System\unTBtyc.exe
  C:\Windows\System\unTBtyc.exe
  2⤵
  PID:5716
- C:\Windows\System\wldLKmC.exe
  C:\Windows\System\wldLKmC.exe
  2⤵
  PID:5288
- C:\Windows\System\UQZSQQa.exe
  C:\Windows\System\UQZSQQa.exe
  2⤵
  PID:5852
- C:\Windows\System\VEQNXdV.exe
  C:\Windows\System\VEQNXdV.exe
  2⤵
  PID:5816
- C:\Windows\System\uXuFzme.exe
  C:\Windows\System\uXuFzme.exe
  2⤵
  PID:2872
- C:\Windows\System\gOsOmte.exe
  C:\Windows\System\gOsOmte.exe
  2⤵
  PID:5948
- C:\Windows\System\cALKwml.exe
  C:\Windows\System\cALKwml.exe
  2⤵
  PID:5660
- C:\Windows\System\MqJzlrt.exe
  C:\Windows\System\MqJzlrt.exe
  2⤵
  PID:5400
- C:\Windows\System\RNmJXzR.exe
  C:\Windows\System\RNmJXzR.exe
  2⤵
  PID:5368
- C:\Windows\System\ocEMcLx.exe
  C:\Windows\System\ocEMcLx.exe
  2⤵
  PID:5764
- C:\Windows\System\dOncAAe.exe
  C:\Windows\System\dOncAAe.exe
  2⤵
  PID:5868
- C:\Windows\System\VdycqQO.exe
  C:\Windows\System\VdycqQO.exe
  2⤵
  PID:5832
- C:\Windows\System\AFtoMnz.exe
  C:\Windows\System\AFtoMnz.exe
  2⤵
  PID:5364
- C:\Windows\System\UOCnLlT.exe
  C:\Windows\System\UOCnLlT.exe
  2⤵
  PID:6064
- C:\Windows\System\TFRZTKI.exe
  C:\Windows\System\TFRZTKI.exe
  2⤵
  PID:6000
- C:\Windows\System\yPkDPjS.exe
  C:\Windows\System\yPkDPjS.exe
  2⤵
  PID:6052
- C:\Windows\System\OjHVPyE.exe
  C:\Windows\System\OjHVPyE.exe
  2⤵
  PID:6084
- C:\Windows\System\SQxPDZm.exe
  C:\Windows\System\SQxPDZm.exe
  2⤵
  PID:5104
- C:\Windows\System\BtsQymE.exe
  C:\Windows\System\BtsQymE.exe
  2⤵
  PID:4660
- C:\Windows\System\miEjrtg.exe
  C:\Windows\System\miEjrtg.exe
  2⤵
  PID:6132
- C:\Windows\System\OmCgbdt.exe
  C:\Windows\System\OmCgbdt.exe
  2⤵
  PID:2332
- C:\Windows\System\SfpbBBT.exe
  C:\Windows\System\SfpbBBT.exe
  2⤵
  PID:6096
- C:\Windows\System\bFkREBx.exe
  C:\Windows\System\bFkREBx.exe
  2⤵
  PID:5176
- C:\Windows\System\rsBIaFA.exe
  C:\Windows\System\rsBIaFA.exe
  2⤵
  PID:3996
- C:\Windows\System\gPQjUir.exe
  C:\Windows\System\gPQjUir.exe
  2⤵
  PID:1592
- C:\Windows\System\cJNNYWa.exe
  C:\Windows\System\cJNNYWa.exe
  2⤵
  PID:5432
- C:\Windows\System\akauHTF.exe
  C:\Windows\System\akauHTF.exe
  2⤵
  PID:5036
- C:\Windows\System\SRmljUI.exe
  C:\Windows\System\SRmljUI.exe
  2⤵
  PID:5220
- C:\Windows\System\UikQiPf.exe
  C:\Windows\System\UikQiPf.exe
  2⤵
  PID:5268
- C:\Windows\System\weAdosm.exe
  C:\Windows\System\weAdosm.exe
  2⤵
  PID:5528
- C:\Windows\System\yWyTfNb.exe
  C:\Windows\System\yWyTfNb.exe
  2⤵
  PID:5532
- C:\Windows\System\TwsEtnr.exe
  C:\Windows\System\TwsEtnr.exe
  2⤵
  PID:5284
- C:\Windows\System\xwwhODo.exe
  C:\Windows\System\xwwhODo.exe
  2⤵
  PID:5712
- C:\Windows\System\oqRlMSW.exe
  C:\Windows\System\oqRlMSW.exe
  2⤵
  PID:5888
- C:\Windows\System\etkhwZH.exe
  C:\Windows\System\etkhwZH.exe
  2⤵
  PID:5436
- C:\Windows\System\OJDGIIn.exe
  C:\Windows\System\OJDGIIn.exe
  2⤵
  PID:5552
- C:\Windows\System\IsMCMgr.exe
  C:\Windows\System\IsMCMgr.exe
  2⤵
  PID:5604
- C:\Windows\System\GuaZgNC.exe
  C:\Windows\System\GuaZgNC.exe
  2⤵
  PID:5820
- C:\Windows\System\ivtyaJR.exe
  C:\Windows\System\ivtyaJR.exe
  2⤵
  PID:5952
- C:\Windows\System\yamHDMT.exe
  C:\Windows\System\yamHDMT.exe
  2⤵
  PID:6044
- C:\Windows\System\WWrOVNr.exe
  C:\Windows\System\WWrOVNr.exe
  2⤵
  PID:5900
- C:\Windows\System\ijBthLW.exe
  C:\Windows\System\ijBthLW.exe
  2⤵
  PID:5804
- C:\Windows\System\lSEAJrb.exe
  C:\Windows\System\lSEAJrb.exe
  2⤵
  PID:5936
- C:\Windows\System\CSjVeZC.exe
  C:\Windows\System\CSjVeZC.exe
  2⤵
  PID:4716
- C:\Windows\System\vPaGrwH.exe
  C:\Windows\System\vPaGrwH.exe
  2⤵
  PID:4620
- C:\Windows\System\okWgPYt.exe
  C:\Windows\System\okWgPYt.exe
  2⤵
  PID:4780
- C:\Windows\System\rfRdOMa.exe
  C:\Windows\System\rfRdOMa.exe
  2⤵
  PID:6128
- C:\Windows\System\aXIvgLb.exe
  C:\Windows\System\aXIvgLb.exe
  2⤵
  PID:5492
- C:\Windows\System\vMeClio.exe
  C:\Windows\System\vMeClio.exe
  2⤵
  PID:5612
- C:\Windows\System\fIQblav.exe
  C:\Windows\System\fIQblav.exe
  2⤵
  PID:3964
- C:\Windows\System\mmnDlst.exe
  C:\Windows\System\mmnDlst.exe
  2⤵
  PID:4848
- C:\Windows\System\AsethDe.exe
  C:\Windows\System\AsethDe.exe
  2⤵
  PID:5496
- C:\Windows\System\OWAvxUo.exe
  C:\Windows\System\OWAvxUo.exe
  2⤵
  PID:5504
- C:\Windows\System\LHLpmiI.exe
  C:\Windows\System\LHLpmiI.exe
  2⤵
  PID:5700
- C:\Windows\System\PEyioWy.exe
  C:\Windows\System\PEyioWy.exe
  2⤵
  PID:5792
- C:\Windows\System\XwHrGsQ.exe
  C:\Windows\System\XwHrGsQ.exe
  2⤵
  PID:5696
- C:\Windows\System\AsDStXv.exe
  C:\Windows\System\AsDStXv.exe
  2⤵
  PID:6116
- C:\Windows\System\FnUwTMa.exe
  C:\Windows\System\FnUwTMa.exe
  2⤵
  PID:5760
- C:\Windows\System\BusMteY.exe
  C:\Windows\System\BusMteY.exe
  2⤵
  PID:1764
- C:\Windows\System\NbHLpzp.exe
  C:\Windows\System\NbHLpzp.exe
  2⤵
  PID:6068
- C:\Windows\System\NMvhPTR.exe
  C:\Windows\System\NMvhPTR.exe
  2⤵
  PID:5880
- C:\Windows\System\DCIRbjO.exe
  C:\Windows\System\DCIRbjO.exe
  2⤵
  PID:5516
- C:\Windows\System\clWosPF.exe
  C:\Windows\System\clWosPF.exe
  2⤵
  PID:2856
- C:\Windows\System\cJVYDXJ.exe
  C:\Windows\System\cJVYDXJ.exe
  2⤵
  PID:5576
- C:\Windows\System\cXqgwaN.exe
  C:\Windows\System\cXqgwaN.exe
  2⤵
  PID:5464
- C:\Windows\System\DGUArUJ.exe
  C:\Windows\System\DGUArUJ.exe
  2⤵
  PID:6156
- C:\Windows\System\roJtKXw.exe
  C:\Windows\System\roJtKXw.exe
  2⤵
  PID:6172
- C:\Windows\System\RemghbD.exe
  C:\Windows\System\RemghbD.exe
  2⤵
  PID:6188
- C:\Windows\System\ecgCIYu.exe
  C:\Windows\System\ecgCIYu.exe
  2⤵
  PID:6204
- C:\Windows\System\PRCDYYa.exe
  C:\Windows\System\PRCDYYa.exe
  2⤵
  PID:6220
- C:\Windows\System\cWeSHDl.exe
  C:\Windows\System\cWeSHDl.exe
  2⤵
  PID:6236
- C:\Windows\System\rVmvKRg.exe
  C:\Windows\System\rVmvKRg.exe
  2⤵
  PID:6252
- C:\Windows\System\LFvTKOa.exe
  C:\Windows\System\LFvTKOa.exe
  2⤵
  PID:6268
- C:\Windows\System\usPkLfy.exe
  C:\Windows\System\usPkLfy.exe
  2⤵
  PID:6284
- C:\Windows\System\UFeqANI.exe
  C:\Windows\System\UFeqANI.exe
  2⤵
  PID:6300
- C:\Windows\System\nnWzoBH.exe
  C:\Windows\System\nnWzoBH.exe
  2⤵
  PID:6316
- C:\Windows\System\oHsfDUZ.exe
  C:\Windows\System\oHsfDUZ.exe
  2⤵
  PID:6332
- C:\Windows\System\YKEzizM.exe
  C:\Windows\System\YKEzizM.exe
  2⤵
  PID:6348
- C:\Windows\System\aeSYUNw.exe
  C:\Windows\System\aeSYUNw.exe
  2⤵
  PID:6364
- C:\Windows\System\TxkDBCG.exe
  C:\Windows\System\TxkDBCG.exe
  2⤵
  PID:6380
- C:\Windows\System\xKMASau.exe
  C:\Windows\System\xKMASau.exe
  2⤵
  PID:6396
- C:\Windows\System\MZFluMd.exe
  C:\Windows\System\MZFluMd.exe
  2⤵
  PID:6412
- C:\Windows\System\KhNuFyt.exe
  C:\Windows\System\KhNuFyt.exe
  2⤵
  PID:6428
- C:\Windows\System\KXZrkrE.exe
  C:\Windows\System\KXZrkrE.exe
  2⤵
  PID:6444
- C:\Windows\System\ACXWsCP.exe
  C:\Windows\System\ACXWsCP.exe
  2⤵
  PID:6460
- C:\Windows\System\NGBQGfg.exe
  C:\Windows\System\NGBQGfg.exe
  2⤵
  PID:6476
- C:\Windows\System\GQsVpAt.exe
  C:\Windows\System\GQsVpAt.exe
  2⤵
  PID:6492
- C:\Windows\System\zRmAbth.exe
  C:\Windows\System\zRmAbth.exe
  2⤵
  PID:6508
- C:\Windows\System\bTpvOVO.exe
  C:\Windows\System\bTpvOVO.exe
  2⤵
  PID:6524
- C:\Windows\System\ayynyHD.exe
  C:\Windows\System\ayynyHD.exe
  2⤵
  PID:6540
- C:\Windows\System\AFVISLF.exe
  C:\Windows\System\AFVISLF.exe
  2⤵
  PID:6556
- C:\Windows\System\jikncgN.exe
  C:\Windows\System\jikncgN.exe
  2⤵
  PID:6572
- C:\Windows\System\XTUUagI.exe
  C:\Windows\System\XTUUagI.exe
  2⤵
  PID:6588
- C:\Windows\System\RDNjyvx.exe
  C:\Windows\System\RDNjyvx.exe
  2⤵
  PID:6604
- C:\Windows\System\YAwrFBG.exe
  C:\Windows\System\YAwrFBG.exe
  2⤵
  PID:6620
- C:\Windows\System\gvTyCDz.exe
  C:\Windows\System\gvTyCDz.exe
  2⤵
  PID:6636
- C:\Windows\System\uQNPpsx.exe
  C:\Windows\System\uQNPpsx.exe
  2⤵
  PID:6652
- C:\Windows\System\LpceKKb.exe
  C:\Windows\System\LpceKKb.exe
  2⤵
  PID:6668
- C:\Windows\System\LzsaiDO.exe
  C:\Windows\System\LzsaiDO.exe
  2⤵
  PID:6684
- C:\Windows\System\gXYkhDO.exe
  C:\Windows\System\gXYkhDO.exe
  2⤵
  PID:6700
- C:\Windows\System\WEcpbaq.exe
  C:\Windows\System\WEcpbaq.exe
  2⤵
  PID:6716
- C:\Windows\System\MmDgCNi.exe
  C:\Windows\System\MmDgCNi.exe
  2⤵
  PID:6732
- C:\Windows\System\DTWbvhr.exe
  C:\Windows\System\DTWbvhr.exe
  2⤵
  PID:6748
- C:\Windows\System\hnTrtAo.exe
  C:\Windows\System\hnTrtAo.exe
  2⤵
  PID:6764
- C:\Windows\System\JIOAlnq.exe
  C:\Windows\System\JIOAlnq.exe
  2⤵
  PID:6780
- C:\Windows\System\BGWjbHi.exe
  C:\Windows\System\BGWjbHi.exe
  2⤵
  PID:6796
- C:\Windows\System\aYFELEg.exe
  C:\Windows\System\aYFELEg.exe
  2⤵
  PID:6812
- C:\Windows\System\VLnJeFV.exe
  C:\Windows\System\VLnJeFV.exe
  2⤵
  PID:6828
- C:\Windows\System\HuBFfDS.exe
  C:\Windows\System\HuBFfDS.exe
  2⤵
  PID:6844
- C:\Windows\System\RPpmvik.exe
  C:\Windows\System\RPpmvik.exe
  2⤵
  PID:6860
- C:\Windows\System\xotSTIy.exe
  C:\Windows\System\xotSTIy.exe
  2⤵
  PID:6876
- C:\Windows\System\YBjtFuu.exe
  C:\Windows\System\YBjtFuu.exe
  2⤵
  PID:6892
- C:\Windows\System\EbuUGbm.exe
  C:\Windows\System\EbuUGbm.exe
  2⤵
  PID:6908
- C:\Windows\System\kSQpMLf.exe
  C:\Windows\System\kSQpMLf.exe
  2⤵
  PID:6924
- C:\Windows\System\jnkuZGs.exe
  C:\Windows\System\jnkuZGs.exe
  2⤵
  PID:6940
- C:\Windows\System\rhaIYVp.exe
  C:\Windows\System\rhaIYVp.exe
  2⤵
  PID:6956
- C:\Windows\System\ytomAJJ.exe
  C:\Windows\System\ytomAJJ.exe
  2⤵
  PID:6972
- C:\Windows\System\dNvADdF.exe
  C:\Windows\System\dNvADdF.exe
  2⤵
  PID:6988
- C:\Windows\System\TyoLGZk.exe
  C:\Windows\System\TyoLGZk.exe
  2⤵
  PID:7004
- C:\Windows\System\PKfibqm.exe
  C:\Windows\System\PKfibqm.exe
  2⤵
  PID:7020
- C:\Windows\System\hWFeFZw.exe
  C:\Windows\System\hWFeFZw.exe
  2⤵
  PID:7036
- C:\Windows\System\kfwcfle.exe
  C:\Windows\System\kfwcfle.exe
  2⤵
  PID:7052
- C:\Windows\System\EzdPvCY.exe
  C:\Windows\System\EzdPvCY.exe
  2⤵
  PID:7068
- C:\Windows\System\oipezCk.exe
  C:\Windows\System\oipezCk.exe
  2⤵
  PID:7084
- C:\Windows\System\QriFYuv.exe
  C:\Windows\System\QriFYuv.exe
  2⤵
  PID:7100
- C:\Windows\System\BdiDLtk.exe
  C:\Windows\System\BdiDLtk.exe
  2⤵
  PID:7116
- C:\Windows\System\QnbABlA.exe
  C:\Windows\System\QnbABlA.exe
  2⤵
  PID:7132
- C:\Windows\System\mESdmPg.exe
  C:\Windows\System\mESdmPg.exe
  2⤵
  PID:7148
- C:\Windows\System\QrSJDIW.exe
  C:\Windows\System\QrSJDIW.exe
  2⤵
  PID:7164
- C:\Windows\System\IHjMNkf.exe
  C:\Windows\System\IHjMNkf.exe
  2⤵
  PID:5548
- C:\Windows\System\krNuxXo.exe
  C:\Windows\System\krNuxXo.exe
  2⤵
  PID:2304
- C:\Windows\System\KQGZxzK.exe
  C:\Windows\System\KQGZxzK.exe
  2⤵
  PID:5916
- C:\Windows\System\ybaHBqP.exe
  C:\Windows\System\ybaHBqP.exe
  2⤵
  PID:6148
- C:\Windows\System\MZuhClH.exe
  C:\Windows\System\MZuhClH.exe
  2⤵
  PID:6200
- C:\Windows\System\SYEAdvi.exe
  C:\Windows\System\SYEAdvi.exe
  2⤵
  PID:6292
- C:\Windows\System\xrgctaq.exe
  C:\Windows\System\xrgctaq.exe
  2⤵
  PID:6328
- C:\Windows\System\TZPqUXf.exe
  C:\Windows\System\TZPqUXf.exe
  2⤵
  PID:6360
- C:\Windows\System\bPPvoPJ.exe
  C:\Windows\System\bPPvoPJ.exe
  2⤵
  PID:6420
- C:\Windows\System\DLRzonI.exe
  C:\Windows\System\DLRzonI.exe
  2⤵
  PID:6216
- C:\Windows\System\rLbUSIw.exe
  C:\Windows\System\rLbUSIw.exe
  2⤵
  PID:6520
- C:\Windows\System\IAKqDZd.exe
  C:\Windows\System\IAKqDZd.exe
  2⤵
  PID:6344
- C:\Windows\System\KrgxbUG.exe
  C:\Windows\System\KrgxbUG.exe
  2⤵
  PID:6580
- C:\Windows\System\DUeEQiM.exe
  C:\Windows\System\DUeEQiM.exe
  2⤵
  PID:6616
- C:\Windows\System\nqtXJFH.exe
  C:\Windows\System\nqtXJFH.exe
  2⤵
  PID:6472
- C:\Windows\System\NhXtvcw.exe
  C:\Windows\System\NhXtvcw.exe
  2⤵
  PID:6648
- C:\Windows\System\kBNChby.exe
  C:\Windows\System\kBNChby.exe
  2⤵
  PID:6568
- C:\Windows\System\ODXxqOx.exe
  C:\Windows\System\ODXxqOx.exe
  2⤵
  PID:6504
- C:\Windows\System\fFwEXjf.exe
  C:\Windows\System\fFwEXjf.exe
  2⤵
  PID:6712
- C:\Windows\System\qMljBEP.exe
  C:\Windows\System\qMljBEP.exe
  2⤵
  PID:6660
- C:\Windows\System\yxXijMB.exe
  C:\Windows\System\yxXijMB.exe
  2⤵
  PID:6536
- C:\Windows\System\LlzPdbW.exe
  C:\Windows\System\LlzPdbW.exe
  2⤵
  PID:6628
- C:\Windows\System\CEPTtds.exe
  C:\Windows\System\CEPTtds.exe
  2⤵
  PID:6900
- C:\Windows\System\wvVUwnF.exe
  C:\Windows\System\wvVUwnF.exe
  2⤵
  PID:6692
- C:\Windows\System\ztscEAP.exe
  C:\Windows\System\ztscEAP.exe
  2⤵
  PID:6904
- C:\Windows\System\IecJfDc.exe
  C:\Windows\System\IecJfDc.exe
  2⤵
  PID:6856
- C:\Windows\System\STbrrSP.exe
  C:\Windows\System\STbrrSP.exe
  2⤵
  PID:6888
- C:\Windows\System\dYvksKz.exe
  C:\Windows\System\dYvksKz.exe
  2⤵
  PID:6936
- C:\Windows\System\UcUKMMN.exe
  C:\Windows\System\UcUKMMN.exe
  2⤵
  PID:7000
- C:\Windows\System\uPEmCtB.exe
  C:\Windows\System\uPEmCtB.exe
  2⤵
  PID:7092
- C:\Windows\System\IwhMPAF.exe
  C:\Windows\System\IwhMPAF.exe
  2⤵
  PID:7044
- C:\Windows\System\MsVeTcu.exe
  C:\Windows\System\MsVeTcu.exe
  2⤵
  PID:7012
- C:\Windows\System\gnXalwi.exe
  C:\Windows\System\gnXalwi.exe
  2⤵
  PID:7080
- C:\Windows\System\cPEwSBX.exe
  C:\Windows\System\cPEwSBX.exe
  2⤵
  PID:7112
- C:\Windows\System\EVboxpk.exe
  C:\Windows\System\EVboxpk.exe
  2⤵
  PID:5316
- C:\Windows\System\vzvITtW.exe
  C:\Windows\System\vzvITtW.exe
  2⤵
  PID:7156
- C:\Windows\System\jyeVbPD.exe
  C:\Windows\System\jyeVbPD.exe
  2⤵
  PID:5580
- C:\Windows\System\NMEyOEq.exe
  C:\Windows\System\NMEyOEq.exe
  2⤵
  PID:6260
- C:\Windows\System\rGJYQkS.exe
  C:\Windows\System\rGJYQkS.exe
  2⤵
  PID:6456
- C:\Windows\System\pKqhlPZ.exe
  C:\Windows\System\pKqhlPZ.exe
  2⤵
  PID:6440
- C:\Windows\System\fAolmfk.exe
  C:\Windows\System\fAolmfk.exe
  2⤵
  PID:6392
- C:\Windows\System\zdSjOhr.exe
  C:\Windows\System\zdSjOhr.exe
  2⤵
  PID:6488
- C:\Windows\System\Vliayfk.exe
  C:\Windows\System\Vliayfk.exe
  2⤵
  PID:6500
- C:\Windows\System\OEETsjK.exe
  C:\Windows\System\OEETsjK.exe
  2⤵
  PID:6836
- C:\Windows\System\HfKkiOc.exe
  C:\Windows\System\HfKkiOc.exe
  2⤵
  PID:6664
- C:\Windows\System\susZnzO.exe
  C:\Windows\System\susZnzO.exe
  2⤵
  PID:6920
- C:\Windows\System\yVNLnii.exe
  C:\Windows\System\yVNLnii.exe
  2⤵
  PID:7060
- C:\Windows\System\feUUbKk.exe
  C:\Windows\System\feUUbKk.exe
  2⤵
  PID:7128
- C:\Windows\System\wHEmsxC.exe
  C:\Windows\System\wHEmsxC.exe
  2⤵
  PID:6196
- C:\Windows\System\uvRInxZ.exe
  C:\Windows\System\uvRInxZ.exe
  2⤵
  PID:6968
- C:\Windows\System\zzTUDDd.exe
  C:\Windows\System\zzTUDDd.exe
  2⤵
  PID:6952
- C:\Windows\System\tKAVQfQ.exe
  C:\Windows\System\tKAVQfQ.exe
  2⤵
  PID:6248
- C:\Windows\System\QdoqODr.exe
  C:\Windows\System\QdoqODr.exe
  2⤵
  PID:6868
- C:\Windows\System\FZAhYbn.exe
  C:\Windows\System\FZAhYbn.exe
  2⤵
  PID:5568
- C:\Windows\System\SXkhpYS.exe
  C:\Windows\System\SXkhpYS.exe
  2⤵
  PID:6356
- C:\Windows\System\yhtEoCt.exe
  C:\Windows\System\yhtEoCt.exe
  2⤵
  PID:6788
- C:\Windows\System\eaTTViN.exe
  C:\Windows\System\eaTTViN.exe
  2⤵
  PID:6376
- C:\Windows\System\OjqOqTe.exe
  C:\Windows\System\OjqOqTe.exe
  2⤵
  PID:6632
- C:\Windows\System\XmFnpHo.exe
  C:\Windows\System\XmFnpHo.exe
  2⤵
  PID:6996
- C:\Windows\System\txuBuOo.exe
  C:\Windows\System\txuBuOo.exe
  2⤵
  PID:6708
- C:\Windows\System\lQjIGpV.exe
  C:\Windows\System\lQjIGpV.exe
  2⤵
  PID:5984
- C:\Windows\System\ZSGRaVo.exe
  C:\Windows\System\ZSGRaVo.exe
  2⤵
  PID:6600
- C:\Windows\System\IhWcmsF.exe
  C:\Windows\System\IhWcmsF.exe
  2⤵
  PID:6552
- C:\Windows\System\MPBPNii.exe
  C:\Windows\System\MPBPNii.exe
  2⤵
  PID:7180
- C:\Windows\System\lVGMUkf.exe
  C:\Windows\System\lVGMUkf.exe
  2⤵
  PID:7196
- C:\Windows\System\IENIiEq.exe
  C:\Windows\System\IENIiEq.exe
  2⤵
  PID:7212
- C:\Windows\System\cnoIUSR.exe
  C:\Windows\System\cnoIUSR.exe
  2⤵
  PID:7228
- C:\Windows\System\ZFIUwRb.exe
  C:\Windows\System\ZFIUwRb.exe
  2⤵
  PID:7244
- C:\Windows\System\FdQYGsX.exe
  C:\Windows\System\FdQYGsX.exe
  2⤵
  PID:7260
- C:\Windows\System\EzfQPWn.exe
  C:\Windows\System\EzfQPWn.exe
  2⤵
  PID:7276
- C:\Windows\System\jkqMwNq.exe
  C:\Windows\System\jkqMwNq.exe
  2⤵
  PID:7292
- C:\Windows\System\HyVktDV.exe
  C:\Windows\System\HyVktDV.exe
  2⤵
  PID:7308
- C:\Windows\System\jBCvxEn.exe
  C:\Windows\System\jBCvxEn.exe
  2⤵
  PID:7324
- C:\Windows\System\BbAUVNK.exe
  C:\Windows\System\BbAUVNK.exe
  2⤵
  PID:7340
- C:\Windows\System\nyPCYCt.exe
  C:\Windows\System\nyPCYCt.exe
  2⤵
  PID:7356
- C:\Windows\System\yTdkJQa.exe
  C:\Windows\System\yTdkJQa.exe
  2⤵
  PID:7372
- C:\Windows\System\YdawwfX.exe
  C:\Windows\System\YdawwfX.exe
  2⤵
  PID:7388
- C:\Windows\System\YyfycOU.exe
  C:\Windows\System\YyfycOU.exe
  2⤵
  PID:7404
- C:\Windows\System\OexPZhb.exe
  C:\Windows\System\OexPZhb.exe
  2⤵
  PID:7420
- C:\Windows\System\GUtUsZS.exe
  C:\Windows\System\GUtUsZS.exe
  2⤵
  PID:7436
- C:\Windows\System\cjprmbq.exe
  C:\Windows\System\cjprmbq.exe
  2⤵
  PID:7452
- C:\Windows\System\ZYITgnj.exe
  C:\Windows\System\ZYITgnj.exe
  2⤵
  PID:7468
- C:\Windows\System\ivBUFZb.exe
  C:\Windows\System\ivBUFZb.exe
  2⤵
  PID:7484
- C:\Windows\System\OtvHkuN.exe
  C:\Windows\System\OtvHkuN.exe
  2⤵
  PID:7500
- C:\Windows\System\Apwumzm.exe
  C:\Windows\System\Apwumzm.exe
  2⤵
  PID:7516
- C:\Windows\System\JadmAor.exe
  C:\Windows\System\JadmAor.exe
  2⤵
  PID:7532
- C:\Windows\System\JvgCAJh.exe
  C:\Windows\System\JvgCAJh.exe
  2⤵
  PID:7548
- C:\Windows\System\CIGOYXk.exe
  C:\Windows\System\CIGOYXk.exe
  2⤵
  PID:7564
- C:\Windows\System\KDtZUCJ.exe
  C:\Windows\System\KDtZUCJ.exe
  2⤵
  PID:7580
- C:\Windows\System\oxHuoQx.exe
  C:\Windows\System\oxHuoQx.exe
  2⤵
  PID:7596
- C:\Windows\System\yhcJieA.exe
  C:\Windows\System\yhcJieA.exe
  2⤵
  PID:7612
- C:\Windows\System\CHvTXAR.exe
  C:\Windows\System\CHvTXAR.exe
  2⤵
  PID:7628
- C:\Windows\System\QOSPYUs.exe
  C:\Windows\System\QOSPYUs.exe
  2⤵
  PID:7644
- C:\Windows\System\qimmeCM.exe
  C:\Windows\System\qimmeCM.exe
  2⤵
  PID:7660
- C:\Windows\System\jhQiipJ.exe
  C:\Windows\System\jhQiipJ.exe
  2⤵
  PID:7676
- C:\Windows\System\ktrnAyL.exe
  C:\Windows\System\ktrnAyL.exe
  2⤵
  PID:7692
- C:\Windows\System\xnKaEqa.exe
  C:\Windows\System\xnKaEqa.exe
  2⤵
  PID:7708
- C:\Windows\System\wOxpEwK.exe
  C:\Windows\System\wOxpEwK.exe
  2⤵
  PID:7724
- C:\Windows\System\NpIFotr.exe
  C:\Windows\System\NpIFotr.exe
  2⤵
  PID:7740
- C:\Windows\System\LtzzQwR.exe
  C:\Windows\System\LtzzQwR.exe
  2⤵
  PID:7756
- C:\Windows\System\DnnXvAn.exe
  C:\Windows\System\DnnXvAn.exe
  2⤵
  PID:7772
- C:\Windows\System\UJBSFOp.exe
  C:\Windows\System\UJBSFOp.exe
  2⤵
  PID:7788
- C:\Windows\System\JEDDVNj.exe
  C:\Windows\System\JEDDVNj.exe
  2⤵
  PID:7804
- C:\Windows\System\iVFrjSN.exe
  C:\Windows\System\iVFrjSN.exe
  2⤵
  PID:7820
- C:\Windows\System\FFNGKol.exe
  C:\Windows\System\FFNGKol.exe
  2⤵
  PID:7836
- C:\Windows\System\GRvmSQN.exe
  C:\Windows\System\GRvmSQN.exe
  2⤵
  PID:7852
- C:\Windows\System\SbfdANf.exe
  C:\Windows\System\SbfdANf.exe
  2⤵
  PID:7868
- C:\Windows\System\IkCJygt.exe
  C:\Windows\System\IkCJygt.exe
  2⤵
  PID:7884
- C:\Windows\System\OTRVdgg.exe
  C:\Windows\System\OTRVdgg.exe
  2⤵
  PID:7900
- C:\Windows\System\MBAKiwe.exe
  C:\Windows\System\MBAKiwe.exe
  2⤵
  PID:7916
- C:\Windows\System\fEsBSWB.exe
  C:\Windows\System\fEsBSWB.exe
  2⤵
  PID:7932
- C:\Windows\System\GLpJYEC.exe
  C:\Windows\System\GLpJYEC.exe
  2⤵
  PID:7948
- C:\Windows\System\PfRfhfq.exe
  C:\Windows\System\PfRfhfq.exe
  2⤵
  PID:7964
- C:\Windows\System\VpvKlYb.exe
  C:\Windows\System\VpvKlYb.exe
  2⤵
  PID:7980
- C:\Windows\System\cmXyNbd.exe
  C:\Windows\System\cmXyNbd.exe
  2⤵
  PID:7996
- C:\Windows\System\LvojBNa.exe
  C:\Windows\System\LvojBNa.exe
  2⤵
  PID:8012
- C:\Windows\System\plooxYQ.exe
  C:\Windows\System\plooxYQ.exe
  2⤵
  PID:8028
- C:\Windows\System\PgyNRLG.exe
  C:\Windows\System\PgyNRLG.exe
  2⤵
  PID:8044
- C:\Windows\System\QfNgdgJ.exe
  C:\Windows\System\QfNgdgJ.exe
  2⤵
  PID:8060
- C:\Windows\System\wkTPeOC.exe
  C:\Windows\System\wkTPeOC.exe
  2⤵
  PID:8076
- C:\Windows\System\bLyOvga.exe
  C:\Windows\System\bLyOvga.exe
  2⤵
  PID:8092
- C:\Windows\System\LtftyoJ.exe
  C:\Windows\System\LtftyoJ.exe
  2⤵
  PID:8108
- C:\Windows\System\DCoxhzT.exe
  C:\Windows\System\DCoxhzT.exe
  2⤵
  PID:8124
- C:\Windows\System\SRywhfm.exe
  C:\Windows\System\SRywhfm.exe
  2⤵
  PID:8140
- C:\Windows\System\pdFpExz.exe
  C:\Windows\System\pdFpExz.exe
  2⤵
  PID:8156
- C:\Windows\System\AuHQmED.exe
  C:\Windows\System\AuHQmED.exe
  2⤵
  PID:8172
- C:\Windows\System\oMzEnRJ.exe
  C:\Windows\System\oMzEnRJ.exe
  2⤵
  PID:8188
- C:\Windows\System\ycOraxs.exe
  C:\Windows\System\ycOraxs.exe
  2⤵
  PID:6932
- C:\Windows\System\NDCElgF.exe
  C:\Windows\System\NDCElgF.exe
  2⤵
  PID:7176
- C:\Windows\System\MguEwZi.exe
  C:\Windows\System\MguEwZi.exe
  2⤵
  PID:6324
- C:\Windows\System\TrckzwX.exe
  C:\Windows\System\TrckzwX.exe
  2⤵
  PID:7188
- C:\Windows\System\faSwvpx.exe
  C:\Windows\System\faSwvpx.exe
  2⤵
  PID:7236
- C:\Windows\System\gCwaWLj.exe
  C:\Windows\System\gCwaWLj.exe
  2⤵
  PID:7300
- C:\Windows\System\MXtNHrQ.exe
  C:\Windows\System\MXtNHrQ.exe
  2⤵
  PID:7336
- C:\Windows\System\ArQHlMP.exe
  C:\Windows\System\ArQHlMP.exe
  2⤵
  PID:7400
- C:\Windows\System\pcEitNu.exe
  C:\Windows\System\pcEitNu.exe
  2⤵
  PID:7220
- C:\Windows\System\ulCWYdW.exe
  C:\Windows\System\ulCWYdW.exe
  2⤵
  PID:7384
- C:\Windows\System\GavVMHL.exe
  C:\Windows\System\GavVMHL.exe
  2⤵
  PID:7348
- C:\Windows\System\dvZZgPz.exe
  C:\Windows\System\dvZZgPz.exe
  2⤵
  PID:7412
- C:\Windows\System\HZEuDfK.exe
  C:\Windows\System\HZEuDfK.exe
  2⤵
  PID:7444
- C:\Windows\System\ssGGgdF.exe
  C:\Windows\System\ssGGgdF.exe
  2⤵
  PID:7496
- C:\Windows\System\blzButU.exe
  C:\Windows\System\blzButU.exe
  2⤵
  PID:7560
- C:\Windows\System\AQCirGJ.exe
  C:\Windows\System\AQCirGJ.exe
  2⤵
  PID:7592
- C:\Windows\System\AZMQTAw.exe
  C:\Windows\System\AZMQTAw.exe
  2⤵
  PID:7512
- C:\Windows\System\TMmUfUf.exe
  C:\Windows\System\TMmUfUf.exe
  2⤵
  PID:7604
- C:\Windows\System\PAGdnFD.exe
  C:\Windows\System\PAGdnFD.exe
  2⤵
  PID:7656
- C:\Windows\System\Jqjkura.exe
  C:\Windows\System\Jqjkura.exe
  2⤵
  PID:7668
- C:\Windows\System\WsNfEQu.exe
  C:\Windows\System\WsNfEQu.exe
  2⤵
  PID:7704
- C:\Windows\System\LhjIAxg.exe
  C:\Windows\System\LhjIAxg.exe
  2⤵
  PID:7752
- C:\Windows\System\YUIHmoF.exe
  C:\Windows\System\YUIHmoF.exe
  2⤵
  PID:7800
- C:\Windows\System\uDpEUzB.exe
  C:\Windows\System\uDpEUzB.exe
  2⤵
  PID:7816
- C:\Windows\System\hqpvUes.exe
  C:\Windows\System\hqpvUes.exe
  2⤵
  PID:7880
- C:\Windows\System\pMbuRNl.exe
  C:\Windows\System\pMbuRNl.exe
  2⤵
  PID:7864
- C:\Windows\System\HnHPDic.exe
  C:\Windows\System\HnHPDic.exe
  2⤵
  PID:7928
- C:\Windows\System\PgbAEWO.exe
  C:\Windows\System\PgbAEWO.exe
  2⤵
  PID:7944
- C:\Windows\System\ykrSafs.exe
  C:\Windows\System\ykrSafs.exe
  2⤵
  PID:7976
- C:\Windows\System\NJBWgjk.exe
  C:\Windows\System\NJBWgjk.exe
  2⤵
  PID:8008
- C:\Windows\System\TOHglTI.exe
  C:\Windows\System\TOHglTI.exe
  2⤵
  PID:8068
- C:\Windows\System\xsjPiCU.exe
  C:\Windows\System\xsjPiCU.exe
  2⤵
  PID:8100
- C:\Windows\System\EefWdfc.exe
  C:\Windows\System\EefWdfc.exe
  2⤵
  PID:8084
- C:\Windows\System\YRNKRlG.exe
  C:\Windows\System\YRNKRlG.exe
  2⤵
  PID:8104
- C:\Windows\System\rblOiIj.exe
  C:\Windows\System\rblOiIj.exe
  2⤵
  PID:8152
- C:\Windows\System\udUUWgC.exe
  C:\Windows\System\udUUWgC.exe
  2⤵
  PID:6168
- C:\Windows\System\nlEJGIy.exe
  C:\Windows\System\nlEJGIy.exe
  2⤵
  PID:7204
- C:\Windows\System\YsyLDMs.exe
  C:\Windows\System\YsyLDMs.exe
  2⤵
  PID:7332
- C:\Windows\System\MvEoHvA.exe
  C:\Windows\System\MvEoHvA.exe
  2⤵
  PID:7368
- C:\Windows\System\RIFfOjq.exe
  C:\Windows\System\RIFfOjq.exe
  2⤵
  PID:7428
- C:\Windows\System\IhqOFYU.exe
  C:\Windows\System\IhqOFYU.exe
  2⤵
  PID:7352
- C:\Windows\System\WYfGTGv.exe
  C:\Windows\System\WYfGTGv.exe
  2⤵
  PID:7620
- C:\Windows\System\hXBhLPo.exe
  C:\Windows\System\hXBhLPo.exe
  2⤵
  PID:7492
- C:\Windows\System\USKWeBX.exe
  C:\Windows\System\USKWeBX.exe
  2⤵
  PID:7588
- C:\Windows\System\FMJrFVS.exe
  C:\Windows\System\FMJrFVS.exe
  2⤵
  PID:7672
- C:\Windows\System\qIqfmyT.exe
  C:\Windows\System\qIqfmyT.exe
  2⤵
  PID:7764
- C:\Windows\System\xszoEIO.exe
  C:\Windows\System\xszoEIO.exe
  2⤵
  PID:8024
- C:\Windows\System\fmTyzvG.exe
  C:\Windows\System\fmTyzvG.exe
  2⤵
  PID:7940
- C:\Windows\System\TfHYPJw.exe
  C:\Windows\System\TfHYPJw.exe
  2⤵
  PID:8116
- C:\Windows\System\mKtDDOt.exe
  C:\Windows\System\mKtDDOt.exe
  2⤵
  PID:8168
- C:\Windows\System\POwEJIM.exe
  C:\Windows\System\POwEJIM.exe
  2⤵
  PID:8040
- C:\Windows\System\GBFqOZc.exe
  C:\Windows\System\GBFqOZc.exe
  2⤵
  PID:7896
- C:\Windows\System\QhIZYIt.exe
  C:\Windows\System\QhIZYIt.exe
  2⤵
  PID:6808
- C:\Windows\System\bRlhXTp.exe
  C:\Windows\System\bRlhXTp.exe
  2⤵
  PID:6468
- C:\Windows\System\PEqvsuW.exe
  C:\Windows\System\PEqvsuW.exe
  2⤵
  PID:7288
- C:\Windows\System\xZWutLt.exe
  C:\Windows\System\xZWutLt.exe
  2⤵
  PID:7652
- C:\Windows\System\AQMgXQU.exe
  C:\Windows\System\AQMgXQU.exe
  2⤵
  PID:8004
- C:\Windows\System\IbORjnp.exe
  C:\Windows\System\IbORjnp.exe
  2⤵
  PID:8020
- C:\Windows\System\ouljYrH.exe
  C:\Windows\System\ouljYrH.exe
  2⤵
  PID:6644
- C:\Windows\System\xnwhNer.exe
  C:\Windows\System\xnwhNer.exe
  2⤵
  PID:7784
- C:\Windows\System\iYWyWsv.exe
  C:\Windows\System\iYWyWsv.exe
  2⤵
  PID:8224
- C:\Windows\System\PGOFlfF.exe
  C:\Windows\System\PGOFlfF.exe
  2⤵
  PID:8272
- C:\Windows\System\nGCtBuq.exe
  C:\Windows\System\nGCtBuq.exe
  2⤵
  PID:8304
- C:\Windows\System\ATYLOnO.exe
  C:\Windows\System\ATYLOnO.exe
  2⤵
  PID:8348
- C:\Windows\System\NmpRqsF.exe
  C:\Windows\System\NmpRqsF.exe
  2⤵
  PID:8372
- C:\Windows\System\dHBLmNB.exe
  C:\Windows\System\dHBLmNB.exe
  2⤵
  PID:8388
- C:\Windows\System\ynfxezd.exe
  C:\Windows\System\ynfxezd.exe
  2⤵
  PID:8404
- C:\Windows\System\Lfnulsa.exe
  C:\Windows\System\Lfnulsa.exe
  2⤵
  PID:8420
- C:\Windows\System\gSUcAZx.exe
  C:\Windows\System\gSUcAZx.exe
  2⤵
  PID:8436
- C:\Windows\System\wIWJVAQ.exe
  C:\Windows\System\wIWJVAQ.exe
  2⤵
  PID:8452
- C:\Windows\System\VbNIrWu.exe
  C:\Windows\System\VbNIrWu.exe
  2⤵
  PID:8468
- C:\Windows\System\kpOWzMT.exe
  C:\Windows\System\kpOWzMT.exe
  2⤵
  PID:8488
- C:\Windows\System\kSmTYar.exe
  C:\Windows\System\kSmTYar.exe
  2⤵
  PID:8504
- C:\Windows\System\oLBsknI.exe
  C:\Windows\System\oLBsknI.exe
  2⤵
  PID:8520
- C:\Windows\System\XobBEDt.exe
  C:\Windows\System\XobBEDt.exe
  2⤵
  PID:8536
- C:\Windows\System\UIprXyI.exe
  C:\Windows\System\UIprXyI.exe
  2⤵
  PID:8552
- C:\Windows\System\kxTgbKY.exe
  C:\Windows\System\kxTgbKY.exe
  2⤵
  PID:8568
- C:\Windows\System\dnwwHqH.exe
  C:\Windows\System\dnwwHqH.exe
  2⤵
  PID:8584
- C:\Windows\System\WFpCUyZ.exe
  C:\Windows\System\WFpCUyZ.exe
  2⤵
  PID:8600
- C:\Windows\System\iZvdGTJ.exe
  C:\Windows\System\iZvdGTJ.exe
  2⤵
  PID:8616
- C:\Windows\System\rCiyuOS.exe
  C:\Windows\System\rCiyuOS.exe
  2⤵
  PID:8632
- C:\Windows\System\tQKMexj.exe
  C:\Windows\System\tQKMexj.exe
  2⤵
  PID:8648
- C:\Windows\System\lizXDbc.exe
  C:\Windows\System\lizXDbc.exe
  2⤵
  PID:8664
- C:\Windows\System\eJVvLiO.exe
  C:\Windows\System\eJVvLiO.exe
  2⤵
  PID:8684
- C:\Windows\System\dabPRwE.exe
  C:\Windows\System\dabPRwE.exe
  2⤵
  PID:8700
- C:\Windows\System\vuXXKeV.exe
  C:\Windows\System\vuXXKeV.exe
  2⤵
  PID:8716
- C:\Windows\System\MGZVrOm.exe
  C:\Windows\System\MGZVrOm.exe
  2⤵
  PID:8732
- C:\Windows\System\vXeCBBq.exe
  C:\Windows\System\vXeCBBq.exe
  2⤵
  PID:8748
- C:\Windows\System\RUPIrcD.exe
  C:\Windows\System\RUPIrcD.exe
  2⤵
  PID:8764
- C:\Windows\System\DLsHDQj.exe
  C:\Windows\System\DLsHDQj.exe
  2⤵
  PID:8780
- C:\Windows\System\pTiPzBh.exe
  C:\Windows\System\pTiPzBh.exe
  2⤵
  PID:8796
- C:\Windows\System\ZLhZKgr.exe
  C:\Windows\System\ZLhZKgr.exe
  2⤵
  PID:8812
- C:\Windows\System\aQrtbnq.exe
  C:\Windows\System\aQrtbnq.exe
  2⤵
  PID:8828
- C:\Windows\System\LQHebgg.exe
  C:\Windows\System\LQHebgg.exe
  2⤵
  PID:8848
- C:\Windows\System\lLhnciL.exe
  C:\Windows\System\lLhnciL.exe
  2⤵
  PID:8864
- C:\Windows\System\ixuUzxc.exe
  C:\Windows\System\ixuUzxc.exe
  2⤵
  PID:8880
- C:\Windows\System\pMdeADB.exe
  C:\Windows\System\pMdeADB.exe
  2⤵
  PID:8896
- C:\Windows\System\DXNxHgX.exe
  C:\Windows\System\DXNxHgX.exe
  2⤵
  PID:8912
- C:\Windows\System\pzmyFoL.exe
  C:\Windows\System\pzmyFoL.exe
  2⤵
  PID:8928
- C:\Windows\System\ZBGRXZh.exe
  C:\Windows\System\ZBGRXZh.exe
  2⤵
  PID:8944
- C:\Windows\System\hgoTtUR.exe
  C:\Windows\System\hgoTtUR.exe
  2⤵
  PID:8960
- C:\Windows\System\HOThlOg.exe
  C:\Windows\System\HOThlOg.exe
  2⤵
  PID:8976
- C:\Windows\System\tiRQROg.exe
  C:\Windows\System\tiRQROg.exe
  2⤵
  PID:8996
- C:\Windows\System\QPDeohP.exe
  C:\Windows\System\QPDeohP.exe
  2⤵
  PID:9012
- C:\Windows\System\bidQqII.exe
  C:\Windows\System\bidQqII.exe
  2⤵
  PID:9028
- C:\Windows\System\KmpvWEU.exe
  C:\Windows\System\KmpvWEU.exe
  2⤵
  PID:9044
- C:\Windows\System\HBqzSDF.exe
  C:\Windows\System\HBqzSDF.exe
  2⤵
  PID:9060
- C:\Windows\System\EpLAjLn.exe
  C:\Windows\System\EpLAjLn.exe
  2⤵
  PID:9076
- C:\Windows\System\JNkRZbR.exe
  C:\Windows\System\JNkRZbR.exe
  2⤵
  PID:9092
- C:\Windows\System\vlNjzGj.exe
  C:\Windows\System\vlNjzGj.exe
  2⤵
  PID:9108
- C:\Windows\System\nQoranf.exe
  C:\Windows\System\nQoranf.exe
  2⤵
  PID:9124
- C:\Windows\System\WeWnEoZ.exe
  C:\Windows\System\WeWnEoZ.exe
  2⤵
  PID:9140
- C:\Windows\System\ttAJFgm.exe
  C:\Windows\System\ttAJFgm.exe
  2⤵
  PID:9156
- C:\Windows\System\rjJvbul.exe
  C:\Windows\System\rjJvbul.exe
  2⤵
  PID:9172
- C:\Windows\System\YSWxhJz.exe
  C:\Windows\System\YSWxhJz.exe
  2⤵
  PID:9188
- C:\Windows\System\BINDaGM.exe
  C:\Windows\System\BINDaGM.exe
  2⤵
  PID:9204
- C:\Windows\System\ELgTPMv.exe
  C:\Windows\System\ELgTPMv.exe
  2⤵
  PID:7528
- C:\Windows\System\lOBbFpL.exe
  C:\Windows\System\lOBbFpL.exe
  2⤵
  PID:7540
- C:\Windows\System\jBxmDop.exe
  C:\Windows\System\jBxmDop.exe
  2⤵
  PID:7912
- C:\Windows\System\hqvwDjQ.exe
  C:\Windows\System\hqvwDjQ.exe
  2⤵
  PID:7640
- C:\Windows\System\EpWPgxl.exe
  C:\Windows\System\EpWPgxl.exe
  2⤵
  PID:7960
- C:\Windows\System\AJeDzeD.exe
  C:\Windows\System\AJeDzeD.exe
  2⤵
  PID:7320
- C:\Windows\System\rKuZWln.exe
  C:\Windows\System\rKuZWln.exe
  2⤵
  PID:8288
- C:\Windows\System\TFPHnLK.exe
  C:\Windows\System\TFPHnLK.exe
  2⤵
  PID:8296
- C:\Windows\System\BlKhHmp.exe
  C:\Windows\System\BlKhHmp.exe
  2⤵
  PID:8364
- C:\Windows\System\ZfdOZDT.exe
  C:\Windows\System\ZfdOZDT.exe
  2⤵
  PID:8460
- C:\Windows\System\fXUDXCa.exe
  C:\Windows\System\fXUDXCa.exe
  2⤵
  PID:8500
- C:\Windows\System\jrlpqOa.exe
  C:\Windows\System\jrlpqOa.exe
  2⤵
  PID:8252
- C:\Windows\System\NhmcdxO.exe
  C:\Windows\System\NhmcdxO.exe
  2⤵
  PID:8232
- C:\Windows\System\LeJOdjv.exe
  C:\Windows\System\LeJOdjv.exe
  2⤵
  PID:8260
- C:\Windows\System\sEjJKmR.exe
  C:\Windows\System\sEjJKmR.exe
  2⤵
  PID:8320
- C:\Windows\System\hggCWnR.exe
  C:\Windows\System\hggCWnR.exe
  2⤵
  PID:8336
- C:\Windows\System\AIXYqyf.exe
  C:\Windows\System\AIXYqyf.exe
  2⤵
  PID:8384
- C:\Windows\System\hTCxjDp.exe
  C:\Windows\System\hTCxjDp.exe
  2⤵
  PID:8448
- C:\Windows\System\ycblptr.exe
  C:\Windows\System\ycblptr.exe
  2⤵
  PID:8516
- C:\Windows\System\fJMtulO.exe
  C:\Windows\System\fJMtulO.exe
  2⤵
  PID:8564
- C:\Windows\System\wZvVmWp.exe
  C:\Windows\System\wZvVmWp.exe
  2⤵
  PID:8592
- C:\Windows\System\aENqNFQ.exe
  C:\Windows\System\aENqNFQ.exe
  2⤵
  PID:8644
- C:\Windows\System\eQKRlnl.exe
  C:\Windows\System\eQKRlnl.exe
  2⤵
  PID:8680
- C:\Windows\System\oKrSCYO.exe
  C:\Windows\System\oKrSCYO.exe
  2⤵
  PID:8724
- C:\Windows\System\MgWNEiQ.exe
  C:\Windows\System\MgWNEiQ.exe
  2⤵
  PID:8756
- C:\Windows\System\nHxFZxR.exe
  C:\Windows\System\nHxFZxR.exe
  2⤵
  PID:8708
- C:\Windows\System\vJpIhuN.exe
  C:\Windows\System\vJpIhuN.exe
  2⤵
  PID:8788
- C:\Windows\System\HhIHtIP.exe
  C:\Windows\System\HhIHtIP.exe
  2⤵
  PID:8856
- C:\Windows\System\nrNtgnN.exe
  C:\Windows\System\nrNtgnN.exe
  2⤵
  PID:8804
- C:\Windows\System\OSzUmvZ.exe
  C:\Windows\System\OSzUmvZ.exe
  2⤵
  PID:8872
- C:\Windows\System\FfxMcqp.exe
  C:\Windows\System\FfxMcqp.exe
  2⤵
  PID:8836
- C:\Windows\System\UmwfPRS.exe
  C:\Windows\System\UmwfPRS.exe
  2⤵
  PID:8924
- C:\Windows\System\DrSDTEN.exe
  C:\Windows\System\DrSDTEN.exe
  2⤵
  PID:9040
- C:\Windows\System\tLOgfNf.exe
  C:\Windows\System\tLOgfNf.exe
  2⤵
  PID:9136
- C:\Windows\System\NdRRcrj.exe
  C:\Windows\System\NdRRcrj.exe
  2⤵
  PID:9184
- C:\Windows\System\fxvYTzW.exe
  C:\Windows\System\fxvYTzW.exe
  2⤵
  PID:7636
- C:\Windows\System\ebyApQb.exe
  C:\Windows\System\ebyApQb.exe
  2⤵
  PID:8208
- C:\Windows\System\NdGbzDz.exe
  C:\Windows\System\NdGbzDz.exe
  2⤵
  PID:9200
- C:\Windows\System\SKeXgEc.exe
  C:\Windows\System\SKeXgEc.exe
  2⤵
  PID:7380
- C:\Windows\System\ILZXmsN.exe
  C:\Windows\System\ILZXmsN.exe
  2⤵
  PID:8368
- C:\Windows\System\cLDXlvd.exe
  C:\Windows\System\cLDXlvd.exe
  2⤵
  PID:8212
- C:\Windows\System\qsLwsMA.exe
  C:\Windows\System\qsLwsMA.exe
  2⤵
  PID:8344
- C:\Windows\System\YQOEFbX.exe
  C:\Windows\System\YQOEFbX.exe
  2⤵
  PID:8428
- C:\Windows\System\PdFYdrT.exe
  C:\Windows\System\PdFYdrT.exe
  2⤵
  PID:8236
- C:\Windows\System\cjpwvVX.exe
  C:\Windows\System\cjpwvVX.exe
  2⤵
  PID:8248
- C:\Windows\System\RzccqNe.exe
  C:\Windows\System\RzccqNe.exe
  2⤵
  PID:8416
- C:\Windows\System\LhfeKts.exe
  C:\Windows\System\LhfeKts.exe
  2⤵
  PID:8608
- C:\Windows\System\izBbsdA.exe
  C:\Windows\System\izBbsdA.exe
  2⤵
  PID:8728
- C:\Windows\System\zJEwCJm.exe
  C:\Windows\System\zJEwCJm.exe
  2⤵
  PID:8640
- C:\Windows\System\upzkbrh.exe
  C:\Windows\System\upzkbrh.exe
  2⤵
  PID:8892
- C:\Windows\System\cFwmZDf.exe
  C:\Windows\System\cFwmZDf.exe
  2⤵
  PID:8840
- C:\Windows\System\bNdAEDC.exe
  C:\Windows\System\bNdAEDC.exe
  2⤵
  PID:8776
- C:\Windows\System\kLOvFPj.exe
  C:\Windows\System\kLOvFPj.exe
  2⤵
  PID:8940
- C:\Windows\System\xSGLdbb.exe
  C:\Windows\System\xSGLdbb.exe
  2⤵
  PID:8988
- C:\Windows\System\EcQIdbN.exe
  C:\Windows\System\EcQIdbN.exe
  2⤵
  PID:9024
- C:\Windows\System\cSqIHJi.exe
  C:\Windows\System\cSqIHJi.exe
  2⤵
  PID:9084
- C:\Windows\System\kKzWHNa.exe
  C:\Windows\System\kKzWHNa.exe
  2⤵
  PID:9148
- C:\Windows\System\eXCUCAv.exe
  C:\Windows\System\eXCUCAv.exe
  2⤵
  PID:9180
- C:\Windows\System\GoPBiks.exe
  C:\Windows\System\GoPBiks.exe
  2⤵
  PID:7076
- C:\Windows\System\QphrWbH.exe
  C:\Windows\System\QphrWbH.exe
  2⤵
  PID:8512
- C:\Windows\System\zyqXHCR.exe
  C:\Windows\System\zyqXHCR.exe
  2⤵
  PID:8196
- C:\Windows\System\YKKzTCE.exe
  C:\Windows\System\YKKzTCE.exe
  2⤵
  PID:7432
- C:\Windows\System\gIkerSo.exe
  C:\Windows\System\gIkerSo.exe
  2⤵
  PID:9056
- C:\Windows\System\mFIeBuM.exe
  C:\Windows\System\mFIeBuM.exe
  2⤵
  PID:8824
- C:\Windows\System\ULUIIce.exe
  C:\Windows\System\ULUIIce.exe
  2⤵
  PID:8740
- C:\Windows\System\VkXPRSV.exe
  C:\Windows\System\VkXPRSV.exe
  2⤵
  PID:8332
- C:\Windows\System\VKxPdsM.exe
  C:\Windows\System\VKxPdsM.exe
  2⤵
  PID:8360
- C:\Windows\System\tBVyKwt.exe
  C:\Windows\System\tBVyKwt.exe
  2⤵
  PID:8560
- C:\Windows\System\aePXHVr.exe
  C:\Windows\System\aePXHVr.exe
  2⤵
  PID:8692
- C:\Windows\System\WjKNZrK.exe
  C:\Windows\System\WjKNZrK.exe
  2⤵
  PID:8200
- C:\Windows\System\SwUvelR.exe
  C:\Windows\System\SwUvelR.exe
  2⤵
  PID:8888
- C:\Windows\System\rzjitTa.exe
  C:\Windows\System\rzjitTa.exe
  2⤵
  PID:8968
- C:\Windows\System\vJibiJS.exe
  C:\Windows\System\vJibiJS.exe
  2⤵
  PID:8240
- C:\Windows\System\ZtSVpax.exe
  C:\Windows\System\ZtSVpax.exe
  2⤵
  PID:9220
- C:\Windows\System\FJDrEla.exe
  C:\Windows\System\FJDrEla.exe
  2⤵
  PID:9240
- C:\Windows\System\dDCUihg.exe
  C:\Windows\System\dDCUihg.exe
  2⤵
  PID:9260
- C:\Windows\System\esqYfZM.exe
  C:\Windows\System\esqYfZM.exe
  2⤵
  PID:9276
- C:\Windows\System\ofkNgRg.exe
  C:\Windows\System\ofkNgRg.exe
  2⤵
  PID:9292
- C:\Windows\System\tEUlDdk.exe
  C:\Windows\System\tEUlDdk.exe
  2⤵
  PID:9308
- C:\Windows\System\jCWLatk.exe
  C:\Windows\System\jCWLatk.exe
  2⤵
  PID:9328
- C:\Windows\System\PgxnJPr.exe
  C:\Windows\System\PgxnJPr.exe
  2⤵
  PID:9348
- C:\Windows\System\jmNHISB.exe
  C:\Windows\System\jmNHISB.exe
  2⤵
  PID:9364
- C:\Windows\System\RBjnrOY.exe
  C:\Windows\System\RBjnrOY.exe
  2⤵
  PID:9380
- C:\Windows\System\ZInkKCC.exe
  C:\Windows\System\ZInkKCC.exe
  2⤵
  PID:9404
- C:\Windows\System\VkhJgML.exe
  C:\Windows\System\VkhJgML.exe
  2⤵
  PID:9424
- C:\Windows\System\ekFkrhl.exe
  C:\Windows\System\ekFkrhl.exe
  2⤵
  PID:9440
- C:\Windows\System\VnuAvrE.exe
  C:\Windows\System\VnuAvrE.exe
  2⤵
  PID:9456
- C:\Windows\System\tosuzRM.exe
  C:\Windows\System\tosuzRM.exe
  2⤵
  PID:9472
- C:\Windows\System\PCNqKnH.exe
  C:\Windows\System\PCNqKnH.exe
  2⤵
  PID:9492
- C:\Windows\System\mvjviDb.exe
  C:\Windows\System\mvjviDb.exe
  2⤵
  PID:9512
- C:\Windows\System\xyrJdJC.exe
  C:\Windows\System\xyrJdJC.exe
  2⤵
  PID:9528
- C:\Windows\System\yPFlnPI.exe
  C:\Windows\System\yPFlnPI.exe
  2⤵
  PID:9544
- C:\Windows\System\FiHHZSz.exe
  C:\Windows\System\FiHHZSz.exe
  2⤵
  PID:9560
- C:\Windows\System\KrjEzOE.exe
  C:\Windows\System\KrjEzOE.exe
  2⤵
  PID:9576
- C:\Windows\System\NTXUqJz.exe
  C:\Windows\System\NTXUqJz.exe
  2⤵
  PID:9596
- C:\Windows\System\rOVMReO.exe
  C:\Windows\System\rOVMReO.exe
  2⤵
  PID:9612
- C:\Windows\System\UuguDgI.exe
  C:\Windows\System\UuguDgI.exe
  2⤵
  PID:9628
- C:\Windows\System\zmTjzjt.exe
  C:\Windows\System\zmTjzjt.exe
  2⤵
  PID:9648
- C:\Windows\System\nBOjsDV.exe
  C:\Windows\System\nBOjsDV.exe
  2⤵
  PID:9664
- C:\Windows\System\aKEhznk.exe
  C:\Windows\System\aKEhznk.exe
  2⤵
  PID:9680
- C:\Windows\System\IrkNGLW.exe
  C:\Windows\System\IrkNGLW.exe
  2⤵
  PID:9700
- C:\Windows\System\VakqzwK.exe
  C:\Windows\System\VakqzwK.exe
  2⤵
  PID:9716
- C:\Windows\System\XIZaHYB.exe
  C:\Windows\System\XIZaHYB.exe
  2⤵
  PID:9732
- C:\Windows\System\QQfzZzz.exe
  C:\Windows\System\QQfzZzz.exe
  2⤵
  PID:9748
- C:\Windows\System\qIbENYD.exe
  C:\Windows\System\qIbENYD.exe
  2⤵
  PID:9764
- C:\Windows\System\yItIGmg.exe
  C:\Windows\System\yItIGmg.exe
  2⤵
  PID:9780
- C:\Windows\System\AKATqjT.exe
  C:\Windows\System\AKATqjT.exe
  2⤵
  PID:9796
- C:\Windows\System\ucIAFjc.exe
  C:\Windows\System\ucIAFjc.exe
  2⤵
  PID:9820
- C:\Windows\System\UnrMhuY.exe
  C:\Windows\System\UnrMhuY.exe
  2⤵
  PID:9836
- C:\Windows\System\ClcurVH.exe
  C:\Windows\System\ClcurVH.exe
  2⤵
  PID:9856
- C:\Windows\System\jzcmLTc.exe
  C:\Windows\System\jzcmLTc.exe
  2⤵
  PID:9872
- C:\Windows\System\ThnHrwX.exe
  C:\Windows\System\ThnHrwX.exe
  2⤵
  PID:10000
- C:\Windows\System\EVRVbzu.exe
  C:\Windows\System\EVRVbzu.exe
  2⤵
  PID:10020
- C:\Windows\System\voIlrvO.exe
  C:\Windows\System\voIlrvO.exe
  2⤵
  PID:10036
- C:\Windows\System\DRlZYYL.exe
  C:\Windows\System\DRlZYYL.exe
  2⤵
  PID:10052
- C:\Windows\System\FeUDVXQ.exe
  C:\Windows\System\FeUDVXQ.exe
  2⤵
  PID:10068
- C:\Windows\System\elWXkZn.exe
  C:\Windows\System\elWXkZn.exe
  2⤵
  PID:10084
- C:\Windows\System\LiUuWmY.exe
  C:\Windows\System\LiUuWmY.exe
  2⤵
  PID:10100
- C:\Windows\System\syFixIj.exe
  C:\Windows\System\syFixIj.exe
  2⤵
  PID:10116
- C:\Windows\System\KCodixW.exe
  C:\Windows\System\KCodixW.exe
  2⤵
  PID:10132
- C:\Windows\System\nNjChse.exe
  C:\Windows\System\nNjChse.exe
  2⤵
  PID:10148
- C:\Windows\System\WiWrphb.exe
  C:\Windows\System\WiWrphb.exe
  2⤵
  PID:10164
- C:\Windows\System\ftIYagc.exe
  C:\Windows\System\ftIYagc.exe
  2⤵
  PID:10180
- C:\Windows\System\yaQrSde.exe
  C:\Windows\System\yaQrSde.exe
  2⤵
  PID:10196
- C:\Windows\System\HNPzPjf.exe
  C:\Windows\System\HNPzPjf.exe
  2⤵
  PID:10216
- C:\Windows\System\sMrWxbF.exe
  C:\Windows\System\sMrWxbF.exe
  2⤵
  PID:10232
- C:\Windows\System\fNirSsw.exe
  C:\Windows\System\fNirSsw.exe
  2⤵
  PID:8656
- C:\Windows\System\jKEyvdh.exe
  C:\Windows\System\jKEyvdh.exe
  2⤵
  PID:9068
- C:\Windows\System\qZhJOho.exe
  C:\Windows\System\qZhJOho.exe
  2⤵
  PID:9236
- C:\Windows\System\errgwVn.exe
  C:\Windows\System\errgwVn.exe
  2⤵
  PID:9272
- C:\Windows\System\sEINXTc.exe
  C:\Windows\System\sEINXTc.exe
  2⤵
  PID:8328
- C:\Windows\System\rXOLOGL.exe
  C:\Windows\System\rXOLOGL.exe
  2⤵
  PID:9116
- C:\Windows\System\tQSxind.exe
  C:\Windows\System\tQSxind.exe
  2⤵
  PID:8904
- C:\Windows\System\EWKXUrv.exe
  C:\Windows\System\EWKXUrv.exe
  2⤵
  PID:9008
- C:\Windows\System\ANCcjlG.exe
  C:\Windows\System\ANCcjlG.exe
  2⤵
  PID:9256
- C:\Windows\System\QWaHGGa.exe
  C:\Windows\System\QWaHGGa.exe
  2⤵
  PID:9412
- C:\Windows\System\UIWkOgx.exe
  C:\Windows\System\UIWkOgx.exe
  2⤵
  PID:9392
- C:\Windows\System\KUhFroD.exe
  C:\Windows\System\KUhFroD.exe
  2⤵
  PID:9448
- C:\Windows\System\kblEwzJ.exe
  C:\Windows\System\kblEwzJ.exe
  2⤵
  PID:9452
- C:\Windows\System\qpHdwZw.exe
  C:\Windows\System\qpHdwZw.exe
  2⤵
  PID:9508
- C:\Windows\System\cnjjRPR.exe
  C:\Windows\System\cnjjRPR.exe
  2⤵
  PID:9464
- C:\Windows\System\RjYvhIO.exe
  C:\Windows\System\RjYvhIO.exe
  2⤵
  PID:9540
- C:\Windows\System\FexcahN.exe
  C:\Windows\System\FexcahN.exe
  2⤵
  PID:9592
- C:\Windows\System\vAPZhlz.exe
  C:\Windows\System\vAPZhlz.exe
  2⤵
  PID:9500
- C:\Windows\System\yMoedxm.exe
  C:\Windows\System\yMoedxm.exe
  2⤵
  PID:9692
- C:\Windows\System\WNJvcaO.exe
  C:\Windows\System\WNJvcaO.exe
  2⤵
  PID:9604
- C:\Windows\System\izFrANq.exe
  C:\Windows\System\izFrANq.exe
  2⤵
  PID:9644
- C:\Windows\System\eOhyXfY.exe
  C:\Windows\System\eOhyXfY.exe
  2⤵
  PID:9744
- C:\Windows\System\DURCAZg.exe
  C:\Windows\System\DURCAZg.exe
  2⤵
  PID:9772
- C:\Windows\System\qflaGId.exe
  C:\Windows\System\qflaGId.exe
  2⤵
  PID:9804
- C:\Windows\System\GpekapV.exe
  C:\Windows\System\GpekapV.exe
  2⤵
  PID:9852
- C:\Windows\System\vPWVMAO.exe
  C:\Windows\System\vPWVMAO.exe
  2⤵
  PID:9884
- C:\Windows\System\RasXxYf.exe
  C:\Windows\System\RasXxYf.exe
  2⤵
  PID:9948
- C:\Windows\System\WwgDXXx.exe
  C:\Windows\System\WwgDXXx.exe
  2⤵
  PID:10016
- C:\Windows\System\sbruUqv.exe
  C:\Windows\System\sbruUqv.exe
  2⤵
  PID:10076
- C:\Windows\System\hnSLFOK.exe
  C:\Windows\System\hnSLFOK.exe
  2⤵
  PID:10140
- C:\Windows\System\PIHJVIK.exe
  C:\Windows\System\PIHJVIK.exe
  2⤵
  PID:10060
- C:\Windows\System\RnsHhVm.exe
  C:\Windows\System\RnsHhVm.exe
  2⤵
  PID:10124
- C:\Windows\System\QplJiVT.exe
  C:\Windows\System\QplJiVT.exe
  2⤵
  PID:10092
- C:\Windows\System\PQYTHSz.exe
  C:\Windows\System\PQYTHSz.exe
  2⤵
  PID:10228
- C:\Windows\System\gArwPds.exe
  C:\Windows\System\gArwPds.exe
  2⤵
  PID:9360
- C:\Windows\System\jEizOMX.exe
  C:\Windows\System\jEizOMX.exe
  2⤵
  PID:9088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EFuDyPX.exe

Filesize
1.7MB

MD5
5a5f962b891a202e7fadf1c9d56a20dc

SHA1
158ca79a622e82212b83c6f742850f1124c2da2d

SHA256
7202c878a82f705ff5f32f0694a25abcd539e2458d3233b1342e7237e476f7b3

SHA512
4a159d6c650658e79eae5b48d69e90c342c8c9dad1932dc267449e5b695ac95dc2730e321a3850e9f13787725855c12fdb9c85f8a23f6bdd361b82f1e31a80d5

Download Submit
C:\Windows\system\SabZWAz.exe

Filesize
1.7MB

MD5
51e8e75bd16394618c06c08c4f652dba

SHA1
db712e4beca95ca41034c8d5d4df8cc8fc29a1ba

SHA256
f3f19b7931676da95a374c596b47c3accc2eed7d60ce76a992daf34e49ebb54f

SHA512
ecf0943198c6f62917de4dd46be560282838654d477450707118736d87e8259e2e33a4f018026f78eb13cab3924447e79a3904a4bda459b4337fd6e03ed0ab01

Download Submit
C:\Windows\system\UDYCptl.exe

Filesize
1.7MB

MD5
605690952c849f608d383d22905f4deb

SHA1
939fc9250f0a9941d8c4bd8a65a68ed064d70043

SHA256
3c4c961fc2dc78155690602492dcba6c934add9bbc924b70b5af3e3b1c2ccf56

SHA512
01ea2000eec7dd1d3d804aca057fd294d34f362e9eb5d0c8c1b3e2b6e6af3e0dd5c90823dda28e1008f11f92daa330416a98003989e59e6d83f8feab02cff3f3

Download Submit
C:\Windows\system\UGeTZlH.exe

Filesize
1.7MB

MD5
e7a5b871c226f1f7eb2ea557d58650ad

SHA1
1d226b0eb3838a7527c91b7b38b460dd0f725486

SHA256
d4ea81edb3576e00e1d42366e661c6f4fd536c68cadf532a6f25e345b5e14e21

SHA512
10c9a0facd693cd3ff465b7713520f84fdc3f0bc92521fd6db22e751fe774759702f2738178c097d7649a2f3c38239e6aac86eca3ea6d364d06eb35b0ffe7c32

Download Submit
C:\Windows\system\VFyoFsv.exe

Filesize
1.7MB

MD5
8554757a50a635cb717299eaf7785856

SHA1
238d9f15df4ed0d7faff5ca3b621854f997acd17

SHA256
f3f993bc93489e695f402a686bea23d7765bf89cd97f84930103d5afa1a416e5

SHA512
22da50682e786ef4269aceba5f84849db9006d29f2fb66eae729f3ed2fe96d9f76ef7794c015ba56d6027a123a4f7ed5ee0dbd8e52d913911a84d9ae5b904be4

Download Submit
C:\Windows\system\WXHIjJm.exe

Filesize
1.7MB

MD5
a6e500b3c6269a2b3cb0ac64dbc889b4

SHA1
9c8d993b6118a075db4d966e53896d1bd65b67bc

SHA256
45d55675d6d54e23b1e9b469f07b6d2eb47e504a80ae19aa72f13873836486a9

SHA512
209f03cb1f356ce312dfe0f449526766aec56ee6fa0a6f940a0582162b78cba4a8318cb3510b7c9090336debf111715c306f5364114121f1536eeec33b09d4ea

Download Submit
C:\Windows\system\XNrHFKs.exe

Filesize
1.7MB

MD5
b5b7915471785cc10227dadfefb8d02f

SHA1
db8ac478424c9948efbbb74b99d835718a8ab06e

SHA256
dedc417b2f176542b941a733c6b4570df10e3bec894f21918fcd75c8468e28bb

SHA512
d9d39df9a9631e044f2a92b0ced546bda11a6bcdb99e85503edec4365a422cd9e2b20988409b4905a1a701a496f3113bd43a8285bfdcdffaba8cf01440d5ed13

Download Submit
C:\Windows\system\dqSQRzz.exe

Filesize
1.7MB

MD5
f35ef4d163b0fd88fd08f45c351d888a

SHA1
b3a47f0670776069639875d158b2c76b74111e7f

SHA256
db43412be1e5ee1664877b5ae6fa736d9d5d391440edd25aea241a7a65f71ca9

SHA512
59469fa841a41c379f5a87c9eb1531c74a632dd747a1c704a4bba0e4c6b1ee4d11c58d0b3cc17498013718ba984da0a9659ff5feec10ac3241052c5f66bc8be5

Download Submit
C:\Windows\system\esaiGRO.exe

Filesize
1.7MB

MD5
8db77f8baf4ebb3a365390c812b2aaf8

SHA1
a80f5aa3dee042730541936bc434f37becd63a54

SHA256
358c69702ed77a67d486c9ca2250c3fa6fb2aaedc11f8c1291a3b238393fc8b8

SHA512
52de09fc3857179f7e33ec5bc0c8963cbd9601583516821aeab25fb6d64e798d02553e70ddfd5c8ced1aa83325520c1865a04a2172f58cdb5795968eabaac297

Download Submit
C:\Windows\system\jVeMUtn.exe

Filesize
1.7MB

MD5
4529a5191fc02df6975b542e5c4cfb05

SHA1
4e44a5ace3f55dabea85fd1ad018470a7d204c23

SHA256
f5d3796423e54d0157e76124cda4b78363c29f7410cf41463941d39169e800ac

SHA512
52aa21a00b908ec939c080f24ce00e6b666315521ab19b8f47ac86cebd157dbad21f9cb74739517ad59595e1d3c76b443886802c7edf64b7a1660949e4014252

Download Submit
C:\Windows\system\kCjutHL.exe

Filesize
1.7MB

MD5
9210c452d7f443d602ede2082738717f

SHA1
b5985099519d47aa2f3c4e1b42a700b3a46cb1c6

SHA256
888767d8736cf3ef7104e8fa3770f2a279cd92ad3099cbeeeab08f98bc8a767e

SHA512
2b3bddde3d4bc0f3a78894dd5ebe055b1b1cea9c889def4eedad6dbf90fbac802f36299b8eb0894465641d68c1c3ca02af1e6e166258f264a955ac266e2fdfcb

Download Submit
C:\Windows\system\miWKVFq.exe

Filesize
1.7MB

MD5
1c31faca6f35af818f446e388050ba69

SHA1
76539ab0267dcdeb3a2ecda7d2b4ae123c04637d

SHA256
489b80f705823d7be77eeffb99ecffa71eedfa94982a8a60c61daf67ae578fa0

SHA512
4afe441431542f4f011b9c3f4b5a8099e51b3a819b0a0d34f27bb6ebe62db432f786e4b24ba3cb50096efa3dcc53a2deb5e8c2dbef6512f0299ecfc656792955

Download Submit
C:\Windows\system\nGKWNpV.exe

Filesize
1.7MB

MD5
b23e9e337a6baf490b3383a6f1854e41

SHA1
4bd4e79b24fb0f0ee29a52490e88cb242d1976a7

SHA256
42a4237720864e1727a75f0e88a6d4f1534aa05bccdd03c1d8515f4ecb72f7f0

SHA512
47751d79d0c289a6b4793d01bfb17a747078184cdebdcd6620263acbbc1b0e09765471d7153444eaae65b1b33fdeefa95fcdb42a039db3242e9f061220ffd765

Download Submit
C:\Windows\system\nUtOgEo.exe

Filesize
1.7MB

MD5
b2bc452511fdb158001842a2959d115a

SHA1
10f9840983ba22c9deefb4038d809658dd74fbac

SHA256
11862eeee2b4787cd364498de40186d16d3a16e7638a10b9ff3ac71c29cda3d9

SHA512
dd416e238b8c8669f5dc8a666e2614cf38846a442f6c6c7878365aa5d6e1c46ce961f4257cd829e8911c6fb5e5743935727f75cf70e7fe7cb26dfc999d0fdb96

Download Submit
C:\Windows\system\ojAPhvb.exe

Filesize
1.7MB

MD5
cad5747c6d210f93b4c85a14cd0635db

SHA1
6ed4668828e10460942fe09baaf3f74023108630

SHA256
85c9f6858d604c7dff3aca87ffa0d1f349b2af67bc678d4f7dac3210c2ff1cbb

SHA512
084f57be46f3eb1783a9ec1c41638ff310ed0414e0a5727387acdf94bbc3ec4ffd22c537cb627843eed2a4245df90837c55d5867f6fe78abf6d5157fad45c1fe

Download Submit
C:\Windows\system\qFIZGnP.exe

Filesize
1.7MB

MD5
5742f7082e2e1b4e605d569f53e19f48

SHA1
fb353874cd228c4a448265cf47e3e4ffc15a74a1

SHA256
2908b363e24b9b29fcb6363a6638f1b8ea0bf6bca707d8e44f8f30db50f99b4b

SHA512
7748c6551e8d48467231edb77dadfdfd555ffbb17b3d3f4357f5b8bde4882e624fc3cf54fb8068658b35c6d00c14a59a16dbec418aa1630fff61b2b910d411c1

Download Submit
C:\Windows\system\rmGmKRw.exe

Filesize
1.7MB

MD5
0ff61b113f2fb0aca63f09b775842716

SHA1
efb71ae73cf9aa12730e7361938939cfc2aaaf12

SHA256
ad42c8cf8916fe47cb87d82f2bb7d87826d78fcc935f52a767929eab9ab96d33

SHA512
90b1595090f9ac0d5ea16ab49ccf5cba80f7a99a3919563b47c9fc565403b0512e503b73780a8befd78b9413a07576f521700b00ee432543b8a5bdb852e48a84

Download Submit
C:\Windows\system\vqwejLj.exe

Filesize
1.7MB

MD5
a6a000320951886e4bf7293451c410e2

SHA1
6e1eef80d9acc2b846a076229a997a04f1068134

SHA256
268b9efba6b502623f12b2baaa9279db1408441de0f20a1155130503a25d184e

SHA512
785cf5971077bbb921af0e726a903b49c6c99377b3d03c341eb60ef8c4dc0f31f76609c6f5fe5340dfa6c55172545ae1e4eee622d3511b9496f00a6f4cd4bbbd

Download Submit
C:\Windows\system\zIxrwPG.exe

Filesize
1.7MB

MD5
b1289efd3ec9f1df53f48d50fa9ca25c

SHA1
cda436b752a1b3ca2df8f2934dab16a23f99f954

SHA256
5ecac6f96b5ee9a27a3553c37bf868b38ad7d6b5e84cfb03c0c47bef9c9acec8

SHA512
51b5fcef5b54c5d4e94f79593133a40c15b7d062f9882b2d6b52df41585ad18e1798ea8219ac6de3169412427d20730716b03d1edbe9d4516d53dd1841164c12

Download Submit
\Windows\system\DycxaLk.exe

Filesize
1.7MB

MD5
d8327de0ec7364f0c78b5d527d7cb1fd

SHA1
e136b0d110fbd0694888a13b26bbaf6ad2fa79fc

SHA256
7b845f35fc3f9ef216223d7ba5dd9284c3450d18b24f02d3ab2c9ac24bcbd5f6

SHA512
957e5639d02266607d1abe0dea536fe779dc13c39e3172c58747972b1c40eb1280288a81d4fde634614d39f98a750f7a461098057bf0dcdc07083a986c4971f4

Download Submit
\Windows\system\FPRullH.exe

Filesize
1.7MB

MD5
527ed44a1990af21c822cf6bd54e33e8

SHA1
0e7b14405ca19f5300a58dbaacdcd7911c6e483f

SHA256
7c89b550bf7221c9e5576eb46604e804aade1062cd7f1c761291fad0b9232d4c

SHA512
1b3b63882018d9ede9d16656c9c2cfa27736593d9aa75c762ad122dc5e0405cc74b0df3e644253a8c42bbe719cb00a2dea80e45a7e45ca6b461e1ad04402b6c8

Download Submit
\Windows\system\HYKvwsj.exe

Filesize
1.7MB

MD5
c63da14ccfdf0c181c3b97a86d9c4611

SHA1
c3dfcaf04fa780d91ed35017a326e3b0f43b8156

SHA256
e2842629cc97be1acefa42a683f6eeca242a878dc87a2e6feb57125efd1c7f20

SHA512
05eef9b51541149c10c8f42064b02d561d342f9d66d0a4d2c6c40005d23186dc25a682453ae2add0713c1361e47bce48a55de03d89caf239f51547fd5849f4cc

Download Submit
\Windows\system\KgCqMcs.exe

Filesize
1.7MB

MD5
23dd50ec2e12ebe964d9cc8f6153c56d

SHA1
32775eb78b1eda2f5732590f6c479ff29fbf8886

SHA256
211089d66c0063fa870a7b67b80efe690f695514457820b0e58e1daf3937e56c

SHA512
4005e88371689598981188db599451c489780f0e2ee842d4145ca63334c48268023024c56624ae41be5b63e7a642bb19e02ecdfbad1d9580512a0d4d1a2faaff

Download Submit
\Windows\system\MagbHYB.exe

Filesize
1.7MB

MD5
29f6cd7f848bde4e9ca5aad4ec73c48e

SHA1
ecc4748bc33ae1117fbeafce91195b3299324ddd

SHA256
9c048e0d637e9143d268f794cfa173b56ffb60d9eddc1b919a09c9aeb895552c

SHA512
fa311b1c752ecd27b4c157bda283e9458e955b3f1bd2e829249234a21e79afe43693ecaf90e0871820662ea067aa52f66efe78fb1826c6a2a2e9d0911be215d9

Download Submit
\Windows\system\MwrKYpf.exe

Filesize
1.7MB

MD5
296f0c9ff07e12eb7e27ad20eaed8a85

SHA1
9a805fb4e39f9c6567990378cb0b47f496ae7898

SHA256
753ea36076a81c0588576725edf2920ec276b4c63a80f4427dde53f9f2247d54

SHA512
d7dbea248a26459bad146c0dde2c992404a21bd35695c786cbdf4420a9afe498e9f993c01ddea07c46c32e7859bcbdb9c3009afe6843fe8bf896223443cd5913

Download Submit
\Windows\system\OEVWmhS.exe

Filesize
1.7MB

MD5
550969d2977004c687dc05f810b72cfa

SHA1
f00613c49accf2f673f36f4e67bbc7546183149a

SHA256
17963ff814a24721edc86e8388c09dbced5c934bedb29151e60e4d18fad07ce9

SHA512
870048e6c2689c9b7538fa692dd423aee259093286d01c9257e097fb7a8583135d1009278e430eb74560a859033e4f2b540dfbb8aeba61f832efc32b0c5ebff7

Download Submit
\Windows\system\ShaFyDU.exe

Filesize
1.7MB

MD5
e6f6f4717a339da434988b5308d6bd30

SHA1
d2b0b281b5c3a1928f6fe00c127ca428f61b44b2

SHA256
e129ba625168780c688462a7d97a395936732f1e7493b22a7bd93c82a031a6ef

SHA512
f71f38b5e204cd5b2d14be8f07a40302de089737cb0cc6b018d6b570a6dae81cea71ac62a439d607919ee8db98b3ccb25536e37c40c6587ecf3387330b33b5a3

Download Submit
\Windows\system\ZsQeXwu.exe

Filesize
1.7MB

MD5
2c16e3d5df1fdceadfe5292bea56c027

SHA1
f31dab06470e0768397083d8a3e6580b0e069911

SHA256
18108f1a17aba10983d4fefdb0416c957a8d7ed7812013d595ce4ec965be0ae3

SHA512
d30dc837d77c7a80dabecf2a14b3f47c1d243209c84469e4ac7d6338004fed66b15f6fbf7362b3085294a07973adc754a2af66f8ade371a5ba7139102ab760bb

Download Submit
\Windows\system\cNHoyXU.exe

Filesize
1.7MB

MD5
b99814f164e178d5e7307f000f5b08b2

SHA1
d6b8f8f0d893e446efe035fa429648fac5a87202

SHA256
0336b4c66b7082a4ac7beaae78871d01e5ee496263b4c344f5d9da8e222e143b

SHA512
026aebb66bc1f4048270d2cc80724597f0fbeace6051647ee60f1e8fda9c4c13be89fad5437c2643c5a65bd787666cbc970542081ed46134f9e855c21746f2c6

Download Submit
\Windows\system\chOfCCV.exe

Filesize
1.7MB

MD5
12e2344401040e022d67847a2574f424

SHA1
a109a6e4c7d126c643210382be896c6565ffd77d

SHA256
afbd319eb7b0d902ac6486ba40abab8dde0663778aa6aadc3ee9d1bcf6cb6b89

SHA512
28498f72b1e4bb3e08a91c08d0f6969857882f9750a0060985738c3e519154a4efbcdeac875c0bc0c932d90b3bf8172ffd3601217535e2e0c4d2e9b622cd48f5

Download Submit
\Windows\system\kGdxMEO.exe

Filesize
1.7MB

MD5
6c8dd91117da9f9a7bc41c9dd7d90806

SHA1
f32a3abbbcc1eacb22a58a53f9fa74367a239c25

SHA256
e48a0ed4029e5c25cb77d2448eff326b0136420d9c27d5160aba0c112a43bdd3

SHA512
bac3e6293da9e829e2d7f4f14f1ad344eb381d9de7c6389f1801357cc164e3dd5cdda9605425127a3c4e00c9d1bf0c8c05828b5de3b3d14758bc05453d1c5cda

Download Submit
\Windows\system\lrtfzgz.exe

Filesize
1.7MB

MD5
a926910ae10f61579bdba82f352ecf51

SHA1
3bf1179a1c62523536cde58c8464da8c9eb60553

SHA256
35169e831fce8852302b6cfdeee0efd1428e2af898404fa1f2ee121d5ab9ca88

SHA512
b5d86ae8d3596fd5a20964b771c33548a686d3e146f1a2b3816be746f6eb5701c31f4ff85912edeaa27a7ba9b59f5ca9afb62f4b0082eac446113881dbc90c25

Download Submit
\Windows\system\mbHRjRF.exe

Filesize
1.7MB

MD5
7058aacf0b811d7f475badcbbd3fc553

SHA1
dd676e7c0eecf4fd28082e72a5a14254edbce50f

SHA256
df739a7c34787195949f63d0499fd9e8a8ed11a33830589dc02cd2f628667c06

SHA512
944bcb22759caa4539262c933defb961764b1f6047a2dd62112eac4273f988b764a9324a34a1393d0ee070098063a010cafb443ab154cc5c622acd37d85b38c3

Download Submit
\Windows\system\nAhZseX.exe

Filesize
1.7MB

MD5
d3399525ee98210c81b5668f3803132a

SHA1
aee507dcd2fb7d901e048db83cd3f5a80b5247e1

SHA256
ba6aa348ac9be145be1da809f42a3a91340d0b9170fd4c2dc10fca8fee64d162

SHA512
66d5fe186fdca88800831dbed5f2f070694cf5c43efff9768d8863d5da55a740ac3e6f939cc0f4d33c2b2d0955c60fecadd96268579b60c2c026881c4152e552

Download Submit
\Windows\system\nWziyOF.exe

Filesize
1.7MB

MD5
a926ae0cf8e6c0789f321c7da341db83

SHA1
4ef3cfa5bdc4032254caa5d364b2fbc7d9c90c22

SHA256
f174e33dd08e116d0054f76ee64899aed3ebd9cb1353d9b25f54ba104e52aef6

SHA512
27640c173ebea8d40c2acecdb01b6030e9a568e91ce3ca226f6c6317f1953ba0d0c30832fac37c6b34dfcf9e2a2ec82a31a595cf17282e29ae4a35a8c9f4903a

Download Submit
\Windows\system\tIVUSij.exe

Filesize
1.7MB

MD5
8878ec9cf0a95ffba09a1a304ead6072

SHA1
ad5684e1e332154cfceae983e2b87c29e47913b5

SHA256
05894374fdbbb7f54c201f3f5df8e080f19b136e31d710c78828c21fb0fae823

SHA512
3a6b91ece27c72c0e56fb9117c7fe6a10f6b73222ab8fa1af07d13f6489f833565b561a996ae0437e537b26efa22cab18cfbf27350d704a3091aee3ea4146fe7

Download Submit
\Windows\system\xgqNnvA.exe

Filesize
1.7MB

MD5
67c0ebebf2e83e8010f97a556f8c824b

SHA1
a2f72ca8a283a227df377bf0c43805545159fece

SHA256
b881db7134eca60ebc06b227e7c405970369a55effff9df08adfcd0203eda38e

SHA512
7605d98271e3e979514fcedcdb2036fd32f8989f1551514bb91e6f771f8823410c925c7c068ceed3c6acf4f22b79928700e46bae1989da5f2911b05a0f2e1c7b

Download Submit
memory/2452-100-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2508-91-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-96-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2560-9-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2664-19-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-94-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2676-113-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2740-110-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2740-25-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Filesize
512KB

Download
memory/2740-87-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2740-111-0x0000000002C30000-0x0000000002CB0000-memory.dmp

Filesize
512KB

Download
memory/2740-290-0x000007FEF5E50000-0x000007FEF67ED000-memory.dmp

Filesize
9.6MB

Download
memory/2740-61-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/2740-69-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2880-104-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2916-93-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-99-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-102-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-0-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-101-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-92-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2916-90-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-7-0x000000013FA60000-0x000000013FE52000-memory.dmp

Filesize
3.9MB

Download
memory/2916-105-0x00000000034F0000-0x00000000038E2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2916-24-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2916-13-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-103-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download