xmrig | 8c39bad80224c81da9b1fea9500d48deb2ef31b3f6df4b2256f25c90c16ca039

Analysis

max time kernel
39s
max time network
37s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
Size

1.8MB
MD5

08253b9baab1c5dece6b01f0d4b7b8e7
SHA1

c2bbf6eef7abed49e2708d56b5da7d3869b0f06f
SHA256

8c39bad80224c81da9b1fea9500d48deb2ef31b3f6df4b2256f25c90c16ca039
SHA512

2ae2c65c9927012dc9a452996bd90da3eb89e6389d073dea85618e8778ffc5b0369de192bb14e12a34f913ba5168bee540dd3437b23eb78daefa4f3a7a64fa60
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlc:NABL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2656-31-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2760-109-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2864-60-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/3064-39-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2300-81-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2568-80-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2672-78-0x000000013FA70000-0x000000013FE62000-memory.dmp	xmrig
behavioral1/memory/2748-76-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2768-27-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/1284-2218-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2864	IqCWIPQ.exe
2768	aQCaPlT.exe
2656	LbBuDmv.exe
3064	YoLiBGk.exe
2808	LgUmpET.exe
2748	eNcFrIz.exe
2672	XlpHrEy.exe
2568	xpAFpBt.exe
2300	DdmAmdz.exe
2760	McWzoqX.exe
2892	DcZfoGL.exe
2828	NrNByZR.exe
2616	soXmDwv.exe
2992	KtMfCIS.exe
288	HstQClx.exe
2896	CgXjztl.exe
1804	FMtvvrK.exe
1816	yMDQmuP.exe
3004	tfsXRZR.exe
2736	LJBAEaV.exe
2428	QacAvjb.exe
1200	GzJHaoC.exe
1768	wpJTHgC.exe
2072	HqXlxSq.exe
2044	eUfCmgb.exe
1028	THsvqpR.exe
2396	XUOCdmn.exe
1716	CuhLUOQ.exe
1080	thrbqQe.exe
1168	lZEdBEf.exe
1348	fTIXPvO.exe
2312	SjvrYWW.exe
272	yycPlXT.exe
1776	kRMEDTV.exe
956	XCvXHpF.exe
764	ewBOWHL.exe
1252	WdPYVor.exe
1292	sDULLBu.exe
2480	bSJizzs.exe
1148	NrWnfzd.exe
1328	fLSpbea.exe
2172	gkKjQCe.exe
1556	DkzSdUR.exe
2980	RiEFgkD.exe
2976	DLyVQVZ.exe
1552	qnesSaX.exe
1388	VdWEyZQ.exe
1512	brkqeKI.exe
2968	cWGYNHw.exe
3060	xENxIbg.exe
2212	tJzkumB.exe
2052	bAPEkNf.exe
2780	Wnoousp.exe
2920	KWbDLCG.exe
2816	DMIcYyK.exe
2720	hhoiWtm.exe
1612	eqUWcbg.exe
1752	hjksrtV.exe
2476	TgKZmAM.exe
1560	JzSHcPe.exe
2640	zBIaojU.exe
2552	XelShQg.exe
2168	MBGMuFY.exe
1636	UMUpwEm.exe

Loads dropped DLL 64 IoCs

pid	Process
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1284-1-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/files/0x0037000000015b72-7.dat	upx
behavioral1/files/0x000c000000012279-6.dat	upx
behavioral1/files/0x0007000000015cd8-18.dat	upx
behavioral1/files/0x0008000000015cc2-13.dat	upx
behavioral1/files/0x0008000000015ca9-11.dat	upx
behavioral1/memory/2656-31-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/files/0x0006000000016c57-101.dat	upx
behavioral1/files/0x0006000000016d2d-131.dat	upx
behavioral1/files/0x0006000000016d46-144.dat	upx
behavioral1/files/0x0006000000016fa9-181.dat	upx
behavioral1/files/0x000600000001708c-186.dat	upx
behavioral1/files/0x0006000000016d7d-176.dat	upx
behavioral1/files/0x0006000000016d73-166.dat	upx
behavioral1/files/0x0006000000016d79-171.dat	upx
behavioral1/files/0x0006000000016d57-156.dat	upx
behavioral1/files/0x0006000000016d5f-161.dat	upx
behavioral1/files/0x0006000000016d4f-151.dat	upx
behavioral1/files/0x0006000000016d3e-141.dat	upx
behavioral1/files/0x0006000000016d36-136.dat	upx
behavioral1/files/0x0006000000016d21-126.dat	upx
behavioral1/files/0x0006000000016d19-121.dat	upx
behavioral1/files/0x0006000000016d10-117.dat	upx
behavioral1/files/0x0007000000016cf2-114.dat	upx
behavioral1/files/0x0006000000016a3a-98.dat	upx
behavioral1/files/0x0007000000015ce1-87.dat	upx
behavioral1/files/0x0006000000016ca1-84.dat	upx
behavioral1/memory/2760-109-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2864-60-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x00070000000167e8-51.dat	upx
behavioral1/memory/2808-41-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0007000000015ced-40.dat	upx
behavioral1/memory/3064-39-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0008000000016591-36.dat	upx
behavioral1/files/0x0006000000016d01-104.dat	upx
behavioral1/files/0x00130000000054a8-91.dat	upx
behavioral1/memory/2300-81-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/memory/2568-80-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2672-78-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/memory/2748-76-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/files/0x0006000000016c5b-65.dat	upx
behavioral1/files/0x0006000000016c3a-64.dat	upx
behavioral1/memory/2768-27-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/1284-2218-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ppVBPyl.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\AkcCqzV.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\VuXeXVk.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\KmoEvwS.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\bGdfnit.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\RyEyYwI.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qTwzOat.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\AWVLjYi.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\BEkNMud.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\fGJIqrw.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\dnkkGNK.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\sEqBkyC.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\wBIbUoW.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qPLlvZQ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\yTupMjq.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\uagrCdo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\UvaRhvt.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\zMcLGbP.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\dcVmsgM.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\iqoXhXw.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ZuisDnf.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\MBGMuFY.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\nukEoAo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ZyVfkQQ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ZitcOVM.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\bbflNSp.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\jtwIpqA.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\yZIugCK.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\juoSuQU.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\TYWgwlI.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\KNGaANU.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\CihBPqn.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\RKjqUJP.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\EBCxqPy.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\JBzGqtn.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\esSpTmg.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\citDGPV.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\LboEfSd.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\adXwxdo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\nZLGCpN.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\cuqQqhZ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\WriGxrs.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\xmcgXwr.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\VHXGwsJ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\QHdRxWz.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\FUfcTkB.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\HcTENWo.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\ARnrlnN.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\EYHmASB.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\OnUfCNJ.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\HTNdYeu.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\NmBGFxj.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\YmzOTXB.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\mFONmuS.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\VajQBqM.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\HDlWnZy.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\nKNtYki.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\kEqRbmt.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\gGjulsO.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\enlFyLI.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\qWJuiHa.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\tCbQXkq.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\XlpHrEy.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
File created	C:\Windows\System\GjVVwYI.exe	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	powershell.exe
1736	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
Token: SeDebugPrivilege	1736	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 1736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	29
PID 1284 wrote to memory of 1736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	29
PID 1284 wrote to memory of 1736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	29
PID 1284 wrote to memory of 2864	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	30
PID 1284 wrote to memory of 2864	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	30
PID 1284 wrote to memory of 2864	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	30
PID 1284 wrote to memory of 3064	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	31
PID 1284 wrote to memory of 3064	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	31
PID 1284 wrote to memory of 3064	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	31
PID 1284 wrote to memory of 2768	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2768	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2768	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	32
PID 1284 wrote to memory of 2808	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2808	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2808	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	33
PID 1284 wrote to memory of 2656	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2656	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2656	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	34
PID 1284 wrote to memory of 2760	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2760	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2760	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	35
PID 1284 wrote to memory of 2748	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	36
PID 1284 wrote to memory of 2748	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	36
PID 1284 wrote to memory of 2748	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	36
PID 1284 wrote to memory of 2828	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	37
PID 1284 wrote to memory of 2828	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	37
PID 1284 wrote to memory of 2828	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	37
PID 1284 wrote to memory of 2672	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	38
PID 1284 wrote to memory of 2672	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	38
PID 1284 wrote to memory of 2672	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	38
PID 1284 wrote to memory of 2616	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	39
PID 1284 wrote to memory of 2616	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	39
PID 1284 wrote to memory of 2616	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	39
PID 1284 wrote to memory of 2568	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	40
PID 1284 wrote to memory of 2568	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	40
PID 1284 wrote to memory of 2568	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	40
PID 1284 wrote to memory of 2992	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	41
PID 1284 wrote to memory of 2992	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	41
PID 1284 wrote to memory of 2992	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	41
PID 1284 wrote to memory of 2300	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	42
PID 1284 wrote to memory of 2300	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	42
PID 1284 wrote to memory of 2300	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	42
PID 1284 wrote to memory of 2896	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	43
PID 1284 wrote to memory of 2896	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	43
PID 1284 wrote to memory of 2896	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	43
PID 1284 wrote to memory of 2892	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	44
PID 1284 wrote to memory of 2892	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	44
PID 1284 wrote to memory of 2892	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	44
PID 1284 wrote to memory of 1804	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	45
PID 1284 wrote to memory of 1804	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	45
PID 1284 wrote to memory of 1804	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	45
PID 1284 wrote to memory of 288	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	46
PID 1284 wrote to memory of 288	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	46
PID 1284 wrote to memory of 288	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	46
PID 1284 wrote to memory of 1816	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	47
PID 1284 wrote to memory of 1816	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	47
PID 1284 wrote to memory of 1816	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	47
PID 1284 wrote to memory of 3004	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	48
PID 1284 wrote to memory of 3004	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	48
PID 1284 wrote to memory of 3004	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	48
PID 1284 wrote to memory of 2736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2736	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	49
PID 1284 wrote to memory of 2428	1284	08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08253b9baab1c5dece6b01f0d4b7b8e7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\Windows\System\IqCWIPQ.exe
  C:\Windows\System\IqCWIPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\YoLiBGk.exe
  C:\Windows\System\YoLiBGk.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\aQCaPlT.exe
  C:\Windows\System\aQCaPlT.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\LgUmpET.exe
  C:\Windows\System\LgUmpET.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\LbBuDmv.exe
  C:\Windows\System\LbBuDmv.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\McWzoqX.exe
  C:\Windows\System\McWzoqX.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\eNcFrIz.exe
  C:\Windows\System\eNcFrIz.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NrNByZR.exe
  C:\Windows\System\NrNByZR.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\XlpHrEy.exe
  C:\Windows\System\XlpHrEy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\soXmDwv.exe
  C:\Windows\System\soXmDwv.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\xpAFpBt.exe
  C:\Windows\System\xpAFpBt.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\KtMfCIS.exe
  C:\Windows\System\KtMfCIS.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\DdmAmdz.exe
  C:\Windows\System\DdmAmdz.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CgXjztl.exe
  C:\Windows\System\CgXjztl.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\DcZfoGL.exe
  C:\Windows\System\DcZfoGL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\FMtvvrK.exe
  C:\Windows\System\FMtvvrK.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\HstQClx.exe
  C:\Windows\System\HstQClx.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\yMDQmuP.exe
  C:\Windows\System\yMDQmuP.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\tfsXRZR.exe
  C:\Windows\System\tfsXRZR.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\LJBAEaV.exe
  C:\Windows\System\LJBAEaV.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\QacAvjb.exe
  C:\Windows\System\QacAvjb.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GzJHaoC.exe
  C:\Windows\System\GzJHaoC.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\wpJTHgC.exe
  C:\Windows\System\wpJTHgC.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\HqXlxSq.exe
  C:\Windows\System\HqXlxSq.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\eUfCmgb.exe
  C:\Windows\System\eUfCmgb.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\THsvqpR.exe
  C:\Windows\System\THsvqpR.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\XUOCdmn.exe
  C:\Windows\System\XUOCdmn.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\CuhLUOQ.exe
  C:\Windows\System\CuhLUOQ.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\thrbqQe.exe
  C:\Windows\System\thrbqQe.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\lZEdBEf.exe
  C:\Windows\System\lZEdBEf.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\fTIXPvO.exe
  C:\Windows\System\fTIXPvO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\SjvrYWW.exe
  C:\Windows\System\SjvrYWW.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\yycPlXT.exe
  C:\Windows\System\yycPlXT.exe
  2⤵
  - Executes dropped EXE
  PID:272
- C:\Windows\System\kRMEDTV.exe
  C:\Windows\System\kRMEDTV.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\XCvXHpF.exe
  C:\Windows\System\XCvXHpF.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\ewBOWHL.exe
  C:\Windows\System\ewBOWHL.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\WdPYVor.exe
  C:\Windows\System\WdPYVor.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\sDULLBu.exe
  C:\Windows\System\sDULLBu.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\bSJizzs.exe
  C:\Windows\System\bSJizzs.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\NrWnfzd.exe
  C:\Windows\System\NrWnfzd.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\fLSpbea.exe
  C:\Windows\System\fLSpbea.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\gkKjQCe.exe
  C:\Windows\System\gkKjQCe.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\DkzSdUR.exe
  C:\Windows\System\DkzSdUR.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\RiEFgkD.exe
  C:\Windows\System\RiEFgkD.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\DLyVQVZ.exe
  C:\Windows\System\DLyVQVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\qnesSaX.exe
  C:\Windows\System\qnesSaX.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\VdWEyZQ.exe
  C:\Windows\System\VdWEyZQ.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\brkqeKI.exe
  C:\Windows\System\brkqeKI.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\cWGYNHw.exe
  C:\Windows\System\cWGYNHw.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\xENxIbg.exe
  C:\Windows\System\xENxIbg.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\tJzkumB.exe
  C:\Windows\System\tJzkumB.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\bAPEkNf.exe
  C:\Windows\System\bAPEkNf.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\Wnoousp.exe
  C:\Windows\System\Wnoousp.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\KWbDLCG.exe
  C:\Windows\System\KWbDLCG.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\DMIcYyK.exe
  C:\Windows\System\DMIcYyK.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\hhoiWtm.exe
  C:\Windows\System\hhoiWtm.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\eqUWcbg.exe
  C:\Windows\System\eqUWcbg.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\hjksrtV.exe
  C:\Windows\System\hjksrtV.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\TgKZmAM.exe
  C:\Windows\System\TgKZmAM.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\JzSHcPe.exe
  C:\Windows\System\JzSHcPe.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\zBIaojU.exe
  C:\Windows\System\zBIaojU.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\XelShQg.exe
  C:\Windows\System\XelShQg.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\MBGMuFY.exe
  C:\Windows\System\MBGMuFY.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\UMUpwEm.exe
  C:\Windows\System\UMUpwEm.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\MNaEOpz.exe
  C:\Windows\System\MNaEOpz.exe
  2⤵
  PID:1528
- C:\Windows\System\KAAgSxI.exe
  C:\Windows\System\KAAgSxI.exe
  2⤵
  PID:2936
- C:\Windows\System\AaPzgaW.exe
  C:\Windows\System\AaPzgaW.exe
  2⤵
  PID:1732
- C:\Windows\System\OgMSbZa.exe
  C:\Windows\System\OgMSbZa.exe
  2⤵
  PID:2108
- C:\Windows\System\kleDyKY.exe
  C:\Windows\System\kleDyKY.exe
  2⤵
  PID:1280
- C:\Windows\System\loLvrbr.exe
  C:\Windows\System\loLvrbr.exe
  2⤵
  PID:1656
- C:\Windows\System\EBNTLvn.exe
  C:\Windows\System\EBNTLvn.exe
  2⤵
  PID:2540
- C:\Windows\System\kUCKAQg.exe
  C:\Windows\System\kUCKAQg.exe
  2⤵
  PID:2324
- C:\Windows\System\IxNUBDQ.exe
  C:\Windows\System\IxNUBDQ.exe
  2⤵
  PID:548
- C:\Windows\System\uagrCdo.exe
  C:\Windows\System\uagrCdo.exe
  2⤵
  PID:1548
- C:\Windows\System\UAKxxAG.exe
  C:\Windows\System\UAKxxAG.exe
  2⤵
  PID:1680
- C:\Windows\System\bVJTmGa.exe
  C:\Windows\System\bVJTmGa.exe
  2⤵
  PID:2956
- C:\Windows\System\YTMvPRt.exe
  C:\Windows\System\YTMvPRt.exe
  2⤵
  PID:900
- C:\Windows\System\cDTtDhg.exe
  C:\Windows\System\cDTtDhg.exe
  2⤵
  PID:1660
- C:\Windows\System\ofXbKdd.exe
  C:\Windows\System\ofXbKdd.exe
  2⤵
  PID:2144
- C:\Windows\System\fwKNqLp.exe
  C:\Windows\System\fwKNqLp.exe
  2⤵
  PID:2032
- C:\Windows\System\EZPuTRn.exe
  C:\Windows\System\EZPuTRn.exe
  2⤵
  PID:2036
- C:\Windows\System\WDTtZaT.exe
  C:\Windows\System\WDTtZaT.exe
  2⤵
  PID:1184
- C:\Windows\System\XKGyGRF.exe
  C:\Windows\System\XKGyGRF.exe
  2⤵
  PID:348
- C:\Windows\System\QwpmmTx.exe
  C:\Windows\System\QwpmmTx.exe
  2⤵
  PID:756
- C:\Windows\System\tGfzzLT.exe
  C:\Windows\System\tGfzzLT.exe
  2⤵
  PID:2648
- C:\Windows\System\VXlUGbN.exe
  C:\Windows\System\VXlUGbN.exe
  2⤵
  PID:2756
- C:\Windows\System\cLVLSPC.exe
  C:\Windows\System\cLVLSPC.exe
  2⤵
  PID:2236
- C:\Windows\System\UqjOwQw.exe
  C:\Windows\System\UqjOwQw.exe
  2⤵
  PID:1620
- C:\Windows\System\VeOhXGG.exe
  C:\Windows\System\VeOhXGG.exe
  2⤵
  PID:1876
- C:\Windows\System\wAdssVm.exe
  C:\Windows\System\wAdssVm.exe
  2⤵
  PID:2792
- C:\Windows\System\QfBLhMx.exe
  C:\Windows\System\QfBLhMx.exe
  2⤵
  PID:2192
- C:\Windows\System\pwCwOPg.exe
  C:\Windows\System\pwCwOPg.exe
  2⤵
  PID:3068
- C:\Windows\System\Lmsmyhr.exe
  C:\Windows\System\Lmsmyhr.exe
  2⤵
  PID:2728
- C:\Windows\System\ImXtdFC.exe
  C:\Windows\System\ImXtdFC.exe
  2⤵
  PID:1448
- C:\Windows\System\tvRcalf.exe
  C:\Windows\System\tvRcalf.exe
  2⤵
  PID:2076
- C:\Windows\System\NeVAkOU.exe
  C:\Windows\System\NeVAkOU.exe
  2⤵
  PID:1108
- C:\Windows\System\HEWwYId.exe
  C:\Windows\System\HEWwYId.exe
  2⤵
  PID:2336
- C:\Windows\System\QdleLLe.exe
  C:\Windows\System\QdleLLe.exe
  2⤵
  PID:2468
- C:\Windows\System\KgguijR.exe
  C:\Windows\System\KgguijR.exe
  2⤵
  PID:632
- C:\Windows\System\BkExFcy.exe
  C:\Windows\System\BkExFcy.exe
  2⤵
  PID:2964
- C:\Windows\System\iJuvcyj.exe
  C:\Windows\System\iJuvcyj.exe
  2⤵
  PID:1948
- C:\Windows\System\yOwbvyq.exe
  C:\Windows\System\yOwbvyq.exe
  2⤵
  PID:2908
- C:\Windows\System\zcuCLEm.exe
  C:\Windows\System\zcuCLEm.exe
  2⤵
  PID:2292
- C:\Windows\System\mZedHME.exe
  C:\Windows\System\mZedHME.exe
  2⤵
  PID:1056
- C:\Windows\System\jMWUQSW.exe
  C:\Windows\System\jMWUQSW.exe
  2⤵
  PID:2272
- C:\Windows\System\xHRmbWV.exe
  C:\Windows\System\xHRmbWV.exe
  2⤵
  PID:2596
- C:\Windows\System\FlrSGTZ.exe
  C:\Windows\System\FlrSGTZ.exe
  2⤵
  PID:3000
- C:\Windows\System\wfGKTQu.exe
  C:\Windows\System\wfGKTQu.exe
  2⤵
  PID:812
- C:\Windows\System\NIYsUaU.exe
  C:\Windows\System\NIYsUaU.exe
  2⤵
  PID:1248
- C:\Windows\System\CLHcyAk.exe
  C:\Windows\System\CLHcyAk.exe
  2⤵
  PID:1576
- C:\Windows\System\CisQxIu.exe
  C:\Windows\System\CisQxIu.exe
  2⤵
  PID:1684
- C:\Windows\System\xVKPVNu.exe
  C:\Windows\System\xVKPVNu.exe
  2⤵
  PID:2872
- C:\Windows\System\SlDSvnF.exe
  C:\Windows\System\SlDSvnF.exe
  2⤵
  PID:2916
- C:\Windows\System\qTsSucd.exe
  C:\Windows\System\qTsSucd.exe
  2⤵
  PID:1820
- C:\Windows\System\UoxYJEm.exe
  C:\Windows\System\UoxYJEm.exe
  2⤵
  PID:660
- C:\Windows\System\keyabeD.exe
  C:\Windows\System\keyabeD.exe
  2⤵
  PID:1648
- C:\Windows\System\ztRqyPQ.exe
  C:\Windows\System\ztRqyPQ.exe
  2⤵
  PID:3080
- C:\Windows\System\ZaKzEdl.exe
  C:\Windows\System\ZaKzEdl.exe
  2⤵
  PID:3100
- C:\Windows\System\lvZaigQ.exe
  C:\Windows\System\lvZaigQ.exe
  2⤵
  PID:3120
- C:\Windows\System\cWHngnR.exe
  C:\Windows\System\cWHngnR.exe
  2⤵
  PID:3140
- C:\Windows\System\IkwbIDQ.exe
  C:\Windows\System\IkwbIDQ.exe
  2⤵
  PID:3160
- C:\Windows\System\ZzuImcp.exe
  C:\Windows\System\ZzuImcp.exe
  2⤵
  PID:3180
- C:\Windows\System\sJKdWFB.exe
  C:\Windows\System\sJKdWFB.exe
  2⤵
  PID:3200
- C:\Windows\System\aicKmvB.exe
  C:\Windows\System\aicKmvB.exe
  2⤵
  PID:3220
- C:\Windows\System\LisViWX.exe
  C:\Windows\System\LisViWX.exe
  2⤵
  PID:3244
- C:\Windows\System\JoykcXF.exe
  C:\Windows\System\JoykcXF.exe
  2⤵
  PID:3264
- C:\Windows\System\KzKMnXl.exe
  C:\Windows\System\KzKMnXl.exe
  2⤵
  PID:3284
- C:\Windows\System\yoUkAce.exe
  C:\Windows\System\yoUkAce.exe
  2⤵
  PID:3304
- C:\Windows\System\hzvEvuF.exe
  C:\Windows\System\hzvEvuF.exe
  2⤵
  PID:3320
- C:\Windows\System\HFkOZKW.exe
  C:\Windows\System\HFkOZKW.exe
  2⤵
  PID:3344
- C:\Windows\System\lMfCBhL.exe
  C:\Windows\System\lMfCBhL.exe
  2⤵
  PID:3360
- C:\Windows\System\QXJBkmo.exe
  C:\Windows\System\QXJBkmo.exe
  2⤵
  PID:3384
- C:\Windows\System\sXjhmfn.exe
  C:\Windows\System\sXjhmfn.exe
  2⤵
  PID:3400
- C:\Windows\System\zfuSUHS.exe
  C:\Windows\System\zfuSUHS.exe
  2⤵
  PID:3424
- C:\Windows\System\mUIcaLn.exe
  C:\Windows\System\mUIcaLn.exe
  2⤵
  PID:3440
- C:\Windows\System\OieNGmx.exe
  C:\Windows\System\OieNGmx.exe
  2⤵
  PID:3464
- C:\Windows\System\zjWZJlX.exe
  C:\Windows\System\zjWZJlX.exe
  2⤵
  PID:3480
- C:\Windows\System\mckNidC.exe
  C:\Windows\System\mckNidC.exe
  2⤵
  PID:3504
- C:\Windows\System\aXBLKxd.exe
  C:\Windows\System\aXBLKxd.exe
  2⤵
  PID:3520
- C:\Windows\System\hjQNYjr.exe
  C:\Windows\System\hjQNYjr.exe
  2⤵
  PID:3544
- C:\Windows\System\ocJTuvJ.exe
  C:\Windows\System\ocJTuvJ.exe
  2⤵
  PID:3560
- C:\Windows\System\GEBLDKX.exe
  C:\Windows\System\GEBLDKX.exe
  2⤵
  PID:3584
- C:\Windows\System\lzkWzAj.exe
  C:\Windows\System\lzkWzAj.exe
  2⤵
  PID:3600
- C:\Windows\System\ItqUNwa.exe
  C:\Windows\System\ItqUNwa.exe
  2⤵
  PID:3624
- C:\Windows\System\ifyPRpo.exe
  C:\Windows\System\ifyPRpo.exe
  2⤵
  PID:3644
- C:\Windows\System\xXOLChY.exe
  C:\Windows\System\xXOLChY.exe
  2⤵
  PID:3664
- C:\Windows\System\EpMCIcg.exe
  C:\Windows\System\EpMCIcg.exe
  2⤵
  PID:3684
- C:\Windows\System\DGbkapR.exe
  C:\Windows\System\DGbkapR.exe
  2⤵
  PID:3704
- C:\Windows\System\NulkctI.exe
  C:\Windows\System\NulkctI.exe
  2⤵
  PID:3724
- C:\Windows\System\MmabxfI.exe
  C:\Windows\System\MmabxfI.exe
  2⤵
  PID:3744
- C:\Windows\System\IkDmvvu.exe
  C:\Windows\System\IkDmvvu.exe
  2⤵
  PID:3764
- C:\Windows\System\ELGnsnQ.exe
  C:\Windows\System\ELGnsnQ.exe
  2⤵
  PID:3788
- C:\Windows\System\yBHbWdQ.exe
  C:\Windows\System\yBHbWdQ.exe
  2⤵
  PID:3808
- C:\Windows\System\nmpGfzV.exe
  C:\Windows\System\nmpGfzV.exe
  2⤵
  PID:3828
- C:\Windows\System\RqbFpPg.exe
  C:\Windows\System\RqbFpPg.exe
  2⤵
  PID:3848
- C:\Windows\System\FEIcrRU.exe
  C:\Windows\System\FEIcrRU.exe
  2⤵
  PID:3868
- C:\Windows\System\VqslGBD.exe
  C:\Windows\System\VqslGBD.exe
  2⤵
  PID:3888
- C:\Windows\System\ppVBPyl.exe
  C:\Windows\System\ppVBPyl.exe
  2⤵
  PID:3908
- C:\Windows\System\PoUUEPI.exe
  C:\Windows\System\PoUUEPI.exe
  2⤵
  PID:3928
- C:\Windows\System\LQvFMgD.exe
  C:\Windows\System\LQvFMgD.exe
  2⤵
  PID:3948
- C:\Windows\System\oVmAXij.exe
  C:\Windows\System\oVmAXij.exe
  2⤵
  PID:3968
- C:\Windows\System\PadZHFJ.exe
  C:\Windows\System\PadZHFJ.exe
  2⤵
  PID:3988
- C:\Windows\System\BisxGYz.exe
  C:\Windows\System\BisxGYz.exe
  2⤵
  PID:4008
- C:\Windows\System\sCkoXlR.exe
  C:\Windows\System\sCkoXlR.exe
  2⤵
  PID:4028
- C:\Windows\System\xVlIsjI.exe
  C:\Windows\System\xVlIsjI.exe
  2⤵
  PID:4044
- C:\Windows\System\UvaRhvt.exe
  C:\Windows\System\UvaRhvt.exe
  2⤵
  PID:4068
- C:\Windows\System\HfOtxSg.exe
  C:\Windows\System\HfOtxSg.exe
  2⤵
  PID:4084
- C:\Windows\System\NnaJbTm.exe
  C:\Windows\System\NnaJbTm.exe
  2⤵
  PID:2316
- C:\Windows\System\AekLknW.exe
  C:\Windows\System\AekLknW.exe
  2⤵
  PID:1124
- C:\Windows\System\FzDXbxn.exe
  C:\Windows\System\FzDXbxn.exe
  2⤵
  PID:2788
- C:\Windows\System\uSnaHrv.exe
  C:\Windows\System\uSnaHrv.exe
  2⤵
  PID:2528
- C:\Windows\System\UamHYYQ.exe
  C:\Windows\System\UamHYYQ.exe
  2⤵
  PID:344
- C:\Windows\System\uGxNwhw.exe
  C:\Windows\System\uGxNwhw.exe
  2⤵
  PID:2296
- C:\Windows\System\aplwdnZ.exe
  C:\Windows\System\aplwdnZ.exe
  2⤵
  PID:2308
- C:\Windows\System\HybnHHA.exe
  C:\Windows\System\HybnHHA.exe
  2⤵
  PID:2608
- C:\Windows\System\xcQBgZl.exe
  C:\Windows\System\xcQBgZl.exe
  2⤵
  PID:1048
- C:\Windows\System\AWVLjYi.exe
  C:\Windows\System\AWVLjYi.exe
  2⤵
  PID:3092
- C:\Windows\System\eLfwcUQ.exe
  C:\Windows\System\eLfwcUQ.exe
  2⤵
  PID:3128
- C:\Windows\System\GXKIKPh.exe
  C:\Windows\System\GXKIKPh.exe
  2⤵
  PID:3116
- C:\Windows\System\jCfzRdW.exe
  C:\Windows\System\jCfzRdW.exe
  2⤵
  PID:3152
- C:\Windows\System\GjVVwYI.exe
  C:\Windows\System\GjVVwYI.exe
  2⤵
  PID:3192
- C:\Windows\System\QsqaoRz.exe
  C:\Windows\System\QsqaoRz.exe
  2⤵
  PID:3228
- C:\Windows\System\AJbWbBa.exe
  C:\Windows\System\AJbWbBa.exe
  2⤵
  PID:3232
- C:\Windows\System\dCDiWfN.exe
  C:\Windows\System\dCDiWfN.exe
  2⤵
  PID:3332
- C:\Windows\System\zEazXsB.exe
  C:\Windows\System\zEazXsB.exe
  2⤵
  PID:3312
- C:\Windows\System\QHdRxWz.exe
  C:\Windows\System\QHdRxWz.exe
  2⤵
  PID:3352
- C:\Windows\System\kCqJCoT.exe
  C:\Windows\System\kCqJCoT.exe
  2⤵
  PID:3012
- C:\Windows\System\tencZGv.exe
  C:\Windows\System\tencZGv.exe
  2⤵
  PID:3416
- C:\Windows\System\tPwdpfb.exe
  C:\Windows\System\tPwdpfb.exe
  2⤵
  PID:3432
- C:\Windows\System\UcoBOym.exe
  C:\Windows\System\UcoBOym.exe
  2⤵
  PID:3476
- C:\Windows\System\BQcgDli.exe
  C:\Windows\System\BQcgDli.exe
  2⤵
  PID:3532
- C:\Windows\System\bxAItBg.exe
  C:\Windows\System\bxAItBg.exe
  2⤵
  PID:3568
- C:\Windows\System\rTOIzsL.exe
  C:\Windows\System\rTOIzsL.exe
  2⤵
  PID:3576
- C:\Windows\System\HdgKPRK.exe
  C:\Windows\System\HdgKPRK.exe
  2⤵
  PID:3596
- C:\Windows\System\JuPGsnB.exe
  C:\Windows\System\JuPGsnB.exe
  2⤵
  PID:3652
- C:\Windows\System\YAMnYvP.exe
  C:\Windows\System\YAMnYvP.exe
  2⤵
  PID:3680
- C:\Windows\System\yRXlrun.exe
  C:\Windows\System\yRXlrun.exe
  2⤵
  PID:3700
- C:\Windows\System\xvfsfsy.exe
  C:\Windows\System\xvfsfsy.exe
  2⤵
  PID:3736
- C:\Windows\System\sNMgAeq.exe
  C:\Windows\System\sNMgAeq.exe
  2⤵
  PID:3760
- C:\Windows\System\zUGYsGT.exe
  C:\Windows\System\zUGYsGT.exe
  2⤵
  PID:3804
- C:\Windows\System\CPdNxkZ.exe
  C:\Windows\System\CPdNxkZ.exe
  2⤵
  PID:3860
- C:\Windows\System\OBpMXqH.exe
  C:\Windows\System\OBpMXqH.exe
  2⤵
  PID:3900
- C:\Windows\System\jOiGoEB.exe
  C:\Windows\System\jOiGoEB.exe
  2⤵
  PID:3936
- C:\Windows\System\XYZjkNy.exe
  C:\Windows\System\XYZjkNy.exe
  2⤵
  PID:3956
- C:\Windows\System\OSTJIIu.exe
  C:\Windows\System\OSTJIIu.exe
  2⤵
  PID:3960
- C:\Windows\System\wHQZhvh.exe
  C:\Windows\System\wHQZhvh.exe
  2⤵
  PID:2180
- C:\Windows\System\ryaFiXh.exe
  C:\Windows\System\ryaFiXh.exe
  2⤵
  PID:4004
- C:\Windows\System\wKBpxEA.exe
  C:\Windows\System\wKBpxEA.exe
  2⤵
  PID:4036
- C:\Windows\System\lbUYjeV.exe
  C:\Windows\System\lbUYjeV.exe
  2⤵
  PID:4092
- C:\Windows\System\SiRqqCj.exe
  C:\Windows\System\SiRqqCj.exe
  2⤵
  PID:4080
- C:\Windows\System\bAVHKRv.exe
  C:\Windows\System\bAVHKRv.exe
  2⤵
  PID:2160
- C:\Windows\System\pNuBekE.exe
  C:\Windows\System\pNuBekE.exe
  2⤵
  PID:2716
- C:\Windows\System\YWUuqof.exe
  C:\Windows\System\YWUuqof.exe
  2⤵
  PID:1980
- C:\Windows\System\jPdGKLu.exe
  C:\Windows\System\jPdGKLu.exe
  2⤵
  PID:1572
- C:\Windows\System\JqmUQvd.exe
  C:\Windows\System\JqmUQvd.exe
  2⤵
  PID:1052
- C:\Windows\System\ygdOdQN.exe
  C:\Windows\System\ygdOdQN.exe
  2⤵
  PID:1828
- C:\Windows\System\nKNtYki.exe
  C:\Windows\System\nKNtYki.exe
  2⤵
  PID:3148
- C:\Windows\System\ZUZhfQm.exe
  C:\Windows\System\ZUZhfQm.exe
  2⤵
  PID:3216
- C:\Windows\System\YpJIGZZ.exe
  C:\Windows\System\YpJIGZZ.exe
  2⤵
  PID:3032
- C:\Windows\System\WJUwqvQ.exe
  C:\Windows\System\WJUwqvQ.exe
  2⤵
  PID:2372
- C:\Windows\System\grAKXbP.exe
  C:\Windows\System\grAKXbP.exe
  2⤵
  PID:1308
- C:\Windows\System\uyXkwPE.exe
  C:\Windows\System\uyXkwPE.exe
  2⤵
  PID:3292
- C:\Windows\System\qfhDFVN.exe
  C:\Windows\System\qfhDFVN.exe
  2⤵
  PID:856
- C:\Windows\System\nnNAVtj.exe
  C:\Windows\System\nnNAVtj.exe
  2⤵
  PID:3276
- C:\Windows\System\SkQPgfB.exe
  C:\Windows\System\SkQPgfB.exe
  2⤵
  PID:3392
- C:\Windows\System\cSVpwGO.exe
  C:\Windows\System\cSVpwGO.exe
  2⤵
  PID:3472
- C:\Windows\System\hYkmrCK.exe
  C:\Windows\System\hYkmrCK.exe
  2⤵
  PID:2580
- C:\Windows\System\IVexAKj.exe
  C:\Windows\System\IVexAKj.exe
  2⤵
  PID:3452
- C:\Windows\System\GpXmtZf.exe
  C:\Windows\System\GpXmtZf.exe
  2⤵
  PID:1488
- C:\Windows\System\XKZHuvk.exe
  C:\Windows\System\XKZHuvk.exe
  2⤵
  PID:3528
- C:\Windows\System\opGHCIN.exe
  C:\Windows\System\opGHCIN.exe
  2⤵
  PID:3672
- C:\Windows\System\HVmxAHF.exe
  C:\Windows\System\HVmxAHF.exe
  2⤵
  PID:496
- C:\Windows\System\FfQEnga.exe
  C:\Windows\System\FfQEnga.exe
  2⤵
  PID:1160
- C:\Windows\System\ojdkwWW.exe
  C:\Windows\System\ojdkwWW.exe
  2⤵
  PID:3800
- C:\Windows\System\qLnYZxe.exe
  C:\Windows\System\qLnYZxe.exe
  2⤵
  PID:3820
- C:\Windows\System\RgEGMoC.exe
  C:\Windows\System\RgEGMoC.exe
  2⤵
  PID:3896
- C:\Windows\System\uQmnhnL.exe
  C:\Windows\System\uQmnhnL.exe
  2⤵
  PID:3876
- C:\Windows\System\MeemDKJ.exe
  C:\Windows\System\MeemDKJ.exe
  2⤵
  PID:3944
- C:\Windows\System\BEkNMud.exe
  C:\Windows\System\BEkNMud.exe
  2⤵
  PID:1608
- C:\Windows\System\cWOoMgy.exe
  C:\Windows\System\cWOoMgy.exe
  2⤵
  PID:2012
- C:\Windows\System\kOanpsP.exe
  C:\Windows\System\kOanpsP.exe
  2⤵
  PID:4040
- C:\Windows\System\BaqMoaY.exe
  C:\Windows\System\BaqMoaY.exe
  2⤵
  PID:3996
- C:\Windows\System\eWXKqpS.exe
  C:\Windows\System\eWXKqpS.exe
  2⤵
  PID:760
- C:\Windows\System\yRFQhrt.exe
  C:\Windows\System\yRFQhrt.exe
  2⤵
  PID:2764
- C:\Windows\System\wllpmTt.exe
  C:\Windows\System\wllpmTt.exe
  2⤵
  PID:1724
- C:\Windows\System\YYgEPBd.exe
  C:\Windows\System\YYgEPBd.exe
  2⤵
  PID:1924
- C:\Windows\System\XUYqubz.exe
  C:\Windows\System\XUYqubz.exe
  2⤵
  PID:1324
- C:\Windows\System\oblxFFc.exe
  C:\Windows\System\oblxFFc.exe
  2⤵
  PID:2664
- C:\Windows\System\SfxGgRE.exe
  C:\Windows\System\SfxGgRE.exe
  2⤵
  PID:3500
- C:\Windows\System\dSXrxRi.exe
  C:\Windows\System\dSXrxRi.exe
  2⤵
  PID:3188
- C:\Windows\System\GPqTPhW.exe
  C:\Windows\System\GPqTPhW.exe
  2⤵
  PID:2804
- C:\Windows\System\YNYBgeJ.exe
  C:\Windows\System\YNYBgeJ.exe
  2⤵
  PID:892
- C:\Windows\System\aUASIuw.exe
  C:\Windows\System\aUASIuw.exe
  2⤵
  PID:3296
- C:\Windows\System\fGrumtC.exe
  C:\Windows\System\fGrumtC.exe
  2⤵
  PID:2932
- C:\Windows\System\IyTbJHK.exe
  C:\Windows\System\IyTbJHK.exe
  2⤵
  PID:3376
- C:\Windows\System\zSfieob.exe
  C:\Windows\System\zSfieob.exe
  2⤵
  PID:352
- C:\Windows\System\VdHzVNp.exe
  C:\Windows\System\VdHzVNp.exe
  2⤵
  PID:880
- C:\Windows\System\RCbODfb.exe
  C:\Windows\System\RCbODfb.exe
  2⤵
  PID:3580
- C:\Windows\System\vlvEjWl.exe
  C:\Windows\System\vlvEjWl.exe
  2⤵
  PID:3732
- C:\Windows\System\gvhEeAt.exe
  C:\Windows\System\gvhEeAt.exe
  2⤵
  PID:3696
- C:\Windows\System\ujjVEcx.exe
  C:\Windows\System\ujjVEcx.exe
  2⤵
  PID:2796
- C:\Windows\System\YZRFOpN.exe
  C:\Windows\System\YZRFOpN.exe
  2⤵
  PID:2280
- C:\Windows\System\jYREgiF.exe
  C:\Windows\System\jYREgiF.exe
  2⤵
  PID:2832
- C:\Windows\System\mSKpzAf.exe
  C:\Windows\System\mSKpzAf.exe
  2⤵
  PID:584
- C:\Windows\System\pFmUCDf.exe
  C:\Windows\System\pFmUCDf.exe
  2⤵
  PID:3904
- C:\Windows\System\XvUkMWZ.exe
  C:\Windows\System\XvUkMWZ.exe
  2⤵
  PID:2604
- C:\Windows\System\qNsyGOX.exe
  C:\Windows\System\qNsyGOX.exe
  2⤵
  PID:3240
- C:\Windows\System\iOfsDHi.exe
  C:\Windows\System\iOfsDHi.exe
  2⤵
  PID:1132
- C:\Windows\System\bsbbsCR.exe
  C:\Windows\System\bsbbsCR.exe
  2⤵
  PID:1944
- C:\Windows\System\gxBtWEA.exe
  C:\Windows\System\gxBtWEA.exe
  2⤵
  PID:2752
- C:\Windows\System\qHBecaq.exe
  C:\Windows\System\qHBecaq.exe
  2⤵
  PID:2364
- C:\Windows\System\GutDiCP.exe
  C:\Windows\System\GutDiCP.exe
  2⤵
  PID:808
- C:\Windows\System\UqTbinN.exe
  C:\Windows\System\UqTbinN.exe
  2⤵
  PID:3328
- C:\Windows\System\iuPaQtQ.exe
  C:\Windows\System\iuPaQtQ.exe
  2⤵
  PID:2912
- C:\Windows\System\wQZqSEd.exe
  C:\Windows\System\wQZqSEd.exe
  2⤵
  PID:3536
- C:\Windows\System\dqUVjWy.exe
  C:\Windows\System\dqUVjWy.exe
  2⤵
  PID:1400
- C:\Windows\System\euaUMyj.exe
  C:\Windows\System\euaUMyj.exe
  2⤵
  PID:3556
- C:\Windows\System\fGJIqrw.exe
  C:\Windows\System\fGJIqrw.exe
  2⤵
  PID:2412
- C:\Windows\System\OWXFfnE.exe
  C:\Windows\System\OWXFfnE.exe
  2⤵
  PID:1264
- C:\Windows\System\fJTWOPV.exe
  C:\Windows\System\fJTWOPV.exe
  2⤵
  PID:2844
- C:\Windows\System\IKFGUvU.exe
  C:\Windows\System\IKFGUvU.exe
  2⤵
  PID:3512
- C:\Windows\System\FKhVTmk.exe
  C:\Windows\System\FKhVTmk.exe
  2⤵
  PID:2452
- C:\Windows\System\GwyFDhr.exe
  C:\Windows\System\GwyFDhr.exe
  2⤵
  PID:2284
- C:\Windows\System\DlaWQZk.exe
  C:\Windows\System\DlaWQZk.exe
  2⤵
  PID:796
- C:\Windows\System\LwgDoDq.exe
  C:\Windows\System\LwgDoDq.exe
  2⤵
  PID:3660
- C:\Windows\System\HhkODwW.exe
  C:\Windows\System\HhkODwW.exe
  2⤵
  PID:2496
- C:\Windows\System\mVLitfZ.exe
  C:\Windows\System\mVLitfZ.exe
  2⤵
  PID:3844
- C:\Windows\System\imKIDXx.exe
  C:\Windows\System\imKIDXx.exe
  2⤵
  PID:4060
- C:\Windows\System\gZTGHxq.exe
  C:\Windows\System\gZTGHxq.exe
  2⤵
  PID:2924
- C:\Windows\System\HrgaaQY.exe
  C:\Windows\System\HrgaaQY.exe
  2⤵
  PID:1808
- C:\Windows\System\djssETD.exe
  C:\Windows\System\djssETD.exe
  2⤵
  PID:1688
- C:\Windows\System\RjyqoYg.exe
  C:\Windows\System\RjyqoYg.exe
  2⤵
  PID:828
- C:\Windows\System\CepNumQ.exe
  C:\Windows\System\CepNumQ.exe
  2⤵
  PID:2228
- C:\Windows\System\iYqHeIT.exe
  C:\Windows\System\iYqHeIT.exe
  2⤵
  PID:3796
- C:\Windows\System\uBhYyiu.exe
  C:\Windows\System\uBhYyiu.exe
  2⤵
  PID:3336
- C:\Windows\System\LDxiKmF.exe
  C:\Windows\System\LDxiKmF.exe
  2⤵
  PID:2884
- C:\Windows\System\TupUMtK.exe
  C:\Windows\System\TupUMtK.exe
  2⤵
  PID:2132
- C:\Windows\System\xPDHKZT.exe
  C:\Windows\System\xPDHKZT.exe
  2⤵
  PID:2520
- C:\Windows\System\hUaSsyu.exe
  C:\Windows\System\hUaSsyu.exe
  2⤵
  PID:3884
- C:\Windows\System\DDrMWEz.exe
  C:\Windows\System\DDrMWEz.exe
  2⤵
  PID:1780
- C:\Windows\System\caCWfme.exe
  C:\Windows\System\caCWfme.exe
  2⤵
  PID:3784
- C:\Windows\System\dsQMXpR.exe
  C:\Windows\System\dsQMXpR.exe
  2⤵
  PID:4104
- C:\Windows\System\ogmGHpi.exe
  C:\Windows\System\ogmGHpi.exe
  2⤵
  PID:4120
- C:\Windows\System\adXwxdo.exe
  C:\Windows\System\adXwxdo.exe
  2⤵
  PID:4172
- C:\Windows\System\rPraiZj.exe
  C:\Windows\System\rPraiZj.exe
  2⤵
  PID:4196
- C:\Windows\System\mGsUzid.exe
  C:\Windows\System\mGsUzid.exe
  2⤵
  PID:4232
- C:\Windows\System\BtIlsxw.exe
  C:\Windows\System\BtIlsxw.exe
  2⤵
  PID:4256
- C:\Windows\System\uNxLQFE.exe
  C:\Windows\System\uNxLQFE.exe
  2⤵
  PID:4280
- C:\Windows\System\hDFPgAx.exe
  C:\Windows\System\hDFPgAx.exe
  2⤵
  PID:4320
- C:\Windows\System\RKjqUJP.exe
  C:\Windows\System\RKjqUJP.exe
  2⤵
  PID:4336
- C:\Windows\System\aBuBdFU.exe
  C:\Windows\System\aBuBdFU.exe
  2⤵
  PID:4356
- C:\Windows\System\yQUalak.exe
  C:\Windows\System\yQUalak.exe
  2⤵
  PID:4396
- C:\Windows\System\CniEUOY.exe
  C:\Windows\System\CniEUOY.exe
  2⤵
  PID:4416
- C:\Windows\System\duwaKvX.exe
  C:\Windows\System\duwaKvX.exe
  2⤵
  PID:4432
- C:\Windows\System\zYVatwP.exe
  C:\Windows\System\zYVatwP.exe
  2⤵
  PID:4448
- C:\Windows\System\HGmthPG.exe
  C:\Windows\System\HGmthPG.exe
  2⤵
  PID:4464
- C:\Windows\System\KVUxIPQ.exe
  C:\Windows\System\KVUxIPQ.exe
  2⤵
  PID:4480
- C:\Windows\System\TadVVsW.exe
  C:\Windows\System\TadVVsW.exe
  2⤵
  PID:4512
- C:\Windows\System\QrwVuRa.exe
  C:\Windows\System\QrwVuRa.exe
  2⤵
  PID:4528
- C:\Windows\System\xDmUgGA.exe
  C:\Windows\System\xDmUgGA.exe
  2⤵
  PID:4548
- C:\Windows\System\IhVwKTW.exe
  C:\Windows\System\IhVwKTW.exe
  2⤵
  PID:4572
- C:\Windows\System\OHXATSG.exe
  C:\Windows\System\OHXATSG.exe
  2⤵
  PID:4592
- C:\Windows\System\HzmyiwX.exe
  C:\Windows\System\HzmyiwX.exe
  2⤵
  PID:4608
- C:\Windows\System\hEQsOpu.exe
  C:\Windows\System\hEQsOpu.exe
  2⤵
  PID:4632
- C:\Windows\System\CFXblrp.exe
  C:\Windows\System\CFXblrp.exe
  2⤵
  PID:4648
- C:\Windows\System\ASNNmmI.exe
  C:\Windows\System\ASNNmmI.exe
  2⤵
  PID:4664
- C:\Windows\System\rVJKbWY.exe
  C:\Windows\System\rVJKbWY.exe
  2⤵
  PID:4708
- C:\Windows\System\IIpLzgw.exe
  C:\Windows\System\IIpLzgw.exe
  2⤵
  PID:4724
- C:\Windows\System\BZoOvOA.exe
  C:\Windows\System\BZoOvOA.exe
  2⤵
  PID:4740
- C:\Windows\System\cNIpWEI.exe
  C:\Windows\System\cNIpWEI.exe
  2⤵
  PID:4756
- C:\Windows\System\sYZXtiT.exe
  C:\Windows\System\sYZXtiT.exe
  2⤵
  PID:4788
- C:\Windows\System\yfzbJNZ.exe
  C:\Windows\System\yfzbJNZ.exe
  2⤵
  PID:4812
- C:\Windows\System\eqgLUXy.exe
  C:\Windows\System\eqgLUXy.exe
  2⤵
  PID:4828
- C:\Windows\System\AcMwZla.exe
  C:\Windows\System\AcMwZla.exe
  2⤵
  PID:4844
- C:\Windows\System\lannApr.exe
  C:\Windows\System\lannApr.exe
  2⤵
  PID:4860
- C:\Windows\System\bjERrCt.exe
  C:\Windows\System\bjERrCt.exe
  2⤵
  PID:4876
- C:\Windows\System\QezOFIZ.exe
  C:\Windows\System\QezOFIZ.exe
  2⤵
  PID:4892
- C:\Windows\System\VCtbyaG.exe
  C:\Windows\System\VCtbyaG.exe
  2⤵
  PID:4908
- C:\Windows\System\xfuNJZQ.exe
  C:\Windows\System\xfuNJZQ.exe
  2⤵
  PID:4928
- C:\Windows\System\RKGUMwR.exe
  C:\Windows\System\RKGUMwR.exe
  2⤵
  PID:4944
- C:\Windows\System\CvzsyXd.exe
  C:\Windows\System\CvzsyXd.exe
  2⤵
  PID:4960
- C:\Windows\System\MnEhBPO.exe
  C:\Windows\System\MnEhBPO.exe
  2⤵
  PID:4976
- C:\Windows\System\sxqNMTO.exe
  C:\Windows\System\sxqNMTO.exe
  2⤵
  PID:4996
- C:\Windows\System\iCOQYBx.exe
  C:\Windows\System\iCOQYBx.exe
  2⤵
  PID:5056
- C:\Windows\System\TrzFnqN.exe
  C:\Windows\System\TrzFnqN.exe
  2⤵
  PID:5076
- C:\Windows\System\EsAzYzM.exe
  C:\Windows\System\EsAzYzM.exe
  2⤵
  PID:5092
- C:\Windows\System\jvryNvL.exe
  C:\Windows\System\jvryNvL.exe
  2⤵
  PID:5108
- C:\Windows\System\xghoAXr.exe
  C:\Windows\System\xghoAXr.exe
  2⤵
  PID:3088
- C:\Windows\System\AtnuKFW.exe
  C:\Windows\System\AtnuKFW.exe
  2⤵
  PID:4100
- C:\Windows\System\tuqDeFM.exe
  C:\Windows\System\tuqDeFM.exe
  2⤵
  PID:4116
- C:\Windows\System\qMOzHNJ.exe
  C:\Windows\System\qMOzHNJ.exe
  2⤵
  PID:1044
- C:\Windows\System\oxTdFIB.exe
  C:\Windows\System\oxTdFIB.exe
  2⤵
  PID:4144
- C:\Windows\System\zMcLGbP.exe
  C:\Windows\System\zMcLGbP.exe
  2⤵
  PID:4168
- C:\Windows\System\dgjcgVs.exe
  C:\Windows\System\dgjcgVs.exe
  2⤵
  PID:4192
- C:\Windows\System\nZLGCpN.exe
  C:\Windows\System\nZLGCpN.exe
  2⤵
  PID:4248
- C:\Windows\System\SQPGudK.exe
  C:\Windows\System\SQPGudK.exe
  2⤵
  PID:4264
- C:\Windows\System\ROuFwsT.exe
  C:\Windows\System\ROuFwsT.exe
  2⤵
  PID:4268
- C:\Windows\System\mMdXshS.exe
  C:\Windows\System\mMdXshS.exe
  2⤵
  PID:4304
- C:\Windows\System\oPJoMkz.exe
  C:\Windows\System\oPJoMkz.exe
  2⤵
  PID:4328
- C:\Windows\System\eZYVEYr.exe
  C:\Windows\System\eZYVEYr.exe
  2⤵
  PID:4344
- C:\Windows\System\NQgAcCd.exe
  C:\Windows\System\NQgAcCd.exe
  2⤵
  PID:4376
- C:\Windows\System\tDsXoeF.exe
  C:\Windows\System\tDsXoeF.exe
  2⤵
  PID:4428
- C:\Windows\System\epBefFt.exe
  C:\Windows\System\epBefFt.exe
  2⤵
  PID:4460
- C:\Windows\System\ghvWQso.exe
  C:\Windows\System\ghvWQso.exe
  2⤵
  PID:4472
- C:\Windows\System\VoPGNUE.exe
  C:\Windows\System\VoPGNUE.exe
  2⤵
  PID:4412
- C:\Windows\System\jZzViFB.exe
  C:\Windows\System\jZzViFB.exe
  2⤵
  PID:4520
- C:\Windows\System\kyWOVxD.exe
  C:\Windows\System\kyWOVxD.exe
  2⤵
  PID:4540
- C:\Windows\System\OArqjkh.exe
  C:\Windows\System\OArqjkh.exe
  2⤵
  PID:4564
- C:\Windows\System\vDLkGqH.exe
  C:\Windows\System\vDLkGqH.exe
  2⤵
  PID:4616
- C:\Windows\System\iuWeUMo.exe
  C:\Windows\System\iuWeUMo.exe
  2⤵
  PID:4656
- C:\Windows\System\rpkVuwc.exe
  C:\Windows\System\rpkVuwc.exe
  2⤵
  PID:4680
- C:\Windows\System\eorSqnq.exe
  C:\Windows\System\eorSqnq.exe
  2⤵
  PID:4720
- C:\Windows\System\MNkxTTp.exe
  C:\Windows\System\MNkxTTp.exe
  2⤵
  PID:4500
- C:\Windows\System\KGgCMNg.exe
  C:\Windows\System\KGgCMNg.exe
  2⤵
  PID:4800
- C:\Windows\System\fxxPJbQ.exe
  C:\Windows\System\fxxPJbQ.exe
  2⤵
  PID:3028
- C:\Windows\System\HeBoVBJ.exe
  C:\Windows\System\HeBoVBJ.exe
  2⤵
  PID:4856
- C:\Windows\System\XCEumrf.exe
  C:\Windows\System\XCEumrf.exe
  2⤵
  PID:5024
- C:\Windows\System\HDBePCW.exe
  C:\Windows\System\HDBePCW.exe
  2⤵
  PID:4956
- C:\Windows\System\bdMaQla.exe
  C:\Windows\System\bdMaQla.exe
  2⤵
  PID:5048
- C:\Windows\System\vtroVHf.exe
  C:\Windows\System\vtroVHf.exe
  2⤵
  PID:4992
- C:\Windows\System\tyHUUic.exe
  C:\Windows\System\tyHUUic.exe
  2⤵
  PID:5088
- C:\Windows\System\fUIwCrq.exe
  C:\Windows\System\fUIwCrq.exe
  2⤵
  PID:4112
- C:\Windows\System\ZhOSVAC.exe
  C:\Windows\System\ZhOSVAC.exe
  2⤵
  PID:2544
- C:\Windows\System\ybVMjxT.exe
  C:\Windows\System\ybVMjxT.exe
  2⤵
  PID:1492
- C:\Windows\System\XfFVuJT.exe
  C:\Windows\System\XfFVuJT.exe
  2⤵
  PID:4220
- C:\Windows\System\ZvFDzYf.exe
  C:\Windows\System\ZvFDzYf.exe
  2⤵
  PID:4292
- C:\Windows\System\Pdllzwm.exe
  C:\Windows\System\Pdllzwm.exe
  2⤵
  PID:4240
- C:\Windows\System\aTUfqHP.exe
  C:\Windows\System\aTUfqHP.exe
  2⤵
  PID:4364
- C:\Windows\System\AYqtDFi.exe
  C:\Windows\System\AYqtDFi.exe
  2⤵
  PID:4408
- C:\Windows\System\EBCxqPy.exe
  C:\Windows\System\EBCxqPy.exe
  2⤵
  PID:4628
- C:\Windows\System\wAecYOO.exe
  C:\Windows\System\wAecYOO.exe
  2⤵
  PID:4160
- C:\Windows\System\wWciMKT.exe
  C:\Windows\System\wWciMKT.exe
  2⤵
  PID:4312
- C:\Windows\System\OnUfCNJ.exe
  C:\Windows\System\OnUfCNJ.exe
  2⤵
  PID:4488
- C:\Windows\System\TffwMpJ.exe
  C:\Windows\System\TffwMpJ.exe
  2⤵
  PID:4524
- C:\Windows\System\sXyypjU.exe
  C:\Windows\System\sXyypjU.exe
  2⤵
  PID:4644
- C:\Windows\System\aNQqunY.exe
  C:\Windows\System\aNQqunY.exe
  2⤵
  PID:4672
- C:\Windows\System\wIYPECA.exe
  C:\Windows\System\wIYPECA.exe
  2⤵
  PID:4704
- C:\Windows\System\UOkbPDP.exe
  C:\Windows\System\UOkbPDP.exe
  2⤵
  PID:4804
- C:\Windows\System\hPaXDsf.exe
  C:\Windows\System\hPaXDsf.exe
  2⤵
  PID:4768
- C:\Windows\System\XEmVBQg.exe
  C:\Windows\System\XEmVBQg.exe
  2⤵
  PID:4840
- C:\Windows\System\NNmACAJ.exe
  C:\Windows\System\NNmACAJ.exe
  2⤵
  PID:4968
- C:\Windows\System\OKbRxJz.exe
  C:\Windows\System\OKbRxJz.exe
  2⤵
  PID:4888
- C:\Windows\System\kPyyStc.exe
  C:\Windows\System\kPyyStc.exe
  2⤵
  PID:5008
- C:\Windows\System\BUrSfXr.exe
  C:\Windows\System\BUrSfXr.exe
  2⤵
  PID:5044
- C:\Windows\System\AXUpelJ.exe
  C:\Windows\System\AXUpelJ.exe
  2⤵
  PID:4560
- C:\Windows\System\xqLRqPD.exe
  C:\Windows\System\xqLRqPD.exe
  2⤵
  PID:4140
- C:\Windows\System\OiqdQzd.exe
  C:\Windows\System\OiqdQzd.exe
  2⤵
  PID:4384
- C:\Windows\System\gLvmPpY.exe
  C:\Windows\System\gLvmPpY.exe
  2⤵
  PID:5032
- C:\Windows\System\iLyktxG.exe
  C:\Windows\System\iLyktxG.exe
  2⤵
  PID:5104
- C:\Windows\System\yifOOBJ.exe
  C:\Windows\System\yifOOBJ.exe
  2⤵
  PID:5068
- C:\Windows\System\iugNQEp.exe
  C:\Windows\System\iugNQEp.exe
  2⤵
  PID:4496
- C:\Windows\System\XQSJvpG.exe
  C:\Windows\System\XQSJvpG.exe
  2⤵
  PID:4204
- C:\Windows\System\UiKORdX.exe
  C:\Windows\System\UiKORdX.exe
  2⤵
  PID:4388
- C:\Windows\System\QtujmeR.exe
  C:\Windows\System\QtujmeR.exe
  2⤵
  PID:4372
- C:\Windows\System\nukEoAo.exe
  C:\Windows\System\nukEoAo.exe
  2⤵
  PID:4936
- C:\Windows\System\oErTQOS.exe
  C:\Windows\System\oErTQOS.exe
  2⤵
  PID:5012
- C:\Windows\System\jJboepQ.exe
  C:\Windows\System\jJboepQ.exe
  2⤵
  PID:4604
- C:\Windows\System\WBaMnLV.exe
  C:\Windows\System\WBaMnLV.exe
  2⤵
  PID:4424
- C:\Windows\System\rYKGBCl.exe
  C:\Windows\System\rYKGBCl.exe
  2⤵
  PID:5084
- C:\Windows\System\TqOZyzL.exe
  C:\Windows\System\TqOZyzL.exe
  2⤵
  PID:5132
- C:\Windows\System\eiTXDBz.exe
  C:\Windows\System\eiTXDBz.exe
  2⤵
  PID:5148
- C:\Windows\System\udJmpWE.exe
  C:\Windows\System\udJmpWE.exe
  2⤵
  PID:5164
- C:\Windows\System\PzXzBaP.exe
  C:\Windows\System\PzXzBaP.exe
  2⤵
  PID:5180
- C:\Windows\System\kzvYnPH.exe
  C:\Windows\System\kzvYnPH.exe
  2⤵
  PID:5200
- C:\Windows\System\EPVHivg.exe
  C:\Windows\System\EPVHivg.exe
  2⤵
  PID:5216
- C:\Windows\System\DbVIzFF.exe
  C:\Windows\System\DbVIzFF.exe
  2⤵
  PID:5232
- C:\Windows\System\GWULXuV.exe
  C:\Windows\System\GWULXuV.exe
  2⤵
  PID:5248
- C:\Windows\System\XYqeTYF.exe
  C:\Windows\System\XYqeTYF.exe
  2⤵
  PID:5268
- C:\Windows\System\smyXIAr.exe
  C:\Windows\System\smyXIAr.exe
  2⤵
  PID:5284
- C:\Windows\System\ScwNLAQ.exe
  C:\Windows\System\ScwNLAQ.exe
  2⤵
  PID:5300
- C:\Windows\System\kKsqhwj.exe
  C:\Windows\System\kKsqhwj.exe
  2⤵
  PID:5320
- C:\Windows\System\lDggtyu.exe
  C:\Windows\System\lDggtyu.exe
  2⤵
  PID:5336
- C:\Windows\System\QRodhDG.exe
  C:\Windows\System\QRodhDG.exe
  2⤵
  PID:5352
- C:\Windows\System\NOgtFgh.exe
  C:\Windows\System\NOgtFgh.exe
  2⤵
  PID:5444
- C:\Windows\System\LgTrdAx.exe
  C:\Windows\System\LgTrdAx.exe
  2⤵
  PID:5476
- C:\Windows\System\HNOsuac.exe
  C:\Windows\System\HNOsuac.exe
  2⤵
  PID:5492
- C:\Windows\System\eUXhHsM.exe
  C:\Windows\System\eUXhHsM.exe
  2⤵
  PID:5508
- C:\Windows\System\PcaaGVN.exe
  C:\Windows\System\PcaaGVN.exe
  2⤵
  PID:5524
- C:\Windows\System\sjagNVc.exe
  C:\Windows\System\sjagNVc.exe
  2⤵
  PID:5544
- C:\Windows\System\izjWmlx.exe
  C:\Windows\System\izjWmlx.exe
  2⤵
  PID:5560
- C:\Windows\System\EjcKzgm.exe
  C:\Windows\System\EjcKzgm.exe
  2⤵
  PID:5576
- C:\Windows\System\JrObNAC.exe
  C:\Windows\System\JrObNAC.exe
  2⤵
  PID:5592
- C:\Windows\System\qeSTzAr.exe
  C:\Windows\System\qeSTzAr.exe
  2⤵
  PID:5612
- C:\Windows\System\UXkqfbj.exe
  C:\Windows\System\UXkqfbj.exe
  2⤵
  PID:5628
- C:\Windows\System\CvZkRLv.exe
  C:\Windows\System\CvZkRLv.exe
  2⤵
  PID:5644
- C:\Windows\System\AkcCqzV.exe
  C:\Windows\System\AkcCqzV.exe
  2⤵
  PID:5660
- C:\Windows\System\KCKeDax.exe
  C:\Windows\System\KCKeDax.exe
  2⤵
  PID:5720
- C:\Windows\System\NVvMGXT.exe
  C:\Windows\System\NVvMGXT.exe
  2⤵
  PID:5736
- C:\Windows\System\HLChEvj.exe
  C:\Windows\System\HLChEvj.exe
  2⤵
  PID:5752
- C:\Windows\System\swEjlEJ.exe
  C:\Windows\System\swEjlEJ.exe
  2⤵
  PID:5772
- C:\Windows\System\VUAKgNX.exe
  C:\Windows\System\VUAKgNX.exe
  2⤵
  PID:5796
- C:\Windows\System\dcVmsgM.exe
  C:\Windows\System\dcVmsgM.exe
  2⤵
  PID:5812
- C:\Windows\System\hCpNWhp.exe
  C:\Windows\System\hCpNWhp.exe
  2⤵
  PID:5836
- C:\Windows\System\ZyVfkQQ.exe
  C:\Windows\System\ZyVfkQQ.exe
  2⤵
  PID:5852
- C:\Windows\System\FNwBIGU.exe
  C:\Windows\System\FNwBIGU.exe
  2⤵
  PID:5872
- C:\Windows\System\HYKapiI.exe
  C:\Windows\System\HYKapiI.exe
  2⤵
  PID:5888
- C:\Windows\System\DjRfYRx.exe
  C:\Windows\System\DjRfYRx.exe
  2⤵
  PID:5904
- C:\Windows\System\JqJPDrg.exe
  C:\Windows\System\JqJPDrg.exe
  2⤵
  PID:5924
- C:\Windows\System\XCmxBHn.exe
  C:\Windows\System\XCmxBHn.exe
  2⤵
  PID:5940
- C:\Windows\System\vGjRVOH.exe
  C:\Windows\System\vGjRVOH.exe
  2⤵
  PID:5956
- C:\Windows\System\NjvxRLs.exe
  C:\Windows\System\NjvxRLs.exe
  2⤵
  PID:5984
- C:\Windows\System\KGewwsc.exe
  C:\Windows\System\KGewwsc.exe
  2⤵
  PID:6000
- C:\Windows\System\RXGGhwn.exe
  C:\Windows\System\RXGGhwn.exe
  2⤵
  PID:6016
- C:\Windows\System\FhcqPYo.exe
  C:\Windows\System\FhcqPYo.exe
  2⤵
  PID:6032
- C:\Windows\System\millmeU.exe
  C:\Windows\System\millmeU.exe
  2⤵
  PID:6052
- C:\Windows\System\yKhEMeg.exe
  C:\Windows\System\yKhEMeg.exe
  2⤵
  PID:6072
- C:\Windows\System\JSpoPiv.exe
  C:\Windows\System\JSpoPiv.exe
  2⤵
  PID:6092
- C:\Windows\System\WXNroNd.exe
  C:\Windows\System\WXNroNd.exe
  2⤵
  PID:6108
- C:\Windows\System\mcdjihe.exe
  C:\Windows\System\mcdjihe.exe
  2⤵
  PID:6128
- C:\Windows\System\cYBAWHQ.exe
  C:\Windows\System\cYBAWHQ.exe
  2⤵
  PID:5072
- C:\Windows\System\alQjbXe.exe
  C:\Windows\System\alQjbXe.exe
  2⤵
  PID:5004
- C:\Windows\System\ZdxpqXo.exe
  C:\Windows\System\ZdxpqXo.exe
  2⤵
  PID:5296
- C:\Windows\System\hBzuRJK.exe
  C:\Windows\System\hBzuRJK.exe
  2⤵
  PID:5376
- C:\Windows\System\vwedsaA.exe
  C:\Windows\System\vwedsaA.exe
  2⤵
  PID:5392
- C:\Windows\System\zCwxjug.exe
  C:\Windows\System\zCwxjug.exe
  2⤵
  PID:4568
- C:\Windows\System\OmdBJoY.exe
  C:\Windows\System\OmdBJoY.exe
  2⤵
  PID:2612
- C:\Windows\System\yYoXdwD.exe
  C:\Windows\System\yYoXdwD.exe
  2⤵
  PID:5040
- C:\Windows\System\fOjvyUC.exe
  C:\Windows\System\fOjvyUC.exe
  2⤵
  PID:5140
- C:\Windows\System\ZafTTiP.exe
  C:\Windows\System\ZafTTiP.exe
  2⤵
  PID:5416
- C:\Windows\System\PjPPUfd.exe
  C:\Windows\System\PjPPUfd.exe
  2⤵
  PID:5240
- C:\Windows\System\jxjnyHk.exe
  C:\Windows\System\jxjnyHk.exe
  2⤵
  PID:5436
- C:\Windows\System\SqUlrUE.exe
  C:\Windows\System\SqUlrUE.exe
  2⤵
  PID:4392
- C:\Windows\System\bOMIkNr.exe
  C:\Windows\System\bOMIkNr.exe
  2⤵
  PID:4132
- C:\Windows\System\uKOvygP.exe
  C:\Windows\System\uKOvygP.exe
  2⤵
  PID:4536
- C:\Windows\System\KHIZCcB.exe
  C:\Windows\System\KHIZCcB.exe
  2⤵
  PID:5308
- C:\Windows\System\sxXAEIu.exe
  C:\Windows\System\sxXAEIu.exe
  2⤵
  PID:5344
- C:\Windows\System\euyFcMG.exe
  C:\Windows\System\euyFcMG.exe
  2⤵
  PID:5488
- C:\Windows\System\cCJFGct.exe
  C:\Windows\System\cCJFGct.exe
  2⤵
  PID:5552
- C:\Windows\System\gUTInlS.exe
  C:\Windows\System\gUTInlS.exe
  2⤵
  PID:5532
- C:\Windows\System\wHteyem.exe
  C:\Windows\System\wHteyem.exe
  2⤵
  PID:5604
- C:\Windows\System\IIWNXgb.exe
  C:\Windows\System\IIWNXgb.exe
  2⤵
  PID:5680
- C:\Windows\System\SCaSSEJ.exe
  C:\Windows\System\SCaSSEJ.exe
  2⤵
  PID:4776
- C:\Windows\System\KBeFkSY.exe
  C:\Windows\System\KBeFkSY.exe
  2⤵
  PID:5732
- C:\Windows\System\ehnUfsH.exe
  C:\Windows\System\ehnUfsH.exe
  2⤵
  PID:5768
- C:\Windows\System\ghvMEXr.exe
  C:\Windows\System\ghvMEXr.exe
  2⤵
  PID:5808
- C:\Windows\System\KSUcwFi.exe
  C:\Windows\System\KSUcwFi.exe
  2⤵
  PID:5916
- C:\Windows\System\eRLSScu.exe
  C:\Windows\System\eRLSScu.exe
  2⤵
  PID:5912
- C:\Windows\System\yuNIPyA.exe
  C:\Windows\System\yuNIPyA.exe
  2⤵
  PID:5832
- C:\Windows\System\GgXFIyA.exe
  C:\Windows\System\GgXFIyA.exe
  2⤵
  PID:5968
- C:\Windows\System\YIXQRFF.exe
  C:\Windows\System\YIXQRFF.exe
  2⤵
  PID:6028
- C:\Windows\System\fLWNXQg.exe
  C:\Windows\System\fLWNXQg.exe
  2⤵
  PID:5980
- C:\Windows\System\iRjhvlC.exe
  C:\Windows\System\iRjhvlC.exe
  2⤵
  PID:6064
- C:\Windows\System\ZrlIHgc.exe
  C:\Windows\System\ZrlIHgc.exe
  2⤵
  PID:4836
- C:\Windows\System\AUEiwcm.exe
  C:\Windows\System\AUEiwcm.exe
  2⤵
  PID:6008
- C:\Windows\System\iyOuLSM.exe
  C:\Windows\System\iyOuLSM.exe
  2⤵
  PID:6048
- C:\Windows\System\gzSRMQU.exe
  C:\Windows\System\gzSRMQU.exe
  2⤵
  PID:4620
- C:\Windows\System\TYFxGyx.exe
  C:\Windows\System\TYFxGyx.exe
  2⤵
  PID:5156
- C:\Windows\System\JCEMQLs.exe
  C:\Windows\System\JCEMQLs.exe
  2⤵
  PID:5188
- C:\Windows\System\FUYiLbL.exe
  C:\Windows\System\FUYiLbL.exe
  2⤵
  PID:5260
- C:\Windows\System\KnqzROQ.exe
  C:\Windows\System\KnqzROQ.exe
  2⤵
  PID:5360
- C:\Windows\System\QVYZwZM.exe
  C:\Windows\System\QVYZwZM.exe
  2⤵
  PID:5384
- C:\Windows\System\YOBOWLx.exe
  C:\Windows\System\YOBOWLx.exe
  2⤵
  PID:5520
- C:\Windows\System\UCulVNr.exe
  C:\Windows\System\UCulVNr.exe
  2⤵
  PID:5420
- C:\Windows\System\cuqQqhZ.exe
  C:\Windows\System\cuqQqhZ.exe
  2⤵
  PID:5588
- C:\Windows\System\VbandNp.exe
  C:\Windows\System\VbandNp.exe
  2⤵
  PID:4212
- C:\Windows\System\jgJYsiU.exe
  C:\Windows\System\jgJYsiU.exe
  2⤵
  PID:5608
- C:\Windows\System\QljCmPS.exe
  C:\Windows\System\QljCmPS.exe
  2⤵
  PID:5504
- C:\Windows\System\GhCxtBZ.exe
  C:\Windows\System\GhCxtBZ.exe
  2⤵
  PID:5600
- C:\Windows\System\GtppLHC.exe
  C:\Windows\System\GtppLHC.exe
  2⤵
  PID:5700
- C:\Windows\System\dnkkGNK.exe
  C:\Windows\System\dnkkGNK.exe
  2⤵
  PID:5708
- C:\Windows\System\VOwigMC.exe
  C:\Windows\System\VOwigMC.exe
  2⤵
  PID:5748
- C:\Windows\System\JAAEzzQ.exe
  C:\Windows\System\JAAEzzQ.exe
  2⤵
  PID:5788
- C:\Windows\System\NOaOCVv.exe
  C:\Windows\System\NOaOCVv.exe
  2⤵
  PID:5824
- C:\Windows\System\FdUiKgV.exe
  C:\Windows\System\FdUiKgV.exe
  2⤵
  PID:5880
- C:\Windows\System\gpWUDaK.exe
  C:\Windows\System\gpWUDaK.exe
  2⤵
  PID:6024
- C:\Windows\System\jAqxTGF.exe
  C:\Windows\System\jAqxTGF.exe
  2⤵
  PID:5972
- C:\Windows\System\CgYMVXv.exe
  C:\Windows\System\CgYMVXv.exe
  2⤵
  PID:6060
- C:\Windows\System\euCIyXD.exe
  C:\Windows\System\euCIyXD.exe
  2⤵
  PID:5328
- C:\Windows\System\YlTlIvP.exe
  C:\Windows\System\YlTlIvP.exe
  2⤵
  PID:5408
- C:\Windows\System\cmKJsBX.exe
  C:\Windows\System\cmKJsBX.exe
  2⤵
  PID:5128
- C:\Windows\System\WqwnYpP.exe
  C:\Windows\System\WqwnYpP.exe
  2⤵
  PID:1784
- C:\Windows\System\wVdEpoq.exe
  C:\Windows\System\wVdEpoq.exe
  2⤵
  PID:5316
- C:\Windows\System\yIhnbgB.exe
  C:\Windows\System\yIhnbgB.exe
  2⤵
  PID:5620
- C:\Windows\System\aDQLAzc.exe
  C:\Windows\System\aDQLAzc.exe
  2⤵
  PID:5460
- C:\Windows\System\uaQVwPo.exe
  C:\Windows\System\uaQVwPo.exe
  2⤵
  PID:4796
- C:\Windows\System\guGKqyK.exe
  C:\Windows\System\guGKqyK.exe
  2⤵
  PID:6116
- C:\Windows\System\lttUNkO.exe
  C:\Windows\System\lttUNkO.exe
  2⤵
  PID:5656
- C:\Windows\System\WXoWHBV.exe
  C:\Windows\System\WXoWHBV.exe
  2⤵
  PID:5568
- C:\Windows\System\wVgVLnl.exe
  C:\Windows\System\wVgVLnl.exe
  2⤵
  PID:5676
- C:\Windows\System\OmdEVCu.exe
  C:\Windows\System\OmdEVCu.exe
  2⤵
  PID:6148
- C:\Windows\System\ndTtdQQ.exe
  C:\Windows\System\ndTtdQQ.exe
  2⤵
  PID:6168
- C:\Windows\System\jKWxUdv.exe
  C:\Windows\System\jKWxUdv.exe
  2⤵
  PID:6268
- C:\Windows\System\LYTihhm.exe
  C:\Windows\System\LYTihhm.exe
  2⤵
  PID:6284
- C:\Windows\System\oyfPkyC.exe
  C:\Windows\System\oyfPkyC.exe
  2⤵
  PID:6300
- C:\Windows\System\QOpSMBc.exe
  C:\Windows\System\QOpSMBc.exe
  2⤵
  PID:6316
- C:\Windows\System\QnGmzbd.exe
  C:\Windows\System\QnGmzbd.exe
  2⤵
  PID:6332
- C:\Windows\System\pNmiECK.exe
  C:\Windows\System\pNmiECK.exe
  2⤵
  PID:6348
- C:\Windows\System\FlosUSv.exe
  C:\Windows\System\FlosUSv.exe
  2⤵
  PID:6372
- C:\Windows\System\VQoNuNQ.exe
  C:\Windows\System\VQoNuNQ.exe
  2⤵
  PID:6392
- C:\Windows\System\ZTyBSpD.exe
  C:\Windows\System\ZTyBSpD.exe
  2⤵
  PID:6408
- C:\Windows\System\KeHrqDG.exe
  C:\Windows\System\KeHrqDG.exe
  2⤵
  PID:6428
- C:\Windows\System\TobPuwQ.exe
  C:\Windows\System\TobPuwQ.exe
  2⤵
  PID:6444
- C:\Windows\System\EwnJPmk.exe
  C:\Windows\System\EwnJPmk.exe
  2⤵
  PID:6460
- C:\Windows\System\kEttmuR.exe
  C:\Windows\System\kEttmuR.exe
  2⤵
  PID:6480
- C:\Windows\System\BVDUAii.exe
  C:\Windows\System\BVDUAii.exe
  2⤵
  PID:6496
- C:\Windows\System\SKnRrFZ.exe
  C:\Windows\System\SKnRrFZ.exe
  2⤵
  PID:6512
- C:\Windows\System\HTNdYeu.exe
  C:\Windows\System\HTNdYeu.exe
  2⤵
  PID:6528
- C:\Windows\System\GYvOaXe.exe
  C:\Windows\System\GYvOaXe.exe
  2⤵
  PID:6544
- C:\Windows\System\ONEeSnP.exe
  C:\Windows\System\ONEeSnP.exe
  2⤵
  PID:6612
- C:\Windows\System\uCTYTuv.exe
  C:\Windows\System\uCTYTuv.exe
  2⤵
  PID:6628
- C:\Windows\System\UbfFiJY.exe
  C:\Windows\System\UbfFiJY.exe
  2⤵
  PID:6648
- C:\Windows\System\xGqShXE.exe
  C:\Windows\System\xGqShXE.exe
  2⤵
  PID:6664
- C:\Windows\System\QsuMQnZ.exe
  C:\Windows\System\QsuMQnZ.exe
  2⤵
  PID:6684
- C:\Windows\System\OBiwzLW.exe
  C:\Windows\System\OBiwzLW.exe
  2⤵
  PID:6700
- C:\Windows\System\epkjwFa.exe
  C:\Windows\System\epkjwFa.exe
  2⤵
  PID:6716
- C:\Windows\System\JjlfnVq.exe
  C:\Windows\System\JjlfnVq.exe
  2⤵
  PID:6736
- C:\Windows\System\bVNTIKX.exe
  C:\Windows\System\bVNTIKX.exe
  2⤵
  PID:6792
- C:\Windows\System\ZitcOVM.exe
  C:\Windows\System\ZitcOVM.exe
  2⤵
  PID:6812
- C:\Windows\System\ozJgJfO.exe
  C:\Windows\System\ozJgJfO.exe
  2⤵
  PID:6832
- C:\Windows\System\vgKVbGP.exe
  C:\Windows\System\vgKVbGP.exe
  2⤵
  PID:6848
- C:\Windows\System\qpaBztA.exe
  C:\Windows\System\qpaBztA.exe
  2⤵
  PID:6864
- C:\Windows\System\jAtEsQL.exe
  C:\Windows\System\jAtEsQL.exe
  2⤵
  PID:6880
- C:\Windows\System\AetFFwZ.exe
  C:\Windows\System\AetFFwZ.exe
  2⤵
  PID:6896
- C:\Windows\System\UTuzOaG.exe
  C:\Windows\System\UTuzOaG.exe
  2⤵
  PID:6916
- C:\Windows\System\COALrvC.exe
  C:\Windows\System\COALrvC.exe
  2⤵
  PID:6932
- C:\Windows\System\MHqxeNZ.exe
  C:\Windows\System\MHqxeNZ.exe
  2⤵
  PID:6948
- C:\Windows\System\ZiSjwHL.exe
  C:\Windows\System\ZiSjwHL.exe
  2⤵
  PID:6964
- C:\Windows\System\sDszpNf.exe
  C:\Windows\System\sDszpNf.exe
  2⤵
  PID:6984
- C:\Windows\System\VSoKbkh.exe
  C:\Windows\System\VSoKbkh.exe
  2⤵
  PID:7004
- C:\Windows\System\rtGsHkc.exe
  C:\Windows\System\rtGsHkc.exe
  2⤵
  PID:7040
- C:\Windows\System\qQiACLQ.exe
  C:\Windows\System\qQiACLQ.exe
  2⤵
  PID:7056
- C:\Windows\System\ROQZEva.exe
  C:\Windows\System\ROQZEva.exe
  2⤵
  PID:7072
- C:\Windows\System\teKAJrf.exe
  C:\Windows\System\teKAJrf.exe
  2⤵
  PID:7088
- C:\Windows\System\JNeOhdC.exe
  C:\Windows\System\JNeOhdC.exe
  2⤵
  PID:7108
- C:\Windows\System\oOtdHkC.exe
  C:\Windows\System\oOtdHkC.exe
  2⤵
  PID:7124
- C:\Windows\System\gzKxnSC.exe
  C:\Windows\System\gzKxnSC.exe
  2⤵
  PID:7140
- C:\Windows\System\ltGPjBy.exe
  C:\Windows\System\ltGPjBy.exe
  2⤵
  PID:7156
- C:\Windows\System\PmfenXW.exe
  C:\Windows\System\PmfenXW.exe
  2⤵
  PID:5208
- C:\Windows\System\qsRYeHR.exe
  C:\Windows\System\qsRYeHR.exe
  2⤵
  PID:6040
- C:\Windows\System\GsLZdEp.exe
  C:\Windows\System\GsLZdEp.exe
  2⤵
  PID:5472
- C:\Windows\System\okEBYPT.exe
  C:\Windows\System\okEBYPT.exe
  2⤵
  PID:4700
- C:\Windows\System\BwTsuzP.exe
  C:\Windows\System\BwTsuzP.exe
  2⤵
  PID:2856
- C:\Windows\System\OGykRMN.exe
  C:\Windows\System\OGykRMN.exe
  2⤵
  PID:6192
- C:\Windows\System\NGWKhzw.exe
  C:\Windows\System\NGWKhzw.exe
  2⤵
  PID:6208
- C:\Windows\System\MyjjLbA.exe
  C:\Windows\System\MyjjLbA.exe
  2⤵
  PID:5668
- C:\Windows\System\LBeHbrf.exe
  C:\Windows\System\LBeHbrf.exe
  2⤵
  PID:5424
- C:\Windows\System\cBVHUIi.exe
  C:\Windows\System\cBVHUIi.exe
  2⤵
  PID:4228
- C:\Windows\System\SdZYJcY.exe
  C:\Windows\System\SdZYJcY.exe
  2⤵
  PID:5704
- C:\Windows\System\CxhSEoR.exe
  C:\Windows\System\CxhSEoR.exe
  2⤵
  PID:5868
- C:\Windows\System\GgSbfFZ.exe
  C:\Windows\System\GgSbfFZ.exe
  2⤵
  PID:6100
- C:\Windows\System\OPZcika.exe
  C:\Windows\System\OPZcika.exe
  2⤵
  PID:5212
- C:\Windows\System\LlKETyr.exe
  C:\Windows\System\LlKETyr.exe
  2⤵
  PID:6244
- C:\Windows\System\bxrzURz.exe
  C:\Windows\System\bxrzURz.exe
  2⤵
  PID:6260
- C:\Windows\System\uNDmAlM.exe
  C:\Windows\System\uNDmAlM.exe
  2⤵
  PID:6356
- C:\Windows\System\zjEZhTW.exe
  C:\Windows\System\zjEZhTW.exe
  2⤵
  PID:6404
- C:\Windows\System\cEnbMLD.exe
  C:\Windows\System\cEnbMLD.exe
  2⤵
  PID:6472
- C:\Windows\System\WUtQtkw.exe
  C:\Windows\System\WUtQtkw.exe
  2⤵
  PID:6536
- C:\Windows\System\gJuplrQ.exe
  C:\Windows\System\gJuplrQ.exe
  2⤵
  PID:6388
- C:\Windows\System\SSlcdcH.exe
  C:\Windows\System\SSlcdcH.exe
  2⤵
  PID:6488
- C:\Windows\System\wdkNccX.exe
  C:\Windows\System\wdkNccX.exe
  2⤵
  PID:6552
- C:\Windows\System\hAstkJD.exe
  C:\Windows\System\hAstkJD.exe
  2⤵
  PID:6568
- C:\Windows\System\wRoQgEX.exe
  C:\Windows\System\wRoQgEX.exe
  2⤵
  PID:6620
- C:\Windows\System\axoRqAZ.exe
  C:\Windows\System\axoRqAZ.exe
  2⤵
  PID:6692
- C:\Windows\System\MvDNPXo.exe
  C:\Windows\System\MvDNPXo.exe
  2⤵
  PID:6676
- C:\Windows\System\rRufnJV.exe
  C:\Windows\System\rRufnJV.exe
  2⤵
  PID:6744
- C:\Windows\System\pLpinFV.exe
  C:\Windows\System\pLpinFV.exe
  2⤵
  PID:6800
- C:\Windows\System\JOlFRUy.exe
  C:\Windows\System\JOlFRUy.exe
  2⤵
  PID:6572
- C:\Windows\System\OEpNHPG.exe
  C:\Windows\System\OEpNHPG.exe
  2⤵
  PID:6804
- C:\Windows\System\RztkCdj.exe
  C:\Windows\System\RztkCdj.exe
  2⤵
  PID:6584
- C:\Windows\System\DMKzOSB.exe
  C:\Windows\System\DMKzOSB.exe
  2⤵
  PID:6904
- C:\Windows\System\CqDBRAa.exe
  C:\Windows\System\CqDBRAa.exe
  2⤵
  PID:6972
- C:\Windows\System\LVlgDvM.exe
  C:\Windows\System\LVlgDvM.exe
  2⤵
  PID:7012
- C:\Windows\System\QIPGKPK.exe
  C:\Windows\System\QIPGKPK.exe
  2⤵
  PID:7068
- C:\Windows\System\FdjWTyq.exe
  C:\Windows\System\FdjWTyq.exe
  2⤵
  PID:7132
- C:\Windows\System\LHVgoHv.exe
  C:\Windows\System\LHVgoHv.exe
  2⤵
  PID:4984
- C:\Windows\System\cKywAql.exe
  C:\Windows\System\cKywAql.exe
  2⤵
  PID:7080
- C:\Windows\System\sAghtCE.exe
  C:\Windows\System\sAghtCE.exe
  2⤵
  PID:7152
- C:\Windows\System\VAqcTSz.exe
  C:\Windows\System\VAqcTSz.exe
  2⤵
  PID:6184
- C:\Windows\System\coWKuRt.exe
  C:\Windows\System\coWKuRt.exe
  2⤵
  PID:6228
- C:\Windows\System\kMwYtKG.exe
  C:\Windows\System\kMwYtKG.exe
  2⤵
  PID:6860
- C:\Windows\System\mpsZTFm.exe
  C:\Windows\System\mpsZTFm.exe
  2⤵
  PID:6928
- C:\Windows\System\gIlaREQ.exe
  C:\Windows\System\gIlaREQ.exe
  2⤵
  PID:4476
- C:\Windows\System\vmWqmpr.exe
  C:\Windows\System\vmWqmpr.exe
  2⤵
  PID:6328
- C:\Windows\System\kEqRbmt.exe
  C:\Windows\System\kEqRbmt.exe
  2⤵
  PID:6344
- C:\Windows\System\NPItYze.exe
  C:\Windows\System\NPItYze.exe
  2⤵
  PID:6756
- C:\Windows\System\WbbQuFv.exe
  C:\Windows\System\WbbQuFv.exe
  2⤵
  PID:6724
- C:\Windows\System\dQTRIkI.exe
  C:\Windows\System\dQTRIkI.exe
  2⤵
  PID:6456
- C:\Windows\System\LacuGOg.exe
  C:\Windows\System\LacuGOg.exe
  2⤵
  PID:6712
- C:\Windows\System\xpFFtKw.exe
  C:\Windows\System\xpFFtKw.exe
  2⤵
  PID:6940
- C:\Windows\System\IRrqjlq.exe
  C:\Windows\System\IRrqjlq.exe
  2⤵
  PID:6420
- C:\Windows\System\bhtRCGC.exe
  C:\Windows\System\bhtRCGC.exe
  2⤵
  PID:6976
- C:\Windows\System\qEJeoAi.exe
  C:\Windows\System\qEJeoAi.exe
  2⤵
  PID:6564
- C:\Windows\System\ideiCgv.exe
  C:\Windows\System\ideiCgv.exe
  2⤵
  PID:6760
- C:\Windows\System\jtwIpqA.exe
  C:\Windows\System\jtwIpqA.exe
  2⤵
  PID:6180
- C:\Windows\System\GjvMLxX.exe
  C:\Windows\System\GjvMLxX.exe
  2⤵
  PID:4900
- C:\Windows\System\zFgxiMb.exe
  C:\Windows\System\zFgxiMb.exe
  2⤵
  PID:7052
- C:\Windows\System\gmWyRQQ.exe
  C:\Windows\System\gmWyRQQ.exe
  2⤵
  PID:7116
- C:\Windows\System\EIzlsUs.exe
  C:\Windows\System\EIzlsUs.exe
  2⤵
  PID:6164
- C:\Windows\System\vdDbNPx.exe
  C:\Windows\System\vdDbNPx.exe
  2⤵
  PID:6604
- C:\Windows\System\WprAYOK.exe
  C:\Windows\System\WprAYOK.exe
  2⤵
  PID:6240
- C:\Windows\System\IpFiFAl.exe
  C:\Windows\System\IpFiFAl.exe
  2⤵
  PID:6280
- C:\Windows\System\SVLGiOE.exe
  C:\Windows\System\SVLGiOE.exe
  2⤵
  PID:5828
- C:\Windows\System\bWIpNKd.exe
  C:\Windows\System\bWIpNKd.exe
  2⤵
  PID:6292
- C:\Windows\System\ZKWEChJ.exe
  C:\Windows\System\ZKWEChJ.exe
  2⤵
  PID:6324
- C:\Windows\System\uFZBCje.exe
  C:\Windows\System\uFZBCje.exe
  2⤵
  PID:6708
- C:\Windows\System\zFRQGeo.exe
  C:\Windows\System\zFRQGeo.exe
  2⤵
  PID:6508
- C:\Windows\System\xhriBCM.exe
  C:\Windows\System\xhriBCM.exe
  2⤵
  PID:7100
- C:\Windows\System\RzSJOTX.exe
  C:\Windows\System\RzSJOTX.exe
  2⤵
  PID:6808
- C:\Windows\System\KCeUSbH.exe
  C:\Windows\System\KCeUSbH.exe
  2⤵
  PID:6768
- C:\Windows\System\esFGxij.exe
  C:\Windows\System\esFGxij.exe
  2⤵
  PID:6780
- C:\Windows\System\JyxFiTQ.exe
  C:\Windows\System\JyxFiTQ.exe
  2⤵
  PID:6644
- C:\Windows\System\FFnFpUg.exe
  C:\Windows\System\FFnFpUg.exe
  2⤵
  PID:7048
- C:\Windows\System\vukWnka.exe
  C:\Windows\System\vukWnka.exe
  2⤵
  PID:6856
- C:\Windows\System\reKaMhe.exe
  C:\Windows\System\reKaMhe.exe
  2⤵
  PID:6576
- C:\Windows\System\AnXnWnN.exe
  C:\Windows\System\AnXnWnN.exe
  2⤵
  PID:5728
- C:\Windows\System\kALrHlj.exe
  C:\Windows\System\kALrHlj.exe
  2⤵
  PID:7120
- C:\Windows\System\MZHqtqH.exe
  C:\Windows\System\MZHqtqH.exe
  2⤵
  PID:5432
- C:\Windows\System\DqGfKQF.exe
  C:\Windows\System\DqGfKQF.exe
  2⤵
  PID:6364
- C:\Windows\System\VYmVqoG.exe
  C:\Windows\System\VYmVqoG.exe
  2⤵
  PID:6660
- C:\Windows\System\pXVoTJv.exe
  C:\Windows\System\pXVoTJv.exe
  2⤵
  PID:6368
- C:\Windows\System\ZmRdRrm.exe
  C:\Windows\System\ZmRdRrm.exe
  2⤵
  PID:6924
- C:\Windows\System\vdFXWKM.exe
  C:\Windows\System\vdFXWKM.exe
  2⤵
  PID:5224
- C:\Windows\System\sEqBkyC.exe
  C:\Windows\System\sEqBkyC.exe
  2⤵
  PID:6520
- C:\Windows\System\wmdFpPX.exe
  C:\Windows\System\wmdFpPX.exe
  2⤵
  PID:6524
- C:\Windows\System\YXZeNvm.exe
  C:\Windows\System\YXZeNvm.exe
  2⤵
  PID:6120
- C:\Windows\System\VAhQHSH.exe
  C:\Windows\System\VAhQHSH.exe
  2⤵
  PID:6944
- C:\Windows\System\KyInnaH.exe
  C:\Windows\System\KyInnaH.exe
  2⤵
  PID:6788
- C:\Windows\System\jKCxasA.exe
  C:\Windows\System\jKCxasA.exe
  2⤵
  PID:6256
- C:\Windows\System\sCmTCMH.exe
  C:\Windows\System\sCmTCMH.exe
  2⤵
  PID:6312
- C:\Windows\System\hiGKYpL.exe
  C:\Windows\System\hiGKYpL.exe
  2⤵
  PID:6216
- C:\Windows\System\vNEtGiH.exe
  C:\Windows\System\vNEtGiH.exe
  2⤵
  PID:6992
- C:\Windows\System\fdMjAfw.exe
  C:\Windows\System\fdMjAfw.exe
  2⤵
  PID:7000
- C:\Windows\System\LxWShut.exe
  C:\Windows\System\LxWShut.exe
  2⤵
  PID:6224
- C:\Windows\System\UlrYhuA.exe
  C:\Windows\System\UlrYhuA.exe
  2⤵
  PID:6296
- C:\Windows\System\chOzaoz.exe
  C:\Windows\System\chOzaoz.exe
  2⤵
  PID:7180
- C:\Windows\System\owBgTbe.exe
  C:\Windows\System\owBgTbe.exe
  2⤵
  PID:7200
- C:\Windows\System\ChbSxvt.exe
  C:\Windows\System\ChbSxvt.exe
  2⤵
  PID:7216
- C:\Windows\System\CpNlnoy.exe
  C:\Windows\System\CpNlnoy.exe
  2⤵
  PID:7328
- C:\Windows\System\iJAiVsl.exe
  C:\Windows\System\iJAiVsl.exe
  2⤵
  PID:7344
- C:\Windows\System\lzCbwOd.exe
  C:\Windows\System\lzCbwOd.exe
  2⤵
  PID:7360
- C:\Windows\System\DUTnqbw.exe
  C:\Windows\System\DUTnqbw.exe
  2⤵
  PID:7376
- C:\Windows\System\JBzGqtn.exe
  C:\Windows\System\JBzGqtn.exe
  2⤵
  PID:7392
- C:\Windows\System\MnnaAbS.exe
  C:\Windows\System\MnnaAbS.exe
  2⤵
  PID:7408
- C:\Windows\System\BjhgmvS.exe
  C:\Windows\System\BjhgmvS.exe
  2⤵
  PID:7424
- C:\Windows\System\pvHXxzU.exe
  C:\Windows\System\pvHXxzU.exe
  2⤵
  PID:7448
- C:\Windows\System\KWBJgCy.exe
  C:\Windows\System\KWBJgCy.exe
  2⤵
  PID:7464
- C:\Windows\System\PrUrmDk.exe
  C:\Windows\System\PrUrmDk.exe
  2⤵
  PID:7484
- C:\Windows\System\bFZXTwX.exe
  C:\Windows\System\bFZXTwX.exe
  2⤵
  PID:7500
- C:\Windows\System\NhNThLo.exe
  C:\Windows\System\NhNThLo.exe
  2⤵
  PID:7516
- C:\Windows\System\dxvjzqa.exe
  C:\Windows\System\dxvjzqa.exe
  2⤵
  PID:7532
- C:\Windows\System\IFkuEmB.exe
  C:\Windows\System\IFkuEmB.exe
  2⤵
  PID:7548
- C:\Windows\System\fnDAUNO.exe
  C:\Windows\System\fnDAUNO.exe
  2⤵
  PID:7580
- C:\Windows\System\xzLClFm.exe
  C:\Windows\System\xzLClFm.exe
  2⤵
  PID:7600
- C:\Windows\System\iqoXhXw.exe
  C:\Windows\System\iqoXhXw.exe
  2⤵
  PID:7616
- C:\Windows\System\WGhNfwh.exe
  C:\Windows\System\WGhNfwh.exe
  2⤵
  PID:7632
- C:\Windows\System\juKDEsX.exe
  C:\Windows\System\juKDEsX.exe
  2⤵
  PID:7652
- C:\Windows\System\PQXTpWz.exe
  C:\Windows\System\PQXTpWz.exe
  2⤵
  PID:7668
- C:\Windows\System\DCUzCIf.exe
  C:\Windows\System\DCUzCIf.exe
  2⤵
  PID:7684
- C:\Windows\System\xCVsoSl.exe
  C:\Windows\System\xCVsoSl.exe
  2⤵
  PID:7700
- C:\Windows\System\HyBETGk.exe
  C:\Windows\System\HyBETGk.exe
  2⤵
  PID:7720
- C:\Windows\System\DAjnvlM.exe
  C:\Windows\System\DAjnvlM.exe
  2⤵
  PID:7736
- C:\Windows\System\JPEGvIn.exe
  C:\Windows\System\JPEGvIn.exe
  2⤵
  PID:7752
- C:\Windows\System\vWzHJfQ.exe
  C:\Windows\System\vWzHJfQ.exe
  2⤵
  PID:7768
- C:\Windows\System\ScgcmpL.exe
  C:\Windows\System\ScgcmpL.exe
  2⤵
  PID:7784
- C:\Windows\System\lVASIoX.exe
  C:\Windows\System\lVASIoX.exe
  2⤵
  PID:7804
- C:\Windows\System\NWAsHEx.exe
  C:\Windows\System\NWAsHEx.exe
  2⤵
  PID:7820
- C:\Windows\System\ydyTQnI.exe
  C:\Windows\System\ydyTQnI.exe
  2⤵
  PID:7836
- C:\Windows\System\lmPWdHx.exe
  C:\Windows\System\lmPWdHx.exe
  2⤵
  PID:7856
- C:\Windows\System\xZMFuTc.exe
  C:\Windows\System\xZMFuTc.exe
  2⤵
  PID:7892
- C:\Windows\System\kLpSPbP.exe
  C:\Windows\System\kLpSPbP.exe
  2⤵
  PID:7908
- C:\Windows\System\FrRHrbZ.exe
  C:\Windows\System\FrRHrbZ.exe
  2⤵
  PID:7928
- C:\Windows\System\rbmpQUP.exe
  C:\Windows\System\rbmpQUP.exe
  2⤵
  PID:7952
- C:\Windows\System\GGgOBpU.exe
  C:\Windows\System\GGgOBpU.exe
  2⤵
  PID:7980
- C:\Windows\System\SYdgVpz.exe
  C:\Windows\System\SYdgVpz.exe
  2⤵
  PID:8000
- C:\Windows\System\ZTQHIYw.exe
  C:\Windows\System\ZTQHIYw.exe
  2⤵
  PID:8020
- C:\Windows\System\GaTVXtb.exe
  C:\Windows\System\GaTVXtb.exe
  2⤵
  PID:8040
- C:\Windows\System\FBJZAFS.exe
  C:\Windows\System\FBJZAFS.exe
  2⤵
  PID:8056
- C:\Windows\System\WriGxrs.exe
  C:\Windows\System\WriGxrs.exe
  2⤵
  PID:8072
- C:\Windows\System\aKCetvY.exe
  C:\Windows\System\aKCetvY.exe
  2⤵
  PID:8088
- C:\Windows\System\KfsMDPp.exe
  C:\Windows\System\KfsMDPp.exe
  2⤵
  PID:8104
- C:\Windows\System\AsZXjhp.exe
  C:\Windows\System\AsZXjhp.exe
  2⤵
  PID:8120
- C:\Windows\System\ttLQqWO.exe
  C:\Windows\System\ttLQqWO.exe
  2⤵
  PID:8136
- C:\Windows\System\KqTfYrM.exe
  C:\Windows\System\KqTfYrM.exe
  2⤵
  PID:8152
- C:\Windows\System\zllsdHq.exe
  C:\Windows\System\zllsdHq.exe
  2⤵
  PID:8168
- C:\Windows\System\VuXeXVk.exe
  C:\Windows\System\VuXeXVk.exe
  2⤵
  PID:8184
- C:\Windows\System\wBIbUoW.exe
  C:\Windows\System\wBIbUoW.exe
  2⤵
  PID:7188
- C:\Windows\System\vABReFh.exe
  C:\Windows\System\vABReFh.exe
  2⤵
  PID:7020
- C:\Windows\System\WgVafRB.exe
  C:\Windows\System\WgVafRB.exe
  2⤵
  PID:7172
- C:\Windows\System\yyqvPCO.exe
  C:\Windows\System\yyqvPCO.exe
  2⤵
  PID:6772
- C:\Windows\System\adIiNoG.exe
  C:\Windows\System\adIiNoG.exe
  2⤵
  PID:7240
- C:\Windows\System\sjbGtVc.exe
  C:\Windows\System\sjbGtVc.exe
  2⤵
  PID:7252
- C:\Windows\System\DCCnwKZ.exe
  C:\Windows\System\DCCnwKZ.exe
  2⤵
  PID:7272
- C:\Windows\System\yZIugCK.exe
  C:\Windows\System\yZIugCK.exe
  2⤵
  PID:7296
- C:\Windows\System\ggrTKbH.exe
  C:\Windows\System\ggrTKbH.exe
  2⤵
  PID:7312
- C:\Windows\System\VHoTKYI.exe
  C:\Windows\System\VHoTKYI.exe
  2⤵
  PID:7340
- C:\Windows\System\fCPFCds.exe
  C:\Windows\System\fCPFCds.exe
  2⤵
  PID:7368
- C:\Windows\System\srPIcCh.exe
  C:\Windows\System\srPIcCh.exe
  2⤵
  PID:7416
- C:\Windows\System\NvCMdPK.exe
  C:\Windows\System\NvCMdPK.exe
  2⤵
  PID:7640
- C:\Windows\System\ZQcaofb.exe
  C:\Windows\System\ZQcaofb.exe
  2⤵
  PID:7444
- C:\Windows\System\uJGglPT.exe
  C:\Windows\System\uJGglPT.exe
  2⤵
  PID:7708
- C:\Windows\System\BsdRSHP.exe
  C:\Windows\System\BsdRSHP.exe
  2⤵
  PID:7496
- C:\Windows\System\KsIRxoA.exe
  C:\Windows\System\KsIRxoA.exe
  2⤵
  PID:7716
- C:\Windows\System\amyzdKG.exe
  C:\Windows\System\amyzdKG.exe
  2⤵
  PID:7564
- C:\Windows\System\QvWXEFO.exe
  C:\Windows\System\QvWXEFO.exe
  2⤵
  PID:7612
- C:\Windows\System\kQtuYid.exe
  C:\Windows\System\kQtuYid.exe
  2⤵
  PID:7780
- C:\Windows\System\RUDjvxr.exe
  C:\Windows\System\RUDjvxr.exe
  2⤵
  PID:7476
- C:\Windows\System\YSAnLfd.exe
  C:\Windows\System\YSAnLfd.exe
  2⤵
  PID:7544
- C:\Windows\System\hUAfOHt.exe
  C:\Windows\System\hUAfOHt.exe
  2⤵
  PID:7624
- C:\Windows\System\ZwUMZOP.exe
  C:\Windows\System\ZwUMZOP.exe
  2⤵
  PID:7692
- C:\Windows\System\TrxeQlx.exe
  C:\Windows\System\TrxeQlx.exe
  2⤵
  PID:7760
- C:\Windows\System\HzIvQhp.exe
  C:\Windows\System\HzIvQhp.exe
  2⤵
  PID:7868
- C:\Windows\System\RyEyYwI.exe
  C:\Windows\System\RyEyYwI.exe
  2⤵
  PID:7320
- C:\Windows\System\hrJWPdd.exe
  C:\Windows\System\hrJWPdd.exe
  2⤵
  PID:7812
- C:\Windows\System\FtppzWI.exe
  C:\Windows\System\FtppzWI.exe
  2⤵
  PID:7904
- C:\Windows\System\vbFMwyQ.exe
  C:\Windows\System\vbFMwyQ.exe
  2⤵
  PID:7936
- C:\Windows\System\bqLyGer.exe
  C:\Windows\System\bqLyGer.exe
  2⤵
  PID:7828
- C:\Windows\System\VCjFAwH.exe
  C:\Windows\System\VCjFAwH.exe
  2⤵
  PID:7844
- C:\Windows\System\ugxxYYR.exe
  C:\Windows\System\ugxxYYR.exe
  2⤵
  PID:7968
- C:\Windows\System\BRGNujz.exe
  C:\Windows\System\BRGNujz.exe
  2⤵
  PID:8028
- C:\Windows\System\KjnUUaF.exe
  C:\Windows\System\KjnUUaF.exe
  2⤵
  PID:8036
- C:\Windows\System\WLcdJzo.exe
  C:\Windows\System\WLcdJzo.exe
  2⤵
  PID:8128
- C:\Windows\System\ISOVdiW.exe
  C:\Windows\System\ISOVdiW.exe
  2⤵
  PID:6156
- C:\Windows\System\vNGyawY.exe
  C:\Windows\System\vNGyawY.exe
  2⤵
  PID:8008
- C:\Windows\System\juoSuQU.exe
  C:\Windows\System\juoSuQU.exe
  2⤵
  PID:6672
- C:\Windows\System\TYWgwlI.exe
  C:\Windows\System\TYWgwlI.exe
  2⤵
  PID:8116
- C:\Windows\System\SSRojTT.exe
  C:\Windows\System\SSRojTT.exe
  2⤵
  PID:8180
- C:\Windows\System\YVQTMDv.exe
  C:\Windows\System\YVQTMDv.exe
  2⤵
  PID:7264
- C:\Windows\System\RTRdIua.exe
  C:\Windows\System\RTRdIua.exe
  2⤵
  PID:7248
- C:\Windows\System\mVunjza.exe
  C:\Windows\System\mVunjza.exe
  2⤵
  PID:7260
- C:\Windows\System\ZejqDfh.exe
  C:\Windows\System\ZejqDfh.exe
  2⤵
  PID:7284
- C:\Windows\System\wUnbFnI.exe
  C:\Windows\System\wUnbFnI.exe
  2⤵
  PID:7456
- C:\Windows\System\ZpprbpY.exe
  C:\Windows\System\ZpprbpY.exe
  2⤵
  PID:7680
- C:\Windows\System\IDNLFDO.exe
  C:\Windows\System\IDNLFDO.exe
  2⤵
  PID:7608
- C:\Windows\System\PRBUUOE.exe
  C:\Windows\System\PRBUUOE.exe
  2⤵
  PID:7432
- C:\Windows\System\xyVAQln.exe
  C:\Windows\System\xyVAQln.exe
  2⤵
  PID:7472
- C:\Windows\System\UIOiPgN.exe
  C:\Windows\System\UIOiPgN.exe
  2⤵
  PID:7512
- C:\Windows\System\NmBGFxj.exe
  C:\Windows\System\NmBGFxj.exe
  2⤵
  PID:7660
- C:\Windows\System\WWskgAT.exe
  C:\Windows\System\WWskgAT.exe
  2⤵
  PID:7480
- C:\Windows\System\oxTLvbF.exe
  C:\Windows\System\oxTLvbF.exe
  2⤵
  PID:7924
- C:\Windows\System\PWMPUSO.exe
  C:\Windows\System\PWMPUSO.exe
  2⤵
  PID:7880
- C:\Windows\System\THPTgma.exe
  C:\Windows\System\THPTgma.exe
  2⤵
  PID:8032
- C:\Windows\System\spuDgTB.exe
  C:\Windows\System\spuDgTB.exe
  2⤵
  PID:7288
- C:\Windows\System\ECrDzXH.exe
  C:\Windows\System\ECrDzXH.exe
  2⤵
  PID:7224
- C:\Windows\System\IaBpxGU.exe
  C:\Windows\System\IaBpxGU.exe
  2⤵
  PID:7884
- C:\Windows\System\PNIYaeY.exe
  C:\Windows\System\PNIYaeY.exe
  2⤵
  PID:7576
- C:\Windows\System\ryunBRy.exe
  C:\Windows\System\ryunBRy.exe
  2⤵
  PID:7796
- C:\Windows\System\uMLlTUL.exe
  C:\Windows\System\uMLlTUL.exe
  2⤵
  PID:7996
- C:\Windows\System\uJWbaBZ.exe
  C:\Windows\System\uJWbaBZ.exe
  2⤵
  PID:8096
- C:\Windows\System\WpGhHVZ.exe
  C:\Windows\System\WpGhHVZ.exe
  2⤵
  PID:7568
- C:\Windows\System\UYeUDTJ.exe
  C:\Windows\System\UYeUDTJ.exe
  2⤵
  PID:7540
- C:\Windows\System\rmZQfnT.exe
  C:\Windows\System\rmZQfnT.exe
  2⤵
  PID:7816
- C:\Windows\System\OheNGEM.exe
  C:\Windows\System\OheNGEM.exe
  2⤵
  PID:7436
- C:\Windows\System\iOXeBQk.exe
  C:\Windows\System\iOXeBQk.exe
  2⤵
  PID:8084
- C:\Windows\System\jYZwtuU.exe
  C:\Windows\System\jYZwtuU.exe
  2⤵
  PID:7728
- C:\Windows\System\yUqybPS.exe
  C:\Windows\System\yUqybPS.exe
  2⤵
  PID:7404
- C:\Windows\System\rtElAkJ.exe
  C:\Windows\System\rtElAkJ.exe
  2⤵
  PID:7372
- C:\Windows\System\EuTssRb.exe
  C:\Windows\System\EuTssRb.exe
  2⤵
  PID:7944
- C:\Windows\System\KArtQjA.exe
  C:\Windows\System\KArtQjA.exe
  2⤵
  PID:8164
- C:\Windows\System\gfPEsio.exe
  C:\Windows\System\gfPEsio.exe
  2⤵
  PID:7268
- C:\Windows\System\BTWFptW.exe
  C:\Windows\System\BTWFptW.exe
  2⤵
  PID:7864
- C:\Windows\System\ThfMLrH.exe
  C:\Windows\System\ThfMLrH.exe
  2⤵
  PID:5716
- C:\Windows\System\kfGHhYh.exe
  C:\Windows\System\kfGHhYh.exe
  2⤵
  PID:8200
- C:\Windows\System\MTlOHfb.exe
  C:\Windows\System\MTlOHfb.exe
  2⤵
  PID:8216
- C:\Windows\System\lVlnmPg.exe
  C:\Windows\System\lVlnmPg.exe
  2⤵
  PID:8232
- C:\Windows\System\VtUnGfh.exe
  C:\Windows\System\VtUnGfh.exe
  2⤵
  PID:8248
- C:\Windows\System\tYynSGf.exe
  C:\Windows\System\tYynSGf.exe
  2⤵
  PID:8264
- C:\Windows\System\XgUvzoP.exe
  C:\Windows\System\XgUvzoP.exe
  2⤵
  PID:8280
- C:\Windows\System\TYNNtGQ.exe
  C:\Windows\System\TYNNtGQ.exe
  2⤵
  PID:8300
- C:\Windows\System\EdiGKnA.exe
  C:\Windows\System\EdiGKnA.exe
  2⤵
  PID:8316
- C:\Windows\System\xmcgXwr.exe
  C:\Windows\System\xmcgXwr.exe
  2⤵
  PID:8336
- C:\Windows\System\tmNaqhd.exe
  C:\Windows\System\tmNaqhd.exe
  2⤵
  PID:8356
- C:\Windows\System\DzAWIcv.exe
  C:\Windows\System\DzAWIcv.exe
  2⤵
  PID:8372
- C:\Windows\System\CSzrBlU.exe
  C:\Windows\System\CSzrBlU.exe
  2⤵
  PID:8388
- C:\Windows\System\qaoPdeK.exe
  C:\Windows\System\qaoPdeK.exe
  2⤵
  PID:8404
- C:\Windows\System\YECGFjq.exe
  C:\Windows\System\YECGFjq.exe
  2⤵
  PID:8420
- C:\Windows\System\izniazC.exe
  C:\Windows\System\izniazC.exe
  2⤵
  PID:8436
- C:\Windows\System\rRViCln.exe
  C:\Windows\System\rRViCln.exe
  2⤵
  PID:8452
- C:\Windows\System\GPxWJoH.exe
  C:\Windows\System\GPxWJoH.exe
  2⤵
  PID:8468
- C:\Windows\System\fNNfBYc.exe
  C:\Windows\System\fNNfBYc.exe
  2⤵
  PID:8484
- C:\Windows\System\MDKipGI.exe
  C:\Windows\System\MDKipGI.exe
  2⤵
  PID:8500
- C:\Windows\System\yghcOvU.exe
  C:\Windows\System\yghcOvU.exe
  2⤵
  PID:8516
- C:\Windows\System\FeFhTWD.exe
  C:\Windows\System\FeFhTWD.exe
  2⤵
  PID:8532
- C:\Windows\System\RWJgUiJ.exe
  C:\Windows\System\RWJgUiJ.exe
  2⤵
  PID:8552
- C:\Windows\System\ARnrlnN.exe
  C:\Windows\System\ARnrlnN.exe
  2⤵
  PID:8568
- C:\Windows\System\cKUNOVK.exe
  C:\Windows\System\cKUNOVK.exe
  2⤵
  PID:8584
- C:\Windows\System\uwxvTYh.exe
  C:\Windows\System\uwxvTYh.exe
  2⤵
  PID:8600
- C:\Windows\System\IUukdFd.exe
  C:\Windows\System\IUukdFd.exe
  2⤵
  PID:8616
- C:\Windows\System\HfpHAGf.exe
  C:\Windows\System\HfpHAGf.exe
  2⤵
  PID:8688
- C:\Windows\System\weuTgWA.exe
  C:\Windows\System\weuTgWA.exe
  2⤵
  PID:8712
- C:\Windows\System\MBxPkYy.exe
  C:\Windows\System\MBxPkYy.exe
  2⤵
  PID:8728
- C:\Windows\System\NqQiVvJ.exe
  C:\Windows\System\NqQiVvJ.exe
  2⤵
  PID:8744
- C:\Windows\System\qGiILZS.exe
  C:\Windows\System\qGiILZS.exe
  2⤵
  PID:8760
- C:\Windows\System\ApgxLrq.exe
  C:\Windows\System\ApgxLrq.exe
  2⤵
  PID:8776
- C:\Windows\System\qTwzOat.exe
  C:\Windows\System\qTwzOat.exe
  2⤵
  PID:8792
- C:\Windows\System\UftfOwF.exe
  C:\Windows\System\UftfOwF.exe
  2⤵
  PID:8808
- C:\Windows\System\WqofTkz.exe
  C:\Windows\System\WqofTkz.exe
  2⤵
  PID:8824
- C:\Windows\System\wDvRyPw.exe
  C:\Windows\System\wDvRyPw.exe
  2⤵
  PID:8840
- C:\Windows\System\ZLtETza.exe
  C:\Windows\System\ZLtETza.exe
  2⤵
  PID:8856
- C:\Windows\System\CYLQIjE.exe
  C:\Windows\System\CYLQIjE.exe
  2⤵
  PID:8872
- C:\Windows\System\wllMOSg.exe
  C:\Windows\System\wllMOSg.exe
  2⤵
  PID:8888
- C:\Windows\System\GLzuWfb.exe
  C:\Windows\System\GLzuWfb.exe
  2⤵
  PID:8904
- C:\Windows\System\DvzslAv.exe
  C:\Windows\System\DvzslAv.exe
  2⤵
  PID:8920
- C:\Windows\System\deWIjQc.exe
  C:\Windows\System\deWIjQc.exe
  2⤵
  PID:8936
- C:\Windows\System\ZhYBTDF.exe
  C:\Windows\System\ZhYBTDF.exe
  2⤵
  PID:8952
- C:\Windows\System\eSOMbLC.exe
  C:\Windows\System\eSOMbLC.exe
  2⤵
  PID:8968
- C:\Windows\System\VkhRvaS.exe
  C:\Windows\System\VkhRvaS.exe
  2⤵
  PID:8984
- C:\Windows\System\ANuIHvx.exe
  C:\Windows\System\ANuIHvx.exe
  2⤵
  PID:9000
- C:\Windows\System\QpljDjZ.exe
  C:\Windows\System\QpljDjZ.exe
  2⤵
  PID:9016
- C:\Windows\System\lVGuttR.exe
  C:\Windows\System\lVGuttR.exe
  2⤵
  PID:9032
- C:\Windows\System\iNiOWhm.exe
  C:\Windows\System\iNiOWhm.exe
  2⤵
  PID:9048
- C:\Windows\System\UyPVaHB.exe
  C:\Windows\System\UyPVaHB.exe
  2⤵
  PID:9064
- C:\Windows\System\dzeJxrA.exe
  C:\Windows\System\dzeJxrA.exe
  2⤵
  PID:9080
- C:\Windows\System\LmmTGwR.exe
  C:\Windows\System\LmmTGwR.exe
  2⤵
  PID:9096
- C:\Windows\System\Scwymlu.exe
  C:\Windows\System\Scwymlu.exe
  2⤵
  PID:9112
- C:\Windows\System\PGfDemx.exe
  C:\Windows\System\PGfDemx.exe
  2⤵
  PID:9132
- C:\Windows\System\KfeQBKV.exe
  C:\Windows\System\KfeQBKV.exe
  2⤵
  PID:9148
- C:\Windows\System\hhLakXn.exe
  C:\Windows\System\hhLakXn.exe
  2⤵
  PID:9164
- C:\Windows\System\tNrxMlv.exe
  C:\Windows\System\tNrxMlv.exe
  2⤵
  PID:9180
- C:\Windows\System\RdwXiKV.exe
  C:\Windows\System\RdwXiKV.exe
  2⤵
  PID:9196
- C:\Windows\System\oVAqsOY.exe
  C:\Windows\System\oVAqsOY.exe
  2⤵
  PID:9212
- C:\Windows\System\nhtFMct.exe
  C:\Windows\System\nhtFMct.exe
  2⤵
  PID:7676
- C:\Windows\System\qPLlvZQ.exe
  C:\Windows\System\qPLlvZQ.exe
  2⤵
  PID:8260
- C:\Windows\System\XWfpVst.exe
  C:\Windows\System\XWfpVst.exe
  2⤵
  PID:8324
- C:\Windows\System\KsUeYDV.exe
  C:\Windows\System\KsUeYDV.exe
  2⤵
  PID:8308
- C:\Windows\System\ZbXIgnP.exe
  C:\Windows\System\ZbXIgnP.exe
  2⤵
  PID:8052
- C:\Windows\System\bGLKHij.exe
  C:\Windows\System\bGLKHij.exe
  2⤵
  PID:8244
- C:\Windows\System\eGWbGay.exe
  C:\Windows\System\eGWbGay.exe
  2⤵
  PID:8364
- C:\Windows\System\YbipWPp.exe
  C:\Windows\System\YbipWPp.exe
  2⤵
  PID:8428
- C:\Windows\System\WYCBJHf.exe
  C:\Windows\System\WYCBJHf.exe
  2⤵
  PID:8348
- C:\Windows\System\OQYBByB.exe
  C:\Windows\System\OQYBByB.exe
  2⤵
  PID:8412
- C:\Windows\System\IRZmQyw.exe
  C:\Windows\System\IRZmQyw.exe
  2⤵
  PID:8444
- C:\Windows\System\MdQkShN.exe
  C:\Windows\System\MdQkShN.exe
  2⤵
  PID:8508
- C:\Windows\System\TRDTBuZ.exe
  C:\Windows\System\TRDTBuZ.exe
  2⤵
  PID:8540
- C:\Windows\System\PtKnGrm.exe
  C:\Windows\System\PtKnGrm.exe
  2⤵
  PID:8564
- C:\Windows\System\CJtViND.exe
  C:\Windows\System\CJtViND.exe
  2⤵
  PID:8612
- C:\Windows\System\ZoSbZRe.exe
  C:\Windows\System\ZoSbZRe.exe
  2⤵
  PID:8628
- C:\Windows\System\vPAuGYO.exe
  C:\Windows\System\vPAuGYO.exe
  2⤵
  PID:8644
- C:\Windows\System\YYfuWyF.exe
  C:\Windows\System\YYfuWyF.exe
  2⤵
  PID:8668
- C:\Windows\System\WEmlQFy.exe
  C:\Windows\System\WEmlQFy.exe
  2⤵
  PID:8704
- C:\Windows\System\OUtHkEm.exe
  C:\Windows\System\OUtHkEm.exe
  2⤵
  PID:8752
- C:\Windows\System\ILZnRPX.exe
  C:\Windows\System\ILZnRPX.exe
  2⤵
  PID:8816
- C:\Windows\System\THCmiZR.exe
  C:\Windows\System\THCmiZR.exe
  2⤵
  PID:8880
- C:\Windows\System\zjBrKcm.exe
  C:\Windows\System\zjBrKcm.exe
  2⤵
  PID:8944
- C:\Windows\System\NyOSIet.exe
  C:\Windows\System\NyOSIet.exe
  2⤵
  PID:8832
- C:\Windows\System\AbNirHt.exe
  C:\Windows\System\AbNirHt.exe
  2⤵
  PID:8736
- C:\Windows\System\LEAdWnK.exe
  C:\Windows\System\LEAdWnK.exe
  2⤵
  PID:9012
- C:\Windows\System\ZJuyANr.exe
  C:\Windows\System\ZJuyANr.exe
  2⤵
  PID:9072
- C:\Windows\System\ArvPnJX.exe
  C:\Windows\System\ArvPnJX.exe
  2⤵
  PID:8740
- C:\Windows\System\wiAFXSC.exe
  C:\Windows\System\wiAFXSC.exe
  2⤵
  PID:8772
- C:\Windows\System\BtzDvvL.exe
  C:\Windows\System\BtzDvvL.exe
  2⤵
  PID:9088
- C:\Windows\System\jsDcgDr.exe
  C:\Windows\System\jsDcgDr.exe
  2⤵
  PID:8932
- C:\Windows\System\BfskMon.exe
  C:\Windows\System\BfskMon.exe
  2⤵
  PID:9144
- C:\Windows\System\eucujPb.exe
  C:\Windows\System\eucujPb.exe
  2⤵
  PID:9120
- C:\Windows\System\aAZbOgm.exe
  C:\Windows\System\aAZbOgm.exe
  2⤵
  PID:9204
- C:\Windows\System\nlUYRHj.exe
  C:\Windows\System\nlUYRHj.exe
  2⤵
  PID:9188
- C:\Windows\System\XVCnKSk.exe
  C:\Windows\System\XVCnKSk.exe
  2⤵
  PID:9192
- C:\Windows\System\OKipQeo.exe
  C:\Windows\System\OKipQeo.exe
  2⤵
  PID:8240
- C:\Windows\System\XHLLwul.exe
  C:\Windows\System\XHLLwul.exe
  2⤵
  PID:8448
- C:\Windows\System\oSWFvwR.exe
  C:\Windows\System\oSWFvwR.exe
  2⤵
  PID:8548
- C:\Windows\System\MsqzSyd.exe
  C:\Windows\System\MsqzSyd.exe
  2⤵
  PID:8196
- C:\Windows\System\laPKerC.exe
  C:\Windows\System\laPKerC.exe
  2⤵
  PID:8512
- C:\Windows\System\hRJNNiW.exe
  C:\Windows\System\hRJNNiW.exe
  2⤵
  PID:8656
- C:\Windows\System\cIGmKVh.exe
  C:\Windows\System\cIGmKVh.exe
  2⤵
  PID:8492
- C:\Windows\System\uKQvqnt.exe
  C:\Windows\System\uKQvqnt.exe
  2⤵
  PID:8724
- C:\Windows\System\qbwATzU.exe
  C:\Windows\System\qbwATzU.exe
  2⤵
  PID:8580
- C:\Windows\System\pyZcZDS.exe
  C:\Windows\System\pyZcZDS.exe
  2⤵
  PID:8700
- C:\Windows\System\oboOEop.exe
  C:\Windows\System\oboOEop.exe
  2⤵
  PID:8676
- C:\Windows\System\PZgzJID.exe
  C:\Windows\System\PZgzJID.exe
  2⤵
  PID:9108
- C:\Windows\System\qkclsMd.exe
  C:\Windows\System\qkclsMd.exe
  2⤵
  PID:9060
- C:\Windows\System\gOclmPa.exe
  C:\Windows\System\gOclmPa.exe
  2⤵
  PID:9128
- C:\Windows\System\PiawGnr.exe
  C:\Windows\System\PiawGnr.exe
  2⤵
  PID:8292
- C:\Windows\System\nUdDtTk.exe
  C:\Windows\System\nUdDtTk.exe
  2⤵
  PID:8344
- C:\Windows\System\VdHeYLw.exe
  C:\Windows\System\VdHeYLw.exe
  2⤵
  PID:8900
- C:\Windows\System\xysIqUe.exe
  C:\Windows\System\xysIqUe.exe
  2⤵
  PID:9028
- C:\Windows\System\kVfKOgT.exe
  C:\Windows\System\kVfKOgT.exe
  2⤵
  PID:8640
- C:\Windows\System\QMWCOWf.exe
  C:\Windows\System\QMWCOWf.exe
  2⤵
  PID:8768
- C:\Windows\System\lUFBgja.exe
  C:\Windows\System\lUFBgja.exe
  2⤵
  PID:8660
- C:\Windows\System\YsZZyRo.exe
  C:\Windows\System\YsZZyRo.exe
  2⤵
  PID:8720
- C:\Windows\System\DIXEcdv.exe
  C:\Windows\System\DIXEcdv.exe
  2⤵
  PID:8976
- C:\Windows\System\cBOVtdX.exe
  C:\Windows\System\cBOVtdX.exe
  2⤵
  PID:8896
- C:\Windows\System\HNnrMpI.exe
  C:\Windows\System\HNnrMpI.exe
  2⤵
  PID:8912
- C:\Windows\System\IUHFCXN.exe
  C:\Windows\System\IUHFCXN.exe
  2⤵
  PID:8256
- C:\Windows\System\MDmyesu.exe
  C:\Windows\System\MDmyesu.exe
  2⤵
  PID:8684
- C:\Windows\System\CkhyFED.exe
  C:\Windows\System\CkhyFED.exe
  2⤵
  PID:8868
- C:\Windows\System\XKTpxrm.exe
  C:\Windows\System\XKTpxrm.exe
  2⤵
  PID:8996
- C:\Windows\System\lurVPBZ.exe
  C:\Windows\System\lurVPBZ.exe
  2⤵
  PID:9172
- C:\Windows\System\XGghgeg.exe
  C:\Windows\System\XGghgeg.exe
  2⤵
  PID:9228
- C:\Windows\System\dNKkXfS.exe
  C:\Windows\System\dNKkXfS.exe
  2⤵
  PID:9244
- C:\Windows\System\KNGaANU.exe
  C:\Windows\System\KNGaANU.exe
  2⤵
  PID:9264
- C:\Windows\System\CLvLcXM.exe
  C:\Windows\System\CLvLcXM.exe
  2⤵
  PID:9280
- C:\Windows\System\axHpSju.exe
  C:\Windows\System\axHpSju.exe
  2⤵
  PID:9296
- C:\Windows\System\AiYqcIB.exe
  C:\Windows\System\AiYqcIB.exe
  2⤵
  PID:9312
- C:\Windows\System\vhYdmYI.exe
  C:\Windows\System\vhYdmYI.exe
  2⤵
  PID:9328
- C:\Windows\System\SEBgQIj.exe
  C:\Windows\System\SEBgQIj.exe
  2⤵
  PID:9344
- C:\Windows\System\ikPEvEN.exe
  C:\Windows\System\ikPEvEN.exe
  2⤵
  PID:9360
- C:\Windows\System\nmnLwWC.exe
  C:\Windows\System\nmnLwWC.exe
  2⤵
  PID:9376
- C:\Windows\System\sSQxRfA.exe
  C:\Windows\System\sSQxRfA.exe
  2⤵
  PID:9392
- C:\Windows\System\JPDSPPx.exe
  C:\Windows\System\JPDSPPx.exe
  2⤵
  PID:9408
- C:\Windows\System\NtVmrLn.exe
  C:\Windows\System\NtVmrLn.exe
  2⤵
  PID:9428
- C:\Windows\System\Erukwno.exe
  C:\Windows\System\Erukwno.exe
  2⤵
  PID:9444
- C:\Windows\System\ZuisDnf.exe
  C:\Windows\System\ZuisDnf.exe
  2⤵
  PID:9460
- C:\Windows\System\oiaykkJ.exe
  C:\Windows\System\oiaykkJ.exe
  2⤵
  PID:9476
- C:\Windows\System\YmzOTXB.exe
  C:\Windows\System\YmzOTXB.exe
  2⤵
  PID:9492
- C:\Windows\System\ENXZPiP.exe
  C:\Windows\System\ENXZPiP.exe
  2⤵
  PID:9508
- C:\Windows\System\vedpZEI.exe
  C:\Windows\System\vedpZEI.exe
  2⤵
  PID:9524
- C:\Windows\System\chYCRSm.exe
  C:\Windows\System\chYCRSm.exe
  2⤵
  PID:9540
- C:\Windows\System\xmtBczJ.exe
  C:\Windows\System\xmtBczJ.exe
  2⤵
  PID:9556
- C:\Windows\System\bbflNSp.exe
  C:\Windows\System\bbflNSp.exe
  2⤵
  PID:9572
- C:\Windows\System\iZSQmup.exe
  C:\Windows\System\iZSQmup.exe
  2⤵
  PID:9588
- C:\Windows\System\UGDnqGf.exe
  C:\Windows\System\UGDnqGf.exe
  2⤵
  PID:9604
- C:\Windows\System\WfBHQQx.exe
  C:\Windows\System\WfBHQQx.exe
  2⤵
  PID:9620
- C:\Windows\System\ThqgJuy.exe
  C:\Windows\System\ThqgJuy.exe
  2⤵
  PID:9636
- C:\Windows\System\fyYLZtE.exe
  C:\Windows\System\fyYLZtE.exe
  2⤵
  PID:9652
- C:\Windows\System\wrZKGyU.exe
  C:\Windows\System\wrZKGyU.exe
  2⤵
  PID:9668
- C:\Windows\System\ETiZYED.exe
  C:\Windows\System\ETiZYED.exe
  2⤵
  PID:9684
- C:\Windows\System\jlsznSK.exe
  C:\Windows\System\jlsznSK.exe
  2⤵
  PID:9700
- C:\Windows\System\UojosRC.exe
  C:\Windows\System\UojosRC.exe
  2⤵
  PID:9716
- C:\Windows\System\WcQUchk.exe
  C:\Windows\System\WcQUchk.exe
  2⤵
  PID:9732
- C:\Windows\System\VHXGwsJ.exe
  C:\Windows\System\VHXGwsJ.exe
  2⤵
  PID:9748
- C:\Windows\System\hAlTPlc.exe
  C:\Windows\System\hAlTPlc.exe
  2⤵
  PID:9764
- C:\Windows\System\aScpRbs.exe
  C:\Windows\System\aScpRbs.exe
  2⤵
  PID:9780
- C:\Windows\System\xNjSEdh.exe
  C:\Windows\System\xNjSEdh.exe
  2⤵
  PID:9796
- C:\Windows\System\pCqEhSF.exe
  C:\Windows\System\pCqEhSF.exe
  2⤵
  PID:9812
- C:\Windows\System\CtdugYY.exe
  C:\Windows\System\CtdugYY.exe
  2⤵
  PID:9828
- C:\Windows\System\TSBKxkX.exe
  C:\Windows\System\TSBKxkX.exe
  2⤵
  PID:9848
- C:\Windows\System\wPcjpPA.exe
  C:\Windows\System\wPcjpPA.exe
  2⤵
  PID:9864
- C:\Windows\System\eVLEvbd.exe
  C:\Windows\System\eVLEvbd.exe
  2⤵
  PID:9880
- C:\Windows\System\vLawqdk.exe
  C:\Windows\System\vLawqdk.exe
  2⤵
  PID:9908
- C:\Windows\System\NosTaak.exe
  C:\Windows\System\NosTaak.exe
  2⤵
  PID:9928
- C:\Windows\System\nuICUfk.exe
  C:\Windows\System\nuICUfk.exe
  2⤵
  PID:9944
- C:\Windows\System\nJKxhRr.exe
  C:\Windows\System\nJKxhRr.exe
  2⤵
  PID:9964
- C:\Windows\System\mLjPORx.exe
  C:\Windows\System\mLjPORx.exe
  2⤵
  PID:9984
- C:\Windows\System\WojscBc.exe
  C:\Windows\System\WojscBc.exe
  2⤵
  PID:10000
- C:\Windows\System\dgWZXqD.exe
  C:\Windows\System\dgWZXqD.exe
  2⤵
  PID:10016
- C:\Windows\System\AJcHfMN.exe
  C:\Windows\System\AJcHfMN.exe
  2⤵
  PID:10032
- C:\Windows\System\UjxIVNs.exe
  C:\Windows\System\UjxIVNs.exe
  2⤵
  PID:10052
- C:\Windows\System\bpxHVWM.exe
  C:\Windows\System\bpxHVWM.exe
  2⤵
  PID:10068
- C:\Windows\System\RNXltfh.exe
  C:\Windows\System\RNXltfh.exe
  2⤵
  PID:10084
- C:\Windows\System\kfvceUH.exe
  C:\Windows\System\kfvceUH.exe
  2⤵
  PID:10100
- C:\Windows\System\diBOjkJ.exe
  C:\Windows\System\diBOjkJ.exe
  2⤵
  PID:10116
- C:\Windows\System\gtxqAfK.exe
  C:\Windows\System\gtxqAfK.exe
  2⤵
  PID:10132
- C:\Windows\System\LAmmjWs.exe
  C:\Windows\System\LAmmjWs.exe
  2⤵
  PID:10148
- C:\Windows\System\NFIZEkc.exe
  C:\Windows\System\NFIZEkc.exe
  2⤵
  PID:10164
- C:\Windows\System\APJyaXL.exe
  C:\Windows\System\APJyaXL.exe
  2⤵
  PID:10180
- C:\Windows\System\TIOVstj.exe
  C:\Windows\System\TIOVstj.exe
  2⤵
  PID:10196
- C:\Windows\System\DFlgGWG.exe
  C:\Windows\System\DFlgGWG.exe
  2⤵
  PID:10220
- C:\Windows\System\VQEhqsl.exe
  C:\Windows\System\VQEhqsl.exe
  2⤵
  PID:10236
- C:\Windows\System\cFkNCaK.exe
  C:\Windows\System\cFkNCaK.exe
  2⤵
  PID:9044
- C:\Windows\System\bVMlKvr.exe
  C:\Windows\System\bVMlKvr.exe
  2⤵
  PID:7212
- C:\Windows\System\qZSzATX.exe
  C:\Windows\System\qZSzATX.exe
  2⤵
  PID:9276
- C:\Windows\System\YQIvuYs.exe
  C:\Windows\System\YQIvuYs.exe
  2⤵
  PID:9308
- C:\Windows\System\fjgzApl.exe
  C:\Windows\System\fjgzApl.exe
  2⤵
  PID:9224
- C:\Windows\System\JoWpelC.exe
  C:\Windows\System\JoWpelC.exe
  2⤵
  PID:9336
- C:\Windows\System\KmoEvwS.exe
  C:\Windows\System\KmoEvwS.exe
  2⤵
  PID:9400
- C:\Windows\System\VkLsGiz.exe
  C:\Windows\System\VkLsGiz.exe
  2⤵
  PID:9440
- C:\Windows\System\NEsaZMB.exe
  C:\Windows\System\NEsaZMB.exe
  2⤵
  PID:9416
- C:\Windows\System\podlWId.exe
  C:\Windows\System\podlWId.exe
  2⤵
  PID:9488
- C:\Windows\System\UICZsso.exe
  C:\Windows\System\UICZsso.exe
  2⤵
  PID:9516
- C:\Windows\System\cJWqRSl.exe
  C:\Windows\System\cJWqRSl.exe
  2⤵
  PID:9420
- C:\Windows\System\BjRUTGy.exe
  C:\Windows\System\BjRUTGy.exe
  2⤵
  PID:9568
- C:\Windows\System\cWkFZXA.exe
  C:\Windows\System\cWkFZXA.exe
  2⤵
  PID:9632
- C:\Windows\System\vjFoPHM.exe
  C:\Windows\System\vjFoPHM.exe
  2⤵
  PID:9616
- C:\Windows\System\qotQgIE.exe
  C:\Windows\System\qotQgIE.exe
  2⤵
  PID:9580
- C:\Windows\System\DFPIjMN.exe
  C:\Windows\System\DFPIjMN.exe
  2⤵
  PID:9692
- C:\Windows\System\gruNeqv.exe
  C:\Windows\System\gruNeqv.exe
  2⤵
  PID:9724
- C:\Windows\System\XAsnKwn.exe
  C:\Windows\System\XAsnKwn.exe
  2⤵
  PID:9760
- C:\Windows\System\bGdfnit.exe
  C:\Windows\System\bGdfnit.exe
  2⤵
  PID:9792
- C:\Windows\System\APcETLu.exe
  C:\Windows\System\APcETLu.exe
  2⤵
  PID:9824
- C:\Windows\System\NEscGGc.exe
  C:\Windows\System\NEscGGc.exe
  2⤵
  PID:9840
- C:\Windows\System\bWtgnvD.exe
  C:\Windows\System\bWtgnvD.exe
  2⤵
  PID:9876
- C:\Windows\System\qgUzjLa.exe
  C:\Windows\System\qgUzjLa.exe
  2⤵
  PID:9892
- C:\Windows\System\OHCvgvx.exe
  C:\Windows\System\OHCvgvx.exe
  2⤵
  PID:9940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CuhLUOQ.exe

Filesize
1.8MB

MD5
e5c8e6b7ce13aec1a049e932f94d0dda

SHA1
95f73f17bfed4321afb3be27acd1fcaf07441862

SHA256
1a7f5004bacd5a8964cfde55361077adb70a631442da255c72733a9fbe289998

SHA512
61b41a74ec45769e2130f69b6cb767b15e4a7b1782ee8a82a58fb668b607598100b08bfcab03a3c624379877719b57d8a572d880cac980592e634be184170926

Download Submit
C:\Windows\system\DcZfoGL.exe

Filesize
1.8MB

MD5
cd5264f3bc4a350f83a5f5508e84449e

SHA1
70033c2444fd8b837a53e0c1bcdebc7555612db1

SHA256
39efcad93fb87d46872e01efcd0cd02275adb15e3cd1998418c7ee9c4b35c7e2

SHA512
a5e435ef22cdf4764e64949ed5a93a9cff172ea972900df0806cec6a851247673dc27a34ecb6e903d6a9430f69fbd049fd8a450f7a928c7bc72d46014b73cc5b

Download Submit
C:\Windows\system\DdmAmdz.exe

Filesize
1.8MB

MD5
dd8985be526c7cc7edd8860b7f5fd945

SHA1
3fb989bb18b1468de8b31ce9aded4c51386454ce

SHA256
9f3e416c04d5b417f8c3cb7e8f2cb9f9ad9319a627f384579c13dccd00d73b7f

SHA512
5020981d00e2075817be0eaa9132b6076845f9c2c0a447bde1aa7c0539fb9401649bd9a8def38710960d04379d01d72183b609d1d89e4aa8ad1ed2302876147a

Download Submit
C:\Windows\system\FMtvvrK.exe

Filesize
1.8MB

MD5
036d7c2cfea472bc7e94aacd5ce3a5f9

SHA1
be96129e2ea4b83d025152e614da0be692a37763

SHA256
1b4559a66891f9b5e0623f40c8af211be034f74adba4b5f6ab9187b9a312162d

SHA512
6620e8ce32899f76a48f588e98b52be71c4a2a91441ffa86463f5a3338695ab26d1582de9f7dc47f51400abe33e5befbad1791c283f60ce8f60f3d49748fc259

Download Submit
C:\Windows\system\GzJHaoC.exe

Filesize
1.8MB

MD5
b57a9936d06bcf9de312e7ecba6307e7

SHA1
ab3dddaef2c803a33062193dd4db35c23e32e0e5

SHA256
e775f9547a0ca8937caf717c8f9f8ca46187579bdd85c5422f19b66a3136824f

SHA512
84989c32325e9921887adf40f89014dd70e86dc052b80edb56d8024ec1a65e981494369cfa8ba3a440779a2adbdf29002885a4137985d9dce0f9318c5ad4a814

Download Submit
C:\Windows\system\HstQClx.exe

Filesize
1.8MB

MD5
7dd2d97cf1abcb6be70ee242ef1c90e5

SHA1
dd202e58d3e3ce373396798f3a19c92ce2183d98

SHA256
34f8ee52146d4d15d1ea48ae019b99dcb92fabceb16fc16cb77d0a92133d4dda

SHA512
5307230efe50e3b810fe8c6faa1ae83a421d8526f9123e7a2c45f67a33b38289f8e399ef24bcdf795f1579a57a5a735bd7e397ff5bfac12693f7cad9e602777b

Download Submit
C:\Windows\system\IqCWIPQ.exe

Filesize
1.8MB

MD5
3afc5ede44ead3d65bb9c5b69a33241e

SHA1
625ce046e9778e5d39449b75d764b7612ee0999b

SHA256
04b79f74d7177ac92b740044917f1d7ad344dee7edbde76274b52b4166a261c2

SHA512
09630d091377e64b033a8c71e12ce3c6fa1e77081c4b4b9509a227dcf3741a27c0bdc3db0ac0355198cfd071fbe18906eec58fe19ee35041a8d0dcad1c1f8768

Download Submit
C:\Windows\system\KtMfCIS.exe

Filesize
1.8MB

MD5
c6a3f73faab9b99494f0cd4286c75d07

SHA1
a778def057278d3d789769d71c74ac9bcbe7846b

SHA256
1dd0e2c9b7a22ee6bfeb41bfeb05196ca15263d454ec933d35dfd8afca344da6

SHA512
82fc92a2f2aad8970913c08c73afbee797330cc7b1a67c35c9aba53eda711daea1728854251e48ddc058dabe88caf5ccd07014983262082bb8eb3b5786e16a7a

Download Submit
C:\Windows\system\LJBAEaV.exe

Filesize
1.8MB

MD5
7c31f45a635019c8aac954940a7adbec

SHA1
f6914992b4833eca061a760e206b01a939571355

SHA256
448c0f03465a154cc5767b87c9000f80fc7871ec05b8bc002c08ee71cc0236ac

SHA512
bf184f1eb89c7edf97abaa4b9f668ad06faf47a61affab4271f74bfd3774610251522d965e6b04073976ab84d4b1be05551dddf45bd14a52cbb1f9159c0eea48

Download Submit
C:\Windows\system\LgUmpET.exe

Filesize
1.8MB

MD5
f64ee66288a43fe5f2083af1b3373df8

SHA1
b612d44c9ff9e5cd8b59a3b495495a536c9aa49d

SHA256
cd001a07efa3392c4b9ae089bdd4e4590f6f2b4bffa83bb0cecc00026c5e5f0c

SHA512
b23ef9198172caec15f34e7fad7a51780ead18687cbcce0b2bcf3b750128b4d3bb3e1362ad3ea85ad40283b1bb56c35a901b003d99581e4dd355110e25eba461

Download Submit
C:\Windows\system\McWzoqX.exe

Filesize
1.8MB

MD5
30de1c42cfbca539b117612bf3934d73

SHA1
cb165ec6b1ab90a5ce3d8601ffa05cd4fe9e2d70

SHA256
ef25cc1c95539425e0dd4af8740863aafff73f63eca1bc1361395cd5d441e814

SHA512
954bb4d61d19326de268b38bec4ce7effc8977d33d9391ab3c015ac6644e139856b448ce85606f695edfde678253df1291678be3c703f74451d9abdc708375c7

Download Submit
C:\Windows\system\QacAvjb.exe

Filesize
1.8MB

MD5
97292c92a5b8f4234348ec2500d7ed60

SHA1
4d57083e8039532618b4c937c180c95fa6f983bf

SHA256
09109c60f028e6680b09370688c4e30fd72b0ed7d54eb0d0b4269233ab241b21

SHA512
683d05ae36ed4b2d91f61e9cecaf3eab8e9bd91c1a8a3966cca5dfac6495470727d42138b234acc032a0077b8b80d748ec2e00d89be8ad9ed1979f7bc866a582

Download Submit
C:\Windows\system\SjvrYWW.exe

Filesize
1.9MB

MD5
6ffdc980c62096051111c4913619c836

SHA1
4e673a9e831afb0ad472983cd9e353ed3854448b

SHA256
f59f42ba0627e383eee753b945cd1b5aa8eca0fccd03eccacb8f5836b39849be

SHA512
a885dd2d6b6004943e4e250131ce57e97517bb6f02924c6f809f59d241d9e97c25d6958ffb795e0a09c69b2ec0d984b1bf53f1624f1a7800db74e78c8b0cc653

Download Submit
C:\Windows\system\THsvqpR.exe

Filesize
1.8MB

MD5
08af2298517e5385b5bcdd89237cc782

SHA1
54b5aaad262712a70ad24b842b1ddc1589da2b7b

SHA256
4d4145fb705840c19adc8c7caf622afbb497d03918e792fedc1d9f82aa40ad6a

SHA512
a90028a77a16c723272cd2ee55dcfd2fe12be0a9c6e1891cd28e42965bdf4d4578a45d38335c25153061a70442c1e0b29c68d5c355001b894b9327581af2e15f

Download Submit
C:\Windows\system\XUOCdmn.exe

Filesize
1.8MB

MD5
763fcf7a1c18bc3912c104ef417114a6

SHA1
c2f1e0eade0abb1e35c884ec2fa3b8fe1a5b3fbb

SHA256
2e65b96bb642b266fe0f923fce57997cd60d52957facb66d05b9aec613343f3f

SHA512
53db1df585212d449b87628320d22ce3ba0dd10a17ca03287f5ec7cd780747240320cf1e813ff3e38e3320925e6bc51bbfb311e3a62fa8b1778c50395003ef25

Download Submit
C:\Windows\system\XlpHrEy.exe

Filesize
1.8MB

MD5
53c2217fa0413ce5ea8b398cd1269ac0

SHA1
884cc6abc2cc1a3acd41b6d9b5a5c944a69572b2

SHA256
12fc7c850adbd7298250cefe30e04b625e386abca20e419fd72e2238977867c5

SHA512
aa4fcb5a9c2068eb952a32e16166ab716fc54668b1c6061b3133675f32c7027822e29a14521902bc0afd28a95c8dcfc868408b0f35828a80faa595addf458667

Download Submit
C:\Windows\system\eNcFrIz.exe

Filesize
1.8MB

MD5
b91109e0d103295942eb704c50aeb1ad

SHA1
3fd3306bd07bdc5c83d416d0f25daf1242daf588

SHA256
5653aa2bdcc5b7fbcd8bfb437fea8b2c1e545432cf4aadbca04cce2dc8810239

SHA512
aa99f6eda9b3c5c2f5e8188c1d1c1ec4d6f985e4b644980491ee4381d9f763a3a6fbd08ac7ddf1d3579562bb8a6bbf345d467286522a7b05d1a57aeb71b8e117

Download Submit
C:\Windows\system\eUfCmgb.exe

Filesize
1.8MB

MD5
d79552cf99919ba8fd5c1546c40d19a7

SHA1
7af67c94e45b8d7d6c3e47d8397c83d70504ae84

SHA256
c7bf53fbbe39aa068ee4f47e358ece7f0362ca915159cc9f54f2cbcac0b70c68

SHA512
05e5117ed0b995548214ce0e27aaecf90df4ab2a87a79c37a6157e9ce777155815b659fc5f40bfcbd026e80b3a9a6f521b9017ce418034ed75b7284b4debfe89

Download Submit
C:\Windows\system\fTIXPvO.exe

Filesize
1.9MB

MD5
8eb5989c29608220b278b01f1dd7e8dc

SHA1
968e70c2d86ec3d76c10e375a451b5146c593e60

SHA256
01bc87a49783b83908ddb0f3e3596d85e0b61949b473aeee97acbc76f0d24515

SHA512
b0d05612e215c1ed973002598ad9e3e076757dbe069c0cf19ebb02cf24cf6040067eef88283ab9f40b7f44f86fbd98552f3df07acd1d73944f35336216e7c80b

Download Submit
C:\Windows\system\lZEdBEf.exe

Filesize
1.8MB

MD5
71acd1edd55df5fcba70a937192fefab

SHA1
ba4602e46e4e9d79d21921718d5f215b3819d34d

SHA256
624fcaf0d1cc9c39951c8c02786794c269332a38c1633cfecffe0f6e66d96d03

SHA512
a0db25d463adc4a8277d6293a0db934f7792e7a52e70d8fd960defb9f0df91f8d3df57b013eca35575b1f2dcde9636fc8634e6d8280b8014e1ac3f46c3c4b4a1

Download Submit
C:\Windows\system\soXmDwv.exe

Filesize
1.8MB

MD5
495bcc3cea274b429732557e41c950f4

SHA1
29511af1d1e31076780b9fa82c47adf80e232bb3

SHA256
c2cc3acee66e98bc1a5e895fa669b7f5f70f9847a688725b477d6f2e099e1961

SHA512
d06fa46742ab2c0fc026af76fcbd0d1e64ba2bef59179b91e9e5277c939d7204951d297c139231d957cc7d8aa4793d3540a801d09439ea8f19c7eaa8798c9761

Download Submit
C:\Windows\system\tfsXRZR.exe

Filesize
1.8MB

MD5
0a39235591457829dff29c2374ca2050

SHA1
0d36e48fc5230430897185460a7f340b8285a15f

SHA256
e4d88d6fe4c19284d4d5effd6ac05a71f008326156dfbe495792b3c7c13becf7

SHA512
4a71a77a09458f046077d4de7910d3a276bfa3b95bc8e06fdb624bf42b96e80b1f0450ea8641aa475497b3a8b7cd7d219617feeec4eb96f8d2c68ef5dc945f97

Download Submit
C:\Windows\system\thrbqQe.exe

Filesize
1.8MB

MD5
17e2fb23cab99bed357ffd2207888d9a

SHA1
2c117dbbb28ae03573b9611d671ac11a8b0e8800

SHA256
cd9c2c3f7a56fa741c0bc2e8bfd4e067bea40d7307fa3ab87d7a96f9c39b9226

SHA512
383da508d322b0ba47285fce3bda18f3ea91e123f17702b84ca12a2893eb2d4c480681fc04ddc95d45115c28d9186ea2f6aa7daee12da467df4399d683c84460

Download Submit
C:\Windows\system\wpJTHgC.exe

Filesize
1.8MB

MD5
5c400179664b02950323d516f06cbd46

SHA1
35305b48c5975e7da9ad27a2964726d1046aa003

SHA256
5e30eaa89d35d9a1191d06f7e98a2a32b1a9da991413a4e20118a067242ca7df

SHA512
997837a99757222360814c88cb417d67e5a610e37d0e94090b07b893611a7fa2bac774cfe8bc38354f4fb7c74f937b96b6ea32437d7231f9d393f03c56cd96de

Download Submit
C:\Windows\system\xpAFpBt.exe

Filesize
1.8MB

MD5
2edcd115788639a93178469d5e98c7f8

SHA1
b7229f3ff3a84e54c78683566e0c45e0c0b565a0

SHA256
1a20a4a0eec6899c51852c23756bc4a7c2f77cc8aefa0dbcc9e69f8857e42f5e

SHA512
12a8255c0c39678e3e6ea7805811e3c2430c92526206f8ec19e71bc2c11d90ec479f388a9f1dd48bdfbb870709ad2fa620839a2fa80ef8b5f4d1c958a149416c

Download Submit
C:\Windows\system\yMDQmuP.exe

Filesize
1.8MB

MD5
10d55f15593297136abbbaf39080d0e0

SHA1
ee3a55a37a245be98e38649f020a1e1aec68d752

SHA256
d528679dd27b2f66e7e2391e9cf0898f9100338d7f02635b3396b069f46a8152

SHA512
6ce3b67aea4f825af8249061232a80443793fcb310c1702572c49ef33212beaf25653175a6b026a05ccab56426a40b5b9acca16a1d7131100211b69e99c55ea4

Download Submit
\Windows\system\CgXjztl.exe

Filesize
1.8MB

MD5
a0afe99202d97be808deabef2c1c9428

SHA1
c9d5d31c2b6feba3aeb8dfe0ea7c01c38f0cdcd3

SHA256
ae9bb46781b8d2040cebc0b72a9870d1b29ac350ccc69378781feb9993eba9d0

SHA512
c953d797b51c88d4748a964d04257f28164ccc183f67a0eea291fe3cfb12ad29d72b1d8d2c9b5166ea3da857bde202d8126c6c0a796ef35f56a148eed27a3bd1

Download Submit
\Windows\system\HqXlxSq.exe

Filesize
1.8MB

MD5
26c8438e9652dc8b3d2142bdcc8c2d9a

SHA1
5ffb0f14f749c4c512f79b532a21cf6895672ec2

SHA256
fff2b181453d2db7e36f8962d755be22fc7c006a4399903903f44ce65084910c

SHA512
d7813900da25315a405434a4618dde58492c4a2f79fe1d0ed72a20c1fa80ddb75f01e194b4b78652a4b5e7ec83e13c35a3a1abc03615dd266bf9b9e46d741464

Download Submit
\Windows\system\LbBuDmv.exe

Filesize
1.8MB

MD5
b68d21a9eabf8b49ef8434d597a98568

SHA1
f453ce37aa8c94256c733df0d625b34c8b2dabac

SHA256
2fa7f19078780901cec2785b89c26447c6c8be2b47c38143a74789abc4c5b495

SHA512
561ba44857306def24e66e312ae713f8f60b72605f765a85863cd94d4d057022cca83d5d3cb868264430cac8fa7c52eba419e5fe3cbb952df886e8501fea04c3

Download Submit
\Windows\system\NrNByZR.exe

Filesize
1.8MB

MD5
b329a797d6ec7d4bc822fd22d7e26709

SHA1
c3dc07b1abfec7946fc451d3366bf72c7b3edf63

SHA256
b0e04ec7c27bf439f81a81af6ff15625a7de4f89c4329b20f65fca9badc7b55e

SHA512
8a33cc1b05b35c091097c726fee5ac499629dc964da693d6ebedb7b2b5f6c3b2f4db2811aacc0ee16e770c0fe3249d906cbe9f54da87d42d2dce6272ab696bbc

Download Submit
\Windows\system\YoLiBGk.exe

Filesize
1.8MB

MD5
438e5aeb0a030887d3026d26d4708f49

SHA1
909b94142ba73d37c2391a8bd6796d0e50b567ea

SHA256
ef716d5b2cc83ce8736158d38244737a4a2205711d69f28542c918174575d482

SHA512
3848d61d76d6daba4da4b4b373885b13f4db3897d7c62fa6c0f4d72383a9d01283bebaa28b4aa6d990e6fe26cb01d669f5a7c53c9239cab1bba187548ecb98fc

Download Submit
\Windows\system\aQCaPlT.exe

Filesize
1.8MB

MD5
5a59144ffd3e30e4d108b480a44fea54

SHA1
2e6eeda2d424520ffbed579b2e913ee217cf2318

SHA256
822a4673ae31f9cf080c052cd6f1b436af5372f2f62da29f99dc553f4db66fc8

SHA512
2f136c7af83cafa9fae5539bd97b4bab705f047740fdc62ea6a49969b1998448b6bc94bafd2cc205d400476698f8004433d2edecf84f3ab9b6c4ca22fccc5037

Download Submit
memory/1284-14-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/1284-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1284-74-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1284-49-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/1284-77-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/1284-1-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-108-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/1284-2218-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-83-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-75-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/1284-82-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-52-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/1284-67-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/1284-79-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/1284-73-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/1736-877-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/1736-955-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2300-81-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-80-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2656-31-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2672-78-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download
memory/2748-76-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2760-109-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2768-27-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2808-41-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2864-60-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/3064-39-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download