xmrig | 952c9ee29ef8765d80890fa1cd48cbdbac1bcee55a8122a53f8310b4799f4324

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
Size

2.1MB
MD5

08d9bc85657695ead9ee800f939aa5c7
SHA1

a41b35355824b757ef930ab53bcf3fccbbf59d89
SHA256

952c9ee29ef8765d80890fa1cd48cbdbac1bcee55a8122a53f8310b4799f4324
SHA512

46a44181a9ee47e9b85211e72b798df058bb2ccda7aaa68ba835774994807b2ddce4849c47dd5077f20358c5374af26433ed42aeafc23f0e51d3ebe9b97a2217
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qr9:NABg

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2568-34-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2472-61-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/2664-86-0x000000013FE00000-0x00000001401F2000-memory.dmp	xmrig
behavioral1/memory/548-109-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2788-87-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2208-75-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2172-68-0x000000013F3A0000-0x000000013F792000-memory.dmp	xmrig
behavioral1/memory/2208-82-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/3056-80-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2444-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2552-52-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2616-876-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2620-16-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2620	jYOVMYU.exe
3056	CDLiesm.exe
2568	qZZbGbR.exe
2664	fvVMOTb.exe
2616	foYKAsV.exe
2552	BfzulSV.exe
2444	MmBWNVC.exe
2472	CYXNdiG.exe
2172	sxgpTBm.exe
2336	OoblWcA.exe
2788	casEiNj.exe
548	CXzJpZi.exe
2864	OXwOzla.exe
1944	HBzeIMw.exe
908	JdvkXMm.exe
1356	kIDZkzB.exe
1580	OZYArzS.exe
2096	BfSQvUt.exe
552	wQuJnpo.exe
2984	HJRtrPR.exe
2256	seHXfLw.exe
1976	WLyIwmU.exe
2896	cuYRmTV.exe
1728	nJZBuFs.exe
596	vfRoTid.exe
1044	crrEczl.exe
1108	OmFdgnB.exe
1652	IGqZtjh.exe
2852	vitCPEX.exe
616	lkyzAgW.exe
696	NWZseaA.exe
2408	qwXlNXu.exe
2252	IgRAecz.exe
2152	sPpAZOZ.exe
2020	YVCCmFQ.exe
1360	EeFtlGe.exe
1556	VSCwLIe.exe
1936	sSljVDb.exe
1304	SvpWxEv.exe
1868	rDttMIw.exe
1332	wkpvJry.exe
404	VGtkRBv.exe
1224	PuHpvJF.exe
928	OsYupNk.exe
1028	HKnAQQl.exe
2136	OlLaXqo.exe
2944	toKvSHr.exe
2924	NVWpkLR.exe
788	TKsQyXX.exe
620	kgeUDJe.exe
1696	xpFFUeV.exe
1716	GIEJoEL.exe
2872	jdIUZgR.exe
892	GsatOtN.exe
1512	YoRUXxR.exe
2524	Fgditpe.exe
2068	PJywwVK.exe
1608	TWOwekq.exe
1720	MMJtTWt.exe
3048	ApCUNQH.exe
1396	GgjlVVe.exe
2648	ANvwWZf.exe
1312	RsNWtel.exe
2724	dOvJJLU.exe

Loads dropped DLL 64 IoCs

pid	Process
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2208-0-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x000b00000001565d-3.dat	upx
behavioral1/files/0x0007000000015d20-17.dat	upx
behavioral1/files/0x0007000000015cff-22.dat	upx
behavioral1/files/0x0007000000015d42-35.dat	upx
behavioral1/memory/2568-34-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-42.dat	upx
behavioral1/files/0x000a000000015d56-44.dat	upx
behavioral1/files/0x0006000000016616-60.dat	upx
behavioral1/memory/2472-61-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x0006000000016adc-79.dat	upx
behavioral1/memory/2664-86-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x0006000000016c44-90.dat	upx
behavioral1/files/0x0006000000016c5e-94.dat	upx
behavioral1/files/0x0006000000016cb0-108.dat	upx
behavioral1/files/0x0034000000015ccd-116.dat	upx
behavioral1/files/0x0006000000016d18-126.dat	upx
behavioral1/files/0x0006000000016cdc-121.dat	upx
behavioral1/files/0x0006000000016c64-97.dat	upx
behavioral1/memory/548-109-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2788-87-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/memory/2336-78-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/2208-75-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0006000000016851-70.dat	upx
behavioral1/memory/2172-68-0x000000013F3A0000-0x000000013F792000-memory.dmp	upx
behavioral1/memory/3056-80-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x000800000001658a-59.dat	upx
behavioral1/memory/2444-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2552-52-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/files/0x0006000000016d07-123.dat	upx
behavioral1/files/0x0006000000016d3a-141.dat	upx
behavioral1/files/0x0006000000016d43-150.dat	upx
behavioral1/files/0x0006000000016db9-177.dat	upx
behavioral1/files/0x0006000000016dbe-181.dat	upx
behavioral1/memory/2616-876-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x0006000000016db1-174.dat	upx
behavioral1/files/0x0006000000016da5-169.dat	upx
behavioral1/files/0x0006000000016d9d-165.dat	upx
behavioral1/files/0x0006000000016d8e-161.dat	upx
behavioral1/files/0x0006000000016d74-158.dat	upx
behavioral1/files/0x0006000000016d5f-153.dat	upx
behavioral1/files/0x0006000000016d3e-145.dat	upx
behavioral1/files/0x0006000000016d34-137.dat	upx
behavioral1/files/0x0006000000016d20-134.dat	upx
behavioral1/memory/2208-36-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2664-26-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/memory/3056-21-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2620-16-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/files/0x0034000000015cb6-12.dat	upx
behavioral1/memory/2208-7-0x000000013F480000-0x000000013F872000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xmSCrSp.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\NjAkgDh.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\kqAjUaL.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\zAZjjGn.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\fvVMOTb.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\QZemEOa.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\KsFbbYE.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\TXtMNQw.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\qqffynv.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\TUlnYjV.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\HCHBDQi.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ALPTSIv.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VAVzUwM.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\GWGICnj.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\TpaEbkU.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VpPMQkc.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XeEOysh.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wvhYVaN.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\YeQAIXM.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\LynHAVk.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XCqhWKA.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\EdrjsPc.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\cLKphug.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\hCOJkHO.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\idboAtu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XSlCkCD.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\UzRohQI.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\kXkhiqy.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\pkbsebS.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\cOlnafI.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VuMiVpV.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\OSPAHlf.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ElXJogM.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\GIEJoEL.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VaScVlY.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\PLYAHYL.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\SAaCrkK.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\UpIdGik.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\HRQXAKC.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\ICKhLFE.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\sraGLiT.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\CJzzMKK.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\jEfAZbh.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\cXniYtp.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\OtVUJWy.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\XjoZqFA.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wVCcXnu.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\JqLdjEy.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\AiZcgIU.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\iftLqAd.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\SFQWkjZ.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\kXXFvaD.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\PJywwVK.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\trLzEjT.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\JSBpPSp.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\fjppHDw.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\lTfqcBR.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wqfLiyU.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\aMdIPES.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\VBEqXSv.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\wYXaarh.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\AazrQms.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\nlQWQMW.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
File created	C:\Windows\System\hOTpMnL.exe	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2156	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
Token: SeDebugPrivilege	2156	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2156	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2156	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2156	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	29
PID 2208 wrote to memory of 2620	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2620	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	30
PID 2208 wrote to memory of 2620	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	30
PID 2208 wrote to memory of 3056	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	31
PID 2208 wrote to memory of 3056	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	31
PID 2208 wrote to memory of 3056	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	31
PID 2208 wrote to memory of 2568	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	32
PID 2208 wrote to memory of 2568	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	32
PID 2208 wrote to memory of 2568	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	32
PID 2208 wrote to memory of 2664	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2664	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2664	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	33
PID 2208 wrote to memory of 2616	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2616	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2616	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	34
PID 2208 wrote to memory of 2552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	35
PID 2208 wrote to memory of 2444	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2444	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2444	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	36
PID 2208 wrote to memory of 2472	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2472	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2472	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	37
PID 2208 wrote to memory of 2172	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2172	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2172	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	38
PID 2208 wrote to memory of 2336	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2336	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2336	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	39
PID 2208 wrote to memory of 2788	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	40
PID 2208 wrote to memory of 2788	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	40
PID 2208 wrote to memory of 2788	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	40
PID 2208 wrote to memory of 548	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	41
PID 2208 wrote to memory of 548	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	41
PID 2208 wrote to memory of 548	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	41
PID 2208 wrote to memory of 2864	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	42
PID 2208 wrote to memory of 2864	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	42
PID 2208 wrote to memory of 2864	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	42
PID 2208 wrote to memory of 908	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	43
PID 2208 wrote to memory of 908	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	43
PID 2208 wrote to memory of 908	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	43
PID 2208 wrote to memory of 1944	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	44
PID 2208 wrote to memory of 1944	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	44
PID 2208 wrote to memory of 1944	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	44
PID 2208 wrote to memory of 1580	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	45
PID 2208 wrote to memory of 1580	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	45
PID 2208 wrote to memory of 1580	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	45
PID 2208 wrote to memory of 1356	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	46
PID 2208 wrote to memory of 1356	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	46
PID 2208 wrote to memory of 1356	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	46
PID 2208 wrote to memory of 552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	47
PID 2208 wrote to memory of 552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	47
PID 2208 wrote to memory of 552	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	47
PID 2208 wrote to memory of 2096	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	48
PID 2208 wrote to memory of 2096	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	48
PID 2208 wrote to memory of 2096	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	48
PID 2208 wrote to memory of 2984	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	49
PID 2208 wrote to memory of 2984	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	49
PID 2208 wrote to memory of 2984	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	49
PID 2208 wrote to memory of 2256	2208	08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08d9bc85657695ead9ee800f939aa5c7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\System\jYOVMYU.exe
  C:\Windows\System\jYOVMYU.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\CDLiesm.exe
  C:\Windows\System\CDLiesm.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\qZZbGbR.exe
  C:\Windows\System\qZZbGbR.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\fvVMOTb.exe
  C:\Windows\System\fvVMOTb.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\foYKAsV.exe
  C:\Windows\System\foYKAsV.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\BfzulSV.exe
  C:\Windows\System\BfzulSV.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\MmBWNVC.exe
  C:\Windows\System\MmBWNVC.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\CYXNdiG.exe
  C:\Windows\System\CYXNdiG.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\sxgpTBm.exe
  C:\Windows\System\sxgpTBm.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\OoblWcA.exe
  C:\Windows\System\OoblWcA.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\casEiNj.exe
  C:\Windows\System\casEiNj.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\CXzJpZi.exe
  C:\Windows\System\CXzJpZi.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\OXwOzla.exe
  C:\Windows\System\OXwOzla.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\JdvkXMm.exe
  C:\Windows\System\JdvkXMm.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\HBzeIMw.exe
  C:\Windows\System\HBzeIMw.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OZYArzS.exe
  C:\Windows\System\OZYArzS.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\kIDZkzB.exe
  C:\Windows\System\kIDZkzB.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\wQuJnpo.exe
  C:\Windows\System\wQuJnpo.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\BfSQvUt.exe
  C:\Windows\System\BfSQvUt.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\HJRtrPR.exe
  C:\Windows\System\HJRtrPR.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\seHXfLw.exe
  C:\Windows\System\seHXfLw.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\WLyIwmU.exe
  C:\Windows\System\WLyIwmU.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\cuYRmTV.exe
  C:\Windows\System\cuYRmTV.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\nJZBuFs.exe
  C:\Windows\System\nJZBuFs.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\vfRoTid.exe
  C:\Windows\System\vfRoTid.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\crrEczl.exe
  C:\Windows\System\crrEczl.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\OmFdgnB.exe
  C:\Windows\System\OmFdgnB.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\IGqZtjh.exe
  C:\Windows\System\IGqZtjh.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\vitCPEX.exe
  C:\Windows\System\vitCPEX.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\lkyzAgW.exe
  C:\Windows\System\lkyzAgW.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\NWZseaA.exe
  C:\Windows\System\NWZseaA.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\qwXlNXu.exe
  C:\Windows\System\qwXlNXu.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\IgRAecz.exe
  C:\Windows\System\IgRAecz.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\sPpAZOZ.exe
  C:\Windows\System\sPpAZOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\YVCCmFQ.exe
  C:\Windows\System\YVCCmFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\EeFtlGe.exe
  C:\Windows\System\EeFtlGe.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\VSCwLIe.exe
  C:\Windows\System\VSCwLIe.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\sSljVDb.exe
  C:\Windows\System\sSljVDb.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\SvpWxEv.exe
  C:\Windows\System\SvpWxEv.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\rDttMIw.exe
  C:\Windows\System\rDttMIw.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\wkpvJry.exe
  C:\Windows\System\wkpvJry.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\VGtkRBv.exe
  C:\Windows\System\VGtkRBv.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\PuHpvJF.exe
  C:\Windows\System\PuHpvJF.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\OsYupNk.exe
  C:\Windows\System\OsYupNk.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\HKnAQQl.exe
  C:\Windows\System\HKnAQQl.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\OlLaXqo.exe
  C:\Windows\System\OlLaXqo.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\toKvSHr.exe
  C:\Windows\System\toKvSHr.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\NVWpkLR.exe
  C:\Windows\System\NVWpkLR.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\TKsQyXX.exe
  C:\Windows\System\TKsQyXX.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\kgeUDJe.exe
  C:\Windows\System\kgeUDJe.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\xpFFUeV.exe
  C:\Windows\System\xpFFUeV.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\GIEJoEL.exe
  C:\Windows\System\GIEJoEL.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\jdIUZgR.exe
  C:\Windows\System\jdIUZgR.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\GsatOtN.exe
  C:\Windows\System\GsatOtN.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\YoRUXxR.exe
  C:\Windows\System\YoRUXxR.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\Fgditpe.exe
  C:\Windows\System\Fgditpe.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\PJywwVK.exe
  C:\Windows\System\PJywwVK.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\TWOwekq.exe
  C:\Windows\System\TWOwekq.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\MMJtTWt.exe
  C:\Windows\System\MMJtTWt.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ApCUNQH.exe
  C:\Windows\System\ApCUNQH.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\GgjlVVe.exe
  C:\Windows\System\GgjlVVe.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\ANvwWZf.exe
  C:\Windows\System\ANvwWZf.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\RsNWtel.exe
  C:\Windows\System\RsNWtel.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\dOvJJLU.exe
  C:\Windows\System\dOvJJLU.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\iFUZmxs.exe
  C:\Windows\System\iFUZmxs.exe
  2⤵
  PID:2460
- C:\Windows\System\iIZWaqD.exe
  C:\Windows\System\iIZWaqD.exe
  2⤵
  PID:2440
- C:\Windows\System\FjwvEpz.exe
  C:\Windows\System\FjwvEpz.exe
  2⤵
  PID:2964
- C:\Windows\System\RfNeQYr.exe
  C:\Windows\System\RfNeQYr.exe
  2⤵
  PID:1528
- C:\Windows\System\ZMFtuau.exe
  C:\Windows\System\ZMFtuau.exe
  2⤵
  PID:1756
- C:\Windows\System\HifqlzM.exe
  C:\Windows\System\HifqlzM.exe
  2⤵
  PID:2176
- C:\Windows\System\nxXXfTF.exe
  C:\Windows\System\nxXXfTF.exe
  2⤵
  PID:1536
- C:\Windows\System\ldXXmdV.exe
  C:\Windows\System\ldXXmdV.exe
  2⤵
  PID:2012
- C:\Windows\System\uKixuQs.exe
  C:\Windows\System\uKixuQs.exe
  2⤵
  PID:1416
- C:\Windows\System\sraGLiT.exe
  C:\Windows\System\sraGLiT.exe
  2⤵
  PID:2644
- C:\Windows\System\IwbKIeD.exe
  C:\Windows\System\IwbKIeD.exe
  2⤵
  PID:2076
- C:\Windows\System\upzxQyy.exe
  C:\Windows\System\upzxQyy.exe
  2⤵
  PID:856
- C:\Windows\System\MuBewdI.exe
  C:\Windows\System\MuBewdI.exe
  2⤵
  PID:1520
- C:\Windows\System\ZcXbPHx.exe
  C:\Windows\System\ZcXbPHx.exe
  2⤵
  PID:2976
- C:\Windows\System\ePSdNeS.exe
  C:\Windows\System\ePSdNeS.exe
  2⤵
  PID:2656
- C:\Windows\System\IwibjSI.exe
  C:\Windows\System\IwibjSI.exe
  2⤵
  PID:2628
- C:\Windows\System\pweYOgQ.exe
  C:\Windows\System\pweYOgQ.exe
  2⤵
  PID:796
- C:\Windows\System\ogyFiDG.exe
  C:\Windows\System\ogyFiDG.exe
  2⤵
  PID:1480
- C:\Windows\System\quQWVMW.exe
  C:\Windows\System\quQWVMW.exe
  2⤵
  PID:2848
- C:\Windows\System\ceThXtd.exe
  C:\Windows\System\ceThXtd.exe
  2⤵
  PID:1704
- C:\Windows\System\WUStOsq.exe
  C:\Windows\System\WUStOsq.exe
  2⤵
  PID:2044
- C:\Windows\System\KJvnYHu.exe
  C:\Windows\System\KJvnYHu.exe
  2⤵
  PID:1320
- C:\Windows\System\lxTDlOj.exe
  C:\Windows\System\lxTDlOj.exe
  2⤵
  PID:1772
- C:\Windows\System\iRbjRwA.exe
  C:\Windows\System\iRbjRwA.exe
  2⤵
  PID:1620
- C:\Windows\System\fAYRYOL.exe
  C:\Windows\System\fAYRYOL.exe
  2⤵
  PID:1824
- C:\Windows\System\suxelTa.exe
  C:\Windows\System\suxelTa.exe
  2⤵
  PID:1692
- C:\Windows\System\rkfFKNK.exe
  C:\Windows\System\rkfFKNK.exe
  2⤵
  PID:944
- C:\Windows\System\OHSyJoQ.exe
  C:\Windows\System\OHSyJoQ.exe
  2⤵
  PID:3040
- C:\Windows\System\Srcmbza.exe
  C:\Windows\System\Srcmbza.exe
  2⤵
  PID:2928
- C:\Windows\System\vaPUqTt.exe
  C:\Windows\System\vaPUqTt.exe
  2⤵
  PID:1648
- C:\Windows\System\ZvYcMDI.exe
  C:\Windows\System\ZvYcMDI.exe
  2⤵
  PID:1284
- C:\Windows\System\DJjbyZk.exe
  C:\Windows\System\DJjbyZk.exe
  2⤵
  PID:2676
- C:\Windows\System\tYatudz.exe
  C:\Windows\System\tYatudz.exe
  2⤵
  PID:3004
- C:\Windows\System\nvODIVi.exe
  C:\Windows\System\nvODIVi.exe
  2⤵
  PID:1600
- C:\Windows\System\mYPYDwl.exe
  C:\Windows\System\mYPYDwl.exe
  2⤵
  PID:2548
- C:\Windows\System\jGTdtow.exe
  C:\Windows\System\jGTdtow.exe
  2⤵
  PID:2880
- C:\Windows\System\ksFoKia.exe
  C:\Windows\System\ksFoKia.exe
  2⤵
  PID:2584
- C:\Windows\System\rpARYth.exe
  C:\Windows\System\rpARYth.exe
  2⤵
  PID:860
- C:\Windows\System\MMbSfQD.exe
  C:\Windows\System\MMbSfQD.exe
  2⤵
  PID:2604
- C:\Windows\System\UEUqEEr.exe
  C:\Windows\System\UEUqEEr.exe
  2⤵
  PID:2492
- C:\Windows\System\ZuzXlJN.exe
  C:\Windows\System\ZuzXlJN.exe
  2⤵
  PID:2752
- C:\Windows\System\fjppHDw.exe
  C:\Windows\System\fjppHDw.exe
  2⤵
  PID:2496
- C:\Windows\System\oGDIiEn.exe
  C:\Windows\System\oGDIiEn.exe
  2⤵
  PID:636
- C:\Windows\System\lTfqcBR.exe
  C:\Windows\System\lTfqcBR.exe
  2⤵
  PID:2028
- C:\Windows\System\xFrbxVD.exe
  C:\Windows\System\xFrbxVD.exe
  2⤵
  PID:2220
- C:\Windows\System\pdWNMzI.exe
  C:\Windows\System\pdWNMzI.exe
  2⤵
  PID:1984
- C:\Windows\System\RhcdidU.exe
  C:\Windows\System\RhcdidU.exe
  2⤵
  PID:1912
- C:\Windows\System\kWBRhtZ.exe
  C:\Windows\System\kWBRhtZ.exe
  2⤵
  PID:324
- C:\Windows\System\eFIWbwt.exe
  C:\Windows\System\eFIWbwt.exe
  2⤵
  PID:452
- C:\Windows\System\HsePJlD.exe
  C:\Windows\System\HsePJlD.exe
  2⤵
  PID:2100
- C:\Windows\System\wYXaarh.exe
  C:\Windows\System\wYXaarh.exe
  2⤵
  PID:1340
- C:\Windows\System\tckCqTu.exe
  C:\Windows\System\tckCqTu.exe
  2⤵
  PID:2296
- C:\Windows\System\dhMySck.exe
  C:\Windows\System\dhMySck.exe
  2⤵
  PID:2652
- C:\Windows\System\ACtfoCi.exe
  C:\Windows\System\ACtfoCi.exe
  2⤵
  PID:2920
- C:\Windows\System\IZQCzdc.exe
  C:\Windows\System\IZQCzdc.exe
  2⤵
  PID:1628
- C:\Windows\System\idboAtu.exe
  C:\Windows\System\idboAtu.exe
  2⤵
  PID:2124
- C:\Windows\System\HHVRKDU.exe
  C:\Windows\System\HHVRKDU.exe
  2⤵
  PID:3012
- C:\Windows\System\TUlnYjV.exe
  C:\Windows\System\TUlnYjV.exe
  2⤵
  PID:2196
- C:\Windows\System\qUcRrzU.exe
  C:\Windows\System\qUcRrzU.exe
  2⤵
  PID:1920
- C:\Windows\System\KAixNUD.exe
  C:\Windows\System\KAixNUD.exe
  2⤵
  PID:3084
- C:\Windows\System\feZcsuB.exe
  C:\Windows\System\feZcsuB.exe
  2⤵
  PID:3100
- C:\Windows\System\WQEJpar.exe
  C:\Windows\System\WQEJpar.exe
  2⤵
  PID:3116
- C:\Windows\System\LbvkCPU.exe
  C:\Windows\System\LbvkCPU.exe
  2⤵
  PID:3132
- C:\Windows\System\vKDbowQ.exe
  C:\Windows\System\vKDbowQ.exe
  2⤵
  PID:3148
- C:\Windows\System\hxqglnf.exe
  C:\Windows\System\hxqglnf.exe
  2⤵
  PID:3164
- C:\Windows\System\gVhQVHI.exe
  C:\Windows\System\gVhQVHI.exe
  2⤵
  PID:3180
- C:\Windows\System\tCMocic.exe
  C:\Windows\System\tCMocic.exe
  2⤵
  PID:3196
- C:\Windows\System\mylPyqo.exe
  C:\Windows\System\mylPyqo.exe
  2⤵
  PID:3212
- C:\Windows\System\MNVBqHk.exe
  C:\Windows\System\MNVBqHk.exe
  2⤵
  PID:3228
- C:\Windows\System\MloSetx.exe
  C:\Windows\System\MloSetx.exe
  2⤵
  PID:3244
- C:\Windows\System\wvhYVaN.exe
  C:\Windows\System\wvhYVaN.exe
  2⤵
  PID:3260
- C:\Windows\System\BfFrSjX.exe
  C:\Windows\System\BfFrSjX.exe
  2⤵
  PID:3276
- C:\Windows\System\jhQJvAg.exe
  C:\Windows\System\jhQJvAg.exe
  2⤵
  PID:3292
- C:\Windows\System\HCHBDQi.exe
  C:\Windows\System\HCHBDQi.exe
  2⤵
  PID:3308
- C:\Windows\System\OuQuppK.exe
  C:\Windows\System\OuQuppK.exe
  2⤵
  PID:3324
- C:\Windows\System\pdylzss.exe
  C:\Windows\System\pdylzss.exe
  2⤵
  PID:3340
- C:\Windows\System\sxsTUTr.exe
  C:\Windows\System\sxsTUTr.exe
  2⤵
  PID:3356
- C:\Windows\System\blKDZjm.exe
  C:\Windows\System\blKDZjm.exe
  2⤵
  PID:3372
- C:\Windows\System\cHqVYJG.exe
  C:\Windows\System\cHqVYJG.exe
  2⤵
  PID:3388
- C:\Windows\System\bsLLdgL.exe
  C:\Windows\System\bsLLdgL.exe
  2⤵
  PID:3404
- C:\Windows\System\xSMEZhS.exe
  C:\Windows\System\xSMEZhS.exe
  2⤵
  PID:3424
- C:\Windows\System\KQRLszz.exe
  C:\Windows\System\KQRLszz.exe
  2⤵
  PID:3440
- C:\Windows\System\gCBemvq.exe
  C:\Windows\System\gCBemvq.exe
  2⤵
  PID:3456
- C:\Windows\System\NVJFboK.exe
  C:\Windows\System\NVJFboK.exe
  2⤵
  PID:3472
- C:\Windows\System\oyDglws.exe
  C:\Windows\System\oyDglws.exe
  2⤵
  PID:3488
- C:\Windows\System\sKMbukt.exe
  C:\Windows\System\sKMbukt.exe
  2⤵
  PID:3504
- C:\Windows\System\ZfyAFQM.exe
  C:\Windows\System\ZfyAFQM.exe
  2⤵
  PID:3520
- C:\Windows\System\mOokMBA.exe
  C:\Windows\System\mOokMBA.exe
  2⤵
  PID:3536
- C:\Windows\System\LTUiqiu.exe
  C:\Windows\System\LTUiqiu.exe
  2⤵
  PID:3552
- C:\Windows\System\FqKWQpT.exe
  C:\Windows\System\FqKWQpT.exe
  2⤵
  PID:3568
- C:\Windows\System\izcuGMT.exe
  C:\Windows\System\izcuGMT.exe
  2⤵
  PID:4080
- C:\Windows\System\wHCDKbB.exe
  C:\Windows\System\wHCDKbB.exe
  2⤵
  PID:2636
- C:\Windows\System\WSWgipS.exe
  C:\Windows\System\WSWgipS.exe
  2⤵
  PID:876
- C:\Windows\System\xjXAhOt.exe
  C:\Windows\System\xjXAhOt.exe
  2⤵
  PID:584
- C:\Windows\System\JxoLXFK.exe
  C:\Windows\System\JxoLXFK.exe
  2⤵
  PID:1732
- C:\Windows\System\mPVvXJn.exe
  C:\Windows\System\mPVvXJn.exe
  2⤵
  PID:3112
- C:\Windows\System\ZziqzzJ.exe
  C:\Windows\System\ZziqzzJ.exe
  2⤵
  PID:3208
- C:\Windows\System\rFFInLG.exe
  C:\Windows\System\rFFInLG.exe
  2⤵
  PID:3304
- C:\Windows\System\QvTgTTP.exe
  C:\Windows\System\QvTgTTP.exe
  2⤵
  PID:3396
- C:\Windows\System\mAtQqiV.exe
  C:\Windows\System\mAtQqiV.exe
  2⤵
  PID:3500
- C:\Windows\System\DeaMoKy.exe
  C:\Windows\System\DeaMoKy.exe
  2⤵
  PID:3564
- C:\Windows\System\WWzmXHG.exe
  C:\Windows\System\WWzmXHG.exe
  2⤵
  PID:672
- C:\Windows\System\JfBvypk.exe
  C:\Windows\System\JfBvypk.exe
  2⤵
  PID:2876
- C:\Windows\System\bSNBMTq.exe
  C:\Windows\System\bSNBMTq.exe
  2⤵
  PID:4088
- C:\Windows\System\ajBvuzK.exe
  C:\Windows\System\ajBvuzK.exe
  2⤵
  PID:4092
- C:\Windows\System\rdjNNQl.exe
  C:\Windows\System\rdjNNQl.exe
  2⤵
  PID:2024
- C:\Windows\System\GXNdxbs.exe
  C:\Windows\System\GXNdxbs.exe
  2⤵
  PID:1924
- C:\Windows\System\wQqeRls.exe
  C:\Windows\System\wQqeRls.exe
  2⤵
  PID:2348
- C:\Windows\System\LIxTRMu.exe
  C:\Windows\System\LIxTRMu.exe
  2⤵
  PID:3640
- C:\Windows\System\oQyMfJT.exe
  C:\Windows\System\oQyMfJT.exe
  2⤵
  PID:2804
- C:\Windows\System\NFKGnNn.exe
  C:\Windows\System\NFKGnNn.exe
  2⤵
  PID:3672
- C:\Windows\System\AkXmtKO.exe
  C:\Windows\System\AkXmtKO.exe
  2⤵
  PID:3720
- C:\Windows\System\EmhSNJa.exe
  C:\Windows\System\EmhSNJa.exe
  2⤵
  PID:3272
- C:\Windows\System\jlLsmid.exe
  C:\Windows\System\jlLsmid.exe
  2⤵
  PID:2420
- C:\Windows\System\pkbsebS.exe
  C:\Windows\System\pkbsebS.exe
  2⤵
  PID:3092
- C:\Windows\System\cuUgWyD.exe
  C:\Windows\System\cuUgWyD.exe
  2⤵
  PID:3268
- C:\Windows\System\IqemyXs.exe
  C:\Windows\System\IqemyXs.exe
  2⤵
  PID:3752
- C:\Windows\System\YeQAIXM.exe
  C:\Windows\System\YeQAIXM.exe
  2⤵
  PID:3480
- C:\Windows\System\YIfTHWB.exe
  C:\Windows\System\YIfTHWB.exe
  2⤵
  PID:3544
- C:\Windows\System\xuCHSLa.exe
  C:\Windows\System\xuCHSLa.exe
  2⤵
  PID:3592
- C:\Windows\System\HgopsWh.exe
  C:\Windows\System\HgopsWh.exe
  2⤵
  PID:3608
- C:\Windows\System\ESfvRQF.exe
  C:\Windows\System\ESfvRQF.exe
  2⤵
  PID:3632
- C:\Windows\System\RVabxOQ.exe
  C:\Windows\System\RVabxOQ.exe
  2⤵
  PID:684
- C:\Windows\System\sJWFzgS.exe
  C:\Windows\System\sJWFzgS.exe
  2⤵
  PID:2040
- C:\Windows\System\uVaFzBB.exe
  C:\Windows\System\uVaFzBB.exe
  2⤵
  PID:2504
- C:\Windows\System\jrMlUwY.exe
  C:\Windows\System\jrMlUwY.exe
  2⤵
  PID:3192
- C:\Windows\System\cdgtLah.exe
  C:\Windows\System\cdgtLah.exe
  2⤵
  PID:3256
- C:\Windows\System\CaGAOTN.exe
  C:\Windows\System\CaGAOTN.exe
  2⤵
  PID:3320
- C:\Windows\System\ubpLxah.exe
  C:\Windows\System\ubpLxah.exe
  2⤵
  PID:3384
- C:\Windows\System\GXDjnHp.exe
  C:\Windows\System\GXDjnHp.exe
  2⤵
  PID:3032
- C:\Windows\System\CJzzMKK.exe
  C:\Windows\System\CJzzMKK.exe
  2⤵
  PID:3692
- C:\Windows\System\irJJmtr.exe
  C:\Windows\System\irJJmtr.exe
  2⤵
  PID:3716
- C:\Windows\System\NprmKve.exe
  C:\Windows\System\NprmKve.exe
  2⤵
  PID:3736
- C:\Windows\System\RqBpggM.exe
  C:\Windows\System\RqBpggM.exe
  2⤵
  PID:3760
- C:\Windows\System\twbEtJo.exe
  C:\Windows\System\twbEtJo.exe
  2⤵
  PID:3772
- C:\Windows\System\SGhVtfz.exe
  C:\Windows\System\SGhVtfz.exe
  2⤵
  PID:3788
- C:\Windows\System\nDmwxhe.exe
  C:\Windows\System\nDmwxhe.exe
  2⤵
  PID:3804
- C:\Windows\System\YLiVicB.exe
  C:\Windows\System\YLiVicB.exe
  2⤵
  PID:3824
- C:\Windows\System\MtDPyCl.exe
  C:\Windows\System\MtDPyCl.exe
  2⤵
  PID:3844
- C:\Windows\System\DklAkjE.exe
  C:\Windows\System\DklAkjE.exe
  2⤵
  PID:3860
- C:\Windows\System\VVZyHEF.exe
  C:\Windows\System\VVZyHEF.exe
  2⤵
  PID:3876
- C:\Windows\System\pVShpPZ.exe
  C:\Windows\System\pVShpPZ.exe
  2⤵
  PID:3892
- C:\Windows\System\VqOQUos.exe
  C:\Windows\System\VqOQUos.exe
  2⤵
  PID:3908
- C:\Windows\System\QYtpHEa.exe
  C:\Windows\System\QYtpHEa.exe
  2⤵
  PID:3924
- C:\Windows\System\RGHupKa.exe
  C:\Windows\System\RGHupKa.exe
  2⤵
  PID:2284
- C:\Windows\System\VpNCIeh.exe
  C:\Windows\System\VpNCIeh.exe
  2⤵
  PID:3960
- C:\Windows\System\XDUULUn.exe
  C:\Windows\System\XDUULUn.exe
  2⤵
  PID:3980
- C:\Windows\System\BXnkJMK.exe
  C:\Windows\System\BXnkJMK.exe
  2⤵
  PID:3992
- C:\Windows\System\wBLdOyq.exe
  C:\Windows\System\wBLdOyq.exe
  2⤵
  PID:4008
- C:\Windows\System\KOpWMSf.exe
  C:\Windows\System\KOpWMSf.exe
  2⤵
  PID:4024
- C:\Windows\System\hchlqsW.exe
  C:\Windows\System\hchlqsW.exe
  2⤵
  PID:4040
- C:\Windows\System\joOKWxo.exe
  C:\Windows\System\joOKWxo.exe
  2⤵
  PID:4056
- C:\Windows\System\ylzKlXg.exe
  C:\Windows\System\ylzKlXg.exe
  2⤵
  PID:4076
- C:\Windows\System\uOArnGV.exe
  C:\Windows\System\uOArnGV.exe
  2⤵
  PID:2884
- C:\Windows\System\FGqBrDZ.exe
  C:\Windows\System\FGqBrDZ.exe
  2⤵
  PID:3204
- C:\Windows\System\hdeIIhZ.exe
  C:\Windows\System\hdeIIhZ.exe
  2⤵
  PID:3368
- C:\Windows\System\XRlXQJG.exe
  C:\Windows\System\XRlXQJG.exe
  2⤵
  PID:3560
- C:\Windows\System\hDMjquQ.exe
  C:\Windows\System\hDMjquQ.exe
  2⤵
  PID:1752
- C:\Windows\System\oHgWHQW.exe
  C:\Windows\System\oHgWHQW.exe
  2⤵
  PID:3128
- C:\Windows\System\ZKJYmMC.exe
  C:\Windows\System\ZKJYmMC.exe
  2⤵
  PID:2612
- C:\Windows\System\MwbHGCV.exe
  C:\Windows\System\MwbHGCV.exe
  2⤵
  PID:1708
- C:\Windows\System\EfWeMMv.exe
  C:\Windows\System\EfWeMMv.exe
  2⤵
  PID:2988
- C:\Windows\System\wqgGuMl.exe
  C:\Windows\System\wqgGuMl.exe
  2⤵
  PID:2700
- C:\Windows\System\cszUQlr.exe
  C:\Windows\System\cszUQlr.exe
  2⤵
  PID:2104
- C:\Windows\System\NSkPNxh.exe
  C:\Windows\System\NSkPNxh.exe
  2⤵
  PID:2772
- C:\Windows\System\UPOnsSI.exe
  C:\Windows\System\UPOnsSI.exe
  2⤵
  PID:3080
- C:\Windows\System\tuLfOaA.exe
  C:\Windows\System\tuLfOaA.exe
  2⤵
  PID:2148
- C:\Windows\System\yNEdOUV.exe
  C:\Windows\System\yNEdOUV.exe
  2⤵
  PID:3700
- C:\Windows\System\qqPyBmx.exe
  C:\Windows\System\qqPyBmx.exe
  2⤵
  PID:2856
- C:\Windows\System\wXzZqsv.exe
  C:\Windows\System\wXzZqsv.exe
  2⤵
  PID:2516
- C:\Windows\System\FdpfvIC.exe
  C:\Windows\System\FdpfvIC.exe
  2⤵
  PID:816
- C:\Windows\System\CoWNuGZ.exe
  C:\Windows\System\CoWNuGZ.exe
  2⤵
  PID:1300
- C:\Windows\System\isOFsig.exe
  C:\Windows\System\isOFsig.exe
  2⤵
  PID:3412
- C:\Windows\System\hNxXjIT.exe
  C:\Windows\System\hNxXjIT.exe
  2⤵
  PID:3512
- C:\Windows\System\crryNoU.exe
  C:\Windows\System\crryNoU.exe
  2⤵
  PID:3580
- C:\Windows\System\cTGQkuH.exe
  C:\Windows\System\cTGQkuH.exe
  2⤵
  PID:3604
- C:\Windows\System\FuqTvrx.exe
  C:\Windows\System\FuqTvrx.exe
  2⤵
  PID:3620
- C:\Windows\System\sOHiGPw.exe
  C:\Windows\System\sOHiGPw.exe
  2⤵
  PID:3432
- C:\Windows\System\zZVQKCG.exe
  C:\Windows\System\zZVQKCG.exe
  2⤵
  PID:3352
- C:\Windows\System\hDYxaOm.exe
  C:\Windows\System\hDYxaOm.exe
  2⤵
  PID:3696
- C:\Windows\System\wTaUFUg.exe
  C:\Windows\System\wTaUFUg.exe
  2⤵
  PID:540
- C:\Windows\System\MFfNaVp.exe
  C:\Windows\System\MFfNaVp.exe
  2⤵
  PID:3868
- C:\Windows\System\zunINQp.exe
  C:\Windows\System\zunINQp.exe
  2⤵
  PID:2900
- C:\Windows\System\BwIccRS.exe
  C:\Windows\System\BwIccRS.exe
  2⤵
  PID:4036
- C:\Windows\System\RnciAhT.exe
  C:\Windows\System\RnciAhT.exe
  2⤵
  PID:3172
- C:\Windows\System\PEfaSAE.exe
  C:\Windows\System\PEfaSAE.exe
  2⤵
  PID:2328
- C:\Windows\System\KvKjHXj.exe
  C:\Windows\System\KvKjHXj.exe
  2⤵
  PID:1928
- C:\Windows\System\ZNveGJq.exe
  C:\Windows\System\ZNveGJq.exe
  2⤵
  PID:3776
- C:\Windows\System\WEcDtOM.exe
  C:\Windows\System\WEcDtOM.exe
  2⤵
  PID:1864
- C:\Windows\System\nAdgxmc.exe
  C:\Windows\System\nAdgxmc.exe
  2⤵
  PID:3936
- C:\Windows\System\JqGRSxZ.exe
  C:\Windows\System\JqGRSxZ.exe
  2⤵
  PID:4032
- C:\Windows\System\HXzazaq.exe
  C:\Windows\System\HXzazaq.exe
  2⤵
  PID:2464
- C:\Windows\System\XjoZqFA.exe
  C:\Windows\System\XjoZqFA.exe
  2⤵
  PID:3628
- C:\Windows\System\aJvccxK.exe
  C:\Windows\System\aJvccxK.exe
  2⤵
  PID:3188
- C:\Windows\System\EBHcvoA.exe
  C:\Windows\System\EBHcvoA.exe
  2⤵
  PID:968
- C:\Windows\System\SnZtCUV.exe
  C:\Windows\System\SnZtCUV.exe
  2⤵
  PID:3780
- C:\Windows\System\yzaOBhQ.exe
  C:\Windows\System\yzaOBhQ.exe
  2⤵
  PID:3888
- C:\Windows\System\wVCcXnu.exe
  C:\Windows\System\wVCcXnu.exe
  2⤵
  PID:3984
- C:\Windows\System\UMdwWBN.exe
  C:\Windows\System\UMdwWBN.exe
  2⤵
  PID:4048
- C:\Windows\System\IRXIbqS.exe
  C:\Windows\System\IRXIbqS.exe
  2⤵
  PID:1860
- C:\Windows\System\qclQUKv.exe
  C:\Windows\System\qclQUKv.exe
  2⤵
  PID:2520
- C:\Windows\System\ZLnTwnx.exe
  C:\Windows\System\ZLnTwnx.exe
  2⤵
  PID:3008
- C:\Windows\System\cZEidnF.exe
  C:\Windows\System\cZEidnF.exe
  2⤵
  PID:3660
- C:\Windows\System\tdFXfmi.exe
  C:\Windows\System\tdFXfmi.exe
  2⤵
  PID:2660
- C:\Windows\System\PdQzKPY.exe
  C:\Windows\System\PdQzKPY.exe
  2⤵
  PID:3416
- C:\Windows\System\uQlwtzX.exe
  C:\Windows\System\uQlwtzX.exe
  2⤵
  PID:3464
- C:\Windows\System\ZQKSYlH.exe
  C:\Windows\System\ZQKSYlH.exe
  2⤵
  PID:3840
- C:\Windows\System\ZFOcozV.exe
  C:\Windows\System\ZFOcozV.exe
  2⤵
  PID:2140
- C:\Windows\System\vGVxbov.exe
  C:\Windows\System\vGVxbov.exe
  2⤵
  PID:3900
- C:\Windows\System\dPEgIQI.exe
  C:\Windows\System\dPEgIQI.exe
  2⤵
  PID:3224
- C:\Windows\System\UMGjmso.exe
  C:\Windows\System\UMGjmso.exe
  2⤵
  PID:3000
- C:\Windows\System\sneHAhp.exe
  C:\Windows\System\sneHAhp.exe
  2⤵
  PID:4068
- C:\Windows\System\xpUUfLg.exe
  C:\Windows\System\xpUUfLg.exe
  2⤵
  PID:3796
- C:\Windows\System\HIyowpD.exe
  C:\Windows\System\HIyowpD.exe
  2⤵
  PID:3944
- C:\Windows\System\LnYmsEe.exe
  C:\Windows\System\LnYmsEe.exe
  2⤵
  PID:4108
- C:\Windows\System\GOXRHvF.exe
  C:\Windows\System\GOXRHvF.exe
  2⤵
  PID:4124
- C:\Windows\System\EpfrplQ.exe
  C:\Windows\System\EpfrplQ.exe
  2⤵
  PID:4144
- C:\Windows\System\VHtLpBq.exe
  C:\Windows\System\VHtLpBq.exe
  2⤵
  PID:4160
- C:\Windows\System\GirCusu.exe
  C:\Windows\System\GirCusu.exe
  2⤵
  PID:4176
- C:\Windows\System\NaTIsUH.exe
  C:\Windows\System\NaTIsUH.exe
  2⤵
  PID:4192
- C:\Windows\System\FQbBRkZ.exe
  C:\Windows\System\FQbBRkZ.exe
  2⤵
  PID:4208
- C:\Windows\System\hFgHfjp.exe
  C:\Windows\System\hFgHfjp.exe
  2⤵
  PID:4224
- C:\Windows\System\qDssUkN.exe
  C:\Windows\System\qDssUkN.exe
  2⤵
  PID:4256
- C:\Windows\System\ORnrdVh.exe
  C:\Windows\System\ORnrdVh.exe
  2⤵
  PID:4272
- C:\Windows\System\mMjjCZI.exe
  C:\Windows\System\mMjjCZI.exe
  2⤵
  PID:4288
- C:\Windows\System\PCGBRUZ.exe
  C:\Windows\System\PCGBRUZ.exe
  2⤵
  PID:4308
- C:\Windows\System\gbUxNrj.exe
  C:\Windows\System\gbUxNrj.exe
  2⤵
  PID:4324
- C:\Windows\System\cvSScts.exe
  C:\Windows\System\cvSScts.exe
  2⤵
  PID:4340
- C:\Windows\System\zylXROd.exe
  C:\Windows\System\zylXROd.exe
  2⤵
  PID:4356
- C:\Windows\System\xxBDmed.exe
  C:\Windows\System\xxBDmed.exe
  2⤵
  PID:4372
- C:\Windows\System\saxjccC.exe
  C:\Windows\System\saxjccC.exe
  2⤵
  PID:4388
- C:\Windows\System\nNtzwEA.exe
  C:\Windows\System\nNtzwEA.exe
  2⤵
  PID:4408
- C:\Windows\System\wkytUqz.exe
  C:\Windows\System\wkytUqz.exe
  2⤵
  PID:4424
- C:\Windows\System\XSZMimM.exe
  C:\Windows\System\XSZMimM.exe
  2⤵
  PID:4440
- C:\Windows\System\trLzEjT.exe
  C:\Windows\System\trLzEjT.exe
  2⤵
  PID:4456
- C:\Windows\System\bXRIRXk.exe
  C:\Windows\System\bXRIRXk.exe
  2⤵
  PID:4472
- C:\Windows\System\DJoUquP.exe
  C:\Windows\System\DJoUquP.exe
  2⤵
  PID:4488
- C:\Windows\System\hBhVvLB.exe
  C:\Windows\System\hBhVvLB.exe
  2⤵
  PID:4508
- C:\Windows\System\GsdvpVP.exe
  C:\Windows\System\GsdvpVP.exe
  2⤵
  PID:4524
- C:\Windows\System\jKAFvAc.exe
  C:\Windows\System\jKAFvAc.exe
  2⤵
  PID:4540
- C:\Windows\System\VhGnjaC.exe
  C:\Windows\System\VhGnjaC.exe
  2⤵
  PID:4556
- C:\Windows\System\fwxeeqm.exe
  C:\Windows\System\fwxeeqm.exe
  2⤵
  PID:4572
- C:\Windows\System\irxymHn.exe
  C:\Windows\System\irxymHn.exe
  2⤵
  PID:4588
- C:\Windows\System\GjQaczH.exe
  C:\Windows\System\GjQaczH.exe
  2⤵
  PID:4608
- C:\Windows\System\OKoMfRA.exe
  C:\Windows\System\OKoMfRA.exe
  2⤵
  PID:4624
- C:\Windows\System\WiWZgQA.exe
  C:\Windows\System\WiWZgQA.exe
  2⤵
  PID:4640
- C:\Windows\System\NSudLee.exe
  C:\Windows\System\NSudLee.exe
  2⤵
  PID:4656
- C:\Windows\System\urQyoAL.exe
  C:\Windows\System\urQyoAL.exe
  2⤵
  PID:4672
- C:\Windows\System\roTVJdA.exe
  C:\Windows\System\roTVJdA.exe
  2⤵
  PID:4688
- C:\Windows\System\STUylfX.exe
  C:\Windows\System\STUylfX.exe
  2⤵
  PID:4704
- C:\Windows\System\rJLEDkL.exe
  C:\Windows\System\rJLEDkL.exe
  2⤵
  PID:4724
- C:\Windows\System\ofjhqLd.exe
  C:\Windows\System\ofjhqLd.exe
  2⤵
  PID:4740
- C:\Windows\System\ispfhyc.exe
  C:\Windows\System\ispfhyc.exe
  2⤵
  PID:4756
- C:\Windows\System\ermTsdu.exe
  C:\Windows\System\ermTsdu.exe
  2⤵
  PID:4772
- C:\Windows\System\daIqxQy.exe
  C:\Windows\System\daIqxQy.exe
  2⤵
  PID:4788
- C:\Windows\System\EUvqHuP.exe
  C:\Windows\System\EUvqHuP.exe
  2⤵
  PID:4804
- C:\Windows\System\HmGowEd.exe
  C:\Windows\System\HmGowEd.exe
  2⤵
  PID:4820
- C:\Windows\System\XESaABn.exe
  C:\Windows\System\XESaABn.exe
  2⤵
  PID:4836
- C:\Windows\System\sCmyIJd.exe
  C:\Windows\System\sCmyIJd.exe
  2⤵
  PID:4856
- C:\Windows\System\sZdiUoh.exe
  C:\Windows\System\sZdiUoh.exe
  2⤵
  PID:4872
- C:\Windows\System\ZdgOTWq.exe
  C:\Windows\System\ZdgOTWq.exe
  2⤵
  PID:4888
- C:\Windows\System\aPfWYLh.exe
  C:\Windows\System\aPfWYLh.exe
  2⤵
  PID:4904
- C:\Windows\System\LynHAVk.exe
  C:\Windows\System\LynHAVk.exe
  2⤵
  PID:4924
- C:\Windows\System\jEfAZbh.exe
  C:\Windows\System\jEfAZbh.exe
  2⤵
  PID:4940
- C:\Windows\System\cXniYtp.exe
  C:\Windows\System\cXniYtp.exe
  2⤵
  PID:4956
- C:\Windows\System\YlWmKsg.exe
  C:\Windows\System\YlWmKsg.exe
  2⤵
  PID:4972
- C:\Windows\System\AazrQms.exe
  C:\Windows\System\AazrQms.exe
  2⤵
  PID:4988
- C:\Windows\System\ZJcCiJC.exe
  C:\Windows\System\ZJcCiJC.exe
  2⤵
  PID:5004
- C:\Windows\System\KGxZHtD.exe
  C:\Windows\System\KGxZHtD.exe
  2⤵
  PID:5020
- C:\Windows\System\SlNqWxC.exe
  C:\Windows\System\SlNqWxC.exe
  2⤵
  PID:5040
- C:\Windows\System\xEygiVG.exe
  C:\Windows\System\xEygiVG.exe
  2⤵
  PID:5056
- C:\Windows\System\kelqoUI.exe
  C:\Windows\System\kelqoUI.exe
  2⤵
  PID:5072
- C:\Windows\System\lvAHNXr.exe
  C:\Windows\System\lvAHNXr.exe
  2⤵
  PID:5088
- C:\Windows\System\KdtPXJS.exe
  C:\Windows\System\KdtPXJS.exe
  2⤵
  PID:5104
- C:\Windows\System\RmtXVHJ.exe
  C:\Windows\System\RmtXVHJ.exe
  2⤵
  PID:2056
- C:\Windows\System\KuYZoyd.exe
  C:\Windows\System\KuYZoyd.exe
  2⤵
  PID:1516
- C:\Windows\System\bdTUeGC.exe
  C:\Windows\System\bdTUeGC.exe
  2⤵
  PID:2452
- C:\Windows\System\MtLnhwN.exe
  C:\Windows\System\MtLnhwN.exe
  2⤵
  PID:3684
- C:\Windows\System\xoYXnAd.exe
  C:\Windows\System\xoYXnAd.exe
  2⤵
  PID:3468
- C:\Windows\System\dJKCDUt.exe
  C:\Windows\System\dJKCDUt.exe
  2⤵
  PID:2580
- C:\Windows\System\ZkGCDjG.exe
  C:\Windows\System\ZkGCDjG.exe
  2⤵
  PID:4152
- C:\Windows\System\JFIHenA.exe
  C:\Windows\System\JFIHenA.exe
  2⤵
  PID:4216
- C:\Windows\System\AzWsIfQ.exe
  C:\Windows\System\AzWsIfQ.exe
  2⤵
  PID:4296
- C:\Windows\System\RKErIIS.exe
  C:\Windows\System\RKErIIS.exe
  2⤵
  PID:4436
- C:\Windows\System\lUfTlGZ.exe
  C:\Windows\System\lUfTlGZ.exe
  2⤵
  PID:4404
- C:\Windows\System\siJKOlo.exe
  C:\Windows\System\siJKOlo.exe
  2⤵
  PID:4532
- C:\Windows\System\UOAuCPm.exe
  C:\Windows\System\UOAuCPm.exe
  2⤵
  PID:4536
- C:\Windows\System\INTLLtM.exe
  C:\Windows\System\INTLLtM.exe
  2⤵
  PID:4600
- C:\Windows\System\MOITjBo.exe
  C:\Windows\System\MOITjBo.exe
  2⤵
  PID:4668
- C:\Windows\System\KlvyFue.exe
  C:\Windows\System\KlvyFue.exe
  2⤵
  PID:3904
- C:\Windows\System\CnyeWtY.exe
  C:\Windows\System\CnyeWtY.exe
  2⤵
  PID:4236
- C:\Windows\System\glYxYhP.exe
  C:\Windows\System\glYxYhP.exe
  2⤵
  PID:3748
- C:\Windows\System\yqkdhrG.exe
  C:\Windows\System\yqkdhrG.exe
  2⤵
  PID:2808
- C:\Windows\System\hzgLRiH.exe
  C:\Windows\System\hzgLRiH.exe
  2⤵
  PID:4952
- C:\Windows\System\WCEqeXf.exe
  C:\Windows\System\WCEqeXf.exe
  2⤵
  PID:5048
- C:\Windows\System\JhpHpnk.exe
  C:\Windows\System\JhpHpnk.exe
  2⤵
  PID:660
- C:\Windows\System\OtVUJWy.exe
  C:\Windows\System\OtVUJWy.exe
  2⤵
  PID:5084
- C:\Windows\System\Gieocuy.exe
  C:\Windows\System\Gieocuy.exe
  2⤵
  PID:4020
- C:\Windows\System\yiMtMiN.exe
  C:\Windows\System\yiMtMiN.exe
  2⤵
  PID:1552
- C:\Windows\System\vIByVVV.exe
  C:\Windows\System\vIByVVV.exe
  2⤵
  PID:3688
- C:\Windows\System\paYmPWi.exe
  C:\Windows\System\paYmPWi.exe
  2⤵
  PID:1196
- C:\Windows\System\JXxrdWm.exe
  C:\Windows\System\JXxrdWm.exe
  2⤵
  PID:4280
- C:\Windows\System\zbczBWk.exe
  C:\Windows\System\zbczBWk.exe
  2⤵
  PID:4348
- C:\Windows\System\eyErYZp.exe
  C:\Windows\System\eyErYZp.exe
  2⤵
  PID:4416
- C:\Windows\System\EqHjBNF.exe
  C:\Windows\System\EqHjBNF.exe
  2⤵
  PID:4484
- C:\Windows\System\TXtMNQw.exe
  C:\Windows\System\TXtMNQw.exe
  2⤵
  PID:4552
- C:\Windows\System\CBIiIvo.exe
  C:\Windows\System\CBIiIvo.exe
  2⤵
  PID:4620
- C:\Windows\System\SBpyWEy.exe
  C:\Windows\System\SBpyWEy.exe
  2⤵
  PID:4680
- C:\Windows\System\hQJVwTM.exe
  C:\Windows\System\hQJVwTM.exe
  2⤵
  PID:3420
- C:\Windows\System\AmZtLYm.exe
  C:\Windows\System\AmZtLYm.exe
  2⤵
  PID:4784
- C:\Windows\System\GRRBHBS.exe
  C:\Windows\System\GRRBHBS.exe
  2⤵
  PID:4852
- C:\Windows\System\gqJykTj.exe
  C:\Windows\System\gqJykTj.exe
  2⤵
  PID:4368
- C:\Windows\System\cgftPyr.exe
  C:\Windows\System\cgftPyr.exe
  2⤵
  PID:5052
- C:\Windows\System\jbgLcQL.exe
  C:\Windows\System\jbgLcQL.exe
  2⤵
  PID:4636
- C:\Windows\System\ycbzTrC.exe
  C:\Windows\System\ycbzTrC.exe
  2⤵
  PID:4264
- C:\Windows\System\HYspvhe.exe
  C:\Windows\System\HYspvhe.exe
  2⤵
  PID:2592
- C:\Windows\System\YhMtFRo.exe
  C:\Windows\System\YhMtFRo.exe
  2⤵
  PID:2564
- C:\Windows\System\FNzuLFH.exe
  C:\Windows\System\FNzuLFH.exe
  2⤵
  PID:2892
- C:\Windows\System\HgDiupm.exe
  C:\Windows\System\HgDiupm.exe
  2⤵
  PID:4700
- C:\Windows\System\mSgHfWA.exe
  C:\Windows\System\mSgHfWA.exe
  2⤵
  PID:4100
- C:\Windows\System\pQdlEBV.exe
  C:\Windows\System\pQdlEBV.exe
  2⤵
  PID:4232
- C:\Windows\System\ZgOmnFp.exe
  C:\Windows\System\ZgOmnFp.exe
  2⤵
  PID:4764
- C:\Windows\System\crjGVJY.exe
  C:\Windows\System\crjGVJY.exe
  2⤵
  PID:4800
- C:\Windows\System\ViOOXln.exe
  C:\Windows\System\ViOOXln.exe
  2⤵
  PID:4868
- C:\Windows\System\hUIhwlc.exe
  C:\Windows\System\hUIhwlc.exe
  2⤵
  PID:4932
- C:\Windows\System\sgssCEv.exe
  C:\Windows\System\sgssCEv.exe
  2⤵
  PID:5036
- C:\Windows\System\xmSCrSp.exe
  C:\Windows\System\xmSCrSp.exe
  2⤵
  PID:5028
- C:\Windows\System\wVCfxrN.exe
  C:\Windows\System\wVCfxrN.exe
  2⤵
  PID:2684
- C:\Windows\System\KhiBOLO.exe
  C:\Windows\System\KhiBOLO.exe
  2⤵
  PID:5012
- C:\Windows\System\kzAPGoY.exe
  C:\Windows\System\kzAPGoY.exe
  2⤵
  PID:1748
- C:\Windows\System\mnAlJLc.exe
  C:\Windows\System\mnAlJLc.exe
  2⤵
  PID:3920
- C:\Windows\System\hUwIOyp.exe
  C:\Windows\System\hUwIOyp.exe
  2⤵
  PID:4448
- C:\Windows\System\aIRBkJK.exe
  C:\Windows\System\aIRBkJK.exe
  2⤵
  PID:4716
- C:\Windows\System\mllopzA.exe
  C:\Windows\System\mllopzA.exe
  2⤵
  PID:4848
- C:\Windows\System\jzqupvG.exe
  C:\Windows\System\jzqupvG.exe
  2⤵
  PID:4120
- C:\Windows\System\YJqgjYP.exe
  C:\Windows\System\YJqgjYP.exe
  2⤵
  PID:3756
- C:\Windows\System\FAfMJfV.exe
  C:\Windows\System\FAfMJfV.exe
  2⤵
  PID:3884
- C:\Windows\System\kcIvmIE.exe
  C:\Windows\System\kcIvmIE.exe
  2⤵
  PID:3300
- C:\Windows\System\AMqVvMW.exe
  C:\Windows\System\AMqVvMW.exe
  2⤵
  PID:2956
- C:\Windows\System\wcCLGLv.exe
  C:\Windows\System\wcCLGLv.exe
  2⤵
  PID:4936
- C:\Windows\System\eKRSdUU.exe
  C:\Windows\System\eKRSdUU.exe
  2⤵
  PID:5100
- C:\Windows\System\HskIbYN.exe
  C:\Windows\System\HskIbYN.exe
  2⤵
  PID:4684
- C:\Windows\System\ppPvQWm.exe
  C:\Windows\System\ppPvQWm.exe
  2⤵
  PID:4696
- C:\Windows\System\KdfNzwd.exe
  C:\Windows\System\KdfNzwd.exe
  2⤵
  PID:4984
- C:\Windows\System\yiGKhSi.exe
  C:\Windows\System\yiGKhSi.exe
  2⤵
  PID:3852
- C:\Windows\System\qbNarAF.exe
  C:\Windows\System\qbNarAF.exe
  2⤵
  PID:4016
- C:\Windows\System\HYXrBZK.exe
  C:\Windows\System\HYXrBZK.exe
  2⤵
  PID:4252
- C:\Windows\System\LggfuxQ.exe
  C:\Windows\System\LggfuxQ.exe
  2⤵
  PID:2768
- C:\Windows\System\RttEJWh.exe
  C:\Windows\System\RttEJWh.exe
  2⤵
  PID:4304
- C:\Windows\System\SticCPx.exe
  C:\Windows\System\SticCPx.exe
  2⤵
  PID:5032
- C:\Windows\System\gLIwFAA.exe
  C:\Windows\System\gLIwFAA.exe
  2⤵
  PID:4584
- C:\Windows\System\fJiucIv.exe
  C:\Windows\System\fJiucIv.exe
  2⤵
  PID:4520
- C:\Windows\System\QMNioiX.exe
  C:\Windows\System\QMNioiX.exe
  2⤵
  PID:4920
- C:\Windows\System\aNfRkqP.exe
  C:\Windows\System\aNfRkqP.exe
  2⤵
  PID:2780
- C:\Windows\System\tlGlrSn.exe
  C:\Windows\System\tlGlrSn.exe
  2⤵
  PID:4132
- C:\Windows\System\DNKreug.exe
  C:\Windows\System\DNKreug.exe
  2⤵
  PID:4968
- C:\Windows\System\TTZoDBq.exe
  C:\Windows\System\TTZoDBq.exe
  2⤵
  PID:4320
- C:\Windows\System\AjzXZjg.exe
  C:\Windows\System\AjzXZjg.exe
  2⤵
  PID:4188
- C:\Windows\System\Mwaxuzx.exe
  C:\Windows\System\Mwaxuzx.exe
  2⤵
  PID:4844
- C:\Windows\System\MZqAVEj.exe
  C:\Windows\System\MZqAVEj.exe
  2⤵
  PID:5124
- C:\Windows\System\TQPSbfU.exe
  C:\Windows\System\TQPSbfU.exe
  2⤵
  PID:5140
- C:\Windows\System\GCoKHNf.exe
  C:\Windows\System\GCoKHNf.exe
  2⤵
  PID:5156
- C:\Windows\System\QNOojXT.exe
  C:\Windows\System\QNOojXT.exe
  2⤵
  PID:5172
- C:\Windows\System\aUVxuAp.exe
  C:\Windows\System\aUVxuAp.exe
  2⤵
  PID:5188
- C:\Windows\System\PgLsXTV.exe
  C:\Windows\System\PgLsXTV.exe
  2⤵
  PID:5204
- C:\Windows\System\EJBcASh.exe
  C:\Windows\System\EJBcASh.exe
  2⤵
  PID:5220
- C:\Windows\System\rBWrLwD.exe
  C:\Windows\System\rBWrLwD.exe
  2⤵
  PID:5236
- C:\Windows\System\OaymtsK.exe
  C:\Windows\System\OaymtsK.exe
  2⤵
  PID:5256
- C:\Windows\System\eGsKLpq.exe
  C:\Windows\System\eGsKLpq.exe
  2⤵
  PID:5276
- C:\Windows\System\rWXrqcm.exe
  C:\Windows\System\rWXrqcm.exe
  2⤵
  PID:5292
- C:\Windows\System\nfYHRxl.exe
  C:\Windows\System\nfYHRxl.exe
  2⤵
  PID:5308
- C:\Windows\System\USxeiCA.exe
  C:\Windows\System\USxeiCA.exe
  2⤵
  PID:5324
- C:\Windows\System\wMjzpxJ.exe
  C:\Windows\System\wMjzpxJ.exe
  2⤵
  PID:5340
- C:\Windows\System\dVENggV.exe
  C:\Windows\System\dVENggV.exe
  2⤵
  PID:5356
- C:\Windows\System\mTJdklw.exe
  C:\Windows\System\mTJdklw.exe
  2⤵
  PID:5372
- C:\Windows\System\naxzLkU.exe
  C:\Windows\System\naxzLkU.exe
  2⤵
  PID:5388
- C:\Windows\System\UrPYefE.exe
  C:\Windows\System\UrPYefE.exe
  2⤵
  PID:5404
- C:\Windows\System\cQuOGUT.exe
  C:\Windows\System\cQuOGUT.exe
  2⤵
  PID:5420
- C:\Windows\System\xfZEuAS.exe
  C:\Windows\System\xfZEuAS.exe
  2⤵
  PID:5436
- C:\Windows\System\FHlMhMR.exe
  C:\Windows\System\FHlMhMR.exe
  2⤵
  PID:5452
- C:\Windows\System\gOVooPY.exe
  C:\Windows\System\gOVooPY.exe
  2⤵
  PID:5468
- C:\Windows\System\iOwYryB.exe
  C:\Windows\System\iOwYryB.exe
  2⤵
  PID:5484
- C:\Windows\System\JpJxYCo.exe
  C:\Windows\System\JpJxYCo.exe
  2⤵
  PID:5500
- C:\Windows\System\CZwaVYN.exe
  C:\Windows\System\CZwaVYN.exe
  2⤵
  PID:5516
- C:\Windows\System\HRQXAKC.exe
  C:\Windows\System\HRQXAKC.exe
  2⤵
  PID:5536
- C:\Windows\System\wwxkyHW.exe
  C:\Windows\System\wwxkyHW.exe
  2⤵
  PID:5552
- C:\Windows\System\admDuri.exe
  C:\Windows\System\admDuri.exe
  2⤵
  PID:5568
- C:\Windows\System\qKSebCX.exe
  C:\Windows\System\qKSebCX.exe
  2⤵
  PID:5584
- C:\Windows\System\SAyFgTz.exe
  C:\Windows\System\SAyFgTz.exe
  2⤵
  PID:5600
- C:\Windows\System\tHJJAhD.exe
  C:\Windows\System\tHJJAhD.exe
  2⤵
  PID:5616
- C:\Windows\System\KmxxfEB.exe
  C:\Windows\System\KmxxfEB.exe
  2⤵
  PID:5632
- C:\Windows\System\xKqfZCE.exe
  C:\Windows\System\xKqfZCE.exe
  2⤵
  PID:5648
- C:\Windows\System\HOhLsaM.exe
  C:\Windows\System\HOhLsaM.exe
  2⤵
  PID:5664
- C:\Windows\System\BpUmyzI.exe
  C:\Windows\System\BpUmyzI.exe
  2⤵
  PID:5680
- C:\Windows\System\RsUtqvA.exe
  C:\Windows\System\RsUtqvA.exe
  2⤵
  PID:5696
- C:\Windows\System\PFUmQHh.exe
  C:\Windows\System\PFUmQHh.exe
  2⤵
  PID:5712
- C:\Windows\System\EyTfAsB.exe
  C:\Windows\System\EyTfAsB.exe
  2⤵
  PID:5728
- C:\Windows\System\sPhFUxc.exe
  C:\Windows\System\sPhFUxc.exe
  2⤵
  PID:5744
- C:\Windows\System\xYDwWRQ.exe
  C:\Windows\System\xYDwWRQ.exe
  2⤵
  PID:5760
- C:\Windows\System\VflNSvm.exe
  C:\Windows\System\VflNSvm.exe
  2⤵
  PID:5776
- C:\Windows\System\FnyFGnN.exe
  C:\Windows\System\FnyFGnN.exe
  2⤵
  PID:5792
- C:\Windows\System\MHRNjNz.exe
  C:\Windows\System\MHRNjNz.exe
  2⤵
  PID:5808
- C:\Windows\System\EfmdnkP.exe
  C:\Windows\System\EfmdnkP.exe
  2⤵
  PID:5824
- C:\Windows\System\AAVJYKk.exe
  C:\Windows\System\AAVJYKk.exe
  2⤵
  PID:5840
- C:\Windows\System\bMsBHVW.exe
  C:\Windows\System\bMsBHVW.exe
  2⤵
  PID:5856
- C:\Windows\System\CqhCukc.exe
  C:\Windows\System\CqhCukc.exe
  2⤵
  PID:5872
- C:\Windows\System\xkvSFPl.exe
  C:\Windows\System\xkvSFPl.exe
  2⤵
  PID:5888
- C:\Windows\System\MtWZVuq.exe
  C:\Windows\System\MtWZVuq.exe
  2⤵
  PID:5904
- C:\Windows\System\VaScVlY.exe
  C:\Windows\System\VaScVlY.exe
  2⤵
  PID:5920
- C:\Windows\System\pyAOOjP.exe
  C:\Windows\System\pyAOOjP.exe
  2⤵
  PID:5940
- C:\Windows\System\XCqhWKA.exe
  C:\Windows\System\XCqhWKA.exe
  2⤵
  PID:5956
- C:\Windows\System\RpNhhKU.exe
  C:\Windows\System\RpNhhKU.exe
  2⤵
  PID:5972
- C:\Windows\System\HnxGjJZ.exe
  C:\Windows\System\HnxGjJZ.exe
  2⤵
  PID:5988
- C:\Windows\System\jADOXKF.exe
  C:\Windows\System\jADOXKF.exe
  2⤵
  PID:6004
- C:\Windows\System\jzRJuVx.exe
  C:\Windows\System\jzRJuVx.exe
  2⤵
  PID:6020
- C:\Windows\System\rOaxkRv.exe
  C:\Windows\System\rOaxkRv.exe
  2⤵
  PID:6036
- C:\Windows\System\gDaOAjT.exe
  C:\Windows\System\gDaOAjT.exe
  2⤵
  PID:6052
- C:\Windows\System\oicWGiJ.exe
  C:\Windows\System\oicWGiJ.exe
  2⤵
  PID:6068
- C:\Windows\System\RrMpKyV.exe
  C:\Windows\System\RrMpKyV.exe
  2⤵
  PID:6084
- C:\Windows\System\ecFQUoL.exe
  C:\Windows\System\ecFQUoL.exe
  2⤵
  PID:6100
- C:\Windows\System\kxwtxPK.exe
  C:\Windows\System\kxwtxPK.exe
  2⤵
  PID:6116
- C:\Windows\System\iOWXTBn.exe
  C:\Windows\System\iOWXTBn.exe
  2⤵
  PID:6132
- C:\Windows\System\BUdPTjZ.exe
  C:\Windows\System\BUdPTjZ.exe
  2⤵
  PID:5136
- C:\Windows\System\wfiLwAv.exe
  C:\Windows\System\wfiLwAv.exe
  2⤵
  PID:5200
- C:\Windows\System\IamIOZf.exe
  C:\Windows\System\IamIOZf.exe
  2⤵
  PID:5264
- C:\Windows\System\AfFhEXB.exe
  C:\Windows\System\AfFhEXB.exe
  2⤵
  PID:5300
- C:\Windows\System\EtrcqWt.exe
  C:\Windows\System\EtrcqWt.exe
  2⤵
  PID:5364
- C:\Windows\System\suBSEje.exe
  C:\Windows\System\suBSEje.exe
  2⤵
  PID:5368
- C:\Windows\System\HbUdKAs.exe
  C:\Windows\System\HbUdKAs.exe
  2⤵
  PID:5492
- C:\Windows\System\SkVhxvm.exe
  C:\Windows\System\SkVhxvm.exe
  2⤵
  PID:5496
- C:\Windows\System\yOgSaCl.exe
  C:\Windows\System\yOgSaCl.exe
  2⤵
  PID:5068
- C:\Windows\System\cwiUpio.exe
  C:\Windows\System\cwiUpio.exe
  2⤵
  PID:5180
- C:\Windows\System\bkRFyxZ.exe
  C:\Windows\System\bkRFyxZ.exe
  2⤵
  PID:5628
- C:\Windows\System\xxbsbXd.exe
  C:\Windows\System\xxbsbXd.exe
  2⤵
  PID:1740
- C:\Windows\System\yXbFSCn.exe
  C:\Windows\System\yXbFSCn.exe
  2⤵
  PID:4248
- C:\Windows\System\muaxbhn.exe
  C:\Windows\System\muaxbhn.exe
  2⤵
  PID:5608
- C:\Windows\System\RvowYFt.exe
  C:\Windows\System\RvowYFt.exe
  2⤵
  PID:1660
- C:\Windows\System\hbTQlES.exe
  C:\Windows\System\hbTQlES.exe
  2⤵
  PID:5580
- C:\Windows\System\evtQeFc.exe
  C:\Windows\System\evtQeFc.exe
  2⤵
  PID:5248
- C:\Windows\System\DKXbZzw.exe
  C:\Windows\System\DKXbZzw.exe
  2⤵
  PID:5288
- C:\Windows\System\rlnDqAw.exe
  C:\Windows\System\rlnDqAw.exe
  2⤵
  PID:5448
- C:\Windows\System\HtHvrLi.exe
  C:\Windows\System\HtHvrLi.exe
  2⤵
  PID:5756
- C:\Windows\System\evhWIou.exe
  C:\Windows\System\evhWIou.exe
  2⤵
  PID:5544
- C:\Windows\System\miKDBra.exe
  C:\Windows\System\miKDBra.exe
  2⤵
  PID:5672
- C:\Windows\System\gPtVezA.exe
  C:\Windows\System\gPtVezA.exe
  2⤵
  PID:5820
- C:\Windows\System\HaFmRjx.exe
  C:\Windows\System\HaFmRjx.exe
  2⤵
  PID:5884
- C:\Windows\System\KsfwzDY.exe
  C:\Windows\System\KsfwzDY.exe
  2⤵
  PID:5800
- C:\Windows\System\TUdnXhv.exe
  C:\Windows\System\TUdnXhv.exe
  2⤵
  PID:5832
- C:\Windows\System\lQMkKvy.exe
  C:\Windows\System\lQMkKvy.exe
  2⤵
  PID:6044
- C:\Windows\System\gRenzzQ.exe
  C:\Windows\System\gRenzzQ.exe
  2⤵
  PID:5868
- C:\Windows\System\ATXrJXA.exe
  C:\Windows\System\ATXrJXA.exe
  2⤵
  PID:5708
- C:\Windows\System\GwDFRUh.exe
  C:\Windows\System\GwDFRUh.exe
  2⤵
  PID:5768
- C:\Windows\System\gInPjoV.exe
  C:\Windows\System\gInPjoV.exe
  2⤵
  PID:5132
- C:\Windows\System\EdrjsPc.exe
  C:\Windows\System\EdrjsPc.exe
  2⤵
  PID:5928
- C:\Windows\System\CMbkRWi.exe
  C:\Windows\System\CMbkRWi.exe
  2⤵
  PID:6000
- C:\Windows\System\gvVcIzE.exe
  C:\Windows\System\gvVcIzE.exe
  2⤵
  PID:5900
- C:\Windows\System\WxIIAyd.exe
  C:\Windows\System\WxIIAyd.exe
  2⤵
  PID:5996
- C:\Windows\System\zRpiBUs.exe
  C:\Windows\System\zRpiBUs.exe
  2⤵
  PID:6096
- C:\Windows\System\xbGuSec.exe
  C:\Windows\System\xbGuSec.exe
  2⤵
  PID:5196
- C:\Windows\System\BxQoGcc.exe
  C:\Windows\System\BxQoGcc.exe
  2⤵
  PID:5432
- C:\Windows\System\SdaKfmM.exe
  C:\Windows\System\SdaKfmM.exe
  2⤵
  PID:5460
- C:\Windows\System\JUVeRMW.exe
  C:\Windows\System\JUVeRMW.exe
  2⤵
  PID:5656
- C:\Windows\System\GEbRjcV.exe
  C:\Windows\System\GEbRjcV.exe
  2⤵
  PID:5252
- C:\Windows\System\vfebrZe.exe
  C:\Windows\System\vfebrZe.exe
  2⤵
  PID:5476
- C:\Windows\System\wVZOUEM.exe
  C:\Windows\System\wVZOUEM.exe
  2⤵
  PID:5416
- C:\Windows\System\YAkRnuh.exe
  C:\Windows\System\YAkRnuh.exe
  2⤵
  PID:6032
- C:\Windows\System\JjjHnSQ.exe
  C:\Windows\System\JjjHnSQ.exe
  2⤵
  PID:5644
- C:\Windows\System\HvIeQxO.exe
  C:\Windows\System\HvIeQxO.exe
  2⤵
  PID:5400
- C:\Windows\System\wqyHQYB.exe
  C:\Windows\System\wqyHQYB.exe
  2⤵
  PID:5752
- C:\Windows\System\bDHvyJo.exe
  C:\Windows\System\bDHvyJo.exe
  2⤵
  PID:5692
- C:\Windows\System\QZemEOa.exe
  C:\Windows\System\QZemEOa.exe
  2⤵
  PID:5384
- C:\Windows\System\qqffynv.exe
  C:\Windows\System\qqffynv.exe
  2⤵
  PID:5952
- C:\Windows\System\YdSLaFQ.exe
  C:\Windows\System\YdSLaFQ.exe
  2⤵
  PID:5704
- C:\Windows\System\YZujVBh.exe
  C:\Windows\System\YZujVBh.exe
  2⤵
  PID:4632
- C:\Windows\System\VEPQKOa.exe
  C:\Windows\System\VEPQKOa.exe
  2⤵
  PID:5480
- C:\Windows\System\dJuodMf.exe
  C:\Windows\System\dJuodMf.exe
  2⤵
  PID:6016
- C:\Windows\System\CFfpROW.exe
  C:\Windows\System\CFfpROW.exe
  2⤵
  PID:5968
- C:\Windows\System\rQNEZVq.exe
  C:\Windows\System\rQNEZVq.exe
  2⤵
  PID:5864
- C:\Windows\System\KmRePbY.exe
  C:\Windows\System\KmRePbY.exe
  2⤵
  PID:5896
- C:\Windows\System\tjVnnlG.exe
  C:\Windows\System\tjVnnlG.exe
  2⤵
  PID:5396
- C:\Windows\System\WWwcYdW.exe
  C:\Windows\System\WWwcYdW.exe
  2⤵
  PID:6076
- C:\Windows\System\PLYAHYL.exe
  C:\Windows\System\PLYAHYL.exe
  2⤵
  PID:5528
- C:\Windows\System\LOkvtEz.exe
  C:\Windows\System\LOkvtEz.exe
  2⤵
  PID:2692
- C:\Windows\System\ziklwuM.exe
  C:\Windows\System\ziklwuM.exe
  2⤵
  PID:4204
- C:\Windows\System\znenSbb.exe
  C:\Windows\System\znenSbb.exe
  2⤵
  PID:5816
- C:\Windows\System\MvayFfs.exe
  C:\Windows\System\MvayFfs.exe
  2⤵
  PID:5332
- C:\Windows\System\IQoiNjs.exe
  C:\Windows\System\IQoiNjs.exe
  2⤵
  PID:6152
- C:\Windows\System\xEHjnzH.exe
  C:\Windows\System\xEHjnzH.exe
  2⤵
  PID:6176
- C:\Windows\System\zDVdOjp.exe
  C:\Windows\System\zDVdOjp.exe
  2⤵
  PID:6192
- C:\Windows\System\qlkvYEj.exe
  C:\Windows\System\qlkvYEj.exe
  2⤵
  PID:6208
- C:\Windows\System\FVxXjcb.exe
  C:\Windows\System\FVxXjcb.exe
  2⤵
  PID:6228
- C:\Windows\System\qgxMfDa.exe
  C:\Windows\System\qgxMfDa.exe
  2⤵
  PID:6244
- C:\Windows\System\JmqTFvk.exe
  C:\Windows\System\JmqTFvk.exe
  2⤵
  PID:6260
- C:\Windows\System\fLBaShV.exe
  C:\Windows\System\fLBaShV.exe
  2⤵
  PID:6276
- C:\Windows\System\QxftJds.exe
  C:\Windows\System\QxftJds.exe
  2⤵
  PID:6392
- C:\Windows\System\SFQWkjZ.exe
  C:\Windows\System\SFQWkjZ.exe
  2⤵
  PID:6408
- C:\Windows\System\chvUXuS.exe
  C:\Windows\System\chvUXuS.exe
  2⤵
  PID:6424
- C:\Windows\System\YaVTbhk.exe
  C:\Windows\System\YaVTbhk.exe
  2⤵
  PID:6440
- C:\Windows\System\JTkupiI.exe
  C:\Windows\System\JTkupiI.exe
  2⤵
  PID:6456
- C:\Windows\System\XYLwZwt.exe
  C:\Windows\System\XYLwZwt.exe
  2⤵
  PID:6472
- C:\Windows\System\nonKDrm.exe
  C:\Windows\System\nonKDrm.exe
  2⤵
  PID:6488
- C:\Windows\System\wzDnQaG.exe
  C:\Windows\System\wzDnQaG.exe
  2⤵
  PID:6504
- C:\Windows\System\cKsHWOy.exe
  C:\Windows\System\cKsHWOy.exe
  2⤵
  PID:6520
- C:\Windows\System\xzEvWaZ.exe
  C:\Windows\System\xzEvWaZ.exe
  2⤵
  PID:6536
- C:\Windows\System\hNnVgfN.exe
  C:\Windows\System\hNnVgfN.exe
  2⤵
  PID:6552
- C:\Windows\System\Tbtivcu.exe
  C:\Windows\System\Tbtivcu.exe
  2⤵
  PID:6568
- C:\Windows\System\cwQmGzu.exe
  C:\Windows\System\cwQmGzu.exe
  2⤵
  PID:6584
- C:\Windows\System\OuXFxzd.exe
  C:\Windows\System\OuXFxzd.exe
  2⤵
  PID:6600
- C:\Windows\System\hiWHoqx.exe
  C:\Windows\System\hiWHoqx.exe
  2⤵
  PID:6624
- C:\Windows\System\TYCkvUI.exe
  C:\Windows\System\TYCkvUI.exe
  2⤵
  PID:6644
- C:\Windows\System\mWqjrxe.exe
  C:\Windows\System\mWqjrxe.exe
  2⤵
  PID:6712
- C:\Windows\System\ZABRzww.exe
  C:\Windows\System\ZABRzww.exe
  2⤵
  PID:6740
- C:\Windows\System\lyvAxFk.exe
  C:\Windows\System\lyvAxFk.exe
  2⤵
  PID:6756
- C:\Windows\System\NjAkgDh.exe
  C:\Windows\System\NjAkgDh.exe
  2⤵
  PID:6772
- C:\Windows\System\AeijrjO.exe
  C:\Windows\System\AeijrjO.exe
  2⤵
  PID:6792
- C:\Windows\System\xNIgrKB.exe
  C:\Windows\System\xNIgrKB.exe
  2⤵
  PID:6808
- C:\Windows\System\gsBWBLI.exe
  C:\Windows\System\gsBWBLI.exe
  2⤵
  PID:6828
- C:\Windows\System\LaobBtN.exe
  C:\Windows\System\LaobBtN.exe
  2⤵
  PID:6848
- C:\Windows\System\KEaGXRO.exe
  C:\Windows\System\KEaGXRO.exe
  2⤵
  PID:6864
- C:\Windows\System\cOlnafI.exe
  C:\Windows\System\cOlnafI.exe
  2⤵
  PID:6880
- C:\Windows\System\JXXKgPk.exe
  C:\Windows\System\JXXKgPk.exe
  2⤵
  PID:6896
- C:\Windows\System\CchQOYs.exe
  C:\Windows\System\CchQOYs.exe
  2⤵
  PID:6912
- C:\Windows\System\ytJSpoE.exe
  C:\Windows\System\ytJSpoE.exe
  2⤵
  PID:6928
- C:\Windows\System\iPkxGvx.exe
  C:\Windows\System\iPkxGvx.exe
  2⤵
  PID:6944
- C:\Windows\System\KBEXpar.exe
  C:\Windows\System\KBEXpar.exe
  2⤵
  PID:6960
- C:\Windows\System\SAaCrkK.exe
  C:\Windows\System\SAaCrkK.exe
  2⤵
  PID:6976
- C:\Windows\System\KrYVRbX.exe
  C:\Windows\System\KrYVRbX.exe
  2⤵
  PID:6992
- C:\Windows\System\yjNOHxl.exe
  C:\Windows\System\yjNOHxl.exe
  2⤵
  PID:7008
- C:\Windows\System\OxxLrBE.exe
  C:\Windows\System\OxxLrBE.exe
  2⤵
  PID:7024
- C:\Windows\System\yUeeXAY.exe
  C:\Windows\System\yUeeXAY.exe
  2⤵
  PID:7040
- C:\Windows\System\XrnqTPm.exe
  C:\Windows\System\XrnqTPm.exe
  2⤵
  PID:7060
- C:\Windows\System\SBDLgcb.exe
  C:\Windows\System\SBDLgcb.exe
  2⤵
  PID:7076
- C:\Windows\System\DNqBsef.exe
  C:\Windows\System\DNqBsef.exe
  2⤵
  PID:7092
- C:\Windows\System\MyAgjDb.exe
  C:\Windows\System\MyAgjDb.exe
  2⤵
  PID:7108
- C:\Windows\System\yhShwlZ.exe
  C:\Windows\System\yhShwlZ.exe
  2⤵
  PID:7124
- C:\Windows\System\DfWfvTA.exe
  C:\Windows\System\DfWfvTA.exe
  2⤵
  PID:7140
- C:\Windows\System\VOeFQmO.exe
  C:\Windows\System\VOeFQmO.exe
  2⤵
  PID:7156
- C:\Windows\System\wRRDmpv.exe
  C:\Windows\System\wRRDmpv.exe
  2⤵
  PID:6092
- C:\Windows\System\jLyAscE.exe
  C:\Windows\System\jLyAscE.exe
  2⤵
  PID:5316
- C:\Windows\System\RjfaGWj.exe
  C:\Windows\System\RjfaGWj.exe
  2⤵
  PID:6148
- C:\Windows\System\uLAuyuq.exe
  C:\Windows\System\uLAuyuq.exe
  2⤵
  PID:6140
- C:\Windows\System\HwyColq.exe
  C:\Windows\System\HwyColq.exe
  2⤵
  PID:6252
- C:\Windows\System\MTODeiB.exe
  C:\Windows\System\MTODeiB.exe
  2⤵
  PID:6128
- C:\Windows\System\XKieJAK.exe
  C:\Windows\System\XKieJAK.exe
  2⤵
  PID:6168
- C:\Windows\System\MLtHpcb.exe
  C:\Windows\System\MLtHpcb.exe
  2⤵
  PID:6236
- C:\Windows\System\TpaEbkU.exe
  C:\Windows\System\TpaEbkU.exe
  2⤵
  PID:5624
- C:\Windows\System\ZtiTLMC.exe
  C:\Windows\System\ZtiTLMC.exe
  2⤵
  PID:6292
- C:\Windows\System\zSLWtIn.exe
  C:\Windows\System\zSLWtIn.exe
  2⤵
  PID:6324
- C:\Windows\System\XuNrGBr.exe
  C:\Windows\System\XuNrGBr.exe
  2⤵
  PID:1664
- C:\Windows\System\QbNUpiP.exe
  C:\Windows\System\QbNUpiP.exe
  2⤵
  PID:6348
- C:\Windows\System\TtTnEdg.exe
  C:\Windows\System\TtTnEdg.exe
  2⤵
  PID:6364
- C:\Windows\System\HTjxscP.exe
  C:\Windows\System\HTjxscP.exe
  2⤵
  PID:6380
- C:\Windows\System\ZSEeLGB.exe
  C:\Windows\System\ZSEeLGB.exe
  2⤵
  PID:6420
- C:\Windows\System\mXZFwPJ.exe
  C:\Windows\System\mXZFwPJ.exe
  2⤵
  PID:6484
- C:\Windows\System\WrCXYBx.exe
  C:\Windows\System\WrCXYBx.exe
  2⤵
  PID:6576
- C:\Windows\System\fLVpfMI.exe
  C:\Windows\System\fLVpfMI.exe
  2⤵
  PID:6616
- C:\Windows\System\fSfGuVn.exe
  C:\Windows\System\fSfGuVn.exe
  2⤵
  PID:6656
- C:\Windows\System\vMCaAzG.exe
  C:\Windows\System\vMCaAzG.exe
  2⤵
  PID:6468
- C:\Windows\System\qzCzKJG.exe
  C:\Windows\System\qzCzKJG.exe
  2⤵
  PID:6404
- C:\Windows\System\KEoLyeD.exe
  C:\Windows\System\KEoLyeD.exe
  2⤵
  PID:6528
- C:\Windows\System\nlQWQMW.exe
  C:\Windows\System\nlQWQMW.exe
  2⤵
  PID:6636
- C:\Windows\System\MTubqlP.exe
  C:\Windows\System\MTubqlP.exe
  2⤵
  PID:6684
- C:\Windows\System\KXSAcMt.exe
  C:\Windows\System\KXSAcMt.exe
  2⤵
  PID:6672
- C:\Windows\System\INofdod.exe
  C:\Windows\System\INofdod.exe
  2⤵
  PID:6700
- C:\Windows\System\uVQRBBq.exe
  C:\Windows\System\uVQRBBq.exe
  2⤵
  PID:6748
- C:\Windows\System\WhnxwUf.exe
  C:\Windows\System\WhnxwUf.exe
  2⤵
  PID:6788
- C:\Windows\System\mcMuivS.exe
  C:\Windows\System\mcMuivS.exe
  2⤵
  PID:6736
- C:\Windows\System\zFiGuqK.exe
  C:\Windows\System\zFiGuqK.exe
  2⤵
  PID:6844
- C:\Windows\System\OUPHCio.exe
  C:\Windows\System\OUPHCio.exe
  2⤵
  PID:6888
- C:\Windows\System\QxGGiYP.exe
  C:\Windows\System\QxGGiYP.exe
  2⤵
  PID:6952
- C:\Windows\System\bJwXesv.exe
  C:\Windows\System\bJwXesv.exe
  2⤵
  PID:6988
- C:\Windows\System\iqELzIn.exe
  C:\Windows\System\iqELzIn.exe
  2⤵
  PID:6840
- C:\Windows\System\MZJHorR.exe
  C:\Windows\System\MZJHorR.exe
  2⤵
  PID:6908
- C:\Windows\System\OoUZPbE.exe
  C:\Windows\System\OoUZPbE.exe
  2⤵
  PID:6972
- C:\Windows\System\OeJyEsO.exe
  C:\Windows\System\OeJyEsO.exe
  2⤵
  PID:7036
- C:\Windows\System\gBfBDuK.exe
  C:\Windows\System\gBfBDuK.exe
  2⤵
  PID:7056
- C:\Windows\System\cWuodAU.exe
  C:\Windows\System\cWuodAU.exe
  2⤵
  PID:7116
- C:\Windows\System\IFlWAJr.exe
  C:\Windows\System\IFlWAJr.exe
  2⤵
  PID:5784
- C:\Windows\System\VuMiVpV.exe
  C:\Windows\System\VuMiVpV.exe
  2⤵
  PID:6288
- C:\Windows\System\nwlzOBD.exe
  C:\Windows\System\nwlzOBD.exe
  2⤵
  PID:6308
- C:\Windows\System\IiZDntC.exe
  C:\Windows\System\IiZDntC.exe
  2⤵
  PID:6356
- C:\Windows\System\dJCcnRT.exe
  C:\Windows\System\dJCcnRT.exe
  2⤵
  PID:5352
- C:\Windows\System\IfZvnRg.exe
  C:\Windows\System\IfZvnRg.exe
  2⤵
  PID:6480
- C:\Windows\System\chEcrSo.exe
  C:\Windows\System\chEcrSo.exe
  2⤵
  PID:6160
- C:\Windows\System\HPaXCwR.exe
  C:\Windows\System\HPaXCwR.exe
  2⤵
  PID:7104
- C:\Windows\System\ChvrjaU.exe
  C:\Windows\System\ChvrjaU.exe
  2⤵
  PID:6112
- C:\Windows\System\tpTinEd.exe
  C:\Windows\System\tpTinEd.exe
  2⤵
  PID:6344
- C:\Windows\System\OkoKbin.exe
  C:\Windows\System\OkoKbin.exe
  2⤵
  PID:6548
- C:\Windows\System\vxkdahb.exe
  C:\Windows\System\vxkdahb.exe
  2⤵
  PID:6400
- C:\Windows\System\meCqeVc.exe
  C:\Windows\System\meCqeVc.exe
  2⤵
  PID:6688
- C:\Windows\System\RMQqJbw.exe
  C:\Windows\System\RMQqJbw.exe
  2⤵
  PID:6732
- C:\Windows\System\iYmsDjx.exe
  C:\Windows\System\iYmsDjx.exe
  2⤵
  PID:6984
- C:\Windows\System\DcULrbT.exe
  C:\Windows\System\DcULrbT.exe
  2⤵
  PID:7004
- C:\Windows\System\sytlxur.exe
  C:\Windows\System\sytlxur.exe
  2⤵
  PID:6184
- C:\Windows\System\WghjpLr.exe
  C:\Windows\System\WghjpLr.exe
  2⤵
  PID:6464
- C:\Windows\System\stWgmIu.exe
  C:\Windows\System\stWgmIu.exe
  2⤵
  PID:6612
- C:\Windows\System\KhMSAPK.exe
  C:\Windows\System\KhMSAPK.exe
  2⤵
  PID:6328
- C:\Windows\System\skqMudD.exe
  C:\Windows\System\skqMudD.exe
  2⤵
  PID:7072
- C:\Windows\System\HIyHYNO.exe
  C:\Windows\System\HIyHYNO.exe
  2⤵
  PID:6596
- C:\Windows\System\YlkUjFd.exe
  C:\Windows\System\YlkUjFd.exe
  2⤵
  PID:6876
- C:\Windows\System\mWObTbj.exe
  C:\Windows\System\mWObTbj.exe
  2⤵
  PID:7048
- C:\Windows\System\aWXQTEh.exe
  C:\Windows\System\aWXQTEh.exe
  2⤵
  PID:6664
- C:\Windows\System\LTsySNe.exe
  C:\Windows\System\LTsySNe.exe
  2⤵
  PID:6784
- C:\Windows\System\McsUotR.exe
  C:\Windows\System\McsUotR.exe
  2⤵
  PID:7020
- C:\Windows\System\XPeZSle.exe
  C:\Windows\System\XPeZSle.exe
  2⤵
  PID:7152
- C:\Windows\System\RabDEiQ.exe
  C:\Windows\System\RabDEiQ.exe
  2⤵
  PID:6632
- C:\Windows\System\BDOjyJR.exe
  C:\Windows\System\BDOjyJR.exe
  2⤵
  PID:6904
- C:\Windows\System\nltreNS.exe
  C:\Windows\System\nltreNS.exe
  2⤵
  PID:5852
- C:\Windows\System\JjTlAza.exe
  C:\Windows\System\JjTlAza.exe
  2⤵
  PID:6240
- C:\Windows\System\ETqVzsq.exe
  C:\Windows\System\ETqVzsq.exe
  2⤵
  PID:6824
- C:\Windows\System\VpPMQkc.exe
  C:\Windows\System\VpPMQkc.exe
  2⤵
  PID:6704
- C:\Windows\System\HJKLfAF.exe
  C:\Windows\System\HJKLfAF.exe
  2⤵
  PID:6804
- C:\Windows\System\waDpBTM.exe
  C:\Windows\System\waDpBTM.exe
  2⤵
  PID:6500
- C:\Windows\System\oNtaZpA.exe
  C:\Windows\System\oNtaZpA.exe
  2⤵
  PID:6860
- C:\Windows\System\hqidkOD.exe
  C:\Windows\System\hqidkOD.exe
  2⤵
  PID:6436
- C:\Windows\System\fapNREj.exe
  C:\Windows\System\fapNREj.exe
  2⤵
  PID:6376
- C:\Windows\System\nXAvhRX.exe
  C:\Windows\System\nXAvhRX.exe
  2⤵
  PID:6320
- C:\Windows\System\XmcmWtf.exe
  C:\Windows\System\XmcmWtf.exe
  2⤵
  PID:7172
- C:\Windows\System\NshAHob.exe
  C:\Windows\System\NshAHob.exe
  2⤵
  PID:7188
- C:\Windows\System\mWJaVtM.exe
  C:\Windows\System\mWJaVtM.exe
  2⤵
  PID:7204
- C:\Windows\System\OSPAHlf.exe
  C:\Windows\System\OSPAHlf.exe
  2⤵
  PID:7220
- C:\Windows\System\SnGOcKB.exe
  C:\Windows\System\SnGOcKB.exe
  2⤵
  PID:7236
- C:\Windows\System\HoItYZy.exe
  C:\Windows\System\HoItYZy.exe
  2⤵
  PID:7252
- C:\Windows\System\nDvJXER.exe
  C:\Windows\System\nDvJXER.exe
  2⤵
  PID:7268
- C:\Windows\System\SPGAPKf.exe
  C:\Windows\System\SPGAPKf.exe
  2⤵
  PID:7284
- C:\Windows\System\KskNgAG.exe
  C:\Windows\System\KskNgAG.exe
  2⤵
  PID:7300
- C:\Windows\System\IUbfixP.exe
  C:\Windows\System\IUbfixP.exe
  2⤵
  PID:7316
- C:\Windows\System\HtZBllz.exe
  C:\Windows\System\HtZBllz.exe
  2⤵
  PID:7332
- C:\Windows\System\ajXyxdL.exe
  C:\Windows\System\ajXyxdL.exe
  2⤵
  PID:7348
- C:\Windows\System\gqmgViz.exe
  C:\Windows\System\gqmgViz.exe
  2⤵
  PID:7364
- C:\Windows\System\HAwELNw.exe
  C:\Windows\System\HAwELNw.exe
  2⤵
  PID:7380
- C:\Windows\System\PTPWRyD.exe
  C:\Windows\System\PTPWRyD.exe
  2⤵
  PID:7396
- C:\Windows\System\mJzFGZO.exe
  C:\Windows\System\mJzFGZO.exe
  2⤵
  PID:7412
- C:\Windows\System\igkkhej.exe
  C:\Windows\System\igkkhej.exe
  2⤵
  PID:7428
- C:\Windows\System\HbGWVwf.exe
  C:\Windows\System\HbGWVwf.exe
  2⤵
  PID:7444
- C:\Windows\System\gopJRha.exe
  C:\Windows\System\gopJRha.exe
  2⤵
  PID:7460
- C:\Windows\System\TQTVsbO.exe
  C:\Windows\System\TQTVsbO.exe
  2⤵
  PID:7476
- C:\Windows\System\QcxOYmX.exe
  C:\Windows\System\QcxOYmX.exe
  2⤵
  PID:7492
- C:\Windows\System\EyDkWTx.exe
  C:\Windows\System\EyDkWTx.exe
  2⤵
  PID:7508
- C:\Windows\System\wqfLiyU.exe
  C:\Windows\System\wqfLiyU.exe
  2⤵
  PID:7524
- C:\Windows\System\fRqoKIW.exe
  C:\Windows\System\fRqoKIW.exe
  2⤵
  PID:7540
- C:\Windows\System\nYIPbdl.exe
  C:\Windows\System\nYIPbdl.exe
  2⤵
  PID:7556
- C:\Windows\System\LPnCJFY.exe
  C:\Windows\System\LPnCJFY.exe
  2⤵
  PID:7572
- C:\Windows\System\QHuBbxY.exe
  C:\Windows\System\QHuBbxY.exe
  2⤵
  PID:7588
- C:\Windows\System\dYUKAyN.exe
  C:\Windows\System\dYUKAyN.exe
  2⤵
  PID:7604
- C:\Windows\System\fLMgPYb.exe
  C:\Windows\System\fLMgPYb.exe
  2⤵
  PID:7620
- C:\Windows\System\WtowIJH.exe
  C:\Windows\System\WtowIJH.exe
  2⤵
  PID:7636
- C:\Windows\System\yIxzrDU.exe
  C:\Windows\System\yIxzrDU.exe
  2⤵
  PID:7652
- C:\Windows\System\EKNjBKw.exe
  C:\Windows\System\EKNjBKw.exe
  2⤵
  PID:7668
- C:\Windows\System\cWvgIjU.exe
  C:\Windows\System\cWvgIjU.exe
  2⤵
  PID:7684
- C:\Windows\System\wpXpAfR.exe
  C:\Windows\System\wpXpAfR.exe
  2⤵
  PID:7700
- C:\Windows\System\WYMrVNs.exe
  C:\Windows\System\WYMrVNs.exe
  2⤵
  PID:7716
- C:\Windows\System\tKaZefi.exe
  C:\Windows\System\tKaZefi.exe
  2⤵
  PID:7732
- C:\Windows\System\VrPmeCx.exe
  C:\Windows\System\VrPmeCx.exe
  2⤵
  PID:7748
- C:\Windows\System\PAFadrr.exe
  C:\Windows\System\PAFadrr.exe
  2⤵
  PID:7764
- C:\Windows\System\PFePywB.exe
  C:\Windows\System\PFePywB.exe
  2⤵
  PID:7784
- C:\Windows\System\kqAjUaL.exe
  C:\Windows\System\kqAjUaL.exe
  2⤵
  PID:7800
- C:\Windows\System\QArmTum.exe
  C:\Windows\System\QArmTum.exe
  2⤵
  PID:7816
- C:\Windows\System\DNpFGBx.exe
  C:\Windows\System\DNpFGBx.exe
  2⤵
  PID:7832
- C:\Windows\System\RABYRZb.exe
  C:\Windows\System\RABYRZb.exe
  2⤵
  PID:7848
- C:\Windows\System\XBMMiCh.exe
  C:\Windows\System\XBMMiCh.exe
  2⤵
  PID:7864
- C:\Windows\System\nJYYdke.exe
  C:\Windows\System\nJYYdke.exe
  2⤵
  PID:7880
- C:\Windows\System\sSulDFB.exe
  C:\Windows\System\sSulDFB.exe
  2⤵
  PID:7896
- C:\Windows\System\qATnKeO.exe
  C:\Windows\System\qATnKeO.exe
  2⤵
  PID:7912
- C:\Windows\System\mNmkbRu.exe
  C:\Windows\System\mNmkbRu.exe
  2⤵
  PID:7928
- C:\Windows\System\tbWOnir.exe
  C:\Windows\System\tbWOnir.exe
  2⤵
  PID:7944
- C:\Windows\System\gHfKrot.exe
  C:\Windows\System\gHfKrot.exe
  2⤵
  PID:7960
- C:\Windows\System\SXetLda.exe
  C:\Windows\System\SXetLda.exe
  2⤵
  PID:7976
- C:\Windows\System\FTjqRqH.exe
  C:\Windows\System\FTjqRqH.exe
  2⤵
  PID:7992
- C:\Windows\System\bqpLSrn.exe
  C:\Windows\System\bqpLSrn.exe
  2⤵
  PID:8008
- C:\Windows\System\VOLvfUm.exe
  C:\Windows\System\VOLvfUm.exe
  2⤵
  PID:8024
- C:\Windows\System\TECdzFl.exe
  C:\Windows\System\TECdzFl.exe
  2⤵
  PID:8040
- C:\Windows\System\dpIiLnr.exe
  C:\Windows\System\dpIiLnr.exe
  2⤵
  PID:8056
- C:\Windows\System\SaYclBE.exe
  C:\Windows\System\SaYclBE.exe
  2⤵
  PID:8072
- C:\Windows\System\lWRLIiP.exe
  C:\Windows\System\lWRLIiP.exe
  2⤵
  PID:8088
- C:\Windows\System\qyFTqwA.exe
  C:\Windows\System\qyFTqwA.exe
  2⤵
  PID:8104
- C:\Windows\System\SyahnmZ.exe
  C:\Windows\System\SyahnmZ.exe
  2⤵
  PID:8120
- C:\Windows\System\yfJMDxX.exe
  C:\Windows\System\yfJMDxX.exe
  2⤵
  PID:8136
- C:\Windows\System\OthSdxM.exe
  C:\Windows\System\OthSdxM.exe
  2⤵
  PID:8152
- C:\Windows\System\XSlCkCD.exe
  C:\Windows\System\XSlCkCD.exe
  2⤵
  PID:8168
- C:\Windows\System\cknHxlr.exe
  C:\Windows\System\cknHxlr.exe
  2⤵
  PID:8184
- C:\Windows\System\JRNXwha.exe
  C:\Windows\System\JRNXwha.exe
  2⤵
  PID:7180
- C:\Windows\System\dHKAaWy.exe
  C:\Windows\System\dHKAaWy.exe
  2⤵
  PID:7244
- C:\Windows\System\ZTZizjC.exe
  C:\Windows\System\ZTZizjC.exe
  2⤵
  PID:7280
- C:\Windows\System\zPwWPom.exe
  C:\Windows\System\zPwWPom.exe
  2⤵
  PID:7200
- C:\Windows\System\hebChlK.exe
  C:\Windows\System\hebChlK.exe
  2⤵
  PID:6340
- C:\Windows\System\qvfjkCo.exe
  C:\Windows\System\qvfjkCo.exe
  2⤵
  PID:7340
- C:\Windows\System\JqLdjEy.exe
  C:\Windows\System\JqLdjEy.exe
  2⤵
  PID:7404
- C:\Windows\System\YMDOnBv.exe
  C:\Windows\System\YMDOnBv.exe
  2⤵
  PID:7260
- C:\Windows\System\EXVMWpV.exe
  C:\Windows\System\EXVMWpV.exe
  2⤵
  PID:7468
- C:\Windows\System\nObwvFh.exe
  C:\Windows\System\nObwvFh.exe
  2⤵
  PID:7388
- C:\Windows\System\BvevySb.exe
  C:\Windows\System\BvevySb.exe
  2⤵
  PID:7456
- C:\Windows\System\INAlBvc.exe
  C:\Windows\System\INAlBvc.exe
  2⤵
  PID:7420
- C:\Windows\System\cKepvdN.exe
  C:\Windows\System\cKepvdN.exe
  2⤵
  PID:7600
- C:\Windows\System\XeEOysh.exe
  C:\Windows\System\XeEOysh.exe
  2⤵
  PID:7628
- C:\Windows\System\AiZcgIU.exe
  C:\Windows\System\AiZcgIU.exe
  2⤵
  PID:7664
- C:\Windows\System\aBcanCO.exe
  C:\Windows\System\aBcanCO.exe
  2⤵
  PID:7724
- C:\Windows\System\yvVrKjv.exe
  C:\Windows\System\yvVrKjv.exe
  2⤵
  PID:7616
- C:\Windows\System\UiPjMXY.exe
  C:\Windows\System\UiPjMXY.exe
  2⤵
  PID:7552
- C:\Windows\System\GpTWhro.exe
  C:\Windows\System\GpTWhro.exe
  2⤵
  PID:7644
- C:\Windows\System\AFTcGOi.exe
  C:\Windows\System\AFTcGOi.exe
  2⤵
  PID:7708
- C:\Windows\System\JKPneNo.exe
  C:\Windows\System\JKPneNo.exe
  2⤵
  PID:7780
- C:\Windows\System\WoiRCbZ.exe
  C:\Windows\System\WoiRCbZ.exe
  2⤵
  PID:7828
- C:\Windows\System\pkJWQaC.exe
  C:\Windows\System\pkJWQaC.exe
  2⤵
  PID:7892
- C:\Windows\System\YOmkkki.exe
  C:\Windows\System\YOmkkki.exe
  2⤵
  PID:7956
- C:\Windows\System\IHWYVYf.exe
  C:\Windows\System\IHWYVYf.exe
  2⤵
  PID:8020
- C:\Windows\System\yXRLJpO.exe
  C:\Windows\System\yXRLJpO.exe
  2⤵
  PID:8084
- C:\Windows\System\gDvTpNa.exe
  C:\Windows\System\gDvTpNa.exe
  2⤵
  PID:8144
- C:\Windows\System\EepyzVg.exe
  C:\Windows\System\EepyzVg.exe
  2⤵
  PID:8180
- C:\Windows\System\TcGkXxB.exe
  C:\Windows\System\TcGkXxB.exe
  2⤵
  PID:8096
- C:\Windows\System\fSvVSOd.exe
  C:\Windows\System\fSvVSOd.exe
  2⤵
  PID:7904
- C:\Windows\System\KIgziyo.exe
  C:\Windows\System\KIgziyo.exe
  2⤵
  PID:7808
- C:\Windows\System\xAdrlAl.exe
  C:\Windows\System\xAdrlAl.exe
  2⤵
  PID:7972
- C:\Windows\System\HwObTPk.exe
  C:\Windows\System\HwObTPk.exe
  2⤵
  PID:8068
- C:\Windows\System\deitxwe.exe
  C:\Windows\System\deitxwe.exe
  2⤵
  PID:6924
- C:\Windows\System\QmJTkFI.exe
  C:\Windows\System\QmJTkFI.exe
  2⤵
  PID:7088
- C:\Windows\System\czbTFfq.exe
  C:\Windows\System\czbTFfq.exe
  2⤵
  PID:6496
- C:\Windows\System\jLzqgLb.exe
  C:\Windows\System\jLzqgLb.exe
  2⤵
  PID:7296
- C:\Windows\System\ICKhLFE.exe
  C:\Windows\System\ICKhLFE.exe
  2⤵
  PID:7324
- C:\Windows\System\SzgjYQN.exe
  C:\Windows\System\SzgjYQN.exe
  2⤵
  PID:7452
- C:\Windows\System\DqsSfpK.exe
  C:\Windows\System\DqsSfpK.exe
  2⤵
  PID:1572
- C:\Windows\System\VSzIsVZ.exe
  C:\Windows\System\VSzIsVZ.exe
  2⤵
  PID:7568
- C:\Windows\System\gzbBbGr.exe
  C:\Windows\System\gzbBbGr.exe
  2⤵
  PID:7756
- C:\Windows\System\tdkcVPe.exe
  C:\Windows\System\tdkcVPe.exe
  2⤵
  PID:7796
- C:\Windows\System\hFbnoAw.exe
  C:\Windows\System\hFbnoAw.exe
  2⤵
  PID:8052
- C:\Windows\System\FMWMuLX.exe
  C:\Windows\System\FMWMuLX.exe
  2⤵
  PID:7872
- C:\Windows\System\LePjyOX.exe
  C:\Windows\System\LePjyOX.exe
  2⤵
  PID:8132
- C:\Windows\System\xjFDQpH.exe
  C:\Windows\System\xjFDQpH.exe
  2⤵
  PID:7728
- C:\Windows\System\dmnekIe.exe
  C:\Windows\System\dmnekIe.exe
  2⤵
  PID:7888
- C:\Windows\System\FlQemqa.exe
  C:\Windows\System\FlQemqa.exe
  2⤵
  PID:7232
- C:\Windows\System\eAtIASb.exe
  C:\Windows\System\eAtIASb.exe
  2⤵
  PID:7988
- C:\Windows\System\zNvGYhc.exe
  C:\Windows\System\zNvGYhc.exe
  2⤵
  PID:7812
- C:\Windows\System\YTyATSE.exe
  C:\Windows\System\YTyATSE.exe
  2⤵
  PID:7488
- C:\Windows\System\DmbQURJ.exe
  C:\Windows\System\DmbQURJ.exe
  2⤵
  PID:8116
- C:\Windows\System\crQThdm.exe
  C:\Windows\System\crQThdm.exe
  2⤵
  PID:7924
- C:\Windows\System\dUJpHMF.exe
  C:\Windows\System\dUJpHMF.exe
  2⤵
  PID:7776
- C:\Windows\System\MOOoQrD.exe
  C:\Windows\System\MOOoQrD.exe
  2⤵
  PID:7968
- C:\Windows\System\RuVobem.exe
  C:\Windows\System\RuVobem.exe
  2⤵
  PID:7312
- C:\Windows\System\fnuTgKC.exe
  C:\Windows\System\fnuTgKC.exe
  2⤵
  PID:7216
- C:\Windows\System\LmoXfMC.exe
  C:\Windows\System\LmoXfMC.exe
  2⤵
  PID:8112
- C:\Windows\System\NLcGoZa.exe
  C:\Windows\System\NLcGoZa.exe
  2⤵
  PID:7760
- C:\Windows\System\MLNCKWZ.exe
  C:\Windows\System\MLNCKWZ.exe
  2⤵
  PID:6780
- C:\Windows\System\TnMfQMn.exe
  C:\Windows\System\TnMfQMn.exe
  2⤵
  PID:7860
- C:\Windows\System\ZujhvPf.exe
  C:\Windows\System\ZujhvPf.exe
  2⤵
  PID:8160
- C:\Windows\System\IvfnRem.exe
  C:\Windows\System\IvfnRem.exe
  2⤵
  PID:7676
- C:\Windows\System\EBhfRoc.exe
  C:\Windows\System\EBhfRoc.exe
  2⤵
  PID:7660
- C:\Windows\System\eGtkIvE.exe
  C:\Windows\System\eGtkIvE.exe
  2⤵
  PID:8196
- C:\Windows\System\vqaKDFi.exe
  C:\Windows\System\vqaKDFi.exe
  2⤵
  PID:8212
- C:\Windows\System\UVXTOle.exe
  C:\Windows\System\UVXTOle.exe
  2⤵
  PID:8228
- C:\Windows\System\urMdTRm.exe
  C:\Windows\System\urMdTRm.exe
  2⤵
  PID:8244
- C:\Windows\System\RpaccPY.exe
  C:\Windows\System\RpaccPY.exe
  2⤵
  PID:8260
- C:\Windows\System\IjWeLYF.exe
  C:\Windows\System\IjWeLYF.exe
  2⤵
  PID:8276
- C:\Windows\System\xsdnUdp.exe
  C:\Windows\System\xsdnUdp.exe
  2⤵
  PID:8292
- C:\Windows\System\wykVKVc.exe
  C:\Windows\System\wykVKVc.exe
  2⤵
  PID:8308
- C:\Windows\System\vRozPTD.exe
  C:\Windows\System\vRozPTD.exe
  2⤵
  PID:8324
- C:\Windows\System\rwbhJIt.exe
  C:\Windows\System\rwbhJIt.exe
  2⤵
  PID:8340
- C:\Windows\System\ygciAgl.exe
  C:\Windows\System\ygciAgl.exe
  2⤵
  PID:8356
- C:\Windows\System\IFKnCVJ.exe
  C:\Windows\System\IFKnCVJ.exe
  2⤵
  PID:8372
- C:\Windows\System\OwFsOPn.exe
  C:\Windows\System\OwFsOPn.exe
  2⤵
  PID:8388
- C:\Windows\System\KmSLtJe.exe
  C:\Windows\System\KmSLtJe.exe
  2⤵
  PID:8404
- C:\Windows\System\UoUroTM.exe
  C:\Windows\System\UoUroTM.exe
  2⤵
  PID:8420
- C:\Windows\System\ykAgjTg.exe
  C:\Windows\System\ykAgjTg.exe
  2⤵
  PID:8436
- C:\Windows\System\HpGdiYo.exe
  C:\Windows\System\HpGdiYo.exe
  2⤵
  PID:8452
- C:\Windows\System\XssjGiU.exe
  C:\Windows\System\XssjGiU.exe
  2⤵
  PID:8468
- C:\Windows\System\OWxpUHX.exe
  C:\Windows\System\OWxpUHX.exe
  2⤵
  PID:8484
- C:\Windows\System\FiBvlpT.exe
  C:\Windows\System\FiBvlpT.exe
  2⤵
  PID:8500
- C:\Windows\System\KsFbbYE.exe
  C:\Windows\System\KsFbbYE.exe
  2⤵
  PID:8516
- C:\Windows\System\vyRSKHU.exe
  C:\Windows\System\vyRSKHU.exe
  2⤵
  PID:8532
- C:\Windows\System\djNLLoR.exe
  C:\Windows\System\djNLLoR.exe
  2⤵
  PID:8548
- C:\Windows\System\OrtciGq.exe
  C:\Windows\System\OrtciGq.exe
  2⤵
  PID:8564
- C:\Windows\System\PFtSwit.exe
  C:\Windows\System\PFtSwit.exe
  2⤵
  PID:8580
- C:\Windows\System\HHYZQyH.exe
  C:\Windows\System\HHYZQyH.exe
  2⤵
  PID:8596
- C:\Windows\System\sdEAmLj.exe
  C:\Windows\System\sdEAmLj.exe
  2⤵
  PID:8612
- C:\Windows\System\yXULcWy.exe
  C:\Windows\System\yXULcWy.exe
  2⤵
  PID:8628
- C:\Windows\System\eFbuRvh.exe
  C:\Windows\System\eFbuRvh.exe
  2⤵
  PID:8644
- C:\Windows\System\alGVcdo.exe
  C:\Windows\System\alGVcdo.exe
  2⤵
  PID:8660
- C:\Windows\System\sIAfWnl.exe
  C:\Windows\System\sIAfWnl.exe
  2⤵
  PID:8676
- C:\Windows\System\yauflJR.exe
  C:\Windows\System\yauflJR.exe
  2⤵
  PID:8692
- C:\Windows\System\ibyywkG.exe
  C:\Windows\System\ibyywkG.exe
  2⤵
  PID:8708
- C:\Windows\System\uPxDYWZ.exe
  C:\Windows\System\uPxDYWZ.exe
  2⤵
  PID:8724
- C:\Windows\System\kNlCgmS.exe
  C:\Windows\System\kNlCgmS.exe
  2⤵
  PID:8740
- C:\Windows\System\UpIdGik.exe
  C:\Windows\System\UpIdGik.exe
  2⤵
  PID:8756
- C:\Windows\System\JTDVGOP.exe
  C:\Windows\System\JTDVGOP.exe
  2⤵
  PID:8772
- C:\Windows\System\qCLVFbF.exe
  C:\Windows\System\qCLVFbF.exe
  2⤵
  PID:8788
- C:\Windows\System\xxvdGNP.exe
  C:\Windows\System\xxvdGNP.exe
  2⤵
  PID:8804
- C:\Windows\System\DRRIESs.exe
  C:\Windows\System\DRRIESs.exe
  2⤵
  PID:8820
- C:\Windows\System\jmYjzFl.exe
  C:\Windows\System\jmYjzFl.exe
  2⤵
  PID:8836
- C:\Windows\System\kJvjiJo.exe
  C:\Windows\System\kJvjiJo.exe
  2⤵
  PID:8852
- C:\Windows\System\knXJgkX.exe
  C:\Windows\System\knXJgkX.exe
  2⤵
  PID:8868
- C:\Windows\System\KyEnozO.exe
  C:\Windows\System\KyEnozO.exe
  2⤵
  PID:8884
- C:\Windows\System\uJDYWIP.exe
  C:\Windows\System\uJDYWIP.exe
  2⤵
  PID:8900
- C:\Windows\System\CTdCNPs.exe
  C:\Windows\System\CTdCNPs.exe
  2⤵
  PID:8916
- C:\Windows\System\veXeXHt.exe
  C:\Windows\System\veXeXHt.exe
  2⤵
  PID:8932
- C:\Windows\System\aQwEcJU.exe
  C:\Windows\System\aQwEcJU.exe
  2⤵
  PID:8948
- C:\Windows\System\QeVrnvK.exe
  C:\Windows\System\QeVrnvK.exe
  2⤵
  PID:8964
- C:\Windows\System\wehThex.exe
  C:\Windows\System\wehThex.exe
  2⤵
  PID:8980
- C:\Windows\System\xAnwsAJ.exe
  C:\Windows\System\xAnwsAJ.exe
  2⤵
  PID:8996
- C:\Windows\System\rcZEEnp.exe
  C:\Windows\System\rcZEEnp.exe
  2⤵
  PID:9012
- C:\Windows\System\uvCasiH.exe
  C:\Windows\System\uvCasiH.exe
  2⤵
  PID:9028
- C:\Windows\System\Mdeadlh.exe
  C:\Windows\System\Mdeadlh.exe
  2⤵
  PID:9044
- C:\Windows\System\vtABOAg.exe
  C:\Windows\System\vtABOAg.exe
  2⤵
  PID:9060
- C:\Windows\System\VCXjEhh.exe
  C:\Windows\System\VCXjEhh.exe
  2⤵
  PID:9076
- C:\Windows\System\eJRFWFt.exe
  C:\Windows\System\eJRFWFt.exe
  2⤵
  PID:9092
- C:\Windows\System\YFTKQWG.exe
  C:\Windows\System\YFTKQWG.exe
  2⤵
  PID:9108
- C:\Windows\System\NtcAhWn.exe
  C:\Windows\System\NtcAhWn.exe
  2⤵
  PID:9124
- C:\Windows\System\BldbaHt.exe
  C:\Windows\System\BldbaHt.exe
  2⤵
  PID:9140
- C:\Windows\System\qvLnHMA.exe
  C:\Windows\System\qvLnHMA.exe
  2⤵
  PID:9156
- C:\Windows\System\EwwqhDX.exe
  C:\Windows\System\EwwqhDX.exe
  2⤵
  PID:9172
- C:\Windows\System\TIaHLMu.exe
  C:\Windows\System\TIaHLMu.exe
  2⤵
  PID:9188
- C:\Windows\System\AeqkhOD.exe
  C:\Windows\System\AeqkhOD.exe
  2⤵
  PID:9204
- C:\Windows\System\hGvrpSb.exe
  C:\Windows\System\hGvrpSb.exe
  2⤵
  PID:7356
- C:\Windows\System\ElXJogM.exe
  C:\Windows\System\ElXJogM.exe
  2⤵
  PID:7292
- C:\Windows\System\HzxJkOS.exe
  C:\Windows\System\HzxJkOS.exe
  2⤵
  PID:8252
- C:\Windows\System\fGVQKKg.exe
  C:\Windows\System\fGVQKKg.exe
  2⤵
  PID:8240
- C:\Windows\System\HVFRRRK.exe
  C:\Windows\System\HVFRRRK.exe
  2⤵
  PID:8316
- C:\Windows\System\cIDpFBT.exe
  C:\Windows\System\cIDpFBT.exe
  2⤵
  PID:8352
- C:\Windows\System\peDUWpF.exe
  C:\Windows\System\peDUWpF.exe
  2⤵
  PID:8384
- C:\Windows\System\EdtISsb.exe
  C:\Windows\System\EdtISsb.exe
  2⤵
  PID:8396
- C:\Windows\System\EQjbKEt.exe
  C:\Windows\System\EQjbKEt.exe
  2⤵
  PID:8448
- C:\Windows\System\sPMOlSy.exe
  C:\Windows\System\sPMOlSy.exe
  2⤵
  PID:8432
- C:\Windows\System\aMdIPES.exe
  C:\Windows\System\aMdIPES.exe
  2⤵
  PID:8496
- C:\Windows\System\HmuUmWL.exe
  C:\Windows\System\HmuUmWL.exe
  2⤵
  PID:8540
- C:\Windows\System\MsJJXHc.exe
  C:\Windows\System\MsJJXHc.exe
  2⤵
  PID:8528
- C:\Windows\System\tupMaIX.exe
  C:\Windows\System\tupMaIX.exe
  2⤵
  PID:8588
- C:\Windows\System\edxDbAc.exe
  C:\Windows\System\edxDbAc.exe
  2⤵
  PID:8556
- C:\Windows\System\rZJCDxU.exe
  C:\Windows\System\rZJCDxU.exe
  2⤵
  PID:8672
- C:\Windows\System\yZPNLEp.exe
  C:\Windows\System\yZPNLEp.exe
  2⤵
  PID:8736
- C:\Windows\System\SmuzcFV.exe
  C:\Windows\System\SmuzcFV.exe
  2⤵
  PID:8800
- C:\Windows\System\hbBUpnU.exe
  C:\Windows\System\hbBUpnU.exe
  2⤵
  PID:8688
- C:\Windows\System\VxPGhyM.exe
  C:\Windows\System\VxPGhyM.exe
  2⤵
  PID:8652
- C:\Windows\System\ePRcgBU.exe
  C:\Windows\System\ePRcgBU.exe
  2⤵
  PID:8816
- C:\Windows\System\btEhCcy.exe
  C:\Windows\System\btEhCcy.exe
  2⤵
  PID:8896
- C:\Windows\System\JSBpPSp.exe
  C:\Windows\System\JSBpPSp.exe
  2⤵
  PID:8844
- C:\Windows\System\VELVHOk.exe
  C:\Windows\System\VELVHOk.exe
  2⤵
  PID:8924
- C:\Windows\System\YXSjCfc.exe
  C:\Windows\System\YXSjCfc.exe
  2⤵
  PID:8988
- C:\Windows\System\mBamIri.exe
  C:\Windows\System\mBamIri.exe
  2⤵
  PID:8972
- C:\Windows\System\pRJjAnG.exe
  C:\Windows\System\pRJjAnG.exe
  2⤵
  PID:9052
- C:\Windows\System\VlGinDF.exe
  C:\Windows\System\VlGinDF.exe
  2⤵
  PID:9036
- C:\Windows\System\piKeFKA.exe
  C:\Windows\System\piKeFKA.exe
  2⤵
  PID:9040
- C:\Windows\System\reVUSqt.exe
  C:\Windows\System\reVUSqt.exe
  2⤵
  PID:9104
- C:\Windows\System\fnYKYzO.exe
  C:\Windows\System\fnYKYzO.exe
  2⤵
  PID:9152
- C:\Windows\System\nlQVzSd.exe
  C:\Windows\System\nlQVzSd.exe
  2⤵
  PID:7436
- C:\Windows\System\VBEqXSv.exe
  C:\Windows\System\VBEqXSv.exe
  2⤵
  PID:8236
- C:\Windows\System\KbCCKDA.exe
  C:\Windows\System\KbCCKDA.exe
  2⤵
  PID:8224
- C:\Windows\System\ZsyHmQa.exe
  C:\Windows\System\ZsyHmQa.exe
  2⤵
  PID:8064
- C:\Windows\System\QCRjZZS.exe
  C:\Windows\System\QCRjZZS.exe
  2⤵
  PID:8380
- C:\Windows\System\QXtXmBg.exe
  C:\Windows\System\QXtXmBg.exe
  2⤵
  PID:8512
- C:\Windows\System\GNphtol.exe
  C:\Windows\System\GNphtol.exe
  2⤵
  PID:8624
- C:\Windows\System\PnzADJe.exe
  C:\Windows\System\PnzADJe.exe
  2⤵
  PID:8832
- C:\Windows\System\HhJZzqg.exe
  C:\Windows\System\HhJZzqg.exe
  2⤵
  PID:8412
- C:\Windows\System\WVOSNvr.exe
  C:\Windows\System\WVOSNvr.exe
  2⤵
  PID:8524
- C:\Windows\System\uQLWobD.exe
  C:\Windows\System\uQLWobD.exe
  2⤵
  PID:8668
- C:\Windows\System\YdmIInu.exe
  C:\Windows\System\YdmIInu.exe
  2⤵
  PID:8864
- C:\Windows\System\yuayPgM.exe
  C:\Windows\System\yuayPgM.exe
  2⤵
  PID:8880
- C:\Windows\System\gSzVrOk.exe
  C:\Windows\System\gSzVrOk.exe
  2⤵
  PID:8752
- C:\Windows\System\gLCpdsG.exe
  C:\Windows\System\gLCpdsG.exe
  2⤵
  PID:8960
- C:\Windows\System\xVgPaLW.exe
  C:\Windows\System\xVgPaLW.exe
  2⤵
  PID:9120
- C:\Windows\System\MvCvaLf.exe
  C:\Windows\System\MvCvaLf.exe
  2⤵
  PID:8208
- C:\Windows\System\hsHbdaN.exe
  C:\Windows\System\hsHbdaN.exe
  2⤵
  PID:8444
- C:\Windows\System\ftXbIQo.exe
  C:\Windows\System\ftXbIQo.exe
  2⤵
  PID:8428
- C:\Windows\System\aqmRxKS.exe
  C:\Windows\System\aqmRxKS.exe
  2⤵
  PID:8784
- C:\Windows\System\yoLHduE.exe
  C:\Windows\System\yoLHduE.exe
  2⤵
  PID:8288
- C:\Windows\System\TRToQXT.exe
  C:\Windows\System\TRToQXT.exe
  2⤵
  PID:8912
- C:\Windows\System\QeqKnZq.exe
  C:\Windows\System\QeqKnZq.exe
  2⤵
  PID:9164
- C:\Windows\System\cLKphug.exe
  C:\Windows\System\cLKphug.exe
  2⤵
  PID:8812
- C:\Windows\System\jTQLwLv.exe
  C:\Windows\System\jTQLwLv.exe
  2⤵
  PID:9136
- C:\Windows\System\eEaJUPY.exe
  C:\Windows\System\eEaJUPY.exe
  2⤵
  PID:8304
- C:\Windows\System\oGzFuEg.exe
  C:\Windows\System\oGzFuEg.exe
  2⤵
  PID:9100
- C:\Windows\System\nPGVYis.exe
  C:\Windows\System\nPGVYis.exe
  2⤵
  PID:8704
- C:\Windows\System\NaFQPxC.exe
  C:\Windows\System\NaFQPxC.exe
  2⤵
  PID:8640
- C:\Windows\System\QefzYIE.exe
  C:\Windows\System\QefzYIE.exe
  2⤵
  PID:9212
- C:\Windows\System\ItCgCxE.exe
  C:\Windows\System\ItCgCxE.exe
  2⤵
  PID:8364
- C:\Windows\System\RFeaamt.exe
  C:\Windows\System\RFeaamt.exe
  2⤵
  PID:9088
- C:\Windows\System\SPOnMqR.exe
  C:\Windows\System\SPOnMqR.exe
  2⤵
  PID:9024
- C:\Windows\System\kWKTpcC.exe
  C:\Windows\System\kWKTpcC.exe
  2⤵
  PID:9020
- C:\Windows\System\wOHhaIB.exe
  C:\Windows\System\wOHhaIB.exe
  2⤵
  PID:9224
- C:\Windows\System\fmIVJZG.exe
  C:\Windows\System\fmIVJZG.exe
  2⤵
  PID:9240
- C:\Windows\System\TIGDWDL.exe
  C:\Windows\System\TIGDWDL.exe
  2⤵
  PID:9260
- C:\Windows\System\QBJmsYi.exe
  C:\Windows\System\QBJmsYi.exe
  2⤵
  PID:9276
- C:\Windows\System\VBKivet.exe
  C:\Windows\System\VBKivet.exe
  2⤵
  PID:9292
- C:\Windows\System\cLpYpSH.exe
  C:\Windows\System\cLpYpSH.exe
  2⤵
  PID:9308
- C:\Windows\System\KpMwYpT.exe
  C:\Windows\System\KpMwYpT.exe
  2⤵
  PID:9324
- C:\Windows\System\iPROMgj.exe
  C:\Windows\System\iPROMgj.exe
  2⤵
  PID:9340
- C:\Windows\System\wRerVJg.exe
  C:\Windows\System\wRerVJg.exe
  2⤵
  PID:9356
- C:\Windows\System\ngZMgfn.exe
  C:\Windows\System\ngZMgfn.exe
  2⤵
  PID:9372
- C:\Windows\System\hOTpMnL.exe
  C:\Windows\System\hOTpMnL.exe
  2⤵
  PID:9388
- C:\Windows\System\drSSFkL.exe
  C:\Windows\System\drSSFkL.exe
  2⤵
  PID:9404
- C:\Windows\System\hzCyqak.exe
  C:\Windows\System\hzCyqak.exe
  2⤵
  PID:9420
- C:\Windows\System\fJKgAyK.exe
  C:\Windows\System\fJKgAyK.exe
  2⤵
  PID:9436
- C:\Windows\System\yqIDVeR.exe
  C:\Windows\System\yqIDVeR.exe
  2⤵
  PID:9452
- C:\Windows\System\LqWirLu.exe
  C:\Windows\System\LqWirLu.exe
  2⤵
  PID:9468
- C:\Windows\System\BLcrTJd.exe
  C:\Windows\System\BLcrTJd.exe
  2⤵
  PID:9484
- C:\Windows\System\xxbIxpF.exe
  C:\Windows\System\xxbIxpF.exe
  2⤵
  PID:9500
- C:\Windows\System\TzZGLXo.exe
  C:\Windows\System\TzZGLXo.exe
  2⤵
  PID:9516
- C:\Windows\System\NpMkXTT.exe
  C:\Windows\System\NpMkXTT.exe
  2⤵
  PID:9532
- C:\Windows\System\zJEtJPs.exe
  C:\Windows\System\zJEtJPs.exe
  2⤵
  PID:9548
- C:\Windows\System\UzRohQI.exe
  C:\Windows\System\UzRohQI.exe
  2⤵
  PID:9564
- C:\Windows\System\xxWouJK.exe
  C:\Windows\System\xxWouJK.exe
  2⤵
  PID:9580
- C:\Windows\System\vuaCbWL.exe
  C:\Windows\System\vuaCbWL.exe
  2⤵
  PID:9596
- C:\Windows\System\kljTVqz.exe
  C:\Windows\System\kljTVqz.exe
  2⤵
  PID:9612
- C:\Windows\System\nasFZyS.exe
  C:\Windows\System\nasFZyS.exe
  2⤵
  PID:9628
- C:\Windows\System\bRwZPVl.exe
  C:\Windows\System\bRwZPVl.exe
  2⤵
  PID:9644
- C:\Windows\System\vPKWWUY.exe
  C:\Windows\System\vPKWWUY.exe
  2⤵
  PID:9660
- C:\Windows\System\aoTxyNB.exe
  C:\Windows\System\aoTxyNB.exe
  2⤵
  PID:9676
- C:\Windows\System\AlwVcry.exe
  C:\Windows\System\AlwVcry.exe
  2⤵
  PID:9692
- C:\Windows\System\FFVlPaK.exe
  C:\Windows\System\FFVlPaK.exe
  2⤵
  PID:9708
- C:\Windows\System\ZIhPRUk.exe
  C:\Windows\System\ZIhPRUk.exe
  2⤵
  PID:9724
- C:\Windows\System\ChHZgRe.exe
  C:\Windows\System\ChHZgRe.exe
  2⤵
  PID:9740
- C:\Windows\System\sPwOqsC.exe
  C:\Windows\System\sPwOqsC.exe
  2⤵
  PID:9760
- C:\Windows\System\blOmOEb.exe
  C:\Windows\System\blOmOEb.exe
  2⤵
  PID:9776
- C:\Windows\System\fqyazsQ.exe
  C:\Windows\System\fqyazsQ.exe
  2⤵
  PID:9792
- C:\Windows\System\sZdbAre.exe
  C:\Windows\System\sZdbAre.exe
  2⤵
  PID:9808
- C:\Windows\System\kTnWhSD.exe
  C:\Windows\System\kTnWhSD.exe
  2⤵
  PID:9824
- C:\Windows\System\zGHQCdX.exe
  C:\Windows\System\zGHQCdX.exe
  2⤵
  PID:9852
- C:\Windows\System\DFLHrYR.exe
  C:\Windows\System\DFLHrYR.exe
  2⤵
  PID:9944
- C:\Windows\System\cZKtADB.exe
  C:\Windows\System\cZKtADB.exe
  2⤵
  PID:9964
- C:\Windows\System\NrWcjZq.exe
  C:\Windows\System\NrWcjZq.exe
  2⤵
  PID:9980
- C:\Windows\System\SRIozar.exe
  C:\Windows\System\SRIozar.exe
  2⤵
  PID:10000
- C:\Windows\System\EyESmlc.exe
  C:\Windows\System\EyESmlc.exe
  2⤵
  PID:10016
- C:\Windows\System\qhOjtfX.exe
  C:\Windows\System\qhOjtfX.exe
  2⤵
  PID:10032
- C:\Windows\System\RqheHfu.exe
  C:\Windows\System\RqheHfu.exe
  2⤵
  PID:10052
- C:\Windows\System\TyWomvK.exe
  C:\Windows\System\TyWomvK.exe
  2⤵
  PID:10068
- C:\Windows\System\CPvqzww.exe
  C:\Windows\System\CPvqzww.exe
  2⤵
  PID:10084
- C:\Windows\System\KbFncCZ.exe
  C:\Windows\System\KbFncCZ.exe
  2⤵
  PID:10100
- C:\Windows\System\VdXIIRn.exe
  C:\Windows\System\VdXIIRn.exe
  2⤵
  PID:10116
- C:\Windows\System\EnxifCQ.exe
  C:\Windows\System\EnxifCQ.exe
  2⤵
  PID:10132
- C:\Windows\System\MyULOxB.exe
  C:\Windows\System\MyULOxB.exe
  2⤵
  PID:10148
- C:\Windows\System\NsjuELe.exe
  C:\Windows\System\NsjuELe.exe
  2⤵
  PID:10164
- C:\Windows\System\lcABFIR.exe
  C:\Windows\System\lcABFIR.exe
  2⤵
  PID:10180
- C:\Windows\System\OxWorrC.exe
  C:\Windows\System\OxWorrC.exe
  2⤵
  PID:10200
- C:\Windows\System\njdiIUr.exe
  C:\Windows\System\njdiIUr.exe
  2⤵
  PID:10216
- C:\Windows\System\vuDkOWs.exe
  C:\Windows\System\vuDkOWs.exe
  2⤵
  PID:10232
- C:\Windows\System\JmSHTgO.exe
  C:\Windows\System\JmSHTgO.exe
  2⤵
  PID:9084
- C:\Windows\System\JmycGYK.exe
  C:\Windows\System\JmycGYK.exe
  2⤵
  PID:8268
- C:\Windows\System\uEXGyxl.exe
  C:\Windows\System\uEXGyxl.exe
  2⤵
  PID:9300
- C:\Windows\System\pYHvaGA.exe
  C:\Windows\System\pYHvaGA.exe
  2⤵
  PID:9364
- C:\Windows\System\KEitGIy.exe
  C:\Windows\System\KEitGIy.exe
  2⤵
  PID:9428
- C:\Windows\System\cZLrmFo.exe
  C:\Windows\System\cZLrmFo.exe
  2⤵
  PID:9492
- C:\Windows\System\JTYlhhl.exe
  C:\Windows\System\JTYlhhl.exe
  2⤵
  PID:9556
- C:\Windows\System\MRUvxUb.exe
  C:\Windows\System\MRUvxUb.exe
  2⤵
  PID:9620
- C:\Windows\System\EmeKtSG.exe
  C:\Windows\System\EmeKtSG.exe
  2⤵
  PID:9684
- C:\Windows\System\WVjxjpZ.exe
  C:\Windows\System\WVjxjpZ.exe
  2⤵
  PID:9748
- C:\Windows\System\NesesYx.exe
  C:\Windows\System\NesesYx.exe
  2⤵
  PID:9540
- C:\Windows\System\ofDYMVj.exe
  C:\Windows\System\ofDYMVj.exe
  2⤵
  PID:9820
- C:\Windows\System\nOvctzP.exe
  C:\Windows\System\nOvctzP.exe
  2⤵
  PID:9348
- C:\Windows\System\VityeVq.exe
  C:\Windows\System\VityeVq.exe
  2⤵
  PID:9672
- C:\Windows\System\BwkFmyd.exe
  C:\Windows\System\BwkFmyd.exe
  2⤵
  PID:9768
- C:\Windows\System\vJgkThZ.exe
  C:\Windows\System\vJgkThZ.exe
  2⤵
  PID:9448
- C:\Windows\System\xditFId.exe
  C:\Windows\System\xditFId.exe
  2⤵
  PID:9544
- C:\Windows\System\iYrVKRO.exe
  C:\Windows\System\iYrVKRO.exe
  2⤵
  PID:9924
- C:\Windows\System\iUOWIJE.exe
  C:\Windows\System\iUOWIJE.exe
  2⤵
  PID:9976
- C:\Windows\System\LEdzlHe.exe
  C:\Windows\System\LEdzlHe.exe
  2⤵
  PID:10040
- C:\Windows\System\XcbLJle.exe
  C:\Windows\System\XcbLJle.exe
  2⤵
  PID:10080
- C:\Windows\System\WoVhbeO.exe
  C:\Windows\System\WoVhbeO.exe
  2⤵
  PID:9996
- C:\Windows\System\dzzhGYf.exe
  C:\Windows\System\dzzhGYf.exe
  2⤵
  PID:10144
- C:\Windows\System\wiqvESQ.exe
  C:\Windows\System\wiqvESQ.exe
  2⤵
  PID:10028
- C:\Windows\System\iAnNUau.exe
  C:\Windows\System\iAnNUau.exe
  2⤵
  PID:10092
- C:\Windows\System\pQjNpdt.exe
  C:\Windows\System\pQjNpdt.exe
  2⤵
  PID:10192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BfzulSV.exe

Filesize
2.1MB

MD5
8eb19792cc428d7b404a7d5912d260a3

SHA1
ab71a9ac383bbd4eccbdd5e371f34974f9b80e82

SHA256
3839f92c3fccf1270930b6dbe261a22e8c19d5a2938fa96dfdf1aa25baf2c732

SHA512
8a702cc45ed53c8adf3e0244c5c21826b6a1b7df1669cf9212c1e45ff83b38659a9f4939f9a3810cd818638dcc2093fcb6b58e69ac7d29ca3e802cdcb9bf2c41

Download Submit
C:\Windows\system\CDLiesm.exe

Filesize
2.1MB

MD5
b56670858db02a423858007126a21592

SHA1
b4bb797967ac089de540ec89f4c095b203c30966

SHA256
221eed3146fdc477d82f6c17995a94f54929c2a37bb11b4c23a63508b5c7dd61

SHA512
adf0fc939e17eee6ff02b9592feb5c3eeec91b8bfa7a30f684c92c6f380a12d16c599bba540a143bf043c124737d46b68cbc68a0bc14500471788fb4b50ad3f0

Download Submit
C:\Windows\system\CYXNdiG.exe

Filesize
2.1MB

MD5
9d553b28768e7f7366b171e3831f3e59

SHA1
7669730b1263fbefd6367599b7b5b4ce7f7c76e7

SHA256
e03fd1d7128c6011a83e43cac1bc3742702299f7fad06f51fd37b6695ad77178

SHA512
8d1703f29a00881ca5147c04b043cab4b6e983d1a27052d254c91411df142f921d7067d20bfa93fb000e498c5e50c57a7b1f3e827efd6304af491401fbdf1d57

Download Submit
C:\Windows\system\HBzeIMw.exe

Filesize
2.1MB

MD5
08b255476b18cc2076da16e106458bd9

SHA1
f335bcd8f366fbf08548a12cf51dd6f773753525

SHA256
9c26c7bd542d46d68fa09a88f0ff940d5f9c9868bbca0691db3054e215688346

SHA512
bd060249281cbdf1f7ff9f5a2266b8a04ff8afd08381a046feb783c3c0248704b192b58ed6f49b33ce8e3a55ecff33636f0ba62cc66d63f63c7125886e3114c0

Download Submit
C:\Windows\system\HJRtrPR.exe

Filesize
2.1MB

MD5
4c02690abf4fb02169582c5f77c8b7ff

SHA1
03060f81e490588e5698370f56fa541b197e4cfb

SHA256
a798470080055577389e7597dbc922d001bf5e18247ed9f38a27d72ec9372657

SHA512
c2f71995826a60eb4c8bac413210293c39b93329a99fc2ede911e51c2278ef84839cf011d11a73190f5eca97b34070f6556621561ac0995f4832d2224017eaec

Download Submit
C:\Windows\system\IGqZtjh.exe

Filesize
2.1MB

MD5
7094dc363e133f9a8ba8b0d48fa694a9

SHA1
fecfe68fd5150085fdcb5051193236381720124b

SHA256
a0a6ca1bfe942321852fa1cfb2b148003ef9f88b97ea8302ec648c90ce16e555

SHA512
383670e31686935d827857c6e7e78ca8860f4d0398a1d03e8d2e2ba73a40966e4302fc1f0ee7c317638cf1cb688aa7c62d7dc32a495de4f3bf9c2028dc8bb0d1

Download Submit
C:\Windows\system\NWZseaA.exe

Filesize
2.1MB

MD5
3cfc8657e191448e63fd52592d3b6238

SHA1
c6a622a52a805abaab958289b8b665cc336adf38

SHA256
b9fe906337edd423f466d99e3ef81d82baed8d1cdc13a3350a0b6ca1bce8fe9f

SHA512
8300a30190db691ae0e76e59f7f3a330edd29ce201e2f33304d8de68d0ad36e05d1616296a67e4dac72404d3037784ca759116b1302f239b22d4f88a2cc19b99

Download Submit
C:\Windows\system\OZYArzS.exe

Filesize
2.1MB

MD5
762f6bced7fc8b9f2bf012e4d44c8aeb

SHA1
dda36d1e58d8df38b71e5e50ebc6378cc46ec146

SHA256
bc26c0662a66a90bd4702c4c385ed8b8f61c1ae59728bba06afe43ea0d1212f0

SHA512
171e87fab34b3b92be289f6ac3a9aad4a0e677ced0e01140bac0191432ace33e389c5d20bd300fc4dd0e650a0e6f4e38ce24bf6cd8e9cecefcedb5929ccc5e6e

Download Submit
C:\Windows\system\OmFdgnB.exe

Filesize
2.1MB

MD5
adb2ae3186adfb6cce8006f4b8859d30

SHA1
c40815e9669e7052f1471d96735a9fa68a5cf0b7

SHA256
81fe788f1071bff9480b3ad893372a96d99df37cb22f78720d9035a9ab78127f

SHA512
cbd47202944c3bd157a7b4833dd6183b3db959c89f1f55e231cf43851aa1cc4e2886543cf986896f6203fc7940301e10a498c0322ca88e6f83cbe84625c8596a

Download Submit
C:\Windows\system\OoblWcA.exe

Filesize
2.1MB

MD5
9ef601191e88d5a77fe8f6b974945f57

SHA1
88c771ba211971eb6d0785f9f555434304fab1d1

SHA256
ff21b6360d377ae50f98118d821017869680fca4688e348fe9f7c2477c83e0fe

SHA512
7bad335ccbd6e68d71114567f0357dcc2fed2b6f5d4e10bde4b3da83f990f2ba9953355b96a5e683490a9a343ffe981be9ddfe29c1407ccb2a895746ca6af360

Download Submit
C:\Windows\system\WLyIwmU.exe

Filesize
2.1MB

MD5
638c493ba1196909f50dbf45ac59b3f3

SHA1
c4d382e13aae8e45c87310e9184b47bb61f0e28c

SHA256
6f5b2a3b06bee64985fee78c555b690089966cd2648609702024858aa1c9b07d

SHA512
2b76cc17f29cd0ba10331b8d89b82a41f8fd4f0e0652fc72e6390948ce6fcc83e7fe20f4d1953c7e2d2eea893724e303916ad2df5497a14aa45bd88a59044164

Download Submit
C:\Windows\system\crrEczl.exe

Filesize
2.1MB

MD5
08ad8feec74e922a474e4d39fc1af87c

SHA1
1f22d3be53b009ba4e3e305e9ceeb1612ee2b87d

SHA256
f95eaa4f56f797ad4bf39b270ad3813240fccdab4423ce536e41c066c17c4a23

SHA512
d5bb2c0b1ff2bfa59db02adc6a00f6d49d9fab71b6417190842238e8e5f15f42f57d206403f02c64da68c843d3054d574cf9c1175d868db7add55856e90522b4

Download Submit
C:\Windows\system\cuYRmTV.exe

Filesize
2.1MB

MD5
9aabb99fd95c262cd34409cdaaa4e778

SHA1
f6f682be37235026a24b5ad64ec7adce4b85e688

SHA256
4a1af2fce0d9ea565832f873aac596f5b05b0e0b9bbd976b6c29423280a326d0

SHA512
9b857f8bff745cd5435a5b18b3877dfbb9de88bf0c40158cf6b98b1c8dc0da905b383b067f92415a8ec34706dc851bbcb73d59a3eb022a43e67fd1de32dfb2d9

Download Submit
C:\Windows\system\lkyzAgW.exe

Filesize
2.1MB

MD5
19dd5ade4d5772b7086ffc4161620a08

SHA1
2c06b8bd8e5bb247c66f99b2856984df3cc7962e

SHA256
e28b95e15aaec4efa38cdcb1d1ac17a80848c16d60a49dfa37bfaa4fa8a895ff

SHA512
5e824db1e05bb6c552abbba4c857dbced44961fcfba8f87e1a199134e2b2dbb7d9d39070253fce1c84a0acc53aca9a372e187d46fa618fd2133de03b82f72a0b

Download Submit
C:\Windows\system\nJZBuFs.exe

Filesize
2.1MB

MD5
26a4ed70c5a29bd7e52a29f167f2cb44

SHA1
dd343b6fe8a04f267982af4e4da6677785e176a1

SHA256
07e52b9579724ca26a45babc1f3ec2fc79c204b93d16ee7e9dae3215b9fa2bc6

SHA512
addd7d33e39d4440a7d24ae839bbec1c4f2205dc40a516076787d75405061a7b123d75960e7e1659c3890e2c907d36c07fb34e7e93456fe427a0eb705f508061

Download Submit
C:\Windows\system\qZZbGbR.exe

Filesize
2.1MB

MD5
bd9deb91354e76299195551ea34a2218

SHA1
b3e67c9962a31451cdf20cc047ff5ca846760dd6

SHA256
2df930099634e2df1bd870272d64cef5203f2470b125728337572c73797ab5c5

SHA512
c62113db54cd189f34a4588a3511c81007eb73cbcbf79d72b9c144f75fed8347922c78d28f7b0ed2c7b8202756cd243252591932e9d5c2d26e0f4aafec3358f8

Download Submit
C:\Windows\system\qwXlNXu.exe

Filesize
2.1MB

MD5
450b689e7c911202a32be52b66ee1a67

SHA1
805eb3c11ec632379ee64ad3174b05283db32296

SHA256
f246aee83801d7708f0ad588a5a43eca0a0aa342527692cdb55fefaa3e02fbe8

SHA512
99f67b70d638540bd8651029e955fd78347eee0b74dc7bcade4431a96969293c7ff60e8b5ff513d78198c5eed60ce0d7fdcafab10b84c11e3df2e49f3d58e1be

Download Submit
C:\Windows\system\seHXfLw.exe

Filesize
2.1MB

MD5
481ea92e9c33ed15fbf329b7ac1edd63

SHA1
edbaa6e87742fe55da68a0ad94757b14d7475d90

SHA256
2c58b0cd7e910110d614853dfd78b86971c4327644bb1bb4f3d731973ffbff7c

SHA512
b9f4495a6bc7c77c6b536d59ade8efbb9b50caeb228037b5671e2b3be87f84a66773736b0c4722f2d7dea65e208decb78605f623b8a4ae8bb682f4c867abc279

Download Submit
C:\Windows\system\vfRoTid.exe

Filesize
2.1MB

MD5
de325be5dc9e4699a5ec51180611ce25

SHA1
7f5225551d7d7934082dfa77fbd4a6a06b36d7f8

SHA256
8e85170b3b0a52f07c4bf9abb21917b191f004703493d4bf6a751dc5971e9577

SHA512
c67099bc51f113f9ac94bc06ea872b259b383bf7d092e8cb83a8ba1f4d21798ecfda2c7f5d96ea9344bd53c9affb31dea8b12a95ae9718e981132da256f41641

Download Submit
C:\Windows\system\vitCPEX.exe

Filesize
2.1MB

MD5
8f8548f58338c40677e8d3f696ec4139

SHA1
4c03d40006b42d11bdf1cdfb51454162cab5ed87

SHA256
cb3592d92c1dad24f499d52e9b6c2d4b7bb763761e6b5c11c618de29baa47ae5

SHA512
6769d97a48dc2427c6f4cf251179865b42876dfb364c5a593d4a9469dd614ff2caed1a6626678988b313e7569c991a89e0b5a4deff87d8feb7897bc3dcc3ae1d

Download Submit
\Windows\system\BfSQvUt.exe

Filesize
2.1MB

MD5
7915e029c08d47c71dee651fe890ac1c

SHA1
e28601f69954c3f2a02f26028cd91431ef8e982b

SHA256
b1b0a2d14c68daf73a22e4bc44ecbb1e0d6e65341fe3b25815d07b11b3860bb8

SHA512
600bceb1e3929b1b1c72e0503a3cbee8d6e74f4bb28ae0259045c724aa10b72a895be1d204ee1b6b8d22a9442d2fd101a2ca5ef18b1ebf5bf1d6ebd0235d02f1

Download Submit
\Windows\system\CXzJpZi.exe

Filesize
2.1MB

MD5
01488cca65a23a7ee426b7f8031b2536

SHA1
afca6ef99d9e38676927c885607d1a83806b012d

SHA256
57ad4bd57ca3021c3fdf3534f219d1986a700921236f028ace7f6b353698368f

SHA512
68810a4cae782bb34b97b6e11b5153b47e5ea8d03e17d5689ce896419ffeb84abb2af8ce33143281975cc70c1902586306e0f031d28f660171f33da69e95cd61

Download Submit
\Windows\system\JdvkXMm.exe

Filesize
2.1MB

MD5
80476b713959d3f23ddf2fbf6e9a48a0

SHA1
5264a27b00effe67b9ef086aaf0b778c18d4ef3a

SHA256
69c1858edd041ebeccabeaba9b317dabf5eae86399cbe95bd0c70aaad2a189e1

SHA512
fd66ccd6deb812e2d163482fa05b8d52486c0a9790b736fc892d88550bc94dcf12ade7b816abf950e1c954e4bd6810110c6a5ae9c8d23e0ef56733f75142c789

Download Submit
\Windows\system\MmBWNVC.exe

Filesize
2.1MB

MD5
c0e16ec8c21b503a5cedda5ab6afc694

SHA1
47c9578cac80926adc0635904d33b7e58a1cccd7

SHA256
9b572820b8fb076a484f91c9d017bcfb98f6fd2da831e4fce8f7fd73ad50b9a3

SHA512
b1ed48ead773189a4d864a30167c9b09bfd711fba3c9ce74012e5482b4a3d3125d8ee78900041b3599298addb8c4dc768fde46d9668db90a421306cf6bfecec0

Download Submit
\Windows\system\OXwOzla.exe

Filesize
2.1MB

MD5
aee5bbaf9eb78120a9fd8ae3edf421d9

SHA1
d370d0f70457703eecd05e44b744e486e91eceb9

SHA256
9718a2d4f8dea5a2b62b223d7d1d9af6f0ab54f1b7a6ca1d17635aaf052b6038

SHA512
f4204d4205c361a69991b1119438e7bf8d2a25ab939f9fff563fe8ee03ce895aab3ae0dedb1f20a28febf25343e3a4f3ff652b0e773d8a2dfcb4e8ab59452134

Download Submit
\Windows\system\casEiNj.exe

Filesize
2.1MB

MD5
edc18168b1c8fa5f86d9ef6c8506e543

SHA1
517c6ffcc6eeb8a6d1a87abd77b98a95ccc4f979

SHA256
d7d74f0785f94dbb01be088d800d6577beb3bb289edf9534d9fdc89c71004267

SHA512
7ffe5646338c874b4e3d0c64543094373e82ae15fb694ea898b55c02c4a79c36226083a9061733117ae123bfd718eb86e31b616ec2e00af405baad1d64677bd5

Download Submit
\Windows\system\foYKAsV.exe

Filesize
2.1MB

MD5
104243f94e88e9df6dadefa23e0ee915

SHA1
e77b96816002520762bcec09747af1e95dc32804

SHA256
96dd09bae390fabec1c66804c64d700bd255465d1802923231a81bca83b937a1

SHA512
32a06fadc382773647f5bf71e2a8d42699e4bbdbf7032c2da69161485b2bfe0017ebf893818c45380e3be87c1124c04a3e798260132acdea392f902e492dc0a2

Download Submit
\Windows\system\fvVMOTb.exe

Filesize
2.1MB

MD5
216e14a3fc31c4e939d4e7534f121ef4

SHA1
0d7fe9229356db65f6f7a704dfe006d25e69e62c

SHA256
7c6d36424091a1c8d93c6e39165a92c5e15d79c5bd1becbf6024ab113175899c

SHA512
963e0f89f0fa83b29bffac911e2996878b4c120cf5b046847fbff1e795869aa95c2217f76739a753d910cbbd8161e4fc69677e87dea020679891213ac0ab0d14

Download Submit
\Windows\system\jYOVMYU.exe

Filesize
2.1MB

MD5
fdf2a020efc854f403c8dd29693bc54b

SHA1
a8c5575782f660a70c176a111ba1f053cf057212

SHA256
f4810d12ac5be201d47a25f1a87872dc733c55b61b42bdcc0a7fb72be96d0790

SHA512
e5f8b2e789d81664f9bacf5b370ca54b518f959a08f9c2fce41e9ae3bee9317db4d992a95d0385485af949032d10c56b9675ced41478d928a4a22f812d34864a

Download Submit
\Windows\system\kIDZkzB.exe

Filesize
2.1MB

MD5
257400cbd675ba42136d240a69fa2df2

SHA1
1ab94315fe1d071bf89af3a3f86b3dd5beb35cd2

SHA256
d231b843ae79336cff5a999704ea5fe3613931535dbd77a890c1003d9983e065

SHA512
25c24b6825b532c8eae70a2d7d3e11cc1cc7bbeb6afb55d8f6a793c842ba2de1cf486276813dd1e04c776d5353d4f676069105d635db1d80e721cc65273a8220

Download Submit
\Windows\system\sxgpTBm.exe

Filesize
2.1MB

MD5
4a55d41e48756f5ec2077f8316f6898e

SHA1
b10928802cbddf00e8a8e5567df82caca1c0b84e

SHA256
0765daa08b3e00e952133aff271b6915bd413742978ef724a7d3e98ec1cde7ea

SHA512
06b361ad23c4b7efb5aa24bd5ded5591de874d679392c137ecf9e42a3512e5da69b64c334a0ee102b6776f06351352818d41ec21d6a539c22a624ffad79a938e

Download Submit
\Windows\system\wQuJnpo.exe

Filesize
2.1MB

MD5
117ecbaef0dd0db30d61a0125b409d6b

SHA1
b25539dd598eface233e0bc421f4c99101855bc0

SHA256
e3566f695b15967fff39e6bf3d9ad435d5400b976f6c5d0ade699279e56fe554

SHA512
e3ef2e663ecdac09266574102494d3e10f76b11494fb887034235628e86e288c0792006d54e935cc868983cd132162d403fd87e71cc0e67e43f80540b226ab5b

Download Submit
memory/548-109-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2156-74-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2156-77-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2172-68-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2208-81-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-99-0x0000000002E50000-0x0000000003242000-memory.dmp

Filesize
3.9MB

Download
memory/2208-82-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2208-58-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2208-7-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2208-56-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2208-51-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2208-73-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2208-75-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2208-76-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2208-25-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-36-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2208-28-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2208-107-0x00000000033A0000-0x0000000003792000-memory.dmp

Filesize
3.9MB

Download
memory/2208-33-0x0000000002E50000-0x0000000003242000-memory.dmp

Filesize
3.9MB

Download
memory/2208-65-0x000000013F3A0000-0x000000013F792000-memory.dmp

Filesize
3.9MB

Download
memory/2208-0-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2336-78-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2444-57-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-61-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2552-52-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2568-34-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-876-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-16-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2664-86-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-26-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-87-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/3056-80-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/3056-21-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download