xmrig | 3966bf10a679055cca2ef9b25d8f08070059678df9e2156539dd44bb9f7f4f14

Analysis

max time kernel
23s
max time network
22s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Size

1.6MB
MD5

0938f66df725143335dc34a5b839c5c2
SHA1

0e7345d330b03417539b24ef6607cc1f2058254e
SHA256

3966bf10a679055cca2ef9b25d8f08070059678df9e2156539dd44bb9f7f4f14
SHA512

839dcb3659abb25439881d6bc1ccb92fe121bcf6fcaeb0ddbe050f25c22d31b621f514f358d4ede0ad8a124f6fea760780880bc6ae0ecf21e0a63128736f4062
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82Sz/:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2684-20-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2120-16-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2580-50-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2684-531-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2372-67-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	xmrig
behavioral1/memory/2480-65-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2420-64-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig
behavioral1/memory/2120-68-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2540-39-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/3004-36-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2120	SfZFMVq.exe
2684	NPHrBYS.exe
2540	LjBOrUz.exe
3004	JuEVNBb.exe
2580	HdCmPaz.exe
2420	MqMxicE.exe
2480	hPAtRFi.exe
2908	XTwUwSx.exe
796	wfqPLHb.exe
2664	smMLJTO.exe
2660	vALkRHJ.exe
1876	annFYSh.exe
2200	gNfzhjK.exe
2352	MBiOqKz.exe
2184	TNIWlZy.exe
836	uemNUlP.exe
3016	JALlviX.exe
2276	hVYQQZO.exe
2260	esDMOGB.exe
2164	UngaEux.exe
1180	UKsEQfR.exe
1408	IbZNuzb.exe
1464	NCRRzZK.exe
2256	rWaYVhJ.exe
1100	nGnCkdq.exe
2668	KiINwGG.exe
1480	ILutLmE.exe
1300	ifVuXAW.exe
1248	dBmmrjG.exe
900	WmYJkRN.exe
572	UfZMSDg.exe
2356	WGIUIcp.exe
1488	ovkKPdj.exe
2320	xdpzzLT.exe
612	pIGTBFS.exe
848	kxqqlLe.exe
2000	mBwABfu.exe
1536	jKwjPmy.exe
2976	DslbTgX.exe
2700	EEZKleN.exe
2472	OWtCPTc.exe
2476	oeiZZtT.exe
2620	tBmbZMF.exe
1932	ygUpqmC.exe
1988	zybsdRT.exe
2316	adPjRfU.exe
356	ugMRaHs.exe
1612	gwOoObX.exe
1580	EzsfOLv.exe
2820	FddCFFE.exe
2068	TFtDpyB.exe
2052	NcDSGCH.exe
488	dNhbYmB.exe
1440	ouiGfrc.exe
2836	jHFtTyA.exe
2156	eLunfSG.exe
280	ghzQhzW.exe
1916	dsprMgN.exe
320	duSaBnA.exe
2812	vFYtBjR.exe
3076	fATwCKB.exe
3108	lkJauej.exe
3148	StVVtqb.exe
2760	CgAvltT.exe

Loads dropped DLL 64 IoCs

pid	Process
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2372-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x000c00000001225d-3.dat	upx
behavioral1/files/0x00320000000139f1-13.dat	upx
behavioral1/memory/2684-20-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0016000000005586-22.dat	upx
behavioral1/memory/2120-16-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0008000000014171-25.dat	upx
behavioral1/files/0x0007000000014183-44.dat	upx
behavioral1/files/0x000700000001418c-46.dat	upx
behavioral1/memory/2580-50-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0007000000014251-52.dat	upx
behavioral1/files/0x0006000000014f57-88.dat	upx
behavioral1/files/0x0006000000015083-100.dat	upx
behavioral1/files/0x000600000001565a-113.dat	upx
behavioral1/files/0x0006000000015cee-155.dat	upx
behavioral1/files/0x0006000000015d0a-162.dat	upx
behavioral1/files/0x0006000000015d21-164.dat	upx
behavioral1/files/0x0006000000015cf8-157.dat	upx
behavioral1/files/0x0006000000015f23-185.dat	upx
behavioral1/files/0x0006000000015d85-178.dat	upx
behavioral1/memory/2684-531-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/files/0x0006000000015d59-171.dat	upx
behavioral1/files/0x0006000000015ce3-150.dat	upx
behavioral1/files/0x0006000000015cc5-143.dat	upx
behavioral1/files/0x0006000000015ca8-136.dat	upx
behavioral1/files/0x0006000000015b85-129.dat	upx
behavioral1/files/0x0006000000015ae3-122.dat	upx
behavioral1/files/0x0006000000015662-115.dat	upx
behavioral1/memory/2372-67-0x000000013F5C0000-0x000000013F9B2000-memory.dmp	upx
behavioral1/files/0x00060000000153ee-108.dat	upx
behavioral1/files/0x0032000000013a3f-101.dat	upx
behavioral1/files/0x000800000001432f-66.dat	upx
behavioral1/memory/2480-65-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2420-64-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000600000001507a-93.dat	upx
behavioral1/files/0x0006000000014c2d-80.dat	upx
behavioral1/memory/2908-75-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-72.dat	upx
behavioral1/memory/2120-68-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0006000000015d9c-183.dat	upx
behavioral1/files/0x0006000000015d61-176.dat	upx
behavioral1/files/0x0006000000015d39-169.dat	upx
behavioral1/files/0x0006000000015cd2-148.dat	upx
behavioral1/files/0x0006000000015cb1-141.dat	upx
behavioral1/files/0x0006000000015c9a-134.dat	upx
behavioral1/files/0x0006000000015b50-127.dat	upx
behavioral1/files/0x00060000000158d9-120.dat	upx
behavioral1/files/0x00060000000150d9-106.dat	upx
behavioral1/files/0x0006000000014bd7-87.dat	upx
behavioral1/files/0x0006000000014a60-86.dat	upx
behavioral1/memory/2540-39-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/3004-36-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LwlSJAG.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\NgvQyav.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\Kmuxtmc.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gKIgfyt.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\BpJNCxY.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\HGfEarz.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\fATwCKB.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\uHjICCe.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\UZLRinT.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\YXDZPYI.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\wuBjgSe.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gmVZcJv.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\IXKTVjH.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\cqDoziQ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\JoFSNqa.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\kJIrngK.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\jkACVKF.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\YHZFBCV.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\lRETYgO.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\amwuyzd.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\NwwyifR.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\SeekHeJ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\Wlovgdr.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\RrauMrJ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\aeXInIx.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\PshjKnI.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\TNIWlZy.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\zByluUr.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\PqHkuEZ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\IbIfCCL.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\homzMOE.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\jxjFnso.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\kHHRhFr.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\iZwrPOM.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\eNQfViH.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\YMzCFQu.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\yaJlLQh.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\MiSXwHh.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\quJhRqb.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\sOpfXVn.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\aFaXnzf.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\EzsfOLv.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\oKldFRX.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\rOSIxGN.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gEAbIgK.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\JJEWoFp.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\NOJxRfD.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\VBVOLCx.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\lDCrojS.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\HRRIWpK.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\gnDyGQZ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\hXakGOR.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\wFyvOgc.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\ojfAOTK.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\UQdBYQL.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\bYawIrp.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\kUfAmGQ.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\sKZpVTq.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\yVUFdYl.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\cODdmmB.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\IyRluLx.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\zyEEhfR.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\NOEbXDl.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
File created	C:\Windows\System\yGUYhJs.exe	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
616	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
Token: SeDebugPrivilege	616	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 616	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	29
PID 2372 wrote to memory of 616	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	29
PID 2372 wrote to memory of 616	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	29
PID 2372 wrote to memory of 2120	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2120	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2120	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	30
PID 2372 wrote to memory of 2684	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2684	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 2684	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	31
PID 2372 wrote to memory of 3004	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	32
PID 2372 wrote to memory of 3004	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	32
PID 2372 wrote to memory of 3004	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	32
PID 2372 wrote to memory of 2540	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2540	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2540	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	33
PID 2372 wrote to memory of 2580	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2580	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2580	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	34
PID 2372 wrote to memory of 2420	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2420	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2420	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	35
PID 2372 wrote to memory of 2480	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2480	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2480	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	36
PID 2372 wrote to memory of 2908	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2908	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	37
PID 2372 wrote to memory of 2908	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	37
PID 2372 wrote to memory of 796	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	38
PID 2372 wrote to memory of 796	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	38
PID 2372 wrote to memory of 796	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	38
PID 2372 wrote to memory of 2476	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2476	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2476	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	39
PID 2372 wrote to memory of 2664	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2664	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2664	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	40
PID 2372 wrote to memory of 2620	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2620	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2620	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	41
PID 2372 wrote to memory of 2660	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2660	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	42
PID 2372 wrote to memory of 2660	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	42
PID 2372 wrote to memory of 1932	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	43
PID 2372 wrote to memory of 1932	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	43
PID 2372 wrote to memory of 1932	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	43
PID 2372 wrote to memory of 1876	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	44
PID 2372 wrote to memory of 1876	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	44
PID 2372 wrote to memory of 1876	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	44
PID 2372 wrote to memory of 1988	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	45
PID 2372 wrote to memory of 1988	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	45
PID 2372 wrote to memory of 1988	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	45
PID 2372 wrote to memory of 2200	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2200	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2200	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	46
PID 2372 wrote to memory of 2316	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2316	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2316	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	47
PID 2372 wrote to memory of 2352	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	48
PID 2372 wrote to memory of 2352	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	48
PID 2372 wrote to memory of 2352	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	48
PID 2372 wrote to memory of 356	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	49
PID 2372 wrote to memory of 356	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	49
PID 2372 wrote to memory of 356	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	49
PID 2372 wrote to memory of 2184	2372	0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0938f66df725143335dc34a5b839c5c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\System\SfZFMVq.exe
  C:\Windows\System\SfZFMVq.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\NPHrBYS.exe
  C:\Windows\System\NPHrBYS.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\JuEVNBb.exe
  C:\Windows\System\JuEVNBb.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\LjBOrUz.exe
  C:\Windows\System\LjBOrUz.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\HdCmPaz.exe
  C:\Windows\System\HdCmPaz.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\MqMxicE.exe
  C:\Windows\System\MqMxicE.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\hPAtRFi.exe
  C:\Windows\System\hPAtRFi.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\XTwUwSx.exe
  C:\Windows\System\XTwUwSx.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\wfqPLHb.exe
  C:\Windows\System\wfqPLHb.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\oeiZZtT.exe
  C:\Windows\System\oeiZZtT.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\smMLJTO.exe
  C:\Windows\System\smMLJTO.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\tBmbZMF.exe
  C:\Windows\System\tBmbZMF.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\vALkRHJ.exe
  C:\Windows\System\vALkRHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\ygUpqmC.exe
  C:\Windows\System\ygUpqmC.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\annFYSh.exe
  C:\Windows\System\annFYSh.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\zybsdRT.exe
  C:\Windows\System\zybsdRT.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\gNfzhjK.exe
  C:\Windows\System\gNfzhjK.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\adPjRfU.exe
  C:\Windows\System\adPjRfU.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\MBiOqKz.exe
  C:\Windows\System\MBiOqKz.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\ugMRaHs.exe
  C:\Windows\System\ugMRaHs.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\TNIWlZy.exe
  C:\Windows\System\TNIWlZy.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\gwOoObX.exe
  C:\Windows\System\gwOoObX.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\uemNUlP.exe
  C:\Windows\System\uemNUlP.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\EzsfOLv.exe
  C:\Windows\System\EzsfOLv.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\JALlviX.exe
  C:\Windows\System\JALlviX.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\FddCFFE.exe
  C:\Windows\System\FddCFFE.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\hVYQQZO.exe
  C:\Windows\System\hVYQQZO.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\TFtDpyB.exe
  C:\Windows\System\TFtDpyB.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\esDMOGB.exe
  C:\Windows\System\esDMOGB.exe
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Windows\System\NcDSGCH.exe
  C:\Windows\System\NcDSGCH.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\UngaEux.exe
  C:\Windows\System\UngaEux.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\dNhbYmB.exe
  C:\Windows\System\dNhbYmB.exe
  2⤵
  - Executes dropped EXE
  PID:488
- C:\Windows\System\UKsEQfR.exe
  C:\Windows\System\UKsEQfR.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\ouiGfrc.exe
  C:\Windows\System\ouiGfrc.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\IbZNuzb.exe
  C:\Windows\System\IbZNuzb.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\CgAvltT.exe
  C:\Windows\System\CgAvltT.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\NCRRzZK.exe
  C:\Windows\System\NCRRzZK.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\yMqKbco.exe
  C:\Windows\System\yMqKbco.exe
  2⤵
  PID:952
- C:\Windows\System\rWaYVhJ.exe
  C:\Windows\System\rWaYVhJ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\KbCXhhj.exe
  C:\Windows\System\KbCXhhj.exe
  2⤵
  PID:824
- C:\Windows\System\nGnCkdq.exe
  C:\Windows\System\nGnCkdq.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\NojSrrq.exe
  C:\Windows\System\NojSrrq.exe
  2⤵
  PID:2968
- C:\Windows\System\KiINwGG.exe
  C:\Windows\System\KiINwGG.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ShXVZco.exe
  C:\Windows\System\ShXVZco.exe
  2⤵
  PID:1252
- C:\Windows\System\ILutLmE.exe
  C:\Windows\System\ILutLmE.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\ZldJCuv.exe
  C:\Windows\System\ZldJCuv.exe
  2⤵
  PID:2036
- C:\Windows\System\ifVuXAW.exe
  C:\Windows\System\ifVuXAW.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\SyVKpTp.exe
  C:\Windows\System\SyVKpTp.exe
  2⤵
  PID:2904
- C:\Windows\System\dBmmrjG.exe
  C:\Windows\System\dBmmrjG.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\vSuBunU.exe
  C:\Windows\System\vSuBunU.exe
  2⤵
  PID:2932
- C:\Windows\System\WmYJkRN.exe
  C:\Windows\System\WmYJkRN.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\FTcPKsh.exe
  C:\Windows\System\FTcPKsh.exe
  2⤵
  PID:944
- C:\Windows\System\UfZMSDg.exe
  C:\Windows\System\UfZMSDg.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\SLggNuY.exe
  C:\Windows\System\SLggNuY.exe
  2⤵
  PID:2868
- C:\Windows\System\WGIUIcp.exe
  C:\Windows\System\WGIUIcp.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\JZaoTOu.exe
  C:\Windows\System\JZaoTOu.exe
  2⤵
  PID:1660
- C:\Windows\System\ovkKPdj.exe
  C:\Windows\System\ovkKPdj.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\DoQQkxL.exe
  C:\Windows\System\DoQQkxL.exe
  2⤵
  PID:3056
- C:\Windows\System\xdpzzLT.exe
  C:\Windows\System\xdpzzLT.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\AEiDYLR.exe
  C:\Windows\System\AEiDYLR.exe
  2⤵
  PID:344
- C:\Windows\System\pIGTBFS.exe
  C:\Windows\System\pIGTBFS.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\vLmlKZj.exe
  C:\Windows\System\vLmlKZj.exe
  2⤵
  PID:1432
- C:\Windows\System\kxqqlLe.exe
  C:\Windows\System\kxqqlLe.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\kjGLRDp.exe
  C:\Windows\System\kjGLRDp.exe
  2⤵
  PID:2944
- C:\Windows\System\mBwABfu.exe
  C:\Windows\System\mBwABfu.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\IGmAFvO.exe
  C:\Windows\System\IGmAFvO.exe
  2⤵
  PID:2496
- C:\Windows\System\jKwjPmy.exe
  C:\Windows\System\jKwjPmy.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\hphozsA.exe
  C:\Windows\System\hphozsA.exe
  2⤵
  PID:2828
- C:\Windows\System\DslbTgX.exe
  C:\Windows\System\DslbTgX.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\MCVWlnO.exe
  C:\Windows\System\MCVWlnO.exe
  2⤵
  PID:2564
- C:\Windows\System\EEZKleN.exe
  C:\Windows\System\EEZKleN.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\UbfJNLA.exe
  C:\Windows\System\UbfJNLA.exe
  2⤵
  PID:2996
- C:\Windows\System\OWtCPTc.exe
  C:\Windows\System\OWtCPTc.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\LGwxXeQ.exe
  C:\Windows\System\LGwxXeQ.exe
  2⤵
  PID:2624
- C:\Windows\System\jHFtTyA.exe
  C:\Windows\System\jHFtTyA.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\iSkNaMA.exe
  C:\Windows\System\iSkNaMA.exe
  2⤵
  PID:2516
- C:\Windows\System\eLunfSG.exe
  C:\Windows\System\eLunfSG.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\GbYFvVP.exe
  C:\Windows\System\GbYFvVP.exe
  2⤵
  PID:1940
- C:\Windows\System\ghzQhzW.exe
  C:\Windows\System\ghzQhzW.exe
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Windows\System\PtOPbaz.exe
  C:\Windows\System\PtOPbaz.exe
  2⤵
  PID:2180
- C:\Windows\System\dsprMgN.exe
  C:\Windows\System\dsprMgN.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\yugTLAo.exe
  C:\Windows\System\yugTLAo.exe
  2⤵
  PID:2652
- C:\Windows\System\duSaBnA.exe
  C:\Windows\System\duSaBnA.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\LwlSJAG.exe
  C:\Windows\System\LwlSJAG.exe
  2⤵
  PID:2792
- C:\Windows\System\vFYtBjR.exe
  C:\Windows\System\vFYtBjR.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\BsNGnRY.exe
  C:\Windows\System\BsNGnRY.exe
  2⤵
  PID:2392
- C:\Windows\System\fATwCKB.exe
  C:\Windows\System\fATwCKB.exe
  2⤵
  - Executes dropped EXE
  PID:3076
- C:\Windows\System\neiYFRK.exe
  C:\Windows\System\neiYFRK.exe
  2⤵
  PID:3092
- C:\Windows\System\lkJauej.exe
  C:\Windows\System\lkJauej.exe
  2⤵
  - Executes dropped EXE
  PID:3108
- C:\Windows\System\qxnbHBp.exe
  C:\Windows\System\qxnbHBp.exe
  2⤵
  PID:3124
- C:\Windows\System\StVVtqb.exe
  C:\Windows\System\StVVtqb.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\WACTNfE.exe
  C:\Windows\System\WACTNfE.exe
  2⤵
  PID:3232
- C:\Windows\System\DFdPivW.exe
  C:\Windows\System\DFdPivW.exe
  2⤵
  PID:3248
- C:\Windows\System\vdqTWdk.exe
  C:\Windows\System\vdqTWdk.exe
  2⤵
  PID:3304
- C:\Windows\System\zqCGzWl.exe
  C:\Windows\System\zqCGzWl.exe
  2⤵
  PID:3320
- C:\Windows\System\ymiYDMX.exe
  C:\Windows\System\ymiYDMX.exe
  2⤵
  PID:3336
- C:\Windows\System\ZAmzqtt.exe
  C:\Windows\System\ZAmzqtt.exe
  2⤵
  PID:3352
- C:\Windows\System\AEMThXZ.exe
  C:\Windows\System\AEMThXZ.exe
  2⤵
  PID:3368
- C:\Windows\System\XTUkadP.exe
  C:\Windows\System\XTUkadP.exe
  2⤵
  PID:3384
- C:\Windows\System\UhIBypU.exe
  C:\Windows\System\UhIBypU.exe
  2⤵
  PID:3400
- C:\Windows\System\IvhRXqF.exe
  C:\Windows\System\IvhRXqF.exe
  2⤵
  PID:3420
- C:\Windows\System\CQxWQXK.exe
  C:\Windows\System\CQxWQXK.exe
  2⤵
  PID:3436
- C:\Windows\System\gEAbIgK.exe
  C:\Windows\System\gEAbIgK.exe
  2⤵
  PID:3452
- C:\Windows\System\EkNZATn.exe
  C:\Windows\System\EkNZATn.exe
  2⤵
  PID:3468
- C:\Windows\System\PaenQfg.exe
  C:\Windows\System\PaenQfg.exe
  2⤵
  PID:3484
- C:\Windows\System\zyEEhfR.exe
  C:\Windows\System\zyEEhfR.exe
  2⤵
  PID:3500
- C:\Windows\System\wlvlKAL.exe
  C:\Windows\System\wlvlKAL.exe
  2⤵
  PID:3516
- C:\Windows\System\hXakGOR.exe
  C:\Windows\System\hXakGOR.exe
  2⤵
  PID:3532
- C:\Windows\System\pRxIsiG.exe
  C:\Windows\System\pRxIsiG.exe
  2⤵
  PID:3552
- C:\Windows\System\gaKqqTy.exe
  C:\Windows\System\gaKqqTy.exe
  2⤵
  PID:3568
- C:\Windows\System\AVDNKNy.exe
  C:\Windows\System\AVDNKNy.exe
  2⤵
  PID:3584
- C:\Windows\System\homzMOE.exe
  C:\Windows\System\homzMOE.exe
  2⤵
  PID:3600
- C:\Windows\System\wrfhzsV.exe
  C:\Windows\System\wrfhzsV.exe
  2⤵
  PID:3616
- C:\Windows\System\lvnhHko.exe
  C:\Windows\System\lvnhHko.exe
  2⤵
  PID:3632
- C:\Windows\System\AmoGhDv.exe
  C:\Windows\System\AmoGhDv.exe
  2⤵
  PID:3648
- C:\Windows\System\nfgzrhD.exe
  C:\Windows\System\nfgzrhD.exe
  2⤵
  PID:3664
- C:\Windows\System\fWzdLtp.exe
  C:\Windows\System\fWzdLtp.exe
  2⤵
  PID:3684
- C:\Windows\System\jDuxPAk.exe
  C:\Windows\System\jDuxPAk.exe
  2⤵
  PID:3700
- C:\Windows\System\hSRMKXZ.exe
  C:\Windows\System\hSRMKXZ.exe
  2⤵
  PID:3732
- C:\Windows\System\JJEWoFp.exe
  C:\Windows\System\JJEWoFp.exe
  2⤵
  PID:3748
- C:\Windows\System\uArBBvZ.exe
  C:\Windows\System\uArBBvZ.exe
  2⤵
  PID:3764
- C:\Windows\System\ICcfldz.exe
  C:\Windows\System\ICcfldz.exe
  2⤵
  PID:3780
- C:\Windows\System\xcsbArD.exe
  C:\Windows\System\xcsbArD.exe
  2⤵
  PID:3796
- C:\Windows\System\JEAsjyO.exe
  C:\Windows\System\JEAsjyO.exe
  2⤵
  PID:3812
- C:\Windows\System\UawCHLv.exe
  C:\Windows\System\UawCHLv.exe
  2⤵
  PID:3828
- C:\Windows\System\rxzltuK.exe
  C:\Windows\System\rxzltuK.exe
  2⤵
  PID:3844
- C:\Windows\System\rrvymPa.exe
  C:\Windows\System\rrvymPa.exe
  2⤵
  PID:3864
- C:\Windows\System\UTwCZHa.exe
  C:\Windows\System\UTwCZHa.exe
  2⤵
  PID:3936
- C:\Windows\System\MCdeASC.exe
  C:\Windows\System\MCdeASC.exe
  2⤵
  PID:3952
- C:\Windows\System\lowxqIL.exe
  C:\Windows\System\lowxqIL.exe
  2⤵
  PID:3992
- C:\Windows\System\vFPrTVH.exe
  C:\Windows\System\vFPrTVH.exe
  2⤵
  PID:2720
- C:\Windows\System\gpbdKQu.exe
  C:\Windows\System\gpbdKQu.exe
  2⤵
  PID:2644
- C:\Windows\System\pSTJvIB.exe
  C:\Windows\System\pSTJvIB.exe
  2⤵
  PID:756
- C:\Windows\System\wNHqPJM.exe
  C:\Windows\System\wNHqPJM.exe
  2⤵
  PID:1752
- C:\Windows\System\beQyzYj.exe
  C:\Windows\System\beQyzYj.exe
  2⤵
  PID:1336
- C:\Windows\System\EQSMbxy.exe
  C:\Windows\System\EQSMbxy.exe
  2⤵
  PID:3428
- C:\Windows\System\RnixyOP.exe
  C:\Windows\System\RnixyOP.exe
  2⤵
  PID:324
- C:\Windows\System\EpOOWye.exe
  C:\Windows\System\EpOOWye.exe
  2⤵
  PID:3524
- C:\Windows\System\IXKTVjH.exe
  C:\Windows\System\IXKTVjH.exe
  2⤵
  PID:3592
- C:\Windows\System\MWIittT.exe
  C:\Windows\System\MWIittT.exe
  2⤵
  PID:3660
- C:\Windows\System\UhZXhfh.exe
  C:\Windows\System\UhZXhfh.exe
  2⤵
  PID:3744
- C:\Windows\System\mhWYHYM.exe
  C:\Windows\System\mhWYHYM.exe
  2⤵
  PID:3052
- C:\Windows\System\fuDHtbq.exe
  C:\Windows\System\fuDHtbq.exe
  2⤵
  PID:2112
- C:\Windows\System\hRBaaYk.exe
  C:\Windows\System\hRBaaYk.exe
  2⤵
  PID:3772
- C:\Windows\System\MFIuhpk.exe
  C:\Windows\System\MFIuhpk.exe
  2⤵
  PID:1688
- C:\Windows\System\mMZQafF.exe
  C:\Windows\System\mMZQafF.exe
  2⤵
  PID:3900
- C:\Windows\System\BryTEGa.exe
  C:\Windows\System\BryTEGa.exe
  2⤵
  PID:2376
- C:\Windows\System\NuDesVw.exe
  C:\Windows\System\NuDesVw.exe
  2⤵
  PID:676
- C:\Windows\System\hWZBLwJ.exe
  C:\Windows\System\hWZBLwJ.exe
  2⤵
  PID:2536
- C:\Windows\System\zfCfKSo.exe
  C:\Windows\System\zfCfKSo.exe
  2⤵
  PID:1964
- C:\Windows\System\JwZunvz.exe
  C:\Windows\System\JwZunvz.exe
  2⤵
  PID:2584
- C:\Windows\System\IWgCUBT.exe
  C:\Windows\System\IWgCUBT.exe
  2⤵
  PID:3496
- C:\Windows\System\WuhCYhz.exe
  C:\Windows\System\WuhCYhz.exe
  2⤵
  PID:1320
- C:\Windows\System\WMNIgIX.exe
  C:\Windows\System\WMNIgIX.exe
  2⤵
  PID:1056
- C:\Windows\System\iqycWyn.exe
  C:\Windows\System\iqycWyn.exe
  2⤵
  PID:1852
- C:\Windows\System\aEZhjAX.exe
  C:\Windows\System\aEZhjAX.exe
  2⤵
  PID:3032
- C:\Windows\System\vveizZt.exe
  C:\Windows\System\vveizZt.exe
  2⤵
  PID:992
- C:\Windows\System\qkjwBEJ.exe
  C:\Windows\System\qkjwBEJ.exe
  2⤵
  PID:3104
- C:\Windows\System\PXhdBBM.exe
  C:\Windows\System\PXhdBBM.exe
  2⤵
  PID:3348
- C:\Windows\System\ZYvSLbW.exe
  C:\Windows\System\ZYvSLbW.exe
  2⤵
  PID:3416
- C:\Windows\System\nYqxPQR.exe
  C:\Windows\System\nYqxPQR.exe
  2⤵
  PID:3480
- C:\Windows\System\XXOVsFY.exe
  C:\Windows\System\XXOVsFY.exe
  2⤵
  PID:3576
- C:\Windows\System\UWDooZt.exe
  C:\Windows\System\UWDooZt.exe
  2⤵
  PID:3716
- C:\Windows\System\XIxROZB.exe
  C:\Windows\System\XIxROZB.exe
  2⤵
  PID:3856
- C:\Windows\System\FPFqzCK.exe
  C:\Windows\System\FPFqzCK.exe
  2⤵
  PID:4060
- C:\Windows\System\TlzqOur.exe
  C:\Windows\System\TlzqOur.exe
  2⤵
  PID:2152
- C:\Windows\System\yDQsGca.exe
  C:\Windows\System\yDQsGca.exe
  2⤵
  PID:1792
- C:\Windows\System\BJUQoTx.exe
  C:\Windows\System\BJUQoTx.exe
  2⤵
  PID:1804
- C:\Windows\System\MskPiUm.exe
  C:\Windows\System\MskPiUm.exe
  2⤵
  PID:3840
- C:\Windows\System\bkYIcya.exe
  C:\Windows\System\bkYIcya.exe
  2⤵
  PID:2132
- C:\Windows\System\QDpiRFd.exe
  C:\Windows\System\QDpiRFd.exe
  2⤵
  PID:1476
- C:\Windows\System\tnuutFm.exe
  C:\Windows\System\tnuutFm.exe
  2⤵
  PID:3960
- C:\Windows\System\MUIlIEy.exe
  C:\Windows\System\MUIlIEy.exe
  2⤵
  PID:988
- C:\Windows\System\DUgzqgR.exe
  C:\Windows\System\DUgzqgR.exe
  2⤵
  PID:2416
- C:\Windows\System\XsHCbKX.exe
  C:\Windows\System\XsHCbKX.exe
  2⤵
  PID:2864
- C:\Windows\System\LBmpDoY.exe
  C:\Windows\System\LBmpDoY.exe
  2⤵
  PID:2560
- C:\Windows\System\mcJwxiX.exe
  C:\Windows\System\mcJwxiX.exe
  2⤵
  PID:1928
- C:\Windows\System\lRETYgO.exe
  C:\Windows\System\lRETYgO.exe
  2⤵
  PID:3628
- C:\Windows\System\ZXvMbzO.exe
  C:\Windows\System\ZXvMbzO.exe
  2⤵
  PID:2204
- C:\Windows\System\BgueLCB.exe
  C:\Windows\System\BgueLCB.exe
  2⤵
  PID:792
- C:\Windows\System\ZZxkwUB.exe
  C:\Windows\System\ZZxkwUB.exe
  2⤵
  PID:2708
- C:\Windows\System\tVOKchs.exe
  C:\Windows\System\tVOKchs.exe
  2⤵
  PID:2124
- C:\Windows\System\BDAYeLZ.exe
  C:\Windows\System\BDAYeLZ.exe
  2⤵
  PID:2732
- C:\Windows\System\HtxUCur.exe
  C:\Windows\System\HtxUCur.exe
  2⤵
  PID:1848
- C:\Windows\System\prsHyBO.exe
  C:\Windows\System\prsHyBO.exe
  2⤵
  PID:1192
- C:\Windows\System\ncUeDuR.exe
  C:\Windows\System\ncUeDuR.exe
  2⤵
  PID:2264
- C:\Windows\System\MXGpayu.exe
  C:\Windows\System\MXGpayu.exe
  2⤵
  PID:2492
- C:\Windows\System\POAskZH.exe
  C:\Windows\System\POAskZH.exe
  2⤵
  PID:788
- C:\Windows\System\FPxCmvD.exe
  C:\Windows\System\FPxCmvD.exe
  2⤵
  PID:1888
- C:\Windows\System\wxgXwDk.exe
  C:\Windows\System\wxgXwDk.exe
  2⤵
  PID:1684
- C:\Windows\System\LDNYYCp.exe
  C:\Windows\System\LDNYYCp.exe
  2⤵
  PID:3136
- C:\Windows\System\jqPaZCM.exe
  C:\Windows\System\jqPaZCM.exe
  2⤵
  PID:3312
- C:\Windows\System\WZrsWgx.exe
  C:\Windows\System\WZrsWgx.exe
  2⤵
  PID:928
- C:\Windows\System\mfJAIfj.exe
  C:\Windows\System\mfJAIfj.exe
  2⤵
  PID:3412
- C:\Windows\System\GdRseua.exe
  C:\Windows\System\GdRseua.exe
  2⤵
  PID:3544
- C:\Windows\System\feLtPMC.exe
  C:\Windows\System\feLtPMC.exe
  2⤵
  PID:3612
- C:\Windows\System\FZoMrKB.exe
  C:\Windows\System\FZoMrKB.exe
  2⤵
  PID:3676
- C:\Windows\System\dxvNzoh.exe
  C:\Windows\System\dxvNzoh.exe
  2⤵
  PID:2336
- C:\Windows\System\HrANspJ.exe
  C:\Windows\System\HrANspJ.exe
  2⤵
  PID:1736
- C:\Windows\System\eZhUhyc.exe
  C:\Windows\System\eZhUhyc.exe
  2⤵
  PID:3792
- C:\Windows\System\kVkWYqv.exe
  C:\Windows\System\kVkWYqv.exe
  2⤵
  PID:3948
- C:\Windows\System\AdEQNcC.exe
  C:\Windows\System\AdEQNcC.exe
  2⤵
  PID:3120
- C:\Windows\System\McyTgOM.exe
  C:\Windows\System\McyTgOM.exe
  2⤵
  PID:2484
- C:\Windows\System\KDRJImu.exe
  C:\Windows\System\KDRJImu.exe
  2⤵
  PID:3564
- C:\Windows\System\NAEsEaK.exe
  C:\Windows\System\NAEsEaK.exe
  2⤵
  PID:2636
- C:\Windows\System\IsxHiXw.exe
  C:\Windows\System\IsxHiXw.exe
  2⤵
  PID:108
- C:\Windows\System\uFeAUMO.exe
  C:\Windows\System\uFeAUMO.exe
  2⤵
  PID:2456
- C:\Windows\System\ftrLuJv.exe
  C:\Windows\System\ftrLuJv.exe
  2⤵
  PID:828
- C:\Windows\System\DMhMJza.exe
  C:\Windows\System\DMhMJza.exe
  2⤵
  PID:2384
- C:\Windows\System\DuSONgE.exe
  C:\Windows\System\DuSONgE.exe
  2⤵
  PID:1604
- C:\Windows\System\gsptICG.exe
  C:\Windows\System\gsptICG.exe
  2⤵
  PID:2512
- C:\Windows\System\nXvlQii.exe
  C:\Windows\System\nXvlQii.exe
  2⤵
  PID:3036
- C:\Windows\System\eXMXVqc.exe
  C:\Windows\System\eXMXVqc.exe
  2⤵
  PID:3392
- C:\Windows\System\BUUuwYo.exe
  C:\Windows\System\BUUuwYo.exe
  2⤵
  PID:2840
- C:\Windows\System\TKFOrtt.exe
  C:\Windows\System\TKFOrtt.exe
  2⤵
  PID:3760
- C:\Windows\System\IKRFdQV.exe
  C:\Windows\System\IKRFdQV.exe
  2⤵
  PID:540
- C:\Windows\System\ATXGApq.exe
  C:\Windows\System\ATXGApq.exe
  2⤵
  PID:272
- C:\Windows\System\kAXCnIn.exe
  C:\Windows\System\kAXCnIn.exe
  2⤵
  PID:1800
- C:\Windows\System\FrKcgsQ.exe
  C:\Windows\System\FrKcgsQ.exe
  2⤵
  PID:1816
- C:\Windows\System\OPGPcNR.exe
  C:\Windows\System\OPGPcNR.exe
  2⤵
  PID:2804
- C:\Windows\System\hYgqIeB.exe
  C:\Windows\System\hYgqIeB.exe
  2⤵
  PID:2924
- C:\Windows\System\KdSkSjh.exe
  C:\Windows\System\KdSkSjh.exe
  2⤵
  PID:2936
- C:\Windows\System\vqGPhdT.exe
  C:\Windows\System\vqGPhdT.exe
  2⤵
  PID:4112
- C:\Windows\System\nyvkwwv.exe
  C:\Windows\System\nyvkwwv.exe
  2⤵
  PID:4128
- C:\Windows\System\VhTmSKA.exe
  C:\Windows\System\VhTmSKA.exe
  2⤵
  PID:4148
- C:\Windows\System\phbJouA.exe
  C:\Windows\System\phbJouA.exe
  2⤵
  PID:4164
- C:\Windows\System\smNGqvZ.exe
  C:\Windows\System\smNGqvZ.exe
  2⤵
  PID:4180
- C:\Windows\System\rZfRkta.exe
  C:\Windows\System\rZfRkta.exe
  2⤵
  PID:4196
- C:\Windows\System\BUVwgTF.exe
  C:\Windows\System\BUVwgTF.exe
  2⤵
  PID:4212
- C:\Windows\System\ItmcEcE.exe
  C:\Windows\System\ItmcEcE.exe
  2⤵
  PID:4228
- C:\Windows\System\IhhZqAV.exe
  C:\Windows\System\IhhZqAV.exe
  2⤵
  PID:4244
- C:\Windows\System\tmCIlww.exe
  C:\Windows\System\tmCIlww.exe
  2⤵
  PID:4328
- C:\Windows\System\GXrGrOv.exe
  C:\Windows\System\GXrGrOv.exe
  2⤵
  PID:4344
- C:\Windows\System\KCfMoTp.exe
  C:\Windows\System\KCfMoTp.exe
  2⤵
  PID:4360
- C:\Windows\System\AmjFcTs.exe
  C:\Windows\System\AmjFcTs.exe
  2⤵
  PID:4376
- C:\Windows\System\daoneIS.exe
  C:\Windows\System\daoneIS.exe
  2⤵
  PID:4392
- C:\Windows\System\SKCGKlY.exe
  C:\Windows\System\SKCGKlY.exe
  2⤵
  PID:4412
- C:\Windows\System\upUTstH.exe
  C:\Windows\System\upUTstH.exe
  2⤵
  PID:4432
- C:\Windows\System\TWUrrrW.exe
  C:\Windows\System\TWUrrrW.exe
  2⤵
  PID:4448
- C:\Windows\System\YbTgzwZ.exe
  C:\Windows\System\YbTgzwZ.exe
  2⤵
  PID:4464
- C:\Windows\System\amwuyzd.exe
  C:\Windows\System\amwuyzd.exe
  2⤵
  PID:4480
- C:\Windows\System\QPEdqGq.exe
  C:\Windows\System\QPEdqGq.exe
  2⤵
  PID:4496
- C:\Windows\System\xxPqplb.exe
  C:\Windows\System\xxPqplb.exe
  2⤵
  PID:4512
- C:\Windows\System\rvFNNjL.exe
  C:\Windows\System\rvFNNjL.exe
  2⤵
  PID:4724
- C:\Windows\System\RoaZzWW.exe
  C:\Windows\System\RoaZzWW.exe
  2⤵
  PID:4740
- C:\Windows\System\HBzFPPs.exe
  C:\Windows\System\HBzFPPs.exe
  2⤵
  PID:4760
- C:\Windows\System\qSJSdaM.exe
  C:\Windows\System\qSJSdaM.exe
  2⤵
  PID:4784
- C:\Windows\System\tdvkNeK.exe
  C:\Windows\System\tdvkNeK.exe
  2⤵
  PID:4804
- C:\Windows\System\NgvQyav.exe
  C:\Windows\System\NgvQyav.exe
  2⤵
  PID:4820
- C:\Windows\System\xqnTqec.exe
  C:\Windows\System\xqnTqec.exe
  2⤵
  PID:4836
- C:\Windows\System\CegHBfa.exe
  C:\Windows\System\CegHBfa.exe
  2⤵
  PID:4852
- C:\Windows\System\WuKHkcj.exe
  C:\Windows\System\WuKHkcj.exe
  2⤵
  PID:4872
- C:\Windows\System\wFyvOgc.exe
  C:\Windows\System\wFyvOgc.exe
  2⤵
  PID:4888
- C:\Windows\System\mXkNkYa.exe
  C:\Windows\System\mXkNkYa.exe
  2⤵
  PID:4904
- C:\Windows\System\kBYCCeH.exe
  C:\Windows\System\kBYCCeH.exe
  2⤵
  PID:4920
- C:\Windows\System\saNYyKE.exe
  C:\Windows\System\saNYyKE.exe
  2⤵
  PID:4936
- C:\Windows\System\cqDoziQ.exe
  C:\Windows\System\cqDoziQ.exe
  2⤵
  PID:4952
- C:\Windows\System\RaDcShA.exe
  C:\Windows\System\RaDcShA.exe
  2⤵
  PID:4968
- C:\Windows\System\LaryzZy.exe
  C:\Windows\System\LaryzZy.exe
  2⤵
  PID:4984
- C:\Windows\System\TvpEPIn.exe
  C:\Windows\System\TvpEPIn.exe
  2⤵
  PID:5000
- C:\Windows\System\QsCQZjS.exe
  C:\Windows\System\QsCQZjS.exe
  2⤵
  PID:5020
- C:\Windows\System\fcJnmrd.exe
  C:\Windows\System\fcJnmrd.exe
  2⤵
  PID:5040
- C:\Windows\System\cSzLDXW.exe
  C:\Windows\System\cSzLDXW.exe
  2⤵
  PID:5056
- C:\Windows\System\TKrNEJt.exe
  C:\Windows\System\TKrNEJt.exe
  2⤵
  PID:5072
- C:\Windows\System\YScjIqa.exe
  C:\Windows\System\YScjIqa.exe
  2⤵
  PID:5088
- C:\Windows\System\HhpQVsf.exe
  C:\Windows\System\HhpQVsf.exe
  2⤵
  PID:5104
- C:\Windows\System\blysQPe.exe
  C:\Windows\System\blysQPe.exe
  2⤵
  PID:452
- C:\Windows\System\YzkggjQ.exe
  C:\Windows\System\YzkggjQ.exe
  2⤵
  PID:3896
- C:\Windows\System\QzuzYUU.exe
  C:\Windows\System\QzuzYUU.exe
  2⤵
  PID:3708
- C:\Windows\System\eSVwceA.exe
  C:\Windows\System\eSVwceA.exe
  2⤵
  PID:552
- C:\Windows\System\CNaktNe.exe
  C:\Windows\System\CNaktNe.exe
  2⤵
  PID:2672
- C:\Windows\System\vBtliUH.exe
  C:\Windows\System\vBtliUH.exe
  2⤵
  PID:1420
- C:\Windows\System\jxjFnso.exe
  C:\Windows\System\jxjFnso.exe
  2⤵
  PID:2948
- C:\Windows\System\YDWtmrY.exe
  C:\Windows\System\YDWtmrY.exe
  2⤵
  PID:628
- C:\Windows\System\ZpsUtJo.exe
  C:\Windows\System\ZpsUtJo.exe
  2⤵
  PID:4124
- C:\Windows\System\GVdjwAY.exe
  C:\Windows\System\GVdjwAY.exe
  2⤵
  PID:4192
- C:\Windows\System\mwrGbrr.exe
  C:\Windows\System\mwrGbrr.exe
  2⤵
  PID:4264
- C:\Windows\System\gjxhteo.exe
  C:\Windows\System\gjxhteo.exe
  2⤵
  PID:4280
- C:\Windows\System\uSDXlfu.exe
  C:\Windows\System\uSDXlfu.exe
  2⤵
  PID:4300
- C:\Windows\System\OueZaIZ.exe
  C:\Windows\System\OueZaIZ.exe
  2⤵
  PID:4316
- C:\Windows\System\WpigjJB.exe
  C:\Windows\System\WpigjJB.exe
  2⤵
  PID:2084
- C:\Windows\System\NwwyifR.exe
  C:\Windows\System\NwwyifR.exe
  2⤵
  PID:4140
- C:\Windows\System\WsKiXkL.exe
  C:\Windows\System\WsKiXkL.exe
  2⤵
  PID:3560
- C:\Windows\System\vgMbPCf.exe
  C:\Windows\System\vgMbPCf.exe
  2⤵
  PID:4372
- C:\Windows\System\KmlASlv.exe
  C:\Windows\System\KmlASlv.exe
  2⤵
  PID:4388
- C:\Windows\System\uQyPqqB.exe
  C:\Windows\System\uQyPqqB.exe
  2⤵
  PID:4456
- C:\Windows\System\UIQMUdO.exe
  C:\Windows\System\UIQMUdO.exe
  2⤵
  PID:4520
- C:\Windows\System\EgjlVoO.exe
  C:\Windows\System\EgjlVoO.exe
  2⤵
  PID:4540
- C:\Windows\System\cBqmopK.exe
  C:\Windows\System\cBqmopK.exe
  2⤵
  PID:4556
- C:\Windows\System\FksZooS.exe
  C:\Windows\System\FksZooS.exe
  2⤵
  PID:4572
- C:\Windows\System\zPLsJQu.exe
  C:\Windows\System\zPLsJQu.exe
  2⤵
  PID:4588
- C:\Windows\System\fcoshpy.exe
  C:\Windows\System\fcoshpy.exe
  2⤵
  PID:4600
- C:\Windows\System\nKQeyet.exe
  C:\Windows\System\nKQeyet.exe
  2⤵
  PID:4616
- C:\Windows\System\qiemkDt.exe
  C:\Windows\System\qiemkDt.exe
  2⤵
  PID:2464
- C:\Windows\System\XhUFFjc.exe
  C:\Windows\System\XhUFFjc.exe
  2⤵
  PID:2100
- C:\Windows\System\rLouqhS.exe
  C:\Windows\System\rLouqhS.exe
  2⤵
  PID:4340
- C:\Windows\System\MdkEboI.exe
  C:\Windows\System\MdkEboI.exe
  2⤵
  PID:4648
- C:\Windows\System\AcLGUuV.exe
  C:\Windows\System\AcLGUuV.exe
  2⤵
  PID:4664
- C:\Windows\System\dJZkEfl.exe
  C:\Windows\System\dJZkEfl.exe
  2⤵
  PID:4712
- C:\Windows\System\uKwoesS.exe
  C:\Windows\System\uKwoesS.exe
  2⤵
  PID:4440
- C:\Windows\System\fZAFofX.exe
  C:\Windows\System\fZAFofX.exe
  2⤵
  PID:4504
- C:\Windows\System\qXdqFDE.exe
  C:\Windows\System\qXdqFDE.exe
  2⤵
  PID:4756
- C:\Windows\System\ryXnWMO.exe
  C:\Windows\System\ryXnWMO.exe
  2⤵
  PID:4736
- C:\Windows\System\rNKVTaA.exe
  C:\Windows\System\rNKVTaA.exe
  2⤵
  PID:2436
- C:\Windows\System\GiBbaRn.exe
  C:\Windows\System\GiBbaRn.exe
  2⤵
  PID:4776
- C:\Windows\System\mEAZMeb.exe
  C:\Windows\System\mEAZMeb.exe
  2⤵
  PID:4792
- C:\Windows\System\PWmuoZy.exe
  C:\Windows\System\PWmuoZy.exe
  2⤵
  PID:4832
- C:\Windows\System\vlFHZVs.exe
  C:\Windows\System\vlFHZVs.exe
  2⤵
  PID:4900
- C:\Windows\System\VXzqKOo.exe
  C:\Windows\System\VXzqKOo.exe
  2⤵
  PID:4964
- C:\Windows\System\KDCcxRY.exe
  C:\Windows\System\KDCcxRY.exe
  2⤵
  PID:5032
- C:\Windows\System\rLjMfmv.exe
  C:\Windows\System\rLjMfmv.exe
  2⤵
  PID:4848
- C:\Windows\System\QxkAkvG.exe
  C:\Windows\System\QxkAkvG.exe
  2⤵
  PID:4912
- C:\Windows\System\hczAAww.exe
  C:\Windows\System\hczAAww.exe
  2⤵
  PID:5068
- C:\Windows\System\RsqNtjU.exe
  C:\Windows\System\RsqNtjU.exe
  2⤵
  PID:5012
- C:\Windows\System\XJmbgaD.exe
  C:\Windows\System\XJmbgaD.exe
  2⤵
  PID:5016
- C:\Windows\System\pUZFnLX.exe
  C:\Windows\System\pUZFnLX.exe
  2⤵
  PID:5064
- C:\Windows\System\mbLdmcW.exe
  C:\Windows\System\mbLdmcW.exe
  2⤵
  PID:3644
- C:\Windows\System\lTIVQOQ.exe
  C:\Windows\System\lTIVQOQ.exe
  2⤵
  PID:1892
- C:\Windows\System\ZOhTWWe.exe
  C:\Windows\System\ZOhTWWe.exe
  2⤵
  PID:588
- C:\Windows\System\wemioxV.exe
  C:\Windows\System\wemioxV.exe
  2⤵
  PID:4916
- C:\Windows\System\zBRkqtX.exe
  C:\Windows\System\zBRkqtX.exe
  2⤵
  PID:5112
- C:\Windows\System\qdzZoFa.exe
  C:\Windows\System\qdzZoFa.exe
  2⤵
  PID:2448
- C:\Windows\System\zOZxMHU.exe
  C:\Windows\System\zOZxMHU.exe
  2⤵
  PID:2656
- C:\Windows\System\zBMPpdD.exe
  C:\Windows\System\zBMPpdD.exe
  2⤵
  PID:4176
- C:\Windows\System\OcjybpW.exe
  C:\Windows\System\OcjybpW.exe
  2⤵
  PID:4548
- C:\Windows\System\xQkFzuW.exe
  C:\Windows\System\xQkFzuW.exe
  2⤵
  PID:1140
- C:\Windows\System\dDetCNb.exe
  C:\Windows\System\dDetCNb.exe
  2⤵
  PID:4656
- C:\Windows\System\WYRvbKf.exe
  C:\Windows\System\WYRvbKf.exe
  2⤵
  PID:1724
- C:\Windows\System\BdirfKx.exe
  C:\Windows\System\BdirfKx.exe
  2⤵
  PID:4768
- C:\Windows\System\gdLIdKy.exe
  C:\Windows\System\gdLIdKy.exe
  2⤵
  PID:2712
- C:\Windows\System\QOJCoHG.exe
  C:\Windows\System\QOJCoHG.exe
  2⤵
  PID:4896
- C:\Windows\System\QsEegRq.exe
  C:\Windows\System\QsEegRq.exe
  2⤵
  PID:4980
- C:\Windows\System\GyfuQTg.exe
  C:\Windows\System\GyfuQTg.exe
  2⤵
  PID:3476
- C:\Windows\System\IhEkYCc.exe
  C:\Windows\System\IhEkYCc.exe
  2⤵
  PID:5052
- C:\Windows\System\uwLAxut.exe
  C:\Windows\System\uwLAxut.exe
  2⤵
  PID:2892
- C:\Windows\System\BtOcrmN.exe
  C:\Windows\System\BtOcrmN.exe
  2⤵
  PID:3408
- C:\Windows\System\PJjOQux.exe
  C:\Windows\System\PJjOQux.exe
  2⤵
  PID:112
- C:\Windows\System\LtmZaoS.exe
  C:\Windows\System\LtmZaoS.exe
  2⤵
  PID:2304
- C:\Windows\System\JWXFSCg.exe
  C:\Windows\System\JWXFSCg.exe
  2⤵
  PID:3144
- C:\Windows\System\KmtsWVR.exe
  C:\Windows\System\KmtsWVR.exe
  2⤵
  PID:4288
- C:\Windows\System\BpGVCWB.exe
  C:\Windows\System\BpGVCWB.exe
  2⤵
  PID:4272
- C:\Windows\System\HJyYkQj.exe
  C:\Windows\System\HJyYkQj.exe
  2⤵
  PID:4356
- C:\Windows\System\BtCGWJP.exe
  C:\Windows\System\BtCGWJP.exe
  2⤵
  PID:4628
- C:\Windows\System\HDHqDXS.exe
  C:\Windows\System\HDHqDXS.exe
  2⤵
  PID:4680
- C:\Windows\System\YhfuZBU.exe
  C:\Windows\System\YhfuZBU.exe
  2⤵
  PID:4104
- C:\Windows\System\lZxCBvV.exe
  C:\Windows\System\lZxCBvV.exe
  2⤵
  PID:4536
- C:\Windows\System\ehtgLSD.exe
  C:\Windows\System\ehtgLSD.exe
  2⤵
  PID:4636
- C:\Windows\System\csczJXx.exe
  C:\Windows\System\csczJXx.exe
  2⤵
  PID:4624
- C:\Windows\System\JoFSNqa.exe
  C:\Windows\System\JoFSNqa.exe
  2⤵
  PID:4240
- C:\Windows\System\qJUCFuo.exe
  C:\Windows\System\qJUCFuo.exe
  2⤵
  PID:4816
- C:\Windows\System\CbgZthg.exe
  C:\Windows\System\CbgZthg.exe
  2⤵
  PID:4932
- C:\Windows\System\HiaWHKu.exe
  C:\Windows\System\HiaWHKu.exe
  2⤵
  PID:5008
- C:\Windows\System\rLSmpcJ.exe
  C:\Windows\System\rLSmpcJ.exe
  2⤵
  PID:4312
- C:\Windows\System\gDZTNpt.exe
  C:\Windows\System\gDZTNpt.exe
  2⤵
  PID:1608
- C:\Windows\System\RzFUseR.exe
  C:\Windows\System\RzFUseR.exe
  2⤵
  PID:2940
- C:\Windows\System\sRNKxKG.exe
  C:\Windows\System\sRNKxKG.exe
  2⤵
  PID:1652
- C:\Windows\System\sLHrooL.exe
  C:\Windows\System\sLHrooL.exe
  2⤵
  PID:4552
- C:\Windows\System\NOEbXDl.exe
  C:\Windows\System\NOEbXDl.exe
  2⤵
  PID:4684
- C:\Windows\System\GvhICzn.exe
  C:\Windows\System\GvhICzn.exe
  2⤵
  PID:4596
- C:\Windows\System\cEOUgXh.exe
  C:\Windows\System\cEOUgXh.exe
  2⤵
  PID:5028
- C:\Windows\System\ThqadCs.exe
  C:\Windows\System\ThqadCs.exe
  2⤵
  PID:548
- C:\Windows\System\NmldQfT.exe
  C:\Windows\System\NmldQfT.exe
  2⤵
  PID:3852
- C:\Windows\System\SAmVBWk.exe
  C:\Windows\System\SAmVBWk.exe
  2⤵
  PID:4748
- C:\Windows\System\YRxbZHC.exe
  C:\Windows\System\YRxbZHC.exe
  2⤵
  PID:5096
- C:\Windows\System\OIthSIU.exe
  C:\Windows\System\OIthSIU.exe
  2⤵
  PID:1908
- C:\Windows\System\HksYEAC.exe
  C:\Windows\System\HksYEAC.exe
  2⤵
  PID:3292
- C:\Windows\System\UUDqTBd.exe
  C:\Windows\System\UUDqTBd.exe
  2⤵
  PID:4580
- C:\Windows\System\JjqGUzJ.exe
  C:\Windows\System\JjqGUzJ.exe
  2⤵
  PID:3680
- C:\Windows\System\qRsjcHM.exe
  C:\Windows\System\qRsjcHM.exe
  2⤵
  PID:4208
- C:\Windows\System\bKfeLsC.exe
  C:\Windows\System\bKfeLsC.exe
  2⤵
  PID:5124
- C:\Windows\System\JnYjXjW.exe
  C:\Windows\System\JnYjXjW.exe
  2⤵
  PID:5140
- C:\Windows\System\LRHbhaV.exe
  C:\Windows\System\LRHbhaV.exe
  2⤵
  PID:5156
- C:\Windows\System\OCQwhUt.exe
  C:\Windows\System\OCQwhUt.exe
  2⤵
  PID:5180
- C:\Windows\System\yDSJxHH.exe
  C:\Windows\System\yDSJxHH.exe
  2⤵
  PID:5196
- C:\Windows\System\IvvRvKG.exe
  C:\Windows\System\IvvRvKG.exe
  2⤵
  PID:5212
- C:\Windows\System\vWsCEbZ.exe
  C:\Windows\System\vWsCEbZ.exe
  2⤵
  PID:5228
- C:\Windows\System\qZIjlmF.exe
  C:\Windows\System\qZIjlmF.exe
  2⤵
  PID:5248
- C:\Windows\System\NOJxRfD.exe
  C:\Windows\System\NOJxRfD.exe
  2⤵
  PID:5268
- C:\Windows\System\CgzUEPy.exe
  C:\Windows\System\CgzUEPy.exe
  2⤵
  PID:5284
- C:\Windows\System\xsJKNzq.exe
  C:\Windows\System\xsJKNzq.exe
  2⤵
  PID:5300
- C:\Windows\System\XZvcSyG.exe
  C:\Windows\System\XZvcSyG.exe
  2⤵
  PID:5316
- C:\Windows\System\UdftGzh.exe
  C:\Windows\System\UdftGzh.exe
  2⤵
  PID:5332
- C:\Windows\System\PEwDdXM.exe
  C:\Windows\System\PEwDdXM.exe
  2⤵
  PID:5348
- C:\Windows\System\WaISOOx.exe
  C:\Windows\System\WaISOOx.exe
  2⤵
  PID:5364
- C:\Windows\System\fGUHUAh.exe
  C:\Windows\System\fGUHUAh.exe
  2⤵
  PID:5380
- C:\Windows\System\agMHrez.exe
  C:\Windows\System\agMHrez.exe
  2⤵
  PID:5396
- C:\Windows\System\Kmuxtmc.exe
  C:\Windows\System\Kmuxtmc.exe
  2⤵
  PID:5412
- C:\Windows\System\AhUkuhP.exe
  C:\Windows\System\AhUkuhP.exe
  2⤵
  PID:5428
- C:\Windows\System\uHjICCe.exe
  C:\Windows\System\uHjICCe.exe
  2⤵
  PID:5444
- C:\Windows\System\wPhJbtG.exe
  C:\Windows\System\wPhJbtG.exe
  2⤵
  PID:5460
- C:\Windows\System\jOopDzs.exe
  C:\Windows\System\jOopDzs.exe
  2⤵
  PID:5476
- C:\Windows\System\AVyyDyn.exe
  C:\Windows\System\AVyyDyn.exe
  2⤵
  PID:5492
- C:\Windows\System\CaJmwSP.exe
  C:\Windows\System\CaJmwSP.exe
  2⤵
  PID:5508
- C:\Windows\System\PaXlemf.exe
  C:\Windows\System\PaXlemf.exe
  2⤵
  PID:5524
- C:\Windows\System\wfAdlxA.exe
  C:\Windows\System\wfAdlxA.exe
  2⤵
  PID:5540
- C:\Windows\System\cgeTuCD.exe
  C:\Windows\System\cgeTuCD.exe
  2⤵
  PID:5556
- C:\Windows\System\WJNONxG.exe
  C:\Windows\System\WJNONxG.exe
  2⤵
  PID:5572
- C:\Windows\System\IjQEShH.exe
  C:\Windows\System\IjQEShH.exe
  2⤵
  PID:5588
- C:\Windows\System\sBXnXEo.exe
  C:\Windows\System\sBXnXEo.exe
  2⤵
  PID:5616
- C:\Windows\System\SZcsYht.exe
  C:\Windows\System\SZcsYht.exe
  2⤵
  PID:5632
- C:\Windows\System\IelajYC.exe
  C:\Windows\System\IelajYC.exe
  2⤵
  PID:5648
- C:\Windows\System\RHJiMfS.exe
  C:\Windows\System\RHJiMfS.exe
  2⤵
  PID:5672
- C:\Windows\System\jkpOgJt.exe
  C:\Windows\System\jkpOgJt.exe
  2⤵
  PID:5800
- C:\Windows\System\qFeImrJ.exe
  C:\Windows\System\qFeImrJ.exe
  2⤵
  PID:5816
- C:\Windows\System\ujxSOoQ.exe
  C:\Windows\System\ujxSOoQ.exe
  2⤵
  PID:5836
- C:\Windows\System\vMiVSLy.exe
  C:\Windows\System\vMiVSLy.exe
  2⤵
  PID:5852
- C:\Windows\System\JJucVfQ.exe
  C:\Windows\System\JJucVfQ.exe
  2⤵
  PID:5868
- C:\Windows\System\DDrZycF.exe
  C:\Windows\System\DDrZycF.exe
  2⤵
  PID:5892
- C:\Windows\System\wYObZta.exe
  C:\Windows\System\wYObZta.exe
  2⤵
  PID:5908
- C:\Windows\System\cNqcBeW.exe
  C:\Windows\System\cNqcBeW.exe
  2⤵
  PID:5928
- C:\Windows\System\gKIgfyt.exe
  C:\Windows\System\gKIgfyt.exe
  2⤵
  PID:5944
- C:\Windows\System\WhxumBW.exe
  C:\Windows\System\WhxumBW.exe
  2⤵
  PID:5968
- C:\Windows\System\IKSigNf.exe
  C:\Windows\System\IKSigNf.exe
  2⤵
  PID:5988
- C:\Windows\System\swHHeVz.exe
  C:\Windows\System\swHHeVz.exe
  2⤵
  PID:6004
- C:\Windows\System\UpucRqW.exe
  C:\Windows\System\UpucRqW.exe
  2⤵
  PID:6020
- C:\Windows\System\lItAWJg.exe
  C:\Windows\System\lItAWJg.exe
  2⤵
  PID:6040
- C:\Windows\System\fUIYMKr.exe
  C:\Windows\System\fUIYMKr.exe
  2⤵
  PID:6060
- C:\Windows\System\VahVXUK.exe
  C:\Windows\System\VahVXUK.exe
  2⤵
  PID:6084
- C:\Windows\System\tXqZMHx.exe
  C:\Windows\System\tXqZMHx.exe
  2⤵
  PID:6108
- C:\Windows\System\VwhTPfm.exe
  C:\Windows\System\VwhTPfm.exe
  2⤵
  PID:6124
- C:\Windows\System\EIFUXcb.exe
  C:\Windows\System\EIFUXcb.exe
  2⤵
  PID:6140
- C:\Windows\System\kMQDACM.exe
  C:\Windows\System\kMQDACM.exe
  2⤵
  PID:4948
- C:\Windows\System\qLnWSbi.exe
  C:\Windows\System\qLnWSbi.exe
  2⤵
  PID:4384
- C:\Windows\System\HCbcmDR.exe
  C:\Windows\System\HCbcmDR.exe
  2⤵
  PID:5148
- C:\Windows\System\GgqKNAo.exe
  C:\Windows\System\GgqKNAo.exe
  2⤵
  PID:4592
- C:\Windows\System\gEkxKbu.exe
  C:\Windows\System\gEkxKbu.exe
  2⤵
  PID:4324
- C:\Windows\System\pfLjOvc.exe
  C:\Windows\System\pfLjOvc.exe
  2⤵
  PID:5168
- C:\Windows\System\CGsKSiR.exe
  C:\Windows\System\CGsKSiR.exe
  2⤵
  PID:3316
- C:\Windows\System\EvqOmWu.exe
  C:\Windows\System\EvqOmWu.exe
  2⤵
  PID:5208
- C:\Windows\System\lTtxyWb.exe
  C:\Windows\System\lTtxyWb.exe
  2⤵
  PID:4632
- C:\Windows\System\ZQdpqCP.exe
  C:\Windows\System\ZQdpqCP.exe
  2⤵
  PID:5276
- C:\Windows\System\BpJNCxY.exe
  C:\Windows\System\BpJNCxY.exe
  2⤵
  PID:5296
- C:\Windows\System\IGJCtdZ.exe
  C:\Windows\System\IGJCtdZ.exe
  2⤵
  PID:5340
- C:\Windows\System\OUPcjxa.exe
  C:\Windows\System\OUPcjxa.exe
  2⤵
  PID:5376
- C:\Windows\System\QpuxzHM.exe
  C:\Windows\System\QpuxzHM.exe
  2⤵
  PID:5436
- C:\Windows\System\nrrHHcd.exe
  C:\Windows\System\nrrHHcd.exe
  2⤵
  PID:5392
- C:\Windows\System\PGdgxoT.exe
  C:\Windows\System\PGdgxoT.exe
  2⤵
  PID:5452
- C:\Windows\System\PGZSUSR.exe
  C:\Windows\System\PGZSUSR.exe
  2⤵
  PID:5484
- C:\Windows\System\LRssKKd.exe
  C:\Windows\System\LRssKKd.exe
  2⤵
  PID:5548
- C:\Windows\System\siotgRd.exe
  C:\Windows\System\siotgRd.exe
  2⤵
  PID:5536
- C:\Windows\System\YRwxAAV.exe
  C:\Windows\System\YRwxAAV.exe
  2⤵
  PID:5608
- C:\Windows\System\WlUhqBz.exe
  C:\Windows\System\WlUhqBz.exe
  2⤵
  PID:5688
- C:\Windows\System\oXQWgSb.exe
  C:\Windows\System\oXQWgSb.exe
  2⤵
  PID:5696
- C:\Windows\System\teIjVme.exe
  C:\Windows\System\teIjVme.exe
  2⤵
  PID:5640
- C:\Windows\System\jvEJovY.exe
  C:\Windows\System\jvEJovY.exe
  2⤵
  PID:5712
- C:\Windows\System\fmjkWFS.exe
  C:\Windows\System\fmjkWFS.exe
  2⤵
  PID:5728
- C:\Windows\System\mJxuODZ.exe
  C:\Windows\System\mJxuODZ.exe
  2⤵
  PID:5748
- C:\Windows\System\bGYPNJy.exe
  C:\Windows\System\bGYPNJy.exe
  2⤵
  PID:5624
- C:\Windows\System\khVFZfO.exe
  C:\Windows\System\khVFZfO.exe
  2⤵
  PID:5756
- C:\Windows\System\FTwCXWl.exe
  C:\Windows\System\FTwCXWl.exe
  2⤵
  PID:1628
- C:\Windows\System\gDnTYsF.exe
  C:\Windows\System\gDnTYsF.exe
  2⤵
  PID:5808
- C:\Windows\System\WvTxhWO.exe
  C:\Windows\System\WvTxhWO.exe
  2⤵
  PID:5884
- C:\Windows\System\yGUYhJs.exe
  C:\Windows\System\yGUYhJs.exe
  2⤵
  PID:5784
- C:\Windows\System\QkQVKNd.exe
  C:\Windows\System\QkQVKNd.exe
  2⤵
  PID:5824
- C:\Windows\System\VjmpaFQ.exe
  C:\Windows\System\VjmpaFQ.exe
  2⤵
  PID:5900
- C:\Windows\System\BCLaQvY.exe
  C:\Windows\System\BCLaQvY.exe
  2⤵
  PID:5792
- C:\Windows\System\slSMwmJ.exe
  C:\Windows\System\slSMwmJ.exe
  2⤵
  PID:5920
- C:\Windows\System\CeYUYdJ.exe
  C:\Windows\System\CeYUYdJ.exe
  2⤵
  PID:5964
- C:\Windows\System\qgHlHsP.exe
  C:\Windows\System\qgHlHsP.exe
  2⤵
  PID:6028
- C:\Windows\System\AWqQyPI.exe
  C:\Windows\System\AWqQyPI.exe
  2⤵
  PID:6036
- C:\Windows\System\dsWwHxJ.exe
  C:\Windows\System\dsWwHxJ.exe
  2⤵
  PID:6080
- C:\Windows\System\DntrghF.exe
  C:\Windows\System\DntrghF.exe
  2⤵
  PID:6096
- C:\Windows\System\ldcYkVH.exe
  C:\Windows\System\ldcYkVH.exe
  2⤵
  PID:6136
- C:\Windows\System\GFcBCuW.exe
  C:\Windows\System\GFcBCuW.exe
  2⤵
  PID:5136
- C:\Windows\System\WaccemP.exe
  C:\Windows\System\WaccemP.exe
  2⤵
  PID:5236
- C:\Windows\System\qmoVqRb.exe
  C:\Windows\System\qmoVqRb.exe
  2⤵
  PID:4568
- C:\Windows\System\UZLRinT.exe
  C:\Windows\System\UZLRinT.exe
  2⤵
  PID:5388
- C:\Windows\System\nyIcWNh.exe
  C:\Windows\System\nyIcWNh.exe
  2⤵
  PID:5580
- C:\Windows\System\JIfsGHN.exe
  C:\Windows\System\JIfsGHN.exe
  2⤵
  PID:5664
- C:\Windows\System\AZftShw.exe
  C:\Windows\System\AZftShw.exe
  2⤵
  PID:5516
- C:\Windows\System\SctODls.exe
  C:\Windows\System\SctODls.exe
  2⤵
  PID:5768
- C:\Windows\System\lXTEgHG.exe
  C:\Windows\System\lXTEgHG.exe
  2⤵
  PID:5860
- C:\Windows\System\sNmjoZM.exe
  C:\Windows\System\sNmjoZM.exe
  2⤵
  PID:4800
- C:\Windows\System\JtWLCjR.exe
  C:\Windows\System\JtWLCjR.exe
  2⤵
  PID:6116
- C:\Windows\System\BLjcgsF.exe
  C:\Windows\System\BLjcgsF.exe
  2⤵
  PID:5100
- C:\Windows\System\RQFkZKL.exe
  C:\Windows\System\RQFkZKL.exe
  2⤵
  PID:5256
- C:\Windows\System\QolLnrG.exe
  C:\Windows\System\QolLnrG.exe
  2⤵
  PID:5360
- C:\Windows\System\WuoAqli.exe
  C:\Windows\System\WuoAqli.exe
  2⤵
  PID:5660
- C:\Windows\System\PpBfwmL.exe
  C:\Windows\System\PpBfwmL.exe
  2⤵
  PID:5604
- C:\Windows\System\VCsTRfE.exe
  C:\Windows\System\VCsTRfE.exe
  2⤵
  PID:5736
- C:\Windows\System\AyUdGFA.exe
  C:\Windows\System\AyUdGFA.exe
  2⤵
  PID:5848
- C:\Windows\System\mFNNFhl.exe
  C:\Windows\System\mFNNFhl.exe
  2⤵
  PID:5936
- C:\Windows\System\rUbXkSr.exe
  C:\Windows\System\rUbXkSr.exe
  2⤵
  PID:6000
- C:\Windows\System\XCaLgnV.exe
  C:\Windows\System\XCaLgnV.exe
  2⤵
  PID:6100
- C:\Windows\System\fmniTZM.exe
  C:\Windows\System\fmniTZM.exe
  2⤵
  PID:5188
- C:\Windows\System\gYaiUxc.exe
  C:\Windows\System\gYaiUxc.exe
  2⤵
  PID:6012
- C:\Windows\System\rJjrhPo.exe
  C:\Windows\System\rJjrhPo.exe
  2⤵
  PID:4404
- C:\Windows\System\tDAphmb.exe
  C:\Windows\System\tDAphmb.exe
  2⤵
  PID:5408
- C:\Windows\System\KYkmViM.exe
  C:\Windows\System\KYkmViM.exe
  2⤵
  PID:5612
- C:\Windows\System\FDOawQj.exe
  C:\Windows\System\FDOawQj.exe
  2⤵
  PID:4944
- C:\Windows\System\vbICgmS.exe
  C:\Windows\System\vbICgmS.exe
  2⤵
  PID:5504
- C:\Windows\System\BBlEeWQ.exe
  C:\Windows\System\BBlEeWQ.exe
  2⤵
  PID:5584
- C:\Windows\System\ojfAOTK.exe
  C:\Windows\System\ojfAOTK.exe
  2⤵
  PID:5888
- C:\Windows\System\jEIRjvD.exe
  C:\Windows\System\jEIRjvD.exe
  2⤵
  PID:5952
- C:\Windows\System\TfNmdci.exe
  C:\Windows\System\TfNmdci.exe
  2⤵
  PID:5500
- C:\Windows\System\sYHgUdw.exe
  C:\Windows\System\sYHgUdw.exe
  2⤵
  PID:4252
- C:\Windows\System\WsHQlLZ.exe
  C:\Windows\System\WsHQlLZ.exe
  2⤵
  PID:5684
- C:\Windows\System\EnJXEXN.exe
  C:\Windows\System\EnJXEXN.exe
  2⤵
  PID:6152
- C:\Windows\System\LOwdcBf.exe
  C:\Windows\System\LOwdcBf.exe
  2⤵
  PID:6168
- C:\Windows\System\YLZyXqd.exe
  C:\Windows\System\YLZyXqd.exe
  2⤵
  PID:6184
- C:\Windows\System\yJEwOny.exe
  C:\Windows\System\yJEwOny.exe
  2⤵
  PID:6200
- C:\Windows\System\YSRqOYc.exe
  C:\Windows\System\YSRqOYc.exe
  2⤵
  PID:6216
- C:\Windows\System\uoYTbyT.exe
  C:\Windows\System\uoYTbyT.exe
  2⤵
  PID:6232
- C:\Windows\System\HngRqZy.exe
  C:\Windows\System\HngRqZy.exe
  2⤵
  PID:6248
- C:\Windows\System\SjFrHLc.exe
  C:\Windows\System\SjFrHLc.exe
  2⤵
  PID:6264
- C:\Windows\System\vTKiDNs.exe
  C:\Windows\System\vTKiDNs.exe
  2⤵
  PID:6280
- C:\Windows\System\MyMdtci.exe
  C:\Windows\System\MyMdtci.exe
  2⤵
  PID:6296
- C:\Windows\System\uTgyjak.exe
  C:\Windows\System\uTgyjak.exe
  2⤵
  PID:6312
- C:\Windows\System\FGryGJo.exe
  C:\Windows\System\FGryGJo.exe
  2⤵
  PID:6328
- C:\Windows\System\ggxeaKi.exe
  C:\Windows\System\ggxeaKi.exe
  2⤵
  PID:6344
- C:\Windows\System\hEzwufv.exe
  C:\Windows\System\hEzwufv.exe
  2⤵
  PID:6360
- C:\Windows\System\jXtddSg.exe
  C:\Windows\System\jXtddSg.exe
  2⤵
  PID:6376
- C:\Windows\System\leoyQGQ.exe
  C:\Windows\System\leoyQGQ.exe
  2⤵
  PID:6392
- C:\Windows\System\nWAOsAQ.exe
  C:\Windows\System\nWAOsAQ.exe
  2⤵
  PID:6408
- C:\Windows\System\UjMNaAk.exe
  C:\Windows\System\UjMNaAk.exe
  2⤵
  PID:6424
- C:\Windows\System\UMXxwrp.exe
  C:\Windows\System\UMXxwrp.exe
  2⤵
  PID:6440
- C:\Windows\System\HOMtlqs.exe
  C:\Windows\System\HOMtlqs.exe
  2⤵
  PID:6456
- C:\Windows\System\oHcXDkc.exe
  C:\Windows\System\oHcXDkc.exe
  2⤵
  PID:6472
- C:\Windows\System\wKPUMHA.exe
  C:\Windows\System\wKPUMHA.exe
  2⤵
  PID:6488
- C:\Windows\System\YEccpbb.exe
  C:\Windows\System\YEccpbb.exe
  2⤵
  PID:6504
- C:\Windows\System\mjEJDCG.exe
  C:\Windows\System\mjEJDCG.exe
  2⤵
  PID:6520
- C:\Windows\System\rvnMWll.exe
  C:\Windows\System\rvnMWll.exe
  2⤵
  PID:6536
- C:\Windows\System\rShflqU.exe
  C:\Windows\System\rShflqU.exe
  2⤵
  PID:6552
- C:\Windows\System\ZenTGBF.exe
  C:\Windows\System\ZenTGBF.exe
  2⤵
  PID:6568
- C:\Windows\System\LDuLRKq.exe
  C:\Windows\System\LDuLRKq.exe
  2⤵
  PID:6584
- C:\Windows\System\AdAtsZM.exe
  C:\Windows\System\AdAtsZM.exe
  2⤵
  PID:6600
- C:\Windows\System\ISehECN.exe
  C:\Windows\System\ISehECN.exe
  2⤵
  PID:6616
- C:\Windows\System\QhlvlSJ.exe
  C:\Windows\System\QhlvlSJ.exe
  2⤵
  PID:6632
- C:\Windows\System\wYlKWoP.exe
  C:\Windows\System\wYlKWoP.exe
  2⤵
  PID:6648
- C:\Windows\System\ZMHBUsC.exe
  C:\Windows\System\ZMHBUsC.exe
  2⤵
  PID:6664
- C:\Windows\System\srxdhCg.exe
  C:\Windows\System\srxdhCg.exe
  2⤵
  PID:6680
- C:\Windows\System\wtZWrPl.exe
  C:\Windows\System\wtZWrPl.exe
  2⤵
  PID:6696
- C:\Windows\System\IeBfTUj.exe
  C:\Windows\System\IeBfTUj.exe
  2⤵
  PID:6712
- C:\Windows\System\dpalBLD.exe
  C:\Windows\System\dpalBLD.exe
  2⤵
  PID:6728
- C:\Windows\System\fBZGkXI.exe
  C:\Windows\System\fBZGkXI.exe
  2⤵
  PID:6744
- C:\Windows\System\mYvtcox.exe
  C:\Windows\System\mYvtcox.exe
  2⤵
  PID:6760
- C:\Windows\System\EUwaVdh.exe
  C:\Windows\System\EUwaVdh.exe
  2⤵
  PID:6776
- C:\Windows\System\oCqLoOd.exe
  C:\Windows\System\oCqLoOd.exe
  2⤵
  PID:6792
- C:\Windows\System\VJJixpO.exe
  C:\Windows\System\VJJixpO.exe
  2⤵
  PID:6808
- C:\Windows\System\oWZJvkA.exe
  C:\Windows\System\oWZJvkA.exe
  2⤵
  PID:6824
- C:\Windows\System\AHVZkeW.exe
  C:\Windows\System\AHVZkeW.exe
  2⤵
  PID:6840
- C:\Windows\System\EVjHdhk.exe
  C:\Windows\System\EVjHdhk.exe
  2⤵
  PID:6856
- C:\Windows\System\zWehlDc.exe
  C:\Windows\System\zWehlDc.exe
  2⤵
  PID:6872
- C:\Windows\System\gUGEhPl.exe
  C:\Windows\System\gUGEhPl.exe
  2⤵
  PID:6888
- C:\Windows\System\pqxqfkV.exe
  C:\Windows\System\pqxqfkV.exe
  2⤵
  PID:6904
- C:\Windows\System\AVUOYgl.exe
  C:\Windows\System\AVUOYgl.exe
  2⤵
  PID:6920
- C:\Windows\System\wRziyTH.exe
  C:\Windows\System\wRziyTH.exe
  2⤵
  PID:6936
- C:\Windows\System\ONBOkws.exe
  C:\Windows\System\ONBOkws.exe
  2⤵
  PID:6952
- C:\Windows\System\vzxVzFy.exe
  C:\Windows\System\vzxVzFy.exe
  2⤵
  PID:6968
- C:\Windows\System\MWlUHVL.exe
  C:\Windows\System\MWlUHVL.exe
  2⤵
  PID:6984
- C:\Windows\System\hSsMXkO.exe
  C:\Windows\System\hSsMXkO.exe
  2⤵
  PID:7000
- C:\Windows\System\algjVyT.exe
  C:\Windows\System\algjVyT.exe
  2⤵
  PID:7016
- C:\Windows\System\HGHFvxg.exe
  C:\Windows\System\HGHFvxg.exe
  2⤵
  PID:7032
- C:\Windows\System\Odssrgi.exe
  C:\Windows\System\Odssrgi.exe
  2⤵
  PID:7048
- C:\Windows\System\jOsmiuO.exe
  C:\Windows\System\jOsmiuO.exe
  2⤵
  PID:7064
- C:\Windows\System\pGPJBJj.exe
  C:\Windows\System\pGPJBJj.exe
  2⤵
  PID:7080
- C:\Windows\System\zSHoCmk.exe
  C:\Windows\System\zSHoCmk.exe
  2⤵
  PID:7096
- C:\Windows\System\GXItCpv.exe
  C:\Windows\System\GXItCpv.exe
  2⤵
  PID:7112
- C:\Windows\System\inOvOVg.exe
  C:\Windows\System\inOvOVg.exe
  2⤵
  PID:7128
- C:\Windows\System\yaJlLQh.exe
  C:\Windows\System\yaJlLQh.exe
  2⤵
  PID:7144
- C:\Windows\System\gZGuXZh.exe
  C:\Windows\System\gZGuXZh.exe
  2⤵
  PID:7160
- C:\Windows\System\sNkDksw.exe
  C:\Windows\System\sNkDksw.exe
  2⤵
  PID:6160
- C:\Windows\System\PkxtZGA.exe
  C:\Windows\System\PkxtZGA.exe
  2⤵
  PID:6224
- C:\Windows\System\WNYcaMJ.exe
  C:\Windows\System\WNYcaMJ.exe
  2⤵
  PID:6288
- C:\Windows\System\DpMarHj.exe
  C:\Windows\System\DpMarHj.exe
  2⤵
  PID:6352
- C:\Windows\System\JRyhaLl.exe
  C:\Windows\System\JRyhaLl.exe
  2⤵
  PID:6416
- C:\Windows\System\dicKfPU.exe
  C:\Windows\System\dicKfPU.exe
  2⤵
  PID:6484
- C:\Windows\System\SDADfXh.exe
  C:\Windows\System\SDADfXh.exe
  2⤵
  PID:6516
- C:\Windows\System\NLUfnFI.exe
  C:\Windows\System\NLUfnFI.exe
  2⤵
  PID:6580
- C:\Windows\System\qirtVXH.exe
  C:\Windows\System\qirtVXH.exe
  2⤵
  PID:6644
- C:\Windows\System\vicOXbS.exe
  C:\Windows\System\vicOXbS.exe
  2⤵
  PID:6704
- C:\Windows\System\oKldFRX.exe
  C:\Windows\System\oKldFRX.exe
  2⤵
  PID:6740
- C:\Windows\System\xkzxZpZ.exe
  C:\Windows\System\xkzxZpZ.exe
  2⤵
  PID:6772
- C:\Windows\System\NNgbgcz.exe
  C:\Windows\System\NNgbgcz.exe
  2⤵
  PID:6836
- C:\Windows\System\RFLdFYH.exe
  C:\Windows\System\RFLdFYH.exe
  2⤵
  PID:6896
- C:\Windows\System\FHxgthI.exe
  C:\Windows\System\FHxgthI.exe
  2⤵
  PID:5980
- C:\Windows\System\uKUOWhd.exe
  C:\Windows\System\uKUOWhd.exe
  2⤵
  PID:6432
- C:\Windows\System\HFPIZUh.exe
  C:\Windows\System\HFPIZUh.exe
  2⤵
  PID:7056
- C:\Windows\System\OkkpOql.exe
  C:\Windows\System\OkkpOql.exe
  2⤵
  PID:7088
- C:\Windows\System\jXQQlAg.exe
  C:\Windows\System\jXQQlAg.exe
  2⤵
  PID:7092
- C:\Windows\System\beXzxNK.exe
  C:\Windows\System\beXzxNK.exe
  2⤵
  PID:6752
- C:\Windows\System\NoiZTQr.exe
  C:\Windows\System\NoiZTQr.exe
  2⤵
  PID:6180
- C:\Windows\System\oYRGZJc.exe
  C:\Windows\System\oYRGZJc.exe
  2⤵
  PID:6336
- C:\Windows\System\mKAGDwz.exe
  C:\Windows\System\mKAGDwz.exe
  2⤵
  PID:6400
- C:\Windows\System\xmUGAXs.exe
  C:\Windows\System\xmUGAXs.exe
  2⤵
  PID:7012
- C:\Windows\System\KLHNJEn.exe
  C:\Windows\System\KLHNJEn.exe
  2⤵
  PID:6532
- C:\Windows\System\HnDxQuK.exe
  C:\Windows\System\HnDxQuK.exe
  2⤵
  PID:4424
- C:\Windows\System\XoqmYjB.exe
  C:\Windows\System\XoqmYjB.exe
  2⤵
  PID:5472
- C:\Windows\System\gnnfgmp.exe
  C:\Windows\System\gnnfgmp.exe
  2⤵
  PID:6148
- C:\Windows\System\RKZCWIa.exe
  C:\Windows\System\RKZCWIa.exe
  2⤵
  PID:6240
- C:\Windows\System\zByluUr.exe
  C:\Windows\System\zByluUr.exe
  2⤵
  PID:6884
- C:\Windows\System\FetfUgZ.exe
  C:\Windows\System\FetfUgZ.exe
  2⤵
  PID:7124
- C:\Windows\System\PoPXueD.exe
  C:\Windows\System\PoPXueD.exe
  2⤵
  PID:6372
- C:\Windows\System\KOxNQyj.exe
  C:\Windows\System\KOxNQyj.exe
  2⤵
  PID:6500
- C:\Windows\System\OdqWxsd.exe
  C:\Windows\System\OdqWxsd.exe
  2⤵
  PID:6628
- C:\Windows\System\GqXoYZh.exe
  C:\Windows\System\GqXoYZh.exe
  2⤵
  PID:6692
- C:\Windows\System\NLGMJUL.exe
  C:\Windows\System\NLGMJUL.exe
  2⤵
  PID:6820
- C:\Windows\System\LjSTDyQ.exe
  C:\Windows\System\LjSTDyQ.exe
  2⤵
  PID:7104
- C:\Windows\System\poqOkVb.exe
  C:\Windows\System\poqOkVb.exe
  2⤵
  PID:6196
- C:\Windows\System\eJSrMbA.exe
  C:\Windows\System\eJSrMbA.exe
  2⤵
  PID:6320
- C:\Windows\System\hdbQleb.exe
  C:\Windows\System\hdbQleb.exe
  2⤵
  PID:6480
- C:\Windows\System\bXtMeLn.exe
  C:\Windows\System\bXtMeLn.exe
  2⤵
  PID:5780
- C:\Windows\System\LajpPPt.exe
  C:\Windows\System\LajpPPt.exe
  2⤵
  PID:6388
- C:\Windows\System\wOcqQiI.exe
  C:\Windows\System\wOcqQiI.exe
  2⤵
  PID:6052
- C:\Windows\System\SVQQJPU.exe
  C:\Windows\System\SVQQJPU.exe
  2⤵
  PID:6932
- C:\Windows\System\IXDCacy.exe
  C:\Windows\System\IXDCacy.exe
  2⤵
  PID:6768
- C:\Windows\System\Pmhdlvp.exe
  C:\Windows\System\Pmhdlvp.exe
  2⤵
  PID:6992
- C:\Windows\System\ejEuhqg.exe
  C:\Windows\System\ejEuhqg.exe
  2⤵
  PID:6724
- C:\Windows\System\TVYSeAq.exe
  C:\Windows\System\TVYSeAq.exe
  2⤵
  PID:7008
- C:\Windows\System\CMkkztP.exe
  C:\Windows\System\CMkkztP.exe
  2⤵
  PID:5984
- C:\Windows\System\MVnCnig.exe
  C:\Windows\System\MVnCnig.exe
  2⤵
  PID:6272
- C:\Windows\System\pHVVeNy.exe
  C:\Windows\System\pHVVeNy.exe
  2⤵
  PID:6564
- C:\Windows\System\zZiuArT.exe
  C:\Windows\System\zZiuArT.exe
  2⤵
  PID:5844
- C:\Windows\System\ditiEEB.exe
  C:\Windows\System\ditiEEB.exe
  2⤵
  PID:6784
- C:\Windows\System\DobHTQr.exe
  C:\Windows\System\DobHTQr.exe
  2⤵
  PID:6304
- C:\Windows\System\JrgaVBA.exe
  C:\Windows\System\JrgaVBA.exe
  2⤵
  PID:6868
- C:\Windows\System\EPgjITr.exe
  C:\Windows\System\EPgjITr.exe
  2⤵
  PID:6976
- C:\Windows\System\pANcSJb.exe
  C:\Windows\System\pANcSJb.exe
  2⤵
  PID:6528
- C:\Windows\System\GicTKeb.exe
  C:\Windows\System\GicTKeb.exe
  2⤵
  PID:6208
- C:\Windows\System\ZVfZiJF.exe
  C:\Windows\System\ZVfZiJF.exe
  2⤵
  PID:5488
- C:\Windows\System\FuzcjPD.exe
  C:\Windows\System\FuzcjPD.exe
  2⤵
  PID:6816
- C:\Windows\System\RQxTInP.exe
  C:\Windows\System\RQxTInP.exe
  2⤵
  PID:7156
- C:\Windows\System\FFxWtbB.exe
  C:\Windows\System\FFxWtbB.exe
  2⤵
  PID:5692
- C:\Windows\System\WxbfTRR.exe
  C:\Windows\System\WxbfTRR.exe
  2⤵
  PID:7060
- C:\Windows\System\rcwXEzl.exe
  C:\Windows\System\rcwXEzl.exe
  2⤵
  PID:5832
- C:\Windows\System\LgaEujm.exe
  C:\Windows\System\LgaEujm.exe
  2⤵
  PID:6340
- C:\Windows\System\nWerrIL.exe
  C:\Windows\System\nWerrIL.exe
  2⤵
  PID:6804
- C:\Windows\System\spVdkGN.exe
  C:\Windows\System\spVdkGN.exe
  2⤵
  PID:7072
- C:\Windows\System\otzxNiG.exe
  C:\Windows\System\otzxNiG.exe
  2⤵
  PID:6324
- C:\Windows\System\XWJvxtL.exe
  C:\Windows\System\XWJvxtL.exe
  2⤵
  PID:7140
- C:\Windows\System\VuvnKzK.exe
  C:\Windows\System\VuvnKzK.exe
  2⤵
  PID:6468
- C:\Windows\System\TcblGby.exe
  C:\Windows\System\TcblGby.exe
  2⤵
  PID:5420
- C:\Windows\System\NNEzvsq.exe
  C:\Windows\System\NNEzvsq.exe
  2⤵
  PID:6916
- C:\Windows\System\XkZZPrU.exe
  C:\Windows\System\XkZZPrU.exe
  2⤵
  PID:6464
- C:\Windows\System\NNQbFxL.exe
  C:\Windows\System\NNQbFxL.exe
  2⤵
  PID:7184
- C:\Windows\System\Wihvcxd.exe
  C:\Windows\System\Wihvcxd.exe
  2⤵
  PID:7200
- C:\Windows\System\lGFQwYb.exe
  C:\Windows\System\lGFQwYb.exe
  2⤵
  PID:7216
- C:\Windows\System\WYxkkSa.exe
  C:\Windows\System\WYxkkSa.exe
  2⤵
  PID:7232
- C:\Windows\System\JcYpKcY.exe
  C:\Windows\System\JcYpKcY.exe
  2⤵
  PID:7248
- C:\Windows\System\WwpMpei.exe
  C:\Windows\System\WwpMpei.exe
  2⤵
  PID:7264
- C:\Windows\System\ZPVOqYB.exe
  C:\Windows\System\ZPVOqYB.exe
  2⤵
  PID:7280
- C:\Windows\System\xxeaXnQ.exe
  C:\Windows\System\xxeaXnQ.exe
  2⤵
  PID:7296
- C:\Windows\System\HJQiqeP.exe
  C:\Windows\System\HJQiqeP.exe
  2⤵
  PID:7312
- C:\Windows\System\DnTiYVO.exe
  C:\Windows\System\DnTiYVO.exe
  2⤵
  PID:7328
- C:\Windows\System\uROyayp.exe
  C:\Windows\System\uROyayp.exe
  2⤵
  PID:7344
- C:\Windows\System\ysKGujB.exe
  C:\Windows\System\ysKGujB.exe
  2⤵
  PID:7360
- C:\Windows\System\gzRHEsj.exe
  C:\Windows\System\gzRHEsj.exe
  2⤵
  PID:7376
- C:\Windows\System\eoIyegF.exe
  C:\Windows\System\eoIyegF.exe
  2⤵
  PID:7392
- C:\Windows\System\VwyNAzZ.exe
  C:\Windows\System\VwyNAzZ.exe
  2⤵
  PID:7408
- C:\Windows\System\dUyzxZG.exe
  C:\Windows\System\dUyzxZG.exe
  2⤵
  PID:7424
- C:\Windows\System\dRRVHgG.exe
  C:\Windows\System\dRRVHgG.exe
  2⤵
  PID:7440
- C:\Windows\System\NhfLYBt.exe
  C:\Windows\System\NhfLYBt.exe
  2⤵
  PID:7456
- C:\Windows\System\niiYPxJ.exe
  C:\Windows\System\niiYPxJ.exe
  2⤵
  PID:7472
- C:\Windows\System\rEwKjwD.exe
  C:\Windows\System\rEwKjwD.exe
  2⤵
  PID:7488
- C:\Windows\System\qTgpvus.exe
  C:\Windows\System\qTgpvus.exe
  2⤵
  PID:7504
- C:\Windows\System\VqtnATT.exe
  C:\Windows\System\VqtnATT.exe
  2⤵
  PID:7520
- C:\Windows\System\maLDsMH.exe
  C:\Windows\System\maLDsMH.exe
  2⤵
  PID:7540
- C:\Windows\System\TNbLsCN.exe
  C:\Windows\System\TNbLsCN.exe
  2⤵
  PID:7556
- C:\Windows\System\DzfQVTd.exe
  C:\Windows\System\DzfQVTd.exe
  2⤵
  PID:7572
- C:\Windows\System\ZRitvPs.exe
  C:\Windows\System\ZRitvPs.exe
  2⤵
  PID:7588
- C:\Windows\System\YVXVnFJ.exe
  C:\Windows\System\YVXVnFJ.exe
  2⤵
  PID:7604
- C:\Windows\System\qnAJXxm.exe
  C:\Windows\System\qnAJXxm.exe
  2⤵
  PID:7620
- C:\Windows\System\zZGZCID.exe
  C:\Windows\System\zZGZCID.exe
  2⤵
  PID:7636
- C:\Windows\System\waZKZgi.exe
  C:\Windows\System\waZKZgi.exe
  2⤵
  PID:7652
- C:\Windows\System\jAFhcub.exe
  C:\Windows\System\jAFhcub.exe
  2⤵
  PID:7668
- C:\Windows\System\DvRutbn.exe
  C:\Windows\System\DvRutbn.exe
  2⤵
  PID:7684
- C:\Windows\System\oYEhCgx.exe
  C:\Windows\System\oYEhCgx.exe
  2⤵
  PID:7700
- C:\Windows\System\xEstvHk.exe
  C:\Windows\System\xEstvHk.exe
  2⤵
  PID:7716
- C:\Windows\System\OEbBqXH.exe
  C:\Windows\System\OEbBqXH.exe
  2⤵
  PID:7732
- C:\Windows\System\APRsGwf.exe
  C:\Windows\System\APRsGwf.exe
  2⤵
  PID:7748
- C:\Windows\System\slxZkIJ.exe
  C:\Windows\System\slxZkIJ.exe
  2⤵
  PID:7764
- C:\Windows\System\miKJuqR.exe
  C:\Windows\System\miKJuqR.exe
  2⤵
  PID:7780
- C:\Windows\System\GxgZHfb.exe
  C:\Windows\System\GxgZHfb.exe
  2⤵
  PID:7796
- C:\Windows\System\ewKzncf.exe
  C:\Windows\System\ewKzncf.exe
  2⤵
  PID:7812
- C:\Windows\System\HGfEarz.exe
  C:\Windows\System\HGfEarz.exe
  2⤵
  PID:7828
- C:\Windows\System\NzvqzOk.exe
  C:\Windows\System\NzvqzOk.exe
  2⤵
  PID:7844
- C:\Windows\System\xPjUxrx.exe
  C:\Windows\System\xPjUxrx.exe
  2⤵
  PID:7860
- C:\Windows\System\jVgGQMY.exe
  C:\Windows\System\jVgGQMY.exe
  2⤵
  PID:7876
- C:\Windows\System\dFsuZYA.exe
  C:\Windows\System\dFsuZYA.exe
  2⤵
  PID:7892
- C:\Windows\System\fgciiyD.exe
  C:\Windows\System\fgciiyD.exe
  2⤵
  PID:7908
- C:\Windows\System\SeekHeJ.exe
  C:\Windows\System\SeekHeJ.exe
  2⤵
  PID:7924
- C:\Windows\System\CDWMyFd.exe
  C:\Windows\System\CDWMyFd.exe
  2⤵
  PID:7940
- C:\Windows\System\EpLZhbG.exe
  C:\Windows\System\EpLZhbG.exe
  2⤵
  PID:7956
- C:\Windows\System\drIkOBL.exe
  C:\Windows\System\drIkOBL.exe
  2⤵
  PID:7972
- C:\Windows\System\ZJjqtqw.exe
  C:\Windows\System\ZJjqtqw.exe
  2⤵
  PID:7988
- C:\Windows\System\NYttclX.exe
  C:\Windows\System\NYttclX.exe
  2⤵
  PID:8004
- C:\Windows\System\lqGBoNm.exe
  C:\Windows\System\lqGBoNm.exe
  2⤵
  PID:8020
- C:\Windows\System\RzFmLQN.exe
  C:\Windows\System\RzFmLQN.exe
  2⤵
  PID:8036
- C:\Windows\System\ziHufxk.exe
  C:\Windows\System\ziHufxk.exe
  2⤵
  PID:8052
- C:\Windows\System\ZOsugXB.exe
  C:\Windows\System\ZOsugXB.exe
  2⤵
  PID:8068
- C:\Windows\System\tAvdylb.exe
  C:\Windows\System\tAvdylb.exe
  2⤵
  PID:8084
- C:\Windows\System\oPfOdwI.exe
  C:\Windows\System\oPfOdwI.exe
  2⤵
  PID:8108
- C:\Windows\System\CpOdsGS.exe
  C:\Windows\System\CpOdsGS.exe
  2⤵
  PID:8124
- C:\Windows\System\qpupLgs.exe
  C:\Windows\System\qpupLgs.exe
  2⤵
  PID:8140
- C:\Windows\System\ywfjjoe.exe
  C:\Windows\System\ywfjjoe.exe
  2⤵
  PID:8156
- C:\Windows\System\qNVoFeY.exe
  C:\Windows\System\qNVoFeY.exe
  2⤵
  PID:8172
- C:\Windows\System\tJSGBCx.exe
  C:\Windows\System\tJSGBCx.exe
  2⤵
  PID:8188
- C:\Windows\System\TjZFuZe.exe
  C:\Windows\System\TjZFuZe.exe
  2⤵
  PID:7212
- C:\Windows\System\VJzOAdP.exe
  C:\Windows\System\VJzOAdP.exe
  2⤵
  PID:6256
- C:\Windows\System\lRVQPpS.exe
  C:\Windows\System\lRVQPpS.exe
  2⤵
  PID:7272
- C:\Windows\System\TNwxgdQ.exe
  C:\Windows\System\TNwxgdQ.exe
  2⤵
  PID:6788
- C:\Windows\System\kJIrngK.exe
  C:\Windows\System\kJIrngK.exe
  2⤵
  PID:7336
- C:\Windows\System\TZvxeJw.exe
  C:\Windows\System\TZvxeJw.exe
  2⤵
  PID:7400
- C:\Windows\System\GZgeblp.exe
  C:\Windows\System\GZgeblp.exe
  2⤵
  PID:7260
- C:\Windows\System\IjdYpkK.exe
  C:\Windows\System\IjdYpkK.exe
  2⤵
  PID:7468
- C:\Windows\System\fBdWRDk.exe
  C:\Windows\System\fBdWRDk.exe
  2⤵
  PID:7536
- C:\Windows\System\XyAgLMi.exe
  C:\Windows\System\XyAgLMi.exe
  2⤵
  PID:7600
- C:\Windows\System\DmwHqeA.exe
  C:\Windows\System\DmwHqeA.exe
  2⤵
  PID:7324
- C:\Windows\System\MdVWkFa.exe
  C:\Windows\System\MdVWkFa.exe
  2⤵
  PID:7692
- C:\Windows\System\kFHGzbX.exe
  C:\Windows\System\kFHGzbX.exe
  2⤵
  PID:7416
- C:\Windows\System\lJDnaiC.exe
  C:\Windows\System\lJDnaiC.exe
  2⤵
  PID:7760
- C:\Windows\System\SRkjJWB.exe
  C:\Windows\System\SRkjJWB.exe
  2⤵
  PID:7356
- C:\Windows\System\FQdQLcR.exe
  C:\Windows\System\FQdQLcR.exe
  2⤵
  PID:7792
- C:\Windows\System\NFlSxDv.exe
  C:\Windows\System\NFlSxDv.exe
  2⤵
  PID:7856
- C:\Windows\System\iraColo.exe
  C:\Windows\System\iraColo.exe
  2⤵
  PID:7680
- C:\Windows\System\QDFcfvF.exe
  C:\Windows\System\QDFcfvF.exe
  2⤵
  PID:7516
- C:\Windows\System\geayYZK.exe
  C:\Windows\System\geayYZK.exe
  2⤵
  PID:7952
- C:\Windows\System\tEoZbMN.exe
  C:\Windows\System\tEoZbMN.exe
  2⤵
  PID:7984
- C:\Windows\System\vfPDXAt.exe
  C:\Windows\System\vfPDXAt.exe
  2⤵
  PID:8016
- C:\Windows\System\jrIBdpH.exe
  C:\Windows\System\jrIBdpH.exe
  2⤵
  PID:7584
- C:\Windows\System\SiJDBPG.exe
  C:\Windows\System\SiJDBPG.exe
  2⤵
  PID:7648
- C:\Windows\System\ijMWIEl.exe
  C:\Windows\System\ijMWIEl.exe
  2⤵
  PID:7836
- C:\Windows\System\GBHzOJq.exe
  C:\Windows\System\GBHzOJq.exe
  2⤵
  PID:7708
- C:\Windows\System\kHHRhFr.exe
  C:\Windows\System\kHHRhFr.exe
  2⤵
  PID:7776
- C:\Windows\System\CzAYuFw.exe
  C:\Windows\System\CzAYuFw.exe
  2⤵
  PID:7904
- C:\Windows\System\FJHSOEO.exe
  C:\Windows\System\FJHSOEO.exe
  2⤵
  PID:8064
- C:\Windows\System\eEWjaCt.exe
  C:\Windows\System\eEWjaCt.exe
  2⤵
  PID:8100
- C:\Windows\System\lTrauAx.exe
  C:\Windows\System\lTrauAx.exe
  2⤵
  PID:5372
- C:\Windows\System\FNLipjU.exe
  C:\Windows\System\FNLipjU.exe
  2⤵
  PID:8184
- C:\Windows\System\fMfikgI.exe
  C:\Windows\System\fMfikgI.exe
  2⤵
  PID:7256
- C:\Windows\System\MdFyVDj.exe
  C:\Windows\System\MdFyVDj.exe
  2⤵
  PID:7464
- C:\Windows\System\WjFcpaw.exe
  C:\Windows\System\WjFcpaw.exe
  2⤵
  PID:7292
- C:\Windows\System\mGdyZZJ.exe
  C:\Windows\System\mGdyZZJ.exe
  2⤵
  PID:7788
- C:\Windows\System\ghUpYpx.exe
  C:\Windows\System\ghUpYpx.exe
  2⤵
  PID:8136
- C:\Windows\System\hNfgJVp.exe
  C:\Windows\System\hNfgJVp.exe
  2⤵
  PID:8012
- C:\Windows\System\xwvUscj.exe
  C:\Windows\System\xwvUscj.exe
  2⤵
  PID:8080
- C:\Windows\System\BwGbsfL.exe
  C:\Windows\System\BwGbsfL.exe
  2⤵
  PID:7996
- C:\Windows\System\wLxzwqU.exe
  C:\Windows\System\wLxzwqU.exe
  2⤵
  PID:8148
- C:\Windows\System\ULmWxGk.exe
  C:\Windows\System\ULmWxGk.exe
  2⤵
  PID:7756
- C:\Windows\System\BJbvukW.exe
  C:\Windows\System\BJbvukW.exe
  2⤵
  PID:7180
- C:\Windows\System\iZwrPOM.exe
  C:\Windows\System\iZwrPOM.exe
  2⤵
  PID:8164
- C:\Windows\System\VFkibQp.exe
  C:\Windows\System\VFkibQp.exe
  2⤵
  PID:7228
- C:\Windows\System\UseLzlQ.exe
  C:\Windows\System\UseLzlQ.exe
  2⤵
  PID:7432
- C:\Windows\System\TjUzztY.exe
  C:\Windows\System\TjUzztY.exe
  2⤵
  PID:1372
- C:\Windows\System\BSecBFc.exe
  C:\Windows\System\BSecBFc.exe
  2⤵
  PID:7852
- C:\Windows\System\WmLGavI.exe
  C:\Windows\System\WmLGavI.exe
  2⤵
  PID:7512
- C:\Windows\System\EFygCij.exe
  C:\Windows\System\EFygCij.exe
  2⤵
  PID:8032
- C:\Windows\System\buXrYxQ.exe
  C:\Windows\System\buXrYxQ.exe
  2⤵
  PID:7744
- C:\Windows\System\YdacjgX.exe
  C:\Windows\System\YdacjgX.exe
  2⤵
  PID:8116
- C:\Windows\System\ehiyjrO.exe
  C:\Windows\System\ehiyjrO.exe
  2⤵
  PID:7772
- C:\Windows\System\eNQfViH.exe
  C:\Windows\System\eNQfViH.exe
  2⤵
  PID:7664
- C:\Windows\System\jKeLUNg.exe
  C:\Windows\System\jKeLUNg.exe
  2⤵
  PID:7320
- C:\Windows\System\nRzZxcH.exe
  C:\Windows\System\nRzZxcH.exe
  2⤵
  PID:7196
- C:\Windows\System\VBVOLCx.exe
  C:\Windows\System\VBVOLCx.exe
  2⤵
  PID:7288
- C:\Windows\System\aWDZNYN.exe
  C:\Windows\System\aWDZNYN.exe
  2⤵
  PID:7500
- C:\Windows\System\HYnBUqi.exe
  C:\Windows\System\HYnBUqi.exe
  2⤵
  PID:8208
- C:\Windows\System\cZtGzNQ.exe
  C:\Windows\System\cZtGzNQ.exe
  2⤵
  PID:8224
- C:\Windows\System\OWcNzrZ.exe
  C:\Windows\System\OWcNzrZ.exe
  2⤵
  PID:8240
- C:\Windows\System\LZsTTcr.exe
  C:\Windows\System\LZsTTcr.exe
  2⤵
  PID:8256
- C:\Windows\System\UyEZduY.exe
  C:\Windows\System\UyEZduY.exe
  2⤵
  PID:8272
- C:\Windows\System\FQdklVn.exe
  C:\Windows\System\FQdklVn.exe
  2⤵
  PID:8288
- C:\Windows\System\eKefayy.exe
  C:\Windows\System\eKefayy.exe
  2⤵
  PID:8308
- C:\Windows\System\cxiVYWk.exe
  C:\Windows\System\cxiVYWk.exe
  2⤵
  PID:8324
- C:\Windows\System\AqkEcdU.exe
  C:\Windows\System\AqkEcdU.exe
  2⤵
  PID:8340
- C:\Windows\System\HcGfoYa.exe
  C:\Windows\System\HcGfoYa.exe
  2⤵
  PID:8356
- C:\Windows\System\jkACVKF.exe
  C:\Windows\System\jkACVKF.exe
  2⤵
  PID:8372
- C:\Windows\System\wsMYFCo.exe
  C:\Windows\System\wsMYFCo.exe
  2⤵
  PID:8388
- C:\Windows\System\cJHUlHm.exe
  C:\Windows\System\cJHUlHm.exe
  2⤵
  PID:8404
- C:\Windows\System\DBeizHq.exe
  C:\Windows\System\DBeizHq.exe
  2⤵
  PID:8420
- C:\Windows\System\WYbbQxG.exe
  C:\Windows\System\WYbbQxG.exe
  2⤵
  PID:8436
- C:\Windows\System\uDfHMJA.exe
  C:\Windows\System\uDfHMJA.exe
  2⤵
  PID:8452
- C:\Windows\System\cPHTHPV.exe
  C:\Windows\System\cPHTHPV.exe
  2⤵
  PID:8468
- C:\Windows\System\wVPwWas.exe
  C:\Windows\System\wVPwWas.exe
  2⤵
  PID:8484
- C:\Windows\System\TlmmjDV.exe
  C:\Windows\System\TlmmjDV.exe
  2⤵
  PID:8500
- C:\Windows\System\nRimfBw.exe
  C:\Windows\System\nRimfBw.exe
  2⤵
  PID:8516
- C:\Windows\System\TQfodSf.exe
  C:\Windows\System\TQfodSf.exe
  2⤵
  PID:8532
- C:\Windows\System\muaJERh.exe
  C:\Windows\System\muaJERh.exe
  2⤵
  PID:8548
- C:\Windows\System\lifiOpx.exe
  C:\Windows\System\lifiOpx.exe
  2⤵
  PID:8564
- C:\Windows\System\FZTwUfD.exe
  C:\Windows\System\FZTwUfD.exe
  2⤵
  PID:8580
- C:\Windows\System\wkBcFFk.exe
  C:\Windows\System\wkBcFFk.exe
  2⤵
  PID:8596
- C:\Windows\System\QydJQnu.exe
  C:\Windows\System\QydJQnu.exe
  2⤵
  PID:8612
- C:\Windows\System\YPqrGVm.exe
  C:\Windows\System\YPqrGVm.exe
  2⤵
  PID:8628
- C:\Windows\System\kEwMFxW.exe
  C:\Windows\System\kEwMFxW.exe
  2⤵
  PID:8644
- C:\Windows\System\wwjwOdE.exe
  C:\Windows\System\wwjwOdE.exe
  2⤵
  PID:8660
- C:\Windows\System\rJcVwZR.exe
  C:\Windows\System\rJcVwZR.exe
  2⤵
  PID:8676
- C:\Windows\System\XOVWFMO.exe
  C:\Windows\System\XOVWFMO.exe
  2⤵
  PID:8692
- C:\Windows\System\cfDnMFx.exe
  C:\Windows\System\cfDnMFx.exe
  2⤵
  PID:8708
- C:\Windows\System\EWyIRvh.exe
  C:\Windows\System\EWyIRvh.exe
  2⤵
  PID:8724
- C:\Windows\System\vFwfuvt.exe
  C:\Windows\System\vFwfuvt.exe
  2⤵
  PID:8740
- C:\Windows\System\hZIybLj.exe
  C:\Windows\System\hZIybLj.exe
  2⤵
  PID:8756
- C:\Windows\System\SCdUFVo.exe
  C:\Windows\System\SCdUFVo.exe
  2⤵
  PID:8772
- C:\Windows\System\UkqzAty.exe
  C:\Windows\System\UkqzAty.exe
  2⤵
  PID:8788
- C:\Windows\System\AFEBNIU.exe
  C:\Windows\System\AFEBNIU.exe
  2⤵
  PID:8804
- C:\Windows\System\pBGCQPj.exe
  C:\Windows\System\pBGCQPj.exe
  2⤵
  PID:8820
- C:\Windows\System\mLKwpgH.exe
  C:\Windows\System\mLKwpgH.exe
  2⤵
  PID:8836
- C:\Windows\System\YClFpYf.exe
  C:\Windows\System\YClFpYf.exe
  2⤵
  PID:8852
- C:\Windows\System\UlXhTBL.exe
  C:\Windows\System\UlXhTBL.exe
  2⤵
  PID:8868
- C:\Windows\System\FdJxBhZ.exe
  C:\Windows\System\FdJxBhZ.exe
  2⤵
  PID:8884
- C:\Windows\System\rjSzpOk.exe
  C:\Windows\System\rjSzpOk.exe
  2⤵
  PID:8900
- C:\Windows\System\XbIqGVr.exe
  C:\Windows\System\XbIqGVr.exe
  2⤵
  PID:8916
- C:\Windows\System\NFGYjmq.exe
  C:\Windows\System\NFGYjmq.exe
  2⤵
  PID:8932
- C:\Windows\System\dDzpNlb.exe
  C:\Windows\System\dDzpNlb.exe
  2⤵
  PID:8948
- C:\Windows\System\MFpCBEW.exe
  C:\Windows\System\MFpCBEW.exe
  2⤵
  PID:8964
- C:\Windows\System\Wlovgdr.exe
  C:\Windows\System\Wlovgdr.exe
  2⤵
  PID:8980
- C:\Windows\System\CjoaCyW.exe
  C:\Windows\System\CjoaCyW.exe
  2⤵
  PID:8996
- C:\Windows\System\UQdBYQL.exe
  C:\Windows\System\UQdBYQL.exe
  2⤵
  PID:9012
- C:\Windows\System\AluwDiJ.exe
  C:\Windows\System\AluwDiJ.exe
  2⤵
  PID:9028
- C:\Windows\System\qBXuSie.exe
  C:\Windows\System\qBXuSie.exe
  2⤵
  PID:9044
- C:\Windows\System\IFcXVMh.exe
  C:\Windows\System\IFcXVMh.exe
  2⤵
  PID:9060
- C:\Windows\System\BZTZHfp.exe
  C:\Windows\System\BZTZHfp.exe
  2⤵
  PID:9076
- C:\Windows\System\jxRNrcB.exe
  C:\Windows\System\jxRNrcB.exe
  2⤵
  PID:9092
- C:\Windows\System\tUoEqxx.exe
  C:\Windows\System\tUoEqxx.exe
  2⤵
  PID:9108
- C:\Windows\System\lpxwmrz.exe
  C:\Windows\System\lpxwmrz.exe
  2⤵
  PID:9124
- C:\Windows\System\DlgWFFc.exe
  C:\Windows\System\DlgWFFc.exe
  2⤵
  PID:9140
- C:\Windows\System\TKkosgw.exe
  C:\Windows\System\TKkosgw.exe
  2⤵
  PID:9156
- C:\Windows\System\PxHAJAI.exe
  C:\Windows\System\PxHAJAI.exe
  2⤵
  PID:9172
- C:\Windows\System\sulPmrq.exe
  C:\Windows\System\sulPmrq.exe
  2⤵
  PID:9188
- C:\Windows\System\AwqDLvf.exe
  C:\Windows\System\AwqDLvf.exe
  2⤵
  PID:9204
- C:\Windows\System\hAPiNdd.exe
  C:\Windows\System\hAPiNdd.exe
  2⤵
  PID:8216
- C:\Windows\System\ffhEZMg.exe
  C:\Windows\System\ffhEZMg.exe
  2⤵
  PID:8280
- C:\Windows\System\sdPIfOs.exe
  C:\Windows\System\sdPIfOs.exe
  2⤵
  PID:8132
- C:\Windows\System\eNopOOp.exe
  C:\Windows\System\eNopOOp.exe
  2⤵
  PID:8264
- C:\Windows\System\xXQRiRX.exe
  C:\Windows\System\xXQRiRX.exe
  2⤵
  PID:7580
- C:\Windows\System\BHqHtJO.exe
  C:\Windows\System\BHqHtJO.exe
  2⤵
  PID:8048
- C:\Windows\System\PUiNUcV.exe
  C:\Windows\System\PUiNUcV.exe
  2⤵
  PID:8000
- C:\Windows\System\oZyaGdU.exe
  C:\Windows\System\oZyaGdU.exe
  2⤵
  PID:8320
- C:\Windows\System\hdRiwOO.exe
  C:\Windows\System\hdRiwOO.exe
  2⤵
  PID:8348
- C:\Windows\System\oRgDYVN.exe
  C:\Windows\System\oRgDYVN.exe
  2⤵
  PID:8476
- C:\Windows\System\zrcOilF.exe
  C:\Windows\System\zrcOilF.exe
  2⤵
  PID:8540
- C:\Windows\System\vterRJH.exe
  C:\Windows\System\vterRJH.exe
  2⤵
  PID:8608
- C:\Windows\System\viGVyLn.exe
  C:\Windows\System\viGVyLn.exe
  2⤵
  PID:8668
- C:\Windows\System\ZOiMPTZ.exe
  C:\Windows\System\ZOiMPTZ.exe
  2⤵
  PID:8732
- C:\Windows\System\jxEufXN.exe
  C:\Windows\System\jxEufXN.exe
  2⤵
  PID:8556
- C:\Windows\System\tQJZAKq.exe
  C:\Windows\System\tQJZAKq.exe
  2⤵
  PID:8816
- C:\Windows\System\XouDqLv.exe
  C:\Windows\System\XouDqLv.exe
  2⤵
  PID:8876
- C:\Windows\System\ZyDSqhb.exe
  C:\Windows\System\ZyDSqhb.exe
  2⤵
  PID:8496
- C:\Windows\System\XdFmpKI.exe
  C:\Windows\System\XdFmpKI.exe
  2⤵
  PID:8300
- C:\Windows\System\WTiYaDK.exe
  C:\Windows\System\WTiYaDK.exe
  2⤵
  PID:8368
- C:\Windows\System\RfWRqcq.exe
  C:\Windows\System\RfWRqcq.exe
  2⤵
  PID:8432
- C:\Windows\System\wmivJUe.exe
  C:\Windows\System\wmivJUe.exe
  2⤵
  PID:8588
- C:\Windows\System\DNRGUmB.exe
  C:\Windows\System\DNRGUmB.exe
  2⤵
  PID:8652
- C:\Windows\System\rjhfzsl.exe
  C:\Windows\System\rjhfzsl.exe
  2⤵
  PID:8716
- C:\Windows\System\YzsTGoQ.exe
  C:\Windows\System\YzsTGoQ.exe
  2⤵
  PID:8908
- C:\Windows\System\wGzXSzn.exe
  C:\Windows\System\wGzXSzn.exe
  2⤵
  PID:8780
- C:\Windows\System\XWoquAL.exe
  C:\Windows\System\XWoquAL.exe
  2⤵
  PID:8892
- C:\Windows\System\AIBBLpS.exe
  C:\Windows\System\AIBBLpS.exe
  2⤵
  PID:8956
- C:\Windows\System\VQHhmku.exe
  C:\Windows\System\VQHhmku.exe
  2⤵
  PID:8972
- C:\Windows\System\MdhvDTP.exe
  C:\Windows\System\MdhvDTP.exe
  2⤵
  PID:9020
- C:\Windows\System\YtxHmEP.exe
  C:\Windows\System\YtxHmEP.exe
  2⤵
  PID:9084
- C:\Windows\System\rhGzbiV.exe
  C:\Windows\System\rhGzbiV.exe
  2⤵
  PID:9152
- C:\Windows\System\FVnBKfl.exe
  C:\Windows\System\FVnBKfl.exe
  2⤵
  PID:9212
- C:\Windows\System\donaUGD.exe
  C:\Windows\System\donaUGD.exe
  2⤵
  PID:9040
- C:\Windows\System\vPkAOnr.exe
  C:\Windows\System\vPkAOnr.exe
  2⤵
  PID:8284
- C:\Windows\System\VPntHKf.exe
  C:\Windows\System\VPntHKf.exe
  2⤵
  PID:9068
- C:\Windows\System\aBFQXMm.exe
  C:\Windows\System\aBFQXMm.exe
  2⤵
  PID:9200
- C:\Windows\System\qxztvlc.exe
  C:\Windows\System\qxztvlc.exe
  2⤵
  PID:9168
- C:\Windows\System\wuBAHBr.exe
  C:\Windows\System\wuBAHBr.exe
  2⤵
  PID:8248
- C:\Windows\System\CqYQZxf.exe
  C:\Windows\System\CqYQZxf.exe
  2⤵
  PID:8380
- C:\Windows\System\PBvTVLB.exe
  C:\Windows\System\PBvTVLB.exe
  2⤵
  PID:8512
- C:\Windows\System\WyWOouh.exe
  C:\Windows\System\WyWOouh.exe
  2⤵
  PID:8576
- C:\Windows\System\osZEzDk.exe
  C:\Windows\System\osZEzDk.exe
  2⤵
  PID:8704
- C:\Windows\System\PTYAtFO.exe
  C:\Windows\System\PTYAtFO.exe
  2⤵
  PID:8844
- C:\Windows\System\GAbkLXs.exe
  C:\Windows\System\GAbkLXs.exe
  2⤵
  PID:8832
- C:\Windows\System\rCQkNQM.exe
  C:\Windows\System\rCQkNQM.exe
  2⤵
  PID:8428
- C:\Windows\System\moEIoyi.exe
  C:\Windows\System\moEIoyi.exe
  2⤵
  PID:8752
- C:\Windows\System\ZrBznDf.exe
  C:\Windows\System\ZrBznDf.exe
  2⤵
  PID:8528
- C:\Windows\System\OOcSZTa.exe
  C:\Windows\System\OOcSZTa.exe
  2⤵
  PID:8796
- C:\Windows\System\YjnCFnM.exe
  C:\Windows\System\YjnCFnM.exe
  2⤵
  PID:8992
- C:\Windows\System\kxoMlxw.exe
  C:\Windows\System\kxoMlxw.exe
  2⤵
  PID:9184
- C:\Windows\System\QdkjcYA.exe
  C:\Windows\System\QdkjcYA.exe
  2⤵
  PID:9104
- C:\Windows\System\RsDcdnp.exe
  C:\Windows\System\RsDcdnp.exe
  2⤵
  PID:8416
- C:\Windows\System\onRlAxO.exe
  C:\Windows\System\onRlAxO.exe
  2⤵
  PID:8572
- C:\Windows\System\YunaxDH.exe
  C:\Windows\System\YunaxDH.exe
  2⤵
  PID:8316
- C:\Windows\System\nMPltac.exe
  C:\Windows\System\nMPltac.exe
  2⤵
  PID:9136
- C:\Windows\System\MtLKAzp.exe
  C:\Windows\System\MtLKAzp.exe
  2⤵
  PID:7968
- C:\Windows\System\jjqJpOu.exe
  C:\Windows\System\jjqJpOu.exe
  2⤵
  PID:8800
- C:\Windows\System\qJoRCFh.exe
  C:\Windows\System\qJoRCFh.exe
  2⤵
  PID:8748
- C:\Windows\System\VvwZGYL.exe
  C:\Windows\System\VvwZGYL.exe
  2⤵
  PID:9056
- C:\Windows\System\lpZEWzQ.exe
  C:\Windows\System\lpZEWzQ.exe
  2⤵
  PID:8364
- C:\Windows\System\qgLmsFO.exe
  C:\Windows\System\qgLmsFO.exe
  2⤵
  PID:8336
- C:\Windows\System\mehMhhs.exe
  C:\Windows\System\mehMhhs.exe
  2⤵
  PID:8448
- C:\Windows\System\dbWgnbb.exe
  C:\Windows\System\dbWgnbb.exe
  2⤵
  PID:9116
- C:\Windows\System\zSPMuQm.exe
  C:\Windows\System\zSPMuQm.exe
  2⤵
  PID:8460
- C:\Windows\System\Enkaqnu.exe
  C:\Windows\System\Enkaqnu.exe
  2⤵
  PID:8492
- C:\Windows\System\jFcfjdF.exe
  C:\Windows\System\jFcfjdF.exe
  2⤵
  PID:8236
- C:\Windows\System\fCuPnFR.exe
  C:\Windows\System\fCuPnFR.exe
  2⤵
  PID:7484
- C:\Windows\System\QYdXjqb.exe
  C:\Windows\System\QYdXjqb.exe
  2⤵
  PID:9236
- C:\Windows\System\IlfqiGp.exe
  C:\Windows\System\IlfqiGp.exe
  2⤵
  PID:9252
- C:\Windows\System\BfhRWjm.exe
  C:\Windows\System\BfhRWjm.exe
  2⤵
  PID:9268
- C:\Windows\System\IpKXPVv.exe
  C:\Windows\System\IpKXPVv.exe
  2⤵
  PID:9284
- C:\Windows\System\eZDMxgu.exe
  C:\Windows\System\eZDMxgu.exe
  2⤵
  PID:9300
- C:\Windows\System\pLWOCmd.exe
  C:\Windows\System\pLWOCmd.exe
  2⤵
  PID:9316
- C:\Windows\System\cqxPTcf.exe
  C:\Windows\System\cqxPTcf.exe
  2⤵
  PID:9332
- C:\Windows\System\bYawIrp.exe
  C:\Windows\System\bYawIrp.exe
  2⤵
  PID:9348
- C:\Windows\System\KVGKCky.exe
  C:\Windows\System\KVGKCky.exe
  2⤵
  PID:9364
- C:\Windows\System\UzYtXIF.exe
  C:\Windows\System\UzYtXIF.exe
  2⤵
  PID:9380
- C:\Windows\System\wrYOCXg.exe
  C:\Windows\System\wrYOCXg.exe
  2⤵
  PID:9396
- C:\Windows\System\GIakkRv.exe
  C:\Windows\System\GIakkRv.exe
  2⤵
  PID:9412
- C:\Windows\System\qKcYdMc.exe
  C:\Windows\System\qKcYdMc.exe
  2⤵
  PID:9428
- C:\Windows\System\bwYxsCj.exe
  C:\Windows\System\bwYxsCj.exe
  2⤵
  PID:9444
- C:\Windows\System\EmDWhHK.exe
  C:\Windows\System\EmDWhHK.exe
  2⤵
  PID:9460
- C:\Windows\System\iiQhzTj.exe
  C:\Windows\System\iiQhzTj.exe
  2⤵
  PID:9476
- C:\Windows\System\IDlCcvs.exe
  C:\Windows\System\IDlCcvs.exe
  2⤵
  PID:9492
- C:\Windows\System\HcgISwm.exe
  C:\Windows\System\HcgISwm.exe
  2⤵
  PID:9508
- C:\Windows\System\VQFCvjo.exe
  C:\Windows\System\VQFCvjo.exe
  2⤵
  PID:9524
- C:\Windows\System\sEnOtZD.exe
  C:\Windows\System\sEnOtZD.exe
  2⤵
  PID:9540
- C:\Windows\System\wJMDrOf.exe
  C:\Windows\System\wJMDrOf.exe
  2⤵
  PID:9556
- C:\Windows\System\VjOhRRt.exe
  C:\Windows\System\VjOhRRt.exe
  2⤵
  PID:9572
- C:\Windows\System\lGuvAWp.exe
  C:\Windows\System\lGuvAWp.exe
  2⤵
  PID:9588
- C:\Windows\System\YzmdiBi.exe
  C:\Windows\System\YzmdiBi.exe
  2⤵
  PID:9604
- C:\Windows\System\vzLVpSi.exe
  C:\Windows\System\vzLVpSi.exe
  2⤵
  PID:9620
- C:\Windows\System\KefMywQ.exe
  C:\Windows\System\KefMywQ.exe
  2⤵
  PID:9636
- C:\Windows\System\eMcDKjp.exe
  C:\Windows\System\eMcDKjp.exe
  2⤵
  PID:9652
- C:\Windows\System\uELOFei.exe
  C:\Windows\System\uELOFei.exe
  2⤵
  PID:9668
- C:\Windows\System\UXazdHX.exe
  C:\Windows\System\UXazdHX.exe
  2⤵
  PID:9684
- C:\Windows\System\KEZTyMV.exe
  C:\Windows\System\KEZTyMV.exe
  2⤵
  PID:9700
- C:\Windows\System\VWcuzBH.exe
  C:\Windows\System\VWcuzBH.exe
  2⤵
  PID:9716
- C:\Windows\System\GDIDqZX.exe
  C:\Windows\System\GDIDqZX.exe
  2⤵
  PID:9732
- C:\Windows\System\THzfEnv.exe
  C:\Windows\System\THzfEnv.exe
  2⤵
  PID:9748
- C:\Windows\System\DfVxuPd.exe
  C:\Windows\System\DfVxuPd.exe
  2⤵
  PID:9764
- C:\Windows\System\cyJGZSG.exe
  C:\Windows\System\cyJGZSG.exe
  2⤵
  PID:9780
- C:\Windows\System\tslfyxR.exe
  C:\Windows\System\tslfyxR.exe
  2⤵
  PID:9796
- C:\Windows\System\WYjMuoD.exe
  C:\Windows\System\WYjMuoD.exe
  2⤵
  PID:9812
- C:\Windows\System\JEMKaUo.exe
  C:\Windows\System\JEMKaUo.exe
  2⤵
  PID:9828
- C:\Windows\System\jDGJPvO.exe
  C:\Windows\System\jDGJPvO.exe
  2⤵
  PID:9844
- C:\Windows\System\poszrSq.exe
  C:\Windows\System\poszrSq.exe
  2⤵
  PID:9860
- C:\Windows\System\ZGuUQky.exe
  C:\Windows\System\ZGuUQky.exe
  2⤵
  PID:9876
- C:\Windows\System\yRojJZH.exe
  C:\Windows\System\yRojJZH.exe
  2⤵
  PID:9892
- C:\Windows\System\LlLYoed.exe
  C:\Windows\System\LlLYoed.exe
  2⤵
  PID:9908
- C:\Windows\System\sLqXmbJ.exe
  C:\Windows\System\sLqXmbJ.exe
  2⤵
  PID:9924
- C:\Windows\System\PnWMqZz.exe
  C:\Windows\System\PnWMqZz.exe
  2⤵
  PID:9940
- C:\Windows\System\uwnEEsx.exe
  C:\Windows\System\uwnEEsx.exe
  2⤵
  PID:9956
- C:\Windows\System\AfDiptd.exe
  C:\Windows\System\AfDiptd.exe
  2⤵
  PID:9972
- C:\Windows\System\oQNAact.exe
  C:\Windows\System\oQNAact.exe
  2⤵
  PID:9988
- C:\Windows\System\adGnGkU.exe
  C:\Windows\System\adGnGkU.exe
  2⤵
  PID:10004
- C:\Windows\System\AFPeASj.exe
  C:\Windows\System\AFPeASj.exe
  2⤵
  PID:10020
- C:\Windows\System\oBEQOes.exe
  C:\Windows\System\oBEQOes.exe
  2⤵
  PID:10036
- C:\Windows\System\rEWOTKN.exe
  C:\Windows\System\rEWOTKN.exe
  2⤵
  PID:10052
- C:\Windows\System\IJBJXJS.exe
  C:\Windows\System\IJBJXJS.exe
  2⤵
  PID:10068
- C:\Windows\System\ONCQgmW.exe
  C:\Windows\System\ONCQgmW.exe
  2⤵
  PID:10084
- C:\Windows\System\AtSLqMM.exe
  C:\Windows\System\AtSLqMM.exe
  2⤵
  PID:10100
- C:\Windows\System\ErujpSd.exe
  C:\Windows\System\ErujpSd.exe
  2⤵
  PID:10116
- C:\Windows\System\AeNDLRb.exe
  C:\Windows\System\AeNDLRb.exe
  2⤵
  PID:10132
- C:\Windows\System\jrPWOwR.exe
  C:\Windows\System\jrPWOwR.exe
  2⤵
  PID:10148
- C:\Windows\System\AUXwDEG.exe
  C:\Windows\System\AUXwDEG.exe
  2⤵
  PID:10164
- C:\Windows\System\OiDDDMp.exe
  C:\Windows\System\OiDDDMp.exe
  2⤵
  PID:10180
- C:\Windows\System\EdyvThR.exe
  C:\Windows\System\EdyvThR.exe
  2⤵
  PID:10196
- C:\Windows\System\qGZKdiE.exe
  C:\Windows\System\qGZKdiE.exe
  2⤵
  PID:10212
- C:\Windows\System\EVacETM.exe
  C:\Windows\System\EVacETM.exe
  2⤵
  PID:10228
- C:\Windows\System\EaBJflp.exe
  C:\Windows\System\EaBJflp.exe
  2⤵
  PID:9232
- C:\Windows\System\vKLIbvO.exe
  C:\Windows\System\vKLIbvO.exe
  2⤵
  PID:8924
- C:\Windows\System\qqUSLNO.exe
  C:\Windows\System\qqUSLNO.exe
  2⤵
  PID:8624
- C:\Windows\System\brBJrWz.exe
  C:\Windows\System\brBJrWz.exe
  2⤵
  PID:9248
- C:\Windows\System\ewBMJQE.exe
  C:\Windows\System\ewBMJQE.exe
  2⤵
  PID:9292
- C:\Windows\System\IJVLqFE.exe
  C:\Windows\System\IJVLqFE.exe
  2⤵
  PID:9356
- C:\Windows\System\iSlbDil.exe
  C:\Windows\System\iSlbDil.exe
  2⤵
  PID:9424
- C:\Windows\System\VZyAalt.exe
  C:\Windows\System\VZyAalt.exe
  2⤵
  PID:9484
- C:\Windows\System\fOLgOJr.exe
  C:\Windows\System\fOLgOJr.exe
  2⤵
  PID:9344
- C:\Windows\System\RvXaEqt.exe
  C:\Windows\System\RvXaEqt.exe
  2⤵
  PID:9340
- C:\Windows\System\qNajzgj.exe
  C:\Windows\System\qNajzgj.exe
  2⤵
  PID:9404
- C:\Windows\System\uzGFIfb.exe
  C:\Windows\System\uzGFIfb.exe
  2⤵
  PID:9468
- C:\Windows\System\qwngNua.exe
  C:\Windows\System\qwngNua.exe
  2⤵
  PID:9612
- C:\Windows\System\lDCrojS.exe
  C:\Windows\System\lDCrojS.exe
  2⤵
  PID:9548
- C:\Windows\System\erTPdQU.exe
  C:\Windows\System\erTPdQU.exe
  2⤵
  PID:9564
- C:\Windows\System\UeMzRnt.exe
  C:\Windows\System\UeMzRnt.exe
  2⤵
  PID:9628
- C:\Windows\System\KwoWSUs.exe
  C:\Windows\System\KwoWSUs.exe
  2⤵
  PID:9680
- C:\Windows\System\jZZvoit.exe
  C:\Windows\System\jZZvoit.exe
  2⤵
  PID:9740
- C:\Windows\System\tjmpQjZ.exe
  C:\Windows\System\tjmpQjZ.exe
  2⤵
  PID:9772
- C:\Windows\System\YgPlgcP.exe
  C:\Windows\System\YgPlgcP.exe
  2⤵
  PID:9724
- C:\Windows\System\TWEFkcO.exe
  C:\Windows\System\TWEFkcO.exe
  2⤵
  PID:9728
- C:\Windows\System\obPEibn.exe
  C:\Windows\System\obPEibn.exe
  2⤵
  PID:9840
- C:\Windows\System\PyfiKUL.exe
  C:\Windows\System\PyfiKUL.exe
  2⤵
  PID:9852
- C:\Windows\System\hKYCWze.exe
  C:\Windows\System\hKYCWze.exe
  2⤵
  PID:9936
- C:\Windows\System\pjEJxOa.exe
  C:\Windows\System\pjEJxOa.exe
  2⤵
  PID:10000
- C:\Windows\System\OPpnrop.exe
  C:\Windows\System\OPpnrop.exe
  2⤵
  PID:9856
- C:\Windows\System\GHVDpOi.exe
  C:\Windows\System\GHVDpOi.exe
  2⤵
  PID:10060
- C:\Windows\System\xxkDGaH.exe
  C:\Windows\System\xxkDGaH.exe
  2⤵
  PID:10012
- C:\Windows\System\sznZdMI.exe
  C:\Windows\System\sznZdMI.exe
  2⤵
  PID:10048
- C:\Windows\System\KelrEyn.exe
  C:\Windows\System\KelrEyn.exe
  2⤵
  PID:10124
- C:\Windows\System\UekoSbK.exe
  C:\Windows\System\UekoSbK.exe
  2⤵
  PID:10108
- C:\Windows\System\ZAjxIpF.exe
  C:\Windows\System\ZAjxIpF.exe
  2⤵
  PID:10156
- C:\Windows\System\oaWJHUu.exe
  C:\Windows\System\oaWJHUu.exe
  2⤵
  PID:10224
- C:\Windows\System\JyamfuY.exe
  C:\Windows\System\JyamfuY.exe
  2⤵
  PID:10176
- C:\Windows\System\mEOVGDe.exe
  C:\Windows\System\mEOVGDe.exe
  2⤵
  PID:9228
- C:\Windows\System\RrauMrJ.exe
  C:\Windows\System\RrauMrJ.exe
  2⤵
  PID:9324
- C:\Windows\System\jNmmkPt.exe
  C:\Windows\System\jNmmkPt.exe
  2⤵
  PID:9456
- C:\Windows\System\AGWxQzI.exe
  C:\Windows\System\AGWxQzI.exe
  2⤵
  PID:9440
- C:\Windows\System\txUVWba.exe
  C:\Windows\System\txUVWba.exe
  2⤵
  PID:9600
- C:\Windows\System\FLnzkVh.exe
  C:\Windows\System\FLnzkVh.exe
  2⤵
  PID:9808
- C:\Windows\System\YGyQsmh.exe
  C:\Windows\System\YGyQsmh.exe
  2⤵
  PID:9932
- C:\Windows\System\Zzesopd.exe
  C:\Windows\System\Zzesopd.exe
  2⤵
  PID:9916
- C:\Windows\System\LdsvRsg.exe
  C:\Windows\System\LdsvRsg.exe
  2⤵
  PID:9500
- C:\Windows\System\VpHufSf.exe
  C:\Windows\System\VpHufSf.exe
  2⤵
  PID:9792
- C:\Windows\System\ZbnkJxt.exe
  C:\Windows\System\ZbnkJxt.exe
  2⤵
  PID:9968
- C:\Windows\System\nlMnXtC.exe
  C:\Windows\System\nlMnXtC.exe
  2⤵
  PID:9712
- C:\Windows\System\ySZxWWt.exe
  C:\Windows\System\ySZxWWt.exe
  2⤵
  PID:9276
- C:\Windows\System\ceOVmQT.exe
  C:\Windows\System\ceOVmQT.exe
  2⤵
  PID:9696
- C:\Windows\System\tdccfdF.exe
  C:\Windows\System\tdccfdF.exe
  2⤵
  PID:9872
- C:\Windows\System\YwLeeNn.exe
  C:\Windows\System\YwLeeNn.exe
  2⤵
  PID:9036
- C:\Windows\System\zktAciG.exe
  C:\Windows\System\zktAciG.exe
  2⤵
  PID:9984
- C:\Windows\System\VXPorBl.exe
  C:\Windows\System\VXPorBl.exe
  2⤵
  PID:10044
- C:\Windows\System\BbJYSgz.exe
  C:\Windows\System\BbJYSgz.exe
  2⤵
  PID:9616
- C:\Windows\System\baTZGdB.exe
  C:\Windows\System\baTZGdB.exe
  2⤵
  PID:9836
- C:\Windows\System\aREnVze.exe
  C:\Windows\System\aREnVze.exe
  2⤵
  PID:9452
- C:\Windows\System\aJMarOp.exe
  C:\Windows\System\aJMarOp.exe
  2⤵
  PID:10096
- C:\Windows\System\HRRIWpK.exe
  C:\Windows\System\HRRIWpK.exe
  2⤵
  PID:9520
- C:\Windows\System\jRReuHj.exe
  C:\Windows\System\jRReuHj.exe
  2⤵
  PID:9888
- C:\Windows\System\XyebiCL.exe
  C:\Windows\System\XyebiCL.exe
  2⤵
  PID:9376
- C:\Windows\System\XTSIXTT.exe
  C:\Windows\System\XTSIXTT.exe
  2⤵
  PID:9596
- C:\Windows\System\oZeLBXw.exe
  C:\Windows\System\oZeLBXw.exe
  2⤵
  PID:9744
- C:\Windows\System\nPsfYwi.exe
  C:\Windows\System\nPsfYwi.exe
  2⤵
  PID:9660
- C:\Windows\System\gnDyGQZ.exe
  C:\Windows\System\gnDyGQZ.exe
  2⤵
  PID:10092
- C:\Windows\System\cODdmmB.exe
  C:\Windows\System\cODdmmB.exe
  2⤵
  PID:10252
- C:\Windows\System\mHayeAM.exe
  C:\Windows\System\mHayeAM.exe
  2⤵
  PID:10268
- C:\Windows\System\HvvMtEZ.exe
  C:\Windows\System\HvvMtEZ.exe
  2⤵
  PID:10284
- C:\Windows\System\LExjxGN.exe
  C:\Windows\System\LExjxGN.exe
  2⤵
  PID:10300
- C:\Windows\System\DaDPmdg.exe
  C:\Windows\System\DaDPmdg.exe
  2⤵
  PID:10316
- C:\Windows\System\AvAmHRj.exe
  C:\Windows\System\AvAmHRj.exe
  2⤵
  PID:10332
- C:\Windows\System\yCyPMPs.exe
  C:\Windows\System\yCyPMPs.exe
  2⤵
  PID:10348
- C:\Windows\System\woqUfzp.exe
  C:\Windows\System\woqUfzp.exe
  2⤵
  PID:10364
- C:\Windows\System\YMzCFQu.exe
  C:\Windows\System\YMzCFQu.exe
  2⤵
  PID:10380
- C:\Windows\System\ZxaTqQd.exe
  C:\Windows\System\ZxaTqQd.exe
  2⤵
  PID:10396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\HdCmPaz.exe

Filesize
1.6MB

MD5
2db657e507d5f1fd079e748727c0f18a

SHA1
33885a9f82ea8ee85b0c6ac70fb57ef06899b058

SHA256
8e17cfdb8dc637830483f5f137df61bdce3dac46475f3c6c9ab27bd656d6ef7e

SHA512
0a32222a1829e04003c4624c684833aa5d13a2657045441f16ff6096125d437ad91d0b9a2330ffdcb11174fa70a20b238542882cd16e02a72227a4b6f564a907

Download Submit
C:\Windows\system\IbZNuzb.exe

Filesize
1.7MB

MD5
c369a3cb3a0bba3f07464ca63511843a

SHA1
be8ae58ff083860bc3812937009c6882eaa74f2b

SHA256
0fbeccda4501e3fdef88a086696fd22b10440834d495c2ba6a798a295e19d12b

SHA512
aa1daec7ca90f78a521e163ab1cf64f9ac324fd54415fa7642ea4e344bd0e1d73afbb5cadf053ccc514f311558abad6759a7df8958f0b2f6381447c013c8563d

Download Submit
C:\Windows\system\JALlviX.exe

Filesize
1.7MB

MD5
ddd57cf48ae52cf3e6e87663ec50a537

SHA1
7efa16ae9d7df7a50545ee0cd8ce509d939a73d4

SHA256
b976e95f61b02f6b153c464d319c64a16b91e2442c6ab5de4b8657b9d39ced33

SHA512
a53f1333a536f2dcdd715f6bf2d45fd454875ae5170a70d5aa1903079cfb9eadb4ae0199ce6db6a88edfb3277b23c561a1f9e0cbbab50cb476f28d4b16981d06

Download Submit
C:\Windows\system\MBiOqKz.exe

Filesize
1.7MB

MD5
a0bb002df545508a58d9cc7b69d5dd62

SHA1
2f52fa83a7f6d9e6692e5e7ca2b8424c33983761

SHA256
583c94b4f0f4a2e34f785c8666da322346d48a589df21341b977bad6ee256d8f

SHA512
91e83636f35f5d29b4f5ecc222ccfc5cceadb11c6a6ecb289806a52629f6422d5fe384923bf20819685141bbe0a8ad07a8177c3dc311293fe0cb87e252a484cf

Download Submit
C:\Windows\system\NCRRzZK.exe

Filesize
1.7MB

MD5
6665aad744d784ac7caaabf757027926

SHA1
a9324f3166acac0519137409f67f65d2e7b2c0d4

SHA256
4c8bdf845ff5aa4acfa3ac1a73d439287feb9c08a929176ab5cf6a385f75c710

SHA512
f6512d8adfb38873e85a129e41d8f45a55946872dfb63267b51a6b9b20337d6de0a221fa2f64bc4c70a8e78ad21104e89d5f704a2f7df14a9434c7994130d207

Download Submit
C:\Windows\system\TNIWlZy.exe

Filesize
1.7MB

MD5
5814654501aedc867cfcd345b7970f17

SHA1
785a255e2f1ecf383fddb4ef588fbd17ca25ee0e

SHA256
869df585d916c26da51f261635dca036f9eff270b10dc290e30c4efb1279ceb4

SHA512
3bba9137e5c614d3d61285ec3fa59824d2401ed1be5bd716d38c7dbf26aee22793785ba8ac1110e828ff354d5bc6bc027ac9b093317338639b9b72a02e74fb5e

Download Submit
C:\Windows\system\UKsEQfR.exe

Filesize
1.7MB

MD5
28c4c025aca73d89c0f2f7a990a3d3b4

SHA1
865622487e830eb9651d0c3a9e145d4338b004e4

SHA256
e95a6dd191a750250e77c8262b34c8dc8e5f090a60ff112bcea43a6f514599b2

SHA512
20f5f19c46bca83554b60d0d75fe6f70bac7a1dbb1c248fb93ef000b17b36c437d4e42654ebc179ba40663a605cd0042fb66fcfa2dbdcc2017ac4a30e3f62041

Download Submit
C:\Windows\system\UngaEux.exe

Filesize
1.7MB

MD5
cd208663f5660447a75df0e91c2e183d

SHA1
ae247b04e7fb7a01816f34b90ff2a2e3c3112069

SHA256
3f4dd6fede87fcebf4dd98f435d927d2ac18707ffe567b9211e3611dde8a65c1

SHA512
0343f5f99e58013d42a3150d40eac1f85145ff3d3ede5f49a7f2567f3ca46c01e6994bd0ce2afb27eac813ccdffff18d65983275829a23462ce24590bf0a9fcd

Download Submit
C:\Windows\system\XTwUwSx.exe

Filesize
1.6MB

MD5
263f0e7c4c6563ba13a5b0ce7d368a59

SHA1
80903ae964353062d0cc7431bb51e320e632eb66

SHA256
64ad70b849a52d028da96e78922d7f9c6d50e4ecc624c061e81ba5dff657d64b

SHA512
f32d093d0a4871b44cf88ac4a7996a7f5d6570b26748cbebcf0fbfe675a126a61bc06eb788f2974e6fe489473258c50c04479e005d65222ec45a335614634e27

Download Submit
C:\Windows\system\annFYSh.exe

Filesize
1.7MB

MD5
4b6ee212a2d2fde608af19b1ce263df0

SHA1
4e32f3a56176142a8b3909e23e59206704dfedfd

SHA256
cbb3c9c186746805f535bff1f033bbb35cfb97c5846777adfd71b5d4254a16ba

SHA512
b30b97eefc33e3b726c7ff4199b6322c17647326ab295c49202c5ab25c031c004540a51b83d1dcf0a7d8dbae373e637d88d9a6676afaab1ec0d03e63ffa21089

Download Submit
C:\Windows\system\esDMOGB.exe

Filesize
1.7MB

MD5
b8ef77ca22975a401ce7d5fe3cb14bed

SHA1
5fc27f5f9df84042072c0b848397f93f9f57db22

SHA256
eaae65744f0621e48755d3d39a539eec698f34957fab59e079fea6c567b22a9e

SHA512
497c73bc6a922c61504dd9d154546dc65ca27a938b5bdf78574f6145baf4a470ec661ed03b6803ed86fd18cbfd22e78dad2b8e81a5c85b7fb398f08476bfe027

Download Submit
C:\Windows\system\gNfzhjK.exe

Filesize
1.7MB

MD5
57ed688d29801e5e63e5e2b96cdd5e68

SHA1
d2454c44ce71dc77681f8ead26c5fdb851116a5e

SHA256
e14d5ce8f8976f588cec6c03bcb94acb1d2ce5ab00855fad83c4155b73515600

SHA512
0a27be373b6637f0533e949ae189f3806d1aca63e062ab436a3a6b5c2bf124d6f0ee81f4103be2523ed7f13c8bbc50f651c8de7e585d9c264444bbea06672f8a

Download Submit
C:\Windows\system\hVYQQZO.exe

Filesize
1.7MB

MD5
e7d8ce4af7e74e809870b7cfe97a98bf

SHA1
eb38ab601d5ef5664b501d69f0f3e357049aa7fa

SHA256
e0e038c4ed07bec77812ac4464f8ca1cfe67318b9c807652a3689d76a8650455

SHA512
9d16f879260ff13e5ad337170514259c22bfbbe0470b3592761a29cdc07fec53e85f97a05c06aac000f7ce969e97c0d412f3a4288923220c742c6d9463bed988

Download Submit
C:\Windows\system\rWaYVhJ.exe

Filesize
1.7MB

MD5
22155796bce6a8d107865933547c8bcb

SHA1
e2fbbb2a3099c8b8a6422f3cc0fb28021f153bde

SHA256
1f8480dcbbe24db8cc32df1f299ae2581bf8411fc4cdea05a61ae8f2f78fe753

SHA512
7ab6fefee1854305e33f7f202503de34873dbe80c48ca553d8f8808bbbed3352b33656b2c8417f35669e935014273d062e4c8414f3f722a2234b9d48296265e0

Download Submit
C:\Windows\system\smMLJTO.exe

Filesize
1.7MB

MD5
50b8fc7ae8d3dfa116722ae64f2d87c6

SHA1
7f322f52670992bd60cd64ac4c3bd851510c2310

SHA256
2782e1448488f17b8c32ac38e566a30ebcd36c117d6616c7daab47612f38c198

SHA512
dc9ddff3197b2fae555cbfc30b8bd33831425a1cda3e8934472a7c8a50ed2ebeb6afd2f7362ece8e4a4b31c643c9d8a1879682eecab5883d1855460fe3d11c17

Download Submit
C:\Windows\system\uemNUlP.exe

Filesize
1.7MB

MD5
7bdc2792fc394605cc1508d7b394316e

SHA1
f251a4873b6063ae78c02f018ae930f3b59d9404

SHA256
a996c493b4f9f9860690ddbfafafa062ec1752fe2fb62264645569506c032987

SHA512
4515e66aa6598c6416d65bff8318cb915f8f12a9427b7ecd8a20355db9c2a227e1e94434c4cc936ebdaee7de32340de139b236891cd49d17e94686ab449fda87

Download Submit
C:\Windows\system\vALkRHJ.exe

Filesize
1.7MB

MD5
cd6703f6f12c1acc6d5990c799de611e

SHA1
4855c8bce7096689aa32cf028d2d13808474b2a1

SHA256
8f2f02dc32b883301d875d6bdd86e32168ab4d8412058f3abdeae6ad4d9b847a

SHA512
c7b199c204dc7ac7cd13abf5f8b2369f6764d99b76a3b22e5b6e9c7b076415f5118eee3d1e9f2536695425e1596908b2d29e2719fe37cb2c5082cc50de102e46

Download Submit
C:\Windows\system\wfqPLHb.exe

Filesize
1.6MB

MD5
20b72b280d42014f0e66d67cdd7cd311

SHA1
88194e09c2a1d6caf265c9422d59ece82a180ddd

SHA256
934f8f3132641fe3f49569340d992c4449d5adfba8bca2d9d35f6a60f65500c5

SHA512
eca4a5dac78958ce129e1a3d3cc75ac2d299d1d5599e8e3d0d38b8d5e8228c35e67ebb30e7776c34ae789df8232a6f095043e96958d0ad3cdcccaaeb016e7a93

Download Submit
\Windows\system\CgAvltT.exe

Filesize
1.7MB

MD5
b1079922b05550a97c8f54641ed91574

SHA1
f81dd8dbbedb8ee766601a45526af780bda245f2

SHA256
b61bf3513e8cb620f79ab353d50f315632309b56cb8c5e751a13dee4e3466b1e

SHA512
00f450bf08a12773d912d2110be30a5251ccd349f191a2aeff33b783b9831dc50012b90afac3f35829b155d336b10adde0f97487b1c03e75f7672d93273e096b

Download Submit
\Windows\system\EzsfOLv.exe

Filesize
1.7MB

MD5
0af1ffa82ca97687ceaf484c008cad8b

SHA1
6cf3e6cac66e8c64b146e80eab8e3b6112d8138b

SHA256
9ae7f72c89840116e5712445073936b1322c98612ed6823509dde6b668f25a56

SHA512
046473e5a6380125b1a2f988418d2703b324f1be247f977f085894f0ca6f57b693c389c8a8873bc8d39c44f9a67aab906304e9a89a336985a529a310b45fcc20

Download Submit
\Windows\system\FddCFFE.exe

Filesize
1.7MB

MD5
d6b3c2f4bcacb7e8124e9c10e490bca7

SHA1
4f36d5c34d554763302fefeabb5578d00848bf46

SHA256
58cbf61f4cf9b1a1137ca5a355bc327ae1b715f946aaa0b27e03db1158c896f0

SHA512
937ef65cd7bef845ae92fb1286d05cddbdebca73a67ba4129e2370fe750cbddfb4d70b8fbb49253f3602f11b1c7d478646c37097d9ecb9be3445ec5872616b81

Download Submit
\Windows\system\JuEVNBb.exe

Filesize
1.6MB

MD5
4cf4df4fdfdaa48a773a1b121362f160

SHA1
2d4b7eabbddf36b6a0c59b7aa29de6a02592bf81

SHA256
0d42b72ca956840036ab2eb1f14d9b4725bb3ae5b8846622328ae2870b3a158b

SHA512
facbd1bbc5128d07c2a5f6932aeece565febe14c9d4b208505e5752ccfd83f62edfd7e52a86693c295659a3ea667d52c19721ee68658aef8b0af47f388756d18

Download Submit
\Windows\system\KbCXhhj.exe

Filesize
1.7MB

MD5
2807da765fc71041eb30dcc259af20ad

SHA1
21774944e6c138de803fd5cc2d1d7e23c0785da1

SHA256
249de2e9f1554e4ad232a5fcdcc5fc3b4c0288cbbd253d073be07193291d9fa1

SHA512
84bc6e845456c021d574123426addd705a56d23948ebe0388327a7f1d5b7614ba9c993afca6fe7b7ad0eadf7c7e922bc995f0050a8081d638094debb87851873

Download Submit
\Windows\system\LjBOrUz.exe

Filesize
1.6MB

MD5
b7f52c11db3bb6167ff9fe838237a4ba

SHA1
ed37684734bebcd8b1cc5f9970af657465df0e64

SHA256
6f750f74a3732b9b3a03067e81cc0ebac4b125c334a21b12c5154d2b0d61da95

SHA512
075cabda75485636f6819f3836f60540e2d0742efc902e7c0d4976881308c278de0ec675a60151c5f771a39156bcd34aba7f6a049643aba6c9a7e8df439efa3e

Download Submit
\Windows\system\MqMxicE.exe

Filesize
1.6MB

MD5
03cbb213b6e4eadabf9e5e5c02a76c8a

SHA1
97c29fc8626524dbc7e0567d822a9ef1a5a8907f

SHA256
51e9c179c04e852627bf84fedae298da2aba3e8ea8ffe1f525c9b3cbb7b7822f

SHA512
4a77f0dd32b724eb44367963b17f1b9416c9caa4ef93c23dc9623c5b7bfa4bfd3930e0a8d9e8ecb5674102259482f2b3d2c10b36d4452ad746cfe5e68afb3d08

Download Submit
\Windows\system\NPHrBYS.exe

Filesize
1.6MB

MD5
bf2eb4fbad0df27474ee2bae8f019f48

SHA1
0a91532e1946b45b19f7d900a8baf9cf58a5781e

SHA256
c95e8f7aaf7f52b9e52a7b90027edd197cbbea6f8b0b6700aa904e6190fc71d6

SHA512
f8c3c6082d9bc95f106cc5467f20b9a6dcfdef16628691a4e2c6efb32b6d71429a27c76e8efa5e15ed15f8966c9fee21f6340f315c744b64b3a5fd5ca14b705d

Download Submit
\Windows\system\NcDSGCH.exe

Filesize
1.7MB

MD5
779daa5c29bd5a5425dc5e2f708a3534

SHA1
61ecd655b1863b109d0f7bb4fbdab2d40c654432

SHA256
5a5272dca58b712a5158b0345a9674e9375e47478cf14a0d29ddf6abb08e7db5

SHA512
6e64de8582cc852f51edcbb87aa6cbaff11d64bbf8ee24394dd3d351829321be9b12aee41b0343fce1638cf8ccac551a225596b7fe1dc70080a8e9a512f77240

Download Submit
\Windows\system\SfZFMVq.exe

Filesize
1.6MB

MD5
2d4fdc13de1af3031a5d75e214f8a715

SHA1
0cc8da388c6b42cf5c1fa53c70f99fe8868fcb7f

SHA256
62b01fa758e6359d0557d04cfb227027d7a849a5c9e65b65846a62364ea6d758

SHA512
bc4d4f1ba312cc70800d3c8796aacc632205505f22a62e847538f58cf3bd208cdb525387d284232b0b89a5c411bf48e7b327731cdf16bced26c9c9f1e217a1fc

Download Submit
\Windows\system\TFtDpyB.exe

Filesize
1.7MB

MD5
206f60f135e04af965758dc7c8af5328

SHA1
ca12c0b2b8905dfa663978e2c59a077f6d8fc0b0

SHA256
561ef639e8181574ed61194470442f814d177081d27970b1090166abf92330fc

SHA512
34da5314730a3a53750c80f3b339fb4fa9f3bbddb2731248a0a7f6a9fbd8771e76fd0ea50d464a6240d96888ef64e4d874bef8b35d2f0f297c47be45ab7e90be

Download Submit
\Windows\system\adPjRfU.exe

Filesize
1.7MB

MD5
54d661d6290b21c7aff3deed4ada89df

SHA1
62ddc053f33c63c612ef8b71108e21a425ab81f8

SHA256
139785dd8c41d4fb39c094348b2f0f1e8750c4252bb921f4ca4a0878ab1d7181

SHA512
f496bffb32299c09bc7aec90c6e032491e5e5092723017bfbf1778f4f91782b8277379a1981a30892b0c42cf996f497d3d7513bcd3881e6c57a93cc897435f20

Download Submit
\Windows\system\dNhbYmB.exe

Filesize
1.7MB

MD5
deb013ecbddf4e589294e63ec60d4ec4

SHA1
bc9fbdcaae87e0a52fd63e9f34ca60d78baffb9a

SHA256
8d410139a16571626d3e9d4994784531a8ea97f9b1396b242e74fd618771c3e4

SHA512
468d507a2a25941fb96982f2aaee79c14173b37e2053c08fa7a9bfc3b7ebe7a93ea29c635f4aca95c676a7600bdfc3a86e7068625a622ad1cbf8531e1fc3a103

Download Submit
\Windows\system\gwOoObX.exe

Filesize
1.7MB

MD5
6fe15b6ea4cbc56730ab4c8c3306ec69

SHA1
76e630351532fd6c2d95c57f5975ab3cd70a4a5c

SHA256
7f2443bf69476fc2188c4ea7d0db3f477722d6073ba5c2130031b28f38d31730

SHA512
59b2e4de5023738d1f5d91c07d28e77821a6279f0705c0227fc41797c02bef270e113c8e9ff5b22994d1259426f917e7944812d24bcd81b2e725b0f916b72366

Download Submit
\Windows\system\hPAtRFi.exe

Filesize
1.6MB

MD5
dcdc2dfca9d499751ee1c169a63682ad

SHA1
8ca7a8f47e553cf2158366848579f5d7ebe8e5ac

SHA256
759f465f74d0c391a935b514da3c3b6c616d5a5e276cd0ccb08c509c4163b3ea

SHA512
5fadaa7d875ce00fba4cc928e0d4fe9fd03cbcc745c4c2dac3b0e7cb8a93875c9650be79b6a44bcf54340dd689bd13075d85c322d609d871488bd0d5bfe4400c

Download Submit
\Windows\system\oeiZZtT.exe

Filesize
1.6MB

MD5
f87c0933d5713e30c64c80d10ee4b279

SHA1
e91e3a4a2f88fe48ca70a34339a78285c5f535c7

SHA256
557c023f1bf6322e5e90f9bd8cc3c4645135542fd2e1bd3ea0201fae28c4b6c4

SHA512
d15248e265291729a198bf06a274bc0633fa046299f9c7282cce19cfe5735abc6de11deb4a1109b1b081b8ba7c3969f7d7e8886428a0f3a4f4160710505f7f2d

Download Submit
\Windows\system\ouiGfrc.exe

Filesize
1.7MB

MD5
0264b94ea146162cc3d298afabd71137

SHA1
c2e2abccbd4c8f195c31274a5e66785a38e80f4b

SHA256
bb0c0505eb14ec93755c948671b19987411cb3df508a2bd94c9626c648b019a6

SHA512
f82da1664560798479f1de38b62b3d81db610bf8636fb778d0ff260a5ef68104aba653f6e3c8b712fe6eddc26d868932c43eb94cfdc6b056922c5139c49a6b1c

Download Submit
\Windows\system\tBmbZMF.exe

Filesize
1.7MB

MD5
9e0a79afabdd89464bb1793b3eef3612

SHA1
94ba06529f8e017fb938a106f61a62175070fa8d

SHA256
5dc99cafcac4ab28860f753d6b49cbd8bcf36132d3d428be7fa1e068017be583

SHA512
7f08be4df5859e5e2a889b921669b9e6cbf828d38a18c36cb69059a1e2eda7f3fb8c3c7495573b81669aa17ec9a9ce22bf863edda0c8e07ffec18f657b9e0cb2

Download Submit
\Windows\system\ugMRaHs.exe

Filesize
1.7MB

MD5
56d9699762e723d8095ba81ee7634793

SHA1
d466d673a5846886fbe174dcb345d29724622e26

SHA256
3502e68a9db81ac39c97c24e5ad4b51fa1e522d0f58bdeb3cf706ba9d14b045e

SHA512
fa49c35691c21ffd27f0a6545e3ca91d6372fba0f3ff2adc4627e455e9313a44616863eba136a374f4d0e0604fd51d97d6add8f662f36b1eb493dd5a39c3697e

Download Submit
\Windows\system\yMqKbco.exe

Filesize
1.7MB

MD5
0d70ff2feb7bf81b1048f3fa3da9ade9

SHA1
48a3dd9d1ac0f0f0bdc0f21c2227fb177132c5f9

SHA256
701bb39c81fdbcc9a3ae622f9a6a1f4eb4e22bd88c26b36fba8ec8000bd203f7

SHA512
170d48bfed1dcc238af2c75e3f5f7581bf7549e8ac9c7c3a8c96d12816e43d18b6b59d48c73a3069d90f40bb489bce15f759979ca1b6d820b62f146256ad71f8

Download Submit
\Windows\system\ygUpqmC.exe

Filesize
1.7MB

MD5
d0170e32b5db281a785277833374cd81

SHA1
306de8e7b6cd2532a41f468569f1b901515a14a0

SHA256
c2a0cde9e1c6c0f0a9cf2503fd854555f9c78088c6a04789f1302b297e9e0da2

SHA512
770d7203503087bd93cdd3101aec10813fa8801dfdeb36bdf0bac95802fd97cf1dd264d6ac64f8abb5e68a170d9559539e10eac919a6e09f44739cb0219d211b

Download Submit
\Windows\system\zybsdRT.exe

Filesize
1.7MB

MD5
bbe0942734727a6e13b42f6a0c5e0fe7

SHA1
a67da01980e087e60a103509194a5d89d4338c61

SHA256
aa2571439aea227182a9286852368e160f1e849a4df19be5edc6a7b7571a08a2

SHA512
90190b4426f74e9e00b723e0d56df81bc38c6554e70912bf275cffc1f5b8e999545a8f56f6faa87ed358236d79fb922a4bf4acfc7e50fa2bd5f5e210e8aed1a9

Download Submit
memory/616-38-0x0000000001EB0000-0x0000000001EB8000-memory.dmp

Filesize
32KB

Download
memory/616-40-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/616-17-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/616-34-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/616-89-0x0000000002C80000-0x0000000002D00000-memory.dmp

Filesize
512KB

Download
memory/616-348-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/616-33-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/616-28-0x000007FEF5620000-0x000007FEF5FBD000-memory.dmp

Filesize
9.6MB

Download
memory/2120-16-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2120-68-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-51-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2372-19-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2372-1-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-67-0x000000013F5C0000-0x000000013F9B2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-94-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2372-60-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2372-62-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2372-49-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2372-35-0x0000000003610000-0x0000000003A02000-memory.dmp

Filesize
3.9MB

Download
memory/2372-37-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2372-11-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2420-64-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2480-65-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2540-39-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2580-50-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2684-531-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2684-20-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2908-75-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/3004-36-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download