xmrig | f526952d2d4465a9b6cfd57e20bd12d58b66b5be429ecd92205681c6a7f5b667

Analysis

max time kernel
27s
max time network
31s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
Size

2.2MB
MD5

09e42af8005096cbcb6b4c26bc104f10
SHA1

a6d0fc0e782314a47988d5c30161b040e995d29a
SHA256

f526952d2d4465a9b6cfd57e20bd12d58b66b5be429ecd92205681c6a7f5b667
SHA512

dfe29d8e9d1618025f111251a8afad068c5d5c628500b739f99d36e413f40ed0747f86b7fddec83da0d929ae86abf4257e85c444022e917dec83054bb9af6e93
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqu:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-53-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2264-79-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2304-88-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2036-352-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2612-89-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2264-84-0x000000013FD20000-0x0000000140112000-memory.dmp	xmrig
behavioral1/memory/2784-52-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2632-23-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2036-12-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2180-15-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2036	InBHMed.exe
2180	fSmHPyN.exe
2632	KIAKplM.exe
2784	CmjLrEl.exe
2652	NZHAABg.exe
2740	GoEWgaz.exe
2500	KWUVdlL.exe
2536	LvfMJon.exe
2612	qQeuepa.exe
2304	SHHAwPT.exe
2856	mHNoGpu.exe
3052	gBZcBxH.exe
1628	oTXZRcl.exe
2812	qTghexN.exe
2724	wPVJzdx.exe
2832	atpFrkr.exe
2880	CAsEoNT.exe
1948	riuTWos.exe
2668	RSBIbMf.exe
1372	JsnreHF.exe
864	kzDSvGX.exe
2124	zUuHiBq.exe
948	UfpUVCU.exe
2056	CcMuzqF.exe
2052	wPSCNpe.exe
1992	dUPMvVG.exe
2164	xBUjnBL.exe
2372	yjFAHho.exe
2988	jLosiBr.exe
832	zDVmdkd.exe
1048	RgsmgXS.exe
1452	jNfjJeL.exe
1092	LExRSoF.exe
2680	pfAePvY.exe
2408	XjTvyQr.exe
976	kQNkmiE.exe
1128	kgYuxZM.exe
2404	pMEbSpB.exe
2320	dHbzGjC.exe
2184	iOgIOfE.exe
1520	ehxrjIH.exe
1648	MDBTIYJ.exe
2460	YlddYJH.exe
1708	dHNjIKT.exe
2672	cDQkbPk.exe
2928	yFcrYRx.exe
2644	haRNvHj.exe
2836	qTkxzcR.exe
2156	btagVTQ.exe
1244	tFFMKur.exe
2868	LgQxOjr.exe
1096	WyQysQg.exe
636	oYNbYId.exe
2064	pqZsYOA.exe
1228	XonHHpY.exe
2144	buntEYD.exe
2020	wmEDbxI.exe
1888	wGCXuGj.exe
3084	xeyeQyC.exe
3116	jVVzAZY.exe
3148	NJLpXEE.exe
3180	eaxPVbf.exe
3212	gQYPjjI.exe
3244	tKWjVOq.exe

Loads dropped DLL 64 IoCs

pid	Process
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2264-0-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x000b000000012303-6.dat	upx
behavioral1/files/0x000900000001264d-16.dat	upx
behavioral1/files/0x000800000001269d-31.dat	upx
behavioral1/files/0x000c0000000126e1-43.dat	upx
behavioral1/memory/2652-49-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx
behavioral1/memory/2740-53-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2536-70-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2264-79-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2304-88-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x00070000000133b9-101.dat	upx
behavioral1/files/0x0008000000013172-75.dat	upx
behavioral1/files/0x00070000000139e0-130.dat	upx
behavioral1/files/0x0007000000013a71-147.dat	upx
behavioral1/files/0x00060000000143ec-191.dat	upx
behavioral1/memory/2036-352-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x00060000000142b0-180.dat	upx
behavioral1/files/0x00060000000141c0-178.dat	upx
behavioral1/files/0x0006000000014316-174.dat	upx
behavioral1/files/0x0006000000014390-184.dat	upx
behavioral1/files/0x0006000000014120-144.dat	upx
behavioral1/files/0x0007000000013a21-139.dat	upx
behavioral1/files/0x00060000000142c4-170.dat	upx
behavioral1/files/0x00060000000141e6-157.dat	upx
behavioral1/files/0x00070000000139b4-113.dat	upx
behavioral1/files/0x00060000000141a2-150.dat	upx
behavioral1/files/0x0007000000013a11-134.dat	upx
behavioral1/files/0x00070000000133b0-108.dat	upx
behavioral1/files/0x000700000001342b-103.dat	upx
behavioral1/files/0x000800000001329e-98.dat	upx
behavioral1/files/0x00070000000139d8-119.dat	upx
behavioral1/files/0x0008000000013113-64.dat	upx
behavioral1/files/0x0007000000013928-112.dat	upx
behavioral1/files/0x000b000000012713-59.dat	upx
behavioral1/memory/2856-91-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2612-89-0x000000013FD20000-0x0000000140112000-memory.dmp	upx
behavioral1/files/0x00070000000133a8-77.dat	upx
behavioral1/files/0x0009000000012d51-72.dat	upx
behavioral1/memory/2500-55-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x000f000000005578-34.dat	upx
behavioral1/memory/2784-52-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x0008000000012678-45.dat	upx
behavioral1/memory/2632-23-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2036-12-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2180-15-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/files/0x000c0000000122e4-13.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\eXpLcBo.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\xbZmxqQ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\BIniCOk.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\infRyQH.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\HnjZnQG.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\WmyHwVQ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\mGOrdXp.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\WdNtDnJ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\HjaTiCD.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\ZqdReck.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\NAVdgqm.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\UVbpygw.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\RguqWyd.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\YAyWgEZ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\dCIjgkA.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\nhnJXby.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\isQUMlP.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\uPCxzZR.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\nRSoEMd.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\TxwrjHb.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\YaqmUZP.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\DwVGnea.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\MRQuvLm.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\xnoMqVn.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\yFcrYRx.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\PfLqPyT.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\EINUMeS.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\ASmTsWf.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\GEuhAWY.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\lDqbJtK.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\riStmUU.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\QPpzvzU.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\QxPESmd.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\QPrXooF.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\LYdYuTf.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\LXJcgaU.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\EimtXdY.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\ZiFBcxt.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\drLhAjm.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\YQfhwYc.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\uRCYDAD.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\AsVmESG.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\HspOPok.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\SUbHNks.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\EiLACzi.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\xcDLxfH.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\zgwSQIt.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\TXFgGwZ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\bTlxANV.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\vBRhbkk.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\DKSMRlg.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\EYJeEMU.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\JkxlQMt.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\ISCuaHb.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\gdiHWzc.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\eLtBTum.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\BDjLNvq.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\OftWLlJ.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\xeyeQyC.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\mtEJbPM.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\vKUvGLf.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\fGWkHBL.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\iMYEhwm.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
File created	C:\Windows\System\RfeIpyH.exe	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2172	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
Token: SeDebugPrivilege	2172	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2172	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2172	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2172	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	29
PID 2264 wrote to memory of 2180	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2180	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2180	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	30
PID 2264 wrote to memory of 2036	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	31
PID 2264 wrote to memory of 2036	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	31
PID 2264 wrote to memory of 2036	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	31
PID 2264 wrote to memory of 2632	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2632	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2632	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	32
PID 2264 wrote to memory of 2740	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2740	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2740	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	33
PID 2264 wrote to memory of 2784	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2784	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2784	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	34
PID 2264 wrote to memory of 2500	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2500	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2500	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	35
PID 2264 wrote to memory of 2652	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2652	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2652	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	36
PID 2264 wrote to memory of 2536	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2536	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2536	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	37
PID 2264 wrote to memory of 2612	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	38
PID 2264 wrote to memory of 2612	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	38
PID 2264 wrote to memory of 2612	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	38
PID 2264 wrote to memory of 3052	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	39
PID 2264 wrote to memory of 3052	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	39
PID 2264 wrote to memory of 3052	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	39
PID 2264 wrote to memory of 2304	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	40
PID 2264 wrote to memory of 2304	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	40
PID 2264 wrote to memory of 2304	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	40
PID 2264 wrote to memory of 1628	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	41
PID 2264 wrote to memory of 1628	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	41
PID 2264 wrote to memory of 1628	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	41
PID 2264 wrote to memory of 2856	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	42
PID 2264 wrote to memory of 2856	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	42
PID 2264 wrote to memory of 2856	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	42
PID 2264 wrote to memory of 2724	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2724	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2724	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	43
PID 2264 wrote to memory of 2812	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2812	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	44
PID 2264 wrote to memory of 2812	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	44
PID 2264 wrote to memory of 1948	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	45
PID 2264 wrote to memory of 1948	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	45
PID 2264 wrote to memory of 1948	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	45
PID 2264 wrote to memory of 2832	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	46
PID 2264 wrote to memory of 2832	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	46
PID 2264 wrote to memory of 2832	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	46
PID 2264 wrote to memory of 2668	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	47
PID 2264 wrote to memory of 2668	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	47
PID 2264 wrote to memory of 2668	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	47
PID 2264 wrote to memory of 2880	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	48
PID 2264 wrote to memory of 2880	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	48
PID 2264 wrote to memory of 2880	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	48
PID 2264 wrote to memory of 1372	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	49
PID 2264 wrote to memory of 1372	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	49
PID 2264 wrote to memory of 1372	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	49
PID 2264 wrote to memory of 864	2264	09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09e42af8005096cbcb6b4c26bc104f10_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System\fSmHPyN.exe
  C:\Windows\System\fSmHPyN.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\InBHMed.exe
  C:\Windows\System\InBHMed.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\KIAKplM.exe
  C:\Windows\System\KIAKplM.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\GoEWgaz.exe
  C:\Windows\System\GoEWgaz.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\CmjLrEl.exe
  C:\Windows\System\CmjLrEl.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\KWUVdlL.exe
  C:\Windows\System\KWUVdlL.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\NZHAABg.exe
  C:\Windows\System\NZHAABg.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\LvfMJon.exe
  C:\Windows\System\LvfMJon.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\qQeuepa.exe
  C:\Windows\System\qQeuepa.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\gBZcBxH.exe
  C:\Windows\System\gBZcBxH.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\SHHAwPT.exe
  C:\Windows\System\SHHAwPT.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\oTXZRcl.exe
  C:\Windows\System\oTXZRcl.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\mHNoGpu.exe
  C:\Windows\System\mHNoGpu.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\wPVJzdx.exe
  C:\Windows\System\wPVJzdx.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\qTghexN.exe
  C:\Windows\System\qTghexN.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\riuTWos.exe
  C:\Windows\System\riuTWos.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\atpFrkr.exe
  C:\Windows\System\atpFrkr.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\RSBIbMf.exe
  C:\Windows\System\RSBIbMf.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\CAsEoNT.exe
  C:\Windows\System\CAsEoNT.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\JsnreHF.exe
  C:\Windows\System\JsnreHF.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\kzDSvGX.exe
  C:\Windows\System\kzDSvGX.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\zUuHiBq.exe
  C:\Windows\System\zUuHiBq.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\UfpUVCU.exe
  C:\Windows\System\UfpUVCU.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\xBUjnBL.exe
  C:\Windows\System\xBUjnBL.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\CcMuzqF.exe
  C:\Windows\System\CcMuzqF.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\yjFAHho.exe
  C:\Windows\System\yjFAHho.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\wPSCNpe.exe
  C:\Windows\System\wPSCNpe.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\jLosiBr.exe
  C:\Windows\System\jLosiBr.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\dUPMvVG.exe
  C:\Windows\System\dUPMvVG.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\RgsmgXS.exe
  C:\Windows\System\RgsmgXS.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\zDVmdkd.exe
  C:\Windows\System\zDVmdkd.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\jNfjJeL.exe
  C:\Windows\System\jNfjJeL.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\LExRSoF.exe
  C:\Windows\System\LExRSoF.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\HmNagVs.exe
  C:\Windows\System\HmNagVs.exe
  2⤵
  PID:644
- C:\Windows\System\pfAePvY.exe
  C:\Windows\System\pfAePvY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\HibAzwK.exe
  C:\Windows\System\HibAzwK.exe
  2⤵
  PID:1744
- C:\Windows\System\XjTvyQr.exe
  C:\Windows\System\XjTvyQr.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ILcnOWA.exe
  C:\Windows\System\ILcnOWA.exe
  2⤵
  PID:1752
- C:\Windows\System\kQNkmiE.exe
  C:\Windows\System\kQNkmiE.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\ZiFBcxt.exe
  C:\Windows\System\ZiFBcxt.exe
  2⤵
  PID:1700
- C:\Windows\System\kgYuxZM.exe
  C:\Windows\System\kgYuxZM.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\WmyHwVQ.exe
  C:\Windows\System\WmyHwVQ.exe
  2⤵
  PID:2992
- C:\Windows\System\pMEbSpB.exe
  C:\Windows\System\pMEbSpB.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\JtaJRux.exe
  C:\Windows\System\JtaJRux.exe
  2⤵
  PID:2432
- C:\Windows\System\dHbzGjC.exe
  C:\Windows\System\dHbzGjC.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\WIhkEfl.exe
  C:\Windows\System\WIhkEfl.exe
  2⤵
  PID:2352
- C:\Windows\System\iOgIOfE.exe
  C:\Windows\System\iOgIOfE.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\vzXBKJw.exe
  C:\Windows\System\vzXBKJw.exe
  2⤵
  PID:2436
- C:\Windows\System\ehxrjIH.exe
  C:\Windows\System\ehxrjIH.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\SsEqwnX.exe
  C:\Windows\System\SsEqwnX.exe
  2⤵
  PID:3004
- C:\Windows\System\MDBTIYJ.exe
  C:\Windows\System\MDBTIYJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\iNktgIl.exe
  C:\Windows\System\iNktgIl.exe
  2⤵
  PID:2464
- C:\Windows\System\YlddYJH.exe
  C:\Windows\System\YlddYJH.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\NlWdpRv.exe
  C:\Windows\System\NlWdpRv.exe
  2⤵
  PID:1600
- C:\Windows\System\dHNjIKT.exe
  C:\Windows\System\dHNjIKT.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\tzXCWJF.exe
  C:\Windows\System\tzXCWJF.exe
  2⤵
  PID:2760
- C:\Windows\System\cDQkbPk.exe
  C:\Windows\System\cDQkbPk.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\CVzjKUK.exe
  C:\Windows\System\CVzjKUK.exe
  2⤵
  PID:2752
- C:\Windows\System\yFcrYRx.exe
  C:\Windows\System\yFcrYRx.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\kJnuQMv.exe
  C:\Windows\System\kJnuQMv.exe
  2⤵
  PID:2584
- C:\Windows\System\haRNvHj.exe
  C:\Windows\System\haRNvHj.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\SrgByNp.exe
  C:\Windows\System\SrgByNp.exe
  2⤵
  PID:1792
- C:\Windows\System\qTkxzcR.exe
  C:\Windows\System\qTkxzcR.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\jXiibql.exe
  C:\Windows\System\jXiibql.exe
  2⤵
  PID:1480
- C:\Windows\System\btagVTQ.exe
  C:\Windows\System\btagVTQ.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\SHysBld.exe
  C:\Windows\System\SHysBld.exe
  2⤵
  PID:2492
- C:\Windows\System\tFFMKur.exe
  C:\Windows\System\tFFMKur.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\kUkOqnm.exe
  C:\Windows\System\kUkOqnm.exe
  2⤵
  PID:3040
- C:\Windows\System\LgQxOjr.exe
  C:\Windows\System\LgQxOjr.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\fGWkHBL.exe
  C:\Windows\System\fGWkHBL.exe
  2⤵
  PID:2800
- C:\Windows\System\WyQysQg.exe
  C:\Windows\System\WyQysQg.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\yRgVLsO.exe
  C:\Windows\System\yRgVLsO.exe
  2⤵
  PID:2932
- C:\Windows\System\oYNbYId.exe
  C:\Windows\System\oYNbYId.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\qbGZZOw.exe
  C:\Windows\System\qbGZZOw.exe
  2⤵
  PID:1136
- C:\Windows\System\pqZsYOA.exe
  C:\Windows\System\pqZsYOA.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\RfFMYKy.exe
  C:\Windows\System\RfFMYKy.exe
  2⤵
  PID:1068
- C:\Windows\System\XonHHpY.exe
  C:\Windows\System\XonHHpY.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\RKFovBM.exe
  C:\Windows\System\RKFovBM.exe
  2⤵
  PID:2060
- C:\Windows\System\buntEYD.exe
  C:\Windows\System\buntEYD.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\trjVkvf.exe
  C:\Windows\System\trjVkvf.exe
  2⤵
  PID:2148
- C:\Windows\System\wmEDbxI.exe
  C:\Windows\System\wmEDbxI.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\iCokntz.exe
  C:\Windows\System\iCokntz.exe
  2⤵
  PID:1572
- C:\Windows\System\wGCXuGj.exe
  C:\Windows\System\wGCXuGj.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\aPgWAxY.exe
  C:\Windows\System\aPgWAxY.exe
  2⤵
  PID:2616
- C:\Windows\System\xeyeQyC.exe
  C:\Windows\System\xeyeQyC.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\qQCYKNx.exe
  C:\Windows\System\qQCYKNx.exe
  2⤵
  PID:3100
- C:\Windows\System\jVVzAZY.exe
  C:\Windows\System\jVVzAZY.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\Cergueh.exe
  C:\Windows\System\Cergueh.exe
  2⤵
  PID:3132
- C:\Windows\System\NJLpXEE.exe
  C:\Windows\System\NJLpXEE.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\WcylSJm.exe
  C:\Windows\System\WcylSJm.exe
  2⤵
  PID:3164
- C:\Windows\System\eaxPVbf.exe
  C:\Windows\System\eaxPVbf.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\iIwZEOv.exe
  C:\Windows\System\iIwZEOv.exe
  2⤵
  PID:3196
- C:\Windows\System\gQYPjjI.exe
  C:\Windows\System\gQYPjjI.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\tAobwUu.exe
  C:\Windows\System\tAobwUu.exe
  2⤵
  PID:3228
- C:\Windows\System\tKWjVOq.exe
  C:\Windows\System\tKWjVOq.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\yTSLVKk.exe
  C:\Windows\System\yTSLVKk.exe
  2⤵
  PID:3260
- C:\Windows\System\bqAyqRE.exe
  C:\Windows\System\bqAyqRE.exe
  2⤵
  PID:3276
- C:\Windows\System\mnVQYtR.exe
  C:\Windows\System\mnVQYtR.exe
  2⤵
  PID:3292
- C:\Windows\System\FloMPZI.exe
  C:\Windows\System\FloMPZI.exe
  2⤵
  PID:3308
- C:\Windows\System\WOKEqxF.exe
  C:\Windows\System\WOKEqxF.exe
  2⤵
  PID:3324
- C:\Windows\System\HjaTiCD.exe
  C:\Windows\System\HjaTiCD.exe
  2⤵
  PID:3340
- C:\Windows\System\SGImRuE.exe
  C:\Windows\System\SGImRuE.exe
  2⤵
  PID:3356
- C:\Windows\System\EiLACzi.exe
  C:\Windows\System\EiLACzi.exe
  2⤵
  PID:3372
- C:\Windows\System\OwmaQVc.exe
  C:\Windows\System\OwmaQVc.exe
  2⤵
  PID:3388
- C:\Windows\System\MklxKaR.exe
  C:\Windows\System\MklxKaR.exe
  2⤵
  PID:3404
- C:\Windows\System\bitqnBE.exe
  C:\Windows\System\bitqnBE.exe
  2⤵
  PID:3420
- C:\Windows\System\gckHfPl.exe
  C:\Windows\System\gckHfPl.exe
  2⤵
  PID:3436
- C:\Windows\System\NiQKYCQ.exe
  C:\Windows\System\NiQKYCQ.exe
  2⤵
  PID:3452
- C:\Windows\System\nkkWuQl.exe
  C:\Windows\System\nkkWuQl.exe
  2⤵
  PID:3468
- C:\Windows\System\qUnBQiq.exe
  C:\Windows\System\qUnBQiq.exe
  2⤵
  PID:3484
- C:\Windows\System\fTJsROq.exe
  C:\Windows\System\fTJsROq.exe
  2⤵
  PID:3500
- C:\Windows\System\hBtitLh.exe
  C:\Windows\System\hBtitLh.exe
  2⤵
  PID:3520
- C:\Windows\System\IkeNVRd.exe
  C:\Windows\System\IkeNVRd.exe
  2⤵
  PID:3536
- C:\Windows\System\ovcnKFn.exe
  C:\Windows\System\ovcnKFn.exe
  2⤵
  PID:3552
- C:\Windows\System\vGXbrOK.exe
  C:\Windows\System\vGXbrOK.exe
  2⤵
  PID:3568
- C:\Windows\System\EvfHvCc.exe
  C:\Windows\System\EvfHvCc.exe
  2⤵
  PID:3584
- C:\Windows\System\YjWWBQV.exe
  C:\Windows\System\YjWWBQV.exe
  2⤵
  PID:3600
- C:\Windows\System\MhttOFq.exe
  C:\Windows\System\MhttOFq.exe
  2⤵
  PID:3616
- C:\Windows\System\PjuYSgB.exe
  C:\Windows\System\PjuYSgB.exe
  2⤵
  PID:3632
- C:\Windows\System\XLeDIHo.exe
  C:\Windows\System\XLeDIHo.exe
  2⤵
  PID:3648
- C:\Windows\System\mtEJbPM.exe
  C:\Windows\System\mtEJbPM.exe
  2⤵
  PID:3664
- C:\Windows\System\echTVTy.exe
  C:\Windows\System\echTVTy.exe
  2⤵
  PID:3680
- C:\Windows\System\ISJWcCd.exe
  C:\Windows\System\ISJWcCd.exe
  2⤵
  PID:3696
- C:\Windows\System\iMYEhwm.exe
  C:\Windows\System\iMYEhwm.exe
  2⤵
  PID:3712
- C:\Windows\System\NnmUhNV.exe
  C:\Windows\System\NnmUhNV.exe
  2⤵
  PID:3728
- C:\Windows\System\EZRoVQr.exe
  C:\Windows\System\EZRoVQr.exe
  2⤵
  PID:3744
- C:\Windows\System\kRYpImm.exe
  C:\Windows\System\kRYpImm.exe
  2⤵
  PID:3760
- C:\Windows\System\VwSevdF.exe
  C:\Windows\System\VwSevdF.exe
  2⤵
  PID:3776
- C:\Windows\System\UXLoWpm.exe
  C:\Windows\System\UXLoWpm.exe
  2⤵
  PID:3792
- C:\Windows\System\zouKvuD.exe
  C:\Windows\System\zouKvuD.exe
  2⤵
  PID:3808
- C:\Windows\System\xPCDIJA.exe
  C:\Windows\System\xPCDIJA.exe
  2⤵
  PID:3824
- C:\Windows\System\vPNZrkd.exe
  C:\Windows\System\vPNZrkd.exe
  2⤵
  PID:3840
- C:\Windows\System\WeVHCBR.exe
  C:\Windows\System\WeVHCBR.exe
  2⤵
  PID:3856
- C:\Windows\System\NtIzoqP.exe
  C:\Windows\System\NtIzoqP.exe
  2⤵
  PID:3872
- C:\Windows\System\ExTIzsw.exe
  C:\Windows\System\ExTIzsw.exe
  2⤵
  PID:3888
- C:\Windows\System\czIkpxj.exe
  C:\Windows\System\czIkpxj.exe
  2⤵
  PID:3904
- C:\Windows\System\WlbIBuI.exe
  C:\Windows\System\WlbIBuI.exe
  2⤵
  PID:3920
- C:\Windows\System\SkeztmP.exe
  C:\Windows\System\SkeztmP.exe
  2⤵
  PID:3936
- C:\Windows\System\XUcStzr.exe
  C:\Windows\System\XUcStzr.exe
  2⤵
  PID:3952
- C:\Windows\System\HBEPKHO.exe
  C:\Windows\System\HBEPKHO.exe
  2⤵
  PID:3968
- C:\Windows\System\XiwHZUg.exe
  C:\Windows\System\XiwHZUg.exe
  2⤵
  PID:3984
- C:\Windows\System\PfLqPyT.exe
  C:\Windows\System\PfLqPyT.exe
  2⤵
  PID:4000
- C:\Windows\System\EazFYjd.exe
  C:\Windows\System\EazFYjd.exe
  2⤵
  PID:4016
- C:\Windows\System\aDzRIBP.exe
  C:\Windows\System\aDzRIBP.exe
  2⤵
  PID:4032
- C:\Windows\System\WsXJNtp.exe
  C:\Windows\System\WsXJNtp.exe
  2⤵
  PID:4048
- C:\Windows\System\UFDODoU.exe
  C:\Windows\System\UFDODoU.exe
  2⤵
  PID:4064
- C:\Windows\System\VFzXUNm.exe
  C:\Windows\System\VFzXUNm.exe
  2⤵
  PID:4080
- C:\Windows\System\wxebxrg.exe
  C:\Windows\System\wxebxrg.exe
  2⤵
  PID:2560
- C:\Windows\System\VCteYjg.exe
  C:\Windows\System\VCteYjg.exe
  2⤵
  PID:1768
- C:\Windows\System\hjXrRYc.exe
  C:\Windows\System\hjXrRYc.exe
  2⤵
  PID:1712
- C:\Windows\System\XJPWKlQ.exe
  C:\Windows\System\XJPWKlQ.exe
  2⤵
  PID:2936
- C:\Windows\System\FTfdWVB.exe
  C:\Windows\System\FTfdWVB.exe
  2⤵
  PID:1116
- C:\Windows\System\qAEPWHW.exe
  C:\Windows\System\qAEPWHW.exe
  2⤵
  PID:1836
- C:\Windows\System\mGOrdXp.exe
  C:\Windows\System\mGOrdXp.exe
  2⤵
  PID:3096
- C:\Windows\System\DMbJNeG.exe
  C:\Windows\System\DMbJNeG.exe
  2⤵
  PID:3160
- C:\Windows\System\yQrRUEb.exe
  C:\Windows\System\yQrRUEb.exe
  2⤵
  PID:3224
- C:\Windows\System\txkCnmH.exe
  C:\Windows\System\txkCnmH.exe
  2⤵
  PID:3288
- C:\Windows\System\lzNXqAc.exe
  C:\Windows\System\lzNXqAc.exe
  2⤵
  PID:3352
- C:\Windows\System\TgJbzfD.exe
  C:\Windows\System\TgJbzfD.exe
  2⤵
  PID:3416
- C:\Windows\System\slAxeUn.exe
  C:\Windows\System\slAxeUn.exe
  2⤵
  PID:3480
- C:\Windows\System\gTYKACC.exe
  C:\Windows\System\gTYKACC.exe
  2⤵
  PID:2692
- C:\Windows\System\VPtfUHM.exe
  C:\Windows\System\VPtfUHM.exe
  2⤵
  PID:3580
- C:\Windows\System\HzRYblO.exe
  C:\Windows\System\HzRYblO.exe
  2⤵
  PID:3644
- C:\Windows\System\VEWeteb.exe
  C:\Windows\System\VEWeteb.exe
  2⤵
  PID:3708
- C:\Windows\System\OzxsWux.exe
  C:\Windows\System\OzxsWux.exe
  2⤵
  PID:3772
- C:\Windows\System\YLyUsvE.exe
  C:\Windows\System\YLyUsvE.exe
  2⤵
  PID:3836
- C:\Windows\System\YaqmUZP.exe
  C:\Windows\System\YaqmUZP.exe
  2⤵
  PID:3900
- C:\Windows\System\RSKuUkK.exe
  C:\Windows\System\RSKuUkK.exe
  2⤵
  PID:3964
- C:\Windows\System\hLHTmqN.exe
  C:\Windows\System\hLHTmqN.exe
  2⤵
  PID:4028
- C:\Windows\System\HiXLAUR.exe
  C:\Windows\System\HiXLAUR.exe
  2⤵
  PID:4104
- C:\Windows\System\lRIHwnK.exe
  C:\Windows\System\lRIHwnK.exe
  2⤵
  PID:4120
- C:\Windows\System\hKcSJWK.exe
  C:\Windows\System\hKcSJWK.exe
  2⤵
  PID:4136
- C:\Windows\System\wGiDewu.exe
  C:\Windows\System\wGiDewu.exe
  2⤵
  PID:4152
- C:\Windows\System\mjtIvZT.exe
  C:\Windows\System\mjtIvZT.exe
  2⤵
  PID:4168
- C:\Windows\System\YHAfros.exe
  C:\Windows\System\YHAfros.exe
  2⤵
  PID:4184
- C:\Windows\System\RQznFUZ.exe
  C:\Windows\System\RQznFUZ.exe
  2⤵
  PID:4200
- C:\Windows\System\uhoypNy.exe
  C:\Windows\System\uhoypNy.exe
  2⤵
  PID:4216
- C:\Windows\System\YLLFABm.exe
  C:\Windows\System\YLLFABm.exe
  2⤵
  PID:4232
- C:\Windows\System\JxEsrel.exe
  C:\Windows\System\JxEsrel.exe
  2⤵
  PID:4248
- C:\Windows\System\uEIplcE.exe
  C:\Windows\System\uEIplcE.exe
  2⤵
  PID:4264
- C:\Windows\System\IBuympB.exe
  C:\Windows\System\IBuympB.exe
  2⤵
  PID:4280
- C:\Windows\System\TXFgGwZ.exe
  C:\Windows\System\TXFgGwZ.exe
  2⤵
  PID:4296
- C:\Windows\System\pUxdfZq.exe
  C:\Windows\System\pUxdfZq.exe
  2⤵
  PID:4312
- C:\Windows\System\UsRyirp.exe
  C:\Windows\System\UsRyirp.exe
  2⤵
  PID:4328
- C:\Windows\System\ZqdReck.exe
  C:\Windows\System\ZqdReck.exe
  2⤵
  PID:4344
- C:\Windows\System\hMAAUIc.exe
  C:\Windows\System\hMAAUIc.exe
  2⤵
  PID:4360
- C:\Windows\System\EmIjAFn.exe
  C:\Windows\System\EmIjAFn.exe
  2⤵
  PID:4376
- C:\Windows\System\wZcmxgo.exe
  C:\Windows\System\wZcmxgo.exe
  2⤵
  PID:4392
- C:\Windows\System\kjmIEOB.exe
  C:\Windows\System\kjmIEOB.exe
  2⤵
  PID:4408
- C:\Windows\System\KgfxvOv.exe
  C:\Windows\System\KgfxvOv.exe
  2⤵
  PID:4424
- C:\Windows\System\vOaJHbC.exe
  C:\Windows\System\vOaJHbC.exe
  2⤵
  PID:4440
- C:\Windows\System\aUmOczb.exe
  C:\Windows\System\aUmOczb.exe
  2⤵
  PID:4456
- C:\Windows\System\JXmIOCw.exe
  C:\Windows\System\JXmIOCw.exe
  2⤵
  PID:4472
- C:\Windows\System\ToyKytL.exe
  C:\Windows\System\ToyKytL.exe
  2⤵
  PID:4488
- C:\Windows\System\RyWzzuS.exe
  C:\Windows\System\RyWzzuS.exe
  2⤵
  PID:4504
- C:\Windows\System\TsonzFT.exe
  C:\Windows\System\TsonzFT.exe
  2⤵
  PID:4520
- C:\Windows\System\JUNuekm.exe
  C:\Windows\System\JUNuekm.exe
  2⤵
  PID:4536
- C:\Windows\System\DtxZYaT.exe
  C:\Windows\System\DtxZYaT.exe
  2⤵
  PID:4552
- C:\Windows\System\rtfUtHM.exe
  C:\Windows\System\rtfUtHM.exe
  2⤵
  PID:4568
- C:\Windows\System\hoYMfhJ.exe
  C:\Windows\System\hoYMfhJ.exe
  2⤵
  PID:4584
- C:\Windows\System\ZZlYUZu.exe
  C:\Windows\System\ZZlYUZu.exe
  2⤵
  PID:4600
- C:\Windows\System\FKzOJEP.exe
  C:\Windows\System\FKzOJEP.exe
  2⤵
  PID:4616
- C:\Windows\System\bLSlnjb.exe
  C:\Windows\System\bLSlnjb.exe
  2⤵
  PID:4632
- C:\Windows\System\FdwBrpa.exe
  C:\Windows\System\FdwBrpa.exe
  2⤵
  PID:4648
- C:\Windows\System\JkxlQMt.exe
  C:\Windows\System\JkxlQMt.exe
  2⤵
  PID:4664
- C:\Windows\System\ybqvhfy.exe
  C:\Windows\System\ybqvhfy.exe
  2⤵
  PID:4680
- C:\Windows\System\GZxLQWH.exe
  C:\Windows\System\GZxLQWH.exe
  2⤵
  PID:4696
- C:\Windows\System\eUbdIRh.exe
  C:\Windows\System\eUbdIRh.exe
  2⤵
  PID:4712
- C:\Windows\System\tcdBniq.exe
  C:\Windows\System\tcdBniq.exe
  2⤵
  PID:4728
- C:\Windows\System\WcWJMUD.exe
  C:\Windows\System\WcWJMUD.exe
  2⤵
  PID:4744
- C:\Windows\System\ENwliWV.exe
  C:\Windows\System\ENwliWV.exe
  2⤵
  PID:4760
- C:\Windows\System\jItAktv.exe
  C:\Windows\System\jItAktv.exe
  2⤵
  PID:4776
- C:\Windows\System\ErTQiPq.exe
  C:\Windows\System\ErTQiPq.exe
  2⤵
  PID:4792
- C:\Windows\System\cMOyWwC.exe
  C:\Windows\System\cMOyWwC.exe
  2⤵
  PID:4808
- C:\Windows\System\ELCQmBv.exe
  C:\Windows\System\ELCQmBv.exe
  2⤵
  PID:4824
- C:\Windows\System\fsOwLGz.exe
  C:\Windows\System\fsOwLGz.exe
  2⤵
  PID:4840
- C:\Windows\System\nCCVIOA.exe
  C:\Windows\System\nCCVIOA.exe
  2⤵
  PID:4856
- C:\Windows\System\YAyWgEZ.exe
  C:\Windows\System\YAyWgEZ.exe
  2⤵
  PID:4872
- C:\Windows\System\ufBYWcj.exe
  C:\Windows\System\ufBYWcj.exe
  2⤵
  PID:4888
- C:\Windows\System\XCjwcOD.exe
  C:\Windows\System\XCjwcOD.exe
  2⤵
  PID:4904
- C:\Windows\System\dCIjgkA.exe
  C:\Windows\System\dCIjgkA.exe
  2⤵
  PID:4920
- C:\Windows\System\qskuzpr.exe
  C:\Windows\System\qskuzpr.exe
  2⤵
  PID:4936
- C:\Windows\System\eXpLcBo.exe
  C:\Windows\System\eXpLcBo.exe
  2⤵
  PID:4952
- C:\Windows\System\kYlcroo.exe
  C:\Windows\System\kYlcroo.exe
  2⤵
  PID:4968
- C:\Windows\System\OaSyhEz.exe
  C:\Windows\System\OaSyhEz.exe
  2⤵
  PID:4984
- C:\Windows\System\mYNbhHh.exe
  C:\Windows\System\mYNbhHh.exe
  2⤵
  PID:5000
- C:\Windows\System\ceNoYUx.exe
  C:\Windows\System\ceNoYUx.exe
  2⤵
  PID:5016
- C:\Windows\System\ZjwQZLl.exe
  C:\Windows\System\ZjwQZLl.exe
  2⤵
  PID:5032
- C:\Windows\System\rHDmuZY.exe
  C:\Windows\System\rHDmuZY.exe
  2⤵
  PID:5048
- C:\Windows\System\jeBKFcD.exe
  C:\Windows\System\jeBKFcD.exe
  2⤵
  PID:5064
- C:\Windows\System\xUvUZvh.exe
  C:\Windows\System\xUvUZvh.exe
  2⤵
  PID:5080
- C:\Windows\System\XzmqJNd.exe
  C:\Windows\System\XzmqJNd.exe
  2⤵
  PID:5096
- C:\Windows\System\ykntAPR.exe
  C:\Windows\System\ykntAPR.exe
  2⤵
  PID:5112
- C:\Windows\System\iJlUxRw.exe
  C:\Windows\System\iJlUxRw.exe
  2⤵
  PID:2884
- C:\Windows\System\JuoIuqN.exe
  C:\Windows\System\JuoIuqN.exe
  2⤵
  PID:2920
- C:\Windows\System\xbZmxqQ.exe
  C:\Windows\System\xbZmxqQ.exe
  2⤵
  PID:3192
- C:\Windows\System\jQzBvFo.exe
  C:\Windows\System\jQzBvFo.exe
  2⤵
  PID:3448
- C:\Windows\System\bfFnxsv.exe
  C:\Windows\System\bfFnxsv.exe
  2⤵
  PID:2516
- C:\Windows\System\WZJlnnN.exe
  C:\Windows\System\WZJlnnN.exe
  2⤵
  PID:3804
- C:\Windows\System\AvtHRve.exe
  C:\Windows\System\AvtHRve.exe
  2⤵
  PID:4060
- C:\Windows\System\FhUanei.exe
  C:\Windows\System\FhUanei.exe
  2⤵
  PID:4160
- C:\Windows\System\KiONjrG.exe
  C:\Windows\System\KiONjrG.exe
  2⤵
  PID:4224
- C:\Windows\System\dohmowm.exe
  C:\Windows\System\dohmowm.exe
  2⤵
  PID:4288
- C:\Windows\System\aieVVmn.exe
  C:\Windows\System\aieVVmn.exe
  2⤵
  PID:4352
- C:\Windows\System\SHSiofb.exe
  C:\Windows\System\SHSiofb.exe
  2⤵
  PID:4388
- C:\Windows\System\PPbmIUD.exe
  C:\Windows\System\PPbmIUD.exe
  2⤵
  PID:4452
- C:\Windows\System\ErJNuHj.exe
  C:\Windows\System\ErJNuHj.exe
  2⤵
  PID:4512
- C:\Windows\System\MRYhhqz.exe
  C:\Windows\System\MRYhhqz.exe
  2⤵
  PID:4576
- C:\Windows\System\UgEYDBY.exe
  C:\Windows\System\UgEYDBY.exe
  2⤵
  PID:4640
- C:\Windows\System\ikSJYng.exe
  C:\Windows\System\ikSJYng.exe
  2⤵
  PID:4704
- C:\Windows\System\GDQlWyb.exe
  C:\Windows\System\GDQlWyb.exe
  2⤵
  PID:4768
- C:\Windows\System\DwgbAbF.exe
  C:\Windows\System\DwgbAbF.exe
  2⤵
  PID:4832
- C:\Windows\System\ZoShDZH.exe
  C:\Windows\System\ZoShDZH.exe
  2⤵
  PID:4896
- C:\Windows\System\RCGpjag.exe
  C:\Windows\System\RCGpjag.exe
  2⤵
  PID:4960
- C:\Windows\System\uQtMhKn.exe
  C:\Windows\System\uQtMhKn.exe
  2⤵
  PID:5024
- C:\Windows\System\CFBDZOi.exe
  C:\Windows\System\CFBDZOi.exe
  2⤵
  PID:5088
- C:\Windows\System\stnXIQp.exe
  C:\Windows\System\stnXIQp.exe
  2⤵
  PID:2816
- C:\Windows\System\JRqXNWp.exe
  C:\Windows\System\JRqXNWp.exe
  2⤵
  PID:3932
- C:\Windows\System\TYiAOyW.exe
  C:\Windows\System\TYiAOyW.exe
  2⤵
  PID:4320
- C:\Windows\System\XThEtHR.exe
  C:\Windows\System\XThEtHR.exe
  2⤵
  PID:4544
- C:\Windows\System\NSZbfZA.exe
  C:\Windows\System\NSZbfZA.exe
  2⤵
  PID:4676
- C:\Windows\System\mvvmqzC.exe
  C:\Windows\System\mvvmqzC.exe
  2⤵
  PID:4932
- C:\Windows\System\mwsHNjj.exe
  C:\Windows\System\mwsHNjj.exe
  2⤵
  PID:5056
- C:\Windows\System\QaTMGfZ.exe
  C:\Windows\System\QaTMGfZ.exe
  2⤵
  PID:5128
- C:\Windows\System\sLqWiQQ.exe
  C:\Windows\System\sLqWiQQ.exe
  2⤵
  PID:5144
- C:\Windows\System\foqGqcV.exe
  C:\Windows\System\foqGqcV.exe
  2⤵
  PID:5160
- C:\Windows\System\HmfFuIJ.exe
  C:\Windows\System\HmfFuIJ.exe
  2⤵
  PID:5176
- C:\Windows\System\oweZqXu.exe
  C:\Windows\System\oweZqXu.exe
  2⤵
  PID:5192
- C:\Windows\System\CyCDjjs.exe
  C:\Windows\System\CyCDjjs.exe
  2⤵
  PID:5208
- C:\Windows\System\xwHPeUQ.exe
  C:\Windows\System\xwHPeUQ.exe
  2⤵
  PID:5224
- C:\Windows\System\hOhhthk.exe
  C:\Windows\System\hOhhthk.exe
  2⤵
  PID:5240
- C:\Windows\System\ohmDoDp.exe
  C:\Windows\System\ohmDoDp.exe
  2⤵
  PID:5256
- C:\Windows\System\ULENXiG.exe
  C:\Windows\System\ULENXiG.exe
  2⤵
  PID:5272
- C:\Windows\System\mkpNeLs.exe
  C:\Windows\System\mkpNeLs.exe
  2⤵
  PID:5288
- C:\Windows\System\OItvRRX.exe
  C:\Windows\System\OItvRRX.exe
  2⤵
  PID:5304
- C:\Windows\System\udWkBXW.exe
  C:\Windows\System\udWkBXW.exe
  2⤵
  PID:5320
- C:\Windows\System\CTFfgpj.exe
  C:\Windows\System\CTFfgpj.exe
  2⤵
  PID:5336
- C:\Windows\System\UjTkOEg.exe
  C:\Windows\System\UjTkOEg.exe
  2⤵
  PID:5352
- C:\Windows\System\VUzellO.exe
  C:\Windows\System\VUzellO.exe
  2⤵
  PID:5368
- C:\Windows\System\cBMAQuy.exe
  C:\Windows\System\cBMAQuy.exe
  2⤵
  PID:5384
- C:\Windows\System\xZCdtZC.exe
  C:\Windows\System\xZCdtZC.exe
  2⤵
  PID:5400
- C:\Windows\System\gCKapWr.exe
  C:\Windows\System\gCKapWr.exe
  2⤵
  PID:5416
- C:\Windows\System\oiWtrwu.exe
  C:\Windows\System\oiWtrwu.exe
  2⤵
  PID:5432
- C:\Windows\System\siMzlAH.exe
  C:\Windows\System\siMzlAH.exe
  2⤵
  PID:5448
- C:\Windows\System\HDAwxIG.exe
  C:\Windows\System\HDAwxIG.exe
  2⤵
  PID:5464
- C:\Windows\System\UrZcLfJ.exe
  C:\Windows\System\UrZcLfJ.exe
  2⤵
  PID:5480
- C:\Windows\System\atvFDUc.exe
  C:\Windows\System\atvFDUc.exe
  2⤵
  PID:5496
- C:\Windows\System\HXigsPW.exe
  C:\Windows\System\HXigsPW.exe
  2⤵
  PID:5512
- C:\Windows\System\xvVUQCZ.exe
  C:\Windows\System\xvVUQCZ.exe
  2⤵
  PID:5528
- C:\Windows\System\hoFEzGz.exe
  C:\Windows\System\hoFEzGz.exe
  2⤵
  PID:5544
- C:\Windows\System\PUUiNcG.exe
  C:\Windows\System\PUUiNcG.exe
  2⤵
  PID:5560
- C:\Windows\System\lxoIlIX.exe
  C:\Windows\System\lxoIlIX.exe
  2⤵
  PID:5576
- C:\Windows\System\bTlxANV.exe
  C:\Windows\System\bTlxANV.exe
  2⤵
  PID:5592
- C:\Windows\System\KcWSYNa.exe
  C:\Windows\System\KcWSYNa.exe
  2⤵
  PID:5608
- C:\Windows\System\KoaFxtt.exe
  C:\Windows\System\KoaFxtt.exe
  2⤵
  PID:5624
- C:\Windows\System\AJRfzMd.exe
  C:\Windows\System\AJRfzMd.exe
  2⤵
  PID:5640
- C:\Windows\System\MTEVWsx.exe
  C:\Windows\System\MTEVWsx.exe
  2⤵
  PID:5656
- C:\Windows\System\vRDrSYh.exe
  C:\Windows\System\vRDrSYh.exe
  2⤵
  PID:5672
- C:\Windows\System\MXDLJSi.exe
  C:\Windows\System\MXDLJSi.exe
  2⤵
  PID:5688
- C:\Windows\System\Trkcrmd.exe
  C:\Windows\System\Trkcrmd.exe
  2⤵
  PID:5704
- C:\Windows\System\hSfMppo.exe
  C:\Windows\System\hSfMppo.exe
  2⤵
  PID:5720
- C:\Windows\System\NyTZNvb.exe
  C:\Windows\System\NyTZNvb.exe
  2⤵
  PID:5736
- C:\Windows\System\ttEaufO.exe
  C:\Windows\System\ttEaufO.exe
  2⤵
  PID:5752
- C:\Windows\System\eduzGAE.exe
  C:\Windows\System\eduzGAE.exe
  2⤵
  PID:5768
- C:\Windows\System\NOONBrn.exe
  C:\Windows\System\NOONBrn.exe
  2⤵
  PID:5784
- C:\Windows\System\nGwZzOP.exe
  C:\Windows\System\nGwZzOP.exe
  2⤵
  PID:5908
- C:\Windows\System\ZgdJWcg.exe
  C:\Windows\System\ZgdJWcg.exe
  2⤵
  PID:5924
- C:\Windows\System\BqSpApx.exe
  C:\Windows\System\BqSpApx.exe
  2⤵
  PID:5944
- C:\Windows\System\jdqTSFS.exe
  C:\Windows\System\jdqTSFS.exe
  2⤵
  PID:5960
- C:\Windows\System\MBCQSsB.exe
  C:\Windows\System\MBCQSsB.exe
  2⤵
  PID:5976
- C:\Windows\System\YRnvtVM.exe
  C:\Windows\System\YRnvtVM.exe
  2⤵
  PID:5992
- C:\Windows\System\OqqiBOD.exe
  C:\Windows\System\OqqiBOD.exe
  2⤵
  PID:6008
- C:\Windows\System\EllWbiY.exe
  C:\Windows\System\EllWbiY.exe
  2⤵
  PID:6024
- C:\Windows\System\iILodhh.exe
  C:\Windows\System\iILodhh.exe
  2⤵
  PID:6044
- C:\Windows\System\rIHwftw.exe
  C:\Windows\System\rIHwftw.exe
  2⤵
  PID:6060
- C:\Windows\System\eRfzZUD.exe
  C:\Windows\System\eRfzZUD.exe
  2⤵
  PID:6076
- C:\Windows\System\BhRIHOC.exe
  C:\Windows\System\BhRIHOC.exe
  2⤵
  PID:6092
- C:\Windows\System\hCQhCZQ.exe
  C:\Windows\System\hCQhCZQ.exe
  2⤵
  PID:6108
- C:\Windows\System\KRqeyIH.exe
  C:\Windows\System\KRqeyIH.exe
  2⤵
  PID:6124
- C:\Windows\System\QigKLDb.exe
  C:\Windows\System\QigKLDb.exe
  2⤵
  PID:3576
- C:\Windows\System\OxBBZya.exe
  C:\Windows\System\OxBBZya.exe
  2⤵
  PID:4804
- C:\Windows\System\OKlddOY.exe
  C:\Windows\System\OKlddOY.exe
  2⤵
  PID:5152
- C:\Windows\System\YGtSJnU.exe
  C:\Windows\System\YGtSJnU.exe
  2⤵
  PID:5216
- C:\Windows\System\soosmkq.exe
  C:\Windows\System\soosmkq.exe
  2⤵
  PID:5280
- C:\Windows\System\xxtoZlv.exe
  C:\Windows\System\xxtoZlv.exe
  2⤵
  PID:5344
- C:\Windows\System\CsnKrIM.exe
  C:\Windows\System\CsnKrIM.exe
  2⤵
  PID:5412
- C:\Windows\System\GZsuIfx.exe
  C:\Windows\System\GZsuIfx.exe
  2⤵
  PID:5476
- C:\Windows\System\upveyDe.exe
  C:\Windows\System\upveyDe.exe
  2⤵
  PID:5540
- C:\Windows\System\IPoZDjF.exe
  C:\Windows\System\IPoZDjF.exe
  2⤵
  PID:5604
- C:\Windows\System\sauzIqk.exe
  C:\Windows\System\sauzIqk.exe
  2⤵
  PID:2684
- C:\Windows\System\AJEaAQR.exe
  C:\Windows\System\AJEaAQR.exe
  2⤵
  PID:5668
- C:\Windows\System\IcaxUJZ.exe
  C:\Windows\System\IcaxUJZ.exe
  2⤵
  PID:5728
- C:\Windows\System\GkyrbLB.exe
  C:\Windows\System\GkyrbLB.exe
  2⤵
  PID:5764
- C:\Windows\System\pwibRZu.exe
  C:\Windows\System\pwibRZu.exe
  2⤵
  PID:2900
- C:\Windows\System\MtKlOoB.exe
  C:\Windows\System\MtKlOoB.exe
  2⤵
  PID:3044
- C:\Windows\System\dhNiJfK.exe
  C:\Windows\System\dhNiJfK.exe
  2⤵
  PID:564
- C:\Windows\System\YHEPxff.exe
  C:\Windows\System\YHEPxff.exe
  2⤵
  PID:1780
- C:\Windows\System\AgbuUgr.exe
  C:\Windows\System\AgbuUgr.exe
  2⤵
  PID:404
- C:\Windows\System\WntzBiW.exe
  C:\Windows\System\WntzBiW.exe
  2⤵
  PID:2976
- C:\Windows\System\mNFHCaQ.exe
  C:\Windows\System\mNFHCaQ.exe
  2⤵
  PID:1760
- C:\Windows\System\CHGDLJJ.exe
  C:\Windows\System\CHGDLJJ.exe
  2⤵
  PID:1596
- C:\Windows\System\NclBEol.exe
  C:\Windows\System\NclBEol.exe
  2⤵
  PID:1300
- C:\Windows\System\TuWOWJN.exe
  C:\Windows\System\TuWOWJN.exe
  2⤵
  PID:2876
- C:\Windows\System\ISCuaHb.exe
  C:\Windows\System\ISCuaHb.exe
  2⤵
  PID:1968
- C:\Windows\System\Lbghkwr.exe
  C:\Windows\System\Lbghkwr.exe
  2⤵
  PID:1172
- C:\Windows\System\LYdYuTf.exe
  C:\Windows\System\LYdYuTf.exe
  2⤵
  PID:2708
- C:\Windows\System\EWzOGTq.exe
  C:\Windows\System\EWzOGTq.exe
  2⤵
  PID:3172
- C:\Windows\System\qcABaqm.exe
  C:\Windows\System\qcABaqm.exe
  2⤵
  PID:3236
- C:\Windows\System\ZYHLjCK.exe
  C:\Windows\System\ZYHLjCK.exe
  2⤵
  PID:3300
- C:\Windows\System\uArdJgf.exe
  C:\Windows\System\uArdJgf.exe
  2⤵
  PID:3368
- C:\Windows\System\CMTupms.exe
  C:\Windows\System\CMTupms.exe
  2⤵
  PID:3532
- C:\Windows\System\ZavJvkm.exe
  C:\Windows\System\ZavJvkm.exe
  2⤵
  PID:3624
- C:\Windows\System\AmeNjEW.exe
  C:\Windows\System\AmeNjEW.exe
  2⤵
  PID:3688
- C:\Windows\System\EFcDReb.exe
  C:\Windows\System\EFcDReb.exe
  2⤵
  PID:3752
- C:\Windows\System\JajxTXg.exe
  C:\Windows\System\JajxTXg.exe
  2⤵
  PID:3816
- C:\Windows\System\OKVgrqs.exe
  C:\Windows\System\OKVgrqs.exe
  2⤵
  PID:3912
- C:\Windows\System\GLKdecj.exe
  C:\Windows\System\GLKdecj.exe
  2⤵
  PID:3980
- C:\Windows\System\SgxGquR.exe
  C:\Windows\System\SgxGquR.exe
  2⤵
  PID:3432
- C:\Windows\System\kqGxHva.exe
  C:\Windows\System\kqGxHva.exe
  2⤵
  PID:1944
- C:\Windows\System\TAIqpxI.exe
  C:\Windows\System\TAIqpxI.exe
  2⤵
  PID:1724
- C:\Windows\System\OgnFBBA.exe
  C:\Windows\System\OgnFBBA.exe
  2⤵
  PID:6160
- C:\Windows\System\eJYbUVz.exe
  C:\Windows\System\eJYbUVz.exe
  2⤵
  PID:6176
- C:\Windows\System\hECzghk.exe
  C:\Windows\System\hECzghk.exe
  2⤵
  PID:6192
- C:\Windows\System\NAVdgqm.exe
  C:\Windows\System\NAVdgqm.exe
  2⤵
  PID:6208
- C:\Windows\System\SILkrml.exe
  C:\Windows\System\SILkrml.exe
  2⤵
  PID:6224
- C:\Windows\System\LOPCoTn.exe
  C:\Windows\System\LOPCoTn.exe
  2⤵
  PID:6252
- C:\Windows\System\proewab.exe
  C:\Windows\System\proewab.exe
  2⤵
  PID:6272
- C:\Windows\System\SEDoTDo.exe
  C:\Windows\System\SEDoTDo.exe
  2⤵
  PID:6292
- C:\Windows\System\peCnUYG.exe
  C:\Windows\System\peCnUYG.exe
  2⤵
  PID:6308
- C:\Windows\System\vWKzoxm.exe
  C:\Windows\System\vWKzoxm.exe
  2⤵
  PID:6328
- C:\Windows\System\GnNJkmU.exe
  C:\Windows\System\GnNJkmU.exe
  2⤵
  PID:6352
- C:\Windows\System\xBIbqnn.exe
  C:\Windows\System\xBIbqnn.exe
  2⤵
  PID:6372
- C:\Windows\System\OMdaOoj.exe
  C:\Windows\System\OMdaOoj.exe
  2⤵
  PID:6392
- C:\Windows\System\hdXUZwS.exe
  C:\Windows\System\hdXUZwS.exe
  2⤵
  PID:6416
- C:\Windows\System\QBjxRTc.exe
  C:\Windows\System\QBjxRTc.exe
  2⤵
  PID:6436
- C:\Windows\System\qHwopZZ.exe
  C:\Windows\System\qHwopZZ.exe
  2⤵
  PID:6460
- C:\Windows\System\xcDLxfH.exe
  C:\Windows\System\xcDLxfH.exe
  2⤵
  PID:6484
- C:\Windows\System\owwkikr.exe
  C:\Windows\System\owwkikr.exe
  2⤵
  PID:6508
- C:\Windows\System\nmGEGKr.exe
  C:\Windows\System\nmGEGKr.exe
  2⤵
  PID:6528
- C:\Windows\System\icDjxwg.exe
  C:\Windows\System\icDjxwg.exe
  2⤵
  PID:6552
- C:\Windows\System\fXgfvhj.exe
  C:\Windows\System\fXgfvhj.exe
  2⤵
  PID:6576
- C:\Windows\System\uRCYDAD.exe
  C:\Windows\System\uRCYDAD.exe
  2⤵
  PID:6592
- C:\Windows\System\HvdHZWi.exe
  C:\Windows\System\HvdHZWi.exe
  2⤵
  PID:6608
- C:\Windows\System\RrrpWrO.exe
  C:\Windows\System\RrrpWrO.exe
  2⤵
  PID:6624
- C:\Windows\System\mTlWdAX.exe
  C:\Windows\System\mTlWdAX.exe
  2⤵
  PID:6640
- C:\Windows\System\KXQMqDs.exe
  C:\Windows\System\KXQMqDs.exe
  2⤵
  PID:6656
- C:\Windows\System\jxQilbv.exe
  C:\Windows\System\jxQilbv.exe
  2⤵
  PID:6672
- C:\Windows\System\VDIoxRY.exe
  C:\Windows\System\VDIoxRY.exe
  2⤵
  PID:6688
- C:\Windows\System\rPMbjbt.exe
  C:\Windows\System\rPMbjbt.exe
  2⤵
  PID:6704
- C:\Windows\System\SLYSapX.exe
  C:\Windows\System\SLYSapX.exe
  2⤵
  PID:6720
- C:\Windows\System\CRNspXw.exe
  C:\Windows\System\CRNspXw.exe
  2⤵
  PID:6736
- C:\Windows\System\SLatbFx.exe
  C:\Windows\System\SLatbFx.exe
  2⤵
  PID:6752
- C:\Windows\System\xmIGGiW.exe
  C:\Windows\System\xmIGGiW.exe
  2⤵
  PID:6768
- C:\Windows\System\DwVGnea.exe
  C:\Windows\System\DwVGnea.exe
  2⤵
  PID:6784
- C:\Windows\System\NFZBguW.exe
  C:\Windows\System\NFZBguW.exe
  2⤵
  PID:6800
- C:\Windows\System\EHMAgjQ.exe
  C:\Windows\System\EHMAgjQ.exe
  2⤵
  PID:6816
- C:\Windows\System\ASmTsWf.exe
  C:\Windows\System\ASmTsWf.exe
  2⤵
  PID:6832
- C:\Windows\System\OhOdMzr.exe
  C:\Windows\System\OhOdMzr.exe
  2⤵
  PID:6848
- C:\Windows\System\YipZhUB.exe
  C:\Windows\System\YipZhUB.exe
  2⤵
  PID:6864
- C:\Windows\System\FGHODBh.exe
  C:\Windows\System\FGHODBh.exe
  2⤵
  PID:6884
- C:\Windows\System\AWTRSUm.exe
  C:\Windows\System\AWTRSUm.exe
  2⤵
  PID:6900
- C:\Windows\System\xMNkzbj.exe
  C:\Windows\System\xMNkzbj.exe
  2⤵
  PID:6920
- C:\Windows\System\lfpTiVu.exe
  C:\Windows\System\lfpTiVu.exe
  2⤵
  PID:6936
- C:\Windows\System\jbetVMW.exe
  C:\Windows\System\jbetVMW.exe
  2⤵
  PID:6952
- C:\Windows\System\ozzEGQV.exe
  C:\Windows\System\ozzEGQV.exe
  2⤵
  PID:6968
- C:\Windows\System\rfJlBcD.exe
  C:\Windows\System\rfJlBcD.exe
  2⤵
  PID:6984
- C:\Windows\System\qbSNqBL.exe
  C:\Windows\System\qbSNqBL.exe
  2⤵
  PID:7000
- C:\Windows\System\Kbkkhvt.exe
  C:\Windows\System\Kbkkhvt.exe
  2⤵
  PID:7016
- C:\Windows\System\CvXgiPk.exe
  C:\Windows\System\CvXgiPk.exe
  2⤵
  PID:7032
- C:\Windows\System\Vmwarth.exe
  C:\Windows\System\Vmwarth.exe
  2⤵
  PID:7048
- C:\Windows\System\LlcZcHv.exe
  C:\Windows\System\LlcZcHv.exe
  2⤵
  PID:7064
- C:\Windows\System\ssJVtsd.exe
  C:\Windows\System\ssJVtsd.exe
  2⤵
  PID:7080
- C:\Windows\System\gdiHWzc.exe
  C:\Windows\System\gdiHWzc.exe
  2⤵
  PID:7096
- C:\Windows\System\cjHlRhc.exe
  C:\Windows\System\cjHlRhc.exe
  2⤵
  PID:7112
- C:\Windows\System\vCQfGsz.exe
  C:\Windows\System\vCQfGsz.exe
  2⤵
  PID:7128
- C:\Windows\System\FBUTOOH.exe
  C:\Windows\System\FBUTOOH.exe
  2⤵
  PID:7144
- C:\Windows\System\AsVmESG.exe
  C:\Windows\System\AsVmESG.exe
  2⤵
  PID:7160
- C:\Windows\System\IuiuQdE.exe
  C:\Windows\System\IuiuQdE.exe
  2⤵
  PID:3256
- C:\Windows\System\CZitpwM.exe
  C:\Windows\System\CZitpwM.exe
  2⤵
  PID:3516
- C:\Windows\System\QwkPQXh.exe
  C:\Windows\System\QwkPQXh.exe
  2⤵
  PID:3740
- C:\Windows\System\vYzmkpT.exe
  C:\Windows\System\vYzmkpT.exe
  2⤵
  PID:4024
- C:\Windows\System\uJZBDbr.exe
  C:\Windows\System\uJZBDbr.exe
  2⤵
  PID:4148
- C:\Windows\System\PKQBMVO.exe
  C:\Windows\System\PKQBMVO.exe
  2⤵
  PID:4244
- C:\Windows\System\tWrdAkP.exe
  C:\Windows\System\tWrdAkP.exe
  2⤵
  PID:4368
- C:\Windows\System\tLLfsWz.exe
  C:\Windows\System\tLLfsWz.exe
  2⤵
  PID:4464
- C:\Windows\System\xmlcbcf.exe
  C:\Windows\System\xmlcbcf.exe
  2⤵
  PID:4532
- C:\Windows\System\IahMQSY.exe
  C:\Windows\System\IahMQSY.exe
  2⤵
  PID:4596
- C:\Windows\System\jEneAWL.exe
  C:\Windows\System\jEneAWL.exe
  2⤵
  PID:4692
- C:\Windows\System\uKLtmeo.exe
  C:\Windows\System\uKLtmeo.exe
  2⤵
  PID:4756
- C:\Windows\System\KhYWBOi.exe
  C:\Windows\System\KhYWBOi.exe
  2⤵
  PID:4820
- C:\Windows\System\NXBSIpn.exe
  C:\Windows\System\NXBSIpn.exe
  2⤵
  PID:4884
- C:\Windows\System\RDbnVke.exe
  C:\Windows\System\RDbnVke.exe
  2⤵
  PID:4980
- C:\Windows\System\GszNDtq.exe
  C:\Windows\System\GszNDtq.exe
  2⤵
  PID:5620
- C:\Windows\System\GCzqRJb.exe
  C:\Windows\System\GCzqRJb.exe
  2⤵
  PID:5652
- C:\Windows\System\nbJqCjx.exe
  C:\Windows\System\nbJqCjx.exe
  2⤵
  PID:5716
- C:\Windows\System\CyTxWhZ.exe
  C:\Windows\System\CyTxWhZ.exe
  2⤵
  PID:5780
- C:\Windows\System\IaUBhRm.exe
  C:\Windows\System\IaUBhRm.exe
  2⤵
  PID:392
- C:\Windows\System\mLiIMoD.exe
  C:\Windows\System\mLiIMoD.exe
  2⤵
  PID:2356
- C:\Windows\System\pyUChZE.exe
  C:\Windows\System\pyUChZE.exe
  2⤵
  PID:1100
- C:\Windows\System\yZGKqiA.exe
  C:\Windows\System\yZGKqiA.exe
  2⤵
  PID:5968
- C:\Windows\System\KgPAqYl.exe
  C:\Windows\System\KgPAqYl.exe
  2⤵
  PID:376
- C:\Windows\System\tAVuESk.exe
  C:\Windows\System\tAVuESk.exe
  2⤵
  PID:2640
- C:\Windows\System\xDZRRZj.exe
  C:\Windows\System\xDZRRZj.exe
  2⤵
  PID:1364
- C:\Windows\System\vBRhbkk.exe
  C:\Windows\System\vBRhbkk.exe
  2⤵
  PID:3080
- C:\Windows\System\UYfHszd.exe
  C:\Windows\System\UYfHszd.exe
  2⤵
  PID:6100
- C:\Windows\System\nhnJXby.exe
  C:\Windows\System\nhnJXby.exe
  2⤵
  PID:5124
- C:\Windows\System\oklzjMa.exe
  C:\Windows\System\oklzjMa.exe
  2⤵
  PID:5380
- C:\Windows\System\AwpqZJS.exe
  C:\Windows\System\AwpqZJS.exe
  2⤵
  PID:2872
- C:\Windows\System\uLSmTir.exe
  C:\Windows\System\uLSmTir.exe
  2⤵
  PID:2256
- C:\Windows\System\gYykXza.exe
  C:\Windows\System\gYykXza.exe
  2⤵
  PID:3720
- C:\Windows\System\dbzmKVs.exe
  C:\Windows\System\dbzmKVs.exe
  2⤵
  PID:3880
- C:\Windows\System\fAZSDrk.exe
  C:\Windows\System\fAZSDrk.exe
  2⤵
  PID:2412
- C:\Windows\System\nezTKLE.exe
  C:\Windows\System\nezTKLE.exe
  2⤵
  PID:6204
- C:\Windows\System\PnfokWF.exe
  C:\Windows\System\PnfokWF.exe
  2⤵
  PID:6284
- C:\Windows\System\bWfMVrx.exe
  C:\Windows\System\bWfMVrx.exe
  2⤵
  PID:6448
- C:\Windows\System\pNoFkpa.exe
  C:\Windows\System\pNoFkpa.exe
  2⤵
  PID:6540
- C:\Windows\System\fmtezOe.exe
  C:\Windows\System\fmtezOe.exe
  2⤵
  PID:5800
- C:\Windows\System\hmHViYk.exe
  C:\Windows\System\hmHViYk.exe
  2⤵
  PID:5816
- C:\Windows\System\gQFMIht.exe
  C:\Windows\System\gQFMIht.exe
  2⤵
  PID:5832
- C:\Windows\System\RczeTKe.exe
  C:\Windows\System\RczeTKe.exe
  2⤵
  PID:5848
- C:\Windows\System\MsudJHr.exe
  C:\Windows\System\MsudJHr.exe
  2⤵
  PID:5864
- C:\Windows\System\fFYfQYA.exe
  C:\Windows\System\fFYfQYA.exe
  2⤵
  PID:5880
- C:\Windows\System\wONUDbR.exe
  C:\Windows\System\wONUDbR.exe
  2⤵
  PID:5896
- C:\Windows\System\DYFXaFa.exe
  C:\Windows\System\DYFXaFa.exe
  2⤵
  PID:5796
- C:\Windows\System\mTmiCBJ.exe
  C:\Windows\System\mTmiCBJ.exe
  2⤵
  PID:6136
- C:\Windows\System\xMScSFI.exe
  C:\Windows\System\xMScSFI.exe
  2⤵
  PID:2916
- C:\Windows\System\HSNNbTR.exe
  C:\Windows\System\HSNNbTR.exe
  2⤵
  PID:6288
- C:\Windows\System\weoWyHc.exe
  C:\Windows\System\weoWyHc.exe
  2⤵
  PID:6412
- C:\Windows\System\iMkOykO.exe
  C:\Windows\System\iMkOykO.exe
  2⤵
  PID:6504
- C:\Windows\System\dlWkJAf.exe
  C:\Windows\System\dlWkJAf.exe
  2⤵
  PID:6620
- C:\Windows\System\ROoUBdB.exe
  C:\Windows\System\ROoUBdB.exe
  2⤵
  PID:6684
- C:\Windows\System\bkhLwZB.exe
  C:\Windows\System\bkhLwZB.exe
  2⤵
  PID:6748
- C:\Windows\System\JZISaXs.exe
  C:\Windows\System\JZISaXs.exe
  2⤵
  PID:6812
- C:\Windows\System\BIniCOk.exe
  C:\Windows\System\BIniCOk.exe
  2⤵
  PID:6876
- C:\Windows\System\FsUIYRO.exe
  C:\Windows\System\FsUIYRO.exe
  2⤵
  PID:6916
- C:\Windows\System\jbjNHvL.exe
  C:\Windows\System\jbjNHvL.exe
  2⤵
  PID:6980
- C:\Windows\System\bSMMBVf.exe
  C:\Windows\System\bSMMBVf.exe
  2⤵
  PID:7044
- C:\Windows\System\cdIZxTt.exe
  C:\Windows\System\cdIZxTt.exe
  2⤵
  PID:7108
- C:\Windows\System\tePrxnq.exe
  C:\Windows\System\tePrxnq.exe
  2⤵
  PID:3156
- C:\Windows\System\gkgmFbe.exe
  C:\Windows\System\gkgmFbe.exe
  2⤵
  PID:4144
- C:\Windows\System\oDdynUy.exe
  C:\Windows\System\oDdynUy.exe
  2⤵
  PID:4528
- C:\Windows\System\sfxfUSf.exe
  C:\Windows\System\sfxfUSf.exe
  2⤵
  PID:4816
- C:\Windows\System\JsZKdza.exe
  C:\Windows\System\JsZKdza.exe
  2⤵
  PID:6364
- C:\Windows\System\OQsJDtW.exe
  C:\Windows\System\OQsJDtW.exe
  2⤵
  PID:2700
- C:\Windows\System\fQAtzsR.exe
  C:\Windows\System\fQAtzsR.exe
  2⤵
  PID:3528
- C:\Windows\System\kVbDToQ.exe
  C:\Windows\System\kVbDToQ.exe
  2⤵
  PID:3916
- C:\Windows\System\HUnHXji.exe
  C:\Windows\System\HUnHXji.exe
  2⤵
  PID:1560
- C:\Windows\System\ZMFyLZl.exe
  C:\Windows\System\ZMFyLZl.exe
  2⤵
  PID:4272
- C:\Windows\System\ZlCJBgV.exe
  C:\Windows\System\ZlCJBgV.exe
  2⤵
  PID:2080
- C:\Windows\System\aqhimFB.exe
  C:\Windows\System\aqhimFB.exe
  2⤵
  PID:4660
- C:\Windows\System\fjHypha.exe
  C:\Windows\System\fjHypha.exe
  2⤵
  PID:3348
- C:\Windows\System\qinaymT.exe
  C:\Windows\System\qinaymT.exe
  2⤵
  PID:4192
- C:\Windows\System\sVunegl.exe
  C:\Windows\System\sVunegl.exe
  2⤵
  PID:6992
- C:\Windows\System\JibFppB.exe
  C:\Windows\System\JibFppB.exe
  2⤵
  PID:7028
- C:\Windows\System\FupQPRf.exe
  C:\Windows\System\FupQPRf.exe
  2⤵
  PID:7060
- C:\Windows\System\ervuwAC.exe
  C:\Windows\System\ervuwAC.exe
  2⤵
  PID:7088
- C:\Windows\System\foxpYCR.exe
  C:\Windows\System\foxpYCR.exe
  2⤵
  PID:7124
- C:\Windows\System\zeJmjry.exe
  C:\Windows\System\zeJmjry.exe
  2⤵
  PID:3412
- C:\Windows\System\VyMkqFR.exe
  C:\Windows\System\VyMkqFR.exe
  2⤵
  PID:4212
- C:\Windows\System\cFQaFwr.exe
  C:\Windows\System\cFQaFwr.exe
  2⤵
  PID:4592
- C:\Windows\System\FRLeuhW.exe
  C:\Windows\System\FRLeuhW.exe
  2⤵
  PID:4880
- C:\Windows\System\VIGXNgs.exe
  C:\Windows\System\VIGXNgs.exe
  2⤵
  PID:1804
- C:\Windows\System\zyXiHXI.exe
  C:\Windows\System\zyXiHXI.exe
  2⤵
  PID:5940
- C:\Windows\System\garWzld.exe
  C:\Windows\System\garWzld.exe
  2⤵
  PID:1684
- C:\Windows\System\IrpPuyo.exe
  C:\Windows\System\IrpPuyo.exe
  2⤵
  PID:1636
- C:\Windows\System\hJpIHGx.exe
  C:\Windows\System\hJpIHGx.exe
  2⤵
  PID:1940
- C:\Windows\System\qoLbZLR.exe
  C:\Windows\System\qoLbZLR.exe
  2⤵
  PID:2508
- C:\Windows\System\wJEPsYo.exe
  C:\Windows\System\wJEPsYo.exe
  2⤵
  PID:5916
- C:\Windows\System\gtxdKqN.exe
  C:\Windows\System\gtxdKqN.exe
  2⤵
  PID:5952
- C:\Windows\System\kXJmyvx.exe
  C:\Windows\System\kXJmyvx.exe
  2⤵
  PID:6020
- C:\Windows\System\eTSqQDg.exe
  C:\Windows\System\eTSqQDg.exe
  2⤵
  PID:6084
- C:\Windows\System\qlPwlNA.exe
  C:\Windows\System\qlPwlNA.exe
  2⤵
  PID:3012
- C:\Windows\System\CCJBkgr.exe
  C:\Windows\System\CCJBkgr.exe
  2⤵
  PID:5184
- C:\Windows\System\pNZNxpm.exe
  C:\Windows\System\pNZNxpm.exe
  2⤵
  PID:5572
- C:\Windows\System\eGhIQdO.exe
  C:\Windows\System\eGhIQdO.exe
  2⤵
  PID:5664
- C:\Windows\System\SQdcbdx.exe
  C:\Windows\System\SQdcbdx.exe
  2⤵
  PID:1980
- C:\Windows\System\PgWAFxc.exe
  C:\Windows\System\PgWAFxc.exe
  2⤵
  PID:3024
- C:\Windows\System\xaACVYS.exe
  C:\Windows\System\xaACVYS.exe
  2⤵
  PID:1928
- C:\Windows\System\RhPEEMX.exe
  C:\Windows\System\RhPEEMX.exe
  2⤵
  PID:2100
- C:\Windows\System\rwqXFMI.exe
  C:\Windows\System\rwqXFMI.exe
  2⤵
  PID:3272
- C:\Windows\System\VAMFANr.exe
  C:\Windows\System\VAMFANr.exe
  2⤵
  PID:3660
- C:\Windows\System\xVuaFMt.exe
  C:\Windows\System\xVuaFMt.exe
  2⤵
  PID:3976
- C:\Windows\System\dshthrx.exe
  C:\Windows\System\dshthrx.exe
  2⤵
  PID:6156
- C:\Windows\System\rWMIpEd.exe
  C:\Windows\System\rWMIpEd.exe
  2⤵
  PID:6220
- C:\Windows\System\wjBoXeV.exe
  C:\Windows\System\wjBoXeV.exe
  2⤵
  PID:6300
- C:\Windows\System\FTsUnGV.exe
  C:\Windows\System\FTsUnGV.exe
  2⤵
  PID:6344
- C:\Windows\System\lrQuLzl.exe
  C:\Windows\System\lrQuLzl.exe
  2⤵
  PID:6388
- C:\Windows\System\DBjhhgQ.exe
  C:\Windows\System\DBjhhgQ.exe
  2⤵
  PID:6468
- C:\Windows\System\regWtqE.exe
  C:\Windows\System\regWtqE.exe
  2⤵
  PID:6516
- C:\Windows\System\UYroSQz.exe
  C:\Windows\System\UYroSQz.exe
  2⤵
  PID:6564
- C:\Windows\System\rCoUwWp.exe
  C:\Windows\System\rCoUwWp.exe
  2⤵
  PID:6856
- C:\Windows\System\eAsnvGN.exe
  C:\Windows\System\eAsnvGN.exe
  2⤵
  PID:6932
- C:\Windows\System\WdNtDnJ.exe
  C:\Windows\System\WdNtDnJ.exe
  2⤵
  PID:4992
- C:\Windows\System\PkBTkRM.exe
  C:\Windows\System\PkBTkRM.exe
  2⤵
  PID:5300
- C:\Windows\System\hbkOqJm.exe
  C:\Windows\System\hbkOqJm.exe
  2⤵
  PID:5524
- C:\Windows\System\iWiQQVH.exe
  C:\Windows\System\iWiQQVH.exe
  2⤵
  PID:3592
- C:\Windows\System\lduTBew.exe
  C:\Windows\System\lduTBew.exe
  2⤵
  PID:1272
- C:\Windows\System\obdfkhJ.exe
  C:\Windows\System\obdfkhJ.exe
  2⤵
  PID:2688
- C:\Windows\System\FwcdQSv.exe
  C:\Windows\System\FwcdQSv.exe
  2⤵
  PID:5252
- C:\Windows\System\zbzgvNJ.exe
  C:\Windows\System\zbzgvNJ.exe
  2⤵
  PID:1720
- C:\Windows\System\AAeidiI.exe
  C:\Windows\System\AAeidiI.exe
  2⤵
  PID:1996
- C:\Windows\System\gUHTHge.exe
  C:\Windows\System\gUHTHge.exe
  2⤵
  PID:3724
- C:\Windows\System\PwXJrZh.exe
  C:\Windows\System\PwXJrZh.exe
  2⤵
  PID:5812
- C:\Windows\System\hnnXZmH.exe
  C:\Windows\System\hnnXZmH.exe
  2⤵
  PID:5844
- C:\Windows\System\hoTwlqK.exe
  C:\Windows\System\hoTwlqK.exe
  2⤵
  PID:2216
- C:\Windows\System\GQrVItE.exe
  C:\Windows\System\GQrVItE.exe
  2⤵
  PID:5876
- C:\Windows\System\PKjEIMt.exe
  C:\Windows\System\PKjEIMt.exe
  2⤵
  PID:5408
- C:\Windows\System\OfimhLa.exe
  C:\Windows\System\OfimhLa.exe
  2⤵
  PID:6408
- C:\Windows\System\Olowfld.exe
  C:\Windows\System\Olowfld.exe
  2⤵
  PID:5828
- C:\Windows\System\aPqABhG.exe
  C:\Windows\System\aPqABhG.exe
  2⤵
  PID:940
- C:\Windows\System\fBkAxdx.exe
  C:\Windows\System\fBkAxdx.exe
  2⤵
  PID:452
- C:\Windows\System\gPjAXBA.exe
  C:\Windows\System\gPjAXBA.exe
  2⤵
  PID:4180
- C:\Windows\System\hMGmIlT.exe
  C:\Windows\System\hMGmIlT.exe
  2⤵
  PID:5536
- C:\Windows\System\KDBlSVE.exe
  C:\Windows\System\KDBlSVE.exe
  2⤵
  PID:2544
- C:\Windows\System\UFtJGql.exe
  C:\Windows\System\UFtJGql.exe
  2⤵
  PID:6432
- C:\Windows\System\SWRojHr.exe
  C:\Windows\System\SWRojHr.exe
  2⤵
  PID:6476
- C:\Windows\System\wLlbGYX.exe
  C:\Windows\System\wLlbGYX.exe
  2⤵
  PID:2600
- C:\Windows\System\qRnrQho.exe
  C:\Windows\System\qRnrQho.exe
  2⤵
  PID:6664
- C:\Windows\System\HOqKZQj.exe
  C:\Windows\System\HOqKZQj.exe
  2⤵
  PID:6792
- C:\Windows\System\mqWXHlz.exe
  C:\Windows\System\mqWXHlz.exe
  2⤵
  PID:6892
- C:\Windows\System\OSeRADY.exe
  C:\Windows\System\OSeRADY.exe
  2⤵
  PID:952
- C:\Windows\System\bWJnpUy.exe
  C:\Windows\System\bWJnpUy.exe
  2⤵
  PID:5104
- C:\Windows\System\nankOGp.exe
  C:\Windows\System\nankOGp.exe
  2⤵
  PID:2104
- C:\Windows\System\iqGKLfA.exe
  C:\Windows\System\iqGKLfA.exe
  2⤵
  PID:2660
- C:\Windows\System\cgVAnmo.exe
  C:\Windows\System\cgVAnmo.exe
  2⤵
  PID:4608
- C:\Windows\System\sGYBlVU.exe
  C:\Windows\System\sGYBlVU.exe
  2⤵
  PID:5332
- C:\Windows\System\BIrGIqL.exe
  C:\Windows\System\BIrGIqL.exe
  2⤵
  PID:5364
- C:\Windows\System\pEAkiWj.exe
  C:\Windows\System\pEAkiWj.exe
  2⤵
  PID:5428
- C:\Windows\System\qcQqUjG.exe
  C:\Windows\System\qcQqUjG.exe
  2⤵
  PID:5712
- C:\Windows\System\nZtviAx.exe
  C:\Windows\System\nZtviAx.exe
  2⤵
  PID:6072
- C:\Windows\System\yqcPpix.exe
  C:\Windows\System\yqcPpix.exe
  2⤵
  PID:5700
- C:\Windows\System\GWNbkRA.exe
  C:\Windows\System\GWNbkRA.exe
  2⤵
  PID:2240
- C:\Windows\System\ubrcsUn.exe
  C:\Windows\System\ubrcsUn.exe
  2⤵
  PID:6584
- C:\Windows\System\PQVaXnw.exe
  C:\Windows\System\PQVaXnw.exe
  2⤵
  PID:6004
- C:\Windows\System\IAGpjKL.exe
  C:\Windows\System\IAGpjKL.exe
  2⤵
  PID:2532
- C:\Windows\System\vKUvGLf.exe
  C:\Windows\System\vKUvGLf.exe
  2⤵
  PID:6492
- C:\Windows\System\cPSTfqH.exe
  C:\Windows\System\cPSTfqH.exe
  2⤵
  PID:5296
- C:\Windows\System\wyKvoFo.exe
  C:\Windows\System\wyKvoFo.exe
  2⤵
  PID:3332
- C:\Windows\System\xFHjuvK.exe
  C:\Windows\System\xFHjuvK.exe
  2⤵
  PID:1528
- C:\Windows\System\ddhlrqF.exe
  C:\Windows\System\ddhlrqF.exe
  2⤵
  PID:6716
- C:\Windows\System\BPAuZVW.exe
  C:\Windows\System\BPAuZVW.exe
  2⤵
  PID:4788
- C:\Windows\System\fACblZb.exe
  C:\Windows\System\fACblZb.exe
  2⤵
  PID:4500
- C:\Windows\System\Hndbusw.exe
  C:\Windows\System\Hndbusw.exe
  2⤵
  PID:5892
- C:\Windows\System\PqQlQAo.exe
  C:\Windows\System\PqQlQAo.exe
  2⤵
  PID:6244
- C:\Windows\System\bZpwnhu.exe
  C:\Windows\System\bZpwnhu.exe
  2⤵
  PID:6248
- C:\Windows\System\EbEnurD.exe
  C:\Windows\System\EbEnurD.exe
  2⤵
  PID:6744
- C:\Windows\System\eXFWTAv.exe
  C:\Windows\System\eXFWTAv.exe
  2⤵
  PID:6808
- C:\Windows\System\xbaYJHK.exe
  C:\Windows\System\xbaYJHK.exe
  2⤵
  PID:7104
- C:\Windows\System\yNgkxzo.exe
  C:\Windows\System\yNgkxzo.exe
  2⤵
  PID:7012
- C:\Windows\System\zLVrJPC.exe
  C:\Windows\System\zLVrJPC.exe
  2⤵
  PID:1672
- C:\Windows\System\zvfbuWI.exe
  C:\Windows\System\zvfbuWI.exe
  2⤵
  PID:4336
- C:\Windows\System\fKJUgQw.exe
  C:\Windows\System\fKJUgQw.exe
  2⤵
  PID:3996
- C:\Windows\System\infRyQH.exe
  C:\Windows\System\infRyQH.exe
  2⤵
  PID:2360
- C:\Windows\System\RMEKHqY.exe
  C:\Windows\System\RMEKHqY.exe
  2⤵
  PID:2548
- C:\Windows\System\aWzkSke.exe
  C:\Windows\System\aWzkSke.exe
  2⤵
  PID:6056
- C:\Windows\System\gkZCygG.exe
  C:\Windows\System\gkZCygG.exe
  2⤵
  PID:3548
- C:\Windows\System\EyVCgzG.exe
  C:\Windows\System\EyVCgzG.exe
  2⤵
  PID:5140
- C:\Windows\System\DKSMRlg.exe
  C:\Windows\System\DKSMRlg.exe
  2⤵
  PID:2316
- C:\Windows\System\umpTmyv.exe
  C:\Windows\System\umpTmyv.exe
  2⤵
  PID:784
- C:\Windows\System\UUjeorG.exe
  C:\Windows\System\UUjeorG.exe
  2⤵
  PID:2084
- C:\Windows\System\KHDUfuw.exe
  C:\Windows\System\KHDUfuw.exe
  2⤵
  PID:3492
- C:\Windows\System\CRjVYub.exe
  C:\Windows\System\CRjVYub.exe
  2⤵
  PID:6264
- C:\Windows\System\AzQfEle.exe
  C:\Windows\System\AzQfEle.exe
  2⤵
  PID:904
- C:\Windows\System\bipnWci.exe
  C:\Windows\System\bipnWci.exe
  2⤵
  PID:3140
- C:\Windows\System\PSQaqIe.exe
  C:\Windows\System\PSQaqIe.exe
  2⤵
  PID:6216
- C:\Windows\System\wycxHmK.exe
  C:\Windows\System\wycxHmK.exe
  2⤵
  PID:6632
- C:\Windows\System\iICvMAH.exe
  C:\Windows\System\iICvMAH.exe
  2⤵
  PID:5072
- C:\Windows\System\VfzkKDZ.exe
  C:\Windows\System\VfzkKDZ.exe
  2⤵
  PID:4088
- C:\Windows\System\LszaOUG.exe
  C:\Windows\System\LszaOUG.exe
  2⤵
  PID:6068
- C:\Windows\System\PWYgpKq.exe
  C:\Windows\System\PWYgpKq.exe
  2⤵
  PID:5236
- C:\Windows\System\TBVwpfu.exe
  C:\Windows\System\TBVwpfu.exe
  2⤵
  PID:5616
- C:\Windows\System\ZfqHdMm.exe
  C:\Windows\System\ZfqHdMm.exe
  2⤵
  PID:3128
- C:\Windows\System\TWkdwca.exe
  C:\Windows\System\TWkdwca.exe
  2⤵
  PID:6680
- C:\Windows\System\ADjRlLb.exe
  C:\Windows\System\ADjRlLb.exe
  2⤵
  PID:1208
- C:\Windows\System\jPTNagY.exe
  C:\Windows\System\jPTNagY.exe
  2⤵
  PID:5136
- C:\Windows\System\mCwfEGh.exe
  C:\Windows\System\mCwfEGh.exe
  2⤵
  PID:2520
- C:\Windows\System\mKniLHR.exe
  C:\Windows\System\mKniLHR.exe
  2⤵
  PID:1084
- C:\Windows\System\EDVNvWR.exe
  C:\Windows\System\EDVNvWR.exe
  2⤵
  PID:5360
- C:\Windows\System\zTyhbxa.exe
  C:\Windows\System\zTyhbxa.exe
  2⤵
  PID:4564
- C:\Windows\System\vsEunYW.exe
  C:\Windows\System\vsEunYW.exe
  2⤵
  PID:7056
- C:\Windows\System\UqgbCyT.exe
  C:\Windows\System\UqgbCyT.exe
  2⤵
  PID:1424
- C:\Windows\System\mehJtBi.exe
  C:\Windows\System\mehJtBi.exe
  2⤵
  PID:7120
- C:\Windows\System\tVcXpMG.exe
  C:\Windows\System\tVcXpMG.exe
  2⤵
  PID:6120
- C:\Windows\System\pJSxTZV.exe
  C:\Windows\System\pJSxTZV.exe
  2⤵
  PID:2844
- C:\Windows\System\MOYvewa.exe
  C:\Windows\System\MOYvewa.exe
  2⤵
  PID:2896
- C:\Windows\System\BjmVMeT.exe
  C:\Windows\System\BjmVMeT.exe
  2⤵
  PID:1620
- C:\Windows\System\riStmUU.exe
  C:\Windows\System\riStmUU.exe
  2⤵
  PID:2556
- C:\Windows\System\tNDJnqY.exe
  C:\Windows\System\tNDJnqY.exe
  2⤵
  PID:7076
- C:\Windows\System\KrzvcKf.exe
  C:\Windows\System\KrzvcKf.exe
  2⤵
  PID:4384
- C:\Windows\System\nvriHFc.exe
  C:\Windows\System\nvriHFc.exe
  2⤵
  PID:5932
- C:\Windows\System\kwNgvsW.exe
  C:\Windows\System\kwNgvsW.exe
  2⤵
  PID:6336
- C:\Windows\System\AdAyodT.exe
  C:\Windows\System\AdAyodT.exe
  2⤵
  PID:6404
- C:\Windows\System\FgBwttv.exe
  C:\Windows\System\FgBwttv.exe
  2⤵
  PID:3112
- C:\Windows\System\wSZgiYW.exe
  C:\Windows\System\wSZgiYW.exe
  2⤵
  PID:5396
- C:\Windows\System\YcSLSom.exe
  C:\Windows\System\YcSLSom.exe
  2⤵
  PID:4672
- C:\Windows\System\BCIXOmY.exe
  C:\Windows\System\BCIXOmY.exe
  2⤵
  PID:5200
- C:\Windows\System\LMdkPvi.exe
  C:\Windows\System\LMdkPvi.exe
  2⤵
  PID:5168
- C:\Windows\System\qfuiLqa.exe
  C:\Windows\System\qfuiLqa.exe
  2⤵
  PID:6652
- C:\Windows\System\bDPCdsx.exe
  C:\Windows\System\bDPCdsx.exe
  2⤵
  PID:6140
- C:\Windows\System\bkaHLbs.exe
  C:\Windows\System\bkaHLbs.exe
  2⤵
  PID:5648
- C:\Windows\System\Ohddhoi.exe
  C:\Windows\System\Ohddhoi.exe
  2⤵
  PID:4240
- C:\Windows\System\OLQDDXf.exe
  C:\Windows\System\OLQDDXf.exe
  2⤵
  PID:4736
- C:\Windows\System\PIMPZTU.exe
  C:\Windows\System\PIMPZTU.exe
  2⤵
  PID:4868
- C:\Windows\System\xRYwsAg.exe
  C:\Windows\System\xRYwsAg.exe
  2⤵
  PID:7156
- C:\Windows\System\FOqFKXa.exe
  C:\Windows\System\FOqFKXa.exe
  2⤵
  PID:2604
- C:\Windows\System\JPySnbg.exe
  C:\Windows\System\JPySnbg.exe
  2⤵
  PID:4436
- C:\Windows\System\evZBWxR.exe
  C:\Windows\System\evZBWxR.exe
  2⤵
  PID:6116
- C:\Windows\System\mZNpTDK.exe
  C:\Windows\System\mZNpTDK.exe
  2⤵
  PID:1152
- C:\Windows\System\ukfpYkq.exe
  C:\Windows\System\ukfpYkq.exe
  2⤵
  PID:3496
- C:\Windows\System\yCZWDgi.exe
  C:\Windows\System\yCZWDgi.exe
  2⤵
  PID:4196
- C:\Windows\System\xLcdROf.exe
  C:\Windows\System\xLcdROf.exe
  2⤵
  PID:5956
- C:\Windows\System\EvSkgmM.exe
  C:\Windows\System\EvSkgmM.exe
  2⤵
  PID:7092
- C:\Windows\System\mouNFWV.exe
  C:\Windows\System\mouNFWV.exe
  2⤵
  PID:5044
- C:\Windows\System\OSgaWhO.exe
  C:\Windows\System\OSgaWhO.exe
  2⤵
  PID:3428
- C:\Windows\System\FElUnGP.exe
  C:\Windows\System\FElUnGP.exe
  2⤵
  PID:2924
- C:\Windows\System\BEKBUry.exe
  C:\Windows\System\BEKBUry.exe
  2⤵
  PID:2068
- C:\Windows\System\pqkbpxN.exe
  C:\Windows\System\pqkbpxN.exe
  2⤵
  PID:2572
- C:\Windows\System\IRwxEJr.exe
  C:\Windows\System\IRwxEJr.exe
  2⤵
  PID:1512
- C:\Windows\System\rONthAh.exe
  C:\Windows\System\rONthAh.exe
  2⤵
  PID:6872
- C:\Windows\System\EbgdDPj.exe
  C:\Windows\System\EbgdDPj.exe
  2⤵
  PID:4688
- C:\Windows\System\JHEruqE.exe
  C:\Windows\System\JHEruqE.exe
  2⤵
  PID:3384
- C:\Windows\System\aZohoOA.exe
  C:\Windows\System\aZohoOA.exe
  2⤵
  PID:5888
- C:\Windows\System\fTgDdCg.exe
  C:\Windows\System\fTgDdCg.exe
  2⤵
  PID:2512
- C:\Windows\System\AFTUeHn.exe
  C:\Windows\System\AFTUeHn.exe
  2⤵
  PID:6912
- C:\Windows\System\QLknDxb.exe
  C:\Windows\System\QLknDxb.exe
  2⤵
  PID:2292
- C:\Windows\System\isQUMlP.exe
  C:\Windows\System\isQUMlP.exe
  2⤵
  PID:4256
- C:\Windows\System\mnvGply.exe
  C:\Windows\System\mnvGply.exe
  2⤵
  PID:6732
- C:\Windows\System\EWIMoXw.exe
  C:\Windows\System\EWIMoXw.exe
  2⤵
  PID:3948
- C:\Windows\System\SLluXpO.exe
  C:\Windows\System\SLluXpO.exe
  2⤵
  PID:6548
- C:\Windows\System\GqGRyAe.exe
  C:\Windows\System\GqGRyAe.exe
  2⤵
  PID:6524
- C:\Windows\System\ROldLPJ.exe
  C:\Windows\System\ROldLPJ.exe
  2⤵
  PID:5268
- C:\Windows\System\AGubwSR.exe
  C:\Windows\System\AGubwSR.exe
  2⤵
  PID:4468
- C:\Windows\System\lKwjBfN.exe
  C:\Windows\System\lKwjBfN.exe
  2⤵
  PID:7176
- C:\Windows\System\SfZUedi.exe
  C:\Windows\System\SfZUedi.exe
  2⤵
  PID:7192
- C:\Windows\System\rEmYiQV.exe
  C:\Windows\System\rEmYiQV.exe
  2⤵
  PID:7208
- C:\Windows\System\hOrKISt.exe
  C:\Windows\System\hOrKISt.exe
  2⤵
  PID:7224
- C:\Windows\System\XvMndlE.exe
  C:\Windows\System\XvMndlE.exe
  2⤵
  PID:7240
- C:\Windows\System\bKOcENL.exe
  C:\Windows\System\bKOcENL.exe
  2⤵
  PID:7256
- C:\Windows\System\YYrZxHT.exe
  C:\Windows\System\YYrZxHT.exe
  2⤵
  PID:7272
- C:\Windows\System\qAKXBSz.exe
  C:\Windows\System\qAKXBSz.exe
  2⤵
  PID:7292
- C:\Windows\System\omadUty.exe
  C:\Windows\System\omadUty.exe
  2⤵
  PID:7308
- C:\Windows\System\VEMncqf.exe
  C:\Windows\System\VEMncqf.exe
  2⤵
  PID:7324
- C:\Windows\System\esniiqh.exe
  C:\Windows\System\esniiqh.exe
  2⤵
  PID:7340
- C:\Windows\System\cQtIVoW.exe
  C:\Windows\System\cQtIVoW.exe
  2⤵
  PID:7356
- C:\Windows\System\qoyNwfB.exe
  C:\Windows\System\qoyNwfB.exe
  2⤵
  PID:7372
- C:\Windows\System\QJBZtNY.exe
  C:\Windows\System\QJBZtNY.exe
  2⤵
  PID:7388
- C:\Windows\System\vCgiUEN.exe
  C:\Windows\System\vCgiUEN.exe
  2⤵
  PID:7412
- C:\Windows\System\qFRIYfq.exe
  C:\Windows\System\qFRIYfq.exe
  2⤵
  PID:7428
- C:\Windows\System\QMXJLWs.exe
  C:\Windows\System\QMXJLWs.exe
  2⤵
  PID:7444
- C:\Windows\System\ifOIrbz.exe
  C:\Windows\System\ifOIrbz.exe
  2⤵
  PID:7460
- C:\Windows\System\GeAOMZM.exe
  C:\Windows\System\GeAOMZM.exe
  2⤵
  PID:7476
- C:\Windows\System\AikXeNp.exe
  C:\Windows\System\AikXeNp.exe
  2⤵
  PID:7500
- C:\Windows\System\GuwjyMM.exe
  C:\Windows\System\GuwjyMM.exe
  2⤵
  PID:7516
- C:\Windows\System\oSkmcOb.exe
  C:\Windows\System\oSkmcOb.exe
  2⤵
  PID:7532
- C:\Windows\System\jDFOVfF.exe
  C:\Windows\System\jDFOVfF.exe
  2⤵
  PID:7548
- C:\Windows\System\CjcRQmh.exe
  C:\Windows\System\CjcRQmh.exe
  2⤵
  PID:7564
- C:\Windows\System\FpgJBHM.exe
  C:\Windows\System\FpgJBHM.exe
  2⤵
  PID:7584
- C:\Windows\System\UXUmiGF.exe
  C:\Windows\System\UXUmiGF.exe
  2⤵
  PID:7600
- C:\Windows\System\NqLtnwJ.exe
  C:\Windows\System\NqLtnwJ.exe
  2⤵
  PID:7616
- C:\Windows\System\YzgaPfn.exe
  C:\Windows\System\YzgaPfn.exe
  2⤵
  PID:7648
- C:\Windows\System\PuKNvZf.exe
  C:\Windows\System\PuKNvZf.exe
  2⤵
  PID:7696
- C:\Windows\System\RfeIpyH.exe
  C:\Windows\System\RfeIpyH.exe
  2⤵
  PID:7712
- C:\Windows\System\PcZTirb.exe
  C:\Windows\System\PcZTirb.exe
  2⤵
  PID:7728
- C:\Windows\System\EJmURlv.exe
  C:\Windows\System\EJmURlv.exe
  2⤵
  PID:7744
- C:\Windows\System\YGBRiHJ.exe
  C:\Windows\System\YGBRiHJ.exe
  2⤵
  PID:7760
- C:\Windows\System\vptzzTQ.exe
  C:\Windows\System\vptzzTQ.exe
  2⤵
  PID:7808
- C:\Windows\System\LXJcgaU.exe
  C:\Windows\System\LXJcgaU.exe
  2⤵
  PID:7824
- C:\Windows\System\SnEztOM.exe
  C:\Windows\System\SnEztOM.exe
  2⤵
  PID:7844
- C:\Windows\System\wNvygvc.exe
  C:\Windows\System\wNvygvc.exe
  2⤵
  PID:7860
- C:\Windows\System\tUItXog.exe
  C:\Windows\System\tUItXog.exe
  2⤵
  PID:7876
- C:\Windows\System\CwWboht.exe
  C:\Windows\System\CwWboht.exe
  2⤵
  PID:7896
- C:\Windows\System\gMiRukd.exe
  C:\Windows\System\gMiRukd.exe
  2⤵
  PID:7912
- C:\Windows\System\eVzitQF.exe
  C:\Windows\System\eVzitQF.exe
  2⤵
  PID:7928
- C:\Windows\System\aRGqMmH.exe
  C:\Windows\System\aRGqMmH.exe
  2⤵
  PID:7948
- C:\Windows\System\GLHNTyw.exe
  C:\Windows\System\GLHNTyw.exe
  2⤵
  PID:7964
- C:\Windows\System\jUUOCQl.exe
  C:\Windows\System\jUUOCQl.exe
  2⤵
  PID:7980
- C:\Windows\System\yjMzEQv.exe
  C:\Windows\System\yjMzEQv.exe
  2⤵
  PID:7996
- C:\Windows\System\eOYNNfp.exe
  C:\Windows\System\eOYNNfp.exe
  2⤵
  PID:8012
- C:\Windows\System\gssXIiO.exe
  C:\Windows\System\gssXIiO.exe
  2⤵
  PID:8028
- C:\Windows\System\elamVYt.exe
  C:\Windows\System\elamVYt.exe
  2⤵
  PID:8044
- C:\Windows\System\lIOVYzX.exe
  C:\Windows\System\lIOVYzX.exe
  2⤵
  PID:8060
- C:\Windows\System\rpAMuHT.exe
  C:\Windows\System\rpAMuHT.exe
  2⤵
  PID:8076
- C:\Windows\System\bqnYFJq.exe
  C:\Windows\System\bqnYFJq.exe
  2⤵
  PID:8092
- C:\Windows\System\TncnnHD.exe
  C:\Windows\System\TncnnHD.exe
  2⤵
  PID:8108
- C:\Windows\System\ZQsyBHs.exe
  C:\Windows\System\ZQsyBHs.exe
  2⤵
  PID:8124
- C:\Windows\System\TPUBiyD.exe
  C:\Windows\System\TPUBiyD.exe
  2⤵
  PID:8140
- C:\Windows\System\orkuaHo.exe
  C:\Windows\System\orkuaHo.exe
  2⤵
  PID:8156
- C:\Windows\System\wzXUnBW.exe
  C:\Windows\System\wzXUnBW.exe
  2⤵
  PID:8172
- C:\Windows\System\aBkmWhS.exe
  C:\Windows\System\aBkmWhS.exe
  2⤵
  PID:8188
- C:\Windows\System\dLhcpHI.exe
  C:\Windows\System\dLhcpHI.exe
  2⤵
  PID:5204
- C:\Windows\System\mnhTHkA.exe
  C:\Windows\System\mnhTHkA.exe
  2⤵
  PID:5588
- C:\Windows\System\ehNsMeF.exe
  C:\Windows\System\ehNsMeF.exe
  2⤵
  PID:7204
- C:\Windows\System\ORugJkk.exe
  C:\Windows\System\ORugJkk.exe
  2⤵
  PID:7264
- C:\Windows\System\sIatMyG.exe
  C:\Windows\System\sIatMyG.exe
  2⤵
  PID:7336
- C:\Windows\System\ZynNNmW.exe
  C:\Windows\System\ZynNNmW.exe
  2⤵
  PID:7400
- C:\Windows\System\tWkrSoO.exe
  C:\Windows\System\tWkrSoO.exe
  2⤵
  PID:7436
- C:\Windows\System\MajzvRH.exe
  C:\Windows\System\MajzvRH.exe
  2⤵
  PID:7468
- C:\Windows\System\QRWxUOw.exe
  C:\Windows\System\QRWxUOw.exe
  2⤵
  PID:7572
- C:\Windows\System\YEjuQEx.exe
  C:\Windows\System\YEjuQEx.exe
  2⤵
  PID:7612
- C:\Windows\System\ufShuZM.exe
  C:\Windows\System\ufShuZM.exe
  2⤵
  PID:2024
- C:\Windows\System\tojyqxM.exe
  C:\Windows\System\tojyqxM.exe
  2⤵
  PID:7248
- C:\Windows\System\fauuKmL.exe
  C:\Windows\System\fauuKmL.exe
  2⤵
  PID:7188
- C:\Windows\System\qrBoDFh.exe
  C:\Windows\System\qrBoDFh.exe
  2⤵
  PID:7280
- C:\Windows\System\VbuIXUX.exe
  C:\Windows\System\VbuIXUX.exe
  2⤵
  PID:7348
- C:\Windows\System\KgnUTjT.exe
  C:\Windows\System\KgnUTjT.exe
  2⤵
  PID:7452
- C:\Windows\System\gxfhiwr.exe
  C:\Windows\System\gxfhiwr.exe
  2⤵
  PID:7528
- C:\Windows\System\WGgxlOB.exe
  C:\Windows\System\WGgxlOB.exe
  2⤵
  PID:7596
- C:\Windows\System\aGDkuhc.exe
  C:\Windows\System\aGDkuhc.exe
  2⤵
  PID:7636
- C:\Windows\System\KrIYKBk.exe
  C:\Windows\System\KrIYKBk.exe
  2⤵
  PID:7660
- C:\Windows\System\uPCxzZR.exe
  C:\Windows\System\uPCxzZR.exe
  2⤵
  PID:7676
- C:\Windows\System\isCpKED.exe
  C:\Windows\System\isCpKED.exe
  2⤵
  PID:7720
- C:\Windows\System\mVjwhaT.exe
  C:\Windows\System\mVjwhaT.exe
  2⤵
  PID:7740
- C:\Windows\System\MRQuvLm.exe
  C:\Windows\System\MRQuvLm.exe
  2⤵
  PID:7804
- C:\Windows\System\GEuhAWY.exe
  C:\Windows\System\GEuhAWY.exe
  2⤵
  PID:7780
- C:\Windows\System\LuShdsl.exe
  C:\Windows\System\LuShdsl.exe
  2⤵
  PID:7796
- C:\Windows\System\stMkfwh.exe
  C:\Windows\System\stMkfwh.exe
  2⤵
  PID:7832
- C:\Windows\System\GFugxof.exe
  C:\Windows\System\GFugxof.exe
  2⤵
  PID:7888
- C:\Windows\System\drLhAjm.exe
  C:\Windows\System\drLhAjm.exe
  2⤵
  PID:7956
- C:\Windows\System\nrCmVev.exe
  C:\Windows\System\nrCmVev.exe
  2⤵
  PID:8020
- C:\Windows\System\KRgasVF.exe
  C:\Windows\System\KRgasVF.exe
  2⤵
  PID:8084
- C:\Windows\System\BosZXNV.exe
  C:\Windows\System\BosZXNV.exe
  2⤵
  PID:8148
- C:\Windows\System\awzZbDd.exe
  C:\Windows\System\awzZbDd.exe
  2⤵
  PID:6728
- C:\Windows\System\hgrQGiK.exe
  C:\Windows\System\hgrQGiK.exe
  2⤵
  PID:7368
- C:\Windows\System\ETmgmEB.exe
  C:\Windows\System\ETmgmEB.exe
  2⤵
  PID:7972
- C:\Windows\System\dArrvBy.exe
  C:\Windows\System\dArrvBy.exe
  2⤵
  PID:8104
- C:\Windows\System\BCeZbGZ.exe
  C:\Windows\System\BCeZbGZ.exe
  2⤵
  PID:7424
- C:\Windows\System\HUCzlOY.exe
  C:\Windows\System\HUCzlOY.exe
  2⤵
  PID:7840
- C:\Windows\System\pjHvnyL.exe
  C:\Windows\System\pjHvnyL.exe
  2⤵
  PID:7524
- C:\Windows\System\jFCRhOM.exe
  C:\Windows\System\jFCRhOM.exe
  2⤵
  PID:7908
- C:\Windows\System\eLtBTum.exe
  C:\Windows\System\eLtBTum.exe
  2⤵
  PID:7540
- C:\Windows\System\KeWKAyx.exe
  C:\Windows\System\KeWKAyx.exe
  2⤵
  PID:8036
- C:\Windows\System\vKqikNq.exe
  C:\Windows\System\vKqikNq.exe
  2⤵
  PID:7384
- C:\Windows\System\WYAjiKD.exe
  C:\Windows\System\WYAjiKD.exe
  2⤵
  PID:4128
- C:\Windows\System\FITrSKU.exe
  C:\Windows\System\FITrSKU.exe
  2⤵
  PID:7300
- C:\Windows\System\qosLFiZ.exe
  C:\Windows\System\qosLFiZ.exe
  2⤵
  PID:7544
- C:\Windows\System\MfXvmji.exe
  C:\Windows\System\MfXvmji.exe
  2⤵
  PID:7656
- C:\Windows\System\HspOPok.exe
  C:\Windows\System\HspOPok.exe
  2⤵
  PID:936
- C:\Windows\System\ZMffuLm.exe
  C:\Windows\System\ZMffuLm.exe
  2⤵
  PID:7856
- C:\Windows\System\yHhuLtn.exe
  C:\Windows\System\yHhuLtn.exe
  2⤵
  PID:8120
- C:\Windows\System\vXPEOzp.exe
  C:\Windows\System\vXPEOzp.exe
  2⤵
  PID:7232
- C:\Windows\System\DqajFLz.exe
  C:\Windows\System\DqajFLz.exe
  2⤵
  PID:8100
- C:\Windows\System\DYqKvVs.exe
  C:\Windows\System\DYqKvVs.exe
  2⤵
  PID:7872
- C:\Windows\System\necuOCw.exe
  C:\Windows\System\necuOCw.exe
  2⤵
  PID:7672
- C:\Windows\System\dvjNjbC.exe
  C:\Windows\System\dvjNjbC.exe
  2⤵
  PID:7628
- C:\Windows\System\pLWhJck.exe
  C:\Windows\System\pLWhJck.exe
  2⤵
  PID:7768
- C:\Windows\System\wuXJEvB.exe
  C:\Windows\System\wuXJEvB.exe
  2⤵
  PID:8180
- C:\Windows\System\yfdLFCt.exe
  C:\Windows\System\yfdLFCt.exe
  2⤵
  PID:8164
- C:\Windows\System\YxPkemf.exe
  C:\Windows\System\YxPkemf.exe
  2⤵
  PID:7940
- C:\Windows\System\IRCSkCZ.exe
  C:\Windows\System\IRCSkCZ.exe
  2⤵
  PID:3848
- C:\Windows\System\sTOAbjC.exe
  C:\Windows\System\sTOAbjC.exe
  2⤵
  PID:7692
- C:\Windows\System\jAWcKQY.exe
  C:\Windows\System\jAWcKQY.exe
  2⤵
  PID:7496
- C:\Windows\System\tFShSuG.exe
  C:\Windows\System\tFShSuG.exe
  2⤵
  PID:7644
- C:\Windows\System\UCAjzdl.exe
  C:\Windows\System\UCAjzdl.exe
  2⤵
  PID:7788
- C:\Windows\System\PtOqeWk.exe
  C:\Windows\System\PtOqeWk.exe
  2⤵
  PID:7320
- C:\Windows\System\xnoMqVn.exe
  C:\Windows\System\xnoMqVn.exe
  2⤵
  PID:7924
- C:\Windows\System\kaEMbRB.exe
  C:\Windows\System\kaEMbRB.exe
  2⤵
  PID:7868
- C:\Windows\System\SvbaQtk.exe
  C:\Windows\System\SvbaQtk.exe
  2⤵
  PID:7472
- C:\Windows\System\WYzIpUJ.exe
  C:\Windows\System\WYzIpUJ.exe
  2⤵
  PID:7988
- C:\Windows\System\uJaAONQ.exe
  C:\Windows\System\uJaAONQ.exe
  2⤵
  PID:8040
- C:\Windows\System\dOiIEry.exe
  C:\Windows\System\dOiIEry.exe
  2⤵
  PID:7508
- C:\Windows\System\vUjzYIy.exe
  C:\Windows\System\vUjzYIy.exe
  2⤵
  PID:7332
- C:\Windows\System\JmevLKr.exe
  C:\Windows\System\JmevLKr.exe
  2⤵
  PID:7484
- C:\Windows\System\lbrsGlD.exe
  C:\Windows\System\lbrsGlD.exe
  2⤵
  PID:7776
- C:\Windows\System\kubWbjr.exe
  C:\Windows\System\kubWbjr.exe
  2⤵
  PID:8196
- C:\Windows\System\OZimFmi.exe
  C:\Windows\System\OZimFmi.exe
  2⤵
  PID:8212
- C:\Windows\System\LlUUbML.exe
  C:\Windows\System\LlUUbML.exe
  2⤵
  PID:8228
- C:\Windows\System\hEsiLMz.exe
  C:\Windows\System\hEsiLMz.exe
  2⤵
  PID:8244
- C:\Windows\System\yyjOlYt.exe
  C:\Windows\System\yyjOlYt.exe
  2⤵
  PID:8260
- C:\Windows\System\pshdRdX.exe
  C:\Windows\System\pshdRdX.exe
  2⤵
  PID:8276
- C:\Windows\System\rKqJpsl.exe
  C:\Windows\System\rKqJpsl.exe
  2⤵
  PID:8292
- C:\Windows\System\ekstJHP.exe
  C:\Windows\System\ekstJHP.exe
  2⤵
  PID:8308
- C:\Windows\System\ITPjCqj.exe
  C:\Windows\System\ITPjCqj.exe
  2⤵
  PID:8324
- C:\Windows\System\pOKYJOk.exe
  C:\Windows\System\pOKYJOk.exe
  2⤵
  PID:8340
- C:\Windows\System\gyVkYZm.exe
  C:\Windows\System\gyVkYZm.exe
  2⤵
  PID:8356
- C:\Windows\System\GVOcmAl.exe
  C:\Windows\System\GVOcmAl.exe
  2⤵
  PID:8372
- C:\Windows\System\VwlVjcL.exe
  C:\Windows\System\VwlVjcL.exe
  2⤵
  PID:8388
- C:\Windows\System\kTrSFxH.exe
  C:\Windows\System\kTrSFxH.exe
  2⤵
  PID:8404
- C:\Windows\System\UAluMXO.exe
  C:\Windows\System\UAluMXO.exe
  2⤵
  PID:8420
- C:\Windows\System\XDoRoxA.exe
  C:\Windows\System\XDoRoxA.exe
  2⤵
  PID:8436
- C:\Windows\System\hrJhfDI.exe
  C:\Windows\System\hrJhfDI.exe
  2⤵
  PID:8452
- C:\Windows\System\jouGpuv.exe
  C:\Windows\System\jouGpuv.exe
  2⤵
  PID:8468
- C:\Windows\System\eyDsawV.exe
  C:\Windows\System\eyDsawV.exe
  2⤵
  PID:8484
- C:\Windows\System\IiJSpNl.exe
  C:\Windows\System\IiJSpNl.exe
  2⤵
  PID:8500
- C:\Windows\System\BDjLNvq.exe
  C:\Windows\System\BDjLNvq.exe
  2⤵
  PID:8516
- C:\Windows\System\mSKUYbe.exe
  C:\Windows\System\mSKUYbe.exe
  2⤵
  PID:8532
- C:\Windows\System\TceghxL.exe
  C:\Windows\System\TceghxL.exe
  2⤵
  PID:8548
- C:\Windows\System\LWrzAGo.exe
  C:\Windows\System\LWrzAGo.exe
  2⤵
  PID:8564
- C:\Windows\System\ZBpNwxk.exe
  C:\Windows\System\ZBpNwxk.exe
  2⤵
  PID:8584
- C:\Windows\System\ayzagPO.exe
  C:\Windows\System\ayzagPO.exe
  2⤵
  PID:8600
- C:\Windows\System\iXVuOLq.exe
  C:\Windows\System\iXVuOLq.exe
  2⤵
  PID:8616
- C:\Windows\System\UhEVzmR.exe
  C:\Windows\System\UhEVzmR.exe
  2⤵
  PID:8632
- C:\Windows\System\ABPiCgl.exe
  C:\Windows\System\ABPiCgl.exe
  2⤵
  PID:8648
- C:\Windows\System\DehsTQC.exe
  C:\Windows\System\DehsTQC.exe
  2⤵
  PID:8664
- C:\Windows\System\EINUMeS.exe
  C:\Windows\System\EINUMeS.exe
  2⤵
  PID:8680
- C:\Windows\System\kiLlVFP.exe
  C:\Windows\System\kiLlVFP.exe
  2⤵
  PID:8696
- C:\Windows\System\VcZjKDt.exe
  C:\Windows\System\VcZjKDt.exe
  2⤵
  PID:8712
- C:\Windows\System\mXFyYif.exe
  C:\Windows\System\mXFyYif.exe
  2⤵
  PID:8732
- C:\Windows\System\lZrRUoQ.exe
  C:\Windows\System\lZrRUoQ.exe
  2⤵
  PID:8748
- C:\Windows\System\HutzZLx.exe
  C:\Windows\System\HutzZLx.exe
  2⤵
  PID:8764
- C:\Windows\System\rOTmzAk.exe
  C:\Windows\System\rOTmzAk.exe
  2⤵
  PID:8780
- C:\Windows\System\cREFdIu.exe
  C:\Windows\System\cREFdIu.exe
  2⤵
  PID:8796
- C:\Windows\System\avgRhqn.exe
  C:\Windows\System\avgRhqn.exe
  2⤵
  PID:8812
- C:\Windows\System\ZPnMbBs.exe
  C:\Windows\System\ZPnMbBs.exe
  2⤵
  PID:8828
- C:\Windows\System\sxYVJuJ.exe
  C:\Windows\System\sxYVJuJ.exe
  2⤵
  PID:8844
- C:\Windows\System\ERrbyxA.exe
  C:\Windows\System\ERrbyxA.exe
  2⤵
  PID:8860
- C:\Windows\System\QNiizIz.exe
  C:\Windows\System\QNiizIz.exe
  2⤵
  PID:8876
- C:\Windows\System\nKfPoaO.exe
  C:\Windows\System\nKfPoaO.exe
  2⤵
  PID:8892
- C:\Windows\System\jVLpdIk.exe
  C:\Windows\System\jVLpdIk.exe
  2⤵
  PID:8920
- C:\Windows\System\mNIpYep.exe
  C:\Windows\System\mNIpYep.exe
  2⤵
  PID:8936
- C:\Windows\System\bXWwwpw.exe
  C:\Windows\System\bXWwwpw.exe
  2⤵
  PID:8956
- C:\Windows\System\TvaAyAZ.exe
  C:\Windows\System\TvaAyAZ.exe
  2⤵
  PID:8972
- C:\Windows\System\dOmsrpC.exe
  C:\Windows\System\dOmsrpC.exe
  2⤵
  PID:8992
- C:\Windows\System\tGJisPw.exe
  C:\Windows\System\tGJisPw.exe
  2⤵
  PID:9008
- C:\Windows\System\qJZybAA.exe
  C:\Windows\System\qJZybAA.exe
  2⤵
  PID:9028
- C:\Windows\System\yEKZdtQ.exe
  C:\Windows\System\yEKZdtQ.exe
  2⤵
  PID:9044
- C:\Windows\System\arWXBws.exe
  C:\Windows\System\arWXBws.exe
  2⤵
  PID:9064
- C:\Windows\System\oBXUANH.exe
  C:\Windows\System\oBXUANH.exe
  2⤵
  PID:9080
- C:\Windows\System\nRSoEMd.exe
  C:\Windows\System\nRSoEMd.exe
  2⤵
  PID:9096
- C:\Windows\System\SDquhUs.exe
  C:\Windows\System\SDquhUs.exe
  2⤵
  PID:8460
- C:\Windows\System\HJszcAp.exe
  C:\Windows\System\HJszcAp.exe
  2⤵
  PID:8528
- C:\Windows\System\gpHKPkZ.exe
  C:\Windows\System\gpHKPkZ.exe
  2⤵
  PID:8288
- C:\Windows\System\VmCWMeA.exe
  C:\Windows\System\VmCWMeA.exe
  2⤵
  PID:8596
- C:\Windows\System\jBDnNAI.exe
  C:\Windows\System\jBDnNAI.exe
  2⤵
  PID:8352
- C:\Windows\System\PdYOIVW.exe
  C:\Windows\System\PdYOIVW.exe
  2⤵
  PID:8608
- C:\Windows\System\ncRBTzk.exe
  C:\Windows\System\ncRBTzk.exe
  2⤵
  PID:8508
- C:\Windows\System\QoafuDc.exe
  C:\Windows\System\QoafuDc.exe
  2⤵
  PID:8576
- C:\Windows\System\oWEARlq.exe
  C:\Windows\System\oWEARlq.exe
  2⤵
  PID:8656
- C:\Windows\System\yrlHOdd.exe
  C:\Windows\System\yrlHOdd.exe
  2⤵
  PID:8612
- C:\Windows\System\STkbIaS.exe
  C:\Windows\System\STkbIaS.exe
  2⤵
  PID:8692
- C:\Windows\System\gFoZqSv.exe
  C:\Windows\System\gFoZqSv.exe
  2⤵
  PID:8704
- C:\Windows\System\QPpzvzU.exe
  C:\Windows\System\QPpzvzU.exe
  2⤵
  PID:8744
- C:\Windows\System\yJvGoqU.exe
  C:\Windows\System\yJvGoqU.exe
  2⤵
  PID:8820
- C:\Windows\System\QKRuePo.exe
  C:\Windows\System\QKRuePo.exe
  2⤵
  PID:8776
- C:\Windows\System\HXwWYWA.exe
  C:\Windows\System\HXwWYWA.exe
  2⤵
  PID:8840
- C:\Windows\System\sTsdZfK.exe
  C:\Windows\System\sTsdZfK.exe
  2⤵
  PID:7684
- C:\Windows\System\jtVyAsh.exe
  C:\Windows\System\jtVyAsh.exe
  2⤵
  PID:8904
- C:\Windows\System\LxjBEAH.exe
  C:\Windows\System\LxjBEAH.exe
  2⤵
  PID:5492
- C:\Windows\System\oIOZIJz.exe
  C:\Windows\System\oIOZIJz.exe
  2⤵
  PID:8916
- C:\Windows\System\jJXNxlD.exe
  C:\Windows\System\jJXNxlD.exe
  2⤵
  PID:8980
- C:\Windows\System\SUbHNks.exe
  C:\Windows\System\SUbHNks.exe
  2⤵
  PID:8964
- C:\Windows\System\OAsJuzM.exe
  C:\Windows\System\OAsJuzM.exe
  2⤵
  PID:9036
- C:\Windows\System\JJIJiej.exe
  C:\Windows\System\JJIJiej.exe
  2⤵
  PID:9040
- C:\Windows\System\OftWLlJ.exe
  C:\Windows\System\OftWLlJ.exe
  2⤵
  PID:9076
- C:\Windows\System\eSHwyrk.exe
  C:\Windows\System\eSHwyrk.exe
  2⤵
  PID:9088
- C:\Windows\System\UTvKRaV.exe
  C:\Windows\System\UTvKRaV.exe
  2⤵
  PID:9144
- C:\Windows\System\wnVRjNg.exe
  C:\Windows\System\wnVRjNg.exe
  2⤵
  PID:9128
- C:\Windows\System\Reudywa.exe
  C:\Windows\System\Reudywa.exe
  2⤵
  PID:9112
- C:\Windows\System\fqaKuaA.exe
  C:\Windows\System\fqaKuaA.exe
  2⤵
  PID:8236
- C:\Windows\System\ceBbPlq.exe
  C:\Windows\System\ceBbPlq.exe
  2⤵
  PID:7668
- C:\Windows\System\CycaTib.exe
  C:\Windows\System\CycaTib.exe
  2⤵
  PID:7492
- C:\Windows\System\YQfhwYc.exe
  C:\Windows\System\YQfhwYc.exe
  2⤵
  PID:9200
- C:\Windows\System\eVytpuS.exe
  C:\Windows\System\eVytpuS.exe
  2⤵
  PID:9184
- C:\Windows\System\ZIrOtEU.exe
  C:\Windows\System\ZIrOtEU.exe
  2⤵
  PID:9164
- C:\Windows\System\MHQOVnO.exe
  C:\Windows\System\MHQOVnO.exe
  2⤵
  PID:8252
- C:\Windows\System\etXcDxS.exe
  C:\Windows\System\etXcDxS.exe
  2⤵
  PID:8364
- C:\Windows\System\anOnidh.exe
  C:\Windows\System\anOnidh.exe
  2⤵
  PID:8400
- C:\Windows\System\wZuaojM.exe
  C:\Windows\System\wZuaojM.exe
  2⤵
  PID:9172
- C:\Windows\System\JitsWNI.exe
  C:\Windows\System\JitsWNI.exe
  2⤵
  PID:8492
- C:\Windows\System\sdriSan.exe
  C:\Windows\System\sdriSan.exe
  2⤵
  PID:8480
- C:\Windows\System\nBKbyZL.exe
  C:\Windows\System\nBKbyZL.exe
  2⤵
  PID:8624
- C:\Windows\System\ePhmnla.exe
  C:\Windows\System\ePhmnla.exe
  2⤵
  PID:8708
- C:\Windows\System\LtStpuT.exe
  C:\Windows\System\LtStpuT.exe
  2⤵
  PID:8884
- C:\Windows\System\IyvpgYs.exe
  C:\Windows\System\IyvpgYs.exe
  2⤵
  PID:2776
- C:\Windows\System\QxHiVzo.exe
  C:\Windows\System\QxHiVzo.exe
  2⤵
  PID:9004
- C:\Windows\System\ywZfxgE.exe
  C:\Windows\System\ywZfxgE.exe
  2⤵
  PID:9148
- C:\Windows\System\CigRxPV.exe
  C:\Windows\System\CigRxPV.exe
  2⤵
  PID:7184
- C:\Windows\System\jHNgrAW.exe
  C:\Windows\System\jHNgrAW.exe
  2⤵
  PID:8540
- C:\Windows\System\VJiFCyV.exe
  C:\Windows\System\VJiFCyV.exe
  2⤵
  PID:8640
- C:\Windows\System\ToktnNQ.exe
  C:\Windows\System\ToktnNQ.exe
  2⤵
  PID:8808
- C:\Windows\System\dsbuWGG.exe
  C:\Windows\System\dsbuWGG.exe
  2⤵
  PID:8592
- C:\Windows\System\UIToUHI.exe
  C:\Windows\System\UIToUHI.exe
  2⤵
  PID:352
- C:\Windows\System\zHOBcbs.exe
  C:\Windows\System\zHOBcbs.exe
  2⤵
  PID:9020
- C:\Windows\System\UNzEawK.exe
  C:\Windows\System\UNzEawK.exe
  2⤵
  PID:9136
- C:\Windows\System\xwpHXFl.exe
  C:\Windows\System\xwpHXFl.exe
  2⤵
  PID:7408
- C:\Windows\System\HnjZnQG.exe
  C:\Windows\System\HnjZnQG.exe
  2⤵
  PID:9188
- C:\Windows\System\KFcrzhZ.exe
  C:\Windows\System\KFcrzhZ.exe
  2⤵
  PID:9160
- C:\Windows\System\UMbUEyJ.exe
  C:\Windows\System\UMbUEyJ.exe
  2⤵
  PID:8396
- C:\Windows\System\IeifJVv.exe
  C:\Windows\System\IeifJVv.exe
  2⤵
  PID:8224
- C:\Windows\System\dloKuqD.exe
  C:\Windows\System\dloKuqD.exe
  2⤵
  PID:8444
- C:\Windows\System\RGAnsNL.exe
  C:\Windows\System\RGAnsNL.exe
  2⤵
  PID:8524
- C:\Windows\System\QxPESmd.exe
  C:\Windows\System\QxPESmd.exe
  2⤵
  PID:9152
- C:\Windows\System\CwaQffb.exe
  C:\Windows\System\CwaQffb.exe
  2⤵
  PID:8788
- C:\Windows\System\mEzuBub.exe
  C:\Windows\System\mEzuBub.exe
  2⤵
  PID:8688
- C:\Windows\System\aCuMErl.exe
  C:\Windows\System\aCuMErl.exe
  2⤵
  PID:9168
- C:\Windows\System\VvDLTKr.exe
  C:\Windows\System\VvDLTKr.exe
  2⤵
  PID:9016
- C:\Windows\System\xCjUxFq.exe
  C:\Windows\System\xCjUxFq.exe
  2⤵
  PID:8560
- C:\Windows\System\hUJcykV.exe
  C:\Windows\System\hUJcykV.exe
  2⤵
  PID:2712
- C:\Windows\System\VxelEkx.exe
  C:\Windows\System\VxelEkx.exe
  2⤵
  PID:9116
- C:\Windows\System\Uylbpad.exe
  C:\Windows\System\Uylbpad.exe
  2⤵
  PID:8724
- C:\Windows\System\eyKDyzG.exe
  C:\Windows\System\eyKDyzG.exe
  2⤵
  PID:8836
- C:\Windows\System\leAxArD.exe
  C:\Windows\System\leAxArD.exe
  2⤵
  PID:8320
- C:\Windows\System\hutzrEL.exe
  C:\Windows\System\hutzrEL.exe
  2⤵
  PID:8872
- C:\Windows\System\ZMKVXYX.exe
  C:\Windows\System\ZMKVXYX.exe
  2⤵
  PID:8928
- C:\Windows\System\qAtpEci.exe
  C:\Windows\System\qAtpEci.exe
  2⤵
  PID:8772
- C:\Windows\System\gwoDYiN.exe
  C:\Windows\System\gwoDYiN.exe
  2⤵
  PID:9224
- C:\Windows\System\pVGuEix.exe
  C:\Windows\System\pVGuEix.exe
  2⤵
  PID:9240
- C:\Windows\System\YCnZCNr.exe
  C:\Windows\System\YCnZCNr.exe
  2⤵
  PID:9256
- C:\Windows\System\LQyTwqF.exe
  C:\Windows\System\LQyTwqF.exe
  2⤵
  PID:9272
- C:\Windows\System\xNPDOln.exe
  C:\Windows\System\xNPDOln.exe
  2⤵
  PID:9288
- C:\Windows\System\SmEbUJm.exe
  C:\Windows\System\SmEbUJm.exe
  2⤵
  PID:9304
- C:\Windows\System\vVMjkpv.exe
  C:\Windows\System\vVMjkpv.exe
  2⤵
  PID:9320
- C:\Windows\System\IIsfSeD.exe
  C:\Windows\System\IIsfSeD.exe
  2⤵
  PID:9336
- C:\Windows\System\IGGdKto.exe
  C:\Windows\System\IGGdKto.exe
  2⤵
  PID:9352
- C:\Windows\System\aYQPwzn.exe
  C:\Windows\System\aYQPwzn.exe
  2⤵
  PID:9368
- C:\Windows\System\MDeUJZo.exe
  C:\Windows\System\MDeUJZo.exe
  2⤵
  PID:9388
- C:\Windows\System\kGehYXE.exe
  C:\Windows\System\kGehYXE.exe
  2⤵
  PID:9416
- C:\Windows\System\bwlpfqM.exe
  C:\Windows\System\bwlpfqM.exe
  2⤵
  PID:9432
- C:\Windows\System\koYrTqO.exe
  C:\Windows\System\koYrTqO.exe
  2⤵
  PID:9448
- C:\Windows\System\jnDmaEM.exe
  C:\Windows\System\jnDmaEM.exe
  2⤵
  PID:9464
- C:\Windows\System\DepKSCO.exe
  C:\Windows\System\DepKSCO.exe
  2⤵
  PID:9480
- C:\Windows\System\TxwrjHb.exe
  C:\Windows\System\TxwrjHb.exe
  2⤵
  PID:9496
- C:\Windows\System\EYJeEMU.exe
  C:\Windows\System\EYJeEMU.exe
  2⤵
  PID:9512
- C:\Windows\System\uvmwRrl.exe
  C:\Windows\System\uvmwRrl.exe
  2⤵
  PID:9528
- C:\Windows\System\QjCoyYk.exe
  C:\Windows\System\QjCoyYk.exe
  2⤵
  PID:9544
- C:\Windows\System\jSPnQpR.exe
  C:\Windows\System\jSPnQpR.exe
  2⤵
  PID:9560
- C:\Windows\System\EURgNjP.exe
  C:\Windows\System\EURgNjP.exe
  2⤵
  PID:9576
- C:\Windows\System\frjMnqn.exe
  C:\Windows\System\frjMnqn.exe
  2⤵
  PID:9592
- C:\Windows\System\KMSpiPu.exe
  C:\Windows\System\KMSpiPu.exe
  2⤵
  PID:9608
- C:\Windows\System\snQZCcm.exe
  C:\Windows\System\snQZCcm.exe
  2⤵
  PID:9624
- C:\Windows\System\XVSRCHi.exe
  C:\Windows\System\XVSRCHi.exe
  2⤵
  PID:9640
- C:\Windows\System\tjVPDCh.exe
  C:\Windows\System\tjVPDCh.exe
  2⤵
  PID:9656
- C:\Windows\System\IIJdQyP.exe
  C:\Windows\System\IIJdQyP.exe
  2⤵
  PID:9672
- C:\Windows\System\jJCvoxd.exe
  C:\Windows\System\jJCvoxd.exe
  2⤵
  PID:9688
- C:\Windows\System\SHlbhwF.exe
  C:\Windows\System\SHlbhwF.exe
  2⤵
  PID:9704
- C:\Windows\System\rCViPeJ.exe
  C:\Windows\System\rCViPeJ.exe
  2⤵
  PID:9720
- C:\Windows\System\FziYAhi.exe
  C:\Windows\System\FziYAhi.exe
  2⤵
  PID:9736
- C:\Windows\System\iNmzNdz.exe
  C:\Windows\System\iNmzNdz.exe
  2⤵
  PID:9752
- C:\Windows\System\ssGHrgC.exe
  C:\Windows\System\ssGHrgC.exe
  2⤵
  PID:9768
- C:\Windows\System\IxrMcVS.exe
  C:\Windows\System\IxrMcVS.exe
  2⤵
  PID:9784
- C:\Windows\System\ddzdhDU.exe
  C:\Windows\System\ddzdhDU.exe
  2⤵
  PID:9800
- C:\Windows\System\DYTUUZy.exe
  C:\Windows\System\DYTUUZy.exe
  2⤵
  PID:9816
- C:\Windows\System\HSCkqBZ.exe
  C:\Windows\System\HSCkqBZ.exe
  2⤵
  PID:9832
- C:\Windows\System\tzRwFmt.exe
  C:\Windows\System\tzRwFmt.exe
  2⤵
  PID:9848
- C:\Windows\System\XBywksY.exe
  C:\Windows\System\XBywksY.exe
  2⤵
  PID:9864
- C:\Windows\System\KJYcHnN.exe
  C:\Windows\System\KJYcHnN.exe
  2⤵
  PID:9880
- C:\Windows\System\GNRgnYi.exe
  C:\Windows\System\GNRgnYi.exe
  2⤵
  PID:9896
- C:\Windows\System\ufAenKm.exe
  C:\Windows\System\ufAenKm.exe
  2⤵
  PID:9912
- C:\Windows\System\qZcfEfM.exe
  C:\Windows\System\qZcfEfM.exe
  2⤵
  PID:9928
- C:\Windows\System\KMoQRiK.exe
  C:\Windows\System\KMoQRiK.exe
  2⤵
  PID:9944
- C:\Windows\System\UVbpygw.exe
  C:\Windows\System\UVbpygw.exe
  2⤵
  PID:9960
- C:\Windows\System\LNBwFUT.exe
  C:\Windows\System\LNBwFUT.exe
  2⤵
  PID:9976
- C:\Windows\System\HYUnKno.exe
  C:\Windows\System\HYUnKno.exe
  2⤵
  PID:9992
- C:\Windows\System\BBTtyDC.exe
  C:\Windows\System\BBTtyDC.exe
  2⤵
  PID:10008
- C:\Windows\System\XkLbsEI.exe
  C:\Windows\System\XkLbsEI.exe
  2⤵
  PID:10024
- C:\Windows\System\cYdLgiO.exe
  C:\Windows\System\cYdLgiO.exe
  2⤵
  PID:10040
- C:\Windows\System\vvOhOFH.exe
  C:\Windows\System\vvOhOFH.exe
  2⤵
  PID:10056
- C:\Windows\System\xstrJBn.exe
  C:\Windows\System\xstrJBn.exe
  2⤵
  PID:10072
- C:\Windows\System\OyaZbqo.exe
  C:\Windows\System\OyaZbqo.exe
  2⤵
  PID:10088
- C:\Windows\System\EimtXdY.exe
  C:\Windows\System\EimtXdY.exe
  2⤵
  PID:10104
- C:\Windows\System\FYtkOzc.exe
  C:\Windows\System\FYtkOzc.exe
  2⤵
  PID:10120
- C:\Windows\System\IBxhHLx.exe
  C:\Windows\System\IBxhHLx.exe
  2⤵
  PID:10136
- C:\Windows\System\sePxweh.exe
  C:\Windows\System\sePxweh.exe
  2⤵
  PID:10152
- C:\Windows\System\lDqbJtK.exe
  C:\Windows\System\lDqbJtK.exe
  2⤵
  PID:10172
- C:\Windows\System\SkldHJW.exe
  C:\Windows\System\SkldHJW.exe
  2⤵
  PID:10188
- C:\Windows\System\qerTFPG.exe
  C:\Windows\System\qerTFPG.exe
  2⤵
  PID:10204
- C:\Windows\System\cHPaMSR.exe
  C:\Windows\System\cHPaMSR.exe
  2⤵
  PID:10220
- C:\Windows\System\NWQljke.exe
  C:\Windows\System\NWQljke.exe
  2⤵
  PID:10236
- C:\Windows\System\kpEUUDB.exe
  C:\Windows\System\kpEUUDB.exe
  2⤵
  PID:9252
- C:\Windows\System\osNSxaO.exe
  C:\Windows\System\osNSxaO.exe
  2⤵
  PID:1568
- C:\Windows\System\SASgRFH.exe
  C:\Windows\System\SASgRFH.exe
  2⤵
  PID:9264
- C:\Windows\System\NBaswvP.exe
  C:\Windows\System\NBaswvP.exe
  2⤵
  PID:9344
- C:\Windows\System\RlcuUpX.exe
  C:\Windows\System\RlcuUpX.exe
  2⤵
  PID:9296
- C:\Windows\System\knXmrFu.exe
  C:\Windows\System\knXmrFu.exe
  2⤵
  PID:9332
- C:\Windows\System\HhpwAug.exe
  C:\Windows\System\HhpwAug.exe
  2⤵
  PID:8912
- C:\Windows\System\zgwSQIt.exe
  C:\Windows\System\zgwSQIt.exe
  2⤵
  PID:9424
- C:\Windows\System\cCsTDmH.exe
  C:\Windows\System\cCsTDmH.exe
  2⤵
  PID:9460
- C:\Windows\System\ahehyyV.exe
  C:\Windows\System\ahehyyV.exe
  2⤵
  PID:9444
- C:\Windows\System\sdhvQLv.exe
  C:\Windows\System\sdhvQLv.exe
  2⤵
  PID:9520
- C:\Windows\System\ukhNkrU.exe
  C:\Windows\System\ukhNkrU.exe
  2⤵
  PID:9584
- C:\Windows\System\jTNGnGY.exe
  C:\Windows\System\jTNGnGY.exe
  2⤵
  PID:9620
- C:\Windows\System\TAqwXhE.exe
  C:\Windows\System\TAqwXhE.exe
  2⤵
  PID:9652
- C:\Windows\System\zoilzCt.exe
  C:\Windows\System\zoilzCt.exe
  2⤵
  PID:9716
- C:\Windows\System\cCCgnNV.exe
  C:\Windows\System\cCCgnNV.exe
  2⤵
  PID:9780
- C:\Windows\System\CUCSAXP.exe
  C:\Windows\System\CUCSAXP.exe
  2⤵
  PID:10068
- C:\Windows\System\lWcsSSY.exe
  C:\Windows\System\lWcsSSY.exe
  2⤵
  PID:10128
- C:\Windows\System\XybvGEO.exe
  C:\Windows\System\XybvGEO.exe
  2⤵
  PID:10196
- C:\Windows\System\lnZVOKZ.exe
  C:\Windows\System\lnZVOKZ.exe
  2⤵
  PID:10228
- C:\Windows\System\NMzLilv.exe
  C:\Windows\System\NMzLilv.exe
  2⤵
  PID:9108
- C:\Windows\System\tNOiQHg.exe
  C:\Windows\System\tNOiQHg.exe
  2⤵
  PID:10148
- C:\Windows\System\iUZrrtw.exe
  C:\Windows\System\iUZrrtw.exe
  2⤵
  PID:10212
- C:\Windows\System\ABGKmGA.exe
  C:\Windows\System\ABGKmGA.exe
  2⤵
  PID:9236
- C:\Windows\System\UzZOlYq.exe
  C:\Windows\System\UzZOlYq.exe
  2⤵
  PID:9300

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CAsEoNT.exe

Filesize
2.2MB

MD5
4a80c9475c77b1bf2cfc5885eb1147d0

SHA1
a638988105273bd30560db0adee0353b9dcc90fb

SHA256
f9623e98e4885e87cb031a203e95436e91f2518f2638fa7808e9d17a0e667ff5

SHA512
e4dbbb6a5d5ffb16ab5506395006e1edcbd0d1adc2cea53a23cac7dd6c659f7cf54a799369a67be07ee28144d800d3505095f934c1a87be5e722a9c2ac9e0a36

Download Submit
C:\Windows\system\CcMuzqF.exe

Filesize
2.2MB

MD5
d5c55cd1221945550f56896c2bc0cc65

SHA1
b2320f2713c44ab4055449844868ce39ed6b5840

SHA256
76fa8fc90d90f9cee177cc5041c2af31c7a1ffd18cc8f95ce226cee7ddb02fbf

SHA512
1c4996df7a251f8d0dd3b62af3fde1e78b64ba66b849862ce38ba45e617b0f9450c6ad11b374e75ee1430f7093eb25ee7b3afb7704ba7b2cbbe68f6bd8bde9bb

Download Submit
C:\Windows\system\GoEWgaz.exe

Filesize
2.2MB

MD5
30ab6a2af033493be51a17257dbda203

SHA1
46130d1aa6a62df75d389619518109166c834c27

SHA256
fe2cf5965125b1e679923c79531dc12d46943be78076b1c507353f0dd32df143

SHA512
e8e0841c739b397fd548bb764db517336fa76591b5afab0486c6b2fcd32c4e91e6a321ac6799a8293511d769bc36961cbc8ab3a6c7d40bc4068026958980601d

Download Submit
C:\Windows\system\JsnreHF.exe

Filesize
2.2MB

MD5
f4ea362264afd17739a3d8e1acbd1f58

SHA1
4337c467026741a612ae5d9fa40a93ad69e635b3

SHA256
52aa4acc7f88b9330305c5f34f95e9551ec1642a788bc61993a87ab6cd1c064a

SHA512
0aab335c47b58f92c576b5872e25281fbd5c3b738fcb9aba4c290f6b7a93ab1c0f31e9ac81d66b151a6e5bece795d3ebb0c4f220134e6b70bc1bcf55165b6d6b

Download Submit
C:\Windows\system\LvfMJon.exe

Filesize
2.2MB

MD5
bc1f74c453f279dac1cf00bb1f01aa74

SHA1
dc50a6067bea159506d4ce94782669d710f5ab7b

SHA256
45d5b75997d77c3979d4122a64f8ef4ab9a2e305302ec781754de9b83bb8454d

SHA512
7b1d3c9995a33d0e4dc39299eea578a887f44307bf78c2297c4ce9ce7e653694473190dec57d3b8512cb5879e65dbde9af1ebc35c27396e5228a5f8d62fe1179

Download Submit
C:\Windows\system\NZHAABg.exe

Filesize
2.2MB

MD5
2d8fbddc4315910b386d493d75422e49

SHA1
7e3c66a83ed3c5e7e7670a166d1a2a25911dd2c7

SHA256
3a75576915af87337d675b82d93bec04def712f0b2b0d768e5c57a3d561a8155

SHA512
12b2102604c612fd53f792def6c429e32f49f2a49d5c2af3595dbee12c3752be1777970b56a4a0d32e5bc79e5fc286c63941bad7f3c977339fad6d7fbf871d12

Download Submit
C:\Windows\system\SHHAwPT.exe

Filesize
2.2MB

MD5
07a217a0750a882a70105cedf3bba42e

SHA1
e576e5618c2603e171854e66449c0fd9bfe859d2

SHA256
3392160b04a26221ca74ea975af857c71fc6b2b5001af6600dc9aeb17e9c83b1

SHA512
7a4ea51149942bcf95e3c7f5f480afc2e584145d1b77f956509147b129ce5145293f68f6d1eed2a88c42aa3a2715c1deb79e77aa88e03b20cf31be857310be7b

Download Submit
C:\Windows\system\UfpUVCU.exe

Filesize
2.2MB

MD5
bb1a190f48e6a4f76f6110748066a586

SHA1
ef8832a5ad23ad82bf79d749b02ce1f51eed3be8

SHA256
7196de2246fb3f2db6687ffc2fa4204b339de09928d32a1878e87ce0d990ad8a

SHA512
cc47b0b9396f35573590c3f830fe94cffb49c95358eed7a1d6d695517ca1fead984898ac37801f5e23a7f04ecdd018dd66e56b25f59eeb97479ecaebfff0cfbf

Download Submit
C:\Windows\system\atpFrkr.exe

Filesize
2.2MB

MD5
5204c619d72226062b5c359acaa28d42

SHA1
ae892fc85a5c6120c41e3a064779eae90a42bb47

SHA256
a3522b6a8010cefa319c23031ee993ffb6fedd05be72167d89c8f4cd62c8cc22

SHA512
fd93aaf03c33cdc16431dd42c63a95fd38718b836a9ece66ff88a93353e6f325aa85e7f21c180842d72f398f6d7734873e72f7679895d975067b16e749472481

Download Submit
C:\Windows\system\dUPMvVG.exe

Filesize
2.2MB

MD5
80e978dbb25aef09003357679f18be13

SHA1
4be748054a7fd42000e01174156a2f5f1bb83cf9

SHA256
49e25b8d10728cef8eb59de879228a9aa63ba8b29ee876a5963ddd20b8f85b15

SHA512
c4d85376a5b76bd6122c10c568852c8748f860b79073dc1da7e28e556c55d8b23f77c1dba642e2618e6dfa78d2aeac365ad4421fac82fcff7bdc21f3ba87f1d0

Download Submit
C:\Windows\system\fSmHPyN.exe

Filesize
2.2MB

MD5
eb49912e16cc347d9edf0529051c33f0

SHA1
35e771624e169f43dff290cdcd1f8879dd63d43d

SHA256
25491ace8f73f56eda014db40165e23da36e6e0ef555fd74593c6692326f6875

SHA512
c1201bdbcec9a80cd018ffcb8b6b6ac597d81e576916fbd7402e570a3e9ed50cb570e189278d53853116d9e3fb6d1d20c320525d252060d51a076c6e9738419b

Download Submit
C:\Windows\system\jLosiBr.exe

Filesize
2.2MB

MD5
076ede5d72878734343830f18939919f

SHA1
1651095bfdead004fa46381406a608aa51913912

SHA256
8099fb007afd10665d638e00bc930d94c35a1c05e2eeeb9e0b7bfb06a933e7ce

SHA512
721ba926766f3a4ffa0a6d6072c3175484271f3c6dee011eddbd56d569212fb78d37c157aee8b6901a8bf9048e3e51344519c4201d58264f9a43e6dc19e25164

Download Submit
C:\Windows\system\jNfjJeL.exe

Filesize
2.2MB

MD5
f287ea8db2eb6dc0898bde598a9ca131

SHA1
709b7641a66c59b061259b82a79b8acac05e2a30

SHA256
942bb89351d160dd89797a121aff001a1f164ad2df07db81136055e410888259

SHA512
35459af26133c5f0b9c72d359a5a31228dd156a29d40b033f612ae21075e1dab8487d8d0239525cd42058a76b28dbaad559bc7e8f7abebf68657f64074739f15

Download Submit
C:\Windows\system\kzDSvGX.exe

Filesize
2.2MB

MD5
3e1e857f5499d168aefb8bdd69c6ea41

SHA1
94d51df586e0c166cb82c19c406e57a1365c83be

SHA256
09ae5719a30684b6e22cd08d693248bf426d757302a15fceb8e4541c9930f301

SHA512
0983a4e948a9eac948a28fa7aeec300b981c2442e316926383f8d240818f1b75ea98e84532ab1af8dbaa2eed286a1717c1bb5400ae2454166dab8280d1fca123

Download Submit
C:\Windows\system\oTXZRcl.exe

Filesize
2.2MB

MD5
5c497b765e16a7b5ec4723e87e375495

SHA1
f2c22db243b07486e5cfa7a524d325e0156ec85e

SHA256
59702d8124c9c8d6f3e0d2339240f6da34750be76c591aa1fa6f9ee1a0f4ff0e

SHA512
0b9f527c4e0e7b44b17359be3e21a4994d4b41e52af3190526136c895856d3d396bdc01ea093f2dac24b2b95e8dedc7d499b1b5c4d9740ec3ec0419d61e33ca7

Download Submit
C:\Windows\system\qQeuepa.exe

Filesize
2.2MB

MD5
68b78d3ca1a556be1efb8c253bcb29a0

SHA1
7a5886c7a87333ed4bb0e53da57031e8e5f3f76c

SHA256
a6a7ac80dad8fc19e8ae39c93670d6645aa5e26ab5406fbba57996d399eaf190

SHA512
3d95aacdf9731e45d7a33d2a6433435aa1241ed6b4259a8fe846baf1ec7334df977a62fd81fbde7e4635524dbbb4b85861a12136505002e68a1c3022d9f7651f

Download Submit
C:\Windows\system\qTghexN.exe

Filesize
2.2MB

MD5
495d2a8e298ea0c9d8438ad24d1cc2e9

SHA1
d9fa60462e94e4507f31ea5fc03a9f208467aa31

SHA256
012bbbe422f97ff74bb702d5276bbc42a04958dd8afda94e769e1b9eb09f125f

SHA512
217de053dea3392f6304e622b5c14932c1fab04dae20e45ba54dbf34ddf8549ac89ecc25a5be41fcd5a65bacaa0b75899fa43d6bd398a871636eb5ae8fe18afd

Download Submit
C:\Windows\system\wPSCNpe.exe

Filesize
2.2MB

MD5
6c8c7e23c07582cc27bae76d2f86f712

SHA1
e6205902639681e134daac364a184745282291fd

SHA256
c08f707cffb8d36dcc2ce5ff3a7fecd8701a9d0c5a45682630f9f2f2806f4798

SHA512
b3d3fe58dd68e7de08b05a5fb1605b3028adc8547605ad75b0ac0310abaad319c941a0f1fb8d0eb57f2f5ae2c33f387cc45dedeee3729209ac1ba2aa363d2e2c

Download Submit
C:\Windows\system\wPVJzdx.exe

Filesize
2.2MB

MD5
4b8660eb36307c1064b67ace5c0dfc07

SHA1
236b33981c9badc6097a0017ef9b580f0375ce86

SHA256
6b6c4adb7edb9a8f1617845798271b2546c757f58f6081d7bf2602a3f2812f33

SHA512
625f2b096227186e1f0dec525f95f986551849e62d61f7341612079d83c144c78fc085adc5e0a873b447ee0ca7b0f1e90279539e900940ec83ec2a348c1b56fd

Download Submit
C:\Windows\system\yjFAHho.exe

Filesize
2.2MB

MD5
0fe147dd84ed1a316ca05605eb06e97b

SHA1
e5452925657db511866318ac5bc0f5262d395864

SHA256
f87d5c9ba520e516be4971c8a922ee0cf449b812e5a48241e245294ad1aff235

SHA512
3cf08d7d6f508a03addebe5aa169e57f9c0b73cf13c4b4323e630cf7d27a12c01da8dd440446926b624937628df2f5991a94c4f58c5a5177b425c21d120a9e30

Download Submit
C:\Windows\system\zDVmdkd.exe

Filesize
2.2MB

MD5
06462a7d05853f89dfd0e46b44dffb0b

SHA1
285911a6bce2121e0aa92316f7bbb4fa1adc9a46

SHA256
e1ec9d92a1f1122a01656d6c640f7391484900892e318bbb7666bd4514c5dfd5

SHA512
8459d9245a1ec17b1393dd8d4c907315d852f5670bb7be496d2da595fb4732611f2dca035082edc27e6a0488331b40e0630a556f1dc4472272d87a3acf53bf0c

Download Submit
C:\Windows\system\zUuHiBq.exe

Filesize
2.2MB

MD5
508c83e74c9634ad8a51f208fca33dbd

SHA1
a70445001098ef7f4b8f33086b9e0aeca8ffe0c8

SHA256
919ddfe419e5ea458551f08c6fd8453a85679da6c3735d7b3bf826067cbc680b

SHA512
4c41fe370110df9f2c4726543af3876f2d6e048dca3a42240f94981868834eea15772f151c1b7b16842fc996d5a79bb2e577b67a77380c481d37eda66d48aa0d

Download Submit
\Windows\system\CmjLrEl.exe

Filesize
2.2MB

MD5
86fee08151a5acb6b203eb03083aec02

SHA1
a04f34ba49349fb06d68763ce7ee04627399eeb4

SHA256
140fe68692f1a861184ef64882dbba71388df2d0d10372c9c17145d137892339

SHA512
a429fcde8c7c5b1a667023bd345bc9236e02f66d6340cee2a58f308df2532855acbba5233916eb4ecdc2294c3f81d258284597d822e6ea5ce2678b4e5e538762

Download Submit
\Windows\system\InBHMed.exe

Filesize
2.2MB

MD5
3c97b18ce1d7baef82e4c4dc051905e9

SHA1
2043833577c80b427811af24dd6488042e4d6b84

SHA256
b07b2780da6cf930c5b69e16004917cb208b151125e08d537cca325a75e692e3

SHA512
3b8d7c56ad10cc91c15d606d72d1a25d13c52ab27d10e8d66080d8a4fa75ff3485c805306dde47f6a083bb14a6ea688398bbe4807a20dfca16105e0455e2a646

Download Submit
\Windows\system\KIAKplM.exe

Filesize
2.2MB

MD5
143e5dade4e2528ad8c308ce19fd6fbe

SHA1
35c6e147c47b1e582cd7804495fed60085cb9c67

SHA256
e1be9848dd0c7b5fa06198d642b5885be1366c02afb4e354e2bbfb299b5710bf

SHA512
f198397e8289cb7f5ce35bc58e1958e6f04a5ab85fa5e3ea594fabf968423b30a07017f0b573a36bec7d0e3b53fbba0d69c95ba6406939a76d888b81fd6762af

Download Submit
\Windows\system\KWUVdlL.exe

Filesize
2.2MB

MD5
6c57689b56fc522242e11dc31a6af83f

SHA1
006dec57ce3600b01a3c231323bc0df8c9d03f5d

SHA256
2934b38089899b70c32253e3d0c7e4fb2f666da67d7476fe95ad279646396499

SHA512
191410cb17b8d836ccc816017df4da7b836bbaef284c645eb4959d703816acf12cc0c0899d2e291a410950b039282967c2b94c9646f1945d9a4f8cda88bc7612

Download Submit
\Windows\system\RSBIbMf.exe

Filesize
2.2MB

MD5
63978de60d758efd01663a7de5cf69ac

SHA1
1d4c76b808e689a37b4eeea1418ed511eb0730df

SHA256
4c219e1b98834768d717aff13b2a67965e6f321a822ade4317656b2ce4f15903

SHA512
0769d29f0c9c00a23295fc6a178684ce5c3a41e9583db550290466117d0fdd66f43337439b9632f8fc39eabdef727f7a2bfb0873566b5a06bfc5efc91387125d

Download Submit
\Windows\system\RgsmgXS.exe

Filesize
2.2MB

MD5
d2e609c210107912b221e87c7b8be8c4

SHA1
fd52dad6640ac05fda1bba555ee50799bfc0d7ce

SHA256
f3d4935d1444a2277da54a088cd68ac001ac2e8cdad84a0ccb0aed5ecbe4b390

SHA512
2fbb879f5980592b3c4df4b58b971263fa7cc997f2b84b36df3b2cb88960e6e9b7599d8c0e9d14b1e1708a76f4de2453fb0a82c9e0291c15d26f8699814fd281

Download Submit
\Windows\system\gBZcBxH.exe

Filesize
2.2MB

MD5
e51b38434584c967f01b4b077279f940

SHA1
1e70352a0039f828026b81e5160d169ee0154ea9

SHA256
703cda4735aadfe70339c549f16c581f4b13d5bfea5ea2921121db57542eae2a

SHA512
8cc1939f4e91a7cb7f418300275840abf81ef5ad29d62083fb01c7410f82fa6a158d63180e0e2bcb890af291f8c1b4ffb448dc23b990b6680c5a78c406eeb420

Download Submit
\Windows\system\mHNoGpu.exe

Filesize
2.2MB

MD5
6001e60032b52efb17822bc73e42d1ba

SHA1
b4672e0333df16e836de871e22f6887f77827413

SHA256
45bb85b6135a72c15973e94a6789f0beccc6a3b5eeb3cde7a684aea983bfb52e

SHA512
1321395a7f336c5e436d18ae1184879e5ab2ad587c01c0ea3f0812b4488634dc51818036bee954ada4bf78b1e44bb13369432c19717d35bc6bd7edcac6c2daaf

Download Submit
\Windows\system\riuTWos.exe

Filesize
2.2MB

MD5
4de0b2904fd9c012db4bd0a7c0f5e026

SHA1
03c097bfe33949fd0cbad5f4c0afaa49cbb9106a

SHA256
bedddf9d6d4dd63d1874056c941f8a435110d8c5546dc7e3b6247e89b551ead7

SHA512
a915f26f34c75ec647cfa45a54bb5adefb5db31db91109164ee6a097d0a6c45a6a8c3d084ae56b703b231e5e52f55027c235cf4521eb859e9142f5ef5f09ed8b

Download Submit
\Windows\system\xBUjnBL.exe

Filesize
2.2MB

MD5
7eb98297581369f6a36fec6feedd83b7

SHA1
f0856b5ef08212f312b1b6bb03682cde1c77c8f7

SHA256
b6460b5e51e4b4c8ac67a6534d9738574d334bb61d599aa6b277e587744af1ea

SHA512
2d50c87ae57d310ede9879ca742a12cc7e98fe7523a0e7b7849bbede8175a17794e3c7b3d85a3f7098e150c236c96bdc8d5cda8a16fc11aaeec4f11f58f32948

Download Submit
memory/2036-12-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2036-352-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2172-51-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/2172-169-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2172-173-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2180-15-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-90-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2264-41-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-1-0x0000000000090000-0x00000000000A0000-memory.dmp

Filesize
64KB

Download
memory/2264-84-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2264-85-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2264-0-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2264-71-0x0000000003770000-0x0000000003B62000-memory.dmp

Filesize
3.9MB

Download
memory/2264-63-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2264-11-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2264-36-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2264-10-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2264-79-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2264-20-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2264-50-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2264-44-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2304-88-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2500-55-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-70-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2612-89-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2632-23-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2652-49-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-53-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2784-52-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2856-91-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download