xmrig | 28549655067aac3c537e6bf623d61fc0662c40374614895862a581c3f1e243aa

Analysis

max time kernel
13s
max time network
33s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
Size

2.1MB
MD5

09d43c3de68ba9783ea0e9dbfe08fe78
SHA1

bb6d7f245b0125a9df628f938849858a516373a4
SHA256

28549655067aac3c537e6bf623d61fc0662c40374614895862a581c3f1e243aa
SHA512

5c6c2b13b6a06f01f31675ef19f9705fd2c8a761db4863c342360eed4848fbd5945b11894eb09a357342ab86d99eadedb37394e2f9325d41ef46692a41b268c4
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qre:NABp

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2108-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2600-25-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2548-47-0x000000013F990000-0x000000013FD82000-memory.dmp	xmrig
behavioral1/memory/2540-36-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2172-63-0x000000013FF20000-0x0000000140312000-memory.dmp	xmrig
behavioral1/memory/2736-85-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2172-91-0x0000000003690000-0x0000000003A82000-memory.dmp	xmrig
behavioral1/memory/2600-78-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2392-1257-0x000000013F7A0000-0x000000013FB92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2108	wVlRZeb.exe
2600	OcnXDfK.exe
2540	qruPDtF.exe
2392	qJTRGOw.exe
2656	vKceuyz.exe
2548	cxvrqft.exe
2428	UqCIIhV.exe
2736	YWZSseP.exe
2716	jRgKTKD.exe
2892	PXjimPb.exe
332	MZziguc.exe
1604	IwSARGf.exe
2692	vOLBJvk.exe
1584	tctuttf.exe
2968	MsqATzh.exe
2000	SwzYUNE.exe
588	XELfnhY.exe
2016	zCYhzBZ.exe
2248	CwaZGWL.exe
592	BvXaSzA.exe
640	tMbfmHv.exe
1872	YusDcEs.exe
428	FBbaQyt.exe
2360	wqItKLa.exe
976	shGmOll.exe
2476	kdyfOEj.exe
1784	bEseIPe.exe
1992	uLVaePw.exe
1432	XIRwUAt.exe
1924	RgQznyr.exe
1960	mIAYWcE.exe
2008	IIDWtAg.exe
2848	QBsPjqC.exe
884	efMUPWi.exe
2192	eXcgCYR.exe
1528	qdxxJst.exe
3032	VXNgnCg.exe
2676	tCnouOk.exe
2556	bBDHlJC.exe
2084	iYJkypH.exe
1020	BAsaRJc.exe
2772	vgJkNgs.exe
2196	ZTLjxHW.exe
1832	daLIhHn.exe
1396	IvRgIdA.exe
1428	WfyAERX.exe
1704	dhXbGlE.exe
2972	mjpwYUx.exe
1932	SwJYyHf.exe
1252	pmZJwsx.exe
1232	kUYvggP.exe
3084	qZkWTeK.exe
3116	AToEoia.exe
3148	KgLiBku.exe
3180	ouSzWCT.exe
3212	WweZeLQ.exe
3244	ifdWtce.exe
3276	RTJtrOp.exe
3308	PomZZvP.exe
3340	ZuGbhGV.exe
3372	enUQaFi.exe
3404	CxbrWly.exe
3476	wScbAHb.exe
3572	jiranDM.exe

Loads dropped DLL 64 IoCs

pid	Process
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2172-0-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/files/0x00080000000122cd-5.dat	upx
behavioral1/memory/2108-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0032000000014aa2-13.dat	upx
behavioral1/memory/2600-25-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x000700000001508a-22.dat	upx
behavioral1/files/0x0008000000014bea-14.dat	upx
behavioral1/files/0x0008000000014e51-18.dat	upx
behavioral1/memory/2548-47-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x0007000000015653-45.dat	upx
behavioral1/memory/2656-44-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/memory/2392-38-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/2540-36-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/files/0x0007000000015659-48.dat	upx
behavioral1/memory/2428-57-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2172-63-0x000000013FF20000-0x0000000140312000-memory.dmp	upx
behavioral1/memory/2172-64-0x0000000003690000-0x0000000003A82000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-65.dat	upx
behavioral1/files/0x0006000000015d9b-86.dat	upx
behavioral1/files/0x0006000000015d87-79.dat	upx
behavioral1/files/0x0006000000015d6f-72.dat	upx
behavioral1/files/0x0006000000015eaf-108.dat	upx
behavioral1/files/0x00060000000164b2-129.dat	upx
behavioral1/files/0x000600000001661c-136.dat	upx
behavioral1/files/0x0006000000016a9a-143.dat	upx
behavioral1/files/0x0006000000016c63-150.dat	upx
behavioral1/files/0x0006000000015e3a-89.dat	upx
behavioral1/memory/2736-85-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x0006000000016dbb-187.dat	upx
behavioral1/files/0x0006000000016d90-180.dat	upx
behavioral1/files/0x0006000000016d3a-173.dat	upx
behavioral1/files/0x0006000000016d1e-166.dat	upx
behavioral1/files/0x0006000000016ce4-159.dat	upx
behavioral1/files/0x0006000000016c6b-152.dat	upx
behavioral1/files/0x0006000000016c4a-145.dat	upx
behavioral1/files/0x0006000000016843-138.dat	upx
behavioral1/files/0x0006000000016572-131.dat	upx
behavioral1/files/0x000600000001630b-124.dat	upx
behavioral1/files/0x0006000000016117-117.dat	upx
behavioral1/files/0x0006000000015f6d-110.dat	upx
behavioral1/files/0x0009000000015d5e-99.dat	upx
behavioral1/files/0x0006000000015d8f-82.dat	upx
behavioral1/memory/2600-78-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0006000000015d79-75.dat	upx
behavioral1/files/0x0031000000014b27-69.dat	upx
behavioral1/files/0x0006000000016da7-185.dat	upx
behavioral1/files/0x0006000000016d7e-178.dat	upx
behavioral1/files/0x0006000000016d26-171.dat	upx
behavioral1/files/0x0006000000016d0d-164.dat	upx
behavioral1/files/0x0006000000016cb7-157.dat	upx
behavioral1/memory/2392-1257-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/files/0x00060000000161e7-122.dat	upx
behavioral1/files/0x0006000000015fe9-115.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pmZJwsx.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\rfIjrQB.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\facXPAK.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\ngmHKhy.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\exzBzCT.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\BhfUgZi.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\wtHXdfd.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\lFWRmMf.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\mcOJWTd.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\vOLBJvk.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\voHAtnc.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\bTZacqt.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\bSVzPVu.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\kUsjNqo.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\kwpqBOS.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\enUQaFi.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\UtKjTol.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\lyRIaZW.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\JAzCqbL.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\BNonPDX.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\FBbaQyt.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\aeysxTR.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\altTtpH.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\TCUegAa.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\zARGNFg.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\QlMhGJV.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\kaSEOzl.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\kovrusI.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\cxvrqft.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\QBsPjqC.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\lWsqZiq.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\UvZOwCv.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\xqAbyYc.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\zHddxGb.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\wTElHBS.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\BvXaSzA.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\XsoMxIg.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\VCUGRoy.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\KNVJAdn.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\OcnXDfK.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\LRWuwps.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\qjZebIv.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\Ykxdvgi.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\BUZHelF.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\rbDwZLI.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\OXpfOZG.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\qpVdpGP.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\FkhQntg.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\GLxJOEO.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\JZwQgRh.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\hTJgaqP.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\gVGwQyS.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\NAHwAqA.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\sBFjpWr.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\BAsaRJc.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\AwQVTuH.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\SEszbKW.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\FxUHxox.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\nYxfMBU.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\ftwzoOe.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\PmFJNBw.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\dXQocZO.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\dyUzsDe.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
File created	C:\Windows\System\pefOYHY.exe	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
Token: SeDebugPrivilege	2900	powershell.exe
Token: SeLockMemoryPrivilege	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2900	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2900	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2900	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	29
PID 2172 wrote to memory of 2108	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2108	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2108	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	30
PID 2172 wrote to memory of 2600	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2600	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2600	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	31
PID 2172 wrote to memory of 2540	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2540	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2540	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	32
PID 2172 wrote to memory of 2656	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2656	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2656	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	33
PID 2172 wrote to memory of 2392	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2392	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2392	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	34
PID 2172 wrote to memory of 2548	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2548	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2548	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	35
PID 2172 wrote to memory of 2428	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2428	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2428	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	36
PID 2172 wrote to memory of 2736	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2736	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2736	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	37
PID 2172 wrote to memory of 2716	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2716	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2716	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	38
PID 2172 wrote to memory of 2888	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	39
PID 2172 wrote to memory of 2888	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	39
PID 2172 wrote to memory of 2888	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	39
PID 2172 wrote to memory of 2892	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	40
PID 2172 wrote to memory of 2892	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	40
PID 2172 wrote to memory of 2892	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	40
PID 2172 wrote to memory of 2908	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	41
PID 2172 wrote to memory of 2908	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	41
PID 2172 wrote to memory of 2908	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	41
PID 2172 wrote to memory of 332	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	42
PID 2172 wrote to memory of 332	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	42
PID 2172 wrote to memory of 332	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	42
PID 2172 wrote to memory of 792	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	43
PID 2172 wrote to memory of 792	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	43
PID 2172 wrote to memory of 792	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	43
PID 2172 wrote to memory of 1604	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	44
PID 2172 wrote to memory of 1604	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	44
PID 2172 wrote to memory of 1604	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	44
PID 2172 wrote to memory of 1544	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	45
PID 2172 wrote to memory of 1544	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	45
PID 2172 wrote to memory of 1544	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	45
PID 2172 wrote to memory of 2692	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	46
PID 2172 wrote to memory of 2692	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	46
PID 2172 wrote to memory of 2692	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	46
PID 2172 wrote to memory of 676	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	47
PID 2172 wrote to memory of 676	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	47
PID 2172 wrote to memory of 676	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	47
PID 2172 wrote to memory of 1584	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	48
PID 2172 wrote to memory of 1584	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	48
PID 2172 wrote to memory of 1584	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	48
PID 2172 wrote to memory of 1416	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	49
PID 2172 wrote to memory of 1416	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	49
PID 2172 wrote to memory of 1416	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	49
PID 2172 wrote to memory of 2968	2172	09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\09d43c3de68ba9783ea0e9dbfe08fe78_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\System\wVlRZeb.exe
  C:\Windows\System\wVlRZeb.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\OcnXDfK.exe
  C:\Windows\System\OcnXDfK.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qruPDtF.exe
  C:\Windows\System\qruPDtF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\vKceuyz.exe
  C:\Windows\System\vKceuyz.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\qJTRGOw.exe
  C:\Windows\System\qJTRGOw.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\cxvrqft.exe
  C:\Windows\System\cxvrqft.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\UqCIIhV.exe
  C:\Windows\System\UqCIIhV.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\YWZSseP.exe
  C:\Windows\System\YWZSseP.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jRgKTKD.exe
  C:\Windows\System\jRgKTKD.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\ctMvzZA.exe
  C:\Windows\System\ctMvzZA.exe
  2⤵
  PID:2888
- C:\Windows\System\PXjimPb.exe
  C:\Windows\System\PXjimPb.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\zXgxoZK.exe
  C:\Windows\System\zXgxoZK.exe
  2⤵
  PID:2908
- C:\Windows\System\MZziguc.exe
  C:\Windows\System\MZziguc.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\nKMhfuT.exe
  C:\Windows\System\nKMhfuT.exe
  2⤵
  PID:792
- C:\Windows\System\IwSARGf.exe
  C:\Windows\System\IwSARGf.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\UEYXjJV.exe
  C:\Windows\System\UEYXjJV.exe
  2⤵
  PID:1544
- C:\Windows\System\vOLBJvk.exe
  C:\Windows\System\vOLBJvk.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\eiTDWus.exe
  C:\Windows\System\eiTDWus.exe
  2⤵
  PID:676
- C:\Windows\System\tctuttf.exe
  C:\Windows\System\tctuttf.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\kUsjNqo.exe
  C:\Windows\System\kUsjNqo.exe
  2⤵
  PID:1416
- C:\Windows\System\MsqATzh.exe
  C:\Windows\System\MsqATzh.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\sBFjpWr.exe
  C:\Windows\System\sBFjpWr.exe
  2⤵
  PID:1316
- C:\Windows\System\SwzYUNE.exe
  C:\Windows\System\SwzYUNE.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\VLrkDYv.exe
  C:\Windows\System\VLrkDYv.exe
  2⤵
  PID:2956
- C:\Windows\System\XELfnhY.exe
  C:\Windows\System\XELfnhY.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\wsiEFnZ.exe
  C:\Windows\System\wsiEFnZ.exe
  2⤵
  PID:2024
- C:\Windows\System\zCYhzBZ.exe
  C:\Windows\System\zCYhzBZ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\VGdwRpZ.exe
  C:\Windows\System\VGdwRpZ.exe
  2⤵
  PID:2484
- C:\Windows\System\CwaZGWL.exe
  C:\Windows\System\CwaZGWL.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\VbnvGyp.exe
  C:\Windows\System\VbnvGyp.exe
  2⤵
  PID:1048
- C:\Windows\System\BvXaSzA.exe
  C:\Windows\System\BvXaSzA.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\QlMhGJV.exe
  C:\Windows\System\QlMhGJV.exe
  2⤵
  PID:2780
- C:\Windows\System\tMbfmHv.exe
  C:\Windows\System\tMbfmHv.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\JznFPFm.exe
  C:\Windows\System\JznFPFm.exe
  2⤵
  PID:1072
- C:\Windows\System\YusDcEs.exe
  C:\Windows\System\YusDcEs.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\POAgBWV.exe
  C:\Windows\System\POAgBWV.exe
  2⤵
  PID:3004
- C:\Windows\System\FBbaQyt.exe
  C:\Windows\System\FBbaQyt.exe
  2⤵
  - Executes dropped EXE
  PID:428
- C:\Windows\System\qNOnIdI.exe
  C:\Windows\System\qNOnIdI.exe
  2⤵
  PID:2576
- C:\Windows\System\wqItKLa.exe
  C:\Windows\System\wqItKLa.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\caChRAB.exe
  C:\Windows\System\caChRAB.exe
  2⤵
  PID:1692
- C:\Windows\System\shGmOll.exe
  C:\Windows\System\shGmOll.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\QllVXiJ.exe
  C:\Windows\System\QllVXiJ.exe
  2⤵
  PID:1736
- C:\Windows\System\kdyfOEj.exe
  C:\Windows\System\kdyfOEj.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\AdPyGhB.exe
  C:\Windows\System\AdPyGhB.exe
  2⤵
  PID:1312
- C:\Windows\System\bEseIPe.exe
  C:\Windows\System\bEseIPe.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\XirDEMs.exe
  C:\Windows\System\XirDEMs.exe
  2⤵
  PID:2072
- C:\Windows\System\uLVaePw.exe
  C:\Windows\System\uLVaePw.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\JVHdXyl.exe
  C:\Windows\System\JVHdXyl.exe
  2⤵
  PID:896
- C:\Windows\System\XIRwUAt.exe
  C:\Windows\System\XIRwUAt.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\LRWuwps.exe
  C:\Windows\System\LRWuwps.exe
  2⤵
  PID:1912
- C:\Windows\System\RgQznyr.exe
  C:\Windows\System\RgQznyr.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\gcMuDEj.exe
  C:\Windows\System\gcMuDEj.exe
  2⤵
  PID:1660
- C:\Windows\System\mIAYWcE.exe
  C:\Windows\System\mIAYWcE.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\SAUQEcB.exe
  C:\Windows\System\SAUQEcB.exe
  2⤵
  PID:1664
- C:\Windows\System\IIDWtAg.exe
  C:\Windows\System\IIDWtAg.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\zQQQgjc.exe
  C:\Windows\System\zQQQgjc.exe
  2⤵
  PID:1188
- C:\Windows\System\QBsPjqC.exe
  C:\Windows\System\QBsPjqC.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\CrnxIkH.exe
  C:\Windows\System\CrnxIkH.exe
  2⤵
  PID:1700
- C:\Windows\System\efMUPWi.exe
  C:\Windows\System\efMUPWi.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\WybgBsM.exe
  C:\Windows\System\WybgBsM.exe
  2⤵
  PID:2816
- C:\Windows\System\eXcgCYR.exe
  C:\Windows\System\eXcgCYR.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\SGtuGBx.exe
  C:\Windows\System\SGtuGBx.exe
  2⤵
  PID:2180
- C:\Windows\System\qdxxJst.exe
  C:\Windows\System\qdxxJst.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\nKJWfjG.exe
  C:\Windows\System\nKJWfjG.exe
  2⤵
  PID:1520
- C:\Windows\System\VXNgnCg.exe
  C:\Windows\System\VXNgnCg.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\PfzBiCu.exe
  C:\Windows\System\PfzBiCu.exe
  2⤵
  PID:2496
- C:\Windows\System\tCnouOk.exe
  C:\Windows\System\tCnouOk.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\BgPFQnc.exe
  C:\Windows\System\BgPFQnc.exe
  2⤵
  PID:2464
- C:\Windows\System\bBDHlJC.exe
  C:\Windows\System\bBDHlJC.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\gkGvZMH.exe
  C:\Windows\System\gkGvZMH.exe
  2⤵
  PID:2384
- C:\Windows\System\iYJkypH.exe
  C:\Windows\System\iYJkypH.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\aeysxTR.exe
  C:\Windows\System\aeysxTR.exe
  2⤵
  PID:2460
- C:\Windows\System\BAsaRJc.exe
  C:\Windows\System\BAsaRJc.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\wnsWIIp.exe
  C:\Windows\System\wnsWIIp.exe
  2⤵
  PID:2160
- C:\Windows\System\vgJkNgs.exe
  C:\Windows\System\vgJkNgs.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\zOwZfVQ.exe
  C:\Windows\System\zOwZfVQ.exe
  2⤵
  PID:1672
- C:\Windows\System\ZTLjxHW.exe
  C:\Windows\System\ZTLjxHW.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\PmFJNBw.exe
  C:\Windows\System\PmFJNBw.exe
  2⤵
  PID:2940
- C:\Windows\System\daLIhHn.exe
  C:\Windows\System\daLIhHn.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\xotJUXf.exe
  C:\Windows\System\xotJUXf.exe
  2⤵
  PID:1616
- C:\Windows\System\IvRgIdA.exe
  C:\Windows\System\IvRgIdA.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\hTJgaqP.exe
  C:\Windows\System\hTJgaqP.exe
  2⤵
  PID:3020
- C:\Windows\System\WfyAERX.exe
  C:\Windows\System\WfyAERX.exe
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\System\IoLPeEQ.exe
  C:\Windows\System\IoLPeEQ.exe
  2⤵
  PID:1276
- C:\Windows\System\dhXbGlE.exe
  C:\Windows\System\dhXbGlE.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\kwpqBOS.exe
  C:\Windows\System\kwpqBOS.exe
  2⤵
  PID:1724
- C:\Windows\System\mjpwYUx.exe
  C:\Windows\System\mjpwYUx.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\RNblZOL.exe
  C:\Windows\System\RNblZOL.exe
  2⤵
  PID:1920
- C:\Windows\System\SwJYyHf.exe
  C:\Windows\System\SwJYyHf.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\KllWvnR.exe
  C:\Windows\System\KllWvnR.exe
  2⤵
  PID:2520
- C:\Windows\System\pmZJwsx.exe
  C:\Windows\System\pmZJwsx.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\CxDEGYt.exe
  C:\Windows\System\CxDEGYt.exe
  2⤵
  PID:2868
- C:\Windows\System\kUYvggP.exe
  C:\Windows\System\kUYvggP.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\WEbsdQR.exe
  C:\Windows\System\WEbsdQR.exe
  2⤵
  PID:1472
- C:\Windows\System\qZkWTeK.exe
  C:\Windows\System\qZkWTeK.exe
  2⤵
  - Executes dropped EXE
  PID:3084
- C:\Windows\System\cySzHsM.exe
  C:\Windows\System\cySzHsM.exe
  2⤵
  PID:3100
- C:\Windows\System\AToEoia.exe
  C:\Windows\System\AToEoia.exe
  2⤵
  - Executes dropped EXE
  PID:3116
- C:\Windows\System\pUpaCLF.exe
  C:\Windows\System\pUpaCLF.exe
  2⤵
  PID:3132
- C:\Windows\System\KgLiBku.exe
  C:\Windows\System\KgLiBku.exe
  2⤵
  - Executes dropped EXE
  PID:3148
- C:\Windows\System\LNfkmmP.exe
  C:\Windows\System\LNfkmmP.exe
  2⤵
  PID:3164
- C:\Windows\System\ouSzWCT.exe
  C:\Windows\System\ouSzWCT.exe
  2⤵
  - Executes dropped EXE
  PID:3180
- C:\Windows\System\cmqYrcz.exe
  C:\Windows\System\cmqYrcz.exe
  2⤵
  PID:3196
- C:\Windows\System\WweZeLQ.exe
  C:\Windows\System\WweZeLQ.exe
  2⤵
  - Executes dropped EXE
  PID:3212
- C:\Windows\System\KAtTqoB.exe
  C:\Windows\System\KAtTqoB.exe
  2⤵
  PID:3228
- C:\Windows\System\ifdWtce.exe
  C:\Windows\System\ifdWtce.exe
  2⤵
  - Executes dropped EXE
  PID:3244
- C:\Windows\System\qnxVhiP.exe
  C:\Windows\System\qnxVhiP.exe
  2⤵
  PID:3260
- C:\Windows\System\RTJtrOp.exe
  C:\Windows\System\RTJtrOp.exe
  2⤵
  - Executes dropped EXE
  PID:3276
- C:\Windows\System\oIBlata.exe
  C:\Windows\System\oIBlata.exe
  2⤵
  PID:3292
- C:\Windows\System\PomZZvP.exe
  C:\Windows\System\PomZZvP.exe
  2⤵
  - Executes dropped EXE
  PID:3308
- C:\Windows\System\DZvyTDl.exe
  C:\Windows\System\DZvyTDl.exe
  2⤵
  PID:3324
- C:\Windows\System\ZuGbhGV.exe
  C:\Windows\System\ZuGbhGV.exe
  2⤵
  - Executes dropped EXE
  PID:3340
- C:\Windows\System\zhIDfWr.exe
  C:\Windows\System\zhIDfWr.exe
  2⤵
  PID:3356
- C:\Windows\System\enUQaFi.exe
  C:\Windows\System\enUQaFi.exe
  2⤵
  - Executes dropped EXE
  PID:3372
- C:\Windows\System\EoiFFIW.exe
  C:\Windows\System\EoiFFIW.exe
  2⤵
  PID:3388
- C:\Windows\System\CxbrWly.exe
  C:\Windows\System\CxbrWly.exe
  2⤵
  - Executes dropped EXE
  PID:3404
- C:\Windows\System\CEHIHEV.exe
  C:\Windows\System\CEHIHEV.exe
  2⤵
  PID:3440
- C:\Windows\System\wScbAHb.exe
  C:\Windows\System\wScbAHb.exe
  2⤵
  - Executes dropped EXE
  PID:3476
- C:\Windows\System\AwQVTuH.exe
  C:\Windows\System\AwQVTuH.exe
  2⤵
  PID:3520
- C:\Windows\System\jiranDM.exe
  C:\Windows\System\jiranDM.exe
  2⤵
  - Executes dropped EXE
  PID:3572
- C:\Windows\System\KIOAnoU.exe
  C:\Windows\System\KIOAnoU.exe
  2⤵
  PID:3588
- C:\Windows\System\TgFbAIJ.exe
  C:\Windows\System\TgFbAIJ.exe
  2⤵
  PID:3604
- C:\Windows\System\lsKINJw.exe
  C:\Windows\System\lsKINJw.exe
  2⤵
  PID:3620
- C:\Windows\System\AcxRqyv.exe
  C:\Windows\System\AcxRqyv.exe
  2⤵
  PID:3644
- C:\Windows\System\vZoMTXY.exe
  C:\Windows\System\vZoMTXY.exe
  2⤵
  PID:3660
- C:\Windows\System\jdoaNdZ.exe
  C:\Windows\System\jdoaNdZ.exe
  2⤵
  PID:3680
- C:\Windows\System\fSwreMI.exe
  C:\Windows\System\fSwreMI.exe
  2⤵
  PID:3696
- C:\Windows\System\eHoxgtk.exe
  C:\Windows\System\eHoxgtk.exe
  2⤵
  PID:3712
- C:\Windows\System\NvrJTzq.exe
  C:\Windows\System\NvrJTzq.exe
  2⤵
  PID:3728
- C:\Windows\System\mzcmJTR.exe
  C:\Windows\System\mzcmJTR.exe
  2⤵
  PID:3744
- C:\Windows\System\zuMQBsh.exe
  C:\Windows\System\zuMQBsh.exe
  2⤵
  PID:3760
- C:\Windows\System\ziwmDqd.exe
  C:\Windows\System\ziwmDqd.exe
  2⤵
  PID:3784
- C:\Windows\System\wpUDJhI.exe
  C:\Windows\System\wpUDJhI.exe
  2⤵
  PID:3800
- C:\Windows\System\vzOlBmV.exe
  C:\Windows\System\vzOlBmV.exe
  2⤵
  PID:3816
- C:\Windows\System\gqCBrRN.exe
  C:\Windows\System\gqCBrRN.exe
  2⤵
  PID:3832
- C:\Windows\System\thRPQRN.exe
  C:\Windows\System\thRPQRN.exe
  2⤵
  PID:3848
- C:\Windows\System\DyfYKnF.exe
  C:\Windows\System\DyfYKnF.exe
  2⤵
  PID:3864
- C:\Windows\System\HSCJxYh.exe
  C:\Windows\System\HSCJxYh.exe
  2⤵
  PID:3880
- C:\Windows\System\XNQmUBX.exe
  C:\Windows\System\XNQmUBX.exe
  2⤵
  PID:3896
- C:\Windows\System\lpACMqW.exe
  C:\Windows\System\lpACMqW.exe
  2⤵
  PID:3912
- C:\Windows\System\YHKskph.exe
  C:\Windows\System\YHKskph.exe
  2⤵
  PID:3928
- C:\Windows\System\kaSEOzl.exe
  C:\Windows\System\kaSEOzl.exe
  2⤵
  PID:3944
- C:\Windows\System\XsoMxIg.exe
  C:\Windows\System\XsoMxIg.exe
  2⤵
  PID:3960
- C:\Windows\System\facXPAK.exe
  C:\Windows\System\facXPAK.exe
  2⤵
  PID:3976
- C:\Windows\System\plhzjYy.exe
  C:\Windows\System\plhzjYy.exe
  2⤵
  PID:3992
- C:\Windows\System\GLxJOEO.exe
  C:\Windows\System\GLxJOEO.exe
  2⤵
  PID:4020
- C:\Windows\System\psvZWTk.exe
  C:\Windows\System\psvZWTk.exe
  2⤵
  PID:4036
- C:\Windows\System\TGzSDeM.exe
  C:\Windows\System\TGzSDeM.exe
  2⤵
  PID:4076
- C:\Windows\System\phDiRCA.exe
  C:\Windows\System\phDiRCA.exe
  2⤵
  PID:944
- C:\Windows\System\kQECWuJ.exe
  C:\Windows\System\kQECWuJ.exe
  2⤵
  PID:500
- C:\Windows\System\BhfUgZi.exe
  C:\Windows\System\BhfUgZi.exe
  2⤵
  PID:3096
- C:\Windows\System\FZXYvEp.exe
  C:\Windows\System\FZXYvEp.exe
  2⤵
  PID:3156
- C:\Windows\System\izGbACV.exe
  C:\Windows\System\izGbACV.exe
  2⤵
  PID:3192
- C:\Windows\System\ealEoNr.exe
  C:\Windows\System\ealEoNr.exe
  2⤵
  PID:3316
- C:\Windows\System\biwlaWT.exe
  C:\Windows\System\biwlaWT.exe
  2⤵
  PID:3384
- C:\Windows\System\VLGHJwH.exe
  C:\Windows\System\VLGHJwH.exe
  2⤵
  PID:3428
- C:\Windows\System\gHvcYDF.exe
  C:\Windows\System\gHvcYDF.exe
  2⤵
  PID:3484
- C:\Windows\System\UtKjTol.exe
  C:\Windows\System\UtKjTol.exe
  2⤵
  PID:3512
- C:\Windows\System\DiYErXE.exe
  C:\Windows\System\DiYErXE.exe
  2⤵
  PID:3584
- C:\Windows\System\ctUcClD.exe
  C:\Windows\System\ctUcClD.exe
  2⤵
  PID:3656
- C:\Windows\System\kovrusI.exe
  C:\Windows\System\kovrusI.exe
  2⤵
  PID:760
- C:\Windows\System\UhHnRZV.exe
  C:\Windows\System\UhHnRZV.exe
  2⤵
  PID:3752
- C:\Windows\System\BuPkFPm.exe
  C:\Windows\System\BuPkFPm.exe
  2⤵
  PID:3792
- C:\Windows\System\HBVTZaR.exe
  C:\Windows\System\HBVTZaR.exe
  2⤵
  PID:1168
- C:\Windows\System\zzZcSqF.exe
  C:\Windows\System\zzZcSqF.exe
  2⤵
  PID:3892
- C:\Windows\System\RXeCQYr.exe
  C:\Windows\System\RXeCQYr.exe
  2⤵
  PID:3956
- C:\Windows\System\jZnUEXT.exe
  C:\Windows\System\jZnUEXT.exe
  2⤵
  PID:4032
- C:\Windows\System\ZzVXkUC.exe
  C:\Windows\System\ZzVXkUC.exe
  2⤵
  PID:4088
- C:\Windows\System\KGwBIfY.exe
  C:\Windows\System\KGwBIfY.exe
  2⤵
  PID:2212
- C:\Windows\System\xQRNmHu.exe
  C:\Windows\System\xQRNmHu.exe
  2⤵
  PID:3380
- C:\Windows\System\eJEKkgZ.exe
  C:\Windows\System\eJEKkgZ.exe
  2⤵
  PID:3508
- C:\Windows\System\osqEAOY.exe
  C:\Windows\System\osqEAOY.exe
  2⤵
  PID:384
- C:\Windows\System\FgWQlJj.exe
  C:\Windows\System\FgWQlJj.exe
  2⤵
  PID:1296
- C:\Windows\System\mkbpLKl.exe
  C:\Windows\System\mkbpLKl.exe
  2⤵
  PID:4112
- C:\Windows\System\ITtFUeV.exe
  C:\Windows\System\ITtFUeV.exe
  2⤵
  PID:4128
- C:\Windows\System\VXJznxa.exe
  C:\Windows\System\VXJznxa.exe
  2⤵
  PID:4144
- C:\Windows\System\QqwOnzT.exe
  C:\Windows\System\QqwOnzT.exe
  2⤵
  PID:4168
- C:\Windows\System\aMJHkCy.exe
  C:\Windows\System\aMJHkCy.exe
  2⤵
  PID:4208
- C:\Windows\System\YrOZWYx.exe
  C:\Windows\System\YrOZWYx.exe
  2⤵
  PID:4224
- C:\Windows\System\lyRIaZW.exe
  C:\Windows\System\lyRIaZW.exe
  2⤵
  PID:4240
- C:\Windows\System\pzINBLj.exe
  C:\Windows\System\pzINBLj.exe
  2⤵
  PID:4256
- C:\Windows\System\BUZHelF.exe
  C:\Windows\System\BUZHelF.exe
  2⤵
  PID:4276
- C:\Windows\System\rbDwZLI.exe
  C:\Windows\System\rbDwZLI.exe
  2⤵
  PID:4292
- C:\Windows\System\bTZacqt.exe
  C:\Windows\System\bTZacqt.exe
  2⤵
  PID:4308
- C:\Windows\System\voHAtnc.exe
  C:\Windows\System\voHAtnc.exe
  2⤵
  PID:4324
- C:\Windows\System\zVYXvvx.exe
  C:\Windows\System\zVYXvvx.exe
  2⤵
  PID:4340
- C:\Windows\System\DxJsqtu.exe
  C:\Windows\System\DxJsqtu.exe
  2⤵
  PID:4356
- C:\Windows\System\CAmbmnx.exe
  C:\Windows\System\CAmbmnx.exe
  2⤵
  PID:4372
- C:\Windows\System\xVDHfKk.exe
  C:\Windows\System\xVDHfKk.exe
  2⤵
  PID:4392
- C:\Windows\System\uTLEQId.exe
  C:\Windows\System\uTLEQId.exe
  2⤵
  PID:4416
- C:\Windows\System\JEsOueL.exe
  C:\Windows\System\JEsOueL.exe
  2⤵
  PID:4432
- C:\Windows\System\KQIFzuX.exe
  C:\Windows\System\KQIFzuX.exe
  2⤵
  PID:4448
- C:\Windows\System\dMMFckX.exe
  C:\Windows\System\dMMFckX.exe
  2⤵
  PID:4468
- C:\Windows\System\wtHXdfd.exe
  C:\Windows\System\wtHXdfd.exe
  2⤵
  PID:4484
- C:\Windows\System\GGrtGTU.exe
  C:\Windows\System\GGrtGTU.exe
  2⤵
  PID:4500
- C:\Windows\System\vBoZgfj.exe
  C:\Windows\System\vBoZgfj.exe
  2⤵
  PID:4516
- C:\Windows\System\bPaTAPv.exe
  C:\Windows\System\bPaTAPv.exe
  2⤵
  PID:4532
- C:\Windows\System\JUdUiVS.exe
  C:\Windows\System\JUdUiVS.exe
  2⤵
  PID:4548
- C:\Windows\System\dyUzsDe.exe
  C:\Windows\System\dyUzsDe.exe
  2⤵
  PID:4564
- C:\Windows\System\sgQtYeC.exe
  C:\Windows\System\sgQtYeC.exe
  2⤵
  PID:4580
- C:\Windows\System\TCUegAa.exe
  C:\Windows\System\TCUegAa.exe
  2⤵
  PID:4596
- C:\Windows\System\aGRgwkp.exe
  C:\Windows\System\aGRgwkp.exe
  2⤵
  PID:4612
- C:\Windows\System\RrTsmEW.exe
  C:\Windows\System\RrTsmEW.exe
  2⤵
  PID:4628
- C:\Windows\System\iTNVcXG.exe
  C:\Windows\System\iTNVcXG.exe
  2⤵
  PID:4644
- C:\Windows\System\FHFqMpO.exe
  C:\Windows\System\FHFqMpO.exe
  2⤵
  PID:4672
- C:\Windows\System\mYBjNlb.exe
  C:\Windows\System\mYBjNlb.exe
  2⤵
  PID:4688
- C:\Windows\System\QpYWsjA.exe
  C:\Windows\System\QpYWsjA.exe
  2⤵
  PID:4704
- C:\Windows\System\JZwQgRh.exe
  C:\Windows\System\JZwQgRh.exe
  2⤵
  PID:4720
- C:\Windows\System\wtRfxzz.exe
  C:\Windows\System\wtRfxzz.exe
  2⤵
  PID:4736
- C:\Windows\System\EhWKDKx.exe
  C:\Windows\System\EhWKDKx.exe
  2⤵
  PID:4752
- C:\Windows\System\NtkUfHa.exe
  C:\Windows\System\NtkUfHa.exe
  2⤵
  PID:4768
- C:\Windows\System\exzBzCT.exe
  C:\Windows\System\exzBzCT.exe
  2⤵
  PID:4784
- C:\Windows\System\KtURHkE.exe
  C:\Windows\System\KtURHkE.exe
  2⤵
  PID:4800
- C:\Windows\System\SOvrPMP.exe
  C:\Windows\System\SOvrPMP.exe
  2⤵
  PID:4816
- C:\Windows\System\KhWGtwN.exe
  C:\Windows\System\KhWGtwN.exe
  2⤵
  PID:4856
- C:\Windows\System\Ccojlve.exe
  C:\Windows\System\Ccojlve.exe
  2⤵
  PID:4876
- C:\Windows\System\vacrHEB.exe
  C:\Windows\System\vacrHEB.exe
  2⤵
  PID:4892
- C:\Windows\System\WqvTlAu.exe
  C:\Windows\System\WqvTlAu.exe
  2⤵
  PID:4912
- C:\Windows\System\ibeGqjq.exe
  C:\Windows\System\ibeGqjq.exe
  2⤵
  PID:4928
- C:\Windows\System\HMvSTui.exe
  C:\Windows\System\HMvSTui.exe
  2⤵
  PID:4944
- C:\Windows\System\PXlHaOV.exe
  C:\Windows\System\PXlHaOV.exe
  2⤵
  PID:4972
- C:\Windows\System\iVfUbKV.exe
  C:\Windows\System\iVfUbKV.exe
  2⤵
  PID:4988
- C:\Windows\System\efbvfJj.exe
  C:\Windows\System\efbvfJj.exe
  2⤵
  PID:5008
- C:\Windows\System\iWFuPsw.exe
  C:\Windows\System\iWFuPsw.exe
  2⤵
  PID:5024
- C:\Windows\System\KJcoRPy.exe
  C:\Windows\System\KJcoRPy.exe
  2⤵
  PID:5044
- C:\Windows\System\IEgJYzz.exe
  C:\Windows\System\IEgJYzz.exe
  2⤵
  PID:5060
- C:\Windows\System\znUHGmQ.exe
  C:\Windows\System\znUHGmQ.exe
  2⤵
  PID:5076
- C:\Windows\System\zCIFPju.exe
  C:\Windows\System\zCIFPju.exe
  2⤵
  PID:5092
- C:\Windows\System\lWsqZiq.exe
  C:\Windows\System\lWsqZiq.exe
  2⤵
  PID:5108
- C:\Windows\System\BYUOKtt.exe
  C:\Windows\System\BYUOKtt.exe
  2⤵
  PID:3988
- C:\Windows\System\nSmUMDi.exe
  C:\Windows\System\nSmUMDi.exe
  2⤵
  PID:1568
- C:\Windows\System\lFWRmMf.exe
  C:\Windows\System\lFWRmMf.exe
  2⤵
  PID:2792
- C:\Windows\System\dJbNmbo.exe
  C:\Windows\System\dJbNmbo.exe
  2⤵
  PID:4120
- C:\Windows\System\kzLXDja.exe
  C:\Windows\System\kzLXDja.exe
  2⤵
  PID:868
- C:\Windows\System\dXQocZO.exe
  C:\Windows\System\dXQocZO.exe
  2⤵
  PID:4156
- C:\Windows\System\jegIWkQ.exe
  C:\Windows\System\jegIWkQ.exe
  2⤵
  PID:2740
- C:\Windows\System\nLoJmVo.exe
  C:\Windows\System\nLoJmVo.exe
  2⤵
  PID:5132
- C:\Windows\System\XBkiiDt.exe
  C:\Windows\System\XBkiiDt.exe
  2⤵
  PID:5148
- C:\Windows\System\leoTkuN.exe
  C:\Windows\System\leoTkuN.exe
  2⤵
  PID:5164
- C:\Windows\System\qjZebIv.exe
  C:\Windows\System\qjZebIv.exe
  2⤵
  PID:5180
- C:\Windows\System\UGMiRPZ.exe
  C:\Windows\System\UGMiRPZ.exe
  2⤵
  PID:5196
- C:\Windows\System\HODNrmG.exe
  C:\Windows\System\HODNrmG.exe
  2⤵
  PID:5216
- C:\Windows\System\zvmCzfO.exe
  C:\Windows\System\zvmCzfO.exe
  2⤵
  PID:5232
- C:\Windows\System\MYgOzAP.exe
  C:\Windows\System\MYgOzAP.exe
  2⤵
  PID:5248
- C:\Windows\System\gErpeAY.exe
  C:\Windows\System\gErpeAY.exe
  2⤵
  PID:5264
- C:\Windows\System\UaoBFtI.exe
  C:\Windows\System\UaoBFtI.exe
  2⤵
  PID:5288
- C:\Windows\System\XnHHiZN.exe
  C:\Windows\System\XnHHiZN.exe
  2⤵
  PID:5304
- C:\Windows\System\UVIInmZ.exe
  C:\Windows\System\UVIInmZ.exe
  2⤵
  PID:5320
- C:\Windows\System\rMjWpkj.exe
  C:\Windows\System\rMjWpkj.exe
  2⤵
  PID:5344
- C:\Windows\System\zARGNFg.exe
  C:\Windows\System\zARGNFg.exe
  2⤵
  PID:5360
- C:\Windows\System\cyvBsLW.exe
  C:\Windows\System\cyvBsLW.exe
  2⤵
  PID:5376
- C:\Windows\System\qFSjWSC.exe
  C:\Windows\System\qFSjWSC.exe
  2⤵
  PID:5468
- C:\Windows\System\oAgSdlI.exe
  C:\Windows\System\oAgSdlI.exe
  2⤵
  PID:5484
- C:\Windows\System\kSOcvZM.exe
  C:\Windows\System\kSOcvZM.exe
  2⤵
  PID:5500
- C:\Windows\System\Ykxdvgi.exe
  C:\Windows\System\Ykxdvgi.exe
  2⤵
  PID:5516
- C:\Windows\System\KXitEXG.exe
  C:\Windows\System\KXitEXG.exe
  2⤵
  PID:5532
- C:\Windows\System\VCUGRoy.exe
  C:\Windows\System\VCUGRoy.exe
  2⤵
  PID:5548
- C:\Windows\System\XtpjfoK.exe
  C:\Windows\System\XtpjfoK.exe
  2⤵
  PID:5564
- C:\Windows\System\XNPuqAW.exe
  C:\Windows\System\XNPuqAW.exe
  2⤵
  PID:5580
- C:\Windows\System\WBQBmqf.exe
  C:\Windows\System\WBQBmqf.exe
  2⤵
  PID:5596
- C:\Windows\System\asmjalm.exe
  C:\Windows\System\asmjalm.exe
  2⤵
  PID:5612
- C:\Windows\System\WJctXjw.exe
  C:\Windows\System\WJctXjw.exe
  2⤵
  PID:5628
- C:\Windows\System\LsArHoa.exe
  C:\Windows\System\LsArHoa.exe
  2⤵
  PID:5644
- C:\Windows\System\UNzGOuL.exe
  C:\Windows\System\UNzGOuL.exe
  2⤵
  PID:5660
- C:\Windows\System\lWFIXId.exe
  C:\Windows\System\lWFIXId.exe
  2⤵
  PID:5676
- C:\Windows\System\mcOJWTd.exe
  C:\Windows\System\mcOJWTd.exe
  2⤵
  PID:5692
- C:\Windows\System\iVeGAas.exe
  C:\Windows\System\iVeGAas.exe
  2⤵
  PID:5708
- C:\Windows\System\StmmUCz.exe
  C:\Windows\System\StmmUCz.exe
  2⤵
  PID:5724
- C:\Windows\System\ngmHKhy.exe
  C:\Windows\System\ngmHKhy.exe
  2⤵
  PID:5740
- C:\Windows\System\rfIjrQB.exe
  C:\Windows\System\rfIjrQB.exe
  2⤵
  PID:5756
- C:\Windows\System\avOjBKn.exe
  C:\Windows\System\avOjBKn.exe
  2⤵
  PID:5772
- C:\Windows\System\zBBdIWg.exe
  C:\Windows\System\zBBdIWg.exe
  2⤵
  PID:5788
- C:\Windows\System\cWhnFQp.exe
  C:\Windows\System\cWhnFQp.exe
  2⤵
  PID:5804
- C:\Windows\System\PhROipL.exe
  C:\Windows\System\PhROipL.exe
  2⤵
  PID:5820
- C:\Windows\System\bbiMNdG.exe
  C:\Windows\System\bbiMNdG.exe
  2⤵
  PID:5836
- C:\Windows\System\cFjyssX.exe
  C:\Windows\System\cFjyssX.exe
  2⤵
  PID:5852
- C:\Windows\System\IbYPwGH.exe
  C:\Windows\System\IbYPwGH.exe
  2⤵
  PID:5868
- C:\Windows\System\nkDBklj.exe
  C:\Windows\System\nkDBklj.exe
  2⤵
  PID:5884
- C:\Windows\System\EmfGZIP.exe
  C:\Windows\System\EmfGZIP.exe
  2⤵
  PID:5900
- C:\Windows\System\rJmxhPt.exe
  C:\Windows\System\rJmxhPt.exe
  2⤵
  PID:5916
- C:\Windows\System\ykvvLce.exe
  C:\Windows\System\ykvvLce.exe
  2⤵
  PID:5932
- C:\Windows\System\yUCOQyp.exe
  C:\Windows\System\yUCOQyp.exe
  2⤵
  PID:5948
- C:\Windows\System\MpQIuCS.exe
  C:\Windows\System\MpQIuCS.exe
  2⤵
  PID:5964
- C:\Windows\System\JAzCqbL.exe
  C:\Windows\System\JAzCqbL.exe
  2⤵
  PID:5980
- C:\Windows\System\uFQAKOs.exe
  C:\Windows\System\uFQAKOs.exe
  2⤵
  PID:5996
- C:\Windows\System\YaEmHSK.exe
  C:\Windows\System\YaEmHSK.exe
  2⤵
  PID:6012
- C:\Windows\System\ECzFuXd.exe
  C:\Windows\System\ECzFuXd.exe
  2⤵
  PID:6028
- C:\Windows\System\pefOYHY.exe
  C:\Windows\System\pefOYHY.exe
  2⤵
  PID:6044
- C:\Windows\System\eftKIDu.exe
  C:\Windows\System\eftKIDu.exe
  2⤵
  PID:6060
- C:\Windows\System\NJuvWiR.exe
  C:\Windows\System\NJuvWiR.exe
  2⤵
  PID:6076
- C:\Windows\System\EMujHSI.exe
  C:\Windows\System\EMujHSI.exe
  2⤵
  PID:6092
- C:\Windows\System\VgCXJZJ.exe
  C:\Windows\System\VgCXJZJ.exe
  2⤵
  PID:6112
- C:\Windows\System\DApLKCH.exe
  C:\Windows\System\DApLKCH.exe
  2⤵
  PID:6132
- C:\Windows\System\PyDjmTk.exe
  C:\Windows\System\PyDjmTk.exe
  2⤵
  PID:2884
- C:\Windows\System\LNaeTbU.exe
  C:\Windows\System\LNaeTbU.exe
  2⤵
  PID:4160
- C:\Windows\System\JlcaeJf.exe
  C:\Windows\System\JlcaeJf.exe
  2⤵
  PID:4248
- C:\Windows\System\TfVmZqm.exe
  C:\Windows\System\TfVmZqm.exe
  2⤵
  PID:4288
- C:\Windows\System\YYrMGmG.exe
  C:\Windows\System\YYrMGmG.exe
  2⤵
  PID:4348
- C:\Windows\System\zhSnFvY.exe
  C:\Windows\System\zhSnFvY.exe
  2⤵
  PID:4388
- C:\Windows\System\oMllVQX.exe
  C:\Windows\System\oMllVQX.exe
  2⤵
  PID:4460
- C:\Windows\System\xvLGJCo.exe
  C:\Windows\System\xvLGJCo.exe
  2⤵
  PID:4496
- C:\Windows\System\PRZdZuT.exe
  C:\Windows\System\PRZdZuT.exe
  2⤵
  PID:4560
- C:\Windows\System\bklsDls.exe
  C:\Windows\System\bklsDls.exe
  2⤵
  PID:4652
- C:\Windows\System\vQjZqkz.exe
  C:\Windows\System\vQjZqkz.exe
  2⤵
  PID:4668
- C:\Windows\System\ejrPeiE.exe
  C:\Windows\System\ejrPeiE.exe
  2⤵
  PID:4732
- C:\Windows\System\kLGDSbq.exe
  C:\Windows\System\kLGDSbq.exe
  2⤵
  PID:4796
- C:\Windows\System\UWlZRIA.exe
  C:\Windows\System\UWlZRIA.exe
  2⤵
  PID:4840
- C:\Windows\System\FZJFAWH.exe
  C:\Windows\System\FZJFAWH.exe
  2⤵
  PID:4888
- C:\Windows\System\pLTlGwB.exe
  C:\Windows\System\pLTlGwB.exe
  2⤵
  PID:4956
- C:\Windows\System\ywwfsjl.exe
  C:\Windows\System\ywwfsjl.exe
  2⤵
  PID:4996
- C:\Windows\System\jKVxlix.exe
  C:\Windows\System\jKVxlix.exe
  2⤵
  PID:5036
- C:\Windows\System\JBJucmE.exe
  C:\Windows\System\JBJucmE.exe
  2⤵
  PID:5100
- C:\Windows\System\tJXyxjT.exe
  C:\Windows\System\tJXyxjT.exe
  2⤵
  PID:3092
- C:\Windows\System\kODACwm.exe
  C:\Windows\System\kODACwm.exe
  2⤵
  PID:5124
- C:\Windows\System\gzlDLjz.exe
  C:\Windows\System\gzlDLjz.exe
  2⤵
  PID:5188
- C:\Windows\System\YSajXoX.exe
  C:\Windows\System\YSajXoX.exe
  2⤵
  PID:5256
- C:\Windows\System\oyCjXtX.exe
  C:\Windows\System\oyCjXtX.exe
  2⤵
  PID:5328
- C:\Windows\System\hkJEAZo.exe
  C:\Windows\System\hkJEAZo.exe
  2⤵
  PID:5368
- C:\Windows\System\LSkPEGs.exe
  C:\Windows\System\LSkPEGs.exe
  2⤵
  PID:5508
- C:\Windows\System\nYxfMBU.exe
  C:\Windows\System\nYxfMBU.exe
  2⤵
  PID:2456
- C:\Windows\System\PYJNDNm.exe
  C:\Windows\System\PYJNDNm.exe
  2⤵
  PID:5668
- C:\Windows\System\uccmwht.exe
  C:\Windows\System\uccmwht.exe
  2⤵
  PID:5736
- C:\Windows\System\XRplYos.exe
  C:\Windows\System\XRplYos.exe
  2⤵
  PID:5800
- C:\Windows\System\sUYXIMJ.exe
  C:\Windows\System\sUYXIMJ.exe
  2⤵
  PID:5864
- C:\Windows\System\fCcmGfp.exe
  C:\Windows\System\fCcmGfp.exe
  2⤵
  PID:5928
- C:\Windows\System\GuSOYqd.exe
  C:\Windows\System\GuSOYqd.exe
  2⤵
  PID:5992
- C:\Windows\System\WUNrdmX.exe
  C:\Windows\System\WUNrdmX.exe
  2⤵
  PID:6052
- C:\Windows\System\AYBfwnf.exe
  C:\Windows\System\AYBfwnf.exe
  2⤵
  PID:6120
- C:\Windows\System\OXpfOZG.exe
  C:\Windows\System\OXpfOZG.exe
  2⤵
  PID:4380
- C:\Windows\System\KvxqCjR.exe
  C:\Windows\System\KvxqCjR.exe
  2⤵
  PID:1480
- C:\Windows\System\JDNSKJj.exe
  C:\Windows\System\JDNSKJj.exe
  2⤵
  PID:4828
- C:\Windows\System\kPnsRnu.exe
  C:\Windows\System\kPnsRnu.exe
  2⤵
  PID:2664
- C:\Windows\System\SEszbKW.exe
  C:\Windows\System\SEszbKW.exe
  2⤵
  PID:5032
- C:\Windows\System\WRHMPOG.exe
  C:\Windows\System\WRHMPOG.exe
  2⤵
  PID:5160
- C:\Windows\System\EMqcZSy.exe
  C:\Windows\System\EMqcZSy.exe
  2⤵
  PID:5608
- C:\Windows\System\jYcdmka.exe
  C:\Windows\System\jYcdmka.exe
  2⤵
  PID:6148
- C:\Windows\System\gKsBRDZ.exe
  C:\Windows\System\gKsBRDZ.exe
  2⤵
  PID:6164
- C:\Windows\System\GbyJcQV.exe
  C:\Windows\System\GbyJcQV.exe
  2⤵
  PID:6180
- C:\Windows\System\zsWRgxj.exe
  C:\Windows\System\zsWRgxj.exe
  2⤵
  PID:6196
- C:\Windows\System\sAjsiAt.exe
  C:\Windows\System\sAjsiAt.exe
  2⤵
  PID:6212
- C:\Windows\System\KAYvvgC.exe
  C:\Windows\System\KAYvvgC.exe
  2⤵
  PID:6228
- C:\Windows\System\qeKkewZ.exe
  C:\Windows\System\qeKkewZ.exe
  2⤵
  PID:6244
- C:\Windows\System\nCuCvEa.exe
  C:\Windows\System\nCuCvEa.exe
  2⤵
  PID:6260
- C:\Windows\System\AdiSMep.exe
  C:\Windows\System\AdiSMep.exe
  2⤵
  PID:6276
- C:\Windows\System\EStJbGF.exe
  C:\Windows\System\EStJbGF.exe
  2⤵
  PID:6292
- C:\Windows\System\YNHDudn.exe
  C:\Windows\System\YNHDudn.exe
  2⤵
  PID:6308
- C:\Windows\System\dShLLDx.exe
  C:\Windows\System\dShLLDx.exe
  2⤵
  PID:6324
- C:\Windows\System\xVfbpmW.exe
  C:\Windows\System\xVfbpmW.exe
  2⤵
  PID:6340
- C:\Windows\System\KNVJAdn.exe
  C:\Windows\System\KNVJAdn.exe
  2⤵
  PID:6356
- C:\Windows\System\cKoCrxZ.exe
  C:\Windows\System\cKoCrxZ.exe
  2⤵
  PID:6372
- C:\Windows\System\UvZOwCv.exe
  C:\Windows\System\UvZOwCv.exe
  2⤵
  PID:6392
- C:\Windows\System\xoUCPrk.exe
  C:\Windows\System\xoUCPrk.exe
  2⤵
  PID:6408
- C:\Windows\System\qpVdpGP.exe
  C:\Windows\System\qpVdpGP.exe
  2⤵
  PID:6424
- C:\Windows\System\XlefflP.exe
  C:\Windows\System\XlefflP.exe
  2⤵
  PID:6440
- C:\Windows\System\zmGMYRy.exe
  C:\Windows\System\zmGMYRy.exe
  2⤵
  PID:6464
- C:\Windows\System\qdPHXmu.exe
  C:\Windows\System\qdPHXmu.exe
  2⤵
  PID:6484
- C:\Windows\System\JLHICic.exe
  C:\Windows\System\JLHICic.exe
  2⤵
  PID:6512
- C:\Windows\System\QvdtuId.exe
  C:\Windows\System\QvdtuId.exe
  2⤵
  PID:6528
- C:\Windows\System\AyUnwaa.exe
  C:\Windows\System\AyUnwaa.exe
  2⤵
  PID:6544
- C:\Windows\System\CbcOEZz.exe
  C:\Windows\System\CbcOEZz.exe
  2⤵
  PID:6560
- C:\Windows\System\LurMJKd.exe
  C:\Windows\System\LurMJKd.exe
  2⤵
  PID:6576
- C:\Windows\System\IjUkjKJ.exe
  C:\Windows\System\IjUkjKJ.exe
  2⤵
  PID:6592
- C:\Windows\System\nPNvxoU.exe
  C:\Windows\System\nPNvxoU.exe
  2⤵
  PID:6612
- C:\Windows\System\byqnNSX.exe
  C:\Windows\System\byqnNSX.exe
  2⤵
  PID:6628
- C:\Windows\System\cqdOseM.exe
  C:\Windows\System\cqdOseM.exe
  2⤵
  PID:6644
- C:\Windows\System\hiFQRfO.exe
  C:\Windows\System\hiFQRfO.exe
  2⤵
  PID:6660
- C:\Windows\System\OvYEcpT.exe
  C:\Windows\System\OvYEcpT.exe
  2⤵
  PID:6676
- C:\Windows\System\kELPMrH.exe
  C:\Windows\System\kELPMrH.exe
  2⤵
  PID:6692
- C:\Windows\System\DMOJdaF.exe
  C:\Windows\System\DMOJdaF.exe
  2⤵
  PID:6708
- C:\Windows\System\eOUvfQG.exe
  C:\Windows\System\eOUvfQG.exe
  2⤵
  PID:6724
- C:\Windows\System\IubsMfB.exe
  C:\Windows\System\IubsMfB.exe
  2⤵
  PID:6740
- C:\Windows\System\kDPlWtI.exe
  C:\Windows\System\kDPlWtI.exe
  2⤵
  PID:6756
- C:\Windows\System\FxUHxox.exe
  C:\Windows\System\FxUHxox.exe
  2⤵
  PID:6776
- C:\Windows\System\DnrOlXX.exe
  C:\Windows\System\DnrOlXX.exe
  2⤵
  PID:6792
- C:\Windows\System\cmETfQF.exe
  C:\Windows\System\cmETfQF.exe
  2⤵
  PID:6808
- C:\Windows\System\DskLABD.exe
  C:\Windows\System\DskLABD.exe
  2⤵
  PID:6824
- C:\Windows\System\ihHSCoJ.exe
  C:\Windows\System\ihHSCoJ.exe
  2⤵
  PID:6840
- C:\Windows\System\OhzlVGc.exe
  C:\Windows\System\OhzlVGc.exe
  2⤵
  PID:6856
- C:\Windows\System\ehaveJi.exe
  C:\Windows\System\ehaveJi.exe
  2⤵
  PID:6872
- C:\Windows\System\RXqltYz.exe
  C:\Windows\System\RXqltYz.exe
  2⤵
  PID:6888
- C:\Windows\System\gtZPbUe.exe
  C:\Windows\System\gtZPbUe.exe
  2⤵
  PID:6904
- C:\Windows\System\wnTOtaO.exe
  C:\Windows\System\wnTOtaO.exe
  2⤵
  PID:6920
- C:\Windows\System\bSVzPVu.exe
  C:\Windows\System\bSVzPVu.exe
  2⤵
  PID:6936
- C:\Windows\System\VTesqmO.exe
  C:\Windows\System\VTesqmO.exe
  2⤵
  PID:6952
- C:\Windows\System\rStNNpg.exe
  C:\Windows\System\rStNNpg.exe
  2⤵
  PID:6968
- C:\Windows\System\qQBEImV.exe
  C:\Windows\System\qQBEImV.exe
  2⤵
  PID:6984
- C:\Windows\System\uEMRyNZ.exe
  C:\Windows\System\uEMRyNZ.exe
  2⤵
  PID:7004
- C:\Windows\System\wYLJDgQ.exe
  C:\Windows\System\wYLJDgQ.exe
  2⤵
  PID:7020
- C:\Windows\System\DHnsJyY.exe
  C:\Windows\System\DHnsJyY.exe
  2⤵
  PID:7036
- C:\Windows\System\YYMdbke.exe
  C:\Windows\System\YYMdbke.exe
  2⤵
  PID:7052
- C:\Windows\System\hWkyewP.exe
  C:\Windows\System\hWkyewP.exe
  2⤵
  PID:7068
- C:\Windows\System\RBAuwgn.exe
  C:\Windows\System\RBAuwgn.exe
  2⤵
  PID:7088
- C:\Windows\System\GLcgGdQ.exe
  C:\Windows\System\GLcgGdQ.exe
  2⤵
  PID:7104
- C:\Windows\System\PqhmlrE.exe
  C:\Windows\System\PqhmlrE.exe
  2⤵
  PID:7120
- C:\Windows\System\ySnimvr.exe
  C:\Windows\System\ySnimvr.exe
  2⤵
  PID:7136
- C:\Windows\System\BNonPDX.exe
  C:\Windows\System\BNonPDX.exe
  2⤵
  PID:7156
- C:\Windows\System\RCAqHjC.exe
  C:\Windows\System\RCAqHjC.exe
  2⤵
  PID:1448
- C:\Windows\System\scReDHo.exe
  C:\Windows\System\scReDHo.exe
  2⤵
  PID:2948
- C:\Windows\System\LmzbARJ.exe
  C:\Windows\System\LmzbARJ.exe
  2⤵
  PID:7316
- C:\Windows\System\nIABfJM.exe
  C:\Windows\System\nIABfJM.exe
  2⤵
  PID:7424
- C:\Windows\System\qTPAGNW.exe
  C:\Windows\System\qTPAGNW.exe
  2⤵
  PID:7512
- C:\Windows\System\PfALgHC.exe
  C:\Windows\System\PfALgHC.exe
  2⤵
  PID:7528
- C:\Windows\System\LuHLnjW.exe
  C:\Windows\System\LuHLnjW.exe
  2⤵
  PID:7544
- C:\Windows\System\zQiSMPZ.exe
  C:\Windows\System\zQiSMPZ.exe
  2⤵
  PID:7560
- C:\Windows\System\RKPfErQ.exe
  C:\Windows\System\RKPfErQ.exe
  2⤵
  PID:7580
- C:\Windows\System\MNZUUhk.exe
  C:\Windows\System\MNZUUhk.exe
  2⤵
  PID:7596
- C:\Windows\System\CIeoVUM.exe
  C:\Windows\System\CIeoVUM.exe
  2⤵
  PID:7612
- C:\Windows\System\nDbvGGg.exe
  C:\Windows\System\nDbvGGg.exe
  2⤵
  PID:7628
- C:\Windows\System\gVGwQyS.exe
  C:\Windows\System\gVGwQyS.exe
  2⤵
  PID:7648
- C:\Windows\System\mIOcvUl.exe
  C:\Windows\System\mIOcvUl.exe
  2⤵
  PID:7664
- C:\Windows\System\xPKXcux.exe
  C:\Windows\System\xPKXcux.exe
  2⤵
  PID:7684
- C:\Windows\System\HGmFhKi.exe
  C:\Windows\System\HGmFhKi.exe
  2⤵
  PID:7700
- C:\Windows\System\OIXROBa.exe
  C:\Windows\System\OIXROBa.exe
  2⤵
  PID:7716
- C:\Windows\System\WzsixFu.exe
  C:\Windows\System\WzsixFu.exe
  2⤵
  PID:7732
- C:\Windows\System\YztrsoJ.exe
  C:\Windows\System\YztrsoJ.exe
  2⤵
  PID:7748
- C:\Windows\System\tltxQqY.exe
  C:\Windows\System\tltxQqY.exe
  2⤵
  PID:7764
- C:\Windows\System\XbdpRDK.exe
  C:\Windows\System\XbdpRDK.exe
  2⤵
  PID:7780
- C:\Windows\System\xqAbyYc.exe
  C:\Windows\System\xqAbyYc.exe
  2⤵
  PID:7804
- C:\Windows\System\FMnPvGB.exe
  C:\Windows\System\FMnPvGB.exe
  2⤵
  PID:7820
- C:\Windows\System\mXMkOpY.exe
  C:\Windows\System\mXMkOpY.exe
  2⤵
  PID:7836
- C:\Windows\System\VRnIcHY.exe
  C:\Windows\System\VRnIcHY.exe
  2⤵
  PID:7852
- C:\Windows\System\QRvdmaY.exe
  C:\Windows\System\QRvdmaY.exe
  2⤵
  PID:7876
- C:\Windows\System\NJskcGE.exe
  C:\Windows\System\NJskcGE.exe
  2⤵
  PID:7900
- C:\Windows\System\DoepKuL.exe
  C:\Windows\System\DoepKuL.exe
  2⤵
  PID:7916
- C:\Windows\System\ysIzBhq.exe
  C:\Windows\System\ysIzBhq.exe
  2⤵
  PID:7932
- C:\Windows\System\NAHwAqA.exe
  C:\Windows\System\NAHwAqA.exe
  2⤵
  PID:7948
- C:\Windows\System\SynwnCV.exe
  C:\Windows\System\SynwnCV.exe
  2⤵
  PID:7964
- C:\Windows\System\lUuTxiU.exe
  C:\Windows\System\lUuTxiU.exe
  2⤵
  PID:7980
- C:\Windows\System\kfkwxbc.exe
  C:\Windows\System\kfkwxbc.exe
  2⤵
  PID:7996
- C:\Windows\System\zHddxGb.exe
  C:\Windows\System\zHddxGb.exe
  2⤵
  PID:8012
- C:\Windows\System\NlgDgQF.exe
  C:\Windows\System\NlgDgQF.exe
  2⤵
  PID:8032
- C:\Windows\System\OKUfQzP.exe
  C:\Windows\System\OKUfQzP.exe
  2⤵
  PID:8048
- C:\Windows\System\adNNYsD.exe
  C:\Windows\System\adNNYsD.exe
  2⤵
  PID:8064
- C:\Windows\System\ogbLDxJ.exe
  C:\Windows\System\ogbLDxJ.exe
  2⤵
  PID:8080
- C:\Windows\System\XJORwZm.exe
  C:\Windows\System\XJORwZm.exe
  2⤵
  PID:8096
- C:\Windows\System\ftwzoOe.exe
  C:\Windows\System\ftwzoOe.exe
  2⤵
  PID:8112
- C:\Windows\System\PMolyZO.exe
  C:\Windows\System\PMolyZO.exe
  2⤵
  PID:8128
- C:\Windows\System\altTtpH.exe
  C:\Windows\System\altTtpH.exe
  2⤵
  PID:8152
- C:\Windows\System\WlWbAKF.exe
  C:\Windows\System\WlWbAKF.exe
  2⤵
  PID:8168
- C:\Windows\System\KlkOzhy.exe
  C:\Windows\System\KlkOzhy.exe
  2⤵
  PID:8184
- C:\Windows\System\tyuXzYg.exe
  C:\Windows\System\tyuXzYg.exe
  2⤵
  PID:756
- C:\Windows\System\wTElHBS.exe
  C:\Windows\System\wTElHBS.exe
  2⤵
  PID:556
- C:\Windows\System\mWXTZxX.exe
  C:\Windows\System\mWXTZxX.exe
  2⤵
  PID:1492
- C:\Windows\System\FkhQntg.exe
  C:\Windows\System\FkhQntg.exe
  2⤵
  PID:2808
- C:\Windows\System\YWTndsg.exe
  C:\Windows\System\YWTndsg.exe
  2⤵
  PID:1972
- C:\Windows\System\CGBJKCF.exe
  C:\Windows\System\CGBJKCF.exe
  2⤵
  PID:2116
- C:\Windows\System\jpMnoIH.exe
  C:\Windows\System\jpMnoIH.exe
  2⤵
  PID:1152
- C:\Windows\System\HtpZrIP.exe
  C:\Windows\System\HtpZrIP.exe
  2⤵
  PID:828
- C:\Windows\System\KMchRzY.exe
  C:\Windows\System\KMchRzY.exe
  2⤵
  PID:860
- C:\Windows\System\XfDBbzw.exe
  C:\Windows\System\XfDBbzw.exe
  2⤵
  PID:3564
- C:\Windows\System\fYiqYFz.exe
  C:\Windows\System\fYiqYFz.exe
  2⤵
  PID:3628
- C:\Windows\System\jguNeaJ.exe
  C:\Windows\System\jguNeaJ.exe
  2⤵
  PID:3668
- C:\Windows\System\VOfSvkq.exe
  C:\Windows\System\VOfSvkq.exe
  2⤵
  PID:3736
- C:\Windows\System\BaVtlXK.exe
  C:\Windows\System\BaVtlXK.exe
  2⤵
  PID:3872
- C:\Windows\System\UrUUlKO.exe
  C:\Windows\System\UrUUlKO.exe
  2⤵
  PID:3936
- C:\Windows\System\nYcROlT.exe
  C:\Windows\System\nYcROlT.exe
  2⤵
  PID:4060
- C:\Windows\System\AoEOiTL.exe
  C:\Windows\System\AoEOiTL.exe
  2⤵
  PID:296
- C:\Windows\System\QCvdrry.exe
  C:\Windows\System\QCvdrry.exe
  2⤵
  PID:2436
- C:\Windows\System\TMVYODt.exe
  C:\Windows\System\TMVYODt.exe
  2⤵
  PID:4084
- C:\Windows\System\oLYLacS.exe
  C:\Windows\System\oLYLacS.exe
  2⤵
  PID:4136
- C:\Windows\System\NimpNXd.exe
  C:\Windows\System\NimpNXd.exe
  2⤵
  PID:4188
- C:\Windows\System\BTvdgJY.exe
  C:\Windows\System\BTvdgJY.exe
  2⤵
  PID:4232
- C:\Windows\System\rTeqFVH.exe
  C:\Windows\System\rTeqFVH.exe
  2⤵
  PID:4300
- C:\Windows\System\bvbvXLR.exe
  C:\Windows\System\bvbvXLR.exe
  2⤵
  PID:4872
- C:\Windows\System\jQtwfAS.exe
  C:\Windows\System\jQtwfAS.exe
  2⤵
  PID:5208
- C:\Windows\System\DlAcHeT.exe
  C:\Windows\System\DlAcHeT.exe
  2⤵
  PID:6024
- C:\Windows\System\VgPGXkS.exe
  C:\Windows\System\VgPGXkS.exe
  2⤵
  PID:6316
- C:\Windows\System\EcxGHXi.exe
  C:\Windows\System\EcxGHXi.exe
  2⤵
  PID:6420
- C:\Windows\System\dSXmJVW.exe
  C:\Windows\System\dSXmJVW.exe
  2⤵
  PID:6568
- C:\Windows\System\lMUtPJE.exe
  C:\Windows\System\lMUtPJE.exe
  2⤵
  PID:6700
- C:\Windows\System\WDseEEJ.exe
  C:\Windows\System\WDseEEJ.exe
  2⤵
  PID:6772
- C:\Windows\System\GHSmqmq.exe
  C:\Windows\System\GHSmqmq.exe
  2⤵
  PID:6836
- C:\Windows\System\vIHMaho.exe
  C:\Windows\System\vIHMaho.exe
  2⤵
  PID:6964
- C:\Windows\System\gEusWbj.exe
  C:\Windows\System\gEusWbj.exe
  2⤵
  PID:7180
- C:\Windows\System\jBbAaPy.exe
  C:\Windows\System\jBbAaPy.exe
  2⤵
  PID:7204
- C:\Windows\System\gfJsKpE.exe
  C:\Windows\System\gfJsKpE.exe
  2⤵
  PID:7236
- C:\Windows\System\TYfJKtY.exe
  C:\Windows\System\TYfJKtY.exe
  2⤵
  PID:7268
- C:\Windows\System\bYgwacc.exe
  C:\Windows\System\bYgwacc.exe
  2⤵
  PID:7284
- C:\Windows\System\xEWeXvS.exe
  C:\Windows\System\xEWeXvS.exe
  2⤵
  PID:7304
- C:\Windows\System\xfVLZGz.exe
  C:\Windows\System\xfVLZGz.exe
  2⤵
  PID:2276
- C:\Windows\System\MVICjan.exe
  C:\Windows\System\MVICjan.exe
  2⤵
  PID:4408
- C:\Windows\System\oOjmrrJ.exe
  C:\Windows\System\oOjmrrJ.exe
  2⤵
  PID:2612
- C:\Windows\System\ZlzyWoe.exe
  C:\Windows\System\ZlzyWoe.exe
  2⤵
  PID:5392
- C:\Windows\System\EtxXyKA.exe
  C:\Windows\System\EtxXyKA.exe
  2⤵
  PID:5408
- C:\Windows\System\QlMeBzY.exe
  C:\Windows\System\QlMeBzY.exe
  2⤵
  PID:5432
- C:\Windows\System\CCkBMzs.exe
  C:\Windows\System\CCkBMzs.exe
  2⤵
  PID:5440
- C:\Windows\System\vOBwaiK.exe
  C:\Windows\System\vOBwaiK.exe
  2⤵
  PID:5452
- C:\Windows\System\FuOHVff.exe
  C:\Windows\System\FuOHVff.exe
  2⤵
  PID:4884
- C:\Windows\System\IrOPWuY.exe
  C:\Windows\System\IrOPWuY.exe
  2⤵
  PID:1076
- C:\Windows\System\rLcaeyr.exe
  C:\Windows\System\rLcaeyr.exe
  2⤵
  PID:6336
- C:\Windows\System\kxNDxTk.exe
  C:\Windows\System\kxNDxTk.exe
  2⤵
  PID:6432
- C:\Windows\System\aeSXhxH.exe
  C:\Windows\System\aeSXhxH.exe
  2⤵
  PID:6480
- C:\Windows\System\cCYWAob.exe
  C:\Windows\System\cCYWAob.exe
  2⤵
  PID:6556
- C:\Windows\System\XYBbuDG.exe
  C:\Windows\System\XYBbuDG.exe
  2⤵
  PID:6652
- C:\Windows\System\JppFLMv.exe
  C:\Windows\System\JppFLMv.exe
  2⤵
  PID:6748
- C:\Windows\System\ZFjrLTi.exe
  C:\Windows\System\ZFjrLTi.exe
  2⤵
  PID:6816
- C:\Windows\System\QWfJEtz.exe
  C:\Windows\System\QWfJEtz.exe
  2⤵
  PID:6880
- C:\Windows\System\nPPRlLA.exe
  C:\Windows\System\nPPRlLA.exe
  2⤵
  PID:6944
- C:\Windows\System\kdLnAAm.exe
  C:\Windows\System\kdLnAAm.exe
  2⤵
  PID:7012
- C:\Windows\System\sbBdvtK.exe
  C:\Windows\System\sbBdvtK.exe
  2⤵
  PID:1772
- C:\Windows\System\xldVdZZ.exe
  C:\Windows\System\xldVdZZ.exe
  2⤵
  PID:7076
- C:\Windows\System\MwYFrRU.exe
  C:\Windows\System\MwYFrRU.exe
  2⤵
  PID:7116
- C:\Windows\System\gaoebYY.exe
  C:\Windows\System\gaoebYY.exe
  2⤵
  PID:2064
- C:\Windows\System\dICVVxY.exe
  C:\Windows\System\dICVVxY.exe
  2⤵
  PID:1956
- C:\Windows\System\gvJeVpt.exe
  C:\Windows\System\gvJeVpt.exe
  2⤵
  PID:3140
- C:\Windows\System\fnXIPoI.exe
  C:\Windows\System\fnXIPoI.exe
  2⤵
  PID:3204
- C:\Windows\System\GwQRKkW.exe
  C:\Windows\System\GwQRKkW.exe
  2⤵
  PID:3240
- C:\Windows\System\oVgbCVy.exe
  C:\Windows\System\oVgbCVy.exe
  2⤵
  PID:7324
- C:\Windows\System\qqWezki.exe
  C:\Windows\System\qqWezki.exe
  2⤵
  PID:4792
- C:\Windows\System\rNCRFIG.exe
  C:\Windows\System\rNCRFIG.exe
  2⤵
  PID:4588
- C:\Windows\System\wNQmIPU.exe
  C:\Windows\System\wNQmIPU.exe
  2⤵
  PID:4316
- C:\Windows\System\CsxwaKA.exe
  C:\Windows\System\CsxwaKA.exe
  2⤵
  PID:5688
- C:\Windows\System\oyPvcfm.exe
  C:\Windows\System\oyPvcfm.exe
  2⤵
  PID:5620
- C:\Windows\System\okvmUgP.exe
  C:\Windows\System\okvmUgP.exe
  2⤵
  PID:5556
- C:\Windows\System\LAooXLP.exe
  C:\Windows\System\LAooXLP.exe
  2⤵
  PID:5492
- C:\Windows\System\UMRCCeU.exe
  C:\Windows\System\UMRCCeU.exe
  2⤵
  PID:5352
- C:\Windows\System\jrmajzr.exe
  C:\Windows\System\jrmajzr.exe
  2⤵
  PID:5272
- C:\Windows\System\pDfGJxz.exe
  C:\Windows\System\pDfGJxz.exe
  2⤵
  PID:5204
- C:\Windows\System\BZmePYC.exe
  C:\Windows\System\BZmePYC.exe
  2⤵
  PID:5140
- C:\Windows\System\dBrzDyb.exe
  C:\Windows\System\dBrzDyb.exe
  2⤵
  PID:2944
- C:\Windows\System\pNiMUPp.exe
  C:\Windows\System\pNiMUPp.exe
  2⤵
  PID:5088
- C:\Windows\System\OsyTvvx.exe
  C:\Windows\System\OsyTvvx.exe
  2⤵
  PID:5020
- C:\Windows\System\ODybCgl.exe
  C:\Windows\System\ODybCgl.exe
  2⤵
  PID:4940
- C:\Windows\System\Olgctgu.exe
  C:\Windows\System\Olgctgu.exe
  2⤵
  PID:4864
- C:\Windows\System\hAhuCYA.exe
  C:\Windows\System\hAhuCYA.exe
  2⤵
  PID:4776
- C:\Windows\System\kiIOBpF.exe
  C:\Windows\System\kiIOBpF.exe
  2⤵
  PID:4712
- C:\Windows\System\nmmAdtF.exe
  C:\Windows\System\nmmAdtF.exe
  2⤵
  PID:4636
- C:\Windows\System\MQOcRRe.exe
  C:\Windows\System\MQOcRRe.exe
  2⤵
  PID:4544
- C:\Windows\System\HtrxtSD.exe
  C:\Windows\System\HtrxtSD.exe
  2⤵
  PID:4508
- C:\Windows\System\hJdQZus.exe
  C:\Windows\System\hJdQZus.exe
  2⤵
  PID:4400
- C:\Windows\System\xabLPyN.exe
  C:\Windows\System\xabLPyN.exe
  2⤵
  PID:2336
- C:\Windows\System\QEvPCCN.exe
  C:\Windows\System\QEvPCCN.exe
  2⤵
  PID:7572
- C:\Windows\System\ZxJdwQk.exe
  C:\Windows\System\ZxJdwQk.exe
  2⤵
  PID:7644
- C:\Windows\System\kTazDyv.exe
  C:\Windows\System\kTazDyv.exe
  2⤵
  PID:7676
- C:\Windows\System\ntjzDgW.exe
  C:\Windows\System\ntjzDgW.exe
  2⤵
  PID:7744
- C:\Windows\System\NxzhJqt.exe
  C:\Windows\System\NxzhJqt.exe
  2⤵
  PID:7816
- C:\Windows\System\EDkxwpw.exe
  C:\Windows\System\EDkxwpw.exe
  2⤵
  PID:7524
- C:\Windows\System\obAXcOQ.exe
  C:\Windows\System\obAXcOQ.exe
  2⤵
  PID:2768
- C:\Windows\System\XjgyNvV.exe
  C:\Windows\System\XjgyNvV.exe
  2⤵
  PID:7588
- C:\Windows\System\cpwdPqD.exe
  C:\Windows\System\cpwdPqD.exe
  2⤵
  PID:7760
- C:\Windows\System\JXVLIpq.exe
  C:\Windows\System\JXVLIpq.exe
  2⤵
  PID:7800
- C:\Windows\System\HhXmhFk.exe
  C:\Windows\System\HhXmhFk.exe
  2⤵
  PID:7864
- C:\Windows\System\KoBlUSH.exe
  C:\Windows\System\KoBlUSH.exe
  2⤵
  PID:7884
- C:\Windows\System\rLGUAWq.exe
  C:\Windows\System\rLGUAWq.exe
  2⤵
  PID:304
- C:\Windows\System\LDzVBvl.exe
  C:\Windows\System\LDzVBvl.exe
  2⤵
  PID:7656
- C:\Windows\System\DgkgIjR.exe
  C:\Windows\System\DgkgIjR.exe
  2⤵
  PID:8056
- C:\Windows\System\UzWThlh.exe
  C:\Windows\System\UzWThlh.exe
  2⤵
  PID:2524
- C:\Windows\System\VXViTpp.exe
  C:\Windows\System\VXViTpp.exe
  2⤵
  PID:540
- C:\Windows\System\RHMUFkQ.exe
  C:\Windows\System\RHMUFkQ.exe
  2⤵
  PID:300
- C:\Windows\System\joljSeC.exe
  C:\Windows\System\joljSeC.exe
  2⤵
  PID:2720
- C:\Windows\System\imwOPif.exe
  C:\Windows\System\imwOPif.exe
  2⤵
  PID:2916
- C:\Windows\System\EuDMEUe.exe
  C:\Windows\System\EuDMEUe.exe
  2⤵
  PID:8140
- C:\Windows\System\MimVrVd.exe
  C:\Windows\System\MimVrVd.exe
  2⤵
  PID:8040
- C:\Windows\System\ldGUAGt.exe
  C:\Windows\System\ldGUAGt.exe
  2⤵
  PID:8176
- C:\Windows\System\EbaeAyJ.exe
  C:\Windows\System\EbaeAyJ.exe
  2⤵
  PID:8028
- C:\Windows\System\BoutDpg.exe
  C:\Windows\System\BoutDpg.exe
  2⤵
  PID:2412
- C:\Windows\System\JjOgKhR.exe
  C:\Windows\System\JjOgKhR.exe
  2⤵
  PID:344
- C:\Windows\System\NpEaUTC.exe
  C:\Windows\System\NpEaUTC.exe
  2⤵
  PID:7976
- C:\Windows\System\BLZrYMp.exe
  C:\Windows\System\BLZrYMp.exe
  2⤵
  PID:8180
- C:\Windows\System\prMSJOJ.exe
  C:\Windows\System\prMSJOJ.exe
  2⤵
  PID:7940
- C:\Windows\System\pHxvMTt.exe
  C:\Windows\System\pHxvMTt.exe
  2⤵
  PID:8144
- C:\Windows\System\HQKDioq.exe
  C:\Windows\System\HQKDioq.exe
  2⤵
  PID:8076
- C:\Windows\System\wtJKUKP.exe
  C:\Windows\System\wtJKUKP.exe
  2⤵
  PID:3364
- C:\Windows\System\ThFFLDM.exe
  C:\Windows\System\ThFFLDM.exe
  2⤵
  PID:3448
- C:\Windows\System\bdTlYuV.exe
  C:\Windows\System\bdTlYuV.exe
  2⤵
  PID:1412
- C:\Windows\System\lrmPdwg.exe
  C:\Windows\System\lrmPdwg.exe
  2⤵
  PID:3472
- C:\Windows\System\vJFpdqP.exe
  C:\Windows\System\vJFpdqP.exe
  2⤵
  PID:3536
- C:\Windows\System\RxdUxBb.exe
  C:\Windows\System\RxdUxBb.exe
  2⤵
  PID:3552
- C:\Windows\System\ZowNIxE.exe
  C:\Windows\System\ZowNIxE.exe
  2⤵
  PID:3556
- C:\Windows\System\GBsbWbJ.exe
  C:\Windows\System\GBsbWbJ.exe
  2⤵
  PID:7336
- C:\Windows\System\jVgcTkG.exe
  C:\Windows\System\jVgcTkG.exe
  2⤵
  PID:3596
- C:\Windows\System\tqaApQu.exe
  C:\Windows\System\tqaApQu.exe
  2⤵
  PID:3640
- C:\Windows\System\sTyYGIc.exe
  C:\Windows\System\sTyYGIc.exe
  2⤵
  PID:3772
- C:\Windows\System\aYjDzQZ.exe
  C:\Windows\System\aYjDzQZ.exe
  2⤵
  PID:3908
- C:\Windows\System\GwSNTOd.exe
  C:\Windows\System\GwSNTOd.exe
  2⤵
  PID:4068
- C:\Windows\System\yaHrtjp.exe
  C:\Windows\System\yaHrtjp.exe
  2⤵
  PID:2992
- C:\Windows\System\ZEaWxhR.exe
  C:\Windows\System\ZEaWxhR.exe
  2⤵
  PID:3252
- C:\Windows\System\GrRJvGV.exe
  C:\Windows\System\GrRJvGV.exe
  2⤵
  PID:3416
- C:\Windows\System\ecRDDXh.exe
  C:\Windows\System\ecRDDXh.exe
  2⤵
  PID:2552
- C:\Windows\System\xIzIPIQ.exe
  C:\Windows\System\xIzIPIQ.exe
  2⤵
  PID:3844
- C:\Windows\System\GqGaCWN.exe
  C:\Windows\System\GqGaCWN.exe
  2⤵
  PID:4008
- C:\Windows\System\npDsxtd.exe
  C:\Windows\System\npDsxtd.exe
  2⤵
  PID:4052
- C:\Windows\System\umaeTSQ.exe
  C:\Windows\System\umaeTSQ.exe
  2⤵
  PID:3496
- C:\Windows\System\kZGMPre.exe
  C:\Windows\System\kZGMPre.exe
  2⤵
  PID:3504
- C:\Windows\System\tapIdBk.exe
  C:\Windows\System\tapIdBk.exe
  2⤵
  PID:3724
- C:\Windows\System\NpIoGff.exe
  C:\Windows\System\NpIoGff.exe
  2⤵
  PID:3924
- C:\Windows\System\zWXXfpv.exe
  C:\Windows\System\zWXXfpv.exe
  2⤵
  PID:2424
- C:\Windows\System\rzfeIhf.exe
  C:\Windows\System\rzfeIhf.exe
  2⤵
  PID:2408
- C:\Windows\System\SMmPSNf.exe
  C:\Windows\System\SMmPSNf.exe
  2⤵
  PID:1600
- C:\Windows\System\KFtLTkw.exe
  C:\Windows\System\KFtLTkw.exe
  2⤵
  PID:1968
- C:\Windows\System\grNlfNj.exe
  C:\Windows\System\grNlfNj.exe
  2⤵
  PID:5924
- C:\Windows\System\Kfctifn.exe
  C:\Windows\System\Kfctifn.exe
  2⤵
  PID:4700
- C:\Windows\System\RHtXANB.exe
  C:\Windows\System\RHtXANB.exe
  2⤵
  PID:5000
- C:\Windows\System\LcUbxBI.exe
  C:\Windows\System\LcUbxBI.exe
  2⤵
  PID:6156
- C:\Windows\System\gYCYUTx.exe
  C:\Windows\System\gYCYUTx.exe
  2⤵
  PID:6192
- C:\Windows\System\roVWSeC.exe
  C:\Windows\System\roVWSeC.exe
  2⤵
  PID:6224
- C:\Windows\System\uSgyxvh.exe
  C:\Windows\System\uSgyxvh.exe
  2⤵
  PID:2936
- C:\Windows\System\SRLCfuL.exe
  C:\Windows\System\SRLCfuL.exe
  2⤵
  PID:6352
- C:\Windows\System\ISUPIgT.exe
  C:\Windows\System\ISUPIgT.exe
  2⤵
  PID:4012
- C:\Windows\System\ptxSmjC.exe
  C:\Windows\System\ptxSmjC.exe
  2⤵
  PID:6456
- C:\Windows\System\EedzXsR.exe
  C:\Windows\System\EedzXsR.exe
  2⤵
  PID:6504
- C:\Windows\System\vQrJwlV.exe
  C:\Windows\System\vQrJwlV.exe
  2⤵
  PID:6540
- C:\Windows\System\WUkqMEe.exe
  C:\Windows\System\WUkqMEe.exe
  2⤵
  PID:6636
- C:\Windows\System\GeeSxtg.exe
  C:\Windows\System\GeeSxtg.exe
  2⤵
  PID:6764
- C:\Windows\System\rYgAldL.exe
  C:\Windows\System\rYgAldL.exe
  2⤵
  PID:6804
- C:\Windows\System\OGOOIQV.exe
  C:\Windows\System\OGOOIQV.exe
  2⤵
  PID:6900
- C:\Windows\System\sZqShFj.exe
  C:\Windows\System\sZqShFj.exe
  2⤵
  PID:6932
- C:\Windows\System\teJBRaZ.exe
  C:\Windows\System\teJBRaZ.exe
  2⤵
  PID:7060
- C:\Windows\System\tFacseB.exe
  C:\Windows\System\tFacseB.exe
  2⤵
  PID:7064
- C:\Windows\System\AgKFjml.exe
  C:\Windows\System\AgKFjml.exe
  2⤵
  PID:7164
- C:\Windows\System\CytNNQN.exe
  C:\Windows\System\CytNNQN.exe
  2⤵
  PID:7100
- C:\Windows\System\QFlWgCw.exe
  C:\Windows\System\QFlWgCw.exe
  2⤵
  PID:7252
- C:\Windows\System\yAwijIX.exe
  C:\Windows\System\yAwijIX.exe
  2⤵
  PID:7300
- C:\Windows\System\eKKZYzF.exe
  C:\Windows\System\eKKZYzF.exe
  2⤵
  PID:7216
- C:\Windows\System\NscgfTv.exe
  C:\Windows\System\NscgfTv.exe
  2⤵
  PID:1560
- C:\Windows\System\LJhxdyR.exe
  C:\Windows\System\LJhxdyR.exe
  2⤵
  PID:772
- C:\Windows\System\TBvPFbG.exe
  C:\Windows\System\TBvPFbG.exe
  2⤵
  PID:2256
- C:\Windows\System\gYGBsSz.exe
  C:\Windows\System\gYGBsSz.exe
  2⤵
  PID:3052
- C:\Windows\System\rqnrEvH.exe
  C:\Windows\System\rqnrEvH.exe
  2⤵
  PID:4176
- C:\Windows\System\frVIJsj.exe
  C:\Windows\System\frVIJsj.exe
  2⤵
  PID:5280
- C:\Windows\System\aqeQbCw.exe
  C:\Windows\System\aqeQbCw.exe
  2⤵
  PID:2960
- C:\Windows\System\aibumYY.exe
  C:\Windows\System\aibumYY.exe
  2⤵
  PID:5416
- C:\Windows\System\KvqHQAe.exe
  C:\Windows\System\KvqHQAe.exe
  2⤵
  PID:4968
- C:\Windows\System\lwmYROX.exe
  C:\Windows\System\lwmYROX.exe
  2⤵
  PID:5464
- C:\Windows\System\pIvqRMY.exe
  C:\Windows\System\pIvqRMY.exe
  2⤵
  PID:6108
- C:\Windows\System\zItYqFw.exe
  C:\Windows\System\zItYqFw.exe
  2⤵
  PID:5228
- C:\Windows\System\GFGOWJa.exe
  C:\Windows\System\GFGOWJa.exe
  2⤵
  PID:6368
- C:\Windows\System\VXpuvrz.exe
  C:\Windows\System\VXpuvrz.exe
  2⤵
  PID:6204
- C:\Windows\System\WDcQQbI.exe
  C:\Windows\System\WDcQQbI.exe
  2⤵
  PID:5700
- C:\Windows\System\ouzLHII.exe
  C:\Windows\System\ouzLHII.exe
  2⤵
  PID:1236
- C:\Windows\System\GKODdBy.exe
  C:\Windows\System\GKODdBy.exe
  2⤵
  PID:5704
- C:\Windows\System\tEqVMCY.exe
  C:\Windows\System\tEqVMCY.exe
  2⤵
  PID:4624
- C:\Windows\System\YlKqPTQ.exe
  C:\Windows\System\YlKqPTQ.exe
  2⤵
  PID:6208
- C:\Windows\System\TJOYUPm.exe
  C:\Windows\System\TJOYUPm.exe
  2⤵
  PID:6268
- C:\Windows\System\QTQQoHX.exe
  C:\Windows\System\QTQQoHX.exe
  2⤵
  PID:6332
- C:\Windows\System\EIoHhcc.exe
  C:\Windows\System\EIoHhcc.exe
  2⤵
  PID:6472
- C:\Windows\System\aHUhBch.exe
  C:\Windows\System\aHUhBch.exe
  2⤵
  PID:6788
- C:\Windows\System\rvIJvyZ.exe
  C:\Windows\System\rvIJvyZ.exe
  2⤵
  PID:7048
- C:\Windows\System\QARmdpd.exe
  C:\Windows\System\QARmdpd.exe
  2⤵
  PID:1268
- C:\Windows\System\qZHVRau.exe
  C:\Windows\System\qZHVRau.exe
  2⤵
  PID:1856
- C:\Windows\System\giJielR.exe
  C:\Windows\System\giJielR.exe
  2⤵
  PID:4660
- C:\Windows\System\EkQUObn.exe
  C:\Windows\System\EkQUObn.exe
  2⤵
  PID:6720
- C:\Windows\System\jwuEIRo.exe
  C:\Windows\System\jwuEIRo.exe
  2⤵
  PID:6980
- C:\Windows\System\fkxfJUe.exe
  C:\Windows\System\fkxfJUe.exe
  2⤵
  PID:2964
- C:\Windows\System\VrzAPsO.exe
  C:\Windows\System\VrzAPsO.exe
  2⤵
  PID:3236
- C:\Windows\System\IzAzuvJ.exe
  C:\Windows\System\IzAzuvJ.exe
  2⤵
  PID:4320
- C:\Windows\System\rEnpGUD.exe
  C:\Windows\System\rEnpGUD.exe
  2⤵
  PID:6100
- C:\Windows\System\Qrgwdkg.exe
  C:\Windows\System\Qrgwdkg.exe
  2⤵
  PID:6036
- C:\Windows\System\HLDdwyY.exe
  C:\Windows\System\HLDdwyY.exe
  2⤵
  PID:5972
- C:\Windows\System\AfWFvrw.exe
  C:\Windows\System\AfWFvrw.exe
  2⤵
  PID:5908
- C:\Windows\System\slgZtze.exe
  C:\Windows\System\slgZtze.exe
  2⤵
  PID:5844
- C:\Windows\System\GueeIha.exe
  C:\Windows\System\GueeIha.exe
  2⤵
  PID:5780
- C:\Windows\System\IyNjwyV.exe
  C:\Windows\System\IyNjwyV.exe
  2⤵
  PID:5656
- C:\Windows\System\uUOKiMZ.exe
  C:\Windows\System\uUOKiMZ.exe
  2⤵
  PID:5560
- C:\Windows\System\NnwRkpo.exe
  C:\Windows\System\NnwRkpo.exe
  2⤵
  PID:2728
- C:\Windows\System\JILxKZf.exe
  C:\Windows\System\JILxKZf.exe
  2⤵
  PID:4904
- C:\Windows\System\poHzjPJ.exe
  C:\Windows\System\poHzjPJ.exe
  2⤵
  PID:5524
- C:\Windows\System\BgJKkxk.exe
  C:\Windows\System\BgJKkxk.exe
  2⤵
  PID:5172
- C:\Windows\System\amJruZC.exe
  C:\Windows\System\amJruZC.exe
  2⤵
  PID:5116
- C:\Windows\System\RMzdOVk.exe
  C:\Windows\System\RMzdOVk.exe
  2⤵
  PID:4780
- C:\Windows\System\QVZCham.exe
  C:\Windows\System\QVZCham.exe
  2⤵
  PID:4512
- C:\Windows\System\TdxPwTs.exe
  C:\Windows\System\TdxPwTs.exe
  2⤵
  PID:4364
- C:\Windows\System\RgbjQYL.exe
  C:\Windows\System\RgbjQYL.exe
  2⤵
  PID:4604
- C:\Windows\System\erxHSfM.exe
  C:\Windows\System\erxHSfM.exe
  2⤵
  PID:4440
- C:\Windows\System\btdujJs.exe
  C:\Windows\System\btdujJs.exe
  2⤵
  PID:7436
- C:\Windows\System\InRKfcO.exe
  C:\Windows\System\InRKfcO.exe
  2⤵
  PID:7444
- C:\Windows\System\YynaQUN.exe
  C:\Windows\System\YynaQUN.exe
  2⤵
  PID:7408
- C:\Windows\System\vUUZrDb.exe
  C:\Windows\System\vUUZrDb.exe
  2⤵
  PID:7416
- C:\Windows\System\qGlhJtE.exe
  C:\Windows\System\qGlhJtE.exe
  2⤵
  PID:1192
- C:\Windows\System\XgNHoVk.exe
  C:\Windows\System\XgNHoVk.exe
  2⤵
  PID:7476
- C:\Windows\System\GVIfTUb.exe
  C:\Windows\System\GVIfTUb.exe
  2⤵
  PID:7472
- C:\Windows\System\DvNstaD.exe
  C:\Windows\System\DvNstaD.exe
  2⤵
  PID:7504
- C:\Windows\System\RboNPjC.exe
  C:\Windows\System\RboNPjC.exe
  2⤵
  PID:7508
- C:\Windows\System\YSKqEmd.exe
  C:\Windows\System\YSKqEmd.exe
  2⤵
  PID:7576
- C:\Windows\System\vsYYmuP.exe
  C:\Windows\System\vsYYmuP.exe
  2⤵
  PID:7812
- C:\Windows\System\mMNkOdF.exe
  C:\Windows\System\mMNkOdF.exe
  2⤵
  PID:7728
- C:\Windows\System\oenOslV.exe
  C:\Windows\System\oenOslV.exe
  2⤵
  PID:7520
- C:\Windows\System\ccytTmW.exe
  C:\Windows\System\ccytTmW.exe
  2⤵
  PID:7848
- C:\Windows\System\NjmdtTo.exe
  C:\Windows\System\NjmdtTo.exe
  2⤵
  PID:8024
- C:\Windows\System\PCaoRjr.exe
  C:\Windows\System\PCaoRjr.exe
  2⤵
  PID:628
- C:\Windows\System\EgrvQiG.exe
  C:\Windows\System\EgrvQiG.exe
  2⤵
  PID:8104
- C:\Windows\System\sCIBfyA.exe
  C:\Windows\System\sCIBfyA.exe
  2⤵
  PID:7944
- C:\Windows\System\dBPlILL.exe
  C:\Windows\System\dBPlILL.exe
  2⤵
  PID:3396
- C:\Windows\System\wlwETJD.exe
  C:\Windows\System\wlwETJD.exe
  2⤵
  PID:3544
- C:\Windows\System\UsrbDjm.exe
  C:\Windows\System\UsrbDjm.exe
  2⤵
  PID:7908
- C:\Windows\System\CgtbFkX.exe
  C:\Windows\System\CgtbFkX.exe
  2⤵
  PID:2380
- C:\Windows\System\cWUnGIz.exe
  C:\Windows\System\cWUnGIz.exe
  2⤵
  PID:3284
- C:\Windows\System\CqSKgnV.exe
  C:\Windows\System\CqSKgnV.exe
  2⤵
  PID:4044
- C:\Windows\System\jyAKOHl.exe
  C:\Windows\System\jyAKOHl.exe
  2⤵
  PID:3828
- C:\Windows\System\kqHYAXK.exe
  C:\Windows\System\kqHYAXK.exe
  2⤵
  PID:2532
- C:\Windows\System\Hmbbkva.exe
  C:\Windows\System\Hmbbkva.exe
  2⤵
  PID:7796
- C:\Windows\System\eRgXchU.exe
  C:\Windows\System\eRgXchU.exe
  2⤵
  PID:8088
- C:\Windows\System\uLFKwIG.exe
  C:\Windows\System\uLFKwIG.exe
  2⤵
  PID:3220
- C:\Windows\System\itANbnL.exe
  C:\Windows\System\itANbnL.exe
  2⤵
  PID:7592
- C:\Windows\System\SOOwwbM.exe
  C:\Windows\System\SOOwwbM.exe
  2⤵
  PID:2628
- C:\Windows\System\TNJtZiO.exe
  C:\Windows\System\TNJtZiO.exe
  2⤵
  PID:7960
- C:\Windows\System\qCsIXbS.exe
  C:\Windows\System\qCsIXbS.exe
  2⤵
  PID:8004
- C:\Windows\System\nzqRRmy.exe
  C:\Windows\System\nzqRRmy.exe
  2⤵
  PID:5480
- C:\Windows\System\jVXJrDy.exe
  C:\Windows\System\jVXJrDy.exe
  2⤵
  PID:3304
- C:\Windows\System\jxKWCOY.exe
  C:\Windows\System\jxKWCOY.exe
  2⤵
  PID:2632
- C:\Windows\System\hZgRygC.exe
  C:\Windows\System\hZgRygC.exe
  2⤵
  PID:3708
- C:\Windows\System\cXocneD.exe
  C:\Windows\System\cXocneD.exe
  2⤵
  PID:4000
- C:\Windows\System\DXqHhwt.exe
  C:\Windows\System\DXqHhwt.exe
  2⤵
  PID:3692
- C:\Windows\System\HDAmxcS.exe
  C:\Windows\System\HDAmxcS.exe
  2⤵
  PID:2784
- C:\Windows\System\dNncMsY.exe
  C:\Windows\System\dNncMsY.exe
  2⤵
  PID:2388
- C:\Windows\System\oTNKvBs.exe
  C:\Windows\System\oTNKvBs.exe
  2⤵
  PID:6452
- C:\Windows\System\SEDdtKg.exe
  C:\Windows\System\SEDdtKg.exe
  2⤵
  PID:6284
- C:\Windows\System\xQivLad.exe
  C:\Windows\System\xQivLad.exe
  2⤵
  PID:4200
- C:\Windows\System\lvHKofu.exe
  C:\Windows\System\lvHKofu.exe
  2⤵
  PID:6996
- C:\Windows\System\PFQnjYb.exe
  C:\Windows\System\PFQnjYb.exe
  2⤵
  PID:7128
- C:\Windows\System\GxGggzV.exe
  C:\Windows\System\GxGggzV.exe
  2⤵
  PID:7292
- C:\Windows\System\QOzvniu.exe
  C:\Windows\System\QOzvniu.exe
  2⤵
  PID:3560
- C:\Windows\System\owtnDIf.exe
  C:\Windows\System\owtnDIf.exe
  2⤵
  PID:7172
- C:\Windows\System\EIvwDsC.exe
  C:\Windows\System\EIvwDsC.exe
  2⤵
  PID:6736
- C:\Windows\System\yARjvzG.exe
  C:\Windows\System\yARjvzG.exe
  2⤵
  PID:7264
- C:\Windows\System\QApiRvr.exe
  C:\Windows\System\QApiRvr.exe
  2⤵
  PID:6768
- C:\Windows\System\TLFlUIX.exe
  C:\Windows\System\TLFlUIX.exe
  2⤵
  PID:2644
- C:\Windows\System\dEedVzv.exe
  C:\Windows\System\dEedVzv.exe
  2⤵
  PID:4100
- C:\Windows\System\rEWcopB.exe
  C:\Windows\System\rEWcopB.exe
  2⤵
  PID:7364
- C:\Windows\System\QIDPArv.exe
  C:\Windows\System\QIDPArv.exe
  2⤵
  PID:5400
- C:\Windows\System\ZuonnHf.exe
  C:\Windows\System\ZuonnHf.exe
  2⤵
  PID:4236
- C:\Windows\System\ZzbragD.exe
  C:\Windows\System\ZzbragD.exe
  2⤵
  PID:6172
- C:\Windows\System\KsILMGx.exe
  C:\Windows\System\KsILMGx.exe
  2⤵
  PID:6304
- C:\Windows\System\hpAlwys.exe
  C:\Windows\System\hpAlwys.exe
  2⤵
  PID:6620
- C:\Windows\System\GKsWUZe.exe
  C:\Windows\System\GKsWUZe.exe
  2⤵
  PID:2068
- C:\Windows\System\aUiAGPI.exe
  C:\Windows\System\aUiAGPI.exe
  2⤵
  PID:4492
- C:\Windows\System\IwDBuVf.exe
  C:\Windows\System\IwDBuVf.exe
  2⤵
  PID:4524
- C:\Windows\System\LzLzpjd.exe
  C:\Windows\System\LzLzpjd.exe
  2⤵
  PID:6524
- C:\Windows\System\doEXvAp.exe
  C:\Windows\System\doEXvAp.exe
  2⤵
  PID:6852
- C:\Windows\System\JNHaJse.exe
  C:\Windows\System\JNHaJse.exe
  2⤵
  PID:2912
- C:\Windows\System\xIvgpql.exe
  C:\Windows\System\xIvgpql.exe
  2⤵
  PID:6552
- C:\Windows\System\XZGBKen.exe
  C:\Windows\System\XZGBKen.exe
  2⤵
  PID:4764
- C:\Windows\System\BHEZzJl.exe
  C:\Windows\System\BHEZzJl.exe
  2⤵
  PID:5940
- C:\Windows\System\yVLBUpV.exe
  C:\Windows\System\yVLBUpV.exe
  2⤵
  PID:5848
- C:\Windows\System\SLobFHT.exe
  C:\Windows\System\SLobFHT.exe
  2⤵
  PID:5748
- C:\Windows\System\rGLDYWZ.exe
  C:\Windows\System\rGLDYWZ.exe
  2⤵
  PID:5056
- C:\Windows\System\saSDXbZ.exe
  C:\Windows\System\saSDXbZ.exe
  2⤵
  PID:4744
- C:\Windows\System\CeghxNA.exe
  C:\Windows\System\CeghxNA.exe
  2⤵
  PID:5276
- C:\Windows\System\CaHUXdT.exe
  C:\Windows\System\CaHUXdT.exe
  2⤵
  PID:4336
- C:\Windows\System\fqEXAPL.exe
  C:\Windows\System\fqEXAPL.exe
  2⤵
  PID:4980
- C:\Windows\System\SGzBfOY.exe
  C:\Windows\System\SGzBfOY.exe
  2⤵
  PID:4716
- C:\Windows\System\JTCabLl.exe
  C:\Windows\System\JTCabLl.exe
  2⤵
  PID:1580
- C:\Windows\System\xJSBiUY.exe
  C:\Windows\System\xJSBiUY.exe
  2⤵
  PID:7488
- C:\Windows\System\UxQTPQF.exe
  C:\Windows\System\UxQTPQF.exe
  2⤵
  PID:7660
- C:\Windows\System\AHCDMHv.exe
  C:\Windows\System\AHCDMHv.exe
  2⤵
  PID:7456
- C:\Windows\System\AWDUIvl.exe
  C:\Windows\System\AWDUIvl.exe
  2⤵
  PID:7912
- C:\Windows\System\xkEIMkw.exe
  C:\Windows\System\xkEIMkw.exe
  2⤵
  PID:2588
- C:\Windows\System\HwmhSQA.exe
  C:\Windows\System\HwmhSQA.exe
  2⤵
  PID:3808
- C:\Windows\System\jDGitYf.exe
  C:\Windows\System\jDGitYf.exe
  2⤵
  PID:3080
- C:\Windows\System\cBjRVax.exe
  C:\Windows\System\cBjRVax.exe
  2⤵
  PID:7924
- C:\Windows\System\zOpKrtU.exe
  C:\Windows\System\zOpKrtU.exe
  2⤵
  PID:2224
- C:\Windows\System\jivWtzT.exe
  C:\Windows\System\jivWtzT.exe
  2⤵
  PID:2132
- C:\Windows\System\vThXMgr.exe
  C:\Windows\System\vThXMgr.exe
  2⤵
  PID:7776
- C:\Windows\System\OVmjxFP.exe
  C:\Windows\System\OVmjxFP.exe
  2⤵
  PID:7712
- C:\Windows\System\jSLZaHE.exe
  C:\Windows\System\jSLZaHE.exe
  2⤵
  PID:844
- C:\Windows\System\pQvuBpv.exe
  C:\Windows\System\pQvuBpv.exe
  2⤵
  PID:2904
- C:\Windows\System\vBBLmhV.exe
  C:\Windows\System\vBBLmhV.exe
  2⤵
  PID:3500
- C:\Windows\System\ygtPjcD.exe
  C:\Windows\System\ygtPjcD.exe
  2⤵
  PID:2560
- C:\Windows\System\rPbjSCK.exe
  C:\Windows\System\rPbjSCK.exe
  2⤵
  PID:8072
- C:\Windows\System\kFCpRHi.exe
  C:\Windows\System\kFCpRHi.exe
  2⤵
  PID:880
- C:\Windows\System\HXmXXdJ.exe
  C:\Windows\System\HXmXXdJ.exe
  2⤵
  PID:6536
- C:\Windows\System\FQchsCO.exe
  C:\Windows\System\FQchsCO.exe
  2⤵
  PID:6288
- C:\Windows\System\ZDaTWWr.exe
  C:\Windows\System\ZDaTWWr.exe
  2⤵
  PID:6500
- C:\Windows\System\ITfCXzx.exe
  C:\Windows\System\ITfCXzx.exe
  2⤵
  PID:2340
- C:\Windows\System\VxFgekm.exe
  C:\Windows\System\VxFgekm.exe
  2⤵
  PID:2756
- C:\Windows\System\PKUVQZm.exe
  C:\Windows\System\PKUVQZm.exe
  2⤵
  PID:488
- C:\Windows\System\GURGgHF.exe
  C:\Windows\System\GURGgHF.exe
  2⤵
  PID:7188
- C:\Windows\System\VbTqHGN.exe
  C:\Windows\System\VbTqHGN.exe
  2⤵
  PID:5988
- C:\Windows\System\OflCmAk.exe
  C:\Windows\System\OflCmAk.exe
  2⤵
  PID:5340
- C:\Windows\System\jcvzubx.exe
  C:\Windows\System\jcvzubx.exe
  2⤵
  PID:3456
- C:\Windows\System\ZZvUuwb.exe
  C:\Windows\System\ZZvUuwb.exe
  2⤵
  PID:5544
- C:\Windows\System\hFDsNnW.exe
  C:\Windows\System\hFDsNnW.exe
  2⤵
  PID:7044
- C:\Windows\System\agbfSLO.exe
  C:\Windows\System\agbfSLO.exe
  2⤵
  PID:6400
- C:\Windows\System\KgMhFuP.exe
  C:\Windows\System\KgMhFuP.exe
  2⤵
  PID:608
- C:\Windows\System\UYbKcdr.exe
  C:\Windows\System\UYbKcdr.exe
  2⤵
  PID:3272
- C:\Windows\System\VYUxGHs.exe
  C:\Windows\System\VYUxGHs.exe
  2⤵
  PID:6068
- C:\Windows\System\zKmrWBj.exe
  C:\Windows\System\zKmrWBj.exe
  2⤵
  PID:2432
- C:\Windows\System\ZnRPqUr.exe
  C:\Windows\System\ZnRPqUr.exe
  2⤵
  PID:3460
- C:\Windows\System\cHBbrRk.exe
  C:\Windows\System\cHBbrRk.exe
  2⤵
  PID:7636
- C:\Windows\System\FjTsHLW.exe
  C:\Windows\System\FjTsHLW.exe
  2⤵
  PID:7500
- C:\Windows\System\SVXAQhU.exe
  C:\Windows\System\SVXAQhU.exe
  2⤵
  PID:3600
- C:\Windows\System\TTGidsL.exe
  C:\Windows\System\TTGidsL.exe
  2⤵
  PID:6348
- C:\Windows\System\urNLPWl.exe
  C:\Windows\System\urNLPWl.exe
  2⤵
  PID:6256
- C:\Windows\System\vVlxkly.exe
  C:\Windows\System\vVlxkly.exe
  2⤵
  PID:6300
- C:\Windows\System\bbcRjRi.exe
  C:\Windows\System\bbcRjRi.exe
  2⤵
  PID:5796
- C:\Windows\System\sIfQWUG.exe
  C:\Windows\System\sIfQWUG.exe
  2⤵
  PID:5784
- C:\Windows\System\pzyHnZG.exe
  C:\Windows\System\pzyHnZG.exe
  2⤵
  PID:7860
- C:\Windows\System\XxlnhBt.exe
  C:\Windows\System\XxlnhBt.exe
  2⤵
  PID:3548
- C:\Windows\System\hdIBSse.exe
  C:\Windows\System\hdIBSse.exe
  2⤵
  PID:7540
- C:\Windows\System\DDqXERV.exe
  C:\Windows\System\DDqXERV.exe
  2⤵
  PID:7152
- C:\Windows\System\rLdXrdX.exe
  C:\Windows\System\rLdXrdX.exe
  2⤵
  PID:2176
- C:\Windows\System\FuWmCkm.exe
  C:\Windows\System\FuWmCkm.exe
  2⤵
  PID:7872
- C:\Windows\System\dggAsVv.exe
  C:\Windows\System\dggAsVv.exe
  2⤵
  PID:8044
- C:\Windows\System\zosaFzO.exe
  C:\Windows\System\zosaFzO.exe
  2⤵
  PID:3780
- C:\Windows\System\krafSqm.exe
  C:\Windows\System\krafSqm.exe
  2⤵
  PID:6640
- C:\Windows\System\xfjGmYx.exe
  C:\Windows\System\xfjGmYx.exe
  2⤵
  PID:1212
- C:\Windows\System\VioPFuF.exe
  C:\Windows\System\VioPFuF.exe
  2⤵
  PID:2268
- C:\Windows\System\JLhkJqz.exe
  C:\Windows\System\JLhkJqz.exe
  2⤵
  PID:6848
- C:\Windows\System\NbRjJjO.exe
  C:\Windows\System\NbRjJjO.exe
  2⤵
  PID:7608
- C:\Windows\System\qDvsRvy.exe
  C:\Windows\System\qDvsRvy.exe
  2⤵
  PID:1532
- C:\Windows\System\mRDOEoi.exe
  C:\Windows\System\mRDOEoi.exe
  2⤵
  PID:6176
- C:\Windows\System\EFnMsdD.exe
  C:\Windows\System\EFnMsdD.exe
  2⤵
  PID:7568
- C:\Windows\System\DxVpVeI.exe
  C:\Windows\System\DxVpVeI.exe
  2⤵
  PID:5356
- C:\Windows\System\StPTTur.exe
  C:\Windows\System\StPTTur.exe
  2⤵
  PID:6384
- C:\Windows\System\JhZkpsC.exe
  C:\Windows\System\JhZkpsC.exe
  2⤵
  PID:7280
- C:\Windows\System\dllQHjN.exe
  C:\Windows\System\dllQHjN.exe
  2⤵
  PID:4808
- C:\Windows\System\nZoNGoX.exe
  C:\Windows\System\nZoNGoX.exe
  2⤵
  PID:1088
- C:\Windows\System\xyvJYmr.exe
  C:\Windows\System\xyvJYmr.exe
  2⤵
  PID:8208
- C:\Windows\System\fjVVrjK.exe
  C:\Windows\System\fjVVrjK.exe
  2⤵
  PID:8224
- C:\Windows\System\RMEmEIm.exe
  C:\Windows\System\RMEmEIm.exe
  2⤵
  PID:8240
- C:\Windows\System\HrLIKzL.exe
  C:\Windows\System\HrLIKzL.exe
  2⤵
  PID:8256
- C:\Windows\System\pLUjaNI.exe
  C:\Windows\System\pLUjaNI.exe
  2⤵
  PID:8272
- C:\Windows\System\aVbLJyw.exe
  C:\Windows\System\aVbLJyw.exe
  2⤵
  PID:8288
- C:\Windows\System\xPFRVmf.exe
  C:\Windows\System\xPFRVmf.exe
  2⤵
  PID:8304
- C:\Windows\System\SNWwzpQ.exe
  C:\Windows\System\SNWwzpQ.exe
  2⤵
  PID:8320
- C:\Windows\System\FtiNtzp.exe
  C:\Windows\System\FtiNtzp.exe
  2⤵
  PID:8336
- C:\Windows\System\jdplfDr.exe
  C:\Windows\System\jdplfDr.exe
  2⤵
  PID:8352
- C:\Windows\System\kjbeFPU.exe
  C:\Windows\System\kjbeFPU.exe
  2⤵
  PID:8368
- C:\Windows\System\VLjhBNT.exe
  C:\Windows\System\VLjhBNT.exe
  2⤵
  PID:8384
- C:\Windows\System\TaCbQjz.exe
  C:\Windows\System\TaCbQjz.exe
  2⤵
  PID:8400
- C:\Windows\System\otWnHeP.exe
  C:\Windows\System\otWnHeP.exe
  2⤵
  PID:8416
- C:\Windows\System\dgFmrbR.exe
  C:\Windows\System\dgFmrbR.exe
  2⤵
  PID:8432
- C:\Windows\System\QDqTKgf.exe
  C:\Windows\System\QDqTKgf.exe
  2⤵
  PID:8448
- C:\Windows\System\vCnPsfn.exe
  C:\Windows\System\vCnPsfn.exe
  2⤵
  PID:8464
- C:\Windows\System\eFPftRK.exe
  C:\Windows\System\eFPftRK.exe
  2⤵
  PID:8480
- C:\Windows\System\XmXEtFF.exe
  C:\Windows\System\XmXEtFF.exe
  2⤵
  PID:8496
- C:\Windows\System\FmlCJDe.exe
  C:\Windows\System\FmlCJDe.exe
  2⤵
  PID:8512
- C:\Windows\System\ftoAZtw.exe
  C:\Windows\System\ftoAZtw.exe
  2⤵
  PID:8528
- C:\Windows\System\yfUeENW.exe
  C:\Windows\System\yfUeENW.exe
  2⤵
  PID:8544
- C:\Windows\System\cmEvdho.exe
  C:\Windows\System\cmEvdho.exe
  2⤵
  PID:8560
- C:\Windows\System\nTNNFXk.exe
  C:\Windows\System\nTNNFXk.exe
  2⤵
  PID:8576
- C:\Windows\System\HlrxYEc.exe
  C:\Windows\System\HlrxYEc.exe
  2⤵
  PID:8592
- C:\Windows\System\RGGGhDJ.exe
  C:\Windows\System\RGGGhDJ.exe
  2⤵
  PID:8608
- C:\Windows\System\ckYfpBa.exe
  C:\Windows\System\ckYfpBa.exe
  2⤵
  PID:8624
- C:\Windows\System\OhfLFIT.exe
  C:\Windows\System\OhfLFIT.exe
  2⤵
  PID:8640
- C:\Windows\System\TNAelZV.exe
  C:\Windows\System\TNAelZV.exe
  2⤵
  PID:8656
- C:\Windows\System\bUunYyK.exe
  C:\Windows\System\bUunYyK.exe
  2⤵
  PID:8672
- C:\Windows\System\KSXsgeo.exe
  C:\Windows\System\KSXsgeo.exe
  2⤵
  PID:8688
- C:\Windows\System\YhFHbAY.exe
  C:\Windows\System\YhFHbAY.exe
  2⤵
  PID:8704
- C:\Windows\System\TkSjUte.exe
  C:\Windows\System\TkSjUte.exe
  2⤵
  PID:8720
- C:\Windows\System\BLjDnPg.exe
  C:\Windows\System\BLjDnPg.exe
  2⤵
  PID:8736
- C:\Windows\System\KgUhblP.exe
  C:\Windows\System\KgUhblP.exe
  2⤵
  PID:8752
- C:\Windows\System\MeErKeM.exe
  C:\Windows\System\MeErKeM.exe
  2⤵
  PID:8768
- C:\Windows\System\QGFbBZK.exe
  C:\Windows\System\QGFbBZK.exe
  2⤵
  PID:8784
- C:\Windows\System\hyiBSqB.exe
  C:\Windows\System\hyiBSqB.exe
  2⤵
  PID:8800
- C:\Windows\System\zjlkmTZ.exe
  C:\Windows\System\zjlkmTZ.exe
  2⤵
  PID:8816
- C:\Windows\System\dddgseR.exe
  C:\Windows\System\dddgseR.exe
  2⤵
  PID:8832
- C:\Windows\System\AJxCMoG.exe
  C:\Windows\System\AJxCMoG.exe
  2⤵
  PID:8848
- C:\Windows\System\vhkYwNj.exe
  C:\Windows\System\vhkYwNj.exe
  2⤵
  PID:8864
- C:\Windows\System\RTxIJEN.exe
  C:\Windows\System\RTxIJEN.exe
  2⤵
  PID:8880
- C:\Windows\System\PVcJWOo.exe
  C:\Windows\System\PVcJWOo.exe
  2⤵
  PID:8896
- C:\Windows\System\RiSeEiN.exe
  C:\Windows\System\RiSeEiN.exe
  2⤵
  PID:8912
- C:\Windows\System\QOGOqjq.exe
  C:\Windows\System\QOGOqjq.exe
  2⤵
  PID:8928
- C:\Windows\System\oimXrZj.exe
  C:\Windows\System\oimXrZj.exe
  2⤵
  PID:8944
- C:\Windows\System\SXVXLqi.exe
  C:\Windows\System\SXVXLqi.exe
  2⤵
  PID:8960
- C:\Windows\System\kWTAWpe.exe
  C:\Windows\System\kWTAWpe.exe
  2⤵
  PID:8980
- C:\Windows\System\znfDdQX.exe
  C:\Windows\System\znfDdQX.exe
  2⤵
  PID:8996
- C:\Windows\System\dlSIwnh.exe
  C:\Windows\System\dlSIwnh.exe
  2⤵
  PID:9012
- C:\Windows\System\qRgesIC.exe
  C:\Windows\System\qRgesIC.exe
  2⤵
  PID:9028
- C:\Windows\System\apUIarY.exe
  C:\Windows\System\apUIarY.exe
  2⤵
  PID:9044
- C:\Windows\System\ywGJkGh.exe
  C:\Windows\System\ywGJkGh.exe
  2⤵
  PID:9064
- C:\Windows\System\WseUrVL.exe
  C:\Windows\System\WseUrVL.exe
  2⤵
  PID:9080
- C:\Windows\System\CZoJoSF.exe
  C:\Windows\System\CZoJoSF.exe
  2⤵
  PID:9096
- C:\Windows\System\HWkhJjz.exe
  C:\Windows\System\HWkhJjz.exe
  2⤵
  PID:9112
- C:\Windows\System\WrMWJYA.exe
  C:\Windows\System\WrMWJYA.exe
  2⤵
  PID:9128
- C:\Windows\System\XJotxxq.exe
  C:\Windows\System\XJotxxq.exe
  2⤵
  PID:9144
- C:\Windows\System\YXDzQmz.exe
  C:\Windows\System\YXDzQmz.exe
  2⤵
  PID:9160
- C:\Windows\System\YzaEnEk.exe
  C:\Windows\System\YzaEnEk.exe
  2⤵
  PID:9176
- C:\Windows\System\ZCQduts.exe
  C:\Windows\System\ZCQduts.exe
  2⤵
  PID:9192
- C:\Windows\System\DrgrYYT.exe
  C:\Windows\System\DrgrYYT.exe
  2⤵
  PID:9208
- C:\Windows\System\gIbnQBm.exe
  C:\Windows\System\gIbnQBm.exe
  2⤵
  PID:7404
- C:\Windows\System\mtAWgos.exe
  C:\Windows\System\mtAWgos.exe
  2⤵
  PID:5448
- C:\Windows\System\NmogUlW.exe
  C:\Windows\System\NmogUlW.exe
  2⤵
  PID:8220
- C:\Windows\System\DgqvDQm.exe
  C:\Windows\System\DgqvDQm.exe
  2⤵
  PID:8280
- C:\Windows\System\JvTFstQ.exe
  C:\Windows\System\JvTFstQ.exe
  2⤵
  PID:8312
- C:\Windows\System\epSrnIl.exe
  C:\Windows\System\epSrnIl.exe
  2⤵
  PID:6004
- C:\Windows\System\qkJotfJ.exe
  C:\Windows\System\qkJotfJ.exe
  2⤵
  PID:8376
- C:\Windows\System\VgWpGkQ.exe
  C:\Windows\System\VgWpGkQ.exe
  2⤵
  PID:8204
- C:\Windows\System\NJmFllA.exe
  C:\Windows\System\NJmFllA.exe
  2⤵
  PID:2240
- C:\Windows\System\ERXEIsG.exe
  C:\Windows\System\ERXEIsG.exe
  2⤵
  PID:8108
- C:\Windows\System\IbhFXsd.exe
  C:\Windows\System\IbhFXsd.exe
  2⤵
  PID:8444
- C:\Windows\System\nnNfDtw.exe
  C:\Windows\System\nnNfDtw.exe
  2⤵
  PID:8472
- C:\Windows\System\mzHxNNs.exe
  C:\Windows\System\mzHxNNs.exe
  2⤵
  PID:8360
- C:\Windows\System\EltsObZ.exe
  C:\Windows\System\EltsObZ.exe
  2⤵
  PID:8540
- C:\Windows\System\yDlbaDQ.exe
  C:\Windows\System\yDlbaDQ.exe
  2⤵
  PID:8488
- C:\Windows\System\jrVLoME.exe
  C:\Windows\System\jrVLoME.exe
  2⤵
  PID:8524
- C:\Windows\System\KMWtBnw.exe
  C:\Windows\System\KMWtBnw.exe
  2⤵
  PID:8600
- C:\Windows\System\uiXJBEz.exe
  C:\Windows\System\uiXJBEz.exe
  2⤵
  PID:8632
- C:\Windows\System\UiPYOzJ.exe
  C:\Windows\System\UiPYOzJ.exe
  2⤵
  PID:8680
- C:\Windows\System\RroSxxp.exe
  C:\Windows\System\RroSxxp.exe
  2⤵
  PID:8428
- C:\Windows\System\wULDtiS.exe
  C:\Windows\System\wULDtiS.exe
  2⤵
  PID:8808
- C:\Windows\System\NLFiICc.exe
  C:\Windows\System\NLFiICc.exe
  2⤵
  PID:8812
- C:\Windows\System\DsdAtNC.exe
  C:\Windows\System\DsdAtNC.exe
  2⤵
  PID:8504
- C:\Windows\System\hunpfEW.exe
  C:\Windows\System\hunpfEW.exe
  2⤵
  PID:8844
- C:\Windows\System\jIzrhCj.exe
  C:\Windows\System\jIzrhCj.exe
  2⤵
  PID:8776
- C:\Windows\System\alBgvLz.exe
  C:\Windows\System\alBgvLz.exe
  2⤵
  PID:8904
- C:\Windows\System\ONTelAk.exe
  C:\Windows\System\ONTelAk.exe
  2⤵
  PID:8668
- C:\Windows\System\ZhVONzT.exe
  C:\Windows\System\ZhVONzT.exe
  2⤵
  PID:8828
- C:\Windows\System\VOTskPQ.exe
  C:\Windows\System\VOTskPQ.exe
  2⤵
  PID:8888
- C:\Windows\System\VicqhuJ.exe
  C:\Windows\System\VicqhuJ.exe
  2⤵
  PID:8908
- C:\Windows\System\tqySYFW.exe
  C:\Windows\System\tqySYFW.exe
  2⤵
  PID:8992
- C:\Windows\System\yhqjfRu.exe
  C:\Windows\System\yhqjfRu.exe
  2⤵
  PID:9004
- C:\Windows\System\skZLNjh.exe
  C:\Windows\System\skZLNjh.exe
  2⤵
  PID:9040
- C:\Windows\System\VTeXlDb.exe
  C:\Windows\System\VTeXlDb.exe
  2⤵
  PID:9120
- C:\Windows\System\uVsdwEz.exe
  C:\Windows\System\uVsdwEz.exe
  2⤵
  PID:9104
- C:\Windows\System\ALZpTyj.exe
  C:\Windows\System\ALZpTyj.exe
  2⤵
  PID:9152
- C:\Windows\System\LpjVilm.exe
  C:\Windows\System\LpjVilm.exe
  2⤵
  PID:9188
- C:\Windows\System\KlrHsNs.exe
  C:\Windows\System\KlrHsNs.exe
  2⤵
  PID:1892
- C:\Windows\System\xhrJKUq.exe
  C:\Windows\System\xhrJKUq.exe
  2⤵
  PID:3464
- C:\Windows\System\aDQzHAg.exe
  C:\Windows\System\aDQzHAg.exe
  2⤵
  PID:6220
- C:\Windows\System\xtElPDJ.exe
  C:\Windows\System\xtElPDJ.exe
  2⤵
  PID:5716
- C:\Windows\System\tuvKmyo.exe
  C:\Windows\System\tuvKmyo.exe
  2⤵
  PID:6588
- C:\Windows\System\WHoMCAa.exe
  C:\Windows\System\WHoMCAa.exe
  2⤵
  PID:8264
- C:\Windows\System\qAQXPID.exe
  C:\Windows\System\qAQXPID.exe
  2⤵
  PID:3492
- C:\Windows\System\folpeRE.exe
  C:\Windows\System\folpeRE.exe
  2⤵
  PID:8584
- C:\Windows\System\hLqZHtt.exe
  C:\Windows\System\hLqZHtt.exe
  2⤵
  PID:8712
- C:\Windows\System\gtGbUyd.exe
  C:\Windows\System\gtGbUyd.exe
  2⤵
  PID:8460
- C:\Windows\System\TOqoCzD.exe
  C:\Windows\System\TOqoCzD.exe
  2⤵
  PID:8536
- C:\Windows\System\TaGvZTl.exe
  C:\Windows\System\TaGvZTl.exe
  2⤵
  PID:8744
- C:\Windows\System\LFNWoZi.exe
  C:\Windows\System\LFNWoZi.exe
  2⤵
  PID:8840
- C:\Windows\System\JTxbThg.exe
  C:\Windows\System\JTxbThg.exe
  2⤵
  PID:8972
- C:\Windows\System\sppemTk.exe
  C:\Windows\System\sppemTk.exe
  2⤵
  PID:8892
- C:\Windows\System\izaHiwL.exe
  C:\Windows\System\izaHiwL.exe
  2⤵
  PID:8792
- C:\Windows\System\BrQLnBG.exe
  C:\Windows\System\BrQLnBG.exe
  2⤵
  PID:8876
- C:\Windows\System\TDyCSHh.exe
  C:\Windows\System\TDyCSHh.exe
  2⤵
  PID:9088
- C:\Windows\System\ZmzmVTZ.exe
  C:\Windows\System\ZmzmVTZ.exe
  2⤵
  PID:9184
- C:\Windows\System\XxpKhOg.exe
  C:\Windows\System\XxpKhOg.exe
  2⤵
  PID:9168
- C:\Windows\System\IzzFwIg.exe
  C:\Windows\System\IzzFwIg.exe
  2⤵
  PID:8408
- C:\Windows\System\JmRbPGQ.exe
  C:\Windows\System\JmRbPGQ.exe
  2⤵
  PID:8456
- C:\Windows\System\mgnKZhA.exe
  C:\Windows\System\mgnKZhA.exe
  2⤵
  PID:6496
- C:\Windows\System\bOgTTkT.exe
  C:\Windows\System\bOgTTkT.exe
  2⤵
  PID:8732
- C:\Windows\System\VywCbID.exe
  C:\Windows\System\VywCbID.exe
  2⤵
  PID:8520
- C:\Windows\System\RRxOhKF.exe
  C:\Windows\System\RRxOhKF.exe
  2⤵
  PID:8636
- C:\Windows\System\rSHsaUq.exe
  C:\Windows\System\rSHsaUq.exe
  2⤵
  PID:8956
- C:\Windows\System\zwrlNGZ.exe
  C:\Windows\System\zwrlNGZ.exe
  2⤵
  PID:9056
- C:\Windows\System\xGraeul.exe
  C:\Windows\System\xGraeul.exe
  2⤵
  PID:9024
- C:\Windows\System\AWvAhhw.exe
  C:\Windows\System\AWvAhhw.exe
  2⤵
  PID:8252
- C:\Windows\System\tuOnExi.exe
  C:\Windows\System\tuOnExi.exe
  2⤵
  PID:8296
- C:\Windows\System\lainmli.exe
  C:\Windows\System\lainmli.exe
  2⤵
  PID:8968
- C:\Windows\System\lVrbgZj.exe
  C:\Windows\System\lVrbgZj.exe
  2⤵
  PID:8568
- C:\Windows\System\bChUTZa.exe
  C:\Windows\System\bChUTZa.exe
  2⤵
  PID:9136
- C:\Windows\System\fynnnEa.exe
  C:\Windows\System\fynnnEa.exe
  2⤵
  PID:8796
- C:\Windows\System\NYbxOqc.exe
  C:\Windows\System\NYbxOqc.exe
  2⤵
  PID:9224
- C:\Windows\System\vUhmJQS.exe
  C:\Windows\System\vUhmJQS.exe
  2⤵
  PID:9240
- C:\Windows\System\JxFVvEY.exe
  C:\Windows\System\JxFVvEY.exe
  2⤵
  PID:9256
- C:\Windows\System\KuBUovB.exe
  C:\Windows\System\KuBUovB.exe
  2⤵
  PID:9272
- C:\Windows\System\KcujSHD.exe
  C:\Windows\System\KcujSHD.exe
  2⤵
  PID:9288
- C:\Windows\System\vkXOuBJ.exe
  C:\Windows\System\vkXOuBJ.exe
  2⤵
  PID:9304
- C:\Windows\System\kchlktV.exe
  C:\Windows\System\kchlktV.exe
  2⤵
  PID:9320
- C:\Windows\System\DPNgyLB.exe
  C:\Windows\System\DPNgyLB.exe
  2⤵
  PID:9336
- C:\Windows\System\hEkOeGx.exe
  C:\Windows\System\hEkOeGx.exe
  2⤵
  PID:9352
- C:\Windows\System\JsISxZz.exe
  C:\Windows\System\JsISxZz.exe
  2⤵
  PID:9368
- C:\Windows\System\ZskTdDV.exe
  C:\Windows\System\ZskTdDV.exe
  2⤵
  PID:9384
- C:\Windows\System\htmrYhk.exe
  C:\Windows\System\htmrYhk.exe
  2⤵
  PID:9400
- C:\Windows\System\CbpYGkE.exe
  C:\Windows\System\CbpYGkE.exe
  2⤵
  PID:9420
- C:\Windows\System\mZRafRe.exe
  C:\Windows\System\mZRafRe.exe
  2⤵
  PID:9436
- C:\Windows\System\EODhhCu.exe
  C:\Windows\System\EODhhCu.exe
  2⤵
  PID:9452
- C:\Windows\System\wCixagv.exe
  C:\Windows\System\wCixagv.exe
  2⤵
  PID:9468
- C:\Windows\System\lMmQreJ.exe
  C:\Windows\System\lMmQreJ.exe
  2⤵
  PID:9484
- C:\Windows\System\tHFlBGC.exe
  C:\Windows\System\tHFlBGC.exe
  2⤵
  PID:9500
- C:\Windows\System\CEPwpLR.exe
  C:\Windows\System\CEPwpLR.exe
  2⤵
  PID:9516
- C:\Windows\System\GVlVZFv.exe
  C:\Windows\System\GVlVZFv.exe
  2⤵
  PID:9532
- C:\Windows\System\QLCOTQz.exe
  C:\Windows\System\QLCOTQz.exe
  2⤵
  PID:9548
- C:\Windows\System\FXMHdVz.exe
  C:\Windows\System\FXMHdVz.exe
  2⤵
  PID:9564
- C:\Windows\System\cqwYbZh.exe
  C:\Windows\System\cqwYbZh.exe
  2⤵
  PID:9580
- C:\Windows\System\YzowzSX.exe
  C:\Windows\System\YzowzSX.exe
  2⤵
  PID:9596
- C:\Windows\System\JGySBSS.exe
  C:\Windows\System\JGySBSS.exe
  2⤵
  PID:9612
- C:\Windows\System\HLQrRBP.exe
  C:\Windows\System\HLQrRBP.exe
  2⤵
  PID:9628
- C:\Windows\System\NiQrdrQ.exe
  C:\Windows\System\NiQrdrQ.exe
  2⤵
  PID:9644
- C:\Windows\System\iYUpZDD.exe
  C:\Windows\System\iYUpZDD.exe
  2⤵
  PID:9660
- C:\Windows\System\AdSAzJp.exe
  C:\Windows\System\AdSAzJp.exe
  2⤵
  PID:9676
- C:\Windows\System\PIIkDUr.exe
  C:\Windows\System\PIIkDUr.exe
  2⤵
  PID:9692
- C:\Windows\System\eKGUiOG.exe
  C:\Windows\System\eKGUiOG.exe
  2⤵
  PID:9708
- C:\Windows\System\wXrQAzB.exe
  C:\Windows\System\wXrQAzB.exe
  2⤵
  PID:9724
- C:\Windows\System\uvYVWkE.exe
  C:\Windows\System\uvYVWkE.exe
  2⤵
  PID:9740
- C:\Windows\System\uOKqyVr.exe
  C:\Windows\System\uOKqyVr.exe
  2⤵
  PID:9756
- C:\Windows\System\kZgVxoK.exe
  C:\Windows\System\kZgVxoK.exe
  2⤵
  PID:9772
- C:\Windows\System\UjtlLkt.exe
  C:\Windows\System\UjtlLkt.exe
  2⤵
  PID:9788
- C:\Windows\System\mXyFvqG.exe
  C:\Windows\System\mXyFvqG.exe
  2⤵
  PID:9804
- C:\Windows\System\XYSaXLE.exe
  C:\Windows\System\XYSaXLE.exe
  2⤵
  PID:9820
- C:\Windows\System\FzXLCSk.exe
  C:\Windows\System\FzXLCSk.exe
  2⤵
  PID:9836
- C:\Windows\System\QaWOLTV.exe
  C:\Windows\System\QaWOLTV.exe
  2⤵
  PID:9852
- C:\Windows\System\kzpOmsw.exe
  C:\Windows\System\kzpOmsw.exe
  2⤵
  PID:9868
- C:\Windows\System\jWBaWeS.exe
  C:\Windows\System\jWBaWeS.exe
  2⤵
  PID:9884
- C:\Windows\System\YjDkyJP.exe
  C:\Windows\System\YjDkyJP.exe
  2⤵
  PID:9900
- C:\Windows\System\wvXWqPT.exe
  C:\Windows\System\wvXWqPT.exe
  2⤵
  PID:9916
- C:\Windows\System\hWYChip.exe
  C:\Windows\System\hWYChip.exe
  2⤵
  PID:9932
- C:\Windows\System\gFQflFo.exe
  C:\Windows\System\gFQflFo.exe
  2⤵
  PID:9948
- C:\Windows\System\GBTTDnU.exe
  C:\Windows\System\GBTTDnU.exe
  2⤵
  PID:9964
- C:\Windows\System\bUcgMnQ.exe
  C:\Windows\System\bUcgMnQ.exe
  2⤵
  PID:9980
- C:\Windows\System\JkHTFeC.exe
  C:\Windows\System\JkHTFeC.exe
  2⤵
  PID:9996
- C:\Windows\System\qCHcFkJ.exe
  C:\Windows\System\qCHcFkJ.exe
  2⤵
  PID:10012
- C:\Windows\System\etepKWq.exe
  C:\Windows\System\etepKWq.exe
  2⤵
  PID:10028
- C:\Windows\System\mVHCkiS.exe
  C:\Windows\System\mVHCkiS.exe
  2⤵
  PID:10044
- C:\Windows\System\cJVjHYR.exe
  C:\Windows\System\cJVjHYR.exe
  2⤵
  PID:10060
- C:\Windows\System\YRmpgeM.exe
  C:\Windows\System\YRmpgeM.exe
  2⤵
  PID:10076
- C:\Windows\System\mGTyPIW.exe
  C:\Windows\System\mGTyPIW.exe
  2⤵
  PID:10092
- C:\Windows\System\eZpdMaI.exe
  C:\Windows\System\eZpdMaI.exe
  2⤵
  PID:10108
- C:\Windows\System\SGOVBXj.exe
  C:\Windows\System\SGOVBXj.exe
  2⤵
  PID:10124
- C:\Windows\System\QxMFzUi.exe
  C:\Windows\System\QxMFzUi.exe
  2⤵
  PID:10140
- C:\Windows\System\DqdqfPn.exe
  C:\Windows\System\DqdqfPn.exe
  2⤵
  PID:10156
- C:\Windows\System\EuAXoqG.exe
  C:\Windows\System\EuAXoqG.exe
  2⤵
  PID:10172
- C:\Windows\System\QCNXOvS.exe
  C:\Windows\System\QCNXOvS.exe
  2⤵
  PID:10188
- C:\Windows\System\vAsZtZP.exe
  C:\Windows\System\vAsZtZP.exe
  2⤵
  PID:10204
- C:\Windows\System\IqrXHLG.exe
  C:\Windows\System\IqrXHLG.exe
  2⤵
  PID:10220
- C:\Windows\System\YUAKOuh.exe
  C:\Windows\System\YUAKOuh.exe
  2⤵
  PID:10236
- C:\Windows\System\qJakyDH.exe
  C:\Windows\System\qJakyDH.exe
  2⤵
  PID:8556
- C:\Windows\System\DVRjRNi.exe
  C:\Windows\System\DVRjRNi.exe
  2⤵
  PID:9268
- C:\Windows\System\sTEXbxp.exe
  C:\Windows\System\sTEXbxp.exe
  2⤵
  PID:9332
- C:\Windows\System\WCTfnpc.exe
  C:\Windows\System\WCTfnpc.exe
  2⤵
  PID:9396
- C:\Windows\System\sJtezTY.exe
  C:\Windows\System\sJtezTY.exe
  2⤵
  PID:9076
- C:\Windows\System\RHoyWiO.exe
  C:\Windows\System\RHoyWiO.exe
  2⤵
  PID:9280
- C:\Windows\System\vOjfBuS.exe
  C:\Windows\System\vOjfBuS.exe
  2⤵
  PID:9348
- C:\Windows\System\ubMfokb.exe
  C:\Windows\System\ubMfokb.exe
  2⤵
  PID:9412
- C:\Windows\System\sKoznFp.exe
  C:\Windows\System\sKoznFp.exe
  2⤵
  PID:9448
- C:\Windows\System\VLbKPWC.exe
  C:\Windows\System\VLbKPWC.exe
  2⤵
  PID:9496
- C:\Windows\System\AuAGcOz.exe
  C:\Windows\System\AuAGcOz.exe
  2⤵
  PID:9556
- C:\Windows\System\ZGSomle.exe
  C:\Windows\System\ZGSomle.exe
  2⤵
  PID:9620
- C:\Windows\System\ilXDTvv.exe
  C:\Windows\System\ilXDTvv.exe
  2⤵
  PID:9656
- C:\Windows\System\GTdbrmt.exe
  C:\Windows\System\GTdbrmt.exe
  2⤵
  PID:9512
- C:\Windows\System\XXfwjHh.exe
  C:\Windows\System\XXfwjHh.exe
  2⤵
  PID:9576
- C:\Windows\System\ZmgrFPN.exe
  C:\Windows\System\ZmgrFPN.exe
  2⤵
  PID:9668
- C:\Windows\System\XFQYpub.exe
  C:\Windows\System\XFQYpub.exe
  2⤵
  PID:9716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BvXaSzA.exe

Filesize
2.1MB

MD5
c54c51347bd113c912f4f0b158ed1291

SHA1
653da61e55d8bdbfd9662883c5d97f1aaa8feadf

SHA256
094bd43be3462754603c768ba52c4451faea7ed06b054547a3c331bca7a4b32b

SHA512
77664a0fce97a10879c2c4957ed7a2765f01cfd829052ed15eacfac30cc4ea9571ff1cc19e69c0991e2fb330eb9857cb59305f899760d7e12ed2bf123cfb1792

Download Submit
C:\Windows\system\CwaZGWL.exe

Filesize
2.1MB

MD5
0af89aa3470b402c790927c113d1129d

SHA1
01058d78d7f9b2a6278585147af0f137f6437b86

SHA256
10ddc756a23785fc3cde6dd6216218c9284f9a6af103b875f979c8df51114bbb

SHA512
4c0c73e549bae7af7973c37a6f207863ea9a2f16912763ddeef5e70f9d6de64ae51603d67c00c4c5b579fd92e0edf409f9685cc676aa0829d71ada7960d11e6d

Download Submit
C:\Windows\system\FBbaQyt.exe

Filesize
2.1MB

MD5
2028804b0f00c230bf73b633e2db4510

SHA1
d6ddbdf9940f116281350a45602dad72605b5851

SHA256
39f40c612c260b727f3d908f0484b176e4458b0916f444d0ce2d5a43c29aeb62

SHA512
90144acb274eec19e36c77b14a073919ec228d97f07b8f0f02cfc4286b080ea81e0d4ec536313ca6d9fc808e087695d93b28120818464cebbe6821ce5a17d14d

Download Submit
C:\Windows\system\MsqATzh.exe

Filesize
2.1MB

MD5
4916fc95b8edd6ba3160401f6fd2adee

SHA1
53e8562275e940e0d7454c10e4dac5c2575a38fa

SHA256
626ee53e67eb12a864ed9481f5fd95b4fd80e6711234b911244e79d4b8787c60

SHA512
479e2a2d07fb88b1cb848e4859ead332d217440289d1d8882af7f7387f5fb7889fabd2d5253e045be9fa4abcbcb54c275a33084e389851bb8c0373a74682274a

Download Submit
C:\Windows\system\OcnXDfK.exe

Filesize
2.1MB

MD5
f7fdd0a1cd94f7940de573b29184fd77

SHA1
b63c59eb14ac6cf75d85a271f8f4cee9821e0e19

SHA256
caec132e723e96e144829a2de6173f4ffb7e29a103bc8ef3653efe699b683168

SHA512
da142def1c05f99db8aa36fbb17b907ce2f4a1f3de4697bc50c14dce6ea21b600d390c0d0115717bf1de276be6c970910f2f21e49b46af3d60f88e72022b0363

Download Submit
C:\Windows\system\SwzYUNE.exe

Filesize
2.1MB

MD5
922755b8111b96582626989b6cfb876d

SHA1
f9f363b8cccb021682d65fe6f6770f56cb7f7275

SHA256
ff407f465f07fda8fea5eb375fbae7930063ad6e13cfc1bccedd5655b9f5b6ef

SHA512
00c6aa78ebb63762bb418d2acc50791a42be20f2fe1f10af76277c3188689a64b86ab685572a16279068928023232ff714d9ff87a29560471885170fcec71a4d

Download Submit
C:\Windows\system\XELfnhY.exe

Filesize
2.1MB

MD5
e7e52f4833667cb6c38d32b9e8fdab3b

SHA1
048d876179b6ee30c17620aea46e3412c6de4e5b

SHA256
ec6e31a51840406f60de6abed7c3968998b0e22d09dc588ab0497075f41f9e44

SHA512
def717f6040e381c6c010fb0d7a3beb41bc03e258373b5b399228987cb7c63f36dadaa8585ddf58815f965924d7b936c307595513cac0fb4c1dc6c545a3b0e49

Download Submit
C:\Windows\system\YWZSseP.exe

Filesize
2.1MB

MD5
846841d0c1de51f856d66dbcc4723598

SHA1
c5aa71cc28a321a1a3509616e4a923b8e9c0fed9

SHA256
f2ae6c2166a31a06c39777684dd5b91485cc2a6d4c2e44676b62f637559bc5d2

SHA512
31930e6efa129fca82c2cc3ac578db3fe1a2bef31fe754545153731e54fdc04586ef48acb8384de1b6cfb78103279f324b5de8fa424da9ca30f61c06ccd1ad3e

Download Submit
C:\Windows\system\YusDcEs.exe

Filesize
2.1MB

MD5
483c0d93387eef5d5f3b382fc7447483

SHA1
da767ba0c8993c51f8c9111b6d27e38cc8207fa1

SHA256
50b9e8a6cdc6bae09d67fdcba12aa28ddc55fbade9ac58c648963b7b507b6a71

SHA512
50333d44922983e2dc2a8312909e2a51e74f31483dbd29cb6338ee0b0ca7c5e5440c269e378aebf6199de0d8c4ae54797d66d718f97813314abcd8d89f49932a

Download Submit
C:\Windows\system\cxvrqft.exe

Filesize
2.1MB

MD5
4617a23ed8fde4c0654959c0827d4b90

SHA1
b4b6963108865bf2b58a262f8c3f8a4a09ab79fb

SHA256
dc4bd9890fe701a18bc89a0e846d2bc598a142421a49f11f98ebf939e10926e8

SHA512
189ce6399f697d1ba228e5ce52ef41c134e608e80aa8f0e7baba89ed145605f38a5ea108c9e262fa696377b88f2b55b7feefbbd0d78243a0713eb6f69260e845

Download Submit
C:\Windows\system\jRgKTKD.exe

Filesize
2.1MB

MD5
50518da21656efb26307df7090d7707f

SHA1
d4a55b4b8f30de7bfeb23ab095be92fb33883efe

SHA256
20fe8cd078a5c95dc3a837abe5f803e1bfecd3b7484d1ddb80d1711c1d29605d

SHA512
0e62de314a6985f33398dcad2bd3143b021e660642fbe446f3c6fbe417d09b4f62887715223301fa37e993297ff6f4898943f25a7582cb9836a06046c3e28052

Download Submit
C:\Windows\system\tMbfmHv.exe

Filesize
2.1MB

MD5
9c145652b8e5b9d71a2e4b7f4e2cab0d

SHA1
5383e01f46f32d37d066fdbcaf1fd067991a1ead

SHA256
04fa89f034ae4d6b051cd0faad7fccfed4bc84bede9a5924365fe7f30c186dd6

SHA512
76618e09512887d23c535ead67dbf3894952d925db2a2b574737b037f7bfd7bcf5c41ed47c934215c018e65c451f3461efa789f1a63b5237a7c62de1f1d1c07e

Download Submit
C:\Windows\system\tctuttf.exe

Filesize
2.1MB

MD5
cd4e22809dd3bff3c6a9faa995aa77b6

SHA1
b80b71c7b8e9d5f52bd085d1f2db4dbe98c2fe41

SHA256
e5cf41f972ebb9fafc4cc27774300c86270f3e2532719165ab2414a0ead55ccc

SHA512
351365c9567e6432bd3eda0f3fccfc278dc79655790b14b6322cad383dec0c71145da471db1a4174531b278f6e385ac05c24128946372fdab57d62a83d154b6f

Download Submit
C:\Windows\system\vOLBJvk.exe

Filesize
2.1MB

MD5
26ccdc1076e9a05a4fc0d20a0170de89

SHA1
19ef550ee45926489d8b643bc7230195179f8ad5

SHA256
7cc9363b09095b01a9a2252be053d5b6a65c9ec8027829d2ab603d42e95a9623

SHA512
c499a5dddbb27ed8eeb8524987c59118c2999b4d66ed79f46a695b03eaee3f0192b46c2737a9f6ffd035e840990e6e10abe24f35f48c601dcd4c018483d7c9ee

Download Submit
C:\Windows\system\wVlRZeb.exe

Filesize
2.1MB

MD5
f90aee3814752fdbe9d7bd6ee819c84a

SHA1
7344c79ae945a99bd0ef82a233ff640018b68eca

SHA256
d31c05e1a7fab12f7b0785e8451b527f9d1722afbe4c0c0ca258992564370c0b

SHA512
62bbb9c7f87e1b31257bb723145512eb0a05a2cd0902e09a2f8a60066ef46043412cb3ad09277a7ad40c054fcdac55a83bf7b4c8faaf291c235253cf6006aad9

Download Submit
C:\Windows\system\wqItKLa.exe

Filesize
2.1MB

MD5
09ae8fa9d0d2c3c2705fd26ebeea5b53

SHA1
51e2dcf8ac2f21fea324763952915a2e51c7c823

SHA256
72d39febc4e8bec39993a9da04a705010264afdf0fed528d760c2f9b9367af3e

SHA512
a791fef1e02c980fd28975e840f310c174846bb39150722824d62668cc9a1fb674362dbf610da8e37b7da8000fc4411b5efd69d56034f0c74cec69ff1032e3c1

Download Submit
C:\Windows\system\zCYhzBZ.exe

Filesize
2.1MB

MD5
6d3dbc53a284dc35f997f0e7609b88b5

SHA1
016d969047f243ba9024ec42bf2f1a19227aa5cb

SHA256
f7816d07acc057094a98373a188dc2808b5c725eea3bab8292b6e0e3e1a9c0b6

SHA512
16f329bcff4f1abd59266acbef7b3b5a59e352a1f6203be7b2609db524ecf8206044933e76dfaf696d4a7f8434a18d045bec21b4db5b3f1f632618d2651d6fa6

Download Submit
\Windows\system\IwSARGf.exe

Filesize
2.1MB

MD5
727a7f7df37d1006849c6001df7c2772

SHA1
75cd890e8fb28d0ee8fd7d49e48bc994f865524f

SHA256
4f15bd190d32489b237ef87557383363b963fc807fd5e9b37ed379a3619dd8ee

SHA512
7a8b17cdfdde50f4bd4ffc19ac57bbe06193675fb13a54c19e2e21d00c26f27141672e83c3c4508607612f61fc1db939fa5781485953c4ddc7f3f570e370d66e

Download Submit
\Windows\system\JznFPFm.exe

Filesize
2.1MB

MD5
2269bf485ca33bb78dd6fde5c9e08604

SHA1
97e98bb4978982352a71e068a2f0d2a420f30dcb

SHA256
2721f9affb65cbb00811273b96bf209a228161c5ed25319dc825881c5d9c9610

SHA512
8b0f46cc3d0c4924d51aace0e6b8a7204b5f5d052caa2f5d5a56a2b1a3950db70cf2b4af1a65f29e613eb191c1416dc4b93d67044471f381792fe2e6a4453aa2

Download Submit
\Windows\system\MZziguc.exe

Filesize
2.1MB

MD5
388fc5ed50dc6b68cba7832b14ee76ce

SHA1
7905459d2bfd1eb0c2837c66986366396c5dd2a9

SHA256
d750bb029d754c08f14770c1860bee35e44589bbc961dcb11ef2b97434a1a583

SHA512
32ddba90e2689981b22c9894483317c6d8649e407d764b8f6a291586ff51e5b28a6c28a44b5d4c127795cc3e9fd353378da01a3e7cfe2cf78d404617db401771

Download Submit
\Windows\system\POAgBWV.exe

Filesize
2.1MB

MD5
cc81bc81cecae9756f44f49eef1fdff6

SHA1
e21846dbab7bc0da59268358d307e6925530410c

SHA256
c8e905b312cc4b0da9e2643aaca19be9343149a116de84035cd97b065e057af6

SHA512
d5c750bc7acac63ac351c3d1b892354d4da4c6700ae0f58148e1687170b6b191869956e95fefb8d1cf0c29d5e2b71f5ef10746d7bd385f3cc4d94271db7f3cc7

Download Submit
\Windows\system\PXjimPb.exe

Filesize
2.1MB

MD5
01bebba92b54821c3d2e4f2d298bd6d6

SHA1
c6f1bfc3efbdb0c8ba5821ac8358ba037a8ed71c

SHA256
78860b0f4b00f2c4e9cf10ddbc87615189c271de513fb80dcd51d63c23ec03ad

SHA512
5e93eb2acec5f920b400a0ae79362e0c69be0183ce46e02a8bf1e17eb9d2c479d9cc0e40fb575d8aa225a1224a4c8d5675b53403c29eb18bfab957d867a47ff0

Download Submit
\Windows\system\QlMhGJV.exe

Filesize
2.1MB

MD5
baeb8bc50b185994c8f6834899a819c4

SHA1
bb247e789b1fbc1cf64a64def21cad738ebb9a02

SHA256
52d8dd66fbcde29310777d2240430826f3eb1783ddfb8ac1cecc166f7f6efef6

SHA512
b407ad323ff623c41c634f1794e222b79a1ac24faa76f0aa95e7a6f481aaec91186dfdc0400c7ef4514c9994cfd1516e22b901291101d190bfd8b336b23c147e

Download Submit
\Windows\system\UEYXjJV.exe

Filesize
2.1MB

MD5
81f1af6e2c4db3471c562c06da60b492

SHA1
6e88186d2b9da2ce4f5293ca28aba50790b75aec

SHA256
d577f9b2118f4ce15fd4e1ba6ca518ee37a93fa3336f161c3692ede362a533a0

SHA512
26933c42183241ec67d06d7973aba54c24c2d55a319b8e3f47d57c2506bae284c78bf8a9c035a5254bc6335c19a900832cc56f91d5299a506c4ff189fc3d63cb

Download Submit
\Windows\system\UqCIIhV.exe

Filesize
2.1MB

MD5
9c5df0c165e26b3aa6ec860704758ba3

SHA1
769ced7e65b59f53e53f69d5aad7eea14f269c13

SHA256
936626e930df054741b694c5de5b4efdbb6175fd5d09c5ec83ab21b19cc4c0e2

SHA512
38ddd0cea77cb9730aca4d5f76d2f21dbcea3c66de7e5bd7718a92a72bf14c30e00760e14f965f3f90ce498c2251142cae162e5ad2c443007eaa21c4f70a189e

Download Submit
\Windows\system\VGdwRpZ.exe

Filesize
2.1MB

MD5
390d50014d0218a0b888cf1dee96cb6d

SHA1
e9902312ba304916a30d0da80ce0bbdc0d63ba0a

SHA256
6de9cf93f786c67746fe544e937f1710b140ffd1199ee66e5fbbb1a447d6d8a5

SHA512
e95c493b919cbfed1c67ae6e1ef7de943a89741b982a247213aa7fa2309f84d83f3e44104ce7e1da41c30cb7f481810fa9f5ffb9f77f405c7e799cffc487a43b

Download Submit
\Windows\system\VLrkDYv.exe

Filesize
2.1MB

MD5
ae72971640366337bfa93daa6c35f80f

SHA1
8a220dbce9e93a503d6c01a2788aa407c17866de

SHA256
2c7e4022fb54948cac9f7fbaa19ea14ff35ec88203a2a5a3be082c805bcd18b2

SHA512
3659d0008e309d5a205d4f266118d5e95f737ebb9e8f8b2bfe2ef56f3ad4c35a21ffc31ada9a0b28e1b39eef16cc252053b8373000df5d3ed27e2bab6e190024

Download Submit
\Windows\system\VbnvGyp.exe

Filesize
2.1MB

MD5
53a1c303d20e02aa99f1504169c9983c

SHA1
8fa4944e4f6d2bd57aebd1ffdc2c20a98de388db

SHA256
9f8e2d2b38ad2a351ebf2777db872ea69d52960e226acd3f87501fa06940b51a

SHA512
442903e350a80b6b94d3e9c8ac35c99c61ec5084ad1f68a04be02de62789004d315fa4fa91420837c0f65eb703736dc8cce33891d1972af9191c44c741e9e53b

Download Submit
\Windows\system\caChRAB.exe

Filesize
2.1MB

MD5
1600fe384c411ce50f726ca0766b4bd7

SHA1
31ba05026f4e64ce83386030ae673703ca34230b

SHA256
8ce10cbc7beb6119dfe3a6056a0a17eb15aa7a480d7095f7ecb30e5ec97cc02e

SHA512
f128ada4c51ab6d449b353da436d9ae8b10e19b14677781dbf85f64fd4583ee2aba0486cd506030b35f25547c76c2e7c663d055478f1209d9dfb8193b64043b6

Download Submit
\Windows\system\ctMvzZA.exe

Filesize
2.1MB

MD5
0fecc11c877eb6afc92854c5bf738072

SHA1
dd61d2dbfb605d5d608ff14ef9b68e0d1eb72fe4

SHA256
7874664dacc3d40546138d8272d7898693d3017347dfbb1ff3857d46e451827d

SHA512
05fcb8fcb164c9d09f86c5e1a83d5cd377ca2ebc39778cf4a99ef1937bcd023191f50e8581d139200f52082c975a567dd78ebc53c1ddb6df608622b43cb3475a

Download Submit
\Windows\system\eiTDWus.exe

Filesize
2.1MB

MD5
642599d30815d4a3148452330b3ca1c1

SHA1
61046df2ec487ffb5529e5cc5f1c008c426cfa24

SHA256
f17d33feed85b77ad73a5ff476657eb1816131751114076cd7e4fd73298e3630

SHA512
95014ced9a01ce451eeca71654291773d7da7e1d04fdbc116802ea05720eb39e7a9027e749e3367e5af811a6f0a46586da3875b10e8911e98140c41d17c5c1fc

Download Submit
\Windows\system\kUsjNqo.exe

Filesize
2.1MB

MD5
f46a4a67de38cdb0c78fab917e5834c1

SHA1
6afb7c1c19cb8fd58da2782b7dbc14e8515e3132

SHA256
5327306f54a65dcceb65561f2045edc96bc13d28840e1be2114505a65d7f9f89

SHA512
1461d8d257a104a1c499ec8fa5c6e5a742187850a2cbac41db22778cc4a7a45f7ffac0843645f2cf8631ec4fa4a2e2009e91b3b8fff16852bfb7e00b7c945bd6

Download Submit
\Windows\system\nKMhfuT.exe

Filesize
2.1MB

MD5
aa72e746ed17a8296d66bc0c701a4606

SHA1
3b078b89ae614781ed9e6567a12a4fb5d5828a41

SHA256
9c7828c2b7fda8be8cb27a5e5ac24707a04e7a80e2aae4afc2678bd4f53a5987

SHA512
8e912d8e7849e0f879779530dd889febfd1fda4008f59ccb3eea0d1c3c3555f72953973211f69f2d9f356a751c730aa7662082fc4d2c4356cc98c736c84f4817

Download Submit
\Windows\system\qJTRGOw.exe

Filesize
2.1MB

MD5
06e25c5f74cdeb48cfba1da1869ab1f8

SHA1
d3ce0684814d8ece6d99e4e55b899797528bb962

SHA256
4139a741569634ef37454267ab7c9fc5450096775976745ddf793a9f94b7c208

SHA512
d049ca3735b2bd91a7958b6dba9384699b794498b34a679109f05edba036fd5aaeaf51c6227ffb2999c07da74ec19cfa63cf778d24d0e71ef56721d52c4e33e0

Download Submit
\Windows\system\qNOnIdI.exe

Filesize
2.1MB

MD5
cfee0afdf2d8101519d4374659d64573

SHA1
3f0d52e4dd0b6a978562a7a36e7d1146952db564

SHA256
53bdaeb672d79d9d157226a6139886dfbf77c5ba018ab84d1e90b0da60040d8a

SHA512
1d57b80ad0d10571d81e146c03b0861fe688a273f012e74f374a81a79a33bdf838f61926bb1220ce6d2caea79d3ff17f4faf9c5b1bc36210ca4bb7502a399aa9

Download Submit
\Windows\system\qruPDtF.exe

Filesize
2.1MB

MD5
0b7fe6ab3e379e3e7d8086158c9d9279

SHA1
1f603dfd2db2cd789c87c8c6ae5f3e136cc6d161

SHA256
1fe1d01270d3d4b7a5e57005f9fab4bff8ea0799ffff6b31ce8985eba7439d85

SHA512
707a57129b43616d1138cb4ed83b696da855905e7fe83395a0b1676a163d542fb49cf1b297eb4d0164e20203f1f9ddb771aa5beac3899ab980ba8dccf8e84f15

Download Submit
\Windows\system\sBFjpWr.exe

Filesize
2.1MB

MD5
9464b698b64ee763fcaa1537b43374f3

SHA1
68d74effe045618996462594b26027b569a500da

SHA256
867996b298e957792f34c2d3b7219f502e36cb96ba4b4dd77490d6cc9027119c

SHA512
c86177f4220b1e630774313e881917fa05c01408f51bdec37aeeab8d8e5d462a382bc99ab726181f0de36166b509b0bd9ea104429f2cf2136243ed5e6c33f24c

Download Submit
\Windows\system\vKceuyz.exe

Filesize
2.1MB

MD5
26f1e047511251cc40239085ddf618ad

SHA1
30fc5e70d991a5eb2813dc6207cac5fdd76c7d2d

SHA256
37600d76ef1182bb42fa1a3e8dfbcd1c872490221c185add6d355ff72b673981

SHA512
d70e28d0215738cd03fcc0ad8feca8a294d71eea69cf578f735183519cea5e562eea05b0266d948002a05dc2504ec7fb060abb7db1015d30a8c0f49754049796

Download Submit
\Windows\system\wsiEFnZ.exe

Filesize
2.1MB

MD5
1f56b496c7a0b3f843c4f08c57e34635

SHA1
8ce4ade2a6b76535a8ab4fa934699e57bc90a162

SHA256
42c4c1deb2e13d978ae2830f9a4adaf46c29874fdf09426f849856413d96514f

SHA512
ef9d583e885607478005bdbdf5e4eeeb232026d20e23283a7adba5ec52d78b0b66419c5bbb71503400594e3438e54167eef362486c956f6199a824ef296efe58

Download Submit
\Windows\system\zXgxoZK.exe

Filesize
2.1MB

MD5
deb229d9a15db6179bd10975032f7410

SHA1
ce7b9ea587b93117abcdb48286a6dfc3fa913c82

SHA256
0f448ef529475387ebf89c12a6a2e19d2f9177bf0c6522d5fcfe13eab8b75bcd

SHA512
7b34dc8e10a2d606603f39aa8efa4dd0971943b2a10702998553a9eff470dde953fdd290ea3ded7238d1d4d9f2fc87840294c20bfa6577cd45205de16dda1036

Download Submit
memory/2108-9-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-94-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-98-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2172-64-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2172-31-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-32-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2172-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2172-63-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2172-62-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-95-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-17-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2172-93-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-0-0x000000013FF20000-0x0000000140312000-memory.dmp

Filesize
3.9MB

Download
memory/2172-50-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2172-96-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2172-97-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2172-30-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2172-8-0x0000000003040000-0x0000000003432000-memory.dmp

Filesize
3.9MB

Download
memory/2172-91-0x0000000003690000-0x0000000003A82000-memory.dmp

Filesize
3.9MB

Download
memory/2172-27-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2392-38-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2392-1257-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2428-57-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2540-36-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2548-47-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2600-78-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-25-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-44-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-85-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2900-52-0x0000000002070000-0x0000000002078000-memory.dmp

Filesize
32KB

Download
memory/2900-51-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download