xmrig | 2854eabc3ac770644f659ddb56a744b14bb476aab6de876942405af0aead7fa1

Analysis

max time kernel
14s
max time network
22s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
Size

1.5MB
MD5

0b077559db64be4256ea6038200ffd4a
SHA1

7e8740a0e680480b16c08904297ce08f43624e9b
SHA256

2854eabc3ac770644f659ddb56a744b14bb476aab6de876942405af0aead7fa1
SHA512

c89ad691039c277d13b55f115ea0d4442a9e343662280081d6388c2ec2e789e87987de36b7f39068880d45df79dab5eb8138d66efb4df826708e705371b3be6b
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYsfLGrAvWWXkCV+1MKTbcMfHhGH:Lz071uv4BPMkibTIA5sf6r+WVc2HhG8Y

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2672-32-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2400-48-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/948-70-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/1504-69-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	xmrig
behavioral1/memory/2448-1171-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig
behavioral1/memory/2072-129-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2796-106-0x000000013F090000-0x000000013F482000-memory.dmp	xmrig
behavioral1/memory/2072-66-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig
behavioral1/memory/2528-28-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1504	uJthVSo.exe
2528	lyhWisc.exe
2672	cCExjhy.exe
2448	cCyqWCD.exe
2400	jsWUcln.exe
2164	fZPMYph.exe
2568	TYBIAqy.exe
948	iXzUyOo.exe
2796	nfoCuRq.exe
1356	dBDgJCX.exe
1788	sSWYzgd.exe
320	FQHLOaw.exe
1932	LOyNCWX.exe
2616	aaBfKfE.exe
1748	ZRjhLfF.exe
908	zYmtMzp.exe
1912	QktfsEv.exe
1644	pVPlIno.exe
276	NfQECOR.exe
2988	nvwAySB.exe
2076	aXMMmOg.exe
1340	WRbnoJp.exe
2024	kDPyjNW.exe
476	OdgwcEB.exe
2252	KjncqPN.exe
1576	ysQbhJq.exe
592	ftpxTuJ.exe
1732	eFKSdEY.exe
636	grUsxPG.exe
2900	qhVqtUY.exe
1140	blqXKPH.exe
1196	shpHnes.exe
3056	RvGkvkz.exe
1180	IrTzCnT.exe
1212	cbpUDHi.exe
1472	SUGuZvG.exe
1276	HiQvyrU.exe
1792	ylSHefo.exe
1888	pWRYnXH.exe
1876	JYKpZvT.exe
936	mHcUNFV.exe
688	SAgabHp.exe
2148	rgGIJjC.exe
2172	kBXAcoi.exe
2904	LuvUsim.exe
1424	LCnpWvW.exe
616	aUkcoZN.exe
3008	MYkBXzd.exe
1208	yrwMqTl.exe
2036	tdipwrv.exe
3016	NZFrbSN.exe
872	KRydGhf.exe
2108	Qmtvetf.exe
1528	KcCarqu.exe
2592	RoxzhVg.exe
2676	daYSbsc.exe
2428	OltYIAf.exe
1588	IHJimfh.exe
2664	uGiTIEW.exe
1992	GtDwWxj.exe
2756	TpdiBKR.exe
1976	dXXLUBZ.exe
2444	cvSMUAl.exe
2120	YhzvKbR.exe

Loads dropped DLL 64 IoCs

pid	Process
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2072-1-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x000b000000014502-3.dat	upx
behavioral1/memory/1504-8-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x00330000000149e1-13.dat	upx
behavioral1/memory/2072-14-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x001800000000558a-21.dat	upx
behavioral1/memory/2672-32-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x000700000001502c-39.dat	upx
behavioral1/memory/2400-48-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/files/0x0008000000014eb9-38.dat	upx
behavioral1/memory/2448-45-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x00070000000153c7-49.dat	upx
behavioral1/memory/2164-54-0x000000013FE00000-0x00000001401F2000-memory.dmp	upx
behavioral1/files/0x00070000000153d9-59.dat	upx
behavioral1/memory/948-70-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/memory/1504-69-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x0008000000015cd9-67.dat	upx
behavioral1/files/0x0006000000015ce3-75.dat	upx
behavioral1/files/0x0033000000014b10-81.dat	upx
behavioral1/files/0x0006000000015d4c-109.dat	upx
behavioral1/files/0x0006000000015d0c-84.dat	upx
behavioral1/files/0x0006000000015fa7-122.dat	upx
behavioral1/files/0x00060000000161b3-136.dat	upx
behavioral1/files/0x00060000000165f0-154.dat	upx
behavioral1/files/0x0006000000016476-150.dat	upx
behavioral1/memory/2448-1171-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000016cb2-185.dat	upx
behavioral1/files/0x0006000000016c3a-179.dat	upx
behavioral1/files/0x0006000000016c42-177.dat	upx
behavioral1/files/0x0006000000016c1d-172.dat	upx
behavioral1/files/0x0006000000016813-162.dat	upx
behavioral1/files/0x0006000000016ce4-191.dat	upx
behavioral1/files/0x0006000000016c8c-184.dat	upx
behavioral1/files/0x0006000000016a6f-166.dat	upx
behavioral1/files/0x000600000001654a-147.dat	upx
behavioral1/files/0x00060000000162c9-142.dat	upx
behavioral1/files/0x00060000000160cc-132.dat	upx
behavioral1/files/0x0006000000015f3c-130.dat	upx
behavioral1/files/0x0006000000015e09-119.dat	upx
behavioral1/files/0x0006000000015d44-91.dat	upx
behavioral1/files/0x0006000000015e6d-110.dat	upx
behavioral1/files/0x0006000000015d24-108.dat	upx
behavioral1/memory/2796-106-0x000000013F090000-0x000000013F482000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-105.dat	upx
behavioral1/memory/2072-66-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/memory/2568-62-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2528-28-0x000000013F320000-0x000000013F712000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DZfmrgA.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\uvBEjaE.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\BlsiWQv.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\FIrcpVP.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\SgNphxZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\nQmHDnw.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ianaJxQ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\YBcRqfQ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\uhfYDrM.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\nayWFBr.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ObTWVHR.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\MLdDOsR.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\tWZoLbU.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\AiYOayA.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\BiyuKGz.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\PQoIhyM.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\aDvadxZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\RAWMzJo.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KxjlxdZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\HEfkyrW.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\bZBXPQP.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\iXEPkFR.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\NpXkORW.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\HlOjExW.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\efuApTK.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ofZENPq.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KSDSGpl.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KUaywcO.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\WGQqADk.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\NYaKpHE.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\UMEeFix.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\xfCtONy.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\XDEJTSj.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\nGofHwG.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\Xgkvihk.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\HjhWeJr.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\kdrLPAp.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\OGYpkEE.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\OZvGfnd.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\PEZfbVz.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\Exrbxnm.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\daYSbsc.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\cYKKlUD.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\MxgtKgF.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\QdABLSZ.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\FsiJHaz.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\wLggCLc.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\pNRUnaM.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\jwaMBMA.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\TpdiBKR.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\aJVqTxu.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\aQoeuys.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\eDJRdVw.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ucjZFCa.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\aaBfKfE.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ysQbhJq.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\NyLlePl.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KBGhYbo.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\tYzioWh.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\TYBIAqy.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\ASPNukk.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\KbKqYfp.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\kTzkjAR.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
File created	C:\Windows\System\cFaEVWa.exe	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2612	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
Token: SeDebugPrivilege	2612	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2612	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 2612	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 2612	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	29
PID 2072 wrote to memory of 1504	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1504	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 1504	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	30
PID 2072 wrote to memory of 2528	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	31
PID 2072 wrote to memory of 2528	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	31
PID 2072 wrote to memory of 2528	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	31
PID 2072 wrote to memory of 2672	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	32
PID 2072 wrote to memory of 2672	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	32
PID 2072 wrote to memory of 2672	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	32
PID 2072 wrote to memory of 2448	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	33
PID 2072 wrote to memory of 2448	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	33
PID 2072 wrote to memory of 2448	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	33
PID 2072 wrote to memory of 2400	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	34
PID 2072 wrote to memory of 2400	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	34
PID 2072 wrote to memory of 2400	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	34
PID 2072 wrote to memory of 2164	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	35
PID 2072 wrote to memory of 2164	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	35
PID 2072 wrote to memory of 2164	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	35
PID 2072 wrote to memory of 2568	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	36
PID 2072 wrote to memory of 2568	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	36
PID 2072 wrote to memory of 2568	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	36
PID 2072 wrote to memory of 948	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	37
PID 2072 wrote to memory of 948	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	37
PID 2072 wrote to memory of 948	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	37
PID 2072 wrote to memory of 2796	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	38
PID 2072 wrote to memory of 2796	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	38
PID 2072 wrote to memory of 2796	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	38
PID 2072 wrote to memory of 1356	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	39
PID 2072 wrote to memory of 1356	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	39
PID 2072 wrote to memory of 1356	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	39
PID 2072 wrote to memory of 1788	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	40
PID 2072 wrote to memory of 1788	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	40
PID 2072 wrote to memory of 1788	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	40
PID 2072 wrote to memory of 1748	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	41
PID 2072 wrote to memory of 1748	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	41
PID 2072 wrote to memory of 1748	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	41
PID 2072 wrote to memory of 320	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	42
PID 2072 wrote to memory of 320	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	42
PID 2072 wrote to memory of 320	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	42
PID 2072 wrote to memory of 908	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	43
PID 2072 wrote to memory of 908	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	43
PID 2072 wrote to memory of 908	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	43
PID 2072 wrote to memory of 1932	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	44
PID 2072 wrote to memory of 1932	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	44
PID 2072 wrote to memory of 1932	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	44
PID 2072 wrote to memory of 1912	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	45
PID 2072 wrote to memory of 1912	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	45
PID 2072 wrote to memory of 1912	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	45
PID 2072 wrote to memory of 2616	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	46
PID 2072 wrote to memory of 2616	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	46
PID 2072 wrote to memory of 2616	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	46
PID 2072 wrote to memory of 276	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	47
PID 2072 wrote to memory of 276	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	47
PID 2072 wrote to memory of 276	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	47
PID 2072 wrote to memory of 1644	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	48
PID 2072 wrote to memory of 1644	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	48
PID 2072 wrote to memory of 1644	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	48
PID 2072 wrote to memory of 2988	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	49
PID 2072 wrote to memory of 2988	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	49
PID 2072 wrote to memory of 2988	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	49
PID 2072 wrote to memory of 2076	2072	0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b077559db64be4256ea6038200ffd4a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2612
- C:\Windows\System\uJthVSo.exe
  C:\Windows\System\uJthVSo.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\lyhWisc.exe
  C:\Windows\System\lyhWisc.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\cCExjhy.exe
  C:\Windows\System\cCExjhy.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\cCyqWCD.exe
  C:\Windows\System\cCyqWCD.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\jsWUcln.exe
  C:\Windows\System\jsWUcln.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\fZPMYph.exe
  C:\Windows\System\fZPMYph.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TYBIAqy.exe
  C:\Windows\System\TYBIAqy.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\iXzUyOo.exe
  C:\Windows\System\iXzUyOo.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\nfoCuRq.exe
  C:\Windows\System\nfoCuRq.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\dBDgJCX.exe
  C:\Windows\System\dBDgJCX.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\sSWYzgd.exe
  C:\Windows\System\sSWYzgd.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ZRjhLfF.exe
  C:\Windows\System\ZRjhLfF.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\FQHLOaw.exe
  C:\Windows\System\FQHLOaw.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\zYmtMzp.exe
  C:\Windows\System\zYmtMzp.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\LOyNCWX.exe
  C:\Windows\System\LOyNCWX.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\QktfsEv.exe
  C:\Windows\System\QktfsEv.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\aaBfKfE.exe
  C:\Windows\System\aaBfKfE.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\NfQECOR.exe
  C:\Windows\System\NfQECOR.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\pVPlIno.exe
  C:\Windows\System\pVPlIno.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\nvwAySB.exe
  C:\Windows\System\nvwAySB.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\aXMMmOg.exe
  C:\Windows\System\aXMMmOg.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\WRbnoJp.exe
  C:\Windows\System\WRbnoJp.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\kDPyjNW.exe
  C:\Windows\System\kDPyjNW.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\KjncqPN.exe
  C:\Windows\System\KjncqPN.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\OdgwcEB.exe
  C:\Windows\System\OdgwcEB.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\ysQbhJq.exe
  C:\Windows\System\ysQbhJq.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\ftpxTuJ.exe
  C:\Windows\System\ftpxTuJ.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\eFKSdEY.exe
  C:\Windows\System\eFKSdEY.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\grUsxPG.exe
  C:\Windows\System\grUsxPG.exe
  2⤵
  - Executes dropped EXE
  PID:636
- C:\Windows\System\shpHnes.exe
  C:\Windows\System\shpHnes.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\qhVqtUY.exe
  C:\Windows\System\qhVqtUY.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\RvGkvkz.exe
  C:\Windows\System\RvGkvkz.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\blqXKPH.exe
  C:\Windows\System\blqXKPH.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\IrTzCnT.exe
  C:\Windows\System\IrTzCnT.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\cbpUDHi.exe
  C:\Windows\System\cbpUDHi.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\SUGuZvG.exe
  C:\Windows\System\SUGuZvG.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\HiQvyrU.exe
  C:\Windows\System\HiQvyrU.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\ylSHefo.exe
  C:\Windows\System\ylSHefo.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\pWRYnXH.exe
  C:\Windows\System\pWRYnXH.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\JYKpZvT.exe
  C:\Windows\System\JYKpZvT.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\mHcUNFV.exe
  C:\Windows\System\mHcUNFV.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\aUkcoZN.exe
  C:\Windows\System\aUkcoZN.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\SAgabHp.exe
  C:\Windows\System\SAgabHp.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\MYkBXzd.exe
  C:\Windows\System\MYkBXzd.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\rgGIJjC.exe
  C:\Windows\System\rgGIJjC.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\yrwMqTl.exe
  C:\Windows\System\yrwMqTl.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\kBXAcoi.exe
  C:\Windows\System\kBXAcoi.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\tdipwrv.exe
  C:\Windows\System\tdipwrv.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\LuvUsim.exe
  C:\Windows\System\LuvUsim.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\NZFrbSN.exe
  C:\Windows\System\NZFrbSN.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\LCnpWvW.exe
  C:\Windows\System\LCnpWvW.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\KRydGhf.exe
  C:\Windows\System\KRydGhf.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\Qmtvetf.exe
  C:\Windows\System\Qmtvetf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\KcCarqu.exe
  C:\Windows\System\KcCarqu.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\RoxzhVg.exe
  C:\Windows\System\RoxzhVg.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\daYSbsc.exe
  C:\Windows\System\daYSbsc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\OltYIAf.exe
  C:\Windows\System\OltYIAf.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\IHJimfh.exe
  C:\Windows\System\IHJimfh.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\uGiTIEW.exe
  C:\Windows\System\uGiTIEW.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\GtDwWxj.exe
  C:\Windows\System\GtDwWxj.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\TpdiBKR.exe
  C:\Windows\System\TpdiBKR.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\dXXLUBZ.exe
  C:\Windows\System\dXXLUBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\cvSMUAl.exe
  C:\Windows\System\cvSMUAl.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\YhzvKbR.exe
  C:\Windows\System\YhzvKbR.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\SgNphxZ.exe
  C:\Windows\System\SgNphxZ.exe
  2⤵
  PID:1964
- C:\Windows\System\ScbwwMl.exe
  C:\Windows\System\ScbwwMl.exe
  2⤵
  PID:1004
- C:\Windows\System\bRXpakM.exe
  C:\Windows\System\bRXpakM.exe
  2⤵
  PID:1628
- C:\Windows\System\lhAXdMz.exe
  C:\Windows\System\lhAXdMz.exe
  2⤵
  PID:2056
- C:\Windows\System\hnKfaHD.exe
  C:\Windows\System\hnKfaHD.exe
  2⤵
  PID:2584
- C:\Windows\System\nQmHDnw.exe
  C:\Windows\System\nQmHDnw.exe
  2⤵
  PID:1680
- C:\Windows\System\zVicsEx.exe
  C:\Windows\System\zVicsEx.exe
  2⤵
  PID:2992
- C:\Windows\System\oTFvWVW.exe
  C:\Windows\System\oTFvWVW.exe
  2⤵
  PID:2688
- C:\Windows\System\YemkLXD.exe
  C:\Windows\System\YemkLXD.exe
  2⤵
  PID:588
- C:\Windows\System\qlkjMIy.exe
  C:\Windows\System\qlkjMIy.exe
  2⤵
  PID:2840
- C:\Windows\System\JQWnFlT.exe
  C:\Windows\System\JQWnFlT.exe
  2⤵
  PID:536
- C:\Windows\System\EgBwIXS.exe
  C:\Windows\System\EgBwIXS.exe
  2⤵
  PID:1096
- C:\Windows\System\VZvMmAi.exe
  C:\Windows\System\VZvMmAi.exe
  2⤵
  PID:2880
- C:\Windows\System\Hdpubmf.exe
  C:\Windows\System\Hdpubmf.exe
  2⤵
  PID:2272
- C:\Windows\System\dEuVgxN.exe
  C:\Windows\System\dEuVgxN.exe
  2⤵
  PID:1256
- C:\Windows\System\douzYOK.exe
  C:\Windows\System\douzYOK.exe
  2⤵
  PID:1692
- C:\Windows\System\JZEkqIT.exe
  C:\Windows\System\JZEkqIT.exe
  2⤵
  PID:1432
- C:\Windows\System\ZSRfZTV.exe
  C:\Windows\System\ZSRfZTV.exe
  2⤵
  PID:3004
- C:\Windows\System\ZtKPBEr.exe
  C:\Windows\System\ZtKPBEr.exe
  2⤵
  PID:3032
- C:\Windows\System\pcjsTDF.exe
  C:\Windows\System\pcjsTDF.exe
  2⤵
  PID:884
- C:\Windows\System\rLNOrQq.exe
  C:\Windows\System\rLNOrQq.exe
  2⤵
  PID:1672
- C:\Windows\System\uHAUHhX.exe
  C:\Windows\System\uHAUHhX.exe
  2⤵
  PID:2152
- C:\Windows\System\AoaFHut.exe
  C:\Windows\System\AoaFHut.exe
  2⤵
  PID:2652
- C:\Windows\System\fpzfaWi.exe
  C:\Windows\System\fpzfaWi.exe
  2⤵
  PID:896
- C:\Windows\System\aIqQtcB.exe
  C:\Windows\System\aIqQtcB.exe
  2⤵
  PID:3020
- C:\Windows\System\vqeCpot.exe
  C:\Windows\System\vqeCpot.exe
  2⤵
  PID:1636
- C:\Windows\System\pGpRtrL.exe
  C:\Windows\System\pGpRtrL.exe
  2⤵
  PID:2208
- C:\Windows\System\FYbsPDB.exe
  C:\Windows\System\FYbsPDB.exe
  2⤵
  PID:2220
- C:\Windows\System\jVymxCI.exe
  C:\Windows\System\jVymxCI.exe
  2⤵
  PID:2412
- C:\Windows\System\nGofHwG.exe
  C:\Windows\System\nGofHwG.exe
  2⤵
  PID:2100
- C:\Windows\System\vmsDOdM.exe
  C:\Windows\System\vmsDOdM.exe
  2⤵
  PID:2680
- C:\Windows\System\JssgCBg.exe
  C:\Windows\System\JssgCBg.exe
  2⤵
  PID:2484
- C:\Windows\System\bZBXPQP.exe
  C:\Windows\System\bZBXPQP.exe
  2⤵
  PID:2684
- C:\Windows\System\GGYUeqQ.exe
  C:\Windows\System\GGYUeqQ.exe
  2⤵
  PID:3044
- C:\Windows\System\cQnpost.exe
  C:\Windows\System\cQnpost.exe
  2⤵
  PID:112
- C:\Windows\System\TBzMFqx.exe
  C:\Windows\System\TBzMFqx.exe
  2⤵
  PID:2496
- C:\Windows\System\dhsVkZy.exe
  C:\Windows\System\dhsVkZy.exe
  2⤵
  PID:2816
- C:\Windows\System\WknDKHT.exe
  C:\Windows\System\WknDKHT.exe
  2⤵
  PID:2244
- C:\Windows\System\vhyLlhY.exe
  C:\Windows\System\vhyLlhY.exe
  2⤵
  PID:1428
- C:\Windows\System\DZfmrgA.exe
  C:\Windows\System\DZfmrgA.exe
  2⤵
  PID:2980
- C:\Windows\System\owKlpOc.exe
  C:\Windows\System\owKlpOc.exe
  2⤵
  PID:1848
- C:\Windows\System\WETqrwS.exe
  C:\Windows\System\WETqrwS.exe
  2⤵
  PID:380
- C:\Windows\System\WpFtAwZ.exe
  C:\Windows\System\WpFtAwZ.exe
  2⤵
  PID:1736
- C:\Windows\System\FteXHGM.exe
  C:\Windows\System\FteXHGM.exe
  2⤵
  PID:1916
- C:\Windows\System\MLdDOsR.exe
  C:\Windows\System\MLdDOsR.exe
  2⤵
  PID:1972
- C:\Windows\System\LWEwDDZ.exe
  C:\Windows\System\LWEwDDZ.exe
  2⤵
  PID:2388
- C:\Windows\System\mPNxjBX.exe
  C:\Windows\System\mPNxjBX.exe
  2⤵
  PID:2896
- C:\Windows\System\oZdVEOB.exe
  C:\Windows\System\oZdVEOB.exe
  2⤵
  PID:272
- C:\Windows\System\XdweMtU.exe
  C:\Windows\System\XdweMtU.exe
  2⤵
  PID:1568
- C:\Windows\System\OecsXtR.exe
  C:\Windows\System\OecsXtR.exe
  2⤵
  PID:2468
- C:\Windows\System\szKtZzF.exe
  C:\Windows\System\szKtZzF.exe
  2⤵
  PID:1940
- C:\Windows\System\EPqSEUn.exe
  C:\Windows\System\EPqSEUn.exe
  2⤵
  PID:1936
- C:\Windows\System\FCAFLvQ.exe
  C:\Windows\System\FCAFLvQ.exe
  2⤵
  PID:1652
- C:\Windows\System\FKBgiDA.exe
  C:\Windows\System\FKBgiDA.exe
  2⤵
  PID:1620
- C:\Windows\System\WfFEcWx.exe
  C:\Windows\System\WfFEcWx.exe
  2⤵
  PID:1580
- C:\Windows\System\PJgXBKp.exe
  C:\Windows\System\PJgXBKp.exe
  2⤵
  PID:2544
- C:\Windows\System\YPjYAQF.exe
  C:\Windows\System\YPjYAQF.exe
  2⤵
  PID:2536
- C:\Windows\System\sFPxKfj.exe
  C:\Windows\System\sFPxKfj.exe
  2⤵
  PID:2564
- C:\Windows\System\OXTfynn.exe
  C:\Windows\System\OXTfynn.exe
  2⤵
  PID:2424
- C:\Windows\System\fKgRGjR.exe
  C:\Windows\System\fKgRGjR.exe
  2⤵
  PID:1392
- C:\Windows\System\rpjOOjD.exe
  C:\Windows\System\rpjOOjD.exe
  2⤵
  PID:2820
- C:\Windows\System\yTyGaPM.exe
  C:\Windows\System\yTyGaPM.exe
  2⤵
  PID:2604
- C:\Windows\System\Fdvnqap.exe
  C:\Windows\System\Fdvnqap.exe
  2⤵
  PID:1604
- C:\Windows\System\HuTOFps.exe
  C:\Windows\System\HuTOFps.exe
  2⤵
  PID:1840
- C:\Windows\System\WBWWTvk.exe
  C:\Windows\System\WBWWTvk.exe
  2⤵
  PID:1412
- C:\Windows\System\QQjrCCK.exe
  C:\Windows\System\QQjrCCK.exe
  2⤵
  PID:1944
- C:\Windows\System\vMgxxQz.exe
  C:\Windows\System\vMgxxQz.exe
  2⤵
  PID:1100
- C:\Windows\System\KSDSGpl.exe
  C:\Windows\System\KSDSGpl.exe
  2⤵
  PID:1668
- C:\Windows\System\muUycqL.exe
  C:\Windows\System\muUycqL.exe
  2⤵
  PID:2196
- C:\Windows\System\bTRxsML.exe
  C:\Windows\System\bTRxsML.exe
  2⤵
  PID:1192
- C:\Windows\System\TDWFJOz.exe
  C:\Windows\System\TDWFJOz.exe
  2⤵
  PID:2184
- C:\Windows\System\mWRaeVP.exe
  C:\Windows\System\mWRaeVP.exe
  2⤵
  PID:2052
- C:\Windows\System\YdRcOcj.exe
  C:\Windows\System\YdRcOcj.exe
  2⤵
  PID:328
- C:\Windows\System\tYFRbMp.exe
  C:\Windows\System\tYFRbMp.exe
  2⤵
  PID:1624
- C:\Windows\System\oqZSyit.exe
  C:\Windows\System\oqZSyit.exe
  2⤵
  PID:1900
- C:\Windows\System\DITdHeK.exe
  C:\Windows\System\DITdHeK.exe
  2⤵
  PID:1532
- C:\Windows\System\itNRlcC.exe
  C:\Windows\System\itNRlcC.exe
  2⤵
  PID:2748
- C:\Windows\System\yrhpDZx.exe
  C:\Windows\System\yrhpDZx.exe
  2⤵
  PID:3064
- C:\Windows\System\DPfrjLF.exe
  C:\Windows\System\DPfrjLF.exe
  2⤵
  PID:2828
- C:\Windows\System\wUekAJW.exe
  C:\Windows\System\wUekAJW.exe
  2⤵
  PID:856
- C:\Windows\System\kdrLPAp.exe
  C:\Windows\System\kdrLPAp.exe
  2⤵
  PID:2276
- C:\Windows\System\vwslHdJ.exe
  C:\Windows\System\vwslHdJ.exe
  2⤵
  PID:1948
- C:\Windows\System\vMBFCan.exe
  C:\Windows\System\vMBFCan.exe
  2⤵
  PID:1864
- C:\Windows\System\bSyrhgp.exe
  C:\Windows\System\bSyrhgp.exe
  2⤵
  PID:1896
- C:\Windows\System\uvBEjaE.exe
  C:\Windows\System\uvBEjaE.exe
  2⤵
  PID:2228
- C:\Windows\System\ldZTjUY.exe
  C:\Windows\System\ldZTjUY.exe
  2⤵
  PID:2280
- C:\Windows\System\QiCNkbL.exe
  C:\Windows\System\QiCNkbL.exe
  2⤵
  PID:2844
- C:\Windows\System\BiyuKGz.exe
  C:\Windows\System\BiyuKGz.exe
  2⤵
  PID:1116
- C:\Windows\System\KQIzUIA.exe
  C:\Windows\System\KQIzUIA.exe
  2⤵
  PID:804
- C:\Windows\System\zQyOpdx.exe
  C:\Windows\System\zQyOpdx.exe
  2⤵
  PID:2016
- C:\Windows\System\bRoxjOe.exe
  C:\Windows\System\bRoxjOe.exe
  2⤵
  PID:760
- C:\Windows\System\Xgkvihk.exe
  C:\Windows\System\Xgkvihk.exe
  2⤵
  PID:2668
- C:\Windows\System\QXHrjqi.exe
  C:\Windows\System\QXHrjqi.exe
  2⤵
  PID:3000
- C:\Windows\System\ukbknKD.exe
  C:\Windows\System\ukbknKD.exe
  2⤵
  PID:2316
- C:\Windows\System\ExHndVn.exe
  C:\Windows\System\ExHndVn.exe
  2⤵
  PID:2944
- C:\Windows\System\aoyrRIe.exe
  C:\Windows\System\aoyrRIe.exe
  2⤵
  PID:280
- C:\Windows\System\DucuiYO.exe
  C:\Windows\System\DucuiYO.exe
  2⤵
  PID:1640
- C:\Windows\System\pPAoCWG.exe
  C:\Windows\System\pPAoCWG.exe
  2⤵
  PID:2800
- C:\Windows\System\RRgvJyw.exe
  C:\Windows\System\RRgvJyw.exe
  2⤵
  PID:1968
- C:\Windows\System\bmwUSNP.exe
  C:\Windows\System\bmwUSNP.exe
  2⤵
  PID:836
- C:\Windows\System\QPfMuZF.exe
  C:\Windows\System\QPfMuZF.exe
  2⤵
  PID:268
- C:\Windows\System\yoZuoZg.exe
  C:\Windows\System\yoZuoZg.exe
  2⤵
  PID:3076
- C:\Windows\System\wuTUBOH.exe
  C:\Windows\System\wuTUBOH.exe
  2⤵
  PID:3092
- C:\Windows\System\mOinNzT.exe
  C:\Windows\System\mOinNzT.exe
  2⤵
  PID:3108
- C:\Windows\System\uaCIaPc.exe
  C:\Windows\System\uaCIaPc.exe
  2⤵
  PID:3124
- C:\Windows\System\kiFMCYE.exe
  C:\Windows\System\kiFMCYE.exe
  2⤵
  PID:3200
- C:\Windows\System\LOmUhie.exe
  C:\Windows\System\LOmUhie.exe
  2⤵
  PID:3216
- C:\Windows\System\iXEPkFR.exe
  C:\Windows\System\iXEPkFR.exe
  2⤵
  PID:3236
- C:\Windows\System\GBbSKfw.exe
  C:\Windows\System\GBbSKfw.exe
  2⤵
  PID:3256
- C:\Windows\System\MuNPOFg.exe
  C:\Windows\System\MuNPOFg.exe
  2⤵
  PID:3280
- C:\Windows\System\DvQYXwz.exe
  C:\Windows\System\DvQYXwz.exe
  2⤵
  PID:3296
- C:\Windows\System\aYWicpj.exe
  C:\Windows\System\aYWicpj.exe
  2⤵
  PID:3312
- C:\Windows\System\pBxiany.exe
  C:\Windows\System\pBxiany.exe
  2⤵
  PID:3336
- C:\Windows\System\smfAXdK.exe
  C:\Windows\System\smfAXdK.exe
  2⤵
  PID:3356
- C:\Windows\System\DfPFIPJ.exe
  C:\Windows\System\DfPFIPJ.exe
  2⤵
  PID:3380
- C:\Windows\System\OqgKDXC.exe
  C:\Windows\System\OqgKDXC.exe
  2⤵
  PID:3396
- C:\Windows\System\GyUDjuM.exe
  C:\Windows\System\GyUDjuM.exe
  2⤵
  PID:3412
- C:\Windows\System\QNRorHo.exe
  C:\Windows\System\QNRorHo.exe
  2⤵
  PID:3440
- C:\Windows\System\YMhLYxU.exe
  C:\Windows\System\YMhLYxU.exe
  2⤵
  PID:3456
- C:\Windows\System\GEyMehn.exe
  C:\Windows\System\GEyMehn.exe
  2⤵
  PID:3476
- C:\Windows\System\GShxOAV.exe
  C:\Windows\System\GShxOAV.exe
  2⤵
  PID:3496
- C:\Windows\System\qjVgRlB.exe
  C:\Windows\System\qjVgRlB.exe
  2⤵
  PID:3520
- C:\Windows\System\kqUTMeE.exe
  C:\Windows\System\kqUTMeE.exe
  2⤵
  PID:3536
- C:\Windows\System\HlOjExW.exe
  C:\Windows\System\HlOjExW.exe
  2⤵
  PID:3556
- C:\Windows\System\dMgBWSx.exe
  C:\Windows\System\dMgBWSx.exe
  2⤵
  PID:3576
- C:\Windows\System\zzFqGYf.exe
  C:\Windows\System\zzFqGYf.exe
  2⤵
  PID:3600
- C:\Windows\System\BQUAmcT.exe
  C:\Windows\System\BQUAmcT.exe
  2⤵
  PID:3616
- C:\Windows\System\PlJqcww.exe
  C:\Windows\System\PlJqcww.exe
  2⤵
  PID:3636
- C:\Windows\System\WqcKzNy.exe
  C:\Windows\System\WqcKzNy.exe
  2⤵
  PID:3656
- C:\Windows\System\AMepQgE.exe
  C:\Windows\System\AMepQgE.exe
  2⤵
  PID:3676
- C:\Windows\System\NidpIdq.exe
  C:\Windows\System\NidpIdq.exe
  2⤵
  PID:3692
- C:\Windows\System\zEajlpG.exe
  C:\Windows\System\zEajlpG.exe
  2⤵
  PID:3720
- C:\Windows\System\sIoBxHE.exe
  C:\Windows\System\sIoBxHE.exe
  2⤵
  PID:3736
- C:\Windows\System\DHRYqgH.exe
  C:\Windows\System\DHRYqgH.exe
  2⤵
  PID:3760
- C:\Windows\System\WawVbWU.exe
  C:\Windows\System\WawVbWU.exe
  2⤵
  PID:3776
- C:\Windows\System\LsYuJqG.exe
  C:\Windows\System\LsYuJqG.exe
  2⤵
  PID:3796
- C:\Windows\System\YXwWaIV.exe
  C:\Windows\System\YXwWaIV.exe
  2⤵
  PID:3816
- C:\Windows\System\aeEnRcB.exe
  C:\Windows\System\aeEnRcB.exe
  2⤵
  PID:3836
- C:\Windows\System\ASPNukk.exe
  C:\Windows\System\ASPNukk.exe
  2⤵
  PID:3852
- C:\Windows\System\ZsqwzYl.exe
  C:\Windows\System\ZsqwzYl.exe
  2⤵
  PID:3880
- C:\Windows\System\ZsSmvNN.exe
  C:\Windows\System\ZsSmvNN.exe
  2⤵
  PID:3896
- C:\Windows\System\BhGuZbN.exe
  C:\Windows\System\BhGuZbN.exe
  2⤵
  PID:3920
- C:\Windows\System\sYIwoow.exe
  C:\Windows\System\sYIwoow.exe
  2⤵
  PID:3936
- C:\Windows\System\ISUIkuS.exe
  C:\Windows\System\ISUIkuS.exe
  2⤵
  PID:3956
- C:\Windows\System\CqvgeYm.exe
  C:\Windows\System\CqvgeYm.exe
  2⤵
  PID:3976
- C:\Windows\System\imlUEnm.exe
  C:\Windows\System\imlUEnm.exe
  2⤵
  PID:3996
- C:\Windows\System\XyhbKSA.exe
  C:\Windows\System\XyhbKSA.exe
  2⤵
  PID:4016
- C:\Windows\System\MhlftIG.exe
  C:\Windows\System\MhlftIG.exe
  2⤵
  PID:4040
- C:\Windows\System\yiXGTmI.exe
  C:\Windows\System\yiXGTmI.exe
  2⤵
  PID:4056
- C:\Windows\System\PhPAxCj.exe
  C:\Windows\System\PhPAxCj.exe
  2⤵
  PID:4080
- C:\Windows\System\jRHvHez.exe
  C:\Windows\System\jRHvHez.exe
  2⤵
  PID:580
- C:\Windows\System\tOfdNnQ.exe
  C:\Windows\System\tOfdNnQ.exe
  2⤵
  PID:1584
- C:\Windows\System\GdCgJPW.exe
  C:\Windows\System\GdCgJPW.exe
  2⤵
  PID:3088
- C:\Windows\System\fltdYPB.exe
  C:\Windows\System\fltdYPB.exe
  2⤵
  PID:2600
- C:\Windows\System\QsWhBeN.exe
  C:\Windows\System\QsWhBeN.exe
  2⤵
  PID:2028
- C:\Windows\System\yhipXqz.exe
  C:\Windows\System\yhipXqz.exe
  2⤵
  PID:2124
- C:\Windows\System\jwfsanp.exe
  C:\Windows\System\jwfsanp.exe
  2⤵
  PID:3100
- C:\Windows\System\hLnIxjb.exe
  C:\Windows\System\hLnIxjb.exe
  2⤵
  PID:3148
- C:\Windows\System\AZCJBcl.exe
  C:\Windows\System\AZCJBcl.exe
  2⤵
  PID:3168
- C:\Windows\System\hPKXwfY.exe
  C:\Windows\System\hPKXwfY.exe
  2⤵
  PID:3188
- C:\Windows\System\KkcWKrr.exe
  C:\Windows\System\KkcWKrr.exe
  2⤵
  PID:3208
- C:\Windows\System\itSFJPU.exe
  C:\Windows\System\itSFJPU.exe
  2⤵
  PID:3232
- C:\Windows\System\QBbBtSX.exe
  C:\Windows\System\QBbBtSX.exe
  2⤵
  PID:3252
- C:\Windows\System\QZaaByv.exe
  C:\Windows\System\QZaaByv.exe
  2⤵
  PID:2236
- C:\Windows\System\pNRUnaM.exe
  C:\Windows\System\pNRUnaM.exe
  2⤵
  PID:3304
- C:\Windows\System\VNnPbfM.exe
  C:\Windows\System\VNnPbfM.exe
  2⤵
  PID:3328
- C:\Windows\System\tHlrDmt.exe
  C:\Windows\System\tHlrDmt.exe
  2⤵
  PID:3372
- C:\Windows\System\oKwViCZ.exe
  C:\Windows\System\oKwViCZ.exe
  2⤵
  PID:3408
- C:\Windows\System\YKJKJiM.exe
  C:\Windows\System\YKJKJiM.exe
  2⤵
  PID:3436
- C:\Windows\System\TcBqwNG.exe
  C:\Windows\System\TcBqwNG.exe
  2⤵
  PID:3452
- C:\Windows\System\OGJUFVg.exe
  C:\Windows\System\OGJUFVg.exe
  2⤵
  PID:3492
- C:\Windows\System\avTVQbN.exe
  C:\Windows\System\avTVQbN.exe
  2⤵
  PID:3516
- C:\Windows\System\itvFHmQ.exe
  C:\Windows\System\itvFHmQ.exe
  2⤵
  PID:3544
- C:\Windows\System\ZICjDeF.exe
  C:\Windows\System\ZICjDeF.exe
  2⤵
  PID:3572
- C:\Windows\System\lUsiJXp.exe
  C:\Windows\System\lUsiJXp.exe
  2⤵
  PID:3592
- C:\Windows\System\FmdPYqt.exe
  C:\Windows\System\FmdPYqt.exe
  2⤵
  PID:3612
- C:\Windows\System\UDfZyLa.exe
  C:\Windows\System\UDfZyLa.exe
  2⤵
  PID:3648
- C:\Windows\System\UBspCPL.exe
  C:\Windows\System\UBspCPL.exe
  2⤵
  PID:3684
- C:\Windows\System\DDDxuBO.exe
  C:\Windows\System\DDDxuBO.exe
  2⤵
  PID:3712
- C:\Windows\System\ztWHAAn.exe
  C:\Windows\System\ztWHAAn.exe
  2⤵
  PID:3732
- C:\Windows\System\SIstnOu.exe
  C:\Windows\System\SIstnOu.exe
  2⤵
  PID:3748
- C:\Windows\System\CCprCnb.exe
  C:\Windows\System\CCprCnb.exe
  2⤵
  PID:3772
- C:\Windows\System\NiGhaMK.exe
  C:\Windows\System\NiGhaMK.exe
  2⤵
  PID:3812
- C:\Windows\System\KRXCnFk.exe
  C:\Windows\System\KRXCnFk.exe
  2⤵
  PID:3828
- C:\Windows\System\jSMFxGk.exe
  C:\Windows\System\jSMFxGk.exe
  2⤵
  PID:3860
- C:\Windows\System\SzBUcLX.exe
  C:\Windows\System\SzBUcLX.exe
  2⤵
  PID:3888
- C:\Windows\System\bBKcCqB.exe
  C:\Windows\System\bBKcCqB.exe
  2⤵
  PID:3912
- C:\Windows\System\fFIksde.exe
  C:\Windows\System\fFIksde.exe
  2⤵
  PID:3944
- C:\Windows\System\pPzgyRB.exe
  C:\Windows\System\pPzgyRB.exe
  2⤵
  PID:3948
- C:\Windows\System\ExuRvto.exe
  C:\Windows\System\ExuRvto.exe
  2⤵
  PID:3992
- C:\Windows\System\tkybzMY.exe
  C:\Windows\System\tkybzMY.exe
  2⤵
  PID:4024
- C:\Windows\System\kYnimNF.exe
  C:\Windows\System\kYnimNF.exe
  2⤵
  PID:4048
- C:\Windows\System\RxmAwOz.exe
  C:\Windows\System\RxmAwOz.exe
  2⤵
  PID:4076
- C:\Windows\System\GmAIxQi.exe
  C:\Windows\System\GmAIxQi.exe
  2⤵
  PID:1656
- C:\Windows\System\ZEzlaDa.exe
  C:\Windows\System\ZEzlaDa.exe
  2⤵
  PID:3084
- C:\Windows\System\rnmyZoC.exe
  C:\Windows\System\rnmyZoC.exe
  2⤵
  PID:2864
- C:\Windows\System\UVjcKUB.exe
  C:\Windows\System\UVjcKUB.exe
  2⤵
  PID:2836
- C:\Windows\System\uNKGGvf.exe
  C:\Windows\System\uNKGGvf.exe
  2⤵
  PID:940
- C:\Windows\System\xqWEQOU.exe
  C:\Windows\System\xqWEQOU.exe
  2⤵
  PID:3144
- C:\Windows\System\hiZtYoh.exe
  C:\Windows\System\hiZtYoh.exe
  2⤵
  PID:3160
- C:\Windows\System\vdUXIzZ.exe
  C:\Windows\System\vdUXIzZ.exe
  2⤵
  PID:3180
- C:\Windows\System\gUiqDqG.exe
  C:\Windows\System\gUiqDqG.exe
  2⤵
  PID:3184
- C:\Windows\System\NNHgPQg.exe
  C:\Windows\System\NNHgPQg.exe
  2⤵
  PID:3272
- C:\Windows\System\rrVRxFO.exe
  C:\Windows\System\rrVRxFO.exe
  2⤵
  PID:3348
- C:\Windows\System\efuApTK.exe
  C:\Windows\System\efuApTK.exe
  2⤵
  PID:3368
- C:\Windows\System\rlzBxov.exe
  C:\Windows\System\rlzBxov.exe
  2⤵
  PID:3428
- C:\Windows\System\FVSePpm.exe
  C:\Windows\System\FVSePpm.exe
  2⤵
  PID:3568
- C:\Windows\System\KIZlnLf.exe
  C:\Windows\System\KIZlnLf.exe
  2⤵
  PID:4104
- C:\Windows\System\xQLIbKJ.exe
  C:\Windows\System\xQLIbKJ.exe
  2⤵
  PID:4124
- C:\Windows\System\raSzJzg.exe
  C:\Windows\System\raSzJzg.exe
  2⤵
  PID:4140
- C:\Windows\System\IvBVWad.exe
  C:\Windows\System\IvBVWad.exe
  2⤵
  PID:4156
- C:\Windows\System\FuBaqPv.exe
  C:\Windows\System\FuBaqPv.exe
  2⤵
  PID:4172
- C:\Windows\System\JkYUnvD.exe
  C:\Windows\System\JkYUnvD.exe
  2⤵
  PID:4188
- C:\Windows\System\BaGkcbK.exe
  C:\Windows\System\BaGkcbK.exe
  2⤵
  PID:4204
- C:\Windows\System\BKwwcYT.exe
  C:\Windows\System\BKwwcYT.exe
  2⤵
  PID:4220
- C:\Windows\System\yNXpUNj.exe
  C:\Windows\System\yNXpUNj.exe
  2⤵
  PID:4240
- C:\Windows\System\dPSibBe.exe
  C:\Windows\System\dPSibBe.exe
  2⤵
  PID:4256
- C:\Windows\System\WFypHyi.exe
  C:\Windows\System\WFypHyi.exe
  2⤵
  PID:4272
- C:\Windows\System\iDyySrZ.exe
  C:\Windows\System\iDyySrZ.exe
  2⤵
  PID:4288
- C:\Windows\System\PQoIhyM.exe
  C:\Windows\System\PQoIhyM.exe
  2⤵
  PID:4304
- C:\Windows\System\voCiYdM.exe
  C:\Windows\System\voCiYdM.exe
  2⤵
  PID:4320
- C:\Windows\System\UMEeFix.exe
  C:\Windows\System\UMEeFix.exe
  2⤵
  PID:4340
- C:\Windows\System\ElOFsKd.exe
  C:\Windows\System\ElOFsKd.exe
  2⤵
  PID:4356
- C:\Windows\System\BlsiWQv.exe
  C:\Windows\System\BlsiWQv.exe
  2⤵
  PID:4372
- C:\Windows\System\lURlVZL.exe
  C:\Windows\System\lURlVZL.exe
  2⤵
  PID:4388
- C:\Windows\System\wFLukhn.exe
  C:\Windows\System\wFLukhn.exe
  2⤵
  PID:4404
- C:\Windows\System\JkBEdDL.exe
  C:\Windows\System\JkBEdDL.exe
  2⤵
  PID:4420
- C:\Windows\System\MsMCqrC.exe
  C:\Windows\System\MsMCqrC.exe
  2⤵
  PID:4436
- C:\Windows\System\UuuzQRk.exe
  C:\Windows\System\UuuzQRk.exe
  2⤵
  PID:4460
- C:\Windows\System\pvqKMcz.exe
  C:\Windows\System\pvqKMcz.exe
  2⤵
  PID:4480
- C:\Windows\System\emXEKtO.exe
  C:\Windows\System\emXEKtO.exe
  2⤵
  PID:4496
- C:\Windows\System\GlRKXbJ.exe
  C:\Windows\System\GlRKXbJ.exe
  2⤵
  PID:4512
- C:\Windows\System\xfCtONy.exe
  C:\Windows\System\xfCtONy.exe
  2⤵
  PID:4528
- C:\Windows\System\QhAtujJ.exe
  C:\Windows\System\QhAtujJ.exe
  2⤵
  PID:4548
- C:\Windows\System\mBXHCBG.exe
  C:\Windows\System\mBXHCBG.exe
  2⤵
  PID:4564
- C:\Windows\System\ZLvdVMk.exe
  C:\Windows\System\ZLvdVMk.exe
  2⤵
  PID:4580
- C:\Windows\System\QVudbDh.exe
  C:\Windows\System\QVudbDh.exe
  2⤵
  PID:4596
- C:\Windows\System\NyLlePl.exe
  C:\Windows\System\NyLlePl.exe
  2⤵
  PID:4612
- C:\Windows\System\hucFBhS.exe
  C:\Windows\System\hucFBhS.exe
  2⤵
  PID:4628
- C:\Windows\System\iPkrXgc.exe
  C:\Windows\System\iPkrXgc.exe
  2⤵
  PID:4648
- C:\Windows\System\KBGhYbo.exe
  C:\Windows\System\KBGhYbo.exe
  2⤵
  PID:4664
- C:\Windows\System\aDvadxZ.exe
  C:\Windows\System\aDvadxZ.exe
  2⤵
  PID:4680
- C:\Windows\System\JluZwYM.exe
  C:\Windows\System\JluZwYM.exe
  2⤵
  PID:4696
- C:\Windows\System\kyYDKRn.exe
  C:\Windows\System\kyYDKRn.exe
  2⤵
  PID:4712
- C:\Windows\System\jNynLgE.exe
  C:\Windows\System\jNynLgE.exe
  2⤵
  PID:4728
- C:\Windows\System\UjiPeKo.exe
  C:\Windows\System\UjiPeKo.exe
  2⤵
  PID:4744
- C:\Windows\System\pRIhNSC.exe
  C:\Windows\System\pRIhNSC.exe
  2⤵
  PID:4764
- C:\Windows\System\xCyrkmb.exe
  C:\Windows\System\xCyrkmb.exe
  2⤵
  PID:4780
- C:\Windows\System\AnbjioC.exe
  C:\Windows\System\AnbjioC.exe
  2⤵
  PID:4796
- C:\Windows\System\PnMvzyW.exe
  C:\Windows\System\PnMvzyW.exe
  2⤵
  PID:4812
- C:\Windows\System\YKEwLLE.exe
  C:\Windows\System\YKEwLLE.exe
  2⤵
  PID:4828
- C:\Windows\System\ianaJxQ.exe
  C:\Windows\System\ianaJxQ.exe
  2⤵
  PID:4844
- C:\Windows\System\CgooGWY.exe
  C:\Windows\System\CgooGWY.exe
  2⤵
  PID:4860
- C:\Windows\System\cYKKlUD.exe
  C:\Windows\System\cYKKlUD.exe
  2⤵
  PID:4880
- C:\Windows\System\RFkESwQ.exe
  C:\Windows\System\RFkESwQ.exe
  2⤵
  PID:4896
- C:\Windows\System\sSLxcqO.exe
  C:\Windows\System\sSLxcqO.exe
  2⤵
  PID:4912
- C:\Windows\System\EdhzTZK.exe
  C:\Windows\System\EdhzTZK.exe
  2⤵
  PID:4928
- C:\Windows\System\VkUbGxl.exe
  C:\Windows\System\VkUbGxl.exe
  2⤵
  PID:4944
- C:\Windows\System\aIltASb.exe
  C:\Windows\System\aIltASb.exe
  2⤵
  PID:4960
- C:\Windows\System\SsnDOrw.exe
  C:\Windows\System\SsnDOrw.exe
  2⤵
  PID:4976
- C:\Windows\System\tWZoLbU.exe
  C:\Windows\System\tWZoLbU.exe
  2⤵
  PID:4996
- C:\Windows\System\tYzioWh.exe
  C:\Windows\System\tYzioWh.exe
  2⤵
  PID:5012
- C:\Windows\System\zjJkuxy.exe
  C:\Windows\System\zjJkuxy.exe
  2⤵
  PID:5028
- C:\Windows\System\EexlHjB.exe
  C:\Windows\System\EexlHjB.exe
  2⤵
  PID:5044
- C:\Windows\System\WAdFztR.exe
  C:\Windows\System\WAdFztR.exe
  2⤵
  PID:5060
- C:\Windows\System\jwaMBMA.exe
  C:\Windows\System\jwaMBMA.exe
  2⤵
  PID:5076
- C:\Windows\System\RAWMzJo.exe
  C:\Windows\System\RAWMzJo.exe
  2⤵
  PID:5092
- C:\Windows\System\oqtkZim.exe
  C:\Windows\System\oqtkZim.exe
  2⤵
  PID:5112
- C:\Windows\System\IsgtzCz.exe
  C:\Windows\System\IsgtzCz.exe
  2⤵
  PID:3756
- C:\Windows\System\aLhfmgF.exe
  C:\Windows\System\aLhfmgF.exe
  2⤵
  PID:3868
- C:\Windows\System\agFPXUO.exe
  C:\Windows\System\agFPXUO.exe
  2⤵
  PID:3964
- C:\Windows\System\egFKKqJ.exe
  C:\Windows\System\egFKKqJ.exe
  2⤵
  PID:4008
- C:\Windows\System\WzIFZMf.exe
  C:\Windows\System\WzIFZMf.exe
  2⤵
  PID:2636
- C:\Windows\System\WeMSSMe.exe
  C:\Windows\System\WeMSSMe.exe
  2⤵
  PID:1784
- C:\Windows\System\frnfeof.exe
  C:\Windows\System\frnfeof.exe
  2⤵
  PID:5136
- C:\Windows\System\SDevSBi.exe
  C:\Windows\System\SDevSBi.exe
  2⤵
  PID:5152
- C:\Windows\System\sBnurBQ.exe
  C:\Windows\System\sBnurBQ.exe
  2⤵
  PID:5168
- C:\Windows\System\zYxpdLa.exe
  C:\Windows\System\zYxpdLa.exe
  2⤵
  PID:5184
- C:\Windows\System\QvSDims.exe
  C:\Windows\System\QvSDims.exe
  2⤵
  PID:5204
- C:\Windows\System\RzKMDtm.exe
  C:\Windows\System\RzKMDtm.exe
  2⤵
  PID:5220
- C:\Windows\System\wnRjHOB.exe
  C:\Windows\System\wnRjHOB.exe
  2⤵
  PID:5236
- C:\Windows\System\mgSEZyc.exe
  C:\Windows\System\mgSEZyc.exe
  2⤵
  PID:5252
- C:\Windows\System\KsgSLti.exe
  C:\Windows\System\KsgSLti.exe
  2⤵
  PID:5272
- C:\Windows\System\dboGxyT.exe
  C:\Windows\System\dboGxyT.exe
  2⤵
  PID:5288
- C:\Windows\System\FjKnadF.exe
  C:\Windows\System\FjKnadF.exe
  2⤵
  PID:5304
- C:\Windows\System\aJVqTxu.exe
  C:\Windows\System\aJVqTxu.exe
  2⤵
  PID:5324
- C:\Windows\System\sjHgXnA.exe
  C:\Windows\System\sjHgXnA.exe
  2⤵
  PID:5340
- C:\Windows\System\LjpmgSP.exe
  C:\Windows\System\LjpmgSP.exe
  2⤵
  PID:5356
- C:\Windows\System\IUyOoKi.exe
  C:\Windows\System\IUyOoKi.exe
  2⤵
  PID:5372
- C:\Windows\System\oUrzvoq.exe
  C:\Windows\System\oUrzvoq.exe
  2⤵
  PID:5388
- C:\Windows\System\rlqGldc.exe
  C:\Windows\System\rlqGldc.exe
  2⤵
  PID:5404
- C:\Windows\System\bpXlFHE.exe
  C:\Windows\System\bpXlFHE.exe
  2⤵
  PID:5420
- C:\Windows\System\EJpucYU.exe
  C:\Windows\System\EJpucYU.exe
  2⤵
  PID:5436
- C:\Windows\System\XrVDqkN.exe
  C:\Windows\System\XrVDqkN.exe
  2⤵
  PID:5456
- C:\Windows\System\uWeTjsu.exe
  C:\Windows\System\uWeTjsu.exe
  2⤵
  PID:5472
- C:\Windows\System\zLskgJN.exe
  C:\Windows\System\zLskgJN.exe
  2⤵
  PID:5488
- C:\Windows\System\KsbSsPG.exe
  C:\Windows\System\KsbSsPG.exe
  2⤵
  PID:5504
- C:\Windows\System\GpeIHaF.exe
  C:\Windows\System\GpeIHaF.exe
  2⤵
  PID:5520
- C:\Windows\System\lnDXxKY.exe
  C:\Windows\System\lnDXxKY.exe
  2⤵
  PID:5536
- C:\Windows\System\RFgzvUZ.exe
  C:\Windows\System\RFgzvUZ.exe
  2⤵
  PID:5552
- C:\Windows\System\rsQwyFP.exe
  C:\Windows\System\rsQwyFP.exe
  2⤵
  PID:5572
- C:\Windows\System\lmyOxmP.exe
  C:\Windows\System\lmyOxmP.exe
  2⤵
  PID:5588
- C:\Windows\System\udJzOKt.exe
  C:\Windows\System\udJzOKt.exe
  2⤵
  PID:5604
- C:\Windows\System\ATkEdgQ.exe
  C:\Windows\System\ATkEdgQ.exe
  2⤵
  PID:5620
- C:\Windows\System\LVBrnHp.exe
  C:\Windows\System\LVBrnHp.exe
  2⤵
  PID:5636
- C:\Windows\System\WsFLUln.exe
  C:\Windows\System\WsFLUln.exe
  2⤵
  PID:5656
- C:\Windows\System\RToqdsC.exe
  C:\Windows\System\RToqdsC.exe
  2⤵
  PID:5672
- C:\Windows\System\MxgtKgF.exe
  C:\Windows\System\MxgtKgF.exe
  2⤵
  PID:5688
- C:\Windows\System\piHaOCf.exe
  C:\Windows\System\piHaOCf.exe
  2⤵
  PID:5704
- C:\Windows\System\WGQqADk.exe
  C:\Windows\System\WGQqADk.exe
  2⤵
  PID:5724
- C:\Windows\System\hBGuiXd.exe
  C:\Windows\System\hBGuiXd.exe
  2⤵
  PID:5740
- C:\Windows\System\VKUZtQu.exe
  C:\Windows\System\VKUZtQu.exe
  2⤵
  PID:5756
- C:\Windows\System\RtwrtBa.exe
  C:\Windows\System\RtwrtBa.exe
  2⤵
  PID:5772
- C:\Windows\System\qeNrNLu.exe
  C:\Windows\System\qeNrNLu.exe
  2⤵
  PID:5792
- C:\Windows\System\XDEJTSj.exe
  C:\Windows\System\XDEJTSj.exe
  2⤵
  PID:5808
- C:\Windows\System\yQzjMwt.exe
  C:\Windows\System\yQzjMwt.exe
  2⤵
  PID:5824
- C:\Windows\System\YFssGQx.exe
  C:\Windows\System\YFssGQx.exe
  2⤵
  PID:5840
- C:\Windows\System\sogJWiF.exe
  C:\Windows\System\sogJWiF.exe
  2⤵
  PID:5856
- C:\Windows\System\YsPALLm.exe
  C:\Windows\System\YsPALLm.exe
  2⤵
  PID:5872
- C:\Windows\System\UrxliQF.exe
  C:\Windows\System\UrxliQF.exe
  2⤵
  PID:5888
- C:\Windows\System\OGYpkEE.exe
  C:\Windows\System\OGYpkEE.exe
  2⤵
  PID:5908
- C:\Windows\System\OZvGfnd.exe
  C:\Windows\System\OZvGfnd.exe
  2⤵
  PID:5924
- C:\Windows\System\xIJeVzg.exe
  C:\Windows\System\xIJeVzg.exe
  2⤵
  PID:5940
- C:\Windows\System\WNBDuQV.exe
  C:\Windows\System\WNBDuQV.exe
  2⤵
  PID:5956
- C:\Windows\System\gJlfTjW.exe
  C:\Windows\System\gJlfTjW.exe
  2⤵
  PID:5972
- C:\Windows\System\UQdEPvW.exe
  C:\Windows\System\UQdEPvW.exe
  2⤵
  PID:5988
- C:\Windows\System\JyYShfu.exe
  C:\Windows\System\JyYShfu.exe
  2⤵
  PID:6124
- C:\Windows\System\GSgwtcN.exe
  C:\Windows\System\GSgwtcN.exe
  2⤵
  PID:4284
- C:\Windows\System\dIDBYnn.exe
  C:\Windows\System\dIDBYnn.exe
  2⤵
  PID:4380
- C:\Windows\System\pQhzeQG.exe
  C:\Windows\System\pQhzeQG.exe
  2⤵
  PID:4824
- C:\Windows\System\mpIsurp.exe
  C:\Windows\System\mpIsurp.exe
  2⤵
  PID:5232
- C:\Windows\System\OOSCuON.exe
  C:\Windows\System\OOSCuON.exe
  2⤵
  PID:5864
- C:\Windows\System\kpJfVKU.exe
  C:\Windows\System\kpJfVKU.exe
  2⤵
  PID:3564
- C:\Windows\System\LlsCBXQ.exe
  C:\Windows\System\LlsCBXQ.exe
  2⤵
  PID:6004
- C:\Windows\System\CckWBbE.exe
  C:\Windows\System\CckWBbE.exe
  2⤵
  PID:5384
- C:\Windows\System\HEzftKz.exe
  C:\Windows\System\HEzftKz.exe
  2⤵
  PID:5548
- C:\Windows\System\AfOcFcn.exe
  C:\Windows\System\AfOcFcn.exe
  2⤵
  PID:5648
- C:\Windows\System\KYahyPl.exe
  C:\Windows\System\KYahyPl.exe
  2⤵
  PID:5848
- C:\Windows\System\LaIdNGF.exe
  C:\Windows\System\LaIdNGF.exe
  2⤵
  PID:5984
- C:\Windows\System\eKEGiSU.exe
  C:\Windows\System\eKEGiSU.exe
  2⤵
  PID:3512
- C:\Windows\System\mVtRCst.exe
  C:\Windows\System\mVtRCst.exe
  2⤵
  PID:3784
- C:\Windows\System\NnRhoGe.exe
  C:\Windows\System\NnRhoGe.exe
  2⤵
  PID:3864
- C:\Windows\System\yiMoOTh.exe
  C:\Windows\System\yiMoOTh.exe
  2⤵
  PID:4028
- C:\Windows\System\WxfEdCd.exe
  C:\Windows\System\WxfEdCd.exe
  2⤵
  PID:2320
- C:\Windows\System\HISqozj.exe
  C:\Windows\System\HISqozj.exe
  2⤵
  PID:3288
- C:\Windows\System\IjMwzLS.exe
  C:\Windows\System\IjMwzLS.exe
  2⤵
  PID:3432
- C:\Windows\System\rkiPXkP.exe
  C:\Windows\System\rkiPXkP.exe
  2⤵
  PID:4164
- C:\Windows\System\KowSzAe.exe
  C:\Windows\System\KowSzAe.exe
  2⤵
  PID:4228
- C:\Windows\System\AOGdPph.exe
  C:\Windows\System\AOGdPph.exe
  2⤵
  PID:4300
- C:\Windows\System\DkLkynx.exe
  C:\Windows\System\DkLkynx.exe
  2⤵
  PID:4336
- C:\Windows\System\bSAUlDR.exe
  C:\Windows\System\bSAUlDR.exe
  2⤵
  PID:4472
- C:\Windows\System\HjhWeJr.exe
  C:\Windows\System\HjhWeJr.exe
  2⤵
  PID:4540
- C:\Windows\System\CmcFenz.exe
  C:\Windows\System\CmcFenz.exe
  2⤵
  PID:4636
- C:\Windows\System\GzdcRdm.exe
  C:\Windows\System\GzdcRdm.exe
  2⤵
  PID:4676
- C:\Windows\System\HCNsksC.exe
  C:\Windows\System\HCNsksC.exe
  2⤵
  PID:4836
- C:\Windows\System\qXnxRCA.exe
  C:\Windows\System\qXnxRCA.exe
  2⤵
  PID:4904
- C:\Windows\System\KUaywcO.exe
  C:\Windows\System\KUaywcO.exe
  2⤵
  PID:4972
- C:\Windows\System\GjqmvDZ.exe
  C:\Windows\System\GjqmvDZ.exe
  2⤵
  PID:5212
- C:\Windows\System\SXeltFA.exe
  C:\Windows\System\SXeltFA.exe
  2⤵
  PID:5072
- C:\Windows\System\pkKGAUG.exe
  C:\Windows\System\pkKGAUG.exe
  2⤵
  PID:3848
- C:\Windows\System\WzQuAIu.exe
  C:\Windows\System\WzQuAIu.exe
  2⤵
  PID:5144
- C:\Windows\System\KcmDgvN.exe
  C:\Windows\System\KcmDgvN.exe
  2⤵
  PID:5216
- C:\Windows\System\AIuiJBw.exe
  C:\Windows\System\AIuiJBw.exe
  2⤵
  PID:5448
- C:\Windows\System\fMdQfzF.exe
  C:\Windows\System\fMdQfzF.exe
  2⤵
  PID:5684
- C:\Windows\System\giEAmHB.exe
  C:\Windows\System\giEAmHB.exe
  2⤵
  PID:6044
- C:\Windows\System\JzJcTpQ.exe
  C:\Windows\System\JzJcTpQ.exe
  2⤵
  PID:6064
- C:\Windows\System\yiPbpyT.exe
  C:\Windows\System\yiPbpyT.exe
  2⤵
  PID:5748
- C:\Windows\System\IqExoYJ.exe
  C:\Windows\System\IqExoYJ.exe
  2⤵
  PID:6072
- C:\Windows\System\cOBkgxF.exe
  C:\Windows\System\cOBkgxF.exe
  2⤵
  PID:5952
- C:\Windows\System\nQeQSWr.exe
  C:\Windows\System\nQeQSWr.exe
  2⤵
  PID:6084
- C:\Windows\System\aQoeuys.exe
  C:\Windows\System\aQoeuys.exe
  2⤵
  PID:5852
- C:\Windows\System\QwrFvrW.exe
  C:\Windows\System\QwrFvrW.exe
  2⤵
  PID:6112
- C:\Windows\System\mimAhqa.exe
  C:\Windows\System\mimAhqa.exe
  2⤵
  PID:6120
- C:\Windows\System\LNiiIQT.exe
  C:\Windows\System\LNiiIQT.exe
  2⤵
  PID:3652
- C:\Windows\System\ZyZaRUP.exe
  C:\Windows\System\ZyZaRUP.exe
  2⤵
  PID:1664
- C:\Windows\System\OlUblbG.exe
  C:\Windows\System\OlUblbG.exe
  2⤵
  PID:4120
- C:\Windows\System\WUERdYh.exe
  C:\Windows\System\WUERdYh.exe
  2⤵
  PID:4316
- C:\Windows\System\PEZfbVz.exe
  C:\Windows\System\PEZfbVz.exe
  2⤵
  PID:4444
- C:\Windows\System\zTetMeq.exe
  C:\Windows\System\zTetMeq.exe
  2⤵
  PID:4452
- C:\Windows\System\oTLKdeN.exe
  C:\Windows\System\oTLKdeN.exe
  2⤵
  PID:4492
- C:\Windows\System\Exrbxnm.exe
  C:\Windows\System\Exrbxnm.exe
  2⤵
  PID:4588
- C:\Windows\System\jluWMMC.exe
  C:\Windows\System\jluWMMC.exe
  2⤵
  PID:4656
- C:\Windows\System\jDrFZBa.exe
  C:\Windows\System\jDrFZBa.exe
  2⤵
  PID:4792
- C:\Windows\System\nzepjcv.exe
  C:\Windows\System\nzepjcv.exe
  2⤵
  PID:4752
- C:\Windows\System\EoYNiek.exe
  C:\Windows\System\EoYNiek.exe
  2⤵
  PID:4856
- C:\Windows\System\QdABLSZ.exe
  C:\Windows\System\QdABLSZ.exe
  2⤵
  PID:4820
- C:\Windows\System\CasWmEy.exe
  C:\Windows\System\CasWmEy.exe
  2⤵
  PID:5024
- C:\Windows\System\xIPwntd.exe
  C:\Windows\System\xIPwntd.exe
  2⤵
  PID:5088
- C:\Windows\System\xkUjbgW.exe
  C:\Windows\System\xkUjbgW.exe
  2⤵
  PID:3952
- C:\Windows\System\GZjwUQd.exe
  C:\Windows\System\GZjwUQd.exe
  2⤵
  PID:5228
- C:\Windows\System\zxMXSIK.exe
  C:\Windows\System\zxMXSIK.exe
  2⤵
  PID:5200
- C:\Windows\System\dlFgPdO.exe
  C:\Windows\System\dlFgPdO.exe
  2⤵
  PID:5336
- C:\Windows\System\DGgwrIn.exe
  C:\Windows\System\DGgwrIn.exe
  2⤵
  PID:5468
- C:\Windows\System\oSOWflo.exe
  C:\Windows\System\oSOWflo.exe
  2⤵
  PID:5696
- C:\Windows\System\wecHBdj.exe
  C:\Windows\System\wecHBdj.exe
  2⤵
  PID:4448
- C:\Windows\System\KzrdVQO.exe
  C:\Windows\System\KzrdVQO.exe
  2⤵
  PID:5932
- C:\Windows\System\SAFxOkD.exe
  C:\Windows\System\SAFxOkD.exe
  2⤵
  PID:5768
- C:\Windows\System\FIrcpVP.exe
  C:\Windows\System\FIrcpVP.exe
  2⤵
  PID:5996
- C:\Windows\System\WEEDNMi.exe
  C:\Windows\System\WEEDNMi.exe
  2⤵
  PID:3404
- C:\Windows\System\KnAwbzq.exe
  C:\Windows\System\KnAwbzq.exe
  2⤵
  PID:5528
- C:\Windows\System\RxUajUf.exe
  C:\Windows\System\RxUajUf.exe
  2⤵
  PID:5632
- C:\Windows\System\sGaIrmY.exe
  C:\Windows\System\sGaIrmY.exe
  2⤵
  PID:6000
- C:\Windows\System\dpzUAGg.exe
  C:\Windows\System\dpzUAGg.exe
  2⤵
  PID:5452
- C:\Windows\System\qGyLlXw.exe
  C:\Windows\System\qGyLlXw.exe
  2⤵
  PID:5512
- C:\Windows\System\xcmjJoi.exe
  C:\Windows\System\xcmjJoi.exe
  2⤵
  PID:5516
- C:\Windows\System\egOuYVo.exe
  C:\Windows\System\egOuYVo.exe
  2⤵
  PID:3672
- C:\Windows\System\fmcLsjY.exe
  C:\Windows\System\fmcLsjY.exe
  2⤵
  PID:5816
- C:\Windows\System\Yhbsrrh.exe
  C:\Windows\System\Yhbsrrh.exe
  2⤵
  PID:3624
- C:\Windows\System\pNXfLmb.exe
  C:\Windows\System\pNXfLmb.exe
  2⤵
  PID:3928
- C:\Windows\System\LgmUtBJ.exe
  C:\Windows\System\LgmUtBJ.exe
  2⤵
  PID:3120
- C:\Windows\System\mAxsIwZ.exe
  C:\Windows\System\mAxsIwZ.exe
  2⤵
  PID:3164
- C:\Windows\System\CZUQCSj.exe
  C:\Windows\System\CZUQCSj.exe
  2⤵
  PID:1772
- C:\Windows\System\RDQXsff.exe
  C:\Windows\System\RDQXsff.exe
  2⤵
  PID:4264
- C:\Windows\System\BUdsnoE.exe
  C:\Windows\System\BUdsnoE.exe
  2⤵
  PID:4296
- C:\Windows\System\KbKqYfp.exe
  C:\Windows\System\KbKqYfp.exe
  2⤵
  PID:4432
- C:\Windows\System\EbIiHBA.exe
  C:\Windows\System\EbIiHBA.exe
  2⤵
  PID:4536
- C:\Windows\System\ssmmFmj.exe
  C:\Windows\System\ssmmFmj.exe
  2⤵
  PID:4604
- C:\Windows\System\FsiJHaz.exe
  C:\Windows\System\FsiJHaz.exe
  2⤵
  PID:4708
- C:\Windows\System\crvzjIA.exe
  C:\Windows\System\crvzjIA.exe
  2⤵
  PID:4872
- C:\Windows\System\pOnAzUH.exe
  C:\Windows\System\pOnAzUH.exe
  2⤵
  PID:4936
- C:\Windows\System\aaTBciP.exe
  C:\Windows\System\aaTBciP.exe
  2⤵
  PID:5068
- C:\Windows\System\AReHMin.exe
  C:\Windows\System\AReHMin.exe
  2⤵
  PID:5284
- C:\Windows\System\RZqolms.exe
  C:\Windows\System\RZqolms.exe
  2⤵
  PID:6012
- C:\Windows\System\pMPcMob.exe
  C:\Windows\System\pMPcMob.exe
  2⤵
  PID:5108
- C:\Windows\System\fHnQJNb.exe
  C:\Windows\System\fHnQJNb.exe
  2⤵
  PID:5380
- C:\Windows\System\AililUu.exe
  C:\Windows\System\AililUu.exe
  2⤵
  PID:6048
- C:\Windows\System\eEHSEYc.exe
  C:\Windows\System\eEHSEYc.exe
  2⤵
  PID:6068
- C:\Windows\System\isOupVI.exe
  C:\Windows\System\isOupVI.exe
  2⤵
  PID:5580
- C:\Windows\System\CDjcgfj.exe
  C:\Windows\System\CDjcgfj.exe
  2⤵
  PID:6104
- C:\Windows\System\YBcRqfQ.exe
  C:\Windows\System\YBcRqfQ.exe
  2⤵
  PID:4216
- C:\Windows\System\eDJRdVw.exe
  C:\Windows\System\eDJRdVw.exe
  2⤵
  PID:5244
- C:\Windows\System\eFSTKNK.exe
  C:\Windows\System\eFSTKNK.exe
  2⤵
  PID:4892
- C:\Windows\System\ZwOfeeI.exe
  C:\Windows\System\ZwOfeeI.exe
  2⤵
  PID:3504
- C:\Windows\System\GTaJkQm.exe
  C:\Windows\System\GTaJkQm.exe
  2⤵
  PID:3876
- C:\Windows\System\hEWjvow.exe
  C:\Windows\System\hEWjvow.exe
  2⤵
  PID:4400
- C:\Windows\System\UgoTrtN.exe
  C:\Windows\System\UgoTrtN.exe
  2⤵
  PID:4136
- C:\Windows\System\YZEvIvK.exe
  C:\Windows\System\YZEvIvK.exe
  2⤵
  PID:6100
- C:\Windows\System\kqxxdQw.exe
  C:\Windows\System\kqxxdQw.exe
  2⤵
  PID:5176
- C:\Windows\System\kAIwlvr.exe
  C:\Windows\System\kAIwlvr.exe
  2⤵
  PID:5036
- C:\Windows\System\tPYxhPb.exe
  C:\Windows\System\tPYxhPb.exe
  2⤵
  PID:4560
- C:\Windows\System\OoSVTDe.exe
  C:\Windows\System\OoSVTDe.exe
  2⤵
  PID:6080
- C:\Windows\System\dpbfNTI.exe
  C:\Windows\System\dpbfNTI.exe
  2⤵
  PID:5124
- C:\Windows\System\tuLWDiq.exe
  C:\Windows\System\tuLWDiq.exe
  2⤵
  PID:2576
- C:\Windows\System\LvAPLPv.exe
  C:\Windows\System\LvAPLPv.exe
  2⤵
  PID:4348
- C:\Windows\System\qABnoQM.exe
  C:\Windows\System\qABnoQM.exe
  2⤵
  PID:4488
- C:\Windows\System\LXVSrpS.exe
  C:\Windows\System\LXVSrpS.exe
  2⤵
  PID:4724
- C:\Windows\System\ucjZFCa.exe
  C:\Windows\System\ucjZFCa.exe
  2⤵
  PID:5192
- C:\Windows\System\vaGuURy.exe
  C:\Windows\System\vaGuURy.exe
  2⤵
  PID:5900
- C:\Windows\System\mbhIeTf.exe
  C:\Windows\System\mbhIeTf.exe
  2⤵
  PID:2452
- C:\Windows\System\wwcMneq.exe
  C:\Windows\System\wwcMneq.exe
  2⤵
  PID:5628
- C:\Windows\System\YMtjWrk.exe
  C:\Windows\System\YMtjWrk.exe
  2⤵
  PID:5652
- C:\Windows\System\rrRYddD.exe
  C:\Windows\System\rrRYddD.exe
  2⤵
  PID:3984
- C:\Windows\System\vpamiKG.exe
  C:\Windows\System\vpamiKG.exe
  2⤵
  PID:2728
- C:\Windows\System\HzSrnQv.exe
  C:\Windows\System\HzSrnQv.exe
  2⤵
  PID:5600
- C:\Windows\System\sWRFFUP.exe
  C:\Windows\System\sWRFFUP.exe
  2⤵
  PID:5300
- C:\Windows\System\NnhsBYU.exe
  C:\Windows\System\NnhsBYU.exe
  2⤵
  PID:5948
- C:\Windows\System\VgbpPPG.exe
  C:\Windows\System\VgbpPPG.exe
  2⤵
  PID:5348
- C:\Windows\System\coGFHzX.exe
  C:\Windows\System\coGFHzX.exe
  2⤵
  PID:5780
- C:\Windows\System\IaPrsWd.exe
  C:\Windows\System\IaPrsWd.exe
  2⤵
  PID:4412
- C:\Windows\System\zOdbqym.exe
  C:\Windows\System\zOdbqym.exe
  2⤵
  PID:5904
- C:\Windows\System\BLXjmWa.exe
  C:\Windows\System\BLXjmWa.exe
  2⤵
  PID:3248
- C:\Windows\System\uhfYDrM.exe
  C:\Windows\System\uhfYDrM.exe
  2⤵
  PID:4168
- C:\Windows\System\BqFquNi.exe
  C:\Windows\System\BqFquNi.exe
  2⤵
  PID:4556
- C:\Windows\System\KxjlxdZ.exe
  C:\Windows\System\KxjlxdZ.exe
  2⤵
  PID:4112
- C:\Windows\System\iPHemXg.exe
  C:\Windows\System\iPHemXg.exe
  2⤵
  PID:5532
- C:\Windows\System\AjJrOPo.exe
  C:\Windows\System\AjJrOPo.exe
  2⤵
  PID:4332
- C:\Windows\System\huFzPTH.exe
  C:\Windows\System\huFzPTH.exe
  2⤵
  PID:4736
- C:\Windows\System\ertKRqL.exe
  C:\Windows\System\ertKRqL.exe
  2⤵
  PID:4644
- C:\Windows\System\qLJSPWZ.exe
  C:\Windows\System\qLJSPWZ.exe
  2⤵
  PID:6008
- C:\Windows\System\udbqeLd.exe
  C:\Windows\System\udbqeLd.exe
  2⤵
  PID:5316
- C:\Windows\System\cvXIrOR.exe
  C:\Windows\System\cvXIrOR.exe
  2⤵
  PID:1996
- C:\Windows\System\cFaEVWa.exe
  C:\Windows\System\cFaEVWa.exe
  2⤵
  PID:1856
- C:\Windows\System\PQBnARm.exe
  C:\Windows\System\PQBnARm.exe
  2⤵
  PID:5500
- C:\Windows\System\shVcGoU.exe
  C:\Windows\System\shVcGoU.exe
  2⤵
  PID:4004
- C:\Windows\System\HHYVPtH.exe
  C:\Windows\System\HHYVPtH.exe
  2⤵
  PID:4352
- C:\Windows\System\KQFcrSO.exe
  C:\Windows\System\KQFcrSO.exe
  2⤵
  PID:5712
- C:\Windows\System\EUBpgmZ.exe
  C:\Windows\System\EUBpgmZ.exe
  2⤵
  PID:1400
- C:\Windows\System\NEIfhtk.exe
  C:\Windows\System\NEIfhtk.exe
  2⤵
  PID:5664
- C:\Windows\System\wEhjkpc.exe
  C:\Windows\System\wEhjkpc.exe
  2⤵
  PID:3012
- C:\Windows\System\vOBvHCi.exe
  C:\Windows\System\vOBvHCi.exe
  2⤵
  PID:5196
- C:\Windows\System\egduRZt.exe
  C:\Windows\System\egduRZt.exe
  2⤵
  PID:6036
- C:\Windows\System\KlBiVFc.exe
  C:\Windows\System\KlBiVFc.exe
  2⤵
  PID:5020
- C:\Windows\System\fesyBFP.exe
  C:\Windows\System\fesyBFP.exe
  2⤵
  PID:6088
- C:\Windows\System\keAAyuN.exe
  C:\Windows\System\keAAyuN.exe
  2⤵
  PID:4100
- C:\Windows\System\nQmZXFC.exe
  C:\Windows\System\nQmZXFC.exe
  2⤵
  PID:5764
- C:\Windows\System\JDcuIbV.exe
  C:\Windows\System\JDcuIbV.exe
  2⤵
  PID:5884
- C:\Windows\System\UEnqyyf.exe
  C:\Windows\System\UEnqyyf.exe
  2⤵
  PID:4808
- C:\Windows\System\SsWKTdZ.exe
  C:\Windows\System\SsWKTdZ.exe
  2⤵
  PID:2520
- C:\Windows\System\aBqToQA.exe
  C:\Windows\System\aBqToQA.exe
  2⤵
  PID:3824
- C:\Windows\System\wYvFlLU.exe
  C:\Windows\System\wYvFlLU.exe
  2⤵
  PID:3132
- C:\Windows\System\FITSaVU.exe
  C:\Windows\System\FITSaVU.exe
  2⤵
  PID:5312
- C:\Windows\System\shpvsjl.exe
  C:\Windows\System\shpvsjl.exe
  2⤵
  PID:5412
- C:\Windows\System\OwgYTgy.exe
  C:\Windows\System\OwgYTgy.exe
  2⤵
  PID:6148
- C:\Windows\System\WIsgzgn.exe
  C:\Windows\System\WIsgzgn.exe
  2⤵
  PID:6168
- C:\Windows\System\NSMVXID.exe
  C:\Windows\System\NSMVXID.exe
  2⤵
  PID:6184
- C:\Windows\System\tLvokkI.exe
  C:\Windows\System\tLvokkI.exe
  2⤵
  PID:6200
- C:\Windows\System\urTkuTd.exe
  C:\Windows\System\urTkuTd.exe
  2⤵
  PID:6216
- C:\Windows\System\yusGxbr.exe
  C:\Windows\System\yusGxbr.exe
  2⤵
  PID:6232
- C:\Windows\System\NXrsTsU.exe
  C:\Windows\System\NXrsTsU.exe
  2⤵
  PID:6248
- C:\Windows\System\fuJvnaY.exe
  C:\Windows\System\fuJvnaY.exe
  2⤵
  PID:6264
- C:\Windows\System\vHsiONS.exe
  C:\Windows\System\vHsiONS.exe
  2⤵
  PID:6280
- C:\Windows\System\RYwugfA.exe
  C:\Windows\System\RYwugfA.exe
  2⤵
  PID:6296
- C:\Windows\System\rARRHqe.exe
  C:\Windows\System\rARRHqe.exe
  2⤵
  PID:6312
- C:\Windows\System\actHstg.exe
  C:\Windows\System\actHstg.exe
  2⤵
  PID:6328
- C:\Windows\System\FWsIKGa.exe
  C:\Windows\System\FWsIKGa.exe
  2⤵
  PID:6344
- C:\Windows\System\thgDGbd.exe
  C:\Windows\System\thgDGbd.exe
  2⤵
  PID:6360
- C:\Windows\System\QtDLXQj.exe
  C:\Windows\System\QtDLXQj.exe
  2⤵
  PID:6376
- C:\Windows\System\hQZbLzY.exe
  C:\Windows\System\hQZbLzY.exe
  2⤵
  PID:6396
- C:\Windows\System\mKxDuFK.exe
  C:\Windows\System\mKxDuFK.exe
  2⤵
  PID:6412
- C:\Windows\System\FfgzRok.exe
  C:\Windows\System\FfgzRok.exe
  2⤵
  PID:6432
- C:\Windows\System\AiYOayA.exe
  C:\Windows\System\AiYOayA.exe
  2⤵
  PID:6448
- C:\Windows\System\RZMiBrC.exe
  C:\Windows\System\RZMiBrC.exe
  2⤵
  PID:6464
- C:\Windows\System\kTzkjAR.exe
  C:\Windows\System\kTzkjAR.exe
  2⤵
  PID:6480
- C:\Windows\System\WybnekU.exe
  C:\Windows\System\WybnekU.exe
  2⤵
  PID:6496
- C:\Windows\System\Qdlkbfr.exe
  C:\Windows\System\Qdlkbfr.exe
  2⤵
  PID:6512
- C:\Windows\System\qgsKWAo.exe
  C:\Windows\System\qgsKWAo.exe
  2⤵
  PID:6528
- C:\Windows\System\nayWFBr.exe
  C:\Windows\System\nayWFBr.exe
  2⤵
  PID:6544
- C:\Windows\System\lOCLfXw.exe
  C:\Windows\System\lOCLfXw.exe
  2⤵
  PID:6560
- C:\Windows\System\NYaKpHE.exe
  C:\Windows\System\NYaKpHE.exe
  2⤵
  PID:6580
- C:\Windows\System\HEfkyrW.exe
  C:\Windows\System\HEfkyrW.exe
  2⤵
  PID:6596
- C:\Windows\System\XgWIByg.exe
  C:\Windows\System\XgWIByg.exe
  2⤵
  PID:6616
- C:\Windows\System\ihNInXH.exe
  C:\Windows\System\ihNInXH.exe
  2⤵
  PID:6652
- C:\Windows\System\WFhDDvQ.exe
  C:\Windows\System\WFhDDvQ.exe
  2⤵
  PID:6720
- C:\Windows\System\HdQzMXA.exe
  C:\Windows\System\HdQzMXA.exe
  2⤵
  PID:6736
- C:\Windows\System\qBkVbqF.exe
  C:\Windows\System\qBkVbqF.exe
  2⤵
  PID:6756
- C:\Windows\System\ircWTXk.exe
  C:\Windows\System\ircWTXk.exe
  2⤵
  PID:6772
- C:\Windows\System\UeiDdVF.exe
  C:\Windows\System\UeiDdVF.exe
  2⤵
  PID:6788
- C:\Windows\System\UmxiSwV.exe
  C:\Windows\System\UmxiSwV.exe
  2⤵
  PID:6804
- C:\Windows\System\WPGovNt.exe
  C:\Windows\System\WPGovNt.exe
  2⤵
  PID:6820
- C:\Windows\System\tHWuZAx.exe
  C:\Windows\System\tHWuZAx.exe
  2⤵
  PID:6836
- C:\Windows\System\iPqtRJw.exe
  C:\Windows\System\iPqtRJw.exe
  2⤵
  PID:6852
- C:\Windows\System\ZtsrCRI.exe
  C:\Windows\System\ZtsrCRI.exe
  2⤵
  PID:6868
- C:\Windows\System\MwvBNIP.exe
  C:\Windows\System\MwvBNIP.exe
  2⤵
  PID:6884
- C:\Windows\System\roFAGvI.exe
  C:\Windows\System\roFAGvI.exe
  2⤵
  PID:6900
- C:\Windows\System\NVoTcUB.exe
  C:\Windows\System\NVoTcUB.exe
  2⤵
  PID:6916
- C:\Windows\System\KMXIiub.exe
  C:\Windows\System\KMXIiub.exe
  2⤵
  PID:6932
- C:\Windows\System\BwfQaKw.exe
  C:\Windows\System\BwfQaKw.exe
  2⤵
  PID:6948
- C:\Windows\System\HUcEzdM.exe
  C:\Windows\System\HUcEzdM.exe
  2⤵
  PID:6964
- C:\Windows\System\dMxqbcK.exe
  C:\Windows\System\dMxqbcK.exe
  2⤵
  PID:6980
- C:\Windows\System\eUXTWqI.exe
  C:\Windows\System\eUXTWqI.exe
  2⤵
  PID:6996
- C:\Windows\System\MXVTFCQ.exe
  C:\Windows\System\MXVTFCQ.exe
  2⤵
  PID:7012
- C:\Windows\System\eKEXRYo.exe
  C:\Windows\System\eKEXRYo.exe
  2⤵
  PID:7028
- C:\Windows\System\aWYGrnZ.exe
  C:\Windows\System\aWYGrnZ.exe
  2⤵
  PID:7048
- C:\Windows\System\McRnEtk.exe
  C:\Windows\System\McRnEtk.exe
  2⤵
  PID:7064
- C:\Windows\System\ftRnTfy.exe
  C:\Windows\System\ftRnTfy.exe
  2⤵
  PID:7080
- C:\Windows\System\NpXkORW.exe
  C:\Windows\System\NpXkORW.exe
  2⤵
  PID:7096
- C:\Windows\System\gMHNXbK.exe
  C:\Windows\System\gMHNXbK.exe
  2⤵
  PID:7112
- C:\Windows\System\WcuLbCF.exe
  C:\Windows\System\WcuLbCF.exe
  2⤵
  PID:7128
- C:\Windows\System\pgTBawF.exe
  C:\Windows\System\pgTBawF.exe
  2⤵
  PID:7144
- C:\Windows\System\KTyAxPZ.exe
  C:\Windows\System\KTyAxPZ.exe
  2⤵
  PID:7160
- C:\Windows\System\ncRxeZB.exe
  C:\Windows\System\ncRxeZB.exe
  2⤵
  PID:4504
- C:\Windows\System\ByQkanb.exe
  C:\Windows\System\ByQkanb.exe
  2⤵
  PID:6156
- C:\Windows\System\eflpleL.exe
  C:\Windows\System\eflpleL.exe
  2⤵
  PID:3136
- C:\Windows\System\pYjcBLa.exe
  C:\Windows\System\pYjcBLa.exe
  2⤵
  PID:6180
- C:\Windows\System\JqiylnO.exe
  C:\Windows\System\JqiylnO.exe
  2⤵
  PID:6276
- C:\Windows\System\ObTWVHR.exe
  C:\Windows\System\ObTWVHR.exe
  2⤵
  PID:6228
- C:\Windows\System\ofZENPq.exe
  C:\Windows\System\ofZENPq.exe
  2⤵
  PID:6292
- C:\Windows\System\pIZFlos.exe
  C:\Windows\System\pIZFlos.exe
  2⤵
  PID:6388
- C:\Windows\System\UanYzdt.exe
  C:\Windows\System\UanYzdt.exe
  2⤵
  PID:6428
- C:\Windows\System\OXCplcC.exe
  C:\Windows\System\OXCplcC.exe
  2⤵
  PID:6456
- C:\Windows\System\OfVSQeU.exe
  C:\Windows\System\OfVSQeU.exe
  2⤵
  PID:6372
- C:\Windows\System\wLggCLc.exe
  C:\Windows\System\wLggCLc.exe
  2⤵
  PID:6308
- C:\Windows\System\zlLcHoQ.exe
  C:\Windows\System\zlLcHoQ.exe
  2⤵
  PID:6476
- C:\Windows\System\aMPSqKB.exe
  C:\Windows\System\aMPSqKB.exe
  2⤵
  PID:6492
- C:\Windows\System\skYkgcg.exe
  C:\Windows\System\skYkgcg.exe
  2⤵
  PID:6592
- C:\Windows\System\tjVZciX.exe
  C:\Windows\System\tjVZciX.exe
  2⤵
  PID:6628
- C:\Windows\System\qNtnvHT.exe
  C:\Windows\System\qNtnvHT.exe
  2⤵
  PID:6644
- C:\Windows\System\EsKRbjt.exe
  C:\Windows\System\EsKRbjt.exe
  2⤵
  PID:4396
- C:\Windows\System\tQrYnDJ.exe
  C:\Windows\System\tQrYnDJ.exe
  2⤵
  PID:6572
- C:\Windows\System\CUEzfQM.exe
  C:\Windows\System\CUEzfQM.exe
  2⤵
  PID:6668
- C:\Windows\System\pqeMSLE.exe
  C:\Windows\System\pqeMSLE.exe
  2⤵
  PID:6684
- C:\Windows\System\Drrwcnr.exe
  C:\Windows\System\Drrwcnr.exe
  2⤵
  PID:6708
- C:\Windows\System\LvkDUkp.exe
  C:\Windows\System\LvkDUkp.exe
  2⤵
  PID:6748
- C:\Windows\System\MDobDLc.exe
  C:\Windows\System\MDobDLc.exe
  2⤵
  PID:6608
- C:\Windows\System\yxeahxc.exe
  C:\Windows\System\yxeahxc.exe
  2⤵
  PID:6812
- C:\Windows\System\gedaFmj.exe
  C:\Windows\System\gedaFmj.exe
  2⤵
  PID:6848
- C:\Windows\System\NJxbCrJ.exe
  C:\Windows\System\NJxbCrJ.exe
  2⤵
  PID:6908
- C:\Windows\System\dQoTReS.exe
  C:\Windows\System\dQoTReS.exe
  2⤵
  PID:6972
- C:\Windows\System\WxLYzAj.exe
  C:\Windows\System\WxLYzAj.exe
  2⤵
  PID:6976
- C:\Windows\System\Uacenik.exe
  C:\Windows\System\Uacenik.exe
  2⤵
  PID:6988
- C:\Windows\System\BKlmoao.exe
  C:\Windows\System\BKlmoao.exe
  2⤵
  PID:6800
- C:\Windows\System\uPOaJtH.exe
  C:\Windows\System\uPOaJtH.exe
  2⤵
  PID:6896
- C:\Windows\System\CeYpDOj.exe
  C:\Windows\System\CeYpDOj.exe
  2⤵
  PID:6992
- C:\Windows\System\zoAwrcZ.exe
  C:\Windows\System\zoAwrcZ.exe
  2⤵
  PID:7044
- C:\Windows\System\ElKBkMh.exe
  C:\Windows\System\ElKBkMh.exe
  2⤵
  PID:7108
- C:\Windows\System\upDDTLA.exe
  C:\Windows\System\upDDTLA.exe
  2⤵
  PID:2352
- C:\Windows\System\qXZHxho.exe
  C:\Windows\System\qXZHxho.exe
  2⤵
  PID:7024
- C:\Windows\System\GmfJMXi.exe
  C:\Windows\System\GmfJMXi.exe
  2⤵
  PID:6288
- C:\Windows\System\EijnaXZ.exe
  C:\Windows\System\EijnaXZ.exe
  2⤵
  PID:6368
- C:\Windows\System\utZecTe.exe
  C:\Windows\System\utZecTe.exe
  2⤵
  PID:7088
- C:\Windows\System\fKzTtAS.exe
  C:\Windows\System\fKzTtAS.exe
  2⤵
  PID:6508
- C:\Windows\System\syqIXQa.exe
  C:\Windows\System\syqIXQa.exe
  2⤵
  PID:7124
- C:\Windows\System\aMnUhmY.exe
  C:\Windows\System\aMnUhmY.exe
  2⤵
  PID:6588
- C:\Windows\System\DWKCkjW.exe
  C:\Windows\System\DWKCkjW.exe
  2⤵
  PID:5732
- C:\Windows\System\pPNUHph.exe
  C:\Windows\System\pPNUHph.exe
  2⤵
  PID:6356
- C:\Windows\System\koQzijs.exe
  C:\Windows\System\koQzijs.exe
  2⤵
  PID:6440
- C:\Windows\System\QBjwnAb.exe
  C:\Windows\System\QBjwnAb.exe
  2⤵
  PID:6568
- C:\Windows\System\rjXQbXm.exe
  C:\Windows\System\rjXQbXm.exe
  2⤵
  PID:6680
- C:\Windows\System\eolsGNE.exe
  C:\Windows\System\eolsGNE.exe
  2⤵
  PID:6692
- C:\Windows\System\dKiYvwB.exe
  C:\Windows\System\dKiYvwB.exe
  2⤵
  PID:6784
- C:\Windows\System\GmSIKjk.exe
  C:\Windows\System\GmSIKjk.exe
  2⤵
  PID:6700
- C:\Windows\System\bHVJIiZ.exe
  C:\Windows\System\bHVJIiZ.exe
  2⤵
  PID:6956
- C:\Windows\System\xJBvije.exe
  C:\Windows\System\xJBvije.exe
  2⤵
  PID:6164
- C:\Windows\System\mtxzyxt.exe
  C:\Windows\System\mtxzyxt.exe
  2⤵
  PID:7060
- C:\Windows\System\eWzVgHT.exe
  C:\Windows\System\eWzVgHT.exe
  2⤵
  PID:6212
- C:\Windows\System\mBkSfCy.exe
  C:\Windows\System\mBkSfCy.exe
  2⤵
  PID:7140
- C:\Windows\System\sGQjikZ.exe
  C:\Windows\System\sGQjikZ.exe
  2⤵
  PID:6640
- C:\Windows\System\OVbsUgv.exe
  C:\Windows\System\OVbsUgv.exe
  2⤵
  PID:6944
- C:\Windows\System\sPhDzEC.exe
  C:\Windows\System\sPhDzEC.exe
  2⤵
  PID:6864
- C:\Windows\System\tMshbeY.exe
  C:\Windows\System\tMshbeY.exe
  2⤵
  PID:6660
- C:\Windows\System\iOBLBzW.exe
  C:\Windows\System\iOBLBzW.exe
  2⤵
  PID:7040
- C:\Windows\System\bGkYamc.exe
  C:\Windows\System\bGkYamc.exe
  2⤵
  PID:6472
- C:\Windows\System\CvnlcBw.exe
  C:\Windows\System\CvnlcBw.exe
  2⤵
  PID:5736
- C:\Windows\System\jgocvTj.exe
  C:\Windows\System\jgocvTj.exe
  2⤵
  PID:6192
- C:\Windows\System\RqzDyPO.exe
  C:\Windows\System\RqzDyPO.exe
  2⤵
  PID:6340
- C:\Windows\System\GgIGRnf.exe
  C:\Windows\System\GgIGRnf.exe
  2⤵
  PID:6732
- C:\Windows\System\lGNBnsl.exe
  C:\Windows\System\lGNBnsl.exe
  2⤵
  PID:7004
- C:\Windows\System\zgxnZTh.exe
  C:\Windows\System\zgxnZTh.exe
  2⤵
  PID:6540
- C:\Windows\System\MYMHaGD.exe
  C:\Windows\System\MYMHaGD.exe
  2⤵
  PID:7156
- C:\Windows\System\LvjHoLj.exe
  C:\Windows\System\LvjHoLj.exe
  2⤵
  PID:6408
- C:\Windows\System\raTtDWT.exe
  C:\Windows\System\raTtDWT.exe
  2⤵
  PID:6796
- C:\Windows\System\TWDMWYf.exe
  C:\Windows\System\TWDMWYf.exe
  2⤵
  PID:6844
- C:\Windows\System\uyjMcmm.exe
  C:\Windows\System\uyjMcmm.exe
  2⤵
  PID:7184
- C:\Windows\System\ZLovCRV.exe
  C:\Windows\System\ZLovCRV.exe
  2⤵
  PID:7200
- C:\Windows\System\qUfQbVD.exe
  C:\Windows\System\qUfQbVD.exe
  2⤵
  PID:7216
- C:\Windows\System\jIMNjYJ.exe
  C:\Windows\System\jIMNjYJ.exe
  2⤵
  PID:7232
- C:\Windows\System\TnaBjKN.exe
  C:\Windows\System\TnaBjKN.exe
  2⤵
  PID:7248
- C:\Windows\System\tMpeOec.exe
  C:\Windows\System\tMpeOec.exe
  2⤵
  PID:7264
- C:\Windows\System\rsRTdch.exe
  C:\Windows\System\rsRTdch.exe
  2⤵
  PID:7280
- C:\Windows\System\goxeeXk.exe
  C:\Windows\System\goxeeXk.exe
  2⤵
  PID:7296
- C:\Windows\System\sabjIwg.exe
  C:\Windows\System\sabjIwg.exe
  2⤵
  PID:7312
- C:\Windows\System\ksRnhHo.exe
  C:\Windows\System\ksRnhHo.exe
  2⤵
  PID:7328
- C:\Windows\System\csKrOTr.exe
  C:\Windows\System\csKrOTr.exe
  2⤵
  PID:7344
- C:\Windows\System\lWicDvH.exe
  C:\Windows\System\lWicDvH.exe
  2⤵
  PID:7360
- C:\Windows\System\MubqtIm.exe
  C:\Windows\System\MubqtIm.exe
  2⤵
  PID:7376
- C:\Windows\System\IaGEzZl.exe
  C:\Windows\System\IaGEzZl.exe
  2⤵
  PID:7392
- C:\Windows\System\xwdAaLl.exe
  C:\Windows\System\xwdAaLl.exe
  2⤵
  PID:7408
- C:\Windows\System\GFtgsZQ.exe
  C:\Windows\System\GFtgsZQ.exe
  2⤵
  PID:7424
- C:\Windows\System\bxYMqgg.exe
  C:\Windows\System\bxYMqgg.exe
  2⤵
  PID:7440
- C:\Windows\System\JXdzZKM.exe
  C:\Windows\System\JXdzZKM.exe
  2⤵
  PID:7456
- C:\Windows\System\pgnjHyg.exe
  C:\Windows\System\pgnjHyg.exe
  2⤵
  PID:7476
- C:\Windows\System\aMIjUGN.exe
  C:\Windows\System\aMIjUGN.exe
  2⤵
  PID:7492
- C:\Windows\System\VkMBSuf.exe
  C:\Windows\System\VkMBSuf.exe
  2⤵
  PID:7508
- C:\Windows\System\BRlIXPe.exe
  C:\Windows\System\BRlIXPe.exe
  2⤵
  PID:7524
- C:\Windows\System\klOOCLu.exe
  C:\Windows\System\klOOCLu.exe
  2⤵
  PID:7540
- C:\Windows\System\fELmsal.exe
  C:\Windows\System\fELmsal.exe
  2⤵
  PID:7556
- C:\Windows\System\aSjKjnR.exe
  C:\Windows\System\aSjKjnR.exe
  2⤵
  PID:7572
- C:\Windows\System\JHARYuQ.exe
  C:\Windows\System\JHARYuQ.exe
  2⤵
  PID:7588
- C:\Windows\System\FbHQdls.exe
  C:\Windows\System\FbHQdls.exe
  2⤵
  PID:7612
- C:\Windows\System\gMXXSkl.exe
  C:\Windows\System\gMXXSkl.exe
  2⤵
  PID:7628
- C:\Windows\System\PkDQugo.exe
  C:\Windows\System\PkDQugo.exe
  2⤵
  PID:7644
- C:\Windows\System\FEXdlDp.exe
  C:\Windows\System\FEXdlDp.exe
  2⤵
  PID:7660
- C:\Windows\System\JWhBKdS.exe
  C:\Windows\System\JWhBKdS.exe
  2⤵
  PID:7676
- C:\Windows\System\KxDYzyP.exe
  C:\Windows\System\KxDYzyP.exe
  2⤵
  PID:7692
- C:\Windows\System\KPCsXiO.exe
  C:\Windows\System\KPCsXiO.exe
  2⤵
  PID:7708
- C:\Windows\System\VexeElX.exe
  C:\Windows\System\VexeElX.exe
  2⤵
  PID:7724
- C:\Windows\System\NFLGZOB.exe
  C:\Windows\System\NFLGZOB.exe
  2⤵
  PID:7740
- C:\Windows\System\ctFOvzc.exe
  C:\Windows\System\ctFOvzc.exe
  2⤵
  PID:7760
- C:\Windows\System\pxPbEVa.exe
  C:\Windows\System\pxPbEVa.exe
  2⤵
  PID:7776
- C:\Windows\System\uoFEWwH.exe
  C:\Windows\System\uoFEWwH.exe
  2⤵
  PID:7792
- C:\Windows\System\tdyPEJn.exe
  C:\Windows\System\tdyPEJn.exe
  2⤵
  PID:7808
- C:\Windows\System\KEXyqia.exe
  C:\Windows\System\KEXyqia.exe
  2⤵
  PID:7824
- C:\Windows\System\yAfkmBO.exe
  C:\Windows\System\yAfkmBO.exe
  2⤵
  PID:7840
- C:\Windows\System\GnlNXGA.exe
  C:\Windows\System\GnlNXGA.exe
  2⤵
  PID:7856
- C:\Windows\System\eQeBvvm.exe
  C:\Windows\System\eQeBvvm.exe
  2⤵
  PID:7872
- C:\Windows\System\FJhFcpK.exe
  C:\Windows\System\FJhFcpK.exe
  2⤵
  PID:7888
- C:\Windows\System\yJHQAwm.exe
  C:\Windows\System\yJHQAwm.exe
  2⤵
  PID:7904
- C:\Windows\System\JnYWILg.exe
  C:\Windows\System\JnYWILg.exe
  2⤵
  PID:7920
- C:\Windows\System\BMrjgtn.exe
  C:\Windows\System\BMrjgtn.exe
  2⤵
  PID:7936
- C:\Windows\System\uuxmasS.exe
  C:\Windows\System\uuxmasS.exe
  2⤵
  PID:7952
- C:\Windows\System\VWBGYgY.exe
  C:\Windows\System\VWBGYgY.exe
  2⤵
  PID:7968
- C:\Windows\System\ytoIXpG.exe
  C:\Windows\System\ytoIXpG.exe
  2⤵
  PID:7984
- C:\Windows\System\IuuUBMo.exe
  C:\Windows\System\IuuUBMo.exe
  2⤵
  PID:8000
- C:\Windows\System\OCjrzgT.exe
  C:\Windows\System\OCjrzgT.exe
  2⤵
  PID:8016
- C:\Windows\System\KTGzeEz.exe
  C:\Windows\System\KTGzeEz.exe
  2⤵
  PID:8032
- C:\Windows\System\tCfjWIy.exe
  C:\Windows\System\tCfjWIy.exe
  2⤵
  PID:8048
- C:\Windows\System\oeOpCIx.exe
  C:\Windows\System\oeOpCIx.exe
  2⤵
  PID:8064
- C:\Windows\System\cucNMmp.exe
  C:\Windows\System\cucNMmp.exe
  2⤵
  PID:8080
- C:\Windows\System\ToSbxsp.exe
  C:\Windows\System\ToSbxsp.exe
  2⤵
  PID:8100
- C:\Windows\System\ExHwzLy.exe
  C:\Windows\System\ExHwzLy.exe
  2⤵
  PID:8120
- C:\Windows\System\DXGgPlR.exe
  C:\Windows\System\DXGgPlR.exe
  2⤵
  PID:8136
- C:\Windows\System\DSzjYhU.exe
  C:\Windows\System\DSzjYhU.exe
  2⤵
  PID:8152
- C:\Windows\System\cZAnUKO.exe
  C:\Windows\System\cZAnUKO.exe
  2⤵
  PID:7240
- C:\Windows\System\MbvGgGM.exe
  C:\Windows\System\MbvGgGM.exe
  2⤵
  PID:6664
- C:\Windows\System\AbRNsqI.exe
  C:\Windows\System\AbRNsqI.exe
  2⤵
  PID:7256
- C:\Windows\System\NQhSfSy.exe
  C:\Windows\System\NQhSfSy.exe
  2⤵
  PID:7304
- C:\Windows\System\RMsvjiF.exe
  C:\Windows\System\RMsvjiF.exe
  2⤵
  PID:7320
- C:\Windows\System\JiRECSl.exe
  C:\Windows\System\JiRECSl.exe
  2⤵
  PID:7372
- C:\Windows\System\hLjfwHU.exe
  C:\Windows\System\hLjfwHU.exe
  2⤵
  PID:7356
- C:\Windows\System\JsiPADE.exe
  C:\Windows\System\JsiPADE.exe
  2⤵
  PID:7384
- C:\Windows\System\cfXqiRX.exe
  C:\Windows\System\cfXqiRX.exe
  2⤵
  PID:7448
- C:\Windows\System\rFkhPwy.exe
  C:\Windows\System\rFkhPwy.exe
  2⤵
  PID:7500
- C:\Windows\System\bLSzSiQ.exe
  C:\Windows\System\bLSzSiQ.exe
  2⤵
  PID:7536
- C:\Windows\System\EFLxqMY.exe
  C:\Windows\System\EFLxqMY.exe
  2⤵
  PID:7596
- C:\Windows\System\CtBWvsO.exe
  C:\Windows\System\CtBWvsO.exe
  2⤵
  PID:7552
- C:\Windows\System\CffpAMr.exe
  C:\Windows\System\CffpAMr.exe
  2⤵
  PID:7600
- C:\Windows\System\qlqPKDj.exe
  C:\Windows\System\qlqPKDj.exe
  2⤵
  PID:7620
- C:\Windows\System\WQzYbiG.exe
  C:\Windows\System\WQzYbiG.exe
  2⤵
  PID:7640
- C:\Windows\System\wGKjHxR.exe
  C:\Windows\System\wGKjHxR.exe
  2⤵
  PID:7704
- C:\Windows\System\BHNVIzq.exe
  C:\Windows\System\BHNVIzq.exe
  2⤵
  PID:7684
- C:\Windows\System\OnVgDYB.exe
  C:\Windows\System\OnVgDYB.exe
  2⤵
  PID:7748
- C:\Windows\System\HUGUubG.exe
  C:\Windows\System\HUGUubG.exe
  2⤵
  PID:7784
- C:\Windows\System\IWDEYtF.exe
  C:\Windows\System\IWDEYtF.exe
  2⤵
  PID:7832
- C:\Windows\System\UXXIYPK.exe
  C:\Windows\System\UXXIYPK.exe
  2⤵
  PID:7820
- C:\Windows\System\FLTSJPW.exe
  C:\Windows\System\FLTSJPW.exe
  2⤵
  PID:7928
- C:\Windows\System\JADCeyo.exe
  C:\Windows\System\JADCeyo.exe
  2⤵
  PID:7996
- C:\Windows\System\qKwPpxg.exe
  C:\Windows\System\qKwPpxg.exe
  2⤵
  PID:8056
- C:\Windows\System\uFqEkDT.exe
  C:\Windows\System\uFqEkDT.exe
  2⤵
  PID:8092
- C:\Windows\System\FzKCQGh.exe
  C:\Windows\System\FzKCQGh.exe
  2⤵
  PID:7916
- C:\Windows\System\nbNNVqC.exe
  C:\Windows\System\nbNNVqC.exe
  2⤵
  PID:8044
- C:\Windows\System\iUaNwUZ.exe
  C:\Windows\System\iUaNwUZ.exe
  2⤵
  PID:7948
- C:\Windows\System\MpSZANh.exe
  C:\Windows\System\MpSZANh.exe
  2⤵
  PID:8128
- C:\Windows\System\BaItwSN.exe
  C:\Windows\System\BaItwSN.exe
  2⤵
  PID:8116
- C:\Windows\System\HuZqRjP.exe
  C:\Windows\System\HuZqRjP.exe
  2⤵
  PID:8164
- C:\Windows\System\ilRgEdl.exe
  C:\Windows\System\ilRgEdl.exe
  2⤵
  PID:8188
- C:\Windows\System\QXHLApg.exe
  C:\Windows\System\QXHLApg.exe
  2⤵
  PID:6676
- C:\Windows\System\CVKUFYM.exe
  C:\Windows\System\CVKUFYM.exe
  2⤵
  PID:7752
- C:\Windows\System\uyVADMP.exe
  C:\Windows\System\uyVADMP.exe
  2⤵
  PID:6940
- C:\Windows\System\oqtkPQo.exe
  C:\Windows\System\oqtkPQo.exe
  2⤵
  PID:7308
- C:\Windows\System\MEHHswx.exe
  C:\Windows\System\MEHHswx.exe
  2⤵
  PID:7260
- C:\Windows\System\YwdOTqa.exe
  C:\Windows\System\YwdOTqa.exe
  2⤵
  PID:7464
- C:\Windows\System\WeWltQX.exe
  C:\Windows\System\WeWltQX.exe
  2⤵
  PID:7416
- C:\Windows\System\MLfDlKY.exe
  C:\Windows\System\MLfDlKY.exe
  2⤵
  PID:7520
- C:\Windows\System\AWKkpgJ.exe
  C:\Windows\System\AWKkpgJ.exe
  2⤵
  PID:7488
- C:\Windows\System\hsAKBjI.exe
  C:\Windows\System\hsAKBjI.exe
  2⤵
  PID:7716
- C:\Windows\System\dKSnyUC.exe
  C:\Windows\System\dKSnyUC.exe
  2⤵
  PID:7804
- C:\Windows\System\qNZpMli.exe
  C:\Windows\System\qNZpMli.exe
  2⤵
  PID:1860
- C:\Windows\System\gXSVDJj.exe
  C:\Windows\System\gXSVDJj.exe
  2⤵
  PID:7652
- C:\Windows\System\jzSZDKQ.exe
  C:\Windows\System\jzSZDKQ.exe
  2⤵
  PID:7816
- C:\Windows\System\AijpkJI.exe
  C:\Windows\System\AijpkJI.exe
  2⤵
  PID:7880
- C:\Windows\System\xsoGGyP.exe
  C:\Windows\System\xsoGGyP.exe
  2⤵
  PID:8076
- C:\Windows\System\kuYmTcm.exe
  C:\Windows\System\kuYmTcm.exe
  2⤵
  PID:7992
- C:\Windows\System\HlfyvUD.exe
  C:\Windows\System\HlfyvUD.exe
  2⤵
  PID:7208
- C:\Windows\System\prvJrNa.exe
  C:\Windows\System\prvJrNa.exe
  2⤵
  PID:7368
- C:\Windows\System\qsKffTx.exe
  C:\Windows\System\qsKffTx.exe
  2⤵
  PID:7700
- C:\Windows\System\PkHJjDv.exe
  C:\Windows\System\PkHJjDv.exe
  2⤵
  PID:7868
- C:\Windows\System\EnQQkvR.exe
  C:\Windows\System\EnQQkvR.exe
  2⤵
  PID:7180
- C:\Windows\System\qPllHfr.exe
  C:\Windows\System\qPllHfr.exe
  2⤵
  PID:8088
- C:\Windows\System\seRaXFM.exe
  C:\Windows\System\seRaXFM.exe
  2⤵
  PID:8208
- C:\Windows\System\uOaVUeq.exe
  C:\Windows\System\uOaVUeq.exe
  2⤵
  PID:8224
- C:\Windows\System\nMzZoHC.exe
  C:\Windows\System\nMzZoHC.exe
  2⤵
  PID:8288
- C:\Windows\System\kCHJlUY.exe
  C:\Windows\System\kCHJlUY.exe
  2⤵
  PID:8312
- C:\Windows\System\pkVZpEX.exe
  C:\Windows\System\pkVZpEX.exe
  2⤵
  PID:8328
- C:\Windows\System\chVnhxv.exe
  C:\Windows\System\chVnhxv.exe
  2⤵
  PID:8344
- C:\Windows\System\KpHkkoU.exe
  C:\Windows\System\KpHkkoU.exe
  2⤵
  PID:8360
- C:\Windows\System\FMTaTZU.exe
  C:\Windows\System\FMTaTZU.exe
  2⤵
  PID:8376
- C:\Windows\System\ZtmbRvZ.exe
  C:\Windows\System\ZtmbRvZ.exe
  2⤵
  PID:8400
- C:\Windows\System\VJYvuwY.exe
  C:\Windows\System\VJYvuwY.exe
  2⤵
  PID:8416
- C:\Windows\System\bUlVBQV.exe
  C:\Windows\System\bUlVBQV.exe
  2⤵
  PID:8432
- C:\Windows\System\yATFjQD.exe
  C:\Windows\System\yATFjQD.exe
  2⤵
  PID:8448
- C:\Windows\System\ObJzgpb.exe
  C:\Windows\System\ObJzgpb.exe
  2⤵
  PID:8464
- C:\Windows\System\rIIqGCV.exe
  C:\Windows\System\rIIqGCV.exe
  2⤵
  PID:8480
- C:\Windows\System\QCeEOYb.exe
  C:\Windows\System\QCeEOYb.exe
  2⤵
  PID:8500
- C:\Windows\System\gzGNciL.exe
  C:\Windows\System\gzGNciL.exe
  2⤵
  PID:8516
- C:\Windows\System\vfjgFVx.exe
  C:\Windows\System\vfjgFVx.exe
  2⤵
  PID:8632
- C:\Windows\System\NvIlzeb.exe
  C:\Windows\System\NvIlzeb.exe
  2⤵
  PID:8652
- C:\Windows\System\NaJSrYD.exe
  C:\Windows\System\NaJSrYD.exe
  2⤵
  PID:8668
- C:\Windows\System\ToJvHvD.exe
  C:\Windows\System\ToJvHvD.exe
  2⤵
  PID:8684
- C:\Windows\System\AtDKsbs.exe
  C:\Windows\System\AtDKsbs.exe
  2⤵
  PID:8700
- C:\Windows\System\FEjMaKG.exe
  C:\Windows\System\FEjMaKG.exe
  2⤵
  PID:8724
- C:\Windows\System\YziusNl.exe
  C:\Windows\System\YziusNl.exe
  2⤵
  PID:8740
- C:\Windows\System\wQLVLSn.exe
  C:\Windows\System\wQLVLSn.exe
  2⤵
  PID:8756
- C:\Windows\System\qlxoxPM.exe
  C:\Windows\System\qlxoxPM.exe
  2⤵
  PID:8772
- C:\Windows\System\xxxZmbV.exe
  C:\Windows\System\xxxZmbV.exe
  2⤵
  PID:8788
- C:\Windows\System\oWQVoWm.exe
  C:\Windows\System\oWQVoWm.exe
  2⤵
  PID:8804
- C:\Windows\System\kvEGiHu.exe
  C:\Windows\System\kvEGiHu.exe
  2⤵
  PID:8820
- C:\Windows\System\JlSugGS.exe
  C:\Windows\System\JlSugGS.exe
  2⤵
  PID:8836
- C:\Windows\System\MugMjBs.exe
  C:\Windows\System\MugMjBs.exe
  2⤵
  PID:8852
- C:\Windows\System\RcmfdwG.exe
  C:\Windows\System\RcmfdwG.exe
  2⤵
  PID:8868
- C:\Windows\System\NbACQoo.exe
  C:\Windows\System\NbACQoo.exe
  2⤵
  PID:8884
- C:\Windows\System\EDbsMxO.exe
  C:\Windows\System\EDbsMxO.exe
  2⤵
  PID:8904
- C:\Windows\System\TSweHGe.exe
  C:\Windows\System\TSweHGe.exe
  2⤵
  PID:8920
- C:\Windows\System\zsxKeac.exe
  C:\Windows\System\zsxKeac.exe
  2⤵
  PID:8936
- C:\Windows\System\rPbmwaF.exe
  C:\Windows\System\rPbmwaF.exe
  2⤵
  PID:8952
- C:\Windows\System\ByNaHww.exe
  C:\Windows\System\ByNaHww.exe
  2⤵
  PID:8972
- C:\Windows\System\YnrmwGx.exe
  C:\Windows\System\YnrmwGx.exe
  2⤵
  PID:8988
- C:\Windows\System\NrJYoVS.exe
  C:\Windows\System\NrJYoVS.exe
  2⤵
  PID:9004
- C:\Windows\System\jEreMHN.exe
  C:\Windows\System\jEreMHN.exe
  2⤵
  PID:9020
- C:\Windows\System\WUBpcLy.exe
  C:\Windows\System\WUBpcLy.exe
  2⤵
  PID:9036
- C:\Windows\System\TbIfhWJ.exe
  C:\Windows\System\TbIfhWJ.exe
  2⤵
  PID:9052
- C:\Windows\System\SoRywUe.exe
  C:\Windows\System\SoRywUe.exe
  2⤵
  PID:9068
- C:\Windows\System\VIkTJRp.exe
  C:\Windows\System\VIkTJRp.exe
  2⤵
  PID:9084
- C:\Windows\System\dxwFlYd.exe
  C:\Windows\System\dxwFlYd.exe
  2⤵
  PID:9100
- C:\Windows\System\hGspcow.exe
  C:\Windows\System\hGspcow.exe
  2⤵
  PID:9116
- C:\Windows\System\rtDxuME.exe
  C:\Windows\System\rtDxuME.exe
  2⤵
  PID:9132
- C:\Windows\System\qTyZnWG.exe
  C:\Windows\System\qTyZnWG.exe
  2⤵
  PID:9152
- C:\Windows\System\HFmCGlv.exe
  C:\Windows\System\HFmCGlv.exe
  2⤵
  PID:9168
- C:\Windows\System\CgcOhzV.exe
  C:\Windows\System\CgcOhzV.exe
  2⤵
  PID:9184
- C:\Windows\System\ByJmhWN.exe
  C:\Windows\System\ByJmhWN.exe
  2⤵
  PID:9200
- C:\Windows\System\gdXpANb.exe
  C:\Windows\System\gdXpANb.exe
  2⤵
  PID:8200
- C:\Windows\System\NQMJXnk.exe
  C:\Windows\System\NQMJXnk.exe
  2⤵
  PID:8012
- C:\Windows\System\AuRKzej.exe
  C:\Windows\System\AuRKzej.exe
  2⤵
  PID:7976
- C:\Windows\System\rwfrDck.exe
  C:\Windows\System\rwfrDck.exe
  2⤵
  PID:8040
- C:\Windows\System\BasKMyi.exe
  C:\Windows\System\BasKMyi.exe
  2⤵
  PID:7352
- C:\Windows\System\OvwLIJl.exe
  C:\Windows\System\OvwLIJl.exe
  2⤵
  PID:6444
- C:\Windows\System\OzkxwUb.exe
  C:\Windows\System\OzkxwUb.exe
  2⤵
  PID:2872
- C:\Windows\System\dhxlaNZ.exe
  C:\Windows\System\dhxlaNZ.exe
  2⤵
  PID:7896
- C:\Windows\System\YxBCaNr.exe
  C:\Windows\System\YxBCaNr.exe
  2⤵
  PID:7584
- C:\Windows\System\SHLqQlN.exe
  C:\Windows\System\SHLqQlN.exe
  2⤵
  PID:8220
- C:\Windows\System\OvOmBmb.exe
  C:\Windows\System\OvOmBmb.exe
  2⤵
  PID:8248
- C:\Windows\System\kUmWFxB.exe
  C:\Windows\System\kUmWFxB.exe
  2⤵
  PID:8268
- C:\Windows\System\jfFvjwT.exe
  C:\Windows\System\jfFvjwT.exe
  2⤵
  PID:8296
- C:\Windows\System\fVGxQQu.exe
  C:\Windows\System\fVGxQQu.exe
  2⤵
  PID:8356
- C:\Windows\System\uMaUcDU.exe
  C:\Windows\System\uMaUcDU.exe
  2⤵
  PID:8396
- C:\Windows\System\hoMmyXj.exe
  C:\Windows\System\hoMmyXj.exe
  2⤵
  PID:8336
- C:\Windows\System\gSAjFpT.exe
  C:\Windows\System\gSAjFpT.exe
  2⤵
  PID:8340
- C:\Windows\System\CVyOjvb.exe
  C:\Windows\System\CVyOjvb.exe
  2⤵
  PID:8472
- C:\Windows\System\JstuTgo.exe
  C:\Windows\System\JstuTgo.exe
  2⤵
  PID:8496
- C:\Windows\System\AUpaYbi.exe
  C:\Windows\System\AUpaYbi.exe
  2⤵
  PID:8492
- C:\Windows\System\ZRBONdV.exe
  C:\Windows\System\ZRBONdV.exe
  2⤵
  PID:7276
- C:\Windows\System\woEAaJB.exe
  C:\Windows\System\woEAaJB.exe
  2⤵
  PID:8552
- C:\Windows\System\RvBHttW.exe
  C:\Windows\System\RvBHttW.exe
  2⤵
  PID:8568
- C:\Windows\System\LMzKeLI.exe
  C:\Windows\System\LMzKeLI.exe
  2⤵
  PID:8588
- C:\Windows\System\voTOkwa.exe
  C:\Windows\System\voTOkwa.exe
  2⤵
  PID:8604
- C:\Windows\System\sMTeWPr.exe
  C:\Windows\System\sMTeWPr.exe
  2⤵
  PID:8620
- C:\Windows\System\KdWwOSu.exe
  C:\Windows\System\KdWwOSu.exe
  2⤵
  PID:8640
- C:\Windows\System\GfzMfUx.exe
  C:\Windows\System\GfzMfUx.exe
  2⤵
  PID:8716
- C:\Windows\System\YBBPXre.exe
  C:\Windows\System\YBBPXre.exe
  2⤵
  PID:8732
- C:\Windows\System\QVxtbWl.exe
  C:\Windows\System\QVxtbWl.exe
  2⤵
  PID:8764
- C:\Windows\System\mCEMEbm.exe
  C:\Windows\System\mCEMEbm.exe
  2⤵
  PID:8828
- C:\Windows\System\RzHZfET.exe
  C:\Windows\System\RzHZfET.exe
  2⤵
  PID:8896
- C:\Windows\System\hfnWaSc.exe
  C:\Windows\System\hfnWaSc.exe
  2⤵
  PID:8964
- C:\Windows\System\ZaipylQ.exe
  C:\Windows\System\ZaipylQ.exe
  2⤵
  PID:9028
- C:\Windows\System\CdiHblj.exe
  C:\Windows\System\CdiHblj.exe
  2⤵
  PID:9064
- C:\Windows\System\qCEbQrP.exe
  C:\Windows\System\qCEbQrP.exe
  2⤵
  PID:8916
- C:\Windows\System\QgZCyIj.exe
  C:\Windows\System\QgZCyIj.exe
  2⤵
  PID:8816
- C:\Windows\System\WPCirHA.exe
  C:\Windows\System\WPCirHA.exe
  2⤵
  PID:9148
- C:\Windows\System\iMJXyvr.exe
  C:\Windows\System\iMJXyvr.exe
  2⤵
  PID:8784
- C:\Windows\System\THlxUts.exe
  C:\Windows\System\THlxUts.exe
  2⤵
  PID:9108
- C:\Windows\System\tIqqvKx.exe
  C:\Windows\System\tIqqvKx.exe
  2⤵
  PID:9144
- C:\Windows\System\JsWLeCx.exe
  C:\Windows\System\JsWLeCx.exe
  2⤵
  PID:8984
- C:\Windows\System\mIEBKRP.exe
  C:\Windows\System\mIEBKRP.exe
  2⤵
  PID:9012
- C:\Windows\System\BivGfYF.exe
  C:\Windows\System\BivGfYF.exe
  2⤵
  PID:8008
- C:\Windows\System\LFMyVjR.exe
  C:\Windows\System\LFMyVjR.exe
  2⤵
  PID:7104
- C:\Windows\System\QYsVqvE.exe
  C:\Windows\System\QYsVqvE.exe
  2⤵
  PID:8148
- C:\Windows\System\LhWanho.exe
  C:\Windows\System\LhWanho.exe
  2⤵
  PID:2832
- C:\Windows\System\XxrXPXc.exe
  C:\Windows\System\XxrXPXc.exe
  2⤵
  PID:7848
- C:\Windows\System\WzyFIEr.exe
  C:\Windows\System\WzyFIEr.exe
  2⤵
  PID:8236
- C:\Windows\System\gBCNgDq.exe
  C:\Windows\System\gBCNgDq.exe
  2⤵
  PID:8320
- C:\Windows\System\DoHjPLf.exe
  C:\Windows\System\DoHjPLf.exe
  2⤵
  PID:9000
- C:\Windows\System\NggiKMB.exe
  C:\Windows\System\NggiKMB.exe
  2⤵
  PID:9128
- C:\Windows\System\OgTeifQ.exe
  C:\Windows\System\OgTeifQ.exe
  2⤵
  PID:8880
- C:\Windows\System\ELnxJmE.exe
  C:\Windows\System\ELnxJmE.exe
  2⤵
  PID:9080
- C:\Windows\System\lJeRbvc.exe
  C:\Windows\System\lJeRbvc.exe
  2⤵
  PID:8752
- C:\Windows\System\PNPpSBc.exe
  C:\Windows\System\PNPpSBc.exe
  2⤵
  PID:8960
- C:\Windows\System\gogLNtO.exe
  C:\Windows\System\gogLNtO.exe
  2⤵
  PID:8780
- C:\Windows\System\SOJdAAd.exe
  C:\Windows\System\SOJdAAd.exe
  2⤵
  PID:9016
- C:\Windows\System\jTnXEkT.exe
  C:\Windows\System\jTnXEkT.exe
  2⤵
  PID:7800
- C:\Windows\System\CeJNfKy.exe
  C:\Windows\System\CeJNfKy.exe
  2⤵
  PID:7772
- C:\Windows\System\LGsRsJW.exe
  C:\Windows\System\LGsRsJW.exe
  2⤵
  PID:7336
- C:\Windows\System\hFUBqJm.exe
  C:\Windows\System\hFUBqJm.exe
  2⤵
  PID:8324
- C:\Windows\System\zgntfxf.exe
  C:\Windows\System\zgntfxf.exe
  2⤵
  PID:8428
- C:\Windows\System\sfopJqj.exe
  C:\Windows\System\sfopJqj.exe
  2⤵
  PID:8548
- C:\Windows\System\rJASYCU.exe
  C:\Windows\System\rJASYCU.exe
  2⤵
  PID:8612
- C:\Windows\System\sMvLwVa.exe
  C:\Windows\System\sMvLwVa.exe
  2⤵
  PID:8560
- C:\Windows\System\yZEDujA.exe
  C:\Windows\System\yZEDujA.exe
  2⤵
  PID:8512
- C:\Windows\System\CeAXWiK.exe
  C:\Windows\System\CeAXWiK.exe
  2⤵
  PID:9076
- C:\Windows\System\AiPHTQi.exe
  C:\Windows\System\AiPHTQi.exe
  2⤵
  PID:8932
- C:\Windows\System\EkCZStP.exe
  C:\Windows\System\EkCZStP.exe
  2⤵
  PID:8284
- C:\Windows\System\QsFSrEe.exe
  C:\Windows\System\QsFSrEe.exe
  2⤵
  PID:8528
- C:\Windows\System\ScFTQeS.exe
  C:\Windows\System\ScFTQeS.exe
  2⤵
  PID:7420
- C:\Windows\System\LpUZysw.exe
  C:\Windows\System\LpUZysw.exe
  2⤵
  PID:8860
- C:\Windows\System\aTerSPD.exe
  C:\Windows\System\aTerSPD.exe
  2⤵
  PID:8456
- C:\Windows\System\LEGrUSR.exe
  C:\Windows\System\LEGrUSR.exe
  2⤵
  PID:8676
- C:\Windows\System\HDhqvDv.exe
  C:\Windows\System\HDhqvDv.exe
  2⤵
  PID:8864
- C:\Windows\System\ujQpnhE.exe
  C:\Windows\System\ujQpnhE.exe
  2⤵
  PID:8596
- C:\Windows\System\MbzhgoI.exe
  C:\Windows\System\MbzhgoI.exe
  2⤵
  PID:7608
- C:\Windows\System\GXHtdry.exe
  C:\Windows\System\GXHtdry.exe
  2⤵
  PID:8660
- C:\Windows\System\vciGzhV.exe
  C:\Windows\System\vciGzhV.exe
  2⤵
  PID:8444
- C:\Windows\System\nPdbSlk.exe
  C:\Windows\System\nPdbSlk.exe
  2⤵
  PID:8628
- C:\Windows\System\vDKouue.exe
  C:\Windows\System\vDKouue.exe
  2⤵
  PID:9228
- C:\Windows\System\MqIoEAm.exe
  C:\Windows\System\MqIoEAm.exe
  2⤵
  PID:9244
- C:\Windows\System\hQUDUVu.exe
  C:\Windows\System\hQUDUVu.exe
  2⤵
  PID:9260
- C:\Windows\System\qVeyjOu.exe
  C:\Windows\System\qVeyjOu.exe
  2⤵
  PID:9380
- C:\Windows\System\xywZekJ.exe
  C:\Windows\System\xywZekJ.exe
  2⤵
  PID:9396
- C:\Windows\System\dDnQOdT.exe
  C:\Windows\System\dDnQOdT.exe
  2⤵
  PID:9412
- C:\Windows\System\VfYvaLb.exe
  C:\Windows\System\VfYvaLb.exe
  2⤵
  PID:9428
- C:\Windows\System\zGXKuAs.exe
  C:\Windows\System\zGXKuAs.exe
  2⤵
  PID:9444
- C:\Windows\System\hBBrKcW.exe
  C:\Windows\System\hBBrKcW.exe
  2⤵
  PID:9464
- C:\Windows\System\vqSOpbD.exe
  C:\Windows\System\vqSOpbD.exe
  2⤵
  PID:9488
- C:\Windows\System\dtYlMXm.exe
  C:\Windows\System\dtYlMXm.exe
  2⤵
  PID:9512
- C:\Windows\System\yefNqJC.exe
  C:\Windows\System\yefNqJC.exe
  2⤵
  PID:9532
- C:\Windows\System\qfeLpco.exe
  C:\Windows\System\qfeLpco.exe
  2⤵
  PID:9600
- C:\Windows\System\DWdNWuw.exe
  C:\Windows\System\DWdNWuw.exe
  2⤵
  PID:9616
- C:\Windows\System\qMTFrpX.exe
  C:\Windows\System\qMTFrpX.exe
  2⤵
  PID:9632
- C:\Windows\System\ogbYTUE.exe
  C:\Windows\System\ogbYTUE.exe
  2⤵
  PID:9648
- C:\Windows\System\OoaKiTG.exe
  C:\Windows\System\OoaKiTG.exe
  2⤵
  PID:9664
- C:\Windows\System\pljywdP.exe
  C:\Windows\System\pljywdP.exe
  2⤵
  PID:9680
- C:\Windows\System\cyhuRgi.exe
  C:\Windows\System\cyhuRgi.exe
  2⤵
  PID:9696
- C:\Windows\System\CPGulXR.exe
  C:\Windows\System\CPGulXR.exe
  2⤵
  PID:9716
- C:\Windows\System\jrRAcfl.exe
  C:\Windows\System\jrRAcfl.exe
  2⤵
  PID:9732
- C:\Windows\System\ZgzbPOI.exe
  C:\Windows\System\ZgzbPOI.exe
  2⤵
  PID:9748
- C:\Windows\System\QMReUZO.exe
  C:\Windows\System\QMReUZO.exe
  2⤵
  PID:9764
- C:\Windows\System\mDlUOJn.exe
  C:\Windows\System\mDlUOJn.exe
  2⤵
  PID:9780
- C:\Windows\System\JdzRRZD.exe
  C:\Windows\System\JdzRRZD.exe
  2⤵
  PID:9804
- C:\Windows\System\hNieUtX.exe
  C:\Windows\System\hNieUtX.exe
  2⤵
  PID:9820
- C:\Windows\System\MxAjyrS.exe
  C:\Windows\System\MxAjyrS.exe
  2⤵
  PID:9836
- C:\Windows\System\fOHyjTq.exe
  C:\Windows\System\fOHyjTq.exe
  2⤵
  PID:9852
- C:\Windows\System\ywHbQhH.exe
  C:\Windows\System\ywHbQhH.exe
  2⤵
  PID:9868
- C:\Windows\System\vYtxpeF.exe
  C:\Windows\System\vYtxpeF.exe
  2⤵
  PID:9884
- C:\Windows\System\JwvfwhE.exe
  C:\Windows\System\JwvfwhE.exe
  2⤵
  PID:9900
- C:\Windows\System\BFNGeeD.exe
  C:\Windows\System\BFNGeeD.exe
  2⤵
  PID:9916
- C:\Windows\System\jGrbSZm.exe
  C:\Windows\System\jGrbSZm.exe
  2⤵
  PID:9932
- C:\Windows\System\uTpPSmt.exe
  C:\Windows\System\uTpPSmt.exe
  2⤵
  PID:9960
- C:\Windows\System\QKfCiNS.exe
  C:\Windows\System\QKfCiNS.exe
  2⤵
  PID:9976
- C:\Windows\System\yoVOUtc.exe
  C:\Windows\System\yoVOUtc.exe
  2⤵
  PID:9992
- C:\Windows\System\PJBOlyz.exe
  C:\Windows\System\PJBOlyz.exe
  2⤵
  PID:10008
- C:\Windows\System\WngePPG.exe
  C:\Windows\System\WngePPG.exe
  2⤵
  PID:10024
- C:\Windows\System\NmksAXc.exe
  C:\Windows\System\NmksAXc.exe
  2⤵
  PID:10040
- C:\Windows\System\ywQaTxR.exe
  C:\Windows\System\ywQaTxR.exe
  2⤵
  PID:10060
- C:\Windows\System\fwlTsuH.exe
  C:\Windows\System\fwlTsuH.exe
  2⤵
  PID:10076
- C:\Windows\System\XrpJHOH.exe
  C:\Windows\System\XrpJHOH.exe
  2⤵
  PID:10092
- C:\Windows\System\sgJImXq.exe
  C:\Windows\System\sgJImXq.exe
  2⤵
  PID:10108
- C:\Windows\System\elNFtxK.exe
  C:\Windows\System\elNFtxK.exe
  2⤵
  PID:10132
- C:\Windows\System\QIwlOmW.exe
  C:\Windows\System\QIwlOmW.exe
  2⤵
  PID:10148
- C:\Windows\System\gJKkCXt.exe
  C:\Windows\System\gJKkCXt.exe
  2⤵
  PID:10164
- C:\Windows\System\AjRthnu.exe
  C:\Windows\System\AjRthnu.exe
  2⤵
  PID:10180
- C:\Windows\System\lLFRBhL.exe
  C:\Windows\System\lLFRBhL.exe
  2⤵
  PID:10196
- C:\Windows\System\GMLrbuC.exe
  C:\Windows\System\GMLrbuC.exe
  2⤵
  PID:10212
- C:\Windows\System\ZipvZaB.exe
  C:\Windows\System\ZipvZaB.exe
  2⤵
  PID:10228
- C:\Windows\System\eoWZKSf.exe
  C:\Windows\System\eoWZKSf.exe
  2⤵
  PID:9220
- C:\Windows\System\twuQWPF.exe
  C:\Windows\System\twuQWPF.exe
  2⤵
  PID:9252
- C:\Windows\System\otznjSK.exe
  C:\Windows\System\otznjSK.exe
  2⤵
  PID:9048
- C:\Windows\System\mvKpzCQ.exe
  C:\Windows\System\mvKpzCQ.exe
  2⤵
  PID:8440
- C:\Windows\System\EDVWORR.exe
  C:\Windows\System\EDVWORR.exe
  2⤵
  PID:9060
- C:\Windows\System\taHbkin.exe
  C:\Windows\System\taHbkin.exe
  2⤵
  PID:8540
- C:\Windows\System\OURzyfU.exe
  C:\Windows\System\OURzyfU.exe
  2⤵
  PID:8844
- C:\Windows\System\JhWQinb.exe
  C:\Windows\System\JhWQinb.exe
  2⤵
  PID:9408
- C:\Windows\System\yygornE.exe
  C:\Windows\System\yygornE.exe
  2⤵
  PID:9296
- C:\Windows\System\KtSnlwa.exe
  C:\Windows\System\KtSnlwa.exe
  2⤵
  PID:9316
- C:\Windows\System\OZaoYhY.exe
  C:\Windows\System\OZaoYhY.exe
  2⤵
  PID:9332
- C:\Windows\System\qXMRcie.exe
  C:\Windows\System\qXMRcie.exe
  2⤵
  PID:9348
- C:\Windows\System\IYTfrrQ.exe
  C:\Windows\System\IYTfrrQ.exe
  2⤵
  PID:9364
- C:\Windows\System\miLmBkg.exe
  C:\Windows\System\miLmBkg.exe
  2⤵
  PID:9404
- C:\Windows\System\sGExXPg.exe
  C:\Windows\System\sGExXPg.exe
  2⤵
  PID:9592
- C:\Windows\System\tTOXRRY.exe
  C:\Windows\System\tTOXRRY.exe
  2⤵
  PID:9472
- C:\Windows\System\yhPOnXZ.exe
  C:\Windows\System\yhPOnXZ.exe
  2⤵
  PID:9688
- C:\Windows\System\ZsiKxFI.exe
  C:\Windows\System\ZsiKxFI.exe
  2⤵
  PID:9724
- C:\Windows\System\bDedWty.exe
  C:\Windows\System\bDedWty.exe
  2⤵
  PID:9436
- C:\Windows\System\ZMWgBEz.exe
  C:\Windows\System\ZMWgBEz.exe
  2⤵
  PID:9792
- C:\Windows\System\kZMEOYO.exe
  C:\Windows\System\kZMEOYO.exe
  2⤵
  PID:9704
- C:\Windows\System\INbkCXd.exe
  C:\Windows\System\INbkCXd.exe
  2⤵
  PID:9776
- C:\Windows\System\OTVergQ.exe
  C:\Windows\System\OTVergQ.exe
  2⤵
  PID:9832
- C:\Windows\System\qVtsYOO.exe
  C:\Windows\System\qVtsYOO.exe
  2⤵
  PID:9892
- C:\Windows\System\yUdlIRG.exe
  C:\Windows\System\yUdlIRG.exe
  2⤵
  PID:9740
- C:\Windows\System\OLDLpzH.exe
  C:\Windows\System\OLDLpzH.exe
  2⤵
  PID:9608
- C:\Windows\System\GQCcHUg.exe
  C:\Windows\System\GQCcHUg.exe
  2⤵
  PID:9944
- C:\Windows\System\gjGAWdF.exe
  C:\Windows\System\gjGAWdF.exe
  2⤵
  PID:9940
- C:\Windows\System\xMWAnaU.exe
  C:\Windows\System\xMWAnaU.exe
  2⤵
  PID:9968
- C:\Windows\System\mengRRm.exe
  C:\Windows\System\mengRRm.exe
  2⤵
  PID:10032
- C:\Windows\System\iQfNXPs.exe
  C:\Windows\System\iQfNXPs.exe
  2⤵
  PID:10100
- C:\Windows\System\VQoglXN.exe
  C:\Windows\System\VQoglXN.exe
  2⤵
  PID:10172
- C:\Windows\System\dkooMQF.exe
  C:\Windows\System\dkooMQF.exe
  2⤵
  PID:10084
- C:\Windows\System\tFyHIWD.exe
  C:\Windows\System\tFyHIWD.exe
  2⤵
  PID:10220
- C:\Windows\System\GgIGZVW.exe
  C:\Windows\System\GgIGZVW.exe
  2⤵
  PID:10048
- C:\Windows\System\ptEtuEf.exe
  C:\Windows\System\ptEtuEf.exe
  2⤵
  PID:10120
- C:\Windows\System\XQkvImg.exe
  C:\Windows\System\XQkvImg.exe
  2⤵
  PID:10224
- C:\Windows\System\SaVYLqQ.exe
  C:\Windows\System\SaVYLqQ.exe
  2⤵
  PID:6424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FQHLOaw.exe

Filesize
1.5MB

MD5
86f3a60bcfb4c4c254cb917c2ea651f6

SHA1
d957bc79a4f748545a8fb528e200056088ca9793

SHA256
1e71037d93ba62362f09fb72b3edee878b088da7866dda41c2575059f7c8a8d6

SHA512
eaa47bd7aae7897ab152e780d291359049671198037cd90eea7fcdd4199503011e0fa1642ec5d32c2a8dce1da986592dcf79a4dd6ac789ffb9c4324897ebae52

Download Submit
C:\Windows\system\LOyNCWX.exe

Filesize
1.5MB

MD5
38961c3e463dfc6ab361e64bcd652428

SHA1
9fb6c4ee6ac17bc8b04177ed2ee9c03ba979214d

SHA256
2efec90d246160cb369ac15f33b410033dc0ace8c1b2c77c126f590bf47aafc3

SHA512
9b16908912ed6a9b0ee84caa544da53e865916a70220789bdfd21dabaebfb8fb27ceb7f88f4274c37e8868193d4a5c6e35c2b8fa54040581f6b5742272fa8909

Download Submit
C:\Windows\system\NfQECOR.exe

Filesize
1.5MB

MD5
11c1954af08d9f544618aa5d32a26919

SHA1
fe67cdbe4f8b3da01f94e49bb83bb262a1788822

SHA256
a295a36a7dd3e585764d30b906296b1f74e50ab4eb054024656e0dd24fa26216

SHA512
7e7ca0bb0213f475856b9af0fbe6135e92f6aa3ce4c491aac291b592a162528bd1182607d1f115e7713c589576a5fdf8b5cd6414a3b11785f6fa9dee5e5835e2

Download Submit
C:\Windows\system\OdgwcEB.exe

Filesize
1.5MB

MD5
34378428fdc4ddac0d7bd52500a918fe

SHA1
6dc7692fd7de90448b74b35dd3a8417879885bb9

SHA256
3ef717454b9dbbb96f5eedf6f337f58636117d51818308922ff6a71b0ab95d6a

SHA512
22184ea5807501ec97b1752b84aede0c856b2d435891c94c1eec685b460326df402ea7935ad02abd70ee4673ede819fcb5f78873adb98fcb4554f701a02772ff

Download Submit
C:\Windows\system\QktfsEv.exe

Filesize
1.5MB

MD5
83344bd3a5efa7286b6a8d7702dcb6aa

SHA1
338bf8b21cca9f46742cbbdf285cc74ff4f33284

SHA256
c30e112f378ed4a226d451bf8942d68573a46f958fa1392841c0ec3f367b4198

SHA512
b8d9f1d3d1bb75e33e5c2a93286492c295d765f03ca993a7c16539b15cb1526bbeb715bdba4d0d3cc9eb9d11ae45cd2d0ab9e27be2d5a30d0ae69e801ee004b2

Download Submit
C:\Windows\system\TYBIAqy.exe

Filesize
1.5MB

MD5
05809601d5eada48db2d2366b1d43ac6

SHA1
90fed4a62eb104ce8773dde10e6f5605a3afcda2

SHA256
46c298f713cf1af52d1d3af9155bdeeb419818587f3606519f4368eeb4b391a9

SHA512
df8ce4b9dadce23a0e3eb5b78352fbd239bfb2f502112ecc0ef8f5bd4585a2848397c7cce1534b55de1cb4f767303aa931f352a84bde8dbde37e47ecab3a78df

Download Submit
C:\Windows\system\WRbnoJp.exe

Filesize
1.5MB

MD5
e7b7bd2ff166ccd8dcd36d2fc666a546

SHA1
48b42a09c75169a0ba314480e0cd7d634d773c60

SHA256
72dd688ad37be015460404b211c97fe659cb9dd663eae21f9a0457fa28fade90

SHA512
fc9de6ecf189f79896571661e65f9998f09dd6578aa7ce99995dee29b3ccbe4a3befbc60803dbd95dcb9c814c51382506a50148ee8cea046edf4e41bfecaa994

Download Submit
C:\Windows\system\aXMMmOg.exe

Filesize
1.5MB

MD5
5c2652e8615d63e49813741164c2a569

SHA1
706c13ab5fc22e7a191a4f847aa7feb4c2492629

SHA256
dc78f85470fe5b7272a8a14536716fd40b5ad40599450d36e275d33a3acdfa8c

SHA512
7bb6f049947baacb05eff6a711f528360d1606a915b44b13b2eed7f3d9ab97c5e15135d959b16c766e2946424b56331f6b476d0ac9bd0bbc9d060d647594e653

Download Submit
C:\Windows\system\aaBfKfE.exe

Filesize
1.5MB

MD5
84d0c005dcc71bcd7c635083c175a2cc

SHA1
283811207c12095f3c206ed1bfa07980833f3c92

SHA256
b92e27c4ec197092bebb6588009189553022e916cb20a4a93e4ef9174467ddde

SHA512
4afca71122e7b535f681033363c7e86ffcb3ba5b3980deee1a10af537622f6c18e9fb85df8a501788dfec9ec6c6d496c9f1b5944094e10a94e451cbe59da3096

Download Submit
C:\Windows\system\blqXKPH.exe

Filesize
1.5MB

MD5
979c8874c682475f1a61925d8679e5b4

SHA1
18f6023505c4c2320a5d077b1182c69dad6c6782

SHA256
487feb7bb4c442f5c4943c762a235ae807f501c3de48513257133d85a22d6890

SHA512
3944ab9f1541e29835f3a1ccd37d1c5c163357cee20e43d95b04e54ce916b70849f86e11374cc6405be8d35b3bf6a7b722966d6cc3b4f523b419931bdf7d6260

Download Submit
C:\Windows\system\cCExjhy.exe

Filesize
1.5MB

MD5
58ca7a7eb8225b13480652b2b54bd7cf

SHA1
44ee15ef420bf4fca4cc8e9c7f9475da0ce97bde

SHA256
00826af9d8e78e237e3bf8d7ce48e0866bbe78cd45a2db5365202bfd50d7b3a3

SHA512
8f154b0adf576d50f0dff5bdc68b6195b3471e661f99303c1829185b3950880ab8de5a6f7e380a83f8500014ee86b01795ede6f64b4f89723073fe6780e95ccf

Download Submit
C:\Windows\system\cCyqWCD.exe

Filesize
1.5MB

MD5
ff941e64e148c2736f5b03dce5eb52ed

SHA1
82de5fd824d789f819a279eaeb511902ae9acb2b

SHA256
5f331574d0e8a00ed543ea8e428b41f55a79a0d7283610b9f8727bfedcd440d1

SHA512
71428f34b94d060915aa487e9c578466c2b5d5bf5b37d1b525dd7ffbf98b73e2e4c98ad64e0c4f64d9b51ba80c32dd6895bcb75041398b0fa73eb97bf3fbc912

Download Submit
C:\Windows\system\dBDgJCX.exe

Filesize
1.5MB

MD5
f4ac2ed58fb6fe61329644cbadf71dfe

SHA1
e5ff864b06dd3a840fe78243442ec4df3f3499c5

SHA256
f9bb213af7518be73f868fc3b9efef0c96715c8d98b1778a20ee7861fbd46eb9

SHA512
c015bcfe8890850a3e0cff3f1ce0ff0a93ad5b352dc1424b24369674a6ac64a9ece0a80036b3da4cc4961cef289ef9d25c4c5afbf8ba0affcd2f831bc9d6b344

Download Submit
C:\Windows\system\eFKSdEY.exe

Filesize
1.5MB

MD5
278f157a1284b14517c71d70ce136acc

SHA1
f01ac028a948d0f5c746d97ae0493b240bbdde5f

SHA256
42a73baeeaf828266ba65567ff85a593f025697a6b7706432a4dd0f484e89d12

SHA512
96785ae9730c50e26aa7f1a4a4ae1feeca7c69cd6532a8169385f4ba3f7e76b7e69aed62204fe72a0c43652f8d3a9dc210c525fc4153e722fa4bfcf690051880

Download Submit
C:\Windows\system\ftpxTuJ.exe

Filesize
1.5MB

MD5
543202c7f72c3353dd4c955e22cc0b50

SHA1
db45b9b2f5ef5719ec0ed465860780729ebe0fab

SHA256
479f7933bc3d53b1effe664cac275b2d87140b81e230cd04eccc7aad99036578

SHA512
99f0aacbfe182996c376ca3ad4d6a0a95d115abccf83f96160810265dc22c6ccb3ee98fd1b74638780c516fd3d394005690fedc1c083daf36de6e9c22f223974

Download Submit
C:\Windows\system\grUsxPG.exe

Filesize
1.5MB

MD5
6502cc48a2d6199bd891ab9811e26b44

SHA1
88a202668305a586f7c3091a897e9ff2e405ae13

SHA256
376e3d76a91e46b483211acea862e370eabb826428d3df9d203d440bdcd4fd5c

SHA512
a09d6e6bf56ea79c1850bdbee018e7b015381b3a80aed15bdee1162fa4f1f63169203b529214dbc9cde55f17e905e7febdd75b59fc9e0191cdabebbbf959f370

Download Submit
C:\Windows\system\iXzUyOo.exe

Filesize
1.5MB

MD5
ad0af385bbc16dd9a332100f779dfe28

SHA1
f87b45b8e6c69c41e24769d2975a5bc04b5fa6b3

SHA256
1238866c0bcd2901ff5508e12ed5ccfaa2c0a0a7b051c04219f8b634ed20f966

SHA512
1c84927e439d36824a9471012f6b98854af9aa41ec9079c68ae8edd78b8b24d1eba29a539fa55eab9245680c44c92dbf9f0a83c9154464fa23b9bc2a288ff938

Download Submit
C:\Windows\system\kDPyjNW.exe

Filesize
1.5MB

MD5
778fefb9e30b96b9991ddd107b9fa8cc

SHA1
f84cf88a1d1d2b493f709957f8053664b8f93a03

SHA256
00c20ccc1dad4416c20116d3b5fbbf5375fcdb49e26f70779ef131224005464a

SHA512
b7b3319793720b9dc9aa764ab3419d878381371e77ce84db1164a60e1c95735c6a4b102652c08c8c150cb941d885784c13fe636b2ba17a45defca0021cbb26ec

Download Submit
C:\Windows\system\nfoCuRq.exe

Filesize
1.5MB

MD5
f83167ad54ccdcfc7cb54b5d2b999b6c

SHA1
370a07f46791a5273773855c2fdde9e274bf62e1

SHA256
3019b7ef13632981c92e6c095b84ca53eedcec6b25570816b59b9b6354ebc1ec

SHA512
660a6d2c45d669335d895bf10a2b85f6b335d19218d0a953dd36a41ada2ff0a680829f44726755dfa5cf4c60f675c9c6540f412a94ea1389136d36e1d5c6f39f

Download Submit
C:\Windows\system\nvwAySB.exe

Filesize
1.5MB

MD5
711c7e8c4762922cce41f51bd3b1b2fb

SHA1
02897151967cf05509a92faf32ba454f5267d9d2

SHA256
08aa28f1d743180d3c5591a3158e99fab5cc532c800df170e079a29fdd56286e

SHA512
cc81091e988644ff528599c78f2f9f9131653d814980ca7b28f707bd93a5bfa5955dd57d560768b491caef7e6949025cb3feb007042ce24a4e5876a03a0b58db

Download Submit
C:\Windows\system\pVPlIno.exe

Filesize
1.5MB

MD5
39a0f4ad7eb846dfd28f481de09065d3

SHA1
9ea407e9b1d71148e4ef4f027b2719092f65bac7

SHA256
19ceed602e3f56139822105b687d31572825dfb0f3d9d7f87af266ecb3809b70

SHA512
e73a2847b2909b45664f2c87859395b291a172d3ce2176c523dca4063a8eff99a42e7957383c34c148cc9dbcca7c030e56170032b9f14f29e0a87bfbabd86253

Download Submit
C:\Windows\system\qhVqtUY.exe

Filesize
1.5MB

MD5
1fc0eba8e81ead8c39b151c27a3b16e4

SHA1
dd975568c89c147a44d90b1f6eefd838d2a81732

SHA256
ec6f8e7ab15bf3baab28ca76d65450bfc359b7261c941ce00ec9886e4535170d

SHA512
4d5cec1f6c75d1abe97dc8fff66c2daf0fd9ad881b7ffeb13325920c65578465e6648cca0c95eb6ebef0df43b3ac211d14d0803b4ba41d2661097ccc226098ca

Download Submit
C:\Windows\system\sSWYzgd.exe

Filesize
1.5MB

MD5
fc64994c4a92030258a503e3a811abb1

SHA1
f2703822da9e900ff5aefd954c0a4298f5131c32

SHA256
260197725980a890d43ae30b22c9b4068bc4789f9c6b1adbe0a82d080ca16eec

SHA512
bbf84a9ae31e2a3eac2464c878e03651016d6a7aecb70263bb2b589c313bc1a4a5e2396843b2479fceec463b44e0f0327743b57ce7e0a8ae7855fbe9a7e109f1

Download Submit
C:\Windows\system\ysQbhJq.exe

Filesize
1.5MB

MD5
b99b827e54cada29b49d06b3ef3c25c7

SHA1
f63f1b51912ec39ade85162f6774362780db0847

SHA256
0229c1808521741759fe66774e4b8c8acf903f26367df0f74708d54e6846458a

SHA512
c054eb7d762e871b4e81a6f10fe6257822abb177ac6be0a97138650d269ef423b8dfbbcdb66512648fe9d8f34b35cf57716576ca097e2abe98c78f1e5756013a

Download Submit
\Windows\system\KjncqPN.exe

Filesize
1.5MB

MD5
ec576ef22aeff1635a4c3f78d1073479

SHA1
4860f97505f46333083004ed74466d22b8699e1d

SHA256
2034a4847b39c84f1c97f853f92287c2053c5e05889cb358abf3cfc0105eb45a

SHA512
381d61eb2beef4370c68d26f5824efd4d99986e5a5787ecb30ab9537847cf00acadb686f1d9ccd871cad14db4808f4c4aa39c09017a383b87a2359505938e71b

Download Submit
\Windows\system\RvGkvkz.exe

Filesize
1.5MB

MD5
876255ae8855a0117a6ead43c7a012e6

SHA1
33621f8e4e1dede9b0d3fd20f4dde919bac8412b

SHA256
f04b23eb36b8835c019e7884fb59088efe3c205be19a8c9df2d71e9787ee5753

SHA512
728b2d5af9f2643ce35b6abf999a814ceddd4aac347c53d50c1f39ca34ba669790048740ee3eb70e5109adfd55114b9489e289a739b4ce944b255a10e6830e17

Download Submit
\Windows\system\ZRjhLfF.exe

Filesize
1.5MB

MD5
c73888a40b77c7938cb602078e6cccf0

SHA1
8c89b784579fd8f47255841ed72cc94cf5a43745

SHA256
2b21b32dc403d5234336c735730b82cab521ce9b76bf0745403437d9256f3588

SHA512
84df31ee69d65464d1f10cc462bdbb0e3597cd9ba0468cfb81fefea8dbd1b7ea3b5ba6a3cd054f8d67d0f0931ccc898a27054e4d69c659d9180e1ab144d03915

Download Submit
\Windows\system\fZPMYph.exe

Filesize
1.5MB

MD5
0e29f9b64efbcd16428857e689f453c4

SHA1
f6657ff901c45efbb837c269eb219669d23ff788

SHA256
ab1623e668c1af31693d686e0acade577ae8f0e26379022820f8f4809bb4bef6

SHA512
a23fe82547d52623399a8cef75be5bf6267fbf2ba1b2af5b1c1c3b3c9712398a44228af3b9f2e48934ea1be0c4c0cf1c0d205213a6879d809d28b7768db794ea

Download Submit
\Windows\system\jsWUcln.exe

Filesize
1.5MB

MD5
f600050cb44b8affbfd305636e97c7fc

SHA1
96de67a5b47eaeef200764b085aae85f4a61c8bb

SHA256
741c7b75c9ee9bddafb7db8b254ae4f3e5454c4f291a644b5f786f5c530fb24e

SHA512
073bbb5d22c27a8defd0e90a9dd1bbd5c5b92058c11ead40970267251517cb968e0b47fe145e4df41ba88fe4150c9899385c17263d3c9a2d43917accbdc986de

Download Submit
\Windows\system\lyhWisc.exe

Filesize
1.5MB

MD5
70a244dc9106ed25873bbbd1821b0c8e

SHA1
eec3c9cb55d6e90b2489dcb575d1c8c12a2b5c95

SHA256
16d6128daf88c86b590b7a6edb72bb27c62be81a58fcaa82a926aa224f8cdb80

SHA512
205c9045aacbda97c4e4e1ba67ae25e03c609d15c155ab24c2c3428563296f90ab2ffe66679d576216a2e6ec8e0a6a4f9c8a3cf7d1766768324f1d371524aa37

Download Submit
\Windows\system\shpHnes.exe

Filesize
1.5MB

MD5
74ea2a0121078fbb4c0597c2fa658a6d

SHA1
daab820162d66b928860773e0510244e9d2472d1

SHA256
beb834ec8edcc3dcd20d5ac01f1fcda64ef4bd88e7569428612f1448e229a3be

SHA512
3ed29cf38fe81f7bf3f7b60119046a3e9ec6bef3ed1c5bdcbc040d1dc6a949a66f2f4282b25014ee552dced0ad188aa964df0047cec52c073ce2b3adab64c8dd

Download Submit
\Windows\system\uJthVSo.exe

Filesize
1.5MB

MD5
4f0a5df016de896d7386dde68918d8b3

SHA1
4a431621a63c85a54f6efa40de4541f759170224

SHA256
6d877a6edc68ddfe0f8fd51ab8b8d95c3df9d5d22e0201ffed17711d42e9a272

SHA512
887a8c6db0322ab287849914f25dc34e49c1b3bf0ca6229db1126d052916cf7f14e44fca513e833cadf75ae5628769c7e8db61ac99d208d9ba24777625e77ac0

Download Submit
\Windows\system\zYmtMzp.exe

Filesize
1.5MB

MD5
43b3ad2f5419d18e6795a546aa0bffe8

SHA1
37baebb8cb191e0b45cad421e71a00d87bd89785

SHA256
0da06d52317d30da6f1cfbf051d8039d4170623a7b86aedf67cef4cec9de7094

SHA512
66f66e7ea5fb0538ec0f631aced70e85c97e03285d4eedf72400d1cecd4b833a6438159b5953ebeb9cb24353aea4c7d39f714dd6529674cac099e8fa0236981c

Download Submit
memory/948-70-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1504-69-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1504-8-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-7-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2072-14-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2072-1-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2072-43-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-60-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2072-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2072-30-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2072-66-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2072-129-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2072-104-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download
memory/2072-47-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2072-50-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2164-54-0x000000013FE00000-0x00000001401F2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-48-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/2448-1171-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-45-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-28-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2568-62-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2612-31-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2612-93-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-29-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2612-24-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-71-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-34-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2612-33-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2612-27-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2612-26-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2672-32-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-106-0x000000013F090000-0x000000013F482000-memory.dmp

Filesize
3.9MB

Download