xmrig | 4899aeba7f8a001cdf8d7d386a51f71cf8a59e3f1e1d7d15d320802f6e602e5c

Analysis

max time kernel
26s
max time network
17s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Size

1.9MB
MD5

0b63b4471859f9a530c952c4b4741407
SHA1

1cc2ee1127181bf23c11555a7a376844335ce0f5
SHA256

4899aeba7f8a001cdf8d7d386a51f71cf8a59e3f1e1d7d15d320802f6e602e5c
SHA512

74f40b2a4dc683d8e54a85e4cd56df7b8d1feb00923eceb1781a1580c80966ab20c3022d81faa29209c29ff5a5bb00204b9cb8bbeb3ead8d2f04b882368b659d
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1M:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2480-80-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2292-78-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2572-75-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2460-74-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2536-71-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2596-62-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2620-38-0x000000013F6A0000-0x000000013FA92000-memory.dmp	xmrig
behavioral1/memory/2736-319-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2156-701-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2736	aSdiHlc.exe
2156	Lebzpld.exe
2672	AiSeRPs.exe
2620	sckOknQ.exe
2596	PrtcMUJ.exe
2460	YupLbiG.exe
2536	etXNBKG.exe
2572	deJVukG.exe
2480	YgJZsqj.exe
2960	mqYVXSC.exe
1644	aeQmjaW.exe
348	SjuhvJz.exe
2448	ZbyedqP.exe
2824	DRecQNe.exe
2752	MUYdCKa.exe
2952	ZADqFhU.exe
1460	YiBtckN.exe
2788	tNwbgsS.exe
1568	RaMOAWh.exe
2980	GqshlyU.exe
1408	bVVvNNy.exe
1444	mCwihwN.exe
1536	QhGGLER.exe
2836	BnJfInF.exe
2908	yqunZJd.exe
2352	jNGMVKz.exe
684	hTQJdOp.exe
404	ouaNlDy.exe
2108	cRwjvsv.exe
1496	wsmKxfr.exe
1868	UcPmHbY.exe
1792	aInYzJe.exe
412	qhAdKnz.exe
2428	SONuKtE.exe
2280	xAcIVNx.exe
1404	DRceego.exe
1572	xNiyQhE.exe
1328	FGSeSzy.exe
1052	iZUQXjS.exe
1596	dxIKHWX.exe
976	HZXLRmY.exe
1064	xwyJxYO.exe
1096	QDdXBpR.exe
2072	RDyYFIb.exe
896	UlTNzdw.exe
816	axzDHtt.exe
2160	aUvYFUr.exe
1004	unCAJtl.exe
2420	mgrCOwc.exe
2184	ePArfJg.exe
1720	YXVlADY.exe
2204	cdqiuPJ.exe
2356	xMTSqVi.exe
1628	sKfxZSh.exe
1948	jTkZwiz.exe
3068	TiQMfaJ.exe
2604	kdIGNtE.exe
1712	rEqdOWW.exe
2632	chPphjJ.exe
1960	xUMNsYT.exe
2088	wveaWiY.exe
2300	cpNFPhH.exe
2676	UQZxWug.exe
1448	BtClePV.exe

Loads dropped DLL 64 IoCs

pid	Process
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2292-0-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x000c00000001342e-6.dat	upx
behavioral1/memory/2736-8-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0038000000013adc-9.dat	upx
behavioral1/files/0x000700000001418c-14.dat	upx
behavioral1/files/0x0007000000014251-28.dat	upx
behavioral1/memory/2672-27-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/memory/2156-18-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x0016000000005586-39.dat	upx
behavioral1/files/0x000a00000001432f-43.dat	upx
behavioral1/files/0x0006000000014b1c-54.dat	upx
behavioral1/files/0x0008000000014367-46.dat	upx
behavioral1/files/0x0006000000014c2d-84.dat	upx
behavioral1/memory/2480-80-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/memory/2292-78-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/files/0x0006000000014bd7-77.dat	upx
behavioral1/files/0x0007000000014a60-76.dat	upx
behavioral1/memory/2572-75-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2460-74-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2536-71-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2596-62-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/memory/2620-38-0x000000013F6A0000-0x000000013FA92000-memory.dmp	upx
behavioral1/files/0x0035000000013f2c-92.dat	upx
behavioral1/files/0x0006000000015083-98.dat	upx
behavioral1/files/0x00060000000153ee-105.dat	upx
behavioral1/files/0x0006000000015ae3-118.dat	upx
behavioral1/files/0x0006000000014f57-87.dat	upx
behavioral1/files/0x0006000000015662-112.dat	upx
behavioral1/files/0x0006000000015b85-138.dat	upx
behavioral1/files/0x00060000000158d9-141.dat	upx
behavioral1/files/0x000600000001565a-108.dat	upx
behavioral1/files/0x0006000000015c9a-149.dat	upx
behavioral1/files/0x0006000000015cf8-184.dat	upx
behavioral1/memory/2736-319-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x0006000000015d0a-189.dat	upx
behavioral1/files/0x0006000000015cee-179.dat	upx
behavioral1/files/0x0006000000015ce3-174.dat	upx
behavioral1/files/0x0006000000015cd2-170.dat	upx
behavioral1/files/0x0006000000015cc5-164.dat	upx
behavioral1/files/0x0006000000015cb1-160.dat	upx
behavioral1/files/0x0006000000015ca8-154.dat	upx
behavioral1/files/0x0006000000015b50-147.dat	upx
behavioral1/files/0x00060000000150d9-130.dat	upx
behavioral1/files/0x000600000001507a-129.dat	upx
behavioral1/memory/2156-701-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KRtcgGK.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\MqECwgm.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\jZHHBhK.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\FsegXqC.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\pZrejYU.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\SPscUXW.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\xNiyQhE.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\OpTgzFP.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\JeFZpHz.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\DTLKlPH.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\fqjMOQr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\LpVsNco.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\MGVGEUx.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\yLNbXQf.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\iczHQjS.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\YupLbiG.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\KYncMVi.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\vfvZJFj.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\SHnENDB.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\IyDHxNB.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\LxXIkoD.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\bxXHVFo.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\QDjMYhp.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\pRVhrbJ.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\qVZiwvu.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\uByySYp.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\yIGuUlX.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\JEOIrRD.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\gmYixfy.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\iEbqDIb.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\emjsYpc.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\knkFwTk.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\wZfEKAq.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ZEAkHgE.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\espyeZO.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\CrWnguR.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\vBwIdlD.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\tNKuNka.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\jHqlInf.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\nuOztlN.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\iQOopcc.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\zoRbukr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\lGcClLb.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\cwrOKmm.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\IopJaHU.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\rEkWBso.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\yvrltwj.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\VAOAVUl.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\VJzcEPr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\AGaBVuc.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ckvCgdA.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\xpSbEyI.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\LrUvBdH.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\uMDveuN.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\CGUuuAU.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\xagptLf.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\dnpdXbi.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\NQSSlOw.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\yxEJTbr.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\uzhYrGL.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\qqZuBOA.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\ckcBqEz.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\bWCOHwR.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
File created	C:\Windows\System\GXBRjms.exe	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2296	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
Token: SeDebugPrivilege	2296	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2296	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	29
PID 2292 wrote to memory of 2296	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	29
PID 2292 wrote to memory of 2296	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	29
PID 2292 wrote to memory of 2736	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2736	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2736	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	30
PID 2292 wrote to memory of 2156	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2156	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2156	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	31
PID 2292 wrote to memory of 2672	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	32
PID 2292 wrote to memory of 2672	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	32
PID 2292 wrote to memory of 2672	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	32
PID 2292 wrote to memory of 2620	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2620	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2620	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	33
PID 2292 wrote to memory of 2596	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	34
PID 2292 wrote to memory of 2596	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	34
PID 2292 wrote to memory of 2596	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	34
PID 2292 wrote to memory of 2572	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	35
PID 2292 wrote to memory of 2572	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	35
PID 2292 wrote to memory of 2572	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	35
PID 2292 wrote to memory of 2460	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2460	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2460	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	36
PID 2292 wrote to memory of 2480	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	37
PID 2292 wrote to memory of 2480	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	37
PID 2292 wrote to memory of 2480	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	37
PID 2292 wrote to memory of 2536	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	38
PID 2292 wrote to memory of 2536	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	38
PID 2292 wrote to memory of 2536	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	38
PID 2292 wrote to memory of 2960	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	39
PID 2292 wrote to memory of 2960	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	39
PID 2292 wrote to memory of 2960	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	39
PID 2292 wrote to memory of 1644	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	40
PID 2292 wrote to memory of 1644	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	40
PID 2292 wrote to memory of 1644	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	40
PID 2292 wrote to memory of 2448	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	41
PID 2292 wrote to memory of 2448	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	41
PID 2292 wrote to memory of 2448	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	41
PID 2292 wrote to memory of 348	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	42
PID 2292 wrote to memory of 348	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	42
PID 2292 wrote to memory of 348	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	42
PID 2292 wrote to memory of 2788	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	43
PID 2292 wrote to memory of 2788	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	43
PID 2292 wrote to memory of 2788	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	43
PID 2292 wrote to memory of 2824	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	44
PID 2292 wrote to memory of 2824	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	44
PID 2292 wrote to memory of 2824	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	44
PID 2292 wrote to memory of 1568	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	45
PID 2292 wrote to memory of 1568	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	45
PID 2292 wrote to memory of 1568	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	45
PID 2292 wrote to memory of 2752	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	46
PID 2292 wrote to memory of 2752	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	46
PID 2292 wrote to memory of 2752	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	46
PID 2292 wrote to memory of 2980	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	47
PID 2292 wrote to memory of 2980	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	47
PID 2292 wrote to memory of 2980	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	47
PID 2292 wrote to memory of 2952	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	48
PID 2292 wrote to memory of 2952	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	48
PID 2292 wrote to memory of 2952	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	48
PID 2292 wrote to memory of 1444	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	49
PID 2292 wrote to memory of 1444	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	49
PID 2292 wrote to memory of 1444	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	49
PID 2292 wrote to memory of 1460	2292	0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b63b4471859f9a530c952c4b4741407_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296
- C:\Windows\System\aSdiHlc.exe
  C:\Windows\System\aSdiHlc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\Lebzpld.exe
  C:\Windows\System\Lebzpld.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\AiSeRPs.exe
  C:\Windows\System\AiSeRPs.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\sckOknQ.exe
  C:\Windows\System\sckOknQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\PrtcMUJ.exe
  C:\Windows\System\PrtcMUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\deJVukG.exe
  C:\Windows\System\deJVukG.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\YupLbiG.exe
  C:\Windows\System\YupLbiG.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\YgJZsqj.exe
  C:\Windows\System\YgJZsqj.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\etXNBKG.exe
  C:\Windows\System\etXNBKG.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\mqYVXSC.exe
  C:\Windows\System\mqYVXSC.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\aeQmjaW.exe
  C:\Windows\System\aeQmjaW.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ZbyedqP.exe
  C:\Windows\System\ZbyedqP.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\SjuhvJz.exe
  C:\Windows\System\SjuhvJz.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\tNwbgsS.exe
  C:\Windows\System\tNwbgsS.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\DRecQNe.exe
  C:\Windows\System\DRecQNe.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\RaMOAWh.exe
  C:\Windows\System\RaMOAWh.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\MUYdCKa.exe
  C:\Windows\System\MUYdCKa.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\GqshlyU.exe
  C:\Windows\System\GqshlyU.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\ZADqFhU.exe
  C:\Windows\System\ZADqFhU.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\mCwihwN.exe
  C:\Windows\System\mCwihwN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\YiBtckN.exe
  C:\Windows\System\YiBtckN.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\QhGGLER.exe
  C:\Windows\System\QhGGLER.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\bVVvNNy.exe
  C:\Windows\System\bVVvNNy.exe
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Windows\System\BnJfInF.exe
  C:\Windows\System\BnJfInF.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\yqunZJd.exe
  C:\Windows\System\yqunZJd.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\jNGMVKz.exe
  C:\Windows\System\jNGMVKz.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\hTQJdOp.exe
  C:\Windows\System\hTQJdOp.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\ouaNlDy.exe
  C:\Windows\System\ouaNlDy.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\cRwjvsv.exe
  C:\Windows\System\cRwjvsv.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\wsmKxfr.exe
  C:\Windows\System\wsmKxfr.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\UcPmHbY.exe
  C:\Windows\System\UcPmHbY.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\aInYzJe.exe
  C:\Windows\System\aInYzJe.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\qhAdKnz.exe
  C:\Windows\System\qhAdKnz.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\SONuKtE.exe
  C:\Windows\System\SONuKtE.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\xAcIVNx.exe
  C:\Windows\System\xAcIVNx.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\DRceego.exe
  C:\Windows\System\DRceego.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\xNiyQhE.exe
  C:\Windows\System\xNiyQhE.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\dxIKHWX.exe
  C:\Windows\System\dxIKHWX.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\FGSeSzy.exe
  C:\Windows\System\FGSeSzy.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\QDdXBpR.exe
  C:\Windows\System\QDdXBpR.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\iZUQXjS.exe
  C:\Windows\System\iZUQXjS.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\RDyYFIb.exe
  C:\Windows\System\RDyYFIb.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\HZXLRmY.exe
  C:\Windows\System\HZXLRmY.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\UlTNzdw.exe
  C:\Windows\System\UlTNzdw.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\xwyJxYO.exe
  C:\Windows\System\xwyJxYO.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\axzDHtt.exe
  C:\Windows\System\axzDHtt.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\aUvYFUr.exe
  C:\Windows\System\aUvYFUr.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\unCAJtl.exe
  C:\Windows\System\unCAJtl.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\mgrCOwc.exe
  C:\Windows\System\mgrCOwc.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ePArfJg.exe
  C:\Windows\System\ePArfJg.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\YXVlADY.exe
  C:\Windows\System\YXVlADY.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\cdqiuPJ.exe
  C:\Windows\System\cdqiuPJ.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\xMTSqVi.exe
  C:\Windows\System\xMTSqVi.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\sKfxZSh.exe
  C:\Windows\System\sKfxZSh.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\jTkZwiz.exe
  C:\Windows\System\jTkZwiz.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\TiQMfaJ.exe
  C:\Windows\System\TiQMfaJ.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\kdIGNtE.exe
  C:\Windows\System\kdIGNtE.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\rEqdOWW.exe
  C:\Windows\System\rEqdOWW.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\chPphjJ.exe
  C:\Windows\System\chPphjJ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xUMNsYT.exe
  C:\Windows\System\xUMNsYT.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\wveaWiY.exe
  C:\Windows\System\wveaWiY.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\cpNFPhH.exe
  C:\Windows\System\cpNFPhH.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\UQZxWug.exe
  C:\Windows\System\UQZxWug.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\BtClePV.exe
  C:\Windows\System\BtClePV.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\pLBgIye.exe
  C:\Windows\System\pLBgIye.exe
  2⤵
  PID:1700
- C:\Windows\System\dExFfGK.exe
  C:\Windows\System\dExFfGK.exe
  2⤵
  PID:1812
- C:\Windows\System\uhRHdSu.exe
  C:\Windows\System\uhRHdSu.exe
  2⤵
  PID:1552
- C:\Windows\System\VybUsUH.exe
  C:\Windows\System\VybUsUH.exe
  2⤵
  PID:1768
- C:\Windows\System\OoeuqqA.exe
  C:\Windows\System\OoeuqqA.exe
  2⤵
  PID:3064
- C:\Windows\System\XEexEKk.exe
  C:\Windows\System\XEexEKk.exe
  2⤵
  PID:2348
- C:\Windows\System\DlAdUMM.exe
  C:\Windows\System\DlAdUMM.exe
  2⤵
  PID:2804
- C:\Windows\System\OJdeEDx.exe
  C:\Windows\System\OJdeEDx.exe
  2⤵
  PID:908
- C:\Windows\System\GEtUWrd.exe
  C:\Windows\System\GEtUWrd.exe
  2⤵
  PID:2556
- C:\Windows\System\cCLIlDp.exe
  C:\Windows\System\cCLIlDp.exe
  2⤵
  PID:1800
- C:\Windows\System\mxRcihQ.exe
  C:\Windows\System\mxRcihQ.exe
  2⤵
  PID:1940
- C:\Windows\System\pSNIroX.exe
  C:\Windows\System\pSNIroX.exe
  2⤵
  PID:452
- C:\Windows\System\TjglvyJ.exe
  C:\Windows\System\TjglvyJ.exe
  2⤵
  PID:1388
- C:\Windows\System\KkCeSto.exe
  C:\Windows\System\KkCeSto.exe
  2⤵
  PID:2272
- C:\Windows\System\xsYcYmO.exe
  C:\Windows\System\xsYcYmO.exe
  2⤵
  PID:1760
- C:\Windows\System\rXRPuRp.exe
  C:\Windows\System\rXRPuRp.exe
  2⤵
  PID:1636
- C:\Windows\System\wyOSKFX.exe
  C:\Windows\System\wyOSKFX.exe
  2⤵
  PID:968
- C:\Windows\System\MDtfPXV.exe
  C:\Windows\System\MDtfPXV.exe
  2⤵
  PID:888
- C:\Windows\System\JTsyEzU.exe
  C:\Windows\System\JTsyEzU.exe
  2⤵
  PID:2660
- C:\Windows\System\uyIJPqN.exe
  C:\Windows\System\uyIJPqN.exe
  2⤵
  PID:2560
- C:\Windows\System\OcYwafD.exe
  C:\Windows\System\OcYwafD.exe
  2⤵
  PID:920
- C:\Windows\System\eAzshsK.exe
  C:\Windows\System\eAzshsK.exe
  2⤵
  PID:320
- C:\Windows\System\LhrRTiY.exe
  C:\Windows\System\LhrRTiY.exe
  2⤵
  PID:1316
- C:\Windows\System\krRyGtg.exe
  C:\Windows\System\krRyGtg.exe
  2⤵
  PID:1896
- C:\Windows\System\QawGEWQ.exe
  C:\Windows\System\QawGEWQ.exe
  2⤵
  PID:900
- C:\Windows\System\nsdKRlz.exe
  C:\Windows\System\nsdKRlz.exe
  2⤵
  PID:2928
- C:\Windows\System\vmhlejw.exe
  C:\Windows\System\vmhlejw.exe
  2⤵
  PID:904
- C:\Windows\System\hLFvoIP.exe
  C:\Windows\System\hLFvoIP.exe
  2⤵
  PID:2372
- C:\Windows\System\JEprcXa.exe
  C:\Windows\System\JEprcXa.exe
  2⤵
  PID:1620
- C:\Windows\System\alwxIgN.exe
  C:\Windows\System\alwxIgN.exe
  2⤵
  PID:2608
- C:\Windows\System\WXxhsCo.exe
  C:\Windows\System\WXxhsCo.exe
  2⤵
  PID:2488
- C:\Windows\System\HKGVggG.exe
  C:\Windows\System\HKGVggG.exe
  2⤵
  PID:2956
- C:\Windows\System\IcbWpKT.exe
  C:\Windows\System\IcbWpKT.exe
  2⤵
  PID:1900
- C:\Windows\System\PYoXLaz.exe
  C:\Windows\System\PYoXLaz.exe
  2⤵
  PID:2496
- C:\Windows\System\GHwxWoF.exe
  C:\Windows\System\GHwxWoF.exe
  2⤵
  PID:2776
- C:\Windows\System\XGEHdxE.exe
  C:\Windows\System\XGEHdxE.exe
  2⤵
  PID:2340
- C:\Windows\System\xbyGgCX.exe
  C:\Windows\System\xbyGgCX.exe
  2⤵
  PID:2456
- C:\Windows\System\ETSlAHP.exe
  C:\Windows\System\ETSlAHP.exe
  2⤵
  PID:776
- C:\Windows\System\MVupciL.exe
  C:\Windows\System\MVupciL.exe
  2⤵
  PID:2624
- C:\Windows\System\JEzcezK.exe
  C:\Windows\System\JEzcezK.exe
  2⤵
  PID:336
- C:\Windows\System\uMccxuE.exe
  C:\Windows\System\uMccxuE.exe
  2⤵
  PID:1744
- C:\Windows\System\wMACxfv.exe
  C:\Windows\System\wMACxfv.exe
  2⤵
  PID:2308
- C:\Windows\System\YGPoOrL.exe
  C:\Windows\System\YGPoOrL.exe
  2⤵
  PID:1624
- C:\Windows\System\wdYUVAk.exe
  C:\Windows\System\wdYUVAk.exe
  2⤵
  PID:2852
- C:\Windows\System\IQtZNhj.exe
  C:\Windows\System\IQtZNhj.exe
  2⤵
  PID:2864
- C:\Windows\System\LlEUikK.exe
  C:\Windows\System\LlEUikK.exe
  2⤵
  PID:2388
- C:\Windows\System\KpyUYoN.exe
  C:\Windows\System\KpyUYoN.exe
  2⤵
  PID:2344
- C:\Windows\System\RVisoSG.exe
  C:\Windows\System\RVisoSG.exe
  2⤵
  PID:924
- C:\Windows\System\HouxNin.exe
  C:\Windows\System\HouxNin.exe
  2⤵
  PID:1516
- C:\Windows\System\DTLKlPH.exe
  C:\Windows\System\DTLKlPH.exe
  2⤵
  PID:2508
- C:\Windows\System\nqXtjlK.exe
  C:\Windows\System\nqXtjlK.exe
  2⤵
  PID:2416
- C:\Windows\System\BoDbicy.exe
  C:\Windows\System\BoDbicy.exe
  2⤵
  PID:1752
- C:\Windows\System\oQVzWSZ.exe
  C:\Windows\System\oQVzWSZ.exe
  2⤵
  PID:1048
- C:\Windows\System\YHLPexo.exe
  C:\Windows\System\YHLPexo.exe
  2⤵
  PID:2116
- C:\Windows\System\bfhrXBp.exe
  C:\Windows\System\bfhrXBp.exe
  2⤵
  PID:572
- C:\Windows\System\cCNLAtq.exe
  C:\Windows\System\cCNLAtq.exe
  2⤵
  PID:2224
- C:\Windows\System\BOtiFca.exe
  C:\Windows\System\BOtiFca.exe
  2⤵
  PID:1980
- C:\Windows\System\QpJBYvz.exe
  C:\Windows\System\QpJBYvz.exe
  2⤵
  PID:1600
- C:\Windows\System\uCAnUrE.exe
  C:\Windows\System\uCAnUrE.exe
  2⤵
  PID:1672
- C:\Windows\System\xteIkTH.exe
  C:\Windows\System\xteIkTH.exe
  2⤵
  PID:2652
- C:\Windows\System\LmUjbdx.exe
  C:\Windows\System\LmUjbdx.exe
  2⤵
  PID:2252
- C:\Windows\System\aXuabsQ.exe
  C:\Windows\System\aXuabsQ.exe
  2⤵
  PID:2832
- C:\Windows\System\jZHHBhK.exe
  C:\Windows\System\jZHHBhK.exe
  2⤵
  PID:864
- C:\Windows\System\koMMhpN.exe
  C:\Windows\System\koMMhpN.exe
  2⤵
  PID:2636
- C:\Windows\System\hFlddVr.exe
  C:\Windows\System\hFlddVr.exe
  2⤵
  PID:1872
- C:\Windows\System\YSeGjPP.exe
  C:\Windows\System\YSeGjPP.exe
  2⤵
  PID:1112
- C:\Windows\System\ummEaao.exe
  C:\Windows\System\ummEaao.exe
  2⤵
  PID:2036
- C:\Windows\System\PtTApMQ.exe
  C:\Windows\System\PtTApMQ.exe
  2⤵
  PID:2336
- C:\Windows\System\modtMOM.exe
  C:\Windows\System\modtMOM.exe
  2⤵
  PID:2768
- C:\Windows\System\ckMfACk.exe
  C:\Windows\System\ckMfACk.exe
  2⤵
  PID:480
- C:\Windows\System\OoetzNE.exe
  C:\Windows\System\OoetzNE.exe
  2⤵
  PID:1520
- C:\Windows\System\dmdslJk.exe
  C:\Windows\System\dmdslJk.exe
  2⤵
  PID:2664
- C:\Windows\System\CYvqloS.exe
  C:\Windows\System\CYvqloS.exe
  2⤵
  PID:1880
- C:\Windows\System\dpooLJR.exe
  C:\Windows\System\dpooLJR.exe
  2⤵
  PID:2220
- C:\Windows\System\kIAfhtD.exe
  C:\Windows\System\kIAfhtD.exe
  2⤵
  PID:3056
- C:\Windows\System\cHQJelG.exe
  C:\Windows\System\cHQJelG.exe
  2⤵
  PID:1300
- C:\Windows\System\YXocmBN.exe
  C:\Windows\System\YXocmBN.exe
  2⤵
  PID:1684
- C:\Windows\System\nxhomKY.exe
  C:\Windows\System\nxhomKY.exe
  2⤵
  PID:1196
- C:\Windows\System\LIIfqiR.exe
  C:\Windows\System\LIIfqiR.exe
  2⤵
  PID:1320
- C:\Windows\System\nOIZfdW.exe
  C:\Windows\System\nOIZfdW.exe
  2⤵
  PID:2080
- C:\Windows\System\zYyRZjo.exe
  C:\Windows\System\zYyRZjo.exe
  2⤵
  PID:2740
- C:\Windows\System\sPGSZaW.exe
  C:\Windows\System\sPGSZaW.exe
  2⤵
  PID:2196
- C:\Windows\System\jmPhzmN.exe
  C:\Windows\System\jmPhzmN.exe
  2⤵
  PID:2856
- C:\Windows\System\pQhRDnk.exe
  C:\Windows\System\pQhRDnk.exe
  2⤵
  PID:3044
- C:\Windows\System\KmePfbS.exe
  C:\Windows\System\KmePfbS.exe
  2⤵
  PID:2128
- C:\Windows\System\vYwRpLb.exe
  C:\Windows\System\vYwRpLb.exe
  2⤵
  PID:1820
- C:\Windows\System\rKKQrTt.exe
  C:\Windows\System\rKKQrTt.exe
  2⤵
  PID:2440
- C:\Windows\System\ECcNTVL.exe
  C:\Windows\System\ECcNTVL.exe
  2⤵
  PID:2176
- C:\Windows\System\NoiDMSe.exe
  C:\Windows\System\NoiDMSe.exe
  2⤵
  PID:1028
- C:\Windows\System\APbUhtA.exe
  C:\Windows\System\APbUhtA.exe
  2⤵
  PID:2600
- C:\Windows\System\ucFqPJd.exe
  C:\Windows\System\ucFqPJd.exe
  2⤵
  PID:112
- C:\Windows\System\mVBzVJb.exe
  C:\Windows\System\mVBzVJb.exe
  2⤵
  PID:2492
- C:\Windows\System\rrZUAOG.exe
  C:\Windows\System\rrZUAOG.exe
  2⤵
  PID:2312
- C:\Windows\System\AvUzlIS.exe
  C:\Windows\System\AvUzlIS.exe
  2⤵
  PID:2988
- C:\Windows\System\LfHPaJu.exe
  C:\Windows\System\LfHPaJu.exe
  2⤵
  PID:2328
- C:\Windows\System\zXUjFhS.exe
  C:\Windows\System\zXUjFhS.exe
  2⤵
  PID:1456
- C:\Windows\System\thwBlZR.exe
  C:\Windows\System\thwBlZR.exe
  2⤵
  PID:1748
- C:\Windows\System\xtaJLMr.exe
  C:\Windows\System\xtaJLMr.exe
  2⤵
  PID:584
- C:\Windows\System\pQKyiJS.exe
  C:\Windows\System\pQKyiJS.exe
  2⤵
  PID:880
- C:\Windows\System\yIMHhIf.exe
  C:\Windows\System\yIMHhIf.exe
  2⤵
  PID:2316
- C:\Windows\System\yZRbTEH.exe
  C:\Windows\System\yZRbTEH.exe
  2⤵
  PID:1648
- C:\Windows\System\LRsSrHM.exe
  C:\Windows\System\LRsSrHM.exe
  2⤵
  PID:3040
- C:\Windows\System\uqcyTQD.exe
  C:\Windows\System\uqcyTQD.exe
  2⤵
  PID:1784
- C:\Windows\System\LUveqGj.exe
  C:\Windows\System\LUveqGj.exe
  2⤵
  PID:2764
- C:\Windows\System\WlpehAA.exe
  C:\Windows\System\WlpehAA.exe
  2⤵
  PID:588
- C:\Windows\System\FkwARoT.exe
  C:\Windows\System\FkwARoT.exe
  2⤵
  PID:596
- C:\Windows\System\Xuesrmq.exe
  C:\Windows\System\Xuesrmq.exe
  2⤵
  PID:1824
- C:\Windows\System\TqSCiGz.exe
  C:\Windows\System\TqSCiGz.exe
  2⤵
  PID:2784
- C:\Windows\System\ADSUEUd.exe
  C:\Windows\System\ADSUEUd.exe
  2⤵
  PID:3084
- C:\Windows\System\gKWXmqm.exe
  C:\Windows\System\gKWXmqm.exe
  2⤵
  PID:3104
- C:\Windows\System\pAVOJTZ.exe
  C:\Windows\System\pAVOJTZ.exe
  2⤵
  PID:3120
- C:\Windows\System\iGFTThH.exe
  C:\Windows\System\iGFTThH.exe
  2⤵
  PID:3136
- C:\Windows\System\UNevmsl.exe
  C:\Windows\System\UNevmsl.exe
  2⤵
  PID:3152
- C:\Windows\System\ejFAOvT.exe
  C:\Windows\System\ejFAOvT.exe
  2⤵
  PID:3168
- C:\Windows\System\EhjYeZV.exe
  C:\Windows\System\EhjYeZV.exe
  2⤵
  PID:3184
- C:\Windows\System\uEIftFe.exe
  C:\Windows\System\uEIftFe.exe
  2⤵
  PID:3200
- C:\Windows\System\MDuMpZc.exe
  C:\Windows\System\MDuMpZc.exe
  2⤵
  PID:3220
- C:\Windows\System\DelWNkS.exe
  C:\Windows\System\DelWNkS.exe
  2⤵
  PID:3240
- C:\Windows\System\TBuMILF.exe
  C:\Windows\System\TBuMILF.exe
  2⤵
  PID:3260
- C:\Windows\System\jxKSllL.exe
  C:\Windows\System\jxKSllL.exe
  2⤵
  PID:3276
- C:\Windows\System\iElApyz.exe
  C:\Windows\System\iElApyz.exe
  2⤵
  PID:3292
- C:\Windows\System\DNuFhic.exe
  C:\Windows\System\DNuFhic.exe
  2⤵
  PID:3308
- C:\Windows\System\nJbOfwl.exe
  C:\Windows\System\nJbOfwl.exe
  2⤵
  PID:3324
- C:\Windows\System\qkMFmhq.exe
  C:\Windows\System\qkMFmhq.exe
  2⤵
  PID:3340
- C:\Windows\System\YbKMTuf.exe
  C:\Windows\System\YbKMTuf.exe
  2⤵
  PID:3356
- C:\Windows\System\IRLMZOU.exe
  C:\Windows\System\IRLMZOU.exe
  2⤵
  PID:3372
- C:\Windows\System\HsaUKTS.exe
  C:\Windows\System\HsaUKTS.exe
  2⤵
  PID:3388
- C:\Windows\System\sbWIEUx.exe
  C:\Windows\System\sbWIEUx.exe
  2⤵
  PID:3404
- C:\Windows\System\wIBjlje.exe
  C:\Windows\System\wIBjlje.exe
  2⤵
  PID:3420
- C:\Windows\System\NmpEcuB.exe
  C:\Windows\System\NmpEcuB.exe
  2⤵
  PID:3528
- C:\Windows\System\XnuYNPo.exe
  C:\Windows\System\XnuYNPo.exe
  2⤵
  PID:3552
- C:\Windows\System\AifqETo.exe
  C:\Windows\System\AifqETo.exe
  2⤵
  PID:3568
- C:\Windows\System\AzTRZGN.exe
  C:\Windows\System\AzTRZGN.exe
  2⤵
  PID:3584
- C:\Windows\System\hpyzxpn.exe
  C:\Windows\System\hpyzxpn.exe
  2⤵
  PID:3600
- C:\Windows\System\RRKXDAz.exe
  C:\Windows\System\RRKXDAz.exe
  2⤵
  PID:3616
- C:\Windows\System\yqPOlFn.exe
  C:\Windows\System\yqPOlFn.exe
  2⤵
  PID:3632
- C:\Windows\System\OZuFpze.exe
  C:\Windows\System\OZuFpze.exe
  2⤵
  PID:3648
- C:\Windows\System\HzQowwi.exe
  C:\Windows\System\HzQowwi.exe
  2⤵
  PID:3664
- C:\Windows\System\YpyNQWH.exe
  C:\Windows\System\YpyNQWH.exe
  2⤵
  PID:3684
- C:\Windows\System\MEhokAI.exe
  C:\Windows\System\MEhokAI.exe
  2⤵
  PID:3700
- C:\Windows\System\chDshYA.exe
  C:\Windows\System\chDshYA.exe
  2⤵
  PID:3732
- C:\Windows\System\EHdknxr.exe
  C:\Windows\System\EHdknxr.exe
  2⤵
  PID:3764
- C:\Windows\System\ARPVxRa.exe
  C:\Windows\System\ARPVxRa.exe
  2⤵
  PID:3780
- C:\Windows\System\ttqXQGY.exe
  C:\Windows\System\ttqXQGY.exe
  2⤵
  PID:3796
- C:\Windows\System\igWxggr.exe
  C:\Windows\System\igWxggr.exe
  2⤵
  PID:3816
- C:\Windows\System\FPptWSQ.exe
  C:\Windows\System\FPptWSQ.exe
  2⤵
  PID:3844
- C:\Windows\System\bzwRCyj.exe
  C:\Windows\System\bzwRCyj.exe
  2⤵
  PID:3860
- C:\Windows\System\sKjskjh.exe
  C:\Windows\System\sKjskjh.exe
  2⤵
  PID:3876
- C:\Windows\System\zryqAsO.exe
  C:\Windows\System\zryqAsO.exe
  2⤵
  PID:3892
- C:\Windows\System\blqTztW.exe
  C:\Windows\System\blqTztW.exe
  2⤵
  PID:3908
- C:\Windows\System\zceuReh.exe
  C:\Windows\System\zceuReh.exe
  2⤵
  PID:3924
- C:\Windows\System\NJenoCu.exe
  C:\Windows\System\NJenoCu.exe
  2⤵
  PID:3940
- C:\Windows\System\RGiaOGf.exe
  C:\Windows\System\RGiaOGf.exe
  2⤵
  PID:3988
- C:\Windows\System\ItHaZOS.exe
  C:\Windows\System\ItHaZOS.exe
  2⤵
  PID:4016
- C:\Windows\System\XNMXLMF.exe
  C:\Windows\System\XNMXLMF.exe
  2⤵
  PID:4032
- C:\Windows\System\SoqxgwW.exe
  C:\Windows\System\SoqxgwW.exe
  2⤵
  PID:4048
- C:\Windows\System\DMLNMfK.exe
  C:\Windows\System\DMLNMfK.exe
  2⤵
  PID:4064
- C:\Windows\System\hqMegIp.exe
  C:\Windows\System\hqMegIp.exe
  2⤵
  PID:4080
- C:\Windows\System\NAuClLQ.exe
  C:\Windows\System\NAuClLQ.exe
  2⤵
  PID:1008
- C:\Windows\System\cotsGej.exe
  C:\Windows\System\cotsGej.exe
  2⤵
  PID:1884
- C:\Windows\System\SDtzHPN.exe
  C:\Windows\System\SDtzHPN.exe
  2⤵
  PID:2012
- C:\Windows\System\IWmzIzT.exe
  C:\Windows\System\IWmzIzT.exe
  2⤵
  PID:3096
- C:\Windows\System\xsYbVWY.exe
  C:\Windows\System\xsYbVWY.exe
  2⤵
  PID:3160
- C:\Windows\System\NzlYSfQ.exe
  C:\Windows\System\NzlYSfQ.exe
  2⤵
  PID:3228
- C:\Windows\System\JxyNygY.exe
  C:\Windows\System\JxyNygY.exe
  2⤵
  PID:3272
- C:\Windows\System\edndzSl.exe
  C:\Windows\System\edndzSl.exe
  2⤵
  PID:3336
- C:\Windows\System\dfRJpeJ.exe
  C:\Windows\System\dfRJpeJ.exe
  2⤵
  PID:3400
- C:\Windows\System\HUqcias.exe
  C:\Windows\System\HUqcias.exe
  2⤵
  PID:3144
- C:\Windows\System\SGabudb.exe
  C:\Windows\System\SGabudb.exe
  2⤵
  PID:3208
- C:\Windows\System\ckvCgdA.exe
  C:\Windows\System\ckvCgdA.exe
  2⤵
  PID:1544
- C:\Windows\System\ndLlvRq.exe
  C:\Windows\System\ndLlvRq.exe
  2⤵
  PID:3444
- C:\Windows\System\WRkSYQg.exe
  C:\Windows\System\WRkSYQg.exe
  2⤵
  PID:3464
- C:\Windows\System\OpTgzFP.exe
  C:\Windows\System\OpTgzFP.exe
  2⤵
  PID:3480
- C:\Windows\System\oZYoUbU.exe
  C:\Windows\System\oZYoUbU.exe
  2⤵
  PID:3496
- C:\Windows\System\YbaafKI.exe
  C:\Windows\System\YbaafKI.exe
  2⤵
  PID:3512
- C:\Windows\System\pyOHRlJ.exe
  C:\Windows\System\pyOHRlJ.exe
  2⤵
  PID:3252
- C:\Windows\System\ZfmvYgB.exe
  C:\Windows\System\ZfmvYgB.exe
  2⤵
  PID:3524
- C:\Windows\System\OyhTTzf.exe
  C:\Windows\System\OyhTTzf.exe
  2⤵
  PID:3348
- C:\Windows\System\riGEMqF.exe
  C:\Windows\System\riGEMqF.exe
  2⤵
  PID:3416
- C:\Windows\System\HKOxdEt.exe
  C:\Windows\System\HKOxdEt.exe
  2⤵
  PID:3536
- C:\Windows\System\yZeusQo.exe
  C:\Windows\System\yZeusQo.exe
  2⤵
  PID:3576
- C:\Windows\System\JiHEeiO.exe
  C:\Windows\System\JiHEeiO.exe
  2⤵
  PID:3592
- C:\Windows\System\eIIPegg.exe
  C:\Windows\System\eIIPegg.exe
  2⤵
  PID:3656
- C:\Windows\System\DnQRmWx.exe
  C:\Windows\System\DnQRmWx.exe
  2⤵
  PID:1640
- C:\Windows\System\HfbkwPL.exe
  C:\Windows\System\HfbkwPL.exe
  2⤵
  PID:3748
- C:\Windows\System\bdGpjqu.exe
  C:\Windows\System\bdGpjqu.exe
  2⤵
  PID:3680
- C:\Windows\System\VQVYpNu.exe
  C:\Windows\System\VQVYpNu.exe
  2⤵
  PID:3608
- C:\Windows\System\yfHICGs.exe
  C:\Windows\System\yfHICGs.exe
  2⤵
  PID:3728
- C:\Windows\System\PoGEvTV.exe
  C:\Windows\System\PoGEvTV.exe
  2⤵
  PID:3792
- C:\Windows\System\ZpSdpHv.exe
  C:\Windows\System\ZpSdpHv.exe
  2⤵
  PID:3836
- C:\Windows\System\KTNWQoc.exe
  C:\Windows\System\KTNWQoc.exe
  2⤵
  PID:3932
- C:\Windows\System\uRuAOEj.exe
  C:\Windows\System\uRuAOEj.exe
  2⤵
  PID:3952
- C:\Windows\System\TVrIuVY.exe
  C:\Windows\System\TVrIuVY.exe
  2⤵
  PID:4008
- C:\Windows\System\rSryjts.exe
  C:\Windows\System\rSryjts.exe
  2⤵
  PID:4072
- C:\Windows\System\yboJphg.exe
  C:\Windows\System\yboJphg.exe
  2⤵
  PID:3956
- C:\Windows\System\RrErEdC.exe
  C:\Windows\System\RrErEdC.exe
  2⤵
  PID:3964
- C:\Windows\System\wZfEKAq.exe
  C:\Windows\System\wZfEKAq.exe
  2⤵
  PID:3980
- C:\Windows\System\SvdVggl.exe
  C:\Windows\System\SvdVggl.exe
  2⤵
  PID:4028
- C:\Windows\System\vwSItXJ.exe
  C:\Windows\System\vwSItXJ.exe
  2⤵
  PID:4092
- C:\Windows\System\BVboJZD.exe
  C:\Windows\System\BVboJZD.exe
  2⤵
  PID:2512
- C:\Windows\System\egmbrCZ.exe
  C:\Windows\System\egmbrCZ.exe
  2⤵
  PID:3092
- C:\Windows\System\qYGcNwD.exe
  C:\Windows\System\qYGcNwD.exe
  2⤵
  PID:3332
- C:\Windows\System\BeGMyoz.exe
  C:\Windows\System\BeGMyoz.exe
  2⤵
  PID:2548
- C:\Windows\System\KzVVyDt.exe
  C:\Windows\System\KzVVyDt.exe
  2⤵
  PID:3488
- C:\Windows\System\pTZsgVd.exe
  C:\Windows\System\pTZsgVd.exe
  2⤵
  PID:3316
- C:\Windows\System\YeejOgQ.exe
  C:\Windows\System\YeejOgQ.exe
  2⤵
  PID:3560
- C:\Windows\System\ZTIIKrD.exe
  C:\Windows\System\ZTIIKrD.exe
  2⤵
  PID:3672
- C:\Windows\System\UimgIZn.exe
  C:\Windows\System\UimgIZn.exe
  2⤵
  PID:3828
- C:\Windows\System\toigyQQ.exe
  C:\Windows\System\toigyQQ.exe
  2⤵
  PID:4100
- C:\Windows\System\cKGIbvv.exe
  C:\Windows\System\cKGIbvv.exe
  2⤵
  PID:4116
- C:\Windows\System\QQkhgoB.exe
  C:\Windows\System\QQkhgoB.exe
  2⤵
  PID:4132
- C:\Windows\System\rKdJziZ.exe
  C:\Windows\System\rKdJziZ.exe
  2⤵
  PID:4148
- C:\Windows\System\eCpahmS.exe
  C:\Windows\System\eCpahmS.exe
  2⤵
  PID:4164
- C:\Windows\System\cMkcCGX.exe
  C:\Windows\System\cMkcCGX.exe
  2⤵
  PID:4180
- C:\Windows\System\yIGuUlX.exe
  C:\Windows\System\yIGuUlX.exe
  2⤵
  PID:4200
- C:\Windows\System\obeCozK.exe
  C:\Windows\System\obeCozK.exe
  2⤵
  PID:4216
- C:\Windows\System\aqtXRkS.exe
  C:\Windows\System\aqtXRkS.exe
  2⤵
  PID:4232
- C:\Windows\System\wVaAMMB.exe
  C:\Windows\System\wVaAMMB.exe
  2⤵
  PID:4248
- C:\Windows\System\SONDPsv.exe
  C:\Windows\System\SONDPsv.exe
  2⤵
  PID:4264
- C:\Windows\System\iAvKgPX.exe
  C:\Windows\System\iAvKgPX.exe
  2⤵
  PID:4280
- C:\Windows\System\cgIaPVy.exe
  C:\Windows\System\cgIaPVy.exe
  2⤵
  PID:4300
- C:\Windows\System\uyIwQaD.exe
  C:\Windows\System\uyIwQaD.exe
  2⤵
  PID:4316
- C:\Windows\System\FieMqMD.exe
  C:\Windows\System\FieMqMD.exe
  2⤵
  PID:4332
- C:\Windows\System\TvcWWFQ.exe
  C:\Windows\System\TvcWWFQ.exe
  2⤵
  PID:4348
- C:\Windows\System\KabiPkB.exe
  C:\Windows\System\KabiPkB.exe
  2⤵
  PID:4364
- C:\Windows\System\WliVrkY.exe
  C:\Windows\System\WliVrkY.exe
  2⤵
  PID:4380
- C:\Windows\System\KYncMVi.exe
  C:\Windows\System\KYncMVi.exe
  2⤵
  PID:4488
- C:\Windows\System\TjijRhk.exe
  C:\Windows\System\TjijRhk.exe
  2⤵
  PID:4504
- C:\Windows\System\tNKuNka.exe
  C:\Windows\System\tNKuNka.exe
  2⤵
  PID:4520
- C:\Windows\System\wBamxIk.exe
  C:\Windows\System\wBamxIk.exe
  2⤵
  PID:4536
- C:\Windows\System\jmImzqK.exe
  C:\Windows\System\jmImzqK.exe
  2⤵
  PID:4552
- C:\Windows\System\lGcClLb.exe
  C:\Windows\System\lGcClLb.exe
  2⤵
  PID:4568
- C:\Windows\System\pBIJgGl.exe
  C:\Windows\System\pBIJgGl.exe
  2⤵
  PID:4584
- C:\Windows\System\kGFsfAe.exe
  C:\Windows\System\kGFsfAe.exe
  2⤵
  PID:4600
- C:\Windows\System\tnjqbiO.exe
  C:\Windows\System\tnjqbiO.exe
  2⤵
  PID:4616
- C:\Windows\System\ZEAkHgE.exe
  C:\Windows\System\ZEAkHgE.exe
  2⤵
  PID:4632
- C:\Windows\System\eftEhSq.exe
  C:\Windows\System\eftEhSq.exe
  2⤵
  PID:4648
- C:\Windows\System\YEzzYgs.exe
  C:\Windows\System\YEzzYgs.exe
  2⤵
  PID:4664
- C:\Windows\System\TMiByoe.exe
  C:\Windows\System\TMiByoe.exe
  2⤵
  PID:4680
- C:\Windows\System\xpSbEyI.exe
  C:\Windows\System\xpSbEyI.exe
  2⤵
  PID:4696
- C:\Windows\System\GTnVBoQ.exe
  C:\Windows\System\GTnVBoQ.exe
  2⤵
  PID:4712
- C:\Windows\System\fNQqENM.exe
  C:\Windows\System\fNQqENM.exe
  2⤵
  PID:4728
- C:\Windows\System\reDlqwR.exe
  C:\Windows\System\reDlqwR.exe
  2⤵
  PID:4752
- C:\Windows\System\zwQVWvn.exe
  C:\Windows\System\zwQVWvn.exe
  2⤵
  PID:4768
- C:\Windows\System\uKsbvpZ.exe
  C:\Windows\System\uKsbvpZ.exe
  2⤵
  PID:4784
- C:\Windows\System\njxHYvV.exe
  C:\Windows\System\njxHYvV.exe
  2⤵
  PID:4800
- C:\Windows\System\lkDXGoW.exe
  C:\Windows\System\lkDXGoW.exe
  2⤵
  PID:4816
- C:\Windows\System\JEOIrRD.exe
  C:\Windows\System\JEOIrRD.exe
  2⤵
  PID:4832
- C:\Windows\System\njhaEbS.exe
  C:\Windows\System\njhaEbS.exe
  2⤵
  PID:4852
- C:\Windows\System\pPoNXDN.exe
  C:\Windows\System\pPoNXDN.exe
  2⤵
  PID:4868
- C:\Windows\System\EmVzrMk.exe
  C:\Windows\System\EmVzrMk.exe
  2⤵
  PID:4884
- C:\Windows\System\xsiKXbJ.exe
  C:\Windows\System\xsiKXbJ.exe
  2⤵
  PID:4900
- C:\Windows\System\nEoKqWg.exe
  C:\Windows\System\nEoKqWg.exe
  2⤵
  PID:4916
- C:\Windows\System\KmoEOrl.exe
  C:\Windows\System\KmoEOrl.exe
  2⤵
  PID:4932
- C:\Windows\System\YsJXoth.exe
  C:\Windows\System\YsJXoth.exe
  2⤵
  PID:4948
- C:\Windows\System\pqteslU.exe
  C:\Windows\System\pqteslU.exe
  2⤵
  PID:5056
- C:\Windows\System\ERnUPSL.exe
  C:\Windows\System\ERnUPSL.exe
  2⤵
  PID:5072
- C:\Windows\System\mWVDwJc.exe
  C:\Windows\System\mWVDwJc.exe
  2⤵
  PID:5088
- C:\Windows\System\diGVqnk.exe
  C:\Windows\System\diGVqnk.exe
  2⤵
  PID:5104
- C:\Windows\System\dOWHPzw.exe
  C:\Windows\System\dOWHPzw.exe
  2⤵
  PID:3368
- C:\Windows\System\OTVFBGC.exe
  C:\Windows\System\OTVFBGC.exe
  2⤵
  PID:3436
- C:\Windows\System\UTTuYpp.exe
  C:\Windows\System\UTTuYpp.exe
  2⤵
  PID:3508
- C:\Windows\System\GnKKAro.exe
  C:\Windows\System\GnKKAro.exe
  2⤵
  PID:3624
- C:\Windows\System\pryCKQW.exe
  C:\Windows\System\pryCKQW.exe
  2⤵
  PID:3716
- C:\Windows\System\zQvNCJx.exe
  C:\Windows\System\zQvNCJx.exe
  2⤵
  PID:3804
- C:\Windows\System\geyHQvo.exe
  C:\Windows\System\geyHQvo.exe
  2⤵
  PID:3984
- C:\Windows\System\tnDwTic.exe
  C:\Windows\System\tnDwTic.exe
  2⤵
  PID:2964
- C:\Windows\System\jIZESTq.exe
  C:\Windows\System\jIZESTq.exe
  2⤵
  PID:3460
- C:\Windows\System\YKDDHGI.exe
  C:\Windows\System\YKDDHGI.exe
  2⤵
  PID:4112
- C:\Windows\System\ZOVRsEm.exe
  C:\Windows\System\ZOVRsEm.exe
  2⤵
  PID:4212
- C:\Windows\System\tvySEIa.exe
  C:\Windows\System\tvySEIa.exe
  2⤵
  PID:2780
- C:\Windows\System\vaTSBAE.exe
  C:\Windows\System\vaTSBAE.exe
  2⤵
  PID:4244
- C:\Windows\System\IjSPXJu.exe
  C:\Windows\System\IjSPXJu.exe
  2⤵
  PID:4344
- C:\Windows\System\fcbyaPr.exe
  C:\Windows\System\fcbyaPr.exe
  2⤵
  PID:2248
- C:\Windows\System\dPUkHQw.exe
  C:\Windows\System\dPUkHQw.exe
  2⤵
  PID:3972
- C:\Windows\System\KdflONT.exe
  C:\Windows\System\KdflONT.exe
  2⤵
  PID:4560
- C:\Windows\System\IvHXjPv.exe
  C:\Windows\System\IvHXjPv.exe
  2⤵
  PID:4500
- C:\Windows\System\MEvwFvY.exe
  C:\Windows\System\MEvwFvY.exe
  2⤵
  PID:4688
- C:\Windows\System\BspFJyf.exe
  C:\Windows\System\BspFJyf.exe
  2⤵
  PID:4624
- C:\Windows\System\uKqyqOA.exe
  C:\Windows\System\uKqyqOA.exe
  2⤵
  PID:4720
- C:\Windows\System\vBoKKsU.exe
  C:\Windows\System\vBoKKsU.exe
  2⤵
  PID:3268
- C:\Windows\System\GhxgDOF.exe
  C:\Windows\System\GhxgDOF.exe
  2⤵
  PID:4828
- C:\Windows\System\BxgYShH.exe
  C:\Windows\System\BxgYShH.exe
  2⤵
  PID:4468
- C:\Windows\System\fkIvDoc.exe
  C:\Windows\System\fkIvDoc.exe
  2⤵
  PID:4484
- C:\Windows\System\bEKEywk.exe
  C:\Windows\System\bEKEywk.exe
  2⤵
  PID:3916
- C:\Windows\System\WiSsFQS.exe
  C:\Windows\System\WiSsFQS.exe
  2⤵
  PID:4848
- C:\Windows\System\nOasGFH.exe
  C:\Windows\System\nOasGFH.exe
  2⤵
  PID:4880
- C:\Windows\System\WyhkdMn.exe
  C:\Windows\System\WyhkdMn.exe
  2⤵
  PID:4808
- C:\Windows\System\pwLHDBd.exe
  C:\Windows\System\pwLHDBd.exe
  2⤵
  PID:4776
- C:\Windows\System\WDCFfBl.exe
  C:\Windows\System\WDCFfBl.exe
  2⤵
  PID:4736
- C:\Windows\System\lYMleOq.exe
  C:\Windows\System\lYMleOq.exe
  2⤵
  PID:4672
- C:\Windows\System\HwkLDBQ.exe
  C:\Windows\System\HwkLDBQ.exe
  2⤵
  PID:4580
- C:\Windows\System\uvuOoNy.exe
  C:\Windows\System\uvuOoNy.exe
  2⤵
  PID:4912
- C:\Windows\System\cynanGq.exe
  C:\Windows\System\cynanGq.exe
  2⤵
  PID:4928
- C:\Windows\System\cARUcNi.exe
  C:\Windows\System\cARUcNi.exe
  2⤵
  PID:4976
- C:\Windows\System\QhDuBBm.exe
  C:\Windows\System\QhDuBBm.exe
  2⤵
  PID:5000
- C:\Windows\System\qkRmiMI.exe
  C:\Windows\System\qkRmiMI.exe
  2⤵
  PID:5024
- C:\Windows\System\BRmPPko.exe
  C:\Windows\System\BRmPPko.exe
  2⤵
  PID:5036
- C:\Windows\System\XpjwVIO.exe
  C:\Windows\System\XpjwVIO.exe
  2⤵
  PID:3612
- C:\Windows\System\PnvYbMV.exe
  C:\Windows\System\PnvYbMV.exe
  2⤵
  PID:3384
- C:\Windows\System\QRONZHw.exe
  C:\Windows\System\QRONZHw.exe
  2⤵
  PID:5040
- C:\Windows\System\ZVQNjAS.exe
  C:\Windows\System\ZVQNjAS.exe
  2⤵
  PID:4040
- C:\Windows\System\yUtDtEv.exe
  C:\Windows\System\yUtDtEv.exe
  2⤵
  PID:3456
- C:\Windows\System\KXwNuHx.exe
  C:\Windows\System\KXwNuHx.exe
  2⤵
  PID:4240
- C:\Windows\System\XexBIHO.exe
  C:\Windows\System\XexBIHO.exe
  2⤵
  PID:4208
- C:\Windows\System\IGLhEvi.exe
  C:\Windows\System\IGLhEvi.exe
  2⤵
  PID:4592
- C:\Windows\System\LrUvBdH.exe
  C:\Windows\System\LrUvBdH.exe
  2⤵
  PID:4760
- C:\Windows\System\rDxEpHK.exe
  C:\Windows\System\rDxEpHK.exe
  2⤵
  PID:3884
- C:\Windows\System\ttUFkfK.exe
  C:\Windows\System\ttUFkfK.exe
  2⤵
  PID:3132
- C:\Windows\System\rpGOIAK.exe
  C:\Windows\System\rpGOIAK.exe
  2⤵
  PID:3692
- C:\Windows\System\xBKbfgu.exe
  C:\Windows\System\xBKbfgu.exe
  2⤵
  PID:4844
- C:\Windows\System\aoQSOab.exe
  C:\Windows\System\aoQSOab.exe
  2⤵
  PID:4156
- C:\Windows\System\sRBecZE.exe
  C:\Windows\System\sRBecZE.exe
  2⤵
  PID:4512
- C:\Windows\System\FzpCEwK.exe
  C:\Windows\System\FzpCEwK.exe
  2⤵
  PID:4324
- C:\Windows\System\JuaGRKI.exe
  C:\Windows\System\JuaGRKI.exe
  2⤵
  PID:4256
- C:\Windows\System\NfxHppA.exe
  C:\Windows\System\NfxHppA.exe
  2⤵
  PID:4424
- C:\Windows\System\qEQYVud.exe
  C:\Windows\System\qEQYVud.exe
  2⤵
  PID:4400
- C:\Windows\System\GmhOiMF.exe
  C:\Windows\System\GmhOiMF.exe
  2⤵
  PID:4448
- C:\Windows\System\vaRHCvb.exe
  C:\Windows\System\vaRHCvb.exe
  2⤵
  PID:4464
- C:\Windows\System\bxXHVFo.exe
  C:\Windows\System\bxXHVFo.exe
  2⤵
  PID:4612
- C:\Windows\System\tLieeEq.exe
  C:\Windows\System\tLieeEq.exe
  2⤵
  PID:4608
- C:\Windows\System\kNpcXVB.exe
  C:\Windows\System\kNpcXVB.exe
  2⤵
  PID:4972
- C:\Windows\System\NBQWObb.exe
  C:\Windows\System\NBQWObb.exe
  2⤵
  PID:4812
- C:\Windows\System\bGUmrbG.exe
  C:\Windows\System\bGUmrbG.exe
  2⤵
  PID:4996
- C:\Windows\System\BnFsjCF.exe
  C:\Windows\System\BnFsjCF.exe
  2⤵
  PID:5012
- C:\Windows\System\CHIyRvg.exe
  C:\Windows\System\CHIyRvg.exe
  2⤵
  PID:5004
- C:\Windows\System\MAIAvht.exe
  C:\Windows\System\MAIAvht.exe
  2⤵
  PID:5032
- C:\Windows\System\HgrEkBd.exe
  C:\Windows\System\HgrEkBd.exe
  2⤵
  PID:5096
- C:\Windows\System\CfrJLTX.exe
  C:\Windows\System\CfrJLTX.exe
  2⤵
  PID:3412
- C:\Windows\System\xNvOREp.exe
  C:\Windows\System\xNvOREp.exe
  2⤵
  PID:5116
- C:\Windows\System\bIVFBHe.exe
  C:\Windows\System\bIVFBHe.exe
  2⤵
  PID:3740
- C:\Windows\System\bgkZgOY.exe
  C:\Windows\System\bgkZgOY.exe
  2⤵
  PID:328
- C:\Windows\System\fMgZdrb.exe
  C:\Windows\System\fMgZdrb.exe
  2⤵
  PID:4088
- C:\Windows\System\JKjFExP.exe
  C:\Windows\System\JKjFExP.exe
  2⤵
  PID:4656
- C:\Windows\System\QDjMYhp.exe
  C:\Windows\System\QDjMYhp.exe
  2⤵
  PID:3856
- C:\Windows\System\RltJdCn.exe
  C:\Windows\System\RltJdCn.exe
  2⤵
  PID:4792
- C:\Windows\System\vsNuHcy.exe
  C:\Windows\System\vsNuHcy.exe
  2⤵
  PID:4864
- C:\Windows\System\bnIaMKL.exe
  C:\Windows\System\bnIaMKL.exe
  2⤵
  PID:5008
- C:\Windows\System\ntDtlFG.exe
  C:\Windows\System\ntDtlFG.exe
  2⤵
  PID:4124
- C:\Windows\System\UfHIWNp.exe
  C:\Windows\System\UfHIWNp.exe
  2⤵
  PID:3504
- C:\Windows\System\PkuMmeu.exe
  C:\Windows\System\PkuMmeu.exe
  2⤵
  PID:3544
- C:\Windows\System\zWwYzIw.exe
  C:\Windows\System\zWwYzIw.exe
  2⤵
  PID:4840
- C:\Windows\System\QsOZBWF.exe
  C:\Windows\System\QsOZBWF.exe
  2⤵
  PID:4432
- C:\Windows\System\JULfQTI.exe
  C:\Windows\System\JULfQTI.exe
  2⤵
  PID:4340
- C:\Windows\System\jQUIRAf.exe
  C:\Windows\System\jQUIRAf.exe
  2⤵
  PID:3116
- C:\Windows\System\ckcBqEz.exe
  C:\Windows\System\ckcBqEz.exe
  2⤵
  PID:4956
- C:\Windows\System\MXDlFqt.exe
  C:\Windows\System\MXDlFqt.exe
  2⤵
  PID:5020
- C:\Windows\System\kXHwZcR.exe
  C:\Windows\System\kXHwZcR.exe
  2⤵
  PID:4260
- C:\Windows\System\PmTyeVH.exe
  C:\Windows\System\PmTyeVH.exe
  2⤵
  PID:4392
- C:\Windows\System\amjOeXv.exe
  C:\Windows\System\amjOeXv.exe
  2⤵
  PID:4436
- C:\Windows\System\BfaWFux.exe
  C:\Windows\System\BfaWFux.exe
  2⤵
  PID:3472
- C:\Windows\System\WHAIoIv.exe
  C:\Windows\System\WHAIoIv.exe
  2⤵
  PID:4004
- C:\Windows\System\lNYJCMj.exe
  C:\Windows\System\lNYJCMj.exe
  2⤵
  PID:4968
- C:\Windows\System\uMDveuN.exe
  C:\Windows\System\uMDveuN.exe
  2⤵
  PID:4288
- C:\Windows\System\PebxpCf.exe
  C:\Windows\System\PebxpCf.exe
  2⤵
  PID:4704
- C:\Windows\System\KNtlJMn.exe
  C:\Windows\System\KNtlJMn.exe
  2⤵
  PID:3812
- C:\Windows\System\wGnXFha.exe
  C:\Windows\System\wGnXFha.exe
  2⤵
  PID:4108
- C:\Windows\System\RziLloQ.exe
  C:\Windows\System\RziLloQ.exe
  2⤵
  PID:3900
- C:\Windows\System\tZwWrch.exe
  C:\Windows\System\tZwWrch.exe
  2⤵
  PID:3248
- C:\Windows\System\zmyRnjd.exe
  C:\Windows\System\zmyRnjd.exe
  2⤵
  PID:4396
- C:\Windows\System\KxYJwQD.exe
  C:\Windows\System\KxYJwQD.exe
  2⤵
  PID:4940
- C:\Windows\System\qZbwCDB.exe
  C:\Windows\System\qZbwCDB.exe
  2⤵
  PID:4640
- C:\Windows\System\ZOsOIrH.exe
  C:\Windows\System\ZOsOIrH.exe
  2⤵
  PID:2820
- C:\Windows\System\GCDlFop.exe
  C:\Windows\System\GCDlFop.exe
  2⤵
  PID:4596
- C:\Windows\System\vLyEAiG.exe
  C:\Windows\System\vLyEAiG.exe
  2⤵
  PID:4544
- C:\Windows\System\TsOgiMB.exe
  C:\Windows\System\TsOgiMB.exe
  2⤵
  PID:5124
- C:\Windows\System\Cdervzz.exe
  C:\Windows\System\Cdervzz.exe
  2⤵
  PID:5140
- C:\Windows\System\BUmoeJi.exe
  C:\Windows\System\BUmoeJi.exe
  2⤵
  PID:5156
- C:\Windows\System\wmlQkzw.exe
  C:\Windows\System\wmlQkzw.exe
  2⤵
  PID:5172
- C:\Windows\System\UsWhSEI.exe
  C:\Windows\System\UsWhSEI.exe
  2⤵
  PID:5188
- C:\Windows\System\PobPWeF.exe
  C:\Windows\System\PobPWeF.exe
  2⤵
  PID:5204
- C:\Windows\System\KbhePhA.exe
  C:\Windows\System\KbhePhA.exe
  2⤵
  PID:5220
- C:\Windows\System\XYgplmS.exe
  C:\Windows\System\XYgplmS.exe
  2⤵
  PID:5236
- C:\Windows\System\SLibvmd.exe
  C:\Windows\System\SLibvmd.exe
  2⤵
  PID:5252
- C:\Windows\System\espyeZO.exe
  C:\Windows\System\espyeZO.exe
  2⤵
  PID:5268
- C:\Windows\System\yvrltwj.exe
  C:\Windows\System\yvrltwj.exe
  2⤵
  PID:5284
- C:\Windows\System\plRqckI.exe
  C:\Windows\System\plRqckI.exe
  2⤵
  PID:5300
- C:\Windows\System\EAWdFih.exe
  C:\Windows\System\EAWdFih.exe
  2⤵
  PID:5316
- C:\Windows\System\nRyXylq.exe
  C:\Windows\System\nRyXylq.exe
  2⤵
  PID:5332
- C:\Windows\System\YqRcIeU.exe
  C:\Windows\System\YqRcIeU.exe
  2⤵
  PID:5348
- C:\Windows\System\CTgQtQX.exe
  C:\Windows\System\CTgQtQX.exe
  2⤵
  PID:5364
- C:\Windows\System\odqjBrI.exe
  C:\Windows\System\odqjBrI.exe
  2⤵
  PID:5380
- C:\Windows\System\yxNvELu.exe
  C:\Windows\System\yxNvELu.exe
  2⤵
  PID:5396
- C:\Windows\System\spyOaUF.exe
  C:\Windows\System\spyOaUF.exe
  2⤵
  PID:5416
- C:\Windows\System\xNggVvH.exe
  C:\Windows\System\xNggVvH.exe
  2⤵
  PID:5432
- C:\Windows\System\syXVBfz.exe
  C:\Windows\System\syXVBfz.exe
  2⤵
  PID:5448
- C:\Windows\System\QKnNbTS.exe
  C:\Windows\System\QKnNbTS.exe
  2⤵
  PID:5464
- C:\Windows\System\ktEWrcB.exe
  C:\Windows\System\ktEWrcB.exe
  2⤵
  PID:5480
- C:\Windows\System\FsegXqC.exe
  C:\Windows\System\FsegXqC.exe
  2⤵
  PID:5496
- C:\Windows\System\ndKNMnq.exe
  C:\Windows\System\ndKNMnq.exe
  2⤵
  PID:5512
- C:\Windows\System\rpgCtFP.exe
  C:\Windows\System\rpgCtFP.exe
  2⤵
  PID:5528
- C:\Windows\System\WhpQudU.exe
  C:\Windows\System\WhpQudU.exe
  2⤵
  PID:5544
- C:\Windows\System\mSdFPHr.exe
  C:\Windows\System\mSdFPHr.exe
  2⤵
  PID:5560
- C:\Windows\System\ffQdGBw.exe
  C:\Windows\System\ffQdGBw.exe
  2⤵
  PID:5576
- C:\Windows\System\trYApHC.exe
  C:\Windows\System\trYApHC.exe
  2⤵
  PID:5596
- C:\Windows\System\FHhVCaC.exe
  C:\Windows\System\FHhVCaC.exe
  2⤵
  PID:5612
- C:\Windows\System\WKLONPQ.exe
  C:\Windows\System\WKLONPQ.exe
  2⤵
  PID:5628
- C:\Windows\System\xUZiuUD.exe
  C:\Windows\System\xUZiuUD.exe
  2⤵
  PID:5648
- C:\Windows\System\sKUyjHh.exe
  C:\Windows\System\sKUyjHh.exe
  2⤵
  PID:5668
- C:\Windows\System\KpDyMUF.exe
  C:\Windows\System\KpDyMUF.exe
  2⤵
  PID:5684
- C:\Windows\System\fsupPwT.exe
  C:\Windows\System\fsupPwT.exe
  2⤵
  PID:5700
- C:\Windows\System\ZNUOxPT.exe
  C:\Windows\System\ZNUOxPT.exe
  2⤵
  PID:5716
- C:\Windows\System\IgXpJqi.exe
  C:\Windows\System\IgXpJqi.exe
  2⤵
  PID:5752
- C:\Windows\System\QtWMhbH.exe
  C:\Windows\System\QtWMhbH.exe
  2⤵
  PID:5768
- C:\Windows\System\vGSPmVL.exe
  C:\Windows\System\vGSPmVL.exe
  2⤵
  PID:5884
- C:\Windows\System\IRyuzMq.exe
  C:\Windows\System\IRyuzMq.exe
  2⤵
  PID:5900
- C:\Windows\System\EzucsDT.exe
  C:\Windows\System\EzucsDT.exe
  2⤵
  PID:5916
- C:\Windows\System\YHBHBin.exe
  C:\Windows\System\YHBHBin.exe
  2⤵
  PID:5932
- C:\Windows\System\ZPbHmuw.exe
  C:\Windows\System\ZPbHmuw.exe
  2⤵
  PID:5948
- C:\Windows\System\AGhHFQX.exe
  C:\Windows\System\AGhHFQX.exe
  2⤵
  PID:5964
- C:\Windows\System\XvNMOmi.exe
  C:\Windows\System\XvNMOmi.exe
  2⤵
  PID:5980
- C:\Windows\System\uUsKEiE.exe
  C:\Windows\System\uUsKEiE.exe
  2⤵
  PID:5996
- C:\Windows\System\bWCOHwR.exe
  C:\Windows\System\bWCOHwR.exe
  2⤵
  PID:6012
- C:\Windows\System\RQkyMZn.exe
  C:\Windows\System\RQkyMZn.exe
  2⤵
  PID:6028
- C:\Windows\System\VAOAVUl.exe
  C:\Windows\System\VAOAVUl.exe
  2⤵
  PID:6044
- C:\Windows\System\OWrCoKO.exe
  C:\Windows\System\OWrCoKO.exe
  2⤵
  PID:6060
- C:\Windows\System\ISTPkLi.exe
  C:\Windows\System\ISTPkLi.exe
  2⤵
  PID:6076
- C:\Windows\System\JdfwIkt.exe
  C:\Windows\System\JdfwIkt.exe
  2⤵
  PID:6092
- C:\Windows\System\wimqdSn.exe
  C:\Windows\System\wimqdSn.exe
  2⤵
  PID:6108
- C:\Windows\System\gSBiLka.exe
  C:\Windows\System\gSBiLka.exe
  2⤵
  PID:6124
- C:\Windows\System\JmsHUpF.exe
  C:\Windows\System\JmsHUpF.exe
  2⤵
  PID:6140
- C:\Windows\System\KZjjZix.exe
  C:\Windows\System\KZjjZix.exe
  2⤵
  PID:5068
- C:\Windows\System\TxSJepW.exe
  C:\Windows\System\TxSJepW.exe
  2⤵
  PID:4404
- C:\Windows\System\FdGqXJj.exe
  C:\Windows\System\FdGqXJj.exe
  2⤵
  PID:4192
- C:\Windows\System\vhSLqWK.exe
  C:\Windows\System\vhSLqWK.exe
  2⤵
  PID:3180
- C:\Windows\System\BdbFNLI.exe
  C:\Windows\System\BdbFNLI.exe
  2⤵
  PID:4412
- C:\Windows\System\rxteslT.exe
  C:\Windows\System\rxteslT.exe
  2⤵
  PID:4388
- C:\Windows\System\DpilOAu.exe
  C:\Windows\System\DpilOAu.exe
  2⤵
  PID:5196
- C:\Windows\System\eyvWVrm.exe
  C:\Windows\System\eyvWVrm.exe
  2⤵
  PID:5152
- C:\Windows\System\sIwIzzS.exe
  C:\Windows\System\sIwIzzS.exe
  2⤵
  PID:5216
- C:\Windows\System\XqGvETQ.exe
  C:\Windows\System\XqGvETQ.exe
  2⤵
  PID:5232
- C:\Windows\System\BzFYLvE.exe
  C:\Windows\System\BzFYLvE.exe
  2⤵
  PID:5340
- C:\Windows\System\XCIQAQf.exe
  C:\Windows\System\XCIQAQf.exe
  2⤵
  PID:5404
- C:\Windows\System\MqLiDFu.exe
  C:\Windows\System\MqLiDFu.exe
  2⤵
  PID:5440
- C:\Windows\System\WqwtZSi.exe
  C:\Windows\System\WqwtZSi.exe
  2⤵
  PID:5504
- C:\Windows\System\XhPvAlC.exe
  C:\Windows\System\XhPvAlC.exe
  2⤵
  PID:5568
- C:\Windows\System\UANQRoR.exe
  C:\Windows\System\UANQRoR.exe
  2⤵
  PID:5636
- C:\Windows\System\HnmjQgC.exe
  C:\Windows\System\HnmjQgC.exe
  2⤵
  PID:2152
- C:\Windows\System\pjimSiX.exe
  C:\Windows\System\pjimSiX.exe
  2⤵
  PID:5360
- C:\Windows\System\dmLZqZt.exe
  C:\Windows\System\dmLZqZt.exe
  2⤵
  PID:5388
- C:\Windows\System\XNjbsUx.exe
  C:\Windows\System\XNjbsUx.exe
  2⤵
  PID:5748
- C:\Windows\System\Ibzlywp.exe
  C:\Windows\System\Ibzlywp.exe
  2⤵
  PID:5804
- C:\Windows\System\mxMHQOy.exe
  C:\Windows\System\mxMHQOy.exe
  2⤵
  PID:5820
- C:\Windows\System\lbzBSER.exe
  C:\Windows\System\lbzBSER.exe
  2⤵
  PID:5868
- C:\Windows\System\GXBRjms.exe
  C:\Windows\System\GXBRjms.exe
  2⤵
  PID:5928
- C:\Windows\System\NmEGitF.exe
  C:\Windows\System\NmEGitF.exe
  2⤵
  PID:6020
- C:\Windows\System\CIwcNLu.exe
  C:\Windows\System\CIwcNLu.exe
  2⤵
  PID:6084
- C:\Windows\System\SWqjWmm.exe
  C:\Windows\System\SWqjWmm.exe
  2⤵
  PID:5944
- C:\Windows\System\mtELjTc.exe
  C:\Windows\System\mtELjTc.exe
  2⤵
  PID:5764
- C:\Windows\System\FyEvHJl.exe
  C:\Windows\System\FyEvHJl.exe
  2⤵
  PID:5940
- C:\Windows\System\cwrOKmm.exe
  C:\Windows\System\cwrOKmm.exe
  2⤵
  PID:3724
- C:\Windows\System\mAzeyux.exe
  C:\Windows\System\mAzeyux.exe
  2⤵
  PID:6072
- C:\Windows\System\YvYHcpP.exe
  C:\Windows\System\YvYHcpP.exe
  2⤵
  PID:4892
- C:\Windows\System\nzNyoqy.exe
  C:\Windows\System\nzNyoqy.exe
  2⤵
  PID:5168
- C:\Windows\System\lMbRwWh.exe
  C:\Windows\System\lMbRwWh.exe
  2⤵
  PID:5312
- C:\Windows\System\gEzaLAR.exe
  C:\Windows\System\gEzaLAR.exe
  2⤵
  PID:5776
- C:\Windows\System\onaOCfu.exe
  C:\Windows\System\onaOCfu.exe
  2⤵
  PID:5248
- C:\Windows\System\OkfUroy.exe
  C:\Windows\System\OkfUroy.exe
  2⤵
  PID:4908
- C:\Windows\System\GKzxefh.exe
  C:\Windows\System\GKzxefh.exe
  2⤵
  PID:5276
- C:\Windows\System\pRVhrbJ.exe
  C:\Windows\System\pRVhrbJ.exe
  2⤵
  PID:5644
- C:\Windows\System\RFGxOaU.exe
  C:\Windows\System\RFGxOaU.exe
  2⤵
  PID:5476
- C:\Windows\System\gmYixfy.exe
  C:\Windows\System\gmYixfy.exe
  2⤵
  PID:5424
- C:\Windows\System\GILsmxe.exe
  C:\Windows\System\GILsmxe.exe
  2⤵
  PID:5552
- C:\Windows\System\cSmiUxJ.exe
  C:\Windows\System\cSmiUxJ.exe
  2⤵
  PID:5460
- C:\Windows\System\IsvciiY.exe
  C:\Windows\System\IsvciiY.exe
  2⤵
  PID:5584
- C:\Windows\System\RurnuBL.exe
  C:\Windows\System\RurnuBL.exe
  2⤵
  PID:5660
- C:\Windows\System\xgcWKdY.exe
  C:\Windows\System\xgcWKdY.exe
  2⤵
  PID:5680
- C:\Windows\System\OVQQFla.exe
  C:\Windows\System\OVQQFla.exe
  2⤵
  PID:5712
- C:\Windows\System\VJzcEPr.exe
  C:\Windows\System\VJzcEPr.exe
  2⤵
  PID:5732
- C:\Windows\System\yZdWJDL.exe
  C:\Windows\System\yZdWJDL.exe
  2⤵
  PID:5816
- C:\Windows\System\GFJrbKK.exe
  C:\Windows\System\GFJrbKK.exe
  2⤵
  PID:5956
- C:\Windows\System\DTvwXBJ.exe
  C:\Windows\System\DTvwXBJ.exe
  2⤵
  PID:5908
- C:\Windows\System\oIZGEBB.exe
  C:\Windows\System\oIZGEBB.exe
  2⤵
  PID:5112
- C:\Windows\System\hHAgERH.exe
  C:\Windows\System\hHAgERH.exe
  2⤵
  PID:5536
- C:\Windows\System\Jsxxxxi.exe
  C:\Windows\System\Jsxxxxi.exe
  2⤵
  PID:5524
- C:\Windows\System\WNzzeYj.exe
  C:\Windows\System\WNzzeYj.exe
  2⤵
  PID:5976
- C:\Windows\System\bThkaHe.exe
  C:\Windows\System\bThkaHe.exe
  2⤵
  PID:6104
- C:\Windows\System\MTCMECZ.exe
  C:\Windows\System\MTCMECZ.exe
  2⤵
  PID:4456
- C:\Windows\System\qoPmjft.exe
  C:\Windows\System\qoPmjft.exe
  2⤵
  PID:5456
- C:\Windows\System\pZrejYU.exe
  C:\Windows\System\pZrejYU.exe
  2⤵
  PID:5864
- C:\Windows\System\LaZOzAZ.exe
  C:\Windows\System\LaZOzAZ.exe
  2⤵
  PID:5800
- C:\Windows\System\dNFiWrB.exe
  C:\Windows\System\dNFiWrB.exe
  2⤵
  PID:6068
- C:\Windows\System\luWeLkV.exe
  C:\Windows\System\luWeLkV.exe
  2⤵
  PID:5372
- C:\Windows\System\SKPcUBK.exe
  C:\Windows\System\SKPcUBK.exe
  2⤵
  PID:5656
- C:\Windows\System\xzuVwYz.exe
  C:\Windows\System\xzuVwYz.exe
  2⤵
  PID:5308
- C:\Windows\System\rosdajA.exe
  C:\Windows\System\rosdajA.exe
  2⤵
  PID:5728
- C:\Windows\System\ocqfTey.exe
  C:\Windows\System\ocqfTey.exe
  2⤵
  PID:5592
- C:\Windows\System\ScTVseH.exe
  C:\Windows\System\ScTVseH.exe
  2⤵
  PID:5760
- C:\Windows\System\ywKyHuf.exe
  C:\Windows\System\ywKyHuf.exe
  2⤵
  PID:5676
- C:\Windows\System\yrlDPAD.exe
  C:\Windows\System\yrlDPAD.exe
  2⤵
  PID:6024
- C:\Windows\System\URXZSOp.exe
  C:\Windows\System\URXZSOp.exe
  2⤵
  PID:6160
- C:\Windows\System\dPjenyP.exe
  C:\Windows\System\dPjenyP.exe
  2⤵
  PID:6180
- C:\Windows\System\gSUevAJ.exe
  C:\Windows\System\gSUevAJ.exe
  2⤵
  PID:6204
- C:\Windows\System\RBrTNie.exe
  C:\Windows\System\RBrTNie.exe
  2⤵
  PID:6220
- C:\Windows\System\FhsTZBt.exe
  C:\Windows\System\FhsTZBt.exe
  2⤵
  PID:6236
- C:\Windows\System\bPULCzu.exe
  C:\Windows\System\bPULCzu.exe
  2⤵
  PID:6252
- C:\Windows\System\HdGDzCq.exe
  C:\Windows\System\HdGDzCq.exe
  2⤵
  PID:6268
- C:\Windows\System\HjHKDnp.exe
  C:\Windows\System\HjHKDnp.exe
  2⤵
  PID:6284
- C:\Windows\System\dZdaBxi.exe
  C:\Windows\System\dZdaBxi.exe
  2⤵
  PID:6300
- C:\Windows\System\BDgpiTJ.exe
  C:\Windows\System\BDgpiTJ.exe
  2⤵
  PID:6320
- C:\Windows\System\AqWMZiK.exe
  C:\Windows\System\AqWMZiK.exe
  2⤵
  PID:6340
- C:\Windows\System\BfjUPBz.exe
  C:\Windows\System\BfjUPBz.exe
  2⤵
  PID:6440
- C:\Windows\System\mRGZIJk.exe
  C:\Windows\System\mRGZIJk.exe
  2⤵
  PID:6456
- C:\Windows\System\PPUsFei.exe
  C:\Windows\System\PPUsFei.exe
  2⤵
  PID:6476
- C:\Windows\System\IwMbfpm.exe
  C:\Windows\System\IwMbfpm.exe
  2⤵
  PID:6492
- C:\Windows\System\yxCYCzV.exe
  C:\Windows\System\yxCYCzV.exe
  2⤵
  PID:6512
- C:\Windows\System\IuKNvHV.exe
  C:\Windows\System\IuKNvHV.exe
  2⤵
  PID:6528
- C:\Windows\System\QDknYLe.exe
  C:\Windows\System\QDknYLe.exe
  2⤵
  PID:6544
- C:\Windows\System\VhmkbCY.exe
  C:\Windows\System\VhmkbCY.exe
  2⤵
  PID:6564
- C:\Windows\System\mTXQhuI.exe
  C:\Windows\System\mTXQhuI.exe
  2⤵
  PID:6580
- C:\Windows\System\cxNERFO.exe
  C:\Windows\System\cxNERFO.exe
  2⤵
  PID:6596
- C:\Windows\System\nUraDrp.exe
  C:\Windows\System\nUraDrp.exe
  2⤵
  PID:6616
- C:\Windows\System\YpsZOFJ.exe
  C:\Windows\System\YpsZOFJ.exe
  2⤵
  PID:6632
- C:\Windows\System\ISMcIBc.exe
  C:\Windows\System\ISMcIBc.exe
  2⤵
  PID:6648
- C:\Windows\System\OrLVGwy.exe
  C:\Windows\System\OrLVGwy.exe
  2⤵
  PID:6664
- C:\Windows\System\hChOtaV.exe
  C:\Windows\System\hChOtaV.exe
  2⤵
  PID:6680
- C:\Windows\System\OnSQUIa.exe
  C:\Windows\System\OnSQUIa.exe
  2⤵
  PID:6700
- C:\Windows\System\sbAdOlZ.exe
  C:\Windows\System\sbAdOlZ.exe
  2⤵
  PID:6716
- C:\Windows\System\wblbpoh.exe
  C:\Windows\System\wblbpoh.exe
  2⤵
  PID:6732
- C:\Windows\System\NQSSlOw.exe
  C:\Windows\System\NQSSlOw.exe
  2⤵
  PID:6748
- C:\Windows\System\IwavCRf.exe
  C:\Windows\System\IwavCRf.exe
  2⤵
  PID:6768
- C:\Windows\System\YYhgDby.exe
  C:\Windows\System\YYhgDby.exe
  2⤵
  PID:6784
- C:\Windows\System\vfvZJFj.exe
  C:\Windows\System\vfvZJFj.exe
  2⤵
  PID:6800
- C:\Windows\System\GyIyblJ.exe
  C:\Windows\System\GyIyblJ.exe
  2⤵
  PID:6816
- C:\Windows\System\TGdVJFj.exe
  C:\Windows\System\TGdVJFj.exe
  2⤵
  PID:6832
- C:\Windows\System\fqjMOQr.exe
  C:\Windows\System\fqjMOQr.exe
  2⤵
  PID:6852
- C:\Windows\System\JBdnwtc.exe
  C:\Windows\System\JBdnwtc.exe
  2⤵
  PID:6868
- C:\Windows\System\YgenFpb.exe
  C:\Windows\System\YgenFpb.exe
  2⤵
  PID:6884
- C:\Windows\System\HetQZMh.exe
  C:\Windows\System\HetQZMh.exe
  2⤵
  PID:6904
- C:\Windows\System\GvwMKEc.exe
  C:\Windows\System\GvwMKEc.exe
  2⤵
  PID:6924
- C:\Windows\System\yOhtBsh.exe
  C:\Windows\System\yOhtBsh.exe
  2⤵
  PID:6940
- C:\Windows\System\JgUYURR.exe
  C:\Windows\System\JgUYURR.exe
  2⤵
  PID:6960
- C:\Windows\System\gBIPAMW.exe
  C:\Windows\System\gBIPAMW.exe
  2⤵
  PID:6980
- C:\Windows\System\DqZMZJq.exe
  C:\Windows\System\DqZMZJq.exe
  2⤵
  PID:7000
- C:\Windows\System\ZLSXKBd.exe
  C:\Windows\System\ZLSXKBd.exe
  2⤵
  PID:7020
- C:\Windows\System\qsmgSbF.exe
  C:\Windows\System\qsmgSbF.exe
  2⤵
  PID:7116
- C:\Windows\System\RkpEJJy.exe
  C:\Windows\System\RkpEJJy.exe
  2⤵
  PID:7132
- C:\Windows\System\kLPpinD.exe
  C:\Windows\System\kLPpinD.exe
  2⤵
  PID:7148
- C:\Windows\System\LpVsNco.exe
  C:\Windows\System\LpVsNco.exe
  2⤵
  PID:7164
- C:\Windows\System\zFqxvon.exe
  C:\Windows\System\zFqxvon.exe
  2⤵
  PID:6172
- C:\Windows\System\epRACOp.exe
  C:\Windows\System\epRACOp.exe
  2⤵
  PID:6052
- C:\Windows\System\DnFZhni.exe
  C:\Windows\System\DnFZhni.exe
  2⤵
  PID:6200
- C:\Windows\System\xzMZmPy.exe
  C:\Windows\System\xzMZmPy.exe
  2⤵
  PID:4292
- C:\Windows\System\reIgnkg.exe
  C:\Windows\System\reIgnkg.exe
  2⤵
  PID:5872
- C:\Windows\System\lFRQIGd.exe
  C:\Windows\System\lFRQIGd.exe
  2⤵
  PID:5896
- C:\Windows\System\PxubDYD.exe
  C:\Windows\System\PxubDYD.exe
  2⤵
  PID:6156
- C:\Windows\System\ygWMWBu.exe
  C:\Windows\System\ygWMWBu.exe
  2⤵
  PID:6228
- C:\Windows\System\vmoSNGW.exe
  C:\Windows\System\vmoSNGW.exe
  2⤵
  PID:6292
- C:\Windows\System\OCBJKtv.exe
  C:\Windows\System\OCBJKtv.exe
  2⤵
  PID:6360
- C:\Windows\System\TQpFNge.exe
  C:\Windows\System\TQpFNge.exe
  2⤵
  PID:6380
- C:\Windows\System\RSNWtRs.exe
  C:\Windows\System\RSNWtRs.exe
  2⤵
  PID:6392
- C:\Windows\System\AoUWTiS.exe
  C:\Windows\System\AoUWTiS.exe
  2⤵
  PID:6412
- C:\Windows\System\yKlVBer.exe
  C:\Windows\System\yKlVBer.exe
  2⤵
  PID:6448
- C:\Windows\System\UNWohSD.exe
  C:\Windows\System\UNWohSD.exe
  2⤵
  PID:6524
- C:\Windows\System\Zilpmym.exe
  C:\Windows\System\Zilpmym.exe
  2⤵
  PID:6624
- C:\Windows\System\dcDuEFt.exe
  C:\Windows\System\dcDuEFt.exe
  2⤵
  PID:6688
- C:\Windows\System\SDOwfwn.exe
  C:\Windows\System\SDOwfwn.exe
  2⤵
  PID:6728
- C:\Windows\System\SHnENDB.exe
  C:\Windows\System\SHnENDB.exe
  2⤵
  PID:6828
- C:\Windows\System\NMBrZHb.exe
  C:\Windows\System\NMBrZHb.exe
  2⤵
  PID:6424
- C:\Windows\System\mwAUiPi.exe
  C:\Windows\System\mwAUiPi.exe
  2⤵
  PID:6824
- C:\Windows\System\NbxraRS.exe
  C:\Windows\System\NbxraRS.exe
  2⤵
  PID:6472
- C:\Windows\System\bLmHsjh.exe
  C:\Windows\System\bLmHsjh.exe
  2⤵
  PID:6540
- C:\Windows\System\IkuRrvl.exe
  C:\Windows\System\IkuRrvl.exe
  2⤵
  PID:6608
- C:\Windows\System\JkEjeZR.exe
  C:\Windows\System\JkEjeZR.exe
  2⤵
  PID:6676
- C:\Windows\System\NBnWkmW.exe
  C:\Windows\System\NBnWkmW.exe
  2⤵
  PID:6744
- C:\Windows\System\ChdfnZl.exe
  C:\Windows\System\ChdfnZl.exe
  2⤵
  PID:6840
- C:\Windows\System\celJLpB.exe
  C:\Windows\System\celJLpB.exe
  2⤵
  PID:6880
- C:\Windows\System\uEFNVmC.exe
  C:\Windows\System\uEFNVmC.exe
  2⤵
  PID:6764
- C:\Windows\System\lysIucA.exe
  C:\Windows\System\lysIucA.exe
  2⤵
  PID:6968
- C:\Windows\System\CrTIyQO.exe
  C:\Windows\System\CrTIyQO.exe
  2⤵
  PID:6972
- C:\Windows\System\ihMVALn.exe
  C:\Windows\System\ihMVALn.exe
  2⤵
  PID:6988
- C:\Windows\System\IzIBtHJ.exe
  C:\Windows\System\IzIBtHJ.exe
  2⤵
  PID:7032
- C:\Windows\System\sbEhwKf.exe
  C:\Windows\System\sbEhwKf.exe
  2⤵
  PID:7072
- C:\Windows\System\DiyXduT.exe
  C:\Windows\System\DiyXduT.exe
  2⤵
  PID:7052
- C:\Windows\System\IykIJEj.exe
  C:\Windows\System\IykIJEj.exe
  2⤵
  PID:7048
- C:\Windows\System\TDQXOkb.exe
  C:\Windows\System\TDQXOkb.exe
  2⤵
  PID:7088
- C:\Windows\System\hDZEfTQ.exe
  C:\Windows\System\hDZEfTQ.exe
  2⤵
  PID:7140
- C:\Windows\System\hFOSOSE.exe
  C:\Windows\System\hFOSOSE.exe
  2⤵
  PID:6040
- C:\Windows\System\psMClFc.exe
  C:\Windows\System\psMClFc.exe
  2⤵
  PID:7156
- C:\Windows\System\DWxmICa.exe
  C:\Windows\System\DWxmICa.exe
  2⤵
  PID:6276
- C:\Windows\System\kUVHQJf.exe
  C:\Windows\System\kUVHQJf.exe
  2⤵
  PID:6316
- C:\Windows\System\oAUBurG.exe
  C:\Windows\System\oAUBurG.exe
  2⤵
  PID:5876
- C:\Windows\System\AhdafwY.exe
  C:\Windows\System\AhdafwY.exe
  2⤵
  PID:5356
- C:\Windows\System\qJxYlIP.exe
  C:\Windows\System\qJxYlIP.exe
  2⤵
  PID:6264
- C:\Windows\System\dzgQUUY.exe
  C:\Windows\System\dzgQUUY.exe
  2⤵
  PID:6404
- C:\Windows\System\TndLzUG.exe
  C:\Windows\System\TndLzUG.exe
  2⤵
  PID:6660
- C:\Windows\System\EQYPGHX.exe
  C:\Windows\System\EQYPGHX.exe
  2⤵
  PID:6796
- C:\Windows\System\EbtHQNN.exe
  C:\Windows\System\EbtHQNN.exe
  2⤵
  PID:6508
- C:\Windows\System\pIFImqc.exe
  C:\Windows\System\pIFImqc.exe
  2⤵
  PID:6672
- C:\Windows\System\OmgwdpP.exe
  C:\Windows\System\OmgwdpP.exe
  2⤵
  PID:6808
- C:\Windows\System\eaBRCDq.exe
  C:\Windows\System\eaBRCDq.exe
  2⤵
  PID:6956
- C:\Windows\System\hMOnAMJ.exe
  C:\Windows\System\hMOnAMJ.exe
  2⤵
  PID:6196
- C:\Windows\System\ArOsMgs.exe
  C:\Windows\System\ArOsMgs.exe
  2⤵
  PID:7028
- C:\Windows\System\luAwzcO.exe
  C:\Windows\System\luAwzcO.exe
  2⤵
  PID:6712
- C:\Windows\System\qgTjWat.exe
  C:\Windows\System\qgTjWat.exe
  2⤵
  PID:5724
- C:\Windows\System\xPPwOmZ.exe
  C:\Windows\System\xPPwOmZ.exe
  2⤵
  PID:7112
- C:\Windows\System\yGmNlAf.exe
  C:\Windows\System\yGmNlAf.exe
  2⤵
  PID:6556
- C:\Windows\System\IopJaHU.exe
  C:\Windows\System\IopJaHU.exe
  2⤵
  PID:6860
- C:\Windows\System\CrWnguR.exe
  C:\Windows\System\CrWnguR.exe
  2⤵
  PID:6308
- C:\Windows\System\oDiGvlk.exe
  C:\Windows\System\oDiGvlk.exe
  2⤵
  PID:6604
- C:\Windows\System\QooTaiA.exe
  C:\Windows\System\QooTaiA.exe
  2⤵
  PID:7124
- C:\Windows\System\QKofACg.exe
  C:\Windows\System\QKofACg.exe
  2⤵
  PID:7016
- C:\Windows\System\AcqtvNx.exe
  C:\Windows\System\AcqtvNx.exe
  2⤵
  PID:7040
- C:\Windows\System\mpDvFoz.exe
  C:\Windows\System\mpDvFoz.exe
  2⤵
  PID:6248
- C:\Windows\System\dUVDYjr.exe
  C:\Windows\System\dUVDYjr.exe
  2⤵
  PID:6260
- C:\Windows\System\iUQPYym.exe
  C:\Windows\System\iUQPYym.exe
  2⤵
  PID:6900
- C:\Windows\System\xpLvIsT.exe
  C:\Windows\System\xpLvIsT.exe
  2⤵
  PID:6780
- C:\Windows\System\KvGoscH.exe
  C:\Windows\System\KvGoscH.exe
  2⤵
  PID:5412
- C:\Windows\System\QDYHSJV.exe
  C:\Windows\System\QDYHSJV.exe
  2⤵
  PID:7080
- C:\Windows\System\KXdxktN.exe
  C:\Windows\System\KXdxktN.exe
  2⤵
  PID:6468
- C:\Windows\System\iXDsHep.exe
  C:\Windows\System\iXDsHep.exe
  2⤵
  PID:6400
- C:\Windows\System\toLEySo.exe
  C:\Windows\System\toLEySo.exe
  2⤵
  PID:6588
- C:\Windows\System\yBwyKeG.exe
  C:\Windows\System\yBwyKeG.exe
  2⤵
  PID:6152
- C:\Windows\System\KKPDlzb.exe
  C:\Windows\System\KKPDlzb.exe
  2⤵
  PID:6384
- C:\Windows\System\BTiJehG.exe
  C:\Windows\System\BTiJehG.exe
  2⤵
  PID:7128
- C:\Windows\System\ZeZpDRj.exe
  C:\Windows\System\ZeZpDRj.exe
  2⤵
  PID:6756
- C:\Windows\System\wjHUFPp.exe
  C:\Windows\System\wjHUFPp.exe
  2⤵
  PID:6920
- C:\Windows\System\IuKeLtL.exe
  C:\Windows\System\IuKeLtL.exe
  2⤵
  PID:6644
- C:\Windows\System\pAIkPdq.exe
  C:\Windows\System\pAIkPdq.exe
  2⤵
  PID:6724
- C:\Windows\System\rrNHcNk.exe
  C:\Windows\System\rrNHcNk.exe
  2⤵
  PID:7180
- C:\Windows\System\gpcclbU.exe
  C:\Windows\System\gpcclbU.exe
  2⤵
  PID:7196
- C:\Windows\System\HjcLmju.exe
  C:\Windows\System\HjcLmju.exe
  2⤵
  PID:7216
- C:\Windows\System\fqFMFTB.exe
  C:\Windows\System\fqFMFTB.exe
  2⤵
  PID:7232
- C:\Windows\System\YqEqcZg.exe
  C:\Windows\System\YqEqcZg.exe
  2⤵
  PID:7248
- C:\Windows\System\YoUWYJf.exe
  C:\Windows\System\YoUWYJf.exe
  2⤵
  PID:7268
- C:\Windows\System\pmDoncB.exe
  C:\Windows\System\pmDoncB.exe
  2⤵
  PID:7284
- C:\Windows\System\meJdKJW.exe
  C:\Windows\System\meJdKJW.exe
  2⤵
  PID:7300
- C:\Windows\System\qciVzEO.exe
  C:\Windows\System\qciVzEO.exe
  2⤵
  PID:7320
- C:\Windows\System\EkiXwep.exe
  C:\Windows\System\EkiXwep.exe
  2⤵
  PID:7356
- C:\Windows\System\ajvxRAP.exe
  C:\Windows\System\ajvxRAP.exe
  2⤵
  PID:7376
- C:\Windows\System\AGaBVuc.exe
  C:\Windows\System\AGaBVuc.exe
  2⤵
  PID:7396
- C:\Windows\System\EjDjbAI.exe
  C:\Windows\System\EjDjbAI.exe
  2⤵
  PID:7416
- C:\Windows\System\hHKJtYf.exe
  C:\Windows\System\hHKJtYf.exe
  2⤵
  PID:7432
- C:\Windows\System\HYAzGer.exe
  C:\Windows\System\HYAzGer.exe
  2⤵
  PID:7448
- C:\Windows\System\TIvjneT.exe
  C:\Windows\System\TIvjneT.exe
  2⤵
  PID:7464
- C:\Windows\System\aWmrOgn.exe
  C:\Windows\System\aWmrOgn.exe
  2⤵
  PID:7480
- C:\Windows\System\jvzFftY.exe
  C:\Windows\System\jvzFftY.exe
  2⤵
  PID:7496
- C:\Windows\System\DRZtmRQ.exe
  C:\Windows\System\DRZtmRQ.exe
  2⤵
  PID:7512
- C:\Windows\System\RWrdpQx.exe
  C:\Windows\System\RWrdpQx.exe
  2⤵
  PID:7528
- C:\Windows\System\nbtTmbj.exe
  C:\Windows\System\nbtTmbj.exe
  2⤵
  PID:7544
- C:\Windows\System\XRJeVXm.exe
  C:\Windows\System\XRJeVXm.exe
  2⤵
  PID:7560
- C:\Windows\System\DnPYqoI.exe
  C:\Windows\System\DnPYqoI.exe
  2⤵
  PID:7576
- C:\Windows\System\jFJxUFR.exe
  C:\Windows\System\jFJxUFR.exe
  2⤵
  PID:7592
- C:\Windows\System\CGUuuAU.exe
  C:\Windows\System\CGUuuAU.exe
  2⤵
  PID:7608
- C:\Windows\System\WyVgHpf.exe
  C:\Windows\System\WyVgHpf.exe
  2⤵
  PID:7624
- C:\Windows\System\HmwhDcO.exe
  C:\Windows\System\HmwhDcO.exe
  2⤵
  PID:7640
- C:\Windows\System\qlIhksx.exe
  C:\Windows\System\qlIhksx.exe
  2⤵
  PID:7656
- C:\Windows\System\nLJNCUc.exe
  C:\Windows\System\nLJNCUc.exe
  2⤵
  PID:7672
- C:\Windows\System\saNRjwW.exe
  C:\Windows\System\saNRjwW.exe
  2⤵
  PID:7688
- C:\Windows\System\IyEjmSO.exe
  C:\Windows\System\IyEjmSO.exe
  2⤵
  PID:7704
- C:\Windows\System\sTZeoIu.exe
  C:\Windows\System\sTZeoIu.exe
  2⤵
  PID:7720
- C:\Windows\System\BmpfIta.exe
  C:\Windows\System\BmpfIta.exe
  2⤵
  PID:7736
- C:\Windows\System\jHqlInf.exe
  C:\Windows\System\jHqlInf.exe
  2⤵
  PID:7752
- C:\Windows\System\skAaBNK.exe
  C:\Windows\System\skAaBNK.exe
  2⤵
  PID:7768
- C:\Windows\System\JBoYINx.exe
  C:\Windows\System\JBoYINx.exe
  2⤵
  PID:7784
- C:\Windows\System\xoHBxKV.exe
  C:\Windows\System\xoHBxKV.exe
  2⤵
  PID:7800
- C:\Windows\System\GQevyFz.exe
  C:\Windows\System\GQevyFz.exe
  2⤵
  PID:7816
- C:\Windows\System\mdTFuut.exe
  C:\Windows\System\mdTFuut.exe
  2⤵
  PID:7836
- C:\Windows\System\GgyfcrQ.exe
  C:\Windows\System\GgyfcrQ.exe
  2⤵
  PID:7852
- C:\Windows\System\QpkQAMu.exe
  C:\Windows\System\QpkQAMu.exe
  2⤵
  PID:7868
- C:\Windows\System\okxAQTv.exe
  C:\Windows\System\okxAQTv.exe
  2⤵
  PID:7884
- C:\Windows\System\EvFXAUZ.exe
  C:\Windows\System\EvFXAUZ.exe
  2⤵
  PID:7900
- C:\Windows\System\prNbejN.exe
  C:\Windows\System\prNbejN.exe
  2⤵
  PID:7916
- C:\Windows\System\VeWuyhV.exe
  C:\Windows\System\VeWuyhV.exe
  2⤵
  PID:7932
- C:\Windows\System\YvqCmQT.exe
  C:\Windows\System\YvqCmQT.exe
  2⤵
  PID:7948
- C:\Windows\System\OQvptWa.exe
  C:\Windows\System\OQvptWa.exe
  2⤵
  PID:7964
- C:\Windows\System\GYvMzKc.exe
  C:\Windows\System\GYvMzKc.exe
  2⤵
  PID:7980
- C:\Windows\System\zvWsZqo.exe
  C:\Windows\System\zvWsZqo.exe
  2⤵
  PID:7996
- C:\Windows\System\foWjQvP.exe
  C:\Windows\System\foWjQvP.exe
  2⤵
  PID:8012
- C:\Windows\System\cmwAUFw.exe
  C:\Windows\System\cmwAUFw.exe
  2⤵
  PID:8028
- C:\Windows\System\HrgmJDV.exe
  C:\Windows\System\HrgmJDV.exe
  2⤵
  PID:8044
- C:\Windows\System\PWgfvfN.exe
  C:\Windows\System\PWgfvfN.exe
  2⤵
  PID:8060
- C:\Windows\System\ZUGuTRn.exe
  C:\Windows\System\ZUGuTRn.exe
  2⤵
  PID:8076
- C:\Windows\System\LAAHJIX.exe
  C:\Windows\System\LAAHJIX.exe
  2⤵
  PID:8092
- C:\Windows\System\uGNXhWT.exe
  C:\Windows\System\uGNXhWT.exe
  2⤵
  PID:8108
- C:\Windows\System\Rxheimy.exe
  C:\Windows\System\Rxheimy.exe
  2⤵
  PID:8124
- C:\Windows\System\uOoTven.exe
  C:\Windows\System\uOoTven.exe
  2⤵
  PID:8140
- C:\Windows\System\ugiHLRW.exe
  C:\Windows\System\ugiHLRW.exe
  2⤵
  PID:8156
- C:\Windows\System\mcnLnex.exe
  C:\Windows\System\mcnLnex.exe
  2⤵
  PID:8172
- C:\Windows\System\hNgLdDg.exe
  C:\Windows\System\hNgLdDg.exe
  2⤵
  PID:8188
- C:\Windows\System\IMjTCun.exe
  C:\Windows\System\IMjTCun.exe
  2⤵
  PID:7068
- C:\Windows\System\leIDQWc.exe
  C:\Windows\System\leIDQWc.exe
  2⤵
  PID:7176
- C:\Windows\System\FgrtSME.exe
  C:\Windows\System\FgrtSME.exe
  2⤵
  PID:7036
- C:\Windows\System\SfzMQuL.exe
  C:\Windows\System\SfzMQuL.exe
  2⤵
  PID:7240
- C:\Windows\System\VJnuktv.exe
  C:\Windows\System\VJnuktv.exe
  2⤵
  PID:7308
- C:\Windows\System\DDZUtzC.exe
  C:\Windows\System\DDZUtzC.exe
  2⤵
  PID:6100
- C:\Windows\System\zbnBggs.exe
  C:\Windows\System\zbnBggs.exe
  2⤵
  PID:6416
- C:\Windows\System\yNGXwzC.exe
  C:\Windows\System\yNGXwzC.exe
  2⤵
  PID:6356
- C:\Windows\System\tARCWLI.exe
  C:\Windows\System\tARCWLI.exe
  2⤵
  PID:7188
- C:\Windows\System\ooTNHem.exe
  C:\Windows\System\ooTNHem.exe
  2⤵
  PID:7368
- C:\Windows\System\cIQUrhS.exe
  C:\Windows\System\cIQUrhS.exe
  2⤵
  PID:7404
- C:\Windows\System\xcnzPpj.exe
  C:\Windows\System\xcnzPpj.exe
  2⤵
  PID:7352
- C:\Windows\System\ApldRRO.exe
  C:\Windows\System\ApldRRO.exe
  2⤵
  PID:7388
- C:\Windows\System\KTiFgmv.exe
  C:\Windows\System\KTiFgmv.exe
  2⤵
  PID:7392
- C:\Windows\System\ZlqpzxG.exe
  C:\Windows\System\ZlqpzxG.exe
  2⤵
  PID:7444
- C:\Windows\System\BXGgvap.exe
  C:\Windows\System\BXGgvap.exe
  2⤵
  PID:7460
- C:\Windows\System\ynHaXEi.exe
  C:\Windows\System\ynHaXEi.exe
  2⤵
  PID:7536
- C:\Windows\System\SsTvxIV.exe
  C:\Windows\System\SsTvxIV.exe
  2⤵
  PID:7600
- C:\Windows\System\UZLUzAq.exe
  C:\Windows\System\UZLUzAq.exe
  2⤵
  PID:7664
- C:\Windows\System\CYDQrLH.exe
  C:\Windows\System\CYDQrLH.exe
  2⤵
  PID:7700
- C:\Windows\System\hPeLgDE.exe
  C:\Windows\System\hPeLgDE.exe
  2⤵
  PID:7584
- C:\Windows\System\HiaVirz.exe
  C:\Windows\System\HiaVirz.exe
  2⤵
  PID:7680
- C:\Windows\System\coAuRdz.exe
  C:\Windows\System\coAuRdz.exe
  2⤵
  PID:7684
- C:\Windows\System\zkQgEBG.exe
  C:\Windows\System\zkQgEBG.exe
  2⤵
  PID:7732
- C:\Windows\System\meUNqbe.exe
  C:\Windows\System\meUNqbe.exe
  2⤵
  PID:7792
- C:\Windows\System\fcbabYx.exe
  C:\Windows\System\fcbabYx.exe
  2⤵
  PID:7832
- C:\Windows\System\gLzKSFo.exe
  C:\Windows\System\gLzKSFo.exe
  2⤵
  PID:7896
- C:\Windows\System\qVZiwvu.exe
  C:\Windows\System\qVZiwvu.exe
  2⤵
  PID:7960
- C:\Windows\System\YdBbDxy.exe
  C:\Windows\System\YdBbDxy.exe
  2⤵
  PID:8020
- C:\Windows\System\eBxyisp.exe
  C:\Windows\System\eBxyisp.exe
  2⤵
  PID:7776
- C:\Windows\System\aBaQoCu.exe
  C:\Windows\System\aBaQoCu.exe
  2⤵
  PID:7848
- C:\Windows\System\fiKrxgr.exe
  C:\Windows\System\fiKrxgr.exe
  2⤵
  PID:8088
- C:\Windows\System\Fcgmdhc.exe
  C:\Windows\System\Fcgmdhc.exe
  2⤵
  PID:8148
- C:\Windows\System\KkBvBxj.exe
  C:\Windows\System\KkBvBxj.exe
  2⤵
  PID:7912
- C:\Windows\System\InrwgID.exe
  C:\Windows\System\InrwgID.exe
  2⤵
  PID:8184
- C:\Windows\System\jZDszvD.exe
  C:\Windows\System\jZDszvD.exe
  2⤵
  PID:8004
- C:\Windows\System\gfEJwWG.exe
  C:\Windows\System\gfEJwWG.exe
  2⤵
  PID:7044
- C:\Windows\System\WPCGLsj.exe
  C:\Windows\System\WPCGLsj.exe
  2⤵
  PID:7212
- C:\Windows\System\pQSSaAI.exe
  C:\Windows\System\pQSSaAI.exe
  2⤵
  PID:8164
- C:\Windows\System\weoBrzz.exe
  C:\Windows\System\weoBrzz.exe
  2⤵
  PID:8132
- C:\Windows\System\qLxnAjy.exe
  C:\Windows\System\qLxnAjy.exe
  2⤵
  PID:7280
- C:\Windows\System\kXseuwo.exe
  C:\Windows\System\kXseuwo.exe
  2⤵
  PID:6932
- C:\Windows\System\eJxRPTN.exe
  C:\Windows\System\eJxRPTN.exe
  2⤵
  PID:7476
- C:\Windows\System\vddcOLP.exe
  C:\Windows\System\vddcOLP.exe
  2⤵
  PID:7520
- C:\Windows\System\RHYKkWZ.exe
  C:\Windows\System\RHYKkWZ.exe
  2⤵
  PID:7296
- C:\Windows\System\wgacYLk.exe
  C:\Windows\System\wgacYLk.exe
  2⤵
  PID:7556
- C:\Windows\System\lWmjoGj.exe
  C:\Windows\System\lWmjoGj.exe
  2⤵
  PID:7384
- C:\Windows\System\nfrkOUC.exe
  C:\Windows\System\nfrkOUC.exe
  2⤵
  PID:7632
- C:\Windows\System\qAmJuwr.exe
  C:\Windows\System\qAmJuwr.exe
  2⤵
  PID:7828
- C:\Windows\System\eCmCyAo.exe
  C:\Windows\System\eCmCyAo.exe
  2⤵
  PID:7504
- C:\Windows\System\WRxuoyf.exe
  C:\Windows\System\WRxuoyf.exe
  2⤵
  PID:7748
- C:\Windows\System\ZAgyuFe.exe
  C:\Windows\System\ZAgyuFe.exe
  2⤵
  PID:8056
- C:\Windows\System\dxsihXu.exe
  C:\Windows\System\dxsihXu.exe
  2⤵
  PID:7988
- C:\Windows\System\eZFHTHV.exe
  C:\Windows\System\eZFHTHV.exe
  2⤵
  PID:6352
- C:\Windows\System\XvVQTPv.exe
  C:\Windows\System\XvVQTPv.exe
  2⤵
  PID:7208
- C:\Windows\System\dKmjsRl.exe
  C:\Windows\System\dKmjsRl.exe
  2⤵
  PID:7328
- C:\Windows\System\vxilIWo.exe
  C:\Windows\System\vxilIWo.exe
  2⤵
  PID:8120
- C:\Windows\System\SNYFpEy.exe
  C:\Windows\System\SNYFpEy.exe
  2⤵
  PID:7568
- C:\Windows\System\GcvfiJA.exe
  C:\Windows\System\GcvfiJA.exe
  2⤵
  PID:7428
- C:\Windows\System\yqekFHg.exe
  C:\Windows\System\yqekFHg.exe
  2⤵
  PID:8040
- C:\Windows\System\tHYFaBw.exe
  C:\Windows\System\tHYFaBw.exe
  2⤵
  PID:7364
- C:\Windows\System\FQZtfzQ.exe
  C:\Windows\System\FQZtfzQ.exe
  2⤵
  PID:7652
- C:\Windows\System\sTFGcII.exe
  C:\Windows\System\sTFGcII.exe
  2⤵
  PID:7616
- C:\Windows\System\dVrelgO.exe
  C:\Windows\System\dVrelgO.exe
  2⤵
  PID:7972
- C:\Windows\System\JsOOitV.exe
  C:\Windows\System\JsOOitV.exe
  2⤵
  PID:7552
- C:\Windows\System\pulZtEZ.exe
  C:\Windows\System\pulZtEZ.exe
  2⤵
  PID:8100
- C:\Windows\System\BEsYrFx.exe
  C:\Windows\System\BEsYrFx.exe
  2⤵
  PID:7508
- C:\Windows\System\jFmJfMX.exe
  C:\Windows\System\jFmJfMX.exe
  2⤵
  PID:7264
- C:\Windows\System\eZfqpGN.exe
  C:\Windows\System\eZfqpGN.exe
  2⤵
  PID:7408
- C:\Windows\System\mFzgGBU.exe
  C:\Windows\System\mFzgGBU.exe
  2⤵
  PID:7228
- C:\Windows\System\sPEhcKc.exe
  C:\Windows\System\sPEhcKc.exe
  2⤵
  PID:8200
- C:\Windows\System\jljrtIC.exe
  C:\Windows\System\jljrtIC.exe
  2⤵
  PID:8216
- C:\Windows\System\sHRyABy.exe
  C:\Windows\System\sHRyABy.exe
  2⤵
  PID:8232
- C:\Windows\System\eVlyKFv.exe
  C:\Windows\System\eVlyKFv.exe
  2⤵
  PID:8248
- C:\Windows\System\dvPlpFk.exe
  C:\Windows\System\dvPlpFk.exe
  2⤵
  PID:8264
- C:\Windows\System\eSGqOGo.exe
  C:\Windows\System\eSGqOGo.exe
  2⤵
  PID:8280
- C:\Windows\System\PHQyoOi.exe
  C:\Windows\System\PHQyoOi.exe
  2⤵
  PID:8296
- C:\Windows\System\eYSGxfN.exe
  C:\Windows\System\eYSGxfN.exe
  2⤵
  PID:8312
- C:\Windows\System\cYQNQYi.exe
  C:\Windows\System\cYQNQYi.exe
  2⤵
  PID:8328
- C:\Windows\System\OgNgEXA.exe
  C:\Windows\System\OgNgEXA.exe
  2⤵
  PID:8344
- C:\Windows\System\BCCkRCu.exe
  C:\Windows\System\BCCkRCu.exe
  2⤵
  PID:8360
- C:\Windows\System\zLYfMUY.exe
  C:\Windows\System\zLYfMUY.exe
  2⤵
  PID:8376
- C:\Windows\System\ZWPGqGL.exe
  C:\Windows\System\ZWPGqGL.exe
  2⤵
  PID:8392
- C:\Windows\System\nxWKrif.exe
  C:\Windows\System\nxWKrif.exe
  2⤵
  PID:8408
- C:\Windows\System\bdSqSEq.exe
  C:\Windows\System\bdSqSEq.exe
  2⤵
  PID:8424
- C:\Windows\System\HsyevpB.exe
  C:\Windows\System\HsyevpB.exe
  2⤵
  PID:8440
- C:\Windows\System\kyjWkre.exe
  C:\Windows\System\kyjWkre.exe
  2⤵
  PID:8456
- C:\Windows\System\aTHoofj.exe
  C:\Windows\System\aTHoofj.exe
  2⤵
  PID:8472
- C:\Windows\System\fuOoKhK.exe
  C:\Windows\System\fuOoKhK.exe
  2⤵
  PID:8488
- C:\Windows\System\YgtkXYP.exe
  C:\Windows\System\YgtkXYP.exe
  2⤵
  PID:8504
- C:\Windows\System\uTKyxfT.exe
  C:\Windows\System\uTKyxfT.exe
  2⤵
  PID:8520
- C:\Windows\System\wLZayDw.exe
  C:\Windows\System\wLZayDw.exe
  2⤵
  PID:8536
- C:\Windows\System\BFeIsIM.exe
  C:\Windows\System\BFeIsIM.exe
  2⤵
  PID:8552
- C:\Windows\System\NxrBaLK.exe
  C:\Windows\System\NxrBaLK.exe
  2⤵
  PID:8568
- C:\Windows\System\klWvJAk.exe
  C:\Windows\System\klWvJAk.exe
  2⤵
  PID:8584
- C:\Windows\System\HnHguPx.exe
  C:\Windows\System\HnHguPx.exe
  2⤵
  PID:8600
- C:\Windows\System\PFafXnf.exe
  C:\Windows\System\PFafXnf.exe
  2⤵
  PID:8616
- C:\Windows\System\KUqzQFl.exe
  C:\Windows\System\KUqzQFl.exe
  2⤵
  PID:8632
- C:\Windows\System\rYxMhfs.exe
  C:\Windows\System\rYxMhfs.exe
  2⤵
  PID:8648
- C:\Windows\System\GTASvqh.exe
  C:\Windows\System\GTASvqh.exe
  2⤵
  PID:8664
- C:\Windows\System\dUiqGtT.exe
  C:\Windows\System\dUiqGtT.exe
  2⤵
  PID:8680
- C:\Windows\System\vwQZSeP.exe
  C:\Windows\System\vwQZSeP.exe
  2⤵
  PID:8700
- C:\Windows\System\LqadDxg.exe
  C:\Windows\System\LqadDxg.exe
  2⤵
  PID:8716
- C:\Windows\System\zFrrYol.exe
  C:\Windows\System\zFrrYol.exe
  2⤵
  PID:8732
- C:\Windows\System\ISaLNGX.exe
  C:\Windows\System\ISaLNGX.exe
  2⤵
  PID:8748
- C:\Windows\System\MIYcRof.exe
  C:\Windows\System\MIYcRof.exe
  2⤵
  PID:8764
- C:\Windows\System\FnJBxGQ.exe
  C:\Windows\System\FnJBxGQ.exe
  2⤵
  PID:8780
- C:\Windows\System\VVPMETd.exe
  C:\Windows\System\VVPMETd.exe
  2⤵
  PID:8796
- C:\Windows\System\aAMiiju.exe
  C:\Windows\System\aAMiiju.exe
  2⤵
  PID:8812
- C:\Windows\System\UtAHKeG.exe
  C:\Windows\System\UtAHKeG.exe
  2⤵
  PID:8828
- C:\Windows\System\nPSHlWU.exe
  C:\Windows\System\nPSHlWU.exe
  2⤵
  PID:8844
- C:\Windows\System\AcccQvo.exe
  C:\Windows\System\AcccQvo.exe
  2⤵
  PID:8860
- C:\Windows\System\iFpZSwP.exe
  C:\Windows\System\iFpZSwP.exe
  2⤵
  PID:8876
- C:\Windows\System\jSaEvmz.exe
  C:\Windows\System\jSaEvmz.exe
  2⤵
  PID:8892
- C:\Windows\System\fMgBPJL.exe
  C:\Windows\System\fMgBPJL.exe
  2⤵
  PID:8908
- C:\Windows\System\pdNpeZU.exe
  C:\Windows\System\pdNpeZU.exe
  2⤵
  PID:8924
- C:\Windows\System\rQuPkVw.exe
  C:\Windows\System\rQuPkVw.exe
  2⤵
  PID:8940
- C:\Windows\System\zCCgucU.exe
  C:\Windows\System\zCCgucU.exe
  2⤵
  PID:8956
- C:\Windows\System\gjkDcbO.exe
  C:\Windows\System\gjkDcbO.exe
  2⤵
  PID:8972
- C:\Windows\System\SzBWTvo.exe
  C:\Windows\System\SzBWTvo.exe
  2⤵
  PID:8988
- C:\Windows\System\ngBkcMX.exe
  C:\Windows\System\ngBkcMX.exe
  2⤵
  PID:9008
- C:\Windows\System\CRszpoS.exe
  C:\Windows\System\CRszpoS.exe
  2⤵
  PID:9024
- C:\Windows\System\ZGeCTfc.exe
  C:\Windows\System\ZGeCTfc.exe
  2⤵
  PID:9040
- C:\Windows\System\ZqaHdCX.exe
  C:\Windows\System\ZqaHdCX.exe
  2⤵
  PID:9056
- C:\Windows\System\QmJBSke.exe
  C:\Windows\System\QmJBSke.exe
  2⤵
  PID:9072
- C:\Windows\System\DVpCkLR.exe
  C:\Windows\System\DVpCkLR.exe
  2⤵
  PID:9088
- C:\Windows\System\NaLyMXc.exe
  C:\Windows\System\NaLyMXc.exe
  2⤵
  PID:9104
- C:\Windows\System\BCaYeIg.exe
  C:\Windows\System\BCaYeIg.exe
  2⤵
  PID:9120
- C:\Windows\System\QOzJxuo.exe
  C:\Windows\System\QOzJxuo.exe
  2⤵
  PID:9136
- C:\Windows\System\hccvWeU.exe
  C:\Windows\System\hccvWeU.exe
  2⤵
  PID:9152
- C:\Windows\System\EakdZSM.exe
  C:\Windows\System\EakdZSM.exe
  2⤵
  PID:9168
- C:\Windows\System\NetOiXn.exe
  C:\Windows\System\NetOiXn.exe
  2⤵
  PID:9184
- C:\Windows\System\brPEPzF.exe
  C:\Windows\System\brPEPzF.exe
  2⤵
  PID:9200
- C:\Windows\System\dIJxoLy.exe
  C:\Windows\System\dIJxoLy.exe
  2⤵
  PID:7440
- C:\Windows\System\zrAWCBY.exe
  C:\Windows\System\zrAWCBY.exe
  2⤵
  PID:5228
- C:\Windows\System\YaCkUUg.exe
  C:\Windows\System\YaCkUUg.exe
  2⤵
  PID:7332
- C:\Windows\System\QZIOVZZ.exe
  C:\Windows\System\QZIOVZZ.exe
  2⤵
  PID:8136
- C:\Windows\System\IyDHxNB.exe
  C:\Windows\System\IyDHxNB.exe
  2⤵
  PID:8224
- C:\Windows\System\yozUmQp.exe
  C:\Windows\System\yozUmQp.exe
  2⤵
  PID:8324
- C:\Windows\System\InwsCdK.exe
  C:\Windows\System\InwsCdK.exe
  2⤵
  PID:8276
- C:\Windows\System\iWYRpMo.exe
  C:\Windows\System\iWYRpMo.exe
  2⤵
  PID:8340
- C:\Windows\System\iCeyocG.exe
  C:\Windows\System\iCeyocG.exe
  2⤵
  PID:8352
- C:\Windows\System\lpNZdYi.exe
  C:\Windows\System\lpNZdYi.exe
  2⤵
  PID:8388
- C:\Windows\System\vXwpHXC.exe
  C:\Windows\System\vXwpHXC.exe
  2⤵
  PID:8464
- C:\Windows\System\lFQNGZW.exe
  C:\Windows\System\lFQNGZW.exe
  2⤵
  PID:8420
- C:\Windows\System\NJYDPVH.exe
  C:\Windows\System\NJYDPVH.exe
  2⤵
  PID:8484
- C:\Windows\System\ptwvhSn.exe
  C:\Windows\System\ptwvhSn.exe
  2⤵
  PID:8548
- C:\Windows\System\yxEJTbr.exe
  C:\Windows\System\yxEJTbr.exe
  2⤵
  PID:8528
- C:\Windows\System\xcPkukT.exe
  C:\Windows\System\xcPkukT.exe
  2⤵
  PID:8592
- C:\Windows\System\GDwmSdi.exe
  C:\Windows\System\GDwmSdi.exe
  2⤵
  PID:8608
- C:\Windows\System\KPtbyfd.exe
  C:\Windows\System\KPtbyfd.exe
  2⤵
  PID:8660
- C:\Windows\System\tfCuJYr.exe
  C:\Windows\System\tfCuJYr.exe
  2⤵
  PID:8676
- C:\Windows\System\mJizmYb.exe
  C:\Windows\System\mJizmYb.exe
  2⤵
  PID:8672
- C:\Windows\System\zrNPPlt.exe
  C:\Windows\System\zrNPPlt.exe
  2⤵
  PID:8788
- C:\Windows\System\TkBXFZP.exe
  C:\Windows\System\TkBXFZP.exe
  2⤵
  PID:8708
- C:\Windows\System\kNsDPkA.exe
  C:\Windows\System\kNsDPkA.exe
  2⤵
  PID:8820
- C:\Windows\System\pWncHVk.exe
  C:\Windows\System\pWncHVk.exe
  2⤵
  PID:8852
- C:\Windows\System\XntTZxK.exe
  C:\Windows\System\XntTZxK.exe
  2⤵
  PID:8840
- C:\Windows\System\fzVaJUG.exe
  C:\Windows\System\fzVaJUG.exe
  2⤵
  PID:8904
- C:\Windows\System\rkhXcla.exe
  C:\Windows\System\rkhXcla.exe
  2⤵
  PID:8948
- C:\Windows\System\CSzQAeK.exe
  C:\Windows\System\CSzQAeK.exe
  2⤵
  PID:8932
- C:\Windows\System\vYMXjHQ.exe
  C:\Windows\System\vYMXjHQ.exe
  2⤵
  PID:8996
- C:\Windows\System\PCxuMZu.exe
  C:\Windows\System\PCxuMZu.exe
  2⤵
  PID:9020
- C:\Windows\System\nEcDFeA.exe
  C:\Windows\System\nEcDFeA.exe
  2⤵
  PID:9084
- C:\Windows\System\xagptLf.exe
  C:\Windows\System\xagptLf.exe
  2⤵
  PID:9068
- C:\Windows\System\UhiRjEJ.exe
  C:\Windows\System\UhiRjEJ.exe
  2⤵
  PID:9100
- C:\Windows\System\TWlQHOJ.exe
  C:\Windows\System\TWlQHOJ.exe
  2⤵
  PID:9180
- C:\Windows\System\mZxQprE.exe
  C:\Windows\System\mZxQprE.exe
  2⤵
  PID:7316
- C:\Windows\System\HkGXWCA.exe
  C:\Windows\System\HkGXWCA.exe
  2⤵
  PID:9164
- C:\Windows\System\OkKdjRU.exe
  C:\Windows\System\OkKdjRU.exe
  2⤵
  PID:8240
- C:\Windows\System\QOhDQhD.exe
  C:\Windows\System\QOhDQhD.exe
  2⤵
  PID:8244
- C:\Windows\System\EopJdgo.exe
  C:\Windows\System\EopJdgo.exe
  2⤵
  PID:8372
- C:\Windows\System\PepIyQy.exe
  C:\Windows\System\PepIyQy.exe
  2⤵
  PID:8256
- C:\Windows\System\TQboSkD.exe
  C:\Windows\System\TQboSkD.exe
  2⤵
  PID:8480
- C:\Windows\System\GMwLerb.exe
  C:\Windows\System\GMwLerb.exe
  2⤵
  PID:8416
- C:\Windows\System\gPyCwxK.exe
  C:\Windows\System\gPyCwxK.exe
  2⤵
  PID:8564
- C:\Windows\System\btaoFKU.exe
  C:\Windows\System\btaoFKU.exe
  2⤵
  PID:8580
- C:\Windows\System\OqyuDiv.exe
  C:\Windows\System\OqyuDiv.exe
  2⤵
  PID:8760
- C:\Windows\System\HXXzoPv.exe
  C:\Windows\System\HXXzoPv.exe
  2⤵
  PID:8836
- C:\Windows\System\zpQHqvf.exe
  C:\Windows\System\zpQHqvf.exe
  2⤵
  PID:8964
- C:\Windows\System\MnlOlDw.exe
  C:\Windows\System\MnlOlDw.exe
  2⤵
  PID:8824
- C:\Windows\System\IbQfwom.exe
  C:\Windows\System\IbQfwom.exe
  2⤵
  PID:8656
- C:\Windows\System\TRJSsBy.exe
  C:\Windows\System\TRJSsBy.exe
  2⤵
  PID:8900
- C:\Windows\System\zVRHjXq.exe
  C:\Windows\System\zVRHjXq.exe
  2⤵
  PID:9016
- C:\Windows\System\VnGfkMy.exe
  C:\Windows\System\VnGfkMy.exe
  2⤵
  PID:9116
- C:\Windows\System\sfqeQaX.exe
  C:\Windows\System\sfqeQaX.exe
  2⤵
  PID:9132
- C:\Windows\System\LtGSHYW.exe
  C:\Windows\System\LtGSHYW.exe
  2⤵
  PID:9160
- C:\Windows\System\JBAVEVb.exe
  C:\Windows\System\JBAVEVb.exe
  2⤵
  PID:8320
- C:\Windows\System\emjsYpc.exe
  C:\Windows\System\emjsYpc.exe
  2⤵
  PID:8452
- C:\Windows\System\tTCYLHQ.exe
  C:\Windows\System\tTCYLHQ.exe
  2⤵
  PID:8436
- C:\Windows\System\DYnpgXl.exe
  C:\Windows\System\DYnpgXl.exe
  2⤵
  PID:8756
- C:\Windows\System\BQTQhAk.exe
  C:\Windows\System\BQTQhAk.exe
  2⤵
  PID:8628
- C:\Windows\System\xIfpgEM.exe
  C:\Windows\System\xIfpgEM.exe
  2⤵
  PID:9052
- C:\Windows\System\ctuJmqK.exe
  C:\Windows\System\ctuJmqK.exe
  2⤵
  PID:8744
- C:\Windows\System\bYeIRyy.exe
  C:\Windows\System\bYeIRyy.exe
  2⤵
  PID:9112
- C:\Windows\System\tvSrtwg.exe
  C:\Windows\System\tvSrtwg.exe
  2⤵
  PID:8512
- C:\Windows\System\LmkhrSw.exe
  C:\Windows\System\LmkhrSw.exe
  2⤵
  PID:8724
- C:\Windows\System\AnYRkcJ.exe
  C:\Windows\System\AnYRkcJ.exe
  2⤵
  PID:8336
- C:\Windows\System\PBCjdpp.exe
  C:\Windows\System\PBCjdpp.exe
  2⤵
  PID:8740
- C:\Windows\System\lxdPQnd.exe
  C:\Windows\System\lxdPQnd.exe
  2⤵
  PID:8384
- C:\Windows\System\SnlCOiY.exe
  C:\Windows\System\SnlCOiY.exe
  2⤵
  PID:7336
- C:\Windows\System\IFyRHOM.exe
  C:\Windows\System\IFyRHOM.exe
  2⤵
  PID:8984
- C:\Windows\System\jJsRImh.exe
  C:\Windows\System\jJsRImh.exe
  2⤵
  PID:9224
- C:\Windows\System\gAlbMZx.exe
  C:\Windows\System\gAlbMZx.exe
  2⤵
  PID:9240
- C:\Windows\System\MGVGEUx.exe
  C:\Windows\System\MGVGEUx.exe
  2⤵
  PID:9256
- C:\Windows\System\difQMDK.exe
  C:\Windows\System\difQMDK.exe
  2⤵
  PID:9272
- C:\Windows\System\fyxhuKf.exe
  C:\Windows\System\fyxhuKf.exe
  2⤵
  PID:9288
- C:\Windows\System\DqdUbXn.exe
  C:\Windows\System\DqdUbXn.exe
  2⤵
  PID:9304
- C:\Windows\System\LCRiTib.exe
  C:\Windows\System\LCRiTib.exe
  2⤵
  PID:9320
- C:\Windows\System\BCLntgP.exe
  C:\Windows\System\BCLntgP.exe
  2⤵
  PID:9336
- C:\Windows\System\lZaaTKa.exe
  C:\Windows\System\lZaaTKa.exe
  2⤵
  PID:9352
- C:\Windows\System\eIpvTpo.exe
  C:\Windows\System\eIpvTpo.exe
  2⤵
  PID:9368
- C:\Windows\System\assQHrb.exe
  C:\Windows\System\assQHrb.exe
  2⤵
  PID:9384
- C:\Windows\System\ZHCsyta.exe
  C:\Windows\System\ZHCsyta.exe
  2⤵
  PID:9400
- C:\Windows\System\eUiQdjR.exe
  C:\Windows\System\eUiQdjR.exe
  2⤵
  PID:9416
- C:\Windows\System\YrLhMcC.exe
  C:\Windows\System\YrLhMcC.exe
  2⤵
  PID:9432
- C:\Windows\System\fPdTKEo.exe
  C:\Windows\System\fPdTKEo.exe
  2⤵
  PID:9448
- C:\Windows\System\wxZFiUc.exe
  C:\Windows\System\wxZFiUc.exe
  2⤵
  PID:9464
- C:\Windows\System\nCpbkFz.exe
  C:\Windows\System\nCpbkFz.exe
  2⤵
  PID:9480
- C:\Windows\System\NdNvUiw.exe
  C:\Windows\System\NdNvUiw.exe
  2⤵
  PID:9496
- C:\Windows\System\KFllcmm.exe
  C:\Windows\System\KFllcmm.exe
  2⤵
  PID:9512
- C:\Windows\System\RxAmEWs.exe
  C:\Windows\System\RxAmEWs.exe
  2⤵
  PID:9528
- C:\Windows\System\QUKJsVR.exe
  C:\Windows\System\QUKJsVR.exe
  2⤵
  PID:9544
- C:\Windows\System\KXnUYuR.exe
  C:\Windows\System\KXnUYuR.exe
  2⤵
  PID:9560
- C:\Windows\System\EBjetrO.exe
  C:\Windows\System\EBjetrO.exe
  2⤵
  PID:9576
- C:\Windows\System\SbOXNlb.exe
  C:\Windows\System\SbOXNlb.exe
  2⤵
  PID:9592
- C:\Windows\System\VRkTBTs.exe
  C:\Windows\System\VRkTBTs.exe
  2⤵
  PID:9608
- C:\Windows\System\eEfIgbo.exe
  C:\Windows\System\eEfIgbo.exe
  2⤵
  PID:9624
- C:\Windows\System\VmgvyMp.exe
  C:\Windows\System\VmgvyMp.exe
  2⤵
  PID:9640
- C:\Windows\System\JXeIGMW.exe
  C:\Windows\System\JXeIGMW.exe
  2⤵
  PID:9660
- C:\Windows\System\YjSjDhC.exe
  C:\Windows\System\YjSjDhC.exe
  2⤵
  PID:9676
- C:\Windows\System\BCtaoaz.exe
  C:\Windows\System\BCtaoaz.exe
  2⤵
  PID:9692
- C:\Windows\System\kZogPQF.exe
  C:\Windows\System\kZogPQF.exe
  2⤵
  PID:9708
- C:\Windows\System\VffOROF.exe
  C:\Windows\System\VffOROF.exe
  2⤵
  PID:9724
- C:\Windows\System\CuPnxOc.exe
  C:\Windows\System\CuPnxOc.exe
  2⤵
  PID:9740
- C:\Windows\System\JeFZpHz.exe
  C:\Windows\System\JeFZpHz.exe
  2⤵
  PID:9756
- C:\Windows\System\jQmYDfp.exe
  C:\Windows\System\jQmYDfp.exe
  2⤵
  PID:9776
- C:\Windows\System\GUmvLNe.exe
  C:\Windows\System\GUmvLNe.exe
  2⤵
  PID:9792
- C:\Windows\System\vxdrqxK.exe
  C:\Windows\System\vxdrqxK.exe
  2⤵
  PID:9808
- C:\Windows\System\wrdDtNW.exe
  C:\Windows\System\wrdDtNW.exe
  2⤵
  PID:9824
- C:\Windows\System\uEqcMpd.exe
  C:\Windows\System\uEqcMpd.exe
  2⤵
  PID:9840
- C:\Windows\System\rJEVnTf.exe
  C:\Windows\System\rJEVnTf.exe
  2⤵
  PID:9856
- C:\Windows\System\OwDzSod.exe
  C:\Windows\System\OwDzSod.exe
  2⤵
  PID:9872
- C:\Windows\System\arTVxJr.exe
  C:\Windows\System\arTVxJr.exe
  2⤵
  PID:9888
- C:\Windows\System\JQEbPQv.exe
  C:\Windows\System\JQEbPQv.exe
  2⤵
  PID:9904
- C:\Windows\System\RWyEbDL.exe
  C:\Windows\System\RWyEbDL.exe
  2⤵
  PID:9920
- C:\Windows\System\kjpFUoP.exe
  C:\Windows\System\kjpFUoP.exe
  2⤵
  PID:9936
- C:\Windows\System\PNGmcyq.exe
  C:\Windows\System\PNGmcyq.exe
  2⤵
  PID:9952
- C:\Windows\System\sBCOQpV.exe
  C:\Windows\System\sBCOQpV.exe
  2⤵
  PID:9968
- C:\Windows\System\MlDgfKg.exe
  C:\Windows\System\MlDgfKg.exe
  2⤵
  PID:9984
- C:\Windows\System\yhapwEG.exe
  C:\Windows\System\yhapwEG.exe
  2⤵
  PID:10000
- C:\Windows\System\kuIgyeX.exe
  C:\Windows\System\kuIgyeX.exe
  2⤵
  PID:10016
- C:\Windows\System\MXhQEVQ.exe
  C:\Windows\System\MXhQEVQ.exe
  2⤵
  PID:10032
- C:\Windows\System\fyntkqO.exe
  C:\Windows\System\fyntkqO.exe
  2⤵
  PID:10048
- C:\Windows\System\udasnpa.exe
  C:\Windows\System\udasnpa.exe
  2⤵
  PID:10064
- C:\Windows\System\oDrSKeL.exe
  C:\Windows\System\oDrSKeL.exe
  2⤵
  PID:10080
- C:\Windows\System\vBmwbzZ.exe
  C:\Windows\System\vBmwbzZ.exe
  2⤵
  PID:10096
- C:\Windows\System\oOPgaPq.exe
  C:\Windows\System\oOPgaPq.exe
  2⤵
  PID:10112
- C:\Windows\System\iYwCnYv.exe
  C:\Windows\System\iYwCnYv.exe
  2⤵
  PID:10128
- C:\Windows\System\PGelTaS.exe
  C:\Windows\System\PGelTaS.exe
  2⤵
  PID:10144
- C:\Windows\System\nuOztlN.exe
  C:\Windows\System\nuOztlN.exe
  2⤵
  PID:10160
- C:\Windows\System\rEkWBso.exe
  C:\Windows\System\rEkWBso.exe
  2⤵
  PID:10176
- C:\Windows\System\RPuUXeb.exe
  C:\Windows\System\RPuUXeb.exe
  2⤵
  PID:10192
- C:\Windows\System\BsVNeRp.exe
  C:\Windows\System\BsVNeRp.exe
  2⤵
  PID:10208
- C:\Windows\System\WHEzaAE.exe
  C:\Windows\System\WHEzaAE.exe
  2⤵
  PID:10224
- C:\Windows\System\WEFihpT.exe
  C:\Windows\System\WEFihpT.exe
  2⤵
  PID:9000
- C:\Windows\System\XYhpXrH.exe
  C:\Windows\System\XYhpXrH.exe
  2⤵
  PID:9220
- C:\Windows\System\CsEBvKN.exe
  C:\Windows\System\CsEBvKN.exe
  2⤵
  PID:9252
- C:\Windows\System\eszhQPd.exe
  C:\Windows\System\eszhQPd.exe
  2⤵
  PID:9328
- C:\Windows\System\fOcVKux.exe
  C:\Windows\System\fOcVKux.exe
  2⤵
  PID:9392
- C:\Windows\System\rxUKCZo.exe
  C:\Windows\System\rxUKCZo.exe
  2⤵
  PID:9284
- C:\Windows\System\frueFBO.exe
  C:\Windows\System\frueFBO.exe
  2⤵
  PID:9348
- C:\Windows\System\HXQMcfl.exe
  C:\Windows\System\HXQMcfl.exe
  2⤵
  PID:9412
- C:\Windows\System\SuVXqXE.exe
  C:\Windows\System\SuVXqXE.exe
  2⤵
  PID:9440
- C:\Windows\System\AiEWRwL.exe
  C:\Windows\System\AiEWRwL.exe
  2⤵
  PID:9488
- C:\Windows\System\kLlxqrC.exe
  C:\Windows\System\kLlxqrC.exe
  2⤵
  PID:9552
- C:\Windows\System\bOWKCtx.exe
  C:\Windows\System\bOWKCtx.exe
  2⤵
  PID:9620
- C:\Windows\System\XAZZwIo.exe
  C:\Windows\System\XAZZwIo.exe
  2⤵
  PID:9656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BnJfInF.exe

Filesize
1.9MB

MD5
f9a056de15da21aa3647cede0b3f5e4a

SHA1
9339179ee1f7d3c6143e17272565d57c5f2eb162

SHA256
c925c7c60d357cac442ec0367652a7e237f488dd5fc3e3ee227b7fa290062167

SHA512
1884a4609f558fd4cb0e24e03ce627a77d50220e72b50e45d08be3c750a573cbd187e5489805ab4d9f9e4999752c271633e557d1664b397e1cb75b2829e3d601

Download Submit
C:\Windows\system\QhGGLER.exe

Filesize
1.9MB

MD5
f14e692a314ec00afc279808c2b7d1fa

SHA1
e2de2bdba5478fc78d39888d49c57486ac1413a3

SHA256
cffc27c07bb5e4f1dd96d8c40f1a14bf9de59bd7303d8b703798ef9365143aff

SHA512
deec74dceb7f114c184814957dbfe7202579a1fdf1373b7aaf26e329611bffc7eaaf0da807e19e142d0a1ae6361b2c85b0cb67a12b09f01d4c7e5e47df2653a1

Download Submit
C:\Windows\system\RaMOAWh.exe

Filesize
1.9MB

MD5
0a202f6a0c634d9609f63045f84425c0

SHA1
fb5c4b30b84f89b5449633fd6ef44febb403adfe

SHA256
4963b50c8d311a0141f67c3fdac8e415f0b84ee85384e96ccd952580d4673120

SHA512
69fa8f58244db330d29c66be445b18b9e170c42b183ffc406e799cb33a4985363f0b83ecbcf8ebc8d829a317fa744d0aa280b70190b0bd1e96924e0ff3ac4af1

Download Submit
C:\Windows\system\SjuhvJz.exe

Filesize
1.9MB

MD5
590372668c0a5033fb3d5513bcfae3ff

SHA1
79775429e36ce4de8eb9a5fbefd7760fa14cd8a6

SHA256
ff03939e4ff1a9c705a84c63f980d45dad8f0c4a0cf21179b941418b2c8f343e

SHA512
da00f1f84d09fb9b869fdca93d409785196979a2b83fac29e7bce91202c0bce8ed7a5f829368da252495d928905cf5996e9843c8c0e93a68e18a3e44ac752f67

Download Submit
C:\Windows\system\UcPmHbY.exe

Filesize
1.9MB

MD5
854a413d36e65543e0270c86e6a2307f

SHA1
ecf9ea131c07760b185b3a71f707f132c7370a08

SHA256
056e993d7610734b4914bdd83d5869614fbd8b7b3f4a666d970687c42a527eff

SHA512
e8d4c737297d21537a83379457d56d8bc6a6caf8d1cc7c8a0df9b862f15655135110b97c15e95a33bd67c7b5bede71e3e79be786b8c3d477f951ce3627f8aede

Download Submit
C:\Windows\system\YgJZsqj.exe

Filesize
1.9MB

MD5
470b9ae7495a6627c71fd1212b3b11b6

SHA1
e57d19b104f3531386da0e74d7d0e085acf35083

SHA256
0378fc818247ba0545fb0d31f2d7b9daecdce8fd42986928184efc3a22632583

SHA512
bb8924584f4c04a6ca8103042aff2ca539ae5fd35803e40eeaa06d9a7fe5927b2f05b8def691617e58ef4d344d2cea1af310c5790518f5b8673b4a5c5465afbe

Download Submit
C:\Windows\system\aInYzJe.exe

Filesize
1.9MB

MD5
e1eb4f1655d3438362223b2803655370

SHA1
92b28e875ba6d777dfa665abeab74563f90a4baa

SHA256
0584071bea4947369e449b34d8bb1514d4270bfba0aade2406bd331569ff8eb4

SHA512
8869acf97e9214ebf684e8e22237701b0dc1f5d16e1ddf9bdce6bcf91747798ef6092c84560bbd6500f906c703662be8096a8c29bcbc560a4902781416a31857

Download Submit
C:\Windows\system\aSdiHlc.exe

Filesize
1.9MB

MD5
933a568cd6a850a78f88a0a809909c20

SHA1
4a4b214e2b756ba3d4383fa0b96830e6d31a5afe

SHA256
9acc640f0a7f44b51149ce18e839d1a30435750aa215830aff928cbab5934485

SHA512
723f42a004e8ee3833e2ff2cb2d598bb80419c0bac6f0ed6618633eb8849ebcf5402a5d4d5326b8ed12cac321bd7b76f7f81bc582d383de099663f0dec430a74

Download Submit
C:\Windows\system\aeQmjaW.exe

Filesize
1.9MB

MD5
de26191ab4d3745641fb132b7ef6cd70

SHA1
f4fcd48501777da27d0c344f5d7348451d2a7985

SHA256
5fd5324cd6e064b0c18d43ed6c6517d53fb8cc29f975749b54e9d309ac1d7aba

SHA512
e3f2c666a6697833a0300d03d77d068853502974b8d6da927bb2eeaa74f6daf6ab4344d1aaf1507350043f89155e8b73cd4d1846f773a789435a255924eb7829

Download Submit
C:\Windows\system\bVVvNNy.exe

Filesize
1.9MB

MD5
0a0fee2037c46e39a7515f8b1ae07772

SHA1
0dea5ce2b2f13e9cc5126d3df0e523a49a8b6997

SHA256
05004ae4d2ef5c8a6202a87e1d630b3ff4b87e92c314e63317b193b370975181

SHA512
2d38f92c1f50eb7b2f29211b0cbda25799d0787e171825fb8c876db07aa24bda5f1954332ee91b2620d71ab4aa387fd4f8fca4951c73127eb0de6deccff6691c

Download Submit
C:\Windows\system\cRwjvsv.exe

Filesize
1.9MB

MD5
365918981b998f510ad4d6c31bd6567f

SHA1
bbbc4c363ff3a9421713daf32f2db84b676417e8

SHA256
31aa5b0fa17251799c4a1ffdd395d02d49d1970e2fd4829c9c2c9b7e04f69d57

SHA512
862c1438862c8fc81a93119dc035b86e9e35db7cee3b9d391c5286fcae01066e101296f92f934d99ee5c2687957a0fc146d6334dcf3e548d63cf52e491d1c165

Download Submit
C:\Windows\system\hTQJdOp.exe

Filesize
1.9MB

MD5
0e7a8ff86d734935779d720374e4f421

SHA1
8312a020c4b18209db6e5d6db0148fe3d92a3e7f

SHA256
90e1415703683103caf2c103eb20d0e70e54d92dc5ff6514c401b8b243c077c9

SHA512
d1cbc7321e80a1018631b3905258b9eba259b9f1eef8b4185453c27f5cf059e8b2d0399360d4d15ea984b56e5eb61f7a22500b9e087581936423ab0f08923e97

Download Submit
C:\Windows\system\jNGMVKz.exe

Filesize
1.9MB

MD5
4357db0082bd65ada44a9b7bbad18ab9

SHA1
8067fc692545103aec9bada10ab085df552fac40

SHA256
44288fe46e4d1f933bbab277583da3e2ef477ae469bff2de669222496c592cbf

SHA512
1594a659adadfcfe535c7d2329f5ecbe1ffc836f10dc2132e7a784fbd48c6ea3bf3791b82bd0d51a3d3c173fed3f29106101ebfc1def73fe50b82ade243fa819

Download Submit
C:\Windows\system\mCwihwN.exe

Filesize
1.9MB

MD5
d7f16bfb10d01b05764edcefe4dafce6

SHA1
9819a4e07e8b5963d93b24eef16c06b6520a708b

SHA256
7eec57a4074338f5c74b90819d663848cc8d2b0f9cf24c34f3a530505557ed49

SHA512
c25617b9853bf07ba795e075baa1f6c78ed97908c47d18b506702555a9f47aa9021f8d3fdc3e4c67b05df0a1e081fce49551e841315cb28bdf9e8af1f41ad5ed

Download Submit
C:\Windows\system\mqYVXSC.exe

Filesize
1.9MB

MD5
747ef2ae7d3f1e2ed4a50288b4c5dce7

SHA1
84ff385183a0e4f990389c84452c3aa43a21cb3a

SHA256
50c37991678d538e0c466bb63fdae57a9229132ba8c52f7bbbe9b13bf1d894b8

SHA512
87a4c9f7762fe5ea554fcf59c2c8390e6399641aa96714d9e1982703eb34d465e8fd9b6030525640545c817c21246fd7a25df76e6a890ea7fa321556548e6791

Download Submit
C:\Windows\system\ouaNlDy.exe

Filesize
1.9MB

MD5
2ddf77c4c85655a6cad3f25d7539a287

SHA1
92eb5fb4eaef14ee94ab1722763b86065aa94535

SHA256
eb24c2b8efd2b6624dc970003a907a692f7079e36f5feed21373f9663d1f7a14

SHA512
b023323c6b9381c0218a9d57ea5340c83988bee26885552daecfc3641a6313c46b9d7f445d02330895cbf6e835432d98d22634fde04b1012423d1750f759101f

Download Submit
C:\Windows\system\tNwbgsS.exe

Filesize
1.9MB

MD5
045ffc23a11a2a7d379bd3732343f567

SHA1
d616279f43ad114087f47815614c47429f99f7e2

SHA256
e15949e79d26d3e18be8a2f8f7ff8420fd0d95c43c54fee7bb53a52e22de5fa8

SHA512
c1b224a204072863616904a57f188b6165c1291d7d0690794bc5e15c7263c4f626586f3fb59e7b744e39f58918559f140316194f4c5dfef6e7f70faef070da35

Download Submit
C:\Windows\system\wsmKxfr.exe

Filesize
1.9MB

MD5
56ec0ac066a617ca1362f1200a299ffd

SHA1
c773df4a8194f232c4e00ab5b583e41557cad6f0

SHA256
51e5f943aba0156f06efd3222f82995891754d819c685a05d46499e7fe4586b2

SHA512
a575f50c806d95dfc537ecf0a9b924f6fb16335a8de146a21694a9b1f870da7a5b06707647b0df39748dfb5d0021e8f7a6e15e2758ff787049cdac742234dc13

Download Submit
C:\Windows\system\yqunZJd.exe

Filesize
1.9MB

MD5
5ec18a74004fc6eb5be9ed98385f4ff2

SHA1
9a25a1da9c47e9602b8c3b547570585d288e0ca3

SHA256
713427c2b0c4b06826357f4797bb10cadac3119d92429a1c90fd0e28d6a01e24

SHA512
a06a8f8469f18a5fc702127109b56a1cfa3d1e7b12157c6b6daa4cc42bfa1e4814ae8369fe3656508da5f1c0b78c349a269099da284dabf87f013d48976683d5

Download Submit
\Windows\system\AiSeRPs.exe

Filesize
1.9MB

MD5
46d7fdf0e19972177e69aa4b3dc4846d

SHA1
ab7a284b2683a09f07faa59a64dec475a3dcef45

SHA256
f0924e5996e206ba6dd8385a862124605f8667db82d2f3d42c6bad718f542c6d

SHA512
e106f2e109b50957279056b153312657b7bdeba9eb25f28c997ab90ca78011ebcceb1d8b5c60185deaffd6acd18139e8a2a04c50015ca1f2278d68741bd64e41

Download Submit
\Windows\system\DRecQNe.exe

Filesize
1.9MB

MD5
0fb6cef8405c15a401bfbb436bbe63f8

SHA1
6166de57093275dc1845178b4eb52762d70f83b8

SHA256
ceb7fe8ffa47dcea83f32257345878124faefea5aee103f328d2e62b0e74d936

SHA512
ddd925eaf6f4c37290fdbc3fc0af2b52c60194b86c1efd90d4ad151693b316e4770e2564bab7e09e59243696001b5f115e03eae863f42c77694d3720b3ad1a07

Download Submit
\Windows\system\GqshlyU.exe

Filesize
1.9MB

MD5
035d7ef1cd7b04f0bb0ae7864ef425c9

SHA1
138c6229fa22e5bb28726fcb938aa2ae8836b743

SHA256
32ab833ef5b5588739e17dc578e788247cd99726971d944206b341aa137fb3c3

SHA512
54ba4e00a046d1ac27b221074c2ef5f3f16b4fb55abebd666b8417fdf0dba6bcbfb6f60d8f960eeaf84fe74e49dd631bf1503b4daa0d283a516be7fb4aa0d58e

Download Submit
\Windows\system\Lebzpld.exe

Filesize
1.9MB

MD5
9e125cb52001b23c6df067ba758858fe

SHA1
12c3d20cc44a16397dc8aff9444e074d3c700284

SHA256
dbb8b6c12986006bf9590ddb11511bf2a5dbdefd1279249856ef7bd88acaaa0c

SHA512
a7efa5c77a35305b538a154408491b63bddacf91f2bd184c47ef49a7650cffab2e02d0c9f1e04e2e9c9893b70ce05b0e2d208fa0f46c9d97086a09452c7b0ff0

Download Submit
\Windows\system\MUYdCKa.exe

Filesize
1.9MB

MD5
b2c1675602598b65a979d88f275a9622

SHA1
4d17154417fca1ae4579d2d5feca344cfdc91e5d

SHA256
67579a16504f1083f96dd5a7404c547fafd85e93b65b2547479a235bd310b3f7

SHA512
abcc9524ca378d5a6495119c4981f810c793b19ca56d4835b627db06a211218a44466afdd0d90e02af58f5b32e6440de2bc54fffff7ae168a0b36e52cf221f4e

Download Submit
\Windows\system\PrtcMUJ.exe

Filesize
1.9MB

MD5
cdabc557eb2797ae965ccda936bf528c

SHA1
9bfc37a6facbcf9784deee397dd296db665183a8

SHA256
7c1fd9a756ac8df3a272fa7a1d829d178c33dc97f26feff7677f8d0bc2e2fce8

SHA512
61141cb155d2b782966af69bd9a87f1351f28c3bc3c7666ce4537abd29390059e5424aa470615efa798c120085dc529895aedf59cdd30731a6332e4c65ba0833

Download Submit
\Windows\system\YiBtckN.exe

Filesize
1.9MB

MD5
f4f5eb9165b059c7e694448d958ccab6

SHA1
db7aca779fb0a1f635a4c4b3e9e09e93fffb89bc

SHA256
935c460ce625c356f4cff1105eb3996bd510e778d527048d83651ddf0e6c0aa0

SHA512
229e586e4c99af459c9fb06f8b31c70158105faadfd9d6e55f92a24ac8d697439cc00dfbc4e8b41f12d3ee3f8848afc65113295be7481f5156b8b1f1db32ea18

Download Submit
\Windows\system\YupLbiG.exe

Filesize
1.9MB

MD5
67ea31c4d1425e49375c2eb39c14f8af

SHA1
42e7c2dff930ad6a68bb710ac108177f7ae78bbe

SHA256
e4bc3c682c5861242baebdc883b12151b8b8d2e896affc99edef69d18d1b8621

SHA512
95c8d8a2dd20f987c58efb5e2d0448a167992ac1cc3f8b2fb2c7a5b558976729e05a9e8caa58ffb0a05c06e9b2796a369baaedc8a55d4f0e8e20ec26f6dfbfa2

Download Submit
\Windows\system\ZADqFhU.exe

Filesize
1.9MB

MD5
e19e929399a6fb54e1507763f21441d6

SHA1
13e10e494fde413ab03c7dad6e1af811abec66e0

SHA256
843b1000adc676d95fe9cbb55ac12113f6d46e7fc8a8e978f6225cc327804a9a

SHA512
12c2bf31f6f671a60e0f0a02fa952ad8b8e805200839b93dc615bb769986b6c081fb184e9d0d3d366e6377d9e8422ba3f4e97ec2f601b750713621c058e54d9e

Download Submit
\Windows\system\ZbyedqP.exe

Filesize
1.9MB

MD5
ba312755d3068983ae76226b7223d4f6

SHA1
cdec8c6f9ad90f18f2175758b0638725f82a651b

SHA256
719a2ea88d76049c2737014f35e85e87b99eb8201a918d7a87c712cea1db4bdb

SHA512
12502762fe85bb85ceae7f1c886a3a6c9fa2cd1eb0a01a76163e4cc9e2cf750d06aac1b320164a830f3e9996c7a4c22595b488464fdddb3c1cf39fca0dd765ae

Download Submit
\Windows\system\deJVukG.exe

Filesize
1.9MB

MD5
765d0c44d93889ef6cbefcef13020751

SHA1
d1f661845efa5564a6ceb8cdc9a966447372d33c

SHA256
6f64a6272002dbb1965aa2879585ec89d86a9b1f4a0fd69da829acebfad8509b

SHA512
f89a9a401b8e38d861bd3dd2e9a5e285a0e5f72507d52398ae072d02f1b9110648755813b87fa87440c496659e864e8dcb873a56d6fcc6279f55f0f43f28fa12

Download Submit
\Windows\system\etXNBKG.exe

Filesize
1.9MB

MD5
125ad863f13b53271907c8e1622a359c

SHA1
7a2841e53e27a16c0e7f34e8382cffe9b3462a69

SHA256
9884c865f0d45317041653dff0a31f0e766935756622a7e7af2ffdd0258f2649

SHA512
c29eb47cd08cb88ab1c4c79b2d043cce2ede5515e2c8cf823a1d482ac83759ecda3346f65817898e2a126f2d23f7be31e4686aba801e2503b89108cc7ad6d395

Download Submit
\Windows\system\sckOknQ.exe

Filesize
1.9MB

MD5
082666c2e4c1947df7d42211453e423d

SHA1
ac165b600c11f4f6e82565104d715cfebfe59cea

SHA256
f102f600b79205baa2b092843a5cf5f133caa57d54eac0d28de20c6556d3e2db

SHA512
551a64a73fbfb107ef8fc4a1f9e1a589e0588e826882008a5587f7c7c8fbd8586986f2823e24de8bda079f139b8cbf27e03f11b71d1b52ddb6f985a2689777db

Download Submit
memory/2156-701-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-18-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-20-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-57-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2292-37-0x0000000003720000-0x0000000003B12000-memory.dmp

Filesize
3.9MB

Download
memory/2292-65-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2292-73-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2292-7-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/2292-698-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/2292-78-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2292-69-0x0000000003720000-0x0000000003B12000-memory.dmp

Filesize
3.9MB

Download
memory/2292-0-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2292-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2292-12-0x0000000003330000-0x0000000003722000-memory.dmp

Filesize
3.9MB

Download
memory/2296-58-0x0000000001CF0000-0x0000000001CF8000-memory.dmp

Filesize
32KB

Download
memory/2296-51-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2296-29-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-411-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-33-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2296-30-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2296-36-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmp

Filesize
9.6MB

Download
memory/2296-68-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2460-74-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2480-80-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2536-71-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-75-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2596-62-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-38-0x000000013F6A0000-0x000000013FA92000-memory.dmp

Filesize
3.9MB

Download
memory/2672-27-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-8-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2736-319-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download