xmrig | 33d6b1b8ca69c99fc11e88d04b6c7f4c7f5653ea27146bfd5a39796ac5ba3eb9

Analysis

max time kernel
150s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Size

2.2MB
MD5

11b2228484c36d19f891243e61893785
SHA1

eabbc585f564ce3dc1781c67eac2ba2204d3760d
SHA256

33d6b1b8ca69c99fc11e88d04b6c7f4c7f5653ea27146bfd5a39796ac5ba3eb9
SHA512

4d7e35cecf81efa1f938351159df568ab58e386431ed01b07e29c0d2d8a88f2562b35033dc568aa3bd373ffecf17ed47d0059f802ac5a497813a45748b23f868
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9cbW:NABq

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 20 IoCs

miner

resource	yara_rule
behavioral1/memory/2512-13-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2940-12-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2588-27-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2464-80-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/1620-94-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2104-91-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2844-89-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2400-87-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2348-85-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2372-83-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2836-77-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2640-76-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/2464-4677-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2940-4691-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2348-4688-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2640-4701-0x000000013F890000-0x000000013FC82000-memory.dmp	xmrig
behavioral1/memory/1620-4699-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2844-4681-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	xmrig
behavioral1/memory/2588-4675-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2372-4761-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2540	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2940	EQkIPeA.exe
2512	vCmssrP.exe
2588	tnCNGyc.exe
2640	TjmqrGa.exe
2464	AeVJHcQ.exe
2372	LBlsyFH.exe
2348	FUULMxY.exe
2400	bVpnLWe.exe
2844	nvhWLmf.exe
2104	YcTkNnR.exe
1620	fDAzMKk.exe
2696	vNAJZUs.exe
2652	HGkhOFl.exe
760	dMKnJEB.exe
328	sCTgIXO.exe
1716	gPuLYXT.exe
1364	VzZpeJX.exe
2860	qkyBEzQ.exe
1732	xDDtVra.exe
2180	ftnPDUQ.exe
540	RYFiIFC.exe
2620	mBobhjQ.exe
1064	owPuFyL.exe
1452	sJDMgSL.exe
1260	xVrQhIg.exe
2216	fCjAKRF.exe
1804	vpzhiMm.exe
536	xJudcQF.exe
784	fEAnxyg.exe
1400	DkjuSxa.exe
2276	FhOXRip.exe
916	wbQoYOC.exe
2932	QbFVsrQ.exe
412	KQfHFkj.exe
1184	hiCwSSz.exe
2108	XJKfJCf.exe
2800	dQUeeHc.exe
1464	PVVhFsO.exe
1484	ViOQBro.exe
1640	YcCKxJh.exe
1292	nxhPGkJ.exe
1832	JQRjLYf.exe
1764	dhAejXQ.exe
2304	QImxSie.exe
900	Fgppgxs.exe
1544	FdMgtqS.exe
876	idSqNyl.exe
768	ShurGtA.exe
1220	RQnUVjw.exe
1956	zTNnslF.exe
2088	Weotrwi.exe
2988	fRxOjJG.exe
1696	QkiHZdD.exe
2960	YbrRFPe.exe
560	yQKkicY.exe
1756	cvOcwhr.exe
2816	DVaEReC.exe
348	UxowEHQ.exe
2124	indFoxP.exe
2252	zUZHcqJ.exe
1524	mfWfcdd.exe
1636	gEGuPCI.exe
856	MZFYmUG.exe
2484	IsHdEHc.exe

Loads dropped DLL 64 IoCs

pid	Process
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2836-1-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x000c000000015c4c-5.dat	upx
behavioral1/files/0x0033000000015cb0-8.dat	upx
behavioral1/memory/2512-13-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2940-12-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0007000000015d0c-23.dat	upx
behavioral1/memory/2588-27-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x001800000000558a-29.dat	upx
behavioral1/files/0x0008000000015d24-37.dat	upx
behavioral1/files/0x0007000000015d44-36.dat	upx
behavioral1/files/0x0008000000015e6d-51.dat	upx
behavioral1/files/0x0006000000016c42-55.dat	upx
behavioral1/files/0x0006000000016cf5-74.dat	upx
behavioral1/memory/2464-80-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0006000000016ce4-79.dat	upx
behavioral1/memory/1620-94-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2104-91-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2844-89-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2400-87-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2348-85-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2372-83-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x00060000000173e5-158.dat	upx
behavioral1/files/0x0006000000016db3-150.dat	upx
behavioral1/files/0x00060000000175b2-179.dat	upx
behavioral1/files/0x00060000000175ac-177.dat	upx
behavioral1/files/0x000600000001744c-174.dat	upx
behavioral1/files/0x000600000001739d-173.dat	upx
behavioral1/files/0x0006000000016e78-172.dat	upx
behavioral1/files/0x0006000000016da4-171.dat	upx
behavioral1/files/0x0006000000016d3a-170.dat	upx
behavioral1/files/0x0006000000016d32-169.dat	upx
behavioral1/files/0x0006000000016d16-168.dat	upx
behavioral1/files/0x0006000000016d05-165.dat	upx
behavioral1/files/0x0006000000016fe8-154.dat	upx
behavioral1/files/0x0006000000016d9f-138.dat	upx
behavioral1/files/0x0006000000016d36-130.dat	upx
behavioral1/files/0x0006000000016d1f-123.dat	upx
behavioral1/files/0x0006000000016cfd-96.dat	upx
behavioral1/files/0x0006000000016d0e-114.dat	upx
behavioral1/files/0x0033000000015cbd-105.dat	upx
behavioral1/memory/2640-76-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x0006000000016cb2-73.dat	upx
behavioral1/files/0x0006000000016c8c-59.dat	upx
behavioral1/files/0x0009000000015e09-48.dat	upx
behavioral1/memory/2464-4677-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2940-4691-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2348-4688-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2640-4701-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/memory/1620-4699-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2844-4681-0x000000013FBD0000-0x000000013FFC2000-memory.dmp	upx
behavioral1/memory/2588-4675-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2372-4761-0x000000013FF30000-0x0000000140322000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ndEeVoK.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\RKVzAtI.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\nwdeAkU.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\xJrJHcf.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\pQFKhFo.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\jIwdHzn.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\akFcVYa.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\MdZoUPc.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\KMmTpIE.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\VdqqHAw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\FpzUoeK.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\UvdmXVp.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ZECeAYh.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\msirpgJ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\qFtAPqS.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DcWnzrV.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\OwNRzDw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\BdbkTLW.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\qvnilMW.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\cGMrDTy.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\lmZELJZ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\mvWXVsO.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\Ieqrokp.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DTLCejq.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\RPMxEWv.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\NvLAktp.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\rvDaLmQ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\IzPzotr.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\eSsaVfw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\RTxdzBi.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\oZTCQvQ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XwHlWrB.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ygEjPka.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\QCIGjXT.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\qdkFmAE.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\AYNLaGv.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\fwWBXES.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\SpAcFPD.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\TmHoztj.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XKdXsrs.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\nreryJx.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\zLXfOQd.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JJxTsfJ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\VvkraRO.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\rwsLRQH.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\JbXUGRX.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\fQSSNqo.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XzdeIPp.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\xVGHFPz.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\OcrIgIP.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\peiLQtj.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\DxaJYON.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\iFlYISA.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\vVLkfOg.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ZopeUYx.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\TUAOWap.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XwkxqBS.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\AHRaWpg.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\XhSdlZx.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\rgfocYm.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\ZwvUuqM.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\fwNmxTQ.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\BuFEihg.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
File created	C:\Windows\System\fTULfMw.exe	11b2228484c36d19f891243e61893785_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2540	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe
Token: SeDebugPrivilege	2540	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2540	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	29
PID 2836 wrote to memory of 2540	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	29
PID 2836 wrote to memory of 2540	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	29
PID 2836 wrote to memory of 2940	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	30
PID 2836 wrote to memory of 2940	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	30
PID 2836 wrote to memory of 2940	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	30
PID 2836 wrote to memory of 2512	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	31
PID 2836 wrote to memory of 2512	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	31
PID 2836 wrote to memory of 2512	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	31
PID 2836 wrote to memory of 2588	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	32
PID 2836 wrote to memory of 2588	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	32
PID 2836 wrote to memory of 2588	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	32
PID 2836 wrote to memory of 2640	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	33
PID 2836 wrote to memory of 2640	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	33
PID 2836 wrote to memory of 2640	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	33
PID 2836 wrote to memory of 2464	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	34
PID 2836 wrote to memory of 2464	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	34
PID 2836 wrote to memory of 2464	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	34
PID 2836 wrote to memory of 2372	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	35
PID 2836 wrote to memory of 2372	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	35
PID 2836 wrote to memory of 2372	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	35
PID 2836 wrote to memory of 2348	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	36
PID 2836 wrote to memory of 2348	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	36
PID 2836 wrote to memory of 2348	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	36
PID 2836 wrote to memory of 2400	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	37
PID 2836 wrote to memory of 2400	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	37
PID 2836 wrote to memory of 2400	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	37
PID 2836 wrote to memory of 2844	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	38
PID 2836 wrote to memory of 2844	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	38
PID 2836 wrote to memory of 2844	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	38
PID 2836 wrote to memory of 2104	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	39
PID 2836 wrote to memory of 2104	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	39
PID 2836 wrote to memory of 2104	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	39
PID 2836 wrote to memory of 1620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	40
PID 2836 wrote to memory of 1620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	40
PID 2836 wrote to memory of 1620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	40
PID 2836 wrote to memory of 2652	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	41
PID 2836 wrote to memory of 2652	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	41
PID 2836 wrote to memory of 2652	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	41
PID 2836 wrote to memory of 2696	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	42
PID 2836 wrote to memory of 2696	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	42
PID 2836 wrote to memory of 2696	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	42
PID 2836 wrote to memory of 760	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	43
PID 2836 wrote to memory of 760	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	43
PID 2836 wrote to memory of 760	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	43
PID 2836 wrote to memory of 328	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	44
PID 2836 wrote to memory of 328	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	44
PID 2836 wrote to memory of 328	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	44
PID 2836 wrote to memory of 2620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	45
PID 2836 wrote to memory of 2620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	45
PID 2836 wrote to memory of 2620	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	45
PID 2836 wrote to memory of 1716	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	46
PID 2836 wrote to memory of 1716	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	46
PID 2836 wrote to memory of 1716	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	46
PID 2836 wrote to memory of 1452	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	47
PID 2836 wrote to memory of 1452	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	47
PID 2836 wrote to memory of 1452	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	47
PID 2836 wrote to memory of 1364	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	48
PID 2836 wrote to memory of 1364	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	48
PID 2836 wrote to memory of 1364	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	48
PID 2836 wrote to memory of 1260	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	49
PID 2836 wrote to memory of 1260	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	49
PID 2836 wrote to memory of 1260	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	49
PID 2836 wrote to memory of 2860	2836	11b2228484c36d19f891243e61893785_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\11b2228484c36d19f891243e61893785_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\11b2228484c36d19f891243e61893785_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2540
- C:\Windows\System\EQkIPeA.exe
  C:\Windows\System\EQkIPeA.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\vCmssrP.exe
  C:\Windows\System\vCmssrP.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\tnCNGyc.exe
  C:\Windows\System\tnCNGyc.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\TjmqrGa.exe
  C:\Windows\System\TjmqrGa.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\AeVJHcQ.exe
  C:\Windows\System\AeVJHcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\LBlsyFH.exe
  C:\Windows\System\LBlsyFH.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\FUULMxY.exe
  C:\Windows\System\FUULMxY.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\bVpnLWe.exe
  C:\Windows\System\bVpnLWe.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\nvhWLmf.exe
  C:\Windows\System\nvhWLmf.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\YcTkNnR.exe
  C:\Windows\System\YcTkNnR.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\fDAzMKk.exe
  C:\Windows\System\fDAzMKk.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\HGkhOFl.exe
  C:\Windows\System\HGkhOFl.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\vNAJZUs.exe
  C:\Windows\System\vNAJZUs.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\dMKnJEB.exe
  C:\Windows\System\dMKnJEB.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\sCTgIXO.exe
  C:\Windows\System\sCTgIXO.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\mBobhjQ.exe
  C:\Windows\System\mBobhjQ.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\gPuLYXT.exe
  C:\Windows\System\gPuLYXT.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\sJDMgSL.exe
  C:\Windows\System\sJDMgSL.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\VzZpeJX.exe
  C:\Windows\System\VzZpeJX.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\xVrQhIg.exe
  C:\Windows\System\xVrQhIg.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\qkyBEzQ.exe
  C:\Windows\System\qkyBEzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\fCjAKRF.exe
  C:\Windows\System\fCjAKRF.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\xDDtVra.exe
  C:\Windows\System\xDDtVra.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\vpzhiMm.exe
  C:\Windows\System\vpzhiMm.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ftnPDUQ.exe
  C:\Windows\System\ftnPDUQ.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\xJudcQF.exe
  C:\Windows\System\xJudcQF.exe
  2⤵
  - Executes dropped EXE
  PID:536
- C:\Windows\System\RYFiIFC.exe
  C:\Windows\System\RYFiIFC.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\fEAnxyg.exe
  C:\Windows\System\fEAnxyg.exe
  2⤵
  - Executes dropped EXE
  PID:784
- C:\Windows\System\owPuFyL.exe
  C:\Windows\System\owPuFyL.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\DkjuSxa.exe
  C:\Windows\System\DkjuSxa.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\FhOXRip.exe
  C:\Windows\System\FhOXRip.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\wbQoYOC.exe
  C:\Windows\System\wbQoYOC.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\QbFVsrQ.exe
  C:\Windows\System\QbFVsrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\KQfHFkj.exe
  C:\Windows\System\KQfHFkj.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\hiCwSSz.exe
  C:\Windows\System\hiCwSSz.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\XJKfJCf.exe
  C:\Windows\System\XJKfJCf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\dQUeeHc.exe
  C:\Windows\System\dQUeeHc.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\PVVhFsO.exe
  C:\Windows\System\PVVhFsO.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\ViOQBro.exe
  C:\Windows\System\ViOQBro.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\YcCKxJh.exe
  C:\Windows\System\YcCKxJh.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\nxhPGkJ.exe
  C:\Windows\System\nxhPGkJ.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\JQRjLYf.exe
  C:\Windows\System\JQRjLYf.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\dhAejXQ.exe
  C:\Windows\System\dhAejXQ.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\QImxSie.exe
  C:\Windows\System\QImxSie.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\Fgppgxs.exe
  C:\Windows\System\Fgppgxs.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\FdMgtqS.exe
  C:\Windows\System\FdMgtqS.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\idSqNyl.exe
  C:\Windows\System\idSqNyl.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\ShurGtA.exe
  C:\Windows\System\ShurGtA.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\RQnUVjw.exe
  C:\Windows\System\RQnUVjw.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\zTNnslF.exe
  C:\Windows\System\zTNnslF.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\Weotrwi.exe
  C:\Windows\System\Weotrwi.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\fRxOjJG.exe
  C:\Windows\System\fRxOjJG.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\QkiHZdD.exe
  C:\Windows\System\QkiHZdD.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\YbrRFPe.exe
  C:\Windows\System\YbrRFPe.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\yQKkicY.exe
  C:\Windows\System\yQKkicY.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\cvOcwhr.exe
  C:\Windows\System\cvOcwhr.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\DVaEReC.exe
  C:\Windows\System\DVaEReC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\UxowEHQ.exe
  C:\Windows\System\UxowEHQ.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\indFoxP.exe
  C:\Windows\System\indFoxP.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\zUZHcqJ.exe
  C:\Windows\System\zUZHcqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\mfWfcdd.exe
  C:\Windows\System\mfWfcdd.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\gEGuPCI.exe
  C:\Windows\System\gEGuPCI.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\MZFYmUG.exe
  C:\Windows\System\MZFYmUG.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\IsHdEHc.exe
  C:\Windows\System\IsHdEHc.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\DFQfyUg.exe
  C:\Windows\System\DFQfyUg.exe
  2⤵
  PID:2472
- C:\Windows\System\inHgdKN.exe
  C:\Windows\System\inHgdKN.exe
  2⤵
  PID:2444
- C:\Windows\System\VRapqzU.exe
  C:\Windows\System\VRapqzU.exe
  2⤵
  PID:2916
- C:\Windows\System\tKkNQLC.exe
  C:\Windows\System\tKkNQLC.exe
  2⤵
  PID:2456
- C:\Windows\System\zOCXziO.exe
  C:\Windows\System\zOCXziO.exe
  2⤵
  PID:2524
- C:\Windows\System\hgSPdzU.exe
  C:\Windows\System\hgSPdzU.exe
  2⤵
  PID:2920
- C:\Windows\System\aWAIydz.exe
  C:\Windows\System\aWAIydz.exe
  2⤵
  PID:2628
- C:\Windows\System\ARUVQkb.exe
  C:\Windows\System\ARUVQkb.exe
  2⤵
  PID:2708
- C:\Windows\System\ngbJjET.exe
  C:\Windows\System\ngbJjET.exe
  2⤵
  PID:2632
- C:\Windows\System\MGEMiSU.exe
  C:\Windows\System\MGEMiSU.exe
  2⤵
  PID:332
- C:\Windows\System\sffxssJ.exe
  C:\Windows\System\sffxssJ.exe
  2⤵
  PID:2504
- C:\Windows\System\yaUBqBN.exe
  C:\Windows\System\yaUBqBN.exe
  2⤵
  PID:1440
- C:\Windows\System\BjyvIOF.exe
  C:\Windows\System\BjyvIOF.exe
  2⤵
  PID:1712
- C:\Windows\System\waUgwaO.exe
  C:\Windows\System\waUgwaO.exe
  2⤵
  PID:2044
- C:\Windows\System\FxkONHD.exe
  C:\Windows\System\FxkONHD.exe
  2⤵
  PID:2212
- C:\Windows\System\dqRlQkc.exe
  C:\Windows\System\dqRlQkc.exe
  2⤵
  PID:2728
- C:\Windows\System\vCDsptb.exe
  C:\Windows\System\vCDsptb.exe
  2⤵
  PID:2300
- C:\Windows\System\VXZdtLc.exe
  C:\Windows\System\VXZdtLc.exe
  2⤵
  PID:2184
- C:\Windows\System\OALBZWA.exe
  C:\Windows\System\OALBZWA.exe
  2⤵
  PID:1816
- C:\Windows\System\xOCCJcX.exe
  C:\Windows\System\xOCCJcX.exe
  2⤵
  PID:988
- C:\Windows\System\bAicPNU.exe
  C:\Windows\System\bAicPNU.exe
  2⤵
  PID:2160
- C:\Windows\System\BuCdTYY.exe
  C:\Windows\System\BuCdTYY.exe
  2⤵
  PID:1580
- C:\Windows\System\PjXVyCL.exe
  C:\Windows\System\PjXVyCL.exe
  2⤵
  PID:3000
- C:\Windows\System\iKgBwIi.exe
  C:\Windows\System\iKgBwIi.exe
  2⤵
  PID:2024
- C:\Windows\System\EUtFGJO.exe
  C:\Windows\System\EUtFGJO.exe
  2⤵
  PID:776
- C:\Windows\System\QhQYnyQ.exe
  C:\Windows\System\QhQYnyQ.exe
  2⤵
  PID:636
- C:\Windows\System\NvmvNfz.exe
  C:\Windows\System\NvmvNfz.exe
  2⤵
  PID:2992
- C:\Windows\System\ndEeVoK.exe
  C:\Windows\System\ndEeVoK.exe
  2⤵
  PID:684
- C:\Windows\System\RHiHZOX.exe
  C:\Windows\System\RHiHZOX.exe
  2⤵
  PID:2748
- C:\Windows\System\vjhnYew.exe
  C:\Windows\System\vjhnYew.exe
  2⤵
  PID:1276
- C:\Windows\System\KthLMjG.exe
  C:\Windows\System\KthLMjG.exe
  2⤵
  PID:1216
- C:\Windows\System\cINDjMM.exe
  C:\Windows\System\cINDjMM.exe
  2⤵
  PID:1312
- C:\Windows\System\hsTOOhP.exe
  C:\Windows\System\hsTOOhP.exe
  2⤵
  PID:1680
- C:\Windows\System\XizmRxR.exe
  C:\Windows\System\XizmRxR.exe
  2⤵
  PID:1788
- C:\Windows\System\DwRXSRz.exe
  C:\Windows\System\DwRXSRz.exe
  2⤵
  PID:2360
- C:\Windows\System\mTfzoAK.exe
  C:\Windows\System\mTfzoAK.exe
  2⤵
  PID:1600
- C:\Windows\System\JLmkgYE.exe
  C:\Windows\System\JLmkgYE.exe
  2⤵
  PID:2344
- C:\Windows\System\aMwyaWH.exe
  C:\Windows\System\aMwyaWH.exe
  2⤵
  PID:268
- C:\Windows\System\uWPxjec.exe
  C:\Windows\System\uWPxjec.exe
  2⤵
  PID:2656
- C:\Windows\System\zchnZNi.exe
  C:\Windows\System\zchnZNi.exe
  2⤵
  PID:1356
- C:\Windows\System\vLnKzeq.exe
  C:\Windows\System\vLnKzeq.exe
  2⤵
  PID:2204
- C:\Windows\System\dlfTauE.exe
  C:\Windows\System\dlfTauE.exe
  2⤵
  PID:1008
- C:\Windows\System\qEQUIVD.exe
  C:\Windows\System\qEQUIVD.exe
  2⤵
  PID:572
- C:\Windows\System\LRrongi.exe
  C:\Windows\System\LRrongi.exe
  2⤵
  PID:2660
- C:\Windows\System\TXDaXcx.exe
  C:\Windows\System\TXDaXcx.exe
  2⤵
  PID:980
- C:\Windows\System\bgfaIPs.exe
  C:\Windows\System\bgfaIPs.exe
  2⤵
  PID:952
- C:\Windows\System\gQZWkfB.exe
  C:\Windows\System\gQZWkfB.exe
  2⤵
  PID:1672
- C:\Windows\System\ucpdmRi.exe
  C:\Windows\System\ucpdmRi.exe
  2⤵
  PID:884
- C:\Windows\System\ppzvhCM.exe
  C:\Windows\System\ppzvhCM.exe
  2⤵
  PID:2980
- C:\Windows\System\LxJwJPq.exe
  C:\Windows\System\LxJwJPq.exe
  2⤵
  PID:1616
- C:\Windows\System\VzdZBiD.exe
  C:\Windows\System\VzdZBiD.exe
  2⤵
  PID:2964
- C:\Windows\System\IOuOeiQ.exe
  C:\Windows\System\IOuOeiQ.exe
  2⤵
  PID:2468
- C:\Windows\System\FyznjPN.exe
  C:\Windows\System\FyznjPN.exe
  2⤵
  PID:872
- C:\Windows\System\XiQMALn.exe
  C:\Windows\System\XiQMALn.exe
  2⤵
  PID:2004
- C:\Windows\System\AWavcJe.exe
  C:\Windows\System\AWavcJe.exe
  2⤵
  PID:1952
- C:\Windows\System\lFZPpCI.exe
  C:\Windows\System\lFZPpCI.exe
  2⤵
  PID:1996
- C:\Windows\System\UlQeMqw.exe
  C:\Windows\System\UlQeMqw.exe
  2⤵
  PID:2232
- C:\Windows\System\MszgssZ.exe
  C:\Windows\System\MszgssZ.exe
  2⤵
  PID:2264
- C:\Windows\System\bwbLUqK.exe
  C:\Windows\System\bwbLUqK.exe
  2⤵
  PID:1528
- C:\Windows\System\evkqAXj.exe
  C:\Windows\System\evkqAXj.exe
  2⤵
  PID:2436
- C:\Windows\System\uiQWPeW.exe
  C:\Windows\System\uiQWPeW.exe
  2⤵
  PID:2336
- C:\Windows\System\LJobVtP.exe
  C:\Windows\System\LJobVtP.exe
  2⤵
  PID:2496
- C:\Windows\System\GpqvXGm.exe
  C:\Windows\System\GpqvXGm.exe
  2⤵
  PID:2324
- C:\Windows\System\ofplQYg.exe
  C:\Windows\System\ofplQYg.exe
  2⤵
  PID:2896
- C:\Windows\System\dpviKGW.exe
  C:\Windows\System\dpviKGW.exe
  2⤵
  PID:2248
- C:\Windows\System\CwydNcX.exe
  C:\Windows\System\CwydNcX.exe
  2⤵
  PID:1244
- C:\Windows\System\PrjjeHY.exe
  C:\Windows\System\PrjjeHY.exe
  2⤵
  PID:1740
- C:\Windows\System\msirpgJ.exe
  C:\Windows\System\msirpgJ.exe
  2⤵
  PID:2664
- C:\Windows\System\wvgKjLs.exe
  C:\Windows\System\wvgKjLs.exe
  2⤵
  PID:2720
- C:\Windows\System\GnfqUiU.exe
  C:\Windows\System\GnfqUiU.exe
  2⤵
  PID:2316
- C:\Windows\System\LAFtJqk.exe
  C:\Windows\System\LAFtJqk.exe
  2⤵
  PID:800
- C:\Windows\System\CKOFNoV.exe
  C:\Windows\System\CKOFNoV.exe
  2⤵
  PID:1632
- C:\Windows\System\HPKIMgh.exe
  C:\Windows\System\HPKIMgh.exe
  2⤵
  PID:2352
- C:\Windows\System\kRqNOPj.exe
  C:\Windows\System\kRqNOPj.exe
  2⤵
  PID:1420
- C:\Windows\System\tAUMHGG.exe
  C:\Windows\System\tAUMHGG.exe
  2⤵
  PID:2556
- C:\Windows\System\tgRsEKr.exe
  C:\Windows\System\tgRsEKr.exe
  2⤵
  PID:2552
- C:\Windows\System\FaTDlXn.exe
  C:\Windows\System\FaTDlXn.exe
  2⤵
  PID:3164
- C:\Windows\System\GmjWDRZ.exe
  C:\Windows\System\GmjWDRZ.exe
  2⤵
  PID:3180
- C:\Windows\System\RUpBTEC.exe
  C:\Windows\System\RUpBTEC.exe
  2⤵
  PID:3196
- C:\Windows\System\ZstkmIg.exe
  C:\Windows\System\ZstkmIg.exe
  2⤵
  PID:3212
- C:\Windows\System\RTxdzBi.exe
  C:\Windows\System\RTxdzBi.exe
  2⤵
  PID:3228
- C:\Windows\System\AGIFCax.exe
  C:\Windows\System\AGIFCax.exe
  2⤵
  PID:3244
- C:\Windows\System\gNkLDBe.exe
  C:\Windows\System\gNkLDBe.exe
  2⤵
  PID:3260
- C:\Windows\System\kPIwfxv.exe
  C:\Windows\System\kPIwfxv.exe
  2⤵
  PID:3276
- C:\Windows\System\ZdExLzg.exe
  C:\Windows\System\ZdExLzg.exe
  2⤵
  PID:3292
- C:\Windows\System\yVNZNks.exe
  C:\Windows\System\yVNZNks.exe
  2⤵
  PID:3308
- C:\Windows\System\gWTMMJp.exe
  C:\Windows\System\gWTMMJp.exe
  2⤵
  PID:3324
- C:\Windows\System\awqzVaf.exe
  C:\Windows\System\awqzVaf.exe
  2⤵
  PID:3340
- C:\Windows\System\BJrWHyh.exe
  C:\Windows\System\BJrWHyh.exe
  2⤵
  PID:3356
- C:\Windows\System\oSlZRaP.exe
  C:\Windows\System\oSlZRaP.exe
  2⤵
  PID:3372
- C:\Windows\System\KqQFeaY.exe
  C:\Windows\System\KqQFeaY.exe
  2⤵
  PID:3388
- C:\Windows\System\WVbIGzp.exe
  C:\Windows\System\WVbIGzp.exe
  2⤵
  PID:3404
- C:\Windows\System\njURkZo.exe
  C:\Windows\System\njURkZo.exe
  2⤵
  PID:3420
- C:\Windows\System\hFbTGLZ.exe
  C:\Windows\System\hFbTGLZ.exe
  2⤵
  PID:3468
- C:\Windows\System\eYYvUBm.exe
  C:\Windows\System\eYYvUBm.exe
  2⤵
  PID:3484
- C:\Windows\System\lVYjMoy.exe
  C:\Windows\System\lVYjMoy.exe
  2⤵
  PID:3504
- C:\Windows\System\EfJmgvo.exe
  C:\Windows\System\EfJmgvo.exe
  2⤵
  PID:3520
- C:\Windows\System\qrgussD.exe
  C:\Windows\System\qrgussD.exe
  2⤵
  PID:3536
- C:\Windows\System\vLtQRuX.exe
  C:\Windows\System\vLtQRuX.exe
  2⤵
  PID:3552
- C:\Windows\System\RsPDDGf.exe
  C:\Windows\System\RsPDDGf.exe
  2⤵
  PID:3604
- C:\Windows\System\ratEYQA.exe
  C:\Windows\System\ratEYQA.exe
  2⤵
  PID:3620
- C:\Windows\System\xdrfIle.exe
  C:\Windows\System\xdrfIle.exe
  2⤵
  PID:3636
- C:\Windows\System\yILZvyG.exe
  C:\Windows\System\yILZvyG.exe
  2⤵
  PID:3652
- C:\Windows\System\fpqyxbI.exe
  C:\Windows\System\fpqyxbI.exe
  2⤵
  PID:3668
- C:\Windows\System\GsaIAXp.exe
  C:\Windows\System\GsaIAXp.exe
  2⤵
  PID:3684
- C:\Windows\System\CanpUKO.exe
  C:\Windows\System\CanpUKO.exe
  2⤵
  PID:3700
- C:\Windows\System\hEiApqO.exe
  C:\Windows\System\hEiApqO.exe
  2⤵
  PID:3716
- C:\Windows\System\xZrjdTh.exe
  C:\Windows\System\xZrjdTh.exe
  2⤵
  PID:3732
- C:\Windows\System\BNHIoLf.exe
  C:\Windows\System\BNHIoLf.exe
  2⤵
  PID:3748
- C:\Windows\System\gdBLRcU.exe
  C:\Windows\System\gdBLRcU.exe
  2⤵
  PID:3764
- C:\Windows\System\utVKtPT.exe
  C:\Windows\System\utVKtPT.exe
  2⤵
  PID:3780
- C:\Windows\System\GwlFqMN.exe
  C:\Windows\System\GwlFqMN.exe
  2⤵
  PID:3796
- C:\Windows\System\NVrhxtF.exe
  C:\Windows\System\NVrhxtF.exe
  2⤵
  PID:3812
- C:\Windows\System\UkEWBss.exe
  C:\Windows\System\UkEWBss.exe
  2⤵
  PID:3884
- C:\Windows\System\tpwWXDs.exe
  C:\Windows\System\tpwWXDs.exe
  2⤵
  PID:3924
- C:\Windows\System\RVqauvw.exe
  C:\Windows\System\RVqauvw.exe
  2⤵
  PID:3940
- C:\Windows\System\zReELgb.exe
  C:\Windows\System\zReELgb.exe
  2⤵
  PID:3956
- C:\Windows\System\GhdaRvz.exe
  C:\Windows\System\GhdaRvz.exe
  2⤵
  PID:3972
- C:\Windows\System\cGJbXbl.exe
  C:\Windows\System\cGJbXbl.exe
  2⤵
  PID:4012
- C:\Windows\System\MrLkWmU.exe
  C:\Windows\System\MrLkWmU.exe
  2⤵
  PID:4028
- C:\Windows\System\QfpXVqt.exe
  C:\Windows\System\QfpXVqt.exe
  2⤵
  PID:4044
- C:\Windows\System\UzVeojr.exe
  C:\Windows\System\UzVeojr.exe
  2⤵
  PID:4060
- C:\Windows\System\ISuKSRV.exe
  C:\Windows\System\ISuKSRV.exe
  2⤵
  PID:4080
- C:\Windows\System\hUsMKUz.exe
  C:\Windows\System\hUsMKUz.exe
  2⤵
  PID:2380
- C:\Windows\System\vuFLyKf.exe
  C:\Windows\System\vuFLyKf.exe
  2⤵
  PID:1992
- C:\Windows\System\FwKfoAl.exe
  C:\Windows\System\FwKfoAl.exe
  2⤵
  PID:3064
- C:\Windows\System\YfYFyYx.exe
  C:\Windows\System\YfYFyYx.exe
  2⤵
  PID:2460
- C:\Windows\System\SfZiHgZ.exe
  C:\Windows\System\SfZiHgZ.exe
  2⤵
  PID:2116
- C:\Windows\System\GUnsYtu.exe
  C:\Windows\System\GUnsYtu.exe
  2⤵
  PID:2880
- C:\Windows\System\DzTQYpq.exe
  C:\Windows\System\DzTQYpq.exe
  2⤵
  PID:628
- C:\Windows\System\JmjeImE.exe
  C:\Windows\System\JmjeImE.exe
  2⤵
  PID:1016
- C:\Windows\System\HctJTTJ.exe
  C:\Windows\System\HctJTTJ.exe
  2⤵
  PID:1928
- C:\Windows\System\mUFbxmu.exe
  C:\Windows\System\mUFbxmu.exe
  2⤵
  PID:1204
- C:\Windows\System\DrMchpW.exe
  C:\Windows\System\DrMchpW.exe
  2⤵
  PID:704
- C:\Windows\System\abKBVwX.exe
  C:\Windows\System\abKBVwX.exe
  2⤵
  PID:2976
- C:\Windows\System\UTeWkgC.exe
  C:\Windows\System\UTeWkgC.exe
  2⤵
  PID:1808
- C:\Windows\System\WVtyekR.exe
  C:\Windows\System\WVtyekR.exe
  2⤵
  PID:1236
- C:\Windows\System\SgvcyrX.exe
  C:\Windows\System\SgvcyrX.exe
  2⤵
  PID:3100
- C:\Windows\System\YaPtZNn.exe
  C:\Windows\System\YaPtZNn.exe
  2⤵
  PID:3104
- C:\Windows\System\GtSvnnX.exe
  C:\Windows\System\GtSvnnX.exe
  2⤵
  PID:3112
- C:\Windows\System\bxOAezF.exe
  C:\Windows\System\bxOAezF.exe
  2⤵
  PID:3128
- C:\Windows\System\TlmXIgu.exe
  C:\Windows\System\TlmXIgu.exe
  2⤵
  PID:3192
- C:\Windows\System\cZHuGVL.exe
  C:\Windows\System\cZHuGVL.exe
  2⤵
  PID:3268
- C:\Windows\System\mGahryg.exe
  C:\Windows\System\mGahryg.exe
  2⤵
  PID:3284
- C:\Windows\System\GmXZnhW.exe
  C:\Windows\System\GmXZnhW.exe
  2⤵
  PID:3332
- C:\Windows\System\XZlCKQa.exe
  C:\Windows\System\XZlCKQa.exe
  2⤵
  PID:3364
- C:\Windows\System\CXafFMb.exe
  C:\Windows\System\CXafFMb.exe
  2⤵
  PID:3396
- C:\Windows\System\eOneBzb.exe
  C:\Windows\System\eOneBzb.exe
  2⤵
  PID:3436
- C:\Windows\System\kPYnlLd.exe
  C:\Windows\System\kPYnlLd.exe
  2⤵
  PID:3452
- C:\Windows\System\mqgVYAr.exe
  C:\Windows\System\mqgVYAr.exe
  2⤵
  PID:3384
- C:\Windows\System\VraPQNq.exe
  C:\Windows\System\VraPQNq.exe
  2⤵
  PID:3532
- C:\Windows\System\benfabE.exe
  C:\Windows\System\benfabE.exe
  2⤵
  PID:3564
- C:\Windows\System\ZEEjshr.exe
  C:\Windows\System\ZEEjshr.exe
  2⤵
  PID:3584
- C:\Windows\System\NsnzqQn.exe
  C:\Windows\System\NsnzqQn.exe
  2⤵
  PID:3600
- C:\Windows\System\VSldKpJ.exe
  C:\Windows\System\VSldKpJ.exe
  2⤵
  PID:3476
- C:\Windows\System\gAPekqL.exe
  C:\Windows\System\gAPekqL.exe
  2⤵
  PID:3544
- C:\Windows\System\WrvAxed.exe
  C:\Windows\System\WrvAxed.exe
  2⤵
  PID:3616
- C:\Windows\System\vNZrWcD.exe
  C:\Windows\System\vNZrWcD.exe
  2⤵
  PID:3664
- C:\Windows\System\QuoDuzH.exe
  C:\Windows\System\QuoDuzH.exe
  2⤵
  PID:3756
- C:\Windows\System\YzlxVLJ.exe
  C:\Windows\System\YzlxVLJ.exe
  2⤵
  PID:3820
- C:\Windows\System\rZbzwnf.exe
  C:\Windows\System\rZbzwnf.exe
  2⤵
  PID:3824
- C:\Windows\System\leswLWm.exe
  C:\Windows\System\leswLWm.exe
  2⤵
  PID:3844
- C:\Windows\System\wqEmfWw.exe
  C:\Windows\System\wqEmfWw.exe
  2⤵
  PID:3864
- C:\Windows\System\XoATAkr.exe
  C:\Windows\System\XoATAkr.exe
  2⤵
  PID:3880
- C:\Windows\System\tlDWYfh.exe
  C:\Windows\System\tlDWYfh.exe
  2⤵
  PID:3744
- C:\Windows\System\LZaDTEX.exe
  C:\Windows\System\LZaDTEX.exe
  2⤵
  PID:3912
- C:\Windows\System\FVANQqq.exe
  C:\Windows\System\FVANQqq.exe
  2⤵
  PID:3916
- C:\Windows\System\ZTJaoDh.exe
  C:\Windows\System\ZTJaoDh.exe
  2⤵
  PID:4088
- C:\Windows\System\NzZijqC.exe
  C:\Windows\System\NzZijqC.exe
  2⤵
  PID:336
- C:\Windows\System\hUZJsKr.exe
  C:\Windows\System\hUZJsKr.exe
  2⤵
  PID:3980
- C:\Windows\System\wwnOdZZ.exe
  C:\Windows\System\wwnOdZZ.exe
  2⤵
  PID:1768
- C:\Windows\System\aHsiUer.exe
  C:\Windows\System\aHsiUer.exe
  2⤵
  PID:2840
- C:\Windows\System\NtdMhDG.exe
  C:\Windows\System\NtdMhDG.exe
  2⤵
  PID:2332
- C:\Windows\System\xmwkGyq.exe
  C:\Windows\System\xmwkGyq.exe
  2⤵
  PID:2592
- C:\Windows\System\TuISrJE.exe
  C:\Windows\System\TuISrJE.exe
  2⤵
  PID:2476
- C:\Windows\System\wUkXgKH.exe
  C:\Windows\System\wUkXgKH.exe
  2⤵
  PID:4072
- C:\Windows\System\HczEMOR.exe
  C:\Windows\System\HczEMOR.exe
  2⤵
  PID:3996
- C:\Windows\System\qIcmIvR.exe
  C:\Windows\System\qIcmIvR.exe
  2⤵
  PID:2952
- C:\Windows\System\bApscna.exe
  C:\Windows\System\bApscna.exe
  2⤵
  PID:2924
- C:\Windows\System\VIDRYtO.exe
  C:\Windows\System\VIDRYtO.exe
  2⤵
  PID:3176
- C:\Windows\System\XJrbfrh.exe
  C:\Windows\System\XJrbfrh.exe
  2⤵
  PID:1556
- C:\Windows\System\PpqYyDJ.exe
  C:\Windows\System\PpqYyDJ.exe
  2⤵
  PID:3208
- C:\Windows\System\UBpBvRD.exe
  C:\Windows\System\UBpBvRD.exe
  2⤵
  PID:3148
- C:\Windows\System\jtuvpIh.exe
  C:\Windows\System\jtuvpIh.exe
  2⤵
  PID:3220
- C:\Windows\System\DMrQDqU.exe
  C:\Windows\System\DMrQDqU.exe
  2⤵
  PID:1148
- C:\Windows\System\KzQZiBQ.exe
  C:\Windows\System\KzQZiBQ.exe
  2⤵
  PID:3348
- C:\Windows\System\bEEzMXE.exe
  C:\Windows\System\bEEzMXE.exe
  2⤵
  PID:3460
- C:\Windows\System\zEcZEpC.exe
  C:\Windows\System\zEcZEpC.exe
  2⤵
  PID:3444
- C:\Windows\System\FOXlDYg.exe
  C:\Windows\System\FOXlDYg.exe
  2⤵
  PID:3832
- C:\Windows\System\ueEWVQU.exe
  C:\Windows\System\ueEWVQU.exe
  2⤵
  PID:3288
- C:\Windows\System\cshOiyN.exe
  C:\Windows\System\cshOiyN.exe
  2⤵
  PID:3120
- C:\Windows\System\RPrBamx.exe
  C:\Windows\System\RPrBamx.exe
  2⤵
  PID:2148
- C:\Windows\System\zaYamIE.exe
  C:\Windows\System\zaYamIE.exe
  2⤵
  PID:1752
- C:\Windows\System\VxCkGAk.exe
  C:\Windows\System\VxCkGAk.exe
  2⤵
  PID:3592
- C:\Windows\System\huRXOTd.exe
  C:\Windows\System\huRXOTd.exe
  2⤵
  PID:3696
- C:\Windows\System\SjsePeQ.exe
  C:\Windows\System\SjsePeQ.exe
  2⤵
  PID:3680
- C:\Windows\System\caLpjAh.exe
  C:\Windows\System\caLpjAh.exe
  2⤵
  PID:3772
- C:\Windows\System\iPNKnIT.exe
  C:\Windows\System\iPNKnIT.exe
  2⤵
  PID:2612
- C:\Windows\System\hqLlTbA.exe
  C:\Windows\System\hqLlTbA.exe
  2⤵
  PID:2868
- C:\Windows\System\whlhOCQ.exe
  C:\Windows\System\whlhOCQ.exe
  2⤵
  PID:3712
- C:\Windows\System\omcEGlc.exe
  C:\Windows\System\omcEGlc.exe
  2⤵
  PID:3568
- C:\Windows\System\KJWogej.exe
  C:\Windows\System\KJWogej.exe
  2⤵
  PID:1416
- C:\Windows\System\MsVrTYp.exe
  C:\Windows\System\MsVrTYp.exe
  2⤵
  PID:3892
- C:\Windows\System\nELJzBl.exe
  C:\Windows\System\nELJzBl.exe
  2⤵
  PID:2144
- C:\Windows\System\pBAvThQ.exe
  C:\Windows\System\pBAvThQ.exe
  2⤵
  PID:3936
- C:\Windows\System\vzFbSEW.exe
  C:\Windows\System\vzFbSEW.exe
  2⤵
  PID:4024
- C:\Windows\System\CsNAenO.exe
  C:\Windows\System\CsNAenO.exe
  2⤵
  PID:4052
- C:\Windows\System\pkyLXPZ.exe
  C:\Windows\System\pkyLXPZ.exe
  2⤵
  PID:1348
- C:\Windows\System\ioCJgxR.exe
  C:\Windows\System\ioCJgxR.exe
  2⤵
  PID:4040
- C:\Windows\System\QxhxZVY.exe
  C:\Windows\System\QxhxZVY.exe
  2⤵
  PID:4116
- C:\Windows\System\mGKstlU.exe
  C:\Windows\System\mGKstlU.exe
  2⤵
  PID:4132
- C:\Windows\System\srmHBdo.exe
  C:\Windows\System\srmHBdo.exe
  2⤵
  PID:4148
- C:\Windows\System\oRTqypd.exe
  C:\Windows\System\oRTqypd.exe
  2⤵
  PID:4168
- C:\Windows\System\FGHZEhQ.exe
  C:\Windows\System\FGHZEhQ.exe
  2⤵
  PID:4184
- C:\Windows\System\EEGWgSA.exe
  C:\Windows\System\EEGWgSA.exe
  2⤵
  PID:4200
- C:\Windows\System\thhwhWQ.exe
  C:\Windows\System\thhwhWQ.exe
  2⤵
  PID:4216
- C:\Windows\System\zOeInLj.exe
  C:\Windows\System\zOeInLj.exe
  2⤵
  PID:4232
- C:\Windows\System\LaQPyaH.exe
  C:\Windows\System\LaQPyaH.exe
  2⤵
  PID:4248
- C:\Windows\System\oLMLuee.exe
  C:\Windows\System\oLMLuee.exe
  2⤵
  PID:4268
- C:\Windows\System\eVTHDqi.exe
  C:\Windows\System\eVTHDqi.exe
  2⤵
  PID:4288
- C:\Windows\System\bgJJWNb.exe
  C:\Windows\System\bgJJWNb.exe
  2⤵
  PID:4308
- C:\Windows\System\oZTCQvQ.exe
  C:\Windows\System\oZTCQvQ.exe
  2⤵
  PID:4324
- C:\Windows\System\rqECUaX.exe
  C:\Windows\System\rqECUaX.exe
  2⤵
  PID:4340
- C:\Windows\System\rGIRRVf.exe
  C:\Windows\System\rGIRRVf.exe
  2⤵
  PID:4356
- C:\Windows\System\BuJvROV.exe
  C:\Windows\System\BuJvROV.exe
  2⤵
  PID:4372
- C:\Windows\System\qxivtaE.exe
  C:\Windows\System\qxivtaE.exe
  2⤵
  PID:4392
- C:\Windows\System\HuFCdhw.exe
  C:\Windows\System\HuFCdhw.exe
  2⤵
  PID:4408
- C:\Windows\System\ImtyyDJ.exe
  C:\Windows\System\ImtyyDJ.exe
  2⤵
  PID:4424
- C:\Windows\System\YOnFjol.exe
  C:\Windows\System\YOnFjol.exe
  2⤵
  PID:4512
- C:\Windows\System\EsWaolO.exe
  C:\Windows\System\EsWaolO.exe
  2⤵
  PID:4580
- C:\Windows\System\jhdcyDh.exe
  C:\Windows\System\jhdcyDh.exe
  2⤵
  PID:4648
- C:\Windows\System\rlismqP.exe
  C:\Windows\System\rlismqP.exe
  2⤵
  PID:4676
- C:\Windows\System\OlojfFV.exe
  C:\Windows\System\OlojfFV.exe
  2⤵
  PID:4692
- C:\Windows\System\BWhiEvx.exe
  C:\Windows\System\BWhiEvx.exe
  2⤵
  PID:4724
- C:\Windows\System\lQBNsmd.exe
  C:\Windows\System\lQBNsmd.exe
  2⤵
  PID:4820
- C:\Windows\System\CQBkZaW.exe
  C:\Windows\System\CQBkZaW.exe
  2⤵
  PID:4836
- C:\Windows\System\WVKywLI.exe
  C:\Windows\System\WVKywLI.exe
  2⤵
  PID:4864
- C:\Windows\System\IAbAEsi.exe
  C:\Windows\System\IAbAEsi.exe
  2⤵
  PID:4880
- C:\Windows\System\nVMZZjC.exe
  C:\Windows\System\nVMZZjC.exe
  2⤵
  PID:4896
- C:\Windows\System\nFUmeKi.exe
  C:\Windows\System\nFUmeKi.exe
  2⤵
  PID:4912
- C:\Windows\System\JCvRznn.exe
  C:\Windows\System\JCvRznn.exe
  2⤵
  PID:4940
- C:\Windows\System\xQbMXhC.exe
  C:\Windows\System\xQbMXhC.exe
  2⤵
  PID:4956
- C:\Windows\System\xjtYAJn.exe
  C:\Windows\System\xjtYAJn.exe
  2⤵
  PID:4976
- C:\Windows\System\kBkkyPr.exe
  C:\Windows\System\kBkkyPr.exe
  2⤵
  PID:4996
- C:\Windows\System\EVOkCFg.exe
  C:\Windows\System\EVOkCFg.exe
  2⤵
  PID:5024
- C:\Windows\System\khbNJsM.exe
  C:\Windows\System\khbNJsM.exe
  2⤵
  PID:5072
- C:\Windows\System\zHVsUAH.exe
  C:\Windows\System\zHVsUAH.exe
  2⤵
  PID:5104
- C:\Windows\System\QwITctW.exe
  C:\Windows\System\QwITctW.exe
  2⤵
  PID:2368
- C:\Windows\System\lvlgusM.exe
  C:\Windows\System\lvlgusM.exe
  2⤵
  PID:1512
- C:\Windows\System\psGNcie.exe
  C:\Windows\System\psGNcie.exe
  2⤵
  PID:3792
- C:\Windows\System\DnYqUXj.exe
  C:\Windows\System\DnYqUXj.exe
  2⤵
  PID:3708
- C:\Windows\System\sasPUYj.exe
  C:\Windows\System\sasPUYj.exe
  2⤵
  PID:3920
- C:\Windows\System\QUEBTVB.exe
  C:\Windows\System\QUEBTVB.exe
  2⤵
  PID:2060
- C:\Windows\System\zeqemkW.exe
  C:\Windows\System\zeqemkW.exe
  2⤵
  PID:2580
- C:\Windows\System\IkjHTVA.exe
  C:\Windows\System\IkjHTVA.exe
  2⤵
  PID:3144
- C:\Windows\System\FkQefDu.exe
  C:\Windows\System\FkQefDu.exe
  2⤵
  PID:4416
- C:\Windows\System\mCUoBIB.exe
  C:\Windows\System\mCUoBIB.exe
  2⤵
  PID:3448
- C:\Windows\System\sNvvzhz.exe
  C:\Windows\System\sNvvzhz.exe
  2⤵
  PID:3224
- C:\Windows\System\OWxqHbp.exe
  C:\Windows\System\OWxqHbp.exe
  2⤵
  PID:4108
- C:\Windows\System\dxjnvBd.exe
  C:\Windows\System\dxjnvBd.exe
  2⤵
  PID:4212
- C:\Windows\System\AgwBPZf.exe
  C:\Windows\System\AgwBPZf.exe
  2⤵
  PID:4280
- C:\Windows\System\ENDfahp.exe
  C:\Windows\System\ENDfahp.exe
  2⤵
  PID:4352
- C:\Windows\System\rzYYhiI.exe
  C:\Windows\System\rzYYhiI.exe
  2⤵
  PID:3692
- C:\Windows\System\xHJGcWu.exe
  C:\Windows\System\xHJGcWu.exe
  2⤵
  PID:4196
- C:\Windows\System\dBrlKac.exe
  C:\Windows\System\dBrlKac.exe
  2⤵
  PID:4436
- C:\Windows\System\GVQeBzS.exe
  C:\Windows\System\GVQeBzS.exe
  2⤵
  PID:3428
- C:\Windows\System\mzUrvdK.exe
  C:\Windows\System\mzUrvdK.exe
  2⤵
  PID:932
- C:\Windows\System\nWIvIvR.exe
  C:\Windows\System\nWIvIvR.exe
  2⤵
  PID:2308
- C:\Windows\System\ktffOVK.exe
  C:\Windows\System\ktffOVK.exe
  2⤵
  PID:2280
- C:\Windows\System\uzUjNRD.exe
  C:\Windows\System\uzUjNRD.exe
  2⤵
  PID:288
- C:\Windows\System\oLKNIxP.exe
  C:\Windows\System\oLKNIxP.exe
  2⤵
  PID:4124
- C:\Windows\System\cbMvSHp.exe
  C:\Windows\System\cbMvSHp.exe
  2⤵
  PID:4228
- C:\Windows\System\lVgNNiW.exe
  C:\Windows\System\lVgNNiW.exe
  2⤵
  PID:4300
- C:\Windows\System\JSHmnkh.exe
  C:\Windows\System\JSHmnkh.exe
  2⤵
  PID:4364
- C:\Windows\System\LZRDpsK.exe
  C:\Windows\System\LZRDpsK.exe
  2⤵
  PID:4460
- C:\Windows\System\UoRAGwz.exe
  C:\Windows\System\UoRAGwz.exe
  2⤵
  PID:4540
- C:\Windows\System\pLrwenu.exe
  C:\Windows\System\pLrwenu.exe
  2⤵
  PID:4596
- C:\Windows\System\sNuJZOf.exe
  C:\Windows\System\sNuJZOf.exe
  2⤵
  PID:344
- C:\Windows\System\fSyMuPt.exe
  C:\Windows\System\fSyMuPt.exe
  2⤵
  PID:4632
- C:\Windows\System\IQCbvVd.exe
  C:\Windows\System\IQCbvVd.exe
  2⤵
  PID:4620
- C:\Windows\System\RbgkyTd.exe
  C:\Windows\System\RbgkyTd.exe
  2⤵
  PID:4608
- C:\Windows\System\vdagVOT.exe
  C:\Windows\System\vdagVOT.exe
  2⤵
  PID:4684
- C:\Windows\System\IMZLQiQ.exe
  C:\Windows\System\IMZLQiQ.exe
  2⤵
  PID:4760
- C:\Windows\System\yhLsziY.exe
  C:\Windows\System\yhLsziY.exe
  2⤵
  PID:4776
- C:\Windows\System\hGpQKIA.exe
  C:\Windows\System\hGpQKIA.exe
  2⤵
  PID:4768
- C:\Windows\System\weFxWhL.exe
  C:\Windows\System\weFxWhL.exe
  2⤵
  PID:4804
- C:\Windows\System\wdYNElx.exe
  C:\Windows\System\wdYNElx.exe
  2⤵
  PID:4816
- C:\Windows\System\UOOvwVK.exe
  C:\Windows\System\UOOvwVK.exe
  2⤵
  PID:4920
- C:\Windows\System\ixIWrbk.exe
  C:\Windows\System\ixIWrbk.exe
  2⤵
  PID:4948
- C:\Windows\System\YBrkypv.exe
  C:\Windows\System\YBrkypv.exe
  2⤵
  PID:4988
- C:\Windows\System\uyEHFWh.exe
  C:\Windows\System\uyEHFWh.exe
  2⤵
  PID:5060
- C:\Windows\System\djOJCzR.exe
  C:\Windows\System\djOJCzR.exe
  2⤵
  PID:3660
- C:\Windows\System\tHlxOAG.exe
  C:\Windows\System\tHlxOAG.exe
  2⤵
  PID:5088
- C:\Windows\System\YxBaNpb.exe
  C:\Windows\System\YxBaNpb.exe
  2⤵
  PID:3848
- C:\Windows\System\MMejNMh.exe
  C:\Windows\System\MMejNMh.exe
  2⤵
  PID:1812
- C:\Windows\System\jcNnIEZ.exe
  C:\Windows\System\jcNnIEZ.exe
  2⤵
  PID:3900
- C:\Windows\System\XFjZolj.exe
  C:\Windows\System\XFjZolj.exe
  2⤵
  PID:3204
- C:\Windows\System\xJrJHcf.exe
  C:\Windows\System\xJrJHcf.exe
  2⤵
  PID:4388
- C:\Windows\System\byOiWXw.exe
  C:\Windows\System\byOiWXw.exe
  2⤵
  PID:3320
- C:\Windows\System\NPHmOPP.exe
  C:\Windows\System\NPHmOPP.exe
  2⤵
  PID:4176
- C:\Windows\System\sOclTlC.exe
  C:\Windows\System\sOclTlC.exe
  2⤵
  PID:2716
- C:\Windows\System\HOOEozk.exe
  C:\Windows\System\HOOEozk.exe
  2⤵
  PID:4112
- C:\Windows\System\KWAUluK.exe
  C:\Windows\System\KWAUluK.exe
  2⤵
  PID:4160
- C:\Windows\System\PXzXjpQ.exe
  C:\Windows\System\PXzXjpQ.exe
  2⤵
  PID:4156
- C:\Windows\System\iuQHfsP.exe
  C:\Windows\System\iuQHfsP.exe
  2⤵
  PID:3500
- C:\Windows\System\BdMDUWg.exe
  C:\Windows\System\BdMDUWg.exe
  2⤵
  PID:2912
- C:\Windows\System\ZayOTSB.exe
  C:\Windows\System\ZayOTSB.exe
  2⤵
  PID:3416
- C:\Windows\System\CAlfpmd.exe
  C:\Windows\System\CAlfpmd.exe
  2⤵
  PID:2008
- C:\Windows\System\BaACAiu.exe
  C:\Windows\System\BaACAiu.exe
  2⤵
  PID:4192
- C:\Windows\System\gjtDRqC.exe
  C:\Windows\System\gjtDRqC.exe
  2⤵
  PID:4504
- C:\Windows\System\dnBCKrt.exe
  C:\Windows\System\dnBCKrt.exe
  2⤵
  PID:4536
- C:\Windows\System\eMQtapb.exe
  C:\Windows\System\eMQtapb.exe
  2⤵
  PID:4668
- C:\Windows\System\TmHoztj.exe
  C:\Windows\System\TmHoztj.exe
  2⤵
  PID:4524
- C:\Windows\System\NJKXJxc.exe
  C:\Windows\System\NJKXJxc.exe
  2⤵
  PID:4616
- C:\Windows\System\gWmWAqz.exe
  C:\Windows\System\gWmWAqz.exe
  2⤵
  PID:4708
- C:\Windows\System\gkFQpWi.exe
  C:\Windows\System\gkFQpWi.exe
  2⤵
  PID:4732
- C:\Windows\System\kyTbPlL.exe
  C:\Windows\System\kyTbPlL.exe
  2⤵
  PID:4756
- C:\Windows\System\KlYBNKe.exe
  C:\Windows\System\KlYBNKe.exe
  2⤵
  PID:4780
- C:\Windows\System\TuFwOlJ.exe
  C:\Windows\System\TuFwOlJ.exe
  2⤵
  PID:4848
- C:\Windows\System\rCCUwTz.exe
  C:\Windows\System\rCCUwTz.exe
  2⤵
  PID:4612
- C:\Windows\System\pFctKJv.exe
  C:\Windows\System\pFctKJv.exe
  2⤵
  PID:4904
- C:\Windows\System\lpWmgiZ.exe
  C:\Windows\System\lpWmgiZ.exe
  2⤵
  PID:4932
- C:\Windows\System\EDryLKS.exe
  C:\Windows\System\EDryLKS.exe
  2⤵
  PID:5004
- C:\Windows\System\fZCftiA.exe
  C:\Windows\System\fZCftiA.exe
  2⤵
  PID:5112
- C:\Windows\System\iIjCLcu.exe
  C:\Windows\System\iIjCLcu.exe
  2⤵
  PID:5020
- C:\Windows\System\ipURqaZ.exe
  C:\Windows\System\ipURqaZ.exe
  2⤵
  PID:5052
- C:\Windows\System\wrRLlRN.exe
  C:\Windows\System\wrRLlRN.exe
  2⤵
  PID:5116
- C:\Windows\System\HeTsxtI.exe
  C:\Windows\System\HeTsxtI.exe
  2⤵
  PID:5100
- C:\Windows\System\Rreqwce.exe
  C:\Windows\System\Rreqwce.exe
  2⤵
  PID:3560
- C:\Windows\System\DTLCejq.exe
  C:\Windows\System\DTLCejq.exe
  2⤵
  PID:4208
- C:\Windows\System\ITyBjUn.exe
  C:\Windows\System\ITyBjUn.exe
  2⤵
  PID:5012
- C:\Windows\System\ybpJOiY.exe
  C:\Windows\System\ybpJOiY.exe
  2⤵
  PID:1268
- C:\Windows\System\FeNBglg.exe
  C:\Windows\System\FeNBglg.exe
  2⤵
  PID:4400
- C:\Windows\System\YynXZmK.exe
  C:\Windows\System\YynXZmK.exe
  2⤵
  PID:4628
- C:\Windows\System\gHYGqYP.exe
  C:\Windows\System\gHYGqYP.exe
  2⤵
  PID:4812
- C:\Windows\System\IfQhVdK.exe
  C:\Windows\System\IfQhVdK.exe
  2⤵
  PID:4644
- C:\Windows\System\MACIwYB.exe
  C:\Windows\System\MACIwYB.exe
  2⤵
  PID:5016
- C:\Windows\System\cDeEMiT.exe
  C:\Windows\System\cDeEMiT.exe
  2⤵
  PID:4688
- C:\Windows\System\WNJgnfU.exe
  C:\Windows\System\WNJgnfU.exe
  2⤵
  PID:2596
- C:\Windows\System\IOIEsnE.exe
  C:\Windows\System\IOIEsnE.exe
  2⤵
  PID:4788
- C:\Windows\System\cDFTOjm.exe
  C:\Windows\System\cDFTOjm.exe
  2⤵
  PID:3576
- C:\Windows\System\huqgMsc.exe
  C:\Windows\System\huqgMsc.exe
  2⤵
  PID:4968
- C:\Windows\System\YcnmpJw.exe
  C:\Windows\System\YcnmpJw.exe
  2⤵
  PID:4180
- C:\Windows\System\NcRMZxe.exe
  C:\Windows\System\NcRMZxe.exe
  2⤵
  PID:4704
- C:\Windows\System\uDrszfB.exe
  C:\Windows\System\uDrszfB.exe
  2⤵
  PID:1624
- C:\Windows\System\cFzHbUK.exe
  C:\Windows\System\cFzHbUK.exe
  2⤵
  PID:2536
- C:\Windows\System\GOkgdIV.exe
  C:\Windows\System\GOkgdIV.exe
  2⤵
  PID:3256
- C:\Windows\System\ujshxAs.exe
  C:\Windows\System\ujshxAs.exe
  2⤵
  PID:4660
- C:\Windows\System\vgvlFlO.exe
  C:\Windows\System\vgvlFlO.exe
  2⤵
  PID:4500
- C:\Windows\System\nDHIZFs.exe
  C:\Windows\System\nDHIZFs.exe
  2⤵
  PID:4000
- C:\Windows\System\EKwwFGJ.exe
  C:\Windows\System\EKwwFGJ.exe
  2⤵
  PID:1936
- C:\Windows\System\ueRKKcU.exe
  C:\Windows\System\ueRKKcU.exe
  2⤵
  PID:3156
- C:\Windows\System\WPmlyMi.exe
  C:\Windows\System\WPmlyMi.exe
  2⤵
  PID:836
- C:\Windows\System\nBVKKrW.exe
  C:\Windows\System\nBVKKrW.exe
  2⤵
  PID:4320
- C:\Windows\System\yLpClKa.exe
  C:\Windows\System\yLpClKa.exe
  2⤵
  PID:4964
- C:\Windows\System\UqTjGsm.exe
  C:\Windows\System\UqTjGsm.exe
  2⤵
  PID:5092
- C:\Windows\System\DYdgHbP.exe
  C:\Windows\System\DYdgHbP.exe
  2⤵
  PID:4532
- C:\Windows\System\DZccMLL.exe
  C:\Windows\System\DZccMLL.exe
  2⤵
  PID:4856
- C:\Windows\System\hZQiByA.exe
  C:\Windows\System\hZQiByA.exe
  2⤵
  PID:1772
- C:\Windows\System\DTnAgxf.exe
  C:\Windows\System\DTnAgxf.exe
  2⤵
  PID:4004
- C:\Windows\System\XAeZqBa.exe
  C:\Windows\System\XAeZqBa.exe
  2⤵
  PID:496
- C:\Windows\System\DVjdZjd.exe
  C:\Windows\System\DVjdZjd.exe
  2⤵
  PID:4928
- C:\Windows\System\xkcwHGE.exe
  C:\Windows\System\xkcwHGE.exe
  2⤵
  PID:1248
- C:\Windows\System\AlQUNUL.exe
  C:\Windows\System\AlQUNUL.exe
  2⤵
  PID:5036
- C:\Windows\System\XLtKdOJ.exe
  C:\Windows\System\XLtKdOJ.exe
  2⤵
  PID:5128
- C:\Windows\System\ZOuMIjx.exe
  C:\Windows\System\ZOuMIjx.exe
  2⤵
  PID:5144
- C:\Windows\System\sKsGapV.exe
  C:\Windows\System\sKsGapV.exe
  2⤵
  PID:5160
- C:\Windows\System\kBAqPvb.exe
  C:\Windows\System\kBAqPvb.exe
  2⤵
  PID:5176
- C:\Windows\System\OsYURuR.exe
  C:\Windows\System\OsYURuR.exe
  2⤵
  PID:5192
- C:\Windows\System\yXLIpxu.exe
  C:\Windows\System\yXLIpxu.exe
  2⤵
  PID:5212
- C:\Windows\System\ieWZyeb.exe
  C:\Windows\System\ieWZyeb.exe
  2⤵
  PID:5228
- C:\Windows\System\PeulaCx.exe
  C:\Windows\System\PeulaCx.exe
  2⤵
  PID:5244
- C:\Windows\System\wAnSVxZ.exe
  C:\Windows\System\wAnSVxZ.exe
  2⤵
  PID:5260
- C:\Windows\System\bvCAWFG.exe
  C:\Windows\System\bvCAWFG.exe
  2⤵
  PID:5276
- C:\Windows\System\jVicOMd.exe
  C:\Windows\System\jVicOMd.exe
  2⤵
  PID:5292
- C:\Windows\System\VNqYPLI.exe
  C:\Windows\System\VNqYPLI.exe
  2⤵
  PID:5308
- C:\Windows\System\EuWkccI.exe
  C:\Windows\System\EuWkccI.exe
  2⤵
  PID:5332
- C:\Windows\System\SbLrtjW.exe
  C:\Windows\System\SbLrtjW.exe
  2⤵
  PID:5416
- C:\Windows\System\yWSMTsb.exe
  C:\Windows\System\yWSMTsb.exe
  2⤵
  PID:5432
- C:\Windows\System\jvJQjOj.exe
  C:\Windows\System\jvJQjOj.exe
  2⤵
  PID:5448
- C:\Windows\System\iQkSOHM.exe
  C:\Windows\System\iQkSOHM.exe
  2⤵
  PID:5464
- C:\Windows\System\NPmPRLk.exe
  C:\Windows\System\NPmPRLk.exe
  2⤵
  PID:5480
- C:\Windows\System\UzrcxSQ.exe
  C:\Windows\System\UzrcxSQ.exe
  2⤵
  PID:5496
- C:\Windows\System\toDQAFf.exe
  C:\Windows\System\toDQAFf.exe
  2⤵
  PID:5516
- C:\Windows\System\faRmEqI.exe
  C:\Windows\System\faRmEqI.exe
  2⤵
  PID:5536
- C:\Windows\System\qaHMLQk.exe
  C:\Windows\System\qaHMLQk.exe
  2⤵
  PID:5552
- C:\Windows\System\XYvYqjf.exe
  C:\Windows\System\XYvYqjf.exe
  2⤵
  PID:5568
- C:\Windows\System\QoVgUqR.exe
  C:\Windows\System\QoVgUqR.exe
  2⤵
  PID:5592
- C:\Windows\System\ETwqCOd.exe
  C:\Windows\System\ETwqCOd.exe
  2⤵
  PID:5608
- C:\Windows\System\HpetjQI.exe
  C:\Windows\System\HpetjQI.exe
  2⤵
  PID:5648
- C:\Windows\System\wtCBhal.exe
  C:\Windows\System\wtCBhal.exe
  2⤵
  PID:5668
- C:\Windows\System\zekAlTq.exe
  C:\Windows\System\zekAlTq.exe
  2⤵
  PID:5684
- C:\Windows\System\ZzNzqHr.exe
  C:\Windows\System\ZzNzqHr.exe
  2⤵
  PID:5704
- C:\Windows\System\uRAnpFO.exe
  C:\Windows\System\uRAnpFO.exe
  2⤵
  PID:5720
- C:\Windows\System\rvWQGjx.exe
  C:\Windows\System\rvWQGjx.exe
  2⤵
  PID:5740
- C:\Windows\System\wyTzdaY.exe
  C:\Windows\System\wyTzdaY.exe
  2⤵
  PID:5756
- C:\Windows\System\GoUxSPP.exe
  C:\Windows\System\GoUxSPP.exe
  2⤵
  PID:5772
- C:\Windows\System\FDebWwg.exe
  C:\Windows\System\FDebWwg.exe
  2⤵
  PID:5788
- C:\Windows\System\YvmSekM.exe
  C:\Windows\System\YvmSekM.exe
  2⤵
  PID:5804
- C:\Windows\System\OYWhmuX.exe
  C:\Windows\System\OYWhmuX.exe
  2⤵
  PID:5824
- C:\Windows\System\FOVXkzu.exe
  C:\Windows\System\FOVXkzu.exe
  2⤵
  PID:5840
- C:\Windows\System\ghAPUnF.exe
  C:\Windows\System\ghAPUnF.exe
  2⤵
  PID:5856
- C:\Windows\System\hKMOVIe.exe
  C:\Windows\System\hKMOVIe.exe
  2⤵
  PID:5872
- C:\Windows\System\CoPkfvU.exe
  C:\Windows\System\CoPkfvU.exe
  2⤵
  PID:5892
- C:\Windows\System\vHyjgBL.exe
  C:\Windows\System\vHyjgBL.exe
  2⤵
  PID:5908
- C:\Windows\System\BqeSfnL.exe
  C:\Windows\System\BqeSfnL.exe
  2⤵
  PID:5924
- C:\Windows\System\FkznRTF.exe
  C:\Windows\System\FkznRTF.exe
  2⤵
  PID:5940
- C:\Windows\System\ehuqOZf.exe
  C:\Windows\System\ehuqOZf.exe
  2⤵
  PID:5956
- C:\Windows\System\OxJEhoz.exe
  C:\Windows\System\OxJEhoz.exe
  2⤵
  PID:5972
- C:\Windows\System\NJqwdFT.exe
  C:\Windows\System\NJqwdFT.exe
  2⤵
  PID:5992
- C:\Windows\System\dkxyeNX.exe
  C:\Windows\System\dkxyeNX.exe
  2⤵
  PID:6016
- C:\Windows\System\dAUFTFi.exe
  C:\Windows\System\dAUFTFi.exe
  2⤵
  PID:6032
- C:\Windows\System\rOznEYb.exe
  C:\Windows\System\rOznEYb.exe
  2⤵
  PID:6048
- C:\Windows\System\tWZGGZz.exe
  C:\Windows\System\tWZGGZz.exe
  2⤵
  PID:6064
- C:\Windows\System\wDQGbaD.exe
  C:\Windows\System\wDQGbaD.exe
  2⤵
  PID:3124
- C:\Windows\System\BGLvoqj.exe
  C:\Windows\System\BGLvoqj.exe
  2⤵
  PID:5140
- C:\Windows\System\ScpAmBh.exe
  C:\Windows\System\ScpAmBh.exe
  2⤵
  PID:5208
- C:\Windows\System\PWpGBzY.exe
  C:\Windows\System\PWpGBzY.exe
  2⤵
  PID:5272
- C:\Windows\System\MBQbnBX.exe
  C:\Windows\System\MBQbnBX.exe
  2⤵
  PID:4244
- C:\Windows\System\msEVzJb.exe
  C:\Windows\System\msEVzJb.exe
  2⤵
  PID:1004
- C:\Windows\System\NSfsroD.exe
  C:\Windows\System\NSfsroD.exe
  2⤵
  PID:5344
- C:\Windows\System\lwwDctJ.exe
  C:\Windows\System\lwwDctJ.exe
  2⤵
  PID:5364
- C:\Windows\System\IIpReZs.exe
  C:\Windows\System\IIpReZs.exe
  2⤵
  PID:5380
- C:\Windows\System\lbyProJ.exe
  C:\Windows\System\lbyProJ.exe
  2⤵
  PID:5188
- C:\Windows\System\aOSmVmE.exe
  C:\Windows\System\aOSmVmE.exe
  2⤵
  PID:5396
- C:\Windows\System\mJGXyhv.exe
  C:\Windows\System\mJGXyhv.exe
  2⤵
  PID:5288
- C:\Windows\System\JmNwbnv.exe
  C:\Windows\System\JmNwbnv.exe
  2⤵
  PID:5152
- C:\Windows\System\yqBZtWI.exe
  C:\Windows\System\yqBZtWI.exe
  2⤵
  PID:5400
- C:\Windows\System\DlbdCdT.exe
  C:\Windows\System\DlbdCdT.exe
  2⤵
  PID:5424
- C:\Windows\System\yddLebw.exe
  C:\Windows\System\yddLebw.exe
  2⤵
  PID:5476
- C:\Windows\System\ZVEsJRJ.exe
  C:\Windows\System\ZVEsJRJ.exe
  2⤵
  PID:5576
- C:\Windows\System\iIruGTG.exe
  C:\Windows\System\iIruGTG.exe
  2⤵
  PID:5584
- C:\Windows\System\lmZELJZ.exe
  C:\Windows\System\lmZELJZ.exe
  2⤵
  PID:5488
- C:\Windows\System\FRgipXM.exe
  C:\Windows\System\FRgipXM.exe
  2⤵
  PID:5636
- C:\Windows\System\bHAODAd.exe
  C:\Windows\System\bHAODAd.exe
  2⤵
  PID:5680
- C:\Windows\System\PbvrQSc.exe
  C:\Windows\System\PbvrQSc.exe
  2⤵
  PID:5816
- C:\Windows\System\gyhPNzU.exe
  C:\Windows\System\gyhPNzU.exe
  2⤵
  PID:5604
- C:\Windows\System\RnkwwoM.exe
  C:\Windows\System\RnkwwoM.exe
  2⤵
  PID:5880
- C:\Windows\System\PfCNGID.exe
  C:\Windows\System\PfCNGID.exe
  2⤵
  PID:5748
- C:\Windows\System\pGqmAsp.exe
  C:\Windows\System\pGqmAsp.exe
  2⤵
  PID:5952
- C:\Windows\System\fqgrino.exe
  C:\Windows\System\fqgrino.exe
  2⤵
  PID:5428
- C:\Windows\System\xSbpYfE.exe
  C:\Windows\System\xSbpYfE.exe
  2⤵
  PID:6000
- C:\Windows\System\BLhLlUi.exe
  C:\Windows\System\BLhLlUi.exe
  2⤵
  PID:5904
- C:\Windows\System\GqNYeqC.exe
  C:\Windows\System\GqNYeqC.exe
  2⤵
  PID:5836
- C:\Windows\System\IrXjUIK.exe
  C:\Windows\System\IrXjUIK.exe
  2⤵
  PID:5700
- C:\Windows\System\enZxSaI.exe
  C:\Windows\System\enZxSaI.exe
  2⤵
  PID:5728
- C:\Windows\System\NeRMZTB.exe
  C:\Windows\System\NeRMZTB.exe
  2⤵
  PID:6056
- C:\Windows\System\FDhujSQ.exe
  C:\Windows\System\FDhujSQ.exe
  2⤵
  PID:6040
- C:\Windows\System\DOdbTQi.exe
  C:\Windows\System\DOdbTQi.exe
  2⤵
  PID:6080
- C:\Windows\System\NHXeOGj.exe
  C:\Windows\System\NHXeOGj.exe
  2⤵
  PID:6096
- C:\Windows\System\XKdXsrs.exe
  C:\Windows\System\XKdXsrs.exe
  2⤵
  PID:6116
- C:\Windows\System\ctAfwUQ.exe
  C:\Windows\System\ctAfwUQ.exe
  2⤵
  PID:6132
- C:\Windows\System\bQIusyj.exe
  C:\Windows\System\bQIusyj.exe
  2⤵
  PID:5268
- C:\Windows\System\PHAaaal.exe
  C:\Windows\System\PHAaaal.exe
  2⤵
  PID:5356
- C:\Windows\System\XmosjHy.exe
  C:\Windows\System\XmosjHy.exe
  2⤵
  PID:5320
- C:\Windows\System\bmDBsfw.exe
  C:\Windows\System\bmDBsfw.exe
  2⤵
  PID:1664
- C:\Windows\System\biUXSqC.exe
  C:\Windows\System\biUXSqC.exe
  2⤵
  PID:5600
- C:\Windows\System\pzsaQOr.exe
  C:\Windows\System\pzsaQOr.exe
  2⤵
  PID:5812
- C:\Windows\System\oorlTEP.exe
  C:\Windows\System\oorlTEP.exe
  2⤵
  PID:5820
- C:\Windows\System\RQAAVmr.exe
  C:\Windows\System\RQAAVmr.exe
  2⤵
  PID:5352
- C:\Windows\System\RGKmeHe.exe
  C:\Windows\System\RGKmeHe.exe
  2⤵
  PID:5156
- C:\Windows\System\ubqOQHg.exe
  C:\Windows\System\ubqOQHg.exe
  2⤵
  PID:5512
- C:\Windows\System\zxNWLEM.exe
  C:\Windows\System\zxNWLEM.exe
  2⤵
  PID:5560
- C:\Windows\System\lBGFvOs.exe
  C:\Windows\System\lBGFvOs.exe
  2⤵
  PID:5620
- C:\Windows\System\qTDBxqJ.exe
  C:\Windows\System\qTDBxqJ.exe
  2⤵
  PID:5888
- C:\Windows\System\RPMxEWv.exe
  C:\Windows\System\RPMxEWv.exe
  2⤵
  PID:5656
- C:\Windows\System\VjNWyXI.exe
  C:\Windows\System\VjNWyXI.exe
  2⤵
  PID:5524
- C:\Windows\System\kcuMYkq.exe
  C:\Windows\System\kcuMYkq.exe
  2⤵
  PID:5868
- C:\Windows\System\MPROCaU.exe
  C:\Windows\System\MPROCaU.exe
  2⤵
  PID:1500
- C:\Windows\System\RltdEvE.exe
  C:\Windows\System\RltdEvE.exe
  2⤵
  PID:6112
- C:\Windows\System\pSPQGjl.exe
  C:\Windows\System\pSPQGjl.exe
  2⤵
  PID:5204
- C:\Windows\System\lPZeNzx.exe
  C:\Windows\System\lPZeNzx.exe
  2⤵
  PID:5224
- C:\Windows\System\OBHTElz.exe
  C:\Windows\System\OBHTElz.exe
  2⤵
  PID:5172
- C:\Windows\System\wmbqplb.exe
  C:\Windows\System\wmbqplb.exe
  2⤵
  PID:5508
- C:\Windows\System\YvNLBEx.exe
  C:\Windows\System\YvNLBEx.exe
  2⤵
  PID:5692
- C:\Windows\System\LcVFnUG.exe
  C:\Windows\System\LcVFnUG.exe
  2⤵
  PID:5732
- C:\Windows\System\EKRihTl.exe
  C:\Windows\System\EKRihTl.exe
  2⤵
  PID:6072
- C:\Windows\System\esEYnag.exe
  C:\Windows\System\esEYnag.exe
  2⤵
  PID:3644
- C:\Windows\System\KBkoOUT.exe
  C:\Windows\System\KBkoOUT.exe
  2⤵
  PID:5240
- C:\Windows\System\NkKtAOS.exe
  C:\Windows\System\NkKtAOS.exe
  2⤵
  PID:5664
- C:\Windows\System\gDfKcQr.exe
  C:\Windows\System\gDfKcQr.exe
  2⤵
  PID:5580
- C:\Windows\System\YQsEDqv.exe
  C:\Windows\System\YQsEDqv.exe
  2⤵
  PID:6092
- C:\Windows\System\bvKFRqk.exe
  C:\Windows\System\bvKFRqk.exe
  2⤵
  PID:5752
- C:\Windows\System\wpFzOjp.exe
  C:\Windows\System\wpFzOjp.exe
  2⤵
  PID:5220
- C:\Windows\System\BVHWPwQ.exe
  C:\Windows\System\BVHWPwQ.exe
  2⤵
  PID:5964
- C:\Windows\System\nZQdtXs.exe
  C:\Windows\System\nZQdtXs.exe
  2⤵
  PID:4844
- C:\Windows\System\fnnjVEP.exe
  C:\Windows\System\fnnjVEP.exe
  2⤵
  PID:5984
- C:\Windows\System\UHEPWWP.exe
  C:\Windows\System\UHEPWWP.exe
  2⤵
  PID:6148
- C:\Windows\System\sSledHw.exe
  C:\Windows\System\sSledHw.exe
  2⤵
  PID:6164
- C:\Windows\System\CWqbzVR.exe
  C:\Windows\System\CWqbzVR.exe
  2⤵
  PID:6184
- C:\Windows\System\nhcqagP.exe
  C:\Windows\System\nhcqagP.exe
  2⤵
  PID:6200
- C:\Windows\System\aFHOeho.exe
  C:\Windows\System\aFHOeho.exe
  2⤵
  PID:6216
- C:\Windows\System\gHgdWTC.exe
  C:\Windows\System\gHgdWTC.exe
  2⤵
  PID:6232
- C:\Windows\System\qmhaxMU.exe
  C:\Windows\System\qmhaxMU.exe
  2⤵
  PID:6248
- C:\Windows\System\JrsCgBI.exe
  C:\Windows\System\JrsCgBI.exe
  2⤵
  PID:6264
- C:\Windows\System\CLJcECB.exe
  C:\Windows\System\CLJcECB.exe
  2⤵
  PID:6280
- C:\Windows\System\bmhNjwr.exe
  C:\Windows\System\bmhNjwr.exe
  2⤵
  PID:6296
- C:\Windows\System\wInLEYq.exe
  C:\Windows\System\wInLEYq.exe
  2⤵
  PID:6312
- C:\Windows\System\OxYNoRP.exe
  C:\Windows\System\OxYNoRP.exe
  2⤵
  PID:6328
- C:\Windows\System\euMMXHp.exe
  C:\Windows\System\euMMXHp.exe
  2⤵
  PID:6344
- C:\Windows\System\elVOgQX.exe
  C:\Windows\System\elVOgQX.exe
  2⤵
  PID:6360
- C:\Windows\System\WtykXkl.exe
  C:\Windows\System\WtykXkl.exe
  2⤵
  PID:6376
- C:\Windows\System\XTjGQmP.exe
  C:\Windows\System\XTjGQmP.exe
  2⤵
  PID:6392
- C:\Windows\System\yEIYLDa.exe
  C:\Windows\System\yEIYLDa.exe
  2⤵
  PID:6408
- C:\Windows\System\eYLuyvh.exe
  C:\Windows\System\eYLuyvh.exe
  2⤵
  PID:6428
- C:\Windows\System\cBeQCSK.exe
  C:\Windows\System\cBeQCSK.exe
  2⤵
  PID:6444
- C:\Windows\System\aUhoanW.exe
  C:\Windows\System\aUhoanW.exe
  2⤵
  PID:6460
- C:\Windows\System\jfyQeTz.exe
  C:\Windows\System\jfyQeTz.exe
  2⤵
  PID:6476
- C:\Windows\System\YndFoQQ.exe
  C:\Windows\System\YndFoQQ.exe
  2⤵
  PID:6496
- C:\Windows\System\HGXLIZf.exe
  C:\Windows\System\HGXLIZf.exe
  2⤵
  PID:6512
- C:\Windows\System\GEQgPpY.exe
  C:\Windows\System\GEQgPpY.exe
  2⤵
  PID:6528
- C:\Windows\System\NHatBZZ.exe
  C:\Windows\System\NHatBZZ.exe
  2⤵
  PID:6544
- C:\Windows\System\bkuXPDz.exe
  C:\Windows\System\bkuXPDz.exe
  2⤵
  PID:6564
- C:\Windows\System\Rhhroaa.exe
  C:\Windows\System\Rhhroaa.exe
  2⤵
  PID:6580
- C:\Windows\System\wpSAOhN.exe
  C:\Windows\System\wpSAOhN.exe
  2⤵
  PID:6596
- C:\Windows\System\jlXTVSh.exe
  C:\Windows\System\jlXTVSh.exe
  2⤵
  PID:6616
- C:\Windows\System\YJZlhRu.exe
  C:\Windows\System\YJZlhRu.exe
  2⤵
  PID:6632
- C:\Windows\System\qbletto.exe
  C:\Windows\System\qbletto.exe
  2⤵
  PID:6648
- C:\Windows\System\FqZOqku.exe
  C:\Windows\System\FqZOqku.exe
  2⤵
  PID:6664
- C:\Windows\System\pXjRebf.exe
  C:\Windows\System\pXjRebf.exe
  2⤵
  PID:6684
- C:\Windows\System\NYQfvav.exe
  C:\Windows\System\NYQfvav.exe
  2⤵
  PID:6700
- C:\Windows\System\uLZfqiH.exe
  C:\Windows\System\uLZfqiH.exe
  2⤵
  PID:6716
- C:\Windows\System\COrHIHJ.exe
  C:\Windows\System\COrHIHJ.exe
  2⤵
  PID:6732
- C:\Windows\System\lFiALjI.exe
  C:\Windows\System\lFiALjI.exe
  2⤵
  PID:6892
- C:\Windows\System\tRiFyHI.exe
  C:\Windows\System\tRiFyHI.exe
  2⤵
  PID:6908
- C:\Windows\System\JCmMgSe.exe
  C:\Windows\System\JCmMgSe.exe
  2⤵
  PID:6924
- C:\Windows\System\ZSfhQle.exe
  C:\Windows\System\ZSfhQle.exe
  2⤵
  PID:6940
- C:\Windows\System\FPwULgd.exe
  C:\Windows\System\FPwULgd.exe
  2⤵
  PID:6956
- C:\Windows\System\peiLQtj.exe
  C:\Windows\System\peiLQtj.exe
  2⤵
  PID:6972
- C:\Windows\System\HyKIast.exe
  C:\Windows\System\HyKIast.exe
  2⤵
  PID:6988
- C:\Windows\System\rZYTqVS.exe
  C:\Windows\System\rZYTqVS.exe
  2⤵
  PID:7004
- C:\Windows\System\lfJohBt.exe
  C:\Windows\System\lfJohBt.exe
  2⤵
  PID:7020
- C:\Windows\System\WYyyzCl.exe
  C:\Windows\System\WYyyzCl.exe
  2⤵
  PID:7036
- C:\Windows\System\IeRueLH.exe
  C:\Windows\System\IeRueLH.exe
  2⤵
  PID:7052
- C:\Windows\System\AQAxwGm.exe
  C:\Windows\System\AQAxwGm.exe
  2⤵
  PID:7072
- C:\Windows\System\xVToMYi.exe
  C:\Windows\System\xVToMYi.exe
  2⤵
  PID:7092
- C:\Windows\System\YheGsLp.exe
  C:\Windows\System\YheGsLp.exe
  2⤵
  PID:7108
- C:\Windows\System\YTiOFHH.exe
  C:\Windows\System\YTiOFHH.exe
  2⤵
  PID:7124
- C:\Windows\System\VHmkQjT.exe
  C:\Windows\System\VHmkQjT.exe
  2⤵
  PID:7140
- C:\Windows\System\YaBtEvh.exe
  C:\Windows\System\YaBtEvh.exe
  2⤵
  PID:7156
- C:\Windows\System\GOqYWsv.exe
  C:\Windows\System\GOqYWsv.exe
  2⤵
  PID:6140
- C:\Windows\System\yciSaTI.exe
  C:\Windows\System\yciSaTI.exe
  2⤵
  PID:6208
- C:\Windows\System\YHMZCGh.exe
  C:\Windows\System\YHMZCGh.exe
  2⤵
  PID:6272
- C:\Windows\System\iNkBsdu.exe
  C:\Windows\System\iNkBsdu.exe
  2⤵
  PID:6336
- C:\Windows\System\GVWYumH.exe
  C:\Windows\System\GVWYumH.exe
  2⤵
  PID:6400
- C:\Windows\System\jGlfcTK.exe
  C:\Windows\System\jGlfcTK.exe
  2⤵
  PID:6468
- C:\Windows\System\fWFNuSp.exe
  C:\Windows\System\fWFNuSp.exe
  2⤵
  PID:5764
- C:\Windows\System\lFSEexp.exe
  C:\Windows\System\lFSEexp.exe
  2⤵
  PID:6256
- C:\Windows\System\yYZJCbu.exe
  C:\Windows\System\yYZJCbu.exe
  2⤵
  PID:6452
- C:\Windows\System\XJczHee.exe
  C:\Windows\System\XJczHee.exe
  2⤵
  PID:5412
- C:\Windows\System\lkkEcsw.exe
  C:\Windows\System\lkkEcsw.exe
  2⤵
  PID:6520
- C:\Windows\System\YhwRwmC.exe
  C:\Windows\System\YhwRwmC.exe
  2⤵
  PID:6088
- C:\Windows\System\dtlyHuS.exe
  C:\Windows\System\dtlyHuS.exe
  2⤵
  PID:6224
- C:\Windows\System\goZFGZL.exe
  C:\Windows\System\goZFGZL.exe
  2⤵
  PID:6356
- C:\Windows\System\lhVxFKX.exe
  C:\Windows\System\lhVxFKX.exe
  2⤵
  PID:6196
- C:\Windows\System\KPoTUcO.exe
  C:\Windows\System\KPoTUcO.exe
  2⤵
  PID:6260
- C:\Windows\System\rnTqizV.exe
  C:\Windows\System\rnTqizV.exe
  2⤵
  PID:6292
- C:\Windows\System\NKMNRdr.exe
  C:\Windows\System\NKMNRdr.exe
  2⤵
  PID:5784
- C:\Windows\System\ZrFHgrZ.exe
  C:\Windows\System\ZrFHgrZ.exe
  2⤵
  PID:6676
- C:\Windows\System\CPEDmjo.exe
  C:\Windows\System\CPEDmjo.exe
  2⤵
  PID:6708
- C:\Windows\System\EsCpIEA.exe
  C:\Windows\System\EsCpIEA.exe
  2⤵
  PID:6588
- C:\Windows\System\VPcgmLM.exe
  C:\Windows\System\VPcgmLM.exe
  2⤵
  PID:6420
- C:\Windows\System\nDaNzMR.exe
  C:\Windows\System\nDaNzMR.exe
  2⤵
  PID:6660
- C:\Windows\System\lEWijRo.exe
  C:\Windows\System\lEWijRo.exe
  2⤵
  PID:6728
- C:\Windows\System\AFjXDjS.exe
  C:\Windows\System\AFjXDjS.exe
  2⤵
  PID:6756
- C:\Windows\System\iRMswon.exe
  C:\Windows\System\iRMswon.exe
  2⤵
  PID:6772
- C:\Windows\System\BlLmrgd.exe
  C:\Windows\System\BlLmrgd.exe
  2⤵
  PID:6788
- C:\Windows\System\RmBJBBY.exe
  C:\Windows\System\RmBJBBY.exe
  2⤵
  PID:6804
- C:\Windows\System\YQpxbbs.exe
  C:\Windows\System\YQpxbbs.exe
  2⤵
  PID:6820
- C:\Windows\System\xcexLcd.exe
  C:\Windows\System\xcexLcd.exe
  2⤵
  PID:6836
- C:\Windows\System\fqwfvoO.exe
  C:\Windows\System\fqwfvoO.exe
  2⤵
  PID:6852
- C:\Windows\System\gaHvEMz.exe
  C:\Windows\System\gaHvEMz.exe
  2⤵
  PID:6868
- C:\Windows\System\UDMedqC.exe
  C:\Windows\System\UDMedqC.exe
  2⤵
  PID:6884
- C:\Windows\System\zkihENP.exe
  C:\Windows\System\zkihENP.exe
  2⤵
  PID:6980
- C:\Windows\System\dxinuLK.exe
  C:\Windows\System\dxinuLK.exe
  2⤵
  PID:7044
- C:\Windows\System\LvZeKUL.exe
  C:\Windows\System\LvZeKUL.exe
  2⤵
  PID:7116
- C:\Windows\System\XePfcCW.exe
  C:\Windows\System\XePfcCW.exe
  2⤵
  PID:6176
- C:\Windows\System\CIktxRd.exe
  C:\Windows\System\CIktxRd.exe
  2⤵
  PID:6436
- C:\Windows\System\mgFHKim.exe
  C:\Windows\System\mgFHKim.exe
  2⤵
  PID:6484
- C:\Windows\System\NAjqzRZ.exe
  C:\Windows\System\NAjqzRZ.exe
  2⤵
  PID:6352
- C:\Windows\System\pfEFZXG.exe
  C:\Windows\System\pfEFZXG.exe
  2⤵
  PID:6932
- C:\Windows\System\cevRWsQ.exe
  C:\Windows\System\cevRWsQ.exe
  2⤵
  PID:7000
- C:\Windows\System\XUHDCCA.exe
  C:\Windows\System\XUHDCCA.exe
  2⤵
  PID:7064
- C:\Windows\System\zxKpfMB.exe
  C:\Windows\System\zxKpfMB.exe
  2⤵
  PID:7104
- C:\Windows\System\tQMupKS.exe
  C:\Windows\System\tQMupKS.exe
  2⤵
  PID:6240
- C:\Windows\System\AbBxjxD.exe
  C:\Windows\System\AbBxjxD.exe
  2⤵
  PID:6372
- C:\Windows\System\csyHUxf.exe
  C:\Windows\System\csyHUxf.exe
  2⤵
  PID:6536
- C:\Windows\System\RYXRmgn.exe
  C:\Windows\System\RYXRmgn.exe
  2⤵
  PID:5532
- C:\Windows\System\ykERRBH.exe
  C:\Windows\System\ykERRBH.exe
  2⤵
  PID:6640
- C:\Windows\System\kbdbIqm.exe
  C:\Windows\System\kbdbIqm.exe
  2⤵
  PID:6752
- C:\Windows\System\mxhQXeG.exe
  C:\Windows\System\mxhQXeG.exe
  2⤵
  PID:6680
- C:\Windows\System\qpFQltm.exe
  C:\Windows\System\qpFQltm.exe
  2⤵
  PID:6696
- C:\Windows\System\cIltzmu.exe
  C:\Windows\System\cIltzmu.exe
  2⤵
  PID:6008
- C:\Windows\System\mCrIYIj.exe
  C:\Windows\System\mCrIYIj.exe
  2⤵
  PID:6948
- C:\Windows\System\SLVTOiQ.exe
  C:\Windows\System\SLVTOiQ.exe
  2⤵
  PID:6304
- C:\Windows\System\dslfErb.exe
  C:\Windows\System\dslfErb.exe
  2⤵
  PID:6780
- C:\Windows\System\JGRLbNy.exe
  C:\Windows\System\JGRLbNy.exe
  2⤵
  PID:6848
- C:\Windows\System\GGxwJPR.exe
  C:\Windows\System\GGxwJPR.exe
  2⤵
  PID:7152
- C:\Windows\System\aMJSATN.exe
  C:\Windows\System\aMJSATN.exe
  2⤵
  PID:5632
- C:\Windows\System\aXOneHw.exe
  C:\Windows\System\aXOneHw.exe
  2⤵
  PID:6964
- C:\Windows\System\aLhEFua.exe
  C:\Windows\System\aLhEFua.exe
  2⤵
  PID:6104
- C:\Windows\System\ZtUIkcb.exe
  C:\Windows\System\ZtUIkcb.exe
  2⤵
  PID:7100
- C:\Windows\System\fnuwSjB.exe
  C:\Windows\System\fnuwSjB.exe
  2⤵
  PID:6044
- C:\Windows\System\MfaIarF.exe
  C:\Windows\System\MfaIarF.exe
  2⤵
  PID:4076
- C:\Windows\System\KLcPpft.exe
  C:\Windows\System\KLcPpft.exe
  2⤵
  PID:6488
- C:\Windows\System\OTxDuZZ.exe
  C:\Windows\System\OTxDuZZ.exe
  2⤵
  PID:6656
- C:\Windows\System\VrpSjAG.exe
  C:\Windows\System\VrpSjAG.exe
  2⤵
  PID:6552
- C:\Windows\System\cUkzKqN.exe
  C:\Windows\System\cUkzKqN.exe
  2⤵
  PID:6916
- C:\Windows\System\uONSKaV.exe
  C:\Windows\System\uONSKaV.exe
  2⤵
  PID:6004
- C:\Windows\System\KRAstny.exe
  C:\Windows\System\KRAstny.exe
  2⤵
  PID:7028
- C:\Windows\System\giTiOMm.exe
  C:\Windows\System\giTiOMm.exe
  2⤵
  PID:7068
- C:\Windows\System\MjUxToE.exe
  C:\Windows\System\MjUxToE.exe
  2⤵
  PID:6828
- C:\Windows\System\wwiyLQX.exe
  C:\Windows\System\wwiyLQX.exe
  2⤵
  PID:6816
- C:\Windows\System\LEUUyiu.exe
  C:\Windows\System\LEUUyiu.exe
  2⤵
  PID:6612
- C:\Windows\System\SzWWNwn.exe
  C:\Windows\System\SzWWNwn.exe
  2⤵
  PID:6832
- C:\Windows\System\eeilhhg.exe
  C:\Windows\System\eeilhhg.exe
  2⤵
  PID:6744
- C:\Windows\System\lDplpAW.exe
  C:\Windows\System\lDplpAW.exe
  2⤵
  PID:6416
- C:\Windows\System\yqekVSK.exe
  C:\Windows\System\yqekVSK.exe
  2⤵
  PID:6368
- C:\Windows\System\MygSHwz.exe
  C:\Windows\System\MygSHwz.exe
  2⤵
  PID:6920
- C:\Windows\System\NkanPsO.exe
  C:\Windows\System\NkanPsO.exe
  2⤵
  PID:7088
- C:\Windows\System\GicmAqI.exe
  C:\Windows\System\GicmAqI.exe
  2⤵
  PID:6812
- C:\Windows\System\fwYfGvo.exe
  C:\Windows\System\fwYfGvo.exe
  2⤵
  PID:6320
- C:\Windows\System\LBdICwk.exe
  C:\Windows\System\LBdICwk.exe
  2⤵
  PID:6844
- C:\Windows\System\UcygqgP.exe
  C:\Windows\System\UcygqgP.exe
  2⤵
  PID:7176
- C:\Windows\System\xpLAuZm.exe
  C:\Windows\System\xpLAuZm.exe
  2⤵
  PID:7192
- C:\Windows\System\zjvUnRW.exe
  C:\Windows\System\zjvUnRW.exe
  2⤵
  PID:7208
- C:\Windows\System\AGqvmmn.exe
  C:\Windows\System\AGqvmmn.exe
  2⤵
  PID:7224
- C:\Windows\System\uVvGMXh.exe
  C:\Windows\System\uVvGMXh.exe
  2⤵
  PID:7240
- C:\Windows\System\bRvVQwx.exe
  C:\Windows\System\bRvVQwx.exe
  2⤵
  PID:7256
- C:\Windows\System\CkWntlg.exe
  C:\Windows\System\CkWntlg.exe
  2⤵
  PID:7272
- C:\Windows\System\znMfHnC.exe
  C:\Windows\System\znMfHnC.exe
  2⤵
  PID:7288
- C:\Windows\System\oNvPXmV.exe
  C:\Windows\System\oNvPXmV.exe
  2⤵
  PID:7304
- C:\Windows\System\tAUPxwy.exe
  C:\Windows\System\tAUPxwy.exe
  2⤵
  PID:7320
- C:\Windows\System\ORYbjgf.exe
  C:\Windows\System\ORYbjgf.exe
  2⤵
  PID:7336
- C:\Windows\System\GxtvOAq.exe
  C:\Windows\System\GxtvOAq.exe
  2⤵
  PID:7352
- C:\Windows\System\MULeqqw.exe
  C:\Windows\System\MULeqqw.exe
  2⤵
  PID:7368
- C:\Windows\System\WoGfUrQ.exe
  C:\Windows\System\WoGfUrQ.exe
  2⤵
  PID:7384
- C:\Windows\System\aQFGcNa.exe
  C:\Windows\System\aQFGcNa.exe
  2⤵
  PID:7400
- C:\Windows\System\TUAOWap.exe
  C:\Windows\System\TUAOWap.exe
  2⤵
  PID:7416
- C:\Windows\System\mUOUisU.exe
  C:\Windows\System\mUOUisU.exe
  2⤵
  PID:7432
- C:\Windows\System\FxMGSWb.exe
  C:\Windows\System\FxMGSWb.exe
  2⤵
  PID:7448
- C:\Windows\System\QXeVdeI.exe
  C:\Windows\System\QXeVdeI.exe
  2⤵
  PID:7464
- C:\Windows\System\iwdfCmU.exe
  C:\Windows\System\iwdfCmU.exe
  2⤵
  PID:7480
- C:\Windows\System\rlqhHMS.exe
  C:\Windows\System\rlqhHMS.exe
  2⤵
  PID:7496
- C:\Windows\System\kdqvMwh.exe
  C:\Windows\System\kdqvMwh.exe
  2⤵
  PID:7512
- C:\Windows\System\RcNcEEY.exe
  C:\Windows\System\RcNcEEY.exe
  2⤵
  PID:7528
- C:\Windows\System\zlZcsRg.exe
  C:\Windows\System\zlZcsRg.exe
  2⤵
  PID:7544
- C:\Windows\System\zbbgspA.exe
  C:\Windows\System\zbbgspA.exe
  2⤵
  PID:7560
- C:\Windows\System\RfHlwMn.exe
  C:\Windows\System\RfHlwMn.exe
  2⤵
  PID:7576
- C:\Windows\System\rnzFrOM.exe
  C:\Windows\System\rnzFrOM.exe
  2⤵
  PID:7592
- C:\Windows\System\sTKhECB.exe
  C:\Windows\System\sTKhECB.exe
  2⤵
  PID:7608
- C:\Windows\System\TutpRHM.exe
  C:\Windows\System\TutpRHM.exe
  2⤵
  PID:7624
- C:\Windows\System\gVAgHxu.exe
  C:\Windows\System\gVAgHxu.exe
  2⤵
  PID:7640
- C:\Windows\System\ejlRCSE.exe
  C:\Windows\System\ejlRCSE.exe
  2⤵
  PID:7656
- C:\Windows\System\izoXQpE.exe
  C:\Windows\System\izoXQpE.exe
  2⤵
  PID:7672
- C:\Windows\System\QobyXsc.exe
  C:\Windows\System\QobyXsc.exe
  2⤵
  PID:7688
- C:\Windows\System\SscuXTQ.exe
  C:\Windows\System\SscuXTQ.exe
  2⤵
  PID:7704
- C:\Windows\System\DGJrpTh.exe
  C:\Windows\System\DGJrpTh.exe
  2⤵
  PID:7720
- C:\Windows\System\pyMTApD.exe
  C:\Windows\System\pyMTApD.exe
  2⤵
  PID:7736
- C:\Windows\System\UUddjpH.exe
  C:\Windows\System\UUddjpH.exe
  2⤵
  PID:7752
- C:\Windows\System\NNmSiyo.exe
  C:\Windows\System\NNmSiyo.exe
  2⤵
  PID:7772
- C:\Windows\System\nQdBlxc.exe
  C:\Windows\System\nQdBlxc.exe
  2⤵
  PID:7788
- C:\Windows\System\UGCuAYf.exe
  C:\Windows\System\UGCuAYf.exe
  2⤵
  PID:7804
- C:\Windows\System\UzAcEZR.exe
  C:\Windows\System\UzAcEZR.exe
  2⤵
  PID:7820
- C:\Windows\System\abjeENV.exe
  C:\Windows\System\abjeENV.exe
  2⤵
  PID:7836
- C:\Windows\System\kcHDKcw.exe
  C:\Windows\System\kcHDKcw.exe
  2⤵
  PID:7852
- C:\Windows\System\LcYNHzH.exe
  C:\Windows\System\LcYNHzH.exe
  2⤵
  PID:7868
- C:\Windows\System\HrjzBzo.exe
  C:\Windows\System\HrjzBzo.exe
  2⤵
  PID:7884
- C:\Windows\System\ecFnElD.exe
  C:\Windows\System\ecFnElD.exe
  2⤵
  PID:7900
- C:\Windows\System\RUYofoh.exe
  C:\Windows\System\RUYofoh.exe
  2⤵
  PID:7920
- C:\Windows\System\RxdjZIV.exe
  C:\Windows\System\RxdjZIV.exe
  2⤵
  PID:7940
- C:\Windows\System\IruOcGY.exe
  C:\Windows\System\IruOcGY.exe
  2⤵
  PID:7956
- C:\Windows\System\SNQnTud.exe
  C:\Windows\System\SNQnTud.exe
  2⤵
  PID:7972
- C:\Windows\System\LVgLAud.exe
  C:\Windows\System\LVgLAud.exe
  2⤵
  PID:7988
- C:\Windows\System\GqPZVFr.exe
  C:\Windows\System\GqPZVFr.exe
  2⤵
  PID:8004
- C:\Windows\System\HfiJowk.exe
  C:\Windows\System\HfiJowk.exe
  2⤵
  PID:8020
- C:\Windows\System\MdZoUPc.exe
  C:\Windows\System\MdZoUPc.exe
  2⤵
  PID:8036
- C:\Windows\System\OBQlXHs.exe
  C:\Windows\System\OBQlXHs.exe
  2⤵
  PID:8052
- C:\Windows\System\CyUuTNI.exe
  C:\Windows\System\CyUuTNI.exe
  2⤵
  PID:8068
- C:\Windows\System\oBaagfb.exe
  C:\Windows\System\oBaagfb.exe
  2⤵
  PID:8084
- C:\Windows\System\xXYUNgA.exe
  C:\Windows\System\xXYUNgA.exe
  2⤵
  PID:8100
- C:\Windows\System\aBVQLCV.exe
  C:\Windows\System\aBVQLCV.exe
  2⤵
  PID:8116
- C:\Windows\System\JTGNMsD.exe
  C:\Windows\System\JTGNMsD.exe
  2⤵
  PID:8132
- C:\Windows\System\nvQiQAA.exe
  C:\Windows\System\nvQiQAA.exe
  2⤵
  PID:8148
- C:\Windows\System\vvvzWwv.exe
  C:\Windows\System\vvvzWwv.exe
  2⤵
  PID:8164
- C:\Windows\System\tSMkYWP.exe
  C:\Windows\System\tSMkYWP.exe
  2⤵
  PID:8180
- C:\Windows\System\VzONlrt.exe
  C:\Windows\System\VzONlrt.exe
  2⤵
  PID:6228
- C:\Windows\System\zZdPeib.exe
  C:\Windows\System\zZdPeib.exe
  2⤵
  PID:7232
- C:\Windows\System\ABEfJyD.exe
  C:\Windows\System\ABEfJyD.exe
  2⤵
  PID:7188
- C:\Windows\System\SwdBsJY.exe
  C:\Windows\System\SwdBsJY.exe
  2⤵
  PID:7220
- C:\Windows\System\alcnkvO.exe
  C:\Windows\System\alcnkvO.exe
  2⤵
  PID:7296
- C:\Windows\System\jkpzeuQ.exe
  C:\Windows\System\jkpzeuQ.exe
  2⤵
  PID:7360
- C:\Windows\System\wudxxxZ.exe
  C:\Windows\System\wudxxxZ.exe
  2⤵
  PID:7424
- C:\Windows\System\AesGIHO.exe
  C:\Windows\System\AesGIHO.exe
  2⤵
  PID:7492
- C:\Windows\System\cPlyAih.exe
  C:\Windows\System\cPlyAih.exe
  2⤵
  PID:7552
- C:\Windows\System\dBkuUNb.exe
  C:\Windows\System\dBkuUNb.exe
  2⤵
  PID:7588
- C:\Windows\System\xlfpjWm.exe
  C:\Windows\System\xlfpjWm.exe
  2⤵
  PID:7440
- C:\Windows\System\xuFHrnu.exe
  C:\Windows\System\xuFHrnu.exe
  2⤵
  PID:7280
- C:\Windows\System\ugnFdPW.exe
  C:\Windows\System\ugnFdPW.exe
  2⤵
  PID:7472
- C:\Windows\System\XlgBuBA.exe
  C:\Windows\System\XlgBuBA.exe
  2⤵
  PID:7284
- C:\Windows\System\dqFnKau.exe
  C:\Windows\System\dqFnKau.exe
  2⤵
  PID:7380
- C:\Windows\System\tzkehOG.exe
  C:\Windows\System\tzkehOG.exe
  2⤵
  PID:7476
- C:\Windows\System\FGDRSWv.exe
  C:\Windows\System\FGDRSWv.exe
  2⤵
  PID:7536
- C:\Windows\System\CFNcNsN.exe
  C:\Windows\System\CFNcNsN.exe
  2⤵
  PID:7604
- C:\Windows\System\qcNlhiO.exe
  C:\Windows\System\qcNlhiO.exe
  2⤵
  PID:7780
- C:\Windows\System\vbSTYWY.exe
  C:\Windows\System\vbSTYWY.exe
  2⤵
  PID:7696
- C:\Windows\System\zhMNcNt.exe
  C:\Windows\System\zhMNcNt.exe
  2⤵
  PID:7816
- C:\Windows\System\PRqvPYO.exe
  C:\Windows\System\PRqvPYO.exe
  2⤵
  PID:7796
- C:\Windows\System\wYqmbfM.exe
  C:\Windows\System\wYqmbfM.exe
  2⤵
  PID:7880
- C:\Windows\System\FBsHLVF.exe
  C:\Windows\System\FBsHLVF.exe
  2⤵
  PID:7916
- C:\Windows\System\fhDJONC.exe
  C:\Windows\System\fhDJONC.exe
  2⤵
  PID:7864
- C:\Windows\System\UJOgzvW.exe
  C:\Windows\System\UJOgzvW.exe
  2⤵
  PID:7936
- C:\Windows\System\Uszggle.exe
  C:\Windows\System\Uszggle.exe
  2⤵
  PID:7984
- C:\Windows\System\zsniPBM.exe
  C:\Windows\System\zsniPBM.exe
  2⤵
  PID:8048
- C:\Windows\System\hiclCSv.exe
  C:\Windows\System\hiclCSv.exe
  2⤵
  PID:8140
- C:\Windows\System\prnQaNP.exe
  C:\Windows\System\prnQaNP.exe
  2⤵
  PID:8172
- C:\Windows\System\XxGzEgS.exe
  C:\Windows\System\XxGzEgS.exe
  2⤵
  PID:7236
- C:\Windows\System\PFRWBfQ.exe
  C:\Windows\System\PFRWBfQ.exe
  2⤵
  PID:8060
- C:\Windows\System\psfKBzw.exe
  C:\Windows\System\psfKBzw.exe
  2⤵
  PID:7584
- C:\Windows\System\jbYFRyh.exe
  C:\Windows\System\jbYFRyh.exe
  2⤵
  PID:7396
- C:\Windows\System\TjLnZoY.exe
  C:\Windows\System\TjLnZoY.exe
  2⤵
  PID:8028
- C:\Windows\System\UzODtRv.exe
  C:\Windows\System\UzODtRv.exe
  2⤵
  PID:7680
- C:\Windows\System\yuOaePR.exe
  C:\Windows\System\yuOaePR.exe
  2⤵
  PID:6628
- C:\Windows\System\bWMfwgK.exe
  C:\Windows\System\bWMfwgK.exe
  2⤵
  PID:7520
- C:\Windows\System\SExfRNl.exe
  C:\Windows\System\SExfRNl.exe
  2⤵
  PID:7748
- C:\Windows\System\fFqeCfa.exe
  C:\Windows\System\fFqeCfa.exe
  2⤵
  PID:7412
- C:\Windows\System\YbmxqVv.exe
  C:\Windows\System\YbmxqVv.exe
  2⤵
  PID:7784
- C:\Windows\System\jbzOwSD.exe
  C:\Windows\System\jbzOwSD.exe
  2⤵
  PID:7912
- C:\Windows\System\yGmsPll.exe
  C:\Windows\System\yGmsPll.exe
  2⤵
  PID:8016
- C:\Windows\System\XrBwPGd.exe
  C:\Windows\System\XrBwPGd.exe
  2⤵
  PID:7376
- C:\Windows\System\veAsLxh.exe
  C:\Windows\System\veAsLxh.exe
  2⤵
  PID:7728
- C:\Windows\System\qZgdZAU.exe
  C:\Windows\System\qZgdZAU.exe
  2⤵
  PID:7964
- C:\Windows\System\UKYhaqF.exe
  C:\Windows\System\UKYhaqF.exe
  2⤵
  PID:8112
- C:\Windows\System\GQrQhXO.exe
  C:\Windows\System\GQrQhXO.exe
  2⤵
  PID:8000
- C:\Windows\System\czCDFkR.exe
  C:\Windows\System\czCDFkR.exe
  2⤵
  PID:7760
- C:\Windows\System\InTHpNU.exe
  C:\Windows\System\InTHpNU.exe
  2⤵
  PID:7572
- C:\Windows\System\VHfApjr.exe
  C:\Windows\System\VHfApjr.exe
  2⤵
  PID:7932
- C:\Windows\System\hZsrrbU.exe
  C:\Windows\System\hZsrrbU.exe
  2⤵
  PID:7332
- C:\Windows\System\RzFyDNt.exe
  C:\Windows\System\RzFyDNt.exe
  2⤵
  PID:8108
- C:\Windows\System\OObiQEL.exe
  C:\Windows\System\OObiQEL.exe
  2⤵
  PID:7204
- C:\Windows\System\EKhUcCW.exe
  C:\Windows\System\EKhUcCW.exe
  2⤵
  PID:7312
- C:\Windows\System\QwsCcMp.exe
  C:\Windows\System\QwsCcMp.exe
  2⤵
  PID:7712
- C:\Windows\System\xWqDmTn.exe
  C:\Windows\System\xWqDmTn.exe
  2⤵
  PID:7860
- C:\Windows\System\bgYFEXq.exe
  C:\Windows\System\bgYFEXq.exe
  2⤵
  PID:7968
- C:\Windows\System\zuEuecA.exe
  C:\Windows\System\zuEuecA.exe
  2⤵
  PID:8188
- C:\Windows\System\itKKQND.exe
  C:\Windows\System\itKKQND.exe
  2⤵
  PID:7084
- C:\Windows\System\OwNRzDw.exe
  C:\Windows\System\OwNRzDw.exe
  2⤵
  PID:8128
- C:\Windows\System\gleCNZQ.exe
  C:\Windows\System\gleCNZQ.exe
  2⤵
  PID:7848
- C:\Windows\System\hMFduhC.exe
  C:\Windows\System\hMFduhC.exe
  2⤵
  PID:7832
- C:\Windows\System\xNUWUad.exe
  C:\Windows\System\xNUWUad.exe
  2⤵
  PID:8196
- C:\Windows\System\yaXNgmA.exe
  C:\Windows\System\yaXNgmA.exe
  2⤵
  PID:8212
- C:\Windows\System\abHHgoK.exe
  C:\Windows\System\abHHgoK.exe
  2⤵
  PID:8228
- C:\Windows\System\bgSyhIm.exe
  C:\Windows\System\bgSyhIm.exe
  2⤵
  PID:8244
- C:\Windows\System\exQkTMv.exe
  C:\Windows\System\exQkTMv.exe
  2⤵
  PID:8260
- C:\Windows\System\yZJMhWU.exe
  C:\Windows\System\yZJMhWU.exe
  2⤵
  PID:8280
- C:\Windows\System\rmDDhxp.exe
  C:\Windows\System\rmDDhxp.exe
  2⤵
  PID:8296
- C:\Windows\System\anxHFYQ.exe
  C:\Windows\System\anxHFYQ.exe
  2⤵
  PID:8316
- C:\Windows\System\aamBvNn.exe
  C:\Windows\System\aamBvNn.exe
  2⤵
  PID:8332
- C:\Windows\System\kxySiix.exe
  C:\Windows\System\kxySiix.exe
  2⤵
  PID:8348
- C:\Windows\System\XxnbsbF.exe
  C:\Windows\System\XxnbsbF.exe
  2⤵
  PID:8364
- C:\Windows\System\tmGqEos.exe
  C:\Windows\System\tmGqEos.exe
  2⤵
  PID:8380
- C:\Windows\System\BPfRFFh.exe
  C:\Windows\System\BPfRFFh.exe
  2⤵
  PID:8396
- C:\Windows\System\XcwxmAT.exe
  C:\Windows\System\XcwxmAT.exe
  2⤵
  PID:8412
- C:\Windows\System\VhiPusp.exe
  C:\Windows\System\VhiPusp.exe
  2⤵
  PID:8428
- C:\Windows\System\NgrYUgo.exe
  C:\Windows\System\NgrYUgo.exe
  2⤵
  PID:8444
- C:\Windows\System\CxfHoXZ.exe
  C:\Windows\System\CxfHoXZ.exe
  2⤵
  PID:8460
- C:\Windows\System\NTKjhCv.exe
  C:\Windows\System\NTKjhCv.exe
  2⤵
  PID:8476
- C:\Windows\System\nrqCgyX.exe
  C:\Windows\System\nrqCgyX.exe
  2⤵
  PID:8492
- C:\Windows\System\XBbYazg.exe
  C:\Windows\System\XBbYazg.exe
  2⤵
  PID:8508
- C:\Windows\System\srkyKVL.exe
  C:\Windows\System\srkyKVL.exe
  2⤵
  PID:8524
- C:\Windows\System\UiRlCVD.exe
  C:\Windows\System\UiRlCVD.exe
  2⤵
  PID:8540
- C:\Windows\System\vfadRMg.exe
  C:\Windows\System\vfadRMg.exe
  2⤵
  PID:8556
- C:\Windows\System\RDgLBcw.exe
  C:\Windows\System\RDgLBcw.exe
  2⤵
  PID:8572
- C:\Windows\System\hwyujWw.exe
  C:\Windows\System\hwyujWw.exe
  2⤵
  PID:8616
- C:\Windows\System\mTVNdZj.exe
  C:\Windows\System\mTVNdZj.exe
  2⤵
  PID:8636
- C:\Windows\System\ulwVSNp.exe
  C:\Windows\System\ulwVSNp.exe
  2⤵
  PID:8652
- C:\Windows\System\aEfCKwv.exe
  C:\Windows\System\aEfCKwv.exe
  2⤵
  PID:8668
- C:\Windows\System\waxZVLJ.exe
  C:\Windows\System\waxZVLJ.exe
  2⤵
  PID:8684
- C:\Windows\System\buhqMoh.exe
  C:\Windows\System\buhqMoh.exe
  2⤵
  PID:8700
- C:\Windows\System\iidLQBc.exe
  C:\Windows\System\iidLQBc.exe
  2⤵
  PID:8716
- C:\Windows\System\YHOlIGV.exe
  C:\Windows\System\YHOlIGV.exe
  2⤵
  PID:8732
- C:\Windows\System\fCxvpNq.exe
  C:\Windows\System\fCxvpNq.exe
  2⤵
  PID:8748
- C:\Windows\System\kfGMnzy.exe
  C:\Windows\System\kfGMnzy.exe
  2⤵
  PID:8764
- C:\Windows\System\EgbPtrD.exe
  C:\Windows\System\EgbPtrD.exe
  2⤵
  PID:8780
- C:\Windows\System\YZvYcei.exe
  C:\Windows\System\YZvYcei.exe
  2⤵
  PID:8796
- C:\Windows\System\ndEkgdW.exe
  C:\Windows\System\ndEkgdW.exe
  2⤵
  PID:8812
- C:\Windows\System\omFWGYE.exe
  C:\Windows\System\omFWGYE.exe
  2⤵
  PID:8828
- C:\Windows\System\oIEJeYu.exe
  C:\Windows\System\oIEJeYu.exe
  2⤵
  PID:8844
- C:\Windows\System\wEiZagj.exe
  C:\Windows\System\wEiZagj.exe
  2⤵
  PID:8860
- C:\Windows\System\ihyyglu.exe
  C:\Windows\System\ihyyglu.exe
  2⤵
  PID:8876
- C:\Windows\System\YXkoBHF.exe
  C:\Windows\System\YXkoBHF.exe
  2⤵
  PID:8892
- C:\Windows\System\DLlWHFF.exe
  C:\Windows\System\DLlWHFF.exe
  2⤵
  PID:8908
- C:\Windows\System\lUJxIWY.exe
  C:\Windows\System\lUJxIWY.exe
  2⤵
  PID:8924
- C:\Windows\System\ELESbXF.exe
  C:\Windows\System\ELESbXF.exe
  2⤵
  PID:8940
- C:\Windows\System\ggugKyb.exe
  C:\Windows\System\ggugKyb.exe
  2⤵
  PID:8956
- C:\Windows\System\jRtrWpD.exe
  C:\Windows\System\jRtrWpD.exe
  2⤵
  PID:8972
- C:\Windows\System\WAtRDdX.exe
  C:\Windows\System\WAtRDdX.exe
  2⤵
  PID:8988
- C:\Windows\System\HnCVwzC.exe
  C:\Windows\System\HnCVwzC.exe
  2⤵
  PID:9004
- C:\Windows\System\yPLjecQ.exe
  C:\Windows\System\yPLjecQ.exe
  2⤵
  PID:9036
- C:\Windows\System\irhtFSj.exe
  C:\Windows\System\irhtFSj.exe
  2⤵
  PID:9052
- C:\Windows\System\PjfwMEI.exe
  C:\Windows\System\PjfwMEI.exe
  2⤵
  PID:9072
- C:\Windows\System\UlRZVfY.exe
  C:\Windows\System\UlRZVfY.exe
  2⤵
  PID:9088
- C:\Windows\System\dxJwFHD.exe
  C:\Windows\System\dxJwFHD.exe
  2⤵
  PID:9104
- C:\Windows\System\nARloxE.exe
  C:\Windows\System\nARloxE.exe
  2⤵
  PID:9120
- C:\Windows\System\qcAmofP.exe
  C:\Windows\System\qcAmofP.exe
  2⤵
  PID:9136
- C:\Windows\System\RLVirFL.exe
  C:\Windows\System\RLVirFL.exe
  2⤵
  PID:9152
- C:\Windows\System\kWorqBd.exe
  C:\Windows\System\kWorqBd.exe
  2⤵
  PID:9168
- C:\Windows\System\gQhBCGp.exe
  C:\Windows\System\gQhBCGp.exe
  2⤵
  PID:9188
- C:\Windows\System\hcIVQxP.exe
  C:\Windows\System\hcIVQxP.exe
  2⤵
  PID:9212
- C:\Windows\System\YRBKrbe.exe
  C:\Windows\System\YRBKrbe.exe
  2⤵
  PID:8224
- C:\Windows\System\JXnbyQg.exe
  C:\Windows\System\JXnbyQg.exe
  2⤵
  PID:8328
- C:\Windows\System\xhItkTe.exe
  C:\Windows\System\xhItkTe.exe
  2⤵
  PID:8392
- C:\Windows\System\MWkyKoK.exe
  C:\Windows\System\MWkyKoK.exe
  2⤵
  PID:8456
- C:\Windows\System\hgQfgOU.exe
  C:\Windows\System\hgQfgOU.exe
  2⤵
  PID:8548
- C:\Windows\System\itrBdyq.exe
  C:\Windows\System\itrBdyq.exe
  2⤵
  PID:8592
- C:\Windows\System\PiPtuTO.exe
  C:\Windows\System\PiPtuTO.exe
  2⤵
  PID:8604
- C:\Windows\System\VZPcubn.exe
  C:\Windows\System\VZPcubn.exe
  2⤵
  PID:8608
- C:\Windows\System\zLaoiWB.exe
  C:\Windows\System\zLaoiWB.exe
  2⤵
  PID:8404
- C:\Windows\System\menXlcX.exe
  C:\Windows\System\menXlcX.exe
  2⤵
  PID:8304
- C:\Windows\System\enpfupk.exe
  C:\Windows\System\enpfupk.exe
  2⤵
  PID:8208
- C:\Windows\System\JJEiAhs.exe
  C:\Windows\System\JJEiAhs.exe
  2⤵
  PID:8308
- C:\Windows\System\fxRjgkq.exe
  C:\Windows\System\fxRjgkq.exe
  2⤵
  PID:8408
- C:\Windows\System\XOLliOI.exe
  C:\Windows\System\XOLliOI.exe
  2⤵
  PID:8532
- C:\Windows\System\RKfuHLz.exe
  C:\Windows\System\RKfuHLz.exe
  2⤵
  PID:8628
- C:\Windows\System\vBdsVDg.exe
  C:\Windows\System\vBdsVDg.exe
  2⤵
  PID:8680
- C:\Windows\System\iGYAjpr.exe
  C:\Windows\System\iGYAjpr.exe
  2⤵
  PID:8744
- C:\Windows\System\VcXqbdX.exe
  C:\Windows\System\VcXqbdX.exe
  2⤵
  PID:8808
- C:\Windows\System\ubjtYIB.exe
  C:\Windows\System\ubjtYIB.exe
  2⤵
  PID:8696
- C:\Windows\System\nLnukFm.exe
  C:\Windows\System\nLnukFm.exe
  2⤵
  PID:8820
- C:\Windows\System\iZiageG.exe
  C:\Windows\System\iZiageG.exe
  2⤵
  PID:8840
- C:\Windows\System\BytRQHl.exe
  C:\Windows\System\BytRQHl.exe
  2⤵
  PID:8904
- C:\Windows\System\xCatxud.exe
  C:\Windows\System\xCatxud.exe
  2⤵
  PID:8964
- C:\Windows\System\ylUarhj.exe
  C:\Windows\System\ylUarhj.exe
  2⤵
  PID:8888
- C:\Windows\System\JMJqbST.exe
  C:\Windows\System\JMJqbST.exe
  2⤵
  PID:8920
- C:\Windows\System\zEMKDpN.exe
  C:\Windows\System\zEMKDpN.exe
  2⤵
  PID:8980
- C:\Windows\System\eZSXcCD.exe
  C:\Windows\System\eZSXcCD.exe
  2⤵
  PID:9020
- C:\Windows\System\TcoeJVI.exe
  C:\Windows\System\TcoeJVI.exe
  2⤵
  PID:9044
- C:\Windows\System\PdgUosa.exe
  C:\Windows\System\PdgUosa.exe
  2⤵
  PID:8624
- C:\Windows\System\HYrpGdF.exe
  C:\Windows\System\HYrpGdF.exe
  2⤵
  PID:9132
- C:\Windows\System\pBvpYhs.exe
  C:\Windows\System\pBvpYhs.exe
  2⤵
  PID:9084
- C:\Windows\System\QvgsEvL.exe
  C:\Windows\System\QvgsEvL.exe
  2⤵
  PID:8360
- C:\Windows\System\LomeHEm.exe
  C:\Windows\System\LomeHEm.exe
  2⤵
  PID:8488
- C:\Windows\System\bXTIEUY.exe
  C:\Windows\System\bXTIEUY.exe
  2⤵
  PID:8268
- C:\Windows\System\mwsaDdT.exe
  C:\Windows\System\mwsaDdT.exe
  2⤵
  PID:9184
- C:\Windows\System\xxlQomI.exe
  C:\Windows\System\xxlQomI.exe
  2⤵
  PID:8340
- C:\Windows\System\uyFMuDf.exe
  C:\Windows\System\uyFMuDf.exe
  2⤵
  PID:8612
- C:\Windows\System\hZsVXPP.exe
  C:\Windows\System\hZsVXPP.exe
  2⤵
  PID:8324
- C:\Windows\System\dFfRAuJ.exe
  C:\Windows\System\dFfRAuJ.exe
  2⤵
  PID:8580
- C:\Windows\System\fWSEolq.exe
  C:\Windows\System\fWSEolq.exe
  2⤵
  PID:8256
- C:\Windows\System\DzxTCwV.exe
  C:\Windows\System\DzxTCwV.exe
  2⤵
  PID:8372
- C:\Windows\System\EbrnqXr.exe
  C:\Windows\System\EbrnqXr.exe
  2⤵
  PID:8712
- C:\Windows\System\ZToXFMc.exe
  C:\Windows\System\ZToXFMc.exe
  2⤵
  PID:8500
- C:\Windows\System\LMSdjRE.exe
  C:\Windows\System\LMSdjRE.exe
  2⤵
  PID:8648
- C:\Windows\System\VTmyEQI.exe
  C:\Windows\System\VTmyEQI.exe
  2⤵
  PID:8676
- C:\Windows\System\yGxXFaE.exe
  C:\Windows\System\yGxXFaE.exe
  2⤵
  PID:8824
- C:\Windows\System\REhEObn.exe
  C:\Windows\System\REhEObn.exe
  2⤵
  PID:9016
- C:\Windows\System\DZdKmjV.exe
  C:\Windows\System\DZdKmjV.exe
  2⤵
  PID:8388
- C:\Windows\System\tUCWajm.exe
  C:\Windows\System\tUCWajm.exe
  2⤵
  PID:9176
- C:\Windows\System\HOWeddq.exe
  C:\Windows\System\HOWeddq.exe
  2⤵
  PID:8564
- C:\Windows\System\whKxlgw.exe
  C:\Windows\System\whKxlgw.exe
  2⤵
  PID:8272
- C:\Windows\System\ijAbjTO.exe
  C:\Windows\System\ijAbjTO.exe
  2⤵
  PID:9012
- C:\Windows\System\HNhsEnU.exe
  C:\Windows\System\HNhsEnU.exe
  2⤵
  PID:9068
- C:\Windows\System\rBIrPNp.exe
  C:\Windows\System\rBIrPNp.exe
  2⤵
  PID:9164
- C:\Windows\System\BkFpMyv.exe
  C:\Windows\System\BkFpMyv.exe
  2⤵
  PID:8644
- C:\Windows\System\geyZYie.exe
  C:\Windows\System\geyZYie.exe
  2⤵
  PID:8936
- C:\Windows\System\YzEBSWw.exe
  C:\Windows\System\YzEBSWw.exe
  2⤵
  PID:8872
- C:\Windows\System\bfvQlwh.exe
  C:\Windows\System\bfvQlwh.exe
  2⤵
  PID:8520
- C:\Windows\System\fhzBJqj.exe
  C:\Windows\System\fhzBJqj.exe
  2⤵
  PID:9232
- C:\Windows\System\QSFSuGd.exe
  C:\Windows\System\QSFSuGd.exe
  2⤵
  PID:9248
- C:\Windows\System\NgNSucU.exe
  C:\Windows\System\NgNSucU.exe
  2⤵
  PID:9268
- C:\Windows\System\JYeXjgU.exe
  C:\Windows\System\JYeXjgU.exe
  2⤵
  PID:9284
- C:\Windows\System\CwbXDDE.exe
  C:\Windows\System\CwbXDDE.exe
  2⤵
  PID:9300
- C:\Windows\System\CAdejOH.exe
  C:\Windows\System\CAdejOH.exe
  2⤵
  PID:9316
- C:\Windows\System\PlvEbDR.exe
  C:\Windows\System\PlvEbDR.exe
  2⤵
  PID:9332
- C:\Windows\System\dKmSNcl.exe
  C:\Windows\System\dKmSNcl.exe
  2⤵
  PID:9348
- C:\Windows\System\QcrjPuT.exe
  C:\Windows\System\QcrjPuT.exe
  2⤵
  PID:9364
- C:\Windows\System\AIJvtNN.exe
  C:\Windows\System\AIJvtNN.exe
  2⤵
  PID:9380
- C:\Windows\System\gFpfGaC.exe
  C:\Windows\System\gFpfGaC.exe
  2⤵
  PID:9396
- C:\Windows\System\tCoNnGR.exe
  C:\Windows\System\tCoNnGR.exe
  2⤵
  PID:9412
- C:\Windows\System\CBhQbSK.exe
  C:\Windows\System\CBhQbSK.exe
  2⤵
  PID:9428
- C:\Windows\System\eIYSxeW.exe
  C:\Windows\System\eIYSxeW.exe
  2⤵
  PID:9444
- C:\Windows\System\lKmGUKs.exe
  C:\Windows\System\lKmGUKs.exe
  2⤵
  PID:9460
- C:\Windows\System\YPcjhRC.exe
  C:\Windows\System\YPcjhRC.exe
  2⤵
  PID:9476
- C:\Windows\System\sqjCXSe.exe
  C:\Windows\System\sqjCXSe.exe
  2⤵
  PID:9492
- C:\Windows\System\YowbGKI.exe
  C:\Windows\System\YowbGKI.exe
  2⤵
  PID:9508
- C:\Windows\System\zzvBSTD.exe
  C:\Windows\System\zzvBSTD.exe
  2⤵
  PID:9524
- C:\Windows\System\VmwEyjJ.exe
  C:\Windows\System\VmwEyjJ.exe
  2⤵
  PID:9540
- C:\Windows\System\dPbzFvR.exe
  C:\Windows\System\dPbzFvR.exe
  2⤵
  PID:9556
- C:\Windows\System\hvAsrGW.exe
  C:\Windows\System\hvAsrGW.exe
  2⤵
  PID:9572
- C:\Windows\System\dFPdokq.exe
  C:\Windows\System\dFPdokq.exe
  2⤵
  PID:9588
- C:\Windows\System\EKNRjPI.exe
  C:\Windows\System\EKNRjPI.exe
  2⤵
  PID:9604
- C:\Windows\System\mQUfLkX.exe
  C:\Windows\System\mQUfLkX.exe
  2⤵
  PID:9652
- C:\Windows\System\RaJHMox.exe
  C:\Windows\System\RaJHMox.exe
  2⤵
  PID:9668
- C:\Windows\System\GTFKJIF.exe
  C:\Windows\System\GTFKJIF.exe
  2⤵
  PID:9684
- C:\Windows\System\kUEeMYp.exe
  C:\Windows\System\kUEeMYp.exe
  2⤵
  PID:9700
- C:\Windows\System\xFDqedL.exe
  C:\Windows\System\xFDqedL.exe
  2⤵
  PID:9716
- C:\Windows\System\FTtseXV.exe
  C:\Windows\System\FTtseXV.exe
  2⤵
  PID:9732
- C:\Windows\System\smDBoiW.exe
  C:\Windows\System\smDBoiW.exe
  2⤵
  PID:9748
- C:\Windows\System\LSFRjHC.exe
  C:\Windows\System\LSFRjHC.exe
  2⤵
  PID:9764
- C:\Windows\System\DYCwYze.exe
  C:\Windows\System\DYCwYze.exe
  2⤵
  PID:9792
- C:\Windows\System\eUqaNQv.exe
  C:\Windows\System\eUqaNQv.exe
  2⤵
  PID:9808
- C:\Windows\System\pmvGqHd.exe
  C:\Windows\System\pmvGqHd.exe
  2⤵
  PID:9824
- C:\Windows\System\obhxMTa.exe
  C:\Windows\System\obhxMTa.exe
  2⤵
  PID:9840
- C:\Windows\System\qyNFYIn.exe
  C:\Windows\System\qyNFYIn.exe
  2⤵
  PID:9856
- C:\Windows\System\UFsWQaU.exe
  C:\Windows\System\UFsWQaU.exe
  2⤵
  PID:9872
- C:\Windows\System\mXQYXIf.exe
  C:\Windows\System\mXQYXIf.exe
  2⤵
  PID:9888
- C:\Windows\System\PAAoIkT.exe
  C:\Windows\System\PAAoIkT.exe
  2⤵
  PID:9904
- C:\Windows\System\xgeUcZN.exe
  C:\Windows\System\xgeUcZN.exe
  2⤵
  PID:9920
- C:\Windows\System\oLypuRw.exe
  C:\Windows\System\oLypuRw.exe
  2⤵
  PID:9936
- C:\Windows\System\lwqRwGp.exe
  C:\Windows\System\lwqRwGp.exe
  2⤵
  PID:9952
- C:\Windows\System\OxgPXLZ.exe
  C:\Windows\System\OxgPXLZ.exe
  2⤵
  PID:9968
- C:\Windows\System\seTOHMi.exe
  C:\Windows\System\seTOHMi.exe
  2⤵
  PID:9988
- C:\Windows\System\adeUZdE.exe
  C:\Windows\System\adeUZdE.exe
  2⤵
  PID:10004
- C:\Windows\System\LmwYjqL.exe
  C:\Windows\System\LmwYjqL.exe
  2⤵
  PID:10020
- C:\Windows\System\wdHKtVN.exe
  C:\Windows\System\wdHKtVN.exe
  2⤵
  PID:10048
- C:\Windows\System\ACYQhlF.exe
  C:\Windows\System\ACYQhlF.exe
  2⤵
  PID:10072
- C:\Windows\System\UxkzaQG.exe
  C:\Windows\System\UxkzaQG.exe
  2⤵
  PID:10120
- C:\Windows\System\eQLigsY.exe
  C:\Windows\System\eQLigsY.exe
  2⤵
  PID:10136
- C:\Windows\System\QDyCOGn.exe
  C:\Windows\System\QDyCOGn.exe
  2⤵
  PID:10152
- C:\Windows\System\zSDXAPd.exe
  C:\Windows\System\zSDXAPd.exe
  2⤵
  PID:10168
- C:\Windows\System\kswyVFU.exe
  C:\Windows\System\kswyVFU.exe
  2⤵
  PID:10184
- C:\Windows\System\whusFRD.exe
  C:\Windows\System\whusFRD.exe
  2⤵
  PID:10200
- C:\Windows\System\HKoayrp.exe
  C:\Windows\System\HKoayrp.exe
  2⤵
  PID:10216
- C:\Windows\System\sfIOUOD.exe
  C:\Windows\System\sfIOUOD.exe
  2⤵
  PID:10232
- C:\Windows\System\nHFSCss.exe
  C:\Windows\System\nHFSCss.exe
  2⤵
  PID:9000
- C:\Windows\System\SNNMapA.exe
  C:\Windows\System\SNNMapA.exe
  2⤵
  PID:8756
- C:\Windows\System\kOhaGnM.exe
  C:\Windows\System\kOhaGnM.exe
  2⤵
  PID:8220
- C:\Windows\System\BycjDtv.exe
  C:\Windows\System\BycjDtv.exe
  2⤵
  PID:9292
- C:\Windows\System\QcawNNX.exe
  C:\Windows\System\QcawNNX.exe
  2⤵
  PID:8852
- C:\Windows\System\xNeKSfb.exe
  C:\Windows\System\xNeKSfb.exe
  2⤵
  PID:9360
- C:\Windows\System\NdfGdXe.exe
  C:\Windows\System\NdfGdXe.exe
  2⤵
  PID:9420
- C:\Windows\System\TMZkURQ.exe
  C:\Windows\System\TMZkURQ.exe
  2⤵
  PID:8728
- C:\Windows\System\oiRnrQH.exe
  C:\Windows\System\oiRnrQH.exe
  2⤵
  PID:8792
- C:\Windows\System\cLWWTbm.exe
  C:\Windows\System\cLWWTbm.exe
  2⤵
  PID:9280
- C:\Windows\System\qVEiVom.exe
  C:\Windows\System\qVEiVom.exe
  2⤵
  PID:9404
- C:\Windows\System\lZUrMXH.exe
  C:\Windows\System\lZUrMXH.exe
  2⤵
  PID:8600
- C:\Windows\System\qaJUfQO.exe
  C:\Windows\System\qaJUfQO.exe
  2⤵
  PID:9276
- C:\Windows\System\Xvijxeg.exe
  C:\Windows\System\Xvijxeg.exe
  2⤵
  PID:9436
- C:\Windows\System\aFkXWTZ.exe
  C:\Windows\System\aFkXWTZ.exe
  2⤵
  PID:9488
- C:\Windows\System\bONVQAe.exe
  C:\Windows\System\bONVQAe.exe
  2⤵
  PID:9500
- C:\Windows\System\drdjbel.exe
  C:\Windows\System\drdjbel.exe
  2⤵
  PID:9564
- C:\Windows\System\WRFYUMp.exe
  C:\Windows\System\WRFYUMp.exe
  2⤵
  PID:9548
- C:\Windows\System\XyaQGbD.exe
  C:\Windows\System\XyaQGbD.exe
  2⤵
  PID:9584
- C:\Windows\System\tVxFXne.exe
  C:\Windows\System\tVxFXne.exe
  2⤵
  PID:9632
- C:\Windows\System\ajCQMWP.exe
  C:\Windows\System\ajCQMWP.exe
  2⤵
  PID:9648
- C:\Windows\System\tJwpotX.exe
  C:\Windows\System\tJwpotX.exe
  2⤵
  PID:9696
- C:\Windows\System\zxDlPkF.exe
  C:\Windows\System\zxDlPkF.exe
  2⤵
  PID:9760
- C:\Windows\System\FwZNyrC.exe
  C:\Windows\System\FwZNyrC.exe
  2⤵
  PID:9836
- C:\Windows\System\KbbBLBA.exe
  C:\Windows\System\KbbBLBA.exe
  2⤵
  PID:9676
- C:\Windows\System\anCGZfK.exe
  C:\Windows\System\anCGZfK.exe
  2⤵
  PID:9896
- C:\Windows\System\bkWeoxw.exe
  C:\Windows\System\bkWeoxw.exe
  2⤵
  PID:10036
- C:\Windows\System\DJcVKIz.exe
  C:\Windows\System\DJcVKIz.exe
  2⤵
  PID:9996
- C:\Windows\System\JjoFbie.exe
  C:\Windows\System\JjoFbie.exe
  2⤵
  PID:9928
- C:\Windows\System\oQgXIZK.exe
  C:\Windows\System\oQgXIZK.exe
  2⤵
  PID:9880
- C:\Windows\System\sHIVaIx.exe
  C:\Windows\System\sHIVaIx.exe
  2⤵
  PID:9776
- C:\Windows\System\VrCcfFg.exe
  C:\Windows\System\VrCcfFg.exe
  2⤵
  PID:9816
- C:\Windows\System\MWWUXmM.exe
  C:\Windows\System\MWWUXmM.exe
  2⤵
  PID:9948
- C:\Windows\System\RhVxDAW.exe
  C:\Windows\System\RhVxDAW.exe
  2⤵
  PID:10012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AeVJHcQ.exe

Filesize
2.2MB

MD5
7eaaa93e90ed9181ce12f1db53650d24

SHA1
fc0796199450e94daa38b5625ce2b1cc8a601e2d

SHA256
f3c87e5f44003e30532b10d3fa2846388e2c928a539b45fc5da0090c36b1c79b

SHA512
79538e3efcc0069925cae7c08cdb18d519cd43d3b2f1d72ab7db6298127aeee87673866fdb4748d06588b420d1bf9d1cdcbf12fb27ab347e808fbc2ccad14962

Download Submit
C:\Windows\system\DkjuSxa.exe

Filesize
2.2MB

MD5
9a14f6f5be9c12152c7c90d6a2c54828

SHA1
dbdc7cc40ead09ba1604c98c512fa6cbda046b27

SHA256
870b3ae1e8222db784ace55c0ea445ff24247cb675afc40972df8ce40e0f8d21

SHA512
6af6f3f928528578f583d352d4f1fecfc15ea7f6bf5fe28a1977e9dbb7bf61ad71e5f8844c8c5e1043cbc719b4a4d3b7731971e1e9234a8076edfe8ed0f4f520

Download Submit
C:\Windows\system\EQkIPeA.exe

Filesize
2.2MB

MD5
bed0a5ed5a8ffd480e444069f23fd432

SHA1
2b38ad6e71fc952c1822cfdeaf919fe5e6c496c9

SHA256
83e1ec1633d9749d8ea20e176b01ba2a92372ab9530b1f794a79fc42ef68a431

SHA512
0ef5095df7c4e3c2d7fa996a022fb125fedb56586a0e8e5fffc3a96b51a685f59075e01ef66f116cb75adb15900b844638b8d11b77a82ef87b8844512281b3ca

Download Submit
C:\Windows\system\FUULMxY.exe

Filesize
2.2MB

MD5
4ba54d13252cc17fdf3700c347c258d0

SHA1
861d9493323bf18dab3724d1f41a42ebd0020d06

SHA256
d1ea8673888540427fd65d38051719ac1a994e2218f99b0ed05bc396da1436ab

SHA512
5da2892d359a142baf813a4d8cff59069cdc88afb47745a3e8dccaca339071bbc1d1634dfb486c8e434154194a12c12a9424c06a9af2d3e0a253c258cf8a0481

Download Submit
C:\Windows\system\FhOXRip.exe

Filesize
2.2MB

MD5
0ec2d587b6da8f1ae92a2342c72e11d6

SHA1
dcb91daf2e2acc666578ff99170846e95fdd86da

SHA256
5d955f1861946ef0b6f21dc13aff7f446ab03dd26390f9277a061bbdee06b6f1

SHA512
550a5fb8f523c76bac62815a9a6f37fd8c3299e6a46cf6407c93897929cf96e91390c4c839e4c17881eafddefb9d7ad453912ba65f2f34288c1fa2f22492e51f

Download Submit
C:\Windows\system\HGkhOFl.exe

Filesize
2.2MB

MD5
9f47a0a0261e6068525605d01f42c5e4

SHA1
3bc3115e932b55ef7ac0d120d8de33f42e85f74f

SHA256
8830cf2443b0d1d64acfac2ffb00acb44c9393487aed91a71bd57c8822c559ea

SHA512
98df1557a60dac228131aff1376ce36147de74a5b1cfbfee7f583624c8fdba439c42551f2b36a9bd7caf9b09478014fb2cabb1512ab8c68bb4fbfec50a8470ef

Download Submit
C:\Windows\system\RYFiIFC.exe

Filesize
2.2MB

MD5
b664db444bd04334465b78d3a6fa6f74

SHA1
c979e3f0f23afb5b7840dce0f94e196aecb7a19a

SHA256
d328477603e3c18f419bfbc76e2a70f4efdbd6a248a728c6a14e4d043f970b38

SHA512
ebb79f734e2ea6424f1e3fa5ae374d340e2229d8e5878824b0e62055bf9ee2e0788c7f399af03667890fb3f02014acaf51ac6117eee905c47d4632ed7ccc8d08

Download Submit
C:\Windows\system\VzZpeJX.exe

Filesize
2.2MB

MD5
b14fc166d3da688df9f37d67bcc5dcdf

SHA1
7ac841163836ceaf335b47719f27793ed22869fe

SHA256
69acebb5a4c6aa66913c31f16104c1e30972a53fd5717fb6072602bf85b70fde

SHA512
429279b85e310ce34334442763d679f1074bcfe7aee7c4eab706680c3208f065ce27f53cec7e5efce02bb83cb8da48595d95d70d04335f36990ec48db06cb3be

Download Submit
C:\Windows\system\YcTkNnR.exe

Filesize
2.2MB

MD5
4941df05dc04a6b01e28edab02272223

SHA1
a02f38b9eb2b6e8faa801a778889c89f1f4e0161

SHA256
46a7041976c47fd8b28062d8b45a4d5a82c9116df365bf5637f908882156dacd

SHA512
0495cbd0c59a02dbbdc5733d8a1fd7c98a84afe59e33b0b536d3992704dde0eb578c40172d9957715b9ae5ff2e282e136a7ad061ad65c09aefef37469bfa2cbe

Download Submit
C:\Windows\system\bVpnLWe.exe

Filesize
2.2MB

MD5
2646bb0328da406c8f2e0808b0caa3b4

SHA1
129557577886ad286340c178537e421e3bad4ae1

SHA256
af897e59329e0ac6f77990934d6664d4109663f4fda498e0a90279043248aee4

SHA512
448809f65375047c0444eaf5c536226f4930025cc8fac266d66633fb7704dbbf23bb0d8c5a3be59474e191cf4a1cb611cc6bbd189432ae00de620ebdb47d0410

Download Submit
C:\Windows\system\dMKnJEB.exe

Filesize
2.2MB

MD5
dfc10fcd3b0bcd2ac30ee2c3819b6661

SHA1
5a3e44d3ca6570f52908e6f8b814f04773b198a5

SHA256
ffd2a53bd30ca7a15273c9e3c6c9a1ed58d478912da5bd83e49d60ebd4d5b0a9

SHA512
6176e4f5d2fbb1056ea7e5ac608b1982c993d7e38c0fffe7cdce54cf7742467d418f1372a9a80a12493b8637e4c0234fee22065ee5d9de973de4c7a298421fc8

Download Submit
C:\Windows\system\fCjAKRF.exe

Filesize
2.2MB

MD5
4cec2d4ab30d602d4ef5df9b82e830b2

SHA1
58574a782bbd1f3d89bd3197384532de2e0f9d34

SHA256
65a72fff9ffd3d301d78ebc0cd8f4a0665880e1e9454eebb97746737998fb490

SHA512
8a8e404d6c81f6f5038c29759bfa57a933af5484c47e82b13d541d1d01418a8bf35eee5d006e2263bf25a14980c17e377d1bd15290f617f48b5144d860d2b9b3

Download Submit
C:\Windows\system\fDAzMKk.exe

Filesize
2.2MB

MD5
9d30c462ab7fc869d6762a1fcd49c1f0

SHA1
6742b8e68c75c2fb783ba17e8789ab3746a12f3c

SHA256
d25084ece46e5eb7e5aed1f249487caff1450cde21f4c5926b5d997ffdc33541

SHA512
25ec63ea2a87400e013c0cf007b9627f3b7524fce807108160341edc73f0a580f4940c2d5084d0bc864b0b35e7ac6ee5874ce40dfaece2c02cc38f292f22c477

Download Submit
C:\Windows\system\fEAnxyg.exe

Filesize
2.2MB

MD5
5111494362884978c4f6fdf62d4fbfe5

SHA1
84cd0c79efd9ceb246ab944c2cfdfc8b7c4d05b4

SHA256
aeec51d99ac3a9f5a344f408cd99eaf43ab83117b8999ba6ab254bc5db99a56a

SHA512
a9c2bc4c558a26055222b4924153305dd0adf77654420cb75e3571bff2f0c7c43116b24cf56a865a8dafd7cf09d2e914230246e60e4b10c2438cf880d27da338

Download Submit
C:\Windows\system\ftnPDUQ.exe

Filesize
2.2MB

MD5
7dce8fdae0f5cc42032be86ed88c4039

SHA1
357eaf9cbe989372d0d8191cf276a9017c8671b8

SHA256
25646bb408b585642aa08573190f63ae4d2b0c910828e2c9e45815597bd2c1d3

SHA512
a1de3a5863a7f9d0bf30f1c243207728bc1d73c076922d444ac001a66d7156a805eb7d014fbcc3c7de0d175d9ba938afa0147c16df2c08f3fdb94df676495eb8

Download Submit
C:\Windows\system\gPuLYXT.exe

Filesize
2.2MB

MD5
6873b880810ccd1dc358208a878b8166

SHA1
c3b6dd2c9114f08431f3a39ab65326facb8721be

SHA256
71cfccbf8381d1efff2c3737ebab3dac94b9392f6038ae5d0bca4df78663d08a

SHA512
410320cdbc74a933869fd2ab9d0a0cba6dcf7645593a8f26677f118a73733ebd5eb04139622780d87122d7e86d09d95b704142fcf4dd355fb67ca46726499897

Download Submit
C:\Windows\system\mBobhjQ.exe

Filesize
2.2MB

MD5
e693056eb95f1a2dda69717094c8566c

SHA1
6de3de8222b6b6b7eb3556963efae478459b7a1d

SHA256
999fe7a64500be156cd96af1654b744a6dd41a31e1d87829c36bb378195936b5

SHA512
39db1aa274b1ad5a8424298581e7eba2109b12ee7a8f6c8139b520fffc19524333774ef217ed5f7f1a2e725d2c3fc2e52d03457df685639d7edc3537ed26ef42

Download Submit
C:\Windows\system\nvhWLmf.exe

Filesize
2.2MB

MD5
21f8682bd0cc021b35bce82c4e11a177

SHA1
1a6a1aa6e36e029b05de95974fc81d576773b3ed

SHA256
c992c1c29ed890346736ec31f72874946ec7ebf0750d424a258dccb2dc89fc0d

SHA512
3aebff7383345a87a425cdc0cbff46fc279ba64a6e7003f78e1949679b5eaa5437a5698615a3926d11e12dfda0ad5fba31a6dc878590935c8cb781f36afe670f

Download Submit
C:\Windows\system\qkyBEzQ.exe

Filesize
2.2MB

MD5
a19b1b31669d8525fc9ed290caf74d38

SHA1
997c292ef94045f496a51093f00b38decc30db22

SHA256
ae8ec4309ce683e0a03a919b4121e0128536bb0ea17313fd07d0fbbac07b3697

SHA512
ce655aa60fed226304efb07458d41f21ff500f2970e8bcc00787661d80e6d1da4626c9fe026e209d4d7b30b8b2b249ab3082e6419f747b258752848037f90dcc

Download Submit
C:\Windows\system\sCTgIXO.exe

Filesize
2.2MB

MD5
2946f14420dae0b0773449fd6a82051d

SHA1
83947e9a083300ad9658381917324d2cb21d9fa0

SHA256
b788b726f76842045fba45253748446cbce9c7b6e40b8d1b4edff7a522e0e1c7

SHA512
9c9d98bfacf76a6b88ccc7e186e030759baa3cf56f274f919006a351708cfee537f2017d43888be68b338398330d94ea60f4ef407bc778ce6fbbe153a16475fc

Download Submit
C:\Windows\system\sJDMgSL.exe

Filesize
2.2MB

MD5
d52cc9b830a92b7ce8429e7d802be7f3

SHA1
b641039f12fe661d25fae5be1b551d42d2b44753

SHA256
8efc691bc6ff5a77fecf5d0db0bc342c98f647aac04e7d15b5d06ac023b67a2f

SHA512
0d85fdee9503e9a7468b6313eae3318f84d2b9f6a330ad9e0c26f4a049e16d4fcf1e99eeacb00f7d0563353333c762ab6609f83886d5a23edc403b9dd0dcaeba

Download Submit
C:\Windows\system\tnCNGyc.exe

Filesize
2.2MB

MD5
2b8bc8cb0a6b464b772faab795212ef4

SHA1
7d56adfd6dc0fd3890dbd36dbb047630b09857f0

SHA256
56cc86d3d8d3d4ecdbb1b287a6200cd2b923a15bd9c161e471d63a97215d19ac

SHA512
9adb684516d238beb54186d5b175a84ad5499d99db728dd7c8bb0d4ee35f70b6b742523d9e6dd87d85b620ff22009a3cb9ddf5e6200489f98dfdbea3d2e6e2d3

Download Submit
C:\Windows\system\vNAJZUs.exe

Filesize
2.2MB

MD5
bcd68c9a9de7a8967dca409af58d8507

SHA1
f3b37a7417a79276a8b968add87bbcce815addc0

SHA256
04939e29c68365b4756b5e66d344b6ae7e99d90b9fb8c5a0737c2640eef8ac9c

SHA512
0d6a8b45b284410cf78b1c5c78a976d96ebb3c845aa513dd6811639c1f2f32632cf919fa1c5889eb12c97ed6991b3d5f97fb18145cdef2032cb834697772017b

Download Submit
C:\Windows\system\vpzhiMm.exe

Filesize
2.2MB

MD5
b69ef4ace84d9d848f0fc3fbd8deefa8

SHA1
63b905d517dce5491c3450c071f552f17f2506ca

SHA256
b78921b0870cbc5da450df65426ef1a9019c406c32fc27c18578112779ac5468

SHA512
7210a42c51835d358370ef0952511afefd6452806e205cc3f6c455d9580aeff5ab40b6d600d2e93ebda7b3fc30151dcda5202e2f3674498caf69fc2449692cb1

Download Submit
C:\Windows\system\wUmZCIW.exe

Filesize
8B

MD5
30a9dfceb37577cb23b97b50ee0ca790

SHA1
b56360a546aafbfa7ce003cd05916a7ab7239259

SHA256
44dda0d0cfe87b066fcb3ae3e2b0cbc86f86ca0fdd14c7ce736c7a63fedce1f4

SHA512
f1ae1743e6029aabc9e7387b476be46b30f000874bca6e0907b605cfb329a40abfc7d4eb3d891027c469be0356b370267e0531be7c50ab8183a5aad8ce1cbe57

Download Submit
C:\Windows\system\xDDtVra.exe

Filesize
2.2MB

MD5
b79848c8578fe8b635f894b087014b3e

SHA1
df633232a399286a1d941d6dbd7d12e985504a19

SHA256
39546e9cf4f133a66979377a3665e6ec7227614cce397e527fccee51ced9d2c0

SHA512
c47d444da318935db17e1d96a7285140b273a33e9bc9a228abd1098b684c9cb5c369f1a946d01d5011d759de97b750577e0f00a5b8fb6798f917f7243857b038

Download Submit
C:\Windows\system\xJudcQF.exe

Filesize
2.2MB

MD5
04496832998729868fd98c3f61b198bd

SHA1
1d8fb61c58718f0091552ea826e131790871698e

SHA256
812e43dec7bd82f522f000116e7e3f003e400f7479e2300ace14d62c22b28461

SHA512
86858a9eba3d1721cfb73fd5bcb929bc087781ab8211c9ceb011be38de06b88126e5f07e9c98661fa0a67f3477e35f576572d9c9b7ff82b2d1e57b9355bedfc5

Download Submit
C:\Windows\system\xVrQhIg.exe

Filesize
2.2MB

MD5
59da994d9d36759e6f55a847f361530f

SHA1
7a1c2599cc1a1b74427b702bc472c3f3827ab06b

SHA256
423007d2d17ed7559d85f340d68ce67eb87c4402b179fdc31c03813488d168f5

SHA512
93afa389ce4fbddb24e1b212807306e7a538dc95a1974a936525474c441ef0696ee91c09ecb7df5bf1258aa5260a25bc000dd504cd6f9633bd21d26109a87a65

Download Submit
\Windows\system\LBlsyFH.exe

Filesize
2.2MB

MD5
f39fe3ae87be3cc1c4cbf33b03fc15c9

SHA1
68a06e352b4206ef446827826c194a0a1dffbe7a

SHA256
f8c37a3a0bd7bf5eee18e22217df6d00f0905f07bea41b0ebe501d63f491adb9

SHA512
a97acec45aaeeef5e69eaca220005d4236e733a482a26451413e9fec81608701724ad1cec8ad651cacd43af119968a9622905664ab7b0bf154fbb83d28abef75

Download Submit
\Windows\system\TjmqrGa.exe

Filesize
2.2MB

MD5
e65e6dc46c69d9035be0dce52fc85123

SHA1
478b54aaf04b9cff9f42b48bc0eff22402b3f786

SHA256
d4f9d49913f60ae2ac93ca9930c288d52fc6bac4f96a471a948576692a8d4a15

SHA512
3477f919e296ab22e823180d60e82b9abc110a780d3acca5ed941155459c3e3e35100b8bb9e5cb2d77e77df9ccad3aecba07f00488002f2f11b33ed883ea57ed

Download Submit
\Windows\system\owPuFyL.exe

Filesize
2.2MB

MD5
f32013a8bca12e30b74a8b7b3d9099a7

SHA1
b3fc793062417689b2a4867f5100c6b6d17ae30b

SHA256
7f6d73903b2e5612f96a45c021f7519813ea12c1d98afaddd06e877193656116

SHA512
342c134bd4874146b1efa481438bc6138c046f54c90678a5397a0a9983f7df9ddd8bb375ace23ab19721d906c314fc96ea81d076f0f116f52b16a8c11b1974ce

Download Submit
\Windows\system\vCmssrP.exe

Filesize
2.2MB

MD5
647bbf10e0dc70085c9f94e357139622

SHA1
68a32cd3556b0634bc4ac4da2e659e5af41333f4

SHA256
4512887f67676c60b56a727392ad6902f9341e6877139dd55bdb5268856eeebb

SHA512
19b6b547ee1c3ef8621accf4204d4b6004e8873de297cad2f02f449d1fd3cb16b6ba82a0546f3368ef23f1f45200094fc566c3fb848b7c52902763e18b326fc3

Download Submit
\Windows\system\wbQoYOC.exe

Filesize
2.2MB

MD5
9c3cd610fd4b3b0e9e2b6eb5ad531aa7

SHA1
e950a49036188bf7ec613afd7be03bf38df5a0f8

SHA256
d3cfcc460db521517051a8b7eaffe0de581be9c7e76a63d6b1149592a9a6d5cb

SHA512
db52f6fb6d4b1ebed6dbd8d36e2788e3a8dc83b9a99ff21837645dba5794483d32f4c81973cf41ef59892a1099035614b7c4247528fe5b28fb84b7d49bb593b2

Download Submit
memory/1620-94-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1620-4699-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2104-91-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2348-4688-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2348-85-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2372-83-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2372-4761-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2400-87-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-4677-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-80-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-13-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-325-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-39-0x000000001B6A0000-0x000000001B982000-memory.dmp

Filesize
2.9MB

Download
memory/2540-72-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-75-0x000007FEF5F90000-0x000007FEF692D000-memory.dmp

Filesize
9.6MB

Download
memory/2540-28-0x000007FEF624E000-0x000007FEF624F000-memory.dmp

Filesize
4KB

Download
memory/2540-40-0x0000000002A70000-0x0000000002A78000-memory.dmp

Filesize
32KB

Download
memory/2588-27-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-4675-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-4701-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2640-76-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2836-1-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2836-78-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2836-77-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-90-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-92-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-15-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2836-10-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2836-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/2836-84-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2836-86-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-93-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2836-25-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2836-88-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-4681-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2844-89-0x000000013FBD0000-0x000000013FFC2000-memory.dmp

Filesize
3.9MB

Download
memory/2940-4691-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2940-12-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download