xmrig | bf37db301b28e2d123b435a1a1fa892b9c7f4026be4ac52a5e15feb847779a95

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
Size

1.5MB
MD5

00f857b864f1cce2796488e4951cd5c8
SHA1

d729c0d654034757e97bb330f3865d46fd5ff673
SHA256

bf37db301b28e2d123b435a1a1fa892b9c7f4026be4ac52a5e15feb847779a95
SHA512

cf02543c922a614657ff151b5b96d784d8332f000a2b88d80df4e073cd30b9351d7fee50ed179dfb3443d8e3ae6b4c1364079ab64a265bdb6533622516b6609e
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82S7z:NABy

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2840-8-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2768-26-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2660-71-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/1748-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	xmrig
behavioral1/memory/2464-84-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2188-82-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2680-79-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2724-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/1808-1691-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2840	PCqLAuD.exe
2544	kujSiQy.exe
2768	JbcDumO.exe
2660	LxJubRM.exe
2724	mnuaxyq.exe
2680	KvDtOQt.exe
2188	yGOkhwR.exe
2464	UoBdixZ.exe
1748	yZWFyjv.exe
1300	oXcGlkq.exe
2608	qcGnHSJ.exe
1548	DquvYdV.exe
1944	FiwICPx.exe
1648	jIJosIL.exe
2220	zqcTaDl.exe
1976	BoihCwb.exe
1564	wQFKCHK.exe
2200	oAacyFj.exe
3056	sUgihYO.exe
856	zMbJLDJ.exe
1248	DFTxRtX.exe
2784	aoBUfpw.exe
2088	XYyZabd.exe
2152	mncxOFB.exe
808	bXaTtOJ.exe
1468	PgxuULj.exe
1924	loAxYnp.exe
1124	uzUkwUs.exe
1128	keqgqkC.exe
1912	EoiqihZ.exe
384	XxdKfYV.exe
1476	NolmfzM.exe
836	wwxICcF.exe
2328	VwkvsCz.exe
1792	oXYLSyT.exe
1988	xZSPwVj.exe
776	kxndyCY.exe
2968	ogCtNHX.exe
1032	jQstFzR.exe
3012	HvqsSjo.exe
1144	kSvdICg.exe
2800	SWMsgay.exe
2808	DClfuKa.exe
2832	UUqpMQE.exe
560	bUZgtEO.exe
3020	RAYKPmG.exe
572	BFCempo.exe
1788	VNAyEOW.exe
2012	KGtThaD.exe
2696	dfVyPUR.exe
2296	FUtTvgG.exe
1604	OrVjWHA.exe
2756	bQkAkdb.exe
2920	wvmeCmN.exe
2628	apmBaeN.exe
2684	BxYggee.exe
2548	WKDzVpp.exe
2448	gLKSeEM.exe
2940	OvenkDv.exe
1660	zLhyxCy.exe
2440	FwMPshB.exe
2556	yKkjOGb.exe
1568	lfhFWMS.exe
2664	rKdNEdA.exe

Loads dropped DLL 64 IoCs

pid	Process
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1808-0-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/files/0x000b000000014712-6.dat	upx
behavioral1/memory/2840-8-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/files/0x0038000000014b4c-9.dat	upx
behavioral1/memory/2544-14-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x000700000001564f-19.dat	upx
behavioral1/files/0x000e0000000054ab-30.dat	upx
behavioral1/files/0x000800000001565d-31.dat	upx
behavioral1/memory/2768-26-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x0007000000015677-38.dat	upx
behavioral1/files/0x0008000000015d56-40.dat	upx
behavioral1/files/0x0006000000015d7f-56.dat	upx
behavioral1/files/0x0006000000015d6b-49.dat	upx
behavioral1/files/0x0006000000015d93-64.dat	upx
behavioral1/files/0x0006000000015d87-59.dat	upx
behavioral1/memory/2660-71-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/files/0x0006000000015e32-89.dat	upx
behavioral1/files/0x0006000000015f65-99.dat	upx
behavioral1/files/0x0038000000014bbc-102.dat	upx
behavioral1/files/0x000600000001610f-113.dat	upx
behavioral1/files/0x000600000001658a-131.dat	upx
behavioral1/files/0x0006000000016c44-150.dat	upx
behavioral1/files/0x0006000000016c64-157.dat	upx
behavioral1/files/0x00060000000164aa-129.dat	upx
behavioral1/files/0x0006000000016d3a-187.dat	upx
behavioral1/files/0x0006000000016d18-179.dat	upx
behavioral1/files/0x0006000000016d20-178.dat	upx
behavioral1/files/0x0006000000016adc-173.dat	upx
behavioral1/files/0x0006000000016d07-169.dat	upx
behavioral1/files/0x0006000000016cb0-161.dat	upx
behavioral1/files/0x0006000000016616-156.dat	upx
behavioral1/files/0x0006000000016c5e-152.dat	upx
behavioral1/files/0x0006000000016d3e-190.dat	upx
behavioral1/files/0x0006000000016d34-185.dat	upx
behavioral1/files/0x0006000000016cdc-167.dat	upx
behavioral1/files/0x0006000000016851-141.dat	upx
behavioral1/files/0x000600000001630a-124.dat	upx
behavioral1/files/0x000600000001621e-119.dat	upx
behavioral1/files/0x0006000000015fe5-107.dat	upx
behavioral1/memory/1748-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp	upx
behavioral1/memory/2464-84-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2188-82-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2680-79-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2724-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x0006000000015ecc-94.dat	upx
behavioral1/memory/1808-1691-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VNAyEOW.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\PWmlSSb.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\wkjCoQw.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\XJvkjMe.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\aMsPzzH.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\CbBDtCY.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\jstmPFt.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\lZSuMai.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\AMiWcqg.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\DbQjMIe.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\SWMsgay.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\Gbndpkr.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\hAcPvZM.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\fKFpUOm.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\FInzmjo.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\sUUNkvt.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\ntfiCOF.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\tOHFlNX.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\NiGSmEv.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\BAkFggF.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\MgZYogN.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\qBbCjoD.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\PJkdGKw.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\azaSITC.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\PtWwiXA.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\sbuwapq.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\CdBudfI.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\CMgoRfa.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\xqXAKDj.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\bMHtkAC.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\ZQBbktm.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\fathcIC.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\WjXirZf.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\FUtTvgG.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\XnZhHsL.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\qshKlLT.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\QRDCAgW.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\mnQCIlw.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\fEhopik.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\jFuaTXk.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\mUbRvIZ.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\IxIirHF.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\BJhOrgM.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\rNJwZuC.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\IqxpYhl.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\BprfYnP.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\uzUkwUs.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\hMEslXs.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\PAMEaMG.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\pHNjGIU.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\rfcbVWx.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\xPPYVUZ.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\gSZieYi.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\AyJJYFM.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\mDxcgmn.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\RHMhuyJ.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\lIOZNKJ.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\HJRwNtz.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\rKdNEdA.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\wYNiVPI.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\lIemczI.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\WKXzHBH.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\VvGTaru.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
File created	C:\Windows\System\oXYLSyT.exe	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2256	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
Token: SeDebugPrivilege	2256	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 2256	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2256	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2256	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	29
PID 1808 wrote to memory of 2840	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2840	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2840	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	30
PID 1808 wrote to memory of 2544	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2544	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2544	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	31
PID 1808 wrote to memory of 2768	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2768	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2768	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	32
PID 1808 wrote to memory of 2660	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2660	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2660	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	33
PID 1808 wrote to memory of 2724	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2724	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2724	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	34
PID 1808 wrote to memory of 2680	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2680	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2680	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	35
PID 1808 wrote to memory of 2188	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2188	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2188	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	36
PID 1808 wrote to memory of 2464	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2464	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2464	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	37
PID 1808 wrote to memory of 1748	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	38
PID 1808 wrote to memory of 1748	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	38
PID 1808 wrote to memory of 1748	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	38
PID 1808 wrote to memory of 2608	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	39
PID 1808 wrote to memory of 2608	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	39
PID 1808 wrote to memory of 2608	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	39
PID 1808 wrote to memory of 1300	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1300	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1300	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	40
PID 1808 wrote to memory of 1548	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1548	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1548	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	41
PID 1808 wrote to memory of 1944	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	42
PID 1808 wrote to memory of 1944	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	42
PID 1808 wrote to memory of 1944	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	42
PID 1808 wrote to memory of 2220	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2220	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	43
PID 1808 wrote to memory of 2220	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	43
PID 1808 wrote to memory of 1648	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	44
PID 1808 wrote to memory of 1648	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	44
PID 1808 wrote to memory of 1648	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	44
PID 1808 wrote to memory of 1976	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	45
PID 1808 wrote to memory of 1976	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	45
PID 1808 wrote to memory of 1976	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	45
PID 1808 wrote to memory of 1564	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	46
PID 1808 wrote to memory of 1564	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	46
PID 1808 wrote to memory of 1564	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	46
PID 1808 wrote to memory of 2200	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	47
PID 1808 wrote to memory of 2200	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	47
PID 1808 wrote to memory of 2200	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	47
PID 1808 wrote to memory of 3056	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	48
PID 1808 wrote to memory of 3056	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	48
PID 1808 wrote to memory of 3056	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	48
PID 1808 wrote to memory of 856	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	49
PID 1808 wrote to memory of 856	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	49
PID 1808 wrote to memory of 856	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	49
PID 1808 wrote to memory of 1248	1808	00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00f857b864f1cce2796488e4951cd5c8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- C:\Windows\System\PCqLAuD.exe
  C:\Windows\System\PCqLAuD.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\kujSiQy.exe
  C:\Windows\System\kujSiQy.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\JbcDumO.exe
  C:\Windows\System\JbcDumO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\LxJubRM.exe
  C:\Windows\System\LxJubRM.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\mnuaxyq.exe
  C:\Windows\System\mnuaxyq.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\KvDtOQt.exe
  C:\Windows\System\KvDtOQt.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\yGOkhwR.exe
  C:\Windows\System\yGOkhwR.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\UoBdixZ.exe
  C:\Windows\System\UoBdixZ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\yZWFyjv.exe
  C:\Windows\System\yZWFyjv.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\qcGnHSJ.exe
  C:\Windows\System\qcGnHSJ.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\oXcGlkq.exe
  C:\Windows\System\oXcGlkq.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\DquvYdV.exe
  C:\Windows\System\DquvYdV.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\FiwICPx.exe
  C:\Windows\System\FiwICPx.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\zqcTaDl.exe
  C:\Windows\System\zqcTaDl.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\jIJosIL.exe
  C:\Windows\System\jIJosIL.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\BoihCwb.exe
  C:\Windows\System\BoihCwb.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\wQFKCHK.exe
  C:\Windows\System\wQFKCHK.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\oAacyFj.exe
  C:\Windows\System\oAacyFj.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\sUgihYO.exe
  C:\Windows\System\sUgihYO.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\zMbJLDJ.exe
  C:\Windows\System\zMbJLDJ.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\DFTxRtX.exe
  C:\Windows\System\DFTxRtX.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\mncxOFB.exe
  C:\Windows\System\mncxOFB.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\aoBUfpw.exe
  C:\Windows\System\aoBUfpw.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\loAxYnp.exe
  C:\Windows\System\loAxYnp.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\XYyZabd.exe
  C:\Windows\System\XYyZabd.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\XxdKfYV.exe
  C:\Windows\System\XxdKfYV.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\bXaTtOJ.exe
  C:\Windows\System\bXaTtOJ.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\NolmfzM.exe
  C:\Windows\System\NolmfzM.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\PgxuULj.exe
  C:\Windows\System\PgxuULj.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\wwxICcF.exe
  C:\Windows\System\wwxICcF.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\uzUkwUs.exe
  C:\Windows\System\uzUkwUs.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\VwkvsCz.exe
  C:\Windows\System\VwkvsCz.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\keqgqkC.exe
  C:\Windows\System\keqgqkC.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\oXYLSyT.exe
  C:\Windows\System\oXYLSyT.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\EoiqihZ.exe
  C:\Windows\System\EoiqihZ.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\xZSPwVj.exe
  C:\Windows\System\xZSPwVj.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\kxndyCY.exe
  C:\Windows\System\kxndyCY.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\ogCtNHX.exe
  C:\Windows\System\ogCtNHX.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\jQstFzR.exe
  C:\Windows\System\jQstFzR.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\HvqsSjo.exe
  C:\Windows\System\HvqsSjo.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\kSvdICg.exe
  C:\Windows\System\kSvdICg.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\SWMsgay.exe
  C:\Windows\System\SWMsgay.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\DClfuKa.exe
  C:\Windows\System\DClfuKa.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\UUqpMQE.exe
  C:\Windows\System\UUqpMQE.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\bUZgtEO.exe
  C:\Windows\System\bUZgtEO.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\RAYKPmG.exe
  C:\Windows\System\RAYKPmG.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\BFCempo.exe
  C:\Windows\System\BFCempo.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\VNAyEOW.exe
  C:\Windows\System\VNAyEOW.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\KGtThaD.exe
  C:\Windows\System\KGtThaD.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\dfVyPUR.exe
  C:\Windows\System\dfVyPUR.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\FUtTvgG.exe
  C:\Windows\System\FUtTvgG.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\OrVjWHA.exe
  C:\Windows\System\OrVjWHA.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\bQkAkdb.exe
  C:\Windows\System\bQkAkdb.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\wvmeCmN.exe
  C:\Windows\System\wvmeCmN.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\apmBaeN.exe
  C:\Windows\System\apmBaeN.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\BxYggee.exe
  C:\Windows\System\BxYggee.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\WKDzVpp.exe
  C:\Windows\System\WKDzVpp.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\gLKSeEM.exe
  C:\Windows\System\gLKSeEM.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\OvenkDv.exe
  C:\Windows\System\OvenkDv.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\zLhyxCy.exe
  C:\Windows\System\zLhyxCy.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\FwMPshB.exe
  C:\Windows\System\FwMPshB.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yKkjOGb.exe
  C:\Windows\System\yKkjOGb.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\lfhFWMS.exe
  C:\Windows\System\lfhFWMS.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\rKdNEdA.exe
  C:\Windows\System\rKdNEdA.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\IHAuPSv.exe
  C:\Windows\System\IHAuPSv.exe
  2⤵
  PID:2644
- C:\Windows\System\fUuQBrq.exe
  C:\Windows\System\fUuQBrq.exe
  2⤵
  PID:2676
- C:\Windows\System\tuZPcCN.exe
  C:\Windows\System\tuZPcCN.exe
  2⤵
  PID:1932
- C:\Windows\System\sLJksXs.exe
  C:\Windows\System\sLJksXs.exe
  2⤵
  PID:1228
- C:\Windows\System\vTdlAXn.exe
  C:\Windows\System\vTdlAXn.exe
  2⤵
  PID:2196
- C:\Windows\System\jAhWvqy.exe
  C:\Windows\System\jAhWvqy.exe
  2⤵
  PID:1276
- C:\Windows\System\CkKKGhL.exe
  C:\Windows\System\CkKKGhL.exe
  2⤵
  PID:2080
- C:\Windows\System\mcGTKSk.exe
  C:\Windows\System\mcGTKSk.exe
  2⤵
  PID:1048
- C:\Windows\System\wSCaBSv.exe
  C:\Windows\System\wSCaBSv.exe
  2⤵
  PID:2136
- C:\Windows\System\xFtdCTv.exe
  C:\Windows\System\xFtdCTv.exe
  2⤵
  PID:1532
- C:\Windows\System\jEPNquI.exe
  C:\Windows\System\jEPNquI.exe
  2⤵
  PID:2072
- C:\Windows\System\ZTSaGZr.exe
  C:\Windows\System\ZTSaGZr.exe
  2⤵
  PID:2024
- C:\Windows\System\vvzSeEp.exe
  C:\Windows\System\vvzSeEp.exe
  2⤵
  PID:2912
- C:\Windows\System\veXKbLR.exe
  C:\Windows\System\veXKbLR.exe
  2⤵
  PID:1644
- C:\Windows\System\EnqfISk.exe
  C:\Windows\System\EnqfISk.exe
  2⤵
  PID:452
- C:\Windows\System\IwYYyAo.exe
  C:\Windows\System\IwYYyAo.exe
  2⤵
  PID:844
- C:\Windows\System\IZBqVIx.exe
  C:\Windows\System\IZBqVIx.exe
  2⤵
  PID:1616
- C:\Windows\System\mcoiFgq.exe
  C:\Windows\System\mcoiFgq.exe
  2⤵
  PID:1824
- C:\Windows\System\CHiUeea.exe
  C:\Windows\System\CHiUeea.exe
  2⤵
  PID:688
- C:\Windows\System\MnTGdRq.exe
  C:\Windows\System\MnTGdRq.exe
  2⤵
  PID:880
- C:\Windows\System\WWYLqtC.exe
  C:\Windows\System\WWYLqtC.exe
  2⤵
  PID:1204
- C:\Windows\System\KrQgTut.exe
  C:\Windows\System\KrQgTut.exe
  2⤵
  PID:2888
- C:\Windows\System\heZclxt.exe
  C:\Windows\System\heZclxt.exe
  2⤵
  PID:2732
- C:\Windows\System\TORfXQU.exe
  C:\Windows\System\TORfXQU.exe
  2⤵
  PID:2148
- C:\Windows\System\lSZwibJ.exe
  C:\Windows\System\lSZwibJ.exe
  2⤵
  PID:876
- C:\Windows\System\zFwdDHD.exe
  C:\Windows\System\zFwdDHD.exe
  2⤵
  PID:1100
- C:\Windows\System\yrpLvlg.exe
  C:\Windows\System\yrpLvlg.exe
  2⤵
  PID:1280
- C:\Windows\System\YlYIySK.exe
  C:\Windows\System\YlYIySK.exe
  2⤵
  PID:2620
- C:\Windows\System\MjvdsYS.exe
  C:\Windows\System\MjvdsYS.exe
  2⤵
  PID:2632
- C:\Windows\System\kMLpfQd.exe
  C:\Windows\System\kMLpfQd.exe
  2⤵
  PID:2708
- C:\Windows\System\GKzkvUD.exe
  C:\Windows\System\GKzkvUD.exe
  2⤵
  PID:2460
- C:\Windows\System\KFHZmeL.exe
  C:\Windows\System\KFHZmeL.exe
  2⤵
  PID:2848
- C:\Windows\System\VsSgSpW.exe
  C:\Windows\System\VsSgSpW.exe
  2⤵
  PID:1624
- C:\Windows\System\ATWwTTH.exe
  C:\Windows\System\ATWwTTH.exe
  2⤵
  PID:2640
- C:\Windows\System\ZpisWrQ.exe
  C:\Windows\System\ZpisWrQ.exe
  2⤵
  PID:312
- C:\Windows\System\tDRappb.exe
  C:\Windows\System\tDRappb.exe
  2⤵
  PID:2500
- C:\Windows\System\gAsIUrE.exe
  C:\Windows\System\gAsIUrE.exe
  2⤵
  PID:1488
- C:\Windows\System\xSGfUDL.exe
  C:\Windows\System\xSGfUDL.exe
  2⤵
  PID:2864
- C:\Windows\System\hhpGZwd.exe
  C:\Windows\System\hhpGZwd.exe
  2⤵
  PID:1588
- C:\Windows\System\GkbgTWA.exe
  C:\Windows\System\GkbgTWA.exe
  2⤵
  PID:2452
- C:\Windows\System\bRjZOrR.exe
  C:\Windows\System\bRjZOrR.exe
  2⤵
  PID:1796
- C:\Windows\System\Eqhqcgv.exe
  C:\Windows\System\Eqhqcgv.exe
  2⤵
  PID:608
- C:\Windows\System\szRmbUL.exe
  C:\Windows\System\szRmbUL.exe
  2⤵
  PID:2224
- C:\Windows\System\EnqzeDL.exe
  C:\Windows\System\EnqzeDL.exe
  2⤵
  PID:1296
- C:\Windows\System\amUYjzW.exe
  C:\Windows\System\amUYjzW.exe
  2⤵
  PID:484
- C:\Windows\System\zbrILqX.exe
  C:\Windows\System\zbrILqX.exe
  2⤵
  PID:2796
- C:\Windows\System\DZlWSJP.exe
  C:\Windows\System\DZlWSJP.exe
  2⤵
  PID:1092
- C:\Windows\System\CJKKoXC.exe
  C:\Windows\System\CJKKoXC.exe
  2⤵
  PID:940
- C:\Windows\System\WUHoNlu.exe
  C:\Windows\System\WUHoNlu.exe
  2⤵
  PID:1860
- C:\Windows\System\UoWWPag.exe
  C:\Windows\System\UoWWPag.exe
  2⤵
  PID:552
- C:\Windows\System\YUTuCdO.exe
  C:\Windows\System\YUTuCdO.exe
  2⤵
  PID:2576
- C:\Windows\System\fbFdNWA.exe
  C:\Windows\System\fbFdNWA.exe
  2⤵
  PID:2476
- C:\Windows\System\mhyrBxt.exe
  C:\Windows\System\mhyrBxt.exe
  2⤵
  PID:2204
- C:\Windows\System\gMBZwYI.exe
  C:\Windows\System\gMBZwYI.exe
  2⤵
  PID:2368
- C:\Windows\System\rOGVfeI.exe
  C:\Windows\System\rOGVfeI.exe
  2⤵
  PID:1900
- C:\Windows\System\jIYURtF.exe
  C:\Windows\System\jIYURtF.exe
  2⤵
  PID:2588
- C:\Windows\System\syCKslu.exe
  C:\Windows\System\syCKslu.exe
  2⤵
  PID:2528
- C:\Windows\System\fSSpCrs.exe
  C:\Windows\System\fSSpCrs.exe
  2⤵
  PID:1008
- C:\Windows\System\YGiAZPk.exe
  C:\Windows\System\YGiAZPk.exe
  2⤵
  PID:2252
- C:\Windows\System\HvdgfkA.exe
  C:\Windows\System\HvdgfkA.exe
  2⤵
  PID:2420
- C:\Windows\System\Akefmww.exe
  C:\Windows\System\Akefmww.exe
  2⤵
  PID:1952
- C:\Windows\System\IEDjCZA.exe
  C:\Windows\System\IEDjCZA.exe
  2⤵
  PID:2064
- C:\Windows\System\WWiOCtl.exe
  C:\Windows\System\WWiOCtl.exe
  2⤵
  PID:2712
- C:\Windows\System\bjtbzdO.exe
  C:\Windows\System\bjtbzdO.exe
  2⤵
  PID:3064
- C:\Windows\System\gmSKvgu.exe
  C:\Windows\System\gmSKvgu.exe
  2⤵
  PID:748
- C:\Windows\System\EKwGUnv.exe
  C:\Windows\System\EKwGUnv.exe
  2⤵
  PID:2132
- C:\Windows\System\jItbnjM.exe
  C:\Windows\System\jItbnjM.exe
  2⤵
  PID:320
- C:\Windows\System\IBbkKzH.exe
  C:\Windows\System\IBbkKzH.exe
  2⤵
  PID:2856
- C:\Windows\System\DSvOOsh.exe
  C:\Windows\System\DSvOOsh.exe
  2⤵
  PID:904
- C:\Windows\System\oqYhXwi.exe
  C:\Windows\System\oqYhXwi.exe
  2⤵
  PID:2316
- C:\Windows\System\pXUOpeT.exe
  C:\Windows\System\pXUOpeT.exe
  2⤵
  PID:2952
- C:\Windows\System\OzbppHU.exe
  C:\Windows\System\OzbppHU.exe
  2⤵
  PID:2288
- C:\Windows\System\loeaODK.exe
  C:\Windows\System\loeaODK.exe
  2⤵
  PID:1800
- C:\Windows\System\SZrrZxm.exe
  C:\Windows\System\SZrrZxm.exe
  2⤵
  PID:1316
- C:\Windows\System\HVJkjof.exe
  C:\Windows\System\HVJkjof.exe
  2⤵
  PID:2408
- C:\Windows\System\bQmkaIM.exe
  C:\Windows\System\bQmkaIM.exe
  2⤵
  PID:1540
- C:\Windows\System\rDlVued.exe
  C:\Windows\System\rDlVued.exe
  2⤵
  PID:2752
- C:\Windows\System\ePqTizg.exe
  C:\Windows\System\ePqTizg.exe
  2⤵
  PID:2488
- C:\Windows\System\mrIzlzi.exe
  C:\Windows\System\mrIzlzi.exe
  2⤵
  PID:1908
- C:\Windows\System\YLQPKNL.exe
  C:\Windows\System\YLQPKNL.exe
  2⤵
  PID:2380
- C:\Windows\System\UDdkxki.exe
  C:\Windows\System\UDdkxki.exe
  2⤵
  PID:540
- C:\Windows\System\OToAndy.exe
  C:\Windows\System\OToAndy.exe
  2⤵
  PID:588
- C:\Windows\System\SRzCPyv.exe
  C:\Windows\System\SRzCPyv.exe
  2⤵
  PID:2992
- C:\Windows\System\GzlGNdi.exe
  C:\Windows\System\GzlGNdi.exe
  2⤵
  PID:1780
- C:\Windows\System\MFPjwCu.exe
  C:\Windows\System\MFPjwCu.exe
  2⤵
  PID:2432
- C:\Windows\System\BJxpJSP.exe
  C:\Windows\System\BJxpJSP.exe
  2⤵
  PID:1508
- C:\Windows\System\UJSzslG.exe
  C:\Windows\System\UJSzslG.exe
  2⤵
  PID:1208
- C:\Windows\System\WbkdmeP.exe
  C:\Windows\System\WbkdmeP.exe
  2⤵
  PID:2180
- C:\Windows\System\JAwirfs.exe
  C:\Windows\System\JAwirfs.exe
  2⤵
  PID:2232
- C:\Windows\System\ZjhMLOy.exe
  C:\Windows\System\ZjhMLOy.exe
  2⤵
  PID:1252
- C:\Windows\System\eiyckJX.exe
  C:\Windows\System\eiyckJX.exe
  2⤵
  PID:2344
- C:\Windows\System\JDUofgC.exe
  C:\Windows\System\JDUofgC.exe
  2⤵
  PID:2720
- C:\Windows\System\sVMjMyS.exe
  C:\Windows\System\sVMjMyS.exe
  2⤵
  PID:564
- C:\Windows\System\kFyZKGr.exe
  C:\Windows\System\kFyZKGr.exe
  2⤵
  PID:1812
- C:\Windows\System\jFuaTXk.exe
  C:\Windows\System\jFuaTXk.exe
  2⤵
  PID:1612
- C:\Windows\System\dcdUJmD.exe
  C:\Windows\System\dcdUJmD.exe
  2⤵
  PID:2876
- C:\Windows\System\WHTCfRI.exe
  C:\Windows\System\WHTCfRI.exe
  2⤵
  PID:2392
- C:\Windows\System\SFPwLmI.exe
  C:\Windows\System\SFPwLmI.exe
  2⤵
  PID:1676
- C:\Windows\System\ohmWLjv.exe
  C:\Windows\System\ohmWLjv.exe
  2⤵
  PID:1432
- C:\Windows\System\NaFKQTh.exe
  C:\Windows\System\NaFKQTh.exe
  2⤵
  PID:1840
- C:\Windows\System\mrSdGNY.exe
  C:\Windows\System\mrSdGNY.exe
  2⤵
  PID:2444
- C:\Windows\System\BNfwAjy.exe
  C:\Windows\System\BNfwAjy.exe
  2⤵
  PID:3088
- C:\Windows\System\uanNSsr.exe
  C:\Windows\System\uanNSsr.exe
  2⤵
  PID:3108
- C:\Windows\System\jtbMIuR.exe
  C:\Windows\System\jtbMIuR.exe
  2⤵
  PID:3128
- C:\Windows\System\tCcfiUa.exe
  C:\Windows\System\tCcfiUa.exe
  2⤵
  PID:3144
- C:\Windows\System\UCYYrHs.exe
  C:\Windows\System\UCYYrHs.exe
  2⤵
  PID:3172
- C:\Windows\System\vvdRsTx.exe
  C:\Windows\System\vvdRsTx.exe
  2⤵
  PID:3188
- C:\Windows\System\nnnQtWd.exe
  C:\Windows\System\nnnQtWd.exe
  2⤵
  PID:3204
- C:\Windows\System\zglEcUX.exe
  C:\Windows\System\zglEcUX.exe
  2⤵
  PID:3228
- C:\Windows\System\JenYgpz.exe
  C:\Windows\System\JenYgpz.exe
  2⤵
  PID:3248
- C:\Windows\System\gSRbkQZ.exe
  C:\Windows\System\gSRbkQZ.exe
  2⤵
  PID:3264
- C:\Windows\System\BQUhHEu.exe
  C:\Windows\System\BQUhHEu.exe
  2⤵
  PID:3292
- C:\Windows\System\tOjXhjj.exe
  C:\Windows\System\tOjXhjj.exe
  2⤵
  PID:3308
- C:\Windows\System\hBCTnVY.exe
  C:\Windows\System\hBCTnVY.exe
  2⤵
  PID:3332
- C:\Windows\System\QoHfonb.exe
  C:\Windows\System\QoHfonb.exe
  2⤵
  PID:3348
- C:\Windows\System\MXslxoH.exe
  C:\Windows\System\MXslxoH.exe
  2⤵
  PID:3364
- C:\Windows\System\uwSeSnP.exe
  C:\Windows\System\uwSeSnP.exe
  2⤵
  PID:3380
- C:\Windows\System\ziQTLKq.exe
  C:\Windows\System\ziQTLKq.exe
  2⤵
  PID:3396
- C:\Windows\System\cszOwNC.exe
  C:\Windows\System\cszOwNC.exe
  2⤵
  PID:3412
- C:\Windows\System\srqYCak.exe
  C:\Windows\System\srqYCak.exe
  2⤵
  PID:3432
- C:\Windows\System\XPWeIha.exe
  C:\Windows\System\XPWeIha.exe
  2⤵
  PID:3448
- C:\Windows\System\QsZMyja.exe
  C:\Windows\System\QsZMyja.exe
  2⤵
  PID:3464
- C:\Windows\System\bBRInrp.exe
  C:\Windows\System\bBRInrp.exe
  2⤵
  PID:3500
- C:\Windows\System\fTNraZq.exe
  C:\Windows\System\fTNraZq.exe
  2⤵
  PID:3524
- C:\Windows\System\woaMTlc.exe
  C:\Windows\System\woaMTlc.exe
  2⤵
  PID:3540
- C:\Windows\System\hXWSgjM.exe
  C:\Windows\System\hXWSgjM.exe
  2⤵
  PID:3556
- C:\Windows\System\CLERbqe.exe
  C:\Windows\System\CLERbqe.exe
  2⤵
  PID:3572
- C:\Windows\System\EOMSxit.exe
  C:\Windows\System\EOMSxit.exe
  2⤵
  PID:3588
- C:\Windows\System\lGWBiOM.exe
  C:\Windows\System\lGWBiOM.exe
  2⤵
  PID:3604
- C:\Windows\System\OKEJWdU.exe
  C:\Windows\System\OKEJWdU.exe
  2⤵
  PID:3620
- C:\Windows\System\DCcYVSg.exe
  C:\Windows\System\DCcYVSg.exe
  2⤵
  PID:3636
- C:\Windows\System\IFAqGHV.exe
  C:\Windows\System\IFAqGHV.exe
  2⤵
  PID:3656
- C:\Windows\System\fILmgrI.exe
  C:\Windows\System\fILmgrI.exe
  2⤵
  PID:3672
- C:\Windows\System\kCXvLds.exe
  C:\Windows\System\kCXvLds.exe
  2⤵
  PID:3688
- C:\Windows\System\vvaopOv.exe
  C:\Windows\System\vvaopOv.exe
  2⤵
  PID:3752
- C:\Windows\System\wZOQASV.exe
  C:\Windows\System\wZOQASV.exe
  2⤵
  PID:3768
- C:\Windows\System\VjzPNvw.exe
  C:\Windows\System\VjzPNvw.exe
  2⤵
  PID:3784
- C:\Windows\System\BAkFggF.exe
  C:\Windows\System\BAkFggF.exe
  2⤵
  PID:3800
- C:\Windows\System\VUxwbgL.exe
  C:\Windows\System\VUxwbgL.exe
  2⤵
  PID:3816
- C:\Windows\System\tjXYEKH.exe
  C:\Windows\System\tjXYEKH.exe
  2⤵
  PID:3832
- C:\Windows\System\BuqLRxP.exe
  C:\Windows\System\BuqLRxP.exe
  2⤵
  PID:3856
- C:\Windows\System\GsCCuKd.exe
  C:\Windows\System\GsCCuKd.exe
  2⤵
  PID:3872
- C:\Windows\System\LNKybDs.exe
  C:\Windows\System\LNKybDs.exe
  2⤵
  PID:3888
- C:\Windows\System\COeDNoZ.exe
  C:\Windows\System\COeDNoZ.exe
  2⤵
  PID:3904
- C:\Windows\System\fqfszYn.exe
  C:\Windows\System\fqfszYn.exe
  2⤵
  PID:3924
- C:\Windows\System\oFfvlie.exe
  C:\Windows\System\oFfvlie.exe
  2⤵
  PID:3940
- C:\Windows\System\nCHgTuc.exe
  C:\Windows\System\nCHgTuc.exe
  2⤵
  PID:3956
- C:\Windows\System\KADfGJo.exe
  C:\Windows\System\KADfGJo.exe
  2⤵
  PID:3972
- C:\Windows\System\XIgGVYL.exe
  C:\Windows\System\XIgGVYL.exe
  2⤵
  PID:3988
- C:\Windows\System\sPeAZos.exe
  C:\Windows\System\sPeAZos.exe
  2⤵
  PID:4004
- C:\Windows\System\zWHXcfp.exe
  C:\Windows\System\zWHXcfp.exe
  2⤵
  PID:4024
- C:\Windows\System\orSXhtf.exe
  C:\Windows\System\orSXhtf.exe
  2⤵
  PID:4040
- C:\Windows\System\aLFCbid.exe
  C:\Windows\System\aLFCbid.exe
  2⤵
  PID:4056
- C:\Windows\System\YpaHPDS.exe
  C:\Windows\System\YpaHPDS.exe
  2⤵
  PID:4076
- C:\Windows\System\YdSYdxj.exe
  C:\Windows\System\YdSYdxj.exe
  2⤵
  PID:4092
- C:\Windows\System\bCQHVVJ.exe
  C:\Windows\System\bCQHVVJ.exe
  2⤵
  PID:2248
- C:\Windows\System\ZCXhTlb.exe
  C:\Windows\System\ZCXhTlb.exe
  2⤵
  PID:2484
- C:\Windows\System\jXVzLcJ.exe
  C:\Windows\System\jXVzLcJ.exe
  2⤵
  PID:2360
- C:\Windows\System\bWSGdhE.exe
  C:\Windows\System\bWSGdhE.exe
  2⤵
  PID:2656
- C:\Windows\System\VsJWvkE.exe
  C:\Windows\System\VsJWvkE.exe
  2⤵
  PID:3076
- C:\Windows\System\ifNpKod.exe
  C:\Windows\System\ifNpKod.exe
  2⤵
  PID:2092
- C:\Windows\System\FzHtvOm.exe
  C:\Windows\System\FzHtvOm.exe
  2⤵
  PID:3216
- C:\Windows\System\hTQYuIj.exe
  C:\Windows\System\hTQYuIj.exe
  2⤵
  PID:3244
- C:\Windows\System\BLhVtNm.exe
  C:\Windows\System\BLhVtNm.exe
  2⤵
  PID:3272
- C:\Windows\System\qMQVEkZ.exe
  C:\Windows\System\qMQVEkZ.exe
  2⤵
  PID:3304
- C:\Windows\System\FJpeVdw.exe
  C:\Windows\System\FJpeVdw.exe
  2⤵
  PID:3320
- C:\Windows\System\CdBudfI.exe
  C:\Windows\System\CdBudfI.exe
  2⤵
  PID:3404
- C:\Windows\System\aFhkNYO.exe
  C:\Windows\System\aFhkNYO.exe
  2⤵
  PID:3388
- C:\Windows\System\MgZYogN.exe
  C:\Windows\System\MgZYogN.exe
  2⤵
  PID:3372
- C:\Windows\System\mAeSlfS.exe
  C:\Windows\System\mAeSlfS.exe
  2⤵
  PID:3456
- C:\Windows\System\oViBsjb.exe
  C:\Windows\System\oViBsjb.exe
  2⤵
  PID:3492
- C:\Windows\System\jsEDBzp.exe
  C:\Windows\System\jsEDBzp.exe
  2⤵
  PID:3536
- C:\Windows\System\ZdhdtZp.exe
  C:\Windows\System\ZdhdtZp.exe
  2⤵
  PID:3512
- C:\Windows\System\uKMejAO.exe
  C:\Windows\System\uKMejAO.exe
  2⤵
  PID:3548
- C:\Windows\System\RsVfLWa.exe
  C:\Windows\System\RsVfLWa.exe
  2⤵
  PID:3616
- C:\Windows\System\WRABGTX.exe
  C:\Windows\System\WRABGTX.exe
  2⤵
  PID:3648
- C:\Windows\System\QmCEssm.exe
  C:\Windows\System\QmCEssm.exe
  2⤵
  PID:3480
- C:\Windows\System\bFMgXtp.exe
  C:\Windows\System\bFMgXtp.exe
  2⤵
  PID:3712
- C:\Windows\System\CWiTuGx.exe
  C:\Windows\System\CWiTuGx.exe
  2⤵
  PID:3740
- C:\Windows\System\tdVAwBc.exe
  C:\Windows\System\tdVAwBc.exe
  2⤵
  PID:3696
- C:\Windows\System\IWRlTNq.exe
  C:\Windows\System\IWRlTNq.exe
  2⤵
  PID:3812
- C:\Windows\System\pdAoYGK.exe
  C:\Windows\System\pdAoYGK.exe
  2⤵
  PID:3700
- C:\Windows\System\FrpCEPW.exe
  C:\Windows\System\FrpCEPW.exe
  2⤵
  PID:3948
- C:\Windows\System\mUbRvIZ.exe
  C:\Windows\System\mUbRvIZ.exe
  2⤵
  PID:3780
- C:\Windows\System\BBTBmIZ.exe
  C:\Windows\System\BBTBmIZ.exe
  2⤵
  PID:908
- C:\Windows\System\eWDQFgg.exe
  C:\Windows\System\eWDQFgg.exe
  2⤵
  PID:3900
- C:\Windows\System\QieUIMQ.exe
  C:\Windows\System\QieUIMQ.exe
  2⤵
  PID:4000
- C:\Windows\System\aNawTme.exe
  C:\Windows\System\aNawTme.exe
  2⤵
  PID:1428
- C:\Windows\System\ayAwwTd.exe
  C:\Windows\System\ayAwwTd.exe
  2⤵
  PID:2564
- C:\Windows\System\egJTbUa.exe
  C:\Windows\System\egJTbUa.exe
  2⤵
  PID:3084
- C:\Windows\System\VoiPmaV.exe
  C:\Windows\System\VoiPmaV.exe
  2⤵
  PID:3116
- C:\Windows\System\nFuYrYo.exe
  C:\Windows\System\nFuYrYo.exe
  2⤵
  PID:3140
- C:\Windows\System\pztGqrI.exe
  C:\Windows\System\pztGqrI.exe
  2⤵
  PID:3168
- C:\Windows\System\uGbQvTW.exe
  C:\Windows\System\uGbQvTW.exe
  2⤵
  PID:3200
- C:\Windows\System\xGWMLxh.exe
  C:\Windows\System\xGWMLxh.exe
  2⤵
  PID:3236
- C:\Windows\System\bibmDfx.exe
  C:\Windows\System\bibmDfx.exe
  2⤵
  PID:3300
- C:\Windows\System\aRRuuTv.exe
  C:\Windows\System\aRRuuTv.exe
  2⤵
  PID:3392
- C:\Windows\System\HqHHGWN.exe
  C:\Windows\System\HqHHGWN.exe
  2⤵
  PID:3628
- C:\Windows\System\yYhMXsJ.exe
  C:\Windows\System\yYhMXsJ.exe
  2⤵
  PID:3664
- C:\Windows\System\obQeLuP.exe
  C:\Windows\System\obQeLuP.exe
  2⤵
  PID:3516
- C:\Windows\System\RzJKBGk.exe
  C:\Windows\System\RzJKBGk.exe
  2⤵
  PID:3704
- C:\Windows\System\eKzwKhC.exe
  C:\Windows\System\eKzwKhC.exe
  2⤵
  PID:4016
- C:\Windows\System\gHwbnhD.exe
  C:\Windows\System\gHwbnhD.exe
  2⤵
  PID:3808
- C:\Windows\System\OTRWsMc.exe
  C:\Windows\System\OTRWsMc.exe
  2⤵
  PID:3844
- C:\Windows\System\UFJeohN.exe
  C:\Windows\System\UFJeohN.exe
  2⤵
  PID:3984
- C:\Windows\System\NbXfwHF.exe
  C:\Windows\System\NbXfwHF.exe
  2⤵
  PID:3824
- C:\Windows\System\HgACYTk.exe
  C:\Windows\System\HgACYTk.exe
  2⤵
  PID:4084
- C:\Windows\System\dHYTAzV.exe
  C:\Windows\System\dHYTAzV.exe
  2⤵
  PID:3584
- C:\Windows\System\CSdLmqe.exe
  C:\Windows\System\CSdLmqe.exe
  2⤵
  PID:3996
- C:\Windows\System\HDZNShf.exe
  C:\Windows\System\HDZNShf.exe
  2⤵
  PID:4068
- C:\Windows\System\yOZOKMu.exe
  C:\Windows\System\yOZOKMu.exe
  2⤵
  PID:2700
- C:\Windows\System\PeybFot.exe
  C:\Windows\System\PeybFot.exe
  2⤵
  PID:2736
- C:\Windows\System\kuhxpDY.exe
  C:\Windows\System\kuhxpDY.exe
  2⤵
  PID:2076
- C:\Windows\System\fnsqviA.exe
  C:\Windows\System\fnsqviA.exe
  2⤵
  PID:3184
- C:\Windows\System\xjpyTtj.exe
  C:\Windows\System\xjpyTtj.exe
  2⤵
  PID:3220
- C:\Windows\System\iWmJHxc.exe
  C:\Windows\System\iWmJHxc.exe
  2⤵
  PID:3324
- C:\Windows\System\KERwLRJ.exe
  C:\Windows\System\KERwLRJ.exe
  2⤵
  PID:3684
- C:\Windows\System\leUjWIW.exe
  C:\Windows\System\leUjWIW.exe
  2⤵
  PID:3424
- C:\Windows\System\YaZBOzo.exe
  C:\Windows\System\YaZBOzo.exe
  2⤵
  PID:400
- C:\Windows\System\YSpbZVG.exe
  C:\Windows\System\YSpbZVG.exe
  2⤵
  PID:3880
- C:\Windows\System\ICRUlao.exe
  C:\Windows\System\ICRUlao.exe
  2⤵
  PID:3764
- C:\Windows\System\mSVeRMk.exe
  C:\Windows\System\mSVeRMk.exe
  2⤵
  PID:3920
- C:\Windows\System\qILkxjP.exe
  C:\Windows\System\qILkxjP.exe
  2⤵
  PID:3868
- C:\Windows\System\zOoZkaB.exe
  C:\Windows\System\zOoZkaB.exe
  2⤵
  PID:3596
- C:\Windows\System\FNHDzeF.exe
  C:\Windows\System\FNHDzeF.exe
  2⤵
  PID:3936
- C:\Windows\System\ucBZqoA.exe
  C:\Windows\System\ucBZqoA.exe
  2⤵
  PID:3096
- C:\Windows\System\rhdSGyc.exe
  C:\Windows\System\rhdSGyc.exe
  2⤵
  PID:2652
- C:\Windows\System\YcqSfBJ.exe
  C:\Windows\System\YcqSfBJ.exe
  2⤵
  PID:2716
- C:\Windows\System\fREdhIj.exe
  C:\Windows\System\fREdhIj.exe
  2⤵
  PID:3328
- C:\Windows\System\kOfbFDE.exe
  C:\Windows\System\kOfbFDE.exe
  2⤵
  PID:3488
- C:\Windows\System\edJBGRn.exe
  C:\Windows\System\edJBGRn.exe
  2⤵
  PID:3720
- C:\Windows\System\CfGJZGE.exe
  C:\Windows\System\CfGJZGE.exe
  2⤵
  PID:3668
- C:\Windows\System\tfrGHvS.exe
  C:\Windows\System\tfrGHvS.exe
  2⤵
  PID:2852
- C:\Windows\System\JuCZjoQ.exe
  C:\Windows\System\JuCZjoQ.exe
  2⤵
  PID:3884
- C:\Windows\System\CUPcogF.exe
  C:\Windows\System\CUPcogF.exe
  2⤵
  PID:3896
- C:\Windows\System\WTuIjUE.exe
  C:\Windows\System\WTuIjUE.exe
  2⤵
  PID:2880
- C:\Windows\System\uVAShYj.exe
  C:\Windows\System\uVAShYj.exe
  2⤵
  PID:3532
- C:\Windows\System\GslyEtn.exe
  C:\Windows\System\GslyEtn.exe
  2⤵
  PID:3164
- C:\Windows\System\hPylJTG.exe
  C:\Windows\System\hPylJTG.exe
  2⤵
  PID:2524
- C:\Windows\System\MmKAhnN.exe
  C:\Windows\System\MmKAhnN.exe
  2⤵
  PID:4104
- C:\Windows\System\XDfkokc.exe
  C:\Windows\System\XDfkokc.exe
  2⤵
  PID:4120
- C:\Windows\System\orJQKrK.exe
  C:\Windows\System\orJQKrK.exe
  2⤵
  PID:4192
- C:\Windows\System\mwLvTOj.exe
  C:\Windows\System\mwLvTOj.exe
  2⤵
  PID:4208
- C:\Windows\System\dYOknmA.exe
  C:\Windows\System\dYOknmA.exe
  2⤵
  PID:4224
- C:\Windows\System\QIvBTVi.exe
  C:\Windows\System\QIvBTVi.exe
  2⤵
  PID:4248
- C:\Windows\System\sxkOLWF.exe
  C:\Windows\System\sxkOLWF.exe
  2⤵
  PID:4264
- C:\Windows\System\xPPYVUZ.exe
  C:\Windows\System\xPPYVUZ.exe
  2⤵
  PID:4284
- C:\Windows\System\dlrdLee.exe
  C:\Windows\System\dlrdLee.exe
  2⤵
  PID:4308
- C:\Windows\System\HAYquJO.exe
  C:\Windows\System\HAYquJO.exe
  2⤵
  PID:4332
- C:\Windows\System\hqXzsvK.exe
  C:\Windows\System\hqXzsvK.exe
  2⤵
  PID:4348
- C:\Windows\System\zzyRsfz.exe
  C:\Windows\System\zzyRsfz.exe
  2⤵
  PID:4364
- C:\Windows\System\JjLkmdt.exe
  C:\Windows\System\JjLkmdt.exe
  2⤵
  PID:4388
- C:\Windows\System\GwhVAKX.exe
  C:\Windows\System\GwhVAKX.exe
  2⤵
  PID:4404
- C:\Windows\System\jCqhkob.exe
  C:\Windows\System\jCqhkob.exe
  2⤵
  PID:4436
- C:\Windows\System\lPxqSkD.exe
  C:\Windows\System\lPxqSkD.exe
  2⤵
  PID:4468
- C:\Windows\System\gqWbobc.exe
  C:\Windows\System\gqWbobc.exe
  2⤵
  PID:4488
- C:\Windows\System\YhClnrb.exe
  C:\Windows\System\YhClnrb.exe
  2⤵
  PID:4504
- C:\Windows\System\wYNiVPI.exe
  C:\Windows\System\wYNiVPI.exe
  2⤵
  PID:4532
- C:\Windows\System\QuuQghS.exe
  C:\Windows\System\QuuQghS.exe
  2⤵
  PID:4560
- C:\Windows\System\LoyESJk.exe
  C:\Windows\System\LoyESJk.exe
  2⤵
  PID:4576
- C:\Windows\System\qBbCjoD.exe
  C:\Windows\System\qBbCjoD.exe
  2⤵
  PID:4596
- C:\Windows\System\vgYYKBQ.exe
  C:\Windows\System\vgYYKBQ.exe
  2⤵
  PID:4612
- C:\Windows\System\IXQOHqy.exe
  C:\Windows\System\IXQOHqy.exe
  2⤵
  PID:4636
- C:\Windows\System\ZfQwdXx.exe
  C:\Windows\System\ZfQwdXx.exe
  2⤵
  PID:4656
- C:\Windows\System\RZHovpP.exe
  C:\Windows\System\RZHovpP.exe
  2⤵
  PID:4680
- C:\Windows\System\sAwWEvy.exe
  C:\Windows\System\sAwWEvy.exe
  2⤵
  PID:4696
- C:\Windows\System\RMOfGyN.exe
  C:\Windows\System\RMOfGyN.exe
  2⤵
  PID:4712
- C:\Windows\System\Dwcedsh.exe
  C:\Windows\System\Dwcedsh.exe
  2⤵
  PID:4732
- C:\Windows\System\JGfESSM.exe
  C:\Windows\System\JGfESSM.exe
  2⤵
  PID:4748
- C:\Windows\System\DjErfoE.exe
  C:\Windows\System\DjErfoE.exe
  2⤵
  PID:4768
- C:\Windows\System\sTzBKhP.exe
  C:\Windows\System\sTzBKhP.exe
  2⤵
  PID:4792
- C:\Windows\System\CsoiuQc.exe
  C:\Windows\System\CsoiuQc.exe
  2⤵
  PID:4812
- C:\Windows\System\ArMPXYz.exe
  C:\Windows\System\ArMPXYz.exe
  2⤵
  PID:4844
- C:\Windows\System\YDJQrdR.exe
  C:\Windows\System\YDJQrdR.exe
  2⤵
  PID:4860
- C:\Windows\System\ilxhOuk.exe
  C:\Windows\System\ilxhOuk.exe
  2⤵
  PID:4884
- C:\Windows\System\vKNcayw.exe
  C:\Windows\System\vKNcayw.exe
  2⤵
  PID:4924
- C:\Windows\System\eAsBJvq.exe
  C:\Windows\System\eAsBJvq.exe
  2⤵
  PID:4940
- C:\Windows\System\tkvZfwy.exe
  C:\Windows\System\tkvZfwy.exe
  2⤵
  PID:4956
- C:\Windows\System\bWTLTFf.exe
  C:\Windows\System\bWTLTFf.exe
  2⤵
  PID:4972
- C:\Windows\System\nQloJzp.exe
  C:\Windows\System\nQloJzp.exe
  2⤵
  PID:4988
- C:\Windows\System\JKLMauY.exe
  C:\Windows\System\JKLMauY.exe
  2⤵
  PID:5004
- C:\Windows\System\PKWalTP.exe
  C:\Windows\System\PKWalTP.exe
  2⤵
  PID:5020
- C:\Windows\System\ZuSNbSN.exe
  C:\Windows\System\ZuSNbSN.exe
  2⤵
  PID:5036
- C:\Windows\System\lMPSaEe.exe
  C:\Windows\System\lMPSaEe.exe
  2⤵
  PID:5056
- C:\Windows\System\IpSPEXm.exe
  C:\Windows\System\IpSPEXm.exe
  2⤵
  PID:5072
- C:\Windows\System\YrukRsS.exe
  C:\Windows\System\YrukRsS.exe
  2⤵
  PID:5088
- C:\Windows\System\NXkIWjJ.exe
  C:\Windows\System\NXkIWjJ.exe
  2⤵
  PID:5104
- C:\Windows\System\iLhvOKL.exe
  C:\Windows\System\iLhvOKL.exe
  2⤵
  PID:4116
- C:\Windows\System\tvSvCEz.exe
  C:\Windows\System\tvSvCEz.exe
  2⤵
  PID:4064
- C:\Windows\System\MJmSqCz.exe
  C:\Windows\System\MJmSqCz.exe
  2⤵
  PID:3848
- C:\Windows\System\PWghZJe.exe
  C:\Windows\System\PWghZJe.exe
  2⤵
  PID:3568
- C:\Windows\System\HfjSbZP.exe
  C:\Windows\System\HfjSbZP.exe
  2⤵
  PID:3180
- C:\Windows\System\ihvOCmx.exe
  C:\Windows\System\ihvOCmx.exe
  2⤵
  PID:3344
- C:\Windows\System\vQSWiMj.exe
  C:\Windows\System\vQSWiMj.exe
  2⤵
  PID:4136
- C:\Windows\System\SuADlzp.exe
  C:\Windows\System\SuADlzp.exe
  2⤵
  PID:4152
- C:\Windows\System\EFuhBWS.exe
  C:\Windows\System\EFuhBWS.exe
  2⤵
  PID:4168
- C:\Windows\System\LzSPktD.exe
  C:\Windows\System\LzSPktD.exe
  2⤵
  PID:4188
- C:\Windows\System\CLNrxGr.exe
  C:\Windows\System\CLNrxGr.exe
  2⤵
  PID:4220
- C:\Windows\System\dtNYfjl.exe
  C:\Windows\System\dtNYfjl.exe
  2⤵
  PID:4236
- C:\Windows\System\keNwjMm.exe
  C:\Windows\System\keNwjMm.exe
  2⤵
  PID:4276
- C:\Windows\System\fMBCSMK.exe
  C:\Windows\System\fMBCSMK.exe
  2⤵
  PID:4304
- C:\Windows\System\PWmlSSb.exe
  C:\Windows\System\PWmlSSb.exe
  2⤵
  PID:4356
- C:\Windows\System\CwUIrzA.exe
  C:\Windows\System\CwUIrzA.exe
  2⤵
  PID:4396
- C:\Windows\System\gKjIDET.exe
  C:\Windows\System\gKjIDET.exe
  2⤵
  PID:4452
- C:\Windows\System\ZkchSbR.exe
  C:\Windows\System\ZkchSbR.exe
  2⤵
  PID:4456
- C:\Windows\System\ehlZxhI.exe
  C:\Windows\System\ehlZxhI.exe
  2⤵
  PID:4412
- C:\Windows\System\npjgtwh.exe
  C:\Windows\System\npjgtwh.exe
  2⤵
  PID:4540
- C:\Windows\System\hoDDglv.exe
  C:\Windows\System\hoDDglv.exe
  2⤵
  PID:4544
- C:\Windows\System\FBPwXue.exe
  C:\Windows\System\FBPwXue.exe
  2⤵
  PID:4428
- C:\Windows\System\mrZSjgb.exe
  C:\Windows\System\mrZSjgb.exe
  2⤵
  PID:4476
- C:\Windows\System\VYaAIsf.exe
  C:\Windows\System\VYaAIsf.exe
  2⤵
  PID:4528
- C:\Windows\System\TEJaDuH.exe
  C:\Windows\System\TEJaDuH.exe
  2⤵
  PID:4588
- C:\Windows\System\coaZXma.exe
  C:\Windows\System\coaZXma.exe
  2⤵
  PID:4604
- C:\Windows\System\LqxjryV.exe
  C:\Windows\System\LqxjryV.exe
  2⤵
  PID:4788
- C:\Windows\System\DzZuFKu.exe
  C:\Windows\System\DzZuFKu.exe
  2⤵
  PID:4832
- C:\Windows\System\brpyCsq.exe
  C:\Windows\System\brpyCsq.exe
  2⤵
  PID:4648
- C:\Windows\System\rZhOcep.exe
  C:\Windows\System\rZhOcep.exe
  2⤵
  PID:4720
- C:\Windows\System\fpaKjIv.exe
  C:\Windows\System\fpaKjIv.exe
  2⤵
  PID:4764
- C:\Windows\System\oSNbFis.exe
  C:\Windows\System\oSNbFis.exe
  2⤵
  PID:4836
- C:\Windows\System\qLVydIM.exe
  C:\Windows\System\qLVydIM.exe
  2⤵
  PID:4856
- C:\Windows\System\vgLOWSR.exe
  C:\Windows\System\vgLOWSR.exe
  2⤵
  PID:4896
- C:\Windows\System\fCxlREX.exe
  C:\Windows\System\fCxlREX.exe
  2⤵
  PID:1672
- C:\Windows\System\oskZJHk.exe
  C:\Windows\System\oskZJHk.exe
  2⤵
  PID:1636
- C:\Windows\System\ZkiUTWl.exe
  C:\Windows\System\ZkiUTWl.exe
  2⤵
  PID:4968
- C:\Windows\System\URLjguH.exe
  C:\Windows\System\URLjguH.exe
  2⤵
  PID:5032
- C:\Windows\System\STZYArf.exe
  C:\Windows\System\STZYArf.exe
  2⤵
  PID:5096
- C:\Windows\System\eOYvsDZ.exe
  C:\Windows\System\eOYvsDZ.exe
  2⤵
  PID:3360
- C:\Windows\System\vmrDqiU.exe
  C:\Windows\System\vmrDqiU.exe
  2⤵
  PID:4176
- C:\Windows\System\YvWrfjN.exe
  C:\Windows\System\YvWrfjN.exe
  2⤵
  PID:4292
- C:\Windows\System\XUZxCxw.exe
  C:\Windows\System\XUZxCxw.exe
  2⤵
  PID:4100
- C:\Windows\System\DlWzthS.exe
  C:\Windows\System\DlWzthS.exe
  2⤵
  PID:3864
- C:\Windows\System\febwHkA.exe
  C:\Windows\System\febwHkA.exe
  2⤵
  PID:4260
- C:\Windows\System\oTgTUdr.exe
  C:\Windows\System\oTgTUdr.exe
  2⤵
  PID:4952
- C:\Windows\System\BorkoAF.exe
  C:\Windows\System\BorkoAF.exe
  2⤵
  PID:5052
- C:\Windows\System\foDuNPw.exe
  C:\Windows\System\foDuNPw.exe
  2⤵
  PID:4516
- C:\Windows\System\hXmeUlZ.exe
  C:\Windows\System\hXmeUlZ.exe
  2⤵
  PID:4780
- C:\Windows\System\auruFRH.exe
  C:\Windows\System\auruFRH.exe
  2⤵
  PID:4688
- C:\Windows\System\TLgnUCL.exe
  C:\Windows\System\TLgnUCL.exe
  2⤵
  PID:4756
- C:\Windows\System\MQhfYiH.exe
  C:\Windows\System\MQhfYiH.exe
  2⤵
  PID:4912
- C:\Windows\System\OelgYTG.exe
  C:\Windows\System\OelgYTG.exe
  2⤵
  PID:4872
- C:\Windows\System\boBUtQh.exe
  C:\Windows\System\boBUtQh.exe
  2⤵
  PID:5068
- C:\Windows\System\HWSCsoD.exe
  C:\Windows\System\HWSCsoD.exe
  2⤵
  PID:3212
- C:\Windows\System\pyjGoRK.exe
  C:\Windows\System\pyjGoRK.exe
  2⤵
  PID:4160
- C:\Windows\System\xNbrrtD.exe
  C:\Windows\System\xNbrrtD.exe
  2⤵
  PID:4608
- C:\Windows\System\MYtyaqR.exe
  C:\Windows\System\MYtyaqR.exe
  2⤵
  PID:4904
- C:\Windows\System\jNtizPB.exe
  C:\Windows\System\jNtizPB.exe
  2⤵
  PID:4936
- C:\Windows\System\MiaGDDz.exe
  C:\Windows\System\MiaGDDz.exe
  2⤵
  PID:2020
- C:\Windows\System\JeNvtGt.exe
  C:\Windows\System\JeNvtGt.exe
  2⤵
  PID:4180
- C:\Windows\System\yIJOSCU.exe
  C:\Windows\System\yIJOSCU.exe
  2⤵
  PID:5012
- C:\Windows\System\isLUnHz.exe
  C:\Windows\System\isLUnHz.exe
  2⤵
  PID:4708
- C:\Windows\System\sDSzZqx.exe
  C:\Windows\System\sDSzZqx.exe
  2⤵
  PID:4360
- C:\Windows\System\XjSGzTC.exe
  C:\Windows\System\XjSGzTC.exe
  2⤵
  PID:4448
- C:\Windows\System\sXhuGkQ.exe
  C:\Windows\System\sXhuGkQ.exe
  2⤵
  PID:4144
- C:\Windows\System\osBHohS.exe
  C:\Windows\System\osBHohS.exe
  2⤵
  PID:1688
- C:\Windows\System\YHaPIFk.exe
  C:\Windows\System\YHaPIFk.exe
  2⤵
  PID:4572
- C:\Windows\System\OPBzlEM.exe
  C:\Windows\System\OPBzlEM.exe
  2⤵
  PID:3100
- C:\Windows\System\qwgmncP.exe
  C:\Windows\System\qwgmncP.exe
  2⤵
  PID:4316
- C:\Windows\System\aUhjEYU.exe
  C:\Windows\System\aUhjEYU.exe
  2⤵
  PID:4512
- C:\Windows\System\yExuIYm.exe
  C:\Windows\System\yExuIYm.exe
  2⤵
  PID:5112
- C:\Windows\System\rCoipLh.exe
  C:\Windows\System\rCoipLh.exe
  2⤵
  PID:4980
- C:\Windows\System\AYVNumt.exe
  C:\Windows\System\AYVNumt.exe
  2⤵
  PID:5124
- C:\Windows\System\UDXCiJH.exe
  C:\Windows\System\UDXCiJH.exe
  2⤵
  PID:5140
- C:\Windows\System\jxDYGut.exe
  C:\Windows\System\jxDYGut.exe
  2⤵
  PID:5156
- C:\Windows\System\DbJFxry.exe
  C:\Windows\System\DbJFxry.exe
  2⤵
  PID:5172
- C:\Windows\System\XmJHOxS.exe
  C:\Windows\System\XmJHOxS.exe
  2⤵
  PID:5188
- C:\Windows\System\TKhtKhu.exe
  C:\Windows\System\TKhtKhu.exe
  2⤵
  PID:5204
- C:\Windows\System\hxqysCw.exe
  C:\Windows\System\hxqysCw.exe
  2⤵
  PID:5220
- C:\Windows\System\BKDkdzG.exe
  C:\Windows\System\BKDkdzG.exe
  2⤵
  PID:5236
- C:\Windows\System\DrxpNZR.exe
  C:\Windows\System\DrxpNZR.exe
  2⤵
  PID:5252
- C:\Windows\System\ZXTSEtq.exe
  C:\Windows\System\ZXTSEtq.exe
  2⤵
  PID:5268
- C:\Windows\System\ehCwBWB.exe
  C:\Windows\System\ehCwBWB.exe
  2⤵
  PID:5284
- C:\Windows\System\MxFUDUZ.exe
  C:\Windows\System\MxFUDUZ.exe
  2⤵
  PID:5300
- C:\Windows\System\MlqYbPf.exe
  C:\Windows\System\MlqYbPf.exe
  2⤵
  PID:5316
- C:\Windows\System\nyjdFiv.exe
  C:\Windows\System\nyjdFiv.exe
  2⤵
  PID:5332
- C:\Windows\System\IaJKUQn.exe
  C:\Windows\System\IaJKUQn.exe
  2⤵
  PID:5356
- C:\Windows\System\OvWWSTN.exe
  C:\Windows\System\OvWWSTN.exe
  2⤵
  PID:5372
- C:\Windows\System\VKkSiWV.exe
  C:\Windows\System\VKkSiWV.exe
  2⤵
  PID:5388
- C:\Windows\System\BFSzOPF.exe
  C:\Windows\System\BFSzOPF.exe
  2⤵
  PID:5404
- C:\Windows\System\dKSPBvi.exe
  C:\Windows\System\dKSPBvi.exe
  2⤵
  PID:5420
- C:\Windows\System\SsDSYWm.exe
  C:\Windows\System\SsDSYWm.exe
  2⤵
  PID:5436
- C:\Windows\System\iFQngbs.exe
  C:\Windows\System\iFQngbs.exe
  2⤵
  PID:5452
- C:\Windows\System\vxYtTet.exe
  C:\Windows\System\vxYtTet.exe
  2⤵
  PID:5468
- C:\Windows\System\GnpnIvH.exe
  C:\Windows\System\GnpnIvH.exe
  2⤵
  PID:5484
- C:\Windows\System\KzDFilt.exe
  C:\Windows\System\KzDFilt.exe
  2⤵
  PID:5500
- C:\Windows\System\SohJPgJ.exe
  C:\Windows\System\SohJPgJ.exe
  2⤵
  PID:5516
- C:\Windows\System\ojYUGuH.exe
  C:\Windows\System\ojYUGuH.exe
  2⤵
  PID:5532
- C:\Windows\System\LOGFKie.exe
  C:\Windows\System\LOGFKie.exe
  2⤵
  PID:5548
- C:\Windows\System\wIGGBnB.exe
  C:\Windows\System\wIGGBnB.exe
  2⤵
  PID:5564
- C:\Windows\System\DbNMMtx.exe
  C:\Windows\System\DbNMMtx.exe
  2⤵
  PID:5580
- C:\Windows\System\MPzKXJT.exe
  C:\Windows\System\MPzKXJT.exe
  2⤵
  PID:5596
- C:\Windows\System\XnZhHsL.exe
  C:\Windows\System\XnZhHsL.exe
  2⤵
  PID:5612
- C:\Windows\System\UJhqYBH.exe
  C:\Windows\System\UJhqYBH.exe
  2⤵
  PID:5628
- C:\Windows\System\DnqRArx.exe
  C:\Windows\System\DnqRArx.exe
  2⤵
  PID:5644
- C:\Windows\System\hLHcXhe.exe
  C:\Windows\System\hLHcXhe.exe
  2⤵
  PID:5660
- C:\Windows\System\ExFTQVI.exe
  C:\Windows\System\ExFTQVI.exe
  2⤵
  PID:5676
- C:\Windows\System\HNDJIut.exe
  C:\Windows\System\HNDJIut.exe
  2⤵
  PID:5692
- C:\Windows\System\QGfeygL.exe
  C:\Windows\System\QGfeygL.exe
  2⤵
  PID:5708
- C:\Windows\System\frdobcl.exe
  C:\Windows\System\frdobcl.exe
  2⤵
  PID:5724
- C:\Windows\System\fagJDsk.exe
  C:\Windows\System\fagJDsk.exe
  2⤵
  PID:5740
- C:\Windows\System\VizOVAO.exe
  C:\Windows\System\VizOVAO.exe
  2⤵
  PID:5756
- C:\Windows\System\oRnLOpq.exe
  C:\Windows\System\oRnLOpq.exe
  2⤵
  PID:5772
- C:\Windows\System\npOeJxW.exe
  C:\Windows\System\npOeJxW.exe
  2⤵
  PID:5792
- C:\Windows\System\UhXezTj.exe
  C:\Windows\System\UhXezTj.exe
  2⤵
  PID:5808
- C:\Windows\System\CEpGvQT.exe
  C:\Windows\System\CEpGvQT.exe
  2⤵
  PID:5824
- C:\Windows\System\AXaYsTU.exe
  C:\Windows\System\AXaYsTU.exe
  2⤵
  PID:5840
- C:\Windows\System\sBemqvK.exe
  C:\Windows\System\sBemqvK.exe
  2⤵
  PID:5856
- C:\Windows\System\yaezrgs.exe
  C:\Windows\System\yaezrgs.exe
  2⤵
  PID:5872
- C:\Windows\System\xOnRQJW.exe
  C:\Windows\System\xOnRQJW.exe
  2⤵
  PID:5888
- C:\Windows\System\vEomTWt.exe
  C:\Windows\System\vEomTWt.exe
  2⤵
  PID:5904
- C:\Windows\System\FkcWuYb.exe
  C:\Windows\System\FkcWuYb.exe
  2⤵
  PID:5920
- C:\Windows\System\ZoZPOQh.exe
  C:\Windows\System\ZoZPOQh.exe
  2⤵
  PID:5936
- C:\Windows\System\JagOace.exe
  C:\Windows\System\JagOace.exe
  2⤵
  PID:5952
- C:\Windows\System\iJvFDyr.exe
  C:\Windows\System\iJvFDyr.exe
  2⤵
  PID:5968
- C:\Windows\System\gvJGKtb.exe
  C:\Windows\System\gvJGKtb.exe
  2⤵
  PID:5984
- C:\Windows\System\GNNzWBz.exe
  C:\Windows\System\GNNzWBz.exe
  2⤵
  PID:6000
- C:\Windows\System\qvYhHtd.exe
  C:\Windows\System\qvYhHtd.exe
  2⤵
  PID:6016
- C:\Windows\System\SUxmLQn.exe
  C:\Windows\System\SUxmLQn.exe
  2⤵
  PID:6032
- C:\Windows\System\CmjkfKG.exe
  C:\Windows\System\CmjkfKG.exe
  2⤵
  PID:6048
- C:\Windows\System\Pavyeer.exe
  C:\Windows\System\Pavyeer.exe
  2⤵
  PID:6064
- C:\Windows\System\sUMWgOv.exe
  C:\Windows\System\sUMWgOv.exe
  2⤵
  PID:6080
- C:\Windows\System\NWETvMX.exe
  C:\Windows\System\NWETvMX.exe
  2⤵
  PID:6096
- C:\Windows\System\ccimcXI.exe
  C:\Windows\System\ccimcXI.exe
  2⤵
  PID:6112
- C:\Windows\System\FPpkuPl.exe
  C:\Windows\System\FPpkuPl.exe
  2⤵
  PID:6128
- C:\Windows\System\cHRDcVR.exe
  C:\Windows\System\cHRDcVR.exe
  2⤵
  PID:4496
- C:\Windows\System\NOVeeyb.exe
  C:\Windows\System\NOVeeyb.exe
  2⤵
  PID:5148
- C:\Windows\System\xeTZfJr.exe
  C:\Windows\System\xeTZfJr.exe
  2⤵
  PID:1312
- C:\Windows\System\mIbcBDN.exe
  C:\Windows\System\mIbcBDN.exe
  2⤵
  PID:4204
- C:\Windows\System\FRZkMZd.exe
  C:\Windows\System\FRZkMZd.exe
  2⤵
  PID:5244
- C:\Windows\System\QkXwxTy.exe
  C:\Windows\System\QkXwxTy.exe
  2⤵
  PID:5308
- C:\Windows\System\WbwYIYn.exe
  C:\Windows\System\WbwYIYn.exe
  2⤵
  PID:4552
- C:\Windows\System\ZwtLiQI.exe
  C:\Windows\System\ZwtLiQI.exe
  2⤵
  PID:5028
- C:\Windows\System\cgqAyiS.exe
  C:\Windows\System\cgqAyiS.exe
  2⤵
  PID:5164
- C:\Windows\System\AYbLunb.exe
  C:\Windows\System\AYbLunb.exe
  2⤵
  PID:5324
- C:\Windows\System\GLAzKGi.exe
  C:\Windows\System\GLAzKGi.exe
  2⤵
  PID:5168
- C:\Windows\System\WYPJSVx.exe
  C:\Windows\System\WYPJSVx.exe
  2⤵
  PID:5296
- C:\Windows\System\PXYfAGt.exe
  C:\Windows\System\PXYfAGt.exe
  2⤵
  PID:5444
- C:\Windows\System\UQYwGKx.exe
  C:\Windows\System\UQYwGKx.exe
  2⤵
  PID:5604
- C:\Windows\System\VVBqUHZ.exe
  C:\Windows\System\VVBqUHZ.exe
  2⤵
  PID:5852
- C:\Windows\System\jGKyKym.exe
  C:\Windows\System\jGKyKym.exe
  2⤵
  PID:5592
- C:\Windows\System\uZqTFOc.exe
  C:\Windows\System\uZqTFOc.exe
  2⤵
  PID:5688
- C:\Windows\System\GgfSONS.exe
  C:\Windows\System\GgfSONS.exe
  2⤵
  PID:5344
- C:\Windows\System\inGKPoO.exe
  C:\Windows\System\inGKPoO.exe
  2⤵
  PID:5780
- C:\Windows\System\cUWMcpv.exe
  C:\Windows\System\cUWMcpv.exe
  2⤵
  PID:5884
- C:\Windows\System\fmKUbHk.exe
  C:\Windows\System\fmKUbHk.exe
  2⤵
  PID:5948
- C:\Windows\System\uQRQLOj.exe
  C:\Windows\System\uQRQLOj.exe
  2⤵
  PID:6040
- C:\Windows\System\ySendQm.exe
  C:\Windows\System\ySendQm.exe
  2⤵
  PID:6136
- C:\Windows\System\RtCkOYx.exe
  C:\Windows\System\RtCkOYx.exe
  2⤵
  PID:5212
- C:\Windows\System\TWHMmEz.exe
  C:\Windows\System\TWHMmEz.exe
  2⤵
  PID:5200
- C:\Windows\System\shLPmlH.exe
  C:\Windows\System\shLPmlH.exe
  2⤵
  PID:4568
- C:\Windows\System\SDJvmFv.exe
  C:\Windows\System\SDJvmFv.exe
  2⤵
  PID:4340
- C:\Windows\System\uPteuZh.exe
  C:\Windows\System\uPteuZh.exe
  2⤵
  PID:5232
- C:\Windows\System\uxvbZaQ.exe
  C:\Windows\System\uxvbZaQ.exe
  2⤵
  PID:868
- C:\Windows\System\INDdwxu.exe
  C:\Windows\System\INDdwxu.exe
  2⤵
  PID:5512
- C:\Windows\System\SolrgOn.exe
  C:\Windows\System\SolrgOn.exe
  2⤵
  PID:5636
- C:\Windows\System\cEiWTrD.exe
  C:\Windows\System\cEiWTrD.exe
  2⤵
  PID:5804
- C:\Windows\System\hntdtuP.exe
  C:\Windows\System\hntdtuP.exe
  2⤵
  PID:5864
- C:\Windows\System\OgmVnfs.exe
  C:\Windows\System\OgmVnfs.exe
  2⤵
  PID:5928
- C:\Windows\System\AeVGoOo.exe
  C:\Windows\System\AeVGoOo.exe
  2⤵
  PID:5992
- C:\Windows\System\CUWDjDP.exe
  C:\Windows\System\CUWDjDP.exe
  2⤵
  PID:5960
- C:\Windows\System\rubXGoZ.exe
  C:\Windows\System\rubXGoZ.exe
  2⤵
  PID:5400
- C:\Windows\System\qZJJHtX.exe
  C:\Windows\System\qZJJHtX.exe
  2⤵
  PID:6092
- C:\Windows\System\UmAxkCT.exe
  C:\Windows\System\UmAxkCT.exe
  2⤵
  PID:4032
- C:\Windows\System\yNFrFQP.exe
  C:\Windows\System\yNFrFQP.exe
  2⤵
  PID:4964
- C:\Windows\System\HMTKjQc.exe
  C:\Windows\System\HMTKjQc.exe
  2⤵
  PID:5492
- C:\Windows\System\darmHgv.exe
  C:\Windows\System\darmHgv.exe
  2⤵
  PID:5620
- C:\Windows\System\pruFpgV.exe
  C:\Windows\System\pruFpgV.exe
  2⤵
  PID:6104
- C:\Windows\System\tOHFlNX.exe
  C:\Windows\System\tOHFlNX.exe
  2⤵
  PID:5656
- C:\Windows\System\BrCqZTe.exe
  C:\Windows\System\BrCqZTe.exe
  2⤵
  PID:5152
- C:\Windows\System\ESFIDCU.exe
  C:\Windows\System\ESFIDCU.exe
  2⤵
  PID:5292
- C:\Windows\System\RWTYTSU.exe
  C:\Windows\System\RWTYTSU.exe
  2⤵
  PID:5084
- C:\Windows\System\rAXaQCA.exe
  C:\Windows\System\rAXaQCA.exe
  2⤵
  PID:5508
- C:\Windows\System\OxWgZal.exe
  C:\Windows\System\OxWgZal.exe
  2⤵
  PID:5672
- C:\Windows\System\epjNbtv.exe
  C:\Windows\System\epjNbtv.exe
  2⤵
  PID:5576
- C:\Windows\System\cBllLrW.exe
  C:\Windows\System\cBllLrW.exe
  2⤵
  PID:5464
- C:\Windows\System\XyiYqDo.exe
  C:\Windows\System\XyiYqDo.exe
  2⤵
  PID:5964
- C:\Windows\System\VCvPMkq.exe
  C:\Windows\System\VCvPMkq.exe
  2⤵
  PID:5280
- C:\Windows\System\fmjUEbz.exe
  C:\Windows\System\fmjUEbz.exe
  2⤵
  PID:6160
- C:\Windows\System\xuHWneZ.exe
  C:\Windows\System\xuHWneZ.exe
  2⤵
  PID:6176
- C:\Windows\System\ZToecLF.exe
  C:\Windows\System\ZToecLF.exe
  2⤵
  PID:6192
- C:\Windows\System\SmiMLQx.exe
  C:\Windows\System\SmiMLQx.exe
  2⤵
  PID:6212
- C:\Windows\System\YWGIevh.exe
  C:\Windows\System\YWGIevh.exe
  2⤵
  PID:6228
- C:\Windows\System\JgIplzb.exe
  C:\Windows\System\JgIplzb.exe
  2⤵
  PID:6244
- C:\Windows\System\wcqNgcO.exe
  C:\Windows\System\wcqNgcO.exe
  2⤵
  PID:6260
- C:\Windows\System\uqHIFLd.exe
  C:\Windows\System\uqHIFLd.exe
  2⤵
  PID:6276
- C:\Windows\System\UgKMXZP.exe
  C:\Windows\System\UgKMXZP.exe
  2⤵
  PID:6296
- C:\Windows\System\iyinCZb.exe
  C:\Windows\System\iyinCZb.exe
  2⤵
  PID:6312
- C:\Windows\System\grbsNCv.exe
  C:\Windows\System\grbsNCv.exe
  2⤵
  PID:6328
- C:\Windows\System\TiQMrAJ.exe
  C:\Windows\System\TiQMrAJ.exe
  2⤵
  PID:6348
- C:\Windows\System\ppJdkCP.exe
  C:\Windows\System\ppJdkCP.exe
  2⤵
  PID:6364
- C:\Windows\System\eYGEwXs.exe
  C:\Windows\System\eYGEwXs.exe
  2⤵
  PID:6380
- C:\Windows\System\DLaQDhX.exe
  C:\Windows\System\DLaQDhX.exe
  2⤵
  PID:6400
- C:\Windows\System\qshKlLT.exe
  C:\Windows\System\qshKlLT.exe
  2⤵
  PID:6568
- C:\Windows\System\nowdYCr.exe
  C:\Windows\System\nowdYCr.exe
  2⤵
  PID:6592
- C:\Windows\System\JdXAXyz.exe
  C:\Windows\System\JdXAXyz.exe
  2⤵
  PID:6608
- C:\Windows\System\bHkhWCG.exe
  C:\Windows\System\bHkhWCG.exe
  2⤵
  PID:6624
- C:\Windows\System\NpXIDWO.exe
  C:\Windows\System\NpXIDWO.exe
  2⤵
  PID:6640
- C:\Windows\System\tlWftPE.exe
  C:\Windows\System\tlWftPE.exe
  2⤵
  PID:6656
- C:\Windows\System\JSrokDR.exe
  C:\Windows\System\JSrokDR.exe
  2⤵
  PID:6672
- C:\Windows\System\gqrOJel.exe
  C:\Windows\System\gqrOJel.exe
  2⤵
  PID:6688
- C:\Windows\System\eOccWPD.exe
  C:\Windows\System\eOccWPD.exe
  2⤵
  PID:6712
- C:\Windows\System\euoYxDj.exe
  C:\Windows\System\euoYxDj.exe
  2⤵
  PID:6728
- C:\Windows\System\yWcUaXD.exe
  C:\Windows\System\yWcUaXD.exe
  2⤵
  PID:6744
- C:\Windows\System\SuqoSwk.exe
  C:\Windows\System\SuqoSwk.exe
  2⤵
  PID:6764
- C:\Windows\System\IuMYIlk.exe
  C:\Windows\System\IuMYIlk.exe
  2⤵
  PID:6780
- C:\Windows\System\eQbXJUK.exe
  C:\Windows\System\eQbXJUK.exe
  2⤵
  PID:6796
- C:\Windows\System\sUdeRbX.exe
  C:\Windows\System\sUdeRbX.exe
  2⤵
  PID:6816
- C:\Windows\System\tugtbQE.exe
  C:\Windows\System\tugtbQE.exe
  2⤵
  PID:6832
- C:\Windows\System\tKickbq.exe
  C:\Windows\System\tKickbq.exe
  2⤵
  PID:6848
- C:\Windows\System\sOptKZn.exe
  C:\Windows\System\sOptKZn.exe
  2⤵
  PID:6872
- C:\Windows\System\RAtyRsN.exe
  C:\Windows\System\RAtyRsN.exe
  2⤵
  PID:6888
- C:\Windows\System\CMgoRfa.exe
  C:\Windows\System\CMgoRfa.exe
  2⤵
  PID:6904
- C:\Windows\System\OxabKXx.exe
  C:\Windows\System\OxabKXx.exe
  2⤵
  PID:6924
- C:\Windows\System\OoyqqdJ.exe
  C:\Windows\System\OoyqqdJ.exe
  2⤵
  PID:6940
- C:\Windows\System\CGhzWZI.exe
  C:\Windows\System\CGhzWZI.exe
  2⤵
  PID:6960
- C:\Windows\System\UvYLOaZ.exe
  C:\Windows\System\UvYLOaZ.exe
  2⤵
  PID:6976
- C:\Windows\System\jstmPFt.exe
  C:\Windows\System\jstmPFt.exe
  2⤵
  PID:6996
- C:\Windows\System\WSLpkOV.exe
  C:\Windows\System\WSLpkOV.exe
  2⤵
  PID:7012
- C:\Windows\System\YqIJeCt.exe
  C:\Windows\System\YqIJeCt.exe
  2⤵
  PID:7028
- C:\Windows\System\orUdxlT.exe
  C:\Windows\System\orUdxlT.exe
  2⤵
  PID:7116
- C:\Windows\System\hMEslXs.exe
  C:\Windows\System\hMEslXs.exe
  2⤵
  PID:7132
- C:\Windows\System\AiPbkeF.exe
  C:\Windows\System\AiPbkeF.exe
  2⤵
  PID:7148
- C:\Windows\System\goZdUQM.exe
  C:\Windows\System\goZdUQM.exe
  2⤵
  PID:7164
- C:\Windows\System\dSGjFFL.exe
  C:\Windows\System\dSGjFFL.exe
  2⤵
  PID:5480
- C:\Windows\System\iTQAZJk.exe
  C:\Windows\System\iTQAZJk.exe
  2⤵
  PID:5684
- C:\Windows\System\BfJJoSY.exe
  C:\Windows\System\BfJJoSY.exe
  2⤵
  PID:6156
- C:\Windows\System\dnodKrY.exe
  C:\Windows\System\dnodKrY.exe
  2⤵
  PID:6252
- C:\Windows\System\dSeGSPg.exe
  C:\Windows\System\dSeGSPg.exe
  2⤵
  PID:6320
- C:\Windows\System\adFSbFz.exe
  C:\Windows\System\adFSbFz.exe
  2⤵
  PID:6392
- C:\Windows\System\mEcjDuj.exe
  C:\Windows\System\mEcjDuj.exe
  2⤵
  PID:5944
- C:\Windows\System\dUowMct.exe
  C:\Windows\System\dUowMct.exe
  2⤵
  PID:5900
- C:\Windows\System\UNSYTwY.exe
  C:\Windows\System\UNSYTwY.exe
  2⤵
  PID:6416
- C:\Windows\System\PGkgIdQ.exe
  C:\Windows\System\PGkgIdQ.exe
  2⤵
  PID:5848
- C:\Windows\System\tLWkeHJ.exe
  C:\Windows\System\tLWkeHJ.exe
  2⤵
  PID:5668
- C:\Windows\System\ePgvhTN.exe
  C:\Windows\System\ePgvhTN.exe
  2⤵
  PID:5768
- C:\Windows\System\HYAwHQv.exe
  C:\Windows\System\HYAwHQv.exe
  2⤵
  PID:6168
- C:\Windows\System\FsnTiUx.exe
  C:\Windows\System\FsnTiUx.exe
  2⤵
  PID:6208
- C:\Windows\System\sfjhMyY.exe
  C:\Windows\System\sfjhMyY.exe
  2⤵
  PID:6272
- C:\Windows\System\xilhZGZ.exe
  C:\Windows\System\xilhZGZ.exe
  2⤵
  PID:6344
- C:\Windows\System\nzGxlew.exe
  C:\Windows\System\nzGxlew.exe
  2⤵
  PID:6464
- C:\Windows\System\wkjCoQw.exe
  C:\Windows\System\wkjCoQw.exe
  2⤵
  PID:6516
- C:\Windows\System\ieaDtNb.exe
  C:\Windows\System\ieaDtNb.exe
  2⤵
  PID:6440
- C:\Windows\System\qDWVtOi.exe
  C:\Windows\System\qDWVtOi.exe
  2⤵
  PID:6480
- C:\Windows\System\WXULIEp.exe
  C:\Windows\System\WXULIEp.exe
  2⤵
  PID:6500
- C:\Windows\System\AwWYzxC.exe
  C:\Windows\System\AwWYzxC.exe
  2⤵
  PID:6524
- C:\Windows\System\WhjZrRG.exe
  C:\Windows\System\WhjZrRG.exe
  2⤵
  PID:6544
- C:\Windows\System\OVwLiWM.exe
  C:\Windows\System\OVwLiWM.exe
  2⤵
  PID:6560
- C:\Windows\System\GigUmgq.exe
  C:\Windows\System\GigUmgq.exe
  2⤵
  PID:6588
- C:\Windows\System\XJvkjMe.exe
  C:\Windows\System\XJvkjMe.exe
  2⤵
  PID:6652
- C:\Windows\System\SkHNPvH.exe
  C:\Windows\System\SkHNPvH.exe
  2⤵
  PID:6752
- C:\Windows\System\goczVvw.exe
  C:\Windows\System\goczVvw.exe
  2⤵
  PID:6792
- C:\Windows\System\aZZOaIP.exe
  C:\Windows\System\aZZOaIP.exe
  2⤵
  PID:6860
- C:\Windows\System\PsDlRYu.exe
  C:\Windows\System\PsDlRYu.exe
  2⤵
  PID:6900
- C:\Windows\System\VWKWrky.exe
  C:\Windows\System\VWKWrky.exe
  2⤵
  PID:6972
- C:\Windows\System\CFPrMia.exe
  C:\Windows\System\CFPrMia.exe
  2⤵
  PID:7044
- C:\Windows\System\VlbUpzw.exe
  C:\Windows\System\VlbUpzw.exe
  2⤵
  PID:7056
- C:\Windows\System\ngfWPPT.exe
  C:\Windows\System\ngfWPPT.exe
  2⤵
  PID:7080
- C:\Windows\System\nQUDrWc.exe
  C:\Windows\System\nQUDrWc.exe
  2⤵
  PID:7064
- C:\Windows\System\cgXfQXJ.exe
  C:\Windows\System\cgXfQXJ.exe
  2⤵
  PID:6600
- C:\Windows\System\qwoxPfu.exe
  C:\Windows\System\qwoxPfu.exe
  2⤵
  PID:6668
- C:\Windows\System\zqvVgcK.exe
  C:\Windows\System\zqvVgcK.exe
  2⤵
  PID:6740
- C:\Windows\System\OXOVRrX.exe
  C:\Windows\System\OXOVRrX.exe
  2⤵
  PID:6808
- C:\Windows\System\pFVueXK.exe
  C:\Windows\System\pFVueXK.exe
  2⤵
  PID:6880
- C:\Windows\System\MXiXlYS.exe
  C:\Windows\System\MXiXlYS.exe
  2⤵
  PID:6920
- C:\Windows\System\EnAPSrA.exe
  C:\Windows\System\EnAPSrA.exe
  2⤵
  PID:6984
- C:\Windows\System\WLLwXEy.exe
  C:\Windows\System\WLLwXEy.exe
  2⤵
  PID:7024
- C:\Windows\System\OsARYqb.exe
  C:\Windows\System\OsARYqb.exe
  2⤵
  PID:7160
- C:\Windows\System\IgYZfRE.exe
  C:\Windows\System\IgYZfRE.exe
  2⤵
  PID:6388
- C:\Windows\System\gGVdiSU.exe
  C:\Windows\System\gGVdiSU.exe
  2⤵
  PID:4424
- C:\Windows\System\OYfnkhM.exe
  C:\Windows\System\OYfnkhM.exe
  2⤵
  PID:5396
- C:\Windows\System\kAqLubJ.exe
  C:\Windows\System\kAqLubJ.exe
  2⤵
  PID:5748
- C:\Windows\System\gSZieYi.exe
  C:\Windows\System\gSZieYi.exe
  2⤵
  PID:4444
- C:\Windows\System\mCbuXyd.exe
  C:\Windows\System\mCbuXyd.exe
  2⤵
  PID:6268
- C:\Windows\System\gMHuByg.exe
  C:\Windows\System\gMHuByg.exe
  2⤵
  PID:6504
- C:\Windows\System\wTojyUn.exe
  C:\Windows\System\wTojyUn.exe
  2⤵
  PID:6240
- C:\Windows\System\UAqqmxh.exe
  C:\Windows\System\UAqqmxh.exe
  2⤵
  PID:6340
- C:\Windows\System\zyjySko.exe
  C:\Windows\System\zyjySko.exe
  2⤵
  PID:6472
- C:\Windows\System\YUmYzxF.exe
  C:\Windows\System\YUmYzxF.exe
  2⤵
  PID:6540
- C:\Windows\System\QsMeBSe.exe
  C:\Windows\System\QsMeBSe.exe
  2⤵
  PID:6720
- C:\Windows\System\zChANwd.exe
  C:\Windows\System\zChANwd.exe
  2⤵
  PID:6856
- C:\Windows\System\BYPiSPh.exe
  C:\Windows\System\BYPiSPh.exe
  2⤵
  PID:7068
- C:\Windows\System\Gmtyzxk.exe
  C:\Windows\System\Gmtyzxk.exe
  2⤵
  PID:6804
- C:\Windows\System\BBMRrYh.exe
  C:\Windows\System\BBMRrYh.exe
  2⤵
  PID:7008
- C:\Windows\System\prjOFPA.exe
  C:\Windows\System\prjOFPA.exe
  2⤵
  PID:7088
- C:\Windows\System\uYtDmup.exe
  C:\Windows\System\uYtDmup.exe
  2⤵
  PID:7112
- C:\Windows\System\KBALuEZ.exe
  C:\Windows\System\KBALuEZ.exe
  2⤵
  PID:6648
- C:\Windows\System\bZkdYzf.exe
  C:\Windows\System\bZkdYzf.exe
  2⤵
  PID:6896
- C:\Windows\System\CLtPKEL.exe
  C:\Windows\System\CLtPKEL.exe
  2⤵
  PID:7084
- C:\Windows\System\dKtbOVq.exe
  C:\Windows\System\dKtbOVq.exe
  2⤵
  PID:6844
- C:\Windows\System\DFsclxy.exe
  C:\Windows\System\DFsclxy.exe
  2⤵
  PID:7104
- C:\Windows\System\OENzNcI.exe
  C:\Windows\System\OENzNcI.exe
  2⤵
  PID:6912
- C:\Windows\System\LLVnANM.exe
  C:\Windows\System\LLVnANM.exe
  2⤵
  PID:5976
- C:\Windows\System\LVHfYLq.exe
  C:\Windows\System\LVHfYLq.exe
  2⤵
  PID:6076
- C:\Windows\System\yDSKkTG.exe
  C:\Windows\System\yDSKkTG.exe
  2⤵
  PID:6292
- C:\Windows\System\mEOYICq.exe
  C:\Windows\System\mEOYICq.exe
  2⤵
  PID:5544
- C:\Windows\System\NMkrcVl.exe
  C:\Windows\System\NMkrcVl.exe
  2⤵
  PID:6220
- C:\Windows\System\xrnRIvV.exe
  C:\Windows\System\xrnRIvV.exe
  2⤵
  PID:7156
- C:\Windows\System\PEOkYRS.exe
  C:\Windows\System\PEOkYRS.exe
  2⤵
  PID:5996
- C:\Windows\System\maqhAEg.exe
  C:\Windows\System\maqhAEg.exe
  2⤵
  PID:5460
- C:\Windows\System\jsOTnUs.exe
  C:\Windows\System\jsOTnUs.exe
  2⤵
  PID:6088
- C:\Windows\System\BWkWGzB.exe
  C:\Windows\System\BWkWGzB.exe
  2⤵
  PID:6204
- C:\Windows\System\ejgYyfk.exe
  C:\Windows\System\ejgYyfk.exe
  2⤵
  PID:6336
- C:\Windows\System\AJkmCDB.exe
  C:\Windows\System\AJkmCDB.exe
  2⤵
  PID:6536
- C:\Windows\System\YPMLHXI.exe
  C:\Windows\System\YPMLHXI.exe
  2⤵
  PID:6664
- C:\Windows\System\TLEvuvh.exe
  C:\Windows\System\TLEvuvh.exe
  2⤵
  PID:6460
- C:\Windows\System\rVoOeQI.exe
  C:\Windows\System\rVoOeQI.exe
  2⤵
  PID:6992
- C:\Windows\System\TxOhZGx.exe
  C:\Windows\System\TxOhZGx.exe
  2⤵
  PID:6708
- C:\Windows\System\LPRuOYT.exe
  C:\Windows\System\LPRuOYT.exe
  2⤵
  PID:7140
- C:\Windows\System\gIlnqKv.exe
  C:\Windows\System\gIlnqKv.exe
  2⤵
  PID:5816
- C:\Windows\System\UdFDOeN.exe
  C:\Windows\System\UdFDOeN.exe
  2⤵
  PID:7108
- C:\Windows\System\hpysvOq.exe
  C:\Windows\System\hpysvOq.exe
  2⤵
  PID:6152
- C:\Windows\System\mnsvPgn.exe
  C:\Windows\System\mnsvPgn.exe
  2⤵
  PID:6396
- C:\Windows\System\IxIirHF.exe
  C:\Windows\System\IxIirHF.exe
  2⤵
  PID:6188
- C:\Windows\System\ZkvKOCl.exe
  C:\Windows\System\ZkvKOCl.exe
  2⤵
  PID:7128
- C:\Windows\System\lIWQKfo.exe
  C:\Windows\System\lIWQKfo.exe
  2⤵
  PID:4484
- C:\Windows\System\AXgWBxm.exe
  C:\Windows\System\AXgWBxm.exe
  2⤵
  PID:6556
- C:\Windows\System\xCvuLRs.exe
  C:\Windows\System\xCvuLRs.exe
  2⤵
  PID:6956
- C:\Windows\System\NTwBAGP.exe
  C:\Windows\System\NTwBAGP.exe
  2⤵
  PID:4644
- C:\Windows\System\XibuwRc.exe
  C:\Windows\System\XibuwRc.exe
  2⤵
  PID:6428
- C:\Windows\System\xqXAKDj.exe
  C:\Windows\System\xqXAKDj.exe
  2⤵
  PID:6444
- C:\Windows\System\URUTvPm.exe
  C:\Windows\System\URUTvPm.exe
  2⤵
  PID:6828
- C:\Windows\System\ZaqcJMi.exe
  C:\Windows\System\ZaqcJMi.exe
  2⤵
  PID:5228
- C:\Windows\System\uIgUijK.exe
  C:\Windows\System\uIgUijK.exe
  2⤵
  PID:6532
- C:\Windows\System\AChkOOp.exe
  C:\Windows\System\AChkOOp.exe
  2⤵
  PID:7040
- C:\Windows\System\fahRIrQ.exe
  C:\Windows\System\fahRIrQ.exe
  2⤵
  PID:6356
- C:\Windows\System\KLiZjCd.exe
  C:\Windows\System\KLiZjCd.exe
  2⤵
  PID:7176
- C:\Windows\System\TWyPDjv.exe
  C:\Windows\System\TWyPDjv.exe
  2⤵
  PID:7196
- C:\Windows\System\FcrcsrU.exe
  C:\Windows\System\FcrcsrU.exe
  2⤵
  PID:7212
- C:\Windows\System\CkBNbiY.exe
  C:\Windows\System\CkBNbiY.exe
  2⤵
  PID:7228
- C:\Windows\System\rbwAFWB.exe
  C:\Windows\System\rbwAFWB.exe
  2⤵
  PID:7244
- C:\Windows\System\SrEUhkB.exe
  C:\Windows\System\SrEUhkB.exe
  2⤵
  PID:7264
- C:\Windows\System\irmzmtX.exe
  C:\Windows\System\irmzmtX.exe
  2⤵
  PID:7280
- C:\Windows\System\hGISkzF.exe
  C:\Windows\System\hGISkzF.exe
  2⤵
  PID:7296
- C:\Windows\System\eSYxitx.exe
  C:\Windows\System\eSYxitx.exe
  2⤵
  PID:7316
- C:\Windows\System\ZjKDLYz.exe
  C:\Windows\System\ZjKDLYz.exe
  2⤵
  PID:7336
- C:\Windows\System\QepLUSh.exe
  C:\Windows\System\QepLUSh.exe
  2⤵
  PID:7352
- C:\Windows\System\TjsuQBA.exe
  C:\Windows\System\TjsuQBA.exe
  2⤵
  PID:7368
- C:\Windows\System\eQUcPTR.exe
  C:\Windows\System\eQUcPTR.exe
  2⤵
  PID:7384
- C:\Windows\System\GEIjVTA.exe
  C:\Windows\System\GEIjVTA.exe
  2⤵
  PID:7400
- C:\Windows\System\lZFqMnH.exe
  C:\Windows\System\lZFqMnH.exe
  2⤵
  PID:7420
- C:\Windows\System\RPzOZeP.exe
  C:\Windows\System\RPzOZeP.exe
  2⤵
  PID:7436
- C:\Windows\System\RcGIHYv.exe
  C:\Windows\System\RcGIHYv.exe
  2⤵
  PID:7452
- C:\Windows\System\AyJJYFM.exe
  C:\Windows\System\AyJJYFM.exe
  2⤵
  PID:7468
- C:\Windows\System\oQlBkMK.exe
  C:\Windows\System\oQlBkMK.exe
  2⤵
  PID:7484
- C:\Windows\System\FNGRPIj.exe
  C:\Windows\System\FNGRPIj.exe
  2⤵
  PID:7508
- C:\Windows\System\gZOgOhD.exe
  C:\Windows\System\gZOgOhD.exe
  2⤵
  PID:7524
- C:\Windows\System\alggMfx.exe
  C:\Windows\System\alggMfx.exe
  2⤵
  PID:7540
- C:\Windows\System\IkmxuAd.exe
  C:\Windows\System\IkmxuAd.exe
  2⤵
  PID:7556
- C:\Windows\System\NDteaGD.exe
  C:\Windows\System\NDteaGD.exe
  2⤵
  PID:7572
- C:\Windows\System\blmNGmU.exe
  C:\Windows\System\blmNGmU.exe
  2⤵
  PID:7588
- C:\Windows\System\mFpcwUI.exe
  C:\Windows\System\mFpcwUI.exe
  2⤵
  PID:7608
- C:\Windows\System\FgCQIhQ.exe
  C:\Windows\System\FgCQIhQ.exe
  2⤵
  PID:7624
- C:\Windows\System\AyEMBAG.exe
  C:\Windows\System\AyEMBAG.exe
  2⤵
  PID:7752
- C:\Windows\System\NxGHVlp.exe
  C:\Windows\System\NxGHVlp.exe
  2⤵
  PID:7768
- C:\Windows\System\ivuXyET.exe
  C:\Windows\System\ivuXyET.exe
  2⤵
  PID:7784
- C:\Windows\System\ZGQbImn.exe
  C:\Windows\System\ZGQbImn.exe
  2⤵
  PID:7800
- C:\Windows\System\msOnoyh.exe
  C:\Windows\System\msOnoyh.exe
  2⤵
  PID:7816
- C:\Windows\System\urRDHbD.exe
  C:\Windows\System\urRDHbD.exe
  2⤵
  PID:7832
- C:\Windows\System\xnSvDZw.exe
  C:\Windows\System\xnSvDZw.exe
  2⤵
  PID:7848
- C:\Windows\System\zCRGFKv.exe
  C:\Windows\System\zCRGFKv.exe
  2⤵
  PID:7864
- C:\Windows\System\jGibPUA.exe
  C:\Windows\System\jGibPUA.exe
  2⤵
  PID:7880
- C:\Windows\System\PcBEuUT.exe
  C:\Windows\System\PcBEuUT.exe
  2⤵
  PID:7896
- C:\Windows\System\iZAeaMq.exe
  C:\Windows\System\iZAeaMq.exe
  2⤵
  PID:7912
- C:\Windows\System\nRslEXo.exe
  C:\Windows\System\nRslEXo.exe
  2⤵
  PID:7928
- C:\Windows\System\AvCiGjG.exe
  C:\Windows\System\AvCiGjG.exe
  2⤵
  PID:7952
- C:\Windows\System\zPJtqfq.exe
  C:\Windows\System\zPJtqfq.exe
  2⤵
  PID:7968
- C:\Windows\System\gghyCsi.exe
  C:\Windows\System\gghyCsi.exe
  2⤵
  PID:7984
- C:\Windows\System\wWpgKVl.exe
  C:\Windows\System\wWpgKVl.exe
  2⤵
  PID:8128
- C:\Windows\System\NLdrtcx.exe
  C:\Windows\System\NLdrtcx.exe
  2⤵
  PID:8148
- C:\Windows\System\lbgSega.exe
  C:\Windows\System\lbgSega.exe
  2⤵
  PID:8164
- C:\Windows\System\XkiAvcH.exe
  C:\Windows\System\XkiAvcH.exe
  2⤵
  PID:8180
- C:\Windows\System\EtCHljE.exe
  C:\Windows\System\EtCHljE.exe
  2⤵
  PID:6788
- C:\Windows\System\dwyLFRl.exe
  C:\Windows\System\dwyLFRl.exe
  2⤵
  PID:7208
- C:\Windows\System\tGkwGuz.exe
  C:\Windows\System\tGkwGuz.exe
  2⤵
  PID:6496
- C:\Windows\System\lIemczI.exe
  C:\Windows\System\lIemczI.exe
  2⤵
  PID:7048
- C:\Windows\System\EyDiYyU.exe
  C:\Windows\System\EyDiYyU.exe
  2⤵
  PID:7252
- C:\Windows\System\dXZVdGP.exe
  C:\Windows\System\dXZVdGP.exe
  2⤵
  PID:7272
- C:\Windows\System\JiWjxuD.exe
  C:\Windows\System\JiWjxuD.exe
  2⤵
  PID:7292
- C:\Windows\System\WRkoFzb.exe
  C:\Windows\System\WRkoFzb.exe
  2⤵
  PID:7332
- C:\Windows\System\yHIsdao.exe
  C:\Windows\System\yHIsdao.exe
  2⤵
  PID:7396
- C:\Windows\System\dzHjFEG.exe
  C:\Windows\System\dzHjFEG.exe
  2⤵
  PID:7408
- C:\Windows\System\IOXXXfr.exe
  C:\Windows\System\IOXXXfr.exe
  2⤵
  PID:7376
- C:\Windows\System\hyWmwiH.exe
  C:\Windows\System\hyWmwiH.exe
  2⤵
  PID:7496
- C:\Windows\System\WCiBzJC.exe
  C:\Windows\System\WCiBzJC.exe
  2⤵
  PID:7444
- C:\Windows\System\QbfnkBT.exe
  C:\Windows\System\QbfnkBT.exe
  2⤵
  PID:7548
- C:\Windows\System\UsneHeV.exe
  C:\Windows\System\UsneHeV.exe
  2⤵
  PID:7616
- C:\Windows\System\BdCMeCS.exe
  C:\Windows\System\BdCMeCS.exe
  2⤵
  PID:7568
- C:\Windows\System\atugSFf.exe
  C:\Windows\System\atugSFf.exe
  2⤵
  PID:7604
- C:\Windows\System\lZSuMai.exe
  C:\Windows\System\lZSuMai.exe
  2⤵
  PID:7648
- C:\Windows\System\KrrAjYh.exe
  C:\Windows\System\KrrAjYh.exe
  2⤵
  PID:7664
- C:\Windows\System\vDdFHEQ.exe
  C:\Windows\System\vDdFHEQ.exe
  2⤵
  PID:7680
- C:\Windows\System\AouNvbz.exe
  C:\Windows\System\AouNvbz.exe
  2⤵
  PID:7712
- C:\Windows\System\MzCAWsz.exe
  C:\Windows\System\MzCAWsz.exe
  2⤵
  PID:7704
- C:\Windows\System\KrQcHKF.exe
  C:\Windows\System\KrQcHKF.exe
  2⤵
  PID:7736
- C:\Windows\System\KjERnyj.exe
  C:\Windows\System\KjERnyj.exe
  2⤵
  PID:7776
- C:\Windows\System\LncwuQU.exe
  C:\Windows\System\LncwuQU.exe
  2⤵
  PID:7824
- C:\Windows\System\cUycSWy.exe
  C:\Windows\System\cUycSWy.exe
  2⤵
  PID:7888
- C:\Windows\System\dlagBpN.exe
  C:\Windows\System\dlagBpN.exe
  2⤵
  PID:7812
- C:\Windows\System\YZUzjyG.exe
  C:\Windows\System\YZUzjyG.exe
  2⤵
  PID:7936
- C:\Windows\System\OJfpXsQ.exe
  C:\Windows\System\OJfpXsQ.exe
  2⤵
  PID:7940
- C:\Windows\System\HqZJCmN.exe
  C:\Windows\System\HqZJCmN.exe
  2⤵
  PID:7992
- C:\Windows\System\MIgdVSb.exe
  C:\Windows\System\MIgdVSb.exe
  2⤵
  PID:7796
- C:\Windows\System\caZtiNb.exe
  C:\Windows\System\caZtiNb.exe
  2⤵
  PID:8020
- C:\Windows\System\yfIcoLr.exe
  C:\Windows\System\yfIcoLr.exe
  2⤵
  PID:8008
- C:\Windows\System\RCuVMho.exe
  C:\Windows\System\RCuVMho.exe
  2⤵
  PID:8092
- C:\Windows\System\CafVPlx.exe
  C:\Windows\System\CafVPlx.exe
  2⤵
  PID:8052
- C:\Windows\System\xSVVHwT.exe
  C:\Windows\System\xSVVHwT.exe
  2⤵
  PID:8068
- C:\Windows\System\ulzCLMc.exe
  C:\Windows\System\ulzCLMc.exe
  2⤵
  PID:8116
- C:\Windows\System\eTNShgU.exe
  C:\Windows\System\eTNShgU.exe
  2⤵
  PID:8160
- C:\Windows\System\wTKdpVL.exe
  C:\Windows\System\wTKdpVL.exe
  2⤵
  PID:8108
- C:\Windows\System\LXNBQkb.exe
  C:\Windows\System\LXNBQkb.exe
  2⤵
  PID:7344
- C:\Windows\System\MvGeNvo.exe
  C:\Windows\System\MvGeNvo.exe
  2⤵
  PID:7256
- C:\Windows\System\lNgJZzp.exe
  C:\Windows\System\lNgJZzp.exe
  2⤵
  PID:7416
- C:\Windows\System\cuhmDSR.exe
  C:\Windows\System\cuhmDSR.exe
  2⤵
  PID:8204
- C:\Windows\System\IwNHoZF.exe
  C:\Windows\System\IwNHoZF.exe
  2⤵
  PID:8220
- C:\Windows\System\pHSUdXp.exe
  C:\Windows\System\pHSUdXp.exe
  2⤵
  PID:8236
- C:\Windows\System\yGGbZid.exe
  C:\Windows\System\yGGbZid.exe
  2⤵
  PID:8252
- C:\Windows\System\aoyzYLU.exe
  C:\Windows\System\aoyzYLU.exe
  2⤵
  PID:8272
- C:\Windows\System\ebgFFjE.exe
  C:\Windows\System\ebgFFjE.exe
  2⤵
  PID:8288
- C:\Windows\System\DVPBVHk.exe
  C:\Windows\System\DVPBVHk.exe
  2⤵
  PID:8304
- C:\Windows\System\TDFcUnS.exe
  C:\Windows\System\TDFcUnS.exe
  2⤵
  PID:8320
- C:\Windows\System\aMsPzzH.exe
  C:\Windows\System\aMsPzzH.exe
  2⤵
  PID:8340
- C:\Windows\System\tqQPNRB.exe
  C:\Windows\System\tqQPNRB.exe
  2⤵
  PID:8356
- C:\Windows\System\vDslCFm.exe
  C:\Windows\System\vDslCFm.exe
  2⤵
  PID:8372
- C:\Windows\System\Bhtcjkd.exe
  C:\Windows\System\Bhtcjkd.exe
  2⤵
  PID:8388
- C:\Windows\System\VXCQzkq.exe
  C:\Windows\System\VXCQzkq.exe
  2⤵
  PID:8408
- C:\Windows\System\CmEkQjb.exe
  C:\Windows\System\CmEkQjb.exe
  2⤵
  PID:8424
- C:\Windows\System\qAfQQWT.exe
  C:\Windows\System\qAfQQWT.exe
  2⤵
  PID:8440
- C:\Windows\System\LXcVtYM.exe
  C:\Windows\System\LXcVtYM.exe
  2⤵
  PID:8456
- C:\Windows\System\ABrwsaf.exe
  C:\Windows\System\ABrwsaf.exe
  2⤵
  PID:8480
- C:\Windows\System\CScavHT.exe
  C:\Windows\System\CScavHT.exe
  2⤵
  PID:8496
- C:\Windows\System\sZtGjEb.exe
  C:\Windows\System\sZtGjEb.exe
  2⤵
  PID:8512
- C:\Windows\System\HADAOSf.exe
  C:\Windows\System\HADAOSf.exe
  2⤵
  PID:8532
- C:\Windows\System\FYLlxKk.exe
  C:\Windows\System\FYLlxKk.exe
  2⤵
  PID:8548
- C:\Windows\System\KYTdWiA.exe
  C:\Windows\System\KYTdWiA.exe
  2⤵
  PID:8568
- C:\Windows\System\pEYWRJE.exe
  C:\Windows\System\pEYWRJE.exe
  2⤵
  PID:8584
- C:\Windows\System\HgCeAQf.exe
  C:\Windows\System\HgCeAQf.exe
  2⤵
  PID:8600
- C:\Windows\System\xdjPYxI.exe
  C:\Windows\System\xdjPYxI.exe
  2⤵
  PID:8616
- C:\Windows\System\jyybtFb.exe
  C:\Windows\System\jyybtFb.exe
  2⤵
  PID:8640
- C:\Windows\System\rBJFhxu.exe
  C:\Windows\System\rBJFhxu.exe
  2⤵
  PID:8656
- C:\Windows\System\RxXAcbn.exe
  C:\Windows\System\RxXAcbn.exe
  2⤵
  PID:8672
- C:\Windows\System\ngPhnzh.exe
  C:\Windows\System\ngPhnzh.exe
  2⤵
  PID:8688
- C:\Windows\System\ubkCZWE.exe
  C:\Windows\System\ubkCZWE.exe
  2⤵
  PID:8704
- C:\Windows\System\fUcYKJU.exe
  C:\Windows\System\fUcYKJU.exe
  2⤵
  PID:8720
- C:\Windows\System\SqlIuLV.exe
  C:\Windows\System\SqlIuLV.exe
  2⤵
  PID:8740
- C:\Windows\System\LSGafHO.exe
  C:\Windows\System\LSGafHO.exe
  2⤵
  PID:8756
- C:\Windows\System\icPNHoe.exe
  C:\Windows\System\icPNHoe.exe
  2⤵
  PID:8772
- C:\Windows\System\lJbFArq.exe
  C:\Windows\System\lJbFArq.exe
  2⤵
  PID:8792
- C:\Windows\System\wXSeETT.exe
  C:\Windows\System\wXSeETT.exe
  2⤵
  PID:8808
- C:\Windows\System\mNjHZeE.exe
  C:\Windows\System\mNjHZeE.exe
  2⤵
  PID:8824
- C:\Windows\System\yEEJspA.exe
  C:\Windows\System\yEEJspA.exe
  2⤵
  PID:8844
- C:\Windows\System\HpofEHQ.exe
  C:\Windows\System\HpofEHQ.exe
  2⤵
  PID:8860
- C:\Windows\System\EfGizHB.exe
  C:\Windows\System\EfGizHB.exe
  2⤵
  PID:8876
- C:\Windows\System\KdQIYpd.exe
  C:\Windows\System\KdQIYpd.exe
  2⤵
  PID:8892
- C:\Windows\System\YvPuguj.exe
  C:\Windows\System\YvPuguj.exe
  2⤵
  PID:8912
- C:\Windows\System\pmxKaMS.exe
  C:\Windows\System\pmxKaMS.exe
  2⤵
  PID:8928
- C:\Windows\System\hHAGnKM.exe
  C:\Windows\System\hHAGnKM.exe
  2⤵
  PID:8944
- C:\Windows\System\vZXxYSK.exe
  C:\Windows\System\vZXxYSK.exe
  2⤵
  PID:8964
- C:\Windows\System\ZZetOiP.exe
  C:\Windows\System\ZZetOiP.exe
  2⤵
  PID:8980
- C:\Windows\System\MkwzseQ.exe
  C:\Windows\System\MkwzseQ.exe
  2⤵
  PID:9000
- C:\Windows\System\hmHhrCU.exe
  C:\Windows\System\hmHhrCU.exe
  2⤵
  PID:9020
- C:\Windows\System\kZEKRoj.exe
  C:\Windows\System\kZEKRoj.exe
  2⤵
  PID:9040
- C:\Windows\System\RHdgwip.exe
  C:\Windows\System\RHdgwip.exe
  2⤵
  PID:9056
- C:\Windows\System\SasDwkU.exe
  C:\Windows\System\SasDwkU.exe
  2⤵
  PID:9072
- C:\Windows\System\PaQCxTN.exe
  C:\Windows\System\PaQCxTN.exe
  2⤵
  PID:9088
- C:\Windows\System\xvejvGB.exe
  C:\Windows\System\xvejvGB.exe
  2⤵
  PID:9104
- C:\Windows\System\OIyoQWF.exe
  C:\Windows\System\OIyoQWF.exe
  2⤵
  PID:9120
- C:\Windows\System\CXgpFLK.exe
  C:\Windows\System\CXgpFLK.exe
  2⤵
  PID:9136
- C:\Windows\System\HBnhyaY.exe
  C:\Windows\System\HBnhyaY.exe
  2⤵
  PID:9152
- C:\Windows\System\PJkdGKw.exe
  C:\Windows\System\PJkdGKw.exe
  2⤵
  PID:9168
- C:\Windows\System\jaAhxtu.exe
  C:\Windows\System\jaAhxtu.exe
  2⤵
  PID:9184
- C:\Windows\System\OagoZZu.exe
  C:\Windows\System\OagoZZu.exe
  2⤵
  PID:9200
- C:\Windows\System\WyGVZXo.exe
  C:\Windows\System\WyGVZXo.exe
  2⤵
  PID:7500
- C:\Windows\System\BhEKvjU.exe
  C:\Windows\System\BhEKvjU.exe
  2⤵
  PID:7636
- C:\Windows\System\PObfRkn.exe
  C:\Windows\System\PObfRkn.exe
  2⤵
  PID:7696
- C:\Windows\System\XiuBxmS.exe
  C:\Windows\System\XiuBxmS.exe
  2⤵
  PID:7792
- C:\Windows\System\vjtFEVI.exe
  C:\Windows\System\vjtFEVI.exe
  2⤵
  PID:7944
- C:\Windows\System\tMQEOyB.exe
  C:\Windows\System\tMQEOyB.exe
  2⤵
  PID:8036
- C:\Windows\System\LyUfuIj.exe
  C:\Windows\System\LyUfuIj.exe
  2⤵
  PID:8096
- C:\Windows\System\XutthBb.exe
  C:\Windows\System\XutthBb.exe
  2⤵
  PID:8188
- C:\Windows\System\csqQjMa.exe
  C:\Windows\System\csqQjMa.exe
  2⤵
  PID:8196
- C:\Windows\System\ozxPQBD.exe
  C:\Windows\System\ozxPQBD.exe
  2⤵
  PID:8260
- C:\Windows\System\lMuyeRD.exe
  C:\Windows\System\lMuyeRD.exe
  2⤵
  PID:8364
- C:\Windows\System\QiQEUGD.exe
  C:\Windows\System\QiQEUGD.exe
  2⤵
  PID:8404
- C:\Windows\System\QMRhjkX.exe
  C:\Windows\System\QMRhjkX.exe
  2⤵
  PID:8540
- C:\Windows\System\iafYFCG.exe
  C:\Windows\System\iafYFCG.exe
  2⤵
  PID:8608
- C:\Windows\System\rrCvHKU.exe
  C:\Windows\System\rrCvHKU.exe
  2⤵
  PID:8332
- C:\Windows\System\wgFBCEt.exe
  C:\Windows\System\wgFBCEt.exe
  2⤵
  PID:8684
- C:\Windows\System\mxiycrS.exe
  C:\Windows\System\mxiycrS.exe
  2⤵
  PID:8716
- C:\Windows\System\ZxqBFVV.exe
  C:\Windows\System\ZxqBFVV.exe
  2⤵
  PID:8784
- C:\Windows\System\lYvktNu.exe
  C:\Windows\System\lYvktNu.exe
  2⤵
  PID:8884
- C:\Windows\System\RDiilEc.exe
  C:\Windows\System\RDiilEc.exe
  2⤵
  PID:8960
- C:\Windows\System\NOwUwPe.exe
  C:\Windows\System\NOwUwPe.exe
  2⤵
  PID:7172
- C:\Windows\System\ZrBhEtn.exe
  C:\Windows\System\ZrBhEtn.exe
  2⤵
  PID:7364
- C:\Windows\System\uzzHOnZ.exe
  C:\Windows\System\uzzHOnZ.exe
  2⤵
  PID:7520
- C:\Windows\System\HuDrVsp.exe
  C:\Windows\System\HuDrVsp.exe
  2⤵
  PID:7732
- C:\Windows\System\RnioAiU.exe
  C:\Windows\System\RnioAiU.exe
  2⤵
  PID:8176
- C:\Windows\System\KUpVlwX.exe
  C:\Windows\System\KUpVlwX.exe
  2⤵
  PID:7304
- C:\Windows\System\KCdwbar.exe
  C:\Windows\System\KCdwbar.exe
  2⤵
  PID:7640
- C:\Windows\System\VQmEkCO.exe
  C:\Windows\System\VQmEkCO.exe
  2⤵
  PID:7700
- C:\Windows\System\IaBCixb.exe
  C:\Windows\System\IaBCixb.exe
  2⤵
  PID:7856
- C:\Windows\System\GYXAXAf.exe
  C:\Windows\System\GYXAXAf.exe
  2⤵
  PID:7904
- C:\Windows\System\Gbndpkr.exe
  C:\Windows\System\Gbndpkr.exe
  2⤵
  PID:8004
- C:\Windows\System\YrdlZtF.exe
  C:\Windows\System\YrdlZtF.exe
  2⤵
  PID:8124
- C:\Windows\System\pZdYNcn.exe
  C:\Windows\System\pZdYNcn.exe
  2⤵
  PID:7192
- C:\Windows\System\TtKCZSI.exe
  C:\Windows\System\TtKCZSI.exe
  2⤵
  PID:8216
- C:\Windows\System\WWHuvvY.exe
  C:\Windows\System\WWHuvvY.exe
  2⤵
  PID:8284
- C:\Windows\System\IisueTj.exe
  C:\Windows\System\IisueTj.exe
  2⤵
  PID:8380
- C:\Windows\System\BJhOrgM.exe
  C:\Windows\System\BJhOrgM.exe
  2⤵
  PID:8448
- C:\Windows\System\mDxcgmn.exe
  C:\Windows\System\mDxcgmn.exe
  2⤵
  PID:8524
- C:\Windows\System\cePdKvu.exe
  C:\Windows\System\cePdKvu.exe
  2⤵
  PID:8592
- C:\Windows\System\OjPuQOK.exe
  C:\Windows\System\OjPuQOK.exe
  2⤵
  PID:8632
- C:\Windows\System\AXiCpky.exe
  C:\Windows\System\AXiCpky.exe
  2⤵
  PID:8696
- C:\Windows\System\clBZmbs.exe
  C:\Windows\System\clBZmbs.exe
  2⤵
  PID:8764
- C:\Windows\System\EkTcLCZ.exe
  C:\Windows\System\EkTcLCZ.exe
  2⤵
  PID:8832
- C:\Windows\System\BjOIQIb.exe
  C:\Windows\System\BjOIQIb.exe
  2⤵
  PID:8872
- C:\Windows\System\hAcPvZM.exe
  C:\Windows\System\hAcPvZM.exe
  2⤵
  PID:8936
- C:\Windows\System\RwOXuxO.exe
  C:\Windows\System\RwOXuxO.exe
  2⤵
  PID:9008
- C:\Windows\System\DWocQKi.exe
  C:\Windows\System\DWocQKi.exe
  2⤵
  PID:9048
- C:\Windows\System\DEKIYeR.exe
  C:\Windows\System\DEKIYeR.exe
  2⤵
  PID:9096
- C:\Windows\System\yIGldGc.exe
  C:\Windows\System\yIGldGc.exe
  2⤵
  PID:9164
- C:\Windows\System\FLIlNUP.exe
  C:\Windows\System\FLIlNUP.exe
  2⤵
  PID:7728
- C:\Windows\System\gPkKcuZ.exe
  C:\Windows\System\gPkKcuZ.exe
  2⤵
  PID:9084
- C:\Windows\System\xqvrgvD.exe
  C:\Windows\System\xqvrgvD.exe
  2⤵
  PID:9144
- C:\Windows\System\rjCvQPO.exe
  C:\Windows\System\rjCvQPO.exe
  2⤵
  PID:9180
- C:\Windows\System\qXLObao.exe
  C:\Windows\System\qXLObao.exe
  2⤵
  PID:7924
- C:\Windows\System\HHFkXuG.exe
  C:\Windows\System\HHFkXuG.exe
  2⤵
  PID:8336
- C:\Windows\System\bHAsBcB.exe
  C:\Windows\System\bHAsBcB.exe
  2⤵
  PID:8504
- C:\Windows\System\qHvwuqv.exe
  C:\Windows\System\qHvwuqv.exe
  2⤵
  PID:8432
- C:\Windows\System\rsPJYzp.exe
  C:\Windows\System\rsPJYzp.exe
  2⤵
  PID:8080
- C:\Windows\System\nowqTXG.exe
  C:\Windows\System\nowqTXG.exe
  2⤵
  PID:8856
- C:\Windows\System\CbBDtCY.exe
  C:\Windows\System\CbBDtCY.exe
  2⤵
  PID:8268
- C:\Windows\System\qvLpETW.exe
  C:\Windows\System\qvLpETW.exe
  2⤵
  PID:8920
- C:\Windows\System\PRjQWuH.exe
  C:\Windows\System\PRjQWuH.exe
  2⤵
  PID:7328
- C:\Windows\System\TFdFHvC.exe
  C:\Windows\System\TFdFHvC.exe
  2⤵
  PID:8564
- C:\Windows\System\YOotrgx.exe
  C:\Windows\System\YOotrgx.exe
  2⤵
  PID:8472
- C:\Windows\System\mSiHPGz.exe
  C:\Windows\System\mSiHPGz.exe
  2⤵
  PID:7676
- C:\Windows\System\rNJwZuC.exe
  C:\Windows\System\rNJwZuC.exe
  2⤵
  PID:8172
- C:\Windows\System\vRBIgsO.exe
  C:\Windows\System\vRBIgsO.exe
  2⤵
  PID:7760
- C:\Windows\System\xTfbvQe.exe
  C:\Windows\System\xTfbvQe.exe
  2⤵
  PID:8212
- C:\Windows\System\vLVwboM.exe
  C:\Windows\System\vLVwboM.exe
  2⤵
  PID:8520
- C:\Windows\System\hQsNTkE.exe
  C:\Windows\System\hQsNTkE.exe
  2⤵
  PID:8840
- C:\Windows\System\oYJylPx.exe
  C:\Windows\System\oYJylPx.exe
  2⤵
  PID:9052
- C:\Windows\System\zMiJJBS.exe
  C:\Windows\System\zMiJJBS.exe
  2⤵
  PID:7580
- C:\Windows\System\ZgqzHwa.exe
  C:\Windows\System\ZgqzHwa.exe
  2⤵
  PID:8908
- C:\Windows\System\rAjmHsU.exe
  C:\Windows\System\rAjmHsU.exe
  2⤵
  PID:8248
- C:\Windows\System\xWREkCB.exe
  C:\Windows\System\xWREkCB.exe
  2⤵
  PID:8156
- C:\Windows\System\RIcitRG.exe
  C:\Windows\System\RIcitRG.exe
  2⤵
  PID:8384
- C:\Windows\System\sNJVCDc.exe
  C:\Windows\System\sNJVCDc.exe
  2⤵
  PID:9116
- C:\Windows\System\xCwIkzL.exe
  C:\Windows\System\xCwIkzL.exe
  2⤵
  PID:9132
- C:\Windows\System\LzSLtQj.exe
  C:\Windows\System\LzSLtQj.exe
  2⤵
  PID:8232
- C:\Windows\System\TrOAqll.exe
  C:\Windows\System\TrOAqll.exe
  2⤵
  PID:8952
- C:\Windows\System\GfKrjBV.exe
  C:\Windows\System\GfKrjBV.exe
  2⤵
  PID:8476
- C:\Windows\System\qnJZNDo.exe
  C:\Windows\System\qnJZNDo.exe
  2⤵
  PID:8044
- C:\Windows\System\EDETTGI.exe
  C:\Windows\System\EDETTGI.exe
  2⤵
  PID:9208
- C:\Windows\System\QonmfFA.exe
  C:\Windows\System\QonmfFA.exe
  2⤵
  PID:8464
- C:\Windows\System\MEacfyR.exe
  C:\Windows\System\MEacfyR.exe
  2⤵
  PID:8780
- C:\Windows\System\FPIgBCF.exe
  C:\Windows\System\FPIgBCF.exe
  2⤵
  PID:8580
- C:\Windows\System\brooWEz.exe
  C:\Windows\System\brooWEz.exe
  2⤵
  PID:8088
- C:\Windows\System\jTAZKxA.exe
  C:\Windows\System\jTAZKxA.exe
  2⤵
  PID:8144
- C:\Windows\System\ymBikNc.exe
  C:\Windows\System\ymBikNc.exe
  2⤵
  PID:8628
- C:\Windows\System\tMFVkcS.exe
  C:\Windows\System\tMFVkcS.exe
  2⤵
  PID:9068
- C:\Windows\System\NgbFtGV.exe
  C:\Windows\System\NgbFtGV.exe
  2⤵
  PID:8280
- C:\Windows\System\dFRfgjj.exe
  C:\Windows\System\dFRfgjj.exe
  2⤵
  PID:8668
- C:\Windows\System\azaSITC.exe
  C:\Windows\System\azaSITC.exe
  2⤵
  PID:8556
- C:\Windows\System\mpbzgNp.exe
  C:\Windows\System\mpbzgNp.exe
  2⤵
  PID:9080
- C:\Windows\System\XLknIFH.exe
  C:\Windows\System\XLknIFH.exe
  2⤵
  PID:8652
- C:\Windows\System\mkIkxyI.exe
  C:\Windows\System\mkIkxyI.exe
  2⤵
  PID:8624
- C:\Windows\System\FSkqzMg.exe
  C:\Windows\System\FSkqzMg.exe
  2⤵
  PID:8972
- C:\Windows\System\FNdcvdA.exe
  C:\Windows\System\FNdcvdA.exe
  2⤵
  PID:9128
- C:\Windows\System\uvMgPEe.exe
  C:\Windows\System\uvMgPEe.exe
  2⤵
  PID:9232
- C:\Windows\System\sdOrXVR.exe
  C:\Windows\System\sdOrXVR.exe
  2⤵
  PID:9248
- C:\Windows\System\uvtwYSk.exe
  C:\Windows\System\uvtwYSk.exe
  2⤵
  PID:9268
- C:\Windows\System\cJqcwEn.exe
  C:\Windows\System\cJqcwEn.exe
  2⤵
  PID:9288
- C:\Windows\System\XTmYssD.exe
  C:\Windows\System\XTmYssD.exe
  2⤵
  PID:9304
- C:\Windows\System\hEujgrb.exe
  C:\Windows\System\hEujgrb.exe
  2⤵
  PID:9320
- C:\Windows\System\zZWsHMP.exe
  C:\Windows\System\zZWsHMP.exe
  2⤵
  PID:9336
- C:\Windows\System\lACHXBp.exe
  C:\Windows\System\lACHXBp.exe
  2⤵
  PID:9352
- C:\Windows\System\UUWKQHA.exe
  C:\Windows\System\UUWKQHA.exe
  2⤵
  PID:9372
- C:\Windows\System\RFiDWtp.exe
  C:\Windows\System\RFiDWtp.exe
  2⤵
  PID:9388
- C:\Windows\System\LcZwlFA.exe
  C:\Windows\System\LcZwlFA.exe
  2⤵
  PID:9404
- C:\Windows\System\IAlffYH.exe
  C:\Windows\System\IAlffYH.exe
  2⤵
  PID:9420
- C:\Windows\System\HYvebHh.exe
  C:\Windows\System\HYvebHh.exe
  2⤵
  PID:9444
- C:\Windows\System\DRdCNCC.exe
  C:\Windows\System\DRdCNCC.exe
  2⤵
  PID:9460
- C:\Windows\System\qGyDZGK.exe
  C:\Windows\System\qGyDZGK.exe
  2⤵
  PID:9476
- C:\Windows\System\NwIGZPJ.exe
  C:\Windows\System\NwIGZPJ.exe
  2⤵
  PID:9492
- C:\Windows\System\PrrGbty.exe
  C:\Windows\System\PrrGbty.exe
  2⤵
  PID:9508
- C:\Windows\System\WuMjRAA.exe
  C:\Windows\System\WuMjRAA.exe
  2⤵
  PID:9524
- C:\Windows\System\bTokpVq.exe
  C:\Windows\System\bTokpVq.exe
  2⤵
  PID:9540
- C:\Windows\System\sBuxnLr.exe
  C:\Windows\System\sBuxnLr.exe
  2⤵
  PID:9556
- C:\Windows\System\nPrhnoy.exe
  C:\Windows\System\nPrhnoy.exe
  2⤵
  PID:9576
- C:\Windows\System\CEiaGuu.exe
  C:\Windows\System\CEiaGuu.exe
  2⤵
  PID:9592
- C:\Windows\System\ehmlptg.exe
  C:\Windows\System\ehmlptg.exe
  2⤵
  PID:9608
- C:\Windows\System\rBzmlKk.exe
  C:\Windows\System\rBzmlKk.exe
  2⤵
  PID:9624
- C:\Windows\System\opemByt.exe
  C:\Windows\System\opemByt.exe
  2⤵
  PID:9640
- C:\Windows\System\WtSgRQU.exe
  C:\Windows\System\WtSgRQU.exe
  2⤵
  PID:9660
- C:\Windows\System\PYlFmds.exe
  C:\Windows\System\PYlFmds.exe
  2⤵
  PID:9784
- C:\Windows\System\SnhgYVE.exe
  C:\Windows\System\SnhgYVE.exe
  2⤵
  PID:9808
- C:\Windows\System\pKJxJyP.exe
  C:\Windows\System\pKJxJyP.exe
  2⤵
  PID:9824
- C:\Windows\System\TsGjpgc.exe
  C:\Windows\System\TsGjpgc.exe
  2⤵
  PID:9840
- C:\Windows\System\dLwmCDg.exe
  C:\Windows\System\dLwmCDg.exe
  2⤵
  PID:9876
- C:\Windows\System\ARdyqes.exe
  C:\Windows\System\ARdyqes.exe
  2⤵
  PID:9892
- C:\Windows\System\viALQaQ.exe
  C:\Windows\System\viALQaQ.exe
  2⤵
  PID:9912
- C:\Windows\System\oslafil.exe
  C:\Windows\System\oslafil.exe
  2⤵
  PID:9928
- C:\Windows\System\wLgohlZ.exe
  C:\Windows\System\wLgohlZ.exe
  2⤵
  PID:9944
- C:\Windows\System\dxZMRyx.exe
  C:\Windows\System\dxZMRyx.exe
  2⤵
  PID:9964
- C:\Windows\System\GAxezEk.exe
  C:\Windows\System\GAxezEk.exe
  2⤵
  PID:9980
- C:\Windows\System\UQGOVmp.exe
  C:\Windows\System\UQGOVmp.exe
  2⤵
  PID:9996
- C:\Windows\System\iEzBwAl.exe
  C:\Windows\System\iEzBwAl.exe
  2⤵
  PID:10012
- C:\Windows\System\RNfuytN.exe
  C:\Windows\System\RNfuytN.exe
  2⤵
  PID:10032
- C:\Windows\System\fKFpUOm.exe
  C:\Windows\System\fKFpUOm.exe
  2⤵
  PID:10048
- C:\Windows\System\ZLqTPLz.exe
  C:\Windows\System\ZLqTPLz.exe
  2⤵
  PID:10064
- C:\Windows\System\pBHOpjq.exe
  C:\Windows\System\pBHOpjq.exe
  2⤵
  PID:10084
- C:\Windows\System\jmNxWAP.exe
  C:\Windows\System\jmNxWAP.exe
  2⤵
  PID:10100
- C:\Windows\System\QroPTfr.exe
  C:\Windows\System\QroPTfr.exe
  2⤵
  PID:10116
- C:\Windows\System\kGJAuDS.exe
  C:\Windows\System\kGJAuDS.exe
  2⤵
  PID:10132
- C:\Windows\System\WycWcqf.exe
  C:\Windows\System\WycWcqf.exe
  2⤵
  PID:10152
- C:\Windows\System\kHauubZ.exe
  C:\Windows\System\kHauubZ.exe
  2⤵
  PID:10168
- C:\Windows\System\aTJzDuI.exe
  C:\Windows\System\aTJzDuI.exe
  2⤵
  PID:10184
- C:\Windows\System\mOjozQL.exe
  C:\Windows\System\mOjozQL.exe
  2⤵
  PID:10200
- C:\Windows\System\hqkUBPg.exe
  C:\Windows\System\hqkUBPg.exe
  2⤵
  PID:10216
- C:\Windows\System\ZwYlnPy.exe
  C:\Windows\System\ZwYlnPy.exe
  2⤵
  PID:7748
- C:\Windows\System\pPXEluf.exe
  C:\Windows\System\pPXEluf.exe
  2⤵
  PID:9240
- C:\Windows\System\AGPzLzv.exe
  C:\Windows\System\AGPzLzv.exe
  2⤵
  PID:9276
- C:\Windows\System\HrBSmve.exe
  C:\Windows\System\HrBSmve.exe
  2⤵
  PID:9296
- C:\Windows\System\qOAVSZu.exe
  C:\Windows\System\qOAVSZu.exe
  2⤵
  PID:9348
- C:\Windows\System\fgGgqZV.exe
  C:\Windows\System\fgGgqZV.exe
  2⤵
  PID:9416
- C:\Windows\System\AfVhJuv.exe
  C:\Windows\System\AfVhJuv.exe
  2⤵
  PID:9360
- C:\Windows\System\OoKiFCL.exe
  C:\Windows\System\OoKiFCL.exe
  2⤵
  PID:9440
- C:\Windows\System\RHMhuyJ.exe
  C:\Windows\System\RHMhuyJ.exe
  2⤵
  PID:9488
- C:\Windows\System\GjfBoGw.exe
  C:\Windows\System\GjfBoGw.exe
  2⤵
  PID:9552
- C:\Windows\System\OZmYssn.exe
  C:\Windows\System\OZmYssn.exe
  2⤵
  PID:9588
- C:\Windows\System\YEgzIHx.exe
  C:\Windows\System\YEgzIHx.exe
  2⤵
  PID:9656
- C:\Windows\System\AMiWcqg.exe
  C:\Windows\System\AMiWcqg.exe
  2⤵
  PID:9532
- C:\Windows\System\FUdwAdP.exe
  C:\Windows\System\FUdwAdP.exe
  2⤵
  PID:9632
- C:\Windows\System\gtkSVeN.exe
  C:\Windows\System\gtkSVeN.exe
  2⤵
  PID:9684
- C:\Windows\System\EJjlwdx.exe
  C:\Windows\System\EJjlwdx.exe
  2⤵
  PID:9700
- C:\Windows\System\lIOZNKJ.exe
  C:\Windows\System\lIOZNKJ.exe
  2⤵
  PID:9712
- C:\Windows\System\QzXsOdw.exe
  C:\Windows\System\QzXsOdw.exe
  2⤵
  PID:9732
- C:\Windows\System\xZTAsIt.exe
  C:\Windows\System\xZTAsIt.exe
  2⤵
  PID:9748
- C:\Windows\System\WonxbbT.exe
  C:\Windows\System\WonxbbT.exe
  2⤵
  PID:9764
- C:\Windows\System\LryhnEa.exe
  C:\Windows\System\LryhnEa.exe
  2⤵
  PID:9776
- C:\Windows\System\FyOJPbP.exe
  C:\Windows\System\FyOJPbP.exe
  2⤵
  PID:9564
- C:\Windows\System\Rdtoxwd.exe
  C:\Windows\System\Rdtoxwd.exe
  2⤵
  PID:9836
- C:\Windows\System\jDIBcNw.exe
  C:\Windows\System\jDIBcNw.exe
  2⤵
  PID:9924
- C:\Windows\System\nBkiBPu.exe
  C:\Windows\System\nBkiBPu.exe
  2⤵
  PID:10024
- C:\Windows\System\dFJQzMl.exe
  C:\Windows\System\dFJQzMl.exe
  2⤵
  PID:10056
- C:\Windows\System\FdsbfGq.exe
  C:\Windows\System\FdsbfGq.exe
  2⤵
  PID:10096
- C:\Windows\System\idZHTpH.exe
  C:\Windows\System\idZHTpH.exe
  2⤵
  PID:9864
- C:\Windows\System\HQbLiTQ.exe
  C:\Windows\System\HQbLiTQ.exe
  2⤵
  PID:9976
- C:\Windows\System\dMiXTfC.exe
  C:\Windows\System\dMiXTfC.exe
  2⤵
  PID:10044
- C:\Windows\System\eGZoIjA.exe
  C:\Windows\System\eGZoIjA.exe
  2⤵
  PID:10108
- C:\Windows\System\FRhGBcZ.exe
  C:\Windows\System\FRhGBcZ.exe
  2⤵
  PID:10148
- C:\Windows\System\WsuRlHB.exe
  C:\Windows\System\WsuRlHB.exe
  2⤵
  PID:7688
- C:\Windows\System\ZuAqlmI.exe
  C:\Windows\System\ZuAqlmI.exe
  2⤵
  PID:9312
- C:\Windows\System\uXXgnJT.exe
  C:\Windows\System\uXXgnJT.exe
  2⤵
  PID:9584
- C:\Windows\System\QESAOXL.exe
  C:\Windows\System\QESAOXL.exe
  2⤵
  PID:9328
- C:\Windows\System\RWVVxdZ.exe
  C:\Windows\System\RWVVxdZ.exe
  2⤵
  PID:9708
- C:\Windows\System\grxcwZf.exe
  C:\Windows\System\grxcwZf.exe
  2⤵
  PID:9600

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BoihCwb.exe

Filesize
1.5MB

MD5
68955fe05e683f212059ed799cac97d4

SHA1
08b5d8c6204e415433941555644157f876e7b7de

SHA256
abe1c7b5b2c6faca6d196254f20798e62c9c18af0b1fd0af551220c9d6732bfc

SHA512
68b209c359905a677b793be08c5e1c0ebb03da0625c47494954e032235c6bb6ee879f7d63bc57f50d1b0bc924c145a6c0ab1117a3822805bab2207ee3bb99183

Download Submit
C:\Windows\system\DquvYdV.exe

Filesize
1.5MB

MD5
bd436d2c9345112e6866f28b10c8bfe1

SHA1
5f9753fb5fc4ccdc9fe199ea61cad4f1b65de069

SHA256
02b4fc655a4b6245b31ee937ab12ef3632e70f68999526a54761a246ff889262

SHA512
0788d12d3965f7b1f0aeb9c1333c2aa39a44e29c8c64c84a721ca3f6bcc25ee4a0f5d029c560b160a7da5319aa743b65a3217b284756be48310ea450efa94aeb

Download Submit
C:\Windows\system\FiwICPx.exe

Filesize
1.5MB

MD5
3096aae6cdd4e477e97d95304d1b443e

SHA1
ff1b229f3de08fd5ab41a36607f5e55338781271

SHA256
cc711b89f1c1faf44a0038faad219a71a9e619161a79baa2a0c47b7a2c2df776

SHA512
4f8b028eeb7f76e72a4d62ffad07e47f1db8801623941ba420e6b1e8d70c48f889afcdf95add5bdc6115670ab2880ee6db4139b1965938fe2d057971e7127195

Download Submit
C:\Windows\system\KvDtOQt.exe

Filesize
1.5MB

MD5
b82ba64750e2d8ae9e26068d3300ecbf

SHA1
061d10ae4af3e390e671db3d530a196b9f2a2261

SHA256
78499e80a49af461d1bef625da30a2411b7b1192f2d95525858fb397ff036b2a

SHA512
ef38bd2aa02fcf0906516ce0fe2775e6616e745aec1e27efd7b38eb40526896da59169c71ce9ac86bd550fa865a92cb111ef4fd3ce3f87f5e18287238b060c88

Download Submit
C:\Windows\system\LxJubRM.exe

Filesize
1.5MB

MD5
f02d6448d28d94d13c94a685c162e98c

SHA1
c497d872fb20d3d3144f01643fe2ecbe5fee6afc

SHA256
00eb5f3bf3100ea806511e7576ac783e1ac1a02325053c0b884075331176b663

SHA512
41e6b7c493d7c2df31d75122b5e12621f3af1d0b620f9a33bde1e517f04f192b2cbbdfa63edbc655bc68f3223f911416748ab43a93c9f24d9895c9cfca1587e1

Download Submit
C:\Windows\system\PCqLAuD.exe

Filesize
1.5MB

MD5
6d1454c158ce9eedb615a600ff39933b

SHA1
c6b3107a01eb1f677ddeb7bdaf7c3a0a400eed72

SHA256
58962cb76da9cafae816dc80e347b893b682f096f6d687fcfd7573c508469be1

SHA512
9a2346a8ad21b98e5449c5447e6f528e5e5c586d7509931c5e483d1a023805ec03e8e80322fe4f485ab3776fca6bcff8d4bed9cd285376da55ef462c57d64694

Download Submit
C:\Windows\system\PgxuULj.exe

Filesize
1.5MB

MD5
fb1b5ac5496a2a33d02eb6e2e75053bd

SHA1
95f6bbc47ac133babd74ea69b395107212f20baa

SHA256
5f8017618c2cdaa695199e15c9669327ffa5b0df06b2ed80b17921afe9c085b6

SHA512
3c86aef626a3c2164563e25569200c43ca5789f7f62202efb44208f704e7c302242f01a65b42f43f590c5d62f9a70527e931a44c1c0d35766818d2bd4b7aecec

Download Submit
C:\Windows\system\UoBdixZ.exe

Filesize
1.5MB

MD5
4a757fd26061d7f5d926a28a2a6e7495

SHA1
2b633cc68cb0a4f9d7797d91110595459fe2f115

SHA256
734e9ae2883c57843f4b0aca461979ef760d7b85da1c17dc8f5e4857aa0bfd17

SHA512
eb26eb00d41abb567d567d29195e21ad76a1bfef054eb9b926768674923ae892937f1bb1ae4134514accaf72a9277c918cef54e15fadbcebf086ff1d4809e1bd

Download Submit
C:\Windows\system\XYyZabd.exe

Filesize
1.5MB

MD5
4ccb85cbed20e64e9e64705443c211df

SHA1
6d18bdcc712b958853c6c246c15f2ab744ceacc0

SHA256
5b4afd35d32dd62ed792edd75651fab1c24481670b3e8f94ba6c0469726d0848

SHA512
56438a92f4a94e1c8b50cad8fd25cb68cf69652c1a7e6a645b7a7223833f2730c4e0e9e293d0820d2b315ea0a6fc5829800342d454d0099b694665fca59c5974

Download Submit
C:\Windows\system\aoBUfpw.exe

Filesize
1.5MB

MD5
94d1e675ab957196c4c21df635aa69ca

SHA1
905e66af53740ad4db40c1d277f00907e2b81b02

SHA256
34175fe0d1c167247c4ce24ed483b386104973b7a8b2c6791c3fd2b3cf4546a8

SHA512
3dda3820d4a85758b46ff8e7e42627b91b6d7faaf239fd59a8bb2cc1ba01d07a7600e4c9002d805a03a750398b09d29d4d2eb570a285ec3e1927443ba681039b

Download Submit
C:\Windows\system\keqgqkC.exe

Filesize
1.5MB

MD5
441ee35b0733944baab6a512e5dfa39d

SHA1
628bcfd4075b8c40f2b985b977e4c50e65553a74

SHA256
19a4e7aa8b2f0aaf1a116216c5fcd63c3f1d0c16deaa9b722d3c2b648829cbf9

SHA512
0244a573287ac624f26fcc4873d0ea6ccb47e50bf75b6ac700f6dfa0a224f03cf469acf5ebe6ad9ff7f8ee7dc3696b20f111ef73de5fcfdd6f86c4e1ac45935f

Download Submit
C:\Windows\system\loAxYnp.exe

Filesize
1.5MB

MD5
3969f4f5b012edf3fa98f78fee7c2a74

SHA1
cbcf8518e314309f29cf29a480231e095a6c1109

SHA256
20b8fc0ec2f8bbad116337846e2ec5ec094c9494816ae23eed0fcbf1390109cf

SHA512
5969b1834459f68d5674af11616575d801590908cb782bebecefd609b5dc1d91fb2f22da1719a132c38a2a5a0857314e006d956d9a3cb8d4c6fd4cf82965b035

Download Submit
C:\Windows\system\mncxOFB.exe

Filesize
1.5MB

MD5
8b9b54af98d167c1465ebd6aff70c9f0

SHA1
2d8b6b809456cdc3295fb224b6d2e5e63eaf13fd

SHA256
9a82a0e819cc4be092295f42fdbbee0f15187a5a4828fbb0e8b0f9d7f66fda64

SHA512
92b59baee9f8727927f1f441fa182498d68fbc31e44985eebc56b62f36f12752e7e8e7d1861a9b0539f86e8b9983371e0395605de06821bd8b5ffec78d414285

Download Submit
C:\Windows\system\oAacyFj.exe

Filesize
1.5MB

MD5
c3a818dccddc08ab36d12ea29ca13b37

SHA1
549458cf192036acaec2004f2fdd32d0b4abe1fc

SHA256
27593defa62b1811bc6fadde0f8c5bd8d131980d52f2f2804378ba8101faa903

SHA512
9a8849a05c97ee70efd2595dfcfdfda7184209437a1f2d499fabf778929cc53ef7e75a032c65f6bddffaa31bf44fb932423942b3e8eeb579ad23522026aebfe0

Download Submit
C:\Windows\system\oXcGlkq.exe

Filesize
1.5MB

MD5
3a946595cda251101f8c89f207d8561d

SHA1
5ea7e8a6d51189d65bc503c5d6baebcb924279fe

SHA256
95bfba2beeb63d613e4d83ab97e6325218935f8053d9c70de2b38975e698227e

SHA512
431d42232257f403d7482c12dc69d55d0cbd718dcae3ab7878eb0b04a0f72533aa2d5e4992cd32da93b6aa7e2b50b31ef245c1e249630cd349b5a3f557c42ef4

Download Submit
C:\Windows\system\sUgihYO.exe

Filesize
1.5MB

MD5
362c0887e971c5d786969c46a12ac699

SHA1
df22725fde03645b96fc8585ac663b9da2e002fc

SHA256
7ae67747ce45432e6a7b88d5ae3cac01519d8a0f12f7926386a2a96055254393

SHA512
2d053680f8119fd7541491d249cb4cefdc5f9f9fa86fdbdc3e3c5bc1c3cafe5ae559b9347a92f9e7aeb4b8268982a44ad821984f6cc7890d999042b324dc4a75

Download Submit
C:\Windows\system\uzUkwUs.exe

Filesize
1.5MB

MD5
fa46eb2ff60bdffdc5dc7e0659dd5060

SHA1
583d593c8b7e156045c9650d7b67ad51ab7b6e76

SHA256
b6a18d10f7d23b31577d02254fb4f15707bd9130f4a384480c6055dcdf1df6c9

SHA512
5a80235c009a78b2df302fa26bf03919f78cfc9fd5efef5af3881d3e50b11b8f17a733aae76f0b6f4c086768a72277068175e1e9924f61c3f9132bb587473a27

Download Submit
C:\Windows\system\wQFKCHK.exe

Filesize
1.5MB

MD5
b69ac627531d64e496864145fad92e92

SHA1
2a06293981dbb3b512b68631a6865d439efa8b24

SHA256
9c5f8d4904d95a3fe7a54b03be67065bcc9ea94d1af75670c419d1be4d7c0baf

SHA512
a42f01691b00b4777a28f191fdbf561e190c1497db6b6db831f4ac6e69827a0a675b3464872bbae15bb3f125bf0d903fa256eb16be9a02594be52aaf65f49ae6

Download Submit
C:\Windows\system\yZWFyjv.exe

Filesize
1.5MB

MD5
61464a3484f8c5e7ed3c1539e1930aca

SHA1
894b9dac13bdf27af92c75fe43d369ea694c1a9d

SHA256
0bad81630d791ed99b098765e842ed2a75e55ca553dc46d76b6a5f6476bb5ce2

SHA512
8f5ad14948b558167e6ac16597e76e2cca4a4aabd0aafb601bb0500753a252aee3ca5c40116f5a942219bf7f5a318329ea02cd0527ec213361aa5a18a2021f33

Download Submit
C:\Windows\system\zMbJLDJ.exe

Filesize
1.5MB

MD5
b60aef3654e6c8f65a325bd7abed7f00

SHA1
33924670ba5f5e44923757ffda41107c97606e36

SHA256
3918300ddcc171b90ad6e68473c2726c32baf7c6b449760a8f8044fbb3c1f156

SHA512
467bf2913a0ccd3fa331a3931577417e9ff85726b7616c4be687919d3e5c926b97c5ee02b4b4006228e1e421faed23e3143f9d8a4a6f475600fbdddfc2e1a668

Download Submit
C:\Windows\system\zqcTaDl.exe

Filesize
1.5MB

MD5
6400992b82307e3ff79e400b7cee23de

SHA1
7568d5668d96cb3d9af8ca91db773055eda71de9

SHA256
7d2a0bd6908a1e1f1d2d8a51076d5e210c39df49a8eda6eb79dbff81e20aef63

SHA512
335176051e80b6c4097ea0ca5fd02085a354b7f4ce65f499931c808956670587eb9726f434f39e06fcbdc05ce179a8fefadfe9649331ab12170c0637bee3ccac

Download Submit
\Windows\system\DFTxRtX.exe

Filesize
1.5MB

MD5
d601f4fa51adf6fe889259245a378052

SHA1
a0785bbb5f8bf83ad70892f03239052c541e6bd9

SHA256
2172f4cf9f3bb8b251366e53f76b28c00c5a3102cbfd9315c43052364e90c820

SHA512
a155b3cfefc62976b165baa01d545914829b03a94c79805d41c749b9bec464b5561392e4724fd0566e74232da5cf8053ef441dd345d693cfefc8b0590e0b9352

Download Submit
\Windows\system\EoiqihZ.exe

Filesize
1.5MB

MD5
a6554bbdada3200599a046b83ccc8d57

SHA1
cbf3b3e1bdbaeac5045acbe3a186f7f8d9b76b96

SHA256
373e10abba0f04e18ad874bde2fb79a330029f0d4c1fb47e76b03bcb71e605fe

SHA512
76ace8d1161af73df3aa5bbbbb15e5a6f8cfc30d74ad673f5dea8429ae21123b421d79300e86967e2ba73c9a00019528bb55362a4ea08d7e9830e6a7d37af81d

Download Submit
\Windows\system\JbcDumO.exe

Filesize
1.5MB

MD5
d7aa68e0330f5db81002f4de77f5770b

SHA1
c851f5e29ac4db64b9dca37aaa791cd924bae912

SHA256
b10cf4b90a29b9a8fb170086834e60e14f43d9888ac3a7abeb4b1747864ea45c

SHA512
b8045a08e55ad8be30700c13c36fe5039e3e0d23c7c76702fb5b2611f432c8499eaa8388f68d7cdd4a1158110966082c28eafc20925773e7a657d39032d16514

Download Submit
\Windows\system\NolmfzM.exe

Filesize
1.5MB

MD5
c09cc62199c39e27e7a38d45bfd6eaff

SHA1
3f22e6dea659eda11a0ed70280c0b9f6abe044f4

SHA256
bca22ae6610b85a91a8da6167d12cced726c99b67c94fb7c24aadc90f04e6d56

SHA512
afd0d3aab18d9ead5ad1662a14e03facb6f1ade14bf70387aed915b78c11137c8f506fa7d3705edf2159e345f5039e494aa92e03d9d6da0e628c8e3b0faffec5

Download Submit
\Windows\system\VwkvsCz.exe

Filesize
1.5MB

MD5
81f9fe3ddeafdb3d65dcf829a3dab403

SHA1
24bc7abf1859a2836dbf0efa3adc474e589129c5

SHA256
09689334318432e8a6c1ddfc6f161ed0605fe670500c87aa4925867ac71ece23

SHA512
3a2a22c4a24fc6236c8ea5d2471f2c01e397f334693b91f7840bb211f97d454a03ef1880f483a4c31e6ae2ed9312a964d46284c656d308d58376af30dff16661

Download Submit
\Windows\system\XxdKfYV.exe

Filesize
1.5MB

MD5
1ebaf7cd325383c419ede0d62bd62181

SHA1
5018b86c189783a838907f40d27cbb249b5220fb

SHA256
6ff03fc543a23b3be9c70d2356df2d28295efc190f8ebe0d1f9787fcbdd5d4d6

SHA512
708fb643c59c1fd12a6ffd072a29d335262f5135d9c4cfaeb682c775d4b8f6662860280a035277cf9ee6c5a0a67ec1ec422065902ca33c9d9d009a889b207fd5

Download Submit
\Windows\system\bXaTtOJ.exe

Filesize
1.5MB

MD5
1f6ebeaca76b5bb8971c5f435118c87c

SHA1
549bc2eca40c7fe5c725e63122a22d089e17a9aa

SHA256
ffd1aabbbf796b09c1e5b24e480c7b6037e59a28bc4be1ab4e8b6e71f14952d6

SHA512
953d13662f2d115e1f84d36a1482507a44323880402007eef16cd36cbd559e56ba6aea47f11c4a32a8963a26334b8c23de184047e99f059cb618d246e16eac6a

Download Submit
\Windows\system\jIJosIL.exe

Filesize
1.5MB

MD5
3a8468bd13f33256b9c4745f3b19bc78

SHA1
a2027796370c56b935ff24afe25ea489a26f53a8

SHA256
b83f7fca6a01d759f7fbf1bcfeccba28eb13d0dc1a4bcecfe3d2a9dc78074e6f

SHA512
6a3088c58ad4cee8024be97195ac59cdf59328a83157ce585d18208c1b6b15a3bb8e736380f71eb8532082e8d8c474b5548d00aa24228b8eb588e1fe299a4d46

Download Submit
\Windows\system\kujSiQy.exe

Filesize
1.5MB

MD5
9a6b9fdcd3641e951881ff992d54979f

SHA1
19256300552e09378b4bb9d1a0a41240ad404d81

SHA256
4752f2c3b36ef999fc9a533a66a6d736cc027a156f81e5d9200615fb1ccec550

SHA512
9f669ee01304732cd252b7bcb511da6f642fcbf2a7290ea6bd9b6deed091e68d89b8ebb0242a81f867db0c92f71cec0e7afb29ca675ac1ec440b816d5235808f

Download Submit
\Windows\system\mnuaxyq.exe

Filesize
1.5MB

MD5
7a978554793549133dc1c4a79f6f365e

SHA1
cef3a4230491dd060408bddbcc478a9247c6cb44

SHA256
043dfde14ff33e6bf58952c57fa8314c097415d9fcf5dd2700f4daf932b6c752

SHA512
f499f81e619f5725d4c3009f519ec27db5057de362382aba87f6dc83ee63eca021ec72e6402bd3ce4631d23f437f66d03ec4878517589b036f91ff616010db07

Download Submit
\Windows\system\oXYLSyT.exe

Filesize
1.5MB

MD5
c13d364ff54c0becab567bf2203dda91

SHA1
6abdcd46ca971f42e9c5051af303f0aef9c10fc5

SHA256
377fe73561d4a02ce0de8337a4b384049b1c0db8456e74f6fc093a8102d9d182

SHA512
1e391b0671611ef0d4758869a7aa1927dae57e2c62db1785a99404157da641549cc8d2cf54606d0bd8983ae285e72f589c858c88d250c8a9914e082aa9a2dd4b

Download Submit
\Windows\system\qcGnHSJ.exe

Filesize
1.5MB

MD5
ec48339bd2671cb2762c5638ea4b9579

SHA1
56392499adbc7d0d383d6f1fa559aad89e223dc7

SHA256
68d98d0286edab208c30cfbc1e050a66fa0248410ce9e8a6594fd6dffca015ef

SHA512
7290efd5a6e85f1c7450ba16161c3c64fd76936fb201cc52c6aa3df0254c19427ecf1a9651bfbd81626cbf4c282d896215cbba188bc11b6c2c30868b5f759cbd

Download Submit
\Windows\system\wwxICcF.exe

Filesize
1.5MB

MD5
4b062e8a1c495fe3cbe0bcaf0bc40263

SHA1
e87ed690968222e60b4a82dfe4e5f248abb49d9f

SHA256
ef0ebf1ba1f583180252a684a8101b4c7238ab30c69f045896eb70e2dd8e5a93

SHA512
e75cdf9fe179cb428cefc16354c47deed7f6b884e6d2de839e463f6846a0dae7c1863e19c6ee6cf2f1feb512a4d7e84f8d1aca0f320ffafb7e9a702b1a4f7f20

Download Submit
\Windows\system\yGOkhwR.exe

Filesize
1.5MB

MD5
669fcfac6767fc0f89ca72ab8ab9b4e5

SHA1
725edcca2bfb758b1d9cc4e74aaa9f3596814339

SHA256
3d046bd37004b08d76fb7684a3104d5e063d1efa9ed6c9d9848478b100a8682a

SHA512
e1b6e5a4e3c355b90f6b57d5f968072e6b2625efd0f1c592e251d4e4b08dbaf91965702de4fb391260abcd984601d851d63ea21cf76175db7b266b85e44df362

Download Submit
memory/1748-86-0x000000013F4E0000-0x000000013F8D2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-80-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-0-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-1691-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-25-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-85-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-1695-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1808-13-0x0000000003080000-0x0000000003472000-memory.dmp

Filesize
3.9MB

Download
memory/1808-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/1808-78-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/1808-87-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-83-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-88-0x00000000033B0000-0x00000000037A2000-memory.dmp

Filesize
3.9MB

Download
memory/1808-75-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-82-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2256-43-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2256-69-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2256-67-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2256-52-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2256-66-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2256-109-0x000007FEF5650000-0x000007FEF5FED000-memory.dmp

Filesize
9.6MB

Download
memory/2256-81-0x0000000002890000-0x0000000002910000-memory.dmp

Filesize
512KB

Download
memory/2464-84-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2544-14-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2660-71-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2680-79-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2724-77-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-26-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2840-8-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download