xmrig | 714baadf36e8b5f487596186d3a451e5946045f4389b006c5483a459f853cd4a

Analysis

max time kernel
31s
max time network
30s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
Size

1.8MB
MD5

0135278d4a814e9d73722ba27570f69e
SHA1

ba09e282ccfa636c09a1bc148da9aefd8254ce8b
SHA256

714baadf36e8b5f487596186d3a451e5946045f4389b006c5483a459f853cd4a
SHA512

6d9322a9c839e48bc40d3af3e078611aa1caaf1863fedde524110e69f636916f1f55bf72742204c5841a83f6ee843e5c1e8973c0a0b6912ad436de8d76d381a2
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlg7T:NABT

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2904-9-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2456-174-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2656-184-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2856-180-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2884-178-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/2488-176-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2416-171-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2904	iNfgrkw.exe
2648	jPgnpDk.exe
2416	ofhSdvE.exe
2656	XduIzpo.exe
2456	svOuujm.exe
2880	EgBhmwW.exe
2488	dMDTJwY.exe
2884	thlkNyS.exe
2856	fTWlXHk.exe
328	dxfkWEJ.exe
1048	IYUEmhG.exe
2696	IWoSpCm.exe
2708	dnEauJO.exe
2588	VowJzMi.exe
1624	ViQUdfV.exe
1768	GzFILAF.exe
2316	IDgghqa.exe
2160	BcpjCwT.exe
1372	foIlzAx.exe
2952	YgMmARn.exe
2016	UqAgKdd.exe
2068	QiMQeIN.exe
404	xmcIQqV.exe
2384	vnpxyLH.exe
644	HIgmJIr.exe
1080	ssWhFDN.exe
2028	xoPWRKN.exe
2508	ZkEJjtp.exe
1772	KSslvej.exe
1420	vCWYLOu.exe
1472	yCUYVri.exe
2968	DebcFPF.exe
772	kYdyMQT.exe
1732	TxMVPyA.exe
380	hYiNOzI.exe
868	peAXOqK.exe
1748	mMmtCnE.exe
700	ClxDvrB.exe
1556	CQHhMye.exe
816	vdlfCfo.exe
1580	JdAfBur.exe
2332	slTBmWf.exe
592	PnBmaQk.exe
1984	MjHkSWd.exe
2892	scRMgNu.exe
900	OdEXtUN.exe
2232	aDulVNB.exe
2688	AmbZOUh.exe
2632	vJQJDSm.exe
2444	aUmOOQt.exe
2836	XJEdrwD.exe
2168	yoLLqvw.exe
2376	JrGJKWQ.exe
1224	sEcxHyC.exe
2012	HQWsFTE.exe
604	TYtvrXQ.exe
2732	MgZDDGd.exe
1440	NtVTefC.exe
1552	mQKpQKx.exe
1548	aAtrPyK.exe
1456	ZaacXPQ.exe
1312	oeASxUx.exe
2412	xcyHZmm.exe
1704	qItggeV.exe

Loads dropped DLL 64 IoCs

pid	Process
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1680-0-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/files/0x000e000000012345-6.dat	upx
behavioral1/memory/2904-9-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x00300000000126ff-10.dat	upx
behavioral1/memory/1680-13-0x0000000003050000-0x0000000003442000-memory.dmp	upx
behavioral1/memory/2648-16-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x0008000000013129-12.dat	upx
behavioral1/files/0x00080000000131d9-38.dat	upx
behavioral1/files/0x000900000001315b-40.dat	upx
behavioral1/files/0x000700000001417f-47.dat	upx
behavioral1/files/0x0006000000014323-81.dat	upx
behavioral1/files/0x0006000000014588-105.dat	upx
behavioral1/files/0x000600000001480e-118.dat	upx
behavioral1/files/0x000600000001430c-66.dat	upx
behavioral1/files/0x00060000000144d8-141.dat	upx
behavioral1/files/0x0006000000014662-145.dat	upx
behavioral1/files/0x0006000000014eb9-160.dat	upx
behavioral1/files/0x0006000000014b36-156.dat	upx
behavioral1/files/0x00060000000149e1-154.dat	upx
behavioral1/files/0x0006000000014dae-150.dat	upx
behavioral1/files/0x00060000000146f8-115.dat	upx
behavioral1/files/0x0006000000014702-113.dat	upx
behavioral1/files/0x00060000000144e0-100.dat	upx
behavioral1/files/0x0006000000014502-97.dat	upx
behavioral1/files/0x000600000001448d-93.dat	upx
behavioral1/files/0x0006000000014435-86.dat	upx
behavioral1/files/0x0006000000014ba7-137.dat	upx
behavioral1/files/0x0006000000014b10-129.dat	upx
behavioral1/files/0x00060000000153c7-188.dat	upx
behavioral1/files/0x000600000001502c-168.dat	upx
behavioral1/memory/2456-174-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2880-185-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2656-184-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2856-180-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/memory/2884-178-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/memory/2488-176-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2416-171-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x000600000001418f-55.dat	upx
behavioral1/files/0x00060000000143a8-77.dat	upx
behavioral1/files/0x000600000001431c-70.dat	upx
behavioral1/files/0x0006000000014204-60.dat	upx
behavioral1/files/0x000a0000000133a3-46.dat	upx
behavioral1/files/0x001800000000558a-37.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WpETOsh.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\iGspsHH.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\PHuTTzo.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\gJIXrfY.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\qoNsbdk.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\aJBlubq.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\OokGBeP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\NdITzQz.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\uncDuJx.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\XxOFGmM.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\gctfZlC.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\YYmawmj.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\MrlXeaV.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\SrCjnPK.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\LcYiPWW.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\yDPmKnW.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\hpwCVoT.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\svxEvcJ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\luJVuKk.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\MgZDDGd.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\cjYkGVI.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\BhkDLqP.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\rfrOcgL.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\uWQnyVe.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\LPnhIoK.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\faeWHOQ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\TxMVPyA.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\xvFCddF.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\kXQnNoK.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\tDcfXTm.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\LPNUYzE.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\WBDLqnL.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\cCKcYua.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\tRYUxfS.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\AgidruA.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\rcBPgiO.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\IYRriVJ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\OrBwHHp.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\qUgfAwZ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ZOmmCBI.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\dSauMhF.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\HQWsFTE.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ElwaDjJ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\FvGNTtO.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\TifyMCN.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\upNhibw.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\eJBlwwg.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\zRYqvBn.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\brLvAZF.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\GzfxqMl.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\ZANgQwx.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\jXQgqpe.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\fSjyppf.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\WQqEUbc.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\dJqJUVI.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\EgBhmwW.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\dCkQyBd.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\vhGXZpe.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\WhiONcu.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\VeOZVGn.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\YQxYQVm.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\wcdQYmZ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\bMYrunR.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
File created	C:\Windows\System\WbPBrnJ.exe	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
Token: SeDebugPrivilege	1884	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	29
PID 1680 wrote to memory of 1884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	29
PID 1680 wrote to memory of 1884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	29
PID 1680 wrote to memory of 2904	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2904	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2904	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	30
PID 1680 wrote to memory of 2648	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2648	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2648	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	31
PID 1680 wrote to memory of 2416	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2416	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2416	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	32
PID 1680 wrote to memory of 2656	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2656	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2656	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	33
PID 1680 wrote to memory of 2880	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2880	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2880	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	34
PID 1680 wrote to memory of 2456	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2456	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2456	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	35
PID 1680 wrote to memory of 2488	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2488	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2488	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	36
PID 1680 wrote to memory of 2884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2884	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	37
PID 1680 wrote to memory of 2856	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	38
PID 1680 wrote to memory of 2856	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	38
PID 1680 wrote to memory of 2856	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	38
PID 1680 wrote to memory of 328	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	39
PID 1680 wrote to memory of 328	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	39
PID 1680 wrote to memory of 328	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	39
PID 1680 wrote to memory of 1048	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	40
PID 1680 wrote to memory of 1048	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	40
PID 1680 wrote to memory of 1048	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	40
PID 1680 wrote to memory of 2696	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2696	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2696	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	41
PID 1680 wrote to memory of 2588	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2588	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2588	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	42
PID 1680 wrote to memory of 2708	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	43
PID 1680 wrote to memory of 2708	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	43
PID 1680 wrote to memory of 2708	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	43
PID 1680 wrote to memory of 1624	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1624	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1624	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	44
PID 1680 wrote to memory of 1768	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	45
PID 1680 wrote to memory of 1768	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	45
PID 1680 wrote to memory of 1768	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	45
PID 1680 wrote to memory of 404	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	46
PID 1680 wrote to memory of 404	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	46
PID 1680 wrote to memory of 404	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	46
PID 1680 wrote to memory of 2316	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2316	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2316	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	47
PID 1680 wrote to memory of 2384	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	48
PID 1680 wrote to memory of 2384	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	48
PID 1680 wrote to memory of 2384	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	48
PID 1680 wrote to memory of 2160	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	49
PID 1680 wrote to memory of 2160	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	49
PID 1680 wrote to memory of 2160	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	49
PID 1680 wrote to memory of 644	1680	0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0135278d4a814e9d73722ba27570f69e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1884
- C:\Windows\System\iNfgrkw.exe
  C:\Windows\System\iNfgrkw.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\jPgnpDk.exe
  C:\Windows\System\jPgnpDk.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\ofhSdvE.exe
  C:\Windows\System\ofhSdvE.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\XduIzpo.exe
  C:\Windows\System\XduIzpo.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\EgBhmwW.exe
  C:\Windows\System\EgBhmwW.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\svOuujm.exe
  C:\Windows\System\svOuujm.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\dMDTJwY.exe
  C:\Windows\System\dMDTJwY.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\thlkNyS.exe
  C:\Windows\System\thlkNyS.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\fTWlXHk.exe
  C:\Windows\System\fTWlXHk.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\dxfkWEJ.exe
  C:\Windows\System\dxfkWEJ.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\IYUEmhG.exe
  C:\Windows\System\IYUEmhG.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\IWoSpCm.exe
  C:\Windows\System\IWoSpCm.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\VowJzMi.exe
  C:\Windows\System\VowJzMi.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\dnEauJO.exe
  C:\Windows\System\dnEauJO.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ViQUdfV.exe
  C:\Windows\System\ViQUdfV.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\GzFILAF.exe
  C:\Windows\System\GzFILAF.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\xmcIQqV.exe
  C:\Windows\System\xmcIQqV.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\IDgghqa.exe
  C:\Windows\System\IDgghqa.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\vnpxyLH.exe
  C:\Windows\System\vnpxyLH.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\BcpjCwT.exe
  C:\Windows\System\BcpjCwT.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\HIgmJIr.exe
  C:\Windows\System\HIgmJIr.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\foIlzAx.exe
  C:\Windows\System\foIlzAx.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\ssWhFDN.exe
  C:\Windows\System\ssWhFDN.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\YgMmARn.exe
  C:\Windows\System\YgMmARn.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\xoPWRKN.exe
  C:\Windows\System\xoPWRKN.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\UqAgKdd.exe
  C:\Windows\System\UqAgKdd.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ZkEJjtp.exe
  C:\Windows\System\ZkEJjtp.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\QiMQeIN.exe
  C:\Windows\System\QiMQeIN.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\vCWYLOu.exe
  C:\Windows\System\vCWYLOu.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\KSslvej.exe
  C:\Windows\System\KSslvej.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\yCUYVri.exe
  C:\Windows\System\yCUYVri.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\DebcFPF.exe
  C:\Windows\System\DebcFPF.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\TxMVPyA.exe
  C:\Windows\System\TxMVPyA.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\kYdyMQT.exe
  C:\Windows\System\kYdyMQT.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\CQHhMye.exe
  C:\Windows\System\CQHhMye.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\hYiNOzI.exe
  C:\Windows\System\hYiNOzI.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\vdlfCfo.exe
  C:\Windows\System\vdlfCfo.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\peAXOqK.exe
  C:\Windows\System\peAXOqK.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\JdAfBur.exe
  C:\Windows\System\JdAfBur.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\mMmtCnE.exe
  C:\Windows\System\mMmtCnE.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PnBmaQk.exe
  C:\Windows\System\PnBmaQk.exe
  2⤵
  - Executes dropped EXE
  PID:592
- C:\Windows\System\ClxDvrB.exe
  C:\Windows\System\ClxDvrB.exe
  2⤵
  - Executes dropped EXE
  PID:700
- C:\Windows\System\MjHkSWd.exe
  C:\Windows\System\MjHkSWd.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\slTBmWf.exe
  C:\Windows\System\slTBmWf.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\sEcxHyC.exe
  C:\Windows\System\sEcxHyC.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\scRMgNu.exe
  C:\Windows\System\scRMgNu.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\NtVTefC.exe
  C:\Windows\System\NtVTefC.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\OdEXtUN.exe
  C:\Windows\System\OdEXtUN.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\mQKpQKx.exe
  C:\Windows\System\mQKpQKx.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\aDulVNB.exe
  C:\Windows\System\aDulVNB.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\aAtrPyK.exe
  C:\Windows\System\aAtrPyK.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\AmbZOUh.exe
  C:\Windows\System\AmbZOUh.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\upwYHfs.exe
  C:\Windows\System\upwYHfs.exe
  2⤵
  PID:2672
- C:\Windows\System\vJQJDSm.exe
  C:\Windows\System\vJQJDSm.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\wWdbyqN.exe
  C:\Windows\System\wWdbyqN.exe
  2⤵
  PID:2748
- C:\Windows\System\aUmOOQt.exe
  C:\Windows\System\aUmOOQt.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\vzWfrBU.exe
  C:\Windows\System\vzWfrBU.exe
  2⤵
  PID:2676
- C:\Windows\System\XJEdrwD.exe
  C:\Windows\System\XJEdrwD.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\cHCsiNi.exe
  C:\Windows\System\cHCsiNi.exe
  2⤵
  PID:2644
- C:\Windows\System\yoLLqvw.exe
  C:\Windows\System\yoLLqvw.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\rtDSggW.exe
  C:\Windows\System\rtDSggW.exe
  2⤵
  PID:2156
- C:\Windows\System\JrGJKWQ.exe
  C:\Windows\System\JrGJKWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\FTGPOVM.exe
  C:\Windows\System\FTGPOVM.exe
  2⤵
  PID:1252
- C:\Windows\System\HQWsFTE.exe
  C:\Windows\System\HQWsFTE.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\pSMahFu.exe
  C:\Windows\System\pSMahFu.exe
  2⤵
  PID:2388
- C:\Windows\System\TYtvrXQ.exe
  C:\Windows\System\TYtvrXQ.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\GAXmzvo.exe
  C:\Windows\System\GAXmzvo.exe
  2⤵
  PID:1288
- C:\Windows\System\MgZDDGd.exe
  C:\Windows\System\MgZDDGd.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\zEfROEh.exe
  C:\Windows\System\zEfROEh.exe
  2⤵
  PID:2280
- C:\Windows\System\ZaacXPQ.exe
  C:\Windows\System\ZaacXPQ.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\POfLKyr.exe
  C:\Windows\System\POfLKyr.exe
  2⤵
  PID:860
- C:\Windows\System\oeASxUx.exe
  C:\Windows\System\oeASxUx.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\MitosHL.exe
  C:\Windows\System\MitosHL.exe
  2⤵
  PID:2760
- C:\Windows\System\xcyHZmm.exe
  C:\Windows\System\xcyHZmm.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\RIfcdAH.exe
  C:\Windows\System\RIfcdAH.exe
  2⤵
  PID:2468
- C:\Windows\System\qItggeV.exe
  C:\Windows\System\qItggeV.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\WOqSvbI.exe
  C:\Windows\System\WOqSvbI.exe
  2⤵
  PID:2072
- C:\Windows\System\DqyrBfx.exe
  C:\Windows\System\DqyrBfx.exe
  2⤵
  PID:1692
- C:\Windows\System\DEcIXqr.exe
  C:\Windows\System\DEcIXqr.exe
  2⤵
  PID:2108
- C:\Windows\System\hOKlhoS.exe
  C:\Windows\System\hOKlhoS.exe
  2⤵
  PID:2260
- C:\Windows\System\QNiIFSO.exe
  C:\Windows\System\QNiIFSO.exe
  2⤵
  PID:1936
- C:\Windows\System\QDQJwhY.exe
  C:\Windows\System\QDQJwhY.exe
  2⤵
  PID:1620
- C:\Windows\System\itRNbUg.exe
  C:\Windows\System\itRNbUg.exe
  2⤵
  PID:2604
- C:\Windows\System\ATPJPdq.exe
  C:\Windows\System\ATPJPdq.exe
  2⤵
  PID:2548
- C:\Windows\System\kxQTWPH.exe
  C:\Windows\System\kxQTWPH.exe
  2⤵
  PID:1888
- C:\Windows\System\JNVTXTz.exe
  C:\Windows\System\JNVTXTz.exe
  2⤵
  PID:2240
- C:\Windows\System\DBQbPsk.exe
  C:\Windows\System\DBQbPsk.exe
  2⤵
  PID:852
- C:\Windows\System\WbuvhOT.exe
  C:\Windows\System\WbuvhOT.exe
  2⤵
  PID:312
- C:\Windows\System\cjYkGVI.exe
  C:\Windows\System\cjYkGVI.exe
  2⤵
  PID:2420
- C:\Windows\System\DJyCDMp.exe
  C:\Windows\System\DJyCDMp.exe
  2⤵
  PID:384
- C:\Windows\System\mkTlIdU.exe
  C:\Windows\System\mkTlIdU.exe
  2⤵
  PID:1448
- C:\Windows\System\oIfMRJL.exe
  C:\Windows\System\oIfMRJL.exe
  2⤵
  PID:2120
- C:\Windows\System\LnQOUNW.exe
  C:\Windows\System\LnQOUNW.exe
  2⤵
  PID:1588
- C:\Windows\System\adTBWnf.exe
  C:\Windows\System\adTBWnf.exe
  2⤵
  PID:2288
- C:\Windows\System\sCVRqkg.exe
  C:\Windows\System\sCVRqkg.exe
  2⤵
  PID:1948
- C:\Windows\System\NWaDwtu.exe
  C:\Windows\System\NWaDwtu.exe
  2⤵
  PID:584
- C:\Windows\System\uxFIRWu.exe
  C:\Windows\System\uxFIRWu.exe
  2⤵
  PID:2092
- C:\Windows\System\cxfgfMB.exe
  C:\Windows\System\cxfgfMB.exe
  2⤵
  PID:2472
- C:\Windows\System\otSTzjo.exe
  C:\Windows\System\otSTzjo.exe
  2⤵
  PID:1228
- C:\Windows\System\aJBlubq.exe
  C:\Windows\System\aJBlubq.exe
  2⤵
  PID:2556
- C:\Windows\System\zPqnenL.exe
  C:\Windows\System\zPqnenL.exe
  2⤵
  PID:2136
- C:\Windows\System\lvTFCGR.exe
  C:\Windows\System\lvTFCGR.exe
  2⤵
  PID:1876
- C:\Windows\System\TDZqtWM.exe
  C:\Windows\System\TDZqtWM.exe
  2⤵
  PID:2172
- C:\Windows\System\twBenRJ.exe
  C:\Windows\System\twBenRJ.exe
  2⤵
  PID:1908
- C:\Windows\System\qrKpFVx.exe
  C:\Windows\System\qrKpFVx.exe
  2⤵
  PID:1300
- C:\Windows\System\zWamcYl.exe
  C:\Windows\System\zWamcYl.exe
  2⤵
  PID:2824
- C:\Windows\System\rWhVfQR.exe
  C:\Windows\System\rWhVfQR.exe
  2⤵
  PID:1212
- C:\Windows\System\XQSGfQY.exe
  C:\Windows\System\XQSGfQY.exe
  2⤵
  PID:2272
- C:\Windows\System\pGKYLry.exe
  C:\Windows\System\pGKYLry.exe
  2⤵
  PID:2920
- C:\Windows\System\HgoBcMT.exe
  C:\Windows\System\HgoBcMT.exe
  2⤵
  PID:2512
- C:\Windows\System\uKFvltI.exe
  C:\Windows\System\uKFvltI.exe
  2⤵
  PID:2344
- C:\Windows\System\ElwaDjJ.exe
  C:\Windows\System\ElwaDjJ.exe
  2⤵
  PID:1780
- C:\Windows\System\BaMiRlb.exe
  C:\Windows\System\BaMiRlb.exe
  2⤵
  PID:1956
- C:\Windows\System\RKOhCdF.exe
  C:\Windows\System\RKOhCdF.exe
  2⤵
  PID:2792
- C:\Windows\System\htpVegQ.exe
  C:\Windows\System\htpVegQ.exe
  2⤵
  PID:1676
- C:\Windows\System\KIhEEqg.exe
  C:\Windows\System\KIhEEqg.exe
  2⤵
  PID:564
- C:\Windows\System\wgLRPpD.exe
  C:\Windows\System\wgLRPpD.exe
  2⤵
  PID:2476
- C:\Windows\System\oFQBvhU.exe
  C:\Windows\System\oFQBvhU.exe
  2⤵
  PID:676
- C:\Windows\System\EUkZOGe.exe
  C:\Windows\System\EUkZOGe.exe
  2⤵
  PID:1988
- C:\Windows\System\MHUxFeT.exe
  C:\Windows\System\MHUxFeT.exe
  2⤵
  PID:1960
- C:\Windows\System\fyRReqq.exe
  C:\Windows\System\fyRReqq.exe
  2⤵
  PID:804
- C:\Windows\System\JCNXnxH.exe
  C:\Windows\System\JCNXnxH.exe
  2⤵
  PID:2080
- C:\Windows\System\HxgNugB.exe
  C:\Windows\System\HxgNugB.exe
  2⤵
  PID:2744
- C:\Windows\System\XGnvjFC.exe
  C:\Windows\System\XGnvjFC.exe
  2⤵
  PID:1652
- C:\Windows\System\eShGvzY.exe
  C:\Windows\System\eShGvzY.exe
  2⤵
  PID:2724
- C:\Windows\System\FvGNTtO.exe
  C:\Windows\System\FvGNTtO.exe
  2⤵
  PID:2356
- C:\Windows\System\GumJQSO.exe
  C:\Windows\System\GumJQSO.exe
  2⤵
  PID:904
- C:\Windows\System\rKgvyAh.exe
  C:\Windows\System\rKgvyAh.exe
  2⤵
  PID:1904
- C:\Windows\System\uVtTXlt.exe
  C:\Windows\System\uVtTXlt.exe
  2⤵
  PID:2500
- C:\Windows\System\noDGbEE.exe
  C:\Windows\System\noDGbEE.exe
  2⤵
  PID:2300
- C:\Windows\System\YIiGvVg.exe
  C:\Windows\System\YIiGvVg.exe
  2⤵
  PID:1724
- C:\Windows\System\jMkYrqQ.exe
  C:\Windows\System\jMkYrqQ.exe
  2⤵
  PID:2484
- C:\Windows\System\xDumZyj.exe
  C:\Windows\System\xDumZyj.exe
  2⤵
  PID:1824
- C:\Windows\System\YiZLrjU.exe
  C:\Windows\System\YiZLrjU.exe
  2⤵
  PID:2996
- C:\Windows\System\GdmpYLr.exe
  C:\Windows\System\GdmpYLr.exe
  2⤵
  PID:1244
- C:\Windows\System\nKfpvnb.exe
  C:\Windows\System\nKfpvnb.exe
  2⤵
  PID:412
- C:\Windows\System\THIXZBz.exe
  C:\Windows\System\THIXZBz.exe
  2⤵
  PID:1464
- C:\Windows\System\EfNbVGG.exe
  C:\Windows\System\EfNbVGG.exe
  2⤵
  PID:1316
- C:\Windows\System\OokGBeP.exe
  C:\Windows\System\OokGBeP.exe
  2⤵
  PID:3004
- C:\Windows\System\bMukjSI.exe
  C:\Windows\System\bMukjSI.exe
  2⤵
  PID:1256
- C:\Windows\System\uExbFQt.exe
  C:\Windows\System\uExbFQt.exe
  2⤵
  PID:2464
- C:\Windows\System\LXCTTEd.exe
  C:\Windows\System\LXCTTEd.exe
  2⤵
  PID:2736
- C:\Windows\System\yDPmKnW.exe
  C:\Windows\System\yDPmKnW.exe
  2⤵
  PID:1524
- C:\Windows\System\xvswdJW.exe
  C:\Windows\System\xvswdJW.exe
  2⤵
  PID:3168
- C:\Windows\System\uCozKxs.exe
  C:\Windows\System\uCozKxs.exe
  2⤵
  PID:3236
- C:\Windows\System\nyhfOVZ.exe
  C:\Windows\System\nyhfOVZ.exe
  2⤵
  PID:3256
- C:\Windows\System\tKuBbHX.exe
  C:\Windows\System\tKuBbHX.exe
  2⤵
  PID:3272
- C:\Windows\System\ikFGEyy.exe
  C:\Windows\System\ikFGEyy.exe
  2⤵
  PID:3296
- C:\Windows\System\gKOhGjq.exe
  C:\Windows\System\gKOhGjq.exe
  2⤵
  PID:3312
- C:\Windows\System\IwJxeuC.exe
  C:\Windows\System\IwJxeuC.exe
  2⤵
  PID:3336
- C:\Windows\System\ZMwYwGc.exe
  C:\Windows\System\ZMwYwGc.exe
  2⤵
  PID:3352
- C:\Windows\System\EGQAZIT.exe
  C:\Windows\System\EGQAZIT.exe
  2⤵
  PID:3376
- C:\Windows\System\EXApzAR.exe
  C:\Windows\System\EXApzAR.exe
  2⤵
  PID:3392
- C:\Windows\System\jLKwqII.exe
  C:\Windows\System\jLKwqII.exe
  2⤵
  PID:3416
- C:\Windows\System\vIkKSDL.exe
  C:\Windows\System\vIkKSDL.exe
  2⤵
  PID:3436
- C:\Windows\System\WbtLNVD.exe
  C:\Windows\System\WbtLNVD.exe
  2⤵
  PID:3456
- C:\Windows\System\qgGxUqh.exe
  C:\Windows\System\qgGxUqh.exe
  2⤵
  PID:3472
- C:\Windows\System\vpVkVkv.exe
  C:\Windows\System\vpVkVkv.exe
  2⤵
  PID:3488
- C:\Windows\System\QYQVEhW.exe
  C:\Windows\System\QYQVEhW.exe
  2⤵
  PID:3504
- C:\Windows\System\ryzTNAr.exe
  C:\Windows\System\ryzTNAr.exe
  2⤵
  PID:3520
- C:\Windows\System\KuJvXzB.exe
  C:\Windows\System\KuJvXzB.exe
  2⤵
  PID:3536
- C:\Windows\System\BeNqgXn.exe
  C:\Windows\System\BeNqgXn.exe
  2⤵
  PID:3564
- C:\Windows\System\SNKZshZ.exe
  C:\Windows\System\SNKZshZ.exe
  2⤵
  PID:3580
- C:\Windows\System\skLfaLB.exe
  C:\Windows\System\skLfaLB.exe
  2⤵
  PID:3596
- C:\Windows\System\cYcEgYs.exe
  C:\Windows\System\cYcEgYs.exe
  2⤵
  PID:3628
- C:\Windows\System\XSuCvyd.exe
  C:\Windows\System\XSuCvyd.exe
  2⤵
  PID:3648
- C:\Windows\System\YQxYQVm.exe
  C:\Windows\System\YQxYQVm.exe
  2⤵
  PID:3668
- C:\Windows\System\ZYFMyVA.exe
  C:\Windows\System\ZYFMyVA.exe
  2⤵
  PID:3684
- C:\Windows\System\qtbXdJU.exe
  C:\Windows\System\qtbXdJU.exe
  2⤵
  PID:3708
- C:\Windows\System\hWLukTt.exe
  C:\Windows\System\hWLukTt.exe
  2⤵
  PID:3724
- C:\Windows\System\uncDuJx.exe
  C:\Windows\System\uncDuJx.exe
  2⤵
  PID:3740
- C:\Windows\System\hAAygeu.exe
  C:\Windows\System\hAAygeu.exe
  2⤵
  PID:3756
- C:\Windows\System\BjqbaMp.exe
  C:\Windows\System\BjqbaMp.exe
  2⤵
  PID:3772
- C:\Windows\System\suxsFfi.exe
  C:\Windows\System\suxsFfi.exe
  2⤵
  PID:3788
- C:\Windows\System\RQzOcmY.exe
  C:\Windows\System\RQzOcmY.exe
  2⤵
  PID:3804
- C:\Windows\System\iYUsmzd.exe
  C:\Windows\System\iYUsmzd.exe
  2⤵
  PID:3820
- C:\Windows\System\CiVOald.exe
  C:\Windows\System\CiVOald.exe
  2⤵
  PID:3836
- C:\Windows\System\NKsJxqs.exe
  C:\Windows\System\NKsJxqs.exe
  2⤵
  PID:3852
- C:\Windows\System\cKeovLR.exe
  C:\Windows\System\cKeovLR.exe
  2⤵
  PID:3868
- C:\Windows\System\fTuatbI.exe
  C:\Windows\System\fTuatbI.exe
  2⤵
  PID:3884
- C:\Windows\System\THzDyMe.exe
  C:\Windows\System\THzDyMe.exe
  2⤵
  PID:3904
- C:\Windows\System\ziYbizg.exe
  C:\Windows\System\ziYbizg.exe
  2⤵
  PID:3920
- C:\Windows\System\ujetSNx.exe
  C:\Windows\System\ujetSNx.exe
  2⤵
  PID:3936
- C:\Windows\System\eCLARBc.exe
  C:\Windows\System\eCLARBc.exe
  2⤵
  PID:3952
- C:\Windows\System\ZPfhlrB.exe
  C:\Windows\System\ZPfhlrB.exe
  2⤵
  PID:3968
- C:\Windows\System\aqzahEd.exe
  C:\Windows\System\aqzahEd.exe
  2⤵
  PID:3984
- C:\Windows\System\GPHtAlD.exe
  C:\Windows\System\GPHtAlD.exe
  2⤵
  PID:4000
- C:\Windows\System\eiTZRfE.exe
  C:\Windows\System\eiTZRfE.exe
  2⤵
  PID:4016
- C:\Windows\System\maMEfJA.exe
  C:\Windows\System\maMEfJA.exe
  2⤵
  PID:4032
- C:\Windows\System\YQODoIx.exe
  C:\Windows\System\YQODoIx.exe
  2⤵
  PID:4052
- C:\Windows\System\OHqiCSV.exe
  C:\Windows\System\OHqiCSV.exe
  2⤵
  PID:4068
- C:\Windows\System\TnjLeeJ.exe
  C:\Windows\System\TnjLeeJ.exe
  2⤵
  PID:4084
- C:\Windows\System\JJRDZed.exe
  C:\Windows\System\JJRDZed.exe
  2⤵
  PID:2480
- C:\Windows\System\UJufhfy.exe
  C:\Windows\System\UJufhfy.exe
  2⤵
  PID:2728
- C:\Windows\System\KgLKqMn.exe
  C:\Windows\System\KgLKqMn.exe
  2⤵
  PID:1880
- C:\Windows\System\giSnsCI.exe
  C:\Windows\System\giSnsCI.exe
  2⤵
  PID:1968
- C:\Windows\System\UtvzuOR.exe
  C:\Windows\System\UtvzuOR.exe
  2⤵
  PID:3176
- C:\Windows\System\qkThsXw.exe
  C:\Windows\System\qkThsXw.exe
  2⤵
  PID:3128
- C:\Windows\System\oGsWWQb.exe
  C:\Windows\System\oGsWWQb.exe
  2⤵
  PID:3160
- C:\Windows\System\itwtMwg.exe
  C:\Windows\System\itwtMwg.exe
  2⤵
  PID:2216
- C:\Windows\System\dZGwbEI.exe
  C:\Windows\System\dZGwbEI.exe
  2⤵
  PID:3188
- C:\Windows\System\IhBfATe.exe
  C:\Windows\System\IhBfATe.exe
  2⤵
  PID:1500
- C:\Windows\System\XgBobdS.exe
  C:\Windows\System\XgBobdS.exe
  2⤵
  PID:2180
- C:\Windows\System\ClRPieR.exe
  C:\Windows\System\ClRPieR.exe
  2⤵
  PID:3212
- C:\Windows\System\qhmUYPe.exe
  C:\Windows\System\qhmUYPe.exe
  2⤵
  PID:3152
- C:\Windows\System\FeeaqFS.exe
  C:\Windows\System\FeeaqFS.exe
  2⤵
  PID:2252
- C:\Windows\System\YUVylJC.exe
  C:\Windows\System\YUVylJC.exe
  2⤵
  PID:3244
- C:\Windows\System\VxYPwMJ.exe
  C:\Windows\System\VxYPwMJ.exe
  2⤵
  PID:3268
- C:\Windows\System\ihgMnoj.exe
  C:\Windows\System\ihgMnoj.exe
  2⤵
  PID:3292
- C:\Windows\System\iFvOqkm.exe
  C:\Windows\System\iFvOqkm.exe
  2⤵
  PID:3328
- C:\Windows\System\YTTeZoa.exe
  C:\Windows\System\YTTeZoa.exe
  2⤵
  PID:3348
- C:\Windows\System\iGKBanb.exe
  C:\Windows\System\iGKBanb.exe
  2⤵
  PID:3368
- C:\Windows\System\RvAfHNA.exe
  C:\Windows\System\RvAfHNA.exe
  2⤵
  PID:3412
- C:\Windows\System\ygYpWcS.exe
  C:\Windows\System\ygYpWcS.exe
  2⤵
  PID:3432
- C:\Windows\System\oEILmPt.exe
  C:\Windows\System\oEILmPt.exe
  2⤵
  PID:3464
- C:\Windows\System\GYsmbhe.exe
  C:\Windows\System\GYsmbhe.exe
  2⤵
  PID:3496
- C:\Windows\System\vMwdxmC.exe
  C:\Windows\System\vMwdxmC.exe
  2⤵
  PID:3576
- C:\Windows\System\raGQESq.exe
  C:\Windows\System\raGQESq.exe
  2⤵
  PID:3556
- C:\Windows\System\UUpXPPR.exe
  C:\Windows\System\UUpXPPR.exe
  2⤵
  PID:3616
- C:\Windows\System\PkmcAQM.exe
  C:\Windows\System\PkmcAQM.exe
  2⤵
  PID:3660
- C:\Windows\System\NoipJkT.exe
  C:\Windows\System\NoipJkT.exe
  2⤵
  PID:3692
- C:\Windows\System\LQyOEls.exe
  C:\Windows\System\LQyOEls.exe
  2⤵
  PID:3700
- C:\Windows\System\LnfbudZ.exe
  C:\Windows\System\LnfbudZ.exe
  2⤵
  PID:3764
- C:\Windows\System\BhkDLqP.exe
  C:\Windows\System\BhkDLqP.exe
  2⤵
  PID:3828
- C:\Windows\System\gVwbBTG.exe
  C:\Windows\System\gVwbBTG.exe
  2⤵
  PID:3896
- C:\Windows\System\BNddfCT.exe
  C:\Windows\System\BNddfCT.exe
  2⤵
  PID:3720
- C:\Windows\System\cpLswFW.exe
  C:\Windows\System\cpLswFW.exe
  2⤵
  PID:3812
- C:\Windows\System\EFJcrzp.exe
  C:\Windows\System\EFJcrzp.exe
  2⤵
  PID:3900
- C:\Windows\System\sILScmB.exe
  C:\Windows\System\sILScmB.exe
  2⤵
  PID:3944
- C:\Windows\System\zjoWjxC.exe
  C:\Windows\System\zjoWjxC.exe
  2⤵
  PID:3992
- C:\Windows\System\nlZkkoa.exe
  C:\Windows\System\nlZkkoa.exe
  2⤵
  PID:4060
- C:\Windows\System\kbmucnG.exe
  C:\Windows\System\kbmucnG.exe
  2⤵
  PID:2844
- C:\Windows\System\IYiLkdM.exe
  C:\Windows\System\IYiLkdM.exe
  2⤵
  PID:1044
- C:\Windows\System\WqKDBzI.exe
  C:\Windows\System\WqKDBzI.exe
  2⤵
  PID:3084
- C:\Windows\System\JdEdALf.exe
  C:\Windows\System\JdEdALf.exe
  2⤵
  PID:3092
- C:\Windows\System\ZbtEtHx.exe
  C:\Windows\System\ZbtEtHx.exe
  2⤵
  PID:3112
- C:\Windows\System\lxXTTID.exe
  C:\Windows\System\lxXTTID.exe
  2⤵
  PID:3676
- C:\Windows\System\rpniyuu.exe
  C:\Windows\System\rpniyuu.exe
  2⤵
  PID:3784
- C:\Windows\System\OvRQXng.exe
  C:\Windows\System\OvRQXng.exe
  2⤵
  PID:2944
- C:\Windows\System\AEasbgo.exe
  C:\Windows\System\AEasbgo.exe
  2⤵
  PID:1584
- C:\Windows\System\ZANgQwx.exe
  C:\Windows\System\ZANgQwx.exe
  2⤵
  PID:4080
- C:\Windows\System\QETeFNW.exe
  C:\Windows\System\QETeFNW.exe
  2⤵
  PID:832
- C:\Windows\System\onRvyRS.exe
  C:\Windows\System\onRvyRS.exe
  2⤵
  PID:2956
- C:\Windows\System\WkLbDTy.exe
  C:\Windows\System\WkLbDTy.exe
  2⤵
  PID:4012
- C:\Windows\System\SWNSmRX.exe
  C:\Windows\System\SWNSmRX.exe
  2⤵
  PID:3156
- C:\Windows\System\XxOFGmM.exe
  C:\Windows\System\XxOFGmM.exe
  2⤵
  PID:3124
- C:\Windows\System\bMvIuow.exe
  C:\Windows\System\bMvIuow.exe
  2⤵
  PID:3204
- C:\Windows\System\wZEIoys.exe
  C:\Windows\System\wZEIoys.exe
  2⤵
  PID:4100
- C:\Windows\System\dmUkpbF.exe
  C:\Windows\System\dmUkpbF.exe
  2⤵
  PID:4116
- C:\Windows\System\UCPGSpf.exe
  C:\Windows\System\UCPGSpf.exe
  2⤵
  PID:4132
- C:\Windows\System\JYDbwnp.exe
  C:\Windows\System\JYDbwnp.exe
  2⤵
  PID:4148
- C:\Windows\System\ToKyyAz.exe
  C:\Windows\System\ToKyyAz.exe
  2⤵
  PID:4164
- C:\Windows\System\xSsuasM.exe
  C:\Windows\System\xSsuasM.exe
  2⤵
  PID:4180
- C:\Windows\System\hrtkJDx.exe
  C:\Windows\System\hrtkJDx.exe
  2⤵
  PID:4196
- C:\Windows\System\nxkdgKR.exe
  C:\Windows\System\nxkdgKR.exe
  2⤵
  PID:4212
- C:\Windows\System\wcHQoGJ.exe
  C:\Windows\System\wcHQoGJ.exe
  2⤵
  PID:4228
- C:\Windows\System\TzkNnRC.exe
  C:\Windows\System\TzkNnRC.exe
  2⤵
  PID:4244
- C:\Windows\System\MIqkhkM.exe
  C:\Windows\System\MIqkhkM.exe
  2⤵
  PID:4260
- C:\Windows\System\RPFsuZJ.exe
  C:\Windows\System\RPFsuZJ.exe
  2⤵
  PID:4276
- C:\Windows\System\TifyMCN.exe
  C:\Windows\System\TifyMCN.exe
  2⤵
  PID:4292
- C:\Windows\System\akUZlQF.exe
  C:\Windows\System\akUZlQF.exe
  2⤵
  PID:4308
- C:\Windows\System\BPxWVCe.exe
  C:\Windows\System\BPxWVCe.exe
  2⤵
  PID:4328
- C:\Windows\System\gdZiMFh.exe
  C:\Windows\System\gdZiMFh.exe
  2⤵
  PID:4344
- C:\Windows\System\qZdhSeU.exe
  C:\Windows\System\qZdhSeU.exe
  2⤵
  PID:4360
- C:\Windows\System\glHgICL.exe
  C:\Windows\System\glHgICL.exe
  2⤵
  PID:4376
- C:\Windows\System\gHXUBes.exe
  C:\Windows\System\gHXUBes.exe
  2⤵
  PID:4392
- C:\Windows\System\onMiUyI.exe
  C:\Windows\System\onMiUyI.exe
  2⤵
  PID:4412
- C:\Windows\System\iogUCtv.exe
  C:\Windows\System\iogUCtv.exe
  2⤵
  PID:4428
- C:\Windows\System\vOPKbfF.exe
  C:\Windows\System\vOPKbfF.exe
  2⤵
  PID:4444
- C:\Windows\System\SikcdZc.exe
  C:\Windows\System\SikcdZc.exe
  2⤵
  PID:4460
- C:\Windows\System\ciaZBOj.exe
  C:\Windows\System\ciaZBOj.exe
  2⤵
  PID:4476
- C:\Windows\System\xqQDAMc.exe
  C:\Windows\System\xqQDAMc.exe
  2⤵
  PID:4492
- C:\Windows\System\sZMrcLo.exe
  C:\Windows\System\sZMrcLo.exe
  2⤵
  PID:4512
- C:\Windows\System\CIjdscB.exe
  C:\Windows\System\CIjdscB.exe
  2⤵
  PID:4528
- C:\Windows\System\DfaDxCc.exe
  C:\Windows\System\DfaDxCc.exe
  2⤵
  PID:4544
- C:\Windows\System\wimvUUB.exe
  C:\Windows\System\wimvUUB.exe
  2⤵
  PID:4560
- C:\Windows\System\tbQWPBZ.exe
  C:\Windows\System\tbQWPBZ.exe
  2⤵
  PID:4576
- C:\Windows\System\SCuLSTv.exe
  C:\Windows\System\SCuLSTv.exe
  2⤵
  PID:4592
- C:\Windows\System\SazaEcT.exe
  C:\Windows\System\SazaEcT.exe
  2⤵
  PID:4612
- C:\Windows\System\FHBoOeD.exe
  C:\Windows\System\FHBoOeD.exe
  2⤵
  PID:4628
- C:\Windows\System\gPLHiYZ.exe
  C:\Windows\System\gPLHiYZ.exe
  2⤵
  PID:4644
- C:\Windows\System\fvgoDdY.exe
  C:\Windows\System\fvgoDdY.exe
  2⤵
  PID:4664
- C:\Windows\System\lnkZrEi.exe
  C:\Windows\System\lnkZrEi.exe
  2⤵
  PID:4680
- C:\Windows\System\hiLcbve.exe
  C:\Windows\System\hiLcbve.exe
  2⤵
  PID:4696
- C:\Windows\System\hEXJJAE.exe
  C:\Windows\System\hEXJJAE.exe
  2⤵
  PID:4712
- C:\Windows\System\tzzCDqP.exe
  C:\Windows\System\tzzCDqP.exe
  2⤵
  PID:4728
- C:\Windows\System\XclcZVq.exe
  C:\Windows\System\XclcZVq.exe
  2⤵
  PID:4744
- C:\Windows\System\DMHAslG.exe
  C:\Windows\System\DMHAslG.exe
  2⤵
  PID:4760
- C:\Windows\System\dSbHzuM.exe
  C:\Windows\System\dSbHzuM.exe
  2⤵
  PID:4776
- C:\Windows\System\qZCMoAi.exe
  C:\Windows\System\qZCMoAi.exe
  2⤵
  PID:4792
- C:\Windows\System\PcJsNLN.exe
  C:\Windows\System\PcJsNLN.exe
  2⤵
  PID:4812
- C:\Windows\System\ubxoQiO.exe
  C:\Windows\System\ubxoQiO.exe
  2⤵
  PID:4828
- C:\Windows\System\NELsWup.exe
  C:\Windows\System\NELsWup.exe
  2⤵
  PID:4844
- C:\Windows\System\OhlIgUF.exe
  C:\Windows\System\OhlIgUF.exe
  2⤵
  PID:4860
- C:\Windows\System\cJnPUny.exe
  C:\Windows\System\cJnPUny.exe
  2⤵
  PID:4876
- C:\Windows\System\TyhgHeY.exe
  C:\Windows\System\TyhgHeY.exe
  2⤵
  PID:4980
- C:\Windows\System\ZwAqHtd.exe
  C:\Windows\System\ZwAqHtd.exe
  2⤵
  PID:4996
- C:\Windows\System\sWXYttO.exe
  C:\Windows\System\sWXYttO.exe
  2⤵
  PID:5012
- C:\Windows\System\wOlAQuF.exe
  C:\Windows\System\wOlAQuF.exe
  2⤵
  PID:5028
- C:\Windows\System\feKgTQt.exe
  C:\Windows\System\feKgTQt.exe
  2⤵
  PID:5044
- C:\Windows\System\Wxhvipw.exe
  C:\Windows\System\Wxhvipw.exe
  2⤵
  PID:5060
- C:\Windows\System\RGHrDsq.exe
  C:\Windows\System\RGHrDsq.exe
  2⤵
  PID:5076
- C:\Windows\System\dNhNSsG.exe
  C:\Windows\System\dNhNSsG.exe
  2⤵
  PID:5092
- C:\Windows\System\OSuQuvF.exe
  C:\Windows\System\OSuQuvF.exe
  2⤵
  PID:5108
- C:\Windows\System\GjklNaa.exe
  C:\Windows\System\GjklNaa.exe
  2⤵
  PID:2624
- C:\Windows\System\wDXDIKn.exe
  C:\Windows\System\wDXDIKn.exe
  2⤵
  PID:3372
- C:\Windows\System\PTwjXMF.exe
  C:\Windows\System\PTwjXMF.exe
  2⤵
  PID:3484
- C:\Windows\System\jziaEsM.exe
  C:\Windows\System\jziaEsM.exe
  2⤵
  PID:3656
- C:\Windows\System\sQDddwQ.exe
  C:\Windows\System\sQDddwQ.exe
  2⤵
  PID:3044
- C:\Windows\System\algpWcO.exe
  C:\Windows\System\algpWcO.exe
  2⤵
  PID:3800
- C:\Windows\System\hTHNyfB.exe
  C:\Windows\System\hTHNyfB.exe
  2⤵
  PID:3880
- C:\Windows\System\zzJZtFk.exe
  C:\Windows\System\zzJZtFk.exe
  2⤵
  PID:4092
- C:\Windows\System\byUqBXy.exe
  C:\Windows\System\byUqBXy.exe
  2⤵
  PID:2828
- C:\Windows\System\KmziIPM.exe
  C:\Windows\System\KmziIPM.exe
  2⤵
  PID:3076
- C:\Windows\System\ApFNuvl.exe
  C:\Windows\System\ApFNuvl.exe
  2⤵
  PID:4040
- C:\Windows\System\vLExglI.exe
  C:\Windows\System\vLExglI.exe
  2⤵
  PID:1816
- C:\Windows\System\JCVoCQL.exe
  C:\Windows\System\JCVoCQL.exe
  2⤵
  PID:4108
- C:\Windows\System\ssbsCFu.exe
  C:\Windows\System\ssbsCFu.exe
  2⤵
  PID:3220
- C:\Windows\System\jcxbvqm.exe
  C:\Windows\System\jcxbvqm.exe
  2⤵
  PID:3264
- C:\Windows\System\YNRpcYX.exe
  C:\Windows\System\YNRpcYX.exe
  2⤵
  PID:3324
- C:\Windows\System\LaRNapk.exe
  C:\Windows\System\LaRNapk.exe
  2⤵
  PID:3452
- C:\Windows\System\FkPOEqR.exe
  C:\Windows\System\FkPOEqR.exe
  2⤵
  PID:3572
- C:\Windows\System\rPAOdji.exe
  C:\Windows\System\rPAOdji.exe
  2⤵
  PID:3548
- C:\Windows\System\RLXTFdX.exe
  C:\Windows\System\RLXTFdX.exe
  2⤵
  PID:3780
- C:\Windows\System\VWvXKTp.exe
  C:\Windows\System\VWvXKTp.exe
  2⤵
  PID:3916
- C:\Windows\System\mIiiCpp.exe
  C:\Windows\System\mIiiCpp.exe
  2⤵
  PID:2324
- C:\Windows\System\WdZgGuk.exe
  C:\Windows\System\WdZgGuk.exe
  2⤵
  PID:4172
- C:\Windows\System\BPQmuKn.exe
  C:\Windows\System\BPQmuKn.exe
  2⤵
  PID:4236
- C:\Windows\System\iOXqWvq.exe
  C:\Windows\System\iOXqWvq.exe
  2⤵
  PID:4300
- C:\Windows\System\MYiSAfO.exe
  C:\Windows\System\MYiSAfO.exe
  2⤵
  PID:4368
- C:\Windows\System\xKPanky.exe
  C:\Windows\System\xKPanky.exe
  2⤵
  PID:4408
- C:\Windows\System\tpGsBMB.exe
  C:\Windows\System\tpGsBMB.exe
  2⤵
  PID:4472
- C:\Windows\System\rLCVHlc.exe
  C:\Windows\System\rLCVHlc.exe
  2⤵
  PID:4536
- C:\Windows\System\YgmUUdQ.exe
  C:\Windows\System\YgmUUdQ.exe
  2⤵
  PID:4600
- C:\Windows\System\OKSjwHy.exe
  C:\Windows\System\OKSjwHy.exe
  2⤵
  PID:4640
- C:\Windows\System\qmqrWyh.exe
  C:\Windows\System\qmqrWyh.exe
  2⤵
  PID:4740
- C:\Windows\System\ZfDSWtp.exe
  C:\Windows\System\ZfDSWtp.exe
  2⤵
  PID:4800
- C:\Windows\System\SOzNQhA.exe
  C:\Windows\System\SOzNQhA.exe
  2⤵
  PID:4840
- C:\Windows\System\DDjJnGB.exe
  C:\Windows\System\DDjJnGB.exe
  2⤵
  PID:4988
- C:\Windows\System\skdDhMs.exe
  C:\Windows\System\skdDhMs.exe
  2⤵
  PID:4256
- C:\Windows\System\KzNGIyF.exe
  C:\Windows\System\KzNGIyF.exe
  2⤵
  PID:4324
- C:\Windows\System\QtkIyYJ.exe
  C:\Windows\System\QtkIyYJ.exe
  2⤵
  PID:4388
- C:\Windows\System\RqBeeAm.exe
  C:\Windows\System\RqBeeAm.exe
  2⤵
  PID:4488
- C:\Windows\System\LofnIec.exe
  C:\Windows\System\LofnIec.exe
  2⤵
  PID:4556
- C:\Windows\System\wcdQYmZ.exe
  C:\Windows\System\wcdQYmZ.exe
  2⤵
  PID:4624
- C:\Windows\System\btDZBaA.exe
  C:\Windows\System\btDZBaA.exe
  2⤵
  PID:4688
- C:\Windows\System\uWwPcma.exe
  C:\Windows\System\uWwPcma.exe
  2⤵
  PID:4752
- C:\Windows\System\JyyHTOV.exe
  C:\Windows\System\JyyHTOV.exe
  2⤵
  PID:4820
- C:\Windows\System\QQguuNR.exe
  C:\Windows\System\QQguuNR.exe
  2⤵
  PID:4884
- C:\Windows\System\VNudaFu.exe
  C:\Windows\System\VNudaFu.exe
  2⤵
  PID:4900
- C:\Windows\System\qGezHhE.exe
  C:\Windows\System\qGezHhE.exe
  2⤵
  PID:4916
- C:\Windows\System\uSveHdc.exe
  C:\Windows\System\uSveHdc.exe
  2⤵
  PID:5024
- C:\Windows\System\IwMFeOe.exe
  C:\Windows\System\IwMFeOe.exe
  2⤵
  PID:5084
- C:\Windows\System\CQXkcPp.exe
  C:\Windows\System\CQXkcPp.exe
  2⤵
  PID:3408
- C:\Windows\System\LjRqhhR.exe
  C:\Windows\System\LjRqhhR.exe
  2⤵
  PID:2960
- C:\Windows\System\eEUHSUQ.exe
  C:\Windows\System\eEUHSUQ.exe
  2⤵
  PID:5116
- C:\Windows\System\utuxBvw.exe
  C:\Windows\System\utuxBvw.exe
  2⤵
  PID:4960
- C:\Windows\System\DpFgoVU.exe
  C:\Windows\System\DpFgoVU.exe
  2⤵
  PID:5036
- C:\Windows\System\jdcYAPN.exe
  C:\Windows\System\jdcYAPN.exe
  2⤵
  PID:4440
- C:\Windows\System\IzqUHpP.exe
  C:\Windows\System\IzqUHpP.exe
  2⤵
  PID:4384
- C:\Windows\System\OKgKbYz.exe
  C:\Windows\System\OKgKbYz.exe
  2⤵
  PID:4028
- C:\Windows\System\bPzIJwO.exe
  C:\Windows\System\bPzIJwO.exe
  2⤵
  PID:4484
- C:\Windows\System\DcREkxf.exe
  C:\Windows\System\DcREkxf.exe
  2⤵
  PID:3184
- C:\Windows\System\rqAYokw.exe
  C:\Windows\System\rqAYokw.exe
  2⤵
  PID:4620
- C:\Windows\System\gReHkmc.exe
  C:\Windows\System\gReHkmc.exe
  2⤵
  PID:796
- C:\Windows\System\qsNwdVl.exe
  C:\Windows\System\qsNwdVl.exe
  2⤵
  PID:4836
- C:\Windows\System\gZCgIEG.exe
  C:\Windows\System\gZCgIEG.exe
  2⤵
  PID:3512
- C:\Windows\System\JDzRSkg.exe
  C:\Windows\System\JDzRSkg.exe
  2⤵
  PID:2304
- C:\Windows\System\gdQWBto.exe
  C:\Windows\System\gdQWBto.exe
  2⤵
  PID:4708
- C:\Windows\System\mrFTiJw.exe
  C:\Windows\System\mrFTiJw.exe
  2⤵
  PID:3612
- C:\Windows\System\ezBASUc.exe
  C:\Windows\System\ezBASUc.exe
  2⤵
  PID:4044
- C:\Windows\System\LpHtuYE.exe
  C:\Windows\System\LpHtuYE.exe
  2⤵
  PID:4404
- C:\Windows\System\IYRriVJ.exe
  C:\Windows\System\IYRriVJ.exe
  2⤵
  PID:4128
- C:\Windows\System\qbvBmpf.exe
  C:\Windows\System\qbvBmpf.exe
  2⤵
  PID:3000
- C:\Windows\System\ykEfMZK.exe
  C:\Windows\System\ykEfMZK.exe
  2⤵
  PID:4948
- C:\Windows\System\TrQugit.exe
  C:\Windows\System\TrQugit.exe
  2⤵
  PID:4972
- C:\Windows\System\YxsLdfY.exe
  C:\Windows\System\YxsLdfY.exe
  2⤵
  PID:5068
- C:\Windows\System\fOPsnVZ.exe
  C:\Windows\System\fOPsnVZ.exe
  2⤵
  PID:3736
- C:\Windows\System\RAVjJyS.exe
  C:\Windows\System\RAVjJyS.exe
  2⤵
  PID:4204
- C:\Windows\System\ghwLBah.exe
  C:\Windows\System\ghwLBah.exe
  2⤵
  PID:4568
- C:\Windows\System\NWQevvI.exe
  C:\Windows\System\NWQevvI.exe
  2⤵
  PID:4336
- C:\Windows\System\QSCMNiw.exe
  C:\Windows\System\QSCMNiw.exe
  2⤵
  PID:3344
- C:\Windows\System\sJnbCTR.exe
  C:\Windows\System\sJnbCTR.exe
  2⤵
  PID:4356
- C:\Windows\System\kbSBUcf.exe
  C:\Windows\System\kbSBUcf.exe
  2⤵
  PID:4252
- C:\Windows\System\WzekIKV.exe
  C:\Windows\System\WzekIKV.exe
  2⤵
  PID:3588
- C:\Windows\System\SRUIqHj.exe
  C:\Windows\System\SRUIqHj.exe
  2⤵
  PID:2340
- C:\Windows\System\YlXeOYW.exe
  C:\Windows\System\YlXeOYW.exe
  2⤵
  PID:4724
- C:\Windows\System\AHLKNTY.exe
  C:\Windows\System\AHLKNTY.exe
  2⤵
  PID:4588
- C:\Windows\System\OrBwHHp.exe
  C:\Windows\System\OrBwHHp.exe
  2⤵
  PID:4452
- C:\Windows\System\DzAVkSB.exe
  C:\Windows\System\DzAVkSB.exe
  2⤵
  PID:3388
- C:\Windows\System\ByYkRMt.exe
  C:\Windows\System\ByYkRMt.exe
  2⤵
  PID:1776
- C:\Windows\System\qhOrExH.exe
  C:\Windows\System\qhOrExH.exe
  2⤵
  PID:4140
- C:\Windows\System\UqlgZJK.exe
  C:\Windows\System\UqlgZJK.exe
  2⤵
  PID:4268
- C:\Windows\System\KkoOLgq.exe
  C:\Windows\System\KkoOLgq.exe
  2⤵
  PID:4504
- C:\Windows\System\arnXxDl.exe
  C:\Windows\System\arnXxDl.exe
  2⤵
  PID:3144
- C:\Windows\System\QbpsRNG.exe
  C:\Windows\System\QbpsRNG.exe
  2⤵
  PID:4076
- C:\Windows\System\lgHLIJg.exe
  C:\Windows\System\lgHLIJg.exe
  2⤵
  PID:4940
- C:\Windows\System\XQSrLrh.exe
  C:\Windows\System\XQSrLrh.exe
  2⤵
  PID:4192
- C:\Windows\System\myhgTap.exe
  C:\Windows\System\myhgTap.exe
  2⤵
  PID:3560
- C:\Windows\System\PDEfjLQ.exe
  C:\Windows\System\PDEfjLQ.exe
  2⤵
  PID:4956
- C:\Windows\System\qsBVOYO.exe
  C:\Windows\System\qsBVOYO.exe
  2⤵
  PID:4932
- C:\Windows\System\yzgwcYh.exe
  C:\Windows\System\yzgwcYh.exe
  2⤵
  PID:4340
- C:\Windows\System\urTfzDN.exe
  C:\Windows\System\urTfzDN.exe
  2⤵
  PID:1160
- C:\Windows\System\baXmUVZ.exe
  C:\Windows\System\baXmUVZ.exe
  2⤵
  PID:2948
- C:\Windows\System\cqwoWOh.exe
  C:\Windows\System\cqwoWOh.exe
  2⤵
  PID:3104
- C:\Windows\System\vPCuMMf.exe
  C:\Windows\System\vPCuMMf.exe
  2⤵
  PID:4784
- C:\Windows\System\uuTHsPg.exe
  C:\Windows\System\uuTHsPg.exe
  2⤵
  PID:2620
- C:\Windows\System\lrqsGrC.exe
  C:\Windows\System\lrqsGrC.exe
  2⤵
  PID:3624
- C:\Windows\System\XyvWwpn.exe
  C:\Windows\System\XyvWwpn.exe
  2⤵
  PID:2116
- C:\Windows\System\vgyWDHN.exe
  C:\Windows\System\vgyWDHN.exe
  2⤵
  PID:2860
- C:\Windows\System\UElUjZV.exe
  C:\Windows\System\UElUjZV.exe
  2⤵
  PID:3964
- C:\Windows\System\ELfUmQc.exe
  C:\Windows\System\ELfUmQc.exe
  2⤵
  PID:4856
- C:\Windows\System\DrFyZRP.exe
  C:\Windows\System\DrFyZRP.exe
  2⤵
  PID:3532
- C:\Windows\System\HietlsD.exe
  C:\Windows\System\HietlsD.exe
  2⤵
  PID:4272
- C:\Windows\System\UtkkoXd.exe
  C:\Windows\System\UtkkoXd.exe
  2⤵
  PID:4400
- C:\Windows\System\poFVMUy.exe
  C:\Windows\System\poFVMUy.exe
  2⤵
  PID:3320
- C:\Windows\System\nXGRNbm.exe
  C:\Windows\System\nXGRNbm.exe
  2⤵
  PID:4868
- C:\Windows\System\MCxdjDu.exe
  C:\Windows\System\MCxdjDu.exe
  2⤵
  PID:4220
- C:\Windows\System\WpETOsh.exe
  C:\Windows\System\WpETOsh.exe
  2⤵
  PID:4804
- C:\Windows\System\rfrOcgL.exe
  C:\Windows\System\rfrOcgL.exe
  2⤵
  PID:4424
- C:\Windows\System\VGdcCZh.exe
  C:\Windows\System\VGdcCZh.exe
  2⤵
  PID:5104
- C:\Windows\System\xYyhtbz.exe
  C:\Windows\System\xYyhtbz.exe
  2⤵
  PID:320
- C:\Windows\System\HvBEsmN.exe
  C:\Windows\System\HvBEsmN.exe
  2⤵
  PID:4552
- C:\Windows\System\hSHkPUS.exe
  C:\Windows\System\hSHkPUS.exe
  2⤵
  PID:1084
- C:\Windows\System\xpiYEtf.exe
  C:\Windows\System\xpiYEtf.exe
  2⤵
  PID:4160
- C:\Windows\System\qDzgZGq.exe
  C:\Windows\System\qDzgZGq.exe
  2⤵
  PID:624
- C:\Windows\System\JDEBext.exe
  C:\Windows\System\JDEBext.exe
  2⤵
  PID:5132
- C:\Windows\System\XuFOvAo.exe
  C:\Windows\System\XuFOvAo.exe
  2⤵
  PID:5148
- C:\Windows\System\utBxmPX.exe
  C:\Windows\System\utBxmPX.exe
  2⤵
  PID:5164
- C:\Windows\System\ZgQFxJJ.exe
  C:\Windows\System\ZgQFxJJ.exe
  2⤵
  PID:5180
- C:\Windows\System\fvXOgDq.exe
  C:\Windows\System\fvXOgDq.exe
  2⤵
  PID:5196
- C:\Windows\System\GeQTkmz.exe
  C:\Windows\System\GeQTkmz.exe
  2⤵
  PID:5212
- C:\Windows\System\kPSsExP.exe
  C:\Windows\System\kPSsExP.exe
  2⤵
  PID:5228
- C:\Windows\System\ubjcEft.exe
  C:\Windows\System\ubjcEft.exe
  2⤵
  PID:5244
- C:\Windows\System\rZuskjF.exe
  C:\Windows\System\rZuskjF.exe
  2⤵
  PID:5260
- C:\Windows\System\ySTOQWD.exe
  C:\Windows\System\ySTOQWD.exe
  2⤵
  PID:5276
- C:\Windows\System\PnJsuut.exe
  C:\Windows\System\PnJsuut.exe
  2⤵
  PID:5292
- C:\Windows\System\ZJNMuzC.exe
  C:\Windows\System\ZJNMuzC.exe
  2⤵
  PID:5308
- C:\Windows\System\wxkRJng.exe
  C:\Windows\System\wxkRJng.exe
  2⤵
  PID:5324
- C:\Windows\System\BryBchU.exe
  C:\Windows\System\BryBchU.exe
  2⤵
  PID:5340
- C:\Windows\System\ScbtnxD.exe
  C:\Windows\System\ScbtnxD.exe
  2⤵
  PID:5356
- C:\Windows\System\fSHnRwc.exe
  C:\Windows\System\fSHnRwc.exe
  2⤵
  PID:5372
- C:\Windows\System\MqCMruQ.exe
  C:\Windows\System\MqCMruQ.exe
  2⤵
  PID:5388
- C:\Windows\System\MwrLWKe.exe
  C:\Windows\System\MwrLWKe.exe
  2⤵
  PID:5404
- C:\Windows\System\kCpGsUz.exe
  C:\Windows\System\kCpGsUz.exe
  2⤵
  PID:5420
- C:\Windows\System\wVGHsBj.exe
  C:\Windows\System\wVGHsBj.exe
  2⤵
  PID:5436
- C:\Windows\System\FpXJaoK.exe
  C:\Windows\System\FpXJaoK.exe
  2⤵
  PID:5452
- C:\Windows\System\IijPLrb.exe
  C:\Windows\System\IijPLrb.exe
  2⤵
  PID:5468
- C:\Windows\System\nZdTDHc.exe
  C:\Windows\System\nZdTDHc.exe
  2⤵
  PID:5484
- C:\Windows\System\gctfZlC.exe
  C:\Windows\System\gctfZlC.exe
  2⤵
  PID:5500
- C:\Windows\System\CyVkrWK.exe
  C:\Windows\System\CyVkrWK.exe
  2⤵
  PID:5516
- C:\Windows\System\DUcGzll.exe
  C:\Windows\System\DUcGzll.exe
  2⤵
  PID:5532
- C:\Windows\System\AjgJIVr.exe
  C:\Windows\System\AjgJIVr.exe
  2⤵
  PID:5548
- C:\Windows\System\tyGAGaC.exe
  C:\Windows\System\tyGAGaC.exe
  2⤵
  PID:5564
- C:\Windows\System\ZcpuyDj.exe
  C:\Windows\System\ZcpuyDj.exe
  2⤵
  PID:5580
- C:\Windows\System\kakWFuB.exe
  C:\Windows\System\kakWFuB.exe
  2⤵
  PID:5596
- C:\Windows\System\gTmvgRe.exe
  C:\Windows\System\gTmvgRe.exe
  2⤵
  PID:5612
- C:\Windows\System\AHOSSKO.exe
  C:\Windows\System\AHOSSKO.exe
  2⤵
  PID:5628
- C:\Windows\System\CTnMlxa.exe
  C:\Windows\System\CTnMlxa.exe
  2⤵
  PID:5644
- C:\Windows\System\lvahden.exe
  C:\Windows\System\lvahden.exe
  2⤵
  PID:5660
- C:\Windows\System\sxHoTAW.exe
  C:\Windows\System\sxHoTAW.exe
  2⤵
  PID:5676
- C:\Windows\System\tzAKbHG.exe
  C:\Windows\System\tzAKbHG.exe
  2⤵
  PID:5692
- C:\Windows\System\jClaGLt.exe
  C:\Windows\System\jClaGLt.exe
  2⤵
  PID:5708
- C:\Windows\System\PoJeJZj.exe
  C:\Windows\System\PoJeJZj.exe
  2⤵
  PID:5724
- C:\Windows\System\auorOVL.exe
  C:\Windows\System\auorOVL.exe
  2⤵
  PID:5740
- C:\Windows\System\qSaIKvY.exe
  C:\Windows\System\qSaIKvY.exe
  2⤵
  PID:5756
- C:\Windows\System\OTkMBbW.exe
  C:\Windows\System\OTkMBbW.exe
  2⤵
  PID:5772
- C:\Windows\System\YhqvGWz.exe
  C:\Windows\System\YhqvGWz.exe
  2⤵
  PID:5788
- C:\Windows\System\jMQjGnh.exe
  C:\Windows\System\jMQjGnh.exe
  2⤵
  PID:5804
- C:\Windows\System\PWWcfUM.exe
  C:\Windows\System\PWWcfUM.exe
  2⤵
  PID:5820
- C:\Windows\System\JvvQXmA.exe
  C:\Windows\System\JvvQXmA.exe
  2⤵
  PID:5840
- C:\Windows\System\MzSGoMA.exe
  C:\Windows\System\MzSGoMA.exe
  2⤵
  PID:5856
- C:\Windows\System\jXQgqpe.exe
  C:\Windows\System\jXQgqpe.exe
  2⤵
  PID:5872
- C:\Windows\System\lCMmxVs.exe
  C:\Windows\System\lCMmxVs.exe
  2⤵
  PID:5888
- C:\Windows\System\RXjAyTX.exe
  C:\Windows\System\RXjAyTX.exe
  2⤵
  PID:5904
- C:\Windows\System\AKjuwQr.exe
  C:\Windows\System\AKjuwQr.exe
  2⤵
  PID:5924
- C:\Windows\System\skXKxYx.exe
  C:\Windows\System\skXKxYx.exe
  2⤵
  PID:5940
- C:\Windows\System\pQNygTb.exe
  C:\Windows\System\pQNygTb.exe
  2⤵
  PID:5956
- C:\Windows\System\DOPTYPi.exe
  C:\Windows\System\DOPTYPi.exe
  2⤵
  PID:5972
- C:\Windows\System\ICwVDfX.exe
  C:\Windows\System\ICwVDfX.exe
  2⤵
  PID:5992
- C:\Windows\System\MyWKddH.exe
  C:\Windows\System\MyWKddH.exe
  2⤵
  PID:6008
- C:\Windows\System\PcLvTVb.exe
  C:\Windows\System\PcLvTVb.exe
  2⤵
  PID:6024
- C:\Windows\System\GYqmXGl.exe
  C:\Windows\System\GYqmXGl.exe
  2⤵
  PID:6040
- C:\Windows\System\kWamphQ.exe
  C:\Windows\System\kWamphQ.exe
  2⤵
  PID:6056
- C:\Windows\System\KVrivXv.exe
  C:\Windows\System\KVrivXv.exe
  2⤵
  PID:6072
- C:\Windows\System\QsGThBf.exe
  C:\Windows\System\QsGThBf.exe
  2⤵
  PID:6088
- C:\Windows\System\PNCMeSU.exe
  C:\Windows\System\PNCMeSU.exe
  2⤵
  PID:6112
- C:\Windows\System\IcDbTyj.exe
  C:\Windows\System\IcDbTyj.exe
  2⤵
  PID:6132
- C:\Windows\System\jjKDmcj.exe
  C:\Windows\System\jjKDmcj.exe
  2⤵
  PID:5128
- C:\Windows\System\WbPBrnJ.exe
  C:\Windows\System\WbPBrnJ.exe
  2⤵
  PID:5192
- C:\Windows\System\tLheghZ.exe
  C:\Windows\System\tLheghZ.exe
  2⤵
  PID:5256
- C:\Windows\System\cCKcYua.exe
  C:\Windows\System\cCKcYua.exe
  2⤵
  PID:5320
- C:\Windows\System\KvidDIb.exe
  C:\Windows\System\KvidDIb.exe
  2⤵
  PID:4912
- C:\Windows\System\HymaNNT.exe
  C:\Windows\System\HymaNNT.exe
  2⤵
  PID:5144
- C:\Windows\System\KdaMNrF.exe
  C:\Windows\System\KdaMNrF.exe
  2⤵
  PID:5240
- C:\Windows\System\KKQMGXA.exe
  C:\Windows\System\KKQMGXA.exe
  2⤵
  PID:5412
- C:\Windows\System\oAmsKau.exe
  C:\Windows\System\oAmsKau.exe
  2⤵
  PID:5416
- C:\Windows\System\yuyCnXC.exe
  C:\Windows\System\yuyCnXC.exe
  2⤵
  PID:5172
- C:\Windows\System\CJvbSSr.exe
  C:\Windows\System\CJvbSSr.exe
  2⤵
  PID:5444
- C:\Windows\System\yvJzBBJ.exe
  C:\Windows\System\yvJzBBJ.exe
  2⤵
  PID:2692
- C:\Windows\System\sxxwGre.exe
  C:\Windows\System\sxxwGre.exe
  2⤵
  PID:5428
- C:\Windows\System\SZnVqEC.exe
  C:\Windows\System\SZnVqEC.exe
  2⤵
  PID:5476
- C:\Windows\System\ziVwBXp.exe
  C:\Windows\System\ziVwBXp.exe
  2⤵
  PID:5496
- C:\Windows\System\qUgfAwZ.exe
  C:\Windows\System\qUgfAwZ.exe
  2⤵
  PID:5512
- C:\Windows\System\RPTLAsh.exe
  C:\Windows\System\RPTLAsh.exe
  2⤵
  PID:5576
- C:\Windows\System\uWQnyVe.exe
  C:\Windows\System\uWQnyVe.exe
  2⤵
  PID:5640
- C:\Windows\System\iOBXJSA.exe
  C:\Windows\System\iOBXJSA.exe
  2⤵
  PID:5704
- C:\Windows\System\wfssdLf.exe
  C:\Windows\System\wfssdLf.exe
  2⤵
  PID:5768
- C:\Windows\System\OngWaJc.exe
  C:\Windows\System\OngWaJc.exe
  2⤵
  PID:5832
- C:\Windows\System\upNhibw.exe
  C:\Windows\System\upNhibw.exe
  2⤵
  PID:5896
- C:\Windows\System\tRYUxfS.exe
  C:\Windows\System\tRYUxfS.exe
  2⤵
  PID:5968
- C:\Windows\System\yPKnpJd.exe
  C:\Windows\System\yPKnpJd.exe
  2⤵
  PID:5964
- C:\Windows\System\YYmawmj.exe
  C:\Windows\System\YYmawmj.exe
  2⤵
  PID:6096
- C:\Windows\System\LCzrSMt.exe
  C:\Windows\System\LCzrSMt.exe
  2⤵
  PID:6108
- C:\Windows\System\CEnNYMz.exe
  C:\Windows\System\CEnNYMz.exe
  2⤵
  PID:5620
- C:\Windows\System\SJaeGpi.exe
  C:\Windows\System\SJaeGpi.exe
  2⤵
  PID:5684
- C:\Windows\System\kNWUNXB.exe
  C:\Windows\System\kNWUNXB.exe
  2⤵
  PID:5780
- C:\Windows\System\ynYSpBA.exe
  C:\Windows\System\ynYSpBA.exe
  2⤵
  PID:5816
- C:\Windows\System\wWPxxob.exe
  C:\Windows\System\wWPxxob.exe
  2⤵
  PID:5884
- C:\Windows\System\AgidruA.exe
  C:\Windows\System\AgidruA.exe
  2⤵
  PID:5948
- C:\Windows\System\FHUKBTl.exe
  C:\Windows\System\FHUKBTl.exe
  2⤵
  PID:6016
- C:\Windows\System\hwFXMFI.exe
  C:\Windows\System\hwFXMFI.exe
  2⤵
  PID:6052
- C:\Windows\System\zouYYKV.exe
  C:\Windows\System\zouYYKV.exe
  2⤵
  PID:6120
- C:\Windows\System\GiIhAFb.exe
  C:\Windows\System\GiIhAFb.exe
  2⤵
  PID:5252
- C:\Windows\System\lEGwrvY.exe
  C:\Windows\System\lEGwrvY.exe
  2⤵
  PID:5384
- C:\Windows\System\qUKwSGw.exe
  C:\Windows\System\qUKwSGw.exe
  2⤵
  PID:5304
- C:\Windows\System\vOKEbGI.exe
  C:\Windows\System\vOKEbGI.exe
  2⤵
  PID:4852
- C:\Windows\System\GfJxLmI.exe
  C:\Windows\System\GfJxLmI.exe
  2⤵
  PID:5700
- C:\Windows\System\GPIUIwL.exe
  C:\Windows\System\GPIUIwL.exe
  2⤵
  PID:5932
- C:\Windows\System\KpmTjvG.exe
  C:\Windows\System\KpmTjvG.exe
  2⤵
  PID:5592
- C:\Windows\System\IeMtIyR.exe
  C:\Windows\System\IeMtIyR.exe
  2⤵
  PID:6080
- C:\Windows\System\qUbZyEN.exe
  C:\Windows\System\qUbZyEN.exe
  2⤵
  PID:5880
- C:\Windows\System\HVHsyPP.exe
  C:\Windows\System\HVHsyPP.exe
  2⤵
  PID:6152
- C:\Windows\System\xCtpNrD.exe
  C:\Windows\System\xCtpNrD.exe
  2⤵
  PID:6168
- C:\Windows\System\IwsJzqG.exe
  C:\Windows\System\IwsJzqG.exe
  2⤵
  PID:6184
- C:\Windows\System\GZtzKAv.exe
  C:\Windows\System\GZtzKAv.exe
  2⤵
  PID:6200
- C:\Windows\System\jfbmejc.exe
  C:\Windows\System\jfbmejc.exe
  2⤵
  PID:6216
- C:\Windows\System\TozOcpd.exe
  C:\Windows\System\TozOcpd.exe
  2⤵
  PID:6232
- C:\Windows\System\QYcrWYB.exe
  C:\Windows\System\QYcrWYB.exe
  2⤵
  PID:6248
- C:\Windows\System\sohhkLZ.exe
  C:\Windows\System\sohhkLZ.exe
  2⤵
  PID:6264
- C:\Windows\System\uGgdsvE.exe
  C:\Windows\System\uGgdsvE.exe
  2⤵
  PID:6280
- C:\Windows\System\WEwFHZk.exe
  C:\Windows\System\WEwFHZk.exe
  2⤵
  PID:6296
- C:\Windows\System\pwCydYp.exe
  C:\Windows\System\pwCydYp.exe
  2⤵
  PID:6312
- C:\Windows\System\RFXjSlp.exe
  C:\Windows\System\RFXjSlp.exe
  2⤵
  PID:6328
- C:\Windows\System\VUQcXtn.exe
  C:\Windows\System\VUQcXtn.exe
  2⤵
  PID:6344
- C:\Windows\System\WCaxFGz.exe
  C:\Windows\System\WCaxFGz.exe
  2⤵
  PID:6360
- C:\Windows\System\tNzcQIP.exe
  C:\Windows\System\tNzcQIP.exe
  2⤵
  PID:6376
- C:\Windows\System\uRDDcfM.exe
  C:\Windows\System\uRDDcfM.exe
  2⤵
  PID:6392
- C:\Windows\System\tShXVpl.exe
  C:\Windows\System\tShXVpl.exe
  2⤵
  PID:6408
- C:\Windows\System\mSxZJKc.exe
  C:\Windows\System\mSxZJKc.exe
  2⤵
  PID:6428
- C:\Windows\System\iXRVegq.exe
  C:\Windows\System\iXRVegq.exe
  2⤵
  PID:6444
- C:\Windows\System\lLiMrVc.exe
  C:\Windows\System\lLiMrVc.exe
  2⤵
  PID:6460
- C:\Windows\System\hOenSEF.exe
  C:\Windows\System\hOenSEF.exe
  2⤵
  PID:6476
- C:\Windows\System\irpqbpb.exe
  C:\Windows\System\irpqbpb.exe
  2⤵
  PID:6492
- C:\Windows\System\sKqdKBC.exe
  C:\Windows\System\sKqdKBC.exe
  2⤵
  PID:6512
- C:\Windows\System\ZdkXcGI.exe
  C:\Windows\System\ZdkXcGI.exe
  2⤵
  PID:6528
- C:\Windows\System\AnDFRFx.exe
  C:\Windows\System\AnDFRFx.exe
  2⤵
  PID:6544
- C:\Windows\System\qifdEEh.exe
  C:\Windows\System\qifdEEh.exe
  2⤵
  PID:6560
- C:\Windows\System\gahuNNA.exe
  C:\Windows\System\gahuNNA.exe
  2⤵
  PID:6576
- C:\Windows\System\LvwYjcd.exe
  C:\Windows\System\LvwYjcd.exe
  2⤵
  PID:6596
- C:\Windows\System\QxWQJWz.exe
  C:\Windows\System\QxWQJWz.exe
  2⤵
  PID:6612
- C:\Windows\System\aJWMFcW.exe
  C:\Windows\System\aJWMFcW.exe
  2⤵
  PID:6628
- C:\Windows\System\EGbpJBq.exe
  C:\Windows\System\EGbpJBq.exe
  2⤵
  PID:6644
- C:\Windows\System\tUIZJbz.exe
  C:\Windows\System\tUIZJbz.exe
  2⤵
  PID:6664
- C:\Windows\System\UIHamgA.exe
  C:\Windows\System\UIHamgA.exe
  2⤵
  PID:6680
- C:\Windows\System\xOMRjdL.exe
  C:\Windows\System\xOMRjdL.exe
  2⤵
  PID:6696
- C:\Windows\System\KDzzeEo.exe
  C:\Windows\System\KDzzeEo.exe
  2⤵
  PID:6712
- C:\Windows\System\RupvIuX.exe
  C:\Windows\System\RupvIuX.exe
  2⤵
  PID:6728
- C:\Windows\System\zlYSzUm.exe
  C:\Windows\System\zlYSzUm.exe
  2⤵
  PID:6748
- C:\Windows\System\eZKIkcL.exe
  C:\Windows\System\eZKIkcL.exe
  2⤵
  PID:6764
- C:\Windows\System\msEhndl.exe
  C:\Windows\System\msEhndl.exe
  2⤵
  PID:6780
- C:\Windows\System\QZWtWyG.exe
  C:\Windows\System\QZWtWyG.exe
  2⤵
  PID:6796
- C:\Windows\System\VCGkbux.exe
  C:\Windows\System\VCGkbux.exe
  2⤵
  PID:6812
- C:\Windows\System\afjuFCC.exe
  C:\Windows\System\afjuFCC.exe
  2⤵
  PID:6828
- C:\Windows\System\eAqYdrt.exe
  C:\Windows\System\eAqYdrt.exe
  2⤵
  PID:6844
- C:\Windows\System\fhcPgnI.exe
  C:\Windows\System\fhcPgnI.exe
  2⤵
  PID:6860
- C:\Windows\System\lKQLbrw.exe
  C:\Windows\System\lKQLbrw.exe
  2⤵
  PID:6876
- C:\Windows\System\iwioZFe.exe
  C:\Windows\System\iwioZFe.exe
  2⤵
  PID:6892
- C:\Windows\System\MfzwiuS.exe
  C:\Windows\System\MfzwiuS.exe
  2⤵
  PID:6912
- C:\Windows\System\aatvInG.exe
  C:\Windows\System\aatvInG.exe
  2⤵
  PID:6928
- C:\Windows\System\yovaiEU.exe
  C:\Windows\System\yovaiEU.exe
  2⤵
  PID:6948
- C:\Windows\System\IKkHXYI.exe
  C:\Windows\System\IKkHXYI.exe
  2⤵
  PID:6964
- C:\Windows\System\xXflWTL.exe
  C:\Windows\System\xXflWTL.exe
  2⤵
  PID:6980
- C:\Windows\System\SoCtySg.exe
  C:\Windows\System\SoCtySg.exe
  2⤵
  PID:6996
- C:\Windows\System\FvLKRqP.exe
  C:\Windows\System\FvLKRqP.exe
  2⤵
  PID:7012
- C:\Windows\System\DqqpriO.exe
  C:\Windows\System\DqqpriO.exe
  2⤵
  PID:7028
- C:\Windows\System\bfxqIMg.exe
  C:\Windows\System\bfxqIMg.exe
  2⤵
  PID:7044
- C:\Windows\System\DGLmhhu.exe
  C:\Windows\System\DGLmhhu.exe
  2⤵
  PID:7060
- C:\Windows\System\cspPaOY.exe
  C:\Windows\System\cspPaOY.exe
  2⤵
  PID:7076
- C:\Windows\System\ITTwqWL.exe
  C:\Windows\System\ITTwqWL.exe
  2⤵
  PID:7092
- C:\Windows\System\UpMbmTB.exe
  C:\Windows\System\UpMbmTB.exe
  2⤵
  PID:7108
- C:\Windows\System\HLpesPq.exe
  C:\Windows\System\HLpesPq.exe
  2⤵
  PID:7124
- C:\Windows\System\qEhXNEW.exe
  C:\Windows\System\qEhXNEW.exe
  2⤵
  PID:7140
- C:\Windows\System\eQCIZmQ.exe
  C:\Windows\System\eQCIZmQ.exe
  2⤵
  PID:7156
- C:\Windows\System\hiMIiYs.exe
  C:\Windows\System\hiMIiYs.exe
  2⤵
  PID:5572
- C:\Windows\System\rLYroEK.exe
  C:\Windows\System\rLYroEK.exe
  2⤵
  PID:5980
- C:\Windows\System\SbloHQl.exe
  C:\Windows\System\SbloHQl.exe
  2⤵
  PID:6148
- C:\Windows\System\BQMYcOP.exe
  C:\Windows\System\BQMYcOP.exe
  2⤵
  PID:6212
- C:\Windows\System\fITKuAE.exe
  C:\Windows\System\fITKuAE.exe
  2⤵
  PID:6276
- C:\Windows\System\WoPWMUY.exe
  C:\Windows\System\WoPWMUY.exe
  2⤵
  PID:6340
- C:\Windows\System\cTeasrF.exe
  C:\Windows\System\cTeasrF.exe
  2⤵
  PID:6400
- C:\Windows\System\MaQnuWG.exe
  C:\Windows\System\MaQnuWG.exe
  2⤵
  PID:6436
- C:\Windows\System\NCMIGmt.exe
  C:\Windows\System\NCMIGmt.exe
  2⤵
  PID:6472
- C:\Windows\System\EGXoynG.exe
  C:\Windows\System\EGXoynG.exe
  2⤵
  PID:6536
- C:\Windows\System\PCMawSM.exe
  C:\Windows\System\PCMawSM.exe
  2⤵
  PID:3752
- C:\Windows\System\CplLVUG.exe
  C:\Windows\System\CplLVUG.exe
  2⤵
  PID:6420
- C:\Windows\System\ENXehrY.exe
  C:\Windows\System\ENXehrY.exe
  2⤵
  PID:5288
- C:\Windows\System\smhHlrZ.exe
  C:\Windows\System\smhHlrZ.exe
  2⤵
  PID:5380
- C:\Windows\System\TRSeHzO.exe
  C:\Windows\System\TRSeHzO.exe
  2⤵
  PID:2864
- C:\Windows\System\lTZnxvO.exe
  C:\Windows\System\lTZnxvO.exe
  2⤵
  PID:5524
- C:\Windows\System\iTntpme.exe
  C:\Windows\System\iTntpme.exe
  2⤵
  PID:6256
- C:\Windows\System\nHIgsUM.exe
  C:\Windows\System\nHIgsUM.exe
  2⤵
  PID:6032
- C:\Windows\System\OoaeSKl.exe
  C:\Windows\System\OoaeSKl.exe
  2⤵
  PID:5656
- C:\Windows\System\phrlyry.exe
  C:\Windows\System\phrlyry.exe
  2⤵
  PID:6048
- C:\Windows\System\bIlHoXv.exe
  C:\Windows\System\bIlHoXv.exe
  2⤵
  PID:5208
- C:\Windows\System\MQUUXvf.exe
  C:\Windows\System\MQUUXvf.exe
  2⤵
  PID:5588
- C:\Windows\System\YsMPhiD.exe
  C:\Windows\System\YsMPhiD.exe
  2⤵
  PID:6224
- C:\Windows\System\dCkQyBd.exe
  C:\Windows\System\dCkQyBd.exe
  2⤵
  PID:6292
- C:\Windows\System\IxCjYIA.exe
  C:\Windows\System\IxCjYIA.exe
  2⤵
  PID:6356
- C:\Windows\System\bMYrunR.exe
  C:\Windows\System\bMYrunR.exe
  2⤵
  PID:6456
- C:\Windows\System\gMTiTVz.exe
  C:\Windows\System\gMTiTVz.exe
  2⤵
  PID:6524
- C:\Windows\System\AfYqIXZ.exe
  C:\Windows\System\AfYqIXZ.exe
  2⤵
  PID:6588
- C:\Windows\System\nnalPoF.exe
  C:\Windows\System\nnalPoF.exe
  2⤵
  PID:6672
- C:\Windows\System\frnapFv.exe
  C:\Windows\System\frnapFv.exe
  2⤵
  PID:6744
- C:\Windows\System\sWcVjGE.exe
  C:\Windows\System\sWcVjGE.exe
  2⤵
  PID:6772
- C:\Windows\System\Sjfbpzd.exe
  C:\Windows\System\Sjfbpzd.exe
  2⤵
  PID:6836
- C:\Windows\System\TFCVvMz.exe
  C:\Windows\System\TFCVvMz.exe
  2⤵
  PID:6900
- C:\Windows\System\EYkvudb.exe
  C:\Windows\System\EYkvudb.exe
  2⤵
  PID:6940
- C:\Windows\System\NdITzQz.exe
  C:\Windows\System\NdITzQz.exe
  2⤵
  PID:7004
- C:\Windows\System\ClsEXum.exe
  C:\Windows\System\ClsEXum.exe
  2⤵
  PID:6720
- C:\Windows\System\JjSjCzH.exe
  C:\Windows\System\JjSjCzH.exe
  2⤵
  PID:6852
- C:\Windows\System\NGlpUsu.exe
  C:\Windows\System\NGlpUsu.exe
  2⤵
  PID:6656
- C:\Windows\System\WfedAzv.exe
  C:\Windows\System\WfedAzv.exe
  2⤵
  PID:6756
- C:\Windows\System\SFNNZoD.exe
  C:\Windows\System\SFNNZoD.exe
  2⤵
  PID:6856
- C:\Windows\System\QvFFJBM.exe
  C:\Windows\System\QvFFJBM.exe
  2⤵
  PID:6924
- C:\Windows\System\sfxXtvt.exe
  C:\Windows\System\sfxXtvt.exe
  2⤵
  PID:6992
- C:\Windows\System\rLoEBGI.exe
  C:\Windows\System\rLoEBGI.exe
  2⤵
  PID:7068
- C:\Windows\System\RXwNozA.exe
  C:\Windows\System\RXwNozA.exe
  2⤵
  PID:7104
- C:\Windows\System\faVwgRf.exe
  C:\Windows\System\faVwgRf.exe
  2⤵
  PID:5492
- C:\Windows\System\FQasvNw.exe
  C:\Windows\System\FQasvNw.exe
  2⤵
  PID:6244
- C:\Windows\System\aXjboZd.exe
  C:\Windows\System\aXjboZd.exe
  2⤵
  PID:6368
- C:\Windows\System\xtLRyQL.exe
  C:\Windows\System\xtLRyQL.exe
  2⤵
  PID:6568
- C:\Windows\System\QZLuvLh.exe
  C:\Windows\System\QZLuvLh.exe
  2⤵
  PID:7116
- C:\Windows\System\pOFxsuC.exe
  C:\Windows\System\pOFxsuC.exe
  2⤵
  PID:6572
- C:\Windows\System\CBcLQZl.exe
  C:\Windows\System\CBcLQZl.exe
  2⤵
  PID:6180
- C:\Windows\System\BacqWDB.exe
  C:\Windows\System\BacqWDB.exe
  2⤵
  PID:5188
- C:\Windows\System\VoDtNHG.exe
  C:\Windows\System\VoDtNHG.exe
  2⤵
  PID:5368
- C:\Windows\System\ySiNoKd.exe
  C:\Windows\System\ySiNoKd.exe
  2⤵
  PID:4924
- C:\Windows\System\OTAfuyE.exe
  C:\Windows\System\OTAfuyE.exe
  2⤵
  PID:5556
- C:\Windows\System\RDHngNn.exe
  C:\Windows\System\RDHngNn.exe
  2⤵
  PID:5224
- C:\Windows\System\AsSXJpk.exe
  C:\Windows\System\AsSXJpk.exe
  2⤵
  PID:5916
- C:\Windows\System\YsLIQbo.exe
  C:\Windows\System\YsLIQbo.exe
  2⤵
  PID:6068
- C:\Windows\System\xOWMOYp.exe
  C:\Windows\System\xOWMOYp.exe
  2⤵
  PID:6388
- C:\Windows\System\pfPDaQH.exe
  C:\Windows\System\pfPDaQH.exe
  2⤵
  PID:6640
- C:\Windows\System\FksKPli.exe
  C:\Windows\System\FksKPli.exe
  2⤵
  PID:6872
- C:\Windows\System\pNblOjB.exe
  C:\Windows\System\pNblOjB.exe
  2⤵
  PID:6824
- C:\Windows\System\ukLeHut.exe
  C:\Windows\System\ukLeHut.exe
  2⤵
  PID:6888
- C:\Windows\System\SKolqqd.exe
  C:\Windows\System\SKolqqd.exe
  2⤵
  PID:7136
- C:\Windows\System\koCWgbx.exe
  C:\Windows\System\koCWgbx.exe
  2⤵
  PID:6308
- C:\Windows\System\RlLdlOO.exe
  C:\Windows\System\RlLdlOO.exe
  2⤵
  PID:6416
- C:\Windows\System\aiyqzAp.exe
  C:\Windows\System\aiyqzAp.exe
  2⤵
  PID:5396
- C:\Windows\System\nMxKqxo.exe
  C:\Windows\System\nMxKqxo.exe
  2⤵
  PID:6488
- C:\Windows\System\OgLFmsQ.exe
  C:\Windows\System\OgLFmsQ.exe
  2⤵
  PID:6692
- C:\Windows\System\QdJoaMt.exe
  C:\Windows\System\QdJoaMt.exe
  2⤵
  PID:7088
- C:\Windows\System\YnTdAMF.exe
  C:\Windows\System\YnTdAMF.exe
  2⤵
  PID:6868
- C:\Windows\System\KiRNOVV.exe
  C:\Windows\System\KiRNOVV.exe
  2⤵
  PID:6740
- C:\Windows\System\IizgnGK.exe
  C:\Windows\System\IizgnGK.exe
  2⤵
  PID:7188
- C:\Windows\System\ZcnIbYC.exe
  C:\Windows\System\ZcnIbYC.exe
  2⤵
  PID:7204
- C:\Windows\System\RfDuwIN.exe
  C:\Windows\System\RfDuwIN.exe
  2⤵
  PID:7220
- C:\Windows\System\zHmckBp.exe
  C:\Windows\System\zHmckBp.exe
  2⤵
  PID:7236
- C:\Windows\System\DJkTuku.exe
  C:\Windows\System\DJkTuku.exe
  2⤵
  PID:7252
- C:\Windows\System\hwmKQcN.exe
  C:\Windows\System\hwmKQcN.exe
  2⤵
  PID:7268
- C:\Windows\System\gLxGlug.exe
  C:\Windows\System\gLxGlug.exe
  2⤵
  PID:7284
- C:\Windows\System\UdyHoDN.exe
  C:\Windows\System\UdyHoDN.exe
  2⤵
  PID:7300
- C:\Windows\System\lnfwLHy.exe
  C:\Windows\System\lnfwLHy.exe
  2⤵
  PID:7316
- C:\Windows\System\tVXmvlv.exe
  C:\Windows\System\tVXmvlv.exe
  2⤵
  PID:7332
- C:\Windows\System\hAewQbT.exe
  C:\Windows\System\hAewQbT.exe
  2⤵
  PID:7348
- C:\Windows\System\HzwbrLF.exe
  C:\Windows\System\HzwbrLF.exe
  2⤵
  PID:7364
- C:\Windows\System\TtGaEME.exe
  C:\Windows\System\TtGaEME.exe
  2⤵
  PID:7380
- C:\Windows\System\lWJHLwP.exe
  C:\Windows\System\lWJHLwP.exe
  2⤵
  PID:7396
- C:\Windows\System\KhfIJCk.exe
  C:\Windows\System\KhfIJCk.exe
  2⤵
  PID:7412
- C:\Windows\System\ltYjSGB.exe
  C:\Windows\System\ltYjSGB.exe
  2⤵
  PID:7428
- C:\Windows\System\DXNLibr.exe
  C:\Windows\System\DXNLibr.exe
  2⤵
  PID:7444
- C:\Windows\System\MrlXeaV.exe
  C:\Windows\System\MrlXeaV.exe
  2⤵
  PID:7460
- C:\Windows\System\OTmTMdD.exe
  C:\Windows\System\OTmTMdD.exe
  2⤵
  PID:7476
- C:\Windows\System\UOPOkqR.exe
  C:\Windows\System\UOPOkqR.exe
  2⤵
  PID:7492
- C:\Windows\System\izcJMJG.exe
  C:\Windows\System\izcJMJG.exe
  2⤵
  PID:7508
- C:\Windows\System\lMNjENH.exe
  C:\Windows\System\lMNjENH.exe
  2⤵
  PID:7524
- C:\Windows\System\EiamWJU.exe
  C:\Windows\System\EiamWJU.exe
  2⤵
  PID:7540
- C:\Windows\System\yRFXzIj.exe
  C:\Windows\System\yRFXzIj.exe
  2⤵
  PID:7556
- C:\Windows\System\BpYEOSw.exe
  C:\Windows\System\BpYEOSw.exe
  2⤵
  PID:7572
- C:\Windows\System\sApaJiD.exe
  C:\Windows\System\sApaJiD.exe
  2⤵
  PID:7588
- C:\Windows\System\NPJbkXI.exe
  C:\Windows\System\NPJbkXI.exe
  2⤵
  PID:7604
- C:\Windows\System\ZhLFMax.exe
  C:\Windows\System\ZhLFMax.exe
  2⤵
  PID:7620
- C:\Windows\System\tLGMLXi.exe
  C:\Windows\System\tLGMLXi.exe
  2⤵
  PID:7636
- C:\Windows\System\EkYLlpO.exe
  C:\Windows\System\EkYLlpO.exe
  2⤵
  PID:7652
- C:\Windows\System\YANhbDW.exe
  C:\Windows\System\YANhbDW.exe
  2⤵
  PID:7676
- C:\Windows\System\CvZLshq.exe
  C:\Windows\System\CvZLshq.exe
  2⤵
  PID:7692
- C:\Windows\System\ckCojbT.exe
  C:\Windows\System\ckCojbT.exe
  2⤵
  PID:7708
- C:\Windows\System\ZtVhDZq.exe
  C:\Windows\System\ZtVhDZq.exe
  2⤵
  PID:7724
- C:\Windows\System\uBhznuo.exe
  C:\Windows\System\uBhznuo.exe
  2⤵
  PID:7740
- C:\Windows\System\VxIXjFs.exe
  C:\Windows\System\VxIXjFs.exe
  2⤵
  PID:7756
- C:\Windows\System\QBplYUg.exe
  C:\Windows\System\QBplYUg.exe
  2⤵
  PID:7772
- C:\Windows\System\huTFGKQ.exe
  C:\Windows\System\huTFGKQ.exe
  2⤵
  PID:7788
- C:\Windows\System\wMHNTNo.exe
  C:\Windows\System\wMHNTNo.exe
  2⤵
  PID:7804
- C:\Windows\System\cqgWigH.exe
  C:\Windows\System\cqgWigH.exe
  2⤵
  PID:7820
- C:\Windows\System\mrqncsy.exe
  C:\Windows\System\mrqncsy.exe
  2⤵
  PID:7836
- C:\Windows\System\lVzviyU.exe
  C:\Windows\System\lVzviyU.exe
  2⤵
  PID:7852
- C:\Windows\System\QUrOBCv.exe
  C:\Windows\System\QUrOBCv.exe
  2⤵
  PID:7868
- C:\Windows\System\owPEMZu.exe
  C:\Windows\System\owPEMZu.exe
  2⤵
  PID:7884
- C:\Windows\System\tlJuWVk.exe
  C:\Windows\System\tlJuWVk.exe
  2⤵
  PID:7900
- C:\Windows\System\Rlxriln.exe
  C:\Windows\System\Rlxriln.exe
  2⤵
  PID:7928
- C:\Windows\System\yOBoWFl.exe
  C:\Windows\System\yOBoWFl.exe
  2⤵
  PID:7944
- C:\Windows\System\HodOwlz.exe
  C:\Windows\System\HodOwlz.exe
  2⤵
  PID:7964
- C:\Windows\System\YaDzNSu.exe
  C:\Windows\System\YaDzNSu.exe
  2⤵
  PID:7980
- C:\Windows\System\OXprsja.exe
  C:\Windows\System\OXprsja.exe
  2⤵
  PID:7996
- C:\Windows\System\MKbEmuv.exe
  C:\Windows\System\MKbEmuv.exe
  2⤵
  PID:8012
- C:\Windows\System\UpuEOXY.exe
  C:\Windows\System\UpuEOXY.exe
  2⤵
  PID:8028
- C:\Windows\System\iKIuKpz.exe
  C:\Windows\System\iKIuKpz.exe
  2⤵
  PID:8044
- C:\Windows\System\atwLdzN.exe
  C:\Windows\System\atwLdzN.exe
  2⤵
  PID:8060
- C:\Windows\System\PIyFoVe.exe
  C:\Windows\System\PIyFoVe.exe
  2⤵
  PID:8076
- C:\Windows\System\mQfXhDI.exe
  C:\Windows\System\mQfXhDI.exe
  2⤵
  PID:8092
- C:\Windows\System\wPYObwD.exe
  C:\Windows\System\wPYObwD.exe
  2⤵
  PID:8108
- C:\Windows\System\OOjdfxN.exe
  C:\Windows\System\OOjdfxN.exe
  2⤵
  PID:8124
- C:\Windows\System\pnyfoXO.exe
  C:\Windows\System\pnyfoXO.exe
  2⤵
  PID:8140
- C:\Windows\System\wJqyJTi.exe
  C:\Windows\System\wJqyJTi.exe
  2⤵
  PID:8156
- C:\Windows\System\pPooRtg.exe
  C:\Windows\System\pPooRtg.exe
  2⤵
  PID:8172
- C:\Windows\System\zYNFMTU.exe
  C:\Windows\System\zYNFMTU.exe
  2⤵
  PID:8188
- C:\Windows\System\Ricamjo.exe
  C:\Windows\System\Ricamjo.exe
  2⤵
  PID:7040
- C:\Windows\System\MjozYVE.exe
  C:\Windows\System\MjozYVE.exe
  2⤵
  PID:7056
- C:\Windows\System\psmebLL.exe
  C:\Windows\System\psmebLL.exe
  2⤵
  PID:6324
- C:\Windows\System\RxTtNvl.exe
  C:\Windows\System\RxTtNvl.exe
  2⤵
  PID:6636
- C:\Windows\System\KGJZAVQ.exe
  C:\Windows\System\KGJZAVQ.exe
  2⤵
  PID:6192
- C:\Windows\System\SrCjnPK.exe
  C:\Windows\System\SrCjnPK.exe
  2⤵
  PID:6704
- C:\Windows\System\KGzAeaS.exe
  C:\Windows\System\KGzAeaS.exe
  2⤵
  PID:6592
- C:\Windows\System\xcHkndO.exe
  C:\Windows\System\xcHkndO.exe
  2⤵
  PID:5204
- C:\Windows\System\CQSttzl.exe
  C:\Windows\System\CQSttzl.exe
  2⤵
  PID:5920
- C:\Windows\System\rpdrEAq.exe
  C:\Windows\System\rpdrEAq.exe
  2⤵
  PID:5868
- C:\Windows\System\LFZeswU.exe
  C:\Windows\System\LFZeswU.exe
  2⤵
  PID:6520
- C:\Windows\System\WXzMAdR.exe
  C:\Windows\System\WXzMAdR.exe
  2⤵
  PID:7200
- C:\Windows\System\vlAtBXt.exe
  C:\Windows\System\vlAtBXt.exe
  2⤵
  PID:7260
- C:\Windows\System\zldcHbB.exe
  C:\Windows\System\zldcHbB.exe
  2⤵
  PID:7280
- C:\Windows\System\zJcxGzb.exe
  C:\Windows\System\zJcxGzb.exe
  2⤵
  PID:7296
- C:\Windows\System\xWSwYZf.exe
  C:\Windows\System\xWSwYZf.exe
  2⤵
  PID:7344
- C:\Windows\System\xiTiong.exe
  C:\Windows\System\xiTiong.exe
  2⤵
  PID:7376
- C:\Windows\System\xvFCddF.exe
  C:\Windows\System\xvFCddF.exe
  2⤵
  PID:7408
- C:\Windows\System\YWfypNj.exe
  C:\Windows\System\YWfypNj.exe
  2⤵
  PID:7468
- C:\Windows\System\tBHwMuA.exe
  C:\Windows\System\tBHwMuA.exe
  2⤵
  PID:7532
- C:\Windows\System\njweetD.exe
  C:\Windows\System\njweetD.exe
  2⤵
  PID:7424
- C:\Windows\System\CfWRIgP.exe
  C:\Windows\System\CfWRIgP.exe
  2⤵
  PID:7488
- C:\Windows\System\djLZech.exe
  C:\Windows\System\djLZech.exe
  2⤵
  PID:7552
- C:\Windows\System\ZOmmCBI.exe
  C:\Windows\System\ZOmmCBI.exe
  2⤵
  PID:7600
- C:\Windows\System\laagktz.exe
  C:\Windows\System\laagktz.exe
  2⤵
  PID:7660
- C:\Windows\System\Gzdvzro.exe
  C:\Windows\System\Gzdvzro.exe
  2⤵
  PID:7700
- C:\Windows\System\hoGicbH.exe
  C:\Windows\System\hoGicbH.exe
  2⤵
  PID:7764
- C:\Windows\System\kXjKvvJ.exe
  C:\Windows\System\kXjKvvJ.exe
  2⤵
  PID:7828
- C:\Windows\System\bDZtszF.exe
  C:\Windows\System\bDZtszF.exe
  2⤵
  PID:7892
- C:\Windows\System\rXNZxmy.exe
  C:\Windows\System\rXNZxmy.exe
  2⤵
  PID:7648
- C:\Windows\System\kODVrVj.exe
  C:\Windows\System\kODVrVj.exe
  2⤵
  PID:7688
- C:\Windows\System\ZIyDBGf.exe
  C:\Windows\System\ZIyDBGf.exe
  2⤵
  PID:7752
- C:\Windows\System\zVBmQAR.exe
  C:\Windows\System\zVBmQAR.exe
  2⤵
  PID:7912
- C:\Windows\System\WCGBpRk.exe
  C:\Windows\System\WCGBpRk.exe
  2⤵
  PID:8004
- C:\Windows\System\jSGueSn.exe
  C:\Windows\System\jSGueSn.exe
  2⤵
  PID:7880
- C:\Windows\System\BuCcKhL.exe
  C:\Windows\System\BuCcKhL.exe
  2⤵
  PID:7952
- C:\Windows\System\ERFNdih.exe
  C:\Windows\System\ERFNdih.exe
  2⤵
  PID:8020
- C:\Windows\System\bsjbCKB.exe
  C:\Windows\System\bsjbCKB.exe
  2⤵
  PID:8040
- C:\Windows\System\FrWHTxR.exe
  C:\Windows\System\FrWHTxR.exe
  2⤵
  PID:8104
- C:\Windows\System\AtWMSDr.exe
  C:\Windows\System\AtWMSDr.exe
  2⤵
  PID:8084
- C:\Windows\System\lJUHsvX.exe
  C:\Windows\System\lJUHsvX.exe
  2⤵
  PID:8116
- C:\Windows\System\MPjdbKi.exe
  C:\Windows\System\MPjdbKi.exe
  2⤵
  PID:6908
- C:\Windows\System\DkkWyVU.exe
  C:\Windows\System\DkkWyVU.exe
  2⤵
  PID:6960
- C:\Windows\System\VRJOeFp.exe
  C:\Windows\System\VRJOeFp.exe
  2⤵
  PID:8152
- C:\Windows\System\xQuMbOB.exe
  C:\Windows\System\xQuMbOB.exe
  2⤵
  PID:6124
- C:\Windows\System\VrNFrbF.exe
  C:\Windows\System\VrNFrbF.exe
  2⤵
  PID:7100
- C:\Windows\System\NRYnRFB.exe
  C:\Windows\System\NRYnRFB.exe
  2⤵
  PID:7216
- C:\Windows\System\ZKTThQf.exe
  C:\Windows\System\ZKTThQf.exe
  2⤵
  PID:7312
- C:\Windows\System\ftkGgRA.exe
  C:\Windows\System\ftkGgRA.exe
  2⤵
  PID:7372
- C:\Windows\System\RMpepXK.exe
  C:\Windows\System\RMpepXK.exe
  2⤵
  PID:7568
- C:\Windows\System\qyCuxOd.exe
  C:\Windows\System\qyCuxOd.exe
  2⤵
  PID:7196
- C:\Windows\System\LNHmAki.exe
  C:\Windows\System\LNHmAki.exe
  2⤵
  PID:7404
- C:\Windows\System\iHySSnP.exe
  C:\Windows\System\iHySSnP.exe
  2⤵
  PID:2784
- C:\Windows\System\dYsVSFW.exe
  C:\Windows\System\dYsVSFW.exe
  2⤵
  PID:7500
- C:\Windows\System\vkWnjOG.exe
  C:\Windows\System\vkWnjOG.exe
  2⤵
  PID:7732
- C:\Windows\System\FmVwbjn.exe
  C:\Windows\System\FmVwbjn.exe
  2⤵
  PID:7684
- C:\Windows\System\DYbBraT.exe
  C:\Windows\System\DYbBraT.exe
  2⤵
  PID:7876
- C:\Windows\System\uiPWmiX.exe
  C:\Windows\System\uiPWmiX.exe
  2⤵
  PID:7668
- C:\Windows\System\LYtpqiq.exe
  C:\Windows\System\LYtpqiq.exe
  2⤵
  PID:7848
- C:\Windows\System\szTZQuz.exe
  C:\Windows\System\szTZQuz.exe
  2⤵
  PID:7340
- C:\Windows\System\uWdCpCE.exe
  C:\Windows\System\uWdCpCE.exe
  2⤵
  PID:7992
- C:\Windows\System\qIBOoYd.exe
  C:\Windows\System\qIBOoYd.exe
  2⤵
  PID:8168
- C:\Windows\System\hiqreMH.exe
  C:\Windows\System\hiqreMH.exe
  2⤵
  PID:7248
- C:\Windows\System\CMhgDeM.exe
  C:\Windows\System\CMhgDeM.exe
  2⤵
  PID:7860
- C:\Windows\System\GpDLKHu.exe
  C:\Windows\System\GpDLKHu.exe
  2⤵
  PID:7616
- C:\Windows\System\GHcmUUq.exe
  C:\Windows\System\GHcmUUq.exe
  2⤵
  PID:7976
- C:\Windows\System\trbHjLK.exe
  C:\Windows\System\trbHjLK.exe
  2⤵
  PID:7360
- C:\Windows\System\xOpKiUk.exe
  C:\Windows\System\xOpKiUk.exe
  2⤵
  PID:8164
- C:\Windows\System\FvzaATH.exe
  C:\Windows\System\FvzaATH.exe
  2⤵
  PID:8204
- C:\Windows\System\ANJtesn.exe
  C:\Windows\System\ANJtesn.exe
  2⤵
  PID:8220
- C:\Windows\System\RdTOYSO.exe
  C:\Windows\System\RdTOYSO.exe
  2⤵
  PID:8320
- C:\Windows\System\CKSoWOt.exe
  C:\Windows\System\CKSoWOt.exe
  2⤵
  PID:8344
- C:\Windows\System\DssigFG.exe
  C:\Windows\System\DssigFG.exe
  2⤵
  PID:8364
- C:\Windows\System\KOEHTqP.exe
  C:\Windows\System\KOEHTqP.exe
  2⤵
  PID:8392
- C:\Windows\System\uoPrmQu.exe
  C:\Windows\System\uoPrmQu.exe
  2⤵
  PID:8408
- C:\Windows\System\csMjnGi.exe
  C:\Windows\System\csMjnGi.exe
  2⤵
  PID:8424
- C:\Windows\System\CwfEjLw.exe
  C:\Windows\System\CwfEjLw.exe
  2⤵
  PID:8440
- C:\Windows\System\diYoUvX.exe
  C:\Windows\System\diYoUvX.exe
  2⤵
  PID:8456
- C:\Windows\System\YJnAjTi.exe
  C:\Windows\System\YJnAjTi.exe
  2⤵
  PID:8696
- C:\Windows\System\OURkIqC.exe
  C:\Windows\System\OURkIqC.exe
  2⤵
  PID:8716
- C:\Windows\System\crwMZWf.exe
  C:\Windows\System\crwMZWf.exe
  2⤵
  PID:8732
- C:\Windows\System\FlHGtCg.exe
  C:\Windows\System\FlHGtCg.exe
  2⤵
  PID:8780
- C:\Windows\System\WfksnXc.exe
  C:\Windows\System\WfksnXc.exe
  2⤵
  PID:8796
- C:\Windows\System\DLixYUa.exe
  C:\Windows\System\DLixYUa.exe
  2⤵
  PID:8812
- C:\Windows\System\BBJUcIB.exe
  C:\Windows\System\BBJUcIB.exe
  2⤵
  PID:8832
- C:\Windows\System\elPzkmW.exe
  C:\Windows\System\elPzkmW.exe
  2⤵
  PID:8848
- C:\Windows\System\dfTWuko.exe
  C:\Windows\System\dfTWuko.exe
  2⤵
  PID:8864
- C:\Windows\System\fCawARW.exe
  C:\Windows\System\fCawARW.exe
  2⤵
  PID:8888
- C:\Windows\System\KBXKAfB.exe
  C:\Windows\System\KBXKAfB.exe
  2⤵
  PID:8904
- C:\Windows\System\fcRQtTd.exe
  C:\Windows\System\fcRQtTd.exe
  2⤵
  PID:8920
- C:\Windows\System\zfqOPpK.exe
  C:\Windows\System\zfqOPpK.exe
  2⤵
  PID:8936
- C:\Windows\System\bOTiefz.exe
  C:\Windows\System\bOTiefz.exe
  2⤵
  PID:8952
- C:\Windows\System\HkAqNyw.exe
  C:\Windows\System\HkAqNyw.exe
  2⤵
  PID:8968
- C:\Windows\System\qzTUGOg.exe
  C:\Windows\System\qzTUGOg.exe
  2⤵
  PID:8984
- C:\Windows\System\IRKTVxb.exe
  C:\Windows\System\IRKTVxb.exe
  2⤵
  PID:9000
- C:\Windows\System\gVHmuHB.exe
  C:\Windows\System\gVHmuHB.exe
  2⤵
  PID:9016
- C:\Windows\System\yCCIoQz.exe
  C:\Windows\System\yCCIoQz.exe
  2⤵
  PID:9032
- C:\Windows\System\qQxkgCu.exe
  C:\Windows\System\qQxkgCu.exe
  2⤵
  PID:9048
- C:\Windows\System\zmxGEUV.exe
  C:\Windows\System\zmxGEUV.exe
  2⤵
  PID:9064
- C:\Windows\System\yTsIQnT.exe
  C:\Windows\System\yTsIQnT.exe
  2⤵
  PID:9080
- C:\Windows\System\cOkqjVP.exe
  C:\Windows\System\cOkqjVP.exe
  2⤵
  PID:9096
- C:\Windows\System\UQOKxzg.exe
  C:\Windows\System\UQOKxzg.exe
  2⤵
  PID:9116
- C:\Windows\System\eJBlwwg.exe
  C:\Windows\System\eJBlwwg.exe
  2⤵
  PID:9132
- C:\Windows\System\IdJKdbW.exe
  C:\Windows\System\IdJKdbW.exe
  2⤵
  PID:9148
- C:\Windows\System\fGaiUiN.exe
  C:\Windows\System\fGaiUiN.exe
  2⤵
  PID:9164
- C:\Windows\System\DnHILJM.exe
  C:\Windows\System\DnHILJM.exe
  2⤵
  PID:9180
- C:\Windows\System\lqhIIVz.exe
  C:\Windows\System\lqhIIVz.exe
  2⤵
  PID:9196
- C:\Windows\System\tkZBEpi.exe
  C:\Windows\System\tkZBEpi.exe
  2⤵
  PID:9212
- C:\Windows\System\nmrNVmF.exe
  C:\Windows\System\nmrNVmF.exe
  2⤵
  PID:7392
- C:\Windows\System\gAaUaUV.exe
  C:\Windows\System\gAaUaUV.exe
  2⤵
  PID:8008
- C:\Windows\System\SBnJrmN.exe
  C:\Windows\System\SBnJrmN.exe
  2⤵
  PID:8216
- C:\Windows\System\YxUjnLH.exe
  C:\Windows\System\YxUjnLH.exe
  2⤵
  PID:7920
- C:\Windows\System\soDkEWv.exe
  C:\Windows\System\soDkEWv.exe
  2⤵
  PID:7956
- C:\Windows\System\TUeWpyd.exe
  C:\Windows\System\TUeWpyd.exe
  2⤵
  PID:8256
- C:\Windows\System\mcpiWiY.exe
  C:\Windows\System\mcpiWiY.exe
  2⤵
  PID:8276
- C:\Windows\System\FOPeNXO.exe
  C:\Windows\System\FOPeNXO.exe
  2⤵
  PID:8292
- C:\Windows\System\FyJnisb.exe
  C:\Windows\System\FyJnisb.exe
  2⤵
  PID:8308
- C:\Windows\System\gulfSPe.exe
  C:\Windows\System\gulfSPe.exe
  2⤵
  PID:8360
- C:\Windows\System\JJwQXls.exe
  C:\Windows\System\JJwQXls.exe
  2⤵
  PID:8228
- C:\Windows\System\zxtXxOp.exe
  C:\Windows\System\zxtXxOp.exe
  2⤵
  PID:8248
- C:\Windows\System\wPsqkgu.exe
  C:\Windows\System\wPsqkgu.exe
  2⤵
  PID:8404
- C:\Windows\System\zXIdSTR.exe
  C:\Windows\System\zXIdSTR.exe
  2⤵
  PID:8464
- C:\Windows\System\AmBSoXa.exe
  C:\Windows\System\AmBSoXa.exe
  2⤵
  PID:8332
- C:\Windows\System\SAZxLIV.exe
  C:\Windows\System\SAZxLIV.exe
  2⤵
  PID:8380
- C:\Windows\System\BeYZeNg.exe
  C:\Windows\System\BeYZeNg.exe
  2⤵
  PID:8420
- C:\Windows\System\rVIgXSV.exe
  C:\Windows\System\rVIgXSV.exe
  2⤵
  PID:8500
- C:\Windows\System\UZdzpEZ.exe
  C:\Windows\System\UZdzpEZ.exe
  2⤵
  PID:8516
- C:\Windows\System\SWEmKRY.exe
  C:\Windows\System\SWEmKRY.exe
  2⤵
  PID:8532
- C:\Windows\System\XYDNlFX.exe
  C:\Windows\System\XYDNlFX.exe
  2⤵
  PID:8548
- C:\Windows\System\gzFVmjr.exe
  C:\Windows\System\gzFVmjr.exe
  2⤵
  PID:8472
- C:\Windows\System\iokPIXD.exe
  C:\Windows\System\iokPIXD.exe
  2⤵
  PID:8584
- C:\Windows\System\aTUIZal.exe
  C:\Windows\System\aTUIZal.exe
  2⤵
  PID:8600
- C:\Windows\System\ixfNkwc.exe
  C:\Windows\System\ixfNkwc.exe
  2⤵
  PID:8616
- C:\Windows\System\ghHNecm.exe
  C:\Windows\System\ghHNecm.exe
  2⤵
  PID:8488
- C:\Windows\System\plcogPa.exe
  C:\Windows\System\plcogPa.exe
  2⤵
  PID:8628
- C:\Windows\System\aRREGOR.exe
  C:\Windows\System\aRREGOR.exe
  2⤵
  PID:8640
- C:\Windows\System\BtXDERR.exe
  C:\Windows\System\BtXDERR.exe
  2⤵
  PID:8656
- C:\Windows\System\qugBMrS.exe
  C:\Windows\System\qugBMrS.exe
  2⤵
  PID:8672
- C:\Windows\System\YdAOQYV.exe
  C:\Windows\System\YdAOQYV.exe
  2⤵
  PID:8684
- C:\Windows\System\OcXTsFy.exe
  C:\Windows\System\OcXTsFy.exe
  2⤵
  PID:8728
- C:\Windows\System\gBMapbV.exe
  C:\Windows\System\gBMapbV.exe
  2⤵
  PID:8824
- C:\Windows\System\BAnjdSR.exe
  C:\Windows\System\BAnjdSR.exe
  2⤵
  PID:8896
- C:\Windows\System\kdQNBRv.exe
  C:\Windows\System\kdQNBRv.exe
  2⤵
  PID:8708
- C:\Windows\System\avYTZbN.exe
  C:\Windows\System\avYTZbN.exe
  2⤵
  PID:8756
- C:\Windows\System\zAuvAOZ.exe
  C:\Windows\System\zAuvAOZ.exe
  2⤵
  PID:8808
- C:\Windows\System\yvKDgka.exe
  C:\Windows\System\yvKDgka.exe
  2⤵
  PID:8840
- C:\Windows\System\IRVMWte.exe
  C:\Windows\System\IRVMWte.exe
  2⤵
  PID:8880
- C:\Windows\System\dsivmYD.exe
  C:\Windows\System\dsivmYD.exe
  2⤵
  PID:8752
- C:\Windows\System\qpCILno.exe
  C:\Windows\System\qpCILno.exe
  2⤵
  PID:8948
- C:\Windows\System\kFIzVnm.exe
  C:\Windows\System\kFIzVnm.exe
  2⤵
  PID:9024
- C:\Windows\System\kzpYdSG.exe
  C:\Windows\System\kzpYdSG.exe
  2⤵
  PID:9028
- C:\Windows\System\TQtFuYd.exe
  C:\Windows\System\TQtFuYd.exe
  2⤵
  PID:9092
- C:\Windows\System\WpNJaSL.exe
  C:\Windows\System\WpNJaSL.exe
  2⤵
  PID:9076
- C:\Windows\System\DdjFlEM.exe
  C:\Windows\System\DdjFlEM.exe
  2⤵
  PID:9128
- C:\Windows\System\LROViRX.exe
  C:\Windows\System\LROViRX.exe
  2⤵
  PID:9192
- C:\Windows\System\XlfvEgE.exe
  C:\Windows\System\XlfvEgE.exe
  2⤵
  PID:6652
- C:\Windows\System\JniGaAA.exe
  C:\Windows\System\JniGaAA.exe
  2⤵
  PID:8268
- C:\Windows\System\ohDVXVL.exe
  C:\Windows\System\ohDVXVL.exe
  2⤵
  PID:5160
- C:\Windows\System\Tgephmf.exe
  C:\Windows\System\Tgephmf.exe
  2⤵
  PID:8340
- C:\Windows\System\uvoDSHd.exe
  C:\Windows\System\uvoDSHd.exe
  2⤵
  PID:8508
- C:\Windows\System\ZehKVks.exe
  C:\Windows\System\ZehKVks.exe
  2⤵
  PID:8544
- C:\Windows\System\eJxwqwb.exe
  C:\Windows\System\eJxwqwb.exe
  2⤵
  PID:8608
- C:\Windows\System\GEHZDRH.exe
  C:\Windows\System\GEHZDRH.exe
  2⤵
  PID:9172
- C:\Windows\System\OrgAYim.exe
  C:\Windows\System\OrgAYim.exe
  2⤵
  PID:5652
- C:\Windows\System\SBeZtzC.exe
  C:\Windows\System\SBeZtzC.exe
  2⤵
  PID:8680
- C:\Windows\System\LzrwMHj.exe
  C:\Windows\System\LzrwMHj.exe
  2⤵
  PID:8436
- C:\Windows\System\AyksDIn.exe
  C:\Windows\System\AyksDIn.exe
  2⤵
  PID:8492
- C:\Windows\System\fHfykHO.exe
  C:\Windows\System\fHfykHO.exe
  2⤵
  PID:7816
- C:\Windows\System\VKxdtzO.exe
  C:\Windows\System\VKxdtzO.exe
  2⤵
  PID:8284
- C:\Windows\System\nnkrJeq.exe
  C:\Windows\System\nnkrJeq.exe
  2⤵
  PID:8596
- C:\Windows\System\iampKxT.exe
  C:\Windows\System\iampKxT.exe
  2⤵
  PID:8448
- C:\Windows\System\MqedIuW.exe
  C:\Windows\System\MqedIuW.exe
  2⤵
  PID:8592
- C:\Windows\System\sGskPpO.exe
  C:\Windows\System\sGskPpO.exe
  2⤵
  PID:8636
- C:\Windows\System\ZTWhxJL.exe
  C:\Windows\System\ZTWhxJL.exe
  2⤵
  PID:8668
- C:\Windows\System\DJQEGsQ.exe
  C:\Windows\System\DJQEGsQ.exe
  2⤵
  PID:8872
- C:\Windows\System\JBAVudR.exe
  C:\Windows\System\JBAVudR.exe
  2⤵
  PID:9008
- C:\Windows\System\RKQnWWJ.exe
  C:\Windows\System\RKQnWWJ.exe
  2⤵
  PID:9160
- C:\Windows\System\tDcfXTm.exe
  C:\Windows\System\tDcfXTm.exe
  2⤵
  PID:8964
- C:\Windows\System\ATXuDxl.exe
  C:\Windows\System\ATXuDxl.exe
  2⤵
  PID:8744
- C:\Windows\System\SkXysQp.exe
  C:\Windows\System\SkXysQp.exe
  2⤵
  PID:8976
- C:\Windows\System\fvjjeVI.exe
  C:\Windows\System\fvjjeVI.exe
  2⤵
  PID:9124
- C:\Windows\System\FcFFHIe.exe
  C:\Windows\System\FcFFHIe.exe
  2⤵
  PID:8512
- C:\Windows\System\GzoScOm.exe
  C:\Windows\System\GzoScOm.exe
  2⤵
  PID:9144
- C:\Windows\System\qakVURJ.exe
  C:\Windows\System\qakVURJ.exe
  2⤵
  PID:8200
- C:\Windows\System\diTArhl.exe
  C:\Windows\System\diTArhl.exe
  2⤵
  PID:8560
- C:\Windows\System\fIKgjCC.exe
  C:\Windows\System\fIKgjCC.exe
  2⤵
  PID:8704
- C:\Windows\System\bacjnIg.exe
  C:\Windows\System\bacjnIg.exe
  2⤵
  PID:8576
- C:\Windows\System\gZdHHQB.exe
  C:\Windows\System\gZdHHQB.exe
  2⤵
  PID:9044
- C:\Windows\System\qkNpLHM.exe
  C:\Windows\System\qkNpLHM.exe
  2⤵
  PID:8792
- C:\Windows\System\uPmAqvX.exe
  C:\Windows\System\uPmAqvX.exe
  2⤵
  PID:8860
- C:\Windows\System\EIZYWba.exe
  C:\Windows\System\EIZYWba.exe
  2⤵
  PID:8556
- C:\Windows\System\YFSfYHu.exe
  C:\Windows\System\YFSfYHu.exe
  2⤵
  PID:8776
- C:\Windows\System\waMTKNc.exe
  C:\Windows\System\waMTKNc.exe
  2⤵
  PID:9088
- C:\Windows\System\PbHpTxg.exe
  C:\Windows\System\PbHpTxg.exe
  2⤵
  PID:8264
- C:\Windows\System\mjQJJOs.exe
  C:\Windows\System\mjQJJOs.exe
  2⤵
  PID:8376
- C:\Windows\System\zvYrlmu.exe
  C:\Windows\System\zvYrlmu.exe
  2⤵
  PID:8416
- C:\Windows\System\tFDIkIu.exe
  C:\Windows\System\tFDIkIu.exe
  2⤵
  PID:8528
- C:\Windows\System\FaEEpoq.exe
  C:\Windows\System\FaEEpoq.exe
  2⤵
  PID:8300
- C:\Windows\System\MsOLqSw.exe
  C:\Windows\System\MsOLqSw.exe
  2⤵
  PID:9220
- C:\Windows\System\IaOJtWS.exe
  C:\Windows\System\IaOJtWS.exe
  2⤵
  PID:9236
- C:\Windows\System\HMDMLTA.exe
  C:\Windows\System\HMDMLTA.exe
  2⤵
  PID:9252
- C:\Windows\System\VZyXfoF.exe
  C:\Windows\System\VZyXfoF.exe
  2⤵
  PID:9268
- C:\Windows\System\jgQkyMe.exe
  C:\Windows\System\jgQkyMe.exe
  2⤵
  PID:9288
- C:\Windows\System\UxOfYhp.exe
  C:\Windows\System\UxOfYhp.exe
  2⤵
  PID:9304
- C:\Windows\System\LcYiPWW.exe
  C:\Windows\System\LcYiPWW.exe
  2⤵
  PID:9320
- C:\Windows\System\EbpwLlJ.exe
  C:\Windows\System\EbpwLlJ.exe
  2⤵
  PID:9336
- C:\Windows\System\RshyqYA.exe
  C:\Windows\System\RshyqYA.exe
  2⤵
  PID:9352
- C:\Windows\System\cAtgqnN.exe
  C:\Windows\System\cAtgqnN.exe
  2⤵
  PID:9368
- C:\Windows\System\mwNqJgK.exe
  C:\Windows\System\mwNqJgK.exe
  2⤵
  PID:9384
- C:\Windows\System\OcXUtwD.exe
  C:\Windows\System\OcXUtwD.exe
  2⤵
  PID:9400
- C:\Windows\System\HNAzUaa.exe
  C:\Windows\System\HNAzUaa.exe
  2⤵
  PID:9416
- C:\Windows\System\aFfGSCf.exe
  C:\Windows\System\aFfGSCf.exe
  2⤵
  PID:9432
- C:\Windows\System\saBTZKw.exe
  C:\Windows\System\saBTZKw.exe
  2⤵
  PID:9448
- C:\Windows\System\wDMJBMv.exe
  C:\Windows\System\wDMJBMv.exe
  2⤵
  PID:9464
- C:\Windows\System\fSjyppf.exe
  C:\Windows\System\fSjyppf.exe
  2⤵
  PID:9480
- C:\Windows\System\KvcwBfR.exe
  C:\Windows\System\KvcwBfR.exe
  2⤵
  PID:9496
- C:\Windows\System\TrxtKLf.exe
  C:\Windows\System\TrxtKLf.exe
  2⤵
  PID:9512
- C:\Windows\System\UimbDMH.exe
  C:\Windows\System\UimbDMH.exe
  2⤵
  PID:9532
- C:\Windows\System\FXQPtqJ.exe
  C:\Windows\System\FXQPtqJ.exe
  2⤵
  PID:9548
- C:\Windows\System\LPNUYzE.exe
  C:\Windows\System\LPNUYzE.exe
  2⤵
  PID:9564
- C:\Windows\System\poPIzCZ.exe
  C:\Windows\System\poPIzCZ.exe
  2⤵
  PID:9580
- C:\Windows\System\MXbVcsv.exe
  C:\Windows\System\MXbVcsv.exe
  2⤵
  PID:9596
- C:\Windows\System\jSfQXhu.exe
  C:\Windows\System\jSfQXhu.exe
  2⤵
  PID:9612
- C:\Windows\System\xkXLbTt.exe
  C:\Windows\System\xkXLbTt.exe
  2⤵
  PID:9628
- C:\Windows\System\IOtkVTM.exe
  C:\Windows\System\IOtkVTM.exe
  2⤵
  PID:9644
- C:\Windows\System\GLhVdpa.exe
  C:\Windows\System\GLhVdpa.exe
  2⤵
  PID:9660
- C:\Windows\System\CcRPVer.exe
  C:\Windows\System\CcRPVer.exe
  2⤵
  PID:9676
- C:\Windows\System\HPstKDg.exe
  C:\Windows\System\HPstKDg.exe
  2⤵
  PID:9692
- C:\Windows\System\fODnIOS.exe
  C:\Windows\System\fODnIOS.exe
  2⤵
  PID:9708
- C:\Windows\System\oaMUgDD.exe
  C:\Windows\System\oaMUgDD.exe
  2⤵
  PID:9724
- C:\Windows\System\FnlbcKJ.exe
  C:\Windows\System\FnlbcKJ.exe
  2⤵
  PID:9740
- C:\Windows\System\AzdVYbL.exe
  C:\Windows\System\AzdVYbL.exe
  2⤵
  PID:9756
- C:\Windows\System\HNuBpFr.exe
  C:\Windows\System\HNuBpFr.exe
  2⤵
  PID:9772
- C:\Windows\System\OWunxde.exe
  C:\Windows\System\OWunxde.exe
  2⤵
  PID:9788
- C:\Windows\System\IvNAoYQ.exe
  C:\Windows\System\IvNAoYQ.exe
  2⤵
  PID:9804
- C:\Windows\System\NIoabeQ.exe
  C:\Windows\System\NIoabeQ.exe
  2⤵
  PID:9820
- C:\Windows\System\qDkmVdl.exe
  C:\Windows\System\qDkmVdl.exe
  2⤵
  PID:9836
- C:\Windows\System\ZzeGNSB.exe
  C:\Windows\System\ZzeGNSB.exe
  2⤵
  PID:9852
- C:\Windows\System\zEGXghD.exe
  C:\Windows\System\zEGXghD.exe
  2⤵
  PID:9868
- C:\Windows\System\gKTFpLw.exe
  C:\Windows\System\gKTFpLw.exe
  2⤵
  PID:9884
- C:\Windows\System\SAODmnZ.exe
  C:\Windows\System\SAODmnZ.exe
  2⤵
  PID:9900
- C:\Windows\System\EublvCz.exe
  C:\Windows\System\EublvCz.exe
  2⤵
  PID:9916
- C:\Windows\System\IksczkE.exe
  C:\Windows\System\IksczkE.exe
  2⤵
  PID:9932
- C:\Windows\System\YVZLJmn.exe
  C:\Windows\System\YVZLJmn.exe
  2⤵
  PID:9948
- C:\Windows\System\zRYqvBn.exe
  C:\Windows\System\zRYqvBn.exe
  2⤵
  PID:9964
- C:\Windows\System\xVJBLdw.exe
  C:\Windows\System\xVJBLdw.exe
  2⤵
  PID:9980
- C:\Windows\System\grhRUca.exe
  C:\Windows\System\grhRUca.exe
  2⤵
  PID:9996
- C:\Windows\System\TEaCOAC.exe
  C:\Windows\System\TEaCOAC.exe
  2⤵
  PID:10012
- C:\Windows\System\WprmkiP.exe
  C:\Windows\System\WprmkiP.exe
  2⤵
  PID:10028
- C:\Windows\System\kUKdWOW.exe
  C:\Windows\System\kUKdWOW.exe
  2⤵
  PID:10044
- C:\Windows\System\VQKtWIG.exe
  C:\Windows\System\VQKtWIG.exe
  2⤵
  PID:10064
- C:\Windows\System\SJdkSCR.exe
  C:\Windows\System\SJdkSCR.exe
  2⤵
  PID:10080
- C:\Windows\System\qEWtQJN.exe
  C:\Windows\System\qEWtQJN.exe
  2⤵
  PID:10096
- C:\Windows\System\HLcHpvK.exe
  C:\Windows\System\HLcHpvK.exe
  2⤵
  PID:10112
- C:\Windows\System\sSiuhWa.exe
  C:\Windows\System\sSiuhWa.exe
  2⤵
  PID:10128
- C:\Windows\System\BvnSHVV.exe
  C:\Windows\System\BvnSHVV.exe
  2⤵
  PID:10144
- C:\Windows\System\FwaqsuD.exe
  C:\Windows\System\FwaqsuD.exe
  2⤵
  PID:10160
- C:\Windows\System\ZaDSNcz.exe
  C:\Windows\System\ZaDSNcz.exe
  2⤵
  PID:10176
- C:\Windows\System\bXaOBFC.exe
  C:\Windows\System\bXaOBFC.exe
  2⤵
  PID:10192
- C:\Windows\System\UTxqsoi.exe
  C:\Windows\System\UTxqsoi.exe
  2⤵
  PID:10208
- C:\Windows\System\HLGJUkI.exe
  C:\Windows\System\HLGJUkI.exe
  2⤵
  PID:10224
- C:\Windows\System\hpwCVoT.exe
  C:\Windows\System\hpwCVoT.exe
  2⤵
  PID:8356
- C:\Windows\System\UnNjaTV.exe
  C:\Windows\System\UnNjaTV.exe
  2⤵
  PID:9284
- C:\Windows\System\MpHZJNE.exe
  C:\Windows\System\MpHZJNE.exe
  2⤵
  PID:9344
- C:\Windows\System\xAgjMyG.exe
  C:\Windows\System\xAgjMyG.exe
  2⤵
  PID:9376
- C:\Windows\System\FtpdAsz.exe
  C:\Windows\System\FtpdAsz.exe
  2⤵
  PID:9440
- C:\Windows\System\xIfRsjI.exe
  C:\Windows\System\xIfRsjI.exe
  2⤵
  PID:8768
- C:\Windows\System\qlrYVvD.exe
  C:\Windows\System\qlrYVvD.exe
  2⤵
  PID:9508
- C:\Windows\System\JIIaZtx.exe
  C:\Windows\System\JIIaZtx.exe
  2⤵
  PID:8480
- C:\Windows\System\Esmswse.exe
  C:\Windows\System\Esmswse.exe
  2⤵
  PID:9208
- C:\Windows\System\ybQHJCo.exe
  C:\Windows\System\ybQHJCo.exe
  2⤵
  PID:9176
- C:\Windows\System\AveYXvm.exe
  C:\Windows\System\AveYXvm.exe
  2⤵
  PID:9428
- C:\Windows\System\erOqIkb.exe
  C:\Windows\System\erOqIkb.exe
  2⤵
  PID:9300
- C:\Windows\System\PpEiAdP.exe
  C:\Windows\System\PpEiAdP.exe
  2⤵
  PID:9544
- C:\Windows\System\wTbNDvG.exe
  C:\Windows\System\wTbNDvG.exe
  2⤵
  PID:9488
- C:\Windows\System\kKCdhhP.exe
  C:\Windows\System\kKCdhhP.exe
  2⤵
  PID:9572
- C:\Windows\System\ZNgNTQN.exe
  C:\Windows\System\ZNgNTQN.exe
  2⤵
  PID:9592
- C:\Windows\System\vWbTeRl.exe
  C:\Windows\System\vWbTeRl.exe
  2⤵
  PID:9640
- C:\Windows\System\LMbBciL.exe
  C:\Windows\System\LMbBciL.exe
  2⤵
  PID:9704
- C:\Windows\System\KMZCQpu.exe
  C:\Windows\System\KMZCQpu.exe
  2⤵
  PID:9768
- C:\Windows\System\kOlqJKS.exe
  C:\Windows\System\kOlqJKS.exe
  2⤵
  PID:9832
- C:\Windows\System\dSauMhF.exe
  C:\Windows\System\dSauMhF.exe
  2⤵
  PID:9656
- C:\Windows\System\RgSzwCM.exe
  C:\Windows\System\RgSzwCM.exe
  2⤵
  PID:9784
- C:\Windows\System\YVgXWUP.exe
  C:\Windows\System\YVgXWUP.exe
  2⤵
  PID:9684
- C:\Windows\System\UHfFMUb.exe
  C:\Windows\System\UHfFMUb.exe
  2⤵
  PID:9864
- C:\Windows\System\yARHWOg.exe
  C:\Windows\System\yARHWOg.exe
  2⤵
  PID:9928
- C:\Windows\System\LcAMcOP.exe
  C:\Windows\System\LcAMcOP.exe
  2⤵
  PID:9876
- C:\Windows\System\DiihInz.exe
  C:\Windows\System\DiihInz.exe
  2⤵
  PID:10024
- C:\Windows\System\jihTvDT.exe
  C:\Windows\System\jihTvDT.exe
  2⤵
  PID:10092
- C:\Windows\System\PrrZHXp.exe
  C:\Windows\System\PrrZHXp.exe
  2⤵
  PID:10152
- C:\Windows\System\VNxPsLA.exe
  C:\Windows\System\VNxPsLA.exe
  2⤵
  PID:9944
- C:\Windows\System\MaSSmlK.exe
  C:\Windows\System\MaSSmlK.exe
  2⤵
  PID:10008
- C:\Windows\System\xsMXCwI.exe
  C:\Windows\System\xsMXCwI.exe
  2⤵
  PID:10168
- C:\Windows\System\nUIvAzp.exe
  C:\Windows\System\nUIvAzp.exe
  2⤵
  PID:10076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BcpjCwT.exe

Filesize
1.9MB

MD5
cbff83d19a9d2f36fa8e326295272932

SHA1
5b5e9aa721888758f8660482953346d45b854321

SHA256
7749b67efe0cfa3622cbcf85bc9df2b7488eb6f62aae99e2902502c7c2a592ab

SHA512
7281dec543e3fecf7bb60aa6a1c958afb5e3746c1500e26cb45c8aca76ca3874a430f6ac0cc6f1547c2878ddf1035497db43f6d298dd1cedc8846280804afab4

Download Submit
C:\Windows\system\DebcFPF.exe

Filesize
1.9MB

MD5
23b7144afbb4c05831aa2b874d70a7e8

SHA1
6e766007a6c43993c896339c975b0f14c59f6d1c

SHA256
b9f456d102fdfb36c93b7739a9fe18484c9d82166f7899dde7659465285a4a1e

SHA512
3130e427255d519676f28a72dca2284a9cb54e686350edb1a5071559eb0fe7a158ee02281193fbb6fe2a66894b850f3d680e9a35f35ee9e829fecf08d53d64e0

Download Submit
C:\Windows\system\EgBhmwW.exe

Filesize
1.8MB

MD5
726996fbc6886a907e98e4774ffb12fa

SHA1
001101e1e85bbabce8af8e72b7c24c6430c85e3a

SHA256
ad69c484d70c1855e0e1327fba75376295a57750355d1f398ef527fb9e129876

SHA512
0060e8a7cfbecd293235f093cb6d7d6ad508dacd8e7db3de9b1c646b838456a77129beec5845a4f06cc939b1e4074d07e273f40da3ff6b3695067220c2c6ba29

Download Submit
C:\Windows\system\EtxtnPw.exe

Filesize
8B

MD5
0a4d9fd0cc8fe1472d155d5d981ff235

SHA1
137003f778b74f1b96494293112b43e4307e765e

SHA256
4707e767d70e4899759ce8aba6535007a27f8c132e3f3e05b8b8ae03c23dd080

SHA512
ad9c5b802b25d2a28cbec3d4cc246b638fad901bd44704bb559f8a0cf5c0d25f339a2e2fe9f4b8bbba249477fc11b0b14c51d97cfa76d081fb255f90811dd5c7

Download Submit
C:\Windows\system\GzFILAF.exe

Filesize
1.9MB

MD5
ebda50fde96d37f1a5b47080768e5add

SHA1
2f5c9db1f1f3ade8c1013a2989306f7fab14d0e0

SHA256
0a51476b0d9039c5b80f841a8ba395fe333cdbf781eb5ace17a15c155767487c

SHA512
998835ab417a08d5fa76b3434b3cf4901446a0a4976b73ff1d7f2f07d98fb4fdfcfd88877e07c1c8db0785c3666a2d566c76d593b74e9bc94463b29d9b3bb4f8

Download Submit
C:\Windows\system\HIgmJIr.exe

Filesize
1.9MB

MD5
8f5b086dfe4b2a27f53360f440627439

SHA1
9675efbb4fafd6e4418f782d7cd8a31ccce7cac5

SHA256
4bf46865ad783aa9940ab500f5749cc63ab2977a1337b072d87a4bea07624293

SHA512
c771675c23ff2a2d1f049cb466f34b6698751064637bd68ef23889c02f0c4359e2045da0f2f3a2ecafddb6289677634ef798dcf08b6f7f74ba650d66f5915cb4

Download Submit
C:\Windows\system\IDgghqa.exe

Filesize
1.9MB

MD5
d962f73ed10ea89b2151e4bf091bdf24

SHA1
a11bfb0d929bacb1bd57ed9078b0e0a65d250b22

SHA256
c09177ee29bfff1a7716b6c1e663b329ecf1b202593e9bcb42d5916ba6e1add9

SHA512
d23e2b34607b48894312469007b4bad0698e62cef791e44da47092e3741f199aba3cd1ffa3a9c977e3dc5d3cfdd8316cd8c1d94aa168dda6ddda3dfe4495392f

Download Submit
C:\Windows\system\IWoSpCm.exe

Filesize
1.8MB

MD5
199cc3633ed497cfc7ebc48716bfc994

SHA1
c914bfdd918ae28d92bfdea04aa1f6e3fd51cf69

SHA256
6710b17addb94f9466652d8a8e62c82f07ad65e83f91706080d1c81cc45a3130

SHA512
53ab04c858bc2d54c5d440ece7868e8af4e5293a73805271294ab318c9d8643e2b30c681a3dfbd0135f91e394037e6972389d508d562798e7417ddda7dc1a186

Download Submit
C:\Windows\system\IYUEmhG.exe

Filesize
1.8MB

MD5
e2c3bd5ec68f767d4344e8fdd8202993

SHA1
9115694363b67ffb2f447e47cecdd4760d940558

SHA256
7712566d458a6b5f005a28e1513d88575673d433a35e81ac327c03da5ce019ef

SHA512
816a43862e311a46ce28ef6d9bb0805d9dc913c918ed5096ca48b1289161e00c5862c6dbb79e54f07b7a9e7c2e5d1a87f04ba659d4ee9565d714878fcb301319

Download Submit
C:\Windows\system\KSslvej.exe

Filesize
1.9MB

MD5
43546865b9a86d34ef7856daa838650e

SHA1
3c9aa2ba042f03550f0174d29e2ad5b407f66385

SHA256
ed8e65c0868c4318cd56d81aa037159106e07958fd189fe421fc39fb4916eae1

SHA512
b4d40e382fbd50c9b7bca2366d68133063d6c255ff8b6ed81cb9a2ce786aa7b6e8e552202255117f0e6403d12db03836710040727816d79eb695141a4eb05682

Download Submit
C:\Windows\system\QiMQeIN.exe

Filesize
1.9MB

MD5
bc68d0bd88938b7331a301a16c52d119

SHA1
9f1004b8d093fe01d08c4f8cb49607b0dc30e669

SHA256
7a9e802a84a9cc110d605730589a70fb1142b7a50ffb741985b1dd2388c62c32

SHA512
0bc62a154183c595509e815bf0f735f7782d1aa189bcbefcfcaa76729b114fef0dcce8bcaf53dcf33a6e08d258bb103689c7b3b2588c8010abe9179800938950

Download Submit
C:\Windows\system\UqAgKdd.exe

Filesize
1.9MB

MD5
cd7299b40a069f08dee90176acd6cedb

SHA1
6fc994524fae012b832f7f9eb0178e1ad2f62330

SHA256
a5acc1b7f24d866bdcf521698b62a26e4e6bbd8296391ca541c2257d4ba5e62d

SHA512
a009d158cf613ebd90fcdf34ceced9a3a08cf1c7b4cf0b6f5c8adc59ddd4151d953882a62233f3cb612dc9f35d51c04913772fcb7c79a11fa6a7f74504bcc95d

Download Submit
C:\Windows\system\ViQUdfV.exe

Filesize
1.9MB

MD5
49364d568e9d6a7586523dd9608ccb88

SHA1
0380541518a543acfe17e40a97781550c24858e7

SHA256
8f18904cbea1f59bed7e544822e95b8774815fc46b81cd61c9e59b05f005ff18

SHA512
d7b502adb18e34937eb944db2b137d393510c893ff25f6dc4ee11775daf7c644134f3524e8ffce45e5249e6893511f2903cd67b873e91befc2e2dfa5fa2f82ea

Download Submit
C:\Windows\system\VowJzMi.exe

Filesize
1.8MB

MD5
eea357c3394f2c09e3a07c45fb59d8b4

SHA1
7b3316ea862995b22383bdfa2ae49c1d07d42277

SHA256
4ff41ac00403fa332f9a36bde840552e0f1a24fc0b0314f3161d91e0b456527d

SHA512
676cb24071c54850fd82928594a979798a421b781fd4dba6e78cd36be76e8e6a2b45d0985615f499ae2fe649245b7e652b4508e18790ff49f06f84d5d3037b3e

Download Submit
C:\Windows\system\XduIzpo.exe

Filesize
1.8MB

MD5
f66fb2d39b759d6b5a238f8f3f36f511

SHA1
0d2f71bce7c8edc5aa4c2788b13f31f265381c4a

SHA256
4e87abbcb5c349a61e60bb07712f3ae7419ae986d961a1c757dffae98479399c

SHA512
def7f932f6609f8a06b4313d040056ab2b2ab0320a237f7c7a5d2d06c81fccb8c74e5119c39dff538088a9ddc1c2bf17875a086a6a95ae608075652ab93132bf

Download Submit
C:\Windows\system\ZkEJjtp.exe

Filesize
1.9MB

MD5
c8db3c5cb634ae6b821fa59618421fbe

SHA1
0487ad1a73f1103703e0509e0201ace66a81bc0e

SHA256
ef7a9eea623d4a67155a11211c593535fd96bebc917c546fb9571f0d5db35622

SHA512
b14d198f0846cc4656a557c532394912e797c06179eb9337d6bbe6d936bd997e8496608db2166e94a4857e4ed5a89fbd52d7c2e428a2bbc4326661be7a299303

Download Submit
C:\Windows\system\dMDTJwY.exe

Filesize
1.8MB

MD5
cf5313ede078cade989bee5027f3902c

SHA1
ed8b98f945a10c5448c87f33966cf0a79c21e9b0

SHA256
10ce7a25c7cb485f34809406964aeb2cad340dbf8452152cb3c64dd83cf5a8c1

SHA512
89b1e60db95637366ddb6f73a52e61e85e236dc874914f3ed993be784dd076b33d2c8188652cd49662cd4ec3212a26f8199d712a6fa4bfc4bbd117f90c157aac

Download Submit
C:\Windows\system\dnEauJO.exe

Filesize
1.9MB

MD5
7d3d480b221a752e1c5a0a62b07ac6c5

SHA1
33aff21cef31201e6e9632098f247c0bbfe119c1

SHA256
e857dd4946210dd396a1b07a58ced6cf2a68327575b01d7ee3b887e965ba1320

SHA512
32714627a3602168158662c69c98685e2005756b3c15b5f54a5132911fd9039e728daf2b29e02dee528fa2abd6c67c8d44b5271a409a4cab661e8608e17385bd

Download Submit
C:\Windows\system\dxfkWEJ.exe

Filesize
1.8MB

MD5
accb042972cbd61d6e50194d507529f0

SHA1
1c7282fb20e09b50bc87a3671802c6f0bdeba2f5

SHA256
aa341fa295ee86d31b2424a5cd67449600fad79d11316d4c6b63c6fffac33a04

SHA512
df575945a39bdd2c1ecc02211541483988e620189fbca8b6cdd010d8958490d4eaa8df896094579358c0331fe8b9caf080500c5067bf0af7dbd205f15b28a208

Download Submit
C:\Windows\system\fTWlXHk.exe

Filesize
1.8MB

MD5
1d7b30f4593432ace66e621159ba1aec

SHA1
8a4f697c67d89ec948e4cd9c7e7137ec6a8e39ad

SHA256
a6b93c93337393081e4e7437b4b521cfdb2983534b3bb63d5ebb3a2ff8d1edb1

SHA512
3b6e71a6334cfe6f8b5d3d3b62c9bf177964f4f5368ad6053c7ca8e5f3ca6320de5eb19f741e048cce63ab5f62a3bbf4994873a25e352dab7cf93344a5313dd4

Download Submit
C:\Windows\system\foIlzAx.exe

Filesize
1.9MB

MD5
fdcda3de40538ed35d5cb8d348f7225c

SHA1
bd79d8e82703843891de3128808fad3f80435e4f

SHA256
b3a0b8f5d7831487027bcd70ce517d0873b021aec8c3db8ba645e3d349e534b6

SHA512
f9bef3072477eef01800b196633cadfcb84eb7db7c50f6c8a99ea2cd6eb982f4d88437f8c67c77ce624bff8808f22eebfcdcc194364982b5ec9fed1fe7f5493a

Download Submit
C:\Windows\system\iNfgrkw.exe

Filesize
1.8MB

MD5
c93ce3a63fcb782f5ea38b3fde3b8ef6

SHA1
7695dff3b14e02704219071b90c36cbf339735d7

SHA256
75ad9b4814f80353eb7643d32be838b7a6b5bb174c3d76da9d06c369fb524af1

SHA512
a52ac71318cbf2eec3c1d8ee96b8d879b81b1ced133597f509a3c36328154823f938a3fe38476b0369b32a1a91172a92fc0fe0a8c85c7afdfd98ddeea7f289de

Download Submit
C:\Windows\system\ofhSdvE.exe

Filesize
1.8MB

MD5
518ca4d03af2e3bf9819a51ade547d9c

SHA1
af9766d2e4eff135cb3a2886d2804e11c2b9d46b

SHA256
c23279d2151c56126d12a1acf2fe6aef4b7f7ea4dff54e249aa3b24bcc5b6a4b

SHA512
aff368cc4e2cb222fb7859c994670f500edbfe6e71d0791e9ac5f12794ed6cd6d2d10a3396348c93965fabe8f8b0648a42127d61c3245e5c2f69856d09b68cfe

Download Submit
C:\Windows\system\svOuujm.exe

Filesize
1.8MB

MD5
79af4c18e45c17785c4b6467f0618e92

SHA1
ea22c12056b024636208ddb509f097b8ebe7e32f

SHA256
aa347dac8719796c12665d527533cc1148db75a630a363ef399e44028c0de826

SHA512
95ac766dc6c662f9b44d890d5094bf28bd41a59a3638de792a767d1e8c8ee71f67fb2b95c1bd0c02885a88afb342a2dd8fa41bb16080c92d9b51e5819e69debb

Download Submit
C:\Windows\system\xmcIQqV.exe

Filesize
1.9MB

MD5
48659d4eaf48c514b32accbd2c67defd

SHA1
695624c83e99ea9b6d347b0c722b59bca7a31511

SHA256
62f457905b20f406b22732632c053526817ba89c4f2ab5a2b9dc674d4fe336b9

SHA512
f23bc7117f5662d26288b6af99a3246ff793e20595f6cb33d1ccd19a83c6953c6db975c7f190c13c49748cf5b0f5ddfd6d38ee93bc8205ad656a07c2b4af0fa4

Download Submit
C:\Windows\system\xoPWRKN.exe

Filesize
1.9MB

MD5
78bba8517f61e7a3565f62ff98d07825

SHA1
4aa97c44e6544e084a7bc678debc0ef37519539f

SHA256
b4d8445d1836a0af034124e3b41805227067590326b38daf4bce68d0f1947545

SHA512
aa274207b6bb9d44b56aefe20bfc5b3a35b5ac1da105fc6257f65111506fca1261dea2993528d5dcc6f34b55c4358262d5b93a31716c796b03d44bf336105e64

Download Submit
C:\Windows\system\yCUYVri.exe

Filesize
1.9MB

MD5
41d113397b0256295e7a503a1aeee7ba

SHA1
6db5b9bf573423cb0f9415499fa4231d23c52f34

SHA256
cc610d0bfc158a9299a60eb3babbd0caaa01560bdff14588c7f2e3b88a7727bc

SHA512
c71f7b28cb515dfff078e2b7f911a30d69dbb66d880cc13d4aaf7299f612ea3df0c370d786c1d6638486da30a219e9ca871bf2a74697a8324d260a021c66e6f7

Download Submit
\Windows\system\YgMmARn.exe

Filesize
1.9MB

MD5
64f0a3eab8fd54eb2297bbf2bc4593d3

SHA1
da83d3ce62792ac86a9e6a66cf8ef7a9f3b416d2

SHA256
c05cf1ae5a6566e2df46983fcd0b6b46e6233f925f2515df754683e1ef552ef7

SHA512
bbfd010b85b395bb68c610c74069bac8bea41ff739b5e2e9de3ce914455f29e374496c6e97d3447c11a0e214ee11bd451bed93c15478c759f00027282a7d2a91

Download Submit
\Windows\system\jPgnpDk.exe

Filesize
1.8MB

MD5
771bd72c33db3f49911b3c3af268824d

SHA1
eea9685dc163b98bf3974b00a6b496c265643626

SHA256
8c1edb8add7489984176e76ead8ed5a5778b3bbea09275a685fd81b1da80dde5

SHA512
b10e6d7ad4ed02b004d45e8d2e437f1e571665e3f7f7d65e140d3239e5374b68dc93ae5f508e18deac8834fb03996288d424dcaf5880112c019a45262e7fcefc

Download Submit
\Windows\system\ssWhFDN.exe

Filesize
1.9MB

MD5
8ed843890adc90f405b2cf24f91d250d

SHA1
afb7642138e62626a5441f5f51d767a7aaa444c7

SHA256
3e7e0ee042c58da4be2c2a92a20151b9213f7524a8975726f4660dd1e35e5ad5

SHA512
378b4d68e13949c203628af33e0dff0c056dcb590b6bf5ae09c176dbdc26f0a4f812f644c1b2f2652bd038a2ac2fa77fa476907f6ca8a55bd4134908d0a12205

Download Submit
\Windows\system\thlkNyS.exe

Filesize
1.8MB

MD5
d5b06629f28c9c65408744e0e3485f28

SHA1
c4e3fa300fba0cf627232c281707e2233c4b8cea

SHA256
fffa9a72b88aefc2303aaf7ff849b0a1e98cd95aac7e55a4d5a136f78658f4ef

SHA512
c1d8e793da3e34ff0110335b70f9a4543bea1b371f6761a4ade664b3ca31b11f6a76f03c9c3d46233ba16159c905d67f99de4a331cc0bdee8481a0e0bb90cb02

Download Submit
\Windows\system\vCWYLOu.exe

Filesize
1.9MB

MD5
3fe9c03ef949a7f6237a14f5d2dc99de

SHA1
9a73a625e17f8a03f899fa24df2dc521441248fc

SHA256
8a18bfe7a6c39d20f3febcc09432596a947da3e194d37317292a178260a7e7e5

SHA512
19f6e295b27c04bdcaacea13d4c1a10146a3415f6e0aac9bc53b7f8870d32fbc839e2ffbd493438a3eacbb23a9a2c09e5dd4a3f74d11052673f12cecc7f840a8

Download Submit
\Windows\system\vnpxyLH.exe

Filesize
1.9MB

MD5
9241f12f7c204d4f8e5162278920d0b7

SHA1
a973603047abb7ed2f0c375ada1543f28b58dc51

SHA256
1ca8cc88c8336a0be680580abd7f89b10e74dbe540ab0f62291f15846e5fed5a

SHA512
cefbe0302f93af48a43e407046758684dcb5f93213a96fa445dc0d7376e682d6d424f4f1e79f9d88ea7547716a48ec4bba83fd8b06eb64de057c60dff57b2fa4

Download Submit
memory/1680-175-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1680-177-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1680-7-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1680-1-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1680-36-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1680-31-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1680-183-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/1680-13-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1680-181-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1680-172-0x0000000003050000-0x0000000003442000-memory.dmp

Filesize
3.9MB

Download
memory/1680-179-0x0000000003460000-0x0000000003852000-memory.dmp

Filesize
3.9MB

Download
memory/1680-0-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/1884-148-0x000000001B7C0000-0x000000001BAA2000-memory.dmp

Filesize
2.9MB

Download
memory/1884-173-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/1884-170-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1884-460-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1884-182-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Filesize
9.6MB

Download
memory/1884-39-0x0000000002970000-0x00000000029F0000-memory.dmp

Filesize
512KB

Download
memory/1884-149-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2416-171-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-174-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2488-176-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2648-16-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-184-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-180-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2880-185-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2884-178-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/2904-9-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download