xmrig | db0c74fbc19c487a5e3b3c0df08d36e5f3d3c262ddd828d4671fcb14aed335ce

Analysis

max time kernel
25s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
Size

1.8MB
MD5

017953679d5dc3716b0bfe4b2577a9a4
SHA1

6650fd71039fc7beef5e8e0bb9db2163ff8ce88e
SHA256

db0c74fbc19c487a5e3b3c0df08d36e5f3d3c262ddd828d4671fcb14aed335ce
SHA512

b8b9aa5274a079ebe8cfb8fad5513267a17d359e12860b8790ada054d8536f1ef57f7f6f60ec62ce05fdb194400c171ea377189c79e2c36c892c997b9a8815a0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrI5A:NAB6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2452-99-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2520-98-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/2468-115-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2448-113-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2652-60-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2668-53-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2976	pxaykJc.exe
2668	EmPyfvF.exe
2652	EWHGrdP.exe
2520	SishOEB.exe
2452	VaGyQBc.exe
2448	ouGfvuw.exe
2468	eDSLazi.exe
1040	WOSdWHB.exe
2308	IkAZAEk.exe
640	MQjOmtY.exe
1572	nUQSrQM.exe
1624	mXsDZBc.exe
2420	ZmPWZFf.exe
1724	ZWkWgzv.exe
2828	NYQaAth.exe
1860	bcgEMrd.exe
1456	oDfoxGq.exe
1568	nBWnEuf.exe
1460	bLUFcFF.exe
2172	TvsyyMy.exe
1240	jzmMrKz.exe
2908	uuDsQBT.exe
2140	dPoCRhk.exe
1852	XrWBWvU.exe
604	hchlvTC.exe
296	ZdZPWrG.exe
2760	bEDwgHD.exe
2388	pPLAznp.exe
2876	xDsKLpx.exe
1100	LWbKhvJ.exe
3008	bFMBMXJ.exe
1472	HhjtTLE.exe
2328	GxPgcqh.exe
1804	cpOvEeH.exe
2724	KKWqsEb.exe
948	BXcqtIN.exe
2104	fwFmiEy.exe
2088	JbJvADo.exe
2756	tcpavIJ.exe
2288	dCRKomc.exe
1440	cDQFbwi.exe
2248	pZxmNXg.exe
2880	ruzDUHv.exe
1964	CKYviZd.exe
2740	TSHTbMn.exe
1700	BblloEa.exe
1928	OQBqDlK.exe
2508	zyJlnDC.exe
3056	LzvUQiB.exe
2400	wpHZqso.exe
2128	rShTqmO.exe
484	QyPPDTg.exe
648	QnJdyax.exe
1776	ZRNUfSj.exe
1012	qODSmPL.exe
716	agZmUav.exe
1924	MgQnHdT.exe
1068	zyJXGDi.exe
1616	qiOGGvN.exe
1284	EUguNYF.exe
2076	zfYzJFW.exe
1444	EuvlaNR.exe
672	pteSTFI.exe
1248	GCPhXSS.exe

Loads dropped DLL 64 IoCs

pid	Process
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2848-0-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x000b0000000144e8-3.dat	upx
behavioral1/files/0x0035000000014712-12.dat	upx
behavioral1/files/0x0008000000014b18-19.dat	upx
behavioral1/files/0x0006000000015d4e-55.dat	upx
behavioral1/files/0x0006000000015d87-74.dat	upx
behavioral1/files/0x0007000000014bbc-100.dat	upx
behavioral1/memory/2452-99-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x000900000001535e-102.dat	upx
behavioral1/memory/2520-98-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/files/0x000600000001621e-134.dat	upx
behavioral1/files/0x0006000000015fe5-125.dat	upx
behavioral1/files/0x0006000000015d56-106.dat	upx
behavioral1/files/0x0006000000015d42-105.dat	upx
behavioral1/files/0x0006000000016adc-156.dat	upx
behavioral1/files/0x0006000000016c5e-163.dat	upx
behavioral1/files/0x0006000000016cb0-170.dat	upx
behavioral1/files/0x000600000001610f-129.dat	upx
behavioral1/files/0x000600000001630a-137.dat	upx
behavioral1/files/0x0006000000016c44-158.dat	upx
behavioral1/files/0x0006000000016d18-179.dat	upx
behavioral1/files/0x0006000000016cdc-172.dat	upx
behavioral1/files/0x0006000000016c64-165.dat	upx
behavioral1/files/0x0006000000016851-151.dat	upx
behavioral1/files/0x000600000001658a-144.dat	upx
behavioral1/files/0x0006000000015f65-116.dat	upx
behavioral1/memory/2468-115-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/files/0x0006000000015e32-114.dat	upx
behavioral1/memory/2448-113-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x0006000000015d6b-107.dat	upx
behavioral1/files/0x0006000000016d07-177.dat	upx
behavioral1/files/0x0006000000016616-149.dat	upx
behavioral1/files/0x00060000000164aa-142.dat	upx
behavioral1/files/0x0006000000015ecc-97.dat	upx
behavioral1/files/0x0006000000015d93-96.dat	upx
behavioral1/files/0x0006000000015d7f-95.dat	upx
behavioral1/files/0x0006000000015d5f-94.dat	upx
behavioral1/memory/2652-60-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0008000000015cff-59.dat	upx
behavioral1/files/0x0007000000014e71-58.dat	upx
behavioral1/memory/2668-53-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0007000000014b4c-28.dat	upx
behavioral1/memory/2976-16-0x000000013FA70000-0x000000013FE62000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\VNwlQKB.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\WcADWWI.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\LXNWOdO.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\zFbHdFU.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\LfYNwIi.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\iQmZvMX.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\brQCJXH.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\iXksouc.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\JouqYdl.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\wCBEEOs.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\LKojGWU.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\HzZuAGd.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\cXyVAUk.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\JhmUNxc.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\tSRlsOB.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\muuCdgx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\OoIIhGc.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ywHPLUI.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\mPULwWt.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\fLGWNZZ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\kKKNRNQ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TzyPQVV.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\KrMbdxE.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TkMmXYf.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\XibfUYM.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\zPBExdQ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\clyEXTj.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\RSszxzQ.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\GdoaMNX.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\UZEtPPz.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\zyJXGDi.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\pvCcYZA.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\yivUiVw.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\EUqsCTj.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\QTcrFNa.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\Tixiorm.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ruEAXZE.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\TqgKVxI.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\HxbhxsL.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\MQjOmtY.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\WWEURAv.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\axIJCAb.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\mpWWcKH.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ZsIVYzc.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\avkaMbX.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\shiDjKA.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\cYzNtsm.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\epuzCGy.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\nAkMeJT.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\HLqOPxx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\kMaEaYj.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\dUenyUc.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\YBiyrTC.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\axAlxQh.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\OmgTFvH.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\wfUjLHR.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\sbeEOjA.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\lmGxGgx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\HEXNiXD.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\vwHCpVd.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\sLbzbHB.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\ADoBYHr.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\yWWWgyx.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
File created	C:\Windows\System\zrJMBfF.exe	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
Token: SeDebugPrivilege	2512	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2512	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	29
PID 2848 wrote to memory of 2512	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	29
PID 2848 wrote to memory of 2512	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	29
PID 2848 wrote to memory of 2976	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2976	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2976	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	30
PID 2848 wrote to memory of 2652	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2652	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2652	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	31
PID 2848 wrote to memory of 2668	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2668	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2668	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	32
PID 2848 wrote to memory of 2452	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	33
PID 2848 wrote to memory of 2452	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	33
PID 2848 wrote to memory of 2452	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	33
PID 2848 wrote to memory of 2520	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	34
PID 2848 wrote to memory of 2520	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	34
PID 2848 wrote to memory of 2520	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	34
PID 2848 wrote to memory of 2420	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	35
PID 2848 wrote to memory of 2420	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	35
PID 2848 wrote to memory of 2420	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	35
PID 2848 wrote to memory of 2448	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	36
PID 2848 wrote to memory of 2448	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	36
PID 2848 wrote to memory of 2448	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	36
PID 2848 wrote to memory of 1724	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	37
PID 2848 wrote to memory of 1724	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	37
PID 2848 wrote to memory of 1724	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	37
PID 2848 wrote to memory of 2468	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	38
PID 2848 wrote to memory of 2468	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	38
PID 2848 wrote to memory of 2468	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	38
PID 2848 wrote to memory of 2828	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	39
PID 2848 wrote to memory of 2828	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	39
PID 2848 wrote to memory of 2828	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	39
PID 2848 wrote to memory of 1040	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	40
PID 2848 wrote to memory of 1040	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	40
PID 2848 wrote to memory of 1040	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	40
PID 2848 wrote to memory of 1860	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	41
PID 2848 wrote to memory of 1860	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	41
PID 2848 wrote to memory of 1860	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	41
PID 2848 wrote to memory of 2308	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	42
PID 2848 wrote to memory of 2308	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	42
PID 2848 wrote to memory of 2308	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	42
PID 2848 wrote to memory of 1456	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	43
PID 2848 wrote to memory of 1456	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	43
PID 2848 wrote to memory of 1456	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	43
PID 2848 wrote to memory of 640	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	44
PID 2848 wrote to memory of 640	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	44
PID 2848 wrote to memory of 640	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	44
PID 2848 wrote to memory of 1568	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	45
PID 2848 wrote to memory of 1568	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	45
PID 2848 wrote to memory of 1568	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	45
PID 2848 wrote to memory of 1572	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	46
PID 2848 wrote to memory of 1572	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	46
PID 2848 wrote to memory of 1572	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	46
PID 2848 wrote to memory of 1460	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	47
PID 2848 wrote to memory of 1460	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	47
PID 2848 wrote to memory of 1460	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	47
PID 2848 wrote to memory of 1624	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	48
PID 2848 wrote to memory of 1624	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	48
PID 2848 wrote to memory of 1624	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	48
PID 2848 wrote to memory of 2172	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	49
PID 2848 wrote to memory of 2172	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	49
PID 2848 wrote to memory of 2172	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	49
PID 2848 wrote to memory of 1240	2848	017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\017953679d5dc3716b0bfe4b2577a9a4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2512
- C:\Windows\System\pxaykJc.exe
  C:\Windows\System\pxaykJc.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\EWHGrdP.exe
  C:\Windows\System\EWHGrdP.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\EmPyfvF.exe
  C:\Windows\System\EmPyfvF.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\VaGyQBc.exe
  C:\Windows\System\VaGyQBc.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\SishOEB.exe
  C:\Windows\System\SishOEB.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\ZmPWZFf.exe
  C:\Windows\System\ZmPWZFf.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\ouGfvuw.exe
  C:\Windows\System\ouGfvuw.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\ZWkWgzv.exe
  C:\Windows\System\ZWkWgzv.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\eDSLazi.exe
  C:\Windows\System\eDSLazi.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\NYQaAth.exe
  C:\Windows\System\NYQaAth.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\WOSdWHB.exe
  C:\Windows\System\WOSdWHB.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\bcgEMrd.exe
  C:\Windows\System\bcgEMrd.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\IkAZAEk.exe
  C:\Windows\System\IkAZAEk.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\oDfoxGq.exe
  C:\Windows\System\oDfoxGq.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\MQjOmtY.exe
  C:\Windows\System\MQjOmtY.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\nBWnEuf.exe
  C:\Windows\System\nBWnEuf.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\nUQSrQM.exe
  C:\Windows\System\nUQSrQM.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\bLUFcFF.exe
  C:\Windows\System\bLUFcFF.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\mXsDZBc.exe
  C:\Windows\System\mXsDZBc.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\TvsyyMy.exe
  C:\Windows\System\TvsyyMy.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\jzmMrKz.exe
  C:\Windows\System\jzmMrKz.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\BblloEa.exe
  C:\Windows\System\BblloEa.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\uuDsQBT.exe
  C:\Windows\System\uuDsQBT.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\LzvUQiB.exe
  C:\Windows\System\LzvUQiB.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\dPoCRhk.exe
  C:\Windows\System\dPoCRhk.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\wpHZqso.exe
  C:\Windows\System\wpHZqso.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\XrWBWvU.exe
  C:\Windows\System\XrWBWvU.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\rShTqmO.exe
  C:\Windows\System\rShTqmO.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\hchlvTC.exe
  C:\Windows\System\hchlvTC.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\QyPPDTg.exe
  C:\Windows\System\QyPPDTg.exe
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Windows\System\ZdZPWrG.exe
  C:\Windows\System\ZdZPWrG.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\QnJdyax.exe
  C:\Windows\System\QnJdyax.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\bEDwgHD.exe
  C:\Windows\System\bEDwgHD.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\ZRNUfSj.exe
  C:\Windows\System\ZRNUfSj.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\pPLAznp.exe
  C:\Windows\System\pPLAznp.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\qODSmPL.exe
  C:\Windows\System\qODSmPL.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\xDsKLpx.exe
  C:\Windows\System\xDsKLpx.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\agZmUav.exe
  C:\Windows\System\agZmUav.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\LWbKhvJ.exe
  C:\Windows\System\LWbKhvJ.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\MgQnHdT.exe
  C:\Windows\System\MgQnHdT.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\bFMBMXJ.exe
  C:\Windows\System\bFMBMXJ.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\zyJXGDi.exe
  C:\Windows\System\zyJXGDi.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\HhjtTLE.exe
  C:\Windows\System\HhjtTLE.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\qiOGGvN.exe
  C:\Windows\System\qiOGGvN.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\GxPgcqh.exe
  C:\Windows\System\GxPgcqh.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\EUguNYF.exe
  C:\Windows\System\EUguNYF.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\cpOvEeH.exe
  C:\Windows\System\cpOvEeH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\zfYzJFW.exe
  C:\Windows\System\zfYzJFW.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\KKWqsEb.exe
  C:\Windows\System\KKWqsEb.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\pteSTFI.exe
  C:\Windows\System\pteSTFI.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\BXcqtIN.exe
  C:\Windows\System\BXcqtIN.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\GCPhXSS.exe
  C:\Windows\System\GCPhXSS.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\fwFmiEy.exe
  C:\Windows\System\fwFmiEy.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\vOQwEQi.exe
  C:\Windows\System\vOQwEQi.exe
  2⤵
  PID:2744
- C:\Windows\System\JbJvADo.exe
  C:\Windows\System\JbJvADo.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\HEXNiXD.exe
  C:\Windows\System\HEXNiXD.exe
  2⤵
  PID:788
- C:\Windows\System\tcpavIJ.exe
  C:\Windows\System\tcpavIJ.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\HFzwuVb.exe
  C:\Windows\System\HFzwuVb.exe
  2⤵
  PID:2988
- C:\Windows\System\dCRKomc.exe
  C:\Windows\System\dCRKomc.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\JSzjYSE.exe
  C:\Windows\System\JSzjYSE.exe
  2⤵
  PID:2500
- C:\Windows\System\cDQFbwi.exe
  C:\Windows\System\cDQFbwi.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\tMOdlOc.exe
  C:\Windows\System\tMOdlOc.exe
  2⤵
  PID:896
- C:\Windows\System\pZxmNXg.exe
  C:\Windows\System\pZxmNXg.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\epuzCGy.exe
  C:\Windows\System\epuzCGy.exe
  2⤵
  PID:1036
- C:\Windows\System\ruzDUHv.exe
  C:\Windows\System\ruzDUHv.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\ievLeOe.exe
  C:\Windows\System\ievLeOe.exe
  2⤵
  PID:1536
- C:\Windows\System\CKYviZd.exe
  C:\Windows\System\CKYviZd.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\VffzEHG.exe
  C:\Windows\System\VffzEHG.exe
  2⤵
  PID:2752
- C:\Windows\System\TSHTbMn.exe
  C:\Windows\System\TSHTbMn.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\CnBQPfM.exe
  C:\Windows\System\CnBQPfM.exe
  2⤵
  PID:2544
- C:\Windows\System\OQBqDlK.exe
  C:\Windows\System\OQBqDlK.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\pDWrbLI.exe
  C:\Windows\System\pDWrbLI.exe
  2⤵
  PID:2560
- C:\Windows\System\zyJlnDC.exe
  C:\Windows\System\zyJlnDC.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\rfxMhsT.exe
  C:\Windows\System\rfxMhsT.exe
  2⤵
  PID:1864
- C:\Windows\System\EuvlaNR.exe
  C:\Windows\System\EuvlaNR.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\KxCXUIY.exe
  C:\Windows\System\KxCXUIY.exe
  2⤵
  PID:2524
- C:\Windows\System\QoehIct.exe
  C:\Windows\System\QoehIct.exe
  2⤵
  PID:1228
- C:\Windows\System\HIileeT.exe
  C:\Windows\System\HIileeT.exe
  2⤵
  PID:1972
- C:\Windows\System\XaZToEo.exe
  C:\Windows\System\XaZToEo.exe
  2⤵
  PID:2604
- C:\Windows\System\JBPCSod.exe
  C:\Windows\System\JBPCSod.exe
  2⤵
  PID:1912
- C:\Windows\System\AXFmIhM.exe
  C:\Windows\System\AXFmIhM.exe
  2⤵
  PID:600
- C:\Windows\System\KzKLjyc.exe
  C:\Windows\System\KzKLjyc.exe
  2⤵
  PID:444
- C:\Windows\System\nAkMeJT.exe
  C:\Windows\System\nAkMeJT.exe
  2⤵
  PID:1004
- C:\Windows\System\clHfebs.exe
  C:\Windows\System\clHfebs.exe
  2⤵
  PID:1952
- C:\Windows\System\kOebqSR.exe
  C:\Windows\System\kOebqSR.exe
  2⤵
  PID:1508
- C:\Windows\System\lePiOxJ.exe
  C:\Windows\System\lePiOxJ.exe
  2⤵
  PID:2584
- C:\Windows\System\PoqGiMT.exe
  C:\Windows\System\PoqGiMT.exe
  2⤵
  PID:2260
- C:\Windows\System\YYkIXql.exe
  C:\Windows\System\YYkIXql.exe
  2⤵
  PID:2536
- C:\Windows\System\GWnbcOG.exe
  C:\Windows\System\GWnbcOG.exe
  2⤵
  PID:328
- C:\Windows\System\tPrrgcQ.exe
  C:\Windows\System\tPrrgcQ.exe
  2⤵
  PID:2492
- C:\Windows\System\IXFNftR.exe
  C:\Windows\System\IXFNftR.exe
  2⤵
  PID:1596
- C:\Windows\System\CKsEcYA.exe
  C:\Windows\System\CKsEcYA.exe
  2⤵
  PID:2028
- C:\Windows\System\CXxMoaH.exe
  C:\Windows\System\CXxMoaH.exe
  2⤵
  PID:2636
- C:\Windows\System\rcCbaDA.exe
  C:\Windows\System\rcCbaDA.exe
  2⤵
  PID:2612
- C:\Windows\System\PmnCqhn.exe
  C:\Windows\System\PmnCqhn.exe
  2⤵
  PID:1840
- C:\Windows\System\fJCJEvu.exe
  C:\Windows\System\fJCJEvu.exe
  2⤵
  PID:2396
- C:\Windows\System\JhmUNxc.exe
  C:\Windows\System\JhmUNxc.exe
  2⤵
  PID:2036
- C:\Windows\System\YFjXoMs.exe
  C:\Windows\System\YFjXoMs.exe
  2⤵
  PID:1296
- C:\Windows\System\schPdix.exe
  C:\Windows\System\schPdix.exe
  2⤵
  PID:972
- C:\Windows\System\uGhhnRD.exe
  C:\Windows\System\uGhhnRD.exe
  2⤵
  PID:2052
- C:\Windows\System\pvCcYZA.exe
  C:\Windows\System\pvCcYZA.exe
  2⤵
  PID:1896
- C:\Windows\System\jAIWSpS.exe
  C:\Windows\System\jAIWSpS.exe
  2⤵
  PID:1564
- C:\Windows\System\yywmEYW.exe
  C:\Windows\System\yywmEYW.exe
  2⤵
  PID:2572
- C:\Windows\System\hbYbYKi.exe
  C:\Windows\System\hbYbYKi.exe
  2⤵
  PID:2464
- C:\Windows\System\WuFLcmI.exe
  C:\Windows\System\WuFLcmI.exe
  2⤵
  PID:2768
- C:\Windows\System\JLqXrGZ.exe
  C:\Windows\System\JLqXrGZ.exe
  2⤵
  PID:908
- C:\Windows\System\FErCfYA.exe
  C:\Windows\System\FErCfYA.exe
  2⤵
  PID:2576
- C:\Windows\System\rsDkVTb.exe
  C:\Windows\System\rsDkVTb.exe
  2⤵
  PID:1712
- C:\Windows\System\apuzbQs.exe
  C:\Windows\System\apuzbQs.exe
  2⤵
  PID:2708
- C:\Windows\System\dbqfIXS.exe
  C:\Windows\System\dbqfIXS.exe
  2⤵
  PID:900
- C:\Windows\System\TvAKfig.exe
  C:\Windows\System\TvAKfig.exe
  2⤵
  PID:872
- C:\Windows\System\IGkwvzx.exe
  C:\Windows\System\IGkwvzx.exe
  2⤵
  PID:1808
- C:\Windows\System\vxzYTaZ.exe
  C:\Windows\System\vxzYTaZ.exe
  2⤵
  PID:544
- C:\Windows\System\uJOcwDx.exe
  C:\Windows\System\uJOcwDx.exe
  2⤵
  PID:1680
- C:\Windows\System\kuimgdO.exe
  C:\Windows\System\kuimgdO.exe
  2⤵
  PID:2168
- C:\Windows\System\bISsPqy.exe
  C:\Windows\System\bISsPqy.exe
  2⤵
  PID:3024
- C:\Windows\System\bOkbezI.exe
  C:\Windows\System\bOkbezI.exe
  2⤵
  PID:2424
- C:\Windows\System\KpefgvW.exe
  C:\Windows\System\KpefgvW.exe
  2⤵
  PID:2348
- C:\Windows\System\IbzuOZM.exe
  C:\Windows\System\IbzuOZM.exe
  2⤵
  PID:1464
- C:\Windows\System\aitAnsz.exe
  C:\Windows\System\aitAnsz.exe
  2⤵
  PID:2596
- C:\Windows\System\klfPhMH.exe
  C:\Windows\System\klfPhMH.exe
  2⤵
  PID:2264
- C:\Windows\System\PHDjIlH.exe
  C:\Windows\System\PHDjIlH.exe
  2⤵
  PID:2852
- C:\Windows\System\BZgjmwK.exe
  C:\Windows\System\BZgjmwK.exe
  2⤵
  PID:2124
- C:\Windows\System\GkgEWLR.exe
  C:\Windows\System\GkgEWLR.exe
  2⤵
  PID:3080
- C:\Windows\System\zftzihi.exe
  C:\Windows\System\zftzihi.exe
  2⤵
  PID:3096
- C:\Windows\System\ascVTNf.exe
  C:\Windows\System\ascVTNf.exe
  2⤵
  PID:3112
- C:\Windows\System\nNjbbyz.exe
  C:\Windows\System\nNjbbyz.exe
  2⤵
  PID:3128
- C:\Windows\System\vGDZXWE.exe
  C:\Windows\System\vGDZXWE.exe
  2⤵
  PID:3144
- C:\Windows\System\pyGxPup.exe
  C:\Windows\System\pyGxPup.exe
  2⤵
  PID:3160
- C:\Windows\System\uHLppuF.exe
  C:\Windows\System\uHLppuF.exe
  2⤵
  PID:3200
- C:\Windows\System\KQzamKv.exe
  C:\Windows\System\KQzamKv.exe
  2⤵
  PID:3216
- C:\Windows\System\CXiRGOc.exe
  C:\Windows\System\CXiRGOc.exe
  2⤵
  PID:3244
- C:\Windows\System\uopzHIf.exe
  C:\Windows\System\uopzHIf.exe
  2⤵
  PID:3276
- C:\Windows\System\KnliOyM.exe
  C:\Windows\System\KnliOyM.exe
  2⤵
  PID:3296
- C:\Windows\System\vJINhpa.exe
  C:\Windows\System\vJINhpa.exe
  2⤵
  PID:3312
- C:\Windows\System\UGsfCeh.exe
  C:\Windows\System\UGsfCeh.exe
  2⤵
  PID:3328
- C:\Windows\System\URlPOBY.exe
  C:\Windows\System\URlPOBY.exe
  2⤵
  PID:3348
- C:\Windows\System\Yeplyjr.exe
  C:\Windows\System\Yeplyjr.exe
  2⤵
  PID:3364
- C:\Windows\System\MzPMHyK.exe
  C:\Windows\System\MzPMHyK.exe
  2⤵
  PID:3384
- C:\Windows\System\BhtyKUu.exe
  C:\Windows\System\BhtyKUu.exe
  2⤵
  PID:3400
- C:\Windows\System\mhgfZrL.exe
  C:\Windows\System\mhgfZrL.exe
  2⤵
  PID:3416
- C:\Windows\System\iVGzsDj.exe
  C:\Windows\System\iVGzsDj.exe
  2⤵
  PID:3432
- C:\Windows\System\WAogdJP.exe
  C:\Windows\System\WAogdJP.exe
  2⤵
  PID:3448
- C:\Windows\System\FyTIRNc.exe
  C:\Windows\System\FyTIRNc.exe
  2⤵
  PID:3464
- C:\Windows\System\RznOMQs.exe
  C:\Windows\System\RznOMQs.exe
  2⤵
  PID:3480
- C:\Windows\System\EjYZaCk.exe
  C:\Windows\System\EjYZaCk.exe
  2⤵
  PID:3496
- C:\Windows\System\LXQkIzf.exe
  C:\Windows\System\LXQkIzf.exe
  2⤵
  PID:3512
- C:\Windows\System\SSftfUy.exe
  C:\Windows\System\SSftfUy.exe
  2⤵
  PID:3528
- C:\Windows\System\PqJJSpI.exe
  C:\Windows\System\PqJJSpI.exe
  2⤵
  PID:3544
- C:\Windows\System\AtuvzlD.exe
  C:\Windows\System\AtuvzlD.exe
  2⤵
  PID:3560
- C:\Windows\System\FROEjEm.exe
  C:\Windows\System\FROEjEm.exe
  2⤵
  PID:3576
- C:\Windows\System\wvLTWRn.exe
  C:\Windows\System\wvLTWRn.exe
  2⤵
  PID:3592
- C:\Windows\System\TIQgWQf.exe
  C:\Windows\System\TIQgWQf.exe
  2⤵
  PID:3608
- C:\Windows\System\kUCTyzd.exe
  C:\Windows\System\kUCTyzd.exe
  2⤵
  PID:3624
- C:\Windows\System\fBUHJLr.exe
  C:\Windows\System\fBUHJLr.exe
  2⤵
  PID:3640
- C:\Windows\System\ZKbztQl.exe
  C:\Windows\System\ZKbztQl.exe
  2⤵
  PID:3656
- C:\Windows\System\OLYFVqm.exe
  C:\Windows\System\OLYFVqm.exe
  2⤵
  PID:3672
- C:\Windows\System\eFqofty.exe
  C:\Windows\System\eFqofty.exe
  2⤵
  PID:3688
- C:\Windows\System\BLZtAtg.exe
  C:\Windows\System\BLZtAtg.exe
  2⤵
  PID:3704
- C:\Windows\System\TJXtRXs.exe
  C:\Windows\System\TJXtRXs.exe
  2⤵
  PID:3720
- C:\Windows\System\rJVsZOj.exe
  C:\Windows\System\rJVsZOj.exe
  2⤵
  PID:3736
- C:\Windows\System\pPkthCa.exe
  C:\Windows\System\pPkthCa.exe
  2⤵
  PID:3752
- C:\Windows\System\JKzaKAV.exe
  C:\Windows\System\JKzaKAV.exe
  2⤵
  PID:3768
- C:\Windows\System\fiMieBy.exe
  C:\Windows\System\fiMieBy.exe
  2⤵
  PID:3784
- C:\Windows\System\GYAGppA.exe
  C:\Windows\System\GYAGppA.exe
  2⤵
  PID:3800
- C:\Windows\System\rsMAiKc.exe
  C:\Windows\System\rsMAiKc.exe
  2⤵
  PID:3816
- C:\Windows\System\WCmpFDW.exe
  C:\Windows\System\WCmpFDW.exe
  2⤵
  PID:3832
- C:\Windows\System\cLfvRzW.exe
  C:\Windows\System\cLfvRzW.exe
  2⤵
  PID:3848
- C:\Windows\System\NegxODi.exe
  C:\Windows\System\NegxODi.exe
  2⤵
  PID:3864
- C:\Windows\System\slGdkgp.exe
  C:\Windows\System\slGdkgp.exe
  2⤵
  PID:3880
- C:\Windows\System\EYLuctO.exe
  C:\Windows\System\EYLuctO.exe
  2⤵
  PID:3896
- C:\Windows\System\EqtYCdd.exe
  C:\Windows\System\EqtYCdd.exe
  2⤵
  PID:3924
- C:\Windows\System\xbplfJF.exe
  C:\Windows\System\xbplfJF.exe
  2⤵
  PID:3960
- C:\Windows\System\mWEJWTR.exe
  C:\Windows\System\mWEJWTR.exe
  2⤵
  PID:3992
- C:\Windows\System\qlMJRYY.exe
  C:\Windows\System\qlMJRYY.exe
  2⤵
  PID:4020
- C:\Windows\System\ryoeScw.exe
  C:\Windows\System\ryoeScw.exe
  2⤵
  PID:4060
- C:\Windows\System\sUaHUKi.exe
  C:\Windows\System\sUaHUKi.exe
  2⤵
  PID:3108
- C:\Windows\System\FWIxKJU.exe
  C:\Windows\System\FWIxKJU.exe
  2⤵
  PID:2916
- C:\Windows\System\VNwlQKB.exe
  C:\Windows\System\VNwlQKB.exe
  2⤵
  PID:3212
- C:\Windows\System\lxXxKTl.exe
  C:\Windows\System\lxXxKTl.exe
  2⤵
  PID:1156
- C:\Windows\System\xBjlmer.exe
  C:\Windows\System\xBjlmer.exe
  2⤵
  PID:3272
- C:\Windows\System\iguWlTe.exe
  C:\Windows\System\iguWlTe.exe
  2⤵
  PID:3356
- C:\Windows\System\smNROMC.exe
  C:\Windows\System\smNROMC.exe
  2⤵
  PID:3380
- C:\Windows\System\PuSuVRv.exe
  C:\Windows\System\PuSuVRv.exe
  2⤵
  PID:3712
- C:\Windows\System\jZSYSNA.exe
  C:\Windows\System\jZSYSNA.exe
  2⤵
  PID:3872
- C:\Windows\System\FWJFCws.exe
  C:\Windows\System\FWJFCws.exe
  2⤵
  PID:3536
- C:\Windows\System\ThqKrGx.exe
  C:\Windows\System\ThqKrGx.exe
  2⤵
  PID:3476
- C:\Windows\System\gmazGFK.exe
  C:\Windows\System\gmazGFK.exe
  2⤵
  PID:3796
- C:\Windows\System\rwavdvf.exe
  C:\Windows\System\rwavdvf.exe
  2⤵
  PID:3916
- C:\Windows\System\HLqOPxx.exe
  C:\Windows\System\HLqOPxx.exe
  2⤵
  PID:1660
- C:\Windows\System\JayNmjp.exe
  C:\Windows\System\JayNmjp.exe
  2⤵
  PID:3936
- C:\Windows\System\rsfltqq.exe
  C:\Windows\System\rsfltqq.exe
  2⤵
  PID:3976
- C:\Windows\System\naOQfcq.exe
  C:\Windows\System\naOQfcq.exe
  2⤵
  PID:1516
- C:\Windows\System\MuCTMlu.exe
  C:\Windows\System\MuCTMlu.exe
  2⤵
  PID:4008
- C:\Windows\System\ZDijdaW.exe
  C:\Windows\System\ZDijdaW.exe
  2⤵
  PID:2000
- C:\Windows\System\ivFbGjd.exe
  C:\Windows\System\ivFbGjd.exe
  2⤵
  PID:4044
- C:\Windows\System\fEXJEwY.exe
  C:\Windows\System\fEXJEwY.exe
  2⤵
  PID:4032
- C:\Windows\System\LCZSPAs.exe
  C:\Windows\System\LCZSPAs.exe
  2⤵
  PID:2200
- C:\Windows\System\RzZBZDN.exe
  C:\Windows\System\RzZBZDN.exe
  2⤵
  PID:1420
- C:\Windows\System\IrBWKFw.exe
  C:\Windows\System\IrBWKFw.exe
  2⤵
  PID:4072
- C:\Windows\System\GvGZrll.exe
  C:\Windows\System\GvGZrll.exe
  2⤵
  PID:3176
- C:\Windows\System\WgMgXZL.exe
  C:\Windows\System\WgMgXZL.exe
  2⤵
  PID:1872
- C:\Windows\System\fjylLnM.exe
  C:\Windows\System\fjylLnM.exe
  2⤵
  PID:3156
- C:\Windows\System\kIeCOhL.exe
  C:\Windows\System\kIeCOhL.exe
  2⤵
  PID:3240
- C:\Windows\System\KzIgnWu.exe
  C:\Windows\System\KzIgnWu.exe
  2⤵
  PID:2868
- C:\Windows\System\IWDtpaS.exe
  C:\Windows\System\IWDtpaS.exe
  2⤵
  PID:3292
- C:\Windows\System\xukiwDB.exe
  C:\Windows\System\xukiwDB.exe
  2⤵
  PID:3308
- C:\Windows\System\PdagQio.exe
  C:\Windows\System\PdagQio.exe
  2⤵
  PID:3408
- C:\Windows\System\KqOPGZr.exe
  C:\Windows\System\KqOPGZr.exe
  2⤵
  PID:3460
- C:\Windows\System\AKgVmFd.exe
  C:\Windows\System\AKgVmFd.exe
  2⤵
  PID:3520
- C:\Windows\System\RwaihyI.exe
  C:\Windows\System\RwaihyI.exe
  2⤵
  PID:3552
- C:\Windows\System\jnwbHaq.exe
  C:\Windows\System\jnwbHaq.exe
  2⤵
  PID:1956
- C:\Windows\System\FsrBGUg.exe
  C:\Windows\System\FsrBGUg.exe
  2⤵
  PID:2812
- C:\Windows\System\wbSkuBQ.exe
  C:\Windows\System\wbSkuBQ.exe
  2⤵
  PID:3620
- C:\Windows\System\yCrbqDk.exe
  C:\Windows\System\yCrbqDk.exe
  2⤵
  PID:3684
- C:\Windows\System\WDasekG.exe
  C:\Windows\System\WDasekG.exe
  2⤵
  PID:3812
- C:\Windows\System\xPutxsQ.exe
  C:\Windows\System\xPutxsQ.exe
  2⤵
  PID:3600
- C:\Windows\System\BtETIvD.exe
  C:\Windows\System\BtETIvD.exe
  2⤵
  PID:3876
- C:\Windows\System\gZakupb.exe
  C:\Windows\System\gZakupb.exe
  2⤵
  PID:3440
- C:\Windows\System\lFsOURg.exe
  C:\Windows\System\lFsOURg.exe
  2⤵
  PID:3632
- C:\Windows\System\HRuNqRF.exe
  C:\Windows\System\HRuNqRF.exe
  2⤵
  PID:3764
- C:\Windows\System\FxsRPkE.exe
  C:\Windows\System\FxsRPkE.exe
  2⤵
  PID:3728
- C:\Windows\System\LDwxsTg.exe
  C:\Windows\System\LDwxsTg.exe
  2⤵
  PID:3912
- C:\Windows\System\iGfurbz.exe
  C:\Windows\System\iGfurbz.exe
  2⤵
  PID:3920
- C:\Windows\System\txKJecJ.exe
  C:\Windows\System\txKJecJ.exe
  2⤵
  PID:876
- C:\Windows\System\MDsKnLV.exe
  C:\Windows\System\MDsKnLV.exe
  2⤵
  PID:3956
- C:\Windows\System\VivnffG.exe
  C:\Windows\System\VivnffG.exe
  2⤵
  PID:1052
- C:\Windows\System\DKtmzPQ.exe
  C:\Windows\System\DKtmzPQ.exe
  2⤵
  PID:4012
- C:\Windows\System\KeBVSla.exe
  C:\Windows\System\KeBVSla.exe
  2⤵
  PID:4036
- C:\Windows\System\ALtVdUx.exe
  C:\Windows\System\ALtVdUx.exe
  2⤵
  PID:4052
- C:\Windows\System\WlNqRzl.exe
  C:\Windows\System\WlNqRzl.exe
  2⤵
  PID:2192
- C:\Windows\System\iQmZvMX.exe
  C:\Windows\System\iQmZvMX.exe
  2⤵
  PID:3076
- C:\Windows\System\dzsciCz.exe
  C:\Windows\System\dzsciCz.exe
  2⤵
  PID:1212
- C:\Windows\System\mFFaZOK.exe
  C:\Windows\System\mFFaZOK.exe
  2⤵
  PID:2732
- C:\Windows\System\tSRlsOB.exe
  C:\Windows\System\tSRlsOB.exe
  2⤵
  PID:3124
- C:\Windows\System\ZHocOVt.exe
  C:\Windows\System\ZHocOVt.exe
  2⤵
  PID:3232
- C:\Windows\System\ymjJiSn.exe
  C:\Windows\System\ymjJiSn.exe
  2⤵
  PID:3252
- C:\Windows\System\GJwjOYE.exe
  C:\Windows\System\GJwjOYE.exe
  2⤵
  PID:332
- C:\Windows\System\NmoChTo.exe
  C:\Windows\System\NmoChTo.exe
  2⤵
  PID:3324
- C:\Windows\System\ZPKUttN.exe
  C:\Windows\System\ZPKUttN.exe
  2⤵
  PID:3392
- C:\Windows\System\ZPqeTsu.exe
  C:\Windows\System\ZPqeTsu.exe
  2⤵
  PID:3428
- C:\Windows\System\dJGADaf.exe
  C:\Windows\System\dJGADaf.exe
  2⤵
  PID:1208
- C:\Windows\System\kPsDfyQ.exe
  C:\Windows\System\kPsDfyQ.exe
  2⤵
  PID:3376
- C:\Windows\System\SpEVPyT.exe
  C:\Windows\System\SpEVPyT.exe
  2⤵
  PID:856
- C:\Windows\System\amkDuVQ.exe
  C:\Windows\System\amkDuVQ.exe
  2⤵
  PID:1028
- C:\Windows\System\muuCdgx.exe
  C:\Windows\System\muuCdgx.exe
  2⤵
  PID:3680
- C:\Windows\System\ENZILhg.exe
  C:\Windows\System\ENZILhg.exe
  2⤵
  PID:536
- C:\Windows\System\FfSTuiN.exe
  C:\Windows\System\FfSTuiN.exe
  2⤵
  PID:3604
- C:\Windows\System\rBWiwYP.exe
  C:\Windows\System\rBWiwYP.exe
  2⤵
  PID:3444
- C:\Windows\System\tePdszn.exe
  C:\Windows\System\tePdszn.exe
  2⤵
  PID:3540
- C:\Windows\System\TELhBbF.exe
  C:\Windows\System\TELhBbF.exe
  2⤵
  PID:4112
- C:\Windows\System\JouqYdl.exe
  C:\Windows\System\JouqYdl.exe
  2⤵
  PID:4148
- C:\Windows\System\mDKewTJ.exe
  C:\Windows\System\mDKewTJ.exe
  2⤵
  PID:4168
- C:\Windows\System\sluEirn.exe
  C:\Windows\System\sluEirn.exe
  2⤵
  PID:4184
- C:\Windows\System\jqSHXJD.exe
  C:\Windows\System\jqSHXJD.exe
  2⤵
  PID:4200
- C:\Windows\System\ZcOUneS.exe
  C:\Windows\System\ZcOUneS.exe
  2⤵
  PID:4216
- C:\Windows\System\CKrzCTC.exe
  C:\Windows\System\CKrzCTC.exe
  2⤵
  PID:4232
- C:\Windows\System\gLfDsUA.exe
  C:\Windows\System\gLfDsUA.exe
  2⤵
  PID:4248
- C:\Windows\System\pMkkoGq.exe
  C:\Windows\System\pMkkoGq.exe
  2⤵
  PID:4264
- C:\Windows\System\fLGWNZZ.exe
  C:\Windows\System\fLGWNZZ.exe
  2⤵
  PID:4280
- C:\Windows\System\eGnCFwa.exe
  C:\Windows\System\eGnCFwa.exe
  2⤵
  PID:4300
- C:\Windows\System\TebeXfu.exe
  C:\Windows\System\TebeXfu.exe
  2⤵
  PID:4316
- C:\Windows\System\TjTakOQ.exe
  C:\Windows\System\TjTakOQ.exe
  2⤵
  PID:4332
- C:\Windows\System\mSVzpUw.exe
  C:\Windows\System\mSVzpUw.exe
  2⤵
  PID:4348
- C:\Windows\System\bhlUqKG.exe
  C:\Windows\System\bhlUqKG.exe
  2⤵
  PID:4364
- C:\Windows\System\rnvqsbB.exe
  C:\Windows\System\rnvqsbB.exe
  2⤵
  PID:4380
- C:\Windows\System\ADoBYHr.exe
  C:\Windows\System\ADoBYHr.exe
  2⤵
  PID:4396
- C:\Windows\System\brQCJXH.exe
  C:\Windows\System\brQCJXH.exe
  2⤵
  PID:4420
- C:\Windows\System\YsEsINq.exe
  C:\Windows\System\YsEsINq.exe
  2⤵
  PID:4436
- C:\Windows\System\wCBEEOs.exe
  C:\Windows\System\wCBEEOs.exe
  2⤵
  PID:4452
- C:\Windows\System\QjxJpTy.exe
  C:\Windows\System\QjxJpTy.exe
  2⤵
  PID:4468
- C:\Windows\System\MNwjCfW.exe
  C:\Windows\System\MNwjCfW.exe
  2⤵
  PID:4484
- C:\Windows\System\MZaEqHE.exe
  C:\Windows\System\MZaEqHE.exe
  2⤵
  PID:4500
- C:\Windows\System\WWEURAv.exe
  C:\Windows\System\WWEURAv.exe
  2⤵
  PID:4516
- C:\Windows\System\xSEDGIi.exe
  C:\Windows\System\xSEDGIi.exe
  2⤵
  PID:4532
- C:\Windows\System\VDiPdiG.exe
  C:\Windows\System\VDiPdiG.exe
  2⤵
  PID:4548
- C:\Windows\System\sMIoGWJ.exe
  C:\Windows\System\sMIoGWJ.exe
  2⤵
  PID:4564
- C:\Windows\System\sdjKboA.exe
  C:\Windows\System\sdjKboA.exe
  2⤵
  PID:4580
- C:\Windows\System\QDtbvOZ.exe
  C:\Windows\System\QDtbvOZ.exe
  2⤵
  PID:4596
- C:\Windows\System\iBYkKGm.exe
  C:\Windows\System\iBYkKGm.exe
  2⤵
  PID:4612
- C:\Windows\System\CZYcreD.exe
  C:\Windows\System\CZYcreD.exe
  2⤵
  PID:4628
- C:\Windows\System\pdRsqlm.exe
  C:\Windows\System\pdRsqlm.exe
  2⤵
  PID:4644
- C:\Windows\System\TiLQcSk.exe
  C:\Windows\System\TiLQcSk.exe
  2⤵
  PID:4660
- C:\Windows\System\gpqZRsj.exe
  C:\Windows\System\gpqZRsj.exe
  2⤵
  PID:4680
- C:\Windows\System\LJkrLni.exe
  C:\Windows\System\LJkrLni.exe
  2⤵
  PID:4696
- C:\Windows\System\syaPIBp.exe
  C:\Windows\System\syaPIBp.exe
  2⤵
  PID:4712
- C:\Windows\System\xvxCDiH.exe
  C:\Windows\System\xvxCDiH.exe
  2⤵
  PID:4728
- C:\Windows\System\nRqbNjw.exe
  C:\Windows\System\nRqbNjw.exe
  2⤵
  PID:4744
- C:\Windows\System\MxXjqMD.exe
  C:\Windows\System\MxXjqMD.exe
  2⤵
  PID:4760
- C:\Windows\System\lZMhUIG.exe
  C:\Windows\System\lZMhUIG.exe
  2⤵
  PID:4780
- C:\Windows\System\vwHCpVd.exe
  C:\Windows\System\vwHCpVd.exe
  2⤵
  PID:4796
- C:\Windows\System\gtiMHGi.exe
  C:\Windows\System\gtiMHGi.exe
  2⤵
  PID:4812
- C:\Windows\System\MuBEbtw.exe
  C:\Windows\System\MuBEbtw.exe
  2⤵
  PID:4828
- C:\Windows\System\FGskpMR.exe
  C:\Windows\System\FGskpMR.exe
  2⤵
  PID:4844
- C:\Windows\System\yLyfWSX.exe
  C:\Windows\System\yLyfWSX.exe
  2⤵
  PID:4860
- C:\Windows\System\ZEQVtcu.exe
  C:\Windows\System\ZEQVtcu.exe
  2⤵
  PID:4876
- C:\Windows\System\EiJfkSf.exe
  C:\Windows\System\EiJfkSf.exe
  2⤵
  PID:4896
- C:\Windows\System\yDPxesB.exe
  C:\Windows\System\yDPxesB.exe
  2⤵
  PID:4912
- C:\Windows\System\lKbaNeh.exe
  C:\Windows\System\lKbaNeh.exe
  2⤵
  PID:4928
- C:\Windows\System\DYslnKt.exe
  C:\Windows\System\DYslnKt.exe
  2⤵
  PID:4944
- C:\Windows\System\NAdopDG.exe
  C:\Windows\System\NAdopDG.exe
  2⤵
  PID:4960
- C:\Windows\System\szpzkzq.exe
  C:\Windows\System\szpzkzq.exe
  2⤵
  PID:4976
- C:\Windows\System\gLObXLn.exe
  C:\Windows\System\gLObXLn.exe
  2⤵
  PID:4992
- C:\Windows\System\cWQMAxL.exe
  C:\Windows\System\cWQMAxL.exe
  2⤵
  PID:5008
- C:\Windows\System\CaneAzB.exe
  C:\Windows\System\CaneAzB.exe
  2⤵
  PID:5024
- C:\Windows\System\weUupLY.exe
  C:\Windows\System\weUupLY.exe
  2⤵
  PID:5040
- C:\Windows\System\VODfjWV.exe
  C:\Windows\System\VODfjWV.exe
  2⤵
  PID:5056
- C:\Windows\System\girbGTM.exe
  C:\Windows\System\girbGTM.exe
  2⤵
  PID:5072
- C:\Windows\System\EFFfyrq.exe
  C:\Windows\System\EFFfyrq.exe
  2⤵
  PID:5088
- C:\Windows\System\WYoGnQT.exe
  C:\Windows\System\WYoGnQT.exe
  2⤵
  PID:5104
- C:\Windows\System\YYeMnrZ.exe
  C:\Windows\System\YYeMnrZ.exe
  2⤵
  PID:2376
- C:\Windows\System\mpWWcKH.exe
  C:\Windows\System\mpWWcKH.exe
  2⤵
  PID:3776
- C:\Windows\System\uJwZNhK.exe
  C:\Windows\System\uJwZNhK.exe
  2⤵
  PID:3932
- C:\Windows\System\YlUIaeP.exe
  C:\Windows\System\YlUIaeP.exe
  2⤵
  PID:3988
- C:\Windows\System\dwMZbQS.exe
  C:\Windows\System\dwMZbQS.exe
  2⤵
  PID:4080
- C:\Windows\System\aRqKzrb.exe
  C:\Windows\System\aRqKzrb.exe
  2⤵
  PID:1644
- C:\Windows\System\WItoAgA.exe
  C:\Windows\System\WItoAgA.exe
  2⤵
  PID:3320
- C:\Windows\System\xHbKSTP.exe
  C:\Windows\System\xHbKSTP.exe
  2⤵
  PID:3524
- C:\Windows\System\hyjiLpb.exe
  C:\Windows\System\hyjiLpb.exe
  2⤵
  PID:3616
- C:\Windows\System\dSZCNyv.exe
  C:\Windows\System\dSZCNyv.exe
  2⤵
  PID:3668
- C:\Windows\System\cqBXSLF.exe
  C:\Windows\System\cqBXSLF.exe
  2⤵
  PID:4132
- C:\Windows\System\PlcBHnv.exe
  C:\Windows\System\PlcBHnv.exe
  2⤵
  PID:4076
- C:\Windows\System\kiSXoCz.exe
  C:\Windows\System\kiSXoCz.exe
  2⤵
  PID:1200
- C:\Windows\System\EOsKRuo.exe
  C:\Windows\System\EOsKRuo.exe
  2⤵
  PID:2040
- C:\Windows\System\LZTuOjR.exe
  C:\Windows\System\LZTuOjR.exe
  2⤵
  PID:3808
- C:\Windows\System\sYmCILU.exe
  C:\Windows\System\sYmCILU.exe
  2⤵
  PID:4004
- C:\Windows\System\VYqQkDx.exe
  C:\Windows\System\VYqQkDx.exe
  2⤵
  PID:4192
- C:\Windows\System\nyxvdSB.exe
  C:\Windows\System\nyxvdSB.exe
  2⤵
  PID:4256
- C:\Windows\System\RTYIrxq.exe
  C:\Windows\System\RTYIrxq.exe
  2⤵
  PID:1120
- C:\Windows\System\KrMbdxE.exe
  C:\Windows\System\KrMbdxE.exe
  2⤵
  PID:4388
- C:\Windows\System\uyFYdXU.exe
  C:\Windows\System\uyFYdXU.exe
  2⤵
  PID:4492
- C:\Windows\System\DqnzJfu.exe
  C:\Windows\System\DqnzJfu.exe
  2⤵
  PID:3192
- C:\Windows\System\AaGyZrs.exe
  C:\Windows\System\AaGyZrs.exe
  2⤵
  PID:4620
- C:\Windows\System\jfsvpYF.exe
  C:\Windows\System\jfsvpYF.exe
  2⤵
  PID:4688
- C:\Windows\System\EPQYoUu.exe
  C:\Windows\System\EPQYoUu.exe
  2⤵
  PID:1728
- C:\Windows\System\azSEeIU.exe
  C:\Windows\System\azSEeIU.exe
  2⤵
  PID:4824
- C:\Windows\System\FfICdTN.exe
  C:\Windows\System\FfICdTN.exe
  2⤵
  PID:3488
- C:\Windows\System\GDmRxDS.exe
  C:\Windows\System\GDmRxDS.exe
  2⤵
  PID:4920
- C:\Windows\System\DeZjkmG.exe
  C:\Windows\System\DeZjkmG.exe
  2⤵
  PID:4984
- C:\Windows\System\XsBjpAF.exe
  C:\Windows\System\XsBjpAF.exe
  2⤵
  PID:5020
- C:\Windows\System\axIJCAb.exe
  C:\Windows\System\axIJCAb.exe
  2⤵
  PID:4276
- C:\Windows\System\UzBhaQE.exe
  C:\Windows\System\UzBhaQE.exe
  2⤵
  PID:4212
- C:\Windows\System\mTNcagG.exe
  C:\Windows\System\mTNcagG.exe
  2⤵
  PID:4308
- C:\Windows\System\AAxadAI.exe
  C:\Windows\System\AAxadAI.exe
  2⤵
  PID:4372
- C:\Windows\System\IOMfDJd.exe
  C:\Windows\System\IOMfDJd.exe
  2⤵
  PID:4412
- C:\Windows\System\iOCxcce.exe
  C:\Windows\System\iOCxcce.exe
  2⤵
  PID:4480
- C:\Windows\System\ABrayPd.exe
  C:\Windows\System\ABrayPd.exe
  2⤵
  PID:4544
- C:\Windows\System\gnlhclZ.exe
  C:\Windows\System\gnlhclZ.exe
  2⤵
  PID:4608
- C:\Windows\System\AGcUByU.exe
  C:\Windows\System\AGcUByU.exe
  2⤵
  PID:4672
- C:\Windows\System\rWqyEXd.exe
  C:\Windows\System\rWqyEXd.exe
  2⤵
  PID:4736
- C:\Windows\System\sLbzbHB.exe
  C:\Windows\System\sLbzbHB.exe
  2⤵
  PID:4776
- C:\Windows\System\KpAqzKZ.exe
  C:\Windows\System\KpAqzKZ.exe
  2⤵
  PID:4840
- C:\Windows\System\OAWpXVb.exe
  C:\Windows\System\OAWpXVb.exe
  2⤵
  PID:4908
- C:\Windows\System\ZMqHSJz.exe
  C:\Windows\System\ZMqHSJz.exe
  2⤵
  PID:4972
- C:\Windows\System\SDFFKCV.exe
  C:\Windows\System\SDFFKCV.exe
  2⤵
  PID:5036
- C:\Windows\System\xwZOwDb.exe
  C:\Windows\System\xwZOwDb.exe
  2⤵
  PID:1524
- C:\Windows\System\ZsIVYzc.exe
  C:\Windows\System\ZsIVYzc.exe
  2⤵
  PID:3396
- C:\Windows\System\mRnScFM.exe
  C:\Windows\System\mRnScFM.exe
  2⤵
  PID:4144
- C:\Windows\System\yivUiVw.exe
  C:\Windows\System\yivUiVw.exe
  2⤵
  PID:4392
- C:\Windows\System\vBAEfAp.exe
  C:\Windows\System\vBAEfAp.exe
  2⤵
  PID:3856
- C:\Windows\System\MCLLQci.exe
  C:\Windows\System\MCLLQci.exe
  2⤵
  PID:3208
- C:\Windows\System\AvgPUtw.exe
  C:\Windows\System\AvgPUtw.exe
  2⤵
  PID:4724
- C:\Windows\System\zLwOeau.exe
  C:\Windows\System\zLwOeau.exe
  2⤵
  PID:4884
- C:\Windows\System\UJKCXRn.exe
  C:\Windows\System\UJKCXRn.exe
  2⤵
  PID:5080
- C:\Windows\System\Tixiorm.exe
  C:\Windows\System\Tixiorm.exe
  2⤵
  PID:3780
- C:\Windows\System\tpvyccO.exe
  C:\Windows\System\tpvyccO.exe
  2⤵
  PID:4124
- C:\Windows\System\TLBwvNk.exe
  C:\Windows\System\TLBwvNk.exe
  2⤵
  PID:4592
- C:\Windows\System\afZPryR.exe
  C:\Windows\System\afZPryR.exe
  2⤵
  PID:4856
- C:\Windows\System\kslCXbg.exe
  C:\Windows\System\kslCXbg.exe
  2⤵
  PID:4108
- C:\Windows\System\FlsfKMK.exe
  C:\Windows\System\FlsfKMK.exe
  2⤵
  PID:4272
- C:\Windows\System\keWCGCn.exe
  C:\Windows\System\keWCGCn.exe
  2⤵
  PID:4540
- C:\Windows\System\KhDdTVw.exe
  C:\Windows\System\KhDdTVw.exe
  2⤵
  PID:4772
- C:\Windows\System\BdFyeBJ.exe
  C:\Windows\System\BdFyeBJ.exe
  2⤵
  PID:4224
- C:\Windows\System\GSzHMAQ.exe
  C:\Windows\System\GSzHMAQ.exe
  2⤵
  PID:4524
- C:\Windows\System\gyPJmjp.exe
  C:\Windows\System\gyPJmjp.exe
  2⤵
  PID:4792
- C:\Windows\System\ZOcQSiz.exe
  C:\Windows\System\ZOcQSiz.exe
  2⤵
  PID:5016
- C:\Windows\System\WcmIwfE.exe
  C:\Windows\System\WcmIwfE.exe
  2⤵
  PID:4340
- C:\Windows\System\ooYqEYf.exe
  C:\Windows\System\ooYqEYf.exe
  2⤵
  PID:4576
- C:\Windows\System\RFgJBNp.exe
  C:\Windows\System\RFgJBNp.exe
  2⤵
  PID:4808
- C:\Windows\System\AZMTaKl.exe
  C:\Windows\System\AZMTaKl.exe
  2⤵
  PID:5004
- C:\Windows\System\NGjoHoY.exe
  C:\Windows\System\NGjoHoY.exe
  2⤵
  PID:2196
- C:\Windows\System\yliVtQT.exe
  C:\Windows\System\yliVtQT.exe
  2⤵
  PID:4040
- C:\Windows\System\gdNuIHz.exe
  C:\Windows\System\gdNuIHz.exe
  2⤵
  PID:4464
- C:\Windows\System\LtrrzBq.exe
  C:\Windows\System\LtrrzBq.exe
  2⤵
  PID:4692
- C:\Windows\System\OppgNRP.exe
  C:\Windows\System\OppgNRP.exe
  2⤵
  PID:1664
- C:\Windows\System\fpkfjmn.exe
  C:\Windows\System\fpkfjmn.exe
  2⤵
  PID:4296
- C:\Windows\System\taCkEhd.exe
  C:\Windows\System\taCkEhd.exe
  2⤵
  PID:4952
- C:\Windows\System\oFrWUvC.exe
  C:\Windows\System\oFrWUvC.exe
  2⤵
  PID:4656
- C:\Windows\System\WFZcDSx.exe
  C:\Windows\System\WFZcDSx.exe
  2⤵
  PID:4708
- C:\Windows\System\dLCkIip.exe
  C:\Windows\System\dLCkIip.exe
  2⤵
  PID:4140
- C:\Windows\System\DQyhblq.exe
  C:\Windows\System\DQyhblq.exe
  2⤵
  PID:4164
- C:\Windows\System\ZYfRJwT.exe
  C:\Windows\System\ZYfRJwT.exe
  2⤵
  PID:4668
- C:\Windows\System\eYVoOOw.exe
  C:\Windows\System\eYVoOOw.exe
  2⤵
  PID:4448
- C:\Windows\System\vyReXSo.exe
  C:\Windows\System\vyReXSo.exe
  2⤵
  PID:3508
- C:\Windows\System\vKmtGvK.exe
  C:\Windows\System\vKmtGvK.exe
  2⤵
  PID:5112
- C:\Windows\System\XRStkdd.exe
  C:\Windows\System\XRStkdd.exe
  2⤵
  PID:4476
- C:\Windows\System\GBALbtm.exe
  C:\Windows\System\GBALbtm.exe
  2⤵
  PID:3904
- C:\Windows\System\WmtfVkZ.exe
  C:\Windows\System\WmtfVkZ.exe
  2⤵
  PID:3652
- C:\Windows\System\PAbLtfu.exe
  C:\Windows\System\PAbLtfu.exe
  2⤵
  PID:5136
- C:\Windows\System\HjScRkb.exe
  C:\Windows\System\HjScRkb.exe
  2⤵
  PID:5152
- C:\Windows\System\fZeVBYp.exe
  C:\Windows\System\fZeVBYp.exe
  2⤵
  PID:5168
- C:\Windows\System\IewZRpf.exe
  C:\Windows\System\IewZRpf.exe
  2⤵
  PID:5184
- C:\Windows\System\ATddaXm.exe
  C:\Windows\System\ATddaXm.exe
  2⤵
  PID:5200
- C:\Windows\System\hrVzLLP.exe
  C:\Windows\System\hrVzLLP.exe
  2⤵
  PID:5216
- C:\Windows\System\KYIFmCP.exe
  C:\Windows\System\KYIFmCP.exe
  2⤵
  PID:5232
- C:\Windows\System\kYBsAZK.exe
  C:\Windows\System\kYBsAZK.exe
  2⤵
  PID:5248
- C:\Windows\System\NrdZLTt.exe
  C:\Windows\System\NrdZLTt.exe
  2⤵
  PID:5268
- C:\Windows\System\sCVQlKy.exe
  C:\Windows\System\sCVQlKy.exe
  2⤵
  PID:5284
- C:\Windows\System\CPBSkWj.exe
  C:\Windows\System\CPBSkWj.exe
  2⤵
  PID:5300
- C:\Windows\System\SZZcviP.exe
  C:\Windows\System\SZZcviP.exe
  2⤵
  PID:5316
- C:\Windows\System\gNujAvE.exe
  C:\Windows\System\gNujAvE.exe
  2⤵
  PID:5332
- C:\Windows\System\HaOCFrq.exe
  C:\Windows\System\HaOCFrq.exe
  2⤵
  PID:5348
- C:\Windows\System\oJosWbK.exe
  C:\Windows\System\oJosWbK.exe
  2⤵
  PID:5364
- C:\Windows\System\eBTFGHY.exe
  C:\Windows\System\eBTFGHY.exe
  2⤵
  PID:5380
- C:\Windows\System\euGFWJO.exe
  C:\Windows\System\euGFWJO.exe
  2⤵
  PID:5396
- C:\Windows\System\zPBExdQ.exe
  C:\Windows\System\zPBExdQ.exe
  2⤵
  PID:5412
- C:\Windows\System\JDCYPIX.exe
  C:\Windows\System\JDCYPIX.exe
  2⤵
  PID:5432
- C:\Windows\System\bUgwbJq.exe
  C:\Windows\System\bUgwbJq.exe
  2⤵
  PID:5448
- C:\Windows\System\gUzugUl.exe
  C:\Windows\System\gUzugUl.exe
  2⤵
  PID:5464
- C:\Windows\System\aXsgoCy.exe
  C:\Windows\System\aXsgoCy.exe
  2⤵
  PID:5480
- C:\Windows\System\jcKZdaZ.exe
  C:\Windows\System\jcKZdaZ.exe
  2⤵
  PID:5496
- C:\Windows\System\vrIWRkK.exe
  C:\Windows\System\vrIWRkK.exe
  2⤵
  PID:5512
- C:\Windows\System\mfinXjw.exe
  C:\Windows\System\mfinXjw.exe
  2⤵
  PID:5528
- C:\Windows\System\qrIWFAm.exe
  C:\Windows\System\qrIWFAm.exe
  2⤵
  PID:5544
- C:\Windows\System\QRCwSvR.exe
  C:\Windows\System\QRCwSvR.exe
  2⤵
  PID:5560
- C:\Windows\System\osMwdal.exe
  C:\Windows\System\osMwdal.exe
  2⤵
  PID:5576
- C:\Windows\System\ruEAXZE.exe
  C:\Windows\System\ruEAXZE.exe
  2⤵
  PID:5592
- C:\Windows\System\ShcwAmp.exe
  C:\Windows\System\ShcwAmp.exe
  2⤵
  PID:5608
- C:\Windows\System\avkaMbX.exe
  C:\Windows\System\avkaMbX.exe
  2⤵
  PID:5624
- C:\Windows\System\KaiDvTK.exe
  C:\Windows\System\KaiDvTK.exe
  2⤵
  PID:5640
- C:\Windows\System\DkNmdtZ.exe
  C:\Windows\System\DkNmdtZ.exe
  2⤵
  PID:5656
- C:\Windows\System\hudMmap.exe
  C:\Windows\System\hudMmap.exe
  2⤵
  PID:5672
- C:\Windows\System\hyMrNat.exe
  C:\Windows\System\hyMrNat.exe
  2⤵
  PID:5688
- C:\Windows\System\RlDGIUx.exe
  C:\Windows\System\RlDGIUx.exe
  2⤵
  PID:5704
- C:\Windows\System\SdfEuJS.exe
  C:\Windows\System\SdfEuJS.exe
  2⤵
  PID:5724
- C:\Windows\System\oZskGBg.exe
  C:\Windows\System\oZskGBg.exe
  2⤵
  PID:5740
- C:\Windows\System\wfUjLHR.exe
  C:\Windows\System\wfUjLHR.exe
  2⤵
  PID:5756
- C:\Windows\System\mDPZaLU.exe
  C:\Windows\System\mDPZaLU.exe
  2⤵
  PID:5772
- C:\Windows\System\MASbqJk.exe
  C:\Windows\System\MASbqJk.exe
  2⤵
  PID:5788
- C:\Windows\System\jEGpgtg.exe
  C:\Windows\System\jEGpgtg.exe
  2⤵
  PID:5804
- C:\Windows\System\CviEZLp.exe
  C:\Windows\System\CviEZLp.exe
  2⤵
  PID:5824
- C:\Windows\System\fCXOrKp.exe
  C:\Windows\System\fCXOrKp.exe
  2⤵
  PID:5840
- C:\Windows\System\shiDjKA.exe
  C:\Windows\System\shiDjKA.exe
  2⤵
  PID:5856
- C:\Windows\System\SdDsCbl.exe
  C:\Windows\System\SdDsCbl.exe
  2⤵
  PID:5872
- C:\Windows\System\itUzXYK.exe
  C:\Windows\System\itUzXYK.exe
  2⤵
  PID:5888
- C:\Windows\System\IKxhSjC.exe
  C:\Windows\System\IKxhSjC.exe
  2⤵
  PID:5904
- C:\Windows\System\mwsiYSy.exe
  C:\Windows\System\mwsiYSy.exe
  2⤵
  PID:5920
- C:\Windows\System\rCkCpYF.exe
  C:\Windows\System\rCkCpYF.exe
  2⤵
  PID:5936
- C:\Windows\System\tjBdCJM.exe
  C:\Windows\System\tjBdCJM.exe
  2⤵
  PID:5952
- C:\Windows\System\eegfvko.exe
  C:\Windows\System\eegfvko.exe
  2⤵
  PID:5968
- C:\Windows\System\ogRFkwN.exe
  C:\Windows\System\ogRFkwN.exe
  2⤵
  PID:5984
- C:\Windows\System\qDvDgLX.exe
  C:\Windows\System\qDvDgLX.exe
  2⤵
  PID:6000
- C:\Windows\System\IDXGxUy.exe
  C:\Windows\System\IDXGxUy.exe
  2⤵
  PID:6016
- C:\Windows\System\GpAmiCB.exe
  C:\Windows\System\GpAmiCB.exe
  2⤵
  PID:6032
- C:\Windows\System\hEXAEmq.exe
  C:\Windows\System\hEXAEmq.exe
  2⤵
  PID:6048
- C:\Windows\System\WfIrtxa.exe
  C:\Windows\System\WfIrtxa.exe
  2⤵
  PID:6064
- C:\Windows\System\AdLBQEi.exe
  C:\Windows\System\AdLBQEi.exe
  2⤵
  PID:6080
- C:\Windows\System\WZdEYnV.exe
  C:\Windows\System\WZdEYnV.exe
  2⤵
  PID:6096
- C:\Windows\System\WLhxXSM.exe
  C:\Windows\System\WLhxXSM.exe
  2⤵
  PID:6116
- C:\Windows\System\mPcfksK.exe
  C:\Windows\System\mPcfksK.exe
  2⤵
  PID:6140
- C:\Windows\System\PSJvsbC.exe
  C:\Windows\System\PSJvsbC.exe
  2⤵
  PID:5164
- C:\Windows\System\VSaIWlt.exe
  C:\Windows\System\VSaIWlt.exe
  2⤵
  PID:5224
- C:\Windows\System\OrAYIAY.exe
  C:\Windows\System\OrAYIAY.exe
  2⤵
  PID:5264
- C:\Windows\System\VkiXInY.exe
  C:\Windows\System\VkiXInY.exe
  2⤵
  PID:5328
- C:\Windows\System\EbSsrYA.exe
  C:\Windows\System\EbSsrYA.exe
  2⤵
  PID:4356
- C:\Windows\System\MTZnkTs.exe
  C:\Windows\System\MTZnkTs.exe
  2⤵
  PID:5052
- C:\Windows\System\iXUKEIA.exe
  C:\Windows\System\iXUKEIA.exe
  2⤵
  PID:4652
- C:\Windows\System\PTDszwg.exe
  C:\Windows\System\PTDszwg.exe
  2⤵
  PID:4208
- C:\Windows\System\clyEXTj.exe
  C:\Windows\System\clyEXTj.exe
  2⤵
  PID:5176
- C:\Windows\System\QlthjVM.exe
  C:\Windows\System\QlthjVM.exe
  2⤵
  PID:5240
- C:\Windows\System\THHbuvM.exe
  C:\Windows\System\THHbuvM.exe
  2⤵
  PID:5308
- C:\Windows\System\mEcfhrl.exe
  C:\Windows\System\mEcfhrl.exe
  2⤵
  PID:5376
- C:\Windows\System\zkbeoRY.exe
  C:\Windows\System\zkbeoRY.exe
  2⤵
  PID:5424
- C:\Windows\System\HVUVVsq.exe
  C:\Windows\System\HVUVVsq.exe
  2⤵
  PID:5488
- C:\Windows\System\VbIKioU.exe
  C:\Windows\System\VbIKioU.exe
  2⤵
  PID:5552
- C:\Windows\System\fIHYArO.exe
  C:\Windows\System\fIHYArO.exe
  2⤵
  PID:5440
- C:\Windows\System\uSfacxq.exe
  C:\Windows\System\uSfacxq.exe
  2⤵
  PID:5648
- C:\Windows\System\eggdCVn.exe
  C:\Windows\System\eggdCVn.exe
  2⤵
  PID:5720
- C:\Windows\System\dxiMPlS.exe
  C:\Windows\System\dxiMPlS.exe
  2⤵
  PID:5784
- C:\Windows\System\qvqkMUg.exe
  C:\Windows\System\qvqkMUg.exe
  2⤵
  PID:5652
- C:\Windows\System\PODThou.exe
  C:\Windows\System\PODThou.exe
  2⤵
  PID:5504
- C:\Windows\System\qScvBRW.exe
  C:\Windows\System\qScvBRW.exe
  2⤵
  PID:5884
- C:\Windows\System\QaQpOkP.exe
  C:\Windows\System\QaQpOkP.exe
  2⤵
  PID:5948
- C:\Windows\System\bNhkWaV.exe
  C:\Windows\System\bNhkWaV.exe
  2⤵
  PID:5404
- C:\Windows\System\wRkTLEy.exe
  C:\Windows\System\wRkTLEy.exe
  2⤵
  PID:5632
- C:\Windows\System\sxWyENE.exe
  C:\Windows\System\sxWyENE.exe
  2⤵
  PID:5796
- C:\Windows\System\GJmejOA.exe
  C:\Windows\System\GJmejOA.exe
  2⤵
  PID:5600
- C:\Windows\System\wzzfPTg.exe
  C:\Windows\System\wzzfPTg.exe
  2⤵
  PID:5700
- C:\Windows\System\ckfFXoW.exe
  C:\Windows\System\ckfFXoW.exe
  2⤵
  PID:5768
- C:\Windows\System\iDkLfzi.exe
  C:\Windows\System\iDkLfzi.exe
  2⤵
  PID:5900
- C:\Windows\System\dGXFoUf.exe
  C:\Windows\System\dGXFoUf.exe
  2⤵
  PID:5964
- C:\Windows\System\MtkTEsm.exe
  C:\Windows\System\MtkTEsm.exe
  2⤵
  PID:6012
- C:\Windows\System\wBvlwWh.exe
  C:\Windows\System\wBvlwWh.exe
  2⤵
  PID:6072
- C:\Windows\System\wouALnl.exe
  C:\Windows\System\wouALnl.exe
  2⤵
  PID:6056
- C:\Windows\System\ebbxazt.exe
  C:\Windows\System\ebbxazt.exe
  2⤵
  PID:6112
- C:\Windows\System\zyoAahz.exe
  C:\Windows\System\zyoAahz.exe
  2⤵
  PID:6132
- C:\Windows\System\fzkpUeS.exe
  C:\Windows\System\fzkpUeS.exe
  2⤵
  PID:5128
- C:\Windows\System\WSugOgt.exe
  C:\Windows\System\WSugOgt.exe
  2⤵
  PID:4756
- C:\Windows\System\xFUcusn.exe
  C:\Windows\System\xFUcusn.exe
  2⤵
  PID:4360
- C:\Windows\System\eEOjDPP.exe
  C:\Windows\System\eEOjDPP.exe
  2⤵
  PID:5276
- C:\Windows\System\FWSzXMG.exe
  C:\Windows\System\FWSzXMG.exe
  2⤵
  PID:5520
- C:\Windows\System\OYMXzvb.exe
  C:\Windows\System\OYMXzvb.exe
  2⤵
  PID:5616
- C:\Windows\System\VtflYJO.exe
  C:\Windows\System\VtflYJO.exe
  2⤵
  PID:4940
- C:\Windows\System\ePrkuQq.exe
  C:\Windows\System\ePrkuQq.exe
  2⤵
  PID:5848
- C:\Windows\System\GyWFEEW.exe
  C:\Windows\System\GyWFEEW.exe
  2⤵
  PID:5980
- C:\Windows\System\gJpZuLY.exe
  C:\Windows\System\gJpZuLY.exe
  2⤵
  PID:5944
- C:\Windows\System\UGwMpBB.exe
  C:\Windows\System\UGwMpBB.exe
  2⤵
  PID:5960
- C:\Windows\System\IVmiwuB.exe
  C:\Windows\System\IVmiwuB.exe
  2⤵
  PID:5460
- C:\Windows\System\hzchynU.exe
  C:\Windows\System\hzchynU.exe
  2⤵
  PID:5588
- C:\Windows\System\pDNhtgA.exe
  C:\Windows\System\pDNhtgA.exe
  2⤵
  PID:5132
- C:\Windows\System\JbVLSXr.exe
  C:\Windows\System\JbVLSXr.exe
  2⤵
  PID:5340
- C:\Windows\System\NxDvkWR.exe
  C:\Windows\System\NxDvkWR.exe
  2⤵
  PID:5712
- C:\Windows\System\IejzNeN.exe
  C:\Windows\System\IejzNeN.exe
  2⤵
  PID:5820
- C:\Windows\System\bJmtzFf.exe
  C:\Windows\System\bJmtzFf.exe
  2⤵
  PID:5508
- C:\Windows\System\drgDvzF.exe
  C:\Windows\System\drgDvzF.exe
  2⤵
  PID:6008
- C:\Windows\System\jxZZvos.exe
  C:\Windows\System\jxZZvos.exe
  2⤵
  PID:5356
- C:\Windows\System\HvgJamh.exe
  C:\Windows\System\HvgJamh.exe
  2⤵
  PID:5324
- C:\Windows\System\sbeEOjA.exe
  C:\Windows\System\sbeEOjA.exe
  2⤵
  PID:5212
- C:\Windows\System\MPCXGTR.exe
  C:\Windows\System\MPCXGTR.exe
  2⤵
  PID:5932
- C:\Windows\System\dwZOROO.exe
  C:\Windows\System\dwZOROO.exe
  2⤵
  PID:5868
- C:\Windows\System\KxmjzYr.exe
  C:\Windows\System\KxmjzYr.exe
  2⤵
  PID:4244
- C:\Windows\System\wLoNGnQ.exe
  C:\Windows\System\wLoNGnQ.exe
  2⤵
  PID:5764
- C:\Windows\System\jnUbgto.exe
  C:\Windows\System\jnUbgto.exe
  2⤵
  PID:6148
- C:\Windows\System\ylyyPdD.exe
  C:\Windows\System\ylyyPdD.exe
  2⤵
  PID:6164
- C:\Windows\System\hBBtGUL.exe
  C:\Windows\System\hBBtGUL.exe
  2⤵
  PID:6180
- C:\Windows\System\dEJZGYM.exe
  C:\Windows\System\dEJZGYM.exe
  2⤵
  PID:6196
- C:\Windows\System\uHOVVuK.exe
  C:\Windows\System\uHOVVuK.exe
  2⤵
  PID:6212
- C:\Windows\System\aLlVLrC.exe
  C:\Windows\System\aLlVLrC.exe
  2⤵
  PID:6228
- C:\Windows\System\uojkkkK.exe
  C:\Windows\System\uojkkkK.exe
  2⤵
  PID:6244
- C:\Windows\System\KCRwoJX.exe
  C:\Windows\System\KCRwoJX.exe
  2⤵
  PID:6268
- C:\Windows\System\zLPBSYL.exe
  C:\Windows\System\zLPBSYL.exe
  2⤵
  PID:6284
- C:\Windows\System\xOtKZmQ.exe
  C:\Windows\System\xOtKZmQ.exe
  2⤵
  PID:6300
- C:\Windows\System\snoRbct.exe
  C:\Windows\System\snoRbct.exe
  2⤵
  PID:6316
- C:\Windows\System\sOzpROR.exe
  C:\Windows\System\sOzpROR.exe
  2⤵
  PID:6332
- C:\Windows\System\tGKVUOy.exe
  C:\Windows\System\tGKVUOy.exe
  2⤵
  PID:6348
- C:\Windows\System\ehyuCUm.exe
  C:\Windows\System\ehyuCUm.exe
  2⤵
  PID:6364
- C:\Windows\System\hteLKdg.exe
  C:\Windows\System\hteLKdg.exe
  2⤵
  PID:6380
- C:\Windows\System\TjqSMNd.exe
  C:\Windows\System\TjqSMNd.exe
  2⤵
  PID:6396
- C:\Windows\System\pDyIkjB.exe
  C:\Windows\System\pDyIkjB.exe
  2⤵
  PID:6412
- C:\Windows\System\HOJylcK.exe
  C:\Windows\System\HOJylcK.exe
  2⤵
  PID:6428
- C:\Windows\System\WcADWWI.exe
  C:\Windows\System\WcADWWI.exe
  2⤵
  PID:6444
- C:\Windows\System\xvzxcME.exe
  C:\Windows\System\xvzxcME.exe
  2⤵
  PID:6460
- C:\Windows\System\DrTTCzS.exe
  C:\Windows\System\DrTTCzS.exe
  2⤵
  PID:6476
- C:\Windows\System\EQBDCKt.exe
  C:\Windows\System\EQBDCKt.exe
  2⤵
  PID:6492
- C:\Windows\System\aoNwxiM.exe
  C:\Windows\System\aoNwxiM.exe
  2⤵
  PID:6508
- C:\Windows\System\suwdrdT.exe
  C:\Windows\System\suwdrdT.exe
  2⤵
  PID:6524
- C:\Windows\System\CyATcdi.exe
  C:\Windows\System\CyATcdi.exe
  2⤵
  PID:6540
- C:\Windows\System\QDLjVsf.exe
  C:\Windows\System\QDLjVsf.exe
  2⤵
  PID:6556
- C:\Windows\System\iLcUomt.exe
  C:\Windows\System\iLcUomt.exe
  2⤵
  PID:6584
- C:\Windows\System\RSszxzQ.exe
  C:\Windows\System\RSszxzQ.exe
  2⤵
  PID:6604
- C:\Windows\System\DifVliK.exe
  C:\Windows\System\DifVliK.exe
  2⤵
  PID:6620
- C:\Windows\System\Iphytyy.exe
  C:\Windows\System\Iphytyy.exe
  2⤵
  PID:6636
- C:\Windows\System\oOATxTr.exe
  C:\Windows\System\oOATxTr.exe
  2⤵
  PID:6652
- C:\Windows\System\TXuNNfZ.exe
  C:\Windows\System\TXuNNfZ.exe
  2⤵
  PID:6668
- C:\Windows\System\hoRViLU.exe
  C:\Windows\System\hoRViLU.exe
  2⤵
  PID:6692
- C:\Windows\System\eBNSuUr.exe
  C:\Windows\System\eBNSuUr.exe
  2⤵
  PID:6708
- C:\Windows\System\rYMfAZA.exe
  C:\Windows\System\rYMfAZA.exe
  2⤵
  PID:6724
- C:\Windows\System\ZIvBKhs.exe
  C:\Windows\System\ZIvBKhs.exe
  2⤵
  PID:6740
- C:\Windows\System\mbZsAqh.exe
  C:\Windows\System\mbZsAqh.exe
  2⤵
  PID:6756
- C:\Windows\System\TAHDBYl.exe
  C:\Windows\System\TAHDBYl.exe
  2⤵
  PID:6772
- C:\Windows\System\ZoSTqjG.exe
  C:\Windows\System\ZoSTqjG.exe
  2⤵
  PID:6788
- C:\Windows\System\dRoZIHC.exe
  C:\Windows\System\dRoZIHC.exe
  2⤵
  PID:6804
- C:\Windows\System\LKojGWU.exe
  C:\Windows\System\LKojGWU.exe
  2⤵
  PID:6820
- C:\Windows\System\YnVnyuw.exe
  C:\Windows\System\YnVnyuw.exe
  2⤵
  PID:6836
- C:\Windows\System\kQciYEI.exe
  C:\Windows\System\kQciYEI.exe
  2⤵
  PID:6852
- C:\Windows\System\GgKGNld.exe
  C:\Windows\System\GgKGNld.exe
  2⤵
  PID:6868
- C:\Windows\System\VaIzBCX.exe
  C:\Windows\System\VaIzBCX.exe
  2⤵
  PID:6884
- C:\Windows\System\TpneAfl.exe
  C:\Windows\System\TpneAfl.exe
  2⤵
  PID:6904
- C:\Windows\System\GokiNbh.exe
  C:\Windows\System\GokiNbh.exe
  2⤵
  PID:6920
- C:\Windows\System\KyKvMww.exe
  C:\Windows\System\KyKvMww.exe
  2⤵
  PID:6936
- C:\Windows\System\vcZvHJu.exe
  C:\Windows\System\vcZvHJu.exe
  2⤵
  PID:6952
- C:\Windows\System\WNMwcCw.exe
  C:\Windows\System\WNMwcCw.exe
  2⤵
  PID:6968
- C:\Windows\System\KGoBaeE.exe
  C:\Windows\System\KGoBaeE.exe
  2⤵
  PID:6984
- C:\Windows\System\nMDKKOF.exe
  C:\Windows\System\nMDKKOF.exe
  2⤵
  PID:7000
- C:\Windows\System\IZPEeWw.exe
  C:\Windows\System\IZPEeWw.exe
  2⤵
  PID:7016
- C:\Windows\System\uNTEiMf.exe
  C:\Windows\System\uNTEiMf.exe
  2⤵
  PID:7032
- C:\Windows\System\fEZdCxY.exe
  C:\Windows\System\fEZdCxY.exe
  2⤵
  PID:7048
- C:\Windows\System\CmbGHTS.exe
  C:\Windows\System\CmbGHTS.exe
  2⤵
  PID:7064
- C:\Windows\System\gkSVkRD.exe
  C:\Windows\System\gkSVkRD.exe
  2⤵
  PID:7080
- C:\Windows\System\IvLTQyT.exe
  C:\Windows\System\IvLTQyT.exe
  2⤵
  PID:7096
- C:\Windows\System\JxkooYk.exe
  C:\Windows\System\JxkooYk.exe
  2⤵
  PID:7112
- C:\Windows\System\pEhjIuW.exe
  C:\Windows\System\pEhjIuW.exe
  2⤵
  PID:7128
- C:\Windows\System\CaVzbbD.exe
  C:\Windows\System\CaVzbbD.exe
  2⤵
  PID:7144
- C:\Windows\System\KXBlZLo.exe
  C:\Windows\System\KXBlZLo.exe
  2⤵
  PID:7160
- C:\Windows\System\kKKNRNQ.exe
  C:\Windows\System\kKKNRNQ.exe
  2⤵
  PID:6176
- C:\Windows\System\XaqAAvj.exe
  C:\Windows\System\XaqAAvj.exe
  2⤵
  PID:6240
- C:\Windows\System\iLesRHN.exe
  C:\Windows\System\iLesRHN.exe
  2⤵
  PID:6312
- C:\Windows\System\mGZSQAe.exe
  C:\Windows\System\mGZSQAe.exe
  2⤵
  PID:6264
- C:\Windows\System\CCsSYFp.exe
  C:\Windows\System\CCsSYFp.exe
  2⤵
  PID:5864
- C:\Windows\System\JbxfvNB.exe
  C:\Windows\System\JbxfvNB.exe
  2⤵
  PID:5144
- C:\Windows\System\KyRvpyK.exe
  C:\Windows\System\KyRvpyK.exe
  2⤵
  PID:6024
- C:\Windows\System\FMekTJU.exe
  C:\Windows\System\FMekTJU.exe
  2⤵
  PID:5372
- C:\Windows\System\UVhNDbc.exe
  C:\Windows\System\UVhNDbc.exe
  2⤵
  PID:6124
- C:\Windows\System\LSxgcCb.exe
  C:\Windows\System\LSxgcCb.exe
  2⤵
  PID:5196
- C:\Windows\System\pGUcoFf.exe
  C:\Windows\System\pGUcoFf.exe
  2⤵
  PID:6192
- C:\Windows\System\vYxECKP.exe
  C:\Windows\System\vYxECKP.exe
  2⤵
  PID:6324
- C:\Windows\System\yPplMJw.exe
  C:\Windows\System\yPplMJw.exe
  2⤵
  PID:6376
- C:\Windows\System\gSJiUYV.exe
  C:\Windows\System\gSJiUYV.exe
  2⤵
  PID:6440
- C:\Windows\System\oJNAHxn.exe
  C:\Windows\System\oJNAHxn.exe
  2⤵
  PID:6504
- C:\Windows\System\ZngXexM.exe
  C:\Windows\System\ZngXexM.exe
  2⤵
  PID:6388
- C:\Windows\System\kdfwTvL.exe
  C:\Windows\System\kdfwTvL.exe
  2⤵
  PID:6360
- C:\Windows\System\NKSgjaG.exe
  C:\Windows\System\NKSgjaG.exe
  2⤵
  PID:6456
- C:\Windows\System\vIHRDvw.exe
  C:\Windows\System\vIHRDvw.exe
  2⤵
  PID:6552
- C:\Windows\System\rfhwxLs.exe
  C:\Windows\System\rfhwxLs.exe
  2⤵
  PID:6576
- C:\Windows\System\ZcFXkTm.exe
  C:\Windows\System\ZcFXkTm.exe
  2⤵
  PID:6676
- C:\Windows\System\dOcrQxh.exe
  C:\Windows\System\dOcrQxh.exe
  2⤵
  PID:6688
- C:\Windows\System\OlhvPuY.exe
  C:\Windows\System\OlhvPuY.exe
  2⤵
  PID:6752
- C:\Windows\System\HvARtcH.exe
  C:\Windows\System\HvARtcH.exe
  2⤵
  PID:6816
- C:\Windows\System\JSUUMmV.exe
  C:\Windows\System\JSUUMmV.exe
  2⤵
  PID:6880
- C:\Windows\System\cMfppcF.exe
  C:\Windows\System\cMfppcF.exe
  2⤵
  PID:6976
- C:\Windows\System\vswIexD.exe
  C:\Windows\System\vswIexD.exe
  2⤵
  PID:7008
- C:\Windows\System\iYyovHg.exe
  C:\Windows\System\iYyovHg.exe
  2⤵
  PID:6800
- C:\Windows\System\rMAEaoG.exe
  C:\Windows\System\rMAEaoG.exe
  2⤵
  PID:6632
- C:\Windows\System\LMgMgzk.exe
  C:\Windows\System\LMgMgzk.exe
  2⤵
  PID:6732
- C:\Windows\System\PjVdRVk.exe
  C:\Windows\System\PjVdRVk.exe
  2⤵
  PID:6828
- C:\Windows\System\WgDonly.exe
  C:\Windows\System\WgDonly.exe
  2⤵
  PID:6896
- C:\Windows\System\UsLuaXS.exe
  C:\Windows\System\UsLuaXS.exe
  2⤵
  PID:5476
- C:\Windows\System\lBQyHPN.exe
  C:\Windows\System\lBQyHPN.exe
  2⤵
  PID:6256
- C:\Windows\System\PwPYnRt.exe
  C:\Windows\System\PwPYnRt.exe
  2⤵
  PID:7124
- C:\Windows\System\kAjauVa.exe
  C:\Windows\System\kAjauVa.exe
  2⤵
  PID:7152
- C:\Windows\System\BqZHEYZ.exe
  C:\Windows\System\BqZHEYZ.exe
  2⤵
  PID:6516
- C:\Windows\System\fJKYCIJ.exe
  C:\Windows\System\fJKYCIJ.exe
  2⤵
  PID:6572
- C:\Windows\System\uGZAhzX.exe
  C:\Windows\System\uGZAhzX.exe
  2⤵
  PID:6224
- C:\Windows\System\xPEENrw.exe
  C:\Windows\System\xPEENrw.exe
  2⤵
  PID:6580
- C:\Windows\System\rxUCiGN.exe
  C:\Windows\System\rxUCiGN.exe
  2⤵
  PID:6748
- C:\Windows\System\vWsUCmF.exe
  C:\Windows\System\vWsUCmF.exe
  2⤵
  PID:6812
- C:\Windows\System\rhfAWoW.exe
  C:\Windows\System\rhfAWoW.exe
  2⤵
  PID:7040
- C:\Windows\System\KJBIUTd.exe
  C:\Windows\System\KJBIUTd.exe
  2⤵
  PID:6704
- C:\Windows\System\uKsbcVA.exe
  C:\Windows\System\uKsbcVA.exe
  2⤵
  PID:6932
- C:\Windows\System\bMRaSQD.exe
  C:\Windows\System\bMRaSQD.exe
  2⤵
  PID:6864
- C:\Windows\System\WLqjzYw.exe
  C:\Windows\System\WLqjzYw.exe
  2⤵
  PID:7056
- C:\Windows\System\DbeSryZ.exe
  C:\Windows\System\DbeSryZ.exe
  2⤵
  PID:6992
- C:\Windows\System\qqvDAMM.exe
  C:\Windows\System\qqvDAMM.exe
  2⤵
  PID:6172
- C:\Windows\System\sEvzjRG.exe
  C:\Windows\System\sEvzjRG.exe
  2⤵
  PID:5568
- C:\Windows\System\YMptGMN.exe
  C:\Windows\System\YMptGMN.exe
  2⤵
  PID:6296
- C:\Windows\System\QUaXnkm.exe
  C:\Windows\System\QUaXnkm.exe
  2⤵
  PID:5420
- C:\Windows\System\afWsGxR.exe
  C:\Windows\System\afWsGxR.exe
  2⤵
  PID:6372
- C:\Windows\System\MsqPJaR.exe
  C:\Windows\System\MsqPJaR.exe
  2⤵
  PID:6208
- C:\Windows\System\HzZuAGd.exe
  C:\Windows\System\HzZuAGd.exe
  2⤵
  PID:5208
- C:\Windows\System\EzVjNiO.exe
  C:\Windows\System\EzVjNiO.exe
  2⤵
  PID:6612
- C:\Windows\System\Wlxoamn.exe
  C:\Windows\System\Wlxoamn.exe
  2⤵
  PID:6684
- C:\Windows\System\TkMmXYf.exe
  C:\Windows\System\TkMmXYf.exe
  2⤵
  PID:6628
- C:\Windows\System\BDSFovi.exe
  C:\Windows\System\BDSFovi.exe
  2⤵
  PID:6876
- C:\Windows\System\hoLmTXu.exe
  C:\Windows\System\hoLmTXu.exe
  2⤵
  PID:6996
- C:\Windows\System\lQvwuNF.exe
  C:\Windows\System\lQvwuNF.exe
  2⤵
  PID:7060
- C:\Windows\System\nZGHMjH.exe
  C:\Windows\System\nZGHMjH.exe
  2⤵
  PID:5664
- C:\Windows\System\xNqcrQI.exe
  C:\Windows\System\xNqcrQI.exe
  2⤵
  PID:7136
- C:\Windows\System\JHHGejy.exe
  C:\Windows\System\JHHGejy.exe
  2⤵
  PID:7172
- C:\Windows\System\rlPQNAX.exe
  C:\Windows\System\rlPQNAX.exe
  2⤵
  PID:7192
- C:\Windows\System\FrneajQ.exe
  C:\Windows\System\FrneajQ.exe
  2⤵
  PID:7208
- C:\Windows\System\cmjYHxj.exe
  C:\Windows\System\cmjYHxj.exe
  2⤵
  PID:7224
- C:\Windows\System\DPKmTsl.exe
  C:\Windows\System\DPKmTsl.exe
  2⤵
  PID:7240
- C:\Windows\System\RcnGSBo.exe
  C:\Windows\System\RcnGSBo.exe
  2⤵
  PID:7256
- C:\Windows\System\YBiyrTC.exe
  C:\Windows\System\YBiyrTC.exe
  2⤵
  PID:7272
- C:\Windows\System\apZBTTO.exe
  C:\Windows\System\apZBTTO.exe
  2⤵
  PID:7288
- C:\Windows\System\KKnXHoM.exe
  C:\Windows\System\KKnXHoM.exe
  2⤵
  PID:7404
- C:\Windows\System\mNYePLA.exe
  C:\Windows\System\mNYePLA.exe
  2⤵
  PID:7432
- C:\Windows\System\BnPXRvQ.exe
  C:\Windows\System\BnPXRvQ.exe
  2⤵
  PID:7448
- C:\Windows\System\yOpAmIE.exe
  C:\Windows\System\yOpAmIE.exe
  2⤵
  PID:7464
- C:\Windows\System\eOmTNcS.exe
  C:\Windows\System\eOmTNcS.exe
  2⤵
  PID:7480
- C:\Windows\System\SJREpts.exe
  C:\Windows\System\SJREpts.exe
  2⤵
  PID:7496
- C:\Windows\System\JShweoM.exe
  C:\Windows\System\JShweoM.exe
  2⤵
  PID:7512
- C:\Windows\System\nkughLz.exe
  C:\Windows\System\nkughLz.exe
  2⤵
  PID:7528
- C:\Windows\System\ZixjylL.exe
  C:\Windows\System\ZixjylL.exe
  2⤵
  PID:7544
- C:\Windows\System\CEoPJqZ.exe
  C:\Windows\System\CEoPJqZ.exe
  2⤵
  PID:7560
- C:\Windows\System\BHmuaOc.exe
  C:\Windows\System\BHmuaOc.exe
  2⤵
  PID:7576
- C:\Windows\System\CfewNOj.exe
  C:\Windows\System\CfewNOj.exe
  2⤵
  PID:7592
- C:\Windows\System\bQKUHYe.exe
  C:\Windows\System\bQKUHYe.exe
  2⤵
  PID:7608
- C:\Windows\System\pumNWnt.exe
  C:\Windows\System\pumNWnt.exe
  2⤵
  PID:7624
- C:\Windows\System\tEdoqEk.exe
  C:\Windows\System\tEdoqEk.exe
  2⤵
  PID:7644
- C:\Windows\System\VXoreLG.exe
  C:\Windows\System\VXoreLG.exe
  2⤵
  PID:7660
- C:\Windows\System\NIVZXFe.exe
  C:\Windows\System\NIVZXFe.exe
  2⤵
  PID:7676
- C:\Windows\System\kfxOogh.exe
  C:\Windows\System\kfxOogh.exe
  2⤵
  PID:7692
- C:\Windows\System\yjqMkuE.exe
  C:\Windows\System\yjqMkuE.exe
  2⤵
  PID:7708
- C:\Windows\System\VMCEUNU.exe
  C:\Windows\System\VMCEUNU.exe
  2⤵
  PID:7724
- C:\Windows\System\jGOxIAN.exe
  C:\Windows\System\jGOxIAN.exe
  2⤵
  PID:7740
- C:\Windows\System\epbSYxD.exe
  C:\Windows\System\epbSYxD.exe
  2⤵
  PID:7760
- C:\Windows\System\AMiPJJP.exe
  C:\Windows\System\AMiPJJP.exe
  2⤵
  PID:7776
- C:\Windows\System\cjUeLxp.exe
  C:\Windows\System\cjUeLxp.exe
  2⤵
  PID:7792
- C:\Windows\System\ieTICTQ.exe
  C:\Windows\System\ieTICTQ.exe
  2⤵
  PID:7808
- C:\Windows\System\oSTlRJV.exe
  C:\Windows\System\oSTlRJV.exe
  2⤵
  PID:7824
- C:\Windows\System\SchNxnW.exe
  C:\Windows\System\SchNxnW.exe
  2⤵
  PID:7840
- C:\Windows\System\wFDZwvY.exe
  C:\Windows\System\wFDZwvY.exe
  2⤵
  PID:7856
- C:\Windows\System\afOmQMU.exe
  C:\Windows\System\afOmQMU.exe
  2⤵
  PID:7876
- C:\Windows\System\NEReACn.exe
  C:\Windows\System\NEReACn.exe
  2⤵
  PID:7892
- C:\Windows\System\hNhbVhF.exe
  C:\Windows\System\hNhbVhF.exe
  2⤵
  PID:7908
- C:\Windows\System\ewplfdk.exe
  C:\Windows\System\ewplfdk.exe
  2⤵
  PID:7924
- C:\Windows\System\NoQQolh.exe
  C:\Windows\System\NoQQolh.exe
  2⤵
  PID:7940
- C:\Windows\System\VNYCcfj.exe
  C:\Windows\System\VNYCcfj.exe
  2⤵
  PID:7956
- C:\Windows\System\iBstghA.exe
  C:\Windows\System\iBstghA.exe
  2⤵
  PID:7972
- C:\Windows\System\pGZYPqW.exe
  C:\Windows\System\pGZYPqW.exe
  2⤵
  PID:7992
- C:\Windows\System\RfDBoRB.exe
  C:\Windows\System\RfDBoRB.exe
  2⤵
  PID:8012
- C:\Windows\System\ZzczdtE.exe
  C:\Windows\System\ZzczdtE.exe
  2⤵
  PID:8028
- C:\Windows\System\XMyaZlX.exe
  C:\Windows\System\XMyaZlX.exe
  2⤵
  PID:8044
- C:\Windows\System\SPSbAlT.exe
  C:\Windows\System\SPSbAlT.exe
  2⤵
  PID:8064
- C:\Windows\System\JIoBVoH.exe
  C:\Windows\System\JIoBVoH.exe
  2⤵
  PID:8080
- C:\Windows\System\jvTeWyd.exe
  C:\Windows\System\jvTeWyd.exe
  2⤵
  PID:8096
- C:\Windows\System\rsiCGqM.exe
  C:\Windows\System\rsiCGqM.exe
  2⤵
  PID:8112
- C:\Windows\System\fmNuMPN.exe
  C:\Windows\System\fmNuMPN.exe
  2⤵
  PID:8128
- C:\Windows\System\KrRGgLX.exe
  C:\Windows\System\KrRGgLX.exe
  2⤵
  PID:8144
- C:\Windows\System\TBARGjz.exe
  C:\Windows\System\TBARGjz.exe
  2⤵
  PID:8164
- C:\Windows\System\mUlBbHo.exe
  C:\Windows\System\mUlBbHo.exe
  2⤵
  PID:8180
- C:\Windows\System\WltZITg.exe
  C:\Windows\System\WltZITg.exe
  2⤵
  PID:7184
- C:\Windows\System\pmqEQvx.exe
  C:\Windows\System\pmqEQvx.exe
  2⤵
  PID:6596
- C:\Windows\System\NuaMnMN.exe
  C:\Windows\System\NuaMnMN.exe
  2⤵
  PID:6768
- C:\Windows\System\mMgcfgw.exe
  C:\Windows\System\mMgcfgw.exe
  2⤵
  PID:7252
- C:\Windows\System\ZruQkNV.exe
  C:\Windows\System\ZruQkNV.exe
  2⤵
  PID:6156
- C:\Windows\System\fJjJAJE.exe
  C:\Windows\System\fJjJAJE.exe
  2⤵
  PID:2240
- C:\Windows\System\KpqgAyH.exe
  C:\Windows\System\KpqgAyH.exe
  2⤵
  PID:2244
- C:\Windows\System\sOoLfln.exe
  C:\Windows\System\sOoLfln.exe
  2⤵
  PID:6700
- C:\Windows\System\gnkhgfF.exe
  C:\Windows\System\gnkhgfF.exe
  2⤵
  PID:6252
- C:\Windows\System\SZZOaXa.exe
  C:\Windows\System\SZZOaXa.exe
  2⤵
  PID:7204
- C:\Windows\System\xJWAPRF.exe
  C:\Windows\System\xJWAPRF.exe
  2⤵
  PID:7296
- C:\Windows\System\cNwfIOJ.exe
  C:\Windows\System\cNwfIOJ.exe
  2⤵
  PID:7316
- C:\Windows\System\DWDmArf.exe
  C:\Windows\System\DWDmArf.exe
  2⤵
  PID:7336
- C:\Windows\System\TcXyRaD.exe
  C:\Windows\System\TcXyRaD.exe
  2⤵
  PID:7356
- C:\Windows\System\iXksouc.exe
  C:\Windows\System\iXksouc.exe
  2⤵
  PID:7368
- C:\Windows\System\czgVpHq.exe
  C:\Windows\System\czgVpHq.exe
  2⤵
  PID:7384
- C:\Windows\System\qvaQCbJ.exe
  C:\Windows\System\qvaQCbJ.exe
  2⤵
  PID:7392
- C:\Windows\System\aaHsKqd.exe
  C:\Windows\System\aaHsKqd.exe
  2⤵
  PID:7476
- C:\Windows\System\kxEoeAY.exe
  C:\Windows\System\kxEoeAY.exe
  2⤵
  PID:7460
- C:\Windows\System\evQktXW.exe
  C:\Windows\System\evQktXW.exe
  2⤵
  PID:7488
- C:\Windows\System\hvEgwEa.exe
  C:\Windows\System\hvEgwEa.exe
  2⤵
  PID:7604
- C:\Windows\System\okIDFDM.exe
  C:\Windows\System\okIDFDM.exe
  2⤵
  PID:7524
- C:\Windows\System\VsIRGdd.exe
  C:\Windows\System\VsIRGdd.exe
  2⤵
  PID:7616
- C:\Windows\System\eSqviGS.exe
  C:\Windows\System\eSqviGS.exe
  2⤵
  PID:7656
- C:\Windows\System\lKUEFWy.exe
  C:\Windows\System\lKUEFWy.exe
  2⤵
  PID:7720
- C:\Windows\System\EwsRfVn.exe
  C:\Windows\System\EwsRfVn.exe
  2⤵
  PID:7668
- C:\Windows\System\oAjdurS.exe
  C:\Windows\System\oAjdurS.exe
  2⤵
  PID:7700
- C:\Windows\System\MWSGxDW.exe
  C:\Windows\System\MWSGxDW.exe
  2⤵
  PID:7768
- C:\Windows\System\schesUc.exe
  C:\Windows\System\schesUc.exe
  2⤵
  PID:7816
- C:\Windows\System\IEwXiGL.exe
  C:\Windows\System\IEwXiGL.exe
  2⤵
  PID:7804
- C:\Windows\System\HNhJonG.exe
  C:\Windows\System\HNhJonG.exe
  2⤵
  PID:7980
- C:\Windows\System\RdvvLQL.exe
  C:\Windows\System\RdvvLQL.exe
  2⤵
  PID:8020
- C:\Windows\System\MAxEHef.exe
  C:\Windows\System\MAxEHef.exe
  2⤵
  PID:8124
- C:\Windows\System\piOYWiH.exe
  C:\Windows\System\piOYWiH.exe
  2⤵
  PID:8088
- C:\Windows\System\HcSQGrd.exe
  C:\Windows\System\HcSQGrd.exe
  2⤵
  PID:7180
- C:\Windows\System\zYruyJk.exe
  C:\Windows\System\zYruyJk.exe
  2⤵
  PID:7232
- C:\Windows\System\ddHavYa.exe
  C:\Windows\System\ddHavYa.exe
  2⤵
  PID:7268
- C:\Windows\System\BKvzOzE.exe
  C:\Windows\System\BKvzOzE.exe
  2⤵
  PID:7332
- C:\Windows\System\jJRbWZZ.exe
  C:\Windows\System\jJRbWZZ.exe
  2⤵
  PID:7900
- C:\Windows\System\axAlxQh.exe
  C:\Windows\System\axAlxQh.exe
  2⤵
  PID:7936
- C:\Windows\System\JrZXMaN.exe
  C:\Windows\System\JrZXMaN.exe
  2⤵
  PID:7400
- C:\Windows\System\oYCrgBq.exe
  C:\Windows\System\oYCrgBq.exe
  2⤵
  PID:7220
- C:\Windows\System\tXoNeEj.exe
  C:\Windows\System\tXoNeEj.exe
  2⤵
  PID:7872
- C:\Windows\System\teovLuk.exe
  C:\Windows\System\teovLuk.exe
  2⤵
  PID:7120
- C:\Windows\System\SwzciBU.exe
  C:\Windows\System\SwzciBU.exe
  2⤵
  PID:6344
- C:\Windows\System\RhSXABO.exe
  C:\Windows\System\RhSXABO.exe
  2⤵
  PID:8076
- C:\Windows\System\fZEjMwN.exe
  C:\Windows\System\fZEjMwN.exe
  2⤵
  PID:8108
- C:\Windows\System\DcqKGcl.exe
  C:\Windows\System\DcqKGcl.exe
  2⤵
  PID:7540
- C:\Windows\System\GPjKUBl.exe
  C:\Windows\System\GPjKUBl.exe
  2⤵
  PID:7376
- C:\Windows\System\zTYvEfG.exe
  C:\Windows\System\zTYvEfG.exe
  2⤵
  PID:7440
- C:\Windows\System\fxpmIKQ.exe
  C:\Windows\System\fxpmIKQ.exe
  2⤵
  PID:7588
- C:\Windows\System\odTKnzJ.exe
  C:\Windows\System\odTKnzJ.exe
  2⤵
  PID:7340
- C:\Windows\System\dNvPPDH.exe
  C:\Windows\System\dNvPPDH.exe
  2⤵
  PID:7520
- C:\Windows\System\gZhbJyd.exe
  C:\Windows\System\gZhbJyd.exe
  2⤵
  PID:7472
- C:\Windows\System\SVKaawi.exe
  C:\Windows\System\SVKaawi.exe
  2⤵
  PID:7428
- C:\Windows\System\YrrrWwD.exe
  C:\Windows\System\YrrrWwD.exe
  2⤵
  PID:7492
- C:\Windows\System\zvOjbzG.exe
  C:\Windows\System\zvOjbzG.exe
  2⤵
  PID:7736
- C:\Windows\System\sWBHgJh.exe
  C:\Windows\System\sWBHgJh.exe
  2⤵
  PID:7884
- C:\Windows\System\PZMdJSW.exe
  C:\Windows\System\PZMdJSW.exe
  2⤵
  PID:8160
- C:\Windows\System\EqBTqKH.exe
  C:\Windows\System\EqBTqKH.exe
  2⤵
  PID:6720
- C:\Windows\System\IRLtLqO.exe
  C:\Windows\System\IRLtLqO.exe
  2⤵
  PID:8120
- C:\Windows\System\cpdbjME.exe
  C:\Windows\System\cpdbjME.exe
  2⤵
  PID:7360
- C:\Windows\System\KJVpOFy.exe
  C:\Windows\System\KJVpOFy.exe
  2⤵
  PID:7920
- C:\Windows\System\UACwiuC.exe
  C:\Windows\System\UACwiuC.exe
  2⤵
  PID:7672
- C:\Windows\System\FqCsznK.exe
  C:\Windows\System\FqCsznK.exe
  2⤵
  PID:8056
- C:\Windows\System\czmUDcC.exe
  C:\Windows\System\czmUDcC.exe
  2⤵
  PID:5836
- C:\Windows\System\sDQsfki.exe
  C:\Windows\System\sDQsfki.exe
  2⤵
  PID:7868
- C:\Windows\System\zaHZosj.exe
  C:\Windows\System\zaHZosj.exe
  2⤵
  PID:7968
- C:\Windows\System\GllRgiq.exe
  C:\Windows\System\GllRgiq.exe
  2⤵
  PID:7312
- C:\Windows\System\EelZgAZ.exe
  C:\Windows\System\EelZgAZ.exe
  2⤵
  PID:7456
- C:\Windows\System\zXHiGDe.exe
  C:\Windows\System\zXHiGDe.exe
  2⤵
  PID:7636
- C:\Windows\System\ayyMvBf.exe
  C:\Windows\System\ayyMvBf.exe
  2⤵
  PID:6960
- C:\Windows\System\zNTKDvw.exe
  C:\Windows\System\zNTKDvw.exe
  2⤵
  PID:7304
- C:\Windows\System\NkygLTD.exe
  C:\Windows\System\NkygLTD.exe
  2⤵
  PID:8092
- C:\Windows\System\MERwLrb.exe
  C:\Windows\System\MERwLrb.exe
  2⤵
  PID:7984
- C:\Windows\System\ipziyBA.exe
  C:\Windows\System\ipziyBA.exe
  2⤵
  PID:7424
- C:\Windows\System\JcqnuEX.exe
  C:\Windows\System\JcqnuEX.exe
  2⤵
  PID:7420
- C:\Windows\System\DUakYNo.exe
  C:\Windows\System\DUakYNo.exe
  2⤵
  PID:8036
- C:\Windows\System\Vdpwmhq.exe
  C:\Windows\System\Vdpwmhq.exe
  2⤵
  PID:7640
- C:\Windows\System\cYzNtsm.exe
  C:\Windows\System\cYzNtsm.exe
  2⤵
  PID:7328
- C:\Windows\System\SigjIDI.exe
  C:\Windows\System\SigjIDI.exe
  2⤵
  PID:8208
- C:\Windows\System\TLngyAY.exe
  C:\Windows\System\TLngyAY.exe
  2⤵
  PID:8224
- C:\Windows\System\WVFjrcf.exe
  C:\Windows\System\WVFjrcf.exe
  2⤵
  PID:8240
- C:\Windows\System\VohrVgB.exe
  C:\Windows\System\VohrVgB.exe
  2⤵
  PID:8256
- C:\Windows\System\eCPKvHl.exe
  C:\Windows\System\eCPKvHl.exe
  2⤵
  PID:8272
- C:\Windows\System\XibfUYM.exe
  C:\Windows\System\XibfUYM.exe
  2⤵
  PID:8288
- C:\Windows\System\OxOxzwn.exe
  C:\Windows\System\OxOxzwn.exe
  2⤵
  PID:8304
- C:\Windows\System\GdoaMNX.exe
  C:\Windows\System\GdoaMNX.exe
  2⤵
  PID:8320
- C:\Windows\System\sYUVnrA.exe
  C:\Windows\System\sYUVnrA.exe
  2⤵
  PID:8336
- C:\Windows\System\JjLmsJc.exe
  C:\Windows\System\JjLmsJc.exe
  2⤵
  PID:8352
- C:\Windows\System\bLTVoCm.exe
  C:\Windows\System\bLTVoCm.exe
  2⤵
  PID:8368
- C:\Windows\System\IvopcSb.exe
  C:\Windows\System\IvopcSb.exe
  2⤵
  PID:8384
- C:\Windows\System\cOPnGHB.exe
  C:\Windows\System\cOPnGHB.exe
  2⤵
  PID:8400
- C:\Windows\System\MkDocum.exe
  C:\Windows\System\MkDocum.exe
  2⤵
  PID:8416
- C:\Windows\System\IhTZarX.exe
  C:\Windows\System\IhTZarX.exe
  2⤵
  PID:8432
- C:\Windows\System\ZHbaBaV.exe
  C:\Windows\System\ZHbaBaV.exe
  2⤵
  PID:8452
- C:\Windows\System\nFmqXeD.exe
  C:\Windows\System\nFmqXeD.exe
  2⤵
  PID:8468
- C:\Windows\System\aKymFjg.exe
  C:\Windows\System\aKymFjg.exe
  2⤵
  PID:8484
- C:\Windows\System\nNhmfXD.exe
  C:\Windows\System\nNhmfXD.exe
  2⤵
  PID:8500
- C:\Windows\System\VerKAjm.exe
  C:\Windows\System\VerKAjm.exe
  2⤵
  PID:8516
- C:\Windows\System\kDUKBLq.exe
  C:\Windows\System\kDUKBLq.exe
  2⤵
  PID:8544
- C:\Windows\System\azOxCXm.exe
  C:\Windows\System\azOxCXm.exe
  2⤵
  PID:8560
- C:\Windows\System\yWWWgyx.exe
  C:\Windows\System\yWWWgyx.exe
  2⤵
  PID:8576
- C:\Windows\System\stTFmRe.exe
  C:\Windows\System\stTFmRe.exe
  2⤵
  PID:8592
- C:\Windows\System\iPiNiFs.exe
  C:\Windows\System\iPiNiFs.exe
  2⤵
  PID:8608
- C:\Windows\System\NYFAPid.exe
  C:\Windows\System\NYFAPid.exe
  2⤵
  PID:8624
- C:\Windows\System\JcetRFN.exe
  C:\Windows\System\JcetRFN.exe
  2⤵
  PID:8640
- C:\Windows\System\akTTNMY.exe
  C:\Windows\System\akTTNMY.exe
  2⤵
  PID:8656
- C:\Windows\System\fxlCcKx.exe
  C:\Windows\System\fxlCcKx.exe
  2⤵
  PID:8672
- C:\Windows\System\vUvJDjW.exe
  C:\Windows\System\vUvJDjW.exe
  2⤵
  PID:8688
- C:\Windows\System\TzyPQVV.exe
  C:\Windows\System\TzyPQVV.exe
  2⤵
  PID:8704
- C:\Windows\System\tLEWdkI.exe
  C:\Windows\System\tLEWdkI.exe
  2⤵
  PID:8720
- C:\Windows\System\iQKQrqp.exe
  C:\Windows\System\iQKQrqp.exe
  2⤵
  PID:8736
- C:\Windows\System\kvvIYNN.exe
  C:\Windows\System\kvvIYNN.exe
  2⤵
  PID:8752
- C:\Windows\System\ldyzGKo.exe
  C:\Windows\System\ldyzGKo.exe
  2⤵
  PID:8768
- C:\Windows\System\oHttdtK.exe
  C:\Windows\System\oHttdtK.exe
  2⤵
  PID:8784
- C:\Windows\System\LVbcsQt.exe
  C:\Windows\System\LVbcsQt.exe
  2⤵
  PID:8800
- C:\Windows\System\GalGxvz.exe
  C:\Windows\System\GalGxvz.exe
  2⤵
  PID:8884
- C:\Windows\System\KMMTLEt.exe
  C:\Windows\System\KMMTLEt.exe
  2⤵
  PID:8900
- C:\Windows\System\xGuEZYy.exe
  C:\Windows\System\xGuEZYy.exe
  2⤵
  PID:8916
- C:\Windows\System\QTQwEaw.exe
  C:\Windows\System\QTQwEaw.exe
  2⤵
  PID:8932
- C:\Windows\System\SWifSDd.exe
  C:\Windows\System\SWifSDd.exe
  2⤵
  PID:8948
- C:\Windows\System\kNicLvm.exe
  C:\Windows\System\kNicLvm.exe
  2⤵
  PID:8964
- C:\Windows\System\zFbHdFU.exe
  C:\Windows\System\zFbHdFU.exe
  2⤵
  PID:8984
- C:\Windows\System\XGBPakx.exe
  C:\Windows\System\XGBPakx.exe
  2⤵
  PID:9000
- C:\Windows\System\PDTQjDf.exe
  C:\Windows\System\PDTQjDf.exe
  2⤵
  PID:9020
- C:\Windows\System\kWoMvOq.exe
  C:\Windows\System\kWoMvOq.exe
  2⤵
  PID:9036
- C:\Windows\System\GrofEHk.exe
  C:\Windows\System\GrofEHk.exe
  2⤵
  PID:9052
- C:\Windows\System\MjFcXgA.exe
  C:\Windows\System\MjFcXgA.exe
  2⤵
  PID:9068
- C:\Windows\System\pyafCcs.exe
  C:\Windows\System\pyafCcs.exe
  2⤵
  PID:9084
- C:\Windows\System\TEzRcti.exe
  C:\Windows\System\TEzRcti.exe
  2⤵
  PID:9104
- C:\Windows\System\XRRFEoT.exe
  C:\Windows\System\XRRFEoT.exe
  2⤵
  PID:9124
- C:\Windows\System\WYrtdbJ.exe
  C:\Windows\System\WYrtdbJ.exe
  2⤵
  PID:9144
- C:\Windows\System\WiMmZVZ.exe
  C:\Windows\System\WiMmZVZ.exe
  2⤵
  PID:7188
- C:\Windows\System\JzYXgze.exe
  C:\Windows\System\JzYXgze.exe
  2⤵
  PID:8216
- C:\Windows\System\oyeiCHu.exe
  C:\Windows\System\oyeiCHu.exe
  2⤵
  PID:8344
- C:\Windows\System\Sqfhdxf.exe
  C:\Windows\System\Sqfhdxf.exe
  2⤵
  PID:8424
- C:\Windows\System\ftntQqx.exe
  C:\Windows\System\ftntQqx.exe
  2⤵
  PID:8464
- C:\Windows\System\WSelVnw.exe
  C:\Windows\System\WSelVnw.exe
  2⤵
  PID:8532
- C:\Windows\System\CjSbMsU.exe
  C:\Windows\System\CjSbMsU.exe
  2⤵
  PID:8480
- C:\Windows\System\EnEfUNd.exe
  C:\Windows\System\EnEfUNd.exe
  2⤵
  PID:8508
- C:\Windows\System\owWqJGY.exe
  C:\Windows\System\owWqJGY.exe
  2⤵
  PID:8444
- C:\Windows\System\GUcINhg.exe
  C:\Windows\System\GUcINhg.exe
  2⤵
  PID:8552
- C:\Windows\System\QdztfLo.exe
  C:\Windows\System\QdztfLo.exe
  2⤵
  PID:8700
- C:\Windows\System\mPULwWt.exe
  C:\Windows\System\mPULwWt.exe
  2⤵
  PID:8760
- C:\Windows\System\SKJnqRD.exe
  C:\Windows\System\SKJnqRD.exe
  2⤵
  PID:8680
- C:\Windows\System\VAIOTMM.exe
  C:\Windows\System\VAIOTMM.exe
  2⤵
  PID:8744
- C:\Windows\System\KyVuKnR.exe
  C:\Windows\System\KyVuKnR.exe
  2⤵
  PID:8808
- C:\Windows\System\mfpuVOZ.exe
  C:\Windows\System\mfpuVOZ.exe
  2⤵
  PID:8748
- C:\Windows\System\evXwhPA.exe
  C:\Windows\System\evXwhPA.exe
  2⤵
  PID:8860
- C:\Windows\System\YbYfITD.exe
  C:\Windows\System\YbYfITD.exe
  2⤵
  PID:8924
- C:\Windows\System\LooKIrr.exe
  C:\Windows\System\LooKIrr.exe
  2⤵
  PID:8996
- C:\Windows\System\rloyvZC.exe
  C:\Windows\System\rloyvZC.exe
  2⤵
  PID:9064
- C:\Windows\System\MLFdoIK.exe
  C:\Windows\System\MLFdoIK.exe
  2⤵
  PID:8536
- C:\Windows\System\ZJocFCO.exe
  C:\Windows\System\ZJocFCO.exe
  2⤵
  PID:8880
- C:\Windows\System\yBtmQKI.exe
  C:\Windows\System\yBtmQKI.exe
  2⤵
  PID:8824
- C:\Windows\System\TqgKVxI.exe
  C:\Windows\System\TqgKVxI.exe
  2⤵
  PID:8844
- C:\Windows\System\VobNQLt.exe
  C:\Windows\System\VobNQLt.exe
  2⤵
  PID:8908
- C:\Windows\System\XsVfxKG.exe
  C:\Windows\System\XsVfxKG.exe
  2⤵
  PID:8972
- C:\Windows\System\VUHZCBq.exe
  C:\Windows\System\VUHZCBq.exe
  2⤵
  PID:9044
- C:\Windows\System\jWdQQcW.exe
  C:\Windows\System\jWdQQcW.exe
  2⤵
  PID:9168
- C:\Windows\System\TPZWwTj.exe
  C:\Windows\System\TPZWwTj.exe
  2⤵
  PID:9192
- C:\Windows\System\ORMOOGh.exe
  C:\Windows\System\ORMOOGh.exe
  2⤵
  PID:9208
- C:\Windows\System\lqLZbhY.exe
  C:\Windows\System\lqLZbhY.exe
  2⤵
  PID:7632
- C:\Windows\System\FnwOIav.exe
  C:\Windows\System\FnwOIav.exe
  2⤵
  PID:8264
- C:\Windows\System\gvxMhlU.exe
  C:\Windows\System\gvxMhlU.exe
  2⤵
  PID:7904
- C:\Windows\System\fNmISCV.exe
  C:\Windows\System\fNmISCV.exe
  2⤵
  PID:8280
- C:\Windows\System\mMYcajO.exe
  C:\Windows\System\mMYcajO.exe
  2⤵
  PID:7600
- C:\Windows\System\zuhIHOG.exe
  C:\Windows\System\zuhIHOG.exe
  2⤵
  PID:7140
- C:\Windows\System\bCjBqzm.exe
  C:\Windows\System\bCjBqzm.exe
  2⤵
  PID:8296
- C:\Windows\System\CMhuWUZ.exe
  C:\Windows\System\CMhuWUZ.exe
  2⤵
  PID:8568
- C:\Windows\System\xROWbHA.exe
  C:\Windows\System\xROWbHA.exe
  2⤵
  PID:8476
- C:\Windows\System\VPTfiTH.exe
  C:\Windows\System\VPTfiTH.exe
  2⤵
  PID:8428
- C:\Windows\System\GdFLPru.exe
  C:\Windows\System\GdFLPru.exe
  2⤵
  PID:8636
- C:\Windows\System\JTXyNra.exe
  C:\Windows\System\JTXyNra.exe
  2⤵
  PID:8376
- C:\Windows\System\fOnnSOG.exe
  C:\Windows\System\fOnnSOG.exe
  2⤵
  PID:8792
- C:\Windows\System\OKKOAWA.exe
  C:\Windows\System\OKKOAWA.exe
  2⤵
  PID:8780
- C:\Windows\System\eFpAUCJ.exe
  C:\Windows\System\eFpAUCJ.exe
  2⤵
  PID:8892
- C:\Windows\System\kMaEaYj.exe
  C:\Windows\System\kMaEaYj.exe
  2⤵
  PID:9060
- C:\Windows\System\yCviAXV.exe
  C:\Windows\System\yCviAXV.exe
  2⤵
  PID:8836
- C:\Windows\System\juWsIwA.exe
  C:\Windows\System\juWsIwA.exe
  2⤵
  PID:9096
- C:\Windows\System\RDOBHrc.exe
  C:\Windows\System\RDOBHrc.exe
  2⤵
  PID:9100
- C:\Windows\System\klpyUTp.exe
  C:\Windows\System\klpyUTp.exe
  2⤵
  PID:8980
- C:\Windows\System\Cdyymuk.exe
  C:\Windows\System\Cdyymuk.exe
  2⤵
  PID:9080
- C:\Windows\System\daXqvLl.exe
  C:\Windows\System\daXqvLl.exe
  2⤵
  PID:9172
- C:\Windows\System\SztmtQu.exe
  C:\Windows\System\SztmtQu.exe
  2⤵
  PID:8236
- C:\Windows\System\QyiBKvF.exe
  C:\Windows\System\QyiBKvF.exe
  2⤵
  PID:8052
- C:\Windows\System\xqwCUdC.exe
  C:\Windows\System\xqwCUdC.exe
  2⤵
  PID:9188
- C:\Windows\System\ENhYtxU.exe
  C:\Windows\System\ENhYtxU.exe
  2⤵
  PID:8312
- C:\Windows\System\eYuZDnm.exe
  C:\Windows\System\eYuZDnm.exe
  2⤵
  PID:7556
- C:\Windows\System\UZEtPPz.exe
  C:\Windows\System\UZEtPPz.exe
  2⤵
  PID:8396
- C:\Windows\System\BeEnHVc.exe
  C:\Windows\System\BeEnHVc.exe
  2⤵
  PID:8284
- C:\Windows\System\jHMdGas.exe
  C:\Windows\System\jHMdGas.exe
  2⤵
  PID:8620
- C:\Windows\System\oKhVZwP.exe
  C:\Windows\System\oKhVZwP.exe
  2⤵
  PID:8940
- C:\Windows\System\vYELkEh.exe
  C:\Windows\System\vYELkEh.exe
  2⤵
  PID:8584
- C:\Windows\System\cuGHREw.exe
  C:\Windows\System\cuGHREw.exe
  2⤵
  PID:8648
- C:\Windows\System\IphoGHs.exe
  C:\Windows\System\IphoGHs.exe
  2⤵
  PID:8956
- C:\Windows\System\USAnBsg.exe
  C:\Windows\System\USAnBsg.exe
  2⤵
  PID:9160
- C:\Windows\System\pwDuaGv.exe
  C:\Windows\System\pwDuaGv.exe
  2⤵
  PID:2776
- C:\Windows\System\ipgYfWH.exe
  C:\Windows\System\ipgYfWH.exe
  2⤵
  PID:7756
- C:\Windows\System\VLoUANp.exe
  C:\Windows\System\VLoUANp.exe
  2⤵
  PID:8992
- C:\Windows\System\mkmMdVk.exe
  C:\Windows\System\mkmMdVk.exe
  2⤵
  PID:8348
- C:\Windows\System\dRneRJc.exe
  C:\Windows\System\dRneRJc.exe
  2⤵
  PID:9120
- C:\Windows\System\IWHcXmp.exe
  C:\Windows\System\IWHcXmp.exe
  2⤵
  PID:7848
- C:\Windows\System\qsmJmKP.exe
  C:\Windows\System\qsmJmKP.exe
  2⤵
  PID:9076
- C:\Windows\System\UPHcpZQ.exe
  C:\Windows\System\UPHcpZQ.exe
  2⤵
  PID:9220
- C:\Windows\System\Jgnirgk.exe
  C:\Windows\System\Jgnirgk.exe
  2⤵
  PID:9236
- C:\Windows\System\pClfrUN.exe
  C:\Windows\System\pClfrUN.exe
  2⤵
  PID:9252
- C:\Windows\System\zlYkXGZ.exe
  C:\Windows\System\zlYkXGZ.exe
  2⤵
  PID:9268
- C:\Windows\System\kXWsyGz.exe
  C:\Windows\System\kXWsyGz.exe
  2⤵
  PID:9284
- C:\Windows\System\PzzlgTp.exe
  C:\Windows\System\PzzlgTp.exe
  2⤵
  PID:9300
- C:\Windows\System\xLszLLP.exe
  C:\Windows\System\xLszLLP.exe
  2⤵
  PID:9316
- C:\Windows\System\fOaOoIH.exe
  C:\Windows\System\fOaOoIH.exe
  2⤵
  PID:9332
- C:\Windows\System\pIExYrz.exe
  C:\Windows\System\pIExYrz.exe
  2⤵
  PID:9348
- C:\Windows\System\VHMcVar.exe
  C:\Windows\System\VHMcVar.exe
  2⤵
  PID:9364
- C:\Windows\System\UmYeaNz.exe
  C:\Windows\System\UmYeaNz.exe
  2⤵
  PID:9380
- C:\Windows\System\muhEFJO.exe
  C:\Windows\System\muhEFJO.exe
  2⤵
  PID:9400
- C:\Windows\System\lRuoRed.exe
  C:\Windows\System\lRuoRed.exe
  2⤵
  PID:9416
- C:\Windows\System\cXyVAUk.exe
  C:\Windows\System\cXyVAUk.exe
  2⤵
  PID:9432
- C:\Windows\System\ngKyLxi.exe
  C:\Windows\System\ngKyLxi.exe
  2⤵
  PID:9448
- C:\Windows\System\XXEEoKE.exe
  C:\Windows\System\XXEEoKE.exe
  2⤵
  PID:9464
- C:\Windows\System\JkMPaOY.exe
  C:\Windows\System\JkMPaOY.exe
  2⤵
  PID:9480
- C:\Windows\System\IgNkDxy.exe
  C:\Windows\System\IgNkDxy.exe
  2⤵
  PID:9496
- C:\Windows\System\dcRtdHO.exe
  C:\Windows\System\dcRtdHO.exe
  2⤵
  PID:9512
- C:\Windows\System\WahXsng.exe
  C:\Windows\System\WahXsng.exe
  2⤵
  PID:9528
- C:\Windows\System\NagoDHy.exe
  C:\Windows\System\NagoDHy.exe
  2⤵
  PID:9544
- C:\Windows\System\qxtuPam.exe
  C:\Windows\System\qxtuPam.exe
  2⤵
  PID:9560
- C:\Windows\System\cINXSKg.exe
  C:\Windows\System\cINXSKg.exe
  2⤵
  PID:9576
- C:\Windows\System\IlbQHww.exe
  C:\Windows\System\IlbQHww.exe
  2⤵
  PID:9592
- C:\Windows\System\maucRpZ.exe
  C:\Windows\System\maucRpZ.exe
  2⤵
  PID:9612
- C:\Windows\System\upFBURX.exe
  C:\Windows\System\upFBURX.exe
  2⤵
  PID:9628
- C:\Windows\System\wYlJIjh.exe
  C:\Windows\System\wYlJIjh.exe
  2⤵
  PID:9644
- C:\Windows\System\shBntMD.exe
  C:\Windows\System\shBntMD.exe
  2⤵
  PID:9660
- C:\Windows\System\EyYjZgn.exe
  C:\Windows\System\EyYjZgn.exe
  2⤵
  PID:9676
- C:\Windows\System\zkpYqoY.exe
  C:\Windows\System\zkpYqoY.exe
  2⤵
  PID:9692
- C:\Windows\System\mfbMyNS.exe
  C:\Windows\System\mfbMyNS.exe
  2⤵
  PID:9712
- C:\Windows\System\mTEXcLu.exe
  C:\Windows\System\mTEXcLu.exe
  2⤵
  PID:9728
- C:\Windows\System\UDhmSZF.exe
  C:\Windows\System\UDhmSZF.exe
  2⤵
  PID:9744
- C:\Windows\System\KUYXlTo.exe
  C:\Windows\System\KUYXlTo.exe
  2⤵
  PID:9760
- C:\Windows\System\lNPEqpj.exe
  C:\Windows\System\lNPEqpj.exe
  2⤵
  PID:9776
- C:\Windows\System\nvjhbGW.exe
  C:\Windows\System\nvjhbGW.exe
  2⤵
  PID:9792
- C:\Windows\System\vMSKlTO.exe
  C:\Windows\System\vMSKlTO.exe
  2⤵
  PID:9812
- C:\Windows\System\yHqSwTa.exe
  C:\Windows\System\yHqSwTa.exe
  2⤵
  PID:9828
- C:\Windows\System\STTrzYt.exe
  C:\Windows\System\STTrzYt.exe
  2⤵
  PID:9848
- C:\Windows\System\hGFzNMo.exe
  C:\Windows\System\hGFzNMo.exe
  2⤵
  PID:9864
- C:\Windows\System\IgoRgIZ.exe
  C:\Windows\System\IgoRgIZ.exe
  2⤵
  PID:9880
- C:\Windows\System\MkpxeJO.exe
  C:\Windows\System\MkpxeJO.exe
  2⤵
  PID:9896
- C:\Windows\System\XLfhVdh.exe
  C:\Windows\System\XLfhVdh.exe
  2⤵
  PID:9912
- C:\Windows\System\TJPoACB.exe
  C:\Windows\System\TJPoACB.exe
  2⤵
  PID:9928
- C:\Windows\System\EqkLEkk.exe
  C:\Windows\System\EqkLEkk.exe
  2⤵
  PID:9944
- C:\Windows\System\BOuGYfz.exe
  C:\Windows\System\BOuGYfz.exe
  2⤵
  PID:9960
- C:\Windows\System\FwELwrV.exe
  C:\Windows\System\FwELwrV.exe
  2⤵
  PID:9976
- C:\Windows\System\QZJzMTQ.exe
  C:\Windows\System\QZJzMTQ.exe
  2⤵
  PID:9992
- C:\Windows\System\IepzcNz.exe
  C:\Windows\System\IepzcNz.exe
  2⤵
  PID:10008
- C:\Windows\System\iaGRgkC.exe
  C:\Windows\System\iaGRgkC.exe
  2⤵
  PID:10024
- C:\Windows\System\vUMchxg.exe
  C:\Windows\System\vUMchxg.exe
  2⤵
  PID:10040
- C:\Windows\System\HXAGDbE.exe
  C:\Windows\System\HXAGDbE.exe
  2⤵
  PID:10056
- C:\Windows\System\xcWlYok.exe
  C:\Windows\System\xcWlYok.exe
  2⤵
  PID:10072
- C:\Windows\System\yrBpGlH.exe
  C:\Windows\System\yrBpGlH.exe
  2⤵
  PID:10088
- C:\Windows\System\EUqsCTj.exe
  C:\Windows\System\EUqsCTj.exe
  2⤵
  PID:10116
- C:\Windows\System\csttLXg.exe
  C:\Windows\System\csttLXg.exe
  2⤵
  PID:10132
- C:\Windows\System\qVxFKkG.exe
  C:\Windows\System\qVxFKkG.exe
  2⤵
  PID:10148
- C:\Windows\System\joKAIup.exe
  C:\Windows\System\joKAIup.exe
  2⤵
  PID:10164
- C:\Windows\System\scSPtfw.exe
  C:\Windows\System\scSPtfw.exe
  2⤵
  PID:10180
- C:\Windows\System\McWbeuZ.exe
  C:\Windows\System\McWbeuZ.exe
  2⤵
  PID:10196
- C:\Windows\System\EQwKGXY.exe
  C:\Windows\System\EQwKGXY.exe
  2⤵
  PID:10212
- C:\Windows\System\cjqUMMX.exe
  C:\Windows\System\cjqUMMX.exe
  2⤵
  PID:10228
- C:\Windows\System\NrkzxQn.exe
  C:\Windows\System\NrkzxQn.exe
  2⤵
  PID:8632
- C:\Windows\System\KjiGoOX.exe
  C:\Windows\System\KjiGoOX.exe
  2⤵
  PID:9260
- C:\Windows\System\FjNYTiG.exe
  C:\Windows\System\FjNYTiG.exe
  2⤵
  PID:9324
- C:\Windows\System\zepqSqY.exe
  C:\Windows\System\zepqSqY.exe
  2⤵
  PID:8696
- C:\Windows\System\VysIuCG.exe
  C:\Windows\System\VysIuCG.exe
  2⤵
  PID:8812
- C:\Windows\System\XBKCrEJ.exe
  C:\Windows\System\XBKCrEJ.exe
  2⤵
  PID:9428
- C:\Windows\System\gVzUbPF.exe
  C:\Windows\System\gVzUbPF.exe
  2⤵
  PID:9200
- C:\Windows\System\mGoyfrh.exe
  C:\Windows\System\mGoyfrh.exe
  2⤵
  PID:8668
- C:\Windows\System\WgWGgSB.exe
  C:\Windows\System\WgWGgSB.exe
  2⤵
  PID:8616
- C:\Windows\System\CiPITCS.exe
  C:\Windows\System\CiPITCS.exe
  2⤵
  PID:9472
- C:\Windows\System\oofLFxB.exe
  C:\Windows\System\oofLFxB.exe
  2⤵
  PID:9308
- C:\Windows\System\gZMEugV.exe
  C:\Windows\System\gZMEugV.exe
  2⤵
  PID:9412
- C:\Windows\System\qwtjvti.exe
  C:\Windows\System\qwtjvti.exe
  2⤵
  PID:9444
- C:\Windows\System\unATVzG.exe
  C:\Windows\System\unATVzG.exe
  2⤵
  PID:9504
- C:\Windows\System\oNKgmNy.exe
  C:\Windows\System\oNKgmNy.exe
  2⤵
  PID:9620
- C:\Windows\System\vFdiNQa.exe
  C:\Windows\System\vFdiNQa.exe
  2⤵
  PID:9684
- C:\Windows\System\muRJLgJ.exe
  C:\Windows\System\muRJLgJ.exe
  2⤵
  PID:9508
- C:\Windows\System\qeksPDt.exe
  C:\Windows\System\qeksPDt.exe
  2⤵
  PID:9756
- C:\Windows\System\mrqdDft.exe
  C:\Windows\System\mrqdDft.exe
  2⤵
  PID:9824
- C:\Windows\System\nJprSvv.exe
  C:\Windows\System\nJprSvv.exe
  2⤵
  PID:9600
- C:\Windows\System\SFgeGBW.exe
  C:\Windows\System\SFgeGBW.exe
  2⤵
  PID:9640
- C:\Windows\System\amqbycJ.exe
  C:\Windows\System\amqbycJ.exe
  2⤵
  PID:9772
- C:\Windows\System\hrJWTrr.exe
  C:\Windows\System\hrJWTrr.exe
  2⤵
  PID:9672
- C:\Windows\System\pQbuWjp.exe
  C:\Windows\System\pQbuWjp.exe
  2⤵
  PID:9800
- C:\Windows\System\FLPLpXN.exe
  C:\Windows\System\FLPLpXN.exe
  2⤵
  PID:9808
- C:\Windows\System\xxhwGuf.exe
  C:\Windows\System\xxhwGuf.exe
  2⤵
  PID:9876
- C:\Windows\System\ACbAACJ.exe
  C:\Windows\System\ACbAACJ.exe
  2⤵
  PID:10004
- C:\Windows\System\UTXILIu.exe
  C:\Windows\System\UTXILIu.exe
  2⤵
  PID:10064
- C:\Windows\System\mfgGExQ.exe
  C:\Windows\System\mfgGExQ.exe
  2⤵
  PID:10188
- C:\Windows\System\dUenyUc.exe
  C:\Windows\System\dUenyUc.exe
  2⤵
  PID:10224
- C:\Windows\System\LfYNwIi.exe
  C:\Windows\System\LfYNwIi.exe
  2⤵
  PID:9360
- C:\Windows\System\AICarCH.exe
  C:\Windows\System\AICarCH.exe
  2⤵
  PID:9488
- C:\Windows\System\hvnMhes.exe
  C:\Windows\System\hvnMhes.exe
  2⤵
  PID:10140
- C:\Windows\System\pIkBCLy.exe
  C:\Windows\System\pIkBCLy.exe
  2⤵
  PID:10208
- C:\Windows\System\XcSqnAD.exe
  C:\Windows\System\XcSqnAD.exe
  2⤵
  PID:9408
- C:\Windows\System\sfznOQM.exe
  C:\Windows\System\sfznOQM.exe
  2⤵
  PID:9116
- C:\Windows\System\UPQqzHP.exe
  C:\Windows\System\UPQqzHP.exe
  2⤵
  PID:9652
- C:\Windows\System\DQFRdxf.exe
  C:\Windows\System\DQFRdxf.exe
  2⤵
  PID:9456
- C:\Windows\System\uFWntTs.exe
  C:\Windows\System\uFWntTs.exe
  2⤵
  PID:9584
- C:\Windows\System\JBbJRMU.exe
  C:\Windows\System\JBbJRMU.exe
  2⤵
  PID:9860
- C:\Windows\System\livxuZy.exe
  C:\Windows\System\livxuZy.exe
  2⤵
  PID:9588
- C:\Windows\System\OmDcWgR.exe
  C:\Windows\System\OmDcWgR.exe
  2⤵
  PID:9872
- C:\Windows\System\vQDBGOA.exe
  C:\Windows\System\vQDBGOA.exe
  2⤵
  PID:9820
- C:\Windows\System\KtUuzDE.exe
  C:\Windows\System\KtUuzDE.exe
  2⤵
  PID:9608
- C:\Windows\System\cdNYjuF.exe
  C:\Windows\System\cdNYjuF.exe
  2⤵
  PID:9804
- C:\Windows\System\IDokTfU.exe
  C:\Windows\System\IDokTfU.exe
  2⤵
  PID:10036
- C:\Windows\System\paKHDor.exe
  C:\Windows\System\paKHDor.exe
  2⤵
  PID:9952
- C:\Windows\System\qhMvcCt.exe
  C:\Windows\System\qhMvcCt.exe
  2⤵
  PID:9988
- C:\Windows\System\mUbLvit.exe
  C:\Windows\System\mUbLvit.exe
  2⤵
  PID:10084
- C:\Windows\System\JrUlHoS.exe
  C:\Windows\System\JrUlHoS.exe
  2⤵
  PID:10104
- C:\Windows\System\nziWDto.exe
  C:\Windows\System\nziWDto.exe
  2⤵
  PID:10156
- C:\Windows\System\WpbgBIx.exe
  C:\Windows\System\WpbgBIx.exe
  2⤵
  PID:9340
- C:\Windows\System\SqRJBrb.exe
  C:\Windows\System\SqRJBrb.exe
  2⤵
  PID:10220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EmPyfvF.exe

Filesize
1.8MB

MD5
7e3398f1dc4610cd997ea28cbeb4e308

SHA1
5d52b44a876b85c9c997080d522563d6f3f13e83

SHA256
ddf7c5e0ffc6df8dca1f93c24ea564549e09d7e4a93f2d6a942524192a603080

SHA512
5f307d0e7ebace240679fd06e56c64ed9df7df1961894302dd8d5453fc8c381808fd346aad17e9dfd5c544a23a9cbdd7d0a47cb90f234a19247ae54942c581aa

Download Submit
C:\Windows\system\IkAZAEk.exe

Filesize
1.8MB

MD5
015867b4b89325c7f311b7d9d5f01562

SHA1
ff837dfbc2a14819d78651a223720af22dce2781

SHA256
7715f22bc3815fb13b3dd8e780f6015b953423c596ee3ea77c2318a293ebf8c7

SHA512
c12c3ebd772c295b04a8ea53a91e9be4987a78da6b048d38304d5a9ba49cbe7ed0cd966975b9f1745a67c0d981b06a736dcce5a7c44d3339859ae62df21adbbe

Download Submit
C:\Windows\system\MQjOmtY.exe

Filesize
1.8MB

MD5
d10149bf9186ff5c8900b90deb6076d9

SHA1
aa2f4e3ad8632113fe835041a672d41041ba8957

SHA256
2a0d8fec58ee8f35ce1498d8ef164ce1787150f23b00978a25eda4e75cbde790

SHA512
bd6ce50bec56cbdb23506e02336d1f33c8f72ba9998b931f2d12f63d3c22bd72b5c1917da17575b9ab1b552701f02a8dc881b0425401e3e437eceb3efbaa3c71

Download Submit
C:\Windows\system\NYQaAth.exe

Filesize
1.8MB

MD5
a43a9541254dae86361584583028ad73

SHA1
f277ea959c8a882e56498292b5605bd9fd3c2d52

SHA256
66f10a862d377b11ab5699e2e086477a78d9ba640890a9392919cb1d1f22a872

SHA512
bf6964c572a5782a48592e9c4f24d652f79ccac2dec24a2ecf11a0ec192051317c29c1439a43b27fbae2dd96a15fa094b5eff28ed72c36a922806616cf9da995

Download Submit
C:\Windows\system\SishOEB.exe

Filesize
1.8MB

MD5
cab9224aae8add2a556225c9fe86bc30

SHA1
e05d7c084472e7bcb39b8776bfc1d89f32b25902

SHA256
50cc250f60667e1db82763190924cadf5cb9e464a8e696aad268ef9cb3e1c736

SHA512
0ab0e37f4cddacfa5b1a8d51fac8cbaf7ee94701a241a0455543f5102054f55fc633612cf2f6422f637d703fe1c8e84130365838d4e9c3a655c7c9c25d5ed705

Download Submit
C:\Windows\system\TvsyyMy.exe

Filesize
1.8MB

MD5
655c8c5744263ed689d15b81786a958b

SHA1
a71b8a01b5bbd2cc0604032a06ac1d797aaafd2b

SHA256
0a018d9685ebefd0ff912007154f650825de71784ff74d68203b8bed6dd72b90

SHA512
ab97e2e369244b62cf434bd69f198e39385cdd2023c1fb992f38c14524f4ab4c3bf803cd85f5690c1b01ffb3f609259332249d47b38b7eeba9c20b0014cb21b6

Download Submit
C:\Windows\system\VaGyQBc.exe

Filesize
1.8MB

MD5
8366b1bdcea8aca17988f5f6201050be

SHA1
8cc706873835eb9e4cee43507a94781b414085b2

SHA256
c76bf7969a256a7d69f07e59a8753192b8128d3dcfbd11b2f67c58af7e595d68

SHA512
f0df3bf862f16c3c4e2d951d96a27af234d87490b7713eb6ff3b3f8e1c67677e165760884ab223a8331351a3e9a8732517e048c037edc53d5c2f656c7480ac82

Download Submit
C:\Windows\system\XrWBWvU.exe

Filesize
1.8MB

MD5
f122c4eaa06ac36e11596c42b38c44fe

SHA1
be687a3551bb96286bca0f938e6b6b6b74b899af

SHA256
81e37f3266b6fabf43435f230e131d720e0f179e89738ac3ee42fdb2b490c4dd

SHA512
8f3ec30dcaa410bdf7d28aba822ce4dbb05c1e611da0d9be877e1d6a8689866d27c0f6dbf01324d773419902ffced19575e5adf4113c26742336fceba8f18985

Download Submit
C:\Windows\system\ZWkWgzv.exe

Filesize
1.8MB

MD5
c62ad162345eee4488d2b4d7cd96eed8

SHA1
fe69cbeb096f4b727e1b616e888f52b1382cb957

SHA256
d1978cb077f5e6800ef052063e74d1fa9b6d16b391324ee11adbc23901646f7f

SHA512
5261f540936a4e1ff8e29dbfd0813336d8f80b41d61bea90f5aeb6602a961f9de5b6c4f48a3138d4a9af4ffc5e2db420279c40df3904693c19655cb9056a4e26

Download Submit
C:\Windows\system\ZdZPWrG.exe

Filesize
1.8MB

MD5
e71a66a9b5a70a94594f946d5adeaa98

SHA1
42bf8f7da0c73ea28497c5e046f37ce57dfe6eb5

SHA256
1286d6dff798efffbd7301c04ac764fdece57288c4ba0dbf1fc65b9865bf4fdc

SHA512
8fe2cbbe5f83ca01d793298bcff98cef3e7dfe88d71e9611333db248a847adc9c06749fc8a8a5ad19a2cc9dc77224b9e526a5b78d9dba5503f75c32768e7e34a

Download Submit
C:\Windows\system\ZmPWZFf.exe

Filesize
1.8MB

MD5
d57f7727e0367030f5a6b73cce925ff6

SHA1
d2b2154d087a77022cffa7426429e1db848a1097

SHA256
3d37586549e2ae55fe7c89e4e0745e75e1ea67641e3601c711025ae2f5d288cf

SHA512
8a3b0b842ae8a6588fcf5c13260b66105b43c51cde1a929244f773de81dbb180692215be4030760e7b5c408ecc736d4f32466a2e5422e587a850693da085f231

Download Submit
C:\Windows\system\bEDwgHD.exe

Filesize
1.8MB

MD5
2ace6407c331de37c917a6c30979e5a5

SHA1
d01f3ca62a4d24e0426acf741d93b3465b404f99

SHA256
d842695044de4fc1b192d2b1753a7528a9f3d2821760e3dadb124302eab7036d

SHA512
e8e3cf971388759f3fce0247cacc0b6a937a402fcfb57d2abfb1cad818084cb83ab4913c9fc67feb751f4f4640c6b3b6ca5086362255b719d170a9ef44b33db9

Download Submit
C:\Windows\system\bLUFcFF.exe

Filesize
1.8MB

MD5
a52a3d4a119b54c221444a7fbaa9e0e5

SHA1
9114c8210f239eab4e20e29607047a89d37a915d

SHA256
3ea9b6163b4b3d6b908b5ac418da5ebe8865a9f27868180031b802a76ae767a7

SHA512
814c71db213b4dc46fba787957e4a2ad1b8fe259813a872914c8ee174f4bee09bfbd596add324dbf7a0e1c62d8ba85572145f70850bc6359d092ff575f6a5227

Download Submit
C:\Windows\system\bcgEMrd.exe

Filesize
1.8MB

MD5
370313b4ae3e1344218d5605ac59f73c

SHA1
53831efb667a8d88e44c5fb97507f406dded41e9

SHA256
70b4fd6a0ac433020c0813ad21499d8ae101c05654d3f60291dc3f1a4a07e7ef

SHA512
4b705a9a799a6758bc4781ec6fe24cdac36a531e0844c7d2bf4a18a327632907d0fc4965d6e4c419b7a3f208bebb8c8bbb110225c4dc653df973ede26e966042

Download Submit
C:\Windows\system\dPoCRhk.exe

Filesize
1.8MB

MD5
ad451678002ac31962d7817524fda723

SHA1
f5ab7ba970eec3c0714deb058713548dcbeb9594

SHA256
7416db87d79fd7ff8c105481274fcc2b282ff28874d4d0449c370a1b406ff9ab

SHA512
227d29e9994b11ab6f33ededa9890a5aee6295c53e79b6fb03313f885fa372ebf591f1bd23694efcc377742fb74ae3b3b7ff1cd0969b81d1e48522f5811e9f7a

Download Submit
C:\Windows\system\eDSLazi.exe

Filesize
1.8MB

MD5
f5a1f1dbed371e11bf9f695edcb8bc75

SHA1
df2fd34498f05754477c9c6269fc36a7baedc3a7

SHA256
1bd5f114d9b91e525a6d4c3c45bf132bec4b54d85cec5f326c3ad06b1839d34c

SHA512
b475c103cee439f1ee18cfc44dcdd7c543f9212b6cb1fb8e2e47e07a62d3bfb5285d0c7b30e4d1811489c35efac2aa6d7da89ce4c881a28db7bdd0ea610034c4

Download Submit
C:\Windows\system\hchlvTC.exe

Filesize
1.8MB

MD5
0cc94a1eb8245ccce78609340086960d

SHA1
5eea09adcb5cb222bbc2c9bd9ad080a98fec8e99

SHA256
c67404f6f97e3f4a80850c40bbb1caf68385708b33109811c4902455eed3a2c4

SHA512
12ea88532d85274f5d9e8c8c967d96f9615734582eff23de57ec5a8247c1091edaefc27642eb9f5c247f496f8e471a4c09e9fa905765f957797c47690e5406be

Download Submit
C:\Windows\system\jzmMrKz.exe

Filesize
1.8MB

MD5
47ff9b3596f252c8ce0265ecc709afce

SHA1
7d953a99b4b64e007ba0dd80d39ee830ebcf2f5b

SHA256
27c6702fc751e17deccbb397486a6d4df2e3c9e70fb4e32493c77247f0aa719c

SHA512
0b91dbcf9be3cb3063fc052a25985f46da0e7b2d7e887c718df4c44b8d35054ebbd01cea9b261f1480fff964ea99d69377d2f55336cae18dbf6f10ea4e63c2e5

Download Submit
C:\Windows\system\mXsDZBc.exe

Filesize
1.8MB

MD5
702415e11ad37e0c2ded4fa57869bd83

SHA1
5d98de5148116878a6adcf33bb8446d59f3ab008

SHA256
94926fbb88f41a1093a0c69a541a837e9fa4f34a1aac68ae82084f36d73b4038

SHA512
b04efb68275d3d7244c904beec3e7c21e8d715806b3d199024591d35d5642e297bedf41a118299072ab9981addee1e876ef78ab595e2c1244449355b072fc4a0

Download Submit
C:\Windows\system\nUQSrQM.exe

Filesize
1.8MB

MD5
b297b61cc1a806147ad59d1d2b939e79

SHA1
d7376dc48c751d682eec5ff94a9b264cd3cb3c49

SHA256
82f37eeff816386261cfcbf684bb2b4f263c1f7077d54af2a754417d63b1c730

SHA512
e6525cadfbb4b1fd291cf0b9219d89c638b9b6edfeb226e123bcd37714acaafd50e4684d8cc6bc22a975056d18a705f4dffaf8b350c6838d183976a184dc2f41

Download Submit
C:\Windows\system\oDfoxGq.exe

Filesize
1.8MB

MD5
522b0b31c5e315d97de40cff072de4d1

SHA1
4eac77f1cd7100ea0bee138df54608dcc2ae7743

SHA256
cf0a394d78f35f500431c58de1b71afce2e6a4212a82189bb2f99f40686b8c73

SHA512
91272d558378f863bf081ef48c4faee00d571bff978a5513d29bad6d036daa682bcae58292ad4bc8ecc17a31bf2cffdfe0b386704b063928f35eb8005f33f3c8

Download Submit
C:\Windows\system\ouGfvuw.exe

Filesize
1.8MB

MD5
72810e8bad9497f6151ffefcc3c03a8f

SHA1
4175d715a791bd29177d9e4d08d0391bc6ede6ce

SHA256
e66ab8eda1e5cadc81709d0af6784203433143e66c174b29e4df5cec8f51a9be

SHA512
3ceb201e77c0914a2dd10d556edeac75fe4a78be2429b04e76beeadf6248421f0f9261375e798ad4442e85508b9b5cbb937aa545ffa3342442fab90c9a9b87fe

Download Submit
C:\Windows\system\pPLAznp.exe

Filesize
1.8MB

MD5
7fdeba71a909ebd56e36189a195d7f6d

SHA1
8d1d59c550b023648d039dee15d08529638d2ecc

SHA256
46ecac5ba527ffbfde13bc7547971c8bcaa7a977a8dcb2b628f021acae0f80b8

SHA512
d737c25109043190c5ba2868d1d486e29acf96223aa0ee34a96923d3ffc5a63311c3abd37f72d33c731e0f2e2de54bf5b4045044176e6603f73b02403eba9358

Download Submit
C:\Windows\system\uuDsQBT.exe

Filesize
1.8MB

MD5
061f74e33be976166e700b7cd2ec05e9

SHA1
d4b7d6c6a03c1e1a78d5e74ffd9f34b1c084d58a

SHA256
be459d02a7adac155341a5d9b2edf20f4da734dd938041cab71654c4b23e8750

SHA512
ec54f237882599501dbd0cbe944057aca3bb7d61b1ef36ca20595ea0f071aecd383523f06c55173b47b4ffa6179a1e8769c486e44ffecf9031c9d9201ceb5c29

Download Submit
\Windows\system\BblloEa.exe

Filesize
1.8MB

MD5
2074180041b9c8e01ee7f67e50d45deb

SHA1
e636a8075e31b0b9b2fb8ccd6f3926689a23bf8b

SHA256
ba4b1fd3388f7b4acc7bd23e51caaebe7650337c6fcf62299ef4641fde9ddb8b

SHA512
7f2087ccd7f7ab6228db28f6597ef08e73baec1b329a849db2b605011dde347d58326bb10331d41119208570ea4d492edd21b64f47522158fa25bba96428b513

Download Submit
\Windows\system\EWHGrdP.exe

Filesize
1.8MB

MD5
2585c998b62304a6e5e4726f55bc4ef5

SHA1
66e6eb1b96051292cf6a160ab5e104b7bf59d378

SHA256
4537423985638d0cfcdc94acc7c02a53802f596b4b29e1e40375403f336a449d

SHA512
c1f4b5df4112848b13e510023c5e0d46d43f281243c18abaa43e7a7554908aa07259645406c892e241d4ee7fed9d364da52ecfd2828825c2f29c1fd3cb42d61e

Download Submit
\Windows\system\LzvUQiB.exe

Filesize
1.8MB

MD5
8c243b317b88d7771bcc84217b44f1d9

SHA1
a0c796a82b2ab42f6edbcf2fa0ba75e08ff9be02

SHA256
6ba84f9e0a2b4421ef6afb5f09417d459fa84ca4030f889554f463092e4fe91b

SHA512
e0aecc4c6ab3597e3145e700997d3d9dbde9b61db4442a8dd5fc52d30a4cb34ffa77628d761ccb27de5893905248b1677516c2eac94dbacc30d82742bc53fbf0

Download Submit
\Windows\system\QnJdyax.exe

Filesize
1.8MB

MD5
3347798bd212d561a9b8931b473b0288

SHA1
55397fb89ee392348507f81615efb10af8db58c3

SHA256
ad186bdb0eb1e079b4e18063a2155a96c04eaf0fb03d8f90751bc185b4c35cc4

SHA512
58a59711e24c557366fa40ba1df7d95fb9eea7ffa6a639e69cd5b30c36d6812b0a71e88d0475674294fc5d64fa516d14ab1bc3760880bbfab443c70c4652f44b

Download Submit
\Windows\system\QyPPDTg.exe

Filesize
1.8MB

MD5
2b3bc101a200fa7054d288e9294bd49a

SHA1
517480220652b3a297e64598647c38f6f7dd0d2e

SHA256
b873ce7420afab22de80986cedf50f2025bac7514a7025267e7ffaf9e84a34e9

SHA512
e77ce10365b1e62ac3ab29849d761a906a6d8984ce1685cf34508a68b08013929aaaa8c625c7a04e746eb69cd7282bcd60be01860ba86cc5f3b9cc61dad22536

Download Submit
\Windows\system\WOSdWHB.exe

Filesize
1.8MB

MD5
e70d77a4484de8ddc4fb9525aca415ae

SHA1
0081d5d91740b505ea23972e353017551ae6c0f8

SHA256
2ed356acbaaa93d500098fc7b6d5cc1e9ffd799a833001bed4df40a8c508fbae

SHA512
9eaad4845faf386b0ae35aeed7b8b97bdfdbe60a3c88501e5d6527e24f18087740d0d4b268186e04a415a424e48098d01ab08765c45dacf26b2b02475c0167c6

Download Submit
\Windows\system\ZRNUfSj.exe

Filesize
1.8MB

MD5
794f8f419ac069c76f48cd05e397736a

SHA1
49913d4bb3b536d6c1194dd2163fcf4a467c1c02

SHA256
513b9f1a6844c21c99d80398d872bb006bf342d7d199a45b8e8ee7e70305e603

SHA512
dc59c06e0282fd84e76b6d693be0a31ec853749dbc6e940a016c1dccb6c17bbb3d544341459d7343dc5eda52c353f5ff7cd1a3f47e38faa73a1cdff55701fee4

Download Submit
\Windows\system\nBWnEuf.exe

Filesize
1.8MB

MD5
1937811f19fb9d4b3f54f27fc43b5d4e

SHA1
a713d220f4b8844f5ac26c3153e7d9cf1f04bb15

SHA256
a79e5cef7d4a4a10df5c3da73e39f6ef4b97338624d6244944b0c4a2e90fd991

SHA512
ebaf7aa3f3d806ebed9b055eea17f7a6c31a48bc84598338170eac8bf3f00c8637d8ade67c6cb4d4186444351c3dfb33dcda3abaa659f95220bb22e14dc61592

Download Submit
\Windows\system\pxaykJc.exe

Filesize
1.8MB

MD5
7a3b232fb9faecda5e0e36169b587d1c

SHA1
72cf448132f66f0d0c99401395b32b3bf817cf35

SHA256
6114c03bb2f32b8f80346d44b3e2d40682327714f010db29bc91e30fd4634af4

SHA512
2da8ecfda208a40fb2a7a168e7ffd9a7ec763f5020fb6ae2a72a64c01938f81f4496c2cbc82bcbcb7eaf3c4ccb4dd041ac40348ad2ce18d4dd3729cf79bc7ae3

Download Submit
\Windows\system\qODSmPL.exe

Filesize
1.8MB

MD5
ff081b42ad51a335d32916b0f049caae

SHA1
3a07be3da50b30c7c70d9799fcf87ee1e2382147

SHA256
0a4418b06a0a5cfa611ab188dd023dcd8de8bdabf45211c5122b7b833a405251

SHA512
b2571f48b9bcef9e55acebc2f06afad6b394be68e7ca3708623dbee11e59476d6a8e2107e52e6fe7873e6923297b40f6ecca0f59d9ffcdc76c955e82e518a69e

Download Submit
\Windows\system\rShTqmO.exe

Filesize
1.8MB

MD5
7e2c9e8be8c199b91f14c5bb88a859ba

SHA1
dd6b1bc59028e3b0f5146d5a60ffc9d1f071cd00

SHA256
c7dbdc2f82bf1f6867a03262bd88bc09150540c45a2298757d48e1d4faa09689

SHA512
ccee4357aa21b7278d23a02f14be27bf535b08387be00591d0f97fa18a25af6b152562cc4356dfd00caa0ce00ec02d85a1f211220f8dfed2230273ccde166811

Download Submit
\Windows\system\wpHZqso.exe

Filesize
1.8MB

MD5
ef6911293d6e7b7c331684720e9402ea

SHA1
9b1282d7e67392142004f8729e1d9d92fada67f0

SHA256
150c1ae25886ac9ec96b7f75d2c19486780ec5ba2dd9981cf07b63c7f46e21fb

SHA512
4751649634b53da8f0dfa328036eed285b69f6064ebf1bf1fd362b0f35943c697e9195093359308808842e55fe5f7da4b11436126d3f2ce9e3bf0e47a2634cfa

Download Submit
memory/2448-113-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2452-99-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2468-115-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-35-0x0000000002790000-0x0000000002810000-memory.dmp

Filesize
512KB

Download
memory/2512-109-0x0000000002790000-0x0000000002810000-memory.dmp

Filesize
512KB

Download
memory/2512-63-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/2512-275-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-47-0x000000001B650000-0x000000001B932000-memory.dmp

Filesize
2.9MB

Download
memory/2512-39-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2512-43-0x0000000002790000-0x0000000002810000-memory.dmp

Filesize
512KB

Download
memory/2512-33-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2520-98-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2652-60-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2668-53-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-118-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-117-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2848-92-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-7-0x0000000002F60000-0x0000000003352000-memory.dmp

Filesize
3.9MB

Download
memory/2848-110-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-111-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2848-122-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2848-90-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2848-119-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2848-120-0x0000000003520000-0x0000000003912000-memory.dmp

Filesize
3.9MB

Download
memory/2848-121-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-0-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2976-16-0x000000013FA70000-0x000000013FE62000-memory.dmp

Filesize
3.9MB

Download