xmrig | 1c20e92ca6b9df9e8740e36c0e492ddef7c200c54c3480ec0cbe248d5486777e

Analysis

max time kernel
21s
max time network
30s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
Size

2.8MB
MD5

0187ab65b1246b8adc17751e738ffc17
SHA1

d18c27498a55ee7fbd4d7cc3d560d5eed528b612
SHA256

1c20e92ca6b9df9e8740e36c0e492ddef7c200c54c3480ec0cbe248d5486777e
SHA512

f86b445716c75571c86d412c357ec8285a90a4327505e5c39e28879623e31f246681dd60e943c35162fd9478f00b416196376265c87118f0cebf269c492139f9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/I:NABh

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2520-156-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2636-159-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2728-165-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2560-162-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2692-161-0x000000013F180000-0x000000013F572000-memory.dmp	xmrig
behavioral1/memory/2196-158-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2644-153-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2748-151-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2744-35-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/1656-14-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2072-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1656	XUyhPHZ.exe
2072	bvMFoAr.exe
2744	deLGvUy.exe
2728	vXyCXgI.exe
2748	xvRnkay.exe
2644	LgjadPn.exe
2520	EkpMNPd.exe
2196	CndcemL.exe
2636	BtXcZsJ.exe
2692	dIJUtJe.exe
2560	diasYgd.exe
1840	rTKEdRC.exe
2768	auguBuR.exe
2760	rjFRcJV.exe
2880	weZiPXf.exe
792	fDRqNRN.exe
2904	lautblh.exe
1808	BGHvJEP.exe
288	RTDPDAw.exe
2160	fpAVJcu.exe
1572	fzMAvsQ.exe
2980	XPNFKIB.exe
1604	IdZkWfm.exe
2608	yUbsiPE.exe
2556	AHgANco.exe
1852	ZVFPMyt.exe
2944	TDlcihy.exe
656	IYgKaWd.exe
2992	foWUpsY.exe
2416	whHXkfB.exe
864	QMUzXFt.exe
2284	jKAicyq.exe
1316	VIPIwLV.exe
1976	RkqeNoD.exe
988	StAVsRY.exe
2372	saospay.exe
900	pvBFiYZ.exe
2384	uBxcVxX.exe
1592	wuXtQIM.exe
3060	UFgnwwY.exe
2956	cVXOxNs.exe
884	qByQOPf.exe
2008	ncyxdFz.exe
1584	pHjkJnK.exe
3040	KfNRZtL.exe
2628	xeVjiNd.exe
2536	nKQiyel.exe
3012	AqxLOJp.exe
2564	FCmaLSl.exe
2640	qzvIyWu.exe
1524	EYCygPM.exe
2168	vkQZXFC.exe
2064	XaeRIJY.exe
1504	bPAjIEl.exe
2088	QPkaUiB.exe
1828	GQhByrk.exe
1520	AVQHxQP.exe
848	nDrCECI.exe
1736	WhsuVqo.exe
1128	CNHHEOR.exe
2348	gwfBoSG.exe
1760	LOvyxDS.exe
1360	DGIODPM.exe
2224	ZeEbiyo.exe

Loads dropped DLL 64 IoCs

pid	Process
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2484-0-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x000b00000001228a-3.dat	upx
behavioral1/files/0x00360000000132f2-7.dat	upx
behavioral1/files/0x0008000000013a85-40.dat	upx
behavioral1/files/0x0007000000014525-47.dat	upx
behavioral1/files/0x00060000000145d4-57.dat	upx
behavioral1/files/0x0009000000013a65-61.dat	upx
behavioral1/files/0x0006000000014730-71.dat	upx
behavioral1/files/0x000600000001475f-84.dat	upx
behavioral1/files/0x0006000000014a29-91.dat	upx
behavioral1/files/0x00060000000148af-85.dat	upx
behavioral1/files/0x0006000000014c0b-99.dat	upx
behavioral1/files/0x000600000001523e-121.dat	upx
behavioral1/files/0x00060000000150aa-115.dat	upx
behavioral1/files/0x0006000000015b37-144.dat	upx
behavioral1/memory/2520-156-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/memory/2636-159-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/files/0x0006000000015a15-139.dat	upx
behavioral1/files/0x0006000000015cc2-190.dat	upx
behavioral1/files/0x0006000000015c9b-184.dat	upx
behavioral1/files/0x0006000000015b72-168.dat	upx
behavioral1/memory/2728-165-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/memory/2560-162-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2692-161-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/files/0x0006000000015bb5-172.dat	upx
behavioral1/memory/2196-158-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2644-153-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2748-151-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x000600000001543a-130.dat	upx
behavioral1/files/0x00060000000155e8-134.dat	upx
behavioral1/files/0x0006000000014fac-109.dat	upx
behavioral1/files/0x0006000000015077-114.dat	upx
behavioral1/files/0x0006000000014d0f-104.dat	upx
behavioral1/files/0x000600000001474b-79.dat	upx
behavioral1/files/0x00060000000146a7-69.dat	upx
behavioral1/files/0x00060000000145c9-50.dat	upx
behavioral1/files/0x00090000000134f5-46.dat	upx
behavioral1/files/0x000800000001451d-41.dat	upx
behavioral1/files/0x00130000000054a8-36.dat	upx
behavioral1/memory/2744-35-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/memory/1656-14-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2072-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0009000000013457-9.dat	upx
behavioral1/files/0x0006000000015ca9-187.dat	upx
behavioral1/files/0x0006000000015c91-177.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\fzMAvsQ.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\pUoiadt.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\toNvtIb.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\ActBvtJ.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\dePgEkJ.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\kRTFsfX.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\sFZNSlY.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\ZDtBNgZ.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\teuzKNu.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\NvGDNLk.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\tsubAJW.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\TmXRpLw.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\heVeedq.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\EQsHRtc.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\HBfGRKn.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\kgjuwtk.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\pugapXV.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\SriBGYD.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\WhsuVqo.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\sRDYOGD.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\DnHAIww.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\uXnWoeo.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\BrcaeQX.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\tYXvsGL.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\MGvGuUJ.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\OyXIeAe.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\xYdrgXN.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\eDmGNIz.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\dLHEjRf.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\HNarLZK.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\NArhXiw.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\NCjoBLx.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\OUFLHdL.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\MQbYGzW.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\SZFdgUl.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\toHzcMv.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\TlsBRvA.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\GqtPkQr.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\PTAPcHs.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\FdasKhm.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\AwEdRpx.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\CCajgFy.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\JvLEBOK.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\qLTLFHx.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\oYxcpmL.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\srykOmp.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\nhBqlcu.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\bPAjIEl.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\JlpjQra.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\LPRKshP.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\diLobwR.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\RTDPDAw.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\KXPgjgY.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\RFSIkrL.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\WlxOEXU.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\obGXhrc.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\LyoDTKC.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\XjEexbv.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\nZxlYKm.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\ZRZrmma.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\pwApbDm.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\YydkQSz.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\NJFFSBa.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
File created	C:\Windows\System\zhOiDIV.exe	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	powershell.exe
Token: SeLockMemoryPrivilege	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 2176	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	29
PID 2484 wrote to memory of 2176	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	29
PID 2484 wrote to memory of 2176	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	29
PID 2484 wrote to memory of 1656	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	30
PID 2484 wrote to memory of 1656	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	30
PID 2484 wrote to memory of 1656	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	30
PID 2484 wrote to memory of 2072	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2072	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2072	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	31
PID 2484 wrote to memory of 2744	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	32
PID 2484 wrote to memory of 2744	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	32
PID 2484 wrote to memory of 2744	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	32
PID 2484 wrote to memory of 2644	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2644	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2644	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	33
PID 2484 wrote to memory of 2728	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	34
PID 2484 wrote to memory of 2728	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	34
PID 2484 wrote to memory of 2728	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	34
PID 2484 wrote to memory of 2636	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	35
PID 2484 wrote to memory of 2636	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	35
PID 2484 wrote to memory of 2636	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	35
PID 2484 wrote to memory of 2748	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	36
PID 2484 wrote to memory of 2748	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	36
PID 2484 wrote to memory of 2748	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	36
PID 2484 wrote to memory of 2692	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2692	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2692	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	37
PID 2484 wrote to memory of 2520	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	38
PID 2484 wrote to memory of 2520	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	38
PID 2484 wrote to memory of 2520	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	38
PID 2484 wrote to memory of 2560	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	39
PID 2484 wrote to memory of 2560	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	39
PID 2484 wrote to memory of 2560	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	39
PID 2484 wrote to memory of 2196	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	40
PID 2484 wrote to memory of 2196	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	40
PID 2484 wrote to memory of 2196	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	40
PID 2484 wrote to memory of 1840	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	41
PID 2484 wrote to memory of 1840	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	41
PID 2484 wrote to memory of 1840	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	41
PID 2484 wrote to memory of 2768	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	42
PID 2484 wrote to memory of 2768	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	42
PID 2484 wrote to memory of 2768	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	42
PID 2484 wrote to memory of 2760	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	43
PID 2484 wrote to memory of 2760	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	43
PID 2484 wrote to memory of 2760	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	43
PID 2484 wrote to memory of 2880	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	44
PID 2484 wrote to memory of 2880	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	44
PID 2484 wrote to memory of 2880	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	44
PID 2484 wrote to memory of 2904	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	45
PID 2484 wrote to memory of 2904	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	45
PID 2484 wrote to memory of 2904	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	45
PID 2484 wrote to memory of 792	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	46
PID 2484 wrote to memory of 792	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	46
PID 2484 wrote to memory of 792	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	46
PID 2484 wrote to memory of 1808	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	47
PID 2484 wrote to memory of 1808	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	47
PID 2484 wrote to memory of 1808	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	47
PID 2484 wrote to memory of 288	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	48
PID 2484 wrote to memory of 288	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	48
PID 2484 wrote to memory of 288	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	48
PID 2484 wrote to memory of 2160	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	49
PID 2484 wrote to memory of 2160	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	49
PID 2484 wrote to memory of 2160	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	49
PID 2484 wrote to memory of 1572	2484	0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0187ab65b1246b8adc17751e738ffc17_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\XUyhPHZ.exe
  C:\Windows\System\XUyhPHZ.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\bvMFoAr.exe
  C:\Windows\System\bvMFoAr.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\deLGvUy.exe
  C:\Windows\System\deLGvUy.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\LgjadPn.exe
  C:\Windows\System\LgjadPn.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\vXyCXgI.exe
  C:\Windows\System\vXyCXgI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\BtXcZsJ.exe
  C:\Windows\System\BtXcZsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\xvRnkay.exe
  C:\Windows\System\xvRnkay.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\dIJUtJe.exe
  C:\Windows\System\dIJUtJe.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\EkpMNPd.exe
  C:\Windows\System\EkpMNPd.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\diasYgd.exe
  C:\Windows\System\diasYgd.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\CndcemL.exe
  C:\Windows\System\CndcemL.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\rTKEdRC.exe
  C:\Windows\System\rTKEdRC.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\auguBuR.exe
  C:\Windows\System\auguBuR.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\rjFRcJV.exe
  C:\Windows\System\rjFRcJV.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\weZiPXf.exe
  C:\Windows\System\weZiPXf.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\lautblh.exe
  C:\Windows\System\lautblh.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\fDRqNRN.exe
  C:\Windows\System\fDRqNRN.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\BGHvJEP.exe
  C:\Windows\System\BGHvJEP.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\RTDPDAw.exe
  C:\Windows\System\RTDPDAw.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\fpAVJcu.exe
  C:\Windows\System\fpAVJcu.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\fzMAvsQ.exe
  C:\Windows\System\fzMAvsQ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\IdZkWfm.exe
  C:\Windows\System\IdZkWfm.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\XPNFKIB.exe
  C:\Windows\System\XPNFKIB.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\yUbsiPE.exe
  C:\Windows\System\yUbsiPE.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\AHgANco.exe
  C:\Windows\System\AHgANco.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ZVFPMyt.exe
  C:\Windows\System\ZVFPMyt.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\TDlcihy.exe
  C:\Windows\System\TDlcihy.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\IYgKaWd.exe
  C:\Windows\System\IYgKaWd.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\foWUpsY.exe
  C:\Windows\System\foWUpsY.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\whHXkfB.exe
  C:\Windows\System\whHXkfB.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\QMUzXFt.exe
  C:\Windows\System\QMUzXFt.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\CNHHEOR.exe
  C:\Windows\System\CNHHEOR.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\jKAicyq.exe
  C:\Windows\System\jKAicyq.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\gwfBoSG.exe
  C:\Windows\System\gwfBoSG.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\VIPIwLV.exe
  C:\Windows\System\VIPIwLV.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\LOvyxDS.exe
  C:\Windows\System\LOvyxDS.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\RkqeNoD.exe
  C:\Windows\System\RkqeNoD.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\DGIODPM.exe
  C:\Windows\System\DGIODPM.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\StAVsRY.exe
  C:\Windows\System\StAVsRY.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\ZeEbiyo.exe
  C:\Windows\System\ZeEbiyo.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\saospay.exe
  C:\Windows\System\saospay.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\BctTtrh.exe
  C:\Windows\System\BctTtrh.exe
  2⤵
  PID:2208
- C:\Windows\System\pvBFiYZ.exe
  C:\Windows\System\pvBFiYZ.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\QYWTVgA.exe
  C:\Windows\System\QYWTVgA.exe
  2⤵
  PID:2180
- C:\Windows\System\uBxcVxX.exe
  C:\Windows\System\uBxcVxX.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\FKfYZqM.exe
  C:\Windows\System\FKfYZqM.exe
  2⤵
  PID:1856
- C:\Windows\System\wuXtQIM.exe
  C:\Windows\System\wuXtQIM.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\lWEApcs.exe
  C:\Windows\System\lWEApcs.exe
  2⤵
  PID:2080
- C:\Windows\System\UFgnwwY.exe
  C:\Windows\System\UFgnwwY.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\YTFSxTO.exe
  C:\Windows\System\YTFSxTO.exe
  2⤵
  PID:880
- C:\Windows\System\cVXOxNs.exe
  C:\Windows\System\cVXOxNs.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\GVuufBB.exe
  C:\Windows\System\GVuufBB.exe
  2⤵
  PID:2488
- C:\Windows\System\qByQOPf.exe
  C:\Windows\System\qByQOPf.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\QvQeiBw.exe
  C:\Windows\System\QvQeiBw.exe
  2⤵
  PID:1848
- C:\Windows\System\ncyxdFz.exe
  C:\Windows\System\ncyxdFz.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\nAoPMYq.exe
  C:\Windows\System\nAoPMYq.exe
  2⤵
  PID:2220
- C:\Windows\System\pHjkJnK.exe
  C:\Windows\System\pHjkJnK.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\WWFiESb.exe
  C:\Windows\System\WWFiESb.exe
  2⤵
  PID:1688
- C:\Windows\System\KfNRZtL.exe
  C:\Windows\System\KfNRZtL.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\WaYtVgM.exe
  C:\Windows\System\WaYtVgM.exe
  2⤵
  PID:2128
- C:\Windows\System\xeVjiNd.exe
  C:\Windows\System\xeVjiNd.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dLHEjRf.exe
  C:\Windows\System\dLHEjRf.exe
  2⤵
  PID:2784
- C:\Windows\System\nKQiyel.exe
  C:\Windows\System\nKQiyel.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\UhgEmwr.exe
  C:\Windows\System\UhgEmwr.exe
  2⤵
  PID:2568
- C:\Windows\System\AqxLOJp.exe
  C:\Windows\System\AqxLOJp.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\aZpZRTi.exe
  C:\Windows\System\aZpZRTi.exe
  2⤵
  PID:2804
- C:\Windows\System\FCmaLSl.exe
  C:\Windows\System\FCmaLSl.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\MPDOlET.exe
  C:\Windows\System\MPDOlET.exe
  2⤵
  PID:2840
- C:\Windows\System\qzvIyWu.exe
  C:\Windows\System\qzvIyWu.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\flkEKZt.exe
  C:\Windows\System\flkEKZt.exe
  2⤵
  PID:1020
- C:\Windows\System\EYCygPM.exe
  C:\Windows\System\EYCygPM.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\XIHJdbR.exe
  C:\Windows\System\XIHJdbR.exe
  2⤵
  PID:1796
- C:\Windows\System\vkQZXFC.exe
  C:\Windows\System\vkQZXFC.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\zRIbCqP.exe
  C:\Windows\System\zRIbCqP.exe
  2⤵
  PID:1844
- C:\Windows\System\XaeRIJY.exe
  C:\Windows\System\XaeRIJY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\qeZRjUA.exe
  C:\Windows\System\qeZRjUA.exe
  2⤵
  PID:2332
- C:\Windows\System\bPAjIEl.exe
  C:\Windows\System\bPAjIEl.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\aZaUHiB.exe
  C:\Windows\System\aZaUHiB.exe
  2⤵
  PID:1432
- C:\Windows\System\QPkaUiB.exe
  C:\Windows\System\QPkaUiB.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\XieFmxU.exe
  C:\Windows\System\XieFmxU.exe
  2⤵
  PID:2472
- C:\Windows\System\GQhByrk.exe
  C:\Windows\System\GQhByrk.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\CJnsucg.exe
  C:\Windows\System\CJnsucg.exe
  2⤵
  PID:844
- C:\Windows\System\AVQHxQP.exe
  C:\Windows\System\AVQHxQP.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\RVCUEkQ.exe
  C:\Windows\System\RVCUEkQ.exe
  2⤵
  PID:1036
- C:\Windows\System\nDrCECI.exe
  C:\Windows\System\nDrCECI.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\gJIKRAS.exe
  C:\Windows\System\gJIKRAS.exe
  2⤵
  PID:2964
- C:\Windows\System\WhsuVqo.exe
  C:\Windows\System\WhsuVqo.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\pUoiadt.exe
  C:\Windows\System\pUoiadt.exe
  2⤵
  PID:1140
- C:\Windows\System\LZdbBbq.exe
  C:\Windows\System\LZdbBbq.exe
  2⤵
  PID:536
- C:\Windows\System\CFfdfpC.exe
  C:\Windows\System\CFfdfpC.exe
  2⤵
  PID:2060
- C:\Windows\System\CCajgFy.exe
  C:\Windows\System\CCajgFy.exe
  2⤵
  PID:832
- C:\Windows\System\zXtxeiT.exe
  C:\Windows\System\zXtxeiT.exe
  2⤵
  PID:1940
- C:\Windows\System\JlpjQra.exe
  C:\Windows\System\JlpjQra.exe
  2⤵
  PID:2104
- C:\Windows\System\DYKsVSi.exe
  C:\Windows\System\DYKsVSi.exe
  2⤵
  PID:2776
- C:\Windows\System\PmVMKRT.exe
  C:\Windows\System\PmVMKRT.exe
  2⤵
  PID:2244
- C:\Windows\System\srykOmp.exe
  C:\Windows\System\srykOmp.exe
  2⤵
  PID:1732
- C:\Windows\System\WxfQEuv.exe
  C:\Windows\System\WxfQEuv.exe
  2⤵
  PID:2936
- C:\Windows\System\JlZNmMj.exe
  C:\Windows\System\JlZNmMj.exe
  2⤵
  PID:2656
- C:\Windows\System\xHYBZFq.exe
  C:\Windows\System\xHYBZFq.exe
  2⤵
  PID:1356
- C:\Windows\System\EyKpRTX.exe
  C:\Windows\System\EyKpRTX.exe
  2⤵
  PID:2752
- C:\Windows\System\fYRqQXu.exe
  C:\Windows\System\fYRqQXu.exe
  2⤵
  PID:1484
- C:\Windows\System\wUVeBbE.exe
  C:\Windows\System\wUVeBbE.exe
  2⤵
  PID:2148
- C:\Windows\System\jprZsyR.exe
  C:\Windows\System\jprZsyR.exe
  2⤵
  PID:632
- C:\Windows\System\XLWREHs.exe
  C:\Windows\System\XLWREHs.exe
  2⤵
  PID:2872
- C:\Windows\System\JuqjNQO.exe
  C:\Windows\System\JuqjNQO.exe
  2⤵
  PID:1492
- C:\Windows\System\OHHtHKX.exe
  C:\Windows\System\OHHtHKX.exe
  2⤵
  PID:1660
- C:\Windows\System\BiEpDge.exe
  C:\Windows\System\BiEpDge.exe
  2⤵
  PID:2592
- C:\Windows\System\lmjNpXN.exe
  C:\Windows\System\lmjNpXN.exe
  2⤵
  PID:1252
- C:\Windows\System\XtSbBqJ.exe
  C:\Windows\System\XtSbBqJ.exe
  2⤵
  PID:2704
- C:\Windows\System\vcmVKnb.exe
  C:\Windows\System\vcmVKnb.exe
  2⤵
  PID:3032
- C:\Windows\System\sRDYOGD.exe
  C:\Windows\System\sRDYOGD.exe
  2⤵
  PID:2392
- C:\Windows\System\qSMTnGC.exe
  C:\Windows\System\qSMTnGC.exe
  2⤵
  PID:1992
- C:\Windows\System\zEUplQl.exe
  C:\Windows\System\zEUplQl.exe
  2⤵
  PID:3056
- C:\Windows\System\CkyorSl.exe
  C:\Windows\System\CkyorSl.exe
  2⤵
  PID:2820
- C:\Windows\System\XKNKlRp.exe
  C:\Windows\System\XKNKlRp.exe
  2⤵
  PID:2620
- C:\Windows\System\YbEovDM.exe
  C:\Windows\System\YbEovDM.exe
  2⤵
  PID:2496
- C:\Windows\System\VQgpzaj.exe
  C:\Windows\System\VQgpzaj.exe
  2⤵
  PID:2164
- C:\Windows\System\kZiXeVY.exe
  C:\Windows\System\kZiXeVY.exe
  2⤵
  PID:448
- C:\Windows\System\ENcbaTp.exe
  C:\Windows\System\ENcbaTp.exe
  2⤵
  PID:768
- C:\Windows\System\LaiCmGs.exe
  C:\Windows\System\LaiCmGs.exe
  2⤵
  PID:1532
- C:\Windows\System\CMSlYyX.exe
  C:\Windows\System\CMSlYyX.exe
  2⤵
  PID:840
- C:\Windows\System\ZWXyHbs.exe
  C:\Windows\System\ZWXyHbs.exe
  2⤵
  PID:2624
- C:\Windows\System\IfpbjHI.exe
  C:\Windows\System\IfpbjHI.exe
  2⤵
  PID:2740
- C:\Windows\System\HUXZMBJ.exe
  C:\Windows\System\HUXZMBJ.exe
  2⤵
  PID:1800
- C:\Windows\System\fCaLCyZ.exe
  C:\Windows\System\fCaLCyZ.exe
  2⤵
  PID:1948
- C:\Windows\System\umcjfIz.exe
  C:\Windows\System\umcjfIz.exe
  2⤵
  PID:1600
- C:\Windows\System\NMVOFEf.exe
  C:\Windows\System\NMVOFEf.exe
  2⤵
  PID:1256
- C:\Windows\System\lkinnaS.exe
  C:\Windows\System\lkinnaS.exe
  2⤵
  PID:1188
- C:\Windows\System\XnQEGDP.exe
  C:\Windows\System\XnQEGDP.exe
  2⤵
  PID:2652
- C:\Windows\System\jYMWJga.exe
  C:\Windows\System\jYMWJga.exe
  2⤵
  PID:2700
- C:\Windows\System\dDAEzXA.exe
  C:\Windows\System\dDAEzXA.exe
  2⤵
  PID:732
- C:\Windows\System\gEiJyhW.exe
  C:\Windows\System\gEiJyhW.exe
  2⤵
  PID:584
- C:\Windows\System\vUdgAnV.exe
  C:\Windows\System\vUdgAnV.exe
  2⤵
  PID:1628
- C:\Windows\System\TFOxJjv.exe
  C:\Windows\System\TFOxJjv.exe
  2⤵
  PID:740
- C:\Windows\System\yALEuEE.exe
  C:\Windows\System\yALEuEE.exe
  2⤵
  PID:1560
- C:\Windows\System\awuAksD.exe
  C:\Windows\System\awuAksD.exe
  2⤵
  PID:1416
- C:\Windows\System\ODcRJAe.exe
  C:\Windows\System\ODcRJAe.exe
  2⤵
  PID:1328
- C:\Windows\System\OtxoIjq.exe
  C:\Windows\System\OtxoIjq.exe
  2⤵
  PID:2664
- C:\Windows\System\GdwAgqd.exe
  C:\Windows\System\GdwAgqd.exe
  2⤵
  PID:1984
- C:\Windows\System\ZgsZukT.exe
  C:\Windows\System\ZgsZukT.exe
  2⤵
  PID:888
- C:\Windows\System\IRrTCsZ.exe
  C:\Windows\System\IRrTCsZ.exe
  2⤵
  PID:1576
- C:\Windows\System\ROvHjAU.exe
  C:\Windows\System\ROvHjAU.exe
  2⤵
  PID:3084
- C:\Windows\System\gbcZqyx.exe
  C:\Windows\System\gbcZqyx.exe
  2⤵
  PID:3100
- C:\Windows\System\GqtPkQr.exe
  C:\Windows\System\GqtPkQr.exe
  2⤵
  PID:3116
- C:\Windows\System\cohXPWx.exe
  C:\Windows\System\cohXPWx.exe
  2⤵
  PID:3136
- C:\Windows\System\YECalmh.exe
  C:\Windows\System\YECalmh.exe
  2⤵
  PID:3152
- C:\Windows\System\MQbYGzW.exe
  C:\Windows\System\MQbYGzW.exe
  2⤵
  PID:3168
- C:\Windows\System\qQICBfY.exe
  C:\Windows\System\qQICBfY.exe
  2⤵
  PID:3184
- C:\Windows\System\QLUGlav.exe
  C:\Windows\System\QLUGlav.exe
  2⤵
  PID:3200
- C:\Windows\System\gYnjxyH.exe
  C:\Windows\System\gYnjxyH.exe
  2⤵
  PID:3216
- C:\Windows\System\UNwiNwN.exe
  C:\Windows\System\UNwiNwN.exe
  2⤵
  PID:3232
- C:\Windows\System\doffwGt.exe
  C:\Windows\System\doffwGt.exe
  2⤵
  PID:3248
- C:\Windows\System\xUSuqMq.exe
  C:\Windows\System\xUSuqMq.exe
  2⤵
  PID:3268
- C:\Windows\System\jKIQVXf.exe
  C:\Windows\System\jKIQVXf.exe
  2⤵
  PID:3284
- C:\Windows\System\zjJBeQH.exe
  C:\Windows\System\zjJBeQH.exe
  2⤵
  PID:3300
- C:\Windows\System\SdevPkX.exe
  C:\Windows\System\SdevPkX.exe
  2⤵
  PID:3316
- C:\Windows\System\sYboKfw.exe
  C:\Windows\System\sYboKfw.exe
  2⤵
  PID:3332
- C:\Windows\System\SZFdgUl.exe
  C:\Windows\System\SZFdgUl.exe
  2⤵
  PID:3348
- C:\Windows\System\pmZchyK.exe
  C:\Windows\System\pmZchyK.exe
  2⤵
  PID:3364
- C:\Windows\System\gLreTgQ.exe
  C:\Windows\System\gLreTgQ.exe
  2⤵
  PID:3384
- C:\Windows\System\dvOZRrN.exe
  C:\Windows\System\dvOZRrN.exe
  2⤵
  PID:3400
- C:\Windows\System\uypTgcF.exe
  C:\Windows\System\uypTgcF.exe
  2⤵
  PID:3416
- C:\Windows\System\COGbagD.exe
  C:\Windows\System\COGbagD.exe
  2⤵
  PID:3432
- C:\Windows\System\HJyJzDb.exe
  C:\Windows\System\HJyJzDb.exe
  2⤵
  PID:3452
- C:\Windows\System\uBCFlZA.exe
  C:\Windows\System\uBCFlZA.exe
  2⤵
  PID:3656
- C:\Windows\System\YcPzsbr.exe
  C:\Windows\System\YcPzsbr.exe
  2⤵
  PID:3676
- C:\Windows\System\PoXhcop.exe
  C:\Windows\System\PoXhcop.exe
  2⤵
  PID:3692
- C:\Windows\System\TefVpql.exe
  C:\Windows\System\TefVpql.exe
  2⤵
  PID:3708
- C:\Windows\System\FBvhKUB.exe
  C:\Windows\System\FBvhKUB.exe
  2⤵
  PID:3724
- C:\Windows\System\oHaAIcO.exe
  C:\Windows\System\oHaAIcO.exe
  2⤵
  PID:3740
- C:\Windows\System\WSmKDzg.exe
  C:\Windows\System\WSmKDzg.exe
  2⤵
  PID:3760
- C:\Windows\System\eXkzjII.exe
  C:\Windows\System\eXkzjII.exe
  2⤵
  PID:3776
- C:\Windows\System\VdGrxdf.exe
  C:\Windows\System\VdGrxdf.exe
  2⤵
  PID:3792
- C:\Windows\System\HsllEBg.exe
  C:\Windows\System\HsllEBg.exe
  2⤵
  PID:3812
- C:\Windows\System\DnHAIww.exe
  C:\Windows\System\DnHAIww.exe
  2⤵
  PID:3828
- C:\Windows\System\feOABOR.exe
  C:\Windows\System\feOABOR.exe
  2⤵
  PID:3856
- C:\Windows\System\gpcXnZP.exe
  C:\Windows\System\gpcXnZP.exe
  2⤵
  PID:3872
- C:\Windows\System\hBKrEnl.exe
  C:\Windows\System\hBKrEnl.exe
  2⤵
  PID:3888
- C:\Windows\System\LHlgkvG.exe
  C:\Windows\System\LHlgkvG.exe
  2⤵
  PID:3904
- C:\Windows\System\EjiKUdB.exe
  C:\Windows\System\EjiKUdB.exe
  2⤵
  PID:3936
- C:\Windows\System\ohAUzTO.exe
  C:\Windows\System\ohAUzTO.exe
  2⤵
  PID:3980
- C:\Windows\System\rlBQGZj.exe
  C:\Windows\System\rlBQGZj.exe
  2⤵
  PID:3996
- C:\Windows\System\npdNJqR.exe
  C:\Windows\System\npdNJqR.exe
  2⤵
  PID:4020
- C:\Windows\System\MJunWyf.exe
  C:\Windows\System\MJunWyf.exe
  2⤵
  PID:4040
- C:\Windows\System\yHuGvnu.exe
  C:\Windows\System\yHuGvnu.exe
  2⤵
  PID:4056
- C:\Windows\System\JvLEBOK.exe
  C:\Windows\System\JvLEBOK.exe
  2⤵
  PID:4072
- C:\Windows\System\PTAPcHs.exe
  C:\Windows\System\PTAPcHs.exe
  2⤵
  PID:4088
- C:\Windows\System\vCCNgaI.exe
  C:\Windows\System\vCCNgaI.exe
  2⤵
  PID:1792
- C:\Windows\System\PKhEeSZ.exe
  C:\Windows\System\PKhEeSZ.exe
  2⤵
  PID:1780
- C:\Windows\System\jCZxoHB.exe
  C:\Windows\System\jCZxoHB.exe
  2⤵
  PID:556
- C:\Windows\System\XeizlGQ.exe
  C:\Windows\System\XeizlGQ.exe
  2⤵
  PID:1564
- C:\Windows\System\GcSYUqG.exe
  C:\Windows\System\GcSYUqG.exe
  2⤵
  PID:3076
- C:\Windows\System\FyHtXCn.exe
  C:\Windows\System\FyHtXCn.exe
  2⤵
  PID:3144
- C:\Windows\System\ZDtBNgZ.exe
  C:\Windows\System\ZDtBNgZ.exe
  2⤵
  PID:3208
- C:\Windows\System\rhgblaf.exe
  C:\Windows\System\rhgblaf.exe
  2⤵
  PID:2216
- C:\Windows\System\oASYUPW.exe
  C:\Windows\System\oASYUPW.exe
  2⤵
  PID:984
- C:\Windows\System\YddxhSQ.exe
  C:\Windows\System\YddxhSQ.exe
  2⤵
  PID:3276
- C:\Windows\System\zPokcST.exe
  C:\Windows\System\zPokcST.exe
  2⤵
  PID:3340
- C:\Windows\System\QGRKtav.exe
  C:\Windows\System\QGRKtav.exe
  2⤵
  PID:3380
- C:\Windows\System\ugEoOPJ.exe
  C:\Windows\System\ugEoOPJ.exe
  2⤵
  PID:3444
- C:\Windows\System\bhjmpMb.exe
  C:\Windows\System\bhjmpMb.exe
  2⤵
  PID:1788
- C:\Windows\System\jJTGtCg.exe
  C:\Windows\System\jJTGtCg.exe
  2⤵
  PID:2532
- C:\Windows\System\lhlMoiy.exe
  C:\Windows\System\lhlMoiy.exe
  2⤵
  PID:3020
- C:\Windows\System\LcMlbBd.exe
  C:\Windows\System\LcMlbBd.exe
  2⤵
  PID:692
- C:\Windows\System\bcPUHPB.exe
  C:\Windows\System\bcPUHPB.exe
  2⤵
  PID:2916
- C:\Windows\System\vVopISx.exe
  C:\Windows\System\vVopISx.exe
  2⤵
  PID:3124
- C:\Windows\System\SCMIhLb.exe
  C:\Windows\System\SCMIhLb.exe
  2⤵
  PID:3196
- C:\Windows\System\qvOONdR.exe
  C:\Windows\System\qvOONdR.exe
  2⤵
  PID:3260
- C:\Windows\System\xXtVaZx.exe
  C:\Windows\System\xXtVaZx.exe
  2⤵
  PID:3324
- C:\Windows\System\EQSvoWn.exe
  C:\Windows\System\EQSvoWn.exe
  2⤵
  PID:3392
- C:\Windows\System\lsMyStF.exe
  C:\Windows\System\lsMyStF.exe
  2⤵
  PID:3460
- C:\Windows\System\OyXIeAe.exe
  C:\Windows\System\OyXIeAe.exe
  2⤵
  PID:3468
- C:\Windows\System\WfTINlH.exe
  C:\Windows\System\WfTINlH.exe
  2⤵
  PID:3488
- C:\Windows\System\umiIGRj.exe
  C:\Windows\System\umiIGRj.exe
  2⤵
  PID:3504
- C:\Windows\System\FwrymQo.exe
  C:\Windows\System\FwrymQo.exe
  2⤵
  PID:3520
- C:\Windows\System\TtMIWGG.exe
  C:\Windows\System\TtMIWGG.exe
  2⤵
  PID:3536
- C:\Windows\System\LDUwYIQ.exe
  C:\Windows\System\LDUwYIQ.exe
  2⤵
  PID:3552
- C:\Windows\System\KXPgjgY.exe
  C:\Windows\System\KXPgjgY.exe
  2⤵
  PID:3576
- C:\Windows\System\NgaTCSf.exe
  C:\Windows\System\NgaTCSf.exe
  2⤵
  PID:3592
- C:\Windows\System\UisYGNR.exe
  C:\Windows\System\UisYGNR.exe
  2⤵
  PID:3608
- C:\Windows\System\winTrHW.exe
  C:\Windows\System\winTrHW.exe
  2⤵
  PID:3620
- C:\Windows\System\IVUhfwu.exe
  C:\Windows\System\IVUhfwu.exe
  2⤵
  PID:3668
- C:\Windows\System\jkqAdmA.exe
  C:\Windows\System\jkqAdmA.exe
  2⤵
  PID:3732
- C:\Windows\System\wDaKPZw.exe
  C:\Windows\System\wDaKPZw.exe
  2⤵
  PID:3800
- C:\Windows\System\PDBOWsC.exe
  C:\Windows\System\PDBOWsC.exe
  2⤵
  PID:2044
- C:\Windows\System\toHzcMv.exe
  C:\Windows\System\toHzcMv.exe
  2⤵
  PID:3852
- C:\Windows\System\QuTfuvk.exe
  C:\Windows\System\QuTfuvk.exe
  2⤵
  PID:3920
- C:\Windows\System\mqJbyXY.exe
  C:\Windows\System\mqJbyXY.exe
  2⤵
  PID:3932
- C:\Windows\System\GveVyKr.exe
  C:\Windows\System\GveVyKr.exe
  2⤵
  PID:3900
- C:\Windows\System\UrdutgN.exe
  C:\Windows\System\UrdutgN.exe
  2⤵
  PID:2192
- C:\Windows\System\uqiRlyr.exe
  C:\Windows\System\uqiRlyr.exe
  2⤵
  PID:3820
- C:\Windows\System\gQxWMht.exe
  C:\Windows\System\gQxWMht.exe
  2⤵
  PID:3748
- C:\Windows\System\QecvkYh.exe
  C:\Windows\System\QecvkYh.exe
  2⤵
  PID:3960
- C:\Windows\System\zcfxxIg.exe
  C:\Windows\System\zcfxxIg.exe
  2⤵
  PID:3132
- C:\Windows\System\EWySKUJ.exe
  C:\Windows\System\EWySKUJ.exe
  2⤵
  PID:3964
- C:\Windows\System\VqahOlk.exe
  C:\Windows\System\VqahOlk.exe
  2⤵
  PID:2516
- C:\Windows\System\oiLJMnx.exe
  C:\Windows\System\oiLJMnx.exe
  2⤵
  PID:1344
- C:\Windows\System\nfclscw.exe
  C:\Windows\System\nfclscw.exe
  2⤵
  PID:1184
- C:\Windows\System\ZDHrMPz.exe
  C:\Windows\System\ZDHrMPz.exe
  2⤵
  PID:2732
- C:\Windows\System\qkdKqps.exe
  C:\Windows\System\qkdKqps.exe
  2⤵
  PID:928
- C:\Windows\System\xpUxqOs.exe
  C:\Windows\System\xpUxqOs.exe
  2⤵
  PID:3976
- C:\Windows\System\NzfcZPQ.exe
  C:\Windows\System\NzfcZPQ.exe
  2⤵
  PID:4008
- C:\Windows\System\BJUnZpb.exe
  C:\Windows\System\BJUnZpb.exe
  2⤵
  PID:4032
- C:\Windows\System\zeRErkc.exe
  C:\Windows\System\zeRErkc.exe
  2⤵
  PID:2852
- C:\Windows\System\leOIPMe.exe
  C:\Windows\System\leOIPMe.exe
  2⤵
  PID:1936
- C:\Windows\System\VUUJQqX.exe
  C:\Windows\System\VUUJQqX.exe
  2⤵
  PID:2816
- C:\Windows\System\WPnHgpT.exe
  C:\Windows\System\WPnHgpT.exe
  2⤵
  PID:1804
- C:\Windows\System\esxaVhB.exe
  C:\Windows\System\esxaVhB.exe
  2⤵
  PID:2552
- C:\Windows\System\UItWfAT.exe
  C:\Windows\System\UItWfAT.exe
  2⤵
  PID:2672
- C:\Windows\System\atRsiQX.exe
  C:\Windows\System\atRsiQX.exe
  2⤵
  PID:4112
- C:\Windows\System\LlkZMNQ.exe
  C:\Windows\System\LlkZMNQ.exe
  2⤵
  PID:4128
- C:\Windows\System\vyeEFou.exe
  C:\Windows\System\vyeEFou.exe
  2⤵
  PID:4152
- C:\Windows\System\LoCwYZm.exe
  C:\Windows\System\LoCwYZm.exe
  2⤵
  PID:4172
- C:\Windows\System\OqbDJDl.exe
  C:\Windows\System\OqbDJDl.exe
  2⤵
  PID:4188
- C:\Windows\System\MyziCCy.exe
  C:\Windows\System\MyziCCy.exe
  2⤵
  PID:4204
- C:\Windows\System\BoADowS.exe
  C:\Windows\System\BoADowS.exe
  2⤵
  PID:4220
- C:\Windows\System\XsfeORt.exe
  C:\Windows\System\XsfeORt.exe
  2⤵
  PID:4236
- C:\Windows\System\QMIdbvt.exe
  C:\Windows\System\QMIdbvt.exe
  2⤵
  PID:4252
- C:\Windows\System\ybxILUe.exe
  C:\Windows\System\ybxILUe.exe
  2⤵
  PID:4268
- C:\Windows\System\erNTcKJ.exe
  C:\Windows\System\erNTcKJ.exe
  2⤵
  PID:4284
- C:\Windows\System\fPsYBof.exe
  C:\Windows\System\fPsYBof.exe
  2⤵
  PID:4300
- C:\Windows\System\CrCkNRd.exe
  C:\Windows\System\CrCkNRd.exe
  2⤵
  PID:4316
- C:\Windows\System\cTvrtVQ.exe
  C:\Windows\System\cTvrtVQ.exe
  2⤵
  PID:4332
- C:\Windows\System\UCkXLMM.exe
  C:\Windows\System\UCkXLMM.exe
  2⤵
  PID:4348
- C:\Windows\System\EOvKNgj.exe
  C:\Windows\System\EOvKNgj.exe
  2⤵
  PID:4364
- C:\Windows\System\YuICxDO.exe
  C:\Windows\System\YuICxDO.exe
  2⤵
  PID:4380
- C:\Windows\System\mNkyfMI.exe
  C:\Windows\System\mNkyfMI.exe
  2⤵
  PID:4396
- C:\Windows\System\kuzwkeR.exe
  C:\Windows\System\kuzwkeR.exe
  2⤵
  PID:4412
- C:\Windows\System\OjSrbUm.exe
  C:\Windows\System\OjSrbUm.exe
  2⤵
  PID:4428
- C:\Windows\System\hviXyFj.exe
  C:\Windows\System\hviXyFj.exe
  2⤵
  PID:4444
- C:\Windows\System\ckAntBn.exe
  C:\Windows\System\ckAntBn.exe
  2⤵
  PID:4460
- C:\Windows\System\UEtbCSk.exe
  C:\Windows\System\UEtbCSk.exe
  2⤵
  PID:4476
- C:\Windows\System\toNvtIb.exe
  C:\Windows\System\toNvtIb.exe
  2⤵
  PID:4492
- C:\Windows\System\gYRUiVN.exe
  C:\Windows\System\gYRUiVN.exe
  2⤵
  PID:4508
- C:\Windows\System\joQXpaM.exe
  C:\Windows\System\joQXpaM.exe
  2⤵
  PID:4524
- C:\Windows\System\xqBOVBL.exe
  C:\Windows\System\xqBOVBL.exe
  2⤵
  PID:4540
- C:\Windows\System\BQgrEHv.exe
  C:\Windows\System\BQgrEHv.exe
  2⤵
  PID:4556
- C:\Windows\System\UuhYQYk.exe
  C:\Windows\System\UuhYQYk.exe
  2⤵
  PID:4572
- C:\Windows\System\CabtsXm.exe
  C:\Windows\System\CabtsXm.exe
  2⤵
  PID:4588
- C:\Windows\System\SSEkjoW.exe
  C:\Windows\System\SSEkjoW.exe
  2⤵
  PID:4604
- C:\Windows\System\rMxCHKg.exe
  C:\Windows\System\rMxCHKg.exe
  2⤵
  PID:4620
- C:\Windows\System\yZAqMbK.exe
  C:\Windows\System\yZAqMbK.exe
  2⤵
  PID:4636
- C:\Windows\System\kWloyeU.exe
  C:\Windows\System\kWloyeU.exe
  2⤵
  PID:4652
- C:\Windows\System\ElZFKgS.exe
  C:\Windows\System\ElZFKgS.exe
  2⤵
  PID:4668
- C:\Windows\System\JCRPvFA.exe
  C:\Windows\System\JCRPvFA.exe
  2⤵
  PID:4684
- C:\Windows\System\ZUAIfsx.exe
  C:\Windows\System\ZUAIfsx.exe
  2⤵
  PID:4700
- C:\Windows\System\DJTcbsv.exe
  C:\Windows\System\DJTcbsv.exe
  2⤵
  PID:4716
- C:\Windows\System\aYozmho.exe
  C:\Windows\System\aYozmho.exe
  2⤵
  PID:4732
- C:\Windows\System\kDAOlii.exe
  C:\Windows\System\kDAOlii.exe
  2⤵
  PID:4748
- C:\Windows\System\ESHIkmM.exe
  C:\Windows\System\ESHIkmM.exe
  2⤵
  PID:4764
- C:\Windows\System\oHWVOUt.exe
  C:\Windows\System\oHWVOUt.exe
  2⤵
  PID:4780
- C:\Windows\System\sCpOiBg.exe
  C:\Windows\System\sCpOiBg.exe
  2⤵
  PID:4796
- C:\Windows\System\AZUmeFW.exe
  C:\Windows\System\AZUmeFW.exe
  2⤵
  PID:4812
- C:\Windows\System\qxHqGBY.exe
  C:\Windows\System\qxHqGBY.exe
  2⤵
  PID:4828
- C:\Windows\System\EqusoBq.exe
  C:\Windows\System\EqusoBq.exe
  2⤵
  PID:4844
- C:\Windows\System\icmljme.exe
  C:\Windows\System\icmljme.exe
  2⤵
  PID:4860
- C:\Windows\System\mBGRsYo.exe
  C:\Windows\System\mBGRsYo.exe
  2⤵
  PID:4876
- C:\Windows\System\DtbgAvb.exe
  C:\Windows\System\DtbgAvb.exe
  2⤵
  PID:4892
- C:\Windows\System\XjEexbv.exe
  C:\Windows\System\XjEexbv.exe
  2⤵
  PID:4908
- C:\Windows\System\fcHeyWr.exe
  C:\Windows\System\fcHeyWr.exe
  2⤵
  PID:4924
- C:\Windows\System\FYjlGQf.exe
  C:\Windows\System\FYjlGQf.exe
  2⤵
  PID:4940
- C:\Windows\System\NYgNhHu.exe
  C:\Windows\System\NYgNhHu.exe
  2⤵
  PID:4956
- C:\Windows\System\TmXRpLw.exe
  C:\Windows\System\TmXRpLw.exe
  2⤵
  PID:4972
- C:\Windows\System\meveGTf.exe
  C:\Windows\System\meveGTf.exe
  2⤵
  PID:4988
- C:\Windows\System\xYAnakm.exe
  C:\Windows\System\xYAnakm.exe
  2⤵
  PID:5004
- C:\Windows\System\ySzbBaQ.exe
  C:\Windows\System\ySzbBaQ.exe
  2⤵
  PID:5020
- C:\Windows\System\rwchqUZ.exe
  C:\Windows\System\rwchqUZ.exe
  2⤵
  PID:5036
- C:\Windows\System\SwkByXS.exe
  C:\Windows\System\SwkByXS.exe
  2⤵
  PID:5056
- C:\Windows\System\OHWyRSn.exe
  C:\Windows\System\OHWyRSn.exe
  2⤵
  PID:5072
- C:\Windows\System\XtHdusW.exe
  C:\Windows\System\XtHdusW.exe
  2⤵
  PID:5088
- C:\Windows\System\sQUgNBL.exe
  C:\Windows\System\sQUgNBL.exe
  2⤵
  PID:5104
- C:\Windows\System\qvxasPA.exe
  C:\Windows\System\qvxasPA.exe
  2⤵
  PID:2792
- C:\Windows\System\vxBlhqS.exe
  C:\Windows\System\vxBlhqS.exe
  2⤵
  PID:2032
- C:\Windows\System\ActBvtJ.exe
  C:\Windows\System\ActBvtJ.exe
  2⤵
  PID:3192
- C:\Windows\System\xnKsPnt.exe
  C:\Windows\System\xnKsPnt.exe
  2⤵
  PID:3428
- C:\Windows\System\xYdrgXN.exe
  C:\Windows\System\xYdrgXN.exe
  2⤵
  PID:3512
- C:\Windows\System\tphMSWm.exe
  C:\Windows\System\tphMSWm.exe
  2⤵
  PID:3584
- C:\Windows\System\sIEdtPv.exe
  C:\Windows\System\sIEdtPv.exe
  2⤵
  PID:3704
- C:\Windows\System\IUsWoSn.exe
  C:\Windows\System\IUsWoSn.exe
  2⤵
  PID:3912
- C:\Windows\System\GNdrGBy.exe
  C:\Windows\System\GNdrGBy.exe
  2⤵
  PID:3824
- C:\Windows\System\IMOPlpV.exe
  C:\Windows\System\IMOPlpV.exe
  2⤵
  PID:1860
- C:\Windows\System\MIZbUAl.exe
  C:\Windows\System\MIZbUAl.exe
  2⤵
  PID:2720
- C:\Windows\System\medTfYK.exe
  C:\Windows\System\medTfYK.exe
  2⤵
  PID:4036
- C:\Windows\System\PIhBJWK.exe
  C:\Windows\System\PIhBJWK.exe
  2⤵
  PID:2860
- C:\Windows\System\XytIEkW.exe
  C:\Windows\System\XytIEkW.exe
  2⤵
  PID:3376
- C:\Windows\System\EuALLVZ.exe
  C:\Windows\System\EuALLVZ.exe
  2⤵
  PID:4160
- C:\Windows\System\ALkEKcO.exe
  C:\Windows\System\ALkEKcO.exe
  2⤵
  PID:4200
- C:\Windows\System\yEKSEon.exe
  C:\Windows\System\yEKSEon.exe
  2⤵
  PID:4080
- C:\Windows\System\IUqVXZE.exe
  C:\Windows\System\IUqVXZE.exe
  2⤵
  PID:4324
- C:\Windows\System\bgevUoN.exe
  C:\Windows\System\bgevUoN.exe
  2⤵
  PID:3440
- C:\Windows\System\gzlOodC.exe
  C:\Windows\System\gzlOodC.exe
  2⤵
  PID:4244
- C:\Windows\System\IkmDvoL.exe
  C:\Windows\System\IkmDvoL.exe
  2⤵
  PID:4308
- C:\Windows\System\nTvvbky.exe
  C:\Windows\System\nTvvbky.exe
  2⤵
  PID:4452
- C:\Windows\System\JsfkBlI.exe
  C:\Windows\System\JsfkBlI.exe
  2⤵
  PID:4516
- C:\Windows\System\pwApbDm.exe
  C:\Windows\System\pwApbDm.exe
  2⤵
  PID:4580
- C:\Windows\System\eDmGNIz.exe
  C:\Windows\System\eDmGNIz.exe
  2⤵
  PID:4420
- C:\Windows\System\FdasKhm.exe
  C:\Windows\System\FdasKhm.exe
  2⤵
  PID:4312
- C:\Windows\System\xJdAEzG.exe
  C:\Windows\System\xJdAEzG.exe
  2⤵
  PID:4712
- C:\Windows\System\WllNAVM.exe
  C:\Windows\System\WllNAVM.exe
  2⤵
  PID:4772
- C:\Windows\System\fxkfFzV.exe
  C:\Windows\System\fxkfFzV.exe
  2⤵
  PID:4836
- C:\Windows\System\xGXIKPQ.exe
  C:\Windows\System\xGXIKPQ.exe
  2⤵
  PID:2876
- C:\Windows\System\ZFcQHEM.exe
  C:\Windows\System\ZFcQHEM.exe
  2⤵
  PID:4084
- C:\Windows\System\dePgEkJ.exe
  C:\Windows\System\dePgEkJ.exe
  2⤵
  PID:1836
- C:\Windows\System\msBZItr.exe
  C:\Windows\System\msBZItr.exe
  2⤵
  PID:4932
- C:\Windows\System\brHzroa.exe
  C:\Windows\System\brHzroa.exe
  2⤵
  PID:4964
- C:\Windows\System\bEXqktX.exe
  C:\Windows\System\bEXqktX.exe
  2⤵
  PID:3312
- C:\Windows\System\AgbmoMM.exe
  C:\Windows\System\AgbmoMM.exe
  2⤵
  PID:1340
- C:\Windows\System\ILzqrXs.exe
  C:\Windows\System\ILzqrXs.exe
  2⤵
  PID:5032
- C:\Windows\System\PCOBiCL.exe
  C:\Windows\System\PCOBiCL.exe
  2⤵
  PID:3092
- C:\Windows\System\RpTEtBD.exe
  C:\Windows\System\RpTEtBD.exe
  2⤵
  PID:4180
- C:\Windows\System\fZMnCCZ.exe
  C:\Windows\System\fZMnCCZ.exe
  2⤵
  PID:4536
- C:\Windows\System\ptvOYMk.exe
  C:\Windows\System\ptvOYMk.exe
  2⤵
  PID:3548
- C:\Windows\System\JYgjBMn.exe
  C:\Windows\System\JYgjBMn.exe
  2⤵
  PID:4628
- C:\Windows\System\dhRjrqm.exe
  C:\Windows\System\dhRjrqm.exe
  2⤵
  PID:3988
- C:\Windows\System\gIPNQkT.exe
  C:\Windows\System\gIPNQkT.exe
  2⤵
  PID:3240
- C:\Windows\System\htRYrym.exe
  C:\Windows\System\htRYrym.exe
  2⤵
  PID:3360
- C:\Windows\System\qETllOu.exe
  C:\Windows\System\qETllOu.exe
  2⤵
  PID:3500
- C:\Windows\System\MaltADB.exe
  C:\Windows\System\MaltADB.exe
  2⤵
  PID:2092
- C:\Windows\System\ZZeTLtk.exe
  C:\Windows\System\ZZeTLtk.exe
  2⤵
  PID:3768
- C:\Windows\System\dMJuVxL.exe
  C:\Windows\System\dMJuVxL.exe
  2⤵
  PID:3928
- C:\Windows\System\orEiMyV.exe
  C:\Windows\System\orEiMyV.exe
  2⤵
  PID:3756
- C:\Windows\System\crhczpV.exe
  C:\Windows\System\crhczpV.exe
  2⤵
  PID:580
- C:\Windows\System\UUkhmyI.exe
  C:\Windows\System\UUkhmyI.exe
  2⤵
  PID:2584
- C:\Windows\System\VhZjrwk.exe
  C:\Windows\System\VhZjrwk.exe
  2⤵
  PID:1548
- C:\Windows\System\CGRubcq.exe
  C:\Windows\System\CGRubcq.exe
  2⤵
  PID:3112
- C:\Windows\System\jgbQnHq.exe
  C:\Windows\System\jgbQnHq.exe
  2⤵
  PID:4372
- C:\Windows\System\TjzvroM.exe
  C:\Windows\System\TjzvroM.exe
  2⤵
  PID:3588
- C:\Windows\System\XkjLdrW.exe
  C:\Windows\System\XkjLdrW.exe
  2⤵
  PID:1668
- C:\Windows\System\YydkQSz.exe
  C:\Windows\System\YydkQSz.exe
  2⤵
  PID:4552
- C:\Windows\System\UFFPTvk.exe
  C:\Windows\System\UFFPTvk.exe
  2⤵
  PID:5044
- C:\Windows\System\nrLHuLW.exe
  C:\Windows\System\nrLHuLW.exe
  2⤵
  PID:4148
- C:\Windows\System\sszmHfd.exe
  C:\Windows\System\sszmHfd.exe
  2⤵
  PID:5112
- C:\Windows\System\pdgGrkv.exe
  C:\Windows\System\pdgGrkv.exe
  2⤵
  PID:4184
- C:\Windows\System\jpvhaGP.exe
  C:\Windows\System\jpvhaGP.exe
  2⤵
  PID:4216
- C:\Windows\System\dUalnOe.exe
  C:\Windows\System\dUalnOe.exe
  2⤵
  PID:4788
- C:\Windows\System\aswgSHb.exe
  C:\Windows\System\aswgSHb.exe
  2⤵
  PID:264
- C:\Windows\System\IsxYokc.exe
  C:\Windows\System\IsxYokc.exe
  2⤵
  PID:320
- C:\Windows\System\YnTrmYi.exe
  C:\Windows\System\YnTrmYi.exe
  2⤵
  PID:3836
- C:\Windows\System\UNXFxae.exe
  C:\Windows\System\UNXFxae.exe
  2⤵
  PID:3464
- C:\Windows\System\uatiTOz.exe
  C:\Windows\System\uatiTOz.exe
  2⤵
  PID:4168
- C:\Windows\System\XgCXXCS.exe
  C:\Windows\System\XgCXXCS.exe
  2⤵
  PID:4068
- C:\Windows\System\CVZmVAE.exe
  C:\Windows\System\CVZmVAE.exe
  2⤵
  PID:4424
- C:\Windows\System\nZxlYKm.exe
  C:\Windows\System\nZxlYKm.exe
  2⤵
  PID:4804
- C:\Windows\System\fvPVoxu.exe
  C:\Windows\System\fvPVoxu.exe
  2⤵
  PID:4900
- C:\Windows\System\czKvimv.exe
  C:\Windows\System\czKvimv.exe
  2⤵
  PID:4564
- C:\Windows\System\eiEnhgt.exe
  C:\Windows\System\eiEnhgt.exe
  2⤵
  PID:4660
- C:\Windows\System\HpPHXHF.exe
  C:\Windows\System\HpPHXHF.exe
  2⤵
  PID:3176
- C:\Windows\System\kkhHaKp.exe
  C:\Windows\System\kkhHaKp.exe
  2⤵
  PID:4856
- C:\Windows\System\EFEybXx.exe
  C:\Windows\System\EFEybXx.exe
  2⤵
  PID:4916
- C:\Windows\System\hkeeyNM.exe
  C:\Windows\System\hkeeyNM.exe
  2⤵
  PID:4984
- C:\Windows\System\nlCtoQj.exe
  C:\Windows\System\nlCtoQj.exe
  2⤵
  PID:4820
- C:\Windows\System\GmeMXDi.exe
  C:\Windows\System\GmeMXDi.exe
  2⤵
  PID:4728
- C:\Windows\System\jqOAKWE.exe
  C:\Windows\System\jqOAKWE.exe
  2⤵
  PID:4760
- C:\Windows\System\DiXCerr.exe
  C:\Windows\System\DiXCerr.exe
  2⤵
  PID:4744
- C:\Windows\System\nIYvptP.exe
  C:\Windows\System\nIYvptP.exe
  2⤵
  PID:5116
- C:\Windows\System\rweyqfb.exe
  C:\Windows\System\rweyqfb.exe
  2⤵
  PID:3484
- C:\Windows\System\ZQlJBPj.exe
  C:\Windows\System\ZQlJBPj.exe
  2⤵
  PID:3864
- C:\Windows\System\kEEhCxz.exe
  C:\Windows\System\kEEhCxz.exe
  2⤵
  PID:2024
- C:\Windows\System\tHgTBqm.exe
  C:\Windows\System\tHgTBqm.exe
  2⤵
  PID:4356
- C:\Windows\System\GtpyUyG.exe
  C:\Windows\System\GtpyUyG.exe
  2⤵
  PID:4280
- C:\Windows\System\jzutoxQ.exe
  C:\Windows\System\jzutoxQ.exe
  2⤵
  PID:3424
- C:\Windows\System\IWAhMwY.exe
  C:\Windows\System\IWAhMwY.exe
  2⤵
  PID:4980
- C:\Windows\System\qHNsmyL.exe
  C:\Windows\System\qHNsmyL.exe
  2⤵
  PID:3308
- C:\Windows\System\QnXgype.exe
  C:\Windows\System\QnXgype.exe
  2⤵
  PID:2344
- C:\Windows\System\iIcWbNU.exe
  C:\Windows\System\iIcWbNU.exe
  2⤵
  PID:3784
- C:\Windows\System\lGDcjFG.exe
  C:\Windows\System\lGDcjFG.exe
  2⤵
  PID:4108
- C:\Windows\System\EVrPgNW.exe
  C:\Windows\System\EVrPgNW.exe
  2⤵
  PID:4872
- C:\Windows\System\LHRoDdA.exe
  C:\Windows\System\LHRoDdA.exe
  2⤵
  PID:2668
- C:\Windows\System\iFpoMbH.exe
  C:\Windows\System\iFpoMbH.exe
  2⤵
  PID:3644
- C:\Windows\System\JcdoKmV.exe
  C:\Windows\System\JcdoKmV.exe
  2⤵
  PID:4436
- C:\Windows\System\xfvNuFF.exe
  C:\Windows\System\xfvNuFF.exe
  2⤵
  PID:4632
- C:\Windows\System\fEIHlmd.exe
  C:\Windows\System\fEIHlmd.exe
  2⤵
  PID:4852
- C:\Windows\System\CzMQZtt.exe
  C:\Windows\System\CzMQZtt.exe
  2⤵
  PID:5068
- C:\Windows\System\YhLzMau.exe
  C:\Windows\System\YhLzMau.exe
  2⤵
  PID:4472
- C:\Windows\System\JkdeWJh.exe
  C:\Windows\System\JkdeWJh.exe
  2⤵
  PID:3700
- C:\Windows\System\IPdjuxc.exe
  C:\Windows\System\IPdjuxc.exe
  2⤵
  PID:4232
- C:\Windows\System\IsPiTnm.exe
  C:\Windows\System\IsPiTnm.exe
  2⤵
  PID:4484
- C:\Windows\System\LNGHlZI.exe
  C:\Windows\System\LNGHlZI.exe
  2⤵
  PID:4488
- C:\Windows\System\iyqyVyE.exe
  C:\Windows\System\iyqyVyE.exe
  2⤵
  PID:3848
- C:\Windows\System\heVeedq.exe
  C:\Windows\System\heVeedq.exe
  2⤵
  PID:5012
- C:\Windows\System\GcdOnvF.exe
  C:\Windows\System\GcdOnvF.exe
  2⤵
  PID:4500
- C:\Windows\System\FJkLwat.exe
  C:\Windows\System\FJkLwat.exe
  2⤵
  PID:4600
- C:\Windows\System\JfumUZY.exe
  C:\Windows\System\JfumUZY.exe
  2⤵
  PID:4740
- C:\Windows\System\hNKACvA.exe
  C:\Windows\System\hNKACvA.exe
  2⤵
  PID:4264
- C:\Windows\System\YwajyoA.exe
  C:\Windows\System\YwajyoA.exe
  2⤵
  PID:4692
- C:\Windows\System\aZhitRw.exe
  C:\Windows\System\aZhitRw.exe
  2⤵
  PID:4756
- C:\Windows\System\FDuVzKi.exe
  C:\Windows\System\FDuVzKi.exe
  2⤵
  PID:4616
- C:\Windows\System\CUOvpXD.exe
  C:\Windows\System\CUOvpXD.exe
  2⤵
  PID:3544
- C:\Windows\System\dJtZryg.exe
  C:\Windows\System\dJtZryg.exe
  2⤵
  PID:4144
- C:\Windows\System\AnPXyTw.exe
  C:\Windows\System\AnPXyTw.exe
  2⤵
  PID:4140
- C:\Windows\System\anLZOxR.exe
  C:\Windows\System\anLZOxR.exe
  2⤵
  PID:5128
- C:\Windows\System\FfZjPaJ.exe
  C:\Windows\System\FfZjPaJ.exe
  2⤵
  PID:5144
- C:\Windows\System\aVGAaSG.exe
  C:\Windows\System\aVGAaSG.exe
  2⤵
  PID:5160
- C:\Windows\System\TlsBRvA.exe
  C:\Windows\System\TlsBRvA.exe
  2⤵
  PID:5176
- C:\Windows\System\MbXQKcY.exe
  C:\Windows\System\MbXQKcY.exe
  2⤵
  PID:5192
- C:\Windows\System\hHiXgMz.exe
  C:\Windows\System\hHiXgMz.exe
  2⤵
  PID:5208
- C:\Windows\System\RgUvMID.exe
  C:\Windows\System\RgUvMID.exe
  2⤵
  PID:5224
- C:\Windows\System\vMGhjhe.exe
  C:\Windows\System\vMGhjhe.exe
  2⤵
  PID:5240
- C:\Windows\System\FmYOOLS.exe
  C:\Windows\System\FmYOOLS.exe
  2⤵
  PID:5256
- C:\Windows\System\npAAvGq.exe
  C:\Windows\System\npAAvGq.exe
  2⤵
  PID:5272
- C:\Windows\System\sNATgTD.exe
  C:\Windows\System\sNATgTD.exe
  2⤵
  PID:5288
- C:\Windows\System\BmcopKE.exe
  C:\Windows\System\BmcopKE.exe
  2⤵
  PID:5304
- C:\Windows\System\HNarLZK.exe
  C:\Windows\System\HNarLZK.exe
  2⤵
  PID:5320
- C:\Windows\System\PidQPSS.exe
  C:\Windows\System\PidQPSS.exe
  2⤵
  PID:5336
- C:\Windows\System\zDKTvtz.exe
  C:\Windows\System\zDKTvtz.exe
  2⤵
  PID:5352
- C:\Windows\System\PMzymmy.exe
  C:\Windows\System\PMzymmy.exe
  2⤵
  PID:5368
- C:\Windows\System\RFSIkrL.exe
  C:\Windows\System\RFSIkrL.exe
  2⤵
  PID:5384
- C:\Windows\System\RZcsRfu.exe
  C:\Windows\System\RZcsRfu.exe
  2⤵
  PID:5400
- C:\Windows\System\WlxOEXU.exe
  C:\Windows\System\WlxOEXU.exe
  2⤵
  PID:5416
- C:\Windows\System\QYqAsyB.exe
  C:\Windows\System\QYqAsyB.exe
  2⤵
  PID:5432
- C:\Windows\System\VJglapZ.exe
  C:\Windows\System\VJglapZ.exe
  2⤵
  PID:5448
- C:\Windows\System\ciRoBvC.exe
  C:\Windows\System\ciRoBvC.exe
  2⤵
  PID:5464
- C:\Windows\System\CJZqxRB.exe
  C:\Windows\System\CJZqxRB.exe
  2⤵
  PID:5480
- C:\Windows\System\mEpgSKU.exe
  C:\Windows\System\mEpgSKU.exe
  2⤵
  PID:5496
- C:\Windows\System\ACwWkIy.exe
  C:\Windows\System\ACwWkIy.exe
  2⤵
  PID:5512
- C:\Windows\System\bFkjmpR.exe
  C:\Windows\System\bFkjmpR.exe
  2⤵
  PID:5528
- C:\Windows\System\teuzKNu.exe
  C:\Windows\System\teuzKNu.exe
  2⤵
  PID:5544
- C:\Windows\System\chaLPEO.exe
  C:\Windows\System\chaLPEO.exe
  2⤵
  PID:5560
- C:\Windows\System\vLNGFjh.exe
  C:\Windows\System\vLNGFjh.exe
  2⤵
  PID:5576
- C:\Windows\System\xKGAnSh.exe
  C:\Windows\System\xKGAnSh.exe
  2⤵
  PID:5592
- C:\Windows\System\wdepvYD.exe
  C:\Windows\System\wdepvYD.exe
  2⤵
  PID:5608
- C:\Windows\System\TRymHyQ.exe
  C:\Windows\System\TRymHyQ.exe
  2⤵
  PID:5624
- C:\Windows\System\AwEdRpx.exe
  C:\Windows\System\AwEdRpx.exe
  2⤵
  PID:5640
- C:\Windows\System\WtiwaSm.exe
  C:\Windows\System\WtiwaSm.exe
  2⤵
  PID:5656
- C:\Windows\System\VYzqvDk.exe
  C:\Windows\System\VYzqvDk.exe
  2⤵
  PID:5672
- C:\Windows\System\slBAnLK.exe
  C:\Windows\System\slBAnLK.exe
  2⤵
  PID:5688
- C:\Windows\System\MRbaWfD.exe
  C:\Windows\System\MRbaWfD.exe
  2⤵
  PID:5704
- C:\Windows\System\lvuYYkI.exe
  C:\Windows\System\lvuYYkI.exe
  2⤵
  PID:5720
- C:\Windows\System\tbwOwTE.exe
  C:\Windows\System\tbwOwTE.exe
  2⤵
  PID:5736
- C:\Windows\System\cqzbZSG.exe
  C:\Windows\System\cqzbZSG.exe
  2⤵
  PID:5752
- C:\Windows\System\dWDheGC.exe
  C:\Windows\System\dWDheGC.exe
  2⤵
  PID:5768
- C:\Windows\System\dWuYdLR.exe
  C:\Windows\System\dWuYdLR.exe
  2⤵
  PID:5784
- C:\Windows\System\nuzpCaN.exe
  C:\Windows\System\nuzpCaN.exe
  2⤵
  PID:5800
- C:\Windows\System\oIMPhZj.exe
  C:\Windows\System\oIMPhZj.exe
  2⤵
  PID:5816
- C:\Windows\System\rfsOjNa.exe
  C:\Windows\System\rfsOjNa.exe
  2⤵
  PID:5832
- C:\Windows\System\pLKTArr.exe
  C:\Windows\System\pLKTArr.exe
  2⤵
  PID:5848
- C:\Windows\System\rEoNynM.exe
  C:\Windows\System\rEoNynM.exe
  2⤵
  PID:5864
- C:\Windows\System\GsmhkkM.exe
  C:\Windows\System\GsmhkkM.exe
  2⤵
  PID:5880
- C:\Windows\System\DFTJrdT.exe
  C:\Windows\System\DFTJrdT.exe
  2⤵
  PID:5896
- C:\Windows\System\xqtlXFA.exe
  C:\Windows\System\xqtlXFA.exe
  2⤵
  PID:5912
- C:\Windows\System\vnrKVPA.exe
  C:\Windows\System\vnrKVPA.exe
  2⤵
  PID:5928
- C:\Windows\System\SyYBLTe.exe
  C:\Windows\System\SyYBLTe.exe
  2⤵
  PID:5944
- C:\Windows\System\kMosuby.exe
  C:\Windows\System\kMosuby.exe
  2⤵
  PID:5960
- C:\Windows\System\sGNHRgR.exe
  C:\Windows\System\sGNHRgR.exe
  2⤵
  PID:5976
- C:\Windows\System\LUNpkyB.exe
  C:\Windows\System\LUNpkyB.exe
  2⤵
  PID:5992
- C:\Windows\System\FWamBZH.exe
  C:\Windows\System\FWamBZH.exe
  2⤵
  PID:6008
- C:\Windows\System\djKoOii.exe
  C:\Windows\System\djKoOii.exe
  2⤵
  PID:6024
- C:\Windows\System\jamQuMB.exe
  C:\Windows\System\jamQuMB.exe
  2⤵
  PID:6040
- C:\Windows\System\YcbEYuN.exe
  C:\Windows\System\YcbEYuN.exe
  2⤵
  PID:6056
- C:\Windows\System\qdrSBUP.exe
  C:\Windows\System\qdrSBUP.exe
  2⤵
  PID:6072
- C:\Windows\System\MpCeeqE.exe
  C:\Windows\System\MpCeeqE.exe
  2⤵
  PID:6088
- C:\Windows\System\mmULgKg.exe
  C:\Windows\System\mmULgKg.exe
  2⤵
  PID:6104
- C:\Windows\System\QUrBSir.exe
  C:\Windows\System\QUrBSir.exe
  2⤵
  PID:6120
- C:\Windows\System\IkeZqII.exe
  C:\Windows\System\IkeZqII.exe
  2⤵
  PID:6136
- C:\Windows\System\NmjHCah.exe
  C:\Windows\System\NmjHCah.exe
  2⤵
  PID:1476
- C:\Windows\System\obGXhrc.exe
  C:\Windows\System\obGXhrc.exe
  2⤵
  PID:5124
- C:\Windows\System\wgCROlz.exe
  C:\Windows\System\wgCROlz.exe
  2⤵
  PID:2836
- C:\Windows\System\HZOEClk.exe
  C:\Windows\System\HZOEClk.exe
  2⤵
  PID:5220
- C:\Windows\System\OICmkjx.exe
  C:\Windows\System\OICmkjx.exe
  2⤵
  PID:5168
- C:\Windows\System\NkhnnVu.exe
  C:\Windows\System\NkhnnVu.exe
  2⤵
  PID:5140
- C:\Windows\System\uXnWoeo.exe
  C:\Windows\System\uXnWoeo.exe
  2⤵
  PID:5344
- C:\Windows\System\SRBEhof.exe
  C:\Windows\System\SRBEhof.exe
  2⤵
  PID:5376
- C:\Windows\System\gDvWOhB.exe
  C:\Windows\System\gDvWOhB.exe
  2⤵
  PID:5412
- C:\Windows\System\uGvxzcl.exe
  C:\Windows\System\uGvxzcl.exe
  2⤵
  PID:5440
- C:\Windows\System\DJUipHR.exe
  C:\Windows\System\DJUipHR.exe
  2⤵
  PID:5396
- C:\Windows\System\SnquaPC.exe
  C:\Windows\System\SnquaPC.exe
  2⤵
  PID:5428
- C:\Windows\System\MJCXDmn.exe
  C:\Windows\System\MJCXDmn.exe
  2⤵
  PID:5460
- C:\Windows\System\qYgGRTE.exe
  C:\Windows\System\qYgGRTE.exe
  2⤵
  PID:5508
- C:\Windows\System\UKbZqqI.exe
  C:\Windows\System\UKbZqqI.exe
  2⤵
  PID:5572
- C:\Windows\System\HyRrMYr.exe
  C:\Windows\System\HyRrMYr.exe
  2⤵
  PID:5492
- C:\Windows\System\TjjSqFS.exe
  C:\Windows\System\TjjSqFS.exe
  2⤵
  PID:5556
- C:\Windows\System\psfexhX.exe
  C:\Windows\System\psfexhX.exe
  2⤵
  PID:5648
- C:\Windows\System\NJFFSBa.exe
  C:\Windows\System\NJFFSBa.exe
  2⤵
  PID:5652
- C:\Windows\System\UCpbPHp.exe
  C:\Windows\System\UCpbPHp.exe
  2⤵
  PID:5668
- C:\Windows\System\YeGoMZo.exe
  C:\Windows\System\YeGoMZo.exe
  2⤵
  PID:5728
- C:\Windows\System\eUVWZcV.exe
  C:\Windows\System\eUVWZcV.exe
  2⤵
  PID:5748
- C:\Windows\System\GBkbtdQ.exe
  C:\Windows\System\GBkbtdQ.exe
  2⤵
  PID:5796
- C:\Windows\System\Zzrbcnz.exe
  C:\Windows\System\Zzrbcnz.exe
  2⤵
  PID:5860
- C:\Windows\System\ZNGSgRg.exe
  C:\Windows\System\ZNGSgRg.exe
  2⤵
  PID:5924
- C:\Windows\System\ZNcjctc.exe
  C:\Windows\System\ZNcjctc.exe
  2⤵
  PID:5952
- C:\Windows\System\KFSCIXa.exe
  C:\Windows\System\KFSCIXa.exe
  2⤵
  PID:5840
- C:\Windows\System\ykHlcEh.exe
  C:\Windows\System\ykHlcEh.exe
  2⤵
  PID:5876
- C:\Windows\System\kudmNUD.exe
  C:\Windows\System\kudmNUD.exe
  2⤵
  PID:6004
- C:\Windows\System\fnGyFZV.exe
  C:\Windows\System\fnGyFZV.exe
  2⤵
  PID:6016
- C:\Windows\System\BfxCEwo.exe
  C:\Windows\System\BfxCEwo.exe
  2⤵
  PID:6080
- C:\Windows\System\MCImibr.exe
  C:\Windows\System\MCImibr.exe
  2⤵
  PID:4612
- C:\Windows\System\uMdGiBd.exe
  C:\Windows\System\uMdGiBd.exe
  2⤵
  PID:5184
- C:\Windows\System\EtVsnJV.exe
  C:\Windows\System\EtVsnJV.exe
  2⤵
  PID:5200
- C:\Windows\System\CIwCnhW.exe
  C:\Windows\System\CIwCnhW.exe
  2⤵
  PID:6128
- C:\Windows\System\JzYAaBl.exe
  C:\Windows\System\JzYAaBl.exe
  2⤵
  PID:5188
- C:\Windows\System\ygCRSKT.exe
  C:\Windows\System\ygCRSKT.exe
  2⤵
  PID:5236
- C:\Windows\System\cmlEgvd.exe
  C:\Windows\System\cmlEgvd.exe
  2⤵
  PID:5360
- C:\Windows\System\sPqwPXB.exe
  C:\Windows\System\sPqwPXB.exe
  2⤵
  PID:5408
- C:\Windows\System\zhOiDIV.exe
  C:\Windows\System\zhOiDIV.exe
  2⤵
  PID:5424
- C:\Windows\System\KmffgVM.exe
  C:\Windows\System\KmffgVM.exe
  2⤵
  PID:5524
- C:\Windows\System\gGSWnoS.exe
  C:\Windows\System\gGSWnoS.exe
  2⤵
  PID:5488
- C:\Windows\System\EKVyiGe.exe
  C:\Windows\System\EKVyiGe.exe
  2⤵
  PID:5588
- C:\Windows\System\kECwmvB.exe
  C:\Windows\System\kECwmvB.exe
  2⤵
  PID:5712
- C:\Windows\System\SbYpHYr.exe
  C:\Windows\System\SbYpHYr.exe
  2⤵
  PID:5812
- C:\Windows\System\OZgzcXM.exe
  C:\Windows\System\OZgzcXM.exe
  2⤵
  PID:5920
- C:\Windows\System\EOfUzDj.exe
  C:\Windows\System\EOfUzDj.exe
  2⤵
  PID:6000
- C:\Windows\System\UNWblSk.exe
  C:\Windows\System\UNWblSk.exe
  2⤵
  PID:6096
- C:\Windows\System\EQsHRtc.exe
  C:\Windows\System\EQsHRtc.exe
  2⤵
  PID:5984
- C:\Windows\System\MJqpaHZ.exe
  C:\Windows\System\MJqpaHZ.exe
  2⤵
  PID:6116
- C:\Windows\System\kRTFsfX.exe
  C:\Windows\System\kRTFsfX.exe
  2⤵
  PID:5808
- C:\Windows\System\GTBFbYc.exe
  C:\Windows\System\GTBFbYc.exe
  2⤵
  PID:5988
- C:\Windows\System\YjnZtTI.exe
  C:\Windows\System\YjnZtTI.exe
  2⤵
  PID:5632
- C:\Windows\System\isZcCQF.exe
  C:\Windows\System\isZcCQF.exe
  2⤵
  PID:6112
- C:\Windows\System\AxfxgTU.exe
  C:\Windows\System\AxfxgTU.exe
  2⤵
  PID:4948
- C:\Windows\System\QTYbfpi.exe
  C:\Windows\System\QTYbfpi.exe
  2⤵
  PID:5760
- C:\Windows\System\nJGaxDK.exe
  C:\Windows\System\nJGaxDK.exe
  2⤵
  PID:5252
- C:\Windows\System\pgbpeYu.exe
  C:\Windows\System\pgbpeYu.exe
  2⤵
  PID:5780
- C:\Windows\System\jSGoUpY.exe
  C:\Windows\System\jSGoUpY.exe
  2⤵
  PID:5264
- C:\Windows\System\WojvdRu.exe
  C:\Windows\System\WojvdRu.exe
  2⤵
  PID:5620
- C:\Windows\System\nhBqlcu.exe
  C:\Windows\System\nhBqlcu.exe
  2⤵
  PID:5972
- C:\Windows\System\NvGDNLk.exe
  C:\Windows\System\NvGDNLk.exe
  2⤵
  PID:6156
- C:\Windows\System\xwvfRxa.exe
  C:\Windows\System\xwvfRxa.exe
  2⤵
  PID:6172
- C:\Windows\System\nkCjbmi.exe
  C:\Windows\System\nkCjbmi.exe
  2⤵
  PID:6188
- C:\Windows\System\bPggkAS.exe
  C:\Windows\System\bPggkAS.exe
  2⤵
  PID:6204
- C:\Windows\System\JnIuNDw.exe
  C:\Windows\System\JnIuNDw.exe
  2⤵
  PID:6220
- C:\Windows\System\EpXZuaa.exe
  C:\Windows\System\EpXZuaa.exe
  2⤵
  PID:6236
- C:\Windows\System\RGDiSec.exe
  C:\Windows\System\RGDiSec.exe
  2⤵
  PID:6252
- C:\Windows\System\Ftjyhpn.exe
  C:\Windows\System\Ftjyhpn.exe
  2⤵
  PID:6268
- C:\Windows\System\EoEjjHo.exe
  C:\Windows\System\EoEjjHo.exe
  2⤵
  PID:6284
- C:\Windows\System\UXEvfkk.exe
  C:\Windows\System\UXEvfkk.exe
  2⤵
  PID:6300
- C:\Windows\System\rRdTkcT.exe
  C:\Windows\System\rRdTkcT.exe
  2⤵
  PID:6316
- C:\Windows\System\nqFdkgG.exe
  C:\Windows\System\nqFdkgG.exe
  2⤵
  PID:6332
- C:\Windows\System\GgYMygY.exe
  C:\Windows\System\GgYMygY.exe
  2⤵
  PID:6348
- C:\Windows\System\KoYgvng.exe
  C:\Windows\System\KoYgvng.exe
  2⤵
  PID:6364
- C:\Windows\System\NArhXiw.exe
  C:\Windows\System\NArhXiw.exe
  2⤵
  PID:6380
- C:\Windows\System\ClhNfmw.exe
  C:\Windows\System\ClhNfmw.exe
  2⤵
  PID:6396
- C:\Windows\System\tpkwwAI.exe
  C:\Windows\System\tpkwwAI.exe
  2⤵
  PID:6412
- C:\Windows\System\ajTUAKF.exe
  C:\Windows\System\ajTUAKF.exe
  2⤵
  PID:6428
- C:\Windows\System\GyzzYHu.exe
  C:\Windows\System\GyzzYHu.exe
  2⤵
  PID:6444
- C:\Windows\System\nQpYQLb.exe
  C:\Windows\System\nQpYQLb.exe
  2⤵
  PID:6460
- C:\Windows\System\iUYMNsH.exe
  C:\Windows\System\iUYMNsH.exe
  2⤵
  PID:6476
- C:\Windows\System\yYxAasz.exe
  C:\Windows\System\yYxAasz.exe
  2⤵
  PID:6492
- C:\Windows\System\NCjoBLx.exe
  C:\Windows\System\NCjoBLx.exe
  2⤵
  PID:6508
- C:\Windows\System\QTuFJYo.exe
  C:\Windows\System\QTuFJYo.exe
  2⤵
  PID:6524
- C:\Windows\System\QPhCjer.exe
  C:\Windows\System\QPhCjer.exe
  2⤵
  PID:6540
- C:\Windows\System\qKVqxEc.exe
  C:\Windows\System\qKVqxEc.exe
  2⤵
  PID:6556
- C:\Windows\System\AVSoGyM.exe
  C:\Windows\System\AVSoGyM.exe
  2⤵
  PID:6572
- C:\Windows\System\KDFVWrz.exe
  C:\Windows\System\KDFVWrz.exe
  2⤵
  PID:6588
- C:\Windows\System\cBjhpgD.exe
  C:\Windows\System\cBjhpgD.exe
  2⤵
  PID:6604
- C:\Windows\System\mbqwOnV.exe
  C:\Windows\System\mbqwOnV.exe
  2⤵
  PID:6620
- C:\Windows\System\dlCBzDo.exe
  C:\Windows\System\dlCBzDo.exe
  2⤵
  PID:6636
- C:\Windows\System\ieWAHvJ.exe
  C:\Windows\System\ieWAHvJ.exe
  2⤵
  PID:6652
- C:\Windows\System\bbmzsyE.exe
  C:\Windows\System\bbmzsyE.exe
  2⤵
  PID:6668
- C:\Windows\System\uNHBEul.exe
  C:\Windows\System\uNHBEul.exe
  2⤵
  PID:6684
- C:\Windows\System\VxOqSRB.exe
  C:\Windows\System\VxOqSRB.exe
  2⤵
  PID:6700
- C:\Windows\System\LTBzslE.exe
  C:\Windows\System\LTBzslE.exe
  2⤵
  PID:6716
- C:\Windows\System\LGLJvSh.exe
  C:\Windows\System\LGLJvSh.exe
  2⤵
  PID:6732
- C:\Windows\System\CDpKQUr.exe
  C:\Windows\System\CDpKQUr.exe
  2⤵
  PID:6748
- C:\Windows\System\LPRKshP.exe
  C:\Windows\System\LPRKshP.exe
  2⤵
  PID:6764
- C:\Windows\System\KIcNtrL.exe
  C:\Windows\System\KIcNtrL.exe
  2⤵
  PID:6780
- C:\Windows\System\PjMUUoM.exe
  C:\Windows\System\PjMUUoM.exe
  2⤵
  PID:6796
- C:\Windows\System\tfBnSdq.exe
  C:\Windows\System\tfBnSdq.exe
  2⤵
  PID:6812
- C:\Windows\System\MyqJvKp.exe
  C:\Windows\System\MyqJvKp.exe
  2⤵
  PID:6828
- C:\Windows\System\ehzhwwX.exe
  C:\Windows\System\ehzhwwX.exe
  2⤵
  PID:6844
- C:\Windows\System\ciYigbP.exe
  C:\Windows\System\ciYigbP.exe
  2⤵
  PID:6860
- C:\Windows\System\BgbVXLl.exe
  C:\Windows\System\BgbVXLl.exe
  2⤵
  PID:6876
- C:\Windows\System\lZheGDz.exe
  C:\Windows\System\lZheGDz.exe
  2⤵
  PID:6892
- C:\Windows\System\PgiWWJc.exe
  C:\Windows\System\PgiWWJc.exe
  2⤵
  PID:6908
- C:\Windows\System\XmWKldj.exe
  C:\Windows\System\XmWKldj.exe
  2⤵
  PID:6924
- C:\Windows\System\LlEkaDW.exe
  C:\Windows\System\LlEkaDW.exe
  2⤵
  PID:6940
- C:\Windows\System\EhGxTuq.exe
  C:\Windows\System\EhGxTuq.exe
  2⤵
  PID:6960
- C:\Windows\System\MTihIVC.exe
  C:\Windows\System\MTihIVC.exe
  2⤵
  PID:6976
- C:\Windows\System\zNmvFYh.exe
  C:\Windows\System\zNmvFYh.exe
  2⤵
  PID:6992
- C:\Windows\System\RlbLFUh.exe
  C:\Windows\System\RlbLFUh.exe
  2⤵
  PID:7008
- C:\Windows\System\XoLDWnT.exe
  C:\Windows\System\XoLDWnT.exe
  2⤵
  PID:7024
- C:\Windows\System\dzRyopK.exe
  C:\Windows\System\dzRyopK.exe
  2⤵
  PID:7040
- C:\Windows\System\gRBNAEP.exe
  C:\Windows\System\gRBNAEP.exe
  2⤵
  PID:7056
- C:\Windows\System\jaYeMgk.exe
  C:\Windows\System\jaYeMgk.exe
  2⤵
  PID:7072
- C:\Windows\System\CWzBmxM.exe
  C:\Windows\System\CWzBmxM.exe
  2⤵
  PID:7088
- C:\Windows\System\pLqPRRd.exe
  C:\Windows\System\pLqPRRd.exe
  2⤵
  PID:7104
- C:\Windows\System\ZHLQoij.exe
  C:\Windows\System\ZHLQoij.exe
  2⤵
  PID:7120
- C:\Windows\System\tbEctlt.exe
  C:\Windows\System\tbEctlt.exe
  2⤵
  PID:7136
- C:\Windows\System\AVxmZWt.exe
  C:\Windows\System\AVxmZWt.exe
  2⤵
  PID:7152
- C:\Windows\System\wdFWDxs.exe
  C:\Windows\System\wdFWDxs.exe
  2⤵
  PID:5172
- C:\Windows\System\bGAOHXF.exe
  C:\Windows\System\bGAOHXF.exe
  2⤵
  PID:5908
- C:\Windows\System\HRJjmjF.exe
  C:\Windows\System\HRJjmjF.exe
  2⤵
  PID:5052
- C:\Windows\System\amGVFFz.exe
  C:\Windows\System\amGVFFz.exe
  2⤵
  PID:6180
- C:\Windows\System\EvIsCLa.exe
  C:\Windows\System\EvIsCLa.exe
  2⤵
  PID:6152
- C:\Windows\System\CQFWRGr.exe
  C:\Windows\System\CQFWRGr.exe
  2⤵
  PID:6228
- C:\Windows\System\sZksMjT.exe
  C:\Windows\System\sZksMjT.exe
  2⤵
  PID:6244
- C:\Windows\System\LghgKGR.exe
  C:\Windows\System\LghgKGR.exe
  2⤵
  PID:6248
- C:\Windows\System\ZrCPyet.exe
  C:\Windows\System\ZrCPyet.exe
  2⤵
  PID:6308
- C:\Windows\System\qDnfENY.exe
  C:\Windows\System\qDnfENY.exe
  2⤵
  PID:6356
- C:\Windows\System\UcutxMl.exe
  C:\Windows\System\UcutxMl.exe
  2⤵
  PID:6372
- C:\Windows\System\MEBtAdU.exe
  C:\Windows\System\MEBtAdU.exe
  2⤵
  PID:6376
- C:\Windows\System\wkPdmfB.exe
  C:\Windows\System\wkPdmfB.exe
  2⤵
  PID:6436
- C:\Windows\System\HPLMYWQ.exe
  C:\Windows\System\HPLMYWQ.exe
  2⤵
  PID:6488
- C:\Windows\System\QpNOGIm.exe
  C:\Windows\System\QpNOGIm.exe
  2⤵
  PID:6564
- C:\Windows\System\RVSirMy.exe
  C:\Windows\System\RVSirMy.exe
  2⤵
  PID:6628
- C:\Windows\System\JKuQFEC.exe
  C:\Windows\System\JKuQFEC.exe
  2⤵
  PID:6472
- C:\Windows\System\jhQFkmy.exe
  C:\Windows\System\jhQFkmy.exe
  2⤵
  PID:6552
- C:\Windows\System\NQRSWVu.exe
  C:\Windows\System\NQRSWVu.exe
  2⤵
  PID:6500
- C:\Windows\System\EWJaVnf.exe
  C:\Windows\System\EWJaVnf.exe
  2⤵
  PID:6788
- C:\Windows\System\fgvhInL.exe
  C:\Windows\System\fgvhInL.exe
  2⤵
  PID:6664
- C:\Windows\System\LkzBnTI.exe
  C:\Windows\System\LkzBnTI.exe
  2⤵
  PID:6900
- C:\Windows\System\qVlHfPK.exe
  C:\Windows\System\qVlHfPK.exe
  2⤵
  PID:6676
- C:\Windows\System\DmKqSWd.exe
  C:\Windows\System\DmKqSWd.exe
  2⤵
  PID:6868
- C:\Windows\System\aNRcWZs.exe
  C:\Windows\System\aNRcWZs.exe
  2⤵
  PID:6680
- C:\Windows\System\JKdXthG.exe
  C:\Windows\System\JKdXthG.exe
  2⤵
  PID:6968
- C:\Windows\System\oIoqEuM.exe
  C:\Windows\System\oIoqEuM.exe
  2⤵
  PID:6988
- C:\Windows\System\KhpOJAD.exe
  C:\Windows\System\KhpOJAD.exe
  2⤵
  PID:7032
- C:\Windows\System\dMjEctQ.exe
  C:\Windows\System\dMjEctQ.exe
  2⤵
  PID:7096
- C:\Windows\System\kyfhhBq.exe
  C:\Windows\System\kyfhhBq.exe
  2⤵
  PID:7160
- C:\Windows\System\qrixpHl.exe
  C:\Windows\System\qrixpHl.exe
  2⤵
  PID:5568
- C:\Windows\System\FxbHedr.exe
  C:\Windows\System\FxbHedr.exe
  2⤵
  PID:7020
- C:\Windows\System\euWwwZE.exe
  C:\Windows\System\euWwwZE.exe
  2⤵
  PID:6276
- C:\Windows\System\baeQUXQ.exe
  C:\Windows\System\baeQUXQ.exe
  2⤵
  PID:1672
- C:\Windows\System\YoeZTcS.exe
  C:\Windows\System\YoeZTcS.exe
  2⤵
  PID:7148
- C:\Windows\System\NXQVPAY.exe
  C:\Windows\System\NXQVPAY.exe
  2⤵
  PID:6032
- C:\Windows\System\oMWnfvh.exe
  C:\Windows\System\oMWnfvh.exe
  2⤵
  PID:6340
- C:\Windows\System\DDicGic.exe
  C:\Windows\System\DDicGic.exe
  2⤵
  PID:6424
- C:\Windows\System\BEmNfnF.exe
  C:\Windows\System\BEmNfnF.exe
  2⤵
  PID:6420
- C:\Windows\System\uXVlVoh.exe
  C:\Windows\System\uXVlVoh.exe
  2⤵
  PID:6440
- C:\Windows\System\PotHHfz.exe
  C:\Windows\System\PotHHfz.exe
  2⤵
  PID:6728
- C:\Windows\System\FjsTqUx.exe
  C:\Windows\System\FjsTqUx.exe
  2⤵
  PID:6520
- C:\Windows\System\LszoMLu.exe
  C:\Windows\System\LszoMLu.exe
  2⤵
  PID:6740
- C:\Windows\System\NWZXQhU.exe
  C:\Windows\System\NWZXQhU.exe
  2⤵
  PID:6872
- C:\Windows\System\pugapXV.exe
  C:\Windows\System\pugapXV.exe
  2⤵
  PID:7064
- C:\Windows\System\Kfsfntd.exe
  C:\Windows\System\Kfsfntd.exe
  2⤵
  PID:7000
- C:\Windows\System\YpltoEt.exe
  C:\Windows\System\YpltoEt.exe
  2⤵
  PID:6168
- C:\Windows\System\cLTSSnx.exe
  C:\Windows\System\cLTSSnx.exe
  2⤵
  PID:6280
- C:\Windows\System\VZqkYBF.exe
  C:\Windows\System\VZqkYBF.exe
  2⤵
  PID:7048
- C:\Windows\System\SFsxEjc.exe
  C:\Windows\System\SFsxEjc.exe
  2⤵
  PID:6760
- C:\Windows\System\CEHKpkl.exe
  C:\Windows\System\CEHKpkl.exe
  2⤵
  PID:6216
- C:\Windows\System\ccCLeei.exe
  C:\Windows\System\ccCLeei.exe
  2⤵
  PID:6984
- C:\Windows\System\zsnqsPC.exe
  C:\Windows\System\zsnqsPC.exe
  2⤵
  PID:7068
- C:\Windows\System\HdRKPIe.exe
  C:\Windows\System\HdRKPIe.exe
  2⤵
  PID:7132
- C:\Windows\System\FkPKiZB.exe
  C:\Windows\System\FkPKiZB.exe
  2⤵
  PID:5156
- C:\Windows\System\GiQZxEB.exe
  C:\Windows\System\GiQZxEB.exe
  2⤵
  PID:7184
- C:\Windows\System\PjAWKaA.exe
  C:\Windows\System\PjAWKaA.exe
  2⤵
  PID:7200
- C:\Windows\System\EduxitY.exe
  C:\Windows\System\EduxitY.exe
  2⤵
  PID:7216
- C:\Windows\System\AIySWjM.exe
  C:\Windows\System\AIySWjM.exe
  2⤵
  PID:7232
- C:\Windows\System\XbqKSfQ.exe
  C:\Windows\System\XbqKSfQ.exe
  2⤵
  PID:7248
- C:\Windows\System\WLzkHsF.exe
  C:\Windows\System\WLzkHsF.exe
  2⤵
  PID:7264
- C:\Windows\System\dWEZqOt.exe
  C:\Windows\System\dWEZqOt.exe
  2⤵
  PID:7280
- C:\Windows\System\SaCULdw.exe
  C:\Windows\System\SaCULdw.exe
  2⤵
  PID:7296
- C:\Windows\System\HSRyfIE.exe
  C:\Windows\System\HSRyfIE.exe
  2⤵
  PID:7312
- C:\Windows\System\iVgxkoD.exe
  C:\Windows\System\iVgxkoD.exe
  2⤵
  PID:7328
- C:\Windows\System\IbLptkt.exe
  C:\Windows\System\IbLptkt.exe
  2⤵
  PID:7344
- C:\Windows\System\ujBUjEM.exe
  C:\Windows\System\ujBUjEM.exe
  2⤵
  PID:7360
- C:\Windows\System\nYSKBgB.exe
  C:\Windows\System\nYSKBgB.exe
  2⤵
  PID:7376
- C:\Windows\System\oGJIGTE.exe
  C:\Windows\System\oGJIGTE.exe
  2⤵
  PID:7392
- C:\Windows\System\FOTHTPT.exe
  C:\Windows\System\FOTHTPT.exe
  2⤵
  PID:7408
- C:\Windows\System\OUFLHdL.exe
  C:\Windows\System\OUFLHdL.exe
  2⤵
  PID:7424
- C:\Windows\System\DrZBsct.exe
  C:\Windows\System\DrZBsct.exe
  2⤵
  PID:7440
- C:\Windows\System\HBfGRKn.exe
  C:\Windows\System\HBfGRKn.exe
  2⤵
  PID:7456
- C:\Windows\System\jkbGGcW.exe
  C:\Windows\System\jkbGGcW.exe
  2⤵
  PID:7472
- C:\Windows\System\gtXYiSu.exe
  C:\Windows\System\gtXYiSu.exe
  2⤵
  PID:7488
- C:\Windows\System\IRETiyQ.exe
  C:\Windows\System\IRETiyQ.exe
  2⤵
  PID:7504
- C:\Windows\System\tBegqjC.exe
  C:\Windows\System\tBegqjC.exe
  2⤵
  PID:7520
- C:\Windows\System\BrcaeQX.exe
  C:\Windows\System\BrcaeQX.exe
  2⤵
  PID:7536
- C:\Windows\System\ZRZrmma.exe
  C:\Windows\System\ZRZrmma.exe
  2⤵
  PID:7552
- C:\Windows\System\GnCFyYI.exe
  C:\Windows\System\GnCFyYI.exe
  2⤵
  PID:7568
- C:\Windows\System\pAWpfGr.exe
  C:\Windows\System\pAWpfGr.exe
  2⤵
  PID:7584
- C:\Windows\System\YgNqNAS.exe
  C:\Windows\System\YgNqNAS.exe
  2⤵
  PID:7600
- C:\Windows\System\uZNceif.exe
  C:\Windows\System\uZNceif.exe
  2⤵
  PID:7616
- C:\Windows\System\RLHqiDa.exe
  C:\Windows\System\RLHqiDa.exe
  2⤵
  PID:7636
- C:\Windows\System\eSoDROU.exe
  C:\Windows\System\eSoDROU.exe
  2⤵
  PID:7652
- C:\Windows\System\CxQTxnE.exe
  C:\Windows\System\CxQTxnE.exe
  2⤵
  PID:7672
- C:\Windows\System\SllJKjj.exe
  C:\Windows\System\SllJKjj.exe
  2⤵
  PID:7692
- C:\Windows\System\mWwyGLK.exe
  C:\Windows\System\mWwyGLK.exe
  2⤵
  PID:7708
- C:\Windows\System\xoWkNRk.exe
  C:\Windows\System\xoWkNRk.exe
  2⤵
  PID:7724
- C:\Windows\System\RzybMgw.exe
  C:\Windows\System\RzybMgw.exe
  2⤵
  PID:7740
- C:\Windows\System\LCaIuig.exe
  C:\Windows\System\LCaIuig.exe
  2⤵
  PID:7756
- C:\Windows\System\nMLayoI.exe
  C:\Windows\System\nMLayoI.exe
  2⤵
  PID:7772
- C:\Windows\System\TXGroIo.exe
  C:\Windows\System\TXGroIo.exe
  2⤵
  PID:7788
- C:\Windows\System\tsubAJW.exe
  C:\Windows\System\tsubAJW.exe
  2⤵
  PID:7804
- C:\Windows\System\BpvbOEv.exe
  C:\Windows\System\BpvbOEv.exe
  2⤵
  PID:7820
- C:\Windows\System\eHnSgZz.exe
  C:\Windows\System\eHnSgZz.exe
  2⤵
  PID:7836
- C:\Windows\System\SnDFhCi.exe
  C:\Windows\System\SnDFhCi.exe
  2⤵
  PID:7852
- C:\Windows\System\SriBGYD.exe
  C:\Windows\System\SriBGYD.exe
  2⤵
  PID:7868
- C:\Windows\System\gwPHZrP.exe
  C:\Windows\System\gwPHZrP.exe
  2⤵
  PID:7884
- C:\Windows\System\wcakJDe.exe
  C:\Windows\System\wcakJDe.exe
  2⤵
  PID:7900
- C:\Windows\System\rcLDTYg.exe
  C:\Windows\System\rcLDTYg.exe
  2⤵
  PID:7916
- C:\Windows\System\gdEIkxo.exe
  C:\Windows\System\gdEIkxo.exe
  2⤵
  PID:7932
- C:\Windows\System\HAToWLV.exe
  C:\Windows\System\HAToWLV.exe
  2⤵
  PID:7948
- C:\Windows\System\KsOPQWs.exe
  C:\Windows\System\KsOPQWs.exe
  2⤵
  PID:7964
- C:\Windows\System\tYXvsGL.exe
  C:\Windows\System\tYXvsGL.exe
  2⤵
  PID:7980
- C:\Windows\System\WqjOcOk.exe
  C:\Windows\System\WqjOcOk.exe
  2⤵
  PID:7996
- C:\Windows\System\qGnqhbn.exe
  C:\Windows\System\qGnqhbn.exe
  2⤵
  PID:8012
- C:\Windows\System\sFZNSlY.exe
  C:\Windows\System\sFZNSlY.exe
  2⤵
  PID:8028
- C:\Windows\System\LSobzbR.exe
  C:\Windows\System\LSobzbR.exe
  2⤵
  PID:8044
- C:\Windows\System\UZruCuC.exe
  C:\Windows\System\UZruCuC.exe
  2⤵
  PID:8060
- C:\Windows\System\KEgEvCk.exe
  C:\Windows\System\KEgEvCk.exe
  2⤵
  PID:8076
- C:\Windows\System\kOjsYcE.exe
  C:\Windows\System\kOjsYcE.exe
  2⤵
  PID:8092
- C:\Windows\System\EvFTCPH.exe
  C:\Windows\System\EvFTCPH.exe
  2⤵
  PID:8108
- C:\Windows\System\VamUHqX.exe
  C:\Windows\System\VamUHqX.exe
  2⤵
  PID:8124
- C:\Windows\System\rIIpPtY.exe
  C:\Windows\System\rIIpPtY.exe
  2⤵
  PID:8140
- C:\Windows\System\DVqYKas.exe
  C:\Windows\System\DVqYKas.exe
  2⤵
  PID:8156
- C:\Windows\System\GPNrWhl.exe
  C:\Windows\System\GPNrWhl.exe
  2⤵
  PID:8172
- C:\Windows\System\VmVfMKb.exe
  C:\Windows\System\VmVfMKb.exe
  2⤵
  PID:8188
- C:\Windows\System\QhzQhEj.exe
  C:\Windows\System\QhzQhEj.exe
  2⤵
  PID:5892
- C:\Windows\System\xtjOXRY.exe
  C:\Windows\System\xtjOXRY.exe
  2⤵
  PID:7192
- C:\Windows\System\KsijPBu.exe
  C:\Windows\System\KsijPBu.exe
  2⤵
  PID:7176
- C:\Windows\System\IrGBKvn.exe
  C:\Windows\System\IrGBKvn.exe
  2⤵
  PID:6212
- C:\Windows\System\hrbrggg.exe
  C:\Windows\System\hrbrggg.exe
  2⤵
  PID:6312
- C:\Windows\System\IjFPzEm.exe
  C:\Windows\System\IjFPzEm.exe
  2⤵
  PID:7212
- C:\Windows\System\exLFJvE.exe
  C:\Windows\System\exLFJvE.exe
  2⤵
  PID:6952
- C:\Windows\System\LyoDTKC.exe
  C:\Windows\System\LyoDTKC.exe
  2⤵
  PID:7240
- C:\Windows\System\eElTeCO.exe
  C:\Windows\System\eElTeCO.exe
  2⤵
  PID:7272
- C:\Windows\System\bUEccaf.exe
  C:\Windows\System\bUEccaf.exe
  2⤵
  PID:7352
- C:\Windows\System\xnhVwqt.exe
  C:\Windows\System\xnhVwqt.exe
  2⤵
  PID:7368
- C:\Windows\System\oYxcpmL.exe
  C:\Windows\System\oYxcpmL.exe
  2⤵
  PID:7448
- C:\Windows\System\mwUTjXT.exe
  C:\Windows\System\mwUTjXT.exe
  2⤵
  PID:7464
- C:\Windows\System\AbajuzO.exe
  C:\Windows\System\AbajuzO.exe
  2⤵
  PID:7436
- C:\Windows\System\XDuIjvA.exe
  C:\Windows\System\XDuIjvA.exe
  2⤵
  PID:7528
- C:\Windows\System\hUIOVPn.exe
  C:\Windows\System\hUIOVPn.exe
  2⤵
  PID:7592
- C:\Windows\System\ohKmXDk.exe
  C:\Windows\System\ohKmXDk.exe
  2⤵
  PID:7548
- C:\Windows\System\YWAXCZe.exe
  C:\Windows\System\YWAXCZe.exe
  2⤵
  PID:7612
- C:\Windows\System\lBjuYAZ.exe
  C:\Windows\System\lBjuYAZ.exe
  2⤵
  PID:7632
- C:\Windows\System\oIyURoL.exe
  C:\Windows\System\oIyURoL.exe
  2⤵
  PID:7660
- C:\Windows\System\SPyCbff.exe
  C:\Windows\System\SPyCbff.exe
  2⤵
  PID:7700
- C:\Windows\System\EhkxUwN.exe
  C:\Windows\System\EhkxUwN.exe
  2⤵
  PID:7764
- C:\Windows\System\gAEGKIJ.exe
  C:\Windows\System\gAEGKIJ.exe
  2⤵
  PID:7828
- C:\Windows\System\QrruWor.exe
  C:\Windows\System\QrruWor.exe
  2⤵
  PID:7860
- C:\Windows\System\RYCEoIs.exe
  C:\Windows\System\RYCEoIs.exe
  2⤵
  PID:7748
- C:\Windows\System\kyZecHj.exe
  C:\Windows\System\kyZecHj.exe
  2⤵
  PID:7816
- C:\Windows\System\HyHfQVU.exe
  C:\Windows\System\HyHfQVU.exe
  2⤵
  PID:7876
- C:\Windows\System\IZdCvDM.exe
  C:\Windows\System\IZdCvDM.exe
  2⤵
  PID:7944
- C:\Windows\System\HbXsGOI.exe
  C:\Windows\System\HbXsGOI.exe
  2⤵
  PID:8008
- C:\Windows\System\ZMBotXz.exe
  C:\Windows\System\ZMBotXz.exe
  2⤵
  PID:8072
- C:\Windows\System\rrWrzao.exe
  C:\Windows\System\rrWrzao.exe
  2⤵
  PID:8104
- C:\Windows\System\GSrKRLh.exe
  C:\Windows\System\GSrKRLh.exe
  2⤵
  PID:8168
- C:\Windows\System\YstCJXS.exe
  C:\Windows\System\YstCJXS.exe
  2⤵
  PID:7112
- C:\Windows\System\KHUzWir.exe
  C:\Windows\System\KHUzWir.exe
  2⤵
  PID:8052
- C:\Windows\System\grJicwB.exe
  C:\Windows\System\grJicwB.exe
  2⤵
  PID:7928
- C:\Windows\System\xanHNUE.exe
  C:\Windows\System\xanHNUE.exe
  2⤵
  PID:7992
- C:\Windows\System\GNFwzJM.exe
  C:\Windows\System\GNFwzJM.exe
  2⤵
  PID:8148
- C:\Windows\System\LqmDIQT.exe
  C:\Windows\System\LqmDIQT.exe
  2⤵
  PID:2812
- C:\Windows\System\tJAGtoC.exe
  C:\Windows\System\tJAGtoC.exe
  2⤵
  PID:6660
- C:\Windows\System\MGvGuUJ.exe
  C:\Windows\System\MGvGuUJ.exe
  2⤵
  PID:7256
- C:\Windows\System\iTnsQhU.exe
  C:\Windows\System\iTnsQhU.exe
  2⤵
  PID:7324
- C:\Windows\System\VpwTZLO.exe
  C:\Windows\System\VpwTZLO.exe
  2⤵
  PID:7432
- C:\Windows\System\UojEJJo.exe
  C:\Windows\System\UojEJJo.exe
  2⤵
  PID:7340
- C:\Windows\System\QjPVULs.exe
  C:\Windows\System\QjPVULs.exe
  2⤵
  PID:7648
- C:\Windows\System\xkXzfKB.exe
  C:\Windows\System\xkXzfKB.exe
  2⤵
  PID:7716
- C:\Windows\System\efgbkje.exe
  C:\Windows\System\efgbkje.exe
  2⤵
  PID:7912
- C:\Windows\System\qLTLFHx.exe
  C:\Windows\System\qLTLFHx.exe
  2⤵
  PID:7880
- C:\Windows\System\rrgWaeA.exe
  C:\Windows\System\rrgWaeA.exe
  2⤵
  PID:7384
- C:\Windows\System\dikTLsU.exe
  C:\Windows\System\dikTLsU.exe
  2⤵
  PID:7500
- C:\Windows\System\kZalAyb.exe
  C:\Windows\System\kZalAyb.exe
  2⤵
  PID:7664
- C:\Windows\System\wyDwVzD.exe
  C:\Windows\System\wyDwVzD.exe
  2⤵
  PID:7800
- C:\Windows\System\OvzBQoe.exe
  C:\Windows\System\OvzBQoe.exe
  2⤵
  PID:7960
- C:\Windows\System\icdrdNc.exe
  C:\Windows\System\icdrdNc.exe
  2⤵
  PID:8120
- C:\Windows\System\nyhaVVv.exe
  C:\Windows\System\nyhaVVv.exe
  2⤵
  PID:8088
- C:\Windows\System\khhrvgk.exe
  C:\Windows\System\khhrvgk.exe
  2⤵
  PID:6596
- C:\Windows\System\kgjuwtk.exe
  C:\Windows\System\kgjuwtk.exe
  2⤵
  PID:6536
- C:\Windows\System\QCWbnIO.exe
  C:\Windows\System\QCWbnIO.exe
  2⤵
  PID:7564
- C:\Windows\System\EBhrGFq.exe
  C:\Windows\System\EBhrGFq.exe
  2⤵
  PID:7224
- C:\Windows\System\jiRdqQI.exe
  C:\Windows\System\jiRdqQI.exe
  2⤵
  PID:7596
- C:\Windows\System\SvlCAxh.exe
  C:\Windows\System\SvlCAxh.exe
  2⤵
  PID:7404
- C:\Windows\System\VcLOhYP.exe
  C:\Windows\System\VcLOhYP.exe
  2⤵
  PID:7752
- C:\Windows\System\dgWkMrE.exe
  C:\Windows\System\dgWkMrE.exe
  2⤵
  PID:8200
- C:\Windows\System\rJDUBbq.exe
  C:\Windows\System\rJDUBbq.exe
  2⤵
  PID:8216
- C:\Windows\System\TwbJMXk.exe
  C:\Windows\System\TwbJMXk.exe
  2⤵
  PID:8240
- C:\Windows\System\yxPFVmv.exe
  C:\Windows\System\yxPFVmv.exe
  2⤵
  PID:8256
- C:\Windows\System\KtYUsHW.exe
  C:\Windows\System\KtYUsHW.exe
  2⤵
  PID:8272
- C:\Windows\System\DuuiXTU.exe
  C:\Windows\System\DuuiXTU.exe
  2⤵
  PID:8288
- C:\Windows\System\DwXEntM.exe
  C:\Windows\System\DwXEntM.exe
  2⤵
  PID:8304
- C:\Windows\System\bixVVMA.exe
  C:\Windows\System\bixVVMA.exe
  2⤵
  PID:8320
- C:\Windows\System\TiMjZvf.exe
  C:\Windows\System\TiMjZvf.exe
  2⤵
  PID:8336
- C:\Windows\System\hfsthvp.exe
  C:\Windows\System\hfsthvp.exe
  2⤵
  PID:8352
- C:\Windows\System\GfeXWgk.exe
  C:\Windows\System\GfeXWgk.exe
  2⤵
  PID:8368
- C:\Windows\System\tRTNzYK.exe
  C:\Windows\System\tRTNzYK.exe
  2⤵
  PID:8384
- C:\Windows\System\UyYQxiL.exe
  C:\Windows\System\UyYQxiL.exe
  2⤵
  PID:8400
- C:\Windows\System\RMczXzI.exe
  C:\Windows\System\RMczXzI.exe
  2⤵
  PID:8416
- C:\Windows\System\AbLCCxP.exe
  C:\Windows\System\AbLCCxP.exe
  2⤵
  PID:8432
- C:\Windows\System\czZrqwz.exe
  C:\Windows\System\czZrqwz.exe
  2⤵
  PID:8448
- C:\Windows\System\beDMvzN.exe
  C:\Windows\System\beDMvzN.exe
  2⤵
  PID:8464
- C:\Windows\System\NrDQZEn.exe
  C:\Windows\System\NrDQZEn.exe
  2⤵
  PID:8480
- C:\Windows\System\KTfTSBD.exe
  C:\Windows\System\KTfTSBD.exe
  2⤵
  PID:8496
- C:\Windows\System\dIIhcWI.exe
  C:\Windows\System\dIIhcWI.exe
  2⤵
  PID:8512
- C:\Windows\System\uhceGVu.exe
  C:\Windows\System\uhceGVu.exe
  2⤵
  PID:8528
- C:\Windows\System\BggNGlQ.exe
  C:\Windows\System\BggNGlQ.exe
  2⤵
  PID:8544
- C:\Windows\System\QLizOBx.exe
  C:\Windows\System\QLizOBx.exe
  2⤵
  PID:8560
- C:\Windows\System\IVcRKDM.exe
  C:\Windows\System\IVcRKDM.exe
  2⤵
  PID:8576
- C:\Windows\System\anQSwXp.exe
  C:\Windows\System\anQSwXp.exe
  2⤵
  PID:8592
- C:\Windows\System\bqLZMhi.exe
  C:\Windows\System\bqLZMhi.exe
  2⤵
  PID:8608
- C:\Windows\System\gvZzyCS.exe
  C:\Windows\System\gvZzyCS.exe
  2⤵
  PID:8624
- C:\Windows\System\wRiBKfQ.exe
  C:\Windows\System\wRiBKfQ.exe
  2⤵
  PID:8640
- C:\Windows\System\kizYFlx.exe
  C:\Windows\System\kizYFlx.exe
  2⤵
  PID:8656
- C:\Windows\System\VhWYkAy.exe
  C:\Windows\System\VhWYkAy.exe
  2⤵
  PID:8672
- C:\Windows\System\rYeLiPh.exe
  C:\Windows\System\rYeLiPh.exe
  2⤵
  PID:8688
- C:\Windows\System\GmfecoR.exe
  C:\Windows\System\GmfecoR.exe
  2⤵
  PID:8704
- C:\Windows\System\xTbbNda.exe
  C:\Windows\System\xTbbNda.exe
  2⤵
  PID:8720
- C:\Windows\System\cqEUmny.exe
  C:\Windows\System\cqEUmny.exe
  2⤵
  PID:8736
- C:\Windows\System\jANvxxG.exe
  C:\Windows\System\jANvxxG.exe
  2⤵
  PID:8752
- C:\Windows\System\eVKwxFn.exe
  C:\Windows\System\eVKwxFn.exe
  2⤵
  PID:8768
- C:\Windows\System\Htfucwf.exe
  C:\Windows\System\Htfucwf.exe
  2⤵
  PID:8784
- C:\Windows\System\drSuZWN.exe
  C:\Windows\System\drSuZWN.exe
  2⤵
  PID:8800
- C:\Windows\System\HpbSeZC.exe
  C:\Windows\System\HpbSeZC.exe
  2⤵
  PID:8816
- C:\Windows\System\vlXaUuA.exe
  C:\Windows\System\vlXaUuA.exe
  2⤵
  PID:8832
- C:\Windows\System\KWhzvRR.exe
  C:\Windows\System\KWhzvRR.exe
  2⤵
  PID:8848
- C:\Windows\System\diLobwR.exe
  C:\Windows\System\diLobwR.exe
  2⤵
  PID:8864
- C:\Windows\System\bJeuwpd.exe
  C:\Windows\System\bJeuwpd.exe
  2⤵
  PID:8880
- C:\Windows\System\vDoEPnf.exe
  C:\Windows\System\vDoEPnf.exe
  2⤵
  PID:8896
- C:\Windows\System\YnsaVdi.exe
  C:\Windows\System\YnsaVdi.exe
  2⤵
  PID:8912
- C:\Windows\System\vPVhsbf.exe
  C:\Windows\System\vPVhsbf.exe
  2⤵
  PID:8928
- C:\Windows\System\tNHtQFH.exe
  C:\Windows\System\tNHtQFH.exe
  2⤵
  PID:8944
- C:\Windows\System\rJtQnvi.exe
  C:\Windows\System\rJtQnvi.exe
  2⤵
  PID:8964
- C:\Windows\System\zQSCIEg.exe
  C:\Windows\System\zQSCIEg.exe
  2⤵
  PID:8980
- C:\Windows\System\EgBjjaZ.exe
  C:\Windows\System\EgBjjaZ.exe
  2⤵
  PID:8996
- C:\Windows\System\arOKyKM.exe
  C:\Windows\System\arOKyKM.exe
  2⤵
  PID:9012
- C:\Windows\System\dXKJoBR.exe
  C:\Windows\System\dXKJoBR.exe
  2⤵
  PID:9028
- C:\Windows\System\GffWSNR.exe
  C:\Windows\System\GffWSNR.exe
  2⤵
  PID:9048
- C:\Windows\System\IwGzwjr.exe
  C:\Windows\System\IwGzwjr.exe
  2⤵
  PID:9064
- C:\Windows\System\pzXnhGN.exe
  C:\Windows\System\pzXnhGN.exe
  2⤵
  PID:9080
- C:\Windows\System\TiacUaW.exe
  C:\Windows\System\TiacUaW.exe
  2⤵
  PID:9096
- C:\Windows\System\dOtHJqw.exe
  C:\Windows\System\dOtHJqw.exe
  2⤵
  PID:9112
- C:\Windows\System\VeOfnFg.exe
  C:\Windows\System\VeOfnFg.exe
  2⤵
  PID:9128
- C:\Windows\System\pHVsqjW.exe
  C:\Windows\System\pHVsqjW.exe
  2⤵
  PID:9144
- C:\Windows\System\MbBuEjd.exe
  C:\Windows\System\MbBuEjd.exe
  2⤵
  PID:9160
- C:\Windows\System\mRRoPcp.exe
  C:\Windows\System\mRRoPcp.exe
  2⤵
  PID:9176
- C:\Windows\System\ltPcKEm.exe
  C:\Windows\System\ltPcKEm.exe
  2⤵
  PID:9192
- C:\Windows\System\HivAutU.exe
  C:\Windows\System\HivAutU.exe
  2⤵
  PID:9208
- C:\Windows\System\dpwJpGP.exe
  C:\Windows\System\dpwJpGP.exe
  2⤵
  PID:7848
- C:\Windows\System\WTPpqRe.exe
  C:\Windows\System\WTPpqRe.exe
  2⤵
  PID:7812
- C:\Windows\System\cmBQkjo.exe
  C:\Windows\System\cmBQkjo.exe
  2⤵
  PID:8040
- C:\Windows\System\niUJYyl.exe
  C:\Windows\System\niUJYyl.exe
  2⤵
  PID:7988
- C:\Windows\System\TYcqmWx.exe
  C:\Windows\System\TYcqmWx.exe
  2⤵
  PID:7736
- C:\Windows\System\gJbUIxp.exe
  C:\Windows\System\gJbUIxp.exe
  2⤵
  PID:8196
- C:\Windows\System\QsYKWgv.exe
  C:\Windows\System\QsYKWgv.exe
  2⤵
  PID:8212
- C:\Windows\System\lwgHSon.exe
  C:\Windows\System\lwgHSon.exe
  2⤵
  PID:8248
- C:\Windows\System\nKihBLM.exe
  C:\Windows\System\nKihBLM.exe
  2⤵
  PID:8296
- C:\Windows\System\SIXfRqZ.exe
  C:\Windows\System\SIXfRqZ.exe
  2⤵
  PID:8364
- C:\Windows\System\HnlxNkE.exe
  C:\Windows\System\HnlxNkE.exe
  2⤵
  PID:8312
- C:\Windows\System\WkSQNAG.exe
  C:\Windows\System\WkSQNAG.exe
  2⤵
  PID:8380
- C:\Windows\System\UoOEMyH.exe
  C:\Windows\System\UoOEMyH.exe
  2⤵
  PID:8412
- C:\Windows\System\uBrJQEO.exe
  C:\Windows\System\uBrJQEO.exe
  2⤵
  PID:8444
- C:\Windows\System\fPteaeC.exe
  C:\Windows\System\fPteaeC.exe
  2⤵
  PID:8476
- C:\Windows\System\qZqAoIt.exe
  C:\Windows\System\qZqAoIt.exe
  2⤵
  PID:8508
- C:\Windows\System\aCvJYhu.exe
  C:\Windows\System\aCvJYhu.exe
  2⤵
  PID:8556
- C:\Windows\System\OzrYSIC.exe
  C:\Windows\System\OzrYSIC.exe
  2⤵
  PID:8588
- C:\Windows\System\GlMnwlH.exe
  C:\Windows\System\GlMnwlH.exe
  2⤵
  PID:8616
- C:\Windows\System\wukeKrD.exe
  C:\Windows\System\wukeKrD.exe
  2⤵
  PID:8632
- C:\Windows\System\VflzzJq.exe
  C:\Windows\System\VflzzJq.exe
  2⤵
  PID:8684
- C:\Windows\System\tJzwWDP.exe
  C:\Windows\System\tJzwWDP.exe
  2⤵
  PID:8744
- C:\Windows\System\BVUYXsm.exe
  C:\Windows\System\BVUYXsm.exe
  2⤵
  PID:8732
- C:\Windows\System\CwuhfGm.exe
  C:\Windows\System\CwuhfGm.exe
  2⤵
  PID:8780
- C:\Windows\System\AsLdRmd.exe
  C:\Windows\System\AsLdRmd.exe
  2⤵
  PID:8796
- C:\Windows\System\jxhbxab.exe
  C:\Windows\System\jxhbxab.exe
  2⤵
  PID:8856
- C:\Windows\System\laKmTyF.exe
  C:\Windows\System\laKmTyF.exe
  2⤵
  PID:8860
- C:\Windows\System\aRUOAYi.exe
  C:\Windows\System\aRUOAYi.exe
  2⤵
  PID:8892
- C:\Windows\System\mxnlCab.exe
  C:\Windows\System\mxnlCab.exe
  2⤵
  PID:8924
- C:\Windows\System\oGyjqZM.exe
  C:\Windows\System\oGyjqZM.exe
  2⤵
  PID:8952
- C:\Windows\System\RVANvsk.exe
  C:\Windows\System\RVANvsk.exe
  2⤵
  PID:8976
- C:\Windows\System\GPaujTr.exe
  C:\Windows\System\GPaujTr.exe
  2⤵
  PID:9020
- C:\Windows\System\yZtSulv.exe
  C:\Windows\System\yZtSulv.exe
  2⤵
  PID:9040
- C:\Windows\System\vJmhanE.exe
  C:\Windows\System\vJmhanE.exe
  2⤵
  PID:9104
- C:\Windows\System\hBikLNO.exe
  C:\Windows\System\hBikLNO.exe
  2⤵
  PID:9168
- C:\Windows\System\enECAWL.exe
  C:\Windows\System\enECAWL.exe
  2⤵
  PID:9120
- C:\Windows\System\fhOhPya.exe
  C:\Windows\System\fhOhPya.exe
  2⤵
  PID:9184
- C:\Windows\System\NfHPapI.exe
  C:\Windows\System\NfHPapI.exe
  2⤵
  PID:7796
- C:\Windows\System\TklfeeJ.exe
  C:\Windows\System\TklfeeJ.exe
  2⤵
  PID:7512
- C:\Windows\System\hhMNdCK.exe
  C:\Windows\System\hhMNdCK.exe
  2⤵
  PID:8224
- C:\Windows\System\OlndzSA.exe
  C:\Windows\System\OlndzSA.exe
  2⤵
  PID:8268
- C:\Windows\System\AMRbjGQ.exe
  C:\Windows\System\AMRbjGQ.exe
  2⤵
  PID:8236
- C:\Windows\System\RJGOeNH.exe
  C:\Windows\System\RJGOeNH.exe
  2⤵
  PID:8332
- C:\Windows\System\QMPpYZl.exe
  C:\Windows\System\QMPpYZl.exe
  2⤵
  PID:8396
- C:\Windows\System\vNBMbFg.exe
  C:\Windows\System\vNBMbFg.exe
  2⤵
  PID:8428
- C:\Windows\System\xeaqsNx.exe
  C:\Windows\System\xeaqsNx.exe
  2⤵
  PID:8520
- C:\Windows\System\itZziAO.exe
  C:\Windows\System\itZziAO.exe
  2⤵
  PID:8652
- C:\Windows\System\RaUZEFQ.exe
  C:\Windows\System\RaUZEFQ.exe
  2⤵
  PID:8572
- C:\Windows\System\uXNfHyM.exe
  C:\Windows\System\uXNfHyM.exe
  2⤵
  PID:8760
- C:\Windows\System\EpdwKdc.exe
  C:\Windows\System\EpdwKdc.exe
  2⤵
  PID:8664
- C:\Windows\System\RTuOjym.exe
  C:\Windows\System\RTuOjym.exe
  2⤵
  PID:8824
- C:\Windows\System\PKunKoY.exe
  C:\Windows\System\PKunKoY.exe
  2⤵
  PID:8920
- C:\Windows\System\tjLvLXk.exe
  C:\Windows\System\tjLvLXk.exe
  2⤵
  PID:8988
- C:\Windows\System\ydfwTbk.exe
  C:\Windows\System\ydfwTbk.exe
  2⤵
  PID:9044
- C:\Windows\System\JmqIfqg.exe
  C:\Windows\System\JmqIfqg.exe
  2⤵
  PID:9156
- C:\Windows\System\rSzJvKL.exe
  C:\Windows\System\rSzJvKL.exe
  2⤵
  PID:9008
- C:\Windows\System\quQUyyL.exe
  C:\Windows\System\quQUyyL.exe
  2⤵
  PID:9076
- C:\Windows\System\ukqgafr.exe
  C:\Windows\System\ukqgafr.exe
  2⤵
  PID:8300
- C:\Windows\System\gSXHtPS.exe
  C:\Windows\System\gSXHtPS.exe
  2⤵
  PID:7892
- C:\Windows\System\fOSwGUs.exe
  C:\Windows\System\fOSwGUs.exe
  2⤵
  PID:8460
- C:\Windows\System\oGYMzXi.exe
  C:\Windows\System\oGYMzXi.exe
  2⤵
  PID:8284
- C:\Windows\System\JVoOvZT.exe
  C:\Windows\System\JVoOvZT.exe
  2⤵
  PID:8728
- C:\Windows\System\zRwcouk.exe
  C:\Windows\System\zRwcouk.exe
  2⤵
  PID:8540
- C:\Windows\System\TnSdtaq.exe
  C:\Windows\System\TnSdtaq.exe
  2⤵
  PID:9152
- C:\Windows\System\xzLJUam.exe
  C:\Windows\System\xzLJUam.exe
  2⤵
  PID:8844
- C:\Windows\System\SkHcmHz.exe
  C:\Windows\System\SkHcmHz.exe
  2⤵
  PID:8488
- C:\Windows\System\bWAINyp.exe
  C:\Windows\System\bWAINyp.exe
  2⤵
  PID:9036
- C:\Windows\System\clKfCwa.exe
  C:\Windows\System\clKfCwa.exe
  2⤵
  PID:8136
- C:\Windows\System\UZgfcia.exe
  C:\Windows\System\UZgfcia.exe
  2⤵
  PID:7628
- C:\Windows\System\LppWvNM.exe
  C:\Windows\System\LppWvNM.exe
  2⤵
  PID:8776
- C:\Windows\System\jjQolXV.exe
  C:\Windows\System\jjQolXV.exe
  2⤵
  PID:8828
- C:\Windows\System\CSBepDM.exe
  C:\Windows\System\CSBepDM.exe
  2⤵
  PID:7924
- C:\Windows\System\DDBTgEY.exe
  C:\Windows\System\DDBTgEY.exe
  2⤵
  PID:8700
- C:\Windows\System\EomPFOG.exe
  C:\Windows\System\EomPFOG.exe
  2⤵
  PID:9228
- C:\Windows\System\cNeVzRA.exe
  C:\Windows\System\cNeVzRA.exe
  2⤵
  PID:9244
- C:\Windows\System\EuMTATP.exe
  C:\Windows\System\EuMTATP.exe
  2⤵
  PID:9260
- C:\Windows\System\FetSDZH.exe
  C:\Windows\System\FetSDZH.exe
  2⤵
  PID:9276
- C:\Windows\System\RcwknCa.exe
  C:\Windows\System\RcwknCa.exe
  2⤵
  PID:9292
- C:\Windows\System\tGgDjUZ.exe
  C:\Windows\System\tGgDjUZ.exe
  2⤵
  PID:9308
- C:\Windows\System\kJtlrEx.exe
  C:\Windows\System\kJtlrEx.exe
  2⤵
  PID:9324
- C:\Windows\System\SGYVFQW.exe
  C:\Windows\System\SGYVFQW.exe
  2⤵
  PID:9340
- C:\Windows\System\QKgICON.exe
  C:\Windows\System\QKgICON.exe
  2⤵
  PID:9356
- C:\Windows\System\rSxakve.exe
  C:\Windows\System\rSxakve.exe
  2⤵
  PID:9372
- C:\Windows\System\nPPSeSj.exe
  C:\Windows\System\nPPSeSj.exe
  2⤵
  PID:9388
- C:\Windows\System\UgLwGKy.exe
  C:\Windows\System\UgLwGKy.exe
  2⤵
  PID:9404
- C:\Windows\System\BGQixYk.exe
  C:\Windows\System\BGQixYk.exe
  2⤵
  PID:9420
- C:\Windows\System\XlpKzqp.exe
  C:\Windows\System\XlpKzqp.exe
  2⤵
  PID:9436
- C:\Windows\System\oQCaWvs.exe
  C:\Windows\System\oQCaWvs.exe
  2⤵
  PID:9452
- C:\Windows\System\RIoIPnj.exe
  C:\Windows\System\RIoIPnj.exe
  2⤵
  PID:9468
- C:\Windows\System\YYtvuav.exe
  C:\Windows\System\YYtvuav.exe
  2⤵
  PID:9484
- C:\Windows\System\yyRczxb.exe
  C:\Windows\System\yyRczxb.exe
  2⤵
  PID:9500
- C:\Windows\System\EXaqara.exe
  C:\Windows\System\EXaqara.exe
  2⤵
  PID:9516
- C:\Windows\System\LwoVjqj.exe
  C:\Windows\System\LwoVjqj.exe
  2⤵
  PID:9532
- C:\Windows\System\CzDJpon.exe
  C:\Windows\System\CzDJpon.exe
  2⤵
  PID:9548
- C:\Windows\System\uhQNSIO.exe
  C:\Windows\System\uhQNSIO.exe
  2⤵
  PID:9564
- C:\Windows\System\nwTyEgk.exe
  C:\Windows\System\nwTyEgk.exe
  2⤵
  PID:9580
- C:\Windows\System\CdivbFJ.exe
  C:\Windows\System\CdivbFJ.exe
  2⤵
  PID:9596
- C:\Windows\System\NNwDRRo.exe
  C:\Windows\System\NNwDRRo.exe
  2⤵
  PID:9612
- C:\Windows\System\IBRPEPw.exe
  C:\Windows\System\IBRPEPw.exe
  2⤵
  PID:9628
- C:\Windows\System\dWefSFp.exe
  C:\Windows\System\dWefSFp.exe
  2⤵
  PID:9644
- C:\Windows\System\PwrNGhs.exe
  C:\Windows\System\PwrNGhs.exe
  2⤵
  PID:9660
- C:\Windows\System\JvZladd.exe
  C:\Windows\System\JvZladd.exe
  2⤵
  PID:9676
- C:\Windows\System\iRiqicu.exe
  C:\Windows\System\iRiqicu.exe
  2⤵
  PID:9692
- C:\Windows\System\VJtjtsk.exe
  C:\Windows\System\VJtjtsk.exe
  2⤵
  PID:9708
- C:\Windows\System\xaNNShI.exe
  C:\Windows\System\xaNNShI.exe
  2⤵
  PID:9724
- C:\Windows\System\tSAuUcm.exe
  C:\Windows\System\tSAuUcm.exe
  2⤵
  PID:9740
- C:\Windows\System\grJHLXH.exe
  C:\Windows\System\grJHLXH.exe
  2⤵
  PID:9756
- C:\Windows\System\KQqBQLh.exe
  C:\Windows\System\KQqBQLh.exe
  2⤵
  PID:9772
- C:\Windows\System\iWCEEln.exe
  C:\Windows\System\iWCEEln.exe
  2⤵
  PID:9788
- C:\Windows\System\LKmPSDB.exe
  C:\Windows\System\LKmPSDB.exe
  2⤵
  PID:9804
- C:\Windows\System\TlAXrfl.exe
  C:\Windows\System\TlAXrfl.exe
  2⤵
  PID:9820
- C:\Windows\System\kFUkSdj.exe
  C:\Windows\System\kFUkSdj.exe
  2⤵
  PID:9836
- C:\Windows\System\aRXwixt.exe
  C:\Windows\System\aRXwixt.exe
  2⤵
  PID:9852
- C:\Windows\System\LkbtAnW.exe
  C:\Windows\System\LkbtAnW.exe
  2⤵
  PID:9868
- C:\Windows\System\BmrYDyy.exe
  C:\Windows\System\BmrYDyy.exe
  2⤵
  PID:9884
- C:\Windows\System\cbYeZtU.exe
  C:\Windows\System\cbYeZtU.exe
  2⤵
  PID:9900
- C:\Windows\System\XFVILdB.exe
  C:\Windows\System\XFVILdB.exe
  2⤵
  PID:9916
- C:\Windows\System\XhpYwzD.exe
  C:\Windows\System\XhpYwzD.exe
  2⤵
  PID:9932
- C:\Windows\System\QiRChbZ.exe
  C:\Windows\System\QiRChbZ.exe
  2⤵
  PID:9948
- C:\Windows\System\xnXmSGy.exe
  C:\Windows\System\xnXmSGy.exe
  2⤵
  PID:9964
- C:\Windows\System\VawBDQE.exe
  C:\Windows\System\VawBDQE.exe
  2⤵
  PID:9980
- C:\Windows\System\itOlBdo.exe
  C:\Windows\System\itOlBdo.exe
  2⤵
  PID:9996
- C:\Windows\System\XRIyLGb.exe
  C:\Windows\System\XRIyLGb.exe
  2⤵
  PID:10012
- C:\Windows\System\GiRNxXW.exe
  C:\Windows\System\GiRNxXW.exe
  2⤵
  PID:10028
- C:\Windows\System\DQftmXO.exe
  C:\Windows\System\DQftmXO.exe
  2⤵
  PID:10044
- C:\Windows\System\SqwLupy.exe
  C:\Windows\System\SqwLupy.exe
  2⤵
  PID:10060
- C:\Windows\System\eufemPa.exe
  C:\Windows\System\eufemPa.exe
  2⤵
  PID:10076
- C:\Windows\System\qUtXlDm.exe
  C:\Windows\System\qUtXlDm.exe
  2⤵
  PID:10092
- C:\Windows\System\ullPPlG.exe
  C:\Windows\System\ullPPlG.exe
  2⤵
  PID:10108
- C:\Windows\System\BXIcLeW.exe
  C:\Windows\System\BXIcLeW.exe
  2⤵
  PID:10124
- C:\Windows\System\iAWfTjx.exe
  C:\Windows\System\iAWfTjx.exe
  2⤵
  PID:10140
- C:\Windows\System\WdTekZr.exe
  C:\Windows\System\WdTekZr.exe
  2⤵
  PID:10156
- C:\Windows\System\jhBYgzY.exe
  C:\Windows\System\jhBYgzY.exe
  2⤵
  PID:10172
- C:\Windows\System\jXANBIn.exe
  C:\Windows\System\jXANBIn.exe
  2⤵
  PID:10188
- C:\Windows\System\KGywixE.exe
  C:\Windows\System\KGywixE.exe
  2⤵
  PID:10204
- C:\Windows\System\aDOIxTT.exe
  C:\Windows\System\aDOIxTT.exe
  2⤵
  PID:10220
- C:\Windows\System\dsOvegd.exe
  C:\Windows\System\dsOvegd.exe
  2⤵
  PID:10236
- C:\Windows\System\lDyqfus.exe
  C:\Windows\System\lDyqfus.exe
  2⤵
  PID:9236
- C:\Windows\System\BWnASjM.exe
  C:\Windows\System\BWnASjM.exe
  2⤵
  PID:9300
- C:\Windows\System\SIMMVFO.exe
  C:\Windows\System\SIMMVFO.exe
  2⤵
  PID:9364
- C:\Windows\System\uCMjGwR.exe
  C:\Windows\System\uCMjGwR.exe
  2⤵
  PID:9316
- C:\Windows\System\aAzQthK.exe
  C:\Windows\System\aAzQthK.exe
  2⤵
  PID:9220
- C:\Windows\System\BGVCklw.exe
  C:\Windows\System\BGVCklw.exe
  2⤵
  PID:9348
- C:\Windows\System\ZIbaUYH.exe
  C:\Windows\System\ZIbaUYH.exe
  2⤵
  PID:9432
- C:\Windows\System\qbnjFpW.exe
  C:\Windows\System\qbnjFpW.exe
  2⤵
  PID:9464
- C:\Windows\System\ZRIvXUO.exe
  C:\Windows\System\ZRIvXUO.exe
  2⤵
  PID:9380
- C:\Windows\System\mmrkxSK.exe
  C:\Windows\System\mmrkxSK.exe
  2⤵
  PID:9524
- C:\Windows\System\rzEPItT.exe
  C:\Windows\System\rzEPItT.exe
  2⤵
  PID:9588
- C:\Windows\System\PnFKTCU.exe
  C:\Windows\System\PnFKTCU.exe
  2⤵
  PID:9624
- C:\Windows\System\qkXXvLR.exe
  C:\Windows\System\qkXXvLR.exe
  2⤵
  PID:9512
- C:\Windows\System\uzJFrbv.exe
  C:\Windows\System\uzJFrbv.exe
  2⤵
  PID:9480
- C:\Windows\System\VuGQGtF.exe
  C:\Windows\System\VuGQGtF.exe
  2⤵
  PID:9652
- C:\Windows\System\ncsDUmQ.exe
  C:\Windows\System\ncsDUmQ.exe
  2⤵
  PID:9716
- C:\Windows\System\YfZsWeZ.exe
  C:\Windows\System\YfZsWeZ.exe
  2⤵
  PID:9780
- C:\Windows\System\bvQFYwP.exe
  C:\Windows\System\bvQFYwP.exe
  2⤵
  PID:9672
- C:\Windows\System\oVuRzOS.exe
  C:\Windows\System\oVuRzOS.exe
  2⤵
  PID:9848
- C:\Windows\System\sBFpxnG.exe
  C:\Windows\System\sBFpxnG.exe
  2⤵
  PID:9908
- C:\Windows\System\VMzcQWJ.exe
  C:\Windows\System\VMzcQWJ.exe
  2⤵
  PID:9764
- C:\Windows\System\sOaCXeo.exe
  C:\Windows\System\sOaCXeo.exe
  2⤵
  PID:9768
- C:\Windows\System\UrwxXST.exe
  C:\Windows\System\UrwxXST.exe
  2⤵
  PID:9736
- C:\Windows\System\MygiXDe.exe
  C:\Windows\System\MygiXDe.exe
  2⤵
  PID:9828
- C:\Windows\System\OsPMAVJ.exe
  C:\Windows\System\OsPMAVJ.exe
  2⤵
  PID:9928

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AHgANco.exe

Filesize
2.8MB

MD5
f09b6aa292e0866137eaf7ddaf100797

SHA1
248f6c0c511bd1ddaae2ce7b93c74d5760ed68a7

SHA256
2639152cd644d5951e360a614e938922a7bd1cd6d4ad761c8d89d9cfc94c7cde

SHA512
11da97d83d0c433d6b4002a7fc3c4bd881aa34cfa6d50ac78545caa4af84bb55299ba24fd685cfff38bf70fecad7e7a6540064c0c3ef4699bfa387f6b3b18fa6

Download Submit
C:\Windows\system\BGHvJEP.exe

Filesize
2.8MB

MD5
154ff24d12369e4eee3debc3a7fba909

SHA1
e1c642e322c66e08829757188a72fa61c5829eb5

SHA256
3a275bdef73fecd2876572541bd499b17dd654b2d076fdb987965b849e996e84

SHA512
96bc357f72547cb389c027a8d11e8bc724fccc5eba5a3d6f02a10e2ce673b84b5359909221b5ad88130482ccd41bc9c4a420ab59c5682f6a61eaf0e65a8ab2a4

Download Submit
C:\Windows\system\BtXcZsJ.exe

Filesize
2.8MB

MD5
f043a9e9e5cb36cd64672a0b6fd0585a

SHA1
c30158e00ba60634b5eaa423b4e41b56963cfe84

SHA256
2838bac39a53080aa860d343cdbed42d86d0b8f58387343cae80030faa32653f

SHA512
0d2ed8e2c6865ccfb5fa332e7d893b96d4886560813f3d026c278a9462abdce4ee8fea7879586e0e022167561d6ed13456bedcd254b732cdae10cae2d79e0331

Download Submit
C:\Windows\system\CndcemL.exe

Filesize
2.8MB

MD5
490b8bbb196b5c8c408d9ec22933922c

SHA1
53540236f948fb234a3c2e8351ed91e083a71926

SHA256
4f524006e0655ce815ca6ff9a278aab11f7c69a1f93f4941f6f731733c246988

SHA512
0765cc4361259a1dbc50b08638b3a8821c08eeb181a1915b9d0d83e2cb35e00d2b3a77c36f2fcba79a69fcbbd85e074852f1c54b6392d16f228653107de69559

Download Submit
C:\Windows\system\IYgKaWd.exe

Filesize
2.8MB

MD5
f3cb85509e10615bf1a0b93a7a3a0c7f

SHA1
a7a384f46c0f52da27e141b54ea58df9643bdd37

SHA256
e588480ef59dfe437a83b2b9372e8ce92a07e2a6f53885b8a6446bf7e7a7af8d

SHA512
ea31d466afb7ad64443bfa734c31be62ff8dc9fea131b1f00ec728f9e447da6bc440e2ac457ff537e38b4c887ca29c3b2f6629c8ef99ce342261ecef02636add

Download Submit
C:\Windows\system\LgjadPn.exe

Filesize
2.8MB

MD5
c49aee7bf92722c18c1db7f61aab7bd4

SHA1
4224fb3abbbc49c7d8bebb37d44e1f9d320d8cd7

SHA256
2e93095c9772cab43289f8ed426ba645430f26c4be59ae798cad89a257e32481

SHA512
cdc7a0d0d70fd5d967131bff78b4bf04a2a4b732f93e8abc446634b06cf7b7e3c7d586163b470b37d1362492f263bff8d28fe55b35ba371a0e21cce371fa04d4

Download Submit
C:\Windows\system\QMUzXFt.exe

Filesize
2.8MB

MD5
f3a1751c78ca330ef5aa8767784fa667

SHA1
52a16179d6940d9537092ac108e2c87fadb877f4

SHA256
97292eddfacb7549145b90ca6f0dbc2cc038d01b1105c16bef5763a1adc1902b

SHA512
441a8241afc89d44c28cf66a237c6fe06f08a10683771f13d38c77dc163f8ac2cdc792f5b5ae1378c8d7cda68fd16146eeee934544ea57401a1481572b020250

Download Submit
C:\Windows\system\RTDPDAw.exe

Filesize
2.8MB

MD5
d3eb38a1594b516a891cccf529825241

SHA1
af8b1ea009c8edde5cc36887e68f6b873c22025e

SHA256
0ab871f39023a7e50e8866df6f798ab4c875b5cf487fbae49d0403dc80e946af

SHA512
8fedc8400172c983cde0dfc25f62b3fd497525089068196d5ff3a663d479d2788b334d4515cfc3a4e5c13f0bcd8fd3122b16d9f70e7cc627ec1b6177d55f23e3

Download Submit
C:\Windows\system\TDlcihy.exe

Filesize
2.8MB

MD5
9e06ed5394dd60b389c8a4bcc21fd4ee

SHA1
4d6968fdd6bb440c320f1edf2768cda96b84c944

SHA256
2b0774e6ab2df4737a5f915c9a315aac4cd5090dfe0c2989e4166b765a8a2bc0

SHA512
db0d35511d1d5fbf43c7d27831e8bea54e345ffbc59e578c8750fb4571b0f3467c1a2646dd2bc543df18b0be510af521a207e4bcdf277f390a112eda47f0c64d

Download Submit
C:\Windows\system\XPNFKIB.exe

Filesize
2.8MB

MD5
881f81c76a70eab097fdb8752f084220

SHA1
0c8c4b921bcc5f6d48270c068851dee0a7102bf4

SHA256
75c7534fff0a3ca45cb9f1d810ec4cb9dfbbad846f3fdad0dc0354e2ca592a11

SHA512
fc97222326b86eedb5a252d5c06b2a328a001aeae8ddf899430c0468de8d71b268061d7c13cde6fa04e7793d2b2638912b1fe887e3ca19408bdc969c493563a4

Download Submit
C:\Windows\system\ZVFPMyt.exe

Filesize
2.8MB

MD5
763eb7c8ffff6dfcc3a72c986af07033

SHA1
7e16a4d8eca53d33fda90f15ae5e49bd2e493e88

SHA256
73f4aa2372644dce1599c3b6a8b68ca86304dd73386e45ae60059450054a6974

SHA512
3db0a20225c60c904cb8a83fa55ebf19f07ea21c0eb1f55122ec3e15702682eba3e7e98b742594ff3d2351690ed041fb67b5d84c5a40da336c3fc08882661c11

Download Submit
C:\Windows\system\deLGvUy.exe

Filesize
2.8MB

MD5
be5185986c7ec7049760244377f3e40a

SHA1
c2efe1be7fe863d184545fec59d054ddabc447c4

SHA256
177306632b4d3c7086cd5e0d693104770e5addcd437c82c8f923d9a439de21c2

SHA512
3901963303de96537f50b7a5b366fde1d39f6c9cff1d00754c14eb4a11b24d06f57f12d345f1ac516e717d42bb211ac0a11d5962258c1a26aa9e86b44f109efc

Download Submit
C:\Windows\system\fDRqNRN.exe

Filesize
2.8MB

MD5
c5bb51492daa675207b26db06e25c0ac

SHA1
100b0372b5ee91d2cf46c683015d76a971283d49

SHA256
72be85511cd11e72471cd69c996216c0d3a9f207217605d6417570c4cdbf2490

SHA512
3451bb55a3c4002c2c1d6a32ba22fb7f06268a7166b43c075b56892844163f91edca7da2875252701b0f69041a05fedca43c8cd71ade5fc91279eb8aa29e27fb

Download Submit
C:\Windows\system\foWUpsY.exe

Filesize
2.8MB

MD5
6f5e68a82caa6f3384c328d15da249b4

SHA1
3f58e67e6834151b16af0417688c27d5a35543fd

SHA256
7f41c619b14973deba9886dc6c41bdccb89aa9aa22dc21573cedbe0e0bd411a7

SHA512
137ee3b7ff017dfe8cc3efc1704c02a0e333f92f541a2e1bd1039efce1226d39bc6ea48700c71769f858996999be669aa15e36c922f6d8815acedf227e5808ad

Download Submit
C:\Windows\system\fpAVJcu.exe

Filesize
2.8MB

MD5
2ff59c07ab83c63ddcdc619579caec95

SHA1
33a6f3bd85e99c0d0c226f19e9c58b834ef06cfb

SHA256
9d39d271d59276e7c0b3315ff861372efc46bb1465b78caef0d86746bcb23055

SHA512
b74bb521eecb28daf447501ed2d2f9d226d16206d06bee485697bc7cfc3821e8175c779e72406ce13efdba688ae6f2bb3856843a750ee2418a3f32aedb30f4dd

Download Submit
C:\Windows\system\fzMAvsQ.exe

Filesize
2.8MB

MD5
dfa028b621d06430757b0030f8ea654b

SHA1
c200153c41a9758eeb338608c1d9b02cc0b2d803

SHA256
8e8048521d05c7498d1f750b21f1b9189de3b1475e2a80163a689b447e1cbd2a

SHA512
d1dc58cfd557cc9b2a790d49cb2dffdc77b04e325126322e33a4a5a203d28ae714eac29571f2c284ac5ff4b09241bede10221ff27e6354685d799c96a604c305

Download Submit
C:\Windows\system\rTKEdRC.exe

Filesize
2.8MB

MD5
43c53af2c504044549d71c2fabd656b8

SHA1
2a3805e22d787f4df3b0f39ec8700560f5be9f40

SHA256
d37dd806de958ff086d8044e3e8b116053f2833a9116efeb9748c648138d7b1d

SHA512
877ccf8db54c72bc973efda274436d04ddcaf2e493bc15106ebe2974ccc8052141a0c21b221afe1a8fd2ccd4a307a1e1eaefd9bbe1c0dd218a74bbcfb97681c3

Download Submit
C:\Windows\system\rjFRcJV.exe

Filesize
2.8MB

MD5
25b29c7de49bf3c96af34228c46fa35a

SHA1
98093519e3abf702fe96e17573fb05d8b29d6229

SHA256
c32240dcb53824cd59e14d95b50d8fe717bf8a86d4aee04f7f728d85c669a842

SHA512
8c2b12656534bc09e9a282ab350dac4fb3255a7a234286cc1963e4b1717e665603c55e6d124e85bbcd014b3805c1a7780850b77452662b0e4d05b98eb790f45c

Download Submit
C:\Windows\system\vXyCXgI.exe

Filesize
2.8MB

MD5
22bda1b79cf9f488ffe670f2093b2e40

SHA1
461a8324ee9eabf57959dc6070a5102c4d21270e

SHA256
6c5c0d43afec7438cf82f5c0dbe6795dc80d026b8016381c9890f7584b7c3bb2

SHA512
6807060cecb5de5a13cd4be95ecfe156ad731e678ff743239351a21d1e6715ef2a02385506729baf0b9af9e789b36ecd1575c0cd4cb0546f017f4777063792c3

Download Submit
C:\Windows\system\weZiPXf.exe

Filesize
2.8MB

MD5
4b36d9602227f482dc7082b837075aa0

SHA1
19dc51e4091a92a633a82da3b869467e4cd9fd17

SHA256
70ed8be885879805f5441c11e2847392c2eb2e488403659443c18cdc5ef6cc48

SHA512
b4a43a46cecae075a1da518d1595c2f7a1500e8eb1130bc062dcebc9eba7abdcc60add236c48b67de1ce689eb562bbd6463f2510be55156322083980347777ad

Download Submit
C:\Windows\system\xvRnkay.exe

Filesize
2.8MB

MD5
fc67ea57071d1b9c7bd20502916a8086

SHA1
a9714c6fe813cd48b478cab412da111d6fa568c9

SHA256
1d70837ed73b9f5615f2597dab94536b3688006948e026f5a8516d6d00e446bd

SHA512
1011a78364b35cad7aaebaae6de4a45f28b025ddbbecd38031b33e07e823dddc677cce2cc06e2a3904e93926097bcd6afcfc5923aea596e239cf812e589afb87

Download Submit
C:\Windows\system\yUbsiPE.exe

Filesize
2.8MB

MD5
b1c84b807bd3f492bbbb44fbd6c52503

SHA1
7eeeb46eb81e2b89196226a3b605e2af91f44e8a

SHA256
fd2ac5af77757604a35a7fb825d3f13f51b913000863c5c4fa63ec681fe2d824

SHA512
99920caeefaed55e5db58e28b7a0a81ad4b7a125bb04df2d1559fcc5546dcad75d063579d859aa1c2b1792162c4132aad12c4059434de5f7d02d94283f78a633

Download Submit
\Windows\system\CNHHEOR.exe

Filesize
2.8MB

MD5
fda89a0c9aa48f7391d43ffbd31ced5f

SHA1
ee3b1bc75614cc611d2c4fd6d88e7adee3397f09

SHA256
70e67af9601a5453c70b65465034d5aad9fb4de5e5c6f2ed79929f44a7cfc44b

SHA512
2d77cb2d1d3b588b975dabe3a4db45e08561bd2e81b7273c00526aa7068f0845ebeae2b88406b929770c55ca0b656cf861cecca14202a6a2cc03e9a24e9f576f

Download Submit
\Windows\system\EkpMNPd.exe

Filesize
2.8MB

MD5
51695c186cb6f3f00df412c476245735

SHA1
55b5c67e349310c1bbe0ea2df2ce20fef07ecebf

SHA256
d7fb9593c61112825ba821772cbcce5ec7c2d90a6084f34894d4413e2af741c8

SHA512
1c30451222cfa0ba7ce53f1491573e304f4c0f9f6629367cf0da29f1a78abdf77a950408c8f39be924ddd522b61c580d374cef6fa9f743fc99cecc5ba1a4bfea

Download Submit
\Windows\system\IdZkWfm.exe

Filesize
2.8MB

MD5
c0be08e1286194c68df5b0cbfa312866

SHA1
681e59de59043287dda5f67e33551f4e72a84c55

SHA256
aad3912646299994a7d10433ca6c5717ca62d9b22f6b9894b662033c678db404

SHA512
ee37b3126768295fac7294601a4b594902b4f71e0f29919f31929a673229306ac3fd523cf076da4a91f8da9081d9179f3a92e93afe16e09dbc01d388eeb70165

Download Submit
\Windows\system\XUyhPHZ.exe

Filesize
2.8MB

MD5
69d9ffd4be863a6fe3002595bac4a248

SHA1
7b38024fadbcd0674b3ef5569ebefa84241caf3c

SHA256
00dd172ea3fce36802155c29351876d003413719040b31e7a1e318e21599a6f2

SHA512
2b3ccaa768bd754e13aaa1ef68c5e3ca67afced409420e85f423d437f5fdb0a51635c7d31db18d8235986da357f8aa7c2814af9e823bc1948d04da0f0beebec7

Download Submit
\Windows\system\auguBuR.exe

Filesize
2.8MB

MD5
a739f00928851a61bca8766349c80771

SHA1
3a2c0d78fd4187555f5b46c5b5ac8b66ddcbb7f6

SHA256
195ceb1b119ccbdb084086de40acf8fa74f0631d21a3568d414518da5684529f

SHA512
123e63c1291736fbb0f5fbab822a83b69363f5985fd012ebee1644772e431ed0c01b8bd61a8f41508f58431cb29489d48771a1aa3915e5b385d1644b2e5360b1

Download Submit
\Windows\system\bvMFoAr.exe

Filesize
2.8MB

MD5
d840818eba7ee49ecb681317ba738acd

SHA1
c0f581fcdd56194eb92ab85ca0603b54a5c52a2b

SHA256
22d30ac6692f753d66b07ef86ac3c9d86b2e029b0ce8ab7de7bd2b53f9161a80

SHA512
241ecd3c24c6ee41c4ea07d4b521d712362be719aa43267dec496261c7273481128fa95406f82e0a54552a2d62233205ecff22f7282c768c829a50fd8b2d735c

Download Submit
\Windows\system\dIJUtJe.exe

Filesize
2.8MB

MD5
d575293f6ea8c4da31d3a942382ac7b3

SHA1
697eb9f28a7cc751db8080b8ef8541793aa4e2c2

SHA256
5d50f9fb6e2748518a3cffee0a39b48ce0f6e8ff2f42dd595c5178ef73c0d73c

SHA512
345bb4f9dc84c14d41fb1584699b664f5d675e620b143ed22b5876e988f8d1984f471cd2029864343660e53ac8ac77a2b9d6c68821888e4641c54b2ab002f381

Download Submit
\Windows\system\diasYgd.exe

Filesize
2.8MB

MD5
093fff5633941e2b92950b746ecf03d3

SHA1
20a270f1467a43acc5459696003fcdeee3a725d5

SHA256
72f01af18d8a5ac4961b988e50de8fd99e56e45912eacfb9926eaeb79ed41311

SHA512
81c9d7ed5a972fef22f2d861048e7d8f73d0f7eaefc1769099b59a39b6a8428d9c2b9ee0e922e9b795f64bd27de1e963934f14ea3e6e9b23e2211415dde030db

Download Submit
\Windows\system\jKAicyq.exe

Filesize
2.8MB

MD5
8668293cf9d5f1b8efd4c9fa388c1cf7

SHA1
ca97717003794d2da44d8ee406a7120a221aa491

SHA256
0a629fe03d49b2ab492a67227d7b04ba0950352dcd3bf952f7093485fb0ac41f

SHA512
bd2ba94641aa7a8eb917ed62270ef167f92bcbb10c00e4e1f58611f91e75c76f9bb5200c43987ac58ebbc4757ec4123bb71ba2e1ce08aba9c9f36d5dca7bae58

Download Submit
\Windows\system\lautblh.exe

Filesize
2.8MB

MD5
50b40dcec56783546ed68580af1986b8

SHA1
7152ead804e6e76ea538920bd275a035e5833c4b

SHA256
4ac86d1aeee34b9b6950a7cd8d30ff56c40c3072fb88190fbf504e3eb4c38bda

SHA512
f4778d40986d673f396d3e15e2dc63a5dae2ebdf2a645a17f4e393ac6f507204f8de1774d9c9d507d086bf03c5bae158ba0fa75a817e84fd0063c0670fea84d8

Download Submit
\Windows\system\whHXkfB.exe

Filesize
2.8MB

MD5
2267c3160a9f68b82be307d5a9038a3b

SHA1
373e7db7a667387b0489bfcc6a231f8022da44fa

SHA256
9abc14955ef30b85c4dd8e42b77b2cb0744085bfea678d717dfa66377a0cc3dd

SHA512
a27838e09588c4d3d1664dbb6005421e150599afcbf48eb59e27822599617eeffaa93fde65056280d44a040c4c529ab285536310ff0ad7ece8e7ab160841c1fc

Download Submit
memory/1656-14-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2072-13-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2176-147-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-175-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2176-358-0x000007FEF5660000-0x000007FEF5FFD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-176-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2176-148-0x0000000002E10000-0x0000000002E90000-memory.dmp

Filesize
512KB

Download
memory/2196-158-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2484-149-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2484-15-0x00000000031B0000-0x00000000035A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-29-0x00000000031B0000-0x00000000035A2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-0-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2484-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2484-154-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-164-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-152-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2484-155-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-163-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2484-157-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2484-150-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2520-156-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2560-162-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2636-159-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-153-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2692-161-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2728-165-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2744-35-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2748-151-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download