xmrig | b7d2ba245679aee34b115ebd8b721d8f6fb3b153fc792b93c480b933370ef061

Analysis

max time kernel
26s
max time network
28s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Size

1.5MB
MD5

01ac27cf02bdcd3321f3eada6b20b214
SHA1

5fcd46eb3085f180d629f2f49e95fc8c887d64d4
SHA256

b7d2ba245679aee34b115ebd8b721d8f6fb3b153fc792b93c480b933370ef061
SHA512

56279085894fb4ba72b68817a5d38d60cca4f497a87286d1292c770220b6be6930cd0212cb9fa85d753dd5ceb0fafd8c6f79e0f6b1e69a6b07aa7fea17580ac3
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VxjzSRLgxc2x:Lz071uv4BPMkibTIA5CJKxG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2476-156-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2920-145-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2572-160-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2412-157-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2588-155-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	xmrig
behavioral1/memory/2284-138-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2528-71-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2676-66-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	xmrig
behavioral1/memory/2540-60-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2540	CRpkebd.exe
2676	VgKdMxo.exe
2528	uEnZAqp.exe
2284	SBzJxbt.exe
2920	RtxploK.exe
2588	snUiYfd.exe
2476	HzbsEsG.exe
2572	lXJmPcC.exe
2412	cutlmrM.exe
320	AyxcMSq.exe
2468	tTQutuI.exe
2708	OZZCeYu.exe
2732	FFSGMAE.exe
2184	SNYnIvI.exe
1172	kmUdGrs.exe
1896	AItwFTB.exe
768	pjTsdOH.exe
1632	kkqIhWw.exe
1552	YJjgWxu.exe
324	SWyRbzs.exe
880	obiOVsx.exe
2000	KmpWhBO.exe
2768	lyWNGxn.exe
1056	tWHNOSd.exe
336	tvhaMgz.exe
2020	NNYrzfh.exe
3040	wOFeomi.exe
2252	dNdesfB.exe
1096	ElIwVAM.exe
3024	GTAqwSL.exe
2324	GuLMzao.exe
1712	XjlOiAY.exe
2828	whMGeXg.exe
356	RuirnIz.exe
1304	gmbEKcs.exe
1660	UjKsNtU.exe
108	TUYCCHR.exe
380	CsnCvJO.exe
968	rvgbTii.exe
3064	spEIdwm.exe
2212	chInsMD.exe
792	LbhWtCC.exe
572	vabNvjB.exe
1884	NuPITAB.exe
1536	XDDnEBo.exe
1364	iwQsDiX.exe
1668	shJHfMr.exe
2092	pkCECyP.exe
1504	bNQzbiq.exe
1960	YWomqjP.exe
2504	ZhRCYEx.exe
2964	EqjCGdG.exe
2688	EyUECLR.exe
1940	wzmwjPk.exe
2596	gmUoUrH.exe
2660	OlmUnnE.exe
2712	GJGfhxt.exe
840	JTzghXw.exe
2536	EiiIqBP.exe
2424	PDrgbOV.exe
2632	KoMYiED.exe
2488	yeMlBIZ.exe
1580	zqwTCYv.exe
328	WWlCROt.exe

Loads dropped DLL 64 IoCs

pid	Process
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2700-0-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/files/0x000b00000001431b-6.dat	upx
behavioral1/files/0x0031000000015d9c-10.dat	upx
behavioral1/files/0x0008000000016122-9.dat	upx
behavioral1/files/0x0016000000005586-25.dat	upx
behavioral1/files/0x0006000000016d31-46.dat	upx
behavioral1/files/0x0007000000016d21-45.dat	upx
behavioral1/files/0x0006000000016d29-52.dat	upx
behavioral1/files/0x0008000000016575-28.dat	upx
behavioral1/files/0x00070000000163eb-24.dat	upx
behavioral1/files/0x0006000000016d85-63.dat	upx
behavioral1/files/0x0006000000016e56-75.dat	upx
behavioral1/files/0x0006000000016f7e-85.dat	upx
behavioral1/files/0x000600000001738c-95.dat	upx
behavioral1/files/0x00060000000173e7-110.dat	upx
behavioral1/files/0x00060000000173dc-102.dat	upx
behavioral1/files/0x0006000000017472-117.dat	upx
behavioral1/files/0x00060000000173c5-96.dat	upx
behavioral1/files/0x0006000000017510-132.dat	upx
behavioral1/files/0x000600000001737e-87.dat	upx
behavioral1/memory/2476-156-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x000600000001748d-163.dat	upx
behavioral1/files/0x0010000000015f23-168.dat	upx
behavioral1/files/0x000600000001864a-174.dat	upx
behavioral1/files/0x00060000000190b3-185.dat	upx
behavioral1/files/0x00060000000190bc-187.dat	upx
behavioral1/files/0x000500000001877f-181.dat	upx
behavioral1/files/0x00050000000191d7-191.dat	upx
behavioral1/files/0x0005000000018674-164.dat	upx
behavioral1/memory/2920-145-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x000600000001745d-114.dat	upx
behavioral1/memory/2572-160-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2412-157-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2588-155-0x000000013F5B0000-0x000000013F9A2000-memory.dmp	upx
behavioral1/files/0x000d00000001865b-153.dat	upx
behavioral1/files/0x00060000000173df-140.dat	upx
behavioral1/memory/2284-138-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x000600000001737b-84.dat	upx
behavioral1/files/0x0006000000016da9-72.dat	upx
behavioral1/memory/2528-71-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2676-66-0x000000013F9F0000-0x000000013FDE2000-memory.dmp	upx
behavioral1/memory/2540-60-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0006000000016d81-57.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\LZeIxrF.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\BVuRXlz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\IOJarCp.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\QAzGHdj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\AOiBqoA.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\Diheqzt.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\TUYCCHR.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ZoEZiuk.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\suAshmC.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\TUdDArf.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\AyxcMSq.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\otHNiHm.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\JvwMWiH.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\mOIkabT.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\baGzkfu.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\uFqLLoL.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\vhMxwhY.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\MIWmFRl.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ylOSKme.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\iWOmZGb.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\bKFVjXA.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gIzKnHK.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\WJOeKBt.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\IMsbpTy.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gvJkkRn.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\RHJMhnO.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\JTzghXw.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\soowpqo.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\ZGEIqwA.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\UOMVePF.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gkTSEXG.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\AItwFTB.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\GcBfonV.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\YCjuxUf.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\RrVLopq.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\msMjLFZ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\etVDpGi.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\WmEprGX.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\NrhjWxH.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\xysxJPV.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\meWPdho.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\xnPCDGd.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\yRSmsqL.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\RTTPaKW.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\gUFxXuj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\woNjjHy.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\xPLzToC.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\lJPJKaz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\spEIdwm.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\pkCECyP.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\waAOApq.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\GieBGrg.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\Dexnmku.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\svyqakZ.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\sjixENe.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\LYjwVUb.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\QmIAgav.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\sorzRdM.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\QTKjBVz.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\STWoiea.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\AvjKwhG.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\sNpwPvj.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\CsAwPmR.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
File created	C:\Windows\System\tpBAZfr.exe	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2508	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
Token: SeDebugPrivilege	2508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2508	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	29
PID 2700 wrote to memory of 2508	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	29
PID 2700 wrote to memory of 2508	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	29
PID 2700 wrote to memory of 2540	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2540	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2540	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	30
PID 2700 wrote to memory of 2676	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	31
PID 2700 wrote to memory of 2676	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	31
PID 2700 wrote to memory of 2676	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	31
PID 2700 wrote to memory of 2528	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2528	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2528	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	32
PID 2700 wrote to memory of 2284	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2284	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2284	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	33
PID 2700 wrote to memory of 2920	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	34
PID 2700 wrote to memory of 2920	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	34
PID 2700 wrote to memory of 2920	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	34
PID 2700 wrote to memory of 2572	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	35
PID 2700 wrote to memory of 2572	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	35
PID 2700 wrote to memory of 2572	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	35
PID 2700 wrote to memory of 2588	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2588	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2588	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	36
PID 2700 wrote to memory of 2412	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	37
PID 2700 wrote to memory of 2412	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	37
PID 2700 wrote to memory of 2412	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	37
PID 2700 wrote to memory of 2476	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	38
PID 2700 wrote to memory of 2476	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	38
PID 2700 wrote to memory of 2476	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	38
PID 2700 wrote to memory of 320	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	39
PID 2700 wrote to memory of 320	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	39
PID 2700 wrote to memory of 320	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	39
PID 2700 wrote to memory of 2468	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	40
PID 2700 wrote to memory of 2468	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	40
PID 2700 wrote to memory of 2468	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	40
PID 2700 wrote to memory of 2708	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	41
PID 2700 wrote to memory of 2708	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	41
PID 2700 wrote to memory of 2708	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	41
PID 2700 wrote to memory of 2732	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	42
PID 2700 wrote to memory of 2732	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	42
PID 2700 wrote to memory of 2732	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	42
PID 2700 wrote to memory of 1172	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	43
PID 2700 wrote to memory of 1172	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	43
PID 2700 wrote to memory of 1172	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	43
PID 2700 wrote to memory of 2184	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	44
PID 2700 wrote to memory of 2184	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	44
PID 2700 wrote to memory of 2184	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	44
PID 2700 wrote to memory of 1896	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	45
PID 2700 wrote to memory of 1896	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	45
PID 2700 wrote to memory of 1896	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	45
PID 2700 wrote to memory of 768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	46
PID 2700 wrote to memory of 768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	46
PID 2700 wrote to memory of 768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	46
PID 2700 wrote to memory of 1552	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	47
PID 2700 wrote to memory of 1552	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	47
PID 2700 wrote to memory of 1552	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	47
PID 2700 wrote to memory of 1632	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	48
PID 2700 wrote to memory of 1632	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	48
PID 2700 wrote to memory of 1632	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	48
PID 2700 wrote to memory of 2768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	49
PID 2700 wrote to memory of 2768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	49
PID 2700 wrote to memory of 2768	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	49
PID 2700 wrote to memory of 324	2700	01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ac27cf02bdcd3321f3eada6b20b214_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2508
- C:\Windows\System\CRpkebd.exe
  C:\Windows\System\CRpkebd.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\VgKdMxo.exe
  C:\Windows\System\VgKdMxo.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\uEnZAqp.exe
  C:\Windows\System\uEnZAqp.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SBzJxbt.exe
  C:\Windows\System\SBzJxbt.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\RtxploK.exe
  C:\Windows\System\RtxploK.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\lXJmPcC.exe
  C:\Windows\System\lXJmPcC.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\snUiYfd.exe
  C:\Windows\System\snUiYfd.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\cutlmrM.exe
  C:\Windows\System\cutlmrM.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\HzbsEsG.exe
  C:\Windows\System\HzbsEsG.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\AyxcMSq.exe
  C:\Windows\System\AyxcMSq.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\tTQutuI.exe
  C:\Windows\System\tTQutuI.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\OZZCeYu.exe
  C:\Windows\System\OZZCeYu.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\FFSGMAE.exe
  C:\Windows\System\FFSGMAE.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\kmUdGrs.exe
  C:\Windows\System\kmUdGrs.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\SNYnIvI.exe
  C:\Windows\System\SNYnIvI.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\AItwFTB.exe
  C:\Windows\System\AItwFTB.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\pjTsdOH.exe
  C:\Windows\System\pjTsdOH.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\YJjgWxu.exe
  C:\Windows\System\YJjgWxu.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\kkqIhWw.exe
  C:\Windows\System\kkqIhWw.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\lyWNGxn.exe
  C:\Windows\System\lyWNGxn.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\SWyRbzs.exe
  C:\Windows\System\SWyRbzs.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\tvhaMgz.exe
  C:\Windows\System\tvhaMgz.exe
  2⤵
  - Executes dropped EXE
  PID:336
- C:\Windows\System\obiOVsx.exe
  C:\Windows\System\obiOVsx.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\NNYrzfh.exe
  C:\Windows\System\NNYrzfh.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\KmpWhBO.exe
  C:\Windows\System\KmpWhBO.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\dNdesfB.exe
  C:\Windows\System\dNdesfB.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\tWHNOSd.exe
  C:\Windows\System\tWHNOSd.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\ElIwVAM.exe
  C:\Windows\System\ElIwVAM.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\wOFeomi.exe
  C:\Windows\System\wOFeomi.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\GTAqwSL.exe
  C:\Windows\System\GTAqwSL.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\GuLMzao.exe
  C:\Windows\System\GuLMzao.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\whMGeXg.exe
  C:\Windows\System\whMGeXg.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\XjlOiAY.exe
  C:\Windows\System\XjlOiAY.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\gmbEKcs.exe
  C:\Windows\System\gmbEKcs.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\RuirnIz.exe
  C:\Windows\System\RuirnIz.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\CsnCvJO.exe
  C:\Windows\System\CsnCvJO.exe
  2⤵
  - Executes dropped EXE
  PID:380
- C:\Windows\System\UjKsNtU.exe
  C:\Windows\System\UjKsNtU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\rvgbTii.exe
  C:\Windows\System\rvgbTii.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\TUYCCHR.exe
  C:\Windows\System\TUYCCHR.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\spEIdwm.exe
  C:\Windows\System\spEIdwm.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\chInsMD.exe
  C:\Windows\System\chInsMD.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\LbhWtCC.exe
  C:\Windows\System\LbhWtCC.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\vabNvjB.exe
  C:\Windows\System\vabNvjB.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\iwQsDiX.exe
  C:\Windows\System\iwQsDiX.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\NuPITAB.exe
  C:\Windows\System\NuPITAB.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\shJHfMr.exe
  C:\Windows\System\shJHfMr.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\XDDnEBo.exe
  C:\Windows\System\XDDnEBo.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\pkCECyP.exe
  C:\Windows\System\pkCECyP.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\bNQzbiq.exe
  C:\Windows\System\bNQzbiq.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\YWomqjP.exe
  C:\Windows\System\YWomqjP.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\ZhRCYEx.exe
  C:\Windows\System\ZhRCYEx.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EyUECLR.exe
  C:\Windows\System\EyUECLR.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\EqjCGdG.exe
  C:\Windows\System\EqjCGdG.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\EiiIqBP.exe
  C:\Windows\System\EiiIqBP.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\wzmwjPk.exe
  C:\Windows\System\wzmwjPk.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\PDrgbOV.exe
  C:\Windows\System\PDrgbOV.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\gmUoUrH.exe
  C:\Windows\System\gmUoUrH.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\KoMYiED.exe
  C:\Windows\System\KoMYiED.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\OlmUnnE.exe
  C:\Windows\System\OlmUnnE.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\yeMlBIZ.exe
  C:\Windows\System\yeMlBIZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\GJGfhxt.exe
  C:\Windows\System\GJGfhxt.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\WWlCROt.exe
  C:\Windows\System\WWlCROt.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\JTzghXw.exe
  C:\Windows\System\JTzghXw.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\psNgjMt.exe
  C:\Windows\System\psNgjMt.exe
  2⤵
  PID:2180
- C:\Windows\System\zqwTCYv.exe
  C:\Windows\System\zqwTCYv.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\ziMNZlj.exe
  C:\Windows\System\ziMNZlj.exe
  2⤵
  PID:2580
- C:\Windows\System\EaNDYUJ.exe
  C:\Windows\System\EaNDYUJ.exe
  2⤵
  PID:1464
- C:\Windows\System\iPfvFbL.exe
  C:\Windows\System\iPfvFbL.exe
  2⤵
  PID:2892
- C:\Windows\System\nvSHNRy.exe
  C:\Windows\System\nvSHNRy.exe
  2⤵
  PID:1740
- C:\Windows\System\BjnjnnC.exe
  C:\Windows\System\BjnjnnC.exe
  2⤵
  PID:2816
- C:\Windows\System\NTCozhw.exe
  C:\Windows\System\NTCozhw.exe
  2⤵
  PID:2136
- C:\Windows\System\nlWqeUe.exe
  C:\Windows\System\nlWqeUe.exe
  2⤵
  PID:2016
- C:\Windows\System\StBVGJB.exe
  C:\Windows\System\StBVGJB.exe
  2⤵
  PID:1420
- C:\Windows\System\TEdlnlo.exe
  C:\Windows\System\TEdlnlo.exe
  2⤵
  PID:972
- C:\Windows\System\mZJYpLh.exe
  C:\Windows\System\mZJYpLh.exe
  2⤵
  PID:2232
- C:\Windows\System\ZvhHhqn.exe
  C:\Windows\System\ZvhHhqn.exe
  2⤵
  PID:2940
- C:\Windows\System\mpkkCin.exe
  C:\Windows\System\mpkkCin.exe
  2⤵
  PID:1808
- C:\Windows\System\cVLpOcI.exe
  C:\Windows\System\cVLpOcI.exe
  2⤵
  PID:404
- C:\Windows\System\TUbfzXj.exe
  C:\Windows\System\TUbfzXj.exe
  2⤵
  PID:744
- C:\Windows\System\HkPPakW.exe
  C:\Windows\System\HkPPakW.exe
  2⤵
  PID:1872
- C:\Windows\System\rFPamvm.exe
  C:\Windows\System\rFPamvm.exe
  2⤵
  PID:2576
- C:\Windows\System\LMyqxgq.exe
  C:\Windows\System\LMyqxgq.exe
  2⤵
  PID:2316
- C:\Windows\System\ZsDOexb.exe
  C:\Windows\System\ZsDOexb.exe
  2⤵
  PID:1444
- C:\Windows\System\soowpqo.exe
  C:\Windows\System\soowpqo.exe
  2⤵
  PID:2340
- C:\Windows\System\MfCwLpw.exe
  C:\Windows\System\MfCwLpw.exe
  2⤵
  PID:2592
- C:\Windows\System\dcjDmXs.exe
  C:\Windows\System\dcjDmXs.exe
  2⤵
  PID:1380
- C:\Windows\System\MRJtLjT.exe
  C:\Windows\System\MRJtLjT.exe
  2⤵
  PID:1672
- C:\Windows\System\OIlWMjw.exe
  C:\Windows\System\OIlWMjw.exe
  2⤵
  PID:2320
- C:\Windows\System\utEAZLz.exe
  C:\Windows\System\utEAZLz.exe
  2⤵
  PID:2872
- C:\Windows\System\esWCZed.exe
  C:\Windows\System\esWCZed.exe
  2⤵
  PID:1608
- C:\Windows\System\gFNqViY.exe
  C:\Windows\System\gFNqViY.exe
  2⤵
  PID:2404
- C:\Windows\System\tpEGXkD.exe
  C:\Windows\System\tpEGXkD.exe
  2⤵
  PID:2384
- C:\Windows\System\mtYKovT.exe
  C:\Windows\System\mtYKovT.exe
  2⤵
  PID:2432
- C:\Windows\System\wopvXId.exe
  C:\Windows\System\wopvXId.exe
  2⤵
  PID:2880
- C:\Windows\System\AluDjaM.exe
  C:\Windows\System\AluDjaM.exe
  2⤵
  PID:1004
- C:\Windows\System\xgxuPNV.exe
  C:\Windows\System\xgxuPNV.exe
  2⤵
  PID:2024
- C:\Windows\System\otHNiHm.exe
  C:\Windows\System\otHNiHm.exe
  2⤵
  PID:2832
- C:\Windows\System\aqZPNAv.exe
  C:\Windows\System\aqZPNAv.exe
  2⤵
  PID:2772
- C:\Windows\System\MewfuNr.exe
  C:\Windows\System\MewfuNr.exe
  2⤵
  PID:2600
- C:\Windows\System\mjhZADs.exe
  C:\Windows\System\mjhZADs.exe
  2⤵
  PID:2036
- C:\Windows\System\ZgIPZWG.exe
  C:\Windows\System\ZgIPZWG.exe
  2⤵
  PID:552
- C:\Windows\System\ufQuYXu.exe
  C:\Windows\System\ufQuYXu.exe
  2⤵
  PID:2192
- C:\Windows\System\HyOUEFa.exe
  C:\Windows\System\HyOUEFa.exe
  2⤵
  PID:1876
- C:\Windows\System\MBxnOoQ.exe
  C:\Windows\System\MBxnOoQ.exe
  2⤵
  PID:1640
- C:\Windows\System\sJfIMJI.exe
  C:\Windows\System\sJfIMJI.exe
  2⤵
  PID:920
- C:\Windows\System\ZRaLHHW.exe
  C:\Windows\System\ZRaLHHW.exe
  2⤵
  PID:2188
- C:\Windows\System\vHVveEA.exe
  C:\Windows\System\vHVveEA.exe
  2⤵
  PID:2916
- C:\Windows\System\vMoYZRK.exe
  C:\Windows\System\vMoYZRK.exe
  2⤵
  PID:3032
- C:\Windows\System\ykBcnhB.exe
  C:\Windows\System\ykBcnhB.exe
  2⤵
  PID:1684
- C:\Windows\System\KTGubxt.exe
  C:\Windows\System\KTGubxt.exe
  2⤵
  PID:2888
- C:\Windows\System\QmIAgav.exe
  C:\Windows\System\QmIAgav.exe
  2⤵
  PID:2808
- C:\Windows\System\kjlrfsC.exe
  C:\Windows\System\kjlrfsC.exe
  2⤵
  PID:648
- C:\Windows\System\REmyJdM.exe
  C:\Windows\System\REmyJdM.exe
  2⤵
  PID:2520
- C:\Windows\System\kyuKrRL.exe
  C:\Windows\System\kyuKrRL.exe
  2⤵
  PID:2612
- C:\Windows\System\DQuKnlM.exe
  C:\Windows\System\DQuKnlM.exe
  2⤵
  PID:1612
- C:\Windows\System\fgYNOWF.exe
  C:\Windows\System\fgYNOWF.exe
  2⤵
  PID:1556
- C:\Windows\System\urNtDTs.exe
  C:\Windows\System\urNtDTs.exe
  2⤵
  PID:692
- C:\Windows\System\FoqvQuT.exe
  C:\Windows\System\FoqvQuT.exe
  2⤵
  PID:1168
- C:\Windows\System\NkpiUiT.exe
  C:\Windows\System\NkpiUiT.exe
  2⤵
  PID:1980
- C:\Windows\System\QfftKUE.exe
  C:\Windows\System\QfftKUE.exe
  2⤵
  PID:1692
- C:\Windows\System\SsDhGUy.exe
  C:\Windows\System\SsDhGUy.exe
  2⤵
  PID:384
- C:\Windows\System\OWbAgMC.exe
  C:\Windows\System\OWbAgMC.exe
  2⤵
  PID:1372
- C:\Windows\System\kwNuuvV.exe
  C:\Windows\System\kwNuuvV.exe
  2⤵
  PID:2452
- C:\Windows\System\VNhqNnt.exe
  C:\Windows\System\VNhqNnt.exe
  2⤵
  PID:2904
- C:\Windows\System\sPckCYm.exe
  C:\Windows\System\sPckCYm.exe
  2⤵
  PID:1636
- C:\Windows\System\BmeWPwk.exe
  C:\Windows\System\BmeWPwk.exe
  2⤵
  PID:2664
- C:\Windows\System\eEgRWgH.exe
  C:\Windows\System\eEgRWgH.exe
  2⤵
  PID:2516
- C:\Windows\System\gGMcsDw.exe
  C:\Windows\System\gGMcsDw.exe
  2⤵
  PID:1340
- C:\Windows\System\oQkjzJQ.exe
  C:\Windows\System\oQkjzJQ.exe
  2⤵
  PID:1448
- C:\Windows\System\eIRxdEe.exe
  C:\Windows\System\eIRxdEe.exe
  2⤵
  PID:1508
- C:\Windows\System\MIqplvl.exe
  C:\Windows\System\MIqplvl.exe
  2⤵
  PID:1708
- C:\Windows\System\GOKzqJU.exe
  C:\Windows\System\GOKzqJU.exe
  2⤵
  PID:448
- C:\Windows\System\rgtaJHS.exe
  C:\Windows\System\rgtaJHS.exe
  2⤵
  PID:3080
- C:\Windows\System\IYdjBdJ.exe
  C:\Windows\System\IYdjBdJ.exe
  2⤵
  PID:3096
- C:\Windows\System\yBhtoHH.exe
  C:\Windows\System\yBhtoHH.exe
  2⤵
  PID:3112
- C:\Windows\System\PLZTFuB.exe
  C:\Windows\System\PLZTFuB.exe
  2⤵
  PID:3128
- C:\Windows\System\MnYNkxH.exe
  C:\Windows\System\MnYNkxH.exe
  2⤵
  PID:3144
- C:\Windows\System\sRnmhKa.exe
  C:\Windows\System\sRnmhKa.exe
  2⤵
  PID:3160
- C:\Windows\System\waAOApq.exe
  C:\Windows\System\waAOApq.exe
  2⤵
  PID:3176
- C:\Windows\System\kSRyxgn.exe
  C:\Windows\System\kSRyxgn.exe
  2⤵
  PID:3200
- C:\Windows\System\HlhtoVv.exe
  C:\Windows\System\HlhtoVv.exe
  2⤵
  PID:3216
- C:\Windows\System\cpQvhlj.exe
  C:\Windows\System\cpQvhlj.exe
  2⤵
  PID:3232
- C:\Windows\System\bPWNYas.exe
  C:\Windows\System\bPWNYas.exe
  2⤵
  PID:3248
- C:\Windows\System\JfjKqnI.exe
  C:\Windows\System\JfjKqnI.exe
  2⤵
  PID:3268
- C:\Windows\System\wlnShgM.exe
  C:\Windows\System\wlnShgM.exe
  2⤵
  PID:3284
- C:\Windows\System\ntwVXZv.exe
  C:\Windows\System\ntwVXZv.exe
  2⤵
  PID:3300
- C:\Windows\System\UkusOUn.exe
  C:\Windows\System\UkusOUn.exe
  2⤵
  PID:3320
- C:\Windows\System\neiWqjA.exe
  C:\Windows\System\neiWqjA.exe
  2⤵
  PID:3336
- C:\Windows\System\MmJQUoB.exe
  C:\Windows\System\MmJQUoB.exe
  2⤵
  PID:3352
- C:\Windows\System\meWPdho.exe
  C:\Windows\System\meWPdho.exe
  2⤵
  PID:3372
- C:\Windows\System\vRlmeJj.exe
  C:\Windows\System\vRlmeJj.exe
  2⤵
  PID:3388
- C:\Windows\System\oGxNNfA.exe
  C:\Windows\System\oGxNNfA.exe
  2⤵
  PID:3404
- C:\Windows\System\mOIkabT.exe
  C:\Windows\System\mOIkabT.exe
  2⤵
  PID:3420
- C:\Windows\System\NKiaumK.exe
  C:\Windows\System\NKiaumK.exe
  2⤵
  PID:3440
- C:\Windows\System\NvWTMvI.exe
  C:\Windows\System\NvWTMvI.exe
  2⤵
  PID:3456
- C:\Windows\System\GieBGrg.exe
  C:\Windows\System\GieBGrg.exe
  2⤵
  PID:3472
- C:\Windows\System\lEaFokA.exe
  C:\Windows\System\lEaFokA.exe
  2⤵
  PID:3488
- C:\Windows\System\yTGCTOW.exe
  C:\Windows\System\yTGCTOW.exe
  2⤵
  PID:3504
- C:\Windows\System\JiNFxBy.exe
  C:\Windows\System\JiNFxBy.exe
  2⤵
  PID:3572
- C:\Windows\System\yeZqtxr.exe
  C:\Windows\System\yeZqtxr.exe
  2⤵
  PID:3656
- C:\Windows\System\kfhfVNa.exe
  C:\Windows\System\kfhfVNa.exe
  2⤵
  PID:3692
- C:\Windows\System\yphFXkO.exe
  C:\Windows\System\yphFXkO.exe
  2⤵
  PID:3760
- C:\Windows\System\IZonIPQ.exe
  C:\Windows\System\IZonIPQ.exe
  2⤵
  PID:3776
- C:\Windows\System\uTzmePw.exe
  C:\Windows\System\uTzmePw.exe
  2⤵
  PID:3796
- C:\Windows\System\kRFVgBt.exe
  C:\Windows\System\kRFVgBt.exe
  2⤵
  PID:3816
- C:\Windows\System\aBJPWrQ.exe
  C:\Windows\System\aBJPWrQ.exe
  2⤵
  PID:3836
- C:\Windows\System\FqVXQKy.exe
  C:\Windows\System\FqVXQKy.exe
  2⤵
  PID:3852
- C:\Windows\System\lRvKPoz.exe
  C:\Windows\System\lRvKPoz.exe
  2⤵
  PID:3880
- C:\Windows\System\UeirSlT.exe
  C:\Windows\System\UeirSlT.exe
  2⤵
  PID:3896
- C:\Windows\System\VVFohAU.exe
  C:\Windows\System\VVFohAU.exe
  2⤵
  PID:3920
- C:\Windows\System\goedGis.exe
  C:\Windows\System\goedGis.exe
  2⤵
  PID:3936
- C:\Windows\System\ACASpue.exe
  C:\Windows\System\ACASpue.exe
  2⤵
  PID:3956
- C:\Windows\System\pkdnKPW.exe
  C:\Windows\System\pkdnKPW.exe
  2⤵
  PID:3972
- C:\Windows\System\biiAAla.exe
  C:\Windows\System\biiAAla.exe
  2⤵
  PID:3996
- C:\Windows\System\YXKnlOv.exe
  C:\Windows\System\YXKnlOv.exe
  2⤵
  PID:4016
- C:\Windows\System\sCqKDcW.exe
  C:\Windows\System\sCqKDcW.exe
  2⤵
  PID:4040
- C:\Windows\System\GcBfonV.exe
  C:\Windows\System\GcBfonV.exe
  2⤵
  PID:4056
- C:\Windows\System\pZrHHAc.exe
  C:\Windows\System\pZrHHAc.exe
  2⤵
  PID:4072
- C:\Windows\System\TlsapTA.exe
  C:\Windows\System\TlsapTA.exe
  2⤵
  PID:2096
- C:\Windows\System\CngzYdc.exe
  C:\Windows\System\CngzYdc.exe
  2⤵
  PID:1532
- C:\Windows\System\huWMDvT.exe
  C:\Windows\System\huWMDvT.exe
  2⤵
  PID:2400
- C:\Windows\System\ZfjvMxu.exe
  C:\Windows\System\ZfjvMxu.exe
  2⤵
  PID:548
- C:\Windows\System\ySZGugM.exe
  C:\Windows\System\ySZGugM.exe
  2⤵
  PID:992
- C:\Windows\System\zTLeJrx.exe
  C:\Windows\System\zTLeJrx.exe
  2⤵
  PID:3108
- C:\Windows\System\UIodSNW.exe
  C:\Windows\System\UIodSNW.exe
  2⤵
  PID:2276
- C:\Windows\System\gYIkhhp.exe
  C:\Windows\System\gYIkhhp.exe
  2⤵
  PID:2144
- C:\Windows\System\gBgrMhf.exe
  C:\Windows\System\gBgrMhf.exe
  2⤵
  PID:2636
- C:\Windows\System\fdjwnWo.exe
  C:\Windows\System\fdjwnWo.exe
  2⤵
  PID:2684
- C:\Windows\System\InNicEc.exe
  C:\Windows\System\InNicEc.exe
  2⤵
  PID:2780
- C:\Windows\System\FnwIbmO.exe
  C:\Windows\System\FnwIbmO.exe
  2⤵
  PID:2952
- C:\Windows\System\bdGUdMc.exe
  C:\Windows\System\bdGUdMc.exe
  2⤵
  PID:3076
- C:\Windows\System\UkRgxgR.exe
  C:\Windows\System\UkRgxgR.exe
  2⤵
  PID:1104
- C:\Windows\System\wzNFmtP.exe
  C:\Windows\System\wzNFmtP.exe
  2⤵
  PID:3124
- C:\Windows\System\ntFadXW.exe
  C:\Windows\System\ntFadXW.exe
  2⤵
  PID:3192
- C:\Windows\System\NtZXxwi.exe
  C:\Windows\System\NtZXxwi.exe
  2⤵
  PID:3260
- C:\Windows\System\aLbFGbM.exe
  C:\Windows\System\aLbFGbM.exe
  2⤵
  PID:3332
- C:\Windows\System\wszwMqv.exe
  C:\Windows\System\wszwMqv.exe
  2⤵
  PID:3400
- C:\Windows\System\PCUlsfu.exe
  C:\Windows\System\PCUlsfu.exe
  2⤵
  PID:3496
- C:\Windows\System\rvcrrPQ.exe
  C:\Windows\System\rvcrrPQ.exe
  2⤵
  PID:3532
- C:\Windows\System\hgbAsSY.exe
  C:\Windows\System\hgbAsSY.exe
  2⤵
  PID:3552
- C:\Windows\System\BbkDtYA.exe
  C:\Windows\System\BbkDtYA.exe
  2⤵
  PID:3212
- C:\Windows\System\nZgkbkK.exe
  C:\Windows\System\nZgkbkK.exe
  2⤵
  PID:3312
- C:\Windows\System\MjmYrMU.exe
  C:\Windows\System\MjmYrMU.exe
  2⤵
  PID:3380
- C:\Windows\System\iOejLdt.exe
  C:\Windows\System\iOejLdt.exe
  2⤵
  PID:3452
- C:\Windows\System\bvxjZWw.exe
  C:\Windows\System\bvxjZWw.exe
  2⤵
  PID:3516
- C:\Windows\System\vXxQAZp.exe
  C:\Windows\System\vXxQAZp.exe
  2⤵
  PID:2216
- C:\Windows\System\joKdqIM.exe
  C:\Windows\System\joKdqIM.exe
  2⤵
  PID:3528
- C:\Windows\System\wpyNijC.exe
  C:\Windows\System\wpyNijC.exe
  2⤵
  PID:3580
- C:\Windows\System\KNEIZDI.exe
  C:\Windows\System\KNEIZDI.exe
  2⤵
  PID:3600
- C:\Windows\System\aRMvxaM.exe
  C:\Windows\System\aRMvxaM.exe
  2⤵
  PID:3620
- C:\Windows\System\QHEaqNL.exe
  C:\Windows\System\QHEaqNL.exe
  2⤵
  PID:3644
- C:\Windows\System\GaAqYnu.exe
  C:\Windows\System\GaAqYnu.exe
  2⤵
  PID:3700
- C:\Windows\System\OpznctK.exe
  C:\Windows\System\OpznctK.exe
  2⤵
  PID:3668
- C:\Windows\System\CidQeeW.exe
  C:\Windows\System\CidQeeW.exe
  2⤵
  PID:3664
- C:\Windows\System\ZNlFDyy.exe
  C:\Windows\System\ZNlFDyy.exe
  2⤵
  PID:3716
- C:\Windows\System\nyQsaNR.exe
  C:\Windows\System\nyQsaNR.exe
  2⤵
  PID:3732
- C:\Windows\System\poRXZkZ.exe
  C:\Windows\System\poRXZkZ.exe
  2⤵
  PID:3748
- C:\Windows\System\WfcWnYs.exe
  C:\Windows\System\WfcWnYs.exe
  2⤵
  PID:1240
- C:\Windows\System\kjOFmBk.exe
  C:\Windows\System\kjOFmBk.exe
  2⤵
  PID:1696
- C:\Windows\System\GpEvCpY.exe
  C:\Windows\System\GpEvCpY.exe
  2⤵
  PID:3768
- C:\Windows\System\GfqVvvS.exe
  C:\Windows\System\GfqVvvS.exe
  2⤵
  PID:3788
- C:\Windows\System\PbQTNbp.exe
  C:\Windows\System\PbQTNbp.exe
  2⤵
  PID:3824
- C:\Windows\System\utWRwDH.exe
  C:\Windows\System\utWRwDH.exe
  2⤵
  PID:3860
- C:\Windows\System\KrUWpOV.exe
  C:\Windows\System\KrUWpOV.exe
  2⤵
  PID:3876
- C:\Windows\System\wvUfsHd.exe
  C:\Windows\System\wvUfsHd.exe
  2⤵
  PID:3912
- C:\Windows\System\ErcwZWn.exe
  C:\Windows\System\ErcwZWn.exe
  2⤵
  PID:3932
- C:\Windows\System\WsnIemZ.exe
  C:\Windows\System\WsnIemZ.exe
  2⤵
  PID:3964
- C:\Windows\System\uPCSaHX.exe
  C:\Windows\System\uPCSaHX.exe
  2⤵
  PID:3992
- C:\Windows\System\sBAcjMw.exe
  C:\Windows\System\sBAcjMw.exe
  2⤵
  PID:4012
- C:\Windows\System\pMjWqKB.exe
  C:\Windows\System\pMjWqKB.exe
  2⤵
  PID:4028
- C:\Windows\System\YDdZuqp.exe
  C:\Windows\System\YDdZuqp.exe
  2⤵
  PID:4080
- C:\Windows\System\gUFxXuj.exe
  C:\Windows\System\gUFxXuj.exe
  2⤵
  PID:4088
- C:\Windows\System\LZeIxrF.exe
  C:\Windows\System\LZeIxrF.exe
  2⤵
  PID:2348
- C:\Windows\System\mZLpTzp.exe
  C:\Windows\System\mZLpTzp.exe
  2⤵
  PID:2088
- C:\Windows\System\PnVQBlQ.exe
  C:\Windows\System\PnVQBlQ.exe
  2⤵
  PID:2464
- C:\Windows\System\sBxilDy.exe
  C:\Windows\System\sBxilDy.exe
  2⤵
  PID:3136
- C:\Windows\System\FIIPFSz.exe
  C:\Windows\System\FIIPFSz.exe
  2⤵
  PID:1676
- C:\Windows\System\kOogCJB.exe
  C:\Windows\System\kOogCJB.exe
  2⤵
  PID:704
- C:\Windows\System\QMsMMCj.exe
  C:\Windows\System\QMsMMCj.exe
  2⤵
  PID:2604
- C:\Windows\System\uEOmPIn.exe
  C:\Windows\System\uEOmPIn.exe
  2⤵
  PID:1188
- C:\Windows\System\nFQCVcM.exe
  C:\Windows\System\nFQCVcM.exe
  2⤵
  PID:2900
- C:\Windows\System\xPLzToC.exe
  C:\Windows\System\xPLzToC.exe
  2⤵
  PID:3120
- C:\Windows\System\kZyqOGV.exe
  C:\Windows\System\kZyqOGV.exe
  2⤵
  PID:1736
- C:\Windows\System\sXpwfei.exe
  C:\Windows\System\sXpwfei.exe
  2⤵
  PID:3224
- C:\Windows\System\VgRUnMa.exe
  C:\Windows\System\VgRUnMa.exe
  2⤵
  PID:3228
- C:\Windows\System\xnhKKIc.exe
  C:\Windows\System\xnhKKIc.exe
  2⤵
  PID:3244
- C:\Windows\System\aqKYCFw.exe
  C:\Windows\System\aqKYCFw.exe
  2⤵
  PID:3412
- C:\Windows\System\kpdHoQG.exe
  C:\Windows\System\kpdHoQG.exe
  2⤵
  PID:1764
- C:\Windows\System\KsJCQMy.exe
  C:\Windows\System\KsJCQMy.exe
  2⤵
  PID:3520
- C:\Windows\System\IIfZZTB.exe
  C:\Windows\System\IIfZZTB.exe
  2⤵
  PID:3568
- C:\Windows\System\daNlCki.exe
  C:\Windows\System\daNlCki.exe
  2⤵
  PID:3828
- C:\Windows\System\eSVdLjt.exe
  C:\Windows\System\eSVdLjt.exe
  2⤵
  PID:4008
- C:\Windows\System\SnREFie.exe
  C:\Windows\System\SnREFie.exe
  2⤵
  PID:2624
- C:\Windows\System\giLQEiH.exe
  C:\Windows\System\giLQEiH.exe
  2⤵
  PID:568
- C:\Windows\System\EANQxwx.exe
  C:\Windows\System\EANQxwx.exe
  2⤵
  PID:2308
- C:\Windows\System\XMxQexJ.exe
  C:\Windows\System\XMxQexJ.exe
  2⤵
  PID:3256
- C:\Windows\System\EsWKrDm.exe
  C:\Windows\System\EsWKrDm.exe
  2⤵
  PID:3292
- C:\Windows\System\eYPqhbb.exe
  C:\Windows\System\eYPqhbb.exe
  2⤵
  PID:3676
- C:\Windows\System\sVDVgZg.exe
  C:\Windows\System\sVDVgZg.exe
  2⤵
  PID:2376
- C:\Windows\System\GwMZKkC.exe
  C:\Windows\System\GwMZKkC.exe
  2⤵
  PID:3864
- C:\Windows\System\nTMTSPw.exe
  C:\Windows\System\nTMTSPw.exe
  2⤵
  PID:3988
- C:\Windows\System\uhomdPv.exe
  C:\Windows\System\uhomdPv.exe
  2⤵
  PID:4092
- C:\Windows\System\UzYUHHE.exe
  C:\Windows\System\UzYUHHE.exe
  2⤵
  PID:3104
- C:\Windows\System\ZoEZiuk.exe
  C:\Windows\System\ZoEZiuk.exe
  2⤵
  PID:1964
- C:\Windows\System\aAgAjfX.exe
  C:\Windows\System\aAgAjfX.exe
  2⤵
  PID:3188
- C:\Windows\System\HBvNYMK.exe
  C:\Windows\System\HBvNYMK.exe
  2⤵
  PID:3364
- C:\Windows\System\iOfHikD.exe
  C:\Windows\System\iOfHikD.exe
  2⤵
  PID:3428
- C:\Windows\System\AXbvHqu.exe
  C:\Windows\System\AXbvHqu.exe
  2⤵
  PID:3672
- C:\Windows\System\gMPFCwW.exe
  C:\Windows\System\gMPFCwW.exe
  2⤵
  PID:908
- C:\Windows\System\GuCvWot.exe
  C:\Windows\System\GuCvWot.exe
  2⤵
  PID:3168
- C:\Windows\System\amDXxJX.exe
  C:\Windows\System\amDXxJX.exe
  2⤵
  PID:3208
- C:\Windows\System\ZqvgGTt.exe
  C:\Windows\System\ZqvgGTt.exe
  2⤵
  PID:3416
- C:\Windows\System\DLtYTaT.exe
  C:\Windows\System\DLtYTaT.exe
  2⤵
  PID:3564
- C:\Windows\System\GpPCTlu.exe
  C:\Windows\System\GpPCTlu.exe
  2⤵
  PID:3952
- C:\Windows\System\PYtpaTw.exe
  C:\Windows\System\PYtpaTw.exe
  2⤵
  PID:4100
- C:\Windows\System\AXDTJyz.exe
  C:\Windows\System\AXDTJyz.exe
  2⤵
  PID:4116
- C:\Windows\System\enfzzuE.exe
  C:\Windows\System\enfzzuE.exe
  2⤵
  PID:4132
- C:\Windows\System\JiBssWH.exe
  C:\Windows\System\JiBssWH.exe
  2⤵
  PID:4148
- C:\Windows\System\UjTuSnb.exe
  C:\Windows\System\UjTuSnb.exe
  2⤵
  PID:4164
- C:\Windows\System\kaiXycu.exe
  C:\Windows\System\kaiXycu.exe
  2⤵
  PID:4180
- C:\Windows\System\xDCcVDC.exe
  C:\Windows\System\xDCcVDC.exe
  2⤵
  PID:4196
- C:\Windows\System\JrVLruq.exe
  C:\Windows\System\JrVLruq.exe
  2⤵
  PID:4216
- C:\Windows\System\YkUWEgV.exe
  C:\Windows\System\YkUWEgV.exe
  2⤵
  PID:4236
- C:\Windows\System\momjsim.exe
  C:\Windows\System\momjsim.exe
  2⤵
  PID:4252
- C:\Windows\System\oQFVKXN.exe
  C:\Windows\System\oQFVKXN.exe
  2⤵
  PID:4268
- C:\Windows\System\kwreJLv.exe
  C:\Windows\System\kwreJLv.exe
  2⤵
  PID:4284
- C:\Windows\System\SEjySoy.exe
  C:\Windows\System\SEjySoy.exe
  2⤵
  PID:4300
- C:\Windows\System\vXVrWwE.exe
  C:\Windows\System\vXVrWwE.exe
  2⤵
  PID:4348
- C:\Windows\System\IocIyva.exe
  C:\Windows\System\IocIyva.exe
  2⤵
  PID:4424
- C:\Windows\System\IYemqFo.exe
  C:\Windows\System\IYemqFo.exe
  2⤵
  PID:4444
- C:\Windows\System\GWAMwOH.exe
  C:\Windows\System\GWAMwOH.exe
  2⤵
  PID:4472
- C:\Windows\System\ZJxfjRh.exe
  C:\Windows\System\ZJxfjRh.exe
  2⤵
  PID:4488
- C:\Windows\System\iHGSahM.exe
  C:\Windows\System\iHGSahM.exe
  2⤵
  PID:4504
- C:\Windows\System\nvVvArI.exe
  C:\Windows\System\nvVvArI.exe
  2⤵
  PID:4520
- C:\Windows\System\GRRNppW.exe
  C:\Windows\System\GRRNppW.exe
  2⤵
  PID:4536
- C:\Windows\System\Vphwfxb.exe
  C:\Windows\System\Vphwfxb.exe
  2⤵
  PID:4552
- C:\Windows\System\yoSDClh.exe
  C:\Windows\System\yoSDClh.exe
  2⤵
  PID:4568
- C:\Windows\System\BoojwnH.exe
  C:\Windows\System\BoojwnH.exe
  2⤵
  PID:4584
- C:\Windows\System\USjCDGt.exe
  C:\Windows\System\USjCDGt.exe
  2⤵
  PID:4600
- C:\Windows\System\YlPFYrE.exe
  C:\Windows\System\YlPFYrE.exe
  2⤵
  PID:4616
- C:\Windows\System\vrWzIeJ.exe
  C:\Windows\System\vrWzIeJ.exe
  2⤵
  PID:4632
- C:\Windows\System\djhNTDi.exe
  C:\Windows\System\djhNTDi.exe
  2⤵
  PID:4648
- C:\Windows\System\jCXDRdN.exe
  C:\Windows\System\jCXDRdN.exe
  2⤵
  PID:4668
- C:\Windows\System\dRNRedk.exe
  C:\Windows\System\dRNRedk.exe
  2⤵
  PID:4688
- C:\Windows\System\QDkbkMi.exe
  C:\Windows\System\QDkbkMi.exe
  2⤵
  PID:4704
- C:\Windows\System\ZMBkWpo.exe
  C:\Windows\System\ZMBkWpo.exe
  2⤵
  PID:4720
- C:\Windows\System\fpKecnm.exe
  C:\Windows\System\fpKecnm.exe
  2⤵
  PID:4736
- C:\Windows\System\mQbfESm.exe
  C:\Windows\System\mQbfESm.exe
  2⤵
  PID:4856
- C:\Windows\System\EWiwiyi.exe
  C:\Windows\System\EWiwiyi.exe
  2⤵
  PID:4880
- C:\Windows\System\sorzRdM.exe
  C:\Windows\System\sorzRdM.exe
  2⤵
  PID:4904
- C:\Windows\System\aqDwDor.exe
  C:\Windows\System\aqDwDor.exe
  2⤵
  PID:4928
- C:\Windows\System\qHGgmhH.exe
  C:\Windows\System\qHGgmhH.exe
  2⤵
  PID:4944
- C:\Windows\System\OeqWDfE.exe
  C:\Windows\System\OeqWDfE.exe
  2⤵
  PID:4980
- C:\Windows\System\pcClJON.exe
  C:\Windows\System\pcClJON.exe
  2⤵
  PID:5024
- C:\Windows\System\cRwyPDx.exe
  C:\Windows\System\cRwyPDx.exe
  2⤵
  PID:5048
- C:\Windows\System\zscYUYh.exe
  C:\Windows\System\zscYUYh.exe
  2⤵
  PID:5064
- C:\Windows\System\hpTWKEd.exe
  C:\Windows\System\hpTWKEd.exe
  2⤵
  PID:5084
- C:\Windows\System\GpqCKZm.exe
  C:\Windows\System\GpqCKZm.exe
  2⤵
  PID:5100
- C:\Windows\System\QYsLjaH.exe
  C:\Windows\System\QYsLjaH.exe
  2⤵
  PID:5116
- C:\Windows\System\DEThOMD.exe
  C:\Windows\System\DEThOMD.exe
  2⤵
  PID:2160
- C:\Windows\System\EVANBJe.exe
  C:\Windows\System\EVANBJe.exe
  2⤵
  PID:3276
- C:\Windows\System\WDozdkQ.exe
  C:\Windows\System\WDozdkQ.exe
  2⤵
  PID:3616
- C:\Windows\System\QVgMkES.exe
  C:\Windows\System\QVgMkES.exe
  2⤵
  PID:4004
- C:\Windows\System\QTKjBVz.exe
  C:\Windows\System\QTKjBVz.exe
  2⤵
  PID:1164
- C:\Windows\System\YCjuxUf.exe
  C:\Windows\System\YCjuxUf.exe
  2⤵
  PID:3868
- C:\Windows\System\oORgQDq.exe
  C:\Windows\System\oORgQDq.exe
  2⤵
  PID:3636
- C:\Windows\System\rLZDtSW.exe
  C:\Windows\System\rLZDtSW.exe
  2⤵
  PID:1804
- C:\Windows\System\LwUOkwV.exe
  C:\Windows\System\LwUOkwV.exe
  2⤵
  PID:4212
- C:\Windows\System\jutyCQF.exe
  C:\Windows\System\jutyCQF.exe
  2⤵
  PID:4336
- C:\Windows\System\IndOpQK.exe
  C:\Windows\System\IndOpQK.exe
  2⤵
  PID:3588
- C:\Windows\System\xsSapdS.exe
  C:\Windows\System\xsSapdS.exe
  2⤵
  PID:352
- C:\Windows\System\eKFgItd.exe
  C:\Windows\System\eKFgItd.exe
  2⤵
  PID:4244
- C:\Windows\System\ShEXXuU.exe
  C:\Windows\System\ShEXXuU.exe
  2⤵
  PID:3316
- C:\Windows\System\FxhTNqs.exe
  C:\Windows\System\FxhTNqs.exe
  2⤵
  PID:4264
- C:\Windows\System\VlccjOl.exe
  C:\Windows\System\VlccjOl.exe
  2⤵
  PID:4308
- C:\Windows\System\nnLoVlU.exe
  C:\Windows\System\nnLoVlU.exe
  2⤵
  PID:4364
- C:\Windows\System\jebuPPA.exe
  C:\Windows\System\jebuPPA.exe
  2⤵
  PID:4372
- C:\Windows\System\jfZxwso.exe
  C:\Windows\System\jfZxwso.exe
  2⤵
  PID:1588
- C:\Windows\System\uekLxGK.exe
  C:\Windows\System\uekLxGK.exe
  2⤵
  PID:4176
- C:\Windows\System\usjLXEa.exe
  C:\Windows\System\usjLXEa.exe
  2⤵
  PID:3436
- C:\Windows\System\HlOzDhS.exe
  C:\Windows\System\HlOzDhS.exe
  2⤵
  PID:4416
- C:\Windows\System\dQaqoaq.exe
  C:\Windows\System\dQaqoaq.exe
  2⤵
  PID:4440
- C:\Windows\System\OWwOqCz.exe
  C:\Windows\System\OWwOqCz.exe
  2⤵
  PID:4460
- C:\Windows\System\LeeymAw.exe
  C:\Windows\System\LeeymAw.exe
  2⤵
  PID:4512
- C:\Windows\System\jscOHJl.exe
  C:\Windows\System\jscOHJl.exe
  2⤵
  PID:4516
- C:\Windows\System\JzNLLCk.exe
  C:\Windows\System\JzNLLCk.exe
  2⤵
  PID:4528
- C:\Windows\System\CTpIxVC.exe
  C:\Windows\System\CTpIxVC.exe
  2⤵
  PID:4580
- C:\Windows\System\Kxhdwqv.exe
  C:\Windows\System\Kxhdwqv.exe
  2⤵
  PID:4732
- C:\Windows\System\koelUoU.exe
  C:\Windows\System\koelUoU.exe
  2⤵
  PID:4756
- C:\Windows\System\gmjYLGg.exe
  C:\Windows\System\gmjYLGg.exe
  2⤵
  PID:4772
- C:\Windows\System\SMMGQoo.exe
  C:\Windows\System\SMMGQoo.exe
  2⤵
  PID:4788
- C:\Windows\System\mOsbuUI.exe
  C:\Windows\System\mOsbuUI.exe
  2⤵
  PID:4712
- C:\Windows\System\suAshmC.exe
  C:\Windows\System\suAshmC.exe
  2⤵
  PID:4812
- C:\Windows\System\FhGdsNp.exe
  C:\Windows\System\FhGdsNp.exe
  2⤵
  PID:4836
- C:\Windows\System\DTEwtHu.exe
  C:\Windows\System\DTEwtHu.exe
  2⤵
  PID:4864
- C:\Windows\System\QxlenjR.exe
  C:\Windows\System\QxlenjR.exe
  2⤵
  PID:4912
- C:\Windows\System\dZLtAjl.exe
  C:\Windows\System\dZLtAjl.exe
  2⤵
  PID:4900
- C:\Windows\System\lMjLExj.exe
  C:\Windows\System\lMjLExj.exe
  2⤵
  PID:4936
- C:\Windows\System\MMqfBoh.exe
  C:\Windows\System\MMqfBoh.exe
  2⤵
  PID:4956
- C:\Windows\System\rqknTuE.exe
  C:\Windows\System\rqknTuE.exe
  2⤵
  PID:4992
- C:\Windows\System\RwzwAvZ.exe
  C:\Windows\System\RwzwAvZ.exe
  2⤵
  PID:5004
- C:\Windows\System\tWTcBcm.exe
  C:\Windows\System\tWTcBcm.exe
  2⤵
  PID:5032
- C:\Windows\System\yAXRGwG.exe
  C:\Windows\System\yAXRGwG.exe
  2⤵
  PID:4356
- C:\Windows\System\bSJZMlt.exe
  C:\Windows\System\bSJZMlt.exe
  2⤵
  PID:5072
- C:\Windows\System\SxSziMj.exe
  C:\Windows\System\SxSziMj.exe
  2⤵
  PID:5112
- C:\Windows\System\ZNwdZhe.exe
  C:\Windows\System\ZNwdZhe.exe
  2⤵
  PID:584
- C:\Windows\System\ymTVjHa.exe
  C:\Windows\System\ymTVjHa.exe
  2⤵
  PID:3088
- C:\Windows\System\GZedNwa.exe
  C:\Windows\System\GZedNwa.exe
  2⤵
  PID:3804
- C:\Windows\System\cvkKgzD.exe
  C:\Windows\System\cvkKgzD.exe
  2⤵
  PID:2356
- C:\Windows\System\EsuZhvi.exe
  C:\Windows\System\EsuZhvi.exe
  2⤵
  PID:2876
- C:\Windows\System\MrFvxEQ.exe
  C:\Windows\System\MrFvxEQ.exe
  2⤵
  PID:3020
- C:\Windows\System\gPhgjml.exe
  C:\Windows\System\gPhgjml.exe
  2⤵
  PID:4496
- C:\Windows\System\QfaDRuH.exe
  C:\Windows\System\QfaDRuH.exe
  2⤵
  PID:3464
- C:\Windows\System\vKatyeT.exe
  C:\Windows\System\vKatyeT.exe
  2⤵
  PID:4468
- C:\Windows\System\OYBnacE.exe
  C:\Windows\System\OYBnacE.exe
  2⤵
  PID:4664
- C:\Windows\System\RbVFrvx.exe
  C:\Windows\System\RbVFrvx.exe
  2⤵
  PID:4644
- C:\Windows\System\DpQEgtN.exe
  C:\Windows\System\DpQEgtN.exe
  2⤵
  PID:4532
- C:\Windows\System\IzfOhKv.exe
  C:\Windows\System\IzfOhKv.exe
  2⤵
  PID:4804
- C:\Windows\System\RgjsgQI.exe
  C:\Windows\System\RgjsgQI.exe
  2⤵
  PID:4824
- C:\Windows\System\ZXDpmAr.exe
  C:\Windows\System\ZXDpmAr.exe
  2⤵
  PID:4840
- C:\Windows\System\WXMQWwl.exe
  C:\Windows\System\WXMQWwl.exe
  2⤵
  PID:2176
- C:\Windows\System\ZGdDHAY.exe
  C:\Windows\System\ZGdDHAY.exe
  2⤵
  PID:4612
- C:\Windows\System\IBEkScZ.exe
  C:\Windows\System\IBEkScZ.exe
  2⤵
  PID:4924
- C:\Windows\System\YngBmUB.exe
  C:\Windows\System\YngBmUB.exe
  2⤵
  PID:5012
- C:\Windows\System\nknipGa.exe
  C:\Windows\System\nknipGa.exe
  2⤵
  PID:2436
- C:\Windows\System\wdIEIfG.exe
  C:\Windows\System\wdIEIfG.exe
  2⤵
  PID:5060
- C:\Windows\System\KTfufUZ.exe
  C:\Windows\System\KTfufUZ.exe
  2⤵
  PID:2128
- C:\Windows\System\LDsQVQH.exe
  C:\Windows\System\LDsQVQH.exe
  2⤵
  PID:3712
- C:\Windows\System\iHhEjTG.exe
  C:\Windows\System\iHhEjTG.exe
  2⤵
  PID:5080
- C:\Windows\System\qDOEMdb.exe
  C:\Windows\System\qDOEMdb.exe
  2⤵
  PID:4324
- C:\Windows\System\nhWYtjb.exe
  C:\Windows\System\nhWYtjb.exe
  2⤵
  PID:4064
- C:\Windows\System\ymKHVvy.exe
  C:\Windows\System\ymKHVvy.exe
  2⤵
  PID:4192
- C:\Windows\System\EtGGIRN.exe
  C:\Windows\System\EtGGIRN.exe
  2⤵
  PID:820
- C:\Windows\System\whuEWtY.exe
  C:\Windows\System\whuEWtY.exe
  2⤵
  PID:3544
- C:\Windows\System\iaoUHfq.exe
  C:\Windows\System\iaoUHfq.exe
  2⤵
  PID:4292
- C:\Windows\System\nhUPnIH.exe
  C:\Windows\System\nhUPnIH.exe
  2⤵
  PID:2100
- C:\Windows\System\XFLVzGS.exe
  C:\Windows\System\XFLVzGS.exe
  2⤵
  PID:4144
- C:\Windows\System\PGfmKsO.exe
  C:\Windows\System\PGfmKsO.exe
  2⤵
  PID:4464
- C:\Windows\System\ENmSeVZ.exe
  C:\Windows\System\ENmSeVZ.exe
  2⤵
  PID:4596
- C:\Windows\System\XyWbbZQ.exe
  C:\Windows\System\XyWbbZQ.exe
  2⤵
  PID:4816
- C:\Windows\System\HqWzMUs.exe
  C:\Windows\System\HqWzMUs.exe
  2⤵
  PID:4896
- C:\Windows\System\ftlEdVj.exe
  C:\Windows\System\ftlEdVj.exe
  2⤵
  PID:5020
- C:\Windows\System\AiayIGI.exe
  C:\Windows\System\AiayIGI.exe
  2⤵
  PID:4972
- C:\Windows\System\PjktOlp.exe
  C:\Windows\System\PjktOlp.exe
  2⤵
  PID:4084
- C:\Windows\System\qJnWZhN.exe
  C:\Windows\System\qJnWZhN.exe
  2⤵
  PID:3792
- C:\Windows\System\sHnSOMg.exe
  C:\Windows\System\sHnSOMg.exe
  2⤵
  PID:4872
- C:\Windows\System\LaznkBS.exe
  C:\Windows\System\LaznkBS.exe
  2⤵
  PID:5016
- C:\Windows\System\kQlStxD.exe
  C:\Windows\System\kQlStxD.exe
  2⤵
  PID:1800
- C:\Windows\System\ipLrXzz.exe
  C:\Windows\System\ipLrXzz.exe
  2⤵
  PID:3652
- C:\Windows\System\LlTYTGI.exe
  C:\Windows\System\LlTYTGI.exe
  2⤵
  PID:3512
- C:\Windows\System\hlNiaew.exe
  C:\Windows\System\hlNiaew.exe
  2⤵
  PID:3548
- C:\Windows\System\FXtBKRD.exe
  C:\Windows\System\FXtBKRD.exe
  2⤵
  PID:4108
- C:\Windows\System\iQuZWyU.exe
  C:\Windows\System\iQuZWyU.exe
  2⤵
  PID:4432
- C:\Windows\System\kVzfOQj.exe
  C:\Windows\System\kVzfOQj.exe
  2⤵
  PID:4640
- C:\Windows\System\ylyYFHR.exe
  C:\Windows\System\ylyYFHR.exe
  2⤵
  PID:4684
- C:\Windows\System\mFfIWIY.exe
  C:\Windows\System\mFfIWIY.exe
  2⤵
  PID:4796
- C:\Windows\System\Pxledxl.exe
  C:\Windows\System\Pxledxl.exe
  2⤵
  PID:4892
- C:\Windows\System\DYFQAOj.exe
  C:\Windows\System\DYFQAOj.exe
  2⤵
  PID:5124
- C:\Windows\System\KLrRliJ.exe
  C:\Windows\System\KLrRliJ.exe
  2⤵
  PID:5140
- C:\Windows\System\epWgMoU.exe
  C:\Windows\System\epWgMoU.exe
  2⤵
  PID:5156
- C:\Windows\System\STWoiea.exe
  C:\Windows\System\STWoiea.exe
  2⤵
  PID:5172
- C:\Windows\System\LaHANVL.exe
  C:\Windows\System\LaHANVL.exe
  2⤵
  PID:5188
- C:\Windows\System\xRYLQBn.exe
  C:\Windows\System\xRYLQBn.exe
  2⤵
  PID:5204
- C:\Windows\System\XmRWLTe.exe
  C:\Windows\System\XmRWLTe.exe
  2⤵
  PID:5220
- C:\Windows\System\TexMgTa.exe
  C:\Windows\System\TexMgTa.exe
  2⤵
  PID:5236
- C:\Windows\System\jfRKxxK.exe
  C:\Windows\System\jfRKxxK.exe
  2⤵
  PID:5256
- C:\Windows\System\SNDsYmU.exe
  C:\Windows\System\SNDsYmU.exe
  2⤵
  PID:5272
- C:\Windows\System\yIgEGPA.exe
  C:\Windows\System\yIgEGPA.exe
  2⤵
  PID:5288
- C:\Windows\System\DbZHEee.exe
  C:\Windows\System\DbZHEee.exe
  2⤵
  PID:5304
- C:\Windows\System\Jdrjomt.exe
  C:\Windows\System\Jdrjomt.exe
  2⤵
  PID:5324
- C:\Windows\System\cznojIJ.exe
  C:\Windows\System\cznojIJ.exe
  2⤵
  PID:5420
- C:\Windows\System\VwuIcIg.exe
  C:\Windows\System\VwuIcIg.exe
  2⤵
  PID:5436
- C:\Windows\System\IPlkXGP.exe
  C:\Windows\System\IPlkXGP.exe
  2⤵
  PID:5452
- C:\Windows\System\YfiKoCS.exe
  C:\Windows\System\YfiKoCS.exe
  2⤵
  PID:5468
- C:\Windows\System\alaApTq.exe
  C:\Windows\System\alaApTq.exe
  2⤵
  PID:5488
- C:\Windows\System\NyQDbNi.exe
  C:\Windows\System\NyQDbNi.exe
  2⤵
  PID:5504
- C:\Windows\System\NTZzgOw.exe
  C:\Windows\System\NTZzgOw.exe
  2⤵
  PID:5524
- C:\Windows\System\SthuFCU.exe
  C:\Windows\System\SthuFCU.exe
  2⤵
  PID:5540
- C:\Windows\System\xqwDfaM.exe
  C:\Windows\System\xqwDfaM.exe
  2⤵
  PID:5556
- C:\Windows\System\mvjThHA.exe
  C:\Windows\System\mvjThHA.exe
  2⤵
  PID:5572
- C:\Windows\System\rwzsyyg.exe
  C:\Windows\System\rwzsyyg.exe
  2⤵
  PID:5588
- C:\Windows\System\AFOycnI.exe
  C:\Windows\System\AFOycnI.exe
  2⤵
  PID:5604
- C:\Windows\System\nGnetSd.exe
  C:\Windows\System\nGnetSd.exe
  2⤵
  PID:5620
- C:\Windows\System\aUfAySU.exe
  C:\Windows\System\aUfAySU.exe
  2⤵
  PID:5644
- C:\Windows\System\EEzCKgR.exe
  C:\Windows\System\EEzCKgR.exe
  2⤵
  PID:5660
- C:\Windows\System\nXmNZVZ.exe
  C:\Windows\System\nXmNZVZ.exe
  2⤵
  PID:5676
- C:\Windows\System\bDgPYRh.exe
  C:\Windows\System\bDgPYRh.exe
  2⤵
  PID:5692
- C:\Windows\System\nVEKpdb.exe
  C:\Windows\System\nVEKpdb.exe
  2⤵
  PID:5708
- C:\Windows\System\eMCNiHM.exe
  C:\Windows\System\eMCNiHM.exe
  2⤵
  PID:5724
- C:\Windows\System\HiONCvF.exe
  C:\Windows\System\HiONCvF.exe
  2⤵
  PID:5740
- C:\Windows\System\qlhlFpR.exe
  C:\Windows\System\qlhlFpR.exe
  2⤵
  PID:5760
- C:\Windows\System\xnPCDGd.exe
  C:\Windows\System\xnPCDGd.exe
  2⤵
  PID:5776
- C:\Windows\System\yEGnUed.exe
  C:\Windows\System\yEGnUed.exe
  2⤵
  PID:5792
- C:\Windows\System\Iinbabj.exe
  C:\Windows\System\Iinbabj.exe
  2⤵
  PID:5808
- C:\Windows\System\KcfniED.exe
  C:\Windows\System\KcfniED.exe
  2⤵
  PID:5824
- C:\Windows\System\KsuNvmA.exe
  C:\Windows\System\KsuNvmA.exe
  2⤵
  PID:5840
- C:\Windows\System\oJwNLRI.exe
  C:\Windows\System\oJwNLRI.exe
  2⤵
  PID:5856
- C:\Windows\System\weRWSwR.exe
  C:\Windows\System\weRWSwR.exe
  2⤵
  PID:5872
- C:\Windows\System\VqgbcOi.exe
  C:\Windows\System\VqgbcOi.exe
  2⤵
  PID:6008
- C:\Windows\System\sOvZIZQ.exe
  C:\Windows\System\sOvZIZQ.exe
  2⤵
  PID:6036
- C:\Windows\System\VvmjXPG.exe
  C:\Windows\System\VvmjXPG.exe
  2⤵
  PID:6052
- C:\Windows\System\JQjXQsW.exe
  C:\Windows\System\JQjXQsW.exe
  2⤵
  PID:6068
- C:\Windows\System\fjBHWwj.exe
  C:\Windows\System\fjBHWwj.exe
  2⤵
  PID:6084
- C:\Windows\System\NpzvaJB.exe
  C:\Windows\System\NpzvaJB.exe
  2⤵
  PID:6100
- C:\Windows\System\LvdBrAj.exe
  C:\Windows\System\LvdBrAj.exe
  2⤵
  PID:6116
- C:\Windows\System\gmMLiLD.exe
  C:\Windows\System\gmMLiLD.exe
  2⤵
  PID:6136
- C:\Windows\System\nBXYeLj.exe
  C:\Windows\System\nBXYeLj.exe
  2⤵
  PID:2500
- C:\Windows\System\pcdVjhx.exe
  C:\Windows\System\pcdVjhx.exe
  2⤵
  PID:5196
- C:\Windows\System\CoUuUaV.exe
  C:\Windows\System\CoUuUaV.exe
  2⤵
  PID:5132
- C:\Windows\System\yetQdmh.exe
  C:\Windows\System\yetQdmh.exe
  2⤵
  PID:4784
- C:\Windows\System\YbyPUHv.exe
  C:\Windows\System\YbyPUHv.exe
  2⤵
  PID:5228
- C:\Windows\System\SdmRxnO.exe
  C:\Windows\System\SdmRxnO.exe
  2⤵
  PID:1428
- C:\Windows\System\YHuagzY.exe
  C:\Windows\System\YHuagzY.exe
  2⤵
  PID:4768
- C:\Windows\System\iWQFSgI.exe
  C:\Windows\System\iWQFSgI.exe
  2⤵
  PID:4832
- C:\Windows\System\uyXYzpS.exe
  C:\Windows\System\uyXYzpS.exe
  2⤵
  PID:4128
- C:\Windows\System\QmGPNzN.exe
  C:\Windows\System\QmGPNzN.exe
  2⤵
  PID:5284
- C:\Windows\System\VelJcuM.exe
  C:\Windows\System\VelJcuM.exe
  2⤵
  PID:5244
- C:\Windows\System\MlfVXJp.exe
  C:\Windows\System\MlfVXJp.exe
  2⤵
  PID:4332
- C:\Windows\System\xMhsbOo.exe
  C:\Windows\System\xMhsbOo.exe
  2⤵
  PID:5380
- C:\Windows\System\YeUwFex.exe
  C:\Windows\System\YeUwFex.exe
  2⤵
  PID:5400
- C:\Windows\System\uaKmQLi.exe
  C:\Windows\System\uaKmQLi.exe
  2⤵
  PID:5348
- C:\Windows\System\brefFwC.exe
  C:\Windows\System\brefFwC.exe
  2⤵
  PID:5416
- C:\Windows\System\KegyupZ.exe
  C:\Windows\System\KegyupZ.exe
  2⤵
  PID:5480
- C:\Windows\System\cqjPaMV.exe
  C:\Windows\System\cqjPaMV.exe
  2⤵
  PID:5580
- C:\Windows\System\pTAXzjs.exe
  C:\Windows\System\pTAXzjs.exe
  2⤵
  PID:5784
- C:\Windows\System\NSXEXQP.exe
  C:\Windows\System\NSXEXQP.exe
  2⤵
  PID:5884
- C:\Windows\System\eGClQyc.exe
  C:\Windows\System\eGClQyc.exe
  2⤵
  PID:5820
- C:\Windows\System\YqBmatI.exe
  C:\Windows\System\YqBmatI.exe
  2⤵
  PID:5512
- C:\Windows\System\lJPJKaz.exe
  C:\Windows\System\lJPJKaz.exe
  2⤵
  PID:5720
- C:\Windows\System\XUGUOti.exe
  C:\Windows\System\XUGUOti.exe
  2⤵
  PID:5652
- C:\Windows\System\HRdvZWz.exe
  C:\Windows\System\HRdvZWz.exe
  2⤵
  PID:5460
- C:\Windows\System\FLUkFpC.exe
  C:\Windows\System\FLUkFpC.exe
  2⤵
  PID:5636
- C:\Windows\System\GnOsaua.exe
  C:\Windows\System\GnOsaua.exe
  2⤵
  PID:5700
- C:\Windows\System\tdTXZaD.exe
  C:\Windows\System\tdTXZaD.exe
  2⤵
  PID:5464
- C:\Windows\System\bVsqIsr.exe
  C:\Windows\System\bVsqIsr.exe
  2⤵
  PID:5568
- C:\Windows\System\WSxMakD.exe
  C:\Windows\System\WSxMakD.exe
  2⤵
  PID:5736
- C:\Windows\System\sdDrmHR.exe
  C:\Windows\System\sdDrmHR.exe
  2⤵
  PID:5804
- C:\Windows\System\iSYrqzW.exe
  C:\Windows\System\iSYrqzW.exe
  2⤵
  PID:5864
- C:\Windows\System\WOicKbN.exe
  C:\Windows\System\WOicKbN.exe
  2⤵
  PID:5912
- C:\Windows\System\SjPMJOy.exe
  C:\Windows\System\SjPMJOy.exe
  2⤵
  PID:5940
- C:\Windows\System\sePnyEO.exe
  C:\Windows\System\sePnyEO.exe
  2⤵
  PID:5960
- C:\Windows\System\MOJOdGs.exe
  C:\Windows\System\MOJOdGs.exe
  2⤵
  PID:5928
- C:\Windows\System\kCrWOfH.exe
  C:\Windows\System\kCrWOfH.exe
  2⤵
  PID:5984
- C:\Windows\System\ZGEIqwA.exe
  C:\Windows\System\ZGEIqwA.exe
  2⤵
  PID:6000
- C:\Windows\System\fRvGmGH.exe
  C:\Windows\System\fRvGmGH.exe
  2⤵
  PID:6080
- C:\Windows\System\buxfTWf.exe
  C:\Windows\System\buxfTWf.exe
  2⤵
  PID:6016
- C:\Windows\System\fbTIiSS.exe
  C:\Windows\System\fbTIiSS.exe
  2⤵
  PID:5136
- C:\Windows\System\mmoxsIs.exe
  C:\Windows\System\mmoxsIs.exe
  2⤵
  PID:5336
- C:\Windows\System\oNdYBmG.exe
  C:\Windows\System\oNdYBmG.exe
  2⤵
  PID:4484
- C:\Windows\System\QyzOQeA.exe
  C:\Windows\System\QyzOQeA.exe
  2⤵
  PID:5296
- C:\Windows\System\vehUnZn.exe
  C:\Windows\System\vehUnZn.exe
  2⤵
  PID:6064
- C:\Windows\System\gGiHETP.exe
  C:\Windows\System\gGiHETP.exe
  2⤵
  PID:5264
- C:\Windows\System\BMeOdGA.exe
  C:\Windows\System\BMeOdGA.exe
  2⤵
  PID:6060
- C:\Windows\System\cmHSEzU.exe
  C:\Windows\System\cmHSEzU.exe
  2⤵
  PID:4172
- C:\Windows\System\LtCQvnR.exe
  C:\Windows\System\LtCQvnR.exe
  2⤵
  PID:4204
- C:\Windows\System\bVfDmEy.exe
  C:\Windows\System\bVfDmEy.exe
  2⤵
  PID:5360
- C:\Windows\System\oQBKuzp.exe
  C:\Windows\System\oQBKuzp.exe
  2⤵
  PID:5612
- C:\Windows\System\ByKbxUC.exe
  C:\Windows\System\ByKbxUC.exe
  2⤵
  PID:4124
- C:\Windows\System\NAuQxZJ.exe
  C:\Windows\System\NAuQxZJ.exe
  2⤵
  PID:5312
- C:\Windows\System\sEKukXj.exe
  C:\Windows\System\sEKukXj.exe
  2⤵
  PID:5656
- C:\Windows\System\gCPBHkK.exe
  C:\Windows\System\gCPBHkK.exe
  2⤵
  PID:5748
- C:\Windows\System\HGTUSQE.exe
  C:\Windows\System\HGTUSQE.exe
  2⤵
  PID:5596
- C:\Windows\System\daTayHH.exe
  C:\Windows\System\daTayHH.exe
  2⤵
  PID:5672
- C:\Windows\System\BwbhWqL.exe
  C:\Windows\System\BwbhWqL.exe
  2⤵
  PID:5908
- C:\Windows\System\UxqxuCy.exe
  C:\Windows\System\UxqxuCy.exe
  2⤵
  PID:5684
- C:\Windows\System\mXPzQAl.exe
  C:\Windows\System\mXPzQAl.exe
  2⤵
  PID:5412
- C:\Windows\System\JNsSlNh.exe
  C:\Windows\System\JNsSlNh.exe
  2⤵
  PID:5628
- C:\Windows\System\QnDvoOr.exe
  C:\Windows\System\QnDvoOr.exe
  2⤵
  PID:5952
- C:\Windows\System\vdxWkvI.exe
  C:\Windows\System\vdxWkvI.exe
  2⤵
  PID:6048
- C:\Windows\System\GCxmKSb.exe
  C:\Windows\System\GCxmKSb.exe
  2⤵
  PID:5936
- C:\Windows\System\sbOjwGW.exe
  C:\Windows\System\sbOjwGW.exe
  2⤵
  PID:5164
- C:\Windows\System\hVLMCIp.exe
  C:\Windows\System\hVLMCIp.exe
  2⤵
  PID:4260
- C:\Windows\System\oLSDeQx.exe
  C:\Windows\System\oLSDeQx.exe
  2⤵
  PID:4280
- C:\Windows\System\IAPgWSV.exe
  C:\Windows\System\IAPgWSV.exe
  2⤵
  PID:2760
- C:\Windows\System\xWxRpzb.exe
  C:\Windows\System\xWxRpzb.exe
  2⤵
  PID:5968
- C:\Windows\System\RSmtDmy.exe
  C:\Windows\System\RSmtDmy.exe
  2⤵
  PID:5332
- C:\Windows\System\RHmsTrM.exe
  C:\Windows\System\RHmsTrM.exe
  2⤵
  PID:6124
- C:\Windows\System\HvMCJbs.exe
  C:\Windows\System\HvMCJbs.exe
  2⤵
  PID:5320
- C:\Windows\System\VncmLta.exe
  C:\Windows\System\VncmLta.exe
  2⤵
  PID:5752
- C:\Windows\System\SaLTZdC.exe
  C:\Windows\System\SaLTZdC.exe
  2⤵
  PID:5688
- C:\Windows\System\CgfidWh.exe
  C:\Windows\System\CgfidWh.exe
  2⤵
  PID:5564
- C:\Windows\System\jDcMJdN.exe
  C:\Windows\System\jDcMJdN.exe
  2⤵
  PID:5732
- C:\Windows\System\woEvrrm.exe
  C:\Windows\System\woEvrrm.exe
  2⤵
  PID:2364
- C:\Windows\System\gLrhQkv.exe
  C:\Windows\System\gLrhQkv.exe
  2⤵
  PID:5212
- C:\Windows\System\cnQwYkK.exe
  C:\Windows\System\cnQwYkK.exe
  2⤵
  PID:5632
- C:\Windows\System\RpaqNEW.exe
  C:\Windows\System\RpaqNEW.exe
  2⤵
  PID:5788
- C:\Windows\System\tokjqiF.exe
  C:\Windows\System\tokjqiF.exe
  2⤵
  PID:5800
- C:\Windows\System\ipBpubB.exe
  C:\Windows\System\ipBpubB.exe
  2⤵
  PID:6156
- C:\Windows\System\eKIecAi.exe
  C:\Windows\System\eKIecAi.exe
  2⤵
  PID:6172
- C:\Windows\System\SODCQDd.exe
  C:\Windows\System\SODCQDd.exe
  2⤵
  PID:6188
- C:\Windows\System\zpkVVhc.exe
  C:\Windows\System\zpkVVhc.exe
  2⤵
  PID:6204
- C:\Windows\System\DAoZopb.exe
  C:\Windows\System\DAoZopb.exe
  2⤵
  PID:6220
- C:\Windows\System\TlGNqtW.exe
  C:\Windows\System\TlGNqtW.exe
  2⤵
  PID:6240
- C:\Windows\System\kLBKFhH.exe
  C:\Windows\System\kLBKFhH.exe
  2⤵
  PID:6256
- C:\Windows\System\SlFOaLu.exe
  C:\Windows\System\SlFOaLu.exe
  2⤵
  PID:6272
- C:\Windows\System\YgkPvlX.exe
  C:\Windows\System\YgkPvlX.exe
  2⤵
  PID:6288
- C:\Windows\System\eqKwPPG.exe
  C:\Windows\System\eqKwPPG.exe
  2⤵
  PID:6304
- C:\Windows\System\ofnZAFL.exe
  C:\Windows\System\ofnZAFL.exe
  2⤵
  PID:6320
- C:\Windows\System\EQKyTTw.exe
  C:\Windows\System\EQKyTTw.exe
  2⤵
  PID:6336
- C:\Windows\System\gkOMACv.exe
  C:\Windows\System\gkOMACv.exe
  2⤵
  PID:6352
- C:\Windows\System\LUJVjUF.exe
  C:\Windows\System\LUJVjUF.exe
  2⤵
  PID:6368
- C:\Windows\System\lnBscVK.exe
  C:\Windows\System\lnBscVK.exe
  2⤵
  PID:6384
- C:\Windows\System\oSwNxcZ.exe
  C:\Windows\System\oSwNxcZ.exe
  2⤵
  PID:6400
- C:\Windows\System\HtjwVTp.exe
  C:\Windows\System\HtjwVTp.exe
  2⤵
  PID:6420
- C:\Windows\System\tYzUAqx.exe
  C:\Windows\System\tYzUAqx.exe
  2⤵
  PID:6436
- C:\Windows\System\qPinKcn.exe
  C:\Windows\System\qPinKcn.exe
  2⤵
  PID:6452
- C:\Windows\System\brPnmYk.exe
  C:\Windows\System\brPnmYk.exe
  2⤵
  PID:6468
- C:\Windows\System\yEXOSys.exe
  C:\Windows\System\yEXOSys.exe
  2⤵
  PID:6484
- C:\Windows\System\fYfWUNH.exe
  C:\Windows\System\fYfWUNH.exe
  2⤵
  PID:6500
- C:\Windows\System\euFoilx.exe
  C:\Windows\System\euFoilx.exe
  2⤵
  PID:6516
- C:\Windows\System\MTRmSGf.exe
  C:\Windows\System\MTRmSGf.exe
  2⤵
  PID:6532
- C:\Windows\System\zMpMIZu.exe
  C:\Windows\System\zMpMIZu.exe
  2⤵
  PID:6548
- C:\Windows\System\GkingVf.exe
  C:\Windows\System\GkingVf.exe
  2⤵
  PID:6568
- C:\Windows\System\lqEoxKm.exe
  C:\Windows\System\lqEoxKm.exe
  2⤵
  PID:6584
- C:\Windows\System\JCTQLoF.exe
  C:\Windows\System\JCTQLoF.exe
  2⤵
  PID:6600
- C:\Windows\System\vuDULKL.exe
  C:\Windows\System\vuDULKL.exe
  2⤵
  PID:6620
- C:\Windows\System\POKdGkk.exe
  C:\Windows\System\POKdGkk.exe
  2⤵
  PID:6640
- C:\Windows\System\LmmzWhk.exe
  C:\Windows\System\LmmzWhk.exe
  2⤵
  PID:6656
- C:\Windows\System\etVDpGi.exe
  C:\Windows\System\etVDpGi.exe
  2⤵
  PID:6672
- C:\Windows\System\lFHuftR.exe
  C:\Windows\System\lFHuftR.exe
  2⤵
  PID:6688
- C:\Windows\System\fmHCvxa.exe
  C:\Windows\System\fmHCvxa.exe
  2⤵
  PID:6708
- C:\Windows\System\OTMWPof.exe
  C:\Windows\System\OTMWPof.exe
  2⤵
  PID:6724
- C:\Windows\System\sFVEFky.exe
  C:\Windows\System\sFVEFky.exe
  2⤵
  PID:6740
- C:\Windows\System\socEIyS.exe
  C:\Windows\System\socEIyS.exe
  2⤵
  PID:6760
- C:\Windows\System\fAqEFGK.exe
  C:\Windows\System\fAqEFGK.exe
  2⤵
  PID:6776
- C:\Windows\System\LhzSGof.exe
  C:\Windows\System\LhzSGof.exe
  2⤵
  PID:6792
- C:\Windows\System\XpZyDER.exe
  C:\Windows\System\XpZyDER.exe
  2⤵
  PID:6808
- C:\Windows\System\hfcrmiJ.exe
  C:\Windows\System\hfcrmiJ.exe
  2⤵
  PID:6828
- C:\Windows\System\BSewBBG.exe
  C:\Windows\System\BSewBBG.exe
  2⤵
  PID:6844
- C:\Windows\System\XMIAyuO.exe
  C:\Windows\System\XMIAyuO.exe
  2⤵
  PID:6860
- C:\Windows\System\uFoyVaw.exe
  C:\Windows\System\uFoyVaw.exe
  2⤵
  PID:6876
- C:\Windows\System\VsJDOJl.exe
  C:\Windows\System\VsJDOJl.exe
  2⤵
  PID:6892
- C:\Windows\System\eoatStk.exe
  C:\Windows\System\eoatStk.exe
  2⤵
  PID:6908
- C:\Windows\System\WthJeec.exe
  C:\Windows\System\WthJeec.exe
  2⤵
  PID:6924
- C:\Windows\System\OdIaiVG.exe
  C:\Windows\System\OdIaiVG.exe
  2⤵
  PID:6940
- C:\Windows\System\mDloaXT.exe
  C:\Windows\System\mDloaXT.exe
  2⤵
  PID:6956
- C:\Windows\System\MpoHoby.exe
  C:\Windows\System\MpoHoby.exe
  2⤵
  PID:6972
- C:\Windows\System\iWOmZGb.exe
  C:\Windows\System\iWOmZGb.exe
  2⤵
  PID:6988
- C:\Windows\System\ddFdsHR.exe
  C:\Windows\System\ddFdsHR.exe
  2⤵
  PID:7004
- C:\Windows\System\rBIUGqu.exe
  C:\Windows\System\rBIUGqu.exe
  2⤵
  PID:7020
- C:\Windows\System\TsSHgea.exe
  C:\Windows\System\TsSHgea.exe
  2⤵
  PID:7036
- C:\Windows\System\tXaLnLO.exe
  C:\Windows\System\tXaLnLO.exe
  2⤵
  PID:7052
- C:\Windows\System\hLTYHSS.exe
  C:\Windows\System\hLTYHSS.exe
  2⤵
  PID:7068
- C:\Windows\System\swgRQqm.exe
  C:\Windows\System\swgRQqm.exe
  2⤵
  PID:7088
- C:\Windows\System\VhHKiQb.exe
  C:\Windows\System\VhHKiQb.exe
  2⤵
  PID:7104
- C:\Windows\System\uxCWNpp.exe
  C:\Windows\System\uxCWNpp.exe
  2⤵
  PID:7120
- C:\Windows\System\LpwvcAn.exe
  C:\Windows\System\LpwvcAn.exe
  2⤵
  PID:7136
- C:\Windows\System\RbZuSsR.exe
  C:\Windows\System\RbZuSsR.exe
  2⤵
  PID:7152
- C:\Windows\System\eybNBwF.exe
  C:\Windows\System\eybNBwF.exe
  2⤵
  PID:5904
- C:\Windows\System\xahxVEy.exe
  C:\Windows\System\xahxVEy.exe
  2⤵
  PID:6164
- C:\Windows\System\URWwVID.exe
  C:\Windows\System\URWwVID.exe
  2⤵
  PID:5948
- C:\Windows\System\PYIdUpg.exe
  C:\Windows\System\PYIdUpg.exe
  2⤵
  PID:5992
- C:\Windows\System\UhvVZPF.exe
  C:\Windows\System\UhvVZPF.exe
  2⤵
  PID:5248
- C:\Windows\System\ubdVugZ.exe
  C:\Windows\System\ubdVugZ.exe
  2⤵
  PID:5216
- C:\Windows\System\HZMcRMi.exe
  C:\Windows\System\HZMcRMi.exe
  2⤵
  PID:6212
- C:\Windows\System\kNxtndv.exe
  C:\Windows\System\kNxtndv.exe
  2⤵
  PID:5980
- C:\Windows\System\cSODqqr.exe
  C:\Windows\System\cSODqqr.exe
  2⤵
  PID:6180
- C:\Windows\System\POLgluo.exe
  C:\Windows\System\POLgluo.exe
  2⤵
  PID:6264
- C:\Windows\System\vTIdXCO.exe
  C:\Windows\System\vTIdXCO.exe
  2⤵
  PID:6284
- C:\Windows\System\OFpUVsq.exe
  C:\Windows\System\OFpUVsq.exe
  2⤵
  PID:6328
- C:\Windows\System\YJhhsdr.exe
  C:\Windows\System\YJhhsdr.exe
  2⤵
  PID:6380
- C:\Windows\System\HOkOVPm.exe
  C:\Windows\System\HOkOVPm.exe
  2⤵
  PID:6416
- C:\Windows\System\SEAgkmr.exe
  C:\Windows\System\SEAgkmr.exe
  2⤵
  PID:6408
- C:\Windows\System\fQyEJJD.exe
  C:\Windows\System\fQyEJJD.exe
  2⤵
  PID:6428
- C:\Windows\System\OfkxqEM.exe
  C:\Windows\System\OfkxqEM.exe
  2⤵
  PID:6492
- C:\Windows\System\SYIBSbI.exe
  C:\Windows\System\SYIBSbI.exe
  2⤵
  PID:6508
- C:\Windows\System\TtduBqB.exe
  C:\Windows\System\TtduBqB.exe
  2⤵
  PID:6528
- C:\Windows\System\LccVanG.exe
  C:\Windows\System\LccVanG.exe
  2⤵
  PID:6592
- C:\Windows\System\rlSQGWo.exe
  C:\Windows\System\rlSQGWo.exe
  2⤵
  PID:6576
- C:\Windows\System\ImAimNY.exe
  C:\Windows\System\ImAimNY.exe
  2⤵
  PID:6616
- C:\Windows\System\xxoivvo.exe
  C:\Windows\System\xxoivvo.exe
  2⤵
  PID:6704
- C:\Windows\System\URJACsA.exe
  C:\Windows\System\URJACsA.exe
  2⤵
  PID:6772
- C:\Windows\System\WzflfAv.exe
  C:\Windows\System\WzflfAv.exe
  2⤵
  PID:6668
- C:\Windows\System\otZtkuJ.exe
  C:\Windows\System\otZtkuJ.exe
  2⤵
  PID:6716
- C:\Windows\System\PWSoNfN.exe
  C:\Windows\System\PWSoNfN.exe
  2⤵
  PID:6820
- C:\Windows\System\rADGVir.exe
  C:\Windows\System\rADGVir.exe
  2⤵
  PID:6748
- C:\Windows\System\lypBPmN.exe
  C:\Windows\System\lypBPmN.exe
  2⤵
  PID:6836
- C:\Windows\System\evntQtm.exe
  C:\Windows\System\evntQtm.exe
  2⤵
  PID:6936
- C:\Windows\System\cnpJZmh.exe
  C:\Windows\System\cnpJZmh.exe
  2⤵
  PID:6888
- C:\Windows\System\DZGxWyD.exe
  C:\Windows\System\DZGxWyD.exe
  2⤵
  PID:6856
- C:\Windows\System\hOjnAqF.exe
  C:\Windows\System\hOjnAqF.exe
  2⤵
  PID:7028
- C:\Windows\System\zYYFYAA.exe
  C:\Windows\System\zYYFYAA.exe
  2⤵
  PID:6980
- C:\Windows\System\jofKWPX.exe
  C:\Windows\System\jofKWPX.exe
  2⤵
  PID:7016
- C:\Windows\System\yNMTRVH.exe
  C:\Windows\System\yNMTRVH.exe
  2⤵
  PID:7100
- C:\Windows\System\glHNboX.exe
  C:\Windows\System\glHNboX.exe
  2⤵
  PID:7076
- C:\Windows\System\PlsfRnP.exe
  C:\Windows\System\PlsfRnP.exe
  2⤵
  PID:7144
- C:\Windows\System\mTdJjml.exe
  C:\Windows\System\mTdJjml.exe
  2⤵
  PID:7148
- C:\Windows\System\CHEqgxq.exe
  C:\Windows\System\CHEqgxq.exe
  2⤵
  PID:6184
- C:\Windows\System\SsWxpbZ.exe
  C:\Windows\System\SsWxpbZ.exe
  2⤵
  PID:5484
- C:\Windows\System\RnbINyr.exe
  C:\Windows\System\RnbINyr.exe
  2⤵
  PID:6280
- C:\Windows\System\HPONHXP.exe
  C:\Windows\System\HPONHXP.exe
  2⤵
  PID:6376
- C:\Windows\System\RrVLopq.exe
  C:\Windows\System\RrVLopq.exe
  2⤵
  PID:6524
- C:\Windows\System\UTIaUNj.exe
  C:\Windows\System\UTIaUNj.exe
  2⤵
  PID:5880
- C:\Windows\System\QZNPZgK.exe
  C:\Windows\System\QZNPZgK.exe
  2⤵
  PID:6444
- C:\Windows\System\cVFFGSf.exe
  C:\Windows\System\cVFFGSf.exe
  2⤵
  PID:6268
- C:\Windows\System\PYzvTIT.exe
  C:\Windows\System\PYzvTIT.exe
  2⤵
  PID:6476
- C:\Windows\System\IFHeJjW.exe
  C:\Windows\System\IFHeJjW.exe
  2⤵
  PID:6544
- C:\Windows\System\ojwUhYN.exe
  C:\Windows\System\ojwUhYN.exe
  2⤵
  PID:6804
- C:\Windows\System\WmEprGX.exe
  C:\Windows\System\WmEprGX.exe
  2⤵
  PID:6788
- C:\Windows\System\eTgWUxD.exe
  C:\Windows\System\eTgWUxD.exe
  2⤵
  PID:6904
- C:\Windows\System\xdoTNDT.exe
  C:\Windows\System\xdoTNDT.exe
  2⤵
  PID:6852
- C:\Windows\System\MNybZtr.exe
  C:\Windows\System\MNybZtr.exe
  2⤵
  PID:6872
- C:\Windows\System\NianQre.exe
  C:\Windows\System\NianQre.exe
  2⤵
  PID:6984
- C:\Windows\System\VgCMIID.exe
  C:\Windows\System\VgCMIID.exe
  2⤵
  PID:7044
- C:\Windows\System\shjgysG.exe
  C:\Windows\System\shjgysG.exe
  2⤵
  PID:7048
- C:\Windows\System\COjspYM.exe
  C:\Windows\System\COjspYM.exe
  2⤵
  PID:5552
- C:\Windows\System\Dexnmku.exe
  C:\Windows\System\Dexnmku.exe
  2⤵
  PID:6168
- C:\Windows\System\iaHuHJQ.exe
  C:\Windows\System\iaHuHJQ.exe
  2⤵
  PID:6296
- C:\Windows\System\ZZRLHzC.exe
  C:\Windows\System\ZZRLHzC.exe
  2⤵
  PID:6044
- C:\Windows\System\BVNyHPa.exe
  C:\Windows\System\BVNyHPa.exe
  2⤵
  PID:6652
- C:\Windows\System\dTVeXTO.exe
  C:\Windows\System\dTVeXTO.exe
  2⤵
  PID:6252
- C:\Windows\System\UimPVpI.exe
  C:\Windows\System\UimPVpI.exe
  2⤵
  PID:6540
- C:\Windows\System\baGzkfu.exe
  C:\Windows\System\baGzkfu.exe
  2⤵
  PID:6920
- C:\Windows\System\uynlMmK.exe
  C:\Windows\System\uynlMmK.exe
  2⤵
  PID:6612
- C:\Windows\System\OSvJszQ.exe
  C:\Windows\System\OSvJszQ.exe
  2⤵
  PID:6964
- C:\Windows\System\AhTXLLV.exe
  C:\Windows\System\AhTXLLV.exe
  2⤵
  PID:7112
- C:\Windows\System\TCpBFet.exe
  C:\Windows\System\TCpBFet.exe
  2⤵
  PID:5356
- C:\Windows\System\PyCfRJJ.exe
  C:\Windows\System\PyCfRJJ.exe
  2⤵
  PID:6784
- C:\Windows\System\nFQQFez.exe
  C:\Windows\System\nFQQFez.exe
  2⤵
  PID:5476
- C:\Windows\System\yGJltHf.exe
  C:\Windows\System\yGJltHf.exe
  2⤵
  PID:7128
- C:\Windows\System\tMmnNXk.exe
  C:\Windows\System\tMmnNXk.exe
  2⤵
  PID:6560
- C:\Windows\System\AvjKwhG.exe
  C:\Windows\System\AvjKwhG.exe
  2⤵
  PID:5836
- C:\Windows\System\BVuRXlz.exe
  C:\Windows\System\BVuRXlz.exe
  2⤵
  PID:4500
- C:\Windows\System\jgbnGfE.exe
  C:\Windows\System\jgbnGfE.exe
  2⤵
  PID:7184
- C:\Windows\System\gjaRZcM.exe
  C:\Windows\System\gjaRZcM.exe
  2⤵
  PID:7200
- C:\Windows\System\mqGYXhL.exe
  C:\Windows\System\mqGYXhL.exe
  2⤵
  PID:7216
- C:\Windows\System\Dxjkubd.exe
  C:\Windows\System\Dxjkubd.exe
  2⤵
  PID:7236
- C:\Windows\System\gsoMKuc.exe
  C:\Windows\System\gsoMKuc.exe
  2⤵
  PID:7252
- C:\Windows\System\VorfnCG.exe
  C:\Windows\System\VorfnCG.exe
  2⤵
  PID:7268
- C:\Windows\System\IYWWrrV.exe
  C:\Windows\System\IYWWrrV.exe
  2⤵
  PID:7284
- C:\Windows\System\rrhvENO.exe
  C:\Windows\System\rrhvENO.exe
  2⤵
  PID:7300
- C:\Windows\System\fAlJJbu.exe
  C:\Windows\System\fAlJJbu.exe
  2⤵
  PID:7316
- C:\Windows\System\XxLsbPY.exe
  C:\Windows\System\XxLsbPY.exe
  2⤵
  PID:7332
- C:\Windows\System\tWeMjak.exe
  C:\Windows\System\tWeMjak.exe
  2⤵
  PID:7348
- C:\Windows\System\HIpjPSG.exe
  C:\Windows\System\HIpjPSG.exe
  2⤵
  PID:7364
- C:\Windows\System\nKeqaBa.exe
  C:\Windows\System\nKeqaBa.exe
  2⤵
  PID:7380
- C:\Windows\System\MLNhgNk.exe
  C:\Windows\System\MLNhgNk.exe
  2⤵
  PID:7396
- C:\Windows\System\rAnWmwJ.exe
  C:\Windows\System\rAnWmwJ.exe
  2⤵
  PID:7412
- C:\Windows\System\stVTpGU.exe
  C:\Windows\System\stVTpGU.exe
  2⤵
  PID:7428
- C:\Windows\System\qhmtAFO.exe
  C:\Windows\System\qhmtAFO.exe
  2⤵
  PID:7444
- C:\Windows\System\yUnkyrw.exe
  C:\Windows\System\yUnkyrw.exe
  2⤵
  PID:7460
- C:\Windows\System\HaVIdLd.exe
  C:\Windows\System\HaVIdLd.exe
  2⤵
  PID:7476
- C:\Windows\System\eGsFVoX.exe
  C:\Windows\System\eGsFVoX.exe
  2⤵
  PID:7492
- C:\Windows\System\AgYuUoc.exe
  C:\Windows\System\AgYuUoc.exe
  2⤵
  PID:7508
- C:\Windows\System\KeZiQmm.exe
  C:\Windows\System\KeZiQmm.exe
  2⤵
  PID:7524
- C:\Windows\System\hiBCZQB.exe
  C:\Windows\System\hiBCZQB.exe
  2⤵
  PID:7540
- C:\Windows\System\RKndHAm.exe
  C:\Windows\System\RKndHAm.exe
  2⤵
  PID:7556
- C:\Windows\System\OiBmuwz.exe
  C:\Windows\System\OiBmuwz.exe
  2⤵
  PID:7572
- C:\Windows\System\yyWQXkp.exe
  C:\Windows\System\yyWQXkp.exe
  2⤵
  PID:7588
- C:\Windows\System\PssiSuq.exe
  C:\Windows\System\PssiSuq.exe
  2⤵
  PID:7604
- C:\Windows\System\jrZRnwL.exe
  C:\Windows\System\jrZRnwL.exe
  2⤵
  PID:7620
- C:\Windows\System\FZvDUBK.exe
  C:\Windows\System\FZvDUBK.exe
  2⤵
  PID:7636
- C:\Windows\System\ZZKwGXT.exe
  C:\Windows\System\ZZKwGXT.exe
  2⤵
  PID:7652
- C:\Windows\System\sgYGAdb.exe
  C:\Windows\System\sgYGAdb.exe
  2⤵
  PID:7668
- C:\Windows\System\gAtoEDa.exe
  C:\Windows\System\gAtoEDa.exe
  2⤵
  PID:7684
- C:\Windows\System\UoTBfXh.exe
  C:\Windows\System\UoTBfXh.exe
  2⤵
  PID:7700
- C:\Windows\System\UOMVePF.exe
  C:\Windows\System\UOMVePF.exe
  2⤵
  PID:7716
- C:\Windows\System\ITHRadR.exe
  C:\Windows\System\ITHRadR.exe
  2⤵
  PID:7732
- C:\Windows\System\InejlJM.exe
  C:\Windows\System\InejlJM.exe
  2⤵
  PID:7748
- C:\Windows\System\jHmHYJH.exe
  C:\Windows\System\jHmHYJH.exe
  2⤵
  PID:7768
- C:\Windows\System\bKFVjXA.exe
  C:\Windows\System\bKFVjXA.exe
  2⤵
  PID:7784
- C:\Windows\System\HJNIYas.exe
  C:\Windows\System\HJNIYas.exe
  2⤵
  PID:7800
- C:\Windows\System\HtMNoDo.exe
  C:\Windows\System\HtMNoDo.exe
  2⤵
  PID:7816
- C:\Windows\System\ZPwboZn.exe
  C:\Windows\System\ZPwboZn.exe
  2⤵
  PID:7832
- C:\Windows\System\wtDsyxJ.exe
  C:\Windows\System\wtDsyxJ.exe
  2⤵
  PID:7848
- C:\Windows\System\htGBDTj.exe
  C:\Windows\System\htGBDTj.exe
  2⤵
  PID:7864
- C:\Windows\System\ZbAjyRe.exe
  C:\Windows\System\ZbAjyRe.exe
  2⤵
  PID:7880
- C:\Windows\System\KuNsFSR.exe
  C:\Windows\System\KuNsFSR.exe
  2⤵
  PID:7896
- C:\Windows\System\YAxQGVV.exe
  C:\Windows\System\YAxQGVV.exe
  2⤵
  PID:7916
- C:\Windows\System\bQWxDHm.exe
  C:\Windows\System\bQWxDHm.exe
  2⤵
  PID:7932
- C:\Windows\System\iwahRDr.exe
  C:\Windows\System\iwahRDr.exe
  2⤵
  PID:7952
- C:\Windows\System\fxixtQt.exe
  C:\Windows\System\fxixtQt.exe
  2⤵
  PID:7968
- C:\Windows\System\XEesvqs.exe
  C:\Windows\System\XEesvqs.exe
  2⤵
  PID:7984
- C:\Windows\System\veEoGJT.exe
  C:\Windows\System\veEoGJT.exe
  2⤵
  PID:8004
- C:\Windows\System\zeGqDes.exe
  C:\Windows\System\zeGqDes.exe
  2⤵
  PID:8020
- C:\Windows\System\kstBTLP.exe
  C:\Windows\System\kstBTLP.exe
  2⤵
  PID:8036
- C:\Windows\System\ZGKMFFq.exe
  C:\Windows\System\ZGKMFFq.exe
  2⤵
  PID:8052
- C:\Windows\System\JNzsTQA.exe
  C:\Windows\System\JNzsTQA.exe
  2⤵
  PID:8068
- C:\Windows\System\lFDinjD.exe
  C:\Windows\System\lFDinjD.exe
  2⤵
  PID:8084
- C:\Windows\System\xXHfQnl.exe
  C:\Windows\System\xXHfQnl.exe
  2⤵
  PID:8104
- C:\Windows\System\InBgBfl.exe
  C:\Windows\System\InBgBfl.exe
  2⤵
  PID:8120
- C:\Windows\System\vKpvfZn.exe
  C:\Windows\System\vKpvfZn.exe
  2⤵
  PID:8140
- C:\Windows\System\TncvsXO.exe
  C:\Windows\System\TncvsXO.exe
  2⤵
  PID:8156
- C:\Windows\System\GZftuqo.exe
  C:\Windows\System\GZftuqo.exe
  2⤵
  PID:8172
- C:\Windows\System\ZLzFhzn.exe
  C:\Windows\System\ZLzFhzn.exe
  2⤵
  PID:8188
- C:\Windows\System\qgGkiUB.exe
  C:\Windows\System\qgGkiUB.exe
  2⤵
  PID:7012
- C:\Windows\System\RmWUYpk.exe
  C:\Windows\System\RmWUYpk.exe
  2⤵
  PID:7228
- C:\Windows\System\sYJgUdY.exe
  C:\Windows\System\sYJgUdY.exe
  2⤵
  PID:7292
- C:\Windows\System\pEGWhsK.exe
  C:\Windows\System\pEGWhsK.exe
  2⤵
  PID:7360
- C:\Windows\System\YfkJCJD.exe
  C:\Windows\System\YfkJCJD.exe
  2⤵
  PID:7420
- C:\Windows\System\svyqakZ.exe
  C:\Windows\System\svyqakZ.exe
  2⤵
  PID:7484
- C:\Windows\System\TjNAPbW.exe
  C:\Windows\System\TjNAPbW.exe
  2⤵
  PID:6932
- C:\Windows\System\jPXvpkX.exe
  C:\Windows\System\jPXvpkX.exe
  2⤵
  PID:7372
- C:\Windows\System\dXTgMgI.exe
  C:\Windows\System\dXTgMgI.exe
  2⤵
  PID:7616
- C:\Windows\System\ONElnJg.exe
  C:\Windows\System\ONElnJg.exe
  2⤵
  PID:6996
- C:\Windows\System\aNTCJlt.exe
  C:\Windows\System\aNTCJlt.exe
  2⤵
  PID:7212
- C:\Windows\System\BtzlUlg.exe
  C:\Windows\System\BtzlUlg.exe
  2⤵
  PID:7308
- C:\Windows\System\mDcbVFb.exe
  C:\Windows\System\mDcbVFb.exe
  2⤵
  PID:7468
- C:\Windows\System\QkjKfEP.exe
  C:\Windows\System\QkjKfEP.exe
  2⤵
  PID:7648
- C:\Windows\System\FBhAGeU.exe
  C:\Windows\System\FBhAGeU.exe
  2⤵
  PID:7408
- C:\Windows\System\Ptrcvat.exe
  C:\Windows\System\Ptrcvat.exe
  2⤵
  PID:7532
- C:\Windows\System\HysYoye.exe
  C:\Windows\System\HysYoye.exe
  2⤵
  PID:7708
- C:\Windows\System\SunloaX.exe
  C:\Windows\System\SunloaX.exe
  2⤵
  PID:7744
- C:\Windows\System\ZfpnMXt.exe
  C:\Windows\System\ZfpnMXt.exe
  2⤵
  PID:7664
- C:\Windows\System\NQTncZz.exe
  C:\Windows\System\NQTncZz.exe
  2⤵
  PID:7792
- C:\Windows\System\HxZaHZr.exe
  C:\Windows\System\HxZaHZr.exe
  2⤵
  PID:7812
- C:\Windows\System\HSMyyQE.exe
  C:\Windows\System\HSMyyQE.exe
  2⤵
  PID:7876
- C:\Windows\System\kJNvpuC.exe
  C:\Windows\System\kJNvpuC.exe
  2⤵
  PID:7912
- C:\Windows\System\jHzYqyR.exe
  C:\Windows\System\jHzYqyR.exe
  2⤵
  PID:7976
- C:\Windows\System\JvwMWiH.exe
  C:\Windows\System\JvwMWiH.exe
  2⤵
  PID:8016
- C:\Windows\System\RPvgIHA.exe
  C:\Windows\System\RPvgIHA.exe
  2⤵
  PID:8044
- C:\Windows\System\nZHrbSz.exe
  C:\Windows\System\nZHrbSz.exe
  2⤵
  PID:7828
- C:\Windows\System\eKoEjCU.exe
  C:\Windows\System\eKoEjCU.exe
  2⤵
  PID:7860
- C:\Windows\System\TUdDArf.exe
  C:\Windows\System\TUdDArf.exe
  2⤵
  PID:8180
- C:\Windows\System\JnGWMAQ.exe
  C:\Windows\System\JnGWMAQ.exe
  2⤵
  PID:8136
- C:\Windows\System\SuFOTnD.exe
  C:\Windows\System\SuFOTnD.exe
  2⤵
  PID:7996
- C:\Windows\System\jqjNNaD.exe
  C:\Windows\System\jqjNNaD.exe
  2⤵
  PID:8132
- C:\Windows\System\FYBcqaY.exe
  C:\Windows\System\FYBcqaY.exe
  2⤵
  PID:7196
- C:\Windows\System\iBGUjAu.exe
  C:\Windows\System\iBGUjAu.exe
  2⤵
  PID:7452
- C:\Windows\System\LbhpcMv.exe
  C:\Windows\System\LbhpcMv.exe
  2⤵
  PID:7260
- C:\Windows\System\CAXcEGw.exe
  C:\Windows\System\CAXcEGw.exe
  2⤵
  PID:7176
- C:\Windows\System\sjixENe.exe
  C:\Windows\System\sjixENe.exe
  2⤵
  PID:7312
- C:\Windows\System\FyjSCQM.exe
  C:\Windows\System\FyjSCQM.exe
  2⤵
  PID:7612
- C:\Windows\System\xqBrsLP.exe
  C:\Windows\System\xqBrsLP.exe
  2⤵
  PID:7244
- C:\Windows\System\RRTySzP.exe
  C:\Windows\System\RRTySzP.exe
  2⤵
  PID:7676
- C:\Windows\System\YdNnvaW.exe
  C:\Windows\System\YdNnvaW.exe
  2⤵
  PID:7740
- C:\Windows\System\LcdQUCK.exe
  C:\Windows\System\LcdQUCK.exe
  2⤵
  PID:7808
- C:\Windows\System\ptoGVFd.exe
  C:\Windows\System\ptoGVFd.exe
  2⤵
  PID:7776
- C:\Windows\System\QgkYjDw.exe
  C:\Windows\System\QgkYjDw.exe
  2⤵
  PID:7660
- C:\Windows\System\ZnnmKMF.exe
  C:\Windows\System\ZnnmKMF.exe
  2⤵
  PID:7904
- C:\Windows\System\sqKBOqU.exe
  C:\Windows\System\sqKBOqU.exe
  2⤵
  PID:8112
- C:\Windows\System\krgUbOH.exe
  C:\Windows\System\krgUbOH.exe
  2⤵
  PID:8128
- C:\Windows\System\QAzGHdj.exe
  C:\Windows\System\QAzGHdj.exe
  2⤵
  PID:8168
- C:\Windows\System\btkiwuB.exe
  C:\Windows\System\btkiwuB.exe
  2⤵
  PID:7500
- C:\Windows\System\vNtcgrt.exe
  C:\Windows\System\vNtcgrt.exe
  2⤵
  PID:7180
- C:\Windows\System\IqltcKR.exe
  C:\Windows\System\IqltcKR.exe
  2⤵
  PID:8152
- C:\Windows\System\SGyRLXE.exe
  C:\Windows\System\SGyRLXE.exe
  2⤵
  PID:8032
- C:\Windows\System\VcMgbaq.exe
  C:\Windows\System\VcMgbaq.exe
  2⤵
  PID:7580
- C:\Windows\System\YyAFtAg.exe
  C:\Windows\System\YyAFtAg.exe
  2⤵
  PID:7388
- C:\Windows\System\SFEiIKY.exe
  C:\Windows\System\SFEiIKY.exe
  2⤵
  PID:7692
- C:\Windows\System\eoHqjyA.exe
  C:\Windows\System\eoHqjyA.exe
  2⤵
  PID:7892
- C:\Windows\System\JzFAREe.exe
  C:\Windows\System\JzFAREe.exe
  2⤵
  PID:7392
- C:\Windows\System\tQqfOAq.exe
  C:\Windows\System\tQqfOAq.exe
  2⤵
  PID:8184
- C:\Windows\System\NaLWTXc.exe
  C:\Windows\System\NaLWTXc.exe
  2⤵
  PID:7600
- C:\Windows\System\jHgIppy.exe
  C:\Windows\System\jHgIppy.exe
  2⤵
  PID:7948
- C:\Windows\System\iioahQX.exe
  C:\Windows\System\iioahQX.exe
  2⤵
  PID:8196
- C:\Windows\System\iySsonY.exe
  C:\Windows\System\iySsonY.exe
  2⤵
  PID:8212
- C:\Windows\System\coptXaR.exe
  C:\Windows\System\coptXaR.exe
  2⤵
  PID:8228
- C:\Windows\System\hzYhLKE.exe
  C:\Windows\System\hzYhLKE.exe
  2⤵
  PID:8244
- C:\Windows\System\CcUfZxI.exe
  C:\Windows\System\CcUfZxI.exe
  2⤵
  PID:8260
- C:\Windows\System\DBhYzvG.exe
  C:\Windows\System\DBhYzvG.exe
  2⤵
  PID:8276
- C:\Windows\System\tNLPfhs.exe
  C:\Windows\System\tNLPfhs.exe
  2⤵
  PID:8292
- C:\Windows\System\gYBjxJN.exe
  C:\Windows\System\gYBjxJN.exe
  2⤵
  PID:8308
- C:\Windows\System\GRnkANW.exe
  C:\Windows\System\GRnkANW.exe
  2⤵
  PID:8324
- C:\Windows\System\YzGSAoY.exe
  C:\Windows\System\YzGSAoY.exe
  2⤵
  PID:8340
- C:\Windows\System\cxplMVo.exe
  C:\Windows\System\cxplMVo.exe
  2⤵
  PID:8356
- C:\Windows\System\EiMtZWK.exe
  C:\Windows\System\EiMtZWK.exe
  2⤵
  PID:8372
- C:\Windows\System\yRSmsqL.exe
  C:\Windows\System\yRSmsqL.exe
  2⤵
  PID:8388
- C:\Windows\System\OJpidzO.exe
  C:\Windows\System\OJpidzO.exe
  2⤵
  PID:8404
- C:\Windows\System\tzyiPyW.exe
  C:\Windows\System\tzyiPyW.exe
  2⤵
  PID:8420
- C:\Windows\System\sgOKcMV.exe
  C:\Windows\System\sgOKcMV.exe
  2⤵
  PID:8436
- C:\Windows\System\apfdSEY.exe
  C:\Windows\System\apfdSEY.exe
  2⤵
  PID:8452
- C:\Windows\System\JGRTSdn.exe
  C:\Windows\System\JGRTSdn.exe
  2⤵
  PID:8468
- C:\Windows\System\QQfeVgG.exe
  C:\Windows\System\QQfeVgG.exe
  2⤵
  PID:8484
- C:\Windows\System\RfVxPCs.exe
  C:\Windows\System\RfVxPCs.exe
  2⤵
  PID:8500
- C:\Windows\System\KSXFtqz.exe
  C:\Windows\System\KSXFtqz.exe
  2⤵
  PID:8520
- C:\Windows\System\eXEUOjL.exe
  C:\Windows\System\eXEUOjL.exe
  2⤵
  PID:8536
- C:\Windows\System\AaBfOtN.exe
  C:\Windows\System\AaBfOtN.exe
  2⤵
  PID:8556
- C:\Windows\System\dwbeNdL.exe
  C:\Windows\System\dwbeNdL.exe
  2⤵
  PID:8572
- C:\Windows\System\KVFNvJL.exe
  C:\Windows\System\KVFNvJL.exe
  2⤵
  PID:8588
- C:\Windows\System\dGciBUY.exe
  C:\Windows\System\dGciBUY.exe
  2⤵
  PID:8604
- C:\Windows\System\hORFzeA.exe
  C:\Windows\System\hORFzeA.exe
  2⤵
  PID:8620
- C:\Windows\System\QWekBpz.exe
  C:\Windows\System\QWekBpz.exe
  2⤵
  PID:8636
- C:\Windows\System\CiWpOst.exe
  C:\Windows\System\CiWpOst.exe
  2⤵
  PID:8652
- C:\Windows\System\CfksoKQ.exe
  C:\Windows\System\CfksoKQ.exe
  2⤵
  PID:8668
- C:\Windows\System\rIqPzfh.exe
  C:\Windows\System\rIqPzfh.exe
  2⤵
  PID:8684
- C:\Windows\System\cJAUScH.exe
  C:\Windows\System\cJAUScH.exe
  2⤵
  PID:8700
- C:\Windows\System\uFqLLoL.exe
  C:\Windows\System\uFqLLoL.exe
  2⤵
  PID:8716
- C:\Windows\System\ixPqTEX.exe
  C:\Windows\System\ixPqTEX.exe
  2⤵
  PID:8732
- C:\Windows\System\kTiUqVJ.exe
  C:\Windows\System\kTiUqVJ.exe
  2⤵
  PID:8752
- C:\Windows\System\tZtxKxi.exe
  C:\Windows\System\tZtxKxi.exe
  2⤵
  PID:8768
- C:\Windows\System\IMsbpTy.exe
  C:\Windows\System\IMsbpTy.exe
  2⤵
  PID:8784
- C:\Windows\System\XUDcbeC.exe
  C:\Windows\System\XUDcbeC.exe
  2⤵
  PID:8800
- C:\Windows\System\meEXWwf.exe
  C:\Windows\System\meEXWwf.exe
  2⤵
  PID:8816
- C:\Windows\System\KedzqhD.exe
  C:\Windows\System\KedzqhD.exe
  2⤵
  PID:8832
- C:\Windows\System\wQtKksi.exe
  C:\Windows\System\wQtKksi.exe
  2⤵
  PID:8848
- C:\Windows\System\FqurERC.exe
  C:\Windows\System\FqurERC.exe
  2⤵
  PID:8864
- C:\Windows\System\UPeMlKD.exe
  C:\Windows\System\UPeMlKD.exe
  2⤵
  PID:8880
- C:\Windows\System\atGpuNW.exe
  C:\Windows\System\atGpuNW.exe
  2⤵
  PID:8896
- C:\Windows\System\XhMfVGm.exe
  C:\Windows\System\XhMfVGm.exe
  2⤵
  PID:8912
- C:\Windows\System\fSanlSM.exe
  C:\Windows\System\fSanlSM.exe
  2⤵
  PID:8928
- C:\Windows\System\rwFLYgN.exe
  C:\Windows\System\rwFLYgN.exe
  2⤵
  PID:8948
- C:\Windows\System\CrsRnHU.exe
  C:\Windows\System\CrsRnHU.exe
  2⤵
  PID:8964
- C:\Windows\System\NBRpbJV.exe
  C:\Windows\System\NBRpbJV.exe
  2⤵
  PID:8984
- C:\Windows\System\jGgtrvd.exe
  C:\Windows\System\jGgtrvd.exe
  2⤵
  PID:9000
- C:\Windows\System\YvFsvTG.exe
  C:\Windows\System\YvFsvTG.exe
  2⤵
  PID:9016
- C:\Windows\System\AOiBqoA.exe
  C:\Windows\System\AOiBqoA.exe
  2⤵
  PID:9036
- C:\Windows\System\ghtQtbx.exe
  C:\Windows\System\ghtQtbx.exe
  2⤵
  PID:9052
- C:\Windows\System\SxHWCwj.exe
  C:\Windows\System\SxHWCwj.exe
  2⤵
  PID:9068
- C:\Windows\System\pYJQxHT.exe
  C:\Windows\System\pYJQxHT.exe
  2⤵
  PID:9088
- C:\Windows\System\zTRaexI.exe
  C:\Windows\System\zTRaexI.exe
  2⤵
  PID:9104
- C:\Windows\System\DLQjJGP.exe
  C:\Windows\System\DLQjJGP.exe
  2⤵
  PID:9120
- C:\Windows\System\ZbbyxSr.exe
  C:\Windows\System\ZbbyxSr.exe
  2⤵
  PID:9136
- C:\Windows\System\SRUTJqA.exe
  C:\Windows\System\SRUTJqA.exe
  2⤵
  PID:9152
- C:\Windows\System\yMgbrHp.exe
  C:\Windows\System\yMgbrHp.exe
  2⤵
  PID:9172
- C:\Windows\System\vtGUXxY.exe
  C:\Windows\System\vtGUXxY.exe
  2⤵
  PID:9188
- C:\Windows\System\bCvBkqO.exe
  C:\Windows\System\bCvBkqO.exe
  2⤵
  PID:9204
- C:\Windows\System\BGIKvGp.exe
  C:\Windows\System\BGIKvGp.exe
  2⤵
  PID:8208
- C:\Windows\System\AumUYcX.exe
  C:\Windows\System\AumUYcX.exe
  2⤵
  PID:8272
- C:\Windows\System\qQwOqKq.exe
  C:\Windows\System\qQwOqKq.exe
  2⤵
  PID:8332
- C:\Windows\System\kfzSiet.exe
  C:\Windows\System\kfzSiet.exe
  2⤵
  PID:8396
- C:\Windows\System\LOQVUnD.exe
  C:\Windows\System\LOQVUnD.exe
  2⤵
  PID:7344
- C:\Windows\System\VxmAXIE.exe
  C:\Windows\System\VxmAXIE.exe
  2⤵
  PID:8460
- C:\Windows\System\cLINOfw.exe
  C:\Windows\System\cLINOfw.exe
  2⤵
  PID:8528
- C:\Windows\System\asbPqRp.exe
  C:\Windows\System\asbPqRp.exe
  2⤵
  PID:8252
- C:\Windows\System\CPnBERJ.exe
  C:\Windows\System\CPnBERJ.exe
  2⤵
  PID:7096
- C:\Windows\System\ZXOIojA.exe
  C:\Windows\System\ZXOIojA.exe
  2⤵
  PID:8284
- C:\Windows\System\PYrBeAb.exe
  C:\Windows\System\PYrBeAb.exe
  2⤵
  PID:8596
- C:\Windows\System\MvfdPPO.exe
  C:\Windows\System\MvfdPPO.exe
  2⤵
  PID:8320
- C:\Windows\System\eCrZsFn.exe
  C:\Windows\System\eCrZsFn.exe
  2⤵
  PID:8384
- C:\Windows\System\SyieeGs.exe
  C:\Windows\System\SyieeGs.exe
  2⤵
  PID:8516
- C:\Windows\System\iGYwoiX.exe
  C:\Windows\System\iGYwoiX.exe
  2⤵
  PID:7324
- C:\Windows\System\vpUgrlh.exe
  C:\Windows\System\vpUgrlh.exe
  2⤵
  PID:8288
- C:\Windows\System\cvVEvTe.exe
  C:\Windows\System\cvVEvTe.exe
  2⤵
  PID:8444
- C:\Windows\System\BtDqwsT.exe
  C:\Windows\System\BtDqwsT.exe
  2⤵
  PID:8548
- C:\Windows\System\ScXJkuI.exe
  C:\Windows\System\ScXJkuI.exe
  2⤵
  PID:8612
- C:\Windows\System\ycETytt.exe
  C:\Windows\System\ycETytt.exe
  2⤵
  PID:8676
- C:\Windows\System\AFLkTXt.exe
  C:\Windows\System\AFLkTXt.exe
  2⤵
  PID:8760
- C:\Windows\System\iHFItRC.exe
  C:\Windows\System\iHFItRC.exe
  2⤵
  PID:8824
- C:\Windows\System\CqJXmUu.exe
  C:\Windows\System\CqJXmUu.exe
  2⤵
  PID:8888
- C:\Windows\System\kzXjIdA.exe
  C:\Windows\System\kzXjIdA.exe
  2⤵
  PID:8956
- C:\Windows\System\SbiZRKJ.exe
  C:\Windows\System\SbiZRKJ.exe
  2⤵
  PID:9024
- C:\Windows\System\TPoVHhg.exe
  C:\Windows\System\TPoVHhg.exe
  2⤵
  PID:9060
- C:\Windows\System\yvaCQAm.exe
  C:\Windows\System\yvaCQAm.exe
  2⤵
  PID:9160
- C:\Windows\System\hwZkWKG.exe
  C:\Windows\System\hwZkWKG.exe
  2⤵
  PID:9200
- C:\Windows\System\rSPajjX.exe
  C:\Windows\System\rSPajjX.exe
  2⤵
  PID:8364
- C:\Windows\System\MZNhaTL.exe
  C:\Windows\System\MZNhaTL.exe
  2⤵
  PID:7844
- C:\Windows\System\hZvLqoY.exe
  C:\Windows\System\hZvLqoY.exe
  2⤵
  PID:8220
- C:\Windows\System\xftHMHI.exe
  C:\Windows\System\xftHMHI.exe
  2⤵
  PID:8748
- C:\Windows\System\itVogHp.exe
  C:\Windows\System\itVogHp.exe
  2⤵
  PID:8808
- C:\Windows\System\LYjwVUb.exe
  C:\Windows\System\LYjwVUb.exe
  2⤵
  PID:8876
- C:\Windows\System\ZUoIdPq.exe
  C:\Windows\System\ZUoIdPq.exe
  2⤵
  PID:8940
- C:\Windows\System\eYyQwbZ.exe
  C:\Windows\System\eYyQwbZ.exe
  2⤵
  PID:8980
- C:\Windows\System\wixaNNH.exe
  C:\Windows\System\wixaNNH.exe
  2⤵
  PID:9076
- C:\Windows\System\qFLKkTr.exe
  C:\Windows\System\qFLKkTr.exe
  2⤵
  PID:9116
- C:\Windows\System\AuJVuJg.exe
  C:\Windows\System\AuJVuJg.exe
  2⤵
  PID:9184
- C:\Windows\System\NrhjWxH.exe
  C:\Windows\System\NrhjWxH.exe
  2⤵
  PID:8304
- C:\Windows\System\wbkcSIC.exe
  C:\Windows\System\wbkcSIC.exe
  2⤵
  PID:8224
- C:\Windows\System\PfyaPuG.exe
  C:\Windows\System\PfyaPuG.exe
  2⤵
  PID:8568
- C:\Windows\System\Diheqzt.exe
  C:\Windows\System\Diheqzt.exe
  2⤵
  PID:7440
- C:\Windows\System\hnBncJD.exe
  C:\Windows\System\hnBncJD.exe
  2⤵
  PID:8580
- C:\Windows\System\ZEBcoik.exe
  C:\Windows\System\ZEBcoik.exe
  2⤵
  PID:8512
- C:\Windows\System\buabhfv.exe
  C:\Windows\System\buabhfv.exe
  2⤵
  PID:8712
- C:\Windows\System\zwJDbEe.exe
  C:\Windows\System\zwJDbEe.exe
  2⤵
  PID:8920
- C:\Windows\System\ygBjYTj.exe
  C:\Windows\System\ygBjYTj.exe
  2⤵
  PID:9096
- C:\Windows\System\OsieImg.exe
  C:\Windows\System\OsieImg.exe
  2⤵
  PID:7552
- C:\Windows\System\KwaCTok.exe
  C:\Windows\System\KwaCTok.exe
  2⤵
  PID:8740
- C:\Windows\System\dZjWuUk.exe
  C:\Windows\System\dZjWuUk.exe
  2⤵
  PID:8976
- C:\Windows\System\VrEAqqJ.exe
  C:\Windows\System\VrEAqqJ.exe
  2⤵
  PID:8628
- C:\Windows\System\pyFNoJp.exe
  C:\Windows\System\pyFNoJp.exe
  2⤵
  PID:7964
- C:\Windows\System\DEVTrTf.exe
  C:\Windows\System\DEVTrTf.exe
  2⤵
  PID:8048
- C:\Windows\System\jVsGGJd.exe
  C:\Windows\System\jVsGGJd.exe
  2⤵
  PID:9044
- C:\Windows\System\XMkRkjS.exe
  C:\Windows\System\XMkRkjS.exe
  2⤵
  PID:8564
- C:\Windows\System\BPSRDQj.exe
  C:\Windows\System\BPSRDQj.exe
  2⤵
  PID:8860
- C:\Windows\System\KESPKRh.exe
  C:\Windows\System\KESPKRh.exe
  2⤵
  PID:7724
- C:\Windows\System\MHJrWJr.exe
  C:\Windows\System\MHJrWJr.exe
  2⤵
  PID:8268
- C:\Windows\System\WmOhveJ.exe
  C:\Windows\System\WmOhveJ.exe
  2⤵
  PID:8492
- C:\Windows\System\kVfBesm.exe
  C:\Windows\System\kVfBesm.exe
  2⤵
  PID:8724
- C:\Windows\System\OMqKhyp.exe
  C:\Windows\System\OMqKhyp.exe
  2⤵
  PID:8380
- C:\Windows\System\PVSsFTo.exe
  C:\Windows\System\PVSsFTo.exe
  2⤵
  PID:8204
- C:\Windows\System\jnqulxy.exe
  C:\Windows\System\jnqulxy.exe
  2⤵
  PID:6720
- C:\Windows\System\AIKtlIN.exe
  C:\Windows\System\AIKtlIN.exe
  2⤵
  PID:8696
- C:\Windows\System\OUyELIO.exe
  C:\Windows\System\OUyELIO.exe
  2⤵
  PID:8100
- C:\Windows\System\wjMIEro.exe
  C:\Windows\System\wjMIEro.exe
  2⤵
  PID:8664
- C:\Windows\System\DEmoNxM.exe
  C:\Windows\System\DEmoNxM.exe
  2⤵
  PID:9328
- C:\Windows\System\IbbuEaq.exe
  C:\Windows\System\IbbuEaq.exe
  2⤵
  PID:9344
- C:\Windows\System\gvJkkRn.exe
  C:\Windows\System\gvJkkRn.exe
  2⤵
  PID:9360
- C:\Windows\System\fdzEYel.exe
  C:\Windows\System\fdzEYel.exe
  2⤵
  PID:9380
- C:\Windows\System\vHvrJZw.exe
  C:\Windows\System\vHvrJZw.exe
  2⤵
  PID:9400
- C:\Windows\System\auzwrUG.exe
  C:\Windows\System\auzwrUG.exe
  2⤵
  PID:9420
- C:\Windows\System\nFRhjDo.exe
  C:\Windows\System\nFRhjDo.exe
  2⤵
  PID:9440
- C:\Windows\System\YRLMfuL.exe
  C:\Windows\System\YRLMfuL.exe
  2⤵
  PID:9456
- C:\Windows\System\gZYBAVm.exe
  C:\Windows\System\gZYBAVm.exe
  2⤵
  PID:9512
- C:\Windows\System\GikSzdn.exe
  C:\Windows\System\GikSzdn.exe
  2⤵
  PID:9528
- C:\Windows\System\bQQslJA.exe
  C:\Windows\System\bQQslJA.exe
  2⤵
  PID:9544
- C:\Windows\System\niwxAij.exe
  C:\Windows\System\niwxAij.exe
  2⤵
  PID:9560
- C:\Windows\System\TDbtptQ.exe
  C:\Windows\System\TDbtptQ.exe
  2⤵
  PID:9576
- C:\Windows\System\CjpwMTQ.exe
  C:\Windows\System\CjpwMTQ.exe
  2⤵
  PID:9592
- C:\Windows\System\giDXYaV.exe
  C:\Windows\System\giDXYaV.exe
  2⤵
  PID:9608
- C:\Windows\System\mFYHTXO.exe
  C:\Windows\System\mFYHTXO.exe
  2⤵
  PID:9624
- C:\Windows\System\uIkUYwi.exe
  C:\Windows\System\uIkUYwi.exe
  2⤵
  PID:9640
- C:\Windows\System\nGaCSkt.exe
  C:\Windows\System\nGaCSkt.exe
  2⤵
  PID:9656
- C:\Windows\System\bkcFVTi.exe
  C:\Windows\System\bkcFVTi.exe
  2⤵
  PID:9672
- C:\Windows\System\ztOMGSU.exe
  C:\Windows\System\ztOMGSU.exe
  2⤵
  PID:9688
- C:\Windows\System\PtNmCkN.exe
  C:\Windows\System\PtNmCkN.exe
  2⤵
  PID:9704
- C:\Windows\System\owvNDlP.exe
  C:\Windows\System\owvNDlP.exe
  2⤵
  PID:9720
- C:\Windows\System\PNZoPPl.exe
  C:\Windows\System\PNZoPPl.exe
  2⤵
  PID:9736
- C:\Windows\System\tSjmDfo.exe
  C:\Windows\System\tSjmDfo.exe
  2⤵
  PID:9752
- C:\Windows\System\OvSskkT.exe
  C:\Windows\System\OvSskkT.exe
  2⤵
  PID:9768
- C:\Windows\System\XpvEANv.exe
  C:\Windows\System\XpvEANv.exe
  2⤵
  PID:9784
- C:\Windows\System\YiSVssu.exe
  C:\Windows\System\YiSVssu.exe
  2⤵
  PID:9800
- C:\Windows\System\NQGNmQz.exe
  C:\Windows\System\NQGNmQz.exe
  2⤵
  PID:9816
- C:\Windows\System\OlDDExo.exe
  C:\Windows\System\OlDDExo.exe
  2⤵
  PID:9832
- C:\Windows\System\afpwfvo.exe
  C:\Windows\System\afpwfvo.exe
  2⤵
  PID:9848
- C:\Windows\System\YSckoAD.exe
  C:\Windows\System\YSckoAD.exe
  2⤵
  PID:9864
- C:\Windows\System\EfjDoSn.exe
  C:\Windows\System\EfjDoSn.exe
  2⤵
  PID:9880
- C:\Windows\System\qkgsaRe.exe
  C:\Windows\System\qkgsaRe.exe
  2⤵
  PID:9896
- C:\Windows\System\eZCIjeS.exe
  C:\Windows\System\eZCIjeS.exe
  2⤵
  PID:9916
- C:\Windows\System\DzSeUUn.exe
  C:\Windows\System\DzSeUUn.exe
  2⤵
  PID:9932
- C:\Windows\System\OAuwMBf.exe
  C:\Windows\System\OAuwMBf.exe
  2⤵
  PID:9948
- C:\Windows\System\osPvRCw.exe
  C:\Windows\System\osPvRCw.exe
  2⤵
  PID:9964
- C:\Windows\System\iNEjoKs.exe
  C:\Windows\System\iNEjoKs.exe
  2⤵
  PID:9980
- C:\Windows\System\GmltMYz.exe
  C:\Windows\System\GmltMYz.exe
  2⤵
  PID:9996
- C:\Windows\System\addEtUu.exe
  C:\Windows\System\addEtUu.exe
  2⤵
  PID:10012
- C:\Windows\System\sBsMyxP.exe
  C:\Windows\System\sBsMyxP.exe
  2⤵
  PID:10028
- C:\Windows\System\AkwlQbC.exe
  C:\Windows\System\AkwlQbC.exe
  2⤵
  PID:10044
- C:\Windows\System\gguSksD.exe
  C:\Windows\System\gguSksD.exe
  2⤵
  PID:10060
- C:\Windows\System\hGNzkHj.exe
  C:\Windows\System\hGNzkHj.exe
  2⤵
  PID:10076
- C:\Windows\System\aciPMaf.exe
  C:\Windows\System\aciPMaf.exe
  2⤵
  PID:10092
- C:\Windows\System\UZAvesK.exe
  C:\Windows\System\UZAvesK.exe
  2⤵
  PID:10108
- C:\Windows\System\zogDTSs.exe
  C:\Windows\System\zogDTSs.exe
  2⤵
  PID:10124
- C:\Windows\System\ViyFOLq.exe
  C:\Windows\System\ViyFOLq.exe
  2⤵
  PID:10140
- C:\Windows\System\DZgNTxn.exe
  C:\Windows\System\DZgNTxn.exe
  2⤵
  PID:10156
- C:\Windows\System\IJTNcIF.exe
  C:\Windows\System\IJTNcIF.exe
  2⤵
  PID:10172
- C:\Windows\System\mDSHdQB.exe
  C:\Windows\System\mDSHdQB.exe
  2⤵
  PID:10188
- C:\Windows\System\zfeHqbW.exe
  C:\Windows\System\zfeHqbW.exe
  2⤵
  PID:10204
- C:\Windows\System\NPnICPW.exe
  C:\Windows\System\NPnICPW.exe
  2⤵
  PID:10220
- C:\Windows\System\pDscHTf.exe
  C:\Windows\System\pDscHTf.exe
  2⤵
  PID:10236
- C:\Windows\System\qryMQhn.exe
  C:\Windows\System\qryMQhn.exe
  2⤵
  PID:8840
- C:\Windows\System\gIzKnHK.exe
  C:\Windows\System\gIzKnHK.exe
  2⤵
  PID:8316
- C:\Windows\System\WJOeKBt.exe
  C:\Windows\System\WJOeKBt.exe
  2⤵
  PID:8812
- C:\Windows\System\jvdfSiY.exe
  C:\Windows\System\jvdfSiY.exe
  2⤵
  PID:8480
- C:\Windows\System\WFQPMND.exe
  C:\Windows\System\WFQPMND.exe
  2⤵
  PID:9240
- C:\Windows\System\sNpwPvj.exe
  C:\Windows\System\sNpwPvj.exe
  2⤵
  PID:9256
- C:\Windows\System\xPQsbKP.exe
  C:\Windows\System\xPQsbKP.exe
  2⤵
  PID:9276
- C:\Windows\System\DugdFNX.exe
  C:\Windows\System\DugdFNX.exe
  2⤵
  PID:8092
- C:\Windows\System\CRNsRtk.exe
  C:\Windows\System\CRNsRtk.exe
  2⤵
  PID:9300
- C:\Windows\System\zYBBgcB.exe
  C:\Windows\System\zYBBgcB.exe
  2⤵
  PID:9316
- C:\Windows\System\hvlnKae.exe
  C:\Windows\System\hvlnKae.exe
  2⤵
  PID:9368
- C:\Windows\System\OTwaAFF.exe
  C:\Windows\System\OTwaAFF.exe
  2⤵
  PID:9408
- C:\Windows\System\HHYvaaU.exe
  C:\Windows\System\HHYvaaU.exe
  2⤵
  PID:9480
- C:\Windows\System\PfxDJGm.exe
  C:\Windows\System\PfxDJGm.exe
  2⤵
  PID:9432
- C:\Windows\System\pcCzsWw.exe
  C:\Windows\System\pcCzsWw.exe
  2⤵
  PID:9484
- C:\Windows\System\aKXqoyV.exe
  C:\Windows\System\aKXqoyV.exe
  2⤵
  PID:9428
- C:\Windows\System\mewnazp.exe
  C:\Windows\System\mewnazp.exe
  2⤵
  PID:9492
- C:\Windows\System\xysxJPV.exe
  C:\Windows\System\xysxJPV.exe
  2⤵
  PID:8352
- C:\Windows\System\vwuIeeR.exe
  C:\Windows\System\vwuIeeR.exe
  2⤵
  PID:9568
- C:\Windows\System\LtgGynj.exe
  C:\Windows\System\LtgGynj.exe
  2⤵
  PID:9632
- C:\Windows\System\nmOZWUL.exe
  C:\Windows\System\nmOZWUL.exe
  2⤵
  PID:9668
- C:\Windows\System\KuroPrQ.exe
  C:\Windows\System\KuroPrQ.exe
  2⤵
  PID:9732
- C:\Windows\System\cFYDWqM.exe
  C:\Windows\System\cFYDWqM.exe
  2⤵
  PID:9584
- C:\Windows\System\QlxOvNN.exe
  C:\Windows\System\QlxOvNN.exe
  2⤵
  PID:9648
- C:\Windows\System\YCtYTQs.exe
  C:\Windows\System\YCtYTQs.exe
  2⤵
  PID:9716
- C:\Windows\System\yqRvQzz.exe
  C:\Windows\System\yqRvQzz.exe
  2⤵
  PID:9764
- C:\Windows\System\CsAwPmR.exe
  C:\Windows\System\CsAwPmR.exe
  2⤵
  PID:9828
- C:\Windows\System\KesZMKu.exe
  C:\Windows\System\KesZMKu.exe
  2⤵
  PID:9924
- C:\Windows\System\IypwuYl.exe
  C:\Windows\System\IypwuYl.exe
  2⤵
  PID:9956
- C:\Windows\System\qXhKmxA.exe
  C:\Windows\System\qXhKmxA.exe
  2⤵
  PID:9780
- C:\Windows\System\ELdhYYH.exe
  C:\Windows\System\ELdhYYH.exe
  2⤵
  PID:9844
- C:\Windows\System\CnZLeIT.exe
  C:\Windows\System\CnZLeIT.exe
  2⤵
  PID:9960
- C:\Windows\System\MmQnEyP.exe
  C:\Windows\System\MmQnEyP.exe
  2⤵
  PID:10024
- C:\Windows\System\LiVzrNQ.exe
  C:\Windows\System\LiVzrNQ.exe
  2⤵
  PID:10084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AyxcMSq.exe

Filesize
1.5MB

MD5
157a89d0970e9b4b5825115b56ba2768

SHA1
537745bb24bae396dfac57844965a8d957a987fc

SHA256
2325a35d555baecbc604c48fbda87861e6a7b63acfb080ee1820193baf8f23da

SHA512
9191d2f830dbc87386095ffcea6e7ffbc27e555b7271913e7e6d4eb61e629daf391f22e733be7dbde2149ca0d872d347fb1a0b4e17b2b82c59da172c9c58fd40

Download Submit
C:\Windows\system\CRpkebd.exe

Filesize
1.5MB

MD5
8a5195ac4edb8e20cb623910a72a0b64

SHA1
66bb8f685b05f5a6c0c3be001764babe06d68116

SHA256
3517444e022b678e5f61d9c7cab9d91845df0a457ad76c98f49fed96cbea98ae

SHA512
cdbe296578160f5332645c55ffb476e346164b132a041d95f51d07f774c19bd17e8253deda32696ea700f81a64db507c9279d25429cb78a7956ad5984d55778e

Download Submit
C:\Windows\system\FFSGMAE.exe

Filesize
1.5MB

MD5
b15963f5a816c4cf735414110155513c

SHA1
f91c1120660e4f7d5d986d139fca16e4be92af81

SHA256
579b2e76511708b246cb62978a84853fcb5adbc65860efcf0e15bd245dc09efa

SHA512
a600454039782f4949d8f95ac62fb6631042fd95379237cee3d6b2ba79d2e42c66c77412a4e171867b9ab55f141530fde09846e9eca6891a7424d50ab442b2ec

Download Submit
C:\Windows\system\GTAqwSL.exe

Filesize
1.6MB

MD5
4102e1682e67f0b6805f596d3e11056f

SHA1
77250752fd879a4884fa4511f6553a336a59e2f7

SHA256
998098692b1409ba5ffd2054f3bfd51d828810a39805884e60c5d77fb8f023ec

SHA512
596ca4a7cf4824e48c5143ccfb9f134f58365865a8660c5680672d7a8af4dec929e76b06c4d1feca9ef646ae7ab0d79e89e890095d51a237e97323cd36de21a6

Download Submit
C:\Windows\system\GuLMzao.exe

Filesize
1.6MB

MD5
c39a762e55ed74c2c921932470722905

SHA1
c8d3d848127d4be9ac5a895c3f4bf0f2e349cc8e

SHA256
6a44072bbfb5f81feb506ce46d96efd5a91ed0fc3078e4d3516dde4ee5f7b796

SHA512
c42c0dfe0c3672a8ea87dcfff9580a3ad285189b4bc8e37d245d0b06279f9fae3427f98568f1a45aa50a094a05b35a0e3f741a402eaf88d0c5d5e638501d8d9c

Download Submit
C:\Windows\system\HzbsEsG.exe

Filesize
1.5MB

MD5
da11e6113e3b0c453ec1289af4690f0c

SHA1
4f46ca20a582d139e07e40231fa01928b4c8ef26

SHA256
361b4644e91061dc470babd65707920fb0a49b40f83a01294a02a871a61f7dcc

SHA512
c67ffc897cf0d719038d41dabcc640a34edfc6d7e8bc847af50a2c979ef3e85453841aba94b2c15e5954a7d3df3b40708fa7c29e0b0d188ade0d30bad4eda760

Download Submit
C:\Windows\system\KmpWhBO.exe

Filesize
1.6MB

MD5
62763c751815d6bd1a69215812c6523f

SHA1
b84ed827ca9c470f13243b4a59500590b6c105b9

SHA256
30c5110f328345c92b5223c8755ef4daa7dfb358164e7a0b23369ade6a8cdfd6

SHA512
b16708cfef6dc6062321d7e0030f5ceeaa75056eabe01457e6e9cd3f3c381a24e2c31653481b0cce7a8ba611f807d4cd6aa305fe3539165cc88568d73a04531e

Download Submit
C:\Windows\system\NNYrzfh.exe

Filesize
1.6MB

MD5
f5fb83140632bcf6db78bc126b7abee6

SHA1
356746ff482df44c3683637c251c2177257c7574

SHA256
e1e39f60b8d7f9be2c72047da7ce46c423303cefb60942794d5f7d4fd8594632

SHA512
6903cf49c2a968b82aacf32ee2e9a896cfc24281c5ebd6cbc49d82709d2696a45386f1adf6e39a64b3374ca68895e3e50c9f7c6ff5c26f2447e10fd26bd14736

Download Submit
C:\Windows\system\OZZCeYu.exe

Filesize
1.5MB

MD5
f40785279035bb4836a975aba2f38aa8

SHA1
110a78922d24b09364a6020dfd1c8808cb564cb4

SHA256
4dbd87c559f8f01bcf988c63dfda2f9162dbc1f27494fd1f69df8e9e936fd169

SHA512
be63940893a64b9d089ad550422dc3aff883d2db29806ff1221b3e1d6ad6e51d082b7929ff969102fac84133d2edafb9a10f38839f178c7a1f1e9b56009fe70c

Download Submit
C:\Windows\system\SBzJxbt.exe

Filesize
1.5MB

MD5
c9f403fe9a8278211dbe9c161176bc15

SHA1
9238f34d07f37b177cb684c4e5b62994f8e02485

SHA256
b7b3037c1a1f0267beb98c846ae60f4be419f64e4b52c3657e6b7f96c09c43e7

SHA512
9e5ec1a0e92a09b7495e3111b9cd7c9d969a4c6197eed4af70334967114bfd817e75c40319a002fb96c659d9788d0ec22841cc6c4c013550ffdc2f76de69c1e6

Download Submit
C:\Windows\system\SNYnIvI.exe

Filesize
1.5MB

MD5
62b107dff56ef1e7ed90206636edc4e5

SHA1
93315b357699459194fbcb17a6c18107f9c8f125

SHA256
bb4a0ccc5217d550dec73e66c75c2a37c7251234cdde3ba496cda2ccc20a4938

SHA512
7e5cf4b55715e2e0cacd8fd510864c6711bdf666e2a9beeab1b8b5d9fdba1dd4e470fa2794296196cf540b85f203cdb82567ff81c6af9715812d814db3108028

Download Submit
C:\Windows\system\VgKdMxo.exe

Filesize
1.5MB

MD5
c5e51d2dd62d61f6ebc5b531e729720e

SHA1
ab38fc0f658610298c45bbc9a6673fe7504c1097

SHA256
a931d09f462edddd49016486118b880f37cea1ed149c29d699ba96cf72a6b18f

SHA512
b0108de08cc8408050c75208441946466a4a8d5344ef354a00b4d30efd360361fdaad8e6a1f779c51c6807c7886cab5270f33317c31da9086df80a24bd2b6f16

Download Submit
C:\Windows\system\cutlmrM.exe

Filesize
1.5MB

MD5
dbe6da714ff4edaf6f6b14780dfd331b

SHA1
6e5b8dda18e05a01bc35e2c49d40b956365d6d9c

SHA256
0352aec9b3f87c8f3e6c3c7a846b4110e1ba28f683a40ec672ec0a403d6a7109

SHA512
efe5a04902ff133e35ac55cff33f2ca42bd27e2d6b0924fb7ce8c99313da35c17ac007ef097bfcb0578fdae8ae1921807fbf0789bc179f26ee4383d56eec00fc

Download Submit
C:\Windows\system\dNdesfB.exe

Filesize
1.6MB

MD5
5fe6f7625187ffc5dba5dbe750bf2dbd

SHA1
8016a27199c724b0c78a8522d76ba4b1df641ff2

SHA256
f7cda595dd216c157c5e4ea5bc8827a8c7b84b8a8ec0c6bf854fa886f03fa1d9

SHA512
f4835bb4614e939ecafd971006f893589060ce137712702a35544d6eeb6ed922464a140dfd0f910b99eff4328a16276b9ece65d13bde9512f3679346c1d8728f

Download Submit
C:\Windows\system\kkqIhWw.exe

Filesize
1.5MB

MD5
71143a19de8e4de26753a7984dffa73c

SHA1
6a5a3e6e08a69303245072a5ec29a778c7851c46

SHA256
2f90f406384406d3b1d273c84b3921bbef5b54737b86ef471362ef352c0d11af

SHA512
31eca3b581b7729bd0a5cd84ba2d0eee2d7a902aa47131991aab7946b68e1d6ab6dafa9eed1c2cf1ea50d533a4124c10d3872b5fcf587911f3e520f05ca2e98a

Download Submit
C:\Windows\system\kmUdGrs.exe

Filesize
1.5MB

MD5
a6cd8adcfd5e2369df7c48cd03de4856

SHA1
afd1f5ed66d374ea8959725d517d8f5bc017a1c7

SHA256
65d99a379ebc7a53036dae090a503c2788a99c6441080e3a330ba099675da4f7

SHA512
4712d7cc910f11c87aa44bffbac20b98050a265b67633106acc7797d144ab3c57064c917dcdf0bf579b1a6d6d9c58f87621bd5166497b097f7f6965ae4d7703c

Download Submit
C:\Windows\system\lyWNGxn.exe

Filesize
1.5MB

MD5
ff0ef54374cf804802071024d72aed5e

SHA1
9060e3a8341723778fd2b7c703fdc599cf061c54

SHA256
fdcc8f830f1a2d01a7a646153c2134a6b6f5db06c2696b4440241ee7077193c2

SHA512
9d6b163570c800970828a2862e0d3de3a1ce1dfde9958ddc90bcc13130934f2902915295ed7d2d5c127ff936e5e6ccde7feb4d825641cc5951178d0743b167ef

Download Submit
C:\Windows\system\pjTsdOH.exe

Filesize
1.5MB

MD5
18de2f834115500969eb545bcd0453df

SHA1
9d7cff59c33185c5a86a7a50fffd4a189b77ed2f

SHA256
bf86bc8a98944d0a1d698ffd00db76f4ecd8ebaff475ed0003c2d7b8871757bd

SHA512
ea783bd95fba4327c998593fe08d93debf96ba395c05968aaf35eb6d26252a8277ab2a6285a5099b31864f0164c36c10d503f3f54f38a5263ec38b89bb536f0f

Download Submit
C:\Windows\system\snUiYfd.exe

Filesize
1.5MB

MD5
e2e81a2b45b164bc712d7f312723bbbf

SHA1
8ebd2e3a3579e2ffc6c1637abd10f9cbf9c9c6d5

SHA256
e305dd3e57e16a3d58b582da9358dfd31a874e3dce6ca1f52d0137040d6270bd

SHA512
a491123bc5d08fd471253e67be0c169c8a75d09b3f81d46ba4c9a8863ae3e9ad4b0b624bc3419eff28999ba5b2949d5f87653cd69898517dcadf264a41cf915a

Download Submit
C:\Windows\system\tTQutuI.exe

Filesize
1.5MB

MD5
8208e33d0263d4750ef9f75b8798ae71

SHA1
ba2f5b9ed07fd6e97e3b679d37ced195745ae121

SHA256
52c3375f49fda5baaa5c39b79f1989fd970121786156f86dccf4f7844f1d0cb4

SHA512
efbb01972501f6fc7973e96347ce1993caff6aa93e4ee6c82da96727e127169e8c03873bedbd8eccad449f74fdd9ec082a4749af000bf8a4067db30ef2aa221f

Download Submit
C:\Windows\system\tWHNOSd.exe

Filesize
1.6MB

MD5
b2f5021a7df81a0bd41a6d329cd644e1

SHA1
649e8e439627b147dd00c3a931287054a6a4b963

SHA256
e021e51df35df04b96ddae2be7d5fda9851105abdd462a868c721c4f4e8c7f43

SHA512
6d186d634b19cfbfb25693a525e7744b17d94178d87f879461d7c537b195041f9c9e9f92ca9e1cd62bc4fd57691c82bc49939bd532863bc59f508350f0625241

Download Submit
C:\Windows\system\uEnZAqp.exe

Filesize
1.5MB

MD5
31141be11c1275cd08ec2c25e2a083d8

SHA1
05e1994a37e611beea5af073359ad5ff132eb087

SHA256
39aa56181a173f2d3417e789c25cff407ee6206c49fbb2cab3d45b2a16db00e0

SHA512
d0c506189f69be873251786f94eb2925c47a64f43572bc610bf6efe19bfb19f5f066ed5ed6cc2db9ee8a7eca6238409a180e35aec5c75958ee1e1ce96effdaf2

Download Submit
\Windows\system\AItwFTB.exe

Filesize
1.5MB

MD5
6dac284cdf17a3bd443587bd04c94880

SHA1
4585daca08f3d97e1c85c62936192df520e4747f

SHA256
4ad8ce8a78d8e1fc6d42c7ffe1c65d70b22b5c97dc370916ea6a8e3cd9ed2536

SHA512
ca5b8e34829d95f8db5a3eafc3710cd46ed463ceb7c7d013e7dbb652cf471a6189ba3a829251b25e36f68cb57ffadc8166ca17c94f387bfb0717ddfac82266e0

Download Submit
\Windows\system\ElIwVAM.exe

Filesize
1.6MB

MD5
252d79321572c6785bff5e4691899e42

SHA1
1b9d07d10204ac3c503c6f2c118b65313a6b9dfd

SHA256
665d8647bde70f8a0daf556149383d8b566d57d1a4eafefd7a466862537291e4

SHA512
3c7e1afb5dc4291056700f58dafa6ca821293602c3a956da98460f6cb5a32849b4c408dd567bcb7d55e55616fbb8f3e8a005f793ab0653520ef74aae6c0ddc62

Download Submit
\Windows\system\RtxploK.exe

Filesize
1.5MB

MD5
938ab2549d79dc153eaf4ae3aea80225

SHA1
ddfbb51ae68966bc89d884f2a31bc1f25c000306

SHA256
549abf26361525f3738d19e0b693097fc90285638579172c4e231cd55f06646c

SHA512
d072dc0563666a7c5d446411ad569c4e504e27a400af22c7a351bf9abba2b5654d8ea909fc9f6fd8ac2f0515c4437d72a82e70be759ce7cafb4c7d596cfd575a

Download Submit
\Windows\system\SWyRbzs.exe

Filesize
1.5MB

MD5
e3bf0756d756db9e168b0678d688bf25

SHA1
5d170cb57f949638c5b4ab6c93c651d580566d7b

SHA256
bf98ea7e4696378f086da2329d3fc9c37474875fa35c7aaa54b0ee7af91a2992

SHA512
ab020ff6bf484cd61629a8c3632898a2971e94289136270fd61f3b921a435e21aa622991b948d4742199598bd85767026d68f21a68e10cf22adcfbe73823a8fa

Download Submit
\Windows\system\XjlOiAY.exe

Filesize
1.6MB

MD5
c5b31aec21c4162cdc22f14e35023598

SHA1
d2da3b3dcc0f6e3a62439523cda94d4901741bd1

SHA256
df1494e85b411d507bdf5e110319c89f805d4935e6720bd95b96035905641a85

SHA512
da438540b22e9b1557ff54a83878b1ae28351169211000488f3498e9325e83f3b6a145ec0927be8e2af7fb574a664388eb84c089dfb5a20e051f2de6f58a4ddd

Download Submit
\Windows\system\YJjgWxu.exe

Filesize
1.5MB

MD5
2d183190f18516956a70f1f07fcccd9b

SHA1
60023de5d4f477d4c71083f51839b6cf7e5edf1b

SHA256
5c2168da31663885ab1ed69ad924413517840a9112f75a636dcf35f138303fdf

SHA512
6d00dcfae784dcf9622c1fd557d062b7884e2caf69a08c97a1eee1f6422cfb1c05f8130753581a152ac447d3fdabd17f7fdf4c588149b50e4fb771f25dbd3ba3

Download Submit
\Windows\system\lXJmPcC.exe

Filesize
1.5MB

MD5
e9b50edc40667cc258c9aee3bb092843

SHA1
144e03678b27b134d1690276dabc8ec98a3e084d

SHA256
1209b44e09a0776c8f7826e0b980dade9ffd0015832b2c6a676576d0ef3d4860

SHA512
01ac8c82c9a8729e6ddf6a166132a5405aa9cd3a5d438a83a5287b0defd7ccc1ac2efd521e9f70b6e87b3827945a35b1b7b121aa92ecff6c9118eeea0203aab6

Download Submit
\Windows\system\obiOVsx.exe

Filesize
1.6MB

MD5
625659463a5e470150bb5142893f0d30

SHA1
4609385119280ce1c715edf990dd2ec57d5bc9ec

SHA256
6ead97e235718d8508890ec564eea29d003982095fa4b037501d91105c7fb559

SHA512
7461b26939285f3f95bbf05e39259ec5f0540ba0f462f0a01065838cff97632758e5bdab8bc6ee245f1dc1c763d644d9e2606a860461152ee3d5df0d941acca4

Download Submit
\Windows\system\tvhaMgz.exe

Filesize
1.6MB

MD5
d71a05808bb8ab21e2d91a59ba8f418a

SHA1
b422004b128cad52283b1c3d93e70e09ffb98986

SHA256
5d55e3e0a445a8dc7956afa5f10f75361ba8e8644c4cfd04566eea3a496cb791

SHA512
4b43dc2f0c242da36bede7c23b1181ea9894cfce4764a53dc17f4096e1bcb0a4b3c868cde3b98c2776c9e422ded6bd5895761c26289fce9213db3873cd9805da

Download Submit
\Windows\system\wOFeomi.exe

Filesize
1.6MB

MD5
30df4a19f921426ea3934425cee9e096

SHA1
223b5f4f7a8a05bb50eb948ad1e89a78c743ac37

SHA256
5362ab70496f1aa91be8b8cc46c97086cb5162b1c50f2c4b3e47081b2b7bfe25

SHA512
12bf60a89126519b9fc73726835570e1bebe5a1c49f3aaaf13075d2042d3a50905afeb38b9d0e77513ffc9a1e6302e0b17802142ce2c50b9d38a0421322fafcc

Download Submit
\Windows\system\whMGeXg.exe

Filesize
1.6MB

MD5
82158c8c49267a80fd43e84d3b7b4ea0

SHA1
cfc70e7aed66fb55dfb66e9c9db6444a155de267

SHA256
4eb9b36e88c85d5ada5020f1b9fdde31b92b6f6aafb27dfa1efc565eb37247b6

SHA512
ab339fac2b783f924999e084108785acc1fcb14d3a8b2178271055032effaa028e6acadc2abca503379b6e03059327cfda0ec6820052c5fc705c7f330522da16

Download Submit
memory/2284-138-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2412-157-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2476-156-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2508-47-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/2508-152-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/2508-178-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-118-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-39-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2508-119-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/2508-133-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Filesize
9.6MB

Download
memory/2508-134-0x0000000002080000-0x0000000002100000-memory.dmp

Filesize
512KB

Download
memory/2528-71-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2540-60-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-160-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-155-0x000000013F5B0000-0x000000013F9A2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-66-0x000000013F9F0000-0x000000013FDE2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-154-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-137-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2700-141-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-150-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-151-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-139-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-158-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2700-159-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-43-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-70-0x00000000033D0000-0x00000000037C2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2700-0-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2920-145-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download