xmrig | 701ff6e9b0ca7b6f964d9016631f151c9b0858274277beed1fe5dc779ea311f9

Analysis

max time kernel
22s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03c3f749156d50f755331084ee220448_JaffaCakes118.exe
Size

2.1MB
MD5

03c3f749156d50f755331084ee220448
SHA1

42ebe20b9ccc414410b30c182f67f1548ac89fe1
SHA256

701ff6e9b0ca7b6f964d9016631f151c9b0858274277beed1fe5dc779ea311f9
SHA512

5ef96bc384eaa1dd0207349dfa23303113ce599f3d7c464fb690f0884d1df828f61044d6e6d6f860208053334d76db164e5c2e3bc1f9c7fb0b71114bef54b1d3
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qro:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2656-26-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2464-115-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2868-113-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2624-90-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2932-86-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2996-81-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2096-78-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2932-65-0x0000000003350000-0x0000000003742000-memory.dmp	xmrig
behavioral1/memory/2612-64-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2080-70-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

Processes:

gMIUNDK.exeoiVuEwW.exezMgYnme.exeIBdGOUn.exeJPFGxIR.exeTWHwmRs.exejvqfecw.exeEHNXamk.exerCoDrDe.exeQFupsOX.exeuHTNPbS.exeaPwHyJT.exeHIQozyM.exemmlhxqh.exewFyKANJ.exeEYLLXYe.exetwIBlSy.exeyodCJEV.exedSKcYCG.exemgClCgK.exeawIMlYF.exePELRHeH.exeNeKOtkc.exelbxZFcB.exemronxGf.exehkfeMpE.exeCsspGeT.exeSCyGXlk.exeoQjFvQt.exeCYCPigE.exeDQEnoiz.exewNivopg.exexwAYjFi.exeDsFVMjE.exeqyiszLF.exelWVvPQf.exeBUlipzW.exejFtyZCR.exegNJQSlx.exelriGPQK.exeforiJqt.exeOxIKwwF.exevMfjvfR.exebpHcbuk.exefxJwIfk.exeFCvymAl.exeYNXUbGL.exesIXqCHr.exeSrfGZsb.exeqlkBcnU.exekYcTjFs.exeocMZhdy.exeRyGseTm.exeFHJqczw.exeUhWsAlx.exeaYTvdQN.exezhEPpbg.exeeDBxPGE.exeEJykPHx.exeKwdWWVk.exeMuTRIWm.exehanqkPK.exeONuQfaz.execilREyb.exe

pid	process
2852	gMIUNDK.exe
2656	oiVuEwW.exe
2612	zMgYnme.exe
2868	IBdGOUn.exe
2080	JPFGxIR.exe
2096	TWHwmRs.exe
2996	jvqfecw.exe
2624	EHNXamk.exe
2464	rCoDrDe.exe
2952	QFupsOX.exe
2428	uHTNPbS.exe
2840	aPwHyJT.exe
2552	HIQozyM.exe
1152	mmlhxqh.exe
556	wFyKANJ.exe
2808	EYLLXYe.exe
1928	twIBlSy.exe
1676	yodCJEV.exe
384	dSKcYCG.exe
2436	mgClCgK.exe
2272	awIMlYF.exe
2108	PELRHeH.exe
1040	NeKOtkc.exe
1488	lbxZFcB.exe
1792	mronxGf.exe
412	hkfeMpE.exe
2404	CsspGeT.exe
1552	SCyGXlk.exe
1052	oQjFvQt.exe
1988	CYCPigE.exe
1724	DQEnoiz.exe
2052	wNivopg.exe
1100	xwAYjFi.exe
3060	DsFVMjE.exe
2320	qyiszLF.exe
1232	lWVvPQf.exe
3016	BUlipzW.exe
1516	jFtyZCR.exe
3004	gNJQSlx.exe
2372	lriGPQK.exe
1820	foriJqt.exe
2596	OxIKwwF.exe
2564	vMfjvfR.exe
2620	bpHcbuk.exe
2528	fxJwIfk.exe
2520	FCvymAl.exe
3056	YNXUbGL.exe
2976	sIXqCHr.exe
2120	SrfGZsb.exe
1872	qlkBcnU.exe
1360	kYcTjFs.exe
1760	ocMZhdy.exe
788	RyGseTm.exe
576	FHJqczw.exe
1648	UhWsAlx.exe
2336	aYTvdQN.exe
2420	zhEPpbg.exe
1204	eDBxPGE.exe
620	EJykPHx.exe
2432	KwdWWVk.exe
2744	MuTRIWm.exe
2680	hanqkPK.exe
2580	ONuQfaz.exe
2040	cilREyb.exe

Loads dropped DLL 64 IoCs

Processes:

03c3f749156d50f755331084ee220448_JaffaCakes118.exe

pid	process
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe

UPX packed file 48 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2932-0-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
\Windows\system\gMIUNDK.exe	upx
C:\Windows\system\oiVuEwW.exe	upx
\Windows\system\zMgYnme.exe	upx
C:\Windows\system\IBdGOUn.exe	upx
behavioral1/memory/2656-26-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
C:\Windows\system\JPFGxIR.exe	upx
\Windows\system\TWHwmRs.exe	upx
C:\Windows\system\jvqfecw.exe	upx
\Windows\system\rCoDrDe.exe	upx
C:\Windows\system\EHNXamk.exe	upx
behavioral1/memory/2852-17-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
\Windows\system\QFupsOX.exe	upx
C:\Windows\system\aPwHyJT.exe	upx
C:\Windows\system\mmlhxqh.exe	upx
behavioral1/memory/2464-115-0x000000013F330000-0x000000013F722000-memory.dmp	upx
C:\Windows\system\twIBlSy.exe	upx
\Windows\system\hkfeMpE.exe	upx
\Windows\system\CsspGeT.exe	upx
C:\Windows\system\mronxGf.exe	upx
\Windows\system\eDBxPGE.exe	upx
\Windows\system\zhEPpbg.exe	upx
\Windows\system\aYTvdQN.exe	upx
\Windows\system\UhWsAlx.exe	upx
\Windows\system\FHJqczw.exe	upx
\Windows\system\RyGseTm.exe	upx
\Windows\system\wNivopg.exe	upx
\Windows\system\DQEnoiz.exe	upx
\Windows\system\oQjFvQt.exe	upx
\Windows\system\ocMZhdy.exe	upx
\Windows\system\xwAYjFi.exe	upx
C:\Windows\system\lbxZFcB.exe	upx
C:\Windows\system\NeKOtkc.exe	upx
C:\Windows\system\PELRHeH.exe	upx
C:\Windows\system\awIMlYF.exe	upx
C:\Windows\system\mgClCgK.exe	upx
C:\Windows\system\dSKcYCG.exe	upx
C:\Windows\system\yodCJEV.exe	upx
behavioral1/memory/2868-113-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
C:\Windows\system\EYLLXYe.exe	upx
C:\Windows\system\wFyKANJ.exe	upx
C:\Windows\system\HIQozyM.exe	upx
behavioral1/memory/2624-90-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2996-81-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2096-78-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
C:\Windows\system\uHTNPbS.exe	upx
behavioral1/memory/2612-64-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2080-70-0x000000013FC30000-0x0000000140022000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

Processes:

03c3f749156d50f755331084ee220448_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\System\iyYQbHl.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\nMIbFyp.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\tfFYEJt.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\fhlDvbk.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\vbfDLEF.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\jLNXQmn.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\qvgpmxy.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\FIscmXd.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\ZbHzsHx.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\RfQHQjt.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\FahuaAU.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\UbQJTPX.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\TVMcaBB.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\ocMZhdy.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\kPnmTiN.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\uNoFMuy.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\AGMekEm.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\XEbCVus.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\dzjSCSf.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\pUXYvlz.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\LMLDZod.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\WIymQfX.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\SaNqyFh.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\hEQMgud.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\baYWbYS.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\awIMlYF.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\RyGseTm.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\NeKOtkc.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\ORxfcUi.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\PXuaQfk.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\CUchNJq.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\JSxnMxw.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\UYCvGDc.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\eQUdjTK.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\gdHBIRE.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\RFgxSdB.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\NNanieF.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\HnaWgQS.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\mKPPyRF.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\ujPmxqf.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\qqSxFKx.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\JbzMyjE.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\PuirmoZ.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\IfDYOKe.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\wxQcNmm.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\bfQzxyG.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\tuujtof.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\hTslcRt.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\uTqdZMI.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\JxxDEuA.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\jttxPdf.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\DXHVzMa.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\GIHZwtR.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\SCyGXlk.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\LTjoQak.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\dBdBlIN.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\JmZZdxk.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\NLOjtBq.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\kfdTqBV.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\XcqUXcK.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\nXVjfgJ.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\ENJHkPN.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\nEJoWcu.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
File created	C:\Windows\System\hnafRDf.exe	03c3f749156d50f755331084ee220448_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2988 powershell.exe

pid	process
2988	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

03c3f749156d50f755331084ee220448_JaffaCakes118.exepowershell.exe

description	pid	process
Token: SeLockMemoryPrivilege	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe
Token: SeDebugPrivilege	2988	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

03c3f749156d50f755331084ee220448_JaffaCakes118.exe

description	pid	process	target process
PID 2932 wrote to memory of 2988	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	powershell.exe
PID 2932 wrote to memory of 2988	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	powershell.exe
PID 2932 wrote to memory of 2988	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	powershell.exe
PID 2932 wrote to memory of 2852	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	gMIUNDK.exe
PID 2932 wrote to memory of 2852	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	gMIUNDK.exe
PID 2932 wrote to memory of 2852	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	gMIUNDK.exe
PID 2932 wrote to memory of 2656	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oiVuEwW.exe
PID 2932 wrote to memory of 2656	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oiVuEwW.exe
PID 2932 wrote to memory of 2656	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oiVuEwW.exe
PID 2932 wrote to memory of 2612	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	zMgYnme.exe
PID 2932 wrote to memory of 2612	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	zMgYnme.exe
PID 2932 wrote to memory of 2612	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	zMgYnme.exe
PID 2932 wrote to memory of 2868	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	IBdGOUn.exe
PID 2932 wrote to memory of 2868	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	IBdGOUn.exe
PID 2932 wrote to memory of 2868	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	IBdGOUn.exe
PID 2932 wrote to memory of 2080	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	JPFGxIR.exe
PID 2932 wrote to memory of 2080	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	JPFGxIR.exe
PID 2932 wrote to memory of 2080	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	JPFGxIR.exe
PID 2932 wrote to memory of 2096	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	TWHwmRs.exe
PID 2932 wrote to memory of 2096	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	TWHwmRs.exe
PID 2932 wrote to memory of 2096	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	TWHwmRs.exe
PID 2932 wrote to memory of 2996	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	jvqfecw.exe
PID 2932 wrote to memory of 2996	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	jvqfecw.exe
PID 2932 wrote to memory of 2996	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	jvqfecw.exe
PID 2932 wrote to memory of 2624	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EHNXamk.exe
PID 2932 wrote to memory of 2624	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EHNXamk.exe
PID 2932 wrote to memory of 2624	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EHNXamk.exe
PID 2932 wrote to memory of 2464	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	rCoDrDe.exe
PID 2932 wrote to memory of 2464	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	rCoDrDe.exe
PID 2932 wrote to memory of 2464	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	rCoDrDe.exe
PID 2932 wrote to memory of 2952	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	QFupsOX.exe
PID 2932 wrote to memory of 2952	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	QFupsOX.exe
PID 2932 wrote to memory of 2952	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	QFupsOX.exe
PID 2932 wrote to memory of 2428	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	uHTNPbS.exe
PID 2932 wrote to memory of 2428	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	uHTNPbS.exe
PID 2932 wrote to memory of 2428	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	uHTNPbS.exe
PID 2932 wrote to memory of 2840	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	aPwHyJT.exe
PID 2932 wrote to memory of 2840	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	aPwHyJT.exe
PID 2932 wrote to memory of 2840	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	aPwHyJT.exe
PID 2932 wrote to memory of 2552	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	HIQozyM.exe
PID 2932 wrote to memory of 2552	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	HIQozyM.exe
PID 2932 wrote to memory of 2552	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	HIQozyM.exe
PID 2932 wrote to memory of 556	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	wFyKANJ.exe
PID 2932 wrote to memory of 556	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	wFyKANJ.exe
PID 2932 wrote to memory of 556	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	wFyKANJ.exe
PID 2932 wrote to memory of 1152	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	mmlhxqh.exe
PID 2932 wrote to memory of 1152	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	mmlhxqh.exe
PID 2932 wrote to memory of 1152	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	mmlhxqh.exe
PID 2932 wrote to memory of 1928	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	twIBlSy.exe
PID 2932 wrote to memory of 1928	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	twIBlSy.exe
PID 2932 wrote to memory of 1928	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	twIBlSy.exe
PID 2932 wrote to memory of 2808	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EYLLXYe.exe
PID 2932 wrote to memory of 2808	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EYLLXYe.exe
PID 2932 wrote to memory of 2808	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	EYLLXYe.exe
PID 2932 wrote to memory of 1052	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oQjFvQt.exe
PID 2932 wrote to memory of 1052	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oQjFvQt.exe
PID 2932 wrote to memory of 1052	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	oQjFvQt.exe
PID 2932 wrote to memory of 1676	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	yodCJEV.exe
PID 2932 wrote to memory of 1676	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	yodCJEV.exe
PID 2932 wrote to memory of 1676	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	yodCJEV.exe
PID 2932 wrote to memory of 1724	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	DQEnoiz.exe
PID 2932 wrote to memory of 1724	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	DQEnoiz.exe
PID 2932 wrote to memory of 1724	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	DQEnoiz.exe
PID 2932 wrote to memory of 384	2932	03c3f749156d50f755331084ee220448_JaffaCakes118.exe	dSKcYCG.exe

C:\Users\Admin\AppData\Local\Temp\03c3f749156d50f755331084ee220448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03c3f749156d50f755331084ee220448_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\System\gMIUNDK.exe
  C:\Windows\System\gMIUNDK.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\oiVuEwW.exe
  C:\Windows\System\oiVuEwW.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\zMgYnme.exe
  C:\Windows\System\zMgYnme.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\IBdGOUn.exe
  C:\Windows\System\IBdGOUn.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\JPFGxIR.exe
  C:\Windows\System\JPFGxIR.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\TWHwmRs.exe
  C:\Windows\System\TWHwmRs.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\jvqfecw.exe
  C:\Windows\System\jvqfecw.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EHNXamk.exe
  C:\Windows\System\EHNXamk.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\rCoDrDe.exe
  C:\Windows\System\rCoDrDe.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\QFupsOX.exe
  C:\Windows\System\QFupsOX.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\uHTNPbS.exe
  C:\Windows\System\uHTNPbS.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\aPwHyJT.exe
  C:\Windows\System\aPwHyJT.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\HIQozyM.exe
  C:\Windows\System\HIQozyM.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\wFyKANJ.exe
  C:\Windows\System\wFyKANJ.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\mmlhxqh.exe
  C:\Windows\System\mmlhxqh.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\twIBlSy.exe
  C:\Windows\System\twIBlSy.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\EYLLXYe.exe
  C:\Windows\System\EYLLXYe.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\oQjFvQt.exe
  C:\Windows\System\oQjFvQt.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\yodCJEV.exe
  C:\Windows\System\yodCJEV.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\DQEnoiz.exe
  C:\Windows\System\DQEnoiz.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\dSKcYCG.exe
  C:\Windows\System\dSKcYCG.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\wNivopg.exe
  C:\Windows\System\wNivopg.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\mgClCgK.exe
  C:\Windows\System\mgClCgK.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\xwAYjFi.exe
  C:\Windows\System\xwAYjFi.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\awIMlYF.exe
  C:\Windows\System\awIMlYF.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\ocMZhdy.exe
  C:\Windows\System\ocMZhdy.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\PELRHeH.exe
  C:\Windows\System\PELRHeH.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\RyGseTm.exe
  C:\Windows\System\RyGseTm.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\NeKOtkc.exe
  C:\Windows\System\NeKOtkc.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\FHJqczw.exe
  C:\Windows\System\FHJqczw.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\lbxZFcB.exe
  C:\Windows\System\lbxZFcB.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\UhWsAlx.exe
  C:\Windows\System\UhWsAlx.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\mronxGf.exe
  C:\Windows\System\mronxGf.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\aYTvdQN.exe
  C:\Windows\System\aYTvdQN.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\hkfeMpE.exe
  C:\Windows\System\hkfeMpE.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\zhEPpbg.exe
  C:\Windows\System\zhEPpbg.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\CsspGeT.exe
  C:\Windows\System\CsspGeT.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\eDBxPGE.exe
  C:\Windows\System\eDBxPGE.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\SCyGXlk.exe
  C:\Windows\System\SCyGXlk.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\EJykPHx.exe
  C:\Windows\System\EJykPHx.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\CYCPigE.exe
  C:\Windows\System\CYCPigE.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\cilREyb.exe
  C:\Windows\System\cilREyb.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\DsFVMjE.exe
  C:\Windows\System\DsFVMjE.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\kPJABwH.exe
  C:\Windows\System\kPJABwH.exe
  2⤵
  PID:2860
- C:\Windows\System\qyiszLF.exe
  C:\Windows\System\qyiszLF.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\PPiPnjV.exe
  C:\Windows\System\PPiPnjV.exe
  2⤵
  PID:2296
- C:\Windows\System\lWVvPQf.exe
  C:\Windows\System\lWVvPQf.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\NnRobZc.exe
  C:\Windows\System\NnRobZc.exe
  2⤵
  PID:3048
- C:\Windows\System\BUlipzW.exe
  C:\Windows\System\BUlipzW.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\IGhvmPl.exe
  C:\Windows\System\IGhvmPl.exe
  2⤵
  PID:612
- C:\Windows\System\jFtyZCR.exe
  C:\Windows\System\jFtyZCR.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\nuwkLec.exe
  C:\Windows\System\nuwkLec.exe
  2⤵
  PID:876
- C:\Windows\System\gNJQSlx.exe
  C:\Windows\System\gNJQSlx.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\yfHBgvX.exe
  C:\Windows\System\yfHBgvX.exe
  2⤵
  PID:2020
- C:\Windows\System\lriGPQK.exe
  C:\Windows\System\lriGPQK.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ztYVulo.exe
  C:\Windows\System\ztYVulo.exe
  2⤵
  PID:1580
- C:\Windows\System\foriJqt.exe
  C:\Windows\System\foriJqt.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\mViapQd.exe
  C:\Windows\System\mViapQd.exe
  2⤵
  PID:868
- C:\Windows\System\OxIKwwF.exe
  C:\Windows\System\OxIKwwF.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\tNzDijJ.exe
  C:\Windows\System\tNzDijJ.exe
  2⤵
  PID:2668
- C:\Windows\System\vMfjvfR.exe
  C:\Windows\System\vMfjvfR.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\gtQGiWA.exe
  C:\Windows\System\gtQGiWA.exe
  2⤵
  PID:2732
- C:\Windows\System\bpHcbuk.exe
  C:\Windows\System\bpHcbuk.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\axXZPNc.exe
  C:\Windows\System\axXZPNc.exe
  2⤵
  PID:2512
- C:\Windows\System\fxJwIfk.exe
  C:\Windows\System\fxJwIfk.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\lzanjWa.exe
  C:\Windows\System\lzanjWa.exe
  2⤵
  PID:1996
- C:\Windows\System\FCvymAl.exe
  C:\Windows\System\FCvymAl.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\CBClfTJ.exe
  C:\Windows\System\CBClfTJ.exe
  2⤵
  PID:828
- C:\Windows\System\YNXUbGL.exe
  C:\Windows\System\YNXUbGL.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\TwJJFwQ.exe
  C:\Windows\System\TwJJFwQ.exe
  2⤵
  PID:2544
- C:\Windows\System\sIXqCHr.exe
  C:\Windows\System\sIXqCHr.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\gKNVjdE.exe
  C:\Windows\System\gKNVjdE.exe
  2⤵
  PID:1072
- C:\Windows\System\SrfGZsb.exe
  C:\Windows\System\SrfGZsb.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\JEqUhYX.exe
  C:\Windows\System\JEqUhYX.exe
  2⤵
  PID:680
- C:\Windows\System\qlkBcnU.exe
  C:\Windows\System\qlkBcnU.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\wsWbxwD.exe
  C:\Windows\System\wsWbxwD.exe
  2⤵
  PID:1092
- C:\Windows\System\kYcTjFs.exe
  C:\Windows\System\kYcTjFs.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\nypaeKz.exe
  C:\Windows\System\nypaeKz.exe
  2⤵
  PID:1192
- C:\Windows\System\KwdWWVk.exe
  C:\Windows\System\KwdWWVk.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\xgcTXEX.exe
  C:\Windows\System\xgcTXEX.exe
  2⤵
  PID:1308
- C:\Windows\System\MuTRIWm.exe
  C:\Windows\System\MuTRIWm.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\ZDaWPxx.exe
  C:\Windows\System\ZDaWPxx.exe
  2⤵
  PID:2864
- C:\Windows\System\hanqkPK.exe
  C:\Windows\System\hanqkPK.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\QXvOaFo.exe
  C:\Windows\System\QXvOaFo.exe
  2⤵
  PID:2696
- C:\Windows\System\ONuQfaz.exe
  C:\Windows\System\ONuQfaz.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\dQXfjXW.exe
  C:\Windows\System\dQXfjXW.exe
  2⤵
  PID:2836
- C:\Windows\System\NQkrWqk.exe
  C:\Windows\System\NQkrWqk.exe
  2⤵
  PID:1568
- C:\Windows\System\gsVFJWW.exe
  C:\Windows\System\gsVFJWW.exe
  2⤵
  PID:1248
- C:\Windows\System\HzeMHYx.exe
  C:\Windows\System\HzeMHYx.exe
  2⤵
  PID:1008
- C:\Windows\System\VmLgtPT.exe
  C:\Windows\System\VmLgtPT.exe
  2⤵
  PID:1832
- C:\Windows\System\MkbVPRi.exe
  C:\Windows\System\MkbVPRi.exe
  2⤵
  PID:1796
- C:\Windows\System\FhgAGdN.exe
  C:\Windows\System\FhgAGdN.exe
  2⤵
  PID:1244
- C:\Windows\System\hpPUjmU.exe
  C:\Windows\System\hpPUjmU.exe
  2⤵
  PID:1624
- C:\Windows\System\eeIquKU.exe
  C:\Windows\System\eeIquKU.exe
  2⤵
  PID:1064
- C:\Windows\System\qvgpmxy.exe
  C:\Windows\System\qvgpmxy.exe
  2⤵
  PID:1252
- C:\Windows\System\TGXMmRm.exe
  C:\Windows\System\TGXMmRm.exe
  2⤵
  PID:1332
- C:\Windows\System\ZldaEUK.exe
  C:\Windows\System\ZldaEUK.exe
  2⤵
  PID:348
- C:\Windows\System\IrZCVOq.exe
  C:\Windows\System\IrZCVOq.exe
  2⤵
  PID:2244
- C:\Windows\System\DUTpZaZ.exe
  C:\Windows\System\DUTpZaZ.exe
  2⤵
  PID:336
- C:\Windows\System\EWJZPRm.exe
  C:\Windows\System\EWJZPRm.exe
  2⤵
  PID:2616
- C:\Windows\System\viqxEGN.exe
  C:\Windows\System\viqxEGN.exe
  2⤵
  PID:2940
- C:\Windows\System\heoHzkl.exe
  C:\Windows\System\heoHzkl.exe
  2⤵
  PID:1208
- C:\Windows\System\uGRHGBu.exe
  C:\Windows\System\uGRHGBu.exe
  2⤵
  PID:1924
- C:\Windows\System\gSKvqlD.exe
  C:\Windows\System\gSKvqlD.exe
  2⤵
  PID:3096
- C:\Windows\System\bsadfaH.exe
  C:\Windows\System\bsadfaH.exe
  2⤵
  PID:3112
- C:\Windows\System\UtAaYWm.exe
  C:\Windows\System\UtAaYWm.exe
  2⤵
  PID:3128
- C:\Windows\System\ORxfcUi.exe
  C:\Windows\System\ORxfcUi.exe
  2⤵
  PID:3144
- C:\Windows\System\DvVOvvm.exe
  C:\Windows\System\DvVOvvm.exe
  2⤵
  PID:3160
- C:\Windows\System\TUjMsJX.exe
  C:\Windows\System\TUjMsJX.exe
  2⤵
  PID:3176
- C:\Windows\System\TyDdADC.exe
  C:\Windows\System\TyDdADC.exe
  2⤵
  PID:3192
- C:\Windows\System\kiVgtGD.exe
  C:\Windows\System\kiVgtGD.exe
  2⤵
  PID:3208
- C:\Windows\System\YTkdshW.exe
  C:\Windows\System\YTkdshW.exe
  2⤵
  PID:3224
- C:\Windows\System\dMiYoXT.exe
  C:\Windows\System\dMiYoXT.exe
  2⤵
  PID:3240
- C:\Windows\System\CgNVYna.exe
  C:\Windows\System\CgNVYna.exe
  2⤵
  PID:3256
- C:\Windows\System\rKsupfk.exe
  C:\Windows\System\rKsupfk.exe
  2⤵
  PID:3272
- C:\Windows\System\jSeTpkr.exe
  C:\Windows\System\jSeTpkr.exe
  2⤵
  PID:3288
- C:\Windows\System\fwQgyay.exe
  C:\Windows\System\fwQgyay.exe
  2⤵
  PID:3304
- C:\Windows\System\eQUdjTK.exe
  C:\Windows\System\eQUdjTK.exe
  2⤵
  PID:3320
- C:\Windows\System\CWJDFrG.exe
  C:\Windows\System\CWJDFrG.exe
  2⤵
  PID:3336
- C:\Windows\System\mlKUmFG.exe
  C:\Windows\System\mlKUmFG.exe
  2⤵
  PID:3352
- C:\Windows\System\WKHvSPE.exe
  C:\Windows\System\WKHvSPE.exe
  2⤵
  PID:3368
- C:\Windows\System\yvHDUvK.exe
  C:\Windows\System\yvHDUvK.exe
  2⤵
  PID:3384
- C:\Windows\System\RyfdMoQ.exe
  C:\Windows\System\RyfdMoQ.exe
  2⤵
  PID:3400
- C:\Windows\System\iPrJhhm.exe
  C:\Windows\System\iPrJhhm.exe
  2⤵
  PID:3416
- C:\Windows\System\IsCSSoD.exe
  C:\Windows\System\IsCSSoD.exe
  2⤵
  PID:3432
- C:\Windows\System\OvtwKCs.exe
  C:\Windows\System\OvtwKCs.exe
  2⤵
  PID:3448
- C:\Windows\System\AOfojWJ.exe
  C:\Windows\System\AOfojWJ.exe
  2⤵
  PID:3464
- C:\Windows\System\QyyRhOJ.exe
  C:\Windows\System\QyyRhOJ.exe
  2⤵
  PID:3480
- C:\Windows\System\yRuTvzN.exe
  C:\Windows\System\yRuTvzN.exe
  2⤵
  PID:3496
- C:\Windows\System\AoZnYYF.exe
  C:\Windows\System\AoZnYYF.exe
  2⤵
  PID:3512
- C:\Windows\System\cgISgJY.exe
  C:\Windows\System\cgISgJY.exe
  2⤵
  PID:3532
- C:\Windows\System\znfDNXx.exe
  C:\Windows\System\znfDNXx.exe
  2⤵
  PID:3548
- C:\Windows\System\AoswBHV.exe
  C:\Windows\System\AoswBHV.exe
  2⤵
  PID:3564
- C:\Windows\System\TsAaqhv.exe
  C:\Windows\System\TsAaqhv.exe
  2⤵
  PID:3580
- C:\Windows\System\JYYYrTc.exe
  C:\Windows\System\JYYYrTc.exe
  2⤵
  PID:3596
- C:\Windows\System\MdXFTqE.exe
  C:\Windows\System\MdXFTqE.exe
  2⤵
  PID:3612
- C:\Windows\System\MyxOsyK.exe
  C:\Windows\System\MyxOsyK.exe
  2⤵
  PID:3628
- C:\Windows\System\bfQzxyG.exe
  C:\Windows\System\bfQzxyG.exe
  2⤵
  PID:3644
- C:\Windows\System\QCnTApm.exe
  C:\Windows\System\QCnTApm.exe
  2⤵
  PID:3664
- C:\Windows\System\lnMGiPl.exe
  C:\Windows\System\lnMGiPl.exe
  2⤵
  PID:3680
- C:\Windows\System\xBWTCDA.exe
  C:\Windows\System\xBWTCDA.exe
  2⤵
  PID:3696
- C:\Windows\System\BQYPtXD.exe
  C:\Windows\System\BQYPtXD.exe
  2⤵
  PID:3712
- C:\Windows\System\lyufYZJ.exe
  C:\Windows\System\lyufYZJ.exe
  2⤵
  PID:3728
- C:\Windows\System\ncqmPYR.exe
  C:\Windows\System\ncqmPYR.exe
  2⤵
  PID:3744
- C:\Windows\System\bMETzEQ.exe
  C:\Windows\System\bMETzEQ.exe
  2⤵
  PID:3760
- C:\Windows\System\DbnZfVA.exe
  C:\Windows\System\DbnZfVA.exe
  2⤵
  PID:3780
- C:\Windows\System\RxgjZkf.exe
  C:\Windows\System\RxgjZkf.exe
  2⤵
  PID:3796
- C:\Windows\System\oZJlVFs.exe
  C:\Windows\System\oZJlVFs.exe
  2⤵
  PID:3812
- C:\Windows\System\wRrmWNk.exe
  C:\Windows\System\wRrmWNk.exe
  2⤵
  PID:3828
- C:\Windows\System\xaZDLye.exe
  C:\Windows\System\xaZDLye.exe
  2⤵
  PID:3844
- C:\Windows\System\YKdmUtD.exe
  C:\Windows\System\YKdmUtD.exe
  2⤵
  PID:3860
- C:\Windows\System\wasdvmm.exe
  C:\Windows\System\wasdvmm.exe
  2⤵
  PID:3876
- C:\Windows\System\vhxTeNa.exe
  C:\Windows\System\vhxTeNa.exe
  2⤵
  PID:3892
- C:\Windows\System\zgTAQwP.exe
  C:\Windows\System\zgTAQwP.exe
  2⤵
  PID:3908
- C:\Windows\System\utAPSvR.exe
  C:\Windows\System\utAPSvR.exe
  2⤵
  PID:3928
- C:\Windows\System\rnSwHPt.exe
  C:\Windows\System\rnSwHPt.exe
  2⤵
  PID:3944
- C:\Windows\System\LTjoQak.exe
  C:\Windows\System\LTjoQak.exe
  2⤵
  PID:3960
- C:\Windows\System\ujPmxqf.exe
  C:\Windows\System\ujPmxqf.exe
  2⤵
  PID:3976
- C:\Windows\System\iyYQbHl.exe
  C:\Windows\System\iyYQbHl.exe
  2⤵
  PID:3992
- C:\Windows\System\izlOzna.exe
  C:\Windows\System\izlOzna.exe
  2⤵
  PID:4008
- C:\Windows\System\OOaxwCY.exe
  C:\Windows\System\OOaxwCY.exe
  2⤵
  PID:4024
- C:\Windows\System\PXuaQfk.exe
  C:\Windows\System\PXuaQfk.exe
  2⤵
  PID:4040
- C:\Windows\System\WFJdwiu.exe
  C:\Windows\System\WFJdwiu.exe
  2⤵
  PID:4060
- C:\Windows\System\llrOxPv.exe
  C:\Windows\System\llrOxPv.exe
  2⤵
  PID:2604
- C:\Windows\System\KFigmYH.exe
  C:\Windows\System\KFigmYH.exe
  2⤵
  PID:3120
- C:\Windows\System\AbjkjiZ.exe
  C:\Windows\System\AbjkjiZ.exe
  2⤵
  PID:3184
- C:\Windows\System\gdEvFlp.exe
  C:\Windows\System\gdEvFlp.exe
  2⤵
  PID:3248
- C:\Windows\System\FHpXIOa.exe
  C:\Windows\System\FHpXIOa.exe
  2⤵
  PID:1868
- C:\Windows\System\Lqnqkom.exe
  C:\Windows\System\Lqnqkom.exe
  2⤵
  PID:1220
- C:\Windows\System\hMpMkpB.exe
  C:\Windows\System\hMpMkpB.exe
  2⤵
  PID:2000
- C:\Windows\System\TUfkMjV.exe
  C:\Windows\System\TUfkMjV.exe
  2⤵
  PID:2728
- C:\Windows\System\JOFvXHb.exe
  C:\Windows\System\JOFvXHb.exe
  2⤵
  PID:2576
- C:\Windows\System\azCtNuZ.exe
  C:\Windows\System\azCtNuZ.exe
  2⤵
  PID:2748
- C:\Windows\System\nUwbptK.exe
  C:\Windows\System\nUwbptK.exe
  2⤵
  PID:2276
- C:\Windows\System\TwelnQG.exe
  C:\Windows\System\TwelnQG.exe
  2⤵
  PID:3316
- C:\Windows\System\UQZTIXb.exe
  C:\Windows\System\UQZTIXb.exe
  2⤵
  PID:2424
- C:\Windows\System\bSaabwK.exe
  C:\Windows\System\bSaabwK.exe
  2⤵
  PID:3408
- C:\Windows\System\olntYPs.exe
  C:\Windows\System\olntYPs.exe
  2⤵
  PID:3472
- C:\Windows\System\LHWwtAn.exe
  C:\Windows\System\LHWwtAn.exe
  2⤵
  PID:3540
- C:\Windows\System\uGgepeP.exe
  C:\Windows\System\uGgepeP.exe
  2⤵
  PID:3604
- C:\Windows\System\sooMoOb.exe
  C:\Windows\System\sooMoOb.exe
  2⤵
  PID:3676
- C:\Windows\System\yLWZXQH.exe
  C:\Windows\System\yLWZXQH.exe
  2⤵
  PID:3740
- C:\Windows\System\nMIbFyp.exe
  C:\Windows\System\nMIbFyp.exe
  2⤵
  PID:3804
- C:\Windows\System\TIzgFop.exe
  C:\Windows\System\TIzgFop.exe
  2⤵
  PID:3872
- C:\Windows\System\vUQQXMM.exe
  C:\Windows\System\vUQQXMM.exe
  2⤵
  PID:3936
- C:\Windows\System\HSimXGC.exe
  C:\Windows\System\HSimXGC.exe
  2⤵
  PID:4000
- C:\Windows\System\CDfJKgz.exe
  C:\Windows\System\CDfJKgz.exe
  2⤵
  PID:4068
- C:\Windows\System\KMvGAwy.exe
  C:\Windows\System\KMvGAwy.exe
  2⤵
  PID:4092
- C:\Windows\System\iemHQnS.exe
  C:\Windows\System\iemHQnS.exe
  2⤵
  PID:908
- C:\Windows\System\UkWKEnO.exe
  C:\Windows\System\UkWKEnO.exe
  2⤵
  PID:2472
- C:\Windows\System\TnnrKiZ.exe
  C:\Windows\System\TnnrKiZ.exe
  2⤵
  PID:1584
- C:\Windows\System\CUchNJq.exe
  C:\Windows\System\CUchNJq.exe
  2⤵
  PID:2892
- C:\Windows\System\PMoBQDz.exe
  C:\Windows\System\PMoBQDz.exe
  2⤵
  PID:1800
- C:\Windows\System\MKvwkYN.exe
  C:\Windows\System\MKvwkYN.exe
  2⤵
  PID:4072
- C:\Windows\System\bjnXJIT.exe
  C:\Windows\System\bjnXJIT.exe
  2⤵
  PID:2128
- C:\Windows\System\nYEAssT.exe
  C:\Windows\System\nYEAssT.exe
  2⤵
  PID:1440
- C:\Windows\System\NTsRayr.exe
  C:\Windows\System\NTsRayr.exe
  2⤵
  PID:1844
- C:\Windows\System\pPjnPyQ.exe
  C:\Windows\System\pPjnPyQ.exe
  2⤵
  PID:4104
- C:\Windows\System\tuujtof.exe
  C:\Windows\System\tuujtof.exe
  2⤵
  PID:4120
- C:\Windows\System\mdXqrpM.exe
  C:\Windows\System\mdXqrpM.exe
  2⤵
  PID:4140
- C:\Windows\System\OAEAgYn.exe
  C:\Windows\System\OAEAgYn.exe
  2⤵
  PID:4156
- C:\Windows\System\yXExcuJ.exe
  C:\Windows\System\yXExcuJ.exe
  2⤵
  PID:4172
- C:\Windows\System\bRsSESN.exe
  C:\Windows\System\bRsSESN.exe
  2⤵
  PID:4188
- C:\Windows\System\RNiJILl.exe
  C:\Windows\System\RNiJILl.exe
  2⤵
  PID:4204
- C:\Windows\System\gnKtIHx.exe
  C:\Windows\System\gnKtIHx.exe
  2⤵
  PID:4220
- C:\Windows\System\uirLFlJ.exe
  C:\Windows\System\uirLFlJ.exe
  2⤵
  PID:4236
- C:\Windows\System\zVffPdZ.exe
  C:\Windows\System\zVffPdZ.exe
  2⤵
  PID:4252
- C:\Windows\System\SBGEWkm.exe
  C:\Windows\System\SBGEWkm.exe
  2⤵
  PID:4268
- C:\Windows\System\RkUhzLE.exe
  C:\Windows\System\RkUhzLE.exe
  2⤵
  PID:4284
- C:\Windows\System\uTqdZMI.exe
  C:\Windows\System\uTqdZMI.exe
  2⤵
  PID:4304
- C:\Windows\System\WEHRuUI.exe
  C:\Windows\System\WEHRuUI.exe
  2⤵
  PID:4320
- C:\Windows\System\DxnjpWl.exe
  C:\Windows\System\DxnjpWl.exe
  2⤵
  PID:4336
- C:\Windows\System\cBPWwiV.exe
  C:\Windows\System\cBPWwiV.exe
  2⤵
  PID:4352
- C:\Windows\System\UXniTpc.exe
  C:\Windows\System\UXniTpc.exe
  2⤵
  PID:4368
- C:\Windows\System\CjSgitg.exe
  C:\Windows\System\CjSgitg.exe
  2⤵
  PID:4384
- C:\Windows\System\Joutcou.exe
  C:\Windows\System\Joutcou.exe
  2⤵
  PID:4400
- C:\Windows\System\uKvWmvq.exe
  C:\Windows\System\uKvWmvq.exe
  2⤵
  PID:4416
- C:\Windows\System\THlyZsP.exe
  C:\Windows\System\THlyZsP.exe
  2⤵
  PID:4432
- C:\Windows\System\RfQHQjt.exe
  C:\Windows\System\RfQHQjt.exe
  2⤵
  PID:4452
- C:\Windows\System\RQEnNKs.exe
  C:\Windows\System\RQEnNKs.exe
  2⤵
  PID:4468
- C:\Windows\System\tvYNosY.exe
  C:\Windows\System\tvYNosY.exe
  2⤵
  PID:4484
- C:\Windows\System\JbqGVTY.exe
  C:\Windows\System\JbqGVTY.exe
  2⤵
  PID:4500
- C:\Windows\System\xArEmuG.exe
  C:\Windows\System\xArEmuG.exe
  2⤵
  PID:4516
- C:\Windows\System\MqyGjEj.exe
  C:\Windows\System\MqyGjEj.exe
  2⤵
  PID:4532
- C:\Windows\System\jurfNxE.exe
  C:\Windows\System\jurfNxE.exe
  2⤵
  PID:4548
- C:\Windows\System\PzMguOx.exe
  C:\Windows\System\PzMguOx.exe
  2⤵
  PID:4568
- C:\Windows\System\nalrbon.exe
  C:\Windows\System\nalrbon.exe
  2⤵
  PID:4584
- C:\Windows\System\BzYsdiG.exe
  C:\Windows\System\BzYsdiG.exe
  2⤵
  PID:4600
- C:\Windows\System\SRwASdR.exe
  C:\Windows\System\SRwASdR.exe
  2⤵
  PID:4616
- C:\Windows\System\Szeguyv.exe
  C:\Windows\System\Szeguyv.exe
  2⤵
  PID:4632
- C:\Windows\System\irUXmin.exe
  C:\Windows\System\irUXmin.exe
  2⤵
  PID:4648
- C:\Windows\System\gdHBIRE.exe
  C:\Windows\System\gdHBIRE.exe
  2⤵
  PID:4664
- C:\Windows\System\uMrGfDe.exe
  C:\Windows\System\uMrGfDe.exe
  2⤵
  PID:4684
- C:\Windows\System\WYQZzCN.exe
  C:\Windows\System\WYQZzCN.exe
  2⤵
  PID:4700
- C:\Windows\System\sCYBPlP.exe
  C:\Windows\System\sCYBPlP.exe
  2⤵
  PID:4716
- C:\Windows\System\DDNkXfK.exe
  C:\Windows\System\DDNkXfK.exe
  2⤵
  PID:4732
- C:\Windows\System\djDgtNX.exe
  C:\Windows\System\djDgtNX.exe
  2⤵
  PID:4748
- C:\Windows\System\udyZnbv.exe
  C:\Windows\System\udyZnbv.exe
  2⤵
  PID:4764
- C:\Windows\System\pJPhbiG.exe
  C:\Windows\System\pJPhbiG.exe
  2⤵
  PID:4780
- C:\Windows\System\epIITLN.exe
  C:\Windows\System\epIITLN.exe
  2⤵
  PID:4800
- C:\Windows\System\toGHzBo.exe
  C:\Windows\System\toGHzBo.exe
  2⤵
  PID:4816
- C:\Windows\System\cAzGAJJ.exe
  C:\Windows\System\cAzGAJJ.exe
  2⤵
  PID:4832
- C:\Windows\System\douPHDq.exe
  C:\Windows\System\douPHDq.exe
  2⤵
  PID:4848
- C:\Windows\System\FDKUaRC.exe
  C:\Windows\System\FDKUaRC.exe
  2⤵
  PID:4864
- C:\Windows\System\qBbzhwA.exe
  C:\Windows\System\qBbzhwA.exe
  2⤵
  PID:4880
- C:\Windows\System\gdsQoNH.exe
  C:\Windows\System\gdsQoNH.exe
  2⤵
  PID:4900
- C:\Windows\System\isQrWeV.exe
  C:\Windows\System\isQrWeV.exe
  2⤵
  PID:4916
- C:\Windows\System\tAWJAyn.exe
  C:\Windows\System\tAWJAyn.exe
  2⤵
  PID:4932
- C:\Windows\System\YocYGWr.exe
  C:\Windows\System\YocYGWr.exe
  2⤵
  PID:4948
- C:\Windows\System\pNIPwXr.exe
  C:\Windows\System\pNIPwXr.exe
  2⤵
  PID:4964
- C:\Windows\System\fdCIoxy.exe
  C:\Windows\System\fdCIoxy.exe
  2⤵
  PID:4980
- C:\Windows\System\NEMDxzb.exe
  C:\Windows\System\NEMDxzb.exe
  2⤵
  PID:4996
- C:\Windows\System\coRpeZs.exe
  C:\Windows\System\coRpeZs.exe
  2⤵
  PID:5016
- C:\Windows\System\VjETvcF.exe
  C:\Windows\System\VjETvcF.exe
  2⤵
  PID:5032
- C:\Windows\System\eGuONDz.exe
  C:\Windows\System\eGuONDz.exe
  2⤵
  PID:5048
- C:\Windows\System\qbzMhom.exe
  C:\Windows\System\qbzMhom.exe
  2⤵
  PID:5064
- C:\Windows\System\LFJvpQs.exe
  C:\Windows\System\LFJvpQs.exe
  2⤵
  PID:5080
- C:\Windows\System\VNuGsKN.exe
  C:\Windows\System\VNuGsKN.exe
  2⤵
  PID:5096
- C:\Windows\System\QXcmCCi.exe
  C:\Windows\System\QXcmCCi.exe
  2⤵
  PID:5112
- C:\Windows\System\PruRYFr.exe
  C:\Windows\System\PruRYFr.exe
  2⤵
  PID:3020
- C:\Windows\System\HrxQqEt.exe
  C:\Windows\System\HrxQqEt.exe
  2⤵
  PID:1036
- C:\Windows\System\WoGfCvC.exe
  C:\Windows\System\WoGfCvC.exe
  2⤵
  PID:2288
- C:\Windows\System\BnbQUho.exe
  C:\Windows\System\BnbQUho.exe
  2⤵
  PID:1596
- C:\Windows\System\dBdBlIN.exe
  C:\Windows\System\dBdBlIN.exe
  2⤵
  PID:2796
- C:\Windows\System\KxmPtDq.exe
  C:\Windows\System\KxmPtDq.exe
  2⤵
  PID:5128
- C:\Windows\System\CMWgXFx.exe
  C:\Windows\System\CMWgXFx.exe
  2⤵
  PID:5144
- C:\Windows\System\qMDbiVD.exe
  C:\Windows\System\qMDbiVD.exe
  2⤵
  PID:5160
- C:\Windows\System\wtosTfT.exe
  C:\Windows\System\wtosTfT.exe
  2⤵
  PID:5232
- C:\Windows\System\RFgxSdB.exe
  C:\Windows\System\RFgxSdB.exe
  2⤵
  PID:5248
- C:\Windows\System\bSfaGvu.exe
  C:\Windows\System\bSfaGvu.exe
  2⤵
  PID:5264
- C:\Windows\System\YkTHMGa.exe
  C:\Windows\System\YkTHMGa.exe
  2⤵
  PID:5280
- C:\Windows\System\tLwPJlI.exe
  C:\Windows\System\tLwPJlI.exe
  2⤵
  PID:5300
- C:\Windows\System\bTYqUWy.exe
  C:\Windows\System\bTYqUWy.exe
  2⤵
  PID:5316
- C:\Windows\System\mILfeFg.exe
  C:\Windows\System\mILfeFg.exe
  2⤵
  PID:5336
- C:\Windows\System\kovleiN.exe
  C:\Windows\System\kovleiN.exe
  2⤵
  PID:5352
- C:\Windows\System\xkOBzPB.exe
  C:\Windows\System\xkOBzPB.exe
  2⤵
  PID:5368
- C:\Windows\System\sCBXgBG.exe
  C:\Windows\System\sCBXgBG.exe
  2⤵
  PID:5384
- C:\Windows\System\qaFiJYk.exe
  C:\Windows\System\qaFiJYk.exe
  2⤵
  PID:5404
- C:\Windows\System\jDIWpFw.exe
  C:\Windows\System\jDIWpFw.exe
  2⤵
  PID:5420
- C:\Windows\System\nyuwsVv.exe
  C:\Windows\System\nyuwsVv.exe
  2⤵
  PID:5436
- C:\Windows\System\RNOssdA.exe
  C:\Windows\System\RNOssdA.exe
  2⤵
  PID:5456
- C:\Windows\System\gneWTeE.exe
  C:\Windows\System\gneWTeE.exe
  2⤵
  PID:5472
- C:\Windows\System\ZVKwtKw.exe
  C:\Windows\System\ZVKwtKw.exe
  2⤵
  PID:5488
- C:\Windows\System\uPCSkiI.exe
  C:\Windows\System\uPCSkiI.exe
  2⤵
  PID:5504
- C:\Windows\System\QzUZjKN.exe
  C:\Windows\System\QzUZjKN.exe
  2⤵
  PID:5520
- C:\Windows\System\LaqayRv.exe
  C:\Windows\System\LaqayRv.exe
  2⤵
  PID:5536
- C:\Windows\System\PojPmtV.exe
  C:\Windows\System\PojPmtV.exe
  2⤵
  PID:5552
- C:\Windows\System\uJATHgY.exe
  C:\Windows\System\uJATHgY.exe
  2⤵
  PID:5572
- C:\Windows\System\DwNpUlZ.exe
  C:\Windows\System\DwNpUlZ.exe
  2⤵
  PID:5588
- C:\Windows\System\polnPUz.exe
  C:\Windows\System\polnPUz.exe
  2⤵
  PID:5604
- C:\Windows\System\klznVls.exe
  C:\Windows\System\klznVls.exe
  2⤵
  PID:6056
- C:\Windows\System\cIatBVA.exe
  C:\Windows\System\cIatBVA.exe
  2⤵
  PID:3424
- C:\Windows\System\DlBpKMj.exe
  C:\Windows\System\DlBpKMj.exe
  2⤵
  PID:3492
- C:\Windows\System\qWJoJGv.exe
  C:\Windows\System\qWJoJGv.exe
  2⤵
  PID:1708
- C:\Windows\System\anYfHfY.exe
  C:\Windows\System\anYfHfY.exe
  2⤵
  PID:4056
- C:\Windows\System\LQWRAaL.exe
  C:\Windows\System\LQWRAaL.exe
  2⤵
  PID:2824
- C:\Windows\System\QvYOfWo.exe
  C:\Windows\System\QvYOfWo.exe
  2⤵
  PID:3220
- C:\Windows\System\JxxDEuA.exe
  C:\Windows\System\JxxDEuA.exe
  2⤵
  PID:4232
- C:\Windows\System\qqSxFKx.exe
  C:\Windows\System\qqSxFKx.exe
  2⤵
  PID:4264
- C:\Windows\System\zrRZpoL.exe
  C:\Windows\System\zrRZpoL.exe
  2⤵
  PID:1696
- C:\Windows\System\WQWEXXW.exe
  C:\Windows\System\WQWEXXW.exe
  2⤵
  PID:1312
- C:\Windows\System\okbujOq.exe
  C:\Windows\System\okbujOq.exe
  2⤵
  PID:3380
- C:\Windows\System\SNQNQSd.exe
  C:\Windows\System\SNQNQSd.exe
  2⤵
  PID:3640
- C:\Windows\System\YHCxpqb.exe
  C:\Windows\System\YHCxpqb.exe
  2⤵
  PID:3776
- C:\Windows\System\CwrUFzz.exe
  C:\Windows\System\CwrUFzz.exe
  2⤵
  PID:4628
- C:\Windows\System\trZRbBz.exe
  C:\Windows\System\trZRbBz.exe
  2⤵
  PID:4696
- C:\Windows\System\cqzYtpp.exe
  C:\Windows\System\cqzYtpp.exe
  2⤵
  PID:3868
- C:\Windows\System\HsVmEZv.exe
  C:\Windows\System\HsVmEZv.exe
  2⤵
  PID:4856
- C:\Windows\System\dqoDKxZ.exe
  C:\Windows\System\dqoDKxZ.exe
  2⤵
  PID:296
- C:\Windows\System\WJGHzfk.exe
  C:\Windows\System\WJGHzfk.exe
  2⤵
  PID:3024
- C:\Windows\System\xHDbUPA.exe
  C:\Windows\System\xHDbUPA.exe
  2⤵
  PID:5024
- C:\Windows\System\kFidiOC.exe
  C:\Windows\System\kFidiOC.exe
  2⤵
  PID:5028
- C:\Windows\System\AqBNipY.exe
  C:\Windows\System\AqBNipY.exe
  2⤵
  PID:1688
- C:\Windows\System\cRINVGT.exe
  C:\Windows\System\cRINVGT.exe
  2⤵
  PID:4184
- C:\Windows\System\iTvPEKG.exe
  C:\Windows\System\iTvPEKG.exe
  2⤵
  PID:4316
- C:\Windows\System\XHkLXHf.exe
  C:\Windows\System\XHkLXHf.exe
  2⤵
  PID:4212
- C:\Windows\System\UemRCyH.exe
  C:\Windows\System\UemRCyH.exe
  2⤵
  PID:5256
- C:\Windows\System\NpNpXSv.exe
  C:\Windows\System\NpNpXSv.exe
  2⤵
  PID:5392
- C:\Windows\System\PfOZVcw.exe
  C:\Windows\System\PfOZVcw.exe
  2⤵
  PID:5464
- C:\Windows\System\neRssBr.exe
  C:\Windows\System\neRssBr.exe
  2⤵
  PID:5532
- C:\Windows\System\LUfFsKr.exe
  C:\Windows\System\LUfFsKr.exe
  2⤵
  PID:4380
- C:\Windows\System\vwwGnzd.exe
  C:\Windows\System\vwwGnzd.exe
  2⤵
  PID:4412
- C:\Windows\System\uPjetOh.exe
  C:\Windows\System\uPjetOh.exe
  2⤵
  PID:4508
- C:\Windows\System\BtbqdDJ.exe
  C:\Windows\System\BtbqdDJ.exe
  2⤵
  PID:4084
- C:\Windows\System\jPkUutX.exe
  C:\Windows\System\jPkUutX.exe
  2⤵
  PID:2348
- C:\Windows\System\TxRDylv.exe
  C:\Windows\System\TxRDylv.exe
  2⤵
  PID:5328
- C:\Windows\System\PzZKoSL.exe
  C:\Windows\System\PzZKoSL.exe
  2⤵
  PID:5184
- C:\Windows\System\SaNqyFh.exe
  C:\Windows\System\SaNqyFh.exe
  2⤵
  PID:1768
- C:\Windows\System\awBVPvU.exe
  C:\Windows\System\awBVPvU.exe
  2⤵
  PID:4788
- C:\Windows\System\QNyZAOA.exe
  C:\Windows\System\QNyZAOA.exe
  2⤵
  PID:4528
- C:\Windows\System\rYIZfrq.exe
  C:\Windows\System\rYIZfrq.exe
  2⤵
  PID:4464
- C:\Windows\System\SovzDYn.exe
  C:\Windows\System\SovzDYn.exe
  2⤵
  PID:4364
- C:\Windows\System\WohOSnK.exe
  C:\Windows\System\WohOSnK.exe
  2⤵
  PID:4168
- C:\Windows\System\KsalMOk.exe
  C:\Windows\System\KsalMOk.exe
  2⤵
  PID:1396
- C:\Windows\System\pFoTFMe.exe
  C:\Windows\System\pFoTFMe.exe
  2⤵
  PID:3972
- C:\Windows\System\OJcvKGW.exe
  C:\Windows\System\OJcvKGW.exe
  2⤵
  PID:3444
- C:\Windows\System\XwVrqGe.exe
  C:\Windows\System\XwVrqGe.exe
  2⤵
  PID:2236
- C:\Windows\System\oxGnTNE.exe
  C:\Windows\System\oxGnTNE.exe
  2⤵
  PID:2872
- C:\Windows\System\PsmbqfL.exe
  C:\Windows\System\PsmbqfL.exe
  2⤵
  PID:3280
- C:\Windows\System\KmUzNNz.exe
  C:\Windows\System\KmUzNNz.exe
  2⤵
  PID:4396
- C:\Windows\System\eQEuNcI.exe
  C:\Windows\System\eQEuNcI.exe
  2⤵
  PID:5988
- C:\Windows\System\XAYMUZX.exe
  C:\Windows\System\XAYMUZX.exe
  2⤵
  PID:4640
- C:\Windows\System\jlGnKSK.exe
  C:\Windows\System\jlGnKSK.exe
  2⤵
  PID:4680
- C:\Windows\System\iaMsMJf.exe
  C:\Windows\System\iaMsMJf.exe
  2⤵
  PID:4808
- C:\Windows\System\ePVKGMw.exe
  C:\Windows\System\ePVKGMw.exe
  2⤵
  PID:4872
- C:\Windows\System\JndLDTg.exe
  C:\Windows\System\JndLDTg.exe
  2⤵
  PID:4976
- C:\Windows\System\aIujhcA.exe
  C:\Windows\System\aIujhcA.exe
  2⤵
  PID:5040
- C:\Windows\System\WQdgNaf.exe
  C:\Windows\System\WQdgNaf.exe
  2⤵
  PID:5104
- C:\Windows\System\JoOtBWt.exe
  C:\Windows\System\JoOtBWt.exe
  2⤵
  PID:540
- C:\Windows\System\VbVxxDE.exe
  C:\Windows\System\VbVxxDE.exe
  2⤵
  PID:5996
- C:\Windows\System\IPHZTVK.exe
  C:\Windows\System\IPHZTVK.exe
  2⤵
  PID:5240
- C:\Windows\System\NUVWhCw.exe
  C:\Windows\System\NUVWhCw.exe
  2⤵
  PID:5308
- C:\Windows\System\yxaTnNF.exe
  C:\Windows\System\yxaTnNF.exe
  2⤵
  PID:5348
- C:\Windows\System\vRMELhh.exe
  C:\Windows\System\vRMELhh.exe
  2⤵
  PID:5412
- C:\Windows\System\DDQwqJV.exe
  C:\Windows\System\DDQwqJV.exe
  2⤵
  PID:5448
- C:\Windows\System\yXLljdD.exe
  C:\Windows\System\yXLljdD.exe
  2⤵
  PID:5660
- C:\Windows\System\gRXctmZ.exe
  C:\Windows\System\gRXctmZ.exe
  2⤵
  PID:5692
- C:\Windows\System\OgMcpmF.exe
  C:\Windows\System\OgMcpmF.exe
  2⤵
  PID:5716
- C:\Windows\System\KaDCWOa.exe
  C:\Windows\System\KaDCWOa.exe
  2⤵
  PID:5724
- C:\Windows\System\UHLrDHV.exe
  C:\Windows\System\UHLrDHV.exe
  2⤵
  PID:5752
- C:\Windows\System\xaVyrqY.exe
  C:\Windows\System\xaVyrqY.exe
  2⤵
  PID:5768
- C:\Windows\System\hSNeBIo.exe
  C:\Windows\System\hSNeBIo.exe
  2⤵
  PID:5940
- C:\Windows\System\uWmSOpA.exe
  C:\Windows\System\uWmSOpA.exe
  2⤵
  PID:6012
- C:\Windows\System\jttxPdf.exe
  C:\Windows\System\jttxPdf.exe
  2⤵
  PID:5672
- C:\Windows\System\AdsDFQp.exe
  C:\Windows\System\AdsDFQp.exe
  2⤵
  PID:5728
- C:\Windows\System\JSxnMxw.exe
  C:\Windows\System\JSxnMxw.exe
  2⤵
  PID:5788
- C:\Windows\System\mohUXqW.exe
  C:\Windows\System\mohUXqW.exe
  2⤵
  PID:5804
- C:\Windows\System\YaFhSsV.exe
  C:\Windows\System\YaFhSsV.exe
  2⤵
  PID:5824
- C:\Windows\System\SeHNwJU.exe
  C:\Windows\System\SeHNwJU.exe
  2⤵
  PID:5892
- C:\Windows\System\bPWBBIJ.exe
  C:\Windows\System\bPWBBIJ.exe
  2⤵
  PID:5596
- C:\Windows\System\oxbKxVF.exe
  C:\Windows\System\oxbKxVF.exe
  2⤵
  PID:5932
- C:\Windows\System\UyUPjdp.exe
  C:\Windows\System\UyUPjdp.exe
  2⤵
  PID:5952
- C:\Windows\System\VsHAxle.exe
  C:\Windows\System\VsHAxle.exe
  2⤵
  PID:5968
- C:\Windows\System\ztpCymY.exe
  C:\Windows\System\ztpCymY.exe
  2⤵
  PID:5984
- C:\Windows\System\mtfWDQd.exe
  C:\Windows\System\mtfWDQd.exe
  2⤵
  PID:6076
- C:\Windows\System\kjBWDlY.exe
  C:\Windows\System\kjBWDlY.exe
  2⤵
  PID:6092
- C:\Windows\System\nfiALkX.exe
  C:\Windows\System\nfiALkX.exe
  2⤵
  PID:6108
- C:\Windows\System\shixwdA.exe
  C:\Windows\System\shixwdA.exe
  2⤵
  PID:6024
- C:\Windows\System\uzalsNu.exe
  C:\Windows\System\uzalsNu.exe
  2⤵
  PID:6040
- C:\Windows\System\FIscmXd.exe
  C:\Windows\System\FIscmXd.exe
  2⤵
  PID:320
- C:\Windows\System\CtlOCtB.exe
  C:\Windows\System\CtlOCtB.exe
  2⤵
  PID:3360
- C:\Windows\System\PKzlckf.exe
  C:\Windows\System\PKzlckf.exe
  2⤵
  PID:3528
- C:\Windows\System\UjyrjqW.exe
  C:\Windows\System\UjyrjqW.exe
  2⤵
  PID:2496
- C:\Windows\System\FahuaAU.exe
  C:\Windows\System\FahuaAU.exe
  2⤵
  PID:3656
- C:\Windows\System\mvoDwxA.exe
  C:\Windows\System\mvoDwxA.exe
  2⤵
  PID:1592
- C:\Windows\System\igoIpPV.exe
  C:\Windows\System\igoIpPV.exe
  2⤵
  PID:3660
- C:\Windows\System\pIpYvhZ.exe
  C:\Windows\System\pIpYvhZ.exe
  2⤵
  PID:3692
- C:\Windows\System\fCpqoJp.exe
  C:\Windows\System\fCpqoJp.exe
  2⤵
  PID:3756
- C:\Windows\System\XQSuwca.exe
  C:\Windows\System\XQSuwca.exe
  2⤵
  PID:2708
- C:\Windows\System\yXtTfMe.exe
  C:\Windows\System\yXtTfMe.exe
  2⤵
  PID:3884
- C:\Windows\System\sVDvKpo.exe
  C:\Windows\System\sVDvKpo.exe
  2⤵
  PID:3820
- C:\Windows\System\DIkkXci.exe
  C:\Windows\System\DIkkXci.exe
  2⤵
  PID:3952
- C:\Windows\System\hewvrfv.exe
  C:\Windows\System\hewvrfv.exe
  2⤵
  PID:2672
- C:\Windows\System\CyZPBWI.exe
  C:\Windows\System\CyZPBWI.exe
  2⤵
  PID:2548
- C:\Windows\System\BMsxYQs.exe
  C:\Windows\System\BMsxYQs.exe
  2⤵
  PID:1032
- C:\Windows\System\fyxhtim.exe
  C:\Windows\System\fyxhtim.exe
  2⤵
  PID:2156
- C:\Windows\System\ErbtKja.exe
  C:\Windows\System\ErbtKja.exe
  2⤵
  PID:3080
- C:\Windows\System\teKonmF.exe
  C:\Windows\System\teKonmF.exe
  2⤵
  PID:3216
- C:\Windows\System\kVVGsKU.exe
  C:\Windows\System\kVVGsKU.exe
  2⤵
  PID:3376
- C:\Windows\System\NcrqzRc.exe
  C:\Windows\System\NcrqzRc.exe
  2⤵
  PID:2588
- C:\Windows\System\bcCPRrl.exe
  C:\Windows\System\bcCPRrl.exe
  2⤵
  PID:4260
- C:\Windows\System\qPsYCMs.exe
  C:\Windows\System\qPsYCMs.exe
  2⤵
  PID:4660
- C:\Windows\System\YujCsjY.exe
  C:\Windows\System\YujCsjY.exe
  2⤵
  PID:4756
- C:\Windows\System\HafQZIv.exe
  C:\Windows\System\HafQZIv.exe
  2⤵
  PID:4032
- C:\Windows\System\BOOeklB.exe
  C:\Windows\System\BOOeklB.exe
  2⤵
  PID:824
- C:\Windows\System\AYyThmD.exe
  C:\Windows\System\AYyThmD.exe
  2⤵
  PID:1948
- C:\Windows\System\qiUUzgm.exe
  C:\Windows\System\qiUUzgm.exe
  2⤵
  PID:2776
- C:\Windows\System\zVrOGbA.exe
  C:\Windows\System\zVrOGbA.exe
  2⤵
  PID:5060
- C:\Windows\System\HsgMqUm.exe
  C:\Windows\System\HsgMqUm.exe
  2⤵
  PID:4988
- C:\Windows\System\MgmFOPt.exe
  C:\Windows\System\MgmFOPt.exe
  2⤵
  PID:1136
- C:\Windows\System\oDwnNwb.exe
  C:\Windows\System\oDwnNwb.exe
  2⤵
  PID:2224
- C:\Windows\System\FRzKKvs.exe
  C:\Windows\System\FRzKKvs.exe
  2⤵
  PID:5168
- C:\Windows\System\HiqsOse.exe
  C:\Windows\System\HiqsOse.exe
  2⤵
  PID:1148
- C:\Windows\System\FjRboeT.exe
  C:\Windows\System\FjRboeT.exe
  2⤵
  PID:4280
- C:\Windows\System\oYnvpBa.exe
  C:\Windows\System\oYnvpBa.exe
  2⤵
  PID:4544
- C:\Windows\System\lssTLPt.exe
  C:\Windows\System\lssTLPt.exe
  2⤵
  PID:3592
- C:\Windows\System\pFIckqb.exe
  C:\Windows\System\pFIckqb.exe
  2⤵
  PID:4476
- C:\Windows\System\vcdbfML.exe
  C:\Windows\System\vcdbfML.exe
  2⤵
  PID:5332
- C:\Windows\System\GjeTibz.exe
  C:\Windows\System\GjeTibz.exe
  2⤵
  PID:4376
- C:\Windows\System\jdllWeo.exe
  C:\Windows\System\jdllWeo.exe
  2⤵
  PID:5220
- C:\Windows\System\YTQtzzQ.exe
  C:\Windows\System\YTQtzzQ.exe
  2⤵
  PID:4860
- C:\Windows\System\ykfXXTJ.exe
  C:\Windows\System\ykfXXTJ.exe
  2⤵
  PID:4136
- C:\Windows\System\dXTZSMS.exe
  C:\Windows\System\dXTZSMS.exe
  2⤵
  PID:600
- C:\Windows\System\abfySmw.exe
  C:\Windows\System\abfySmw.exe
  2⤵
  PID:2036
- C:\Windows\System\GnSehLv.exe
  C:\Windows\System\GnSehLv.exe
  2⤵
  PID:1512
- C:\Windows\System\PoqXZew.exe
  C:\Windows\System\PoqXZew.exe
  2⤵
  PID:3840
- C:\Windows\System\mKVNGLr.exe
  C:\Windows\System\mKVNGLr.exe
  2⤵
  PID:308
- C:\Windows\System\GqSlTvQ.exe
  C:\Windows\System\GqSlTvQ.exe
  2⤵
  PID:3284
- C:\Windows\System\HuruefH.exe
  C:\Windows\System\HuruefH.exe
  2⤵
  PID:2828
- C:\Windows\System\SPKUqhX.exe
  C:\Windows\System\SPKUqhX.exe
  2⤵
  PID:5444
- C:\Windows\System\NNanieF.exe
  C:\Windows\System\NNanieF.exe
  2⤵
  PID:5624
- C:\Windows\System\lNKKCxz.exe
  C:\Windows\System\lNKKCxz.exe
  2⤵
  PID:5512
- C:\Windows\System\FQcZEQg.exe
  C:\Windows\System\FQcZEQg.exe
  2⤵
  PID:5580
- C:\Windows\System\qnkbWur.exe
  C:\Windows\System\qnkbWur.exe
  2⤵
  PID:5648
- C:\Windows\System\VtubVYM.exe
  C:\Windows\System\VtubVYM.exe
  2⤵
  PID:5652
- C:\Windows\System\UAmgHmG.exe
  C:\Windows\System\UAmgHmG.exe
  2⤵
  PID:5720
- C:\Windows\System\HackwfU.exe
  C:\Windows\System\HackwfU.exe
  2⤵
  PID:5664
- C:\Windows\System\DOnwrVV.exe
  C:\Windows\System\DOnwrVV.exe
  2⤵
  PID:5764
- C:\Windows\System\HVPFbGQ.exe
  C:\Windows\System\HVPFbGQ.exe
  2⤵
  PID:5748
- C:\Windows\System\BJaYzrv.exe
  C:\Windows\System\BJaYzrv.exe
  2⤵
  PID:1400
- C:\Windows\System\JbzMyjE.exe
  C:\Windows\System\JbzMyjE.exe
  2⤵
  PID:5796
- C:\Windows\System\GnqXrZh.exe
  C:\Windows\System\GnqXrZh.exe
  2⤵
  PID:5848
- C:\Windows\System\SqnozSJ.exe
  C:\Windows\System\SqnozSJ.exe
  2⤵
  PID:5860
- C:\Windows\System\aLhzqJd.exe
  C:\Windows\System\aLhzqJd.exe
  2⤵
  PID:5872
- C:\Windows\System\cluOhrg.exe
  C:\Windows\System\cluOhrg.exe
  2⤵
  PID:5888
- C:\Windows\System\WhYKmUC.exe
  C:\Windows\System\WhYKmUC.exe
  2⤵
  PID:5936
- C:\Windows\System\ImHVhxC.exe
  C:\Windows\System\ImHVhxC.exe
  2⤵
  PID:6116
- C:\Windows\System\kPnmTiN.exe
  C:\Windows\System\kPnmTiN.exe
  2⤵
  PID:5612
- C:\Windows\System\wHKwBoD.exe
  C:\Windows\System\wHKwBoD.exe
  2⤵
  PID:6104
- C:\Windows\System\bIiIOOJ.exe
  C:\Windows\System\bIiIOOJ.exe
  2⤵
  PID:3168
- C:\Windows\System\OWgQhHw.exe
  C:\Windows\System\OWgQhHw.exe
  2⤵
  PID:3460
- C:\Windows\System\XNbCjEM.exe
  C:\Windows\System\XNbCjEM.exe
  2⤵
  PID:3364
- C:\Windows\System\Ryxyteo.exe
  C:\Windows\System\Ryxyteo.exe
  2⤵
  PID:3624
- C:\Windows\System\VhYCZcw.exe
  C:\Windows\System\VhYCZcw.exe
  2⤵
  PID:2924
- C:\Windows\System\JiNLwQE.exe
  C:\Windows\System\JiNLwQE.exe
  2⤵
  PID:3488
- C:\Windows\System\RWscfqj.exe
  C:\Windows\System\RWscfqj.exe
  2⤵
  PID:560
- C:\Windows\System\Lyjcjox.exe
  C:\Windows\System\Lyjcjox.exe
  2⤵
  PID:2904
- C:\Windows\System\GdhDgow.exe
  C:\Windows\System\GdhDgow.exe
  2⤵
  PID:4596
- C:\Windows\System\gFpKATH.exe
  C:\Windows\System\gFpKATH.exe
  2⤵
  PID:3724
- C:\Windows\System\baYWbYS.exe
  C:\Windows\System\baYWbYS.exe
  2⤵
  PID:4180
- C:\Windows\System\snMSgRv.exe
  C:\Windows\System\snMSgRv.exe
  2⤵
  PID:892
- C:\Windows\System\DaumfKM.exe
  C:\Windows\System\DaumfKM.exe
  2⤵
  PID:5468
- C:\Windows\System\fvfpUps.exe
  C:\Windows\System\fvfpUps.exe
  2⤵
  PID:3916
- C:\Windows\System\UgnOvbS.exe
  C:\Windows\System\UgnOvbS.exe
  2⤵
  PID:1932
- C:\Windows\System\paHvWsa.exe
  C:\Windows\System\paHvWsa.exe
  2⤵
  PID:3988
- C:\Windows\System\iyznlFU.exe
  C:\Windows\System\iyznlFU.exe
  2⤵
  PID:1804
- C:\Windows\System\NLOjtBq.exe
  C:\Windows\System\NLOjtBq.exe
  2⤵
  PID:3752
- C:\Windows\System\KFyBaXl.exe
  C:\Windows\System\KFyBaXl.exe
  2⤵
  PID:1636
- C:\Windows\System\kpLcqAf.exe
  C:\Windows\System\kpLcqAf.exe
  2⤵
  PID:1788
- C:\Windows\System\HfYFeTG.exe
  C:\Windows\System\HfYFeTG.exe
  2⤵
  PID:4924
- C:\Windows\System\thmoqaU.exe
  C:\Windows\System\thmoqaU.exe
  2⤵
  PID:4248
- C:\Windows\System\duGFwop.exe
  C:\Windows\System\duGFwop.exe
  2⤵
  PID:5500
- C:\Windows\System\DXHVzMa.exe
  C:\Windows\System\DXHVzMa.exe
  2⤵
  PID:5208
- C:\Windows\System\sZhGEVW.exe
  C:\Windows\System\sZhGEVW.exe
  2⤵
  PID:4560
- C:\Windows\System\UbQJTPX.exe
  C:\Windows\System\UbQJTPX.exe
  2⤵
  PID:4428
- C:\Windows\System\DkKoZAj.exe
  C:\Windows\System\DkKoZAj.exe
  2⤵
  PID:4440
- C:\Windows\System\RUMozmn.exe
  C:\Windows\System\RUMozmn.exe
  2⤵
  PID:1044
- C:\Windows\System\JmZZdxk.exe
  C:\Windows\System\JmZZdxk.exe
  2⤵
  PID:5188
- C:\Windows\System\cAgpgmj.exe
  C:\Windows\System\cAgpgmj.exe
  2⤵
  PID:2876
- C:\Windows\System\nRlRPiD.exe
  C:\Windows\System\nRlRPiD.exe
  2⤵
  PID:3836
- C:\Windows\System\eHixJvc.exe
  C:\Windows\System\eHixJvc.exe
  2⤵
  PID:2516
- C:\Windows\System\kewDdNR.exe
  C:\Windows\System\kewDdNR.exe
  2⤵
  PID:5920
- C:\Windows\System\nWnbVQU.exe
  C:\Windows\System\nWnbVQU.exe
  2⤵
  PID:6004
- C:\Windows\System\EJPtOTc.exe
  C:\Windows\System\EJPtOTc.exe
  2⤵
  PID:4772
- C:\Windows\System\URqUsyq.exe
  C:\Windows\System\URqUsyq.exe
  2⤵
  PID:4972
- C:\Windows\System\YWPCpBD.exe
  C:\Windows\System\YWPCpBD.exe
  2⤵
  PID:5744
- C:\Windows\System\bovXnEd.exe
  C:\Windows\System\bovXnEd.exe
  2⤵
  PID:5272
- C:\Windows\System\dIYrvTr.exe
  C:\Windows\System\dIYrvTr.exe
  2⤵
  PID:6016
- C:\Windows\System\FvftsQo.exe
  C:\Windows\System\FvftsQo.exe
  2⤵
  PID:5516
- C:\Windows\System\ZXqGxis.exe
  C:\Windows\System\ZXqGxis.exe
  2⤵
  PID:4348
- C:\Windows\System\gQGVJsF.exe
  C:\Windows\System\gQGVJsF.exe
  2⤵
  PID:5812
- C:\Windows\System\AWzxkiw.exe
  C:\Windows\System\AWzxkiw.exe
  2⤵
  PID:5704
- C:\Windows\System\HpxsrxW.exe
  C:\Windows\System\HpxsrxW.exe
  2⤵
  PID:5976
- C:\Windows\System\pCAoduB.exe
  C:\Windows\System\pCAoduB.exe
  2⤵
  PID:6100
- C:\Windows\System\LJzuaPK.exe
  C:\Windows\System\LJzuaPK.exe
  2⤵
  PID:5816
- C:\Windows\System\eBaxawt.exe
  C:\Windows\System\eBaxawt.exe
  2⤵
  PID:5636
- C:\Windows\System\XYxtAsu.exe
  C:\Windows\System\XYxtAsu.exe
  2⤵
  PID:5868
- C:\Windows\System\eQFvjTx.exe
  C:\Windows\System\eQFvjTx.exe
  2⤵
  PID:6052
- C:\Windows\System\zxuZwSM.exe
  C:\Windows\System\zxuZwSM.exe
  2⤵
  PID:5964
- C:\Windows\System\TMZRgXp.exe
  C:\Windows\System\TMZRgXp.exe
  2⤵
  PID:844
- C:\Windows\System\lxPUaoS.exe
  C:\Windows\System\lxPUaoS.exe
  2⤵
  PID:3296
- C:\Windows\System\mvimxBN.exe
  C:\Windows\System\mvimxBN.exe
  2⤵
  PID:1876
- C:\Windows\System\LMLDZod.exe
  C:\Windows\System\LMLDZod.exe
  2⤵
  PID:3332
- C:\Windows\System\LoNcWTC.exe
  C:\Windows\System\LoNcWTC.exe
  2⤵
  PID:2712
- C:\Windows\System\bWwDtMT.exe
  C:\Windows\System\bWwDtMT.exe
  2⤵
  PID:4228
- C:\Windows\System\UkMCpRK.exe
  C:\Windows\System\UkMCpRK.exe
  2⤵
  PID:1952
- C:\Windows\System\kLmFxWF.exe
  C:\Windows\System\kLmFxWF.exe
  2⤵
  PID:3956
- C:\Windows\System\pCOHvqb.exe
  C:\Windows\System\pCOHvqb.exe
  2⤵
  PID:4792
- C:\Windows\System\fuVurIX.exe
  C:\Windows\System\fuVurIX.exe
  2⤵
  PID:5140
- C:\Windows\System\PHiCRnu.exe
  C:\Windows\System\PHiCRnu.exe
  2⤵
  PID:1428
- C:\Windows\System\DfXPxYB.exe
  C:\Windows\System\DfXPxYB.exe
  2⤵
  PID:3636
- C:\Windows\System\QovTfHy.exe
  C:\Windows\System\QovTfHy.exe
  2⤵
  PID:4540
- C:\Windows\System\prQpQkY.exe
  C:\Windows\System\prQpQkY.exe
  2⤵
  PID:4048
- C:\Windows\System\IFyJSvV.exe
  C:\Windows\System\IFyJSvV.exe
  2⤵
  PID:4896
- C:\Windows\System\XcmNmbM.exe
  C:\Windows\System\XcmNmbM.exe
  2⤵
  PID:3560
- C:\Windows\System\nXtiYsd.exe
  C:\Windows\System\nXtiYsd.exe
  2⤵
  PID:5176
- C:\Windows\System\wUnrGjv.exe
  C:\Windows\System\wUnrGjv.exe
  2⤵
  PID:2064
- C:\Windows\System\jdYYgIb.exe
  C:\Windows\System\jdYYgIb.exe
  2⤵
  PID:4088
- C:\Windows\System\tdHQgfl.exe
  C:\Windows\System\tdHQgfl.exe
  2⤵
  PID:5076
- C:\Windows\System\lNnayXg.exe
  C:\Windows\System\lNnayXg.exe
  2⤵
  PID:4744
- C:\Windows\System\ERyFhqg.exe
  C:\Windows\System\ERyFhqg.exe
  2⤵
  PID:5380
- C:\Windows\System\DIAkTBs.exe
  C:\Windows\System\DIAkTBs.exe
  2⤵
  PID:5628
- C:\Windows\System\tWZabNq.exe
  C:\Windows\System\tWZabNq.exe
  2⤵
  PID:6088
- C:\Windows\System\bRbwCrR.exe
  C:\Windows\System\bRbwCrR.exe
  2⤵
  PID:5956
- C:\Windows\System\UbDQSaA.exe
  C:\Windows\System\UbDQSaA.exe
  2⤵
  PID:3136
- C:\Windows\System\QcxcJHQ.exe
  C:\Windows\System\QcxcJHQ.exe
  2⤵
  PID:6068
- C:\Windows\System\RNkDxJO.exe
  C:\Windows\System\RNkDxJO.exe
  2⤵
  PID:6036
- C:\Windows\System\UYCvGDc.exe
  C:\Windows\System\UYCvGDc.exe
  2⤵
  PID:3792
- C:\Windows\System\TgDnrKk.exe
  C:\Windows\System\TgDnrKk.exe
  2⤵
  PID:2476
- C:\Windows\System\nBxEroY.exe
  C:\Windows\System\nBxEroY.exe
  2⤵
  PID:5056
- C:\Windows\System\kWUuyyP.exe
  C:\Windows\System\kWUuyyP.exe
  2⤵
  PID:4888
- C:\Windows\System\lmxZPfd.exe
  C:\Windows\System\lmxZPfd.exe
  2⤵
  PID:2100
- C:\Windows\System\FwRULvV.exe
  C:\Windows\System\FwRULvV.exe
  2⤵
  PID:1528
- C:\Windows\System\apvvgaH.exe
  C:\Windows\System\apvvgaH.exe
  2⤵
  PID:5292
- C:\Windows\System\akwVGdU.exe
  C:\Windows\System\akwVGdU.exe
  2⤵
  PID:2968
- C:\Windows\System\HnaWgQS.exe
  C:\Windows\System\HnaWgQS.exe
  2⤵
  PID:5196
- C:\Windows\System\ywGOVkc.exe
  C:\Windows\System\ywGOVkc.exe
  2⤵
  PID:1256
- C:\Windows\System\hTGUaqb.exe
  C:\Windows\System\hTGUaqb.exe
  2⤵
  PID:4216
- C:\Windows\System\YwSBpcX.exe
  C:\Windows\System\YwSBpcX.exe
  2⤵
  PID:5992
- C:\Windows\System\YxFdFCQ.exe
  C:\Windows\System\YxFdFCQ.exe
  2⤵
  PID:5708
- C:\Windows\System\JXMZWFg.exe
  C:\Windows\System\JXMZWFg.exe
  2⤵
  PID:6048
- C:\Windows\System\wfRfrJD.exe
  C:\Windows\System\wfRfrJD.exe
  2⤵
  PID:2376
- C:\Windows\System\GTAuwwT.exe
  C:\Windows\System\GTAuwwT.exe
  2⤵
  PID:1672
- C:\Windows\System\mHMRHIU.exe
  C:\Windows\System\mHMRHIU.exe
  2⤵
  PID:2312
- C:\Windows\System\PkMmUVW.exe
  C:\Windows\System\PkMmUVW.exe
  2⤵
  PID:6152
- C:\Windows\System\eSZRrqo.exe
  C:\Windows\System\eSZRrqo.exe
  2⤵
  PID:6168
- C:\Windows\System\tzapPYy.exe
  C:\Windows\System\tzapPYy.exe
  2⤵
  PID:6184
- C:\Windows\System\LFlVjJS.exe
  C:\Windows\System\LFlVjJS.exe
  2⤵
  PID:6200
- C:\Windows\System\hPvAEMt.exe
  C:\Windows\System\hPvAEMt.exe
  2⤵
  PID:6216
- C:\Windows\System\RcuVRvj.exe
  C:\Windows\System\RcuVRvj.exe
  2⤵
  PID:6232
- C:\Windows\System\BafJRoR.exe
  C:\Windows\System\BafJRoR.exe
  2⤵
  PID:6248
- C:\Windows\System\hpghnLK.exe
  C:\Windows\System\hpghnLK.exe
  2⤵
  PID:6264
- C:\Windows\System\MRckZuz.exe
  C:\Windows\System\MRckZuz.exe
  2⤵
  PID:6280
- C:\Windows\System\YOHqrgc.exe
  C:\Windows\System\YOHqrgc.exe
  2⤵
  PID:6296
- C:\Windows\System\PKcjMLc.exe
  C:\Windows\System\PKcjMLc.exe
  2⤵
  PID:6312
- C:\Windows\System\tEDQahd.exe
  C:\Windows\System\tEDQahd.exe
  2⤵
  PID:6328
- C:\Windows\System\kfdTqBV.exe
  C:\Windows\System\kfdTqBV.exe
  2⤵
  PID:6344
- C:\Windows\System\MMigxXx.exe
  C:\Windows\System\MMigxXx.exe
  2⤵
  PID:6360
- C:\Windows\System\tfFYEJt.exe
  C:\Windows\System\tfFYEJt.exe
  2⤵
  PID:6376
- C:\Windows\System\hykpUej.exe
  C:\Windows\System\hykpUej.exe
  2⤵
  PID:6392
- C:\Windows\System\NCaEbEh.exe
  C:\Windows\System\NCaEbEh.exe
  2⤵
  PID:6408
- C:\Windows\System\fWrImOc.exe
  C:\Windows\System\fWrImOc.exe
  2⤵
  PID:6424
- C:\Windows\System\eWcQWWc.exe
  C:\Windows\System\eWcQWWc.exe
  2⤵
  PID:6440
- C:\Windows\System\lzMVbhv.exe
  C:\Windows\System\lzMVbhv.exe
  2⤵
  PID:6456
- C:\Windows\System\pBIvrML.exe
  C:\Windows\System\pBIvrML.exe
  2⤵
  PID:6472
- C:\Windows\System\cGILQJn.exe
  C:\Windows\System\cGILQJn.exe
  2⤵
  PID:6488
- C:\Windows\System\aVblvPI.exe
  C:\Windows\System\aVblvPI.exe
  2⤵
  PID:6504
- C:\Windows\System\WzHOkSN.exe
  C:\Windows\System\WzHOkSN.exe
  2⤵
  PID:6520
- C:\Windows\System\vXtmphY.exe
  C:\Windows\System\vXtmphY.exe
  2⤵
  PID:6536
- C:\Windows\System\APAjebL.exe
  C:\Windows\System\APAjebL.exe
  2⤵
  PID:6552
- C:\Windows\System\EIsLPVJ.exe
  C:\Windows\System\EIsLPVJ.exe
  2⤵
  PID:6568
- C:\Windows\System\IOTCWlf.exe
  C:\Windows\System\IOTCWlf.exe
  2⤵
  PID:6584
- C:\Windows\System\AvuFMbW.exe
  C:\Windows\System\AvuFMbW.exe
  2⤵
  PID:6600
- C:\Windows\System\rHUOpQw.exe
  C:\Windows\System\rHUOpQw.exe
  2⤵
  PID:6616
- C:\Windows\System\Jcrkqsi.exe
  C:\Windows\System\Jcrkqsi.exe
  2⤵
  PID:6632
- C:\Windows\System\hmJdziM.exe
  C:\Windows\System\hmJdziM.exe
  2⤵
  PID:6648
- C:\Windows\System\RxOdfso.exe
  C:\Windows\System\RxOdfso.exe
  2⤵
  PID:6664
- C:\Windows\System\TjscNLd.exe
  C:\Windows\System\TjscNLd.exe
  2⤵
  PID:6680
- C:\Windows\System\SfqMuif.exe
  C:\Windows\System\SfqMuif.exe
  2⤵
  PID:6696
- C:\Windows\System\qPTpFAH.exe
  C:\Windows\System\qPTpFAH.exe
  2⤵
  PID:6712
- C:\Windows\System\gXjWqCS.exe
  C:\Windows\System\gXjWqCS.exe
  2⤵
  PID:6728
- C:\Windows\System\cjbnokk.exe
  C:\Windows\System\cjbnokk.exe
  2⤵
  PID:6744
- C:\Windows\System\HXRoYYV.exe
  C:\Windows\System\HXRoYYV.exe
  2⤵
  PID:6760
- C:\Windows\System\hlLBkjV.exe
  C:\Windows\System\hlLBkjV.exe
  2⤵
  PID:6776
- C:\Windows\System\cbmyYMS.exe
  C:\Windows\System\cbmyYMS.exe
  2⤵
  PID:6792
- C:\Windows\System\RncwJNw.exe
  C:\Windows\System\RncwJNw.exe
  2⤵
  PID:6808
- C:\Windows\System\mJTGVRt.exe
  C:\Windows\System\mJTGVRt.exe
  2⤵
  PID:6824
- C:\Windows\System\OqZhLjO.exe
  C:\Windows\System\OqZhLjO.exe
  2⤵
  PID:6840
- C:\Windows\System\iVAArqd.exe
  C:\Windows\System\iVAArqd.exe
  2⤵
  PID:6860
- C:\Windows\System\oldGshz.exe
  C:\Windows\System\oldGshz.exe
  2⤵
  PID:6876
- C:\Windows\System\uEZZbpi.exe
  C:\Windows\System\uEZZbpi.exe
  2⤵
  PID:6892
- C:\Windows\System\mtbacuq.exe
  C:\Windows\System\mtbacuq.exe
  2⤵
  PID:6908
- C:\Windows\System\IDhWmxB.exe
  C:\Windows\System\IDhWmxB.exe
  2⤵
  PID:6924
- C:\Windows\System\oVNiwTR.exe
  C:\Windows\System\oVNiwTR.exe
  2⤵
  PID:6940
- C:\Windows\System\YlXedyh.exe
  C:\Windows\System\YlXedyh.exe
  2⤵
  PID:6956
- C:\Windows\System\jGgZXzL.exe
  C:\Windows\System\jGgZXzL.exe
  2⤵
  PID:6972
- C:\Windows\System\AQxtQgy.exe
  C:\Windows\System\AQxtQgy.exe
  2⤵
  PID:6988
- C:\Windows\System\cdusEoe.exe
  C:\Windows\System\cdusEoe.exe
  2⤵
  PID:7004
- C:\Windows\System\XcqUXcK.exe
  C:\Windows\System\XcqUXcK.exe
  2⤵
  PID:7024
- C:\Windows\System\XFMEYCL.exe
  C:\Windows\System\XFMEYCL.exe
  2⤵
  PID:7040
- C:\Windows\System\QpaKsyg.exe
  C:\Windows\System\QpaKsyg.exe
  2⤵
  PID:7056
- C:\Windows\System\oORfjxI.exe
  C:\Windows\System\oORfjxI.exe
  2⤵
  PID:7072
- C:\Windows\System\eSrOyZv.exe
  C:\Windows\System\eSrOyZv.exe
  2⤵
  PID:7088
- C:\Windows\System\RVjKaxE.exe
  C:\Windows\System\RVjKaxE.exe
  2⤵
  PID:7104
- C:\Windows\System\qKDRtYN.exe
  C:\Windows\System\qKDRtYN.exe
  2⤵
  PID:7120
- C:\Windows\System\FXdZyCJ.exe
  C:\Windows\System\FXdZyCJ.exe
  2⤵
  PID:7136
- C:\Windows\System\sFZPyGl.exe
  C:\Windows\System\sFZPyGl.exe
  2⤵
  PID:7152
- C:\Windows\System\aFSzKlJ.exe
  C:\Windows\System\aFSzKlJ.exe
  2⤵
  PID:4424
- C:\Windows\System\yHSGIwG.exe
  C:\Windows\System\yHSGIwG.exe
  2⤵
  PID:4824
- C:\Windows\System\FmwJYhu.exe
  C:\Windows\System\FmwJYhu.exe
  2⤵
  PID:6148
- C:\Windows\System\wUjhVSY.exe
  C:\Windows\System\wUjhVSY.exe
  2⤵
  PID:2724
- C:\Windows\System\Smjoase.exe
  C:\Windows\System\Smjoase.exe
  2⤵
  PID:6272
- C:\Windows\System\DmSWjdk.exe
  C:\Windows\System\DmSWjdk.exe
  2⤵
  PID:6336
- C:\Windows\System\eXmnaKe.exe
  C:\Windows\System\eXmnaKe.exe
  2⤵
  PID:6400
- C:\Windows\System\NkgDVsA.exe
  C:\Windows\System\NkgDVsA.exe
  2⤵
  PID:6192
- C:\Windows\System\WDyNjyF.exe
  C:\Windows\System\WDyNjyF.exe
  2⤵
  PID:6260
- C:\Windows\System\SCKeKUE.exe
  C:\Windows\System\SCKeKUE.exe
  2⤵
  PID:5276
- C:\Windows\System\dKTsslA.exe
  C:\Windows\System\dKTsslA.exe
  2⤵
  PID:4132
- C:\Windows\System\fsdbdNY.exe
  C:\Windows\System\fsdbdNY.exe
  2⤵
  PID:5560
- C:\Windows\System\FRUmBBR.exe
  C:\Windows\System\FRUmBBR.exe
  2⤵
  PID:5200
- C:\Windows\System\HPvYoxc.exe
  C:\Windows\System\HPvYoxc.exe
  2⤵
  PID:6448
- C:\Windows\System\ppYnmBX.exe
  C:\Windows\System\ppYnmBX.exe
  2⤵
  PID:4556
- C:\Windows\System\NsSmjLa.exe
  C:\Windows\System\NsSmjLa.exe
  2⤵
  PID:6228
- C:\Windows\System\yXIrKiu.exe
  C:\Windows\System\yXIrKiu.exe
  2⤵
  PID:6324
- C:\Windows\System\hbHUmNr.exe
  C:\Windows\System\hbHUmNr.exe
  2⤵
  PID:6388
- C:\Windows\System\iQoLtnu.exe
  C:\Windows\System\iQoLtnu.exe
  2⤵
  PID:6480
- C:\Windows\System\KTRFDZn.exe
  C:\Windows\System\KTRFDZn.exe
  2⤵
  PID:6516
- C:\Windows\System\CAUdacu.exe
  C:\Windows\System\CAUdacu.exe
  2⤵
  PID:6580
- C:\Windows\System\COIrjKJ.exe
  C:\Windows\System\COIrjKJ.exe
  2⤵
  PID:6596
- C:\Windows\System\ZTTkEzL.exe
  C:\Windows\System\ZTTkEzL.exe
  2⤵
  PID:6612
- C:\Windows\System\INgzHnZ.exe
  C:\Windows\System\INgzHnZ.exe
  2⤵
  PID:6676
- C:\Windows\System\nPadRXw.exe
  C:\Windows\System\nPadRXw.exe
  2⤵
  PID:6656
- C:\Windows\System\HvPAPrM.exe
  C:\Windows\System\HvPAPrM.exe
  2⤵
  PID:6688
- C:\Windows\System\heaJzIc.exe
  C:\Windows\System\heaJzIc.exe
  2⤵
  PID:6720
- C:\Windows\System\cpLPDnV.exe
  C:\Windows\System\cpLPDnV.exe
  2⤵
  PID:6784
- C:\Windows\System\OOrkdAO.exe
  C:\Windows\System\OOrkdAO.exe
  2⤵
  PID:6848
- C:\Windows\System\NISdctp.exe
  C:\Windows\System\NISdctp.exe
  2⤵
  PID:6916
- C:\Windows\System\bKCVDFh.exe
  C:\Windows\System\bKCVDFh.exe
  2⤵
  PID:6980
- C:\Windows\System\uSwFoZw.exe
  C:\Windows\System\uSwFoZw.exe
  2⤵
  PID:6768
- C:\Windows\System\XYqiJJV.exe
  C:\Windows\System\XYqiJJV.exe
  2⤵
  PID:6932
- C:\Windows\System\cycFEdV.exe
  C:\Windows\System\cycFEdV.exe
  2⤵
  PID:6800
- C:\Windows\System\WGZQwBy.exe
  C:\Windows\System\WGZQwBy.exe
  2⤵
  PID:6904
- C:\Windows\System\lLsEVsD.exe
  C:\Windows\System\lLsEVsD.exe
  2⤵
  PID:6996
- C:\Windows\System\hiJsEVg.exe
  C:\Windows\System\hiJsEVg.exe
  2⤵
  PID:7096
- C:\Windows\System\dCRnBAd.exe
  C:\Windows\System\dCRnBAd.exe
  2⤵
  PID:7080
- C:\Windows\System\wgXFemA.exe
  C:\Windows\System\wgXFemA.exe
  2⤵
  PID:7144
- C:\Windows\System\lkrfmdL.exe
  C:\Windows\System\lkrfmdL.exe
  2⤵
  PID:7016
- C:\Windows\System\ThqBJhG.exe
  C:\Windows\System\ThqBJhG.exe
  2⤵
  PID:6304
- C:\Windows\System\YjZSDDO.exe
  C:\Windows\System\YjZSDDO.exe
  2⤵
  PID:7160
- C:\Windows\System\MDDIKso.exe
  C:\Windows\System\MDDIKso.exe
  2⤵
  PID:6244
- C:\Windows\System\FUbtmsw.exe
  C:\Windows\System\FUbtmsw.exe
  2⤵
  PID:3888
- C:\Windows\System\zzABljc.exe
  C:\Windows\System\zzABljc.exe
  2⤵
  PID:4944
- C:\Windows\System\pyjyXNK.exe
  C:\Windows\System\pyjyXNK.exe
  2⤵
  PID:6196
- C:\Windows\System\fhlDvbk.exe
  C:\Windows\System\fhlDvbk.exe
  2⤵
  PID:6368
- C:\Windows\System\mKPPyRF.exe
  C:\Windows\System\mKPPyRF.exe
  2⤵
  PID:5288
- C:\Windows\System\QPmfRAd.exe
  C:\Windows\System\QPmfRAd.exe
  2⤵
  PID:6484
- C:\Windows\System\EWCpWAw.exe
  C:\Windows\System\EWCpWAw.exe
  2⤵
  PID:6640
- C:\Windows\System\rmeNEYh.exe
  C:\Windows\System\rmeNEYh.exe
  2⤵
  PID:6496
- C:\Windows\System\hAFoAcr.exe
  C:\Windows\System\hAFoAcr.exe
  2⤵
  PID:6320
- C:\Windows\System\ExjJXkc.exe
  C:\Windows\System\ExjJXkc.exe
  2⤵
  PID:6888
- C:\Windows\System\jhcEcDs.exe
  C:\Windows\System\jhcEcDs.exe
  2⤵
  PID:6900
- C:\Windows\System\gkFFFsH.exe
  C:\Windows\System\gkFFFsH.exe
  2⤵
  PID:6968
- C:\Windows\System\iYoEBky.exe
  C:\Windows\System\iYoEBky.exe
  2⤵
  PID:4740
- C:\Windows\System\ELoxXGo.exe
  C:\Windows\System\ELoxXGo.exe
  2⤵
  PID:6436
- C:\Windows\System\lgxSEkf.exe
  C:\Windows\System\lgxSEkf.exe
  2⤵
  PID:6592
- C:\Windows\System\XunxbnC.exe
  C:\Windows\System\XunxbnC.exe
  2⤵
  PID:6752
- C:\Windows\System\pcpVujP.exe
  C:\Windows\System\pcpVujP.exe
  2⤵
  PID:5904
- C:\Windows\System\YUeasdR.exe
  C:\Windows\System\YUeasdR.exe
  2⤵
  PID:3736
- C:\Windows\System\IefCfRm.exe
  C:\Windows\System\IefCfRm.exe
  2⤵
  PID:2960
- C:\Windows\System\aKNCWLE.exe
  C:\Windows\System\aKNCWLE.exe
  2⤵
  PID:5680
- C:\Windows\System\RQNgcdN.exe
  C:\Windows\System\RQNgcdN.exe
  2⤵
  PID:6952
- C:\Windows\System\OrVKcED.exe
  C:\Windows\System\OrVKcED.exe
  2⤵
  PID:6872
- C:\Windows\System\NJoCRvR.exe
  C:\Windows\System\NJoCRvR.exe
  2⤵
  PID:7116
- C:\Windows\System\CPCKojd.exe
  C:\Windows\System\CPCKojd.exe
  2⤵
  PID:6384
- C:\Windows\System\pyWOJvq.exe
  C:\Windows\System\pyWOJvq.exe
  2⤵
  PID:6704
- C:\Windows\System\TLxGJLv.exe
  C:\Windows\System\TLxGJLv.exe
  2⤵
  PID:5884
- C:\Windows\System\PaDJyEj.exe
  C:\Windows\System\PaDJyEj.exe
  2⤵
  PID:5224
- C:\Windows\System\JuitUqG.exe
  C:\Windows\System\JuitUqG.exe
  2⤵
  PID:6452
- C:\Windows\System\MogAdRN.exe
  C:\Windows\System\MogAdRN.exe
  2⤵
  PID:6948
- C:\Windows\System\sqyqCrA.exe
  C:\Windows\System\sqyqCrA.exe
  2⤵
  PID:6884
- C:\Windows\System\PavQcMj.exe
  C:\Windows\System\PavQcMj.exe
  2⤵
  PID:6820
- C:\Windows\System\OHBAhRJ.exe
  C:\Windows\System\OHBAhRJ.exe
  2⤵
  PID:6256
- C:\Windows\System\EHAYmJv.exe
  C:\Windows\System\EHAYmJv.exe
  2⤵
  PID:6708
- C:\Windows\System\EIFValL.exe
  C:\Windows\System\EIFValL.exe
  2⤵
  PID:6964
- C:\Windows\System\iPDuWGQ.exe
  C:\Windows\System\iPDuWGQ.exe
  2⤵
  PID:7172
- C:\Windows\System\WIymQfX.exe
  C:\Windows\System\WIymQfX.exe
  2⤵
  PID:7188
- C:\Windows\System\FAswfiu.exe
  C:\Windows\System\FAswfiu.exe
  2⤵
  PID:7204
- C:\Windows\System\LNemPBE.exe
  C:\Windows\System\LNemPBE.exe
  2⤵
  PID:7224
- C:\Windows\System\BbcSqWo.exe
  C:\Windows\System\BbcSqWo.exe
  2⤵
  PID:7240
- C:\Windows\System\FXvozcp.exe
  C:\Windows\System\FXvozcp.exe
  2⤵
  PID:7256
- C:\Windows\System\cBPwsWH.exe
  C:\Windows\System\cBPwsWH.exe
  2⤵
  PID:7272
- C:\Windows\System\nlTdzrs.exe
  C:\Windows\System\nlTdzrs.exe
  2⤵
  PID:7288
- C:\Windows\System\nydBmHr.exe
  C:\Windows\System\nydBmHr.exe
  2⤵
  PID:7304
- C:\Windows\System\lnmxtkJ.exe
  C:\Windows\System\lnmxtkJ.exe
  2⤵
  PID:7320
- C:\Windows\System\RskMvrJ.exe
  C:\Windows\System\RskMvrJ.exe
  2⤵
  PID:7336
- C:\Windows\System\IATaqnQ.exe
  C:\Windows\System\IATaqnQ.exe
  2⤵
  PID:7352
- C:\Windows\System\aBcSKta.exe
  C:\Windows\System\aBcSKta.exe
  2⤵
  PID:7368
- C:\Windows\System\TRXRiTR.exe
  C:\Windows\System\TRXRiTR.exe
  2⤵
  PID:7384
- C:\Windows\System\tABlCDG.exe
  C:\Windows\System\tABlCDG.exe
  2⤵
  PID:7400
- C:\Windows\System\HgJrWXa.exe
  C:\Windows\System\HgJrWXa.exe
  2⤵
  PID:7416
- C:\Windows\System\AfvzUhR.exe
  C:\Windows\System\AfvzUhR.exe
  2⤵
  PID:7432
- C:\Windows\System\lokISWj.exe
  C:\Windows\System\lokISWj.exe
  2⤵
  PID:7448
- C:\Windows\System\DbUNjqp.exe
  C:\Windows\System\DbUNjqp.exe
  2⤵
  PID:7464
- C:\Windows\System\zjkAzxL.exe
  C:\Windows\System\zjkAzxL.exe
  2⤵
  PID:7480
- C:\Windows\System\ypaxxDh.exe
  C:\Windows\System\ypaxxDh.exe
  2⤵
  PID:7496
- C:\Windows\System\DZXaJCi.exe
  C:\Windows\System\DZXaJCi.exe
  2⤵
  PID:7512
- C:\Windows\System\ajQPfov.exe
  C:\Windows\System\ajQPfov.exe
  2⤵
  PID:7528
- C:\Windows\System\uAbPwCT.exe
  C:\Windows\System\uAbPwCT.exe
  2⤵
  PID:7544
- C:\Windows\System\HiRRvss.exe
  C:\Windows\System\HiRRvss.exe
  2⤵
  PID:7560
- C:\Windows\System\LkjHMcK.exe
  C:\Windows\System\LkjHMcK.exe
  2⤵
  PID:7576
- C:\Windows\System\OXmqVSX.exe
  C:\Windows\System\OXmqVSX.exe
  2⤵
  PID:7592
- C:\Windows\System\CeTEVSU.exe
  C:\Windows\System\CeTEVSU.exe
  2⤵
  PID:7608
- C:\Windows\System\iOlmpeI.exe
  C:\Windows\System\iOlmpeI.exe
  2⤵
  PID:7624
- C:\Windows\System\AEAzGtJ.exe
  C:\Windows\System\AEAzGtJ.exe
  2⤵
  PID:7640
- C:\Windows\System\szRlqmf.exe
  C:\Windows\System\szRlqmf.exe
  2⤵
  PID:7656
- C:\Windows\System\MFPFAch.exe
  C:\Windows\System\MFPFAch.exe
  2⤵
  PID:7672
- C:\Windows\System\xFoBamw.exe
  C:\Windows\System\xFoBamw.exe
  2⤵
  PID:7688
- C:\Windows\System\uASkkdk.exe
  C:\Windows\System\uASkkdk.exe
  2⤵
  PID:7704
- C:\Windows\System\pzhUDXB.exe
  C:\Windows\System\pzhUDXB.exe
  2⤵
  PID:7720
- C:\Windows\System\gFvtGwz.exe
  C:\Windows\System\gFvtGwz.exe
  2⤵
  PID:7736
- C:\Windows\System\vbfDLEF.exe
  C:\Windows\System\vbfDLEF.exe
  2⤵
  PID:7752
- C:\Windows\System\UXWjozO.exe
  C:\Windows\System\UXWjozO.exe
  2⤵
  PID:7768
- C:\Windows\System\TVMcaBB.exe
  C:\Windows\System\TVMcaBB.exe
  2⤵
  PID:7784
- C:\Windows\System\wzLNkeG.exe
  C:\Windows\System\wzLNkeG.exe
  2⤵
  PID:7800
- C:\Windows\System\DWMlGly.exe
  C:\Windows\System\DWMlGly.exe
  2⤵
  PID:7816
- C:\Windows\System\AtwFmcS.exe
  C:\Windows\System\AtwFmcS.exe
  2⤵
  PID:7832
- C:\Windows\System\pKPXBBp.exe
  C:\Windows\System\pKPXBBp.exe
  2⤵
  PID:7848
- C:\Windows\System\PGfeBOG.exe
  C:\Windows\System\PGfeBOG.exe
  2⤵
  PID:7864
- C:\Windows\System\RZdmdSE.exe
  C:\Windows\System\RZdmdSE.exe
  2⤵
  PID:7880
- C:\Windows\System\gKWXZcn.exe
  C:\Windows\System\gKWXZcn.exe
  2⤵
  PID:7896
- C:\Windows\System\dWqFZho.exe
  C:\Windows\System\dWqFZho.exe
  2⤵
  PID:7912
- C:\Windows\System\niKCHlN.exe
  C:\Windows\System\niKCHlN.exe
  2⤵
  PID:7928
- C:\Windows\System\MDqUMhs.exe
  C:\Windows\System\MDqUMhs.exe
  2⤵
  PID:7944
- C:\Windows\System\bjBfTRG.exe
  C:\Windows\System\bjBfTRG.exe
  2⤵
  PID:7960
- C:\Windows\System\RPqgkov.exe
  C:\Windows\System\RPqgkov.exe
  2⤵
  PID:7976
- C:\Windows\System\pzDTRyI.exe
  C:\Windows\System\pzDTRyI.exe
  2⤵
  PID:7992
- C:\Windows\System\DqrRPnp.exe
  C:\Windows\System\DqrRPnp.exe
  2⤵
  PID:8008
- C:\Windows\System\rgdZnTn.exe
  C:\Windows\System\rgdZnTn.exe
  2⤵
  PID:8024
- C:\Windows\System\aQbtJuc.exe
  C:\Windows\System\aQbtJuc.exe
  2⤵
  PID:8040
- C:\Windows\System\MKwtGnQ.exe
  C:\Windows\System\MKwtGnQ.exe
  2⤵
  PID:8056
- C:\Windows\System\ATaeXiu.exe
  C:\Windows\System\ATaeXiu.exe
  2⤵
  PID:8072
- C:\Windows\System\wreqbOx.exe
  C:\Windows\System\wreqbOx.exe
  2⤵
  PID:8088
- C:\Windows\System\rnVNvzQ.exe
  C:\Windows\System\rnVNvzQ.exe
  2⤵
  PID:8104
- C:\Windows\System\QFUyfHs.exe
  C:\Windows\System\QFUyfHs.exe
  2⤵
  PID:8120
- C:\Windows\System\vINKEnQ.exe
  C:\Windows\System\vINKEnQ.exe
  2⤵
  PID:8140
- C:\Windows\System\BkFVpDp.exe
  C:\Windows\System\BkFVpDp.exe
  2⤵
  PID:8156
- C:\Windows\System\KvqjyEi.exe
  C:\Windows\System\KvqjyEi.exe
  2⤵
  PID:8172
- C:\Windows\System\DKrzjjj.exe
  C:\Windows\System\DKrzjjj.exe
  2⤵
  PID:8188
- C:\Windows\System\PIpuTnz.exe
  C:\Windows\System\PIpuTnz.exe
  2⤵
  PID:6832
- C:\Windows\System\uNoFMuy.exe
  C:\Windows\System\uNoFMuy.exe
  2⤵
  PID:7232
- C:\Windows\System\TmmFPaX.exe
  C:\Windows\System\TmmFPaX.exe
  2⤵
  PID:4080
- C:\Windows\System\JrKMznX.exe
  C:\Windows\System\JrKMznX.exe
  2⤵
  PID:7332
- C:\Windows\System\TNiBEYC.exe
  C:\Windows\System\TNiBEYC.exe
  2⤵
  PID:7180
- C:\Windows\System\SOsOEHg.exe
  C:\Windows\System\SOsOEHg.exe
  2⤵
  PID:7216
- C:\Windows\System\qIUEbbM.exe
  C:\Windows\System\qIUEbbM.exe
  2⤵
  PID:7408
- C:\Windows\System\WXWcZLv.exe
  C:\Windows\System\WXWcZLv.exe
  2⤵
  PID:7280
- C:\Windows\System\SQdAECC.exe
  C:\Windows\System\SQdAECC.exe
  2⤵
  PID:7344
- C:\Windows\System\BGNOoHd.exe
  C:\Windows\System\BGNOoHd.exe
  2⤵
  PID:7456
- C:\Windows\System\ytFVRIC.exe
  C:\Windows\System\ytFVRIC.exe
  2⤵
  PID:7492
- C:\Windows\System\XhHpROf.exe
  C:\Windows\System\XhHpROf.exe
  2⤵
  PID:7472
- C:\Windows\System\PuirmoZ.exe
  C:\Windows\System\PuirmoZ.exe
  2⤵
  PID:7444
- C:\Windows\System\qKpjlFT.exe
  C:\Windows\System\qKpjlFT.exe
  2⤵
  PID:7556
- C:\Windows\System\UfkIpxu.exe
  C:\Windows\System\UfkIpxu.exe
  2⤵
  PID:7568
- C:\Windows\System\QNyhoYZ.exe
  C:\Windows\System\QNyhoYZ.exe
  2⤵
  PID:7620
- C:\Windows\System\QufaOcw.exe
  C:\Windows\System\QufaOcw.exe
  2⤵
  PID:7668
- C:\Windows\System\rNTvZUs.exe
  C:\Windows\System\rNTvZUs.exe
  2⤵
  PID:7696
- C:\Windows\System\iDJxroA.exe
  C:\Windows\System\iDJxroA.exe
  2⤵
  PID:7716
- C:\Windows\System\bXhHgcU.exe
  C:\Windows\System\bXhHgcU.exe
  2⤵
  PID:7780
- C:\Windows\System\QTxsEVX.exe
  C:\Windows\System\QTxsEVX.exe
  2⤵
  PID:7732
- C:\Windows\System\RsAumpn.exe
  C:\Windows\System\RsAumpn.exe
  2⤵
  PID:7796
- C:\Windows\System\MnyacPf.exe
  C:\Windows\System\MnyacPf.exe
  2⤵
  PID:7828
- C:\Windows\System\eoONpsc.exe
  C:\Windows\System\eoONpsc.exe
  2⤵
  PID:7888
- C:\Windows\System\SHfwUcL.exe
  C:\Windows\System\SHfwUcL.exe
  2⤵
  PID:7908
- C:\Windows\System\FTDwYSt.exe
  C:\Windows\System\FTDwYSt.exe
  2⤵
  PID:7924
- C:\Windows\System\PxwVZMF.exe
  C:\Windows\System\PxwVZMF.exe
  2⤵
  PID:7972
- C:\Windows\System\mXzcYdp.exe
  C:\Windows\System\mXzcYdp.exe
  2⤵
  PID:8004
- C:\Windows\System\AEoFLWJ.exe
  C:\Windows\System\AEoFLWJ.exe
  2⤵
  PID:8068
- C:\Windows\System\eCEjBER.exe
  C:\Windows\System\eCEjBER.exe
  2⤵
  PID:8112
- C:\Windows\System\hnafRDf.exe
  C:\Windows\System\hnafRDf.exe
  2⤵
  PID:8148
- C:\Windows\System\wbbNglx.exe
  C:\Windows\System\wbbNglx.exe
  2⤵
  PID:8164
- C:\Windows\System\GIHZwtR.exe
  C:\Windows\System\GIHZwtR.exe
  2⤵
  PID:7268
- C:\Windows\System\jFKoqpB.exe
  C:\Windows\System\jFKoqpB.exe
  2⤵
  PID:8152
- C:\Windows\System\HffJcRQ.exe
  C:\Windows\System\HffJcRQ.exe
  2⤵
  PID:8052
- C:\Windows\System\lEeZlva.exe
  C:\Windows\System\lEeZlva.exe
  2⤵
  PID:7488
- C:\Windows\System\xrVCFst.exe
  C:\Windows\System\xrVCFst.exe
  2⤵
  PID:7588
- C:\Windows\System\NJVCqOq.exe
  C:\Windows\System\NJVCqOq.exe
  2⤵
  PID:7636
- C:\Windows\System\aqWVrwH.exe
  C:\Windows\System\aqWVrwH.exe
  2⤵
  PID:7380
- C:\Windows\System\vrmQWwL.exe
  C:\Windows\System\vrmQWwL.exe
  2⤵
  PID:7300
- C:\Windows\System\tQvvMyd.exe
  C:\Windows\System\tQvvMyd.exe
  2⤵
  PID:7424
- C:\Windows\System\kerSFBr.exe
  C:\Windows\System\kerSFBr.exe
  2⤵
  PID:7536
- C:\Windows\System\nyhSduV.exe
  C:\Windows\System\nyhSduV.exe
  2⤵
  PID:7652
- C:\Windows\System\KuIiKUP.exe
  C:\Windows\System\KuIiKUP.exe
  2⤵
  PID:7728
- C:\Windows\System\YykVnCu.exe
  C:\Windows\System\YykVnCu.exe
  2⤵
  PID:7824
- C:\Windows\System\VWgYfvF.exe
  C:\Windows\System\VWgYfvF.exe
  2⤵
  PID:7956
- C:\Windows\System\mpVzbpU.exe
  C:\Windows\System\mpVzbpU.exe
  2⤵
  PID:7968
- C:\Windows\System\dWFWDle.exe
  C:\Windows\System\dWFWDle.exe
  2⤵
  PID:8064
- C:\Windows\System\gIvwwzJ.exe
  C:\Windows\System\gIvwwzJ.exe
  2⤵
  PID:8096
- C:\Windows\System\Gilftgy.exe
  C:\Windows\System\Gilftgy.exe
  2⤵
  PID:6356
- C:\Windows\System\UIrotMr.exe
  C:\Windows\System\UIrotMr.exe
  2⤵
  PID:7440
- C:\Windows\System\wLLBKni.exe
  C:\Windows\System\wLLBKni.exe
  2⤵
  PID:7396
- C:\Windows\System\kJFknsw.exe
  C:\Windows\System\kJFknsw.exe
  2⤵
  PID:7844
- C:\Windows\System\KynhRSq.exe
  C:\Windows\System\KynhRSq.exe
  2⤵
  PID:7364
- C:\Windows\System\kouCgNK.exe
  C:\Windows\System\kouCgNK.exe
  2⤵
  PID:8180
- C:\Windows\System\cTSnPDe.exe
  C:\Windows\System\cTSnPDe.exe
  2⤵
  PID:7248
- C:\Windows\System\hEQMgud.exe
  C:\Windows\System\hEQMgud.exe
  2⤵
  PID:8196
- C:\Windows\System\WryTXjK.exe
  C:\Windows\System\WryTXjK.exe
  2⤵
  PID:8212
- C:\Windows\System\hElexqh.exe
  C:\Windows\System\hElexqh.exe
  2⤵
  PID:8228
- C:\Windows\System\cVUHguD.exe
  C:\Windows\System\cVUHguD.exe
  2⤵
  PID:8244
- C:\Windows\System\CNXfBAz.exe
  C:\Windows\System\CNXfBAz.exe
  2⤵
  PID:8260
- C:\Windows\System\FSvcsIW.exe
  C:\Windows\System\FSvcsIW.exe
  2⤵
  PID:8276
- C:\Windows\System\GzdkVeO.exe
  C:\Windows\System\GzdkVeO.exe
  2⤵
  PID:8292
- C:\Windows\System\xDMliUu.exe
  C:\Windows\System\xDMliUu.exe
  2⤵
  PID:8308
- C:\Windows\System\MxJrPum.exe
  C:\Windows\System\MxJrPum.exe
  2⤵
  PID:8324
- C:\Windows\System\dOLDImq.exe
  C:\Windows\System\dOLDImq.exe
  2⤵
  PID:8340
- C:\Windows\System\dzjSCSf.exe
  C:\Windows\System\dzjSCSf.exe
  2⤵
  PID:8356
- C:\Windows\System\xeUmSfG.exe
  C:\Windows\System\xeUmSfG.exe
  2⤵
  PID:8372
- C:\Windows\System\FyrfKbi.exe
  C:\Windows\System\FyrfKbi.exe
  2⤵
  PID:8388
- C:\Windows\System\AGMekEm.exe
  C:\Windows\System\AGMekEm.exe
  2⤵
  PID:8404
- C:\Windows\System\SrXGmBk.exe
  C:\Windows\System\SrXGmBk.exe
  2⤵
  PID:8420
- C:\Windows\System\tVuDEYB.exe
  C:\Windows\System\tVuDEYB.exe
  2⤵
  PID:8436
- C:\Windows\System\HaHxyIE.exe
  C:\Windows\System\HaHxyIE.exe
  2⤵
  PID:8452
- C:\Windows\System\QkIiHOs.exe
  C:\Windows\System\QkIiHOs.exe
  2⤵
  PID:8472
- C:\Windows\System\pNRNwOi.exe
  C:\Windows\System\pNRNwOi.exe
  2⤵
  PID:8488
- C:\Windows\System\PztNEjn.exe
  C:\Windows\System\PztNEjn.exe
  2⤵
  PID:8504
- C:\Windows\System\UJkcPLL.exe
  C:\Windows\System\UJkcPLL.exe
  2⤵
  PID:8520
- C:\Windows\System\aXSqmaU.exe
  C:\Windows\System\aXSqmaU.exe
  2⤵
  PID:8536
- C:\Windows\System\HOitjfq.exe
  C:\Windows\System\HOitjfq.exe
  2⤵
  PID:8552
- C:\Windows\System\XkbOiVu.exe
  C:\Windows\System\XkbOiVu.exe
  2⤵
  PID:8568
- C:\Windows\System\ZVxfMiD.exe
  C:\Windows\System\ZVxfMiD.exe
  2⤵
  PID:8584
- C:\Windows\System\IYdtabn.exe
  C:\Windows\System\IYdtabn.exe
  2⤵
  PID:8600
- C:\Windows\System\JOCZBaO.exe
  C:\Windows\System\JOCZBaO.exe
  2⤵
  PID:8616
- C:\Windows\System\RDUwjCa.exe
  C:\Windows\System\RDUwjCa.exe
  2⤵
  PID:8632
- C:\Windows\System\EknHAQu.exe
  C:\Windows\System\EknHAQu.exe
  2⤵
  PID:8648
- C:\Windows\System\MITHRsw.exe
  C:\Windows\System\MITHRsw.exe
  2⤵
  PID:8664
- C:\Windows\System\HRDEQEE.exe
  C:\Windows\System\HRDEQEE.exe
  2⤵
  PID:8680
- C:\Windows\System\WLRGEXc.exe
  C:\Windows\System\WLRGEXc.exe
  2⤵
  PID:8696
- C:\Windows\System\GsICIpq.exe
  C:\Windows\System\GsICIpq.exe
  2⤵
  PID:8712
- C:\Windows\System\vQjFEJn.exe
  C:\Windows\System\vQjFEJn.exe
  2⤵
  PID:8728
- C:\Windows\System\SKXUvTd.exe
  C:\Windows\System\SKXUvTd.exe
  2⤵
  PID:8744
- C:\Windows\System\XdIevLj.exe
  C:\Windows\System\XdIevLj.exe
  2⤵
  PID:8760
- C:\Windows\System\tYIcarn.exe
  C:\Windows\System\tYIcarn.exe
  2⤵
  PID:8776
- C:\Windows\System\wgRZUPi.exe
  C:\Windows\System\wgRZUPi.exe
  2⤵
  PID:8792
- C:\Windows\System\zIIuUWG.exe
  C:\Windows\System\zIIuUWG.exe
  2⤵
  PID:8808
- C:\Windows\System\IPuNljO.exe
  C:\Windows\System\IPuNljO.exe
  2⤵
  PID:8824
- C:\Windows\System\hEwIKAP.exe
  C:\Windows\System\hEwIKAP.exe
  2⤵
  PID:8840
- C:\Windows\System\UgyRaZk.exe
  C:\Windows\System\UgyRaZk.exe
  2⤵
  PID:8856
- C:\Windows\System\hdgObPI.exe
  C:\Windows\System\hdgObPI.exe
  2⤵
  PID:8872
- C:\Windows\System\HjjvgxB.exe
  C:\Windows\System\HjjvgxB.exe
  2⤵
  PID:8888
- C:\Windows\System\rxWjwpG.exe
  C:\Windows\System\rxWjwpG.exe
  2⤵
  PID:8904
- C:\Windows\System\jLNXQmn.exe
  C:\Windows\System\jLNXQmn.exe
  2⤵
  PID:8920
- C:\Windows\System\HzaIzGF.exe
  C:\Windows\System\HzaIzGF.exe
  2⤵
  PID:8936
- C:\Windows\System\dluqCTO.exe
  C:\Windows\System\dluqCTO.exe
  2⤵
  PID:8952
- C:\Windows\System\jPUjpBj.exe
  C:\Windows\System\jPUjpBj.exe
  2⤵
  PID:8968
- C:\Windows\System\qIihlif.exe
  C:\Windows\System\qIihlif.exe
  2⤵
  PID:8984
- C:\Windows\System\oGwgXIA.exe
  C:\Windows\System\oGwgXIA.exe
  2⤵
  PID:9000
- C:\Windows\System\SGnTXoN.exe
  C:\Windows\System\SGnTXoN.exe
  2⤵
  PID:9016
- C:\Windows\System\HtsIjhL.exe
  C:\Windows\System\HtsIjhL.exe
  2⤵
  PID:9032
- C:\Windows\System\MHAmxBy.exe
  C:\Windows\System\MHAmxBy.exe
  2⤵
  PID:9048
- C:\Windows\System\ENJHkPN.exe
  C:\Windows\System\ENJHkPN.exe
  2⤵
  PID:9064
- C:\Windows\System\WMchhKK.exe
  C:\Windows\System\WMchhKK.exe
  2⤵
  PID:9080
- C:\Windows\System\KOSSXEb.exe
  C:\Windows\System\KOSSXEb.exe
  2⤵
  PID:9096
- C:\Windows\System\QlWLBbk.exe
  C:\Windows\System\QlWLBbk.exe
  2⤵
  PID:9112
- C:\Windows\System\Cskcrhd.exe
  C:\Windows\System\Cskcrhd.exe
  2⤵
  PID:9128
- C:\Windows\System\MfYZNCk.exe
  C:\Windows\System\MfYZNCk.exe
  2⤵
  PID:9144
- C:\Windows\System\gTQvDBR.exe
  C:\Windows\System\gTQvDBR.exe
  2⤵
  PID:9160
- C:\Windows\System\JEHXHDp.exe
  C:\Windows\System\JEHXHDp.exe
  2⤵
  PID:9176
- C:\Windows\System\UPwEyNM.exe
  C:\Windows\System\UPwEyNM.exe
  2⤵
  PID:9192
- C:\Windows\System\nEJoWcu.exe
  C:\Windows\System\nEJoWcu.exe
  2⤵
  PID:9208
- C:\Windows\System\oZfxcdp.exe
  C:\Windows\System\oZfxcdp.exe
  2⤵
  PID:7552
- C:\Windows\System\LdaAgNF.exe
  C:\Windows\System\LdaAgNF.exe
  2⤵
  PID:8256
- C:\Windows\System\eAGmFVM.exe
  C:\Windows\System\eAGmFVM.exe
  2⤵
  PID:8320
- C:\Windows\System\ilOBczH.exe
  C:\Windows\System\ilOBczH.exe
  2⤵
  PID:8136
- C:\Windows\System\wJBYuFF.exe
  C:\Windows\System\wJBYuFF.exe
  2⤵
  PID:8412
- C:\Windows\System\SUcNCEm.exe
  C:\Windows\System\SUcNCEm.exe
  2⤵
  PID:7632
- C:\Windows\System\agqKvel.exe
  C:\Windows\System\agqKvel.exe
  2⤵
  PID:8208
- C:\Windows\System\pypmBfy.exe
  C:\Windows\System\pypmBfy.exe
  2⤵
  PID:7952
- C:\Windows\System\LHsfiPe.exe
  C:\Windows\System\LHsfiPe.exe
  2⤵
  PID:8300
- C:\Windows\System\HhpBmSg.exe
  C:\Windows\System\HhpBmSg.exe
  2⤵
  PID:7988
- C:\Windows\System\WOqWJDN.exe
  C:\Windows\System\WOqWJDN.exe
  2⤵
  PID:7940
- C:\Windows\System\NeEvUeF.exe
  C:\Windows\System\NeEvUeF.exe
  2⤵
  PID:8240
- C:\Windows\System\WqlsSmF.exe
  C:\Windows\System\WqlsSmF.exe
  2⤵
  PID:8364
- C:\Windows\System\nXVjfgJ.exe
  C:\Windows\System\nXVjfgJ.exe
  2⤵
  PID:8432
- C:\Windows\System\rTImznI.exe
  C:\Windows\System\rTImznI.exe
  2⤵
  PID:8496
- C:\Windows\System\TkaSABl.exe
  C:\Windows\System\TkaSABl.exe
  2⤵
  PID:8464
- C:\Windows\System\IRrYrVq.exe
  C:\Windows\System\IRrYrVq.exe
  2⤵
  PID:8580
- C:\Windows\System\GAENklc.exe
  C:\Windows\System\GAENklc.exe
  2⤵
  PID:8592
- C:\Windows\System\ccieUgo.exe
  C:\Windows\System\ccieUgo.exe
  2⤵
  PID:8640
- C:\Windows\System\QSFLqLa.exe
  C:\Windows\System\QSFLqLa.exe
  2⤵
  PID:8656
- C:\Windows\System\EEixFcn.exe
  C:\Windows\System\EEixFcn.exe
  2⤵
  PID:8628
- C:\Windows\System\zktrndy.exe
  C:\Windows\System\zktrndy.exe
  2⤵
  PID:8740
- C:\Windows\System\EWGcQPX.exe
  C:\Windows\System\EWGcQPX.exe
  2⤵
  PID:8720
- C:\Windows\System\pqQfeOs.exe
  C:\Windows\System\pqQfeOs.exe
  2⤵
  PID:8804
- C:\Windows\System\nNxapWT.exe
  C:\Windows\System\nNxapWT.exe
  2⤵
  PID:8756
- C:\Windows\System\khMXcnE.exe
  C:\Windows\System\khMXcnE.exe
  2⤵
  PID:8864
- C:\Windows\System\jbrIzxF.exe
  C:\Windows\System\jbrIzxF.exe
  2⤵
  PID:8868
- C:\Windows\System\ccVbGXQ.exe
  C:\Windows\System\ccVbGXQ.exe
  2⤵
  PID:8964
- C:\Windows\System\kPOJpvA.exe
  C:\Windows\System\kPOJpvA.exe
  2⤵
  PID:9028
- C:\Windows\System\EBcCIcR.exe
  C:\Windows\System\EBcCIcR.exe
  2⤵
  PID:9088
- C:\Windows\System\zjNTosA.exe
  C:\Windows\System\zjNTosA.exe
  2⤵
  PID:9124
- C:\Windows\System\glTsXSB.exe
  C:\Windows\System\glTsXSB.exe
  2⤵
  PID:9188
- C:\Windows\System\QGetAyS.exe
  C:\Windows\System\QGetAyS.exe
  2⤵
  PID:8316
- C:\Windows\System\vAsFeNf.exe
  C:\Windows\System\vAsFeNf.exe
  2⤵
  PID:9168
- C:\Windows\System\cpiGVGz.exe
  C:\Windows\System\cpiGVGz.exe
  2⤵
  PID:8912
- C:\Windows\System\pQzppsg.exe
  C:\Windows\System\pQzppsg.exe
  2⤵
  PID:8980
- C:\Windows\System\wHojqIg.exe
  C:\Windows\System\wHojqIg.exe
  2⤵
  PID:9044
- C:\Windows\System\oCMctUP.exe
  C:\Windows\System\oCMctUP.exe
  2⤵
  PID:9108
- C:\Windows\System\OpgLWXa.exe
  C:\Windows\System\OpgLWXa.exe
  2⤵
  PID:8224
- C:\Windows\System\iyVMjat.exe
  C:\Windows\System\iyVMjat.exe
  2⤵
  PID:7460
- C:\Windows\System\ckcwmBw.exe
  C:\Windows\System\ckcwmBw.exe
  2⤵
  PID:8396
- C:\Windows\System\IfDYOKe.exe
  C:\Windows\System\IfDYOKe.exe
  2⤵
  PID:7200
- C:\Windows\System\xmPmzeb.exe
  C:\Windows\System\xmPmzeb.exe
  2⤵
  PID:8444
- C:\Windows\System\GPfuStg.exe
  C:\Windows\System\GPfuStg.exe
  2⤵
  PID:8236
- C:\Windows\System\jqYVcbS.exe
  C:\Windows\System\jqYVcbS.exe
  2⤵
  PID:8500
- C:\Windows\System\XerdIuY.exe
  C:\Windows\System\XerdIuY.exe
  2⤵
  PID:8460
- C:\Windows\System\cVYIirQ.exe
  C:\Windows\System\cVYIirQ.exe
  2⤵
  PID:8612
- C:\Windows\System\XCBZHii.exe
  C:\Windows\System\XCBZHii.exe
  2⤵
  PID:8672
- C:\Windows\System\DmjohDF.exe
  C:\Windows\System\DmjohDF.exe
  2⤵
  PID:8692
- C:\Windows\System\rqxRXoB.exe
  C:\Windows\System\rqxRXoB.exe
  2⤵
  PID:8788
- C:\Windows\System\UUDqdnp.exe
  C:\Windows\System\UUDqdnp.exe
  2⤵
  PID:8996
- C:\Windows\System\YjbGyIv.exe
  C:\Windows\System\YjbGyIv.exe
  2⤵
  PID:9120
- C:\Windows\System\Bacjwme.exe
  C:\Windows\System\Bacjwme.exe
  2⤵
  PID:9060
- C:\Windows\System\AdmyFCU.exe
  C:\Windows\System\AdmyFCU.exe
  2⤵
  PID:8288
- C:\Windows\System\cOZIdRJ.exe
  C:\Windows\System\cOZIdRJ.exe
  2⤵
  PID:8884
- C:\Windows\System\uGsMTcA.exe
  C:\Windows\System\uGsMTcA.exe
  2⤵
  PID:9200
- C:\Windows\System\UcvpJQR.exe
  C:\Windows\System\UcvpJQR.exe
  2⤵
  PID:8184
- C:\Windows\System\mOCfhPo.exe
  C:\Windows\System\mOCfhPo.exe
  2⤵
  PID:8416
- C:\Windows\System\PDtDGPJ.exe
  C:\Windows\System\PDtDGPJ.exe
  2⤵
  PID:8512
- C:\Windows\System\RgQLAsO.exe
  C:\Windows\System\RgQLAsO.exe
  2⤵
  PID:8516
- C:\Windows\System\QYCNRXU.exe
  C:\Windows\System\QYCNRXU.exe
  2⤵
  PID:8596
- C:\Windows\System\GYtTPbw.exe
  C:\Windows\System\GYtTPbw.exe
  2⤵
  PID:8708
- C:\Windows\System\pUXYvlz.exe
  C:\Windows\System\pUXYvlz.exe
  2⤵
  PID:8900
- C:\Windows\System\hDsZmeF.exe
  C:\Windows\System\hDsZmeF.exe
  2⤵
  PID:9056
- C:\Windows\System\UstDTDA.exe
  C:\Windows\System\UstDTDA.exe
  2⤵
  PID:8132
- C:\Windows\System\zOXQTXW.exe
  C:\Windows\System\zOXQTXW.exe
  2⤵
  PID:9040
- C:\Windows\System\mGjKqYa.exe
  C:\Windows\System\mGjKqYa.exe
  2⤵
  PID:7392
- C:\Windows\System\FWLtYLL.exe
  C:\Windows\System\FWLtYLL.exe
  2⤵
  PID:8528
- C:\Windows\System\GfXEhqg.exe
  C:\Windows\System\GfXEhqg.exe
  2⤵
  PID:9184
- C:\Windows\System\IPuzjmD.exe
  C:\Windows\System\IPuzjmD.exe
  2⤵
  PID:7872
- C:\Windows\System\AiOeclB.exe
  C:\Windows\System\AiOeclB.exe
  2⤵
  PID:9136
- C:\Windows\System\VYvLOeg.exe
  C:\Windows\System\VYvLOeg.exe
  2⤵
  PID:8624
- C:\Windows\System\zWUXkri.exe
  C:\Windows\System\zWUXkri.exe
  2⤵
  PID:9232
- C:\Windows\System\xKovdXB.exe
  C:\Windows\System\xKovdXB.exe
  2⤵
  PID:9248
- C:\Windows\System\KUcGVFs.exe
  C:\Windows\System\KUcGVFs.exe
  2⤵
  PID:9264
- C:\Windows\System\DGTpBvM.exe
  C:\Windows\System\DGTpBvM.exe
  2⤵
  PID:9288
- C:\Windows\System\moLxLKB.exe
  C:\Windows\System\moLxLKB.exe
  2⤵
  PID:9304
- C:\Windows\System\zUoHNzM.exe
  C:\Windows\System\zUoHNzM.exe
  2⤵
  PID:9320
- C:\Windows\System\ZbHzsHx.exe
  C:\Windows\System\ZbHzsHx.exe
  2⤵
  PID:9336
- C:\Windows\System\kPFUBzD.exe
  C:\Windows\System\kPFUBzD.exe
  2⤵
  PID:9352
- C:\Windows\System\OphYKYx.exe
  C:\Windows\System\OphYKYx.exe
  2⤵
  PID:9368
- C:\Windows\System\yyHMeaD.exe
  C:\Windows\System\yyHMeaD.exe
  2⤵
  PID:9384
- C:\Windows\System\uJbpRfU.exe
  C:\Windows\System\uJbpRfU.exe
  2⤵
  PID:9400
- C:\Windows\System\CNnfbKy.exe
  C:\Windows\System\CNnfbKy.exe
  2⤵
  PID:9416
- C:\Windows\System\MkIOMoh.exe
  C:\Windows\System\MkIOMoh.exe
  2⤵
  PID:9432
- C:\Windows\System\eymSzno.exe
  C:\Windows\System\eymSzno.exe
  2⤵
  PID:9448
- C:\Windows\System\afowjBY.exe
  C:\Windows\System\afowjBY.exe
  2⤵
  PID:9464
- C:\Windows\System\nXCsQMZ.exe
  C:\Windows\System\nXCsQMZ.exe
  2⤵
  PID:9480
- C:\Windows\System\qOzWglP.exe
  C:\Windows\System\qOzWglP.exe
  2⤵
  PID:9496
- C:\Windows\System\LiqcrnD.exe
  C:\Windows\System\LiqcrnD.exe
  2⤵
  PID:9512
- C:\Windows\System\MHgPXpy.exe
  C:\Windows\System\MHgPXpy.exe
  2⤵
  PID:9528
- C:\Windows\System\wxQcNmm.exe
  C:\Windows\System\wxQcNmm.exe
  2⤵
  PID:9544
- C:\Windows\System\DpVvjbF.exe
  C:\Windows\System\DpVvjbF.exe
  2⤵
  PID:9560
- C:\Windows\System\avjqCsG.exe
  C:\Windows\System\avjqCsG.exe
  2⤵
  PID:9576
- C:\Windows\System\pxWbmrp.exe
  C:\Windows\System\pxWbmrp.exe
  2⤵
  PID:9592
- C:\Windows\System\uxClYGN.exe
  C:\Windows\System\uxClYGN.exe
  2⤵
  PID:9608
- C:\Windows\System\axvyOxp.exe
  C:\Windows\System\axvyOxp.exe
  2⤵
  PID:9624
- C:\Windows\System\DyUVdOK.exe
  C:\Windows\System\DyUVdOK.exe
  2⤵
  PID:9640
- C:\Windows\System\OnZPNKk.exe
  C:\Windows\System\OnZPNKk.exe
  2⤵
  PID:9656
- C:\Windows\System\pnlqRri.exe
  C:\Windows\System\pnlqRri.exe
  2⤵
  PID:9672
- C:\Windows\System\PpoZYOK.exe
  C:\Windows\System\PpoZYOK.exe
  2⤵
  PID:9688
- C:\Windows\System\AmqhWrU.exe
  C:\Windows\System\AmqhWrU.exe
  2⤵
  PID:9704
- C:\Windows\System\qzHGOvK.exe
  C:\Windows\System\qzHGOvK.exe
  2⤵
  PID:9720
- C:\Windows\System\TDleTWP.exe
  C:\Windows\System\TDleTWP.exe
  2⤵
  PID:9736
- C:\Windows\System\IlZJWkG.exe
  C:\Windows\System\IlZJWkG.exe
  2⤵
  PID:9752
- C:\Windows\System\GMEcHLe.exe
  C:\Windows\System\GMEcHLe.exe
  2⤵
  PID:9768
- C:\Windows\System\lJpCgCE.exe
  C:\Windows\System\lJpCgCE.exe
  2⤵
  PID:9784
- C:\Windows\System\DQwjDgD.exe
  C:\Windows\System\DQwjDgD.exe
  2⤵
  PID:9800
- C:\Windows\System\zpSyipP.exe
  C:\Windows\System\zpSyipP.exe
  2⤵
  PID:9816
- C:\Windows\System\LmcBwkK.exe
  C:\Windows\System\LmcBwkK.exe
  2⤵
  PID:9832
- C:\Windows\System\nkwuZem.exe
  C:\Windows\System\nkwuZem.exe
  2⤵
  PID:9852
- C:\Windows\System\vipLwCV.exe
  C:\Windows\System\vipLwCV.exe
  2⤵
  PID:9868
- C:\Windows\System\YWIflwg.exe
  C:\Windows\System\YWIflwg.exe
  2⤵
  PID:9884
- C:\Windows\System\AeJMlXs.exe
  C:\Windows\System\AeJMlXs.exe
  2⤵
  PID:9900
- C:\Windows\System\owSYZSs.exe
  C:\Windows\System\owSYZSs.exe
  2⤵
  PID:9916
- C:\Windows\System\XEbCVus.exe
  C:\Windows\System\XEbCVus.exe
  2⤵
  PID:9932
- C:\Windows\System\NKoZBfA.exe
  C:\Windows\System\NKoZBfA.exe
  2⤵
  PID:9948
- C:\Windows\System\JEGDMxm.exe
  C:\Windows\System\JEGDMxm.exe
  2⤵
  PID:9964
- C:\Windows\System\oHSzctC.exe
  C:\Windows\System\oHSzctC.exe
  2⤵
  PID:9980
- C:\Windows\System\tSnzzHU.exe
  C:\Windows\System\tSnzzHU.exe
  2⤵
  PID:9996
- C:\Windows\System\YzCneym.exe
  C:\Windows\System\YzCneym.exe
  2⤵
  PID:10012
- C:\Windows\System\ydPuXnu.exe
  C:\Windows\System\ydPuXnu.exe
  2⤵
  PID:10028
- C:\Windows\System\oUSayNI.exe
  C:\Windows\System\oUSayNI.exe
  2⤵
  PID:10044
- C:\Windows\System\QOCixlw.exe
  C:\Windows\System\QOCixlw.exe
  2⤵
  PID:10060
- C:\Windows\System\ertXvlx.exe
  C:\Windows\System\ertXvlx.exe
  2⤵
  PID:10076
- C:\Windows\System\ArNAnKf.exe
  C:\Windows\System\ArNAnKf.exe
  2⤵
  PID:10092
- C:\Windows\System\bcZtrvZ.exe
  C:\Windows\System\bcZtrvZ.exe
  2⤵
  PID:10108
- C:\Windows\System\LwHynAR.exe
  C:\Windows\System\LwHynAR.exe
  2⤵
  PID:10124
- C:\Windows\System\mvEGBfI.exe
  C:\Windows\System\mvEGBfI.exe
  2⤵
  PID:10140
- C:\Windows\System\fqTYeZR.exe
  C:\Windows\System\fqTYeZR.exe
  2⤵
  PID:10156
- C:\Windows\System\hTslcRt.exe
  C:\Windows\System\hTslcRt.exe
  2⤵
  PID:10172
- C:\Windows\System\pAJzKeX.exe
  C:\Windows\System\pAJzKeX.exe
  2⤵
  PID:10188
- C:\Windows\System\qANJJNS.exe
  C:\Windows\System\qANJJNS.exe
  2⤵
  PID:10204
- C:\Windows\System\ILjHnPc.exe
  C:\Windows\System\ILjHnPc.exe
  2⤵
  PID:10220
- C:\Windows\System\uAoLEPp.exe
  C:\Windows\System\uAoLEPp.exe
  2⤵
  PID:8564
- C:\Windows\System\cVAvIpB.exe
  C:\Windows\System\cVAvIpB.exe
  2⤵
  PID:8204
- C:\Windows\System\EJXCdCi.exe
  C:\Windows\System\EJXCdCi.exe
  2⤵
  PID:9204
- C:\Windows\System\FfHodFU.exe
  C:\Windows\System\FfHodFU.exe
  2⤵
  PID:9272
- C:\Windows\System\OVmCLrz.exe
  C:\Windows\System\OVmCLrz.exe
  2⤵
  PID:9300
- C:\Windows\System\avPpybL.exe
  C:\Windows\System\avPpybL.exe
  2⤵
  PID:9364
- C:\Windows\System\NpxOJzg.exe
  C:\Windows\System\NpxOJzg.exe
  2⤵
  PID:9460
- C:\Windows\System\YqavKdU.exe
  C:\Windows\System\YqavKdU.exe
  2⤵
  PID:9492
- C:\Windows\System\ogImgZN.exe
  C:\Windows\System\ogImgZN.exe
  2⤵
  PID:9556
- C:\Windows\System\swpJwBP.exe
  C:\Windows\System\swpJwBP.exe
  2⤵
  PID:9620
- C:\Windows\System\WdFCFKH.exe
  C:\Windows\System\WdFCFKH.exe
  2⤵
  PID:9348
- C:\Windows\System\TsXHMns.exe
  C:\Windows\System\TsXHMns.exe
  2⤵
  PID:9412
- C:\Windows\System\HdoVwLK.exe
  C:\Windows\System\HdoVwLK.exe
  2⤵
  PID:9344
- C:\Windows\System\hxvQHPW.exe
  C:\Windows\System\hxvQHPW.exe
  2⤵
  PID:9504
- C:\Windows\System\SICuguh.exe
  C:\Windows\System\SICuguh.exe
  2⤵
  PID:9568
- C:\Windows\System\NdRGKvq.exe
  C:\Windows\System\NdRGKvq.exe
  2⤵
  PID:9604
- C:\Windows\System\FBxWDjB.exe
  C:\Windows\System\FBxWDjB.exe
  2⤵
  PID:9664
- C:\Windows\System\UCAZGvx.exe
  C:\Windows\System\UCAZGvx.exe
  2⤵
  PID:9700
- C:\Windows\System\nIXwruH.exe
  C:\Windows\System\nIXwruH.exe
  2⤵
  PID:9812
- C:\Windows\System\xMBFIsJ.exe
  C:\Windows\System\xMBFIsJ.exe
  2⤵
  PID:9716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EHNXamk.exe

Filesize
2.1MB

MD5
e85750d27e703c21d1aec34203c89a4f

SHA1
933079ede763a8e4440952e9a16cf67957c7d558

SHA256
49205dfcc02df388bcf8cc604c9cb4d00b3fc8600846949d7dac344b97a62ee0

SHA512
a74d08b7f8e7e969d168a4b4723e96f2924927ad80fc794282b2215275db00c205bda23a81501a5fdd3f4bbe55723b58183a7119a88137694a51fc7bab45a545

Download Submit
C:\Windows\system\EYLLXYe.exe

Filesize
2.1MB

MD5
c6e47659cc23b559eef24574d0b51e73

SHA1
efbabdd02ef2386691792876e086d1025b40e5a7

SHA256
ba3221170090961c87c039edf20498fe89c3cad2ceaae13a8d1948077e4bb5e1

SHA512
12b80167f2fd8c76b0b48a6cf361ac53c86a58b0e9f8733fe9e7c1a4580c5a64401c050c3b5f3375b8c74dd9ab113c6bd05ef36f30c0a106059e2e2fbc949a1d

Download Submit
C:\Windows\system\HIQozyM.exe

Filesize
2.1MB

MD5
c4244a09dd1d40128347702d21e1aa54

SHA1
4c3d7f1036edf9be0a62ed3d52bd622af91b434b

SHA256
7675c9c79d1a547ae6c3d134fb1f3006786caf86f2918453fc4be56a7767b434

SHA512
5d283b6917714d02de248ec8040fb190bdfd3714f43573400ae3e06c2af9d995fd44563219773f0bcbb1cc5abbbb89f8f60a3f45b83f1598bf724dd9763e6aba

Download Submit
C:\Windows\system\IBdGOUn.exe

Filesize
2.1MB

MD5
1a4f1228e76243a0eec6b2efb47f1c29

SHA1
1f9d4eaa0d7cfc56c7254a21f6da15722a8887db

SHA256
668ca0782cfdd5bf300a01a06319f33396ad390cb4664452175922ca5dfe3c43

SHA512
799be1a02f2acf1477c74d1e39260587a29154f7d0dd1684d8cdeb4207d3168e8d8162d732467864f8885d728fcb19409d33d6ecd8ec2699eafd4b2f10a419fe

Download Submit
C:\Windows\system\JPFGxIR.exe

Filesize
2.1MB

MD5
520194c01e965e4f9cb61e6f051ba11a

SHA1
5f8dee789ff5cbffa6bc7a70221ce754429c36a3

SHA256
1e643c2d5fd389c96c4af98465342003e38bdfcfea6e4f53d3375b49557cbd95

SHA512
48bfcf5e3f99f7ed5e80207862fae25981c70d2cebb73e00c97e82dbacd84c0363546f4ad13f43f5579fed531038403c305fa980a5f74be6677def132bfad85f

Download Submit
C:\Windows\system\NeKOtkc.exe

Filesize
2.1MB

MD5
e300000a1658b3236f91c87e9ddc8173

SHA1
483dbf7e3a6d435eff1ee3e30c57a0c801838b68

SHA256
88109a6b6a39602a5ed9204e76009fa16130157fc4dde9d54a7e2dc24dfc18cb

SHA512
f36c02815d8674cb481583e43daf194905516e53c7508292e9668fb09284721addf3ec5169c7d64ff23be6d3f808d1657ec7bba9b4b9806438a718b313abddce

Download Submit
C:\Windows\system\PELRHeH.exe

Filesize
2.1MB

MD5
5db742868e38ed08c5c0ae1e0c401bd1

SHA1
bf328abd6fb1eed31687d3c1bcd9dbcdf9669edf

SHA256
0866e3b810c4475d75ca9877f8ea26b127ccdc7a15d427b823710eba284f0175

SHA512
eddb45cd1015d91dfb9192890439353e1af45dbf68c5fd6817590b319feb179eae59c8dc0086538f323b75f4c7ed460d1441fe6d4495aa2c8488231979618181

Download Submit
C:\Windows\system\aPwHyJT.exe

Filesize
2.1MB

MD5
63bf8c147aa7faca503b0f35e84b2a93

SHA1
939203eb88dfe329bb2c6076588ec686a0dcd3c0

SHA256
ed99268c6bb0500ca9836ef6a59cd81b34281d1e9f97304e0ed993960964001c

SHA512
d3dbf127913db7e3c7e935df2dd362da948a5e157f98cd9f90c48ab953512f5562f4b171c743005fcd10bc12053d6839a6fe456b965c0bd2e52175c44436d1b6

Download Submit
C:\Windows\system\awIMlYF.exe

Filesize
2.1MB

MD5
a0330db9c3291366c6ce222c17ba797c

SHA1
15f693866182a80c730cae1d01f558c6ab926e01

SHA256
d1aaa149b38928f9ef46743511aa67fcdbde27eb876f87f167d38c3b53275f5c

SHA512
2ed11dfdeb3308625d669cb847862125684c233ab33304581a109a15e20b7e5d3159b7f88b47bd2576e453c29cd180f22eac26fed0d08581d4b23689b4b19099

Download Submit
C:\Windows\system\dSKcYCG.exe

Filesize
2.1MB

MD5
1c6283f941352a00eb92ced01aefa5a3

SHA1
f3c2ac28fadc01a1ff0d5e04d0d164052a1370b1

SHA256
a67f236f7db371a4b430f2b9fe49854a16c6d51d4da899de919ae20597774854

SHA512
1fcb8e21b6dbfab66a49291f09d2d6bf1a2b64eb51c14656fd1f68d309161ade420a3ac67aa311a0b608824a7db48c6260e1a4544c11c5f93404aa4405efd4fd

Download Submit
C:\Windows\system\jvqfecw.exe

Filesize
2.1MB

MD5
aed33af38d31ca0a2c512bb00893671d

SHA1
cc2e96d911ccd36cb9b6b964d7609fa719ce7fe3

SHA256
44ee00216e80a990a6bef3cddadcfbfefa344109cf54fb51dfd7149671e01475

SHA512
1604b07395c98de2c6dd1f4975f2e494ff3975608ec03c2be19efdb4e7a444274ec0cd6216e2c14d8818b777b3829c450b2a398a856a3c0cdc1456a907e191cc

Download Submit
C:\Windows\system\lbxZFcB.exe

Filesize
2.1MB

MD5
3db7e274f9a1efed4b22acb41358fb0d

SHA1
45029e9ac0497e45a66607a156a2e1d73e28d5b8

SHA256
432ed21fd89a8fec8df5d88a89e54a0aa2c2b677de0421181b37cc885120596a

SHA512
1a7eebc213d4af6924d5a11fa6cc205d5cbf29a43a4701e4804d5fdd49df7cfb90787910904e2157a8c73e9ba10b3e0532c0bf4f36793a52c4ad278303965e36

Download Submit
C:\Windows\system\mgClCgK.exe

Filesize
2.1MB

MD5
78e54e9b03354191ab8a2c20d34680cc

SHA1
c5f913b7e58c3334c6cd0e2f6c64a414ae2e422f

SHA256
b996d2c0453a20f576819c2c80b25b761545fa1ddd230a3bd87b402d0349d02c

SHA512
b01b5311d010f209c823203b2fd6c25f9db52fd7cd17fadadbbdeaa0c68ec9ae755ea8fb45e3a5d41e574d5ac3798fa289a3e394cb24220e4a8b54ebd2599ea8

Download Submit
C:\Windows\system\mmlhxqh.exe

Filesize
2.1MB

MD5
4c010c86bc112dc218951d5ca16d49da

SHA1
731f3fcbe47dec36d2ddd77f1983f99008ff9791

SHA256
9b2dd56b53b0c3fdda40c9843687c2e988801bc1f4b967cb4d15aeca5dd08066

SHA512
70121a0219a4642d1ec6b2ac519e04533c589a254ed73c7b7b089898814408ecc9e0731cb3cec1ed41e6ca1fa95cafd908bea6d443d9271b1a8d8815b01db9c3

Download Submit
C:\Windows\system\mronxGf.exe

Filesize
2.1MB

MD5
6e8801854bed54690d16b94b950734f5

SHA1
97832745a5ac3280d7b94fe18f381c4d10c729c5

SHA256
0ce0291066039c678f2d40e5c0669b062ad2a28304668e65226ffe6112b3374a

SHA512
42a26c611b4e80c208941d72de4f516acfe44bd901a40e73fae82a52bcd26c23ed77be23302352c664123710dd264c873b6669837ba739cc1030db3d45b05ad1

Download Submit
C:\Windows\system\oiVuEwW.exe

Filesize
2.1MB

MD5
ca38bf06a838d531398c4b1593d18a1a

SHA1
078dbad3705b0e190436281c0d6217fe33280744

SHA256
644175dd69c8139f40fb778ba4c67b61b6c72b3b34b5f012b42432cad0e8e6cb

SHA512
2c07ab23cc897bdfd5ba524690486712c388dfea1a40e19c8da7dcd02f67b2fa995ad5c23c2d2be0e5c5e41207c8719bb165dfe6139c154c53d4c68770a7ba09

Download Submit
C:\Windows\system\twIBlSy.exe

Filesize
2.1MB

MD5
b47589a3653877240cb6d7a1e3bace6f

SHA1
cd78a0b329638348f62810d0ed749d1de2d57797

SHA256
b434e5aef408dbec3138a984b0eb82acf86508fff1b075e64b546f5b8aac71e2

SHA512
0109d3aa92a9e5fe06ae18372312b20065c5d5b4db22267fdd29154d43c6248925ac1eb22039c89b32a25ce82c18df5d8813ec453fbd530a978f60e04eae15ca

Download Submit
C:\Windows\system\uHTNPbS.exe

Filesize
2.1MB

MD5
fae34cb88c1960c794d3e5e7f9414e9c

SHA1
3704fea6b3435840b4fdfabf2fc8b0e58f4ffa87

SHA256
c92c4aed3e78697546659d3c815d7d9c2085770db66ccc93275b040c4fec4a30

SHA512
90e00e70a76a1dc5d58fd6a94bd2a6db665222e9f210ffc7673d5e767fcbd69706f0521438045b9e33a371e3557aabcc812ed863e762b0e91cb0769fbb5d2b8e

Download Submit
C:\Windows\system\wFyKANJ.exe

Filesize
2.1MB

MD5
f10e07046fe5040d81cf927cf2d5bf4d

SHA1
c2564ec7a86472df23f2d0784ac57b5326bb6b8b

SHA256
e436b94a27087b91cb974b1ca52e1ddf7794129ea4fbf776a026fc689e5327da

SHA512
6eee2d31f51fb0ad2e2e516e23f69689537ae0cad8bd0403eccfb8ff01820be839b1910e4950fc4a917aa0b91117036ea8cf929fb4b03a97be3ea9e4d34692df

Download Submit
C:\Windows\system\yodCJEV.exe

Filesize
2.1MB

MD5
6451683ec0ca80693be4214eb0728b32

SHA1
d5044d0116a04fdce2d80b750b24fbd28f97a1f8

SHA256
87a69817954019fe2fe4031efee9d90e84e14dc2039cb2d5b74b48781fc5e297

SHA512
da8a9ca79cbc0aa4881619731d900f8a1f36707249d16df6707e50dba9c802a72e06c0cf1478104d0f357710def9de1069d3007c982e908efe797801035748ee

Download Submit
\Windows\system\CsspGeT.exe

Filesize
2.1MB

MD5
70d5b818cf5326629d7acf20df24f318

SHA1
15b472736d6c00aa360c0345c7061fdbb816ba66

SHA256
433450e911e8830e39e3d94c730484ecdc85caf432b15d2edb3ecb41317b62bc

SHA512
5de14d08442341c0927b213a9b445dda24b9543b0bf336147df4ab63eab23dc7d1e7118646964ca7c3e85d2ce07930de5ef53348656142f6caf26b691ff4b153

Download Submit
\Windows\system\DQEnoiz.exe

Filesize
2.1MB

MD5
a209dafebdb000599f6de74831e55374

SHA1
d8bf07046624835cce364ee9262a6d1b29f35022

SHA256
4ce73a8ea75153976a9a8f9554f0078a6d0ee73fb0a67b904330fda782752de5

SHA512
ebc0f6f8bdcc4f25e7767964cf8c103435b48cf4d25d3ece82adb59a68517b0131c0d84c805bc69980eaf038d018a7678d18a258bd3f8dea309020433c1a7483

Download Submit
\Windows\system\FHJqczw.exe

Filesize
2.1MB

MD5
d31920ebd9603d85b9428aed513b34da

SHA1
fad228b8fa5de5a2d60a6c9900816cf05cbed6f1

SHA256
00f11aae995caf61e8016e5dd40ac953d239f5725dd4f7cbe1cc66c87b2df6e3

SHA512
5571be959e9fd76d27c8dc31eca35d326839df6d4144a81989f4bd64495481faf51e481b84aa06b4f8eee7ada1d533aba3031f77c1d1ff664a5cdd557d03f150

Download Submit
\Windows\system\QFupsOX.exe

Filesize
2.1MB

MD5
08bba3bf347ef251b293e63d75b9e7a2

SHA1
12cca2859ef5954ff13746f27f8dc5e446be3161

SHA256
0d588263c6845ab903892b2d6f185f58dfb8d07e16b29e18d9ed9128990aa191

SHA512
d1ff8048ef8039167d468c07d52d36c11ebe60e603e3f7af3edefbc0bc5511a935020f488aec4f0022bd377ea1c6e78dbaba43f420aebbc1794bcda4155176ef

Download Submit
\Windows\system\RyGseTm.exe

Filesize
2.1MB

MD5
c2c3732097fa08993d971f152091e1d6

SHA1
67db3b102aa060e9f0405f475061665469799d15

SHA256
7ce01af06310b1785301517af64d04057ccbe9e6d673e63ba9d2ce1f5097b8b1

SHA512
f7037fc2d61fcc86b96b0ad57a1f772530a5ea7274a9abf26984c8a75db18ac961781c09813c2190daf3ef148caa8c6d2a97f38331e54d1d418e47b668468e8f

Download Submit
\Windows\system\TWHwmRs.exe

Filesize
2.1MB

MD5
ea4866d9874be68efa75d98813b1eacc

SHA1
d21b183888417c0684ab21218f17ec78899beeb9

SHA256
e804d7e3250447991b017d85317d8eba35beb21264d580c2fbbe11c718ff45d6

SHA512
14efa3122aab60f4202893123286653b83de343bdd4c6cfca3c03bd662bc329c69b8bbe216c6f2edd35932aeb2c1ad0405d1933076a95b140f491140ac467d47

Download Submit
\Windows\system\UhWsAlx.exe

Filesize
2.1MB

MD5
4c4029edb0a60d014f6cb78106f454e9

SHA1
0da6b4c4279db62b3c96837671208b02134408da

SHA256
28c7b76f44b3eb88db2986763ca80136bd946d44871aa26d190bf0c81e0a1b4b

SHA512
00a15ea88a7ce5c650b523d1ac76897d8334524c76c19e01cabaf53c0a8cb3204c9d6035d115528373f943a256843cdc2797f44726a41c36c88d8deeb6383d97

Download Submit
\Windows\system\aYTvdQN.exe

Filesize
2.1MB

MD5
7d6596d07a4f8acff2246562bd4cd087

SHA1
17c04b3e26f578ca78c2d15663e27d6aa7570279

SHA256
0f922a44fd2b83ad2876b30735477eb53b28b78c7947587286f47543c91e7f44

SHA512
c085ef64f83b1c111eba562010691dfefea012a8a7eb56b27831aed7df71d9a4f905c9f83c4709e5713cf087d89b0639472f6833b7ede708162593c69212ddec

Download Submit
\Windows\system\eDBxPGE.exe

Filesize
2.1MB

MD5
b7b8f5627151ef0f2ac965608a5897bc

SHA1
8f26643ce841f1c9fa81d4074cf54d42c95f021d

SHA256
0812e7b4e6ca4eb297799dbfd90bc12f078910f17d9fc019a6d467c07c625825

SHA512
1a64735fd396bb5b54dbca98a8bf604223e9dea86fc6efc28ba593fd71dde61373075ec21a6c54e4ac2826c1618ccc2dc5a46e2fab71081f53721b0cb37b7a47

Download Submit
\Windows\system\gMIUNDK.exe

Filesize
2.1MB

MD5
66feeb3caa8781e72c8f1b1efc6be7c4

SHA1
77d07673a2395abecca2a3ae9918ec8a86567be1

SHA256
bfc1e1578535964939d19b12f9f850257ba4849ddd2b213c4fa21443da8cbcc0

SHA512
b1e07afe0a59012684508770871d1c7fea652f94e129f7cdcbd63f322b00677b1d8eab0b36756baeec3a14620882b87a25b0529de678f124c3275a70bfcfc743

Download Submit
\Windows\system\hkfeMpE.exe

Filesize
2.1MB

MD5
165717be0733dcc2532867ee6090c2be

SHA1
1e75f58d48a2366a10c4f9385275802f5eedf59c

SHA256
dd615c0a704a07ba551e390bd1d272bc10eedd2ec8acc58f723940c610da5835

SHA512
715fc1ca95b819818af2fec026732ecea125c7f1116682e4c33e9b93b771580be81fffc78cf1a2f34d204491bd878a6c80b7a50e738ee9800da772ef1560dd23

Download Submit
\Windows\system\oQjFvQt.exe

Filesize
2.1MB

MD5
1c7008fc5aaf82d5adce3bac444fd627

SHA1
35ca77038aff2d654c7676ea5ffe700396fa93a9

SHA256
65a2a2feba46eb636901e812d9e5851822081177adb6a8dc01c63f9db3b19149

SHA512
37016c40022ef65f831228dc8bf4177c213a40e252dab3f62a44c7f43bfe40448445398e547290d3a45d67ab83c0b27a44f10a805a7bd9f6cc262bd7b72718db

Download Submit
\Windows\system\ocMZhdy.exe

Filesize
2.1MB

MD5
1b9be589b432745a189fe738861fdc37

SHA1
8a790322c1b3cf324062a79b024e9767baab72eb

SHA256
08c266aec8f1cef69ccf49df36beeb355c1d1b2d1b939933e35e0a837dcb328b

SHA512
00458651ae42401a5cede7c0e313dddc8e295319fef886a9a21455c5a2f7e4eadacf809b2521a248c0a474b6a4a8b7e0f1761a9eee0d1208cc4aed3c900cd771

Download Submit
\Windows\system\rCoDrDe.exe

Filesize
2.1MB

MD5
8e5564bfe29cef66051b4a18420acafa

SHA1
bf04706180152412f7f8c50e35998261a547c189

SHA256
c547a424a087d9d589fbe3c38bffca258063bb4e0beafcd4d5940a6ac142ebcf

SHA512
43df976973805daefd119be4eb3ba29eb9151fca627212eb62fa42a0877aaa588341c2c034248e7bc82083fb88ce8bc34bf3ae16904fd9dd5bf12ad23e5b539d

Download Submit
\Windows\system\wNivopg.exe

Filesize
2.1MB

MD5
cb9b373a43a26d40b87db97dae54c7da

SHA1
2e7a72a4c4c91ba4752d43697d63086ea04e3cff

SHA256
bc3ba92edfb738ae4517fdb7200de9b0efa5d65fdf77d774f0949f9cbf8ec3fa

SHA512
c8bf046d06aed8f3003567682b8069234cdb8accf715f2f5d0fedc9e745deb9ede08976e9563edc4b452c2137b6dc88002a8283a7f1421ae740ee63e0ef2d818

Download Submit
\Windows\system\xwAYjFi.exe

Filesize
2.1MB

MD5
e122141b228a1cdbabb59f50c1f66152

SHA1
30339fa472caf26531efe83765d98284abb3e8ee

SHA256
004fa8f2533395fa9a7aa4c196155a5e009f29091697d7d179368563c62a21f5

SHA512
64848d99790cc9c46b3b75bf19d88222b1b8711eb96d44ccdf1d1def6e6a9327579be0cc250e28a66b32be35ab40daf015f8a35fecd24d63d5450860db2fd8c2

Download Submit
\Windows\system\zMgYnme.exe

Filesize
2.1MB

MD5
8ed8cc8574310ffe3d3c11770b74ec25

SHA1
ba837e13a2a3f9bdf4296c21dabde7d7f3556340

SHA256
3864fc8e403097df1ec9f1d0a200c9d6243aebb377f50434a99b928fb1c74330

SHA512
eea51c8218dd9bc31c4e3fd41c2473b6147b467bf1d6ef749d73c2a733fdd44c1cfce711d1f70c1f51f473dd6c23229f055a2e24b97396b718c39e2873fee384

Download Submit
\Windows\system\zhEPpbg.exe

Filesize
2.1MB

MD5
8fde35ba44b902738d65bf19db77b998

SHA1
9d7ff2a736f1748faa2a31ce3cea34f08b7fc32f

SHA256
a25f2ed577004ddc0bda0c375ca8ed876dd6f29f7e4d84ecab4d41bb32e057ca

SHA512
cfcc17937ce8778f7b3b942bde76e01ea333ae25eeed54ee14a1e14108766947f4fd2ddcf0b91880878d268c2ea1193da725fad66cb522d6faf981c946655bad

Download Submit
memory/2080-70-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2096-78-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2464-115-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2612-64-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2624-90-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2656-26-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2852-17-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2868-113-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2932-66-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2932-0-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2932-65-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2932-97-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2932-7-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2932-62-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2932-86-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2932-75-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2932-80-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-104-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2932-102-0x00000000036F0000-0x0000000003AE2000-memory.dmp

Filesize
3.9MB

Download
memory/2988-98-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2988-48-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2988-111-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2988-529-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2988-60-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2988-59-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/2988-58-0x000007FEF5C20000-0x000007FEF65BD000-memory.dmp

Filesize
9.6MB

Download
memory/2988-54-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/2996-81-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download