xmrig | 0ef2ca6c425545b292d8ed95545b003fbc533b259918365dd3c9a4cc41dfc2a2

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
Size

2.1MB
MD5

0224b83efc26850a5fde3791247aded8
SHA1

6bf4cf53f55ee445cf81f240dd65f3c475bdc30f
SHA256

0ef2ca6c425545b292d8ed95545b003fbc533b259918365dd3c9a4cc41dfc2a2
SHA512

a90a5daf461c8f99307e269cebc568092271c62f9130f30ddde895a864a52e5b03840ddda5b1391a45a4cc52619fc4d6aa08f46fad34124773428e2ebd85570d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrW:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2520-8-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/1280-39-0x000000013F490000-0x000000013F882000-memory.dmp	xmrig
behavioral1/memory/1124-64-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2476-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2464-69-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2332-63-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2552-59-0x000000013FB60000-0x000000013FF52000-memory.dmp	xmrig
behavioral1/memory/2676-55-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2520	sPlSKka.exe
1280	giBkdbM.exe
1124	vtjvkOL.exe
2676	CGCfklP.exe
2552	GQGzyDJ.exe
2332	MDuifuF.exe
2476	apmfCyi.exe
2464	SYKNvlv.exe
2756	AlkzQnI.exe
2752	JrXeAEL.exe
1908	lgmeXjx.exe
1600	hyeIgnr.exe
1616	aPMsmSI.exe
2132	UIUtFuZ.exe
1916	djVaMKx.exe
1604	DwUPMSX.exe
1872	RMhAGxG.exe
2400	nIOTxux.exe
644	TOdTUIM.exe
2936	QksUvMS.exe
1336	hnAVbLJ.exe
2884	DOGkxQa.exe
2240	lGhhFeJ.exe
2816	jtqMTPU.exe
2708	myQjdMd.exe
916	aRAhyof.exe
2912	jfwqNLb.exe
1716	ggGCmSG.exe
1724	qdrEXzz.exe
2316	PFKPlro.exe
1652	xHijlFM.exe
3044	RUaFIUy.exe
1496	bHQOgqa.exe
240	rXSszvo.exe
1040	UHYrDOt.exe
928	tnUIjrB.exe
1612	SDIUBbi.exe
1068	trQeZip.exe
2300	YDPXjCQ.exe
740	KCDkwAr.exe
1088	DaWdJLP.exe
1660	BEcPCHU.exe
1452	ORKfrcv.exe
2788	paAQhnS.exe
2104	IIgeLZh.exe
1740	PfcRgdK.exe
1984	gzuWBSO.exe
1708	bbybBBe.exe
1676	aLqQsWh.exe
2072	yUZDeIB.exe
1520	cbtpVcB.exe
2780	suJTJIR.exe
2608	oEkEPIA.exe
2620	GDAYWJf.exe
2440	mKJFUZK.exe
3016	DmQgbNH.exe
2972	CcoHUWf.exe
2664	knNtZAK.exe
2616	FmpNXYY.exe
500	mmExGxC.exe
2180	sUVHSqW.exe
2852	YQRQzFl.exe
832	AFvoZPq.exe
820	WxuhiRY.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-1-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/files/0x000d00000001340c-3.dat	upx
behavioral1/memory/2520-8-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x001400000000549e-18.dat	upx
behavioral1/files/0x0037000000013a3d-17.dat	upx
behavioral1/files/0x0008000000014183-25.dat	upx
behavioral1/files/0x000700000001418d-28.dat	upx
behavioral1/memory/1280-39-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x00070000000141b5-40.dat	upx
behavioral1/files/0x0008000000014983-46.dat	upx
behavioral1/memory/1124-64-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x00060000000149ea-72.dat	upx
behavioral1/files/0x0006000000014c25-78.dat	upx
behavioral1/files/0x0006000000015023-92.dat	upx
behavioral1/memory/2476-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0006000000014e5a-81.dat	upx
behavioral1/files/0x0037000000013a7c-99.dat	upx
behavioral1/files/0x0006000000015362-110.dat	upx
behavioral1/files/0x0006000000015642-124.dat	upx
behavioral1/files/0x0006000000015c51-141.dat	upx
behavioral1/files/0x0006000000015b13-129.dat	upx
behavioral1/files/0x0006000000015c86-160.dat	upx
behavioral1/files/0x0006000000015cad-170.dat	upx
behavioral1/files/0x0006000000015cca-187.dat	upx
behavioral1/files/0x0006000000015cb9-179.dat	upx
behavioral1/files/0x0006000000015ca5-178.dat	upx
behavioral1/files/0x0006000000015cc1-183.dat	upx
behavioral1/files/0x0006000000015c9c-165.dat	upx
behavioral1/files/0x0006000000015bb9-148.dat	upx
behavioral1/files/0x0006000000015c6d-143.dat	upx
behavioral1/files/0x0006000000015c7c-151.dat	upx
behavioral1/files/0x0006000000015b77-134.dat	upx
behavioral1/files/0x00060000000155e3-119.dat	upx
behavioral1/files/0x00060000000153cf-114.dat	upx
behavioral1/memory/2756-84-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0006000000015136-103.dat	upx
behavioral1/files/0x0006000000014b12-76.dat	upx
behavioral1/memory/2464-69-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2332-63-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2552-59-0x000000013FB60000-0x000000013FF52000-memory.dmp	upx
behavioral1/memory/2676-55-0x000000013F8B0000-0x000000013FCA2000-memory.dmp	upx
behavioral1/files/0x0007000000014216-50.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\vuzfXec.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\rXSszvo.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\Sykpypj.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\JGvEwuW.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\xqDIaQj.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\yUdToOQ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\hNaMpWG.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\dYJHtXB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\RsyCUxc.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\VGAjFWr.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\rOzrlzC.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\KpubxZh.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\KsFbLQc.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\jeabKcY.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\sCJEHur.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WKHJYFS.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ghZMYNh.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\jEPLKCm.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\DQvdSlA.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WvgnUcZ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\yaYWEoZ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\nzVRygT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\qhlaStj.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\qRQEOfS.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\DYHoNEZ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\CIHKTdx.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\QsPnBqI.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WFAWQpj.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\QuTJEtW.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\wXKzfsP.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\mmExGxC.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\petoWHS.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\MfrKOZb.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\GbMLbaA.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\AlcIOwb.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\FkSlEjT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\vvYWdgf.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\eoXOpeH.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\kICkWgc.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\dFFWxzi.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\hQKtYJJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\LGNarnv.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\YbICAki.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\RuwkbTS.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\AGyaJeT.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\liabTTi.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\WyTzctI.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\wyxaair.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\yoVptOr.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\PlPGtAP.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\DsqlQgL.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\bXcHsNW.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\kmuAhWJ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\FmVbLPB.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\qBxqTvv.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\XMmSvma.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\drVphqQ.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\pYWlPrl.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\GkbdpMF.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\xamsbJi.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\TkLyuks.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ctLXuuP.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\GhMNzdf.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
File created	C:\Windows\System\ENMzqBe.exe	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2016	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeLockMemoryPrivilege	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2016	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2016	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2016	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2520	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2520	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2520	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1280	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	31
PID 2036 wrote to memory of 1280	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	31
PID 2036 wrote to memory of 1280	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	31
PID 2036 wrote to memory of 1124	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1124	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	32
PID 2036 wrote to memory of 1124	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2676	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2676	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2676	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2552	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2552	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2552	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2476	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2476	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2476	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2332	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2332	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2332	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2464	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2464	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2464	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2756	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2756	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2756	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2752	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2752	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2752	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	39
PID 2036 wrote to memory of 1908	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	40
PID 2036 wrote to memory of 1908	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	40
PID 2036 wrote to memory of 1908	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	40
PID 2036 wrote to memory of 1616	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1616	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1616	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1600	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1600	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1600	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	42
PID 2036 wrote to memory of 2132	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2132	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2132	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	43
PID 2036 wrote to memory of 1916	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	44
PID 2036 wrote to memory of 1916	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	44
PID 2036 wrote to memory of 1916	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	44
PID 2036 wrote to memory of 1604	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	45
PID 2036 wrote to memory of 1604	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	45
PID 2036 wrote to memory of 1604	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	45
PID 2036 wrote to memory of 1872	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	46
PID 2036 wrote to memory of 1872	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	46
PID 2036 wrote to memory of 1872	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2400	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2400	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	47
PID 2036 wrote to memory of 2400	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	47
PID 2036 wrote to memory of 644	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	48
PID 2036 wrote to memory of 644	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	48
PID 2036 wrote to memory of 644	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	48
PID 2036 wrote to memory of 2936	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	49
PID 2036 wrote to memory of 2936	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	49
PID 2036 wrote to memory of 2936	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1336	2036	0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0224b83efc26850a5fde3791247aded8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\System\sPlSKka.exe
  C:\Windows\System\sPlSKka.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\giBkdbM.exe
  C:\Windows\System\giBkdbM.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\vtjvkOL.exe
  C:\Windows\System\vtjvkOL.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\CGCfklP.exe
  C:\Windows\System\CGCfklP.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\GQGzyDJ.exe
  C:\Windows\System\GQGzyDJ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\apmfCyi.exe
  C:\Windows\System\apmfCyi.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\MDuifuF.exe
  C:\Windows\System\MDuifuF.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\SYKNvlv.exe
  C:\Windows\System\SYKNvlv.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\AlkzQnI.exe
  C:\Windows\System\AlkzQnI.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\JrXeAEL.exe
  C:\Windows\System\JrXeAEL.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\lgmeXjx.exe
  C:\Windows\System\lgmeXjx.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\aPMsmSI.exe
  C:\Windows\System\aPMsmSI.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\hyeIgnr.exe
  C:\Windows\System\hyeIgnr.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\UIUtFuZ.exe
  C:\Windows\System\UIUtFuZ.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\djVaMKx.exe
  C:\Windows\System\djVaMKx.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\DwUPMSX.exe
  C:\Windows\System\DwUPMSX.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\RMhAGxG.exe
  C:\Windows\System\RMhAGxG.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\nIOTxux.exe
  C:\Windows\System\nIOTxux.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\TOdTUIM.exe
  C:\Windows\System\TOdTUIM.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\QksUvMS.exe
  C:\Windows\System\QksUvMS.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\hnAVbLJ.exe
  C:\Windows\System\hnAVbLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\lGhhFeJ.exe
  C:\Windows\System\lGhhFeJ.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\DOGkxQa.exe
  C:\Windows\System\DOGkxQa.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\myQjdMd.exe
  C:\Windows\System\myQjdMd.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\jtqMTPU.exe
  C:\Windows\System\jtqMTPU.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\aRAhyof.exe
  C:\Windows\System\aRAhyof.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\jfwqNLb.exe
  C:\Windows\System\jfwqNLb.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\qdrEXzz.exe
  C:\Windows\System\qdrEXzz.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\ggGCmSG.exe
  C:\Windows\System\ggGCmSG.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\PFKPlro.exe
  C:\Windows\System\PFKPlro.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\xHijlFM.exe
  C:\Windows\System\xHijlFM.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\RUaFIUy.exe
  C:\Windows\System\RUaFIUy.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\bHQOgqa.exe
  C:\Windows\System\bHQOgqa.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\SDIUBbi.exe
  C:\Windows\System\SDIUBbi.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\rXSszvo.exe
  C:\Windows\System\rXSszvo.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\trQeZip.exe
  C:\Windows\System\trQeZip.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\UHYrDOt.exe
  C:\Windows\System\UHYrDOt.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\YDPXjCQ.exe
  C:\Windows\System\YDPXjCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\tnUIjrB.exe
  C:\Windows\System\tnUIjrB.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\DaWdJLP.exe
  C:\Windows\System\DaWdJLP.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\KCDkwAr.exe
  C:\Windows\System\KCDkwAr.exe
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Windows\System\BEcPCHU.exe
  C:\Windows\System\BEcPCHU.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\ORKfrcv.exe
  C:\Windows\System\ORKfrcv.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\paAQhnS.exe
  C:\Windows\System\paAQhnS.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\IIgeLZh.exe
  C:\Windows\System\IIgeLZh.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\bbybBBe.exe
  C:\Windows\System\bbybBBe.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\PfcRgdK.exe
  C:\Windows\System\PfcRgdK.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\aLqQsWh.exe
  C:\Windows\System\aLqQsWh.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\gzuWBSO.exe
  C:\Windows\System\gzuWBSO.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\yUZDeIB.exe
  C:\Windows\System\yUZDeIB.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\cbtpVcB.exe
  C:\Windows\System\cbtpVcB.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\suJTJIR.exe
  C:\Windows\System\suJTJIR.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\oEkEPIA.exe
  C:\Windows\System\oEkEPIA.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\GDAYWJf.exe
  C:\Windows\System\GDAYWJf.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\mKJFUZK.exe
  C:\Windows\System\mKJFUZK.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\DmQgbNH.exe
  C:\Windows\System\DmQgbNH.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\CcoHUWf.exe
  C:\Windows\System\CcoHUWf.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\knNtZAK.exe
  C:\Windows\System\knNtZAK.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\FmpNXYY.exe
  C:\Windows\System\FmpNXYY.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\mmExGxC.exe
  C:\Windows\System\mmExGxC.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\sUVHSqW.exe
  C:\Windows\System\sUVHSqW.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\YQRQzFl.exe
  C:\Windows\System\YQRQzFl.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\AFvoZPq.exe
  C:\Windows\System\AFvoZPq.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\WxuhiRY.exe
  C:\Windows\System\WxuhiRY.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\jORssro.exe
  C:\Windows\System\jORssro.exe
  2⤵
  PID:296
- C:\Windows\System\bnnEEBo.exe
  C:\Windows\System\bnnEEBo.exe
  2⤵
  PID:2152
- C:\Windows\System\JnzWwtz.exe
  C:\Windows\System\JnzWwtz.exe
  2⤵
  PID:2820
- C:\Windows\System\igzfAtQ.exe
  C:\Windows\System\igzfAtQ.exe
  2⤵
  PID:2592
- C:\Windows\System\jEPLKCm.exe
  C:\Windows\System\jEPLKCm.exe
  2⤵
  PID:1472
- C:\Windows\System\SslNlRX.exe
  C:\Windows\System\SslNlRX.exe
  2⤵
  PID:2960
- C:\Windows\System\CVlbUWi.exe
  C:\Windows\System\CVlbUWi.exe
  2⤵
  PID:844
- C:\Windows\System\IoWgPtj.exe
  C:\Windows\System\IoWgPtj.exe
  2⤵
  PID:1420
- C:\Windows\System\DQvdSlA.exe
  C:\Windows\System\DQvdSlA.exe
  2⤵
  PID:2112
- C:\Windows\System\kQbqIgc.exe
  C:\Windows\System\kQbqIgc.exe
  2⤵
  PID:1304
- C:\Windows\System\ZoKYNsT.exe
  C:\Windows\System\ZoKYNsT.exe
  2⤵
  PID:380
- C:\Windows\System\gAmyUJI.exe
  C:\Windows\System\gAmyUJI.exe
  2⤵
  PID:972
- C:\Windows\System\iMIpRzd.exe
  C:\Windows\System\iMIpRzd.exe
  2⤵
  PID:2176
- C:\Windows\System\DrCwvPP.exe
  C:\Windows\System\DrCwvPP.exe
  2⤵
  PID:1672
- C:\Windows\System\RIuXkIq.exe
  C:\Windows\System\RIuXkIq.exe
  2⤵
  PID:352
- C:\Windows\System\QsxCMHq.exe
  C:\Windows\System\QsxCMHq.exe
  2⤵
  PID:912
- C:\Windows\System\PEmgjrK.exe
  C:\Windows\System\PEmgjrK.exe
  2⤵
  PID:3052
- C:\Windows\System\ZAuNoZM.exe
  C:\Windows\System\ZAuNoZM.exe
  2⤵
  PID:2672
- C:\Windows\System\CFRCCPx.exe
  C:\Windows\System\CFRCCPx.exe
  2⤵
  PID:1728
- C:\Windows\System\tFgKXFX.exe
  C:\Windows\System\tFgKXFX.exe
  2⤵
  PID:888
- C:\Windows\System\DoGJWHn.exe
  C:\Windows\System\DoGJWHn.exe
  2⤵
  PID:3064
- C:\Windows\System\zKSODoo.exe
  C:\Windows\System\zKSODoo.exe
  2⤵
  PID:1444
- C:\Windows\System\kaFhXRD.exe
  C:\Windows\System\kaFhXRD.exe
  2⤵
  PID:2468
- C:\Windows\System\PYCgoWo.exe
  C:\Windows\System\PYCgoWo.exe
  2⤵
  PID:892
- C:\Windows\System\VGAjFWr.exe
  C:\Windows\System\VGAjFWr.exe
  2⤵
  PID:2896
- C:\Windows\System\GGjnGzv.exe
  C:\Windows\System\GGjnGzv.exe
  2⤵
  PID:1544
- C:\Windows\System\OMbGcPo.exe
  C:\Windows\System\OMbGcPo.exe
  2⤵
  PID:2684
- C:\Windows\System\gwjBYja.exe
  C:\Windows\System\gwjBYja.exe
  2⤵
  PID:1932
- C:\Windows\System\ANXsSku.exe
  C:\Windows\System\ANXsSku.exe
  2⤵
  PID:776
- C:\Windows\System\NNLlLtZ.exe
  C:\Windows\System\NNLlLtZ.exe
  2⤵
  PID:1528
- C:\Windows\System\HQVjHSY.exe
  C:\Windows\System\HQVjHSY.exe
  2⤵
  PID:1536
- C:\Windows\System\cnhdOVL.exe
  C:\Windows\System\cnhdOVL.exe
  2⤵
  PID:2292
- C:\Windows\System\FatMVqr.exe
  C:\Windows\System\FatMVqr.exe
  2⤵
  PID:1588
- C:\Windows\System\ihMCpzN.exe
  C:\Windows\System\ihMCpzN.exe
  2⤵
  PID:2248
- C:\Windows\System\FxFgosY.exe
  C:\Windows\System\FxFgosY.exe
  2⤵
  PID:2256
- C:\Windows\System\lcSXtzY.exe
  C:\Windows\System\lcSXtzY.exe
  2⤵
  PID:2124
- C:\Windows\System\qhlaStj.exe
  C:\Windows\System\qhlaStj.exe
  2⤵
  PID:2924
- C:\Windows\System\Sykpypj.exe
  C:\Windows\System\Sykpypj.exe
  2⤵
  PID:2968
- C:\Windows\System\ozeYCyT.exe
  C:\Windows\System\ozeYCyT.exe
  2⤵
  PID:1704
- C:\Windows\System\YeRuBmq.exe
  C:\Windows\System\YeRuBmq.exe
  2⤵
  PID:2052
- C:\Windows\System\CblBUBj.exe
  C:\Windows\System\CblBUBj.exe
  2⤵
  PID:1560
- C:\Windows\System\Sfwapfa.exe
  C:\Windows\System\Sfwapfa.exe
  2⤵
  PID:1500
- C:\Windows\System\oleYlxH.exe
  C:\Windows\System\oleYlxH.exe
  2⤵
  PID:2836
- C:\Windows\System\kptosNW.exe
  C:\Windows\System\kptosNW.exe
  2⤵
  PID:2100
- C:\Windows\System\petoWHS.exe
  C:\Windows\System\petoWHS.exe
  2⤵
  PID:2308
- C:\Windows\System\yTzLBAp.exe
  C:\Windows\System\yTzLBAp.exe
  2⤵
  PID:2372
- C:\Windows\System\yPHSTfe.exe
  C:\Windows\System\yPHSTfe.exe
  2⤵
  PID:2504
- C:\Windows\System\hRTiPGq.exe
  C:\Windows\System\hRTiPGq.exe
  2⤵
  PID:1656
- C:\Windows\System\gTxLFox.exe
  C:\Windows\System\gTxLFox.exe
  2⤵
  PID:2264
- C:\Windows\System\EtniSpj.exe
  C:\Windows\System\EtniSpj.exe
  2⤵
  PID:1204
- C:\Windows\System\DPERztR.exe
  C:\Windows\System\DPERztR.exe
  2⤵
  PID:2920
- C:\Windows\System\wGrdlSs.exe
  C:\Windows\System\wGrdlSs.exe
  2⤵
  PID:2680
- C:\Windows\System\YQqvcbQ.exe
  C:\Windows\System\YQqvcbQ.exe
  2⤵
  PID:2456
- C:\Windows\System\ojXZfbg.exe
  C:\Windows\System\ojXZfbg.exe
  2⤵
  PID:2872
- C:\Windows\System\dAmlgsz.exe
  C:\Windows\System\dAmlgsz.exe
  2⤵
  PID:2716
- C:\Windows\System\IZhZXJd.exe
  C:\Windows\System\IZhZXJd.exe
  2⤵
  PID:2416
- C:\Windows\System\FXpMMDS.exe
  C:\Windows\System\FXpMMDS.exe
  2⤵
  PID:1508
- C:\Windows\System\puFFkXs.exe
  C:\Windows\System\puFFkXs.exe
  2⤵
  PID:1696
- C:\Windows\System\nOIYssT.exe
  C:\Windows\System\nOIYssT.exe
  2⤵
  PID:2116
- C:\Windows\System\UnIRBrF.exe
  C:\Windows\System\UnIRBrF.exe
  2⤵
  PID:860
- C:\Windows\System\TZcqDhB.exe
  C:\Windows\System\TZcqDhB.exe
  2⤵
  PID:2392
- C:\Windows\System\PKQIDBe.exe
  C:\Windows\System\PKQIDBe.exe
  2⤵
  PID:3040
- C:\Windows\System\hWrkjQw.exe
  C:\Windows\System\hWrkjQw.exe
  2⤵
  PID:2880
- C:\Windows\System\DeEYLaz.exe
  C:\Windows\System\DeEYLaz.exe
  2⤵
  PID:2512
- C:\Windows\System\sxrxFfu.exe
  C:\Windows\System\sxrxFfu.exe
  2⤵
  PID:1712
- C:\Windows\System\axyTVhf.exe
  C:\Windows\System\axyTVhf.exe
  2⤵
  PID:2804
- C:\Windows\System\imwDmQm.exe
  C:\Windows\System\imwDmQm.exe
  2⤵
  PID:1780
- C:\Windows\System\hgnQnrd.exe
  C:\Windows\System\hgnQnrd.exe
  2⤵
  PID:2548
- C:\Windows\System\HEQkcEN.exe
  C:\Windows\System\HEQkcEN.exe
  2⤵
  PID:1620
- C:\Windows\System\kPXLMtN.exe
  C:\Windows\System\kPXLMtN.exe
  2⤵
  PID:2460
- C:\Windows\System\SfzhhIJ.exe
  C:\Windows\System\SfzhhIJ.exe
  2⤵
  PID:340
- C:\Windows\System\hQKtYJJ.exe
  C:\Windows\System\hQKtYJJ.exe
  2⤵
  PID:1648
- C:\Windows\System\vTdMAok.exe
  C:\Windows\System\vTdMAok.exe
  2⤵
  PID:2720
- C:\Windows\System\YxrTtcn.exe
  C:\Windows\System\YxrTtcn.exe
  2⤵
  PID:1632
- C:\Windows\System\MjuPhlb.exe
  C:\Windows\System\MjuPhlb.exe
  2⤵
  PID:2736
- C:\Windows\System\cprTVep.exe
  C:\Windows\System\cprTVep.exe
  2⤵
  PID:576
- C:\Windows\System\vuwHMvp.exe
  C:\Windows\System\vuwHMvp.exe
  2⤵
  PID:2420
- C:\Windows\System\YQqClhF.exe
  C:\Windows\System\YQqClhF.exe
  2⤵
  PID:2668
- C:\Windows\System\PTqIvrl.exe
  C:\Windows\System\PTqIvrl.exe
  2⤵
  PID:1920
- C:\Windows\System\dqUUdzM.exe
  C:\Windows\System\dqUUdzM.exe
  2⤵
  PID:2140
- C:\Windows\System\awaxTyj.exe
  C:\Windows\System\awaxTyj.exe
  2⤵
  PID:1876
- C:\Windows\System\fufGcoh.exe
  C:\Windows\System\fufGcoh.exe
  2⤵
  PID:2604
- C:\Windows\System\wSGHpNN.exe
  C:\Windows\System\wSGHpNN.exe
  2⤵
  PID:2444
- C:\Windows\System\HQAkUUV.exe
  C:\Windows\System\HQAkUUV.exe
  2⤵
  PID:312
- C:\Windows\System\pXUHSWE.exe
  C:\Windows\System\pXUHSWE.exe
  2⤵
  PID:1572
- C:\Windows\System\HZuUErs.exe
  C:\Windows\System\HZuUErs.exe
  2⤵
  PID:2020
- C:\Windows\System\UWFPQCF.exe
  C:\Windows\System\UWFPQCF.exe
  2⤵
  PID:1220
- C:\Windows\System\HUZfQwt.exe
  C:\Windows\System\HUZfQwt.exe
  2⤵
  PID:1020
- C:\Windows\System\tzNyLiG.exe
  C:\Windows\System\tzNyLiG.exe
  2⤵
  PID:2024
- C:\Windows\System\JwPbPqN.exe
  C:\Windows\System\JwPbPqN.exe
  2⤵
  PID:1636
- C:\Windows\System\WnfooLV.exe
  C:\Windows\System\WnfooLV.exe
  2⤵
  PID:3028
- C:\Windows\System\rOzrlzC.exe
  C:\Windows\System\rOzrlzC.exe
  2⤵
  PID:1276
- C:\Windows\System\HGoUNNh.exe
  C:\Windows\System\HGoUNNh.exe
  2⤵
  PID:2384
- C:\Windows\System\hlKMkTr.exe
  C:\Windows\System\hlKMkTr.exe
  2⤵
  PID:2080
- C:\Windows\System\YUmXxcY.exe
  C:\Windows\System\YUmXxcY.exe
  2⤵
  PID:2088
- C:\Windows\System\eakXhSX.exe
  C:\Windows\System\eakXhSX.exe
  2⤵
  PID:3076
- C:\Windows\System\sAdJzKX.exe
  C:\Windows\System\sAdJzKX.exe
  2⤵
  PID:3092
- C:\Windows\System\BTRJjZL.exe
  C:\Windows\System\BTRJjZL.exe
  2⤵
  PID:3108
- C:\Windows\System\apwjfQG.exe
  C:\Windows\System\apwjfQG.exe
  2⤵
  PID:3128
- C:\Windows\System\qIvUgJE.exe
  C:\Windows\System\qIvUgJE.exe
  2⤵
  PID:3144
- C:\Windows\System\MYqaDTY.exe
  C:\Windows\System\MYqaDTY.exe
  2⤵
  PID:3160
- C:\Windows\System\ngXwYSX.exe
  C:\Windows\System\ngXwYSX.exe
  2⤵
  PID:3176
- C:\Windows\System\FKQMNiC.exe
  C:\Windows\System\FKQMNiC.exe
  2⤵
  PID:3192
- C:\Windows\System\JyAATnc.exe
  C:\Windows\System\JyAATnc.exe
  2⤵
  PID:3208
- C:\Windows\System\rMqmHrj.exe
  C:\Windows\System\rMqmHrj.exe
  2⤵
  PID:3224
- C:\Windows\System\kzFKdau.exe
  C:\Windows\System\kzFKdau.exe
  2⤵
  PID:3240
- C:\Windows\System\BenObxx.exe
  C:\Windows\System\BenObxx.exe
  2⤵
  PID:3256
- C:\Windows\System\wPxvbIj.exe
  C:\Windows\System\wPxvbIj.exe
  2⤵
  PID:3272
- C:\Windows\System\WRffVUd.exe
  C:\Windows\System\WRffVUd.exe
  2⤵
  PID:3292
- C:\Windows\System\IiXkAtQ.exe
  C:\Windows\System\IiXkAtQ.exe
  2⤵
  PID:3308
- C:\Windows\System\PWQnyDz.exe
  C:\Windows\System\PWQnyDz.exe
  2⤵
  PID:3324
- C:\Windows\System\TVyTHZO.exe
  C:\Windows\System\TVyTHZO.exe
  2⤵
  PID:3340
- C:\Windows\System\mGyHuEE.exe
  C:\Windows\System\mGyHuEE.exe
  2⤵
  PID:3356
- C:\Windows\System\iHHwTNX.exe
  C:\Windows\System\iHHwTNX.exe
  2⤵
  PID:3372
- C:\Windows\System\mYUHwsw.exe
  C:\Windows\System\mYUHwsw.exe
  2⤵
  PID:3388
- C:\Windows\System\CRbPKGs.exe
  C:\Windows\System\CRbPKGs.exe
  2⤵
  PID:3404
- C:\Windows\System\QWswfCG.exe
  C:\Windows\System\QWswfCG.exe
  2⤵
  PID:3420
- C:\Windows\System\jurWdfb.exe
  C:\Windows\System\jurWdfb.exe
  2⤵
  PID:3436
- C:\Windows\System\JMOZKgV.exe
  C:\Windows\System\JMOZKgV.exe
  2⤵
  PID:3452
- C:\Windows\System\fpihcYG.exe
  C:\Windows\System\fpihcYG.exe
  2⤵
  PID:3468
- C:\Windows\System\VmFBTZm.exe
  C:\Windows\System\VmFBTZm.exe
  2⤵
  PID:3484
- C:\Windows\System\qrBYshA.exe
  C:\Windows\System\qrBYshA.exe
  2⤵
  PID:3500
- C:\Windows\System\EzAJwnt.exe
  C:\Windows\System\EzAJwnt.exe
  2⤵
  PID:3516
- C:\Windows\System\UmvQYrZ.exe
  C:\Windows\System\UmvQYrZ.exe
  2⤵
  PID:3532
- C:\Windows\System\XIgIjoD.exe
  C:\Windows\System\XIgIjoD.exe
  2⤵
  PID:3548
- C:\Windows\System\MDXtmys.exe
  C:\Windows\System\MDXtmys.exe
  2⤵
  PID:3564
- C:\Windows\System\MCCAhLy.exe
  C:\Windows\System\MCCAhLy.exe
  2⤵
  PID:3580
- C:\Windows\System\fsslNOg.exe
  C:\Windows\System\fsslNOg.exe
  2⤵
  PID:3596
- C:\Windows\System\GvEzWYm.exe
  C:\Windows\System\GvEzWYm.exe
  2⤵
  PID:3612
- C:\Windows\System\xsqUXxR.exe
  C:\Windows\System\xsqUXxR.exe
  2⤵
  PID:3628
- C:\Windows\System\wuSDGhE.exe
  C:\Windows\System\wuSDGhE.exe
  2⤵
  PID:3644
- C:\Windows\System\BgdBihr.exe
  C:\Windows\System\BgdBihr.exe
  2⤵
  PID:3660
- C:\Windows\System\eiVIoWr.exe
  C:\Windows\System\eiVIoWr.exe
  2⤵
  PID:3676
- C:\Windows\System\vNTuOmf.exe
  C:\Windows\System\vNTuOmf.exe
  2⤵
  PID:3692
- C:\Windows\System\LjgHWys.exe
  C:\Windows\System\LjgHWys.exe
  2⤵
  PID:3708
- C:\Windows\System\pBQZncu.exe
  C:\Windows\System\pBQZncu.exe
  2⤵
  PID:3724
- C:\Windows\System\KpubxZh.exe
  C:\Windows\System\KpubxZh.exe
  2⤵
  PID:3740
- C:\Windows\System\HoJHIms.exe
  C:\Windows\System\HoJHIms.exe
  2⤵
  PID:3760
- C:\Windows\System\zybtThX.exe
  C:\Windows\System\zybtThX.exe
  2⤵
  PID:3776
- C:\Windows\System\louVmnG.exe
  C:\Windows\System\louVmnG.exe
  2⤵
  PID:3792
- C:\Windows\System\Dqwgxlz.exe
  C:\Windows\System\Dqwgxlz.exe
  2⤵
  PID:3808
- C:\Windows\System\mRRdLZg.exe
  C:\Windows\System\mRRdLZg.exe
  2⤵
  PID:3824
- C:\Windows\System\yaoWKnA.exe
  C:\Windows\System\yaoWKnA.exe
  2⤵
  PID:3840
- C:\Windows\System\lQGvQmJ.exe
  C:\Windows\System\lQGvQmJ.exe
  2⤵
  PID:3856
- C:\Windows\System\aGtSkfs.exe
  C:\Windows\System\aGtSkfs.exe
  2⤵
  PID:3872
- C:\Windows\System\BINQWyt.exe
  C:\Windows\System\BINQWyt.exe
  2⤵
  PID:3888
- C:\Windows\System\TDMaqSv.exe
  C:\Windows\System\TDMaqSv.exe
  2⤵
  PID:3904
- C:\Windows\System\QPSurUP.exe
  C:\Windows\System\QPSurUP.exe
  2⤵
  PID:3920
- C:\Windows\System\CPzTwUU.exe
  C:\Windows\System\CPzTwUU.exe
  2⤵
  PID:3936
- C:\Windows\System\xwkFVol.exe
  C:\Windows\System\xwkFVol.exe
  2⤵
  PID:3956
- C:\Windows\System\YkdRgtz.exe
  C:\Windows\System\YkdRgtz.exe
  2⤵
  PID:3972
- C:\Windows\System\WtcIPUR.exe
  C:\Windows\System\WtcIPUR.exe
  2⤵
  PID:3988
- C:\Windows\System\ajsxQSa.exe
  C:\Windows\System\ajsxQSa.exe
  2⤵
  PID:4004
- C:\Windows\System\UPfhzfC.exe
  C:\Windows\System\UPfhzfC.exe
  2⤵
  PID:4020
- C:\Windows\System\Firweho.exe
  C:\Windows\System\Firweho.exe
  2⤵
  PID:4040
- C:\Windows\System\oLVpaJb.exe
  C:\Windows\System\oLVpaJb.exe
  2⤵
  PID:4056
- C:\Windows\System\iJTydKK.exe
  C:\Windows\System\iJTydKK.exe
  2⤵
  PID:4072
- C:\Windows\System\DoDLlLJ.exe
  C:\Windows\System\DoDLlLJ.exe
  2⤵
  PID:4088
- C:\Windows\System\FUGcboJ.exe
  C:\Windows\System\FUGcboJ.exe
  2⤵
  PID:1104
- C:\Windows\System\dfgvnOt.exe
  C:\Windows\System\dfgvnOt.exe
  2⤵
  PID:2336
- C:\Windows\System\lRHLUgV.exe
  C:\Windows\System\lRHLUgV.exe
  2⤵
  PID:2232
- C:\Windows\System\HbfMqrM.exe
  C:\Windows\System\HbfMqrM.exe
  2⤵
  PID:2596
- C:\Windows\System\TWUcjnn.exe
  C:\Windows\System\TWUcjnn.exe
  2⤵
  PID:4104
- C:\Windows\System\FcfIvIQ.exe
  C:\Windows\System\FcfIvIQ.exe
  2⤵
  PID:4120
- C:\Windows\System\VMwNWMz.exe
  C:\Windows\System\VMwNWMz.exe
  2⤵
  PID:4136
- C:\Windows\System\pdwGCsc.exe
  C:\Windows\System\pdwGCsc.exe
  2⤵
  PID:4152
- C:\Windows\System\vIYQInR.exe
  C:\Windows\System\vIYQInR.exe
  2⤵
  PID:4172
- C:\Windows\System\aQDZvrI.exe
  C:\Windows\System\aQDZvrI.exe
  2⤵
  PID:4192
- C:\Windows\System\aDKnemZ.exe
  C:\Windows\System\aDKnemZ.exe
  2⤵
  PID:4208
- C:\Windows\System\cMDRPUt.exe
  C:\Windows\System\cMDRPUt.exe
  2⤵
  PID:4224
- C:\Windows\System\WvgnUcZ.exe
  C:\Windows\System\WvgnUcZ.exe
  2⤵
  PID:4240
- C:\Windows\System\uIgXVYd.exe
  C:\Windows\System\uIgXVYd.exe
  2⤵
  PID:4256
- C:\Windows\System\mhFFLwT.exe
  C:\Windows\System\mhFFLwT.exe
  2⤵
  PID:4272
- C:\Windows\System\DdhpYTX.exe
  C:\Windows\System\DdhpYTX.exe
  2⤵
  PID:4288
- C:\Windows\System\lEIwVfI.exe
  C:\Windows\System\lEIwVfI.exe
  2⤵
  PID:4304
- C:\Windows\System\KOplJgY.exe
  C:\Windows\System\KOplJgY.exe
  2⤵
  PID:4320
- C:\Windows\System\uAqwNZP.exe
  C:\Windows\System\uAqwNZP.exe
  2⤵
  PID:4336
- C:\Windows\System\TqHLCpH.exe
  C:\Windows\System\TqHLCpH.exe
  2⤵
  PID:4352
- C:\Windows\System\QuwbNTi.exe
  C:\Windows\System\QuwbNTi.exe
  2⤵
  PID:4368
- C:\Windows\System\BTulhmF.exe
  C:\Windows\System\BTulhmF.exe
  2⤵
  PID:4384
- C:\Windows\System\ocDMMcb.exe
  C:\Windows\System\ocDMMcb.exe
  2⤵
  PID:4400
- C:\Windows\System\jwHEhcy.exe
  C:\Windows\System\jwHEhcy.exe
  2⤵
  PID:4416
- C:\Windows\System\yoVptOr.exe
  C:\Windows\System\yoVptOr.exe
  2⤵
  PID:4432
- C:\Windows\System\XaAUQWB.exe
  C:\Windows\System\XaAUQWB.exe
  2⤵
  PID:4448
- C:\Windows\System\MfrKOZb.exe
  C:\Windows\System\MfrKOZb.exe
  2⤵
  PID:4464
- C:\Windows\System\XMmSvma.exe
  C:\Windows\System\XMmSvma.exe
  2⤵
  PID:4480
- C:\Windows\System\hFMMkFR.exe
  C:\Windows\System\hFMMkFR.exe
  2⤵
  PID:4496
- C:\Windows\System\qRQEOfS.exe
  C:\Windows\System\qRQEOfS.exe
  2⤵
  PID:4512
- C:\Windows\System\GbMLbaA.exe
  C:\Windows\System\GbMLbaA.exe
  2⤵
  PID:4528
- C:\Windows\System\mTsiRtb.exe
  C:\Windows\System\mTsiRtb.exe
  2⤵
  PID:4544
- C:\Windows\System\EtAtfTy.exe
  C:\Windows\System\EtAtfTy.exe
  2⤵
  PID:4560
- C:\Windows\System\TPgMVxs.exe
  C:\Windows\System\TPgMVxs.exe
  2⤵
  PID:4576
- C:\Windows\System\OoLJjSd.exe
  C:\Windows\System\OoLJjSd.exe
  2⤵
  PID:4592
- C:\Windows\System\bRGzLNl.exe
  C:\Windows\System\bRGzLNl.exe
  2⤵
  PID:4700
- C:\Windows\System\NYYVLKM.exe
  C:\Windows\System\NYYVLKM.exe
  2⤵
  PID:4736
- C:\Windows\System\yjGSFFy.exe
  C:\Windows\System\yjGSFFy.exe
  2⤵
  PID:4752
- C:\Windows\System\lscONmg.exe
  C:\Windows\System\lscONmg.exe
  2⤵
  PID:4768
- C:\Windows\System\ExiAAca.exe
  C:\Windows\System\ExiAAca.exe
  2⤵
  PID:4784
- C:\Windows\System\enMBiGX.exe
  C:\Windows\System\enMBiGX.exe
  2⤵
  PID:4800
- C:\Windows\System\mEWDoFG.exe
  C:\Windows\System\mEWDoFG.exe
  2⤵
  PID:4816
- C:\Windows\System\NutXyTT.exe
  C:\Windows\System\NutXyTT.exe
  2⤵
  PID:4832
- C:\Windows\System\ZwHUtws.exe
  C:\Windows\System\ZwHUtws.exe
  2⤵
  PID:4848
- C:\Windows\System\qSFYODx.exe
  C:\Windows\System\qSFYODx.exe
  2⤵
  PID:4864
- C:\Windows\System\QPYOiaU.exe
  C:\Windows\System\QPYOiaU.exe
  2⤵
  PID:4880
- C:\Windows\System\jOQqHXc.exe
  C:\Windows\System\jOQqHXc.exe
  2⤵
  PID:4896
- C:\Windows\System\eBPAgho.exe
  C:\Windows\System\eBPAgho.exe
  2⤵
  PID:4912
- C:\Windows\System\XUKDMgH.exe
  C:\Windows\System\XUKDMgH.exe
  2⤵
  PID:4928
- C:\Windows\System\RvJhVAh.exe
  C:\Windows\System\RvJhVAh.exe
  2⤵
  PID:4944
- C:\Windows\System\wcCjHYi.exe
  C:\Windows\System\wcCjHYi.exe
  2⤵
  PID:4960
- C:\Windows\System\OgLdSHQ.exe
  C:\Windows\System\OgLdSHQ.exe
  2⤵
  PID:4976
- C:\Windows\System\NKKndXs.exe
  C:\Windows\System\NKKndXs.exe
  2⤵
  PID:4996
- C:\Windows\System\KgiMHdJ.exe
  C:\Windows\System\KgiMHdJ.exe
  2⤵
  PID:5012
- C:\Windows\System\kUWqEGe.exe
  C:\Windows\System\kUWqEGe.exe
  2⤵
  PID:5028
- C:\Windows\System\wFIzedu.exe
  C:\Windows\System\wFIzedu.exe
  2⤵
  PID:5044
- C:\Windows\System\bJnjQle.exe
  C:\Windows\System\bJnjQle.exe
  2⤵
  PID:5060
- C:\Windows\System\JOUzrYX.exe
  C:\Windows\System\JOUzrYX.exe
  2⤵
  PID:5076
- C:\Windows\System\CeyMlEH.exe
  C:\Windows\System\CeyMlEH.exe
  2⤵
  PID:5092
- C:\Windows\System\GfMlwYi.exe
  C:\Windows\System\GfMlwYi.exe
  2⤵
  PID:5108
- C:\Windows\System\cnviafV.exe
  C:\Windows\System\cnviafV.exe
  2⤵
  PID:1564
- C:\Windows\System\GkNmSAY.exe
  C:\Windows\System\GkNmSAY.exe
  2⤵
  PID:3136
- C:\Windows\System\NNFWmVO.exe
  C:\Windows\System\NNFWmVO.exe
  2⤵
  PID:3428
- C:\Windows\System\iRkeiMQ.exe
  C:\Windows\System\iRkeiMQ.exe
  2⤵
  PID:3100
- C:\Windows\System\ZeZsdUz.exe
  C:\Windows\System\ZeZsdUz.exe
  2⤵
  PID:3232
- C:\Windows\System\jcYRStS.exe
  C:\Windows\System\jcYRStS.exe
  2⤵
  PID:3300
- C:\Windows\System\kCIBEjH.exe
  C:\Windows\System\kCIBEjH.exe
  2⤵
  PID:4064
- C:\Windows\System\JAuofHb.exe
  C:\Windows\System\JAuofHb.exe
  2⤵
  PID:3496
- C:\Windows\System\IMlLtiD.exe
  C:\Windows\System\IMlLtiD.exe
  2⤵
  PID:3716
- C:\Windows\System\daJBdUd.exe
  C:\Windows\System\daJBdUd.exe
  2⤵
  PID:3816
- C:\Windows\System\yafGqkN.exe
  C:\Windows\System\yafGqkN.exe
  2⤵
  PID:3984
- C:\Windows\System\ZqRZUSZ.exe
  C:\Windows\System\ZqRZUSZ.exe
  2⤵
  PID:2328
- C:\Windows\System\GVPUmll.exe
  C:\Windows\System\GVPUmll.exe
  2⤵
  PID:3348
- C:\Windows\System\SznrRXI.exe
  C:\Windows\System\SznrRXI.exe
  2⤵
  PID:3444
- C:\Windows\System\jalpRCz.exe
  C:\Windows\System\jalpRCz.exe
  2⤵
  PID:4116
- C:\Windows\System\FvtVaCG.exe
  C:\Windows\System\FvtVaCG.exe
  2⤵
  PID:3576
- C:\Windows\System\HiyumHg.exe
  C:\Windows\System\HiyumHg.exe
  2⤵
  PID:3636
- C:\Windows\System\CclrTBT.exe
  C:\Windows\System\CclrTBT.exe
  2⤵
  PID:3772
- C:\Windows\System\eSkxOTo.exe
  C:\Windows\System\eSkxOTo.exe
  2⤵
  PID:4316
- C:\Windows\System\jSiuqWI.exe
  C:\Windows\System\jSiuqWI.exe
  2⤵
  PID:4284
- C:\Windows\System\UhSizFx.exe
  C:\Windows\System\UhSizFx.exe
  2⤵
  PID:4100
- C:\Windows\System\LUIKoho.exe
  C:\Windows\System\LUIKoho.exe
  2⤵
  PID:4148
- C:\Windows\System\rawRlfr.exe
  C:\Windows\System\rawRlfr.exe
  2⤵
  PID:4220
- C:\Windows\System\EyHlGrJ.exe
  C:\Windows\System\EyHlGrJ.exe
  2⤵
  PID:4204
- C:\Windows\System\RyMGZpK.exe
  C:\Windows\System\RyMGZpK.exe
  2⤵
  PID:4236
- C:\Windows\System\WwkDlbG.exe
  C:\Windows\System\WwkDlbG.exe
  2⤵
  PID:4440
- C:\Windows\System\DEXtbRj.exe
  C:\Windows\System\DEXtbRj.exe
  2⤵
  PID:3384
- C:\Windows\System\xNItqaJ.exe
  C:\Windows\System\xNItqaJ.exe
  2⤵
  PID:4396
- C:\Windows\System\RfPNXEC.exe
  C:\Windows\System\RfPNXEC.exe
  2⤵
  PID:3896
- C:\Windows\System\GVaQoHv.exe
  C:\Windows\System\GVaQoHv.exe
  2⤵
  PID:4264
- C:\Windows\System\UrYQpRg.exe
  C:\Windows\System\UrYQpRg.exe
  2⤵
  PID:4428
- C:\Windows\System\rnfFCGP.exe
  C:\Windows\System\rnfFCGP.exe
  2⤵
  PID:4508
- C:\Windows\System\BwRiLCI.exe
  C:\Windows\System\BwRiLCI.exe
  2⤵
  PID:4600
- C:\Windows\System\NzkUsQA.exe
  C:\Windows\System\NzkUsQA.exe
  2⤵
  PID:4628
- C:\Windows\System\NjJgKLH.exe
  C:\Windows\System\NjJgKLH.exe
  2⤵
  PID:4644
- C:\Windows\System\OCvyIgC.exe
  C:\Windows\System\OCvyIgC.exe
  2⤵
  PID:4664
- C:\Windows\System\SXUpEHq.exe
  C:\Windows\System\SXUpEHq.exe
  2⤵
  PID:4680
- C:\Windows\System\HnZtXwq.exe
  C:\Windows\System\HnZtXwq.exe
  2⤵
  PID:4524
- C:\Windows\System\zAtzDWK.exe
  C:\Windows\System\zAtzDWK.exe
  2⤵
  PID:4720
- C:\Windows\System\RmDpRLw.exe
  C:\Windows\System\RmDpRLw.exe
  2⤵
  PID:4760
- C:\Windows\System\uebNeqb.exe
  C:\Windows\System\uebNeqb.exe
  2⤵
  PID:4796
- C:\Windows\System\ZNVfDip.exe
  C:\Windows\System\ZNVfDip.exe
  2⤵
  PID:4780
- C:\Windows\System\kUyOAGP.exe
  C:\Windows\System\kUyOAGP.exe
  2⤵
  PID:4844
- C:\Windows\System\zBofxLK.exe
  C:\Windows\System\zBofxLK.exe
  2⤵
  PID:4828
- C:\Windows\System\DaODOOw.exe
  C:\Windows\System\DaODOOw.exe
  2⤵
  PID:4984
- C:\Windows\System\KTgeeiV.exe
  C:\Windows\System\KTgeeiV.exe
  2⤵
  PID:4872
- C:\Windows\System\bfqaLhB.exe
  C:\Windows\System\bfqaLhB.exe
  2⤵
  PID:4936
- C:\Windows\System\DZJgrZX.exe
  C:\Windows\System\DZJgrZX.exe
  2⤵
  PID:5040
- C:\Windows\System\EXzizRl.exe
  C:\Windows\System\EXzizRl.exe
  2⤵
  PID:3336
- C:\Windows\System\VQdAKlP.exe
  C:\Windows\System\VQdAKlP.exe
  2⤵
  PID:1968
- C:\Windows\System\KsFbLQc.exe
  C:\Windows\System\KsFbLQc.exe
  2⤵
  PID:4032
- C:\Windows\System\HsrHQPx.exe
  C:\Windows\System\HsrHQPx.exe
  2⤵
  PID:2452
- C:\Windows\System\xpBgSub.exe
  C:\Windows\System\xpBgSub.exe
  2⤵
  PID:5104
- C:\Windows\System\pspBLZr.exe
  C:\Windows\System\pspBLZr.exe
  2⤵
  PID:3368
- C:\Windows\System\wdmAqrY.exe
  C:\Windows\System\wdmAqrY.exe
  2⤵
  PID:5084
- C:\Windows\System\zdurXPh.exe
  C:\Windows\System\zdurXPh.exe
  2⤵
  PID:2380
- C:\Windows\System\mmJjlXc.exe
  C:\Windows\System\mmJjlXc.exe
  2⤵
  PID:3284
- C:\Windows\System\tFpOSnZ.exe
  C:\Windows\System\tFpOSnZ.exe
  2⤵
  PID:3464
- C:\Windows\System\AGyaJeT.exe
  C:\Windows\System\AGyaJeT.exe
  2⤵
  PID:2704
- C:\Windows\System\dOvEijk.exe
  C:\Windows\System\dOvEijk.exe
  2⤵
  PID:3588
- C:\Windows\System\nKwxIOx.exe
  C:\Windows\System\nKwxIOx.exe
  2⤵
  PID:3560
- C:\Windows\System\ApdJojQ.exe
  C:\Windows\System\ApdJojQ.exe
  2⤵
  PID:3684
- C:\Windows\System\KYqUyns.exe
  C:\Windows\System\KYqUyns.exe
  2⤵
  PID:3752
- C:\Windows\System\oIaUOTZ.exe
  C:\Windows\System\oIaUOTZ.exe
  2⤵
  PID:3912
- C:\Windows\System\eAdvzkd.exe
  C:\Windows\System\eAdvzkd.exe
  2⤵
  PID:3884
- C:\Windows\System\GrtkiMW.exe
  C:\Windows\System\GrtkiMW.exe
  2⤵
  PID:3980
- C:\Windows\System\gGtROQg.exe
  C:\Windows\System\gGtROQg.exe
  2⤵
  PID:4048
- C:\Windows\System\vaagnWQ.exe
  C:\Windows\System\vaagnWQ.exe
  2⤵
  PID:1684
- C:\Windows\System\ZojcGNR.exe
  C:\Windows\System\ZojcGNR.exe
  2⤵
  PID:1256
- C:\Windows\System\wHVlaCu.exe
  C:\Windows\System\wHVlaCu.exe
  2⤵
  PID:1912
- C:\Windows\System\giXTwjW.exe
  C:\Windows\System\giXTwjW.exe
  2⤵
  PID:4144
- C:\Windows\System\raBOKzx.exe
  C:\Windows\System\raBOKzx.exe
  2⤵
  PID:3544
- C:\Windows\System\tHGzNDl.exe
  C:\Windows\System\tHGzNDl.exe
  2⤵
  PID:3640
- C:\Windows\System\foCXjpO.exe
  C:\Windows\System\foCXjpO.exe
  2⤵
  PID:4312
- C:\Windows\System\HcWpTEa.exe
  C:\Windows\System\HcWpTEa.exe
  2⤵
  PID:4344
- C:\Windows\System\ahkERqn.exe
  C:\Windows\System\ahkERqn.exe
  2⤵
  PID:4380
- C:\Windows\System\UxUwkRC.exe
  C:\Windows\System\UxUwkRC.exe
  2⤵
  PID:3316
- C:\Windows\System\xgIADhF.exe
  C:\Windows\System\xgIADhF.exe
  2⤵
  PID:3412
- C:\Windows\System\tQymUUV.exe
  C:\Windows\System\tQymUUV.exe
  2⤵
  PID:4360
- C:\Windows\System\NmMQHOS.exe
  C:\Windows\System\NmMQHOS.exe
  2⤵
  PID:4424
- C:\Windows\System\bWEjRgC.exe
  C:\Windows\System\bWEjRgC.exe
  2⤵
  PID:4472
- C:\Windows\System\bXdnxju.exe
  C:\Windows\System\bXdnxju.exe
  2⤵
  PID:4612
- C:\Windows\System\mruXVPk.exe
  C:\Windows\System\mruXVPk.exe
  2⤵
  PID:4716
- C:\Windows\System\SybvNPA.exe
  C:\Windows\System\SybvNPA.exe
  2⤵
  PID:4776
- C:\Windows\System\drVphqQ.exe
  C:\Windows\System\drVphqQ.exe
  2⤵
  PID:4748
- C:\Windows\System\NCVWwjw.exe
  C:\Windows\System\NCVWwjw.exe
  2⤵
  PID:5024
- C:\Windows\System\tsUNkVm.exe
  C:\Windows\System\tsUNkVm.exe
  2⤵
  PID:4968
- C:\Windows\System\HeKiaLx.exe
  C:\Windows\System\HeKiaLx.exe
  2⤵
  PID:4988
- C:\Windows\System\skZRUSf.exe
  C:\Windows\System\skZRUSf.exe
  2⤵
  PID:3236
- C:\Windows\System\FArYHFV.exe
  C:\Windows\System\FArYHFV.exe
  2⤵
  PID:1788
- C:\Windows\System\JBBLeVd.exe
  C:\Windows\System\JBBLeVd.exe
  2⤵
  PID:3364
- C:\Windows\System\SCLBwsW.exe
  C:\Windows\System\SCLBwsW.exe
  2⤵
  PID:5072
- C:\Windows\System\NANOLnn.exe
  C:\Windows\System\NANOLnn.exe
  2⤵
  PID:3620
- C:\Windows\System\tzMdPLd.exe
  C:\Windows\System\tzMdPLd.exe
  2⤵
  PID:2724
- C:\Windows\System\TjJewlv.exe
  C:\Windows\System\TjJewlv.exe
  2⤵
  PID:2588
- C:\Windows\System\pQDdLHd.exe
  C:\Windows\System\pQDdLHd.exe
  2⤵
  PID:3252
- C:\Windows\System\OIHEyba.exe
  C:\Windows\System\OIHEyba.exe
  2⤵
  PID:3512
- C:\Windows\System\jFzQiwt.exe
  C:\Windows\System\jFzQiwt.exe
  2⤵
  PID:3156
- C:\Windows\System\Ahhsage.exe
  C:\Windows\System\Ahhsage.exe
  2⤵
  PID:3084
- C:\Windows\System\KgSuZBq.exe
  C:\Windows\System\KgSuZBq.exe
  2⤵
  PID:3748
- C:\Windows\System\ihSBmZn.exe
  C:\Windows\System\ihSBmZn.exe
  2⤵
  PID:3572
- C:\Windows\System\aDyhvGb.exe
  C:\Windows\System\aDyhvGb.exe
  2⤵
  PID:4280
- C:\Windows\System\DBAUZMV.exe
  C:\Windows\System\DBAUZMV.exe
  2⤵
  PID:3704
- C:\Windows\System\yqeLald.exe
  C:\Windows\System\yqeLald.exe
  2⤵
  PID:4132
- C:\Windows\System\aGvElMp.exe
  C:\Windows\System\aGvElMp.exe
  2⤵
  PID:4216
- C:\Windows\System\rZOckxx.exe
  C:\Windows\System\rZOckxx.exe
  2⤵
  PID:4296
- C:\Windows\System\bRMSaHq.exe
  C:\Windows\System\bRMSaHq.exe
  2⤵
  PID:3352
- C:\Windows\System\VEDumQd.exe
  C:\Windows\System\VEDumQd.exe
  2⤵
  PID:3732
- C:\Windows\System\dosceva.exe
  C:\Windows\System\dosceva.exe
  2⤵
  PID:4504
- C:\Windows\System\WSLtTdM.exe
  C:\Windows\System\WSLtTdM.exe
  2⤵
  PID:4492
- C:\Windows\System\ZDZmPZZ.exe
  C:\Windows\System\ZDZmPZZ.exe
  2⤵
  PID:4640
- C:\Windows\System\mWuitro.exe
  C:\Windows\System\mWuitro.exe
  2⤵
  PID:2412
- C:\Windows\System\vlQaNua.exe
  C:\Windows\System\vlQaNua.exe
  2⤵
  PID:2940
- C:\Windows\System\GrTaQAH.exe
  C:\Windows\System\GrTaQAH.exe
  2⤵
  PID:4696
- C:\Windows\System\qCSOcmm.exe
  C:\Windows\System\qCSOcmm.exe
  2⤵
  PID:4488
- C:\Windows\System\epkeEBA.exe
  C:\Windows\System\epkeEBA.exe
  2⤵
  PID:4712
- C:\Windows\System\UpevmZb.exe
  C:\Windows\System\UpevmZb.exe
  2⤵
  PID:4556
- C:\Windows\System\SVERBXr.exe
  C:\Windows\System\SVERBXr.exe
  2⤵
  PID:4924
- C:\Windows\System\jbKgaGx.exe
  C:\Windows\System\jbKgaGx.exe
  2⤵
  PID:5004
- C:\Windows\System\XLVInxe.exe
  C:\Windows\System\XLVInxe.exe
  2⤵
  PID:2952
- C:\Windows\System\yJLgFGR.exe
  C:\Windows\System\yJLgFGR.exe
  2⤵
  PID:3556
- C:\Windows\System\JGvEwuW.exe
  C:\Windows\System\JGvEwuW.exe
  2⤵
  PID:3460
- C:\Windows\System\EGtmWTK.exe
  C:\Windows\System\EGtmWTK.exe
  2⤵
  PID:3784
- C:\Windows\System\MSLsosF.exe
  C:\Windows\System\MSLsosF.exe
  2⤵
  PID:4732
- C:\Windows\System\HRzowZs.exe
  C:\Windows\System\HRzowZs.exe
  2⤵
  PID:4908
- C:\Windows\System\hVJbywW.exe
  C:\Windows\System\hVJbywW.exe
  2⤵
  PID:4956
- C:\Windows\System\WHAcjKW.exe
  C:\Windows\System\WHAcjKW.exe
  2⤵
  PID:4668
- C:\Windows\System\IHHZGLQ.exe
  C:\Windows\System\IHHZGLQ.exe
  2⤵
  PID:4300
- C:\Windows\System\cOOudZc.exe
  C:\Windows\System\cOOudZc.exe
  2⤵
  PID:4460
- C:\Windows\System\CAJhTqN.exe
  C:\Windows\System\CAJhTqN.exe
  2⤵
  PID:3188
- C:\Windows\System\qiEwLdQ.exe
  C:\Windows\System\qiEwLdQ.exe
  2⤵
  PID:3900
- C:\Windows\System\MBWJusg.exe
  C:\Windows\System\MBWJusg.exe
  2⤵
  PID:4812
- C:\Windows\System\RnjQYbN.exe
  C:\Windows\System\RnjQYbN.exe
  2⤵
  PID:4588
- C:\Windows\System\GUuyIop.exe
  C:\Windows\System\GUuyIop.exe
  2⤵
  PID:4392
- C:\Windows\System\FmciaOW.exe
  C:\Windows\System\FmciaOW.exe
  2⤵
  PID:3736
- C:\Windows\System\xfcrSMG.exe
  C:\Windows\System\xfcrSMG.exe
  2⤵
  PID:4444
- C:\Windows\System\PclQtkx.exe
  C:\Windows\System\PclQtkx.exe
  2⤵
  PID:1736
- C:\Windows\System\XgCSPWR.exe
  C:\Windows\System\XgCSPWR.exe
  2⤵
  PID:4348
- C:\Windows\System\BkBuOvu.exe
  C:\Windows\System\BkBuOvu.exe
  2⤵
  PID:3480
- C:\Windows\System\PxIEdhv.exe
  C:\Windows\System\PxIEdhv.exe
  2⤵
  PID:3788
- C:\Windows\System\tNWTgnO.exe
  C:\Windows\System\tNWTgnO.exe
  2⤵
  PID:5116
- C:\Windows\System\hpdAiWQ.exe
  C:\Windows\System\hpdAiWQ.exe
  2⤵
  PID:3492
- C:\Windows\System\sLTBmiV.exe
  C:\Windows\System\sLTBmiV.exe
  2⤵
  PID:5128
- C:\Windows\System\fvnCbBP.exe
  C:\Windows\System\fvnCbBP.exe
  2⤵
  PID:5148
- C:\Windows\System\veXjnyS.exe
  C:\Windows\System\veXjnyS.exe
  2⤵
  PID:5164
- C:\Windows\System\YowvRfo.exe
  C:\Windows\System\YowvRfo.exe
  2⤵
  PID:5236
- C:\Windows\System\mDUQLou.exe
  C:\Windows\System\mDUQLou.exe
  2⤵
  PID:5252
- C:\Windows\System\dKLFLzr.exe
  C:\Windows\System\dKLFLzr.exe
  2⤵
  PID:5268
- C:\Windows\System\OLdSnia.exe
  C:\Windows\System\OLdSnia.exe
  2⤵
  PID:5288
- C:\Windows\System\eiRszHm.exe
  C:\Windows\System\eiRszHm.exe
  2⤵
  PID:5304
- C:\Windows\System\tWyfMWN.exe
  C:\Windows\System\tWyfMWN.exe
  2⤵
  PID:5320
- C:\Windows\System\EoQtRnf.exe
  C:\Windows\System\EoQtRnf.exe
  2⤵
  PID:5336
- C:\Windows\System\owoPCae.exe
  C:\Windows\System\owoPCae.exe
  2⤵
  PID:5352
- C:\Windows\System\nOYyxAi.exe
  C:\Windows\System\nOYyxAi.exe
  2⤵
  PID:5372
- C:\Windows\System\KBEJeRK.exe
  C:\Windows\System\KBEJeRK.exe
  2⤵
  PID:5388
- C:\Windows\System\NPtZmwO.exe
  C:\Windows\System\NPtZmwO.exe
  2⤵
  PID:5404
- C:\Windows\System\LpJfXDy.exe
  C:\Windows\System\LpJfXDy.exe
  2⤵
  PID:5420
- C:\Windows\System\pSajNGo.exe
  C:\Windows\System\pSajNGo.exe
  2⤵
  PID:5436
- C:\Windows\System\KkkOfzV.exe
  C:\Windows\System\KkkOfzV.exe
  2⤵
  PID:5456
- C:\Windows\System\xalvNWh.exe
  C:\Windows\System\xalvNWh.exe
  2⤵
  PID:5472
- C:\Windows\System\cIUgvmE.exe
  C:\Windows\System\cIUgvmE.exe
  2⤵
  PID:5488
- C:\Windows\System\tUtdMrx.exe
  C:\Windows\System\tUtdMrx.exe
  2⤵
  PID:5504
- C:\Windows\System\viqZUuf.exe
  C:\Windows\System\viqZUuf.exe
  2⤵
  PID:5520
- C:\Windows\System\PlPGtAP.exe
  C:\Windows\System\PlPGtAP.exe
  2⤵
  PID:5536
- C:\Windows\System\RfUSrmX.exe
  C:\Windows\System\RfUSrmX.exe
  2⤵
  PID:5556
- C:\Windows\System\PymAbYw.exe
  C:\Windows\System\PymAbYw.exe
  2⤵
  PID:5572
- C:\Windows\System\IRqJqxR.exe
  C:\Windows\System\IRqJqxR.exe
  2⤵
  PID:5588
- C:\Windows\System\eDuDMLp.exe
  C:\Windows\System\eDuDMLp.exe
  2⤵
  PID:5604
- C:\Windows\System\xWUqzrV.exe
  C:\Windows\System\xWUqzrV.exe
  2⤵
  PID:5620
- C:\Windows\System\lTKQPzC.exe
  C:\Windows\System\lTKQPzC.exe
  2⤵
  PID:5636
- C:\Windows\System\YjTtTBr.exe
  C:\Windows\System\YjTtTBr.exe
  2⤵
  PID:5656
- C:\Windows\System\NxuIhbO.exe
  C:\Windows\System\NxuIhbO.exe
  2⤵
  PID:5672
- C:\Windows\System\kuvwfOu.exe
  C:\Windows\System\kuvwfOu.exe
  2⤵
  PID:5688
- C:\Windows\System\rQOZTKn.exe
  C:\Windows\System\rQOZTKn.exe
  2⤵
  PID:5704
- C:\Windows\System\yaYWEoZ.exe
  C:\Windows\System\yaYWEoZ.exe
  2⤵
  PID:5720
- C:\Windows\System\IyBYdPS.exe
  C:\Windows\System\IyBYdPS.exe
  2⤵
  PID:5736
- C:\Windows\System\rJqoRoq.exe
  C:\Windows\System\rJqoRoq.exe
  2⤵
  PID:5752
- C:\Windows\System\QPWToPI.exe
  C:\Windows\System\QPWToPI.exe
  2⤵
  PID:5768
- C:\Windows\System\XcrFMuU.exe
  C:\Windows\System\XcrFMuU.exe
  2⤵
  PID:5788
- C:\Windows\System\DgsUOFh.exe
  C:\Windows\System\DgsUOFh.exe
  2⤵
  PID:5804
- C:\Windows\System\fcjXQMn.exe
  C:\Windows\System\fcjXQMn.exe
  2⤵
  PID:5820
- C:\Windows\System\xINOgnn.exe
  C:\Windows\System\xINOgnn.exe
  2⤵
  PID:5912
- C:\Windows\System\jeabKcY.exe
  C:\Windows\System\jeabKcY.exe
  2⤵
  PID:5928
- C:\Windows\System\UNdELzX.exe
  C:\Windows\System\UNdELzX.exe
  2⤵
  PID:5944
- C:\Windows\System\RIHabaC.exe
  C:\Windows\System\RIHabaC.exe
  2⤵
  PID:5960
- C:\Windows\System\NuwJZdM.exe
  C:\Windows\System\NuwJZdM.exe
  2⤵
  PID:5976
- C:\Windows\System\oZSYGkl.exe
  C:\Windows\System\oZSYGkl.exe
  2⤵
  PID:5992
- C:\Windows\System\vVdWngi.exe
  C:\Windows\System\vVdWngi.exe
  2⤵
  PID:6008
- C:\Windows\System\hvFCAOu.exe
  C:\Windows\System\hvFCAOu.exe
  2⤵
  PID:6024
- C:\Windows\System\lRDvJRp.exe
  C:\Windows\System\lRDvJRp.exe
  2⤵
  PID:6040
- C:\Windows\System\XWXvwkl.exe
  C:\Windows\System\XWXvwkl.exe
  2⤵
  PID:6056
- C:\Windows\System\xnBODDd.exe
  C:\Windows\System\xnBODDd.exe
  2⤵
  PID:6072
- C:\Windows\System\vHvYELH.exe
  C:\Windows\System\vHvYELH.exe
  2⤵
  PID:6088
- C:\Windows\System\sUxYlXt.exe
  C:\Windows\System\sUxYlXt.exe
  2⤵
  PID:6104
- C:\Windows\System\ipcbrdV.exe
  C:\Windows\System\ipcbrdV.exe
  2⤵
  PID:6120
- C:\Windows\System\gdpijXI.exe
  C:\Windows\System\gdpijXI.exe
  2⤵
  PID:6136
- C:\Windows\System\SAJoUot.exe
  C:\Windows\System\SAJoUot.exe
  2⤵
  PID:4536
- C:\Windows\System\aSKEcOh.exe
  C:\Windows\System\aSKEcOh.exe
  2⤵
  PID:3152
- C:\Windows\System\ueJZkIJ.exe
  C:\Windows\System\ueJZkIJ.exe
  2⤵
  PID:3948
- C:\Windows\System\hJKwpzi.exe
  C:\Windows\System\hJKwpzi.exe
  2⤵
  PID:5180
- C:\Windows\System\YMLxqbP.exe
  C:\Windows\System\YMLxqbP.exe
  2⤵
  PID:5196
- C:\Windows\System\DsqlQgL.exe
  C:\Windows\System\DsqlQgL.exe
  2⤵
  PID:5188
- C:\Windows\System\VuFZeZJ.exe
  C:\Windows\System\VuFZeZJ.exe
  2⤵
  PID:5144
- C:\Windows\System\PAXduLl.exe
  C:\Windows\System\PAXduLl.exe
  2⤵
  PID:5216
- C:\Windows\System\EvMsCkt.exe
  C:\Windows\System\EvMsCkt.exe
  2⤵
  PID:5220
- C:\Windows\System\OFwBDas.exe
  C:\Windows\System\OFwBDas.exe
  2⤵
  PID:4920
- C:\Windows\System\AlcIOwb.exe
  C:\Windows\System\AlcIOwb.exe
  2⤵
  PID:5244
- C:\Windows\System\OZzDutm.exe
  C:\Windows\System\OZzDutm.exe
  2⤵
  PID:5248
- C:\Windows\System\ffQjMPW.exe
  C:\Windows\System\ffQjMPW.exe
  2⤵
  PID:5360
- C:\Windows\System\DoZxxEp.exe
  C:\Windows\System\DoZxxEp.exe
  2⤵
  PID:5396
- C:\Windows\System\TeUJNuU.exe
  C:\Windows\System\TeUJNuU.exe
  2⤵
  PID:5464
- C:\Windows\System\lotzEED.exe
  C:\Windows\System\lotzEED.exe
  2⤵
  PID:5500
- C:\Windows\System\LRftYNu.exe
  C:\Windows\System\LRftYNu.exe
  2⤵
  PID:5764
- C:\Windows\System\MpMZRgE.exe
  C:\Windows\System\MpMZRgE.exe
  2⤵
  PID:5700
- C:\Windows\System\dmFjpxn.exe
  C:\Windows\System\dmFjpxn.exe
  2⤵
  PID:5632
- C:\Windows\System\YCGGlib.exe
  C:\Windows\System\YCGGlib.exe
  2⤵
  PID:5568
- C:\Windows\System\eytyQbp.exe
  C:\Windows\System\eytyQbp.exe
  2⤵
  PID:5384
- C:\Windows\System\JliqEPt.exe
  C:\Windows\System\JliqEPt.exe
  2⤵
  PID:5452
- C:\Windows\System\dXyLlrH.exe
  C:\Windows\System\dXyLlrH.exe
  2⤵
  PID:5484
- C:\Windows\System\pHXeLuj.exe
  C:\Windows\System\pHXeLuj.exe
  2⤵
  PID:5580
- C:\Windows\System\dzFNYdg.exe
  C:\Windows\System\dzFNYdg.exe
  2⤵
  PID:5644
- C:\Windows\System\OAHMrBr.exe
  C:\Windows\System\OAHMrBr.exe
  2⤵
  PID:5712
- C:\Windows\System\NWDXMhe.exe
  C:\Windows\System\NWDXMhe.exe
  2⤵
  PID:5780
- C:\Windows\System\kEYvENQ.exe
  C:\Windows\System\kEYvENQ.exe
  2⤵
  PID:5840
- C:\Windows\System\MzAkETY.exe
  C:\Windows\System\MzAkETY.exe
  2⤵
  PID:5856
- C:\Windows\System\WcQJbpA.exe
  C:\Windows\System\WcQJbpA.exe
  2⤵
  PID:5872
- C:\Windows\System\QPNqqNg.exe
  C:\Windows\System\QPNqqNg.exe
  2⤵
  PID:5884
- C:\Windows\System\qYLLaJN.exe
  C:\Windows\System\qYLLaJN.exe
  2⤵
  PID:5972
- C:\Windows\System\sXPymZt.exe
  C:\Windows\System\sXPymZt.exe
  2⤵
  PID:6032
- C:\Windows\System\ZzAyqvX.exe
  C:\Windows\System\ZzAyqvX.exe
  2⤵
  PID:6096
- C:\Windows\System\ZutdIQr.exe
  C:\Windows\System\ZutdIQr.exe
  2⤵
  PID:5156
- C:\Windows\System\VxTRgQk.exe
  C:\Windows\System\VxTRgQk.exe
  2⤵
  PID:3248
- C:\Windows\System\RiLvoLD.exe
  C:\Windows\System\RiLvoLD.exe
  2⤵
  PID:5136
- C:\Windows\System\vzTSKYF.exe
  C:\Windows\System\vzTSKYF.exe
  2⤵
  PID:5260
- C:\Windows\System\YEUgfIV.exe
  C:\Windows\System\YEUgfIV.exe
  2⤵
  PID:5532
- C:\Windows\System\mloHgjw.exe
  C:\Windows\System\mloHgjw.exe
  2⤵
  PID:5988
- C:\Windows\System\nNMfyYw.exe
  C:\Windows\System\nNMfyYw.exe
  2⤵
  PID:6016
- C:\Windows\System\xqDIaQj.exe
  C:\Windows\System\xqDIaQj.exe
  2⤵
  PID:3836
- C:\Windows\System\sCJEHur.exe
  C:\Windows\System\sCJEHur.exe
  2⤵
  PID:5328
- C:\Windows\System\hzpNPuy.exe
  C:\Windows\System\hzpNPuy.exe
  2⤵
  PID:6080
- C:\Windows\System\kcqPMji.exe
  C:\Windows\System\kcqPMji.exe
  2⤵
  PID:5172
- C:\Windows\System\LUFPYur.exe
  C:\Windows\System\LUFPYur.exe
  2⤵
  PID:5232
- C:\Windows\System\GITkIHK.exe
  C:\Windows\System\GITkIHK.exe
  2⤵
  PID:5428
- C:\Windows\System\LygFHbX.exe
  C:\Windows\System\LygFHbX.exe
  2⤵
  PID:5664
- C:\Windows\System\BYRJTLB.exe
  C:\Windows\System\BYRJTLB.exe
  2⤵
  PID:5836
- C:\Windows\System\uLJUyWk.exe
  C:\Windows\System\uLJUyWk.exe
  2⤵
  PID:5648
- C:\Windows\System\LCnpAmF.exe
  C:\Windows\System\LCnpAmF.exe
  2⤵
  PID:5416
- C:\Windows\System\BQuGUYO.exe
  C:\Windows\System\BQuGUYO.exe
  2⤵
  PID:5552
- C:\Windows\System\KKiNtvD.exe
  C:\Windows\System\KKiNtvD.exe
  2⤵
  PID:5816
- C:\Windows\System\QgWcHLF.exe
  C:\Windows\System\QgWcHLF.exe
  2⤵
  PID:6064
- C:\Windows\System\WjNaJSJ.exe
  C:\Windows\System\WjNaJSJ.exe
  2⤵
  PID:5892
- C:\Windows\System\kLiRVgH.exe
  C:\Windows\System\kLiRVgH.exe
  2⤵
  PID:5732
- C:\Windows\System\TNXtXKH.exe
  C:\Windows\System\TNXtXKH.exe
  2⤵
  PID:6116
- C:\Windows\System\rlHrJDQ.exe
  C:\Windows\System\rlHrJDQ.exe
  2⤵
  PID:6020
- C:\Windows\System\QHPHURQ.exe
  C:\Windows\System\QHPHURQ.exe
  2⤵
  PID:5348
- C:\Windows\System\WYZdtFV.exe
  C:\Windows\System\WYZdtFV.exe
  2⤵
  PID:5480
- C:\Windows\System\oYWTXCW.exe
  C:\Windows\System\oYWTXCW.exe
  2⤵
  PID:2284
- C:\Windows\System\FgTRBLL.exe
  C:\Windows\System\FgTRBLL.exe
  2⤵
  PID:6004
- C:\Windows\System\HEPmiif.exe
  C:\Windows\System\HEPmiif.exe
  2⤵
  PID:5668
- C:\Windows\System\OUCXaAs.exe
  C:\Windows\System\OUCXaAs.exe
  2⤵
  PID:4676
- C:\Windows\System\LyUDNHh.exe
  C:\Windows\System\LyUDNHh.exe
  2⤵
  PID:5800
- C:\Windows\System\ffSGvJx.exe
  C:\Windows\System\ffSGvJx.exe
  2⤵
  PID:5544
- C:\Windows\System\SEOOTZH.exe
  C:\Windows\System\SEOOTZH.exe
  2⤵
  PID:3672
- C:\Windows\System\cvlbGCk.exe
  C:\Windows\System\cvlbGCk.exe
  2⤵
  PID:5904
- C:\Windows\System\HLsHvYf.exe
  C:\Windows\System\HLsHvYf.exe
  2⤵
  PID:5896
- C:\Windows\System\PSrGakL.exe
  C:\Windows\System\PSrGakL.exe
  2⤵
  PID:5200
- C:\Windows\System\MCYxSsl.exe
  C:\Windows\System\MCYxSsl.exe
  2⤵
  PID:6132
- C:\Windows\System\mJgyLBo.exe
  C:\Windows\System\mJgyLBo.exe
  2⤵
  PID:6148
- C:\Windows\System\urrTeQv.exe
  C:\Windows\System\urrTeQv.exe
  2⤵
  PID:6164
- C:\Windows\System\yUdToOQ.exe
  C:\Windows\System\yUdToOQ.exe
  2⤵
  PID:6184
- C:\Windows\System\CQghYeL.exe
  C:\Windows\System\CQghYeL.exe
  2⤵
  PID:6200
- C:\Windows\System\NhMyGED.exe
  C:\Windows\System\NhMyGED.exe
  2⤵
  PID:6216
- C:\Windows\System\yMcDoIi.exe
  C:\Windows\System\yMcDoIi.exe
  2⤵
  PID:6232
- C:\Windows\System\JyGZiMQ.exe
  C:\Windows\System\JyGZiMQ.exe
  2⤵
  PID:6248
- C:\Windows\System\uMkaSyr.exe
  C:\Windows\System\uMkaSyr.exe
  2⤵
  PID:6264
- C:\Windows\System\simklWv.exe
  C:\Windows\System\simklWv.exe
  2⤵
  PID:6280
- C:\Windows\System\LPRCpzm.exe
  C:\Windows\System\LPRCpzm.exe
  2⤵
  PID:6296
- C:\Windows\System\LGNarnv.exe
  C:\Windows\System\LGNarnv.exe
  2⤵
  PID:6312
- C:\Windows\System\pbUlckL.exe
  C:\Windows\System\pbUlckL.exe
  2⤵
  PID:6328
- C:\Windows\System\xamsbJi.exe
  C:\Windows\System\xamsbJi.exe
  2⤵
  PID:6344
- C:\Windows\System\REygSNk.exe
  C:\Windows\System\REygSNk.exe
  2⤵
  PID:6360
- C:\Windows\System\jFUQJEw.exe
  C:\Windows\System\jFUQJEw.exe
  2⤵
  PID:6376
- C:\Windows\System\qBDJodB.exe
  C:\Windows\System\qBDJodB.exe
  2⤵
  PID:6392
- C:\Windows\System\mPfXvth.exe
  C:\Windows\System\mPfXvth.exe
  2⤵
  PID:6408
- C:\Windows\System\GBWGoLc.exe
  C:\Windows\System\GBWGoLc.exe
  2⤵
  PID:6424
- C:\Windows\System\QdHqUqu.exe
  C:\Windows\System\QdHqUqu.exe
  2⤵
  PID:6440
- C:\Windows\System\UZbTudS.exe
  C:\Windows\System\UZbTudS.exe
  2⤵
  PID:6456
- C:\Windows\System\DwgExOJ.exe
  C:\Windows\System\DwgExOJ.exe
  2⤵
  PID:6472
- C:\Windows\System\iGGgVxg.exe
  C:\Windows\System\iGGgVxg.exe
  2⤵
  PID:6488
- C:\Windows\System\YJQHgfO.exe
  C:\Windows\System\YJQHgfO.exe
  2⤵
  PID:6504
- C:\Windows\System\nrXjXZy.exe
  C:\Windows\System\nrXjXZy.exe
  2⤵
  PID:6520
- C:\Windows\System\zjSMNeA.exe
  C:\Windows\System\zjSMNeA.exe
  2⤵
  PID:6536
- C:\Windows\System\aHqEuse.exe
  C:\Windows\System\aHqEuse.exe
  2⤵
  PID:6552
- C:\Windows\System\ZIwVtzt.exe
  C:\Windows\System\ZIwVtzt.exe
  2⤵
  PID:6568
- C:\Windows\System\BocjMfx.exe
  C:\Windows\System\BocjMfx.exe
  2⤵
  PID:6584
- C:\Windows\System\UAZVmVN.exe
  C:\Windows\System\UAZVmVN.exe
  2⤵
  PID:6600
- C:\Windows\System\KohpgEw.exe
  C:\Windows\System\KohpgEw.exe
  2⤵
  PID:6616
- C:\Windows\System\YbICAki.exe
  C:\Windows\System\YbICAki.exe
  2⤵
  PID:6632
- C:\Windows\System\pZhHfjj.exe
  C:\Windows\System\pZhHfjj.exe
  2⤵
  PID:6648
- C:\Windows\System\RosVqtf.exe
  C:\Windows\System\RosVqtf.exe
  2⤵
  PID:6664
- C:\Windows\System\SRVTzil.exe
  C:\Windows\System\SRVTzil.exe
  2⤵
  PID:6680
- C:\Windows\System\drgkpsk.exe
  C:\Windows\System\drgkpsk.exe
  2⤵
  PID:6696
- C:\Windows\System\AgesIEx.exe
  C:\Windows\System\AgesIEx.exe
  2⤵
  PID:6712
- C:\Windows\System\egGfCRt.exe
  C:\Windows\System\egGfCRt.exe
  2⤵
  PID:6732
- C:\Windows\System\HCttSvP.exe
  C:\Windows\System\HCttSvP.exe
  2⤵
  PID:6748
- C:\Windows\System\RuwkbTS.exe
  C:\Windows\System\RuwkbTS.exe
  2⤵
  PID:6764
- C:\Windows\System\awqcbJF.exe
  C:\Windows\System\awqcbJF.exe
  2⤵
  PID:6780
- C:\Windows\System\oAazbyC.exe
  C:\Windows\System\oAazbyC.exe
  2⤵
  PID:6796
- C:\Windows\System\EtPxrRx.exe
  C:\Windows\System\EtPxrRx.exe
  2⤵
  PID:6812
- C:\Windows\System\IQDVMtN.exe
  C:\Windows\System\IQDVMtN.exe
  2⤵
  PID:6860
- C:\Windows\System\WfkwQiF.exe
  C:\Windows\System\WfkwQiF.exe
  2⤵
  PID:6876
- C:\Windows\System\twomDQM.exe
  C:\Windows\System\twomDQM.exe
  2⤵
  PID:6892
- C:\Windows\System\AoQnLmh.exe
  C:\Windows\System\AoQnLmh.exe
  2⤵
  PID:6908
- C:\Windows\System\ESsJrcd.exe
  C:\Windows\System\ESsJrcd.exe
  2⤵
  PID:6924
- C:\Windows\System\ZgXRchF.exe
  C:\Windows\System\ZgXRchF.exe
  2⤵
  PID:6940
- C:\Windows\System\TIVUEqB.exe
  C:\Windows\System\TIVUEqB.exe
  2⤵
  PID:6956
- C:\Windows\System\goGvfJb.exe
  C:\Windows\System\goGvfJb.exe
  2⤵
  PID:6972
- C:\Windows\System\WHuCInU.exe
  C:\Windows\System\WHuCInU.exe
  2⤵
  PID:6988
- C:\Windows\System\NpTWlxp.exe
  C:\Windows\System\NpTWlxp.exe
  2⤵
  PID:7004
- C:\Windows\System\PidGMiY.exe
  C:\Windows\System\PidGMiY.exe
  2⤵
  PID:7024
- C:\Windows\System\vUsVxzT.exe
  C:\Windows\System\vUsVxzT.exe
  2⤵
  PID:7040
- C:\Windows\System\Cmwffiw.exe
  C:\Windows\System\Cmwffiw.exe
  2⤵
  PID:7056
- C:\Windows\System\HVQORth.exe
  C:\Windows\System\HVQORth.exe
  2⤵
  PID:7072
- C:\Windows\System\paeEaKt.exe
  C:\Windows\System\paeEaKt.exe
  2⤵
  PID:7088
- C:\Windows\System\zikkcxn.exe
  C:\Windows\System\zikkcxn.exe
  2⤵
  PID:7104
- C:\Windows\System\SMMVhKL.exe
  C:\Windows\System\SMMVhKL.exe
  2⤵
  PID:7120
- C:\Windows\System\HmDREKU.exe
  C:\Windows\System\HmDREKU.exe
  2⤵
  PID:7136
- C:\Windows\System\nPtggYA.exe
  C:\Windows\System\nPtggYA.exe
  2⤵
  PID:7152
- C:\Windows\System\DNTkoqr.exe
  C:\Windows\System\DNTkoqr.exe
  2⤵
  PID:5204
- C:\Windows\System\epVSHMe.exe
  C:\Windows\System\epVSHMe.exe
  2⤵
  PID:5596
- C:\Windows\System\zeCUyZi.exe
  C:\Windows\System\zeCUyZi.exe
  2⤵
  PID:5936
- C:\Windows\System\meUufFX.exe
  C:\Windows\System\meUufFX.exe
  2⤵
  PID:5776
- C:\Windows\System\FkSlEjT.exe
  C:\Windows\System\FkSlEjT.exe
  2⤵
  PID:5548
- C:\Windows\System\mqItBYh.exe
  C:\Windows\System\mqItBYh.exe
  2⤵
  PID:5852
- C:\Windows\System\pYWlPrl.exe
  C:\Windows\System\pYWlPrl.exe
  2⤵
  PID:6068
- C:\Windows\System\QZRosqM.exe
  C:\Windows\System\QZRosqM.exe
  2⤵
  PID:5920
- C:\Windows\System\RjqoRjs.exe
  C:\Windows\System\RjqoRjs.exe
  2⤵
  PID:6240
- C:\Windows\System\jhYEhXd.exe
  C:\Windows\System\jhYEhXd.exe
  2⤵
  PID:6276
- C:\Windows\System\jBSQDDC.exe
  C:\Windows\System\jBSQDDC.exe
  2⤵
  PID:6336
- C:\Windows\System\HLFyRtU.exe
  C:\Windows\System\HLFyRtU.exe
  2⤵
  PID:6400
- C:\Windows\System\vvYWdgf.exe
  C:\Windows\System\vvYWdgf.exe
  2⤵
  PID:6288
- C:\Windows\System\ErkAdry.exe
  C:\Windows\System\ErkAdry.exe
  2⤵
  PID:6356
- C:\Windows\System\ANndwDb.exe
  C:\Windows\System\ANndwDb.exe
  2⤵
  PID:6192
- C:\Windows\System\pHRNDfL.exe
  C:\Windows\System\pHRNDfL.exe
  2⤵
  PID:6224
- C:\Windows\System\KJFHkUA.exe
  C:\Windows\System\KJFHkUA.exe
  2⤵
  PID:6532
- C:\Windows\System\IGfEYJI.exe
  C:\Windows\System\IGfEYJI.exe
  2⤵
  PID:6320
- C:\Windows\System\QOiALBE.exe
  C:\Windows\System\QOiALBE.exe
  2⤵
  PID:6592
- C:\Windows\System\utBnvtL.exe
  C:\Windows\System\utBnvtL.exe
  2⤵
  PID:6420
- C:\Windows\System\LlElNMX.exe
  C:\Windows\System\LlElNMX.exe
  2⤵
  PID:6624
- C:\Windows\System\ARxAdRu.exe
  C:\Windows\System\ARxAdRu.exe
  2⤵
  PID:6548
- C:\Windows\System\jdsVGNY.exe
  C:\Windows\System\jdsVGNY.exe
  2⤵
  PID:6720
- C:\Windows\System\GVIIPnR.exe
  C:\Windows\System\GVIIPnR.exe
  2⤵
  PID:6644
- C:\Windows\System\BDfZJcs.exe
  C:\Windows\System\BDfZJcs.exe
  2⤵
  PID:6612
- C:\Windows\System\QrEnCwq.exe
  C:\Windows\System\QrEnCwq.exe
  2⤵
  PID:6788
- C:\Windows\System\vKMZIas.exe
  C:\Windows\System\vKMZIas.exe
  2⤵
  PID:6820
- C:\Windows\System\htLhphD.exe
  C:\Windows\System\htLhphD.exe
  2⤵
  PID:6772
- C:\Windows\System\gBWwwSR.exe
  C:\Windows\System\gBWwwSR.exe
  2⤵
  PID:6832
- C:\Windows\System\nzkvUkJ.exe
  C:\Windows\System\nzkvUkJ.exe
  2⤵
  PID:6844
- C:\Windows\System\SPwbedQ.exe
  C:\Windows\System\SPwbedQ.exe
  2⤵
  PID:6872
- C:\Windows\System\DYHoNEZ.exe
  C:\Windows\System\DYHoNEZ.exe
  2⤵
  PID:6932
- C:\Windows\System\CyquFuv.exe
  C:\Windows\System\CyquFuv.exe
  2⤵
  PID:6888
- C:\Windows\System\dRqlLwD.exe
  C:\Windows\System\dRqlLwD.exe
  2⤵
  PID:7000
- C:\Windows\System\vgzLHca.exe
  C:\Windows\System\vgzLHca.exe
  2⤵
  PID:7064
- C:\Windows\System\KbkAUXa.exe
  C:\Windows\System\KbkAUXa.exe
  2⤵
  PID:6948
- C:\Windows\System\ETfxlKk.exe
  C:\Windows\System\ETfxlKk.exe
  2⤵
  PID:7096
- C:\Windows\System\iTuoAcp.exe
  C:\Windows\System\iTuoAcp.exe
  2⤵
  PID:7160
- C:\Windows\System\oDUTeIs.exe
  C:\Windows\System\oDUTeIs.exe
  2⤵
  PID:6952
- C:\Windows\System\zgLgvaP.exe
  C:\Windows\System\zgLgvaP.exe
  2⤵
  PID:7144
- C:\Windows\System\gLzzQoV.exe
  C:\Windows\System\gLzzQoV.exe
  2⤵
  PID:4200
- C:\Windows\System\zqVoXzj.exe
  C:\Windows\System\zqVoXzj.exe
  2⤵
  PID:5812
- C:\Windows\System\bXvHasN.exe
  C:\Windows\System\bXvHasN.exe
  2⤵
  PID:5344
- C:\Windows\System\CIHKTdx.exe
  C:\Windows\System\CIHKTdx.exe
  2⤵
  PID:6272
- C:\Windows\System\FPuIGVs.exe
  C:\Windows\System\FPuIGVs.exe
  2⤵
  PID:6372
- C:\Windows\System\kMYXVVi.exe
  C:\Windows\System\kMYXVVi.exe
  2⤵
  PID:6324
- C:\Windows\System\NSqxdGw.exe
  C:\Windows\System\NSqxdGw.exe
  2⤵
  PID:6308
- C:\Windows\System\EuGUbUZ.exe
  C:\Windows\System\EuGUbUZ.exe
  2⤵
  PID:6580
- C:\Windows\System\DcUCciH.exe
  C:\Windows\System\DcUCciH.exe
  2⤵
  PID:6352
- C:\Windows\System\jWEkokT.exe
  C:\Windows\System\jWEkokT.exe
  2⤵
  PID:6468
- C:\Windows\System\GFjfadW.exe
  C:\Windows\System\GFjfadW.exe
  2⤵
  PID:6512
- C:\Windows\System\TkLyuks.exe
  C:\Windows\System\TkLyuks.exe
  2⤵
  PID:6708
- C:\Windows\System\dVunpLB.exe
  C:\Windows\System\dVunpLB.exe
  2⤵
  PID:6824
- C:\Windows\System\LNveWHR.exe
  C:\Windows\System\LNveWHR.exe
  2⤵
  PID:6904
- C:\Windows\System\lMULEZw.exe
  C:\Windows\System\lMULEZw.exe
  2⤵
  PID:6984
- C:\Windows\System\bORJGmR.exe
  C:\Windows\System\bORJGmR.exe
  2⤵
  PID:7116
- C:\Windows\System\zfgDvIY.exe
  C:\Windows\System\zfgDvIY.exe
  2⤵
  PID:5984
- C:\Windows\System\LwnVCoU.exe
  C:\Windows\System\LwnVCoU.exe
  2⤵
  PID:6416
- C:\Windows\System\QWkRgIE.exe
  C:\Windows\System\QWkRgIE.exe
  2⤵
  PID:6576
- C:\Windows\System\ijtpNVq.exe
  C:\Windows\System\ijtpNVq.exe
  2⤵
  PID:6156
- C:\Windows\System\aOIPZXc.exe
  C:\Windows\System\aOIPZXc.exe
  2⤵
  PID:7080
- C:\Windows\System\CjsskPs.exe
  C:\Windows\System\CjsskPs.exe
  2⤵
  PID:6760
- C:\Windows\System\Kipxflj.exe
  C:\Windows\System\Kipxflj.exe
  2⤵
  PID:6828
- C:\Windows\System\NINUcdA.exe
  C:\Windows\System\NINUcdA.exe
  2⤵
  PID:6884
- C:\Windows\System\dmtOMNc.exe
  C:\Windows\System\dmtOMNc.exe
  2⤵
  PID:7052
- C:\Windows\System\RFbzIrI.exe
  C:\Windows\System\RFbzIrI.exe
  2⤵
  PID:6368
- C:\Windows\System\pyubJmf.exe
  C:\Windows\System\pyubJmf.exe
  2⤵
  PID:6388
- C:\Windows\System\fSbfPSe.exe
  C:\Windows\System\fSbfPSe.exe
  2⤵
  PID:7132
- C:\Windows\System\fOqQjBC.exe
  C:\Windows\System\fOqQjBC.exe
  2⤵
  PID:6840
- C:\Windows\System\lMSvevv.exe
  C:\Windows\System\lMSvevv.exe
  2⤵
  PID:6868
- C:\Windows\System\XlACdDy.exe
  C:\Windows\System\XlACdDy.exe
  2⤵
  PID:6996
- C:\Windows\System\qHWfgnP.exe
  C:\Windows\System\qHWfgnP.exe
  2⤵
  PID:7172
- C:\Windows\System\razgQvW.exe
  C:\Windows\System\razgQvW.exe
  2⤵
  PID:7188
- C:\Windows\System\kJHQiVC.exe
  C:\Windows\System\kJHQiVC.exe
  2⤵
  PID:7204
- C:\Windows\System\itaOTNC.exe
  C:\Windows\System\itaOTNC.exe
  2⤵
  PID:7220
- C:\Windows\System\RrndBel.exe
  C:\Windows\System\RrndBel.exe
  2⤵
  PID:7236
- C:\Windows\System\nrfjeMM.exe
  C:\Windows\System\nrfjeMM.exe
  2⤵
  PID:7252
- C:\Windows\System\fXKaWIa.exe
  C:\Windows\System\fXKaWIa.exe
  2⤵
  PID:7268
- C:\Windows\System\fwsUGEY.exe
  C:\Windows\System\fwsUGEY.exe
  2⤵
  PID:7284
- C:\Windows\System\gxCMsYP.exe
  C:\Windows\System\gxCMsYP.exe
  2⤵
  PID:7300
- C:\Windows\System\sRKqFIx.exe
  C:\Windows\System\sRKqFIx.exe
  2⤵
  PID:7320
- C:\Windows\System\cFKGQVo.exe
  C:\Windows\System\cFKGQVo.exe
  2⤵
  PID:7336
- C:\Windows\System\QpHOhiP.exe
  C:\Windows\System\QpHOhiP.exe
  2⤵
  PID:7352
- C:\Windows\System\qDyYPyG.exe
  C:\Windows\System\qDyYPyG.exe
  2⤵
  PID:7368
- C:\Windows\System\gKuuHMN.exe
  C:\Windows\System\gKuuHMN.exe
  2⤵
  PID:7384
- C:\Windows\System\ywquhwD.exe
  C:\Windows\System\ywquhwD.exe
  2⤵
  PID:7400
- C:\Windows\System\RfpFzcd.exe
  C:\Windows\System\RfpFzcd.exe
  2⤵
  PID:7416
- C:\Windows\System\UOwfMzw.exe
  C:\Windows\System\UOwfMzw.exe
  2⤵
  PID:7432
- C:\Windows\System\GkbdpMF.exe
  C:\Windows\System\GkbdpMF.exe
  2⤵
  PID:7448
- C:\Windows\System\JGNBbUN.exe
  C:\Windows\System\JGNBbUN.exe
  2⤵
  PID:7464
- C:\Windows\System\hgnPZcX.exe
  C:\Windows\System\hgnPZcX.exe
  2⤵
  PID:7480
- C:\Windows\System\JevGIQm.exe
  C:\Windows\System\JevGIQm.exe
  2⤵
  PID:7496
- C:\Windows\System\GgiWDfX.exe
  C:\Windows\System\GgiWDfX.exe
  2⤵
  PID:7512
- C:\Windows\System\eaRCCmx.exe
  C:\Windows\System\eaRCCmx.exe
  2⤵
  PID:7528
- C:\Windows\System\VzUBmSj.exe
  C:\Windows\System\VzUBmSj.exe
  2⤵
  PID:7544
- C:\Windows\System\uhhlpTc.exe
  C:\Windows\System\uhhlpTc.exe
  2⤵
  PID:7560
- C:\Windows\System\yvtIpaO.exe
  C:\Windows\System\yvtIpaO.exe
  2⤵
  PID:7576
- C:\Windows\System\anhVsGG.exe
  C:\Windows\System\anhVsGG.exe
  2⤵
  PID:7592
- C:\Windows\System\AvRWWyB.exe
  C:\Windows\System\AvRWWyB.exe
  2⤵
  PID:7608
- C:\Windows\System\IoezaXO.exe
  C:\Windows\System\IoezaXO.exe
  2⤵
  PID:7624
- C:\Windows\System\ZhRCdyf.exe
  C:\Windows\System\ZhRCdyf.exe
  2⤵
  PID:7640
- C:\Windows\System\ZWUAnmX.exe
  C:\Windows\System\ZWUAnmX.exe
  2⤵
  PID:7656
- C:\Windows\System\omWTGAj.exe
  C:\Windows\System\omWTGAj.exe
  2⤵
  PID:7672
- C:\Windows\System\nABaunP.exe
  C:\Windows\System\nABaunP.exe
  2⤵
  PID:7688
- C:\Windows\System\aIPmqzb.exe
  C:\Windows\System\aIPmqzb.exe
  2⤵
  PID:7704
- C:\Windows\System\QmSREDC.exe
  C:\Windows\System\QmSREDC.exe
  2⤵
  PID:7720
- C:\Windows\System\eJLvAgV.exe
  C:\Windows\System\eJLvAgV.exe
  2⤵
  PID:7736
- C:\Windows\System\jMCEDyx.exe
  C:\Windows\System\jMCEDyx.exe
  2⤵
  PID:7752
- C:\Windows\System\PnaYBVO.exe
  C:\Windows\System\PnaYBVO.exe
  2⤵
  PID:7768
- C:\Windows\System\qoMxuCZ.exe
  C:\Windows\System\qoMxuCZ.exe
  2⤵
  PID:7784
- C:\Windows\System\cmJtAlZ.exe
  C:\Windows\System\cmJtAlZ.exe
  2⤵
  PID:7800
- C:\Windows\System\EoJYdCk.exe
  C:\Windows\System\EoJYdCk.exe
  2⤵
  PID:7816
- C:\Windows\System\ZUvBNuO.exe
  C:\Windows\System\ZUvBNuO.exe
  2⤵
  PID:7832
- C:\Windows\System\NXPFjDj.exe
  C:\Windows\System\NXPFjDj.exe
  2⤵
  PID:7848
- C:\Windows\System\ZwalcSk.exe
  C:\Windows\System\ZwalcSk.exe
  2⤵
  PID:7864
- C:\Windows\System\ZzcdzYn.exe
  C:\Windows\System\ZzcdzYn.exe
  2⤵
  PID:7880
- C:\Windows\System\WKHJYFS.exe
  C:\Windows\System\WKHJYFS.exe
  2⤵
  PID:7896
- C:\Windows\System\dCYCBle.exe
  C:\Windows\System\dCYCBle.exe
  2⤵
  PID:7916
- C:\Windows\System\hwKmcbT.exe
  C:\Windows\System\hwKmcbT.exe
  2⤵
  PID:7932
- C:\Windows\System\jCWqtWh.exe
  C:\Windows\System\jCWqtWh.exe
  2⤵
  PID:7948
- C:\Windows\System\spbCdnt.exe
  C:\Windows\System\spbCdnt.exe
  2⤵
  PID:7964
- C:\Windows\System\vwyYXai.exe
  C:\Windows\System\vwyYXai.exe
  2⤵
  PID:7980
- C:\Windows\System\KpzdyBj.exe
  C:\Windows\System\KpzdyBj.exe
  2⤵
  PID:7996
- C:\Windows\System\RsyCUxc.exe
  C:\Windows\System\RsyCUxc.exe
  2⤵
  PID:8012
- C:\Windows\System\akNEHgI.exe
  C:\Windows\System\akNEHgI.exe
  2⤵
  PID:8064
- C:\Windows\System\ctLXuuP.exe
  C:\Windows\System\ctLXuuP.exe
  2⤵
  PID:8080
- C:\Windows\System\mHUNHoZ.exe
  C:\Windows\System\mHUNHoZ.exe
  2⤵
  PID:8096
- C:\Windows\System\IdSmBBG.exe
  C:\Windows\System\IdSmBBG.exe
  2⤵
  PID:8112
- C:\Windows\System\ZHucAxZ.exe
  C:\Windows\System\ZHucAxZ.exe
  2⤵
  PID:8128
- C:\Windows\System\nqyzgBw.exe
  C:\Windows\System\nqyzgBw.exe
  2⤵
  PID:8144
- C:\Windows\System\sggXwlk.exe
  C:\Windows\System\sggXwlk.exe
  2⤵
  PID:8160
- C:\Windows\System\CRsYCkP.exe
  C:\Windows\System\CRsYCkP.exe
  2⤵
  PID:8176
- C:\Windows\System\ENPqrGj.exe
  C:\Windows\System\ENPqrGj.exe
  2⤵
  PID:5880
- C:\Windows\System\dYnJmrh.exe
  C:\Windows\System\dYnJmrh.exe
  2⤵
  PID:7228
- C:\Windows\System\ZXqibGS.exe
  C:\Windows\System\ZXqibGS.exe
  2⤵
  PID:7296
- C:\Windows\System\ciNxlrY.exe
  C:\Windows\System\ciNxlrY.exe
  2⤵
  PID:7164
- C:\Windows\System\ewjlIwZ.exe
  C:\Windows\System\ewjlIwZ.exe
  2⤵
  PID:7392
- C:\Windows\System\Ceifxml.exe
  C:\Windows\System\Ceifxml.exe
  2⤵
  PID:5600
- C:\Windows\System\ClOHTES.exe
  C:\Windows\System\ClOHTES.exe
  2⤵
  PID:7184
- C:\Windows\System\gzkvJfv.exe
  C:\Windows\System\gzkvJfv.exe
  2⤵
  PID:7520
- C:\Windows\System\GtLDlIz.exe
  C:\Windows\System\GtLDlIz.exe
  2⤵
  PID:7312
- C:\Windows\System\grzwHdT.exe
  C:\Windows\System\grzwHdT.exe
  2⤵
  PID:7616
- C:\Windows\System\tYFYWYZ.exe
  C:\Windows\System\tYFYWYZ.exe
  2⤵
  PID:6744
- C:\Windows\System\zcnKLra.exe
  C:\Windows\System\zcnKLra.exe
  2⤵
  PID:7244
- C:\Windows\System\dIOlmFb.exe
  C:\Windows\System\dIOlmFb.exe
  2⤵
  PID:7540
- C:\Windows\System\lULeObC.exe
  C:\Windows\System\lULeObC.exe
  2⤵
  PID:7716
- C:\Windows\System\BFMBLkv.exe
  C:\Windows\System\BFMBLkv.exe
  2⤵
  PID:6596
- C:\Windows\System\BgOByNy.exe
  C:\Windows\System\BgOByNy.exe
  2⤵
  PID:7412
- C:\Windows\System\VNltrPF.exe
  C:\Windows\System\VNltrPF.exe
  2⤵
  PID:7744
- C:\Windows\System\BShgJQN.exe
  C:\Windows\System\BShgJQN.exe
  2⤵
  PID:7504
- C:\Windows\System\GJzvuiF.exe
  C:\Windows\System\GJzvuiF.exe
  2⤵
  PID:7316
- C:\Windows\System\aVyrlyl.exe
  C:\Windows\System\aVyrlyl.exe
  2⤵
  PID:7728
- C:\Windows\System\FkZygxf.exe
  C:\Windows\System\FkZygxf.exe
  2⤵
  PID:7376
- C:\Windows\System\BOqxRLz.exe
  C:\Windows\System\BOqxRLz.exe
  2⤵
  PID:7472
- C:\Windows\System\QhdxhHj.exe
  C:\Windows\System\QhdxhHj.exe
  2⤵
  PID:7840
- C:\Windows\System\jGpoaFz.exe
  C:\Windows\System\jGpoaFz.exe
  2⤵
  PID:7904
- C:\Windows\System\LMoSBIY.exe
  C:\Windows\System\LMoSBIY.exe
  2⤵
  PID:7764
- C:\Windows\System\TUGFghm.exe
  C:\Windows\System\TUGFghm.exe
  2⤵
  PID:7792
- C:\Windows\System\JptFvSk.exe
  C:\Windows\System\JptFvSk.exe
  2⤵
  PID:7908
- C:\Windows\System\UkgrDYx.exe
  C:\Windows\System\UkgrDYx.exe
  2⤵
  PID:7888
- C:\Windows\System\VnfesWh.exe
  C:\Windows\System\VnfesWh.exe
  2⤵
  PID:8004
- C:\Windows\System\mjoQKEL.exe
  C:\Windows\System\mjoQKEL.exe
  2⤵
  PID:7860
- C:\Windows\System\KRVaFhZ.exe
  C:\Windows\System\KRVaFhZ.exe
  2⤵
  PID:7924
- C:\Windows\System\UJOOzrX.exe
  C:\Windows\System\UJOOzrX.exe
  2⤵
  PID:8028
- C:\Windows\System\PEUsCBg.exe
  C:\Windows\System\PEUsCBg.exe
  2⤵
  PID:8044
- C:\Windows\System\yUAYsIy.exe
  C:\Windows\System\yUAYsIy.exe
  2⤵
  PID:8076
- C:\Windows\System\sfVywjY.exe
  C:\Windows\System\sfVywjY.exe
  2⤵
  PID:8140
- C:\Windows\System\mNAHena.exe
  C:\Windows\System\mNAHena.exe
  2⤵
  PID:8172
- C:\Windows\System\mTOdbiG.exe
  C:\Windows\System\mTOdbiG.exe
  2⤵
  PID:8152
- C:\Windows\System\VEPdwqE.exe
  C:\Windows\System\VEPdwqE.exe
  2⤵
  PID:8188
- C:\Windows\System\HaSHKOG.exe
  C:\Windows\System\HaSHKOG.exe
  2⤵
  PID:8120
- C:\Windows\System\pfUubwN.exe
  C:\Windows\System\pfUubwN.exe
  2⤵
  PID:7488
- C:\Windows\System\wXKzfsP.exe
  C:\Windows\System\wXKzfsP.exe
  2⤵
  PID:7428
- C:\Windows\System\ZbirXFk.exe
  C:\Windows\System\ZbirXFk.exe
  2⤵
  PID:7572
- C:\Windows\System\umoWgGF.exe
  C:\Windows\System\umoWgGF.exe
  2⤵
  PID:7440
- C:\Windows\System\rIkuBEm.exe
  C:\Windows\System\rIkuBEm.exe
  2⤵
  PID:7808
- C:\Windows\System\QOxMWAS.exe
  C:\Windows\System\QOxMWAS.exe
  2⤵
  PID:7536
- C:\Windows\System\fNQUEha.exe
  C:\Windows\System\fNQUEha.exe
  2⤵
  PID:7344
- C:\Windows\System\tjUIGFS.exe
  C:\Windows\System\tjUIGFS.exe
  2⤵
  PID:7380
- C:\Windows\System\AOnYwNr.exe
  C:\Windows\System\AOnYwNr.exe
  2⤵
  PID:7248
- C:\Windows\System\GhMZFaW.exe
  C:\Windows\System\GhMZFaW.exe
  2⤵
  PID:7760
- C:\Windows\System\yquHron.exe
  C:\Windows\System\yquHron.exe
  2⤵
  PID:7508
- C:\Windows\System\sBIDWxL.exe
  C:\Windows\System\sBIDWxL.exe
  2⤵
  PID:7972
- C:\Windows\System\fUoRFRk.exe
  C:\Windows\System\fUoRFRk.exe
  2⤵
  PID:8024
- C:\Windows\System\Aropafv.exe
  C:\Windows\System\Aropafv.exe
  2⤵
  PID:8168
- C:\Windows\System\PZetCqT.exe
  C:\Windows\System\PZetCqT.exe
  2⤵
  PID:8184
- C:\Windows\System\LMMZsTr.exe
  C:\Windows\System\LMMZsTr.exe
  2⤵
  PID:7364
- C:\Windows\System\pMBbSPj.exe
  C:\Windows\System\pMBbSPj.exe
  2⤵
  PID:7036
- C:\Windows\System\liabTTi.exe
  C:\Windows\System\liabTTi.exe
  2⤵
  PID:7992
- C:\Windows\System\EPZGviC.exe
  C:\Windows\System\EPZGviC.exe
  2⤵
  PID:7928
- C:\Windows\System\dlwOBlN.exe
  C:\Windows\System\dlwOBlN.exe
  2⤵
  PID:8108
- C:\Windows\System\xIYWswW.exe
  C:\Windows\System\xIYWswW.exe
  2⤵
  PID:6484
- C:\Windows\System\uKNibeH.exe
  C:\Windows\System\uKNibeH.exe
  2⤵
  PID:7944
- C:\Windows\System\tVaZNyb.exe
  C:\Windows\System\tVaZNyb.exe
  2⤵
  PID:7872
- C:\Windows\System\NRSezMX.exe
  C:\Windows\System\NRSezMX.exe
  2⤵
  PID:7664
- C:\Windows\System\LzsZxbM.exe
  C:\Windows\System\LzsZxbM.exe
  2⤵
  PID:8052
- C:\Windows\System\NxMiaTz.exe
  C:\Windows\System\NxMiaTz.exe
  2⤵
  PID:6704
- C:\Windows\System\yEPnuos.exe
  C:\Windows\System\yEPnuos.exe
  2⤵
  PID:6728
- C:\Windows\System\GqSIkJZ.exe
  C:\Windows\System\GqSIkJZ.exe
  2⤵
  PID:7960
- C:\Windows\System\WuPlMjU.exe
  C:\Windows\System\WuPlMjU.exe
  2⤵
  PID:7264
- C:\Windows\System\PlhODaU.exe
  C:\Windows\System\PlhODaU.exe
  2⤵
  PID:7556
- C:\Windows\System\WoyUlyi.exe
  C:\Windows\System\WoyUlyi.exe
  2⤵
  PID:6404
- C:\Windows\System\XngFfcA.exe
  C:\Windows\System\XngFfcA.exe
  2⤵
  PID:7956
- C:\Windows\System\Nhjdcee.exe
  C:\Windows\System\Nhjdcee.exe
  2⤵
  PID:7988
- C:\Windows\System\NMkoNnR.exe
  C:\Windows\System\NMkoNnR.exe
  2⤵
  PID:7460
- C:\Windows\System\yRfiDNc.exe
  C:\Windows\System\yRfiDNc.exe
  2⤵
  PID:7780
- C:\Windows\System\vRqnjEE.exe
  C:\Windows\System\vRqnjEE.exe
  2⤵
  PID:8208
- C:\Windows\System\ikVhbLf.exe
  C:\Windows\System\ikVhbLf.exe
  2⤵
  PID:8224
- C:\Windows\System\eetIOQR.exe
  C:\Windows\System\eetIOQR.exe
  2⤵
  PID:8240
- C:\Windows\System\ZRjQhNK.exe
  C:\Windows\System\ZRjQhNK.exe
  2⤵
  PID:8256
- C:\Windows\System\MLzPULg.exe
  C:\Windows\System\MLzPULg.exe
  2⤵
  PID:8272
- C:\Windows\System\hglrBwW.exe
  C:\Windows\System\hglrBwW.exe
  2⤵
  PID:8288
- C:\Windows\System\pcIKZds.exe
  C:\Windows\System\pcIKZds.exe
  2⤵
  PID:8304
- C:\Windows\System\eoXOpeH.exe
  C:\Windows\System\eoXOpeH.exe
  2⤵
  PID:8320
- C:\Windows\System\QJBHfvT.exe
  C:\Windows\System\QJBHfvT.exe
  2⤵
  PID:8336
- C:\Windows\System\HagNtpl.exe
  C:\Windows\System\HagNtpl.exe
  2⤵
  PID:8352
- C:\Windows\System\RmKLzfd.exe
  C:\Windows\System\RmKLzfd.exe
  2⤵
  PID:8368
- C:\Windows\System\YYITEtT.exe
  C:\Windows\System\YYITEtT.exe
  2⤵
  PID:8384
- C:\Windows\System\JGSOQfc.exe
  C:\Windows\System\JGSOQfc.exe
  2⤵
  PID:8400
- C:\Windows\System\aFaBYPE.exe
  C:\Windows\System\aFaBYPE.exe
  2⤵
  PID:8416
- C:\Windows\System\YGtYPPQ.exe
  C:\Windows\System\YGtYPPQ.exe
  2⤵
  PID:8432
- C:\Windows\System\ClVYFpv.exe
  C:\Windows\System\ClVYFpv.exe
  2⤵
  PID:8448
- C:\Windows\System\gPzHiZw.exe
  C:\Windows\System\gPzHiZw.exe
  2⤵
  PID:8484
- C:\Windows\System\ljEkLRd.exe
  C:\Windows\System\ljEkLRd.exe
  2⤵
  PID:8500
- C:\Windows\System\xmvEkkq.exe
  C:\Windows\System\xmvEkkq.exe
  2⤵
  PID:8516
- C:\Windows\System\SIAJCpI.exe
  C:\Windows\System\SIAJCpI.exe
  2⤵
  PID:8532
- C:\Windows\System\JmvRveC.exe
  C:\Windows\System\JmvRveC.exe
  2⤵
  PID:8548
- C:\Windows\System\eJFtkNI.exe
  C:\Windows\System\eJFtkNI.exe
  2⤵
  PID:8564
- C:\Windows\System\QlDxSLL.exe
  C:\Windows\System\QlDxSLL.exe
  2⤵
  PID:8580
- C:\Windows\System\NFHhekt.exe
  C:\Windows\System\NFHhekt.exe
  2⤵
  PID:8596
- C:\Windows\System\fxczDZs.exe
  C:\Windows\System\fxczDZs.exe
  2⤵
  PID:8612
- C:\Windows\System\uDvikWz.exe
  C:\Windows\System\uDvikWz.exe
  2⤵
  PID:8628
- C:\Windows\System\waIcEji.exe
  C:\Windows\System\waIcEji.exe
  2⤵
  PID:8644
- C:\Windows\System\SXCzUEZ.exe
  C:\Windows\System\SXCzUEZ.exe
  2⤵
  PID:8660
- C:\Windows\System\WyTzctI.exe
  C:\Windows\System\WyTzctI.exe
  2⤵
  PID:8676
- C:\Windows\System\UhlxijC.exe
  C:\Windows\System\UhlxijC.exe
  2⤵
  PID:8692
- C:\Windows\System\hxHwWau.exe
  C:\Windows\System\hxHwWau.exe
  2⤵
  PID:8708
- C:\Windows\System\qpbNnNP.exe
  C:\Windows\System\qpbNnNP.exe
  2⤵
  PID:8728
- C:\Windows\System\AYEuLoT.exe
  C:\Windows\System\AYEuLoT.exe
  2⤵
  PID:8744
- C:\Windows\System\dFQzSYP.exe
  C:\Windows\System\dFQzSYP.exe
  2⤵
  PID:8760
- C:\Windows\System\UgdPSvr.exe
  C:\Windows\System\UgdPSvr.exe
  2⤵
  PID:8776
- C:\Windows\System\xgNWmbY.exe
  C:\Windows\System\xgNWmbY.exe
  2⤵
  PID:8792
- C:\Windows\System\zpcnDIh.exe
  C:\Windows\System\zpcnDIh.exe
  2⤵
  PID:8808
- C:\Windows\System\xfAwtjv.exe
  C:\Windows\System\xfAwtjv.exe
  2⤵
  PID:8824
- C:\Windows\System\ahqsvBs.exe
  C:\Windows\System\ahqsvBs.exe
  2⤵
  PID:8840
- C:\Windows\System\clEHgoO.exe
  C:\Windows\System\clEHgoO.exe
  2⤵
  PID:8856
- C:\Windows\System\XTyDSxH.exe
  C:\Windows\System\XTyDSxH.exe
  2⤵
  PID:8872
- C:\Windows\System\SbyfUGh.exe
  C:\Windows\System\SbyfUGh.exe
  2⤵
  PID:8888
- C:\Windows\System\lvxknUS.exe
  C:\Windows\System\lvxknUS.exe
  2⤵
  PID:8904
- C:\Windows\System\OPSUqSK.exe
  C:\Windows\System\OPSUqSK.exe
  2⤵
  PID:8920
- C:\Windows\System\cmshOOs.exe
  C:\Windows\System\cmshOOs.exe
  2⤵
  PID:8984
- C:\Windows\System\bisZoJe.exe
  C:\Windows\System\bisZoJe.exe
  2⤵
  PID:9000
- C:\Windows\System\neQcJWi.exe
  C:\Windows\System\neQcJWi.exe
  2⤵
  PID:9016
- C:\Windows\System\FUWVkzi.exe
  C:\Windows\System\FUWVkzi.exe
  2⤵
  PID:9032
- C:\Windows\System\kgQlZuo.exe
  C:\Windows\System\kgQlZuo.exe
  2⤵
  PID:9048
- C:\Windows\System\nwmrJfW.exe
  C:\Windows\System\nwmrJfW.exe
  2⤵
  PID:9064
- C:\Windows\System\FtPAGkt.exe
  C:\Windows\System\FtPAGkt.exe
  2⤵
  PID:9080
- C:\Windows\System\jUyxsLV.exe
  C:\Windows\System\jUyxsLV.exe
  2⤵
  PID:9100
- C:\Windows\System\vqBixhS.exe
  C:\Windows\System\vqBixhS.exe
  2⤵
  PID:9128
- C:\Windows\System\ZNCjgkJ.exe
  C:\Windows\System\ZNCjgkJ.exe
  2⤵
  PID:9164
- C:\Windows\System\WuqzmuC.exe
  C:\Windows\System\WuqzmuC.exe
  2⤵
  PID:9180
- C:\Windows\System\dfZBFzc.exe
  C:\Windows\System\dfZBFzc.exe
  2⤵
  PID:9204
- C:\Windows\System\DzJzmyy.exe
  C:\Windows\System\DzJzmyy.exe
  2⤵
  PID:8220
- C:\Windows\System\vTXPRpr.exe
  C:\Windows\System\vTXPRpr.exe
  2⤵
  PID:8424
- C:\Windows\System\BNqLaVI.exe
  C:\Windows\System\BNqLaVI.exe
  2⤵
  PID:1516
- C:\Windows\System\Xninyui.exe
  C:\Windows\System\Xninyui.exe
  2⤵
  PID:8528
- C:\Windows\System\ytYrPFB.exe
  C:\Windows\System\ytYrPFB.exe
  2⤵
  PID:8560
- C:\Windows\System\HvVgvJe.exe
  C:\Windows\System\HvVgvJe.exe
  2⤵
  PID:8652
- C:\Windows\System\PcFwjkV.exe
  C:\Windows\System\PcFwjkV.exe
  2⤵
  PID:8724
- C:\Windows\System\FKlIzBa.exe
  C:\Windows\System\FKlIzBa.exe
  2⤵
  PID:8756
- C:\Windows\System\tshQuaq.exe
  C:\Windows\System\tshQuaq.exe
  2⤵
  PID:8476
- C:\Windows\System\AyXfhVL.exe
  C:\Windows\System\AyXfhVL.exe
  2⤵
  PID:8916
- C:\Windows\System\yEfDqrA.exe
  C:\Windows\System\yEfDqrA.exe
  2⤵
  PID:8604
- C:\Windows\System\ArVRDet.exe
  C:\Windows\System\ArVRDet.exe
  2⤵
  PID:8508
- C:\Windows\System\tcEuCDR.exe
  C:\Windows\System\tcEuCDR.exe
  2⤵
  PID:8804
- C:\Windows\System\rXyUwJi.exe
  C:\Windows\System\rXyUwJi.exe
  2⤵
  PID:8832
- C:\Windows\System\odcyMrV.exe
  C:\Windows\System\odcyMrV.exe
  2⤵
  PID:8700
- C:\Windows\System\NIwtEwR.exe
  C:\Windows\System\NIwtEwR.exe
  2⤵
  PID:8836
- C:\Windows\System\QiEeCXb.exe
  C:\Windows\System\QiEeCXb.exe
  2⤵
  PID:8868
- C:\Windows\System\oHXySKU.exe
  C:\Windows\System\oHXySKU.exe
  2⤵
  PID:8956
- C:\Windows\System\nEJUWjQ.exe
  C:\Windows\System\nEJUWjQ.exe
  2⤵
  PID:8976
- C:\Windows\System\gmLsdWl.exe
  C:\Windows\System\gmLsdWl.exe
  2⤵
  PID:9024
- C:\Windows\System\ghZMYNh.exe
  C:\Windows\System\ghZMYNh.exe
  2⤵
  PID:9040
- C:\Windows\System\mHODaOh.exe
  C:\Windows\System\mHODaOh.exe
  2⤵
  PID:9088
- C:\Windows\System\sMAMUGO.exe
  C:\Windows\System\sMAMUGO.exe
  2⤵
  PID:9152
- C:\Windows\System\eKLHSnp.exe
  C:\Windows\System\eKLHSnp.exe
  2⤵
  PID:8248
- C:\Windows\System\aDpHewW.exe
  C:\Windows\System\aDpHewW.exe
  2⤵
  PID:8236
- C:\Windows\System\zMZbxNo.exe
  C:\Windows\System\zMZbxNo.exe
  2⤵
  PID:8284
- C:\Windows\System\DcTKKrO.exe
  C:\Windows\System\DcTKKrO.exe
  2⤵
  PID:8344
- C:\Windows\System\tuNIXlu.exe
  C:\Windows\System\tuNIXlu.exe
  2⤵
  PID:8332
- C:\Windows\System\OmQlZvn.exe
  C:\Windows\System\OmQlZvn.exe
  2⤵
  PID:8412
- C:\Windows\System\NsrJZoi.exe
  C:\Windows\System\NsrJZoi.exe
  2⤵
  PID:8456
- C:\Windows\System\sPwMmIN.exe
  C:\Windows\System\sPwMmIN.exe
  2⤵
  PID:8588
- C:\Windows\System\lyIdjxV.exe
  C:\Windows\System\lyIdjxV.exe
  2⤵
  PID:9212
- C:\Windows\System\WAVWsOe.exe
  C:\Windows\System\WAVWsOe.exe
  2⤵
  PID:8944
- C:\Windows\System\ljTbrcU.exe
  C:\Windows\System\ljTbrcU.exe
  2⤵
  PID:9172
- C:\Windows\System\XgAbhdS.exe
  C:\Windows\System\XgAbhdS.exe
  2⤵
  PID:8472
- C:\Windows\System\iCUfnxx.exe
  C:\Windows\System\iCUfnxx.exe
  2⤵
  PID:9188
- C:\Windows\System\CVvjJEu.exe
  C:\Windows\System\CVvjJEu.exe
  2⤵
  PID:8328
- C:\Windows\System\hasvVwc.exe
  C:\Windows\System\hasvVwc.exe
  2⤵
  PID:8468
- C:\Windows\System\RPtTPov.exe
  C:\Windows\System\RPtTPov.exe
  2⤵
  PID:8720
- C:\Windows\System\MCmrbRL.exe
  C:\Windows\System\MCmrbRL.exe
  2⤵
  PID:8640
- C:\Windows\System\SbUQmwg.exe
  C:\Windows\System\SbUQmwg.exe
  2⤵
  PID:8740
- C:\Windows\System\jLhdFwu.exe
  C:\Windows\System\jLhdFwu.exe
  2⤵
  PID:8800
- C:\Windows\System\OFPmmjg.exe
  C:\Windows\System\OFPmmjg.exe
  2⤵
  PID:8940
- C:\Windows\System\jESBOkB.exe
  C:\Windows\System\jESBOkB.exe
  2⤵
  PID:8268
- C:\Windows\System\jdfCclk.exe
  C:\Windows\System\jdfCclk.exe
  2⤵
  PID:9072
- C:\Windows\System\nkdrKyE.exe
  C:\Windows\System\nkdrKyE.exe
  2⤵
  PID:8392
- C:\Windows\System\VakcoEB.exe
  C:\Windows\System\VakcoEB.exe
  2⤵
  PID:8408
- C:\Windows\System\bXQfVlZ.exe
  C:\Windows\System\bXQfVlZ.exe
  2⤵
  PID:8312
- C:\Windows\System\yWekPJx.exe
  C:\Windows\System\yWekPJx.exe
  2⤵
  PID:9124
- C:\Windows\System\pCJSbTp.exe
  C:\Windows\System\pCJSbTp.exe
  2⤵
  PID:8464
- C:\Windows\System\cfAnAqF.exe
  C:\Windows\System\cfAnAqF.exe
  2⤵
  PID:8820
- C:\Windows\System\FqnigpU.exe
  C:\Windows\System\FqnigpU.exe
  2⤵
  PID:9192
- C:\Windows\System\YDOZbeh.exe
  C:\Windows\System\YDOZbeh.exe
  2⤵
  PID:8852
- C:\Windows\System\LAVjile.exe
  C:\Windows\System\LAVjile.exe
  2⤵
  PID:8624
- C:\Windows\System\tLzYAcS.exe
  C:\Windows\System\tLzYAcS.exe
  2⤵
  PID:8996
- C:\Windows\System\YPVEVFe.exe
  C:\Windows\System\YPVEVFe.exe
  2⤵
  PID:9060
- C:\Windows\System\SQsWaOu.exe
  C:\Windows\System\SQsWaOu.exe
  2⤵
  PID:8968
- C:\Windows\System\oGRzPIb.exe
  C:\Windows\System\oGRzPIb.exe
  2⤵
  PID:8444
- C:\Windows\System\OGXvJkN.exe
  C:\Windows\System\OGXvJkN.exe
  2⤵
  PID:8492
- C:\Windows\System\wpfjoeV.exe
  C:\Windows\System\wpfjoeV.exe
  2⤵
  PID:8972
- C:\Windows\System\XVguPTt.exe
  C:\Windows\System\XVguPTt.exe
  2⤵
  PID:8884
- C:\Windows\System\dRXEqJr.exe
  C:\Windows\System\dRXEqJr.exe
  2⤵
  PID:8300
- C:\Windows\System\CMErLxg.exe
  C:\Windows\System\CMErLxg.exe
  2⤵
  PID:8380
- C:\Windows\System\qVJokag.exe
  C:\Windows\System\qVJokag.exe
  2⤵
  PID:9200
- C:\Windows\System\cBadNHu.exe
  C:\Windows\System\cBadNHu.exe
  2⤵
  PID:8960
- C:\Windows\System\wBvTDXV.exe
  C:\Windows\System\wBvTDXV.exe
  2⤵
  PID:8672
- C:\Windows\System\xtCoIVo.exe
  C:\Windows\System\xtCoIVo.exe
  2⤵
  PID:8376
- C:\Windows\System\nIgACUt.exe
  C:\Windows\System\nIgACUt.exe
  2⤵
  PID:9228
- C:\Windows\System\DCLNaDY.exe
  C:\Windows\System\DCLNaDY.exe
  2⤵
  PID:9244
- C:\Windows\System\bjSSSOS.exe
  C:\Windows\System\bjSSSOS.exe
  2⤵
  PID:9260
- C:\Windows\System\dlneSFY.exe
  C:\Windows\System\dlneSFY.exe
  2⤵
  PID:9280
- C:\Windows\System\jziiveI.exe
  C:\Windows\System\jziiveI.exe
  2⤵
  PID:9296
- C:\Windows\System\ivTrfMm.exe
  C:\Windows\System\ivTrfMm.exe
  2⤵
  PID:9312
- C:\Windows\System\CcaKZap.exe
  C:\Windows\System\CcaKZap.exe
  2⤵
  PID:9332
- C:\Windows\System\fwvOZof.exe
  C:\Windows\System\fwvOZof.exe
  2⤵
  PID:9352
- C:\Windows\System\EtjHFLL.exe
  C:\Windows\System\EtjHFLL.exe
  2⤵
  PID:9368
- C:\Windows\System\swQpGcX.exe
  C:\Windows\System\swQpGcX.exe
  2⤵
  PID:9388
- C:\Windows\System\uxSlWHU.exe
  C:\Windows\System\uxSlWHU.exe
  2⤵
  PID:9404
- C:\Windows\System\cGdTBTO.exe
  C:\Windows\System\cGdTBTO.exe
  2⤵
  PID:9420
- C:\Windows\System\BcjzXgR.exe
  C:\Windows\System\BcjzXgR.exe
  2⤵
  PID:9436
- C:\Windows\System\NMYmqjf.exe
  C:\Windows\System\NMYmqjf.exe
  2⤵
  PID:9452
- C:\Windows\System\RpGowKl.exe
  C:\Windows\System\RpGowKl.exe
  2⤵
  PID:9468
- C:\Windows\System\aGftQEs.exe
  C:\Windows\System\aGftQEs.exe
  2⤵
  PID:9560
- C:\Windows\System\jGyCICD.exe
  C:\Windows\System\jGyCICD.exe
  2⤵
  PID:9576
- C:\Windows\System\ccrrHki.exe
  C:\Windows\System\ccrrHki.exe
  2⤵
  PID:9592
- C:\Windows\System\JZUEgOj.exe
  C:\Windows\System\JZUEgOj.exe
  2⤵
  PID:9612
- C:\Windows\System\kcTHuDS.exe
  C:\Windows\System\kcTHuDS.exe
  2⤵
  PID:9628
- C:\Windows\System\rBrTHVk.exe
  C:\Windows\System\rBrTHVk.exe
  2⤵
  PID:9644
- C:\Windows\System\UQgGERX.exe
  C:\Windows\System\UQgGERX.exe
  2⤵
  PID:9660
- C:\Windows\System\HSaYwYF.exe
  C:\Windows\System\HSaYwYF.exe
  2⤵
  PID:9676
- C:\Windows\System\GlotNDg.exe
  C:\Windows\System\GlotNDg.exe
  2⤵
  PID:9692
- C:\Windows\System\shKVyck.exe
  C:\Windows\System\shKVyck.exe
  2⤵
  PID:9708
- C:\Windows\System\lNAJzWJ.exe
  C:\Windows\System\lNAJzWJ.exe
  2⤵
  PID:9736
- C:\Windows\System\yezEdgp.exe
  C:\Windows\System\yezEdgp.exe
  2⤵
  PID:9868
- C:\Windows\System\AasxJcy.exe
  C:\Windows\System\AasxJcy.exe
  2⤵
  PID:9884
- C:\Windows\System\ORMOsnd.exe
  C:\Windows\System\ORMOsnd.exe
  2⤵
  PID:9900
- C:\Windows\System\oABPKGP.exe
  C:\Windows\System\oABPKGP.exe
  2⤵
  PID:9920
- C:\Windows\System\bcbiNhy.exe
  C:\Windows\System\bcbiNhy.exe
  2⤵
  PID:9936
- C:\Windows\System\cZjOVsX.exe
  C:\Windows\System\cZjOVsX.exe
  2⤵
  PID:9952
- C:\Windows\System\SvMZTxv.exe
  C:\Windows\System\SvMZTxv.exe
  2⤵
  PID:9972
- C:\Windows\System\XPtjyho.exe
  C:\Windows\System\XPtjyho.exe
  2⤵
  PID:9988
- C:\Windows\System\USmuTZm.exe
  C:\Windows\System\USmuTZm.exe
  2⤵
  PID:10008
- C:\Windows\System\lLfENwY.exe
  C:\Windows\System\lLfENwY.exe
  2⤵
  PID:10024
- C:\Windows\System\wOsdTvM.exe
  C:\Windows\System\wOsdTvM.exe
  2⤵
  PID:10040
- C:\Windows\System\HDmksns.exe
  C:\Windows\System\HDmksns.exe
  2⤵
  PID:10072
- C:\Windows\System\VKOOmLw.exe
  C:\Windows\System\VKOOmLw.exe
  2⤵
  PID:10088
- C:\Windows\System\CptuRNF.exe
  C:\Windows\System\CptuRNF.exe
  2⤵
  PID:10104
- C:\Windows\System\gqVngfI.exe
  C:\Windows\System\gqVngfI.exe
  2⤵
  PID:10120
- C:\Windows\System\gNQhdvo.exe
  C:\Windows\System\gNQhdvo.exe
  2⤵
  PID:10136
- C:\Windows\System\IcEDmSC.exe
  C:\Windows\System\IcEDmSC.exe
  2⤵
  PID:10152
- C:\Windows\System\QsPnBqI.exe
  C:\Windows\System\QsPnBqI.exe
  2⤵
  PID:10168
- C:\Windows\System\kICkWgc.exe
  C:\Windows\System\kICkWgc.exe
  2⤵
  PID:10184
- C:\Windows\System\traYmgi.exe
  C:\Windows\System\traYmgi.exe
  2⤵
  PID:10200
- C:\Windows\System\crJcxbz.exe
  C:\Windows\System\crJcxbz.exe
  2⤵
  PID:10216
- C:\Windows\System\cxNKsVl.exe
  C:\Windows\System\cxNKsVl.exe
  2⤵
  PID:10232
- C:\Windows\System\IexyMfV.exe
  C:\Windows\System\IexyMfV.exe
  2⤵
  PID:9220
- C:\Windows\System\BrvJnzj.exe
  C:\Windows\System\BrvJnzj.exe
  2⤵
  PID:9288
- C:\Windows\System\klQoPlC.exe
  C:\Windows\System\klQoPlC.exe
  2⤵
  PID:9328
- C:\Windows\System\XxSuhGE.exe
  C:\Windows\System\XxSuhGE.exe
  2⤵
  PID:9112
- C:\Windows\System\cSqTewX.exe
  C:\Windows\System\cSqTewX.exe
  2⤵
  PID:9444
- C:\Windows\System\kaSCtFu.exe
  C:\Windows\System\kaSCtFu.exe
  2⤵
  PID:9520
- C:\Windows\System\hQMmLdM.exe
  C:\Windows\System\hQMmLdM.exe
  2⤵
  PID:9532
- C:\Windows\System\QfqNfMw.exe
  C:\Windows\System\QfqNfMw.exe
  2⤵
  PID:9552
- C:\Windows\System\dyAjeJY.exe
  C:\Windows\System\dyAjeJY.exe
  2⤵
  PID:9588
- C:\Windows\System\hQFuYKO.exe
  C:\Windows\System\hQFuYKO.exe
  2⤵
  PID:9728
- C:\Windows\System\HxXKAYS.exe
  C:\Windows\System\HxXKAYS.exe
  2⤵
  PID:9744
- C:\Windows\System\KEkZHbc.exe
  C:\Windows\System\KEkZHbc.exe
  2⤵
  PID:9764
- C:\Windows\System\FmVbLPB.exe
  C:\Windows\System\FmVbLPB.exe
  2⤵
  PID:9788
- C:\Windows\System\MjfVbbM.exe
  C:\Windows\System\MjfVbbM.exe
  2⤵
  PID:9768
- C:\Windows\System\QAMxHMd.exe
  C:\Windows\System\QAMxHMd.exe
  2⤵
  PID:9812
- C:\Windows\System\DnAFOjB.exe
  C:\Windows\System\DnAFOjB.exe
  2⤵
  PID:9832
- C:\Windows\System\ihlnLya.exe
  C:\Windows\System\ihlnLya.exe
  2⤵
  PID:9844
- C:\Windows\System\KuhkQzn.exe
  C:\Windows\System\KuhkQzn.exe
  2⤵
  PID:9864
- C:\Windows\System\tjBxIsO.exe
  C:\Windows\System\tjBxIsO.exe
  2⤵
  PID:9932
- C:\Windows\System\TEZaTZW.exe
  C:\Windows\System\TEZaTZW.exe
  2⤵
  PID:9996
- C:\Windows\System\KfBZSZn.exe
  C:\Windows\System\KfBZSZn.exe
  2⤵
  PID:9908
- C:\Windows\System\zQDIppF.exe
  C:\Windows\System\zQDIppF.exe
  2⤵
  PID:10084
- C:\Windows\System\QwKUCPi.exe
  C:\Windows\System\QwKUCPi.exe
  2⤵
  PID:10116
- C:\Windows\System\FgKmBCj.exe
  C:\Windows\System\FgKmBCj.exe
  2⤵
  PID:10016
- C:\Windows\System\mVtYSOg.exe
  C:\Windows\System\mVtYSOg.exe
  2⤵
  PID:10068
- C:\Windows\System\YULUbyl.exe
  C:\Windows\System\YULUbyl.exe
  2⤵
  PID:10064
- C:\Windows\System\bXcHsNW.exe
  C:\Windows\System\bXcHsNW.exe
  2⤵
  PID:9320
- C:\Windows\System\bFGTwbM.exe
  C:\Windows\System\bFGTwbM.exe
  2⤵
  PID:9256
- C:\Windows\System\XfRaydg.exe
  C:\Windows\System\XfRaydg.exe
  2⤵
  PID:10228
- C:\Windows\System\xDQBrBt.exe
  C:\Windows\System\xDQBrBt.exe
  2⤵
  PID:9400
- C:\Windows\System\NtetBuc.exe
  C:\Windows\System\NtetBuc.exe
  2⤵
  PID:9464
- C:\Windows\System\QuwOGxw.exe
  C:\Windows\System\QuwOGxw.exe
  2⤵
  PID:8772
- C:\Windows\System\RbyTcaX.exe
  C:\Windows\System\RbyTcaX.exe
  2⤵
  PID:9268
- C:\Windows\System\KRHBVXw.exe
  C:\Windows\System\KRHBVXw.exe
  2⤵
  PID:9308
- C:\Windows\System\dFFWxzi.exe
  C:\Windows\System\dFFWxzi.exe
  2⤵
  PID:9376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AlkzQnI.exe

Filesize
2.1MB

MD5
0c6a86779e716a9981b486b0defd2a7d

SHA1
ccb2cb5e9beb6815b2bd11d07da1c87f5a24ad79

SHA256
8ed8fa4886a847fa1e8a9fd033ca7263e52cad6905fe8a999501ab38c1b73d29

SHA512
1722d15a9579c8617b6d42d5c301ce46fd7555d0a6580d7ab45fea6b75cd71b93c4863b7ac264c42ce34ce13823e496bc1f1ca32430eb19cfa9a7fc82c0bf265

Download Submit
C:\Windows\system\CGCfklP.exe

Filesize
2.1MB

MD5
6ad068516066289af22037b4cb502725

SHA1
10344138b177ca08eca2b41f795bd01a877db250

SHA256
b6980f7b64038fa6e4957b41c41a1ece17893bc401b587e1051da8549ede0d0f

SHA512
129495f1c2ac9424209834b471d9a82e822c266cf4de1de299fa04a4837dc89fa0f7604e48e85b28451f04eaf0014c6f5784a6705a6c17b7f7a46e9413cd748e

Download Submit
C:\Windows\system\DOGkxQa.exe

Filesize
2.1MB

MD5
5c2b7621e6a15788457e5d512d0d861d

SHA1
121288bf5b22c4c5412a2a443572030820742b55

SHA256
1644b5af96aa475eac6a532b16c16131ec62e3638bcc0753d037e9b73cee86dc

SHA512
05afd562fdba6f8fdcc12105dcc299cfe8d3ee67360d2d748218fbc293415070741dd00cfa96008197fedd8f8f3d35eaf69ef0e90730395637216108537951f3

Download Submit
C:\Windows\system\DwUPMSX.exe

Filesize
2.1MB

MD5
ed454853f50f0ed8ac23651dcb41347a

SHA1
01123a76c293c2a875202f4ca4337634907269de

SHA256
13781fe4d66dbc2e3390a7f3b5638637a141ee5d14e2bdc073c58190ddc70c6d

SHA512
256fc0d9ec5373f1b44b3c7f98c513fc42f9af67bdba15aaf76962daa66afea780a0a6b961af7bb66d065841398cc0308e9c63ba9b522e98884582f4512d155f

Download Submit
C:\Windows\system\JrXeAEL.exe

Filesize
2.1MB

MD5
c4a9bae6083c962d2ccc23c634babf45

SHA1
eee00f2b3db8e90e5f82e39d0d0d5e83dc009bfe

SHA256
2cbc03ce13406cf166747dffea0f2a50c9099cbd2dd8234afcff4d6a8d0ffb0f

SHA512
214abf6394d3bb561ae569de7ae51373663776ca1039fb2d27befeb30626e7630690d2e5cbca51446421dce4968957a5a228f2417a411506ef6767df8909e37b

Download Submit
C:\Windows\system\MDuifuF.exe

Filesize
2.1MB

MD5
97d1b42b7e2e992fd543c782ac30ebfa

SHA1
734bf3aec8ef82aaa2559fafffe6ed94ed56d648

SHA256
d2915254373e5405883da420318c9740d8fa587c2a54e594924900ec57ff9275

SHA512
92001f232e5378526ca3556aa26ecfd3432db5141f9fefd3e50d57e615c8d3863a225f9bf56135a4d141e5c8955e3980ab16d2ca63d5f3f4a997c61cd0cadc18

Download Submit
C:\Windows\system\PFKPlro.exe

Filesize
2.1MB

MD5
6eb7bf235399130bf4b33d2e31aba75e

SHA1
8db6086b477c622ea165b11d1d586349afab0f0f

SHA256
b52a197d413c35059d81f4c92b7fc1310bacdc093bb5595846e9e440917ae2cf

SHA512
2a7e7b47f454d2db36cbac2bf70e97aefdbadfdceae5cbd64e2a2f5fba8d703025ade001adabe111f7f3ab98900e023f9b7a8b7535e76b225853fd85028e49ab

Download Submit
C:\Windows\system\QksUvMS.exe

Filesize
2.1MB

MD5
22f9c8d051a21993fddeb6a64918a741

SHA1
04b290f332cd2209b5a13f59a30b50842aacf99d

SHA256
6104b469da30689634dd65062fd6efbeaedc6ccd4b8f6d52075158d7f984e122

SHA512
75f8b456cbb78542d60789f5d131dd5531ceadb5ac3ba66b715bab72418b65eac6f781293cf1c7dbb6b1af5ae290faa13c7f0cccec69601e88293ae8b6f39487

Download Submit
C:\Windows\system\RMhAGxG.exe

Filesize
2.1MB

MD5
459b28be82e41253950040a72ce1fbb6

SHA1
740dd73f38b88334c7ba4366d8ae5bf04f824a8e

SHA256
8cab33e40cc49a577552433effacea80da44bfc3713f1523075050fe36cc1de0

SHA512
d8724bfb2facf96f34d4cb70eb82066b7929b20bb6159b5382bec891ad0ef2e450e9d392c8de9f5740f12550151c47b01882ad3d6f99ad40e73905293e3f061a

Download Submit
C:\Windows\system\TOdTUIM.exe

Filesize
2.1MB

MD5
d4de325852097e141c6b0a03ea3e4a65

SHA1
c7f28eb8d9044fc6e8b0d56549b4eb1795e0d5f9

SHA256
8c46f7d5de8e89158d6c19341cce92f9acd2e4503fcde8cc6e452e9f1fd5b583

SHA512
8480b8a2ae5fd33b62085e9160b18cd707654b9ca9f612269b7a50a60b0a413a34ef1efda4d27c63b3948d569809f08cc479a2b533303b3ea83ace65b560dee0

Download Submit
C:\Windows\system\UIUtFuZ.exe

Filesize
2.1MB

MD5
fb0077af28008abcc98edee78a7dcfe2

SHA1
8fd683444fcbf0068a961e47d11a54568e562acb

SHA256
8d2154f00fb73f99f1a4daaf8447dd9b27530c51f91084b8228fd73d940141b6

SHA512
f0f52a99a421f24bb5b8a7ffc14215448476535123c26c1ece63eedad8406b4ab83afe879e13c070ca4dfe0cb97062436f2b78d534d382ee1451e6a7c48a202d

Download Submit
C:\Windows\system\aRAhyof.exe

Filesize
2.1MB

MD5
96f506611c2d8ffe6a3539d136ddada0

SHA1
d2c2cf2b74fa96788edf06720d4087575464723e

SHA256
2794d0a767a7014d4262c3a986d8f920590c19185a55d7e935536b07ee632200

SHA512
98730aa9d405546b783d7ec8d81a35f3ca9b8aa9c4f85a992aa14b198b7d950e106354afa3d37a392a2a30afc936f67a4a85c4bed530903bc65682a89c73d57b

Download Submit
C:\Windows\system\djVaMKx.exe

Filesize
2.1MB

MD5
2113d10e648b6592f83d98b737e1ade5

SHA1
5eda388f8c8a33c4625af005975050591c0246c0

SHA256
e16358f91ee7c895f327fdbb6eb424545d2da9d7fb8701aa225d80a1c4ae6b90

SHA512
b012667c2448feabb10736bbc05856357eb3a66fe864785c34b782d3d8cb73f98238674fa6c09f8bbf2dd6dbfb124e3e64c8f677330a8cea06bdd2b01d49a7ef

Download Submit
C:\Windows\system\ggGCmSG.exe

Filesize
2.1MB

MD5
a9507267beba03b011861de8160928d1

SHA1
fd4ffc07af8f38e20cf45bd690803dae51891baf

SHA256
82736172eb63031940b210911f92ace47d758aea4731a97e0af5743c8fc93819

SHA512
65a0b03be2e50005b585ea422f161551e46bcaad724e777620cfe791180514360fb94ecfecaf00ad17d20432cc138d362e7d1f9dd42c0f310326b71d623f1a06

Download Submit
C:\Windows\system\giBkdbM.exe

Filesize
2.1MB

MD5
4a2c0a6f1b66b4db6d0f07e045863584

SHA1
07af3af23aa53043a1fafcc5f29a513d72fb2641

SHA256
acea32777c8355c32f5f0a8d267dde184f92859f58041331e8b8d5d5b6b43b5a

SHA512
7b575e8da22927e981e1cac51039f55bb2e4945c422fb993cb6bda5070249c1813f0d1fe39a372bd017d8d4b005682cf3cbefdaa79b62ea1036ad2d53efb01bb

Download Submit
C:\Windows\system\hnAVbLJ.exe

Filesize
2.1MB

MD5
72800a4fb1deae1b41492a1331b25466

SHA1
0d5dfd57d81e69fee743133593fedc7f322a3bb3

SHA256
21c2a3bc6fd1f08ed1d296db5a7b6abd93563f72ba15a67dbdcf9077172b3ace

SHA512
38a8fc75d78ea2449133ffd68a80d7011d5feb85325c001e05b60dde62792842edfb31c4500d12c74681a0a26971abdc52180417b7251833c0e4a80fd21949a1

Download Submit
C:\Windows\system\hyeIgnr.exe

Filesize
2.1MB

MD5
bb78434f3cc35ab1b723008dc78387de

SHA1
d15d7c1dad802fb59c52995a42ff5c178425556e

SHA256
0c96df6c45483211a920686a8977e2a916476bfed90f684811fe2a25c5435a93

SHA512
d680024b206c7a4de8178759664a1928a9142ce8d61401442bb95ba0ab80ad3433984f9cad966938e172253a7fe8f893cb957e336eaf970a4585e0f97ba4d0f5

Download Submit
C:\Windows\system\jfwqNLb.exe

Filesize
2.1MB

MD5
5aab84caa7b21392cb8f41662c7862e7

SHA1
6e52c558d6c605a0a89f2e9d66c7f3d81e7ba68f

SHA256
5621134288f990ba2ad0f683dfd023ffb5a3db42a168f240e98af23d22bfba30

SHA512
46c2e769d046b75db46b2be0ed86128627d6420ad076df39ec522e39dbc6a74f289cf60bb14664581afa124ed4e146bd2dd77b5d6f46047397411086ce26598f

Download Submit
C:\Windows\system\jtqMTPU.exe

Filesize
2.1MB

MD5
b8d1963f1b7338724d3e5d5de3ba1d43

SHA1
83ce27453b5bac94a3436d45b6e89588aca5a341

SHA256
8617ab94b4551275cd3bf8250437f08ffa66392bad94fdc8c81df187221d5af0

SHA512
41f414dfec44c7051cc1dc6657ddf90ea09d8412a87874e6062f48c51ed1c3d1781c613f818149b0690adb4b0476543e3077b7e9d35cb16b105038ff13a7dd09

Download Submit
C:\Windows\system\lGhhFeJ.exe

Filesize
2.1MB

MD5
429778c79cc0dd55561ebb200f9232cb

SHA1
b7cec3e3bae889d5901eeef2423c98dfb4cf9322

SHA256
2ec9e20765192b0f8d00a40d7b65a58d3b7025602f1db8cfc57e039272b0f5ab

SHA512
e42739f642e0e44bc148be0b6c9479ed638c85c73d5148cd9bfc883b9e4b8fc6296fadf987637581221c3d3c9029ac8f4c3595ac5fda964a39b0314b61e5bcf8

Download Submit
C:\Windows\system\nIOTxux.exe

Filesize
2.1MB

MD5
66aa8b00fd34dd80d63f1fa339c47d7b

SHA1
fad5f8937c3c29910ec2754faa881b72e359311c

SHA256
302d8d8b34a0b4fbe58befd26e6b796e59b5e7d747e88baab06cc4ab896b788a

SHA512
6c940b637d5488150ddae2863e1549742dc10fd9c45968b402c0c2f1e4fb7787df91beb5a70f9e4c718069aa8f3a3cbebd1c612f221dbaf29fed5d1ddabfe02a

Download Submit
C:\Windows\system\qdrEXzz.exe

Filesize
2.1MB

MD5
ce7fd7a65eed2afff4ced439986e79e2

SHA1
ceb4c9c07f5fff7f6212586ebe4c9d7472efbbc3

SHA256
e97db81185e0fedf5ad3d37a467501e3e986d16d1c997efc3807c9ad6e2473ac

SHA512
060d371db1e90bc884c76956d0d89795a3f1598a8292ebe997624920ab58c7ba1dedb28150be9c707850dec76cfc99ba932ceb2978e220c58e938761c6c7afb4

Download Submit
C:\Windows\system\xHijlFM.exe

Filesize
2.1MB

MD5
9da02b1cb7aa50bd434d5a1c3d259369

SHA1
0aa7c7920b6abcba30df7bc7f4238f2920e62ea7

SHA256
0b17238de7aa23b1b3d07843122885e47568c3ea79a35624338b51571f5d95fb

SHA512
4c184f643b275c76ddadd2ee1c2b13890f6baf12528e6fc537201b0e472457053d9d176ad89ff9d0d79db889544a4836a247d434b03b39bd650f8f2c3debc6bc

Download Submit
\Windows\system\GQGzyDJ.exe

Filesize
2.1MB

MD5
4f5fa0b79db45accde6fb58c7153cc82

SHA1
49d2ca37f3f02fff1acafa2502028dd4c9e6f508

SHA256
726d82a398e8ec496b8c4febcd3781c74355da2b36f65ff9af5460f3bda5cd21

SHA512
f4dc5cbc0ab01b2451d40afd4a37150ae5221d2879c57f0d5b006193caec580d2c29d5dd38e39eff987b2436b0a078de0adc867750d0a0dc5d518ed500fe6279

Download Submit
\Windows\system\RUaFIUy.exe

Filesize
2.1MB

MD5
b8aec18547e4380429f510bf0856c992

SHA1
ba2f740ef6dbde86f2fdfba8cade97dde5745ba5

SHA256
a90ac911aeae2e298e6d507ae707b95e35489972f0beb412eb0452cab2347bc2

SHA512
51b27ffa44f94e5518b7f43160ec9daddfec12bf897096d45b3980061103ad4ddf6571cc6c5af2bf05a5ec9576f1dd2c8fdb26c95db71f42dbcad82b89046a7a

Download Submit
\Windows\system\SYKNvlv.exe

Filesize
2.1MB

MD5
a0c774eaf3fad2c3c3cd6572bfddd073

SHA1
a21e8ae42df73d9acfe26973108ba02686312362

SHA256
3ab8d15643fa2ac041701f016d860901526e8e4e3ea1c2b9fe0dc639ffee7e5b

SHA512
7e20ba56cce7134b0601a6a24736cede92608ce316e78e9b46543e55bc2f828d2ea6ea42e822fea76548ec0284416579fd6334d24116c56816051a13215c04af

Download Submit
\Windows\system\aPMsmSI.exe

Filesize
2.1MB

MD5
a295232ff24d04167800f4567fd1dd2f

SHA1
3228d788ec8c79ce0ff15565f22991cce3f8fd78

SHA256
b88d2927220408a8b3b26e6ab7390f8156d2f101882da056eb004fe127d70851

SHA512
624c8405ce6d08c788e31c34f6ef9750f8234e133a91d2d4385ee3f31c80c3f3b4ef7883851f2a864bb84dee38e2b4dbdfd98200e7f651bcbb910f6c42d8f345

Download Submit
\Windows\system\apmfCyi.exe

Filesize
2.1MB

MD5
e58a6e63e5ff2c36ebb404b788810f21

SHA1
23588e0b672641eef6b018cc2f88ec2f22b58224

SHA256
d5ebc78ba233965fe10c117fb057a74a36a6276e7b06d482b12a6de50654f406

SHA512
b20a87ead60e7cc454104ea708cf675fe11fdbd2eba516f3b91ec3bb4e7e09a83db6315cfa0d37510cb7586b37d8d0c4f9cc01ef00b7ec46cf7ea237f3f61d5b

Download Submit
\Windows\system\lgmeXjx.exe

Filesize
2.1MB

MD5
b6fa3a8cd0c9f1a3ac99e47d9e7d284f

SHA1
1d7a726e017de2975f90b7a904077b34e497f985

SHA256
97010942db9cb7faadbdca722aa25bcfc7fddc1a34056a2a2370ca65fc3f5903

SHA512
fb8c9af6cef537c74445ea7ad825a9eee2df15de673e4e6d053c042f51334bd09755e5692f7470a2ed46271a8e3b5931ca463e19f816ba0313f41aca9691b962

Download Submit
\Windows\system\myQjdMd.exe

Filesize
2.1MB

MD5
56e8d1983765028620b247a6f6118ca8

SHA1
29cbd5a3b5fc98a7c4cdfa9a8babe2a5b1c1968b

SHA256
5e6440264c4f5dde8d63a69c0464a9e38c91e8fd3a0be51ba26b9a96a66869ce

SHA512
e9ab8e88748504d249e2d2c5e2b154a395839b8b6f927576d17e3b988f7b7ef882093c2ccf8bdcd0b597bde695081f459e58e90711715c495dc787adea1ceed9

Download Submit
\Windows\system\sPlSKka.exe

Filesize
2.1MB

MD5
3b0b4fca11aa231244571c7e3765bcfd

SHA1
d9b36cd48aca33561da284e884b9d329b5c03a95

SHA256
3b3f441e33922d7fee24f872257ead73afda40e01b0a4d46b52d8f69303a6951

SHA512
06e716be23a5333354952b7ddb201336691d92ece06135c0641bb42fe158a1bf1f1ab09b615ca7447f99f97395d3ccef3e3d56ea549121e3ac8c934ee8e52113

Download Submit
\Windows\system\vtjvkOL.exe

Filesize
2.1MB

MD5
cc6cc857d18e01ea135b208c9ccba57a

SHA1
5bd6490d13b63d0850d80de93e56ba803b6c746b

SHA256
83957c86070649e93bfa9e484a65dbb3004e6b7d4b72eb9f4621acb790909f56

SHA512
d37786f065230e9e4a7d04f45249ec7ee6ac6d2c5b5c8c87921b779a9ecd7c8518306c1f7482809b0ebb557dfafeddecbf34218620afc4faa8cf4916a447534a

Download Submit
memory/1124-64-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/1280-39-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2016-31-0x0000000002AA0000-0x0000000002AA8000-memory.dmp

Filesize
32KB

Download
memory/2016-58-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/2016-222-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2016-53-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/2016-30-0x000000001B430000-0x000000001B712000-memory.dmp

Filesize
2.9MB

Download
memory/2016-48-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2016-37-0x0000000002CE0000-0x0000000002D60000-memory.dmp

Filesize
512KB

Download
memory/2016-36-0x000007FEF5D00000-0x000007FEF669D000-memory.dmp

Filesize
9.6MB

Download
memory/2036-60-0x00000000037A0000-0x0000000003B92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-66-0x00000000037A0000-0x0000000003B92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-86-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2036-67-0x00000000037A0000-0x0000000003B92000-memory.dmp

Filesize
3.9MB

Download
memory/2036-38-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2036-7-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2036-1-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2036-57-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/2036-51-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/2036-54-0x0000000003180000-0x0000000003572000-memory.dmp

Filesize
3.9MB

Download
memory/2332-63-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2464-69-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2476-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2520-8-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2552-59-0x000000013FB60000-0x000000013FF52000-memory.dmp

Filesize
3.9MB

Download
memory/2676-55-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-84-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download