xmrig | ef850e2d836c70eb4e3cdddcebdccb50375f4837f25a7ae8543ba01a5be66033

Analysis

max time kernel
35s
max time network
32s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
Size

1.4MB
MD5

0238177e30e9d3bf4de6d35c7b10b3a7
SHA1

241575296310aa34349f69519d36429366a19029
SHA256

ef850e2d836c70eb4e3cdddcebdccb50375f4837f25a7ae8543ba01a5be66033
SHA512

27c0a111c5a6225b48fada204b340ba4bb1b1918581a949ef454f59ef2b3d50bef0a6f63cf5c74b1eb0ec64b609eda1f82991f24973153b287d3d6acfa3664b5
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPw8nD:Lz071uv4BPMkibTIA5CJ7D

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/3044-8-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2384-138-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	xmrig
behavioral1/memory/2408-126-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2696-124-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2500-140-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig
behavioral1/memory/2576-136-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2184-134-0x0000000002F10000-0x0000000003302000-memory.dmp	xmrig
behavioral1/memory/2916-133-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/1208-121-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2532-119-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3044	ThIOlaF.exe
2532	hJtUFrI.exe
1208	iqQAXoc.exe
2696	JInybZL.exe
2408	ZuwWlAF.exe
2916	sNLNSGA.exe
2576	TINMbae.exe
2384	sNMUIrO.exe
2500	rmjlRJt.exe
2432	NxBTQBN.exe
1976	OMcFOfv.exe
1616	TSgyUsG.exe
2448	NDZMTCZ.exe
2480	OvEXmvL.exe
1444	okgXoqt.exe
2560	YmhtOZa.exe
1568	KSCsERW.exe
1644	JWxWSfD.exe
2144	oeRowIB.exe
352	XkWMiXw.exe
1352	WbykpSM.exe
2044	kSTcJdD.exe
1280	wMpqyxA.exe
2224	qKINFXB.exe
664	qirzdvb.exe
2036	NIoUjxk.exe
1148	yTMVkgC.exe
2080	DvIwqui.exe
2060	XtpZOQg.exe
872	EnZwScY.exe
2556	UlhNqoV.exe
912	rnaWEsu.exe
1476	lIUvKAI.exe
1824	HDflvnS.exe
772	ZOvWyUb.exe
1252	iaDFjRC.exe
1628	BAIeFEK.exe
948	IZaMhnt.exe
2992	jHiZcXf.exe
2796	FgqCRev.exe
332	LietQtJ.exe
284	jNYpVKj.exe
2280	RrJwuQa.exe
1684	miMebiJ.exe
1704	UTezVyj.exe
1216	awOEIBo.exe
1472	udqPqJY.exe
888	MPHNEOx.exe
1892	PEugxta.exe
1972	CaWzoFM.exe
2604	tYEXdWi.exe
1948	WXlGIfP.exe
1756	FSGdJpV.exe
1500	oUOEJUC.exe
2948	kHYAjZP.exe
2508	BWJQVAV.exe
2124	zePtYpW.exe
2488	EmAOuHu.exe
2424	pWwCgEC.exe
2920	IORYAPE.exe
2664	gqAhLQU.exe
2628	WGKtXVa.exe
2716	aTyhXIB.exe
340	xWoCNxF.exe

Loads dropped DLL 64 IoCs

pid	Process
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2184-1-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x000d00000001342e-5.dat	upx
behavioral1/memory/3044-8-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x002a000000013a88-14.dat	upx
behavioral1/files/0x0016000000005586-16.dat	upx
behavioral1/files/0x0007000000014251-31.dat	upx
behavioral1/files/0x000800000001418c-27.dat	upx
behavioral1/files/0x000700000001431b-35.dat	upx
behavioral1/files/0x0008000000014367-41.dat	upx
behavioral1/files/0x0006000000014b1c-51.dat	upx
behavioral1/files/0x0006000000014bd7-54.dat	upx
behavioral1/files/0x0006000000014f57-67.dat	upx
behavioral1/files/0x0006000000015083-77.dat	upx
behavioral1/files/0x0006000000015b50-110.dat	upx
behavioral1/files/0x0006000000015c9a-135.dat	upx
behavioral1/memory/2384-138-0x000000013F0E0000-0x000000013F4D2000-memory.dmp	upx
behavioral1/files/0x0006000000015662-96.dat	upx
behavioral1/files/0x0006000000015cb1-150.dat	upx
behavioral1/files/0x0006000000015cf8-176.dat	upx
behavioral1/files/0x0006000000015d21-190.dat	upx
behavioral1/files/0x0006000000015ce3-161.dat	upx
behavioral1/files/0x0006000000015cee-171.dat	upx
behavioral1/files/0x0006000000015cc5-184.dat	upx
behavioral1/files/0x0006000000015d0a-179.dat	upx
behavioral1/files/0x0029000000013adc-170.dat	upx
behavioral1/files/0x0006000000015ca8-166.dat	upx
behavioral1/memory/2408-126-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2696-124-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x0006000000015b85-123.dat	upx
behavioral1/files/0x0006000000015ae3-107.dat	upx
behavioral1/files/0x0006000000015cd2-159.dat	upx
behavioral1/memory/2500-140-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/memory/2576-136-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2916-133-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/memory/1208-121-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2532-119-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x00060000000158d9-100.dat	upx
behavioral1/files/0x00060000000153ee-86.dat	upx
behavioral1/files/0x000600000001565a-91.dat	upx
behavioral1/files/0x00060000000150d9-81.dat	upx
behavioral1/files/0x000600000001507a-71.dat	upx
behavioral1/files/0x0006000000014c2d-61.dat	upx
behavioral1/files/0x00080000000143fb-47.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OvYLXNk.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\FpPYYih.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\BtjpdQi.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\CdvuCoL.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\excMJmO.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\LlEEMQq.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\NsNDKik.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\vkVIoFy.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\cRfZyQz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\LSpVCgv.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\nwCWHfH.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ZRvLmnO.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\qirzdvb.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\IBzifGh.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\HTwBlqf.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\RpqMZsL.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kMsBjdR.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\gOnRtGj.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\nRVzfJO.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\FdQqWHr.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\RKsprng.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\AgHitqU.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pkaGGvo.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\jyvVwhX.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pFrXGMy.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\reIFXlt.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\dlQPodp.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\dpNmfmg.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\NvGzpgX.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\OMcFOfv.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\DJKRDUd.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\LyXGxxt.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\zUiiRNH.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pagTFLr.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\OvEXmvL.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\GuWmvat.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\OZzNoNz.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\CsXkqzL.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\amvRRkP.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\YynkPhk.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\sHzOUoo.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\nSSMhwG.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\PCmPZZR.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\pdONetM.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\lfXEZSe.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\DREfKMU.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\XFQEJLB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\BQwglPS.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\OAmfyWi.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\HWDHcnB.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\lpceNIs.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\wXpkOMi.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\IsDSTec.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ZzYFdoW.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\ioODpyO.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\anLceZr.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\rpQWXjo.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\MjlUMES.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kHYAjZP.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\EdFrtFQ.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\kxTxNAb.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\GIfAWzW.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\DAHBfOo.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
File created	C:\Windows\System\jPAlNbL.exe	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2884	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
Token: SeDebugPrivilege	2884	powershell.exe
Token: SeLockMemoryPrivilege	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2884	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2884	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	29
PID 2184 wrote to memory of 2884	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	29
PID 2184 wrote to memory of 3044	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	30
PID 2184 wrote to memory of 3044	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	30
PID 2184 wrote to memory of 3044	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	30
PID 2184 wrote to memory of 2532	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2532	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	31
PID 2184 wrote to memory of 2532	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	31
PID 2184 wrote to memory of 1208	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	32
PID 2184 wrote to memory of 1208	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	32
PID 2184 wrote to memory of 1208	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	32
PID 2184 wrote to memory of 2696	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2696	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2696	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	33
PID 2184 wrote to memory of 2408	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	34
PID 2184 wrote to memory of 2408	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	34
PID 2184 wrote to memory of 2408	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	34
PID 2184 wrote to memory of 2916	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	35
PID 2184 wrote to memory of 2916	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	35
PID 2184 wrote to memory of 2916	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	35
PID 2184 wrote to memory of 2576	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2576	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2576	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	36
PID 2184 wrote to memory of 2384	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2384	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2384	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	37
PID 2184 wrote to memory of 2500	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	38
PID 2184 wrote to memory of 2500	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	38
PID 2184 wrote to memory of 2500	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	38
PID 2184 wrote to memory of 2432	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	39
PID 2184 wrote to memory of 2432	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	39
PID 2184 wrote to memory of 2432	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	39
PID 2184 wrote to memory of 1976	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1976	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1976	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	40
PID 2184 wrote to memory of 1616	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	41
PID 2184 wrote to memory of 1616	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	41
PID 2184 wrote to memory of 1616	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	41
PID 2184 wrote to memory of 2448	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	42
PID 2184 wrote to memory of 2448	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	42
PID 2184 wrote to memory of 2448	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	42
PID 2184 wrote to memory of 2480	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	43
PID 2184 wrote to memory of 2480	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	43
PID 2184 wrote to memory of 2480	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	43
PID 2184 wrote to memory of 1444	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	44
PID 2184 wrote to memory of 1444	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	44
PID 2184 wrote to memory of 1444	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	44
PID 2184 wrote to memory of 2560	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	45
PID 2184 wrote to memory of 2560	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	45
PID 2184 wrote to memory of 2560	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	45
PID 2184 wrote to memory of 1568	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1568	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1568	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	46
PID 2184 wrote to memory of 1644	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	47
PID 2184 wrote to memory of 1644	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	47
PID 2184 wrote to memory of 1644	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	47
PID 2184 wrote to memory of 2144	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	48
PID 2184 wrote to memory of 2144	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	48
PID 2184 wrote to memory of 2144	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	48
PID 2184 wrote to memory of 352	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	49
PID 2184 wrote to memory of 352	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	49
PID 2184 wrote to memory of 352	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	49
PID 2184 wrote to memory of 1352	2184	0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0238177e30e9d3bf4de6d35c7b10b3a7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\System\ThIOlaF.exe
  C:\Windows\System\ThIOlaF.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\hJtUFrI.exe
  C:\Windows\System\hJtUFrI.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\iqQAXoc.exe
  C:\Windows\System\iqQAXoc.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\JInybZL.exe
  C:\Windows\System\JInybZL.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\ZuwWlAF.exe
  C:\Windows\System\ZuwWlAF.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\sNLNSGA.exe
  C:\Windows\System\sNLNSGA.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\TINMbae.exe
  C:\Windows\System\TINMbae.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\sNMUIrO.exe
  C:\Windows\System\sNMUIrO.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\rmjlRJt.exe
  C:\Windows\System\rmjlRJt.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\NxBTQBN.exe
  C:\Windows\System\NxBTQBN.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\OMcFOfv.exe
  C:\Windows\System\OMcFOfv.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\TSgyUsG.exe
  C:\Windows\System\TSgyUsG.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\NDZMTCZ.exe
  C:\Windows\System\NDZMTCZ.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\OvEXmvL.exe
  C:\Windows\System\OvEXmvL.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\okgXoqt.exe
  C:\Windows\System\okgXoqt.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\YmhtOZa.exe
  C:\Windows\System\YmhtOZa.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\KSCsERW.exe
  C:\Windows\System\KSCsERW.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\JWxWSfD.exe
  C:\Windows\System\JWxWSfD.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\oeRowIB.exe
  C:\Windows\System\oeRowIB.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\XkWMiXw.exe
  C:\Windows\System\XkWMiXw.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\WbykpSM.exe
  C:\Windows\System\WbykpSM.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\wMpqyxA.exe
  C:\Windows\System\wMpqyxA.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\kSTcJdD.exe
  C:\Windows\System\kSTcJdD.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\NIoUjxk.exe
  C:\Windows\System\NIoUjxk.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\qKINFXB.exe
  C:\Windows\System\qKINFXB.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\XtpZOQg.exe
  C:\Windows\System\XtpZOQg.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\qirzdvb.exe
  C:\Windows\System\qirzdvb.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\EnZwScY.exe
  C:\Windows\System\EnZwScY.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\yTMVkgC.exe
  C:\Windows\System\yTMVkgC.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\rnaWEsu.exe
  C:\Windows\System\rnaWEsu.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\DvIwqui.exe
  C:\Windows\System\DvIwqui.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\HDflvnS.exe
  C:\Windows\System\HDflvnS.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\UlhNqoV.exe
  C:\Windows\System\UlhNqoV.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\iaDFjRC.exe
  C:\Windows\System\iaDFjRC.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\lIUvKAI.exe
  C:\Windows\System\lIUvKAI.exe
  2⤵
  - Executes dropped EXE
  PID:1476
- C:\Windows\System\IZaMhnt.exe
  C:\Windows\System\IZaMhnt.exe
  2⤵
  - Executes dropped EXE
  PID:948
- C:\Windows\System\ZOvWyUb.exe
  C:\Windows\System\ZOvWyUb.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\jHiZcXf.exe
  C:\Windows\System\jHiZcXf.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\BAIeFEK.exe
  C:\Windows\System\BAIeFEK.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\FgqCRev.exe
  C:\Windows\System\FgqCRev.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\LietQtJ.exe
  C:\Windows\System\LietQtJ.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\jNYpVKj.exe
  C:\Windows\System\jNYpVKj.exe
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\System\RrJwuQa.exe
  C:\Windows\System\RrJwuQa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\miMebiJ.exe
  C:\Windows\System\miMebiJ.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\UTezVyj.exe
  C:\Windows\System\UTezVyj.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\awOEIBo.exe
  C:\Windows\System\awOEIBo.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\udqPqJY.exe
  C:\Windows\System\udqPqJY.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\WXlGIfP.exe
  C:\Windows\System\WXlGIfP.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\MPHNEOx.exe
  C:\Windows\System\MPHNEOx.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\FSGdJpV.exe
  C:\Windows\System\FSGdJpV.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\PEugxta.exe
  C:\Windows\System\PEugxta.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\oUOEJUC.exe
  C:\Windows\System\oUOEJUC.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\CaWzoFM.exe
  C:\Windows\System\CaWzoFM.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\kHYAjZP.exe
  C:\Windows\System\kHYAjZP.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\tYEXdWi.exe
  C:\Windows\System\tYEXdWi.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\BWJQVAV.exe
  C:\Windows\System\BWJQVAV.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\zePtYpW.exe
  C:\Windows\System\zePtYpW.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\pWwCgEC.exe
  C:\Windows\System\pWwCgEC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\EmAOuHu.exe
  C:\Windows\System\EmAOuHu.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\IORYAPE.exe
  C:\Windows\System\IORYAPE.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\gqAhLQU.exe
  C:\Windows\System\gqAhLQU.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\WGKtXVa.exe
  C:\Windows\System\WGKtXVa.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\aTyhXIB.exe
  C:\Windows\System\aTyhXIB.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\xWoCNxF.exe
  C:\Windows\System\xWoCNxF.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\TFThbhQ.exe
  C:\Windows\System\TFThbhQ.exe
  2⤵
  PID:2784
- C:\Windows\System\GKYWUQF.exe
  C:\Windows\System\GKYWUQF.exe
  2⤵
  PID:2984
- C:\Windows\System\YhsLBNw.exe
  C:\Windows\System\YhsLBNw.exe
  2⤵
  PID:1868
- C:\Windows\System\NDJqjPU.exe
  C:\Windows\System\NDJqjPU.exe
  2⤵
  PID:1520
- C:\Windows\System\OFFPpEM.exe
  C:\Windows\System\OFFPpEM.exe
  2⤵
  PID:320
- C:\Windows\System\dVlySaG.exe
  C:\Windows\System\dVlySaG.exe
  2⤵
  PID:408
- C:\Windows\System\EDGSFsa.exe
  C:\Windows\System\EDGSFsa.exe
  2⤵
  PID:1912
- C:\Windows\System\XneyjgA.exe
  C:\Windows\System\XneyjgA.exe
  2⤵
  PID:2380
- C:\Windows\System\CSGfoJb.exe
  C:\Windows\System\CSGfoJb.exe
  2⤵
  PID:1920
- C:\Windows\System\igoHqxq.exe
  C:\Windows\System\igoHqxq.exe
  2⤵
  PID:1244
- C:\Windows\System\mgmtACF.exe
  C:\Windows\System\mgmtACF.exe
  2⤵
  PID:2204
- C:\Windows\System\DAHBfOo.exe
  C:\Windows\System\DAHBfOo.exe
  2⤵
  PID:2056
- C:\Windows\System\PqPRPDV.exe
  C:\Windows\System\PqPRPDV.exe
  2⤵
  PID:756
- C:\Windows\System\VuYVCbT.exe
  C:\Windows\System\VuYVCbT.exe
  2⤵
  PID:3032
- C:\Windows\System\FxCVtgG.exe
  C:\Windows\System\FxCVtgG.exe
  2⤵
  PID:2936
- C:\Windows\System\wXaGEjS.exe
  C:\Windows\System\wXaGEjS.exe
  2⤵
  PID:884
- C:\Windows\System\WnKRqkO.exe
  C:\Windows\System\WnKRqkO.exe
  2⤵
  PID:1604
- C:\Windows\System\qLFcGny.exe
  C:\Windows\System\qLFcGny.exe
  2⤵
  PID:2864
- C:\Windows\System\QPRBTlB.exe
  C:\Windows\System\QPRBTlB.exe
  2⤵
  PID:1700
- C:\Windows\System\lJEHtyM.exe
  C:\Windows\System\lJEHtyM.exe
  2⤵
  PID:2960
- C:\Windows\System\mlwvxLd.exe
  C:\Windows\System\mlwvxLd.exe
  2⤵
  PID:2528
- C:\Windows\System\lIsgWFz.exe
  C:\Windows\System\lIsgWFz.exe
  2⤵
  PID:304
- C:\Windows\System\JXGAFYl.exe
  C:\Windows\System\JXGAFYl.exe
  2⤵
  PID:2852
- C:\Windows\System\UybmXID.exe
  C:\Windows\System\UybmXID.exe
  2⤵
  PID:2868
- C:\Windows\System\mQNIFkW.exe
  C:\Windows\System\mQNIFkW.exe
  2⤵
  PID:1652
- C:\Windows\System\qgeVWzk.exe
  C:\Windows\System\qgeVWzk.exe
  2⤵
  PID:2704
- C:\Windows\System\DjfYApP.exe
  C:\Windows\System\DjfYApP.exe
  2⤵
  PID:2316
- C:\Windows\System\Rjuwuzk.exe
  C:\Windows\System\Rjuwuzk.exe
  2⤵
  PID:1844
- C:\Windows\System\URWewPY.exe
  C:\Windows\System\URWewPY.exe
  2⤵
  PID:2444
- C:\Windows\System\PwNjQlA.exe
  C:\Windows\System\PwNjQlA.exe
  2⤵
  PID:2340
- C:\Windows\System\ASXDnkt.exe
  C:\Windows\System\ASXDnkt.exe
  2⤵
  PID:2672
- C:\Windows\System\NLAMpWw.exe
  C:\Windows\System\NLAMpWw.exe
  2⤵
  PID:1688
- C:\Windows\System\KJodnwA.exe
  C:\Windows\System\KJodnwA.exe
  2⤵
  PID:1020
- C:\Windows\System\pozlGRt.exe
  C:\Windows\System\pozlGRt.exe
  2⤵
  PID:2668
- C:\Windows\System\lRBTbje.exe
  C:\Windows\System\lRBTbje.exe
  2⤵
  PID:1460
- C:\Windows\System\xgAMoKv.exe
  C:\Windows\System\xgAMoKv.exe
  2⤵
  PID:448
- C:\Windows\System\FBLCLAS.exe
  C:\Windows\System\FBLCLAS.exe
  2⤵
  PID:1436
- C:\Windows\System\FXkCTkZ.exe
  C:\Windows\System\FXkCTkZ.exe
  2⤵
  PID:2012
- C:\Windows\System\IBzifGh.exe
  C:\Windows\System\IBzifGh.exe
  2⤵
  PID:808
- C:\Windows\System\CnEKnBH.exe
  C:\Windows\System\CnEKnBH.exe
  2⤵
  PID:2744
- C:\Windows\System\VYmZPVy.exe
  C:\Windows\System\VYmZPVy.exe
  2⤵
  PID:1884
- C:\Windows\System\hGhRJOY.exe
  C:\Windows\System\hGhRJOY.exe
  2⤵
  PID:2284
- C:\Windows\System\pKWUtvP.exe
  C:\Windows\System\pKWUtvP.exe
  2⤵
  PID:2476
- C:\Windows\System\WChnmMu.exe
  C:\Windows\System\WChnmMu.exe
  2⤵
  PID:1668
- C:\Windows\System\IHYtQRZ.exe
  C:\Windows\System\IHYtQRZ.exe
  2⤵
  PID:2976
- C:\Windows\System\kNYkcNH.exe
  C:\Windows\System\kNYkcNH.exe
  2⤵
  PID:1928
- C:\Windows\System\ZzYFdoW.exe
  C:\Windows\System\ZzYFdoW.exe
  2⤵
  PID:2876
- C:\Windows\System\SfFWYVQ.exe
  C:\Windows\System\SfFWYVQ.exe
  2⤵
  PID:1248
- C:\Windows\System\pwnmJxi.exe
  C:\Windows\System\pwnmJxi.exe
  2⤵
  PID:2988
- C:\Windows\System\sIfgdvG.exe
  C:\Windows\System\sIfgdvG.exe
  2⤵
  PID:584
- C:\Windows\System\xqiugTo.exe
  C:\Windows\System\xqiugTo.exe
  2⤵
  PID:312
- C:\Windows\System\jBPdWhY.exe
  C:\Windows\System\jBPdWhY.exe
  2⤵
  PID:2712
- C:\Windows\System\uvqbmGc.exe
  C:\Windows\System\uvqbmGc.exe
  2⤵
  PID:876
- C:\Windows\System\XIjOhlD.exe
  C:\Windows\System\XIjOhlD.exe
  2⤵
  PID:2684
- C:\Windows\System\pTNdUkv.exe
  C:\Windows\System\pTNdUkv.exe
  2⤵
  PID:2788
- C:\Windows\System\aNBzcte.exe
  C:\Windows\System\aNBzcte.exe
  2⤵
  PID:2600
- C:\Windows\System\CiVfMkN.exe
  C:\Windows\System\CiVfMkN.exe
  2⤵
  PID:2468
- C:\Windows\System\ETUyyjy.exe
  C:\Windows\System\ETUyyjy.exe
  2⤵
  PID:2304
- C:\Windows\System\iqznvlW.exe
  C:\Windows\System\iqznvlW.exe
  2⤵
  PID:680
- C:\Windows\System\ZJgLEFf.exe
  C:\Windows\System\ZJgLEFf.exe
  2⤵
  PID:2940
- C:\Windows\System\kJrPfZn.exe
  C:\Windows\System\kJrPfZn.exe
  2⤵
  PID:476
- C:\Windows\System\NyyAYtr.exe
  C:\Windows\System\NyyAYtr.exe
  2⤵
  PID:1544
- C:\Windows\System\sdpRGel.exe
  C:\Windows\System\sdpRGel.exe
  2⤵
  PID:2268
- C:\Windows\System\kVstEbS.exe
  C:\Windows\System\kVstEbS.exe
  2⤵
  PID:2752
- C:\Windows\System\SNKpKhp.exe
  C:\Windows\System\SNKpKhp.exe
  2⤵
  PID:3000
- C:\Windows\System\nBtDiWS.exe
  C:\Windows\System\nBtDiWS.exe
  2⤵
  PID:3080
- C:\Windows\System\iLCOAGs.exe
  C:\Windows\System\iLCOAGs.exe
  2⤵
  PID:3100
- C:\Windows\System\AlHXdXD.exe
  C:\Windows\System\AlHXdXD.exe
  2⤵
  PID:3116
- C:\Windows\System\PWsPIck.exe
  C:\Windows\System\PWsPIck.exe
  2⤵
  PID:3132
- C:\Windows\System\dlPnCQF.exe
  C:\Windows\System\dlPnCQF.exe
  2⤵
  PID:3148
- C:\Windows\System\jyvVwhX.exe
  C:\Windows\System\jyvVwhX.exe
  2⤵
  PID:3164
- C:\Windows\System\fMxPxOl.exe
  C:\Windows\System\fMxPxOl.exe
  2⤵
  PID:3180
- C:\Windows\System\YLQBHnv.exe
  C:\Windows\System\YLQBHnv.exe
  2⤵
  PID:3196
- C:\Windows\System\FwAywFL.exe
  C:\Windows\System\FwAywFL.exe
  2⤵
  PID:3212
- C:\Windows\System\DCtAUxa.exe
  C:\Windows\System\DCtAUxa.exe
  2⤵
  PID:3232
- C:\Windows\System\jHJonbb.exe
  C:\Windows\System\jHJonbb.exe
  2⤵
  PID:3248
- C:\Windows\System\hfxRhEl.exe
  C:\Windows\System\hfxRhEl.exe
  2⤵
  PID:3264
- C:\Windows\System\ilIgaCw.exe
  C:\Windows\System\ilIgaCw.exe
  2⤵
  PID:3284
- C:\Windows\System\drQoDYR.exe
  C:\Windows\System\drQoDYR.exe
  2⤵
  PID:3300
- C:\Windows\System\gvROQQP.exe
  C:\Windows\System\gvROQQP.exe
  2⤵
  PID:3316
- C:\Windows\System\oQeeEsY.exe
  C:\Windows\System\oQeeEsY.exe
  2⤵
  PID:3332
- C:\Windows\System\kVfRJSt.exe
  C:\Windows\System\kVfRJSt.exe
  2⤵
  PID:3352
- C:\Windows\System\wyeledV.exe
  C:\Windows\System\wyeledV.exe
  2⤵
  PID:3368
- C:\Windows\System\KzdcRHO.exe
  C:\Windows\System\KzdcRHO.exe
  2⤵
  PID:3384
- C:\Windows\System\mBzmvLW.exe
  C:\Windows\System\mBzmvLW.exe
  2⤵
  PID:3400
- C:\Windows\System\BRjraOc.exe
  C:\Windows\System\BRjraOc.exe
  2⤵
  PID:3416
- C:\Windows\System\BUwcswB.exe
  C:\Windows\System\BUwcswB.exe
  2⤵
  PID:3452
- C:\Windows\System\caATNwG.exe
  C:\Windows\System\caATNwG.exe
  2⤵
  PID:3468
- C:\Windows\System\QvxxayQ.exe
  C:\Windows\System\QvxxayQ.exe
  2⤵
  PID:3484
- C:\Windows\System\VRFZsmo.exe
  C:\Windows\System\VRFZsmo.exe
  2⤵
  PID:3500
- C:\Windows\System\puJNqLv.exe
  C:\Windows\System\puJNqLv.exe
  2⤵
  PID:3516
- C:\Windows\System\FLbSLIe.exe
  C:\Windows\System\FLbSLIe.exe
  2⤵
  PID:3532
- C:\Windows\System\OyjtsaS.exe
  C:\Windows\System\OyjtsaS.exe
  2⤵
  PID:3552
- C:\Windows\System\NKzYaIZ.exe
  C:\Windows\System\NKzYaIZ.exe
  2⤵
  PID:3568
- C:\Windows\System\rMCXtni.exe
  C:\Windows\System\rMCXtni.exe
  2⤵
  PID:3584
- C:\Windows\System\ZxnAZRJ.exe
  C:\Windows\System\ZxnAZRJ.exe
  2⤵
  PID:3600
- C:\Windows\System\upzZwZp.exe
  C:\Windows\System\upzZwZp.exe
  2⤵
  PID:3616
- C:\Windows\System\tcEkXEQ.exe
  C:\Windows\System\tcEkXEQ.exe
  2⤵
  PID:3632
- C:\Windows\System\qbMDeeM.exe
  C:\Windows\System\qbMDeeM.exe
  2⤵
  PID:3652
- C:\Windows\System\OWSusCi.exe
  C:\Windows\System\OWSusCi.exe
  2⤵
  PID:3672
- C:\Windows\System\LlMWYnW.exe
  C:\Windows\System\LlMWYnW.exe
  2⤵
  PID:3692
- C:\Windows\System\bPukVPd.exe
  C:\Windows\System\bPukVPd.exe
  2⤵
  PID:3860
- C:\Windows\System\zqtHiJd.exe
  C:\Windows\System\zqtHiJd.exe
  2⤵
  PID:3888
- C:\Windows\System\YpJBBti.exe
  C:\Windows\System\YpJBBti.exe
  2⤵
  PID:3908
- C:\Windows\System\GuWmvat.exe
  C:\Windows\System\GuWmvat.exe
  2⤵
  PID:3932
- C:\Windows\System\cOYfTPk.exe
  C:\Windows\System\cOYfTPk.exe
  2⤵
  PID:3948
- C:\Windows\System\KkUfPvg.exe
  C:\Windows\System\KkUfPvg.exe
  2⤵
  PID:3964
- C:\Windows\System\FypAykU.exe
  C:\Windows\System\FypAykU.exe
  2⤵
  PID:3984
- C:\Windows\System\pFrXGMy.exe
  C:\Windows\System\pFrXGMy.exe
  2⤵
  PID:4008
- C:\Windows\System\JaGCIif.exe
  C:\Windows\System\JaGCIif.exe
  2⤵
  PID:4032
- C:\Windows\System\KwOdRBm.exe
  C:\Windows\System\KwOdRBm.exe
  2⤵
  PID:4048
- C:\Windows\System\iOeiiys.exe
  C:\Windows\System\iOeiiys.exe
  2⤵
  PID:4068
- C:\Windows\System\dlTguHw.exe
  C:\Windows\System\dlTguHw.exe
  2⤵
  PID:4088
- C:\Windows\System\cjCnHxH.exe
  C:\Windows\System\cjCnHxH.exe
  2⤵
  PID:2492
- C:\Windows\System\wmRUyaN.exe
  C:\Windows\System\wmRUyaN.exe
  2⤵
  PID:768
- C:\Windows\System\ZXQiMDa.exe
  C:\Windows\System\ZXQiMDa.exe
  2⤵
  PID:2412
- C:\Windows\System\aellCrN.exe
  C:\Windows\System\aellCrN.exe
  2⤵
  PID:1212
- C:\Windows\System\ztpGsck.exe
  C:\Windows\System\ztpGsck.exe
  2⤵
  PID:1696
- C:\Windows\System\ISRZZIu.exe
  C:\Windows\System\ISRZZIu.exe
  2⤵
  PID:2888
- C:\Windows\System\YiXaKjb.exe
  C:\Windows\System\YiXaKjb.exe
  2⤵
  PID:3548
- C:\Windows\System\LSnyhCj.exe
  C:\Windows\System\LSnyhCj.exe
  2⤵
  PID:2520
- C:\Windows\System\wzdlCGp.exe
  C:\Windows\System\wzdlCGp.exe
  2⤵
  PID:3088
- C:\Windows\System\YknCLHO.exe
  C:\Windows\System\YknCLHO.exe
  2⤵
  PID:2616
- C:\Windows\System\MTazuOf.exe
  C:\Windows\System\MTazuOf.exe
  2⤵
  PID:3224
- C:\Windows\System\pPcwiOr.exe
  C:\Windows\System\pPcwiOr.exe
  2⤵
  PID:2260
- C:\Windows\System\CNGAmwa.exe
  C:\Windows\System\CNGAmwa.exe
  2⤵
  PID:3392
- C:\Windows\System\VEnqGaK.exe
  C:\Windows\System\VEnqGaK.exe
  2⤵
  PID:3448
- C:\Windows\System\TDhMdWz.exe
  C:\Windows\System\TDhMdWz.exe
  2⤵
  PID:2584
- C:\Windows\System\kxAaVED.exe
  C:\Windows\System\kxAaVED.exe
  2⤵
  PID:880
- C:\Windows\System\lWojDMa.exe
  C:\Windows\System\lWojDMa.exe
  2⤵
  PID:3140
- C:\Windows\System\FiiLTjA.exe
  C:\Windows\System\FiiLTjA.exe
  2⤵
  PID:3204
- C:\Windows\System\yclaGIb.exe
  C:\Windows\System\yclaGIb.exe
  2⤵
  PID:3280
- C:\Windows\System\FdQqWHr.exe
  C:\Windows\System\FdQqWHr.exe
  2⤵
  PID:3340
- C:\Windows\System\fNteIMK.exe
  C:\Windows\System\fNteIMK.exe
  2⤵
  PID:3412
- C:\Windows\System\QVrgfHi.exe
  C:\Windows\System\QVrgfHi.exe
  2⤵
  PID:3528
- C:\Windows\System\bjSDarJ.exe
  C:\Windows\System\bjSDarJ.exe
  2⤵
  PID:3560
- C:\Windows\System\wjRofMA.exe
  C:\Windows\System\wjRofMA.exe
  2⤵
  PID:3668
- C:\Windows\System\oLekDiP.exe
  C:\Windows\System\oLekDiP.exe
  2⤵
  PID:3728
- C:\Windows\System\IzKzAAf.exe
  C:\Windows\System\IzKzAAf.exe
  2⤵
  PID:3744
- C:\Windows\System\glAUzqd.exe
  C:\Windows\System\glAUzqd.exe
  2⤵
  PID:3768
- C:\Windows\System\QGeArpU.exe
  C:\Windows\System\QGeArpU.exe
  2⤵
  PID:3784
- C:\Windows\System\mIcALiM.exe
  C:\Windows\System\mIcALiM.exe
  2⤵
  PID:3804
- C:\Windows\System\fcKYtCi.exe
  C:\Windows\System\fcKYtCi.exe
  2⤵
  PID:3824
- C:\Windows\System\AtROfSH.exe
  C:\Windows\System\AtROfSH.exe
  2⤵
  PID:2152
- C:\Windows\System\KZGkEST.exe
  C:\Windows\System\KZGkEST.exe
  2⤵
  PID:988
- C:\Windows\System\KSLRCuI.exe
  C:\Windows\System\KSLRCuI.exe
  2⤵
  PID:3296
- C:\Windows\System\FLJQvKV.exe
  C:\Windows\System\FLJQvKV.exe
  2⤵
  PID:3436
- C:\Windows\System\lBVeNXh.exe
  C:\Windows\System\lBVeNXh.exe
  2⤵
  PID:3480
- C:\Windows\System\DSsMpMG.exe
  C:\Windows\System\DSsMpMG.exe
  2⤵
  PID:3576
- C:\Windows\System\nmlfISq.exe
  C:\Windows\System\nmlfISq.exe
  2⤵
  PID:3640
- C:\Windows\System\DVDOpzD.exe
  C:\Windows\System\DVDOpzD.exe
  2⤵
  PID:3684
- C:\Windows\System\UtOfbnx.exe
  C:\Windows\System\UtOfbnx.exe
  2⤵
  PID:1840
- C:\Windows\System\ZZUSXHI.exe
  C:\Windows\System\ZZUSXHI.exe
  2⤵
  PID:836
- C:\Windows\System\RAJfKGT.exe
  C:\Windows\System\RAJfKGT.exe
  2⤵
  PID:3916
- C:\Windows\System\DvocDlL.exe
  C:\Windows\System\DvocDlL.exe
  2⤵
  PID:3924
- C:\Windows\System\fszJYPu.exe
  C:\Windows\System\fszJYPu.exe
  2⤵
  PID:3920
- C:\Windows\System\FlpApVH.exe
  C:\Windows\System\FlpApVH.exe
  2⤵
  PID:3020
- C:\Windows\System\lzEnMtG.exe
  C:\Windows\System\lzEnMtG.exe
  2⤵
  PID:3972
- C:\Windows\System\lnsdvMU.exe
  C:\Windows\System\lnsdvMU.exe
  2⤵
  PID:3976
- C:\Windows\System\sWnGgIB.exe
  C:\Windows\System\sWnGgIB.exe
  2⤵
  PID:3996
- C:\Windows\System\EdFrtFQ.exe
  C:\Windows\System\EdFrtFQ.exe
  2⤵
  PID:4076
- C:\Windows\System\NCfqnwe.exe
  C:\Windows\System\NCfqnwe.exe
  2⤵
  PID:2544
- C:\Windows\System\bcZucFN.exe
  C:\Windows\System\bcZucFN.exe
  2⤵
  PID:1364
- C:\Windows\System\BhLqsNz.exe
  C:\Windows\System\BhLqsNz.exe
  2⤵
  PID:2660
- C:\Windows\System\xnsEnTR.exe
  C:\Windows\System\xnsEnTR.exe
  2⤵
  PID:1584
- C:\Windows\System\WDsMZYz.exe
  C:\Windows\System\WDsMZYz.exe
  2⤵
  PID:556
- C:\Windows\System\AoHRCrr.exe
  C:\Windows\System\AoHRCrr.exe
  2⤵
  PID:1588
- C:\Windows\System\zJXDUIc.exe
  C:\Windows\System\zJXDUIc.exe
  2⤵
  PID:1748
- C:\Windows\System\pBGQTpB.exe
  C:\Windows\System\pBGQTpB.exe
  2⤵
  PID:1560
- C:\Windows\System\bflEgLo.exe
  C:\Windows\System\bflEgLo.exe
  2⤵
  PID:1608
- C:\Windows\System\AUfpbyh.exe
  C:\Windows\System\AUfpbyh.exe
  2⤵
  PID:2000
- C:\Windows\System\iPpHulw.exe
  C:\Windows\System\iPpHulw.exe
  2⤵
  PID:3324
- C:\Windows\System\OuJwzTf.exe
  C:\Windows\System\OuJwzTf.exe
  2⤵
  PID:3364
- C:\Windows\System\sHbcOOq.exe
  C:\Windows\System\sHbcOOq.exe
  2⤵
  PID:2108
- C:\Windows\System\xGHCuIY.exe
  C:\Windows\System\xGHCuIY.exe
  2⤵
  PID:1300
- C:\Windows\System\XTBdesP.exe
  C:\Windows\System\XTBdesP.exe
  2⤵
  PID:3172
- C:\Windows\System\TmizbKs.exe
  C:\Windows\System\TmizbKs.exe
  2⤵
  PID:1240
- C:\Windows\System\VNfJTGP.exe
  C:\Windows\System\VNfJTGP.exe
  2⤵
  PID:3344
- C:\Windows\System\kEhFOxz.exe
  C:\Windows\System\kEhFOxz.exe
  2⤵
  PID:3380
- C:\Windows\System\ydwcWLb.exe
  C:\Windows\System\ydwcWLb.exe
  2⤵
  PID:3492
- C:\Windows\System\HHoCwPB.exe
  C:\Windows\System\HHoCwPB.exe
  2⤵
  PID:3628
- C:\Windows\System\XegrghX.exe
  C:\Windows\System\XegrghX.exe
  2⤵
  PID:3716
- C:\Windows\System\iKRhdeS.exe
  C:\Windows\System\iKRhdeS.exe
  2⤵
  PID:3736
- C:\Windows\System\PauXbhf.exe
  C:\Windows\System\PauXbhf.exe
  2⤵
  PID:3764
- C:\Windows\System\YfgSvql.exe
  C:\Windows\System\YfgSvql.exe
  2⤵
  PID:3792
- C:\Windows\System\ZagjlGQ.exe
  C:\Windows\System\ZagjlGQ.exe
  2⤵
  PID:3812
- C:\Windows\System\zplllFq.exe
  C:\Windows\System\zplllFq.exe
  2⤵
  PID:2420
- C:\Windows\System\GBIkXsq.exe
  C:\Windows\System\GBIkXsq.exe
  2⤵
  PID:2288
- C:\Windows\System\vjDVTHS.exe
  C:\Windows\System\vjDVTHS.exe
  2⤵
  PID:3128
- C:\Windows\System\icetIYa.exe
  C:\Windows\System\icetIYa.exe
  2⤵
  PID:2756
- C:\Windows\System\EbhAPpx.exe
  C:\Windows\System\EbhAPpx.exe
  2⤵
  PID:2052
- C:\Windows\System\radyRVI.exe
  C:\Windows\System\radyRVI.exe
  2⤵
  PID:3544
- C:\Windows\System\MpyUtFi.exe
  C:\Windows\System\MpyUtFi.exe
  2⤵
  PID:2368
- C:\Windows\System\UZgvuFe.exe
  C:\Windows\System\UZgvuFe.exe
  2⤵
  PID:3680
- C:\Windows\System\ogrDgMz.exe
  C:\Windows\System\ogrDgMz.exe
  2⤵
  PID:2644
- C:\Windows\System\GCCtxQQ.exe
  C:\Windows\System\GCCtxQQ.exe
  2⤵
  PID:2264
- C:\Windows\System\nPqgSrS.exe
  C:\Windows\System\nPqgSrS.exe
  2⤵
  PID:3176
- C:\Windows\System\kBaaxDQ.exe
  C:\Windows\System\kBaaxDQ.exe
  2⤵
  PID:2128
- C:\Windows\System\FRblLIj.exe
  C:\Windows\System\FRblLIj.exe
  2⤵
  PID:3780
- C:\Windows\System\IgdfVNS.exe
  C:\Windows\System\IgdfVNS.exe
  2⤵
  PID:2860
- C:\Windows\System\KbjRQan.exe
  C:\Windows\System\KbjRQan.exe
  2⤵
  PID:3608
- C:\Windows\System\vndNKuX.exe
  C:\Windows\System\vndNKuX.exe
  2⤵
  PID:2680
- C:\Windows\System\OuIAtUD.exe
  C:\Windows\System\OuIAtUD.exe
  2⤵
  PID:3944
- C:\Windows\System\tzSeoXT.exe
  C:\Windows\System\tzSeoXT.exe
  2⤵
  PID:620
- C:\Windows\System\AEUKWan.exe
  C:\Windows\System\AEUKWan.exe
  2⤵
  PID:2620
- C:\Windows\System\NkQyAlB.exe
  C:\Windows\System\NkQyAlB.exe
  2⤵
  PID:3308
- C:\Windows\System\IOftQmc.exe
  C:\Windows\System\IOftQmc.exe
  2⤵
  PID:1964
- C:\Windows\System\pxqEZMC.exe
  C:\Windows\System\pxqEZMC.exe
  2⤵
  PID:3796
- C:\Windows\System\NSNwMjo.exe
  C:\Windows\System\NSNwMjo.exe
  2⤵
  PID:3432
- C:\Windows\System\NExhqSe.exe
  C:\Windows\System\NExhqSe.exe
  2⤵
  PID:3256
- C:\Windows\System\HmGKXEQ.exe
  C:\Windows\System\HmGKXEQ.exe
  2⤵
  PID:2196
- C:\Windows\System\PaRVJEK.exe
  C:\Windows\System\PaRVJEK.exe
  2⤵
  PID:4004
- C:\Windows\System\UaioYFd.exe
  C:\Windows\System\UaioYFd.exe
  2⤵
  PID:3048
- C:\Windows\System\QfYstsG.exe
  C:\Windows\System\QfYstsG.exe
  2⤵
  PID:2632
- C:\Windows\System\AjEuiUW.exe
  C:\Windows\System\AjEuiUW.exe
  2⤵
  PID:3592
- C:\Windows\System\BpLSzDT.exe
  C:\Windows\System\BpLSzDT.exe
  2⤵
  PID:804
- C:\Windows\System\QPfBNqq.exe
  C:\Windows\System\QPfBNqq.exe
  2⤵
  PID:3708
- C:\Windows\System\qFfRyyi.exe
  C:\Windows\System\qFfRyyi.exe
  2⤵
  PID:3376
- C:\Windows\System\OSEiTIq.exe
  C:\Windows\System\OSEiTIq.exe
  2⤵
  PID:3872
- C:\Windows\System\UwPpOpb.exe
  C:\Windows\System\UwPpOpb.exe
  2⤵
  PID:3108
- C:\Windows\System\BKcWOho.exe
  C:\Windows\System\BKcWOho.exe
  2⤵
  PID:3512
- C:\Windows\System\ZUWKLUG.exe
  C:\Windows\System\ZUWKLUG.exe
  2⤵
  PID:1776
- C:\Windows\System\dqKPOsz.exe
  C:\Windows\System\dqKPOsz.exe
  2⤵
  PID:4040
- C:\Windows\System\BglHhfu.exe
  C:\Windows\System\BglHhfu.exe
  2⤵
  PID:3904
- C:\Windows\System\mVLCvnR.exe
  C:\Windows\System\mVLCvnR.exe
  2⤵
  PID:1856
- C:\Windows\System\ibcjVYs.exe
  C:\Windows\System\ibcjVYs.exe
  2⤵
  PID:3956
- C:\Windows\System\lHPkcom.exe
  C:\Windows\System\lHPkcom.exe
  2⤵
  PID:2800
- C:\Windows\System\WcsuxCO.exe
  C:\Windows\System\WcsuxCO.exe
  2⤵
  PID:3156
- C:\Windows\System\swNmwTj.exe
  C:\Windows\System\swNmwTj.exe
  2⤵
  PID:4028
- C:\Windows\System\JHpAVsu.exe
  C:\Windows\System\JHpAVsu.exe
  2⤵
  PID:844
- C:\Windows\System\jhRAOiT.exe
  C:\Windows\System\jhRAOiT.exe
  2⤵
  PID:2096
- C:\Windows\System\Szecfsu.exe
  C:\Windows\System\Szecfsu.exe
  2⤵
  PID:2760
- C:\Windows\System\DjNnMjf.exe
  C:\Windows\System\DjNnMjf.exe
  2⤵
  PID:2856
- C:\Windows\System\vbnhUcY.exe
  C:\Windows\System\vbnhUcY.exe
  2⤵
  PID:1320
- C:\Windows\System\CVkyqdN.exe
  C:\Windows\System\CVkyqdN.exe
  2⤵
  PID:1448
- C:\Windows\System\RPxwEpi.exe
  C:\Windows\System\RPxwEpi.exe
  2⤵
  PID:3776
- C:\Windows\System\cwofOes.exe
  C:\Windows\System\cwofOes.exe
  2⤵
  PID:1100
- C:\Windows\System\uBRcHAB.exe
  C:\Windows\System\uBRcHAB.exe
  2⤵
  PID:3220
- C:\Windows\System\HgIvDNH.exe
  C:\Windows\System\HgIvDNH.exe
  2⤵
  PID:3704
- C:\Windows\System\ASVbFev.exe
  C:\Windows\System\ASVbFev.exe
  2⤵
  PID:3664
- C:\Windows\System\MTlDmsm.exe
  C:\Windows\System\MTlDmsm.exe
  2⤵
  PID:3960
- C:\Windows\System\KwhZHAj.exe
  C:\Windows\System\KwhZHAj.exe
  2⤵
  PID:4120
- C:\Windows\System\MVyMVNk.exe
  C:\Windows\System\MVyMVNk.exe
  2⤵
  PID:4136
- C:\Windows\System\ZaAMVKB.exe
  C:\Windows\System\ZaAMVKB.exe
  2⤵
  PID:4152
- C:\Windows\System\FCiWlAc.exe
  C:\Windows\System\FCiWlAc.exe
  2⤵
  PID:4168
- C:\Windows\System\xXFgkwM.exe
  C:\Windows\System\xXFgkwM.exe
  2⤵
  PID:4184
- C:\Windows\System\ClxzDaE.exe
  C:\Windows\System\ClxzDaE.exe
  2⤵
  PID:4200
- C:\Windows\System\mPHMCWj.exe
  C:\Windows\System\mPHMCWj.exe
  2⤵
  PID:4216
- C:\Windows\System\qrNQlUC.exe
  C:\Windows\System\qrNQlUC.exe
  2⤵
  PID:4240
- C:\Windows\System\ueZZypT.exe
  C:\Windows\System\ueZZypT.exe
  2⤵
  PID:4256
- C:\Windows\System\mvJzBQR.exe
  C:\Windows\System\mvJzBQR.exe
  2⤵
  PID:4272
- C:\Windows\System\aomGGRV.exe
  C:\Windows\System\aomGGRV.exe
  2⤵
  PID:4288
- C:\Windows\System\dlTwrVV.exe
  C:\Windows\System\dlTwrVV.exe
  2⤵
  PID:4312
- C:\Windows\System\xMRTvSk.exe
  C:\Windows\System\xMRTvSk.exe
  2⤵
  PID:4328
- C:\Windows\System\qdnrciG.exe
  C:\Windows\System\qdnrciG.exe
  2⤵
  PID:4344
- C:\Windows\System\QoNiEgQ.exe
  C:\Windows\System\QoNiEgQ.exe
  2⤵
  PID:4364
- C:\Windows\System\HtEwRwE.exe
  C:\Windows\System\HtEwRwE.exe
  2⤵
  PID:4380
- C:\Windows\System\HupVInK.exe
  C:\Windows\System\HupVInK.exe
  2⤵
  PID:4396
- C:\Windows\System\NQCrctC.exe
  C:\Windows\System\NQCrctC.exe
  2⤵
  PID:4412
- C:\Windows\System\xBHugGc.exe
  C:\Windows\System\xBHugGc.exe
  2⤵
  PID:4428
- C:\Windows\System\eyOFZDM.exe
  C:\Windows\System\eyOFZDM.exe
  2⤵
  PID:4460
- C:\Windows\System\YJjDcLk.exe
  C:\Windows\System\YJjDcLk.exe
  2⤵
  PID:4476
- C:\Windows\System\sRmTwmm.exe
  C:\Windows\System\sRmTwmm.exe
  2⤵
  PID:4492
- C:\Windows\System\RvZxzfC.exe
  C:\Windows\System\RvZxzfC.exe
  2⤵
  PID:4512
- C:\Windows\System\wAIHBXY.exe
  C:\Windows\System\wAIHBXY.exe
  2⤵
  PID:4532
- C:\Windows\System\oCjNXPK.exe
  C:\Windows\System\oCjNXPK.exe
  2⤵
  PID:4552
- C:\Windows\System\YrURWjD.exe
  C:\Windows\System\YrURWjD.exe
  2⤵
  PID:4568
- C:\Windows\System\wyTtJKE.exe
  C:\Windows\System\wyTtJKE.exe
  2⤵
  PID:4588
- C:\Windows\System\QbUchfm.exe
  C:\Windows\System\QbUchfm.exe
  2⤵
  PID:4604
- C:\Windows\System\ubzQbKn.exe
  C:\Windows\System\ubzQbKn.exe
  2⤵
  PID:4648
- C:\Windows\System\csfUnIs.exe
  C:\Windows\System\csfUnIs.exe
  2⤵
  PID:4680
- C:\Windows\System\TnxySWx.exe
  C:\Windows\System\TnxySWx.exe
  2⤵
  PID:4716
- C:\Windows\System\ULTQhBT.exe
  C:\Windows\System\ULTQhBT.exe
  2⤵
  PID:4744
- C:\Windows\System\xVwLdyc.exe
  C:\Windows\System\xVwLdyc.exe
  2⤵
  PID:4768
- C:\Windows\System\BwpfFFT.exe
  C:\Windows\System\BwpfFFT.exe
  2⤵
  PID:4784
- C:\Windows\System\kMpRzcZ.exe
  C:\Windows\System\kMpRzcZ.exe
  2⤵
  PID:4804
- C:\Windows\System\qguYHKl.exe
  C:\Windows\System\qguYHKl.exe
  2⤵
  PID:4828
- C:\Windows\System\HVBrAMI.exe
  C:\Windows\System\HVBrAMI.exe
  2⤵
  PID:4844
- C:\Windows\System\UJqSgwD.exe
  C:\Windows\System\UJqSgwD.exe
  2⤵
  PID:4864
- C:\Windows\System\vwwhxLV.exe
  C:\Windows\System\vwwhxLV.exe
  2⤵
  PID:4884
- C:\Windows\System\CWiFjbh.exe
  C:\Windows\System\CWiFjbh.exe
  2⤵
  PID:4900
- C:\Windows\System\vMmaYls.exe
  C:\Windows\System\vMmaYls.exe
  2⤵
  PID:4924
- C:\Windows\System\CPnYRad.exe
  C:\Windows\System\CPnYRad.exe
  2⤵
  PID:4944
- C:\Windows\System\YhyJBsC.exe
  C:\Windows\System\YhyJBsC.exe
  2⤵
  PID:4964
- C:\Windows\System\ytdbNIo.exe
  C:\Windows\System\ytdbNIo.exe
  2⤵
  PID:4984
- C:\Windows\System\TiLTmSG.exe
  C:\Windows\System\TiLTmSG.exe
  2⤵
  PID:5000
- C:\Windows\System\FBMnGSt.exe
  C:\Windows\System\FBMnGSt.exe
  2⤵
  PID:5024
- C:\Windows\System\ylZMqmW.exe
  C:\Windows\System\ylZMqmW.exe
  2⤵
  PID:5044
- C:\Windows\System\KJpuSgX.exe
  C:\Windows\System\KJpuSgX.exe
  2⤵
  PID:5060
- C:\Windows\System\YhTbLoS.exe
  C:\Windows\System\YhTbLoS.exe
  2⤵
  PID:5080
- C:\Windows\System\wbqlXnb.exe
  C:\Windows\System\wbqlXnb.exe
  2⤵
  PID:5112
- C:\Windows\System\CvdPmJG.exe
  C:\Windows\System\CvdPmJG.exe
  2⤵
  PID:4108
- C:\Windows\System\HWDHcnB.exe
  C:\Windows\System\HWDHcnB.exe
  2⤵
  PID:1428
- C:\Windows\System\qrZKxdP.exe
  C:\Windows\System\qrZKxdP.exe
  2⤵
  PID:4196
- C:\Windows\System\OXyFzIU.exe
  C:\Windows\System\OXyFzIU.exe
  2⤵
  PID:4236
- C:\Windows\System\GbnkckU.exe
  C:\Windows\System\GbnkckU.exe
  2⤵
  PID:4304
- C:\Windows\System\AiLQSWS.exe
  C:\Windows\System\AiLQSWS.exe
  2⤵
  PID:4340
- C:\Windows\System\cRfZyQz.exe
  C:\Windows\System\cRfZyQz.exe
  2⤵
  PID:4252
- C:\Windows\System\ZpDqEZZ.exe
  C:\Windows\System\ZpDqEZZ.exe
  2⤵
  PID:4436
- C:\Windows\System\TcFxxYN.exe
  C:\Windows\System\TcFxxYN.exe
  2⤵
  PID:4248
- C:\Windows\System\Llseflh.exe
  C:\Windows\System\Llseflh.exe
  2⤵
  PID:4320
- C:\Windows\System\LSpVCgv.exe
  C:\Windows\System\LSpVCgv.exe
  2⤵
  PID:4388
- C:\Windows\System\cmxuAoU.exe
  C:\Windows\System\cmxuAoU.exe
  2⤵
  PID:4472
- C:\Windows\System\SzTBjlS.exe
  C:\Windows\System\SzTBjlS.exe
  2⤵
  PID:4540
- C:\Windows\System\oVbolrO.exe
  C:\Windows\System\oVbolrO.exe
  2⤵
  PID:4580
- C:\Windows\System\IGtlkuz.exe
  C:\Windows\System\IGtlkuz.exe
  2⤵
  PID:4664
- C:\Windows\System\kLpfjco.exe
  C:\Windows\System\kLpfjco.exe
  2⤵
  PID:4688
- C:\Windows\System\vEwsRiw.exe
  C:\Windows\System\vEwsRiw.exe
  2⤵
  PID:4712
- C:\Windows\System\UvpSNmX.exe
  C:\Windows\System\UvpSNmX.exe
  2⤵
  PID:4732
- C:\Windows\System\WUfvFlO.exe
  C:\Windows\System\WUfvFlO.exe
  2⤵
  PID:4872
- C:\Windows\System\lpceNIs.exe
  C:\Windows\System\lpceNIs.exe
  2⤵
  PID:4896
- C:\Windows\System\qDWQcAv.exe
  C:\Windows\System\qDWQcAv.exe
  2⤵
  PID:4932
- C:\Windows\System\PsmSwgn.exe
  C:\Windows\System\PsmSwgn.exe
  2⤵
  PID:4952
- C:\Windows\System\PEPNqZV.exe
  C:\Windows\System\PEPNqZV.exe
  2⤵
  PID:4980
- C:\Windows\System\CjSQxCg.exe
  C:\Windows\System\CjSQxCg.exe
  2⤵
  PID:5016
- C:\Windows\System\BPzeAvD.exe
  C:\Windows\System\BPzeAvD.exe
  2⤵
  PID:5012
- C:\Windows\System\kpRvpKb.exe
  C:\Windows\System\kpRvpKb.exe
  2⤵
  PID:5068
- C:\Windows\System\GnIenzw.exe
  C:\Windows\System\GnIenzw.exe
  2⤵
  PID:5072
- C:\Windows\System\KoFjmsc.exe
  C:\Windows\System\KoFjmsc.exe
  2⤵
  PID:5108
- C:\Windows\System\lrwuCsc.exe
  C:\Windows\System\lrwuCsc.exe
  2⤵
  PID:4128
- C:\Windows\System\AqVsyde.exe
  C:\Windows\System\AqVsyde.exe
  2⤵
  PID:4164
- C:\Windows\System\bahntZu.exe
  C:\Windows\System\bahntZu.exe
  2⤵
  PID:4192
- C:\Windows\System\uGPGKao.exe
  C:\Windows\System\uGPGKao.exe
  2⤵
  PID:4576
- C:\Windows\System\KQLIwfR.exe
  C:\Windows\System\KQLIwfR.exe
  2⤵
  PID:4284
- C:\Windows\System\OUEWCfy.exe
  C:\Windows\System\OUEWCfy.exe
  2⤵
  PID:4264
- C:\Windows\System\uaXVDeG.exe
  C:\Windows\System\uaXVDeG.exe
  2⤵
  PID:4376
- C:\Windows\System\JEGKpPu.exe
  C:\Windows\System\JEGKpPu.exe
  2⤵
  PID:4560
- C:\Windows\System\oMTXvRp.exe
  C:\Windows\System\oMTXvRp.exe
  2⤵
  PID:4564
- C:\Windows\System\YMAaziG.exe
  C:\Windows\System\YMAaziG.exe
  2⤵
  PID:4520
- C:\Windows\System\wXpkOMi.exe
  C:\Windows\System\wXpkOMi.exe
  2⤵
  PID:4596
- C:\Windows\System\kCJNVrP.exe
  C:\Windows\System\kCJNVrP.exe
  2⤵
  PID:4736
- C:\Windows\System\RVhwovF.exe
  C:\Windows\System\RVhwovF.exe
  2⤵
  PID:4624
- C:\Windows\System\lJdUypc.exe
  C:\Windows\System\lJdUypc.exe
  2⤵
  PID:4780
- C:\Windows\System\inhEVJX.exe
  C:\Windows\System\inhEVJX.exe
  2⤵
  PID:4616
- C:\Windows\System\aKkHDQe.exe
  C:\Windows\System\aKkHDQe.exe
  2⤵
  PID:4776
- C:\Windows\System\KvifhVg.exe
  C:\Windows\System\KvifhVg.exe
  2⤵
  PID:4836
- C:\Windows\System\FsliKmj.exe
  C:\Windows\System\FsliKmj.exe
  2⤵
  PID:4632
- C:\Windows\System\BAAECqJ.exe
  C:\Windows\System\BAAECqJ.exe
  2⤵
  PID:4708
- C:\Windows\System\ovlkyad.exe
  C:\Windows\System\ovlkyad.exe
  2⤵
  PID:4856
- C:\Windows\System\bOhuFlG.exe
  C:\Windows\System\bOhuFlG.exe
  2⤵
  PID:4992
- C:\Windows\System\xZYUADM.exe
  C:\Windows\System\xZYUADM.exe
  2⤵
  PID:5136
- C:\Windows\System\pGnCDiv.exe
  C:\Windows\System\pGnCDiv.exe
  2⤵
  PID:5152
- C:\Windows\System\ezbPGFO.exe
  C:\Windows\System\ezbPGFO.exe
  2⤵
  PID:5168
- C:\Windows\System\tsYCGXa.exe
  C:\Windows\System\tsYCGXa.exe
  2⤵
  PID:5328
- C:\Windows\System\rpJuGnW.exe
  C:\Windows\System\rpJuGnW.exe
  2⤵
  PID:5344
- C:\Windows\System\lyMWOtq.exe
  C:\Windows\System\lyMWOtq.exe
  2⤵
  PID:5360
- C:\Windows\System\fHfIVNo.exe
  C:\Windows\System\fHfIVNo.exe
  2⤵
  PID:5376
- C:\Windows\System\yuqoweq.exe
  C:\Windows\System\yuqoweq.exe
  2⤵
  PID:5396
- C:\Windows\System\jmUYzPt.exe
  C:\Windows\System\jmUYzPt.exe
  2⤵
  PID:5412
- C:\Windows\System\rvjlCmJ.exe
  C:\Windows\System\rvjlCmJ.exe
  2⤵
  PID:5428
- C:\Windows\System\KcFoyaY.exe
  C:\Windows\System\KcFoyaY.exe
  2⤵
  PID:5444
- C:\Windows\System\vbaHAFq.exe
  C:\Windows\System\vbaHAFq.exe
  2⤵
  PID:5460
- C:\Windows\System\RiqbOSS.exe
  C:\Windows\System\RiqbOSS.exe
  2⤵
  PID:5476
- C:\Windows\System\CdvuCoL.exe
  C:\Windows\System\CdvuCoL.exe
  2⤵
  PID:5492
- C:\Windows\System\jPAlNbL.exe
  C:\Windows\System\jPAlNbL.exe
  2⤵
  PID:5508
- C:\Windows\System\BKSismc.exe
  C:\Windows\System\BKSismc.exe
  2⤵
  PID:5524
- C:\Windows\System\HDrObfn.exe
  C:\Windows\System\HDrObfn.exe
  2⤵
  PID:5540
- C:\Windows\System\isNZbtl.exe
  C:\Windows\System\isNZbtl.exe
  2⤵
  PID:5556
- C:\Windows\System\CtnXlAz.exe
  C:\Windows\System\CtnXlAz.exe
  2⤵
  PID:5572
- C:\Windows\System\idWPAIJ.exe
  C:\Windows\System\idWPAIJ.exe
  2⤵
  PID:5588
- C:\Windows\System\royJAQw.exe
  C:\Windows\System\royJAQw.exe
  2⤵
  PID:5604
- C:\Windows\System\VBhErha.exe
  C:\Windows\System\VBhErha.exe
  2⤵
  PID:5620
- C:\Windows\System\sHzOUoo.exe
  C:\Windows\System\sHzOUoo.exe
  2⤵
  PID:5636
- C:\Windows\System\wRQjssq.exe
  C:\Windows\System\wRQjssq.exe
  2⤵
  PID:5652
- C:\Windows\System\WEakQJR.exe
  C:\Windows\System\WEakQJR.exe
  2⤵
  PID:5668
- C:\Windows\System\ioODpyO.exe
  C:\Windows\System\ioODpyO.exe
  2⤵
  PID:5688
- C:\Windows\System\cQNGfNO.exe
  C:\Windows\System\cQNGfNO.exe
  2⤵
  PID:5704
- C:\Windows\System\lOjNvPM.exe
  C:\Windows\System\lOjNvPM.exe
  2⤵
  PID:5720
- C:\Windows\System\mCFuklb.exe
  C:\Windows\System\mCFuklb.exe
  2⤵
  PID:5736
- C:\Windows\System\nSSMhwG.exe
  C:\Windows\System\nSSMhwG.exe
  2⤵
  PID:5752
- C:\Windows\System\yIiBfPs.exe
  C:\Windows\System\yIiBfPs.exe
  2⤵
  PID:5772
- C:\Windows\System\LyXGxxt.exe
  C:\Windows\System\LyXGxxt.exe
  2⤵
  PID:5788
- C:\Windows\System\DCNVoXa.exe
  C:\Windows\System\DCNVoXa.exe
  2⤵
  PID:5804
- C:\Windows\System\dSUTWsC.exe
  C:\Windows\System\dSUTWsC.exe
  2⤵
  PID:5820
- C:\Windows\System\HtrOMBx.exe
  C:\Windows\System\HtrOMBx.exe
  2⤵
  PID:5836
- C:\Windows\System\LtWvgmK.exe
  C:\Windows\System\LtWvgmK.exe
  2⤵
  PID:5856
- C:\Windows\System\nwCWHfH.exe
  C:\Windows\System\nwCWHfH.exe
  2⤵
  PID:5872
- C:\Windows\System\OZzNoNz.exe
  C:\Windows\System\OZzNoNz.exe
  2⤵
  PID:5888
- C:\Windows\System\fWVcmNq.exe
  C:\Windows\System\fWVcmNq.exe
  2⤵
  PID:5904
- C:\Windows\System\iCkroYW.exe
  C:\Windows\System\iCkroYW.exe
  2⤵
  PID:5920
- C:\Windows\System\fsdNGcl.exe
  C:\Windows\System\fsdNGcl.exe
  2⤵
  PID:5936
- C:\Windows\System\SPuDbOt.exe
  C:\Windows\System\SPuDbOt.exe
  2⤵
  PID:5952
- C:\Windows\System\JgiVZVw.exe
  C:\Windows\System\JgiVZVw.exe
  2⤵
  PID:5968
- C:\Windows\System\vdQOyvv.exe
  C:\Windows\System\vdQOyvv.exe
  2⤵
  PID:5984
- C:\Windows\System\oaeKIpP.exe
  C:\Windows\System\oaeKIpP.exe
  2⤵
  PID:6000
- C:\Windows\System\ontksgF.exe
  C:\Windows\System\ontksgF.exe
  2⤵
  PID:6016
- C:\Windows\System\LmtkTIP.exe
  C:\Windows\System\LmtkTIP.exe
  2⤵
  PID:6032
- C:\Windows\System\HDorgJb.exe
  C:\Windows\System\HDorgJb.exe
  2⤵
  PID:6048
- C:\Windows\System\mInhqYg.exe
  C:\Windows\System\mInhqYg.exe
  2⤵
  PID:6064
- C:\Windows\System\AmHkeuZ.exe
  C:\Windows\System\AmHkeuZ.exe
  2⤵
  PID:6080
- C:\Windows\System\hAoijyw.exe
  C:\Windows\System\hAoijyw.exe
  2⤵
  PID:6096
- C:\Windows\System\SrnkWDo.exe
  C:\Windows\System\SrnkWDo.exe
  2⤵
  PID:6112
- C:\Windows\System\ahseOqy.exe
  C:\Windows\System\ahseOqy.exe
  2⤵
  PID:6128
- C:\Windows\System\iSarsFY.exe
  C:\Windows\System\iSarsFY.exe
  2⤵
  PID:5040
- C:\Windows\System\bTBQCue.exe
  C:\Windows\System\bTBQCue.exe
  2⤵
  PID:5104
- C:\Windows\System\VAtJCaJ.exe
  C:\Windows\System\VAtJCaJ.exe
  2⤵
  PID:4176
- C:\Windows\System\excMJmO.exe
  C:\Windows\System\excMJmO.exe
  2⤵
  PID:4212
- C:\Windows\System\FiksJXN.exe
  C:\Windows\System\FiksJXN.exe
  2⤵
  PID:4356
- C:\Windows\System\LEQYInl.exe
  C:\Windows\System\LEQYInl.exe
  2⤵
  PID:4636
- C:\Windows\System\xNtfTPW.exe
  C:\Windows\System\xNtfTPW.exe
  2⤵
  PID:5132
- C:\Windows\System\kWXBwth.exe
  C:\Windows\System\kWXBwth.exe
  2⤵
  PID:4840
- C:\Windows\System\GtDJKeu.exe
  C:\Windows\System\GtDJKeu.exe
  2⤵
  PID:4760
- C:\Windows\System\UJiPiIj.exe
  C:\Windows\System\UJiPiIj.exe
  2⤵
  PID:4700
- C:\Windows\System\BEkwzpw.exe
  C:\Windows\System\BEkwzpw.exe
  2⤵
  PID:4740
- C:\Windows\System\hLQOQMG.exe
  C:\Windows\System\hLQOQMG.exe
  2⤵
  PID:4528
- C:\Windows\System\WHgbDaM.exe
  C:\Windows\System\WHgbDaM.exe
  2⤵
  PID:4940
- C:\Windows\System\PksatIi.exe
  C:\Windows\System\PksatIi.exe
  2⤵
  PID:5176
- C:\Windows\System\IntfOjX.exe
  C:\Windows\System\IntfOjX.exe
  2⤵
  PID:5188
- C:\Windows\System\qXPtqAA.exe
  C:\Windows\System\qXPtqAA.exe
  2⤵
  PID:5208
- C:\Windows\System\shGVKhg.exe
  C:\Windows\System\shGVKhg.exe
  2⤵
  PID:5100
- C:\Windows\System\LlEEMQq.exe
  C:\Windows\System\LlEEMQq.exe
  2⤵
  PID:5076
- C:\Windows\System\rjEvAuY.exe
  C:\Windows\System\rjEvAuY.exe
  2⤵
  PID:5216
- C:\Windows\System\BOUXDDs.exe
  C:\Windows\System\BOUXDDs.exe
  2⤵
  PID:5232
- C:\Windows\System\PlDseLh.exe
  C:\Windows\System\PlDseLh.exe
  2⤵
  PID:4372
- C:\Windows\System\XXqujkA.exe
  C:\Windows\System\XXqujkA.exe
  2⤵
  PID:5340
- C:\Windows\System\pwdCmpR.exe
  C:\Windows\System\pwdCmpR.exe
  2⤵
  PID:5372
- C:\Windows\System\OSTVuOs.exe
  C:\Windows\System\OSTVuOs.exe
  2⤵
  PID:5300
- C:\Windows\System\RwhotgE.exe
  C:\Windows\System\RwhotgE.exe
  2⤵
  PID:5264
- C:\Windows\System\KkHthib.exe
  C:\Windows\System\KkHthib.exe
  2⤵
  PID:5388
- C:\Windows\System\jJVFjCD.exe
  C:\Windows\System\jJVFjCD.exe
  2⤵
  PID:4404
- C:\Windows\System\bedhIYJ.exe
  C:\Windows\System\bedhIYJ.exe
  2⤵
  PID:5408
- C:\Windows\System\QMlhljS.exe
  C:\Windows\System\QMlhljS.exe
  2⤵
  PID:5352
- C:\Windows\System\yjolfGE.exe
  C:\Windows\System\yjolfGE.exe
  2⤵
  PID:5424
- C:\Windows\System\XWadaIW.exe
  C:\Windows\System\XWadaIW.exe
  2⤵
  PID:5504
- C:\Windows\System\ljoozIO.exe
  C:\Windows\System\ljoozIO.exe
  2⤵
  PID:5488
- C:\Windows\System\TLkeyCN.exe
  C:\Windows\System\TLkeyCN.exe
  2⤵
  PID:5564
- C:\Windows\System\BUtwjsI.exe
  C:\Windows\System\BUtwjsI.exe
  2⤵
  PID:5628
- C:\Windows\System\QmSXrSw.exe
  C:\Windows\System\QmSXrSw.exe
  2⤵
  PID:5696
- C:\Windows\System\Ghmuvgg.exe
  C:\Windows\System\Ghmuvgg.exe
  2⤵
  PID:5760
- C:\Windows\System\sGmTZWW.exe
  C:\Windows\System\sGmTZWW.exe
  2⤵
  PID:5800
- C:\Windows\System\OeMUype.exe
  C:\Windows\System\OeMUype.exe
  2⤵
  PID:5520
- C:\Windows\System\dksMKdm.exe
  C:\Windows\System\dksMKdm.exe
  2⤵
  PID:5784
- C:\Windows\System\LoTKkNq.exe
  C:\Windows\System\LoTKkNq.exe
  2⤵
  PID:5864
- C:\Windows\System\mEpqwDZ.exe
  C:\Windows\System\mEpqwDZ.exe
  2⤵
  PID:5812
- C:\Windows\System\sidSufQ.exe
  C:\Windows\System\sidSufQ.exe
  2⤵
  PID:5712
- C:\Windows\System\uxmlmmU.exe
  C:\Windows\System\uxmlmmU.exe
  2⤵
  PID:5816
- C:\Windows\System\vgPXlwg.exe
  C:\Windows\System\vgPXlwg.exe
  2⤵
  PID:5880
- C:\Windows\System\zPBAcNY.exe
  C:\Windows\System\zPBAcNY.exe
  2⤵
  PID:5932
- C:\Windows\System\bNtvHvs.exe
  C:\Windows\System\bNtvHvs.exe
  2⤵
  PID:5916
- C:\Windows\System\kMsBjdR.exe
  C:\Windows\System\kMsBjdR.exe
  2⤵
  PID:6028
- C:\Windows\System\adKnrrw.exe
  C:\Windows\System\adKnrrw.exe
  2⤵
  PID:6008
- C:\Windows\System\xjFUdBN.exe
  C:\Windows\System\xjFUdBN.exe
  2⤵
  PID:6056
- C:\Windows\System\wLxwnkk.exe
  C:\Windows\System\wLxwnkk.exe
  2⤵
  PID:6060
- C:\Windows\System\jVlsYvv.exe
  C:\Windows\System\jVlsYvv.exe
  2⤵
  PID:4676
- C:\Windows\System\zUiiRNH.exe
  C:\Windows\System\zUiiRNH.exe
  2⤵
  PID:5124
- C:\Windows\System\dvkYkSw.exe
  C:\Windows\System\dvkYkSw.exe
  2⤵
  PID:6076
- C:\Windows\System\nDmzIkV.exe
  C:\Windows\System\nDmzIkV.exe
  2⤵
  PID:5144
- C:\Windows\System\OpuIcOO.exe
  C:\Windows\System\OpuIcOO.exe
  2⤵
  PID:4508
- C:\Windows\System\jHfMGWF.exe
  C:\Windows\System\jHfMGWF.exe
  2⤵
  PID:6136
- C:\Windows\System\pHkUxSL.exe
  C:\Windows\System\pHkUxSL.exe
  2⤵
  PID:5180
- C:\Windows\System\ZgREraU.exe
  C:\Windows\System\ZgREraU.exe
  2⤵
  PID:4468
- C:\Windows\System\NrnLNlM.exe
  C:\Windows\System\NrnLNlM.exe
  2⤵
  PID:5148
- C:\Windows\System\fSHERMF.exe
  C:\Windows\System\fSHERMF.exe
  2⤵
  PID:4104
- C:\Windows\System\fXTlyxO.exe
  C:\Windows\System\fXTlyxO.exe
  2⤵
  PID:5276
- C:\Windows\System\AcTIRXv.exe
  C:\Windows\System\AcTIRXv.exe
  2⤵
  PID:5316
- C:\Windows\System\yNwsIVn.exe
  C:\Windows\System\yNwsIVn.exe
  2⤵
  PID:5420
- C:\Windows\System\vCkbJVY.exe
  C:\Windows\System\vCkbJVY.exe
  2⤵
  PID:5244
- C:\Windows\System\cXwEJez.exe
  C:\Windows\System\cXwEJez.exe
  2⤵
  PID:5728
- C:\Windows\System\oydeymR.exe
  C:\Windows\System\oydeymR.exe
  2⤵
  PID:5552
- C:\Windows\System\QTWrKcS.exe
  C:\Windows\System\QTWrKcS.exe
  2⤵
  PID:5308
- C:\Windows\System\BnNOYkM.exe
  C:\Windows\System\BnNOYkM.exe
  2⤵
  PID:5472
- C:\Windows\System\KitWBGZ.exe
  C:\Windows\System\KitWBGZ.exe
  2⤵
  PID:5240
- C:\Windows\System\GKDGtvi.exe
  C:\Windows\System\GKDGtvi.exe
  2⤵
  PID:5660
- C:\Windows\System\IWFinyM.exe
  C:\Windows\System\IWFinyM.exe
  2⤵
  PID:5664
- C:\Windows\System\bUllaWx.exe
  C:\Windows\System\bUllaWx.exe
  2⤵
  PID:5676
- C:\Windows\System\rInFoOS.exe
  C:\Windows\System\rInFoOS.exe
  2⤵
  PID:5744
- C:\Windows\System\UQaaoBk.exe
  C:\Windows\System\UQaaoBk.exe
  2⤵
  PID:5272
- C:\Windows\System\JXWIubf.exe
  C:\Windows\System\JXWIubf.exe
  2⤵
  PID:2772
- C:\Windows\System\NsNDKik.exe
  C:\Windows\System\NsNDKik.exe
  2⤵
  PID:5484
- C:\Windows\System\xxYUDdi.exe
  C:\Windows\System\xxYUDdi.exe
  2⤵
  PID:5584
- C:\Windows\System\GLwBRuU.exe
  C:\Windows\System\GLwBRuU.exe
  2⤵
  PID:4488
- C:\Windows\System\LETWszQ.exe
  C:\Windows\System\LETWszQ.exe
  2⤵
  PID:5184
- C:\Windows\System\YewcCIo.exe
  C:\Windows\System\YewcCIo.exe
  2⤵
  PID:5312
- C:\Windows\System\DHnAYNx.exe
  C:\Windows\System\DHnAYNx.exe
  2⤵
  PID:5284
- C:\Windows\System\tQXLquI.exe
  C:\Windows\System\tQXLquI.exe
  2⤵
  PID:5680
- C:\Windows\System\ywTrVsr.exe
  C:\Windows\System\ywTrVsr.exe
  2⤵
  PID:5884
- C:\Windows\System\THmSizk.exe
  C:\Windows\System\THmSizk.exe
  2⤵
  PID:4796
- C:\Windows\System\JHHkIXD.exe
  C:\Windows\System\JHHkIXD.exe
  2⤵
  PID:6120
- C:\Windows\System\ybTtIAz.exe
  C:\Windows\System\ybTtIAz.exe
  2⤵
  PID:6104
- C:\Windows\System\oXWkSsM.exe
  C:\Windows\System\oXWkSsM.exe
  2⤵
  PID:5944
- C:\Windows\System\anLceZr.exe
  C:\Windows\System\anLceZr.exe
  2⤵
  PID:4908
- C:\Windows\System\lZEKGIg.exe
  C:\Windows\System\lZEKGIg.exe
  2⤵
  PID:4228
- C:\Windows\System\nvkjQWC.exe
  C:\Windows\System\nvkjQWC.exe
  2⤵
  PID:5536
- C:\Windows\System\fcVqvHQ.exe
  C:\Windows\System\fcVqvHQ.exe
  2⤵
  PID:5928
- C:\Windows\System\cnFgsUW.exe
  C:\Windows\System\cnFgsUW.exe
  2⤵
  PID:5828
- C:\Windows\System\xxRefzT.exe
  C:\Windows\System\xxRefzT.exe
  2⤵
  PID:5228
- C:\Windows\System\sBkVCGO.exe
  C:\Windows\System\sBkVCGO.exe
  2⤵
  PID:6040
- C:\Windows\System\JMErYlL.exe
  C:\Windows\System\JMErYlL.exe
  2⤵
  PID:5600
- C:\Windows\System\ZeJjDCj.exe
  C:\Windows\System\ZeJjDCj.exe
  2⤵
  PID:5992
- C:\Windows\System\xHlDNrL.exe
  C:\Windows\System\xHlDNrL.exe
  2⤵
  PID:6160
- C:\Windows\System\hmlSccm.exe
  C:\Windows\System\hmlSccm.exe
  2⤵
  PID:6176
- C:\Windows\System\ynFjHrI.exe
  C:\Windows\System\ynFjHrI.exe
  2⤵
  PID:6200
- C:\Windows\System\KwbqAIc.exe
  C:\Windows\System\KwbqAIc.exe
  2⤵
  PID:6216
- C:\Windows\System\QwSPppM.exe
  C:\Windows\System\QwSPppM.exe
  2⤵
  PID:6232
- C:\Windows\System\zBceJyw.exe
  C:\Windows\System\zBceJyw.exe
  2⤵
  PID:6248
- C:\Windows\System\BTXDgYE.exe
  C:\Windows\System\BTXDgYE.exe
  2⤵
  PID:6264
- C:\Windows\System\LiwOBjy.exe
  C:\Windows\System\LiwOBjy.exe
  2⤵
  PID:6280
- C:\Windows\System\dRqYyhj.exe
  C:\Windows\System\dRqYyhj.exe
  2⤵
  PID:6296
- C:\Windows\System\CbdvUbQ.exe
  C:\Windows\System\CbdvUbQ.exe
  2⤵
  PID:6312
- C:\Windows\System\kbJRMBl.exe
  C:\Windows\System\kbJRMBl.exe
  2⤵
  PID:6328
- C:\Windows\System\nfvMECS.exe
  C:\Windows\System\nfvMECS.exe
  2⤵
  PID:6344
- C:\Windows\System\UZpXvlz.exe
  C:\Windows\System\UZpXvlz.exe
  2⤵
  PID:6360
- C:\Windows\System\tpLxnEl.exe
  C:\Windows\System\tpLxnEl.exe
  2⤵
  PID:6380
- C:\Windows\System\eWPuxTj.exe
  C:\Windows\System\eWPuxTj.exe
  2⤵
  PID:6396
- C:\Windows\System\XWGNMyP.exe
  C:\Windows\System\XWGNMyP.exe
  2⤵
  PID:6412
- C:\Windows\System\kYMqdpW.exe
  C:\Windows\System\kYMqdpW.exe
  2⤵
  PID:6428
- C:\Windows\System\mezCODG.exe
  C:\Windows\System\mezCODG.exe
  2⤵
  PID:6444
- C:\Windows\System\FkNHREN.exe
  C:\Windows\System\FkNHREN.exe
  2⤵
  PID:6460
- C:\Windows\System\gvJGEDc.exe
  C:\Windows\System\gvJGEDc.exe
  2⤵
  PID:6476
- C:\Windows\System\OTdryhh.exe
  C:\Windows\System\OTdryhh.exe
  2⤵
  PID:6496
- C:\Windows\System\zavLUhM.exe
  C:\Windows\System\zavLUhM.exe
  2⤵
  PID:6516
- C:\Windows\System\tnJlSih.exe
  C:\Windows\System\tnJlSih.exe
  2⤵
  PID:6532
- C:\Windows\System\cYbIlGR.exe
  C:\Windows\System\cYbIlGR.exe
  2⤵
  PID:6548
- C:\Windows\System\rtADWgW.exe
  C:\Windows\System\rtADWgW.exe
  2⤵
  PID:6564
- C:\Windows\System\oMrdtrS.exe
  C:\Windows\System\oMrdtrS.exe
  2⤵
  PID:6580
- C:\Windows\System\fmXZrku.exe
  C:\Windows\System\fmXZrku.exe
  2⤵
  PID:6596
- C:\Windows\System\cOtZGxG.exe
  C:\Windows\System\cOtZGxG.exe
  2⤵
  PID:6612
- C:\Windows\System\lHGijOF.exe
  C:\Windows\System\lHGijOF.exe
  2⤵
  PID:6632
- C:\Windows\System\aVBmQyY.exe
  C:\Windows\System\aVBmQyY.exe
  2⤵
  PID:6648
- C:\Windows\System\eULThjp.exe
  C:\Windows\System\eULThjp.exe
  2⤵
  PID:6664
- C:\Windows\System\HTwBlqf.exe
  C:\Windows\System\HTwBlqf.exe
  2⤵
  PID:6680
- C:\Windows\System\DLnpNrl.exe
  C:\Windows\System\DLnpNrl.exe
  2⤵
  PID:6696
- C:\Windows\System\lPgjpKD.exe
  C:\Windows\System\lPgjpKD.exe
  2⤵
  PID:6720
- C:\Windows\System\OCyGyXV.exe
  C:\Windows\System\OCyGyXV.exe
  2⤵
  PID:6736
- C:\Windows\System\fjvsZud.exe
  C:\Windows\System\fjvsZud.exe
  2⤵
  PID:6752
- C:\Windows\System\uGXJNPi.exe
  C:\Windows\System\uGXJNPi.exe
  2⤵
  PID:6768
- C:\Windows\System\opGIbOM.exe
  C:\Windows\System\opGIbOM.exe
  2⤵
  PID:6788
- C:\Windows\System\JMLwekC.exe
  C:\Windows\System\JMLwekC.exe
  2⤵
  PID:6804
- C:\Windows\System\QVOalBe.exe
  C:\Windows\System\QVOalBe.exe
  2⤵
  PID:6828
- C:\Windows\System\pagTFLr.exe
  C:\Windows\System\pagTFLr.exe
  2⤵
  PID:6844
- C:\Windows\System\ZeaoFnG.exe
  C:\Windows\System\ZeaoFnG.exe
  2⤵
  PID:6860
- C:\Windows\System\kZBMCfw.exe
  C:\Windows\System\kZBMCfw.exe
  2⤵
  PID:6876
- C:\Windows\System\dSPELjW.exe
  C:\Windows\System\dSPELjW.exe
  2⤵
  PID:6892
- C:\Windows\System\brIPMxe.exe
  C:\Windows\System\brIPMxe.exe
  2⤵
  PID:6908
- C:\Windows\System\odwOtyn.exe
  C:\Windows\System\odwOtyn.exe
  2⤵
  PID:6924
- C:\Windows\System\EHLNdIo.exe
  C:\Windows\System\EHLNdIo.exe
  2⤵
  PID:6940
- C:\Windows\System\kdKNrVh.exe
  C:\Windows\System\kdKNrVh.exe
  2⤵
  PID:6956
- C:\Windows\System\zDJxplW.exe
  C:\Windows\System\zDJxplW.exe
  2⤵
  PID:6972
- C:\Windows\System\reIFXlt.exe
  C:\Windows\System\reIFXlt.exe
  2⤵
  PID:6988
- C:\Windows\System\wJdhegR.exe
  C:\Windows\System\wJdhegR.exe
  2⤵
  PID:7004
- C:\Windows\System\STuDHur.exe
  C:\Windows\System\STuDHur.exe
  2⤵
  PID:7020
- C:\Windows\System\lRzhllj.exe
  C:\Windows\System\lRzhllj.exe
  2⤵
  PID:7036
- C:\Windows\System\QuXReKq.exe
  C:\Windows\System\QuXReKq.exe
  2⤵
  PID:7052
- C:\Windows\System\MgopMMW.exe
  C:\Windows\System\MgopMMW.exe
  2⤵
  PID:7068
- C:\Windows\System\wMTxUFr.exe
  C:\Windows\System\wMTxUFr.exe
  2⤵
  PID:7084
- C:\Windows\System\pQVKVto.exe
  C:\Windows\System\pQVKVto.exe
  2⤵
  PID:7100
- C:\Windows\System\UkipqaK.exe
  C:\Windows\System\UkipqaK.exe
  2⤵
  PID:7116
- C:\Windows\System\BEQgjDf.exe
  C:\Windows\System\BEQgjDf.exe
  2⤵
  PID:7132
- C:\Windows\System\amShbhX.exe
  C:\Windows\System\amShbhX.exe
  2⤵
  PID:7148
- C:\Windows\System\BaMkSZT.exe
  C:\Windows\System\BaMkSZT.exe
  2⤵
  PID:7164
- C:\Windows\System\ZfIqBca.exe
  C:\Windows\System\ZfIqBca.exe
  2⤵
  PID:5912
- C:\Windows\System\bRAPPVX.exe
  C:\Windows\System\bRAPPVX.exe
  2⤵
  PID:5440
- C:\Windows\System\FxfInql.exe
  C:\Windows\System\FxfInql.exe
  2⤵
  PID:6072
- C:\Windows\System\sKjXpJJ.exe
  C:\Windows\System\sKjXpJJ.exe
  2⤵
  PID:5324
- C:\Windows\System\zuOnpIF.exe
  C:\Windows\System\zuOnpIF.exe
  2⤵
  PID:6192
- C:\Windows\System\HQnFfRC.exe
  C:\Windows\System\HQnFfRC.exe
  2⤵
  PID:6244
- C:\Windows\System\kxTxNAb.exe
  C:\Windows\System\kxTxNAb.exe
  2⤵
  PID:6184
- C:\Windows\System\bqhZStc.exe
  C:\Windows\System\bqhZStc.exe
  2⤵
  PID:6188
- C:\Windows\System\inHpean.exe
  C:\Windows\System\inHpean.exe
  2⤵
  PID:6376
- C:\Windows\System\JJYdYDa.exe
  C:\Windows\System\JJYdYDa.exe
  2⤵
  PID:6404
- C:\Windows\System\VrhgrXM.exe
  C:\Windows\System\VrhgrXM.exe
  2⤵
  PID:6256
- C:\Windows\System\uPpAWvx.exe
  C:\Windows\System\uPpAWvx.exe
  2⤵
  PID:6324
- C:\Windows\System\NWiOQmv.exe
  C:\Windows\System\NWiOQmv.exe
  2⤵
  PID:6392
- C:\Windows\System\sBjSqKP.exe
  C:\Windows\System\sBjSqKP.exe
  2⤵
  PID:6468
- C:\Windows\System\IBxYHvk.exe
  C:\Windows\System\IBxYHvk.exe
  2⤵
  PID:6540
- C:\Windows\System\Ljxemmw.exe
  C:\Windows\System\Ljxemmw.exe
  2⤵
  PID:6044
- C:\Windows\System\XNpsEHr.exe
  C:\Windows\System\XNpsEHr.exe
  2⤵
  PID:6488
- C:\Windows\System\UbUDlpy.exe
  C:\Windows\System\UbUDlpy.exe
  2⤵
  PID:6560
- C:\Windows\System\rHxstif.exe
  C:\Windows\System\rHxstif.exe
  2⤵
  PID:6640
- C:\Windows\System\EjFDQFq.exe
  C:\Windows\System\EjFDQFq.exe
  2⤵
  PID:6704
- C:\Windows\System\NLHwICT.exe
  C:\Windows\System\NLHwICT.exe
  2⤵
  PID:6744
- C:\Windows\System\jrxjbnZ.exe
  C:\Windows\System\jrxjbnZ.exe
  2⤵
  PID:6784
- C:\Windows\System\NfJJRpB.exe
  C:\Windows\System\NfJJRpB.exe
  2⤵
  PID:6852
- C:\Windows\System\WjTvYLT.exe
  C:\Windows\System\WjTvYLT.exe
  2⤵
  PID:6916
- C:\Windows\System\OuzrMNx.exe
  C:\Windows\System\OuzrMNx.exe
  2⤵
  PID:6980
- C:\Windows\System\lPmCxCP.exe
  C:\Windows\System\lPmCxCP.exe
  2⤵
  PID:7044
- C:\Windows\System\cIPpNDK.exe
  C:\Windows\System\cIPpNDK.exe
  2⤵
  PID:7112
- C:\Windows\System\aJapxPo.exe
  C:\Windows\System\aJapxPo.exe
  2⤵
  PID:4820
- C:\Windows\System\PTecGFq.exe
  C:\Windows\System\PTecGFq.exe
  2⤵
  PID:6624
- C:\Windows\System\PCmPZZR.exe
  C:\Windows\System\PCmPZZR.exe
  2⤵
  PID:6620
- C:\Windows\System\qMdmqdb.exe
  C:\Windows\System\qMdmqdb.exe
  2⤵
  PID:6692
- C:\Windows\System\WQtplFV.exe
  C:\Windows\System\WQtplFV.exe
  2⤵
  PID:6868
- C:\Windows\System\ONeeUrD.exe
  C:\Windows\System\ONeeUrD.exe
  2⤵
  PID:6932
- C:\Windows\System\yaTFcCr.exe
  C:\Windows\System\yaTFcCr.exe
  2⤵
  PID:6996
- C:\Windows\System\yQPERKg.exe
  C:\Windows\System\yQPERKg.exe
  2⤵
  PID:7060
- C:\Windows\System\iMIJvgy.exe
  C:\Windows\System\iMIJvgy.exe
  2⤵
  PID:7124
- C:\Windows\System\zPEQHum.exe
  C:\Windows\System\zPEQHum.exe
  2⤵
  PID:4972
- C:\Windows\System\KJGHqhu.exe
  C:\Windows\System\KJGHqhu.exe
  2⤵
  PID:6152
- C:\Windows\System\nZLtITl.exe
  C:\Windows\System\nZLtITl.exe
  2⤵
  PID:6148
- C:\Windows\System\RKsprng.exe
  C:\Windows\System\RKsprng.exe
  2⤵
  PID:6356
- C:\Windows\System\xXhQqDk.exe
  C:\Windows\System\xXhQqDk.exe
  2⤵
  PID:6512
- C:\Windows\System\WlaFrDf.exe
  C:\Windows\System\WlaFrDf.exe
  2⤵
  PID:6712
- C:\Windows\System\HHDstiB.exe
  C:\Windows\System\HHDstiB.exe
  2⤵
  PID:6948
- C:\Windows\System\IxDVhzq.exe
  C:\Windows\System\IxDVhzq.exe
  2⤵
  PID:7076
- C:\Windows\System\DiFNppf.exe
  C:\Windows\System\DiFNppf.exe
  2⤵
  PID:6212
- C:\Windows\System\KAHWXaD.exe
  C:\Windows\System\KAHWXaD.exe
  2⤵
  PID:6228
- C:\Windows\System\OvYLXNk.exe
  C:\Windows\System\OvYLXNk.exe
  2⤵
  PID:6556
- C:\Windows\System\DREfKMU.exe
  C:\Windows\System\DREfKMU.exe
  2⤵
  PID:1720
- C:\Windows\System\drzcino.exe
  C:\Windows\System\drzcino.exe
  2⤵
  PID:6836
- C:\Windows\System\EhVTZos.exe
  C:\Windows\System\EhVTZos.exe
  2⤵
  PID:7160
- C:\Windows\System\DNvaFpx.exe
  C:\Windows\System\DNvaFpx.exe
  2⤵
  PID:6156
- C:\Windows\System\wlMWNCf.exe
  C:\Windows\System\wlMWNCf.exe
  2⤵
  PID:7012
- C:\Windows\System\eWzCyhy.exe
  C:\Windows\System\eWzCyhy.exe
  2⤵
  PID:6372
- C:\Windows\System\VCybnes.exe
  C:\Windows\System\VCybnes.exe
  2⤵
  PID:6504
- C:\Windows\System\FpPYYih.exe
  C:\Windows\System\FpPYYih.exe
  2⤵
  PID:6388
- C:\Windows\System\wXSTMls.exe
  C:\Windows\System\wXSTMls.exe
  2⤵
  PID:6884
- C:\Windows\System\gyeKNyI.exe
  C:\Windows\System\gyeKNyI.exe
  2⤵
  PID:6888
- C:\Windows\System\EsQhVsY.exe
  C:\Windows\System\EsQhVsY.exe
  2⤵
  PID:7092
- C:\Windows\System\ixDWtwG.exe
  C:\Windows\System\ixDWtwG.exe
  2⤵
  PID:6656
- C:\Windows\System\aVrOMiw.exe
  C:\Windows\System\aVrOMiw.exe
  2⤵
  PID:6572
- C:\Windows\System\CYaaKew.exe
  C:\Windows\System\CYaaKew.exe
  2⤵
  PID:6764
- C:\Windows\System\TPbbzdP.exe
  C:\Windows\System\TPbbzdP.exe
  2⤵
  PID:6732
- C:\Windows\System\dIwpoyP.exe
  C:\Windows\System\dIwpoyP.exe
  2⤵
  PID:7108
- C:\Windows\System\TXfLKpk.exe
  C:\Windows\System\TXfLKpk.exe
  2⤵
  PID:6840
- C:\Windows\System\sibIhgD.exe
  C:\Windows\System\sibIhgD.exe
  2⤵
  PID:7156
- C:\Windows\System\yUFzCOj.exe
  C:\Windows\System\yUFzCOj.exe
  2⤵
  PID:6800
- C:\Windows\System\GAAivxM.exe
  C:\Windows\System\GAAivxM.exe
  2⤵
  PID:6604
- C:\Windows\System\ICvmJqq.exe
  C:\Windows\System\ICvmJqq.exe
  2⤵
  PID:6676
- C:\Windows\System\NBlfbQb.exe
  C:\Windows\System\NBlfbQb.exe
  2⤵
  PID:6288
- C:\Windows\System\CFwAEet.exe
  C:\Windows\System\CFwAEet.exe
  2⤵
  PID:7080
- C:\Windows\System\FUzAHMR.exe
  C:\Windows\System\FUzAHMR.exe
  2⤵
  PID:6968
- C:\Windows\System\togjsEC.exe
  C:\Windows\System\togjsEC.exe
  2⤵
  PID:7176
- C:\Windows\System\EmSunoc.exe
  C:\Windows\System\EmSunoc.exe
  2⤵
  PID:7192
- C:\Windows\System\qxSifxb.exe
  C:\Windows\System\qxSifxb.exe
  2⤵
  PID:7208
- C:\Windows\System\GFejZSM.exe
  C:\Windows\System\GFejZSM.exe
  2⤵
  PID:7224
- C:\Windows\System\jwRwduf.exe
  C:\Windows\System\jwRwduf.exe
  2⤵
  PID:7240
- C:\Windows\System\dnqlDWF.exe
  C:\Windows\System\dnqlDWF.exe
  2⤵
  PID:7256
- C:\Windows\System\vkVIoFy.exe
  C:\Windows\System\vkVIoFy.exe
  2⤵
  PID:7272
- C:\Windows\System\dlQPodp.exe
  C:\Windows\System\dlQPodp.exe
  2⤵
  PID:7288
- C:\Windows\System\dJZjSmm.exe
  C:\Windows\System\dJZjSmm.exe
  2⤵
  PID:7304
- C:\Windows\System\DyaJdMD.exe
  C:\Windows\System\DyaJdMD.exe
  2⤵
  PID:7320
- C:\Windows\System\TNLWsgX.exe
  C:\Windows\System\TNLWsgX.exe
  2⤵
  PID:7336
- C:\Windows\System\tNkAnNp.exe
  C:\Windows\System\tNkAnNp.exe
  2⤵
  PID:7352
- C:\Windows\System\ZArLlmD.exe
  C:\Windows\System\ZArLlmD.exe
  2⤵
  PID:7368
- C:\Windows\System\sOwwchI.exe
  C:\Windows\System\sOwwchI.exe
  2⤵
  PID:7388
- C:\Windows\System\TypQtIz.exe
  C:\Windows\System\TypQtIz.exe
  2⤵
  PID:7404
- C:\Windows\System\PqHIozx.exe
  C:\Windows\System\PqHIozx.exe
  2⤵
  PID:7420
- C:\Windows\System\MbgfWKD.exe
  C:\Windows\System\MbgfWKD.exe
  2⤵
  PID:7436
- C:\Windows\System\cJaNBKD.exe
  C:\Windows\System\cJaNBKD.exe
  2⤵
  PID:7452
- C:\Windows\System\RadFcGJ.exe
  C:\Windows\System\RadFcGJ.exe
  2⤵
  PID:7468
- C:\Windows\System\yRnzJDp.exe
  C:\Windows\System\yRnzJDp.exe
  2⤵
  PID:7484
- C:\Windows\System\lDhemJx.exe
  C:\Windows\System\lDhemJx.exe
  2⤵
  PID:7500
- C:\Windows\System\jbeKuTX.exe
  C:\Windows\System\jbeKuTX.exe
  2⤵
  PID:7516
- C:\Windows\System\xdQbkTq.exe
  C:\Windows\System\xdQbkTq.exe
  2⤵
  PID:7536
- C:\Windows\System\BkHONGv.exe
  C:\Windows\System\BkHONGv.exe
  2⤵
  PID:7552
- C:\Windows\System\uxgNLLT.exe
  C:\Windows\System\uxgNLLT.exe
  2⤵
  PID:7568
- C:\Windows\System\UlEigDP.exe
  C:\Windows\System\UlEigDP.exe
  2⤵
  PID:7584
- C:\Windows\System\fSpKJhB.exe
  C:\Windows\System\fSpKJhB.exe
  2⤵
  PID:7600
- C:\Windows\System\PihVOfW.exe
  C:\Windows\System\PihVOfW.exe
  2⤵
  PID:7616
- C:\Windows\System\yQvAruA.exe
  C:\Windows\System\yQvAruA.exe
  2⤵
  PID:7632
- C:\Windows\System\dAmjPPH.exe
  C:\Windows\System\dAmjPPH.exe
  2⤵
  PID:7648
- C:\Windows\System\oIhgPVQ.exe
  C:\Windows\System\oIhgPVQ.exe
  2⤵
  PID:7668
- C:\Windows\System\jpQJiNq.exe
  C:\Windows\System\jpQJiNq.exe
  2⤵
  PID:7684
- C:\Windows\System\qntGtxN.exe
  C:\Windows\System\qntGtxN.exe
  2⤵
  PID:7700
- C:\Windows\System\cSoNJae.exe
  C:\Windows\System\cSoNJae.exe
  2⤵
  PID:7716
- C:\Windows\System\zcfKwuc.exe
  C:\Windows\System\zcfKwuc.exe
  2⤵
  PID:7736
- C:\Windows\System\lxfoZql.exe
  C:\Windows\System\lxfoZql.exe
  2⤵
  PID:7752
- C:\Windows\System\DvgirAG.exe
  C:\Windows\System\DvgirAG.exe
  2⤵
  PID:7792
- C:\Windows\System\pMllHjX.exe
  C:\Windows\System\pMllHjX.exe
  2⤵
  PID:7812
- C:\Windows\System\OicxECc.exe
  C:\Windows\System\OicxECc.exe
  2⤵
  PID:7828
- C:\Windows\System\ECqSJHd.exe
  C:\Windows\System\ECqSJHd.exe
  2⤵
  PID:7848
- C:\Windows\System\HvEcgRX.exe
  C:\Windows\System\HvEcgRX.exe
  2⤵
  PID:7864
- C:\Windows\System\smqrwDP.exe
  C:\Windows\System\smqrwDP.exe
  2⤵
  PID:7980
- C:\Windows\System\usVkLhc.exe
  C:\Windows\System\usVkLhc.exe
  2⤵
  PID:7996
- C:\Windows\System\NUnJnDu.exe
  C:\Windows\System\NUnJnDu.exe
  2⤵
  PID:8012
- C:\Windows\System\JZmOLin.exe
  C:\Windows\System\JZmOLin.exe
  2⤵
  PID:8028
- C:\Windows\System\GELSMwT.exe
  C:\Windows\System\GELSMwT.exe
  2⤵
  PID:8044
- C:\Windows\System\cvQPKWU.exe
  C:\Windows\System\cvQPKWU.exe
  2⤵
  PID:8060
- C:\Windows\System\KoSseSk.exe
  C:\Windows\System\KoSseSk.exe
  2⤵
  PID:8080
- C:\Windows\System\uOsDLUi.exe
  C:\Windows\System\uOsDLUi.exe
  2⤵
  PID:8096
- C:\Windows\System\rhaIJlH.exe
  C:\Windows\System\rhaIJlH.exe
  2⤵
  PID:8112
- C:\Windows\System\YZRoBIi.exe
  C:\Windows\System\YZRoBIi.exe
  2⤵
  PID:8128
- C:\Windows\System\hqCtcxV.exe
  C:\Windows\System\hqCtcxV.exe
  2⤵
  PID:8144
- C:\Windows\System\fYUdlmT.exe
  C:\Windows\System\fYUdlmT.exe
  2⤵
  PID:8160
- C:\Windows\System\gOnRtGj.exe
  C:\Windows\System\gOnRtGj.exe
  2⤵
  PID:8176
- C:\Windows\System\fjqTERR.exe
  C:\Windows\System\fjqTERR.exe
  2⤵
  PID:4208
- C:\Windows\System\ozVVQOb.exe
  C:\Windows\System\ozVVQOb.exe
  2⤵
  PID:7188
- C:\Windows\System\AUVfzTe.exe
  C:\Windows\System\AUVfzTe.exe
  2⤵
  PID:6320
- C:\Windows\System\GIfAWzW.exe
  C:\Windows\System\GIfAWzW.exe
  2⤵
  PID:7252
- C:\Windows\System\SdsiDOu.exe
  C:\Windows\System\SdsiDOu.exe
  2⤵
  PID:7236
- C:\Windows\System\zocplxy.exe
  C:\Windows\System\zocplxy.exe
  2⤵
  PID:7312
- C:\Windows\System\ctFRLzv.exe
  C:\Windows\System\ctFRLzv.exe
  2⤵
  PID:7376
- C:\Windows\System\zdZuVpo.exe
  C:\Windows\System\zdZuVpo.exe
  2⤵
  PID:7416
- C:\Windows\System\cDxEJRq.exe
  C:\Windows\System\cDxEJRq.exe
  2⤵
  PID:7448
- C:\Windows\System\ExhyhoT.exe
  C:\Windows\System\ExhyhoT.exe
  2⤵
  PID:7396
- C:\Windows\System\SajzWZN.exe
  C:\Windows\System\SajzWZN.exe
  2⤵
  PID:7400
- C:\Windows\System\UtIzkEe.exe
  C:\Windows\System\UtIzkEe.exe
  2⤵
  PID:7508
- C:\Windows\System\MaCmFwX.exe
  C:\Windows\System\MaCmFwX.exe
  2⤵
  PID:7460
- C:\Windows\System\NYSXLqp.exe
  C:\Windows\System\NYSXLqp.exe
  2⤵
  PID:7496
- C:\Windows\System\Euaqetk.exe
  C:\Windows\System\Euaqetk.exe
  2⤵
  PID:7564
- C:\Windows\System\ayTOlfk.exe
  C:\Windows\System\ayTOlfk.exe
  2⤵
  PID:7608
- C:\Windows\System\BjuAIzI.exe
  C:\Windows\System\BjuAIzI.exe
  2⤵
  PID:7596
- C:\Windows\System\IahFzjO.exe
  C:\Windows\System\IahFzjO.exe
  2⤵
  PID:7660
- C:\Windows\System\lTgMzQe.exe
  C:\Windows\System\lTgMzQe.exe
  2⤵
  PID:7696
- C:\Windows\System\amHynfM.exe
  C:\Windows\System\amHynfM.exe
  2⤵
  PID:7680
- C:\Windows\System\rtHlWHZ.exe
  C:\Windows\System\rtHlWHZ.exe
  2⤵
  PID:7764
- C:\Windows\System\mmWhuqJ.exe
  C:\Windows\System\mmWhuqJ.exe
  2⤵
  PID:7776
- C:\Windows\System\HnjOIGP.exe
  C:\Windows\System\HnjOIGP.exe
  2⤵
  PID:7808
- C:\Windows\System\nLzcIpo.exe
  C:\Windows\System\nLzcIpo.exe
  2⤵
  PID:7820
- C:\Windows\System\aCQDzwi.exe
  C:\Windows\System\aCQDzwi.exe
  2⤵
  PID:7824
- C:\Windows\System\NPvpSBt.exe
  C:\Windows\System\NPvpSBt.exe
  2⤵
  PID:7880
- C:\Windows\System\RTIBKPx.exe
  C:\Windows\System\RTIBKPx.exe
  2⤵
  PID:7896
- C:\Windows\System\IxtAjWj.exe
  C:\Windows\System\IxtAjWj.exe
  2⤵
  PID:7916
- C:\Windows\System\ieNkheT.exe
  C:\Windows\System\ieNkheT.exe
  2⤵
  PID:7936
- C:\Windows\System\fDeWOBW.exe
  C:\Windows\System\fDeWOBW.exe
  2⤵
  PID:7944
- C:\Windows\System\xjyPDwK.exe
  C:\Windows\System\xjyPDwK.exe
  2⤵
  PID:7960
- C:\Windows\System\sWxYIBD.exe
  C:\Windows\System\sWxYIBD.exe
  2⤵
  PID:7976
- C:\Windows\System\zNDrUQx.exe
  C:\Windows\System\zNDrUQx.exe
  2⤵
  PID:7988
- C:\Windows\System\IrWpGHn.exe
  C:\Windows\System\IrWpGHn.exe
  2⤵
  PID:8072
- C:\Windows\System\AOKudWO.exe
  C:\Windows\System\AOKudWO.exe
  2⤵
  PID:8024
- C:\Windows\System\uiYgRsh.exe
  C:\Windows\System\uiYgRsh.exe
  2⤵
  PID:8104
- C:\Windows\System\BAtLlXK.exe
  C:\Windows\System\BAtLlXK.exe
  2⤵
  PID:8168
- C:\Windows\System\ynsagLu.exe
  C:\Windows\System\ynsagLu.exe
  2⤵
  PID:7172
- C:\Windows\System\rpQWXjo.exe
  C:\Windows\System\rpQWXjo.exe
  2⤵
  PID:7284
- C:\Windows\System\oIRWlvp.exe
  C:\Windows\System\oIRWlvp.exe
  2⤵
  PID:7296
- C:\Windows\System\CAEbxrP.exe
  C:\Windows\System\CAEbxrP.exe
  2⤵
  PID:7492
- C:\Windows\System\AMTVzYK.exe
  C:\Windows\System\AMTVzYK.exe
  2⤵
  PID:7464
- C:\Windows\System\RzNhHxn.exe
  C:\Windows\System\RzNhHxn.exe
  2⤵
  PID:7232
- C:\Windows\System\KdaIlfx.exe
  C:\Windows\System\KdaIlfx.exe
  2⤵
  PID:1496
- C:\Windows\System\pdONetM.exe
  C:\Windows\System\pdONetM.exe
  2⤵
  PID:7664
- C:\Windows\System\CsXkqzL.exe
  C:\Windows\System\CsXkqzL.exe
  2⤵
  PID:7144
- C:\Windows\System\rKLPkZN.exe
  C:\Windows\System\rKLPkZN.exe
  2⤵
  PID:7300
- C:\Windows\System\YpHMQxD.exe
  C:\Windows\System\YpHMQxD.exe
  2⤵
  PID:7676
- C:\Windows\System\BFlBlMO.exe
  C:\Windows\System\BFlBlMO.exe
  2⤵
  PID:7732
- C:\Windows\System\nXFMOxC.exe
  C:\Windows\System\nXFMOxC.exe
  2⤵
  PID:7840
- C:\Windows\System\QJbyHks.exe
  C:\Windows\System\QJbyHks.exe
  2⤵
  PID:7860
- C:\Windows\System\yoVvaBP.exe
  C:\Windows\System\yoVvaBP.exe
  2⤵
  PID:7904
- C:\Windows\System\YJicguv.exe
  C:\Windows\System\YJicguv.exe
  2⤵
  PID:7968
- C:\Windows\System\NrMZSDk.exe
  C:\Windows\System\NrMZSDk.exe
  2⤵
  PID:7888
- C:\Windows\System\LnRUYrP.exe
  C:\Windows\System\LnRUYrP.exe
  2⤵
  PID:7412
- C:\Windows\System\mVZOMjn.exe
  C:\Windows\System\mVZOMjn.exe
  2⤵
  PID:8152
- C:\Windows\System\GNocdFS.exe
  C:\Windows\System\GNocdFS.exe
  2⤵
  PID:8140
- C:\Windows\System\KCWDMby.exe
  C:\Windows\System\KCWDMby.exe
  2⤵
  PID:8036
- C:\Windows\System\OUrHHsD.exe
  C:\Windows\System\OUrHHsD.exe
  2⤵
  PID:7532
- C:\Windows\System\EFVwQlw.exe
  C:\Windows\System\EFVwQlw.exe
  2⤵
  PID:8188
- C:\Windows\System\GgQaAoH.exe
  C:\Windows\System\GgQaAoH.exe
  2⤵
  PID:7348
- C:\Windows\System\gHZwnof.exe
  C:\Windows\System\gHZwnof.exe
  2⤵
  PID:7692
- C:\Windows\System\dppHAbS.exe
  C:\Windows\System\dppHAbS.exe
  2⤵
  PID:7908
- C:\Windows\System\nNmUCeN.exe
  C:\Windows\System\nNmUCeN.exe
  2⤵
  PID:7612
- C:\Windows\System\tPQcmrJ.exe
  C:\Windows\System\tPQcmrJ.exe
  2⤵
  PID:7360
- C:\Windows\System\ncHMDLz.exe
  C:\Windows\System\ncHMDLz.exe
  2⤵
  PID:7220
- C:\Windows\System\fRTBYnH.exe
  C:\Windows\System\fRTBYnH.exe
  2⤵
  PID:8076
- C:\Windows\System\zHxkPXn.exe
  C:\Windows\System\zHxkPXn.exe
  2⤵
  PID:7344
- C:\Windows\System\actQqfN.exe
  C:\Windows\System\actQqfN.exe
  2⤵
  PID:6424
- C:\Windows\System\aHQRXYR.exe
  C:\Windows\System\aHQRXYR.exe
  2⤵
  PID:8196
- C:\Windows\System\pVcPHNs.exe
  C:\Windows\System\pVcPHNs.exe
  2⤵
  PID:8212
- C:\Windows\System\yIQsdFJ.exe
  C:\Windows\System\yIQsdFJ.exe
  2⤵
  PID:8228
- C:\Windows\System\xUuJjGw.exe
  C:\Windows\System\xUuJjGw.exe
  2⤵
  PID:8244
- C:\Windows\System\nBJSJcB.exe
  C:\Windows\System\nBJSJcB.exe
  2⤵
  PID:8260
- C:\Windows\System\JhZEZMe.exe
  C:\Windows\System\JhZEZMe.exe
  2⤵
  PID:8276
- C:\Windows\System\oHOWKem.exe
  C:\Windows\System\oHOWKem.exe
  2⤵
  PID:8292
- C:\Windows\System\rXXdVXg.exe
  C:\Windows\System\rXXdVXg.exe
  2⤵
  PID:8308
- C:\Windows\System\vayMfZQ.exe
  C:\Windows\System\vayMfZQ.exe
  2⤵
  PID:8324
- C:\Windows\System\PDREfoF.exe
  C:\Windows\System\PDREfoF.exe
  2⤵
  PID:8340
- C:\Windows\System\HUFPhXa.exe
  C:\Windows\System\HUFPhXa.exe
  2⤵
  PID:8356
- C:\Windows\System\JCTwsKP.exe
  C:\Windows\System\JCTwsKP.exe
  2⤵
  PID:8372
- C:\Windows\System\erHTBpL.exe
  C:\Windows\System\erHTBpL.exe
  2⤵
  PID:8388
- C:\Windows\System\gJfPgYY.exe
  C:\Windows\System\gJfPgYY.exe
  2⤵
  PID:8404
- C:\Windows\System\HbgVNAL.exe
  C:\Windows\System\HbgVNAL.exe
  2⤵
  PID:8420
- C:\Windows\System\PkJLCyG.exe
  C:\Windows\System\PkJLCyG.exe
  2⤵
  PID:8436
- C:\Windows\System\mAgwBpG.exe
  C:\Windows\System\mAgwBpG.exe
  2⤵
  PID:8452
- C:\Windows\System\FkxFPTy.exe
  C:\Windows\System\FkxFPTy.exe
  2⤵
  PID:8468
- C:\Windows\System\wGTLhEQ.exe
  C:\Windows\System\wGTLhEQ.exe
  2⤵
  PID:8484
- C:\Windows\System\zdyOrNb.exe
  C:\Windows\System\zdyOrNb.exe
  2⤵
  PID:8500
- C:\Windows\System\RScODzV.exe
  C:\Windows\System\RScODzV.exe
  2⤵
  PID:8516
- C:\Windows\System\xcEJiXw.exe
  C:\Windows\System\xcEJiXw.exe
  2⤵
  PID:8532
- C:\Windows\System\XFQEJLB.exe
  C:\Windows\System\XFQEJLB.exe
  2⤵
  PID:8548
- C:\Windows\System\AgHitqU.exe
  C:\Windows\System\AgHitqU.exe
  2⤵
  PID:8564
- C:\Windows\System\jocjvFo.exe
  C:\Windows\System\jocjvFo.exe
  2⤵
  PID:8580
- C:\Windows\System\pRpiyPv.exe
  C:\Windows\System\pRpiyPv.exe
  2⤵
  PID:8600
- C:\Windows\System\VvJEEDr.exe
  C:\Windows\System\VvJEEDr.exe
  2⤵
  PID:8616
- C:\Windows\System\WpVxEfd.exe
  C:\Windows\System\WpVxEfd.exe
  2⤵
  PID:8632
- C:\Windows\System\QgHgKYO.exe
  C:\Windows\System\QgHgKYO.exe
  2⤵
  PID:8648
- C:\Windows\System\RMYgNHz.exe
  C:\Windows\System\RMYgNHz.exe
  2⤵
  PID:8664
- C:\Windows\System\qmRbvkE.exe
  C:\Windows\System\qmRbvkE.exe
  2⤵
  PID:8680
- C:\Windows\System\gEWGkKr.exe
  C:\Windows\System\gEWGkKr.exe
  2⤵
  PID:8696
- C:\Windows\System\dFahSgc.exe
  C:\Windows\System\dFahSgc.exe
  2⤵
  PID:8712
- C:\Windows\System\kdyzVtF.exe
  C:\Windows\System\kdyzVtF.exe
  2⤵
  PID:8728
- C:\Windows\System\fuKTPHC.exe
  C:\Windows\System\fuKTPHC.exe
  2⤵
  PID:8744
- C:\Windows\System\OgjWovl.exe
  C:\Windows\System\OgjWovl.exe
  2⤵
  PID:8760
- C:\Windows\System\VxYbCet.exe
  C:\Windows\System\VxYbCet.exe
  2⤵
  PID:8776
- C:\Windows\System\ETBESra.exe
  C:\Windows\System\ETBESra.exe
  2⤵
  PID:8792
- C:\Windows\System\iAMvlCm.exe
  C:\Windows\System\iAMvlCm.exe
  2⤵
  PID:8812
- C:\Windows\System\sACQIMV.exe
  C:\Windows\System\sACQIMV.exe
  2⤵
  PID:8832
- C:\Windows\System\FCDaATf.exe
  C:\Windows\System\FCDaATf.exe
  2⤵
  PID:8848
- C:\Windows\System\IsDSTec.exe
  C:\Windows\System\IsDSTec.exe
  2⤵
  PID:8864
- C:\Windows\System\fvibPPX.exe
  C:\Windows\System\fvibPPX.exe
  2⤵
  PID:8880
- C:\Windows\System\GcCmAhe.exe
  C:\Windows\System\GcCmAhe.exe
  2⤵
  PID:8900
- C:\Windows\System\OiKdpfW.exe
  C:\Windows\System\OiKdpfW.exe
  2⤵
  PID:8924
- C:\Windows\System\RTSCOla.exe
  C:\Windows\System\RTSCOla.exe
  2⤵
  PID:8940
- C:\Windows\System\jnIAYmR.exe
  C:\Windows\System\jnIAYmR.exe
  2⤵
  PID:8956
- C:\Windows\System\aZNsozm.exe
  C:\Windows\System\aZNsozm.exe
  2⤵
  PID:8972
- C:\Windows\System\cLvGdxU.exe
  C:\Windows\System\cLvGdxU.exe
  2⤵
  PID:8988
- C:\Windows\System\lLZGMXS.exe
  C:\Windows\System\lLZGMXS.exe
  2⤵
  PID:9008
- C:\Windows\System\WTgkbrn.exe
  C:\Windows\System\WTgkbrn.exe
  2⤵
  PID:9024
- C:\Windows\System\vzlCBVq.exe
  C:\Windows\System\vzlCBVq.exe
  2⤵
  PID:9040
- C:\Windows\System\grdFQbv.exe
  C:\Windows\System\grdFQbv.exe
  2⤵
  PID:9060
- C:\Windows\System\trtVjHx.exe
  C:\Windows\System\trtVjHx.exe
  2⤵
  PID:9076
- C:\Windows\System\BtjpdQi.exe
  C:\Windows\System\BtjpdQi.exe
  2⤵
  PID:9092
- C:\Windows\System\wKRwpQc.exe
  C:\Windows\System\wKRwpQc.exe
  2⤵
  PID:9116
- C:\Windows\System\BdEBnpC.exe
  C:\Windows\System\BdEBnpC.exe
  2⤵
  PID:9132
- C:\Windows\System\kYFoGQJ.exe
  C:\Windows\System\kYFoGQJ.exe
  2⤵
  PID:9148
- C:\Windows\System\KnjziKm.exe
  C:\Windows\System\KnjziKm.exe
  2⤵
  PID:9164
- C:\Windows\System\qfVmhnS.exe
  C:\Windows\System\qfVmhnS.exe
  2⤵
  PID:9184
- C:\Windows\System\kseNYcy.exe
  C:\Windows\System\kseNYcy.exe
  2⤵
  PID:9200
- C:\Windows\System\JiZTJKN.exe
  C:\Windows\System\JiZTJKN.exe
  2⤵
  PID:7876
- C:\Windows\System\WhUmhWZ.exe
  C:\Windows\System\WhUmhWZ.exe
  2⤵
  PID:7480
- C:\Windows\System\vBTNggk.exe
  C:\Windows\System\vBTNggk.exe
  2⤵
  PID:7744
- C:\Windows\System\jroORch.exe
  C:\Windows\System\jroORch.exe
  2⤵
  PID:7748
- C:\Windows\System\PQZfbPw.exe
  C:\Windows\System\PQZfbPw.exe
  2⤵
  PID:8240
- C:\Windows\System\OJXxHqa.exe
  C:\Windows\System\OJXxHqa.exe
  2⤵
  PID:8268
- C:\Windows\System\ceqrqVQ.exe
  C:\Windows\System\ceqrqVQ.exe
  2⤵
  PID:8224
- C:\Windows\System\yrPugBP.exe
  C:\Windows\System\yrPugBP.exe
  2⤵
  PID:8252
- C:\Windows\System\CXPyIlc.exe
  C:\Windows\System\CXPyIlc.exe
  2⤵
  PID:8380
- C:\Windows\System\KGbyZaQ.exe
  C:\Windows\System\KGbyZaQ.exe
  2⤵
  PID:8448
- C:\Windows\System\KNOLcrv.exe
  C:\Windows\System\KNOLcrv.exe
  2⤵
  PID:8444
- C:\Windows\System\YoxunBM.exe
  C:\Windows\System\YoxunBM.exe
  2⤵
  PID:8396
- C:\Windows\System\yCKxiLt.exe
  C:\Windows\System\yCKxiLt.exe
  2⤵
  PID:8460
- C:\Windows\System\cnVXfnH.exe
  C:\Windows\System\cnVXfnH.exe
  2⤵
  PID:8492
- C:\Windows\System\Ygsuwsb.exe
  C:\Windows\System\Ygsuwsb.exe
  2⤵
  PID:8560
- C:\Windows\System\aBrjynj.exe
  C:\Windows\System\aBrjynj.exe
  2⤵
  PID:8572
- C:\Windows\System\WvyHCeT.exe
  C:\Windows\System\WvyHCeT.exe
  2⤵
  PID:8676
- C:\Windows\System\vwcZIfc.exe
  C:\Windows\System\vwcZIfc.exe
  2⤵
  PID:8692
- C:\Windows\System\IhRQdNW.exe
  C:\Windows\System\IhRQdNW.exe
  2⤵
  PID:8624
- C:\Windows\System\QBGPEyt.exe
  C:\Windows\System\QBGPEyt.exe
  2⤵
  PID:8736
- C:\Windows\System\YYUuQIq.exe
  C:\Windows\System\YYUuQIq.exe
  2⤵
  PID:8804
- C:\Windows\System\NEORlEE.exe
  C:\Windows\System\NEORlEE.exe
  2⤵
  PID:8840
- C:\Windows\System\nRVzfJO.exe
  C:\Windows\System\nRVzfJO.exe
  2⤵
  PID:8752
- C:\Windows\System\gfrJeOk.exe
  C:\Windows\System\gfrJeOk.exe
  2⤵
  PID:8788
- C:\Windows\System\LkEliMh.exe
  C:\Windows\System\LkEliMh.exe
  2⤵
  PID:8908
- C:\Windows\System\hxTxIHs.exe
  C:\Windows\System\hxTxIHs.exe
  2⤵
  PID:9100
- C:\Windows\System\KlmXbKN.exe
  C:\Windows\System\KlmXbKN.exe
  2⤵
  PID:9128
- C:\Windows\System\tBbEyco.exe
  C:\Windows\System\tBbEyco.exe
  2⤵
  PID:9192
- C:\Windows\System\eOZRbKk.exe
  C:\Windows\System\eOZRbKk.exe
  2⤵
  PID:8204
- C:\Windows\System\rmCMkaz.exe
  C:\Windows\System\rmCMkaz.exe
  2⤵
  PID:8300
- C:\Windows\System\RpqMZsL.exe
  C:\Windows\System\RpqMZsL.exe
  2⤵
  PID:9172
- C:\Windows\System\VCdFQZl.exe
  C:\Windows\System\VCdFQZl.exe
  2⤵
  PID:8284
- C:\Windows\System\oxFLBzS.exe
  C:\Windows\System\oxFLBzS.exe
  2⤵
  PID:9212
- C:\Windows\System\cfJfJeh.exe
  C:\Windows\System\cfJfJeh.exe
  2⤵
  PID:8416
- C:\Windows\System\juxRWls.exe
  C:\Windows\System\juxRWls.exe
  2⤵
  PID:8496
- C:\Windows\System\amvRRkP.exe
  C:\Windows\System\amvRRkP.exe
  2⤵
  PID:8612
- C:\Windows\System\Onefpfx.exe
  C:\Windows\System\Onefpfx.exe
  2⤵
  PID:8660
- C:\Windows\System\wSwEXkC.exe
  C:\Windows\System\wSwEXkC.exe
  2⤵
  PID:8540
- C:\Windows\System\MzlzLdE.exe
  C:\Windows\System\MzlzLdE.exe
  2⤵
  PID:8592
- C:\Windows\System\HbasQUd.exe
  C:\Windows\System\HbasQUd.exe
  2⤵
  PID:8524
- C:\Windows\System\lopdGvD.exe
  C:\Windows\System\lopdGvD.exe
  2⤵
  PID:8756
- C:\Windows\System\FrFYyvJ.exe
  C:\Windows\System\FrFYyvJ.exe
  2⤵
  PID:8912
- C:\Windows\System\AlgyQTA.exe
  C:\Windows\System\AlgyQTA.exe
  2⤵
  PID:8820
- C:\Windows\System\rceJCIA.exe
  C:\Windows\System\rceJCIA.exe
  2⤵
  PID:9052
- C:\Windows\System\BQwglPS.exe
  C:\Windows\System\BQwglPS.exe
  2⤵
  PID:9108
- C:\Windows\System\zkLwFKq.exe
  C:\Windows\System\zkLwFKq.exe
  2⤵
  PID:8316
- C:\Windows\System\XfvsWEP.exe
  C:\Windows\System\XfvsWEP.exe
  2⤵
  PID:8688
- C:\Windows\System\aDZpTVu.exe
  C:\Windows\System\aDZpTVu.exe
  2⤵
  PID:8656
- C:\Windows\System\ImESLoS.exe
  C:\Windows\System\ImESLoS.exe
  2⤵
  PID:8872
- C:\Windows\System\OyuLMUE.exe
  C:\Windows\System\OyuLMUE.exe
  2⤵
  PID:9224
- C:\Windows\System\aPdOOMk.exe
  C:\Windows\System\aPdOOMk.exe
  2⤵
  PID:9260
- C:\Windows\System\CuDIedq.exe
  C:\Windows\System\CuDIedq.exe
  2⤵
  PID:9276
- C:\Windows\System\sCvHqUt.exe
  C:\Windows\System\sCvHqUt.exe
  2⤵
  PID:9292
- C:\Windows\System\wYVqRmD.exe
  C:\Windows\System\wYVqRmD.exe
  2⤵
  PID:9308
- C:\Windows\System\OUFVtkv.exe
  C:\Windows\System\OUFVtkv.exe
  2⤵
  PID:9324
- C:\Windows\System\qhsazHI.exe
  C:\Windows\System\qhsazHI.exe
  2⤵
  PID:9340
- C:\Windows\System\LhOMIHw.exe
  C:\Windows\System\LhOMIHw.exe
  2⤵
  PID:9356
- C:\Windows\System\XtOSedC.exe
  C:\Windows\System\XtOSedC.exe
  2⤵
  PID:9372
- C:\Windows\System\SGfIdoF.exe
  C:\Windows\System\SGfIdoF.exe
  2⤵
  PID:9392
- C:\Windows\System\pmWbTgT.exe
  C:\Windows\System\pmWbTgT.exe
  2⤵
  PID:9408
- C:\Windows\System\POuQvFf.exe
  C:\Windows\System\POuQvFf.exe
  2⤵
  PID:9424
- C:\Windows\System\GTmoZSk.exe
  C:\Windows\System\GTmoZSk.exe
  2⤵
  PID:9440
- C:\Windows\System\STLKgNx.exe
  C:\Windows\System\STLKgNx.exe
  2⤵
  PID:9456
- C:\Windows\System\penGkWN.exe
  C:\Windows\System\penGkWN.exe
  2⤵
  PID:9472
- C:\Windows\System\yIOvwrs.exe
  C:\Windows\System\yIOvwrs.exe
  2⤵
  PID:9488
- C:\Windows\System\sIKcMTR.exe
  C:\Windows\System\sIKcMTR.exe
  2⤵
  PID:9512
- C:\Windows\System\kUuRtRq.exe
  C:\Windows\System\kUuRtRq.exe
  2⤵
  PID:9528
- C:\Windows\System\knnNRbf.exe
  C:\Windows\System\knnNRbf.exe
  2⤵
  PID:9544
- C:\Windows\System\hxMrcVU.exe
  C:\Windows\System\hxMrcVU.exe
  2⤵
  PID:9560
- C:\Windows\System\jIZZtKf.exe
  C:\Windows\System\jIZZtKf.exe
  2⤵
  PID:9576
- C:\Windows\System\OAmfyWi.exe
  C:\Windows\System\OAmfyWi.exe
  2⤵
  PID:9592
- C:\Windows\System\TmOxBxY.exe
  C:\Windows\System\TmOxBxY.exe
  2⤵
  PID:9608
- C:\Windows\System\DaQpcAE.exe
  C:\Windows\System\DaQpcAE.exe
  2⤵
  PID:9624
- C:\Windows\System\iVYzQhI.exe
  C:\Windows\System\iVYzQhI.exe
  2⤵
  PID:9640
- C:\Windows\System\qJTIdSf.exe
  C:\Windows\System\qJTIdSf.exe
  2⤵
  PID:9660
- C:\Windows\System\nfgNHUC.exe
  C:\Windows\System\nfgNHUC.exe
  2⤵
  PID:9676
- C:\Windows\System\FPhVbCe.exe
  C:\Windows\System\FPhVbCe.exe
  2⤵
  PID:9692
- C:\Windows\System\rRfiVTA.exe
  C:\Windows\System\rRfiVTA.exe
  2⤵
  PID:9708
- C:\Windows\System\iMIhyIG.exe
  C:\Windows\System\iMIhyIG.exe
  2⤵
  PID:9724
- C:\Windows\System\KhNTppr.exe
  C:\Windows\System\KhNTppr.exe
  2⤵
  PID:9740
- C:\Windows\System\eGgsEOI.exe
  C:\Windows\System\eGgsEOI.exe
  2⤵
  PID:9756
- C:\Windows\System\lpEyowm.exe
  C:\Windows\System\lpEyowm.exe
  2⤵
  PID:9772
- C:\Windows\System\uzaQTAz.exe
  C:\Windows\System\uzaQTAz.exe
  2⤵
  PID:9788
- C:\Windows\System\lfXEZSe.exe
  C:\Windows\System\lfXEZSe.exe
  2⤵
  PID:9804
- C:\Windows\System\zttrjBM.exe
  C:\Windows\System\zttrjBM.exe
  2⤵
  PID:9828
- C:\Windows\System\bvlagPj.exe
  C:\Windows\System\bvlagPj.exe
  2⤵
  PID:9844
- C:\Windows\System\RtjMHDq.exe
  C:\Windows\System\RtjMHDq.exe
  2⤵
  PID:9860
- C:\Windows\System\NvYMAor.exe
  C:\Windows\System\NvYMAor.exe
  2⤵
  PID:9876
- C:\Windows\System\EhDWsUr.exe
  C:\Windows\System\EhDWsUr.exe
  2⤵
  PID:9892
- C:\Windows\System\BBhcYNN.exe
  C:\Windows\System\BBhcYNN.exe
  2⤵
  PID:9908
- C:\Windows\System\JgPfRGN.exe
  C:\Windows\System\JgPfRGN.exe
  2⤵
  PID:9924
- C:\Windows\System\KjZLEsl.exe
  C:\Windows\System\KjZLEsl.exe
  2⤵
  PID:9940
- C:\Windows\System\gkvjTRw.exe
  C:\Windows\System\gkvjTRw.exe
  2⤵
  PID:9956
- C:\Windows\System\lbFPiEG.exe
  C:\Windows\System\lbFPiEG.exe
  2⤵
  PID:9972
- C:\Windows\System\ihjwWEb.exe
  C:\Windows\System\ihjwWEb.exe
  2⤵
  PID:9992
- C:\Windows\System\WrJVRmM.exe
  C:\Windows\System\WrJVRmM.exe
  2⤵
  PID:10008
- C:\Windows\System\eiiDJFS.exe
  C:\Windows\System\eiiDJFS.exe
  2⤵
  PID:10024
- C:\Windows\System\BcVdwmg.exe
  C:\Windows\System\BcVdwmg.exe
  2⤵
  PID:10048
- C:\Windows\System\DKKbakY.exe
  C:\Windows\System\DKKbakY.exe
  2⤵
  PID:10064
- C:\Windows\System\NIgiJCI.exe
  C:\Windows\System\NIgiJCI.exe
  2⤵
  PID:10080
- C:\Windows\System\UbvfsJx.exe
  C:\Windows\System\UbvfsJx.exe
  2⤵
  PID:10096
- C:\Windows\System\MQcslBT.exe
  C:\Windows\System\MQcslBT.exe
  2⤵
  PID:10112
- C:\Windows\System\BnLZvRI.exe
  C:\Windows\System\BnLZvRI.exe
  2⤵
  PID:10128
- C:\Windows\System\xsChhTA.exe
  C:\Windows\System\xsChhTA.exe
  2⤵
  PID:10148
- C:\Windows\System\MdknrdK.exe
  C:\Windows\System\MdknrdK.exe
  2⤵
  PID:10164
- C:\Windows\System\POSBQbB.exe
  C:\Windows\System\POSBQbB.exe
  2⤵
  PID:10192
- C:\Windows\System\kgILjbM.exe
  C:\Windows\System\kgILjbM.exe
  2⤵
  PID:10208
- C:\Windows\System\IPVclkf.exe
  C:\Windows\System\IPVclkf.exe
  2⤵
  PID:10228
- C:\Windows\System\zqwOmUs.exe
  C:\Windows\System\zqwOmUs.exe
  2⤵
  PID:8936
- C:\Windows\System\USKVWcB.exe
  C:\Windows\System\USKVWcB.exe
  2⤵
  PID:9112
- C:\Windows\System\NSXPmgK.exe
  C:\Windows\System\NSXPmgK.exe
  2⤵
  PID:9156
- C:\Windows\System\uCdQkrp.exe
  C:\Windows\System\uCdQkrp.exe
  2⤵
  PID:5260
- C:\Windows\System\RUakPtI.exe
  C:\Windows\System\RUakPtI.exe
  2⤵
  PID:8256
- C:\Windows\System\UhjakAy.exe
  C:\Windows\System\UhjakAy.exe
  2⤵
  PID:9232
- C:\Windows\System\CGPYPZK.exe
  C:\Windows\System\CGPYPZK.exe
  2⤵
  PID:9252
- C:\Windows\System\qKmrGEB.exe
  C:\Windows\System\qKmrGEB.exe
  2⤵
  PID:9288
- C:\Windows\System\YynkPhk.exe
  C:\Windows\System\YynkPhk.exe
  2⤵
  PID:9144
- C:\Windows\System\ueDHZWq.exe
  C:\Windows\System\ueDHZWq.exe
  2⤵
  PID:8932
- C:\Windows\System\wOtpKhC.exe
  C:\Windows\System\wOtpKhC.exe
  2⤵
  PID:8336
- C:\Windows\System\tNyPwYp.exe
  C:\Windows\System\tNyPwYp.exe
  2⤵
  PID:8608
- C:\Windows\System\vgvIaSh.exe
  C:\Windows\System\vgvIaSh.exe
  2⤵
  PID:8856
- C:\Windows\System\ldUVwUM.exe
  C:\Windows\System\ldUVwUM.exe
  2⤵
  PID:7280
- C:\Windows\System\OQrITYR.exe
  C:\Windows\System\OQrITYR.exe
  2⤵
  PID:9268
- C:\Windows\System\rYrjEal.exe
  C:\Windows\System\rYrjEal.exe
  2⤵
  PID:9304
- C:\Windows\System\rtdYLih.exe
  C:\Windows\System\rtdYLih.exe
  2⤵
  PID:8916
- C:\Windows\System\ztqAOvt.exe
  C:\Windows\System\ztqAOvt.exe
  2⤵
  PID:9400
- C:\Windows\System\tnkGzdN.exe
  C:\Windows\System\tnkGzdN.exe
  2⤵
  PID:9432
- C:\Windows\System\qemSaXn.exe
  C:\Windows\System\qemSaXn.exe
  2⤵
  PID:9496
- C:\Windows\System\hFHsuRV.exe
  C:\Windows\System\hFHsuRV.exe
  2⤵
  PID:9500
- C:\Windows\System\VjzwzWX.exe
  C:\Windows\System\VjzwzWX.exe
  2⤵
  PID:9540
- C:\Windows\System\etIlRyY.exe
  C:\Windows\System\etIlRyY.exe
  2⤵
  PID:9604
- C:\Windows\System\nWqEVYj.exe
  C:\Windows\System\nWqEVYj.exe
  2⤵
  PID:9700
- C:\Windows\System\oAkCJTc.exe
  C:\Windows\System\oAkCJTc.exe
  2⤵
  PID:9764
- C:\Windows\System\wpcdtXn.exe
  C:\Windows\System\wpcdtXn.exe
  2⤵
  PID:9520
- C:\Windows\System\jqSjOai.exe
  C:\Windows\System\jqSjOai.exe
  2⤵
  PID:9784
- C:\Windows\System\TsLEtiI.exe
  C:\Windows\System\TsLEtiI.exe
  2⤵
  PID:9824
- C:\Windows\System\lthZZNW.exe
  C:\Windows\System\lthZZNW.exe
  2⤵
  PID:9840
- C:\Windows\System\lJhtwxp.exe
  C:\Windows\System\lJhtwxp.exe
  2⤵
  PID:9904
- C:\Windows\System\CnBZFJC.exe
  C:\Windows\System\CnBZFJC.exe
  2⤵
  PID:10000
- C:\Windows\System\FRXCcFq.exe
  C:\Windows\System\FRXCcFq.exe
  2⤵
  PID:10036
- C:\Windows\System\NCVgHpp.exe
  C:\Windows\System\NCVgHpp.exe
  2⤵
  PID:10172
- C:\Windows\System\ewvcxsV.exe
  C:\Windows\System\ewvcxsV.exe
  2⤵
  PID:9916
- C:\Windows\System\WbcEgex.exe
  C:\Windows\System\WbcEgex.exe
  2⤵
  PID:9888
- C:\Windows\System\TnICLQS.exe
  C:\Windows\System\TnICLQS.exe
  2⤵
  PID:10236
- C:\Windows\System\xsSKTkL.exe
  C:\Windows\System\xsSKTkL.exe
  2⤵
  PID:10092
- C:\Windows\System\SSswIwC.exe
  C:\Windows\System\SSswIwC.exe
  2⤵
  PID:9988
- C:\Windows\System\QMQXDbu.exe
  C:\Windows\System\QMQXDbu.exe
  2⤵
  PID:9088
- C:\Windows\System\JlwGCbE.exe
  C:\Windows\System\JlwGCbE.exe
  2⤵
  PID:8964
- C:\Windows\System\fRYmBWb.exe
  C:\Windows\System\fRYmBWb.exe
  2⤵
  PID:8596
- C:\Windows\System\ZRvLmnO.exe
  C:\Windows\System\ZRvLmnO.exe
  2⤵
  PID:8996
- C:\Windows\System\mRsfQXQ.exe
  C:\Windows\System\mRsfQXQ.exe
  2⤵
  PID:8888
- C:\Windows\System\GUGCpXC.exe
  C:\Windows\System\GUGCpXC.exe
  2⤵
  PID:9348
- C:\Windows\System\ciGpCyz.exe
  C:\Windows\System\ciGpCyz.exe
  2⤵
  PID:9320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DvIwqui.exe

Filesize
1.4MB

MD5
90014a97cf1d5573a7ae2aefd0e2ed36

SHA1
02ce1607196117433be6e7f62f4e949f1d71bfae

SHA256
666573b915441b3191cb7a3d9bcc137f64641a20eca2ea3ad2f280324bc11d61

SHA512
c5e7ee188e75b2541e81576b53e10ac8962f9052a922a6d3bd06b68e0644b35b5b1ae190f66e2b81477a79881d4664c7a9d6e26965c32635c0e74ebc08c570aa

Download Submit
C:\Windows\system\JInybZL.exe

Filesize
1.4MB

MD5
53db26a9fdf40819e49257c49770b116

SHA1
373466a7baba2c928f634ba6f1d657d867fc0c82

SHA256
5abd6429e22b28e4cd53233543cbe36a53242b7daa6b521767d251d14bd3f700

SHA512
cb88c64012f75d19ce67a7931658b9d38161ac24c3fa8d3dcc7755e9f305bfb97038d9c5be7d495facea63bd5418dc489251c3ba3e4a1f70e3c1887a41bbf1f0

Download Submit
C:\Windows\system\JWxWSfD.exe

Filesize
1.4MB

MD5
994443677b804e6b5b315bbc76a3acb1

SHA1
7d3e0ea81a42f1b31df49f990b17e47262974a43

SHA256
5b01f43dc768c7914286d3fa3f04cf84ce169de42636c047e052c6c7e1c4c543

SHA512
87dff7d65f5299e8fa32df3498d38fd28cb5c7621f6d5053c10023487eff477476b5e05162b9e79fe99991cd3bcdb202739aaea261fa1989df868860e5cc921a

Download Submit
C:\Windows\system\KSCsERW.exe

Filesize
1.4MB

MD5
164d436b6fbba8ed021e9f7b68692e91

SHA1
7ea7f9f99b7e17a42e9fb387a0817ed7ed69b7f5

SHA256
953e9a5ceac72056a181c9a57d944261b2f49b6308287d65175da66c37ba3937

SHA512
3d9471c5c274a25d820ef97763a364493f5051ff69a93c1cf039af49933b4978a893a5875c6509ab5f97226a8915ae131e0f171bb9f1e27f6cebafd9e0b6301b

Download Submit
C:\Windows\system\NDZMTCZ.exe

Filesize
1.4MB

MD5
90b11f4eed39de9b1c51c122d9acdac9

SHA1
d3455f99b061f036104cb0192ccc4cbd32ff0f96

SHA256
b5254451fd68185956507e040faf39c91e7cace3c920a6541edd8415de7d7f3d

SHA512
700070841344bd852cf1f1b2879f4b9b106d3b5a8caa0c37daa0fa51650c0a06b03d76c65df82ec67e5140e167cfcda65197b82d4392e50b2e59b188077801b0

Download Submit
C:\Windows\system\NIoUjxk.exe

Filesize
1.4MB

MD5
cb6bfac8e0e24067cfb2ac874af6ae1f

SHA1
9fe16ebcfec176a031903a60edff7f069b53dc96

SHA256
d31a17d0f53953ec30ceefa9432b1efd08daf8fc7e4bccb53849039e6e4ac87f

SHA512
d6fe962fb67df8dfe8d0fc9cf2d003011d251732ccd485a6bee4ec11c633ea5dddae37c7a2fd0848098f9dd200f290391302f288284ff48efce410f48b1c4dbf

Download Submit
C:\Windows\system\OMcFOfv.exe

Filesize
1.4MB

MD5
9ac67a7b399f8267ff1b8702c0c3e875

SHA1
d19d86f2aae41d2d5cc8ec0efdabef4b24a5c218

SHA256
82909923cfe4bd9269657f0ea0b521024e71290c71a7cae5987b85539057c738

SHA512
b202e6449d73afe18e24462f97a74eb8ac08cb86b253dc7b0f97a48b140109994b3f471221332606220191e2769a8bbbd494dc77c785d80af89e4a6619ac9f4e

Download Submit
C:\Windows\system\OvEXmvL.exe

Filesize
1.4MB

MD5
09fb85f989a6bfeaa86451cbf981ddb1

SHA1
c2613632437f91bf5e3e424497ac39180efe2f86

SHA256
eb2e462d40f46bfceb3f5de6862c19964fa3466e1164b65e935fefe7cbd2e17e

SHA512
f92270693774b14f393ece3044b1aa449aca01b5a13d7d5af60fd476b0e123658d0ea4ef3c54bfcdbba45c9d0a052414d73526fe9ea50f276b5ca7db0109cac1

Download Submit
C:\Windows\system\TINMbae.exe

Filesize
1.4MB

MD5
f9524e1121f1925c2a9eef19616a2f5d

SHA1
40c3417e06d4536cb14967819ac105e21ac1f205

SHA256
b8e8ad0cda29959b0788edb2d7bb70861a804e5b961bd4ae0df13de33ce88148

SHA512
83656408c52d42f4928bd33fc88e451332b4ede0fec086585061c3e92bee4600ed6cff70e7b9576925e544a2a020aa80798d6c2aead1714000b963c9ef90a663

Download Submit
C:\Windows\system\TSgyUsG.exe

Filesize
1.4MB

MD5
f6c87b168e40bc7ebe052dad6baab3c5

SHA1
411ac55528232ae57cc35a85927c57a3db924d0f

SHA256
a87a567e81d151546f88b57481eb212afe0acd358839536a3f7fbf411bdb7dd5

SHA512
e3133dab3212bc69ed2f541ea344559385050eab70e6d41c7c0f73d257ade5220b2fd86ae613ed6dba05b2b92f2316d93841657d85440bfef83ea5e60f8872a8

Download Submit
C:\Windows\system\ThIOlaF.exe

Filesize
1.4MB

MD5
8ac230b927ff1daa0dbd5a51b74d8e84

SHA1
5133d9535890cc8a830d4a38cd1ad0fa9068ebf5

SHA256
4b2e55734a0543c00b5979268bf096a1f2d2fcf6a3150fc5ca3d2acacee0f4e8

SHA512
8b66fb3b45921e34f6f148de4644ac307fd63ba15030ea365e74876e545c2dd144590b5619ddfcb90f2d05f1730d0101c2140d4c36c044e09ac1fe4f1d0bd3ae

Download Submit
C:\Windows\system\UlhNqoV.exe

Filesize
1.4MB

MD5
c49219eafe67164ec76c20f722df11db

SHA1
e2204f0fd969180107ede9bfd09e351f102262fe

SHA256
52647544676335078b2cbf133f0bc77440123f8eeedc2f7fbf6d9e0399ad6ccc

SHA512
20f98005d034998881108849fae609a1ecff25b6d1be18fbc1dde5f04ca4c625411a78cd231c56a0e26275e5646554a32b0a1f202045d886cfd6db924afa7f98

Download Submit
C:\Windows\system\WbykpSM.exe

Filesize
1.4MB

MD5
c285778ed9f3f14d8e0750edc33ccbfc

SHA1
a9c4cfaf3cf7b8f239a4f1af1f99f0c2246445ce

SHA256
24d66dd3a923039fcf418fd7d5385cc5cc670f10d71daafda44def65bb2ff236

SHA512
5c9b461b4ad189f0f27f2b5c35ce698443769bb68a0181f410361acc4369835a5f0d09ea6dfc6072506a07944802d5967eb06e1b57d22d7a50b2d5ace2d0dbad

Download Submit
C:\Windows\system\XkWMiXw.exe

Filesize
1.4MB

MD5
7288517c0893b56fd9ce15f960b26b29

SHA1
14a6c00506545f75481944d1c52a95b7cf6fe684

SHA256
962a56d37ac39cfead156d0e2946db1b391ed07636663b5b7197b4c8b04cdb30

SHA512
262b5819a0582f65b1dd5f3e48c520e34469eae80ccba72c5c67e479facd4e58ad4808e85894b051ca4042f88ce970a9706dd89ea7baf3829fc496a1045f3b95

Download Submit
C:\Windows\system\XtpZOQg.exe

Filesize
1.4MB

MD5
bb6a2e17d8d8003bb7b4e5237a09dc3d

SHA1
4c7341ae958a76518a266334fc5e234a76baece5

SHA256
e386cd21d6310a7fbf0c0b816920f3a6c0e4370bb67216612a23f1e591973f21

SHA512
908e003cbd574a5f25e540ff29ec8e89b98c82ca8b126492edbb44663055a0a0ce5b84d3fb2dc540c105d8534c04940371506eece2feb8f8e620ef960d7fe991

Download Submit
C:\Windows\system\YmhtOZa.exe

Filesize
1.4MB

MD5
78075da9ceace8fa21b528d6bb050c6a

SHA1
9eff15e938441c56967d361294b5dba433a0b14f

SHA256
3ff3e03cf47ddba5b09ebeb3a20c45e35b314edd57702cf2c4c04a704f68fa1c

SHA512
db7f61eff7d08d0428973ab0e37e4507637ee139fd85b19000000fb4ee1eddeee7f6b365c2eca5e9a9b7dd801828192c4692ad116b151efc865664cb056e4325

Download Submit
C:\Windows\system\ZuwWlAF.exe

Filesize
1.4MB

MD5
ac27e642f5673023f846f88ccb31b439

SHA1
285bcc7d1d6b6fec3707d29627dd24a27988e0d6

SHA256
7fcbfc88e489697b1ac2bf5aba4349af3a96f92ad91c401d5eba2af74168450a

SHA512
e25afcc710e4651af3821b8ddb78babbc3cdb6af5052a80aec212030d4fd87ef16c3f06f5901d4e3c08c950bdb31713248823f342d8886de49ea2c2bb40564ad

Download Submit
C:\Windows\system\iqQAXoc.exe

Filesize
1.4MB

MD5
9ed67b8413a9cd0d4b57637d0c367bf2

SHA1
50c2f443798238d697a89ad5fdc15c67ed579c9e

SHA256
182e3b06c8ad5099ba5782d6828796d525044b98db0efd666e82becacaeafc43

SHA512
9ef42c4576ff85528afce2e7ef3a26af5e3153ef15fd31efe740eef2da19b227235535de049ef13d65017df41eef247da8412f969569227f07385b7b11cbc643

Download Submit
C:\Windows\system\kSTcJdD.exe

Filesize
1.4MB

MD5
68dc8c966c79c81267175896ec9c6975

SHA1
571a2e91434149fd713bf322a990a8c330c4f873

SHA256
6972b812457d9d7ecb9160f254656ab67e7a1a9f12c175ee7cb215bf1f5164c7

SHA512
6f4f987a7b222571997eb138299f701d43a66cdd3cc97c08adda566774f7a4a7b11fc83891606bf0875b64b293de888dbb239612c6d999671f054e50e12aec7c

Download Submit
C:\Windows\system\oeRowIB.exe

Filesize
1.4MB

MD5
c114e4a447532293bcab96a2d054cec1

SHA1
b360edf01848f6de93560ac68a39dcf7439654f9

SHA256
7f4c548a170b580070ccbe73976e2db3f165d33f34fc297b287be1377a003cb5

SHA512
906553e8b38b82c42e6b9471fe1b12b1f7c2fae9e9c13ad5d81330d38ada63077b4cda43e308c29427763ed665d2c6d3a25e17866c1377d59123b75a46d0e566

Download Submit
C:\Windows\system\okgXoqt.exe

Filesize
1.4MB

MD5
bb1989f5ac3d234db3cb8b074cca4314

SHA1
eb8aaed92b4bebd06e9f020705570b0b3377fdb0

SHA256
05754e28258bc560a2b1fa9e5e2799f857ceb0939c54facbca32cb82d5d8059b

SHA512
427b63377c5f4cf4ae828fec800ffbdbdd7f765e38445a0d55b3d063762c85ef0f916f7b68e8df9ae00692b80e3ef3fd2c07a47717941a25962f43645aa096ad

Download Submit
C:\Windows\system\qKINFXB.exe

Filesize
1.4MB

MD5
aef1bf8fb187af93f2ff50897751211b

SHA1
61303f9a9c5e6fb4b5e34df9a1daac7579b0ddae

SHA256
364f66d2825a6a8908a303b478ff7c516bf06dc3c983a79d5a546225246a3665

SHA512
503dd02138bf917d6b69e43170e04b2a592c6044c0dd73b382b80e3e23084adff68d4cc471edb9140db523d31f2cf9f95a6a4711160cd7af534185a23ff6dd22

Download Submit
C:\Windows\system\qirzdvb.exe

Filesize
1.4MB

MD5
23936ff6a08011797b6f2d788b364cba

SHA1
c226c7cbdaca73c70fbb5c227b0cd9f31ef47c0e

SHA256
09006e5b0924dd5b04b1b48a007f265dd506f8ae8a5e8b472de1bebb31e7d3fb

SHA512
4ed71cc4bb347f28334564d969a42f8145968e8ed1ccc0e544e92c42611c43d1416cadb9c91b0c45b8e99a2d843be6301c28fc5734fffcd08ba58af42245ae6f

Download Submit
C:\Windows\system\rmjlRJt.exe

Filesize
1.4MB

MD5
858cd49f007d084d2272490f0804b40f

SHA1
d5e799189b73cc5e2be0c775db8bee53208cbea8

SHA256
0c647b1163e1ea3826abcdc41f9b8cc966fc70d5ca053f32fa40bf891a668d39

SHA512
97f39a569ac91b714a37e6215ab79bda3ba4cde0ced3b603fdb24067b9f313b763504880bc10137d195cc87172f187deb3fdbf6c7ffc07b4546093317c9f256f

Download Submit
C:\Windows\system\sNLNSGA.exe

Filesize
1.4MB

MD5
cac0b726a210d70c09e192c0aa5ca8d5

SHA1
54b46cb64a18aa3193b97466f62e63a763745ac9

SHA256
791f86abe3b04d76a576392ef2248d9fb704f2416249e0d9a6d602e37d397025

SHA512
8549b9774d94fc9e3bcd56c4860eb6615d27c7aa6a6baed2d8e9f5bf6da1032cbc7c02ee57f39050e5f0ba296d440b2bcd8389f0cae51eeb3004f655b2fa1f71

Download Submit
C:\Windows\system\sNMUIrO.exe

Filesize
1.4MB

MD5
b2e06af6435633a8b6fd0b92c3dcf8c8

SHA1
0afd5d9e8875ca1c115c85f92b5b8123bf2537ef

SHA256
bd680d383e0d6d9460c77880f4fb67da017994a87050f0df41e144ed6d4b519d

SHA512
5ca5f0420e84e7ff304c76d5f9f0b3709ab048c43a7864ca57078476aef484573f553a19222c99504a79594988f7c07ae4174138bca81a1b747287e7f9535d84

Download Submit
C:\Windows\system\yTMVkgC.exe

Filesize
1.4MB

MD5
aa3329b266e8f6a4618a525bbdfbc678

SHA1
80350064522c816e9bfac0227789e0563b8bcf33

SHA256
0ed07d5ec7765e03c0d22ec825ad71f6d2ecda9b0d3e91e65b6d91ffd653c784

SHA512
25a1d394d0fee91476816783e580ede67e622f6c434158a4b063bc4fcf4517bc94fdf361e849e20cf00abe5283ec0045e080729a3f221c792bcbf0e7c51e83be

Download Submit
\Windows\system\EnZwScY.exe

Filesize
1.4MB

MD5
7419b20e523b47f1c73adda8330febb3

SHA1
7f99edef70d24dfad7aaf919bc5059deb0e6fae7

SHA256
5f36e1b4d30f9d432d1d9471dbf0374d0e30205a76bd85c0a05f3df5bb06444b

SHA512
1bb4615d1880db289a34e1e4d54de81dc95a7610a591a5f5e0de8ff095365059d856109797041ae2c9c386035932674d63872f3c8fb91079d70cebe1fa2c09e8

Download Submit
\Windows\system\HDflvnS.exe

Filesize
1.4MB

MD5
6bfc267047e15934a7d5e8c81725d127

SHA1
ecefca06db131f3c9a6f6e3cdd8bf353ca9c8407

SHA256
7b4127c06d19ffed626dca173084aec0b440eb3ff3d2d3d9af79df2e690547b3

SHA512
6899eb6f6c3599ed8f2be14e126ca547ec2c2d3bac54710942028243391e8971f1e578c625900af7ea84007679fe16ff35ad18890061941667c5d71e70e48a9c

Download Submit
\Windows\system\NxBTQBN.exe

Filesize
1.4MB

MD5
3c599255d3e14be6025dc3051a986697

SHA1
3b3f348fd25efc6e4d2bdcf2915635a25fc494d5

SHA256
efe8b221010cfca5be2c9f4fc185bc1711bcfb4f45546972aaaa4ca25d9f5836

SHA512
64cf9653332dc3b05dc3d4e670af5fcd14432f22e29418d336a08f047f2872cf41233de2a836131aca60efd041c5a3de3955418290a18cc9b7d8e5afb4c0427e

Download Submit
\Windows\system\hJtUFrI.exe

Filesize
1.4MB

MD5
fae71829bb8629b9d1fa819a95fc473b

SHA1
d39eb16e999fc4e10f3a142da2ae3196dc1e218d

SHA256
a43abc37d0ab6cb99a7ad8d7764e4e67075664880501414fabc2394f2b151117

SHA512
2dc157913bc7aba3616b2f2cf04f02a2b9ab7d081c6b5169c323fb2942db78a065dfe01f9152acb561e09c8dac2124d0c74e72e0429379a816a57e8d87fe5a65

Download Submit
\Windows\system\rnaWEsu.exe

Filesize
1.4MB

MD5
30bf67661d77681298dec8e010975987

SHA1
42beb17b4039ec29125efc865ad98814be890532

SHA256
f9c12b2de650225dd36a4a133d1981f3bc0758ede96fc42e77fe3e1e57c2b216

SHA512
12d152f47269d8dc6a325e01b9259ce10215ed416cfddd14305ef4c1839e3f04358a03dbb8569c809c675230ce614082140c3b162444cc3d4347f02577be55c4

Download Submit
\Windows\system\wMpqyxA.exe

Filesize
1.4MB

MD5
5e4f2c9ed92a71554c3fda38fd08c9ca

SHA1
18f092fabf75658958b8da265408fe69fde70687

SHA256
aff0e14f7da48702c6cba635a6087dca70809bfea485b08be36ad1c8ac61755e

SHA512
d436eab987ac10374982c947489edd71ff7b18ec29a10d98237f4e032519908d90f9a427c7b494bf130e45cee144dee2b634cd9e0885baf93eae91ced63a3ed6

Download Submit
memory/1208-121-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2184-137-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-141-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-1-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-129-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-122-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-120-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-142-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-125-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2184-139-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2184-134-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2184-6-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2384-138-0x000000013F0E0000-0x000000013F4D2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-126-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-140-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-119-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-136-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2696-124-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2884-117-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-116-0x0000000001F40000-0x0000000001F48000-memory.dmp

Filesize
32KB

Download
memory/2884-114-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2884-115-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2884-113-0x000000001B840000-0x000000001BB22000-memory.dmp

Filesize
2.9MB

Download
memory/2884-118-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/2884-545-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2916-133-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/3044-8-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download