xmrig | 077dd945cbde3624ffba94bf0b6e7d48d2b32e9482842ef5be598dbff9c11071

Analysis

max time kernel
60s
max time network
58s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
Size

2.1MB
MD5

028cde6b4be81c4984cc92d357405e69
SHA1

a387a9cd8535b8b85917d15bed0a2be260f84caa
SHA256

077dd945cbde3624ffba94bf0b6e7d48d2b32e9482842ef5be598dbff9c11071
SHA512

2b3a9ab76b45006bf52b7676bf4ab3b1632fa1d17d04cfdf2856ff06eac1a6e2f85b9b9ac9a5c65e10fcab983e305cd4175ac51deb881003b64680ebb5ea2732
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qri:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2112-26-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2668-108-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2988-107-0x000000013F610000-0x000000013FA02000-memory.dmp	xmrig
behavioral1/memory/2604-102-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2456-100-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2020-23-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2020-3141-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2020	JpbPRFb.exe
2112	XpuopNX.exe
2988	YpZmFoP.exe
2668	yDkHNzK.exe
2064	YktAWlq.exe
2748	ALUmoXX.exe
2456	vqaYuEv.exe
2604	kgkEfCS.exe
2432	IDDMHIe.exe
2964	IbuWOlA.exe
1800	SJSwVcJ.exe
2764	HfolaiD.exe
1936	AbzjJlW.exe
1960	LJXOBwq.exe
1836	ubexSvd.exe
2504	UjwTSdi.exe
2288	CPukBzW.exe
2716	czNHUvS.exe
2776	EMfWdJu.exe
760	uSYluus.exe
2008	KxhqhMW.exe
1508	ZIOpUVp.exe
1104	PwStOis.exe
1288	vEDaRvB.exe
2852	Bmaruod.exe
2300	cguIPkw.exe
588	bAYScjk.exe
1820	EcCqNxo.exe
2192	qELRWKY.exe
880	VCiBtlM.exe
1140	dGIXtBt.exe
2180	ylLPume.exe
356	jqdbMpL.exe
1536	eyNITbo.exe
2000	EAcVuOH.exe
1380	tPnoYsD.exe
1032	DdzcJdi.exe
2092	xjqQSwg.exe
900	KQQTwbz.exe
580	kyHlFpX.exe
2976	gVRHfDX.exe
1768	jwUFbKP.exe
3040	uDvRKbW.exe
2072	LMPwKsf.exe
2252	WQzejxD.exe
1756	nWcYteO.exe
664	eWsxkuq.exe
2188	uPmjDnu.exe
2368	CwdLcsY.exe
2184	DjRSlwa.exe
1588	RZYCfQA.exe
2576	mDhZiBX.exe
2588	ymQsvpz.exe
2652	NtQVOIY.exe
2544	seZlHlU.exe
1956	WCMRTAS.exe
2684	tmcqzaU.exe
1996	oipIuSS.exe
676	mCEnlnY.exe
2452	hIeFXAT.exe
2628	mjKyFpb.exe
1940	jiMowYo.exe
2772	IJIJHJa.exe
1672	JnyWuSs.exe

Loads dropped DLL 64 IoCs

pid	Process
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1096-1-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x000c000000014f71-6.dat	upx
behavioral1/files/0x0007000000015cd5-14.dat	upx
behavioral1/memory/2112-26-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/files/0x0007000000015ceb-31.dat	upx
behavioral1/files/0x0009000000015d56-41.dat	upx
behavioral1/files/0x00060000000161e7-45.dat	upx
behavioral1/files/0x0008000000015d07-40.dat	upx
behavioral1/files/0x0007000000004e76-35.dat	upx
behavioral1/files/0x0006000000016cb7-90.dat	upx
behavioral1/files/0x0006000000016843-125.dat	upx
behavioral1/files/0x0006000000016d26-141.dat	upx
behavioral1/files/0x003500000001568c-151.dat	upx
behavioral1/files/0x0006000000016d90-161.dat	upx
behavioral1/files/0x0006000000016eb2-186.dat	upx
behavioral1/files/0x0006000000016e94-181.dat	upx
behavioral1/files/0x0006000000016dbf-176.dat	upx
behavioral1/files/0x0006000000016dbb-171.dat	upx
behavioral1/files/0x0006000000016da7-166.dat	upx
behavioral1/files/0x0006000000016d7e-156.dat	upx
behavioral1/files/0x0006000000016d3a-147.dat	upx
behavioral1/files/0x0006000000016d1e-136.dat	upx
behavioral1/memory/2668-108-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2988-107-0x000000013F610000-0x000000013FA02000-memory.dmp	upx
behavioral1/memory/2604-102-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2456-100-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x0006000000016c63-98.dat	upx
behavioral1/files/0x0006000000016a9a-97.dat	upx
behavioral1/memory/2748-96-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x0006000000016ce4-93.dat	upx
behavioral1/files/0x0006000000016c6b-86.dat	upx
behavioral1/memory/2064-82-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x0006000000016c4a-79.dat	upx
behavioral1/files/0x0006000000016572-58.dat	upx
behavioral1/files/0x000600000001630b-52.dat	upx
behavioral1/files/0x0006000000016d0d-118.dat	upx
behavioral1/files/0x000600000001661c-69.dat	upx
behavioral1/files/0x00060000000164b2-67.dat	upx
behavioral1/files/0x003500000001567f-24.dat	upx
behavioral1/memory/2020-23-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/files/0x0008000000015cba-22.dat	upx
behavioral1/memory/2020-3141-0x000000013FC40000-0x0000000140032000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dGIXtBt.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\xjqQSwg.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\smBoUsz.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\QDMDxXz.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\bNXPaPb.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\aAMiTyd.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\BEHLRNW.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\JpbPRFb.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\iKfaXxq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\GWByQZV.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\RvMINtx.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\DlMeBkf.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\FsrZzOH.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\cCiTDVq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\YlgpoNF.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\PTtocqg.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\iRNqIcZ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\odgthnt.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\vdeobmM.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\opeCpVv.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\tUiLCYz.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\wbUVPtA.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\XpXlKMc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\TmsQANT.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\pMeEMYs.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\JJQWzAS.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\yTwzoSq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\KQQTwbz.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\Jxviiuj.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\NPFZvhQ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\olVrPeu.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\LpAEbES.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\zEmdLTY.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\MYZAYTF.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\YnEWfIc.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\fkSCphN.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\yMGiiPa.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\RCiIhop.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\TCEPVoJ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\zmXOYxq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\ZJQNdux.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\MxQFNZq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\WmqBjjt.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\NqKYAlX.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\TfAZIwu.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\nWcYteO.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\IvpLmUy.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\FvbYWCJ.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\iQkHCfd.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\hMVrpNz.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\LvlUENG.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\QXxlpwV.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\zfBoRLd.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\bhEOQGq.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\KPArWzm.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\JlyFMOh.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\lYgwHeC.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\eKHHHQs.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\VbAMgrB.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\YefnAYt.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\MLBhXje.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\TlTYwBX.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\jGfTjsr.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
File created	C:\Windows\System\rqAZwZP.exe	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1708	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
Token: SeDebugPrivilege	1708	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1708	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	29
PID 1096 wrote to memory of 1708	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	29
PID 1096 wrote to memory of 1708	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	29
PID 1096 wrote to memory of 2020	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	30
PID 1096 wrote to memory of 2020	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	30
PID 1096 wrote to memory of 2020	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	30
PID 1096 wrote to memory of 2988	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	31
PID 1096 wrote to memory of 2988	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	31
PID 1096 wrote to memory of 2988	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	31
PID 1096 wrote to memory of 2112	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	32
PID 1096 wrote to memory of 2112	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	32
PID 1096 wrote to memory of 2112	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	32
PID 1096 wrote to memory of 2668	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	33
PID 1096 wrote to memory of 2668	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	33
PID 1096 wrote to memory of 2668	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	33
PID 1096 wrote to memory of 2064	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	34
PID 1096 wrote to memory of 2064	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	34
PID 1096 wrote to memory of 2064	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	34
PID 1096 wrote to memory of 2748	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	35
PID 1096 wrote to memory of 2748	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	35
PID 1096 wrote to memory of 2748	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	35
PID 1096 wrote to memory of 2456	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	36
PID 1096 wrote to memory of 2456	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	36
PID 1096 wrote to memory of 2456	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	36
PID 1096 wrote to memory of 2604	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	37
PID 1096 wrote to memory of 2604	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	37
PID 1096 wrote to memory of 2604	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	37
PID 1096 wrote to memory of 2432	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	38
PID 1096 wrote to memory of 2432	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	38
PID 1096 wrote to memory of 2432	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	38
PID 1096 wrote to memory of 2504	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	39
PID 1096 wrote to memory of 2504	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	39
PID 1096 wrote to memory of 2504	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	39
PID 1096 wrote to memory of 2964	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	40
PID 1096 wrote to memory of 2964	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	40
PID 1096 wrote to memory of 2964	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	40
PID 1096 wrote to memory of 2288	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	41
PID 1096 wrote to memory of 2288	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	41
PID 1096 wrote to memory of 2288	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	41
PID 1096 wrote to memory of 1800	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	42
PID 1096 wrote to memory of 1800	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	42
PID 1096 wrote to memory of 1800	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	42
PID 1096 wrote to memory of 2716	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	43
PID 1096 wrote to memory of 2716	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	43
PID 1096 wrote to memory of 2716	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	43
PID 1096 wrote to memory of 2764	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	44
PID 1096 wrote to memory of 2764	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	44
PID 1096 wrote to memory of 2764	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	44
PID 1096 wrote to memory of 2776	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	45
PID 1096 wrote to memory of 2776	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	45
PID 1096 wrote to memory of 2776	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	45
PID 1096 wrote to memory of 1936	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	46
PID 1096 wrote to memory of 1936	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	46
PID 1096 wrote to memory of 1936	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	46
PID 1096 wrote to memory of 760	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	47
PID 1096 wrote to memory of 760	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	47
PID 1096 wrote to memory of 760	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	47
PID 1096 wrote to memory of 1960	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	48
PID 1096 wrote to memory of 1960	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	48
PID 1096 wrote to memory of 1960	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	48
PID 1096 wrote to memory of 2008	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	49
PID 1096 wrote to memory of 2008	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	49
PID 1096 wrote to memory of 2008	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	49
PID 1096 wrote to memory of 1836	1096	028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\028cde6b4be81c4984cc92d357405e69_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1708
- C:\Windows\System\JpbPRFb.exe
  C:\Windows\System\JpbPRFb.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\YpZmFoP.exe
  C:\Windows\System\YpZmFoP.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\XpuopNX.exe
  C:\Windows\System\XpuopNX.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\yDkHNzK.exe
  C:\Windows\System\yDkHNzK.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\YktAWlq.exe
  C:\Windows\System\YktAWlq.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\ALUmoXX.exe
  C:\Windows\System\ALUmoXX.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\vqaYuEv.exe
  C:\Windows\System\vqaYuEv.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\kgkEfCS.exe
  C:\Windows\System\kgkEfCS.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\IDDMHIe.exe
  C:\Windows\System\IDDMHIe.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\UjwTSdi.exe
  C:\Windows\System\UjwTSdi.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\IbuWOlA.exe
  C:\Windows\System\IbuWOlA.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\CPukBzW.exe
  C:\Windows\System\CPukBzW.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\SJSwVcJ.exe
  C:\Windows\System\SJSwVcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\czNHUvS.exe
  C:\Windows\System\czNHUvS.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\HfolaiD.exe
  C:\Windows\System\HfolaiD.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\EMfWdJu.exe
  C:\Windows\System\EMfWdJu.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\AbzjJlW.exe
  C:\Windows\System\AbzjJlW.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\uSYluus.exe
  C:\Windows\System\uSYluus.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\LJXOBwq.exe
  C:\Windows\System\LJXOBwq.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\KxhqhMW.exe
  C:\Windows\System\KxhqhMW.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\ubexSvd.exe
  C:\Windows\System\ubexSvd.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\ZIOpUVp.exe
  C:\Windows\System\ZIOpUVp.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\PwStOis.exe
  C:\Windows\System\PwStOis.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\vEDaRvB.exe
  C:\Windows\System\vEDaRvB.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\Bmaruod.exe
  C:\Windows\System\Bmaruod.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\cguIPkw.exe
  C:\Windows\System\cguIPkw.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\bAYScjk.exe
  C:\Windows\System\bAYScjk.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\EcCqNxo.exe
  C:\Windows\System\EcCqNxo.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\qELRWKY.exe
  C:\Windows\System\qELRWKY.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\VCiBtlM.exe
  C:\Windows\System\VCiBtlM.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\dGIXtBt.exe
  C:\Windows\System\dGIXtBt.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\ylLPume.exe
  C:\Windows\System\ylLPume.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\jqdbMpL.exe
  C:\Windows\System\jqdbMpL.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\eyNITbo.exe
  C:\Windows\System\eyNITbo.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\EAcVuOH.exe
  C:\Windows\System\EAcVuOH.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\tPnoYsD.exe
  C:\Windows\System\tPnoYsD.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\DdzcJdi.exe
  C:\Windows\System\DdzcJdi.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\xjqQSwg.exe
  C:\Windows\System\xjqQSwg.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\KQQTwbz.exe
  C:\Windows\System\KQQTwbz.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\kyHlFpX.exe
  C:\Windows\System\kyHlFpX.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\gVRHfDX.exe
  C:\Windows\System\gVRHfDX.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\jwUFbKP.exe
  C:\Windows\System\jwUFbKP.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\uDvRKbW.exe
  C:\Windows\System\uDvRKbW.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\LMPwKsf.exe
  C:\Windows\System\LMPwKsf.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\WQzejxD.exe
  C:\Windows\System\WQzejxD.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\nWcYteO.exe
  C:\Windows\System\nWcYteO.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\eWsxkuq.exe
  C:\Windows\System\eWsxkuq.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\uPmjDnu.exe
  C:\Windows\System\uPmjDnu.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CwdLcsY.exe
  C:\Windows\System\CwdLcsY.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\DjRSlwa.exe
  C:\Windows\System\DjRSlwa.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\RZYCfQA.exe
  C:\Windows\System\RZYCfQA.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\mDhZiBX.exe
  C:\Windows\System\mDhZiBX.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ymQsvpz.exe
  C:\Windows\System\ymQsvpz.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\NtQVOIY.exe
  C:\Windows\System\NtQVOIY.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\seZlHlU.exe
  C:\Windows\System\seZlHlU.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\WCMRTAS.exe
  C:\Windows\System\WCMRTAS.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\tmcqzaU.exe
  C:\Windows\System\tmcqzaU.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\oipIuSS.exe
  C:\Windows\System\oipIuSS.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\mCEnlnY.exe
  C:\Windows\System\mCEnlnY.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\hIeFXAT.exe
  C:\Windows\System\hIeFXAT.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\mjKyFpb.exe
  C:\Windows\System\mjKyFpb.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\jiMowYo.exe
  C:\Windows\System\jiMowYo.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\IJIJHJa.exe
  C:\Windows\System\IJIJHJa.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\JnyWuSs.exe
  C:\Windows\System\JnyWuSs.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\edMaAcT.exe
  C:\Windows\System\edMaAcT.exe
  2⤵
  PID:1060
- C:\Windows\System\FLUAvMf.exe
  C:\Windows\System\FLUAvMf.exe
  2⤵
  PID:2920
- C:\Windows\System\WkPANkt.exe
  C:\Windows\System\WkPANkt.exe
  2⤵
  PID:2720
- C:\Windows\System\WdmBRVK.exe
  C:\Windows\System\WdmBRVK.exe
  2⤵
  PID:1808
- C:\Windows\System\GAVGZWZ.exe
  C:\Windows\System\GAVGZWZ.exe
  2⤵
  PID:2244
- C:\Windows\System\ioEaFkq.exe
  C:\Windows\System\ioEaFkq.exe
  2⤵
  PID:2320
- C:\Windows\System\lNdFbRv.exe
  C:\Windows\System\lNdFbRv.exe
  2⤵
  PID:1700
- C:\Windows\System\GKlpPoT.exe
  C:\Windows\System\GKlpPoT.exe
  2⤵
  PID:632
- C:\Windows\System\lNdPSQK.exe
  C:\Windows\System\lNdPSQK.exe
  2⤵
  PID:2056
- C:\Windows\System\lNybUBU.exe
  C:\Windows\System\lNybUBU.exe
  2⤵
  PID:1488
- C:\Windows\System\tycafSd.exe
  C:\Windows\System\tycafSd.exe
  2⤵
  PID:1916
- C:\Windows\System\MWnmrwb.exe
  C:\Windows\System\MWnmrwb.exe
  2⤵
  PID:1036
- C:\Windows\System\UzZicfz.exe
  C:\Windows\System\UzZicfz.exe
  2⤵
  PID:3024
- C:\Windows\System\AUByInX.exe
  C:\Windows\System\AUByInX.exe
  2⤵
  PID:848
- C:\Windows\System\TQKnphY.exe
  C:\Windows\System\TQKnphY.exe
  2⤵
  PID:1532
- C:\Windows\System\lrDiIkU.exe
  C:\Windows\System\lrDiIkU.exe
  2⤵
  PID:2144
- C:\Windows\System\DpRKjRk.exe
  C:\Windows\System\DpRKjRk.exe
  2⤵
  PID:2336
- C:\Windows\System\dRlTDaP.exe
  C:\Windows\System\dRlTDaP.exe
  2⤵
  PID:916
- C:\Windows\System\izQupgt.exe
  C:\Windows\System\izQupgt.exe
  2⤵
  PID:1524
- C:\Windows\System\KEyKiFe.exe
  C:\Windows\System\KEyKiFe.exe
  2⤵
  PID:1964
- C:\Windows\System\hiOefye.exe
  C:\Windows\System\hiOefye.exe
  2⤵
  PID:2100
- C:\Windows\System\JxfeQmS.exe
  C:\Windows\System\JxfeQmS.exe
  2⤵
  PID:1748
- C:\Windows\System\cCiTDVq.exe
  C:\Windows\System\cCiTDVq.exe
  2⤵
  PID:876
- C:\Windows\System\nrVaXQd.exe
  C:\Windows\System\nrVaXQd.exe
  2⤵
  PID:1580
- C:\Windows\System\VOSzAyE.exe
  C:\Windows\System\VOSzAyE.exe
  2⤵
  PID:1272
- C:\Windows\System\ocDwpkx.exe
  C:\Windows\System\ocDwpkx.exe
  2⤵
  PID:2640
- C:\Windows\System\TtmPZRl.exe
  C:\Windows\System\TtmPZRl.exe
  2⤵
  PID:2572
- C:\Windows\System\cyIhHYs.exe
  C:\Windows\System\cyIhHYs.exe
  2⤵
  PID:2044
- C:\Windows\System\KXEzstc.exe
  C:\Windows\System\KXEzstc.exe
  2⤵
  PID:2696
- C:\Windows\System\sjEZQXE.exe
  C:\Windows\System\sjEZQXE.exe
  2⤵
  PID:1564
- C:\Windows\System\PuXyOQo.exe
  C:\Windows\System\PuXyOQo.exe
  2⤵
  PID:1160
- C:\Windows\System\BoYtPPq.exe
  C:\Windows\System\BoYtPPq.exe
  2⤵
  PID:2428
- C:\Windows\System\mJOsaUJ.exe
  C:\Windows\System\mJOsaUJ.exe
  2⤵
  PID:2700
- C:\Windows\System\dUtSVQj.exe
  C:\Windows\System\dUtSVQj.exe
  2⤵
  PID:336
- C:\Windows\System\CfHtBxg.exe
  C:\Windows\System\CfHtBxg.exe
  2⤵
  PID:500
- C:\Windows\System\jVKREJc.exe
  C:\Windows\System\jVKREJc.exe
  2⤵
  PID:2256
- C:\Windows\System\lSmxxkJ.exe
  C:\Windows\System\lSmxxkJ.exe
  2⤵
  PID:1576
- C:\Windows\System\RnucSEN.exe
  C:\Windows\System\RnucSEN.exe
  2⤵
  PID:620
- C:\Windows\System\YvJZmim.exe
  C:\Windows\System\YvJZmim.exe
  2⤵
  PID:540
- C:\Windows\System\oDZxEzq.exe
  C:\Windows\System\oDZxEzq.exe
  2⤵
  PID:1520
- C:\Windows\System\obabXQH.exe
  C:\Windows\System\obabXQH.exe
  2⤵
  PID:704
- C:\Windows\System\FrOXoAK.exe
  C:\Windows\System\FrOXoAK.exe
  2⤵
  PID:452
- C:\Windows\System\zfBoRLd.exe
  C:\Windows\System\zfBoRLd.exe
  2⤵
  PID:1648
- C:\Windows\System\kYGCwbj.exe
  C:\Windows\System\kYGCwbj.exe
  2⤵
  PID:936
- C:\Windows\System\rugxyYj.exe
  C:\Windows\System\rugxyYj.exe
  2⤵
  PID:2164
- C:\Windows\System\gJXxJoP.exe
  C:\Windows\System\gJXxJoP.exe
  2⤵
  PID:688
- C:\Windows\System\PGObGBR.exe
  C:\Windows\System\PGObGBR.exe
  2⤵
  PID:2036
- C:\Windows\System\EMVQIsJ.exe
  C:\Windows\System\EMVQIsJ.exe
  2⤵
  PID:1232
- C:\Windows\System\navtccr.exe
  C:\Windows\System\navtccr.exe
  2⤵
  PID:1196
- C:\Windows\System\dhPoKku.exe
  C:\Windows\System\dhPoKku.exe
  2⤵
  PID:2636
- C:\Windows\System\fzHbnFF.exe
  C:\Windows\System\fzHbnFF.exe
  2⤵
  PID:2508
- C:\Windows\System\wcmVGuL.exe
  C:\Windows\System\wcmVGuL.exe
  2⤵
  PID:2708
- C:\Windows\System\KfLHVrI.exe
  C:\Windows\System\KfLHVrI.exe
  2⤵
  PID:1616
- C:\Windows\System\TcBlQaG.exe
  C:\Windows\System\TcBlQaG.exe
  2⤵
  PID:600
- C:\Windows\System\pMxoYyO.exe
  C:\Windows\System\pMxoYyO.exe
  2⤵
  PID:2812
- C:\Windows\System\agQxJWE.exe
  C:\Windows\System\agQxJWE.exe
  2⤵
  PID:1280
- C:\Windows\System\ZDXzGsv.exe
  C:\Windows\System\ZDXzGsv.exe
  2⤵
  PID:2344
- C:\Windows\System\dweZSMs.exe
  C:\Windows\System\dweZSMs.exe
  2⤵
  PID:860
- C:\Windows\System\jgRBkLd.exe
  C:\Windows\System\jgRBkLd.exe
  2⤵
  PID:2672
- C:\Windows\System\BXQphJm.exe
  C:\Windows\System\BXQphJm.exe
  2⤵
  PID:812
- C:\Windows\System\utkTnQp.exe
  C:\Windows\System\utkTnQp.exe
  2⤵
  PID:1052
- C:\Windows\System\CoMWkIc.exe
  C:\Windows\System\CoMWkIc.exe
  2⤵
  PID:2980
- C:\Windows\System\rDXPvQv.exe
  C:\Windows\System\rDXPvQv.exe
  2⤵
  PID:3016
- C:\Windows\System\dwuttBE.exe
  C:\Windows\System\dwuttBE.exe
  2⤵
  PID:2736
- C:\Windows\System\vfpatzD.exe
  C:\Windows\System\vfpatzD.exe
  2⤵
  PID:2492
- C:\Windows\System\rkCTRyg.exe
  C:\Windows\System\rkCTRyg.exe
  2⤵
  PID:2836
- C:\Windows\System\nGUUEIU.exe
  C:\Windows\System\nGUUEIU.exe
  2⤵
  PID:2216
- C:\Windows\System\ydFJjOI.exe
  C:\Windows\System\ydFJjOI.exe
  2⤵
  PID:2596
- C:\Windows\System\NnaJbYe.exe
  C:\Windows\System\NnaJbYe.exe
  2⤵
  PID:560
- C:\Windows\System\YINgcIo.exe
  C:\Windows\System\YINgcIo.exe
  2⤵
  PID:1740
- C:\Windows\System\bVUjaRl.exe
  C:\Windows\System\bVUjaRl.exe
  2⤵
  PID:956
- C:\Windows\System\SGMamKF.exe
  C:\Windows\System\SGMamKF.exe
  2⤵
  PID:2308
- C:\Windows\System\SHjEzuZ.exe
  C:\Windows\System\SHjEzuZ.exe
  2⤵
  PID:3080
- C:\Windows\System\PScLaau.exe
  C:\Windows\System\PScLaau.exe
  2⤵
  PID:3104
- C:\Windows\System\vzyvARo.exe
  C:\Windows\System\vzyvARo.exe
  2⤵
  PID:3120
- C:\Windows\System\hSIdyln.exe
  C:\Windows\System\hSIdyln.exe
  2⤵
  PID:3144
- C:\Windows\System\vsrJffR.exe
  C:\Windows\System\vsrJffR.exe
  2⤵
  PID:3160
- C:\Windows\System\pbCThyf.exe
  C:\Windows\System\pbCThyf.exe
  2⤵
  PID:3184
- C:\Windows\System\SXdcajs.exe
  C:\Windows\System\SXdcajs.exe
  2⤵
  PID:3204
- C:\Windows\System\pqRhfPr.exe
  C:\Windows\System\pqRhfPr.exe
  2⤵
  PID:3224
- C:\Windows\System\WBPDSQd.exe
  C:\Windows\System\WBPDSQd.exe
  2⤵
  PID:3244
- C:\Windows\System\VbAMgrB.exe
  C:\Windows\System\VbAMgrB.exe
  2⤵
  PID:3264
- C:\Windows\System\PEEHBdU.exe
  C:\Windows\System\PEEHBdU.exe
  2⤵
  PID:3284
- C:\Windows\System\afgZNoo.exe
  C:\Windows\System\afgZNoo.exe
  2⤵
  PID:3304
- C:\Windows\System\WBFLbCj.exe
  C:\Windows\System\WBFLbCj.exe
  2⤵
  PID:3324
- C:\Windows\System\YuNdtLp.exe
  C:\Windows\System\YuNdtLp.exe
  2⤵
  PID:3344
- C:\Windows\System\wVwnJnv.exe
  C:\Windows\System\wVwnJnv.exe
  2⤵
  PID:3364
- C:\Windows\System\tIPGlug.exe
  C:\Windows\System\tIPGlug.exe
  2⤵
  PID:3384
- C:\Windows\System\JsPBYKp.exe
  C:\Windows\System\JsPBYKp.exe
  2⤵
  PID:3404
- C:\Windows\System\VPvAXKL.exe
  C:\Windows\System\VPvAXKL.exe
  2⤵
  PID:3424
- C:\Windows\System\tUiLCYz.exe
  C:\Windows\System\tUiLCYz.exe
  2⤵
  PID:3444
- C:\Windows\System\ANMBOXq.exe
  C:\Windows\System\ANMBOXq.exe
  2⤵
  PID:3464
- C:\Windows\System\QhEkiQZ.exe
  C:\Windows\System\QhEkiQZ.exe
  2⤵
  PID:3484
- C:\Windows\System\ktjQdsP.exe
  C:\Windows\System\ktjQdsP.exe
  2⤵
  PID:3504
- C:\Windows\System\IaLfdDe.exe
  C:\Windows\System\IaLfdDe.exe
  2⤵
  PID:3524
- C:\Windows\System\OKfDnFi.exe
  C:\Windows\System\OKfDnFi.exe
  2⤵
  PID:3544
- C:\Windows\System\NqEEhSB.exe
  C:\Windows\System\NqEEhSB.exe
  2⤵
  PID:3564
- C:\Windows\System\mxoNXKa.exe
  C:\Windows\System\mxoNXKa.exe
  2⤵
  PID:3584
- C:\Windows\System\adJFMlp.exe
  C:\Windows\System\adJFMlp.exe
  2⤵
  PID:3604
- C:\Windows\System\dvEYQuI.exe
  C:\Windows\System\dvEYQuI.exe
  2⤵
  PID:3624
- C:\Windows\System\dXfWdhm.exe
  C:\Windows\System\dXfWdhm.exe
  2⤵
  PID:3644
- C:\Windows\System\cZPhLss.exe
  C:\Windows\System\cZPhLss.exe
  2⤵
  PID:3664
- C:\Windows\System\pPbQuko.exe
  C:\Windows\System\pPbQuko.exe
  2⤵
  PID:3688
- C:\Windows\System\TviKrOa.exe
  C:\Windows\System\TviKrOa.exe
  2⤵
  PID:3708
- C:\Windows\System\dCqxdkZ.exe
  C:\Windows\System\dCqxdkZ.exe
  2⤵
  PID:3728
- C:\Windows\System\jyvtsXF.exe
  C:\Windows\System\jyvtsXF.exe
  2⤵
  PID:3748
- C:\Windows\System\nGenfkP.exe
  C:\Windows\System\nGenfkP.exe
  2⤵
  PID:3768
- C:\Windows\System\JVZCBWi.exe
  C:\Windows\System\JVZCBWi.exe
  2⤵
  PID:3788
- C:\Windows\System\JHHnldo.exe
  C:\Windows\System\JHHnldo.exe
  2⤵
  PID:3808
- C:\Windows\System\YYunHEm.exe
  C:\Windows\System\YYunHEm.exe
  2⤵
  PID:3828
- C:\Windows\System\wLVOxLK.exe
  C:\Windows\System\wLVOxLK.exe
  2⤵
  PID:3848
- C:\Windows\System\oUXyxOo.exe
  C:\Windows\System\oUXyxOo.exe
  2⤵
  PID:3868
- C:\Windows\System\PsaqODq.exe
  C:\Windows\System\PsaqODq.exe
  2⤵
  PID:3888
- C:\Windows\System\wbUVPtA.exe
  C:\Windows\System\wbUVPtA.exe
  2⤵
  PID:3908
- C:\Windows\System\fjYMnKC.exe
  C:\Windows\System\fjYMnKC.exe
  2⤵
  PID:3928
- C:\Windows\System\yuEanxT.exe
  C:\Windows\System\yuEanxT.exe
  2⤵
  PID:3948
- C:\Windows\System\vLlCLGF.exe
  C:\Windows\System\vLlCLGF.exe
  2⤵
  PID:3972
- C:\Windows\System\svTvQCf.exe
  C:\Windows\System\svTvQCf.exe
  2⤵
  PID:3992
- C:\Windows\System\BYYlQlO.exe
  C:\Windows\System\BYYlQlO.exe
  2⤵
  PID:4016
- C:\Windows\System\GhONPYe.exe
  C:\Windows\System\GhONPYe.exe
  2⤵
  PID:4036
- C:\Windows\System\sKCWzyc.exe
  C:\Windows\System\sKCWzyc.exe
  2⤵
  PID:4064
- C:\Windows\System\fFxXWQO.exe
  C:\Windows\System\fFxXWQO.exe
  2⤵
  PID:4088
- C:\Windows\System\hpgYmlD.exe
  C:\Windows\System\hpgYmlD.exe
  2⤵
  PID:2904
- C:\Windows\System\dnCnJBk.exe
  C:\Windows\System\dnCnJBk.exe
  2⤵
  PID:2912
- C:\Windows\System\KzxxgYQ.exe
  C:\Windows\System\KzxxgYQ.exe
  2⤵
  PID:3092
- C:\Windows\System\VrRumCe.exe
  C:\Windows\System\VrRumCe.exe
  2⤵
  PID:3076
- C:\Windows\System\mbnHxPy.exe
  C:\Windows\System\mbnHxPy.exe
  2⤵
  PID:3112
- C:\Windows\System\GsIRTpE.exe
  C:\Windows\System\GsIRTpE.exe
  2⤵
  PID:3172
- C:\Windows\System\omzZLUN.exe
  C:\Windows\System\omzZLUN.exe
  2⤵
  PID:3200
- C:\Windows\System\rRmNiFB.exe
  C:\Windows\System\rRmNiFB.exe
  2⤵
  PID:3220
- C:\Windows\System\mjDcOxs.exe
  C:\Windows\System\mjDcOxs.exe
  2⤵
  PID:3252
- C:\Windows\System\xucTjOp.exe
  C:\Windows\System\xucTjOp.exe
  2⤵
  PID:348
- C:\Windows\System\KNzwJLq.exe
  C:\Windows\System\KNzwJLq.exe
  2⤵
  PID:3296
- C:\Windows\System\hsOhsHY.exe
  C:\Windows\System\hsOhsHY.exe
  2⤵
  PID:3316
- C:\Windows\System\sOQUCRu.exe
  C:\Windows\System\sOQUCRu.exe
  2⤵
  PID:3372
- C:\Windows\System\nObzkKn.exe
  C:\Windows\System\nObzkKn.exe
  2⤵
  PID:3360
- C:\Windows\System\CjvetUT.exe
  C:\Windows\System\CjvetUT.exe
  2⤵
  PID:3416
- C:\Windows\System\OvwKEQR.exe
  C:\Windows\System\OvwKEQR.exe
  2⤵
  PID:3432
- C:\Windows\System\XAuXEFL.exe
  C:\Windows\System\XAuXEFL.exe
  2⤵
  PID:3500
- C:\Windows\System\qbuikNp.exe
  C:\Windows\System\qbuikNp.exe
  2⤵
  PID:2856
- C:\Windows\System\JBIARos.exe
  C:\Windows\System\JBIARos.exe
  2⤵
  PID:3516
- C:\Windows\System\czfPcwq.exe
  C:\Windows\System\czfPcwq.exe
  2⤵
  PID:3572
- C:\Windows\System\RLAioEP.exe
  C:\Windows\System\RLAioEP.exe
  2⤵
  PID:1860
- C:\Windows\System\VrHNxkP.exe
  C:\Windows\System\VrHNxkP.exe
  2⤵
  PID:3612
- C:\Windows\System\YPauqDh.exe
  C:\Windows\System\YPauqDh.exe
  2⤵
  PID:3596
- C:\Windows\System\ncqyJYJ.exe
  C:\Windows\System\ncqyJYJ.exe
  2⤵
  PID:3656
- C:\Windows\System\asCkoYA.exe
  C:\Windows\System\asCkoYA.exe
  2⤵
  PID:1040
- C:\Windows\System\RlilRbd.exe
  C:\Windows\System\RlilRbd.exe
  2⤵
  PID:3676
- C:\Windows\System\IDKoCkN.exe
  C:\Windows\System\IDKoCkN.exe
  2⤵
  PID:3724
- C:\Windows\System\jsvyrHP.exe
  C:\Windows\System\jsvyrHP.exe
  2⤵
  PID:3776
- C:\Windows\System\UNmBhsz.exe
  C:\Windows\System\UNmBhsz.exe
  2⤵
  PID:3760
- C:\Windows\System\ZVqCWNZ.exe
  C:\Windows\System\ZVqCWNZ.exe
  2⤵
  PID:400
- C:\Windows\System\wXsmydW.exe
  C:\Windows\System\wXsmydW.exe
  2⤵
  PID:3820
- C:\Windows\System\dpSopUB.exe
  C:\Windows\System\dpSopUB.exe
  2⤵
  PID:3836
- C:\Windows\System\wHYYqoZ.exe
  C:\Windows\System\wHYYqoZ.exe
  2⤵
  PID:3840
- C:\Windows\System\kqEwWEH.exe
  C:\Windows\System\kqEwWEH.exe
  2⤵
  PID:3884
- C:\Windows\System\ofueXsK.exe
  C:\Windows\System\ofueXsK.exe
  2⤵
  PID:3916
- C:\Windows\System\iFbNnEI.exe
  C:\Windows\System\iFbNnEI.exe
  2⤵
  PID:3980
- C:\Windows\System\JkMKeVu.exe
  C:\Windows\System\JkMKeVu.exe
  2⤵
  PID:2556
- C:\Windows\System\okdUrsr.exe
  C:\Windows\System\okdUrsr.exe
  2⤵
  PID:4048
- C:\Windows\System\nLKVHnN.exe
  C:\Windows\System\nLKVHnN.exe
  2⤵
  PID:4060
- C:\Windows\System\FdJMsNy.exe
  C:\Windows\System\FdJMsNy.exe
  2⤵
  PID:2960
- C:\Windows\System\Phhpivc.exe
  C:\Windows\System\Phhpivc.exe
  2⤵
  PID:1804
- C:\Windows\System\jaUpHdj.exe
  C:\Windows\System\jaUpHdj.exe
  2⤵
  PID:2076
- C:\Windows\System\DaLzJjH.exe
  C:\Windows\System\DaLzJjH.exe
  2⤵
  PID:1156
- C:\Windows\System\rUokiHJ.exe
  C:\Windows\System\rUokiHJ.exe
  2⤵
  PID:2260
- C:\Windows\System\GsZyDAI.exe
  C:\Windows\System\GsZyDAI.exe
  2⤵
  PID:2824
- C:\Windows\System\vGifFCH.exe
  C:\Windows\System\vGifFCH.exe
  2⤵
  PID:3680
- C:\Windows\System\xGAAUke.exe
  C:\Windows\System\xGAAUke.exe
  2⤵
  PID:1980
- C:\Windows\System\EQOHbUM.exe
  C:\Windows\System\EQOHbUM.exe
  2⤵
  PID:792
- C:\Windows\System\vNZddHD.exe
  C:\Windows\System\vNZddHD.exe
  2⤵
  PID:2408
- C:\Windows\System\meWlPXb.exe
  C:\Windows\System\meWlPXb.exe
  2⤵
  PID:1688
- C:\Windows\System\ZXxmjyZ.exe
  C:\Windows\System\ZXxmjyZ.exe
  2⤵
  PID:360
- C:\Windows\System\nxRfHws.exe
  C:\Windows\System\nxRfHws.exe
  2⤵
  PID:1932
- C:\Windows\System\BOxcrkq.exe
  C:\Windows\System\BOxcrkq.exe
  2⤵
  PID:3096
- C:\Windows\System\NzEEttU.exe
  C:\Windows\System\NzEEttU.exe
  2⤵
  PID:3140
- C:\Windows\System\sUxYCcn.exe
  C:\Windows\System\sUxYCcn.exe
  2⤵
  PID:2612
- C:\Windows\System\RHrHnAJ.exe
  C:\Windows\System\RHrHnAJ.exe
  2⤵
  PID:2364
- C:\Windows\System\xbkxqVJ.exe
  C:\Windows\System\xbkxqVJ.exe
  2⤵
  PID:3312
- C:\Windows\System\bWvGKbN.exe
  C:\Windows\System\bWvGKbN.exe
  2⤵
  PID:2664
- C:\Windows\System\aPxlZSI.exe
  C:\Windows\System\aPxlZSI.exe
  2⤵
  PID:3380
- C:\Windows\System\VAdvpli.exe
  C:\Windows\System\VAdvpli.exe
  2⤵
  PID:2792
- C:\Windows\System\dVJhIfp.exe
  C:\Windows\System\dVJhIfp.exe
  2⤵
  PID:3272
- C:\Windows\System\xtnpIYp.exe
  C:\Windows\System\xtnpIYp.exe
  2⤵
  PID:3492
- C:\Windows\System\HBxMlXz.exe
  C:\Windows\System\HBxMlXz.exe
  2⤵
  PID:3472
- C:\Windows\System\fRjVthJ.exe
  C:\Windows\System\fRjVthJ.exe
  2⤵
  PID:3476
- C:\Windows\System\BBSbAfR.exe
  C:\Windows\System\BBSbAfR.exe
  2⤵
  PID:3556
- C:\Windows\System\hMcrmgk.exe
  C:\Windows\System\hMcrmgk.exe
  2⤵
  PID:3580
- C:\Windows\System\JMNfSxr.exe
  C:\Windows\System\JMNfSxr.exe
  2⤵
  PID:1624
- C:\Windows\System\IbDEJQO.exe
  C:\Windows\System\IbDEJQO.exe
  2⤵
  PID:3940
- C:\Windows\System\dbEFtgn.exe
  C:\Windows\System\dbEFtgn.exe
  2⤵
  PID:4008
- C:\Windows\System\xmWdRLR.exe
  C:\Windows\System\xmWdRLR.exe
  2⤵
  PID:3988
- C:\Windows\System\QiumTFZ.exe
  C:\Windows\System\QiumTFZ.exe
  2⤵
  PID:4072
- C:\Windows\System\QcxggIL.exe
  C:\Windows\System\QcxggIL.exe
  2⤵
  PID:4080
- C:\Windows\System\WsccwHU.exe
  C:\Windows\System\WsccwHU.exe
  2⤵
  PID:1660
- C:\Windows\System\REcPVZV.exe
  C:\Windows\System\REcPVZV.exe
  2⤵
  PID:3168
- C:\Windows\System\suWXiXk.exe
  C:\Windows\System\suWXiXk.exe
  2⤵
  PID:3400
- C:\Windows\System\mdXoqaP.exe
  C:\Windows\System\mdXoqaP.exe
  2⤵
  PID:804
- C:\Windows\System\BIxnsXS.exe
  C:\Windows\System\BIxnsXS.exe
  2⤵
  PID:1544
- C:\Windows\System\eRrMOvS.exe
  C:\Windows\System\eRrMOvS.exe
  2⤵
  PID:1296
- C:\Windows\System\qEXvVEL.exe
  C:\Windows\System\qEXvVEL.exe
  2⤵
  PID:2732
- C:\Windows\System\wbOvGTl.exe
  C:\Windows\System\wbOvGTl.exe
  2⤵
  PID:3196
- C:\Windows\System\MUgQMqD.exe
  C:\Windows\System\MUgQMqD.exe
  2⤵
  PID:2900
- C:\Windows\System\uOlGXAq.exe
  C:\Windows\System\uOlGXAq.exe
  2⤵
  PID:3636
- C:\Windows\System\TZXqPHU.exe
  C:\Windows\System\TZXqPHU.exe
  2⤵
  PID:2844
- C:\Windows\System\kxNtVRI.exe
  C:\Windows\System\kxNtVRI.exe
  2⤵
  PID:3736
- C:\Windows\System\IQMHIZg.exe
  C:\Windows\System\IQMHIZg.exe
  2⤵
  PID:1920
- C:\Windows\System\MEKdbSL.exe
  C:\Windows\System\MEKdbSL.exe
  2⤵
  PID:3256
- C:\Windows\System\GhOrlYb.exe
  C:\Windows\System\GhOrlYb.exe
  2⤵
  PID:3856
- C:\Windows\System\zUfYhEp.exe
  C:\Windows\System\zUfYhEp.exe
  2⤵
  PID:2360
- C:\Windows\System\nvDlPbA.exe
  C:\Windows\System\nvDlPbA.exe
  2⤵
  PID:3920
- C:\Windows\System\QjZwLlc.exe
  C:\Windows\System\QjZwLlc.exe
  2⤵
  PID:1992
- C:\Windows\System\cPGJODs.exe
  C:\Windows\System\cPGJODs.exe
  2⤵
  PID:3292
- C:\Windows\System\SYCNrqw.exe
  C:\Windows\System\SYCNrqw.exe
  2⤵
  PID:3536
- C:\Windows\System\kqhNWQx.exe
  C:\Windows\System\kqhNWQx.exe
  2⤵
  PID:3968
- C:\Windows\System\OINOcNu.exe
  C:\Windows\System\OINOcNu.exe
  2⤵
  PID:2660
- C:\Windows\System\bLSolcx.exe
  C:\Windows\System\bLSolcx.exe
  2⤵
  PID:4044
- C:\Windows\System\JjrUOvU.exe
  C:\Windows\System\JjrUOvU.exe
  2⤵
  PID:4100
- C:\Windows\System\NBFxaqc.exe
  C:\Windows\System\NBFxaqc.exe
  2⤵
  PID:4124
- C:\Windows\System\rzVSxhO.exe
  C:\Windows\System\rzVSxhO.exe
  2⤵
  PID:4144
- C:\Windows\System\dHXcImk.exe
  C:\Windows\System\dHXcImk.exe
  2⤵
  PID:4168
- C:\Windows\System\xpfQfPo.exe
  C:\Windows\System\xpfQfPo.exe
  2⤵
  PID:4260
- C:\Windows\System\BYBIRPN.exe
  C:\Windows\System\BYBIRPN.exe
  2⤵
  PID:4276
- C:\Windows\System\PsSObcc.exe
  C:\Windows\System\PsSObcc.exe
  2⤵
  PID:4312
- C:\Windows\System\BGlRZbn.exe
  C:\Windows\System\BGlRZbn.exe
  2⤵
  PID:4344
- C:\Windows\System\xMiWJSW.exe
  C:\Windows\System\xMiWJSW.exe
  2⤵
  PID:4360
- C:\Windows\System\KlkNcxa.exe
  C:\Windows\System\KlkNcxa.exe
  2⤵
  PID:4376
- C:\Windows\System\UDkUXUg.exe
  C:\Windows\System\UDkUXUg.exe
  2⤵
  PID:4392
- C:\Windows\System\eRdgEmJ.exe
  C:\Windows\System\eRdgEmJ.exe
  2⤵
  PID:4416
- C:\Windows\System\lYSqDYN.exe
  C:\Windows\System\lYSqDYN.exe
  2⤵
  PID:4436
- C:\Windows\System\LHQeawL.exe
  C:\Windows\System\LHQeawL.exe
  2⤵
  PID:4452
- C:\Windows\System\ZdkgHAA.exe
  C:\Windows\System\ZdkgHAA.exe
  2⤵
  PID:4472
- C:\Windows\System\ZoSOxOq.exe
  C:\Windows\System\ZoSOxOq.exe
  2⤵
  PID:4488
- C:\Windows\System\yysxbmk.exe
  C:\Windows\System\yysxbmk.exe
  2⤵
  PID:4504
- C:\Windows\System\mqDUXCD.exe
  C:\Windows\System\mqDUXCD.exe
  2⤵
  PID:4520
- C:\Windows\System\SNnljvg.exe
  C:\Windows\System\SNnljvg.exe
  2⤵
  PID:4540
- C:\Windows\System\LWpVlNc.exe
  C:\Windows\System\LWpVlNc.exe
  2⤵
  PID:4576
- C:\Windows\System\qTqylHN.exe
  C:\Windows\System\qTqylHN.exe
  2⤵
  PID:4596
- C:\Windows\System\FFxARgp.exe
  C:\Windows\System\FFxARgp.exe
  2⤵
  PID:4612
- C:\Windows\System\YlfqJCM.exe
  C:\Windows\System\YlfqJCM.exe
  2⤵
  PID:4628
- C:\Windows\System\EJBEzBy.exe
  C:\Windows\System\EJBEzBy.exe
  2⤵
  PID:4644
- C:\Windows\System\ULRxHQM.exe
  C:\Windows\System\ULRxHQM.exe
  2⤵
  PID:4664
- C:\Windows\System\opeCpVv.exe
  C:\Windows\System\opeCpVv.exe
  2⤵
  PID:4708
- C:\Windows\System\IXunPpG.exe
  C:\Windows\System\IXunPpG.exe
  2⤵
  PID:4724
- C:\Windows\System\TtIAaXG.exe
  C:\Windows\System\TtIAaXG.exe
  2⤵
  PID:4740
- C:\Windows\System\tfhdIMU.exe
  C:\Windows\System\tfhdIMU.exe
  2⤵
  PID:4756
- C:\Windows\System\FrKSSxP.exe
  C:\Windows\System\FrKSSxP.exe
  2⤵
  PID:4772
- C:\Windows\System\dMvNtYA.exe
  C:\Windows\System\dMvNtYA.exe
  2⤵
  PID:4828
- C:\Windows\System\KquTSnW.exe
  C:\Windows\System\KquTSnW.exe
  2⤵
  PID:4860
- C:\Windows\System\kUbrsTQ.exe
  C:\Windows\System\kUbrsTQ.exe
  2⤵
  PID:4876
- C:\Windows\System\jtOeWzZ.exe
  C:\Windows\System\jtOeWzZ.exe
  2⤵
  PID:4896
- C:\Windows\System\cKLBODb.exe
  C:\Windows\System\cKLBODb.exe
  2⤵
  PID:4912
- C:\Windows\System\NYXVGbv.exe
  C:\Windows\System\NYXVGbv.exe
  2⤵
  PID:4928
- C:\Windows\System\yUCEuVe.exe
  C:\Windows\System\yUCEuVe.exe
  2⤵
  PID:4948
- C:\Windows\System\PdZmWJH.exe
  C:\Windows\System\PdZmWJH.exe
  2⤵
  PID:4980
- C:\Windows\System\GoZdbKz.exe
  C:\Windows\System\GoZdbKz.exe
  2⤵
  PID:5000
- C:\Windows\System\EfBFdxx.exe
  C:\Windows\System\EfBFdxx.exe
  2⤵
  PID:5016
- C:\Windows\System\PbHjZFe.exe
  C:\Windows\System\PbHjZFe.exe
  2⤵
  PID:5032
- C:\Windows\System\HXooeid.exe
  C:\Windows\System\HXooeid.exe
  2⤵
  PID:5048
- C:\Windows\System\vzQdsHP.exe
  C:\Windows\System\vzQdsHP.exe
  2⤵
  PID:5068
- C:\Windows\System\oaMiTVu.exe
  C:\Windows\System\oaMiTVu.exe
  2⤵
  PID:5084
- C:\Windows\System\qvBglzM.exe
  C:\Windows\System\qvBglzM.exe
  2⤵
  PID:5100
- C:\Windows\System\VzysIcY.exe
  C:\Windows\System\VzysIcY.exe
  2⤵
  PID:5116
- C:\Windows\System\PrTlIJB.exe
  C:\Windows\System\PrTlIJB.exe
  2⤵
  PID:2940
- C:\Windows\System\VGbmDAm.exe
  C:\Windows\System\VGbmDAm.exe
  2⤵
  PID:4024
- C:\Windows\System\DJnzzgK.exe
  C:\Windows\System\DJnzzgK.exe
  2⤵
  PID:4000
- C:\Windows\System\PfpFXcH.exe
  C:\Windows\System\PfpFXcH.exe
  2⤵
  PID:3600
- C:\Windows\System\KtADDmN.exe
  C:\Windows\System\KtADDmN.exe
  2⤵
  PID:2512
- C:\Windows\System\MsNtBeQ.exe
  C:\Windows\System\MsNtBeQ.exe
  2⤵
  PID:3704
- C:\Windows\System\fnrgHKg.exe
  C:\Windows\System\fnrgHKg.exe
  2⤵
  PID:3756
- C:\Windows\System\uWEaSEg.exe
  C:\Windows\System\uWEaSEg.exe
  2⤵
  PID:2532
- C:\Windows\System\HDtFJhQ.exe
  C:\Windows\System\HDtFJhQ.exe
  2⤵
  PID:3420
- C:\Windows\System\AQqjVpQ.exe
  C:\Windows\System\AQqjVpQ.exe
  2⤵
  PID:4156
- C:\Windows\System\cQiyRQi.exe
  C:\Windows\System\cQiyRQi.exe
  2⤵
  PID:4180
- C:\Windows\System\VdrjSTm.exe
  C:\Windows\System\VdrjSTm.exe
  2⤵
  PID:4196
- C:\Windows\System\PapkWPC.exe
  C:\Windows\System\PapkWPC.exe
  2⤵
  PID:4212
- C:\Windows\System\VvEaBav.exe
  C:\Windows\System\VvEaBav.exe
  2⤵
  PID:4228
- C:\Windows\System\QhBGRAT.exe
  C:\Windows\System\QhBGRAT.exe
  2⤵
  PID:4284
- C:\Windows\System\fxEcFfS.exe
  C:\Windows\System\fxEcFfS.exe
  2⤵
  PID:4308
- C:\Windows\System\VHSSwir.exe
  C:\Windows\System\VHSSwir.exe
  2⤵
  PID:4176
- C:\Windows\System\htNgKmi.exe
  C:\Windows\System\htNgKmi.exe
  2⤵
  PID:2032
- C:\Windows\System\wXHsHwQ.exe
  C:\Windows\System\wXHsHwQ.exe
  2⤵
  PID:4404
- C:\Windows\System\QaZudsH.exe
  C:\Windows\System\QaZudsH.exe
  2⤵
  PID:4444
- C:\Windows\System\WCytZBY.exe
  C:\Windows\System\WCytZBY.exe
  2⤵
  PID:4428
- C:\Windows\System\EfKaBFi.exe
  C:\Windows\System\EfKaBFi.exe
  2⤵
  PID:4496
- C:\Windows\System\HLsuFNX.exe
  C:\Windows\System\HLsuFNX.exe
  2⤵
  PID:4536
- C:\Windows\System\uUubJvO.exe
  C:\Windows\System\uUubJvO.exe
  2⤵
  PID:4516
- C:\Windows\System\lLhozVe.exe
  C:\Windows\System\lLhozVe.exe
  2⤵
  PID:4584
- C:\Windows\System\LtRXqen.exe
  C:\Windows\System\LtRXqen.exe
  2⤵
  PID:4636
- C:\Windows\System\yyFZaPP.exe
  C:\Windows\System\yyFZaPP.exe
  2⤵
  PID:4552
- C:\Windows\System\mQtxSNe.exe
  C:\Windows\System\mQtxSNe.exe
  2⤵
  PID:4656
- C:\Windows\System\YEdFxSb.exe
  C:\Windows\System\YEdFxSb.exe
  2⤵
  PID:4660
- C:\Windows\System\TPClvaX.exe
  C:\Windows\System\TPClvaX.exe
  2⤵
  PID:4692
- C:\Windows\System\HZRGplU.exe
  C:\Windows\System\HZRGplU.exe
  2⤵
  PID:4336
- C:\Windows\System\jHXsefk.exe
  C:\Windows\System\jHXsefk.exe
  2⤵
  PID:4792
- C:\Windows\System\ATUGxKS.exe
  C:\Windows\System\ATUGxKS.exe
  2⤵
  PID:4788
- C:\Windows\System\giZeXnY.exe
  C:\Windows\System\giZeXnY.exe
  2⤵
  PID:4824
- C:\Windows\System\qqgrVhN.exe
  C:\Windows\System\qqgrVhN.exe
  2⤵
  PID:4852
- C:\Windows\System\SvnPobL.exe
  C:\Windows\System\SvnPobL.exe
  2⤵
  PID:4904
- C:\Windows\System\mhMkEXS.exe
  C:\Windows\System\mhMkEXS.exe
  2⤵
  PID:4920
- C:\Windows\System\WBBAadi.exe
  C:\Windows\System\WBBAadi.exe
  2⤵
  PID:5056
- C:\Windows\System\FqmXwBI.exe
  C:\Windows\System\FqmXwBI.exe
  2⤵
  PID:5044
- C:\Windows\System\FdqmOHu.exe
  C:\Windows\System\FdqmOHu.exe
  2⤵
  PID:5080
- C:\Windows\System\JKBgMXh.exe
  C:\Windows\System\JKBgMXh.exe
  2⤵
  PID:3824
- C:\Windows\System\DHGHiSh.exe
  C:\Windows\System\DHGHiSh.exe
  2⤵
  PID:3900
- C:\Windows\System\wihXCwn.exe
  C:\Windows\System\wihXCwn.exe
  2⤵
  PID:3180
- C:\Windows\System\lTvTvWP.exe
  C:\Windows\System\lTvTvWP.exe
  2⤵
  PID:2228
- C:\Windows\System\RxuXNux.exe
  C:\Windows\System\RxuXNux.exe
  2⤵
  PID:3436
- C:\Windows\System\xjOfKpW.exe
  C:\Windows\System\xjOfKpW.exe
  2⤵
  PID:3956
- C:\Windows\System\xmQlxWU.exe
  C:\Windows\System\xmQlxWU.exe
  2⤵
  PID:3800
- C:\Windows\System\QhHOOir.exe
  C:\Windows\System\QhHOOir.exe
  2⤵
  PID:4140
- C:\Windows\System\TKWZqiM.exe
  C:\Windows\System\TKWZqiM.exe
  2⤵
  PID:4152
- C:\Windows\System\MALFvjW.exe
  C:\Windows\System\MALFvjW.exe
  2⤵
  PID:4208
- C:\Windows\System\HuqlrSg.exe
  C:\Windows\System\HuqlrSg.exe
  2⤵
  PID:2224
- C:\Windows\System\ibadHIc.exe
  C:\Windows\System\ibadHIc.exe
  2⤵
  PID:4340
- C:\Windows\System\XpXlKMc.exe
  C:\Windows\System\XpXlKMc.exe
  2⤵
  PID:4324
- C:\Windows\System\bogHLmM.exe
  C:\Windows\System\bogHLmM.exe
  2⤵
  PID:4588
- C:\Windows\System\nuJuVMA.exe
  C:\Windows\System\nuJuVMA.exe
  2⤵
  PID:4372
- C:\Windows\System\pEzIFVK.exe
  C:\Windows\System\pEzIFVK.exe
  2⤵
  PID:4484
- C:\Windows\System\YlgpoNF.exe
  C:\Windows\System\YlgpoNF.exe
  2⤵
  PID:4564
- C:\Windows\System\rNVmMnn.exe
  C:\Windows\System\rNVmMnn.exe
  2⤵
  PID:4716
- C:\Windows\System\jRHyZwR.exe
  C:\Windows\System\jRHyZwR.exe
  2⤵
  PID:4768
- C:\Windows\System\jeLEraD.exe
  C:\Windows\System\jeLEraD.exe
  2⤵
  PID:4604
- C:\Windows\System\WHVlAJc.exe
  C:\Windows\System\WHVlAJc.exe
  2⤵
  PID:4800
- C:\Windows\System\SSwBQkY.exe
  C:\Windows\System\SSwBQkY.exe
  2⤵
  PID:4820
- C:\Windows\System\OTADCbc.exe
  C:\Windows\System\OTADCbc.exe
  2⤵
  PID:4868
- C:\Windows\System\trIjtNd.exe
  C:\Windows\System\trIjtNd.exe
  2⤵
  PID:4888
- C:\Windows\System\tAZGCAd.exe
  C:\Windows\System\tAZGCAd.exe
  2⤵
  PID:4960
- C:\Windows\System\YVAjyzM.exe
  C:\Windows\System\YVAjyzM.exe
  2⤵
  PID:4996
- C:\Windows\System\fPbHTtP.exe
  C:\Windows\System\fPbHTtP.exe
  2⤵
  PID:5060
- C:\Windows\System\EituyDw.exe
  C:\Windows\System\EituyDw.exe
  2⤵
  PID:5040
- C:\Windows\System\qZgXhfv.exe
  C:\Windows\System\qZgXhfv.exe
  2⤵
  PID:1636
- C:\Windows\System\uyhkirF.exe
  C:\Windows\System\uyhkirF.exe
  2⤵
  PID:904
- C:\Windows\System\iKfaXxq.exe
  C:\Windows\System\iKfaXxq.exe
  2⤵
  PID:4192
- C:\Windows\System\wJqjtXi.exe
  C:\Windows\System\wJqjtXi.exe
  2⤵
  PID:4252
- C:\Windows\System\ViqxiBp.exe
  C:\Windows\System\ViqxiBp.exe
  2⤵
  PID:4568
- C:\Windows\System\ZpbwOYs.exe
  C:\Windows\System\ZpbwOYs.exe
  2⤵
  PID:4652
- C:\Windows\System\TmsQANT.exe
  C:\Windows\System\TmsQANT.exe
  2⤵
  PID:4812
- C:\Windows\System\pDKgIBH.exe
  C:\Windows\System\pDKgIBH.exe
  2⤵
  PID:4936
- C:\Windows\System\xKtvEXX.exe
  C:\Windows\System\xKtvEXX.exe
  2⤵
  PID:4204
- C:\Windows\System\wHdDHvP.exe
  C:\Windows\System\wHdDHvP.exe
  2⤵
  PID:2124
- C:\Windows\System\GWByQZV.exe
  C:\Windows\System\GWByQZV.exe
  2⤵
  PID:4836
- C:\Windows\System\mEQkaxF.exe
  C:\Windows\System\mEQkaxF.exe
  2⤵
  PID:4680
- C:\Windows\System\KFWjRtl.exe
  C:\Windows\System\KFWjRtl.exe
  2⤵
  PID:4556
- C:\Windows\System\nDQrNeS.exe
  C:\Windows\System\nDQrNeS.exe
  2⤵
  PID:4872
- C:\Windows\System\PTtocqg.exe
  C:\Windows\System\PTtocqg.exe
  2⤵
  PID:4368
- C:\Windows\System\YGcrMLg.exe
  C:\Windows\System\YGcrMLg.exe
  2⤵
  PID:4108
- C:\Windows\System\RuNSyAx.exe
  C:\Windows\System\RuNSyAx.exe
  2⤵
  PID:4848
- C:\Windows\System\hasUdAB.exe
  C:\Windows\System\hasUdAB.exe
  2⤵
  PID:1656
- C:\Windows\System\Mlptwmo.exe
  C:\Windows\System\Mlptwmo.exe
  2⤵
  PID:4688
- C:\Windows\System\NdFRarC.exe
  C:\Windows\System\NdFRarC.exe
  2⤵
  PID:4988
- C:\Windows\System\syTOGXo.exe
  C:\Windows\System\syTOGXo.exe
  2⤵
  PID:4844
- C:\Windows\System\smBoUsz.exe
  C:\Windows\System\smBoUsz.exe
  2⤵
  PID:3456
- C:\Windows\System\aTulSuY.exe
  C:\Windows\System\aTulSuY.exe
  2⤵
  PID:4780
- C:\Windows\System\EDtGzWN.exe
  C:\Windows\System\EDtGzWN.exe
  2⤵
  PID:4432
- C:\Windows\System\MzasJXm.exe
  C:\Windows\System\MzasJXm.exe
  2⤵
  PID:1328
- C:\Windows\System\VAePlDi.exe
  C:\Windows\System\VAePlDi.exe
  2⤵
  PID:4136
- C:\Windows\System\RvMINtx.exe
  C:\Windows\System\RvMINtx.exe
  2⤵
  PID:4964
- C:\Windows\System\PzjcExR.exe
  C:\Windows\System\PzjcExR.exe
  2⤵
  PID:3460
- C:\Windows\System\JvoLSSw.exe
  C:\Windows\System\JvoLSSw.exe
  2⤵
  PID:4976
- C:\Windows\System\jSRRrkd.exe
  C:\Windows\System\jSRRrkd.exe
  2⤵
  PID:4304
- C:\Windows\System\zmXOYxq.exe
  C:\Windows\System\zmXOYxq.exe
  2⤵
  PID:5028
- C:\Windows\System\HPvDtsh.exe
  C:\Windows\System\HPvDtsh.exe
  2⤵
  PID:4188
- C:\Windows\System\xijlvaA.exe
  C:\Windows\System\xijlvaA.exe
  2⤵
  PID:5124
- C:\Windows\System\baOvMGJ.exe
  C:\Windows\System\baOvMGJ.exe
  2⤵
  PID:5140
- C:\Windows\System\oiceBKm.exe
  C:\Windows\System\oiceBKm.exe
  2⤵
  PID:5160
- C:\Windows\System\dPHaEtO.exe
  C:\Windows\System\dPHaEtO.exe
  2⤵
  PID:5176
- C:\Windows\System\Lzlafmf.exe
  C:\Windows\System\Lzlafmf.exe
  2⤵
  PID:5192
- C:\Windows\System\GuncaRi.exe
  C:\Windows\System\GuncaRi.exe
  2⤵
  PID:5208
- C:\Windows\System\OoBNuuj.exe
  C:\Windows\System\OoBNuuj.exe
  2⤵
  PID:5224
- C:\Windows\System\PIXxdMX.exe
  C:\Windows\System\PIXxdMX.exe
  2⤵
  PID:5240
- C:\Windows\System\JgKdtan.exe
  C:\Windows\System\JgKdtan.exe
  2⤵
  PID:5264
- C:\Windows\System\dPOCjJS.exe
  C:\Windows\System\dPOCjJS.exe
  2⤵
  PID:5280
- C:\Windows\System\BqJILen.exe
  C:\Windows\System\BqJILen.exe
  2⤵
  PID:5296
- C:\Windows\System\nWuXgOO.exe
  C:\Windows\System\nWuXgOO.exe
  2⤵
  PID:5312
- C:\Windows\System\CsneSNU.exe
  C:\Windows\System\CsneSNU.exe
  2⤵
  PID:5332
- C:\Windows\System\WTEwDRq.exe
  C:\Windows\System\WTEwDRq.exe
  2⤵
  PID:5348
- C:\Windows\System\wrAIqbs.exe
  C:\Windows\System\wrAIqbs.exe
  2⤵
  PID:5364
- C:\Windows\System\zRngoqZ.exe
  C:\Windows\System\zRngoqZ.exe
  2⤵
  PID:5384
- C:\Windows\System\lBTwNwQ.exe
  C:\Windows\System\lBTwNwQ.exe
  2⤵
  PID:5400
- C:\Windows\System\SyvdfDG.exe
  C:\Windows\System\SyvdfDG.exe
  2⤵
  PID:5416
- C:\Windows\System\xZEnVnl.exe
  C:\Windows\System\xZEnVnl.exe
  2⤵
  PID:5432
- C:\Windows\System\eQuVREf.exe
  C:\Windows\System\eQuVREf.exe
  2⤵
  PID:5448
- C:\Windows\System\ANVxhug.exe
  C:\Windows\System\ANVxhug.exe
  2⤵
  PID:5468
- C:\Windows\System\CdtJtVH.exe
  C:\Windows\System\CdtJtVH.exe
  2⤵
  PID:5484
- C:\Windows\System\KmGRhfd.exe
  C:\Windows\System\KmGRhfd.exe
  2⤵
  PID:5500
- C:\Windows\System\zTghUMd.exe
  C:\Windows\System\zTghUMd.exe
  2⤵
  PID:5520
- C:\Windows\System\gojviZc.exe
  C:\Windows\System\gojviZc.exe
  2⤵
  PID:5536
- C:\Windows\System\lwjRgDo.exe
  C:\Windows\System\lwjRgDo.exe
  2⤵
  PID:5552
- C:\Windows\System\mAQIprv.exe
  C:\Windows\System\mAQIprv.exe
  2⤵
  PID:5572
- C:\Windows\System\pMeEMYs.exe
  C:\Windows\System\pMeEMYs.exe
  2⤵
  PID:5588
- C:\Windows\System\MchYToW.exe
  C:\Windows\System\MchYToW.exe
  2⤵
  PID:5604
- C:\Windows\System\blKPbJs.exe
  C:\Windows\System\blKPbJs.exe
  2⤵
  PID:5620
- C:\Windows\System\dgNHcsA.exe
  C:\Windows\System\dgNHcsA.exe
  2⤵
  PID:5636
- C:\Windows\System\WXswxTy.exe
  C:\Windows\System\WXswxTy.exe
  2⤵
  PID:5656
- C:\Windows\System\RzMxxvI.exe
  C:\Windows\System\RzMxxvI.exe
  2⤵
  PID:5672
- C:\Windows\System\qXgMbgf.exe
  C:\Windows\System\qXgMbgf.exe
  2⤵
  PID:5692
- C:\Windows\System\gvSixUQ.exe
  C:\Windows\System\gvSixUQ.exe
  2⤵
  PID:5708
- C:\Windows\System\RBTiGNT.exe
  C:\Windows\System\RBTiGNT.exe
  2⤵
  PID:5724
- C:\Windows\System\sEqBnWH.exe
  C:\Windows\System\sEqBnWH.exe
  2⤵
  PID:5740
- C:\Windows\System\qGVMiXi.exe
  C:\Windows\System\qGVMiXi.exe
  2⤵
  PID:5756
- C:\Windows\System\YsQSjUl.exe
  C:\Windows\System\YsQSjUl.exe
  2⤵
  PID:5776
- C:\Windows\System\iHjiusO.exe
  C:\Windows\System\iHjiusO.exe
  2⤵
  PID:5792
- C:\Windows\System\fguAWyq.exe
  C:\Windows\System\fguAWyq.exe
  2⤵
  PID:5808
- C:\Windows\System\BFVhFBL.exe
  C:\Windows\System\BFVhFBL.exe
  2⤵
  PID:5828
- C:\Windows\System\HdOLVGl.exe
  C:\Windows\System\HdOLVGl.exe
  2⤵
  PID:5848
- C:\Windows\System\dlZfsvQ.exe
  C:\Windows\System\dlZfsvQ.exe
  2⤵
  PID:5864
- C:\Windows\System\cWsnVIg.exe
  C:\Windows\System\cWsnVIg.exe
  2⤵
  PID:5900
- C:\Windows\System\JTwUFOF.exe
  C:\Windows\System\JTwUFOF.exe
  2⤵
  PID:5920
- C:\Windows\System\xKCFsRl.exe
  C:\Windows\System\xKCFsRl.exe
  2⤵
  PID:5936
- C:\Windows\System\SNtgrIY.exe
  C:\Windows\System\SNtgrIY.exe
  2⤵
  PID:5952
- C:\Windows\System\PffNBSk.exe
  C:\Windows\System\PffNBSk.exe
  2⤵
  PID:5968
- C:\Windows\System\rIhqFRN.exe
  C:\Windows\System\rIhqFRN.exe
  2⤵
  PID:5988
- C:\Windows\System\dtTPRXE.exe
  C:\Windows\System\dtTPRXE.exe
  2⤵
  PID:6004
- C:\Windows\System\lEDMutt.exe
  C:\Windows\System\lEDMutt.exe
  2⤵
  PID:6020
- C:\Windows\System\kQHdkfk.exe
  C:\Windows\System\kQHdkfk.exe
  2⤵
  PID:6036
- C:\Windows\System\BENKDyU.exe
  C:\Windows\System\BENKDyU.exe
  2⤵
  PID:6092
- C:\Windows\System\fwqgaWT.exe
  C:\Windows\System\fwqgaWT.exe
  2⤵
  PID:6108
- C:\Windows\System\gUcyQoy.exe
  C:\Windows\System\gUcyQoy.exe
  2⤵
  PID:6124
- C:\Windows\System\Mzsambj.exe
  C:\Windows\System\Mzsambj.exe
  2⤵
  PID:6140
- C:\Windows\System\BkQkDpt.exe
  C:\Windows\System\BkQkDpt.exe
  2⤵
  PID:5152
- C:\Windows\System\LOUsikd.exe
  C:\Windows\System\LOUsikd.exe
  2⤵
  PID:5184
- C:\Windows\System\LZsGMmz.exe
  C:\Windows\System\LZsGMmz.exe
  2⤵
  PID:5256
- C:\Windows\System\rjKhrDD.exe
  C:\Windows\System\rjKhrDD.exe
  2⤵
  PID:5320
- C:\Windows\System\BjFJFEs.exe
  C:\Windows\System\BjFJFEs.exe
  2⤵
  PID:5360
- C:\Windows\System\iERkGus.exe
  C:\Windows\System\iERkGus.exe
  2⤵
  PID:5428
- C:\Windows\System\yigaWnD.exe
  C:\Windows\System\yigaWnD.exe
  2⤵
  PID:5492
- C:\Windows\System\IMFErww.exe
  C:\Windows\System\IMFErww.exe
  2⤵
  PID:5532
- C:\Windows\System\uzTKoUx.exe
  C:\Windows\System\uzTKoUx.exe
  2⤵
  PID:5560
- C:\Windows\System\qviHDXD.exe
  C:\Windows\System\qviHDXD.exe
  2⤵
  PID:5596
- C:\Windows\System\USKAoCA.exe
  C:\Windows\System\USKAoCA.exe
  2⤵
  PID:5516
- C:\Windows\System\HiQQddJ.exe
  C:\Windows\System\HiQQddJ.exe
  2⤵
  PID:5132
- C:\Windows\System\xKFOAjp.exe
  C:\Windows\System\xKFOAjp.exe
  2⤵
  PID:4512
- C:\Windows\System\FWSvoVP.exe
  C:\Windows\System\FWSvoVP.exe
  2⤵
  PID:5168
- C:\Windows\System\QohCrrM.exe
  C:\Windows\System\QohCrrM.exe
  2⤵
  PID:5276
- C:\Windows\System\xYYpHpX.exe
  C:\Windows\System\xYYpHpX.exe
  2⤵
  PID:5340
- C:\Windows\System\rHtCXZL.exe
  C:\Windows\System\rHtCXZL.exe
  2⤵
  PID:5380
- C:\Windows\System\gsyIDKR.exe
  C:\Windows\System\gsyIDKR.exe
  2⤵
  PID:5440
- C:\Windows\System\pzBvfRj.exe
  C:\Windows\System\pzBvfRj.exe
  2⤵
  PID:5512
- C:\Windows\System\fkSCphN.exe
  C:\Windows\System\fkSCphN.exe
  2⤵
  PID:5544
- C:\Windows\System\oTzigCw.exe
  C:\Windows\System\oTzigCw.exe
  2⤵
  PID:5644
- C:\Windows\System\yIcCEYi.exe
  C:\Windows\System\yIcCEYi.exe
  2⤵
  PID:5680
- C:\Windows\System\OxcgsBC.exe
  C:\Windows\System\OxcgsBC.exe
  2⤵
  PID:5772
- C:\Windows\System\znQcZwz.exe
  C:\Windows\System\znQcZwz.exe
  2⤵
  PID:5800
- C:\Windows\System\XzSPfss.exe
  C:\Windows\System\XzSPfss.exe
  2⤵
  PID:5816
- C:\Windows\System\WOVtXhM.exe
  C:\Windows\System\WOVtXhM.exe
  2⤵
  PID:5844
- C:\Windows\System\MpJkPOr.exe
  C:\Windows\System\MpJkPOr.exe
  2⤵
  PID:5872
- C:\Windows\System\JRBRdIT.exe
  C:\Windows\System\JRBRdIT.exe
  2⤵
  PID:5892
- C:\Windows\System\xtaejWC.exe
  C:\Windows\System\xtaejWC.exe
  2⤵
  PID:5960
- C:\Windows\System\lmvUJnR.exe
  C:\Windows\System\lmvUJnR.exe
  2⤵
  PID:6028
- C:\Windows\System\mIYCdmQ.exe
  C:\Windows\System\mIYCdmQ.exe
  2⤵
  PID:5944
- C:\Windows\System\qPNcWBq.exe
  C:\Windows\System\qPNcWBq.exe
  2⤵
  PID:5984
- C:\Windows\System\SSZAEAn.exe
  C:\Windows\System\SSZAEAn.exe
  2⤵
  PID:6048
- C:\Windows\System\VJgrNGE.exe
  C:\Windows\System\VJgrNGE.exe
  2⤵
  PID:6064
- C:\Windows\System\kvBHJfS.exe
  C:\Windows\System\kvBHJfS.exe
  2⤵
  PID:6080
- C:\Windows\System\iwJlfan.exe
  C:\Windows\System\iwJlfan.exe
  2⤵
  PID:6132
- C:\Windows\System\GbUAZzy.exe
  C:\Windows\System\GbUAZzy.exe
  2⤵
  PID:6088
- C:\Windows\System\VBqgrQv.exe
  C:\Windows\System\VBqgrQv.exe
  2⤵
  PID:6116
- C:\Windows\System\qvBtztE.exe
  C:\Windows\System\qvBtztE.exe
  2⤵
  PID:5252
- C:\Windows\System\EKqRqrT.exe
  C:\Windows\System\EKqRqrT.exe
  2⤵
  PID:5356
- C:\Windows\System\vjCrcjZ.exe
  C:\Windows\System\vjCrcjZ.exe
  2⤵
  PID:5464
- C:\Windows\System\mpvEsmk.exe
  C:\Windows\System\mpvEsmk.exe
  2⤵
  PID:5408
- C:\Windows\System\CCWIJqH.exe
  C:\Windows\System\CCWIJqH.exe
  2⤵
  PID:4464
- C:\Windows\System\JJQWzAS.exe
  C:\Windows\System\JJQWzAS.exe
  2⤵
  PID:5476
- C:\Windows\System\XxXyLJT.exe
  C:\Windows\System\XxXyLJT.exe
  2⤵
  PID:5700
- C:\Windows\System\utvkGTA.exe
  C:\Windows\System\utvkGTA.exe
  2⤵
  PID:5580
- C:\Windows\System\JHqPgXx.exe
  C:\Windows\System\JHqPgXx.exe
  2⤵
  PID:5684
- C:\Windows\System\dfnbTZA.exe
  C:\Windows\System\dfnbTZA.exe
  2⤵
  PID:5736
- C:\Windows\System\PmjajAY.exe
  C:\Windows\System\PmjajAY.exe
  2⤵
  PID:5720
- C:\Windows\System\oBnDQVg.exe
  C:\Windows\System\oBnDQVg.exe
  2⤵
  PID:5788
- C:\Windows\System\TvikkXc.exe
  C:\Windows\System\TvikkXc.exe
  2⤵
  PID:5876
- C:\Windows\System\kWlkYFc.exe
  C:\Windows\System\kWlkYFc.exe
  2⤵
  PID:5912
- C:\Windows\System\WXgbbNW.exe
  C:\Windows\System\WXgbbNW.exe
  2⤵
  PID:5916
- C:\Windows\System\EgGJoZe.exe
  C:\Windows\System\EgGJoZe.exe
  2⤵
  PID:6060
- C:\Windows\System\lDwmVee.exe
  C:\Windows\System\lDwmVee.exe
  2⤵
  PID:5292
- C:\Windows\System\xxXzSju.exe
  C:\Windows\System\xxXzSju.exe
  2⤵
  PID:5248
- C:\Windows\System\fhtEwru.exe
  C:\Windows\System\fhtEwru.exe
  2⤵
  PID:4300
- C:\Windows\System\iOyqAvj.exe
  C:\Windows\System\iOyqAvj.exe
  2⤵
  PID:5024
- C:\Windows\System\onXubTi.exe
  C:\Windows\System\onXubTi.exe
  2⤵
  PID:5632
- C:\Windows\System\LcKbPbv.exe
  C:\Windows\System\LcKbPbv.exe
  2⤵
  PID:5344
- C:\Windows\System\uzzyFTZ.exe
  C:\Windows\System\uzzyFTZ.exe
  2⤵
  PID:5612
- C:\Windows\System\WXpfKfd.exe
  C:\Windows\System\WXpfKfd.exe
  2⤵
  PID:5768
- C:\Windows\System\pcxLMjL.exe
  C:\Windows\System\pcxLMjL.exe
  2⤵
  PID:6000
- C:\Windows\System\UQvqoXy.exe
  C:\Windows\System\UQvqoXy.exe
  2⤵
  PID:6016
- C:\Windows\System\jThapRe.exe
  C:\Windows\System\jThapRe.exe
  2⤵
  PID:6072
- C:\Windows\System\cyQipzI.exe
  C:\Windows\System\cyQipzI.exe
  2⤵
  PID:5528
- C:\Windows\System\ukuXqrF.exe
  C:\Windows\System\ukuXqrF.exe
  2⤵
  PID:5752
- C:\Windows\System\YWOKYlH.exe
  C:\Windows\System\YWOKYlH.exe
  2⤵
  PID:5328
- C:\Windows\System\gtpTYfe.exe
  C:\Windows\System\gtpTYfe.exe
  2⤵
  PID:5668
- C:\Windows\System\nqpLgwH.exe
  C:\Windows\System\nqpLgwH.exe
  2⤵
  PID:6056
- C:\Windows\System\ncxRmPF.exe
  C:\Windows\System\ncxRmPF.exe
  2⤵
  PID:5932
- C:\Windows\System\TQdJSBy.exe
  C:\Windows\System\TQdJSBy.exe
  2⤵
  PID:5480
- C:\Windows\System\iPmyxAu.exe
  C:\Windows\System\iPmyxAu.exe
  2⤵
  PID:6156
- C:\Windows\System\EBRurWy.exe
  C:\Windows\System\EBRurWy.exe
  2⤵
  PID:6172
- C:\Windows\System\biUhxvh.exe
  C:\Windows\System\biUhxvh.exe
  2⤵
  PID:6188
- C:\Windows\System\VZyDgOA.exe
  C:\Windows\System\VZyDgOA.exe
  2⤵
  PID:6204
- C:\Windows\System\DbXPMpv.exe
  C:\Windows\System\DbXPMpv.exe
  2⤵
  PID:6220
- C:\Windows\System\maPxHiE.exe
  C:\Windows\System\maPxHiE.exe
  2⤵
  PID:6236
- C:\Windows\System\pLqgwoh.exe
  C:\Windows\System\pLqgwoh.exe
  2⤵
  PID:6252
- C:\Windows\System\kBlLeHb.exe
  C:\Windows\System\kBlLeHb.exe
  2⤵
  PID:6268
- C:\Windows\System\WijiaTE.exe
  C:\Windows\System\WijiaTE.exe
  2⤵
  PID:6284
- C:\Windows\System\zqDXlhR.exe
  C:\Windows\System\zqDXlhR.exe
  2⤵
  PID:6300
- C:\Windows\System\jRwJoHn.exe
  C:\Windows\System\jRwJoHn.exe
  2⤵
  PID:6316
- C:\Windows\System\aAozZnT.exe
  C:\Windows\System\aAozZnT.exe
  2⤵
  PID:6332
- C:\Windows\System\RYpyyrZ.exe
  C:\Windows\System\RYpyyrZ.exe
  2⤵
  PID:6348
- C:\Windows\System\GnXFBDf.exe
  C:\Windows\System\GnXFBDf.exe
  2⤵
  PID:6364
- C:\Windows\System\KpXHAFs.exe
  C:\Windows\System\KpXHAFs.exe
  2⤵
  PID:6380
- C:\Windows\System\Nhufabk.exe
  C:\Windows\System\Nhufabk.exe
  2⤵
  PID:6396
- C:\Windows\System\yMGiiPa.exe
  C:\Windows\System\yMGiiPa.exe
  2⤵
  PID:6412
- C:\Windows\System\zXWGuve.exe
  C:\Windows\System\zXWGuve.exe
  2⤵
  PID:6428
- C:\Windows\System\MLBhXje.exe
  C:\Windows\System\MLBhXje.exe
  2⤵
  PID:6444
- C:\Windows\System\wPjSBjo.exe
  C:\Windows\System\wPjSBjo.exe
  2⤵
  PID:6460
- C:\Windows\System\vHwufLI.exe
  C:\Windows\System\vHwufLI.exe
  2⤵
  PID:6476
- C:\Windows\System\TlTYwBX.exe
  C:\Windows\System\TlTYwBX.exe
  2⤵
  PID:6492
- C:\Windows\System\WkDudKc.exe
  C:\Windows\System\WkDudKc.exe
  2⤵
  PID:6508
- C:\Windows\System\jeEXsUT.exe
  C:\Windows\System\jeEXsUT.exe
  2⤵
  PID:6524
- C:\Windows\System\BrVUnGc.exe
  C:\Windows\System\BrVUnGc.exe
  2⤵
  PID:6540
- C:\Windows\System\oolwHAw.exe
  C:\Windows\System\oolwHAw.exe
  2⤵
  PID:6556
- C:\Windows\System\bWNJPRP.exe
  C:\Windows\System\bWNJPRP.exe
  2⤵
  PID:6572
- C:\Windows\System\RqPPAwh.exe
  C:\Windows\System\RqPPAwh.exe
  2⤵
  PID:6588
- C:\Windows\System\cNjLtLU.exe
  C:\Windows\System\cNjLtLU.exe
  2⤵
  PID:6604
- C:\Windows\System\aImhDES.exe
  C:\Windows\System\aImhDES.exe
  2⤵
  PID:6620
- C:\Windows\System\QDMDxXz.exe
  C:\Windows\System\QDMDxXz.exe
  2⤵
  PID:6636
- C:\Windows\System\OynHhRt.exe
  C:\Windows\System\OynHhRt.exe
  2⤵
  PID:6652
- C:\Windows\System\WzyGwHM.exe
  C:\Windows\System\WzyGwHM.exe
  2⤵
  PID:6668
- C:\Windows\System\vLwkxTK.exe
  C:\Windows\System\vLwkxTK.exe
  2⤵
  PID:6684
- C:\Windows\System\zxhLdeF.exe
  C:\Windows\System\zxhLdeF.exe
  2⤵
  PID:6700
- C:\Windows\System\HdJevch.exe
  C:\Windows\System\HdJevch.exe
  2⤵
  PID:6716
- C:\Windows\System\LVWOJGe.exe
  C:\Windows\System\LVWOJGe.exe
  2⤵
  PID:6732
- C:\Windows\System\KlRzkob.exe
  C:\Windows\System\KlRzkob.exe
  2⤵
  PID:6748
- C:\Windows\System\FWstRsA.exe
  C:\Windows\System\FWstRsA.exe
  2⤵
  PID:6768
- C:\Windows\System\SaBYwuQ.exe
  C:\Windows\System\SaBYwuQ.exe
  2⤵
  PID:6784
- C:\Windows\System\XnsApJC.exe
  C:\Windows\System\XnsApJC.exe
  2⤵
  PID:6800
- C:\Windows\System\VPNtAsi.exe
  C:\Windows\System\VPNtAsi.exe
  2⤵
  PID:6816
- C:\Windows\System\RusfOfo.exe
  C:\Windows\System\RusfOfo.exe
  2⤵
  PID:6832
- C:\Windows\System\JaRkHjA.exe
  C:\Windows\System\JaRkHjA.exe
  2⤵
  PID:6848
- C:\Windows\System\PVWUCTu.exe
  C:\Windows\System\PVWUCTu.exe
  2⤵
  PID:6864
- C:\Windows\System\BBMuEyQ.exe
  C:\Windows\System\BBMuEyQ.exe
  2⤵
  PID:6880
- C:\Windows\System\ukbfzQY.exe
  C:\Windows\System\ukbfzQY.exe
  2⤵
  PID:6896
- C:\Windows\System\ykmrJfH.exe
  C:\Windows\System\ykmrJfH.exe
  2⤵
  PID:6912
- C:\Windows\System\QxbzjKH.exe
  C:\Windows\System\QxbzjKH.exe
  2⤵
  PID:6928
- C:\Windows\System\jEtEINM.exe
  C:\Windows\System\jEtEINM.exe
  2⤵
  PID:6944
- C:\Windows\System\iYTuRMe.exe
  C:\Windows\System\iYTuRMe.exe
  2⤵
  PID:6960
- C:\Windows\System\GgEydtg.exe
  C:\Windows\System\GgEydtg.exe
  2⤵
  PID:6980
- C:\Windows\System\OLNBojA.exe
  C:\Windows\System\OLNBojA.exe
  2⤵
  PID:6996
- C:\Windows\System\uuOalhB.exe
  C:\Windows\System\uuOalhB.exe
  2⤵
  PID:7012
- C:\Windows\System\MYZAYTF.exe
  C:\Windows\System\MYZAYTF.exe
  2⤵
  PID:7028
- C:\Windows\System\zCWzlVI.exe
  C:\Windows\System\zCWzlVI.exe
  2⤵
  PID:7044
- C:\Windows\System\XFhfCtm.exe
  C:\Windows\System\XFhfCtm.exe
  2⤵
  PID:7060
- C:\Windows\System\wIlGmMt.exe
  C:\Windows\System\wIlGmMt.exe
  2⤵
  PID:7076
- C:\Windows\System\ZJQNdux.exe
  C:\Windows\System\ZJQNdux.exe
  2⤵
  PID:7092
- C:\Windows\System\ZQaYQgL.exe
  C:\Windows\System\ZQaYQgL.exe
  2⤵
  PID:7108
- C:\Windows\System\dQHQBYz.exe
  C:\Windows\System\dQHQBYz.exe
  2⤵
  PID:7124
- C:\Windows\System\NnUtpwq.exe
  C:\Windows\System\NnUtpwq.exe
  2⤵
  PID:7140
- C:\Windows\System\SVktuEc.exe
  C:\Windows\System\SVktuEc.exe
  2⤵
  PID:7156
- C:\Windows\System\ZYdkVhz.exe
  C:\Windows\System\ZYdkVhz.exe
  2⤵
  PID:5996
- C:\Windows\System\QCwxFoP.exe
  C:\Windows\System\QCwxFoP.exe
  2⤵
  PID:6200
- C:\Windows\System\NQULNdU.exe
  C:\Windows\System\NQULNdU.exe
  2⤵
  PID:6264
- C:\Windows\System\mDkrYOx.exe
  C:\Windows\System\mDkrYOx.exe
  2⤵
  PID:6328
- C:\Windows\System\YmCNicE.exe
  C:\Windows\System\YmCNicE.exe
  2⤵
  PID:4084
- C:\Windows\System\haXyVBc.exe
  C:\Windows\System\haXyVBc.exe
  2⤵
  PID:6392
- C:\Windows\System\FZuMxvK.exe
  C:\Windows\System\FZuMxvK.exe
  2⤵
  PID:6484
- C:\Windows\System\NeOuRZD.exe
  C:\Windows\System\NeOuRZD.exe
  2⤵
  PID:6548
- C:\Windows\System\PzUbzMo.exe
  C:\Windows\System\PzUbzMo.exe
  2⤵
  PID:6212
- C:\Windows\System\XEHVSeu.exe
  C:\Windows\System\XEHVSeu.exe
  2⤵
  PID:6644
- C:\Windows\System\KKpEwAQ.exe
  C:\Windows\System\KKpEwAQ.exe
  2⤵
  PID:6680
- C:\Windows\System\ZEMRKky.exe
  C:\Windows\System\ZEMRKky.exe
  2⤵
  PID:6404
- C:\Windows\System\SHFgING.exe
  C:\Windows\System\SHFgING.exe
  2⤵
  PID:6500
- C:\Windows\System\tqZQfzY.exe
  C:\Windows\System\tqZQfzY.exe
  2⤵
  PID:6276
- C:\Windows\System\AatIzSu.exe
  C:\Windows\System\AatIzSu.exe
  2⤵
  PID:6340
- C:\Windows\System\EQwzoLS.exe
  C:\Windows\System\EQwzoLS.exe
  2⤵
  PID:6696
- C:\Windows\System\CdQjBZM.exe
  C:\Windows\System\CdQjBZM.exe
  2⤵
  PID:6468
- C:\Windows\System\aIeMtWC.exe
  C:\Windows\System\aIeMtWC.exe
  2⤵
  PID:6536
- C:\Windows\System\bunRjrq.exe
  C:\Windows\System\bunRjrq.exe
  2⤵
  PID:6692
- C:\Windows\System\dDxMhAH.exe
  C:\Windows\System\dDxMhAH.exe
  2⤵
  PID:6632
- C:\Windows\System\RZYyFEs.exe
  C:\Windows\System\RZYyFEs.exe
  2⤵
  PID:6776
- C:\Windows\System\NNaDxGY.exe
  C:\Windows\System\NNaDxGY.exe
  2⤵
  PID:6756
- C:\Windows\System\CfCDbLg.exe
  C:\Windows\System\CfCDbLg.exe
  2⤵
  PID:6792
- C:\Windows\System\svkvdXY.exe
  C:\Windows\System\svkvdXY.exe
  2⤵
  PID:6844
- C:\Windows\System\InEjPuq.exe
  C:\Windows\System\InEjPuq.exe
  2⤵
  PID:6860
- C:\Windows\System\xGMYCdd.exe
  C:\Windows\System\xGMYCdd.exe
  2⤵
  PID:6908
- C:\Windows\System\eoGsehf.exe
  C:\Windows\System\eoGsehf.exe
  2⤵
  PID:6940
- C:\Windows\System\iHlsbiS.exe
  C:\Windows\System\iHlsbiS.exe
  2⤵
  PID:6976
- C:\Windows\System\FcDtwEc.exe
  C:\Windows\System\FcDtwEc.exe
  2⤵
  PID:6992
- C:\Windows\System\pxHxTHw.exe
  C:\Windows\System\pxHxTHw.exe
  2⤵
  PID:7068
- C:\Windows\System\ZqcdeKl.exe
  C:\Windows\System\ZqcdeKl.exe
  2⤵
  PID:7024
- C:\Windows\System\TGTgfHC.exe
  C:\Windows\System\TGTgfHC.exe
  2⤵
  PID:7164
- C:\Windows\System\lrSsCPa.exe
  C:\Windows\System\lrSsCPa.exe
  2⤵
  PID:7088
- C:\Windows\System\nVdKMUH.exe
  C:\Windows\System\nVdKMUH.exe
  2⤵
  PID:6260
- C:\Windows\System\hTmzzPP.exe
  C:\Windows\System\hTmzzPP.exe
  2⤵
  PID:6180
- C:\Windows\System\nEoBvpS.exe
  C:\Windows\System\nEoBvpS.exe
  2⤵
  PID:6580
- C:\Windows\System\UERXbIZ.exe
  C:\Windows\System\UERXbIZ.exe
  2⤵
  PID:6516
- C:\Windows\System\TyNUJmE.exe
  C:\Windows\System\TyNUJmE.exe
  2⤵
  PID:6324
- C:\Windows\System\zcNduuf.exe
  C:\Windows\System\zcNduuf.exe
  2⤵
  PID:6148
- C:\Windows\System\IMBbGmB.exe
  C:\Windows\System\IMBbGmB.exe
  2⤵
  PID:6712
- C:\Windows\System\fvwUYTD.exe
  C:\Windows\System\fvwUYTD.exe
  2⤵
  PID:6248
- C:\Windows\System\RCMWySQ.exe
  C:\Windows\System\RCMWySQ.exe
  2⤵
  PID:6440
- C:\Windows\System\qFgEaty.exe
  C:\Windows\System\qFgEaty.exe
  2⤵
  PID:6532
- C:\Windows\System\faisZOO.exe
  C:\Windows\System\faisZOO.exe
  2⤵
  PID:6808
- C:\Windows\System\AoLtaqF.exe
  C:\Windows\System\AoLtaqF.exe
  2⤵
  PID:6628
- C:\Windows\System\MgffbhF.exe
  C:\Windows\System\MgffbhF.exe
  2⤵
  PID:6876
- C:\Windows\System\zJFLfcX.exe
  C:\Windows\System\zJFLfcX.exe
  2⤵
  PID:6924
- C:\Windows\System\pNgZIEi.exe
  C:\Windows\System\pNgZIEi.exe
  2⤵
  PID:6956
- C:\Windows\System\fZrtFPK.exe
  C:\Windows\System\fZrtFPK.exe
  2⤵
  PID:7100
- C:\Windows\System\jIjZuvQ.exe
  C:\Windows\System\jIjZuvQ.exe
  2⤵
  PID:7056
- C:\Windows\System\HURkuHM.exe
  C:\Windows\System\HURkuHM.exe
  2⤵
  PID:6232
- C:\Windows\System\giggVMV.exe
  C:\Windows\System\giggVMV.exe
  2⤵
  PID:5856
- C:\Windows\System\ILwQyIR.exe
  C:\Windows\System\ILwQyIR.exe
  2⤵
  PID:6296
- C:\Windows\System\FlfVMtu.exe
  C:\Windows\System\FlfVMtu.exe
  2⤵
  PID:6244
- C:\Windows\System\AsKiYsR.exe
  C:\Windows\System\AsKiYsR.exe
  2⤵
  PID:6744
- C:\Windows\System\xebhgAb.exe
  C:\Windows\System\xebhgAb.exe
  2⤵
  PID:6728
- C:\Windows\System\mFqbfPp.exe
  C:\Windows\System\mFqbfPp.exe
  2⤵
  PID:6904
- C:\Windows\System\kvXVXvg.exe
  C:\Windows\System\kvXVXvg.exe
  2⤵
  PID:7040
- C:\Windows\System\ByrZMth.exe
  C:\Windows\System\ByrZMth.exe
  2⤵
  PID:7084
- C:\Windows\System\HmeSxND.exe
  C:\Windows\System\HmeSxND.exe
  2⤵
  PID:6972
- C:\Windows\System\BFEynQQ.exe
  C:\Windows\System\BFEynQQ.exe
  2⤵
  PID:6892
- C:\Windows\System\fEBnvWu.exe
  C:\Windows\System\fEBnvWu.exe
  2⤵
  PID:6872
- C:\Windows\System\NnacewS.exe
  C:\Windows\System\NnacewS.exe
  2⤵
  PID:6664
- C:\Windows\System\KdtBtzc.exe
  C:\Windows\System\KdtBtzc.exe
  2⤵
  PID:6436
- C:\Windows\System\HKueXov.exe
  C:\Windows\System\HKueXov.exe
  2⤵
  PID:7180
- C:\Windows\System\gEIpEqJ.exe
  C:\Windows\System\gEIpEqJ.exe
  2⤵
  PID:7196
- C:\Windows\System\StEbgGA.exe
  C:\Windows\System\StEbgGA.exe
  2⤵
  PID:7216
- C:\Windows\System\gVMoJJP.exe
  C:\Windows\System\gVMoJJP.exe
  2⤵
  PID:7232
- C:\Windows\System\VLRgnLo.exe
  C:\Windows\System\VLRgnLo.exe
  2⤵
  PID:7248
- C:\Windows\System\jNWMchP.exe
  C:\Windows\System\jNWMchP.exe
  2⤵
  PID:7264
- C:\Windows\System\hEPKrNw.exe
  C:\Windows\System\hEPKrNw.exe
  2⤵
  PID:7280
- C:\Windows\System\mXIUWQS.exe
  C:\Windows\System\mXIUWQS.exe
  2⤵
  PID:7296
- C:\Windows\System\efXJhYh.exe
  C:\Windows\System\efXJhYh.exe
  2⤵
  PID:7312
- C:\Windows\System\JlyFMOh.exe
  C:\Windows\System\JlyFMOh.exe
  2⤵
  PID:7328
- C:\Windows\System\YLUTQFu.exe
  C:\Windows\System\YLUTQFu.exe
  2⤵
  PID:7344
- C:\Windows\System\WRtbGVH.exe
  C:\Windows\System\WRtbGVH.exe
  2⤵
  PID:7360
- C:\Windows\System\cthlLRN.exe
  C:\Windows\System\cthlLRN.exe
  2⤵
  PID:7376
- C:\Windows\System\GmlogCK.exe
  C:\Windows\System\GmlogCK.exe
  2⤵
  PID:7392
- C:\Windows\System\znZjHHp.exe
  C:\Windows\System\znZjHHp.exe
  2⤵
  PID:7408
- C:\Windows\System\YKBSPNJ.exe
  C:\Windows\System\YKBSPNJ.exe
  2⤵
  PID:7424
- C:\Windows\System\HurSWiy.exe
  C:\Windows\System\HurSWiy.exe
  2⤵
  PID:7440
- C:\Windows\System\sXsDXHm.exe
  C:\Windows\System\sXsDXHm.exe
  2⤵
  PID:7456
- C:\Windows\System\jmFWSKp.exe
  C:\Windows\System\jmFWSKp.exe
  2⤵
  PID:7472
- C:\Windows\System\lfHtkTn.exe
  C:\Windows\System\lfHtkTn.exe
  2⤵
  PID:7488
- C:\Windows\System\vVMnAhi.exe
  C:\Windows\System\vVMnAhi.exe
  2⤵
  PID:7504
- C:\Windows\System\bBNvEdI.exe
  C:\Windows\System\bBNvEdI.exe
  2⤵
  PID:7520
- C:\Windows\System\bNXPaPb.exe
  C:\Windows\System\bNXPaPb.exe
  2⤵
  PID:7536
- C:\Windows\System\DZcYZFA.exe
  C:\Windows\System\DZcYZFA.exe
  2⤵
  PID:7552
- C:\Windows\System\dkYGMHo.exe
  C:\Windows\System\dkYGMHo.exe
  2⤵
  PID:7568
- C:\Windows\System\jRqcZiH.exe
  C:\Windows\System\jRqcZiH.exe
  2⤵
  PID:7584
- C:\Windows\System\QpIZHFo.exe
  C:\Windows\System\QpIZHFo.exe
  2⤵
  PID:7600
- C:\Windows\System\ANCWAuI.exe
  C:\Windows\System\ANCWAuI.exe
  2⤵
  PID:7616
- C:\Windows\System\gZarvVn.exe
  C:\Windows\System\gZarvVn.exe
  2⤵
  PID:7632
- C:\Windows\System\GufNmFe.exe
  C:\Windows\System\GufNmFe.exe
  2⤵
  PID:7652
- C:\Windows\System\eIpeBNF.exe
  C:\Windows\System\eIpeBNF.exe
  2⤵
  PID:7668
- C:\Windows\System\oALaAgq.exe
  C:\Windows\System\oALaAgq.exe
  2⤵
  PID:7684
- C:\Windows\System\iRNqIcZ.exe
  C:\Windows\System\iRNqIcZ.exe
  2⤵
  PID:7700
- C:\Windows\System\BXraPef.exe
  C:\Windows\System\BXraPef.exe
  2⤵
  PID:7716
- C:\Windows\System\ZMAfPyv.exe
  C:\Windows\System\ZMAfPyv.exe
  2⤵
  PID:7732
- C:\Windows\System\HFFMObm.exe
  C:\Windows\System\HFFMObm.exe
  2⤵
  PID:7748
- C:\Windows\System\FvbYWCJ.exe
  C:\Windows\System\FvbYWCJ.exe
  2⤵
  PID:7768
- C:\Windows\System\SEBQLBl.exe
  C:\Windows\System\SEBQLBl.exe
  2⤵
  PID:7784
- C:\Windows\System\zmEATtM.exe
  C:\Windows\System\zmEATtM.exe
  2⤵
  PID:7800
- C:\Windows\System\ndVJSma.exe
  C:\Windows\System\ndVJSma.exe
  2⤵
  PID:7816
- C:\Windows\System\fJoxNTJ.exe
  C:\Windows\System\fJoxNTJ.exe
  2⤵
  PID:7832
- C:\Windows\System\otugKdD.exe
  C:\Windows\System\otugKdD.exe
  2⤵
  PID:7848
- C:\Windows\System\KUfKKeh.exe
  C:\Windows\System\KUfKKeh.exe
  2⤵
  PID:7864
- C:\Windows\System\IvpLmUy.exe
  C:\Windows\System\IvpLmUy.exe
  2⤵
  PID:7884
- C:\Windows\System\ZCYypiy.exe
  C:\Windows\System\ZCYypiy.exe
  2⤵
  PID:7900
- C:\Windows\System\gAGIWlS.exe
  C:\Windows\System\gAGIWlS.exe
  2⤵
  PID:7916
- C:\Windows\System\kFloxcv.exe
  C:\Windows\System\kFloxcv.exe
  2⤵
  PID:7932
- C:\Windows\System\xRbnxqV.exe
  C:\Windows\System\xRbnxqV.exe
  2⤵
  PID:7948
- C:\Windows\System\IeQFqtg.exe
  C:\Windows\System\IeQFqtg.exe
  2⤵
  PID:7964
- C:\Windows\System\cHGwgQW.exe
  C:\Windows\System\cHGwgQW.exe
  2⤵
  PID:7984
- C:\Windows\System\ncRCWYK.exe
  C:\Windows\System\ncRCWYK.exe
  2⤵
  PID:8000
- C:\Windows\System\mFlZrDa.exe
  C:\Windows\System\mFlZrDa.exe
  2⤵
  PID:8016
- C:\Windows\System\jGfTjsr.exe
  C:\Windows\System\jGfTjsr.exe
  2⤵
  PID:8032
- C:\Windows\System\BDvYeYq.exe
  C:\Windows\System\BDvYeYq.exe
  2⤵
  PID:8048
- C:\Windows\System\TBtqOEG.exe
  C:\Windows\System\TBtqOEG.exe
  2⤵
  PID:8064
- C:\Windows\System\rQtSDHn.exe
  C:\Windows\System\rQtSDHn.exe
  2⤵
  PID:8080
- C:\Windows\System\cVXpOQs.exe
  C:\Windows\System\cVXpOQs.exe
  2⤵
  PID:8096
- C:\Windows\System\yTwzoSq.exe
  C:\Windows\System\yTwzoSq.exe
  2⤵
  PID:8112
- C:\Windows\System\NKRBwIY.exe
  C:\Windows\System\NKRBwIY.exe
  2⤵
  PID:8128
- C:\Windows\System\lcNcXbZ.exe
  C:\Windows\System\lcNcXbZ.exe
  2⤵
  PID:8144
- C:\Windows\System\eaEwHhV.exe
  C:\Windows\System\eaEwHhV.exe
  2⤵
  PID:8160
- C:\Windows\System\gNvLjig.exe
  C:\Windows\System\gNvLjig.exe
  2⤵
  PID:8176
- C:\Windows\System\GeiDzuv.exe
  C:\Windows\System\GeiDzuv.exe
  2⤵
  PID:7172
- C:\Windows\System\HVBUoCc.exe
  C:\Windows\System\HVBUoCc.exe
  2⤵
  PID:6456
- C:\Windows\System\BEHhKyS.exe
  C:\Windows\System\BEHhKyS.exe
  2⤵
  PID:7204
- C:\Windows\System\ptvVEQn.exe
  C:\Windows\System\ptvVEQn.exe
  2⤵
  PID:7272
- C:\Windows\System\fSNElfY.exe
  C:\Windows\System\fSNElfY.exe
  2⤵
  PID:7308
- C:\Windows\System\pQorDTQ.exe
  C:\Windows\System\pQorDTQ.exe
  2⤵
  PID:7188
- C:\Windows\System\YDzbwkd.exe
  C:\Windows\System\YDzbwkd.exe
  2⤵
  PID:7224
- C:\Windows\System\cqrXZsR.exe
  C:\Windows\System\cqrXZsR.exe
  2⤵
  PID:7352
- C:\Windows\System\rqAZwZP.exe
  C:\Windows\System\rqAZwZP.exe
  2⤵
  PID:7356
- C:\Windows\System\MAZGSod.exe
  C:\Windows\System\MAZGSod.exe
  2⤵
  PID:7388
- C:\Windows\System\IDumxMM.exe
  C:\Windows\System\IDumxMM.exe
  2⤵
  PID:7416
- C:\Windows\System\pSoxfTs.exe
  C:\Windows\System\pSoxfTs.exe
  2⤵
  PID:7500
- C:\Windows\System\WxsIbNu.exe
  C:\Windows\System\WxsIbNu.exe
  2⤵
  PID:7448
- C:\Windows\System\PHyfIAX.exe
  C:\Windows\System\PHyfIAX.exe
  2⤵
  PID:7512
- C:\Windows\System\PWvKBho.exe
  C:\Windows\System\PWvKBho.exe
  2⤵
  PID:7548
- C:\Windows\System\eKajgAW.exe
  C:\Windows\System\eKajgAW.exe
  2⤵
  PID:7608
- C:\Windows\System\sQQGUFY.exe
  C:\Windows\System\sQQGUFY.exe
  2⤵
  PID:6616
- C:\Windows\System\hIzGatY.exe
  C:\Windows\System\hIzGatY.exe
  2⤵
  PID:7664
- C:\Windows\System\zAfDJiH.exe
  C:\Windows\System\zAfDJiH.exe
  2⤵
  PID:7696
- C:\Windows\System\MxQFNZq.exe
  C:\Windows\System\MxQFNZq.exe
  2⤵
  PID:7756
- C:\Windows\System\mOElixP.exe
  C:\Windows\System\mOElixP.exe
  2⤵
  PID:7712
- C:\Windows\System\QxYIgmW.exe
  C:\Windows\System\QxYIgmW.exe
  2⤵
  PID:7828
- C:\Windows\System\rxawfrk.exe
  C:\Windows\System\rxawfrk.exe
  2⤵
  PID:7856
- C:\Windows\System\ECANFWF.exe
  C:\Windows\System\ECANFWF.exe
  2⤵
  PID:7840
- C:\Windows\System\VhzHgke.exe
  C:\Windows\System\VhzHgke.exe
  2⤵
  PID:7896
- C:\Windows\System\UzWdIoO.exe
  C:\Windows\System\UzWdIoO.exe
  2⤵
  PID:7956
- C:\Windows\System\lDFbaQh.exe
  C:\Windows\System\lDFbaQh.exe
  2⤵
  PID:7940
- C:\Windows\System\CwaYULJ.exe
  C:\Windows\System\CwaYULJ.exe
  2⤵
  PID:7980
- C:\Windows\System\OoDlSgg.exe
  C:\Windows\System\OoDlSgg.exe
  2⤵
  PID:8028
- C:\Windows\System\aAMiTyd.exe
  C:\Windows\System\aAMiTyd.exe
  2⤵
  PID:8092
- C:\Windows\System\IpQVWmL.exe
  C:\Windows\System\IpQVWmL.exe
  2⤵
  PID:8156
- C:\Windows\System\HwEzXTc.exe
  C:\Windows\System\HwEzXTc.exe
  2⤵
  PID:8012
- C:\Windows\System\olVrPeu.exe
  C:\Windows\System\olVrPeu.exe
  2⤵
  PID:7304
- C:\Windows\System\rlLwxiT.exe
  C:\Windows\System\rlLwxiT.exe
  2⤵
  PID:7320
- C:\Windows\System\ckQDcnf.exe
  C:\Windows\System\ckQDcnf.exe
  2⤵
  PID:8104
- C:\Windows\System\dbrhepc.exe
  C:\Windows\System\dbrhepc.exe
  2⤵
  PID:8140
- C:\Windows\System\OPnqZtC.exe
  C:\Windows\System\OPnqZtC.exe
  2⤵
  PID:8172
- C:\Windows\System\XPuGXhQ.exe
  C:\Windows\System\XPuGXhQ.exe
  2⤵
  PID:7404
- C:\Windows\System\lkYxVJG.exe
  C:\Windows\System\lkYxVJG.exe
  2⤵
  PID:7256
- C:\Windows\System\RfmHaIA.exe
  C:\Windows\System\RfmHaIA.exe
  2⤵
  PID:7560
- C:\Windows\System\PLKzAFV.exe
  C:\Windows\System\PLKzAFV.exe
  2⤵
  PID:7612
- C:\Windows\System\ZNDnqGj.exe
  C:\Windows\System\ZNDnqGj.exe
  2⤵
  PID:7724
- C:\Windows\System\MVkVESB.exe
  C:\Windows\System\MVkVESB.exe
  2⤵
  PID:7872
- C:\Windows\System\dzXejYf.exe
  C:\Windows\System\dzXejYf.exe
  2⤵
  PID:7596
- C:\Windows\System\RlXXvCi.exe
  C:\Windows\System\RlXXvCi.exe
  2⤵
  PID:7912
- C:\Windows\System\sVBYgJW.exe
  C:\Windows\System\sVBYgJW.exe
  2⤵
  PID:7660
- C:\Windows\System\TObnrjY.exe
  C:\Windows\System\TObnrjY.exe
  2⤵
  PID:7740
- C:\Windows\System\bhBcuZm.exe
  C:\Windows\System\bhBcuZm.exe
  2⤵
  PID:8124
- C:\Windows\System\JznBcoD.exe
  C:\Windows\System\JznBcoD.exe
  2⤵
  PID:7928
- C:\Windows\System\PvNFigF.exe
  C:\Windows\System\PvNFigF.exe
  2⤵
  PID:8168
- C:\Windows\System\gRGXtrp.exe
  C:\Windows\System\gRGXtrp.exe
  2⤵
  PID:7288
- C:\Windows\System\iQkHCfd.exe
  C:\Windows\System\iQkHCfd.exe
  2⤵
  PID:7260
- C:\Windows\System\mFOSTQz.exe
  C:\Windows\System\mFOSTQz.exe
  2⤵
  PID:8188
- C:\Windows\System\wBHfvVq.exe
  C:\Windows\System\wBHfvVq.exe
  2⤵
  PID:7544
- C:\Windows\System\IzgOoBV.exe
  C:\Windows\System\IzgOoBV.exe
  2⤵
  PID:7776
- C:\Windows\System\cveNeFh.exe
  C:\Windows\System\cveNeFh.exe
  2⤵
  PID:7480
- C:\Windows\System\kpWuMdr.exe
  C:\Windows\System\kpWuMdr.exe
  2⤵
  PID:8008
- C:\Windows\System\fBcvGHa.exe
  C:\Windows\System\fBcvGHa.exe
  2⤵
  PID:8024
- C:\Windows\System\CXYpoba.exe
  C:\Windows\System\CXYpoba.exe
  2⤵
  PID:7924
- C:\Windows\System\nbrFkKJ.exe
  C:\Windows\System\nbrFkKJ.exe
  2⤵
  PID:8136
- C:\Windows\System\oDIoOXp.exe
  C:\Windows\System\oDIoOXp.exe
  2⤵
  PID:7532
- C:\Windows\System\DEZpbYF.exe
  C:\Windows\System\DEZpbYF.exe
  2⤵
  PID:7244
- C:\Windows\System\BxjeekX.exe
  C:\Windows\System\BxjeekX.exe
  2⤵
  PID:7648
- C:\Windows\System\FwKuNFZ.exe
  C:\Windows\System\FwKuNFZ.exe
  2⤵
  PID:8060
- C:\Windows\System\hcxKXZQ.exe
  C:\Windows\System\hcxKXZQ.exe
  2⤵
  PID:7876
- C:\Windows\System\LjccPvl.exe
  C:\Windows\System\LjccPvl.exe
  2⤵
  PID:8088
- C:\Windows\System\aIVbzoj.exe
  C:\Windows\System\aIVbzoj.exe
  2⤵
  PID:8208
- C:\Windows\System\LpAEbES.exe
  C:\Windows\System\LpAEbES.exe
  2⤵
  PID:8224
- C:\Windows\System\bJSwAvp.exe
  C:\Windows\System\bJSwAvp.exe
  2⤵
  PID:8240
- C:\Windows\System\fVBoroD.exe
  C:\Windows\System\fVBoroD.exe
  2⤵
  PID:8256
- C:\Windows\System\YKjRthu.exe
  C:\Windows\System\YKjRthu.exe
  2⤵
  PID:8272
- C:\Windows\System\lYgwHeC.exe
  C:\Windows\System\lYgwHeC.exe
  2⤵
  PID:8288
- C:\Windows\System\zreYley.exe
  C:\Windows\System\zreYley.exe
  2⤵
  PID:8304
- C:\Windows\System\dXMUCpN.exe
  C:\Windows\System\dXMUCpN.exe
  2⤵
  PID:8320
- C:\Windows\System\ahLhzeC.exe
  C:\Windows\System\ahLhzeC.exe
  2⤵
  PID:8336
- C:\Windows\System\DpYthNQ.exe
  C:\Windows\System\DpYthNQ.exe
  2⤵
  PID:8356
- C:\Windows\System\zMErHxR.exe
  C:\Windows\System\zMErHxR.exe
  2⤵
  PID:8372
- C:\Windows\System\sShaLTG.exe
  C:\Windows\System\sShaLTG.exe
  2⤵
  PID:8388
- C:\Windows\System\oOQjXLx.exe
  C:\Windows\System\oOQjXLx.exe
  2⤵
  PID:8404
- C:\Windows\System\BEHLRNW.exe
  C:\Windows\System\BEHLRNW.exe
  2⤵
  PID:8420
- C:\Windows\System\jItdgox.exe
  C:\Windows\System\jItdgox.exe
  2⤵
  PID:8436
- C:\Windows\System\TYlytCc.exe
  C:\Windows\System\TYlytCc.exe
  2⤵
  PID:8452
- C:\Windows\System\rPnSVJn.exe
  C:\Windows\System\rPnSVJn.exe
  2⤵
  PID:8468
- C:\Windows\System\ZuPkPAT.exe
  C:\Windows\System\ZuPkPAT.exe
  2⤵
  PID:8484
- C:\Windows\System\RgwuUfI.exe
  C:\Windows\System\RgwuUfI.exe
  2⤵
  PID:8500
- C:\Windows\System\gfPNysT.exe
  C:\Windows\System\gfPNysT.exe
  2⤵
  PID:8516
- C:\Windows\System\FYTtujC.exe
  C:\Windows\System\FYTtujC.exe
  2⤵
  PID:8532
- C:\Windows\System\NgVVQjF.exe
  C:\Windows\System\NgVVQjF.exe
  2⤵
  PID:8548
- C:\Windows\System\ZNCvGeN.exe
  C:\Windows\System\ZNCvGeN.exe
  2⤵
  PID:8564
- C:\Windows\System\vzTrbQs.exe
  C:\Windows\System\vzTrbQs.exe
  2⤵
  PID:8580
- C:\Windows\System\tnOOabh.exe
  C:\Windows\System\tnOOabh.exe
  2⤵
  PID:8596
- C:\Windows\System\TpFESdg.exe
  C:\Windows\System\TpFESdg.exe
  2⤵
  PID:8612
- C:\Windows\System\nDOSneD.exe
  C:\Windows\System\nDOSneD.exe
  2⤵
  PID:8628
- C:\Windows\System\nUuEwEs.exe
  C:\Windows\System\nUuEwEs.exe
  2⤵
  PID:8644
- C:\Windows\System\hMVrpNz.exe
  C:\Windows\System\hMVrpNz.exe
  2⤵
  PID:8660
- C:\Windows\System\ADCDlIr.exe
  C:\Windows\System\ADCDlIr.exe
  2⤵
  PID:8688
- C:\Windows\System\Icnolzs.exe
  C:\Windows\System\Icnolzs.exe
  2⤵
  PID:8704
- C:\Windows\System\PpBmalE.exe
  C:\Windows\System\PpBmalE.exe
  2⤵
  PID:8720
- C:\Windows\System\VRBhpTT.exe
  C:\Windows\System\VRBhpTT.exe
  2⤵
  PID:8736
- C:\Windows\System\HzuNlCF.exe
  C:\Windows\System\HzuNlCF.exe
  2⤵
  PID:8760
- C:\Windows\System\ymTKsCf.exe
  C:\Windows\System\ymTKsCf.exe
  2⤵
  PID:8776
- C:\Windows\System\GmbyCNh.exe
  C:\Windows\System\GmbyCNh.exe
  2⤵
  PID:8792
- C:\Windows\System\ShTJklw.exe
  C:\Windows\System\ShTJklw.exe
  2⤵
  PID:8808
- C:\Windows\System\kcMTrxG.exe
  C:\Windows\System\kcMTrxG.exe
  2⤵
  PID:8824
- C:\Windows\System\aIqyBKz.exe
  C:\Windows\System\aIqyBKz.exe
  2⤵
  PID:8840
- C:\Windows\System\oUgxCfx.exe
  C:\Windows\System\oUgxCfx.exe
  2⤵
  PID:8856
- C:\Windows\System\DxYOAIQ.exe
  C:\Windows\System\DxYOAIQ.exe
  2⤵
  PID:8872
- C:\Windows\System\QYKIyxP.exe
  C:\Windows\System\QYKIyxP.exe
  2⤵
  PID:8888
- C:\Windows\System\lDnluNq.exe
  C:\Windows\System\lDnluNq.exe
  2⤵
  PID:8904
- C:\Windows\System\NEVAxhj.exe
  C:\Windows\System\NEVAxhj.exe
  2⤵
  PID:8920
- C:\Windows\System\nGFtpdj.exe
  C:\Windows\System\nGFtpdj.exe
  2⤵
  PID:8936
- C:\Windows\System\fPkNYPZ.exe
  C:\Windows\System\fPkNYPZ.exe
  2⤵
  PID:8952
- C:\Windows\System\Jxviiuj.exe
  C:\Windows\System\Jxviiuj.exe
  2⤵
  PID:8968
- C:\Windows\System\SNqzrLi.exe
  C:\Windows\System\SNqzrLi.exe
  2⤵
  PID:8984
- C:\Windows\System\UAovmsI.exe
  C:\Windows\System\UAovmsI.exe
  2⤵
  PID:9000
- C:\Windows\System\iNFOgGZ.exe
  C:\Windows\System\iNFOgGZ.exe
  2⤵
  PID:9016
- C:\Windows\System\pEcwqcz.exe
  C:\Windows\System\pEcwqcz.exe
  2⤵
  PID:9032
- C:\Windows\System\FrercWc.exe
  C:\Windows\System\FrercWc.exe
  2⤵
  PID:9048
- C:\Windows\System\uHJRhro.exe
  C:\Windows\System\uHJRhro.exe
  2⤵
  PID:9064
- C:\Windows\System\CjHoLxj.exe
  C:\Windows\System\CjHoLxj.exe
  2⤵
  PID:9080
- C:\Windows\System\PoSGCwh.exe
  C:\Windows\System\PoSGCwh.exe
  2⤵
  PID:9096
- C:\Windows\System\dlTQtHP.exe
  C:\Windows\System\dlTQtHP.exe
  2⤵
  PID:9112
- C:\Windows\System\EpBfiCj.exe
  C:\Windows\System\EpBfiCj.exe
  2⤵
  PID:9128
- C:\Windows\System\QSpcgbU.exe
  C:\Windows\System\QSpcgbU.exe
  2⤵
  PID:9144
- C:\Windows\System\DpkhtZR.exe
  C:\Windows\System\DpkhtZR.exe
  2⤵
  PID:9160
- C:\Windows\System\kUSARoL.exe
  C:\Windows\System\kUSARoL.exe
  2⤵
  PID:9176
- C:\Windows\System\ZIVJtPm.exe
  C:\Windows\System\ZIVJtPm.exe
  2⤵
  PID:9192
- C:\Windows\System\drezwzk.exe
  C:\Windows\System\drezwzk.exe
  2⤵
  PID:9208
- C:\Windows\System\SJWljNm.exe
  C:\Windows\System\SJWljNm.exe
  2⤵
  PID:7796
- C:\Windows\System\wdGYBkL.exe
  C:\Windows\System\wdGYBkL.exe
  2⤵
  PID:8264
- C:\Windows\System\DlMeBkf.exe
  C:\Windows\System\DlMeBkf.exe
  2⤵
  PID:8328
- C:\Windows\System\wBcQRJG.exe
  C:\Windows\System\wBcQRJG.exe
  2⤵
  PID:8560
- C:\Windows\System\bhEOQGq.exe
  C:\Windows\System\bhEOQGq.exe
  2⤵
  PID:8448
- C:\Windows\System\YefnAYt.exe
  C:\Windows\System\YefnAYt.exe
  2⤵
  PID:8592
- C:\Windows\System\WBKRBHs.exe
  C:\Windows\System\WBKRBHs.exe
  2⤵
  PID:8508
- C:\Windows\System\aDpojnZ.exe
  C:\Windows\System\aDpojnZ.exe
  2⤵
  PID:8752
- C:\Windows\System\UXwblvq.exe
  C:\Windows\System\UXwblvq.exe
  2⤵
  PID:8800
- C:\Windows\System\bWGjajh.exe
  C:\Windows\System\bWGjajh.exe
  2⤵
  PID:8832
- C:\Windows\System\QUYxugq.exe
  C:\Windows\System\QUYxugq.exe
  2⤵
  PID:8868
- C:\Windows\System\CAPSLsQ.exe
  C:\Windows\System\CAPSLsQ.exe
  2⤵
  PID:8964
- C:\Windows\System\pExcgEu.exe
  C:\Windows\System\pExcgEu.exe
  2⤵
  PID:8916
- C:\Windows\System\syjqEIX.exe
  C:\Windows\System\syjqEIX.exe
  2⤵
  PID:8980
- C:\Windows\System\PaHoEya.exe
  C:\Windows\System\PaHoEya.exe
  2⤵
  PID:8884
- C:\Windows\System\QDFGoRr.exe
  C:\Windows\System\QDFGoRr.exe
  2⤵
  PID:9056
- C:\Windows\System\nAlUcwK.exe
  C:\Windows\System\nAlUcwK.exe
  2⤵
  PID:9040
- C:\Windows\System\AXRarIN.exe
  C:\Windows\System\AXRarIN.exe
  2⤵
  PID:9124
- C:\Windows\System\njnMSTy.exe
  C:\Windows\System\njnMSTy.exe
  2⤵
  PID:9136
- C:\Windows\System\PONbBRl.exe
  C:\Windows\System\PONbBRl.exe
  2⤵
  PID:9188
- C:\Windows\System\gkMBQHb.exe
  C:\Windows\System\gkMBQHb.exe
  2⤵
  PID:9204
- C:\Windows\System\DzCtGNP.exe
  C:\Windows\System\DzCtGNP.exe
  2⤵
  PID:8300
- C:\Windows\System\oaGiYgt.exe
  C:\Windows\System\oaGiYgt.exe
  2⤵
  PID:8252
- C:\Windows\System\tUJvcTA.exe
  C:\Windows\System\tUJvcTA.exe
  2⤵
  PID:7860
- C:\Windows\System\fkbDPBe.exe
  C:\Windows\System\fkbDPBe.exe
  2⤵
  PID:8280
- C:\Windows\System\XjDAxZS.exe
  C:\Windows\System\XjDAxZS.exe
  2⤵
  PID:8400
- C:\Windows\System\QwRssxC.exe
  C:\Windows\System\QwRssxC.exe
  2⤵
  PID:8460
- C:\Windows\System\WxeEHxY.exe
  C:\Windows\System\WxeEHxY.exe
  2⤵
  PID:8556
- C:\Windows\System\wEeCdQU.exe
  C:\Windows\System\wEeCdQU.exe
  2⤵
  PID:8588
- C:\Windows\System\cNlMqie.exe
  C:\Windows\System\cNlMqie.exe
  2⤵
  PID:8480
- C:\Windows\System\oywCwSE.exe
  C:\Windows\System\oywCwSE.exe
  2⤵
  PID:8576
- C:\Windows\System\MzwJGMe.exe
  C:\Windows\System\MzwJGMe.exe
  2⤵
  PID:8680
- C:\Windows\System\mzniDdu.exe
  C:\Windows\System\mzniDdu.exe
  2⤵
  PID:8996
- C:\Windows\System\dIuYiRe.exe
  C:\Windows\System\dIuYiRe.exe
  2⤵
  PID:8852
- C:\Windows\System\dOqeNli.exe
  C:\Windows\System\dOqeNli.exe
  2⤵
  PID:8744
- C:\Windows\System\qGQRnDH.exe
  C:\Windows\System\qGQRnDH.exe
  2⤵
  PID:9024
- C:\Windows\System\KijplvO.exe
  C:\Windows\System\KijplvO.exe
  2⤵
  PID:9108
- C:\Windows\System\ZatgalQ.exe
  C:\Windows\System\ZatgalQ.exe
  2⤵
  PID:8464
- C:\Windows\System\ApuTqun.exe
  C:\Windows\System\ApuTqun.exe
  2⤵
  PID:9200
- C:\Windows\System\utFiCWj.exe
  C:\Windows\System\utFiCWj.exe
  2⤵
  PID:8216
- C:\Windows\System\WTBdOJZ.exe
  C:\Windows\System\WTBdOJZ.exe
  2⤵
  PID:8352
- C:\Windows\System\dOrgJyU.exe
  C:\Windows\System\dOrgJyU.exe
  2⤵
  PID:8284
- C:\Windows\System\fWRSfym.exe
  C:\Windows\System\fWRSfym.exe
  2⤵
  PID:8528
- C:\Windows\System\kYUCKLM.exe
  C:\Windows\System\kYUCKLM.exe
  2⤵
  PID:8700
- C:\Windows\System\LloJaMx.exe
  C:\Windows\System\LloJaMx.exe
  2⤵
  PID:8712
- C:\Windows\System\BtWJOpI.exe
  C:\Windows\System\BtWJOpI.exe
  2⤵
  PID:8772
- C:\Windows\System\IVWmyFC.exe
  C:\Windows\System\IVWmyFC.exe
  2⤵
  PID:8784
- C:\Windows\System\SvJpEte.exe
  C:\Windows\System\SvJpEte.exe
  2⤵
  PID:9088
- C:\Windows\System\FFfDbgc.exe
  C:\Windows\System\FFfDbgc.exe
  2⤵
  PID:9104
- C:\Windows\System\gOClvkH.exe
  C:\Windows\System\gOClvkH.exe
  2⤵
  PID:8668
- C:\Windows\System\whIplot.exe
  C:\Windows\System\whIplot.exe
  2⤵
  PID:8932
- C:\Windows\System\odgthnt.exe
  C:\Windows\System\odgthnt.exe
  2⤵
  PID:7892
- C:\Windows\System\jEKhKyC.exe
  C:\Windows\System\jEKhKyC.exe
  2⤵
  PID:8396
- C:\Windows\System\thBWCnK.exe
  C:\Windows\System\thBWCnK.exe
  2⤵
  PID:8344
- C:\Windows\System\qHbcxaj.exe
  C:\Windows\System\qHbcxaj.exe
  2⤵
  PID:8512
- C:\Windows\System\BloFCsb.exe
  C:\Windows\System\BloFCsb.exe
  2⤵
  PID:8672
- C:\Windows\System\brYaXsj.exe
  C:\Windows\System\brYaXsj.exe
  2⤵
  PID:8960
- C:\Windows\System\UUEOXBz.exe
  C:\Windows\System\UUEOXBz.exe
  2⤵
  PID:9008
- C:\Windows\System\lFEEfEe.exe
  C:\Windows\System\lFEEfEe.exe
  2⤵
  PID:8636
- C:\Windows\System\YkaurBw.exe
  C:\Windows\System\YkaurBw.exe
  2⤵
  PID:9232
- C:\Windows\System\qUcbmiT.exe
  C:\Windows\System\qUcbmiT.exe
  2⤵
  PID:9248
- C:\Windows\System\RuzBAzQ.exe
  C:\Windows\System\RuzBAzQ.exe
  2⤵
  PID:9264
- C:\Windows\System\XVZfDMG.exe
  C:\Windows\System\XVZfDMG.exe
  2⤵
  PID:9280
- C:\Windows\System\NYnrdNS.exe
  C:\Windows\System\NYnrdNS.exe
  2⤵
  PID:9296
- C:\Windows\System\MeudGqk.exe
  C:\Windows\System\MeudGqk.exe
  2⤵
  PID:9312
- C:\Windows\System\WmqBjjt.exe
  C:\Windows\System\WmqBjjt.exe
  2⤵
  PID:9328
- C:\Windows\System\svfYVAF.exe
  C:\Windows\System\svfYVAF.exe
  2⤵
  PID:9344
- C:\Windows\System\KvHMnDO.exe
  C:\Windows\System\KvHMnDO.exe
  2⤵
  PID:9360
- C:\Windows\System\aSDeOEN.exe
  C:\Windows\System\aSDeOEN.exe
  2⤵
  PID:9376
- C:\Windows\System\UlKQHIi.exe
  C:\Windows\System\UlKQHIi.exe
  2⤵
  PID:9392
- C:\Windows\System\xOzURvj.exe
  C:\Windows\System\xOzURvj.exe
  2⤵
  PID:9408
- C:\Windows\System\yPQOMHj.exe
  C:\Windows\System\yPQOMHj.exe
  2⤵
  PID:9424
- C:\Windows\System\nmASOOj.exe
  C:\Windows\System\nmASOOj.exe
  2⤵
  PID:9440
- C:\Windows\System\uUjRRyi.exe
  C:\Windows\System\uUjRRyi.exe
  2⤵
  PID:9456
- C:\Windows\System\ZEtsTNx.exe
  C:\Windows\System\ZEtsTNx.exe
  2⤵
  PID:9472
- C:\Windows\System\PaoGYdN.exe
  C:\Windows\System\PaoGYdN.exe
  2⤵
  PID:9488
- C:\Windows\System\NqKYAlX.exe
  C:\Windows\System\NqKYAlX.exe
  2⤵
  PID:9504
- C:\Windows\System\gPuNLBT.exe
  C:\Windows\System\gPuNLBT.exe
  2⤵
  PID:9520
- C:\Windows\System\HEVyWKn.exe
  C:\Windows\System\HEVyWKn.exe
  2⤵
  PID:9536
- C:\Windows\System\zroOgoM.exe
  C:\Windows\System\zroOgoM.exe
  2⤵
  PID:9552
- C:\Windows\System\teMXDWn.exe
  C:\Windows\System\teMXDWn.exe
  2⤵
  PID:9568
- C:\Windows\System\OSUbVjX.exe
  C:\Windows\System\OSUbVjX.exe
  2⤵
  PID:9584
- C:\Windows\System\KNlvixj.exe
  C:\Windows\System\KNlvixj.exe
  2⤵
  PID:9600
- C:\Windows\System\QBOHSqU.exe
  C:\Windows\System\QBOHSqU.exe
  2⤵
  PID:9616
- C:\Windows\System\nYwfBXE.exe
  C:\Windows\System\nYwfBXE.exe
  2⤵
  PID:9632
- C:\Windows\System\VclXwZF.exe
  C:\Windows\System\VclXwZF.exe
  2⤵
  PID:9648
- C:\Windows\System\hHIjGCt.exe
  C:\Windows\System\hHIjGCt.exe
  2⤵
  PID:9664
- C:\Windows\System\ZgnvmyS.exe
  C:\Windows\System\ZgnvmyS.exe
  2⤵
  PID:9680
- C:\Windows\System\iRjbEhi.exe
  C:\Windows\System\iRjbEhi.exe
  2⤵
  PID:9696
- C:\Windows\System\FeBJLDW.exe
  C:\Windows\System\FeBJLDW.exe
  2⤵
  PID:9712
- C:\Windows\System\vDHfbXv.exe
  C:\Windows\System\vDHfbXv.exe
  2⤵
  PID:9728
- C:\Windows\System\OJiJIqE.exe
  C:\Windows\System\OJiJIqE.exe
  2⤵
  PID:9744
- C:\Windows\System\hFyMIET.exe
  C:\Windows\System\hFyMIET.exe
  2⤵
  PID:9760
- C:\Windows\System\JUIeuqm.exe
  C:\Windows\System\JUIeuqm.exe
  2⤵
  PID:9776
- C:\Windows\System\FflEKPu.exe
  C:\Windows\System\FflEKPu.exe
  2⤵
  PID:9792
- C:\Windows\System\QUOpXbz.exe
  C:\Windows\System\QUOpXbz.exe
  2⤵
  PID:9808
- C:\Windows\System\FlTrYZg.exe
  C:\Windows\System\FlTrYZg.exe
  2⤵
  PID:9824
- C:\Windows\System\cGtmZeF.exe
  C:\Windows\System\cGtmZeF.exe
  2⤵
  PID:9840
- C:\Windows\System\eRnhVCo.exe
  C:\Windows\System\eRnhVCo.exe
  2⤵
  PID:9856
- C:\Windows\System\zoASFWO.exe
  C:\Windows\System\zoASFWO.exe
  2⤵
  PID:9872
- C:\Windows\System\hwoqwWt.exe
  C:\Windows\System\hwoqwWt.exe
  2⤵
  PID:9888
- C:\Windows\System\TfAZIwu.exe
  C:\Windows\System\TfAZIwu.exe
  2⤵
  PID:9904
- C:\Windows\System\oQyYnAG.exe
  C:\Windows\System\oQyYnAG.exe
  2⤵
  PID:9956
- C:\Windows\System\MIQjiGe.exe
  C:\Windows\System\MIQjiGe.exe
  2⤵
  PID:9972
- C:\Windows\System\ziuAqkg.exe
  C:\Windows\System\ziuAqkg.exe
  2⤵
  PID:9992
- C:\Windows\System\zoZuYiv.exe
  C:\Windows\System\zoZuYiv.exe
  2⤵
  PID:10012
- C:\Windows\System\ipbIieC.exe
  C:\Windows\System\ipbIieC.exe
  2⤵
  PID:10028
- C:\Windows\System\xMxhdGV.exe
  C:\Windows\System\xMxhdGV.exe
  2⤵
  PID:10048
- C:\Windows\System\KJSksVb.exe
  C:\Windows\System\KJSksVb.exe
  2⤵
  PID:10064
- C:\Windows\System\snQRGLP.exe
  C:\Windows\System\snQRGLP.exe
  2⤵
  PID:10080
- C:\Windows\System\PXxsXZO.exe
  C:\Windows\System\PXxsXZO.exe
  2⤵
  PID:10096
- C:\Windows\System\tfeTlGu.exe
  C:\Windows\System\tfeTlGu.exe
  2⤵
  PID:10112
- C:\Windows\System\ktBFQce.exe
  C:\Windows\System\ktBFQce.exe
  2⤵
  PID:10128
- C:\Windows\System\GygLyJR.exe
  C:\Windows\System\GygLyJR.exe
  2⤵
  PID:10144
- C:\Windows\System\TDLqtfm.exe
  C:\Windows\System\TDLqtfm.exe
  2⤵
  PID:10160
- C:\Windows\System\bYeoSVO.exe
  C:\Windows\System\bYeoSVO.exe
  2⤵
  PID:10176
- C:\Windows\System\ikpTIEu.exe
  C:\Windows\System\ikpTIEu.exe
  2⤵
  PID:10192
- C:\Windows\System\mhtzvOp.exe
  C:\Windows\System\mhtzvOp.exe
  2⤵
  PID:10208
- C:\Windows\System\IGxDcfo.exe
  C:\Windows\System\IGxDcfo.exe
  2⤵
  PID:10224
- C:\Windows\System\WQmhbLG.exe
  C:\Windows\System\WQmhbLG.exe
  2⤵
  PID:8900
- C:\Windows\System\dQxKAsP.exe
  C:\Windows\System\dQxKAsP.exe
  2⤵
  PID:8444
- C:\Windows\System\EPzTxAp.exe
  C:\Windows\System\EPzTxAp.exe
  2⤵
  PID:8732
- C:\Windows\System\eaTyFOQ.exe
  C:\Windows\System\eaTyFOQ.exe
  2⤵
  PID:9304
- C:\Windows\System\dlKgiIE.exe
  C:\Windows\System\dlKgiIE.exe
  2⤵
  PID:8640
- C:\Windows\System\JAxIASY.exe
  C:\Windows\System\JAxIASY.exe
  2⤵
  PID:9372
- C:\Windows\System\RFJFNNE.exe
  C:\Windows\System\RFJFNNE.exe
  2⤵
  PID:9404
- C:\Windows\System\yiEhdCy.exe
  C:\Windows\System\yiEhdCy.exe
  2⤵
  PID:9228
- C:\Windows\System\geQQEaO.exe
  C:\Windows\System\geQQEaO.exe
  2⤵
  PID:9468
- C:\Windows\System\kKVctQD.exe
  C:\Windows\System\kKVctQD.exe
  2⤵
  PID:9256
- C:\Windows\System\aGtxdfc.exe
  C:\Windows\System\aGtxdfc.exe
  2⤵
  PID:9288
- C:\Windows\System\MXbEWDi.exe
  C:\Windows\System\MXbEWDi.exe
  2⤵
  PID:9596
- C:\Windows\System\ZJxJRrP.exe
  C:\Windows\System\ZJxJRrP.exe
  2⤵
  PID:9416
- C:\Windows\System\lwSAdZW.exe
  C:\Windows\System\lwSAdZW.exe
  2⤵
  PID:9580
- C:\Windows\System\dhxLQyN.exe
  C:\Windows\System\dhxLQyN.exe
  2⤵
  PID:9752
- C:\Windows\System\iSfnlcK.exe
  C:\Windows\System\iSfnlcK.exe
  2⤵
  PID:9756
- C:\Windows\System\KsDJfKX.exe
  C:\Windows\System\KsDJfKX.exe
  2⤵
  PID:9708
- C:\Windows\System\bYHNtqo.exe
  C:\Windows\System\bYHNtqo.exe
  2⤵
  PID:9800
- C:\Windows\System\vdeobmM.exe
  C:\Windows\System\vdeobmM.exe
  2⤵
  PID:9820
- C:\Windows\System\RhPVpVq.exe
  C:\Windows\System\RhPVpVq.exe
  2⤵
  PID:9884
- C:\Windows\System\auMiJiT.exe
  C:\Windows\System\auMiJiT.exe
  2⤵
  PID:9896
- C:\Windows\System\CQMxUuR.exe
  C:\Windows\System\CQMxUuR.exe
  2⤵
  PID:9932
- C:\Windows\System\nNiuLdt.exe
  C:\Windows\System\nNiuLdt.exe
  2⤵
  PID:9952
- C:\Windows\System\lGKTabx.exe
  C:\Windows\System\lGKTabx.exe
  2⤵
  PID:10024
- C:\Windows\System\yETVqbL.exe
  C:\Windows\System\yETVqbL.exe
  2⤵
  PID:10004
- C:\Windows\System\QvhvWoR.exe
  C:\Windows\System\QvhvWoR.exe
  2⤵
  PID:10060
- C:\Windows\System\twdnKvF.exe
  C:\Windows\System\twdnKvF.exe
  2⤵
  PID:10124
- C:\Windows\System\lvrNnVa.exe
  C:\Windows\System\lvrNnVa.exe
  2⤵
  PID:10136
- C:\Windows\System\GsVSaoX.exe
  C:\Windows\System\GsVSaoX.exe
  2⤵
  PID:10108
- C:\Windows\System\lhKeIOA.exe
  C:\Windows\System\lhKeIOA.exe
  2⤵
  PID:10188

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ALUmoXX.exe

Filesize
2.1MB

MD5
adb5e663e7a18ee3a2d76d168a8871c9

SHA1
052fb93fac922c115a2acfef7c44245f6a553d82

SHA256
739230c67d09d990cdb4f4aa30d6d8b88c48ddf8b7aa29d5c5118169307893d3

SHA512
8ad6ab4974909917fa9b4e21071bbb066a234550778ee8fb47bc4c2cdd6ab8d2d764500d1930445ccf34c5c2a2f56ed428ec86b8447156bfa1d2b3f5384ba1a2

Download Submit
C:\Windows\system\AbzjJlW.exe

Filesize
2.2MB

MD5
3e5acfd5e3ec069cbbe2953c4c2d176e

SHA1
5ace4152ebfc97f5cd8a1dfc3dfe154077c7b758

SHA256
8930e2fafa2656ecfd33cd5462e30a6d3f878853776cc0b8148bae75bfe05d67

SHA512
72a30509c5fd06062ca76e09eb8ffdebcb40ff9db939d8aa559f6f2d71e094d9a105823aa18a36f000715a3a454df2a0d1949f43c874c31bdfb240c6b0eb1790

Download Submit
C:\Windows\system\Bmaruod.exe

Filesize
2.2MB

MD5
50578b3d8f8a8026981236226b104939

SHA1
1c561c8d22db88cd4c2b10b42acdd5ebcf8cde45

SHA256
fbda38cb171ec2f273c71bd89e7dbec5604664b1dbf939e0ff0468e42b832c28

SHA512
36f9299beb7aa64c47e7f4e38c6f06e22a84dadbb9c693c060cef7e4a99550a8647b6f887551225102faa5d1d923e540fbf346015adadbb7d08e841c8609de6e

Download Submit
C:\Windows\system\EcCqNxo.exe

Filesize
2.2MB

MD5
f012c583c1d498b670f6f38102e18173

SHA1
e19045a367fa1b681885f128551ac70563b13580

SHA256
ef3ecb777084cef5ae989fd65c115cfe76c3a090336a4231c2da8c1476812d63

SHA512
4db46215f796c28cacecda2ca64f40c02312c4832d846d296df49e112b7c572ec65df051ab1a858ea3a583b1ac44797ecfcfd3e86e68599e9d73c1ec04492dee

Download Submit
C:\Windows\system\HfolaiD.exe

Filesize
2.2MB

MD5
93beffc72f27d2bee6e5a79c7cffdaa0

SHA1
fdf881b4557da239c7e21dc7a441c4bd3ba1af51

SHA256
c878758271fa8e9aaa2e3cb578e26b1ae91f765dfe2b09e0b7bf4e3604917a4f

SHA512
6dcfd30b12c8986076076b58931ed9017b35d5ff2ced1ba423c058d2cc799f839eecf0b0326051cce25e830876fb889ce42ef7775a152fc9fba7963fb22941e9

Download Submit
C:\Windows\system\IbuWOlA.exe

Filesize
2.1MB

MD5
e08946464de4558e729c06e47d34debd

SHA1
2decfd1bdba3aa0ad84ecebf5ecc3d14e6b07276

SHA256
5bc2b1c1fd6c7f556a625fef749143518b6d30c08c9f5d58daa8cacdf193266f

SHA512
53f03731c667d924eabe6ef70c966fa5bd0745cb02aa7fb46f618f58fb26f63c799ddebfe2c51989f15da4cd0109f9a5935a9caf7369967a4eb8d77bdea44d3b

Download Submit
C:\Windows\system\JpbPRFb.exe

Filesize
2.1MB

MD5
e8d8330194c3633393b6ab852e4b4491

SHA1
3f60abee9a8c67746cf7ab940b60ed481f4c782f

SHA256
024f05a7cc730da47d50b1652611f927de1ef8307b1b66a0ca1cf1c90dc99503

SHA512
4dd69dcbf58188e12c68ffbadeca02ed6b2d046750f5c45a03ce962a73c818c9a169f704f33ef2d8e05525b0bae9ac2bc1fed5730cd8a2cda540c87762e12bae

Download Submit
C:\Windows\system\PwStOis.exe

Filesize
2.2MB

MD5
e1c983dd9ec7fe6985497ac6c0ceba9d

SHA1
c2a501f17383fb7363e4a21edd758ff7bb84170a

SHA256
f4e67357e843d7ff08a8ea7604404e3d86233af5f9663bd43a4009425dd75892

SHA512
9ce3400c31a88d34b96b1dd7ad6ba7375fc20a4f956cf46417b80bd511bdbcfd251a954d8808588c886184cd0ff4d62e2c5d6a4f0d0ade99cd3189ffc5855dc4

Download Submit
C:\Windows\system\SJSwVcJ.exe

Filesize
2.1MB

MD5
04761085ee87f328a17d850d95b9bdc7

SHA1
04a4eb6f6f8a1198c4ebb284c54c08573baf399a

SHA256
d638ed1a851b47f6749f95c67f422500b8900cdff6b08bbc89c175664b866313

SHA512
e6b6659593fa30b3a9ba4289048a5ec0033507e5af32a43f83d4183a8d9f0095091c6641954991abb18357144faf352308eed4cef6eeacaf88e4c6a9e0ae260a

Download Submit
C:\Windows\system\VCiBtlM.exe

Filesize
2.2MB

MD5
e667d72ead24fc5d8e4a9a2a7cf4a137

SHA1
c57f1896ec6dc81dc5bc97697915f04ee41966bd

SHA256
973d67ebb819d741f1bc1644bb01c6f51bb727b45eba3760578a9ca39203ebe8

SHA512
dd648dc3c09be5d16f2ef6096b80e0a0c3115ad79b4cc4965ad5f181ed7f48fdcbd445ba28dbfa5bb99f24a6e5c690e8e41632fea590c8276032a3af1e7b03ee

Download Submit
C:\Windows\system\XpuopNX.exe

Filesize
2.1MB

MD5
d6c26361c2b3881e3a0c6bc0f90ecfa0

SHA1
10ae5c94e4e70567e015a40bbb2646514413c9d9

SHA256
c76477ecbdbcf8ef0b154bf933ec5560403885c30e181f25a2b72bd0726ad051

SHA512
dbfb696150a1374a7bd77f7c10a5d7495cd6d6a04f1b58de7a0a234d210485bae7c130ba91fe10048ef62bc6fd83d1f25cf8074a5a8f43ab0f7043d792568615

Download Submit
C:\Windows\system\YktAWlq.exe

Filesize
2.1MB

MD5
0e68d59576425916ea13fa45b44488fd

SHA1
afc4356dacffa06123295e9293018fabc3fbb2c7

SHA256
4b1b867d7290fb9ecfb0f452df3b88235992f1d7ce19779f4ff04b0fa50e4ff8

SHA512
691b64cb854d8b562c1bad3365fa8973c446ec524ac12bb7c7138f0f3cc6124057358af90124b4c776c13f30989b78d8ad2f1dedfd6a8a5736a6a28605837a93

Download Submit
C:\Windows\system\YpZmFoP.exe

Filesize
2.1MB

MD5
e44f4d0bbf46907b177d49c771537e61

SHA1
adcfd45d4151c22873657e0cf70a8cd9153165c4

SHA256
36679528bec960d788fe8d28f35931a55530a808ae5c769b3d593b96a88aafba

SHA512
e9a03a69fbc4f28098c032782151b01d3adcd82a167131e1532e012c8024132ce7230de345b8d9115430a368d674d03c2261fedfed4492145b7b50b1f08e3e17

Download Submit
C:\Windows\system\ZIOpUVp.exe

Filesize
2.2MB

MD5
6f921b617d16ab8f774a17b6ca109f52

SHA1
03e297e517af57efd24e9ded9c143128fd8482a0

SHA256
799f4175be52e2e6513ef8f4bd654c8c9065b8e1f0f4141f240f5ac8d26846e5

SHA512
756cd1df2065306380de7e4688ad938bdb8daf747fe89ce613edb1e352f6a848a3d91edcf4b6fb52dd5cdebcb28925be64cb5c66e611ce2e2583cc20b7612d50

Download Submit
C:\Windows\system\bAYScjk.exe

Filesize
2.2MB

MD5
4190e94748346419383bafdd915b75ac

SHA1
4a3e341f668615cc87d765d4a68c099d56b33146

SHA256
2466086600724244649c9ba93ef886d290cdca83fa145e5b47f4e34773ca1d27

SHA512
9644577d6fd57603d810368a75b43aa42417f9ac375dcdca5559f37d9a9695a34c50c86d3e6f93a6bd66ff9dc4d627d0815ff4ffcb75bfcf7f36e682e0846f06

Download Submit
C:\Windows\system\cguIPkw.exe

Filesize
2.2MB

MD5
a77db2958f4aafa0efe17182ff10c617

SHA1
097df4d615a6608d3742dfea5ec9d1cc6bd3f525

SHA256
70035713b1b6a16bf10a012edb6b91ca9026a2a0ad9e894ad41f42ea7bbbe507

SHA512
66e76415f65d42cd9ea4881565d9b91ea30aa7705fb7fec91ef49999fe759946ed2f123d596d58ff5eed05c821bb58ed340f46153b462a6dd43b8407b6efe7d6

Download Submit
C:\Windows\system\czNHUvS.exe

Filesize
2.2MB

MD5
7e7b80429f8a6ded5fb8f781ad9257ab

SHA1
d09401bd30e28dd4c08afa36293974c1312b5b9f

SHA256
07557c953bfab1d0b6ebeccdf35021be218d5a55994b0e21639c5e7578d113d6

SHA512
56e4f8198664c633a57ff9ea235b1d3e20805a4975bf7bd9d8e7c78d40b4882597e7a6e4f1f5c8622cbf2f8c542982cecf696aa55b37624a2b1b02e7fe52999d

Download Submit
C:\Windows\system\dGIXtBt.exe

Filesize
2.2MB

MD5
ddb7490f52af9509caa2e7758b8d5ca7

SHA1
5388db46448e329fddbfb2caa350d7d70a457569

SHA256
a181e931ee06b947dd7c34ad22f3d998e2c5c76632215b9df532bc62f9759202

SHA512
05be6e008ba90cba857832be75b661c0390d0d8fc4b56f5adda2b5da23f256a9af29d670ae50a19590b63808b3a814346dc45557d232b0e71c1360ee735b93e9

Download Submit
C:\Windows\system\qELRWKY.exe

Filesize
2.2MB

MD5
1d18e5db4da650d82e39cca21d2e4389

SHA1
1c8357245fa0b47a82239cbdc4affbfdfa446185

SHA256
d531b7fc4ed86f20a4b05be4f34356ef4bb0bcaad43b4639cf8170794ea06e6b

SHA512
a48786d504e5dc31d1ca818fb823369e3d93aeb3c9376a401a63e85fb38550501255235ef26478f63cfcf397ae9f4c2428e253c82dcdfeb5f0736f499780a0f9

Download Submit
C:\Windows\system\ubexSvd.exe

Filesize
2.2MB

MD5
1437e9aaa91544489e60102ffb15daa8

SHA1
cd650f50828a94c7455bd5d48ed173d7d0ecd804

SHA256
72dca07f44bff3d651d8cc39d0a802459afc0121dba3d009463791ee12cf54eb

SHA512
88e6dcaf3dc1fe92c17ac4e2a92f885c36ac119386e20581571be90c7c6adefe529932b814847e2a4c2570e4669903a422a20caf8f7d29d7308d693091a82c63

Download Submit
C:\Windows\system\vEDaRvB.exe

Filesize
2.2MB

MD5
cd556f43910aa78d6e62b7a0e14d1ef8

SHA1
0e526348caae6b8b911a7499a4e58060ec930e21

SHA256
98fe5cf6717ea1ebb5ed60761cc603584f3b74869e23fdf3236fd1c9812489df

SHA512
8776b72c4d3d8324e89d8db97b45c2e00ee81f4153ea2adabf86e909ff43a0f0183e00484bfa1f97d63f6f22da513cb4762fcba4d4d8e98d8066ff9bee94ef01

Download Submit
C:\Windows\system\vqaYuEv.exe

Filesize
2.1MB

MD5
a0f42409b4250bfda83320520dcee64a

SHA1
9f779ce9297744574fb8e9be851a069b3ddee46f

SHA256
1c13c1472a26531d91cb19750a1a68de538d8dde7408ae5830b502693fab2a31

SHA512
511d010663de9426511ee89d5d6e2d5b6cadd631713735568e96031354e39371b23e60e5f4aace99d3558bc92ccbc8b1452cef8a9f0ed2b9c7e07278407e3cd5

Download Submit
C:\Windows\system\yDkHNzK.exe

Filesize
2.1MB

MD5
1ee9282079f94045cbbcb7281a3f2391

SHA1
fa0e5488b83d7799282f6708e1142bc4546e3c77

SHA256
4cf9ee15fb6e47332b7cb5b7e227b040aec0439ede02fe7cf1d810fb909e0040

SHA512
3e0761ee832701200995800c2494ddb626d216c7e03e726b91777a7ee3f55385004b0ecda6b984b2a16e298d574bdcb830dc44ded44357131199c9cbcc746cdb

Download Submit
C:\Windows\system\ylLPume.exe

Filesize
2.2MB

MD5
2ad52fcfb3c741b33a36d101be495d6a

SHA1
0a1652b4b2c32d6dc50f1698d572ecf1be78a178

SHA256
0b5647d1b63b91a7659054d57d349f8ef9882a15d53edf89e83e7d08d3a547f1

SHA512
f1e3bf665f78fd7508b3ebd9f11e6356e7447141e294cd5ac76d25746b517946f0205d5d88bd0c801be8d19c6b944e0e8505e7e09be9ec1d236cbd9c6d8edc72

Download Submit
\Windows\system\CPukBzW.exe

Filesize
2.1MB

MD5
ef7145ad488dbf5125cf0364c3913fbe

SHA1
0c01f6ddaf9f82111b1a9c91f9d1475eb882a805

SHA256
b89602c1bb8a4cb61703da96761cee673145f56270bca2b4b28eb19d4917ccc6

SHA512
6f0a561f65fb59ee25bb75261459e8569d6e0bae6cb130dd1d766af3a49996cae3230f21cc236a78597f3d1831f647cae0b053f1c03c18a1b0a43568f437ebf7

Download Submit
\Windows\system\EMfWdJu.exe

Filesize
2.2MB

MD5
2001e2fb0bf143eef160981d2bd71bc1

SHA1
183b426047ca4c0ab8d1501c8d2741c497bb7f55

SHA256
ecfd0ed9a13e3ebde17b8804a2c87bb430ffc865381009f68f18bff4cb3022bf

SHA512
70769ea7cf69342d2aeb169063076139e07f2a9e6e9eee34d704fd2198490afe345a439ac42ae9700b0e25a4a20db099c5dba4b83a1e668b03bf19d2723e84d4

Download Submit
\Windows\system\IDDMHIe.exe

Filesize
2.1MB

MD5
31927b3c2046178f3a1e207e63280903

SHA1
ece2df3044cb8a73ebe0ec1cb9832d8b901cd665

SHA256
3d0ed48aed12bfcdb1fa9dd5f920c24cd85a0cc31f5c0a9899b6f01ec94e751f

SHA512
11ebbaf4199e138cdcd40860cbda7588ebffb18ddf8a666e1a9ee9152ef8bbabec39b87832eb57cf5c440ff8cbaa9c0a94bdd54c8d4f396c0f14cb2f910b697c

Download Submit
\Windows\system\KxhqhMW.exe

Filesize
2.2MB

MD5
6e0fc469b731b9705f52baa34b6fda27

SHA1
5f540ffb8c3c740719aa688fe6156c2f8e40a305

SHA256
7096f1337ca06c15a05a8916107ac8d551ca739b7c5e98b14e7afcfada078af0

SHA512
782608b1315e471dd525cae90dac4aa9048c11f3ca90d4900f63b5e7a908d5e823726fccfe2dbeeb5f278c4bcba76ec4f5c9c91a1429bbd5323d00e83c6f1bab

Download Submit
\Windows\system\LJXOBwq.exe

Filesize
2.2MB

MD5
85e8c8cafce5e870fe8ccd545612599d

SHA1
362f2c4e44135819b450320641d522a67e9641ff

SHA256
8084d30cf37e1e6cee3289a038d97c277daec052f611d0cb89d53c68abf33c4c

SHA512
b0d3cce8657819f0b4eb9edf391c35903b114656c4b135828af98e6228025e51c34987c3f71b50e5e71d5647135d1a84a27cc07f7ef898614d8e05d93d31d348

Download Submit
\Windows\system\UjwTSdi.exe

Filesize
2.1MB

MD5
9dece498e41173f7ae438b1930c274ab

SHA1
10ef6621a0975cdc59de76ea395939137ebfa588

SHA256
d9d8aa6bcd3dba2f4726dc3f0d8b844913316e23158e3d55cdf7cf11c9aac884

SHA512
dac5e2c8e40bac7ad4f325b20570bd111fe63a89028228fe4f53a1e8f182767cd79cd0b11e9b9ad9913afc6979ceeea334f48dadbfa40e199cd7eb3baf690bc0

Download Submit
\Windows\system\kgkEfCS.exe

Filesize
2.1MB

MD5
638fb471ecba2298787f9747e1fb659c

SHA1
204aa6401663f086af7c0b0485b86a9e563e2ebe

SHA256
7d4c205adbe26c2f4354aec555f67a56d47fc5fb72f18d4a06d99e24b9d3e6d6

SHA512
445fa42d021d2c5b58631b16d8b4b4ee69b64aa4a3d681efeadc7e53b0247168b499e21bcaed40641b3c90d73fd39b663399b39a31cd70a92156723d33831e62

Download Submit
\Windows\system\uSYluus.exe

Filesize
2.2MB

MD5
4c4af10add797521c0267b9fb77f55c8

SHA1
a3b3550827cbfa79f73b9dc1f6e889201257739f

SHA256
d298952a71ebd39593dc0191117c725523efb53a9323ef31e8b8dddbac0406d1

SHA512
357a73ac6fe29365b5d6d3552bca800fadce9b5e34f528989b56cc48b5b552e0ae120ad373cc8825448a53f9b9658bbaebd842440fdb36b952f76aaba50ee92b

Download Submit
memory/1096-88-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/1096-109-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-1-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/1096-101-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-11-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-104-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-105-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download
memory/1096-103-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/1096-106-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/1096-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1096-49-0x0000000002F00000-0x00000000032F2000-memory.dmp

Filesize
3.9MB

Download
memory/1708-48-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/1708-46-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/1708-47-0x0000000002810000-0x0000000002890000-memory.dmp

Filesize
512KB

Download
memory/1708-201-0x000007FEF5D20000-0x000007FEF66BD000-memory.dmp

Filesize
9.6MB

Download
memory/1708-115-0x0000000001DF0000-0x0000000001DF8000-memory.dmp

Filesize
32KB

Download
memory/1708-32-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2020-23-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2020-3141-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2064-82-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2112-26-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-100-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2604-102-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2668-108-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2748-96-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2988-107-0x000000013F610000-0x000000013FA02000-memory.dmp

Filesize
3.9MB

Download