xmrig | c713b1219617a68f2fd9b0dd30dcd5c165c0229808aaa43b99ea51120d195c5d

Analysis

max time kernel
35s
max time network
68s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
Size

1.9MB
MD5

03ffd0e4421657df24ead0752925f3c2
SHA1

300b9a03bfdd88c8f1e8d757b12cf72969363627
SHA256

c713b1219617a68f2fd9b0dd30dcd5c165c0229808aaa43b99ea51120d195c5d
SHA512

37e9a2ccca54263bbba448702b7fdee3af1db2f3b6a4caed824f5c5b663f046070e76b127571fc2f697aa778aa9f027e7e83ac1460f7863b63d2372d0d19c248
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlBo:NABP

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2548-21-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/1688-56-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2440-73-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2544-85-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2512-90-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2436-292-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2832-69-0x000000013F650000-0x000000013FA42000-memory.dmp	xmrig
behavioral1/memory/2412-65-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2440	ReNkgws.exe
2544	gKnhIKw.exe
2548	ahwGlDe.exe
2512	TFDgfPf.exe
2436	uJvvZow.exe
2344	JsTLKTr.exe
2412	kAsqBQp.exe
2988	HqmWSaB.exe
2832	BVUnpGA.exe
1608	sPtHHgK.exe
684	zgghEtQ.exe
756	ABIaFuX.exe
1760	FJsdtqJ.exe
2692	dCuDFse.exe
1960	ktMbHHp.exe
2320	KydHVrY.exe
1672	WMnwTAL.exe
2008	hCDBpAn.exe
824	WOgdOxr.exe
1072	fAMeXBJ.exe
1556	JGFtiJU.exe
2332	RRHHRJZ.exe
1748	vWmiopk.exe
1676	ANclAKt.exe
2052	bBqhoMS.exe
848	dnuTGXi.exe
772	zxiqyeC.exe
3004	AcbKMTP.exe
2844	jgFtRgL.exe
1048	AgUAcka.exe
1344	pxeSQek.exe
1828	ATZQExU.exe
2276	iyDZcmQ.exe
1612	ROObpOU.exe
2896	bHvNuwA.exe
2768	cBuzFmy.exe
644	OUGfoCs.exe
1964	AIDdwFw.exe
368	bBJQVmc.exe
2696	DupJyjV.exe
2148	NVcubPg.exe
1740	EagkhXy.exe
2044	EulZwKJ.exe
1560	OIeypdm.exe
964	rzJxCCN.exe
944	ichrqMM.exe
2812	JQcpQvL.exe
320	ATiqlDi.exe
3040	bwoamFn.exe
1940	eiHszOH.exe
2808	hCguWPU.exe
1500	TvyhFBB.exe
2104	ZhxRrdV.exe
2204	TqkJzMn.exe
1588	QAzebdT.exe
1596	wmvjleA.exe
2708	zLpSEHg.exe
2464	BWKQFkX.exe
2156	gdDAAtc.exe
2364	afGdZHW.exe
2876	NqYcEjf.exe
1492	xjzMIpu.exe
832	gUFxnzd.exe
2308	PhJfUKT.exe

Loads dropped DLL 64 IoCs

pid	Process
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1688-1-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x000d000000014909-3.dat	upx
behavioral1/memory/2440-9-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0020000000014fe1-13.dat	upx
behavioral1/memory/2544-14-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x00080000000155d9-18.dat	upx
behavioral1/memory/2548-21-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x000f0000000006fd-33.dat	upx
behavioral1/files/0x00070000000155e2-32.dat	upx
behavioral1/memory/2512-35-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2436-37-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x0008000000015a2d-39.dat	upx
behavioral1/memory/1688-40-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0018000000015264-47.dat	upx
behavioral1/files/0x0006000000016d36-52.dat	upx
behavioral1/memory/1688-56-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-55.dat	upx
behavioral1/files/0x0006000000016d4a-70.dat	upx
behavioral1/memory/2440-73-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0008000000015e41-48.dat	upx
behavioral1/memory/2544-85-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x0006000000016d55-84.dat	upx
behavioral1/memory/2512-90-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/memory/2344-51-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x0006000000016d89-101.dat	upx
behavioral1/files/0x0006000000016e56-112.dat	upx
behavioral1/files/0x0006000000017090-116.dat	upx
behavioral1/files/0x0006000000018b96-173.dat	upx
behavioral1/files/0x0006000000018d06-184.dat	upx
behavioral1/files/0x0006000000018b37-151.dat	upx
behavioral1/files/0x0006000000018b6a-168.dat	upx
behavioral1/memory/2436-292-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/files/0x00050000000192c9-185.dat	upx
behavioral1/files/0x0006000000018ba2-176.dat	upx
behavioral1/files/0x0006000000018b73-167.dat	upx
behavioral1/files/0x0006000000018b15-162.dat	upx
behavioral1/files/0x0006000000018b4a-159.dat	upx
behavioral1/files/0x0006000000018ae2-136.dat	upx
behavioral1/files/0x00050000000192f4-188.dat	upx
behavioral1/files/0x0006000000018b42-156.dat	upx
behavioral1/files/0x0005000000018698-127.dat	upx
behavioral1/files/0x0006000000018b33-150.dat	upx
behavioral1/files/0x0006000000018ae8-141.dat	upx
behavioral1/files/0x00050000000186a0-130.dat	upx
behavioral1/files/0x000500000001868c-121.dat	upx
behavioral1/files/0x0006000000016d84-96.dat	upx
behavioral1/files/0x0006000000016d4f-93.dat	upx
behavioral1/files/0x0006000000016d41-79.dat	upx
behavioral1/files/0x000600000001704f-107.dat	upx
behavioral1/memory/2832-69-0x000000013F650000-0x000000013FA42000-memory.dmp	upx
behavioral1/memory/2412-65-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2988-60-0x000000013F7A0000-0x000000013FB92000-memory.dmp	upx
behavioral1/memory/684-87-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\oZWgFmM.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\iroVvhu.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\wVvEjEt.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ARTzZJD.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ceFrMza.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\keTjAMx.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\KbSlIie.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\KMfgEcj.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\cBuzFmy.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\sfUjnLq.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\EdvQRxR.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\eUvDYmh.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\cgjPCNM.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\hyOzPzA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\mfrMHoQ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\PwBYojc.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\PvDsLba.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\UhgfKQF.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\YaYkrBK.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\eZtnvKm.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\DIahotf.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\tXPiWix.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ICEpyaQ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\tIUIihN.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\JQcpQvL.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\tcWizWC.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\JiKTNNx.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ZLNIHyj.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\iUJIHiZ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\RYgIAGI.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\zFHsJQX.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\OBpnGnV.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ancXLVZ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\TvyhFBB.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\AALNDja.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\bfbPMtA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\fivyBOF.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\AIDdwFw.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\EulZwKJ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ajKFrYM.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\iHzYtNW.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\qdaevac.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\QqDOnnT.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ZndMxki.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\VYwUKoz.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ZBzucrJ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\PVNWdOH.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ZTnHtXB.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\IqfmufS.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\LJZBWXH.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\YxVeFyT.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\snNgbUM.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\TJynarp.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\jBAPYlS.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\kbnmZSU.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\cTTEHkI.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\ngXVGZP.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\AgUAcka.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\wmvjleA.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\rpGTeNK.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\YjORoci.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\UKMqhYQ.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\RvpXojN.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
File created	C:\Windows\System\rqrogEX.exe	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2948	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2948	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2948	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	29
PID 1688 wrote to memory of 2440	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2440	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2440	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	30
PID 1688 wrote to memory of 2544	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2544	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2544	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	31
PID 1688 wrote to memory of 2548	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2548	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2548	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	32
PID 1688 wrote to memory of 2512	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2512	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2512	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	33
PID 1688 wrote to memory of 2436	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2436	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2436	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	34
PID 1688 wrote to memory of 2344	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2344	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2344	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	35
PID 1688 wrote to memory of 2412	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2412	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2412	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	36
PID 1688 wrote to memory of 2832	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2832	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2832	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	37
PID 1688 wrote to memory of 2988	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	38
PID 1688 wrote to memory of 2988	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	38
PID 1688 wrote to memory of 2988	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	38
PID 1688 wrote to memory of 684	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	39
PID 1688 wrote to memory of 684	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	39
PID 1688 wrote to memory of 684	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	39
PID 1688 wrote to memory of 1608	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	40
PID 1688 wrote to memory of 1608	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	40
PID 1688 wrote to memory of 1608	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	40
PID 1688 wrote to memory of 1760	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	41
PID 1688 wrote to memory of 1760	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	41
PID 1688 wrote to memory of 1760	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	41
PID 1688 wrote to memory of 756	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	42
PID 1688 wrote to memory of 756	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	42
PID 1688 wrote to memory of 756	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	42
PID 1688 wrote to memory of 2692	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	43
PID 1688 wrote to memory of 2692	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	43
PID 1688 wrote to memory of 2692	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	43
PID 1688 wrote to memory of 1960	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	44
PID 1688 wrote to memory of 1960	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	44
PID 1688 wrote to memory of 1960	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	44
PID 1688 wrote to memory of 1672	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	45
PID 1688 wrote to memory of 1672	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	45
PID 1688 wrote to memory of 1672	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	45
PID 1688 wrote to memory of 2320	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2320	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2320	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	46
PID 1688 wrote to memory of 2008	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	47
PID 1688 wrote to memory of 2008	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	47
PID 1688 wrote to memory of 2008	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	47
PID 1688 wrote to memory of 824	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	48
PID 1688 wrote to memory of 824	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	48
PID 1688 wrote to memory of 824	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	48
PID 1688 wrote to memory of 1072	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	49
PID 1688 wrote to memory of 1072	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	49
PID 1688 wrote to memory of 1072	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	49
PID 1688 wrote to memory of 1556	1688	03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ffd0e4421657df24ead0752925f3c2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2948
- C:\Windows\System\ReNkgws.exe
  C:\Windows\System\ReNkgws.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\gKnhIKw.exe
  C:\Windows\System\gKnhIKw.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\ahwGlDe.exe
  C:\Windows\System\ahwGlDe.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\TFDgfPf.exe
  C:\Windows\System\TFDgfPf.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\uJvvZow.exe
  C:\Windows\System\uJvvZow.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JsTLKTr.exe
  C:\Windows\System\JsTLKTr.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\kAsqBQp.exe
  C:\Windows\System\kAsqBQp.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\BVUnpGA.exe
  C:\Windows\System\BVUnpGA.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\HqmWSaB.exe
  C:\Windows\System\HqmWSaB.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\zgghEtQ.exe
  C:\Windows\System\zgghEtQ.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\sPtHHgK.exe
  C:\Windows\System\sPtHHgK.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\FJsdtqJ.exe
  C:\Windows\System\FJsdtqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\ABIaFuX.exe
  C:\Windows\System\ABIaFuX.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\dCuDFse.exe
  C:\Windows\System\dCuDFse.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\ktMbHHp.exe
  C:\Windows\System\ktMbHHp.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\WMnwTAL.exe
  C:\Windows\System\WMnwTAL.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\KydHVrY.exe
  C:\Windows\System\KydHVrY.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\hCDBpAn.exe
  C:\Windows\System\hCDBpAn.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\WOgdOxr.exe
  C:\Windows\System\WOgdOxr.exe
  2⤵
  - Executes dropped EXE
  PID:824
- C:\Windows\System\fAMeXBJ.exe
  C:\Windows\System\fAMeXBJ.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\JGFtiJU.exe
  C:\Windows\System\JGFtiJU.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\RRHHRJZ.exe
  C:\Windows\System\RRHHRJZ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\vWmiopk.exe
  C:\Windows\System\vWmiopk.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\dnuTGXi.exe
  C:\Windows\System\dnuTGXi.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\ANclAKt.exe
  C:\Windows\System\ANclAKt.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\pxeSQek.exe
  C:\Windows\System\pxeSQek.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\bBqhoMS.exe
  C:\Windows\System\bBqhoMS.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\iyDZcmQ.exe
  C:\Windows\System\iyDZcmQ.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\zxiqyeC.exe
  C:\Windows\System\zxiqyeC.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\bHvNuwA.exe
  C:\Windows\System\bHvNuwA.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\AcbKMTP.exe
  C:\Windows\System\AcbKMTP.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\OUGfoCs.exe
  C:\Windows\System\OUGfoCs.exe
  2⤵
  - Executes dropped EXE
  PID:644
- C:\Windows\System\jgFtRgL.exe
  C:\Windows\System\jgFtRgL.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\NVcubPg.exe
  C:\Windows\System\NVcubPg.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\AgUAcka.exe
  C:\Windows\System\AgUAcka.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\OIeypdm.exe
  C:\Windows\System\OIeypdm.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\ATZQExU.exe
  C:\Windows\System\ATZQExU.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\rzJxCCN.exe
  C:\Windows\System\rzJxCCN.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\ROObpOU.exe
  C:\Windows\System\ROObpOU.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ichrqMM.exe
  C:\Windows\System\ichrqMM.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\cBuzFmy.exe
  C:\Windows\System\cBuzFmy.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\JQcpQvL.exe
  C:\Windows\System\JQcpQvL.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\AIDdwFw.exe
  C:\Windows\System\AIDdwFw.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\ATiqlDi.exe
  C:\Windows\System\ATiqlDi.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\bBJQVmc.exe
  C:\Windows\System\bBJQVmc.exe
  2⤵
  - Executes dropped EXE
  PID:368
- C:\Windows\System\bwoamFn.exe
  C:\Windows\System\bwoamFn.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\DupJyjV.exe
  C:\Windows\System\DupJyjV.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\eiHszOH.exe
  C:\Windows\System\eiHszOH.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\EagkhXy.exe
  C:\Windows\System\EagkhXy.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\hCguWPU.exe
  C:\Windows\System\hCguWPU.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\EulZwKJ.exe
  C:\Windows\System\EulZwKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\TvyhFBB.exe
  C:\Windows\System\TvyhFBB.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\ZhxRrdV.exe
  C:\Windows\System\ZhxRrdV.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\TqkJzMn.exe
  C:\Windows\System\TqkJzMn.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\QAzebdT.exe
  C:\Windows\System\QAzebdT.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\wmvjleA.exe
  C:\Windows\System\wmvjleA.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\zLpSEHg.exe
  C:\Windows\System\zLpSEHg.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\NqYcEjf.exe
  C:\Windows\System\NqYcEjf.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\BWKQFkX.exe
  C:\Windows\System\BWKQFkX.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\jTeUNPm.exe
  C:\Windows\System\jTeUNPm.exe
  2⤵
  PID:2616
- C:\Windows\System\gdDAAtc.exe
  C:\Windows\System\gdDAAtc.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\UhgfKQF.exe
  C:\Windows\System\UhgfKQF.exe
  2⤵
  PID:2944
- C:\Windows\System\afGdZHW.exe
  C:\Windows\System\afGdZHW.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\nrZZdQt.exe
  C:\Windows\System\nrZZdQt.exe
  2⤵
  PID:2392
- C:\Windows\System\xjzMIpu.exe
  C:\Windows\System\xjzMIpu.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\deixvCr.exe
  C:\Windows\System\deixvCr.exe
  2⤵
  PID:1080
- C:\Windows\System\gUFxnzd.exe
  C:\Windows\System\gUFxnzd.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\lRzmRJW.exe
  C:\Windows\System\lRzmRJW.exe
  2⤵
  PID:2388
- C:\Windows\System\PhJfUKT.exe
  C:\Windows\System\PhJfUKT.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\hjOpUWB.exe
  C:\Windows\System\hjOpUWB.exe
  2⤵
  PID:2408
- C:\Windows\System\xklhCsO.exe
  C:\Windows\System\xklhCsO.exe
  2⤵
  PID:1744
- C:\Windows\System\fKcLGFK.exe
  C:\Windows\System\fKcLGFK.exe
  2⤵
  PID:2260
- C:\Windows\System\iaOmWtd.exe
  C:\Windows\System\iaOmWtd.exe
  2⤵
  PID:2892
- C:\Windows\System\zeKpRhL.exe
  C:\Windows\System\zeKpRhL.exe
  2⤵
  PID:2208
- C:\Windows\System\ppIsrCI.exe
  C:\Windows\System\ppIsrCI.exe
  2⤵
  PID:1284
- C:\Windows\System\maxIyfO.exe
  C:\Windows\System\maxIyfO.exe
  2⤵
  PID:1968
- C:\Windows\System\rbzkxgo.exe
  C:\Windows\System\rbzkxgo.exe
  2⤵
  PID:1976
- C:\Windows\System\ZndMxki.exe
  C:\Windows\System\ZndMxki.exe
  2⤵
  PID:2760
- C:\Windows\System\HexPyKC.exe
  C:\Windows\System\HexPyKC.exe
  2⤵
  PID:2428
- C:\Windows\System\QvcgIzL.exe
  C:\Windows\System\QvcgIzL.exe
  2⤵
  PID:2088
- C:\Windows\System\TsmWlCP.exe
  C:\Windows\System\TsmWlCP.exe
  2⤵
  PID:2816
- C:\Windows\System\xcskGCq.exe
  C:\Windows\System\xcskGCq.exe
  2⤵
  PID:916
- C:\Windows\System\OkpyomA.exe
  C:\Windows\System\OkpyomA.exe
  2⤵
  PID:1552
- C:\Windows\System\IsZgzPk.exe
  C:\Windows\System\IsZgzPk.exe
  2⤵
  PID:2180
- C:\Windows\System\hbnwxoG.exe
  C:\Windows\System\hbnwxoG.exe
  2⤵
  PID:280
- C:\Windows\System\WWZQOGl.exe
  C:\Windows\System\WWZQOGl.exe
  2⤵
  PID:940
- C:\Windows\System\mswstIv.exe
  C:\Windows\System\mswstIv.exe
  2⤵
  PID:696
- C:\Windows\System\KKUyFAF.exe
  C:\Windows\System\KKUyFAF.exe
  2⤵
  PID:340
- C:\Windows\System\hgEZFob.exe
  C:\Windows\System\hgEZFob.exe
  2⤵
  PID:1872
- C:\Windows\System\NumrciM.exe
  C:\Windows\System\NumrciM.exe
  2⤵
  PID:1988
- C:\Windows\System\VZUPLKl.exe
  C:\Windows\System\VZUPLKl.exe
  2⤵
  PID:3048
- C:\Windows\System\pKERiev.exe
  C:\Windows\System\pKERiev.exe
  2⤵
  PID:876
- C:\Windows\System\itzTEPv.exe
  C:\Windows\System\itzTEPv.exe
  2⤵
  PID:2176
- C:\Windows\System\Ubmqjzi.exe
  C:\Windows\System\Ubmqjzi.exe
  2⤵
  PID:860
- C:\Windows\System\QPzltcO.exe
  C:\Windows\System\QPzltcO.exe
  2⤵
  PID:1692
- C:\Windows\System\ubjUuCP.exe
  C:\Windows\System\ubjUuCP.exe
  2⤵
  PID:2704
- C:\Windows\System\eabYiTp.exe
  C:\Windows\System\eabYiTp.exe
  2⤵
  PID:1084
- C:\Windows\System\CgkGkTa.exe
  C:\Windows\System\CgkGkTa.exe
  2⤵
  PID:2172
- C:\Windows\System\DpaNHwf.exe
  C:\Windows\System\DpaNHwf.exe
  2⤵
  PID:1752
- C:\Windows\System\beebkJO.exe
  C:\Windows\System\beebkJO.exe
  2⤵
  PID:1424
- C:\Windows\System\QrqPHkH.exe
  C:\Windows\System\QrqPHkH.exe
  2⤵
  PID:1536
- C:\Windows\System\UXUSsTp.exe
  C:\Windows\System\UXUSsTp.exe
  2⤵
  PID:1680
- C:\Windows\System\cRJPEKQ.exe
  C:\Windows\System\cRJPEKQ.exe
  2⤵
  PID:2864
- C:\Windows\System\MvnTciK.exe
  C:\Windows\System\MvnTciK.exe
  2⤵
  PID:1324
- C:\Windows\System\VdoZbKV.exe
  C:\Windows\System\VdoZbKV.exe
  2⤵
  PID:2912
- C:\Windows\System\QmJVdly.exe
  C:\Windows\System\QmJVdly.exe
  2⤵
  PID:1412
- C:\Windows\System\oKhhjUu.exe
  C:\Windows\System\oKhhjUu.exe
  2⤵
  PID:2032
- C:\Windows\System\XYAXRoZ.exe
  C:\Windows\System\XYAXRoZ.exe
  2⤵
  PID:2852
- C:\Windows\System\KdpSOcj.exe
  C:\Windows\System\KdpSOcj.exe
  2⤵
  PID:1924
- C:\Windows\System\AZplNRS.exe
  C:\Windows\System\AZplNRS.exe
  2⤵
  PID:3076
- C:\Windows\System\pddCtBX.exe
  C:\Windows\System\pddCtBX.exe
  2⤵
  PID:3092
- C:\Windows\System\bVjDsSv.exe
  C:\Windows\System\bVjDsSv.exe
  2⤵
  PID:3116
- C:\Windows\System\fKhjFAG.exe
  C:\Windows\System\fKhjFAG.exe
  2⤵
  PID:3132
- C:\Windows\System\hmKilta.exe
  C:\Windows\System\hmKilta.exe
  2⤵
  PID:3148
- C:\Windows\System\cmHPHKA.exe
  C:\Windows\System\cmHPHKA.exe
  2⤵
  PID:3164
- C:\Windows\System\nwfYBFI.exe
  C:\Windows\System\nwfYBFI.exe
  2⤵
  PID:3180
- C:\Windows\System\baLKWmT.exe
  C:\Windows\System\baLKWmT.exe
  2⤵
  PID:3196
- C:\Windows\System\osyChws.exe
  C:\Windows\System\osyChws.exe
  2⤵
  PID:3216
- C:\Windows\System\cGzGapJ.exe
  C:\Windows\System\cGzGapJ.exe
  2⤵
  PID:3236
- C:\Windows\System\ygSzSDt.exe
  C:\Windows\System\ygSzSDt.exe
  2⤵
  PID:3252
- C:\Windows\System\KRPEfVu.exe
  C:\Windows\System\KRPEfVu.exe
  2⤵
  PID:3268
- C:\Windows\System\DLXwwdT.exe
  C:\Windows\System\DLXwwdT.exe
  2⤵
  PID:3284
- C:\Windows\System\JHDdbHf.exe
  C:\Windows\System\JHDdbHf.exe
  2⤵
  PID:3300
- C:\Windows\System\kiNhCTh.exe
  C:\Windows\System\kiNhCTh.exe
  2⤵
  PID:3368
- C:\Windows\System\jwFiLqj.exe
  C:\Windows\System\jwFiLqj.exe
  2⤵
  PID:3388
- C:\Windows\System\XltSxrr.exe
  C:\Windows\System\XltSxrr.exe
  2⤵
  PID:3404
- C:\Windows\System\pjekfTe.exe
  C:\Windows\System\pjekfTe.exe
  2⤵
  PID:3420
- C:\Windows\System\HHhmjFE.exe
  C:\Windows\System\HHhmjFE.exe
  2⤵
  PID:3436
- C:\Windows\System\jGRniHp.exe
  C:\Windows\System\jGRniHp.exe
  2⤵
  PID:3452
- C:\Windows\System\yHTHBVH.exe
  C:\Windows\System\yHTHBVH.exe
  2⤵
  PID:3468
- C:\Windows\System\IjUSgDE.exe
  C:\Windows\System\IjUSgDE.exe
  2⤵
  PID:3484
- C:\Windows\System\yvznVjj.exe
  C:\Windows\System\yvznVjj.exe
  2⤵
  PID:3500
- C:\Windows\System\FxmFyKC.exe
  C:\Windows\System\FxmFyKC.exe
  2⤵
  PID:3516
- C:\Windows\System\pQgKvBx.exe
  C:\Windows\System\pQgKvBx.exe
  2⤵
  PID:3532
- C:\Windows\System\FeCDUYx.exe
  C:\Windows\System\FeCDUYx.exe
  2⤵
  PID:3548
- C:\Windows\System\xIvUyra.exe
  C:\Windows\System\xIvUyra.exe
  2⤵
  PID:3564
- C:\Windows\System\FNdmHwT.exe
  C:\Windows\System\FNdmHwT.exe
  2⤵
  PID:3580
- C:\Windows\System\codHifm.exe
  C:\Windows\System\codHifm.exe
  2⤵
  PID:3596
- C:\Windows\System\ILlsbjS.exe
  C:\Windows\System\ILlsbjS.exe
  2⤵
  PID:3612
- C:\Windows\System\TZdHxJk.exe
  C:\Windows\System\TZdHxJk.exe
  2⤵
  PID:3628
- C:\Windows\System\jBAPYlS.exe
  C:\Windows\System\jBAPYlS.exe
  2⤵
  PID:3644
- C:\Windows\System\Evkljpw.exe
  C:\Windows\System\Evkljpw.exe
  2⤵
  PID:3660
- C:\Windows\System\pyiQpLC.exe
  C:\Windows\System\pyiQpLC.exe
  2⤵
  PID:3676
- C:\Windows\System\cFPFhAD.exe
  C:\Windows\System\cFPFhAD.exe
  2⤵
  PID:3692
- C:\Windows\System\StUIyOk.exe
  C:\Windows\System\StUIyOk.exe
  2⤵
  PID:3708
- C:\Windows\System\CzHJWYe.exe
  C:\Windows\System\CzHJWYe.exe
  2⤵
  PID:3724
- C:\Windows\System\XMwklOd.exe
  C:\Windows\System\XMwklOd.exe
  2⤵
  PID:3740
- C:\Windows\System\cqKPwOs.exe
  C:\Windows\System\cqKPwOs.exe
  2⤵
  PID:3756
- C:\Windows\System\RYgIAGI.exe
  C:\Windows\System\RYgIAGI.exe
  2⤵
  PID:3772
- C:\Windows\System\zFHsJQX.exe
  C:\Windows\System\zFHsJQX.exe
  2⤵
  PID:3792
- C:\Windows\System\PpNKzkF.exe
  C:\Windows\System\PpNKzkF.exe
  2⤵
  PID:3808
- C:\Windows\System\wigWfQU.exe
  C:\Windows\System\wigWfQU.exe
  2⤵
  PID:3824
- C:\Windows\System\qejNyyM.exe
  C:\Windows\System\qejNyyM.exe
  2⤵
  PID:3840
- C:\Windows\System\XUUGcsQ.exe
  C:\Windows\System\XUUGcsQ.exe
  2⤵
  PID:3856
- C:\Windows\System\kbnmZSU.exe
  C:\Windows\System\kbnmZSU.exe
  2⤵
  PID:3872
- C:\Windows\System\kkpbFbU.exe
  C:\Windows\System\kkpbFbU.exe
  2⤵
  PID:3888
- C:\Windows\System\JGVxVrd.exe
  C:\Windows\System\JGVxVrd.exe
  2⤵
  PID:3904
- C:\Windows\System\NahLBTr.exe
  C:\Windows\System\NahLBTr.exe
  2⤵
  PID:3920
- C:\Windows\System\LQXhATz.exe
  C:\Windows\System\LQXhATz.exe
  2⤵
  PID:3936
- C:\Windows\System\AXKofxH.exe
  C:\Windows\System\AXKofxH.exe
  2⤵
  PID:3952
- C:\Windows\System\sjBggvm.exe
  C:\Windows\System\sjBggvm.exe
  2⤵
  PID:3968
- C:\Windows\System\JLmFglD.exe
  C:\Windows\System\JLmFglD.exe
  2⤵
  PID:3984
- C:\Windows\System\QyGqKvg.exe
  C:\Windows\System\QyGqKvg.exe
  2⤵
  PID:4000
- C:\Windows\System\oZWgFmM.exe
  C:\Windows\System\oZWgFmM.exe
  2⤵
  PID:4016
- C:\Windows\System\ovJIEqn.exe
  C:\Windows\System\ovJIEqn.exe
  2⤵
  PID:4032
- C:\Windows\System\jeLoQNq.exe
  C:\Windows\System\jeLoQNq.exe
  2⤵
  PID:4048
- C:\Windows\System\xLxzFzC.exe
  C:\Windows\System\xLxzFzC.exe
  2⤵
  PID:4064
- C:\Windows\System\HDOdajH.exe
  C:\Windows\System\HDOdajH.exe
  2⤵
  PID:4080
- C:\Windows\System\dzSSfRe.exe
  C:\Windows\System\dzSSfRe.exe
  2⤵
  PID:2348
- C:\Windows\System\PZUiBFO.exe
  C:\Windows\System\PZUiBFO.exe
  2⤵
  PID:2500
- C:\Windows\System\NZdjmKM.exe
  C:\Windows\System\NZdjmKM.exe
  2⤵
  PID:2932
- C:\Windows\System\NrTkeOv.exe
  C:\Windows\System\NrTkeOv.exe
  2⤵
  PID:3100
- C:\Windows\System\rCDSfQH.exe
  C:\Windows\System\rCDSfQH.exe
  2⤵
  PID:3104
- C:\Windows\System\pcaIVuz.exe
  C:\Windows\System\pcaIVuz.exe
  2⤵
  PID:3176
- C:\Windows\System\nyOmpcn.exe
  C:\Windows\System\nyOmpcn.exe
  2⤵
  PID:2476
- C:\Windows\System\BwpLPEv.exe
  C:\Windows\System\BwpLPEv.exe
  2⤵
  PID:752
- C:\Windows\System\GsSJCaA.exe
  C:\Windows\System\GsSJCaA.exe
  2⤵
  PID:1352
- C:\Windows\System\PneEuab.exe
  C:\Windows\System\PneEuab.exe
  2⤵
  PID:3280
- C:\Windows\System\eovqeGP.exe
  C:\Windows\System\eovqeGP.exe
  2⤵
  PID:2672
- C:\Windows\System\iroVvhu.exe
  C:\Windows\System\iroVvhu.exe
  2⤵
  PID:2072
- C:\Windows\System\CYbiMRF.exe
  C:\Windows\System\CYbiMRF.exe
  2⤵
  PID:664
- C:\Windows\System\UMkmokL.exe
  C:\Windows\System\UMkmokL.exe
  2⤵
  PID:1632
- C:\Windows\System\omumbNC.exe
  C:\Windows\System\omumbNC.exe
  2⤵
  PID:2112
- C:\Windows\System\sefMBfW.exe
  C:\Windows\System\sefMBfW.exe
  2⤵
  PID:2860
- C:\Windows\System\IGZmiEG.exe
  C:\Windows\System\IGZmiEG.exe
  2⤵
  PID:2712
- C:\Windows\System\XRRlfID.exe
  C:\Windows\System\XRRlfID.exe
  2⤵
  PID:3084
- C:\Windows\System\flefBAi.exe
  C:\Windows\System\flefBAi.exe
  2⤵
  PID:3156
- C:\Windows\System\cvgdrsF.exe
  C:\Windows\System\cvgdrsF.exe
  2⤵
  PID:3192
- C:\Windows\System\fzctVpX.exe
  C:\Windows\System\fzctVpX.exe
  2⤵
  PID:3296
- C:\Windows\System\CPqISDy.exe
  C:\Windows\System\CPqISDy.exe
  2⤵
  PID:1512
- C:\Windows\System\EiyjPQs.exe
  C:\Windows\System\EiyjPQs.exe
  2⤵
  PID:1060
- C:\Windows\System\rknkLJn.exe
  C:\Windows\System\rknkLJn.exe
  2⤵
  PID:2124
- C:\Windows\System\kYYGVRX.exe
  C:\Windows\System\kYYGVRX.exe
  2⤵
  PID:1540
- C:\Windows\System\tcWizWC.exe
  C:\Windows\System\tcWizWC.exe
  2⤵
  PID:2312
- C:\Windows\System\Fbhpkgj.exe
  C:\Windows\System\Fbhpkgj.exe
  2⤵
  PID:920
- C:\Windows\System\ScbcKaN.exe
  C:\Windows\System\ScbcKaN.exe
  2⤵
  PID:2940
- C:\Windows\System\BuwBrOl.exe
  C:\Windows\System\BuwBrOl.exe
  2⤵
  PID:1916
- C:\Windows\System\RNDjYGQ.exe
  C:\Windows\System\RNDjYGQ.exe
  2⤵
  PID:2376
- C:\Windows\System\cToZPlq.exe
  C:\Windows\System\cToZPlq.exe
  2⤵
  PID:1228
- C:\Windows\System\xScDlTJ.exe
  C:\Windows\System\xScDlTJ.exe
  2⤵
  PID:2000
- C:\Windows\System\ezdKdYr.exe
  C:\Windows\System\ezdKdYr.exe
  2⤵
  PID:3384
- C:\Windows\System\KUzbahF.exe
  C:\Windows\System\KUzbahF.exe
  2⤵
  PID:3432
- C:\Windows\System\kSQgRGM.exe
  C:\Windows\System\kSQgRGM.exe
  2⤵
  PID:3412
- C:\Windows\System\vjausvZ.exe
  C:\Windows\System\vjausvZ.exe
  2⤵
  PID:3476
- C:\Windows\System\wQbnfdD.exe
  C:\Windows\System\wQbnfdD.exe
  2⤵
  PID:3508
- C:\Windows\System\nirlSaU.exe
  C:\Windows\System\nirlSaU.exe
  2⤵
  PID:3556
- C:\Windows\System\yofYiQE.exe
  C:\Windows\System\yofYiQE.exe
  2⤵
  PID:3588
- C:\Windows\System\ZhgEEXs.exe
  C:\Windows\System\ZhgEEXs.exe
  2⤵
  PID:3572
- C:\Windows\System\MRFuwKb.exe
  C:\Windows\System\MRFuwKb.exe
  2⤵
  PID:3604
- C:\Windows\System\sPkIZIJ.exe
  C:\Windows\System\sPkIZIJ.exe
  2⤵
  PID:3636
- C:\Windows\System\xIYMlNi.exe
  C:\Windows\System\xIYMlNi.exe
  2⤵
  PID:3684
- C:\Windows\System\PLrYCZa.exe
  C:\Windows\System\PLrYCZa.exe
  2⤵
  PID:3748
- C:\Windows\System\qSHniHC.exe
  C:\Windows\System\qSHniHC.exe
  2⤵
  PID:2064
- C:\Windows\System\PDwcMfr.exe
  C:\Windows\System\PDwcMfr.exe
  2⤵
  PID:3784
- C:\Windows\System\wVvEjEt.exe
  C:\Windows\System\wVvEjEt.exe
  2⤵
  PID:3848
- C:\Windows\System\rLfZwPH.exe
  C:\Windows\System\rLfZwPH.exe
  2⤵
  PID:3736
- C:\Windows\System\FGXQcmD.exe
  C:\Windows\System\FGXQcmD.exe
  2⤵
  PID:3804
- C:\Windows\System\dCpmTVc.exe
  C:\Windows\System\dCpmTVc.exe
  2⤵
  PID:3912
- C:\Windows\System\cNBUCVc.exe
  C:\Windows\System\cNBUCVc.exe
  2⤵
  PID:3864
- C:\Windows\System\VxWmdEI.exe
  C:\Windows\System\VxWmdEI.exe
  2⤵
  PID:1996
- C:\Windows\System\BXSFhua.exe
  C:\Windows\System\BXSFhua.exe
  2⤵
  PID:2580
- C:\Windows\System\FrkLkHe.exe
  C:\Windows\System\FrkLkHe.exe
  2⤵
  PID:4008
- C:\Windows\System\tNDDsuC.exe
  C:\Windows\System\tNDDsuC.exe
  2⤵
  PID:4012
- C:\Windows\System\PQsZXOK.exe
  C:\Windows\System\PQsZXOK.exe
  2⤵
  PID:4040
- C:\Windows\System\tmEDMgV.exe
  C:\Windows\System\tmEDMgV.exe
  2⤵
  PID:4028
- C:\Windows\System\cuLhWlF.exe
  C:\Windows\System\cuLhWlF.exe
  2⤵
  PID:4092
- C:\Windows\System\ZIUeMoh.exe
  C:\Windows\System\ZIUeMoh.exe
  2⤵
  PID:1576
- C:\Windows\System\ssvRSLE.exe
  C:\Windows\System\ssvRSLE.exe
  2⤵
  PID:3208
- C:\Windows\System\WIizNem.exe
  C:\Windows\System\WIizNem.exe
  2⤵
  PID:3248
- C:\Windows\System\qsKcNAu.exe
  C:\Windows\System\qsKcNAu.exe
  2⤵
  PID:2492
- C:\Windows\System\qzQLPom.exe
  C:\Windows\System\qzQLPom.exe
  2⤵
  PID:2460
- C:\Windows\System\ngUlTOk.exe
  C:\Windows\System\ngUlTOk.exe
  2⤵
  PID:2820
- C:\Windows\System\gkTwfSZ.exe
  C:\Windows\System\gkTwfSZ.exe
  2⤵
  PID:564
- C:\Windows\System\swpkZgp.exe
  C:\Windows\System\swpkZgp.exe
  2⤵
  PID:1724
- C:\Windows\System\wMrTkHf.exe
  C:\Windows\System\wMrTkHf.exe
  2⤵
  PID:2752
- C:\Windows\System\TgKwEsT.exe
  C:\Windows\System\TgKwEsT.exe
  2⤵
  PID:3264
- C:\Windows\System\sfUjnLq.exe
  C:\Windows\System\sfUjnLq.exe
  2⤵
  PID:2316
- C:\Windows\System\VyfqKoW.exe
  C:\Windows\System\VyfqKoW.exe
  2⤵
  PID:3260
- C:\Windows\System\IqfmufS.exe
  C:\Windows\System\IqfmufS.exe
  2⤵
  PID:2216
- C:\Windows\System\EElsmVs.exe
  C:\Windows\System\EElsmVs.exe
  2⤵
  PID:1600
- C:\Windows\System\oBkjxps.exe
  C:\Windows\System\oBkjxps.exe
  2⤵
  PID:1788
- C:\Windows\System\FJkcfRR.exe
  C:\Windows\System\FJkcfRR.exe
  2⤵
  PID:3400
- C:\Windows\System\pWRnzLO.exe
  C:\Windows\System\pWRnzLO.exe
  2⤵
  PID:2576
- C:\Windows\System\VtWjZDt.exe
  C:\Windows\System\VtWjZDt.exe
  2⤵
  PID:324
- C:\Windows\System\myJPabL.exe
  C:\Windows\System\myJPabL.exe
  2⤵
  PID:3592
- C:\Windows\System\YYRCFVE.exe
  C:\Windows\System\YYRCFVE.exe
  2⤵
  PID:3560
- C:\Windows\System\GdetBNZ.exe
  C:\Windows\System\GdetBNZ.exe
  2⤵
  PID:3620
- C:\Windows\System\wsnTjtQ.exe
  C:\Windows\System\wsnTjtQ.exe
  2⤵
  PID:3720
- C:\Windows\System\hyOzPzA.exe
  C:\Windows\System\hyOzPzA.exe
  2⤵
  PID:2564
- C:\Windows\System\IMcEaXX.exe
  C:\Windows\System\IMcEaXX.exe
  2⤵
  PID:3700
- C:\Windows\System\ZUezaZh.exe
  C:\Windows\System\ZUezaZh.exe
  2⤵
  PID:2968
- C:\Windows\System\PXfyqiI.exe
  C:\Windows\System\PXfyqiI.exe
  2⤵
  PID:1824
- C:\Windows\System\wSCGfiC.exe
  C:\Windows\System\wSCGfiC.exe
  2⤵
  PID:1252
- C:\Windows\System\zDLubcM.exe
  C:\Windows\System\zDLubcM.exe
  2⤵
  PID:3928
- C:\Windows\System\lwuqLlV.exe
  C:\Windows\System\lwuqLlV.exe
  2⤵
  PID:4056
- C:\Windows\System\UxIgHYj.exe
  C:\Windows\System\UxIgHYj.exe
  2⤵
  PID:4100
- C:\Windows\System\JNyVVMX.exe
  C:\Windows\System\JNyVVMX.exe
  2⤵
  PID:4116
- C:\Windows\System\pCEnvGW.exe
  C:\Windows\System\pCEnvGW.exe
  2⤵
  PID:4132
- C:\Windows\System\jfIBEFa.exe
  C:\Windows\System\jfIBEFa.exe
  2⤵
  PID:4148
- C:\Windows\System\FkQwwpu.exe
  C:\Windows\System\FkQwwpu.exe
  2⤵
  PID:4164
- C:\Windows\System\RvkyLLt.exe
  C:\Windows\System\RvkyLLt.exe
  2⤵
  PID:4180
- C:\Windows\System\bjCgJLt.exe
  C:\Windows\System\bjCgJLt.exe
  2⤵
  PID:4196
- C:\Windows\System\GrCWfjN.exe
  C:\Windows\System\GrCWfjN.exe
  2⤵
  PID:4212
- C:\Windows\System\KNLPriM.exe
  C:\Windows\System\KNLPriM.exe
  2⤵
  PID:4228
- C:\Windows\System\XLxdRlF.exe
  C:\Windows\System\XLxdRlF.exe
  2⤵
  PID:4244
- C:\Windows\System\ZLPlVpJ.exe
  C:\Windows\System\ZLPlVpJ.exe
  2⤵
  PID:4260
- C:\Windows\System\NKKTLkf.exe
  C:\Windows\System\NKKTLkf.exe
  2⤵
  PID:4276
- C:\Windows\System\yMoYdaM.exe
  C:\Windows\System\yMoYdaM.exe
  2⤵
  PID:4292
- C:\Windows\System\fwImsLB.exe
  C:\Windows\System\fwImsLB.exe
  2⤵
  PID:4308
- C:\Windows\System\swCJKIW.exe
  C:\Windows\System\swCJKIW.exe
  2⤵
  PID:4400
- C:\Windows\System\XuwLrNL.exe
  C:\Windows\System\XuwLrNL.exe
  2⤵
  PID:4416
- C:\Windows\System\CFXoeaA.exe
  C:\Windows\System\CFXoeaA.exe
  2⤵
  PID:4436
- C:\Windows\System\xHXsLPk.exe
  C:\Windows\System\xHXsLPk.exe
  2⤵
  PID:4452
- C:\Windows\System\jTXMoSt.exe
  C:\Windows\System\jTXMoSt.exe
  2⤵
  PID:4468
- C:\Windows\System\kwbiMuP.exe
  C:\Windows\System\kwbiMuP.exe
  2⤵
  PID:4484
- C:\Windows\System\hCgiVQf.exe
  C:\Windows\System\hCgiVQf.exe
  2⤵
  PID:4500
- C:\Windows\System\NkwOTqY.exe
  C:\Windows\System\NkwOTqY.exe
  2⤵
  PID:4516
- C:\Windows\System\SjiPRup.exe
  C:\Windows\System\SjiPRup.exe
  2⤵
  PID:4532
- C:\Windows\System\xHUtfpa.exe
  C:\Windows\System\xHUtfpa.exe
  2⤵
  PID:4548
- C:\Windows\System\XwzUYUr.exe
  C:\Windows\System\XwzUYUr.exe
  2⤵
  PID:4564
- C:\Windows\System\IpjToNQ.exe
  C:\Windows\System\IpjToNQ.exe
  2⤵
  PID:4580
- C:\Windows\System\EdvQRxR.exe
  C:\Windows\System\EdvQRxR.exe
  2⤵
  PID:4596
- C:\Windows\System\JAVKDbX.exe
  C:\Windows\System\JAVKDbX.exe
  2⤵
  PID:4612
- C:\Windows\System\KcrUGGp.exe
  C:\Windows\System\KcrUGGp.exe
  2⤵
  PID:4628
- C:\Windows\System\XBJbMCs.exe
  C:\Windows\System\XBJbMCs.exe
  2⤵
  PID:4644
- C:\Windows\System\EHDvUIC.exe
  C:\Windows\System\EHDvUIC.exe
  2⤵
  PID:4660
- C:\Windows\System\KvDClOH.exe
  C:\Windows\System\KvDClOH.exe
  2⤵
  PID:4676
- C:\Windows\System\fRvguaC.exe
  C:\Windows\System\fRvguaC.exe
  2⤵
  PID:4692
- C:\Windows\System\dYCioZq.exe
  C:\Windows\System\dYCioZq.exe
  2⤵
  PID:4712
- C:\Windows\System\IDpjtBK.exe
  C:\Windows\System\IDpjtBK.exe
  2⤵
  PID:4728
- C:\Windows\System\YDhjkrm.exe
  C:\Windows\System\YDhjkrm.exe
  2⤵
  PID:4748
- C:\Windows\System\TBHplpu.exe
  C:\Windows\System\TBHplpu.exe
  2⤵
  PID:4772
- C:\Windows\System\JiKTNNx.exe
  C:\Windows\System\JiKTNNx.exe
  2⤵
  PID:4800
- C:\Windows\System\IMNpzrI.exe
  C:\Windows\System\IMNpzrI.exe
  2⤵
  PID:4816
- C:\Windows\System\WiIOeGs.exe
  C:\Windows\System\WiIOeGs.exe
  2⤵
  PID:4832
- C:\Windows\System\htoqTAd.exe
  C:\Windows\System\htoqTAd.exe
  2⤵
  PID:4848
- C:\Windows\System\fEpRFbn.exe
  C:\Windows\System\fEpRFbn.exe
  2⤵
  PID:4864
- C:\Windows\System\uJQoEhU.exe
  C:\Windows\System\uJQoEhU.exe
  2⤵
  PID:4880
- C:\Windows\System\XcwgVSt.exe
  C:\Windows\System\XcwgVSt.exe
  2⤵
  PID:4896
- C:\Windows\System\LsmYIfF.exe
  C:\Windows\System\LsmYIfF.exe
  2⤵
  PID:4912
- C:\Windows\System\rpGTeNK.exe
  C:\Windows\System\rpGTeNK.exe
  2⤵
  PID:4928
- C:\Windows\System\cvUTFOb.exe
  C:\Windows\System\cvUTFOb.exe
  2⤵
  PID:4944
- C:\Windows\System\IMwZgjH.exe
  C:\Windows\System\IMwZgjH.exe
  2⤵
  PID:4960
- C:\Windows\System\ogDrMZN.exe
  C:\Windows\System\ogDrMZN.exe
  2⤵
  PID:4976
- C:\Windows\System\ltyJVgz.exe
  C:\Windows\System\ltyJVgz.exe
  2⤵
  PID:4992
- C:\Windows\System\JwwtzLu.exe
  C:\Windows\System\JwwtzLu.exe
  2⤵
  PID:5008
- C:\Windows\System\AJxCMkS.exe
  C:\Windows\System\AJxCMkS.exe
  2⤵
  PID:5024
- C:\Windows\System\qOLAVRf.exe
  C:\Windows\System\qOLAVRf.exe
  2⤵
  PID:5040
- C:\Windows\System\btodSIa.exe
  C:\Windows\System\btodSIa.exe
  2⤵
  PID:5056
- C:\Windows\System\aBfdOKU.exe
  C:\Windows\System\aBfdOKU.exe
  2⤵
  PID:5072
- C:\Windows\System\MfyAEvV.exe
  C:\Windows\System\MfyAEvV.exe
  2⤵
  PID:5088
- C:\Windows\System\NgkElNx.exe
  C:\Windows\System\NgkElNx.exe
  2⤵
  PID:5104
- C:\Windows\System\VYwUKoz.exe
  C:\Windows\System\VYwUKoz.exe
  2⤵
  PID:2928
- C:\Windows\System\ajKFrYM.exe
  C:\Windows\System\ajKFrYM.exe
  2⤵
  PID:2192
- C:\Windows\System\NbtZBUR.exe
  C:\Windows\System\NbtZBUR.exe
  2⤵
  PID:1700
- C:\Windows\System\JaOSekc.exe
  C:\Windows\System\JaOSekc.exe
  2⤵
  PID:2024
- C:\Windows\System\mumhUee.exe
  C:\Windows\System\mumhUee.exe
  2⤵
  PID:3144
- C:\Windows\System\EzEUGlM.exe
  C:\Windows\System\EzEUGlM.exe
  2⤵
  PID:936
- C:\Windows\System\uISwkzX.exe
  C:\Windows\System\uISwkzX.exe
  2⤵
  PID:2468
- C:\Windows\System\fCOledf.exe
  C:\Windows\System\fCOledf.exe
  2⤵
  PID:3944
- C:\Windows\System\xgBcaHJ.exe
  C:\Windows\System\xgBcaHJ.exe
  2⤵
  PID:1836
- C:\Windows\System\qRPuvhW.exe
  C:\Windows\System\qRPuvhW.exe
  2⤵
  PID:2756
- C:\Windows\System\iwmDmcJ.exe
  C:\Windows\System\iwmDmcJ.exe
  2⤵
  PID:3528
- C:\Windows\System\YaYkrBK.exe
  C:\Windows\System\YaYkrBK.exe
  2⤵
  PID:3732
- C:\Windows\System\ulzZWIE.exe
  C:\Windows\System\ulzZWIE.exe
  2⤵
  PID:3836
- C:\Windows\System\IpFMUwf.exe
  C:\Windows\System\IpFMUwf.exe
  2⤵
  PID:4124
- C:\Windows\System\ARTzZJD.exe
  C:\Windows\System\ARTzZJD.exe
  2⤵
  PID:4348
- C:\Windows\System\wUAplbk.exe
  C:\Windows\System\wUAplbk.exe
  2⤵
  PID:4364
- C:\Windows\System\japjZTe.exe
  C:\Windows\System\japjZTe.exe
  2⤵
  PID:4380
- C:\Windows\System\KghcAog.exe
  C:\Windows\System\KghcAog.exe
  2⤵
  PID:4392
- C:\Windows\System\DuBHntS.exe
  C:\Windows\System\DuBHntS.exe
  2⤵
  PID:4460
- C:\Windows\System\AohuPFi.exe
  C:\Windows\System\AohuPFi.exe
  2⤵
  PID:4528
- C:\Windows\System\WMMWtYa.exe
  C:\Windows\System\WMMWtYa.exe
  2⤵
  PID:4388
- C:\Windows\System\kkqknqi.exe
  C:\Windows\System\kkqknqi.exe
  2⤵
  PID:4656
- C:\Windows\System\OBpnGnV.exe
  C:\Windows\System\OBpnGnV.exe
  2⤵
  PID:4720
- C:\Windows\System\ZKkKYHR.exe
  C:\Windows\System\ZKkKYHR.exe
  2⤵
  PID:4768
- C:\Windows\System\mMAhHZw.exe
  C:\Windows\System\mMAhHZw.exe
  2⤵
  PID:4812
- C:\Windows\System\TIMqpsl.exe
  C:\Windows\System\TIMqpsl.exe
  2⤵
  PID:1796
- C:\Windows\System\RtQOiFx.exe
  C:\Windows\System\RtQOiFx.exe
  2⤵
  PID:3244
- C:\Windows\System\awebaEN.exe
  C:\Windows\System\awebaEN.exe
  2⤵
  PID:568
- C:\Windows\System\trPUjcr.exe
  C:\Windows\System\trPUjcr.exe
  2⤵
  PID:1820
- C:\Windows\System\waFnfKp.exe
  C:\Windows\System\waFnfKp.exe
  2⤵
  PID:1508
- C:\Windows\System\EAqyFae.exe
  C:\Windows\System\EAqyFae.exe
  2⤵
  PID:3380
- C:\Windows\System\kZyyvoK.exe
  C:\Windows\System\kZyyvoK.exe
  2⤵
  PID:3608
- C:\Windows\System\lLPaVGn.exe
  C:\Windows\System\lLPaVGn.exe
  2⤵
  PID:4872
- C:\Windows\System\RFoTOjR.exe
  C:\Windows\System\RFoTOjR.exe
  2⤵
  PID:4936
- C:\Windows\System\MwfruLv.exe
  C:\Windows\System\MwfruLv.exe
  2⤵
  PID:4140
- C:\Windows\System\yWouQwd.exe
  C:\Windows\System\yWouQwd.exe
  2⤵
  PID:4408
- C:\Windows\System\WjOjGyh.exe
  C:\Windows\System\WjOjGyh.exe
  2⤵
  PID:2012
- C:\Windows\System\HCmCZSx.exe
  C:\Windows\System\HCmCZSx.exe
  2⤵
  PID:4888
- C:\Windows\System\eZLUnWL.exe
  C:\Windows\System\eZLUnWL.exe
  2⤵
  PID:1992
- C:\Windows\System\YzlABxJ.exe
  C:\Windows\System\YzlABxJ.exe
  2⤵
  PID:4608
- C:\Windows\System\kNxwyHt.exe
  C:\Windows\System\kNxwyHt.exe
  2⤵
  PID:4956
- C:\Windows\System\uoamyrE.exe
  C:\Windows\System\uoamyrE.exe
  2⤵
  PID:4204
- C:\Windows\System\nSniZOo.exe
  C:\Windows\System\nSniZOo.exe
  2⤵
  PID:4272
- C:\Windows\System\JdolMDq.exe
  C:\Windows\System\JdolMDq.exe
  2⤵
  PID:4824
- C:\Windows\System\BkjtonZ.exe
  C:\Windows\System\BkjtonZ.exe
  2⤵
  PID:5004
- C:\Windows\System\UDklPng.exe
  C:\Windows\System\UDklPng.exe
  2⤵
  PID:4892
- C:\Windows\System\xPcZJJZ.exe
  C:\Windows\System\xPcZJJZ.exe
  2⤵
  PID:1304
- C:\Windows\System\zCXpCJv.exe
  C:\Windows\System\zCXpCJv.exe
  2⤵
  PID:4700
- C:\Windows\System\QGDxMoK.exe
  C:\Windows\System\QGDxMoK.exe
  2⤵
  PID:4788
- C:\Windows\System\txRKiVU.exe
  C:\Windows\System\txRKiVU.exe
  2⤵
  PID:3932
- C:\Windows\System\YZmzFIY.exe
  C:\Windows\System\YZmzFIY.exe
  2⤵
  PID:5052
- C:\Windows\System\PXhYovF.exe
  C:\Windows\System\PXhYovF.exe
  2⤵
  PID:5116
- C:\Windows\System\LkjrIRK.exe
  C:\Windows\System\LkjrIRK.exe
  2⤵
  PID:2872
- C:\Windows\System\SuKlAMr.exe
  C:\Windows\System\SuKlAMr.exe
  2⤵
  PID:2688
- C:\Windows\System\vRdQEje.exe
  C:\Windows\System\vRdQEje.exe
  2⤵
  PID:1192
- C:\Windows\System\iSXItjh.exe
  C:\Windows\System\iSXItjh.exe
  2⤵
  PID:3996
- C:\Windows\System\hjvemEg.exe
  C:\Windows\System\hjvemEg.exe
  2⤵
  PID:332
- C:\Windows\System\yfyAOQk.exe
  C:\Windows\System\yfyAOQk.exe
  2⤵
  PID:4360
- C:\Windows\System\ZBzucrJ.exe
  C:\Windows\System\ZBzucrJ.exe
  2⤵
  PID:4492
- C:\Windows\System\LJZBWXH.exe
  C:\Windows\System\LJZBWXH.exe
  2⤵
  PID:4756
- C:\Windows\System\icjeefE.exe
  C:\Windows\System\icjeefE.exe
  2⤵
  PID:2764
- C:\Windows\System\UOuMpYV.exe
  C:\Windows\System\UOuMpYV.exe
  2⤵
  PID:2380
- C:\Windows\System\tDyPMAI.exe
  C:\Windows\System\tDyPMAI.exe
  2⤵
  PID:4908
- C:\Windows\System\ykMCeFj.exe
  C:\Windows\System\ykMCeFj.exe
  2⤵
  PID:4968
- C:\Windows\System\gpCkBIa.exe
  C:\Windows\System\gpCkBIa.exe
  2⤵
  PID:4672
- C:\Windows\System\RvpXojN.exe
  C:\Windows\System\RvpXojN.exe
  2⤵
  PID:4192
- C:\Windows\System\uvLAgFh.exe
  C:\Windows\System\uvLAgFh.exe
  2⤵
  PID:4328
- C:\Windows\System\rIGVObH.exe
  C:\Windows\System\rIGVObH.exe
  2⤵
  PID:4792
- C:\Windows\System\NzEpgBO.exe
  C:\Windows\System\NzEpgBO.exe
  2⤵
  PID:4428
- C:\Windows\System\wNiZCjO.exe
  C:\Windows\System\wNiZCjO.exe
  2⤵
  PID:4588
- C:\Windows\System\CfCmTmD.exe
  C:\Windows\System\CfCmTmD.exe
  2⤵
  PID:2888
- C:\Windows\System\HwzBrJq.exe
  C:\Windows\System\HwzBrJq.exe
  2⤵
  PID:4984
- C:\Windows\System\AuESsTF.exe
  C:\Windows\System\AuESsTF.exe
  2⤵
  PID:5096
- C:\Windows\System\EQVqCih.exe
  C:\Windows\System\EQVqCih.exe
  2⤵
  PID:2220
- C:\Windows\System\LCFrkBZ.exe
  C:\Windows\System\LCFrkBZ.exe
  2⤵
  PID:4128
- C:\Windows\System\ZLNIHyj.exe
  C:\Windows\System\ZLNIHyj.exe
  2⤵
  PID:4736
- C:\Windows\System\dMbylbk.exe
  C:\Windows\System\dMbylbk.exe
  2⤵
  PID:2916
- C:\Windows\System\BZIYIyM.exe
  C:\Windows\System\BZIYIyM.exe
  2⤵
  PID:4444
- C:\Windows\System\oKtkDsK.exe
  C:\Windows\System\oKtkDsK.exe
  2⤵
  PID:4508
- C:\Windows\System\fscVhbb.exe
  C:\Windows\System\fscVhbb.exe
  2⤵
  PID:5112
- C:\Windows\System\OHhabMN.exe
  C:\Windows\System\OHhabMN.exe
  2⤵
  PID:3624
- C:\Windows\System\HNSglZM.exe
  C:\Windows\System\HNSglZM.exe
  2⤵
  PID:4620
- C:\Windows\System\mfrMHoQ.exe
  C:\Windows\System\mfrMHoQ.exe
  2⤵
  PID:3768
- C:\Windows\System\RuqryJJ.exe
  C:\Windows\System\RuqryJJ.exe
  2⤵
  PID:4332
- C:\Windows\System\PtmbssA.exe
  C:\Windows\System\PtmbssA.exe
  2⤵
  PID:4544
- C:\Windows\System\gmpEJRV.exe
  C:\Windows\System\gmpEJRV.exe
  2⤵
  PID:4988
- C:\Windows\System\toWimmp.exe
  C:\Windows\System\toWimmp.exe
  2⤵
  PID:2304
- C:\Windows\System\FHbqYWG.exe
  C:\Windows\System\FHbqYWG.exe
  2⤵
  PID:3356
- C:\Windows\System\BYCGAjq.exe
  C:\Windows\System\BYCGAjq.exe
  2⤵
  PID:2144
- C:\Windows\System\tNvSpcV.exe
  C:\Windows\System\tNvSpcV.exe
  2⤵
  PID:4072
- C:\Windows\System\GzTzUIi.exe
  C:\Windows\System\GzTzUIi.exe
  2⤵
  PID:4176
- C:\Windows\System\GxoPnFG.exe
  C:\Windows\System\GxoPnFG.exe
  2⤵
  PID:2556
- C:\Windows\System\ancXLVZ.exe
  C:\Windows\System\ancXLVZ.exe
  2⤵
  PID:4724
- C:\Windows\System\VYvRKGA.exe
  C:\Windows\System\VYvRKGA.exe
  2⤵
  PID:4344
- C:\Windows\System\WPIfYdA.exe
  C:\Windows\System\WPIfYdA.exe
  2⤵
  PID:4512
- C:\Windows\System\zfnFZbO.exe
  C:\Windows\System\zfnFZbO.exe
  2⤵
  PID:4316
- C:\Windows\System\GzzQKnM.exe
  C:\Windows\System\GzzQKnM.exe
  2⤵
  PID:4860
- C:\Windows\System\jRHEGwe.exe
  C:\Windows\System\jRHEGwe.exe
  2⤵
  PID:2780
- C:\Windows\System\jsnFRKz.exe
  C:\Windows\System\jsnFRKz.exe
  2⤵
  PID:5084
- C:\Windows\System\hPqHEsn.exe
  C:\Windows\System\hPqHEsn.exe
  2⤵
  PID:4972
- C:\Windows\System\RClAYAr.exe
  C:\Windows\System\RClAYAr.exe
  2⤵
  PID:2648
- C:\Windows\System\sHqFQUC.exe
  C:\Windows\System\sHqFQUC.exe
  2⤵
  PID:3964
- C:\Windows\System\ORjyuLA.exe
  C:\Windows\System\ORjyuLA.exe
  2⤵
  PID:1856
- C:\Windows\System\fOxSOOJ.exe
  C:\Windows\System\fOxSOOJ.exe
  2⤵
  PID:3480
- C:\Windows\System\LgIiYtW.exe
  C:\Windows\System\LgIiYtW.exe
  2⤵
  PID:3896
- C:\Windows\System\QdxYKnG.exe
  C:\Windows\System\QdxYKnG.exe
  2⤵
  PID:4940
- C:\Windows\System\QuIiwvt.exe
  C:\Windows\System\QuIiwvt.exe
  2⤵
  PID:4524
- C:\Windows\System\OvgBJOg.exe
  C:\Windows\System\OvgBJOg.exe
  2⤵
  PID:4424
- C:\Windows\System\mznZeLA.exe
  C:\Windows\System\mznZeLA.exe
  2⤵
  PID:5016
- C:\Windows\System\AALNDja.exe
  C:\Windows\System\AALNDja.exe
  2⤵
  PID:5020
- C:\Windows\System\PgMAzAj.exe
  C:\Windows\System\PgMAzAj.exe
  2⤵
  PID:5124
- C:\Windows\System\bpftIMM.exe
  C:\Windows\System\bpftIMM.exe
  2⤵
  PID:5140
- C:\Windows\System\xONlMTQ.exe
  C:\Windows\System\xONlMTQ.exe
  2⤵
  PID:5156
- C:\Windows\System\ZLMCrIM.exe
  C:\Windows\System\ZLMCrIM.exe
  2⤵
  PID:5172
- C:\Windows\System\lGTfdlv.exe
  C:\Windows\System\lGTfdlv.exe
  2⤵
  PID:5188
- C:\Windows\System\tQIzWQI.exe
  C:\Windows\System\tQIzWQI.exe
  2⤵
  PID:5204
- C:\Windows\System\EXxeREq.exe
  C:\Windows\System\EXxeREq.exe
  2⤵
  PID:5220
- C:\Windows\System\nETaJsE.exe
  C:\Windows\System\nETaJsE.exe
  2⤵
  PID:5236
- C:\Windows\System\JFabYwT.exe
  C:\Windows\System\JFabYwT.exe
  2⤵
  PID:5252
- C:\Windows\System\wvJWNwe.exe
  C:\Windows\System\wvJWNwe.exe
  2⤵
  PID:5268
- C:\Windows\System\UEdbENm.exe
  C:\Windows\System\UEdbENm.exe
  2⤵
  PID:5284
- C:\Windows\System\IHzpUHa.exe
  C:\Windows\System\IHzpUHa.exe
  2⤵
  PID:5300
- C:\Windows\System\AFXEjQx.exe
  C:\Windows\System\AFXEjQx.exe
  2⤵
  PID:5320
- C:\Windows\System\ffeWsTo.exe
  C:\Windows\System\ffeWsTo.exe
  2⤵
  PID:5348
- C:\Windows\System\tQzkJRX.exe
  C:\Windows\System\tQzkJRX.exe
  2⤵
  PID:5364
- C:\Windows\System\VFQLwLl.exe
  C:\Windows\System\VFQLwLl.exe
  2⤵
  PID:5384
- C:\Windows\System\kyWdubF.exe
  C:\Windows\System\kyWdubF.exe
  2⤵
  PID:5404
- C:\Windows\System\BQieybw.exe
  C:\Windows\System\BQieybw.exe
  2⤵
  PID:5516
- C:\Windows\System\DAsEZey.exe
  C:\Windows\System\DAsEZey.exe
  2⤵
  PID:5532
- C:\Windows\System\eUvDYmh.exe
  C:\Windows\System\eUvDYmh.exe
  2⤵
  PID:5548
- C:\Windows\System\EnyBqZh.exe
  C:\Windows\System\EnyBqZh.exe
  2⤵
  PID:5564
- C:\Windows\System\PwBYojc.exe
  C:\Windows\System\PwBYojc.exe
  2⤵
  PID:5580
- C:\Windows\System\GFEXnnm.exe
  C:\Windows\System\GFEXnnm.exe
  2⤵
  PID:5608
- C:\Windows\System\fazejdK.exe
  C:\Windows\System\fazejdK.exe
  2⤵
  PID:5624
- C:\Windows\System\hgOErtO.exe
  C:\Windows\System\hgOErtO.exe
  2⤵
  PID:5640
- C:\Windows\System\YjORoci.exe
  C:\Windows\System\YjORoci.exe
  2⤵
  PID:5656
- C:\Windows\System\uGacjsf.exe
  C:\Windows\System\uGacjsf.exe
  2⤵
  PID:5672
- C:\Windows\System\HMJszCB.exe
  C:\Windows\System\HMJszCB.exe
  2⤵
  PID:5688
- C:\Windows\System\AYHkkiZ.exe
  C:\Windows\System\AYHkkiZ.exe
  2⤵
  PID:5704
- C:\Windows\System\yDyHZAi.exe
  C:\Windows\System\yDyHZAi.exe
  2⤵
  PID:5752
- C:\Windows\System\tvGUCQz.exe
  C:\Windows\System\tvGUCQz.exe
  2⤵
  PID:5784
- C:\Windows\System\gocTcZr.exe
  C:\Windows\System\gocTcZr.exe
  2⤵
  PID:5916
- C:\Windows\System\MpbIfwE.exe
  C:\Windows\System\MpbIfwE.exe
  2⤵
  PID:6084
- C:\Windows\System\PVNWdOH.exe
  C:\Windows\System\PVNWdOH.exe
  2⤵
  PID:4576
- C:\Windows\System\EfpYJrR.exe
  C:\Windows\System\EfpYJrR.exe
  2⤵
  PID:5132
- C:\Windows\System\urYLOBn.exe
  C:\Windows\System\urYLOBn.exe
  2⤵
  PID:4208
- C:\Windows\System\eBvPWOL.exe
  C:\Windows\System\eBvPWOL.exe
  2⤵
  PID:5080
- C:\Windows\System\dyQUriK.exe
  C:\Windows\System\dyQUriK.exe
  2⤵
  PID:2848
- C:\Windows\System\wrhfHeG.exe
  C:\Windows\System\wrhfHeG.exe
  2⤵
  PID:5200
- C:\Windows\System\TYFmghB.exe
  C:\Windows\System\TYFmghB.exe
  2⤵
  PID:5264
- C:\Windows\System\LlPwDOn.exe
  C:\Windows\System\LlPwDOn.exe
  2⤵
  PID:5296
- C:\Windows\System\yVdTQAj.exe
  C:\Windows\System\yVdTQAj.exe
  2⤵
  PID:2404
- C:\Windows\System\wiAbHWl.exe
  C:\Windows\System\wiAbHWl.exe
  2⤵
  PID:5312
- C:\Windows\System\nPZnFCp.exe
  C:\Windows\System\nPZnFCp.exe
  2⤵
  PID:5216
- C:\Windows\System\BNthUxs.exe
  C:\Windows\System\BNthUxs.exe
  2⤵
  PID:5340
- C:\Windows\System\OYlgiPd.exe
  C:\Windows\System\OYlgiPd.exe
  2⤵
  PID:5372
- C:\Windows\System\Ukjstks.exe
  C:\Windows\System\Ukjstks.exe
  2⤵
  PID:5184
- C:\Windows\System\uFJcCLY.exe
  C:\Windows\System\uFJcCLY.exe
  2⤵
  PID:5400
- C:\Windows\System\kmObnzE.exe
  C:\Windows\System\kmObnzE.exe
  2⤵
  PID:5424
- C:\Windows\System\eCSSvEa.exe
  C:\Windows\System\eCSSvEa.exe
  2⤵
  PID:5448
- C:\Windows\System\iKjahJb.exe
  C:\Windows\System\iKjahJb.exe
  2⤵
  PID:2608
- C:\Windows\System\myvrhIT.exe
  C:\Windows\System\myvrhIT.exe
  2⤵
  PID:960
- C:\Windows\System\wpKoaAL.exe
  C:\Windows\System\wpKoaAL.exe
  2⤵
  PID:5472
- C:\Windows\System\rqrogEX.exe
  C:\Windows\System\rqrogEX.exe
  2⤵
  PID:5484
- C:\Windows\System\mmOmYdZ.exe
  C:\Windows\System\mmOmYdZ.exe
  2⤵
  PID:5496
- C:\Windows\System\pXmkPfp.exe
  C:\Windows\System\pXmkPfp.exe
  2⤵
  PID:1572
- C:\Windows\System\cgjPCNM.exe
  C:\Windows\System\cgjPCNM.exe
  2⤵
  PID:5600
- C:\Windows\System\CdvGXGV.exe
  C:\Windows\System\CdvGXGV.exe
  2⤵
  PID:5668
- C:\Windows\System\keTjAMx.exe
  C:\Windows\System\keTjAMx.exe
  2⤵
  PID:5716
- C:\Windows\System\wLCKOeo.exe
  C:\Windows\System\wLCKOeo.exe
  2⤵
  PID:5740
- C:\Windows\System\GvbpqmL.exe
  C:\Windows\System\GvbpqmL.exe
  2⤵
  PID:5652
- C:\Windows\System\iUJIHiZ.exe
  C:\Windows\System\iUJIHiZ.exe
  2⤵
  PID:5616
- C:\Windows\System\tvJKDag.exe
  C:\Windows\System\tvJKDag.exe
  2⤵
  PID:2480
- C:\Windows\System\QMmYkQe.exe
  C:\Windows\System\QMmYkQe.exe
  2⤵
  PID:5576
- C:\Windows\System\UKMqhYQ.exe
  C:\Windows\System\UKMqhYQ.exe
  2⤵
  PID:5528
- C:\Windows\System\kcNQFWW.exe
  C:\Windows\System\kcNQFWW.exe
  2⤵
  PID:5764
- C:\Windows\System\ICEpyaQ.exe
  C:\Windows\System\ICEpyaQ.exe
  2⤵
  PID:5780
- C:\Windows\System\qVSrDhz.exe
  C:\Windows\System\qVSrDhz.exe
  2⤵
  PID:5800
- C:\Windows\System\gESJfsa.exe
  C:\Windows\System\gESJfsa.exe
  2⤵
  PID:1876
- C:\Windows\System\PsAqxxU.exe
  C:\Windows\System\PsAqxxU.exe
  2⤵
  PID:5812
- C:\Windows\System\efuytRi.exe
  C:\Windows\System\efuytRi.exe
  2⤵
  PID:5836
- C:\Windows\System\TNlyHYY.exe
  C:\Windows\System\TNlyHYY.exe
  2⤵
  PID:5852
- C:\Windows\System\vfAFaKC.exe
  C:\Windows\System\vfAFaKC.exe
  2⤵
  PID:5868
- C:\Windows\System\keunhbP.exe
  C:\Windows\System\keunhbP.exe
  2⤵
  PID:5884
- C:\Windows\System\aHLPfyP.exe
  C:\Windows\System\aHLPfyP.exe
  2⤵
  PID:5904
- C:\Windows\System\zjNjJNU.exe
  C:\Windows\System\zjNjJNU.exe
  2⤵
  PID:5956
- C:\Windows\System\TNRjpBM.exe
  C:\Windows\System\TNRjpBM.exe
  2⤵
  PID:5928
- C:\Windows\System\aAAmIiY.exe
  C:\Windows\System\aAAmIiY.exe
  2⤵
  PID:5976
- C:\Windows\System\eZtnvKm.exe
  C:\Windows\System\eZtnvKm.exe
  2⤵
  PID:6004
- C:\Windows\System\JrupFaS.exe
  C:\Windows\System\JrupFaS.exe
  2⤵
  PID:5940
- C:\Windows\System\zLeHQqZ.exe
  C:\Windows\System\zLeHQqZ.exe
  2⤵
  PID:5984
- C:\Windows\System\NpmItfm.exe
  C:\Windows\System\NpmItfm.exe
  2⤵
  PID:6024
- C:\Windows\System\cTTEHkI.exe
  C:\Windows\System\cTTEHkI.exe
  2⤵
  PID:856
- C:\Windows\System\jtrZqKu.exe
  C:\Windows\System\jtrZqKu.exe
  2⤵
  PID:6020
- C:\Windows\System\LUrXMwR.exe
  C:\Windows\System\LUrXMwR.exe
  2⤵
  PID:6068
- C:\Windows\System\LyJjMXH.exe
  C:\Windows\System\LyJjMXH.exe
  2⤵
  PID:6056
- C:\Windows\System\bTXmRPu.exe
  C:\Windows\System\bTXmRPu.exe
  2⤵
  PID:6064
- C:\Windows\System\FpNKVYw.exe
  C:\Windows\System\FpNKVYw.exe
  2⤵
  PID:6100
- C:\Windows\System\DIahotf.exe
  C:\Windows\System\DIahotf.exe
  2⤵
  PID:6120
- C:\Windows\System\iHzYtNW.exe
  C:\Windows\System\iHzYtNW.exe
  2⤵
  PID:4604
- C:\Windows\System\PVxlzGc.exe
  C:\Windows\System\PVxlzGc.exe
  2⤵
  PID:5292
- C:\Windows\System\DIbfgIi.exe
  C:\Windows\System\DIbfgIi.exe
  2⤵
  PID:5308
- C:\Windows\System\bfbPMtA.exe
  C:\Windows\System\bfbPMtA.exe
  2⤵
  PID:5412
- C:\Windows\System\qdaevac.exe
  C:\Windows\System\qdaevac.exe
  2⤵
  PID:5228
- C:\Windows\System\inDMbwP.exe
  C:\Windows\System\inDMbwP.exe
  2⤵
  PID:5460
- C:\Windows\System\jVLfPld.exe
  C:\Windows\System\jVLfPld.exe
  2⤵
  PID:5420
- C:\Windows\System\nHSosIo.exe
  C:\Windows\System\nHSosIo.exe
  2⤵
  PID:5508
- C:\Windows\System\BeghYnT.exe
  C:\Windows\System\BeghYnT.exe
  2⤵
  PID:4448
- C:\Windows\System\iipdxuU.exe
  C:\Windows\System\iipdxuU.exe
  2⤵
  PID:2360
- C:\Windows\System\JBxvdfX.exe
  C:\Windows\System\JBxvdfX.exe
  2⤵
  PID:1148
- C:\Windows\System\kHBIMSS.exe
  C:\Windows\System\kHBIMSS.exe
  2⤵
  PID:5344
- C:\Windows\System\UehlgvC.exe
  C:\Windows\System\UehlgvC.exe
  2⤵
  PID:5728
- C:\Windows\System\vZHMxXA.exe
  C:\Windows\System\vZHMxXA.exe
  2⤵
  PID:5772
- C:\Windows\System\JYYJJVY.exe
  C:\Windows\System\JYYJJVY.exe
  2⤵
  PID:5832
- C:\Windows\System\YxVeFyT.exe
  C:\Windows\System\YxVeFyT.exe
  2⤵
  PID:5892
- C:\Windows\System\FAMqvdQ.exe
  C:\Windows\System\FAMqvdQ.exe
  2⤵
  PID:5480
- C:\Windows\System\ezqfTlz.exe
  C:\Windows\System\ezqfTlz.exe
  2⤵
  PID:5996
- C:\Windows\System\vusKkzR.exe
  C:\Windows\System\vusKkzR.exe
  2⤵
  PID:5664
- C:\Windows\System\xVMCcwK.exe
  C:\Windows\System\xVMCcwK.exe
  2⤵
  PID:5912
- C:\Windows\System\kSbIadS.exe
  C:\Windows\System\kSbIadS.exe
  2⤵
  PID:6108
- C:\Windows\System\DVtezqr.exe
  C:\Windows\System\DVtezqr.exe
  2⤵
  PID:5712
- C:\Windows\System\ZskaUFz.exe
  C:\Windows\System\ZskaUFz.exe
  2⤵
  PID:6116
- C:\Windows\System\ceFrMza.exe
  C:\Windows\System\ceFrMza.exe
  2⤵
  PID:5380
- C:\Windows\System\vqjUnge.exe
  C:\Windows\System\vqjUnge.exe
  2⤵
  PID:5476
- C:\Windows\System\ZTnHtXB.exe
  C:\Windows\System\ZTnHtXB.exe
  2⤵
  PID:5444
- C:\Windows\System\ikKQUGo.exe
  C:\Windows\System\ikKQUGo.exe
  2⤵
  PID:5212
- C:\Windows\System\eOyGHAX.exe
  C:\Windows\System\eOyGHAX.exe
  2⤵
  PID:6092
- C:\Windows\System\QQxJmsh.exe
  C:\Windows\System\QQxJmsh.exe
  2⤵
  PID:4240
- C:\Windows\System\cOKGspL.exe
  C:\Windows\System\cOKGspL.exe
  2⤵
  PID:5396
- C:\Windows\System\weROMqu.exe
  C:\Windows\System\weROMqu.exe
  2⤵
  PID:5492
- C:\Windows\System\WVQEfLG.exe
  C:\Windows\System\WVQEfLG.exe
  2⤵
  PID:2356
- C:\Windows\System\TpHvaEh.exe
  C:\Windows\System\TpHvaEh.exe
  2⤵
  PID:2952
- C:\Windows\System\hmitFYP.exe
  C:\Windows\System\hmitFYP.exe
  2⤵
  PID:5844
- C:\Windows\System\dqtHUgC.exe
  C:\Windows\System\dqtHUgC.exe
  2⤵
  PID:5896
- C:\Windows\System\tokAHZl.exe
  C:\Windows\System\tokAHZl.exe
  2⤵
  PID:5968
- C:\Windows\System\tnqruuj.exe
  C:\Windows\System\tnqruuj.exe
  2⤵
  PID:2108
- C:\Windows\System\snNgbUM.exe
  C:\Windows\System\snNgbUM.exe
  2⤵
  PID:5700
- C:\Windows\System\SrurLWk.exe
  C:\Windows\System\SrurLWk.exe
  2⤵
  PID:5560
- C:\Windows\System\wgwfoRL.exe
  C:\Windows\System\wgwfoRL.exe
  2⤵
  PID:5804
- C:\Windows\System\CsSLRbs.exe
  C:\Windows\System\CsSLRbs.exe
  2⤵
  PID:2168
- C:\Windows\System\bYecQJq.exe
  C:\Windows\System\bYecQJq.exe
  2⤵
  PID:5332
- C:\Windows\System\QHxiKxD.exe
  C:\Windows\System\QHxiKxD.exe
  2⤵
  PID:3512
- C:\Windows\System\cOjthel.exe
  C:\Windows\System\cOjthel.exe
  2⤵
  PID:5592
- C:\Windows\System\UngEJOP.exe
  C:\Windows\System\UngEJOP.exe
  2⤵
  PID:6124
- C:\Windows\System\qcVMJam.exe
  C:\Windows\System\qcVMJam.exe
  2⤵
  PID:5908
- C:\Windows\System\vkjimMi.exe
  C:\Windows\System\vkjimMi.exe
  2⤵
  PID:6012
- C:\Windows\System\fcxLQZv.exe
  C:\Windows\System\fcxLQZv.exe
  2⤵
  PID:2636
- C:\Windows\System\lxkAHul.exe
  C:\Windows\System\lxkAHul.exe
  2⤵
  PID:1348
- C:\Windows\System\sdtrPMy.exe
  C:\Windows\System\sdtrPMy.exe
  2⤵
  PID:6128
- C:\Windows\System\vAeKaRC.exe
  C:\Windows\System\vAeKaRC.exe
  2⤵
  PID:6152
- C:\Windows\System\HTeAGvk.exe
  C:\Windows\System\HTeAGvk.exe
  2⤵
  PID:6168
- C:\Windows\System\ofiNYDT.exe
  C:\Windows\System\ofiNYDT.exe
  2⤵
  PID:6184
- C:\Windows\System\fyKoAlw.exe
  C:\Windows\System\fyKoAlw.exe
  2⤵
  PID:6200
- C:\Windows\System\oDBXTKi.exe
  C:\Windows\System\oDBXTKi.exe
  2⤵
  PID:6216
- C:\Windows\System\KbSlIie.exe
  C:\Windows\System\KbSlIie.exe
  2⤵
  PID:6232
- C:\Windows\System\XHgrTHE.exe
  C:\Windows\System\XHgrTHE.exe
  2⤵
  PID:6248
- C:\Windows\System\VbxXBLV.exe
  C:\Windows\System\VbxXBLV.exe
  2⤵
  PID:6264
- C:\Windows\System\artIgWL.exe
  C:\Windows\System\artIgWL.exe
  2⤵
  PID:6280
- C:\Windows\System\XubHQid.exe
  C:\Windows\System\XubHQid.exe
  2⤵
  PID:6296
- C:\Windows\System\CgINYYk.exe
  C:\Windows\System\CgINYYk.exe
  2⤵
  PID:6312
- C:\Windows\System\qRPPauS.exe
  C:\Windows\System\qRPPauS.exe
  2⤵
  PID:6328
- C:\Windows\System\yXrecEw.exe
  C:\Windows\System\yXrecEw.exe
  2⤵
  PID:6344
- C:\Windows\System\tXPiWix.exe
  C:\Windows\System\tXPiWix.exe
  2⤵
  PID:6360
- C:\Windows\System\BrqAYQX.exe
  C:\Windows\System\BrqAYQX.exe
  2⤵
  PID:6376
- C:\Windows\System\nHhKBcG.exe
  C:\Windows\System\nHhKBcG.exe
  2⤵
  PID:6392
- C:\Windows\System\RtzoldK.exe
  C:\Windows\System\RtzoldK.exe
  2⤵
  PID:6408
- C:\Windows\System\SqVIzmE.exe
  C:\Windows\System\SqVIzmE.exe
  2⤵
  PID:6424
- C:\Windows\System\guXFDQX.exe
  C:\Windows\System\guXFDQX.exe
  2⤵
  PID:6440
- C:\Windows\System\ArGObzX.exe
  C:\Windows\System\ArGObzX.exe
  2⤵
  PID:6456
- C:\Windows\System\JxHBKpM.exe
  C:\Windows\System\JxHBKpM.exe
  2⤵
  PID:6472
- C:\Windows\System\tIUIihN.exe
  C:\Windows\System\tIUIihN.exe
  2⤵
  PID:6488
- C:\Windows\System\roGyFrn.exe
  C:\Windows\System\roGyFrn.exe
  2⤵
  PID:6512
- C:\Windows\System\yjyCqKR.exe
  C:\Windows\System\yjyCqKR.exe
  2⤵
  PID:6528
- C:\Windows\System\KMfgEcj.exe
  C:\Windows\System\KMfgEcj.exe
  2⤵
  PID:6552
- C:\Windows\System\GSVXBtZ.exe
  C:\Windows\System\GSVXBtZ.exe
  2⤵
  PID:6568
- C:\Windows\System\HkrpPRn.exe
  C:\Windows\System\HkrpPRn.exe
  2⤵
  PID:6584
- C:\Windows\System\bYfCOOi.exe
  C:\Windows\System\bYfCOOi.exe
  2⤵
  PID:6600
- C:\Windows\System\eGgjmOt.exe
  C:\Windows\System\eGgjmOt.exe
  2⤵
  PID:6620
- C:\Windows\System\MvOoADq.exe
  C:\Windows\System\MvOoADq.exe
  2⤵
  PID:6640
- C:\Windows\System\czWqppJ.exe
  C:\Windows\System\czWqppJ.exe
  2⤵
  PID:6656
- C:\Windows\System\vKgLjur.exe
  C:\Windows\System\vKgLjur.exe
  2⤵
  PID:6672
- C:\Windows\System\TJynarp.exe
  C:\Windows\System\TJynarp.exe
  2⤵
  PID:6688
- C:\Windows\System\CcGkvCc.exe
  C:\Windows\System\CcGkvCc.exe
  2⤵
  PID:6704
- C:\Windows\System\KmdXXgl.exe
  C:\Windows\System\KmdXXgl.exe
  2⤵
  PID:6720
- C:\Windows\System\HuEOXza.exe
  C:\Windows\System\HuEOXza.exe
  2⤵
  PID:6736
- C:\Windows\System\MFWcujk.exe
  C:\Windows\System\MFWcujk.exe
  2⤵
  PID:6752
- C:\Windows\System\QqDOnnT.exe
  C:\Windows\System\QqDOnnT.exe
  2⤵
  PID:6768
- C:\Windows\System\FmWMfTq.exe
  C:\Windows\System\FmWMfTq.exe
  2⤵
  PID:6784
- C:\Windows\System\nTsAaqQ.exe
  C:\Windows\System\nTsAaqQ.exe
  2⤵
  PID:6800
- C:\Windows\System\HuAmlrd.exe
  C:\Windows\System\HuAmlrd.exe
  2⤵
  PID:6816
- C:\Windows\System\EIJczWz.exe
  C:\Windows\System\EIJczWz.exe
  2⤵
  PID:6832
- C:\Windows\System\UFndJtF.exe
  C:\Windows\System\UFndJtF.exe
  2⤵
  PID:6848
- C:\Windows\System\PvDsLba.exe
  C:\Windows\System\PvDsLba.exe
  2⤵
  PID:6864
- C:\Windows\System\zLBASCW.exe
  C:\Windows\System\zLBASCW.exe
  2⤵
  PID:6880
- C:\Windows\System\jdcVmeO.exe
  C:\Windows\System\jdcVmeO.exe
  2⤵
  PID:6896
- C:\Windows\System\QpJyNVW.exe
  C:\Windows\System\QpJyNVW.exe
  2⤵
  PID:6912
- C:\Windows\System\hdVpHcm.exe
  C:\Windows\System\hdVpHcm.exe
  2⤵
  PID:6928
- C:\Windows\System\zGGgCYI.exe
  C:\Windows\System\zGGgCYI.exe
  2⤵
  PID:6944
- C:\Windows\System\ReHOYhX.exe
  C:\Windows\System\ReHOYhX.exe
  2⤵
  PID:6960
- C:\Windows\System\gNrFKPM.exe
  C:\Windows\System\gNrFKPM.exe
  2⤵
  PID:6976
- C:\Windows\System\NUXlDQE.exe
  C:\Windows\System\NUXlDQE.exe
  2⤵
  PID:7000
- C:\Windows\System\TMaGXdM.exe
  C:\Windows\System\TMaGXdM.exe
  2⤵
  PID:7016
- C:\Windows\System\gYxNAeI.exe
  C:\Windows\System\gYxNAeI.exe
  2⤵
  PID:7032
- C:\Windows\System\BQVhNyC.exe
  C:\Windows\System\BQVhNyC.exe
  2⤵
  PID:7048
- C:\Windows\System\lFYDztm.exe
  C:\Windows\System\lFYDztm.exe
  2⤵
  PID:7068
- C:\Windows\System\AnrCIrH.exe
  C:\Windows\System\AnrCIrH.exe
  2⤵
  PID:7084
- C:\Windows\System\hBiedeI.exe
  C:\Windows\System\hBiedeI.exe
  2⤵
  PID:7100
- C:\Windows\System\QQjDqFc.exe
  C:\Windows\System\QQjDqFc.exe
  2⤵
  PID:7120
- C:\Windows\System\WdGbsAS.exe
  C:\Windows\System\WdGbsAS.exe
  2⤵
  PID:7136
- C:\Windows\System\tChqONe.exe
  C:\Windows\System\tChqONe.exe
  2⤵
  PID:7156
- C:\Windows\System\zUDVEMz.exe
  C:\Windows\System\zUDVEMz.exe
  2⤵
  PID:5136
- C:\Windows\System\TAhUlKC.exe
  C:\Windows\System\TAhUlKC.exe
  2⤵
  PID:5796
- C:\Windows\System\QKkDAaT.exe
  C:\Windows\System\QKkDAaT.exe
  2⤵
  PID:5792
- C:\Windows\System\wxYspgR.exe
  C:\Windows\System\wxYspgR.exe
  2⤵
  PID:6180
- C:\Windows\System\FxoHeNs.exe
  C:\Windows\System\FxoHeNs.exe
  2⤵
  PID:6176
- C:\Windows\System\FZsJpED.exe
  C:\Windows\System\FZsJpED.exe
  2⤵
  PID:6260
- C:\Windows\System\aAoLETD.exe
  C:\Windows\System\aAoLETD.exe
  2⤵
  PID:6320
- C:\Windows\System\eyQAeLQ.exe
  C:\Windows\System\eyQAeLQ.exe
  2⤵
  PID:6276
- C:\Windows\System\fivyBOF.exe
  C:\Windows\System\fivyBOF.exe
  2⤵
  PID:6388
- C:\Windows\System\FegrYEq.exe
  C:\Windows\System\FegrYEq.exe
  2⤵
  PID:6340
- C:\Windows\System\ojIalmX.exe
  C:\Windows\System\ojIalmX.exe
  2⤵
  PID:6908
- C:\Windows\System\VlGReUs.exe
  C:\Windows\System\VlGReUs.exe
  2⤵
  PID:6968
- C:\Windows\System\hkotgup.exe
  C:\Windows\System\hkotgup.exe
  2⤵
  PID:6952
- C:\Windows\System\DfAPBZP.exe
  C:\Windows\System\DfAPBZP.exe
  2⤵
  PID:6988
- C:\Windows\System\BZCCSzm.exe
  C:\Windows\System\BZCCSzm.exe
  2⤵
  PID:7012
- C:\Windows\System\rTpyVQv.exe
  C:\Windows\System\rTpyVQv.exe
  2⤵
  PID:7080
- C:\Windows\System\lEMSFLi.exe
  C:\Windows\System\lEMSFLi.exe
  2⤵
  PID:7056
- C:\Windows\System\pUPaeHT.exe
  C:\Windows\System\pUPaeHT.exe
  2⤵
  PID:7064
- C:\Windows\System\igkbHWD.exe
  C:\Windows\System\igkbHWD.exe
  2⤵
  PID:7132
- C:\Windows\System\YzNHMZq.exe
  C:\Windows\System\YzNHMZq.exe
  2⤵
  PID:6256
- C:\Windows\System\vCNeRWk.exe
  C:\Windows\System\vCNeRWk.exe
  2⤵
  PID:7164
- C:\Windows\System\uRALULR.exe
  C:\Windows\System\uRALULR.exe
  2⤵
  PID:6372
- C:\Windows\System\ngXVGZP.exe
  C:\Windows\System\ngXVGZP.exe
  2⤵
  PID:6384
- C:\Windows\System\uAmAehp.exe
  C:\Windows\System\uAmAehp.exe
  2⤵
  PID:6292
- C:\Windows\System\urqnBbV.exe
  C:\Windows\System\urqnBbV.exe
  2⤵
  PID:7076
- C:\Windows\System\XXmwSFT.exe
  C:\Windows\System\XXmwSFT.exe
  2⤵
  PID:6972
- C:\Windows\System\FLSbEfc.exe
  C:\Windows\System\FLSbEfc.exe
  2⤵
  PID:6196
- C:\Windows\System\grQbSEX.exe
  C:\Windows\System\grQbSEX.exe
  2⤵
  PID:6208
- C:\Windows\System\uJPrtTV.exe
  C:\Windows\System\uJPrtTV.exe
  2⤵
  PID:7028
- C:\Windows\System\ZghdewL.exe
  C:\Windows\System\ZghdewL.exe
  2⤵
  PID:6700
- C:\Windows\System\IDByuYN.exe
  C:\Windows\System\IDByuYN.exe
  2⤵
  PID:6824
- C:\Windows\System\Wnoctfw.exe
  C:\Windows\System\Wnoctfw.exe
  2⤵
  PID:6744
- C:\Windows\System\XccBNke.exe
  C:\Windows\System\XccBNke.exe
  2⤵
  PID:6716
- C:\Windows\System\JHWEOHH.exe
  C:\Windows\System\JHWEOHH.exe
  2⤵
  PID:6368
- C:\Windows\System\nUDvxaV.exe
  C:\Windows\System\nUDvxaV.exe
  2⤵
  PID:6828
- C:\Windows\System\xRCxXdF.exe
  C:\Windows\System\xRCxXdF.exe
  2⤵
  PID:7108
- C:\Windows\System\kwtTFna.exe
  C:\Windows\System\kwtTFna.exe
  2⤵
  PID:6596
- C:\Windows\System\vyHyZXr.exe
  C:\Windows\System\vyHyZXr.exe
  2⤵
  PID:6808
- C:\Windows\System\RduLPah.exe
  C:\Windows\System\RduLPah.exe
  2⤵
  PID:6844
- C:\Windows\System\mtZZOer.exe
  C:\Windows\System\mtZZOer.exe
  2⤵
  PID:6904
- C:\Windows\System\nsBZGsF.exe
  C:\Windows\System\nsBZGsF.exe
  2⤵
  PID:6920
- C:\Windows\System\EnbhCEu.exe
  C:\Windows\System\EnbhCEu.exe
  2⤵
  PID:6508
- C:\Windows\System\RSJxdaq.exe
  C:\Windows\System\RSJxdaq.exe
  2⤵
  PID:6548
- C:\Windows\System\poPhWem.exe
  C:\Windows\System\poPhWem.exe
  2⤵
  PID:6612
- C:\Windows\System\ciRZKcX.exe
  C:\Windows\System\ciRZKcX.exe
  2⤵
  PID:6664
- C:\Windows\System\TMJVdXT.exe
  C:\Windows\System\TMJVdXT.exe
  2⤵
  PID:6680
- C:\Windows\System\opTEVzo.exe
  C:\Windows\System\opTEVzo.exe
  2⤵
  PID:6812
- C:\Windows\System\tjNJRTr.exe
  C:\Windows\System\tjNJRTr.exe
  2⤵
  PID:6732
- C:\Windows\System\THFpWds.exe
  C:\Windows\System\THFpWds.exe
  2⤵
  PID:7096
- C:\Windows\System\XOtbTZS.exe
  C:\Windows\System\XOtbTZS.exe
  2⤵
  PID:6308
- C:\Windows\System\sXdyKZc.exe
  C:\Windows\System\sXdyKZc.exe
  2⤵
  PID:6872
- C:\Windows\System\yepULHL.exe
  C:\Windows\System\yepULHL.exe
  2⤵
  PID:6504
- C:\Windows\System\zkYNkpF.exe
  C:\Windows\System\zkYNkpF.exe
  2⤵
  PID:6616
- C:\Windows\System\NmQnURH.exe
  C:\Windows\System\NmQnURH.exe
  2⤵
  PID:6856
- C:\Windows\System\KJDjFro.exe
  C:\Windows\System\KJDjFro.exe
  2⤵
  PID:6576
- C:\Windows\System\MwRgzAH.exe
  C:\Windows\System\MwRgzAH.exe
  2⤵
  PID:6580
- C:\Windows\System\nqdWecP.exe
  C:\Windows\System\nqdWecP.exe
  2⤵
  PID:6924
- C:\Windows\System\ldSYrIM.exe
  C:\Windows\System\ldSYrIM.exe
  2⤵
  PID:6792
- C:\Windows\System\yoDawCU.exe
  C:\Windows\System\yoDawCU.exe
  2⤵
  PID:7184
- C:\Windows\System\EjLgegc.exe
  C:\Windows\System\EjLgegc.exe
  2⤵
  PID:7200
- C:\Windows\System\EFvRVNL.exe
  C:\Windows\System\EFvRVNL.exe
  2⤵
  PID:7216
- C:\Windows\System\wIjYcfO.exe
  C:\Windows\System\wIjYcfO.exe
  2⤵
  PID:7232
- C:\Windows\System\UTxsFKC.exe
  C:\Windows\System\UTxsFKC.exe
  2⤵
  PID:7260
- C:\Windows\System\fybZjLU.exe
  C:\Windows\System\fybZjLU.exe
  2⤵
  PID:7284
- C:\Windows\System\JyJqBHg.exe
  C:\Windows\System\JyJqBHg.exe
  2⤵
  PID:7300
- C:\Windows\System\qAsUKqL.exe
  C:\Windows\System\qAsUKqL.exe
  2⤵
  PID:7316
- C:\Windows\System\YBCGPmC.exe
  C:\Windows\System\YBCGPmC.exe
  2⤵
  PID:7332
- C:\Windows\System\PAJrsSb.exe
  C:\Windows\System\PAJrsSb.exe
  2⤵
  PID:7348
- C:\Windows\System\TrhnSdM.exe
  C:\Windows\System\TrhnSdM.exe
  2⤵
  PID:7364
- C:\Windows\System\mZCkQCF.exe
  C:\Windows\System\mZCkQCF.exe
  2⤵
  PID:7380
- C:\Windows\System\yPZPUPr.exe
  C:\Windows\System\yPZPUPr.exe
  2⤵
  PID:7400
- C:\Windows\System\XAehuwc.exe
  C:\Windows\System\XAehuwc.exe
  2⤵
  PID:7416
- C:\Windows\System\zzPXOPP.exe
  C:\Windows\System\zzPXOPP.exe
  2⤵
  PID:7436
- C:\Windows\System\ltvCEto.exe
  C:\Windows\System\ltvCEto.exe
  2⤵
  PID:7452
- C:\Windows\System\LwCxyCA.exe
  C:\Windows\System\LwCxyCA.exe
  2⤵
  PID:7468
- C:\Windows\System\ukgfCdh.exe
  C:\Windows\System\ukgfCdh.exe
  2⤵
  PID:7484
- C:\Windows\System\HHMgCdp.exe
  C:\Windows\System\HHMgCdp.exe
  2⤵
  PID:7504
- C:\Windows\System\wCQhYnx.exe
  C:\Windows\System\wCQhYnx.exe
  2⤵
  PID:7520
- C:\Windows\System\CxTKKPb.exe
  C:\Windows\System\CxTKKPb.exe
  2⤵
  PID:7540
- C:\Windows\System\GWXVulD.exe
  C:\Windows\System\GWXVulD.exe
  2⤵
  PID:7580
- C:\Windows\System\wIxOFJV.exe
  C:\Windows\System\wIxOFJV.exe
  2⤵
  PID:7612
- C:\Windows\System\iNHRYQL.exe
  C:\Windows\System\iNHRYQL.exe
  2⤵
  PID:7640
- C:\Windows\System\xzDfXyF.exe
  C:\Windows\System\xzDfXyF.exe
  2⤵
  PID:7688
- C:\Windows\System\rViDCPr.exe
  C:\Windows\System\rViDCPr.exe
  2⤵
  PID:7704
- C:\Windows\System\VTHaflw.exe
  C:\Windows\System\VTHaflw.exe
  2⤵
  PID:7720
- C:\Windows\System\wAWRaTB.exe
  C:\Windows\System\wAWRaTB.exe
  2⤵
  PID:7736
- C:\Windows\System\TOCSchj.exe
  C:\Windows\System\TOCSchj.exe
  2⤵
  PID:7752
- C:\Windows\System\epuGTPt.exe
  C:\Windows\System\epuGTPt.exe
  2⤵
  PID:7768
- C:\Windows\System\GphaFlr.exe
  C:\Windows\System\GphaFlr.exe
  2⤵
  PID:7784
- C:\Windows\System\gmgUjCn.exe
  C:\Windows\System\gmgUjCn.exe
  2⤵
  PID:7800
- C:\Windows\System\gOrkvoq.exe
  C:\Windows\System\gOrkvoq.exe
  2⤵
  PID:7816
- C:\Windows\System\LwTkvTM.exe
  C:\Windows\System\LwTkvTM.exe
  2⤵
  PID:7832
- C:\Windows\System\bBrYtUo.exe
  C:\Windows\System\bBrYtUo.exe
  2⤵
  PID:7848
- C:\Windows\System\NHLhrPZ.exe
  C:\Windows\System\NHLhrPZ.exe
  2⤵
  PID:7864
- C:\Windows\System\ybychhf.exe
  C:\Windows\System\ybychhf.exe
  2⤵
  PID:7880
- C:\Windows\System\JPsadll.exe
  C:\Windows\System\JPsadll.exe
  2⤵
  PID:7896
- C:\Windows\System\hrSCKiF.exe
  C:\Windows\System\hrSCKiF.exe
  2⤵
  PID:7912
- C:\Windows\System\OYwwnfs.exe
  C:\Windows\System\OYwwnfs.exe
  2⤵
  PID:7928
- C:\Windows\System\nxFWcUi.exe
  C:\Windows\System\nxFWcUi.exe
  2⤵
  PID:7944
- C:\Windows\System\gZMtDiG.exe
  C:\Windows\System\gZMtDiG.exe
  2⤵
  PID:7960
- C:\Windows\System\jNvIGTA.exe
  C:\Windows\System\jNvIGTA.exe
  2⤵
  PID:7980
- C:\Windows\System\WDptgLu.exe
  C:\Windows\System\WDptgLu.exe
  2⤵
  PID:8000
- C:\Windows\System\DIxrGEI.exe
  C:\Windows\System\DIxrGEI.exe
  2⤵
  PID:8024
- C:\Windows\System\KkgSqdQ.exe
  C:\Windows\System\KkgSqdQ.exe
  2⤵
  PID:8056
- C:\Windows\System\hQEwqBe.exe
  C:\Windows\System\hQEwqBe.exe
  2⤵
  PID:8132
- C:\Windows\System\kADVIDS.exe
  C:\Windows\System\kADVIDS.exe
  2⤵
  PID:8164
- C:\Windows\System\tvJZAqa.exe
  C:\Windows\System\tvJZAqa.exe
  2⤵
  PID:8184
- C:\Windows\System\MgUyKMr.exe
  C:\Windows\System\MgUyKMr.exe
  2⤵
  PID:6608
- C:\Windows\System\RKgnoEg.exe
  C:\Windows\System\RKgnoEg.exe
  2⤵
  PID:7040
- C:\Windows\System\mGTcSlU.exe
  C:\Windows\System\mGTcSlU.exe
  2⤵
  PID:6560
- C:\Windows\System\BLlduri.exe
  C:\Windows\System\BLlduri.exe
  2⤵
  PID:7228
- C:\Windows\System\SRBaJMH.exe
  C:\Windows\System\SRBaJMH.exe
  2⤵
  PID:6244
- C:\Windows\System\CdCJOaw.exe
  C:\Windows\System\CdCJOaw.exe
  2⤵
  PID:7292
- C:\Windows\System\DIQVQXT.exe
  C:\Windows\System\DIQVQXT.exe
  2⤵
  PID:7308
- C:\Windows\System\WfYmiDA.exe
  C:\Windows\System\WfYmiDA.exe
  2⤵
  PID:7344
- C:\Windows\System\CGThHFd.exe
  C:\Windows\System\CGThHFd.exe
  2⤵
  PID:7392
- C:\Windows\System\ZvDVqXT.exe
  C:\Windows\System\ZvDVqXT.exe
  2⤵
  PID:7148
- C:\Windows\System\KCVJCvE.exe
  C:\Windows\System\KCVJCvE.exe
  2⤵
  PID:7444
- C:\Windows\System\pfFSPQE.exe
  C:\Windows\System\pfFSPQE.exe
  2⤵
  PID:7512
- C:\Windows\System\nCRGxHb.exe
  C:\Windows\System\nCRGxHb.exe
  2⤵
  PID:7568
- C:\Windows\System\wAKaBmg.exe
  C:\Windows\System\wAKaBmg.exe
  2⤵
  PID:7636
- C:\Windows\System\OyVQBsj.exe
  C:\Windows\System\OyVQBsj.exe
  2⤵
  PID:7728
- C:\Windows\System\jaCkuvM.exe
  C:\Windows\System\jaCkuvM.exe
  2⤵
  PID:7792
- C:\Windows\System\CDhgyMc.exe
  C:\Windows\System\CDhgyMc.exe
  2⤵
  PID:7828
- C:\Windows\System\vabtkPf.exe
  C:\Windows\System\vabtkPf.exe
  2⤵
  PID:7432
- C:\Windows\System\mujqfLD.exe
  C:\Windows\System\mujqfLD.exe
  2⤵
  PID:7892
- C:\Windows\System\CJvqOGH.exe
  C:\Windows\System\CJvqOGH.exe
  2⤵
  PID:7596
- C:\Windows\System\MyxhtCw.exe
  C:\Windows\System\MyxhtCw.exe
  2⤵
  PID:7604
- C:\Windows\System\jfnrDcg.exe
  C:\Windows\System\jfnrDcg.exe
  2⤵
  PID:7712
- C:\Windows\System\ylBrRUt.exe
  C:\Windows\System\ylBrRUt.exe
  2⤵
  PID:7496
- C:\Windows\System\TrFVyFY.exe
  C:\Windows\System\TrFVyFY.exe
  2⤵
  PID:7776
- C:\Windows\System\eGAHteW.exe
  C:\Windows\System\eGAHteW.exe
  2⤵
  PID:7812
- C:\Windows\System\THkFoUt.exe
  C:\Windows\System\THkFoUt.exe
  2⤵
  PID:7676
- C:\Windows\System\toVekMW.exe
  C:\Windows\System\toVekMW.exe
  2⤵
  PID:7744
- C:\Windows\System\vSkxSCu.exe
  C:\Windows\System\vSkxSCu.exe
  2⤵
  PID:7872
- C:\Windows\System\UkVCnya.exe
  C:\Windows\System\UkVCnya.exe
  2⤵
  PID:7936
- C:\Windows\System\frokZZe.exe
  C:\Windows\System\frokZZe.exe
  2⤵
  PID:7992
- C:\Windows\System\ZsPeEUb.exe
  C:\Windows\System\ZsPeEUb.exe
  2⤵
  PID:8032
- C:\Windows\System\lFJrsKr.exe
  C:\Windows\System\lFJrsKr.exe
  2⤵
  PID:8052
- C:\Windows\System\wwMfpgX.exe
  C:\Windows\System\wwMfpgX.exe
  2⤵
  PID:8140
- C:\Windows\System\PTGdEuq.exe
  C:\Windows\System\PTGdEuq.exe
  2⤵
  PID:6544
- C:\Windows\System\YXYyXGs.exe
  C:\Windows\System\YXYyXGs.exe
  2⤵
  PID:7192
- C:\Windows\System\odhopKj.exe
  C:\Windows\System\odhopKj.exe
  2⤵
  PID:6464
- C:\Windows\System\NcZsxvu.exe
  C:\Windows\System\NcZsxvu.exe
  2⤵
  PID:7280
- C:\Windows\System\HqpSSLP.exe
  C:\Windows\System\HqpSSLP.exe
  2⤵
  PID:7480
- C:\Windows\System\djMiMss.exe
  C:\Windows\System\djMiMss.exe
  2⤵
  PID:7560
- C:\Windows\System\GsfnABq.exe
  C:\Windows\System\GsfnABq.exe
  2⤵
  PID:8100
- C:\Windows\System\oQglwwz.exe
  C:\Windows\System\oQglwwz.exe
  2⤵
  PID:8120
- C:\Windows\System\AlYDnft.exe
  C:\Windows\System\AlYDnft.exe
  2⤵
  PID:8012
- C:\Windows\System\IoPvVQP.exe
  C:\Windows\System\IoPvVQP.exe
  2⤵
  PID:8084
- C:\Windows\System\cBMwOcP.exe
  C:\Windows\System\cBMwOcP.exe
  2⤵
  PID:6728
- C:\Windows\System\RpykaRH.exe
  C:\Windows\System\RpykaRH.exe
  2⤵
  PID:7328
- C:\Windows\System\ReEkiMQ.exe
  C:\Windows\System\ReEkiMQ.exe
  2⤵
  PID:7696
- C:\Windows\System\luoRmKj.exe
  C:\Windows\System\luoRmKj.exe
  2⤵
  PID:7700
- C:\Windows\System\eHYMPlJ.exe
  C:\Windows\System\eHYMPlJ.exe
  2⤵
  PID:7272
- C:\Windows\System\Qlkrvsg.exe
  C:\Windows\System\Qlkrvsg.exe
  2⤵
  PID:7240
- C:\Windows\System\xOJozXI.exe
  C:\Windows\System\xOJozXI.exe
  2⤵
  PID:7312
- C:\Windows\System\JRJsZDF.exe
  C:\Windows\System\JRJsZDF.exe
  2⤵
  PID:7516
- C:\Windows\System\tEYXIwW.exe
  C:\Windows\System\tEYXIwW.exe
  2⤵
  PID:7620
- C:\Windows\System\Pukiqsc.exe
  C:\Windows\System\Pukiqsc.exe
  2⤵
  PID:7668
- C:\Windows\System\LmEbxER.exe
  C:\Windows\System\LmEbxER.exe
  2⤵
  PID:7648
- C:\Windows\System\tREpSnS.exe
  C:\Windows\System\tREpSnS.exe
  2⤵
  PID:7532
- C:\Windows\System\dcMxQKU.exe
  C:\Windows\System\dcMxQKU.exe
  2⤵
  PID:7904
- C:\Windows\System\YjUeuGT.exe
  C:\Windows\System\YjUeuGT.exe
  2⤵
  PID:7748
- C:\Windows\System\PnLbmRy.exe
  C:\Windows\System\PnLbmRy.exe
  2⤵
  PID:7956
- C:\Windows\System\yQkbUkw.exe
  C:\Windows\System\yQkbUkw.exe
  2⤵
  PID:8036
- C:\Windows\System\XrzQYwc.exe
  C:\Windows\System\XrzQYwc.exe
  2⤵
  PID:8148
- C:\Windows\System\eGHyYpP.exe
  C:\Windows\System\eGHyYpP.exe
  2⤵
  PID:5440
- C:\Windows\System\iMjCoHt.exe
  C:\Windows\System\iMjCoHt.exe
  2⤵
  PID:7112
- C:\Windows\System\BKwtNWC.exe
  C:\Windows\System\BKwtNWC.exe
  2⤵
  PID:8068
- C:\Windows\System\UzqxtvX.exe
  C:\Windows\System\UzqxtvX.exe
  2⤵
  PID:8116
- C:\Windows\System\tQEFlpI.exe
  C:\Windows\System\tQEFlpI.exe
  2⤵
  PID:7376
- C:\Windows\System\QGJfZzI.exe
  C:\Windows\System\QGJfZzI.exe
  2⤵
  PID:8048
- C:\Windows\System\QONDAoa.exe
  C:\Windows\System\QONDAoa.exe
  2⤵
  PID:6780
- C:\Windows\System\UydomlB.exe
  C:\Windows\System\UydomlB.exe
  2⤵
  PID:7176
- C:\Windows\System\abmzKGN.exe
  C:\Windows\System\abmzKGN.exe
  2⤵
  PID:7664
- C:\Windows\System\UVTpMeW.exe
  C:\Windows\System\UVTpMeW.exe
  2⤵
  PID:8180
- C:\Windows\System\UWsFgQD.exe
  C:\Windows\System\UWsFgQD.exe
  2⤵
  PID:7548
- C:\Windows\System\bSQSYRC.exe
  C:\Windows\System\bSQSYRC.exe
  2⤵
  PID:6468
- C:\Windows\System\gwOEWBc.exe
  C:\Windows\System\gwOEWBc.exe
  2⤵
  PID:8076
- C:\Windows\System\pzJXcct.exe
  C:\Windows\System\pzJXcct.exe
  2⤵
  PID:6696
- C:\Windows\System\aYLCKOD.exe
  C:\Windows\System\aYLCKOD.exe
  2⤵
  PID:8196
- C:\Windows\System\Byegowh.exe
  C:\Windows\System\Byegowh.exe
  2⤵
  PID:8212
- C:\Windows\System\WURXVHq.exe
  C:\Windows\System\WURXVHq.exe
  2⤵
  PID:8228
- C:\Windows\System\FwnDQZn.exe
  C:\Windows\System\FwnDQZn.exe
  2⤵
  PID:8244
- C:\Windows\System\poSmyrN.exe
  C:\Windows\System\poSmyrN.exe
  2⤵
  PID:8260
- C:\Windows\System\uCdeEdX.exe
  C:\Windows\System\uCdeEdX.exe
  2⤵
  PID:8280
- C:\Windows\System\BopRuiM.exe
  C:\Windows\System\BopRuiM.exe
  2⤵
  PID:8300
- C:\Windows\System\vbsESDy.exe
  C:\Windows\System\vbsESDy.exe
  2⤵
  PID:8316
- C:\Windows\System\PEzPkDC.exe
  C:\Windows\System\PEzPkDC.exe
  2⤵
  PID:8332
- C:\Windows\System\KYeTOss.exe
  C:\Windows\System\KYeTOss.exe
  2⤵
  PID:8348
- C:\Windows\System\sbXzNVO.exe
  C:\Windows\System\sbXzNVO.exe
  2⤵
  PID:8368
- C:\Windows\System\kTFrnwy.exe
  C:\Windows\System\kTFrnwy.exe
  2⤵
  PID:8384
- C:\Windows\System\zPIXsAm.exe
  C:\Windows\System\zPIXsAm.exe
  2⤵
  PID:8400
- C:\Windows\System\xkvkXCz.exe
  C:\Windows\System\xkvkXCz.exe
  2⤵
  PID:8416
- C:\Windows\System\zCxtyVw.exe
  C:\Windows\System\zCxtyVw.exe
  2⤵
  PID:8436
- C:\Windows\System\ISxdOhB.exe
  C:\Windows\System\ISxdOhB.exe
  2⤵
  PID:8452
- C:\Windows\System\EiTthXE.exe
  C:\Windows\System\EiTthXE.exe
  2⤵
  PID:8472
- C:\Windows\System\COxJgMp.exe
  C:\Windows\System\COxJgMp.exe
  2⤵
  PID:8488
- C:\Windows\System\HTcvFkb.exe
  C:\Windows\System\HTcvFkb.exe
  2⤵
  PID:8504
- C:\Windows\System\FmZEhHs.exe
  C:\Windows\System\FmZEhHs.exe
  2⤵
  PID:8520
- C:\Windows\System\nxigmqd.exe
  C:\Windows\System\nxigmqd.exe
  2⤵
  PID:8540
- C:\Windows\System\ikARHgQ.exe
  C:\Windows\System\ikARHgQ.exe
  2⤵
  PID:8568
- C:\Windows\System\fMrhsWs.exe
  C:\Windows\System\fMrhsWs.exe
  2⤵
  PID:8584
- C:\Windows\System\MrqUVaa.exe
  C:\Windows\System\MrqUVaa.exe
  2⤵
  PID:8600
- C:\Windows\System\AjwLMVu.exe
  C:\Windows\System\AjwLMVu.exe
  2⤵
  PID:8620
- C:\Windows\System\vyOYqPk.exe
  C:\Windows\System\vyOYqPk.exe
  2⤵
  PID:8636
- C:\Windows\System\ONzDNxT.exe
  C:\Windows\System\ONzDNxT.exe
  2⤵
  PID:8656
- C:\Windows\System\VHuRpqm.exe
  C:\Windows\System\VHuRpqm.exe
  2⤵
  PID:8672
- C:\Windows\System\JuIxUWZ.exe
  C:\Windows\System\JuIxUWZ.exe
  2⤵
  PID:8688
- C:\Windows\System\rZLauCx.exe
  C:\Windows\System\rZLauCx.exe
  2⤵
  PID:8728
- C:\Windows\System\OINhYYc.exe
  C:\Windows\System\OINhYYc.exe
  2⤵
  PID:8748
- C:\Windows\System\UzmSKbl.exe
  C:\Windows\System\UzmSKbl.exe
  2⤵
  PID:8764
- C:\Windows\System\nUswdNz.exe
  C:\Windows\System\nUswdNz.exe
  2⤵
  PID:8780
- C:\Windows\System\vYrQiRc.exe
  C:\Windows\System\vYrQiRc.exe
  2⤵
  PID:8800
- C:\Windows\System\zvWlZPq.exe
  C:\Windows\System\zvWlZPq.exe
  2⤵
  PID:8816
- C:\Windows\System\gxfaorK.exe
  C:\Windows\System\gxfaorK.exe
  2⤵
  PID:8832
- C:\Windows\System\NquccYU.exe
  C:\Windows\System\NquccYU.exe
  2⤵
  PID:8848
- C:\Windows\System\DnFvpUG.exe
  C:\Windows\System\DnFvpUG.exe
  2⤵
  PID:8864
- C:\Windows\System\lGLjaHl.exe
  C:\Windows\System\lGLjaHl.exe
  2⤵
  PID:8880
- C:\Windows\System\Yrqtxoz.exe
  C:\Windows\System\Yrqtxoz.exe
  2⤵
  PID:8896
- C:\Windows\System\gevPAPz.exe
  C:\Windows\System\gevPAPz.exe
  2⤵
  PID:8912
- C:\Windows\System\CdNsxmM.exe
  C:\Windows\System\CdNsxmM.exe
  2⤵
  PID:8928
- C:\Windows\System\BXlncQN.exe
  C:\Windows\System\BXlncQN.exe
  2⤵
  PID:8952
- C:\Windows\System\XmijZgI.exe
  C:\Windows\System\XmijZgI.exe
  2⤵
  PID:8972
- C:\Windows\System\xjGwJRz.exe
  C:\Windows\System\xjGwJRz.exe
  2⤵
  PID:8992
- C:\Windows\System\TazriYN.exe
  C:\Windows\System\TazriYN.exe
  2⤵
  PID:9008
- C:\Windows\System\WcGBloP.exe
  C:\Windows\System\WcGBloP.exe
  2⤵
  PID:9028
- C:\Windows\System\xpxbBZN.exe
  C:\Windows\System\xpxbBZN.exe
  2⤵
  PID:9048
- C:\Windows\System\gTmmpxb.exe
  C:\Windows\System\gTmmpxb.exe
  2⤵
  PID:9064
- C:\Windows\System\gPDqFTL.exe
  C:\Windows\System\gPDqFTL.exe
  2⤵
  PID:9088
- C:\Windows\System\CSOvzuQ.exe
  C:\Windows\System\CSOvzuQ.exe
  2⤵
  PID:9116
- C:\Windows\System\aJyQuRl.exe
  C:\Windows\System\aJyQuRl.exe
  2⤵
  PID:9144
- C:\Windows\System\PcEgNTD.exe
  C:\Windows\System\PcEgNTD.exe
  2⤵
  PID:9160
- C:\Windows\System\HxDpiUk.exe
  C:\Windows\System\HxDpiUk.exe
  2⤵
  PID:9176
- C:\Windows\System\nEuaXEi.exe
  C:\Windows\System\nEuaXEi.exe
  2⤵
  PID:9192
- C:\Windows\System\PSokqQh.exe
  C:\Windows\System\PSokqQh.exe
  2⤵
  PID:9208
- C:\Windows\System\Vtjerkv.exe
  C:\Windows\System\Vtjerkv.exe
  2⤵
  PID:7684
- C:\Windows\System\DqDMdRQ.exe
  C:\Windows\System\DqDMdRQ.exe
  2⤵
  PID:8268
- C:\Windows\System\JOOYIIw.exe
  C:\Windows\System\JOOYIIw.exe
  2⤵
  PID:8144
- C:\Windows\System\lTEMrcS.exe
  C:\Windows\System\lTEMrcS.exe
  2⤵
  PID:8016
- C:\Windows\System\mpfmYAE.exe
  C:\Windows\System\mpfmYAE.exe
  2⤵
  PID:8256
- C:\Windows\System\zcPxaci.exe
  C:\Windows\System\zcPxaci.exe
  2⤵
  PID:8428
- C:\Windows\System\GOwIMEP.exe
  C:\Windows\System\GOwIMEP.exe
  2⤵
  PID:8272
- C:\Windows\System\ajwbxXw.exe
  C:\Windows\System\ajwbxXw.exe
  2⤵
  PID:8556
- C:\Windows\System\dwErGFI.exe
  C:\Windows\System\dwErGFI.exe
  2⤵
  PID:8344
- C:\Windows\System\qRQuArl.exe
  C:\Windows\System\qRQuArl.exe
  2⤵
  PID:8380
- C:\Windows\System\QHdoBwn.exe
  C:\Windows\System\QHdoBwn.exe
  2⤵
  PID:8696
- C:\Windows\System\pebyZBQ.exe
  C:\Windows\System\pebyZBQ.exe
  2⤵
  PID:8496
- C:\Windows\System\EXpeOZw.exe
  C:\Windows\System\EXpeOZw.exe
  2⤵
  PID:8536
- C:\Windows\System\kKAgIIf.exe
  C:\Windows\System\kKAgIIf.exe
  2⤵
  PID:8612
- C:\Windows\System\NyPspTl.exe
  C:\Windows\System\NyPspTl.exe
  2⤵
  PID:8772
- C:\Windows\System\pIobbaq.exe
  C:\Windows\System\pIobbaq.exe
  2⤵
  PID:8808
- C:\Windows\System\QLkHtYQ.exe
  C:\Windows\System\QLkHtYQ.exe
  2⤵
  PID:8904
- C:\Windows\System\vUQANNA.exe
  C:\Windows\System\vUQANNA.exe
  2⤵
  PID:8664
- C:\Windows\System\jAxZqom.exe
  C:\Windows\System\jAxZqom.exe
  2⤵
  PID:8872
- C:\Windows\System\IdnLLKC.exe
  C:\Windows\System\IdnLLKC.exe
  2⤵
  PID:8948
- C:\Windows\System\iFZJSPQ.exe
  C:\Windows\System\iFZJSPQ.exe
  2⤵
  PID:8888
- C:\Windows\System\GjSWFbZ.exe
  C:\Windows\System\GjSWFbZ.exe
  2⤵
  PID:8704
- C:\Windows\System\texteff.exe
  C:\Windows\System\texteff.exe
  2⤵
  PID:8960
- C:\Windows\System\ufImjdZ.exe
  C:\Windows\System\ufImjdZ.exe
  2⤵
  PID:8716
- C:\Windows\System\xCSCrLV.exe
  C:\Windows\System\xCSCrLV.exe
  2⤵
  PID:8792
- C:\Windows\System\pLYaYRF.exe
  C:\Windows\System\pLYaYRF.exe
  2⤵
  PID:8856
- C:\Windows\System\ScHDBXZ.exe
  C:\Windows\System\ScHDBXZ.exe
  2⤵
  PID:9100
- C:\Windows\System\bbqsDKQ.exe
  C:\Windows\System\bbqsDKQ.exe
  2⤵
  PID:9000
- C:\Windows\System\etrLwaY.exe
  C:\Windows\System\etrLwaY.exe
  2⤵
  PID:9112
- C:\Windows\System\vqDWnNn.exe
  C:\Windows\System\vqDWnNn.exe
  2⤵
  PID:9084
- C:\Windows\System\zpsYdrq.exe
  C:\Windows\System\zpsYdrq.exe
  2⤵
  PID:9188
- C:\Windows\System\KUQMFIf.exe
  C:\Windows\System\KUQMFIf.exe
  2⤵
  PID:9132
- C:\Windows\System\KBpcuNh.exe
  C:\Windows\System\KBpcuNh.exe
  2⤵
  PID:9200
- C:\Windows\System\EgatLnV.exe
  C:\Windows\System\EgatLnV.exe
  2⤵
  PID:7652
- C:\Windows\System\TIOxqQe.exe
  C:\Windows\System\TIOxqQe.exe
  2⤵
  PID:7408
- C:\Windows\System\GrkQEiX.exe
  C:\Windows\System\GrkQEiX.exe
  2⤵
  PID:8240
- C:\Windows\System\FBypvjF.exe
  C:\Windows\System\FBypvjF.exe
  2⤵
  PID:8356
- C:\Windows\System\HMeFtDe.exe
  C:\Windows\System\HMeFtDe.exe
  2⤵
  PID:8064
- C:\Windows\System\dUgqEit.exe
  C:\Windows\System\dUgqEit.exe
  2⤵
  PID:8296
- C:\Windows\System\xZPnVRZ.exe
  C:\Windows\System\xZPnVRZ.exe
  2⤵
  PID:8448
- C:\Windows\System\miepyDV.exe
  C:\Windows\System\miepyDV.exe
  2⤵
  PID:8412
- C:\Windows\System\TnVGtNw.exe
  C:\Windows\System\TnVGtNw.exe
  2⤵
  PID:8376
- C:\Windows\System\VIPKKiU.exe
  C:\Windows\System\VIPKKiU.exe
  2⤵
  PID:8528
- C:\Windows\System\hrJMADm.exe
  C:\Windows\System\hrJMADm.exe
  2⤵
  PID:8876
- C:\Windows\System\lTipaZY.exe
  C:\Windows\System\lTipaZY.exe
  2⤵
  PID:8424
- C:\Windows\System\HKCfLje.exe
  C:\Windows\System\HKCfLje.exe
  2⤵
  PID:8812
- C:\Windows\System\LEYoxGt.exe
  C:\Windows\System\LEYoxGt.exe
  2⤵
  PID:8788
- C:\Windows\System\wxxjhgX.exe
  C:\Windows\System\wxxjhgX.exe
  2⤵
  PID:9044
- C:\Windows\System\GtBlUkU.exe
  C:\Windows\System\GtBlUkU.exe
  2⤵
  PID:9004
- C:\Windows\System\DzDTSzn.exe
  C:\Windows\System\DzDTSzn.exe
  2⤵
  PID:9172
- C:\Windows\System\dapfjkh.exe
  C:\Windows\System\dapfjkh.exe
  2⤵
  PID:8220
- C:\Windows\System\riMDhnx.exe
  C:\Windows\System\riMDhnx.exe
  2⤵
  PID:8628
- C:\Windows\System\uRCdKhR.exe
  C:\Windows\System\uRCdKhR.exe
  2⤵
  PID:9072
- C:\Windows\System\zXhRocv.exe
  C:\Windows\System\zXhRocv.exe
  2⤵
  PID:8468
- C:\Windows\System\gzSGSZU.exe
  C:\Windows\System\gzSGSZU.exe
  2⤵
  PID:8104
- C:\Windows\System\zQBKrJj.exe
  C:\Windows\System\zQBKrJj.exe
  2⤵
  PID:9080
- C:\Windows\System\VEFXwTl.exe
  C:\Windows\System\VEFXwTl.exe
  2⤵
  PID:8684
- C:\Windows\System\qImKFdb.exe
  C:\Windows\System\qImKFdb.exe
  2⤵
  PID:9128
- C:\Windows\System\MppiDjI.exe
  C:\Windows\System\MppiDjI.exe
  2⤵
  PID:9096
- C:\Windows\System\JuteCQs.exe
  C:\Windows\System\JuteCQs.exe
  2⤵
  PID:7252
- C:\Windows\System\PcygQuD.exe
  C:\Windows\System\PcygQuD.exe
  2⤵
  PID:8828
- C:\Windows\System\hasMVSG.exe
  C:\Windows\System\hasMVSG.exe
  2⤵
  PID:8720
- C:\Windows\System\ReBcciE.exe
  C:\Windows\System\ReBcciE.exe
  2⤵
  PID:8724
- C:\Windows\System\LzZrlMK.exe
  C:\Windows\System\LzZrlMK.exe
  2⤵
  PID:8632
- C:\Windows\System\cTNNsQy.exe
  C:\Windows\System\cTNNsQy.exe
  2⤵
  PID:9020
- C:\Windows\System\EuTiIBL.exe
  C:\Windows\System\EuTiIBL.exe
  2⤵
  PID:8936
- C:\Windows\System\UZaYIAK.exe
  C:\Windows\System\UZaYIAK.exe
  2⤵
  PID:8252
- C:\Windows\System\SQFfgWV.exe
  C:\Windows\System\SQFfgWV.exe
  2⤵
  PID:9168
- C:\Windows\System\uRolCOl.exe
  C:\Windows\System\uRolCOl.exe
  2⤵
  PID:9140
- C:\Windows\System\bwnUWTo.exe
  C:\Windows\System\bwnUWTo.exe
  2⤵
  PID:8968
- C:\Windows\System\eQkmxqW.exe
  C:\Windows\System\eQkmxqW.exe
  2⤵
  PID:8980
- C:\Windows\System\IYatKxm.exe
  C:\Windows\System\IYatKxm.exe
  2⤵
  PID:8596
- C:\Windows\System\zMykkNT.exe
  C:\Windows\System\zMykkNT.exe
  2⤵
  PID:8276
- C:\Windows\System\shJHbwq.exe
  C:\Windows\System\shJHbwq.exe
  2⤵
  PID:9220
- C:\Windows\System\JyiVyay.exe
  C:\Windows\System\JyiVyay.exe
  2⤵
  PID:9236
- C:\Windows\System\cnEqPZI.exe
  C:\Windows\System\cnEqPZI.exe
  2⤵
  PID:9256
- C:\Windows\System\piashtW.exe
  C:\Windows\System\piashtW.exe
  2⤵
  PID:9276
- C:\Windows\System\CXLhdbG.exe
  C:\Windows\System\CXLhdbG.exe
  2⤵
  PID:9292
- C:\Windows\System\aIfYbbq.exe
  C:\Windows\System\aIfYbbq.exe
  2⤵
  PID:9308
- C:\Windows\System\EfdhEAu.exe
  C:\Windows\System\EfdhEAu.exe
  2⤵
  PID:9324
- C:\Windows\System\saYUMtj.exe
  C:\Windows\System\saYUMtj.exe
  2⤵
  PID:9340
- C:\Windows\System\ZIvQrBB.exe
  C:\Windows\System\ZIvQrBB.exe
  2⤵
  PID:9436
- C:\Windows\System\NfMfjVJ.exe
  C:\Windows\System\NfMfjVJ.exe
  2⤵
  PID:9468
- C:\Windows\System\oOZbYko.exe
  C:\Windows\System\oOZbYko.exe
  2⤵
  PID:9488
- C:\Windows\System\qvtkwFC.exe
  C:\Windows\System\qvtkwFC.exe
  2⤵
  PID:9504
- C:\Windows\System\qpRsIAI.exe
  C:\Windows\System\qpRsIAI.exe
  2⤵
  PID:9524
- C:\Windows\System\AfuvdDG.exe
  C:\Windows\System\AfuvdDG.exe
  2⤵
  PID:9608
- C:\Windows\System\VEFJrEi.exe
  C:\Windows\System\VEFJrEi.exe
  2⤵
  PID:9624
- C:\Windows\System\mJwEivo.exe
  C:\Windows\System\mJwEivo.exe
  2⤵
  PID:9640
- C:\Windows\System\Bchtcjs.exe
  C:\Windows\System\Bchtcjs.exe
  2⤵
  PID:9656
- C:\Windows\System\UMfeSPJ.exe
  C:\Windows\System\UMfeSPJ.exe
  2⤵
  PID:9672
- C:\Windows\System\APrvhJm.exe
  C:\Windows\System\APrvhJm.exe
  2⤵
  PID:9688
- C:\Windows\System\yzJYpdG.exe
  C:\Windows\System\yzJYpdG.exe
  2⤵
  PID:9704
- C:\Windows\System\SfiLJQk.exe
  C:\Windows\System\SfiLJQk.exe
  2⤵
  PID:9724
- C:\Windows\System\FHvxuSU.exe
  C:\Windows\System\FHvxuSU.exe
  2⤵
  PID:9740
- C:\Windows\System\xtwSgac.exe
  C:\Windows\System\xtwSgac.exe
  2⤵
  PID:9756
- C:\Windows\System\wGRYZFH.exe
  C:\Windows\System\wGRYZFH.exe
  2⤵
  PID:9772
- C:\Windows\System\ZDLoTaq.exe
  C:\Windows\System\ZDLoTaq.exe
  2⤵
  PID:9788
- C:\Windows\System\ThIroDX.exe
  C:\Windows\System\ThIroDX.exe
  2⤵
  PID:9804
- C:\Windows\System\yqtvFmj.exe
  C:\Windows\System\yqtvFmj.exe
  2⤵
  PID:9820
- C:\Windows\System\fxWPNCi.exe
  C:\Windows\System\fxWPNCi.exe
  2⤵
  PID:9836
- C:\Windows\System\ixCAlVC.exe
  C:\Windows\System\ixCAlVC.exe
  2⤵
  PID:9852
- C:\Windows\System\FlVBHHy.exe
  C:\Windows\System\FlVBHHy.exe
  2⤵
  PID:9868
- C:\Windows\System\AIORTDa.exe
  C:\Windows\System\AIORTDa.exe
  2⤵
  PID:9884
- C:\Windows\System\nmUxYBy.exe
  C:\Windows\System\nmUxYBy.exe
  2⤵
  PID:9900
- C:\Windows\System\bQwNscd.exe
  C:\Windows\System\bQwNscd.exe
  2⤵
  PID:9916
- C:\Windows\System\BgvWgyI.exe
  C:\Windows\System\BgvWgyI.exe
  2⤵
  PID:9932
- C:\Windows\System\WrFtAcV.exe
  C:\Windows\System\WrFtAcV.exe
  2⤵
  PID:9948
- C:\Windows\System\yFpPeht.exe
  C:\Windows\System\yFpPeht.exe
  2⤵
  PID:9964
- C:\Windows\System\erHqHic.exe
  C:\Windows\System\erHqHic.exe
  2⤵
  PID:9980
- C:\Windows\System\fLQgqDy.exe
  C:\Windows\System\fLQgqDy.exe
  2⤵
  PID:9996
- C:\Windows\System\FMhMNnf.exe
  C:\Windows\System\FMhMNnf.exe
  2⤵
  PID:10012
- C:\Windows\System\oSwzhqm.exe
  C:\Windows\System\oSwzhqm.exe
  2⤵
  PID:10028
- C:\Windows\System\qyInmqS.exe
  C:\Windows\System\qyInmqS.exe
  2⤵
  PID:10044
- C:\Windows\System\plyXfAe.exe
  C:\Windows\System\plyXfAe.exe
  2⤵
  PID:10060
- C:\Windows\System\GsifDQA.exe
  C:\Windows\System\GsifDQA.exe
  2⤵
  PID:10076
- C:\Windows\System\AIxTLEf.exe
  C:\Windows\System\AIxTLEf.exe
  2⤵
  PID:10092
- C:\Windows\System\zyYPgss.exe
  C:\Windows\System\zyYPgss.exe
  2⤵
  PID:10108
- C:\Windows\System\YaQQbwl.exe
  C:\Windows\System\YaQQbwl.exe
  2⤵
  PID:10124
- C:\Windows\System\PbLNdDe.exe
  C:\Windows\System\PbLNdDe.exe
  2⤵
  PID:10140
- C:\Windows\System\JFccgix.exe
  C:\Windows\System\JFccgix.exe
  2⤵
  PID:10156
- C:\Windows\System\ltuMxdu.exe
  C:\Windows\System\ltuMxdu.exe
  2⤵
  PID:10172
- C:\Windows\System\xKIiUpO.exe
  C:\Windows\System\xKIiUpO.exe
  2⤵
  PID:10188
- C:\Windows\System\QhYzDwi.exe
  C:\Windows\System\QhYzDwi.exe
  2⤵
  PID:10204
- C:\Windows\System\TsCSvlI.exe
  C:\Windows\System\TsCSvlI.exe
  2⤵
  PID:10220
- C:\Windows\System\OqlDRRO.exe
  C:\Windows\System\OqlDRRO.exe
  2⤵
  PID:10236
- C:\Windows\System\RUbMkLF.exe
  C:\Windows\System\RUbMkLF.exe
  2⤵
  PID:8512
- C:\Windows\System\dhtkIaW.exe
  C:\Windows\System\dhtkIaW.exe
  2⤵
  PID:8288
- C:\Windows\System\gbkHJRj.exe
  C:\Windows\System\gbkHJRj.exe
  2⤵
  PID:9272
- C:\Windows\System\aGZmhCm.exe
  C:\Windows\System\aGZmhCm.exe
  2⤵
  PID:8040
- C:\Windows\System\VCHjczP.exe
  C:\Windows\System\VCHjczP.exe
  2⤵
  PID:9376
- C:\Windows\System\awDRlgR.exe
  C:\Windows\System\awDRlgR.exe
  2⤵
  PID:9368
- C:\Windows\System\iRzyUrO.exe
  C:\Windows\System\iRzyUrO.exe
  2⤵
  PID:9396
- C:\Windows\System\pfXuzzo.exe
  C:\Windows\System\pfXuzzo.exe
  2⤵
  PID:9448
- C:\Windows\System\LLWyKuJ.exe
  C:\Windows\System\LLWyKuJ.exe
  2⤵
  PID:9532
- C:\Windows\System\OGaoFyt.exe
  C:\Windows\System\OGaoFyt.exe
  2⤵
  PID:9428
- C:\Windows\System\AKcknSh.exe
  C:\Windows\System\AKcknSh.exe
  2⤵
  PID:9484
- C:\Windows\System\wCcdFID.exe
  C:\Windows\System\wCcdFID.exe
  2⤵
  PID:9516
- C:\Windows\System\tDmtdoj.exe
  C:\Windows\System\tDmtdoj.exe
  2⤵
  PID:9556
- C:\Windows\System\bHSJzaa.exe
  C:\Windows\System\bHSJzaa.exe
  2⤵
  PID:9452
- C:\Windows\System\faGzbYd.exe
  C:\Windows\System\faGzbYd.exe
  2⤵
  PID:9680
- C:\Windows\System\bMWeEXf.exe
  C:\Windows\System\bMWeEXf.exe
  2⤵
  PID:9560
- C:\Windows\System\EDqjgxK.exe
  C:\Windows\System\EDqjgxK.exe
  2⤵
  PID:9576
- C:\Windows\System\cRlcnYO.exe
  C:\Windows\System\cRlcnYO.exe
  2⤵
  PID:9664
- C:\Windows\System\HDNskjE.exe
  C:\Windows\System\HDNskjE.exe
  2⤵
  PID:9784
- C:\Windows\System\BVVVlEG.exe
  C:\Windows\System\BVVVlEG.exe
  2⤵
  PID:9636
- C:\Windows\System\eQzxSuq.exe
  C:\Windows\System\eQzxSuq.exe
  2⤵
  PID:9732
- C:\Windows\System\qRwSfHQ.exe
  C:\Windows\System\qRwSfHQ.exe
  2⤵
  PID:9848
- C:\Windows\System\uLSBAiw.exe
  C:\Windows\System\uLSBAiw.exe
  2⤵
  PID:9736
- C:\Windows\System\aCcKcGu.exe
  C:\Windows\System\aCcKcGu.exe
  2⤵
  PID:9860
- C:\Windows\System\cIZisGp.exe
  C:\Windows\System\cIZisGp.exe
  2⤵
  PID:9892
- C:\Windows\System\ZWsKyFn.exe
  C:\Windows\System\ZWsKyFn.exe
  2⤵
  PID:9988
- C:\Windows\System\KXTFikB.exe
  C:\Windows\System\KXTFikB.exe
  2⤵
  PID:10052
- C:\Windows\System\fRcejNY.exe
  C:\Windows\System\fRcejNY.exe
  2⤵
  PID:10104
- C:\Windows\System\FbyBDLY.exe
  C:\Windows\System\FbyBDLY.exe
  2⤵
  PID:10196
- C:\Windows\System\IJASRJy.exe
  C:\Windows\System\IJASRJy.exe
  2⤵
  PID:8292
- C:\Windows\System\bZWCdGx.exe
  C:\Windows\System\bZWCdGx.exe
  2⤵
  PID:8680
- C:\Windows\System\cStAjTz.exe
  C:\Windows\System\cStAjTz.exe
  2⤵
  PID:9336
- C:\Windows\System\HxMTqUV.exe
  C:\Windows\System\HxMTqUV.exe
  2⤵
  PID:9288
- C:\Windows\System\ZPHlyhx.exe
  C:\Windows\System\ZPHlyhx.exe
  2⤵
  PID:9480
- C:\Windows\System\AuSMNbb.exe
  C:\Windows\System\AuSMNbb.exe
  2⤵
  PID:9388
- C:\Windows\System\oKScmnX.exe
  C:\Windows\System\oKScmnX.exe
  2⤵
  PID:9360
- C:\Windows\System\KtvQvMq.exe
  C:\Windows\System\KtvQvMq.exe
  2⤵
  PID:9400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ABIaFuX.exe

Filesize
1.9MB

MD5
68ad8dd2f428c692077d45cf7a17667c

SHA1
ecb0e9b4faca1eeb31e1cfab9df112d77214d91c

SHA256
cc843aacbb2de2cfe577b9dbb233b2df8a191267362fd38d543c414d442e4f09

SHA512
bcbf059a22eb8d6b1dc5d97a7d6e6492662f3d9a4ffa562b5674f9236a4ddc54a9d4942ebc4793b2a09ad996279fe6a5499435bae258757190d665a62107722b

Download Submit
C:\Windows\system\ANclAKt.exe

Filesize
1.9MB

MD5
0f5cf6724923c2b6f6981f58b21b9071

SHA1
066002016729b8ce918f4c32727f0eb3a0c14b50

SHA256
58c0bf72b67768cba12b32c65854439c491915a42547042323624c0499658ac1

SHA512
8c9c90d88b4211b2da221e74898d03f23ee32ea1ebec72e297a2ea8863ab607a26593882d26f299bee76e1167e17e7bc550b185b09980d481693c013a11065a3

Download Submit
C:\Windows\system\AcbKMTP.exe

Filesize
1.9MB

MD5
b2390f65d5494e9e759f856ee7efed14

SHA1
bd3c7350e7352b51b2ae50e4e3e6ba48ffa74c97

SHA256
7d8a9cc09a72abc39a5c48d8f9dcbc52d7e43f659ae338a82433b36c691295d0

SHA512
5942c2c57425841b667b8aa1c24a783eb438a51738240284752ed7575bbaf667628d7c7a4e4a63ca2eaa6e463ab326594204edd896750b07ddb35307027a748a

Download Submit
C:\Windows\system\FJsdtqJ.exe

Filesize
1.9MB

MD5
170702b6fd660d0ba82f854adddeba05

SHA1
3e37bb3d49e0477ac25b2264e6a8c7d5e23e202e

SHA256
4cfb4f72ee3a7a77a95d68d7156ef47aff87a6e896554607b1594eb0c3e96df9

SHA512
de679d5660a27a5131f6fedd1a41aff325bdf197cd075a39126a78601aed5f30c90f71d9a9d2b09645c6601b6595c46377cc5b1d30229499bd3476ca50a7efa5

Download Submit
C:\Windows\system\HqmWSaB.exe

Filesize
1.6MB

MD5
b97dfed683c730e91a3692aa81ba5727

SHA1
b86319e4b7a0800728dc6d1d00f68be033ec73d8

SHA256
28ccfe4f58b9f2532a3ce9da930b073db742817680dcaef1997fe398d2535196

SHA512
f26a27b6690bc8dc16830865e625c338f367875af059774ea359b36847e014743fe0394a51a3fd0fb963e4fd117461eaf778c0dc3d59960e0bc5d6e4f224f784

Download Submit
C:\Windows\system\JGFtiJU.exe

Filesize
1.9MB

MD5
50c789016a77b234af24271d1cfa3d15

SHA1
8bce7da4de5f6be114ed98ff308a529e18709a37

SHA256
4fbc26378153f2ca912a292f9a43878a7065415c9c070dba7bd20adb87f103ac

SHA512
8fcb9d440471dae536dcab2a18628918876c342e9aa13e42e4869d7eebca515361fd6147439c6c74180a4de42cb62755325bbd83bb4780bc1b5047f0e7ff65d2

Download Submit
C:\Windows\system\KydHVrY.exe

Filesize
1.9MB

MD5
1742b099719dee5aed1d32ed29a3a14f

SHA1
6f916eeef2ea7cf1f4a67316d8e18002b7b7565b

SHA256
17c5fbec2ab3b26d9b7680319d509577b2d674047522b28d6937ecc03d131395

SHA512
1c74b54d57a34222092cdef28addc57aa16c0367ceed3be370b954b8c63b476066ebbb04e0a051a547aebe2ad82e1075a7f13b43f63388032672be11f85e1e27

Download Submit
C:\Windows\system\RRHHRJZ.exe

Filesize
1.9MB

MD5
25f52c8db0744b8161c0f7e81c52af74

SHA1
55b4c27fc11dd698cfa793f10a7671e6be00232d

SHA256
39c9d002269e3b9bb4e1187eee5302df754e5cae07704612a2b8736e1ccac124

SHA512
3208ecca8c5cb01f789aafdd8fedc818c85a8000f3bd5b5a1755a319b9a440b5f256d32e9c60827b8b482273dd355d1ffead4d55b705465974e5fa041fa07185

Download Submit
C:\Windows\system\TFDgfPf.exe

Filesize
1.9MB

MD5
26400cc2ad500640ac1e043a614a85e8

SHA1
37877aca15cfc68dbe4264cb6a35560e8ce4facd

SHA256
e1ae6d3f449ee451e8fd910490260d7ba2b20d75365b46fa6b41e00afdbb7c5e

SHA512
9a612b199bd3b5e7ddbca02058451acd367c350131196eb37d6ec3608cc5ab9dcd3f6c14be5de750e3625fa1b79eac4e1c065aff7449653d75805026bc977953

Download Submit
C:\Windows\system\WMnwTAL.exe

Filesize
1.9MB

MD5
10ed88a4be5bc6bca19eb560a7f80ef2

SHA1
3d5b2a929adb2a9b55816afb292fa20b5464eefe

SHA256
11175428cd8ebcb674d07c0083164175f3258599015a34714dc16de831dc50ed

SHA512
5bd361916d0a78e0804b4c6806d64f6b6a66624deaabdb7ab0d4eb2692ccf9fa5614fad5bd83e1f078be6e2d40494d6d0115624b8c4f7e0d78d58786adeced74

Download Submit
C:\Windows\system\WOgdOxr.exe

Filesize
1.9MB

MD5
881cd17a8fdbfdedcd45517bee36df2e

SHA1
40c9b3d7f42b4c1dd9f51eaceafe73a70c00ba12

SHA256
a26d747ba124fa7cd9857172bac9d8a46815e772ae5928ce3d1b5496c05b85d5

SHA512
2a39c361b0982281719c0968269dc2ea0d491de47fa39d7eaf30af0cb00a56dfb098b1eb78359d88127fdc6dcb700655401faf206703a3fc481857836f3ba2d4

Download Submit
C:\Windows\system\ahwGlDe.exe

Filesize
1.9MB

MD5
a0a042daa239edd3b78d273cf4e6d1b9

SHA1
e0aa9988f585083d9781edf8c9382e33d233d206

SHA256
3f36a4e69acd12320eac8d6c7cb98e96b4796e6f12bdc4c58397c6c5a07f9947

SHA512
39f5d734866cf5f0566647c463c4c2e5c402a48c346012cd202b0db105e90f932b1f2a1685404143f1b86287e8298030431c244789776ecbc9ac8fc567899492

Download Submit
C:\Windows\system\bBqhoMS.exe

Filesize
1.9MB

MD5
8cdc8f3d889d53d2bfefa800a13e1c61

SHA1
8d91933b8017ce724180246ee1a2b50fd561d0da

SHA256
d16396adaf6091bd4e178748bfe25fd577c24c7ff07462b6514149ce204ecdd1

SHA512
4af943effe7cbe7ea330ef932b4047e1b2a8b444029f946097e96da2b826888f34be57fb2bd7c9bbae1d5212aafd51fe55eb41a351b1a894f7c7b6d7e7cef943

Download Submit
C:\Windows\system\dCuDFse.exe

Filesize
1.9MB

MD5
323c1fd0c7a69732a277a51cab73cef8

SHA1
8ff23139255d273fcce3acbdf8c528f574157937

SHA256
f29a93cacc2d013f6c8bcd318f12ed73c879c15c2f93d25c34bf962d02b75554

SHA512
bd527d7f1d8d4a22466b19dcd2fedd40449e3da31c5659df3b6c021359a7488d0a926967a6873b3728ae2f4c70a1b75e86e0be4f74e975928a89a1857f057501

Download Submit
C:\Windows\system\dnuTGXi.exe

Filesize
1.9MB

MD5
47b0290a4b7839073797454f96b16bcc

SHA1
ab420f0ef43a26f57257ad45ec2eb914e11642ed

SHA256
0b93a73a59c64c9dd9edd52a1b26490574b1c20199f0a7fc9a0fc2b68ab82c85

SHA512
011908103b3e9202e4a175c9c2f87aebe3cc5709a0679283bd38420bafac33ba3a9c6c35bc552641c86c40b542103f748764bd2a85c7ece9080ea98a45160a24

Download Submit
C:\Windows\system\fAMeXBJ.exe

Filesize
1.9MB

MD5
f9e83366d429970d542424b78d5dd065

SHA1
abe54346a99b995d4db01be848d67f0e68c3e0b1

SHA256
19021de4b389980bac24e21a1d61f9d0e7722ce8804bf3ea2b70c9677aad3bb7

SHA512
56fefea4bd00f602b5e9325e1e251bc86b2b6998dd78aecf7db8aa7f763d2fce72ec1f8cd2c77c027fbd9502938e76e3e25e24a762c403e45d4bdbad731c506c

Download Submit
C:\Windows\system\gKnhIKw.exe

Filesize
1.9MB

MD5
cbff03d0cdb139c8589e8ce2b00328d1

SHA1
81c072d41db5917ab7fa17f0d7630314e1138fa2

SHA256
e3e4021e6e3fc09b9c43ac3ca8c50392a028aa4d5f8db9163b9ee4c42c0a9f58

SHA512
710120126b6a3a928fc590af7ecabeaa5bd5b90298886e9ba056364629c372df60832793d637c26b3cdbd04e8ce83632e6f122bf882c6db96d2f2fbdfe30a7a3

Download Submit
C:\Windows\system\hCDBpAn.exe

Filesize
1.9MB

MD5
4a2655c6d833b79380dc51d92e26c90e

SHA1
4def70962a84dc7e2c24f07fb1273458d20b46f8

SHA256
4c5fef97e72b1e1dd8aa897446c2e153ac14d93ffc9824258ee2d30b9d3418fe

SHA512
f5ccc7ea6f65edf6b87a7238c597f6feb536db4bd6580eb64c37809b6bd5089a116d51dd60cb9c590db8202a5670cc92b4658fb98b98f228c2b20f5f43b3f929

Download Submit
C:\Windows\system\jgFtRgL.exe

Filesize
1.9MB

MD5
da70200a8b5f2531937fac9b3551e1d0

SHA1
4c1135ec50502ed5fe284cd394dd7cf1906ae9ac

SHA256
f46e50ecf201be7b42e6bf028043f25c991022c089f3a39364a147a87b63090c

SHA512
d841e19db04be58e942f31ca1985080852838c1af4b611ac9fc1381457a48486a69fa85cc04250199a2264dac788b365e2f6162348b8ef3929317c84fb57c9ec

Download Submit
C:\Windows\system\kAsqBQp.exe

Filesize
1.9MB

MD5
e9b456c406b5e7fa9790d25d2a9724bd

SHA1
b180ad95be7dc672354476ce776c5885959ee947

SHA256
af362dd6088c52117649dd904aaa108120e71ad5db124be7104077df539e34d9

SHA512
25002cc6a3cd9f6f37322c10d16d1704b37995c1400b39d68eb03c26283e3e4c11d1defe2016e46bba25eb79b82d82350b0dc5e24610a47ac84e7a7a4d13d934

Download Submit
C:\Windows\system\ktMbHHp.exe

Filesize
1.9MB

MD5
cfe0b4e87668094bf78bce6fb93efb2f

SHA1
6d47a18e6c852c47ee10403166d405a02499b39e

SHA256
e44fd1a74c01b13d4a63125dfc89adc796f6950aca7959d713ac9c94ed706837

SHA512
5abd535a5fbf7365ccce08abd4777e8ccc43a14a8766badd9b9c49e72f2c61c6c75239a97f217109c1668f2b7655653aab50e0ce6fed7471eb9e88d3287c3fd9

Download Submit
C:\Windows\system\uJvvZow.exe

Filesize
1.9MB

MD5
56cba1c0aa0a25e6ff0cc8fafd8a21b2

SHA1
aa25530ba2e96c1514fbed6617aad53073ee9ae8

SHA256
90974227bdf5636446761f70a95c5e8437bd9ae71a87b46eab60d1f44c81e686

SHA512
2ade368ba4440cf07391beeed9aca2476e65fca9613184e6eefcb8e0efe80cbf1a1c03daf50b4c98e6030ebeb352db9dc838203357ba1a5a8ab67451d4687581

Download Submit
C:\Windows\system\vWmiopk.exe

Filesize
1.9MB

MD5
405ab7a0649f25c2d9b20e9670ceea1d

SHA1
d090de41b2d7870ed484576f6df852253d65102b

SHA256
c635b2c8beb52af212f5bd397be9f372d6880b2ae6cb8d1f1f86898214ed28d5

SHA512
df0e94658acf6abe951763f969b561448408ffb73a704c47df77567a42586d2e199b6601fce5c56bba9c0bed6ccb5f4ca0b28a68e95fad4a47cd202d1e46c231

Download Submit
C:\Windows\system\zgghEtQ.exe

Filesize
1.9MB

MD5
b687c82cb347aff6ed1f02c37f214bf1

SHA1
24d40681b38495ce16cead519306707a66b24e23

SHA256
e3b3bc5aaa71d7ce3a00162ee40ff71a42d11188596a1bb734493f5c200484db

SHA512
93cffb771e780e874ddeeb1b99ac09abdb80437bf4cf701bec486f7176908847b07a749996ecd7ff83662a9ef5d5662fd53be97f17db4c3dff516a5bfcb0cca9

Download Submit
C:\Windows\system\zxiqyeC.exe

Filesize
1.9MB

MD5
b94521e8a3260b283b36e69bdf0e2530

SHA1
4ef132cdbf5470f4f8212283ba2169b6153a5018

SHA256
9d6b0e43f77070d5f17c6f32b29552b3c5ac7868e541623f2a9db5daf75861e5

SHA512
4b08f48c46af3c90f67100703f90025544e934dea1c227cdeadad6352badd7b47f7f373dfe794797cb0fd9de050d49a75e11f2bfe034b33e9ce1054b0d14f3f5

Download Submit
\Windows\system\AgUAcka.exe

Filesize
1.8MB

MD5
0485f7255f1d3693cae8e04dea3484d4

SHA1
a56df1aa92e4c9e2a052232015d97c8c47647ac8

SHA256
eb102da3942ad718af06b4118f4bb9f9d476b44edce9c36ee1d3a4a1e8289b68

SHA512
a5fd3de85ad3566ab17a1ac1d853b7ef86ed05632379c24de1e1ef6fe079d5849249d6599e219e7fc2ce3d35dd39100084cb05669861a4e439981698f6921ad5

Download Submit
\Windows\system\BVUnpGA.exe

Filesize
1.9MB

MD5
b4b9613268d1d4c27ccc17d686609e8b

SHA1
421a3fa2ddfc28742ff6c0ec5828b7752070e590

SHA256
5a32a5984c59f87a384f442c53f56ad38d12a10ab0e11e426458864c16ba077d

SHA512
4bcac1dacfe24ff1a3b25a6a0586b994089fc96375fd85047772b2e099d991c93c1e0d78eb441a88eebc83dedc6729e23404ad4812b02e4aadb74839447ea269

Download Submit
\Windows\system\HqmWSaB.exe

Filesize
1.9MB

MD5
a5ee72108c1c0e4d2b9af74d1408d7f2

SHA1
7cadd11053666f2bccba45afe9f3bd0be8812f9f

SHA256
aa1860ad4560e39adfd0e8af4bc6b9d5a7a31f156ebf70565bb71d4f7fdcb40d

SHA512
9fb0666c37bc8765896237691e333535bfc133055e0635698e644bc243afe018a2990594b55b9624047eecb75404b94f665ed2cf0f3f9b8ef5e4937eb3838e8b

Download Submit
\Windows\system\JsTLKTr.exe

Filesize
1.9MB

MD5
ec35edff0d6539899d79033f79f6c795

SHA1
1fea7f583e094eedb215c83f718d356331617547

SHA256
5ada20cd893a3de11b8dd8eb3a806cb46866acfa69839b38efd0187049d43432

SHA512
bde089782c3890854ea9f1c792c9065301193c84a5a320fce1d343417533835b72d2a58b5bd4ec39a355e6ac2ff990a61b788f066710a78b44fa40de8c5b9429

Download Submit
\Windows\system\NVcubPg.exe

Filesize
1.9MB

MD5
40c0068f33d8ef53c4573b33202be936

SHA1
64214ee954ac36ccd50c575c7ae7d6b0ce5a975b

SHA256
656ec46f331fa8bd031fe9959d24183f7ad11abb20f7574795ddb6860058fae9

SHA512
39799dec6d14af0f97a86808bad34ada4e9635501bca81194b1f800477c52ae3ccafb85eb89210f0bf21b8da1b30556c87a507f3d170569e084e1464d76d02e8

Download Submit
\Windows\system\OUGfoCs.exe

Filesize
1.9MB

MD5
a81192443c0f4dc54fde487a57dd407e

SHA1
2be9e4d4e4e0515fb4e901751752e518e4b10caa

SHA256
2d92c7b970328c714b111822000c312926d52b4587c374153fa90ac172b05ee0

SHA512
eefee13600491d760c11f14c89d69e1125ebea6449f7f66c233ee024324fc57d6b0a1c5d5f1e0f10bda077c03fdd0c5c0f3c5d30cca74dec3911ba0127976efe

Download Submit
\Windows\system\ReNkgws.exe

Filesize
1.9MB

MD5
59ed068407de1dda7563c0923216c05d

SHA1
05aeff88f5299725fb0078dc0044f4e193eefba9

SHA256
c3a9e187f08e54db200fe74917060ae54503e7902b6d1a8425fb78ba0b950647

SHA512
716b6d30f6ca7af55df79075263c5033861d4ec3e830fc642822f1de02b844b85c78c36fcd9dfba3482d02d4301657df373b727587c23b69d8d3319bea078b92

Download Submit
\Windows\system\bHvNuwA.exe

Filesize
1.9MB

MD5
efeea1bea72b71d2fc5c13ca438a9a00

SHA1
cbfac712cf6c84e99c4616f7da36208b08f29f20

SHA256
b72d8f70f10a1b0930d24b86f35299a25c52212aba0da4355e7222a76865d83a

SHA512
e21a9b5a89c4f06d9766e93855dd98d17192dad115779b32acc2b1f3ecd1d55635391483852f090c76e89490894105b5aee2d6a5058b162978aea6e42b7d24f6

Download Submit
\Windows\system\iyDZcmQ.exe

Filesize
1.9MB

MD5
2064f8c62ee5dc5577b0ecfb44b3b2cf

SHA1
cd555b8a7edc9cbea079e83715efc89a3eebc11f

SHA256
8ce3e2214047e21f497700f24671978eab3939a7f1b8edfbd7b45d9e281675e6

SHA512
0f9178c74197ad91b92c61b8014d65a26423e70175c3c2ae1228ef3b6967e6925407f6ae41643599531c40e45146daed8818357071dc704f5d4979153e4b24fd

Download Submit
\Windows\system\pxeSQek.exe

Filesize
1.9MB

MD5
2a0e7270506b2a1eb1e38d37c3d78871

SHA1
0e8886d9acb5385a97f1a99bcc09325bf763c534

SHA256
f44759de5047923ec77ec98ca9f64b08e91f5de29ed7b7cd86964fba041fa429

SHA512
63f867f7dc00746b352723222cd252ea967cbd77dcad73078a4a3eaf5a7efbae69fe95badf428c5d68c0ede799d57a0575eee7e65020f8cb6c3b5651c41e24a0

Download Submit
\Windows\system\sPtHHgK.exe

Filesize
1.9MB

MD5
63450446df38d3ec773868750c393192

SHA1
2bd5279de93b18ddbbb2624a87c2dc04e9036724

SHA256
1e7a8ee1499fa6db5156152d3101ae578affe3fc4dd2fead7856b51df4960627

SHA512
a5e7228cd7a6b2736b5eb547a60bfebc92debd3d2a5a26ac1cb24a801b7955386b23e02926ea4ea6a14ae8f5baec955ba373b0c9a227e47535598fe0cceca0b8

Download Submit
memory/684-87-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-40-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/1688-76-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1688-88-0x00000000032D0000-0x00000000036C2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-7-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/1688-89-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-1-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1688-68-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-56-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/1688-66-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/1688-67-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download
memory/2344-51-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2412-65-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-37-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2436-292-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2440-9-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2440-73-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2512-35-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-90-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2544-85-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2544-14-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2548-21-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-69-0x000000013F650000-0x000000013FA42000-memory.dmp

Filesize
3.9MB

Download
memory/2948-34-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2948-259-0x000000001B2B0000-0x000000001B592000-memory.dmp

Filesize
2.9MB

Download
memory/2948-289-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/2948-261-0x0000000002460000-0x0000000002468000-memory.dmp

Filesize
32KB

Download
memory/2988-60-0x000000013F7A0000-0x000000013FB92000-memory.dmp

Filesize
3.9MB

Download