xmrig | 8e8d5ad747c15f9779ed0138df4478aef915613e110d0d7f2b1696bc47a05479

Analysis

max time kernel
37s
max time network
37s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 16:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
Size

1.8MB
MD5

058eb2dc1b459022095bd484c289f1b0
SHA1

7d742c737eb25f6146c37a7535bcc23ac538da8d
SHA256

8e8d5ad747c15f9779ed0138df4478aef915613e110d0d7f2b1696bc47a05479
SHA512

6b5eb83b28bf1e4f2757787c2edc84dccc4c4f2937fb595198328ed8f5387e3e3d5831d7e9b0d61cab733b0eb4b1666031d6865b42774cabd50c3484048b2cdf
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pO2:NABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2584-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2504-183-0x000000013FB20000-0x000000013FF12000-memory.dmp	xmrig
behavioral1/memory/2568-181-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2408-179-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/2764-177-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2592-175-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2740-173-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2360-171-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig
behavioral1/memory/2644-169-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2584	FNojOXZ.exe
2644	rRBDvqh.exe
2360	UMMcFtn.exe
2740	uwEwWaH.exe
2592	hLXYKde.exe
2764	kiUGrhx.exe
2408	RbgfRcH.exe
2568	EgcosuJ.exe
2504	zhVjCOR.exe
2348	zaAZkyN.exe
2892	igmRpBx.exe
1028	WBEaAme.exe
296	DKKejph.exe
2552	HXkXveQ.exe
1116	YJFAgEF.exe
2188	YgCqGLh.exe
1264	ZiNCOLk.exe
1944	AzYsIso.exe
916	msUBjjI.exe
1308	rofcNdH.exe
2768	GIvzlLH.exe
2832	krCKLmy.exe
568	VKHZbtZ.exe
2200	cJBgzWB.exe
1980	bSnMiYl.exe
1220	eOucGol.exe
1948	Bspecju.exe
1284	ulhoZtl.exe
2376	XOHHwOU.exe
2292	duynLSw.exe
1052	LwfkSPL.exe
2116	SePsmyQ.exe
1788	cAYNOBv.exe
1700	ExfDAEZ.exe
1564	BqVdOOh.exe
1876	yFCWuUq.exe
2092	yRIPDjo.exe
1044	CNrNEfe.exe
960	lpklJfh.exe
2032	qaxIodD.exe
884	uzBGhyT.exe
1312	IBUnCaC.exe
1708	uNtOLVD.exe
1244	PxIxLiK.exe
2436	PFZqNkl.exe
896	oAdsRuy.exe
2440	LVnAicD.exe
2920	pLUSDSM.exe
2844	CDBefTK.exe
2704	xoTXIWc.exe
2516	dwRLOkw.exe
2316	vNfVDbE.exe
2204	XyCscHP.exe
1972	eAiHmxl.exe
1808	wYunwty.exe
680	LCCrCMf.exe
1112	dLtmCph.exe
2120	ioXqjyj.exe
1648	kzFVadT.exe
1744	ERYPwyI.exe
2284	eymTSHC.exe
584	BComxOH.exe
1480	oLcvEYR.exe
1628	zYdCqAD.exe

Loads dropped DLL 64 IoCs

pid	Process
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2052-0-0x000000013F7F0000-0x000000013FBE2000-memory.dmp	upx
behavioral1/files/0x000c00000001226e-6.dat	upx
behavioral1/memory/2584-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/files/0x0039000000015cc2-18.dat	upx
behavioral1/files/0x00130000000054a8-22.dat	upx
behavioral1/files/0x0007000000015d1e-29.dat	upx
behavioral1/files/0x0007000000015d28-36.dat	upx
behavioral1/files/0x0006000000016ca1-50.dat	upx
behavioral1/files/0x0006000000016cf2-59.dat	upx
behavioral1/files/0x0006000000016ccd-62.dat	upx
behavioral1/files/0x0006000000016d10-68.dat	upx
behavioral1/files/0x0006000000016d36-85.dat	upx
behavioral1/files/0x0006000000016d57-98.dat	upx
behavioral1/files/0x0008000000016c5b-54.dat	upx
behavioral1/files/0x000600000001708c-129.dat	upx
behavioral1/files/0x000600000001738e-139.dat	upx
behavioral1/files/0x0006000000016d4f-145.dat	upx
behavioral1/files/0x00060000000173e2-156.dat	upx
behavioral1/files/0x00060000000171ad-161.dat	upx
behavioral1/files/0x000600000001738f-163.dat	upx
behavioral1/memory/2504-183-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/memory/2568-181-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2408-179-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/2764-177-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2592-175-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2740-173-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2360-171-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/memory/2644-169-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0039000000015cca-164.dat	upx
behavioral1/files/0x0006000000016fa9-154.dat	upx
behavioral1/files/0x0006000000016d79-152.dat	upx
behavioral1/files/0x0006000000016d2d-128.dat	upx
behavioral1/files/0x0006000000016d19-118.dat	upx
behavioral1/files/0x0006000000016d5f-104.dat	upx
behavioral1/files/0x0006000000016d46-96.dat	upx
behavioral1/files/0x0006000000016d3e-86.dat	upx
behavioral1/files/0x00060000000173e5-184.dat	upx
behavioral1/files/0x0006000000016d21-81.dat	upx
behavioral1/files/0x0006000000016d01-66.dat	upx
behavioral1/files/0x0006000000016d7d-121.dat	upx
behavioral1/files/0x0006000000016d73-109.dat	upx
behavioral1/files/0x0008000000015d13-28.dat	upx
behavioral1/files/0x0009000000015d89-42.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pwQoxHe.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\WghhXcy.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\thHHsfc.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\adkvKmv.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\PDcABlM.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\IwPPABm.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\FxySgii.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\SqMjoOh.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\eVBLJBd.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\oUHRdBu.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\jLYdItj.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\rmbfHGT.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\piLTREh.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\atFjyUP.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\KYybhhI.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\QqPaXsv.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\nHvzGZt.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\IrhSyBV.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\pjxNcBA.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\oLvNVPj.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\vLKxwKi.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\zkVyjwC.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\jmrSKXA.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\RSHeTls.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\CvbBGxv.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\qZZpCSH.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\uqpxAKZ.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\TGpqGaK.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\PRNayNj.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\naNGCoP.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\IvkoFbj.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\ukLIUHC.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\AzwVqJX.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\GhhqyKw.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\oTpvToE.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\RFMjkhb.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\qAPaXpe.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\TzXJdwA.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\arccbPO.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\BrTgkMx.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\SGxHGbx.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\WUKKXNp.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\OJuRavM.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\GSebBbe.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\iYiKtCB.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\wrpJgqY.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\pcQyJqZ.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\RbgfRcH.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\HobAsvs.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\FkSYimX.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\VqcoSCM.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\uwEwWaH.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\rfkzbdw.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\THtbZcN.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\cBjsBMQ.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\jGEfRyS.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\gcxMhDk.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\efpFmrN.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\cNCtmnY.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\oYljDgg.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\jwTsniU.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\tUlaHrp.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\nKNNdvc.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
File created	C:\Windows\System\LVnAicD.exe	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2908	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
Token: SeDebugPrivilege	2908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2908	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2908	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2908	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	29
PID 2052 wrote to memory of 2584	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2584	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2584	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	30
PID 2052 wrote to memory of 2644	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	31
PID 2052 wrote to memory of 2644	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	31
PID 2052 wrote to memory of 2644	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	31
PID 2052 wrote to memory of 2360	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	32
PID 2052 wrote to memory of 2360	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	32
PID 2052 wrote to memory of 2360	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	32
PID 2052 wrote to memory of 2740	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	33
PID 2052 wrote to memory of 2740	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	33
PID 2052 wrote to memory of 2740	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	33
PID 2052 wrote to memory of 2592	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	34
PID 2052 wrote to memory of 2592	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	34
PID 2052 wrote to memory of 2592	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	34
PID 2052 wrote to memory of 2764	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	35
PID 2052 wrote to memory of 2764	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	35
PID 2052 wrote to memory of 2764	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	35
PID 2052 wrote to memory of 2408	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	36
PID 2052 wrote to memory of 2408	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	36
PID 2052 wrote to memory of 2408	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	36
PID 2052 wrote to memory of 2504	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	37
PID 2052 wrote to memory of 2504	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	37
PID 2052 wrote to memory of 2504	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	37
PID 2052 wrote to memory of 2568	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	38
PID 2052 wrote to memory of 2568	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	38
PID 2052 wrote to memory of 2568	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	38
PID 2052 wrote to memory of 2892	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	39
PID 2052 wrote to memory of 2892	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	39
PID 2052 wrote to memory of 2892	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	39
PID 2052 wrote to memory of 2348	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	40
PID 2052 wrote to memory of 2348	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	40
PID 2052 wrote to memory of 2348	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	40
PID 2052 wrote to memory of 1028	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	41
PID 2052 wrote to memory of 1028	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	41
PID 2052 wrote to memory of 1028	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	41
PID 2052 wrote to memory of 296	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	42
PID 2052 wrote to memory of 296	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	42
PID 2052 wrote to memory of 296	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	42
PID 2052 wrote to memory of 916	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	43
PID 2052 wrote to memory of 916	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	43
PID 2052 wrote to memory of 916	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	43
PID 2052 wrote to memory of 2552	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	44
PID 2052 wrote to memory of 2552	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	44
PID 2052 wrote to memory of 2552	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	44
PID 2052 wrote to memory of 2768	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	45
PID 2052 wrote to memory of 2768	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	45
PID 2052 wrote to memory of 2768	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	45
PID 2052 wrote to memory of 1116	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	46
PID 2052 wrote to memory of 1116	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	46
PID 2052 wrote to memory of 1116	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	46
PID 2052 wrote to memory of 2200	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	47
PID 2052 wrote to memory of 2200	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	47
PID 2052 wrote to memory of 2200	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	47
PID 2052 wrote to memory of 2188	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	48
PID 2052 wrote to memory of 2188	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	48
PID 2052 wrote to memory of 2188	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	48
PID 2052 wrote to memory of 1980	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	49
PID 2052 wrote to memory of 1980	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	49
PID 2052 wrote to memory of 1980	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	49
PID 2052 wrote to memory of 1264	2052	058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\058eb2dc1b459022095bd484c289f1b0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\System\FNojOXZ.exe
  C:\Windows\System\FNojOXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\rRBDvqh.exe
  C:\Windows\System\rRBDvqh.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\UMMcFtn.exe
  C:\Windows\System\UMMcFtn.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\uwEwWaH.exe
  C:\Windows\System\uwEwWaH.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\hLXYKde.exe
  C:\Windows\System\hLXYKde.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\kiUGrhx.exe
  C:\Windows\System\kiUGrhx.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\RbgfRcH.exe
  C:\Windows\System\RbgfRcH.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\zhVjCOR.exe
  C:\Windows\System\zhVjCOR.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\EgcosuJ.exe
  C:\Windows\System\EgcosuJ.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\igmRpBx.exe
  C:\Windows\System\igmRpBx.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\zaAZkyN.exe
  C:\Windows\System\zaAZkyN.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\WBEaAme.exe
  C:\Windows\System\WBEaAme.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\DKKejph.exe
  C:\Windows\System\DKKejph.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\msUBjjI.exe
  C:\Windows\System\msUBjjI.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\HXkXveQ.exe
  C:\Windows\System\HXkXveQ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\GIvzlLH.exe
  C:\Windows\System\GIvzlLH.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\YJFAgEF.exe
  C:\Windows\System\YJFAgEF.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\cJBgzWB.exe
  C:\Windows\System\cJBgzWB.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\YgCqGLh.exe
  C:\Windows\System\YgCqGLh.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\bSnMiYl.exe
  C:\Windows\System\bSnMiYl.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\ZiNCOLk.exe
  C:\Windows\System\ZiNCOLk.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\eOucGol.exe
  C:\Windows\System\eOucGol.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\AzYsIso.exe
  C:\Windows\System\AzYsIso.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\Bspecju.exe
  C:\Windows\System\Bspecju.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\rofcNdH.exe
  C:\Windows\System\rofcNdH.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\ulhoZtl.exe
  C:\Windows\System\ulhoZtl.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\krCKLmy.exe
  C:\Windows\System\krCKLmy.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\duynLSw.exe
  C:\Windows\System\duynLSw.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\VKHZbtZ.exe
  C:\Windows\System\VKHZbtZ.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\LwfkSPL.exe
  C:\Windows\System\LwfkSPL.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\XOHHwOU.exe
  C:\Windows\System\XOHHwOU.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\cAYNOBv.exe
  C:\Windows\System\cAYNOBv.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\SePsmyQ.exe
  C:\Windows\System\SePsmyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\BqVdOOh.exe
  C:\Windows\System\BqVdOOh.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\ExfDAEZ.exe
  C:\Windows\System\ExfDAEZ.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\CNrNEfe.exe
  C:\Windows\System\CNrNEfe.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\yFCWuUq.exe
  C:\Windows\System\yFCWuUq.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\lpklJfh.exe
  C:\Windows\System\lpklJfh.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\yRIPDjo.exe
  C:\Windows\System\yRIPDjo.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\qaxIodD.exe
  C:\Windows\System\qaxIodD.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\uzBGhyT.exe
  C:\Windows\System\uzBGhyT.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\IBUnCaC.exe
  C:\Windows\System\IBUnCaC.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\uNtOLVD.exe
  C:\Windows\System\uNtOLVD.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\yDiRgTD.exe
  C:\Windows\System\yDiRgTD.exe
  2⤵
  PID:340
- C:\Windows\System\PxIxLiK.exe
  C:\Windows\System\PxIxLiK.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\WNTYfqF.exe
  C:\Windows\System\WNTYfqF.exe
  2⤵
  PID:988
- C:\Windows\System\PFZqNkl.exe
  C:\Windows\System\PFZqNkl.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\JluiZjW.exe
  C:\Windows\System\JluiZjW.exe
  2⤵
  PID:984
- C:\Windows\System\oAdsRuy.exe
  C:\Windows\System\oAdsRuy.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\ronqyDg.exe
  C:\Windows\System\ronqyDg.exe
  2⤵
  PID:2864
- C:\Windows\System\LVnAicD.exe
  C:\Windows\System\LVnAicD.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\QSGEeuH.exe
  C:\Windows\System\QSGEeuH.exe
  2⤵
  PID:1636
- C:\Windows\System\pLUSDSM.exe
  C:\Windows\System\pLUSDSM.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\FfraGqc.exe
  C:\Windows\System\FfraGqc.exe
  2⤵
  PID:1584
- C:\Windows\System\CDBefTK.exe
  C:\Windows\System\CDBefTK.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\pBrAOee.exe
  C:\Windows\System\pBrAOee.exe
  2⤵
  PID:2640
- C:\Windows\System\xoTXIWc.exe
  C:\Windows\System\xoTXIWc.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\WUKKXNp.exe
  C:\Windows\System\WUKKXNp.exe
  2⤵
  PID:2608
- C:\Windows\System\dwRLOkw.exe
  C:\Windows\System\dwRLOkw.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\FIeGSEU.exe
  C:\Windows\System\FIeGSEU.exe
  2⤵
  PID:2496
- C:\Windows\System\vNfVDbE.exe
  C:\Windows\System\vNfVDbE.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\RSHeTls.exe
  C:\Windows\System\RSHeTls.exe
  2⤵
  PID:2728
- C:\Windows\System\XyCscHP.exe
  C:\Windows\System\XyCscHP.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\NsuCWNi.exe
  C:\Windows\System\NsuCWNi.exe
  2⤵
  PID:2560
- C:\Windows\System\eAiHmxl.exe
  C:\Windows\System\eAiHmxl.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\qNyeBMz.exe
  C:\Windows\System\qNyeBMz.exe
  2⤵
  PID:1960
- C:\Windows\System\wYunwty.exe
  C:\Windows\System\wYunwty.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\inwgNoK.exe
  C:\Windows\System\inwgNoK.exe
  2⤵
  PID:1828
- C:\Windows\System\LCCrCMf.exe
  C:\Windows\System\LCCrCMf.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\pBspSSD.exe
  C:\Windows\System\pBspSSD.exe
  2⤵
  PID:2536
- C:\Windows\System\dLtmCph.exe
  C:\Windows\System\dLtmCph.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\vxEqJMA.exe
  C:\Windows\System\vxEqJMA.exe
  2⤵
  PID:2600
- C:\Windows\System\ioXqjyj.exe
  C:\Windows\System\ioXqjyj.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\gSpmJyu.exe
  C:\Windows\System\gSpmJyu.exe
  2⤵
  PID:1444
- C:\Windows\System\kzFVadT.exe
  C:\Windows\System\kzFVadT.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\pAjIIyl.exe
  C:\Windows\System\pAjIIyl.exe
  2⤵
  PID:2384
- C:\Windows\System\ERYPwyI.exe
  C:\Windows\System\ERYPwyI.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\WLJOFtL.exe
  C:\Windows\System\WLJOFtL.exe
  2⤵
  PID:1872
- C:\Windows\System\eymTSHC.exe
  C:\Windows\System\eymTSHC.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ZHjOKKQ.exe
  C:\Windows\System\ZHjOKKQ.exe
  2⤵
  PID:1384
- C:\Windows\System\BComxOH.exe
  C:\Windows\System\BComxOH.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\MtZDjrW.exe
  C:\Windows\System\MtZDjrW.exe
  2⤵
  PID:1688
- C:\Windows\System\oLcvEYR.exe
  C:\Windows\System\oLcvEYR.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\mxTQYxR.exe
  C:\Windows\System\mxTQYxR.exe
  2⤵
  PID:1332
- C:\Windows\System\zYdCqAD.exe
  C:\Windows\System\zYdCqAD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\zfPWraW.exe
  C:\Windows\System\zfPWraW.exe
  2⤵
  PID:2800
- C:\Windows\System\uSYanbF.exe
  C:\Windows\System\uSYanbF.exe
  2⤵
  PID:1532
- C:\Windows\System\GEGyZgw.exe
  C:\Windows\System\GEGyZgw.exe
  2⤵
  PID:2980
- C:\Windows\System\ynGGaet.exe
  C:\Windows\System\ynGGaet.exe
  2⤵
  PID:1300
- C:\Windows\System\GlAbbKO.exe
  C:\Windows\System\GlAbbKO.exe
  2⤵
  PID:888
- C:\Windows\System\nybkrUM.exe
  C:\Windows\System\nybkrUM.exe
  2⤵
  PID:2368
- C:\Windows\System\ucQcFja.exe
  C:\Windows\System\ucQcFja.exe
  2⤵
  PID:2488
- C:\Windows\System\oqjumtT.exe
  C:\Windows\System\oqjumtT.exe
  2⤵
  PID:1668
- C:\Windows\System\hBOkujl.exe
  C:\Windows\System\hBOkujl.exe
  2⤵
  PID:2544
- C:\Windows\System\HbOiLMQ.exe
  C:\Windows\System\HbOiLMQ.exe
  2⤵
  PID:1824
- C:\Windows\System\unxISCy.exe
  C:\Windows\System\unxISCy.exe
  2⤵
  PID:264
- C:\Windows\System\lHuDGTL.exe
  C:\Windows\System\lHuDGTL.exe
  2⤵
  PID:1756
- C:\Windows\System\Dttjhkk.exe
  C:\Windows\System\Dttjhkk.exe
  2⤵
  PID:1936
- C:\Windows\System\ggLtEEE.exe
  C:\Windows\System\ggLtEEE.exe
  2⤵
  PID:2040
- C:\Windows\System\xutvjEw.exe
  C:\Windows\System\xutvjEw.exe
  2⤵
  PID:2924
- C:\Windows\System\KtOjBpk.exe
  C:\Windows\System\KtOjBpk.exe
  2⤵
  PID:2148
- C:\Windows\System\EGeTwYK.exe
  C:\Windows\System\EGeTwYK.exe
  2⤵
  PID:2492
- C:\Windows\System\npeCniP.exe
  C:\Windows\System\npeCniP.exe
  2⤵
  PID:480
- C:\Windows\System\ypezRHV.exe
  C:\Windows\System\ypezRHV.exe
  2⤵
  PID:3088
- C:\Windows\System\BfIRifu.exe
  C:\Windows\System\BfIRifu.exe
  2⤵
  PID:3104
- C:\Windows\System\AcNJNSF.exe
  C:\Windows\System\AcNJNSF.exe
  2⤵
  PID:3120
- C:\Windows\System\VYfUgiA.exe
  C:\Windows\System\VYfUgiA.exe
  2⤵
  PID:3136
- C:\Windows\System\OmVLHjH.exe
  C:\Windows\System\OmVLHjH.exe
  2⤵
  PID:3152
- C:\Windows\System\efpFmrN.exe
  C:\Windows\System\efpFmrN.exe
  2⤵
  PID:3168
- C:\Windows\System\LIkiLdZ.exe
  C:\Windows\System\LIkiLdZ.exe
  2⤵
  PID:3184
- C:\Windows\System\uGRAAEi.exe
  C:\Windows\System\uGRAAEi.exe
  2⤵
  PID:3200
- C:\Windows\System\ClnjsIU.exe
  C:\Windows\System\ClnjsIU.exe
  2⤵
  PID:3216
- C:\Windows\System\ADykaUI.exe
  C:\Windows\System\ADykaUI.exe
  2⤵
  PID:3232
- C:\Windows\System\fwuNSMt.exe
  C:\Windows\System\fwuNSMt.exe
  2⤵
  PID:3248
- C:\Windows\System\DfRFawC.exe
  C:\Windows\System\DfRFawC.exe
  2⤵
  PID:3264
- C:\Windows\System\CYUbEiK.exe
  C:\Windows\System\CYUbEiK.exe
  2⤵
  PID:3280
- C:\Windows\System\KaNLuRs.exe
  C:\Windows\System\KaNLuRs.exe
  2⤵
  PID:3296
- C:\Windows\System\ZmraTHH.exe
  C:\Windows\System\ZmraTHH.exe
  2⤵
  PID:3312
- C:\Windows\System\hnKxUfQ.exe
  C:\Windows\System\hnKxUfQ.exe
  2⤵
  PID:3328
- C:\Windows\System\HobAsvs.exe
  C:\Windows\System\HobAsvs.exe
  2⤵
  PID:3344
- C:\Windows\System\CzdZXBL.exe
  C:\Windows\System\CzdZXBL.exe
  2⤵
  PID:3360
- C:\Windows\System\RVOuIRE.exe
  C:\Windows\System\RVOuIRE.exe
  2⤵
  PID:3376
- C:\Windows\System\OUPXqcc.exe
  C:\Windows\System\OUPXqcc.exe
  2⤵
  PID:3392
- C:\Windows\System\zqkgOqn.exe
  C:\Windows\System\zqkgOqn.exe
  2⤵
  PID:3408
- C:\Windows\System\qUClbjG.exe
  C:\Windows\System\qUClbjG.exe
  2⤵
  PID:3584
- C:\Windows\System\wkOXRWT.exe
  C:\Windows\System\wkOXRWT.exe
  2⤵
  PID:3604
- C:\Windows\System\CZrJrha.exe
  C:\Windows\System\CZrJrha.exe
  2⤵
  PID:3620
- C:\Windows\System\rMpiWsm.exe
  C:\Windows\System\rMpiWsm.exe
  2⤵
  PID:3636
- C:\Windows\System\xbPMydn.exe
  C:\Windows\System\xbPMydn.exe
  2⤵
  PID:3652
- C:\Windows\System\hvNTyHm.exe
  C:\Windows\System\hvNTyHm.exe
  2⤵
  PID:3668
- C:\Windows\System\ZzWQFtx.exe
  C:\Windows\System\ZzWQFtx.exe
  2⤵
  PID:3720
- C:\Windows\System\MuIYNEf.exe
  C:\Windows\System\MuIYNEf.exe
  2⤵
  PID:3892
- C:\Windows\System\lOiKXnf.exe
  C:\Windows\System\lOiKXnf.exe
  2⤵
  PID:3924
- C:\Windows\System\DIIqKhK.exe
  C:\Windows\System\DIIqKhK.exe
  2⤵
  PID:3948
- C:\Windows\System\EYXXbtJ.exe
  C:\Windows\System\EYXXbtJ.exe
  2⤵
  PID:3968
- C:\Windows\System\IzUNLWv.exe
  C:\Windows\System\IzUNLWv.exe
  2⤵
  PID:3988
- C:\Windows\System\eTmaacb.exe
  C:\Windows\System\eTmaacb.exe
  2⤵
  PID:4008
- C:\Windows\System\qvzWngy.exe
  C:\Windows\System\qvzWngy.exe
  2⤵
  PID:4028
- C:\Windows\System\ePFZuTe.exe
  C:\Windows\System\ePFZuTe.exe
  2⤵
  PID:4048
- C:\Windows\System\OcKTpwx.exe
  C:\Windows\System\OcKTpwx.exe
  2⤵
  PID:4068
- C:\Windows\System\vqLeQTA.exe
  C:\Windows\System\vqLeQTA.exe
  2⤵
  PID:4084
- C:\Windows\System\dClwHJg.exe
  C:\Windows\System\dClwHJg.exe
  2⤵
  PID:2580
- C:\Windows\System\AVfxVjV.exe
  C:\Windows\System\AVfxVjV.exe
  2⤵
  PID:1560
- C:\Windows\System\kMVAoBg.exe
  C:\Windows\System\kMVAoBg.exe
  2⤵
  PID:1820
- C:\Windows\System\tnbNmjQ.exe
  C:\Windows\System\tnbNmjQ.exe
  2⤵
  PID:3144
- C:\Windows\System\ggaaZpM.exe
  C:\Windows\System\ggaaZpM.exe
  2⤵
  PID:3180
- C:\Windows\System\skskBRk.exe
  C:\Windows\System\skskBRk.exe
  2⤵
  PID:592
- C:\Windows\System\zZXxfIa.exe
  C:\Windows\System\zZXxfIa.exe
  2⤵
  PID:1152
- C:\Windows\System\tEXxkNl.exe
  C:\Windows\System\tEXxkNl.exe
  2⤵
  PID:2816
- C:\Windows\System\eUBRMZg.exe
  C:\Windows\System\eUBRMZg.exe
  2⤵
  PID:3208
- C:\Windows\System\SVdWDUQ.exe
  C:\Windows\System\SVdWDUQ.exe
  2⤵
  PID:3272
- C:\Windows\System\ozJiUtW.exe
  C:\Windows\System\ozJiUtW.exe
  2⤵
  PID:3336
- C:\Windows\System\YGLpUad.exe
  C:\Windows\System\YGLpUad.exe
  2⤵
  PID:3004
- C:\Windows\System\fLhEAIq.exe
  C:\Windows\System\fLhEAIq.exe
  2⤵
  PID:2028
- C:\Windows\System\avphmbT.exe
  C:\Windows\System\avphmbT.exe
  2⤵
  PID:1716
- C:\Windows\System\NvNGUqO.exe
  C:\Windows\System\NvNGUqO.exe
  2⤵
  PID:3368
- C:\Windows\System\XQISvZh.exe
  C:\Windows\System\XQISvZh.exe
  2⤵
  PID:3660
- C:\Windows\System\WkSGnIV.exe
  C:\Windows\System\WkSGnIV.exe
  2⤵
  PID:2044
- C:\Windows\System\ZwhhPsW.exe
  C:\Windows\System\ZwhhPsW.exe
  2⤵
  PID:3760
- C:\Windows\System\qnIKyng.exe
  C:\Windows\System\qnIKyng.exe
  2⤵
  PID:3776
- C:\Windows\System\AkRmGmA.exe
  C:\Windows\System\AkRmGmA.exe
  2⤵
  PID:3792
- C:\Windows\System\rSXIrrC.exe
  C:\Windows\System\rSXIrrC.exe
  2⤵
  PID:3808
- C:\Windows\System\VlqvroX.exe
  C:\Windows\System\VlqvroX.exe
  2⤵
  PID:3816
- C:\Windows\System\bvLzzAo.exe
  C:\Windows\System\bvLzzAo.exe
  2⤵
  PID:3832
- C:\Windows\System\XDHIyib.exe
  C:\Windows\System\XDHIyib.exe
  2⤵
  PID:3848
- C:\Windows\System\WHnmtmI.exe
  C:\Windows\System\WHnmtmI.exe
  2⤵
  PID:3320
- C:\Windows\System\fCbHrzH.exe
  C:\Windows\System\fCbHrzH.exe
  2⤵
  PID:3384
- C:\Windows\System\LetRAxA.exe
  C:\Windows\System\LetRAxA.exe
  2⤵
  PID:3424
- C:\Windows\System\jGrFXCC.exe
  C:\Windows\System\jGrFXCC.exe
  2⤵
  PID:2660
- C:\Windows\System\FRfrOyT.exe
  C:\Windows\System\FRfrOyT.exe
  2⤵
  PID:3428
- C:\Windows\System\dNbMUqY.exe
  C:\Windows\System\dNbMUqY.exe
  2⤵
  PID:3440
- C:\Windows\System\tuTjeiA.exe
  C:\Windows\System\tuTjeiA.exe
  2⤵
  PID:3456
- C:\Windows\System\oougrQk.exe
  C:\Windows\System\oougrQk.exe
  2⤵
  PID:3472
- C:\Windows\System\vDQtMeG.exe
  C:\Windows\System\vDQtMeG.exe
  2⤵
  PID:3492
- C:\Windows\System\HncgXXA.exe
  C:\Windows\System\HncgXXA.exe
  2⤵
  PID:3512
- C:\Windows\System\knemmNm.exe
  C:\Windows\System\knemmNm.exe
  2⤵
  PID:3528
- C:\Windows\System\wmbKoDL.exe
  C:\Windows\System\wmbKoDL.exe
  2⤵
  PID:3544
- C:\Windows\System\cSqDGuO.exe
  C:\Windows\System\cSqDGuO.exe
  2⤵
  PID:3560
- C:\Windows\System\zykpoZe.exe
  C:\Windows\System\zykpoZe.exe
  2⤵
  PID:3576
- C:\Windows\System\uRFWcLu.exe
  C:\Windows\System\uRFWcLu.exe
  2⤵
  PID:3864
- C:\Windows\System\HXEnkJh.exe
  C:\Windows\System\HXEnkJh.exe
  2⤵
  PID:3872
- C:\Windows\System\cViPYmA.exe
  C:\Windows\System\cViPYmA.exe
  2⤵
  PID:3732
- C:\Windows\System\PmmVGyQ.exe
  C:\Windows\System\PmmVGyQ.exe
  2⤵
  PID:2596
- C:\Windows\System\tlcrtFl.exe
  C:\Windows\System\tlcrtFl.exe
  2⤵
  PID:2720
- C:\Windows\System\JtKZLmT.exe
  C:\Windows\System\JtKZLmT.exe
  2⤵
  PID:1528
- C:\Windows\System\UXvlgJG.exe
  C:\Windows\System\UXvlgJG.exe
  2⤵
  PID:2680
- C:\Windows\System\MbqNxJA.exe
  C:\Windows\System\MbqNxJA.exe
  2⤵
  PID:2000
- C:\Windows\System\PFVrXTL.exe
  C:\Windows\System\PFVrXTL.exe
  2⤵
  PID:2280
- C:\Windows\System\OJuRavM.exe
  C:\Windows\System\OJuRavM.exe
  2⤵
  PID:1868
- C:\Windows\System\ajxNYpM.exe
  C:\Windows\System\ajxNYpM.exe
  2⤵
  PID:1736
- C:\Windows\System\AIIXwoT.exe
  C:\Windows\System\AIIXwoT.exe
  2⤵
  PID:596
- C:\Windows\System\FaRmlLG.exe
  C:\Windows\System\FaRmlLG.exe
  2⤵
  PID:3068
- C:\Windows\System\beMaqjz.exe
  C:\Windows\System\beMaqjz.exe
  2⤵
  PID:1616
- C:\Windows\System\BkqUFhv.exe
  C:\Windows\System\BkqUFhv.exe
  2⤵
  PID:2564
- C:\Windows\System\CvbBGxv.exe
  C:\Windows\System\CvbBGxv.exe
  2⤵
  PID:2480
- C:\Windows\System\yZTqiKO.exe
  C:\Windows\System\yZTqiKO.exe
  2⤵
  PID:3128
- C:\Windows\System\oJpoErf.exe
  C:\Windows\System\oJpoErf.exe
  2⤵
  PID:3192
- C:\Windows\System\NATnfOc.exe
  C:\Windows\System\NATnfOc.exe
  2⤵
  PID:3648
- C:\Windows\System\pwQoxHe.exe
  C:\Windows\System\pwQoxHe.exe
  2⤵
  PID:3688
- C:\Windows\System\JGCqbFN.exe
  C:\Windows\System\JGCqbFN.exe
  2⤵
  PID:3944
- C:\Windows\System\RnpDuJY.exe
  C:\Windows\System\RnpDuJY.exe
  2⤵
  PID:2192
- C:\Windows\System\BxJhfOK.exe
  C:\Windows\System\BxJhfOK.exe
  2⤵
  PID:3940
- C:\Windows\System\MhhbCeU.exe
  C:\Windows\System\MhhbCeU.exe
  2⤵
  PID:3964
- C:\Windows\System\WExneDn.exe
  C:\Windows\System\WExneDn.exe
  2⤵
  PID:3996
- C:\Windows\System\qVDRGQm.exe
  C:\Windows\System\qVDRGQm.exe
  2⤵
  PID:4020
- C:\Windows\System\GxNkiQC.exe
  C:\Windows\System\GxNkiQC.exe
  2⤵
  PID:540
- C:\Windows\System\IwPPABm.exe
  C:\Windows\System\IwPPABm.exe
  2⤵
  PID:4060
- C:\Windows\System\sfNFCYo.exe
  C:\Windows\System\sfNFCYo.exe
  2⤵
  PID:1880
- C:\Windows\System\goyKouy.exe
  C:\Windows\System\goyKouy.exe
  2⤵
  PID:1148
- C:\Windows\System\BxKLZmg.exe
  C:\Windows\System\BxKLZmg.exe
  2⤵
  PID:2324
- C:\Windows\System\EvWrRiv.exe
  C:\Windows\System\EvWrRiv.exe
  2⤵
  PID:1556
- C:\Windows\System\rcevDJd.exe
  C:\Windows\System\rcevDJd.exe
  2⤵
  PID:4000
- C:\Windows\System\BvrGxHn.exe
  C:\Windows\System\BvrGxHn.exe
  2⤵
  PID:4036
- C:\Windows\System\cNCtmnY.exe
  C:\Windows\System\cNCtmnY.exe
  2⤵
  PID:4040
- C:\Windows\System\VlxCzAV.exe
  C:\Windows\System\VlxCzAV.exe
  2⤵
  PID:912
- C:\Windows\System\iTRkeaj.exe
  C:\Windows\System\iTRkeaj.exe
  2⤵
  PID:3116
- C:\Windows\System\YFRVSEq.exe
  C:\Windows\System\YFRVSEq.exe
  2⤵
  PID:1652
- C:\Windows\System\kGDFfyS.exe
  C:\Windows\System\kGDFfyS.exe
  2⤵
  PID:3400
- C:\Windows\System\jzBmcCR.exe
  C:\Windows\System\jzBmcCR.exe
  2⤵
  PID:3244
- C:\Windows\System\WxnuHIT.exe
  C:\Windows\System\WxnuHIT.exe
  2⤵
  PID:2824
- C:\Windows\System\knLWgdX.exe
  C:\Windows\System\knLWgdX.exe
  2⤵
  PID:3596
- C:\Windows\System\pixkkIr.exe
  C:\Windows\System\pixkkIr.exe
  2⤵
  PID:1600
- C:\Windows\System\LtsKULt.exe
  C:\Windows\System\LtsKULt.exe
  2⤵
  PID:3664
- C:\Windows\System\uKBPIEm.exe
  C:\Windows\System\uKBPIEm.exe
  2⤵
  PID:1720
- C:\Windows\System\VZgGPAD.exe
  C:\Windows\System\VZgGPAD.exe
  2⤵
  PID:376
- C:\Windows\System\zRXYrSb.exe
  C:\Windows\System\zRXYrSb.exe
  2⤵
  PID:1812
- C:\Windows\System\HdWLpIV.exe
  C:\Windows\System\HdWLpIV.exe
  2⤵
  PID:2372
- C:\Windows\System\gZoPsxd.exe
  C:\Windows\System\gZoPsxd.exe
  2⤵
  PID:544
- C:\Windows\System\xCGgRgZ.exe
  C:\Windows\System\xCGgRgZ.exe
  2⤵
  PID:2312
- C:\Windows\System\nFgyWup.exe
  C:\Windows\System\nFgyWup.exe
  2⤵
  PID:2304
- C:\Windows\System\aOMBfhB.exe
  C:\Windows\System\aOMBfhB.exe
  2⤵
  PID:1976
- C:\Windows\System\lZeKWkC.exe
  C:\Windows\System\lZeKWkC.exe
  2⤵
  PID:3804
- C:\Windows\System\PzxHqYx.exe
  C:\Windows\System\PzxHqYx.exe
  2⤵
  PID:3292
- C:\Windows\System\ORGLuNd.exe
  C:\Windows\System\ORGLuNd.exe
  2⤵
  PID:3812
- C:\Windows\System\KcYoDDk.exe
  C:\Windows\System\KcYoDDk.exe
  2⤵
  PID:3756
- C:\Windows\System\GSebBbe.exe
  C:\Windows\System\GSebBbe.exe
  2⤵
  PID:3036
- C:\Windows\System\EWiqeev.exe
  C:\Windows\System\EWiqeev.exe
  2⤵
  PID:3484
- C:\Windows\System\KaUJVCN.exe
  C:\Windows\System\KaUJVCN.exe
  2⤵
  PID:2184
- C:\Windows\System\HxqxnYs.exe
  C:\Windows\System\HxqxnYs.exe
  2⤵
  PID:3060
- C:\Windows\System\aAqtbSE.exe
  C:\Windows\System\aAqtbSE.exe
  2⤵
  PID:3744
- C:\Windows\System\RpYNqNc.exe
  C:\Windows\System\RpYNqNc.exe
  2⤵
  PID:3288
- C:\Windows\System\xlIFMbC.exe
  C:\Windows\System\xlIFMbC.exe
  2⤵
  PID:3480
- C:\Windows\System\EksQhXN.exe
  C:\Windows\System\EksQhXN.exe
  2⤵
  PID:1588
- C:\Windows\System\qmqPETU.exe
  C:\Windows\System\qmqPETU.exe
  2⤵
  PID:1620
- C:\Windows\System\cfEuIoM.exe
  C:\Windows\System\cfEuIoM.exe
  2⤵
  PID:2212
- C:\Windows\System\KJtqSHj.exe
  C:\Windows\System\KJtqSHj.exe
  2⤵
  PID:876
- C:\Windows\System\jeyiZeR.exe
  C:\Windows\System\jeyiZeR.exe
  2⤵
  PID:2976
- C:\Windows\System\MRMBMCy.exe
  C:\Windows\System\MRMBMCy.exe
  2⤵
  PID:3740
- C:\Windows\System\jVMBQpN.exe
  C:\Windows\System\jVMBQpN.exe
  2⤵
  PID:3772
- C:\Windows\System\TsHEaRY.exe
  C:\Windows\System\TsHEaRY.exe
  2⤵
  PID:3788
- C:\Windows\System\LHjPOis.exe
  C:\Windows\System\LHjPOis.exe
  2⤵
  PID:3520
- C:\Windows\System\ycKbtdm.exe
  C:\Windows\System\ycKbtdm.exe
  2⤵
  PID:1540
- C:\Windows\System\boIMIMm.exe
  C:\Windows\System\boIMIMm.exe
  2⤵
  PID:2676
- C:\Windows\System\iVkQzyO.exe
  C:\Windows\System\iVkQzyO.exe
  2⤵
  PID:1428
- C:\Windows\System\JgZupph.exe
  C:\Windows\System\JgZupph.exe
  2⤵
  PID:1404
- C:\Windows\System\HymMmSe.exe
  C:\Windows\System\HymMmSe.exe
  2⤵
  PID:3096
- C:\Windows\System\LBEJkwA.exe
  C:\Windows\System\LBEJkwA.exe
  2⤵
  PID:3696
- C:\Windows\System\ZapoacJ.exe
  C:\Windows\System\ZapoacJ.exe
  2⤵
  PID:3908
- C:\Windows\System\guihwJJ.exe
  C:\Windows\System\guihwJJ.exe
  2⤵
  PID:3980
- C:\Windows\System\KBuZnHS.exe
  C:\Windows\System\KBuZnHS.exe
  2⤵
  PID:2744
- C:\Windows\System\wisevOz.exe
  C:\Windows\System\wisevOz.exe
  2⤵
  PID:3464
- C:\Windows\System\prmyVGb.exe
  C:\Windows\System\prmyVGb.exe
  2⤵
  PID:3536
- C:\Windows\System\dpofMLN.exe
  C:\Windows\System\dpofMLN.exe
  2⤵
  PID:3612
- C:\Windows\System\bglbCDP.exe
  C:\Windows\System\bglbCDP.exe
  2⤵
  PID:848
- C:\Windows\System\iInxLvU.exe
  C:\Windows\System\iInxLvU.exe
  2⤵
  PID:768
- C:\Windows\System\lheTiIa.exe
  C:\Windows\System\lheTiIa.exe
  2⤵
  PID:3956
- C:\Windows\System\fRoNfpl.exe
  C:\Windows\System\fRoNfpl.exe
  2⤵
  PID:3632
- C:\Windows\System\gAnEsxy.exe
  C:\Windows\System\gAnEsxy.exe
  2⤵
  PID:656
- C:\Windows\System\iTWzTNh.exe
  C:\Windows\System\iTWzTNh.exe
  2⤵
  PID:1016
- C:\Windows\System\uRJRukO.exe
  C:\Windows\System\uRJRukO.exe
  2⤵
  PID:2220
- C:\Windows\System\PgUacct.exe
  C:\Windows\System\PgUacct.exe
  2⤵
  PID:2328
- C:\Windows\System\ppyyKHv.exe
  C:\Windows\System\ppyyKHv.exe
  2⤵
  PID:4108
- C:\Windows\System\BignmnS.exe
  C:\Windows\System\BignmnS.exe
  2⤵
  PID:4124
- C:\Windows\System\PkrwpQh.exe
  C:\Windows\System\PkrwpQh.exe
  2⤵
  PID:4144
- C:\Windows\System\lsNGMDe.exe
  C:\Windows\System\lsNGMDe.exe
  2⤵
  PID:4160
- C:\Windows\System\mcZifIu.exe
  C:\Windows\System\mcZifIu.exe
  2⤵
  PID:4176
- C:\Windows\System\xvEvNJp.exe
  C:\Windows\System\xvEvNJp.exe
  2⤵
  PID:4192
- C:\Windows\System\dTneRbN.exe
  C:\Windows\System\dTneRbN.exe
  2⤵
  PID:4208
- C:\Windows\System\HBkIMpb.exe
  C:\Windows\System\HBkIMpb.exe
  2⤵
  PID:4224
- C:\Windows\System\dKnOfYo.exe
  C:\Windows\System\dKnOfYo.exe
  2⤵
  PID:4240
- C:\Windows\System\oQKqRkQ.exe
  C:\Windows\System\oQKqRkQ.exe
  2⤵
  PID:4268
- C:\Windows\System\WkvBlYW.exe
  C:\Windows\System\WkvBlYW.exe
  2⤵
  PID:4284
- C:\Windows\System\oUHRdBu.exe
  C:\Windows\System\oUHRdBu.exe
  2⤵
  PID:4300
- C:\Windows\System\isgqfja.exe
  C:\Windows\System\isgqfja.exe
  2⤵
  PID:4316
- C:\Windows\System\sxEUGGc.exe
  C:\Windows\System\sxEUGGc.exe
  2⤵
  PID:4332
- C:\Windows\System\XwLAeWa.exe
  C:\Windows\System\XwLAeWa.exe
  2⤵
  PID:4352
- C:\Windows\System\ODurKLb.exe
  C:\Windows\System\ODurKLb.exe
  2⤵
  PID:4368
- C:\Windows\System\HTEYViP.exe
  C:\Windows\System\HTEYViP.exe
  2⤵
  PID:4388
- C:\Windows\System\FzWopHb.exe
  C:\Windows\System\FzWopHb.exe
  2⤵
  PID:4404
- C:\Windows\System\wSEgygw.exe
  C:\Windows\System\wSEgygw.exe
  2⤵
  PID:4420
- C:\Windows\System\hewztsP.exe
  C:\Windows\System\hewztsP.exe
  2⤵
  PID:4436
- C:\Windows\System\bigAVYA.exe
  C:\Windows\System\bigAVYA.exe
  2⤵
  PID:4452
- C:\Windows\System\jgPOzeK.exe
  C:\Windows\System\jgPOzeK.exe
  2⤵
  PID:4468
- C:\Windows\System\GTxPzRW.exe
  C:\Windows\System\GTxPzRW.exe
  2⤵
  PID:4484
- C:\Windows\System\rjpQoCh.exe
  C:\Windows\System\rjpQoCh.exe
  2⤵
  PID:4500
- C:\Windows\System\TqgaquM.exe
  C:\Windows\System\TqgaquM.exe
  2⤵
  PID:4516
- C:\Windows\System\WvbNhvZ.exe
  C:\Windows\System\WvbNhvZ.exe
  2⤵
  PID:4532
- C:\Windows\System\EusnRRy.exe
  C:\Windows\System\EusnRRy.exe
  2⤵
  PID:4548
- C:\Windows\System\zVvsgIc.exe
  C:\Windows\System\zVvsgIc.exe
  2⤵
  PID:4564
- C:\Windows\System\uBcJBGT.exe
  C:\Windows\System\uBcJBGT.exe
  2⤵
  PID:4580
- C:\Windows\System\sXLnpvh.exe
  C:\Windows\System\sXLnpvh.exe
  2⤵
  PID:4596
- C:\Windows\System\DJDOrXq.exe
  C:\Windows\System\DJDOrXq.exe
  2⤵
  PID:4612
- C:\Windows\System\lqADsDW.exe
  C:\Windows\System\lqADsDW.exe
  2⤵
  PID:4628
- C:\Windows\System\FykPqPq.exe
  C:\Windows\System\FykPqPq.exe
  2⤵
  PID:4644
- C:\Windows\System\OFwgBlv.exe
  C:\Windows\System\OFwgBlv.exe
  2⤵
  PID:4684
- C:\Windows\System\jLYdItj.exe
  C:\Windows\System\jLYdItj.exe
  2⤵
  PID:4892
- C:\Windows\System\tpCGVYQ.exe
  C:\Windows\System\tpCGVYQ.exe
  2⤵
  PID:4924
- C:\Windows\System\AkikYpf.exe
  C:\Windows\System\AkikYpf.exe
  2⤵
  PID:4940
- C:\Windows\System\fYiRbQs.exe
  C:\Windows\System\fYiRbQs.exe
  2⤵
  PID:4956
- C:\Windows\System\GoIlteD.exe
  C:\Windows\System\GoIlteD.exe
  2⤵
  PID:4972
- C:\Windows\System\WtlURkU.exe
  C:\Windows\System\WtlURkU.exe
  2⤵
  PID:4988
- C:\Windows\System\zCEKWsj.exe
  C:\Windows\System\zCEKWsj.exe
  2⤵
  PID:5004
- C:\Windows\System\HUMnleg.exe
  C:\Windows\System\HUMnleg.exe
  2⤵
  PID:5020
- C:\Windows\System\nfzlDZt.exe
  C:\Windows\System\nfzlDZt.exe
  2⤵
  PID:5036
- C:\Windows\System\iWGMiDL.exe
  C:\Windows\System\iWGMiDL.exe
  2⤵
  PID:5056
- C:\Windows\System\MrnIzCV.exe
  C:\Windows\System\MrnIzCV.exe
  2⤵
  PID:5080
- C:\Windows\System\QlPCkQb.exe
  C:\Windows\System\QlPCkQb.exe
  2⤵
  PID:5112
- C:\Windows\System\pfWFDJu.exe
  C:\Windows\System\pfWFDJu.exe
  2⤵
  PID:2696
- C:\Windows\System\IrhSyBV.exe
  C:\Windows\System\IrhSyBV.exe
  2⤵
  PID:3644
- C:\Windows\System\ugluqip.exe
  C:\Windows\System\ugluqip.exe
  2⤵
  PID:3436
- C:\Windows\System\qZZpCSH.exe
  C:\Windows\System\qZZpCSH.exe
  2⤵
  PID:2872
- C:\Windows\System\eSZTynO.exe
  C:\Windows\System\eSZTynO.exe
  2⤵
  PID:2168
- C:\Windows\System\niSIuNa.exe
  C:\Windows\System\niSIuNa.exe
  2⤵
  PID:1996
- C:\Windows\System\QJoZkqM.exe
  C:\Windows\System\QJoZkqM.exe
  2⤵
  PID:2356
- C:\Windows\System\FxySgii.exe
  C:\Windows\System\FxySgii.exe
  2⤵
  PID:1832
- C:\Windows\System\LTRiiMP.exe
  C:\Windows\System\LTRiiMP.exe
  2⤵
  PID:3920
- C:\Windows\System\sRtecVt.exe
  C:\Windows\System\sRtecVt.exe
  2⤵
  PID:4220
- C:\Windows\System\xsnvomk.exe
  C:\Windows\System\xsnvomk.exe
  2⤵
  PID:4264
- C:\Windows\System\yUhwEsp.exe
  C:\Windows\System\yUhwEsp.exe
  2⤵
  PID:4328
- C:\Windows\System\hIookaB.exe
  C:\Windows\System\hIookaB.exe
  2⤵
  PID:4428
- C:\Windows\System\GbkFQgr.exe
  C:\Windows\System\GbkFQgr.exe
  2⤵
  PID:4464
- C:\Windows\System\mfkqKlU.exe
  C:\Windows\System\mfkqKlU.exe
  2⤵
  PID:1748
- C:\Windows\System\SOZUPLD.exe
  C:\Windows\System\SOZUPLD.exe
  2⤵
  PID:3556
- C:\Windows\System\VMUGaHs.exe
  C:\Windows\System\VMUGaHs.exe
  2⤵
  PID:2540
- C:\Windows\System\BbkjhCq.exe
  C:\Windows\System\BbkjhCq.exe
  2⤵
  PID:3752
- C:\Windows\System\uZwBdbT.exe
  C:\Windows\System\uZwBdbT.exe
  2⤵
  PID:2708
- C:\Windows\System\QbeVauv.exe
  C:\Windows\System\QbeVauv.exe
  2⤵
  PID:4544
- C:\Windows\System\NRRkPWB.exe
  C:\Windows\System\NRRkPWB.exe
  2⤵
  PID:4608
- C:\Windows\System\HziApBl.exe
  C:\Windows\System\HziApBl.exe
  2⤵
  PID:1500
- C:\Windows\System\HnbSIRU.exe
  C:\Windows\System\HnbSIRU.exe
  2⤵
  PID:4104
- C:\Windows\System\mKfLLuS.exe
  C:\Windows\System\mKfLLuS.exe
  2⤵
  PID:4236
- C:\Windows\System\YNksUWQ.exe
  C:\Windows\System\YNksUWQ.exe
  2⤵
  PID:4492
- C:\Windows\System\Twnbmor.exe
  C:\Windows\System\Twnbmor.exe
  2⤵
  PID:4376
- C:\Windows\System\hqnfiaE.exe
  C:\Windows\System\hqnfiaE.exe
  2⤵
  PID:4412
- C:\Windows\System\xzzUcSh.exe
  C:\Windows\System\xzzUcSh.exe
  2⤵
  PID:4448
- C:\Windows\System\AQAMtat.exe
  C:\Windows\System\AQAMtat.exe
  2⤵
  PID:4560
- C:\Windows\System\ZUqnwcf.exe
  C:\Windows\System\ZUqnwcf.exe
  2⤵
  PID:4588
- C:\Windows\System\RfUAQZX.exe
  C:\Windows\System\RfUAQZX.exe
  2⤵
  PID:4732
- C:\Windows\System\GxWqEit.exe
  C:\Windows\System\GxWqEit.exe
  2⤵
  PID:4748
- C:\Windows\System\XfZlsHP.exe
  C:\Windows\System\XfZlsHP.exe
  2⤵
  PID:4764
- C:\Windows\System\xwoOYmS.exe
  C:\Windows\System\xwoOYmS.exe
  2⤵
  PID:4780
- C:\Windows\System\hOIPcnF.exe
  C:\Windows\System\hOIPcnF.exe
  2⤵
  PID:4796
- C:\Windows\System\bwsnvpN.exe
  C:\Windows\System\bwsnvpN.exe
  2⤵
  PID:4820
- C:\Windows\System\JOjHDPh.exe
  C:\Windows\System\JOjHDPh.exe
  2⤵
  PID:4812
- C:\Windows\System\gKvtPho.exe
  C:\Windows\System\gKvtPho.exe
  2⤵
  PID:4832
- C:\Windows\System\JYhrXeR.exe
  C:\Windows\System\JYhrXeR.exe
  2⤵
  PID:4864
- C:\Windows\System\iBlYkzj.exe
  C:\Windows\System\iBlYkzj.exe
  2⤵
  PID:4888
- C:\Windows\System\cExaKyK.exe
  C:\Windows\System\cExaKyK.exe
  2⤵
  PID:4932
- C:\Windows\System\nwFUiFa.exe
  C:\Windows\System\nwFUiFa.exe
  2⤵
  PID:5032
- C:\Windows\System\qdcqFxN.exe
  C:\Windows\System\qdcqFxN.exe
  2⤵
  PID:4920
- C:\Windows\System\PfFBIVj.exe
  C:\Windows\System\PfFBIVj.exe
  2⤵
  PID:4980
- C:\Windows\System\vWHWCmr.exe
  C:\Windows\System\vWHWCmr.exe
  2⤵
  PID:4968
- C:\Windows\System\ZUUOotL.exe
  C:\Windows\System\ZUUOotL.exe
  2⤵
  PID:5052
- C:\Windows\System\IhtIGDB.exe
  C:\Windows\System\IhtIGDB.exe
  2⤵
  PID:5092
- C:\Windows\System\shCgORv.exe
  C:\Windows\System\shCgORv.exe
  2⤵
  PID:5108
- C:\Windows\System\nlStODI.exe
  C:\Windows\System\nlStODI.exe
  2⤵
  PID:2944
- C:\Windows\System\GgaStkR.exe
  C:\Windows\System\GgaStkR.exe
  2⤵
  PID:3228
- C:\Windows\System\xDXsEZX.exe
  C:\Windows\System\xDXsEZX.exe
  2⤵
  PID:1108
- C:\Windows\System\JcoFUoX.exe
  C:\Windows\System\JcoFUoX.exe
  2⤵
  PID:2196
- C:\Windows\System\dXSMYTa.exe
  C:\Windows\System\dXSMYTa.exe
  2⤵
  PID:3176
- C:\Windows\System\PzWbLVm.exe
  C:\Windows\System\PzWbLVm.exe
  2⤵
  PID:1228
- C:\Windows\System\gijjNyQ.exe
  C:\Windows\System\gijjNyQ.exe
  2⤵
  PID:2340
- C:\Windows\System\iYiTNkD.exe
  C:\Windows\System\iYiTNkD.exe
  2⤵
  PID:4156
- C:\Windows\System\EUueJLd.exe
  C:\Windows\System\EUueJLd.exe
  2⤵
  PID:4256
- C:\Windows\System\ghIMsFZ.exe
  C:\Windows\System\ghIMsFZ.exe
  2⤵
  PID:3936
- C:\Windows\System\rmbfHGT.exe
  C:\Windows\System\rmbfHGT.exe
  2⤵
  PID:2688
- C:\Windows\System\ifxOvJJ.exe
  C:\Windows\System\ifxOvJJ.exe
  2⤵
  PID:4652
- C:\Windows\System\Ioayjpu.exe
  C:\Windows\System\Ioayjpu.exe
  2⤵
  PID:4556
- C:\Windows\System\KzWYcES.exe
  C:\Windows\System\KzWYcES.exe
  2⤵
  PID:4636
- C:\Windows\System\ECYCmAz.exe
  C:\Windows\System\ECYCmAz.exe
  2⤵
  PID:4672
- C:\Windows\System\qIEoudk.exe
  C:\Windows\System\qIEoudk.exe
  2⤵
  PID:4680
- C:\Windows\System\TKMiwTw.exe
  C:\Windows\System\TKMiwTw.exe
  2⤵
  PID:4736
- C:\Windows\System\hDpkRGX.exe
  C:\Windows\System\hDpkRGX.exe
  2⤵
  PID:4772
- C:\Windows\System\KYybhhI.exe
  C:\Windows\System\KYybhhI.exe
  2⤵
  PID:4804
- C:\Windows\System\QQgGYXg.exe
  C:\Windows\System\QQgGYXg.exe
  2⤵
  PID:4904
- C:\Windows\System\cVDGlaa.exe
  C:\Windows\System\cVDGlaa.exe
  2⤵
  PID:4824
- C:\Windows\System\GhhqyKw.exe
  C:\Windows\System\GhhqyKw.exe
  2⤵
  PID:4880
- C:\Windows\System\SEySfuz.exe
  C:\Windows\System\SEySfuz.exe
  2⤵
  PID:4912
- C:\Windows\System\uqpxAKZ.exe
  C:\Windows\System\uqpxAKZ.exe
  2⤵
  PID:5088
- C:\Windows\System\tbnLNTK.exe
  C:\Windows\System\tbnLNTK.exe
  2⤵
  PID:3884
- C:\Windows\System\ZqVTgNz.exe
  C:\Windows\System\ZqVTgNz.exe
  2⤵
  PID:5096
- C:\Windows\System\ovtGcJy.exe
  C:\Windows\System\ovtGcJy.exe
  2⤵
  PID:5016
- C:\Windows\System\FkSYimX.exe
  C:\Windows\System\FkSYimX.exe
  2⤵
  PID:4080
- C:\Windows\System\GcYYpIM.exe
  C:\Windows\System\GcYYpIM.exe
  2⤵
  PID:788
- C:\Windows\System\GsFVzgA.exe
  C:\Windows\System\GsFVzgA.exe
  2⤵
  PID:4868
- C:\Windows\System\JHWOVYm.exe
  C:\Windows\System\JHWOVYm.exe
  2⤵
  PID:4460
- C:\Windows\System\TwPARZs.exe
  C:\Windows\System\TwPARZs.exe
  2⤵
  PID:2444
- C:\Windows\System\WszRXIT.exe
  C:\Windows\System\WszRXIT.exe
  2⤵
  PID:4396
- C:\Windows\System\drXRTjE.exe
  C:\Windows\System\drXRTjE.exe
  2⤵
  PID:4540
- C:\Windows\System\MKkAOuB.exe
  C:\Windows\System\MKkAOuB.exe
  2⤵
  PID:4344
- C:\Windows\System\DhQxBTa.exe
  C:\Windows\System\DhQxBTa.exe
  2⤵
  PID:4232
- C:\Windows\System\oYljDgg.exe
  C:\Windows\System\oYljDgg.exe
  2⤵
  PID:4828
- C:\Windows\System\FURBomf.exe
  C:\Windows\System\FURBomf.exe
  2⤵
  PID:4756
- C:\Windows\System\HHJXFUT.exe
  C:\Windows\System\HHJXFUT.exe
  2⤵
  PID:1712
- C:\Windows\System\LWjvAkH.exe
  C:\Windows\System\LWjvAkH.exe
  2⤵
  PID:5048
- C:\Windows\System\SqMjoOh.exe
  C:\Windows\System\SqMjoOh.exe
  2⤵
  PID:3708
- C:\Windows\System\uACzkSt.exe
  C:\Windows\System\uACzkSt.exe
  2⤵
  PID:4508
- C:\Windows\System\lRwKwcY.exe
  C:\Windows\System\lRwKwcY.exe
  2⤵
  PID:3504
- C:\Windows\System\WXLkkWC.exe
  C:\Windows\System\WXLkkWC.exe
  2⤵
  PID:3976
- C:\Windows\System\zqTqJco.exe
  C:\Windows\System\zqTqJco.exe
  2⤵
  PID:2684
- C:\Windows\System\MyrRinM.exe
  C:\Windows\System\MyrRinM.exe
  2⤵
  PID:4604
- C:\Windows\System\PCRrlVZ.exe
  C:\Windows\System\PCRrlVZ.exe
  2⤵
  PID:1964
- C:\Windows\System\QUOjcnG.exe
  C:\Windows\System\QUOjcnG.exe
  2⤵
  PID:4384
- C:\Windows\System\iVXQLpe.exe
  C:\Windows\System\iVXQLpe.exe
  2⤵
  PID:4664
- C:\Windows\System\BSqqWWC.exe
  C:\Windows\System\BSqqWWC.exe
  2⤵
  PID:3984
- C:\Windows\System\PwFSqBt.exe
  C:\Windows\System\PwFSqBt.exe
  2⤵
  PID:4444
- C:\Windows\System\ISuHegY.exe
  C:\Windows\System\ISuHegY.exe
  2⤵
  PID:3356
- C:\Windows\System\zkYYsaG.exe
  C:\Windows\System\zkYYsaG.exe
  2⤵
  PID:4740
- C:\Windows\System\YgUrBlJ.exe
  C:\Windows\System\YgUrBlJ.exe
  2⤵
  PID:3572
- C:\Windows\System\SqRemaP.exe
  C:\Windows\System\SqRemaP.exe
  2⤵
  PID:4728
- C:\Windows\System\pjxNcBA.exe
  C:\Windows\System\pjxNcBA.exe
  2⤵
  PID:904
- C:\Windows\System\ZGVdxNP.exe
  C:\Windows\System\ZGVdxNP.exe
  2⤵
  PID:4432
- C:\Windows\System\SFwyhHt.exe
  C:\Windows\System\SFwyhHt.exe
  2⤵
  PID:5124
- C:\Windows\System\RuCtewu.exe
  C:\Windows\System\RuCtewu.exe
  2⤵
  PID:5144
- C:\Windows\System\nLWiVsu.exe
  C:\Windows\System\nLWiVsu.exe
  2⤵
  PID:5160
- C:\Windows\System\ODzMFOg.exe
  C:\Windows\System\ODzMFOg.exe
  2⤵
  PID:5176
- C:\Windows\System\vJSbuDO.exe
  C:\Windows\System\vJSbuDO.exe
  2⤵
  PID:5192
- C:\Windows\System\VqKsXDo.exe
  C:\Windows\System\VqKsXDo.exe
  2⤵
  PID:5208
- C:\Windows\System\GmaAVyc.exe
  C:\Windows\System\GmaAVyc.exe
  2⤵
  PID:5228
- C:\Windows\System\GoNUZto.exe
  C:\Windows\System\GoNUZto.exe
  2⤵
  PID:5244
- C:\Windows\System\mVjaHDS.exe
  C:\Windows\System\mVjaHDS.exe
  2⤵
  PID:5260
- C:\Windows\System\NyoZtHP.exe
  C:\Windows\System\NyoZtHP.exe
  2⤵
  PID:5284
- C:\Windows\System\ikLAcAc.exe
  C:\Windows\System\ikLAcAc.exe
  2⤵
  PID:5300
- C:\Windows\System\QJAPFZm.exe
  C:\Windows\System\QJAPFZm.exe
  2⤵
  PID:5316
- C:\Windows\System\Wbfggfo.exe
  C:\Windows\System\Wbfggfo.exe
  2⤵
  PID:5332
- C:\Windows\System\bQDbjEK.exe
  C:\Windows\System\bQDbjEK.exe
  2⤵
  PID:5348
- C:\Windows\System\piLTREh.exe
  C:\Windows\System\piLTREh.exe
  2⤵
  PID:5364
- C:\Windows\System\RsIsFew.exe
  C:\Windows\System\RsIsFew.exe
  2⤵
  PID:5380
- C:\Windows\System\cFrZFwP.exe
  C:\Windows\System\cFrZFwP.exe
  2⤵
  PID:5400
- C:\Windows\System\HkbqWoD.exe
  C:\Windows\System\HkbqWoD.exe
  2⤵
  PID:5416
- C:\Windows\System\ofdChyI.exe
  C:\Windows\System\ofdChyI.exe
  2⤵
  PID:5432
- C:\Windows\System\mzNZelq.exe
  C:\Windows\System\mzNZelq.exe
  2⤵
  PID:5452
- C:\Windows\System\GukvxlF.exe
  C:\Windows\System\GukvxlF.exe
  2⤵
  PID:5468
- C:\Windows\System\KBoZSxK.exe
  C:\Windows\System\KBoZSxK.exe
  2⤵
  PID:5484
- C:\Windows\System\MRfsDZE.exe
  C:\Windows\System\MRfsDZE.exe
  2⤵
  PID:5500
- C:\Windows\System\fgCVNqP.exe
  C:\Windows\System\fgCVNqP.exe
  2⤵
  PID:5516
- C:\Windows\System\xCgCwKa.exe
  C:\Windows\System\xCgCwKa.exe
  2⤵
  PID:5532
- C:\Windows\System\WaFTiVr.exe
  C:\Windows\System\WaFTiVr.exe
  2⤵
  PID:5548
- C:\Windows\System\EsocwyS.exe
  C:\Windows\System\EsocwyS.exe
  2⤵
  PID:5564
- C:\Windows\System\eyiXThb.exe
  C:\Windows\System\eyiXThb.exe
  2⤵
  PID:5580
- C:\Windows\System\GScTkeI.exe
  C:\Windows\System\GScTkeI.exe
  2⤵
  PID:5600
- C:\Windows\System\NYYwRto.exe
  C:\Windows\System\NYYwRto.exe
  2⤵
  PID:5616
- C:\Windows\System\kutsLeY.exe
  C:\Windows\System\kutsLeY.exe
  2⤵
  PID:5632
- C:\Windows\System\wvxZgVt.exe
  C:\Windows\System\wvxZgVt.exe
  2⤵
  PID:5648
- C:\Windows\System\hzwlJjj.exe
  C:\Windows\System\hzwlJjj.exe
  2⤵
  PID:5664
- C:\Windows\System\srmFzgK.exe
  C:\Windows\System\srmFzgK.exe
  2⤵
  PID:5680
- C:\Windows\System\upjtBrT.exe
  C:\Windows\System\upjtBrT.exe
  2⤵
  PID:5696
- C:\Windows\System\YnxUMHq.exe
  C:\Windows\System\YnxUMHq.exe
  2⤵
  PID:5720
- C:\Windows\System\DaEUlzo.exe
  C:\Windows\System\DaEUlzo.exe
  2⤵
  PID:5764
- C:\Windows\System\QYvetgn.exe
  C:\Windows\System\QYvetgn.exe
  2⤵
  PID:5780
- C:\Windows\System\UwyDqmK.exe
  C:\Windows\System\UwyDqmK.exe
  2⤵
  PID:5796
- C:\Windows\System\SHlZUjg.exe
  C:\Windows\System\SHlZUjg.exe
  2⤵
  PID:5812
- C:\Windows\System\EvLXBZj.exe
  C:\Windows\System\EvLXBZj.exe
  2⤵
  PID:5828
- C:\Windows\System\zSyuWmI.exe
  C:\Windows\System\zSyuWmI.exe
  2⤵
  PID:5844
- C:\Windows\System\TGpqGaK.exe
  C:\Windows\System\TGpqGaK.exe
  2⤵
  PID:5864
- C:\Windows\System\TRXlmmv.exe
  C:\Windows\System\TRXlmmv.exe
  2⤵
  PID:5880
- C:\Windows\System\sAVNPox.exe
  C:\Windows\System\sAVNPox.exe
  2⤵
  PID:5896
- C:\Windows\System\pzXyHVV.exe
  C:\Windows\System\pzXyHVV.exe
  2⤵
  PID:5912
- C:\Windows\System\NVhBPyP.exe
  C:\Windows\System\NVhBPyP.exe
  2⤵
  PID:5928
- C:\Windows\System\SUPkUgL.exe
  C:\Windows\System\SUPkUgL.exe
  2⤵
  PID:5948
- C:\Windows\System\LYJMnOo.exe
  C:\Windows\System\LYJMnOo.exe
  2⤵
  PID:5964
- C:\Windows\System\mqTBdKw.exe
  C:\Windows\System\mqTBdKw.exe
  2⤵
  PID:5980
- C:\Windows\System\BWjEhoe.exe
  C:\Windows\System\BWjEhoe.exe
  2⤵
  PID:6000
- C:\Windows\System\XbMvaDq.exe
  C:\Windows\System\XbMvaDq.exe
  2⤵
  PID:6016
- C:\Windows\System\KOeGerR.exe
  C:\Windows\System\KOeGerR.exe
  2⤵
  PID:6032
- C:\Windows\System\ztVijSZ.exe
  C:\Windows\System\ztVijSZ.exe
  2⤵
  PID:6052
- C:\Windows\System\jcfDeoq.exe
  C:\Windows\System\jcfDeoq.exe
  2⤵
  PID:6068
- C:\Windows\System\ccwDzJW.exe
  C:\Windows\System\ccwDzJW.exe
  2⤵
  PID:6084
- C:\Windows\System\ZAbnlpI.exe
  C:\Windows\System\ZAbnlpI.exe
  2⤵
  PID:6100
- C:\Windows\System\xzlDjWu.exe
  C:\Windows\System\xzlDjWu.exe
  2⤵
  PID:6116
- C:\Windows\System\EATsBGh.exe
  C:\Windows\System\EATsBGh.exe
  2⤵
  PID:6136
- C:\Windows\System\NvGpOJu.exe
  C:\Windows\System\NvGpOJu.exe
  2⤵
  PID:5064
- C:\Windows\System\kkiQpqW.exe
  C:\Windows\System\kkiQpqW.exe
  2⤵
  PID:5028
- C:\Windows\System\VMQjZMf.exe
  C:\Windows\System\VMQjZMf.exe
  2⤵
  PID:3784
- C:\Windows\System\VbGpuHU.exe
  C:\Windows\System\VbGpuHU.exe
  2⤵
  PID:4152
- C:\Windows\System\wcpKcuR.exe
  C:\Windows\System\wcpKcuR.exe
  2⤵
  PID:4524
- C:\Windows\System\Hiwkkiq.exe
  C:\Windows\System\Hiwkkiq.exe
  2⤵
  PID:4720
- C:\Windows\System\tqdCrDX.exe
  C:\Windows\System\tqdCrDX.exe
  2⤵
  PID:5172
- C:\Windows\System\OIzjCqD.exe
  C:\Windows\System\OIzjCqD.exe
  2⤵
  PID:5280
- C:\Windows\System\WHRNsew.exe
  C:\Windows\System\WHRNsew.exe
  2⤵
  PID:5272
- C:\Windows\System\iFCwTEY.exe
  C:\Windows\System\iFCwTEY.exe
  2⤵
  PID:5156
- C:\Windows\System\luvJhkG.exe
  C:\Windows\System\luvJhkG.exe
  2⤵
  PID:5216
- C:\Windows\System\zFsuscB.exe
  C:\Windows\System\zFsuscB.exe
  2⤵
  PID:5372
- C:\Windows\System\LEXRxBm.exe
  C:\Windows\System\LEXRxBm.exe
  2⤵
  PID:5392
- C:\Windows\System\ITEshcE.exe
  C:\Windows\System\ITEshcE.exe
  2⤵
  PID:5328
- C:\Windows\System\ynzkwYU.exe
  C:\Windows\System\ynzkwYU.exe
  2⤵
  PID:5428
- C:\Windows\System\GAmvxOI.exe
  C:\Windows\System\GAmvxOI.exe
  2⤵
  PID:5496
- C:\Windows\System\gihxiPN.exe
  C:\Windows\System\gihxiPN.exe
  2⤵
  PID:5560
- C:\Windows\System\JaeXgoN.exe
  C:\Windows\System\JaeXgoN.exe
  2⤵
  PID:5624
- C:\Windows\System\ROmUdYr.exe
  C:\Windows\System\ROmUdYr.exe
  2⤵
  PID:5688
- C:\Windows\System\RdyjsgI.exe
  C:\Windows\System\RdyjsgI.exe
  2⤵
  PID:5736
- C:\Windows\System\RoKrhoN.exe
  C:\Windows\System\RoKrhoN.exe
  2⤵
  PID:5740
- C:\Windows\System\PRNayNj.exe
  C:\Windows\System\PRNayNj.exe
  2⤵
  PID:5480
- C:\Windows\System\lgExoOK.exe
  C:\Windows\System\lgExoOK.exe
  2⤵
  PID:5544
- C:\Windows\System\QylDIVY.exe
  C:\Windows\System\QylDIVY.exe
  2⤵
  PID:5748
- C:\Windows\System\oFHMjSv.exe
  C:\Windows\System\oFHMjSv.exe
  2⤵
  PID:5672
- C:\Windows\System\oLvNVPj.exe
  C:\Windows\System\oLvNVPj.exe
  2⤵
  PID:5716
- C:\Windows\System\McjaSEq.exe
  C:\Windows\System\McjaSEq.exe
  2⤵
  PID:5732
- C:\Windows\System\jwTsniU.exe
  C:\Windows\System\jwTsniU.exe
  2⤵
  PID:5824
- C:\Windows\System\SffJrDc.exe
  C:\Windows\System\SffJrDc.exe
  2⤵
  PID:5888
- C:\Windows\System\QqPaXsv.exe
  C:\Windows\System\QqPaXsv.exe
  2⤵
  PID:5956
- C:\Windows\System\TfdGiJV.exe
  C:\Windows\System\TfdGiJV.exe
  2⤵
  PID:5992
- C:\Windows\System\nILkvCh.exe
  C:\Windows\System\nILkvCh.exe
  2⤵
  PID:5936
- C:\Windows\System\hFzDjIH.exe
  C:\Windows\System\hFzDjIH.exe
  2⤵
  PID:6024
- C:\Windows\System\GhOAODp.exe
  C:\Windows\System\GhOAODp.exe
  2⤵
  PID:5840
- C:\Windows\System\sAxgZOP.exe
  C:\Windows\System\sAxgZOP.exe
  2⤵
  PID:5944
- C:\Windows\System\uvUdxmu.exe
  C:\Windows\System\uvUdxmu.exe
  2⤵
  PID:6044
- C:\Windows\System\XLSYYBT.exe
  C:\Windows\System\XLSYYBT.exe
  2⤵
  PID:4724
- C:\Windows\System\jAPkqrI.exe
  C:\Windows\System\jAPkqrI.exe
  2⤵
  PID:6096
- C:\Windows\System\wWAqdPj.exe
  C:\Windows\System\wWAqdPj.exe
  2⤵
  PID:4004
- C:\Windows\System\yNYYcGF.exe
  C:\Windows\System\yNYYcGF.exe
  2⤵
  PID:4876
- C:\Windows\System\qYwuZBM.exe
  C:\Windows\System\qYwuZBM.exe
  2⤵
  PID:5240
- C:\Windows\System\EnROBuI.exe
  C:\Windows\System\EnROBuI.exe
  2⤵
  PID:5252
- C:\Windows\System\ZgLwNjh.exe
  C:\Windows\System\ZgLwNjh.exe
  2⤵
  PID:5044
- C:\Windows\System\rlHdysj.exe
  C:\Windows\System\rlHdysj.exe
  2⤵
  PID:5464
- C:\Windows\System\RDbOrQa.exe
  C:\Windows\System\RDbOrQa.exe
  2⤵
  PID:5448
- C:\Windows\System\izJTblt.exe
  C:\Windows\System\izJTblt.exe
  2⤵
  PID:5292
- C:\Windows\System\iASvoKO.exe
  C:\Windows\System\iASvoKO.exe
  2⤵
  PID:5140
- C:\Windows\System\foGHbkZ.exe
  C:\Windows\System\foGHbkZ.exe
  2⤵
  PID:5424
- C:\Windows\System\nQTCwoW.exe
  C:\Windows\System\nQTCwoW.exe
  2⤵
  PID:5444
- C:\Windows\System\sZHIwFC.exe
  C:\Windows\System\sZHIwFC.exe
  2⤵
  PID:5476
- C:\Windows\System\HDclWpc.exe
  C:\Windows\System\HDclWpc.exe
  2⤵
  PID:5708
- C:\Windows\System\naNGCoP.exe
  C:\Windows\System\naNGCoP.exe
  2⤵
  PID:5920
- C:\Windows\System\yaXRxFn.exe
  C:\Windows\System\yaXRxFn.exe
  2⤵
  PID:5872
- C:\Windows\System\HgnfHkx.exe
  C:\Windows\System\HgnfHkx.exe
  2⤵
  PID:5988
- C:\Windows\System\HBfgQoD.exe
  C:\Windows\System\HBfgQoD.exe
  2⤵
  PID:5904
- C:\Windows\System\WGrirZv.exe
  C:\Windows\System\WGrirZv.exe
  2⤵
  PID:5168
- C:\Windows\System\nJuEPVo.exe
  C:\Windows\System\nJuEPVo.exe
  2⤵
  PID:6128
- C:\Windows\System\iYiKtCB.exe
  C:\Windows\System\iYiKtCB.exe
  2⤵
  PID:5152
- C:\Windows\System\uFIPWuS.exe
  C:\Windows\System\uFIPWuS.exe
  2⤵
  PID:5276
- C:\Windows\System\aKTyTFO.exe
  C:\Windows\System\aKTyTFO.exe
  2⤵
  PID:5412
- C:\Windows\System\oTpvToE.exe
  C:\Windows\System\oTpvToE.exe
  2⤵
  PID:5820
- C:\Windows\System\HigClOM.exe
  C:\Windows\System\HigClOM.exe
  2⤵
  PID:5856
- C:\Windows\System\RZlAOQG.exe
  C:\Windows\System\RZlAOQG.exe
  2⤵
  PID:6080
- C:\Windows\System\qdbqaqn.exe
  C:\Windows\System\qdbqaqn.exe
  2⤵
  PID:6064
- C:\Windows\System\FRmpotx.exe
  C:\Windows\System\FRmpotx.exe
  2⤵
  PID:5592
- C:\Windows\System\dmOILnq.exe
  C:\Windows\System\dmOILnq.exe
  2⤵
  PID:4656
- C:\Windows\System\biEZlco.exe
  C:\Windows\System\biEZlco.exe
  2⤵
  PID:5712
- C:\Windows\System\iCdBXSU.exe
  C:\Windows\System\iCdBXSU.exe
  2⤵
  PID:6012
- C:\Windows\System\CikswpO.exe
  C:\Windows\System\CikswpO.exe
  2⤵
  PID:6112
- C:\Windows\System\LXrEvnk.exe
  C:\Windows\System\LXrEvnk.exe
  2⤵
  PID:5804
- C:\Windows\System\aHObBGH.exe
  C:\Windows\System\aHObBGH.exe
  2⤵
  PID:5556
- C:\Windows\System\PVzKzuR.exe
  C:\Windows\System\PVzKzuR.exe
  2⤵
  PID:5360
- C:\Windows\System\PNJxlHE.exe
  C:\Windows\System\PNJxlHE.exe
  2⤵
  PID:6148
- C:\Windows\System\ivgHfGS.exe
  C:\Windows\System\ivgHfGS.exe
  2⤵
  PID:6164
- C:\Windows\System\zKvLYEs.exe
  C:\Windows\System\zKvLYEs.exe
  2⤵
  PID:6184
- C:\Windows\System\mOnoluy.exe
  C:\Windows\System\mOnoluy.exe
  2⤵
  PID:6200
- C:\Windows\System\fUhuVXZ.exe
  C:\Windows\System\fUhuVXZ.exe
  2⤵
  PID:6216
- C:\Windows\System\xJhicQs.exe
  C:\Windows\System\xJhicQs.exe
  2⤵
  PID:6236
- C:\Windows\System\bqLHemf.exe
  C:\Windows\System\bqLHemf.exe
  2⤵
  PID:6252
- C:\Windows\System\xsJHzLd.exe
  C:\Windows\System\xsJHzLd.exe
  2⤵
  PID:6296
- C:\Windows\System\ksPNpJD.exe
  C:\Windows\System\ksPNpJD.exe
  2⤵
  PID:6332
- C:\Windows\System\BurmmCz.exe
  C:\Windows\System\BurmmCz.exe
  2⤵
  PID:6348
- C:\Windows\System\qgdqcTo.exe
  C:\Windows\System\qgdqcTo.exe
  2⤵
  PID:6364
- C:\Windows\System\irqadgO.exe
  C:\Windows\System\irqadgO.exe
  2⤵
  PID:6380
- C:\Windows\System\QgLfLLI.exe
  C:\Windows\System\QgLfLLI.exe
  2⤵
  PID:6400
- C:\Windows\System\sKXdIQJ.exe
  C:\Windows\System\sKXdIQJ.exe
  2⤵
  PID:6416
- C:\Windows\System\aaIqAEN.exe
  C:\Windows\System\aaIqAEN.exe
  2⤵
  PID:6436
- C:\Windows\System\fqUpAvG.exe
  C:\Windows\System\fqUpAvG.exe
  2⤵
  PID:6452
- C:\Windows\System\OoeauuW.exe
  C:\Windows\System\OoeauuW.exe
  2⤵
  PID:6468
- C:\Windows\System\xyADDkZ.exe
  C:\Windows\System\xyADDkZ.exe
  2⤵
  PID:6484
- C:\Windows\System\EsfTnVN.exe
  C:\Windows\System\EsfTnVN.exe
  2⤵
  PID:6500
- C:\Windows\System\PSNCuzL.exe
  C:\Windows\System\PSNCuzL.exe
  2⤵
  PID:6516
- C:\Windows\System\sKUqiLn.exe
  C:\Windows\System\sKUqiLn.exe
  2⤵
  PID:6532
- C:\Windows\System\KuBrzoO.exe
  C:\Windows\System\KuBrzoO.exe
  2⤵
  PID:6548
- C:\Windows\System\BFfttJr.exe
  C:\Windows\System\BFfttJr.exe
  2⤵
  PID:6564
- C:\Windows\System\wkpRsRD.exe
  C:\Windows\System\wkpRsRD.exe
  2⤵
  PID:6580
- C:\Windows\System\omCLybG.exe
  C:\Windows\System\omCLybG.exe
  2⤵
  PID:6596
- C:\Windows\System\LOdLCsV.exe
  C:\Windows\System\LOdLCsV.exe
  2⤵
  PID:6612
- C:\Windows\System\JMCwtVf.exe
  C:\Windows\System\JMCwtVf.exe
  2⤵
  PID:6632
- C:\Windows\System\xLEWNuk.exe
  C:\Windows\System\xLEWNuk.exe
  2⤵
  PID:6648
- C:\Windows\System\YbfhFjK.exe
  C:\Windows\System\YbfhFjK.exe
  2⤵
  PID:6664
- C:\Windows\System\oWCAwWT.exe
  C:\Windows\System\oWCAwWT.exe
  2⤵
  PID:6684
- C:\Windows\System\heUmFyP.exe
  C:\Windows\System\heUmFyP.exe
  2⤵
  PID:6700
- C:\Windows\System\xqwTgjc.exe
  C:\Windows\System\xqwTgjc.exe
  2⤵
  PID:6716
- C:\Windows\System\JbVcSoC.exe
  C:\Windows\System\JbVcSoC.exe
  2⤵
  PID:6732
- C:\Windows\System\KVQLQiE.exe
  C:\Windows\System\KVQLQiE.exe
  2⤵
  PID:6748
- C:\Windows\System\FQPHenB.exe
  C:\Windows\System\FQPHenB.exe
  2⤵
  PID:6776
- C:\Windows\System\xqlvkiD.exe
  C:\Windows\System\xqlvkiD.exe
  2⤵
  PID:6792
- C:\Windows\System\evlAFni.exe
  C:\Windows\System\evlAFni.exe
  2⤵
  PID:6808
- C:\Windows\System\yDQkDUI.exe
  C:\Windows\System\yDQkDUI.exe
  2⤵
  PID:6824
- C:\Windows\System\SUHDCGM.exe
  C:\Windows\System\SUHDCGM.exe
  2⤵
  PID:6840
- C:\Windows\System\ReDWovg.exe
  C:\Windows\System\ReDWovg.exe
  2⤵
  PID:6856
- C:\Windows\System\QOwHEbZ.exe
  C:\Windows\System\QOwHEbZ.exe
  2⤵
  PID:6872
- C:\Windows\System\ABaePvH.exe
  C:\Windows\System\ABaePvH.exe
  2⤵
  PID:6888
- C:\Windows\System\yDdmVOE.exe
  C:\Windows\System\yDdmVOE.exe
  2⤵
  PID:6904
- C:\Windows\System\CherSDD.exe
  C:\Windows\System\CherSDD.exe
  2⤵
  PID:6920
- C:\Windows\System\zNOsKzw.exe
  C:\Windows\System\zNOsKzw.exe
  2⤵
  PID:6936
- C:\Windows\System\mZUizIn.exe
  C:\Windows\System\mZUizIn.exe
  2⤵
  PID:6952
- C:\Windows\System\amZVGui.exe
  C:\Windows\System\amZVGui.exe
  2⤵
  PID:6968
- C:\Windows\System\PyChBDS.exe
  C:\Windows\System\PyChBDS.exe
  2⤵
  PID:6984
- C:\Windows\System\kdOjysS.exe
  C:\Windows\System\kdOjysS.exe
  2⤵
  PID:7000
- C:\Windows\System\awQNDac.exe
  C:\Windows\System\awQNDac.exe
  2⤵
  PID:7016
- C:\Windows\System\DYzGthV.exe
  C:\Windows\System\DYzGthV.exe
  2⤵
  PID:7032
- C:\Windows\System\ybnIfip.exe
  C:\Windows\System\ybnIfip.exe
  2⤵
  PID:7048
- C:\Windows\System\jiWFUFf.exe
  C:\Windows\System\jiWFUFf.exe
  2⤵
  PID:7064
- C:\Windows\System\gIoBONh.exe
  C:\Windows\System\gIoBONh.exe
  2⤵
  PID:7080
- C:\Windows\System\BoUIkSF.exe
  C:\Windows\System\BoUIkSF.exe
  2⤵
  PID:7096
- C:\Windows\System\TTchOcw.exe
  C:\Windows\System\TTchOcw.exe
  2⤵
  PID:7112
- C:\Windows\System\UBrEkwV.exe
  C:\Windows\System\UBrEkwV.exe
  2⤵
  PID:7128
- C:\Windows\System\yKUXxzO.exe
  C:\Windows\System\yKUXxzO.exe
  2⤵
  PID:7144
- C:\Windows\System\bIycNef.exe
  C:\Windows\System\bIycNef.exe
  2⤵
  PID:7160
- C:\Windows\System\Piufios.exe
  C:\Windows\System\Piufios.exe
  2⤵
  PID:5072
- C:\Windows\System\agfPxes.exe
  C:\Windows\System\agfPxes.exe
  2⤵
  PID:6160
- C:\Windows\System\xcxlIXQ.exe
  C:\Windows\System\xcxlIXQ.exe
  2⤵
  PID:6228
- C:\Windows\System\DXVjTJb.exe
  C:\Windows\System\DXVjTJb.exe
  2⤵
  PID:5996
- C:\Windows\System\vBrPloV.exe
  C:\Windows\System\vBrPloV.exe
  2⤵
  PID:5644
- C:\Windows\System\whyQIHj.exe
  C:\Windows\System\whyQIHj.exe
  2⤵
  PID:6176
- C:\Windows\System\GSHypDT.exe
  C:\Windows\System\GSHypDT.exe
  2⤵
  PID:6244
- C:\Windows\System\wHrDPpV.exe
  C:\Windows\System\wHrDPpV.exe
  2⤵
  PID:6268
- C:\Windows\System\JZcRUke.exe
  C:\Windows\System\JZcRUke.exe
  2⤵
  PID:6284
- C:\Windows\System\CsTJnfi.exe
  C:\Windows\System\CsTJnfi.exe
  2⤵
  PID:6344
- C:\Windows\System\UnVCcZG.exe
  C:\Windows\System\UnVCcZG.exe
  2⤵
  PID:6412
- C:\Windows\System\ZDlQjkL.exe
  C:\Windows\System\ZDlQjkL.exe
  2⤵
  PID:6316
- C:\Windows\System\HUDlIBP.exe
  C:\Windows\System\HUDlIBP.exe
  2⤵
  PID:6392
- C:\Windows\System\FRrNnsy.exe
  C:\Windows\System\FRrNnsy.exe
  2⤵
  PID:6480
- C:\Windows\System\uttIbof.exe
  C:\Windows\System\uttIbof.exe
  2⤵
  PID:6544
- C:\Windows\System\ZioxMYE.exe
  C:\Windows\System\ZioxMYE.exe
  2⤵
  PID:6356
- C:\Windows\System\IkIcRwj.exe
  C:\Windows\System\IkIcRwj.exe
  2⤵
  PID:6528
- C:\Windows\System\NErcpxM.exe
  C:\Windows\System\NErcpxM.exe
  2⤵
  PID:6608
- C:\Windows\System\saQhPFI.exe
  C:\Windows\System\saQhPFI.exe
  2⤵
  PID:6640
- C:\Windows\System\xmhjUSQ.exe
  C:\Windows\System\xmhjUSQ.exe
  2⤵
  PID:6620
- C:\Windows\System\FerFIXS.exe
  C:\Windows\System\FerFIXS.exe
  2⤵
  PID:6556
- C:\Windows\System\GCHPBDS.exe
  C:\Windows\System\GCHPBDS.exe
  2⤵
  PID:6680
- C:\Windows\System\AHbDQuX.exe
  C:\Windows\System\AHbDQuX.exe
  2⤵
  PID:6712
- C:\Windows\System\jjyqAAl.exe
  C:\Windows\System\jjyqAAl.exe
  2⤵
  PID:6724
- C:\Windows\System\fqdknsL.exe
  C:\Windows\System\fqdknsL.exe
  2⤵
  PID:6696
- C:\Windows\System\oBAwBVj.exe
  C:\Windows\System\oBAwBVj.exe
  2⤵
  PID:6784
- C:\Windows\System\SCkkoSm.exe
  C:\Windows\System\SCkkoSm.exe
  2⤵
  PID:6848
- C:\Windows\System\vmeGiRA.exe
  C:\Windows\System\vmeGiRA.exe
  2⤵
  PID:6912
- C:\Windows\System\UEXKJja.exe
  C:\Windows\System\UEXKJja.exe
  2⤵
  PID:6976
- C:\Windows\System\htKajjl.exe
  C:\Windows\System\htKajjl.exe
  2⤵
  PID:6768
- C:\Windows\System\hmFacZV.exe
  C:\Windows\System\hmFacZV.exe
  2⤵
  PID:7044
- C:\Windows\System\RlTqyaJ.exe
  C:\Windows\System\RlTqyaJ.exe
  2⤵
  PID:6832
- C:\Windows\System\tUlaHrp.exe
  C:\Windows\System\tUlaHrp.exe
  2⤵
  PID:6928
- C:\Windows\System\cXAKukL.exe
  C:\Windows\System\cXAKukL.exe
  2⤵
  PID:6992
- C:\Windows\System\AHMJriM.exe
  C:\Windows\System\AHMJriM.exe
  2⤵
  PID:7056
- C:\Windows\System\rhtubNC.exe
  C:\Windows\System\rhtubNC.exe
  2⤵
  PID:7072
- C:\Windows\System\KnsYciB.exe
  C:\Windows\System\KnsYciB.exe
  2⤵
  PID:7136
- C:\Windows\System\cMnpheE.exe
  C:\Windows\System\cMnpheE.exe
  2⤵
  PID:6196
- C:\Windows\System\VqcoSCM.exe
  C:\Windows\System\VqcoSCM.exe
  2⤵
  PID:6224
- C:\Windows\System\jRHTYam.exe
  C:\Windows\System\jRHTYam.exe
  2⤵
  PID:6212
- C:\Windows\System\xIFDBcv.exe
  C:\Windows\System\xIFDBcv.exe
  2⤵
  PID:6156
- C:\Windows\System\OrDIVUM.exe
  C:\Windows\System\OrDIVUM.exe
  2⤵
  PID:6396
- C:\Windows\System\FrqaTIg.exe
  C:\Windows\System\FrqaTIg.exe
  2⤵
  PID:6576
- C:\Windows\System\CWeGtaZ.exe
  C:\Windows\System\CWeGtaZ.exe
  2⤵
  PID:6464
- C:\Windows\System\qAPaXpe.exe
  C:\Windows\System\qAPaXpe.exe
  2⤵
  PID:6324
- C:\Windows\System\FJaibtP.exe
  C:\Windows\System\FJaibtP.exe
  2⤵
  PID:6760
- C:\Windows\System\pnfglhM.exe
  C:\Windows\System\pnfglhM.exe
  2⤵
  PID:6944
- C:\Windows\System\xgKcBGv.exe
  C:\Windows\System\xgKcBGv.exe
  2⤵
  PID:5640
- C:\Windows\System\yWJbOBi.exe
  C:\Windows\System\yWJbOBi.exe
  2⤵
  PID:6800
- C:\Windows\System\wvknlUP.exe
  C:\Windows\System\wvknlUP.exe
  2⤵
  PID:6764
- C:\Windows\System\XFOTUWv.exe
  C:\Windows\System\XFOTUWv.exe
  2⤵
  PID:7008
- C:\Windows\System\INJpisw.exe
  C:\Windows\System\INJpisw.exe
  2⤵
  PID:6676
- C:\Windows\System\RGlxPIK.exe
  C:\Windows\System\RGlxPIK.exe
  2⤵
  PID:7104
- C:\Windows\System\KMMCXTr.exe
  C:\Windows\System\KMMCXTr.exe
  2⤵
  PID:6880
- C:\Windows\System\rfkzbdw.exe
  C:\Windows\System\rfkzbdw.exe
  2⤵
  PID:6672
- C:\Windows\System\vIuVkpi.exe
  C:\Windows\System\vIuVkpi.exe
  2⤵
  PID:7088
- C:\Windows\System\HiuKKjg.exe
  C:\Windows\System\HiuKKjg.exe
  2⤵
  PID:6512
- C:\Windows\System\gdSfGTw.exe
  C:\Windows\System\gdSfGTw.exe
  2⤵
  PID:6496
- C:\Windows\System\PKUVfqY.exe
  C:\Windows\System\PKUVfqY.exe
  2⤵
  PID:5792
- C:\Windows\System\JWUnAsp.exe
  C:\Windows\System\JWUnAsp.exe
  2⤵
  PID:7092
- C:\Windows\System\eyUpUlt.exe
  C:\Windows\System\eyUpUlt.exe
  2⤵
  PID:6208
- C:\Windows\System\hHKHXbE.exe
  C:\Windows\System\hHKHXbE.exe
  2⤵
  PID:6900
- C:\Windows\System\QIMpUQZ.exe
  C:\Windows\System\QIMpUQZ.exe
  2⤵
  PID:6592
- C:\Windows\System\CaFwmaE.exe
  C:\Windows\System\CaFwmaE.exe
  2⤵
  PID:6628
- C:\Windows\System\NdZQkOT.exe
  C:\Windows\System\NdZQkOT.exe
  2⤵
  PID:6896
- C:\Windows\System\RTxXSxT.exe
  C:\Windows\System\RTxXSxT.exe
  2⤵
  PID:6232
- C:\Windows\System\yeYqJtd.exe
  C:\Windows\System\yeYqJtd.exe
  2⤵
  PID:6604
- C:\Windows\System\FNJijtW.exe
  C:\Windows\System\FNJijtW.exe
  2⤵
  PID:6692
- C:\Windows\System\SCjkYhD.exe
  C:\Windows\System\SCjkYhD.exe
  2⤵
  PID:6460
- C:\Windows\System\ybVfLsP.exe
  C:\Windows\System\ybVfLsP.exe
  2⤵
  PID:7176
- C:\Windows\System\zAYkuVx.exe
  C:\Windows\System\zAYkuVx.exe
  2⤵
  PID:7192
- C:\Windows\System\UjDPjhT.exe
  C:\Windows\System\UjDPjhT.exe
  2⤵
  PID:7208
- C:\Windows\System\JqrtySO.exe
  C:\Windows\System\JqrtySO.exe
  2⤵
  PID:7224
- C:\Windows\System\vkAJkRc.exe
  C:\Windows\System\vkAJkRc.exe
  2⤵
  PID:7240
- C:\Windows\System\mVRCoRu.exe
  C:\Windows\System\mVRCoRu.exe
  2⤵
  PID:7256
- C:\Windows\System\wWVdGGe.exe
  C:\Windows\System\wWVdGGe.exe
  2⤵
  PID:7272
- C:\Windows\System\zstnDKY.exe
  C:\Windows\System\zstnDKY.exe
  2⤵
  PID:7288
- C:\Windows\System\vrRYDOX.exe
  C:\Windows\System\vrRYDOX.exe
  2⤵
  PID:7304
- C:\Windows\System\vuJpbqo.exe
  C:\Windows\System\vuJpbqo.exe
  2⤵
  PID:7324
- C:\Windows\System\mQWSUqN.exe
  C:\Windows\System\mQWSUqN.exe
  2⤵
  PID:7340
- C:\Windows\System\yekCsdI.exe
  C:\Windows\System\yekCsdI.exe
  2⤵
  PID:7356
- C:\Windows\System\UNAKPlG.exe
  C:\Windows\System\UNAKPlG.exe
  2⤵
  PID:7376
- C:\Windows\System\PCVemIt.exe
  C:\Windows\System\PCVemIt.exe
  2⤵
  PID:7392
- C:\Windows\System\EIDDZcv.exe
  C:\Windows\System\EIDDZcv.exe
  2⤵
  PID:7408
- C:\Windows\System\lKqppUv.exe
  C:\Windows\System\lKqppUv.exe
  2⤵
  PID:7424
- C:\Windows\System\GhxThsZ.exe
  C:\Windows\System\GhxThsZ.exe
  2⤵
  PID:7440
- C:\Windows\System\XDLfkcw.exe
  C:\Windows\System\XDLfkcw.exe
  2⤵
  PID:7456
- C:\Windows\System\sHMiemi.exe
  C:\Windows\System\sHMiemi.exe
  2⤵
  PID:7472
- C:\Windows\System\cTmxvBO.exe
  C:\Windows\System\cTmxvBO.exe
  2⤵
  PID:7488
- C:\Windows\System\vowPRRN.exe
  C:\Windows\System\vowPRRN.exe
  2⤵
  PID:7504
- C:\Windows\System\xfZrOCg.exe
  C:\Windows\System\xfZrOCg.exe
  2⤵
  PID:7524
- C:\Windows\System\GtTLKFx.exe
  C:\Windows\System\GtTLKFx.exe
  2⤵
  PID:7540
- C:\Windows\System\rIxhDaX.exe
  C:\Windows\System\rIxhDaX.exe
  2⤵
  PID:7556
- C:\Windows\System\xKQoHic.exe
  C:\Windows\System\xKQoHic.exe
  2⤵
  PID:7572
- C:\Windows\System\PDcYJyw.exe
  C:\Windows\System\PDcYJyw.exe
  2⤵
  PID:7588
- C:\Windows\System\PRHYLec.exe
  C:\Windows\System\PRHYLec.exe
  2⤵
  PID:7604
- C:\Windows\System\dYkNpfu.exe
  C:\Windows\System\dYkNpfu.exe
  2⤵
  PID:7620
- C:\Windows\System\ezANzeh.exe
  C:\Windows\System\ezANzeh.exe
  2⤵
  PID:7636
- C:\Windows\System\KRWseli.exe
  C:\Windows\System\KRWseli.exe
  2⤵
  PID:7652
- C:\Windows\System\VawdREq.exe
  C:\Windows\System\VawdREq.exe
  2⤵
  PID:7668
- C:\Windows\System\GgMmhcE.exe
  C:\Windows\System\GgMmhcE.exe
  2⤵
  PID:7684
- C:\Windows\System\YTrhiBl.exe
  C:\Windows\System\YTrhiBl.exe
  2⤵
  PID:7700
- C:\Windows\System\cVRHSxj.exe
  C:\Windows\System\cVRHSxj.exe
  2⤵
  PID:7716
- C:\Windows\System\cuzIaXJ.exe
  C:\Windows\System\cuzIaXJ.exe
  2⤵
  PID:7732
- C:\Windows\System\BEHbYDv.exe
  C:\Windows\System\BEHbYDv.exe
  2⤵
  PID:7748
- C:\Windows\System\IvkoFbj.exe
  C:\Windows\System\IvkoFbj.exe
  2⤵
  PID:7764
- C:\Windows\System\ebQSrra.exe
  C:\Windows\System\ebQSrra.exe
  2⤵
  PID:7780
- C:\Windows\System\vLKxwKi.exe
  C:\Windows\System\vLKxwKi.exe
  2⤵
  PID:7796
- C:\Windows\System\VnLkiRN.exe
  C:\Windows\System\VnLkiRN.exe
  2⤵
  PID:7812
- C:\Windows\System\TzXJdwA.exe
  C:\Windows\System\TzXJdwA.exe
  2⤵
  PID:7828
- C:\Windows\System\jfGsijM.exe
  C:\Windows\System\jfGsijM.exe
  2⤵
  PID:7844
- C:\Windows\System\qMGzZgv.exe
  C:\Windows\System\qMGzZgv.exe
  2⤵
  PID:7860
- C:\Windows\System\XquacYx.exe
  C:\Windows\System\XquacYx.exe
  2⤵
  PID:7876
- C:\Windows\System\PZSwgbU.exe
  C:\Windows\System\PZSwgbU.exe
  2⤵
  PID:7892
- C:\Windows\System\TObEJiR.exe
  C:\Windows\System\TObEJiR.exe
  2⤵
  PID:7908
- C:\Windows\System\YbONJbX.exe
  C:\Windows\System\YbONJbX.exe
  2⤵
  PID:7924
- C:\Windows\System\jmrSKXA.exe
  C:\Windows\System\jmrSKXA.exe
  2⤵
  PID:7940
- C:\Windows\System\AtTsLGg.exe
  C:\Windows\System\AtTsLGg.exe
  2⤵
  PID:7996
- C:\Windows\System\MPtQqpT.exe
  C:\Windows\System\MPtQqpT.exe
  2⤵
  PID:8012
- C:\Windows\System\yoANhrI.exe
  C:\Windows\System\yoANhrI.exe
  2⤵
  PID:8028
- C:\Windows\System\ofmiXwj.exe
  C:\Windows\System\ofmiXwj.exe
  2⤵
  PID:8044
- C:\Windows\System\YoyHcor.exe
  C:\Windows\System\YoyHcor.exe
  2⤵
  PID:8060
- C:\Windows\System\iksDdyF.exe
  C:\Windows\System\iksDdyF.exe
  2⤵
  PID:8076
- C:\Windows\System\aiehDDf.exe
  C:\Windows\System\aiehDDf.exe
  2⤵
  PID:8092
- C:\Windows\System\MgADmPp.exe
  C:\Windows\System\MgADmPp.exe
  2⤵
  PID:8112
- C:\Windows\System\ukLIUHC.exe
  C:\Windows\System\ukLIUHC.exe
  2⤵
  PID:8128
- C:\Windows\System\LlpuniN.exe
  C:\Windows\System\LlpuniN.exe
  2⤵
  PID:8144
- C:\Windows\System\IhneoJe.exe
  C:\Windows\System\IhneoJe.exe
  2⤵
  PID:8160
- C:\Windows\System\UCcVpdO.exe
  C:\Windows\System\UCcVpdO.exe
  2⤵
  PID:8176
- C:\Windows\System\npgAkPI.exe
  C:\Windows\System\npgAkPI.exe
  2⤵
  PID:6868
- C:\Windows\System\aTppioE.exe
  C:\Windows\System\aTppioE.exe
  2⤵
  PID:6476
- C:\Windows\System\jMONJot.exe
  C:\Windows\System\jMONJot.exe
  2⤵
  PID:6656
- C:\Windows\System\fDLaDjf.exe
  C:\Windows\System\fDLaDjf.exe
  2⤵
  PID:7028
- C:\Windows\System\YLGczNp.exe
  C:\Windows\System\YLGczNp.exe
  2⤵
  PID:7216
- C:\Windows\System\kcLRpbu.exe
  C:\Windows\System\kcLRpbu.exe
  2⤵
  PID:7220
- C:\Windows\System\ywGlYvn.exe
  C:\Windows\System\ywGlYvn.exe
  2⤵
  PID:7316
- C:\Windows\System\hZUZPNK.exe
  C:\Windows\System\hZUZPNK.exe
  2⤵
  PID:7352
- C:\Windows\System\jQxurCY.exe
  C:\Windows\System\jQxurCY.exe
  2⤵
  PID:7236
- C:\Windows\System\HARUJPX.exe
  C:\Windows\System\HARUJPX.exe
  2⤵
  PID:7372
- C:\Windows\System\zsyxUEd.exe
  C:\Windows\System\zsyxUEd.exe
  2⤵
  PID:7400
- C:\Windows\System\GMfHOFR.exe
  C:\Windows\System\GMfHOFR.exe
  2⤵
  PID:7416
- C:\Windows\System\JsAHiFJ.exe
  C:\Windows\System\JsAHiFJ.exe
  2⤵
  PID:7484
- C:\Windows\System\ttyZpQc.exe
  C:\Windows\System\ttyZpQc.exe
  2⤵
  PID:7436
- C:\Windows\System\nvkTlHE.exe
  C:\Windows\System\nvkTlHE.exe
  2⤵
  PID:7496
- C:\Windows\System\wOdiVBZ.exe
  C:\Windows\System\wOdiVBZ.exe
  2⤵
  PID:7596
- C:\Windows\System\PVQmmXy.exe
  C:\Windows\System\PVQmmXy.exe
  2⤵
  PID:7632
- C:\Windows\System\YHiJpVj.exe
  C:\Windows\System\YHiJpVj.exe
  2⤵
  PID:7548
- C:\Windows\System\wBzuabt.exe
  C:\Windows\System\wBzuabt.exe
  2⤵
  PID:7584
- C:\Windows\System\AqQnjYO.exe
  C:\Windows\System\AqQnjYO.exe
  2⤵
  PID:7724
- C:\Windows\System\GbGTVdg.exe
  C:\Windows\System\GbGTVdg.exe
  2⤵
  PID:7680
- C:\Windows\System\GohCeKV.exe
  C:\Windows\System\GohCeKV.exe
  2⤵
  PID:7744
- C:\Windows\System\QaaXlJF.exe
  C:\Windows\System\QaaXlJF.exe
  2⤵
  PID:7804
- C:\Windows\System\eHBtdXE.exe
  C:\Windows\System\eHBtdXE.exe
  2⤵
  PID:7840
- C:\Windows\System\orIPCTV.exe
  C:\Windows\System\orIPCTV.exe
  2⤵
  PID:7856
- C:\Windows\System\evbcIAn.exe
  C:\Windows\System\evbcIAn.exe
  2⤵
  PID:7916
- C:\Windows\System\imFyQdK.exe
  C:\Windows\System\imFyQdK.exe
  2⤵
  PID:7888
- C:\Windows\System\ptrNlTV.exe
  C:\Windows\System\ptrNlTV.exe
  2⤵
  PID:7904
- C:\Windows\System\LJXNRKj.exe
  C:\Windows\System\LJXNRKj.exe
  2⤵
  PID:7956
- C:\Windows\System\yGLZJXD.exe
  C:\Windows\System\yGLZJXD.exe
  2⤵
  PID:7972
- C:\Windows\System\EifIlbN.exe
  C:\Windows\System\EifIlbN.exe
  2⤵
  PID:7988
- C:\Windows\System\yelPxkr.exe
  C:\Windows\System\yelPxkr.exe
  2⤵
  PID:8036
- C:\Windows\System\HUQQSHt.exe
  C:\Windows\System\HUQQSHt.exe
  2⤵
  PID:8104
- C:\Windows\System\PakPiWO.exe
  C:\Windows\System\PakPiWO.exe
  2⤵
  PID:8020
- C:\Windows\System\IJoPRwA.exe
  C:\Windows\System\IJoPRwA.exe
  2⤵
  PID:8056
- C:\Windows\System\sVXtbzw.exe
  C:\Windows\System\sVXtbzw.exe
  2⤵
  PID:8152
- C:\Windows\System\pkcQWMx.exe
  C:\Windows\System\pkcQWMx.exe
  2⤵
  PID:6292
- C:\Windows\System\QOxSFFp.exe
  C:\Windows\System\QOxSFFp.exe
  2⤵
  PID:8168
- C:\Windows\System\PmuKFuF.exe
  C:\Windows\System\PmuKFuF.exe
  2⤵
  PID:7568
- C:\Windows\System\qWiOyVC.exe
  C:\Windows\System\qWiOyVC.exe
  2⤵
  PID:7692
- C:\Windows\System\OowGBJQ.exe
  C:\Windows\System\OowGBJQ.exe
  2⤵
  PID:7616
- C:\Windows\System\mXduVAu.exe
  C:\Windows\System\mXduVAu.exe
  2⤵
  PID:7788
- C:\Windows\System\lBcGJmr.exe
  C:\Windows\System\lBcGJmr.exe
  2⤵
  PID:7872
- C:\Windows\System\HNmalHZ.exe
  C:\Windows\System\HNmalHZ.exe
  2⤵
  PID:8004
- C:\Windows\System\JXgGRaW.exe
  C:\Windows\System\JXgGRaW.exe
  2⤵
  PID:8124
- C:\Windows\System\xZqQOFQ.exe
  C:\Windows\System\xZqQOFQ.exe
  2⤵
  PID:7776
- C:\Windows\System\pVGPTIk.exe
  C:\Windows\System\pVGPTIk.exe
  2⤵
  PID:7984
- C:\Windows\System\ELIroio.exe
  C:\Windows\System\ELIroio.exe
  2⤵
  PID:7676
- C:\Windows\System\MoIiPcO.exe
  C:\Windows\System\MoIiPcO.exe
  2⤵
  PID:8024
- C:\Windows\System\aqXbHlU.exe
  C:\Windows\System\aqXbHlU.exe
  2⤵
  PID:7172
- C:\Windows\System\UatbXBY.exe
  C:\Windows\System\UatbXBY.exe
  2⤵
  PID:7320
- C:\Windows\System\zKVgeMc.exe
  C:\Windows\System\zKVgeMc.exe
  2⤵
  PID:7268
- C:\Windows\System\ngcRmls.exe
  C:\Windows\System\ngcRmls.exe
  2⤵
  PID:7296
- C:\Windows\System\SCjUXRV.exe
  C:\Windows\System\SCjUXRV.exe
  2⤵
  PID:7464
- C:\Windows\System\jzGHGsU.exe
  C:\Windows\System\jzGHGsU.exe
  2⤵
  PID:6172
- C:\Windows\System\mZfGSRx.exe
  C:\Windows\System\mZfGSRx.exe
  2⤵
  PID:7964
- C:\Windows\System\fLSIHHv.exe
  C:\Windows\System\fLSIHHv.exe
  2⤵
  PID:7552
- C:\Windows\System\mzLevjP.exe
  C:\Windows\System\mzLevjP.exe
  2⤵
  PID:8188
- C:\Windows\System\wkluNxq.exe
  C:\Windows\System\wkluNxq.exe
  2⤵
  PID:7384
- C:\Windows\System\VePVFLu.exe
  C:\Windows\System\VePVFLu.exe
  2⤵
  PID:7760
- C:\Windows\System\IGJdQLl.exe
  C:\Windows\System\IGJdQLl.exe
  2⤵
  PID:8196
- C:\Windows\System\eszPQjL.exe
  C:\Windows\System\eszPQjL.exe
  2⤵
  PID:8212
- C:\Windows\System\wkRculK.exe
  C:\Windows\System\wkRculK.exe
  2⤵
  PID:8228
- C:\Windows\System\vFGhsXx.exe
  C:\Windows\System\vFGhsXx.exe
  2⤵
  PID:8244
- C:\Windows\System\ngtaXur.exe
  C:\Windows\System\ngtaXur.exe
  2⤵
  PID:8264
- C:\Windows\System\kZraEyh.exe
  C:\Windows\System\kZraEyh.exe
  2⤵
  PID:8284
- C:\Windows\System\qjmWLUo.exe
  C:\Windows\System\qjmWLUo.exe
  2⤵
  PID:8300
- C:\Windows\System\bhaKTEs.exe
  C:\Windows\System\bhaKTEs.exe
  2⤵
  PID:8316
- C:\Windows\System\vWIBTaQ.exe
  C:\Windows\System\vWIBTaQ.exe
  2⤵
  PID:8332
- C:\Windows\System\CGTZQNe.exe
  C:\Windows\System\CGTZQNe.exe
  2⤵
  PID:8348
- C:\Windows\System\PVJwVLw.exe
  C:\Windows\System\PVJwVLw.exe
  2⤵
  PID:8364
- C:\Windows\System\CHWfKnR.exe
  C:\Windows\System\CHWfKnR.exe
  2⤵
  PID:8380
- C:\Windows\System\dlNEeRW.exe
  C:\Windows\System\dlNEeRW.exe
  2⤵
  PID:8396
- C:\Windows\System\SWADujh.exe
  C:\Windows\System\SWADujh.exe
  2⤵
  PID:8412
- C:\Windows\System\rnVgYnf.exe
  C:\Windows\System\rnVgYnf.exe
  2⤵
  PID:8428
- C:\Windows\System\fRgcWep.exe
  C:\Windows\System\fRgcWep.exe
  2⤵
  PID:8444
- C:\Windows\System\snwMnMi.exe
  C:\Windows\System\snwMnMi.exe
  2⤵
  PID:8460
- C:\Windows\System\nKNNdvc.exe
  C:\Windows\System\nKNNdvc.exe
  2⤵
  PID:8476
- C:\Windows\System\quqeuCk.exe
  C:\Windows\System\quqeuCk.exe
  2⤵
  PID:8492
- C:\Windows\System\QVMmZCl.exe
  C:\Windows\System\QVMmZCl.exe
  2⤵
  PID:8508
- C:\Windows\System\smMWerD.exe
  C:\Windows\System\smMWerD.exe
  2⤵
  PID:8524
- C:\Windows\System\wQWQuJT.exe
  C:\Windows\System\wQWQuJT.exe
  2⤵
  PID:8540
- C:\Windows\System\IbdUYNK.exe
  C:\Windows\System\IbdUYNK.exe
  2⤵
  PID:8556
- C:\Windows\System\ZKuqtWq.exe
  C:\Windows\System\ZKuqtWq.exe
  2⤵
  PID:8576
- C:\Windows\System\bDvNnGe.exe
  C:\Windows\System\bDvNnGe.exe
  2⤵
  PID:8592
- C:\Windows\System\nUwQTYF.exe
  C:\Windows\System\nUwQTYF.exe
  2⤵
  PID:8608
- C:\Windows\System\amslovG.exe
  C:\Windows\System\amslovG.exe
  2⤵
  PID:8624
- C:\Windows\System\MtpICka.exe
  C:\Windows\System\MtpICka.exe
  2⤵
  PID:8640
- C:\Windows\System\srHZTjW.exe
  C:\Windows\System\srHZTjW.exe
  2⤵
  PID:8656
- C:\Windows\System\yLQNOZQ.exe
  C:\Windows\System\yLQNOZQ.exe
  2⤵
  PID:8676
- C:\Windows\System\CVWNFCa.exe
  C:\Windows\System\CVWNFCa.exe
  2⤵
  PID:8692
- C:\Windows\System\dlgLwXZ.exe
  C:\Windows\System\dlgLwXZ.exe
  2⤵
  PID:8708
- C:\Windows\System\BnRlfGV.exe
  C:\Windows\System\BnRlfGV.exe
  2⤵
  PID:8724
- C:\Windows\System\WghhXcy.exe
  C:\Windows\System\WghhXcy.exe
  2⤵
  PID:8740
- C:\Windows\System\IeDZsTY.exe
  C:\Windows\System\IeDZsTY.exe
  2⤵
  PID:8756
- C:\Windows\System\DmfpLkv.exe
  C:\Windows\System\DmfpLkv.exe
  2⤵
  PID:8772
- C:\Windows\System\jNMlxhG.exe
  C:\Windows\System\jNMlxhG.exe
  2⤵
  PID:8788
- C:\Windows\System\rwpwiBc.exe
  C:\Windows\System\rwpwiBc.exe
  2⤵
  PID:8804
- C:\Windows\System\nOLLnEX.exe
  C:\Windows\System\nOLLnEX.exe
  2⤵
  PID:8820
- C:\Windows\System\dSOddpe.exe
  C:\Windows\System\dSOddpe.exe
  2⤵
  PID:8836
- C:\Windows\System\CofehTd.exe
  C:\Windows\System\CofehTd.exe
  2⤵
  PID:8852
- C:\Windows\System\MZSbSJM.exe
  C:\Windows\System\MZSbSJM.exe
  2⤵
  PID:8872
- C:\Windows\System\mztugLb.exe
  C:\Windows\System\mztugLb.exe
  2⤵
  PID:8888
- C:\Windows\System\PDXorzh.exe
  C:\Windows\System\PDXorzh.exe
  2⤵
  PID:8908
- C:\Windows\System\BMotHlz.exe
  C:\Windows\System\BMotHlz.exe
  2⤵
  PID:8924
- C:\Windows\System\NYSYWDc.exe
  C:\Windows\System\NYSYWDc.exe
  2⤵
  PID:8940
- C:\Windows\System\DywLRbb.exe
  C:\Windows\System\DywLRbb.exe
  2⤵
  PID:8956
- C:\Windows\System\AgtplnA.exe
  C:\Windows\System\AgtplnA.exe
  2⤵
  PID:8976
- C:\Windows\System\RFMjkhb.exe
  C:\Windows\System\RFMjkhb.exe
  2⤵
  PID:8992
- C:\Windows\System\gxMLkon.exe
  C:\Windows\System\gxMLkon.exe
  2⤵
  PID:9008
- C:\Windows\System\YRZsgWP.exe
  C:\Windows\System\YRZsgWP.exe
  2⤵
  PID:9028
- C:\Windows\System\dPgtsdW.exe
  C:\Windows\System\dPgtsdW.exe
  2⤵
  PID:9044
- C:\Windows\System\BbGVvra.exe
  C:\Windows\System\BbGVvra.exe
  2⤵
  PID:9060
- C:\Windows\System\nHvzGZt.exe
  C:\Windows\System\nHvzGZt.exe
  2⤵
  PID:9076
- C:\Windows\System\QkChfMC.exe
  C:\Windows\System\QkChfMC.exe
  2⤵
  PID:9092
- C:\Windows\System\yGTUnnF.exe
  C:\Windows\System\yGTUnnF.exe
  2⤵
  PID:9112
- C:\Windows\System\vxDxgMh.exe
  C:\Windows\System\vxDxgMh.exe
  2⤵
  PID:9128
- C:\Windows\System\xGEoUhA.exe
  C:\Windows\System\xGEoUhA.exe
  2⤵
  PID:9144
- C:\Windows\System\THAZfqa.exe
  C:\Windows\System\THAZfqa.exe
  2⤵
  PID:9164
- C:\Windows\System\kDrklbX.exe
  C:\Windows\System\kDrklbX.exe
  2⤵
  PID:9180
- C:\Windows\System\kDlmmdp.exe
  C:\Windows\System\kDlmmdp.exe
  2⤵
  PID:9200
- C:\Windows\System\udmlSur.exe
  C:\Windows\System\udmlSur.exe
  2⤵
  PID:8204
- C:\Windows\System\fgGDhvw.exe
  C:\Windows\System\fgGDhvw.exe
  2⤵
  PID:8272
- C:\Windows\System\IdyJACx.exe
  C:\Windows\System\IdyJACx.exe
  2⤵
  PID:8312
- C:\Windows\System\KbRQWPq.exe
  C:\Windows\System\KbRQWPq.exe
  2⤵
  PID:8376
- C:\Windows\System\CUkWEwe.exe
  C:\Windows\System\CUkWEwe.exe
  2⤵
  PID:8440
- C:\Windows\System\LuSfRcv.exe
  C:\Windows\System\LuSfRcv.exe
  2⤵
  PID:8532
- C:\Windows\System\XmRECKn.exe
  C:\Windows\System\XmRECKn.exe
  2⤵
  PID:8600
- C:\Windows\System\OSnWqwT.exe
  C:\Windows\System\OSnWqwT.exe
  2⤵
  PID:7644
- C:\Windows\System\xbkDryT.exe
  C:\Windows\System\xbkDryT.exe
  2⤵
  PID:8700
- C:\Windows\System\Cfrjvzm.exe
  C:\Windows\System\Cfrjvzm.exe
  2⤵
  PID:8736
- C:\Windows\System\taISkuu.exe
  C:\Windows\System\taISkuu.exe
  2⤵
  PID:8768
- C:\Windows\System\fKkVRDG.exe
  C:\Windows\System\fKkVRDG.exe
  2⤵
  PID:7388
- C:\Windows\System\hLFEAXu.exe
  C:\Windows\System\hLFEAXu.exe
  2⤵
  PID:8328
- C:\Windows\System\XCEErNj.exe
  C:\Windows\System\XCEErNj.exe
  2⤵
  PID:7948
- C:\Windows\System\wrpJgqY.exe
  C:\Windows\System\wrpJgqY.exe
  2⤵
  PID:7252
- C:\Windows\System\eVBLJBd.exe
  C:\Windows\System\eVBLJBd.exe
  2⤵
  PID:8224
- C:\Windows\System\cZrTtdS.exe
  C:\Windows\System\cZrTtdS.exe
  2⤵
  PID:8292
- C:\Windows\System\UxBSHtJ.exe
  C:\Windows\System\UxBSHtJ.exe
  2⤵
  PID:8360
- C:\Windows\System\zxtyPdm.exe
  C:\Windows\System\zxtyPdm.exe
  2⤵
  PID:8424
- C:\Windows\System\zELgInv.exe
  C:\Windows\System\zELgInv.exe
  2⤵
  PID:8488
- C:\Windows\System\edGjpZr.exe
  C:\Windows\System\edGjpZr.exe
  2⤵
  PID:8552
- C:\Windows\System\rEzCEvq.exe
  C:\Windows\System\rEzCEvq.exe
  2⤵
  PID:8648
- C:\Windows\System\kFREYHW.exe
  C:\Windows\System\kFREYHW.exe
  2⤵
  PID:8716
- C:\Windows\System\fOLMaNm.exe
  C:\Windows\System\fOLMaNm.exe
  2⤵
  PID:8748
- C:\Windows\System\HgSNHOJ.exe
  C:\Windows\System\HgSNHOJ.exe
  2⤵
  PID:8832
- C:\Windows\System\dwcSKgb.exe
  C:\Windows\System\dwcSKgb.exe
  2⤵
  PID:8896
- C:\Windows\System\RCQCoOY.exe
  C:\Windows\System\RCQCoOY.exe
  2⤵
  PID:8936
- C:\Windows\System\thHHsfc.exe
  C:\Windows\System\thHHsfc.exe
  2⤵
  PID:8816
- C:\Windows\System\kValyqJ.exe
  C:\Windows\System\kValyqJ.exe
  2⤵
  PID:8844
- C:\Windows\System\DyWAwjQ.exe
  C:\Windows\System\DyWAwjQ.exe
  2⤵
  PID:9068
- C:\Windows\System\nRfeSek.exe
  C:\Windows\System\nRfeSek.exe
  2⤵
  PID:9136
- C:\Windows\System\TmmrBNx.exe
  C:\Windows\System\TmmrBNx.exe
  2⤵
  PID:9176
- C:\Windows\System\tcZLuMz.exe
  C:\Windows\System\tcZLuMz.exe
  2⤵
  PID:8952
- C:\Windows\System\jGEfRyS.exe
  C:\Windows\System\jGEfRyS.exe
  2⤵
  PID:8408
- C:\Windows\System\fCphspW.exe
  C:\Windows\System\fCphspW.exe
  2⤵
  PID:8884
- C:\Windows\System\TibIXma.exe
  C:\Windows\System\TibIXma.exe
  2⤵
  PID:8568
- C:\Windows\System\GkAEUaU.exe
  C:\Windows\System\GkAEUaU.exe
  2⤵
  PID:9088
- C:\Windows\System\WDKLXcQ.exe
  C:\Windows\System\WDKLXcQ.exe
  2⤵
  PID:9052
- C:\Windows\System\FwIBRNf.exe
  C:\Windows\System\FwIBRNf.exe
  2⤵
  PID:9024
- C:\Windows\System\Vlffkqa.exe
  C:\Windows\System\Vlffkqa.exe
  2⤵
  PID:9124
- C:\Windows\System\VmyqXGn.exe
  C:\Windows\System\VmyqXGn.exe
  2⤵
  PID:9156
- C:\Windows\System\nZKgFzB.exe
  C:\Windows\System\nZKgFzB.exe
  2⤵
  PID:8236
- C:\Windows\System\tHAKIQJ.exe
  C:\Windows\System\tHAKIQJ.exe
  2⤵
  PID:7448
- C:\Windows\System\gdwgXSV.exe
  C:\Windows\System\gdwgXSV.exe
  2⤵
  PID:8632
- C:\Windows\System\lnggeSS.exe
  C:\Windows\System\lnggeSS.exe
  2⤵
  PID:8072
- C:\Windows\System\CgXeEer.exe
  C:\Windows\System\CgXeEer.exe
  2⤵
  PID:8800
- C:\Windows\System\JiFVeeg.exe
  C:\Windows\System\JiFVeeg.exe
  2⤵
  PID:7368
- C:\Windows\System\QsUJNur.exe
  C:\Windows\System\QsUJNur.exe
  2⤵
  PID:8260
- C:\Windows\System\WhzaxUT.exe
  C:\Windows\System\WhzaxUT.exe
  2⤵
  PID:8392
- C:\Windows\System\iJpbHLX.exe
  C:\Windows\System\iJpbHLX.exe
  2⤵
  PID:8828
- C:\Windows\System\vOAOmZU.exe
  C:\Windows\System\vOAOmZU.exe
  2⤵
  PID:9004
- C:\Windows\System\kRBvioD.exe
  C:\Windows\System\kRBvioD.exe
  2⤵
  PID:8456
- C:\Windows\System\zrrJoqW.exe
  C:\Windows\System\zrrJoqW.exe
  2⤵
  PID:8968
- C:\Windows\System\pKoDniw.exe
  C:\Windows\System\pKoDniw.exe
  2⤵
  PID:8356
- C:\Windows\System\XIBRpYs.exe
  C:\Windows\System\XIBRpYs.exe
  2⤵
  PID:8812
- C:\Windows\System\odzOchk.exe
  C:\Windows\System\odzOchk.exe
  2⤵
  PID:8848
- C:\Windows\System\jAngdYs.exe
  C:\Windows\System\jAngdYs.exe
  2⤵
  PID:7660
- C:\Windows\System\eEoquzL.exe
  C:\Windows\System\eEoquzL.exe
  2⤵
  PID:8672
- C:\Windows\System\vWYwIIE.exe
  C:\Windows\System\vWYwIIE.exe
  2⤵
  PID:8140
- C:\Windows\System\voHAkvw.exe
  C:\Windows\System\voHAkvw.exe
  2⤵
  PID:7836
- C:\Windows\System\IRmaiah.exe
  C:\Windows\System\IRmaiah.exe
  2⤵
  PID:8564
- C:\Windows\System\pnRhSrd.exe
  C:\Windows\System\pnRhSrd.exe
  2⤵
  PID:8520
- C:\Windows\System\HyYiOpR.exe
  C:\Windows\System\HyYiOpR.exe
  2⤵
  PID:7532
- C:\Windows\System\kGkhioo.exe
  C:\Windows\System\kGkhioo.exe
  2⤵
  PID:8780
- C:\Windows\System\IcIeaEg.exe
  C:\Windows\System\IcIeaEg.exe
  2⤵
  PID:8864
- C:\Windows\System\STReMKy.exe
  C:\Windows\System\STReMKy.exe
  2⤵
  PID:9224
- C:\Windows\System\KnUSQTN.exe
  C:\Windows\System\KnUSQTN.exe
  2⤵
  PID:9240
- C:\Windows\System\tNrXTfg.exe
  C:\Windows\System\tNrXTfg.exe
  2⤵
  PID:9256
- C:\Windows\System\vzaRuCk.exe
  C:\Windows\System\vzaRuCk.exe
  2⤵
  PID:9272
- C:\Windows\System\BprcNpX.exe
  C:\Windows\System\BprcNpX.exe
  2⤵
  PID:9288
- C:\Windows\System\XhyCnRc.exe
  C:\Windows\System\XhyCnRc.exe
  2⤵
  PID:9304
- C:\Windows\System\AhoSWoh.exe
  C:\Windows\System\AhoSWoh.exe
  2⤵
  PID:9324
- C:\Windows\System\wZxFLJv.exe
  C:\Windows\System\wZxFLJv.exe
  2⤵
  PID:9340
- C:\Windows\System\fFpqJnQ.exe
  C:\Windows\System\fFpqJnQ.exe
  2⤵
  PID:9356
- C:\Windows\System\OnCYprD.exe
  C:\Windows\System\OnCYprD.exe
  2⤵
  PID:9380
- C:\Windows\System\zJGgOBg.exe
  C:\Windows\System\zJGgOBg.exe
  2⤵
  PID:9400
- C:\Windows\System\hdwbkdW.exe
  C:\Windows\System\hdwbkdW.exe
  2⤵
  PID:9428
- C:\Windows\System\pTSpNxI.exe
  C:\Windows\System\pTSpNxI.exe
  2⤵
  PID:9484
- C:\Windows\System\iATttYa.exe
  C:\Windows\System\iATttYa.exe
  2⤵
  PID:9500
- C:\Windows\System\iqBAFsm.exe
  C:\Windows\System\iqBAFsm.exe
  2⤵
  PID:9516
- C:\Windows\System\BrFFnBD.exe
  C:\Windows\System\BrFFnBD.exe
  2⤵
  PID:9532
- C:\Windows\System\NdfIRgL.exe
  C:\Windows\System\NdfIRgL.exe
  2⤵
  PID:9676
- C:\Windows\System\qeRhcCp.exe
  C:\Windows\System\qeRhcCp.exe
  2⤵
  PID:9696
- C:\Windows\System\wbPUmSP.exe
  C:\Windows\System\wbPUmSP.exe
  2⤵
  PID:9712
- C:\Windows\System\arccbPO.exe
  C:\Windows\System\arccbPO.exe
  2⤵
  PID:9728
- C:\Windows\System\ozUPvDJ.exe
  C:\Windows\System\ozUPvDJ.exe
  2⤵
  PID:9744
- C:\Windows\System\osLuVcd.exe
  C:\Windows\System\osLuVcd.exe
  2⤵
  PID:9764
- C:\Windows\System\BbeTsSi.exe
  C:\Windows\System\BbeTsSi.exe
  2⤵
  PID:9780
- C:\Windows\System\AlKqQil.exe
  C:\Windows\System\AlKqQil.exe
  2⤵
  PID:9796
- C:\Windows\System\WXlqyPw.exe
  C:\Windows\System\WXlqyPw.exe
  2⤵
  PID:9812
- C:\Windows\System\sHtPLRc.exe
  C:\Windows\System\sHtPLRc.exe
  2⤵
  PID:9828
- C:\Windows\System\UlfgrcC.exe
  C:\Windows\System\UlfgrcC.exe
  2⤵
  PID:9844
- C:\Windows\System\JtQFYId.exe
  C:\Windows\System\JtQFYId.exe
  2⤵
  PID:9860
- C:\Windows\System\DrnMBUk.exe
  C:\Windows\System\DrnMBUk.exe
  2⤵
  PID:9876
- C:\Windows\System\eQnkUUV.exe
  C:\Windows\System\eQnkUUV.exe
  2⤵
  PID:9892
- C:\Windows\System\oypjTRV.exe
  C:\Windows\System\oypjTRV.exe
  2⤵
  PID:9908
- C:\Windows\System\atFjyUP.exe
  C:\Windows\System\atFjyUP.exe
  2⤵
  PID:9924
- C:\Windows\System\cZnkbrq.exe
  C:\Windows\System\cZnkbrq.exe
  2⤵
  PID:9940
- C:\Windows\System\kSZUAsp.exe
  C:\Windows\System\kSZUAsp.exe
  2⤵
  PID:9956
- C:\Windows\System\ngoqtyA.exe
  C:\Windows\System\ngoqtyA.exe
  2⤵
  PID:9972
- C:\Windows\System\jGJiYbK.exe
  C:\Windows\System\jGJiYbK.exe
  2⤵
  PID:9988
- C:\Windows\System\zkVyjwC.exe
  C:\Windows\System\zkVyjwC.exe
  2⤵
  PID:10004
- C:\Windows\System\skpBoiP.exe
  C:\Windows\System\skpBoiP.exe
  2⤵
  PID:10020
- C:\Windows\System\aKxuAdC.exe
  C:\Windows\System\aKxuAdC.exe
  2⤵
  PID:10036
- C:\Windows\System\WwbxpVU.exe
  C:\Windows\System\WwbxpVU.exe
  2⤵
  PID:10052
- C:\Windows\System\gOYXQjn.exe
  C:\Windows\System\gOYXQjn.exe
  2⤵
  PID:10068
- C:\Windows\System\ztKIImq.exe
  C:\Windows\System\ztKIImq.exe
  2⤵
  PID:10084
- C:\Windows\System\nxegvOp.exe
  C:\Windows\System\nxegvOp.exe
  2⤵
  PID:10100
- C:\Windows\System\HSYENSH.exe
  C:\Windows\System\HSYENSH.exe
  2⤵
  PID:10116
- C:\Windows\System\GClUxLF.exe
  C:\Windows\System\GClUxLF.exe
  2⤵
  PID:10132
- C:\Windows\System\DmBpYNS.exe
  C:\Windows\System\DmBpYNS.exe
  2⤵
  PID:10148
- C:\Windows\System\ENYazeU.exe
  C:\Windows\System\ENYazeU.exe
  2⤵
  PID:10236
- C:\Windows\System\CdvGYHs.exe
  C:\Windows\System\CdvGYHs.exe
  2⤵
  PID:9188
- C:\Windows\System\uGENwou.exe
  C:\Windows\System\uGENwou.exe
  2⤵
  PID:8500
- C:\Windows\System\ZBCQHlx.exe
  C:\Windows\System\ZBCQHlx.exe
  2⤵
  PID:8220
- C:\Windows\System\pPsuujf.exe
  C:\Windows\System\pPsuujf.exe
  2⤵
  PID:8484
- C:\Windows\System\nQtactp.exe
  C:\Windows\System\nQtactp.exe
  2⤵
  PID:8988
- C:\Windows\System\EvDiSdC.exe
  C:\Windows\System\EvDiSdC.exe
  2⤵
  PID:9236
- C:\Windows\System\uAEMObF.exe
  C:\Windows\System\uAEMObF.exe
  2⤵
  PID:9300
- C:\Windows\System\FIgntML.exe
  C:\Windows\System\FIgntML.exe
  2⤵
  PID:9376
- C:\Windows\System\SVjatJo.exe
  C:\Windows\System\SVjatJo.exe
  2⤵
  PID:9408
- C:\Windows\System\XZwWLio.exe
  C:\Windows\System\XZwWLio.exe
  2⤵
  PID:9424
- C:\Windows\System\nHdmBUs.exe
  C:\Windows\System\nHdmBUs.exe
  2⤵
  PID:9496
- C:\Windows\System\wRVOOek.exe
  C:\Windows\System\wRVOOek.exe
  2⤵
  PID:9316
- C:\Windows\System\gCxwUyj.exe
  C:\Windows\System\gCxwUyj.exe
  2⤵
  PID:9692
- C:\Windows\System\aIimlOa.exe
  C:\Windows\System\aIimlOa.exe
  2⤵
  PID:9756
- C:\Windows\System\Tnuzlua.exe
  C:\Windows\System\Tnuzlua.exe
  2⤵
  PID:9820
- C:\Windows\System\zaatXhS.exe
  C:\Windows\System\zaatXhS.exe
  2⤵
  PID:9884
- C:\Windows\System\ELWlWwI.exe
  C:\Windows\System\ELWlWwI.exe
  2⤵
  PID:10044
- C:\Windows\System\FzdRmJD.exe
  C:\Windows\System\FzdRmJD.exe
  2⤵
  PID:10108
- C:\Windows\System\ruTEItT.exe
  C:\Windows\System\ruTEItT.exe
  2⤵
  PID:10144
- C:\Windows\System\hmWtvHl.exe
  C:\Windows\System\hmWtvHl.exe
  2⤵
  PID:9352
- C:\Windows\System\wUpjnPB.exe
  C:\Windows\System\wUpjnPB.exe
  2⤵
  PID:9440
- C:\Windows\System\pIvixcr.exe
  C:\Windows\System\pIvixcr.exe
  2⤵
  PID:9456
- C:\Windows\System\sSxPKEa.exe
  C:\Windows\System\sSxPKEa.exe
  2⤵
  PID:9472
- C:\Windows\System\cgoEvup.exe
  C:\Windows\System\cgoEvup.exe
  2⤵
  PID:9540
- C:\Windows\System\mnVdPBV.exe
  C:\Windows\System\mnVdPBV.exe
  2⤵
  PID:9552
- C:\Windows\System\gFWJyzK.exe
  C:\Windows\System\gFWJyzK.exe
  2⤵
  PID:9580
- C:\Windows\System\GBUrniR.exe
  C:\Windows\System\GBUrniR.exe
  2⤵
  PID:9596
- C:\Windows\System\MuFiBep.exe
  C:\Windows\System\MuFiBep.exe
  2⤵
  PID:9612
- C:\Windows\System\ZdJQSUB.exe
  C:\Windows\System\ZdJQSUB.exe
  2⤵
  PID:9632
- C:\Windows\System\SAQDoku.exe
  C:\Windows\System\SAQDoku.exe
  2⤵
  PID:9708
- C:\Windows\System\VQmpgjs.exe
  C:\Windows\System\VQmpgjs.exe
  2⤵
  PID:9776
- C:\Windows\System\wDQpOFh.exe
  C:\Windows\System\wDQpOFh.exe
  2⤵
  PID:9840
- C:\Windows\System\geXfDvj.exe
  C:\Windows\System\geXfDvj.exe
  2⤵
  PID:9904
- C:\Windows\System\PLTolPU.exe
  C:\Windows\System\PLTolPU.exe
  2⤵
  PID:9968
- C:\Windows\System\Tnlydqx.exe
  C:\Windows\System\Tnlydqx.exe
  2⤵
  PID:10032
- C:\Windows\System\cdMrIJr.exe
  C:\Windows\System\cdMrIJr.exe
  2⤵
  PID:10124
- C:\Windows\System\aWAVTSE.exe
  C:\Windows\System\aWAVTSE.exe
  2⤵
  PID:10156
- C:\Windows\System\OOkxPAP.exe
  C:\Windows\System\OOkxPAP.exe
  2⤵
  PID:10180
- C:\Windows\System\GpfbJhQ.exe
  C:\Windows\System\GpfbJhQ.exe
  2⤵
  PID:10204
- C:\Windows\System\aQQLFEA.exe
  C:\Windows\System\aQQLFEA.exe
  2⤵
  PID:10216
- C:\Windows\System\sHllXwl.exe
  C:\Windows\System\sHllXwl.exe
  2⤵
  PID:9220
- C:\Windows\System\pcQyJqZ.exe
  C:\Windows\System\pcQyJqZ.exe
  2⤵
  PID:7312
- C:\Windows\System\NbyZbFd.exe
  C:\Windows\System\NbyZbFd.exe
  2⤵
  PID:9368
- C:\Windows\System\PYyrlFb.exe
  C:\Windows\System\PYyrlFb.exe
  2⤵
  PID:9684
- C:\Windows\System\fLhMpvU.exe
  C:\Windows\System\fLhMpvU.exe
  2⤵
  PID:9980
- C:\Windows\System\CHvyqci.exe
  C:\Windows\System\CHvyqci.exe
  2⤵
  PID:8868
- C:\Windows\System\WEkMpVO.exe
  C:\Windows\System\WEkMpVO.exe
  2⤵
  PID:9332
- C:\Windows\System\AOHoyUr.exe
  C:\Windows\System\AOHoyUr.exe
  2⤵
  PID:9480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AzYsIso.exe

Filesize
1.9MB

MD5
1424d211dddbff257342a044186ce3e4

SHA1
03b3f1a1314feaf5af86649bea886e677eb7c3e7

SHA256
e79ef8bda9106ccf08b94057aa552c5e591dbfcdfc84d2c939a5aa065d116e41

SHA512
9b56979f39e9e52bdd12dbffd9b8b3613f89891159b3be40c824ff308a10e79004115fbcc4af4d7fd46196e27ea331580e0adf386098941ab312948aff00078d

Download Submit
C:\Windows\system\Bspecju.exe

Filesize
1.9MB

MD5
585b994ba9ce6b27ab4dc2dce1ac996c

SHA1
0ee99336c059259716d8c487cece6a8ddd0b6bb9

SHA256
82ba64e5cbb311295f47ad501db80fecc8e8c794fa9c56c3aad74e01e8d5e975

SHA512
621c20c1daff427541f5ffebe85705bfaf99fc3f9d4d44e6eac5dfca8824793aae766893f81a1dcec54011d5c200a7e791857cbb9c3c28245606320b52ab1844

Download Submit
C:\Windows\system\EgcosuJ.exe

Filesize
1.8MB

MD5
57ae3b979ba17a6641fc39139fbc839d

SHA1
d368ebf6487627ce1dc7bb89054981528da02a01

SHA256
170cf20dbd7f8cdedac131e25a26cf28ef05422b50a33e1e6e196253ff00b9ce

SHA512
77a877de5de19a253d2f97ff9677330183500395f770c6d533d8b6f78d6128c1c1197de11a6fed72db7f1be0e70a07c55fdc1608346412cc64a40ad36d805dab

Download Submit
C:\Windows\system\FNojOXZ.exe

Filesize
1.8MB

MD5
0f3afa01c83b45d8b2406bc65aa48b3d

SHA1
20f0ac508a0da7b7df44c9fdd89f629f46688eba

SHA256
bca6d8e5f5d2b106801c538b69771102e1ff9f2e7e609619cf9ec0ba8d9f6ffb

SHA512
76f4410520cd7d4576558add325f123f9445fd067a798e27d0dd1c4bc3d66adc767dc758d265987ebdf067eb2f42336aaf5b104094a7a9ca95d1145e415b805b

Download Submit
C:\Windows\system\GIvzlLH.exe

Filesize
1.8MB

MD5
3cee44c25e826dc7d9acf4058b2400b9

SHA1
663b948ee10a08e5be794e1fe175c035296a54de

SHA256
4e486c163e431e91da1ae226791a58ff9d5fc8682a7331fd2d48f5b5a8be046a

SHA512
37b6876c84ab8a29a52f023407602a056bfe35f65e7b36a8d95af61c8d27afa055b6ce42a89133d18e56abe84ed2c18eeac7d43222b7e11d61c610e3eb23b76e

Download Submit
C:\Windows\system\HXkXveQ.exe

Filesize
1.8MB

MD5
379fdc975b72595f89ca43694f24d941

SHA1
d49191cb3a6ed3b8a066e485e16fe0948faccf86

SHA256
04fc7feaa1df927c66cf3dbdedc6788c20e93ffb6a44f3993d293dda6030cb99

SHA512
891fdaaaeac619dbbb54abe80fd5c9a00e21c145090279c6dfb554a710e1b92621c0786b09ea366c12397e284d74bada7291696153d869e3d5ad0e8cc383d78a

Download Submit
C:\Windows\system\LwfkSPL.exe

Filesize
1.9MB

MD5
c6e266b73f083649ad5123e43db76aab

SHA1
45b4d67fd6bcbeaa9a6b00c6ec178874a86ff921

SHA256
31057cca6f2ba1ba0263a136e0c109f36ad59a0f0bb978a7fcbddfda99e2c43a

SHA512
8a0b1d19f7933cb8a848168bac35fd11c4ea35c5da498bcea7dbcb28e5b07df905aa0b30fe7bb59770f364d4bf6827429437f4c3e3aed1928ef5d98f71b4cd7d

Download Submit
C:\Windows\system\RbgfRcH.exe

Filesize
1.8MB

MD5
7ad8366be44f7c6b1587580fd31f08a3

SHA1
261698323e3f2bcfee94a425af49371775e440ea

SHA256
e083fa5ae4bdce35ad213c6edd41a1d656c068132d19dd6fbb024fdb2a9b0c46

SHA512
56b7d50547fa7b9560a43f350d7595c94d09a45a164343d75fa0f487cadf7303d09f73257fca86ff6e104139eaea0563863b02ac5774169c6afcee6df2feb691

Download Submit
C:\Windows\system\UMMcFtn.exe

Filesize
1.8MB

MD5
0a404f8d5c9cbba9aa9552b86fdcdb89

SHA1
68ee7f7adafa1e54bd6745c5f250008c54ff235e

SHA256
e0bc0cef3ecc45413f760b970cf31401a0b6302d3b4b03cdc00bbf70534b26db

SHA512
70934ad9fc94deffef03890f37c6728ea8532f37490b9196685486fec4218d9318c577745e26b283dcc452001954c197e22a3f4d0f8427549f40e9953dc1fd6d

Download Submit
C:\Windows\system\VKHZbtZ.exe

Filesize
1.9MB

MD5
65dd1ede87e4202d7278180d4218b16e

SHA1
b8df7502c1a0caba90954c668f63c81c8ca43dd3

SHA256
9125ebc0b7c4735ae188c8ae6f8ce37f25285db37e0c4fc090943aebfb4c2fd0

SHA512
037ec63611fea532b73f3d12170e2f5a39b17775a0d8a9e0a1e8c5b5e39d762f73a4e84c5b2883ac577091867f6bfff035400959179216a8bd89eb88dfec2d38

Download Submit
C:\Windows\system\WBEaAme.exe

Filesize
1.8MB

MD5
a2afdbcaa79381b0550d52a93110f956

SHA1
631f6d0c1ba21bc6d0c6a63ab0b5e3d26351d098

SHA256
9c088f0a6437d9d6772a8d4bd8b87198f64fbd8e3f7681476866a752cbee4542

SHA512
97b6d1b65345ad1c511a42a39c759fcfb3865c4672cc067b752a2c16874e4b42e892009f796f284d910489c29591838331b48da5c3b129faf162f957f0c7415d

Download Submit
C:\Windows\system\YJFAgEF.exe

Filesize
1.8MB

MD5
423245f9b7004709096820fb4b01860d

SHA1
69947a08224b3bcd39d3705ebe74903f86a09499

SHA256
c9d959d7a1692333ccf38e388f9c291a6992f6cf03f0e85116a186e0ddc49678

SHA512
e8becea40d16c4a5bb8fdf2849521255e2ea37c178d43bab907ed261e0c5151d4b325790aa246cb0d13e617a12edbadd66c4943dfac0a498b29b00820fdd6a02

Download Submit
C:\Windows\system\YgCqGLh.exe

Filesize
1.9MB

MD5
4930d38e8ab7a1b9bdd77fb806024fb5

SHA1
bdfbe493dd7aa0680d6bcb37329fa47c374ba838

SHA256
83e23fd048a9ac901f40de2e872e72e5b1a5a4c0e461db1586c81b5340ae1f67

SHA512
cfdeae2993aa1f5a051c05515924c7a0555f36ed4ee9a4441465e9c2e3ff4c6c61756acafca50a9c461084245ac501e963debddf36d93aa85f3dfd1317155ccb

Download Submit
C:\Windows\system\bSnMiYl.exe

Filesize
1.9MB

MD5
2daaaadf61738190a1048f4135b34812

SHA1
09cd49db18319b0195affc2d3b540f172422723d

SHA256
e9c67754af1b5172f6aa63180d75f5b7283934cd6c0393bddcbc52570dd6c0b6

SHA512
bd8fa03a33831517eae2f7c67e4c694313945b19f10222260f6b56c6926085d49c5faf59d0fa72be23667e16e72030f480ff3e7b653541b6c45369163f03ceb2

Download Submit
C:\Windows\system\duynLSw.exe

Filesize
1.9MB

MD5
d89a62d8a2a292089f48e7f3536819a1

SHA1
0962a32def711af34a785469bd43e35cddd53697

SHA256
3fd9fa9d313023614be264e4a281fdb1b2ba967aaf7cc3a70c0bb374b50dc630

SHA512
6343405ec1b94987ee2a21d31ed330f26e57c64b157cb3fe8e1153b7e3b74ea461595347d0a910ba259314697836d0fe261b9bec3d84d36c5422a0f97f92a2f8

Download Submit
C:\Windows\system\igmRpBx.exe

Filesize
1.8MB

MD5
a0021b8e5942d64394d992370a752754

SHA1
c777a28b25a5c25932ce0ae796c3f2641a36ff68

SHA256
291de00d977512022c5628093fc842eb2e120e6cae818f3bcb88cf0bf18e410a

SHA512
e45f34045ed7b6ebd74c09942b412eab1f69d11809a32f9a0d16ef02efc5d292f2954397c461ca2cd2477dd08b3f2afdc6036e90e76a877499abae7b36faead0

Download Submit
C:\Windows\system\kiUGrhx.exe

Filesize
1.8MB

MD5
16562ca51354316617c9fe4878959b4c

SHA1
4bc152e375343a5488f0084b9d1eecdb60dd0e95

SHA256
4f757d427fd9932332ada97edb9043ffd7f12ad585fddb811bb535ed006780d7

SHA512
fa54e616eee8f569a55d3501ed53c581c2f9a662cb82f37088597564059bc03a8e71a87fc48b0aad03e26722deb0f4d3da437996fdd72e0dc4d840776dbeea2f

Download Submit
C:\Windows\system\msUBjjI.exe

Filesize
1.8MB

MD5
13a4cdacfd4007c4aca9d10dce4782c9

SHA1
a79bbd4b2de800cee0f50db348a9eb262a2c03ca

SHA256
f65a6a4dafc2025610cbe8f1bc168661a910ab5ca417a57f799a6d1333538abd

SHA512
cb8973added4947c5a9c7a2416baf3e99905e6a0346785ccc54d9bc3e27e99033a8e5aab3156928a7b819ed3b60becb3740cfa688c102ee5d92a4a508c29905c

Download Submit
C:\Windows\system\rRBDvqh.exe

Filesize
1.8MB

MD5
87ee4ec5a831b467b6c7278fa4c49e3d

SHA1
4c02413aa5a8c573a09a8a09c2c2b9889861986b

SHA256
81976a43e25bdf848b55c420b107fcb26e74820fef463446ca192fdc87350ded

SHA512
49f1cbd8026145d1b41ed06cc58a3860e5ba358db7f576a56b0ab878c3935bc10bc1408e8de2d8013a7656fa3db623eed17b20e21167bba1000065286f58d2e3

Download Submit
C:\Windows\system\rofcNdH.exe

Filesize
1.9MB

MD5
ab3ca754f08db48d95dc169f2784d86f

SHA1
5507dc1e53d1f4d665bdbb85eca86446e6c50e7a

SHA256
eb52c9b3b89ea53a6f7854e2ed4d3e42472231faf54289303250f03b168af00e

SHA512
3eaefa8f4bddb2e5d142be4f8caddf32652c1d661dff0061a3aebcf24dcd279591e647c49baa84ba00217897cc18c55eb5f55eb7590fc5c213c36983758bd28f

Download Submit
C:\Windows\system\ulhoZtl.exe

Filesize
1.9MB

MD5
ec71c2b622dcc567036823513d1486af

SHA1
405f9b0ef165afb0af793598b05f4191eaba36b6

SHA256
09c395749f0e67afb1ce37c8fd48c9105c05ac87a71e67fba0daba853588eb1d

SHA512
8849b137e4860d2baccf2d6eb2e6dab21a00f52632a2d97dfe27b12412b223c892779fe4257636bd917b1e42cf94982e397ecd78d523e21d513b9d904f07095c

Download Submit
C:\Windows\system\uwEwWaH.exe

Filesize
1.8MB

MD5
02f1b5fe5a536fc937704f0deb7972fc

SHA1
d693e603dadf86153576f8069257a804bc3fe7af

SHA256
9a4e4c740766f2514a3ada22c134dbdc1181df8f82a6bbf34cf1d3be795b1247

SHA512
a44a008562dfa508c2789633776a26cf37511205c0c1e84d208e2394f1d9e4721c0edd192c7fc621f95ca91e473bde7063570fc37aca93b22a7ee6bfa041e2bf

Download Submit
C:\Windows\system\zaAZkyN.exe

Filesize
1.8MB

MD5
3d3850d4728825acaad1a7b86ae1ac14

SHA1
9516aa061758baa597ebda7a4e3d3d2a3d41c458

SHA256
33772ed7d07d31e8743a01ae42773de3d618fafd2abe8131f4edcdb2ce04600b

SHA512
2ff9ca38789c0110470475896689f9da25cd0bbb176d4f0c64f0fbf9dcb49f57f002fa636bceab27c2538764e593217cd2550a31e474001b02b5d252a369805a

Download Submit
C:\Windows\system\zhVjCOR.exe

Filesize
1.8MB

MD5
98c41f077db658d3a8f168260f2d3b2a

SHA1
378fbf40963d99bf3d8475a9594ba52f3aa3e6ec

SHA256
9c941b4f587d72796bbe63347e2af76344daa1c4024cba6046f382b77d2e72c9

SHA512
634b0fc1094e5ed869de84e00304c92d0823c89022f502b994f112dee405d6d4a72ea7e17b32dde3d744d017115de374d7b20e2836a5bf446389ced100fb7e49

Download Submit
\Windows\system\DKKejph.exe

Filesize
1.8MB

MD5
29d3f5762c769a2ddcac9a6ed241726b

SHA1
5be27ba08b7f3746fba791c1264adfe413717c76

SHA256
e77378be9e532ec3b31d825b7aa08dd73b466f1ecc19e373cd18df3f3899395c

SHA512
0e1dcf899751b042e0cb5bb3902d2a26aab037c863b824e948d9f85e0b5de0187cf7ac325ceb9c514bc55d792cdbd22081780b569e51efeab77462224647ca10

Download Submit
\Windows\system\SePsmyQ.exe

Filesize
1.9MB

MD5
fe8f89f84bc463f519c127b37dd6a969

SHA1
0c6834b5d01b4398f521f1c282866312377c15b0

SHA256
0642e2be2be0602f624f0681975f8d1bb1c9b6a12ede293c71d133813e00e22c

SHA512
58b20184501d108ed72c034e54145c9eac7cd3ed02f135c2d69b5ff1bdbcfab27a6abfbdd4839009c3acc05194effc1502884274bd1f2c6de45adea1707e62e7

Download Submit
\Windows\system\XOHHwOU.exe

Filesize
1.9MB

MD5
79ad12be4798b4bf5c037f2be14f112e

SHA1
b3074bb67b92fe6d763a54b1514c109679664874

SHA256
b6a2c2e1357620e00a34e744432943ab37986f80c7df3002ca4155c52590a210

SHA512
b705cba804371094c6012df64f85f8c345c4555312a52adf1405dc5380e1cea43b4d62b768b4574e1795f58664aee314c6fbb0d7bdd9d3a0da5f5522dd4591c5

Download Submit
\Windows\system\ZiNCOLk.exe

Filesize
1.9MB

MD5
1a81ed2d41780d75e0e4f32874f7bae1

SHA1
24ec448bfc59e8f9aca2064cbbc212e95d452f50

SHA256
28aaceabd52fcf92d5006608b3e33808aa9fc4c74375ec9d2f57f090ffa9b58a

SHA512
709c0fe4311245ef73159fbeb99ec7aad646c6fc32c9f6a1d4d521fe2b9b7319c1d2b8cabf9ef0a50fda0523b5270fe4057119419f6b74530bd8dbd7d94990f3

Download Submit
\Windows\system\cAYNOBv.exe

Filesize
1.9MB

MD5
072e0e88b2f929791f1f19fbee592455

SHA1
7786716e0d637fb4fd79bff779001104acb415fc

SHA256
9169a17a02b308daf1af22e8bb4a1fe9e4c8baddfe6e4346ad0bd93c11319b30

SHA512
5faead458e64df2529c44f556b3c9a4c570359aa999d4a64633a515bdbacb7ac53facac046e20f4182e9576c50061bc04458365f9fa005d63eba932561066230

Download Submit
\Windows\system\cJBgzWB.exe

Filesize
1.9MB

MD5
0cfc80b51783c08b2bc8bc1b962b388a

SHA1
beb13401758feb5778d6d422f35f76c4222d77ef

SHA256
ddbc9f01991ba48836562ad7401177b0c74e0cecaad46650e7630b53d3fbec55

SHA512
070cbabe68baa889fe748f51e63923dc52ad192b9e990c962242a25c3ebd4fa245c13ba2a9f45c2e1c6545f849049ee3455cb6792a8401afb3a4b0e905d85365

Download Submit
\Windows\system\eOucGol.exe

Filesize
1.9MB

MD5
2234e6e3766cabb7f035a6594c5543ea

SHA1
e653bb43bb0a75ff998edb25ba341001992d8060

SHA256
786c0fb6a0caa4f38b4cb6c1dda99c9bb4b582426e223d21eac1adab944d5058

SHA512
5d81e841bb4aba90031f4b57b63edb814c3bde7f02b88de74b56547007ce65297b7181288d2c0cf4be4b9c4e1a31fc166946d1cffb2d2552f2e7082fac9437f5

Download Submit
\Windows\system\hLXYKde.exe

Filesize
1.8MB

MD5
5bc978522d9d2c0d52c285db42c9df4d

SHA1
2a9261823bd58f8c44830d7bcbdabb27f190e6dd

SHA256
7c8f27f1be161150de19394b16a6418d53b64da7911f7f99dc99a0c2e7ac5e29

SHA512
605ef2a008240a5d0d5aeece6a8c8eb7957f3ba647e9cc5de834b5ceaed136648f72eba487e0de40caf0409f886c465806be5d6e2e1fb492826c16c70b13bc17

Download Submit
\Windows\system\krCKLmy.exe

Filesize
1.9MB

MD5
7a87458d73d655eae2f5f72ed9bea355

SHA1
804d3d40c7d846dc9fd2cc79b3ff41dcef26e3ae

SHA256
3e5ee5dccb17be8eaad735fa1140683b36d8812a4a92ee200cf08655d4b438ff

SHA512
fe44593fcda433de1412944fef01944fd3baf761aa64cf3c8de152713d0ba007a6da7f0adc5a01652ca9daced0d20910fd8ccd559c154e15262689094f27a2d2

Download Submit
memory/2052-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2052-176-0x00000000033E0000-0x00000000037D2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-172-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2052-0-0x000000013F7F0000-0x000000013FBE2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-170-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-12-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-182-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-180-0x00000000033E0000-0x00000000037D2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-178-0x00000000033E0000-0x00000000037D2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-174-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2052-187-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/2360-171-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2408-179-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-183-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/2568-181-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-13-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2592-175-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-169-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2740-173-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2764-177-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2908-168-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/2908-167-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

Filesize
9.6MB

Download
memory/2908-14-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/2908-215-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2908-217-0x00000000028E0000-0x00000000028E8000-memory.dmp

Filesize
32KB

Download
memory/2908-489-0x000007FEF5710000-0x000007FEF60AD000-memory.dmp

Filesize
9.6MB

Download