xmrig | 2c2912b8abd2b5aa2bbe0992381e3a81177bd29c36bd7a44b7769a67f1e79a72

Analysis

max time kernel
10s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Size

1.9MB
MD5

05d1b4a137a2c5b590576a4632506abd
SHA1

179e2056dfdc86125fd016af68bcffadde1306fe
SHA256

2c2912b8abd2b5aa2bbe0992381e3a81177bd29c36bd7a44b7769a67f1e79a72
SHA512

1903a60ee9ea16ae75e13989193323d6d93e36c406919eca26b1eee256e3e3c2ee3cc98aa71adf9db72cf9ddba0129fe02f7ddb3ced6e43b288b96e901ccb283
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U0:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2492-191-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2704-189-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2892-186-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2584-184-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2604-183-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2672-178-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2596-176-0x000000013FB80000-0x000000013FF72000-memory.dmp	xmrig
behavioral1/memory/2544-196-0x000000013FB40000-0x000000013FF32000-memory.dmp	xmrig
behavioral1/memory/2192-195-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2192	GcVOSJT.exe
2544	bSQkjop.exe
2596	aDsWqwq.exe
2672	WRGqPDF.exe
2604	XBUApUz.exe
2584	AYlfxVY.exe
2892	gmSRMoJ.exe
2704	PPNvxjh.exe
2492	alypdZV.exe
2700	xHTzBNC.exe
2468	uZpCdLj.exe
2828	xQqdIUs.exe
2524	mYuywBw.exe
1728	BMjLwDP.exe
2244	EMWeUHJ.exe
1968	NpSycOE.exe
2876	BmHkrIw.exe
320	VMnOwnt.exe
2852	DFumWCR.exe
2512	qdooQdV.exe
2780	KYfAGGx.exe
2856	XsSOogH.exe
2636	IIAmMJP.exe
1872	iQLSYcc.exe
1568	AjjzVfR.exe
1444	FxsYwYO.exe
1288	hKSJNKU.exe
680	ILHwPvu.exe
812	nIYcjAd.exe
564	IICdWWn.exe
2228	PldPPun.exe
764	OvFZgAz.exe
992	JCUiapM.exe
1204	fwBCRfC.exe
2124	DPARUpL.exe
112	uJOldAC.exe
1192	GLiSGQD.exe
1200	IaXbYqw.exe
1784	pUYNgpx.exe
3060	PWMyuKJ.exe
3052	dXclJyK.exe
3064	uNmYiXT.exe
1000	dpvnymX.exe
1660	TkDXriB.exe
1464	tzUQbrb.exe
900	IMPGaLL.exe
1824	gSENwqo.exe
2944	oqkIPru.exe
2888	KhVNHMD.exe
1604	dVakckZ.exe
2164	tXzZGNE.exe
2532	TPqETbP.exe
2896	bOFCMJA.exe
2720	rUHWXGP.exe
2564	jUPfDhd.exe
2480	NYnSCDZ.exe
2748	sLZIiri.exe
2428	BcOoNVv.exe
2692	AiYsCmf.exe
2060	TVcAWbP.exe
2448	WclYnHi.exe
2776	UlRfBdE.exe
2848	hMezTzO.exe
2744	SaeDMwV.exe

Loads dropped DLL 64 IoCs

pid	Process
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/824-0-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/files/0x000b0000000149f5-3.dat	upx
behavioral1/files/0x0009000000015018-13.dat	upx
behavioral1/files/0x000f000000005578-20.dat	upx
behavioral1/files/0x0008000000015616-24.dat	upx
behavioral1/files/0x0007000000015c78-48.dat	upx
behavioral1/files/0x000a000000015b6f-33.dat	upx
behavioral1/files/0x0006000000015cf6-77.dat	upx
behavioral1/files/0x0006000000015d07-84.dat	upx
behavioral1/files/0x0007000000015c83-55.dat	upx
behavioral1/files/0x0006000000015d1a-99.dat	upx
behavioral1/files/0x0006000000015d31-106.dat	upx
behavioral1/files/0x0006000000015df1-113.dat	upx
behavioral1/files/0x0006000000016a29-161.dat	upx
behavioral1/files/0x0006000000016287-166.dat	upx
behavioral1/files/0x00060000000165ae-153.dat	upx
behavioral1/files/0x00060000000167d5-156.dat	upx
behavioral1/files/0x0006000000016448-144.dat	upx
behavioral1/files/0x0006000000016176-138.dat	upx
behavioral1/memory/2492-191-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2704-189-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2892-186-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/memory/2584-184-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2604-183-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2672-178-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2596-176-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/memory/2544-196-0x000000013FB40000-0x000000013FF32000-memory.dmp	upx
behavioral1/files/0x000600000001650c-147.dat	upx
behavioral1/files/0x00060000000160af-135.dat	upx
behavioral1/memory/2192-195-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/files/0x0006000000015f7a-129.dat	upx
behavioral1/files/0x0006000000015f01-124.dat	upx
behavioral1/files/0x0006000000015d98-109.dat	upx
behavioral1/files/0x0006000000015d27-104.dat	upx
behavioral1/files/0x0006000000015d0f-95.dat	upx
behavioral1/files/0x0006000000015cfe-93.dat	upx
behavioral1/files/0x0006000000015cee-83.dat	upx
behavioral1/files/0x0006000000015cb6-73.dat	upx
behavioral1/files/0x0006000000015cce-66.dat	upx
behavioral1/files/0x000a000000015c6b-44.dat	upx
behavioral1/files/0x0007000000015c9f-59.dat	upx
behavioral1/files/0x0007000000015626-32.dat	upx
behavioral1/files/0x000a000000015c52-38.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\tvWxTMs.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\lqcEuwn.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\MxbXdGc.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\rUhrUAx.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\NmxQBrR.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\QMnALFP.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\okuGEKO.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\WkQAmFy.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\oMARzSF.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\VVYSuAd.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ueKiAjI.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\gsoIAum.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\SUDgpXb.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\xsysiEW.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\dixgins.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jNZXCQY.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\TSwpDBj.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ZSPjpPp.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\PLvMTpl.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\IMPGaLL.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\iTmfMDc.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\cubXGov.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\COhZRfq.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\poAihhw.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\enKnnbx.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\nPDBjRb.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\kDgTspE.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\LxlzRfn.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\AvPkclv.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\BesLxFO.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\SgQONDp.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\aPuCguI.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\mCDeFmN.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\BbTMSwt.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\fUKevby.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\bLoNOdT.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\hbJdGDv.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\YjTiJlh.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\JYAjkwR.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\DOHyxYB.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\DGesrQC.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\zVlpkWO.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ENcbkfL.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\xkOJUBB.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\wBmTHPv.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\TCyxIUe.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\hNUxYvB.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\vEQeRXF.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\KOOlTAP.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\wcYauNk.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jCLWsRn.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\oqkIPru.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\ldNnFZZ.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\zxLucMq.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\wuQldGK.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\KpOADrd.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\jZSdqMh.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\kgJTOyR.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\EIJKlng.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\UCdpKkc.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\AItbnCB.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\mHjZbkb.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\SNqyNyr.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
File created	C:\Windows\System\BmHkrIw.exe	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2536	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
Token: SeDebugPrivilege	2536	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2536	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	29
PID 824 wrote to memory of 2536	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	29
PID 824 wrote to memory of 2536	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	29
PID 824 wrote to memory of 2192	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	30
PID 824 wrote to memory of 2192	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	30
PID 824 wrote to memory of 2192	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	30
PID 824 wrote to memory of 2544	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	31
PID 824 wrote to memory of 2544	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	31
PID 824 wrote to memory of 2544	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	31
PID 824 wrote to memory of 2596	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	32
PID 824 wrote to memory of 2596	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	32
PID 824 wrote to memory of 2596	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	32
PID 824 wrote to memory of 2672	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	33
PID 824 wrote to memory of 2672	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	33
PID 824 wrote to memory of 2672	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	33
PID 824 wrote to memory of 2604	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	34
PID 824 wrote to memory of 2604	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	34
PID 824 wrote to memory of 2604	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	34
PID 824 wrote to memory of 2584	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	35
PID 824 wrote to memory of 2584	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	35
PID 824 wrote to memory of 2584	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	35
PID 824 wrote to memory of 2892	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	36
PID 824 wrote to memory of 2892	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	36
PID 824 wrote to memory of 2892	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	36
PID 824 wrote to memory of 2704	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	37
PID 824 wrote to memory of 2704	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	37
PID 824 wrote to memory of 2704	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	37
PID 824 wrote to memory of 2492	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	38
PID 824 wrote to memory of 2492	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	38
PID 824 wrote to memory of 2492	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	38
PID 824 wrote to memory of 2700	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	39
PID 824 wrote to memory of 2700	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	39
PID 824 wrote to memory of 2700	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	39
PID 824 wrote to memory of 2468	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	40
PID 824 wrote to memory of 2468	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	40
PID 824 wrote to memory of 2468	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	40
PID 824 wrote to memory of 2524	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	41
PID 824 wrote to memory of 2524	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	41
PID 824 wrote to memory of 2524	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	41
PID 824 wrote to memory of 2828	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	42
PID 824 wrote to memory of 2828	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	42
PID 824 wrote to memory of 2828	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	42
PID 824 wrote to memory of 2244	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	43
PID 824 wrote to memory of 2244	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	43
PID 824 wrote to memory of 2244	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	43
PID 824 wrote to memory of 1728	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	44
PID 824 wrote to memory of 1728	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	44
PID 824 wrote to memory of 1728	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	44
PID 824 wrote to memory of 2876	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	45
PID 824 wrote to memory of 2876	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	45
PID 824 wrote to memory of 2876	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	45
PID 824 wrote to memory of 1968	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	46
PID 824 wrote to memory of 1968	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	46
PID 824 wrote to memory of 1968	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	46
PID 824 wrote to memory of 320	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	47
PID 824 wrote to memory of 320	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	47
PID 824 wrote to memory of 320	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	47
PID 824 wrote to memory of 2852	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	48
PID 824 wrote to memory of 2852	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	48
PID 824 wrote to memory of 2852	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	48
PID 824 wrote to memory of 2512	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	49
PID 824 wrote to memory of 2512	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	49
PID 824 wrote to memory of 2512	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	49
PID 824 wrote to memory of 2780	824	05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05d1b4a137a2c5b590576a4632506abd_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\System\GcVOSJT.exe
  C:\Windows\System\GcVOSJT.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\bSQkjop.exe
  C:\Windows\System\bSQkjop.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\aDsWqwq.exe
  C:\Windows\System\aDsWqwq.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\WRGqPDF.exe
  C:\Windows\System\WRGqPDF.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\XBUApUz.exe
  C:\Windows\System\XBUApUz.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\AYlfxVY.exe
  C:\Windows\System\AYlfxVY.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\gmSRMoJ.exe
  C:\Windows\System\gmSRMoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\PPNvxjh.exe
  C:\Windows\System\PPNvxjh.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\alypdZV.exe
  C:\Windows\System\alypdZV.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\xHTzBNC.exe
  C:\Windows\System\xHTzBNC.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\uZpCdLj.exe
  C:\Windows\System\uZpCdLj.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\mYuywBw.exe
  C:\Windows\System\mYuywBw.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\xQqdIUs.exe
  C:\Windows\System\xQqdIUs.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\EMWeUHJ.exe
  C:\Windows\System\EMWeUHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\BMjLwDP.exe
  C:\Windows\System\BMjLwDP.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\BmHkrIw.exe
  C:\Windows\System\BmHkrIw.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NpSycOE.exe
  C:\Windows\System\NpSycOE.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\VMnOwnt.exe
  C:\Windows\System\VMnOwnt.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\DFumWCR.exe
  C:\Windows\System\DFumWCR.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qdooQdV.exe
  C:\Windows\System\qdooQdV.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\KYfAGGx.exe
  C:\Windows\System\KYfAGGx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\IIAmMJP.exe
  C:\Windows\System\IIAmMJP.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\XsSOogH.exe
  C:\Windows\System\XsSOogH.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\iQLSYcc.exe
  C:\Windows\System\iQLSYcc.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\AjjzVfR.exe
  C:\Windows\System\AjjzVfR.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\FxsYwYO.exe
  C:\Windows\System\FxsYwYO.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\hKSJNKU.exe
  C:\Windows\System\hKSJNKU.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\PldPPun.exe
  C:\Windows\System\PldPPun.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\ILHwPvu.exe
  C:\Windows\System\ILHwPvu.exe
  2⤵
  - Executes dropped EXE
  PID:680
- C:\Windows\System\OvFZgAz.exe
  C:\Windows\System\OvFZgAz.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\nIYcjAd.exe
  C:\Windows\System\nIYcjAd.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\JCUiapM.exe
  C:\Windows\System\JCUiapM.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\IICdWWn.exe
  C:\Windows\System\IICdWWn.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\DPARUpL.exe
  C:\Windows\System\DPARUpL.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\fwBCRfC.exe
  C:\Windows\System\fwBCRfC.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\uJOldAC.exe
  C:\Windows\System\uJOldAC.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\GLiSGQD.exe
  C:\Windows\System\GLiSGQD.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\IaXbYqw.exe
  C:\Windows\System\IaXbYqw.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\pUYNgpx.exe
  C:\Windows\System\pUYNgpx.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\dpvnymX.exe
  C:\Windows\System\dpvnymX.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\PWMyuKJ.exe
  C:\Windows\System\PWMyuKJ.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\TkDXriB.exe
  C:\Windows\System\TkDXriB.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\dXclJyK.exe
  C:\Windows\System\dXclJyK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\tzUQbrb.exe
  C:\Windows\System\tzUQbrb.exe
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\System\uNmYiXT.exe
  C:\Windows\System\uNmYiXT.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\IMPGaLL.exe
  C:\Windows\System\IMPGaLL.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\gSENwqo.exe
  C:\Windows\System\gSENwqo.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\oqkIPru.exe
  C:\Windows\System\oqkIPru.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\KhVNHMD.exe
  C:\Windows\System\KhVNHMD.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\dVakckZ.exe
  C:\Windows\System\dVakckZ.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\tXzZGNE.exe
  C:\Windows\System\tXzZGNE.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\TPqETbP.exe
  C:\Windows\System\TPqETbP.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\bOFCMJA.exe
  C:\Windows\System\bOFCMJA.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\rUHWXGP.exe
  C:\Windows\System\rUHWXGP.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\jUPfDhd.exe
  C:\Windows\System\jUPfDhd.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\AiYsCmf.exe
  C:\Windows\System\AiYsCmf.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\NYnSCDZ.exe
  C:\Windows\System\NYnSCDZ.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\TVcAWbP.exe
  C:\Windows\System\TVcAWbP.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\sLZIiri.exe
  C:\Windows\System\sLZIiri.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\WclYnHi.exe
  C:\Windows\System\WclYnHi.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\BcOoNVv.exe
  C:\Windows\System\BcOoNVv.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\UlRfBdE.exe
  C:\Windows\System\UlRfBdE.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\hMezTzO.exe
  C:\Windows\System\hMezTzO.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\SaeDMwV.exe
  C:\Windows\System\SaeDMwV.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\KOOlTAP.exe
  C:\Windows\System\KOOlTAP.exe
  2⤵
  PID:3036
- C:\Windows\System\FKoghDd.exe
  C:\Windows\System\FKoghDd.exe
  2⤵
  PID:2032
- C:\Windows\System\yKCqgqy.exe
  C:\Windows\System\yKCqgqy.exe
  2⤵
  PID:2436
- C:\Windows\System\SBpEAyM.exe
  C:\Windows\System\SBpEAyM.exe
  2⤵
  PID:1536
- C:\Windows\System\CRWyuPC.exe
  C:\Windows\System\CRWyuPC.exe
  2⤵
  PID:2420
- C:\Windows\System\gshRkEF.exe
  C:\Windows\System\gshRkEF.exe
  2⤵
  PID:328
- C:\Windows\System\SZohRWb.exe
  C:\Windows\System\SZohRWb.exe
  2⤵
  PID:1808
- C:\Windows\System\qKzxgKT.exe
  C:\Windows\System\qKzxgKT.exe
  2⤵
  PID:620
- C:\Windows\System\JALsNym.exe
  C:\Windows\System\JALsNym.exe
  2⤵
  PID:332
- C:\Windows\System\WXojewy.exe
  C:\Windows\System\WXojewy.exe
  2⤵
  PID:2640
- C:\Windows\System\DOHyxYB.exe
  C:\Windows\System\DOHyxYB.exe
  2⤵
  PID:2620
- C:\Windows\System\fQZnLJu.exe
  C:\Windows\System\fQZnLJu.exe
  2⤵
  PID:2760
- C:\Windows\System\UnaeWty.exe
  C:\Windows\System\UnaeWty.exe
  2⤵
  PID:1652
- C:\Windows\System\iZRxNNC.exe
  C:\Windows\System\iZRxNNC.exe
  2⤵
  PID:2788
- C:\Windows\System\IimXzsI.exe
  C:\Windows\System\IimXzsI.exe
  2⤵
  PID:1092
- C:\Windows\System\GomkVIV.exe
  C:\Windows\System\GomkVIV.exe
  2⤵
  PID:1980
- C:\Windows\System\OORnOcB.exe
  C:\Windows\System\OORnOcB.exe
  2⤵
  PID:2832
- C:\Windows\System\ENcbkfL.exe
  C:\Windows\System\ENcbkfL.exe
  2⤵
  PID:1480
- C:\Windows\System\DxTdtnu.exe
  C:\Windows\System\DxTdtnu.exe
  2⤵
  PID:1868
- C:\Windows\System\SaRaRFn.exe
  C:\Windows\System\SaRaRFn.exe
  2⤵
  PID:2476
- C:\Windows\System\COxFMww.exe
  C:\Windows\System\COxFMww.exe
  2⤵
  PID:1080
- C:\Windows\System\lBputDl.exe
  C:\Windows\System\lBputDl.exe
  2⤵
  PID:2960
- C:\Windows\System\fgdlccD.exe
  C:\Windows\System\fgdlccD.exe
  2⤵
  PID:1164
- C:\Windows\System\WaqhevT.exe
  C:\Windows\System\WaqhevT.exe
  2⤵
  PID:880
- C:\Windows\System\JnCkIvQ.exe
  C:\Windows\System\JnCkIvQ.exe
  2⤵
  PID:2912
- C:\Windows\System\xcjSBZo.exe
  C:\Windows\System\xcjSBZo.exe
  2⤵
  PID:2948
- C:\Windows\System\teSvARx.exe
  C:\Windows\System\teSvARx.exe
  2⤵
  PID:2248
- C:\Windows\System\eLeXcdv.exe
  C:\Windows\System\eLeXcdv.exe
  2⤵
  PID:2376
- C:\Windows\System\FdwZfJC.exe
  C:\Windows\System\FdwZfJC.exe
  2⤵
  PID:848
- C:\Windows\System\KZBoFSb.exe
  C:\Windows\System\KZBoFSb.exe
  2⤵
  PID:2632
- C:\Windows\System\wDAusXv.exe
  C:\Windows\System\wDAusXv.exe
  2⤵
  PID:2128
- C:\Windows\System\wyniuFd.exe
  C:\Windows\System\wyniuFd.exe
  2⤵
  PID:1632
- C:\Windows\System\svXfIsT.exe
  C:\Windows\System\svXfIsT.exe
  2⤵
  PID:668
- C:\Windows\System\jpwkIkc.exe
  C:\Windows\System\jpwkIkc.exe
  2⤵
  PID:2664
- C:\Windows\System\BGcZSsI.exe
  C:\Windows\System\BGcZSsI.exe
  2⤵
  PID:2496
- C:\Windows\System\bLEFwmJ.exe
  C:\Windows\System\bLEFwmJ.exe
  2⤵
  PID:2988
- C:\Windows\System\tvWxTMs.exe
  C:\Windows\System\tvWxTMs.exe
  2⤵
  PID:2592
- C:\Windows\System\EYLMEMd.exe
  C:\Windows\System\EYLMEMd.exe
  2⤵
  PID:2992
- C:\Windows\System\ObnkJXV.exe
  C:\Windows\System\ObnkJXV.exe
  2⤵
  PID:3012
- C:\Windows\System\RPBxAEm.exe
  C:\Windows\System\RPBxAEm.exe
  2⤵
  PID:2796
- C:\Windows\System\JxykerB.exe
  C:\Windows\System\JxykerB.exe
  2⤵
  PID:1624
- C:\Windows\System\EZKUNjo.exe
  C:\Windows\System\EZKUNjo.exe
  2⤵
  PID:2816
- C:\Windows\System\iUMtJpP.exe
  C:\Windows\System\iUMtJpP.exe
  2⤵
  PID:2628
- C:\Windows\System\hbJdGDv.exe
  C:\Windows\System\hbJdGDv.exe
  2⤵
  PID:1592
- C:\Windows\System\ejzjqkv.exe
  C:\Windows\System\ejzjqkv.exe
  2⤵
  PID:540
- C:\Windows\System\xljDPCK.exe
  C:\Windows\System\xljDPCK.exe
  2⤵
  PID:2304
- C:\Windows\System\gvSDFNd.exe
  C:\Windows\System\gvSDFNd.exe
  2⤵
  PID:2548
- C:\Windows\System\GhVFCJm.exe
  C:\Windows\System\GhVFCJm.exe
  2⤵
  PID:1492
- C:\Windows\System\MwmYLMA.exe
  C:\Windows\System\MwmYLMA.exe
  2⤵
  PID:1680
- C:\Windows\System\adYXvDk.exe
  C:\Windows\System\adYXvDk.exe
  2⤵
  PID:2320
- C:\Windows\System\zSuzXKm.exe
  C:\Windows\System\zSuzXKm.exe
  2⤵
  PID:1628
- C:\Windows\System\juScWuV.exe
  C:\Windows\System\juScWuV.exe
  2⤵
  PID:1440
- C:\Windows\System\Dgyxftu.exe
  C:\Windows\System\Dgyxftu.exe
  2⤵
  PID:2996
- C:\Windows\System\xWQBOeB.exe
  C:\Windows\System\xWQBOeB.exe
  2⤵
  PID:636
- C:\Windows\System\yvYpvaP.exe
  C:\Windows\System\yvYpvaP.exe
  2⤵
  PID:3004
- C:\Windows\System\afHGupo.exe
  C:\Windows\System\afHGupo.exe
  2⤵
  PID:2464
- C:\Windows\System\RUjTBzz.exe
  C:\Windows\System\RUjTBzz.exe
  2⤵
  PID:2616
- C:\Windows\System\zRqmQSt.exe
  C:\Windows\System\zRqmQSt.exe
  2⤵
  PID:908
- C:\Windows\System\cHviOUB.exe
  C:\Windows\System\cHviOUB.exe
  2⤵
  PID:2784
- C:\Windows\System\gRPcQKM.exe
  C:\Windows\System\gRPcQKM.exe
  2⤵
  PID:108
- C:\Windows\System\AdwcIHw.exe
  C:\Windows\System\AdwcIHw.exe
  2⤵
  PID:1184
- C:\Windows\System\MnDCVUZ.exe
  C:\Windows\System\MnDCVUZ.exe
  2⤵
  PID:3044
- C:\Windows\System\LINLagN.exe
  C:\Windows\System\LINLagN.exe
  2⤵
  PID:1600
- C:\Windows\System\havHNlG.exe
  C:\Windows\System\havHNlG.exe
  2⤵
  PID:2732
- C:\Windows\System\nPDBjRb.exe
  C:\Windows\System\nPDBjRb.exe
  2⤵
  PID:1696
- C:\Windows\System\SSlSclc.exe
  C:\Windows\System\SSlSclc.exe
  2⤵
  PID:2812
- C:\Windows\System\mgmoYjN.exe
  C:\Windows\System\mgmoYjN.exe
  2⤵
  PID:604
- C:\Windows\System\MnbXZnz.exe
  C:\Windows\System\MnbXZnz.exe
  2⤵
  PID:2556
- C:\Windows\System\Uelekga.exe
  C:\Windows\System\Uelekga.exe
  2⤵
  PID:1956
- C:\Windows\System\lvsjyoa.exe
  C:\Windows\System\lvsjyoa.exe
  2⤵
  PID:2148
- C:\Windows\System\GzcAZcR.exe
  C:\Windows\System\GzcAZcR.exe
  2⤵
  PID:2900
- C:\Windows\System\MDpysgA.exe
  C:\Windows\System\MDpysgA.exe
  2⤵
  PID:1764
- C:\Windows\System\ueKiAjI.exe
  C:\Windows\System\ueKiAjI.exe
  2⤵
  PID:2268
- C:\Windows\System\DpeRlCQ.exe
  C:\Windows\System\DpeRlCQ.exe
  2⤵
  PID:2800
- C:\Windows\System\prZoKJp.exe
  C:\Windows\System\prZoKJp.exe
  2⤵
  PID:2100
- C:\Windows\System\OAbUpCM.exe
  C:\Windows\System\OAbUpCM.exe
  2⤵
  PID:2736
- C:\Windows\System\ecLYACv.exe
  C:\Windows\System\ecLYACv.exe
  2⤵
  PID:784
- C:\Windows\System\ORSqfhE.exe
  C:\Windows\System\ORSqfhE.exe
  2⤵
  PID:2088
- C:\Windows\System\JgsXFSB.exe
  C:\Windows\System\JgsXFSB.exe
  2⤵
  PID:3080
- C:\Windows\System\EIJKlng.exe
  C:\Windows\System\EIJKlng.exe
  2⤵
  PID:3096
- C:\Windows\System\JryRovq.exe
  C:\Windows\System\JryRovq.exe
  2⤵
  PID:3116
- C:\Windows\System\XYFZFSH.exe
  C:\Windows\System\XYFZFSH.exe
  2⤵
  PID:3132
- C:\Windows\System\vmeeVPA.exe
  C:\Windows\System\vmeeVPA.exe
  2⤵
  PID:3148
- C:\Windows\System\vWBlOCh.exe
  C:\Windows\System\vWBlOCh.exe
  2⤵
  PID:3164
- C:\Windows\System\ZIANcCi.exe
  C:\Windows\System\ZIANcCi.exe
  2⤵
  PID:3184
- C:\Windows\System\wcYauNk.exe
  C:\Windows\System\wcYauNk.exe
  2⤵
  PID:3200
- C:\Windows\System\tbbXYWk.exe
  C:\Windows\System\tbbXYWk.exe
  2⤵
  PID:3216
- C:\Windows\System\yOZSpiC.exe
  C:\Windows\System\yOZSpiC.exe
  2⤵
  PID:3232
- C:\Windows\System\FmHuKAE.exe
  C:\Windows\System\FmHuKAE.exe
  2⤵
  PID:3248
- C:\Windows\System\hFbdvJh.exe
  C:\Windows\System\hFbdvJh.exe
  2⤵
  PID:3264
- C:\Windows\System\JfGylwL.exe
  C:\Windows\System\JfGylwL.exe
  2⤵
  PID:3280
- C:\Windows\System\HnGPhqf.exe
  C:\Windows\System\HnGPhqf.exe
  2⤵
  PID:3296
- C:\Windows\System\OwCUMyl.exe
  C:\Windows\System\OwCUMyl.exe
  2⤵
  PID:3312
- C:\Windows\System\QSEcJKn.exe
  C:\Windows\System\QSEcJKn.exe
  2⤵
  PID:3328
- C:\Windows\System\yoqoUrC.exe
  C:\Windows\System\yoqoUrC.exe
  2⤵
  PID:3344
- C:\Windows\System\abCjAgq.exe
  C:\Windows\System\abCjAgq.exe
  2⤵
  PID:3360
- C:\Windows\System\zJGoKnc.exe
  C:\Windows\System\zJGoKnc.exe
  2⤵
  PID:3376
- C:\Windows\System\mstRGSQ.exe
  C:\Windows\System\mstRGSQ.exe
  2⤵
  PID:3392
- C:\Windows\System\zCgPsFI.exe
  C:\Windows\System\zCgPsFI.exe
  2⤵
  PID:3444
- C:\Windows\System\lXVODNx.exe
  C:\Windows\System\lXVODNx.exe
  2⤵
  PID:3460
- C:\Windows\System\bJbuCYg.exe
  C:\Windows\System\bJbuCYg.exe
  2⤵
  PID:3476
- C:\Windows\System\uxBsFSj.exe
  C:\Windows\System\uxBsFSj.exe
  2⤵
  PID:3492
- C:\Windows\System\IBwstiB.exe
  C:\Windows\System\IBwstiB.exe
  2⤵
  PID:3508
- C:\Windows\System\FXncYlM.exe
  C:\Windows\System\FXncYlM.exe
  2⤵
  PID:3524
- C:\Windows\System\YjTiJlh.exe
  C:\Windows\System\YjTiJlh.exe
  2⤵
  PID:3540
- C:\Windows\System\AXaDBzC.exe
  C:\Windows\System\AXaDBzC.exe
  2⤵
  PID:3560
- C:\Windows\System\PGxkUgr.exe
  C:\Windows\System\PGxkUgr.exe
  2⤵
  PID:3576
- C:\Windows\System\uvoeoxk.exe
  C:\Windows\System\uvoeoxk.exe
  2⤵
  PID:3592
- C:\Windows\System\fOYdgwZ.exe
  C:\Windows\System\fOYdgwZ.exe
  2⤵
  PID:3608
- C:\Windows\System\shBHMHS.exe
  C:\Windows\System\shBHMHS.exe
  2⤵
  PID:3624
- C:\Windows\System\pODFpVX.exe
  C:\Windows\System\pODFpVX.exe
  2⤵
  PID:3640
- C:\Windows\System\jleMnyl.exe
  C:\Windows\System\jleMnyl.exe
  2⤵
  PID:3656
- C:\Windows\System\kSrYfaW.exe
  C:\Windows\System\kSrYfaW.exe
  2⤵
  PID:3672
- C:\Windows\System\fWSVDed.exe
  C:\Windows\System\fWSVDed.exe
  2⤵
  PID:3688
- C:\Windows\System\ZWFnGde.exe
  C:\Windows\System\ZWFnGde.exe
  2⤵
  PID:3708
- C:\Windows\System\hsexpNI.exe
  C:\Windows\System\hsexpNI.exe
  2⤵
  PID:3728
- C:\Windows\System\GfHdXMX.exe
  C:\Windows\System\GfHdXMX.exe
  2⤵
  PID:3744
- C:\Windows\System\NPrrEnw.exe
  C:\Windows\System\NPrrEnw.exe
  2⤵
  PID:3760
- C:\Windows\System\CGnXSZC.exe
  C:\Windows\System\CGnXSZC.exe
  2⤵
  PID:3776
- C:\Windows\System\YRreADQ.exe
  C:\Windows\System\YRreADQ.exe
  2⤵
  PID:3792
- C:\Windows\System\bGhQjZd.exe
  C:\Windows\System\bGhQjZd.exe
  2⤵
  PID:3808
- C:\Windows\System\TCwjrDl.exe
  C:\Windows\System\TCwjrDl.exe
  2⤵
  PID:3824
- C:\Windows\System\YVCCLoj.exe
  C:\Windows\System\YVCCLoj.exe
  2⤵
  PID:3840
- C:\Windows\System\gRBEJrf.exe
  C:\Windows\System\gRBEJrf.exe
  2⤵
  PID:3856
- C:\Windows\System\yGSCIAE.exe
  C:\Windows\System\yGSCIAE.exe
  2⤵
  PID:3872
- C:\Windows\System\pPfJBwj.exe
  C:\Windows\System\pPfJBwj.exe
  2⤵
  PID:3888
- C:\Windows\System\iTmfMDc.exe
  C:\Windows\System\iTmfMDc.exe
  2⤵
  PID:3904
- C:\Windows\System\TjARrWB.exe
  C:\Windows\System\TjARrWB.exe
  2⤵
  PID:3920
- C:\Windows\System\ySOMKzc.exe
  C:\Windows\System\ySOMKzc.exe
  2⤵
  PID:3940
- C:\Windows\System\yjSzlHB.exe
  C:\Windows\System\yjSzlHB.exe
  2⤵
  PID:3956
- C:\Windows\System\leSRiPn.exe
  C:\Windows\System\leSRiPn.exe
  2⤵
  PID:3972
- C:\Windows\System\XJreyFr.exe
  C:\Windows\System\XJreyFr.exe
  2⤵
  PID:3988
- C:\Windows\System\KUcRcta.exe
  C:\Windows\System\KUcRcta.exe
  2⤵
  PID:4004
- C:\Windows\System\kOKiIBo.exe
  C:\Windows\System\kOKiIBo.exe
  2⤵
  PID:4020
- C:\Windows\System\jgXXOIw.exe
  C:\Windows\System\jgXXOIw.exe
  2⤵
  PID:4036
- C:\Windows\System\lqcEuwn.exe
  C:\Windows\System\lqcEuwn.exe
  2⤵
  PID:4052
- C:\Windows\System\gsoIAum.exe
  C:\Windows\System\gsoIAum.exe
  2⤵
  PID:4068
- C:\Windows\System\XzwGmsN.exe
  C:\Windows\System\XzwGmsN.exe
  2⤵
  PID:4084
- C:\Windows\System\JeUjBJw.exe
  C:\Windows\System\JeUjBJw.exe
  2⤵
  PID:1056
- C:\Windows\System\ePIRDwX.exe
  C:\Windows\System\ePIRDwX.exe
  2⤵
  PID:1612
- C:\Windows\System\AGMVIFH.exe
  C:\Windows\System\AGMVIFH.exe
  2⤵
  PID:3176
- C:\Windows\System\rEhivaO.exe
  C:\Windows\System\rEhivaO.exe
  2⤵
  PID:3104
- C:\Windows\System\olQzzob.exe
  C:\Windows\System\olQzzob.exe
  2⤵
  PID:3276
- C:\Windows\System\FcFGvSX.exe
  C:\Windows\System\FcFGvSX.exe
  2⤵
  PID:3340
- C:\Windows\System\hSxmdfo.exe
  C:\Windows\System\hSxmdfo.exe
  2⤵
  PID:3412
- C:\Windows\System\iUsKFYy.exe
  C:\Windows\System\iUsKFYy.exe
  2⤵
  PID:3428
- C:\Windows\System\alZRPKm.exe
  C:\Windows\System\alZRPKm.exe
  2⤵
  PID:2560
- C:\Windows\System\RSQsTsJ.exe
  C:\Windows\System\RSQsTsJ.exe
  2⤵
  PID:1984
- C:\Windows\System\IkLiNnm.exe
  C:\Windows\System\IkLiNnm.exe
  2⤵
  PID:3440
- C:\Windows\System\cubXGov.exe
  C:\Windows\System\cubXGov.exe
  2⤵
  PID:3468
- C:\Windows\System\lJwpXSZ.exe
  C:\Windows\System\lJwpXSZ.exe
  2⤵
  PID:3600
- C:\Windows\System\COhZRfq.exe
  C:\Windows\System\COhZRfq.exe
  2⤵
  PID:2952
- C:\Windows\System\hMaDQuI.exe
  C:\Windows\System\hMaDQuI.exe
  2⤵
  PID:1952
- C:\Windows\System\kDgTspE.exe
  C:\Windows\System\kDgTspE.exe
  2⤵
  PID:1532
- C:\Windows\System\pFHbXxJ.exe
  C:\Windows\System\pFHbXxJ.exe
  2⤵
  PID:2324
- C:\Windows\System\ubkDOHs.exe
  C:\Windows\System\ubkDOHs.exe
  2⤵
  PID:2168
- C:\Windows\System\CwYFPDm.exe
  C:\Windows\System\CwYFPDm.exe
  2⤵
  PID:2808
- C:\Windows\System\kihPJaD.exe
  C:\Windows\System\kihPJaD.exe
  2⤵
  PID:2688
- C:\Windows\System\itHrgIe.exe
  C:\Windows\System\itHrgIe.exe
  2⤵
  PID:3664
- C:\Windows\System\UYeyXSt.exe
  C:\Windows\System\UYeyXSt.exe
  2⤵
  PID:3736
- C:\Windows\System\yiByfsB.exe
  C:\Windows\System\yiByfsB.exe
  2⤵
  PID:3772
- C:\Windows\System\EoCgpTT.exe
  C:\Windows\System\EoCgpTT.exe
  2⤵
  PID:3836
- C:\Windows\System\YfImUxL.exe
  C:\Windows\System\YfImUxL.exe
  2⤵
  PID:3964
- C:\Windows\System\BesLxFO.exe
  C:\Windows\System\BesLxFO.exe
  2⤵
  PID:3932
- C:\Windows\System\twtZniz.exe
  C:\Windows\System\twtZniz.exe
  2⤵
  PID:3000
- C:\Windows\System\SySRluJ.exe
  C:\Windows\System\SySRluJ.exe
  2⤵
  PID:2568
- C:\Windows\System\UNJThry.exe
  C:\Windows\System\UNJThry.exe
  2⤵
  PID:772
- C:\Windows\System\JsjixNF.exe
  C:\Windows\System\JsjixNF.exe
  2⤵
  PID:1608
- C:\Windows\System\xkOJUBB.exe
  C:\Windows\System\xkOJUBB.exe
  2⤵
  PID:3092
- C:\Windows\System\AGDlCWO.exe
  C:\Windows\System\AGDlCWO.exe
  2⤵
  PID:3156
- C:\Windows\System\PJGxvJd.exe
  C:\Windows\System\PJGxvJd.exe
  2⤵
  PID:3224
- C:\Windows\System\NdawdkV.exe
  C:\Windows\System\NdawdkV.exe
  2⤵
  PID:3288
- C:\Windows\System\znZZLry.exe
  C:\Windows\System\znZZLry.exe
  2⤵
  PID:3352
- C:\Windows\System\gXCfhMX.exe
  C:\Windows\System\gXCfhMX.exe
  2⤵
  PID:3452
- C:\Windows\System\ZQOgVrG.exe
  C:\Windows\System\ZQOgVrG.exe
  2⤵
  PID:3516
- C:\Windows\System\wuQldGK.exe
  C:\Windows\System\wuQldGK.exe
  2⤵
  PID:3556
- C:\Windows\System\pHeYeEx.exe
  C:\Windows\System\pHeYeEx.exe
  2⤵
  PID:3620
- C:\Windows\System\XRcltcS.exe
  C:\Windows\System\XRcltcS.exe
  2⤵
  PID:3752
- C:\Windows\System\KzgZDgl.exe
  C:\Windows\System\KzgZDgl.exe
  2⤵
  PID:3756
- C:\Windows\System\opASXOY.exe
  C:\Windows\System\opASXOY.exe
  2⤵
  PID:3820
- C:\Windows\System\BLdchGi.exe
  C:\Windows\System\BLdchGi.exe
  2⤵
  PID:3884
- C:\Windows\System\eLwieFo.exe
  C:\Windows\System\eLwieFo.exe
  2⤵
  PID:3952
- C:\Windows\System\NDlexJd.exe
  C:\Windows\System\NDlexJd.exe
  2⤵
  PID:4028
- C:\Windows\System\FEQQAkq.exe
  C:\Windows\System\FEQQAkq.exe
  2⤵
  PID:4044
- C:\Windows\System\LYuOZfX.exe
  C:\Windows\System\LYuOZfX.exe
  2⤵
  PID:3076
- C:\Windows\System\mUvqksE.exe
  C:\Windows\System\mUvqksE.exe
  2⤵
  PID:4060
- C:\Windows\System\bzVJmHc.exe
  C:\Windows\System\bzVJmHc.exe
  2⤵
  PID:3172
- C:\Windows\System\xlcJdZT.exe
  C:\Windows\System\xlcJdZT.exe
  2⤵
  PID:448
- C:\Windows\System\INEaVUr.exe
  C:\Windows\System\INEaVUr.exe
  2⤵
  PID:2576
- C:\Windows\System\jbudEcK.exe
  C:\Windows\System\jbudEcK.exe
  2⤵
  PID:1284
- C:\Windows\System\zpWblOI.exe
  C:\Windows\System\zpWblOI.exe
  2⤵
  PID:2356
- C:\Windows\System\pOHmnyo.exe
  C:\Windows\System\pOHmnyo.exe
  2⤵
  PID:1132
- C:\Windows\System\jVvcFaW.exe
  C:\Windows\System\jVvcFaW.exe
  2⤵
  PID:3868
- C:\Windows\System\zyPJDnZ.exe
  C:\Windows\System\zyPJDnZ.exe
  2⤵
  PID:1312
- C:\Windows\System\MxbXdGc.exe
  C:\Windows\System\MxbXdGc.exe
  2⤵
  PID:2712
- C:\Windows\System\UCdpKkc.exe
  C:\Windows\System\UCdpKkc.exe
  2⤵
  PID:2964
- C:\Windows\System\osEJiGI.exe
  C:\Windows\System\osEJiGI.exe
  2⤵
  PID:3320
- C:\Windows\System\Vseoysb.exe
  C:\Windows\System\Vseoysb.exe
  2⤵
  PID:3212
- C:\Windows\System\xoBjxdw.exe
  C:\Windows\System\xoBjxdw.exe
  2⤵
  PID:3420
- C:\Windows\System\vBghWUF.exe
  C:\Windows\System\vBghWUF.exe
  2⤵
  PID:2160
- C:\Windows\System\EIxfDqF.exe
  C:\Windows\System\EIxfDqF.exe
  2⤵
  PID:3604
- C:\Windows\System\PejAchU.exe
  C:\Windows\System\PejAchU.exe
  2⤵
  PID:1904
- C:\Windows\System\JNTViUB.exe
  C:\Windows\System\JNTViUB.exe
  2⤵
  PID:3704
- C:\Windows\System\opTigIf.exe
  C:\Windows\System\opTigIf.exe
  2⤵
  PID:3804
- C:\Windows\System\mlusGop.exe
  C:\Windows\System\mlusGop.exe
  2⤵
  PID:3124
- C:\Windows\System\OGYOgNJ.exe
  C:\Windows\System\OGYOgNJ.exe
  2⤵
  PID:3488
- C:\Windows\System\gdTTBkm.exe
  C:\Windows\System\gdTTBkm.exe
  2⤵
  PID:3724
- C:\Windows\System\BeJgmLY.exe
  C:\Windows\System\BeJgmLY.exe
  2⤵
  PID:3548
- C:\Windows\System\vhYcWlj.exe
  C:\Windows\System\vhYcWlj.exe
  2⤵
  PID:3788
- C:\Windows\System\oxHptxQ.exe
  C:\Windows\System\oxHptxQ.exe
  2⤵
  PID:4012
- C:\Windows\System\VQVazwu.exe
  C:\Windows\System\VQVazwu.exe
  2⤵
  PID:3272
- C:\Windows\System\KpOADrd.exe
  C:\Windows\System\KpOADrd.exe
  2⤵
  PID:2644
- C:\Windows\System\XdIqwnl.exe
  C:\Windows\System\XdIqwnl.exe
  2⤵
  PID:2860
- C:\Windows\System\KwgLdNj.exe
  C:\Windows\System\KwgLdNj.exe
  2⤵
  PID:3208
- C:\Windows\System\GibYWyy.exe
  C:\Windows\System\GibYWyy.exe
  2⤵
  PID:3388
- C:\Windows\System\tkmSoky.exe
  C:\Windows\System\tkmSoky.exe
  2⤵
  PID:2680
- C:\Windows\System\IKlBadt.exe
  C:\Windows\System\IKlBadt.exe
  2⤵
  PID:4064
- C:\Windows\System\LxlzRfn.exe
  C:\Windows\System\LxlzRfn.exe
  2⤵
  PID:1540
- C:\Windows\System\AItbnCB.exe
  C:\Windows\System\AItbnCB.exe
  2⤵
  PID:3308
- C:\Windows\System\SaJcSyS.exe
  C:\Windows\System\SaJcSyS.exe
  2⤵
  PID:3260
- C:\Windows\System\iFHZPGC.exe
  C:\Windows\System\iFHZPGC.exe
  2⤵
  PID:3948
- C:\Windows\System\SRBOsLI.exe
  C:\Windows\System\SRBOsLI.exe
  2⤵
  PID:4000
- C:\Windows\System\ggiBbOK.exe
  C:\Windows\System\ggiBbOK.exe
  2⤵
  PID:3652
- C:\Windows\System\JvDgfoe.exe
  C:\Windows\System\JvDgfoe.exe
  2⤵
  PID:3832
- C:\Windows\System\EDJQQhD.exe
  C:\Windows\System\EDJQQhD.exe
  2⤵
  PID:896
- C:\Windows\System\aVoWyLo.exe
  C:\Windows\System\aVoWyLo.exe
  2⤵
  PID:1120
- C:\Windows\System\hlZIuUB.exe
  C:\Windows\System\hlZIuUB.exe
  2⤵
  PID:3196
- C:\Windows\System\TJikzHv.exe
  C:\Windows\System\TJikzHv.exe
  2⤵
  PID:3928
- C:\Windows\System\fATLlgN.exe
  C:\Windows\System\fATLlgN.exe
  2⤵
  PID:2312
- C:\Windows\System\wpWpgHo.exe
  C:\Windows\System\wpWpgHo.exe
  2⤵
  PID:3616
- C:\Windows\System\mxUbVYo.exe
  C:\Windows\System\mxUbVYo.exe
  2⤵
  PID:3680
- C:\Windows\System\QRrRvVM.exe
  C:\Windows\System\QRrRvVM.exe
  2⤵
  PID:4104
- C:\Windows\System\wMIrnVC.exe
  C:\Windows\System\wMIrnVC.exe
  2⤵
  PID:4120
- C:\Windows\System\YmgctUZ.exe
  C:\Windows\System\YmgctUZ.exe
  2⤵
  PID:4136
- C:\Windows\System\HtUEhBy.exe
  C:\Windows\System\HtUEhBy.exe
  2⤵
  PID:4156
- C:\Windows\System\mHjZbkb.exe
  C:\Windows\System\mHjZbkb.exe
  2⤵
  PID:4172
- C:\Windows\System\jQfjDlF.exe
  C:\Windows\System\jQfjDlF.exe
  2⤵
  PID:4188
- C:\Windows\System\SduDxrA.exe
  C:\Windows\System\SduDxrA.exe
  2⤵
  PID:4204
- C:\Windows\System\mKcagBJ.exe
  C:\Windows\System\mKcagBJ.exe
  2⤵
  PID:4220
- C:\Windows\System\ocTIOZb.exe
  C:\Windows\System\ocTIOZb.exe
  2⤵
  PID:4236
- C:\Windows\System\fIDgBMQ.exe
  C:\Windows\System\fIDgBMQ.exe
  2⤵
  PID:4252
- C:\Windows\System\XoPbVZU.exe
  C:\Windows\System\XoPbVZU.exe
  2⤵
  PID:4268
- C:\Windows\System\zFgZNpC.exe
  C:\Windows\System\zFgZNpC.exe
  2⤵
  PID:4284
- C:\Windows\System\RZxAhvI.exe
  C:\Windows\System\RZxAhvI.exe
  2⤵
  PID:4300
- C:\Windows\System\vhkxdYx.exe
  C:\Windows\System\vhkxdYx.exe
  2⤵
  PID:4316
- C:\Windows\System\ZWpYfEc.exe
  C:\Windows\System\ZWpYfEc.exe
  2⤵
  PID:4332
- C:\Windows\System\lIKkktJ.exe
  C:\Windows\System\lIKkktJ.exe
  2⤵
  PID:4348
- C:\Windows\System\qslcpMf.exe
  C:\Windows\System\qslcpMf.exe
  2⤵
  PID:4364
- C:\Windows\System\wBmTHPv.exe
  C:\Windows\System\wBmTHPv.exe
  2⤵
  PID:4380
- C:\Windows\System\dnfDvYV.exe
  C:\Windows\System\dnfDvYV.exe
  2⤵
  PID:4396
- C:\Windows\System\WSNBHSk.exe
  C:\Windows\System\WSNBHSk.exe
  2⤵
  PID:4412
- C:\Windows\System\UHDRGQv.exe
  C:\Windows\System\UHDRGQv.exe
  2⤵
  PID:4432
- C:\Windows\System\GAMRkXA.exe
  C:\Windows\System\GAMRkXA.exe
  2⤵
  PID:4452
- C:\Windows\System\ERnEHWi.exe
  C:\Windows\System\ERnEHWi.exe
  2⤵
  PID:4468
- C:\Windows\System\dixgins.exe
  C:\Windows\System\dixgins.exe
  2⤵
  PID:4484
- C:\Windows\System\KNWUcpQ.exe
  C:\Windows\System\KNWUcpQ.exe
  2⤵
  PID:4500
- C:\Windows\System\FnXcges.exe
  C:\Windows\System\FnXcges.exe
  2⤵
  PID:4516
- C:\Windows\System\nyKynXU.exe
  C:\Windows\System\nyKynXU.exe
  2⤵
  PID:4532
- C:\Windows\System\LpAEJlL.exe
  C:\Windows\System\LpAEJlL.exe
  2⤵
  PID:4548
- C:\Windows\System\SGvZaMK.exe
  C:\Windows\System\SGvZaMK.exe
  2⤵
  PID:4564
- C:\Windows\System\ldNnFZZ.exe
  C:\Windows\System\ldNnFZZ.exe
  2⤵
  PID:4580
- C:\Windows\System\TBlHXLy.exe
  C:\Windows\System\TBlHXLy.exe
  2⤵
  PID:4604
- C:\Windows\System\eIdzxbI.exe
  C:\Windows\System\eIdzxbI.exe
  2⤵
  PID:4620
- C:\Windows\System\chgXgHJ.exe
  C:\Windows\System\chgXgHJ.exe
  2⤵
  PID:4636
- C:\Windows\System\SgQONDp.exe
  C:\Windows\System\SgQONDp.exe
  2⤵
  PID:4656
- C:\Windows\System\nbbxQcf.exe
  C:\Windows\System\nbbxQcf.exe
  2⤵
  PID:4672
- C:\Windows\System\pCjGgWd.exe
  C:\Windows\System\pCjGgWd.exe
  2⤵
  PID:4688
- C:\Windows\System\PqxURAD.exe
  C:\Windows\System\PqxURAD.exe
  2⤵
  PID:4704
- C:\Windows\System\AhFpeyW.exe
  C:\Windows\System\AhFpeyW.exe
  2⤵
  PID:4720
- C:\Windows\System\rUhrUAx.exe
  C:\Windows\System\rUhrUAx.exe
  2⤵
  PID:4736
- C:\Windows\System\WkQAmFy.exe
  C:\Windows\System\WkQAmFy.exe
  2⤵
  PID:4752
- C:\Windows\System\tFqQzoz.exe
  C:\Windows\System\tFqQzoz.exe
  2⤵
  PID:4768
- C:\Windows\System\WHoSHPe.exe
  C:\Windows\System\WHoSHPe.exe
  2⤵
  PID:4784
- C:\Windows\System\aPuCguI.exe
  C:\Windows\System\aPuCguI.exe
  2⤵
  PID:4800
- C:\Windows\System\ctCVAZR.exe
  C:\Windows\System\ctCVAZR.exe
  2⤵
  PID:4816
- C:\Windows\System\TOOzbrh.exe
  C:\Windows\System\TOOzbrh.exe
  2⤵
  PID:4832
- C:\Windows\System\BHJoUKi.exe
  C:\Windows\System\BHJoUKi.exe
  2⤵
  PID:4848
- C:\Windows\System\SUDgpXb.exe
  C:\Windows\System\SUDgpXb.exe
  2⤵
  PID:4864
- C:\Windows\System\dSBTIzp.exe
  C:\Windows\System\dSBTIzp.exe
  2⤵
  PID:4880
- C:\Windows\System\ACoxUgU.exe
  C:\Windows\System\ACoxUgU.exe
  2⤵
  PID:4896
- C:\Windows\System\gKCWIBj.exe
  C:\Windows\System\gKCWIBj.exe
  2⤵
  PID:4912
- C:\Windows\System\mtnFRZL.exe
  C:\Windows\System\mtnFRZL.exe
  2⤵
  PID:4928
- C:\Windows\System\DUfAFic.exe
  C:\Windows\System\DUfAFic.exe
  2⤵
  PID:4944
- C:\Windows\System\MslgCJd.exe
  C:\Windows\System\MslgCJd.exe
  2⤵
  PID:4960
- C:\Windows\System\NDzyxhw.exe
  C:\Windows\System\NDzyxhw.exe
  2⤵
  PID:4976
- C:\Windows\System\BrIGbWO.exe
  C:\Windows\System\BrIGbWO.exe
  2⤵
  PID:4992
- C:\Windows\System\XLYnqxu.exe
  C:\Windows\System\XLYnqxu.exe
  2⤵
  PID:5008
- C:\Windows\System\WgcMmMy.exe
  C:\Windows\System\WgcMmMy.exe
  2⤵
  PID:5024
- C:\Windows\System\KnZKhcR.exe
  C:\Windows\System\KnZKhcR.exe
  2⤵
  PID:5040
- C:\Windows\System\cArBJWg.exe
  C:\Windows\System\cArBJWg.exe
  2⤵
  PID:5056
- C:\Windows\System\CnLXmqd.exe
  C:\Windows\System\CnLXmqd.exe
  2⤵
  PID:5072
- C:\Windows\System\mCDeFmN.exe
  C:\Windows\System\mCDeFmN.exe
  2⤵
  PID:5092
- C:\Windows\System\EJmuRth.exe
  C:\Windows\System\EJmuRth.exe
  2⤵
  PID:5108
- C:\Windows\System\LncqfNE.exe
  C:\Windows\System\LncqfNE.exe
  2⤵
  PID:3192
- C:\Windows\System\hwdWYXP.exe
  C:\Windows\System\hwdWYXP.exe
  2⤵
  PID:4112
- C:\Windows\System\nUbbwge.exe
  C:\Windows\System\nUbbwge.exe
  2⤵
  PID:2928
- C:\Windows\System\Fchatng.exe
  C:\Windows\System\Fchatng.exe
  2⤵
  PID:3996
- C:\Windows\System\oXyWyRq.exe
  C:\Windows\System\oXyWyRq.exe
  2⤵
  PID:4216
- C:\Windows\System\vLuZbVR.exe
  C:\Windows\System\vLuZbVR.exe
  2⤵
  PID:4276
- C:\Windows\System\EvSTXJS.exe
  C:\Windows\System\EvSTXJS.exe
  2⤵
  PID:4312
- C:\Windows\System\CTCDWzv.exe
  C:\Windows\System\CTCDWzv.exe
  2⤵
  PID:2416
- C:\Windows\System\xSMUZXq.exe
  C:\Windows\System\xSMUZXq.exe
  2⤵
  PID:2728
- C:\Windows\System\kKhxbRZ.exe
  C:\Windows\System\kKhxbRZ.exe
  2⤵
  PID:4100
- C:\Windows\System\gjXtDbp.exe
  C:\Windows\System\gjXtDbp.exe
  2⤵
  PID:4168
- C:\Windows\System\AvPkclv.exe
  C:\Windows\System\AvPkclv.exe
  2⤵
  PID:4232
- C:\Windows\System\DtbvCRy.exe
  C:\Windows\System\DtbvCRy.exe
  2⤵
  PID:4296
- C:\Windows\System\DkhvZiK.exe
  C:\Windows\System\DkhvZiK.exe
  2⤵
  PID:4360
- C:\Windows\System\oMARzSF.exe
  C:\Windows\System\oMARzSF.exe
  2⤵
  PID:4408
- C:\Windows\System\BbTMSwt.exe
  C:\Windows\System\BbTMSwt.exe
  2⤵
  PID:4480
- C:\Windows\System\JYAjkwR.exe
  C:\Windows\System\JYAjkwR.exe
  2⤵
  PID:4544
- C:\Windows\System\uodXOzS.exe
  C:\Windows\System\uodXOzS.exe
  2⤵
  PID:4388
- C:\Windows\System\HODCYsu.exe
  C:\Windows\System\HODCYsu.exe
  2⤵
  PID:4680
- C:\Windows\System\jNYdkIX.exe
  C:\Windows\System\jNYdkIX.exe
  2⤵
  PID:4748
- C:\Windows\System\fEbCrcJ.exe
  C:\Windows\System\fEbCrcJ.exe
  2⤵
  PID:4844
- C:\Windows\System\pHGwBHC.exe
  C:\Windows\System\pHGwBHC.exe
  2⤵
  PID:4940
- C:\Windows\System\poAihhw.exe
  C:\Windows\System\poAihhw.exe
  2⤵
  PID:4652
- C:\Windows\System\zVEFFFU.exe
  C:\Windows\System\zVEFFFU.exe
  2⤵
  PID:5036
- C:\Windows\System\drjEWey.exe
  C:\Windows\System\drjEWey.exe
  2⤵
  PID:4840
- C:\Windows\System\xTSAvxp.exe
  C:\Windows\System\xTSAvxp.exe
  2⤵
  PID:3768
- C:\Windows\System\vGlxoTo.exe
  C:\Windows\System\vGlxoTo.exe
  2⤵
  PID:5068
- C:\Windows\System\ttaEqXb.exe
  C:\Windows\System\ttaEqXb.exe
  2⤵
  PID:4344
- C:\Windows\System\WTpgdmd.exe
  C:\Windows\System\WTpgdmd.exe
  2⤵
  PID:3500
- C:\Windows\System\RnqPgOt.exe
  C:\Windows\System\RnqPgOt.exe
  2⤵
  PID:4956
- C:\Windows\System\SlfgFNY.exe
  C:\Windows\System\SlfgFNY.exe
  2⤵
  PID:4228
- C:\Windows\System\qWqEdvU.exe
  C:\Windows\System\qWqEdvU.exe
  2⤵
  PID:4356
- C:\Windows\System\zxLucMq.exe
  C:\Windows\System\zxLucMq.exe
  2⤵
  PID:4576
- C:\Windows\System\QKgqMXx.exe
  C:\Windows\System\QKgqMXx.exe
  2⤵
  PID:4496
- C:\Windows\System\JjlcXpE.exe
  C:\Windows\System\JjlcXpE.exe
  2⤵
  PID:4792
- C:\Windows\System\VHyUnVp.exe
  C:\Windows\System\VHyUnVp.exe
  2⤵
  PID:4924
- C:\Windows\System\aZPrqrr.exe
  C:\Windows\System\aZPrqrr.exe
  2⤵
  PID:5016
- C:\Windows\System\pwcEAPs.exe
  C:\Windows\System\pwcEAPs.exe
  2⤵
  PID:4596
- C:\Windows\System\AqGVOZM.exe
  C:\Windows\System\AqGVOZM.exe
  2⤵
  PID:4668
- C:\Windows\System\JGwMjTG.exe
  C:\Windows\System\JGwMjTG.exe
  2⤵
  PID:4760
- C:\Windows\System\xtwzIoZ.exe
  C:\Windows\System\xtwzIoZ.exe
  2⤵
  PID:4796
- C:\Windows\System\diEwTHG.exe
  C:\Windows\System\diEwTHG.exe
  2⤵
  PID:4164
- C:\Windows\System\VVYSuAd.exe
  C:\Windows\System\VVYSuAd.exe
  2⤵
  PID:4144
- C:\Windows\System\EAAkDGC.exe
  C:\Windows\System\EAAkDGC.exe
  2⤵
  PID:4744
- C:\Windows\System\DOKdctr.exe
  C:\Windows\System\DOKdctr.exe
  2⤵
  PID:4292
- C:\Windows\System\WfTqadm.exe
  C:\Windows\System\WfTqadm.exe
  2⤵
  PID:4540
- C:\Windows\System\vbtuGJn.exe
  C:\Windows\System\vbtuGJn.exe
  2⤵
  PID:5004
- C:\Windows\System\DGesrQC.exe
  C:\Windows\System\DGesrQC.exe
  2⤵
  PID:4212
- C:\Windows\System\XwGpPdg.exe
  C:\Windows\System\XwGpPdg.exe
  2⤵
  PID:4424
- C:\Windows\System\BFCOGmI.exe
  C:\Windows\System\BFCOGmI.exe
  2⤵
  PID:4492
- C:\Windows\System\PaOqZrF.exe
  C:\Windows\System\PaOqZrF.exe
  2⤵
  PID:5080
- C:\Windows\System\NmxQBrR.exe
  C:\Windows\System\NmxQBrR.exe
  2⤵
  PID:4828
- C:\Windows\System\kWBBRZr.exe
  C:\Windows\System\kWBBRZr.exe
  2⤵
  PID:4780
- C:\Windows\System\phacAhi.exe
  C:\Windows\System\phacAhi.exe
  2⤵
  PID:5100
- C:\Windows\System\HxvZCKU.exe
  C:\Windows\System\HxvZCKU.exe
  2⤵
  PID:3916
- C:\Windows\System\sLzGdHG.exe
  C:\Windows\System\sLzGdHG.exe
  2⤵
  PID:4444
- C:\Windows\System\ltRpBaw.exe
  C:\Windows\System\ltRpBaw.exe
  2⤵
  PID:4952
- C:\Windows\System\YVVqJyU.exe
  C:\Windows\System\YVVqJyU.exe
  2⤵
  PID:2152
- C:\Windows\System\jZSdqMh.exe
  C:\Windows\System\jZSdqMh.exe
  2⤵
  PID:4856
- C:\Windows\System\bxXgFwI.exe
  C:\Windows\System\bxXgFwI.exe
  2⤵
  PID:4264
- C:\Windows\System\hjqndFO.exe
  C:\Windows\System\hjqndFO.exe
  2⤵
  PID:5084
- C:\Windows\System\qQZtTzc.exe
  C:\Windows\System\qQZtTzc.exe
  2⤵
  PID:4644
- C:\Windows\System\rPuXOdz.exe
  C:\Windows\System\rPuXOdz.exe
  2⤵
  PID:4988
- C:\Windows\System\wASAWkv.exe
  C:\Windows\System\wASAWkv.exe
  2⤵
  PID:4616
- C:\Windows\System\jNZXCQY.exe
  C:\Windows\System\jNZXCQY.exe
  2⤵
  PID:5124
- C:\Windows\System\CqSOnLe.exe
  C:\Windows\System\CqSOnLe.exe
  2⤵
  PID:5140
- C:\Windows\System\tVZHKFG.exe
  C:\Windows\System\tVZHKFG.exe
  2⤵
  PID:5156
- C:\Windows\System\TSwpDBj.exe
  C:\Windows\System\TSwpDBj.exe
  2⤵
  PID:5176
- C:\Windows\System\zVlpkWO.exe
  C:\Windows\System\zVlpkWO.exe
  2⤵
  PID:5192
- C:\Windows\System\KNhBsEP.exe
  C:\Windows\System\KNhBsEP.exe
  2⤵
  PID:5208
- C:\Windows\System\MTYIIDp.exe
  C:\Windows\System\MTYIIDp.exe
  2⤵
  PID:5224
- C:\Windows\System\xSqdKfE.exe
  C:\Windows\System\xSqdKfE.exe
  2⤵
  PID:5240
- C:\Windows\System\DrNxcIN.exe
  C:\Windows\System\DrNxcIN.exe
  2⤵
  PID:5256
- C:\Windows\System\BOwfSJR.exe
  C:\Windows\System\BOwfSJR.exe
  2⤵
  PID:5272
- C:\Windows\System\QMnALFP.exe
  C:\Windows\System\QMnALFP.exe
  2⤵
  PID:5288
- C:\Windows\System\qaysuPQ.exe
  C:\Windows\System\qaysuPQ.exe
  2⤵
  PID:5304
- C:\Windows\System\amPpVUy.exe
  C:\Windows\System\amPpVUy.exe
  2⤵
  PID:5320
- C:\Windows\System\XhqbHOF.exe
  C:\Windows\System\XhqbHOF.exe
  2⤵
  PID:5340
- C:\Windows\System\ETyuYOW.exe
  C:\Windows\System\ETyuYOW.exe
  2⤵
  PID:5356
- C:\Windows\System\PviBZQp.exe
  C:\Windows\System\PviBZQp.exe
  2⤵
  PID:5372
- C:\Windows\System\TpVSVCS.exe
  C:\Windows\System\TpVSVCS.exe
  2⤵
  PID:5388
- C:\Windows\System\ZvjGEmD.exe
  C:\Windows\System\ZvjGEmD.exe
  2⤵
  PID:5404
- C:\Windows\System\LsNeAWg.exe
  C:\Windows\System\LsNeAWg.exe
  2⤵
  PID:5420
- C:\Windows\System\nodzhyT.exe
  C:\Windows\System\nodzhyT.exe
  2⤵
  PID:5436
- C:\Windows\System\BZbPRCA.exe
  C:\Windows\System\BZbPRCA.exe
  2⤵
  PID:5452
- C:\Windows\System\zlnZlIT.exe
  C:\Windows\System\zlnZlIT.exe
  2⤵
  PID:5468
- C:\Windows\System\bJHSdOF.exe
  C:\Windows\System\bJHSdOF.exe
  2⤵
  PID:5484
- C:\Windows\System\MvQwrKW.exe
  C:\Windows\System\MvQwrKW.exe
  2⤵
  PID:5500
- C:\Windows\System\RcCvJem.exe
  C:\Windows\System\RcCvJem.exe
  2⤵
  PID:5516
- C:\Windows\System\TCyxIUe.exe
  C:\Windows\System\TCyxIUe.exe
  2⤵
  PID:5532
- C:\Windows\System\jkOAcsC.exe
  C:\Windows\System\jkOAcsC.exe
  2⤵
  PID:5548
- C:\Windows\System\aBQgBZe.exe
  C:\Windows\System\aBQgBZe.exe
  2⤵
  PID:5564
- C:\Windows\System\hNUxYvB.exe
  C:\Windows\System\hNUxYvB.exe
  2⤵
  PID:5580
- C:\Windows\System\TqEHcPp.exe
  C:\Windows\System\TqEHcPp.exe
  2⤵
  PID:5596
- C:\Windows\System\YHWPEzu.exe
  C:\Windows\System\YHWPEzu.exe
  2⤵
  PID:5612
- C:\Windows\System\XZoHMNS.exe
  C:\Windows\System\XZoHMNS.exe
  2⤵
  PID:5628
- C:\Windows\System\QYPtZZG.exe
  C:\Windows\System\QYPtZZG.exe
  2⤵
  PID:5644
- C:\Windows\System\fUKevby.exe
  C:\Windows\System\fUKevby.exe
  2⤵
  PID:5660
- C:\Windows\System\ZCGfATm.exe
  C:\Windows\System\ZCGfATm.exe
  2⤵
  PID:5676
- C:\Windows\System\OpHzdYq.exe
  C:\Windows\System\OpHzdYq.exe
  2⤵
  PID:5692
- C:\Windows\System\VIMEBNP.exe
  C:\Windows\System\VIMEBNP.exe
  2⤵
  PID:5708
- C:\Windows\System\sTtMBEC.exe
  C:\Windows\System\sTtMBEC.exe
  2⤵
  PID:5724
- C:\Windows\System\PqxfaoV.exe
  C:\Windows\System\PqxfaoV.exe
  2⤵
  PID:5740
- C:\Windows\System\eAEtunA.exe
  C:\Windows\System\eAEtunA.exe
  2⤵
  PID:5756
- C:\Windows\System\NkLkHii.exe
  C:\Windows\System\NkLkHii.exe
  2⤵
  PID:5772
- C:\Windows\System\OXiZrmT.exe
  C:\Windows\System\OXiZrmT.exe
  2⤵
  PID:5788
- C:\Windows\System\VuynGGW.exe
  C:\Windows\System\VuynGGW.exe
  2⤵
  PID:5804
- C:\Windows\System\CsKePzf.exe
  C:\Windows\System\CsKePzf.exe
  2⤵
  PID:5820
- C:\Windows\System\cqznhEI.exe
  C:\Windows\System\cqznhEI.exe
  2⤵
  PID:5836
- C:\Windows\System\MWwSXpq.exe
  C:\Windows\System\MWwSXpq.exe
  2⤵
  PID:5852
- C:\Windows\System\YfCWRbA.exe
  C:\Windows\System\YfCWRbA.exe
  2⤵
  PID:5868
- C:\Windows\System\sGMjyFl.exe
  C:\Windows\System\sGMjyFl.exe
  2⤵
  PID:5884
- C:\Windows\System\aDKGqZK.exe
  C:\Windows\System\aDKGqZK.exe
  2⤵
  PID:5900
- C:\Windows\System\TEhlohL.exe
  C:\Windows\System\TEhlohL.exe
  2⤵
  PID:5916
- C:\Windows\System\BPAyABg.exe
  C:\Windows\System\BPAyABg.exe
  2⤵
  PID:5932
- C:\Windows\System\MFTSFZM.exe
  C:\Windows\System\MFTSFZM.exe
  2⤵
  PID:5948
- C:\Windows\System\aQIMAVt.exe
  C:\Windows\System\aQIMAVt.exe
  2⤵
  PID:5964
- C:\Windows\System\PXWGhvG.exe
  C:\Windows\System\PXWGhvG.exe
  2⤵
  PID:5980
- C:\Windows\System\NpsSNoD.exe
  C:\Windows\System\NpsSNoD.exe
  2⤵
  PID:5996
- C:\Windows\System\DbUEeop.exe
  C:\Windows\System\DbUEeop.exe
  2⤵
  PID:6012
- C:\Windows\System\YFRVsyf.exe
  C:\Windows\System\YFRVsyf.exe
  2⤵
  PID:6032
- C:\Windows\System\zWoRPbi.exe
  C:\Windows\System\zWoRPbi.exe
  2⤵
  PID:6048
- C:\Windows\System\obQNHyK.exe
  C:\Windows\System\obQNHyK.exe
  2⤵
  PID:6064
- C:\Windows\System\lLkyZBk.exe
  C:\Windows\System\lLkyZBk.exe
  2⤵
  PID:6080
- C:\Windows\System\KgujTKb.exe
  C:\Windows\System\KgujTKb.exe
  2⤵
  PID:6096
- C:\Windows\System\KxQxCDS.exe
  C:\Windows\System\KxQxCDS.exe
  2⤵
  PID:6112
- C:\Windows\System\WPQtTuG.exe
  C:\Windows\System\WPQtTuG.exe
  2⤵
  PID:6128
- C:\Windows\System\RnqEZcN.exe
  C:\Windows\System\RnqEZcN.exe
  2⤵
  PID:4728
- C:\Windows\System\KREIdcV.exe
  C:\Windows\System\KREIdcV.exe
  2⤵
  PID:5132
- C:\Windows\System\wTMyeTi.exe
  C:\Windows\System\wTMyeTi.exe
  2⤵
  PID:5172
- C:\Windows\System\jimptKF.exe
  C:\Windows\System\jimptKF.exe
  2⤵
  PID:4560
- C:\Windows\System\KgeUdRW.exe
  C:\Windows\System\KgeUdRW.exe
  2⤵
  PID:4524
- C:\Windows\System\hUQHMCl.exe
  C:\Windows\System\hUQHMCl.exe
  2⤵
  PID:1296
- C:\Windows\System\xFhSeuc.exe
  C:\Windows\System\xFhSeuc.exe
  2⤵
  PID:4876
- C:\Windows\System\BStGEOF.exe
  C:\Windows\System\BStGEOF.exe
  2⤵
  PID:4712
- C:\Windows\System\jzuxLjk.exe
  C:\Windows\System\jzuxLjk.exe
  2⤵
  PID:5268
- C:\Windows\System\FOBJzGg.exe
  C:\Windows\System\FOBJzGg.exe
  2⤵
  PID:5252
- C:\Windows\System\rhmeAbO.exe
  C:\Windows\System\rhmeAbO.exe
  2⤵
  PID:5464
- C:\Windows\System\jCLWsRn.exe
  C:\Windows\System\jCLWsRn.exe
  2⤵
  PID:5412
- C:\Windows\System\pHskguY.exe
  C:\Windows\System\pHskguY.exe
  2⤵
  PID:5448
- C:\Windows\System\pNcmJSR.exe
  C:\Windows\System\pNcmJSR.exe
  2⤵
  PID:5560
- C:\Windows\System\vWUmyNu.exe
  C:\Windows\System\vWUmyNu.exe
  2⤵
  PID:5592
- C:\Windows\System\SZvkhbF.exe
  C:\Windows\System\SZvkhbF.exe
  2⤵
  PID:5608
- C:\Windows\System\cHLpmHL.exe
  C:\Windows\System\cHLpmHL.exe
  2⤵
  PID:5684
- C:\Windows\System\rWZROUc.exe
  C:\Windows\System\rWZROUc.exe
  2⤵
  PID:5748
- C:\Windows\System\SJQFZzp.exe
  C:\Windows\System\SJQFZzp.exe
  2⤵
  PID:5812
- C:\Windows\System\bTgxGAF.exe
  C:\Windows\System\bTgxGAF.exe
  2⤵
  PID:5640
- C:\Windows\System\FvUxhJA.exe
  C:\Windows\System\FvUxhJA.exe
  2⤵
  PID:5704
- C:\Windows\System\fUtTYvt.exe
  C:\Windows\System\fUtTYvt.exe
  2⤵
  PID:5844
- C:\Windows\System\ZINobLO.exe
  C:\Windows\System\ZINobLO.exe
  2⤵
  PID:5908
- C:\Windows\System\bBdvYFD.exe
  C:\Windows\System\bBdvYFD.exe
  2⤵
  PID:5972
- C:\Windows\System\gaudnbH.exe
  C:\Windows\System\gaudnbH.exe
  2⤵
  PID:5800
- C:\Windows\System\CQPrHbo.exe
  C:\Windows\System\CQPrHbo.exe
  2⤵
  PID:6076
- C:\Windows\System\SBtioAp.exe
  C:\Windows\System\SBtioAp.exe
  2⤵
  PID:6136
- C:\Windows\System\wPSJTcz.exe
  C:\Windows\System\wPSJTcz.exe
  2⤵
  PID:5168
- C:\Windows\System\lMUlehy.exe
  C:\Windows\System\lMUlehy.exe
  2⤵
  PID:5860
- C:\Windows\System\cUQAFRv.exe
  C:\Windows\System\cUQAFRv.exe
  2⤵
  PID:4592
- C:\Windows\System\BJQatfg.exe
  C:\Windows\System\BJQatfg.exe
  2⤵
  PID:5988
- C:\Windows\System\QlnbnqG.exe
  C:\Windows\System\QlnbnqG.exe
  2⤵
  PID:5924
- C:\Windows\System\fZjgcNT.exe
  C:\Windows\System\fZjgcNT.exe
  2⤵
  PID:5960
- C:\Windows\System\nSesJcw.exe
  C:\Windows\System\nSesJcw.exe
  2⤵
  PID:6060
- C:\Windows\System\ZpSCZoc.exe
  C:\Windows\System\ZpSCZoc.exe
  2⤵
  PID:6124
- C:\Windows\System\hVhIKXy.exe
  C:\Windows\System\hVhIKXy.exe
  2⤵
  PID:4812
- C:\Windows\System\sKaGmtv.exe
  C:\Windows\System\sKaGmtv.exe
  2⤵
  PID:4464
- C:\Windows\System\kgJTOyR.exe
  C:\Windows\System\kgJTOyR.exe
  2⤵
  PID:5188
- C:\Windows\System\XHvjYTW.exe
  C:\Windows\System\XHvjYTW.exe
  2⤵
  PID:5496
- C:\Windows\System\nEXVucv.exe
  C:\Windows\System\nEXVucv.exe
  2⤵
  PID:5528
- C:\Windows\System\aDEVGKg.exe
  C:\Windows\System\aDEVGKg.exe
  2⤵
  PID:5588
- C:\Windows\System\bLoNOdT.exe
  C:\Windows\System\bLoNOdT.exe
  2⤵
  PID:5316
- C:\Windows\System\xbkKLrI.exe
  C:\Windows\System\xbkKLrI.exe
  2⤵
  PID:5620
- C:\Windows\System\Esthstl.exe
  C:\Windows\System\Esthstl.exe
  2⤵
  PID:5604
- C:\Windows\System\zbDdfZk.exe
  C:\Windows\System\zbDdfZk.exe
  2⤵
  PID:5672
- C:\Windows\System\BUAesmA.exe
  C:\Windows\System\BUAesmA.exe
  2⤵
  PID:5204
- C:\Windows\System\ZSPjpPp.exe
  C:\Windows\System\ZSPjpPp.exe
  2⤵
  PID:5956
- C:\Windows\System\rneJYXT.exe
  C:\Windows\System\rneJYXT.exe
  2⤵
  PID:4404
- C:\Windows\System\KjLbwZm.exe
  C:\Windows\System\KjLbwZm.exe
  2⤵
  PID:5556
- C:\Windows\System\zZGjcuM.exe
  C:\Windows\System\zZGjcuM.exe
  2⤵
  PID:5784
- C:\Windows\System\fBXMdyw.exe
  C:\Windows\System\fBXMdyw.exe
  2⤵
  PID:6028
- C:\Windows\System\zFsvJaC.exe
  C:\Windows\System\zFsvJaC.exe
  2⤵
  PID:5508
- C:\Windows\System\tekcOdE.exe
  C:\Windows\System\tekcOdE.exe
  2⤵
  PID:5828
- C:\Windows\System\XogYUwx.exe
  C:\Windows\System\XogYUwx.exe
  2⤵
  PID:5732
- C:\Windows\System\NXauTEM.exe
  C:\Windows\System\NXauTEM.exe
  2⤵
  PID:5940
- C:\Windows\System\DovvIjs.exe
  C:\Windows\System\DovvIjs.exe
  2⤵
  PID:6056
- C:\Windows\System\FFFUFwg.exe
  C:\Windows\System\FFFUFwg.exe
  2⤵
  PID:5572
- C:\Windows\System\cVztiYH.exe
  C:\Windows\System\cVztiYH.exe
  2⤵
  PID:5896
- C:\Windows\System\PqWsVig.exe
  C:\Windows\System\PqWsVig.exe
  2⤵
  PID:5796
- C:\Windows\System\ArkoTYD.exe
  C:\Windows\System\ArkoTYD.exe
  2⤵
  PID:6020
- C:\Windows\System\lYrgUnl.exe
  C:\Windows\System\lYrgUnl.exe
  2⤵
  PID:5652
- C:\Windows\System\jJTBvvP.exe
  C:\Windows\System\jJTBvvP.exe
  2⤵
  PID:5880
- C:\Windows\System\JbrbCea.exe
  C:\Windows\System\JbrbCea.exe
  2⤵
  PID:5216
- C:\Windows\System\qGxyIoO.exe
  C:\Windows\System\qGxyIoO.exe
  2⤵
  PID:6008
- C:\Windows\System\JAPGySR.exe
  C:\Windows\System\JAPGySR.exe
  2⤵
  PID:5384
- C:\Windows\System\BtWZDRO.exe
  C:\Windows\System\BtWZDRO.exe
  2⤵
  PID:5476
- C:\Windows\System\okuGEKO.exe
  C:\Windows\System\okuGEKO.exe
  2⤵
  PID:6108
- C:\Windows\System\RcxxOqP.exe
  C:\Windows\System\RcxxOqP.exe
  2⤵
  PID:6152
- C:\Windows\System\XEWPWad.exe
  C:\Windows\System\XEWPWad.exe
  2⤵
  PID:6168
- C:\Windows\System\MRwTiwi.exe
  C:\Windows\System\MRwTiwi.exe
  2⤵
  PID:6184
- C:\Windows\System\IWByiDb.exe
  C:\Windows\System\IWByiDb.exe
  2⤵
  PID:6200
- C:\Windows\System\tAMEwmx.exe
  C:\Windows\System\tAMEwmx.exe
  2⤵
  PID:6216
- C:\Windows\System\mVSAbCC.exe
  C:\Windows\System\mVSAbCC.exe
  2⤵
  PID:6232
- C:\Windows\System\mYTOiZQ.exe
  C:\Windows\System\mYTOiZQ.exe
  2⤵
  PID:6248
- C:\Windows\System\OzHJeWY.exe
  C:\Windows\System\OzHJeWY.exe
  2⤵
  PID:6264
- C:\Windows\System\KcdVyxC.exe
  C:\Windows\System\KcdVyxC.exe
  2⤵
  PID:6280
- C:\Windows\System\XEUwxju.exe
  C:\Windows\System\XEUwxju.exe
  2⤵
  PID:6296
- C:\Windows\System\shucTPy.exe
  C:\Windows\System\shucTPy.exe
  2⤵
  PID:6312
- C:\Windows\System\OBLuTfS.exe
  C:\Windows\System\OBLuTfS.exe
  2⤵
  PID:6328
- C:\Windows\System\SNqyNyr.exe
  C:\Windows\System\SNqyNyr.exe
  2⤵
  PID:6352
- C:\Windows\System\pFkaYVv.exe
  C:\Windows\System\pFkaYVv.exe
  2⤵
  PID:6368
- C:\Windows\System\wdwgZsP.exe
  C:\Windows\System\wdwgZsP.exe
  2⤵
  PID:6384
- C:\Windows\System\RKPQusL.exe
  C:\Windows\System\RKPQusL.exe
  2⤵
  PID:6400
- C:\Windows\System\HEQeVYs.exe
  C:\Windows\System\HEQeVYs.exe
  2⤵
  PID:6416
- C:\Windows\System\ZgLHGNG.exe
  C:\Windows\System\ZgLHGNG.exe
  2⤵
  PID:6432
- C:\Windows\System\AsnMFMF.exe
  C:\Windows\System\AsnMFMF.exe
  2⤵
  PID:6448
- C:\Windows\System\KwbZOOE.exe
  C:\Windows\System\KwbZOOE.exe
  2⤵
  PID:6464
- C:\Windows\System\xsysiEW.exe
  C:\Windows\System\xsysiEW.exe
  2⤵
  PID:6484
- C:\Windows\System\Fbbgtef.exe
  C:\Windows\System\Fbbgtef.exe
  2⤵
  PID:6500
- C:\Windows\System\BYjzUiC.exe
  C:\Windows\System\BYjzUiC.exe
  2⤵
  PID:6516
- C:\Windows\System\jvuzIFs.exe
  C:\Windows\System\jvuzIFs.exe
  2⤵
  PID:6532
- C:\Windows\System\rXsozPy.exe
  C:\Windows\System\rXsozPy.exe
  2⤵
  PID:6548
- C:\Windows\System\qzmhfxX.exe
  C:\Windows\System\qzmhfxX.exe
  2⤵
  PID:6568
- C:\Windows\System\fYlRrJw.exe
  C:\Windows\System\fYlRrJw.exe
  2⤵
  PID:6584
- C:\Windows\System\WizcAOh.exe
  C:\Windows\System\WizcAOh.exe
  2⤵
  PID:6600
- C:\Windows\System\tdfDZrm.exe
  C:\Windows\System\tdfDZrm.exe
  2⤵
  PID:6616
- C:\Windows\System\zWyTFZS.exe
  C:\Windows\System\zWyTFZS.exe
  2⤵
  PID:6632
- C:\Windows\System\UTzXFUZ.exe
  C:\Windows\System\UTzXFUZ.exe
  2⤵
  PID:6652
- C:\Windows\System\bpFjTbn.exe
  C:\Windows\System\bpFjTbn.exe
  2⤵
  PID:6668
- C:\Windows\System\oWjveXZ.exe
  C:\Windows\System\oWjveXZ.exe
  2⤵
  PID:6684
- C:\Windows\System\oyDZvmd.exe
  C:\Windows\System\oyDZvmd.exe
  2⤵
  PID:6704
- C:\Windows\System\ClvIUTh.exe
  C:\Windows\System\ClvIUTh.exe
  2⤵
  PID:6720
- C:\Windows\System\FoOvNSk.exe
  C:\Windows\System\FoOvNSk.exe
  2⤵
  PID:6736
- C:\Windows\System\Naobhhq.exe
  C:\Windows\System\Naobhhq.exe
  2⤵
  PID:6752
- C:\Windows\System\eQtiQZE.exe
  C:\Windows\System\eQtiQZE.exe
  2⤵
  PID:6772
- C:\Windows\System\uZzaQsB.exe
  C:\Windows\System\uZzaQsB.exe
  2⤵
  PID:6788
- C:\Windows\System\ZrAHXwi.exe
  C:\Windows\System\ZrAHXwi.exe
  2⤵
  PID:6804
- C:\Windows\System\zLxuTyH.exe
  C:\Windows\System\zLxuTyH.exe
  2⤵
  PID:6820
- C:\Windows\System\tCWPawq.exe
  C:\Windows\System\tCWPawq.exe
  2⤵
  PID:6840
- C:\Windows\System\dquwlnL.exe
  C:\Windows\System\dquwlnL.exe
  2⤵
  PID:6856
- C:\Windows\System\SvybQpS.exe
  C:\Windows\System\SvybQpS.exe
  2⤵
  PID:6880
- C:\Windows\System\fBElmoK.exe
  C:\Windows\System\fBElmoK.exe
  2⤵
  PID:6896
- C:\Windows\System\WdWWDZu.exe
  C:\Windows\System\WdWWDZu.exe
  2⤵
  PID:6912
- C:\Windows\System\dCkYmNb.exe
  C:\Windows\System\dCkYmNb.exe
  2⤵
  PID:6932
- C:\Windows\System\MmTHioM.exe
  C:\Windows\System\MmTHioM.exe
  2⤵
  PID:6948
- C:\Windows\System\MAgDbai.exe
  C:\Windows\System\MAgDbai.exe
  2⤵
  PID:6964
- C:\Windows\System\MMQqxWc.exe
  C:\Windows\System\MMQqxWc.exe
  2⤵
  PID:6984
- C:\Windows\System\gUcHyep.exe
  C:\Windows\System\gUcHyep.exe
  2⤵
  PID:7000
- C:\Windows\System\OfWgDti.exe
  C:\Windows\System\OfWgDti.exe
  2⤵
  PID:7016
- C:\Windows\System\MPyoerl.exe
  C:\Windows\System\MPyoerl.exe
  2⤵
  PID:7032
- C:\Windows\System\vEQeRXF.exe
  C:\Windows\System\vEQeRXF.exe
  2⤵
  PID:7048
- C:\Windows\System\ZMpBPHj.exe
  C:\Windows\System\ZMpBPHj.exe
  2⤵
  PID:7068
- C:\Windows\System\UGSHLCP.exe
  C:\Windows\System\UGSHLCP.exe
  2⤵
  PID:7084
- C:\Windows\System\PLvMTpl.exe
  C:\Windows\System\PLvMTpl.exe
  2⤵
  PID:7100
- C:\Windows\System\rpFrDKe.exe
  C:\Windows\System\rpFrDKe.exe
  2⤵
  PID:7116
- C:\Windows\System\zkUZoyB.exe
  C:\Windows\System\zkUZoyB.exe
  2⤵
  PID:7132
- C:\Windows\System\kfDDIRN.exe
  C:\Windows\System\kfDDIRN.exe
  2⤵
  PID:7148
- C:\Windows\System\kAcAwPK.exe
  C:\Windows\System\kAcAwPK.exe
  2⤵
  PID:6160
- C:\Windows\System\AdQqpTv.exe
  C:\Windows\System\AdQqpTv.exe
  2⤵
  PID:6192
- C:\Windows\System\LAnaQso.exe
  C:\Windows\System\LAnaQso.exe
  2⤵
  PID:6256
- C:\Windows\System\mXanmtr.exe
  C:\Windows\System\mXanmtr.exe
  2⤵
  PID:6320
- C:\Windows\System\eowLBFz.exe
  C:\Windows\System\eowLBFz.exe
  2⤵
  PID:5032
- C:\Windows\System\KMhCjgO.exe
  C:\Windows\System\KMhCjgO.exe
  2⤵
  PID:6396
- C:\Windows\System\GvABpGi.exe
  C:\Windows\System\GvABpGi.exe
  2⤵
  PID:6424
- C:\Windows\System\enKnnbx.exe
  C:\Windows\System\enKnnbx.exe
  2⤵
  PID:6456
- C:\Windows\System\RSKGnEK.exe
  C:\Windows\System\RSKGnEK.exe
  2⤵
  PID:6148
- C:\Windows\System\zksIbYi.exe
  C:\Windows\System\zksIbYi.exe
  2⤵
  PID:6240
- C:\Windows\System\EKcfdCI.exe
  C:\Windows\System\EKcfdCI.exe
  2⤵
  PID:6492
- C:\Windows\System\bIewrmy.exe
  C:\Windows\System\bIewrmy.exe
  2⤵
  PID:6440
- C:\Windows\System\pYWbTnr.exe
  C:\Windows\System\pYWbTnr.exe
  2⤵
  PID:6592
- C:\Windows\System\NEGtaMI.exe
  C:\Windows\System\NEGtaMI.exe
  2⤵
  PID:6692
- C:\Windows\System\iColTcS.exe
  C:\Windows\System\iColTcS.exe
  2⤵
  PID:6700
- C:\Windows\System\BcSBRVZ.exe
  C:\Windows\System\BcSBRVZ.exe
  2⤵
  PID:6800
- C:\Windows\System\vBcjZpT.exe
  C:\Windows\System\vBcjZpT.exe
  2⤵
  PID:6836
- C:\Windows\System\JsqaEqD.exe
  C:\Windows\System\JsqaEqD.exe
  2⤵
  PID:6408
- C:\Windows\System\PQtsBBu.exe
  C:\Windows\System\PQtsBBu.exe
  2⤵
  PID:6864
- C:\Windows\System\FKwLTyT.exe
  C:\Windows\System\FKwLTyT.exe
  2⤵
  PID:6608
- C:\Windows\System\OOMwjMq.exe
  C:\Windows\System\OOMwjMq.exe
  2⤵
  PID:6888
- C:\Windows\System\mFzRhSx.exe
  C:\Windows\System\mFzRhSx.exe
  2⤵
  PID:6576
- C:\Windows\System\lBdkkbs.exe
  C:\Windows\System\lBdkkbs.exe
  2⤵
  PID:6228
- C:\Windows\System\glLIfwV.exe
  C:\Windows\System\glLIfwV.exe
  2⤵
  PID:6244
- C:\Windows\System\QmKBNpN.exe
  C:\Windows\System\QmKBNpN.exe
  2⤵
  PID:6560
- C:\Windows\System\YQqdoBN.exe
  C:\Windows\System\YQqdoBN.exe
  2⤵
  PID:6980
- C:\Windows\System\pmBTmpQ.exe
  C:\Windows\System\pmBTmpQ.exe
  2⤵
  PID:6224
- C:\Windows\System\egyojjH.exe
  C:\Windows\System\egyojjH.exe
  2⤵
  PID:6444
- C:\Windows\System\fQGGYWw.exe
  C:\Windows\System\fQGGYWw.exe
  2⤵
  PID:6940
- C:\Windows\System\EhUqkbM.exe
  C:\Windows\System\EhUqkbM.exe
  2⤵
  PID:6868
- C:\Windows\System\RBfoPUY.exe
  C:\Windows\System\RBfoPUY.exe
  2⤵
  PID:6780
- C:\Windows\System\zEQzVEK.exe
  C:\Windows\System\zEQzVEK.exe
  2⤵
  PID:6428
- C:\Windows\System\bVpfTxa.exe
  C:\Windows\System\bVpfTxa.exe
  2⤵
  PID:7056
- C:\Windows\System\KwyEQcM.exe
  C:\Windows\System\KwyEQcM.exe
  2⤵
  PID:6524
- C:\Windows\System\qwrTJtc.exe
  C:\Windows\System\qwrTJtc.exe
  2⤵
  PID:6376
- C:\Windows\System\gwCzZTm.exe
  C:\Windows\System\gwCzZTm.exe
  2⤵
  PID:7144
- C:\Windows\System\HYbwIxv.exe
  C:\Windows\System\HYbwIxv.exe
  2⤵
  PID:6764
- C:\Windows\System\euYBwdI.exe
  C:\Windows\System\euYBwdI.exe
  2⤵
  PID:6976
- C:\Windows\System\bPynkKx.exe
  C:\Windows\System\bPynkKx.exe
  2⤵
  PID:6336
- C:\Windows\System\HTdGzTu.exe
  C:\Windows\System\HTdGzTu.exe
  2⤵
  PID:7064
- C:\Windows\System\ZnTNBfu.exe
  C:\Windows\System\ZnTNBfu.exe
  2⤵
  PID:6208
- C:\Windows\System\CJXCYSy.exe
  C:\Windows\System\CJXCYSy.exe
  2⤵
  PID:7108
- C:\Windows\System\bWZTLdc.exe
  C:\Windows\System\bWZTLdc.exe
  2⤵
  PID:7092
- C:\Windows\System\zOuwGfB.exe
  C:\Windows\System\zOuwGfB.exe
  2⤵
  PID:7008
- C:\Windows\System\VABBYyE.exe
  C:\Windows\System\VABBYyE.exe
  2⤵
  PID:6288
- C:\Windows\System\EbwCVwA.exe
  C:\Windows\System\EbwCVwA.exe
  2⤵
  PID:6528
- C:\Windows\System\ZKNTAPQ.exe
  C:\Windows\System\ZKNTAPQ.exe
  2⤵
  PID:6176
- C:\Windows\System\nBJllKW.exe
  C:\Windows\System\nBJllKW.exe
  2⤵
  PID:7128
- C:\Windows\System\JSqRUuC.exe
  C:\Windows\System\JSqRUuC.exe
  2⤵
  PID:6784
- C:\Windows\System\ztmiDct.exe
  C:\Windows\System\ztmiDct.exe
  2⤵
  PID:6852
- C:\Windows\System\MCBSPQn.exe
  C:\Windows\System\MCBSPQn.exe
  2⤵
  PID:5152
- C:\Windows\System\jeWeCDy.exe
  C:\Windows\System\jeWeCDy.exe
  2⤵
  PID:2176
- C:\Windows\System\JdExDCu.exe
  C:\Windows\System\JdExDCu.exe
  2⤵
  PID:7076
- C:\Windows\System\EIaRpIN.exe
  C:\Windows\System\EIaRpIN.exe
  2⤵
  PID:7140
- C:\Windows\System\JKNnprT.exe
  C:\Windows\System\JKNnprT.exe
  2⤵
  PID:2372
- C:\Windows\System\vZoNpoi.exe
  C:\Windows\System\vZoNpoi.exe
  2⤵
  PID:6848
- C:\Windows\System\KsqxglG.exe
  C:\Windows\System\KsqxglG.exe
  2⤵
  PID:7060
- C:\Windows\System\gDSCrNg.exe
  C:\Windows\System\gDSCrNg.exe
  2⤵
  PID:7180
- C:\Windows\System\JiUdgEY.exe
  C:\Windows\System\JiUdgEY.exe
  2⤵
  PID:7196
- C:\Windows\System\AwFqYGX.exe
  C:\Windows\System\AwFqYGX.exe
  2⤵
  PID:7212
- C:\Windows\System\nJIGepS.exe
  C:\Windows\System\nJIGepS.exe
  2⤵
  PID:7228
- C:\Windows\System\moexCOj.exe
  C:\Windows\System\moexCOj.exe
  2⤵
  PID:7244
- C:\Windows\System\HQyLHJi.exe
  C:\Windows\System\HQyLHJi.exe
  2⤵
  PID:7260
- C:\Windows\System\PnkCcvr.exe
  C:\Windows\System\PnkCcvr.exe
  2⤵
  PID:7276
- C:\Windows\System\zliOUbz.exe
  C:\Windows\System\zliOUbz.exe
  2⤵
  PID:7292
- C:\Windows\System\MsbkZXR.exe
  C:\Windows\System\MsbkZXR.exe
  2⤵
  PID:7308
- C:\Windows\System\WKzsyMP.exe
  C:\Windows\System\WKzsyMP.exe
  2⤵
  PID:7324
- C:\Windows\System\paVDTNF.exe
  C:\Windows\System\paVDTNF.exe
  2⤵
  PID:7340
- C:\Windows\System\TconKre.exe
  C:\Windows\System\TconKre.exe
  2⤵
  PID:7372
- C:\Windows\System\njzpzvz.exe
  C:\Windows\System\njzpzvz.exe
  2⤵
  PID:7388
- C:\Windows\System\PZdheXN.exe
  C:\Windows\System\PZdheXN.exe
  2⤵
  PID:7404
- C:\Windows\System\MCIjbGi.exe
  C:\Windows\System\MCIjbGi.exe
  2⤵
  PID:7420
- C:\Windows\System\YuSEKmQ.exe
  C:\Windows\System\YuSEKmQ.exe
  2⤵
  PID:7436
- C:\Windows\System\lIunupq.exe
  C:\Windows\System\lIunupq.exe
  2⤵
  PID:7452
- C:\Windows\System\fHvxTbN.exe
  C:\Windows\System\fHvxTbN.exe
  2⤵
  PID:7468
- C:\Windows\System\GYkLMPp.exe
  C:\Windows\System\GYkLMPp.exe
  2⤵
  PID:7488
- C:\Windows\System\jNZXpBf.exe
  C:\Windows\System\jNZXpBf.exe
  2⤵
  PID:7504
- C:\Windows\System\aDQBHvj.exe
  C:\Windows\System\aDQBHvj.exe
  2⤵
  PID:7520
- C:\Windows\System\kgrrIMN.exe
  C:\Windows\System\kgrrIMN.exe
  2⤵
  PID:7536
- C:\Windows\System\kdKONFW.exe
  C:\Windows\System\kdKONFW.exe
  2⤵
  PID:7552
- C:\Windows\System\eQVRldL.exe
  C:\Windows\System\eQVRldL.exe
  2⤵
  PID:7568
- C:\Windows\System\aEsnlKY.exe
  C:\Windows\System\aEsnlKY.exe
  2⤵
  PID:7584
- C:\Windows\System\ASdPMHW.exe
  C:\Windows\System\ASdPMHW.exe
  2⤵
  PID:7600
- C:\Windows\System\LlxTzGm.exe
  C:\Windows\System\LlxTzGm.exe
  2⤵
  PID:7616
- C:\Windows\System\RBBJqDW.exe
  C:\Windows\System\RBBJqDW.exe
  2⤵
  PID:7632
- C:\Windows\System\VIDgxpA.exe
  C:\Windows\System\VIDgxpA.exe
  2⤵
  PID:7648
- C:\Windows\System\VXNKwap.exe
  C:\Windows\System\VXNKwap.exe
  2⤵
  PID:7664
- C:\Windows\System\QfuOdRU.exe
  C:\Windows\System\QfuOdRU.exe
  2⤵
  PID:7684
- C:\Windows\System\dLkqWfF.exe
  C:\Windows\System\dLkqWfF.exe
  2⤵
  PID:7704
- C:\Windows\System\gKFkNDG.exe
  C:\Windows\System\gKFkNDG.exe
  2⤵
  PID:7720
- C:\Windows\System\DvmDfGX.exe
  C:\Windows\System\DvmDfGX.exe
  2⤵
  PID:7736
- C:\Windows\System\qsopWTr.exe
  C:\Windows\System\qsopWTr.exe
  2⤵
  PID:7752
- C:\Windows\System\KGpRkIB.exe
  C:\Windows\System\KGpRkIB.exe
  2⤵
  PID:7768
- C:\Windows\System\oaEuNqS.exe
  C:\Windows\System\oaEuNqS.exe
  2⤵
  PID:7784
- C:\Windows\System\SsxhdGS.exe
  C:\Windows\System\SsxhdGS.exe
  2⤵
  PID:7800
- C:\Windows\System\zHpQgtU.exe
  C:\Windows\System\zHpQgtU.exe
  2⤵
  PID:7816
- C:\Windows\System\DUzfBDz.exe
  C:\Windows\System\DUzfBDz.exe
  2⤵
  PID:7832
- C:\Windows\System\JMKHdat.exe
  C:\Windows\System\JMKHdat.exe
  2⤵
  PID:7848
- C:\Windows\System\yjuycfb.exe
  C:\Windows\System\yjuycfb.exe
  2⤵
  PID:7864
- C:\Windows\System\uiuvuMW.exe
  C:\Windows\System\uiuvuMW.exe
  2⤵
  PID:7880
- C:\Windows\System\iHTovDb.exe
  C:\Windows\System\iHTovDb.exe
  2⤵
  PID:7896
- C:\Windows\System\hEHwIQb.exe
  C:\Windows\System\hEHwIQb.exe
  2⤵
  PID:7912
- C:\Windows\System\lOOEOpe.exe
  C:\Windows\System\lOOEOpe.exe
  2⤵
  PID:7928
- C:\Windows\System\hSdPfEi.exe
  C:\Windows\System\hSdPfEi.exe
  2⤵
  PID:7944
- C:\Windows\System\urIzrqG.exe
  C:\Windows\System\urIzrqG.exe
  2⤵
  PID:7960
- C:\Windows\System\VEZoNPi.exe
  C:\Windows\System\VEZoNPi.exe
  2⤵
  PID:7976
- C:\Windows\System\tvSYUjz.exe
  C:\Windows\System\tvSYUjz.exe
  2⤵
  PID:7992
- C:\Windows\System\LUvFtXo.exe
  C:\Windows\System\LUvFtXo.exe
  2⤵
  PID:8008
- C:\Windows\System\TNiuThj.exe
  C:\Windows\System\TNiuThj.exe
  2⤵
  PID:8024
- C:\Windows\System\ecBYnhU.exe
  C:\Windows\System\ecBYnhU.exe
  2⤵
  PID:8040
- C:\Windows\System\ByMdMes.exe
  C:\Windows\System\ByMdMes.exe
  2⤵
  PID:8056
- C:\Windows\System\bBBAoiE.exe
  C:\Windows\System\bBBAoiE.exe
  2⤵
  PID:8072
- C:\Windows\System\xjNVNBm.exe
  C:\Windows\System\xjNVNBm.exe
  2⤵
  PID:8088
- C:\Windows\System\ruTNGRC.exe
  C:\Windows\System\ruTNGRC.exe
  2⤵
  PID:8104
- C:\Windows\System\megTYQr.exe
  C:\Windows\System\megTYQr.exe
  2⤵
  PID:8120
- C:\Windows\System\nVkymro.exe
  C:\Windows\System\nVkymro.exe
  2⤵
  PID:8136
- C:\Windows\System\iSdZFID.exe
  C:\Windows\System\iSdZFID.exe
  2⤵
  PID:8152
- C:\Windows\System\WLejQzy.exe
  C:\Windows\System\WLejQzy.exe
  2⤵
  PID:8168
- C:\Windows\System\tUfSmsr.exe
  C:\Windows\System\tUfSmsr.exe
  2⤵
  PID:8184
- C:\Windows\System\XsKHUHc.exe
  C:\Windows\System\XsKHUHc.exe
  2⤵
  PID:7124
- C:\Windows\System\hVOemfc.exe
  C:\Windows\System\hVOemfc.exe
  2⤵
  PID:7160
- C:\Windows\System\ywSQvTr.exe
  C:\Windows\System\ywSQvTr.exe
  2⤵
  PID:6556
- C:\Windows\System\NnHFBZi.exe
  C:\Windows\System\NnHFBZi.exe
  2⤵
  PID:6660
- C:\Windows\System\FmrFdsn.exe
  C:\Windows\System\FmrFdsn.exe
  2⤵
  PID:7236
- C:\Windows\System\lcZXyxq.exe
  C:\Windows\System\lcZXyxq.exe
  2⤵
  PID:7300
- C:\Windows\System\iSVoZPB.exe
  C:\Windows\System\iSVoZPB.exe
  2⤵
  PID:7192
- C:\Windows\System\KVobgDS.exe
  C:\Windows\System\KVobgDS.exe
  2⤵
  PID:7252
- C:\Windows\System\lJGqxbP.exe
  C:\Windows\System\lJGqxbP.exe
  2⤵
  PID:7320
- C:\Windows\System\QBrcfFQ.exe
  C:\Windows\System\QBrcfFQ.exe
  2⤵
  PID:7288
- C:\Windows\System\ykJAeLM.exe
  C:\Windows\System\ykJAeLM.exe
  2⤵
  PID:7444
- C:\Windows\System\bTBRHUS.exe
  C:\Windows\System\bTBRHUS.exe
  2⤵
  PID:7480
- C:\Windows\System\qIqAAqX.exe
  C:\Windows\System\qIqAAqX.exe
  2⤵
  PID:7544
- C:\Windows\System\MeECAdz.exe
  C:\Windows\System\MeECAdz.exe
  2⤵
  PID:7608
- C:\Windows\System\NdTRXQg.exe
  C:\Windows\System\NdTRXQg.exe
  2⤵
  PID:7640
- C:\Windows\System\QtXUkbq.exe
  C:\Windows\System\QtXUkbq.exe
  2⤵
  PID:7672
- C:\Windows\System\WHGFfNJ.exe
  C:\Windows\System\WHGFfNJ.exe
  2⤵
  PID:7500
- C:\Windows\System\wRpmFKK.exe
  C:\Windows\System\wRpmFKK.exe
  2⤵
  PID:7400
- C:\Windows\System\uWsEyJo.exe
  C:\Windows\System\uWsEyJo.exe
  2⤵
  PID:7564
- C:\Windows\System\AqNeQiP.exe
  C:\Windows\System\AqNeQiP.exe
  2⤵
  PID:7656
- C:\Windows\System\KkYSlet.exe
  C:\Windows\System\KkYSlet.exe
  2⤵
  PID:7712
- C:\Windows\System\Vzstoex.exe
  C:\Windows\System\Vzstoex.exe
  2⤵
  PID:7776
- C:\Windows\System\QhweDqi.exe
  C:\Windows\System\QhweDqi.exe
  2⤵
  PID:7732
- C:\Windows\System\xYLkjOq.exe
  C:\Windows\System\xYLkjOq.exe
  2⤵
  PID:7764
- C:\Windows\System\eHjVrBa.exe
  C:\Windows\System\eHjVrBa.exe
  2⤵
  PID:7696
- C:\Windows\System\GOQDAbs.exe
  C:\Windows\System\GOQDAbs.exe
  2⤵
  PID:7876
- C:\Windows\System\xVzHcpF.exe
  C:\Windows\System\xVzHcpF.exe
  2⤵
  PID:7828
- C:\Windows\System\aTQznGC.exe
  C:\Windows\System\aTQznGC.exe
  2⤵
  PID:7892
- C:\Windows\System\mYgqbrT.exe
  C:\Windows\System\mYgqbrT.exe
  2⤵
  PID:7956
- C:\Windows\System\QZigiRV.exe
  C:\Windows\System\QZigiRV.exe
  2⤵
  PID:7940
- C:\Windows\System\GrlGcdI.exe
  C:\Windows\System\GrlGcdI.exe
  2⤵
  PID:8068
- C:\Windows\System\VStOGgp.exe
  C:\Windows\System\VStOGgp.exe
  2⤵
  PID:8096
- C:\Windows\System\RKLFZVK.exe
  C:\Windows\System\RKLFZVK.exe
  2⤵
  PID:8164
- C:\Windows\System\zTFwMCp.exe
  C:\Windows\System\zTFwMCp.exe
  2⤵
  PID:7176
- C:\Windows\System\rWBZsAW.exe
  C:\Windows\System\rWBZsAW.exe
  2⤵
  PID:7988
- C:\Windows\System\TcKUfEn.exe
  C:\Windows\System\TcKUfEn.exe
  2⤵
  PID:7332
- C:\Windows\System\APiSRDA.exe
  C:\Windows\System\APiSRDA.exe
  2⤵
  PID:7512
- C:\Windows\System\ltsXRgY.exe
  C:\Windows\System\ltsXRgY.exe
  2⤵
  PID:7380
- C:\Windows\System\hquHhmp.exe
  C:\Windows\System\hquHhmp.exe
  2⤵
  PID:8084
- C:\Windows\System\wnfVwor.exe
  C:\Windows\System\wnfVwor.exe
  2⤵
  PID:7272
- C:\Windows\System\bgGEoCG.exe
  C:\Windows\System\bgGEoCG.exe
  2⤵
  PID:7460
- C:\Windows\System\RuuXqzB.exe
  C:\Windows\System\RuuXqzB.exe
  2⤵
  PID:8052
- C:\Windows\System\AwXwArg.exe
  C:\Windows\System\AwXwArg.exe
  2⤵
  PID:8176
- C:\Windows\System\Yqzeqji.exe
  C:\Windows\System\Yqzeqji.exe
  2⤵
  PID:7268
- C:\Windows\System\CHVwbij.exe
  C:\Windows\System\CHVwbij.exe
  2⤵
  PID:7676
- C:\Windows\System\BUDZowu.exe
  C:\Windows\System\BUDZowu.exe
  2⤵
  PID:7824
- C:\Windows\System\eChsMBb.exe
  C:\Windows\System\eChsMBb.exe
  2⤵
  PID:8036
- C:\Windows\System\KHecVib.exe
  C:\Windows\System\KHecVib.exe
  2⤵
  PID:7580
- C:\Windows\System\mneSwok.exe
  C:\Windows\System\mneSwok.exe
  2⤵
  PID:8132
- C:\Windows\System\pyVmiqC.exe
  C:\Windows\System\pyVmiqC.exe
  2⤵
  PID:7628
- C:\Windows\System\cYwDQvm.exe
  C:\Windows\System\cYwDQvm.exe
  2⤵
  PID:7840
- C:\Windows\System\pmVhSrr.exe
  C:\Windows\System\pmVhSrr.exe
  2⤵
  PID:8004
- C:\Windows\System\oQTuQgU.exe
  C:\Windows\System\oQTuQgU.exe
  2⤵
  PID:7384
- C:\Windows\System\xUvtfMF.exe
  C:\Windows\System\xUvtfMF.exe
  2⤵
  PID:8144
- C:\Windows\System\JgELlvv.exe
  C:\Windows\System\JgELlvv.exe
  2⤵
  PID:7920
- C:\Windows\System\IQYtmkD.exe
  C:\Windows\System\IQYtmkD.exe
  2⤵
  PID:1472
- C:\Windows\System\fVmClBd.exe
  C:\Windows\System\fVmClBd.exe
  2⤵
  PID:7860
- C:\Windows\System\CXgxKVv.exe
  C:\Windows\System\CXgxKVv.exe
  2⤵
  PID:6908
- C:\Windows\System\GjEmpKS.exe
  C:\Windows\System\GjEmpKS.exe
  2⤵
  PID:6292
- C:\Windows\System\lkyltiI.exe
  C:\Windows\System\lkyltiI.exe
  2⤵
  PID:2880
- C:\Windows\System\WDktmcH.exe
  C:\Windows\System\WDktmcH.exe
  2⤵
  PID:7496
- C:\Windows\System\ixfDUuc.exe
  C:\Windows\System\ixfDUuc.exe
  2⤵
  PID:7208
- C:\Windows\System\hFSeXrg.exe
  C:\Windows\System\hFSeXrg.exe
  2⤵
  PID:7576
- C:\Windows\System\doNTtze.exe
  C:\Windows\System\doNTtze.exe
  2⤵
  PID:6760
- C:\Windows\System\QsFARFB.exe
  C:\Windows\System\QsFARFB.exe
  2⤵
  PID:7592
- C:\Windows\System\KBEEnzL.exe
  C:\Windows\System\KBEEnzL.exe
  2⤵
  PID:8204
- C:\Windows\System\iPOQALs.exe
  C:\Windows\System\iPOQALs.exe
  2⤵
  PID:8220
- C:\Windows\System\ADUyBLQ.exe
  C:\Windows\System\ADUyBLQ.exe
  2⤵
  PID:8236
- C:\Windows\System\TeIMNIl.exe
  C:\Windows\System\TeIMNIl.exe
  2⤵
  PID:8252
- C:\Windows\System\EgqJULR.exe
  C:\Windows\System\EgqJULR.exe
  2⤵
  PID:8268
- C:\Windows\System\xAnTLSw.exe
  C:\Windows\System\xAnTLSw.exe
  2⤵
  PID:8284
- C:\Windows\System\efrKuAc.exe
  C:\Windows\System\efrKuAc.exe
  2⤵
  PID:8300
- C:\Windows\System\bUQpofe.exe
  C:\Windows\System\bUQpofe.exe
  2⤵
  PID:8316
- C:\Windows\System\TdKyCnS.exe
  C:\Windows\System\TdKyCnS.exe
  2⤵
  PID:8332
- C:\Windows\System\dltPWan.exe
  C:\Windows\System\dltPWan.exe
  2⤵
  PID:8348
- C:\Windows\System\tgZLPOu.exe
  C:\Windows\System\tgZLPOu.exe
  2⤵
  PID:8368
- C:\Windows\System\hAWMZtC.exe
  C:\Windows\System\hAWMZtC.exe
  2⤵
  PID:8388
- C:\Windows\System\AZBnfJT.exe
  C:\Windows\System\AZBnfJT.exe
  2⤵
  PID:8404
- C:\Windows\System\xKCpTtW.exe
  C:\Windows\System\xKCpTtW.exe
  2⤵
  PID:8432
- C:\Windows\System\luhkoiO.exe
  C:\Windows\System\luhkoiO.exe
  2⤵
  PID:8448
- C:\Windows\System\rsZJSyL.exe
  C:\Windows\System\rsZJSyL.exe
  2⤵
  PID:8464
- C:\Windows\System\ZUDhbnp.exe
  C:\Windows\System\ZUDhbnp.exe
  2⤵
  PID:8480
- C:\Windows\System\TYbXQIc.exe
  C:\Windows\System\TYbXQIc.exe
  2⤵
  PID:8496
- C:\Windows\System\XlGnFyR.exe
  C:\Windows\System\XlGnFyR.exe
  2⤵
  PID:8512
- C:\Windows\System\ICjKVRt.exe
  C:\Windows\System\ICjKVRt.exe
  2⤵
  PID:8528
- C:\Windows\System\qzEBBSH.exe
  C:\Windows\System\qzEBBSH.exe
  2⤵
  PID:8544
- C:\Windows\System\sXOnDrO.exe
  C:\Windows\System\sXOnDrO.exe
  2⤵
  PID:8560
- C:\Windows\System\eQTzgQi.exe
  C:\Windows\System\eQTzgQi.exe
  2⤵
  PID:8580
- C:\Windows\System\weAaOTM.exe
  C:\Windows\System\weAaOTM.exe
  2⤵
  PID:8596
- C:\Windows\System\cQSCbCd.exe
  C:\Windows\System\cQSCbCd.exe
  2⤵
  PID:8612
- C:\Windows\System\FUeRRIM.exe
  C:\Windows\System\FUeRRIM.exe
  2⤵
  PID:8628
- C:\Windows\System\eztqSyj.exe
  C:\Windows\System\eztqSyj.exe
  2⤵
  PID:8644
- C:\Windows\System\DtBuDZQ.exe
  C:\Windows\System\DtBuDZQ.exe
  2⤵
  PID:8660
- C:\Windows\System\qecNwTz.exe
  C:\Windows\System\qecNwTz.exe
  2⤵
  PID:8676
- C:\Windows\System\sZBNCRA.exe
  C:\Windows\System\sZBNCRA.exe
  2⤵
  PID:8692
- C:\Windows\System\hCBIpJb.exe
  C:\Windows\System\hCBIpJb.exe
  2⤵
  PID:8708
- C:\Windows\System\VTQvfNq.exe
  C:\Windows\System\VTQvfNq.exe
  2⤵
  PID:8724
- C:\Windows\System\PzYNJKS.exe
  C:\Windows\System\PzYNJKS.exe
  2⤵
  PID:8740
- C:\Windows\System\drVpowE.exe
  C:\Windows\System\drVpowE.exe
  2⤵
  PID:8756
- C:\Windows\System\MQQQLPo.exe
  C:\Windows\System\MQQQLPo.exe
  2⤵
  PID:8772
- C:\Windows\System\vFNQPRh.exe
  C:\Windows\System\vFNQPRh.exe
  2⤵
  PID:8792
- C:\Windows\System\vScOzoa.exe
  C:\Windows\System\vScOzoa.exe
  2⤵
  PID:8808
- C:\Windows\System\ANDURfA.exe
  C:\Windows\System\ANDURfA.exe
  2⤵
  PID:8824
- C:\Windows\System\IIzGJVG.exe
  C:\Windows\System\IIzGJVG.exe
  2⤵
  PID:8840
- C:\Windows\System\XZdppRK.exe
  C:\Windows\System\XZdppRK.exe
  2⤵
  PID:8856
- C:\Windows\System\BvxfHQg.exe
  C:\Windows\System\BvxfHQg.exe
  2⤵
  PID:8872
- C:\Windows\System\SGJkgXO.exe
  C:\Windows\System\SGJkgXO.exe
  2⤵
  PID:8888
- C:\Windows\System\vgnBRHH.exe
  C:\Windows\System\vgnBRHH.exe
  2⤵
  PID:8904
- C:\Windows\System\nXikzRE.exe
  C:\Windows\System\nXikzRE.exe
  2⤵
  PID:8920
- C:\Windows\System\LZpBagD.exe
  C:\Windows\System\LZpBagD.exe
  2⤵
  PID:8940
- C:\Windows\System\VnRHQbf.exe
  C:\Windows\System\VnRHQbf.exe
  2⤵
  PID:8956
- C:\Windows\System\KcypCvG.exe
  C:\Windows\System\KcypCvG.exe
  2⤵
  PID:8972
- C:\Windows\System\TpvLDrV.exe
  C:\Windows\System\TpvLDrV.exe
  2⤵
  PID:8988
- C:\Windows\System\lsoccsQ.exe
  C:\Windows\System\lsoccsQ.exe
  2⤵
  PID:9004
- C:\Windows\System\mdDBxKX.exe
  C:\Windows\System\mdDBxKX.exe
  2⤵
  PID:9020
- C:\Windows\System\HUnzbDA.exe
  C:\Windows\System\HUnzbDA.exe
  2⤵
  PID:9036
- C:\Windows\System\PERweSo.exe
  C:\Windows\System\PERweSo.exe
  2⤵
  PID:9052
- C:\Windows\System\CIiSBue.exe
  C:\Windows\System\CIiSBue.exe
  2⤵
  PID:9068
- C:\Windows\System\VWSybDY.exe
  C:\Windows\System\VWSybDY.exe
  2⤵
  PID:9084
- C:\Windows\System\rHgjlyI.exe
  C:\Windows\System\rHgjlyI.exe
  2⤵
  PID:9100
- C:\Windows\System\bXMLrTR.exe
  C:\Windows\System\bXMLrTR.exe
  2⤵
  PID:9116
- C:\Windows\System\RNtBHOJ.exe
  C:\Windows\System\RNtBHOJ.exe
  2⤵
  PID:9132
- C:\Windows\System\hOCxnag.exe
  C:\Windows\System\hOCxnag.exe
  2⤵
  PID:9148
- C:\Windows\System\lqWLNRt.exe
  C:\Windows\System\lqWLNRt.exe
  2⤵
  PID:9164
- C:\Windows\System\BILRdHe.exe
  C:\Windows\System\BILRdHe.exe
  2⤵
  PID:9180
- C:\Windows\System\GYGXtrz.exe
  C:\Windows\System\GYGXtrz.exe
  2⤵
  PID:9196
- C:\Windows\System\iTsYhYv.exe
  C:\Windows\System\iTsYhYv.exe
  2⤵
  PID:9212
- C:\Windows\System\lZUWlCQ.exe
  C:\Windows\System\lZUWlCQ.exe
  2⤵
  PID:8020
- C:\Windows\System\fJkOQmV.exe
  C:\Windows\System\fJkOQmV.exe
  2⤵
  PID:7464
- C:\Windows\System\hghtMHT.exe
  C:\Windows\System\hghtMHT.exe
  2⤵
  PID:8264
- C:\Windows\System\bSHHnTn.exe
  C:\Windows\System\bSHHnTn.exe
  2⤵
  PID:8328
- C:\Windows\System\EeIatHG.exe
  C:\Windows\System\EeIatHG.exe
  2⤵
  PID:7760
- C:\Windows\System\LuTcasi.exe
  C:\Windows\System\LuTcasi.exe
  2⤵
  PID:7204
- C:\Windows\System\GptCXoi.exe
  C:\Windows\System\GptCXoi.exe
  2⤵
  PID:7624
- C:\Windows\System\dYECQWA.exe
  C:\Windows\System\dYECQWA.exe
  2⤵
  PID:8276
- C:\Windows\System\ISTeGhd.exe
  C:\Windows\System\ISTeGhd.exe
  2⤵
  PID:8340
- C:\Windows\System\AIKhwOX.exe
  C:\Windows\System\AIKhwOX.exe
  2⤵
  PID:8364
- C:\Windows\System\Lvwtdzx.exe
  C:\Windows\System\Lvwtdzx.exe
  2⤵
  PID:8384
- C:\Windows\System\nvhfOnI.exe
  C:\Windows\System\nvhfOnI.exe
  2⤵
  PID:7364
- C:\Windows\System\JvYFndX.exe
  C:\Windows\System\JvYFndX.exe
  2⤵
  PID:8552
- C:\Windows\System\xIJhZZx.exe
  C:\Windows\System\xIJhZZx.exe
  2⤵
  PID:8504
- C:\Windows\System\cprBBpW.exe
  C:\Windows\System\cprBBpW.exe
  2⤵
  PID:8568
- C:\Windows\System\OnAgecp.exe
  C:\Windows\System\OnAgecp.exe
  2⤵
  PID:8428
- C:\Windows\System\mFATKlA.exe
  C:\Windows\System\mFATKlA.exe
  2⤵
  PID:8652
- C:\Windows\System\nygDyXH.exe
  C:\Windows\System\nygDyXH.exe
  2⤵
  PID:8720
- C:\Windows\System\RGzLNlh.exe
  C:\Windows\System\RGzLNlh.exe
  2⤵
  PID:8668
- C:\Windows\System\XwfkfLT.exe
  C:\Windows\System\XwfkfLT.exe
  2⤵
  PID:8636
- C:\Windows\System\wHpdyeg.exe
  C:\Windows\System\wHpdyeg.exe
  2⤵
  PID:8752
- C:\Windows\System\colNZae.exe
  C:\Windows\System\colNZae.exe
  2⤵
  PID:8848
- C:\Windows\System\TPEPcuC.exe
  C:\Windows\System\TPEPcuC.exe
  2⤵
  PID:8912
- C:\Windows\System\BvHUyFj.exe
  C:\Windows\System\BvHUyFj.exe
  2⤵
  PID:8928
- C:\Windows\System\zuAMuRo.exe
  C:\Windows\System\zuAMuRo.exe
  2⤵
  PID:8832
- C:\Windows\System\tfypHxZ.exe
  C:\Windows\System\tfypHxZ.exe
  2⤵
  PID:8936
- C:\Windows\System\UwuwGmP.exe
  C:\Windows\System\UwuwGmP.exe
  2⤵
  PID:8968
- C:\Windows\System\oXeJPRm.exe
  C:\Windows\System\oXeJPRm.exe
  2⤵
  PID:8980
- C:\Windows\System\TqNGwjJ.exe
  C:\Windows\System\TqNGwjJ.exe
  2⤵
  PID:8948
- C:\Windows\System\VeKWuTF.exe
  C:\Windows\System\VeKWuTF.exe
  2⤵
  PID:9080
- C:\Windows\System\YsPxwLQ.exe
  C:\Windows\System\YsPxwLQ.exe
  2⤵
  PID:9144
- C:\Windows\System\QyUkgHB.exe
  C:\Windows\System\QyUkgHB.exe
  2⤵
  PID:9208
- C:\Windows\System\UMiAqlU.exe
  C:\Windows\System\UMiAqlU.exe
  2⤵
  PID:8324
- C:\Windows\System\wRZCmbO.exe
  C:\Windows\System\wRZCmbO.exe
  2⤵
  PID:8244
- C:\Windows\System\VFKbaXk.exe
  C:\Windows\System\VFKbaXk.exe
  2⤵
  PID:8248
- C:\Windows\System\vYimSrp.exe
  C:\Windows\System\vYimSrp.exe
  2⤵
  PID:7336
- C:\Windows\System\vSpFfPp.exe
  C:\Windows\System\vSpFfPp.exe
  2⤵
  PID:7748
- C:\Windows\System\suwlNcj.exe
  C:\Windows\System\suwlNcj.exe
  2⤵
  PID:8196
- C:\Windows\System\JUgszvO.exe
  C:\Windows\System\JUgszvO.exe
  2⤵
  PID:9160
- C:\Windows\System\NTXVAlo.exe
  C:\Windows\System\NTXVAlo.exe
  2⤵
  PID:8396
- C:\Windows\System\RGvKgQZ.exe
  C:\Windows\System\RGvKgQZ.exe
  2⤵
  PID:8424
- C:\Windows\System\aYgZtoh.exe
  C:\Windows\System\aYgZtoh.exe
  2⤵
  PID:8492
- C:\Windows\System\CbaHXST.exe
  C:\Windows\System\CbaHXST.exe
  2⤵
  PID:8576
- C:\Windows\System\EFnZKbi.exe
  C:\Windows\System\EFnZKbi.exe
  2⤵
  PID:8540
- C:\Windows\System\gtCBvlI.exe
  C:\Windows\System\gtCBvlI.exe
  2⤵
  PID:8820
- C:\Windows\System\mjORDVS.exe
  C:\Windows\System\mjORDVS.exe
  2⤵
  PID:8748
- C:\Windows\System\ccHPazL.exe
  C:\Windows\System\ccHPazL.exe
  2⤵
  PID:8916
- C:\Windows\System\JSMrXac.exe
  C:\Windows\System\JSMrXac.exe
  2⤵
  PID:8896
- C:\Windows\System\LfolBbQ.exe
  C:\Windows\System\LfolBbQ.exe
  2⤵
  PID:9028
- C:\Windows\System\EotWUKB.exe
  C:\Windows\System\EotWUKB.exe
  2⤵
  PID:8768
- C:\Windows\System\XdVXpqZ.exe
  C:\Windows\System\XdVXpqZ.exe
  2⤵
  PID:9204
- C:\Windows\System\YbXmjwk.exe
  C:\Windows\System\YbXmjwk.exe
  2⤵
  PID:8148
- C:\Windows\System\eiMFEgp.exe
  C:\Windows\System\eiMFEgp.exe
  2⤵
  PID:9016
- C:\Windows\System\LYqJAlO.exe
  C:\Windows\System\LYqJAlO.exe
  2⤵
  PID:9192
- C:\Windows\System\TEkdFqd.exe
  C:\Windows\System\TEkdFqd.exe
  2⤵
  PID:8312
- C:\Windows\System\TUitpnZ.exe
  C:\Windows\System\TUitpnZ.exe
  2⤵
  PID:1576
- C:\Windows\System\lbKPSuU.exe
  C:\Windows\System\lbKPSuU.exe
  2⤵
  PID:8536
- C:\Windows\System\uWGBTtQ.exe
  C:\Windows\System\uWGBTtQ.exe
  2⤵
  PID:7872
- C:\Windows\System\KfFiLUf.exe
  C:\Windows\System\KfFiLUf.exe
  2⤵
  PID:8400
- C:\Windows\System\gWoeidV.exe
  C:\Windows\System\gWoeidV.exe
  2⤵
  PID:8736
- C:\Windows\System\svaFNQb.exe
  C:\Windows\System\svaFNQb.exe
  2⤵
  PID:9012
- C:\Windows\System\jYptwiW.exe
  C:\Windows\System\jYptwiW.exe
  2⤵
  PID:8864
- C:\Windows\System\aRleMbZ.exe
  C:\Windows\System\aRleMbZ.exe
  2⤵
  PID:8032
- C:\Windows\System\hkoDfia.exe
  C:\Windows\System\hkoDfia.exe
  2⤵
  PID:8296
- C:\Windows\System\InTnDPc.exe
  C:\Windows\System\InTnDPc.exe
  2⤵
  PID:8688
- C:\Windows\System\XnMPgGU.exe
  C:\Windows\System\XnMPgGU.exe
  2⤵
  PID:8804
- C:\Windows\System\ayQvZxr.exe
  C:\Windows\System\ayQvZxr.exe
  2⤵
  PID:8472
- C:\Windows\System\nekAcWZ.exe
  C:\Windows\System\nekAcWZ.exe
  2⤵
  PID:8704
- C:\Windows\System\Whazxsu.exe
  C:\Windows\System\Whazxsu.exe
  2⤵
  PID:9140
- C:\Windows\System\JJwjBhw.exe
  C:\Windows\System\JJwjBhw.exe
  2⤵
  PID:8884
- C:\Windows\System\YDPlEJa.exe
  C:\Windows\System\YDPlEJa.exe
  2⤵
  PID:8444
- C:\Windows\System\WoXJlyI.exe
  C:\Windows\System\WoXJlyI.exe
  2⤵
  PID:9232
- C:\Windows\System\TvLFzwN.exe
  C:\Windows\System\TvLFzwN.exe
  2⤵
  PID:9248
- C:\Windows\System\VpRcadb.exe
  C:\Windows\System\VpRcadb.exe
  2⤵
  PID:9264
- C:\Windows\System\ZVMLTTR.exe
  C:\Windows\System\ZVMLTTR.exe
  2⤵
  PID:9280
- C:\Windows\System\peZuNUQ.exe
  C:\Windows\System\peZuNUQ.exe
  2⤵
  PID:9296
- C:\Windows\System\jqqzLpQ.exe
  C:\Windows\System\jqqzLpQ.exe
  2⤵
  PID:9312
- C:\Windows\System\PHCiVtR.exe
  C:\Windows\System\PHCiVtR.exe
  2⤵
  PID:9328
- C:\Windows\System\YGNmrrL.exe
  C:\Windows\System\YGNmrrL.exe
  2⤵
  PID:9344
- C:\Windows\System\VCMsBnt.exe
  C:\Windows\System\VCMsBnt.exe
  2⤵
  PID:9360
- C:\Windows\System\mUowVWp.exe
  C:\Windows\System\mUowVWp.exe
  2⤵
  PID:9376
- C:\Windows\System\YqgMfDK.exe
  C:\Windows\System\YqgMfDK.exe
  2⤵
  PID:9404
- C:\Windows\System\xDmuGod.exe
  C:\Windows\System\xDmuGod.exe
  2⤵
  PID:9420
- C:\Windows\System\TQorIMl.exe
  C:\Windows\System\TQorIMl.exe
  2⤵
  PID:9440
- C:\Windows\System\iJbOzQf.exe
  C:\Windows\System\iJbOzQf.exe
  2⤵
  PID:9456
- C:\Windows\System\tsJldvT.exe
  C:\Windows\System\tsJldvT.exe
  2⤵
  PID:9472
- C:\Windows\System\kgBwwwR.exe
  C:\Windows\System\kgBwwwR.exe
  2⤵
  PID:9488
- C:\Windows\System\YTXVaYY.exe
  C:\Windows\System\YTXVaYY.exe
  2⤵
  PID:9504
- C:\Windows\System\PkVwudK.exe
  C:\Windows\System\PkVwudK.exe
  2⤵
  PID:9520
- C:\Windows\System\SEQWJmx.exe
  C:\Windows\System\SEQWJmx.exe
  2⤵
  PID:9536
- C:\Windows\System\eTFKcrd.exe
  C:\Windows\System\eTFKcrd.exe
  2⤵
  PID:9552
- C:\Windows\System\yAzLjmi.exe
  C:\Windows\System\yAzLjmi.exe
  2⤵
  PID:9568
- C:\Windows\System\aEwupdP.exe
  C:\Windows\System\aEwupdP.exe
  2⤵
  PID:9584
- C:\Windows\System\maQahss.exe
  C:\Windows\System\maQahss.exe
  2⤵
  PID:9600
- C:\Windows\System\RDuSNKb.exe
  C:\Windows\System\RDuSNKb.exe
  2⤵
  PID:9620
- C:\Windows\System\ViabiiH.exe
  C:\Windows\System\ViabiiH.exe
  2⤵
  PID:9640
- C:\Windows\System\fGEGVsE.exe
  C:\Windows\System\fGEGVsE.exe
  2⤵
  PID:9656
- C:\Windows\System\bjnwrpv.exe
  C:\Windows\System\bjnwrpv.exe
  2⤵
  PID:9672
- C:\Windows\System\wLGJKee.exe
  C:\Windows\System\wLGJKee.exe
  2⤵
  PID:9688
- C:\Windows\System\dvUStiU.exe
  C:\Windows\System\dvUStiU.exe
  2⤵
  PID:9704
- C:\Windows\System\YIpRmZC.exe
  C:\Windows\System\YIpRmZC.exe
  2⤵
  PID:9724
- C:\Windows\System\XfkviIq.exe
  C:\Windows\System\XfkviIq.exe
  2⤵
  PID:9740
- C:\Windows\System\beWclRR.exe
  C:\Windows\System\beWclRR.exe
  2⤵
  PID:9756
- C:\Windows\System\YMSWLdY.exe
  C:\Windows\System\YMSWLdY.exe
  2⤵
  PID:9772
- C:\Windows\System\xpnQkDp.exe
  C:\Windows\System\xpnQkDp.exe
  2⤵
  PID:9788
- C:\Windows\System\dXTftlq.exe
  C:\Windows\System\dXTftlq.exe
  2⤵
  PID:9808
- C:\Windows\System\NOmwXuL.exe
  C:\Windows\System\NOmwXuL.exe
  2⤵
  PID:9824
- C:\Windows\System\ihONxhZ.exe
  C:\Windows\System\ihONxhZ.exe
  2⤵
  PID:9840
- C:\Windows\System\uxzlkbN.exe
  C:\Windows\System\uxzlkbN.exe
  2⤵
  PID:9856
- C:\Windows\System\TaIeDao.exe
  C:\Windows\System\TaIeDao.exe
  2⤵
  PID:9872
- C:\Windows\System\iLtDYxC.exe
  C:\Windows\System\iLtDYxC.exe
  2⤵
  PID:9892
- C:\Windows\System\rdhPtrW.exe
  C:\Windows\System\rdhPtrW.exe
  2⤵
  PID:9908
- C:\Windows\System\PnmnNiI.exe
  C:\Windows\System\PnmnNiI.exe
  2⤵
  PID:9924
- C:\Windows\System\wIXkqHw.exe
  C:\Windows\System\wIXkqHw.exe
  2⤵
  PID:9940
- C:\Windows\System\XiiJHqc.exe
  C:\Windows\System\XiiJHqc.exe
  2⤵
  PID:9956
- C:\Windows\System\qOIEnZr.exe
  C:\Windows\System\qOIEnZr.exe
  2⤵
  PID:9972
- C:\Windows\System\zXXyALr.exe
  C:\Windows\System\zXXyALr.exe
  2⤵
  PID:9992
- C:\Windows\System\uiunllf.exe
  C:\Windows\System\uiunllf.exe
  2⤵
  PID:10008
- C:\Windows\System\nbsfOCD.exe
  C:\Windows\System\nbsfOCD.exe
  2⤵
  PID:10028
- C:\Windows\System\DmZgplC.exe
  C:\Windows\System\DmZgplC.exe
  2⤵
  PID:10044
- C:\Windows\System\gRjmlWq.exe
  C:\Windows\System\gRjmlWq.exe
  2⤵
  PID:10064
- C:\Windows\System\FCIZYhx.exe
  C:\Windows\System\FCIZYhx.exe
  2⤵
  PID:10080
- C:\Windows\System\wwDWXsm.exe
  C:\Windows\System\wwDWXsm.exe
  2⤵
  PID:10096
- C:\Windows\System\PzDtvQR.exe
  C:\Windows\System\PzDtvQR.exe
  2⤵
  PID:10112
- C:\Windows\System\gHMqRdG.exe
  C:\Windows\System\gHMqRdG.exe
  2⤵
  PID:10128
- C:\Windows\System\GMddDzn.exe
  C:\Windows\System\GMddDzn.exe
  2⤵
  PID:10144
- C:\Windows\System\ZjEKIex.exe
  C:\Windows\System\ZjEKIex.exe
  2⤵
  PID:10164
- C:\Windows\System\xHrSduu.exe
  C:\Windows\System\xHrSduu.exe
  2⤵
  PID:10180
- C:\Windows\System\vifDPQk.exe
  C:\Windows\System\vifDPQk.exe
  2⤵
  PID:10200
- C:\Windows\System\SmgyqNh.exe
  C:\Windows\System\SmgyqNh.exe
  2⤵
  PID:10216
- C:\Windows\System\szOQpUn.exe
  C:\Windows\System\szOQpUn.exe
  2⤵
  PID:10232
- C:\Windows\System\uEeSmgK.exe
  C:\Windows\System\uEeSmgK.exe
  2⤵
  PID:8420
- C:\Windows\System\FqXUIyW.exe
  C:\Windows\System\FqXUIyW.exe
  2⤵
  PID:8488
- C:\Windows\System\hvcDJsf.exe
  C:\Windows\System\hvcDJsf.exe
  2⤵
  PID:9260
- C:\Windows\System\BiDubVU.exe
  C:\Windows\System\BiDubVU.exe
  2⤵
  PID:9324
- C:\Windows\System\hLEoyQF.exe
  C:\Windows\System\hLEoyQF.exe
  2⤵
  PID:9276
- C:\Windows\System\hIgeaGn.exe
  C:\Windows\System\hIgeaGn.exe
  2⤵
  PID:9388
- C:\Windows\System\CrxNySO.exe
  C:\Windows\System\CrxNySO.exe
  2⤵
  PID:9464
- C:\Windows\System\BSvJpFN.exe
  C:\Windows\System\BSvJpFN.exe
  2⤵
  PID:9528
- C:\Windows\System\KPWLVkW.exe
  C:\Windows\System\KPWLVkW.exe
  2⤵
  PID:9452
- C:\Windows\System\WvXFzWK.exe
  C:\Windows\System\WvXFzWK.exe
  2⤵
  PID:9592
- C:\Windows\System\miSnxvy.exe
  C:\Windows\System\miSnxvy.exe
  2⤵
  PID:9512
- C:\Windows\System\rcQVAlL.exe
  C:\Windows\System\rcQVAlL.exe
  2⤵
  PID:9596
- C:\Windows\System\mxLgIIp.exe
  C:\Windows\System\mxLgIIp.exe
  2⤵
  PID:9548
- C:\Windows\System\hogeSPV.exe
  C:\Windows\System\hogeSPV.exe
  2⤵
  PID:9612
- C:\Windows\System\wCVuKuY.exe
  C:\Windows\System\wCVuKuY.exe
  2⤵
  PID:9632
- C:\Windows\System\QPohjEu.exe
  C:\Windows\System\QPohjEu.exe
  2⤵
  PID:9700
- C:\Windows\System\uGhcvNe.exe
  C:\Windows\System\uGhcvNe.exe
  2⤵
  PID:9768
- C:\Windows\System\itYYLfA.exe
  C:\Windows\System\itYYLfA.exe
  2⤵
  PID:9680
- C:\Windows\System\MgQsIGd.exe
  C:\Windows\System\MgQsIGd.exe
  2⤵
  PID:9648
- C:\Windows\System\sDnyytS.exe
  C:\Windows\System\sDnyytS.exe
  2⤵
  PID:9780
- C:\Windows\System\JFdaEQm.exe
  C:\Windows\System\JFdaEQm.exe
  2⤵
  PID:9804
- C:\Windows\System\vUPJLxt.exe
  C:\Windows\System\vUPJLxt.exe
  2⤵
  PID:9864
- C:\Windows\System\LrbGqWP.exe
  C:\Windows\System\LrbGqWP.exe
  2⤵
  PID:9904
- C:\Windows\System\MKHhWxo.exe
  C:\Windows\System\MKHhWxo.exe
  2⤵
  PID:9968
- C:\Windows\System\htRcZyh.exe
  C:\Windows\System\htRcZyh.exe
  2⤵
  PID:9916
- C:\Windows\System\zutSPdW.exe
  C:\Windows\System\zutSPdW.exe
  2⤵
  PID:9888
- C:\Windows\System\vJyuvhD.exe
  C:\Windows\System\vJyuvhD.exe
  2⤵
  PID:9984
- C:\Windows\System\youaAxk.exe
  C:\Windows\System\youaAxk.exe
  2⤵
  PID:9980
- C:\Windows\System\AibWwGB.exe
  C:\Windows\System\AibWwGB.exe
  2⤵
  PID:10024
- C:\Windows\System\GSuGdDb.exe
  C:\Windows\System\GSuGdDb.exe
  2⤵
  PID:10120
- C:\Windows\System\WfOsmqo.exe
  C:\Windows\System\WfOsmqo.exe
  2⤵
  PID:10076
- C:\Windows\System\dLWeyhV.exe
  C:\Windows\System\dLWeyhV.exe
  2⤵
  PID:10104
- C:\Windows\System\DwuAGvS.exe
  C:\Windows\System\DwuAGvS.exe
  2⤵
  PID:10212
- C:\Windows\System\yqzCxzd.exe
  C:\Windows\System\yqzCxzd.exe
  2⤵
  PID:8376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AYlfxVY.exe

Filesize
1.9MB

MD5
3cb5c772563200b915c8811a1b405337

SHA1
a8ac806c249dfa7e9f3154ec31a878244aeaabce

SHA256
29d542375b0d5e48af6818e77e3ac880f677b82c1b32d7b108d03ac55fe3691d

SHA512
862762123923548411d824862b0c76d5b2c6a324da71cae1c4412eeb4a041761d3e69ac6f3915ced694c49c4fc1f0d98c0ac0fb84c3468fdf0b1a4bee35e6f30

Download Submit
C:\Windows\system\AjjzVfR.exe

Filesize
1.9MB

MD5
80e608045f96e4ec8e7446e848f2a8ee

SHA1
50add102de2e24f8444d317e6de604a220947d8d

SHA256
c40088ccddc9fe16f2c5cb1de0ef3d1a888fcd5cd22a3537f308f4cf396e188e

SHA512
85ce329dbe48e7abc867cf7efbf5e9185de030427ae0552e75c75fdc517fc7a9d33f012f34d143147ddffb4cde08727cf1b78a53aa8164a9b4b09b7236dc3314

Download Submit
C:\Windows\system\BMjLwDP.exe

Filesize
1.9MB

MD5
64b759e75888e4b748b007de0543a896

SHA1
7b81e925744aaeac2b0a6d82e03d807ddd793854

SHA256
e68fd2ef02af0be8c726925b7bb494bbb279015a6048db2f4ca7d453da1998d5

SHA512
cbc3fa4edda8232d2f18e5ad325c351710265a84dd00dee4ef09b26ec95ad8f74a18c4131af750a206eee2f0d549ddd2b2498c828988866ce5d9f76d7267a5f6

Download Submit
C:\Windows\system\BmHkrIw.exe

Filesize
1.9MB

MD5
518868fefc1bb1a751b5807aa5b9f87b

SHA1
9a96cb5320d112c71266cad2a595df3b107775b6

SHA256
8c6eb9bb023674706a7c35dc2303d5626bf6d0d28fdee4e041805de6f95559a7

SHA512
d8f42ad2b820a7c9fd347539ad859c958ca688b89905616c585327ead2c0d8afb30bbef48008aae3fef0c567f748d1fae6018923db5161ff909b4b4d8e3ef6b6

Download Submit
C:\Windows\system\DFumWCR.exe

Filesize
1.9MB

MD5
95d36b42ca10ec860ac4e7553f3feb2f

SHA1
1f0a2b0723f84988173de58ff2c8fb1fc89c5b1a

SHA256
707b4192aeee8d55006c0b56d86530bbed2e65110a0aa303372b21ec73161cfe

SHA512
2eb6988303e8b5488cb1e8449d67d96fba9cae5f4a7d9d507fe421b8c2539fac31efa6c91aa29d49100589bdca62d883a1922ff1615fa51dae09ab81fa59c3ab

Download Submit
C:\Windows\system\EMWeUHJ.exe

Filesize
1.9MB

MD5
0b478f4ee055d50f4ce489989722d06c

SHA1
c38a9d6e613e7cd1c07579e6e9aecf0d28fffee6

SHA256
9f82453e809a9080428e30d7526a0eae2f6167bd7711941bcda8962c058dc13c

SHA512
e7425837e1798a58c64727e007798f7096a4bf2e408a76af084fd1cace76750b84bfecfc897ca1dae292f11fd20d7a01d3f6087080ecd7f4065bc0fecc8f68fd

Download Submit
C:\Windows\system\FxsYwYO.exe

Filesize
1.9MB

MD5
5c0625cc5b85c50316a3ee089a43a160

SHA1
56f354c5a8f0ef8115d10648d49b80cf398e30b9

SHA256
6fa1b7bb37508597ba4997229b853325941dc82ee8de798203c9981157825553

SHA512
3807a2dde3d6575621208365d19cf6ba99a5c8ea591ce5c9887d1f4be2de94dac2a6ca8041ac5d8bad83e72748d9c3bc2908dd7faeae073ac8ee960b31d17293

Download Submit
C:\Windows\system\PPNvxjh.exe

Filesize
1.9MB

MD5
585ce12455d563d5a183b3c7b6df2140

SHA1
22fa2e28e2bec894314916994f2fd840929afa0f

SHA256
2dcad007784f8995180cbf7a2baa9f9fd3d700999051c7e5774fc292523a909c

SHA512
910eb31072abbbd122a39e7e20afbbf13a91d1cf55ad3a4df103bd911d6025c176a100baaeee483e5d2344066a1882f52765374c9c5e4dd87b7c183bcf14a868

Download Submit
C:\Windows\system\PldPPun.exe

Filesize
1.9MB

MD5
6674437265cad45acb5e7ad53e99a07a

SHA1
ae5f33095a17c68b1bc5200ca2303bf6aeceeb73

SHA256
148dd91b30c172dc29c33b493c12161acba81278903f5836a6f02c0b7324fb0c

SHA512
87434e53de67d0e5ccd959cb03077f80605989a76d13e32d59efa2814728039dd9af4fa3106282f3dae6f791d06f880583c59cb86857fa2ac37b9203f8b480bf

Download Submit
C:\Windows\system\VMnOwnt.exe

Filesize
1.9MB

MD5
f5cc116df1dabda33773f98627bb4b50

SHA1
6e1a33219a2ae4305bb40bfcfee9a3310aaeb8dc

SHA256
3c2f3404bb770e13a0923977e96ce039cf905c231c849af7e96812609a780480

SHA512
672e59a29ee0217f95e845af94ad722f14414e270bdf0a90fea6ec510fe88d775b3e90c530b15e1ecb571cd32b3e95a682fa57249460965dffc84a78bc555568

Download Submit
C:\Windows\system\WRGqPDF.exe

Filesize
1.9MB

MD5
e5e5b90d0fdab8df86bfd80ddb7cd762

SHA1
e049a1223971aa0e7002f42b7a6b6b9f5cf1c866

SHA256
3de65296ca01f07c4e90ca8e42b1315dda9b3a995572299158d7949ab4b13fd3

SHA512
b0e7ae54e98437550d42a7493690cb1e2d933931a9fea3c5e662b82216b0b16d4b92cba89150e512dc8beeb3f7e09036ee23aa90b0b9199bed0a7ddd2764dcce

Download Submit
C:\Windows\system\XBUApUz.exe

Filesize
1.9MB

MD5
949f1fe692278aa4d0e457556efa5fab

SHA1
551e770029fcc6cc6acaa816c8d81361f23b6acc

SHA256
f2fd3136bf2147c232b44dd9173bf5b45a97a05224a59f774ba8f459493a48f6

SHA512
1d6b1302405d9fb995bd1a44757e8156ab8480623868343cb54b4afd348ff03623247debdca979bf7a2ee4ff125b2794d27fe90ae001f5e6de7206d23d01c8f5

Download Submit
C:\Windows\system\aDsWqwq.exe

Filesize
1.9MB

MD5
5735aba40e6a4532ef185146653cbb6a

SHA1
e3896f44a0f746469741df19ce805a1b6049eb71

SHA256
e75b5971d99163427c298bd362ae95be03a33dc47ed5a75dbdc2c0218aba6b72

SHA512
113b8fa0d35267016d58e16bf80ed47fd6861f3ec2815ee8852c6b8072f7994a07ee6ba9542127fbea42cf140beced988c3f277de0a367c7311e50fbe52e9b10

Download Submit
C:\Windows\system\alypdZV.exe

Filesize
1.9MB

MD5
ab5ec00c4d2ca79114d48b05b033bd99

SHA1
b02ce55f224faa44cc022e6830708e79b4facf41

SHA256
296ec7670b665c33967790c5fc32f42a618c488d4766848709c8577df43f13df

SHA512
5e2b5bfb4f4345f30b53311cfaa37243a1d4b54776d1c1112d4ca0260ca7f0c9cc0fb32af783fe7adb9e0cbdd6ea93255c26ba927adc87a1efe902bf6cdf0b08

Download Submit
C:\Windows\system\gmSRMoJ.exe

Filesize
1.9MB

MD5
976b3eafd463c68eeeba5687fe7e280d

SHA1
e74e9bfe54256c629c4addb3b09b28c07a3688f6

SHA256
751f047361cf2cbf58af859ffedeeef5dc168e37bd8ef358a4f0800a1aeb7119

SHA512
ebffcf1231410551ba36407d65943eca245139a124b0c1d09bdf60a35169a8863910c57b08d475c8f3387baa14ee3fbb7d71bef6c7b51ac5661ae80d486c8d2b

Download Submit
C:\Windows\system\hKSJNKU.exe

Filesize
1.9MB

MD5
856d3f106230cfc26fd8cafdb778d656

SHA1
9a27fc5219e8ba6a6192e23b72b56b3a8710285f

SHA256
7e149d0d6690b029bf4f2ebc471625bd7c742a207efc897c38b90fc080c32985

SHA512
48e48bca236f12d43f1d5718cdeb73036764febf5f469b27192a78f887b212bfc28e0309e011c11d32782e963abcf42784fcbfd496852daa25ebd7ccc0fda350

Download Submit
C:\Windows\system\iQLSYcc.exe

Filesize
1.9MB

MD5
3d767d3ca7ca41a88455014748878c32

SHA1
1c3d837fd7a94e3844bb3665d041095e8bbe0698

SHA256
795b809c041fecd5186c8c66bf1c09f36b82663db1cebeea53d55994dd7aa955

SHA512
d68c9fab653e3e07b9dd0a7118d3b727ce889da3e0b6d9a927483eae5a16242bab1864388d5b598965db3b6c1a6b81822b316dfae256abce3594312f820d881c

Download Submit
C:\Windows\system\mYuywBw.exe

Filesize
1.9MB

MD5
6db29ecbf974a733b62286fb576dd61c

SHA1
76d29bc192952a469d179bfa464d8047b976d11e

SHA256
116b75379c3da58ea9453eb67d80b4d41e6a0786c184f29eb1fa5b2a55f5ef4b

SHA512
2b8521782ec97aa1c9e2f38f9a658dac242f32777144fe6c9b3f8a6d54dd3570ca833403ba5db5f5cec7c0a461598341e8d5d8cbfafdb0edba7c4468a33936c2

Download Submit
C:\Windows\system\nIYcjAd.exe

Filesize
1.9MB

MD5
1ca43315d33ee5935254139a9016b9b5

SHA1
c35e4399fb069b9acf7d6055cab9bb24754b3bb1

SHA256
029daf2e23cad29f0b969656da2a244fb6055d8f2749d928e6e34d1abee539a5

SHA512
d756c8a3f40452c4e4487837bf7d8331827b9f6b72e984368c84824e607ed3bea0cf9003d5bae48cee1c93811f4c500998bed8407eb36b4675a7b5258daa3e30

Download Submit
C:\Windows\system\qdooQdV.exe

Filesize
1.9MB

MD5
57d80348571dd9b3f1d9bfdb4a8c1ae4

SHA1
ea07baa444883e95567d5aa7451c1e193e35c341

SHA256
0bcc1b16ff945b5aa52fcb3b567382f9f308cfc7420e89580aacef253571bbb8

SHA512
173ecde05ed530da3e2ec6a3a59f6b4c9ac40d18d1e8bbeb5f149a2a9aa2acc83f819b1f317bba102e008cd443501116a1adf7077e7f45818f1e2352b0bc4286

Download Submit
C:\Windows\system\uZpCdLj.exe

Filesize
1.9MB

MD5
7de952cb451314cf4a7d7bfc66141a5f

SHA1
795e978db6be34c4e8e677896b2082817feba5bc

SHA256
f14e5c8c0f34e5436f7a8da404d502ed4cc2ebb6acfb8d86a026f3571ae95cdf

SHA512
75b3845453c07a035357e1e97964dc432391911fbff10c1b191eb201c56f68cc411ea72337e6a9c8ebcf78dfad3edc2af377056f6996779f438d5e6c46206009

Download Submit
C:\Windows\system\xHTzBNC.exe

Filesize
1.9MB

MD5
dfa72e5e229f995e7be95cd7bce9fc62

SHA1
17f8b43734f2e2dc0d2054b350eeeb246ed1f9b8

SHA256
a0a057ab70eea6f7a3b1c798ecc667f24299aa8f496a1d3b5c1682d6eb3373d5

SHA512
c2857203694fa7fb0f34a4046f7573bcde7729fa8b521bb2862cf1cb60a338ada40dfa35ea71cd1441fb847ef6a96e6935a043f30298376826844374424c2cd2

Download Submit
C:\Windows\system\xQqdIUs.exe

Filesize
1.9MB

MD5
d4838d7afb3a80057360caae04361d30

SHA1
5a78852ce8082603b2f9ac504b8ddbef4fd95223

SHA256
b96b5dcab2232b075e1c5433c1d8137494b5fb9b7f46164ebfbad1286795a25d

SHA512
7acbc1239e993b9dfedac4222c40eff30fb1bb32dbbece5fa1ab12de0bbe5d70b0dec4e8b2f794199050c492cc0201a4f3511c2a2a96e9934d9434dfc83cfa74

Download Submit
\Windows\system\GcVOSJT.exe

Filesize
1.9MB

MD5
38689004e9f1bf89ca3d9e3b340841d0

SHA1
9f9971a3a7e27540b508463177519ed3a810d3f2

SHA256
4887b0d0cc7f7bbd7618a713f706041b154160fe2fd17202a2a8a437f3f40c04

SHA512
79931d980999445a79cbe048d6024728f2f45fb088b76708160c6851f88d2ca2238703d1a7cef1e8c3186399571617d173e03a4c153593727f4eb98ea8e6de71

Download Submit
\Windows\system\IIAmMJP.exe

Filesize
1.9MB

MD5
e474db6ac5af8186225713c77b729476

SHA1
fcedc6de2578376cc98f30817b5c6b09f78334ad

SHA256
7b573873b3d6aa881bd3c3e511e395899743ac42383acc0cb5ed7ae4686f1017

SHA512
5d320dab346948a2c792a3885eb2bd3cb35fba42b8ad49acc17716d5beb935b4dee97962d134d7c74379c7dc93e11d0667656f02105a79dfdb2ea647c7fe7642

Download Submit
\Windows\system\IICdWWn.exe

Filesize
1.9MB

MD5
82217c6b9f8b8114273ea75190cf8fa7

SHA1
e360d8268e4347d3caca0ea8ddba0db7757ad504

SHA256
087b4f61ac00c945fa8d11998a87a3a7e3ab4155a0c5a0e1a644193648aaa112

SHA512
5b8262a8deddfa6f6f9c69e84927d8e5a65170ea71201d163e5bdcad3a4608071906ee3022ac33afd02377c8fcfe069ad344ab258b14ed60e00969e7f19f9b15

Download Submit
\Windows\system\ILHwPvu.exe

Filesize
1.9MB

MD5
781d87b1b219e9e8d8ff3bc26c741c37

SHA1
f0973701b65dee610b85d4e6638b5d18eaefc64f

SHA256
704d6ed97fc629e15e32a6d0192a89d59e28b90d39693fa29f8ebf00b070f202

SHA512
06e03f16e7cd6f661c1d661ac4358ad6bcd3bebb58209761ba2f95380cb86cba2630db826629c11db61150cd8126d5e10544140bb74c23c35fbc278718c8bbe6

Download Submit
\Windows\system\JCUiapM.exe

Filesize
1.9MB

MD5
3e43ff5105ccb77a46729ac90d962110

SHA1
265ade6d41ab096eb92990b339a409f82687e86f

SHA256
eaa0ed8f4e3c0467388ce3a5e152f7db916b06b8656738d857771c6fd236b2c5

SHA512
762087c790a097927dc429331acc0a8b6c1599ffd4f87ec29de326222aa7ddd153fd68cefd3cd534805cf18aa8c6495e6fd7d45643675f154c52f19a7f4eb5ad

Download Submit
\Windows\system\KYfAGGx.exe

Filesize
1.9MB

MD5
5990e1e7e11922c34e38e8a3526b5dfc

SHA1
88ee09d5ef614ebfb1d2895c70e48e043e9f3ad1

SHA256
b406ac6f7fa5cc3cfc4df8991955f91a2d2c134647b22494334ba465da790c8d

SHA512
e1804b31960db79f8bdfc11cdd9031af3da4a43c94d5cc8afae2a4e0ae9bdf900353991e0dc3a38a4c40be61c98e73b820429311c0fd205a32ae18517e6080f0

Download Submit
\Windows\system\NpSycOE.exe

Filesize
1.9MB

MD5
7d2e5b77971f16ed97010b792269cb28

SHA1
a54b16d323b1fcf52f4c0735bfbbe59ed3f0dcc6

SHA256
79cdd376d0c4da3686f7f476e6e15c65523c2d2d20ca583f434f7dea0626b34b

SHA512
90413ac9d99f6d62fd519dc682de1c7416f88cff3bb88e6b6499d71592700b9c9714b1849dd9d475f75c83dbcd9206c71522eb2a556a305781bccabb29284d3d

Download Submit
\Windows\system\OvFZgAz.exe

Filesize
1.9MB

MD5
2c7578e18b10603dfa7e1045ae84a32b

SHA1
bd384dc4d3b58d7cc39fe5dde121eb0c0e5a4e07

SHA256
2d4a4643bdac4aff649f9664b95eb4e51a5b256e4869428e15d5fb22b909a28d

SHA512
56f9d12cd2fb429ba32f209b01c87d6165cf52597a96462a6c630b982fc011c0efbd28564949d4ff5e5a0dd40eb7646657d0b3d002aa9a084651394354489679

Download Submit
\Windows\system\XsSOogH.exe

Filesize
1.9MB

MD5
9740e5e5d6f5c2d533b650aca1a0b877

SHA1
7e0337d13e7955ac64c6e8ebdd963f18c42dd747

SHA256
44a19375437671de9711be15678b72cb85763c8f358c63b72ea581298a108e21

SHA512
afa46da25cbfe02ab691f4ff03c11d5d35a8a15c87ed2dcbf31ed3dd8e417d6c3c115f7eeb6709faa4297d4e0271fde323e6cb7572a2eaac213f7f5fba77033c

Download Submit
\Windows\system\bSQkjop.exe

Filesize
1.9MB

MD5
becea910fbc9ae506640a782a9d437ef

SHA1
f5de333ce5288db6243943beef8382794692db05

SHA256
0d50eee0413b5e1b3a654638bf6103fc54b7f17c8af1cda43096aab2db87a09a

SHA512
94fe3b8c82a5a6650cb977cc7a7b511d59ec69192d65b6236788404f5c570b93479c3d66e1fd0cd1860fbe5bf1525fa371c20ed63e253bb63e37354fd1fa9a6d

Download Submit
memory/824-171-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/824-192-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/824-179-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/824-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/824-177-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/824-7-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/824-173-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/824-187-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/824-0-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/824-190-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/824-180-0x0000000002E90000-0x0000000003282000-memory.dmp

Filesize
3.9MB

Download
memory/824-185-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2192-195-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2492-191-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2536-172-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2536-201-0x0000000001E60000-0x0000000001E68000-memory.dmp

Filesize
32KB

Download
memory/2536-169-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2536-170-0x00000000028E0000-0x0000000002960000-memory.dmp

Filesize
512KB

Download
memory/2536-246-0x000007FEF6080000-0x000007FEF6A1D000-memory.dmp

Filesize
9.6MB

Download
memory/2536-188-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2544-196-0x000000013FB40000-0x000000013FF32000-memory.dmp

Filesize
3.9MB

Download
memory/2584-184-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2596-176-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2604-183-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2672-178-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2704-189-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2892-186-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download