xmrig | fb08ee20a729aa90eee5fc4f671ef90ab89b28cf1780e5e4ffc9205f1eb81a5b

Analysis

max time kernel
40s
max time network
37s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
Size

1.7MB
MD5

05da1e72c19691b2282fc03657a6a0a4
SHA1

7093c21092f440be2f5790026076fdaf079eb118
SHA256

fb08ee20a729aa90eee5fc4f671ef90ab89b28cf1780e5e4ffc9205f1eb81a5b
SHA512

2822085734e18206af0c4b1df2ba7f384f89177ca86c4ebeb3dc3fca30e8153cc78723fad477749ff1c1fd85f65a2e6f4f0a0e195e759d295e678809838d1295
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pxtU9:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2548-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2584-275-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2500-271-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2532-269-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2640-233-0x000000013F130000-0x000000013F522000-memory.dmp	xmrig
behavioral1/memory/2768-157-0x000000013FD40000-0x0000000140132000-memory.dmp	xmrig
behavioral1/memory/2772-155-0x000000013FC10000-0x0000000140002000-memory.dmp	xmrig
behavioral1/memory/2700-152-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	xmrig
behavioral1/memory/1704-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2548	vlZCaKL.exe
1704	goWwXeY.exe
2700	hOZtWZX.exe
2584	FqQzDlI.exe
2772	vWVYuWC.exe
2768	DEvISZO.exe
2640	dPgiobq.exe
2532	WMPXgEd.exe
2500	THSTGYW.exe
2076	TNOoIVK.exe
2968	fGYNKat.exe
2484	xSwOOxW.exe
600	dksGUpo.exe
1064	ggJpztA.exe
720	kKOOHfZ.exe
1868	CdePWZZ.exe
1112	FZnvicL.exe
1792	QeOvvAr.exe
2044	onYZmgh.exe
1228	zJeBOFP.exe
1676	pmPBwjE.exe
2232	gUcfvHw.exe
2360	FgIuPin.exe
2424	ZbxrjSv.exe
1212	zSYOWJq.exe
1516	bOOzjsy.exe
956	opeNpbh.exe
1992	tDlEcYE.exe
1732	VhxhmSA.exe
1672	SQyEfTz.exe
448	JotbFhi.exe
2724	PdnvTZW.exe
2752	dTXLCbr.exe
1536	QdjDtVA.exe
1540	wsowCVd.exe
2824	HbXcuuL.exe
1072	CLCDmyY.exe
1844	mYBaEQO.exe
1316	ZhMPBkA.exe
1016	XyeWRXZ.exe
2192	XJaDZXi.exe
1788	JsyFmCZ.exe
912	jNCIyce.exe
964	wxpkisN.exe
2184	zfTquXk.exe
1348	gRgQuDj.exe
240	IVBtjQM.exe
2296	xNqwiWi.exe
2900	AIhtAau.exe
1772	KUiGxgV.exe
1328	DWaReeh.exe
2060	EaBshdm.exe
2280	mpKRrWn.exe
2288	cllzrmX.exe
340	vxIUXGo.exe
1764	wRzSHpa.exe
1724	rMRcOFn.exe
2720	aqndYim.exe
1940	RopkzGT.exe
2464	CUjRAde.exe
3016	PTUcxEQ.exe
1876	ksRPict.exe
2256	bMInUyQ.exe
1696	svxBnkw.exe

Loads dropped DLL 64 IoCs

pid	Process
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000f000000005578-18.dat	upx
behavioral1/files/0x0008000000015d31-15.dat	upx
behavioral1/files/0x000c00000001220d-5.dat	upx
behavioral1/memory/2996-0-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0009000000015f7a-28.dat	upx
behavioral1/files/0x0008000000016176-32.dat	upx
behavioral1/memory/2548-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x0007000000016287-35.dat	upx
behavioral1/files/0x0007000000016448-40.dat	upx
behavioral1/files/0x000700000001650c-44.dat	upx
behavioral1/files/0x0007000000016c51-55.dat	upx
behavioral1/files/0x0006000000016ca5-63.dat	upx
behavioral1/files/0x0006000000017422-161.dat	upx
behavioral1/memory/2584-275-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2500-271-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/memory/2532-269-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2640-233-0x000000013F130000-0x000000013F522000-memory.dmp	upx
behavioral1/files/0x00060000000174a5-166.dat	upx
behavioral1/memory/2768-157-0x000000013FD40000-0x0000000140132000-memory.dmp	upx
behavioral1/memory/2772-155-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/memory/2700-152-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/1704-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0006000000017407-131.dat	upx
behavioral1/files/0x000600000001737c-123.dat	upx
behavioral1/files/0x00060000000173f2-127.dat	upx
behavioral1/files/0x0006000000017374-119.dat	upx
behavioral1/files/0x0006000000017371-116.dat	upx
behavioral1/files/0x0006000000016fed-107.dat	upx
behavioral1/files/0x000600000001735a-111.dat	upx
behavioral1/files/0x0006000000016e4a-103.dat	upx
behavioral1/files/0x0006000000016e24-99.dat	upx
behavioral1/files/0x0006000000016d57-95.dat	upx
behavioral1/files/0x0006000000016d51-91.dat	upx
behavioral1/files/0x0006000000016d3e-87.dat	upx
behavioral1/files/0x0006000000016d1a-83.dat	upx
behavioral1/files/0x0006000000016d16-79.dat	upx
behavioral1/files/0x0006000000016cc6-75.dat	upx
behavioral1/files/0x0006000000016cbe-71.dat	upx
behavioral1/files/0x0006000000016cb6-67.dat	upx
behavioral1/files/0x0006000000016c7c-59.dat	upx
behavioral1/files/0x000a000000016be2-52.dat	upx
behavioral1/files/0x00070000000165ae-48.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\RnGWlGD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\PgyrlVd.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\yEfuGZU.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\uBeEcvu.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\QbtfoVd.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\HYxucSL.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\FLvEYEd.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\nqpucKk.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\HaDANHk.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\nloAZhz.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\JNTmvxX.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\pTGeERp.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\UUZCutT.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\olZIkSs.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\AonaxPC.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\VhxhmSA.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\gUzAikN.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\tehrrpv.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\RqKCiad.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\cDODLKX.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\JksGtTi.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\BSkDwCd.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ukyEqjs.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\NTbfjZd.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\WinJuuo.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\sVsvRBA.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\phYrUET.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\LnLnWkO.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\sTViHut.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\QRPxsXj.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\jCiERPh.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\IVBtjQM.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\DnJcpwr.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\bxBfHxf.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\WwVycBa.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YPQYGmP.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\TaBlqUy.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\wApqVmL.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\UdmsAFL.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\lQNxLQy.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\JLpvSCD.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\zqcJHde.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\ZYWoYSy.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\rqwTQjV.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\jlDxJZH.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\RKmCiNA.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\iCBJMXO.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\XVtWVhk.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\VRiBPXN.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\CwmKqTK.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\voACVEG.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\SmIeUFK.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\FTJNpDM.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\GdwLGhh.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\XjcVdIP.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\zfTquXk.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\USOEQbl.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\xWKSVCY.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\JIRSEQx.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\YdSwduh.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\IrPEtxn.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\dWIAuFh.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\XASuoqP.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
File created	C:\Windows\System\smQzrxl.exe	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2924	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
Token: SeDebugPrivilege	2924	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2924	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	29
PID 2996 wrote to memory of 2924	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	29
PID 2996 wrote to memory of 2924	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	29
PID 2996 wrote to memory of 2548	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2548	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	30
PID 2996 wrote to memory of 2548	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	30
PID 2996 wrote to memory of 1704	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	31
PID 2996 wrote to memory of 1704	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	31
PID 2996 wrote to memory of 1704	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	31
PID 2996 wrote to memory of 2700	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2700	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2700	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	32
PID 2996 wrote to memory of 2584	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	33
PID 2996 wrote to memory of 2584	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	33
PID 2996 wrote to memory of 2584	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	33
PID 2996 wrote to memory of 2772	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	34
PID 2996 wrote to memory of 2772	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	34
PID 2996 wrote to memory of 2772	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	34
PID 2996 wrote to memory of 2768	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2768	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2768	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	35
PID 2996 wrote to memory of 2640	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	36
PID 2996 wrote to memory of 2640	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	36
PID 2996 wrote to memory of 2640	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	36
PID 2996 wrote to memory of 2532	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	37
PID 2996 wrote to memory of 2532	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	37
PID 2996 wrote to memory of 2532	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	37
PID 2996 wrote to memory of 2500	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	38
PID 2996 wrote to memory of 2500	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	38
PID 2996 wrote to memory of 2500	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	38
PID 2996 wrote to memory of 2076	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2076	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2076	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	39
PID 2996 wrote to memory of 2968	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	40
PID 2996 wrote to memory of 2968	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	40
PID 2996 wrote to memory of 2968	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	40
PID 2996 wrote to memory of 2484	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	41
PID 2996 wrote to memory of 2484	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	41
PID 2996 wrote to memory of 2484	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	41
PID 2996 wrote to memory of 600	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	42
PID 2996 wrote to memory of 600	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	42
PID 2996 wrote to memory of 600	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	42
PID 2996 wrote to memory of 1064	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	43
PID 2996 wrote to memory of 1064	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	43
PID 2996 wrote to memory of 1064	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	43
PID 2996 wrote to memory of 720	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	44
PID 2996 wrote to memory of 720	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	44
PID 2996 wrote to memory of 720	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	44
PID 2996 wrote to memory of 1868	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	45
PID 2996 wrote to memory of 1868	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	45
PID 2996 wrote to memory of 1868	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	45
PID 2996 wrote to memory of 1112	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	46
PID 2996 wrote to memory of 1112	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	46
PID 2996 wrote to memory of 1112	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	46
PID 2996 wrote to memory of 1792	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	47
PID 2996 wrote to memory of 1792	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	47
PID 2996 wrote to memory of 1792	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	47
PID 2996 wrote to memory of 2044	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	48
PID 2996 wrote to memory of 2044	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	48
PID 2996 wrote to memory of 2044	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	48
PID 2996 wrote to memory of 1228	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	49
PID 2996 wrote to memory of 1228	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	49
PID 2996 wrote to memory of 1228	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	49
PID 2996 wrote to memory of 1676	2996	05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05da1e72c19691b2282fc03657a6a0a4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- C:\Windows\System\vlZCaKL.exe
  C:\Windows\System\vlZCaKL.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\goWwXeY.exe
  C:\Windows\System\goWwXeY.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\hOZtWZX.exe
  C:\Windows\System\hOZtWZX.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\FqQzDlI.exe
  C:\Windows\System\FqQzDlI.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\vWVYuWC.exe
  C:\Windows\System\vWVYuWC.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\DEvISZO.exe
  C:\Windows\System\DEvISZO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\dPgiobq.exe
  C:\Windows\System\dPgiobq.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\WMPXgEd.exe
  C:\Windows\System\WMPXgEd.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\THSTGYW.exe
  C:\Windows\System\THSTGYW.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\TNOoIVK.exe
  C:\Windows\System\TNOoIVK.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\fGYNKat.exe
  C:\Windows\System\fGYNKat.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\xSwOOxW.exe
  C:\Windows\System\xSwOOxW.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\dksGUpo.exe
  C:\Windows\System\dksGUpo.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\ggJpztA.exe
  C:\Windows\System\ggJpztA.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\kKOOHfZ.exe
  C:\Windows\System\kKOOHfZ.exe
  2⤵
  - Executes dropped EXE
  PID:720
- C:\Windows\System\CdePWZZ.exe
  C:\Windows\System\CdePWZZ.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\FZnvicL.exe
  C:\Windows\System\FZnvicL.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\QeOvvAr.exe
  C:\Windows\System\QeOvvAr.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\onYZmgh.exe
  C:\Windows\System\onYZmgh.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\zJeBOFP.exe
  C:\Windows\System\zJeBOFP.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\pmPBwjE.exe
  C:\Windows\System\pmPBwjE.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\gUcfvHw.exe
  C:\Windows\System\gUcfvHw.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\FgIuPin.exe
  C:\Windows\System\FgIuPin.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\ZbxrjSv.exe
  C:\Windows\System\ZbxrjSv.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\zSYOWJq.exe
  C:\Windows\System\zSYOWJq.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\bOOzjsy.exe
  C:\Windows\System\bOOzjsy.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\opeNpbh.exe
  C:\Windows\System\opeNpbh.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\tDlEcYE.exe
  C:\Windows\System\tDlEcYE.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\VhxhmSA.exe
  C:\Windows\System\VhxhmSA.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\SQyEfTz.exe
  C:\Windows\System\SQyEfTz.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\JotbFhi.exe
  C:\Windows\System\JotbFhi.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\PdnvTZW.exe
  C:\Windows\System\PdnvTZW.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\dTXLCbr.exe
  C:\Windows\System\dTXLCbr.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\QdjDtVA.exe
  C:\Windows\System\QdjDtVA.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\wsowCVd.exe
  C:\Windows\System\wsowCVd.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\HbXcuuL.exe
  C:\Windows\System\HbXcuuL.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\CLCDmyY.exe
  C:\Windows\System\CLCDmyY.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\mYBaEQO.exe
  C:\Windows\System\mYBaEQO.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\ZhMPBkA.exe
  C:\Windows\System\ZhMPBkA.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\XyeWRXZ.exe
  C:\Windows\System\XyeWRXZ.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\XJaDZXi.exe
  C:\Windows\System\XJaDZXi.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\JsyFmCZ.exe
  C:\Windows\System\JsyFmCZ.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\jNCIyce.exe
  C:\Windows\System\jNCIyce.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\wxpkisN.exe
  C:\Windows\System\wxpkisN.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\zfTquXk.exe
  C:\Windows\System\zfTquXk.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\gRgQuDj.exe
  C:\Windows\System\gRgQuDj.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\IVBtjQM.exe
  C:\Windows\System\IVBtjQM.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\xNqwiWi.exe
  C:\Windows\System\xNqwiWi.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\AIhtAau.exe
  C:\Windows\System\AIhtAau.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\KUiGxgV.exe
  C:\Windows\System\KUiGxgV.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\DWaReeh.exe
  C:\Windows\System\DWaReeh.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\EaBshdm.exe
  C:\Windows\System\EaBshdm.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\mpKRrWn.exe
  C:\Windows\System\mpKRrWn.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\cllzrmX.exe
  C:\Windows\System\cllzrmX.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\vxIUXGo.exe
  C:\Windows\System\vxIUXGo.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\wRzSHpa.exe
  C:\Windows\System\wRzSHpa.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\rMRcOFn.exe
  C:\Windows\System\rMRcOFn.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\aqndYim.exe
  C:\Windows\System\aqndYim.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\RopkzGT.exe
  C:\Windows\System\RopkzGT.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\PTUcxEQ.exe
  C:\Windows\System\PTUcxEQ.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\CUjRAde.exe
  C:\Windows\System\CUjRAde.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ksRPict.exe
  C:\Windows\System\ksRPict.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\bMInUyQ.exe
  C:\Windows\System\bMInUyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\svxBnkw.exe
  C:\Windows\System\svxBnkw.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\TmdwEDS.exe
  C:\Windows\System\TmdwEDS.exe
  2⤵
  PID:1812
- C:\Windows\System\yxzYkih.exe
  C:\Windows\System\yxzYkih.exe
  2⤵
  PID:400
- C:\Windows\System\NfYgGHD.exe
  C:\Windows\System\NfYgGHD.exe
  2⤵
  PID:1624
- C:\Windows\System\JlFGnqs.exe
  C:\Windows\System\JlFGnqs.exe
  2⤵
  PID:1444
- C:\Windows\System\elVTSJS.exe
  C:\Windows\System\elVTSJS.exe
  2⤵
  PID:1564
- C:\Windows\System\MyawsdZ.exe
  C:\Windows\System\MyawsdZ.exe
  2⤵
  PID:1284
- C:\Windows\System\AzfYnvz.exe
  C:\Windows\System\AzfYnvz.exe
  2⤵
  PID:2728
- C:\Windows\System\XPVpXWN.exe
  C:\Windows\System\XPVpXWN.exe
  2⤵
  PID:2748
- C:\Windows\System\LFfgCNl.exe
  C:\Windows\System\LFfgCNl.exe
  2⤵
  PID:984
- C:\Windows\System\COuZCqC.exe
  C:\Windows\System\COuZCqC.exe
  2⤵
  PID:1464
- C:\Windows\System\cYdrMbz.exe
  C:\Windows\System\cYdrMbz.exe
  2⤵
  PID:2168
- C:\Windows\System\QhpuDwB.exe
  C:\Windows\System\QhpuDwB.exe
  2⤵
  PID:2860
- C:\Windows\System\LEFbhpN.exe
  C:\Windows\System\LEFbhpN.exe
  2⤵
  PID:652
- C:\Windows\System\oQnQNkR.exe
  C:\Windows\System\oQnQNkR.exe
  2⤵
  PID:2008
- C:\Windows\System\WoTSwVH.exe
  C:\Windows\System\WoTSwVH.exe
  2⤵
  PID:328
- C:\Windows\System\yAiqIGR.exe
  C:\Windows\System\yAiqIGR.exe
  2⤵
  PID:2096
- C:\Windows\System\ixALnkh.exe
  C:\Windows\System\ixALnkh.exe
  2⤵
  PID:2892
- C:\Windows\System\ECKpxQa.exe
  C:\Windows\System\ECKpxQa.exe
  2⤵
  PID:2912
- C:\Windows\System\mxkMRoV.exe
  C:\Windows\System\mxkMRoV.exe
  2⤵
  PID:1712
- C:\Windows\System\enFzvYo.exe
  C:\Windows\System\enFzvYo.exe
  2⤵
  PID:604
- C:\Windows\System\tnRJsQY.exe
  C:\Windows\System\tnRJsQY.exe
  2⤵
  PID:2260
- C:\Windows\System\ykzWQeC.exe
  C:\Windows\System\ykzWQeC.exe
  2⤵
  PID:540
- C:\Windows\System\uIsbGmk.exe
  C:\Windows\System\uIsbGmk.exe
  2⤵
  PID:1388
- C:\Windows\System\pEHWPfx.exe
  C:\Windows\System\pEHWPfx.exe
  2⤵
  PID:3048
- C:\Windows\System\RqKCiad.exe
  C:\Windows\System\RqKCiad.exe
  2⤵
  PID:1588
- C:\Windows\System\KTakBZJ.exe
  C:\Windows\System\KTakBZJ.exe
  2⤵
  PID:1692
- C:\Windows\System\ijDKeEO.exe
  C:\Windows\System\ijDKeEO.exe
  2⤵
  PID:3068
- C:\Windows\System\KuzmdbP.exe
  C:\Windows\System\KuzmdbP.exe
  2⤵
  PID:2052
- C:\Windows\System\ijOoslv.exe
  C:\Windows\System\ijOoslv.exe
  2⤵
  PID:2604
- C:\Windows\System\IcStRPU.exe
  C:\Windows\System\IcStRPU.exe
  2⤵
  PID:2776
- C:\Windows\System\vdLwlOT.exe
  C:\Windows\System\vdLwlOT.exe
  2⤵
  PID:2680
- C:\Windows\System\JedDXMT.exe
  C:\Windows\System\JedDXMT.exe
  2⤵
  PID:2596
- C:\Windows\System\VTXGswj.exe
  C:\Windows\System\VTXGswj.exe
  2⤵
  PID:2344
- C:\Windows\System\WacdGKT.exe
  C:\Windows\System\WacdGKT.exe
  2⤵
  PID:1404
- C:\Windows\System\BonNzRy.exe
  C:\Windows\System\BonNzRy.exe
  2⤵
  PID:2436
- C:\Windows\System\iUcUmPP.exe
  C:\Windows\System\iUcUmPP.exe
  2⤵
  PID:2588
- C:\Windows\System\voRfBMI.exe
  C:\Windows\System\voRfBMI.exe
  2⤵
  PID:2664
- C:\Windows\System\qVnMasR.exe
  C:\Windows\System\qVnMasR.exe
  2⤵
  PID:2164
- C:\Windows\System\GalBZmI.exe
  C:\Windows\System\GalBZmI.exe
  2⤵
  PID:1852
- C:\Windows\System\wMZGkhn.exe
  C:\Windows\System\wMZGkhn.exe
  2⤵
  PID:1076
- C:\Windows\System\YPQYGmP.exe
  C:\Windows\System\YPQYGmP.exe
  2⤵
  PID:2376
- C:\Windows\System\afwTYKg.exe
  C:\Windows\System\afwTYKg.exe
  2⤵
  PID:2324
- C:\Windows\System\GZSijcA.exe
  C:\Windows\System\GZSijcA.exe
  2⤵
  PID:2304
- C:\Windows\System\sKDXpVa.exe
  C:\Windows\System\sKDXpVa.exe
  2⤵
  PID:1936
- C:\Windows\System\yjCBsov.exe
  C:\Windows\System\yjCBsov.exe
  2⤵
  PID:2012
- C:\Windows\System\JCTCGQu.exe
  C:\Windows\System\JCTCGQu.exe
  2⤵
  PID:1616
- C:\Windows\System\RnGWlGD.exe
  C:\Windows\System\RnGWlGD.exe
  2⤵
  PID:1312
- C:\Windows\System\qpErAqq.exe
  C:\Windows\System\qpErAqq.exe
  2⤵
  PID:268
- C:\Windows\System\UqpylRV.exe
  C:\Windows\System\UqpylRV.exe
  2⤵
  PID:1636
- C:\Windows\System\HMeDIEu.exe
  C:\Windows\System\HMeDIEu.exe
  2⤵
  PID:1244
- C:\Windows\System\ZfLubnb.exe
  C:\Windows\System\ZfLubnb.exe
  2⤵
  PID:2944
- C:\Windows\System\dowcOuD.exe
  C:\Windows\System\dowcOuD.exe
  2⤵
  PID:784
- C:\Windows\System\QQXurez.exe
  C:\Windows\System\QQXurez.exe
  2⤵
  PID:2704
- C:\Windows\System\hTonoFp.exe
  C:\Windows\System\hTonoFp.exe
  2⤵
  PID:1804
- C:\Windows\System\NBeYDQL.exe
  C:\Windows\System\NBeYDQL.exe
  2⤵
  PID:320
- C:\Windows\System\MSZkAft.exe
  C:\Windows\System\MSZkAft.exe
  2⤵
  PID:1592
- C:\Windows\System\xJdEzjk.exe
  C:\Windows\System\xJdEzjk.exe
  2⤵
  PID:2264
- C:\Windows\System\LVKehOU.exe
  C:\Windows\System\LVKehOU.exe
  2⤵
  PID:2688
- C:\Windows\System\dwRqayb.exe
  C:\Windows\System\dwRqayb.exe
  2⤵
  PID:1620
- C:\Windows\System\tXYOcMC.exe
  C:\Windows\System\tXYOcMC.exe
  2⤵
  PID:2316
- C:\Windows\System\PKxPvWb.exe
  C:\Windows\System\PKxPvWb.exe
  2⤵
  PID:1964
- C:\Windows\System\HsKomyF.exe
  C:\Windows\System\HsKomyF.exe
  2⤵
  PID:1532
- C:\Windows\System\zYpCQTG.exe
  C:\Windows\System\zYpCQTG.exe
  2⤵
  PID:568
- C:\Windows\System\LdepOSh.exe
  C:\Windows\System\LdepOSh.exe
  2⤵
  PID:2516
- C:\Windows\System\WFwNKjT.exe
  C:\Windows\System\WFwNKjT.exe
  2⤵
  PID:2300
- C:\Windows\System\whsEety.exe
  C:\Windows\System\whsEety.exe
  2⤵
  PID:1820
- C:\Windows\System\aHoYUcC.exe
  C:\Windows\System\aHoYUcC.exe
  2⤵
  PID:2248
- C:\Windows\System\DUCnbzd.exe
  C:\Windows\System\DUCnbzd.exe
  2⤵
  PID:1744
- C:\Windows\System\pTGeERp.exe
  C:\Windows\System\pTGeERp.exe
  2⤵
  PID:2492
- C:\Windows\System\QtQoylI.exe
  C:\Windows\System\QtQoylI.exe
  2⤵
  PID:2512
- C:\Windows\System\GxNVdSx.exe
  C:\Windows\System\GxNVdSx.exe
  2⤵
  PID:2352
- C:\Windows\System\gmVjAEI.exe
  C:\Windows\System\gmVjAEI.exe
  2⤵
  PID:1680
- C:\Windows\System\mAaVlpx.exe
  C:\Windows\System\mAaVlpx.exe
  2⤵
  PID:1528
- C:\Windows\System\NTbfjZd.exe
  C:\Windows\System\NTbfjZd.exe
  2⤵
  PID:1104
- C:\Windows\System\lOkOEVc.exe
  C:\Windows\System\lOkOEVc.exe
  2⤵
  PID:2200
- C:\Windows\System\SasEgfh.exe
  C:\Windows\System\SasEgfh.exe
  2⤵
  PID:2308
- C:\Windows\System\uLoZYCl.exe
  C:\Windows\System\uLoZYCl.exe
  2⤵
  PID:3076
- C:\Windows\System\nvkSnjf.exe
  C:\Windows\System\nvkSnjf.exe
  2⤵
  PID:3360
- C:\Windows\System\pcbEOrG.exe
  C:\Windows\System\pcbEOrG.exe
  2⤵
  PID:3376
- C:\Windows\System\ySqWxJg.exe
  C:\Windows\System\ySqWxJg.exe
  2⤵
  PID:3392
- C:\Windows\System\xjUFIrx.exe
  C:\Windows\System\xjUFIrx.exe
  2⤵
  PID:3408
- C:\Windows\System\BlfDNOo.exe
  C:\Windows\System\BlfDNOo.exe
  2⤵
  PID:3424
- C:\Windows\System\kGlMfqH.exe
  C:\Windows\System\kGlMfqH.exe
  2⤵
  PID:3440
- C:\Windows\System\arsbFhS.exe
  C:\Windows\System\arsbFhS.exe
  2⤵
  PID:3456
- C:\Windows\System\OvkhTzk.exe
  C:\Windows\System\OvkhTzk.exe
  2⤵
  PID:3472
- C:\Windows\System\uqSvBtt.exe
  C:\Windows\System\uqSvBtt.exe
  2⤵
  PID:3488
- C:\Windows\System\ZpAbcNe.exe
  C:\Windows\System\ZpAbcNe.exe
  2⤵
  PID:3504
- C:\Windows\System\pOiTmJy.exe
  C:\Windows\System\pOiTmJy.exe
  2⤵
  PID:3520
- C:\Windows\System\ZtfxNmh.exe
  C:\Windows\System\ZtfxNmh.exe
  2⤵
  PID:3536
- C:\Windows\System\JIzJokj.exe
  C:\Windows\System\JIzJokj.exe
  2⤵
  PID:3552
- C:\Windows\System\XBSsATi.exe
  C:\Windows\System\XBSsATi.exe
  2⤵
  PID:3568
- C:\Windows\System\hKBHKlT.exe
  C:\Windows\System\hKBHKlT.exe
  2⤵
  PID:3584
- C:\Windows\System\AxsAFGR.exe
  C:\Windows\System\AxsAFGR.exe
  2⤵
  PID:3600
- C:\Windows\System\YlFmTeq.exe
  C:\Windows\System\YlFmTeq.exe
  2⤵
  PID:3616
- C:\Windows\System\PwMoaWO.exe
  C:\Windows\System\PwMoaWO.exe
  2⤵
  PID:3632
- C:\Windows\System\PqQsshv.exe
  C:\Windows\System\PqQsshv.exe
  2⤵
  PID:3648
- C:\Windows\System\uxNhqPM.exe
  C:\Windows\System\uxNhqPM.exe
  2⤵
  PID:3672
- C:\Windows\System\vmeYOKV.exe
  C:\Windows\System\vmeYOKV.exe
  2⤵
  PID:3688
- C:\Windows\System\SMTDmab.exe
  C:\Windows\System\SMTDmab.exe
  2⤵
  PID:3704
- C:\Windows\System\PKTLGIc.exe
  C:\Windows\System\PKTLGIc.exe
  2⤵
  PID:3720
- C:\Windows\System\HAYqOPe.exe
  C:\Windows\System\HAYqOPe.exe
  2⤵
  PID:3736
- C:\Windows\System\lPBsMwN.exe
  C:\Windows\System\lPBsMwN.exe
  2⤵
  PID:3752
- C:\Windows\System\wZMRqHw.exe
  C:\Windows\System\wZMRqHw.exe
  2⤵
  PID:3768
- C:\Windows\System\tfVjyMk.exe
  C:\Windows\System\tfVjyMk.exe
  2⤵
  PID:3784
- C:\Windows\System\oPFnDca.exe
  C:\Windows\System\oPFnDca.exe
  2⤵
  PID:3800
- C:\Windows\System\DmcqIPX.exe
  C:\Windows\System\DmcqIPX.exe
  2⤵
  PID:3816
- C:\Windows\System\mtbpOtk.exe
  C:\Windows\System\mtbpOtk.exe
  2⤵
  PID:3832
- C:\Windows\System\CYgJApd.exe
  C:\Windows\System\CYgJApd.exe
  2⤵
  PID:3848
- C:\Windows\System\ICFBwCU.exe
  C:\Windows\System\ICFBwCU.exe
  2⤵
  PID:3864
- C:\Windows\System\llKkChu.exe
  C:\Windows\System\llKkChu.exe
  2⤵
  PID:3880
- C:\Windows\System\TaBlqUy.exe
  C:\Windows\System\TaBlqUy.exe
  2⤵
  PID:3896
- C:\Windows\System\gFfvwPp.exe
  C:\Windows\System\gFfvwPp.exe
  2⤵
  PID:3912
- C:\Windows\System\mblufgh.exe
  C:\Windows\System\mblufgh.exe
  2⤵
  PID:3940
- C:\Windows\System\TfIHFXJ.exe
  C:\Windows\System\TfIHFXJ.exe
  2⤵
  PID:3956
- C:\Windows\System\bgoclpz.exe
  C:\Windows\System\bgoclpz.exe
  2⤵
  PID:2556
- C:\Windows\System\NvGKDsm.exe
  C:\Windows\System\NvGKDsm.exe
  2⤵
  PID:2760
- C:\Windows\System\TuhfQXm.exe
  C:\Windows\System\TuhfQXm.exe
  2⤵
  PID:3096
- C:\Windows\System\UsedVog.exe
  C:\Windows\System\UsedVog.exe
  2⤵
  PID:3112
- C:\Windows\System\hwzvAlM.exe
  C:\Windows\System\hwzvAlM.exe
  2⤵
  PID:3140
- C:\Windows\System\EztHkiD.exe
  C:\Windows\System\EztHkiD.exe
  2⤵
  PID:3156
- C:\Windows\System\nJIWIBL.exe
  C:\Windows\System\nJIWIBL.exe
  2⤵
  PID:3172
- C:\Windows\System\sMCQvYV.exe
  C:\Windows\System\sMCQvYV.exe
  2⤵
  PID:3188
- C:\Windows\System\VwvcEYj.exe
  C:\Windows\System\VwvcEYj.exe
  2⤵
  PID:3204
- C:\Windows\System\FsLCnxs.exe
  C:\Windows\System\FsLCnxs.exe
  2⤵
  PID:3216
- C:\Windows\System\pEDlpza.exe
  C:\Windows\System\pEDlpza.exe
  2⤵
  PID:3232
- C:\Windows\System\QfDMGXF.exe
  C:\Windows\System\QfDMGXF.exe
  2⤵
  PID:3248
- C:\Windows\System\TBeDxXx.exe
  C:\Windows\System\TBeDxXx.exe
  2⤵
  PID:3264
- C:\Windows\System\HvPuSyk.exe
  C:\Windows\System\HvPuSyk.exe
  2⤵
  PID:3284
- C:\Windows\System\KSbBhis.exe
  C:\Windows\System\KSbBhis.exe
  2⤵
  PID:3300
- C:\Windows\System\lpbhipJ.exe
  C:\Windows\System\lpbhipJ.exe
  2⤵
  PID:3316
- C:\Windows\System\rnYMoaY.exe
  C:\Windows\System\rnYMoaY.exe
  2⤵
  PID:3332
- C:\Windows\System\DqBrLXL.exe
  C:\Windows\System\DqBrLXL.exe
  2⤵
  PID:2480
- C:\Windows\System\Lhsrgrz.exe
  C:\Windows\System\Lhsrgrz.exe
  2⤵
  PID:1752
- C:\Windows\System\duhlwxR.exe
  C:\Windows\System\duhlwxR.exe
  2⤵
  PID:2780
- C:\Windows\System\dxqsLpY.exe
  C:\Windows\System\dxqsLpY.exe
  2⤵
  PID:3400
- C:\Windows\System\ZkKuLVK.exe
  C:\Windows\System\ZkKuLVK.exe
  2⤵
  PID:3448
- C:\Windows\System\SRQUtZy.exe
  C:\Windows\System\SRQUtZy.exe
  2⤵
  PID:3512
- C:\Windows\System\UUZCutT.exe
  C:\Windows\System\UUZCutT.exe
  2⤵
  PID:3576
- C:\Windows\System\TskdaGo.exe
  C:\Windows\System\TskdaGo.exe
  2⤵
  PID:3640
- C:\Windows\System\lNPFNRS.exe
  C:\Windows\System\lNPFNRS.exe
  2⤵
  PID:3464
- C:\Windows\System\sSALpZk.exe
  C:\Windows\System\sSALpZk.exe
  2⤵
  PID:3560
- C:\Windows\System\DSlbZSS.exe
  C:\Windows\System\DSlbZSS.exe
  2⤵
  PID:3716
- C:\Windows\System\HuepvsH.exe
  C:\Windows\System\HuepvsH.exe
  2⤵
  PID:3776
- C:\Windows\System\NkIeENv.exe
  C:\Windows\System\NkIeENv.exe
  2⤵
  PID:3840
- C:\Windows\System\iufqVNa.exe
  C:\Windows\System\iufqVNa.exe
  2⤵
  PID:3904
- C:\Windows\System\uUBzvBB.exe
  C:\Windows\System\uUBzvBB.exe
  2⤵
  PID:1728
- C:\Windows\System\CXDQSdJ.exe
  C:\Windows\System\CXDQSdJ.exe
  2⤵
  PID:2028
- C:\Windows\System\FlmTaXS.exe
  C:\Windows\System\FlmTaXS.exe
  2⤵
  PID:2064
- C:\Windows\System\jvNecHn.exe
  C:\Windows\System\jvNecHn.exe
  2⤵
  PID:3976
- C:\Windows\System\whoyCLw.exe
  C:\Windows\System\whoyCLw.exe
  2⤵
  PID:4012
- C:\Windows\System\WFzNWIB.exe
  C:\Windows\System\WFzNWIB.exe
  2⤵
  PID:4044
- C:\Windows\System\tDyUahS.exe
  C:\Windows\System\tDyUahS.exe
  2⤵
  PID:4056
- C:\Windows\System\rhvrxim.exe
  C:\Windows\System\rhvrxim.exe
  2⤵
  PID:3628
- C:\Windows\System\oomDypI.exe
  C:\Windows\System\oomDypI.exe
  2⤵
  PID:3668
- C:\Windows\System\lGymNYN.exe
  C:\Windows\System\lGymNYN.exe
  2⤵
  PID:1652
- C:\Windows\System\iQFzTbF.exe
  C:\Windows\System\iQFzTbF.exe
  2⤵
  PID:1888
- C:\Windows\System\pjHVXdy.exe
  C:\Windows\System\pjHVXdy.exe
  2⤵
  PID:3108
- C:\Windows\System\SYjVexy.exe
  C:\Windows\System\SYjVexy.exe
  2⤵
  PID:2348
- C:\Windows\System\lEEDjiO.exe
  C:\Windows\System\lEEDjiO.exe
  2⤵
  PID:3088
- C:\Windows\System\lagRgQO.exe
  C:\Windows\System\lagRgQO.exe
  2⤵
  PID:3132
- C:\Windows\System\uBnhJnz.exe
  C:\Windows\System\uBnhJnz.exe
  2⤵
  PID:2696
- C:\Windows\System\FGavzau.exe
  C:\Windows\System\FGavzau.exe
  2⤵
  PID:1684
- C:\Windows\System\zUouzBq.exe
  C:\Windows\System\zUouzBq.exe
  2⤵
  PID:3292
- C:\Windows\System\mXqoTwf.exe
  C:\Windows\System\mXqoTwf.exe
  2⤵
  PID:3328
- C:\Windows\System\oUpfJUE.exe
  C:\Windows\System\oUpfJUE.exe
  2⤵
  PID:2356
- C:\Windows\System\FySnyUa.exe
  C:\Windows\System\FySnyUa.exe
  2⤵
  PID:3484
- C:\Windows\System\diXjGgq.exe
  C:\Windows\System\diXjGgq.exe
  2⤵
  PID:3872
- C:\Windows\System\GRrcqSk.exe
  C:\Windows\System\GRrcqSk.exe
  2⤵
  PID:3152
- C:\Windows\System\VcRaNFt.exe
  C:\Windows\System\VcRaNFt.exe
  2⤵
  PID:3988
- C:\Windows\System\UQFxmHh.exe
  C:\Windows\System\UQFxmHh.exe
  2⤵
  PID:3272
- C:\Windows\System\BolRPgA.exe
  C:\Windows\System\BolRPgA.exe
  2⤵
  PID:3344
- C:\Windows\System\zzpdHxU.exe
  C:\Windows\System\zzpdHxU.exe
  2⤵
  PID:3388
- C:\Windows\System\fMGOWOd.exe
  C:\Windows\System\fMGOWOd.exe
  2⤵
  PID:3548
- C:\Windows\System\KSEbjag.exe
  C:\Windows\System\KSEbjag.exe
  2⤵
  PID:3684
- C:\Windows\System\IOskkVb.exe
  C:\Windows\System\IOskkVb.exe
  2⤵
  PID:3952
- C:\Windows\System\SJgTCGz.exe
  C:\Windows\System\SJgTCGz.exe
  2⤵
  PID:4000
- C:\Windows\System\XRspsOT.exe
  C:\Windows\System\XRspsOT.exe
  2⤵
  PID:3664
- C:\Windows\System\EmahQDc.exe
  C:\Windows\System\EmahQDc.exe
  2⤵
  PID:3500
- C:\Windows\System\RVTPiyK.exe
  C:\Windows\System\RVTPiyK.exe
  2⤵
  PID:4040
- C:\Windows\System\GnYeZhu.exe
  C:\Windows\System\GnYeZhu.exe
  2⤵
  PID:3624
- C:\Windows\System\KQoUczl.exe
  C:\Windows\System\KQoUczl.exe
  2⤵
  PID:3732
- C:\Windows\System\BWsSaXx.exe
  C:\Windows\System\BWsSaXx.exe
  2⤵
  PID:3796
- C:\Windows\System\DQDYQKy.exe
  C:\Windows\System\DQDYQKy.exe
  2⤵
  PID:3888
- C:\Windows\System\kMqOhed.exe
  C:\Windows\System\kMqOhed.exe
  2⤵
  PID:3992
- C:\Windows\System\WySDuff.exe
  C:\Windows\System\WySDuff.exe
  2⤵
  PID:3528
- C:\Windows\System\dGjeUsO.exe
  C:\Windows\System\dGjeUsO.exe
  2⤵
  PID:852
- C:\Windows\System\AHtzMbN.exe
  C:\Windows\System\AHtzMbN.exe
  2⤵
  PID:3936
- C:\Windows\System\DzxluBY.exe
  C:\Windows\System\DzxluBY.exe
  2⤵
  PID:4008
- C:\Windows\System\KerAMbQ.exe
  C:\Windows\System\KerAMbQ.exe
  2⤵
  PID:3968
- C:\Windows\System\DjaGCPL.exe
  C:\Windows\System\DjaGCPL.exe
  2⤵
  PID:3092
- C:\Windows\System\kMNfWvJ.exe
  C:\Windows\System\kMNfWvJ.exe
  2⤵
  PID:2560
- C:\Windows\System\XxSgVHf.exe
  C:\Windows\System\XxSgVHf.exe
  2⤵
  PID:3168
- C:\Windows\System\pgoDXtP.exe
  C:\Windows\System\pgoDXtP.exe
  2⤵
  PID:1976
- C:\Windows\System\ndrPFmw.exe
  C:\Windows\System\ndrPFmw.exe
  2⤵
  PID:2016
- C:\Windows\System\cniJHap.exe
  C:\Windows\System\cniJHap.exe
  2⤵
  PID:4112
- C:\Windows\System\VNjREfe.exe
  C:\Windows\System\VNjREfe.exe
  2⤵
  PID:4128
- C:\Windows\System\GLjraLU.exe
  C:\Windows\System\GLjraLU.exe
  2⤵
  PID:4144
- C:\Windows\System\lMOaawe.exe
  C:\Windows\System\lMOaawe.exe
  2⤵
  PID:4160
- C:\Windows\System\XLaimQw.exe
  C:\Windows\System\XLaimQw.exe
  2⤵
  PID:4176
- C:\Windows\System\KOExMHc.exe
  C:\Windows\System\KOExMHc.exe
  2⤵
  PID:4196
- C:\Windows\System\hniNwNA.exe
  C:\Windows\System\hniNwNA.exe
  2⤵
  PID:4212
- C:\Windows\System\HMgOzTo.exe
  C:\Windows\System\HMgOzTo.exe
  2⤵
  PID:4228
- C:\Windows\System\RhNNzPg.exe
  C:\Windows\System\RhNNzPg.exe
  2⤵
  PID:4244
- C:\Windows\System\LCNQKHE.exe
  C:\Windows\System\LCNQKHE.exe
  2⤵
  PID:4264
- C:\Windows\System\HYxucSL.exe
  C:\Windows\System\HYxucSL.exe
  2⤵
  PID:4280
- C:\Windows\System\SkwSHxW.exe
  C:\Windows\System\SkwSHxW.exe
  2⤵
  PID:4296
- C:\Windows\System\GBAJlhk.exe
  C:\Windows\System\GBAJlhk.exe
  2⤵
  PID:4312
- C:\Windows\System\hVrHtnM.exe
  C:\Windows\System\hVrHtnM.exe
  2⤵
  PID:4332
- C:\Windows\System\xbKOTjE.exe
  C:\Windows\System\xbKOTjE.exe
  2⤵
  PID:4352
- C:\Windows\System\bncKniS.exe
  C:\Windows\System\bncKniS.exe
  2⤵
  PID:4368
- C:\Windows\System\QPaZwjC.exe
  C:\Windows\System\QPaZwjC.exe
  2⤵
  PID:4384
- C:\Windows\System\JNLtvcC.exe
  C:\Windows\System\JNLtvcC.exe
  2⤵
  PID:4400
- C:\Windows\System\YHusOuB.exe
  C:\Windows\System\YHusOuB.exe
  2⤵
  PID:4416
- C:\Windows\System\QOZsDKl.exe
  C:\Windows\System\QOZsDKl.exe
  2⤵
  PID:4436
- C:\Windows\System\hdhRdbm.exe
  C:\Windows\System\hdhRdbm.exe
  2⤵
  PID:4452
- C:\Windows\System\WoXZBat.exe
  C:\Windows\System\WoXZBat.exe
  2⤵
  PID:4468
- C:\Windows\System\TrTHZNN.exe
  C:\Windows\System\TrTHZNN.exe
  2⤵
  PID:4484
- C:\Windows\System\zQhqBcM.exe
  C:\Windows\System\zQhqBcM.exe
  2⤵
  PID:4500
- C:\Windows\System\DvjucOX.exe
  C:\Windows\System\DvjucOX.exe
  2⤵
  PID:4516
- C:\Windows\System\pMRVQZL.exe
  C:\Windows\System\pMRVQZL.exe
  2⤵
  PID:4532
- C:\Windows\System\vFHuoRu.exe
  C:\Windows\System\vFHuoRu.exe
  2⤵
  PID:4548
- C:\Windows\System\GNcXkni.exe
  C:\Windows\System\GNcXkni.exe
  2⤵
  PID:4564
- C:\Windows\System\GOvsXam.exe
  C:\Windows\System\GOvsXam.exe
  2⤵
  PID:4580
- C:\Windows\System\DtRPVsQ.exe
  C:\Windows\System\DtRPVsQ.exe
  2⤵
  PID:4692
- C:\Windows\System\AmgtXma.exe
  C:\Windows\System\AmgtXma.exe
  2⤵
  PID:4712
- C:\Windows\System\Xqevvli.exe
  C:\Windows\System\Xqevvli.exe
  2⤵
  PID:4728
- C:\Windows\System\orbxeBl.exe
  C:\Windows\System\orbxeBl.exe
  2⤵
  PID:4760
- C:\Windows\System\fMczHQL.exe
  C:\Windows\System\fMczHQL.exe
  2⤵
  PID:4784
- C:\Windows\System\lrHYHDI.exe
  C:\Windows\System\lrHYHDI.exe
  2⤵
  PID:4800
- C:\Windows\System\cvlNUDs.exe
  C:\Windows\System\cvlNUDs.exe
  2⤵
  PID:4852
- C:\Windows\System\boJhjZo.exe
  C:\Windows\System\boJhjZo.exe
  2⤵
  PID:4968
- C:\Windows\System\TSdyZNL.exe
  C:\Windows\System\TSdyZNL.exe
  2⤵
  PID:4984
- C:\Windows\System\xMwrjve.exe
  C:\Windows\System\xMwrjve.exe
  2⤵
  PID:5000
- C:\Windows\System\RSrZmch.exe
  C:\Windows\System\RSrZmch.exe
  2⤵
  PID:5016
- C:\Windows\System\JrdumEH.exe
  C:\Windows\System\JrdumEH.exe
  2⤵
  PID:5036
- C:\Windows\System\mdMAilB.exe
  C:\Windows\System\mdMAilB.exe
  2⤵
  PID:5060
- C:\Windows\System\VXfEvwR.exe
  C:\Windows\System\VXfEvwR.exe
  2⤵
  PID:5076
- C:\Windows\System\CgZKLSi.exe
  C:\Windows\System\CgZKLSi.exe
  2⤵
  PID:5092
- C:\Windows\System\LMqBiKB.exe
  C:\Windows\System\LMqBiKB.exe
  2⤵
  PID:5112
- C:\Windows\System\sotsaLU.exe
  C:\Windows\System\sotsaLU.exe
  2⤵
  PID:3260
- C:\Windows\System\BkxGVwp.exe
  C:\Windows\System\BkxGVwp.exe
  2⤵
  PID:3368
- C:\Windows\System\BoKLhlW.exe
  C:\Windows\System\BoKLhlW.exe
  2⤵
  PID:1408
- C:\Windows\System\zRSyxkV.exe
  C:\Windows\System\zRSyxkV.exe
  2⤵
  PID:3384
- C:\Windows\System\Gthieur.exe
  C:\Windows\System\Gthieur.exe
  2⤵
  PID:3680
- C:\Windows\System\VREvOwa.exe
  C:\Windows\System\VREvOwa.exe
  2⤵
  PID:1096
- C:\Windows\System\AFVFTJC.exe
  C:\Windows\System\AFVFTJC.exe
  2⤵
  PID:4464
- C:\Windows\System\LOHspml.exe
  C:\Windows\System\LOHspml.exe
  2⤵
  PID:3432
- C:\Windows\System\BdDGRZW.exe
  C:\Windows\System\BdDGRZW.exe
  2⤵
  PID:3924
- C:\Windows\System\vIDnQUI.exe
  C:\Windows\System\vIDnQUI.exe
  2⤵
  PID:2836
- C:\Windows\System\qclxnpK.exe
  C:\Windows\System\qclxnpK.exe
  2⤵
  PID:3856
- C:\Windows\System\sKdXFIv.exe
  C:\Windows\System\sKdXFIv.exe
  2⤵
  PID:3748
- C:\Windows\System\gAOuVsl.exe
  C:\Windows\System\gAOuVsl.exe
  2⤵
  PID:848
- C:\Windows\System\ELIXacK.exe
  C:\Windows\System\ELIXacK.exe
  2⤵
  PID:2240
- C:\Windows\System\oUZLHzi.exe
  C:\Windows\System\oUZLHzi.exe
  2⤵
  PID:4020
- C:\Windows\System\vVkCHPa.exe
  C:\Windows\System\vVkCHPa.exe
  2⤵
  PID:4192
- C:\Windows\System\zWBSWbd.exe
  C:\Windows\System\zWBSWbd.exe
  2⤵
  PID:4252
- C:\Windows\System\awJPOUH.exe
  C:\Windows\System\awJPOUH.exe
  2⤵
  PID:4604
- C:\Windows\System\VlgtKCK.exe
  C:\Windows\System\VlgtKCK.exe
  2⤵
  PID:1968
- C:\Windows\System\lShaXvm.exe
  C:\Windows\System\lShaXvm.exe
  2⤵
  PID:4108
- C:\Windows\System\xdpOwnO.exe
  C:\Windows\System\xdpOwnO.exe
  2⤵
  PID:4172
- C:\Windows\System\BxQhPsQ.exe
  C:\Windows\System\BxQhPsQ.exe
  2⤵
  PID:4272
- C:\Windows\System\rsNdATt.exe
  C:\Windows\System\rsNdATt.exe
  2⤵
  PID:4340
- C:\Windows\System\LKCLtbd.exe
  C:\Windows\System\LKCLtbd.exe
  2⤵
  PID:4348
- C:\Windows\System\IvrNkTo.exe
  C:\Windows\System\IvrNkTo.exe
  2⤵
  PID:4448
- C:\Windows\System\eTzSAMP.exe
  C:\Windows\System\eTzSAMP.exe
  2⤵
  PID:3312
- C:\Windows\System\aPJeXHt.exe
  C:\Windows\System\aPJeXHt.exe
  2⤵
  PID:3128
- C:\Windows\System\XqyKlfC.exe
  C:\Windows\System\XqyKlfC.exe
  2⤵
  PID:4208
- C:\Windows\System\TEeuYAn.exe
  C:\Windows\System\TEeuYAn.exe
  2⤵
  PID:4620
- C:\Windows\System\mfISRQQ.exe
  C:\Windows\System\mfISRQQ.exe
  2⤵
  PID:4636
- C:\Windows\System\fnzHarj.exe
  C:\Windows\System\fnzHarj.exe
  2⤵
  PID:4652
- C:\Windows\System\cDODLKX.exe
  C:\Windows\System\cDODLKX.exe
  2⤵
  PID:4656
- C:\Windows\System\uKfYpvt.exe
  C:\Windows\System\uKfYpvt.exe
  2⤵
  PID:4680
- C:\Windows\System\KljYEJn.exe
  C:\Windows\System\KljYEJn.exe
  2⤵
  PID:4540
- C:\Windows\System\QVJHqtl.exe
  C:\Windows\System\QVJHqtl.exe
  2⤵
  PID:4528
- C:\Windows\System\qLvOMxG.exe
  C:\Windows\System\qLvOMxG.exe
  2⤵
  PID:4544
- C:\Windows\System\oaMZtYY.exe
  C:\Windows\System\oaMZtYY.exe
  2⤵
  PID:4736
- C:\Windows\System\BCJLbVS.exe
  C:\Windows\System\BCJLbVS.exe
  2⤵
  PID:4780
- C:\Windows\System\KgWtAjb.exe
  C:\Windows\System\KgWtAjb.exe
  2⤵
  PID:4792
- C:\Windows\System\OIWckFD.exe
  C:\Windows\System\OIWckFD.exe
  2⤵
  PID:4832
- C:\Windows\System\SkGcaNL.exe
  C:\Windows\System\SkGcaNL.exe
  2⤵
  PID:4816
- C:\Windows\System\KaByMMM.exe
  C:\Windows\System\KaByMMM.exe
  2⤵
  PID:4904
- C:\Windows\System\eYSJPET.exe
  C:\Windows\System\eYSJPET.exe
  2⤵
  PID:4872
- C:\Windows\System\xUZipmI.exe
  C:\Windows\System\xUZipmI.exe
  2⤵
  PID:4896
- C:\Windows\System\DusJRiq.exe
  C:\Windows\System\DusJRiq.exe
  2⤵
  PID:4916
- C:\Windows\System\lJhYnLp.exe
  C:\Windows\System\lJhYnLp.exe
  2⤵
  PID:4932
- C:\Windows\System\FMFXuFD.exe
  C:\Windows\System\FMFXuFD.exe
  2⤵
  PID:4948
- C:\Windows\System\olZIkSs.exe
  C:\Windows\System\olZIkSs.exe
  2⤵
  PID:4960
- C:\Windows\System\VwDBpKh.exe
  C:\Windows\System\VwDBpKh.exe
  2⤵
  PID:4996
- C:\Windows\System\nhxjeFG.exe
  C:\Windows\System\nhxjeFG.exe
  2⤵
  PID:5048
- C:\Windows\System\tBIQRxm.exe
  C:\Windows\System\tBIQRxm.exe
  2⤵
  PID:5032
- C:\Windows\System\tOigAID.exe
  C:\Windows\System\tOigAID.exe
  2⤵
  PID:5088
- C:\Windows\System\XIVxYcz.exe
  C:\Windows\System\XIVxYcz.exe
  2⤵
  PID:5072
- C:\Windows\System\qPiaiHk.exe
  C:\Windows\System\qPiaiHk.exe
  2⤵
  PID:3480
- C:\Windows\System\pigOySU.exe
  C:\Windows\System\pigOySU.exe
  2⤵
  PID:4072
- C:\Windows\System\EgNhUFw.exe
  C:\Windows\System\EgNhUFw.exe
  2⤵
  PID:3812
- C:\Windows\System\IEhIRxZ.exe
  C:\Windows\System\IEhIRxZ.exe
  2⤵
  PID:768
- C:\Windows\System\PQSKpwM.exe
  C:\Windows\System\PQSKpwM.exe
  2⤵
  PID:4152
- C:\Windows\System\KLyhlOh.exe
  C:\Windows\System\KLyhlOh.exe
  2⤵
  PID:4184
- C:\Windows\System\RyxLwal.exe
  C:\Windows\System\RyxLwal.exe
  2⤵
  PID:3700
- C:\Windows\System\HAXxOgG.exe
  C:\Windows\System\HAXxOgG.exe
  2⤵
  PID:4432
- C:\Windows\System\QoqqJDw.exe
  C:\Windows\System\QoqqJDw.exe
  2⤵
  PID:2244
- C:\Windows\System\scJrPSW.exe
  C:\Windows\System\scJrPSW.exe
  2⤵
  PID:4292
- C:\Windows\System\zUngsep.exe
  C:\Windows\System\zUngsep.exe
  2⤵
  PID:4328
- C:\Windows\System\ibYCZeE.exe
  C:\Windows\System\ibYCZeE.exe
  2⤵
  PID:4612
- C:\Windows\System\FZapjyl.exe
  C:\Windows\System\FZapjyl.exe
  2⤵
  PID:4596
- C:\Windows\System\GjPyMhz.exe
  C:\Windows\System\GjPyMhz.exe
  2⤵
  PID:4304
- C:\Windows\System\VBbGSvb.exe
  C:\Windows\System\VBbGSvb.exe
  2⤵
  PID:4396
- C:\Windows\System\oJJoMXd.exe
  C:\Windows\System\oJJoMXd.exe
  2⤵
  PID:628
- C:\Windows\System\QSlZeGb.exe
  C:\Windows\System\QSlZeGb.exe
  2⤵
  PID:4476
- C:\Windows\System\amkflCd.exe
  C:\Windows\System\amkflCd.exe
  2⤵
  PID:4676
- C:\Windows\System\CJareLV.exe
  C:\Windows\System\CJareLV.exe
  2⤵
  PID:4724
- C:\Windows\System\dlKmnVi.exe
  C:\Windows\System\dlKmnVi.exe
  2⤵
  PID:4236
- C:\Windows\System\XIbFKhK.exe
  C:\Windows\System\XIbFKhK.exe
  2⤵
  PID:4880
- C:\Windows\System\bVoZjoM.exe
  C:\Windows\System\bVoZjoM.exe
  2⤵
  PID:4940
- C:\Windows\System\sZqjtHA.exe
  C:\Windows\System\sZqjtHA.exe
  2⤵
  PID:4376
- C:\Windows\System\SCjKZTf.exe
  C:\Windows\System\SCjKZTf.exe
  2⤵
  PID:4664
- C:\Windows\System\isKouuz.exe
  C:\Windows\System\isKouuz.exe
  2⤵
  PID:4884
- C:\Windows\System\wDTzLjq.exe
  C:\Windows\System\wDTzLjq.exe
  2⤵
  PID:4572
- C:\Windows\System\kTWjIjp.exe
  C:\Windows\System\kTWjIjp.exe
  2⤵
  PID:4632
- C:\Windows\System\PPelwfu.exe
  C:\Windows\System\PPelwfu.exe
  2⤵
  PID:4924
- C:\Windows\System\FaIjArs.exe
  C:\Windows\System\FaIjArs.exe
  2⤵
  PID:4796
- C:\Windows\System\zEKEBau.exe
  C:\Windows\System\zEKEBau.exe
  2⤵
  PID:5028
- C:\Windows\System\elpYZuR.exe
  C:\Windows\System\elpYZuR.exe
  2⤵
  PID:3212
- C:\Windows\System\wApqVmL.exe
  C:\Windows\System\wApqVmL.exe
  2⤵
  PID:4032
- C:\Windows\System\JOpDJMg.exe
  C:\Windows\System\JOpDJMg.exe
  2⤵
  PID:1816
- C:\Windows\System\TSQnqql.exe
  C:\Windows\System\TSQnqql.exe
  2⤵
  PID:4256
- C:\Windows\System\BYPWVYw.exe
  C:\Windows\System\BYPWVYw.exe
  2⤵
  PID:4104
- C:\Windows\System\dwnUUOM.exe
  C:\Windows\System\dwnUUOM.exe
  2⤵
  PID:4444
- C:\Windows\System\OLWeIMU.exe
  C:\Windows\System\OLWeIMU.exe
  2⤵
  PID:4628
- C:\Windows\System\ZjKfOsQ.exe
  C:\Windows\System\ZjKfOsQ.exe
  2⤵
  PID:5024
- C:\Windows\System\ZIfHFtz.exe
  C:\Windows\System\ZIfHFtz.exe
  2⤵
  PID:3028
- C:\Windows\System\RQviFcs.exe
  C:\Windows\System\RQviFcs.exe
  2⤵
  PID:4576
- C:\Windows\System\SDpQsNl.exe
  C:\Windows\System\SDpQsNl.exe
  2⤵
  PID:3744
- C:\Windows\System\sBOstKj.exe
  C:\Windows\System\sBOstKj.exe
  2⤵
  PID:5012
- C:\Windows\System\eDYSacV.exe
  C:\Windows\System\eDYSacV.exe
  2⤵
  PID:2420
- C:\Windows\System\WJXNeuP.exe
  C:\Windows\System\WJXNeuP.exe
  2⤵
  PID:4204
- C:\Windows\System\lnWkals.exe
  C:\Windows\System\lnWkals.exe
  2⤵
  PID:4672
- C:\Windows\System\cXwdSue.exe
  C:\Windows\System\cXwdSue.exe
  2⤵
  PID:2220
- C:\Windows\System\FwDljtm.exe
  C:\Windows\System\FwDljtm.exe
  2⤵
  PID:4704
- C:\Windows\System\OpkGKXi.exe
  C:\Windows\System\OpkGKXi.exe
  2⤵
  PID:2568
- C:\Windows\System\XgNUBpW.exe
  C:\Windows\System\XgNUBpW.exe
  2⤵
  PID:4720
- C:\Windows\System\uMqKTTK.exe
  C:\Windows\System\uMqKTTK.exe
  2⤵
  PID:1952
- C:\Windows\System\mEBOJKt.exe
  C:\Windows\System\mEBOJKt.exe
  2⤵
  PID:4980
- C:\Windows\System\OzrLcbF.exe
  C:\Windows\System\OzrLcbF.exe
  2⤵
  PID:3064
- C:\Windows\System\xzkJHKF.exe
  C:\Windows\System\xzkJHKF.exe
  2⤵
  PID:676
- C:\Windows\System\fQFmcfd.exe
  C:\Windows\System\fQFmcfd.exe
  2⤵
  PID:4140
- C:\Windows\System\ytGFbjT.exe
  C:\Windows\System\ytGFbjT.exe
  2⤵
  PID:4428
- C:\Windows\System\PqkaEWP.exe
  C:\Windows\System\PqkaEWP.exe
  2⤵
  PID:4908
- C:\Windows\System\JksGtTi.exe
  C:\Windows\System\JksGtTi.exe
  2⤵
  PID:2068
- C:\Windows\System\UCumOVn.exe
  C:\Windows\System\UCumOVn.exe
  2⤵
  PID:1828
- C:\Windows\System\LjTxXCy.exe
  C:\Windows\System\LjTxXCy.exe
  2⤵
  PID:5172
- C:\Windows\System\ShMTFTI.exe
  C:\Windows\System\ShMTFTI.exe
  2⤵
  PID:5188
- C:\Windows\System\fUfZRzc.exe
  C:\Windows\System\fUfZRzc.exe
  2⤵
  PID:5208
- C:\Windows\System\mZbtHLQ.exe
  C:\Windows\System\mZbtHLQ.exe
  2⤵
  PID:5224
- C:\Windows\System\kxhKkvl.exe
  C:\Windows\System\kxhKkvl.exe
  2⤵
  PID:5240
- C:\Windows\System\UdmsAFL.exe
  C:\Windows\System\UdmsAFL.exe
  2⤵
  PID:5260
- C:\Windows\System\kDTpQEg.exe
  C:\Windows\System\kDTpQEg.exe
  2⤵
  PID:5280
- C:\Windows\System\bplLMRJ.exe
  C:\Windows\System\bplLMRJ.exe
  2⤵
  PID:5300
- C:\Windows\System\KleHXDi.exe
  C:\Windows\System\KleHXDi.exe
  2⤵
  PID:5316
- C:\Windows\System\HvEUPMb.exe
  C:\Windows\System\HvEUPMb.exe
  2⤵
  PID:5332
- C:\Windows\System\ohSqpeJ.exe
  C:\Windows\System\ohSqpeJ.exe
  2⤵
  PID:5352
- C:\Windows\System\FIXYXmK.exe
  C:\Windows\System\FIXYXmK.exe
  2⤵
  PID:5368
- C:\Windows\System\GspBFXN.exe
  C:\Windows\System\GspBFXN.exe
  2⤵
  PID:5384
- C:\Windows\System\PSOEqgq.exe
  C:\Windows\System\PSOEqgq.exe
  2⤵
  PID:5400
- C:\Windows\System\ohFmoin.exe
  C:\Windows\System\ohFmoin.exe
  2⤵
  PID:5416
- C:\Windows\System\bmzmiOd.exe
  C:\Windows\System\bmzmiOd.exe
  2⤵
  PID:5432
- C:\Windows\System\gqsgpCD.exe
  C:\Windows\System\gqsgpCD.exe
  2⤵
  PID:5448
- C:\Windows\System\kwSvpfm.exe
  C:\Windows\System\kwSvpfm.exe
  2⤵
  PID:5464
- C:\Windows\System\oMxxmGH.exe
  C:\Windows\System\oMxxmGH.exe
  2⤵
  PID:5484
- C:\Windows\System\XVtWVhk.exe
  C:\Windows\System\XVtWVhk.exe
  2⤵
  PID:5500
- C:\Windows\System\AjgYSjM.exe
  C:\Windows\System\AjgYSjM.exe
  2⤵
  PID:5516
- C:\Windows\System\fDndwXv.exe
  C:\Windows\System\fDndwXv.exe
  2⤵
  PID:5532
- C:\Windows\System\tBrcOzB.exe
  C:\Windows\System\tBrcOzB.exe
  2⤵
  PID:5548
- C:\Windows\System\qyvoLqW.exe
  C:\Windows\System\qyvoLqW.exe
  2⤵
  PID:5564
- C:\Windows\System\yxjwDKB.exe
  C:\Windows\System\yxjwDKB.exe
  2⤵
  PID:5580
- C:\Windows\System\QCayUxl.exe
  C:\Windows\System\QCayUxl.exe
  2⤵
  PID:5596
- C:\Windows\System\xKFlaBe.exe
  C:\Windows\System\xKFlaBe.exe
  2⤵
  PID:5612
- C:\Windows\System\MPjAXPg.exe
  C:\Windows\System\MPjAXPg.exe
  2⤵
  PID:5628
- C:\Windows\System\zSelMeS.exe
  C:\Windows\System\zSelMeS.exe
  2⤵
  PID:5644
- C:\Windows\System\IEtAICL.exe
  C:\Windows\System\IEtAICL.exe
  2⤵
  PID:5660
- C:\Windows\System\Zcctcbb.exe
  C:\Windows\System\Zcctcbb.exe
  2⤵
  PID:5676
- C:\Windows\System\gPDvhdY.exe
  C:\Windows\System\gPDvhdY.exe
  2⤵
  PID:5692
- C:\Windows\System\MocASqi.exe
  C:\Windows\System\MocASqi.exe
  2⤵
  PID:5712
- C:\Windows\System\WhnMjJW.exe
  C:\Windows\System\WhnMjJW.exe
  2⤵
  PID:5728
- C:\Windows\System\yGuXSZq.exe
  C:\Windows\System\yGuXSZq.exe
  2⤵
  PID:5744
- C:\Windows\System\snTzKrM.exe
  C:\Windows\System\snTzKrM.exe
  2⤵
  PID:5760
- C:\Windows\System\AARIKpW.exe
  C:\Windows\System\AARIKpW.exe
  2⤵
  PID:5776
- C:\Windows\System\YGkBOgu.exe
  C:\Windows\System\YGkBOgu.exe
  2⤵
  PID:5796
- C:\Windows\System\tpxDdgi.exe
  C:\Windows\System\tpxDdgi.exe
  2⤵
  PID:5812
- C:\Windows\System\NNCoiCP.exe
  C:\Windows\System\NNCoiCP.exe
  2⤵
  PID:5828
- C:\Windows\System\DhNXkPP.exe
  C:\Windows\System\DhNXkPP.exe
  2⤵
  PID:5844
- C:\Windows\System\WzeSsBl.exe
  C:\Windows\System\WzeSsBl.exe
  2⤵
  PID:5880
- C:\Windows\System\JKlYkjr.exe
  C:\Windows\System\JKlYkjr.exe
  2⤵
  PID:5896
- C:\Windows\System\vnGJQCZ.exe
  C:\Windows\System\vnGJQCZ.exe
  2⤵
  PID:5912
- C:\Windows\System\FFiqzSF.exe
  C:\Windows\System\FFiqzSF.exe
  2⤵
  PID:5928
- C:\Windows\System\gmQXPKg.exe
  C:\Windows\System\gmQXPKg.exe
  2⤵
  PID:5944
- C:\Windows\System\LZVjDGg.exe
  C:\Windows\System\LZVjDGg.exe
  2⤵
  PID:5960
- C:\Windows\System\mleLrKf.exe
  C:\Windows\System\mleLrKf.exe
  2⤵
  PID:5988
- C:\Windows\System\SYmZKHE.exe
  C:\Windows\System\SYmZKHE.exe
  2⤵
  PID:6004
- C:\Windows\System\AjXFQrJ.exe
  C:\Windows\System\AjXFQrJ.exe
  2⤵
  PID:6072
- C:\Windows\System\KNVNQva.exe
  C:\Windows\System\KNVNQva.exe
  2⤵
  PID:6088
- C:\Windows\System\XaTbykc.exe
  C:\Windows\System\XaTbykc.exe
  2⤵
  PID:6104
- C:\Windows\System\IdCPtdu.exe
  C:\Windows\System\IdCPtdu.exe
  2⤵
  PID:6120
- C:\Windows\System\ggtenGp.exe
  C:\Windows\System\ggtenGp.exe
  2⤵
  PID:6136
- C:\Windows\System\xureHer.exe
  C:\Windows\System\xureHer.exe
  2⤵
  PID:4560
- C:\Windows\System\rmtLiFe.exe
  C:\Windows\System\rmtLiFe.exe
  2⤵
  PID:1960
- C:\Windows\System\bQKCyMl.exe
  C:\Windows\System\bQKCyMl.exe
  2⤵
  PID:4004
- C:\Windows\System\NpUggdf.exe
  C:\Windows\System\NpUggdf.exe
  2⤵
  PID:4600
- C:\Windows\System\RWDFxVb.exe
  C:\Windows\System\RWDFxVb.exe
  2⤵
  PID:5136
- C:\Windows\System\NcFLxKg.exe
  C:\Windows\System\NcFLxKg.exe
  2⤵
  PID:5132
- C:\Windows\System\MKPbIUZ.exe
  C:\Windows\System\MKPbIUZ.exe
  2⤵
  PID:5168
- C:\Windows\System\tuLyHTp.exe
  C:\Windows\System\tuLyHTp.exe
  2⤵
  PID:5204
- C:\Windows\System\QZbgkYi.exe
  C:\Windows\System\QZbgkYi.exe
  2⤵
  PID:5268
- C:\Windows\System\DZbPvww.exe
  C:\Windows\System\DZbPvww.exe
  2⤵
  PID:5344
- C:\Windows\System\pdbonvu.exe
  C:\Windows\System\pdbonvu.exe
  2⤵
  PID:5376
- C:\Windows\System\OvmeXlf.exe
  C:\Windows\System\OvmeXlf.exe
  2⤵
  PID:5440
- C:\Windows\System\KbjHPym.exe
  C:\Windows\System\KbjHPym.exe
  2⤵
  PID:5480
- C:\Windows\System\HjhmxtE.exe
  C:\Windows\System\HjhmxtE.exe
  2⤵
  PID:5460
- C:\Windows\System\YwZutWU.exe
  C:\Windows\System\YwZutWU.exe
  2⤵
  PID:5492
- C:\Windows\System\VcTLDVV.exe
  C:\Windows\System\VcTLDVV.exe
  2⤵
  PID:5640
- C:\Windows\System\ppQebKe.exe
  C:\Windows\System\ppQebKe.exe
  2⤵
  PID:5656
- C:\Windows\System\kgYEhdD.exe
  C:\Windows\System\kgYEhdD.exe
  2⤵
  PID:5704
- C:\Windows\System\cVMfgrq.exe
  C:\Windows\System\cVMfgrq.exe
  2⤵
  PID:5720
- C:\Windows\System\pfEZhwf.exe
  C:\Windows\System\pfEZhwf.exe
  2⤵
  PID:5772
- C:\Windows\System\xZrEwwz.exe
  C:\Windows\System\xZrEwwz.exe
  2⤵
  PID:5836
- C:\Windows\System\daWPVcr.exe
  C:\Windows\System\daWPVcr.exe
  2⤵
  PID:5824
- C:\Windows\System\bmGslSp.exe
  C:\Windows\System\bmGslSp.exe
  2⤵
  PID:5888
- C:\Windows\System\mLfMQOD.exe
  C:\Windows\System\mLfMQOD.exe
  2⤵
  PID:5924
- C:\Windows\System\aQvhBFh.exe
  C:\Windows\System\aQvhBFh.exe
  2⤵
  PID:6000
- C:\Windows\System\IxqrBye.exe
  C:\Windows\System\IxqrBye.exe
  2⤵
  PID:5864
- C:\Windows\System\zQwDYDq.exe
  C:\Windows\System\zQwDYDq.exe
  2⤵
  PID:5936
- C:\Windows\System\ppyQrQg.exe
  C:\Windows\System\ppyQrQg.exe
  2⤵
  PID:5980
- C:\Windows\System\ZekVCUj.exe
  C:\Windows\System\ZekVCUj.exe
  2⤵
  PID:6020
- C:\Windows\System\qwEPqXY.exe
  C:\Windows\System\qwEPqXY.exe
  2⤵
  PID:6036
- C:\Windows\System\CCCvwac.exe
  C:\Windows\System\CCCvwac.exe
  2⤵
  PID:6052
- C:\Windows\System\nPvNEtB.exe
  C:\Windows\System\nPvNEtB.exe
  2⤵
  PID:6068
- C:\Windows\System\DadLswZ.exe
  C:\Windows\System\DadLswZ.exe
  2⤵
  PID:6128
- C:\Windows\System\FcoIQWJ.exe
  C:\Windows\System\FcoIQWJ.exe
  2⤵
  PID:5128
- C:\Windows\System\yosZVBT.exe
  C:\Windows\System\yosZVBT.exe
  2⤵
  PID:5164
- C:\Windows\System\wVotiRm.exe
  C:\Windows\System\wVotiRm.exe
  2⤵
  PID:5184
- C:\Windows\System\ujmeAjL.exe
  C:\Windows\System\ujmeAjL.exe
  2⤵
  PID:2580
- C:\Windows\System\clqlEwD.exe
  C:\Windows\System\clqlEwD.exe
  2⤵
  PID:5160
- C:\Windows\System\xUBGkIa.exe
  C:\Windows\System\xUBGkIa.exe
  2⤵
  PID:5876
- C:\Windows\System\qUCyogW.exe
  C:\Windows\System\qUCyogW.exe
  2⤵
  PID:5940
- C:\Windows\System\tzYuBSx.exe
  C:\Windows\System\tzYuBSx.exe
  2⤵
  PID:5196
- C:\Windows\System\OkvlOoZ.exe
  C:\Windows\System\OkvlOoZ.exe
  2⤵
  PID:5412
- C:\Windows\System\AkzpBOt.exe
  C:\Windows\System\AkzpBOt.exe
  2⤵
  PID:5216
- C:\Windows\System\FiVtKbJ.exe
  C:\Windows\System\FiVtKbJ.exe
  2⤵
  PID:5288
- C:\Windows\System\EdKbBRy.exe
  C:\Windows\System\EdKbBRy.exe
  2⤵
  PID:5328
- C:\Windows\System\ZZZGplN.exe
  C:\Windows\System\ZZZGplN.exe
  2⤵
  PID:5396
- C:\Windows\System\rVUFnUR.exe
  C:\Windows\System\rVUFnUR.exe
  2⤵
  PID:5556
- C:\Windows\System\zeXlpyU.exe
  C:\Windows\System\zeXlpyU.exe
  2⤵
  PID:5672
- C:\Windows\System\diiCrSs.exe
  C:\Windows\System\diiCrSs.exe
  2⤵
  PID:5688
- C:\Windows\System\bNeUVQI.exe
  C:\Windows\System\bNeUVQI.exe
  2⤵
  PID:4188
- C:\Windows\System\pNLdWzU.exe
  C:\Windows\System\pNLdWzU.exe
  2⤵
  PID:5996
- C:\Windows\System\VEQWcDs.exe
  C:\Windows\System\VEQWcDs.exe
  2⤵
  PID:5636
- C:\Windows\System\ZcxKlMV.exe
  C:\Windows\System\ZcxKlMV.exe
  2⤵
  PID:6044
- C:\Windows\System\VazARed.exe
  C:\Windows\System\VazARed.exe
  2⤵
  PID:6096
- C:\Windows\System\LoZskOr.exe
  C:\Windows\System\LoZskOr.exe
  2⤵
  PID:5788
- C:\Windows\System\PDhNSJH.exe
  C:\Windows\System\PDhNSJH.exe
  2⤵
  PID:3964
- C:\Windows\System\iNtYuTR.exe
  C:\Windows\System\iNtYuTR.exe
  2⤵
  PID:5544
- C:\Windows\System\HDdNqCZ.exe
  C:\Windows\System\HDdNqCZ.exe
  2⤵
  PID:6084
- C:\Windows\System\TQWcbHK.exe
  C:\Windows\System\TQWcbHK.exe
  2⤵
  PID:5604
- C:\Windows\System\XaunGEP.exe
  C:\Windows\System\XaunGEP.exe
  2⤵
  PID:5736
- C:\Windows\System\kycghuH.exe
  C:\Windows\System\kycghuH.exe
  2⤵
  PID:6016
- C:\Windows\System\dBanxjO.exe
  C:\Windows\System\dBanxjO.exe
  2⤵
  PID:6112
- C:\Windows\System\BffXfEf.exe
  C:\Windows\System\BffXfEf.exe
  2⤵
  PID:6028
- C:\Windows\System\hWzarvL.exe
  C:\Windows\System\hWzarvL.exe
  2⤵
  PID:3404
- C:\Windows\System\atpDMbM.exe
  C:\Windows\System\atpDMbM.exe
  2⤵
  PID:5152
- C:\Windows\System\HVAWRWH.exe
  C:\Windows\System\HVAWRWH.exe
  2⤵
  PID:5156
- C:\Windows\System\YDEixgV.exe
  C:\Windows\System\YDEixgV.exe
  2⤵
  PID:5804
- C:\Windows\System\iKgOhvq.exe
  C:\Windows\System\iKgOhvq.exe
  2⤵
  PID:5364
- C:\Windows\System\dMvyVSn.exe
  C:\Windows\System\dMvyVSn.exe
  2⤵
  PID:5340
- C:\Windows\System\vcHZQWH.exe
  C:\Windows\System\vcHZQWH.exe
  2⤵
  PID:6116
- C:\Windows\System\vEczCkP.exe
  C:\Windows\System\vEczCkP.exe
  2⤵
  PID:5292
- C:\Windows\System\bCAxYCl.exe
  C:\Windows\System\bCAxYCl.exe
  2⤵
  PID:5968
- C:\Windows\System\QoVIbRW.exe
  C:\Windows\System\QoVIbRW.exe
  2⤵
  PID:5472
- C:\Windows\System\EZCPwqN.exe
  C:\Windows\System\EZCPwqN.exe
  2⤵
  PID:5408
- C:\Windows\System\orxtqOx.exe
  C:\Windows\System\orxtqOx.exe
  2⤵
  PID:5256
- C:\Windows\System\cPMECee.exe
  C:\Windows\System\cPMECee.exe
  2⤵
  PID:6160
- C:\Windows\System\odkpvbq.exe
  C:\Windows\System\odkpvbq.exe
  2⤵
  PID:6180
- C:\Windows\System\RJErxYg.exe
  C:\Windows\System\RJErxYg.exe
  2⤵
  PID:6196
- C:\Windows\System\BgXYuQZ.exe
  C:\Windows\System\BgXYuQZ.exe
  2⤵
  PID:6212
- C:\Windows\System\maZTxOC.exe
  C:\Windows\System\maZTxOC.exe
  2⤵
  PID:6228
- C:\Windows\System\tUsbqUV.exe
  C:\Windows\System\tUsbqUV.exe
  2⤵
  PID:6248
- C:\Windows\System\IdHorAm.exe
  C:\Windows\System\IdHorAm.exe
  2⤵
  PID:6264
- C:\Windows\System\dhjnDQi.exe
  C:\Windows\System\dhjnDQi.exe
  2⤵
  PID:6280
- C:\Windows\System\aUkRDkY.exe
  C:\Windows\System\aUkRDkY.exe
  2⤵
  PID:6296
- C:\Windows\System\XaSicrU.exe
  C:\Windows\System\XaSicrU.exe
  2⤵
  PID:6312
- C:\Windows\System\ysahRfi.exe
  C:\Windows\System\ysahRfi.exe
  2⤵
  PID:6336
- C:\Windows\System\yyGpFsW.exe
  C:\Windows\System\yyGpFsW.exe
  2⤵
  PID:6352
- C:\Windows\System\KgKvFCr.exe
  C:\Windows\System\KgKvFCr.exe
  2⤵
  PID:6368
- C:\Windows\System\qNRFqkc.exe
  C:\Windows\System\qNRFqkc.exe
  2⤵
  PID:6384
- C:\Windows\System\rtRWDtd.exe
  C:\Windows\System\rtRWDtd.exe
  2⤵
  PID:6400
- C:\Windows\System\FumjJXH.exe
  C:\Windows\System\FumjJXH.exe
  2⤵
  PID:6416
- C:\Windows\System\DvQsNwj.exe
  C:\Windows\System\DvQsNwj.exe
  2⤵
  PID:6432
- C:\Windows\System\mDpGbJd.exe
  C:\Windows\System\mDpGbJd.exe
  2⤵
  PID:6448
- C:\Windows\System\waFFdMv.exe
  C:\Windows\System\waFFdMv.exe
  2⤵
  PID:6468
- C:\Windows\System\KLzdWiK.exe
  C:\Windows\System\KLzdWiK.exe
  2⤵
  PID:6484
- C:\Windows\System\OrvuTQn.exe
  C:\Windows\System\OrvuTQn.exe
  2⤵
  PID:6500
- C:\Windows\System\DAfRpRz.exe
  C:\Windows\System\DAfRpRz.exe
  2⤵
  PID:6516
- C:\Windows\System\GsYCJxo.exe
  C:\Windows\System\GsYCJxo.exe
  2⤵
  PID:6532
- C:\Windows\System\bLuIZKQ.exe
  C:\Windows\System\bLuIZKQ.exe
  2⤵
  PID:6552
- C:\Windows\System\GyyzcJD.exe
  C:\Windows\System\GyyzcJD.exe
  2⤵
  PID:6568
- C:\Windows\System\MrJPvbv.exe
  C:\Windows\System\MrJPvbv.exe
  2⤵
  PID:6584
- C:\Windows\System\xuLHGgB.exe
  C:\Windows\System\xuLHGgB.exe
  2⤵
  PID:6600
- C:\Windows\System\aHzGsmY.exe
  C:\Windows\System\aHzGsmY.exe
  2⤵
  PID:6616
- C:\Windows\System\cAXQvkc.exe
  C:\Windows\System\cAXQvkc.exe
  2⤵
  PID:6632
- C:\Windows\System\jLYhaBd.exe
  C:\Windows\System\jLYhaBd.exe
  2⤵
  PID:6648
- C:\Windows\System\xPCCASv.exe
  C:\Windows\System\xPCCASv.exe
  2⤵
  PID:6664
- C:\Windows\System\BMgxKQY.exe
  C:\Windows\System\BMgxKQY.exe
  2⤵
  PID:6680
- C:\Windows\System\qpqkdwq.exe
  C:\Windows\System\qpqkdwq.exe
  2⤵
  PID:6696
- C:\Windows\System\fjwsuTc.exe
  C:\Windows\System\fjwsuTc.exe
  2⤵
  PID:6808
- C:\Windows\System\zTJSyRq.exe
  C:\Windows\System\zTJSyRq.exe
  2⤵
  PID:6824
- C:\Windows\System\DgGYQaO.exe
  C:\Windows\System\DgGYQaO.exe
  2⤵
  PID:6844
- C:\Windows\System\TKoxhSd.exe
  C:\Windows\System\TKoxhSd.exe
  2⤵
  PID:6868
- C:\Windows\System\vMKkCnn.exe
  C:\Windows\System\vMKkCnn.exe
  2⤵
  PID:6884
- C:\Windows\System\vyeLpNi.exe
  C:\Windows\System\vyeLpNi.exe
  2⤵
  PID:6900
- C:\Windows\System\GNbkeBd.exe
  C:\Windows\System\GNbkeBd.exe
  2⤵
  PID:6916
- C:\Windows\System\urFZFMM.exe
  C:\Windows\System\urFZFMM.exe
  2⤵
  PID:6932
- C:\Windows\System\kSCwNeB.exe
  C:\Windows\System\kSCwNeB.exe
  2⤵
  PID:6952
- C:\Windows\System\DKFPogU.exe
  C:\Windows\System\DKFPogU.exe
  2⤵
  PID:6968
- C:\Windows\System\DpexquL.exe
  C:\Windows\System\DpexquL.exe
  2⤵
  PID:6984
- C:\Windows\System\ercfQmJ.exe
  C:\Windows\System\ercfQmJ.exe
  2⤵
  PID:7000
- C:\Windows\System\DnJcpwr.exe
  C:\Windows\System\DnJcpwr.exe
  2⤵
  PID:7016
- C:\Windows\System\pjbacpB.exe
  C:\Windows\System\pjbacpB.exe
  2⤵
  PID:7032
- C:\Windows\System\LbaQLZj.exe
  C:\Windows\System\LbaQLZj.exe
  2⤵
  PID:7048
- C:\Windows\System\lbkYYEj.exe
  C:\Windows\System\lbkYYEj.exe
  2⤵
  PID:7064
- C:\Windows\System\VLVbAEX.exe
  C:\Windows\System\VLVbAEX.exe
  2⤵
  PID:7084
- C:\Windows\System\gcnXVNK.exe
  C:\Windows\System\gcnXVNK.exe
  2⤵
  PID:7100
- C:\Windows\System\NioCxLV.exe
  C:\Windows\System\NioCxLV.exe
  2⤵
  PID:7116
- C:\Windows\System\PwHbclZ.exe
  C:\Windows\System\PwHbclZ.exe
  2⤵
  PID:7132
- C:\Windows\System\pKeGibr.exe
  C:\Windows\System\pKeGibr.exe
  2⤵
  PID:7148
- C:\Windows\System\hKtgMzh.exe
  C:\Windows\System\hKtgMzh.exe
  2⤵
  PID:7164
- C:\Windows\System\BajDmKk.exe
  C:\Windows\System\BajDmKk.exe
  2⤵
  PID:6176
- C:\Windows\System\EoHUhga.exe
  C:\Windows\System\EoHUhga.exe
  2⤵
  PID:6240
- C:\Windows\System\xqUoAVj.exe
  C:\Windows\System\xqUoAVj.exe
  2⤵
  PID:6308
- C:\Windows\System\lrefORd.exe
  C:\Windows\System\lrefORd.exe
  2⤵
  PID:6220
- C:\Windows\System\lQzrAcX.exe
  C:\Windows\System\lQzrAcX.exe
  2⤵
  PID:6260
- C:\Windows\System\CiaKIeJ.exe
  C:\Windows\System\CiaKIeJ.exe
  2⤵
  PID:5724
- C:\Windows\System\nFWnKVU.exe
  C:\Windows\System\nFWnKVU.exe
  2⤵
  PID:1340
- C:\Windows\System\PzxVKIP.exe
  C:\Windows\System\PzxVKIP.exe
  2⤵
  PID:5808
- C:\Windows\System\PVgCyfG.exe
  C:\Windows\System\PVgCyfG.exe
  2⤵
  PID:6332
- C:\Windows\System\EcpFCEH.exe
  C:\Windows\System\EcpFCEH.exe
  2⤵
  PID:6328
- C:\Windows\System\rPKkRZu.exe
  C:\Windows\System\rPKkRZu.exe
  2⤵
  PID:6376
- C:\Windows\System\zSQNHRG.exe
  C:\Windows\System\zSQNHRG.exe
  2⤵
  PID:6444
- C:\Windows\System\RqZVYKy.exe
  C:\Windows\System\RqZVYKy.exe
  2⤵
  PID:6392
- C:\Windows\System\MUNDdEH.exe
  C:\Windows\System\MUNDdEH.exe
  2⤵
  PID:6540
- C:\Windows\System\KOktYVs.exe
  C:\Windows\System\KOktYVs.exe
  2⤵
  PID:6428
- C:\Windows\System\BoUqoKC.exe
  C:\Windows\System\BoUqoKC.exe
  2⤵
  PID:6492
- C:\Windows\System\LtnwUTM.exe
  C:\Windows\System\LtnwUTM.exe
  2⤵
  PID:6760
- C:\Windows\System\sjDXtDq.exe
  C:\Windows\System\sjDXtDq.exe
  2⤵
  PID:6784
- C:\Windows\System\xyRJLIp.exe
  C:\Windows\System\xyRJLIp.exe
  2⤵
  PID:6832
- C:\Windows\System\Ohjlvjt.exe
  C:\Windows\System\Ohjlvjt.exe
  2⤵
  PID:6836
- C:\Windows\System\rvBdZtx.exe
  C:\Windows\System\rvBdZtx.exe
  2⤵
  PID:6852
- C:\Windows\System\BkhwMUD.exe
  C:\Windows\System\BkhwMUD.exe
  2⤵
  PID:6948
- C:\Windows\System\lThNHGU.exe
  C:\Windows\System\lThNHGU.exe
  2⤵
  PID:6976
- C:\Windows\System\UwmMRkJ.exe
  C:\Windows\System\UwmMRkJ.exe
  2⤵
  PID:6924
- C:\Windows\System\UzKjXTc.exe
  C:\Windows\System\UzKjXTc.exe
  2⤵
  PID:7072
- C:\Windows\System\ciFqbkT.exe
  C:\Windows\System\ciFqbkT.exe
  2⤵
  PID:6996
- C:\Windows\System\sYarDbD.exe
  C:\Windows\System\sYarDbD.exe
  2⤵
  PID:7140
- C:\Windows\System\fJCoPeJ.exe
  C:\Windows\System\fJCoPeJ.exe
  2⤵
  PID:6168
- C:\Windows\System\BRLKMxs.exe
  C:\Windows\System\BRLKMxs.exe
  2⤵
  PID:7060
- C:\Windows\System\CHZLDtQ.exe
  C:\Windows\System\CHZLDtQ.exe
  2⤵
  PID:6304
- C:\Windows\System\dYnCbFy.exe
  C:\Windows\System\dYnCbFy.exe
  2⤵
  PID:5588
- C:\Windows\System\RazviDd.exe
  C:\Windows\System\RazviDd.exe
  2⤵
  PID:7156
- C:\Windows\System\EWuTAoM.exe
  C:\Windows\System\EWuTAoM.exe
  2⤵
  PID:6292
- C:\Windows\System\yhawTMW.exe
  C:\Windows\System\yhawTMW.exe
  2⤵
  PID:5756
- C:\Windows\System\WfxZocH.exe
  C:\Windows\System\WfxZocH.exe
  2⤵
  PID:6348
- C:\Windows\System\dfMyXhe.exe
  C:\Windows\System\dfMyXhe.exe
  2⤵
  PID:6412
- C:\Windows\System\xAQJwwO.exe
  C:\Windows\System\xAQJwwO.exe
  2⤵
  PID:5392
- C:\Windows\System\zPaPjhF.exe
  C:\Windows\System\zPaPjhF.exe
  2⤵
  PID:6456
- C:\Windows\System\DwOkbLV.exe
  C:\Windows\System\DwOkbLV.exe
  2⤵
  PID:6612
- C:\Windows\System\voACVEG.exe
  C:\Windows\System\voACVEG.exe
  2⤵
  PID:6596
- C:\Windows\System\Rjtrprx.exe
  C:\Windows\System\Rjtrprx.exe
  2⤵
  PID:6672
- C:\Windows\System\upzCEFH.exe
  C:\Windows\System\upzCEFH.exe
  2⤵
  PID:6660
- C:\Windows\System\BkaRNaR.exe
  C:\Windows\System\BkaRNaR.exe
  2⤵
  PID:6716
- C:\Windows\System\FURetja.exe
  C:\Windows\System\FURetja.exe
  2⤵
  PID:6728
- C:\Windows\System\KVrGRcE.exe
  C:\Windows\System\KVrGRcE.exe
  2⤵
  PID:6752
- C:\Windows\System\aiqhYoZ.exe
  C:\Windows\System\aiqhYoZ.exe
  2⤵
  PID:6772
- C:\Windows\System\wsJENUQ.exe
  C:\Windows\System\wsJENUQ.exe
  2⤵
  PID:6236
- C:\Windows\System\idNZoJB.exe
  C:\Windows\System\idNZoJB.exe
  2⤵
  PID:7180
- C:\Windows\System\QVUjcZC.exe
  C:\Windows\System\QVUjcZC.exe
  2⤵
  PID:7200
- C:\Windows\System\yDGiJRY.exe
  C:\Windows\System\yDGiJRY.exe
  2⤵
  PID:7220
- C:\Windows\System\IgAMnSJ.exe
  C:\Windows\System\IgAMnSJ.exe
  2⤵
  PID:7236
- C:\Windows\System\SxtrlMe.exe
  C:\Windows\System\SxtrlMe.exe
  2⤵
  PID:7252
- C:\Windows\System\SPbowic.exe
  C:\Windows\System\SPbowic.exe
  2⤵
  PID:7268
- C:\Windows\System\CTAygNq.exe
  C:\Windows\System\CTAygNq.exe
  2⤵
  PID:7284
- C:\Windows\System\TKXbgMx.exe
  C:\Windows\System\TKXbgMx.exe
  2⤵
  PID:7300
- C:\Windows\System\NAwdLAZ.exe
  C:\Windows\System\NAwdLAZ.exe
  2⤵
  PID:7316
- C:\Windows\System\wzUgpdb.exe
  C:\Windows\System\wzUgpdb.exe
  2⤵
  PID:7332
- C:\Windows\System\ZhpfeAw.exe
  C:\Windows\System\ZhpfeAw.exe
  2⤵
  PID:7348
- C:\Windows\System\LoLuNmS.exe
  C:\Windows\System\LoLuNmS.exe
  2⤵
  PID:7364
- C:\Windows\System\PKBjPwa.exe
  C:\Windows\System\PKBjPwa.exe
  2⤵
  PID:7380
- C:\Windows\System\mfcwnGA.exe
  C:\Windows\System\mfcwnGA.exe
  2⤵
  PID:7396
- C:\Windows\System\QNPhcZu.exe
  C:\Windows\System\QNPhcZu.exe
  2⤵
  PID:7560
- C:\Windows\System\uBeEcvu.exe
  C:\Windows\System\uBeEcvu.exe
  2⤵
  PID:7580
- C:\Windows\System\ddyIfXE.exe
  C:\Windows\System\ddyIfXE.exe
  2⤵
  PID:7600
- C:\Windows\System\ywPsGpe.exe
  C:\Windows\System\ywPsGpe.exe
  2⤵
  PID:7616
- C:\Windows\System\FLFkRRP.exe
  C:\Windows\System\FLFkRRP.exe
  2⤵
  PID:7636
- C:\Windows\System\wQDSsta.exe
  C:\Windows\System\wQDSsta.exe
  2⤵
  PID:7652
- C:\Windows\System\IeZaBZm.exe
  C:\Windows\System\IeZaBZm.exe
  2⤵
  PID:7832
- C:\Windows\System\NuKQqfg.exe
  C:\Windows\System\NuKQqfg.exe
  2⤵
  PID:7848
- C:\Windows\System\YVifVgY.exe
  C:\Windows\System\YVifVgY.exe
  2⤵
  PID:7864
- C:\Windows\System\MQKYxpz.exe
  C:\Windows\System\MQKYxpz.exe
  2⤵
  PID:7880
- C:\Windows\System\wHjinWf.exe
  C:\Windows\System\wHjinWf.exe
  2⤵
  PID:8020
- C:\Windows\System\ZOgwApk.exe
  C:\Windows\System\ZOgwApk.exe
  2⤵
  PID:8040
- C:\Windows\System\nPIQREh.exe
  C:\Windows\System\nPIQREh.exe
  2⤵
  PID:8060
- C:\Windows\System\GUxwCJV.exe
  C:\Windows\System\GUxwCJV.exe
  2⤵
  PID:8076
- C:\Windows\System\FERIjrf.exe
  C:\Windows\System\FERIjrf.exe
  2⤵
  PID:8092
- C:\Windows\System\TOZwRMs.exe
  C:\Windows\System\TOZwRMs.exe
  2⤵
  PID:8108
- C:\Windows\System\WxNkjlG.exe
  C:\Windows\System\WxNkjlG.exe
  2⤵
  PID:8124
- C:\Windows\System\ZpyTDSB.exe
  C:\Windows\System\ZpyTDSB.exe
  2⤵
  PID:8140
- C:\Windows\System\hUpHJNw.exe
  C:\Windows\System\hUpHJNw.exe
  2⤵
  PID:8160
- C:\Windows\System\lQNxLQy.exe
  C:\Windows\System\lQNxLQy.exe
  2⤵
  PID:8176
- C:\Windows\System\hEBXIqC.exe
  C:\Windows\System\hEBXIqC.exe
  2⤵
  PID:6344
- C:\Windows\System\XdScgzM.exe
  C:\Windows\System\XdScgzM.exe
  2⤵
  PID:6592
- C:\Windows\System\jeJRPBy.exe
  C:\Windows\System\jeJRPBy.exe
  2⤵
  PID:6692
- C:\Windows\System\fjUPVns.exe
  C:\Windows\System\fjUPVns.exe
  2⤵
  PID:7096
- C:\Windows\System\ggBVpve.exe
  C:\Windows\System\ggBVpve.exe
  2⤵
  PID:7192
- C:\Windows\System\JDRLcoG.exe
  C:\Windows\System\JDRLcoG.exe
  2⤵
  PID:7260
- C:\Windows\System\kofhgTt.exe
  C:\Windows\System\kofhgTt.exe
  2⤵
  PID:7328
- C:\Windows\System\ndyIAWM.exe
  C:\Windows\System\ndyIAWM.exe
  2⤵
  PID:7392
- C:\Windows\System\YASHpMt.exe
  C:\Windows\System\YASHpMt.exe
  2⤵
  PID:6864
- C:\Windows\System\eslJRGM.exe
  C:\Windows\System\eslJRGM.exe
  2⤵
  PID:7572
- C:\Windows\System\ebpanuG.exe
  C:\Windows\System\ebpanuG.exe
  2⤵
  PID:6188
- C:\Windows\System\JNjJyHw.exe
  C:\Windows\System\JNjJyHw.exe
  2⤵
  PID:6524
- C:\Windows\System\emoJaoV.exe
  C:\Windows\System\emoJaoV.exe
  2⤵
  PID:6704
- C:\Windows\System\RNSdZdn.exe
  C:\Windows\System\RNSdZdn.exe
  2⤵
  PID:6780
- C:\Windows\System\WyibTWO.exe
  C:\Windows\System\WyibTWO.exe
  2⤵
  PID:6792
- C:\Windows\System\FIiOYsY.exe
  C:\Windows\System\FIiOYsY.exe
  2⤵
  PID:7212
- C:\Windows\System\QRmfRjZ.exe
  C:\Windows\System\QRmfRjZ.exe
  2⤵
  PID:7276
- C:\Windows\System\USOEQbl.exe
  C:\Windows\System\USOEQbl.exe
  2⤵
  PID:7372
- C:\Windows\System\KkaZZET.exe
  C:\Windows\System\KkaZZET.exe
  2⤵
  PID:7408
- C:\Windows\System\SmIeUFK.exe
  C:\Windows\System\SmIeUFK.exe
  2⤵
  PID:7520
- C:\Windows\System\JOyiWPB.exe
  C:\Windows\System\JOyiWPB.exe
  2⤵
  PID:7592
- C:\Windows\System\VkIYsZf.exe
  C:\Windows\System\VkIYsZf.exe
  2⤵
  PID:7688
- C:\Windows\System\DbRQDmO.exe
  C:\Windows\System\DbRQDmO.exe
  2⤵
  PID:7044
- C:\Windows\System\CGQNvoy.exe
  C:\Windows\System\CGQNvoy.exe
  2⤵
  PID:7012
- C:\Windows\System\jaeqXeK.exe
  C:\Windows\System\jaeqXeK.exe
  2⤵
  PID:7456
- C:\Windows\System\cqSLvvi.exe
  C:\Windows\System\cqSLvvi.exe
  2⤵
  PID:7480
- C:\Windows\System\utfPyKJ.exe
  C:\Windows\System\utfPyKJ.exe
  2⤵
  PID:7500
- C:\Windows\System\XgDLmGv.exe
  C:\Windows\System\XgDLmGv.exe
  2⤵
  PID:7716
- C:\Windows\System\CdpOBnI.exe
  C:\Windows\System\CdpOBnI.exe
  2⤵
  PID:7544
- C:\Windows\System\ryPDgtd.exe
  C:\Windows\System\ryPDgtd.exe
  2⤵
  PID:7596
- C:\Windows\System\iCfhvFx.exe
  C:\Windows\System\iCfhvFx.exe
  2⤵
  PID:7672
- C:\Windows\System\yoGLAfx.exe
  C:\Windows\System\yoGLAfx.exe
  2⤵
  PID:7724
- C:\Windows\System\sQBWOyS.exe
  C:\Windows\System\sQBWOyS.exe
  2⤵
  PID:7808
- C:\Windows\System\sNLDHvN.exe
  C:\Windows\System\sNLDHvN.exe
  2⤵
  PID:7856
- C:\Windows\System\FbajcNn.exe
  C:\Windows\System\FbajcNn.exe
  2⤵
  PID:7896
- C:\Windows\System\yrTiOlx.exe
  C:\Windows\System\yrTiOlx.exe
  2⤵
  PID:7916
- C:\Windows\System\lHZZGla.exe
  C:\Windows\System\lHZZGla.exe
  2⤵
  PID:7932
- C:\Windows\System\sagNfEB.exe
  C:\Windows\System\sagNfEB.exe
  2⤵
  PID:7980
- C:\Windows\System\obkzimS.exe
  C:\Windows\System\obkzimS.exe
  2⤵
  PID:8004
- C:\Windows\System\RZTShCa.exe
  C:\Windows\System\RZTShCa.exe
  2⤵
  PID:8036
- C:\Windows\System\LRhRowC.exe
  C:\Windows\System\LRhRowC.exe
  2⤵
  PID:8100
- C:\Windows\System\FYWKkHY.exe
  C:\Windows\System\FYWKkHY.exe
  2⤵
  PID:8168
- C:\Windows\System\tUwdUEV.exe
  C:\Windows\System\tUwdUEV.exe
  2⤵
  PID:8052
- C:\Windows\System\mGncxQh.exe
  C:\Windows\System\mGncxQh.exe
  2⤵
  PID:8116
- C:\Windows\System\KecDpCx.exe
  C:\Windows\System\KecDpCx.exe
  2⤵
  PID:7228
- C:\Windows\System\lZtpqGT.exe
  C:\Windows\System\lZtpqGT.exe
  2⤵
  PID:7188
- C:\Windows\System\TFWbDPA.exe
  C:\Windows\System\TFWbDPA.exe
  2⤵
  PID:7296
- C:\Windows\System\PWYebmz.exe
  C:\Windows\System\PWYebmz.exe
  2⤵
  PID:6480
- C:\Windows\System\lwqGSmh.exe
  C:\Windows\System\lwqGSmh.exe
  2⤵
  PID:6244
- C:\Windows\System\phSNTzc.exe
  C:\Windows\System\phSNTzc.exe
  2⤵
  PID:7176
- C:\Windows\System\PRSGreu.exe
  C:\Windows\System\PRSGreu.exe
  2⤵
  PID:6424
- C:\Windows\System\LBHVkWO.exe
  C:\Windows\System\LBHVkWO.exe
  2⤵
  PID:7244
- C:\Windows\System\HQWQRLS.exe
  C:\Windows\System\HQWQRLS.exe
  2⤵
  PID:7404
- C:\Windows\System\DwVIMhk.exe
  C:\Windows\System\DwVIMhk.exe
  2⤵
  PID:7696
- C:\Windows\System\fUAWFTQ.exe
  C:\Windows\System\fUAWFTQ.exe
  2⤵
  PID:7680
- C:\Windows\System\MPpGBFo.exe
  C:\Windows\System\MPpGBFo.exe
  2⤵
  PID:7700
- C:\Windows\System\QLzmMZF.exe
  C:\Windows\System\QLzmMZF.exe
  2⤵
  PID:7128
- C:\Windows\System\cRWcwHv.exe
  C:\Windows\System\cRWcwHv.exe
  2⤵
  PID:7420
- C:\Windows\System\yUwQRzM.exe
  C:\Windows\System\yUwQRzM.exe
  2⤵
  PID:7436
- C:\Windows\System\fTNeuZI.exe
  C:\Windows\System\fTNeuZI.exe
  2⤵
  PID:6940
- C:\Windows\System\AuDhfHV.exe
  C:\Windows\System\AuDhfHV.exe
  2⤵
  PID:6564
- C:\Windows\System\TtYHaOz.exe
  C:\Windows\System\TtYHaOz.exe
  2⤵
  PID:7496
- C:\Windows\System\KVYXzvW.exe
  C:\Windows\System\KVYXzvW.exe
  2⤵
  PID:7452
- C:\Windows\System\kTrvAOX.exe
  C:\Windows\System\kTrvAOX.exe
  2⤵
  PID:7532
- C:\Windows\System\zfGzfFy.exe
  C:\Windows\System\zfGzfFy.exe
  2⤵
  PID:7772
- C:\Windows\System\tZoVfPD.exe
  C:\Windows\System\tZoVfPD.exe
  2⤵
  PID:7840
- C:\Windows\System\XGoaFFL.exe
  C:\Windows\System\XGoaFFL.exe
  2⤵
  PID:7872
- C:\Windows\System\QLNIxIo.exe
  C:\Windows\System\QLNIxIo.exe
  2⤵
  PID:7824
- C:\Windows\System\wATTskH.exe
  C:\Windows\System\wATTskH.exe
  2⤵
  PID:7788
- C:\Windows\System\AEgMpac.exe
  C:\Windows\System\AEgMpac.exe
  2⤵
  PID:7816
- C:\Windows\System\ZhLYTFP.exe
  C:\Windows\System\ZhLYTFP.exe
  2⤵
  PID:7952
- C:\Windows\System\yZjFvOj.exe
  C:\Windows\System\yZjFvOj.exe
  2⤵
  PID:7972
- C:\Windows\System\hnWmkbP.exe
  C:\Windows\System\hnWmkbP.exe
  2⤵
  PID:7988
- C:\Windows\System\QsYnNoD.exe
  C:\Windows\System\QsYnNoD.exe
  2⤵
  PID:8132
- C:\Windows\System\lUEOIPb.exe
  C:\Windows\System\lUEOIPb.exe
  2⤵
  PID:8048
- C:\Windows\System\EDNulOp.exe
  C:\Windows\System\EDNulOp.exe
  2⤵
  PID:8000
- C:\Windows\System\etYYqkY.exe
  C:\Windows\System\etYYqkY.exe
  2⤵
  PID:6512
- C:\Windows\System\roJvbAc.exe
  C:\Windows\System\roJvbAc.exe
  2⤵
  PID:8188
- C:\Windows\System\hrTtpUt.exe
  C:\Windows\System\hrTtpUt.exe
  2⤵
  PID:7292
- C:\Windows\System\uaQfnya.exe
  C:\Windows\System\uaQfnya.exe
  2⤵
  PID:7576
- C:\Windows\System\ovxFoCa.exe
  C:\Windows\System\ovxFoCa.exe
  2⤵
  PID:6892
- C:\Windows\System\KdYbhAC.exe
  C:\Windows\System\KdYbhAC.exe
  2⤵
  PID:7108
- C:\Windows\System\LgCFuEL.exe
  C:\Windows\System\LgCFuEL.exe
  2⤵
  PID:7536
- C:\Windows\System\danmsSG.exe
  C:\Windows\System\danmsSG.exe
  2⤵
  PID:7432
- C:\Windows\System\QxuerAN.exe
  C:\Windows\System\QxuerAN.exe
  2⤵
  PID:7340
- C:\Windows\System\pBoEpKy.exe
  C:\Windows\System\pBoEpKy.exe
  2⤵
  PID:7492
- C:\Windows\System\ufSNJvb.exe
  C:\Windows\System\ufSNJvb.exe
  2⤵
  PID:7416
- C:\Windows\System\DhDzOjB.exe
  C:\Windows\System\DhDzOjB.exe
  2⤵
  PID:7488
- C:\Windows\System\LiANHGC.exe
  C:\Windows\System\LiANHGC.exe
  2⤵
  PID:7512
- C:\Windows\System\HujefSd.exe
  C:\Windows\System\HujefSd.exe
  2⤵
  PID:7732
- C:\Windows\System\EJipBWc.exe
  C:\Windows\System\EJipBWc.exe
  2⤵
  PID:7752
- C:\Windows\System\HgracLX.exe
  C:\Windows\System\HgracLX.exe
  2⤵
  PID:7792
- C:\Windows\System\GMukpES.exe
  C:\Windows\System\GMukpES.exe
  2⤵
  PID:7796
- C:\Windows\System\DeFUHxM.exe
  C:\Windows\System\DeFUHxM.exe
  2⤵
  PID:7912
- C:\Windows\System\hNEYrBu.exe
  C:\Windows\System\hNEYrBu.exe
  2⤵
  PID:2960
- C:\Windows\System\JLpvSCD.exe
  C:\Windows\System\JLpvSCD.exe
  2⤵
  PID:7344
- C:\Windows\System\zMclmHS.exe
  C:\Windows\System\zMclmHS.exe
  2⤵
  PID:7644
- C:\Windows\System\tzfshmf.exe
  C:\Windows\System\tzfshmf.exe
  2⤵
  PID:7760
- C:\Windows\System\TyPgxXX.exe
  C:\Windows\System\TyPgxXX.exe
  2⤵
  PID:7776
- C:\Windows\System\pgSCJYA.exe
  C:\Windows\System\pgSCJYA.exe
  2⤵
  PID:7964
- C:\Windows\System\lfrNjWZ.exe
  C:\Windows\System\lfrNjWZ.exe
  2⤵
  PID:8184
- C:\Windows\System\UpFtCfq.exe
  C:\Windows\System\UpFtCfq.exe
  2⤵
  PID:8072
- C:\Windows\System\FLvEYEd.exe
  C:\Windows\System\FLvEYEd.exe
  2⤵
  PID:7476
- C:\Windows\System\WcLLHNR.exe
  C:\Windows\System\WcLLHNR.exe
  2⤵
  PID:6276
- C:\Windows\System\QPAyPXB.exe
  C:\Windows\System\QPAyPXB.exe
  2⤵
  PID:7908
- C:\Windows\System\TEnnxVa.exe
  C:\Windows\System\TEnnxVa.exe
  2⤵
  PID:7744
- C:\Windows\System\INBjTyr.exe
  C:\Windows\System\INBjTyr.exe
  2⤵
  PID:7028
- C:\Windows\System\zjNjEfq.exe
  C:\Windows\System\zjNjEfq.exe
  2⤵
  PID:6796
- C:\Windows\System\MrXWROU.exe
  C:\Windows\System\MrXWROU.exe
  2⤵
  PID:7360
- C:\Windows\System\GnfkMiZ.exe
  C:\Windows\System\GnfkMiZ.exe
  2⤵
  PID:7976
- C:\Windows\System\vzJFmLC.exe
  C:\Windows\System\vzJFmLC.exe
  2⤵
  PID:6744
- C:\Windows\System\gMSpXEP.exe
  C:\Windows\System\gMSpXEP.exe
  2⤵
  PID:7924
- C:\Windows\System\GTncjCB.exe
  C:\Windows\System\GTncjCB.exe
  2⤵
  PID:6408
- C:\Windows\System\dGfJXmp.exe
  C:\Windows\System\dGfJXmp.exe
  2⤵
  PID:8204
- C:\Windows\System\JnkKrFZ.exe
  C:\Windows\System\JnkKrFZ.exe
  2⤵
  PID:8224
- C:\Windows\System\vqMAeZy.exe
  C:\Windows\System\vqMAeZy.exe
  2⤵
  PID:8240
- C:\Windows\System\pqPKbpz.exe
  C:\Windows\System\pqPKbpz.exe
  2⤵
  PID:8256
- C:\Windows\System\hKffvVF.exe
  C:\Windows\System\hKffvVF.exe
  2⤵
  PID:8272
- C:\Windows\System\ADYkvYB.exe
  C:\Windows\System\ADYkvYB.exe
  2⤵
  PID:8288
- C:\Windows\System\bvnRoSP.exe
  C:\Windows\System\bvnRoSP.exe
  2⤵
  PID:8308
- C:\Windows\System\WdtiMFt.exe
  C:\Windows\System\WdtiMFt.exe
  2⤵
  PID:8388
- C:\Windows\System\rqPZNjw.exe
  C:\Windows\System\rqPZNjw.exe
  2⤵
  PID:8404
- C:\Windows\System\NBzAtko.exe
  C:\Windows\System\NBzAtko.exe
  2⤵
  PID:8424
- C:\Windows\System\BSkDwCd.exe
  C:\Windows\System\BSkDwCd.exe
  2⤵
  PID:8448
- C:\Windows\System\CuGLGGW.exe
  C:\Windows\System\CuGLGGW.exe
  2⤵
  PID:8464
- C:\Windows\System\Xfxediv.exe
  C:\Windows\System\Xfxediv.exe
  2⤵
  PID:8480
- C:\Windows\System\ScDJgMq.exe
  C:\Windows\System\ScDJgMq.exe
  2⤵
  PID:8496
- C:\Windows\System\CuzWDSD.exe
  C:\Windows\System\CuzWDSD.exe
  2⤵
  PID:8512
- C:\Windows\System\cnKEVfk.exe
  C:\Windows\System\cnKEVfk.exe
  2⤵
  PID:8532
- C:\Windows\System\znvRglx.exe
  C:\Windows\System\znvRglx.exe
  2⤵
  PID:8548
- C:\Windows\System\kSYfVHv.exe
  C:\Windows\System\kSYfVHv.exe
  2⤵
  PID:8564
- C:\Windows\System\QWuEhIy.exe
  C:\Windows\System\QWuEhIy.exe
  2⤵
  PID:8580
- C:\Windows\System\AnudSPI.exe
  C:\Windows\System\AnudSPI.exe
  2⤵
  PID:8624
- C:\Windows\System\pcmHLTU.exe
  C:\Windows\System\pcmHLTU.exe
  2⤵
  PID:8652
- C:\Windows\System\xomSOzi.exe
  C:\Windows\System\xomSOzi.exe
  2⤵
  PID:8668
- C:\Windows\System\NSeLdcx.exe
  C:\Windows\System\NSeLdcx.exe
  2⤵
  PID:8684
- C:\Windows\System\sftAeij.exe
  C:\Windows\System\sftAeij.exe
  2⤵
  PID:8700
- C:\Windows\System\eTdmPiy.exe
  C:\Windows\System\eTdmPiy.exe
  2⤵
  PID:8716
- C:\Windows\System\cOVqMKy.exe
  C:\Windows\System\cOVqMKy.exe
  2⤵
  PID:8732
- C:\Windows\System\MKnbnHb.exe
  C:\Windows\System\MKnbnHb.exe
  2⤵
  PID:8752
- C:\Windows\System\Gjlflyb.exe
  C:\Windows\System\Gjlflyb.exe
  2⤵
  PID:8768
- C:\Windows\System\fhyzBnf.exe
  C:\Windows\System\fhyzBnf.exe
  2⤵
  PID:8784
- C:\Windows\System\WNEenVJ.exe
  C:\Windows\System\WNEenVJ.exe
  2⤵
  PID:8800
- C:\Windows\System\YsbEoFM.exe
  C:\Windows\System\YsbEoFM.exe
  2⤵
  PID:8820
- C:\Windows\System\uXPWfEA.exe
  C:\Windows\System\uXPWfEA.exe
  2⤵
  PID:8836
- C:\Windows\System\MwbXVeP.exe
  C:\Windows\System\MwbXVeP.exe
  2⤵
  PID:8852
- C:\Windows\System\rESpleJ.exe
  C:\Windows\System\rESpleJ.exe
  2⤵
  PID:8868
- C:\Windows\System\icykYHs.exe
  C:\Windows\System\icykYHs.exe
  2⤵
  PID:8888
- C:\Windows\System\PDYGtCb.exe
  C:\Windows\System\PDYGtCb.exe
  2⤵
  PID:8904
- C:\Windows\System\LPAinwZ.exe
  C:\Windows\System\LPAinwZ.exe
  2⤵
  PID:8928
- C:\Windows\System\ecSoLvi.exe
  C:\Windows\System\ecSoLvi.exe
  2⤵
  PID:8944
- C:\Windows\System\Qncjkbg.exe
  C:\Windows\System\Qncjkbg.exe
  2⤵
  PID:8964
- C:\Windows\System\tHGvSKj.exe
  C:\Windows\System\tHGvSKj.exe
  2⤵
  PID:8980
- C:\Windows\System\urpJIaQ.exe
  C:\Windows\System\urpJIaQ.exe
  2⤵
  PID:8996
- C:\Windows\System\jiuMOtJ.exe
  C:\Windows\System\jiuMOtJ.exe
  2⤵
  PID:9012
- C:\Windows\System\IRpEiMM.exe
  C:\Windows\System\IRpEiMM.exe
  2⤵
  PID:9028
- C:\Windows\System\SujOSKL.exe
  C:\Windows\System\SujOSKL.exe
  2⤵
  PID:9044
- C:\Windows\System\ybtgmdI.exe
  C:\Windows\System\ybtgmdI.exe
  2⤵
  PID:9060
- C:\Windows\System\OBIObgY.exe
  C:\Windows\System\OBIObgY.exe
  2⤵
  PID:9080
- C:\Windows\System\blVUGqV.exe
  C:\Windows\System\blVUGqV.exe
  2⤵
  PID:9096
- C:\Windows\System\pFRevvW.exe
  C:\Windows\System\pFRevvW.exe
  2⤵
  PID:9116
- C:\Windows\System\FTJNpDM.exe
  C:\Windows\System\FTJNpDM.exe
  2⤵
  PID:9136
- C:\Windows\System\GzOOFcn.exe
  C:\Windows\System\GzOOFcn.exe
  2⤵
  PID:9152
- C:\Windows\System\GjUBbaB.exe
  C:\Windows\System\GjUBbaB.exe
  2⤵
  PID:9196
- C:\Windows\System\xWKSVCY.exe
  C:\Windows\System\xWKSVCY.exe
  2⤵
  PID:7440
- C:\Windows\System\upEvGOl.exe
  C:\Windows\System\upEvGOl.exe
  2⤵
  PID:7448
- C:\Windows\System\vdODPqI.exe
  C:\Windows\System\vdODPqI.exe
  2⤵
  PID:7888
- C:\Windows\System\LeMecan.exe
  C:\Windows\System\LeMecan.exe
  2⤵
  PID:7736
- C:\Windows\System\uDTxxmt.exe
  C:\Windows\System\uDTxxmt.exe
  2⤵
  PID:8284
- C:\Windows\System\xPcJwYi.exe
  C:\Windows\System\xPcJwYi.exe
  2⤵
  PID:7764
- C:\Windows\System\weaxoig.exe
  C:\Windows\System\weaxoig.exe
  2⤵
  PID:8336
- C:\Windows\System\fVfVCcQ.exe
  C:\Windows\System\fVfVCcQ.exe
  2⤵
  PID:8356
- C:\Windows\System\uvuuzXe.exe
  C:\Windows\System\uvuuzXe.exe
  2⤵
  PID:8368
- C:\Windows\System\SqoBiQo.exe
  C:\Windows\System\SqoBiQo.exe
  2⤵
  PID:8400
- C:\Windows\System\WinJuuo.exe
  C:\Windows\System\WinJuuo.exe
  2⤵
  PID:8416
- C:\Windows\System\xtCwJxW.exe
  C:\Windows\System\xtCwJxW.exe
  2⤵
  PID:8472
- C:\Windows\System\RbmYQmd.exe
  C:\Windows\System\RbmYQmd.exe
  2⤵
  PID:8504
- C:\Windows\System\NLZZGDZ.exe
  C:\Windows\System\NLZZGDZ.exe
  2⤵
  PID:8544
- C:\Windows\System\kFwDsOT.exe
  C:\Windows\System\kFwDsOT.exe
  2⤵
  PID:8524
- C:\Windows\System\eVAyVEa.exe
  C:\Windows\System\eVAyVEa.exe
  2⤵
  PID:8596
- C:\Windows\System\ocOZvzr.exe
  C:\Windows\System\ocOZvzr.exe
  2⤵
  PID:8612
- C:\Windows\System\AZEIDcf.exe
  C:\Windows\System\AZEIDcf.exe
  2⤵
  PID:8636
- C:\Windows\System\jHfVdJc.exe
  C:\Windows\System\jHfVdJc.exe
  2⤵
  PID:8780
- C:\Windows\System\Cvagslx.exe
  C:\Windows\System\Cvagslx.exe
  2⤵
  PID:8876
- C:\Windows\System\fxHBPlK.exe
  C:\Windows\System\fxHBPlK.exe
  2⤵
  PID:8920
- C:\Windows\System\qqijcsh.exe
  C:\Windows\System\qqijcsh.exe
  2⤵
  PID:9024
- C:\Windows\System\HtUMssj.exe
  C:\Windows\System\HtUMssj.exe
  2⤵
  PID:8924
- C:\Windows\System\yaOqRnf.exe
  C:\Windows\System\yaOqRnf.exe
  2⤵
  PID:9124
- C:\Windows\System\MPyWaYP.exe
  C:\Windows\System\MPyWaYP.exe
  2⤵
  PID:9168
- C:\Windows\System\NvpbpGn.exe
  C:\Windows\System\NvpbpGn.exe
  2⤵
  PID:9184
- C:\Windows\System\UhJuquv.exe
  C:\Windows\System\UhJuquv.exe
  2⤵
  PID:8696
- C:\Windows\System\MQnSsvG.exe
  C:\Windows\System\MQnSsvG.exe
  2⤵
  PID:8764
- C:\Windows\System\PZpBsFf.exe
  C:\Windows\System\PZpBsFf.exe
  2⤵
  PID:8860
- C:\Windows\System\BmfjoxG.exe
  C:\Windows\System\BmfjoxG.exe
  2⤵
  PID:8936
- C:\Windows\System\hmGZIGm.exe
  C:\Windows\System\hmGZIGm.exe
  2⤵
  PID:9008
- C:\Windows\System\iJtOGFl.exe
  C:\Windows\System\iJtOGFl.exe
  2⤵
  PID:9204
- C:\Windows\System\wWNolbM.exe
  C:\Windows\System\wWNolbM.exe
  2⤵
  PID:7900
- C:\Windows\System\wATlQgN.exe
  C:\Windows\System\wATlQgN.exe
  2⤵
  PID:9104
- C:\Windows\System\vFEGNgL.exe
  C:\Windows\System\vFEGNgL.exe
  2⤵
  PID:8324
- C:\Windows\System\EGVWIjC.exe
  C:\Windows\System\EGVWIjC.exe
  2⤵
  PID:8352
- C:\Windows\System\xRKFxlj.exe
  C:\Windows\System\xRKFxlj.exe
  2⤵
  PID:8440
- C:\Windows\System\cfbmsXt.exe
  C:\Windows\System\cfbmsXt.exe
  2⤵
  PID:8508
- C:\Windows\System\TTnnqnR.exe
  C:\Windows\System\TTnnqnR.exe
  2⤵
  PID:8588
- C:\Windows\System\fTYKCla.exe
  C:\Windows\System\fTYKCla.exe
  2⤵
  PID:6628
- C:\Windows\System\eJXTKCc.exe
  C:\Windows\System\eJXTKCc.exe
  2⤵
  PID:8476
- C:\Windows\System\uvXaXqe.exe
  C:\Windows\System\uvXaXqe.exe
  2⤵
  PID:8616
- C:\Windows\System\yWHSIWm.exe
  C:\Windows\System\yWHSIWm.exe
  2⤵
  PID:8444
- C:\Windows\System\NBftuel.exe
  C:\Windows\System\NBftuel.exe
  2⤵
  PID:8748
- C:\Windows\System\PsgNiOD.exe
  C:\Windows\System\PsgNiOD.exe
  2⤵
  PID:8884
- C:\Windows\System\jfTQLaf.exe
  C:\Windows\System\jfTQLaf.exe
  2⤵
  PID:9020
- C:\Windows\System\EcMzKVD.exe
  C:\Windows\System\EcMzKVD.exe
  2⤵
  PID:9160
- C:\Windows\System\KDHRlHz.exe
  C:\Windows\System\KDHRlHz.exe
  2⤵
  PID:8972
- C:\Windows\System\GdwLGhh.exe
  C:\Windows\System\GdwLGhh.exe
  2⤵
  PID:9004
- C:\Windows\System\MnHegci.exe
  C:\Windows\System\MnHegci.exe
  2⤵
  PID:9144
- C:\Windows\System\cHUqJEd.exe
  C:\Windows\System\cHUqJEd.exe
  2⤵
  PID:9148
- C:\Windows\System\Ohmyohi.exe
  C:\Windows\System\Ohmyohi.exe
  2⤵
  PID:8728
- C:\Windows\System\JxzfGBt.exe
  C:\Windows\System\JxzfGBt.exe
  2⤵
  PID:9072
- C:\Windows\System\dbMpAsu.exe
  C:\Windows\System\dbMpAsu.exe
  2⤵
  PID:7684
- C:\Windows\System\hRvDOlO.exe
  C:\Windows\System\hRvDOlO.exe
  2⤵
  PID:8028
- C:\Windows\System\bxTRfMH.exe
  C:\Windows\System\bxTRfMH.exe
  2⤵
  PID:8560
- C:\Windows\System\uwSJuSD.exe
  C:\Windows\System\uwSJuSD.exe
  2⤵
  PID:8520
- C:\Windows\System\npxLBBh.exe
  C:\Windows\System\npxLBBh.exe
  2⤵
  PID:8436
- C:\Windows\System\RCEqToP.exe
  C:\Windows\System\RCEqToP.exe
  2⤵
  PID:8660
- C:\Windows\System\SneuNdl.exe
  C:\Windows\System\SneuNdl.exe
  2⤵
  PID:8916
- C:\Windows\System\VPqukuD.exe
  C:\Windows\System\VPqukuD.exe
  2⤵
  PID:8832
- C:\Windows\System\FrgTgmJ.exe
  C:\Windows\System\FrgTgmJ.exe
  2⤵
  PID:8900
- C:\Windows\System\tJSwOyF.exe
  C:\Windows\System\tJSwOyF.exe
  2⤵
  PID:8776
- C:\Windows\System\ZAVzZIK.exe
  C:\Windows\System\ZAVzZIK.exe
  2⤵
  PID:8364
- C:\Windows\System\Rkzfefh.exe
  C:\Windows\System\Rkzfefh.exe
  2⤵
  PID:8992
- C:\Windows\System\qOfltNw.exe
  C:\Windows\System\qOfltNw.exe
  2⤵
  PID:8348
- C:\Windows\System\wVfxqzt.exe
  C:\Windows\System\wVfxqzt.exe
  2⤵
  PID:8988
- C:\Windows\System\wkmFmkz.exe
  C:\Windows\System\wkmFmkz.exe
  2⤵
  PID:8372
- C:\Windows\System\SnsTkIW.exe
  C:\Windows\System\SnsTkIW.exe
  2⤵
  PID:9220
- C:\Windows\System\veWPKCe.exe
  C:\Windows\System\veWPKCe.exe
  2⤵
  PID:9236
- C:\Windows\System\rTcAvUg.exe
  C:\Windows\System\rTcAvUg.exe
  2⤵
  PID:9256
- C:\Windows\System\tAHVxVc.exe
  C:\Windows\System\tAHVxVc.exe
  2⤵
  PID:9272
- C:\Windows\System\IbHiXZM.exe
  C:\Windows\System\IbHiXZM.exe
  2⤵
  PID:9328
- C:\Windows\System\PLIORXw.exe
  C:\Windows\System\PLIORXw.exe
  2⤵
  PID:9344
- C:\Windows\System\iPckWJA.exe
  C:\Windows\System\iPckWJA.exe
  2⤵
  PID:9360
- C:\Windows\System\PSiktiZ.exe
  C:\Windows\System\PSiktiZ.exe
  2⤵
  PID:9376
- C:\Windows\System\PppCxyf.exe
  C:\Windows\System\PppCxyf.exe
  2⤵
  PID:9392
- C:\Windows\System\lnXeTqE.exe
  C:\Windows\System\lnXeTqE.exe
  2⤵
  PID:9408
- C:\Windows\System\rCQgtcp.exe
  C:\Windows\System\rCQgtcp.exe
  2⤵
  PID:9424
- C:\Windows\System\SJzGPeo.exe
  C:\Windows\System\SJzGPeo.exe
  2⤵
  PID:9444
- C:\Windows\System\TtaRNIe.exe
  C:\Windows\System\TtaRNIe.exe
  2⤵
  PID:9460
- C:\Windows\System\SCJQfuv.exe
  C:\Windows\System\SCJQfuv.exe
  2⤵
  PID:9484
- C:\Windows\System\FhdNTpw.exe
  C:\Windows\System\FhdNTpw.exe
  2⤵
  PID:9500
- C:\Windows\System\SbDhnST.exe
  C:\Windows\System\SbDhnST.exe
  2⤵
  PID:9516
- C:\Windows\System\KvLuvQZ.exe
  C:\Windows\System\KvLuvQZ.exe
  2⤵
  PID:9532
- C:\Windows\System\ymxdxiI.exe
  C:\Windows\System\ymxdxiI.exe
  2⤵
  PID:9552
- C:\Windows\System\JIRSEQx.exe
  C:\Windows\System\JIRSEQx.exe
  2⤵
  PID:9568
- C:\Windows\System\wAXQXPp.exe
  C:\Windows\System\wAXQXPp.exe
  2⤵
  PID:9588
- C:\Windows\System\SinZxaP.exe
  C:\Windows\System\SinZxaP.exe
  2⤵
  PID:9604
- C:\Windows\System\BlkDMVA.exe
  C:\Windows\System\BlkDMVA.exe
  2⤵
  PID:9620
- C:\Windows\System\cMSuoel.exe
  C:\Windows\System\cMSuoel.exe
  2⤵
  PID:9640
- C:\Windows\System\nqpucKk.exe
  C:\Windows\System\nqpucKk.exe
  2⤵
  PID:9668
- C:\Windows\System\soIwrvn.exe
  C:\Windows\System\soIwrvn.exe
  2⤵
  PID:9684
- C:\Windows\System\sIElpeu.exe
  C:\Windows\System\sIElpeu.exe
  2⤵
  PID:9700
- C:\Windows\System\qJIcYzw.exe
  C:\Windows\System\qJIcYzw.exe
  2⤵
  PID:9716
- C:\Windows\System\uzQHepw.exe
  C:\Windows\System\uzQHepw.exe
  2⤵
  PID:9732
- C:\Windows\System\AtOUvdf.exe
  C:\Windows\System\AtOUvdf.exe
  2⤵
  PID:9748
- C:\Windows\System\pPjqKZe.exe
  C:\Windows\System\pPjqKZe.exe
  2⤵
  PID:9764
- C:\Windows\System\PcROoFw.exe
  C:\Windows\System\PcROoFw.exe
  2⤵
  PID:9780
- C:\Windows\System\DxyKawm.exe
  C:\Windows\System\DxyKawm.exe
  2⤵
  PID:9796
- C:\Windows\System\dVkIHTJ.exe
  C:\Windows\System\dVkIHTJ.exe
  2⤵
  PID:9816
- C:\Windows\System\KVueeJC.exe
  C:\Windows\System\KVueeJC.exe
  2⤵
  PID:9832
- C:\Windows\System\rPulSdr.exe
  C:\Windows\System\rPulSdr.exe
  2⤵
  PID:9848
- C:\Windows\System\kpAjVOa.exe
  C:\Windows\System\kpAjVOa.exe
  2⤵
  PID:9864
- C:\Windows\System\CXjnxrF.exe
  C:\Windows\System\CXjnxrF.exe
  2⤵
  PID:9880
- C:\Windows\System\qLPMyAr.exe
  C:\Windows\System\qLPMyAr.exe
  2⤵
  PID:9896
- C:\Windows\System\XfWwiDs.exe
  C:\Windows\System\XfWwiDs.exe
  2⤵
  PID:9912
- C:\Windows\System\rKMrLJp.exe
  C:\Windows\System\rKMrLJp.exe
  2⤵
  PID:9928
- C:\Windows\System\BzwLBHw.exe
  C:\Windows\System\BzwLBHw.exe
  2⤵
  PID:9948
- C:\Windows\System\hZxFfvS.exe
  C:\Windows\System\hZxFfvS.exe
  2⤵
  PID:9984
- C:\Windows\System\FDzABDk.exe
  C:\Windows\System\FDzABDk.exe
  2⤵
  PID:10000
- C:\Windows\System\nMUpdfP.exe
  C:\Windows\System\nMUpdfP.exe
  2⤵
  PID:10016
- C:\Windows\System\NyMJGDu.exe
  C:\Windows\System\NyMJGDu.exe
  2⤵
  PID:10032
- C:\Windows\System\CZpOuZN.exe
  C:\Windows\System\CZpOuZN.exe
  2⤵
  PID:10048
- C:\Windows\System\pQmzPsi.exe
  C:\Windows\System\pQmzPsi.exe
  2⤵
  PID:10064
- C:\Windows\System\jedHqYf.exe
  C:\Windows\System\jedHqYf.exe
  2⤵
  PID:10080
- C:\Windows\System\LpziikQ.exe
  C:\Windows\System\LpziikQ.exe
  2⤵
  PID:10096
- C:\Windows\System\sbVueLz.exe
  C:\Windows\System\sbVueLz.exe
  2⤵
  PID:10112
- C:\Windows\System\nNeGAOR.exe
  C:\Windows\System\nNeGAOR.exe
  2⤵
  PID:10128
- C:\Windows\System\JpEERMS.exe
  C:\Windows\System\JpEERMS.exe
  2⤵
  PID:10144
- C:\Windows\System\fCRtbwX.exe
  C:\Windows\System\fCRtbwX.exe
  2⤵
  PID:10160
- C:\Windows\System\KxUston.exe
  C:\Windows\System\KxUston.exe
  2⤵
  PID:10176
- C:\Windows\System\imChGqw.exe
  C:\Windows\System\imChGqw.exe
  2⤵
  PID:10192
- C:\Windows\System\UxAYxtV.exe
  C:\Windows\System\UxAYxtV.exe
  2⤵
  PID:10208
- C:\Windows\System\nvSgVGO.exe
  C:\Windows\System\nvSgVGO.exe
  2⤵
  PID:10224
- C:\Windows\System\urjdcpY.exe
  C:\Windows\System\urjdcpY.exe
  2⤵
  PID:9092
- C:\Windows\System\YyILmFT.exe
  C:\Windows\System\YyILmFT.exe
  2⤵
  PID:8796
- C:\Windows\System\CaKfsiM.exe
  C:\Windows\System\CaKfsiM.exe
  2⤵
  PID:8692
- C:\Windows\System\RnYlsZe.exe
  C:\Windows\System\RnYlsZe.exe
  2⤵
  PID:9248
- C:\Windows\System\AmFRxbg.exe
  C:\Windows\System\AmFRxbg.exe
  2⤵
  PID:8396
- C:\Windows\System\XmUpGwr.exe
  C:\Windows\System\XmUpGwr.exe
  2⤵
  PID:9068
- C:\Windows\System\WdtkjwT.exe
  C:\Windows\System\WdtkjwT.exe
  2⤵
  PID:7740
- C:\Windows\System\dehoLaF.exe
  C:\Windows\System\dehoLaF.exe
  2⤵
  PID:9280
- C:\Windows\System\xBOdVtN.exe
  C:\Windows\System\xBOdVtN.exe
  2⤵
  PID:9312
- C:\Windows\System\OTQQMfQ.exe
  C:\Windows\System\OTQQMfQ.exe
  2⤵
  PID:9284
- C:\Windows\System\lOXUMeN.exe
  C:\Windows\System\lOXUMeN.exe
  2⤵
  PID:9372
- C:\Windows\System\TSxjdJE.exe
  C:\Windows\System\TSxjdJE.exe
  2⤵
  PID:9352
- C:\Windows\System\zqcJHde.exe
  C:\Windows\System\zqcJHde.exe
  2⤵
  PID:9600
- C:\Windows\System\RmlhaYc.exe
  C:\Windows\System\RmlhaYc.exe
  2⤵
  PID:9524
- C:\Windows\System\ZHAoTGu.exe
  C:\Windows\System\ZHAoTGu.exe
  2⤵
  PID:9452
- C:\Windows\System\ixfLexG.exe
  C:\Windows\System\ixfLexG.exe
  2⤵
  PID:9384
- C:\Windows\System\eTQcaen.exe
  C:\Windows\System\eTQcaen.exe
  2⤵
  PID:9440
- C:\Windows\System\LTBnfsh.exe
  C:\Windows\System\LTBnfsh.exe
  2⤵
  PID:9616
- C:\Windows\System\RKFpiny.exe
  C:\Windows\System\RKFpiny.exe
  2⤵
  PID:9660
- C:\Windows\System\mTillel.exe
  C:\Windows\System\mTillel.exe
  2⤵
  PID:9612
- C:\Windows\System\RxEfShk.exe
  C:\Windows\System\RxEfShk.exe
  2⤵
  PID:9656
- C:\Windows\System\cVrHhRt.exe
  C:\Windows\System\cVrHhRt.exe
  2⤵
  PID:9756
- C:\Windows\System\FGMBwYE.exe
  C:\Windows\System\FGMBwYE.exe
  2⤵
  PID:9696
- C:\Windows\System\TGGrXvp.exe
  C:\Windows\System\TGGrXvp.exe
  2⤵
  PID:9860
- C:\Windows\System\dluwgLn.exe
  C:\Windows\System\dluwgLn.exe
  2⤵
  PID:9956
- C:\Windows\System\vjYAfbq.exe
  C:\Windows\System\vjYAfbq.exe
  2⤵
  PID:9708
- C:\Windows\System\xokhJXe.exe
  C:\Windows\System\xokhJXe.exe
  2⤵
  PID:9976
- C:\Windows\System\YqlJdrK.exe
  C:\Windows\System\YqlJdrK.exe
  2⤵
  PID:9908
- C:\Windows\System\vYjCrkn.exe
  C:\Windows\System\vYjCrkn.exe
  2⤵
  PID:9776
- C:\Windows\System\ukyEqjs.exe
  C:\Windows\System\ukyEqjs.exe
  2⤵
  PID:9944
- C:\Windows\System\toAypbp.exe
  C:\Windows\System\toAypbp.exe
  2⤵
  PID:9992
- C:\Windows\System\XRpimkE.exe
  C:\Windows\System\XRpimkE.exe
  2⤵
  PID:10040
- C:\Windows\System\XmGfVtF.exe
  C:\Windows\System\XmGfVtF.exe
  2⤵
  PID:10072
- C:\Windows\System\ccErDlq.exe
  C:\Windows\System\ccErDlq.exe
  2⤵
  PID:9208
- C:\Windows\System\EayjbYx.exe
  C:\Windows\System\EayjbYx.exe
  2⤵
  PID:9296
- C:\Windows\System\QvgoCAV.exe
  C:\Windows\System\QvgoCAV.exe
  2⤵
  PID:9512
- C:\Windows\System\krPlAtp.exe
  C:\Windows\System\krPlAtp.exe
  2⤵
  PID:9388
- C:\Windows\System\VIBzrmy.exe
  C:\Windows\System\VIBzrmy.exe
  2⤵
  PID:9580
- C:\Windows\System\bYkBZbu.exe
  C:\Windows\System\bYkBZbu.exe
  2⤵
  PID:9828
- C:\Windows\System\vLUiaZs.exe
  C:\Windows\System\vLUiaZs.exe
  2⤵
  PID:9904
- C:\Windows\System\oUOPLJK.exe
  C:\Windows\System\oUOPLJK.exe
  2⤵
  PID:8740
- C:\Windows\System\qrmHgpo.exe
  C:\Windows\System\qrmHgpo.exe
  2⤵
  PID:9492
- C:\Windows\System\zyjwgTQ.exe
  C:\Windows\System\zyjwgTQ.exe
  2⤵
  PID:9340
- C:\Windows\System\WNPIamR.exe
  C:\Windows\System\WNPIamR.exe
  2⤵
  PID:9628
- C:\Windows\System\VQakoap.exe
  C:\Windows\System\VQakoap.exe
  2⤵
  PID:9540
- C:\Windows\System\jbMNwnQ.exe
  C:\Windows\System\jbMNwnQ.exe
  2⤵
  PID:9892
- C:\Windows\System\IyeuixE.exe
  C:\Windows\System\IyeuixE.exe
  2⤵
  PID:10232
- C:\Windows\System\WTEvEoR.exe
  C:\Windows\System\WTEvEoR.exe
  2⤵
  PID:8744
- C:\Windows\System\ouDHxDA.exe
  C:\Windows\System\ouDHxDA.exe
  2⤵
  PID:9300
- C:\Windows\System\bqHPiRY.exe
  C:\Windows\System\bqHPiRY.exe
  2⤵
  PID:9508
- C:\Windows\System\vXEbKqF.exe
  C:\Windows\System\vXEbKqF.exe
  2⤵
  PID:9728
- C:\Windows\System\kjBMbxK.exe
  C:\Windows\System\kjBMbxK.exe
  2⤵
  PID:10076
- C:\Windows\System\jVSwMRQ.exe
  C:\Windows\System\jVSwMRQ.exe
  2⤵
  PID:9844
- C:\Windows\System\QznLJvn.exe
  C:\Windows\System\QznLJvn.exe
  2⤵
  PID:10092

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CdePWZZ.exe

Filesize
1.7MB

MD5
c45f6900a0fb69b2feb851099bfd6c78

SHA1
d11213bef843f253ac988e8c9d6555a2aeba16fe

SHA256
a0696d8b13c329c7a8d2e1128d756a158ed08b041dec6fb618ae7b38b0556472

SHA512
b7fc47da334c680d4166cef33544b3c21b4615f23bdc7b1584e5404b8c384be0851ca175b7cd8bee7c67be16ce744895d4c7d4c6a8089beece46d67a6317f636

Download Submit
C:\Windows\system\DEvISZO.exe

Filesize
1.7MB

MD5
923e43ac849740469a3bb4febca5b037

SHA1
86a47be3eb72a445e9883ca9a88be33ec3107999

SHA256
ae7decaa81a54ee6509f8c026ce183fa511dba0860853247df22333fee28c0a9

SHA512
c368ee916f430370219a9dd4d4fc73a4f56bd24f3344bc8b19eba2629c06845851050c0f01f73d136357cd410073f248eb8c432f01e37410a386e0b930b125e1

Download Submit
C:\Windows\system\FZnvicL.exe

Filesize
1.7MB

MD5
84abd04b559919d1d58991e611733202

SHA1
4ca20a3c081e1c16cdd094e2d4be47c241337c9a

SHA256
faec64d51a1256c526c199c2e6adee211d5b53fe8bacc5cc0ab33e219ca633ba

SHA512
b2549f710547382149316bffe240457dfcba01df9007a6097fb07fb96460def8f2b41a3dc68450094dd478cc4f0fc8f017608401b7adb27af56f64212a1df7a8

Download Submit
C:\Windows\system\FgIuPin.exe

Filesize
1.7MB

MD5
94f57880295a8cb9433cb417e694c0c1

SHA1
61262cca55dc29fa7da54e1bece8af67f8309d22

SHA256
e539046cdc2b7db2990d1b61cac8dbaafe6bf1d840bd0be07724e4cc3818e4f3

SHA512
1b1d1c2cea24543a703ec75dbff7221a5cd264fa7f92f158436058eb15efb8be42967f182a7662490274b3d259a0736a638e68d5ec376ddda1b36c9e714ae645

Download Submit
C:\Windows\system\FqQzDlI.exe

Filesize
1.7MB

MD5
2c7a86e584a06d42a74fd27e7815589c

SHA1
b83a9c85b3db11860e05d0fb71cb448bc65b83cc

SHA256
f26bf73867ad979406cc8bf93ed7028241628881dccb8faba0799f62f1991404

SHA512
f2fe7aac0120c631f05cbc7c198883b3696dd5d40c0fb2fb1bf2e78940b6580816da93d887a530acef6251255ef9dccad6890935888926f29720d559e7c8260e

Download Submit
C:\Windows\system\JotbFhi.exe

Filesize
1.7MB

MD5
09fa832f380792bca7d2bf4ca4a85ecd

SHA1
9f53610cdd4fe14de20c7fc633e00d6f5c5da07c

SHA256
162b8339185e9d4bc77a8e2654e4f1eb98abb4f5977a6bc1bfb018d80cfc1d90

SHA512
3847cd2b25010fedd3e72a1f2dc1d8acee373e52b78faf7407de86970aa2909c89fce59d71afc6ea01d73ab21a508de062ed3ef89d183296d04ce3ac3257ff6f

Download Submit
C:\Windows\system\PdnvTZW.exe

Filesize
1.7MB

MD5
1dd625a3b8e8bd46b330c6fcc5501dd2

SHA1
c98999d0954965a45baa6dae91bd7a728c38bcba

SHA256
7697e48ff812aeb764023c27ee7f977d2073f172a75605f8d05670d1857d9d7c

SHA512
25548ca0dc0bed84d9ee896753c79e2460e6e13e2fc7c09875a70335728bb676e2d92bc64ffa0cbc1385c95af428b8d8d4964b1ce1f97aca706fdb6c45163074

Download Submit
C:\Windows\system\QeOvvAr.exe

Filesize
1.7MB

MD5
a58f3cd3726d4be48ea52ae7434e4f1e

SHA1
19290befbf0dbf2f7c8fab07e52c052c8f6d21cb

SHA256
45df57667cd1a7eb522cb0c41a938df2b224fe0990d70d74ce35b03c76ceba34

SHA512
9bf7e1af067e8eeb14de6b7ccc0411ea4f3fe0640264024bf118654d20869c81ec26ce67b4cfd91bd38524cef6a90c8cc224e4f728e6a03c7c1048e77e004ee7

Download Submit
C:\Windows\system\SQyEfTz.exe

Filesize
1.7MB

MD5
0d39f8643cbe43326a4450e0b41277ca

SHA1
37e2092d3c92fa29712a92eb0cdd6c1df755133b

SHA256
4a50650e30f1e6800c22e982ef47dd01e6812939f0e668acde40a29e09fea15a

SHA512
b519281215cc8b6210a3863b8a6aff0da6fe6df8324fb04a476d1e4c0c799ae29363d0cd77e575da8a6f59edf954bc22cc4bdda9e61510640dcadec9da9d41cd

Download Submit
C:\Windows\system\THSTGYW.exe

Filesize
1.7MB

MD5
cef7f6acb859166f87d0c2754386c114

SHA1
64061ecdcf1e93a2c46e810b93669e261c310f50

SHA256
e098f902f90f5a2f6c7ab4cd51f10cde0e84451409667313bb39ee8e16a1448f

SHA512
60d65db7baf3462112a0c48f6fef033d17a4865082b2396790aac0737066675cc1f2bbd72de485d4241bdb06ba2f57feff1c76416da8c868f567f1836ca2cc56

Download Submit
C:\Windows\system\TNOoIVK.exe

Filesize
1.7MB

MD5
7e56163cee73d4fb2a261b23b58c5c97

SHA1
c0e4de0a93c3d63fa7ad03d77381be21fd664e56

SHA256
d2e50b7d69822721522c950fca9edb462784837db214d6485cc328552c4eb588

SHA512
0079e9cb5527ff3fc8eb0927ac1ebce9b1eca2ea930aef7f77226e05f03633d1c7a1c63c6bc411d4db50f87713024b3139590c3923bc42c1c0b64447c1d2ad92

Download Submit
C:\Windows\system\VhxhmSA.exe

Filesize
1.7MB

MD5
77c83dd22f827651928cc8d9b194c369

SHA1
d9292a2ff0d5bebc182de78cb760d950683b33d4

SHA256
e8e5967c24efdee59a6126b6a5fdb6e3b48d3dd58d5bbe21cd8811a8e9207e6f

SHA512
2c36742f5e3338adbdb24ae896a89d89836b6857dcbfe23fa970a33bd72ff3889962233ed87a6cb22017f1bdcb26e0c26e952402ea7f8d52efa7ea1f88ff9dc7

Download Submit
C:\Windows\system\WMPXgEd.exe

Filesize
1.7MB

MD5
94fae23748a7c3398bc61db5e13fe23c

SHA1
9e638bdc664f53280efbbb77797fc9409ad247d8

SHA256
b6f503fa93f74df686ad626c62cca0e8934b1e9ea171ccd1fd791b374c5c2931

SHA512
0ef115c04a9980037445d45cba917e2aa88419df47ad2508748df94607733a7f6c0df843e756f85c838292b5d82f8ae29b0a4b32a3f03611b9352486909391e4

Download Submit
C:\Windows\system\ZbxrjSv.exe

Filesize
1.7MB

MD5
e5f6c320746a5f9f999ef2b2d4ab3155

SHA1
631270720abbb718c16270d18bf4412da87ec611

SHA256
8e04c39f7022a9379e9da1e4ddadd3cdbf56adb3ba9a99aa29775114e6cc5103

SHA512
df0f67278663fbb7cfb00de829c2f503ddb50633039988665efb3f719584fdcb0c07fa5a71bb7156cbb49c5f3bd397552faff4a36e2089385d563e3f3263e2b2

Download Submit
C:\Windows\system\bOOzjsy.exe

Filesize
1.7MB

MD5
bd0a811e9805dc579fcc416c0b1ac7ea

SHA1
123a66e20b6516cfd9fbd2e130a94df594255eca

SHA256
8fcf4dc5080c5059ecc389e87425ac4c763074f911d946e380cf9dea1296ca89

SHA512
9efe5aaf5942923fbf087425cdd59d8a21ca8c8b5d2559c4132cfc1304daef1747ca0e09ad5fcd1026716ff35f854df6561e6fd9993bff71b46da97a4e542bc7

Download Submit
C:\Windows\system\dPgiobq.exe

Filesize
1.7MB

MD5
2c7497edb438e61e40fecb1d733e3c4b

SHA1
88ca3d40847efb08a40ebee8e341695ae3262208

SHA256
578493e5885b64a14a6fa32feb9e28a7573e057947ff2579466baf9489571cfc

SHA512
142542309f2b687ef2e133460e0bb8cb4c68a2afc92c9be764217a4ef0092d4acfdfbfb620c052a72db064d4be9d7a6c3d68f71d611629126f76cb45602035ad

Download Submit
C:\Windows\system\dksGUpo.exe

Filesize
1.7MB

MD5
cb8973057310dbcea3e92fc101a0a64b

SHA1
7e76d55a2e573dbb167d839097d1ec4ef45fd092

SHA256
2540b94333e6b4d84d409e69a90b4357f4cb290d5635d51d5a6c1e32093a2b03

SHA512
7009b9d82a489eeeb8e235c6c601b4535b1498fe94d32edbcd0e2a8d8a0685e693637c1494aba8db46272140d21b75e8890494cf7ee3acad86140a1b16b5dddd

Download Submit
C:\Windows\system\fGYNKat.exe

Filesize
1.7MB

MD5
1ad71316c1dfdfb8304759d09c432c17

SHA1
506f64e8f4ab22228bd50d5ee88add38033b15ac

SHA256
b51ce2e7e8b2db3098902533547be9e22828537abd6d856e955125d9ed6b93b5

SHA512
7b2bdf10f7166d6bb645e820dda6d53682498a84c72686f48a07368f4f8906a164fe9d5c3f0707ea982b6a8f15ceb305f7eddaa65e434beb72a665326ad9c165

Download Submit
C:\Windows\system\gUcfvHw.exe

Filesize
1.7MB

MD5
3e8d72a2b189f4b25a5d6052bf23406f

SHA1
669d66e8b631b8d327ce4c289cdb65a8590a8ba2

SHA256
a9bd2c5f9675a144a4f21c60f34e01428c5e0de3989c617fb6e797e13edf87a2

SHA512
7bd97135fe819bd036f710a6b46e3d30c5bb8f52cb5c38146713d6142a1e62738aa24d0a0ce0dab6fad9a5633620be8c1786ad2c4ccf0b10a7132156f27958e0

Download Submit
C:\Windows\system\ggJpztA.exe

Filesize
1.7MB

MD5
7210fddda8b2e05d3a33bfad71fb8b89

SHA1
d9aab2d88b8ad2f68b1aa2a5f3507b1392406143

SHA256
d84f995a08e320b7ad38c999cf4f435aec3e245ad008e6d29a18c99de625255f

SHA512
64d889519fa943c589f3b04ce0728d42c64729ec1fafb72f8134cbf77c2471af2770119f6bb42b4b8e2d1ac1981bc9af499b614dd59c5e33837f64e71eebbef9

Download Submit
C:\Windows\system\goWwXeY.exe

Filesize
1.7MB

MD5
4ad03bec548f7ed81ecb33ab2f18d78f

SHA1
cc87006ee4b5341d1223fd51e0c8bb7d69aedc2d

SHA256
f0e89f4bbe8e71ee9a8ee7b2aa2842b565c5515213fc57c6b4cbcb0d722cdae7

SHA512
ddbfcb1513809529d81e7dc648de9af3cea383dc0a1ed5760e3d5e0c4627cbb504368098347b873a431f5fd36933754b86f03510e114bfe278a8ac31a46b73ac

Download Submit
C:\Windows\system\hOZtWZX.exe

Filesize
1.7MB

MD5
15ce9972317c27f24e877ae596c4cde6

SHA1
7d70c21b065629dea7f8451d908ecaadbe11978c

SHA256
d44ed86a4c7ed2a0536994d2d5263d9515ee821809a35c4b38b3ef9b742d27ca

SHA512
ad3e63166b85054bde41ecb98cd33dcccf3520b239f42fd155dbf7a1f4fcdae597877501127842399e40a866bba1c007adf18cda715ea3f8c25955cc3afec5d2

Download Submit
C:\Windows\system\kKOOHfZ.exe

Filesize
1.7MB

MD5
937a467fb128c8288cca5e29135bc1e3

SHA1
da47526ca91987258386c54a485d12a4ad596635

SHA256
8483bb138dd1326dc28679c831d4ae4a79dd3440d4433b37b68e9e12a8db69ad

SHA512
79bdb74676729e9721218d246c5225fa0a2e085b2f471734b8c58c10beba441d0375bf5d64e356fadf90d6b5e788328fdce905e42cb38b873373a7ecac7135d6

Download Submit
C:\Windows\system\onYZmgh.exe

Filesize
1.7MB

MD5
a0765d176f32a56c7efb139b25e66fc4

SHA1
6c9330abebc749caa147137c1eee1e1375fc927a

SHA256
eb5c0dec34989556c86d3a345beaee06e221f8b115ff3ad4e2249151a75388d5

SHA512
b9d7bd99e11359984f9f6865d74ffd7a90df88b4e1e2515830d6b587f1bca33d2930968eaff96eb5d8529b0eda20945b4312fea09a223eabbdc3fd987b0dc3ad

Download Submit
C:\Windows\system\opeNpbh.exe

Filesize
1.7MB

MD5
2e71a6257326204a691f4d84799d3d62

SHA1
d6bff0763f43eae11686b7ae23ca04480a962ab1

SHA256
4140c517e84ff38b29eca2678523f2c167339fa458e2d8234494d4c63a8b3986

SHA512
dd4bced33e910d1b66a60077a8f7826104b4c2f275d9cbac17ad4111b98444434e8dc725094533be4ce299fe1684547f55133e594554b6bae83f0cab66ed9224

Download Submit
C:\Windows\system\pmPBwjE.exe

Filesize
1.7MB

MD5
8281f33803a4879ecffecba74f1ef985

SHA1
c0b8ac1d741546e66ae7f24c7b2f47db35755d12

SHA256
eac20ce4c3e90244c790fa6bb4a7ebc2a55eb92dc548ae9acd0ec8a957b1a2ec

SHA512
8fadb2336baa009cb865282d49c57d79ce4a1a504818cfc72700a765bda508906cbb0c2c0b89637f70ff2b8cfc10b021b319e927868390b6f5dfe459ceb31a58

Download Submit
C:\Windows\system\tDlEcYE.exe

Filesize
1.7MB

MD5
cec6bbfb57cee5fbd29a29429aa895ab

SHA1
360a8ccbc5aa3e2dbeccee4a11ffb461a2d28381

SHA256
954e48951bc46eeb7c082b630faeea15ba190f5a9669ffa2cb5d09a72b38acd3

SHA512
5ea1268b58ed1f3e27bd27f7b9cfb9421b64c747c4848b1edc9a6fa01482b59d797a543fb2b347f6c3d64ec8623beac4f587df0ef044a3432b154d81dd6eefc7

Download Submit
C:\Windows\system\vWVYuWC.exe

Filesize
1.7MB

MD5
f700f55285ea4f9dc83065140cf0500c

SHA1
4a27ce7c5861cef628f60385697fcbbb5c006502

SHA256
2c91d9fb237422bffdb5b9726d063fc8455f939d86098e130441b8cb9af051f7

SHA512
f50a2c6800a2c44d31bc49346ebf60095c26f4a271c69a4393800d28f45407cf28081b5be60aca441174de553ebb9c41f474126f947094023f6e558701c62e6a

Download Submit
C:\Windows\system\vlZCaKL.exe

Filesize
1.7MB

MD5
723c0c404696bb8e7e14d5e3448768f1

SHA1
cf998cae8dce8a47f29f2f4c2266a8075e4d734e

SHA256
f8fe14d50d7abfe0e3d3c57930ed283c9987ec59f88c4eb4c511f29e458d028c

SHA512
8e1ae0cf0725a139a510bd5c5902f8980a7c946d807373ec6bf017d61d1f66351f4775194ef06f4413cb2d4fbdbb3389942d0717219ae07fc7ab0c0ccd92c191

Download Submit
C:\Windows\system\xSwOOxW.exe

Filesize
1.7MB

MD5
7b6b920061fd3af432ff37548270afb5

SHA1
d03f749118fa9e54158dac8433d817e16c96c214

SHA256
a766eda94384dbf2e2caf4b664321a6e33033302f9b545596d7559d219cd75b6

SHA512
7522bf10b9809ad1e5233880afcd222fa85a373c2a0b9113abc668de9571de3358bd58e99e90e0af071c892abfa6b5831963bd9d022452c86cc70c63d14f2cb6

Download Submit
C:\Windows\system\zJeBOFP.exe

Filesize
1.7MB

MD5
1cb293df4a2310fb3808a24efcbda213

SHA1
6b00477894e4c56c1b616f49c02861e673612b7f

SHA256
09c91d2917f672917494a0fe7943489a4c4c12265b5950091ba163eba6715f04

SHA512
40ef24c9d6235ecd4368d14720a974ab6b7f5f4eb0fa881787677dbe595501e8d20cbd5180875de394a5b5ea1f8f9a803e26f7e828b87c2e633787529526fc7c

Download Submit
C:\Windows\system\zSYOWJq.exe

Filesize
1.7MB

MD5
4f4c1b17f356cbc8214620fb19943453

SHA1
0ea7f23368fb15c0414478b228224a7b66f7809d

SHA256
df3fe53d0c9c5f062ad24e86ccd721c17e45f5c9b2f0bb9f81455a3b7bf33aa1

SHA512
ecd5f5e1602484f2fe75fd548baf29aa2bf89865d0fda36007b2a2db890de006516aeb86c488d0edf869d1472a2cc5f33f99022460d5ddc96d7edc12859e798e

Download Submit
memory/1704-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-271-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-269-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2548-26-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2584-275-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-233-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2700-152-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2768-157-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2772-155-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2924-657-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2924-134-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2924-137-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2924-150-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2924-274-0x0000000002D30000-0x0000000002DB0000-memory.dmp

Filesize
512KB

Download
memory/2924-23-0x000000001B810000-0x000000001BAF2000-memory.dmp

Filesize
2.9MB

Download
memory/2924-133-0x000007FEF5140000-0x000007FEF5ADD000-memory.dmp

Filesize
9.6MB

Download
memory/2996-0-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-154-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2996-153-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2996-156-0x000000013FD40000-0x0000000140132000-memory.dmp

Filesize
3.9MB

Download
memory/2996-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2996-21-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-270-0x0000000003490000-0x0000000003882000-memory.dmp

Filesize
3.9MB

Download
memory/2996-268-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2996-272-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-273-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2996-151-0x0000000003130000-0x0000000003522000-memory.dmp

Filesize
3.9MB

Download