xmrig | b84bb82dd9799a1e4ccb47a1fae4384e8a2f4a5e26c9ad9b1162e04adc5784de

Analysis

max time kernel
36s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-04-2024 19:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
Size

1.8MB
MD5

05de3385af2d2a019cfa5df19d45cd27
SHA1

e496ede413540f079267c8601fde3e2016529543
SHA256

b84bb82dd9799a1e4ccb47a1fae4384e8a2f4a5e26c9ad9b1162e04adc5784de
SHA512

acc3e524528bb6ec6067476eb09f654bc6a73277b0505eac8a2279258ec139e519d8980224d8ff79eb2f3307e474c70563d3f93691fb8d696fb170359f1e23c1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl2:NABx

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2800-13-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2248-479-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2580-484-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2532-491-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2556-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2448-487-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2568-477-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	xmrig
behavioral1/memory/2636-474-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2524-406-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2800	ulklmwS.exe
2524	XhZyDRE.exe
2636	RNXPZPA.exe
2568	vTzpjjU.exe
2248	EHAudYO.exe
2580	SmLPVFq.exe
2448	iVRwRNI.exe
2556	UijVRzS.exe
2532	SPaIEMf.exe
2416	JPREtsV.exe
2484	cCzeGzq.exe
2892	HoPfXdh.exe
2112	OXCBWZQ.exe
1696	IcwExMS.exe
1416	SRBLyCU.exe
2692	fgXoDCd.exe
2664	TlHyCFG.exe
2740	jkILnFs.exe
1772	jlIURDT.exe
608	YcvVRcA.exe
1904	aLyDRwq.exe
1848	JOdJlAM.exe
1620	qzuBFch.exe
808	llSGKpO.exe
1628	rbRTAaM.exe
2920	ZigjFph.exe
2932	xRgljvQ.exe
2020	mWSFsIt.exe
1212	FFXseyW.exe
2752	mqDzrMk.exe
1272	HBwMzNf.exe
268	XrrTdws.exe
1472	jFOuesU.exe
1636	joojdUs.exe
2836	nUBzdxh.exe
1844	EIaupdc.exe
2780	YlHSiLJ.exe
1788	WebkPDO.exe
2372	xWILNfP.exe
2236	EwKzUWP.exe
2988	MobuMoE.exe
3064	FsQHjiZ.exe
1572	SWCTvoy.exe
1576	izcuROp.exe
1532	eKjoEqR.exe
1316	QIVNBlz.exe
1948	RBiLoVQ.exe
952	ZDMwblp.exe
656	pfoisUF.exe
1852	dBNzHyM.exe
1292	ocUAsHN.exe
1288	EoeESBa.exe
320	dKhdePX.exe
748	nQwkxxu.exe
1976	ZDryGVP.exe
1768	nqXWnsf.exe
2216	oFGdbSz.exe
1996	UXhUGbe.exe
2220	uhlIDER.exe
2980	PKTZJav.exe
800	YjizyAv.exe
984	LSKREEd.exe
1232	wcxqvbw.exe
876	snbhdve.exe

Loads dropped DLL 64 IoCs

pid	Process
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-0-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/files/0x000a000000015cb6-3.dat	upx
behavioral1/memory/2800-13-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/files/0x0035000000015d42-17.dat	upx
behavioral1/files/0x000e0000000054ab-19.dat	upx
behavioral1/files/0x0009000000015d6b-25.dat	upx
behavioral1/files/0x0007000000015d7f-34.dat	upx
behavioral1/files/0x0007000000015d87-37.dat	upx
behavioral1/files/0x0006000000016d07-57.dat	upx
behavioral1/files/0x0006000000016d34-69.dat	upx
behavioral1/files/0x0006000000016d3e-77.dat	upx
behavioral1/files/0x0006000000016d9d-97.dat	upx
behavioral1/files/0x0006000000016da5-101.dat	upx
behavioral1/files/0x0015000000018644-137.dat	upx
behavioral1/memory/2248-479-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2580-484-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/memory/2532-491-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	upx
behavioral1/memory/2556-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2448-487-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2568-477-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2636-474-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2524-406-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x0031000000018649-141.dat	upx
behavioral1/files/0x0006000000017437-133.dat	upx
behavioral1/files/0x00060000000173d0-129.dat	upx
behavioral1/files/0x00060000000171df-125.dat	upx
behavioral1/files/0x000600000001708b-121.dat	upx
behavioral1/files/0x000600000001704a-118.dat	upx
behavioral1/files/0x0006000000016db9-109.dat	upx
behavioral1/files/0x0006000000016dbe-113.dat	upx
behavioral1/files/0x0006000000016db1-105.dat	upx
behavioral1/files/0x0006000000016d8e-93.dat	upx
behavioral1/files/0x0006000000016d74-89.dat	upx
behavioral1/files/0x0006000000016d5f-85.dat	upx
behavioral1/files/0x0006000000016d43-81.dat	upx
behavioral1/files/0x0006000000016d3a-73.dat	upx
behavioral1/files/0x0006000000016d20-65.dat	upx
behavioral1/files/0x0006000000016d18-61.dat	upx
behavioral1/files/0x0006000000016cdc-53.dat	upx
behavioral1/files/0x0008000000015ecc-49.dat	upx
behavioral1/files/0x0007000000015e32-46.dat	upx
behavioral1/files/0x0007000000015d93-42.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\zAXwqXq.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\RbePVjY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\MuVlSFc.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\SkgQKNr.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\OzKhkQY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\IdPQZtg.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\LsIqsSN.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\QioGSfm.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\tlyOTTh.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\jEspHKK.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\qtJuKLO.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ynNhskn.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\kmumZpO.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\DDRgCSk.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\jKuiXZl.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ABHqioJ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ADABOCf.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\oDvhTuJ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\GDrDSPB.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\taXQoGu.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\HvUWKqS.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\IQEACkM.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\TORFzgb.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\jfosJLI.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\GnkmFHL.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\CGpxRKj.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\twCFQCU.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\QZEutDt.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\atubcfl.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\rCCTpxx.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\cXZTSRw.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\bfGQzYF.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\iKGOpib.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\lJHHgin.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\kIvNSdU.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\MRLmRBY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\FYUdeSo.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\uMoeSqM.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\yqzLaKZ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\AKfWVXS.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\dzPeqbx.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\fpNFtzv.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\BGRaiXe.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\bvVwSmk.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\IdWESZN.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\WgmPnkg.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\GoVMhid.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\wbYoBAJ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\vsqoZPu.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\bKcaSGE.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\dBoTNWR.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\nvjyyNF.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\YTjAKRu.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ZqjCPeX.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\sxYQruY.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\fBFGuhD.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\DNYXnrM.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\swHGJzy.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\vztsFEv.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\CYGzzcQ.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\PpraXuW.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\ZUsaejO.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\eVbRUtc.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
File created	C:\Windows\System\LMQHKCB.exe	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3028	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
Token: SeDebugPrivilege	3028	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 3028	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	29
PID 2876 wrote to memory of 3028	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	29
PID 2876 wrote to memory of 3028	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	29
PID 2876 wrote to memory of 2800	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2800	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2800	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	30
PID 2876 wrote to memory of 2524	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2524	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2524	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	31
PID 2876 wrote to memory of 2636	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2636	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2636	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	32
PID 2876 wrote to memory of 2568	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	33
PID 2876 wrote to memory of 2568	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	33
PID 2876 wrote to memory of 2568	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	33
PID 2876 wrote to memory of 2248	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	34
PID 2876 wrote to memory of 2248	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	34
PID 2876 wrote to memory of 2248	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	34
PID 2876 wrote to memory of 2580	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	35
PID 2876 wrote to memory of 2580	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	35
PID 2876 wrote to memory of 2580	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	35
PID 2876 wrote to memory of 2448	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	36
PID 2876 wrote to memory of 2448	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	36
PID 2876 wrote to memory of 2448	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	36
PID 2876 wrote to memory of 2556	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	37
PID 2876 wrote to memory of 2556	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	37
PID 2876 wrote to memory of 2556	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	37
PID 2876 wrote to memory of 2532	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	38
PID 2876 wrote to memory of 2532	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	38
PID 2876 wrote to memory of 2532	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	38
PID 2876 wrote to memory of 2416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	39
PID 2876 wrote to memory of 2416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	39
PID 2876 wrote to memory of 2416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	39
PID 2876 wrote to memory of 2484	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	40
PID 2876 wrote to memory of 2484	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	40
PID 2876 wrote to memory of 2484	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	40
PID 2876 wrote to memory of 2892	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	41
PID 2876 wrote to memory of 2892	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	41
PID 2876 wrote to memory of 2892	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	41
PID 2876 wrote to memory of 2112	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	42
PID 2876 wrote to memory of 2112	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	42
PID 2876 wrote to memory of 2112	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	42
PID 2876 wrote to memory of 1696	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	43
PID 2876 wrote to memory of 1696	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	43
PID 2876 wrote to memory of 1696	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	43
PID 2876 wrote to memory of 1416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	44
PID 2876 wrote to memory of 1416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	44
PID 2876 wrote to memory of 1416	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	44
PID 2876 wrote to memory of 2692	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	45
PID 2876 wrote to memory of 2692	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	45
PID 2876 wrote to memory of 2692	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	45
PID 2876 wrote to memory of 2664	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	46
PID 2876 wrote to memory of 2664	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	46
PID 2876 wrote to memory of 2664	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	46
PID 2876 wrote to memory of 2740	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	47
PID 2876 wrote to memory of 2740	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	47
PID 2876 wrote to memory of 2740	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	47
PID 2876 wrote to memory of 1772	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	48
PID 2876 wrote to memory of 1772	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	48
PID 2876 wrote to memory of 1772	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	48
PID 2876 wrote to memory of 608	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	49
PID 2876 wrote to memory of 608	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	49
PID 2876 wrote to memory of 608	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	49
PID 2876 wrote to memory of 1904	2876	05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05de3385af2d2a019cfa5df19d45cd27_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3028
- C:\Windows\System\ulklmwS.exe
  C:\Windows\System\ulklmwS.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\XhZyDRE.exe
  C:\Windows\System\XhZyDRE.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\RNXPZPA.exe
  C:\Windows\System\RNXPZPA.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\vTzpjjU.exe
  C:\Windows\System\vTzpjjU.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\EHAudYO.exe
  C:\Windows\System\EHAudYO.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\SmLPVFq.exe
  C:\Windows\System\SmLPVFq.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\iVRwRNI.exe
  C:\Windows\System\iVRwRNI.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\UijVRzS.exe
  C:\Windows\System\UijVRzS.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\SPaIEMf.exe
  C:\Windows\System\SPaIEMf.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\JPREtsV.exe
  C:\Windows\System\JPREtsV.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\cCzeGzq.exe
  C:\Windows\System\cCzeGzq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\HoPfXdh.exe
  C:\Windows\System\HoPfXdh.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\OXCBWZQ.exe
  C:\Windows\System\OXCBWZQ.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\IcwExMS.exe
  C:\Windows\System\IcwExMS.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\SRBLyCU.exe
  C:\Windows\System\SRBLyCU.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\fgXoDCd.exe
  C:\Windows\System\fgXoDCd.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\TlHyCFG.exe
  C:\Windows\System\TlHyCFG.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\jkILnFs.exe
  C:\Windows\System\jkILnFs.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\jlIURDT.exe
  C:\Windows\System\jlIURDT.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\YcvVRcA.exe
  C:\Windows\System\YcvVRcA.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\aLyDRwq.exe
  C:\Windows\System\aLyDRwq.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\JOdJlAM.exe
  C:\Windows\System\JOdJlAM.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\qzuBFch.exe
  C:\Windows\System\qzuBFch.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\llSGKpO.exe
  C:\Windows\System\llSGKpO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\rbRTAaM.exe
  C:\Windows\System\rbRTAaM.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ZigjFph.exe
  C:\Windows\System\ZigjFph.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\xRgljvQ.exe
  C:\Windows\System\xRgljvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\mWSFsIt.exe
  C:\Windows\System\mWSFsIt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\FFXseyW.exe
  C:\Windows\System\FFXseyW.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\mqDzrMk.exe
  C:\Windows\System\mqDzrMk.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\HBwMzNf.exe
  C:\Windows\System\HBwMzNf.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\XrrTdws.exe
  C:\Windows\System\XrrTdws.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\jFOuesU.exe
  C:\Windows\System\jFOuesU.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\joojdUs.exe
  C:\Windows\System\joojdUs.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\nUBzdxh.exe
  C:\Windows\System\nUBzdxh.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\EIaupdc.exe
  C:\Windows\System\EIaupdc.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\YlHSiLJ.exe
  C:\Windows\System\YlHSiLJ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\WebkPDO.exe
  C:\Windows\System\WebkPDO.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\xWILNfP.exe
  C:\Windows\System\xWILNfP.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\EwKzUWP.exe
  C:\Windows\System\EwKzUWP.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\MobuMoE.exe
  C:\Windows\System\MobuMoE.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\FsQHjiZ.exe
  C:\Windows\System\FsQHjiZ.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\SWCTvoy.exe
  C:\Windows\System\SWCTvoy.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\izcuROp.exe
  C:\Windows\System\izcuROp.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\eKjoEqR.exe
  C:\Windows\System\eKjoEqR.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\QIVNBlz.exe
  C:\Windows\System\QIVNBlz.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\RBiLoVQ.exe
  C:\Windows\System\RBiLoVQ.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\ZDMwblp.exe
  C:\Windows\System\ZDMwblp.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\pfoisUF.exe
  C:\Windows\System\pfoisUF.exe
  2⤵
  - Executes dropped EXE
  PID:656
- C:\Windows\System\dBNzHyM.exe
  C:\Windows\System\dBNzHyM.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\ocUAsHN.exe
  C:\Windows\System\ocUAsHN.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\EoeESBa.exe
  C:\Windows\System\EoeESBa.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\dKhdePX.exe
  C:\Windows\System\dKhdePX.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\nQwkxxu.exe
  C:\Windows\System\nQwkxxu.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\ZDryGVP.exe
  C:\Windows\System\ZDryGVP.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\nqXWnsf.exe
  C:\Windows\System\nqXWnsf.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\oFGdbSz.exe
  C:\Windows\System\oFGdbSz.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\UXhUGbe.exe
  C:\Windows\System\UXhUGbe.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\uhlIDER.exe
  C:\Windows\System\uhlIDER.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\PKTZJav.exe
  C:\Windows\System\PKTZJav.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\YjizyAv.exe
  C:\Windows\System\YjizyAv.exe
  2⤵
  - Executes dropped EXE
  PID:800
- C:\Windows\System\LSKREEd.exe
  C:\Windows\System\LSKREEd.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\wcxqvbw.exe
  C:\Windows\System\wcxqvbw.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\snbhdve.exe
  C:\Windows\System\snbhdve.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\oDvhTuJ.exe
  C:\Windows\System\oDvhTuJ.exe
  2⤵
  PID:1740
- C:\Windows\System\wbYoBAJ.exe
  C:\Windows\System\wbYoBAJ.exe
  2⤵
  PID:1724
- C:\Windows\System\KSaCHSQ.exe
  C:\Windows\System\KSaCHSQ.exe
  2⤵
  PID:2960
- C:\Windows\System\CfVncwX.exe
  C:\Windows\System\CfVncwX.exe
  2⤵
  PID:1564
- C:\Windows\System\fWugVcw.exe
  C:\Windows\System\fWugVcw.exe
  2⤵
  PID:2820
- C:\Windows\System\kQWeHrS.exe
  C:\Windows\System\kQWeHrS.exe
  2⤵
  PID:1784
- C:\Windows\System\DpmplaJ.exe
  C:\Windows\System\DpmplaJ.exe
  2⤵
  PID:2728
- C:\Windows\System\INnhfOH.exe
  C:\Windows\System\INnhfOH.exe
  2⤵
  PID:1796
- C:\Windows\System\cYNyzqm.exe
  C:\Windows\System\cYNyzqm.exe
  2⤵
  PID:2700
- C:\Windows\System\jEgvIpv.exe
  C:\Windows\System\jEgvIpv.exe
  2⤵
  PID:2732
- C:\Windows\System\BqrfcbF.exe
  C:\Windows\System\BqrfcbF.exe
  2⤵
  PID:2760
- C:\Windows\System\AvXRHQQ.exe
  C:\Windows\System\AvXRHQQ.exe
  2⤵
  PID:2428
- C:\Windows\System\DLQPAKP.exe
  C:\Windows\System\DLQPAKP.exe
  2⤵
  PID:2440
- C:\Windows\System\ahfDTwl.exe
  C:\Windows\System\ahfDTwl.exe
  2⤵
  PID:2464
- C:\Windows\System\DSxiWcS.exe
  C:\Windows\System\DSxiWcS.exe
  2⤵
  PID:1800
- C:\Windows\System\wEyUScb.exe
  C:\Windows\System\wEyUScb.exe
  2⤵
  PID:2600
- C:\Windows\System\dCSxVyH.exe
  C:\Windows\System\dCSxVyH.exe
  2⤵
  PID:2604
- C:\Windows\System\OospnJa.exe
  C:\Windows\System\OospnJa.exe
  2⤵
  PID:2308
- C:\Windows\System\QOylDQW.exe
  C:\Windows\System\QOylDQW.exe
  2⤵
  PID:1936
- C:\Windows\System\WtPuCpO.exe
  C:\Windows\System\WtPuCpO.exe
  2⤵
  PID:2148
- C:\Windows\System\CjAUmYg.exe
  C:\Windows\System\CjAUmYg.exe
  2⤵
  PID:548
- C:\Windows\System\IoJNkcd.exe
  C:\Windows\System\IoJNkcd.exe
  2⤵
  PID:2924
- C:\Windows\System\ynNhskn.exe
  C:\Windows\System\ynNhskn.exe
  2⤵
  PID:2284
- C:\Windows\System\PjrOaUt.exe
  C:\Windows\System\PjrOaUt.exe
  2⤵
  PID:2140
- C:\Windows\System\UNeHKKp.exe
  C:\Windows\System\UNeHKKp.exe
  2⤵
  PID:1480
- C:\Windows\System\eipIgPG.exe
  C:\Windows\System\eipIgPG.exe
  2⤵
  PID:2596
- C:\Windows\System\IQfXEJG.exe
  C:\Windows\System\IQfXEJG.exe
  2⤵
  PID:1728
- C:\Windows\System\OWwyXTX.exe
  C:\Windows\System\OWwyXTX.exe
  2⤵
  PID:1764
- C:\Windows\System\RQWQfnf.exe
  C:\Windows\System\RQWQfnf.exe
  2⤵
  PID:2376
- C:\Windows\System\vbwYcbJ.exe
  C:\Windows\System\vbwYcbJ.exe
  2⤵
  PID:1988
- C:\Windows\System\aNptkpF.exe
  C:\Windows\System\aNptkpF.exe
  2⤵
  PID:684
- C:\Windows\System\pHmGVuH.exe
  C:\Windows\System\pHmGVuH.exe
  2⤵
  PID:2032
- C:\Windows\System\VIEJgVs.exe
  C:\Windows\System\VIEJgVs.exe
  2⤵
  PID:1808
- C:\Windows\System\dwAElHC.exe
  C:\Windows\System\dwAElHC.exe
  2⤵
  PID:924
- C:\Windows\System\KAkdGmT.exe
  C:\Windows\System\KAkdGmT.exe
  2⤵
  PID:1280
- C:\Windows\System\gZDVMQL.exe
  C:\Windows\System\gZDVMQL.exe
  2⤵
  PID:836
- C:\Windows\System\HcgRbFK.exe
  C:\Windows\System\HcgRbFK.exe
  2⤵
  PID:2384
- C:\Windows\System\hxRxrsT.exe
  C:\Windows\System\hxRxrsT.exe
  2⤵
  PID:2152
- C:\Windows\System\VVbEIox.exe
  C:\Windows\System\VVbEIox.exe
  2⤵
  PID:2188
- C:\Windows\System\yVuWlEB.exe
  C:\Windows\System\yVuWlEB.exe
  2⤵
  PID:1792
- C:\Windows\System\NgozLCl.exe
  C:\Windows\System\NgozLCl.exe
  2⤵
  PID:2228
- C:\Windows\System\XKtEYpX.exe
  C:\Windows\System\XKtEYpX.exe
  2⤵
  PID:2088
- C:\Windows\System\jecRhpA.exe
  C:\Windows\System\jecRhpA.exe
  2⤵
  PID:2040
- C:\Windows\System\OBOsxmn.exe
  C:\Windows\System\OBOsxmn.exe
  2⤵
  PID:1704
- C:\Windows\System\ZlRKiqG.exe
  C:\Windows\System\ZlRKiqG.exe
  2⤵
  PID:2884
- C:\Windows\System\FFJbDxo.exe
  C:\Windows\System\FFJbDxo.exe
  2⤵
  PID:2816
- C:\Windows\System\rflxida.exe
  C:\Windows\System\rflxida.exe
  2⤵
  PID:2456
- C:\Windows\System\yjtwbBK.exe
  C:\Windows\System\yjtwbBK.exe
  2⤵
  PID:2588
- C:\Windows\System\klmTkPq.exe
  C:\Windows\System\klmTkPq.exe
  2⤵
  PID:2948
- C:\Windows\System\NIaMShj.exe
  C:\Windows\System\NIaMShj.exe
  2⤵
  PID:2144
- C:\Windows\System\vsqoZPu.exe
  C:\Windows\System\vsqoZPu.exe
  2⤵
  PID:1632
- C:\Windows\System\LbKEpIE.exe
  C:\Windows\System\LbKEpIE.exe
  2⤵
  PID:2812
- C:\Windows\System\xDVQkRg.exe
  C:\Windows\System\xDVQkRg.exe
  2⤵
  PID:1508
- C:\Windows\System\HoDmbTD.exe
  C:\Windows\System\HoDmbTD.exe
  2⤵
  PID:1896
- C:\Windows\System\onLyMBY.exe
  C:\Windows\System\onLyMBY.exe
  2⤵
  PID:1464
- C:\Windows\System\jGoKaUH.exe
  C:\Windows\System\jGoKaUH.exe
  2⤵
  PID:2772
- C:\Windows\System\TzZakrC.exe
  C:\Windows\System\TzZakrC.exe
  2⤵
  PID:3008
- C:\Windows\System\ZUsaejO.exe
  C:\Windows\System\ZUsaejO.exe
  2⤵
  PID:1544
- C:\Windows\System\tsSHwbG.exe
  C:\Windows\System\tsSHwbG.exe
  2⤵
  PID:1540
- C:\Windows\System\KVCZANn.exe
  C:\Windows\System\KVCZANn.exe
  2⤵
  PID:1780
- C:\Windows\System\FQplaxd.exe
  C:\Windows\System\FQplaxd.exe
  2⤵
  PID:2016
- C:\Windows\System\yDsrJDs.exe
  C:\Windows\System\yDsrJDs.exe
  2⤵
  PID:1720
- C:\Windows\System\IuhCWFb.exe
  C:\Windows\System\IuhCWFb.exe
  2⤵
  PID:868
- C:\Windows\System\iAIFijQ.exe
  C:\Windows\System\iAIFijQ.exe
  2⤵
  PID:1588
- C:\Windows\System\aTMKLdK.exe
  C:\Windows\System\aTMKLdK.exe
  2⤵
  PID:1276
- C:\Windows\System\MTYrIyg.exe
  C:\Windows\System\MTYrIyg.exe
  2⤵
  PID:2592
- C:\Windows\System\DciLnje.exe
  C:\Windows\System\DciLnje.exe
  2⤵
  PID:2976
- C:\Windows\System\CGpxRKj.exe
  C:\Windows\System\CGpxRKj.exe
  2⤵
  PID:2336
- C:\Windows\System\qixciEj.exe
  C:\Windows\System\qixciEj.exe
  2⤵
  PID:1524
- C:\Windows\System\bdsRoqL.exe
  C:\Windows\System\bdsRoqL.exe
  2⤵
  PID:1264
- C:\Windows\System\rPeuwEt.exe
  C:\Windows\System\rPeuwEt.exe
  2⤵
  PID:880
- C:\Windows\System\URYIOcC.exe
  C:\Windows\System\URYIOcC.exe
  2⤵
  PID:1608
- C:\Windows\System\MQQHpcm.exe
  C:\Windows\System\MQQHpcm.exe
  2⤵
  PID:700
- C:\Windows\System\dezlqqo.exe
  C:\Windows\System\dezlqqo.exe
  2⤵
  PID:2688
- C:\Windows\System\xCgRLab.exe
  C:\Windows\System\xCgRLab.exe
  2⤵
  PID:1492
- C:\Windows\System\TRLHPUV.exe
  C:\Windows\System\TRLHPUV.exe
  2⤵
  PID:3044
- C:\Windows\System\sAyMcux.exe
  C:\Windows\System\sAyMcux.exe
  2⤵
  PID:2424
- C:\Windows\System\ecQxZwo.exe
  C:\Windows\System\ecQxZwo.exe
  2⤵
  PID:2180
- C:\Windows\System\KSguZKc.exe
  C:\Windows\System\KSguZKc.exe
  2⤵
  PID:1964
- C:\Windows\System\NBJRSmX.exe
  C:\Windows\System\NBJRSmX.exe
  2⤵
  PID:3084
- C:\Windows\System\VSAzPsY.exe
  C:\Windows\System\VSAzPsY.exe
  2⤵
  PID:3100
- C:\Windows\System\sSJJJkf.exe
  C:\Windows\System\sSJJJkf.exe
  2⤵
  PID:3116
- C:\Windows\System\UAtIbAJ.exe
  C:\Windows\System\UAtIbAJ.exe
  2⤵
  PID:3132
- C:\Windows\System\auysmPx.exe
  C:\Windows\System\auysmPx.exe
  2⤵
  PID:3148
- C:\Windows\System\SUbwZDZ.exe
  C:\Windows\System\SUbwZDZ.exe
  2⤵
  PID:3164
- C:\Windows\System\ZFXGgVw.exe
  C:\Windows\System\ZFXGgVw.exe
  2⤵
  PID:3180
- C:\Windows\System\AGqZvNG.exe
  C:\Windows\System\AGqZvNG.exe
  2⤵
  PID:3196
- C:\Windows\System\YWhxIve.exe
  C:\Windows\System\YWhxIve.exe
  2⤵
  PID:3212
- C:\Windows\System\qKOMXgr.exe
  C:\Windows\System\qKOMXgr.exe
  2⤵
  PID:3228
- C:\Windows\System\DvvDNZK.exe
  C:\Windows\System\DvvDNZK.exe
  2⤵
  PID:3244
- C:\Windows\System\vnSPnan.exe
  C:\Windows\System\vnSPnan.exe
  2⤵
  PID:3260
- C:\Windows\System\DVtfeup.exe
  C:\Windows\System\DVtfeup.exe
  2⤵
  PID:3276
- C:\Windows\System\krWFJoq.exe
  C:\Windows\System\krWFJoq.exe
  2⤵
  PID:3292
- C:\Windows\System\Fcrxtvn.exe
  C:\Windows\System\Fcrxtvn.exe
  2⤵
  PID:3308
- C:\Windows\System\mxxXRiA.exe
  C:\Windows\System\mxxXRiA.exe
  2⤵
  PID:3324
- C:\Windows\System\nVlHbTg.exe
  C:\Windows\System\nVlHbTg.exe
  2⤵
  PID:3344
- C:\Windows\System\gSsUiHs.exe
  C:\Windows\System\gSsUiHs.exe
  2⤵
  PID:3360
- C:\Windows\System\zmECTsP.exe
  C:\Windows\System\zmECTsP.exe
  2⤵
  PID:3376
- C:\Windows\System\xlAEBTj.exe
  C:\Windows\System\xlAEBTj.exe
  2⤵
  PID:3392
- C:\Windows\System\tinRScL.exe
  C:\Windows\System\tinRScL.exe
  2⤵
  PID:3408
- C:\Windows\System\RAFiKKR.exe
  C:\Windows\System\RAFiKKR.exe
  2⤵
  PID:3424
- C:\Windows\System\lwuxahU.exe
  C:\Windows\System\lwuxahU.exe
  2⤵
  PID:3440
- C:\Windows\System\IzIVcbI.exe
  C:\Windows\System\IzIVcbI.exe
  2⤵
  PID:3456
- C:\Windows\System\EEDTrGy.exe
  C:\Windows\System\EEDTrGy.exe
  2⤵
  PID:3472
- C:\Windows\System\gIQVFAz.exe
  C:\Windows\System\gIQVFAz.exe
  2⤵
  PID:3488
- C:\Windows\System\NESSqbD.exe
  C:\Windows\System\NESSqbD.exe
  2⤵
  PID:3504
- C:\Windows\System\WrvAFGx.exe
  C:\Windows\System\WrvAFGx.exe
  2⤵
  PID:3520
- C:\Windows\System\wbeuZLC.exe
  C:\Windows\System\wbeuZLC.exe
  2⤵
  PID:3536
- C:\Windows\System\cVAehOx.exe
  C:\Windows\System\cVAehOx.exe
  2⤵
  PID:3552
- C:\Windows\System\QAUxxqN.exe
  C:\Windows\System\QAUxxqN.exe
  2⤵
  PID:3568
- C:\Windows\System\DNYXnrM.exe
  C:\Windows\System\DNYXnrM.exe
  2⤵
  PID:3584
- C:\Windows\System\OgLjgoS.exe
  C:\Windows\System\OgLjgoS.exe
  2⤵
  PID:3600
- C:\Windows\System\tvbTkro.exe
  C:\Windows\System\tvbTkro.exe
  2⤵
  PID:3616
- C:\Windows\System\ZErHuwp.exe
  C:\Windows\System\ZErHuwp.exe
  2⤵
  PID:3632
- C:\Windows\System\NFyCILy.exe
  C:\Windows\System\NFyCILy.exe
  2⤵
  PID:3664
- C:\Windows\System\zNZfjdz.exe
  C:\Windows\System\zNZfjdz.exe
  2⤵
  PID:3732
- C:\Windows\System\twCFQCU.exe
  C:\Windows\System\twCFQCU.exe
  2⤵
  PID:3780
- C:\Windows\System\NPNpQna.exe
  C:\Windows\System\NPNpQna.exe
  2⤵
  PID:3824
- C:\Windows\System\tlyOTTh.exe
  C:\Windows\System\tlyOTTh.exe
  2⤵
  PID:3892
- C:\Windows\System\OXaXGaa.exe
  C:\Windows\System\OXaXGaa.exe
  2⤵
  PID:3708
- C:\Windows\System\NriqRZO.exe
  C:\Windows\System\NriqRZO.exe
  2⤵
  PID:3724
- C:\Windows\System\JqoSHft.exe
  C:\Windows\System\JqoSHft.exe
  2⤵
  PID:2784
- C:\Windows\System\UlfgIlZ.exe
  C:\Windows\System\UlfgIlZ.exe
  2⤵
  PID:3820
- C:\Windows\System\uMoeSqM.exe
  C:\Windows\System\uMoeSqM.exe
  2⤵
  PID:2436
- C:\Windows\System\FqFWsKm.exe
  C:\Windows\System\FqFWsKm.exe
  2⤵
  PID:3128
- C:\Windows\System\vPFwykc.exe
  C:\Windows\System\vPFwykc.exe
  2⤵
  PID:3192
- C:\Windows\System\tnUixFG.exe
  C:\Windows\System\tnUixFG.exe
  2⤵
  PID:1932
- C:\Windows\System\ArqnReF.exe
  C:\Windows\System\ArqnReF.exe
  2⤵
  PID:3284
- C:\Windows\System\DHkrDmP.exe
  C:\Windows\System\DHkrDmP.exe
  2⤵
  PID:3352
- C:\Windows\System\MvthErK.exe
  C:\Windows\System\MvthErK.exe
  2⤵
  PID:3416
- C:\Windows\System\rDruQzg.exe
  C:\Windows\System\rDruQzg.exe
  2⤵
  PID:3612
- C:\Windows\System\gYUyxVL.exe
  C:\Windows\System\gYUyxVL.exe
  2⤵
  PID:3652
- C:\Windows\System\hfAfubW.exe
  C:\Windows\System\hfAfubW.exe
  2⤵
  PID:1192
- C:\Windows\System\EGkzxmJ.exe
  C:\Windows\System\EGkzxmJ.exe
  2⤵
  PID:3968
- C:\Windows\System\wAVnfzD.exe
  C:\Windows\System\wAVnfzD.exe
  2⤵
  PID:3984
- C:\Windows\System\HzdwjhM.exe
  C:\Windows\System\HzdwjhM.exe
  2⤵
  PID:4000
- C:\Windows\System\CHhVWni.exe
  C:\Windows\System\CHhVWni.exe
  2⤵
  PID:4016
- C:\Windows\System\WRnsMRf.exe
  C:\Windows\System\WRnsMRf.exe
  2⤵
  PID:2300
- C:\Windows\System\QMBiIMU.exe
  C:\Windows\System\QMBiIMU.exe
  2⤵
  PID:588
- C:\Windows\System\oXFprSS.exe
  C:\Windows\System\oXFprSS.exe
  2⤵
  PID:620
- C:\Windows\System\BvefuqO.exe
  C:\Windows\System\BvefuqO.exe
  2⤵
  PID:2496
- C:\Windows\System\rMZoTiU.exe
  C:\Windows\System\rMZoTiU.exe
  2⤵
  PID:1188
- C:\Windows\System\KhFSYOT.exe
  C:\Windows\System\KhFSYOT.exe
  2⤵
  PID:2100
- C:\Windows\System\eGJxAHj.exe
  C:\Windows\System\eGJxAHj.exe
  2⤵
  PID:3080
- C:\Windows\System\DhNyVCm.exe
  C:\Windows\System\DhNyVCm.exe
  2⤵
  PID:3172
- C:\Windows\System\lJHHgin.exe
  C:\Windows\System\lJHHgin.exe
  2⤵
  PID:1676
- C:\Windows\System\VotexHW.exe
  C:\Windows\System\VotexHW.exe
  2⤵
  PID:3236
- C:\Windows\System\bKcaSGE.exe
  C:\Windows\System\bKcaSGE.exe
  2⤵
  PID:3332
- C:\Windows\System\dvbSuiE.exe
  C:\Windows\System\dvbSuiE.exe
  2⤵
  PID:3400
- C:\Windows\System\HVMDbMC.exe
  C:\Windows\System\HVMDbMC.exe
  2⤵
  PID:3468
- C:\Windows\System\rkTdFzN.exe
  C:\Windows\System\rkTdFzN.exe
  2⤵
  PID:3564
- C:\Windows\System\xJvGrBK.exe
  C:\Windows\System\xJvGrBK.exe
  2⤵
  PID:3628
- C:\Windows\System\TaFlbPR.exe
  C:\Windows\System\TaFlbPR.exe
  2⤵
  PID:2616
- C:\Windows\System\DiBUTjE.exe
  C:\Windows\System\DiBUTjE.exe
  2⤵
  PID:3676
- C:\Windows\System\GABhPSG.exe
  C:\Windows\System\GABhPSG.exe
  2⤵
  PID:476
- C:\Windows\System\eXcQQnI.exe
  C:\Windows\System\eXcQQnI.exe
  2⤵
  PID:2408
- C:\Windows\System\ioSkRNA.exe
  C:\Windows\System\ioSkRNA.exe
  2⤵
  PID:3720
- C:\Windows\System\RQlPqsl.exe
  C:\Windows\System\RQlPqsl.exe
  2⤵
  PID:3252
- C:\Windows\System\kIvNSdU.exe
  C:\Windows\System\kIvNSdU.exe
  2⤵
  PID:3096
- C:\Windows\System\kNVSXEk.exe
  C:\Windows\System\kNVSXEk.exe
  2⤵
  PID:2620
- C:\Windows\System\hPbzMqh.exe
  C:\Windows\System\hPbzMqh.exe
  2⤵
  PID:3316
- C:\Windows\System\VBpDjBO.exe
  C:\Windows\System\VBpDjBO.exe
  2⤵
  PID:2348
- C:\Windows\System\LbNLZvN.exe
  C:\Windows\System\LbNLZvN.exe
  2⤵
  PID:3792
- C:\Windows\System\DVSVACj.exe
  C:\Windows\System\DVSVACj.exe
  2⤵
  PID:3516
- C:\Windows\System\ManiaaP.exe
  C:\Windows\System\ManiaaP.exe
  2⤵
  PID:3452
- C:\Windows\System\bqtGFYK.exe
  C:\Windows\System\bqtGFYK.exe
  2⤵
  PID:3752
- C:\Windows\System\zLsuLnA.exe
  C:\Windows\System\zLsuLnA.exe
  2⤵
  PID:3768
- C:\Windows\System\JcImqye.exe
  C:\Windows\System\JcImqye.exe
  2⤵
  PID:892
- C:\Windows\System\FHWSKwC.exe
  C:\Windows\System\FHWSKwC.exe
  2⤵
  PID:2400
- C:\Windows\System\aQJXZwp.exe
  C:\Windows\System\aQJXZwp.exe
  2⤵
  PID:532
- C:\Windows\System\KZnqXxF.exe
  C:\Windows\System\KZnqXxF.exe
  2⤵
  PID:2508
- C:\Windows\System\vspYsdB.exe
  C:\Windows\System\vspYsdB.exe
  2⤵
  PID:3796
- C:\Windows\System\mWjQltf.exe
  C:\Windows\System\mWjQltf.exe
  2⤵
  PID:3960
- C:\Windows\System\UbygbxX.exe
  C:\Windows\System\UbygbxX.exe
  2⤵
  PID:3948
- C:\Windows\System\cpdwcdP.exe
  C:\Windows\System\cpdwcdP.exe
  2⤵
  PID:3952
- C:\Windows\System\bvFAnuN.exe
  C:\Windows\System\bvFAnuN.exe
  2⤵
  PID:3964
- C:\Windows\System\sUDYYhe.exe
  C:\Windows\System\sUDYYhe.exe
  2⤵
  PID:3996
- C:\Windows\System\BJxwEBy.exe
  C:\Windows\System\BJxwEBy.exe
  2⤵
  PID:4048
- C:\Windows\System\nvaHpWM.exe
  C:\Windows\System\nvaHpWM.exe
  2⤵
  PID:1604
- C:\Windows\System\hrGDdPH.exe
  C:\Windows\System\hrGDdPH.exe
  2⤵
  PID:4068
- C:\Windows\System\kbkACeq.exe
  C:\Windows\System\kbkACeq.exe
  2⤵
  PID:4084
- C:\Windows\System\kMpYFkB.exe
  C:\Windows\System\kMpYFkB.exe
  2⤵
  PID:1744
- C:\Windows\System\zvweNGj.exe
  C:\Windows\System\zvweNGj.exe
  2⤵
  PID:4092
- C:\Windows\System\ldQzsbv.exe
  C:\Windows\System\ldQzsbv.exe
  2⤵
  PID:1776
- C:\Windows\System\UbKPRpv.exe
  C:\Windows\System\UbKPRpv.exe
  2⤵
  PID:2888
- C:\Windows\System\txlQaRy.exe
  C:\Windows\System\txlQaRy.exe
  2⤵
  PID:3144
- C:\Windows\System\CaknxXE.exe
  C:\Windows\System\CaknxXE.exe
  2⤵
  PID:296
- C:\Windows\System\QdxYYDq.exe
  C:\Windows\System\QdxYYDq.exe
  2⤵
  PID:3300
- C:\Windows\System\yxKYaFx.exe
  C:\Windows\System\yxKYaFx.exe
  2⤵
  PID:3372
- C:\Windows\System\eiMKaRt.exe
  C:\Windows\System\eiMKaRt.exe
  2⤵
  PID:3464
- C:\Windows\System\bvSmcur.exe
  C:\Windows\System\bvSmcur.exe
  2⤵
  PID:3528
- C:\Windows\System\JzgcFUI.exe
  C:\Windows\System\JzgcFUI.exe
  2⤵
  PID:2552
- C:\Windows\System\MBfgKXs.exe
  C:\Windows\System\MBfgKXs.exe
  2⤵
  PID:1612
- C:\Windows\System\bgeELPi.exe
  C:\Windows\System\bgeELPi.exe
  2⤵
  PID:3688
- C:\Windows\System\DUAjDTI.exe
  C:\Windows\System\DUAjDTI.exe
  2⤵
  PID:3700
- C:\Windows\System\TJmoJtc.exe
  C:\Windows\System\TJmoJtc.exe
  2⤵
  PID:2008
- C:\Windows\System\vpILiUr.exe
  C:\Windows\System\vpILiUr.exe
  2⤵
  PID:3188
- C:\Windows\System\HhHGWnX.exe
  C:\Windows\System\HhHGWnX.exe
  2⤵
  PID:3388
- C:\Windows\System\etSoiDN.exe
  C:\Windows\System\etSoiDN.exe
  2⤵
  PID:3844
- C:\Windows\System\iRuyxpF.exe
  C:\Windows\System\iRuyxpF.exe
  2⤵
  PID:3812
- C:\Windows\System\hesSgwf.exe
  C:\Windows\System\hesSgwf.exe
  2⤵
  PID:3788
- C:\Windows\System\QZEutDt.exe
  C:\Windows\System\QZEutDt.exe
  2⤵
  PID:3548
- C:\Windows\System\nvrIyly.exe
  C:\Windows\System\nvrIyly.exe
  2⤵
  PID:3744
- C:\Windows\System\yfNPCEo.exe
  C:\Windows\System\yfNPCEo.exe
  2⤵
  PID:3756
- C:\Windows\System\BGZsqMx.exe
  C:\Windows\System\BGZsqMx.exe
  2⤵
  PID:3832
- C:\Windows\System\WucOZpA.exe
  C:\Windows\System\WucOZpA.exe
  2⤵
  PID:4028
- C:\Windows\System\dbduiri.exe
  C:\Windows\System\dbduiri.exe
  2⤵
  PID:4104
- C:\Windows\System\atubcfl.exe
  C:\Windows\System\atubcfl.exe
  2⤵
  PID:4120
- C:\Windows\System\WocFyCB.exe
  C:\Windows\System\WocFyCB.exe
  2⤵
  PID:4136
- C:\Windows\System\HUGbxHl.exe
  C:\Windows\System\HUGbxHl.exe
  2⤵
  PID:4152
- C:\Windows\System\BxZugOt.exe
  C:\Windows\System\BxZugOt.exe
  2⤵
  PID:4276
- C:\Windows\System\eFZcSTY.exe
  C:\Windows\System\eFZcSTY.exe
  2⤵
  PID:4292
- C:\Windows\System\IifeknK.exe
  C:\Windows\System\IifeknK.exe
  2⤵
  PID:4308
- C:\Windows\System\zAXwqXq.exe
  C:\Windows\System\zAXwqXq.exe
  2⤵
  PID:4324
- C:\Windows\System\lWVOqPR.exe
  C:\Windows\System\lWVOqPR.exe
  2⤵
  PID:4340
- C:\Windows\System\WWuwIac.exe
  C:\Windows\System\WWuwIac.exe
  2⤵
  PID:4356
- C:\Windows\System\gRmlvXg.exe
  C:\Windows\System\gRmlvXg.exe
  2⤵
  PID:4372
- C:\Windows\System\TxcDGjd.exe
  C:\Windows\System\TxcDGjd.exe
  2⤵
  PID:4388
- C:\Windows\System\wvFdpVP.exe
  C:\Windows\System\wvFdpVP.exe
  2⤵
  PID:4404
- C:\Windows\System\bQaRWNc.exe
  C:\Windows\System\bQaRWNc.exe
  2⤵
  PID:4420
- C:\Windows\System\AyzmHAZ.exe
  C:\Windows\System\AyzmHAZ.exe
  2⤵
  PID:4440
- C:\Windows\System\GnxBnHP.exe
  C:\Windows\System\GnxBnHP.exe
  2⤵
  PID:4460
- C:\Windows\System\fmwrigl.exe
  C:\Windows\System\fmwrigl.exe
  2⤵
  PID:4476
- C:\Windows\System\BVecAHX.exe
  C:\Windows\System\BVecAHX.exe
  2⤵
  PID:4492
- C:\Windows\System\QLZqWSf.exe
  C:\Windows\System\QLZqWSf.exe
  2⤵
  PID:4512
- C:\Windows\System\eVbRUtc.exe
  C:\Windows\System\eVbRUtc.exe
  2⤵
  PID:4528
- C:\Windows\System\RSfXzOH.exe
  C:\Windows\System\RSfXzOH.exe
  2⤵
  PID:4544
- C:\Windows\System\roXJWxV.exe
  C:\Windows\System\roXJWxV.exe
  2⤵
  PID:4560
- C:\Windows\System\OtlLvFf.exe
  C:\Windows\System\OtlLvFf.exe
  2⤵
  PID:4576
- C:\Windows\System\LDovEft.exe
  C:\Windows\System\LDovEft.exe
  2⤵
  PID:4592
- C:\Windows\System\RbePVjY.exe
  C:\Windows\System\RbePVjY.exe
  2⤵
  PID:4724
- C:\Windows\System\yRuYTus.exe
  C:\Windows\System\yRuYTus.exe
  2⤵
  PID:4740
- C:\Windows\System\PBfAvCB.exe
  C:\Windows\System\PBfAvCB.exe
  2⤵
  PID:4800
- C:\Windows\System\vZMFSgX.exe
  C:\Windows\System\vZMFSgX.exe
  2⤵
  PID:4820
- C:\Windows\System\FhnWuEf.exe
  C:\Windows\System\FhnWuEf.exe
  2⤵
  PID:4840
- C:\Windows\System\pMnyfMt.exe
  C:\Windows\System\pMnyfMt.exe
  2⤵
  PID:4856
- C:\Windows\System\dssoXbD.exe
  C:\Windows\System\dssoXbD.exe
  2⤵
  PID:4872
- C:\Windows\System\SQOXgUG.exe
  C:\Windows\System\SQOXgUG.exe
  2⤵
  PID:4888
- C:\Windows\System\zpQDIJv.exe
  C:\Windows\System\zpQDIJv.exe
  2⤵
  PID:4904
- C:\Windows\System\jOgbooy.exe
  C:\Windows\System\jOgbooy.exe
  2⤵
  PID:4920
- C:\Windows\System\soStrjR.exe
  C:\Windows\System\soStrjR.exe
  2⤵
  PID:4940
- C:\Windows\System\kTMYkCC.exe
  C:\Windows\System\kTMYkCC.exe
  2⤵
  PID:4956
- C:\Windows\System\VWGyfAJ.exe
  C:\Windows\System\VWGyfAJ.exe
  2⤵
  PID:4980
- C:\Windows\System\VXyfSOv.exe
  C:\Windows\System\VXyfSOv.exe
  2⤵
  PID:5000
- C:\Windows\System\HnDNZJb.exe
  C:\Windows\System\HnDNZJb.exe
  2⤵
  PID:5016
- C:\Windows\System\dBoTNWR.exe
  C:\Windows\System\dBoTNWR.exe
  2⤵
  PID:5032
- C:\Windows\System\LMQHKCB.exe
  C:\Windows\System\LMQHKCB.exe
  2⤵
  PID:5052
- C:\Windows\System\kRQdMUf.exe
  C:\Windows\System\kRQdMUf.exe
  2⤵
  PID:5068
- C:\Windows\System\AtdINlQ.exe
  C:\Windows\System\AtdINlQ.exe
  2⤵
  PID:5084
- C:\Windows\System\BViFXDq.exe
  C:\Windows\System\BViFXDq.exe
  2⤵
  PID:5100
- C:\Windows\System\UpnYrXh.exe
  C:\Windows\System\UpnYrXh.exe
  2⤵
  PID:3764
- C:\Windows\System\MuVlSFc.exe
  C:\Windows\System\MuVlSFc.exe
  2⤵
  PID:3912
- C:\Windows\System\mibNLIA.exe
  C:\Windows\System\mibNLIA.exe
  2⤵
  PID:3936
- C:\Windows\System\qFurHYK.exe
  C:\Windows\System\qFurHYK.exe
  2⤵
  PID:3992
- C:\Windows\System\oHmeaoz.exe
  C:\Windows\System\oHmeaoz.exe
  2⤵
  PID:4076
- C:\Windows\System\yHTuHpy.exe
  C:\Windows\System\yHTuHpy.exe
  2⤵
  PID:3704
- C:\Windows\System\gvctiSe.exe
  C:\Windows\System\gvctiSe.exe
  2⤵
  PID:1692
- C:\Windows\System\SLkOrfZ.exe
  C:\Windows\System\SLkOrfZ.exe
  2⤵
  PID:2824
- C:\Windows\System\jhaOcFq.exe
  C:\Windows\System\jhaOcFq.exe
  2⤵
  PID:4128
- C:\Windows\System\oizakCd.exe
  C:\Windows\System\oizakCd.exe
  2⤵
  PID:2468
- C:\Windows\System\AstuJtz.exe
  C:\Windows\System\AstuJtz.exe
  2⤵
  PID:2540
- C:\Windows\System\XcEFbRi.exe
  C:\Windows\System\XcEFbRi.exe
  2⤵
  PID:3624
- C:\Windows\System\jshOUEv.exe
  C:\Windows\System\jshOUEv.exe
  2⤵
  PID:3224
- C:\Windows\System\xRtrtVF.exe
  C:\Windows\System\xRtrtVF.exe
  2⤵
  PID:3924
- C:\Windows\System\ODWkduM.exe
  C:\Windows\System\ODWkduM.exe
  2⤵
  PID:3848
- C:\Windows\System\obpirVu.exe
  C:\Windows\System\obpirVu.exe
  2⤵
  PID:4144
- C:\Windows\System\GzeZSCg.exe
  C:\Windows\System\GzeZSCg.exe
  2⤵
  PID:4176
- C:\Windows\System\OmAdgkm.exe
  C:\Windows\System\OmAdgkm.exe
  2⤵
  PID:4316
- C:\Windows\System\RXSHLGf.exe
  C:\Windows\System\RXSHLGf.exe
  2⤵
  PID:4196
- C:\Windows\System\bDNFehB.exe
  C:\Windows\System\bDNFehB.exe
  2⤵
  PID:4224
- C:\Windows\System\cUouUea.exe
  C:\Windows\System\cUouUea.exe
  2⤵
  PID:4240
- C:\Windows\System\yqzLaKZ.exe
  C:\Windows\System\yqzLaKZ.exe
  2⤵
  PID:4256
- C:\Windows\System\nVREfAc.exe
  C:\Windows\System\nVREfAc.exe
  2⤵
  PID:4164
- C:\Windows\System\UlRuPfx.exe
  C:\Windows\System\UlRuPfx.exe
  2⤵
  PID:4364
- C:\Windows\System\kXmsZPL.exe
  C:\Windows\System\kXmsZPL.exe
  2⤵
  PID:4520
- C:\Windows\System\GvAmVhp.exe
  C:\Windows\System\GvAmVhp.exe
  2⤵
  PID:4432
- C:\Windows\System\LfMUIAW.exe
  C:\Windows\System\LfMUIAW.exe
  2⤵
  PID:4588
- C:\Windows\System\lriZMYi.exe
  C:\Windows\System\lriZMYi.exe
  2⤵
  PID:4508
- C:\Windows\System\jaPaobm.exe
  C:\Windows\System\jaPaobm.exe
  2⤵
  PID:4600
- C:\Windows\System\TERpuWi.exe
  C:\Windows\System\TERpuWi.exe
  2⤵
  PID:4632
- C:\Windows\System\gLGuzAQ.exe
  C:\Windows\System\gLGuzAQ.exe
  2⤵
  PID:4644
- C:\Windows\System\HOLtQWk.exe
  C:\Windows\System\HOLtQWk.exe
  2⤵
  PID:4664
- C:\Windows\System\OyOUAvo.exe
  C:\Windows\System\OyOUAvo.exe
  2⤵
  PID:4680
- C:\Windows\System\ygnTvUp.exe
  C:\Windows\System\ygnTvUp.exe
  2⤵
  PID:4696
- C:\Windows\System\qBJaSyx.exe
  C:\Windows\System\qBJaSyx.exe
  2⤵
  PID:4712
- C:\Windows\System\RxBubOr.exe
  C:\Windows\System\RxBubOr.exe
  2⤵
  PID:4772
- C:\Windows\System\trLdvkK.exe
  C:\Windows\System\trLdvkK.exe
  2⤵
  PID:4756
- C:\Windows\System\uSvzTqQ.exe
  C:\Windows\System\uSvzTqQ.exe
  2⤵
  PID:4780
- C:\Windows\System\UmmRjUl.exe
  C:\Windows\System\UmmRjUl.exe
  2⤵
  PID:4808
- C:\Windows\System\TatGTQg.exe
  C:\Windows\System\TatGTQg.exe
  2⤵
  PID:4848
- C:\Windows\System\ayZJCoa.exe
  C:\Windows\System\ayZJCoa.exe
  2⤵
  PID:4896
- C:\Windows\System\BSHVLlO.exe
  C:\Windows\System\BSHVLlO.exe
  2⤵
  PID:4932
- C:\Windows\System\rJwbDku.exe
  C:\Windows\System\rJwbDku.exe
  2⤵
  PID:4976
- C:\Windows\System\IQEACkM.exe
  C:\Windows\System\IQEACkM.exe
  2⤵
  PID:4912
- C:\Windows\System\knjhzJZ.exe
  C:\Windows\System\knjhzJZ.exe
  2⤵
  PID:4952
- C:\Windows\System\OgRPKRQ.exe
  C:\Windows\System\OgRPKRQ.exe
  2⤵
  PID:3740
- C:\Windows\System\LyuOYMB.exe
  C:\Windows\System\LyuOYMB.exe
  2⤵
  PID:5080
- C:\Windows\System\HrfOBXr.exe
  C:\Windows\System\HrfOBXr.exe
  2⤵
  PID:5040
- C:\Windows\System\LBUjXKo.exe
  C:\Windows\System\LBUjXKo.exe
  2⤵
  PID:2104
- C:\Windows\System\XvMcdoe.exe
  C:\Windows\System\XvMcdoe.exe
  2⤵
  PID:2096
- C:\Windows\System\ObEKHgC.exe
  C:\Windows\System\ObEKHgC.exe
  2⤵
  PID:2696
- C:\Windows\System\aNNWhdO.exe
  C:\Windows\System\aNNWhdO.exe
  2⤵
  PID:3576
- C:\Windows\System\YkOpYaj.exe
  C:\Windows\System\YkOpYaj.exe
  2⤵
  PID:4100
- C:\Windows\System\WnrEKAW.exe
  C:\Windows\System\WnrEKAW.exe
  2⤵
  PID:3268
- C:\Windows\System\KrvvCXt.exe
  C:\Windows\System\KrvvCXt.exe
  2⤵
  PID:3684
- C:\Windows\System\yiEdBGM.exe
  C:\Windows\System\yiEdBGM.exe
  2⤵
  PID:4172
- C:\Windows\System\GLcnTdU.exe
  C:\Windows\System\GLcnTdU.exe
  2⤵
  PID:4188
- C:\Windows\System\OTQfjOA.exe
  C:\Windows\System\OTQfjOA.exe
  2⤵
  PID:4184
- C:\Windows\System\RIKgSkj.exe
  C:\Windows\System\RIKgSkj.exe
  2⤵
  PID:4412
- C:\Windows\System\PpZCWtF.exe
  C:\Windows\System\PpZCWtF.exe
  2⤵
  PID:4192
- C:\Windows\System\JEibjfk.exe
  C:\Windows\System\JEibjfk.exe
  2⤵
  PID:4264
- C:\Windows\System\yJDxdEV.exe
  C:\Windows\System\yJDxdEV.exe
  2⤵
  PID:4332
- C:\Windows\System\DDKlhXS.exe
  C:\Windows\System\DDKlhXS.exe
  2⤵
  PID:4552
- C:\Windows\System\ILfzJgB.exe
  C:\Windows\System\ILfzJgB.exe
  2⤵
  PID:4568
- C:\Windows\System\lZqkoPo.exe
  C:\Windows\System\lZqkoPo.exe
  2⤵
  PID:4624
- C:\Windows\System\RyPerlr.exe
  C:\Windows\System\RyPerlr.exe
  2⤵
  PID:4656
- C:\Windows\System\iLhIdWI.exe
  C:\Windows\System\iLhIdWI.exe
  2⤵
  PID:5048
- C:\Windows\System\AHSRfMH.exe
  C:\Windows\System\AHSRfMH.exe
  2⤵
  PID:4868
- C:\Windows\System\WxkCoDV.exe
  C:\Windows\System\WxkCoDV.exe
  2⤵
  PID:5112
- C:\Windows\System\epjPvWq.exe
  C:\Windows\System\epjPvWq.exe
  2⤵
  PID:4796
- C:\Windows\System\xQXKZCZ.exe
  C:\Windows\System\xQXKZCZ.exe
  2⤵
  PID:5028
- C:\Windows\System\JequAJz.exe
  C:\Windows\System\JequAJz.exe
  2⤵
  PID:5092
- C:\Windows\System\CwYUiTD.exe
  C:\Windows\System\CwYUiTD.exe
  2⤵
  PID:2944
- C:\Windows\System\TxWEvNk.exe
  C:\Windows\System\TxWEvNk.exe
  2⤵
  PID:3272
- C:\Windows\System\eBGDZZB.exe
  C:\Windows\System\eBGDZZB.exe
  2⤵
  PID:2056
- C:\Windows\System\hyUUjUJ.exe
  C:\Windows\System\hyUUjUJ.exe
  2⤵
  PID:3816
- C:\Windows\System\NjQLOqX.exe
  C:\Windows\System\NjQLOqX.exe
  2⤵
  PID:3156
- C:\Windows\System\jacRjTT.exe
  C:\Windows\System\jacRjTT.exe
  2⤵
  PID:4208
- C:\Windows\System\VwvmJwe.exe
  C:\Windows\System\VwvmJwe.exe
  2⤵
  PID:4380
- C:\Windows\System\dZLYaqF.exe
  C:\Windows\System\dZLYaqF.exe
  2⤵
  PID:4236
- C:\Windows\System\twlAYFg.exe
  C:\Windows\System\twlAYFg.exe
  2⤵
  PID:4400
- C:\Windows\System\cNOIiFh.exe
  C:\Windows\System\cNOIiFh.exe
  2⤵
  PID:4652
- C:\Windows\System\lxzpZmL.exe
  C:\Windows\System\lxzpZmL.exe
  2⤵
  PID:4640
- C:\Windows\System\NvFEHrn.exe
  C:\Windows\System\NvFEHrn.exe
  2⤵
  PID:4456
- C:\Windows\System\SgeqKpm.exe
  C:\Windows\System\SgeqKpm.exe
  2⤵
  PID:4716
- C:\Windows\System\JnltJwg.exe
  C:\Windows\System\JnltJwg.exe
  2⤵
  PID:4080
- C:\Windows\System\COucYKI.exe
  C:\Windows\System\COucYKI.exe
  2⤵
  PID:4748
- C:\Windows\System\UvIiTnp.exe
  C:\Windows\System\UvIiTnp.exe
  2⤵
  PID:4660
- C:\Windows\System\jOzrkMs.exe
  C:\Windows\System\jOzrkMs.exe
  2⤵
  PID:2240
- C:\Windows\System\Zwaogju.exe
  C:\Windows\System\Zwaogju.exe
  2⤵
  PID:4936
- C:\Windows\System\xsNliwJ.exe
  C:\Windows\System\xsNliwJ.exe
  2⤵
  PID:4812
- C:\Windows\System\AwWKmpO.exe
  C:\Windows\System\AwWKmpO.exe
  2⤵
  PID:4288
- C:\Windows\System\MRLmRBY.exe
  C:\Windows\System\MRLmRBY.exe
  2⤵
  PID:4540
- C:\Windows\System\bHeVWlF.exe
  C:\Windows\System\bHeVWlF.exe
  2⤵
  PID:4488
- C:\Windows\System\tJdnzCo.exe
  C:\Windows\System\tJdnzCo.exe
  2⤵
  PID:4792
- C:\Windows\System\yIzQvVy.exe
  C:\Windows\System\yIzQvVy.exe
  2⤵
  PID:4884
- C:\Windows\System\jqjMuQG.exe
  C:\Windows\System\jqjMuQG.exe
  2⤵
  PID:4972
- C:\Windows\System\isfYBki.exe
  C:\Windows\System\isfYBki.exe
  2⤵
  PID:3748
- C:\Windows\System\YhHzbcH.exe
  C:\Windows\System\YhHzbcH.exe
  2⤵
  PID:4996
- C:\Windows\System\KWHMarv.exe
  C:\Windows\System\KWHMarv.exe
  2⤵
  PID:3648
- C:\Windows\System\bvVwSmk.exe
  C:\Windows\System\bvVwSmk.exe
  2⤵
  PID:3432
- C:\Windows\System\WthRQMs.exe
  C:\Windows\System\WthRQMs.exe
  2⤵
  PID:4448
- C:\Windows\System\iRVojiR.exe
  C:\Windows\System\iRVojiR.exe
  2⤵
  PID:2288
- C:\Windows\System\jIgVDiv.exe
  C:\Windows\System\jIgVDiv.exe
  2⤵
  PID:4864
- C:\Windows\System\fTnObqx.exe
  C:\Windows\System\fTnObqx.exe
  2⤵
  PID:5124
- C:\Windows\System\BzFBMaB.exe
  C:\Windows\System\BzFBMaB.exe
  2⤵
  PID:5140
- C:\Windows\System\IGPtICI.exe
  C:\Windows\System\IGPtICI.exe
  2⤵
  PID:5160
- C:\Windows\System\KLspQyD.exe
  C:\Windows\System\KLspQyD.exe
  2⤵
  PID:5176
- C:\Windows\System\BBrmtMn.exe
  C:\Windows\System\BBrmtMn.exe
  2⤵
  PID:5192
- C:\Windows\System\WXwlvDg.exe
  C:\Windows\System\WXwlvDg.exe
  2⤵
  PID:5208
- C:\Windows\System\EWdIQfN.exe
  C:\Windows\System\EWdIQfN.exe
  2⤵
  PID:5224
- C:\Windows\System\YmDhSpd.exe
  C:\Windows\System\YmDhSpd.exe
  2⤵
  PID:5240
- C:\Windows\System\mjJvujg.exe
  C:\Windows\System\mjJvujg.exe
  2⤵
  PID:5260
- C:\Windows\System\EhPPDKn.exe
  C:\Windows\System\EhPPDKn.exe
  2⤵
  PID:5276
- C:\Windows\System\YTirNgI.exe
  C:\Windows\System\YTirNgI.exe
  2⤵
  PID:5292
- C:\Windows\System\bRWVyHi.exe
  C:\Windows\System\bRWVyHi.exe
  2⤵
  PID:5308
- C:\Windows\System\CqXbfsk.exe
  C:\Windows\System\CqXbfsk.exe
  2⤵
  PID:5324
- C:\Windows\System\mxPbakR.exe
  C:\Windows\System\mxPbakR.exe
  2⤵
  PID:5344
- C:\Windows\System\lJLYtol.exe
  C:\Windows\System\lJLYtol.exe
  2⤵
  PID:5360
- C:\Windows\System\dvclchw.exe
  C:\Windows\System\dvclchw.exe
  2⤵
  PID:5376
- C:\Windows\System\fsNuYxT.exe
  C:\Windows\System\fsNuYxT.exe
  2⤵
  PID:5392
- C:\Windows\System\xihEEwW.exe
  C:\Windows\System\xihEEwW.exe
  2⤵
  PID:5408
- C:\Windows\System\vTeCIJh.exe
  C:\Windows\System\vTeCIJh.exe
  2⤵
  PID:5424
- C:\Windows\System\kstdhBW.exe
  C:\Windows\System\kstdhBW.exe
  2⤵
  PID:5440
- C:\Windows\System\wHwgAJA.exe
  C:\Windows\System\wHwgAJA.exe
  2⤵
  PID:5456
- C:\Windows\System\YTIXsKK.exe
  C:\Windows\System\YTIXsKK.exe
  2⤵
  PID:5476
- C:\Windows\System\aYCCEph.exe
  C:\Windows\System\aYCCEph.exe
  2⤵
  PID:5492
- C:\Windows\System\YlGgBMS.exe
  C:\Windows\System\YlGgBMS.exe
  2⤵
  PID:5508
- C:\Windows\System\PKixOSG.exe
  C:\Windows\System\PKixOSG.exe
  2⤵
  PID:5524
- C:\Windows\System\kNLkIqS.exe
  C:\Windows\System\kNLkIqS.exe
  2⤵
  PID:5540
- C:\Windows\System\VmPFtLQ.exe
  C:\Windows\System\VmPFtLQ.exe
  2⤵
  PID:5556
- C:\Windows\System\kXxbKlN.exe
  C:\Windows\System\kXxbKlN.exe
  2⤵
  PID:5572
- C:\Windows\System\FnKaRrf.exe
  C:\Windows\System\FnKaRrf.exe
  2⤵
  PID:5588
- C:\Windows\System\mQbZIxF.exe
  C:\Windows\System\mQbZIxF.exe
  2⤵
  PID:5608
- C:\Windows\System\MwmnzzI.exe
  C:\Windows\System\MwmnzzI.exe
  2⤵
  PID:5624
- C:\Windows\System\DTmwovY.exe
  C:\Windows\System\DTmwovY.exe
  2⤵
  PID:5640
- C:\Windows\System\pInzyEL.exe
  C:\Windows\System\pInzyEL.exe
  2⤵
  PID:5656
- C:\Windows\System\DQkLOQO.exe
  C:\Windows\System\DQkLOQO.exe
  2⤵
  PID:5792
- C:\Windows\System\vmIBzFy.exe
  C:\Windows\System\vmIBzFy.exe
  2⤵
  PID:5808
- C:\Windows\System\YTjAKRu.exe
  C:\Windows\System\YTjAKRu.exe
  2⤵
  PID:5824
- C:\Windows\System\chNtQaq.exe
  C:\Windows\System\chNtQaq.exe
  2⤵
  PID:5844
- C:\Windows\System\pYvueNY.exe
  C:\Windows\System\pYvueNY.exe
  2⤵
  PID:5860
- C:\Windows\System\RHjsJgN.exe
  C:\Windows\System\RHjsJgN.exe
  2⤵
  PID:5880
- C:\Windows\System\oJlEnOb.exe
  C:\Windows\System\oJlEnOb.exe
  2⤵
  PID:5904
- C:\Windows\System\TORFzgb.exe
  C:\Windows\System\TORFzgb.exe
  2⤵
  PID:5920
- C:\Windows\System\bvySgnR.exe
  C:\Windows\System\bvySgnR.exe
  2⤵
  PID:5936
- C:\Windows\System\cEhwRei.exe
  C:\Windows\System\cEhwRei.exe
  2⤵
  PID:5952
- C:\Windows\System\RfkXPFW.exe
  C:\Windows\System\RfkXPFW.exe
  2⤵
  PID:5968
- C:\Windows\System\NoeHThs.exe
  C:\Windows\System\NoeHThs.exe
  2⤵
  PID:5984
- C:\Windows\System\kNHRudi.exe
  C:\Windows\System\kNHRudi.exe
  2⤵
  PID:6000
- C:\Windows\System\autHZRs.exe
  C:\Windows\System\autHZRs.exe
  2⤵
  PID:6016
- C:\Windows\System\IGtJJFT.exe
  C:\Windows\System\IGtJJFT.exe
  2⤵
  PID:6032
- C:\Windows\System\GGqmsfA.exe
  C:\Windows\System\GGqmsfA.exe
  2⤵
  PID:6048
- C:\Windows\System\cIyGPPw.exe
  C:\Windows\System\cIyGPPw.exe
  2⤵
  PID:6064
- C:\Windows\System\LjfPBjj.exe
  C:\Windows\System\LjfPBjj.exe
  2⤵
  PID:6080
- C:\Windows\System\NtCDwAz.exe
  C:\Windows\System\NtCDwAz.exe
  2⤵
  PID:6096
- C:\Windows\System\OwRLVwW.exe
  C:\Windows\System\OwRLVwW.exe
  2⤵
  PID:6120
- C:\Windows\System\rUqOIIM.exe
  C:\Windows\System\rUqOIIM.exe
  2⤵
  PID:6136
- C:\Windows\System\IdWESZN.exe
  C:\Windows\System\IdWESZN.exe
  2⤵
  PID:2516
- C:\Windows\System\drYGbOG.exe
  C:\Windows\System\drYGbOG.exe
  2⤵
  PID:5200
- C:\Windows\System\EgtnUIs.exe
  C:\Windows\System\EgtnUIs.exe
  2⤵
  PID:3836
- C:\Windows\System\zexShBE.exe
  C:\Windows\System\zexShBE.exe
  2⤵
  PID:4040
- C:\Windows\System\xGaTSYb.exe
  C:\Windows\System\xGaTSYb.exe
  2⤵
  PID:4212
- C:\Windows\System\NTXWyor.exe
  C:\Windows\System\NTXWyor.exe
  2⤵
  PID:4720
- C:\Windows\System\kmumZpO.exe
  C:\Windows\System\kmumZpO.exe
  2⤵
  PID:3872
- C:\Windows\System\mgMAuRH.exe
  C:\Windows\System\mgMAuRH.exe
  2⤵
  PID:5272
- C:\Windows\System\qezgASI.exe
  C:\Windows\System\qezgASI.exe
  2⤵
  PID:5336
- C:\Windows\System\DQbLtYR.exe
  C:\Windows\System\DQbLtYR.exe
  2⤵
  PID:5340
- C:\Windows\System\cyPQaOi.exe
  C:\Windows\System\cyPQaOi.exe
  2⤵
  PID:5400
- C:\Windows\System\OzKhkQY.exe
  C:\Windows\System\OzKhkQY.exe
  2⤵
  PID:5468
- C:\Windows\System\FYUdeSo.exe
  C:\Windows\System\FYUdeSo.exe
  2⤵
  PID:5320
- C:\Windows\System\fBOnthw.exe
  C:\Windows\System\fBOnthw.exe
  2⤵
  PID:3448
- C:\Windows\System\ryRMXQt.exe
  C:\Windows\System\ryRMXQt.exe
  2⤵
  PID:5188
- C:\Windows\System\KIcBxEC.exe
  C:\Windows\System\KIcBxEC.exe
  2⤵
  PID:5252
- C:\Windows\System\UNdWswG.exe
  C:\Windows\System\UNdWswG.exe
  2⤵
  PID:5316
- C:\Windows\System\jiMvYzb.exe
  C:\Windows\System\jiMvYzb.exe
  2⤵
  PID:5532
- C:\Windows\System\MyACKPy.exe
  C:\Windows\System\MyACKPy.exe
  2⤵
  PID:5596
- C:\Windows\System\iiARdIh.exe
  C:\Windows\System\iiARdIh.exe
  2⤵
  PID:5636
- C:\Windows\System\JxolkYl.exe
  C:\Windows\System\JxolkYl.exe
  2⤵
  PID:5420
- C:\Windows\System\OAzIqWr.exe
  C:\Windows\System\OAzIqWr.exe
  2⤵
  PID:5620
- C:\Windows\System\qTumPiN.exe
  C:\Windows\System\qTumPiN.exe
  2⤵
  PID:5448
- C:\Windows\System\tUssIPa.exe
  C:\Windows\System\tUssIPa.exe
  2⤵
  PID:5580
- C:\Windows\System\qHtlPaa.exe
  C:\Windows\System\qHtlPaa.exe
  2⤵
  PID:5684
- C:\Windows\System\XAsiNjU.exe
  C:\Windows\System\XAsiNjU.exe
  2⤵
  PID:5700
- C:\Windows\System\QrcLwUL.exe
  C:\Windows\System\QrcLwUL.exe
  2⤵
  PID:5724
- C:\Windows\System\aUJwoqY.exe
  C:\Windows\System\aUJwoqY.exe
  2⤵
  PID:5740
- C:\Windows\System\RuupERK.exe
  C:\Windows\System\RuupERK.exe
  2⤵
  PID:5748
- C:\Windows\System\trgdNmz.exe
  C:\Windows\System\trgdNmz.exe
  2⤵
  PID:5768
- C:\Windows\System\plYZYRI.exe
  C:\Windows\System\plYZYRI.exe
  2⤵
  PID:5816
- C:\Windows\System\OKFkJgu.exe
  C:\Windows\System\OKFkJgu.exe
  2⤵
  PID:5852
- C:\Windows\System\wggznho.exe
  C:\Windows\System\wggznho.exe
  2⤵
  PID:5928
- C:\Windows\System\qtJuKLO.exe
  C:\Windows\System\qtJuKLO.exe
  2⤵
  PID:5836
- C:\Windows\System\LgCFpwH.exe
  C:\Windows\System\LgCFpwH.exe
  2⤵
  PID:5872
- C:\Windows\System\oLypZzG.exe
  C:\Windows\System\oLypZzG.exe
  2⤵
  PID:6024
- C:\Windows\System\AuzIKXK.exe
  C:\Windows\System\AuzIKXK.exe
  2⤵
  PID:6060
- C:\Windows\System\FLTpFAs.exe
  C:\Windows\System\FLTpFAs.exe
  2⤵
  PID:6132
- C:\Windows\System\TsCPiIl.exe
  C:\Windows\System\TsCPiIl.exe
  2⤵
  PID:6072
- C:\Windows\System\ytISzsX.exe
  C:\Windows\System\ytISzsX.exe
  2⤵
  PID:4500
- C:\Windows\System\RHLBRpc.exe
  C:\Windows\System\RHLBRpc.exe
  2⤵
  PID:5132
- C:\Windows\System\JNtsJQv.exe
  C:\Windows\System\JNtsJQv.exe
  2⤵
  PID:4396
- C:\Windows\System\QJLtvAd.exe
  C:\Windows\System\QJLtvAd.exe
  2⤵
  PID:6012
- C:\Windows\System\Rispwdi.exe
  C:\Windows\System\Rispwdi.exe
  2⤵
  PID:6104
- C:\Windows\System\DxWjKfm.exe
  C:\Windows\System\DxWjKfm.exe
  2⤵
  PID:5136
- C:\Windows\System\GbgHGqG.exe
  C:\Windows\System\GbgHGqG.exe
  2⤵
  PID:4232
- C:\Windows\System\hqQjxrX.exe
  C:\Windows\System\hqQjxrX.exe
  2⤵
  PID:5008
- C:\Windows\System\mnbBnJH.exe
  C:\Windows\System\mnbBnJH.exe
  2⤵
  PID:5500
- C:\Windows\System\zmlTNxk.exe
  C:\Windows\System\zmlTNxk.exe
  2⤵
  PID:5156
- C:\Windows\System\smIOaJI.exe
  C:\Windows\System\smIOaJI.exe
  2⤵
  PID:5356
- C:\Windows\System\EOBowFZ.exe
  C:\Windows\System\EOBowFZ.exe
  2⤵
  PID:5472
- C:\Windows\System\kgpBKex.exe
  C:\Windows\System\kgpBKex.exe
  2⤵
  PID:5416
- C:\Windows\System\TwDWvZU.exe
  C:\Windows\System\TwDWvZU.exe
  2⤵
  PID:5384
- C:\Windows\System\fuKqbBt.exe
  C:\Windows\System\fuKqbBt.exe
  2⤵
  PID:5552
- C:\Windows\System\xOQnQDh.exe
  C:\Windows\System\xOQnQDh.exe
  2⤵
  PID:5720
- C:\Windows\System\rBGgcZz.exe
  C:\Windows\System\rBGgcZz.exe
  2⤵
  PID:5764
- C:\Windows\System\UZrDlVy.exe
  C:\Windows\System\UZrDlVy.exe
  2⤵
  PID:5800
- C:\Windows\System\QSSZwHz.exe
  C:\Windows\System\QSSZwHz.exe
  2⤵
  PID:5992
- C:\Windows\System\wvMaqaC.exe
  C:\Windows\System\wvMaqaC.exe
  2⤵
  PID:6128
- C:\Windows\System\OYNJdga.exe
  C:\Windows\System\OYNJdga.exe
  2⤵
  PID:304
- C:\Windows\System\lfuouZT.exe
  C:\Windows\System\lfuouZT.exe
  2⤵
  PID:4788
- C:\Windows\System\sZwtVcJ.exe
  C:\Windows\System\sZwtVcJ.exe
  2⤵
  PID:5484
- C:\Windows\System\VmmANAI.exe
  C:\Windows\System\VmmANAI.exe
  2⤵
  PID:5488
- C:\Windows\System\iZIhLBl.exe
  C:\Windows\System\iZIhLBl.exe
  2⤵
  PID:5832
- C:\Windows\System\gFNOZpu.exe
  C:\Windows\System\gFNOZpu.exe
  2⤵
  PID:5672
- C:\Windows\System\bfdWCXi.exe
  C:\Windows\System\bfdWCXi.exe
  2⤵
  PID:5736
- C:\Windows\System\tesshIM.exe
  C:\Windows\System\tesshIM.exe
  2⤵
  PID:5788
- C:\Windows\System\jAlfywO.exe
  C:\Windows\System\jAlfywO.exe
  2⤵
  PID:5248
- C:\Windows\System\WBNhOAz.exe
  C:\Windows\System\WBNhOAz.exe
  2⤵
  PID:6056
- C:\Windows\System\duudEfE.exe
  C:\Windows\System\duudEfE.exe
  2⤵
  PID:5980
- C:\Windows\System\OspVQFh.exe
  C:\Windows\System\OspVQFh.exe
  2⤵
  PID:4704
- C:\Windows\System\edjCRxo.exe
  C:\Windows\System\edjCRxo.exe
  2⤵
  PID:5632
- C:\Windows\System\DrbDouJ.exe
  C:\Windows\System\DrbDouJ.exe
  2⤵
  PID:5696
- C:\Windows\System\zcnGVoN.exe
  C:\Windows\System\zcnGVoN.exe
  2⤵
  PID:6092
- C:\Windows\System\IZvpySC.exe
  C:\Windows\System\IZvpySC.exe
  2⤵
  PID:5804
- C:\Windows\System\xLmKczY.exe
  C:\Windows\System\xLmKczY.exe
  2⤵
  PID:5708
- C:\Windows\System\inkfTWb.exe
  C:\Windows\System\inkfTWb.exe
  2⤵
  PID:5912
- C:\Windows\System\lDbsvBF.exe
  C:\Windows\System\lDbsvBF.exe
  2⤵
  PID:5916
- C:\Windows\System\vTOmoJc.exe
  C:\Windows\System\vTOmoJc.exe
  2⤵
  PID:5668
- C:\Windows\System\ZZdjVYr.exe
  C:\Windows\System\ZZdjVYr.exe
  2⤵
  PID:6148
- C:\Windows\System\UXFhQpw.exe
  C:\Windows\System\UXFhQpw.exe
  2⤵
  PID:6164
- C:\Windows\System\XIBKvXa.exe
  C:\Windows\System\XIBKvXa.exe
  2⤵
  PID:6180
- C:\Windows\System\diaGrKj.exe
  C:\Windows\System\diaGrKj.exe
  2⤵
  PID:6196
- C:\Windows\System\OXMQOEY.exe
  C:\Windows\System\OXMQOEY.exe
  2⤵
  PID:6212
- C:\Windows\System\NkmikmL.exe
  C:\Windows\System\NkmikmL.exe
  2⤵
  PID:6228
- C:\Windows\System\ebFremE.exe
  C:\Windows\System\ebFremE.exe
  2⤵
  PID:6244
- C:\Windows\System\jfosJLI.exe
  C:\Windows\System\jfosJLI.exe
  2⤵
  PID:6264
- C:\Windows\System\bUygDdd.exe
  C:\Windows\System\bUygDdd.exe
  2⤵
  PID:6280
- C:\Windows\System\pHyfdhb.exe
  C:\Windows\System\pHyfdhb.exe
  2⤵
  PID:6296
- C:\Windows\System\AHxiXcS.exe
  C:\Windows\System\AHxiXcS.exe
  2⤵
  PID:6316
- C:\Windows\System\wjnKEaP.exe
  C:\Windows\System\wjnKEaP.exe
  2⤵
  PID:6332
- C:\Windows\System\EZPAcGD.exe
  C:\Windows\System\EZPAcGD.exe
  2⤵
  PID:6348
- C:\Windows\System\OnTjehK.exe
  C:\Windows\System\OnTjehK.exe
  2⤵
  PID:6364
- C:\Windows\System\ZwhkAZl.exe
  C:\Windows\System\ZwhkAZl.exe
  2⤵
  PID:6380
- C:\Windows\System\TGuBotZ.exe
  C:\Windows\System\TGuBotZ.exe
  2⤵
  PID:6396
- C:\Windows\System\vCDynxo.exe
  C:\Windows\System\vCDynxo.exe
  2⤵
  PID:6412
- C:\Windows\System\DDRgCSk.exe
  C:\Windows\System\DDRgCSk.exe
  2⤵
  PID:6428
- C:\Windows\System\MhILlWN.exe
  C:\Windows\System\MhILlWN.exe
  2⤵
  PID:6444
- C:\Windows\System\IrfPuBj.exe
  C:\Windows\System\IrfPuBj.exe
  2⤵
  PID:6464
- C:\Windows\System\msETpmn.exe
  C:\Windows\System\msETpmn.exe
  2⤵
  PID:6480
- C:\Windows\System\mfaNyqe.exe
  C:\Windows\System\mfaNyqe.exe
  2⤵
  PID:6496
- C:\Windows\System\QuMggvA.exe
  C:\Windows\System\QuMggvA.exe
  2⤵
  PID:6512
- C:\Windows\System\JkkbveB.exe
  C:\Windows\System\JkkbveB.exe
  2⤵
  PID:6528
- C:\Windows\System\uiBRMJA.exe
  C:\Windows\System\uiBRMJA.exe
  2⤵
  PID:6544
- C:\Windows\System\jKuiXZl.exe
  C:\Windows\System\jKuiXZl.exe
  2⤵
  PID:6560
- C:\Windows\System\WgmPnkg.exe
  C:\Windows\System\WgmPnkg.exe
  2⤵
  PID:6576
- C:\Windows\System\WbjZuzW.exe
  C:\Windows\System\WbjZuzW.exe
  2⤵
  PID:6592
- C:\Windows\System\dufEGjy.exe
  C:\Windows\System\dufEGjy.exe
  2⤵
  PID:6608
- C:\Windows\System\QhOGHAo.exe
  C:\Windows\System\QhOGHAo.exe
  2⤵
  PID:6624
- C:\Windows\System\sacXVlg.exe
  C:\Windows\System\sacXVlg.exe
  2⤵
  PID:6640
- C:\Windows\System\oGGxuwA.exe
  C:\Windows\System\oGGxuwA.exe
  2⤵
  PID:6656
- C:\Windows\System\nrIiSdl.exe
  C:\Windows\System\nrIiSdl.exe
  2⤵
  PID:6676
- C:\Windows\System\PsRJJPY.exe
  C:\Windows\System\PsRJJPY.exe
  2⤵
  PID:6692
- C:\Windows\System\vswmXHz.exe
  C:\Windows\System\vswmXHz.exe
  2⤵
  PID:6708
- C:\Windows\System\yaWSTSJ.exe
  C:\Windows\System\yaWSTSJ.exe
  2⤵
  PID:6724
- C:\Windows\System\nAnAfmG.exe
  C:\Windows\System\nAnAfmG.exe
  2⤵
  PID:6880
- C:\Windows\System\RZONjvI.exe
  C:\Windows\System\RZONjvI.exe
  2⤵
  PID:6908
- C:\Windows\System\eAuCrNA.exe
  C:\Windows\System\eAuCrNA.exe
  2⤵
  PID:6924
- C:\Windows\System\QYOwlOQ.exe
  C:\Windows\System\QYOwlOQ.exe
  2⤵
  PID:6944
- C:\Windows\System\dpKEwZm.exe
  C:\Windows\System\dpKEwZm.exe
  2⤵
  PID:6964
- C:\Windows\System\kfDyIHT.exe
  C:\Windows\System\kfDyIHT.exe
  2⤵
  PID:6992
- C:\Windows\System\jUTIpzT.exe
  C:\Windows\System\jUTIpzT.exe
  2⤵
  PID:7008
- C:\Windows\System\HhkoCEu.exe
  C:\Windows\System\HhkoCEu.exe
  2⤵
  PID:7024
- C:\Windows\System\hjPLbWe.exe
  C:\Windows\System\hjPLbWe.exe
  2⤵
  PID:7040
- C:\Windows\System\CUpeUaG.exe
  C:\Windows\System\CUpeUaG.exe
  2⤵
  PID:7056
- C:\Windows\System\IEQSiBk.exe
  C:\Windows\System\IEQSiBk.exe
  2⤵
  PID:7072
- C:\Windows\System\qTGdpRo.exe
  C:\Windows\System\qTGdpRo.exe
  2⤵
  PID:7088
- C:\Windows\System\BDmvoOg.exe
  C:\Windows\System\BDmvoOg.exe
  2⤵
  PID:7104
- C:\Windows\System\qHwXvnk.exe
  C:\Windows\System\qHwXvnk.exe
  2⤵
  PID:7132
- C:\Windows\System\xYnjmTr.exe
  C:\Windows\System\xYnjmTr.exe
  2⤵
  PID:7148
- C:\Windows\System\ZqjCPeX.exe
  C:\Windows\System\ZqjCPeX.exe
  2⤵
  PID:7164
- C:\Windows\System\AMopSvp.exe
  C:\Windows\System\AMopSvp.exe
  2⤵
  PID:6176
- C:\Windows\System\aQxaond.exe
  C:\Windows\System\aQxaond.exe
  2⤵
  PID:6272
- C:\Windows\System\KhgvHDS.exe
  C:\Windows\System\KhgvHDS.exe
  2⤵
  PID:5776
- C:\Windows\System\BibTHaV.exe
  C:\Windows\System\BibTHaV.exe
  2⤵
  PID:6252
- C:\Windows\System\ZDLebsX.exe
  C:\Windows\System\ZDLebsX.exe
  2⤵
  PID:6116
- C:\Windows\System\CLWrHgl.exe
  C:\Windows\System\CLWrHgl.exe
  2⤵
  PID:5236
- C:\Windows\System\qmELfnY.exe
  C:\Windows\System\qmELfnY.exe
  2⤵
  PID:6312
- C:\Windows\System\EGHokts.exe
  C:\Windows\System\EGHokts.exe
  2⤵
  PID:6376
- C:\Windows\System\VJQigkE.exe
  C:\Windows\System\VJQigkE.exe
  2⤵
  PID:6440
- C:\Windows\System\OPujgJk.exe
  C:\Windows\System\OPujgJk.exe
  2⤵
  PID:6476
- C:\Windows\System\wYKiLqP.exe
  C:\Windows\System\wYKiLqP.exe
  2⤵
  PID:6256
- C:\Windows\System\RfxopMv.exe
  C:\Windows\System\RfxopMv.exe
  2⤵
  PID:6504
- C:\Windows\System\cQWzqoC.exe
  C:\Windows\System\cQWzqoC.exe
  2⤵
  PID:6360
- C:\Windows\System\LBPLPsi.exe
  C:\Windows\System\LBPLPsi.exe
  2⤵
  PID:6508
- C:\Windows\System\WWfXsPd.exe
  C:\Windows\System\WWfXsPd.exe
  2⤵
  PID:6460
- C:\Windows\System\SvOkThW.exe
  C:\Windows\System\SvOkThW.exe
  2⤵
  PID:6540
- C:\Windows\System\DuzvPZD.exe
  C:\Windows\System\DuzvPZD.exe
  2⤵
  PID:6524
- C:\Windows\System\KPWcHEh.exe
  C:\Windows\System\KPWcHEh.exe
  2⤵
  PID:6632
- C:\Windows\System\swHGJzy.exe
  C:\Windows\System\swHGJzy.exe
  2⤵
  PID:6700
- C:\Windows\System\OKlPskK.exe
  C:\Windows\System\OKlPskK.exe
  2⤵
  PID:6672
- C:\Windows\System\xRoRoik.exe
  C:\Windows\System\xRoRoik.exe
  2⤵
  PID:6648
- C:\Windows\System\ZLugmlC.exe
  C:\Windows\System\ZLugmlC.exe
  2⤵
  PID:6756
- C:\Windows\System\VPXEqwC.exe
  C:\Windows\System\VPXEqwC.exe
  2⤵
  PID:6772
- C:\Windows\System\oIrgzQd.exe
  C:\Windows\System\oIrgzQd.exe
  2⤵
  PID:6788
- C:\Windows\System\kdkxEWO.exe
  C:\Windows\System\kdkxEWO.exe
  2⤵
  PID:6824
- C:\Windows\System\HQQGVoY.exe
  C:\Windows\System\HQQGVoY.exe
  2⤵
  PID:6816
- C:\Windows\System\acZECII.exe
  C:\Windows\System\acZECII.exe
  2⤵
  PID:6836
- C:\Windows\System\zXXOEHL.exe
  C:\Windows\System\zXXOEHL.exe
  2⤵
  PID:6852
- C:\Windows\System\kfRPrWl.exe
  C:\Windows\System\kfRPrWl.exe
  2⤵
  PID:6872
- C:\Windows\System\MJhSsoo.exe
  C:\Windows\System\MJhSsoo.exe
  2⤵
  PID:6900
- C:\Windows\System\ifgyiLW.exe
  C:\Windows\System\ifgyiLW.exe
  2⤵
  PID:6920
- C:\Windows\System\UPgPdtR.exe
  C:\Windows\System\UPgPdtR.exe
  2⤵
  PID:7004
- C:\Windows\System\qZxBRaA.exe
  C:\Windows\System\qZxBRaA.exe
  2⤵
  PID:7068
- C:\Windows\System\cdrIyNK.exe
  C:\Windows\System\cdrIyNK.exe
  2⤵
  PID:7144
- C:\Windows\System\cVfGWHk.exe
  C:\Windows\System\cVfGWHk.exe
  2⤵
  PID:5744
- C:\Windows\System\OnCgvOp.exe
  C:\Windows\System\OnCgvOp.exe
  2⤵
  PID:5896
- C:\Windows\System\FkIGeOP.exe
  C:\Windows\System\FkIGeOP.exe
  2⤵
  PID:6188
- C:\Windows\System\uPdIERS.exe
  C:\Windows\System\uPdIERS.exe
  2⤵
  PID:6456
- C:\Windows\System\jofXXTQ.exe
  C:\Windows\System\jofXXTQ.exe
  2⤵
  PID:6668
- C:\Windows\System\bqcbLeS.exe
  C:\Windows\System\bqcbLeS.exe
  2⤵
  PID:6764
- C:\Windows\System\OapinaG.exe
  C:\Windows\System\OapinaG.exe
  2⤵
  PID:6988
- C:\Windows\System\XmlLeFF.exe
  C:\Windows\System\XmlLeFF.exe
  2⤵
  PID:7052
- C:\Windows\System\tIrCDZG.exe
  C:\Windows\System\tIrCDZG.exe
  2⤵
  PID:6768
- C:\Windows\System\VxLnPzW.exe
  C:\Windows\System\VxLnPzW.exe
  2⤵
  PID:6940
- C:\Windows\System\koWJqce.exe
  C:\Windows\System\koWJqce.exe
  2⤵
  PID:6860
- C:\Windows\System\EBJHwTh.exe
  C:\Windows\System\EBJHwTh.exe
  2⤵
  PID:6916
- C:\Windows\System\KzkBRQd.exe
  C:\Windows\System\KzkBRQd.exe
  2⤵
  PID:7064
- C:\Windows\System\PkAdXaH.exe
  C:\Windows\System\PkAdXaH.exe
  2⤵
  PID:7156
- C:\Windows\System\DjzrPsn.exe
  C:\Windows\System\DjzrPsn.exe
  2⤵
  PID:6236
- C:\Windows\System\fTpzUcL.exe
  C:\Windows\System\fTpzUcL.exe
  2⤵
  PID:5568
- C:\Windows\System\rQgZKjl.exe
  C:\Windows\System\rQgZKjl.exe
  2⤵
  PID:6292
- C:\Windows\System\INihFpT.exe
  C:\Windows\System\INihFpT.exe
  2⤵
  PID:6536
- C:\Windows\System\rfGHCfv.exe
  C:\Windows\System\rfGHCfv.exe
  2⤵
  PID:6736
- C:\Windows\System\FASmTKS.exe
  C:\Windows\System\FASmTKS.exe
  2⤵
  PID:6652
- C:\Windows\System\eiBdTvh.exe
  C:\Windows\System\eiBdTvh.exe
  2⤵
  PID:6744
- C:\Windows\System\YJEJDJa.exe
  C:\Windows\System\YJEJDJa.exe
  2⤵
  PID:6780
- C:\Windows\System\BYrSgdh.exe
  C:\Windows\System\BYrSgdh.exe
  2⤵
  PID:6848
- C:\Windows\System\HvlnEar.exe
  C:\Windows\System\HvlnEar.exe
  2⤵
  PID:6960
- C:\Windows\System\GOEMybn.exe
  C:\Windows\System\GOEMybn.exe
  2⤵
  PID:6108
- C:\Windows\System\FvdeFXP.exe
  C:\Windows\System\FvdeFXP.exe
  2⤵
  PID:6976
- C:\Windows\System\wjMGftX.exe
  C:\Windows\System\wjMGftX.exe
  2⤵
  PID:7084
- C:\Windows\System\hpdsxpX.exe
  C:\Windows\System\hpdsxpX.exe
  2⤵
  PID:6620
- C:\Windows\System\XaJrrCs.exe
  C:\Windows\System\XaJrrCs.exe
  2⤵
  PID:6832
- C:\Windows\System\BPLLyYg.exe
  C:\Windows\System\BPLLyYg.exe
  2⤵
  PID:6172
- C:\Windows\System\GQaTtMp.exe
  C:\Windows\System\GQaTtMp.exe
  2⤵
  PID:6472
- C:\Windows\System\GFKoghd.exe
  C:\Windows\System\GFKoghd.exe
  2⤵
  PID:6732
- C:\Windows\System\VyEBlcx.exe
  C:\Windows\System\VyEBlcx.exe
  2⤵
  PID:5876
- C:\Windows\System\fOoqhIF.exe
  C:\Windows\System\fOoqhIF.exe
  2⤵
  PID:2024
- C:\Windows\System\QefhefW.exe
  C:\Windows\System\QefhefW.exe
  2⤵
  PID:6492
- C:\Windows\System\fCLGSTj.exe
  C:\Windows\System\fCLGSTj.exe
  2⤵
  PID:6616
- C:\Windows\System\lMSflOt.exe
  C:\Windows\System\lMSflOt.exe
  2⤵
  PID:6804
- C:\Windows\System\kEkxUmR.exe
  C:\Windows\System\kEkxUmR.exe
  2⤵
  PID:6160
- C:\Windows\System\fuJrYpp.exe
  C:\Windows\System\fuJrYpp.exe
  2⤵
  PID:6892
- C:\Windows\System\JhExADc.exe
  C:\Windows\System\JhExADc.exe
  2⤵
  PID:7120
- C:\Windows\System\CAQosxZ.exe
  C:\Windows\System\CAQosxZ.exe
  2⤵
  PID:6936
- C:\Windows\System\sRQWFzb.exe
  C:\Windows\System\sRQWFzb.exe
  2⤵
  PID:7116
- C:\Windows\System\bMIpBWA.exe
  C:\Windows\System\bMIpBWA.exe
  2⤵
  PID:6356
- C:\Windows\System\nZLmiUF.exe
  C:\Windows\System\nZLmiUF.exe
  2⤵
  PID:6932
- C:\Windows\System\MOWPTOS.exe
  C:\Windows\System\MOWPTOS.exe
  2⤵
  PID:7180
- C:\Windows\System\HVaZMao.exe
  C:\Windows\System\HVaZMao.exe
  2⤵
  PID:7204
- C:\Windows\System\CJBCgfP.exe
  C:\Windows\System\CJBCgfP.exe
  2⤵
  PID:7220
- C:\Windows\System\NwdtqhV.exe
  C:\Windows\System\NwdtqhV.exe
  2⤵
  PID:7368
- C:\Windows\System\oxrOcdZ.exe
  C:\Windows\System\oxrOcdZ.exe
  2⤵
  PID:7384
- C:\Windows\System\TRkqiya.exe
  C:\Windows\System\TRkqiya.exe
  2⤵
  PID:7400
- C:\Windows\System\HTGdqSd.exe
  C:\Windows\System\HTGdqSd.exe
  2⤵
  PID:7424
- C:\Windows\System\fiQmjOM.exe
  C:\Windows\System\fiQmjOM.exe
  2⤵
  PID:7440
- C:\Windows\System\ecWoUwF.exe
  C:\Windows\System\ecWoUwF.exe
  2⤵
  PID:7456
- C:\Windows\System\vmzDTJl.exe
  C:\Windows\System\vmzDTJl.exe
  2⤵
  PID:7472
- C:\Windows\System\VUcefgr.exe
  C:\Windows\System\VUcefgr.exe
  2⤵
  PID:7488
- C:\Windows\System\wXDIqCp.exe
  C:\Windows\System\wXDIqCp.exe
  2⤵
  PID:7504
- C:\Windows\System\wUgfBBg.exe
  C:\Windows\System\wUgfBBg.exe
  2⤵
  PID:7560
- C:\Windows\System\FuPfDuJ.exe
  C:\Windows\System\FuPfDuJ.exe
  2⤵
  PID:7576
- C:\Windows\System\gxIiUZh.exe
  C:\Windows\System\gxIiUZh.exe
  2⤵
  PID:7592
- C:\Windows\System\GDrDSPB.exe
  C:\Windows\System\GDrDSPB.exe
  2⤵
  PID:7608
- C:\Windows\System\oixfcMG.exe
  C:\Windows\System\oixfcMG.exe
  2⤵
  PID:7628
- C:\Windows\System\LBetCUp.exe
  C:\Windows\System\LBetCUp.exe
  2⤵
  PID:7644
- C:\Windows\System\XwAncYO.exe
  C:\Windows\System\XwAncYO.exe
  2⤵
  PID:7660
- C:\Windows\System\aEURVOw.exe
  C:\Windows\System\aEURVOw.exe
  2⤵
  PID:7676
- C:\Windows\System\eywdsJB.exe
  C:\Windows\System\eywdsJB.exe
  2⤵
  PID:7696
- C:\Windows\System\QlKBjTp.exe
  C:\Windows\System\QlKBjTp.exe
  2⤵
  PID:7836
- C:\Windows\System\bwCBiCU.exe
  C:\Windows\System\bwCBiCU.exe
  2⤵
  PID:7852
- C:\Windows\System\kcquVLY.exe
  C:\Windows\System\kcquVLY.exe
  2⤵
  PID:7868
- C:\Windows\System\UugmZlr.exe
  C:\Windows\System\UugmZlr.exe
  2⤵
  PID:7884
- C:\Windows\System\ZaRThLg.exe
  C:\Windows\System\ZaRThLg.exe
  2⤵
  PID:7912
- C:\Windows\System\hNVhtWE.exe
  C:\Windows\System\hNVhtWE.exe
  2⤵
  PID:7928
- C:\Windows\System\jEmqyNo.exe
  C:\Windows\System\jEmqyNo.exe
  2⤵
  PID:7948
- C:\Windows\System\PKgShuY.exe
  C:\Windows\System\PKgShuY.exe
  2⤵
  PID:7964
- C:\Windows\System\fPvBjDU.exe
  C:\Windows\System\fPvBjDU.exe
  2⤵
  PID:7980
- C:\Windows\System\UnkaUKh.exe
  C:\Windows\System\UnkaUKh.exe
  2⤵
  PID:8000
- C:\Windows\System\LxXSSTa.exe
  C:\Windows\System\LxXSSTa.exe
  2⤵
  PID:8016
- C:\Windows\System\UfVVcEd.exe
  C:\Windows\System\UfVVcEd.exe
  2⤵
  PID:8032
- C:\Windows\System\rCCTpxx.exe
  C:\Windows\System\rCCTpxx.exe
  2⤵
  PID:8048
- C:\Windows\System\wFGKQCF.exe
  C:\Windows\System\wFGKQCF.exe
  2⤵
  PID:8064
- C:\Windows\System\xfOXXVo.exe
  C:\Windows\System\xfOXXVo.exe
  2⤵
  PID:8084
- C:\Windows\System\mlmFZCm.exe
  C:\Windows\System\mlmFZCm.exe
  2⤵
  PID:8104
- C:\Windows\System\tBYOtiz.exe
  C:\Windows\System\tBYOtiz.exe
  2⤵
  PID:8124
- C:\Windows\System\tmDYVZo.exe
  C:\Windows\System\tmDYVZo.exe
  2⤵
  PID:8140
- C:\Windows\System\jEXeyyd.exe
  C:\Windows\System\jEXeyyd.exe
  2⤵
  PID:8156
- C:\Windows\System\dugAcqZ.exe
  C:\Windows\System\dugAcqZ.exe
  2⤵
  PID:7200
- C:\Windows\System\heQDCmw.exe
  C:\Windows\System\heQDCmw.exe
  2⤵
  PID:7240
- C:\Windows\System\TdOdBKW.exe
  C:\Windows\System\TdOdBKW.exe
  2⤵
  PID:7248
- C:\Windows\System\DONuuaX.exe
  C:\Windows\System\DONuuaX.exe
  2⤵
  PID:7272
- C:\Windows\System\xPGuiGD.exe
  C:\Windows\System\xPGuiGD.exe
  2⤵
  PID:7292
- C:\Windows\System\GuWzYKk.exe
  C:\Windows\System\GuWzYKk.exe
  2⤵
  PID:7308
- C:\Windows\System\ygnEnQs.exe
  C:\Windows\System\ygnEnQs.exe
  2⤵
  PID:7340
- C:\Windows\System\XOEaXFC.exe
  C:\Windows\System\XOEaXFC.exe
  2⤵
  PID:7352
- C:\Windows\System\xSIOqcr.exe
  C:\Windows\System\xSIOqcr.exe
  2⤵
  PID:7380
- C:\Windows\System\olbSbJg.exe
  C:\Windows\System\olbSbJg.exe
  2⤵
  PID:7420
- C:\Windows\System\OTjNdGl.exe
  C:\Windows\System\OTjNdGl.exe
  2⤵
  PID:7512
- C:\Windows\System\haIsRiA.exe
  C:\Windows\System\haIsRiA.exe
  2⤵
  PID:7480
- C:\Windows\System\qHHIvOc.exe
  C:\Windows\System\qHHIvOc.exe
  2⤵
  PID:7536
- C:\Windows\System\mCXFzjC.exe
  C:\Windows\System\mCXFzjC.exe
  2⤵
  PID:7432
- C:\Windows\System\aistrgX.exe
  C:\Windows\System\aistrgX.exe
  2⤵
  PID:7584
- C:\Windows\System\VIEaJHJ.exe
  C:\Windows\System\VIEaJHJ.exe
  2⤵
  PID:7688
- C:\Windows\System\EcrwmUG.exe
  C:\Windows\System\EcrwmUG.exe
  2⤵
  PID:7692
- C:\Windows\System\PfqsZPx.exe
  C:\Windows\System\PfqsZPx.exe
  2⤵
  PID:7640
- C:\Windows\System\bfkcysP.exe
  C:\Windows\System\bfkcysP.exe
  2⤵
  PID:7572
- C:\Windows\System\ZvjyVBP.exe
  C:\Windows\System\ZvjyVBP.exe
  2⤵
  PID:7708
- C:\Windows\System\MvQJIQo.exe
  C:\Windows\System\MvQJIQo.exe
  2⤵
  PID:7720
- C:\Windows\System\xfIIhIM.exe
  C:\Windows\System\xfIIhIM.exe
  2⤵
  PID:7728
- C:\Windows\System\NxGFCIM.exe
  C:\Windows\System\NxGFCIM.exe
  2⤵
  PID:7756
- C:\Windows\System\IdPQZtg.exe
  C:\Windows\System\IdPQZtg.exe
  2⤵
  PID:7772
- C:\Windows\System\rapMQsO.exe
  C:\Windows\System\rapMQsO.exe
  2⤵
  PID:7792
- C:\Windows\System\MEeviHx.exe
  C:\Windows\System\MEeviHx.exe
  2⤵
  PID:7808
- C:\Windows\System\eDxpwaD.exe
  C:\Windows\System\eDxpwaD.exe
  2⤵
  PID:7828
- C:\Windows\System\diGUMJE.exe
  C:\Windows\System\diGUMJE.exe
  2⤵
  PID:7848
- C:\Windows\System\VcRVXBs.exe
  C:\Windows\System\VcRVXBs.exe
  2⤵
  PID:7864
- C:\Windows\System\VWClrKO.exe
  C:\Windows\System\VWClrKO.exe
  2⤵
  PID:7924
- C:\Windows\System\cXZTSRw.exe
  C:\Windows\System\cXZTSRw.exe
  2⤵
  PID:7992
- C:\Windows\System\ePlAMkA.exe
  C:\Windows\System\ePlAMkA.exe
  2⤵
  PID:8056
- C:\Windows\System\LCJKbqP.exe
  C:\Windows\System\LCJKbqP.exe
  2⤵
  PID:7900
- C:\Windows\System\bFsVEsh.exe
  C:\Windows\System\bFsVEsh.exe
  2⤵
  PID:7904
- C:\Windows\System\kPODuzj.exe
  C:\Windows\System\kPODuzj.exe
  2⤵
  PID:8008
- C:\Windows\System\ELZEYbQ.exe
  C:\Windows\System\ELZEYbQ.exe
  2⤵
  PID:7140
- C:\Windows\System\xDVznPY.exe
  C:\Windows\System\xDVznPY.exe
  2⤵
  PID:6452
- C:\Windows\System\cBahWBQ.exe
  C:\Windows\System\cBahWBQ.exe
  2⤵
  PID:7188
- C:\Windows\System\owHKnLH.exe
  C:\Windows\System\owHKnLH.exe
  2⤵
  PID:7244
- C:\Windows\System\afkJDrf.exe
  C:\Windows\System\afkJDrf.exe
  2⤵
  PID:7216
- C:\Windows\System\ByDOIPQ.exe
  C:\Windows\System\ByDOIPQ.exe
  2⤵
  PID:7264
- C:\Windows\System\bDpVQWx.exe
  C:\Windows\System\bDpVQWx.exe
  2⤵
  PID:7360
- C:\Windows\System\GDWRXmp.exe
  C:\Windows\System\GDWRXmp.exe
  2⤵
  PID:7304
- C:\Windows\System\QkBVdTk.exe
  C:\Windows\System\QkBVdTk.exe
  2⤵
  PID:7412
- C:\Windows\System\KOJjOwi.exe
  C:\Windows\System\KOJjOwi.exe
  2⤵
  PID:7716
- C:\Windows\System\kikCDou.exe
  C:\Windows\System\kikCDou.exe
  2⤵
  PID:7744
- C:\Windows\System\lBSXoZZ.exe
  C:\Windows\System\lBSXoZZ.exe
  2⤵
  PID:7816
- C:\Windows\System\rjBAaFK.exe
  C:\Windows\System\rjBAaFK.exe
  2⤵
  PID:7764
- C:\Windows\System\UIrGYal.exe
  C:\Windows\System\UIrGYal.exe
  2⤵
  PID:7988
- C:\Windows\System\CAPJZEh.exe
  C:\Windows\System\CAPJZEh.exe
  2⤵
  PID:7896
- C:\Windows\System\hYUYxPi.exe
  C:\Windows\System\hYUYxPi.exe
  2⤵
  PID:7704
- C:\Windows\System\GPXQcDW.exe
  C:\Windows\System\GPXQcDW.exe
  2⤵
  PID:7844
- C:\Windows\System\qCAGzIz.exe
  C:\Windows\System\qCAGzIz.exe
  2⤵
  PID:8132
- C:\Windows\System\aRlvnxT.exe
  C:\Windows\System\aRlvnxT.exe
  2⤵
  PID:8148
- C:\Windows\System\AqLePUb.exe
  C:\Windows\System\AqLePUb.exe
  2⤵
  PID:8172
- C:\Windows\System\HRTRFdM.exe
  C:\Windows\System\HRTRFdM.exe
  2⤵
  PID:6392
- C:\Windows\System\XUfcmUU.exe
  C:\Windows\System\XUfcmUU.exe
  2⤵
  PID:6820
- C:\Windows\System\YKdGEnp.exe
  C:\Windows\System\YKdGEnp.exe
  2⤵
  PID:7364
- C:\Windows\System\UeLJASA.exe
  C:\Windows\System\UeLJASA.exe
  2⤵
  PID:6868
- C:\Windows\System\mnylLAJ.exe
  C:\Windows\System\mnylLAJ.exe
  2⤵
  PID:7196
- C:\Windows\System\iYWcLyP.exe
  C:\Windows\System\iYWcLyP.exe
  2⤵
  PID:7260
- C:\Windows\System\IYxDNAv.exe
  C:\Windows\System\IYxDNAv.exe
  2⤵
  PID:7448
- C:\Windows\System\uCtyauv.exe
  C:\Windows\System\uCtyauv.exe
  2⤵
  PID:7496
- C:\Windows\System\oYwSNjk.exe
  C:\Windows\System\oYwSNjk.exe
  2⤵
  PID:7656
- C:\Windows\System\veoqtkQ.exe
  C:\Windows\System\veoqtkQ.exe
  2⤵
  PID:7552
- C:\Windows\System\OHSAKJg.exe
  C:\Windows\System\OHSAKJg.exe
  2⤵
  PID:7788
- C:\Windows\System\rJPwyPv.exe
  C:\Windows\System\rJPwyPv.exe
  2⤵
  PID:7176
- C:\Windows\System\TCHrxFi.exe
  C:\Windows\System\TCHrxFi.exe
  2⤵
  PID:7320
- C:\Windows\System\OTOwmzj.exe
  C:\Windows\System\OTOwmzj.exe
  2⤵
  PID:7588
- C:\Windows\System\QAScqvl.exe
  C:\Windows\System\QAScqvl.exe
  2⤵
  PID:6436
- C:\Windows\System\EqXkpeL.exe
  C:\Windows\System\EqXkpeL.exe
  2⤵
  PID:8112
- C:\Windows\System\taXQoGu.exe
  C:\Windows\System\taXQoGu.exe
  2⤵
  PID:7600
- C:\Windows\System\dysSnpp.exe
  C:\Windows\System\dysSnpp.exe
  2⤵
  PID:7860
- C:\Windows\System\rAswyZP.exe
  C:\Windows\System\rAswyZP.exe
  2⤵
  PID:7464
- C:\Windows\System\UxWvTYK.exe
  C:\Windows\System\UxWvTYK.exe
  2⤵
  PID:7768
- C:\Windows\System\pJZPYuO.exe
  C:\Windows\System\pJZPYuO.exe
  2⤵
  PID:8028
- C:\Windows\System\JrNnQNP.exe
  C:\Windows\System\JrNnQNP.exe
  2⤵
  PID:7936
- C:\Windows\System\edVscrn.exe
  C:\Windows\System\edVscrn.exe
  2⤵
  PID:8072
- C:\Windows\System\UHSHZZK.exe
  C:\Windows\System\UHSHZZK.exe
  2⤵
  PID:8168
- C:\Windows\System\pNWugxk.exe
  C:\Windows\System\pNWugxk.exe
  2⤵
  PID:7316
- C:\Windows\System\ehecQVo.exe
  C:\Windows\System\ehecQVo.exe
  2⤵
  PID:8176
- C:\Windows\System\Wjtpccf.exe
  C:\Windows\System\Wjtpccf.exe
  2⤵
  PID:7748
- C:\Windows\System\crfVBcF.exe
  C:\Windows\System\crfVBcF.exe
  2⤵
  PID:8116
- C:\Windows\System\jDeEUtN.exe
  C:\Windows\System\jDeEUtN.exe
  2⤵
  PID:7192
- C:\Windows\System\RdwfzJP.exe
  C:\Windows\System\RdwfzJP.exe
  2⤵
  PID:7944
- C:\Windows\System\LsIqsSN.exe
  C:\Windows\System\LsIqsSN.exe
  2⤵
  PID:7784
- C:\Windows\System\TfxnYNk.exe
  C:\Windows\System\TfxnYNk.exe
  2⤵
  PID:8296
- C:\Windows\System\zgtDbXR.exe
  C:\Windows\System\zgtDbXR.exe
  2⤵
  PID:8316
- C:\Windows\System\wUdseNs.exe
  C:\Windows\System\wUdseNs.exe
  2⤵
  PID:8332
- C:\Windows\System\sxYQruY.exe
  C:\Windows\System\sxYQruY.exe
  2⤵
  PID:8348
- C:\Windows\System\BUsgQes.exe
  C:\Windows\System\BUsgQes.exe
  2⤵
  PID:8364
- C:\Windows\System\QhnNPEu.exe
  C:\Windows\System\QhnNPEu.exe
  2⤵
  PID:8380
- C:\Windows\System\ATHVZRE.exe
  C:\Windows\System\ATHVZRE.exe
  2⤵
  PID:8396
- C:\Windows\System\tXWkpiO.exe
  C:\Windows\System\tXWkpiO.exe
  2⤵
  PID:8412
- C:\Windows\System\hbZPAEP.exe
  C:\Windows\System\hbZPAEP.exe
  2⤵
  PID:8428
- C:\Windows\System\YscKAUY.exe
  C:\Windows\System\YscKAUY.exe
  2⤵
  PID:8444
- C:\Windows\System\TyJrLgE.exe
  C:\Windows\System\TyJrLgE.exe
  2⤵
  PID:8464
- C:\Windows\System\ZZRQfTG.exe
  C:\Windows\System\ZZRQfTG.exe
  2⤵
  PID:8480
- C:\Windows\System\dkroxLt.exe
  C:\Windows\System\dkroxLt.exe
  2⤵
  PID:8496
- C:\Windows\System\MIdmEjm.exe
  C:\Windows\System\MIdmEjm.exe
  2⤵
  PID:8512
- C:\Windows\System\ClBXUOs.exe
  C:\Windows\System\ClBXUOs.exe
  2⤵
  PID:8528
- C:\Windows\System\ZzLqlyP.exe
  C:\Windows\System\ZzLqlyP.exe
  2⤵
  PID:8544
- C:\Windows\System\EBYZkpw.exe
  C:\Windows\System\EBYZkpw.exe
  2⤵
  PID:8560
- C:\Windows\System\sDYzwxx.exe
  C:\Windows\System\sDYzwxx.exe
  2⤵
  PID:8576
- C:\Windows\System\ybJECql.exe
  C:\Windows\System\ybJECql.exe
  2⤵
  PID:8596
- C:\Windows\System\WTNfHUn.exe
  C:\Windows\System\WTNfHUn.exe
  2⤵
  PID:8612
- C:\Windows\System\vsOAeZs.exe
  C:\Windows\System\vsOAeZs.exe
  2⤵
  PID:8628
- C:\Windows\System\heAraDL.exe
  C:\Windows\System\heAraDL.exe
  2⤵
  PID:8644
- C:\Windows\System\HaQibHU.exe
  C:\Windows\System\HaQibHU.exe
  2⤵
  PID:8660
- C:\Windows\System\xvdvePA.exe
  C:\Windows\System\xvdvePA.exe
  2⤵
  PID:8676
- C:\Windows\System\TXKKPTE.exe
  C:\Windows\System\TXKKPTE.exe
  2⤵
  PID:8692
- C:\Windows\System\naveOti.exe
  C:\Windows\System\naveOti.exe
  2⤵
  PID:8708
- C:\Windows\System\AUKhhnZ.exe
  C:\Windows\System\AUKhhnZ.exe
  2⤵
  PID:8724
- C:\Windows\System\uSqFTjN.exe
  C:\Windows\System\uSqFTjN.exe
  2⤵
  PID:8740
- C:\Windows\System\TlZDqRc.exe
  C:\Windows\System\TlZDqRc.exe
  2⤵
  PID:8756
- C:\Windows\System\tfMMAxD.exe
  C:\Windows\System\tfMMAxD.exe
  2⤵
  PID:8772
- C:\Windows\System\QSzaQrT.exe
  C:\Windows\System\QSzaQrT.exe
  2⤵
  PID:8788
- C:\Windows\System\EphpuPD.exe
  C:\Windows\System\EphpuPD.exe
  2⤵
  PID:8804
- C:\Windows\System\YrOzMkf.exe
  C:\Windows\System\YrOzMkf.exe
  2⤵
  PID:8820
- C:\Windows\System\RLrsXHO.exe
  C:\Windows\System\RLrsXHO.exe
  2⤵
  PID:8836
- C:\Windows\System\APtJpSm.exe
  C:\Windows\System\APtJpSm.exe
  2⤵
  PID:8852
- C:\Windows\System\vztsFEv.exe
  C:\Windows\System\vztsFEv.exe
  2⤵
  PID:8868
- C:\Windows\System\hPrYzuX.exe
  C:\Windows\System\hPrYzuX.exe
  2⤵
  PID:8884
- C:\Windows\System\LNYhtLL.exe
  C:\Windows\System\LNYhtLL.exe
  2⤵
  PID:8900
- C:\Windows\System\jKAkVjB.exe
  C:\Windows\System\jKAkVjB.exe
  2⤵
  PID:8916
- C:\Windows\System\FWxIIgY.exe
  C:\Windows\System\FWxIIgY.exe
  2⤵
  PID:8932
- C:\Windows\System\LTPDEGY.exe
  C:\Windows\System\LTPDEGY.exe
  2⤵
  PID:8948
- C:\Windows\System\CuWqvlV.exe
  C:\Windows\System\CuWqvlV.exe
  2⤵
  PID:8964
- C:\Windows\System\lwwtFyq.exe
  C:\Windows\System\lwwtFyq.exe
  2⤵
  PID:8980
- C:\Windows\System\XefzkTT.exe
  C:\Windows\System\XefzkTT.exe
  2⤵
  PID:8996
- C:\Windows\System\xkwrKul.exe
  C:\Windows\System\xkwrKul.exe
  2⤵
  PID:9012
- C:\Windows\System\vMAmGis.exe
  C:\Windows\System\vMAmGis.exe
  2⤵
  PID:9028
- C:\Windows\System\tLRaJwA.exe
  C:\Windows\System\tLRaJwA.exe
  2⤵
  PID:9044
- C:\Windows\System\LdkqZAz.exe
  C:\Windows\System\LdkqZAz.exe
  2⤵
  PID:9060
- C:\Windows\System\htQucrl.exe
  C:\Windows\System\htQucrl.exe
  2⤵
  PID:9076
- C:\Windows\System\uVsGlkj.exe
  C:\Windows\System\uVsGlkj.exe
  2⤵
  PID:9092
- C:\Windows\System\GoVMhid.exe
  C:\Windows\System\GoVMhid.exe
  2⤵
  PID:9108
- C:\Windows\System\CYGzzcQ.exe
  C:\Windows\System\CYGzzcQ.exe
  2⤵
  PID:9124
- C:\Windows\System\PvHGGcf.exe
  C:\Windows\System\PvHGGcf.exe
  2⤵
  PID:9140
- C:\Windows\System\kxAQIJj.exe
  C:\Windows\System\kxAQIJj.exe
  2⤵
  PID:9156
- C:\Windows\System\FixRdyI.exe
  C:\Windows\System\FixRdyI.exe
  2⤵
  PID:9172
- C:\Windows\System\gLNTBBN.exe
  C:\Windows\System\gLNTBBN.exe
  2⤵
  PID:9208
- C:\Windows\System\KOAAZBM.exe
  C:\Windows\System\KOAAZBM.exe
  2⤵
  PID:7232
- C:\Windows\System\CSEbKHX.exe
  C:\Windows\System\CSEbKHX.exe
  2⤵
  PID:7800
- C:\Windows\System\QDVWUZS.exe
  C:\Windows\System\QDVWUZS.exe
  2⤵
  PID:7532
- C:\Windows\System\wAwNcbo.exe
  C:\Windows\System\wAwNcbo.exe
  2⤵
  PID:8080
- C:\Windows\System\vqzqfwU.exe
  C:\Windows\System\vqzqfwU.exe
  2⤵
  PID:8328
- C:\Windows\System\yEqBgUp.exe
  C:\Windows\System\yEqBgUp.exe
  2⤵
  PID:8392
- C:\Windows\System\DyNpfTj.exe
  C:\Windows\System\DyNpfTj.exe
  2⤵
  PID:8460
- C:\Windows\System\HsGZMIP.exe
  C:\Windows\System\HsGZMIP.exe
  2⤵
  PID:8492
- C:\Windows\System\gmxYUhx.exe
  C:\Windows\System\gmxYUhx.exe
  2⤵
  PID:8308
- C:\Windows\System\ICxGYGR.exe
  C:\Windows\System\ICxGYGR.exe
  2⤵
  PID:8312
- C:\Windows\System\SbueuVZ.exe
  C:\Windows\System\SbueuVZ.exe
  2⤵
  PID:8476
- C:\Windows\System\HyRDptO.exe
  C:\Windows\System\HyRDptO.exe
  2⤵
  PID:8540
- C:\Windows\System\QgloLPK.exe
  C:\Windows\System\QgloLPK.exe
  2⤵
  PID:8504
- C:\Windows\System\TydxwGO.exe
  C:\Windows\System\TydxwGO.exe
  2⤵
  PID:8652
- C:\Windows\System\oBuZPzw.exe
  C:\Windows\System\oBuZPzw.exe
  2⤵
  PID:8720
- C:\Windows\System\vPBbOYo.exe
  C:\Windows\System\vPBbOYo.exe
  2⤵
  PID:8812
- C:\Windows\System\qVixbFI.exe
  C:\Windows\System\qVixbFI.exe
  2⤵
  PID:8816
- C:\Windows\System\mJWMYVE.exe
  C:\Windows\System\mJWMYVE.exe
  2⤵
  PID:8848
- C:\Windows\System\Pattedv.exe
  C:\Windows\System\Pattedv.exe
  2⤵
  PID:8912
- C:\Windows\System\sLwqYNX.exe
  C:\Windows\System\sLwqYNX.exe
  2⤵
  PID:8972
- C:\Windows\System\vpeBHIH.exe
  C:\Windows\System\vpeBHIH.exe
  2⤵
  PID:8976
- C:\Windows\System\fKFPOOH.exe
  C:\Windows\System\fKFPOOH.exe
  2⤵
  PID:8668
- C:\Windows\System\GebDpGu.exe
  C:\Windows\System\GebDpGu.exe
  2⤵
  PID:9008
- C:\Windows\System\nECTHlo.exe
  C:\Windows\System\nECTHlo.exe
  2⤵
  PID:8768
- C:\Windows\System\vmYSGyb.exe
  C:\Windows\System\vmYSGyb.exe
  2⤵
  PID:9068
- C:\Windows\System\zuqlVTI.exe
  C:\Windows\System\zuqlVTI.exe
  2⤵
  PID:8864
- C:\Windows\System\mxDvhkR.exe
  C:\Windows\System\mxDvhkR.exe
  2⤵
  PID:8796
- C:\Windows\System\ggpfVAn.exe
  C:\Windows\System\ggpfVAn.exe
  2⤵
  PID:9116
- C:\Windows\System\ddRaMWg.exe
  C:\Windows\System\ddRaMWg.exe
  2⤵
  PID:9056
- C:\Windows\System\xEneRSt.exe
  C:\Windows\System\xEneRSt.exe
  2⤵
  PID:9136
- C:\Windows\System\CgNBIkf.exe
  C:\Windows\System\CgNBIkf.exe
  2⤵
  PID:9184
- C:\Windows\System\AeBkhnT.exe
  C:\Windows\System\AeBkhnT.exe
  2⤵
  PID:8024
- C:\Windows\System\pBykfVV.exe
  C:\Windows\System\pBykfVV.exe
  2⤵
  PID:9120
- C:\Windows\System\RwYguul.exe
  C:\Windows\System\RwYguul.exe
  2⤵
  PID:9188
- C:\Windows\System\gUdCQHj.exe
  C:\Windows\System\gUdCQHj.exe
  2⤵
  PID:8208
- C:\Windows\System\jmxMGqr.exe
  C:\Windows\System\jmxMGqr.exe
  2⤵
  PID:7804
- C:\Windows\System\fBFGuhD.exe
  C:\Windows\System\fBFGuhD.exe
  2⤵
  PID:8236
- C:\Windows\System\zhCFJuC.exe
  C:\Windows\System\zhCFJuC.exe
  2⤵
  PID:8244
- C:\Windows\System\XJQKSog.exe
  C:\Windows\System\XJQKSog.exe
  2⤵
  PID:8268
- C:\Windows\System\PZxgpGX.exe
  C:\Windows\System\PZxgpGX.exe
  2⤵
  PID:8276
- C:\Windows\System\rVmbbzG.exe
  C:\Windows\System\rVmbbzG.exe
  2⤵
  PID:8388
- C:\Windows\System\JJEzMLt.exe
  C:\Windows\System\JJEzMLt.exe
  2⤵
  PID:8452
- C:\Windows\System\WeYkJci.exe
  C:\Windows\System\WeYkJci.exe
  2⤵
  PID:8340
- C:\Windows\System\XFpkEZV.exe
  C:\Windows\System\XFpkEZV.exe
  2⤵
  PID:8408
- C:\Windows\System\HSasPUv.exe
  C:\Windows\System\HSasPUv.exe
  2⤵
  PID:8584
- C:\Windows\System\cMaAkEB.exe
  C:\Windows\System\cMaAkEB.exe
  2⤵
  PID:8304
- C:\Windows\System\nrVIHlI.exe
  C:\Windows\System\nrVIHlI.exe
  2⤵
  PID:8656
- C:\Windows\System\vcLFqkO.exe
  C:\Windows\System\vcLFqkO.exe
  2⤵
  PID:8376
- C:\Windows\System\jVibFxk.exe
  C:\Windows\System\jVibFxk.exe
  2⤵
  PID:8704
- C:\Windows\System\lIAqtIy.exe
  C:\Windows\System\lIAqtIy.exe
  2⤵
  PID:8960
- C:\Windows\System\HvUWKqS.exe
  C:\Windows\System\HvUWKqS.exe
  2⤵
  PID:9088
- C:\Windows\System\vOuYYdZ.exe
  C:\Windows\System\vOuYYdZ.exe
  2⤵
  PID:8736
- C:\Windows\System\gTuSuSf.exe
  C:\Windows\System\gTuSuSf.exe
  2⤵
  PID:9204
- C:\Windows\System\GLbIJro.exe
  C:\Windows\System\GLbIJro.exe
  2⤵
  PID:8252
- C:\Windows\System\ZFjssfa.exe
  C:\Windows\System\ZFjssfa.exe
  2⤵
  PID:8360
- C:\Windows\System\BKhHvfN.exe
  C:\Windows\System\BKhHvfN.exe
  2⤵
  PID:8344
- C:\Windows\System\KNVGJga.exe
  C:\Windows\System\KNVGJga.exe
  2⤵
  PID:8624
- C:\Windows\System\EoPcxzk.exe
  C:\Windows\System\EoPcxzk.exe
  2⤵
  PID:8240
- C:\Windows\System\WTSNFps.exe
  C:\Windows\System\WTSNFps.exe
  2⤵
  PID:8324
- C:\Windows\System\AqMoVmM.exe
  C:\Windows\System\AqMoVmM.exe
  2⤵
  PID:8716
- C:\Windows\System\lfwsMGJ.exe
  C:\Windows\System\lfwsMGJ.exe
  2⤵
  PID:8752
- C:\Windows\System\qOzPuAa.exe
  C:\Windows\System\qOzPuAa.exe
  2⤵
  PID:8256
- C:\Windows\System\DoMYGzF.exe
  C:\Windows\System\DoMYGzF.exe
  2⤵
  PID:8636
- C:\Windows\System\sUcKqvY.exe
  C:\Windows\System\sUcKqvY.exe
  2⤵
  PID:8404
- C:\Windows\System\ABHqioJ.exe
  C:\Windows\System\ABHqioJ.exe
  2⤵
  PID:8372
- C:\Windows\System\dpMrbeT.exe
  C:\Windows\System\dpMrbeT.exe
  2⤵
  PID:8120
- C:\Windows\System\FXtqakG.exe
  C:\Windows\System\FXtqakG.exe
  2⤵
  PID:8732
- C:\Windows\System\CaDWulv.exe
  C:\Windows\System\CaDWulv.exe
  2⤵
  PID:9220
- C:\Windows\System\nobLROf.exe
  C:\Windows\System\nobLROf.exe
  2⤵
  PID:9236
- C:\Windows\System\gmCsGPH.exe
  C:\Windows\System\gmCsGPH.exe
  2⤵
  PID:9256
- C:\Windows\System\nOmoRuw.exe
  C:\Windows\System\nOmoRuw.exe
  2⤵
  PID:9272
- C:\Windows\System\BsSnvsO.exe
  C:\Windows\System\BsSnvsO.exe
  2⤵
  PID:9292
- C:\Windows\System\dbRntoe.exe
  C:\Windows\System\dbRntoe.exe
  2⤵
  PID:9308
- C:\Windows\System\jDINKvj.exe
  C:\Windows\System\jDINKvj.exe
  2⤵
  PID:9324
- C:\Windows\System\DDfWrgF.exe
  C:\Windows\System\DDfWrgF.exe
  2⤵
  PID:9340
- C:\Windows\System\CFAMMTf.exe
  C:\Windows\System\CFAMMTf.exe
  2⤵
  PID:9356
- C:\Windows\System\CnFTClg.exe
  C:\Windows\System\CnFTClg.exe
  2⤵
  PID:9372
- C:\Windows\System\dzPeqbx.exe
  C:\Windows\System\dzPeqbx.exe
  2⤵
  PID:9388
- C:\Windows\System\beNFJmx.exe
  C:\Windows\System\beNFJmx.exe
  2⤵
  PID:9404
- C:\Windows\System\iyLqarC.exe
  C:\Windows\System\iyLqarC.exe
  2⤵
  PID:9420
- C:\Windows\System\GgDdImf.exe
  C:\Windows\System\GgDdImf.exe
  2⤵
  PID:9436
- C:\Windows\System\LoDXQip.exe
  C:\Windows\System\LoDXQip.exe
  2⤵
  PID:9452
- C:\Windows\System\eHOdGxx.exe
  C:\Windows\System\eHOdGxx.exe
  2⤵
  PID:9468
- C:\Windows\System\SFKiPWG.exe
  C:\Windows\System\SFKiPWG.exe
  2⤵
  PID:9492
- C:\Windows\System\jtEmUal.exe
  C:\Windows\System\jtEmUal.exe
  2⤵
  PID:9508
- C:\Windows\System\etiVhJy.exe
  C:\Windows\System\etiVhJy.exe
  2⤵
  PID:9524
- C:\Windows\System\juEcqXc.exe
  C:\Windows\System\juEcqXc.exe
  2⤵
  PID:9540
- C:\Windows\System\DElVEUE.exe
  C:\Windows\System\DElVEUE.exe
  2⤵
  PID:9556
- C:\Windows\System\WdyKOdN.exe
  C:\Windows\System\WdyKOdN.exe
  2⤵
  PID:9572
- C:\Windows\System\sAnbBLP.exe
  C:\Windows\System\sAnbBLP.exe
  2⤵
  PID:9588
- C:\Windows\System\utrZSxr.exe
  C:\Windows\System\utrZSxr.exe
  2⤵
  PID:9608
- C:\Windows\System\GaVujgS.exe
  C:\Windows\System\GaVujgS.exe
  2⤵
  PID:9624
- C:\Windows\System\dlfwuUs.exe
  C:\Windows\System\dlfwuUs.exe
  2⤵
  PID:9640
- C:\Windows\System\mwWIuQV.exe
  C:\Windows\System\mwWIuQV.exe
  2⤵
  PID:9656
- C:\Windows\System\DmdkMHu.exe
  C:\Windows\System\DmdkMHu.exe
  2⤵
  PID:9672
- C:\Windows\System\NRvWnsm.exe
  C:\Windows\System\NRvWnsm.exe
  2⤵
  PID:9688
- C:\Windows\System\OyoYeBp.exe
  C:\Windows\System\OyoYeBp.exe
  2⤵
  PID:9704
- C:\Windows\System\pNzntsq.exe
  C:\Windows\System\pNzntsq.exe
  2⤵
  PID:9720
- C:\Windows\System\TuZVEdV.exe
  C:\Windows\System\TuZVEdV.exe
  2⤵
  PID:9736
- C:\Windows\System\nrZYTgo.exe
  C:\Windows\System\nrZYTgo.exe
  2⤵
  PID:9752
- C:\Windows\System\QdEmlVr.exe
  C:\Windows\System\QdEmlVr.exe
  2⤵
  PID:9856
- C:\Windows\System\JfJBUGA.exe
  C:\Windows\System\JfJBUGA.exe
  2⤵
  PID:9880
- C:\Windows\System\nvjyyNF.exe
  C:\Windows\System\nvjyyNF.exe
  2⤵
  PID:9900
- C:\Windows\System\XoHiMfE.exe
  C:\Windows\System\XoHiMfE.exe
  2⤵
  PID:9920
- C:\Windows\System\aMigXmU.exe
  C:\Windows\System\aMigXmU.exe
  2⤵
  PID:9936
- C:\Windows\System\eNhSdMV.exe
  C:\Windows\System\eNhSdMV.exe
  2⤵
  PID:9952
- C:\Windows\System\SzzhkBN.exe
  C:\Windows\System\SzzhkBN.exe
  2⤵
  PID:9968
- C:\Windows\System\qBKyYIQ.exe
  C:\Windows\System\qBKyYIQ.exe
  2⤵
  PID:9984
- C:\Windows\System\MhjjVjI.exe
  C:\Windows\System\MhjjVjI.exe
  2⤵
  PID:10032
- C:\Windows\System\kUlAaZJ.exe
  C:\Windows\System\kUlAaZJ.exe
  2⤵
  PID:10048
- C:\Windows\System\gopEFEj.exe
  C:\Windows\System\gopEFEj.exe
  2⤵
  PID:10064
- C:\Windows\System\rUZOtRA.exe
  C:\Windows\System\rUZOtRA.exe
  2⤵
  PID:10080
- C:\Windows\System\LtpMuvL.exe
  C:\Windows\System\LtpMuvL.exe
  2⤵
  PID:10100
- C:\Windows\System\PlMqWEv.exe
  C:\Windows\System\PlMqWEv.exe
  2⤵
  PID:10116
- C:\Windows\System\wvKulGB.exe
  C:\Windows\System\wvKulGB.exe
  2⤵
  PID:10136
- C:\Windows\System\XbZDRKO.exe
  C:\Windows\System\XbZDRKO.exe
  2⤵
  PID:10152
- C:\Windows\System\QEklWby.exe
  C:\Windows\System\QEklWby.exe
  2⤵
  PID:10168
- C:\Windows\System\hqivtzW.exe
  C:\Windows\System\hqivtzW.exe
  2⤵
  PID:10184
- C:\Windows\System\fjneXnk.exe
  C:\Windows\System\fjneXnk.exe
  2⤵
  PID:10200
- C:\Windows\System\EiVJEDc.exe
  C:\Windows\System\EiVJEDc.exe
  2⤵
  PID:9364
- C:\Windows\System\DyLkIDx.exe
  C:\Windows\System\DyLkIDx.exe
  2⤵
  PID:9244
- C:\Windows\System\zBxGBjW.exe
  C:\Windows\System\zBxGBjW.exe
  2⤵
  PID:9428
- C:\Windows\System\GnrHHkC.exe
  C:\Windows\System\GnrHHkC.exe
  2⤵
  PID:9352
- C:\Windows\System\WEHAhre.exe
  C:\Windows\System\WEHAhre.exe
  2⤵
  PID:9380
- C:\Windows\System\TXnnWgE.exe
  C:\Windows\System\TXnnWgE.exe
  2⤵
  PID:9464
- C:\Windows\System\wdzAeCs.exe
  C:\Windows\System\wdzAeCs.exe
  2⤵
  PID:9648
- C:\Windows\System\aWZXGOS.exe
  C:\Windows\System\aWZXGOS.exe
  2⤵
  PID:9760
- C:\Windows\System\WxWGWbT.exe
  C:\Windows\System\WxWGWbT.exe
  2⤵
  PID:9784
- C:\Windows\System\oKzHBWB.exe
  C:\Windows\System\oKzHBWB.exe
  2⤵
  PID:9800
- C:\Windows\System\OQfLxjY.exe
  C:\Windows\System\OQfLxjY.exe
  2⤵
  PID:9816
- C:\Windows\System\ODygxiN.exe
  C:\Windows\System\ODygxiN.exe
  2⤵
  PID:9876
- C:\Windows\System\YhEWmzJ.exe
  C:\Windows\System\YhEWmzJ.exe
  2⤵
  PID:10044
- C:\Windows\System\phFljib.exe
  C:\Windows\System\phFljib.exe
  2⤵
  PID:9944
- C:\Windows\System\elMpSJh.exe
  C:\Windows\System\elMpSJh.exe
  2⤵
  PID:10072
- C:\Windows\System\IGRaYKR.exe
  C:\Windows\System\IGRaYKR.exe
  2⤵
  PID:10112
- C:\Windows\System\tSGiRal.exe
  C:\Windows\System\tSGiRal.exe
  2⤵
  PID:8264
- C:\Windows\System\msKzoOx.exe
  C:\Windows\System\msKzoOx.exe
  2⤵
  PID:9320
- C:\Windows\System\bfGQzYF.exe
  C:\Windows\System\bfGQzYF.exe
  2⤵
  PID:9268
- C:\Windows\System\AVVoifD.exe
  C:\Windows\System\AVVoifD.exe
  2⤵
  PID:9484
- C:\Windows\System\VhLrNwK.exe
  C:\Windows\System\VhLrNwK.exe
  2⤵
  PID:10216
- C:\Windows\System\hZoTJZH.exe
  C:\Windows\System\hZoTJZH.exe
  2⤵
  PID:10236
- C:\Windows\System\bpyKqfO.exe
  C:\Windows\System\bpyKqfO.exe
  2⤵
  PID:9228
- C:\Windows\System\GuWNeqD.exe
  C:\Windows\System\GuWNeqD.exe
  2⤵
  PID:9304
- C:\Windows\System\HIsGyHI.exe
  C:\Windows\System\HIsGyHI.exe
  2⤵
  PID:9384
- C:\Windows\System\mwBvXKF.exe
  C:\Windows\System\mwBvXKF.exe
  2⤵
  PID:9400
- C:\Windows\System\BCqlPVr.exe
  C:\Windows\System\BCqlPVr.exe
  2⤵
  PID:9792
- C:\Windows\System\ZujonEh.exe
  C:\Windows\System\ZujonEh.exe
  2⤵
  PID:9828
- C:\Windows\System\LVaZzLU.exe
  C:\Windows\System\LVaZzLU.exe
  2⤵
  PID:9772
- C:\Windows\System\soRvmis.exe
  C:\Windows\System\soRvmis.exe
  2⤵
  PID:9836
- C:\Windows\System\BSzaGOg.exe
  C:\Windows\System\BSzaGOg.exe
  2⤵
  PID:9868
- C:\Windows\System\GZQcyZe.exe
  C:\Windows\System\GZQcyZe.exe
  2⤵
  PID:9932
- C:\Windows\System\xLpDqQu.exe
  C:\Windows\System\xLpDqQu.exe
  2⤵
  PID:996
- C:\Windows\System\plUbHMG.exe
  C:\Windows\System\plUbHMG.exe
  2⤵
  PID:10012
- C:\Windows\System\utWRBEU.exe
  C:\Windows\System\utWRBEU.exe
  2⤵
  PID:10028
- C:\Windows\System\OxDoIFg.exe
  C:\Windows\System\OxDoIFg.exe
  2⤵
  PID:10088
- C:\Windows\System\AhzLUfw.exe
  C:\Windows\System\AhzLUfw.exe
  2⤵
  PID:10192
- C:\Windows\System\PAnXouh.exe
  C:\Windows\System\PAnXouh.exe
  2⤵
  PID:10108
- C:\Windows\System\SJWMBFk.exe
  C:\Windows\System\SJWMBFk.exe
  2⤵
  PID:9288
- C:\Windows\System\hDsjYua.exe
  C:\Windows\System\hDsjYua.exe
  2⤵
  PID:10160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EHAudYO.exe

Filesize
1.8MB

MD5
ea3ce84f6af111a1f079c2247c4f1249

SHA1
5b502ebc66732138e463c66939c8191a94c041d3

SHA256
52eb14858bf17425880728eb481f879ae95270e2afbf8a58e5685dac6dd6bd58

SHA512
f6055771c1e25c439da466e54efc26be319abc1f5c01a6817485fa566977848472ad58a6e5fd951445454e386a6866fd68dc191107f41fa52f5ded23141b267d

Download Submit
C:\Windows\system\FFXseyW.exe

Filesize
1.8MB

MD5
bedaf92f9f810a3e8ac6c1b36045efa8

SHA1
23c79df20246c9fd80b8a5a010f54fbeab40a3ee

SHA256
89e482e52798bae5399e97086391c20431a6c44dd3639475137cf411566956a5

SHA512
a375a30b044492dc202f5d2ffb3b6cf759fe489cf1b82275c6ad3dc9a591e3289a9d62ad1a468693f59bec4be893b386b62a6f16d20efd8db9125a0b33957c3f

Download Submit
C:\Windows\system\HBwMzNf.exe

Filesize
1.8MB

MD5
5cf347820a5bcc37fc729133720b9dcd

SHA1
a588826527870864f2dbee9fc41a65f559fbac9c

SHA256
b3867779280a97e487e433ac3589561a806ff5cb1b574d1ab68da2d3bca5176b

SHA512
505f6a88e15e2e1f1a365784c9116b67012dd7572013aa3b164273f40780c48d76ec1fb2b20fe0353bc98d02f33374e63c06c13fd6e5ac09786f787bd9297324

Download Submit
C:\Windows\system\HoPfXdh.exe

Filesize
1.8MB

MD5
c039741c63d1eb72b6fc408866f9cea0

SHA1
388fde90aeaf2cefb31b4d0aa6f3c08d8b5b0eb8

SHA256
8ea7d10e8cf740662200f8a3c3cd50360570958edd626c4bb888a0129d272112

SHA512
1fe4cd3a389204ffcbd0961592a7f8804faf9a11689bef26e9fc5c2b63d5e65245c0c400c649288ab85253ac387daf2c405b443bb7e4ff1b7e59b5eaa548187e

Download Submit
C:\Windows\system\IcwExMS.exe

Filesize
1.8MB

MD5
d38688a4af986fbfb437f3c8a16cfd3b

SHA1
b82e3ed466d3dca1d2b695af659bf0e1363f0863

SHA256
8dfe07ec031e68fad1b164a4c985ec4a2af0b3a848fb3206de4942798d4ce8db

SHA512
3f27eff56e5e38430ababd0c37e95193322c8d06ee3a95af948cfeda1d2ae851adacdfc58a19a9464c1f15bedbefb525acd62f0318d3b88a08af4fb4155e5375

Download Submit
C:\Windows\system\JOdJlAM.exe

Filesize
1.8MB

MD5
db08a0ea4f307368de697696c9422558

SHA1
137f50b5850af328e05f8ea0e20e0e5db8bba4a3

SHA256
43f908b5a74434d480af515a219f7231e38ba81484cd48ae1dedc11d7dca1c41

SHA512
1d3142a072fa9c751d44f964fc690d1e6b92767996af089dceaad756a0a49b7db3a3f76badcca31ff9d839875e9aeb924c8ca3d319fa10641b4e29c6faa1720f

Download Submit
C:\Windows\system\JPREtsV.exe

Filesize
1.8MB

MD5
0a5e758f953c1e09ed7d5500b68b1daa

SHA1
4c61969639d5e237cc8df2815aa10e0e26d3b925

SHA256
60162a5d647d26b0ef28ee47a033d2207e4c7b3a3c1c62e3f739997be5fb47de

SHA512
633f4c1c7d2b2b6925cfcd62527509ab3e9cb308a05126479a0361f3de04c99fdf0c9238b75f3010c1a93e6c51c800862dfaa207dfe23c072abfd8b51490b2ef

Download Submit
C:\Windows\system\OXCBWZQ.exe

Filesize
1.8MB

MD5
2b7ab581ab350066eb2934d70c403686

SHA1
3f52e98d04176544659c9235c1444f424fdf7c25

SHA256
d8c0ce4530c853a17ce2621a84492668928b68be996f38133cf2c1beb41e5d98

SHA512
babb4e01dc42eee7a205ae510ca4be20a536cecbe4b9228fd73bcbc1b285aba6f799fb254129172748fcf4bec13620f982c44973d78dcc35151e89f48f45c62a

Download Submit
C:\Windows\system\SPaIEMf.exe

Filesize
1.8MB

MD5
3fcfffe3f16de0965f2f4d604e9b5d8b

SHA1
35c0dfb42e022f97d4489cf6cb26c40f8c764573

SHA256
0eeff80fb24f724f8e3cd17fee51fe21f53f8a9a29bee0e0032f487666fcf274

SHA512
c290a8e9fcf56ea13ff7f0c324fbc27cd91ccefaa0dc478b4c1777df06f5957e368370dde8d07262e7a33c9513b45524b4fb1ad0a97235ac8e24fce750f29190

Download Submit
C:\Windows\system\SRBLyCU.exe

Filesize
1.8MB

MD5
9b209ec48130f606e0944f14949cfd5f

SHA1
83e7713208ab685886cf403593b33f37ca35fb09

SHA256
c8f3c2d0acb68d1f23775881231bcc93a7289895da324c8f0288c15d4cf502b5

SHA512
94eecd56ee6f4dcc4adc515444cd0b27ce59393a00ddcce9d7a35ade78bb1bf657b8617456f7b9ee4a532a1c0a1f3469541979b70d0c710c37dd9969c19739db

Download Submit
C:\Windows\system\SmLPVFq.exe

Filesize
1.8MB

MD5
88e713ab17d93c1268306116efd2c317

SHA1
bbd91b395317d45f16b801c2f7b272d8c53862eb

SHA256
98b0111334864d7fae1c99513ee4c5843c71b403038a93a81a7baabcc0e1e5b3

SHA512
ac2759141cf97d9c2511318b6cae0f89a195db4daf9e36fb55ab9b4eb13dd996051fdf2c8c2038e68344fd3ad0c80a344d17e8623b2ca53545fe07993fd0614d

Download Submit
C:\Windows\system\TlHyCFG.exe

Filesize
1.8MB

MD5
3b1c815d6ffbddcdc6fb03aff1589ddd

SHA1
cb050816cd2ecfb5308e29f80f4c3e4e2344cf15

SHA256
11815b027757179cff86c732a571e3dc26917962e23a1f61da3695ac098406b7

SHA512
c8b60811e992c43e7eca32729582179c06b0d522c1dde40560f189f63922834a3fb828702ad3a8a53eb9617f190d930c331ec472056319ace26fe2584cd2a10c

Download Submit
C:\Windows\system\UijVRzS.exe

Filesize
1.8MB

MD5
a41e95eb109ce54dc2e32fab0b74c16f

SHA1
1595d098f625879e6eac822e6fb614dee6c37416

SHA256
a77709cbecbde5ef9733254bc548552b78002d6482e8542b610a7d60858bddcf

SHA512
55d6fee46780165395141d0232585ad0b2feb1c5487a64509a0612c0ae8115b424eddeefaa685d61701590ea4d30b8de6a11552f5479fc4f36be2ef222767840

Download Submit
C:\Windows\system\XhZyDRE.exe

Filesize
1.8MB

MD5
02c097cc8d6544e940b7a32027bf8a14

SHA1
142c408e0a129f6a86c62c5608d909fd53faad9d

SHA256
49e5b4422dd07baf67955727ff1d443d3295c1af008ecf64e6f9b3b5b5bef73e

SHA512
18f499ddc219b77d5903c685bcfb8760f392fadc79809021787501a221341288900ed33f372fd3a392ea72dce5cadd56b5524a6ae8dc7fedbec84b9655de4cda

Download Submit
C:\Windows\system\XrrTdws.exe

Filesize
1.8MB

MD5
7523a2c15f7dcd62fb342496ee1e9ccb

SHA1
19bd93ed91ff457fdd98da83e0335df353ca248f

SHA256
a69e791127a9de009705d6d3dffa37467fb1df1e819bb142fc82ee7fe7632d01

SHA512
8ac108224f6b45b2078547ef5b5d7e9402dc8ca4b30a63873ed46c9a20f705ce3c7e696a2250514dbbade1ee5c44b53bcf2f1423f6fc3905d9985130a596038c

Download Submit
C:\Windows\system\YcvVRcA.exe

Filesize
1.8MB

MD5
91cc151897d03c4d61260f2c0f5cab7f

SHA1
5a1dedf0e812d2344f4add86855fcbdcded2473f

SHA256
6e5b420bf940e298cbce5c8233d1ab8ba92f0ccac87e94221e850d14fba269d7

SHA512
607e1a295bd76c128a446a94568cb13dee696a4896f2fd7480f2b6707772c036575aa12e985fbcb598e34b3dc8e423e53cb942ab03c27ce757df78ea4cb8aa0e

Download Submit
C:\Windows\system\ZigjFph.exe

Filesize
1.8MB

MD5
6a81190ca8fb1baa6c7da1ea98264115

SHA1
8d52f4c1945370859e1f9d48ab5148d6e7f8eed9

SHA256
252714f99d018b36aeaa3a79e3daed31f42b8e335d4859108abc73408d594f19

SHA512
16a79ba94e8b474e738fee4b2b28b487136d20e281af09a5fb649d8e9d66f232a162aa72b45853ff7ce0bd190352559303fb8e455e7cef4e1b3162521a09bbcc

Download Submit
C:\Windows\system\aLyDRwq.exe

Filesize
1.8MB

MD5
cd5a1f8c7aa61f65faeb4980d8cde01f

SHA1
08c76c3a59e9fdd7a0c872716e4e1c56d78ee828

SHA256
4ccb664e145a0eb4888e629b806ba738e2f1e5b10313c671ee5bfce89130bdf6

SHA512
42f824d009b08511af19c2be96fa7c713686c705447ffd808f5ce342beaa9ba0b045d3155ff07d2abd9a6241833710d42b67d9a67e7db5ce594dc0b677bbd256

Download Submit
C:\Windows\system\cCzeGzq.exe

Filesize
1.8MB

MD5
5c166af603a5265a7cf15c90e4804066

SHA1
73eaadc906ef249efa96134e81fde396fcb12494

SHA256
ccfb0b0c30bb659068f2fe105e2a2f70b53034d047303f0362d0265e565e6d2a

SHA512
81267d155d89e1fabab0721c86192e5c5d21388abe13363c0b8d74e777773af2dce5fda9af54ef2be7d26912e9830e403229554dfd689af7ca09416e62ccec45

Download Submit
C:\Windows\system\fgXoDCd.exe

Filesize
1.8MB

MD5
9bac8f7c48a6cb4a12dbdad9965d3718

SHA1
190742ca1c900e0f2f2ffb34fd89dd46377b2d39

SHA256
253cc1bb2d8409d650b95fe4af4add02def1524a783826153248f7b063494985

SHA512
5e590ad05d59aec32ce9768cb7038f1b2de2a9834713bc91360c22de929baf6749c6072d1546cb8d188659b90015abd98f27584641a082aae70fcd2617bcb3b2

Download Submit
C:\Windows\system\iVRwRNI.exe

Filesize
1.8MB

MD5
abd8d889fdef8361e0ce9c9ec1c2dd00

SHA1
4898892d7b3feb5ae83449faee178eb880ca2dc4

SHA256
81c59ca165ac5bafcf964c2ea69eee48d69248fe35a989597971ee53eb4b7970

SHA512
50de5c5d22e1d7f358a6ca9465a4686bfea77825ae4edc890c3bb8490b65f21e5ad7bb07125b890e847e403aab0fc1cf1a387268ba072c677a74770ddd2e29d3

Download Submit
C:\Windows\system\jkILnFs.exe

Filesize
1.8MB

MD5
b94b6350d9b0d6dd3fef7547446d21d2

SHA1
e42cc81d68f5b35e23394658ab8770d9415f5b8f

SHA256
7d929c6894199b7e3ed792a990c2ef5b27bde67ffdf4199fc5654b02552470ae

SHA512
a6bed40ba02339a1396c2806f21e4ed45125edf6d3b4b7713f6e90f1a82b12bbcd9858905104c8d01806f463e0c115c69e6d6e216500fafe8bbca87e251ebd8a

Download Submit
C:\Windows\system\jlIURDT.exe

Filesize
1.8MB

MD5
7ceb64b15b49ed236c940892b4b6f474

SHA1
8a37c3e018ea8615bd7c921eff51a4d23027bc09

SHA256
482f7764003a813d5feeafa19924b70fc03f33700bce8643fe453cded15c5da1

SHA512
ddd56fdc04e07be8ff5eed70979b91de774551651b25e7b30854aaa1e9841c37e7d66e368f723b863423a2dc9c28cec586ebc23c87d86994a403595c9c16f1bf

Download Submit
C:\Windows\system\llSGKpO.exe

Filesize
1.8MB

MD5
43cd37f7f37cd9b5332b1fbe3e2a77f6

SHA1
ae237f7650e5458be35d1657fe3b1ab9052a707c

SHA256
c94776b5b1b238e1870cb2f33efea9a6bfbed3e6727064a5b6b20405546638f1

SHA512
ae3880992c6825d7417c1989fcf7d177ae66f279e2e37bfc3c7bf55a0230ac126056d4f3ae3a8b3ab242ad514786b52220c413da9a835749c271bd48ffb125a5

Download Submit
C:\Windows\system\mWSFsIt.exe

Filesize
1.8MB

MD5
6f96aca208fa47f99f0fd9debce2b645

SHA1
fcddf6accc9c751bb6303d0f54958eaa5e965a57

SHA256
a4179def390ebbc1268bd8d92e4d769847a900755e0af8e59c936662cb6eb909

SHA512
31f144f0f1eef6eee494c73825d7ad0c1e6d51f2e2aa8af5f792c9c0325e7550b21899e81a7ac5a73324ec14e012063c5344686947562ace2f2dfa80340ef791

Download Submit
C:\Windows\system\mqDzrMk.exe

Filesize
1.8MB

MD5
c156b2a12acb87327cff27e6af550dc3

SHA1
0c6837ae85a645ff62149fe5d429b8b5f5aad05a

SHA256
342a3862836bcbaa97810ce4c01bea7842ca204c612eb4f986b1be01a9e69726

SHA512
13d96a58bbeaf8b789a2e38b62f761c7dad3a159cc618eda43764a97c310e117af169b3f836fa312dce240758b9a52732352f2af044bcb89547714cd46ccc061

Download Submit
C:\Windows\system\qzuBFch.exe

Filesize
1.8MB

MD5
cb1e6c85ceb9d2d384a460960d712fcd

SHA1
1940553f6d7757d6d5c16ea92364dd718f740894

SHA256
52be150b299e5e6d55b733cce1c7acdad1236e494c4caf0070223ac7bf290afa

SHA512
d4c6135996af163b0bcaebc3efb516511153aa9616e3c8e36368760254ca25812f9453a6316646f12421e5daf9d4a3a8dee50de0970998cd80cd5576c586b572

Download Submit
C:\Windows\system\rbRTAaM.exe

Filesize
1.8MB

MD5
db0b3a5b7ddb605a99e8f15f826a8dcf

SHA1
c80b1e04ace0b3f9768881251fe550c7ae1940e9

SHA256
657689afe8feec84dac2f18a0695ef63bd05b9315b99d95380190a7e149561a7

SHA512
6bf7bae14e4d9a128e99bf75ea88fd799cc39f77fe1c808c3d1b5ee6794e182479e6aa03b2603f65fcbf6e3d49d1a4495f5f2493307f16c5f4dc00504a89fcbe

Download Submit
C:\Windows\system\xRgljvQ.exe

Filesize
1.8MB

MD5
9495a214c0407f75e484bde3a4a919bc

SHA1
ae698779327fdd3d8a41248853f16b0245030cf6

SHA256
343c1ec1a9a8c93ac79aae8b280b525a06c40967e84bb32affc9a9a3b0601650

SHA512
55f52aa6b391e16ed080a23e4d5ab590c013393325792a4014941b2879a003bf9ed8d3d737875fa626d58996fb133542ea30fd241b9e3020a4016384aad12cc1

Download Submit
\Windows\system\RNXPZPA.exe

Filesize
1.8MB

MD5
8964333d976ebbe565866666696fa463

SHA1
fcdd3f49f36865ddfac55f291b3ad2b8b42bc99e

SHA256
f0444b237da1f2cea11ece9b1e8f8539937adfb63f91c6893057569668fa0718

SHA512
fb6490d0863542cf915600f794de5c25a5928baf3a136838cf677f1d69cc3f616b3a56658b7a0b43b26295639505ceb7f7c5163a21af1eaf77d0e13fccdc1d78

Download Submit
\Windows\system\ulklmwS.exe

Filesize
1.8MB

MD5
9c46bfb77b4fae2f582a093fd1946809

SHA1
93cf6756a89ff18abc7208132bc04a83c59d0d65

SHA256
567594ca6a2a2fa9b82a557eec4c5f532e09abe6416d1724bccdadc0a960d098

SHA512
54ec2e100b576d1154e5c6b467b43acf82c6d8fb43b1567b86d20adaa0552a801a87dac75f2150d0688036bb3ee6877c37888bbb69b8de838da5746f7c61da96

Download Submit
\Windows\system\vTzpjjU.exe

Filesize
1.8MB

MD5
9693fbfc205313cf88e5eba8cd7ffcad

SHA1
0551137585846c5f39d72f077334f3fb15e9c271

SHA256
7a8f3770fa0e86b0ad84e64d86ed858acea238fbbc6a3bbc0a07e7b7975e50a3

SHA512
232b64bf18161109d644aa949668eb894a94ff7c5eef3026c6eaab709e2844b02f324ced8fb09f9b91a1a29599efeeeba84f05c465c7afb0dc964ec88f361f12

Download Submit
memory/2248-479-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2448-487-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2524-406-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2532-491-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/2556-489-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2568-477-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2580-484-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2636-474-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2800-13-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2876-494-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/2876-475-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-490-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-488-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2876-492-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-0-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2876-486-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-480-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-478-0x0000000003290000-0x0000000003682000-memory.dmp

Filesize
3.9MB

Download
memory/2876-12-0x0000000003070000-0x0000000003462000-memory.dmp

Filesize
3.9MB

Download
memory/3028-476-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/3028-493-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-14-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/3028-369-0x00000000028A0000-0x0000000002920000-memory.dmp

Filesize
512KB

Download
memory/3028-368-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3028-30-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/3028-28-0x000000001B680000-0x000000001B962000-memory.dmp

Filesize
2.9MB

Download
memory/3028-621-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download