xmrig | e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524

Analysis

max time kernel
23s
max time network
22s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Size

2.3MB
MD5

06c56a6d346186f50aa7dc813c26dedb
SHA1

9b6482eb5194012964f0d246df25eaf1a8d475d0
SHA256

e2ec00b8eab9f6ad6b7f9aa60433e279221f66f19bd3cff173509ab8f15de524
SHA512

3d53442edaffcd90be88a61d5c2c3f1202f1785921dc0de6f7d38352dba3b7918a312e24aa44ca6b2956ed81283d939b0c32de2e9a12daf28b7c7a8fa0825cc6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDs:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2944-20-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2684-34-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2560-41-0x000000013FB10000-0x000000013FF02000-memory.dmp	xmrig
behavioral1/memory/2644-33-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/3000-23-0x000000013FFF0000-0x00000001403E2000-memory.dmp	xmrig
behavioral1/memory/2488-56-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2308-64-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2912-71-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig
behavioral1/memory/2916-88-0x000000013F660000-0x000000013FA52000-memory.dmp	xmrig
behavioral1/memory/2520-440-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2796-95-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2308-89-0x00000000036E0000-0x0000000003AD2000-memory.dmp	xmrig
behavioral1/memory/2308-70-0x000000013FCC0000-0x00000001400B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2944	KeNJeOI.exe
3000	UPVjmYW.exe
2644	prfWXsp.exe
2684	AWPlgzL.exe
2560	HFpSkue.exe
2520	hBQblYO.exe
2488	sEkyfPZ.exe
2896	TKZxSbq.exe
2912	zPTptnV.exe
2916	RTyzDMk.exe
2796	fJOANME.exe
2300	GXoRxNt.exe
2280	JQFxqTd.exe
1824	DWVYdzD.exe
1628	rdxvFpy.exe
2712	MXZLQoh.exe
2728	GUxuMGI.exe
2296	UOfNoqo.exe
1568	iRjLwsg.exe
1776	xwZSUrD.exe
2240	uUvdPeF.exe
2264	pGCaKhV.exe
2840	iyjyWfS.exe
2548	DDaeSoD.exe
804	BPpdZNh.exe
580	vBrVnPc.exe
3052	lFJAfyl.exe
268	GIjXrPK.exe
1496	dUEVdKH.exe
1872	SFmlUTD.exe
1360	rbIXzof.exe
1104	tOkmeAs.exe
2216	YBtHlJc.exe
820	jPXrLUv.exe
1372	mkTQZbr.exe
1788	tsWeNUS.exe
1348	dGbfnXj.exe
1148	nVSzdyI.exe
1028	bzKMLhQ.exe
1052	mELRmvn.exe
1044	CGbozbk.exe
1300	iaEsKtR.exe
2868	dMbgFfM.exe
2968	Zvfzwmo.exe
3004	lhtoLlh.exe
2992	lAgASuD.exe
1004	iWAynMK.exe
888	cCHZULw.exe
1508	EklWUyI.exe
3020	BnFRlQj.exe
1604	jFzzwTG.exe
2820	txtKuao.exe
2100	MTjXLDs.exe
2620	POEVCkW.exe
2524	LMTINTY.exe
2384	RBDyzyb.exe
2032	Ikjjnsj.exe
2592	FVMihWI.exe
2480	fVuoKye.exe
2536	GubyXwc.exe
2528	zCCubMC.exe
2788	zaajEyc.exe
1712	CZeuiqT.exe
548	fXmsiGE.exe

Loads dropped DLL 64 IoCs

pid	Process
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2308-2-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000c000000013187-3.dat	upx
behavioral1/files/0x0008000000013a46-16.dat	upx
behavioral1/files/0x0008000000013a3a-21.dat	upx
behavioral1/memory/2944-20-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2684-34-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/files/0x0008000000013a6e-35.dat	upx
behavioral1/memory/2560-41-0x000000013FB10000-0x000000013FF02000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-42.dat	upx
behavioral1/memory/2308-43-0x00000000036E0000-0x0000000003AD2000-memory.dmp	upx
behavioral1/memory/2644-33-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/memory/3000-23-0x000000013FFF0000-0x00000001403E2000-memory.dmp	upx
behavioral1/files/0x0032000000013420-11.dat	upx
behavioral1/files/0x000a00000001415f-52.dat	upx
behavioral1/memory/2488-56-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0008000000014597-57.dat	upx
behavioral1/memory/2308-64-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x000700000001469d-67.dat	upx
behavioral1/memory/2896-62-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2912-71-0x000000013FCC0000-0x00000001400B2000-memory.dmp	upx
behavioral1/files/0x00060000000146fc-78.dat	upx
behavioral1/files/0x00060000000146f4-72.dat	upx
behavioral1/memory/2916-88-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x0006000000014712-91.dat	upx
behavioral1/files/0x003200000001342c-96.dat	upx
behavioral1/files/0x0006000000014826-103.dat	upx
behavioral1/files/0x0006000000014a9a-115.dat	upx
behavioral1/files/0x0006000000014b18-118.dat	upx
behavioral1/files/0x0006000000015677-160.dat	upx
behavioral1/files/0x0006000000015c87-165.dat	upx
behavioral1/files/0x0006000000015cae-184.dat	upx
behavioral1/files/0x0006000000015c9e-181.dat	upx
behavioral1/memory/2520-440-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/files/0x0006000000015cb6-190.dat	upx
behavioral1/files/0x0006000000015684-179.dat	upx
behavioral1/files/0x000600000001565d-177.dat	upx
behavioral1/files/0x000600000001564f-175.dat	upx
behavioral1/files/0x0006000000014fa2-140.dat	upx
behavioral1/files/0x0006000000015653-152.dat	upx
behavioral1/files/0x000600000001535e-145.dat	upx
behavioral1/files/0x0006000000014e71-135.dat	upx
behavioral1/files/0x0006000000014bbc-130.dat	upx
behavioral1/files/0x0006000000014b4c-125.dat	upx
behavioral1/files/0x000600000001487f-110.dat	upx
behavioral1/files/0x000600000001471a-97.dat	upx
behavioral1/memory/2796-95-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QsLNDNK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\PVTVVYx.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\pTcQElC.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\cVRCLUI.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ynIVbgm.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\mHrVACx.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\LagfHjS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\nEnuqpB.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\vYPvBIO.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GrKzZsz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\nWYYvXk.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\wrhCPlf.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\TItSdzc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\GkAncxt.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OAGpCIS.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\auVjpeo.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\lYOmGIT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\NjOjubH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\bkDbyyD.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\FVMihWI.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ATovDWD.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\PZCBZEP.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EvDcaMQ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\yNZlExK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\xSaibkh.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\wORsvlv.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OaiIBBU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\lThQaim.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\aTzODbl.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\okOqukD.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\PVFDLHc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\nCpoVuL.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\EtPzJrl.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\OSwbwvI.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\VOVDljB.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\odTBxht.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\pvLHAZw.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jNunKqd.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZkeZpSK.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\APgqrOJ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\TbWylyc.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\eBLXGOZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\UOfNoqo.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\pHCUWpx.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dftTSgs.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\tGqrfTI.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\HouIbif.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\pfpPOjs.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\HFpSkue.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\woTMoFL.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\bKHtgfT.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\HvrgJFq.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\jPXrLUv.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rHElsdb.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\aklyfpZ.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZWHNNYf.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\VljSIQz.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\TFHMkLE.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\dXRhXRE.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\rbIXzof.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\beehBBp.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\SgfZKoU.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\eRoTYkH.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
File created	C:\Windows\System\ZqkxfXL.exe	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2196	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	29
PID 2308 wrote to memory of 2196	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	29
PID 2308 wrote to memory of 2196	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	29
PID 2308 wrote to memory of 2944	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2944	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	30
PID 2308 wrote to memory of 2944	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	30
PID 2308 wrote to memory of 3000	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3000	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	31
PID 2308 wrote to memory of 3000	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	31
PID 2308 wrote to memory of 2644	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	32
PID 2308 wrote to memory of 2644	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	32
PID 2308 wrote to memory of 2644	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	32
PID 2308 wrote to memory of 2684	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2684	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2684	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	33
PID 2308 wrote to memory of 2560	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	34
PID 2308 wrote to memory of 2560	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	34
PID 2308 wrote to memory of 2560	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	34
PID 2308 wrote to memory of 2520	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	35
PID 2308 wrote to memory of 2520	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	35
PID 2308 wrote to memory of 2520	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	35
PID 2308 wrote to memory of 2488	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	36
PID 2308 wrote to memory of 2488	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	36
PID 2308 wrote to memory of 2488	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	36
PID 2308 wrote to memory of 2896	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	37
PID 2308 wrote to memory of 2896	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	37
PID 2308 wrote to memory of 2896	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	37
PID 2308 wrote to memory of 2912	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	38
PID 2308 wrote to memory of 2912	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	38
PID 2308 wrote to memory of 2912	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	38
PID 2308 wrote to memory of 2796	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	39
PID 2308 wrote to memory of 2796	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	39
PID 2308 wrote to memory of 2796	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	39
PID 2308 wrote to memory of 2916	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	40
PID 2308 wrote to memory of 2916	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	40
PID 2308 wrote to memory of 2916	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	40
PID 2308 wrote to memory of 2280	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	41
PID 2308 wrote to memory of 2280	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	41
PID 2308 wrote to memory of 2280	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	41
PID 2308 wrote to memory of 2300	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	42
PID 2308 wrote to memory of 2300	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	42
PID 2308 wrote to memory of 2300	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	42
PID 2308 wrote to memory of 1628	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	43
PID 2308 wrote to memory of 1628	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	43
PID 2308 wrote to memory of 1628	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	43
PID 2308 wrote to memory of 1824	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	44
PID 2308 wrote to memory of 1824	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	44
PID 2308 wrote to memory of 1824	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	44
PID 2308 wrote to memory of 2712	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	45
PID 2308 wrote to memory of 2712	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	45
PID 2308 wrote to memory of 2712	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	45
PID 2308 wrote to memory of 2728	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	46
PID 2308 wrote to memory of 2728	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	46
PID 2308 wrote to memory of 2728	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	46
PID 2308 wrote to memory of 2296	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	47
PID 2308 wrote to memory of 2296	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	47
PID 2308 wrote to memory of 2296	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	47
PID 2308 wrote to memory of 1568	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	48
PID 2308 wrote to memory of 1568	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	48
PID 2308 wrote to memory of 1568	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	48
PID 2308 wrote to memory of 1776	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	49
PID 2308 wrote to memory of 1776	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	49
PID 2308 wrote to memory of 1776	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	49
PID 2308 wrote to memory of 2240	2308	06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\06c56a6d346186f50aa7dc813c26dedb_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\KeNJeOI.exe
  C:\Windows\System\KeNJeOI.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\UPVjmYW.exe
  C:\Windows\System\UPVjmYW.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\prfWXsp.exe
  C:\Windows\System\prfWXsp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\AWPlgzL.exe
  C:\Windows\System\AWPlgzL.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\HFpSkue.exe
  C:\Windows\System\HFpSkue.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\hBQblYO.exe
  C:\Windows\System\hBQblYO.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\sEkyfPZ.exe
  C:\Windows\System\sEkyfPZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\TKZxSbq.exe
  C:\Windows\System\TKZxSbq.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\zPTptnV.exe
  C:\Windows\System\zPTptnV.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\fJOANME.exe
  C:\Windows\System\fJOANME.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\RTyzDMk.exe
  C:\Windows\System\RTyzDMk.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\JQFxqTd.exe
  C:\Windows\System\JQFxqTd.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\GXoRxNt.exe
  C:\Windows\System\GXoRxNt.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\rdxvFpy.exe
  C:\Windows\System\rdxvFpy.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\DWVYdzD.exe
  C:\Windows\System\DWVYdzD.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\MXZLQoh.exe
  C:\Windows\System\MXZLQoh.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\GUxuMGI.exe
  C:\Windows\System\GUxuMGI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\UOfNoqo.exe
  C:\Windows\System\UOfNoqo.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\iRjLwsg.exe
  C:\Windows\System\iRjLwsg.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\xwZSUrD.exe
  C:\Windows\System\xwZSUrD.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\uUvdPeF.exe
  C:\Windows\System\uUvdPeF.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\pGCaKhV.exe
  C:\Windows\System\pGCaKhV.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\iyjyWfS.exe
  C:\Windows\System\iyjyWfS.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\lFJAfyl.exe
  C:\Windows\System\lFJAfyl.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\DDaeSoD.exe
  C:\Windows\System\DDaeSoD.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\GIjXrPK.exe
  C:\Windows\System\GIjXrPK.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\BPpdZNh.exe
  C:\Windows\System\BPpdZNh.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\dUEVdKH.exe
  C:\Windows\System\dUEVdKH.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\vBrVnPc.exe
  C:\Windows\System\vBrVnPc.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\SFmlUTD.exe
  C:\Windows\System\SFmlUTD.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\rbIXzof.exe
  C:\Windows\System\rbIXzof.exe
  2⤵
  - Executes dropped EXE
  PID:1360
- C:\Windows\System\tOkmeAs.exe
  C:\Windows\System\tOkmeAs.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\YBtHlJc.exe
  C:\Windows\System\YBtHlJc.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\jPXrLUv.exe
  C:\Windows\System\jPXrLUv.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\mkTQZbr.exe
  C:\Windows\System\mkTQZbr.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\tsWeNUS.exe
  C:\Windows\System\tsWeNUS.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\dGbfnXj.exe
  C:\Windows\System\dGbfnXj.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\nVSzdyI.exe
  C:\Windows\System\nVSzdyI.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\bzKMLhQ.exe
  C:\Windows\System\bzKMLhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\mELRmvn.exe
  C:\Windows\System\mELRmvn.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\CGbozbk.exe
  C:\Windows\System\CGbozbk.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\iaEsKtR.exe
  C:\Windows\System\iaEsKtR.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\dMbgFfM.exe
  C:\Windows\System\dMbgFfM.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\lhtoLlh.exe
  C:\Windows\System\lhtoLlh.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\Zvfzwmo.exe
  C:\Windows\System\Zvfzwmo.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\lAgASuD.exe
  C:\Windows\System\lAgASuD.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\iWAynMK.exe
  C:\Windows\System\iWAynMK.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\EklWUyI.exe
  C:\Windows\System\EklWUyI.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\cCHZULw.exe
  C:\Windows\System\cCHZULw.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\MTjXLDs.exe
  C:\Windows\System\MTjXLDs.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\BnFRlQj.exe
  C:\Windows\System\BnFRlQj.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\RBDyzyb.exe
  C:\Windows\System\RBDyzyb.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\jFzzwTG.exe
  C:\Windows\System\jFzzwTG.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\Ikjjnsj.exe
  C:\Windows\System\Ikjjnsj.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\txtKuao.exe
  C:\Windows\System\txtKuao.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FVMihWI.exe
  C:\Windows\System\FVMihWI.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\POEVCkW.exe
  C:\Windows\System\POEVCkW.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\fVuoKye.exe
  C:\Windows\System\fVuoKye.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\LMTINTY.exe
  C:\Windows\System\LMTINTY.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\GubyXwc.exe
  C:\Windows\System\GubyXwc.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\zCCubMC.exe
  C:\Windows\System\zCCubMC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\zaajEyc.exe
  C:\Windows\System\zaajEyc.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\CZeuiqT.exe
  C:\Windows\System\CZeuiqT.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\fXmsiGE.exe
  C:\Windows\System\fXmsiGE.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\wCCdToG.exe
  C:\Windows\System\wCCdToG.exe
  2⤵
  PID:2636
- C:\Windows\System\JGAMcjn.exe
  C:\Windows\System\JGAMcjn.exe
  2⤵
  PID:1440
- C:\Windows\System\JvWxnLo.exe
  C:\Windows\System\JvWxnLo.exe
  2⤵
  PID:1248
- C:\Windows\System\GrKzZsz.exe
  C:\Windows\System\GrKzZsz.exe
  2⤵
  PID:2104
- C:\Windows\System\GUyscRt.exe
  C:\Windows\System\GUyscRt.exe
  2⤵
  PID:1056
- C:\Windows\System\HifXgfP.exe
  C:\Windows\System\HifXgfP.exe
  2⤵
  PID:2236
- C:\Windows\System\ojVBJBU.exe
  C:\Windows\System\ojVBJBU.exe
  2⤵
  PID:2844
- C:\Windows\System\iwRsvbo.exe
  C:\Windows\System\iwRsvbo.exe
  2⤵
  PID:488
- C:\Windows\System\VGlYGHB.exe
  C:\Windows\System\VGlYGHB.exe
  2⤵
  PID:852
- C:\Windows\System\dCYGkga.exe
  C:\Windows\System\dCYGkga.exe
  2⤵
  PID:2292
- C:\Windows\System\DYRHOXO.exe
  C:\Windows\System\DYRHOXO.exe
  2⤵
  PID:1816
- C:\Windows\System\pHCUWpx.exe
  C:\Windows\System\pHCUWpx.exe
  2⤵
  PID:1888
- C:\Windows\System\aKkrGHa.exe
  C:\Windows\System\aKkrGHa.exe
  2⤵
  PID:1292
- C:\Windows\System\REbNztU.exe
  C:\Windows\System\REbNztU.exe
  2⤵
  PID:1556
- C:\Windows\System\mlIZdpW.exe
  C:\Windows\System\mlIZdpW.exe
  2⤵
  PID:2668
- C:\Windows\System\zULsNvj.exe
  C:\Windows\System\zULsNvj.exe
  2⤵
  PID:652
- C:\Windows\System\SuxWZFN.exe
  C:\Windows\System\SuxWZFN.exe
  2⤵
  PID:2884
- C:\Windows\System\xdGUXgp.exe
  C:\Windows\System\xdGUXgp.exe
  2⤵
  PID:924
- C:\Windows\System\ofjbDrx.exe
  C:\Windows\System\ofjbDrx.exe
  2⤵
  PID:1596
- C:\Windows\System\lNVvfGM.exe
  C:\Windows\System\lNVvfGM.exe
  2⤵
  PID:2808
- C:\Windows\System\omKBePr.exe
  C:\Windows\System\omKBePr.exe
  2⤵
  PID:1772
- C:\Windows\System\PVTVVYx.exe
  C:\Windows\System\PVTVVYx.exe
  2⤵
  PID:1036
- C:\Windows\System\vQfKZKZ.exe
  C:\Windows\System\vQfKZKZ.exe
  2⤵
  PID:2600
- C:\Windows\System\QvVRppO.exe
  C:\Windows\System\QvVRppO.exe
  2⤵
  PID:2936
- C:\Windows\System\JZTCwOz.exe
  C:\Windows\System\JZTCwOz.exe
  2⤵
  PID:2168
- C:\Windows\System\BHBdQjc.exe
  C:\Windows\System\BHBdQjc.exe
  2⤵
  PID:1336
- C:\Windows\System\lOUpmbn.exe
  C:\Windows\System\lOUpmbn.exe
  2⤵
  PID:2628
- C:\Windows\System\CqogZJb.exe
  C:\Windows\System\CqogZJb.exe
  2⤵
  PID:2580
- C:\Windows\System\cdVSoIk.exe
  C:\Windows\System\cdVSoIk.exe
  2⤵
  PID:2648
- C:\Windows\System\EnHALEx.exe
  C:\Windows\System\EnHALEx.exe
  2⤵
  PID:2376
- C:\Windows\System\FIpIkzK.exe
  C:\Windows\System\FIpIkzK.exe
  2⤵
  PID:2332
- C:\Windows\System\XCVJTBd.exe
  C:\Windows\System\XCVJTBd.exe
  2⤵
  PID:848
- C:\Windows\System\SrutEvX.exe
  C:\Windows\System\SrutEvX.exe
  2⤵
  PID:1812
- C:\Windows\System\axrfdru.exe
  C:\Windows\System\axrfdru.exe
  2⤵
  PID:2276
- C:\Windows\System\kaSDJpE.exe
  C:\Windows\System\kaSDJpE.exe
  2⤵
  PID:332
- C:\Windows\System\kyMjQzr.exe
  C:\Windows\System\kyMjQzr.exe
  2⤵
  PID:1632
- C:\Windows\System\QpCyTvh.exe
  C:\Windows\System\QpCyTvh.exe
  2⤵
  PID:2148
- C:\Windows\System\aoopCgQ.exe
  C:\Windows\System\aoopCgQ.exe
  2⤵
  PID:708
- C:\Windows\System\KqIPhQB.exe
  C:\Windows\System\KqIPhQB.exe
  2⤵
  PID:2676
- C:\Windows\System\zljbmqi.exe
  C:\Windows\System\zljbmqi.exe
  2⤵
  PID:2972
- C:\Windows\System\noOoIYS.exe
  C:\Windows\System\noOoIYS.exe
  2⤵
  PID:1984
- C:\Windows\System\ATovDWD.exe
  C:\Windows\System\ATovDWD.exe
  2⤵
  PID:896
- C:\Windows\System\wOEdpgR.exe
  C:\Windows\System\wOEdpgR.exe
  2⤵
  PID:2932
- C:\Windows\System\kEHCKQj.exe
  C:\Windows\System\kEHCKQj.exe
  2⤵
  PID:2800
- C:\Windows\System\TxHkXbK.exe
  C:\Windows\System\TxHkXbK.exe
  2⤵
  PID:2208
- C:\Windows\System\FKkDsPw.exe
  C:\Windows\System\FKkDsPw.exe
  2⤵
  PID:2532
- C:\Windows\System\iAqlhNK.exe
  C:\Windows\System\iAqlhNK.exe
  2⤵
  PID:2704
- C:\Windows\System\DdtgTKt.exe
  C:\Windows\System\DdtgTKt.exe
  2⤵
  PID:3088
- C:\Windows\System\VpjjKNa.exe
  C:\Windows\System\VpjjKNa.exe
  2⤵
  PID:3104
- C:\Windows\System\PZCBZEP.exe
  C:\Windows\System\PZCBZEP.exe
  2⤵
  PID:3120
- C:\Windows\System\hQVcnmV.exe
  C:\Windows\System\hQVcnmV.exe
  2⤵
  PID:3136
- C:\Windows\System\hzSxYvJ.exe
  C:\Windows\System\hzSxYvJ.exe
  2⤵
  PID:3152
- C:\Windows\System\RAkYcdk.exe
  C:\Windows\System\RAkYcdk.exe
  2⤵
  PID:3168
- C:\Windows\System\CQbxYpb.exe
  C:\Windows\System\CQbxYpb.exe
  2⤵
  PID:3184
- C:\Windows\System\hOLaUvZ.exe
  C:\Windows\System\hOLaUvZ.exe
  2⤵
  PID:3204
- C:\Windows\System\CRcGVJb.exe
  C:\Windows\System\CRcGVJb.exe
  2⤵
  PID:3220
- C:\Windows\System\UkjlcGx.exe
  C:\Windows\System\UkjlcGx.exe
  2⤵
  PID:3236
- C:\Windows\System\msieUoY.exe
  C:\Windows\System\msieUoY.exe
  2⤵
  PID:3332
- C:\Windows\System\efAMXzt.exe
  C:\Windows\System\efAMXzt.exe
  2⤵
  PID:3356
- C:\Windows\System\ZAsNrzC.exe
  C:\Windows\System\ZAsNrzC.exe
  2⤵
  PID:3392
- C:\Windows\System\xhplbUz.exe
  C:\Windows\System\xhplbUz.exe
  2⤵
  PID:3416
- C:\Windows\System\wTRbsAM.exe
  C:\Windows\System\wTRbsAM.exe
  2⤵
  PID:3472
- C:\Windows\System\eQShxHW.exe
  C:\Windows\System\eQShxHW.exe
  2⤵
  PID:3508
- C:\Windows\System\pQsrHgY.exe
  C:\Windows\System\pQsrHgY.exe
  2⤵
  PID:3528
- C:\Windows\System\jxzoroF.exe
  C:\Windows\System\jxzoroF.exe
  2⤵
  PID:3548
- C:\Windows\System\OWIDtlf.exe
  C:\Windows\System\OWIDtlf.exe
  2⤵
  PID:3568
- C:\Windows\System\ZYxuOEa.exe
  C:\Windows\System\ZYxuOEa.exe
  2⤵
  PID:3588
- C:\Windows\System\KbkuahU.exe
  C:\Windows\System\KbkuahU.exe
  2⤵
  PID:3608
- C:\Windows\System\MZbJtOn.exe
  C:\Windows\System\MZbJtOn.exe
  2⤵
  PID:3628
- C:\Windows\System\TugWDfw.exe
  C:\Windows\System\TugWDfw.exe
  2⤵
  PID:3648
- C:\Windows\System\StEIjlY.exe
  C:\Windows\System\StEIjlY.exe
  2⤵
  PID:3668
- C:\Windows\System\tLeByut.exe
  C:\Windows\System\tLeByut.exe
  2⤵
  PID:3688
- C:\Windows\System\okVHfBz.exe
  C:\Windows\System\okVHfBz.exe
  2⤵
  PID:3708
- C:\Windows\System\WRvGOfH.exe
  C:\Windows\System\WRvGOfH.exe
  2⤵
  PID:3728
- C:\Windows\System\iGFUnFa.exe
  C:\Windows\System\iGFUnFa.exe
  2⤵
  PID:3748
- C:\Windows\System\XphyVAe.exe
  C:\Windows\System\XphyVAe.exe
  2⤵
  PID:3768
- C:\Windows\System\ufgfAVN.exe
  C:\Windows\System\ufgfAVN.exe
  2⤵
  PID:3788
- C:\Windows\System\QJfElqS.exe
  C:\Windows\System\QJfElqS.exe
  2⤵
  PID:3808
- C:\Windows\System\TxZKyxS.exe
  C:\Windows\System\TxZKyxS.exe
  2⤵
  PID:3828
- C:\Windows\System\qbSDRgX.exe
  C:\Windows\System\qbSDRgX.exe
  2⤵
  PID:3848
- C:\Windows\System\VrQlBqD.exe
  C:\Windows\System\VrQlBqD.exe
  2⤵
  PID:3872
- C:\Windows\System\yqhOgwl.exe
  C:\Windows\System\yqhOgwl.exe
  2⤵
  PID:3888
- C:\Windows\System\OyAtklJ.exe
  C:\Windows\System\OyAtklJ.exe
  2⤵
  PID:3908
- C:\Windows\System\ydfIBFK.exe
  C:\Windows\System\ydfIBFK.exe
  2⤵
  PID:3924
- C:\Windows\System\yWJDWOs.exe
  C:\Windows\System\yWJDWOs.exe
  2⤵
  PID:3944
- C:\Windows\System\mHXZPUx.exe
  C:\Windows\System\mHXZPUx.exe
  2⤵
  PID:3964
- C:\Windows\System\Kyeannk.exe
  C:\Windows\System\Kyeannk.exe
  2⤵
  PID:3992
- C:\Windows\System\DCxNkmW.exe
  C:\Windows\System\DCxNkmW.exe
  2⤵
  PID:4008
- C:\Windows\System\heXeKhl.exe
  C:\Windows\System\heXeKhl.exe
  2⤵
  PID:4024
- C:\Windows\System\cbMgzxt.exe
  C:\Windows\System\cbMgzxt.exe
  2⤵
  PID:4040
- C:\Windows\System\cJLSAtw.exe
  C:\Windows\System\cJLSAtw.exe
  2⤵
  PID:4056
- C:\Windows\System\MfXDBlg.exe
  C:\Windows\System\MfXDBlg.exe
  2⤵
  PID:4072
- C:\Windows\System\HiZwfsr.exe
  C:\Windows\System\HiZwfsr.exe
  2⤵
  PID:4088
- C:\Windows\System\MHPgSeA.exe
  C:\Windows\System\MHPgSeA.exe
  2⤵
  PID:448
- C:\Windows\System\pVpJADF.exe
  C:\Windows\System\pVpJADF.exe
  2⤵
  PID:1688
- C:\Windows\System\FANWeMs.exe
  C:\Windows\System\FANWeMs.exe
  2⤵
  PID:2012
- C:\Windows\System\CAJOOlO.exe
  C:\Windows\System\CAJOOlO.exe
  2⤵
  PID:1716
- C:\Windows\System\lwQdAsr.exe
  C:\Windows\System\lwQdAsr.exe
  2⤵
  PID:2024
- C:\Windows\System\haOzyuv.exe
  C:\Windows\System\haOzyuv.exe
  2⤵
  PID:1560
- C:\Windows\System\tABkDrE.exe
  C:\Windows\System\tABkDrE.exe
  2⤵
  PID:1608
- C:\Windows\System\PKyARGO.exe
  C:\Windows\System\PKyARGO.exe
  2⤵
  PID:2880
- C:\Windows\System\vBRHCKi.exe
  C:\Windows\System\vBRHCKi.exe
  2⤵
  PID:2452
- C:\Windows\System\LwUWuYz.exe
  C:\Windows\System\LwUWuYz.exe
  2⤵
  PID:3084
- C:\Windows\System\kyAjPhI.exe
  C:\Windows\System\kyAjPhI.exe
  2⤵
  PID:3180
- C:\Windows\System\lCwrNeW.exe
  C:\Windows\System\lCwrNeW.exe
  2⤵
  PID:3252
- C:\Windows\System\JqtIJri.exe
  C:\Windows\System\JqtIJri.exe
  2⤵
  PID:3268
- C:\Windows\System\Bxuwbfc.exe
  C:\Windows\System\Bxuwbfc.exe
  2⤵
  PID:3280
- C:\Windows\System\UCDcFTi.exe
  C:\Windows\System\UCDcFTi.exe
  2⤵
  PID:3296
- C:\Windows\System\VgTAdMi.exe
  C:\Windows\System\VgTAdMi.exe
  2⤵
  PID:3320
- C:\Windows\System\jjFxWoc.exe
  C:\Windows\System\jjFxWoc.exe
  2⤵
  PID:628
- C:\Windows\System\nMDcPPK.exe
  C:\Windows\System\nMDcPPK.exe
  2⤵
  PID:3384
- C:\Windows\System\KAadHdx.exe
  C:\Windows\System\KAadHdx.exe
  2⤵
  PID:2664
- C:\Windows\System\xUhoUcY.exe
  C:\Windows\System\xUhoUcY.exe
  2⤵
  PID:2848
- C:\Windows\System\ywRClgU.exe
  C:\Windows\System\ywRClgU.exe
  2⤵
  PID:3128
- C:\Windows\System\wqXFKMq.exe
  C:\Windows\System\wqXFKMq.exe
  2⤵
  PID:3200
- C:\Windows\System\YNQwQRg.exe
  C:\Windows\System\YNQwQRg.exe
  2⤵
  PID:588
- C:\Windows\System\rQNzFuf.exe
  C:\Windows\System\rQNzFuf.exe
  2⤵
  PID:1660
- C:\Windows\System\eEWCUsL.exe
  C:\Windows\System\eEWCUsL.exe
  2⤵
  PID:3016
- C:\Windows\System\anjingb.exe
  C:\Windows\System\anjingb.exe
  2⤵
  PID:3448
- C:\Windows\System\TPgdrGY.exe
  C:\Windows\System\TPgdrGY.exe
  2⤵
  PID:3464
- C:\Windows\System\LItVKeR.exe
  C:\Windows\System\LItVKeR.exe
  2⤵
  PID:796
- C:\Windows\System\YoXzoIo.exe
  C:\Windows\System\YoXzoIo.exe
  2⤵
  PID:2768
- C:\Windows\System\VoeryTt.exe
  C:\Windows\System\VoeryTt.exe
  2⤵
  PID:2608
- C:\Windows\System\aMYFGQi.exe
  C:\Windows\System\aMYFGQi.exe
  2⤵
  PID:864
- C:\Windows\System\DVBLdHb.exe
  C:\Windows\System\DVBLdHb.exe
  2⤵
  PID:2752
- C:\Windows\System\arqiyLR.exe
  C:\Windows\System\arqiyLR.exe
  2⤵
  PID:3340
- C:\Windows\System\ODyYXii.exe
  C:\Windows\System\ODyYXii.exe
  2⤵
  PID:3656
- C:\Windows\System\feMtvhK.exe
  C:\Windows\System\feMtvhK.exe
  2⤵
  PID:3664
- C:\Windows\System\rYGUbRV.exe
  C:\Windows\System\rYGUbRV.exe
  2⤵
  PID:3696
- C:\Windows\System\zYpsvKV.exe
  C:\Windows\System\zYpsvKV.exe
  2⤵
  PID:3700
- C:\Windows\System\BmqyKBL.exe
  C:\Windows\System\BmqyKBL.exe
  2⤵
  PID:3736
- C:\Windows\System\rCIRGsu.exe
  C:\Windows\System\rCIRGsu.exe
  2⤵
  PID:3744
- C:\Windows\System\TehgXHb.exe
  C:\Windows\System\TehgXHb.exe
  2⤵
  PID:3776
- C:\Windows\System\ZNYatpq.exe
  C:\Windows\System\ZNYatpq.exe
  2⤵
  PID:3784
- C:\Windows\System\yvKPApM.exe
  C:\Windows\System\yvKPApM.exe
  2⤵
  PID:1924
- C:\Windows\System\EvDcaMQ.exe
  C:\Windows\System\EvDcaMQ.exe
  2⤵
  PID:1588
- C:\Windows\System\NVNrXYw.exe
  C:\Windows\System\NVNrXYw.exe
  2⤵
  PID:3840
- C:\Windows\System\sQKwNdK.exe
  C:\Windows\System\sQKwNdK.exe
  2⤵
  PID:3864
- C:\Windows\System\LGtgxmU.exe
  C:\Windows\System\LGtgxmU.exe
  2⤵
  PID:1744
- C:\Windows\System\HurgrAQ.exe
  C:\Windows\System\HurgrAQ.exe
  2⤵
  PID:320
- C:\Windows\System\yNZlExK.exe
  C:\Windows\System\yNZlExK.exe
  2⤵
  PID:3868
- C:\Windows\System\xSaibkh.exe
  C:\Windows\System\xSaibkh.exe
  2⤵
  PID:2440
- C:\Windows\System\pXJrGmD.exe
  C:\Windows\System\pXJrGmD.exe
  2⤵
  PID:3904
- C:\Windows\System\ZuFJKNz.exe
  C:\Windows\System\ZuFJKNz.exe
  2⤵
  PID:3920
- C:\Windows\System\dcmBQru.exe
  C:\Windows\System\dcmBQru.exe
  2⤵
  PID:3952
- C:\Windows\System\jwVBzQb.exe
  C:\Windows\System\jwVBzQb.exe
  2⤵
  PID:3972
- C:\Windows\System\XehZObX.exe
  C:\Windows\System\XehZObX.exe
  2⤵
  PID:1304
- C:\Windows\System\xzkhQmJ.exe
  C:\Windows\System\xzkhQmJ.exe
  2⤵
  PID:2700
- C:\Windows\System\Hflfwwb.exe
  C:\Windows\System\Hflfwwb.exe
  2⤵
  PID:1136
- C:\Windows\System\LwOdJaa.exe
  C:\Windows\System\LwOdJaa.exe
  2⤵
  PID:2360
- C:\Windows\System\mqjGGZZ.exe
  C:\Windows\System\mqjGGZZ.exe
  2⤵
  PID:3292
- C:\Windows\System\ZLVGZHl.exe
  C:\Windows\System\ZLVGZHl.exe
  2⤵
  PID:3368
- C:\Windows\System\bumHwJz.exe
  C:\Windows\System\bumHwJz.exe
  2⤵
  PID:2720
- C:\Windows\System\aTzODbl.exe
  C:\Windows\System\aTzODbl.exe
  2⤵
  PID:3456
- C:\Windows\System\mesScKn.exe
  C:\Windows\System\mesScKn.exe
  2⤵
  PID:1676
- C:\Windows\System\wfAucnK.exe
  C:\Windows\System\wfAucnK.exe
  2⤵
  PID:3216
- C:\Windows\System\LMZVkPw.exe
  C:\Windows\System\LMZVkPw.exe
  2⤵
  PID:3312
- C:\Windows\System\pHezhun.exe
  C:\Windows\System\pHezhun.exe
  2⤵
  PID:3192
- C:\Windows\System\KJcOgYV.exe
  C:\Windows\System\KJcOgYV.exe
  2⤵
  PID:3408
- C:\Windows\System\rqnlinG.exe
  C:\Windows\System\rqnlinG.exe
  2⤵
  PID:2692
- C:\Windows\System\fgcEPdG.exe
  C:\Windows\System\fgcEPdG.exe
  2⤵
  PID:1740
- C:\Windows\System\oMZVZxH.exe
  C:\Windows\System\oMZVZxH.exe
  2⤵
  PID:3444
- C:\Windows\System\LqDqZCh.exe
  C:\Windows\System\LqDqZCh.exe
  2⤵
  PID:3560
- C:\Windows\System\rFVSlMu.exe
  C:\Windows\System\rFVSlMu.exe
  2⤵
  PID:3616
- C:\Windows\System\BQmkksu.exe
  C:\Windows\System\BQmkksu.exe
  2⤵
  PID:3644
- C:\Windows\System\BOkZOaQ.exe
  C:\Windows\System\BOkZOaQ.exe
  2⤵
  PID:532
- C:\Windows\System\GdnWLRS.exe
  C:\Windows\System\GdnWLRS.exe
  2⤵
  PID:2304
- C:\Windows\System\opWNbOg.exe
  C:\Windows\System\opWNbOg.exe
  2⤵
  PID:3640
- C:\Windows\System\teMaGaa.exe
  C:\Windows\System\teMaGaa.exe
  2⤵
  PID:3480
- C:\Windows\System\SyunBDN.exe
  C:\Windows\System\SyunBDN.exe
  2⤵
  PID:3404
- C:\Windows\System\DlRZumm.exe
  C:\Windows\System\DlRZumm.exe
  2⤵
  PID:2064
- C:\Windows\System\WymezIS.exe
  C:\Windows\System\WymezIS.exe
  2⤵
  PID:3520
- C:\Windows\System\mpgBwwB.exe
  C:\Windows\System\mpgBwwB.exe
  2⤵
  PID:1524
- C:\Windows\System\vDlcUjC.exe
  C:\Windows\System\vDlcUjC.exe
  2⤵
  PID:3800
- C:\Windows\System\WUGHZqT.exe
  C:\Windows\System\WUGHZqT.exe
  2⤵
  PID:3884
- C:\Windows\System\gUQAlgE.exe
  C:\Windows\System\gUQAlgE.exe
  2⤵
  PID:3940
- C:\Windows\System\GuqKCzP.exe
  C:\Windows\System\GuqKCzP.exe
  2⤵
  PID:3500
- C:\Windows\System\YFygqET.exe
  C:\Windows\System\YFygqET.exe
  2⤵
  PID:3844
- C:\Windows\System\rBYwLRN.exe
  C:\Windows\System\rBYwLRN.exe
  2⤵
  PID:3880
- C:\Windows\System\rRELYZL.exe
  C:\Windows\System\rRELYZL.exe
  2⤵
  PID:3932
- C:\Windows\System\oSQZgGe.exe
  C:\Windows\System\oSQZgGe.exe
  2⤵
  PID:3976
- C:\Windows\System\EaAosFw.exe
  C:\Windows\System\EaAosFw.exe
  2⤵
  PID:2232
- C:\Windows\System\Vfaudza.exe
  C:\Windows\System\Vfaudza.exe
  2⤵
  PID:3988
- C:\Windows\System\nCxNjug.exe
  C:\Windows\System\nCxNjug.exe
  2⤵
  PID:3112
- C:\Windows\System\XnNqHXV.exe
  C:\Windows\System\XnNqHXV.exe
  2⤵
  PID:3248
- C:\Windows\System\ChBRdsD.exe
  C:\Windows\System\ChBRdsD.exe
  2⤵
  PID:3228
- C:\Windows\System\XpVLShQ.exe
  C:\Windows\System\XpVLShQ.exe
  2⤵
  PID:2660
- C:\Windows\System\NYPAeui.exe
  C:\Windows\System\NYPAeui.exe
  2⤵
  PID:3684
- C:\Windows\System\wRdTYmm.exe
  C:\Windows\System\wRdTYmm.exe
  2⤵
  PID:1732
- C:\Windows\System\WSKGdji.exe
  C:\Windows\System\WSKGdji.exe
  2⤵
  PID:3096
- C:\Windows\System\lcjnANa.exe
  C:\Windows\System\lcjnANa.exe
  2⤵
  PID:4112
- C:\Windows\System\pVTuUJb.exe
  C:\Windows\System\pVTuUJb.exe
  2⤵
  PID:4128
- C:\Windows\System\KdnrSjN.exe
  C:\Windows\System\KdnrSjN.exe
  2⤵
  PID:4192
- C:\Windows\System\LbbYryL.exe
  C:\Windows\System\LbbYryL.exe
  2⤵
  PID:4208
- C:\Windows\System\sJvrzxG.exe
  C:\Windows\System\sJvrzxG.exe
  2⤵
  PID:4224
- C:\Windows\System\SgfZKoU.exe
  C:\Windows\System\SgfZKoU.exe
  2⤵
  PID:4240
- C:\Windows\System\NBUQkvD.exe
  C:\Windows\System\NBUQkvD.exe
  2⤵
  PID:4256
- C:\Windows\System\gnOCeDo.exe
  C:\Windows\System\gnOCeDo.exe
  2⤵
  PID:4272
- C:\Windows\System\HQiuhnB.exe
  C:\Windows\System\HQiuhnB.exe
  2⤵
  PID:4288
- C:\Windows\System\KIVxlZx.exe
  C:\Windows\System\KIVxlZx.exe
  2⤵
  PID:4304
- C:\Windows\System\UFWOUAn.exe
  C:\Windows\System\UFWOUAn.exe
  2⤵
  PID:4320
- C:\Windows\System\BdVNmnv.exe
  C:\Windows\System\BdVNmnv.exe
  2⤵
  PID:4340
- C:\Windows\System\BCePxzi.exe
  C:\Windows\System\BCePxzi.exe
  2⤵
  PID:4356
- C:\Windows\System\EfHLZxy.exe
  C:\Windows\System\EfHLZxy.exe
  2⤵
  PID:4372
- C:\Windows\System\BEWeqgr.exe
  C:\Windows\System\BEWeqgr.exe
  2⤵
  PID:4388
- C:\Windows\System\saolQvp.exe
  C:\Windows\System\saolQvp.exe
  2⤵
  PID:4404
- C:\Windows\System\EcTUFDM.exe
  C:\Windows\System\EcTUFDM.exe
  2⤵
  PID:4420
- C:\Windows\System\jDxNsRw.exe
  C:\Windows\System\jDxNsRw.exe
  2⤵
  PID:4436
- C:\Windows\System\HrSgUZZ.exe
  C:\Windows\System\HrSgUZZ.exe
  2⤵
  PID:4456
- C:\Windows\System\vLafTHk.exe
  C:\Windows\System\vLafTHk.exe
  2⤵
  PID:4472
- C:\Windows\System\EcDvaXE.exe
  C:\Windows\System\EcDvaXE.exe
  2⤵
  PID:4488
- C:\Windows\System\GKnepgl.exe
  C:\Windows\System\GKnepgl.exe
  2⤵
  PID:4504
- C:\Windows\System\sRuNUWN.exe
  C:\Windows\System\sRuNUWN.exe
  2⤵
  PID:4520
- C:\Windows\System\xsfJDAX.exe
  C:\Windows\System\xsfJDAX.exe
  2⤵
  PID:4536
- C:\Windows\System\HNjGvEm.exe
  C:\Windows\System\HNjGvEm.exe
  2⤵
  PID:4552
- C:\Windows\System\gAPCQnT.exe
  C:\Windows\System\gAPCQnT.exe
  2⤵
  PID:4568
- C:\Windows\System\yRAzxjd.exe
  C:\Windows\System\yRAzxjd.exe
  2⤵
  PID:4584
- C:\Windows\System\cVPOxIv.exe
  C:\Windows\System\cVPOxIv.exe
  2⤵
  PID:4604
- C:\Windows\System\wEpHlPV.exe
  C:\Windows\System\wEpHlPV.exe
  2⤵
  PID:4620
- C:\Windows\System\NSECXJQ.exe
  C:\Windows\System\NSECXJQ.exe
  2⤵
  PID:4636
- C:\Windows\System\icFsilU.exe
  C:\Windows\System\icFsilU.exe
  2⤵
  PID:4652
- C:\Windows\System\oaDXvuj.exe
  C:\Windows\System\oaDXvuj.exe
  2⤵
  PID:4668
- C:\Windows\System\hkpnvuV.exe
  C:\Windows\System\hkpnvuV.exe
  2⤵
  PID:4792
- C:\Windows\System\UGZqUwG.exe
  C:\Windows\System\UGZqUwG.exe
  2⤵
  PID:4812
- C:\Windows\System\SnJKQhu.exe
  C:\Windows\System\SnJKQhu.exe
  2⤵
  PID:4844
- C:\Windows\System\ihHHMgB.exe
  C:\Windows\System\ihHHMgB.exe
  2⤵
  PID:4868
- C:\Windows\System\MUIbdBO.exe
  C:\Windows\System\MUIbdBO.exe
  2⤵
  PID:4988
- C:\Windows\System\fsvDvaR.exe
  C:\Windows\System\fsvDvaR.exe
  2⤵
  PID:5004
- C:\Windows\System\CYTKBat.exe
  C:\Windows\System\CYTKBat.exe
  2⤵
  PID:5020
- C:\Windows\System\pWiHOXa.exe
  C:\Windows\System\pWiHOXa.exe
  2⤵
  PID:5036
- C:\Windows\System\OWlVQot.exe
  C:\Windows\System\OWlVQot.exe
  2⤵
  PID:5052
- C:\Windows\System\gAVVEfH.exe
  C:\Windows\System\gAVVEfH.exe
  2⤵
  PID:5068
- C:\Windows\System\TiXqFLr.exe
  C:\Windows\System\TiXqFLr.exe
  2⤵
  PID:5084
- C:\Windows\System\zDApPxC.exe
  C:\Windows\System\zDApPxC.exe
  2⤵
  PID:5100
- C:\Windows\System\QCwxPUf.exe
  C:\Windows\System\QCwxPUf.exe
  2⤵
  PID:5116
- C:\Windows\System\yCsdRVr.exe
  C:\Windows\System\yCsdRVr.exe
  2⤵
  PID:3284
- C:\Windows\System\rvKwMDT.exe
  C:\Windows\System\rvKwMDT.exe
  2⤵
  PID:2828
- C:\Windows\System\wXYCNXk.exe
  C:\Windows\System\wXYCNXk.exe
  2⤵
  PID:2424
- C:\Windows\System\zTQeemF.exe
  C:\Windows\System\zTQeemF.exe
  2⤵
  PID:2672
- C:\Windows\System\yBaUclh.exe
  C:\Windows\System\yBaUclh.exe
  2⤵
  PID:1616
- C:\Windows\System\wDesvoX.exe
  C:\Windows\System\wDesvoX.exe
  2⤵
  PID:1948
- C:\Windows\System\WCHtJSR.exe
  C:\Windows\System\WCHtJSR.exe
  2⤵
  PID:3504
- C:\Windows\System\WhrJeFk.exe
  C:\Windows\System\WhrJeFk.exe
  2⤵
  PID:2764
- C:\Windows\System\FRimcpj.exe
  C:\Windows\System\FRimcpj.exe
  2⤵
  PID:1620
- C:\Windows\System\woTMoFL.exe
  C:\Windows\System\woTMoFL.exe
  2⤵
  PID:3132
- C:\Windows\System\ToZyrCC.exe
  C:\Windows\System\ToZyrCC.exe
  2⤵
  PID:2468
- C:\Windows\System\VKLbOux.exe
  C:\Windows\System\VKLbOux.exe
  2⤵
  PID:3720
- C:\Windows\System\LCaUomb.exe
  C:\Windows\System\LCaUomb.exe
  2⤵
  PID:1648
- C:\Windows\System\tmXWMhK.exe
  C:\Windows\System\tmXWMhK.exe
  2⤵
  PID:1536
- C:\Windows\System\gIzqEil.exe
  C:\Windows\System\gIzqEil.exe
  2⤵
  PID:3936
- C:\Windows\System\tHECxnh.exe
  C:\Windows\System\tHECxnh.exe
  2⤵
  PID:3980
- C:\Windows\System\pTcQElC.exe
  C:\Windows\System\pTcQElC.exe
  2⤵
  PID:2872
- C:\Windows\System\xLqJNAX.exe
  C:\Windows\System\xLqJNAX.exe
  2⤵
  PID:4120
- C:\Windows\System\cVRCLUI.exe
  C:\Windows\System\cVRCLUI.exe
  2⤵
  PID:4236
- C:\Windows\System\FFgWKii.exe
  C:\Windows\System\FFgWKii.exe
  2⤵
  PID:4268
- C:\Windows\System\atMobYn.exe
  C:\Windows\System\atMobYn.exe
  2⤵
  PID:4332
- C:\Windows\System\eWvTpPm.exe
  C:\Windows\System\eWvTpPm.exe
  2⤵
  PID:4148
- C:\Windows\System\PPxRUVW.exe
  C:\Windows\System\PPxRUVW.exe
  2⤵
  PID:4160
- C:\Windows\System\OScrvHI.exe
  C:\Windows\System\OScrvHI.exe
  2⤵
  PID:4168
- C:\Windows\System\figUGkX.exe
  C:\Windows\System\figUGkX.exe
  2⤵
  PID:4176
- C:\Windows\System\qlTXNaU.exe
  C:\Windows\System\qlTXNaU.exe
  2⤵
  PID:4252
- C:\Windows\System\YlXyEjP.exe
  C:\Windows\System\YlXyEjP.exe
  2⤵
  PID:4352
- C:\Windows\System\OEpylKS.exe
  C:\Windows\System\OEpylKS.exe
  2⤵
  PID:4412
- C:\Windows\System\DKwJIFa.exe
  C:\Windows\System\DKwJIFa.exe
  2⤵
  PID:4444
- C:\Windows\System\wRTKHle.exe
  C:\Windows\System\wRTKHle.exe
  2⤵
  PID:4200
- C:\Windows\System\VWuTUPM.exe
  C:\Windows\System\VWuTUPM.exe
  2⤵
  PID:4664
- C:\Windows\System\BoLrfGq.exe
  C:\Windows\System\BoLrfGq.exe
  2⤵
  PID:1516
- C:\Windows\System\mmORbbJ.exe
  C:\Windows\System\mmORbbJ.exe
  2⤵
  PID:4596
- C:\Windows\System\ccYodLO.exe
  C:\Windows\System\ccYodLO.exe
  2⤵
  PID:4548
- C:\Windows\System\QlkYeXN.exe
  C:\Windows\System\QlkYeXN.exe
  2⤵
  PID:4500
- C:\Windows\System\idktsmy.exe
  C:\Windows\System\idktsmy.exe
  2⤵
  PID:4700
- C:\Windows\System\pEmWMYx.exe
  C:\Windows\System\pEmWMYx.exe
  2⤵
  PID:4616
- C:\Windows\System\KeRIPNZ.exe
  C:\Windows\System\KeRIPNZ.exe
  2⤵
  PID:4544
- C:\Windows\System\fLHfJJL.exe
  C:\Windows\System\fLHfJJL.exe
  2⤵
  PID:4788
- C:\Windows\System\tXyzAHg.exe
  C:\Windows\System\tXyzAHg.exe
  2⤵
  PID:856
- C:\Windows\System\YHZLDrZ.exe
  C:\Windows\System\YHZLDrZ.exe
  2⤵
  PID:768
- C:\Windows\System\xQHixPJ.exe
  C:\Windows\System\xQHixPJ.exe
  2⤵
  PID:4860
- C:\Windows\System\dHfZEod.exe
  C:\Windows\System\dHfZEod.exe
  2⤵
  PID:2980
- C:\Windows\System\bkijVVn.exe
  C:\Windows\System\bkijVVn.exe
  2⤵
  PID:4884
- C:\Windows\System\VrNMweb.exe
  C:\Windows\System\VrNMweb.exe
  2⤵
  PID:2464
- C:\Windows\System\iHHwZxA.exe
  C:\Windows\System\iHHwZxA.exe
  2⤵
  PID:4908
- C:\Windows\System\CYUbdBs.exe
  C:\Windows\System\CYUbdBs.exe
  2⤵
  PID:4924
- C:\Windows\System\SHeXgyl.exe
  C:\Windows\System\SHeXgyl.exe
  2⤵
  PID:4948
- C:\Windows\System\oVTZmxb.exe
  C:\Windows\System\oVTZmxb.exe
  2⤵
  PID:4964
- C:\Windows\System\dsWRuez.exe
  C:\Windows\System\dsWRuez.exe
  2⤵
  PID:4980
- C:\Windows\System\lsHLBEr.exe
  C:\Windows\System\lsHLBEr.exe
  2⤵
  PID:5076
- C:\Windows\System\WTFAXtK.exe
  C:\Windows\System\WTFAXtK.exe
  2⤵
  PID:3764
- C:\Windows\System\VXAGAlS.exe
  C:\Windows\System\VXAGAlS.exe
  2⤵
  PID:4052
- C:\Windows\System\zCQQxXP.exe
  C:\Windows\System\zCQQxXP.exe
  2⤵
  PID:3412
- C:\Windows\System\bDdckjW.exe
  C:\Windows\System\bDdckjW.exe
  2⤵
  PID:4020
- C:\Windows\System\ArKlzkh.exe
  C:\Windows\System\ArKlzkh.exe
  2⤵
  PID:4264
- C:\Windows\System\dHnEYqo.exe
  C:\Windows\System\dHnEYqo.exe
  2⤵
  PID:5060
- C:\Windows\System\kgEpIqy.exe
  C:\Windows\System\kgEpIqy.exe
  2⤵
  PID:5092
- C:\Windows\System\yBnhlNG.exe
  C:\Windows\System\yBnhlNG.exe
  2⤵
  PID:2904
- C:\Windows\System\vpyEUfN.exe
  C:\Windows\System\vpyEUfN.exe
  2⤵
  PID:5096
- C:\Windows\System\ENMPaDl.exe
  C:\Windows\System\ENMPaDl.exe
  2⤵
  PID:1504
- C:\Windows\System\exFFdIg.exe
  C:\Windows\System\exFFdIg.exe
  2⤵
  PID:2212
- C:\Windows\System\DCXQyPp.exe
  C:\Windows\System\DCXQyPp.exe
  2⤵
  PID:4464
- C:\Windows\System\ZQDOChi.exe
  C:\Windows\System\ZQDOChi.exe
  2⤵
  PID:2036
- C:\Windows\System\ENMYjwE.exe
  C:\Windows\System\ENMYjwE.exe
  2⤵
  PID:4108
- C:\Windows\System\XZAeydP.exe
  C:\Windows\System\XZAeydP.exe
  2⤵
  PID:4248
- C:\Windows\System\DKKduQO.exe
  C:\Windows\System\DKKduQO.exe
  2⤵
  PID:4188
- C:\Windows\System\VlsBTQr.exe
  C:\Windows\System\VlsBTQr.exe
  2⤵
  PID:4432
- C:\Windows\System\QzVTNOx.exe
  C:\Windows\System\QzVTNOx.exe
  2⤵
  PID:4280
- C:\Windows\System\QzIisLP.exe
  C:\Windows\System\QzIisLP.exe
  2⤵
  PID:4688
- C:\Windows\System\oFYkeoi.exe
  C:\Windows\System\oFYkeoi.exe
  2⤵
  PID:4628
- C:\Windows\System\tKSVflt.exe
  C:\Windows\System\tKSVflt.exe
  2⤵
  PID:4564
- C:\Windows\System\fXAyLDH.exe
  C:\Windows\System\fXAyLDH.exe
  2⤵
  PID:4576
- C:\Windows\System\dozCafj.exe
  C:\Windows\System\dozCafj.exe
  2⤵
  PID:4716
- C:\Windows\System\QpIsikl.exe
  C:\Windows\System\QpIsikl.exe
  2⤵
  PID:4728
- C:\Windows\System\AMfjDXZ.exe
  C:\Windows\System\AMfjDXZ.exe
  2⤵
  PID:2116
- C:\Windows\System\KnlxzxF.exe
  C:\Windows\System\KnlxzxF.exe
  2⤵
  PID:4748
- C:\Windows\System\xsknFkY.exe
  C:\Windows\System\xsknFkY.exe
  2⤵
  PID:4768
- C:\Windows\System\xbGdNMV.exe
  C:\Windows\System\xbGdNMV.exe
  2⤵
  PID:400
- C:\Windows\System\HrEDool.exe
  C:\Windows\System\HrEDool.exe
  2⤵
  PID:4808
- C:\Windows\System\HIgTbRn.exe
  C:\Windows\System\HIgTbRn.exe
  2⤵
  PID:1032
- C:\Windows\System\BCThElD.exe
  C:\Windows\System\BCThElD.exe
  2⤵
  PID:4856
- C:\Windows\System\TCeKlSL.exe
  C:\Windows\System\TCeKlSL.exe
  2⤵
  PID:4876
- C:\Windows\System\aZfhKUg.exe
  C:\Windows\System\aZfhKUg.exe
  2⤵
  PID:4892
- C:\Windows\System\WjVgjju.exe
  C:\Windows\System\WjVgjju.exe
  2⤵
  PID:4904
- C:\Windows\System\TeSzcTr.exe
  C:\Windows\System\TeSzcTr.exe
  2⤵
  PID:4936
- C:\Windows\System\PPTMPHF.exe
  C:\Windows\System\PPTMPHF.exe
  2⤵
  PID:4956
- C:\Windows\System\FfSdvZE.exe
  C:\Windows\System\FfSdvZE.exe
  2⤵
  PID:4984
- C:\Windows\System\JCkXRiP.exe
  C:\Windows\System\JCkXRiP.exe
  2⤵
  PID:5016
- C:\Windows\System\XqnIRoB.exe
  C:\Windows\System\XqnIRoB.exe
  2⤵
  PID:3436
- C:\Windows\System\vmjOdzv.exe
  C:\Windows\System\vmjOdzv.exe
  2⤵
  PID:2364
- C:\Windows\System\eaTllqU.exe
  C:\Windows\System\eaTllqU.exe
  2⤵
  PID:1160
- C:\Windows\System\VJXOyBt.exe
  C:\Windows\System\VJXOyBt.exe
  2⤵
  PID:2248
- C:\Windows\System\uXlJDAK.exe
  C:\Windows\System\uXlJDAK.exe
  2⤵
  PID:3540
- C:\Windows\System\xVbYQDD.exe
  C:\Windows\System\xVbYQDD.exe
  2⤵
  PID:3900
- C:\Windows\System\KbVZqdM.exe
  C:\Windows\System\KbVZqdM.exe
  2⤵
  PID:612
- C:\Windows\System\PhUcIXk.exe
  C:\Windows\System\PhUcIXk.exe
  2⤵
  PID:1656
- C:\Windows\System\uWTVmFX.exe
  C:\Windows\System\uWTVmFX.exe
  2⤵
  PID:4216
- C:\Windows\System\SsbDCRm.exe
  C:\Windows\System\SsbDCRm.exe
  2⤵
  PID:5132
- C:\Windows\System\VMsKHOo.exe
  C:\Windows\System\VMsKHOo.exe
  2⤵
  PID:5148
- C:\Windows\System\HTbSqeY.exe
  C:\Windows\System\HTbSqeY.exe
  2⤵
  PID:5164
- C:\Windows\System\jXWghOV.exe
  C:\Windows\System\jXWghOV.exe
  2⤵
  PID:5184
- C:\Windows\System\GIpVMGF.exe
  C:\Windows\System\GIpVMGF.exe
  2⤵
  PID:5200
- C:\Windows\System\dWiujmS.exe
  C:\Windows\System\dWiujmS.exe
  2⤵
  PID:5216
- C:\Windows\System\MzWRMkp.exe
  C:\Windows\System\MzWRMkp.exe
  2⤵
  PID:5232
- C:\Windows\System\JQJMESQ.exe
  C:\Windows\System\JQJMESQ.exe
  2⤵
  PID:5248
- C:\Windows\System\rpdxNpc.exe
  C:\Windows\System\rpdxNpc.exe
  2⤵
  PID:5264
- C:\Windows\System\QGnPquS.exe
  C:\Windows\System\QGnPquS.exe
  2⤵
  PID:5284
- C:\Windows\System\SGDYWNB.exe
  C:\Windows\System\SGDYWNB.exe
  2⤵
  PID:5300
- C:\Windows\System\lwmoKIA.exe
  C:\Windows\System\lwmoKIA.exe
  2⤵
  PID:5316
- C:\Windows\System\fANozgo.exe
  C:\Windows\System\fANozgo.exe
  2⤵
  PID:5332
- C:\Windows\System\IzYVZol.exe
  C:\Windows\System\IzYVZol.exe
  2⤵
  PID:5348
- C:\Windows\System\FOcBUhj.exe
  C:\Windows\System\FOcBUhj.exe
  2⤵
  PID:5364
- C:\Windows\System\nWYYvXk.exe
  C:\Windows\System\nWYYvXk.exe
  2⤵
  PID:5380
- C:\Windows\System\PVFDLHc.exe
  C:\Windows\System\PVFDLHc.exe
  2⤵
  PID:5400
- C:\Windows\System\UsnpVNX.exe
  C:\Windows\System\UsnpVNX.exe
  2⤵
  PID:5420
- C:\Windows\System\GxTDtRH.exe
  C:\Windows\System\GxTDtRH.exe
  2⤵
  PID:5436
- C:\Windows\System\eLyuqCR.exe
  C:\Windows\System\eLyuqCR.exe
  2⤵
  PID:5452
- C:\Windows\System\xDMaGlO.exe
  C:\Windows\System\xDMaGlO.exe
  2⤵
  PID:5468
- C:\Windows\System\wrhCPlf.exe
  C:\Windows\System\wrhCPlf.exe
  2⤵
  PID:5488
- C:\Windows\System\IFzuhGU.exe
  C:\Windows\System\IFzuhGU.exe
  2⤵
  PID:5528
- C:\Windows\System\VpqUMeK.exe
  C:\Windows\System\VpqUMeK.exe
  2⤵
  PID:5544
- C:\Windows\System\RvGXzou.exe
  C:\Windows\System\RvGXzou.exe
  2⤵
  PID:5560
- C:\Windows\System\PQhMcYN.exe
  C:\Windows\System\PQhMcYN.exe
  2⤵
  PID:5576
- C:\Windows\System\PDzgGCJ.exe
  C:\Windows\System\PDzgGCJ.exe
  2⤵
  PID:5592
- C:\Windows\System\frZVgLC.exe
  C:\Windows\System\frZVgLC.exe
  2⤵
  PID:5608
- C:\Windows\System\DBuufsg.exe
  C:\Windows\System\DBuufsg.exe
  2⤵
  PID:5628
- C:\Windows\System\tYIZiRI.exe
  C:\Windows\System\tYIZiRI.exe
  2⤵
  PID:5648
- C:\Windows\System\jQbKEYx.exe
  C:\Windows\System\jQbKEYx.exe
  2⤵
  PID:5664
- C:\Windows\System\sRPZmmi.exe
  C:\Windows\System\sRPZmmi.exe
  2⤵
  PID:5680
- C:\Windows\System\QPSMiii.exe
  C:\Windows\System\QPSMiii.exe
  2⤵
  PID:5696
- C:\Windows\System\tmvYgCZ.exe
  C:\Windows\System\tmvYgCZ.exe
  2⤵
  PID:5792
- C:\Windows\System\mXAwwRH.exe
  C:\Windows\System\mXAwwRH.exe
  2⤵
  PID:5844
- C:\Windows\System\mOlEEeU.exe
  C:\Windows\System\mOlEEeU.exe
  2⤵
  PID:5860
- C:\Windows\System\xFCpUBx.exe
  C:\Windows\System\xFCpUBx.exe
  2⤵
  PID:5880
- C:\Windows\System\TItSdzc.exe
  C:\Windows\System\TItSdzc.exe
  2⤵
  PID:5896
- C:\Windows\System\ghsZeuo.exe
  C:\Windows\System\ghsZeuo.exe
  2⤵
  PID:5912
- C:\Windows\System\JdPJOsZ.exe
  C:\Windows\System\JdPJOsZ.exe
  2⤵
  PID:5928
- C:\Windows\System\WRGTBcI.exe
  C:\Windows\System\WRGTBcI.exe
  2⤵
  PID:5944
- C:\Windows\System\DtSQERS.exe
  C:\Windows\System\DtSQERS.exe
  2⤵
  PID:5964
- C:\Windows\System\RJIwXnF.exe
  C:\Windows\System\RJIwXnF.exe
  2⤵
  PID:6076
- C:\Windows\System\StsARcy.exe
  C:\Windows\System\StsARcy.exe
  2⤵
  PID:6092
- C:\Windows\System\CMdSvtE.exe
  C:\Windows\System\CMdSvtE.exe
  2⤵
  PID:6108
- C:\Windows\System\owUqmUc.exe
  C:\Windows\System\owUqmUc.exe
  2⤵
  PID:6124
- C:\Windows\System\qdbTVel.exe
  C:\Windows\System\qdbTVel.exe
  2⤵
  PID:6140
- C:\Windows\System\RGVXAtZ.exe
  C:\Windows\System\RGVXAtZ.exe
  2⤵
  PID:4364
- C:\Windows\System\ojSKSKn.exe
  C:\Windows\System\ojSKSKn.exe
  2⤵
  PID:4600
- C:\Windows\System\tgdwXul.exe
  C:\Windows\System\tgdwXul.exe
  2⤵
  PID:4184
- C:\Windows\System\LuWLdcP.exe
  C:\Windows\System\LuWLdcP.exe
  2⤵
  PID:4932
- C:\Windows\System\atAfrNV.exe
  C:\Windows\System\atAfrNV.exe
  2⤵
  PID:4976
- C:\Windows\System\euHGYJm.exe
  C:\Windows\System\euHGYJm.exe
  2⤵
  PID:5048
- C:\Windows\System\zWhFGDk.exe
  C:\Windows\System\zWhFGDk.exe
  2⤵
  PID:4204
- C:\Windows\System\duvnAqD.exe
  C:\Windows\System\duvnAqD.exe
  2⤵
  PID:5176
- C:\Windows\System\kMvHCZg.exe
  C:\Windows\System\kMvHCZg.exe
  2⤵
  PID:5240
- C:\Windows\System\etujlBn.exe
  C:\Windows\System\etujlBn.exe
  2⤵
  PID:5480
- C:\Windows\System\BVLhhAD.exe
  C:\Windows\System\BVLhhAD.exe
  2⤵
  PID:5372
- C:\Windows\System\iKDJRDa.exe
  C:\Windows\System\iKDJRDa.exe
  2⤵
  PID:5444
- C:\Windows\System\Gdrhyfi.exe
  C:\Windows\System\Gdrhyfi.exe
  2⤵
  PID:5340
- C:\Windows\System\FJQWmxA.exe
  C:\Windows\System\FJQWmxA.exe
  2⤵
  PID:5344
- C:\Windows\System\KvQiHLZ.exe
  C:\Windows\System\KvQiHLZ.exe
  2⤵
  PID:4516
- C:\Windows\System\FiEHRTg.exe
  C:\Windows\System\FiEHRTg.exe
  2⤵
  PID:5032
- C:\Windows\System\AceDJtP.exe
  C:\Windows\System\AceDJtP.exe
  2⤵
  PID:5392
- C:\Windows\System\xdMiKIE.exe
  C:\Windows\System\xdMiKIE.exe
  2⤵
  PID:4712
- C:\Windows\System\NjOjubH.exe
  C:\Windows\System\NjOjubH.exe
  2⤵
  PID:4764
- C:\Windows\System\QbFAFHu.exe
  C:\Windows\System\QbFAFHu.exe
  2⤵
  PID:3492
- C:\Windows\System\dQmggjq.exe
  C:\Windows\System\dQmggjq.exe
  2⤵
  PID:5324
- C:\Windows\System\FKjthjK.exe
  C:\Windows\System\FKjthjK.exe
  2⤵
  PID:4348
- C:\Windows\System\lviKIoj.exe
  C:\Windows\System\lviKIoj.exe
  2⤵
  PID:4156
- C:\Windows\System\RetyJpP.exe
  C:\Windows\System\RetyJpP.exe
  2⤵
  PID:4468
- C:\Windows\System\ItcJBlm.exe
  C:\Windows\System\ItcJBlm.exe
  2⤵
  PID:4944
- C:\Windows\System\arKpVjk.exe
  C:\Windows\System\arKpVjk.exe
  2⤵
  PID:3604
- C:\Windows\System\OrvEKJR.exe
  C:\Windows\System\OrvEKJR.exe
  2⤵
  PID:5128
- C:\Windows\System\jHSqReP.exe
  C:\Windows\System\jHSqReP.exe
  2⤵
  PID:5224
- C:\Windows\System\dhfJCRl.exe
  C:\Windows\System\dhfJCRl.exe
  2⤵
  PID:5388
- C:\Windows\System\PiriyCu.exe
  C:\Windows\System\PiriyCu.exe
  2⤵
  PID:5496
- C:\Windows\System\NsjhDaT.exe
  C:\Windows\System\NsjhDaT.exe
  2⤵
  PID:5540
- C:\Windows\System\jLoJiDD.exe
  C:\Windows\System\jLoJiDD.exe
  2⤵
  PID:5556
- C:\Windows\System\xUbBeGE.exe
  C:\Windows\System\xUbBeGE.exe
  2⤵
  PID:4760
- C:\Windows\System\vlSXIfW.exe
  C:\Windows\System\vlSXIfW.exe
  2⤵
  PID:4736
- C:\Windows\System\koAfUrG.exe
  C:\Windows\System\koAfUrG.exe
  2⤵
  PID:4480
- C:\Windows\System\SkLXAMY.exe
  C:\Windows\System\SkLXAMY.exe
  2⤵
  PID:5716
- C:\Windows\System\eEPQmez.exe
  C:\Windows\System\eEPQmez.exe
  2⤵
  PID:5732
- C:\Windows\System\KzXHZOg.exe
  C:\Windows\System\KzXHZOg.exe
  2⤵
  PID:5744
- C:\Windows\System\Qgglger.exe
  C:\Windows\System\Qgglger.exe
  2⤵
  PID:5656
- C:\Windows\System\dftTSgs.exe
  C:\Windows\System\dftTSgs.exe
  2⤵
  PID:2368
- C:\Windows\System\GcNYKVU.exe
  C:\Windows\System\GcNYKVU.exe
  2⤵
  PID:5780
- C:\Windows\System\acHRaBq.exe
  C:\Windows\System\acHRaBq.exe
  2⤵
  PID:5776
- C:\Windows\System\QlyPAGW.exe
  C:\Windows\System\QlyPAGW.exe
  2⤵
  PID:5904
- C:\Windows\System\mugacAg.exe
  C:\Windows\System\mugacAg.exe
  2⤵
  PID:5800
- C:\Windows\System\dcgRrTN.exe
  C:\Windows\System\dcgRrTN.exe
  2⤵
  PID:5816
- C:\Windows\System\beehBBp.exe
  C:\Windows\System\beehBBp.exe
  2⤵
  PID:5832
- C:\Windows\System\doxTHRh.exe
  C:\Windows\System\doxTHRh.exe
  2⤵
  PID:5980
- C:\Windows\System\gJJpJZo.exe
  C:\Windows\System\gJJpJZo.exe
  2⤵
  PID:5920
- C:\Windows\System\cSnjfSH.exe
  C:\Windows\System\cSnjfSH.exe
  2⤵
  PID:5636
- C:\Windows\System\igZPGBl.exe
  C:\Windows\System\igZPGBl.exe
  2⤵
  PID:5892
- C:\Windows\System\KWVsEGN.exe
  C:\Windows\System\KWVsEGN.exe
  2⤵
  PID:5672
- C:\Windows\System\DPlbEQY.exe
  C:\Windows\System\DPlbEQY.exe
  2⤵
  PID:5960
- C:\Windows\System\tVcSMud.exe
  C:\Windows\System\tVcSMud.exe
  2⤵
  PID:6020
- C:\Windows\System\eFZswIz.exe
  C:\Windows\System\eFZswIz.exe
  2⤵
  PID:6024
- C:\Windows\System\xzGiQAa.exe
  C:\Windows\System\xzGiQAa.exe
  2⤵
  PID:6040
- C:\Windows\System\eyuRMei.exe
  C:\Windows\System\eyuRMei.exe
  2⤵
  PID:6056
- C:\Windows\System\wyQzXRe.exe
  C:\Windows\System\wyQzXRe.exe
  2⤵
  PID:6072
- C:\Windows\System\WoSZfAL.exe
  C:\Windows\System\WoSZfAL.exe
  2⤵
  PID:2784
- C:\Windows\System\pmvYZMj.exe
  C:\Windows\System\pmvYZMj.exe
  2⤵
  PID:5172
- C:\Windows\System\kwrJyQT.exe
  C:\Windows\System\kwrJyQT.exe
  2⤵
  PID:6088
- C:\Windows\System\RdfJZpF.exe
  C:\Windows\System\RdfJZpF.exe
  2⤵
  PID:4172
- C:\Windows\System\jGpWHNO.exe
  C:\Windows\System\jGpWHNO.exe
  2⤵
  PID:5408
- C:\Windows\System\VRRzlPh.exe
  C:\Windows\System\VRRzlPh.exe
  2⤵
  PID:5412
- C:\Windows\System\vhkTjAg.exe
  C:\Windows\System\vhkTjAg.exe
  2⤵
  PID:2120
- C:\Windows\System\BQQHqon.exe
  C:\Windows\System\BQQHqon.exe
  2⤵
  PID:4612
- C:\Windows\System\rykunaH.exe
  C:\Windows\System\rykunaH.exe
  2⤵
  PID:4972
- C:\Windows\System\GCBUzqA.exe
  C:\Windows\System\GCBUzqA.exe
  2⤵
  PID:5208
- C:\Windows\System\XldzJxW.exe
  C:\Windows\System\XldzJxW.exe
  2⤵
  PID:5476
- C:\Windows\System\zjUDwbL.exe
  C:\Windows\System\zjUDwbL.exe
  2⤵
  PID:4660
- C:\Windows\System\MJSqGtZ.exe
  C:\Windows\System\MJSqGtZ.exe
  2⤵
  PID:4740
- C:\Windows\System\spdjSzl.exe
  C:\Windows\System\spdjSzl.exe
  2⤵
  PID:5256
- C:\Windows\System\XowjSqU.exe
  C:\Windows\System\XowjSqU.exe
  2⤵
  PID:4916
- C:\Windows\System\tjYFZRm.exe
  C:\Windows\System\tjYFZRm.exe
  2⤵
  PID:5536
- C:\Windows\System\Ekfvhww.exe
  C:\Windows\System\Ekfvhww.exe
  2⤵
  PID:5512
- C:\Windows\System\gyyAgmS.exe
  C:\Windows\System\gyyAgmS.exe
  2⤵
  PID:5432
- C:\Windows\System\mwwjNBz.exe
  C:\Windows\System\mwwjNBz.exe
  2⤵
  PID:4784
- C:\Windows\System\bKHtgfT.exe
  C:\Windows\System\bKHtgfT.exe
  2⤵
  PID:5620
- C:\Windows\System\RyvTdft.exe
  C:\Windows\System\RyvTdft.exe
  2⤵
  PID:5724
- C:\Windows\System\ywnJSUh.exe
  C:\Windows\System\ywnJSUh.exe
  2⤵
  PID:5764
- C:\Windows\System\ozPaKth.exe
  C:\Windows\System\ozPaKth.exe
  2⤵
  PID:5812
- C:\Windows\System\ujyUBxi.exe
  C:\Windows\System\ujyUBxi.exe
  2⤵
  PID:5604
- C:\Windows\System\GZgRSrq.exe
  C:\Windows\System\GZgRSrq.exe
  2⤵
  PID:6012
- C:\Windows\System\IdbRUif.exe
  C:\Windows\System\IdbRUif.exe
  2⤵
  PID:6064
- C:\Windows\System\FgPkrwW.exe
  C:\Windows\System\FgPkrwW.exe
  2⤵
  PID:5824
- C:\Windows\System\ekpsOaA.exe
  C:\Windows\System\ekpsOaA.exe
  2⤵
  PID:5936
- C:\Windows\System\ESHzwWR.exe
  C:\Windows\System\ESHzwWR.exe
  2⤵
  PID:5992
- C:\Windows\System\hhqBKtG.exe
  C:\Windows\System\hhqBKtG.exe
  2⤵
  PID:5852
- C:\Windows\System\gpXoNYt.exe
  C:\Windows\System\gpXoNYt.exe
  2⤵
  PID:3260
- C:\Windows\System\AgbvHvC.exe
  C:\Windows\System\AgbvHvC.exe
  2⤵
  PID:5140
- C:\Windows\System\vjqiNKc.exe
  C:\Windows\System\vjqiNKc.exe
  2⤵
  PID:5144
- C:\Windows\System\unORjYQ.exe
  C:\Windows\System\unORjYQ.exe
  2⤵
  PID:5108
- C:\Windows\System\YtqCSne.exe
  C:\Windows\System\YtqCSne.exe
  2⤵
  PID:4384
- C:\Windows\System\DknaVXW.exe
  C:\Windows\System\DknaVXW.exe
  2⤵
  PID:4316
- C:\Windows\System\QgZiWQX.exe
  C:\Windows\System\QgZiWQX.exe
  2⤵
  PID:5124
- C:\Windows\System\ZDzvPzL.exe
  C:\Windows\System\ZDzvPzL.exe
  2⤵
  PID:4676
- C:\Windows\System\DOSVrag.exe
  C:\Windows\System\DOSVrag.exe
  2⤵
  PID:4644
- C:\Windows\System\mcSgTBC.exe
  C:\Windows\System\mcSgTBC.exe
  2⤵
  PID:4832
- C:\Windows\System\EoufFQo.exe
  C:\Windows\System\EoufFQo.exe
  2⤵
  PID:5192
- C:\Windows\System\uYAEyBk.exe
  C:\Windows\System\uYAEyBk.exe
  2⤵
  PID:5568
- C:\Windows\System\pBwAcan.exe
  C:\Windows\System\pBwAcan.exe
  2⤵
  PID:5876
- C:\Windows\System\rDumqsS.exe
  C:\Windows\System\rDumqsS.exe
  2⤵
  PID:5956
- C:\Windows\System\SZMWvex.exe
  C:\Windows\System\SZMWvex.exe
  2⤵
  PID:6068
- C:\Windows\System\TGQXjeu.exe
  C:\Windows\System\TGQXjeu.exe
  2⤵
  PID:1992
- C:\Windows\System\HXJVWzN.exe
  C:\Windows\System\HXJVWzN.exe
  2⤵
  PID:5484
- C:\Windows\System\KINuiCJ.exe
  C:\Windows\System\KINuiCJ.exe
  2⤵
  PID:6008
- C:\Windows\System\oNAUQeL.exe
  C:\Windows\System\oNAUQeL.exe
  2⤵
  PID:5988
- C:\Windows\System\CWGzjpw.exe
  C:\Windows\System\CWGzjpw.exe
  2⤵
  PID:6132
- C:\Windows\System\QyFTkKK.exe
  C:\Windows\System\QyFTkKK.exe
  2⤵
  PID:4104
- C:\Windows\System\BBdtaYc.exe
  C:\Windows\System\BBdtaYc.exe
  2⤵
  PID:4684
- C:\Windows\System\unnvJQE.exe
  C:\Windows\System\unnvJQE.exe
  2⤵
  PID:3596
- C:\Windows\System\tGqrfTI.exe
  C:\Windows\System\tGqrfTI.exe
  2⤵
  PID:4888
- C:\Windows\System\eVVkpXP.exe
  C:\Windows\System\eVVkpXP.exe
  2⤵
  PID:5756
- C:\Windows\System\bkDbyyD.exe
  C:\Windows\System\bkDbyyD.exe
  2⤵
  PID:6052
- C:\Windows\System\qEuzSmu.exe
  C:\Windows\System\qEuzSmu.exe
  2⤵
  PID:4840
- C:\Windows\System\FmRfMrl.exe
  C:\Windows\System\FmRfMrl.exe
  2⤵
  PID:3352
- C:\Windows\System\PFFAeic.exe
  C:\Windows\System\PFFAeic.exe
  2⤵
  PID:5856
- C:\Windows\System\GqGIQAH.exe
  C:\Windows\System\GqGIQAH.exe
  2⤵
  PID:5808
- C:\Windows\System\iXUSVrk.exe
  C:\Windows\System\iXUSVrk.exe
  2⤵
  PID:2740
- C:\Windows\System\awnUSVT.exe
  C:\Windows\System\awnUSVT.exe
  2⤵
  PID:5828
- C:\Windows\System\umcFKXk.exe
  C:\Windows\System\umcFKXk.exe
  2⤵
  PID:6148
- C:\Windows\System\PFdXeNy.exe
  C:\Windows\System\PFdXeNy.exe
  2⤵
  PID:6164
- C:\Windows\System\cqhYNKk.exe
  C:\Windows\System\cqhYNKk.exe
  2⤵
  PID:6180
- C:\Windows\System\odTBxht.exe
  C:\Windows\System\odTBxht.exe
  2⤵
  PID:6196
- C:\Windows\System\zVXEVUA.exe
  C:\Windows\System\zVXEVUA.exe
  2⤵
  PID:6212
- C:\Windows\System\JUUSgjc.exe
  C:\Windows\System\JUUSgjc.exe
  2⤵
  PID:6228
- C:\Windows\System\LlGrQQm.exe
  C:\Windows\System\LlGrQQm.exe
  2⤵
  PID:6244
- C:\Windows\System\Wwneext.exe
  C:\Windows\System\Wwneext.exe
  2⤵
  PID:6260
- C:\Windows\System\eRoTYkH.exe
  C:\Windows\System\eRoTYkH.exe
  2⤵
  PID:6276
- C:\Windows\System\MmrVRGi.exe
  C:\Windows\System\MmrVRGi.exe
  2⤵
  PID:6292
- C:\Windows\System\DNBiwcT.exe
  C:\Windows\System\DNBiwcT.exe
  2⤵
  PID:6308
- C:\Windows\System\BfgPnwr.exe
  C:\Windows\System\BfgPnwr.exe
  2⤵
  PID:6324
- C:\Windows\System\ayMeyhZ.exe
  C:\Windows\System\ayMeyhZ.exe
  2⤵
  PID:6340
- C:\Windows\System\icDIubv.exe
  C:\Windows\System\icDIubv.exe
  2⤵
  PID:6356
- C:\Windows\System\bNLsuBw.exe
  C:\Windows\System\bNLsuBw.exe
  2⤵
  PID:6372
- C:\Windows\System\OyNPUea.exe
  C:\Windows\System\OyNPUea.exe
  2⤵
  PID:6388
- C:\Windows\System\CqgaQbl.exe
  C:\Windows\System\CqgaQbl.exe
  2⤵
  PID:6404
- C:\Windows\System\Vnmslgi.exe
  C:\Windows\System\Vnmslgi.exe
  2⤵
  PID:6424
- C:\Windows\System\fmeYVYl.exe
  C:\Windows\System\fmeYVYl.exe
  2⤵
  PID:6440
- C:\Windows\System\SWHwTaK.exe
  C:\Windows\System\SWHwTaK.exe
  2⤵
  PID:6456
- C:\Windows\System\XOBLfeS.exe
  C:\Windows\System\XOBLfeS.exe
  2⤵
  PID:6472
- C:\Windows\System\OyeFrZs.exe
  C:\Windows\System\OyeFrZs.exe
  2⤵
  PID:6488
- C:\Windows\System\okOqukD.exe
  C:\Windows\System\okOqukD.exe
  2⤵
  PID:6504
- C:\Windows\System\tyvJiow.exe
  C:\Windows\System\tyvJiow.exe
  2⤵
  PID:6520
- C:\Windows\System\prEhGIm.exe
  C:\Windows\System\prEhGIm.exe
  2⤵
  PID:6536
- C:\Windows\System\jcnrDQv.exe
  C:\Windows\System\jcnrDQv.exe
  2⤵
  PID:6552
- C:\Windows\System\dNjkqwp.exe
  C:\Windows\System\dNjkqwp.exe
  2⤵
  PID:6568
- C:\Windows\System\jmvCVVX.exe
  C:\Windows\System\jmvCVVX.exe
  2⤵
  PID:6584
- C:\Windows\System\lGaPxvV.exe
  C:\Windows\System\lGaPxvV.exe
  2⤵
  PID:6600
- C:\Windows\System\XjXZTeO.exe
  C:\Windows\System\XjXZTeO.exe
  2⤵
  PID:6616
- C:\Windows\System\KimEsdD.exe
  C:\Windows\System\KimEsdD.exe
  2⤵
  PID:6632
- C:\Windows\System\sgbeqJc.exe
  C:\Windows\System\sgbeqJc.exe
  2⤵
  PID:6648
- C:\Windows\System\gPEqFrD.exe
  C:\Windows\System\gPEqFrD.exe
  2⤵
  PID:6664
- C:\Windows\System\bnPYHtN.exe
  C:\Windows\System\bnPYHtN.exe
  2⤵
  PID:6680
- C:\Windows\System\afwyRnU.exe
  C:\Windows\System\afwyRnU.exe
  2⤵
  PID:6696
- C:\Windows\System\IiPmzRs.exe
  C:\Windows\System\IiPmzRs.exe
  2⤵
  PID:6712
- C:\Windows\System\UEaYwWp.exe
  C:\Windows\System\UEaYwWp.exe
  2⤵
  PID:6728
- C:\Windows\System\GnibMuT.exe
  C:\Windows\System\GnibMuT.exe
  2⤵
  PID:6744
- C:\Windows\System\kzYUlVT.exe
  C:\Windows\System\kzYUlVT.exe
  2⤵
  PID:6760
- C:\Windows\System\qGfohmq.exe
  C:\Windows\System\qGfohmq.exe
  2⤵
  PID:6776
- C:\Windows\System\JlMFpOx.exe
  C:\Windows\System\JlMFpOx.exe
  2⤵
  PID:6792
- C:\Windows\System\otdetjn.exe
  C:\Windows\System\otdetjn.exe
  2⤵
  PID:6808
- C:\Windows\System\nCpoVuL.exe
  C:\Windows\System\nCpoVuL.exe
  2⤵
  PID:6824
- C:\Windows\System\pHqCbFA.exe
  C:\Windows\System\pHqCbFA.exe
  2⤵
  PID:6840
- C:\Windows\System\xqJMGgk.exe
  C:\Windows\System\xqJMGgk.exe
  2⤵
  PID:6856
- C:\Windows\System\eSdcpGB.exe
  C:\Windows\System\eSdcpGB.exe
  2⤵
  PID:6872
- C:\Windows\System\OkVLByt.exe
  C:\Windows\System\OkVLByt.exe
  2⤵
  PID:6888
- C:\Windows\System\qBsKQFQ.exe
  C:\Windows\System\qBsKQFQ.exe
  2⤵
  PID:6904
- C:\Windows\System\jSALWvL.exe
  C:\Windows\System\jSALWvL.exe
  2⤵
  PID:6920
- C:\Windows\System\CVNSHbB.exe
  C:\Windows\System\CVNSHbB.exe
  2⤵
  PID:6936
- C:\Windows\System\oEnyZNh.exe
  C:\Windows\System\oEnyZNh.exe
  2⤵
  PID:6952
- C:\Windows\System\HyJLKBG.exe
  C:\Windows\System\HyJLKBG.exe
  2⤵
  PID:6968
- C:\Windows\System\OgqChWm.exe
  C:\Windows\System\OgqChWm.exe
  2⤵
  PID:6984
- C:\Windows\System\LINhEKI.exe
  C:\Windows\System\LINhEKI.exe
  2⤵
  PID:7000
- C:\Windows\System\NmYPDuy.exe
  C:\Windows\System\NmYPDuy.exe
  2⤵
  PID:7016
- C:\Windows\System\kMdEspZ.exe
  C:\Windows\System\kMdEspZ.exe
  2⤵
  PID:7032
- C:\Windows\System\KdYfRje.exe
  C:\Windows\System\KdYfRje.exe
  2⤵
  PID:7048
- C:\Windows\System\ynIVbgm.exe
  C:\Windows\System\ynIVbgm.exe
  2⤵
  PID:7064
- C:\Windows\System\fHGOmLf.exe
  C:\Windows\System\fHGOmLf.exe
  2⤵
  PID:7080
- C:\Windows\System\GkAncxt.exe
  C:\Windows\System\GkAncxt.exe
  2⤵
  PID:7096
- C:\Windows\System\woDUlna.exe
  C:\Windows\System\woDUlna.exe
  2⤵
  PID:7112
- C:\Windows\System\xzjmjee.exe
  C:\Windows\System\xzjmjee.exe
  2⤵
  PID:7128
- C:\Windows\System\rHElsdb.exe
  C:\Windows\System\rHElsdb.exe
  2⤵
  PID:7144
- C:\Windows\System\XmITJtO.exe
  C:\Windows\System\XmITJtO.exe
  2⤵
  PID:7160
- C:\Windows\System\DBEZchf.exe
  C:\Windows\System\DBEZchf.exe
  2⤵
  PID:4140
- C:\Windows\System\ehUlbng.exe
  C:\Windows\System\ehUlbng.exe
  2⤵
  PID:6188
- C:\Windows\System\YXjaahV.exe
  C:\Windows\System\YXjaahV.exe
  2⤵
  PID:6224
- C:\Windows\System\QgKKYGn.exe
  C:\Windows\System\QgKKYGn.exe
  2⤵
  PID:6284
- C:\Windows\System\sLgSTrg.exe
  C:\Windows\System\sLgSTrg.exe
  2⤵
  PID:6348
- C:\Windows\System\wyALTbY.exe
  C:\Windows\System\wyALTbY.exe
  2⤵
  PID:6416
- C:\Windows\System\HRTmDSV.exe
  C:\Windows\System\HRTmDSV.exe
  2⤵
  PID:6480
- C:\Windows\System\qwSMwyf.exe
  C:\Windows\System\qwSMwyf.exe
  2⤵
  PID:2824
- C:\Windows\System\briHRJW.exe
  C:\Windows\System\briHRJW.exe
  2⤵
  PID:6496
- C:\Windows\System\TxXaOLt.exe
  C:\Windows\System\TxXaOLt.exe
  2⤵
  PID:6576
- C:\Windows\System\VrpzIGt.exe
  C:\Windows\System\VrpzIGt.exe
  2⤵
  PID:6612
- C:\Windows\System\BXmLqeD.exe
  C:\Windows\System\BXmLqeD.exe
  2⤵
  PID:6240
- C:\Windows\System\psHXBzy.exe
  C:\Windows\System\psHXBzy.exe
  2⤵
  PID:6304
- C:\Windows\System\ylYUvcq.exe
  C:\Windows\System\ylYUvcq.exe
  2⤵
  PID:6368
- C:\Windows\System\JukkswU.exe
  C:\Windows\System\JukkswU.exe
  2⤵
  PID:6436
- C:\Windows\System\aklyfpZ.exe
  C:\Windows\System\aklyfpZ.exe
  2⤵
  PID:6532
- C:\Windows\System\rHHquiX.exe
  C:\Windows\System\rHHquiX.exe
  2⤵
  PID:6592
- C:\Windows\System\wAwZPnV.exe
  C:\Windows\System\wAwZPnV.exe
  2⤵
  PID:6660
- C:\Windows\System\kfFsFln.exe
  C:\Windows\System\kfFsFln.exe
  2⤵
  PID:6624
- C:\Windows\System\pxMQmCH.exe
  C:\Windows\System\pxMQmCH.exe
  2⤵
  PID:6804
- C:\Windows\System\PiPVrKD.exe
  C:\Windows\System\PiPVrKD.exe
  2⤵
  PID:6688
- C:\Windows\System\DFbZxAm.exe
  C:\Windows\System\DFbZxAm.exe
  2⤵
  PID:6720
- C:\Windows\System\vEVnIYx.exe
  C:\Windows\System\vEVnIYx.exe
  2⤵
  PID:6756
- C:\Windows\System\VhfIkHF.exe
  C:\Windows\System\VhfIkHF.exe
  2⤵
  PID:6896
- C:\Windows\System\UmQoSYE.exe
  C:\Windows\System\UmQoSYE.exe
  2⤵
  PID:6880
- C:\Windows\System\sWUkCKz.exe
  C:\Windows\System\sWUkCKz.exe
  2⤵
  PID:6948
- C:\Windows\System\xwIodqw.exe
  C:\Windows\System\xwIodqw.exe
  2⤵
  PID:6964
- C:\Windows\System\ZaRgPWo.exe
  C:\Windows\System\ZaRgPWo.exe
  2⤵
  PID:7028
- C:\Windows\System\tFafxmb.exe
  C:\Windows\System\tFafxmb.exe
  2⤵
  PID:7092
- C:\Windows\System\ThztEfV.exe
  C:\Windows\System\ThztEfV.exe
  2⤵
  PID:6980
- C:\Windows\System\kozSqeo.exe
  C:\Windows\System\kozSqeo.exe
  2⤵
  PID:2696
- C:\Windows\System\LcRdwct.exe
  C:\Windows\System\LcRdwct.exe
  2⤵
  PID:7040
- C:\Windows\System\HfzwUEW.exe
  C:\Windows\System\HfzwUEW.exe
  2⤵
  PID:7104
- C:\Windows\System\VgDjAxn.exe
  C:\Windows\System\VgDjAxn.exe
  2⤵
  PID:6220
- C:\Windows\System\eaVrJsR.exe
  C:\Windows\System\eaVrJsR.exe
  2⤵
  PID:6384
- C:\Windows\System\cErTmfV.exe
  C:\Windows\System\cErTmfV.exe
  2⤵
  PID:6516
- C:\Windows\System\YwvlVhe.exe
  C:\Windows\System\YwvlVhe.exe
  2⤵
  PID:6448
- C:\Windows\System\bFTRbaa.exe
  C:\Windows\System\bFTRbaa.exe
  2⤵
  PID:6236
- C:\Windows\System\QEkhkMV.exe
  C:\Windows\System\QEkhkMV.exe
  2⤵
  PID:6528
- C:\Windows\System\uHzeAtk.exe
  C:\Windows\System\uHzeAtk.exe
  2⤵
  PID:6772
- C:\Windows\System\YPvdBbn.exe
  C:\Windows\System\YPvdBbn.exe
  2⤵
  PID:6816
- C:\Windows\System\wzKRBQv.exe
  C:\Windows\System\wzKRBQv.exe
  2⤵
  PID:6944
- C:\Windows\System\YACEtFH.exe
  C:\Windows\System\YACEtFH.exe
  2⤵
  PID:7124
- C:\Windows\System\yBHDcmE.exe
  C:\Windows\System\yBHDcmE.exe
  2⤵
  PID:6676
- C:\Windows\System\cpHGyIV.exe
  C:\Windows\System\cpHGyIV.exe
  2⤵
  PID:6932
- C:\Windows\System\XMpfUNm.exe
  C:\Windows\System\XMpfUNm.exe
  2⤵
  PID:6868
- C:\Windows\System\CkGyqcz.exe
  C:\Windows\System\CkGyqcz.exe
  2⤵
  PID:6300
- C:\Windows\System\tmxHeTI.exe
  C:\Windows\System\tmxHeTI.exe
  2⤵
  PID:6784
- C:\Windows\System\JleJFoO.exe
  C:\Windows\System\JleJFoO.exe
  2⤵
  PID:7012
- C:\Windows\System\pXlFafX.exe
  C:\Windows\System\pXlFafX.exe
  2⤵
  PID:6320
- C:\Windows\System\afEVHEc.exe
  C:\Windows\System\afEVHEc.exe
  2⤵
  PID:6560
- C:\Windows\System\IhzfYyR.exe
  C:\Windows\System\IhzfYyR.exe
  2⤵
  PID:6596
- C:\Windows\System\QmknTyR.exe
  C:\Windows\System\QmknTyR.exe
  2⤵
  PID:6864
- C:\Windows\System\ODMBxyY.exe
  C:\Windows\System\ODMBxyY.exe
  2⤵
  PID:7072
- C:\Windows\System\wCqBOwn.exe
  C:\Windows\System\wCqBOwn.exe
  2⤵
  PID:6412
- C:\Windows\System\DgnQidC.exe
  C:\Windows\System\DgnQidC.exe
  2⤵
  PID:6548
- C:\Windows\System\oshHFHS.exe
  C:\Windows\System\oshHFHS.exe
  2⤵
  PID:6752
- C:\Windows\System\pMKldWb.exe
  C:\Windows\System\pMKldWb.exe
  2⤵
  PID:6836
- C:\Windows\System\eatKJWN.exe
  C:\Windows\System\eatKJWN.exe
  2⤵
  PID:5508
- C:\Windows\System\EeWaPcT.exe
  C:\Windows\System\EeWaPcT.exe
  2⤵
  PID:6380
- C:\Windows\System\rrFZqfn.exe
  C:\Windows\System\rrFZqfn.exe
  2⤵
  PID:6628
- C:\Windows\System\JCeZWax.exe
  C:\Windows\System\JCeZWax.exe
  2⤵
  PID:6336
- C:\Windows\System\mTJLJnp.exe
  C:\Windows\System\mTJLJnp.exe
  2⤵
  PID:7076
- C:\Windows\System\jsuRpwc.exe
  C:\Windows\System\jsuRpwc.exe
  2⤵
  PID:7184
- C:\Windows\System\OAGpCIS.exe
  C:\Windows\System\OAGpCIS.exe
  2⤵
  PID:7200
- C:\Windows\System\RLChtxJ.exe
  C:\Windows\System\RLChtxJ.exe
  2⤵
  PID:7216
- C:\Windows\System\xQLZgJq.exe
  C:\Windows\System\xQLZgJq.exe
  2⤵
  PID:7232
- C:\Windows\System\OmPDgoG.exe
  C:\Windows\System\OmPDgoG.exe
  2⤵
  PID:7248
- C:\Windows\System\idhZaVL.exe
  C:\Windows\System\idhZaVL.exe
  2⤵
  PID:7264
- C:\Windows\System\nPScOvB.exe
  C:\Windows\System\nPScOvB.exe
  2⤵
  PID:7280
- C:\Windows\System\qGdIwLK.exe
  C:\Windows\System\qGdIwLK.exe
  2⤵
  PID:7296
- C:\Windows\System\qVFbAXM.exe
  C:\Windows\System\qVFbAXM.exe
  2⤵
  PID:7312
- C:\Windows\System\pxDTSaP.exe
  C:\Windows\System\pxDTSaP.exe
  2⤵
  PID:7328
- C:\Windows\System\aikgxQy.exe
  C:\Windows\System\aikgxQy.exe
  2⤵
  PID:7344
- C:\Windows\System\MobzYGm.exe
  C:\Windows\System\MobzYGm.exe
  2⤵
  PID:7360
- C:\Windows\System\mDqbppX.exe
  C:\Windows\System\mDqbppX.exe
  2⤵
  PID:7376
- C:\Windows\System\IrruGRR.exe
  C:\Windows\System\IrruGRR.exe
  2⤵
  PID:7392
- C:\Windows\System\bMoNoub.exe
  C:\Windows\System\bMoNoub.exe
  2⤵
  PID:7408
- C:\Windows\System\PNSqXGQ.exe
  C:\Windows\System\PNSqXGQ.exe
  2⤵
  PID:7424
- C:\Windows\System\zzjGgKq.exe
  C:\Windows\System\zzjGgKq.exe
  2⤵
  PID:7440
- C:\Windows\System\ZjwWXdy.exe
  C:\Windows\System\ZjwWXdy.exe
  2⤵
  PID:7456
- C:\Windows\System\snPtDta.exe
  C:\Windows\System\snPtDta.exe
  2⤵
  PID:7472
- C:\Windows\System\OXlRYvC.exe
  C:\Windows\System\OXlRYvC.exe
  2⤵
  PID:7488
- C:\Windows\System\VcWQMYw.exe
  C:\Windows\System\VcWQMYw.exe
  2⤵
  PID:7504
- C:\Windows\System\OjilJNz.exe
  C:\Windows\System\OjilJNz.exe
  2⤵
  PID:7520
- C:\Windows\System\FLrqaoB.exe
  C:\Windows\System\FLrqaoB.exe
  2⤵
  PID:7536
- C:\Windows\System\VYRSYjx.exe
  C:\Windows\System\VYRSYjx.exe
  2⤵
  PID:7552
- C:\Windows\System\nGVJTFN.exe
  C:\Windows\System\nGVJTFN.exe
  2⤵
  PID:7568
- C:\Windows\System\gFzfCBW.exe
  C:\Windows\System\gFzfCBW.exe
  2⤵
  PID:7584
- C:\Windows\System\RtuPTYC.exe
  C:\Windows\System\RtuPTYC.exe
  2⤵
  PID:7600
- C:\Windows\System\jKYvgpw.exe
  C:\Windows\System\jKYvgpw.exe
  2⤵
  PID:7616
- C:\Windows\System\IZyuILt.exe
  C:\Windows\System\IZyuILt.exe
  2⤵
  PID:7632
- C:\Windows\System\dWGaXMr.exe
  C:\Windows\System\dWGaXMr.exe
  2⤵
  PID:7648
- C:\Windows\System\AytSxGh.exe
  C:\Windows\System\AytSxGh.exe
  2⤵
  PID:7664
- C:\Windows\System\ebAnOPr.exe
  C:\Windows\System\ebAnOPr.exe
  2⤵
  PID:7680
- C:\Windows\System\pSgOEfY.exe
  C:\Windows\System\pSgOEfY.exe
  2⤵
  PID:7696
- C:\Windows\System\XHJCsCO.exe
  C:\Windows\System\XHJCsCO.exe
  2⤵
  PID:7712
- C:\Windows\System\AOhdjoz.exe
  C:\Windows\System\AOhdjoz.exe
  2⤵
  PID:7728
- C:\Windows\System\AMYgIbL.exe
  C:\Windows\System\AMYgIbL.exe
  2⤵
  PID:7744
- C:\Windows\System\tBRklOK.exe
  C:\Windows\System\tBRklOK.exe
  2⤵
  PID:7760
- C:\Windows\System\XCBDrfG.exe
  C:\Windows\System\XCBDrfG.exe
  2⤵
  PID:7776
- C:\Windows\System\FuGuqbh.exe
  C:\Windows\System\FuGuqbh.exe
  2⤵
  PID:7792
- C:\Windows\System\vmEEGHR.exe
  C:\Windows\System\vmEEGHR.exe
  2⤵
  PID:7808
- C:\Windows\System\BkNTNTM.exe
  C:\Windows\System\BkNTNTM.exe
  2⤵
  PID:7824
- C:\Windows\System\hoimCWm.exe
  C:\Windows\System\hoimCWm.exe
  2⤵
  PID:7840
- C:\Windows\System\xePvaIV.exe
  C:\Windows\System\xePvaIV.exe
  2⤵
  PID:7856
- C:\Windows\System\isVNdKP.exe
  C:\Windows\System\isVNdKP.exe
  2⤵
  PID:7872
- C:\Windows\System\hyutxgV.exe
  C:\Windows\System\hyutxgV.exe
  2⤵
  PID:7888
- C:\Windows\System\ikpGHAP.exe
  C:\Windows\System\ikpGHAP.exe
  2⤵
  PID:7904
- C:\Windows\System\OBIxzmG.exe
  C:\Windows\System\OBIxzmG.exe
  2⤵
  PID:7920
- C:\Windows\System\SdwXgOY.exe
  C:\Windows\System\SdwXgOY.exe
  2⤵
  PID:7936
- C:\Windows\System\DIXDZMj.exe
  C:\Windows\System\DIXDZMj.exe
  2⤵
  PID:7952
- C:\Windows\System\YDnDoOx.exe
  C:\Windows\System\YDnDoOx.exe
  2⤵
  PID:7968
- C:\Windows\System\wuDSmrc.exe
  C:\Windows\System\wuDSmrc.exe
  2⤵
  PID:7984
- C:\Windows\System\xRoMkpH.exe
  C:\Windows\System\xRoMkpH.exe
  2⤵
  PID:8000
- C:\Windows\System\wnzjqgQ.exe
  C:\Windows\System\wnzjqgQ.exe
  2⤵
  PID:8016
- C:\Windows\System\VSDufYm.exe
  C:\Windows\System\VSDufYm.exe
  2⤵
  PID:8032
- C:\Windows\System\LQSivWB.exe
  C:\Windows\System\LQSivWB.exe
  2⤵
  PID:8048
- C:\Windows\System\iDcZTZe.exe
  C:\Windows\System\iDcZTZe.exe
  2⤵
  PID:8064
- C:\Windows\System\VNTLfRF.exe
  C:\Windows\System\VNTLfRF.exe
  2⤵
  PID:8080
- C:\Windows\System\zqhSMJX.exe
  C:\Windows\System\zqhSMJX.exe
  2⤵
  PID:8096
- C:\Windows\System\vBsbdHT.exe
  C:\Windows\System\vBsbdHT.exe
  2⤵
  PID:8112
- C:\Windows\System\HjSRfdH.exe
  C:\Windows\System\HjSRfdH.exe
  2⤵
  PID:8128
- C:\Windows\System\EjuSaIc.exe
  C:\Windows\System\EjuSaIc.exe
  2⤵
  PID:8148
- C:\Windows\System\HYHtNXC.exe
  C:\Windows\System\HYHtNXC.exe
  2⤵
  PID:8164
- C:\Windows\System\LtcIVPp.exe
  C:\Windows\System\LtcIVPp.exe
  2⤵
  PID:8180
- C:\Windows\System\CgaDMrp.exe
  C:\Windows\System\CgaDMrp.exe
  2⤵
  PID:6316
- C:\Windows\System\gkBmXtZ.exe
  C:\Windows\System\gkBmXtZ.exe
  2⤵
  PID:7212
- C:\Windows\System\bNfVjtG.exe
  C:\Windows\System\bNfVjtG.exe
  2⤵
  PID:7276
- C:\Windows\System\vZqvFaV.exe
  C:\Windows\System\vZqvFaV.exe
  2⤵
  PID:7340
- C:\Windows\System\LHiEoqR.exe
  C:\Windows\System\LHiEoqR.exe
  2⤵
  PID:7404
- C:\Windows\System\qnjonAi.exe
  C:\Windows\System\qnjonAi.exe
  2⤵
  PID:7468
- C:\Windows\System\zZvfzbI.exe
  C:\Windows\System\zZvfzbI.exe
  2⤵
  PID:7532
- C:\Windows\System\JsHCsRO.exe
  C:\Windows\System\JsHCsRO.exe
  2⤵
  PID:7596
- C:\Windows\System\dgckCAe.exe
  C:\Windows\System\dgckCAe.exe
  2⤵
  PID:7660
- C:\Windows\System\NUctefA.exe
  C:\Windows\System\NUctefA.exe
  2⤵
  PID:7724
- C:\Windows\System\sVbUipg.exe
  C:\Windows\System\sVbUipg.exe
  2⤵
  PID:7788
- C:\Windows\System\IUJtxUR.exe
  C:\Windows\System\IUJtxUR.exe
  2⤵
  PID:7852
- C:\Windows\System\BIEwbrh.exe
  C:\Windows\System\BIEwbrh.exe
  2⤵
  PID:6740
- C:\Windows\System\aZpTYOk.exe
  C:\Windows\System\aZpTYOk.exe
  2⤵
  PID:7944
- C:\Windows\System\KrovELv.exe
  C:\Windows\System\KrovELv.exe
  2⤵
  PID:7352
- C:\Windows\System\nLDFJNA.exe
  C:\Windows\System\nLDFJNA.exe
  2⤵
  PID:7516
- C:\Windows\System\ItsOYLK.exe
  C:\Windows\System\ItsOYLK.exe
  2⤵
  PID:7640
- C:\Windows\System\rLxlqri.exe
  C:\Windows\System\rLxlqri.exe
  2⤵
  PID:8104
- C:\Windows\System\VXLfMiF.exe
  C:\Windows\System\VXLfMiF.exe
  2⤵
  PID:6252
- C:\Windows\System\jTjnYJf.exe
  C:\Windows\System\jTjnYJf.exe
  2⤵
  PID:7388
- C:\Windows\System\XTVCOvJ.exe
  C:\Windows\System\XTVCOvJ.exe
  2⤵
  PID:7736
- C:\Windows\System\AywQWPq.exe
  C:\Windows\System\AywQWPq.exe
  2⤵
  PID:7192
- C:\Windows\System\VlpPcDS.exe
  C:\Windows\System\VlpPcDS.exe
  2⤵
  PID:7260
- C:\Windows\System\twKCjxF.exe
  C:\Windows\System\twKCjxF.exe
  2⤵
  PID:7356
- C:\Windows\System\fqmTqJo.exe
  C:\Windows\System\fqmTqJo.exe
  2⤵
  PID:7452
- C:\Windows\System\OnyYAKr.exe
  C:\Windows\System\OnyYAKr.exe
  2⤵
  PID:7580
- C:\Windows\System\iycDlnt.exe
  C:\Windows\System\iycDlnt.exe
  2⤵
  PID:7704
- C:\Windows\System\JBggCAX.exe
  C:\Windows\System\JBggCAX.exe
  2⤵
  PID:7800
- C:\Windows\System\GfvfySd.exe
  C:\Windows\System\GfvfySd.exe
  2⤵
  PID:7900
- C:\Windows\System\lnmEASc.exe
  C:\Windows\System\lnmEASc.exe
  2⤵
  PID:7996
- C:\Windows\System\NHLijly.exe
  C:\Windows\System\NHLijly.exe
  2⤵
  PID:8060
- C:\Windows\System\XPTzlhh.exe
  C:\Windows\System\XPTzlhh.exe
  2⤵
  PID:8124
- C:\Windows\System\fHFqXzh.exe
  C:\Windows\System\fHFqXzh.exe
  2⤵
  PID:8144
- C:\Windows\System\nQPJAgO.exe
  C:\Windows\System\nQPJAgO.exe
  2⤵
  PID:7336
- C:\Windows\System\wORsvlv.exe
  C:\Windows\System\wORsvlv.exe
  2⤵
  PID:7592
- C:\Windows\System\JdGggnG.exe
  C:\Windows\System\JdGggnG.exe
  2⤵
  PID:7692
- C:\Windows\System\DpzJKCG.exe
  C:\Windows\System\DpzJKCG.exe
  2⤵
  PID:7912
- C:\Windows\System\PaClUOU.exe
  C:\Windows\System\PaClUOU.exe
  2⤵
  PID:8012
- C:\Windows\System\qoDAeQs.exe
  C:\Windows\System\qoDAeQs.exe
  2⤵
  PID:7976
- C:\Windows\System\NWZfshg.exe
  C:\Windows\System\NWZfshg.exe
  2⤵
  PID:7372
- C:\Windows\System\KBVMBFh.exe
  C:\Windows\System\KBVMBFh.exe
  2⤵
  PID:7676
- C:\Windows\System\pbblXET.exe
  C:\Windows\System\pbblXET.exe
  2⤵
  PID:7884
- C:\Windows\System\nEnuqpB.exe
  C:\Windows\System\nEnuqpB.exe
  2⤵
  PID:7224
- C:\Windows\System\hzoXBzm.exe
  C:\Windows\System\hzoXBzm.exe
  2⤵
  PID:7804
- C:\Windows\System\mAXRUbo.exe
  C:\Windows\System\mAXRUbo.exe
  2⤵
  PID:7256
- C:\Windows\System\RyZbKLC.exe
  C:\Windows\System\RyZbKLC.exe
  2⤵
  PID:7512
- C:\Windows\System\txkUiCN.exe
  C:\Windows\System\txkUiCN.exe
  2⤵
  PID:7964
- C:\Windows\System\eVyIRUc.exe
  C:\Windows\System\eVyIRUc.exe
  2⤵
  PID:7992
- C:\Windows\System\pITuDmf.exe
  C:\Windows\System\pITuDmf.exe
  2⤵
  PID:7916
- C:\Windows\System\JWtBrkF.exe
  C:\Windows\System\JWtBrkF.exe
  2⤵
  PID:7672
- C:\Windows\System\RfqVrhU.exe
  C:\Windows\System\RfqVrhU.exe
  2⤵
  PID:6916
- C:\Windows\System\LmQZIxn.exe
  C:\Windows\System\LmQZIxn.exe
  2⤵
  PID:7528
- C:\Windows\System\OdjbMTW.exe
  C:\Windows\System\OdjbMTW.exe
  2⤵
  PID:7868
- C:\Windows\System\dwCzswF.exe
  C:\Windows\System\dwCzswF.exe
  2⤵
  PID:7612
- C:\Windows\System\CKXbFma.exe
  C:\Windows\System\CKXbFma.exe
  2⤵
  PID:7740
- C:\Windows\System\yVuWUkz.exe
  C:\Windows\System\yVuWUkz.exe
  2⤵
  PID:8056
- C:\Windows\System\QxPcqRY.exe
  C:\Windows\System\QxPcqRY.exe
  2⤵
  PID:7496
- C:\Windows\System\YDbbUAm.exe
  C:\Windows\System\YDbbUAm.exe
  2⤵
  PID:7836
- C:\Windows\System\YScmzXt.exe
  C:\Windows\System\YScmzXt.exe
  2⤵
  PID:7784
- C:\Windows\System\tcunXjO.exe
  C:\Windows\System\tcunXjO.exe
  2⤵
  PID:7448
- C:\Windows\System\ZkeZpSK.exe
  C:\Windows\System\ZkeZpSK.exe
  2⤵
  PID:7464
- C:\Windows\System\arhWQhn.exe
  C:\Windows\System\arhWQhn.exe
  2⤵
  PID:8072
- C:\Windows\System\aKDKFFl.exe
  C:\Windows\System\aKDKFFl.exe
  2⤵
  PID:7244
- C:\Windows\System\rntOHRi.exe
  C:\Windows\System\rntOHRi.exe
  2⤵
  PID:6884
- C:\Windows\System\hDUMoqs.exe
  C:\Windows\System\hDUMoqs.exe
  2⤵
  PID:8200
- C:\Windows\System\bJpAzvw.exe
  C:\Windows\System\bJpAzvw.exe
  2⤵
  PID:8216
- C:\Windows\System\JyfZzmb.exe
  C:\Windows\System\JyfZzmb.exe
  2⤵
  PID:8232
- C:\Windows\System\ApeTXSj.exe
  C:\Windows\System\ApeTXSj.exe
  2⤵
  PID:8248
- C:\Windows\System\MKPTVQL.exe
  C:\Windows\System\MKPTVQL.exe
  2⤵
  PID:8264
- C:\Windows\System\oHNedhG.exe
  C:\Windows\System\oHNedhG.exe
  2⤵
  PID:8280
- C:\Windows\System\wCiuNfM.exe
  C:\Windows\System\wCiuNfM.exe
  2⤵
  PID:8296
- C:\Windows\System\QfDHOwQ.exe
  C:\Windows\System\QfDHOwQ.exe
  2⤵
  PID:8312
- C:\Windows\System\QXzOiIR.exe
  C:\Windows\System\QXzOiIR.exe
  2⤵
  PID:8328
- C:\Windows\System\ELEgVlG.exe
  C:\Windows\System\ELEgVlG.exe
  2⤵
  PID:8344
- C:\Windows\System\dlZAyhp.exe
  C:\Windows\System\dlZAyhp.exe
  2⤵
  PID:8360
- C:\Windows\System\ibjYLiL.exe
  C:\Windows\System\ibjYLiL.exe
  2⤵
  PID:8376
- C:\Windows\System\AssdTBk.exe
  C:\Windows\System\AssdTBk.exe
  2⤵
  PID:8392
- C:\Windows\System\fzynGne.exe
  C:\Windows\System\fzynGne.exe
  2⤵
  PID:8408
- C:\Windows\System\NtyavfE.exe
  C:\Windows\System\NtyavfE.exe
  2⤵
  PID:8424
- C:\Windows\System\rlcGhhe.exe
  C:\Windows\System\rlcGhhe.exe
  2⤵
  PID:8440
- C:\Windows\System\lKvYuzr.exe
  C:\Windows\System\lKvYuzr.exe
  2⤵
  PID:8456
- C:\Windows\System\PZvybDB.exe
  C:\Windows\System\PZvybDB.exe
  2⤵
  PID:8472
- C:\Windows\System\vlWPNIJ.exe
  C:\Windows\System\vlWPNIJ.exe
  2⤵
  PID:8488
- C:\Windows\System\VjDbHdp.exe
  C:\Windows\System\VjDbHdp.exe
  2⤵
  PID:8504
- C:\Windows\System\EtPzJrl.exe
  C:\Windows\System\EtPzJrl.exe
  2⤵
  PID:8520
- C:\Windows\System\cHwNkbU.exe
  C:\Windows\System\cHwNkbU.exe
  2⤵
  PID:8536
- C:\Windows\System\YFwHgtn.exe
  C:\Windows\System\YFwHgtn.exe
  2⤵
  PID:8552
- C:\Windows\System\KkLjort.exe
  C:\Windows\System\KkLjort.exe
  2⤵
  PID:8568
- C:\Windows\System\tFPnyLt.exe
  C:\Windows\System\tFPnyLt.exe
  2⤵
  PID:8584
- C:\Windows\System\ridmbro.exe
  C:\Windows\System\ridmbro.exe
  2⤵
  PID:8600
- C:\Windows\System\KngqfWp.exe
  C:\Windows\System\KngqfWp.exe
  2⤵
  PID:8616
- C:\Windows\System\MyDsmUH.exe
  C:\Windows\System\MyDsmUH.exe
  2⤵
  PID:8632
- C:\Windows\System\bXAHIDK.exe
  C:\Windows\System\bXAHIDK.exe
  2⤵
  PID:8648
- C:\Windows\System\XlYyByW.exe
  C:\Windows\System\XlYyByW.exe
  2⤵
  PID:8664
- C:\Windows\System\biNRQdf.exe
  C:\Windows\System\biNRQdf.exe
  2⤵
  PID:8680
- C:\Windows\System\ziSXdeO.exe
  C:\Windows\System\ziSXdeO.exe
  2⤵
  PID:8696
- C:\Windows\System\nUHjSSF.exe
  C:\Windows\System\nUHjSSF.exe
  2⤵
  PID:8712
- C:\Windows\System\lsXuzha.exe
  C:\Windows\System\lsXuzha.exe
  2⤵
  PID:8728
- C:\Windows\System\bMMPlpM.exe
  C:\Windows\System\bMMPlpM.exe
  2⤵
  PID:8744
- C:\Windows\System\nVxVSlj.exe
  C:\Windows\System\nVxVSlj.exe
  2⤵
  PID:8760
- C:\Windows\System\gZrSsTl.exe
  C:\Windows\System\gZrSsTl.exe
  2⤵
  PID:8776
- C:\Windows\System\cNWavUL.exe
  C:\Windows\System\cNWavUL.exe
  2⤵
  PID:8792
- C:\Windows\System\pvqLbUB.exe
  C:\Windows\System\pvqLbUB.exe
  2⤵
  PID:8816
- C:\Windows\System\XdmJFho.exe
  C:\Windows\System\XdmJFho.exe
  2⤵
  PID:8832
- C:\Windows\System\gFGPqKv.exe
  C:\Windows\System\gFGPqKv.exe
  2⤵
  PID:8848
- C:\Windows\System\PrNWzhR.exe
  C:\Windows\System\PrNWzhR.exe
  2⤵
  PID:8864
- C:\Windows\System\XTSjmhF.exe
  C:\Windows\System\XTSjmhF.exe
  2⤵
  PID:8880
- C:\Windows\System\JcSxuRW.exe
  C:\Windows\System\JcSxuRW.exe
  2⤵
  PID:8896
- C:\Windows\System\APgqrOJ.exe
  C:\Windows\System\APgqrOJ.exe
  2⤵
  PID:8912
- C:\Windows\System\zhhhmzI.exe
  C:\Windows\System\zhhhmzI.exe
  2⤵
  PID:8928
- C:\Windows\System\qPQhbsR.exe
  C:\Windows\System\qPQhbsR.exe
  2⤵
  PID:8944
- C:\Windows\System\sNTzXuO.exe
  C:\Windows\System\sNTzXuO.exe
  2⤵
  PID:8960
- C:\Windows\System\oHGAVGV.exe
  C:\Windows\System\oHGAVGV.exe
  2⤵
  PID:8976
- C:\Windows\System\fqEUGcJ.exe
  C:\Windows\System\fqEUGcJ.exe
  2⤵
  PID:8992
- C:\Windows\System\DXMURyE.exe
  C:\Windows\System\DXMURyE.exe
  2⤵
  PID:9008
- C:\Windows\System\mHrVACx.exe
  C:\Windows\System\mHrVACx.exe
  2⤵
  PID:9024
- C:\Windows\System\RpFCwGb.exe
  C:\Windows\System\RpFCwGb.exe
  2⤵
  PID:9040
- C:\Windows\System\clfstwN.exe
  C:\Windows\System\clfstwN.exe
  2⤵
  PID:9056
- C:\Windows\System\zsvvhPB.exe
  C:\Windows\System\zsvvhPB.exe
  2⤵
  PID:9072
- C:\Windows\System\OpYjgyp.exe
  C:\Windows\System\OpYjgyp.exe
  2⤵
  PID:9088
- C:\Windows\System\pkrYyYN.exe
  C:\Windows\System\pkrYyYN.exe
  2⤵
  PID:9104
- C:\Windows\System\pjkBQyP.exe
  C:\Windows\System\pjkBQyP.exe
  2⤵
  PID:9120
- C:\Windows\System\yfxJOzb.exe
  C:\Windows\System\yfxJOzb.exe
  2⤵
  PID:9136
- C:\Windows\System\TjyaWSD.exe
  C:\Windows\System\TjyaWSD.exe
  2⤵
  PID:9152
- C:\Windows\System\JzBJboO.exe
  C:\Windows\System\JzBJboO.exe
  2⤵
  PID:9168
- C:\Windows\System\diGzmQS.exe
  C:\Windows\System\diGzmQS.exe
  2⤵
  PID:9184
- C:\Windows\System\pCamLbF.exe
  C:\Windows\System\pCamLbF.exe
  2⤵
  PID:9200
- C:\Windows\System\AMAJlkr.exe
  C:\Windows\System\AMAJlkr.exe
  2⤵
  PID:8208
- C:\Windows\System\HvrgJFq.exe
  C:\Windows\System\HvrgJFq.exe
  2⤵
  PID:7564
- C:\Windows\System\jnFMhLu.exe
  C:\Windows\System\jnFMhLu.exe
  2⤵
  PID:8308
- C:\Windows\System\tGpNYJp.exe
  C:\Windows\System\tGpNYJp.exe
  2⤵
  PID:8372
- C:\Windows\System\GRbOOCc.exe
  C:\Windows\System\GRbOOCc.exe
  2⤵
  PID:8436
- C:\Windows\System\uITaNXv.exe
  C:\Windows\System\uITaNXv.exe
  2⤵
  PID:8468
- C:\Windows\System\ziejIrv.exe
  C:\Windows\System\ziejIrv.exe
  2⤵
  PID:8256
- C:\Windows\System\lEBYNDW.exe
  C:\Windows\System\lEBYNDW.exe
  2⤵
  PID:8120
- C:\Windows\System\cWNFzAq.exe
  C:\Windows\System\cWNFzAq.exe
  2⤵
  PID:7272
- C:\Windows\System\CgPNwae.exe
  C:\Windows\System\CgPNwae.exe
  2⤵
  PID:8228
- C:\Windows\System\zsFGyLT.exe
  C:\Windows\System\zsFGyLT.exe
  2⤵
  PID:8292
- C:\Windows\System\sYONZGU.exe
  C:\Windows\System\sYONZGU.exe
  2⤵
  PID:8384
- C:\Windows\System\IPmBWsw.exe
  C:\Windows\System\IPmBWsw.exe
  2⤵
  PID:8624
- C:\Windows\System\ZiqCZxU.exe
  C:\Windows\System\ZiqCZxU.exe
  2⤵
  PID:8580
- C:\Windows\System\BUGnUCQ.exe
  C:\Windows\System\BUGnUCQ.exe
  2⤵
  PID:8516
- C:\Windows\System\SzwkpeE.exe
  C:\Windows\System\SzwkpeE.exe
  2⤵
  PID:8660
- C:\Windows\System\OSwbwvI.exe
  C:\Windows\System\OSwbwvI.exe
  2⤵
  PID:8644
- C:\Windows\System\xkDFajW.exe
  C:\Windows\System\xkDFajW.exe
  2⤵
  PID:8704
- C:\Windows\System\CfPlZan.exe
  C:\Windows\System\CfPlZan.exe
  2⤵
  PID:8752
- C:\Windows\System\WjDHBPy.exe
  C:\Windows\System\WjDHBPy.exe
  2⤵
  PID:8784
- C:\Windows\System\MxUFzwT.exe
  C:\Windows\System\MxUFzwT.exe
  2⤵
  PID:8800
- C:\Windows\System\ILQMnRy.exe
  C:\Windows\System\ILQMnRy.exe
  2⤵
  PID:8856
- C:\Windows\System\ZWHNNYf.exe
  C:\Windows\System\ZWHNNYf.exe
  2⤵
  PID:8920
- C:\Windows\System\SlteXZD.exe
  C:\Windows\System\SlteXZD.exe
  2⤵
  PID:8812
- C:\Windows\System\BIrbBeJ.exe
  C:\Windows\System\BIrbBeJ.exe
  2⤵
  PID:9020
- C:\Windows\System\KsdIvbx.exe
  C:\Windows\System\KsdIvbx.exe
  2⤵
  PID:9084
- C:\Windows\System\ZqkxfXL.exe
  C:\Windows\System\ZqkxfXL.exe
  2⤵
  PID:8936
- C:\Windows\System\HuXKCqB.exe
  C:\Windows\System\HuXKCqB.exe
  2⤵
  PID:9176
- C:\Windows\System\ckTZMSW.exe
  C:\Windows\System\ckTZMSW.exe
  2⤵
  PID:9064
- C:\Windows\System\OiwDmSY.exe
  C:\Windows\System\OiwDmSY.exe
  2⤵
  PID:8404
- C:\Windows\System\jJhcAbS.exe
  C:\Windows\System\jJhcAbS.exe
  2⤵
  PID:8876
- C:\Windows\System\aujCLMP.exe
  C:\Windows\System\aujCLMP.exe
  2⤵
  PID:8500
- C:\Windows\System\ZtBkBHA.exe
  C:\Windows\System\ZtBkBHA.exe
  2⤵
  PID:9000
- C:\Windows\System\kOyaKQQ.exe
  C:\Windows\System\kOyaKQQ.exe
  2⤵
  PID:8244
- C:\Windows\System\SIPqPVq.exe
  C:\Windows\System\SIPqPVq.exe
  2⤵
  PID:8260
- C:\Windows\System\syidrih.exe
  C:\Windows\System\syidrih.exe
  2⤵
  PID:9192
- C:\Windows\System\MaAZWtY.exe
  C:\Windows\System\MaAZWtY.exe
  2⤵
  PID:8560
- C:\Windows\System\LNXDeVh.exe
  C:\Windows\System\LNXDeVh.exe
  2⤵
  PID:8288
- C:\Windows\System\OEccdyS.exe
  C:\Windows\System\OEccdyS.exe
  2⤵
  PID:8416
- C:\Windows\System\DUyASzd.exe
  C:\Windows\System\DUyASzd.exe
  2⤵
  PID:8688
- C:\Windows\System\zPBbHtJ.exe
  C:\Windows\System\zPBbHtJ.exe
  2⤵
  PID:8768
- C:\Windows\System\eGtsoDf.exe
  C:\Windows\System\eGtsoDf.exe
  2⤵
  PID:8676
- C:\Windows\System\yMwVZgB.exe
  C:\Windows\System\yMwVZgB.exe
  2⤵
  PID:8576
- C:\Windows\System\VOVDljB.exe
  C:\Windows\System\VOVDljB.exe
  2⤵
  PID:8804
- C:\Windows\System\IXlFULs.exe
  C:\Windows\System\IXlFULs.exe
  2⤵
  PID:8892
- C:\Windows\System\DBgbiWQ.exe
  C:\Windows\System\DBgbiWQ.exe
  2⤵
  PID:9112
- C:\Windows\System\qvhEuIb.exe
  C:\Windows\System\qvhEuIb.exe
  2⤵
  PID:9080
- C:\Windows\System\sqozRlQ.exe
  C:\Windows\System\sqozRlQ.exe
  2⤵
  PID:8840
- C:\Windows\System\TbWylyc.exe
  C:\Windows\System\TbWylyc.exe
  2⤵
  PID:9096
- C:\Windows\System\uPWPvpu.exe
  C:\Windows\System\uPWPvpu.exe
  2⤵
  PID:8544
- C:\Windows\System\oLHCzSk.exe
  C:\Windows\System\oLHCzSk.exe
  2⤵
  PID:8276
- C:\Windows\System\MiwSfPp.exe
  C:\Windows\System\MiwSfPp.exe
  2⤵
  PID:8304
- C:\Windows\System\AyOFJnK.exe
  C:\Windows\System\AyOFJnK.exe
  2⤵
  PID:8656
- C:\Windows\System\hpdZcrE.exe
  C:\Windows\System\hpdZcrE.exe
  2⤵
  PID:9052
- C:\Windows\System\kQDUCCj.exe
  C:\Windows\System\kQDUCCj.exe
  2⤵
  PID:8972
- C:\Windows\System\PDfwGfC.exe
  C:\Windows\System\PDfwGfC.exe
  2⤵
  PID:9220
- C:\Windows\System\kEBQBSU.exe
  C:\Windows\System\kEBQBSU.exe
  2⤵
  PID:9236
- C:\Windows\System\aVXvAWE.exe
  C:\Windows\System\aVXvAWE.exe
  2⤵
  PID:9252
- C:\Windows\System\jDRqZoC.exe
  C:\Windows\System\jDRqZoC.exe
  2⤵
  PID:9268
- C:\Windows\System\uOVlMQJ.exe
  C:\Windows\System\uOVlMQJ.exe
  2⤵
  PID:9284
- C:\Windows\System\cceSSMj.exe
  C:\Windows\System\cceSSMj.exe
  2⤵
  PID:9300
- C:\Windows\System\zSShNHe.exe
  C:\Windows\System\zSShNHe.exe
  2⤵
  PID:9316
- C:\Windows\System\CUOnYnS.exe
  C:\Windows\System\CUOnYnS.exe
  2⤵
  PID:9332
- C:\Windows\System\PKXAfTR.exe
  C:\Windows\System\PKXAfTR.exe
  2⤵
  PID:9348
- C:\Windows\System\GBuEOox.exe
  C:\Windows\System\GBuEOox.exe
  2⤵
  PID:9364
- C:\Windows\System\ZvaqEHj.exe
  C:\Windows\System\ZvaqEHj.exe
  2⤵
  PID:9380
- C:\Windows\System\CPlzwmC.exe
  C:\Windows\System\CPlzwmC.exe
  2⤵
  PID:9396
- C:\Windows\System\PsSWjlP.exe
  C:\Windows\System\PsSWjlP.exe
  2⤵
  PID:9412
- C:\Windows\System\iPAGWIH.exe
  C:\Windows\System\iPAGWIH.exe
  2⤵
  PID:9428
- C:\Windows\System\htCJdgL.exe
  C:\Windows\System\htCJdgL.exe
  2⤵
  PID:9444
- C:\Windows\System\sUGFdKR.exe
  C:\Windows\System\sUGFdKR.exe
  2⤵
  PID:9460
- C:\Windows\System\JblESCX.exe
  C:\Windows\System\JblESCX.exe
  2⤵
  PID:9476
- C:\Windows\System\SIaTwVZ.exe
  C:\Windows\System\SIaTwVZ.exe
  2⤵
  PID:9492
- C:\Windows\System\cyPUfYq.exe
  C:\Windows\System\cyPUfYq.exe
  2⤵
  PID:9508
- C:\Windows\System\VljSIQz.exe
  C:\Windows\System\VljSIQz.exe
  2⤵
  PID:9524
- C:\Windows\System\hyGakki.exe
  C:\Windows\System\hyGakki.exe
  2⤵
  PID:9540
- C:\Windows\System\dwNYAdQ.exe
  C:\Windows\System\dwNYAdQ.exe
  2⤵
  PID:9556
- C:\Windows\System\LEXvYxU.exe
  C:\Windows\System\LEXvYxU.exe
  2⤵
  PID:9572
- C:\Windows\System\hcNHOST.exe
  C:\Windows\System\hcNHOST.exe
  2⤵
  PID:9588
- C:\Windows\System\LnGHYJu.exe
  C:\Windows\System\LnGHYJu.exe
  2⤵
  PID:9604
- C:\Windows\System\euCAMdb.exe
  C:\Windows\System\euCAMdb.exe
  2⤵
  PID:9620
- C:\Windows\System\pvLHAZw.exe
  C:\Windows\System\pvLHAZw.exe
  2⤵
  PID:9636
- C:\Windows\System\BPGisQj.exe
  C:\Windows\System\BPGisQj.exe
  2⤵
  PID:9652
- C:\Windows\System\vHPApzL.exe
  C:\Windows\System\vHPApzL.exe
  2⤵
  PID:9668
- C:\Windows\System\BApNlqb.exe
  C:\Windows\System\BApNlqb.exe
  2⤵
  PID:9684
- C:\Windows\System\wrPWIQP.exe
  C:\Windows\System\wrPWIQP.exe
  2⤵
  PID:9700
- C:\Windows\System\seYKKef.exe
  C:\Windows\System\seYKKef.exe
  2⤵
  PID:9716
- C:\Windows\System\QeeGPBa.exe
  C:\Windows\System\QeeGPBa.exe
  2⤵
  PID:9732
- C:\Windows\System\OXGotDD.exe
  C:\Windows\System\OXGotDD.exe
  2⤵
  PID:9748
- C:\Windows\System\rtwAFPc.exe
  C:\Windows\System\rtwAFPc.exe
  2⤵
  PID:9764
- C:\Windows\System\yvXnBli.exe
  C:\Windows\System\yvXnBli.exe
  2⤵
  PID:9780
- C:\Windows\System\GhcmAcu.exe
  C:\Windows\System\GhcmAcu.exe
  2⤵
  PID:9796
- C:\Windows\System\LIvdIQz.exe
  C:\Windows\System\LIvdIQz.exe
  2⤵
  PID:9812
- C:\Windows\System\HseHTtX.exe
  C:\Windows\System\HseHTtX.exe
  2⤵
  PID:9828
- C:\Windows\System\xJwTkxy.exe
  C:\Windows\System\xJwTkxy.exe
  2⤵
  PID:9844
- C:\Windows\System\ACutbaS.exe
  C:\Windows\System\ACutbaS.exe
  2⤵
  PID:9860
- C:\Windows\System\kbSdQOO.exe
  C:\Windows\System\kbSdQOO.exe
  2⤵
  PID:9876
- C:\Windows\System\oKeDkRK.exe
  C:\Windows\System\oKeDkRK.exe
  2⤵
  PID:9892
- C:\Windows\System\zmQXRbD.exe
  C:\Windows\System\zmQXRbD.exe
  2⤵
  PID:9908
- C:\Windows\System\OaiIBBU.exe
  C:\Windows\System\OaiIBBU.exe
  2⤵
  PID:9924
- C:\Windows\System\RQfKzVm.exe
  C:\Windows\System\RQfKzVm.exe
  2⤵
  PID:9940
- C:\Windows\System\bPlxgsV.exe
  C:\Windows\System\bPlxgsV.exe
  2⤵
  PID:9956
- C:\Windows\System\BSVFSCm.exe
  C:\Windows\System\BSVFSCm.exe
  2⤵
  PID:9972
- C:\Windows\System\ZqKDqWP.exe
  C:\Windows\System\ZqKDqWP.exe
  2⤵
  PID:9988
- C:\Windows\System\wJIBAHf.exe
  C:\Windows\System\wJIBAHf.exe
  2⤵
  PID:10004
- C:\Windows\System\UQvroan.exe
  C:\Windows\System\UQvroan.exe
  2⤵
  PID:10020
- C:\Windows\System\YnkSYnU.exe
  C:\Windows\System\YnkSYnU.exe
  2⤵
  PID:10036
- C:\Windows\System\ALxUoOD.exe
  C:\Windows\System\ALxUoOD.exe
  2⤵
  PID:10052
- C:\Windows\System\jmZnozZ.exe
  C:\Windows\System\jmZnozZ.exe
  2⤵
  PID:10068
- C:\Windows\System\kiOcQvW.exe
  C:\Windows\System\kiOcQvW.exe
  2⤵
  PID:10084
- C:\Windows\System\ftnCpHy.exe
  C:\Windows\System\ftnCpHy.exe
  2⤵
  PID:10100
- C:\Windows\System\diZstRJ.exe
  C:\Windows\System\diZstRJ.exe
  2⤵
  PID:10116
- C:\Windows\System\khEVCPQ.exe
  C:\Windows\System\khEVCPQ.exe
  2⤵
  PID:10132
- C:\Windows\System\ExjdkLl.exe
  C:\Windows\System\ExjdkLl.exe
  2⤵
  PID:10148
- C:\Windows\System\pFXHxsV.exe
  C:\Windows\System\pFXHxsV.exe
  2⤵
  PID:10164
- C:\Windows\System\tJHRJmv.exe
  C:\Windows\System\tJHRJmv.exe
  2⤵
  PID:10180
- C:\Windows\System\tJeOczx.exe
  C:\Windows\System\tJeOczx.exe
  2⤵
  PID:10196
- C:\Windows\System\vvDFLcB.exe
  C:\Windows\System\vvDFLcB.exe
  2⤵
  PID:10212
- C:\Windows\System\anWlLFp.exe
  C:\Windows\System\anWlLFp.exe
  2⤵
  PID:10228
- C:\Windows\System\jLVUVue.exe
  C:\Windows\System\jLVUVue.exe
  2⤵
  PID:9036
- C:\Windows\System\vHFZcns.exe
  C:\Windows\System\vHFZcns.exe
  2⤵
  PID:8352
- C:\Windows\System\LagfHjS.exe
  C:\Windows\System\LagfHjS.exe
  2⤵
  PID:8356
- C:\Windows\System\UZPsQkX.exe
  C:\Windows\System\UZPsQkX.exe
  2⤵
  PID:9232
- C:\Windows\System\YQYFGqV.exe
  C:\Windows\System\YQYFGqV.exe
  2⤵
  PID:9296
- C:\Windows\System\JeGFFKF.exe
  C:\Windows\System\JeGFFKF.exe
  2⤵
  PID:9360
- C:\Windows\System\qACZWLb.exe
  C:\Windows\System\qACZWLb.exe
  2⤵
  PID:9424
- C:\Windows\System\AFxvJwq.exe
  C:\Windows\System\AFxvJwq.exe
  2⤵
  PID:9484
- C:\Windows\System\pTIEsHb.exe
  C:\Windows\System\pTIEsHb.exe
  2⤵
  PID:9212
- C:\Windows\System\HouIbif.exe
  C:\Windows\System\HouIbif.exe
  2⤵
  PID:9548
- C:\Windows\System\jNGvlUV.exe
  C:\Windows\System\jNGvlUV.exe
  2⤵
  PID:9404
- C:\Windows\System\lbfvYhx.exe
  C:\Windows\System\lbfvYhx.exe
  2⤵
  PID:8240
- C:\Windows\System\GCWvnut.exe
  C:\Windows\System\GCWvnut.exe
  2⤵
  PID:9440
- C:\Windows\System\nuORNpZ.exe
  C:\Windows\System\nuORNpZ.exe
  2⤵
  PID:9280
- C:\Windows\System\GhLhgZM.exe
  C:\Windows\System\GhLhgZM.exe
  2⤵
  PID:9612
- C:\Windows\System\CucqLan.exe
  C:\Windows\System\CucqLan.exe
  2⤵
  PID:9468
- C:\Windows\System\YwpqOgn.exe
  C:\Windows\System\YwpqOgn.exe
  2⤵
  PID:9532
- C:\Windows\System\CZmltHp.exe
  C:\Windows\System\CZmltHp.exe
  2⤵
  PID:9616
- C:\Windows\System\iMwgUZJ.exe
  C:\Windows\System\iMwgUZJ.exe
  2⤵
  PID:9628
- C:\Windows\System\DMJMlYV.exe
  C:\Windows\System\DMJMlYV.exe
  2⤵
  PID:9660
- C:\Windows\System\XTwfPAG.exe
  C:\Windows\System\XTwfPAG.exe
  2⤵
  PID:9740
- C:\Windows\System\GKtVKhm.exe
  C:\Windows\System\GKtVKhm.exe
  2⤵
  PID:9728
- C:\Windows\System\akuwamt.exe
  C:\Windows\System\akuwamt.exe
  2⤵
  PID:9724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BPpdZNh.exe

Filesize
2.3MB

MD5
c6781e1ee4ba84b3c843234b4e1a950e

SHA1
7e45e92c6beddba74ee9ca6522cc23188429d7ff

SHA256
d1b2537410bb346f818572263878cfc63c34ee9203c7457b28b2f77bf909b4c1

SHA512
e804dabe80f28ef6b8fce553dcd2609a4d84aaccc6ee8ef1cc1bfdd4e56034b3e0826718cde6790933022a8f89910de9d6270cd094bcb5145ced9d0336c80f59

Download Submit
C:\Windows\system\DDaeSoD.exe

Filesize
2.3MB

MD5
e4392aa88c1918c5f061388edfa57bb4

SHA1
eaa2e7dc98db51e9dde7e093007f464ab11cb47e

SHA256
fcc95569498bd6e5997dd1ebc9c983294eb935d0959407f0a85988d874f87a26

SHA512
7bf6a598421086127e915151302e18232d21e6ad42efcd6c2ffb652ad1a3c81ef6e6103ee647c54bcc9fc03f5ee571465692fe892c707e9961bf53f88b83ea3a

Download Submit
C:\Windows\system\DWVYdzD.exe

Filesize
2.3MB

MD5
8a3ed622995a77b625f91fe069a995d0

SHA1
85acae907c23d9bcb97e1b8e52eda40624a3fcfb

SHA256
a85673876ca57cf0884f0fa55ca9ea7e2ba7c6477eba9ea5d2b7075fd3a96f56

SHA512
7175eb75c4a8beca4ee6c2ce697d49642b1a8bda5d9f239edae9ed7e9546abcb8ac5d31d37f13b6c96f7e956e39b89af4ca5304f0d404453837d1b43d10811ec

Download Submit
C:\Windows\system\GIjXrPK.exe

Filesize
2.3MB

MD5
62d405fbc9762aed2cc694ac211d56c0

SHA1
61e312b8c08e4597726a07ef5f5cddd1cba5c2d3

SHA256
d259c8b066d19924d9514a7adddf25ac850b63d3672a2195db446da5e0cb6d14

SHA512
f625a073313d1552c18d8d480465a70c1d6d00560cd2c3e67556e839e3449faab34e9706c5cc4308a57209ac14e0c29e376b861d3604770e23f2aa0b6ab187a6

Download Submit
C:\Windows\system\GUxuMGI.exe

Filesize
2.3MB

MD5
7ba64ebb4823a4b7e1236f9d0b5a8bf2

SHA1
5ba9aac825f3ed3a215a3bddea2bfc68430388d9

SHA256
234d82387191016741c5a88bc66f4e1994f6deed61f4560febdc03adff22f61c

SHA512
55ebcccbd0555b48da7a91e9fbc176af5f15eaef87d7145fe93cbeb64aa8493c9519610a6cfa8397e630faca0ca4490908ac9d5c36abd07537703eadf2c24fbc

Download Submit
C:\Windows\system\GXoRxNt.exe

Filesize
2.3MB

MD5
fe88704b9c5e3cc247e32fd9a9b65b9b

SHA1
b14e97c7b0c3ca88be74ff5aea5c2420acad29ab

SHA256
4f6db605c4cb6cd3370af9bb0ac21c1030c6cf17095e364ad0fe5223b4b0e1a0

SHA512
cf4e44d8482aa93d1bd928326224c24a3b13c77858179ba831f856696fc3a1d124f5f1a09fba3dcdfeec4287224a878ce2399577f5f8aee51419f9bdd97245ce

Download Submit
C:\Windows\system\JQFxqTd.exe

Filesize
2.3MB

MD5
4b00595b32a52643aad1e12a54d0dd59

SHA1
e927b593b25a6b4b85929624872c5226a3bdd233

SHA256
b02cfe71ced27022404b256fff8816bd48961183bea0e97d402c749348faf48c

SHA512
53387932f428141773d4aa5e9b5a4215e4573ffd4eeaf1b53bde4c4657aa530d6aa5faf9c15258fad74ad4727b6f95943dc00ee73c106a5c0c4fb2e1d53df771

Download Submit
C:\Windows\system\MXZLQoh.exe

Filesize
2.3MB

MD5
dc861948a74ae2b66d42542a98199360

SHA1
a1858a836bf062d1877b0c9f6cbad1f5a354bdbb

SHA256
5103c7271cac802586fa7e06c665697e018a33ce422ab218fa0b2b7c294e5743

SHA512
c51990496050b867b15ad06f1eda9a0bf6db32c11862cb44cf5eb54152a70738e79c27848e3c32a2c1b14da2d48328a321734192b0f51ee7b4e9f8599a3fc63e

Download Submit
C:\Windows\system\RTyzDMk.exe

Filesize
2.3MB

MD5
81dc43ce163cac6e66a939530778314d

SHA1
e76da35a392442bd7230baea5ab2928f358c067f

SHA256
a162711e4e337f7352a85400a71c41d3e9476efd13142b3b192ea50e3fdea7e0

SHA512
5d604bac42420954bf5cc133e317c5483606f93786e22993dd471252023d51092bd1addfdd66b7c6fa0b04762b9c622b27c50870145e3005758b473f96353c9c

Download Submit
C:\Windows\system\SFmlUTD.exe

Filesize
2.3MB

MD5
c90541538b947572c7b144ee19a73bb4

SHA1
2889770c707bf4ea528258cb5c88de43752cc85f

SHA256
e23b5924bd13d97765a7409c8434bbd41d216a00bccca1148f1fbd79afb8e32b

SHA512
2df19a49bb87305fc05e403fc381ed727c4aacf00432053ef9f07aef8ac8c38ada1b42a0c002a88a507ec34076658810a846f912880fb33ec1497a9134fc22f3

Download Submit
C:\Windows\system\UPVjmYW.exe

Filesize
2.3MB

MD5
ec2a7a18435f9a6b326a2a3c2855e0b1

SHA1
756b21c2794b8e68399391987a1a204438c9377a

SHA256
4fb9863df29ca40b74b54b0c2c4612dd54603a739ba3c27997289faf03be0a86

SHA512
325030bfb8af89d8b60f83f280c16e0b690cc59e39be3e2cb94098046ba91f32b9a6f8c0923f5757b7636c9d7ba52604c60fc8e3f1dd08a03e62abcf18d75c01

Download Submit
C:\Windows\system\dUEVdKH.exe

Filesize
2.3MB

MD5
ad59c8d0aad366c1dc9259e509d60fb2

SHA1
e143a803a616f70101d539dc7da442631fe07150

SHA256
4f2bd9db53e89b147965f896682d1a5718dea694b65152f7d67ad7e5c22e89e5

SHA512
c291c0d32fdb13e1859e26909c22baa4aa15280f33dee608c2fd386d20c025ad237bc7f02beadb3e69eaa445ebdd36d3adc17c3304ef4c6f54ac281652c2864c

Download Submit
C:\Windows\system\iRjLwsg.exe

Filesize
2.3MB

MD5
febe8ff04e15ad69e8d0ffff300aeb3b

SHA1
ea70a7cc7c662a423f0197f3e86e39eb4710ed94

SHA256
62eb78ffcdac2c8b2bbc8cec83c0eb906900fa0476c45d9f2be81d468a275096

SHA512
de4271f40dd522f073c44aa38bc2e47b2a880d3d640fb87aa483328335f7296327e99d10d15fd6c2d7db3641cae85ee8828ed246e4d92d37f3f611bdb154d311

Download Submit
C:\Windows\system\iyjyWfS.exe

Filesize
2.3MB

MD5
d8fe07c523c18b72bbcb7ab33a2a2451

SHA1
1ce9f726d368b1aed07f7596eda05e666b92a1a0

SHA256
2cc5702ce70290f372a36e260d9f27e72760544606c111614b1f5383fb921d07

SHA512
8913ef204850b441c18d5c1c38c34c65b1a4da2612a420410562ada9c1f14aaf1717c26338a737a954abc697a0e8f7a0b8c625dfdbdaf869a83791430e02ba59

Download Submit
C:\Windows\system\lFJAfyl.exe

Filesize
2.3MB

MD5
5fcc9b933f56364c795c2a3073cf255b

SHA1
f423e850e20cc993a70cffd35b93f140d1f088ff

SHA256
7cbc90f4d4292e7b04dc799e83e4179b64284c1157baf43948f8c4f5482f1add

SHA512
26c4629ca0f152f107d6e5731ea8517c3b6b83cae4b08db5b96a0395774239ade2fd46270255092a8493accd0c4d5c9051eec1f06abf307b0ae0b3d097957651

Download Submit
C:\Windows\system\pGCaKhV.exe

Filesize
2.3MB

MD5
32fd41e3258621b6ebf65484bf8b40f5

SHA1
58bd575e25a63ee5c5ffa147978eeb17ec62d6cb

SHA256
2443ea3d0151995c4536d7e5aee1a362256f646521417328f8c624b8b3a959c0

SHA512
c211f53fd718923e9a1bef1d50b0a49c40a7c811f8172c24db65b44490f8d3bdc5caff29cf6640c5fd7108f7281d6c21913aa2235ef1886a4e6281b5b09463b1

Download Submit
C:\Windows\system\prfWXsp.exe

Filesize
2.3MB

MD5
f5e45c7e93b37b6c68c5155a074d2685

SHA1
3c96cbfc7350307140bea01b6141a8ff45f9a3a4

SHA256
682726b3a60fa2c927db3b7efac8961d9d172be88676555dec18e89f6dcd3ec9

SHA512
c7342d4fcf57722c59e2ed6ed95ab3a610cf2f87a03c672b571af7897c7daf7a7b183317a827511bd0b86ab36ada6ebc11248eda677ecb2403245efe054eb095

Download Submit
C:\Windows\system\rbIXzof.exe

Filesize
2.3MB

MD5
37d1c2bc8353a8999fcf79e3e068192e

SHA1
d7c46dd3012274ecf9e2f228f201e74f52481147

SHA256
92c94dbd8b0b2749fc145abce6e00ffaebd037e9d992555825802cd77f2750b6

SHA512
c00953f4849e5f38cc6b0a5f30e249939ab71a279617cfa5308dd28577d1e530e14ea9f35ee6712f1a95949a21655e5370842e273e9c5c563b5e6df29e632aaf

Download Submit
C:\Windows\system\sEkyfPZ.exe

Filesize
2.3MB

MD5
b9191d520fd0d7f52e16201797f52356

SHA1
3025b6089eda2e73d37d1b248300ac76e4fb9a09

SHA256
7da1126a14bb0a01a2870d4161a247a7ab0303e1363aca43bf84ee8b58469dd7

SHA512
413f1a56c4ac88de3cbe7c0e5f37686ec8ac04f50d372aa0fa1c59aa896b8ac9658dafe4c5690bd9067b487de920654b96bb753aedf84d7fc78062b10d4b89cf

Download Submit
C:\Windows\system\tOkmeAs.exe

Filesize
2.3MB

MD5
4ec3fa3095cb77bcf68b4ca48bcaad20

SHA1
5aa013c0ee0939cf41b0e96ad71445abb1a95fd9

SHA256
5e2c832d419ace8b67628618184aed8b35185023c4016ed2e750d16753bc57c2

SHA512
10a587320dbd14d2ec51acaa0e45f78d2b8bfa05996ed730b45a5020a495da14af8bfa4eb433568d41377de285a88d899fd1d23ebbc6976c4949844e0effc0d0

Download Submit
C:\Windows\system\uUvdPeF.exe

Filesize
2.3MB

MD5
68762eeb082a801683a35055ad7721d4

SHA1
c4dcaff861e5e37568ccbaa3bc94ab93af9272f2

SHA256
673c3c46269c91b038d18688591e9af6be8a0ce4d351613fabce72beaf066831

SHA512
df990d51009b673e8f451f551ca562f13dd0edb454b3b1ca9f28782d9255a281fe6d005ad8498b12e5cb1418ded2117f088400c703bda84f539928c4e213d90f

Download Submit
C:\Windows\system\xwZSUrD.exe

Filesize
2.3MB

MD5
025ebfcb55ad2ce1018a7877fcd56a20

SHA1
e871c4523fbb069d8c034296d7d9cf4f752257ce

SHA256
48b85d542aa019da29811a58e5e4234be8546a5b155863eaa215e9859b432de7

SHA512
9b3b100a8f15d53b7ea66dcad05897b60326574c4555d4966bd136ee079f91a2b8fd64265b1bb4e3a2bf3988dadb1f1d33093d8f2881f00bf4018b8969bf2f24

Download Submit
C:\Windows\system\zPTptnV.exe

Filesize
2.3MB

MD5
ac208e8646fccdad5febe4ca045b6234

SHA1
d7644723316f7366fc181bf6eeb08dc3345d9f06

SHA256
594773a2a4d260198f153c405b28f16457a1a6cde071f75f049c338572dd980e

SHA512
9a66a559518f80b86838768d45b55ba09d4f0e4edd45988a29c755e6d1c101c794c65dc404d5bff3df5172fa9d71b7085ff676a8b15f2992d53592a83a9bd537

Download Submit
\Windows\system\AWPlgzL.exe

Filesize
2.3MB

MD5
35a73e3806b0210a6c0241c7904cf385

SHA1
be535516fea1c830fdc416b7bf255c6880ef689f

SHA256
7a9a67305267b853d5a8425e412d518b89ff5bcacefc30f54d761d62f56d3a8e

SHA512
ce148423a7f34545a4ca4d46467eb0529c031d339f9615157177816ceab94ec9e0e74a9c7d5fc142c260d9db02e2b950d41d299cd82b3f5d64e3f666a5b4d1ea

Download Submit
\Windows\system\HFpSkue.exe

Filesize
2.3MB

MD5
d6d7abe4a2d176e005e21bcfbe00dd4d

SHA1
cf98d37951e3a63780bae7c6751cdb80c82acc66

SHA256
2b66bce671f4ba60ba8f1b91524ce7a7871aed4a7343a3407988dfb2f0da1fda

SHA512
6ed47de7671b38538392dd817711b10d8fe6d513bb8101ca22ca23b341affa738f35c4343f418efc665c858742f064ba9b02eb76a721951c4e013db165960f1b

Download Submit
\Windows\system\KeNJeOI.exe

Filesize
2.3MB

MD5
a084619239cae6eb4b3b701595b5480b

SHA1
de4777a227c0236771ce3194cf8db8f07495c552

SHA256
512e92a34e706fd18305638c7360381ff0e6d7264fd2c60daca86ab212165bba

SHA512
2ed0cdf4f8bb7efbc8d48b41aed962cb1b7890ed0724ea01c2804c0fce413d98b1e4f3b7897cc466435920de368b1cf2ab9d11ad0fb0a6e2cbd418d6c03493dc

Download Submit
\Windows\system\TKZxSbq.exe

Filesize
2.3MB

MD5
37f304007ea43654a4597f1a6d13bffe

SHA1
66e60ff0e83fe264673524abc3dd5e02a397e3c6

SHA256
7bc94032f0f1c9af4e2d27e2fa193b752b866b95928b378567fe469552fc3207

SHA512
dca459d065d94427a9d8e87f9a706adebee0ea597c253f6e6df006fe0c5768ec6eb20324832cb494c1c3a213fa1b6432510a2d3c5f593d4f7139d7654b3a4b2d

Download Submit
\Windows\system\UOfNoqo.exe

Filesize
2.3MB

MD5
708125b3efd911046d8da23eaa5c0bf7

SHA1
2514740d4bc97a1d262b81917e5e8274d66f3c4a

SHA256
dfe4a41fafc1b5fb9bf112351715d497765fdb958e1d0524d7a965256bf7368d

SHA512
6847cc19cdcf453c7209ff0c07edc04eed75b5fd1098586ddbe51e809d9d8a133772ab712b206842231b86a25e17d9b4dec80ab9499e131c0b700482ec30463a

Download Submit
\Windows\system\fJOANME.exe

Filesize
2.3MB

MD5
321d9867e4912a534197bdc84c03c4de

SHA1
b1b7a3925fe78cb2a45be57e7f0c56a213afa0b7

SHA256
ec7585f534cae25d5e956d37a84f0e423eab12e97137fc263873f4feb1034cac

SHA512
f15c1da11bc815abb245969f9a0cd4a376b20d684c35da536ed4bf19deee7e968aead8127a35e785925cbb40deaeb87071b63982e2f26195130ca8b2dda579d7

Download Submit
\Windows\system\hBQblYO.exe

Filesize
2.3MB

MD5
231cb89d439a372a0623efea48bef7aa

SHA1
900012590468e2093a176161c91a0cd99503ef98

SHA256
286874fc0098634325531e4f35ba08d62f05b4d288e21c2ebfa0dfd0c018b162

SHA512
840e7878d848ac32aa02eaae86db945a95577e18752a5dc39d266df9347159ca0d12b2f7be9a3e44d745597a9cf41d4f0ac4da9ec40b0ccaf92e3cd5d25702e4

Download Submit
\Windows\system\rdxvFpy.exe

Filesize
2.3MB

MD5
700b6606041753ca74b9aa65ceb57375

SHA1
c3cb6de1eea7b7b4d59fce6db62c36606555649e

SHA256
076e304f08db854188aa76db55b2eb71493d290b14639fb18db3c3cd15c3f077

SHA512
03a9ee82ec3bba3ff2e63499a923c1659150d708ff7ac292e9fa6f227892ed16d5a7a2ea577ce271621205b3b8010db4b74c5689f3f29487b6627533fd334486

Download Submit
\Windows\system\vBrVnPc.exe

Filesize
2.3MB

MD5
3141f430dc0b9256326d2c76b2421a47

SHA1
700db89c2de563ebec5c3d8d765ad372d9e76186

SHA256
fd062c678957d31077cdd6d78c1610c20f6f9992ed4caf2287d56c949ddf733a

SHA512
066b54f8fcc1da4cacf70d5cf02afbe99cdba1a6531e83af5134e167dd773695022f07cee1e41fd6b5a4b619bef58f2e496c5035a23429f1c4128866c68d55d4

Download Submit
memory/2196-48-0x0000000001F00000-0x0000000001F08000-memory.dmp

Filesize
32KB

Download
memory/2196-44-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2308-2-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2308-27-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-55-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-64-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2308-966-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-92-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-25-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2308-81-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-70-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2308-28-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-89-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-43-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-60-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2308-39-0x0000000002F20000-0x0000000003312000-memory.dmp

Filesize
3.9MB

Download
memory/2308-15-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2308-84-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-56-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2520-440-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2560-41-0x000000013FB10000-0x000000013FF02000-memory.dmp

Filesize
3.9MB

Download
memory/2644-33-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2684-34-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-95-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-62-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2912-71-0x000000013FCC0000-0x00000001400B2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-88-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2944-20-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-23-0x000000013FFF0000-0x00000001403E2000-memory.dmp

Filesize
3.9MB

Download