xmrig | 1881608816275c262b3d6821e429c01c369bf5d34dc171a81c1838b97601938e

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 07:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Size

2.4MB
MD5

0729e506a4da16c84c40035c2d923b70
SHA1

f0fc23bd4df042b0ba18c30f139e58a0a5539064
SHA256

1881608816275c262b3d6821e429c01c369bf5d34dc171a81c1838b97601938e
SHA512

d05c4ce8ca0f36e00ad7cd7a48968a70e93842060f5cb9229a8d93de373981f6506dfd5fb9ac11d2fb6bbb4a28f4e2e2102010d94dc7be4a91432ce7ffc5e07d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9Yo:NAB+

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2088-16-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/1304-12-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2816-137-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2472-88-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2724-36-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2912-70-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/2836-67-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2480-63-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2588-60-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1304	cpPKzzZ.exe
2088	QPzEyWg.exe
2724	azcmnUM.exe
2588	AqSGiWx.exe
2480	EmoYCDs.exe
2836	wrFTfFM.exe
2472	lQIdoAa.exe
2912	AXPmWid.exe
2816	QIclARC.exe
1728	nVCQRYd.exe
2716	aCjBIUp.exe
2676	ftELsvM.exe
2004	xjHbARx.exe
2000	eBhqsme.exe
1040	CGAjMRA.exe
2704	GXexKWF.exe
1700	BLqJEHW.exe
1300	LNugWzk.exe
2860	tpbSkPR.exe
2300	KrQmoYo.exe
1716	zilIjHU.exe
828	HNojTWi.exe
976	TWfuiHM.exe
2428	TRvjQUN.exe
1188	aOWnOMX.exe
1664	xlyOhuR.exe
1788	mrUCsCc.exe
808	UePgqfO.exe
2332	gRkKMxr.exe
904	vHkWOQh.exe
2532	pxdRMDk.exe
2412	wmxwans.exe
1720	vHHdWzP.exe
1896	eDsyCMV.exe
1740	xZjxWFp.exe
1632	DERBlrT.exe
1904	MEJMZyT.exe
2772	McfQGxs.exe
2904	cDvPFgW.exe
1708	nHJOyrt.exe
2032	VTZRmVP.exe
2500	zCytpfw.exe
864	yNysvEL.exe
936	dsrswgO.exe
1724	xjudbUg.exe
1556	pNSkLnw.exe
1336	YZDFdBR.exe
2052	rTWIuZH.exe
1976	ZqsYEsK.exe
604	mahqlHU.exe
2012	cCoSFTN.exe
1056	HzQpVpO.exe
1736	XEMXzrx.exe
756	FjMZpZe.exe
2404	tUAjSZJ.exe
1372	MJtBJKi.exe
1876	IRCYaBl.exe
2944	vCNsbAO.exe
1128	weDKfAj.exe
2856	UNVKSVz.exe
1984	ZGGNKFY.exe
2220	GebnDWQ.exe
916	DYcqMRB.exe
2536	mqUfDip.exe

Loads dropped DLL 64 IoCs

pid	Process
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2240-2-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x000b0000000153c7-3.dat	upx
behavioral1/files/0x0032000000015ba8-7.dat	upx
behavioral1/memory/2088-16-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/1304-12-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0007000000015c85-17.dat	upx
behavioral1/files/0x0007000000015c93-25.dat	upx
behavioral1/files/0x0009000000015cce-37.dat	upx
behavioral1/files/0x000600000001654a-62.dat	upx
behavioral1/files/0x0006000000016813-86.dat	upx
behavioral1/files/0x0006000000016d05-116.dat	upx
behavioral1/memory/2816-137-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/files/0x000600000001744c-171.dat	upx
behavioral1/files/0x00070000000161b3-40.dat	upx
behavioral1/files/0x00060000000175b8-187.dat	upx
behavioral1/files/0x00060000000175ac-177.dat	upx
behavioral1/files/0x000600000001739d-170.dat	upx
behavioral1/files/0x00060000000173e5-167.dat	upx
behavioral1/files/0x0006000000016e78-162.dat	upx
behavioral1/files/0x0006000000016fe8-160.dat	upx
behavioral1/files/0x0006000000016da4-155.dat	upx
behavioral1/files/0x0006000000016db3-153.dat	upx
behavioral1/files/0x0006000000016d9f-147.dat	upx
behavioral1/files/0x0006000000016d32-142.dat	upx
behavioral1/files/0x0006000000016d16-141.dat	upx
behavioral1/files/0x0006000000016d36-138.dat	upx
behavioral1/files/0x0006000000016d1f-131.dat	upx
behavioral1/files/0x0006000000016cf5-125.dat	upx
behavioral1/files/0x0006000000016cb2-124.dat	upx
behavioral1/files/0x0006000000016c42-123.dat	upx
behavioral1/files/0x0006000000016d0e-120.dat	upx
behavioral1/files/0x0006000000016cfd-113.dat	upx
behavioral1/files/0x0006000000016ce4-104.dat	upx
behavioral1/files/0x0008000000015cb0-99.dat	upx
behavioral1/files/0x0006000000016c8c-96.dat	upx
behavioral1/files/0x0006000000016c3a-90.dat	upx
behavioral1/files/0x0006000000016a6f-79.dat	upx
behavioral1/files/0x00060000000165f0-72.dat	upx
behavioral1/files/0x0006000000016476-50.dat	upx
behavioral1/files/0x001800000000558a-42.dat	upx
behavioral1/files/0x00060000000175b2-184.dat	upx
behavioral1/files/0x0006000000016d3a-146.dat	upx
behavioral1/memory/2472-88-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0006000000016c1d-87.dat	upx
behavioral1/memory/2724-36-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2912-70-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/2836-67-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2480-63-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x00060000000162c9-61.dat	upx
behavioral1/memory/2588-60-0x000000013F250000-0x000000013F642000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\JlqyHKW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\deJpQtw.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\fzvEUhx.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\YQzidKM.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\JsfDaJX.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ucNglYJ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\oaxXwvS.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\CSAoGyY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\IEIxAuh.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\LyJjwjV.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ORDqzyU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\VwDUJkj.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\mJWzmaK.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ZGGNKFY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\koFivbn.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\inCJiCq.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\qPMOOpy.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\rooDaWp.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ABqlnIu.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\hUFseFE.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QIclARC.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\pKHModU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\gfLKWme.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\jynMdLe.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\jdKtPQx.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\lQIdoAa.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\uaNioFU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QlMxWkj.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\IHBRPbx.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\QKgzwzn.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\eItxFrw.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\mahqlHU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\VTRgOZB.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\MjsqDWr.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\vlRsMTV.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\FxufrWA.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\OSYoDkH.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\jmftMya.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\qBYqYWT.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\ZqsYEsK.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\JJSdlTW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\eukiQuZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\qLQoPYu.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\RxwbUGU.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\oskoQzy.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\WZZSlFj.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\zSoaWzW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\CSjDuki.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\Xoemroh.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\rYPkobY.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\JattmhP.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\iRaZPco.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\SzMVMAI.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\EEGGUmH.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\egWwhaS.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\DBQmRNl.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\fwNPPtW.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\BMoebfZ.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\LWotBMs.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\bVREkeu.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\HzQpVpO.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\lWAQGcR.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\jIqKICS.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
File created	C:\Windows\System\yZNGQFC.exe	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1324	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
Token: SeDebugPrivilege	1324	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1324	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	29
PID 2240 wrote to memory of 1324	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	29
PID 2240 wrote to memory of 1324	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	29
PID 2240 wrote to memory of 1304	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	30
PID 2240 wrote to memory of 1304	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	30
PID 2240 wrote to memory of 1304	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	30
PID 2240 wrote to memory of 2088	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2088	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2088	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	31
PID 2240 wrote to memory of 2724	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2724	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2724	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	32
PID 2240 wrote to memory of 2836	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2836	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2836	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	33
PID 2240 wrote to memory of 2588	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2588	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2588	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	34
PID 2240 wrote to memory of 2716	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2716	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2716	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	35
PID 2240 wrote to memory of 2480	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2480	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2480	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	36
PID 2240 wrote to memory of 2676	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2676	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2676	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	37
PID 2240 wrote to memory of 2472	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2472	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2472	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	38
PID 2240 wrote to memory of 2532	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	39
PID 2240 wrote to memory of 2532	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	39
PID 2240 wrote to memory of 2532	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	39
PID 2240 wrote to memory of 2912	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2912	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2912	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	40
PID 2240 wrote to memory of 2772	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2772	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2772	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	41
PID 2240 wrote to memory of 2816	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2816	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2816	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	42
PID 2240 wrote to memory of 2904	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	43
PID 2240 wrote to memory of 2904	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	43
PID 2240 wrote to memory of 2904	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	43
PID 2240 wrote to memory of 1728	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1728	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1728	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	44
PID 2240 wrote to memory of 1708	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	45
PID 2240 wrote to memory of 1708	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	45
PID 2240 wrote to memory of 1708	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	45
PID 2240 wrote to memory of 2004	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2004	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2004	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	46
PID 2240 wrote to memory of 2032	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	47
PID 2240 wrote to memory of 2032	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	47
PID 2240 wrote to memory of 2032	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	47
PID 2240 wrote to memory of 2000	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	48
PID 2240 wrote to memory of 2000	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	48
PID 2240 wrote to memory of 2000	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	48
PID 2240 wrote to memory of 864	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	49
PID 2240 wrote to memory of 864	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	49
PID 2240 wrote to memory of 864	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	49
PID 2240 wrote to memory of 1040	2240	0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0729e506a4da16c84c40035c2d923b70_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System\cpPKzzZ.exe
  C:\Windows\System\cpPKzzZ.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\QPzEyWg.exe
  C:\Windows\System\QPzEyWg.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\azcmnUM.exe
  C:\Windows\System\azcmnUM.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\wrFTfFM.exe
  C:\Windows\System\wrFTfFM.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\AqSGiWx.exe
  C:\Windows\System\AqSGiWx.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\aCjBIUp.exe
  C:\Windows\System\aCjBIUp.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\EmoYCDs.exe
  C:\Windows\System\EmoYCDs.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\ftELsvM.exe
  C:\Windows\System\ftELsvM.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\lQIdoAa.exe
  C:\Windows\System\lQIdoAa.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\pxdRMDk.exe
  C:\Windows\System\pxdRMDk.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\AXPmWid.exe
  C:\Windows\System\AXPmWid.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\McfQGxs.exe
  C:\Windows\System\McfQGxs.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\QIclARC.exe
  C:\Windows\System\QIclARC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\cDvPFgW.exe
  C:\Windows\System\cDvPFgW.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nVCQRYd.exe
  C:\Windows\System\nVCQRYd.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\nHJOyrt.exe
  C:\Windows\System\nHJOyrt.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\xjHbARx.exe
  C:\Windows\System\xjHbARx.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\VTZRmVP.exe
  C:\Windows\System\VTZRmVP.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\eBhqsme.exe
  C:\Windows\System\eBhqsme.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\yNysvEL.exe
  C:\Windows\System\yNysvEL.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\CGAjMRA.exe
  C:\Windows\System\CGAjMRA.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\dsrswgO.exe
  C:\Windows\System\dsrswgO.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\GXexKWF.exe
  C:\Windows\System\GXexKWF.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\xjudbUg.exe
  C:\Windows\System\xjudbUg.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\BLqJEHW.exe
  C:\Windows\System\BLqJEHW.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\pNSkLnw.exe
  C:\Windows\System\pNSkLnw.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\LNugWzk.exe
  C:\Windows\System\LNugWzk.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\YZDFdBR.exe
  C:\Windows\System\YZDFdBR.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\tpbSkPR.exe
  C:\Windows\System\tpbSkPR.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\rTWIuZH.exe
  C:\Windows\System\rTWIuZH.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\KrQmoYo.exe
  C:\Windows\System\KrQmoYo.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\ZqsYEsK.exe
  C:\Windows\System\ZqsYEsK.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\zilIjHU.exe
  C:\Windows\System\zilIjHU.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\mahqlHU.exe
  C:\Windows\System\mahqlHU.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\HNojTWi.exe
  C:\Windows\System\HNojTWi.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\HzQpVpO.exe
  C:\Windows\System\HzQpVpO.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\TWfuiHM.exe
  C:\Windows\System\TWfuiHM.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\XEMXzrx.exe
  C:\Windows\System\XEMXzrx.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\TRvjQUN.exe
  C:\Windows\System\TRvjQUN.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\FjMZpZe.exe
  C:\Windows\System\FjMZpZe.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\aOWnOMX.exe
  C:\Windows\System\aOWnOMX.exe
  2⤵
  - Executes dropped EXE
  PID:1188
- C:\Windows\System\tUAjSZJ.exe
  C:\Windows\System\tUAjSZJ.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\xlyOhuR.exe
  C:\Windows\System\xlyOhuR.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\MJtBJKi.exe
  C:\Windows\System\MJtBJKi.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\mrUCsCc.exe
  C:\Windows\System\mrUCsCc.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\IRCYaBl.exe
  C:\Windows\System\IRCYaBl.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\UePgqfO.exe
  C:\Windows\System\UePgqfO.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\vCNsbAO.exe
  C:\Windows\System\vCNsbAO.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\gRkKMxr.exe
  C:\Windows\System\gRkKMxr.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\UNVKSVz.exe
  C:\Windows\System\UNVKSVz.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\vHkWOQh.exe
  C:\Windows\System\vHkWOQh.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\ZGGNKFY.exe
  C:\Windows\System\ZGGNKFY.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\wmxwans.exe
  C:\Windows\System\wmxwans.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\GebnDWQ.exe
  C:\Windows\System\GebnDWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\vHHdWzP.exe
  C:\Windows\System\vHHdWzP.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\DYcqMRB.exe
  C:\Windows\System\DYcqMRB.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\eDsyCMV.exe
  C:\Windows\System\eDsyCMV.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\mqUfDip.exe
  C:\Windows\System\mqUfDip.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\xZjxWFp.exe
  C:\Windows\System\xZjxWFp.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\YAllCAB.exe
  C:\Windows\System\YAllCAB.exe
  2⤵
  PID:1636
- C:\Windows\System\DERBlrT.exe
  C:\Windows\System\DERBlrT.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\mJWzmaK.exe
  C:\Windows\System\mJWzmaK.exe
  2⤵
  PID:884
- C:\Windows\System\MEJMZyT.exe
  C:\Windows\System\MEJMZyT.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\TkoQnjI.exe
  C:\Windows\System\TkoQnjI.exe
  2⤵
  PID:2656
- C:\Windows\System\zCytpfw.exe
  C:\Windows\System\zCytpfw.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\SxwOyyK.exe
  C:\Windows\System\SxwOyyK.exe
  2⤵
  PID:2800
- C:\Windows\System\cCoSFTN.exe
  C:\Windows\System\cCoSFTN.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\utIYlmZ.exe
  C:\Windows\System\utIYlmZ.exe
  2⤵
  PID:2756
- C:\Windows\System\weDKfAj.exe
  C:\Windows\System\weDKfAj.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\VTRgOZB.exe
  C:\Windows\System\VTRgOZB.exe
  2⤵
  PID:3048
- C:\Windows\System\hhxhSUi.exe
  C:\Windows\System\hhxhSUi.exe
  2⤵
  PID:2176
- C:\Windows\System\Syjvxwa.exe
  C:\Windows\System\Syjvxwa.exe
  2⤵
  PID:2224
- C:\Windows\System\lWAQGcR.exe
  C:\Windows\System\lWAQGcR.exe
  2⤵
  PID:1712
- C:\Windows\System\nrpQwGk.exe
  C:\Windows\System\nrpQwGk.exe
  2⤵
  PID:3008
- C:\Windows\System\XugDBwt.exe
  C:\Windows\System\XugDBwt.exe
  2⤵
  PID:2276
- C:\Windows\System\DKlJBSX.exe
  C:\Windows\System\DKlJBSX.exe
  2⤵
  PID:1992
- C:\Windows\System\hfiQyVD.exe
  C:\Windows\System\hfiQyVD.exe
  2⤵
  PID:1552
- C:\Windows\System\KMBlGHx.exe
  C:\Windows\System\KMBlGHx.exe
  2⤵
  PID:2736
- C:\Windows\System\VnKeHfZ.exe
  C:\Windows\System\VnKeHfZ.exe
  2⤵
  PID:2060
- C:\Windows\System\WizpbVB.exe
  C:\Windows\System\WizpbVB.exe
  2⤵
  PID:1676
- C:\Windows\System\DGDPECW.exe
  C:\Windows\System\DGDPECW.exe
  2⤵
  PID:2920
- C:\Windows\System\elQeBIm.exe
  C:\Windows\System\elQeBIm.exe
  2⤵
  PID:2964
- C:\Windows\System\UftDjqH.exe
  C:\Windows\System\UftDjqH.exe
  2⤵
  PID:2340
- C:\Windows\System\bbogRAM.exe
  C:\Windows\System\bbogRAM.exe
  2⤵
  PID:888
- C:\Windows\System\EejwHoP.exe
  C:\Windows\System\EejwHoP.exe
  2⤵
  PID:2524
- C:\Windows\System\uwNYhdd.exe
  C:\Windows\System\uwNYhdd.exe
  2⤵
  PID:1780
- C:\Windows\System\FJJXtVq.exe
  C:\Windows\System\FJJXtVq.exe
  2⤵
  PID:2292
- C:\Windows\System\iRaZPco.exe
  C:\Windows\System\iRaZPco.exe
  2⤵
  PID:1932
- C:\Windows\System\rsJKVIo.exe
  C:\Windows\System\rsJKVIo.exe
  2⤵
  PID:580
- C:\Windows\System\mpZjLif.exe
  C:\Windows\System\mpZjLif.exe
  2⤵
  PID:1160
- C:\Windows\System\lKWpRKk.exe
  C:\Windows\System\lKWpRKk.exe
  2⤵
  PID:2268
- C:\Windows\System\VCQroMa.exe
  C:\Windows\System\VCQroMa.exe
  2⤵
  PID:980
- C:\Windows\System\YRGoNeM.exe
  C:\Windows\System\YRGoNeM.exe
  2⤵
  PID:1680
- C:\Windows\System\kEWtLal.exe
  C:\Windows\System\kEWtLal.exe
  2⤵
  PID:924
- C:\Windows\System\iXyZIcG.exe
  C:\Windows\System\iXyZIcG.exe
  2⤵
  PID:2272
- C:\Windows\System\ZRztqcL.exe
  C:\Windows\System\ZRztqcL.exe
  2⤵
  PID:1624
- C:\Windows\System\RCoGEKJ.exe
  C:\Windows\System\RCoGEKJ.exe
  2⤵
  PID:2140
- C:\Windows\System\rPjMJAk.exe
  C:\Windows\System\rPjMJAk.exe
  2⤵
  PID:2504
- C:\Windows\System\TkxMRKV.exe
  C:\Windows\System\TkxMRKV.exe
  2⤵
  PID:2584
- C:\Windows\System\SkUGWCx.exe
  C:\Windows\System\SkUGWCx.exe
  2⤵
  PID:2260
- C:\Windows\System\MgwDpfG.exe
  C:\Windows\System\MgwDpfG.exe
  2⤵
  PID:1348
- C:\Windows\System\EEGGUmH.exe
  C:\Windows\System\EEGGUmH.exe
  2⤵
  PID:1036
- C:\Windows\System\TFyVMvn.exe
  C:\Windows\System\TFyVMvn.exe
  2⤵
  PID:3080
- C:\Windows\System\XnYJxHu.exe
  C:\Windows\System\XnYJxHu.exe
  2⤵
  PID:3096
- C:\Windows\System\VNQHAdV.exe
  C:\Windows\System\VNQHAdV.exe
  2⤵
  PID:3112
- C:\Windows\System\jHHgUXR.exe
  C:\Windows\System\jHHgUXR.exe
  2⤵
  PID:3128
- C:\Windows\System\RZWFGXG.exe
  C:\Windows\System\RZWFGXG.exe
  2⤵
  PID:3144
- C:\Windows\System\fUFHllM.exe
  C:\Windows\System\fUFHllM.exe
  2⤵
  PID:3160
- C:\Windows\System\xmopuyL.exe
  C:\Windows\System\xmopuyL.exe
  2⤵
  PID:3176
- C:\Windows\System\ieaHAeT.exe
  C:\Windows\System\ieaHAeT.exe
  2⤵
  PID:3192
- C:\Windows\System\MjsqDWr.exe
  C:\Windows\System\MjsqDWr.exe
  2⤵
  PID:3208
- C:\Windows\System\DWadlNS.exe
  C:\Windows\System\DWadlNS.exe
  2⤵
  PID:3224
- C:\Windows\System\cPhpXtN.exe
  C:\Windows\System\cPhpXtN.exe
  2⤵
  PID:3240
- C:\Windows\System\znxLMAR.exe
  C:\Windows\System\znxLMAR.exe
  2⤵
  PID:3256
- C:\Windows\System\QllcgJQ.exe
  C:\Windows\System\QllcgJQ.exe
  2⤵
  PID:3272
- C:\Windows\System\drlUsBG.exe
  C:\Windows\System\drlUsBG.exe
  2⤵
  PID:3288
- C:\Windows\System\KfnPrVY.exe
  C:\Windows\System\KfnPrVY.exe
  2⤵
  PID:3304
- C:\Windows\System\tRmPLDU.exe
  C:\Windows\System\tRmPLDU.exe
  2⤵
  PID:3320
- C:\Windows\System\uKwpWIz.exe
  C:\Windows\System\uKwpWIz.exe
  2⤵
  PID:3336
- C:\Windows\System\TqhBglE.exe
  C:\Windows\System\TqhBglE.exe
  2⤵
  PID:3352
- C:\Windows\System\kxFQEzm.exe
  C:\Windows\System\kxFQEzm.exe
  2⤵
  PID:3368
- C:\Windows\System\ovGgxcc.exe
  C:\Windows\System\ovGgxcc.exe
  2⤵
  PID:3384
- C:\Windows\System\QkGEbal.exe
  C:\Windows\System\QkGEbal.exe
  2⤵
  PID:3400
- C:\Windows\System\pbohBcl.exe
  C:\Windows\System\pbohBcl.exe
  2⤵
  PID:3416
- C:\Windows\System\RMCjNGk.exe
  C:\Windows\System\RMCjNGk.exe
  2⤵
  PID:3432
- C:\Windows\System\jDxEsxf.exe
  C:\Windows\System\jDxEsxf.exe
  2⤵
  PID:3448
- C:\Windows\System\arjCsil.exe
  C:\Windows\System\arjCsil.exe
  2⤵
  PID:3464
- C:\Windows\System\wExfjOZ.exe
  C:\Windows\System\wExfjOZ.exe
  2⤵
  PID:3480
- C:\Windows\System\jIqKICS.exe
  C:\Windows\System\jIqKICS.exe
  2⤵
  PID:3496
- C:\Windows\System\dhfcmHQ.exe
  C:\Windows\System\dhfcmHQ.exe
  2⤵
  PID:3512
- C:\Windows\System\HZjzyvK.exe
  C:\Windows\System\HZjzyvK.exe
  2⤵
  PID:3528
- C:\Windows\System\LAkTYzl.exe
  C:\Windows\System\LAkTYzl.exe
  2⤵
  PID:3544
- C:\Windows\System\dJcVrLx.exe
  C:\Windows\System\dJcVrLx.exe
  2⤵
  PID:3560
- C:\Windows\System\sKjCGIo.exe
  C:\Windows\System\sKjCGIo.exe
  2⤵
  PID:3576
- C:\Windows\System\hFbcblf.exe
  C:\Windows\System\hFbcblf.exe
  2⤵
  PID:3592
- C:\Windows\System\jqIzamK.exe
  C:\Windows\System\jqIzamK.exe
  2⤵
  PID:3608
- C:\Windows\System\whZFpXa.exe
  C:\Windows\System\whZFpXa.exe
  2⤵
  PID:3624
- C:\Windows\System\usLYjbA.exe
  C:\Windows\System\usLYjbA.exe
  2⤵
  PID:3640
- C:\Windows\System\oskoQzy.exe
  C:\Windows\System\oskoQzy.exe
  2⤵
  PID:3656
- C:\Windows\System\CSAoGyY.exe
  C:\Windows\System\CSAoGyY.exe
  2⤵
  PID:3672
- C:\Windows\System\vBuPvlk.exe
  C:\Windows\System\vBuPvlk.exe
  2⤵
  PID:3688
- C:\Windows\System\XLLSNyT.exe
  C:\Windows\System\XLLSNyT.exe
  2⤵
  PID:3704
- C:\Windows\System\biskWKE.exe
  C:\Windows\System\biskWKE.exe
  2⤵
  PID:3720
- C:\Windows\System\iMbErAB.exe
  C:\Windows\System\iMbErAB.exe
  2⤵
  PID:3736
- C:\Windows\System\QjQQxxu.exe
  C:\Windows\System\QjQQxxu.exe
  2⤵
  PID:3752
- C:\Windows\System\krkfcND.exe
  C:\Windows\System\krkfcND.exe
  2⤵
  PID:3768
- C:\Windows\System\DEgUlsp.exe
  C:\Windows\System\DEgUlsp.exe
  2⤵
  PID:3784
- C:\Windows\System\RGbWJTn.exe
  C:\Windows\System\RGbWJTn.exe
  2⤵
  PID:3800
- C:\Windows\System\vBIqeNL.exe
  C:\Windows\System\vBIqeNL.exe
  2⤵
  PID:3816
- C:\Windows\System\LFYfsWZ.exe
  C:\Windows\System\LFYfsWZ.exe
  2⤵
  PID:3832
- C:\Windows\System\QZZwuzW.exe
  C:\Windows\System\QZZwuzW.exe
  2⤵
  PID:3848
- C:\Windows\System\umhAaxS.exe
  C:\Windows\System\umhAaxS.exe
  2⤵
  PID:3864
- C:\Windows\System\lOkwjds.exe
  C:\Windows\System\lOkwjds.exe
  2⤵
  PID:3880
- C:\Windows\System\tXiHvne.exe
  C:\Windows\System\tXiHvne.exe
  2⤵
  PID:3896
- C:\Windows\System\uaNioFU.exe
  C:\Windows\System\uaNioFU.exe
  2⤵
  PID:3912
- C:\Windows\System\fxVTFea.exe
  C:\Windows\System\fxVTFea.exe
  2⤵
  PID:3928
- C:\Windows\System\RYgmFSP.exe
  C:\Windows\System\RYgmFSP.exe
  2⤵
  PID:3944
- C:\Windows\System\pGqnxjl.exe
  C:\Windows\System\pGqnxjl.exe
  2⤵
  PID:3960
- C:\Windows\System\eVUfxnK.exe
  C:\Windows\System\eVUfxnK.exe
  2⤵
  PID:3976
- C:\Windows\System\PSLSQRo.exe
  C:\Windows\System\PSLSQRo.exe
  2⤵
  PID:3992
- C:\Windows\System\iDQWqVw.exe
  C:\Windows\System\iDQWqVw.exe
  2⤵
  PID:4008
- C:\Windows\System\lYwOAVt.exe
  C:\Windows\System\lYwOAVt.exe
  2⤵
  PID:4024
- C:\Windows\System\deZYeTp.exe
  C:\Windows\System\deZYeTp.exe
  2⤵
  PID:4040
- C:\Windows\System\CZQgUua.exe
  C:\Windows\System\CZQgUua.exe
  2⤵
  PID:4056
- C:\Windows\System\fVggHcN.exe
  C:\Windows\System\fVggHcN.exe
  2⤵
  PID:4072
- C:\Windows\System\tJQCDNX.exe
  C:\Windows\System\tJQCDNX.exe
  2⤵
  PID:4088
- C:\Windows\System\HeutOZn.exe
  C:\Windows\System\HeutOZn.exe
  2⤵
  PID:1228
- C:\Windows\System\PDORaBs.exe
  C:\Windows\System\PDORaBs.exe
  2⤵
  PID:1792
- C:\Windows\System\IEIxAuh.exe
  C:\Windows\System\IEIxAuh.exe
  2⤵
  PID:3124
- C:\Windows\System\kyhCSGN.exe
  C:\Windows\System\kyhCSGN.exe
  2⤵
  PID:3188
- C:\Windows\System\zdlwzIf.exe
  C:\Windows\System\zdlwzIf.exe
  2⤵
  PID:3252
- C:\Windows\System\hUPzLuw.exe
  C:\Windows\System\hUPzLuw.exe
  2⤵
  PID:3284
- C:\Windows\System\SXtsTrK.exe
  C:\Windows\System\SXtsTrK.exe
  2⤵
  PID:3348
- C:\Windows\System\TBOVIGM.exe
  C:\Windows\System\TBOVIGM.exe
  2⤵
  PID:3412
- C:\Windows\System\odlKdoT.exe
  C:\Windows\System\odlKdoT.exe
  2⤵
  PID:3476
- C:\Windows\System\oGqufyX.exe
  C:\Windows\System\oGqufyX.exe
  2⤵
  PID:3540
- C:\Windows\System\TWepvMm.exe
  C:\Windows\System\TWepvMm.exe
  2⤵
  PID:3604
- C:\Windows\System\YYDELtA.exe
  C:\Windows\System\YYDELtA.exe
  2⤵
  PID:3668
- C:\Windows\System\CmxNaPE.exe
  C:\Windows\System\CmxNaPE.exe
  2⤵
  PID:3732
- C:\Windows\System\QlMxWkj.exe
  C:\Windows\System\QlMxWkj.exe
  2⤵
  PID:2644
- C:\Windows\System\ywLPUVY.exe
  C:\Windows\System\ywLPUVY.exe
  2⤵
  PID:3828
- C:\Windows\System\soNowOq.exe
  C:\Windows\System\soNowOq.exe
  2⤵
  PID:3892
- C:\Windows\System\ZCjTswq.exe
  C:\Windows\System\ZCjTswq.exe
  2⤵
  PID:2488
- C:\Windows\System\eidtbLk.exe
  C:\Windows\System\eidtbLk.exe
  2⤵
  PID:3984
- C:\Windows\System\KgLbLeh.exe
  C:\Windows\System\KgLbLeh.exe
  2⤵
  PID:4048
- C:\Windows\System\vXfKuMc.exe
  C:\Windows\System\vXfKuMc.exe
  2⤵
  PID:1316
- C:\Windows\System\pNYIkwt.exe
  C:\Windows\System\pNYIkwt.exe
  2⤵
  PID:3156
- C:\Windows\System\XObOnUk.exe
  C:\Windows\System\XObOnUk.exe
  2⤵
  PID:4104
- C:\Windows\System\saStlqx.exe
  C:\Windows\System\saStlqx.exe
  2⤵
  PID:4120
- C:\Windows\System\TlrgvzP.exe
  C:\Windows\System\TlrgvzP.exe
  2⤵
  PID:4136
- C:\Windows\System\TjOvoxr.exe
  C:\Windows\System\TjOvoxr.exe
  2⤵
  PID:4152
- C:\Windows\System\CfpGfWn.exe
  C:\Windows\System\CfpGfWn.exe
  2⤵
  PID:4168
- C:\Windows\System\SrXudgG.exe
  C:\Windows\System\SrXudgG.exe
  2⤵
  PID:4184
- C:\Windows\System\WZZSlFj.exe
  C:\Windows\System\WZZSlFj.exe
  2⤵
  PID:4200
- C:\Windows\System\gDQTkBE.exe
  C:\Windows\System\gDQTkBE.exe
  2⤵
  PID:4216
- C:\Windows\System\hEJAGKo.exe
  C:\Windows\System\hEJAGKo.exe
  2⤵
  PID:4232
- C:\Windows\System\lojUQCk.exe
  C:\Windows\System\lojUQCk.exe
  2⤵
  PID:4248
- C:\Windows\System\LtxGIza.exe
  C:\Windows\System\LtxGIza.exe
  2⤵
  PID:4264
- C:\Windows\System\NHRZyUS.exe
  C:\Windows\System\NHRZyUS.exe
  2⤵
  PID:4280
- C:\Windows\System\qewUWlB.exe
  C:\Windows\System\qewUWlB.exe
  2⤵
  PID:4296
- C:\Windows\System\auvxyBy.exe
  C:\Windows\System\auvxyBy.exe
  2⤵
  PID:4312
- C:\Windows\System\jEJrfMx.exe
  C:\Windows\System\jEJrfMx.exe
  2⤵
  PID:4328
- C:\Windows\System\GRetfnY.exe
  C:\Windows\System\GRetfnY.exe
  2⤵
  PID:4344
- C:\Windows\System\MfoVJVg.exe
  C:\Windows\System\MfoVJVg.exe
  2⤵
  PID:4360
- C:\Windows\System\LyJjwjV.exe
  C:\Windows\System\LyJjwjV.exe
  2⤵
  PID:4376
- C:\Windows\System\tSyZmQj.exe
  C:\Windows\System\tSyZmQj.exe
  2⤵
  PID:4392
- C:\Windows\System\oSNLvkF.exe
  C:\Windows\System\oSNLvkF.exe
  2⤵
  PID:4408
- C:\Windows\System\hlKTHga.exe
  C:\Windows\System\hlKTHga.exe
  2⤵
  PID:4424
- C:\Windows\System\VUSclsw.exe
  C:\Windows\System\VUSclsw.exe
  2⤵
  PID:4440
- C:\Windows\System\LXIseuI.exe
  C:\Windows\System\LXIseuI.exe
  2⤵
  PID:4456
- C:\Windows\System\RlASvrj.exe
  C:\Windows\System\RlASvrj.exe
  2⤵
  PID:4472
- C:\Windows\System\mbXSTOZ.exe
  C:\Windows\System\mbXSTOZ.exe
  2⤵
  PID:4488
- C:\Windows\System\DngTgXf.exe
  C:\Windows\System\DngTgXf.exe
  2⤵
  PID:4504
- C:\Windows\System\DbYzQBp.exe
  C:\Windows\System\DbYzQBp.exe
  2⤵
  PID:4520
- C:\Windows\System\rVFaUBo.exe
  C:\Windows\System\rVFaUBo.exe
  2⤵
  PID:4536
- C:\Windows\System\zuWjRkj.exe
  C:\Windows\System\zuWjRkj.exe
  2⤵
  PID:4552
- C:\Windows\System\HicJfND.exe
  C:\Windows\System\HicJfND.exe
  2⤵
  PID:4568
- C:\Windows\System\yJaeiFS.exe
  C:\Windows\System\yJaeiFS.exe
  2⤵
  PID:4584
- C:\Windows\System\nlmcbOx.exe
  C:\Windows\System\nlmcbOx.exe
  2⤵
  PID:4600
- C:\Windows\System\MVDqfXY.exe
  C:\Windows\System\MVDqfXY.exe
  2⤵
  PID:4616
- C:\Windows\System\rqVIdDX.exe
  C:\Windows\System\rqVIdDX.exe
  2⤵
  PID:4632
- C:\Windows\System\lwzfFqo.exe
  C:\Windows\System\lwzfFqo.exe
  2⤵
  PID:4648
- C:\Windows\System\xbDTtmo.exe
  C:\Windows\System\xbDTtmo.exe
  2⤵
  PID:4664
- C:\Windows\System\qvbzqgD.exe
  C:\Windows\System\qvbzqgD.exe
  2⤵
  PID:4680
- C:\Windows\System\blFhByy.exe
  C:\Windows\System\blFhByy.exe
  2⤵
  PID:4696
- C:\Windows\System\pXnQPAe.exe
  C:\Windows\System\pXnQPAe.exe
  2⤵
  PID:4712
- C:\Windows\System\dbkxHdZ.exe
  C:\Windows\System\dbkxHdZ.exe
  2⤵
  PID:4728
- C:\Windows\System\YEdwUiK.exe
  C:\Windows\System\YEdwUiK.exe
  2⤵
  PID:4744
- C:\Windows\System\bROOBGQ.exe
  C:\Windows\System\bROOBGQ.exe
  2⤵
  PID:4760
- C:\Windows\System\aLDpbQa.exe
  C:\Windows\System\aLDpbQa.exe
  2⤵
  PID:4776
- C:\Windows\System\eAjsqyi.exe
  C:\Windows\System\eAjsqyi.exe
  2⤵
  PID:4792
- C:\Windows\System\FSTyKFS.exe
  C:\Windows\System\FSTyKFS.exe
  2⤵
  PID:4808
- C:\Windows\System\vxopuZd.exe
  C:\Windows\System\vxopuZd.exe
  2⤵
  PID:4824
- C:\Windows\System\ibyHjKu.exe
  C:\Windows\System\ibyHjKu.exe
  2⤵
  PID:4840
- C:\Windows\System\aUXfMbR.exe
  C:\Windows\System\aUXfMbR.exe
  2⤵
  PID:4856
- C:\Windows\System\XVMRbLn.exe
  C:\Windows\System\XVMRbLn.exe
  2⤵
  PID:4872
- C:\Windows\System\xEWDUVq.exe
  C:\Windows\System\xEWDUVq.exe
  2⤵
  PID:4888
- C:\Windows\System\gqHxiuc.exe
  C:\Windows\System\gqHxiuc.exe
  2⤵
  PID:4904
- C:\Windows\System\rPvFptN.exe
  C:\Windows\System\rPvFptN.exe
  2⤵
  PID:4920
- C:\Windows\System\TkUYhJM.exe
  C:\Windows\System\TkUYhJM.exe
  2⤵
  PID:4936
- C:\Windows\System\yqAcdup.exe
  C:\Windows\System\yqAcdup.exe
  2⤵
  PID:4952
- C:\Windows\System\icIJQbD.exe
  C:\Windows\System\icIJQbD.exe
  2⤵
  PID:4968
- C:\Windows\System\LWfTAGl.exe
  C:\Windows\System\LWfTAGl.exe
  2⤵
  PID:4984
- C:\Windows\System\fwFwfOb.exe
  C:\Windows\System\fwFwfOb.exe
  2⤵
  PID:5000
- C:\Windows\System\XUCeXdJ.exe
  C:\Windows\System\XUCeXdJ.exe
  2⤵
  PID:5016
- C:\Windows\System\mFRIvJC.exe
  C:\Windows\System\mFRIvJC.exe
  2⤵
  PID:5032
- C:\Windows\System\THeCjPr.exe
  C:\Windows\System\THeCjPr.exe
  2⤵
  PID:5048
- C:\Windows\System\GaEsWzw.exe
  C:\Windows\System\GaEsWzw.exe
  2⤵
  PID:5064
- C:\Windows\System\UAVBEvc.exe
  C:\Windows\System\UAVBEvc.exe
  2⤵
  PID:5080
- C:\Windows\System\VGuHroI.exe
  C:\Windows\System\VGuHroI.exe
  2⤵
  PID:5096
- C:\Windows\System\oaxXwvS.exe
  C:\Windows\System\oaxXwvS.exe
  2⤵
  PID:5112
- C:\Windows\System\gfLKWme.exe
  C:\Windows\System\gfLKWme.exe
  2⤵
  PID:3408
- C:\Windows\System\pXEjloP.exe
  C:\Windows\System\pXEjloP.exe
  2⤵
  PID:3664
- C:\Windows\System\LkrxwYF.exe
  C:\Windows\System\LkrxwYF.exe
  2⤵
  PID:3888
- C:\Windows\System\koFivbn.exe
  C:\Windows\System\koFivbn.exe
  2⤵
  PID:4084
- C:\Windows\System\zSoaWzW.exe
  C:\Windows\System\zSoaWzW.exe
  2⤵
  PID:4132
- C:\Windows\System\RwETzRx.exe
  C:\Windows\System\RwETzRx.exe
  2⤵
  PID:2812
- C:\Windows\System\JEBYYVq.exe
  C:\Windows\System\JEBYYVq.exe
  2⤵
  PID:4288
- C:\Windows\System\TUgYsDv.exe
  C:\Windows\System\TUgYsDv.exe
  2⤵
  PID:4356
- C:\Windows\System\lqawlph.exe
  C:\Windows\System\lqawlph.exe
  2⤵
  PID:1112
- C:\Windows\System\OlEUwrE.exe
  C:\Windows\System\OlEUwrE.exe
  2⤵
  PID:4516
- C:\Windows\System\BWgoHMO.exe
  C:\Windows\System\BWgoHMO.exe
  2⤵
  PID:4580
- C:\Windows\System\IJYsDHd.exe
  C:\Windows\System\IJYsDHd.exe
  2⤵
  PID:4644
- C:\Windows\System\egWwhaS.exe
  C:\Windows\System\egWwhaS.exe
  2⤵
  PID:4676
- C:\Windows\System\RTaukfN.exe
  C:\Windows\System\RTaukfN.exe
  2⤵
  PID:4736
- C:\Windows\System\KPxSOTi.exe
  C:\Windows\System\KPxSOTi.exe
  2⤵
  PID:4768
- C:\Windows\System\WOnSOpa.exe
  C:\Windows\System\WOnSOpa.exe
  2⤵
  PID:4804
- C:\Windows\System\WUMIxYC.exe
  C:\Windows\System\WUMIxYC.exe
  2⤵
  PID:4836
- C:\Windows\System\oqbqFFD.exe
  C:\Windows\System\oqbqFFD.exe
  2⤵
  PID:1928
- C:\Windows\System\yvimEkq.exe
  C:\Windows\System\yvimEkq.exe
  2⤵
  PID:932
- C:\Windows\System\dUAIWtk.exe
  C:\Windows\System\dUAIWtk.exe
  2⤵
  PID:4960
- C:\Windows\System\oNvTWdE.exe
  C:\Windows\System\oNvTWdE.exe
  2⤵
  PID:5024
- C:\Windows\System\ybgyZGZ.exe
  C:\Windows\System\ybgyZGZ.exe
  2⤵
  PID:292
- C:\Windows\System\dHyOTNG.exe
  C:\Windows\System\dHyOTNG.exe
  2⤵
  PID:1280
- C:\Windows\System\YMwMhqe.exe
  C:\Windows\System\YMwMhqe.exe
  2⤵
  PID:2324
- C:\Windows\System\CtoECvu.exe
  C:\Windows\System\CtoECvu.exe
  2⤵
  PID:2596
- C:\Windows\System\qZudaiU.exe
  C:\Windows\System\qZudaiU.exe
  2⤵
  PID:2288
- C:\Windows\System\QaUWhrr.exe
  C:\Windows\System\QaUWhrr.exe
  2⤵
  PID:2508
- C:\Windows\System\dbvfMFx.exe
  C:\Windows\System\dbvfMFx.exe
  2⤵
  PID:5088
- C:\Windows\System\adyjkgW.exe
  C:\Windows\System\adyjkgW.exe
  2⤵
  PID:3860
- C:\Windows\System\UzdgVsU.exe
  C:\Windows\System\UzdgVsU.exe
  2⤵
  PID:1880
- C:\Windows\System\IOxuxYm.exe
  C:\Windows\System\IOxuxYm.exe
  2⤵
  PID:2080
- C:\Windows\System\DnpZxEq.exe
  C:\Windows\System\DnpZxEq.exe
  2⤵
  PID:608
- C:\Windows\System\dyFyfnB.exe
  C:\Windows\System\dyFyfnB.exe
  2⤵
  PID:1368
- C:\Windows\System\DDVOcFr.exe
  C:\Windows\System\DDVOcFr.exe
  2⤵
  PID:2900
- C:\Windows\System\hQpOjNq.exe
  C:\Windows\System\hQpOjNq.exe
  2⤵
  PID:5132
- C:\Windows\System\wrjJmMe.exe
  C:\Windows\System\wrjJmMe.exe
  2⤵
  PID:5148
- C:\Windows\System\IHBRPbx.exe
  C:\Windows\System\IHBRPbx.exe
  2⤵
  PID:5164
- C:\Windows\System\bUbtfHS.exe
  C:\Windows\System\bUbtfHS.exe
  2⤵
  PID:5184
- C:\Windows\System\rmciuME.exe
  C:\Windows\System\rmciuME.exe
  2⤵
  PID:5200
- C:\Windows\System\qUNNbob.exe
  C:\Windows\System\qUNNbob.exe
  2⤵
  PID:5216
- C:\Windows\System\vADzCQN.exe
  C:\Windows\System\vADzCQN.exe
  2⤵
  PID:5608
- C:\Windows\System\pQvzfON.exe
  C:\Windows\System\pQvzfON.exe
  2⤵
  PID:5624
- C:\Windows\System\uCmzRVI.exe
  C:\Windows\System\uCmzRVI.exe
  2⤵
  PID:5640
- C:\Windows\System\iDAgMvP.exe
  C:\Windows\System\iDAgMvP.exe
  2⤵
  PID:5656
- C:\Windows\System\YQzidKM.exe
  C:\Windows\System\YQzidKM.exe
  2⤵
  PID:5672
- C:\Windows\System\lbZwZcb.exe
  C:\Windows\System\lbZwZcb.exe
  2⤵
  PID:5688
- C:\Windows\System\NUFZbvg.exe
  C:\Windows\System\NUFZbvg.exe
  2⤵
  PID:5704
- C:\Windows\System\PqLXovT.exe
  C:\Windows\System\PqLXovT.exe
  2⤵
  PID:5720
- C:\Windows\System\JkHtcPA.exe
  C:\Windows\System\JkHtcPA.exe
  2⤵
  PID:5736
- C:\Windows\System\hUJrgMe.exe
  C:\Windows\System\hUJrgMe.exe
  2⤵
  PID:5752
- C:\Windows\System\BzpUdkm.exe
  C:\Windows\System\BzpUdkm.exe
  2⤵
  PID:5768
- C:\Windows\System\inCJiCq.exe
  C:\Windows\System\inCJiCq.exe
  2⤵
  PID:5784
- C:\Windows\System\gCkVCxy.exe
  C:\Windows\System\gCkVCxy.exe
  2⤵
  PID:5800
- C:\Windows\System\QbiVNIf.exe
  C:\Windows\System\QbiVNIf.exe
  2⤵
  PID:5816
- C:\Windows\System\ScfyGLP.exe
  C:\Windows\System\ScfyGLP.exe
  2⤵
  PID:3840
- C:\Windows\System\YFYUVrC.exe
  C:\Windows\System\YFYUVrC.exe
  2⤵
  PID:2956
- C:\Windows\System\xgZBJDt.exe
  C:\Windows\System\xgZBJDt.exe
  2⤵
  PID:3248
- C:\Windows\System\jDgCLje.exe
  C:\Windows\System\jDgCLje.exe
  2⤵
  PID:3728
- C:\Windows\System\kuqNrPq.exe
  C:\Windows\System\kuqNrPq.exe
  2⤵
  PID:3952
- C:\Windows\System\dFZsgtb.exe
  C:\Windows\System\dFZsgtb.exe
  2⤵
  PID:4144
- C:\Windows\System\vlRsMTV.exe
  C:\Windows\System\vlRsMTV.exe
  2⤵
  PID:4208
- C:\Windows\System\NBopLQk.exe
  C:\Windows\System\NBopLQk.exe
  2⤵
  PID:4372
- C:\Windows\System\ctQhoSJ.exe
  C:\Windows\System\ctQhoSJ.exe
  2⤵
  PID:4464
- C:\Windows\System\EOgSgbU.exe
  C:\Windows\System\EOgSgbU.exe
  2⤵
  PID:4528
- C:\Windows\System\EoojOky.exe
  C:\Windows\System\EoojOky.exe
  2⤵
  PID:4592
- C:\Windows\System\oEMtQeC.exe
  C:\Windows\System\oEMtQeC.exe
  2⤵
  PID:4656
- C:\Windows\System\nlSlmIq.exe
  C:\Windows\System\nlSlmIq.exe
  2⤵
  PID:4724
- C:\Windows\System\RPNbyUR.exe
  C:\Windows\System\RPNbyUR.exe
  2⤵
  PID:4820
- C:\Windows\System\xPttFlZ.exe
  C:\Windows\System\xPttFlZ.exe
  2⤵
  PID:4916
- C:\Windows\System\rpxibJz.exe
  C:\Windows\System\rpxibJz.exe
  2⤵
  PID:5012
- C:\Windows\System\qPMOOpy.exe
  C:\Windows\System\qPMOOpy.exe
  2⤵
  PID:5108
- C:\Windows\System\TzjpIjL.exe
  C:\Windows\System\TzjpIjL.exe
  2⤵
  PID:4164
- C:\Windows\System\akomljF.exe
  C:\Windows\System\akomljF.exe
  2⤵
  PID:4224
- C:\Windows\System\YuRILFx.exe
  C:\Windows\System\YuRILFx.exe
  2⤵
  PID:780
- C:\Windows\System\LAooUlN.exe
  C:\Windows\System\LAooUlN.exe
  2⤵
  PID:2852
- C:\Windows\System\DBQmRNl.exe
  C:\Windows\System\DBQmRNl.exe
  2⤵
  PID:4900
- C:\Windows\System\kibxlfz.exe
  C:\Windows\System\kibxlfz.exe
  2⤵
  PID:2820
- C:\Windows\System\HmhaozC.exe
  C:\Windows\System\HmhaozC.exe
  2⤵
  PID:4128
- C:\Windows\System\PJruYrs.exe
  C:\Windows\System\PJruYrs.exe
  2⤵
  PID:1996
- C:\Windows\System\UVbInfx.exe
  C:\Windows\System\UVbInfx.exe
  2⤵
  PID:5128
- C:\Windows\System\QvhJHlD.exe
  C:\Windows\System\QvhJHlD.exe
  2⤵
  PID:5196
- C:\Windows\System\PyXNVxm.exe
  C:\Windows\System\PyXNVxm.exe
  2⤵
  PID:5244
- C:\Windows\System\GBORkQo.exe
  C:\Windows\System\GBORkQo.exe
  2⤵
  PID:5260
- C:\Windows\System\eeLwahL.exe
  C:\Windows\System\eeLwahL.exe
  2⤵
  PID:5276
- C:\Windows\System\KEzGtMe.exe
  C:\Windows\System\KEzGtMe.exe
  2⤵
  PID:5296
- C:\Windows\System\erTKIbY.exe
  C:\Windows\System\erTKIbY.exe
  2⤵
  PID:5316
- C:\Windows\System\rWfLEBk.exe
  C:\Windows\System\rWfLEBk.exe
  2⤵
  PID:5332
- C:\Windows\System\srKhifa.exe
  C:\Windows\System\srKhifa.exe
  2⤵
  PID:5388
- C:\Windows\System\eHJkDkW.exe
  C:\Windows\System\eHJkDkW.exe
  2⤵
  PID:5400
- C:\Windows\System\GZvGfrS.exe
  C:\Windows\System\GZvGfrS.exe
  2⤵
  PID:5416
- C:\Windows\System\vOpWBZH.exe
  C:\Windows\System\vOpWBZH.exe
  2⤵
  PID:5448
- C:\Windows\System\ziBqGtQ.exe
  C:\Windows\System\ziBqGtQ.exe
  2⤵
  PID:5460
- C:\Windows\System\mgYLqAd.exe
  C:\Windows\System\mgYLqAd.exe
  2⤵
  PID:2928
- C:\Windows\System\lESldyQ.exe
  C:\Windows\System\lESldyQ.exe
  2⤵
  PID:1048
- C:\Windows\System\EeWJPAn.exe
  C:\Windows\System\EeWJPAn.exe
  2⤵
  PID:4272
- C:\Windows\System\EFUXrOA.exe
  C:\Windows\System\EFUXrOA.exe
  2⤵
  PID:4336
- C:\Windows\System\dkQhgmV.exe
  C:\Windows\System\dkQhgmV.exe
  2⤵
  PID:5476
- C:\Windows\System\IrLlXYI.exe
  C:\Windows\System\IrLlXYI.exe
  2⤵
  PID:2768
- C:\Windows\System\IBzXSXG.exe
  C:\Windows\System\IBzXSXG.exe
  2⤵
  PID:2764
- C:\Windows\System\LEbpwRu.exe
  C:\Windows\System\LEbpwRu.exe
  2⤵
  PID:2204
- C:\Windows\System\ruNeMIV.exe
  C:\Windows\System\ruNeMIV.exe
  2⤵
  PID:4320
- C:\Windows\System\zgFwNbR.exe
  C:\Windows\System\zgFwNbR.exe
  2⤵
  PID:1072
- C:\Windows\System\SrdZchu.exe
  C:\Windows\System\SrdZchu.exe
  2⤵
  PID:4800
- C:\Windows\System\BrBmvcU.exe
  C:\Windows\System\BrBmvcU.exe
  2⤵
  PID:1816
- C:\Windows\System\VFJgRRS.exe
  C:\Windows\System\VFJgRRS.exe
  2⤵
  PID:5060
- C:\Windows\System\EnKpYyh.exe
  C:\Windows\System\EnKpYyh.exe
  2⤵
  PID:2612
- C:\Windows\System\VPGutNA.exe
  C:\Windows\System\VPGutNA.exe
  2⤵
  PID:2552
- C:\Windows\System\ofumfCf.exe
  C:\Windows\System\ofumfCf.exe
  2⤵
  PID:2164
- C:\Windows\System\oFlXIcE.exe
  C:\Windows\System\oFlXIcE.exe
  2⤵
  PID:5560
- C:\Windows\System\bimgSKU.exe
  C:\Windows\System\bimgSKU.exe
  2⤵
  PID:5572
- C:\Windows\System\qALfwOC.exe
  C:\Windows\System\qALfwOC.exe
  2⤵
  PID:5588
- C:\Windows\System\ZLaaAci.exe
  C:\Windows\System\ZLaaAci.exe
  2⤵
  PID:5604
- C:\Windows\System\SfeDvuR.exe
  C:\Windows\System\SfeDvuR.exe
  2⤵
  PID:5668
- C:\Windows\System\vPPaoZP.exe
  C:\Windows\System\vPPaoZP.exe
  2⤵
  PID:5732
- C:\Windows\System\tRrQVCT.exe
  C:\Windows\System\tRrQVCT.exe
  2⤵
  PID:2564
- C:\Windows\System\gMpkhFG.exe
  C:\Windows\System\gMpkhFG.exe
  2⤵
  PID:5620
- C:\Windows\System\mDoDDGo.exe
  C:\Windows\System\mDoDDGo.exe
  2⤵
  PID:5648
- C:\Windows\System\SSFcSkY.exe
  C:\Windows\System\SSFcSkY.exe
  2⤵
  PID:5748
- C:\Windows\System\UahoDDg.exe
  C:\Windows\System\UahoDDg.exe
  2⤵
  PID:5812
- C:\Windows\System\oXPCSQk.exe
  C:\Windows\System\oXPCSQk.exe
  2⤵
  PID:5832
- C:\Windows\System\jynMdLe.exe
  C:\Windows\System\jynMdLe.exe
  2⤵
  PID:2708
- C:\Windows\System\XpsieOo.exe
  C:\Windows\System\XpsieOo.exe
  2⤵
  PID:1240
- C:\Windows\System\GdfpphM.exe
  C:\Windows\System\GdfpphM.exe
  2⤵
  PID:5876
- C:\Windows\System\ntZQimG.exe
  C:\Windows\System\ntZQimG.exe
  2⤵
  PID:5848
- C:\Windows\System\TPlMaMa.exe
  C:\Windows\System\TPlMaMa.exe
  2⤵
  PID:5868
- C:\Windows\System\WQznzTg.exe
  C:\Windows\System\WQznzTg.exe
  2⤵
  PID:5892
- C:\Windows\System\kWgrIoa.exe
  C:\Windows\System\kWgrIoa.exe
  2⤵
  PID:5908
- C:\Windows\System\yZNGQFC.exe
  C:\Windows\System\yZNGQFC.exe
  2⤵
  PID:5924
- C:\Windows\System\tztrhJV.exe
  C:\Windows\System\tztrhJV.exe
  2⤵
  PID:5940
- C:\Windows\System\cIwkLyx.exe
  C:\Windows\System\cIwkLyx.exe
  2⤵
  PID:5956
- C:\Windows\System\CSjDuki.exe
  C:\Windows\System\CSjDuki.exe
  2⤵
  PID:5972
- C:\Windows\System\OGVqYBb.exe
  C:\Windows\System\OGVqYBb.exe
  2⤵
  PID:5988
- C:\Windows\System\hbRdAIZ.exe
  C:\Windows\System\hbRdAIZ.exe
  2⤵
  PID:6008
- C:\Windows\System\pAEoNIk.exe
  C:\Windows\System\pAEoNIk.exe
  2⤵
  PID:6032
- C:\Windows\System\EQWJUfT.exe
  C:\Windows\System\EQWJUfT.exe
  2⤵
  PID:6048
- C:\Windows\System\dHECcIr.exe
  C:\Windows\System\dHECcIr.exe
  2⤵
  PID:6060
- C:\Windows\System\qYbxbwn.exe
  C:\Windows\System\qYbxbwn.exe
  2⤵
  PID:6076
- C:\Windows\System\ASYXSIS.exe
  C:\Windows\System\ASYXSIS.exe
  2⤵
  PID:2084
- C:\Windows\System\BTcrTRb.exe
  C:\Windows\System\BTcrTRb.exe
  2⤵
  PID:6096
- C:\Windows\System\qdgFlSB.exe
  C:\Windows\System\qdgFlSB.exe
  2⤵
  PID:6112
- C:\Windows\System\oumegKA.exe
  C:\Windows\System\oumegKA.exe
  2⤵
  PID:6124
- C:\Windows\System\kBIjKSa.exe
  C:\Windows\System\kBIjKSa.exe
  2⤵
  PID:6136
- C:\Windows\System\tPdWSYa.exe
  C:\Windows\System\tPdWSYa.exe
  2⤵
  PID:2076
- C:\Windows\System\vQZCtrM.exe
  C:\Windows\System\vQZCtrM.exe
  2⤵
  PID:1424
- C:\Windows\System\NPaczKe.exe
  C:\Windows\System\NPaczKe.exe
  2⤵
  PID:1640
- C:\Windows\System\EgmNtCS.exe
  C:\Windows\System\EgmNtCS.exe
  2⤵
  PID:3136
- C:\Windows\System\WAubpgQ.exe
  C:\Windows\System\WAubpgQ.exe
  2⤵
  PID:3204
- C:\Windows\System\eeqdscg.exe
  C:\Windows\System\eeqdscg.exe
  2⤵
  PID:3268
- C:\Windows\System\FSGuEDN.exe
  C:\Windows\System\FSGuEDN.exe
  2⤵
  PID:3360
- C:\Windows\System\qMywgzW.exe
  C:\Windows\System\qMywgzW.exe
  2⤵
  PID:3424
- C:\Windows\System\YoCVZNb.exe
  C:\Windows\System\YoCVZNb.exe
  2⤵
  PID:3492
- C:\Windows\System\idbLvtW.exe
  C:\Windows\System\idbLvtW.exe
  2⤵
  PID:3556
- C:\Windows\System\WbzmSUQ.exe
  C:\Windows\System\WbzmSUQ.exe
  2⤵
  PID:3620
- C:\Windows\System\PlOsMEI.exe
  C:\Windows\System\PlOsMEI.exe
  2⤵
  PID:3652
- C:\Windows\System\PvzdKSj.exe
  C:\Windows\System\PvzdKSj.exe
  2⤵
  PID:2392
- C:\Windows\System\kGzXlUi.exe
  C:\Windows\System\kGzXlUi.exe
  2⤵
  PID:1924
- C:\Windows\System\sZqHwmh.exe
  C:\Windows\System\sZqHwmh.exe
  2⤵
  PID:1244
- C:\Windows\System\ubksuEX.exe
  C:\Windows\System\ubksuEX.exe
  2⤵
  PID:3776
- C:\Windows\System\FZWNdpV.exe
  C:\Windows\System\FZWNdpV.exe
  2⤵
  PID:324
- C:\Windows\System\bdVwUub.exe
  C:\Windows\System\bdVwUub.exe
  2⤵
  PID:2652
- C:\Windows\System\ycHinJz.exe
  C:\Windows\System\ycHinJz.exe
  2⤵
  PID:2604
- C:\Windows\System\zaTbyMS.exe
  C:\Windows\System\zaTbyMS.exe
  2⤵
  PID:3092
- C:\Windows\System\Xoemroh.exe
  C:\Windows\System\Xoemroh.exe
  2⤵
  PID:4064
- C:\Windows\System\RBsbIlE.exe
  C:\Windows\System\RBsbIlE.exe
  2⤵
  PID:3572
- C:\Windows\System\rQRsFiF.exe
  C:\Windows\System\rQRsFiF.exe
  2⤵
  PID:3824
- C:\Windows\System\XhzgiKf.exe
  C:\Windows\System\XhzgiKf.exe
  2⤵
  PID:1796
- C:\Windows\System\jkkjyzF.exe
  C:\Windows\System\jkkjyzF.exe
  2⤵
  PID:4180
- C:\Windows\System\SSrfThr.exe
  C:\Windows\System\SSrfThr.exe
  2⤵
  PID:4368
- C:\Windows\System\rooDaWp.exe
  C:\Windows\System\rooDaWp.exe
  2⤵
  PID:4256
- C:\Windows\System\FEhvBsv.exe
  C:\Windows\System\FEhvBsv.exe
  2⤵
  PID:4436
- C:\Windows\System\JsfDaJX.exe
  C:\Windows\System\JsfDaJX.exe
  2⤵
  PID:4756
- C:\Windows\System\fwNPPtW.exe
  C:\Windows\System\fwNPPtW.exe
  2⤵
  PID:4784
- C:\Windows\System\fNmAHbg.exe
  C:\Windows\System\fNmAHbg.exe
  2⤵
  PID:4884
- C:\Windows\System\QKgzwzn.exe
  C:\Windows\System\QKgzwzn.exe
  2⤵
  PID:5008
- C:\Windows\System\lbQwkVF.exe
  C:\Windows\System\lbQwkVF.exe
  2⤵
  PID:2744
- C:\Windows\System\ZwQmrfW.exe
  C:\Windows\System\ZwQmrfW.exe
  2⤵
  PID:3712
- C:\Windows\System\vEKHfso.exe
  C:\Windows\System\vEKHfso.exe
  2⤵
  PID:1460
- C:\Windows\System\XNPSISV.exe
  C:\Windows\System\XNPSISV.exe
  2⤵
  PID:1532
- C:\Windows\System\JlqyHKW.exe
  C:\Windows\System\JlqyHKW.exe
  2⤵
  PID:4832
- C:\Windows\System\zDhMSAQ.exe
  C:\Windows\System\zDhMSAQ.exe
  2⤵
  PID:2840
- C:\Windows\System\yOqMTIs.exe
  C:\Windows\System\yOqMTIs.exe
  2⤵
  PID:5160
- C:\Windows\System\URlRhcz.exe
  C:\Windows\System\URlRhcz.exe
  2⤵
  PID:5256
- C:\Windows\System\LYKZkMZ.exe
  C:\Windows\System\LYKZkMZ.exe
  2⤵
  PID:5268
- C:\Windows\System\hluIrbT.exe
  C:\Windows\System\hluIrbT.exe
  2⤵
  PID:2992
- C:\Windows\System\FgtqSWF.exe
  C:\Windows\System\FgtqSWF.exe
  2⤵
  PID:2572
- C:\Windows\System\WuvqpqT.exe
  C:\Windows\System\WuvqpqT.exe
  2⤵
  PID:5368
- C:\Windows\System\bJNjJZc.exe
  C:\Windows\System\bJNjJZc.exe
  2⤵
  PID:5408
- C:\Windows\System\IxyLuyP.exe
  C:\Windows\System\IxyLuyP.exe
  2⤵
  PID:5352
- C:\Windows\System\rYPkobY.exe
  C:\Windows\System\rYPkobY.exe
  2⤵
  PID:5456
- C:\Windows\System\qnDoteS.exe
  C:\Windows\System\qnDoteS.exe
  2⤵
  PID:2776
- C:\Windows\System\nbQgsAw.exe
  C:\Windows\System\nbQgsAw.exe
  2⤵
  PID:4448
- C:\Windows\System\NfaOvHF.exe
  C:\Windows\System\NfaOvHF.exe
  2⤵
  PID:2168
- C:\Windows\System\ALbpAxO.exe
  C:\Windows\System\ALbpAxO.exe
  2⤵
  PID:4612
- C:\Windows\System\yjOXxTF.exe
  C:\Windows\System\yjOXxTF.exe
  2⤵
  PID:5424
- C:\Windows\System\RxwbUGU.exe
  C:\Windows\System\RxwbUGU.exe
  2⤵
  PID:5432
- C:\Windows\System\CSSTzAz.exe
  C:\Windows\System\CSSTzAz.exe
  2⤵
  PID:2568
- C:\Windows\System\CfocPgl.exe
  C:\Windows\System\CfocPgl.exe
  2⤵
  PID:3444
- C:\Windows\System\iYfEArr.exe
  C:\Windows\System\iYfEArr.exe
  2⤵
  PID:2436
- C:\Windows\System\AwmIGaM.exe
  C:\Windows\System\AwmIGaM.exe
  2⤵
  PID:1600
- C:\Windows\System\oFYbUlQ.exe
  C:\Windows\System\oFYbUlQ.exe
  2⤵
  PID:5488
- C:\Windows\System\FZenLYI.exe
  C:\Windows\System\FZenLYI.exe
  2⤵
  PID:2116
- C:\Windows\System\CFFnRFg.exe
  C:\Windows\System\CFFnRFg.exe
  2⤵
  PID:5212
- C:\Windows\System\iXdHLYv.exe
  C:\Windows\System\iXdHLYv.exe
  2⤵
  PID:1360
- C:\Windows\System\gbhzGCr.exe
  C:\Windows\System\gbhzGCr.exe
  2⤵
  PID:5600
- C:\Windows\System\VudbiZu.exe
  C:\Windows\System\VudbiZu.exe
  2⤵
  PID:2372
- C:\Windows\System\eWErRdF.exe
  C:\Windows\System\eWErRdF.exe
  2⤵
  PID:5744
- C:\Windows\System\wLEWkqS.exe
  C:\Windows\System\wLEWkqS.exe
  2⤵
  PID:2216
- C:\Windows\System\caiLuYw.exe
  C:\Windows\System\caiLuYw.exe
  2⤵
  PID:6088
- C:\Windows\System\uUAhEaA.exe
  C:\Windows\System\uUAhEaA.exe
  2⤵
  PID:1504
- C:\Windows\System\WmABoIm.exe
  C:\Windows\System\WmABoIm.exe
  2⤵
  PID:5728
- C:\Windows\System\yYUWQSz.exe
  C:\Windows\System\yYUWQSz.exe
  2⤵
  PID:5584
- C:\Windows\System\GrrNjWD.exe
  C:\Windows\System\GrrNjWD.exe
  2⤵
  PID:5652
- C:\Windows\System\CHDeyIN.exe
  C:\Windows\System\CHDeyIN.exe
  2⤵
  PID:5780
- C:\Windows\System\taOgSPb.exe
  C:\Windows\System\taOgSPb.exe
  2⤵
  PID:6000
- C:\Windows\System\GRIienS.exe
  C:\Windows\System\GRIienS.exe
  2⤵
  PID:6068
- C:\Windows\System\yafRzJb.exe
  C:\Windows\System\yafRzJb.exe
  2⤵
  PID:6120
- C:\Windows\System\akRjCvh.exe
  C:\Windows\System\akRjCvh.exe
  2⤵
  PID:3040
- C:\Windows\System\zYdKdTT.exe
  C:\Windows\System\zYdKdTT.exe
  2⤵
  PID:3300
- C:\Windows\System\yqJGsax.exe
  C:\Windows\System\yqJGsax.exe
  2⤵
  PID:3456
- C:\Windows\System\abiuWKT.exe
  C:\Windows\System\abiuWKT.exe
  2⤵
  PID:3616
- C:\Windows\System\EmpjuFd.exe
  C:\Windows\System\EmpjuFd.exe
  2⤵
  PID:1856
- C:\Windows\System\uHGJYIs.exe
  C:\Windows\System\uHGJYIs.exe
  2⤵
  PID:6016
- C:\Windows\System\IQVtHwD.exe
  C:\Windows\System\IQVtHwD.exe
  2⤵
  PID:6128
- C:\Windows\System\TxYGhHK.exe
  C:\Windows\System\TxYGhHK.exe
  2⤵
  PID:5856
- C:\Windows\System\pksJgig.exe
  C:\Windows\System\pksJgig.exe
  2⤵
  PID:5864
- C:\Windows\System\QNHSxWk.exe
  C:\Windows\System\QNHSxWk.exe
  2⤵
  PID:5872
- C:\Windows\System\SLCPhID.exe
  C:\Windows\System\SLCPhID.exe
  2⤵
  PID:3700
- C:\Windows\System\HFxfiUR.exe
  C:\Windows\System\HFxfiUR.exe
  2⤵
  PID:4260
- C:\Windows\System\JhTKxpe.exe
  C:\Windows\System\JhTKxpe.exe
  2⤵
  PID:3956
- C:\Windows\System\qkivYYH.exe
  C:\Windows\System\qkivYYH.exe
  2⤵
  PID:5192
- C:\Windows\System\BoJSnmh.exe
  C:\Windows\System\BoJSnmh.exe
  2⤵
  PID:5076
- C:\Windows\System\YUEEnMS.exe
  C:\Windows\System\YUEEnMS.exe
  2⤵
  PID:5292
- C:\Windows\System\ADkAhew.exe
  C:\Windows\System\ADkAhew.exe
  2⤵
  PID:5380
- C:\Windows\System\QdZJSfV.exe
  C:\Windows\System\QdZJSfV.exe
  2⤵
  PID:2960
- C:\Windows\System\wjYfJoo.exe
  C:\Windows\System\wjYfJoo.exe
  2⤵
  PID:4036
- C:\Windows\System\djEWNnb.exe
  C:\Windows\System\djEWNnb.exe
  2⤵
  PID:1536
- C:\Windows\System\fwOZFwA.exe
  C:\Windows\System\fwOZFwA.exe
  2⤵
  PID:4564
- C:\Windows\System\pcasVEx.exe
  C:\Windows\System\pcasVEx.exe
  2⤵
  PID:4976
- C:\Windows\System\ORDqzyU.exe
  C:\Windows\System\ORDqzyU.exe
  2⤵
  PID:4548
- C:\Windows\System\zDEqauP.exe
  C:\Windows\System\zDEqauP.exe
  2⤵
  PID:5124
- C:\Windows\System\QBaWlil.exe
  C:\Windows\System\QBaWlil.exe
  2⤵
  PID:5504
- C:\Windows\System\gCOdbJg.exe
  C:\Windows\System\gCOdbJg.exe
  2⤵
  PID:2056
- C:\Windows\System\FxufrWA.exe
  C:\Windows\System\FxufrWA.exe
  2⤵
  PID:5308
- C:\Windows\System\YGqbwqJ.exe
  C:\Windows\System\YGqbwqJ.exe
  2⤵
  PID:1988
- C:\Windows\System\YBeOQvM.exe
  C:\Windows\System\YBeOQvM.exe
  2⤵
  PID:6132
- C:\Windows\System\VyaRGDV.exe
  C:\Windows\System\VyaRGDV.exe
  2⤵
  PID:4304
- C:\Windows\System\MdJTIbb.exe
  C:\Windows\System\MdJTIbb.exe
  2⤵
  PID:1848
- C:\Windows\System\bRaaXPK.exe
  C:\Windows\System\bRaaXPK.exe
  2⤵
  PID:5444
- C:\Windows\System\eYXlllf.exe
  C:\Windows\System\eYXlllf.exe
  2⤵
  PID:4948
- C:\Windows\System\KKICMba.exe
  C:\Windows\System\KKICMba.exe
  2⤵
  PID:3104
- C:\Windows\System\YuTTKQf.exe
  C:\Windows\System\YuTTKQf.exe
  2⤵
  PID:3908
- C:\Windows\System\ZDrjIeP.exe
  C:\Windows\System\ZDrjIeP.exe
  2⤵
  PID:5716
- C:\Windows\System\iMwQtSv.exe
  C:\Windows\System\iMwQtSv.exe
  2⤵
  PID:5208
- C:\Windows\System\qkoWkEy.exe
  C:\Windows\System\qkoWkEy.exe
  2⤵
  PID:3936
- C:\Windows\System\fTROXpD.exe
  C:\Windows\System\fTROXpD.exe
  2⤵
  PID:2416
- C:\Windows\System\XQMOyDZ.exe
  C:\Windows\System\XQMOyDZ.exe
  2⤵
  PID:3588
- C:\Windows\System\QQBhqgm.exe
  C:\Windows\System\QQBhqgm.exe
  2⤵
  PID:3488
- C:\Windows\System\WVOBABS.exe
  C:\Windows\System\WVOBABS.exe
  2⤵
  PID:2684
- C:\Windows\System\jdKtPQx.exe
  C:\Windows\System\jdKtPQx.exe
  2⤵
  PID:5984
- C:\Windows\System\BMoebfZ.exe
  C:\Windows\System\BMoebfZ.exe
  2⤵
  PID:6084
- C:\Windows\System\pWJkxaS.exe
  C:\Windows\System\pWJkxaS.exe
  2⤵
  PID:2368
- C:\Windows\System\sdOCZsY.exe
  C:\Windows\System\sdOCZsY.exe
  2⤵
  PID:832
- C:\Windows\System\BIliLNa.exe
  C:\Windows\System\BIliLNa.exe
  2⤵
  PID:3872
- C:\Windows\System\xmGcrYt.exe
  C:\Windows\System\xmGcrYt.exe
  2⤵
  PID:2344
- C:\Windows\System\AqObMLs.exe
  C:\Windows\System\AqObMLs.exe
  2⤵
  PID:5884
- C:\Windows\System\mfxjvCm.exe
  C:\Windows\System\mfxjvCm.exe
  2⤵
  PID:5888
- C:\Windows\System\mozixzK.exe
  C:\Windows\System\mozixzK.exe
  2⤵
  PID:3904
- C:\Windows\System\KuzHpCP.exe
  C:\Windows\System\KuzHpCP.exe
  2⤵
  PID:4004
- C:\Windows\System\sNNgYiZ.exe
  C:\Windows\System\sNNgYiZ.exe
  2⤵
  PID:4880
- C:\Windows\System\zsBVyHe.exe
  C:\Windows\System\zsBVyHe.exe
  2⤵
  PID:4500
- C:\Windows\System\yHHSapt.exe
  C:\Windows\System\yHHSapt.exe
  2⤵
  PID:2560
- C:\Windows\System\ffKlXut.exe
  C:\Windows\System\ffKlXut.exe
  2⤵
  PID:2936
- C:\Windows\System\SDflPpl.exe
  C:\Windows\System\SDflPpl.exe
  2⤵
  PID:4720
- C:\Windows\System\OSYoDkH.exe
  C:\Windows\System\OSYoDkH.exe
  2⤵
  PID:5272
- C:\Windows\System\qhagJfM.exe
  C:\Windows\System\qhagJfM.exe
  2⤵
  PID:5312
- C:\Windows\System\pUITUgF.exe
  C:\Windows\System\pUITUgF.exe
  2⤵
  PID:5396
- C:\Windows\System\IQXGoal.exe
  C:\Windows\System\IQXGoal.exe
  2⤵
  PID:1772
- C:\Windows\System\MNfzRlu.exe
  C:\Windows\System\MNfzRlu.exe
  2⤵
  PID:3636
- C:\Windows\System\uSxoyva.exe
  C:\Windows\System\uSxoyva.exe
  2⤵
  PID:3236
- C:\Windows\System\oyprrFg.exe
  C:\Windows\System\oyprrFg.exe
  2⤵
  PID:2112
- C:\Windows\System\paYBIBU.exe
  C:\Windows\System\paYBIBU.exe
  2⤵
  PID:1652
- C:\Windows\System\EaNYRaX.exe
  C:\Windows\System\EaNYRaX.exe
  2⤵
  PID:6104
- C:\Windows\System\IVEVYxV.exe
  C:\Windows\System\IVEVYxV.exe
  2⤵
  PID:4560
- C:\Windows\System\ShOEoPm.exe
  C:\Windows\System\ShOEoPm.exe
  2⤵
  PID:2072
- C:\Windows\System\RhwDHJS.exe
  C:\Windows\System\RhwDHJS.exe
  2⤵
  PID:5548
- C:\Windows\System\eItxFrw.exe
  C:\Windows\System\eItxFrw.exe
  2⤵
  PID:5968
- C:\Windows\System\JJSdlTW.exe
  C:\Windows\System\JJSdlTW.exe
  2⤵
  PID:1576
- C:\Windows\System\JIKQyqm.exe
  C:\Windows\System\JIKQyqm.exe
  2⤵
  PID:5636
- C:\Windows\System\VyEumzP.exe
  C:\Windows\System\VyEumzP.exe
  2⤵
  PID:2556
- C:\Windows\System\KewZzYv.exe
  C:\Windows\System\KewZzYv.exe
  2⤵
  PID:1452
- C:\Windows\System\BbuaRnH.exe
  C:\Windows\System\BbuaRnH.exe
  2⤵
  PID:5252
- C:\Windows\System\AhvVial.exe
  C:\Windows\System\AhvVial.exe
  2⤵
  PID:4740
- C:\Windows\System\htTUJNn.exe
  C:\Windows\System\htTUJNn.exe
  2⤵
  PID:5808
- C:\Windows\System\VjuYwNG.exe
  C:\Windows\System\VjuYwNG.exe
  2⤵
  PID:5304
- C:\Windows\System\WniBYfd.exe
  C:\Windows\System\WniBYfd.exe
  2⤵
  PID:3120
- C:\Windows\System\MQQlxzC.exe
  C:\Windows\System\MQQlxzC.exe
  2⤵
  PID:1656
- C:\Windows\System\lTUvVRZ.exe
  C:\Windows\System\lTUvVRZ.exe
  2⤵
  PID:4432
- C:\Windows\System\IQZzejg.exe
  C:\Windows\System\IQZzejg.exe
  2⤵
  PID:5472
- C:\Windows\System\mfGgOpN.exe
  C:\Windows\System\mfGgOpN.exe
  2⤵
  PID:3396
- C:\Windows\System\GKAzFvP.exe
  C:\Windows\System\GKAzFvP.exe
  2⤵
  PID:4176
- C:\Windows\System\VLMejNp.exe
  C:\Windows\System\VLMejNp.exe
  2⤵
  PID:5104
- C:\Windows\System\eKGGOzR.exe
  C:\Windows\System\eKGGOzR.exe
  2⤵
  PID:2792
- C:\Windows\System\UCJYDsd.exe
  C:\Windows\System\UCJYDsd.exe
  2⤵
  PID:4628
- C:\Windows\System\KmrWJaA.exe
  C:\Windows\System\KmrWJaA.exe
  2⤵
  PID:6160
- C:\Windows\System\UUvHBWt.exe
  C:\Windows\System\UUvHBWt.exe
  2⤵
  PID:6176
- C:\Windows\System\eiTFqlr.exe
  C:\Windows\System\eiTFqlr.exe
  2⤵
  PID:6192
- C:\Windows\System\YDOhVxF.exe
  C:\Windows\System\YDOhVxF.exe
  2⤵
  PID:6208
- C:\Windows\System\SqnEknc.exe
  C:\Windows\System\SqnEknc.exe
  2⤵
  PID:6224
- C:\Windows\System\DbFsPsU.exe
  C:\Windows\System\DbFsPsU.exe
  2⤵
  PID:6240
- C:\Windows\System\SkDeYpO.exe
  C:\Windows\System\SkDeYpO.exe
  2⤵
  PID:6256
- C:\Windows\System\vVbxkqJ.exe
  C:\Windows\System\vVbxkqJ.exe
  2⤵
  PID:6272
- C:\Windows\System\ABqlnIu.exe
  C:\Windows\System\ABqlnIu.exe
  2⤵
  PID:6288
- C:\Windows\System\nQvnKeY.exe
  C:\Windows\System\nQvnKeY.exe
  2⤵
  PID:6304
- C:\Windows\System\IucmutO.exe
  C:\Windows\System\IucmutO.exe
  2⤵
  PID:6320
- C:\Windows\System\AcaNZLh.exe
  C:\Windows\System\AcaNZLh.exe
  2⤵
  PID:6336
- C:\Windows\System\qSZVbdi.exe
  C:\Windows\System\qSZVbdi.exe
  2⤵
  PID:6352
- C:\Windows\System\GDgYeLi.exe
  C:\Windows\System\GDgYeLi.exe
  2⤵
  PID:6368
- C:\Windows\System\xVdWuBR.exe
  C:\Windows\System\xVdWuBR.exe
  2⤵
  PID:6384
- C:\Windows\System\MeCBLbS.exe
  C:\Windows\System\MeCBLbS.exe
  2⤵
  PID:6400
- C:\Windows\System\RsyWFsh.exe
  C:\Windows\System\RsyWFsh.exe
  2⤵
  PID:6416
- C:\Windows\System\vyIDZiN.exe
  C:\Windows\System\vyIDZiN.exe
  2⤵
  PID:6432
- C:\Windows\System\DuBgxMD.exe
  C:\Windows\System\DuBgxMD.exe
  2⤵
  PID:6448
- C:\Windows\System\CWYNIEo.exe
  C:\Windows\System\CWYNIEo.exe
  2⤵
  PID:6464
- C:\Windows\System\hvrEdJW.exe
  C:\Windows\System\hvrEdJW.exe
  2⤵
  PID:6480
- C:\Windows\System\hUFseFE.exe
  C:\Windows\System\hUFseFE.exe
  2⤵
  PID:6496
- C:\Windows\System\ULCWQhR.exe
  C:\Windows\System\ULCWQhR.exe
  2⤵
  PID:6512
- C:\Windows\System\kSbRsiF.exe
  C:\Windows\System\kSbRsiF.exe
  2⤵
  PID:6528
- C:\Windows\System\QXrRedv.exe
  C:\Windows\System\QXrRedv.exe
  2⤵
  PID:6544
- C:\Windows\System\vdKNXqy.exe
  C:\Windows\System\vdKNXqy.exe
  2⤵
  PID:6560
- C:\Windows\System\PkMLBwp.exe
  C:\Windows\System\PkMLBwp.exe
  2⤵
  PID:6576
- C:\Windows\System\DDFDckE.exe
  C:\Windows\System\DDFDckE.exe
  2⤵
  PID:6592
- C:\Windows\System\XilJSkK.exe
  C:\Windows\System\XilJSkK.exe
  2⤵
  PID:6608
- C:\Windows\System\ZjNlyYB.exe
  C:\Windows\System\ZjNlyYB.exe
  2⤵
  PID:6624
- C:\Windows\System\bXvhFoS.exe
  C:\Windows\System\bXvhFoS.exe
  2⤵
  PID:6640
- C:\Windows\System\QWUmvOq.exe
  C:\Windows\System\QWUmvOq.exe
  2⤵
  PID:6656
- C:\Windows\System\fXETUBm.exe
  C:\Windows\System\fXETUBm.exe
  2⤵
  PID:6672
- C:\Windows\System\uOKrznt.exe
  C:\Windows\System\uOKrznt.exe
  2⤵
  PID:6688
- C:\Windows\System\kObIqEY.exe
  C:\Windows\System\kObIqEY.exe
  2⤵
  PID:6704
- C:\Windows\System\tnwYXEY.exe
  C:\Windows\System\tnwYXEY.exe
  2⤵
  PID:6720
- C:\Windows\System\ljRzvcm.exe
  C:\Windows\System\ljRzvcm.exe
  2⤵
  PID:6736
- C:\Windows\System\wgpORBB.exe
  C:\Windows\System\wgpORBB.exe
  2⤵
  PID:6752
- C:\Windows\System\fyMzavQ.exe
  C:\Windows\System\fyMzavQ.exe
  2⤵
  PID:6768
- C:\Windows\System\XdMKaTP.exe
  C:\Windows\System\XdMKaTP.exe
  2⤵
  PID:6788
- C:\Windows\System\jJSOPqf.exe
  C:\Windows\System\jJSOPqf.exe
  2⤵
  PID:6804
- C:\Windows\System\saQynSm.exe
  C:\Windows\System\saQynSm.exe
  2⤵
  PID:6820
- C:\Windows\System\GrdGpzb.exe
  C:\Windows\System\GrdGpzb.exe
  2⤵
  PID:6836
- C:\Windows\System\HmnbmzY.exe
  C:\Windows\System\HmnbmzY.exe
  2⤵
  PID:6852
- C:\Windows\System\nJiPtrA.exe
  C:\Windows\System\nJiPtrA.exe
  2⤵
  PID:6868
- C:\Windows\System\QgxTPXc.exe
  C:\Windows\System\QgxTPXc.exe
  2⤵
  PID:6884
- C:\Windows\System\dHNGnqi.exe
  C:\Windows\System\dHNGnqi.exe
  2⤵
  PID:6900
- C:\Windows\System\fKetRkC.exe
  C:\Windows\System\fKetRkC.exe
  2⤵
  PID:6916
- C:\Windows\System\geDyDBi.exe
  C:\Windows\System\geDyDBi.exe
  2⤵
  PID:6932
- C:\Windows\System\foeFaPp.exe
  C:\Windows\System\foeFaPp.exe
  2⤵
  PID:6948
- C:\Windows\System\mLhckMC.exe
  C:\Windows\System\mLhckMC.exe
  2⤵
  PID:6964
- C:\Windows\System\ORWfzdd.exe
  C:\Windows\System\ORWfzdd.exe
  2⤵
  PID:6980
- C:\Windows\System\KGWqTrE.exe
  C:\Windows\System\KGWqTrE.exe
  2⤵
  PID:6996
- C:\Windows\System\ONGKoqR.exe
  C:\Windows\System\ONGKoqR.exe
  2⤵
  PID:7012
- C:\Windows\System\osnXZlg.exe
  C:\Windows\System\osnXZlg.exe
  2⤵
  PID:7028
- C:\Windows\System\nlkkNga.exe
  C:\Windows\System\nlkkNga.exe
  2⤵
  PID:7044
- C:\Windows\System\lFnzkkW.exe
  C:\Windows\System\lFnzkkW.exe
  2⤵
  PID:7060
- C:\Windows\System\OpxQbSB.exe
  C:\Windows\System\OpxQbSB.exe
  2⤵
  PID:7076
- C:\Windows\System\mfDVuYT.exe
  C:\Windows\System\mfDVuYT.exe
  2⤵
  PID:7092
- C:\Windows\System\EgdAMaj.exe
  C:\Windows\System\EgdAMaj.exe
  2⤵
  PID:7108
- C:\Windows\System\InlCfTJ.exe
  C:\Windows\System\InlCfTJ.exe
  2⤵
  PID:7124
- C:\Windows\System\gFgkNsv.exe
  C:\Windows\System\gFgkNsv.exe
  2⤵
  PID:7140
- C:\Windows\System\yeVkaxJ.exe
  C:\Windows\System\yeVkaxJ.exe
  2⤵
  PID:7156
- C:\Windows\System\EqJzmnl.exe
  C:\Windows\System\EqJzmnl.exe
  2⤵
  PID:2284
- C:\Windows\System\jrNCLwB.exe
  C:\Windows\System\jrNCLwB.exe
  2⤵
  PID:5948
- C:\Windows\System\EYdFiCk.exe
  C:\Windows\System\EYdFiCk.exe
  2⤵
  PID:6156
- C:\Windows\System\jmftMya.exe
  C:\Windows\System\jmftMya.exe
  2⤵
  PID:488
- C:\Windows\System\HyHigXR.exe
  C:\Windows\System\HyHigXR.exe
  2⤵
  PID:6248
- C:\Windows\System\LcdLhjD.exe
  C:\Windows\System\LcdLhjD.exe
  2⤵
  PID:6168
- C:\Windows\System\sNviHJZ.exe
  C:\Windows\System\sNviHJZ.exe
  2⤵
  PID:6200
- C:\Windows\System\rHAqYON.exe
  C:\Windows\System\rHAqYON.exe
  2⤵
  PID:6268
- C:\Windows\System\PojTXjg.exe
  C:\Windows\System\PojTXjg.exe
  2⤵
  PID:6296
- C:\Windows\System\JIozDuy.exe
  C:\Windows\System\JIozDuy.exe
  2⤵
  PID:6364
- C:\Windows\System\DWXnUnf.exe
  C:\Windows\System\DWXnUnf.exe
  2⤵
  PID:6456
- C:\Windows\System\zILGDgm.exe
  C:\Windows\System\zILGDgm.exe
  2⤵
  PID:6344
- C:\Windows\System\cvyeOtC.exe
  C:\Windows\System\cvyeOtC.exe
  2⤵
  PID:6408
- C:\Windows\System\SeEKUKH.exe
  C:\Windows\System\SeEKUKH.exe
  2⤵
  PID:6488
- C:\Windows\System\sxzEjhG.exe
  C:\Windows\System\sxzEjhG.exe
  2⤵
  PID:6492
- C:\Windows\System\lcjNAOP.exe
  C:\Windows\System\lcjNAOP.exe
  2⤵
  PID:6536
- C:\Windows\System\HQdHNuG.exe
  C:\Windows\System\HQdHNuG.exe
  2⤵
  PID:6552
- C:\Windows\System\Wsqajqa.exe
  C:\Windows\System\Wsqajqa.exe
  2⤵
  PID:6588
- C:\Windows\System\SBAzmsP.exe
  C:\Windows\System\SBAzmsP.exe
  2⤵
  PID:6604
- C:\Windows\System\hmHrfEB.exe
  C:\Windows\System\hmHrfEB.exe
  2⤵
  PID:6668
- C:\Windows\System\rcULLoi.exe
  C:\Windows\System\rcULLoi.exe
  2⤵
  PID:6652
- C:\Windows\System\TTKjxmG.exe
  C:\Windows\System\TTKjxmG.exe
  2⤵
  PID:6744
- C:\Windows\System\jxPkPQS.exe
  C:\Windows\System\jxPkPQS.exe
  2⤵
  PID:6732
- C:\Windows\System\pKHModU.exe
  C:\Windows\System\pKHModU.exe
  2⤵
  PID:6796
- C:\Windows\System\YQTMYEY.exe
  C:\Windows\System\YQTMYEY.exe
  2⤵
  PID:6860
- C:\Windows\System\giXqQia.exe
  C:\Windows\System\giXqQia.exe
  2⤵
  PID:6876
- C:\Windows\System\uyPuwbz.exe
  C:\Windows\System\uyPuwbz.exe
  2⤵
  PID:6908
- C:\Windows\System\almALYN.exe
  C:\Windows\System\almALYN.exe
  2⤵
  PID:6896
- C:\Windows\System\LWotBMs.exe
  C:\Windows\System\LWotBMs.exe
  2⤵
  PID:6960
- C:\Windows\System\ggAhUKc.exe
  C:\Windows\System\ggAhUKc.exe
  2⤵
  PID:7004
- C:\Windows\System\HYHCkox.exe
  C:\Windows\System\HYHCkox.exe
  2⤵
  PID:7036
- C:\Windows\System\vTxrVsx.exe
  C:\Windows\System\vTxrVsx.exe
  2⤵
  PID:7100
- C:\Windows\System\pAUinDL.exe
  C:\Windows\System\pAUinDL.exe
  2⤵
  PID:7052
- C:\Windows\System\deJpQtw.exe
  C:\Windows\System\deJpQtw.exe
  2⤵
  PID:7084
- C:\Windows\System\eXmeycf.exe
  C:\Windows\System\eXmeycf.exe
  2⤵
  PID:3876
- C:\Windows\System\bVREkeu.exe
  C:\Windows\System\bVREkeu.exe
  2⤵
  PID:768
- C:\Windows\System\nrQFXXz.exe
  C:\Windows\System\nrQFXXz.exe
  2⤵
  PID:7152
- C:\Windows\System\XkrdXQS.exe
  C:\Windows\System\XkrdXQS.exe
  2⤵
  PID:6236
- C:\Windows\System\ymTijdb.exe
  C:\Windows\System\ymTijdb.exe
  2⤵
  PID:6220
- C:\Windows\System\ZvWmZHl.exe
  C:\Windows\System\ZvWmZHl.exe
  2⤵
  PID:6460
- C:\Windows\System\OIOQRYJ.exe
  C:\Windows\System\OIOQRYJ.exe
  2⤵
  PID:6556
- C:\Windows\System\cMhUWtp.exe
  C:\Windows\System\cMhUWtp.exe
  2⤵
  PID:6716
- C:\Windows\System\OCclQSH.exe
  C:\Windows\System\OCclQSH.exe
  2⤵
  PID:6428
- C:\Windows\System\iDnJRZA.exe
  C:\Windows\System\iDnJRZA.exe
  2⤵
  PID:6784
- C:\Windows\System\FkvKRMO.exe
  C:\Windows\System\FkvKRMO.exe
  2⤵
  PID:6848
- C:\Windows\System\bhnxueQ.exe
  C:\Windows\System\bhnxueQ.exe
  2⤵
  PID:6392
- C:\Windows\System\tqNrIZS.exe
  C:\Windows\System\tqNrIZS.exe
  2⤵
  PID:6380
- C:\Windows\System\IGVaiEM.exe
  C:\Windows\System\IGVaiEM.exe
  2⤵
  PID:6992
- C:\Windows\System\bGwxeqy.exe
  C:\Windows\System\bGwxeqy.exe
  2⤵
  PID:6620
- C:\Windows\System\xnLIzZb.exe
  C:\Windows\System\xnLIzZb.exe
  2⤵
  PID:6776
- C:\Windows\System\iwomMSC.exe
  C:\Windows\System\iwomMSC.exe
  2⤵
  PID:7040
- C:\Windows\System\gLYjRRe.exe
  C:\Windows\System\gLYjRRe.exe
  2⤵
  PID:7120
- C:\Windows\System\kUEmzCr.exe
  C:\Windows\System\kUEmzCr.exe
  2⤵
  PID:5344
- C:\Windows\System\ucNglYJ.exe
  C:\Windows\System\ucNglYJ.exe
  2⤵
  PID:5596
- C:\Windows\System\ZXUMnAH.exe
  C:\Windows\System\ZXUMnAH.exe
  2⤵
  PID:6312
- C:\Windows\System\OqocIRc.exe
  C:\Windows\System\OqocIRc.exe
  2⤵
  PID:6172
- C:\Windows\System\DHGTRHU.exe
  C:\Windows\System\DHGTRHU.exe
  2⤵
  PID:6760
- C:\Windows\System\xAYIeiP.exe
  C:\Windows\System\xAYIeiP.exe
  2⤵
  PID:6280
- C:\Windows\System\aEWjnMv.exe
  C:\Windows\System\aEWjnMv.exe
  2⤵
  PID:6972
- C:\Windows\System\NxAbdWv.exe
  C:\Windows\System\NxAbdWv.exe
  2⤵
  PID:6812
- C:\Windows\System\eukiQuZ.exe
  C:\Windows\System\eukiQuZ.exe
  2⤵
  PID:6616
- C:\Windows\System\xRqDaPf.exe
  C:\Windows\System\xRqDaPf.exe
  2⤵
  PID:6152
- C:\Windows\System\JRAZSnh.exe
  C:\Windows\System\JRAZSnh.exe
  2⤵
  PID:7136
- C:\Windows\System\ieuzvrO.exe
  C:\Windows\System\ieuzvrO.exe
  2⤵
  PID:6376
- C:\Windows\System\FSgJEvT.exe
  C:\Windows\System\FSgJEvT.exe
  2⤵
  PID:6892
- C:\Windows\System\KUJGpzA.exe
  C:\Windows\System\KUJGpzA.exe
  2⤵
  PID:7180
- C:\Windows\System\AJnOlIR.exe
  C:\Windows\System\AJnOlIR.exe
  2⤵
  PID:7196
- C:\Windows\System\pEmZqkb.exe
  C:\Windows\System\pEmZqkb.exe
  2⤵
  PID:7212
- C:\Windows\System\iedlFMb.exe
  C:\Windows\System\iedlFMb.exe
  2⤵
  PID:7228
- C:\Windows\System\jWDMgmT.exe
  C:\Windows\System\jWDMgmT.exe
  2⤵
  PID:7244
- C:\Windows\System\WxgEKMv.exe
  C:\Windows\System\WxgEKMv.exe
  2⤵
  PID:7260
- C:\Windows\System\rXWfNeb.exe
  C:\Windows\System\rXWfNeb.exe
  2⤵
  PID:7276
- C:\Windows\System\VSWpDhs.exe
  C:\Windows\System\VSWpDhs.exe
  2⤵
  PID:7292
- C:\Windows\System\JattmhP.exe
  C:\Windows\System\JattmhP.exe
  2⤵
  PID:7308
- C:\Windows\System\gZnIYXB.exe
  C:\Windows\System\gZnIYXB.exe
  2⤵
  PID:7324
- C:\Windows\System\USAOdFf.exe
  C:\Windows\System\USAOdFf.exe
  2⤵
  PID:7340
- C:\Windows\System\swrgIhl.exe
  C:\Windows\System\swrgIhl.exe
  2⤵
  PID:7356
- C:\Windows\System\KbHQbfH.exe
  C:\Windows\System\KbHQbfH.exe
  2⤵
  PID:7372
- C:\Windows\System\LLgNDMf.exe
  C:\Windows\System\LLgNDMf.exe
  2⤵
  PID:7388
- C:\Windows\System\wwyGNxY.exe
  C:\Windows\System\wwyGNxY.exe
  2⤵
  PID:7404
- C:\Windows\System\sqfpADr.exe
  C:\Windows\System\sqfpADr.exe
  2⤵
  PID:7424
- C:\Windows\System\EGFCBlD.exe
  C:\Windows\System\EGFCBlD.exe
  2⤵
  PID:7440
- C:\Windows\System\MmxioIL.exe
  C:\Windows\System\MmxioIL.exe
  2⤵
  PID:7456
- C:\Windows\System\qBYqYWT.exe
  C:\Windows\System\qBYqYWT.exe
  2⤵
  PID:7472
- C:\Windows\System\tonAbHf.exe
  C:\Windows\System\tonAbHf.exe
  2⤵
  PID:7488
- C:\Windows\System\CLtxjew.exe
  C:\Windows\System\CLtxjew.exe
  2⤵
  PID:7504
- C:\Windows\System\fJgoQRZ.exe
  C:\Windows\System\fJgoQRZ.exe
  2⤵
  PID:7520
- C:\Windows\System\dfVMeAx.exe
  C:\Windows\System\dfVMeAx.exe
  2⤵
  PID:7536
- C:\Windows\System\nRGnowc.exe
  C:\Windows\System\nRGnowc.exe
  2⤵
  PID:7552
- C:\Windows\System\GNNAOkl.exe
  C:\Windows\System\GNNAOkl.exe
  2⤵
  PID:7568
- C:\Windows\System\UfFEGsb.exe
  C:\Windows\System\UfFEGsb.exe
  2⤵
  PID:7584
- C:\Windows\System\CsGkIdV.exe
  C:\Windows\System\CsGkIdV.exe
  2⤵
  PID:7600
- C:\Windows\System\qbQmwkC.exe
  C:\Windows\System\qbQmwkC.exe
  2⤵
  PID:7616
- C:\Windows\System\pyXvUyF.exe
  C:\Windows\System\pyXvUyF.exe
  2⤵
  PID:7632
- C:\Windows\System\GsTQRQd.exe
  C:\Windows\System\GsTQRQd.exe
  2⤵
  PID:7648
- C:\Windows\System\rwsvrva.exe
  C:\Windows\System\rwsvrva.exe
  2⤵
  PID:7664
- C:\Windows\System\HBSPUyZ.exe
  C:\Windows\System\HBSPUyZ.exe
  2⤵
  PID:7680
- C:\Windows\System\cpQonGr.exe
  C:\Windows\System\cpQonGr.exe
  2⤵
  PID:7696
- C:\Windows\System\VwDUJkj.exe
  C:\Windows\System\VwDUJkj.exe
  2⤵
  PID:7712
- C:\Windows\System\YvlRegg.exe
  C:\Windows\System\YvlRegg.exe
  2⤵
  PID:7728
- C:\Windows\System\GzrdFSs.exe
  C:\Windows\System\GzrdFSs.exe
  2⤵
  PID:7744
- C:\Windows\System\iVShpHg.exe
  C:\Windows\System\iVShpHg.exe
  2⤵
  PID:7760
- C:\Windows\System\hAeuDmZ.exe
  C:\Windows\System\hAeuDmZ.exe
  2⤵
  PID:7776
- C:\Windows\System\DWVaVfY.exe
  C:\Windows\System\DWVaVfY.exe
  2⤵
  PID:7792
- C:\Windows\System\LpuasLr.exe
  C:\Windows\System\LpuasLr.exe
  2⤵
  PID:7808
- C:\Windows\System\yVfzxtp.exe
  C:\Windows\System\yVfzxtp.exe
  2⤵
  PID:7824
- C:\Windows\System\ccRWrSa.exe
  C:\Windows\System\ccRWrSa.exe
  2⤵
  PID:7840
- C:\Windows\System\ImEvoQZ.exe
  C:\Windows\System\ImEvoQZ.exe
  2⤵
  PID:7856
- C:\Windows\System\qLQoPYu.exe
  C:\Windows\System\qLQoPYu.exe
  2⤵
  PID:7872
- C:\Windows\System\qDxViZX.exe
  C:\Windows\System\qDxViZX.exe
  2⤵
  PID:7888
- C:\Windows\System\fzvEUhx.exe
  C:\Windows\System\fzvEUhx.exe
  2⤵
  PID:7904
- C:\Windows\System\LLOEnhT.exe
  C:\Windows\System\LLOEnhT.exe
  2⤵
  PID:7920
- C:\Windows\System\xwVWCBf.exe
  C:\Windows\System\xwVWCBf.exe
  2⤵
  PID:7936
- C:\Windows\System\kPFXGzd.exe
  C:\Windows\System\kPFXGzd.exe
  2⤵
  PID:7952
- C:\Windows\System\stOyDIN.exe
  C:\Windows\System\stOyDIN.exe
  2⤵
  PID:7968
- C:\Windows\System\HOCKerb.exe
  C:\Windows\System\HOCKerb.exe
  2⤵
  PID:7984
- C:\Windows\System\xMiYDPz.exe
  C:\Windows\System\xMiYDPz.exe
  2⤵
  PID:8004
- C:\Windows\System\LsNFanB.exe
  C:\Windows\System\LsNFanB.exe
  2⤵
  PID:8020
- C:\Windows\System\qNlyeIq.exe
  C:\Windows\System\qNlyeIq.exe
  2⤵
  PID:8036
- C:\Windows\System\EZGnBDf.exe
  C:\Windows\System\EZGnBDf.exe
  2⤵
  PID:8052
- C:\Windows\System\wrSytHi.exe
  C:\Windows\System\wrSytHi.exe
  2⤵
  PID:8068
- C:\Windows\System\ZejCslk.exe
  C:\Windows\System\ZejCslk.exe
  2⤵
  PID:8084
- C:\Windows\System\SzMVMAI.exe
  C:\Windows\System\SzMVMAI.exe
  2⤵
  PID:8100
- C:\Windows\System\fOjeARz.exe
  C:\Windows\System\fOjeARz.exe
  2⤵
  PID:8116
- C:\Windows\System\cJcKhxB.exe
  C:\Windows\System\cJcKhxB.exe
  2⤵
  PID:8132
- C:\Windows\System\ZwcCHVa.exe
  C:\Windows\System\ZwcCHVa.exe
  2⤵
  PID:8148
- C:\Windows\System\XhGLrYk.exe
  C:\Windows\System\XhGLrYk.exe
  2⤵
  PID:8164
- C:\Windows\System\eYXURcz.exe
  C:\Windows\System\eYXURcz.exe
  2⤵
  PID:8180
- C:\Windows\System\QduDqEp.exe
  C:\Windows\System\QduDqEp.exe
  2⤵
  PID:7176
- C:\Windows\System\GwXubnC.exe
  C:\Windows\System\GwXubnC.exe
  2⤵
  PID:6568
- C:\Windows\System\zkWZGit.exe
  C:\Windows\System\zkWZGit.exe
  2⤵
  PID:6508
- C:\Windows\System\AKUmcXD.exe
  C:\Windows\System\AKUmcXD.exe
  2⤵
  PID:7188
- C:\Windows\System\kPDePYP.exe
  C:\Windows\System\kPDePYP.exe
  2⤵
  PID:7224
- C:\Windows\System\byLTpdj.exe
  C:\Windows\System\byLTpdj.exe
  2⤵
  PID:7256
- C:\Windows\System\KxbzADF.exe
  C:\Windows\System\KxbzADF.exe
  2⤵
  PID:7300
- C:\Windows\System\WoBLkxA.exe
  C:\Windows\System\WoBLkxA.exe
  2⤵
  PID:7364
- C:\Windows\System\QTwHZQI.exe
  C:\Windows\System\QTwHZQI.exe
  2⤵
  PID:7380
- C:\Windows\System\GnoUppN.exe
  C:\Windows\System\GnoUppN.exe
  2⤵
  PID:7348
- C:\Windows\System\nVQcOKm.exe
  C:\Windows\System\nVQcOKm.exe
  2⤵
  PID:2036
- C:\Windows\System\qTkHWul.exe
  C:\Windows\System\qTkHWul.exe
  2⤵
  PID:7464
- C:\Windows\System\zpMNotK.exe
  C:\Windows\System\zpMNotK.exe
  2⤵
  PID:7528
- C:\Windows\System\NVjpHjF.exe
  C:\Windows\System\NVjpHjF.exe
  2⤵
  PID:7592
- C:\Windows\System\gbLdfMU.exe
  C:\Windows\System\gbLdfMU.exe
  2⤵
  PID:7656
- C:\Windows\System\ylxIrXX.exe
  C:\Windows\System\ylxIrXX.exe
  2⤵
  PID:7720
- C:\Windows\System\qizYWQY.exe
  C:\Windows\System\qizYWQY.exe
  2⤵
  PID:7756
- C:\Windows\System\XEGWKZp.exe
  C:\Windows\System\XEGWKZp.exe
  2⤵
  PID:7548
- C:\Windows\System\CfyqUoV.exe
  C:\Windows\System\CfyqUoV.exe
  2⤵
  PID:7740
- C:\Windows\System\wUbeFAq.exe
  C:\Windows\System\wUbeFAq.exe
  2⤵
  PID:7820
- C:\Windows\System\ukMmBFa.exe
  C:\Windows\System\ukMmBFa.exe
  2⤵
  PID:7640
- C:\Windows\System\AmxRWJB.exe
  C:\Windows\System\AmxRWJB.exe
  2⤵
  PID:7804
- C:\Windows\System\NcEhZfI.exe
  C:\Windows\System\NcEhZfI.exe
  2⤵
  PID:7768
- C:\Windows\System\EkzOZuh.exe
  C:\Windows\System\EkzOZuh.exe
  2⤵
  PID:7880
- C:\Windows\System\apHvMYp.exe
  C:\Windows\System\apHvMYp.exe
  2⤵
  PID:7836
- C:\Windows\System\GnOlIIR.exe
  C:\Windows\System\GnOlIIR.exe
  2⤵
  PID:7912
- C:\Windows\System\xVXpKMp.exe
  C:\Windows\System\xVXpKMp.exe
  2⤵
  PID:7976
- C:\Windows\System\wfEhBfK.exe
  C:\Windows\System\wfEhBfK.exe
  2⤵
  PID:7900
- C:\Windows\System\KFwFozA.exe
  C:\Windows\System\KFwFozA.exe
  2⤵
  PID:7964
- C:\Windows\System\lpTXqqU.exe
  C:\Windows\System\lpTXqqU.exe
  2⤵
  PID:8048
- C:\Windows\System\EATdCZz.exe
  C:\Windows\System\EATdCZz.exe
  2⤵
  PID:8112
- C:\Windows\System\eHflSBJ.exe
  C:\Windows\System\eHflSBJ.exe
  2⤵
  PID:8064
- C:\Windows\System\zBrvsVb.exe
  C:\Windows\System\zBrvsVb.exe
  2⤵
  PID:8144
- C:\Windows\System\lCuSDdy.exe
  C:\Windows\System\lCuSDdy.exe
  2⤵
  PID:8124
- C:\Windows\System\wPsUDDT.exe
  C:\Windows\System\wPsUDDT.exe
  2⤵
  PID:8188
- C:\Windows\System\GlvRwso.exe
  C:\Windows\System\GlvRwso.exe
  2⤵
  PID:6332
- C:\Windows\System\ctsvkEw.exe
  C:\Windows\System\ctsvkEw.exe
  2⤵
  PID:7240
- C:\Windows\System\ofBPktY.exe
  C:\Windows\System\ofBPktY.exe
  2⤵
  PID:7268
- C:\Windows\System\SpRWgEQ.exe
  C:\Windows\System\SpRWgEQ.exe
  2⤵
  PID:7336
- C:\Windows\System\hakFTWe.exe
  C:\Windows\System\hakFTWe.exe
  2⤵
  PID:7396
- C:\Windows\System\NGRxbyV.exe
  C:\Windows\System\NGRxbyV.exe
  2⤵
  PID:7560
- C:\Windows\System\SWQxIFF.exe
  C:\Windows\System\SWQxIFF.exe
  2⤵
  PID:6780
- C:\Windows\System\KCytTow.exe
  C:\Windows\System\KCytTow.exe
  2⤵
  PID:7624
- C:\Windows\System\DIHCXkX.exe
  C:\Windows\System\DIHCXkX.exe
  2⤵
  PID:7512
- C:\Windows\System\LHRfxEZ.exe
  C:\Windows\System\LHRfxEZ.exe
  2⤵
  PID:7576
- C:\Windows\System\aKHiTCN.exe
  C:\Windows\System\aKHiTCN.exe
  2⤵
  PID:7928
- C:\Windows\System\zHUBTRA.exe
  C:\Windows\System\zHUBTRA.exe
  2⤵
  PID:7484
- C:\Windows\System\RYvIuBm.exe
  C:\Windows\System\RYvIuBm.exe
  2⤵
  PID:7800
- C:\Windows\System\oKdCOtB.exe
  C:\Windows\System\oKdCOtB.exe
  2⤵
  PID:7944
- C:\Windows\System\hCVhWiP.exe
  C:\Windows\System\hCVhWiP.exe
  2⤵
  PID:7996
- C:\Windows\System\KvCjMtP.exe
  C:\Windows\System\KvCjMtP.exe
  2⤵
  PID:8080
- C:\Windows\System\YQSxzSo.exe
  C:\Windows\System\YQSxzSo.exe
  2⤵
  PID:8128
- C:\Windows\System\ONUsSLZ.exe
  C:\Windows\System\ONUsSLZ.exe
  2⤵
  PID:6636
- C:\Windows\System\CVmUYen.exe
  C:\Windows\System\CVmUYen.exe
  2⤵
  PID:7208
- C:\Windows\System\kKgsQQq.exe
  C:\Windows\System\kKgsQQq.exe
  2⤵
  PID:7320
- C:\Windows\System\KBoRrxg.exe
  C:\Windows\System\KBoRrxg.exe
  2⤵
  PID:7784
- C:\Windows\System\CvdVhcZ.exe
  C:\Windows\System\CvdVhcZ.exe
  2⤵
  PID:7500
- C:\Windows\System\UvKzyhf.exe
  C:\Windows\System\UvKzyhf.exe
  2⤵
  PID:7708
- C:\Windows\System\WgjQqLL.exe
  C:\Windows\System\WgjQqLL.exe
  2⤵
  PID:8044
- C:\Windows\System\tWRZHSZ.exe
  C:\Windows\System\tWRZHSZ.exe
  2⤵
  PID:7752
- C:\Windows\System\VekQIsL.exe
  C:\Windows\System\VekQIsL.exe
  2⤵
  PID:7672
- C:\Windows\System\RISvpaB.exe
  C:\Windows\System\RISvpaB.exe
  2⤵
  PID:8096
- C:\Windows\System\YgeMIeA.exe
  C:\Windows\System\YgeMIeA.exe
  2⤵
  PID:7688
- C:\Windows\System\JzJblXm.exe
  C:\Windows\System\JzJblXm.exe
  2⤵
  PID:7436
- C:\Windows\System\IWuGsyj.exe
  C:\Windows\System\IWuGsyj.exe
  2⤵
  PID:7816
- C:\Windows\System\wDZfMIa.exe
  C:\Windows\System\wDZfMIa.exe
  2⤵
  PID:7868
- C:\Windows\System\FXRKIDk.exe
  C:\Windows\System\FXRKIDk.exe
  2⤵
  PID:7416
- C:\Windows\System\CPUCubh.exe
  C:\Windows\System\CPUCubh.exe
  2⤵
  PID:8032
- C:\Windows\System\ipepbUu.exe
  C:\Windows\System\ipepbUu.exe
  2⤵
  PID:8196
- C:\Windows\System\vnqVbuR.exe
  C:\Windows\System\vnqVbuR.exe
  2⤵
  PID:8212
- C:\Windows\System\AjINmkU.exe
  C:\Windows\System\AjINmkU.exe
  2⤵
  PID:8228
- C:\Windows\System\WOZNlQX.exe
  C:\Windows\System\WOZNlQX.exe
  2⤵
  PID:8244
- C:\Windows\System\lPpSMkV.exe
  C:\Windows\System\lPpSMkV.exe
  2⤵
  PID:8260
- C:\Windows\System\hXizXOw.exe
  C:\Windows\System\hXizXOw.exe
  2⤵
  PID:8276
- C:\Windows\System\bnWTVEJ.exe
  C:\Windows\System\bnWTVEJ.exe
  2⤵
  PID:8292
- C:\Windows\System\vvvoutj.exe
  C:\Windows\System\vvvoutj.exe
  2⤵
  PID:8308
- C:\Windows\System\eUNbeIr.exe
  C:\Windows\System\eUNbeIr.exe
  2⤵
  PID:8324
- C:\Windows\System\IEYMtGO.exe
  C:\Windows\System\IEYMtGO.exe
  2⤵
  PID:8340
- C:\Windows\System\vvtyyxm.exe
  C:\Windows\System\vvtyyxm.exe
  2⤵
  PID:8356
- C:\Windows\System\goNZihQ.exe
  C:\Windows\System\goNZihQ.exe
  2⤵
  PID:8372
- C:\Windows\System\WJWaHnC.exe
  C:\Windows\System\WJWaHnC.exe
  2⤵
  PID:8388
- C:\Windows\System\gJmjDqs.exe
  C:\Windows\System\gJmjDqs.exe
  2⤵
  PID:8404
- C:\Windows\System\ICDlerv.exe
  C:\Windows\System\ICDlerv.exe
  2⤵
  PID:8420
- C:\Windows\System\bdoFpsy.exe
  C:\Windows\System\bdoFpsy.exe
  2⤵
  PID:8436
- C:\Windows\System\uFAHgKo.exe
  C:\Windows\System\uFAHgKo.exe
  2⤵
  PID:8452
- C:\Windows\System\mpeHvXJ.exe
  C:\Windows\System\mpeHvXJ.exe
  2⤵
  PID:8468
- C:\Windows\System\EzHRxGI.exe
  C:\Windows\System\EzHRxGI.exe
  2⤵
  PID:8484
- C:\Windows\System\kHJjzHk.exe
  C:\Windows\System\kHJjzHk.exe
  2⤵
  PID:8500
- C:\Windows\System\sgbibtS.exe
  C:\Windows\System\sgbibtS.exe
  2⤵
  PID:8516
- C:\Windows\System\jwSXBlN.exe
  C:\Windows\System\jwSXBlN.exe
  2⤵
  PID:8532
- C:\Windows\System\zBKbMqa.exe
  C:\Windows\System\zBKbMqa.exe
  2⤵
  PID:8552
- C:\Windows\System\XBFROKT.exe
  C:\Windows\System\XBFROKT.exe
  2⤵
  PID:8572
- C:\Windows\System\ZcpLOwg.exe
  C:\Windows\System\ZcpLOwg.exe
  2⤵
  PID:8588
- C:\Windows\System\JyEGFpC.exe
  C:\Windows\System\JyEGFpC.exe
  2⤵
  PID:8604
- C:\Windows\System\DyJLWox.exe
  C:\Windows\System\DyJLWox.exe
  2⤵
  PID:8620
- C:\Windows\System\ZijKrGw.exe
  C:\Windows\System\ZijKrGw.exe
  2⤵
  PID:8636
- C:\Windows\System\EEfsXye.exe
  C:\Windows\System\EEfsXye.exe
  2⤵
  PID:8652
- C:\Windows\System\svXUOgy.exe
  C:\Windows\System\svXUOgy.exe
  2⤵
  PID:8668
- C:\Windows\System\LnmbiKt.exe
  C:\Windows\System\LnmbiKt.exe
  2⤵
  PID:8684
- C:\Windows\System\yZNlRdX.exe
  C:\Windows\System\yZNlRdX.exe
  2⤵
  PID:8700
- C:\Windows\System\BUdodBO.exe
  C:\Windows\System\BUdodBO.exe
  2⤵
  PID:8716
- C:\Windows\System\ODxAxag.exe
  C:\Windows\System\ODxAxag.exe
  2⤵
  PID:8732
- C:\Windows\System\EeqPUwf.exe
  C:\Windows\System\EeqPUwf.exe
  2⤵
  PID:8748
- C:\Windows\System\WGgCGYC.exe
  C:\Windows\System\WGgCGYC.exe
  2⤵
  PID:8764
- C:\Windows\System\xWjnNbx.exe
  C:\Windows\System\xWjnNbx.exe
  2⤵
  PID:8780
- C:\Windows\System\rKbsuPh.exe
  C:\Windows\System\rKbsuPh.exe
  2⤵
  PID:8800
- C:\Windows\System\PyEudiM.exe
  C:\Windows\System\PyEudiM.exe
  2⤵
  PID:8816
- C:\Windows\System\AuFUxFO.exe
  C:\Windows\System\AuFUxFO.exe
  2⤵
  PID:8832
- C:\Windows\System\EAPZlvr.exe
  C:\Windows\System\EAPZlvr.exe
  2⤵
  PID:8848
- C:\Windows\System\EiWmZra.exe
  C:\Windows\System\EiWmZra.exe
  2⤵
  PID:8864
- C:\Windows\System\EvcFfXg.exe
  C:\Windows\System\EvcFfXg.exe
  2⤵
  PID:8880
- C:\Windows\System\Pbmenor.exe
  C:\Windows\System\Pbmenor.exe
  2⤵
  PID:8896
- C:\Windows\System\djvvWWz.exe
  C:\Windows\System\djvvWWz.exe
  2⤵
  PID:8912
- C:\Windows\System\XMZvEKa.exe
  C:\Windows\System\XMZvEKa.exe
  2⤵
  PID:8928
- C:\Windows\System\DKefaZs.exe
  C:\Windows\System\DKefaZs.exe
  2⤵
  PID:8944
- C:\Windows\System\idpxPqG.exe
  C:\Windows\System\idpxPqG.exe
  2⤵
  PID:8960
- C:\Windows\System\LnARmpW.exe
  C:\Windows\System\LnARmpW.exe
  2⤵
  PID:8976
- C:\Windows\System\KWTZLME.exe
  C:\Windows\System\KWTZLME.exe
  2⤵
  PID:8992
- C:\Windows\System\QmNDKyj.exe
  C:\Windows\System\QmNDKyj.exe
  2⤵
  PID:9008
- C:\Windows\System\bKbMfGg.exe
  C:\Windows\System\bKbMfGg.exe
  2⤵
  PID:9024
- C:\Windows\System\vOKFYOY.exe
  C:\Windows\System\vOKFYOY.exe
  2⤵
  PID:9040
- C:\Windows\System\oYvVHKV.exe
  C:\Windows\System\oYvVHKV.exe
  2⤵
  PID:9056
- C:\Windows\System\NymiHql.exe
  C:\Windows\System\NymiHql.exe
  2⤵
  PID:9072
- C:\Windows\System\emGrxTm.exe
  C:\Windows\System\emGrxTm.exe
  2⤵
  PID:9088
- C:\Windows\System\RftVJhh.exe
  C:\Windows\System\RftVJhh.exe
  2⤵
  PID:9104
- C:\Windows\System\RxJXpHG.exe
  C:\Windows\System\RxJXpHG.exe
  2⤵
  PID:9120
- C:\Windows\System\RqiSwFA.exe
  C:\Windows\System\RqiSwFA.exe
  2⤵
  PID:9136
- C:\Windows\System\ADvZTaX.exe
  C:\Windows\System\ADvZTaX.exe
  2⤵
  PID:9152
- C:\Windows\System\LrtFVGD.exe
  C:\Windows\System\LrtFVGD.exe
  2⤵
  PID:9168
- C:\Windows\System\zFhLtCS.exe
  C:\Windows\System\zFhLtCS.exe
  2⤵
  PID:9184
- C:\Windows\System\IfRxEnR.exe
  C:\Windows\System\IfRxEnR.exe
  2⤵
  PID:9200
- C:\Windows\System\czynnhL.exe
  C:\Windows\System\czynnhL.exe
  2⤵
  PID:8204
- C:\Windows\System\nNhvNug.exe
  C:\Windows\System\nNhvNug.exe
  2⤵
  PID:8012
- C:\Windows\System\PtbgbPZ.exe
  C:\Windows\System\PtbgbPZ.exe
  2⤵
  PID:8224
- C:\Windows\System\ztZYkuA.exe
  C:\Windows\System\ztZYkuA.exe
  2⤵
  PID:8272
- C:\Windows\System\xqNpXmN.exe
  C:\Windows\System\xqNpXmN.exe
  2⤵
  PID:8332
- C:\Windows\System\MPsEGKH.exe
  C:\Windows\System\MPsEGKH.exe
  2⤵
  PID:8368
- C:\Windows\System\lSKFddb.exe
  C:\Windows\System\lSKFddb.exe
  2⤵
  PID:8432
- C:\Windows\System\eNBjZJP.exe
  C:\Windows\System\eNBjZJP.exe
  2⤵
  PID:8496
- C:\Windows\System\sCIgrZq.exe
  C:\Windows\System\sCIgrZq.exe
  2⤵
  PID:8320
- C:\Windows\System\VbPMtPy.exe
  C:\Windows\System\VbPMtPy.exe
  2⤵
  PID:8348
- C:\Windows\System\jdhVQFq.exe
  C:\Windows\System\jdhVQFq.exe
  2⤵
  PID:8288
- C:\Windows\System\bmuvhQU.exe
  C:\Windows\System\bmuvhQU.exe
  2⤵
  PID:8412
- C:\Windows\System\CvRMECp.exe
  C:\Windows\System\CvRMECp.exe
  2⤵
  PID:8316
- C:\Windows\System\swYBROU.exe
  C:\Windows\System\swYBROU.exe
  2⤵
  PID:8580
- C:\Windows\System\nlpLsEL.exe
  C:\Windows\System\nlpLsEL.exe
  2⤵
  PID:8612
- C:\Windows\System\ZxJidIi.exe
  C:\Windows\System\ZxJidIi.exe
  2⤵
  PID:8660
- C:\Windows\System\hmNNBMG.exe
  C:\Windows\System\hmNNBMG.exe
  2⤵
  PID:8724
- C:\Windows\System\TUWWxXB.exe
  C:\Windows\System\TUWWxXB.exe
  2⤵
  PID:8788
- C:\Windows\System\PdUvpEb.exe
  C:\Windows\System\PdUvpEb.exe
  2⤵
  PID:8744
- C:\Windows\System\cQUOtLp.exe
  C:\Windows\System\cQUOtLp.exe
  2⤵
  PID:8772
- C:\Windows\System\TSFxlsR.exe
  C:\Windows\System\TSFxlsR.exe
  2⤵
  PID:8808
- C:\Windows\System\fHayaEc.exe
  C:\Windows\System\fHayaEc.exe
  2⤵
  PID:8840
- C:\Windows\System\iYAxOWy.exe
  C:\Windows\System\iYAxOWy.exe
  2⤵
  PID:8892
- C:\Windows\System\wtGgrYa.exe
  C:\Windows\System\wtGgrYa.exe
  2⤵
  PID:8904
- C:\Windows\System\NpZiyWO.exe
  C:\Windows\System\NpZiyWO.exe
  2⤵
  PID:8956
- C:\Windows\System\rUyyZdK.exe
  C:\Windows\System\rUyyZdK.exe
  2⤵
  PID:9032
- C:\Windows\System\pgNOGfG.exe
  C:\Windows\System\pgNOGfG.exe
  2⤵
  PID:9036
- C:\Windows\System\PgFBObn.exe
  C:\Windows\System\PgFBObn.exe
  2⤵
  PID:9052
- C:\Windows\System\oLstKXp.exe
  C:\Windows\System\oLstKXp.exe
  2⤵
  PID:9064
- C:\Windows\System\PTlZykG.exe
  C:\Windows\System\PTlZykG.exe
  2⤵
  PID:8972
- C:\Windows\System\gPSnstS.exe
  C:\Windows\System\gPSnstS.exe
  2⤵
  PID:9128
- C:\Windows\System\VMAvyIR.exe
  C:\Windows\System\VMAvyIR.exe
  2⤵
  PID:9148
- C:\Windows\System\URtauLU.exe
  C:\Windows\System\URtauLU.exe
  2⤵
  PID:9212
- C:\Windows\System\KozGrVg.exe
  C:\Windows\System\KozGrVg.exe
  2⤵
  PID:9164
- C:\Windows\System\PzWmsaq.exe
  C:\Windows\System\PzWmsaq.exe
  2⤵
  PID:6928
- C:\Windows\System\IVpnvgj.exe
  C:\Windows\System\IVpnvgj.exe
  2⤵
  PID:8400
- C:\Windows\System\LIgVkdR.exe
  C:\Windows\System\LIgVkdR.exe
  2⤵
  PID:8524
- C:\Windows\System\OVPlvBo.exe
  C:\Windows\System\OVPlvBo.exe
  2⤵
  PID:8448
- C:\Windows\System\rYBjQSz.exe
  C:\Windows\System\rYBjQSz.exe
  2⤵
  PID:8464
- C:\Windows\System\sDnNdzY.exe
  C:\Windows\System\sDnNdzY.exe
  2⤵
  PID:8696
- C:\Windows\System\jvRjLIt.exe
  C:\Windows\System\jvRjLIt.exe
  2⤵
  PID:8648
- C:\Windows\System\sOelzwf.exe
  C:\Windows\System\sOelzwf.exe
  2⤵
  PID:8596
- C:\Windows\System\XrVkpHt.exe
  C:\Windows\System\XrVkpHt.exe
  2⤵
  PID:8792
- C:\Windows\System\fFOGJWN.exe
  C:\Windows\System\fFOGJWN.exe
  2⤵
  PID:8952
- C:\Windows\System\hPkaFOa.exe
  C:\Windows\System\hPkaFOa.exe
  2⤵
  PID:8708
- C:\Windows\System\vcIstAW.exe
  C:\Windows\System\vcIstAW.exe
  2⤵
  PID:9112
- C:\Windows\System\OyzmfjO.exe
  C:\Windows\System\OyzmfjO.exe
  2⤵
  PID:9196
- C:\Windows\System\onmResr.exe
  C:\Windows\System\onmResr.exe
  2⤵
  PID:8384
- C:\Windows\System\qZzArLV.exe
  C:\Windows\System\qZzArLV.exe
  2⤵
  PID:8756
- C:\Windows\System\zuUhcna.exe
  C:\Windows\System\zuUhcna.exe
  2⤵
  PID:9180
- C:\Windows\System\dxJQMBP.exe
  C:\Windows\System\dxJQMBP.exe
  2⤵
  PID:8908
- C:\Windows\System\tVFewtY.exe
  C:\Windows\System\tVFewtY.exe
  2⤵
  PID:8940
- C:\Windows\System\zQfOtGj.exe
  C:\Windows\System\zQfOtGj.exe
  2⤵
  PID:9020
- C:\Windows\System\dnysHBo.exe
  C:\Windows\System\dnysHBo.exe
  2⤵
  PID:8300
- C:\Windows\System\JwOfLFF.exe
  C:\Windows\System\JwOfLFF.exe
  2⤵
  PID:8872
- C:\Windows\System\MySGxju.exe
  C:\Windows\System\MySGxju.exe
  2⤵
  PID:9228
- C:\Windows\System\YkBOXGl.exe
  C:\Windows\System\YkBOXGl.exe
  2⤵
  PID:9244
- C:\Windows\System\SGTvrWl.exe
  C:\Windows\System\SGTvrWl.exe
  2⤵
  PID:9260
- C:\Windows\System\trJhHqe.exe
  C:\Windows\System\trJhHqe.exe
  2⤵
  PID:9276
- C:\Windows\System\dTcoUyd.exe
  C:\Windows\System\dTcoUyd.exe
  2⤵
  PID:9292
- C:\Windows\System\GYaVzYc.exe
  C:\Windows\System\GYaVzYc.exe
  2⤵
  PID:9308
- C:\Windows\System\ernUGOv.exe
  C:\Windows\System\ernUGOv.exe
  2⤵
  PID:9324
- C:\Windows\System\RnPgphf.exe
  C:\Windows\System\RnPgphf.exe
  2⤵
  PID:9344
- C:\Windows\System\GJGLxPp.exe
  C:\Windows\System\GJGLxPp.exe
  2⤵
  PID:9360
- C:\Windows\System\tCozTnC.exe
  C:\Windows\System\tCozTnC.exe
  2⤵
  PID:9376
- C:\Windows\System\ENtSYst.exe
  C:\Windows\System\ENtSYst.exe
  2⤵
  PID:9392
- C:\Windows\System\qAkWJzN.exe
  C:\Windows\System\qAkWJzN.exe
  2⤵
  PID:9408
- C:\Windows\System\YWoaaZI.exe
  C:\Windows\System\YWoaaZI.exe
  2⤵
  PID:9424
- C:\Windows\System\LCqzvqN.exe
  C:\Windows\System\LCqzvqN.exe
  2⤵
  PID:9440
- C:\Windows\System\kVVLIkJ.exe
  C:\Windows\System\kVVLIkJ.exe
  2⤵
  PID:9456
- C:\Windows\System\zhysvIO.exe
  C:\Windows\System\zhysvIO.exe
  2⤵
  PID:9472
- C:\Windows\System\ttYZEOz.exe
  C:\Windows\System\ttYZEOz.exe
  2⤵
  PID:9488
- C:\Windows\System\MAkZaOi.exe
  C:\Windows\System\MAkZaOi.exe
  2⤵
  PID:9504
- C:\Windows\System\DkeLFgn.exe
  C:\Windows\System\DkeLFgn.exe
  2⤵
  PID:9520
- C:\Windows\System\NHrANep.exe
  C:\Windows\System\NHrANep.exe
  2⤵
  PID:9536
- C:\Windows\System\FAWkMPj.exe
  C:\Windows\System\FAWkMPj.exe
  2⤵
  PID:9552
- C:\Windows\System\XjXCOus.exe
  C:\Windows\System\XjXCOus.exe
  2⤵
  PID:9568
- C:\Windows\System\ziYAOnT.exe
  C:\Windows\System\ziYAOnT.exe
  2⤵
  PID:9584
- C:\Windows\System\goOsFEv.exe
  C:\Windows\System\goOsFEv.exe
  2⤵
  PID:9600
- C:\Windows\System\aWwdyhh.exe
  C:\Windows\System\aWwdyhh.exe
  2⤵
  PID:9616
- C:\Windows\System\sigsUmH.exe
  C:\Windows\System\sigsUmH.exe
  2⤵
  PID:9632
- C:\Windows\System\PEsvoig.exe
  C:\Windows\System\PEsvoig.exe
  2⤵
  PID:9648
- C:\Windows\System\QnKVRhc.exe
  C:\Windows\System\QnKVRhc.exe
  2⤵
  PID:9664
- C:\Windows\System\DRLLYcv.exe
  C:\Windows\System\DRLLYcv.exe
  2⤵
  PID:9680
- C:\Windows\System\RbpeqXd.exe
  C:\Windows\System\RbpeqXd.exe
  2⤵
  PID:9696
- C:\Windows\System\kAzVVAa.exe
  C:\Windows\System\kAzVVAa.exe
  2⤵
  PID:9712
- C:\Windows\System\yTNfTpM.exe
  C:\Windows\System\yTNfTpM.exe
  2⤵
  PID:9728
- C:\Windows\System\YHyfICw.exe
  C:\Windows\System\YHyfICw.exe
  2⤵
  PID:9744
- C:\Windows\System\LJYHJfE.exe
  C:\Windows\System\LJYHJfE.exe
  2⤵
  PID:9760
- C:\Windows\System\NpYrrKU.exe
  C:\Windows\System\NpYrrKU.exe
  2⤵
  PID:9776
- C:\Windows\System\ATTdIMF.exe
  C:\Windows\System\ATTdIMF.exe
  2⤵
  PID:9792
- C:\Windows\System\alsDpwi.exe
  C:\Windows\System\alsDpwi.exe
  2⤵
  PID:9808
- C:\Windows\System\SoBRCnI.exe
  C:\Windows\System\SoBRCnI.exe
  2⤵
  PID:9824
- C:\Windows\System\UsOuNDK.exe
  C:\Windows\System\UsOuNDK.exe
  2⤵
  PID:9840
- C:\Windows\System\aZkeXTf.exe
  C:\Windows\System\aZkeXTf.exe
  2⤵
  PID:9856
- C:\Windows\System\DyDJlgo.exe
  C:\Windows\System\DyDJlgo.exe
  2⤵
  PID:9872
- C:\Windows\System\fXzPyqZ.exe
  C:\Windows\System\fXzPyqZ.exe
  2⤵
  PID:9888
- C:\Windows\System\vttCjEb.exe
  C:\Windows\System\vttCjEb.exe
  2⤵
  PID:9904
- C:\Windows\System\AVLXtxO.exe
  C:\Windows\System\AVLXtxO.exe
  2⤵
  PID:9920
- C:\Windows\System\CHIsLSv.exe
  C:\Windows\System\CHIsLSv.exe
  2⤵
  PID:9936
- C:\Windows\System\zYRXeVj.exe
  C:\Windows\System\zYRXeVj.exe
  2⤵
  PID:9952
- C:\Windows\System\JHGockh.exe
  C:\Windows\System\JHGockh.exe
  2⤵
  PID:9968
- C:\Windows\System\PqNepXl.exe
  C:\Windows\System\PqNepXl.exe
  2⤵
  PID:9984
- C:\Windows\System\sNiTeWB.exe
  C:\Windows\System\sNiTeWB.exe
  2⤵
  PID:10000
- C:\Windows\System\PWhehzd.exe
  C:\Windows\System\PWhehzd.exe
  2⤵
  PID:10016
- C:\Windows\System\AeRrzpW.exe
  C:\Windows\System\AeRrzpW.exe
  2⤵
  PID:10032
- C:\Windows\System\hNtBnOa.exe
  C:\Windows\System\hNtBnOa.exe
  2⤵
  PID:10048
- C:\Windows\System\MvbLMae.exe
  C:\Windows\System\MvbLMae.exe
  2⤵
  PID:10064
- C:\Windows\System\eMAQMwh.exe
  C:\Windows\System\eMAQMwh.exe
  2⤵
  PID:10080
- C:\Windows\System\bPblXfx.exe
  C:\Windows\System\bPblXfx.exe
  2⤵
  PID:10096
- C:\Windows\System\kDXJJda.exe
  C:\Windows\System\kDXJJda.exe
  2⤵
  PID:10112
- C:\Windows\System\pkTdQjl.exe
  C:\Windows\System\pkTdQjl.exe
  2⤵
  PID:10128
- C:\Windows\System\QgLkiiI.exe
  C:\Windows\System\QgLkiiI.exe
  2⤵
  PID:10144
- C:\Windows\System\amEzkkx.exe
  C:\Windows\System\amEzkkx.exe
  2⤵
  PID:10160
- C:\Windows\System\gNThzBS.exe
  C:\Windows\System\gNThzBS.exe
  2⤵
  PID:10176
- C:\Windows\System\YDEkZtR.exe
  C:\Windows\System\YDEkZtR.exe
  2⤵
  PID:10192
- C:\Windows\System\QULOMpU.exe
  C:\Windows\System\QULOMpU.exe
  2⤵
  PID:10208
- C:\Windows\System\ggJkJJN.exe
  C:\Windows\System\ggJkJJN.exe
  2⤵
  PID:10224
- C:\Windows\System\FSMdYMp.exe
  C:\Windows\System\FSMdYMp.exe
  2⤵
  PID:9144
- C:\Windows\System\yeegYoG.exe
  C:\Windows\System\yeegYoG.exe
  2⤵
  PID:8304
- C:\Windows\System\naHNFKU.exe
  C:\Windows\System\naHNFKU.exe
  2⤵
  PID:8888
- C:\Windows\System\WNljPlr.exe
  C:\Windows\System\WNljPlr.exe
  2⤵
  PID:9084
- C:\Windows\System\oSFkytw.exe
  C:\Windows\System\oSFkytw.exe
  2⤵
  PID:9160
- C:\Windows\System\KkcOvbn.exe
  C:\Windows\System\KkcOvbn.exe
  2⤵
  PID:9252
- C:\Windows\System\QjFKYOb.exe
  C:\Windows\System\QjFKYOb.exe
  2⤵
  PID:8416
- C:\Windows\System\kePTDgf.exe
  C:\Windows\System\kePTDgf.exe
  2⤵
  PID:9304
- C:\Windows\System\rfddRtw.exe
  C:\Windows\System\rfddRtw.exe
  2⤵
  PID:9284
- C:\Windows\System\LAzKwdb.exe
  C:\Windows\System\LAzKwdb.exe
  2⤵
  PID:9340
- C:\Windows\System\nYYMfzl.exe
  C:\Windows\System\nYYMfzl.exe
  2⤵
  PID:9400
- C:\Windows\System\tnSQJFY.exe
  C:\Windows\System\tnSQJFY.exe
  2⤵
  PID:9416
- C:\Windows\System\ZtpesWO.exe
  C:\Windows\System\ZtpesWO.exe
  2⤵
  PID:9448
- C:\Windows\System\aWlZbyd.exe
  C:\Windows\System\aWlZbyd.exe
  2⤵
  PID:9500
- C:\Windows\System\CsLoJCQ.exe
  C:\Windows\System\CsLoJCQ.exe
  2⤵
  PID:9452
- C:\Windows\System\WXRuBME.exe
  C:\Windows\System\WXRuBME.exe
  2⤵
  PID:9592
- C:\Windows\System\jafwIBy.exe
  C:\Windows\System\jafwIBy.exe
  2⤵
  PID:9628
- C:\Windows\System\HZXKEVG.exe
  C:\Windows\System\HZXKEVG.exe
  2⤵
  PID:9580
- C:\Windows\System\dlHqWkO.exe
  C:\Windows\System\dlHqWkO.exe
  2⤵
  PID:9612
- C:\Windows\System\lyScQkH.exe
  C:\Windows\System\lyScQkH.exe
  2⤵
  PID:9688
- C:\Windows\System\TldOAbt.exe
  C:\Windows\System\TldOAbt.exe
  2⤵
  PID:9704
- C:\Windows\System\chcpysr.exe
  C:\Windows\System\chcpysr.exe
  2⤵
  PID:9708
- C:\Windows\System\opwdTVZ.exe
  C:\Windows\System\opwdTVZ.exe
  2⤵
  PID:9784
- C:\Windows\System\sbjXitT.exe
  C:\Windows\System\sbjXitT.exe
  2⤵
  PID:9816
- C:\Windows\System\uWehcpX.exe
  C:\Windows\System\uWehcpX.exe
  2⤵
  PID:9848
- C:\Windows\System\ucAWMpe.exe
  C:\Windows\System\ucAWMpe.exe
  2⤵
  PID:9880
- C:\Windows\System\gJZQQhx.exe
  C:\Windows\System\gJZQQhx.exe
  2⤵
  PID:9896
- C:\Windows\System\qBHWUht.exe
  C:\Windows\System\qBHWUht.exe
  2⤵
  PID:9944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AXPmWid.exe

Filesize
2.4MB

MD5
5bb86d1d11d57072e3d92263fce93738

SHA1
a7e448e4a359fe16ee943fa94ba7870fb0fffbca

SHA256
c9f3dc27ea18ea7c9aea48e95229e6ac4eaf1db983d3ec1992d03bd6ad461dcd

SHA512
2a4d538c3bf5d4b99298984e519da55a66a659531f28ec17a189aaf54d2d4d9bb92d8bfa6b3b0923901c049d646f59d17da4946ccea5b6d21282b776997f28a4

Download Submit
C:\Windows\system\AqSGiWx.exe

Filesize
2.4MB

MD5
2820861778fb810866e850ada69a752c

SHA1
3268c9960fcd69ba3a8d817a599e95b0e528c92c

SHA256
80c5432bf6c56698b3103be888738e41b464a878163f160024d79aa21755b390

SHA512
de4844f8b26c206b289aa21a1756f587ce56cf7a4fcc33adb649ec695240677f7d1d97d7d85435776680102832c7a7c9842dd33d2dc691526b5e9138fa99221a

Download Submit
C:\Windows\system\BLqJEHW.exe

Filesize
2.4MB

MD5
306ad369f5d3d80a344d0cf73eaeed2d

SHA1
b3a3e43b31b5ae2d20e36a1e683a02eb189055bb

SHA256
d89eea35ee7714e9c86ca0a35e3f0439ac8f308eec3482453bd3ae915a1fba3d

SHA512
50c80383d0d2b58ad9ea8f6a5841036831bafac76ed4819b606581c72f6619ab1728834a2ec912740f8c5cfd67bbad2ce61118f9f007d0e3dbcbe417bbbd0762

Download Submit
C:\Windows\system\CGAjMRA.exe

Filesize
2.4MB

MD5
1ed4fd14aaa5140973ce267cf4636d20

SHA1
4816f56f653119632d1591a7064f3467dc9f0d94

SHA256
b034b0ce1d37e14fa1efc5a7fb4c8cb5d5b01c88b5e81017662939aeb51fbe4b

SHA512
d13ad82e1750bdb39b4c8ee1933f54aa18d323dc7aabac3d9329d7094b3fefee0393cb0c54ccbf80fc5bcf7aa30894a8882f48630c45bc727d585a1a66e31738

Download Submit
C:\Windows\system\HNojTWi.exe

Filesize
2.4MB

MD5
79e14d8ee74770a9908e62dd169354ee

SHA1
93a0ebf6ff6444013846e1b109dd668014acd6aa

SHA256
693ce239ee54860f18c861c37c64340d64618dc3b18bf64cda80333d8883574d

SHA512
e9c2a045c1e031dfeb6bf4b4db0fdd0cad52e74a1f4698ac554e98bc28b72dca158c82caf012248a1174d965010095849c93f4576a17edb161bf179d2c59af01

Download Submit
C:\Windows\system\KrQmoYo.exe

Filesize
2.4MB

MD5
fb8add2dcd150412b02136d62a56160b

SHA1
5df4ff0359d85b4b3758c77bec3706efd44dbce9

SHA256
8ca580914f634040cf1be626fa41fbfd95088af64fe8afd73fd7f72054ed2982

SHA512
f020eb4540bcdbb094d7c5464c391409f5adf86977eb2bb16f09641bff6f2bf488c8b4ca1cfd517323bfd48a19882eb108343f817160f25462501f08c420af6e

Download Submit
C:\Windows\system\LNugWzk.exe

Filesize
2.4MB

MD5
3de41502a8bf4695cb5cf5f0f2f8afe1

SHA1
05ba8148e27989f33e6f87a8ceb60d62fbd13e05

SHA256
5806fe89b3fdc7dba42388b22ffee6e3e343117accd8fbb3a899f115be70f95a

SHA512
a8abe3820c16fbc0a0982756ddb2bb7460b070ae5db0630bb2a6a04d2dc434da26e4f36ed9f24021402ec7be50e41bed76a8ea267aed9185807030c3ac2eca9b

Download Submit
C:\Windows\system\QIclARC.exe

Filesize
2.4MB

MD5
f3854f6ca8164a0632a72c4339057cc6

SHA1
2e7b972a4a877401775bb6dc937fb3c6ce4b16c0

SHA256
990f9188bbc04aa397c6be9fb1792c489ef28e3b90833adb14edefa0daec009c

SHA512
5c4bf979faf0f636436b35ef2c29eacf8285e8daf922dc468eb34f8f2d25bc464985801d7c7f51c21834375d57fa408853c016d53ee7206036f6098cca390708

Download Submit
C:\Windows\system\TRvjQUN.exe

Filesize
2.4MB

MD5
198e228b0817881db9ab53b0397a1586

SHA1
26199a1f92cf921883c66c8cfcd626f74e019f75

SHA256
8b555412d3daec8fb2c6b9f7e36b4df0b140de1c85fd447cd1ee7e0e19b93005

SHA512
7b115940efd23611c89743f82c592ac31847471f649b4e5659336f7964a5d4d04f8f81b163a421863e92b669132ffc7feadebe02df764b568d5242795e898d00

Download Submit
C:\Windows\system\aCjBIUp.exe

Filesize
2.4MB

MD5
e4bca8d4a626ff28baa12581727ee652

SHA1
2d360def7656a15f98ba1753b109092296312f5b

SHA256
e7d0fe423fcdd0ef1c0e8bfaf11d069519e09af06048f8939c7891004a7df485

SHA512
62c9a0bb8990fcc77d038e1db44df0f4c8c3e96a47d3226b5c04f3cb21c81a6d5613ca1c750207033a7adaca696026e5b97d89ae346d5d21d1eb652fb96d4cb8

Download Submit
C:\Windows\system\eBhqsme.exe

Filesize
2.4MB

MD5
3fad89ad543eacd85e17b648852e4d29

SHA1
b24aea25d0bb4552c976579d93945a29a6a61d8a

SHA256
1adbf0a65952a2688ef6356a712056ae0767d0d40322fa4e4d5cf69ae65a91dc

SHA512
33dfe26de66653c81dafc490ccb26d36e615f7838bd40842a9df46138ad400424af7c0d8cc474ffcbe2128017f9a15e39ce79b5c232c0fdcc71864d9a6f960a8

Download Submit
C:\Windows\system\lQIdoAa.exe

Filesize
2.4MB

MD5
b5a99e116c6df37ce128a36f9653bab8

SHA1
4ff122e032dca3c7949217822aea7cd67941e5d9

SHA256
27d4d01dbcfbcff955aaf66a6e23cc64a41bc3efc6df8fde4c787ab57dc0d898

SHA512
243fe162857dac13d915cff6c8d00ffe22b911c374ffc84d08c5c995e66ef0e4da088b05d6a5ceeb618b098fe51db9dbaeb6776bd9b6302f9835131906aab7c0

Download Submit
C:\Windows\system\nVCQRYd.exe

Filesize
2.4MB

MD5
9f65cbb6a4bbefe4b6b26e693080ff47

SHA1
b3b56ed09c4779c85bffbe683aa23a3e22597dcc

SHA256
cc516ed3a62574ff881c6c30adeec234a47359fe35a1868ab106ce714ff0ffdb

SHA512
692ab5e4767264e57434129b133e4ab2b9d0936391c9fbfae8668f52f3dfb0ab4ae1b2a63a5417838a79f1bf76938b3f9a0d7a7da42ea3730558fe8814c57777

Download Submit
C:\Windows\system\tpbSkPR.exe

Filesize
2.4MB

MD5
c6d0d1b4e6ba982a3ba0f8953469081c

SHA1
4a9e45c1415b8af5e0b2154b4c48e47d11d15354

SHA256
55556a8d338d3825d0b6f7348f2743186329e489bb54e008f5aabeaef31d6037

SHA512
f00191ef08fbd40ebff01cf78d918b148c31b15d7a6d7d0a0d723c35c2dd68d2f69f30295d8075ef4134ad5fce429ed8d053a257d3aa883f0120e98cd1da580b

Download Submit
C:\Windows\system\xjHbARx.exe

Filesize
2.4MB

MD5
6a00b0ae1caa6b08815bb70fc515c9d3

SHA1
ce63c6783b5909196de295e4488c8c392652b868

SHA256
8a7e67e4528cecacae49fa0a31877b7e621adc0903635a0f23fc76f8e3d354c9

SHA512
0bed5ea646af6a0eb7620ea04bc753da681dd3314019f8f3ea4b621917b51b4760ef12d5b7090db87c96be12bf1d3072f83d533aa8abac595bfa4e931bd46e38

Download Submit
C:\Windows\system\zilIjHU.exe

Filesize
2.4MB

MD5
d1a11d8c68e371f7a280f9f392827268

SHA1
c59244ad8b8faa72e3d39c75b51e49d1241ada79

SHA256
be6cf27a24a01e492a93a0bbb95cf2f08c54df086957282213aeab55d890400a

SHA512
b5e4aa332cf08a3ab6a3fe4c7a36b9f455ec23f72a0291fe8bd60bc363ec6c24dcbc1473f79ee8bde49b0161a25d5c87d85b24001a1917a101a30357914507a3

Download Submit
\Windows\system\EmoYCDs.exe

Filesize
2.4MB

MD5
2c821fe7895334123d6e625c47eca7e2

SHA1
e98f4922337a24ac855fde249537b8fe6985d1b5

SHA256
e47bc84949702e528063e7fd1a33e63fde8ada29bbed567342d656d6037c17c7

SHA512
35a47349964b2f498410588aaadd5b1ada12a0e93fbd44ba113cec9aa3e88d0e3c97ede3c48f249dc29c23c207d0fe76eae1350b9d75809176cc980ed1623390

Download Submit
\Windows\system\FjMZpZe.exe

Filesize
2.4MB

MD5
3d04d0dc2e08d7c4467a3282a44846db

SHA1
f6eacfb3abccdd9e323f74e142dd50e9c532f193

SHA256
798a1ccc6fb81120b5381cfea082d0dc8c2f8f995aef34a5b8b6662347ea146a

SHA512
fc4f358fe7be2fcf7fc8493673a2689dd9e97d2490d8d16a53fe10620a6fc3ff25b12da7657ec5843b70e79fc3d1b516cfbbafa0e7ea54e8b366853c79212377

Download Submit
\Windows\system\GXexKWF.exe

Filesize
2.4MB

MD5
91746a1f7c32de5ec8ef80754134c15e

SHA1
28e4f709fcb9eedd69fa2a08836f1a38a2535889

SHA256
e4e4e5b324e05f3aea7d730b0d715098f66f625a0379f743cb417249ae56603e

SHA512
2785638df8e06de0fcf0f04ed959a73dff969dd215799701bea4ef08f06924929191b0441c7a2031a80995c4855c6b5068009b7e1121a74a90bf05e50832a03c

Download Submit
\Windows\system\HzQpVpO.exe

Filesize
2.4MB

MD5
337f355b81f0acbc936ee22253ed9f45

SHA1
d10cdb9c5432d6ac9dc9bf7e143ad48dd31ff8e7

SHA256
4557b95c702dc000e9de439efa3e70dcc705f9a92ba9bb5f937e55bd03c271e7

SHA512
757bece9ffd89068cd777ebca112993f90407add3d3c4243cde0686a7e431192570c5f9d5416984c0dbaa6c4b3133ac572163170f19e1165b41476319b44721d

Download Submit
\Windows\system\McfQGxs.exe

Filesize
2.4MB

MD5
fe0fa0011bfd0f6b1b00254387cddbbb

SHA1
6f12a857e9292eb27aabcd74b1acf29ade6c2cf0

SHA256
a2ef88e0ae133f472e15cd85414d9fbfa6df4bec65b6f6531aec857822a96030

SHA512
71a39cabdb59baf6a74ae02d388ad2bf4cc734e9c20cfa34cf3a18fe0687dca7f8588942d28d8c880a17ecece227a3ad05b0efd64f4a96eed641653d4425b149

Download Submit
\Windows\system\QPzEyWg.exe

Filesize
2.4MB

MD5
bab40d0b175baa7fa575b4591cb46bb7

SHA1
04b02f3c8a2f60a465b1778bdd0bd23c76960766

SHA256
0bfec2f3f15ff5a19cf2bd05e388f74426e0a8486973d5991a302037c9db5a68

SHA512
c28108b6b4b0439aea644db88e4dee4b20723d25e8d75d0715ea1b84671af0befb6e28ad23bc72a59e8a0319e25e881fdefe60d7787221d7d27c82a6f59e4bf0

Download Submit
\Windows\system\TWfuiHM.exe

Filesize
2.4MB

MD5
e8c9921413a7f973db16e002593b9e13

SHA1
d3c253b76fbccbc11f0b0876b237430f8f99dd82

SHA256
aafd04eade3ab2d3acb60f7e787e311b76c7a68f097738d2fb44982f1a6d91a5

SHA512
931f0114c02cb775a9d987315cdd26cd3d7de1b1a0000257af4c65b219499c9f01f226b7087d0dc8457ab5410ddde3b0e5c523acdb629c4f43fa94f8ffe8fa69

Download Submit
\Windows\system\VTZRmVP.exe

Filesize
2.4MB

MD5
8f3ab9f5707f97f1ae2775e1981e4c3e

SHA1
3413c1f2f4b60a0db87fb013211b561160bac0fb

SHA256
8c19d9d32c9c114e6ed49984a9b82db0c56c745b17fb9abed4ec28ce1c218401

SHA512
d024964066bef4ad580b425777400156eba14f126eae67480bdee75a99d3e026d9cb933b17a2e7a20223966eb553684fb8681b324f4e14ad9539b2fc2c153987

Download Submit
\Windows\system\XEMXzrx.exe

Filesize
2.4MB

MD5
b06d3e8197c457cdc1e16f48dc391890

SHA1
a89605911d1bccd9f3f98615083c5a6769f4d778

SHA256
4357dd0be831421424ef75e44031f98448e9409cc6603d0755a298ae859bc11a

SHA512
8549379332d0f993c51b263eff4d0db23873a072d6532d4ad751103063b6f68bba593587c8e6a34a925b860bc1ca8f0013de6977a3914073859dd945dcecec58

Download Submit
\Windows\system\YZDFdBR.exe

Filesize
2.4MB

MD5
7204e5dd4ae23a276c6f2fa34a66c84f

SHA1
f0d6d756403206c5c0318436b7b1f64aca65fb96

SHA256
d4c6815df2130814f7e5ef06640b5f474a166f87813c24fd2e0a8e653d1f25ef

SHA512
321e886d99fec72afc6d3a9de16e87c301343edf3bb3985b282041656fa18ea41a399149dfe33cc90f55b1002c859a5868c876a1f10065cb0c22de887c1469d3

Download Submit
\Windows\system\ZqsYEsK.exe

Filesize
2.4MB

MD5
e48316f64745af482dd592afa6695f08

SHA1
7006ad506fa9e9f7eb7f759dc12cccbb1d1f6001

SHA256
4791a3f461fe06a3c881512f6e2156e41f72ebea4795dae8727d151203d0273f

SHA512
cdf49529cf9eebfec3de378082515f1d6bc2fd3d0f49894efac0e04d96e20f74fdcb4c0291b9001a3384b54b9661a67099964d78e86d9be764053bfde1b8a1de

Download Submit
\Windows\system\azcmnUM.exe

Filesize
2.4MB

MD5
f5fd862006fad62bd7cd772156732d68

SHA1
8143fad3847b43bb8d72cd74b386a9a2fc15730a

SHA256
8dc0e892f81607483f71eea1e1aed4213b14f3b1d6bc3cc27d7151f060fe481d

SHA512
2acae205df4ae686202e2009725f315d8c35f5fb1eb229331f3a6052f1bc152e99d84fbcb84024ac2b35c533cbe7484b02795408e3223790fcd6965a7c1ecb34

Download Submit
\Windows\system\cDvPFgW.exe

Filesize
2.4MB

MD5
1fa7b6c2eaab5d52f0ce42af0edfefe3

SHA1
a84e1e6bc95b0dd5f451443153b82c09bc4ced7c

SHA256
0a13c3d32ae84feea7ff6f943bea6859d5a796debf2e9582bc05295bee050c5c

SHA512
daae7161d4d509289a782d90a6a5d0dc04ae26f0b96fbd97971d0d12441a2af5a4c8d676545ea7aa95884ce287e57a86d7c21cd4b7bb212312cb022be05b93cd

Download Submit
\Windows\system\cpPKzzZ.exe

Filesize
2.4MB

MD5
184452646e5f745c58b68e619d9323ec

SHA1
ca8344bdc169ddf36a6e3c74f06d94e85f6bf6cd

SHA256
0e4a5ae7d471cae5bbd8944ba31b3853e134a95a64ba3897973e4ae94a6674c0

SHA512
e87ae59256b98af7996361d46c852c40e88abf1db159920e5b139f500c9ca21b1715a2040970e8dde15944af949568f641f6c18f14e681b1e13b7f7d3c9df8b6

Download Submit
\Windows\system\dsrswgO.exe

Filesize
2.4MB

MD5
2b22d682107df6e7c1c0c7cc21dccf65

SHA1
502a3c2cf6c26e39384396f7ebfb949b0d3aa961

SHA256
0ad4bc6a1422ef0444cb321366f253c5100595600c9fc910833338674f043481

SHA512
f683c3d3df74efbf6c7c5211c595346e70aab148a8e955c1357ec652b35a968f1e9b85a128e3dbe0a450c392b31b96a4c02bfbb81902ae80575a049aff888379

Download Submit
\Windows\system\ftELsvM.exe

Filesize
2.4MB

MD5
ade475f5147bc709e47bb4611e5dc110

SHA1
50111eca48ed146e38522f39e31d58c5a8ee8e20

SHA256
af6eab49ec184e1359473160073832a98c3a184d6c3f1f96d83a689af31b09da

SHA512
7f22dce8f535d65db8f401305b5a70ff95418e3389c0a34d774585c149844b6cf83b7a70ca5d28038924bcdcb275762491975a1cca966e65ec90efa5d5146884

Download Submit
\Windows\system\mahqlHU.exe

Filesize
2.4MB

MD5
ffbde4304adbddd4e72dfdbf0b88d5e3

SHA1
c015d9d8d93f4f5ff4fe2c855f701cc10ad991d4

SHA256
9c9dddc99885a6034bab16621591a33ed85968ac893e15af12f31f6ee97e3441

SHA512
0e0effc7fb3a0ddb7963fe198269faaa481e1f01fe767bf4fe0fafceaf03d8cd5fe81285584b5c7ed2a04415225dff4c214fed9b37826ad0ba82566e906f3bca

Download Submit
\Windows\system\nHJOyrt.exe

Filesize
2.4MB

MD5
6ca359038e23c9b8ff91a6be3728a809

SHA1
ae7add1c76f0e336609ca2eff1340163cb5a9e3c

SHA256
fc7520a815d099ce0e1b3ea36f171bb35b53496bed6a2df21189f6810a01d74d

SHA512
ab48dc28ca56f82927d3cb9c45280a1a69d62ce1e2c1e33661e54a68672dd53d43fffeaa959c263acfe3d83ab6186b5e6fb5c4256c122770d445aea9cb5cabd9

Download Submit
\Windows\system\pNSkLnw.exe

Filesize
2.4MB

MD5
01b2a46b380de4f622fb82a4e3cb1bc5

SHA1
de4bdf9b859db73cc3221d4d43da45fa1e4ef562

SHA256
d0a285e0ddff8a329061ca5ca9883c9e586c4fd777cd770e5a71c8666619d3d5

SHA512
1b5aabddd8cf6f574fef1463be8874c7bc15bdf26b3a663c07cab2ac0d1fc1a82727089fa5b6287aa5e378f4159b6217f19a744c0b1ca984426238f32be033a1

Download Submit
\Windows\system\pxdRMDk.exe

Filesize
2.4MB

MD5
4f94ec64429d12ffec2d4c600eed0eda

SHA1
c980de170c754f179dac1d315ed87f29bbe1b4e5

SHA256
65a6a06d8d0edf00ff7b944eeb6543eb42111ec7d7e15f08a1c00a409d017a2b

SHA512
36678cf58b0f6801b528c18db341ede7a451e1ce7f9070681c05ed576b1d559633b6ef45285280c6437b1a36b0c85f7a97435581c6408bfbdc2c3f038af34971

Download Submit
\Windows\system\rTWIuZH.exe

Filesize
2.4MB

MD5
c721a36122420b0427f4f45e6a05c786

SHA1
84f594ae00e426a5b644ec4c438b6f4801628f97

SHA256
45ec13c26eadb8d2e512cc4a970e7d772134a1663a3030dca4a052a5688b74b5

SHA512
1aa4f6d5f91258a4bcfb54b556052d4991f67ae712833626ea94910603742b9685f65d28f9f203ca03b15978e5f725d4db89d15d09654f679a9bf97c6de9f4b8

Download Submit
\Windows\system\wrFTfFM.exe

Filesize
2.4MB

MD5
9a8c52d9eaeb4d528009342109e17ace

SHA1
777916c3a3db207805e63f6e17f7dc2ef63381d5

SHA256
fbd4b869a83699d3f15ca29a1f4d07baba7bfea45867466671210c4b7d53d905

SHA512
273ab24019f5d743c6c6ee7560e77a5a64a2e0d378fb96c97f9416f59ab90b4abc0937483c1fad6e7870eee029f209cda3888e11dae63fa5bd7268223d4878be

Download Submit
\Windows\system\xjudbUg.exe

Filesize
2.4MB

MD5
1bc22795e3288d09fde3c78bdc3d6c21

SHA1
e4e0fb547651ea7b3c4547d02a747c8bfb44a35c

SHA256
bcf14c0062173db345103528168cb309a9e4875afdbbb2f6a794c913cb2cf688

SHA512
ed81cbb3beff4e4cf28635f1b2ff17b770c18277b53b16bd36dbcd0421cbefd12a0fc4ae13a91e4be57f91f1b36db4f64d321a7f8d2b79be1ed4edf17b1a244d

Download Submit
\Windows\system\yNysvEL.exe

Filesize
2.4MB

MD5
dcf40cd1d08a509da6e002a5ea5e5dea

SHA1
4044cf1ab91bcb14c106f1e49794631589190b05

SHA256
83dda8ede0539b721fed766ec4eed7802d9b0f5e122d965efb38bb413843c1e7

SHA512
40beab5aa73c30ff6cef1eea3f5cc6ce571d80d86b83057f81544dfa90d3e07ed1910ca374758b89fbbb6753523478c44773a5700be37fe26dd472c8c0c81c94

Download Submit
memory/1304-12-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1324-66-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1324-45-0x0000000002960000-0x00000000029E0000-memory.dmp

Filesize
512KB

Download
memory/1324-254-0x00000000028F0000-0x00000000028F8000-memory.dmp

Filesize
32KB

Download
memory/2088-16-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2240-84-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2240-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2240-14-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2240-69-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2240-10-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2240-89-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2240-59-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-71-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2240-2-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2240-34-0x0000000002E60000-0x0000000003252000-memory.dmp

Filesize
3.9MB

Download
memory/2240-75-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2240-130-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2240-109-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2240-68-0x0000000003540000-0x0000000003932000-memory.dmp

Filesize
3.9MB

Download
memory/2472-88-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2480-63-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2588-60-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2724-36-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-137-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2836-67-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2912-70-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download