xmrig | 788a7d11dbef31b9648dc00ca9fb7c36681de0bab7e60c7916c60e91a1e5ceec

Analysis

max time kernel
21s
max time network
35s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
Size

2.2MB
MD5

0764332d6adc0f1ffe16caa8d5ad60ab
SHA1

fa8f5ad68a79478b678090656a0b1839415bda7b
SHA256

788a7d11dbef31b9648dc00ca9fb7c36681de0bab7e60c7916c60e91a1e5ceec
SHA512

fbae9b1ebf14d065b2de299432110d31919a56ba26b1f6b38209fa9dfe1d128062c06c5c1f7f56ee8f1a01b39dd1392d47d9c1754ce7e8614de412b1df3ea0b0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfh:NAB2

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/1516-7-0x000000013FE80000-0x0000000140272000-memory.dmp	xmrig
behavioral1/memory/2424-142-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2536-137-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2740-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2656-132-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/3016-130-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2548-128-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig
behavioral1/memory/2652-125-0x000000013FEE0000-0x00000001402D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1516	wxvyjXz.exe
2516	JTFttgw.exe
2652	DdYdUxq.exe
2548	EZhoPCU.exe
3016	yZrzATB.exe
2656	RbteIoH.exe
2740	ODZkiyF.exe
2536	IlwAVkb.exe
2424	RwdTmQr.exe
2480	ZRgHVDm.exe
2904	hXQZKWc.exe
2908	yZtXiKC.exe
1952	wSVYXEI.exe
2492	RcFxgOr.exe
2708	tftdxuT.exe
2748	yzFZyBu.exe
920	VvvbNpY.exe
1104	CBHIDQy.exe
1860	tTzdwCC.exe
2352	SlfoXks.exe
2032	dqpwUlQ.exe
2340	FSEMzVD.exe
2924	KzMspDL.exe
1268	VlYFJDW.exe
1320	lnWqMiC.exe
2076	GGRJqXG.exe
780	JRZUyRa.exe
984	sdtggqF.exe
940	xXbbEBQ.exe
2772	CPXkuyk.exe
2188	nBHhOgO.exe
1096	WBNmviF.exe
1936	wbtquwe.exe
1996	FkEEAhU.exe
1340	ZIPsjIC.exe
2264	sfqEZvu.exe
1608	hVcwCmU.exe
1984	IOcHNNx.exe
1348	VPNNJJS.exe
1200	TogFaUv.exe
2012	kwrYnTl.exe
956	YSFPACo.exe
2160	dSsXpRY.exe
1548	qHNLiyF.exe
2368	HrzBQhF.exe
2976	aAXGRNL.exe
580	LpGHPeb.exe
1696	LnGepou.exe
2064	qVHeiVM.exe
1596	BGBcXnj.exe
1804	VnICAAW.exe
2576	LFJcjIr.exe
2660	RJXQyef.exe
2436	FsZNOeo.exe
1828	oVUOpNg.exe
1716	xfJKxGU.exe
2192	OLfcpjE.exe
2044	JrplbGQ.exe
2876	cDMbcqq.exe
1796	MqZAwoM.exe
772	vqmgZpi.exe
676	dtNaWAs.exe
1768	oSqXdMC.exe
1504	fLowfDq.exe

Loads dropped DLL 64 IoCs

pid	Process
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a0000000122b8-5.dat	upx
behavioral1/files/0x00300000000143fd-9.dat	upx
behavioral1/memory/1516-7-0x000000013FE80000-0x0000000140272000-memory.dmp	upx
behavioral1/memory/1632-6-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x000700000001471d-29.dat	upx
behavioral1/files/0x0007000000014726-37.dat	upx
behavioral1/files/0x0006000000015be6-53.dat	upx
behavioral1/files/0x0006000000015cba-60.dat	upx
behavioral1/files/0x0006000000015ce1-70.dat	upx
behavioral1/files/0x0006000000015d07-82.dat	upx
behavioral1/files/0x0006000000015cd5-68.dat	upx
behavioral1/files/0x0006000000015d87-118.dat	upx
behavioral1/files/0x0006000000015d79-150.dat	upx
behavioral1/memory/2424-142-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x0006000000015eaf-166.dat	upx
behavioral1/files/0x0006000000015fe9-185.dat	upx
behavioral1/files/0x00060000000161e7-182.dat	upx
behavioral1/files/0x000600000001630b-186.dat	upx
behavioral1/files/0x0006000000016117-179.dat	upx
behavioral1/files/0x0006000000015f6d-170.dat	upx
behavioral1/files/0x0006000000015e3a-157.dat	upx
behavioral1/files/0x0031000000014454-161.dat	upx
behavioral1/memory/2536-137-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2740-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0006000000015d8f-134.dat	upx
behavioral1/files/0x0006000000015d67-116.dat	upx
behavioral1/files/0x0006000000015d9b-148.dat	upx
behavioral1/files/0x0006000000015d56-94.dat	upx
behavioral1/files/0x0006000000015d28-89.dat	upx
behavioral1/memory/2656-132-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/3016-130-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2548-128-0x000000013F140000-0x000000013F532000-memory.dmp	upx
behavioral1/memory/2652-125-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0006000000015d6f-110.dat	upx
behavioral1/files/0x0006000000015ceb-79.dat	upx
behavioral1/files/0x0006000000015d5e-100.dat	upx
behavioral1/files/0x0006000000015d4a-92.dat	upx
behavioral1/files/0x0006000000015ca6-59.dat	upx
behavioral1/files/0x000800000001568c-48.dat	upx
behavioral1/files/0x0007000000014857-43.dat	upx
behavioral1/files/0x00090000000146e6-28.dat	upx
behavioral1/memory/2516-19-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0007000000004e76-23.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NwuRooC.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lOPDuXt.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\YFfqDXP.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\OEjgAzV.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\XrqYhZL.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ZjEqSCD.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\VPNNJJS.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\eGmREfi.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\bmmiLUT.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ULsRemS.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\ILThKvH.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\lhVmTLk.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\wMQfgcI.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vHRhlWI.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vEeejtG.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\fXGbtdo.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\PuzgtkL.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\VDknhEk.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\VlYFJDW.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\gEwXDmR.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\GRZRqgy.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vaTmabe.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\pmDPqPI.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\wAmIlJL.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\UmwXhWU.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\SAPxTPv.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\UwZNjQI.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\BreAcAo.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\xfJKxGU.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\XBJfzRr.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\DhdGJUN.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\EwYwEWN.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\QgvxkNB.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\uTiQOOQ.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JJoBpBq.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\sfqEZvu.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JrplbGQ.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\wqGnlyp.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\yBaXQgN.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\FFOORSz.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JLaROJH.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\tWGMQgh.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\tGzKSYX.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\NgbvAIE.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\bHTfQSh.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\Konrogq.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\OQBmnNg.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\GLMUZKJ.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vtwDiTY.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\InyCcZu.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\JTFttgw.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\jqrDNKT.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\hTQSJqw.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\YZQhbmf.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\fElvzVf.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\MiBbOSE.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\QMgdOxg.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\vjkbHba.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\TZZGIxP.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\MzJXVBU.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\KmDXGxx.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\qFmOJwY.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\UFvWeQW.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
File created	C:\Windows\System\pDZxgBK.exe	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2100	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeLockMemoryPrivilege	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2100	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	29
PID 1632 wrote to memory of 2100	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	29
PID 1632 wrote to memory of 2100	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	29
PID 1632 wrote to memory of 1516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	30
PID 1632 wrote to memory of 1516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	30
PID 1632 wrote to memory of 1516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	30
PID 1632 wrote to memory of 2516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2516	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2652	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2652	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2652	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2548	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2548	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2548	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	33
PID 1632 wrote to memory of 3016	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	34
PID 1632 wrote to memory of 3016	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	34
PID 1632 wrote to memory of 3016	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2656	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2656	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2656	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2740	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2740	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2740	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2536	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2536	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2536	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2424	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2424	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2424	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2480	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2480	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2480	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2904	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2904	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2904	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2908	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2908	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2908	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	41
PID 1632 wrote to memory of 1952	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	42
PID 1632 wrote to memory of 1952	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	42
PID 1632 wrote to memory of 1952	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	42
PID 1632 wrote to memory of 2492	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2492	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2492	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2708	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	44
PID 1632 wrote to memory of 2708	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	44
PID 1632 wrote to memory of 2708	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	44
PID 1632 wrote to memory of 2748	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2748	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2748	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	45
PID 1632 wrote to memory of 920	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	46
PID 1632 wrote to memory of 920	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	46
PID 1632 wrote to memory of 920	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	46
PID 1632 wrote to memory of 1860	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1860	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1860	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1104	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1104	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1104	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	48
PID 1632 wrote to memory of 2032	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2032	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2032	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	49
PID 1632 wrote to memory of 2352	1632	0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0764332d6adc0f1ffe16caa8d5ad60ab_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\System\wxvyjXz.exe
  C:\Windows\System\wxvyjXz.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\JTFttgw.exe
  C:\Windows\System\JTFttgw.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\DdYdUxq.exe
  C:\Windows\System\DdYdUxq.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\EZhoPCU.exe
  C:\Windows\System\EZhoPCU.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\yZrzATB.exe
  C:\Windows\System\yZrzATB.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\RbteIoH.exe
  C:\Windows\System\RbteIoH.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\ODZkiyF.exe
  C:\Windows\System\ODZkiyF.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\IlwAVkb.exe
  C:\Windows\System\IlwAVkb.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\RwdTmQr.exe
  C:\Windows\System\RwdTmQr.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ZRgHVDm.exe
  C:\Windows\System\ZRgHVDm.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\hXQZKWc.exe
  C:\Windows\System\hXQZKWc.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\yZtXiKC.exe
  C:\Windows\System\yZtXiKC.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\wSVYXEI.exe
  C:\Windows\System\wSVYXEI.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\RcFxgOr.exe
  C:\Windows\System\RcFxgOr.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\tftdxuT.exe
  C:\Windows\System\tftdxuT.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\yzFZyBu.exe
  C:\Windows\System\yzFZyBu.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\VvvbNpY.exe
  C:\Windows\System\VvvbNpY.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\tTzdwCC.exe
  C:\Windows\System\tTzdwCC.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\CBHIDQy.exe
  C:\Windows\System\CBHIDQy.exe
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\System\dqpwUlQ.exe
  C:\Windows\System\dqpwUlQ.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\SlfoXks.exe
  C:\Windows\System\SlfoXks.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\VlYFJDW.exe
  C:\Windows\System\VlYFJDW.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\FSEMzVD.exe
  C:\Windows\System\FSEMzVD.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\lnWqMiC.exe
  C:\Windows\System\lnWqMiC.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\KzMspDL.exe
  C:\Windows\System\KzMspDL.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\GGRJqXG.exe
  C:\Windows\System\GGRJqXG.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JRZUyRa.exe
  C:\Windows\System\JRZUyRa.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\sdtggqF.exe
  C:\Windows\System\sdtggqF.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\xXbbEBQ.exe
  C:\Windows\System\xXbbEBQ.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\nBHhOgO.exe
  C:\Windows\System\nBHhOgO.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\CPXkuyk.exe
  C:\Windows\System\CPXkuyk.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\wbtquwe.exe
  C:\Windows\System\wbtquwe.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\WBNmviF.exe
  C:\Windows\System\WBNmviF.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\sfqEZvu.exe
  C:\Windows\System\sfqEZvu.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\FkEEAhU.exe
  C:\Windows\System\FkEEAhU.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\VPNNJJS.exe
  C:\Windows\System\VPNNJJS.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ZIPsjIC.exe
  C:\Windows\System\ZIPsjIC.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\TogFaUv.exe
  C:\Windows\System\TogFaUv.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\hVcwCmU.exe
  C:\Windows\System\hVcwCmU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\kwrYnTl.exe
  C:\Windows\System\kwrYnTl.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\IOcHNNx.exe
  C:\Windows\System\IOcHNNx.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\YSFPACo.exe
  C:\Windows\System\YSFPACo.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\dSsXpRY.exe
  C:\Windows\System\dSsXpRY.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\qHNLiyF.exe
  C:\Windows\System\qHNLiyF.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\HrzBQhF.exe
  C:\Windows\System\HrzBQhF.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\aAXGRNL.exe
  C:\Windows\System\aAXGRNL.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\LpGHPeb.exe
  C:\Windows\System\LpGHPeb.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\NwuRooC.exe
  C:\Windows\System\NwuRooC.exe
  2⤵
  PID:1748
- C:\Windows\System\LnGepou.exe
  C:\Windows\System\LnGepou.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ZMkuBxF.exe
  C:\Windows\System\ZMkuBxF.exe
  2⤵
  PID:1572
- C:\Windows\System\qVHeiVM.exe
  C:\Windows\System\qVHeiVM.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\TZZGIxP.exe
  C:\Windows\System\TZZGIxP.exe
  2⤵
  PID:1520
- C:\Windows\System\BGBcXnj.exe
  C:\Windows\System\BGBcXnj.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\yqbYQgi.exe
  C:\Windows\System\yqbYQgi.exe
  2⤵
  PID:1720
- C:\Windows\System\VnICAAW.exe
  C:\Windows\System\VnICAAW.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\uWQXlaa.exe
  C:\Windows\System\uWQXlaa.exe
  2⤵
  PID:2564
- C:\Windows\System\LFJcjIr.exe
  C:\Windows\System\LFJcjIr.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\gEwXDmR.exe
  C:\Windows\System\gEwXDmR.exe
  2⤵
  PID:2584
- C:\Windows\System\RJXQyef.exe
  C:\Windows\System\RJXQyef.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\rgAMrvx.exe
  C:\Windows\System\rgAMrvx.exe
  2⤵
  PID:2608
- C:\Windows\System\FsZNOeo.exe
  C:\Windows\System\FsZNOeo.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\BomMcSl.exe
  C:\Windows\System\BomMcSl.exe
  2⤵
  PID:2468
- C:\Windows\System\oVUOpNg.exe
  C:\Windows\System\oVUOpNg.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\kuoVueF.exe
  C:\Windows\System\kuoVueF.exe
  2⤵
  PID:2312
- C:\Windows\System\xfJKxGU.exe
  C:\Windows\System\xfJKxGU.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\XIDvCvF.exe
  C:\Windows\System\XIDvCvF.exe
  2⤵
  PID:2764
- C:\Windows\System\OLfcpjE.exe
  C:\Windows\System\OLfcpjE.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\yduTlyg.exe
  C:\Windows\System\yduTlyg.exe
  2⤵
  PID:3032
- C:\Windows\System\JrplbGQ.exe
  C:\Windows\System\JrplbGQ.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\tqINDuw.exe
  C:\Windows\System\tqINDuw.exe
  2⤵
  PID:2692
- C:\Windows\System\cDMbcqq.exe
  C:\Windows\System\cDMbcqq.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\dikLKmj.exe
  C:\Windows\System\dikLKmj.exe
  2⤵
  PID:1624
- C:\Windows\System\MqZAwoM.exe
  C:\Windows\System\MqZAwoM.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\zamVqDy.exe
  C:\Windows\System\zamVqDy.exe
  2⤵
  PID:1640
- C:\Windows\System\vqmgZpi.exe
  C:\Windows\System\vqmgZpi.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\OSSljnm.exe
  C:\Windows\System\OSSljnm.exe
  2⤵
  PID:2060
- C:\Windows\System\dtNaWAs.exe
  C:\Windows\System\dtNaWAs.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\KCTQuLs.exe
  C:\Windows\System\KCTQuLs.exe
  2⤵
  PID:688
- C:\Windows\System\oSqXdMC.exe
  C:\Windows\System\oSqXdMC.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\JYzeWzO.exe
  C:\Windows\System\JYzeWzO.exe
  2⤵
  PID:820
- C:\Windows\System\fLowfDq.exe
  C:\Windows\System\fLowfDq.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\KXndvom.exe
  C:\Windows\System\KXndvom.exe
  2⤵
  PID:448
- C:\Windows\System\cIoqNfK.exe
  C:\Windows\System\cIoqNfK.exe
  2⤵
  PID:964
- C:\Windows\System\nOuepxH.exe
  C:\Windows\System\nOuepxH.exe
  2⤵
  PID:2132
- C:\Windows\System\MFETLFl.exe
  C:\Windows\System\MFETLFl.exe
  2⤵
  PID:1736
- C:\Windows\System\aKVFMkY.exe
  C:\Windows\System\aKVFMkY.exe
  2⤵
  PID:1668
- C:\Windows\System\aOOGfUJ.exe
  C:\Windows\System\aOOGfUJ.exe
  2⤵
  PID:1948
- C:\Windows\System\zTCtYDl.exe
  C:\Windows\System\zTCtYDl.exe
  2⤵
  PID:1680
- C:\Windows\System\oPXPgWu.exe
  C:\Windows\System\oPXPgWu.exe
  2⤵
  PID:1732
- C:\Windows\System\YzpRQXa.exe
  C:\Windows\System\YzpRQXa.exe
  2⤵
  PID:2580
- C:\Windows\System\JkxKFps.exe
  C:\Windows\System\JkxKFps.exe
  2⤵
  PID:2456
- C:\Windows\System\XdKwrru.exe
  C:\Windows\System\XdKwrru.exe
  2⤵
  PID:1400
- C:\Windows\System\LkcLpfM.exe
  C:\Windows\System\LkcLpfM.exe
  2⤵
  PID:2704
- C:\Windows\System\reAblcI.exe
  C:\Windows\System\reAblcI.exe
  2⤵
  PID:2300
- C:\Windows\System\HXKkLyH.exe
  C:\Windows\System\HXKkLyH.exe
  2⤵
  PID:2276
- C:\Windows\System\PFSwkoN.exe
  C:\Windows\System\PFSwkoN.exe
  2⤵
  PID:2776
- C:\Windows\System\stCCoNC.exe
  C:\Windows\System\stCCoNC.exe
  2⤵
  PID:3088
- C:\Windows\System\szEnpef.exe
  C:\Windows\System\szEnpef.exe
  2⤵
  PID:3104
- C:\Windows\System\rkeYNqb.exe
  C:\Windows\System\rkeYNqb.exe
  2⤵
  PID:3120
- C:\Windows\System\VcMZGwG.exe
  C:\Windows\System\VcMZGwG.exe
  2⤵
  PID:3136
- C:\Windows\System\YXKOTlv.exe
  C:\Windows\System\YXKOTlv.exe
  2⤵
  PID:3152
- C:\Windows\System\UJNETJo.exe
  C:\Windows\System\UJNETJo.exe
  2⤵
  PID:3168
- C:\Windows\System\HiretLu.exe
  C:\Windows\System\HiretLu.exe
  2⤵
  PID:3184
- C:\Windows\System\AwLIYRZ.exe
  C:\Windows\System\AwLIYRZ.exe
  2⤵
  PID:3200
- C:\Windows\System\eQIGkmo.exe
  C:\Windows\System\eQIGkmo.exe
  2⤵
  PID:3216
- C:\Windows\System\ildoQXb.exe
  C:\Windows\System\ildoQXb.exe
  2⤵
  PID:3232
- C:\Windows\System\IrUFBTE.exe
  C:\Windows\System\IrUFBTE.exe
  2⤵
  PID:3248
- C:\Windows\System\Konrogq.exe
  C:\Windows\System\Konrogq.exe
  2⤵
  PID:3264
- C:\Windows\System\bJakONq.exe
  C:\Windows\System\bJakONq.exe
  2⤵
  PID:3280
- C:\Windows\System\olZgPzt.exe
  C:\Windows\System\olZgPzt.exe
  2⤵
  PID:3296
- C:\Windows\System\kdNueKK.exe
  C:\Windows\System\kdNueKK.exe
  2⤵
  PID:3312
- C:\Windows\System\BKNRSYu.exe
  C:\Windows\System\BKNRSYu.exe
  2⤵
  PID:3328
- C:\Windows\System\XBJfzRr.exe
  C:\Windows\System\XBJfzRr.exe
  2⤵
  PID:3348
- C:\Windows\System\NqLLVvK.exe
  C:\Windows\System\NqLLVvK.exe
  2⤵
  PID:3364
- C:\Windows\System\rOAdEwA.exe
  C:\Windows\System\rOAdEwA.exe
  2⤵
  PID:3380
- C:\Windows\System\jSxMzgd.exe
  C:\Windows\System\jSxMzgd.exe
  2⤵
  PID:3396
- C:\Windows\System\EOgaSme.exe
  C:\Windows\System\EOgaSme.exe
  2⤵
  PID:3412
- C:\Windows\System\NRiwqff.exe
  C:\Windows\System\NRiwqff.exe
  2⤵
  PID:3428
- C:\Windows\System\SGmitAO.exe
  C:\Windows\System\SGmitAO.exe
  2⤵
  PID:3444
- C:\Windows\System\fhQYBDa.exe
  C:\Windows\System\fhQYBDa.exe
  2⤵
  PID:3460
- C:\Windows\System\ZBsSogD.exe
  C:\Windows\System\ZBsSogD.exe
  2⤵
  PID:3476
- C:\Windows\System\sWqLzYk.exe
  C:\Windows\System\sWqLzYk.exe
  2⤵
  PID:3492
- C:\Windows\System\SxdNCTr.exe
  C:\Windows\System\SxdNCTr.exe
  2⤵
  PID:3508
- C:\Windows\System\OQBmnNg.exe
  C:\Windows\System\OQBmnNg.exe
  2⤵
  PID:3524
- C:\Windows\System\OYxqnFp.exe
  C:\Windows\System\OYxqnFp.exe
  2⤵
  PID:3540
- C:\Windows\System\OEjgAzV.exe
  C:\Windows\System\OEjgAzV.exe
  2⤵
  PID:3556
- C:\Windows\System\LrmGAcz.exe
  C:\Windows\System\LrmGAcz.exe
  2⤵
  PID:3572
- C:\Windows\System\UFvWeQW.exe
  C:\Windows\System\UFvWeQW.exe
  2⤵
  PID:3588
- C:\Windows\System\lhlyekk.exe
  C:\Windows\System\lhlyekk.exe
  2⤵
  PID:3604
- C:\Windows\System\aoAgDTP.exe
  C:\Windows\System\aoAgDTP.exe
  2⤵
  PID:3620
- C:\Windows\System\DnJNHgY.exe
  C:\Windows\System\DnJNHgY.exe
  2⤵
  PID:3636
- C:\Windows\System\sIYrxbc.exe
  C:\Windows\System\sIYrxbc.exe
  2⤵
  PID:3652
- C:\Windows\System\yzRyBRw.exe
  C:\Windows\System\yzRyBRw.exe
  2⤵
  PID:3668
- C:\Windows\System\VJrcHOg.exe
  C:\Windows\System\VJrcHOg.exe
  2⤵
  PID:3684
- C:\Windows\System\mIDrFge.exe
  C:\Windows\System\mIDrFge.exe
  2⤵
  PID:3700
- C:\Windows\System\BRnDLQg.exe
  C:\Windows\System\BRnDLQg.exe
  2⤵
  PID:3716
- C:\Windows\System\HLpltZA.exe
  C:\Windows\System\HLpltZA.exe
  2⤵
  PID:3732
- C:\Windows\System\makJArr.exe
  C:\Windows\System\makJArr.exe
  2⤵
  PID:3748
- C:\Windows\System\AroWHtU.exe
  C:\Windows\System\AroWHtU.exe
  2⤵
  PID:3764
- C:\Windows\System\XGIETWd.exe
  C:\Windows\System\XGIETWd.exe
  2⤵
  PID:3780
- C:\Windows\System\hxwLQwy.exe
  C:\Windows\System\hxwLQwy.exe
  2⤵
  PID:3796
- C:\Windows\System\rbioxhv.exe
  C:\Windows\System\rbioxhv.exe
  2⤵
  PID:3812
- C:\Windows\System\rYcrcAw.exe
  C:\Windows\System\rYcrcAw.exe
  2⤵
  PID:3828
- C:\Windows\System\iiXeixc.exe
  C:\Windows\System\iiXeixc.exe
  2⤵
  PID:3844
- C:\Windows\System\CSulAPv.exe
  C:\Windows\System\CSulAPv.exe
  2⤵
  PID:3860
- C:\Windows\System\aZFETGD.exe
  C:\Windows\System\aZFETGD.exe
  2⤵
  PID:3876
- C:\Windows\System\rwRTUxG.exe
  C:\Windows\System\rwRTUxG.exe
  2⤵
  PID:3892
- C:\Windows\System\NNMtPTd.exe
  C:\Windows\System\NNMtPTd.exe
  2⤵
  PID:3908
- C:\Windows\System\VOYsQyz.exe
  C:\Windows\System\VOYsQyz.exe
  2⤵
  PID:3924
- C:\Windows\System\wrSmded.exe
  C:\Windows\System\wrSmded.exe
  2⤵
  PID:3940
- C:\Windows\System\flAAUJH.exe
  C:\Windows\System\flAAUJH.exe
  2⤵
  PID:3956
- C:\Windows\System\fkWgAVF.exe
  C:\Windows\System\fkWgAVF.exe
  2⤵
  PID:3972
- C:\Windows\System\yrijqLc.exe
  C:\Windows\System\yrijqLc.exe
  2⤵
  PID:3988
- C:\Windows\System\latcqas.exe
  C:\Windows\System\latcqas.exe
  2⤵
  PID:4004
- C:\Windows\System\vMxKHUi.exe
  C:\Windows\System\vMxKHUi.exe
  2⤵
  PID:4020
- C:\Windows\System\TsfJIRP.exe
  C:\Windows\System\TsfJIRP.exe
  2⤵
  PID:4036
- C:\Windows\System\jDUxyGR.exe
  C:\Windows\System\jDUxyGR.exe
  2⤵
  PID:4052
- C:\Windows\System\kifdGKh.exe
  C:\Windows\System\kifdGKh.exe
  2⤵
  PID:4068
- C:\Windows\System\kLjkucq.exe
  C:\Windows\System\kLjkucq.exe
  2⤵
  PID:4084
- C:\Windows\System\HBDUusB.exe
  C:\Windows\System\HBDUusB.exe
  2⤵
  PID:2016
- C:\Windows\System\yNcmjtl.exe
  C:\Windows\System\yNcmjtl.exe
  2⤵
  PID:1032
- C:\Windows\System\ftBFCdp.exe
  C:\Windows\System\ftBFCdp.exe
  2⤵
  PID:2040
- C:\Windows\System\nPwmPAD.exe
  C:\Windows\System\nPwmPAD.exe
  2⤵
  PID:1248
- C:\Windows\System\hBJNtct.exe
  C:\Windows\System\hBJNtct.exe
  2⤵
  PID:3096
- C:\Windows\System\SAIKsSa.exe
  C:\Windows\System\SAIKsSa.exe
  2⤵
  PID:3160
- C:\Windows\System\aFWsPYM.exe
  C:\Windows\System\aFWsPYM.exe
  2⤵
  PID:2968
- C:\Windows\System\lmrgyBA.exe
  C:\Windows\System\lmrgyBA.exe
  2⤵
  PID:2420
- C:\Windows\System\TCNaZTz.exe
  C:\Windows\System\TCNaZTz.exe
  2⤵
  PID:1304
- C:\Windows\System\GRZRqgy.exe
  C:\Windows\System\GRZRqgy.exe
  2⤵
  PID:1724
- C:\Windows\System\SlQYMBr.exe
  C:\Windows\System\SlQYMBr.exe
  2⤵
  PID:3256
- C:\Windows\System\uMvrWcB.exe
  C:\Windows\System\uMvrWcB.exe
  2⤵
  PID:3320
- C:\Windows\System\fYCEJgW.exe
  C:\Windows\System\fYCEJgW.exe
  2⤵
  PID:3356
- C:\Windows\System\mAZKYkA.exe
  C:\Windows\System\mAZKYkA.exe
  2⤵
  PID:3420
- C:\Windows\System\xfZaIeq.exe
  C:\Windows\System\xfZaIeq.exe
  2⤵
  PID:3484
- C:\Windows\System\tduevZX.exe
  C:\Windows\System\tduevZX.exe
  2⤵
  PID:3548
- C:\Windows\System\spfAQka.exe
  C:\Windows\System\spfAQka.exe
  2⤵
  PID:3612
- C:\Windows\System\LONNnsQ.exe
  C:\Windows\System\LONNnsQ.exe
  2⤵
  PID:3676
- C:\Windows\System\MzJXVBU.exe
  C:\Windows\System\MzJXVBU.exe
  2⤵
  PID:2356
- C:\Windows\System\VdMffOF.exe
  C:\Windows\System\VdMffOF.exe
  2⤵
  PID:3740
- C:\Windows\System\XrqYhZL.exe
  C:\Windows\System\XrqYhZL.exe
  2⤵
  PID:3804
- C:\Windows\System\eBqvwVf.exe
  C:\Windows\System\eBqvwVf.exe
  2⤵
  PID:3868
- C:\Windows\System\FwqpuQs.exe
  C:\Windows\System\FwqpuQs.exe
  2⤵
  PID:3932
- C:\Windows\System\rdVzoCV.exe
  C:\Windows\System\rdVzoCV.exe
  2⤵
  PID:3996
- C:\Windows\System\GVXwNMa.exe
  C:\Windows\System\GVXwNMa.exe
  2⤵
  PID:2812
- C:\Windows\System\fBEHnKP.exe
  C:\Windows\System\fBEHnKP.exe
  2⤵
  PID:4064
- C:\Windows\System\OmHeTRY.exe
  C:\Windows\System\OmHeTRY.exe
  2⤵
  PID:2624
- C:\Windows\System\ZiGhnIZ.exe
  C:\Windows\System\ZiGhnIZ.exe
  2⤵
  PID:2680
- C:\Windows\System\SzjpJAb.exe
  C:\Windows\System\SzjpJAb.exe
  2⤵
  PID:592
- C:\Windows\System\ZNRiVrW.exe
  C:\Windows\System\ZNRiVrW.exe
  2⤵
  PID:3224
- C:\Windows\System\GACUmWs.exe
  C:\Windows\System\GACUmWs.exe
  2⤵
  PID:3324
- C:\Windows\System\WZZDmRZ.exe
  C:\Windows\System\WZZDmRZ.exe
  2⤵
  PID:3580
- C:\Windows\System\RtByeFx.exe
  C:\Windows\System\RtByeFx.exe
  2⤵
  PID:1912
- C:\Windows\System\dmdrYbH.exe
  C:\Windows\System\dmdrYbH.exe
  2⤵
  PID:2944
- C:\Windows\System\bNNcQhe.exe
  C:\Windows\System\bNNcQhe.exe
  2⤵
  PID:4000
- C:\Windows\System\acusFul.exe
  C:\Windows\System\acusFul.exe
  2⤵
  PID:2972
- C:\Windows\System\aDnjjiO.exe
  C:\Windows\System\aDnjjiO.exe
  2⤵
  PID:4104
- C:\Windows\System\VZJlUrZ.exe
  C:\Windows\System\VZJlUrZ.exe
  2⤵
  PID:4120
- C:\Windows\System\ILThKvH.exe
  C:\Windows\System\ILThKvH.exe
  2⤵
  PID:4136
- C:\Windows\System\FcMcrjs.exe
  C:\Windows\System\FcMcrjs.exe
  2⤵
  PID:4152
- C:\Windows\System\CthvsWy.exe
  C:\Windows\System\CthvsWy.exe
  2⤵
  PID:4168
- C:\Windows\System\mkiTnUM.exe
  C:\Windows\System\mkiTnUM.exe
  2⤵
  PID:4184
- C:\Windows\System\kypAzyG.exe
  C:\Windows\System\kypAzyG.exe
  2⤵
  PID:4200
- C:\Windows\System\DCQfyII.exe
  C:\Windows\System\DCQfyII.exe
  2⤵
  PID:4220
- C:\Windows\System\jqrDNKT.exe
  C:\Windows\System\jqrDNKT.exe
  2⤵
  PID:4236
- C:\Windows\System\SDOemrR.exe
  C:\Windows\System\SDOemrR.exe
  2⤵
  PID:4252
- C:\Windows\System\VwWVjKZ.exe
  C:\Windows\System\VwWVjKZ.exe
  2⤵
  PID:4268
- C:\Windows\System\emUTkFd.exe
  C:\Windows\System\emUTkFd.exe
  2⤵
  PID:4284
- C:\Windows\System\xqzgWaX.exe
  C:\Windows\System\xqzgWaX.exe
  2⤵
  PID:4300
- C:\Windows\System\cOdPHQv.exe
  C:\Windows\System\cOdPHQv.exe
  2⤵
  PID:4316
- C:\Windows\System\AAeZbIt.exe
  C:\Windows\System\AAeZbIt.exe
  2⤵
  PID:4332
- C:\Windows\System\lhVmTLk.exe
  C:\Windows\System\lhVmTLk.exe
  2⤵
  PID:4348
- C:\Windows\System\PMDpEim.exe
  C:\Windows\System\PMDpEim.exe
  2⤵
  PID:4364
- C:\Windows\System\rFIEkWG.exe
  C:\Windows\System\rFIEkWG.exe
  2⤵
  PID:4380
- C:\Windows\System\WTNfgOh.exe
  C:\Windows\System\WTNfgOh.exe
  2⤵
  PID:4396
- C:\Windows\System\wMQfgcI.exe
  C:\Windows\System\wMQfgcI.exe
  2⤵
  PID:4412
- C:\Windows\System\pDZxgBK.exe
  C:\Windows\System\pDZxgBK.exe
  2⤵
  PID:4428
- C:\Windows\System\cXrfCJB.exe
  C:\Windows\System\cXrfCJB.exe
  2⤵
  PID:4444
- C:\Windows\System\kabigVm.exe
  C:\Windows\System\kabigVm.exe
  2⤵
  PID:4460
- C:\Windows\System\vaTmabe.exe
  C:\Windows\System\vaTmabe.exe
  2⤵
  PID:4476
- C:\Windows\System\unmXfBf.exe
  C:\Windows\System\unmXfBf.exe
  2⤵
  PID:4492
- C:\Windows\System\dToSowP.exe
  C:\Windows\System\dToSowP.exe
  2⤵
  PID:4508
- C:\Windows\System\wqGnlyp.exe
  C:\Windows\System\wqGnlyp.exe
  2⤵
  PID:4524
- C:\Windows\System\VjwVzfE.exe
  C:\Windows\System\VjwVzfE.exe
  2⤵
  PID:4540
- C:\Windows\System\qyeDonS.exe
  C:\Windows\System\qyeDonS.exe
  2⤵
  PID:4556
- C:\Windows\System\docbhvQ.exe
  C:\Windows\System\docbhvQ.exe
  2⤵
  PID:4572
- C:\Windows\System\jtZmjAR.exe
  C:\Windows\System\jtZmjAR.exe
  2⤵
  PID:4588
- C:\Windows\System\pbgPJtU.exe
  C:\Windows\System\pbgPJtU.exe
  2⤵
  PID:4604
- C:\Windows\System\JqyWauz.exe
  C:\Windows\System\JqyWauz.exe
  2⤵
  PID:4620
- C:\Windows\System\KSFItyl.exe
  C:\Windows\System\KSFItyl.exe
  2⤵
  PID:4636
- C:\Windows\System\MexVkAP.exe
  C:\Windows\System\MexVkAP.exe
  2⤵
  PID:4652
- C:\Windows\System\AyIHKFQ.exe
  C:\Windows\System\AyIHKFQ.exe
  2⤵
  PID:4668
- C:\Windows\System\DZTWTRR.exe
  C:\Windows\System\DZTWTRR.exe
  2⤵
  PID:4684
- C:\Windows\System\hGfeFom.exe
  C:\Windows\System\hGfeFom.exe
  2⤵
  PID:4700
- C:\Windows\System\lnWuMeY.exe
  C:\Windows\System\lnWuMeY.exe
  2⤵
  PID:4716
- C:\Windows\System\WspHSpb.exe
  C:\Windows\System\WspHSpb.exe
  2⤵
  PID:4732
- C:\Windows\System\vEeejtG.exe
  C:\Windows\System\vEeejtG.exe
  2⤵
  PID:4752
- C:\Windows\System\CdjHbXM.exe
  C:\Windows\System\CdjHbXM.exe
  2⤵
  PID:4768
- C:\Windows\System\LIqpbjK.exe
  C:\Windows\System\LIqpbjK.exe
  2⤵
  PID:4784
- C:\Windows\System\SVQOHUw.exe
  C:\Windows\System\SVQOHUw.exe
  2⤵
  PID:4816
- C:\Windows\System\UFwKCHz.exe
  C:\Windows\System\UFwKCHz.exe
  2⤵
  PID:4832
- C:\Windows\System\svLDRIb.exe
  C:\Windows\System\svLDRIb.exe
  2⤵
  PID:4848
- C:\Windows\System\KRiCxry.exe
  C:\Windows\System\KRiCxry.exe
  2⤵
  PID:4864
- C:\Windows\System\aVrsKoM.exe
  C:\Windows\System\aVrsKoM.exe
  2⤵
  PID:4880
- C:\Windows\System\DzQwZvn.exe
  C:\Windows\System\DzQwZvn.exe
  2⤵
  PID:4896
- C:\Windows\System\Jwrizrh.exe
  C:\Windows\System\Jwrizrh.exe
  2⤵
  PID:4912
- C:\Windows\System\JaDLUbc.exe
  C:\Windows\System\JaDLUbc.exe
  2⤵
  PID:4928
- C:\Windows\System\wAmIlJL.exe
  C:\Windows\System\wAmIlJL.exe
  2⤵
  PID:4944
- C:\Windows\System\fXGbtdo.exe
  C:\Windows\System\fXGbtdo.exe
  2⤵
  PID:4960
- C:\Windows\System\dheqENR.exe
  C:\Windows\System\dheqENR.exe
  2⤵
  PID:4976
- C:\Windows\System\qXjLHSi.exe
  C:\Windows\System\qXjLHSi.exe
  2⤵
  PID:4992
- C:\Windows\System\aZJoXJH.exe
  C:\Windows\System\aZJoXJH.exe
  2⤵
  PID:5008
- C:\Windows\System\BqbVdZw.exe
  C:\Windows\System\BqbVdZw.exe
  2⤵
  PID:5024
- C:\Windows\System\CYEtCJR.exe
  C:\Windows\System\CYEtCJR.exe
  2⤵
  PID:5040
- C:\Windows\System\DsPSTnq.exe
  C:\Windows\System\DsPSTnq.exe
  2⤵
  PID:5056
- C:\Windows\System\dONAmPu.exe
  C:\Windows\System\dONAmPu.exe
  2⤵
  PID:5072
- C:\Windows\System\VTmMOyV.exe
  C:\Windows\System\VTmMOyV.exe
  2⤵
  PID:5088
- C:\Windows\System\WPLwJkh.exe
  C:\Windows\System\WPLwJkh.exe
  2⤵
  PID:5104
- C:\Windows\System\HDBCpMm.exe
  C:\Windows\System\HDBCpMm.exe
  2⤵
  PID:1816
- C:\Windows\System\rvWKayG.exe
  C:\Windows\System\rvWKayG.exe
  2⤵
  PID:3904
- C:\Windows\System\JiDocDP.exe
  C:\Windows\System\JiDocDP.exe
  2⤵
  PID:4132
- C:\Windows\System\SQYLfib.exe
  C:\Windows\System\SQYLfib.exe
  2⤵
  PID:4196
- C:\Windows\System\gNtBTKe.exe
  C:\Windows\System\gNtBTKe.exe
  2⤵
  PID:4264
- C:\Windows\System\nHxRwYX.exe
  C:\Windows\System\nHxRwYX.exe
  2⤵
  PID:4328
- C:\Windows\System\mEaVZUV.exe
  C:\Windows\System\mEaVZUV.exe
  2⤵
  PID:4392
- C:\Windows\System\RlFqYhG.exe
  C:\Windows\System\RlFqYhG.exe
  2⤵
  PID:4456
- C:\Windows\System\DhdGJUN.exe
  C:\Windows\System\DhdGJUN.exe
  2⤵
  PID:4520
- C:\Windows\System\zycqYys.exe
  C:\Windows\System\zycqYys.exe
  2⤵
  PID:4584
- C:\Windows\System\AOgbIYs.exe
  C:\Windows\System\AOgbIYs.exe
  2⤵
  PID:4648
- C:\Windows\System\GLMUZKJ.exe
  C:\Windows\System\GLMUZKJ.exe
  2⤵
  PID:4712
- C:\Windows\System\vVIirYv.exe
  C:\Windows\System\vVIirYv.exe
  2⤵
  PID:2140
- C:\Windows\System\VfwLrQZ.exe
  C:\Windows\System\VfwLrQZ.exe
  2⤵
  PID:2336
- C:\Windows\System\nXyemQj.exe
  C:\Windows\System\nXyemQj.exe
  2⤵
  PID:1972
- C:\Windows\System\fgpREkq.exe
  C:\Windows\System\fgpREkq.exe
  2⤵
  PID:1648
- C:\Windows\System\YZHBbJc.exe
  C:\Windows\System\YZHBbJc.exe
  2⤵
  PID:2616
- C:\Windows\System\wtcAVtn.exe
  C:\Windows\System\wtcAVtn.exe
  2⤵
  PID:4744
- C:\Windows\System\CmopvLy.exe
  C:\Windows\System\CmopvLy.exe
  2⤵
  PID:2008
- C:\Windows\System\UafSdab.exe
  C:\Windows\System\UafSdab.exe
  2⤵
  PID:784
- C:\Windows\System\XvhNaPM.exe
  C:\Windows\System\XvhNaPM.exe
  2⤵
  PID:5128
- C:\Windows\System\OypSeUQ.exe
  C:\Windows\System\OypSeUQ.exe
  2⤵
  PID:5144
- C:\Windows\System\pUCRVip.exe
  C:\Windows\System\pUCRVip.exe
  2⤵
  PID:5160
- C:\Windows\System\SDRQxaJ.exe
  C:\Windows\System\SDRQxaJ.exe
  2⤵
  PID:5176
- C:\Windows\System\CwJbrcm.exe
  C:\Windows\System\CwJbrcm.exe
  2⤵
  PID:5192
- C:\Windows\System\BOFwsyv.exe
  C:\Windows\System\BOFwsyv.exe
  2⤵
  PID:5632
- C:\Windows\System\eGmREfi.exe
  C:\Windows\System\eGmREfi.exe
  2⤵
  PID:5680
- C:\Windows\System\FFOORSz.exe
  C:\Windows\System\FFOORSz.exe
  2⤵
  PID:5696
- C:\Windows\System\lOPDuXt.exe
  C:\Windows\System\lOPDuXt.exe
  2⤵
  PID:5712
- C:\Windows\System\KmDXGxx.exe
  C:\Windows\System\KmDXGxx.exe
  2⤵
  PID:5728
- C:\Windows\System\HVhBqOI.exe
  C:\Windows\System\HVhBqOI.exe
  2⤵
  PID:5744
- C:\Windows\System\kHotAyq.exe
  C:\Windows\System\kHotAyq.exe
  2⤵
  PID:5796
- C:\Windows\System\ujcqwqO.exe
  C:\Windows\System\ujcqwqO.exe
  2⤵
  PID:5840
- C:\Windows\System\REEnGWn.exe
  C:\Windows\System\REEnGWn.exe
  2⤵
  PID:5876
- C:\Windows\System\mSNjRpc.exe
  C:\Windows\System\mSNjRpc.exe
  2⤵
  PID:5904
- C:\Windows\System\kaedZye.exe
  C:\Windows\System\kaedZye.exe
  2⤵
  PID:6024
- C:\Windows\System\yRuSgGN.exe
  C:\Windows\System\yRuSgGN.exe
  2⤵
  PID:6092
- C:\Windows\System\OlHfgXE.exe
  C:\Windows\System\OlHfgXE.exe
  2⤵
  PID:6108
- C:\Windows\System\GOQOIqh.exe
  C:\Windows\System\GOQOIqh.exe
  2⤵
  PID:6128
- C:\Windows\System\AOeDDpT.exe
  C:\Windows\System\AOeDDpT.exe
  2⤵
  PID:708
- C:\Windows\System\uewHRmO.exe
  C:\Windows\System\uewHRmO.exe
  2⤵
  PID:4824
- C:\Windows\System\PFylvxL.exe
  C:\Windows\System\PFylvxL.exe
  2⤵
  PID:4924
- C:\Windows\System\crjcoMF.exe
  C:\Windows\System\crjcoMF.exe
  2⤵
  PID:5020
- C:\Windows\System\hTQSJqw.exe
  C:\Windows\System\hTQSJqw.exe
  2⤵
  PID:5084
- C:\Windows\System\EwYwEWN.exe
  C:\Windows\System\EwYwEWN.exe
  2⤵
  PID:4128
- C:\Windows\System\zcYTcSc.exe
  C:\Windows\System\zcYTcSc.exe
  2⤵
  PID:4388
- C:\Windows\System\CsAfwaK.exe
  C:\Windows\System\CsAfwaK.exe
  2⤵
  PID:4644
- C:\Windows\System\NcZlJCe.exe
  C:\Windows\System\NcZlJCe.exe
  2⤵
  PID:1920
- C:\Windows\System\ZtWPNMO.exe
  C:\Windows\System\ZtWPNMO.exe
  2⤵
  PID:804
- C:\Windows\System\tXKHJKH.exe
  C:\Windows\System\tXKHJKH.exe
  2⤵
  PID:5156
- C:\Windows\System\YrjMyrH.exe
  C:\Windows\System\YrjMyrH.exe
  2⤵
  PID:5644
- C:\Windows\System\viLMeVM.exe
  C:\Windows\System\viLMeVM.exe
  2⤵
  PID:5664
- C:\Windows\System\VAWNNbO.exe
  C:\Windows\System\VAWNNbO.exe
  2⤵
  PID:5648
- C:\Windows\System\FKLGYKx.exe
  C:\Windows\System\FKLGYKx.exe
  2⤵
  PID:5740
- C:\Windows\System\DefQytP.exe
  C:\Windows\System\DefQytP.exe
  2⤵
  PID:5820
- C:\Windows\System\YZQhbmf.exe
  C:\Windows\System\YZQhbmf.exe
  2⤵
  PID:5836
- C:\Windows\System\QxeqLWQ.exe
  C:\Windows\System\QxeqLWQ.exe
  2⤵
  PID:5896
- C:\Windows\System\ZZdJQNa.exe
  C:\Windows\System\ZZdJQNa.exe
  2⤵
  PID:4840
- C:\Windows\System\xQXuQrk.exe
  C:\Windows\System\xQXuQrk.exe
  2⤵
  PID:4904
- C:\Windows\System\xpyJAmZ.exe
  C:\Windows\System\xpyJAmZ.exe
  2⤵
  PID:4940
- C:\Windows\System\vEgrVtz.exe
  C:\Windows\System\vEgrVtz.exe
  2⤵
  PID:5032
- C:\Windows\System\YHnGArz.exe
  C:\Windows\System\YHnGArz.exe
  2⤵
  PID:2108
- C:\Windows\System\fviRunh.exe
  C:\Windows\System\fviRunh.exe
  2⤵
  PID:1044
- C:\Windows\System\qfOmQaP.exe
  C:\Windows\System\qfOmQaP.exe
  2⤵
  PID:1968
- C:\Windows\System\VrUaqSP.exe
  C:\Windows\System\VrUaqSP.exe
  2⤵
  PID:5992
- C:\Windows\System\XnFPAzl.exe
  C:\Windows\System\XnFPAzl.exe
  2⤵
  PID:1588
- C:\Windows\System\HQQGSFg.exe
  C:\Windows\System\HQQGSFg.exe
  2⤵
  PID:2552
- C:\Windows\System\lpyLhbi.exe
  C:\Windows\System\lpyLhbi.exe
  2⤵
  PID:2472
- C:\Windows\System\gXcfKjf.exe
  C:\Windows\System\gXcfKjf.exe
  2⤵
  PID:2544
- C:\Windows\System\dXEzaGU.exe
  C:\Windows\System\dXEzaGU.exe
  2⤵
  PID:2180
- C:\Windows\System\ArHRDRN.exe
  C:\Windows\System\ArHRDRN.exe
  2⤵
  PID:2112
- C:\Windows\System\Zdxhfvw.exe
  C:\Windows\System\Zdxhfvw.exe
  2⤵
  PID:1780
- C:\Windows\System\dlEevfy.exe
  C:\Windows\System\dlEevfy.exe
  2⤵
  PID:816
- C:\Windows\System\mkzQvlq.exe
  C:\Windows\System\mkzQvlq.exe
  2⤵
  PID:2360
- C:\Windows\System\oNuEaQc.exe
  C:\Windows\System\oNuEaQc.exe
  2⤵
  PID:3628
- C:\Windows\System\sIoVkga.exe
  C:\Windows\System\sIoVkga.exe
  2⤵
  PID:3692
- C:\Windows\System\cVmgZfc.exe
  C:\Windows\System\cVmgZfc.exe
  2⤵
  PID:3756
- C:\Windows\System\wUyhbMk.exe
  C:\Windows\System\wUyhbMk.exe
  2⤵
  PID:3820
- C:\Windows\System\OXsxKsU.exe
  C:\Windows\System\OXsxKsU.exe
  2⤵
  PID:3884
- C:\Windows\System\BreAcAo.exe
  C:\Windows\System\BreAcAo.exe
  2⤵
  PID:3948
- C:\Windows\System\vInLbWt.exe
  C:\Windows\System\vInLbWt.exe
  2⤵
  PID:4012
- C:\Windows\System\mByFxPQ.exe
  C:\Windows\System\mByFxPQ.exe
  2⤵
  PID:4080
- C:\Windows\System\ckNagaW.exe
  C:\Windows\System\ckNagaW.exe
  2⤵
  PID:2512
- C:\Windows\System\mwAsWqQ.exe
  C:\Windows\System\mwAsWqQ.exe
  2⤵
  PID:3192
- C:\Windows\System\lDaAVKC.exe
  C:\Windows\System\lDaAVKC.exe
  2⤵
  PID:3288
- C:\Windows\System\XhLqHie.exe
  C:\Windows\System\XhLqHie.exe
  2⤵
  PID:3516
- C:\Windows\System\UmwXhWU.exe
  C:\Windows\System\UmwXhWU.exe
  2⤵
  PID:3708
- C:\Windows\System\tygJtbM.exe
  C:\Windows\System\tygJtbM.exe
  2⤵
  PID:3964
- C:\Windows\System\ZfmiZKn.exe
  C:\Windows\System\ZfmiZKn.exe
  2⤵
  PID:2092
- C:\Windows\System\OLRYjEZ.exe
  C:\Windows\System\OLRYjEZ.exe
  2⤵
  PID:2396
- C:\Windows\System\eQnTQSo.exe
  C:\Windows\System\eQnTQSo.exe
  2⤵
  PID:428
- C:\Windows\System\LRXULLv.exe
  C:\Windows\System\LRXULLv.exe
  2⤵
  PID:4144
- C:\Windows\System\mdFPqeT.exe
  C:\Windows\System\mdFPqeT.exe
  2⤵
  PID:4208
- C:\Windows\System\bJXCzzV.exe
  C:\Windows\System\bJXCzzV.exe
  2⤵
  PID:4276
- C:\Windows\System\yaqCIhE.exe
  C:\Windows\System\yaqCIhE.exe
  2⤵
  PID:4340
- C:\Windows\System\ylVLiLD.exe
  C:\Windows\System\ylVLiLD.exe
  2⤵
  PID:4404
- C:\Windows\System\PuzgtkL.exe
  C:\Windows\System\PuzgtkL.exe
  2⤵
  PID:4472
- C:\Windows\System\UHXBdCe.exe
  C:\Windows\System\UHXBdCe.exe
  2⤵
  PID:4532
- C:\Windows\System\SapZPLw.exe
  C:\Windows\System\SapZPLw.exe
  2⤵
  PID:4596
- C:\Windows\System\hMJdaCA.exe
  C:\Windows\System\hMJdaCA.exe
  2⤵
  PID:4660
- C:\Windows\System\YNnUOVC.exe
  C:\Windows\System\YNnUOVC.exe
  2⤵
  PID:4724
- C:\Windows\System\pIqDrSS.exe
  C:\Windows\System\pIqDrSS.exe
  2⤵
  PID:4792
- C:\Windows\System\jcXkyXe.exe
  C:\Windows\System\jcXkyXe.exe
  2⤵
  PID:5068
- C:\Windows\System\ASCgnIm.exe
  C:\Windows\System\ASCgnIm.exe
  2⤵
  PID:3900
- C:\Windows\System\xngPlKp.exe
  C:\Windows\System\xngPlKp.exe
  2⤵
  PID:4324
- C:\Windows\System\zcfrEhD.exe
  C:\Windows\System\zcfrEhD.exe
  2⤵
  PID:4580
- C:\Windows\System\xTZTzdD.exe
  C:\Windows\System\xTZTzdD.exe
  2⤵
  PID:4708
- C:\Windows\System\aHcwYki.exe
  C:\Windows\System\aHcwYki.exe
  2⤵
  PID:1000
- C:\Windows\System\SAPxTPv.exe
  C:\Windows\System\SAPxTPv.exe
  2⤵
  PID:1388
- C:\Windows\System\sHEpoJT.exe
  C:\Windows\System\sHEpoJT.exe
  2⤵
  PID:5172
- C:\Windows\System\DAcOLdC.exe
  C:\Windows\System\DAcOLdC.exe
  2⤵
  PID:5212
- C:\Windows\System\VQhlcqE.exe
  C:\Windows\System\VQhlcqE.exe
  2⤵
  PID:5228
- C:\Windows\System\GSJTdhb.exe
  C:\Windows\System\GSJTdhb.exe
  2⤵
  PID:5244
- C:\Windows\System\CbvRQbI.exe
  C:\Windows\System\CbvRQbI.exe
  2⤵
  PID:5260
- C:\Windows\System\kLrZSkW.exe
  C:\Windows\System\kLrZSkW.exe
  2⤵
  PID:5276
- C:\Windows\System\HFCRZyI.exe
  C:\Windows\System\HFCRZyI.exe
  2⤵
  PID:5292
- C:\Windows\System\VldgTps.exe
  C:\Windows\System\VldgTps.exe
  2⤵
  PID:5308
- C:\Windows\System\DoKsiBt.exe
  C:\Windows\System\DoKsiBt.exe
  2⤵
  PID:5324
- C:\Windows\System\QHAvqZX.exe
  C:\Windows\System\QHAvqZX.exe
  2⤵
  PID:5340
- C:\Windows\System\ekAVVpg.exe
  C:\Windows\System\ekAVVpg.exe
  2⤵
  PID:5356
- C:\Windows\System\gGMFIOb.exe
  C:\Windows\System\gGMFIOb.exe
  2⤵
  PID:5372
- C:\Windows\System\bjLJpRH.exe
  C:\Windows\System\bjLJpRH.exe
  2⤵
  PID:5388
- C:\Windows\System\FesbcPk.exe
  C:\Windows\System\FesbcPk.exe
  2⤵
  PID:5404
- C:\Windows\System\aMPpqcK.exe
  C:\Windows\System\aMPpqcK.exe
  2⤵
  PID:5424
- C:\Windows\System\EzqCydD.exe
  C:\Windows\System\EzqCydD.exe
  2⤵
  PID:5440
- C:\Windows\System\DkRJVpP.exe
  C:\Windows\System\DkRJVpP.exe
  2⤵
  PID:5456
- C:\Windows\System\fFxdrEz.exe
  C:\Windows\System\fFxdrEz.exe
  2⤵
  PID:5472
- C:\Windows\System\rkCIUir.exe
  C:\Windows\System\rkCIUir.exe
  2⤵
  PID:5488
- C:\Windows\System\dtaujYq.exe
  C:\Windows\System\dtaujYq.exe
  2⤵
  PID:5504
- C:\Windows\System\gNMjLXd.exe
  C:\Windows\System\gNMjLXd.exe
  2⤵
  PID:5520
- C:\Windows\System\qRrIPNU.exe
  C:\Windows\System\qRrIPNU.exe
  2⤵
  PID:5536
- C:\Windows\System\njHvEFH.exe
  C:\Windows\System\njHvEFH.exe
  2⤵
  PID:5552
- C:\Windows\System\cwvlXdM.exe
  C:\Windows\System\cwvlXdM.exe
  2⤵
  PID:5568
- C:\Windows\System\gRoCryU.exe
  C:\Windows\System\gRoCryU.exe
  2⤵
  PID:5584
- C:\Windows\System\odaBoZm.exe
  C:\Windows\System\odaBoZm.exe
  2⤵
  PID:5604
- C:\Windows\System\AZuZHHd.exe
  C:\Windows\System\AZuZHHd.exe
  2⤵
  PID:5620
- C:\Windows\System\JLaROJH.exe
  C:\Windows\System\JLaROJH.exe
  2⤵
  PID:5692
- C:\Windows\System\jwVZeal.exe
  C:\Windows\System\jwVZeal.exe
  2⤵
  PID:5756
- C:\Windows\System\dEcByes.exe
  C:\Windows\System\dEcByes.exe
  2⤵
  PID:5772
- C:\Windows\System\fHcYqCo.exe
  C:\Windows\System\fHcYqCo.exe
  2⤵
  PID:664
- C:\Windows\System\qFmOJwY.exe
  C:\Windows\System\qFmOJwY.exe
  2⤵
  PID:5852
- C:\Windows\System\jEtfiSr.exe
  C:\Windows\System\jEtfiSr.exe
  2⤵
  PID:5868
- C:\Windows\System\wDVMqVz.exe
  C:\Windows\System\wDVMqVz.exe
  2⤵
  PID:5920
- C:\Windows\System\ApogFHa.exe
  C:\Windows\System\ApogFHa.exe
  2⤵
  PID:5928
- C:\Windows\System\zANAPny.exe
  C:\Windows\System\zANAPny.exe
  2⤵
  PID:1928
- C:\Windows\System\aErYoEN.exe
  C:\Windows\System\aErYoEN.exe
  2⤵
  PID:3564
- C:\Windows\System\bWYHzaE.exe
  C:\Windows\System\bWYHzaE.exe
  2⤵
  PID:3500
- C:\Windows\System\fElvzVf.exe
  C:\Windows\System\fElvzVf.exe
  2⤵
  PID:3436
- C:\Windows\System\gWsDTLE.exe
  C:\Windows\System\gWsDTLE.exe
  2⤵
  PID:3344
- C:\Windows\System\JerHJiB.exe
  C:\Windows\System\JerHJiB.exe
  2⤵
  PID:3304
- C:\Windows\System\YRgkypp.exe
  C:\Windows\System\YRgkypp.exe
  2⤵
  PID:3212
- C:\Windows\System\PtYLXDv.exe
  C:\Windows\System\PtYLXDv.exe
  2⤵
  PID:3148
- C:\Windows\System\yBaXQgN.exe
  C:\Windows\System\yBaXQgN.exe
  2⤵
  PID:2240
- C:\Windows\System\MiBbOSE.exe
  C:\Windows\System\MiBbOSE.exe
  2⤵
  PID:2648
- C:\Windows\System\yyxfBWh.exe
  C:\Windows\System\yyxfBWh.exe
  2⤵
  PID:6068
- C:\Windows\System\HqoBlYp.exe
  C:\Windows\System\HqoBlYp.exe
  2⤵
  PID:4780
- C:\Windows\System\voATYHR.exe
  C:\Windows\System\voATYHR.exe
  2⤵
  PID:5676
- C:\Windows\System\NvNhicE.exe
  C:\Windows\System\NvNhicE.exe
  2⤵
  PID:3788
- C:\Windows\System\rQLxzrc.exe
  C:\Windows\System\rQLxzrc.exe
  2⤵
  PID:3388
- C:\Windows\System\ZjEqSCD.exe
  C:\Windows\System\ZjEqSCD.exe
  2⤵
  PID:960
- C:\Windows\System\WehJjVC.exe
  C:\Windows\System\WehJjVC.exe
  2⤵
  PID:2948
- C:\Windows\System\EUUtnmf.exe
  C:\Windows\System\EUUtnmf.exe
  2⤵
  PID:5380
- C:\Windows\System\HRmYSVv.exe
  C:\Windows\System\HRmYSVv.exe
  2⤵
  PID:5416
- C:\Windows\System\LHIAcJj.exe
  C:\Windows\System\LHIAcJj.exe
  2⤵
  PID:3980
- C:\Windows\System\WgVqzCu.exe
  C:\Windows\System\WgVqzCu.exe
  2⤵
  PID:3772
- C:\Windows\System\PTXcBrI.exe
  C:\Windows\System\PTXcBrI.exe
  2⤵
  PID:4692
- C:\Windows\System\OxGYzIw.exe
  C:\Windows\System\OxGYzIw.exe
  2⤵
  PID:2636
- C:\Windows\System\PWgrRlw.exe
  C:\Windows\System\PWgrRlw.exe
  2⤵
  PID:5208
- C:\Windows\System\yVgNSWh.exe
  C:\Windows\System\yVgNSWh.exe
  2⤵
  PID:5272
- C:\Windows\System\xsKitNg.exe
  C:\Windows\System\xsKitNg.exe
  2⤵
  PID:5368
- C:\Windows\System\iZACgfM.exe
  C:\Windows\System\iZACgfM.exe
  2⤵
  PID:5580
- C:\Windows\System\ZZogjSV.exe
  C:\Windows\System\ZZogjSV.exe
  2⤵
  PID:5576
- C:\Windows\System\QgvxkNB.exe
  C:\Windows\System\QgvxkNB.exe
  2⤵
  PID:5752
- C:\Windows\System\tZBvuGN.exe
  C:\Windows\System\tZBvuGN.exe
  2⤵
  PID:5560
- C:\Windows\System\pByLpvL.exe
  C:\Windows\System\pByLpvL.exe
  2⤵
  PID:5944
- C:\Windows\System\OgaZcXF.exe
  C:\Windows\System\OgaZcXF.exe
  2⤵
  PID:3468
- C:\Windows\System\GBYNmRa.exe
  C:\Windows\System\GBYNmRa.exe
  2⤵
  PID:5600
- C:\Windows\System\tUIpjkG.exe
  C:\Windows\System\tUIpjkG.exe
  2⤵
  PID:3308
- C:\Windows\System\VDknhEk.exe
  C:\Windows\System\VDknhEk.exe
  2⤵
  PID:5768
- C:\Windows\System\dydAAjp.exe
  C:\Windows\System\dydAAjp.exe
  2⤵
  PID:2788
- C:\Windows\System\tWGMQgh.exe
  C:\Windows\System\tWGMQgh.exe
  2⤵
  PID:3408
- C:\Windows\System\BSirxpJ.exe
  C:\Windows\System\BSirxpJ.exe
  2⤵
  PID:3244
- C:\Windows\System\EdXBvAE.exe
  C:\Windows\System\EdXBvAE.exe
  2⤵
  PID:2384
- C:\Windows\System\VaZJIxw.exe
  C:\Windows\System\VaZJIxw.exe
  2⤵
  PID:3112
- C:\Windows\System\vQeGgaA.exe
  C:\Windows\System\vQeGgaA.exe
  2⤵
  PID:2196
- C:\Windows\System\WzcPaFh.exe
  C:\Windows\System\WzcPaFh.exe
  2⤵
  PID:6060
- C:\Windows\System\pojULgD.exe
  C:\Windows\System\pojULgD.exe
  2⤵
  PID:616
- C:\Windows\System\OMrvYgI.exe
  C:\Windows\System\OMrvYgI.exe
  2⤵
  PID:6084
- C:\Windows\System\JduIoGS.exe
  C:\Windows\System\JduIoGS.exe
  2⤵
  PID:1820
- C:\Windows\System\rsZsTcZ.exe
  C:\Windows\System\rsZsTcZ.exe
  2⤵
  PID:1296
- C:\Windows\System\FIMQzkz.exe
  C:\Windows\System\FIMQzkz.exe
  2⤵
  PID:2836
- C:\Windows\System\AfjXfUL.exe
  C:\Windows\System\AfjXfUL.exe
  2⤵
  PID:892
- C:\Windows\System\XhTUYhl.exe
  C:\Windows\System\XhTUYhl.exe
  2⤵
  PID:4988
- C:\Windows\System\kJJJZry.exe
  C:\Windows\System\kJJJZry.exe
  2⤵
  PID:5016
- C:\Windows\System\tvCHtjX.exe
  C:\Windows\System\tvCHtjX.exe
  2⤵
  PID:5116
- C:\Windows\System\SnXgYmw.exe
  C:\Windows\System\SnXgYmw.exe
  2⤵
  PID:4616
- C:\Windows\System\IlAEWNo.exe
  C:\Windows\System\IlAEWNo.exe
  2⤵
  PID:2668
- C:\Windows\System\bIhxaAP.exe
  C:\Windows\System\bIhxaAP.exe
  2⤵
  PID:2592
- C:\Windows\System\qwdPWyJ.exe
  C:\Windows\System\qwdPWyJ.exe
  2⤵
  PID:5816
- C:\Windows\System\QMgdOxg.exe
  C:\Windows\System\QMgdOxg.exe
  2⤵
  PID:4936
- C:\Windows\System\TejXoOW.exe
  C:\Windows\System\TejXoOW.exe
  2⤵
  PID:4968
- C:\Windows\System\qFOkZAh.exe
  C:\Windows\System\qFOkZAh.exe
  2⤵
  PID:2152
- C:\Windows\System\WOkfZNq.exe
  C:\Windows\System\WOkfZNq.exe
  2⤵
  PID:5812
- C:\Windows\System\JkvqJII.exe
  C:\Windows\System\JkvqJII.exe
  2⤵
  PID:5884
- C:\Windows\System\khblXXr.exe
  C:\Windows\System\khblXXr.exe
  2⤵
  PID:2884
- C:\Windows\System\bIZJPOo.exe
  C:\Windows\System\bIZJPOo.exe
  2⤵
  PID:1056
- C:\Windows\System\fGpNfFm.exe
  C:\Windows\System\fGpNfFm.exe
  2⤵
  PID:2432
- C:\Windows\System\DTDERna.exe
  C:\Windows\System\DTDERna.exe
  2⤵
  PID:852
- C:\Windows\System\KGfQwDN.exe
  C:\Windows\System\KGfQwDN.exe
  2⤵
  PID:2316
- C:\Windows\System\dQHlLQf.exe
  C:\Windows\System\dQHlLQf.exe
  2⤵
  PID:1496
- C:\Windows\System\unYFMoy.exe
  C:\Windows\System\unYFMoy.exe
  2⤵
  PID:2852
- C:\Windows\System\KShiwkD.exe
  C:\Windows\System\KShiwkD.exe
  2⤵
  PID:4044
- C:\Windows\System\WZffvVh.exe
  C:\Windows\System\WZffvVh.exe
  2⤵
  PID:3392
- C:\Windows\System\KcHcSHC.exe
  C:\Windows\System\KcHcSHC.exe
  2⤵
  PID:4248
- C:\Windows\System\rLnUilD.exe
  C:\Windows\System\rLnUilD.exe
  2⤵
  PID:4452
- C:\Windows\System\OHhmocN.exe
  C:\Windows\System\OHhmocN.exe
  2⤵
  PID:4372
- C:\Windows\System\CjlQGpw.exe
  C:\Windows\System\CjlQGpw.exe
  2⤵
  PID:4112
- C:\Windows\System\BrAZdjR.exe
  C:\Windows\System\BrAZdjR.exe
  2⤵
  PID:4552
- C:\Windows\System\uDQrhNx.exe
  C:\Windows\System\uDQrhNx.exe
  2⤵
  PID:5140
- C:\Windows\System\adfgDBb.exe
  C:\Windows\System\adfgDBb.exe
  2⤵
  PID:3724
- C:\Windows\System\cHotvVS.exe
  C:\Windows\System\cHotvVS.exe
  2⤵
  PID:5320
- C:\Windows\System\WOXQoeC.exe
  C:\Windows\System\WOXQoeC.exe
  2⤵
  PID:4312
- C:\Windows\System\eEHGVdu.exe
  C:\Windows\System\eEHGVdu.exe
  2⤵
  PID:4564
- C:\Windows\System\wZnBEDL.exe
  C:\Windows\System\wZnBEDL.exe
  2⤵
  PID:5352
- C:\Windows\System\PEBgIjO.exe
  C:\Windows\System\PEBgIjO.exe
  2⤵
  PID:5412
- C:\Windows\System\vHRhlWI.exe
  C:\Windows\System\vHRhlWI.exe
  2⤵
  PID:5448
- C:\Windows\System\AZcjQOO.exe
  C:\Windows\System\AZcjQOO.exe
  2⤵
  PID:5452
- C:\Windows\System\UgyFBAT.exe
  C:\Windows\System\UgyFBAT.exe
  2⤵
  PID:5396
- C:\Windows\System\MGBBtRK.exe
  C:\Windows\System\MGBBtRK.exe
  2⤵
  PID:5548
- C:\Windows\System\OJkxVBZ.exe
  C:\Windows\System\OJkxVBZ.exe
  2⤵
  PID:3532
- C:\Windows\System\gKcMlgT.exe
  C:\Windows\System\gKcMlgT.exe
  2⤵
  PID:5760
- C:\Windows\System\LNCVlTe.exe
  C:\Windows\System\LNCVlTe.exe
  2⤵
  PID:2880
- C:\Windows\System\hqDyuRz.exe
  C:\Windows\System\hqDyuRz.exe
  2⤵
  PID:2212
- C:\Windows\System\WWtpucL.exe
  C:\Windows\System\WWtpucL.exe
  2⤵
  PID:3272
- C:\Windows\System\rwNmMjk.exe
  C:\Windows\System\rwNmMjk.exe
  2⤵
  PID:5968
- C:\Windows\System\esyIGYd.exe
  C:\Windows\System\esyIGYd.exe
  2⤵
  PID:5980
- C:\Windows\System\qzMTLYV.exe
  C:\Windows\System\qzMTLYV.exe
  2⤵
  PID:2644
- C:\Windows\System\nXACGdK.exe
  C:\Windows\System\nXACGdK.exe
  2⤵
  PID:4100
- C:\Windows\System\CBsYwpR.exe
  C:\Windows\System\CBsYwpR.exe
  2⤵
  PID:5400
- C:\Windows\System\jEwGzCF.exe
  C:\Windows\System\jEwGzCF.exe
  2⤵
  PID:3084
- C:\Windows\System\vilySlZ.exe
  C:\Windows\System\vilySlZ.exe
  2⤵
  PID:1956
- C:\Windows\System\aXYUjMp.exe
  C:\Windows\System\aXYUjMp.exe
  2⤵
  PID:5656
- C:\Windows\System\iqCeBIm.exe
  C:\Windows\System\iqCeBIm.exe
  2⤵
  PID:876
- C:\Windows\System\VEiCvQX.exe
  C:\Windows\System\VEiCvQX.exe
  2⤵
  PID:6036
- C:\Windows\System\JeAQfBK.exe
  C:\Windows\System\JeAQfBK.exe
  2⤵
  PID:2164
- C:\Windows\System\WLjDfPg.exe
  C:\Windows\System\WLjDfPg.exe
  2⤵
  PID:4876
- C:\Windows\System\SOmCcrr.exe
  C:\Windows\System\SOmCcrr.exe
  2⤵
  PID:1844
- C:\Windows\System\nAGKqzg.exe
  C:\Windows\System\nAGKqzg.exe
  2⤵
  PID:3840
- C:\Windows\System\ETnVhhe.exe
  C:\Windows\System\ETnVhhe.exe
  2⤵
  PID:1960
- C:\Windows\System\UwZNjQI.exe
  C:\Windows\System\UwZNjQI.exe
  2⤵
  PID:3128
- C:\Windows\System\VljugAB.exe
  C:\Windows\System\VljugAB.exe
  2⤵
  PID:4192
- C:\Windows\System\LOGgKVj.exe
  C:\Windows\System\LOGgKVj.exe
  2⤵
  PID:5384
- C:\Windows\System\CAaMNRY.exe
  C:\Windows\System\CAaMNRY.exe
  2⤵
  PID:4060
- C:\Windows\System\mwSoURf.exe
  C:\Windows\System\mwSoURf.exe
  2⤵
  PID:348
- C:\Windows\System\hQRxQAD.exe
  C:\Windows\System\hQRxQAD.exe
  2⤵
  PID:4244
- C:\Windows\System\ZzZPIzC.exe
  C:\Windows\System\ZzZPIzC.exe
  2⤵
  PID:4360
- C:\Windows\System\DyfxemC.exe
  C:\Windows\System\DyfxemC.exe
  2⤵
  PID:4760
- C:\Windows\System\NKuKLix.exe
  C:\Windows\System\NKuKLix.exe
  2⤵
  PID:3728
- C:\Windows\System\bwHzGuh.exe
  C:\Windows\System\bwHzGuh.exe
  2⤵
  PID:848
- C:\Windows\System\glnZPGX.exe
  C:\Windows\System\glnZPGX.exe
  2⤵
  PID:1560
- C:\Windows\System\RhefrjH.exe
  C:\Windows\System\RhefrjH.exe
  2⤵
  PID:5784
- C:\Windows\System\FaQxbDO.exe
  C:\Windows\System\FaQxbDO.exe
  2⤵
  PID:2640
- C:\Windows\System\nEiLoWZ.exe
  C:\Windows\System\nEiLoWZ.exe
  2⤵
  PID:6152
- C:\Windows\System\EIjOkkL.exe
  C:\Windows\System\EIjOkkL.exe
  2⤵
  PID:6168
- C:\Windows\System\vjkbHba.exe
  C:\Windows\System\vjkbHba.exe
  2⤵
  PID:6184
- C:\Windows\System\InyCcZu.exe
  C:\Windows\System\InyCcZu.exe
  2⤵
  PID:6200
- C:\Windows\System\vNFRlps.exe
  C:\Windows\System\vNFRlps.exe
  2⤵
  PID:6216
- C:\Windows\System\KShKYZo.exe
  C:\Windows\System\KShKYZo.exe
  2⤵
  PID:6232
- C:\Windows\System\mIdZwIh.exe
  C:\Windows\System\mIdZwIh.exe
  2⤵
  PID:6248
- C:\Windows\System\eQiwSzh.exe
  C:\Windows\System\eQiwSzh.exe
  2⤵
  PID:6264
- C:\Windows\System\VawcTEW.exe
  C:\Windows\System\VawcTEW.exe
  2⤵
  PID:6280
- C:\Windows\System\KEQhiYi.exe
  C:\Windows\System\KEQhiYi.exe
  2⤵
  PID:6296
- C:\Windows\System\GSMCovh.exe
  C:\Windows\System\GSMCovh.exe
  2⤵
  PID:6312
- C:\Windows\System\JayiCBb.exe
  C:\Windows\System\JayiCBb.exe
  2⤵
  PID:6328
- C:\Windows\System\RokUHEX.exe
  C:\Windows\System\RokUHEX.exe
  2⤵
  PID:6344
- C:\Windows\System\vtwDiTY.exe
  C:\Windows\System\vtwDiTY.exe
  2⤵
  PID:6360
- C:\Windows\System\AbbbVJw.exe
  C:\Windows\System\AbbbVJw.exe
  2⤵
  PID:6376
- C:\Windows\System\kdZKYVm.exe
  C:\Windows\System\kdZKYVm.exe
  2⤵
  PID:6392
- C:\Windows\System\EidiDTh.exe
  C:\Windows\System\EidiDTh.exe
  2⤵
  PID:6408
- C:\Windows\System\lNYJyah.exe
  C:\Windows\System\lNYJyah.exe
  2⤵
  PID:6424
- C:\Windows\System\kwfedqI.exe
  C:\Windows\System\kwfedqI.exe
  2⤵
  PID:6440
- C:\Windows\System\cBGCEUm.exe
  C:\Windows\System\cBGCEUm.exe
  2⤵
  PID:6456
- C:\Windows\System\OAcrntN.exe
  C:\Windows\System\OAcrntN.exe
  2⤵
  PID:6472
- C:\Windows\System\DOyexVH.exe
  C:\Windows\System\DOyexVH.exe
  2⤵
  PID:6488
- C:\Windows\System\RVhLptt.exe
  C:\Windows\System\RVhLptt.exe
  2⤵
  PID:6504
- C:\Windows\System\cryFPWU.exe
  C:\Windows\System\cryFPWU.exe
  2⤵
  PID:6520
- C:\Windows\System\XZiSIXl.exe
  C:\Windows\System\XZiSIXl.exe
  2⤵
  PID:6536
- C:\Windows\System\juYdQVR.exe
  C:\Windows\System\juYdQVR.exe
  2⤵
  PID:6552
- C:\Windows\System\KgpaGfT.exe
  C:\Windows\System\KgpaGfT.exe
  2⤵
  PID:6568
- C:\Windows\System\oXevTxf.exe
  C:\Windows\System\oXevTxf.exe
  2⤵
  PID:6584
- C:\Windows\System\InLrckv.exe
  C:\Windows\System\InLrckv.exe
  2⤵
  PID:6600
- C:\Windows\System\uTiQOOQ.exe
  C:\Windows\System\uTiQOOQ.exe
  2⤵
  PID:6616
- C:\Windows\System\qhJZJxE.exe
  C:\Windows\System\qhJZJxE.exe
  2⤵
  PID:6632
- C:\Windows\System\xjnzfhp.exe
  C:\Windows\System\xjnzfhp.exe
  2⤵
  PID:6648
- C:\Windows\System\bmmiLUT.exe
  C:\Windows\System\bmmiLUT.exe
  2⤵
  PID:6664
- C:\Windows\System\PUqlvXO.exe
  C:\Windows\System\PUqlvXO.exe
  2⤵
  PID:6680
- C:\Windows\System\yDxuLUJ.exe
  C:\Windows\System\yDxuLUJ.exe
  2⤵
  PID:6696
- C:\Windows\System\YFfqDXP.exe
  C:\Windows\System\YFfqDXP.exe
  2⤵
  PID:6712
- C:\Windows\System\UGuLZQj.exe
  C:\Windows\System\UGuLZQj.exe
  2⤵
  PID:6728
- C:\Windows\System\JJoBpBq.exe
  C:\Windows\System\JJoBpBq.exe
  2⤵
  PID:6744
- C:\Windows\System\omjRRqV.exe
  C:\Windows\System\omjRRqV.exe
  2⤵
  PID:6760
- C:\Windows\System\tIQVYti.exe
  C:\Windows\System\tIQVYti.exe
  2⤵
  PID:6776
- C:\Windows\System\tuRvKXw.exe
  C:\Windows\System\tuRvKXw.exe
  2⤵
  PID:6792
- C:\Windows\System\EzXHruU.exe
  C:\Windows\System\EzXHruU.exe
  2⤵
  PID:6808
- C:\Windows\System\fYOKfxB.exe
  C:\Windows\System\fYOKfxB.exe
  2⤵
  PID:6824
- C:\Windows\System\VAnKOhp.exe
  C:\Windows\System\VAnKOhp.exe
  2⤵
  PID:6844
- C:\Windows\System\fQaVDPy.exe
  C:\Windows\System\fQaVDPy.exe
  2⤵
  PID:6860
- C:\Windows\System\DQfybQb.exe
  C:\Windows\System\DQfybQb.exe
  2⤵
  PID:6876
- C:\Windows\System\qTOZAsZ.exe
  C:\Windows\System\qTOZAsZ.exe
  2⤵
  PID:6892
- C:\Windows\System\IkRjSaF.exe
  C:\Windows\System\IkRjSaF.exe
  2⤵
  PID:6908
- C:\Windows\System\SPsWBui.exe
  C:\Windows\System\SPsWBui.exe
  2⤵
  PID:6924
- C:\Windows\System\WSZghSm.exe
  C:\Windows\System\WSZghSm.exe
  2⤵
  PID:6952
- C:\Windows\System\KxWDGIl.exe
  C:\Windows\System\KxWDGIl.exe
  2⤵
  PID:7056
- C:\Windows\System\sPIccbE.exe
  C:\Windows\System\sPIccbE.exe
  2⤵
  PID:7072
- C:\Windows\System\ViwlTwW.exe
  C:\Windows\System\ViwlTwW.exe
  2⤵
  PID:7088
- C:\Windows\System\ntEnkFj.exe
  C:\Windows\System\ntEnkFj.exe
  2⤵
  PID:7104
- C:\Windows\System\DGIQwaK.exe
  C:\Windows\System\DGIQwaK.exe
  2⤵
  PID:7120
- C:\Windows\System\mTARyMU.exe
  C:\Windows\System\mTARyMU.exe
  2⤵
  PID:7140
- C:\Windows\System\gfegdTQ.exe
  C:\Windows\System\gfegdTQ.exe
  2⤵
  PID:7156
- C:\Windows\System\yyZUEQY.exe
  C:\Windows\System\yyZUEQY.exe
  2⤵
  PID:5860
- C:\Windows\System\BQzAkjP.exe
  C:\Windows\System\BQzAkjP.exe
  2⤵
  PID:3116
- C:\Windows\System\dxZFWxc.exe
  C:\Windows\System\dxZFWxc.exe
  2⤵
  PID:5468
- C:\Windows\System\aINTNba.exe
  C:\Windows\System\aINTNba.exe
  2⤵
  PID:5912
- C:\Windows\System\rVhQyPT.exe
  C:\Windows\System\rVhQyPT.exe
  2⤵
  PID:4920
- C:\Windows\System\ddxrfuV.exe
  C:\Windows\System\ddxrfuV.exe
  2⤵
  PID:1292
- C:\Windows\System\gMHZOsM.exe
  C:\Windows\System\gMHZOsM.exe
  2⤵
  PID:4812
- C:\Windows\System\JjfGmBh.exe
  C:\Windows\System\JjfGmBh.exe
  2⤵
  PID:1576
- C:\Windows\System\UePobxi.exe
  C:\Windows\System\UePobxi.exe
  2⤵
  PID:5484
- C:\Windows\System\tGzKSYX.exe
  C:\Windows\System\tGzKSYX.exe
  2⤵
  PID:6160
- C:\Windows\System\HMeWjWR.exe
  C:\Windows\System\HMeWjWR.exe
  2⤵
  PID:5240
- C:\Windows\System\RGcEHzt.exe
  C:\Windows\System\RGcEHzt.exe
  2⤵
  PID:6260
- C:\Windows\System\cmyhAaK.exe
  C:\Windows\System\cmyhAaK.exe
  2⤵
  PID:6324
- C:\Windows\System\ULsRemS.exe
  C:\Windows\System\ULsRemS.exe
  2⤵
  PID:6388
- C:\Windows\System\KkAoUix.exe
  C:\Windows\System\KkAoUix.exe
  2⤵
  PID:6416
- C:\Windows\System\NgbvAIE.exe
  C:\Windows\System\NgbvAIE.exe
  2⤵
  PID:5672
- C:\Windows\System\ZtdragR.exe
  C:\Windows\System\ZtdragR.exe
  2⤵
  PID:5304
- C:\Windows\System\BXtzdDO.exe
  C:\Windows\System\BXtzdDO.exe
  2⤵
  PID:5940
- C:\Windows\System\rZxFCMg.exe
  C:\Windows\System\rZxFCMg.exe
  2⤵
  PID:640
- C:\Windows\System\IozzpNb.exe
  C:\Windows\System\IozzpNb.exe
  2⤵
  PID:2888
- C:\Windows\System\zFLjTdq.exe
  C:\Windows\System\zFLjTdq.exe
  2⤵
  PID:5828
- C:\Windows\System\vlJBlHv.exe
  C:\Windows\System\vlJBlHv.exe
  2⤵
  PID:5168
- C:\Windows\System\SJjBxiS.exe
  C:\Windows\System\SJjBxiS.exe
  2⤵
  PID:6532
- C:\Windows\System\bHTfQSh.exe
  C:\Windows\System\bHTfQSh.exe
  2⤵
  PID:1092
- C:\Windows\System\gvThHCJ.exe
  C:\Windows\System\gvThHCJ.exe
  2⤵
  PID:6072
- C:\Windows\System\LyIEwbG.exe
  C:\Windows\System\LyIEwbG.exe
  2⤵
  PID:6180
- C:\Windows\System\pQzdLVd.exe
  C:\Windows\System\pQzdLVd.exe
  2⤵
  PID:6272
- C:\Windows\System\adaUXGL.exe
  C:\Windows\System\adaUXGL.exe
  2⤵
  PID:6336
- C:\Windows\System\VMEjnRE.exe
  C:\Windows\System\VMEjnRE.exe
  2⤵
  PID:6484
- C:\Windows\System\KaApprQ.exe
  C:\Windows\System\KaApprQ.exe
  2⤵
  PID:6372
- C:\Windows\System\VxnuZTF.exe
  C:\Windows\System\VxnuZTF.exe
  2⤵
  PID:6436
- C:\Windows\System\rUohuMd.exe
  C:\Windows\System\rUohuMd.exe
  2⤵
  PID:6528
- C:\Windows\System\GzSmXob.exe
  C:\Windows\System\GzSmXob.exe
  2⤵
  PID:6660
- C:\Windows\System\ouwjHoi.exe
  C:\Windows\System\ouwjHoi.exe
  2⤵
  PID:6724
- C:\Windows\System\KRNAywv.exe
  C:\Windows\System\KRNAywv.exe
  2⤵
  PID:6788
- C:\Windows\System\pmDPqPI.exe
  C:\Windows\System\pmDPqPI.exe
  2⤵
  PID:6856
- C:\Windows\System\TDXboMG.exe
  C:\Windows\System\TDXboMG.exe
  2⤵
  PID:6580
- C:\Windows\System\JzzysLm.exe
  C:\Windows\System\JzzysLm.exe
  2⤵
  PID:6644
- C:\Windows\System\cELOwTB.exe
  C:\Windows\System\cELOwTB.exe
  2⤵
  PID:6708
- C:\Windows\System\ELmqxDQ.exe
  C:\Windows\System\ELmqxDQ.exe
  2⤵
  PID:6772
- C:\Windows\System\rLvFbFq.exe
  C:\Windows\System\rLvFbFq.exe
  2⤵
  PID:6840
- C:\Windows\System\VHSogjR.exe
  C:\Windows\System\VHSogjR.exe
  2⤵
  PID:6888
- C:\Windows\System\EbcqYVE.exe
  C:\Windows\System\EbcqYVE.exe
  2⤵
  PID:6984
- C:\Windows\System\ZThUgfF.exe
  C:\Windows\System\ZThUgfF.exe
  2⤵
  PID:7000
- C:\Windows\System\yIQCURM.exe
  C:\Windows\System\yIQCURM.exe
  2⤵
  PID:7016
- C:\Windows\System\bpfDoxw.exe
  C:\Windows\System\bpfDoxw.exe
  2⤵
  PID:7032
- C:\Windows\System\GKURoqN.exe
  C:\Windows\System\GKURoqN.exe
  2⤵
  PID:7064
- C:\Windows\System\CYxsVAQ.exe
  C:\Windows\System\CYxsVAQ.exe
  2⤵
  PID:7128
- C:\Windows\System\CuPFmAn.exe
  C:\Windows\System\CuPFmAn.exe
  2⤵
  PID:5544
- C:\Windows\System\FgZorEv.exe
  C:\Windows\System\FgZorEv.exe
  2⤵
  PID:2620
- C:\Windows\System\TWJmSUi.exe
  C:\Windows\System\TWJmSUi.exe
  2⤵
  PID:3132
- C:\Windows\System\AbqUkPR.exe
  C:\Windows\System\AbqUkPR.exe
  2⤵
  PID:7052
- C:\Windows\System\nlTJqUA.exe
  C:\Windows\System\nlTJqUA.exe
  2⤵
  PID:7084
- C:\Windows\System\mmSyLUP.exe
  C:\Windows\System\mmSyLUP.exe
  2⤵
  PID:6044
- C:\Windows\System\mwQEowS.exe
  C:\Windows\System\mwQEowS.exe
  2⤵
  PID:5152
- C:\Windows\System\gjVQSYD.exe
  C:\Windows\System\gjVQSYD.exe
  2⤵
  PID:2236
- C:\Windows\System\hEhOTfT.exe
  C:\Windows\System\hEhOTfT.exe
  2⤵
  PID:5964
- C:\Windows\System\bslIjXs.exe
  C:\Windows\System\bslIjXs.exe
  2⤵
  PID:5064
- C:\Windows\System\WgzXOJJ.exe
  C:\Windows\System\WgzXOJJ.exe
  2⤵
  PID:5364
- C:\Windows\System\BmmBQLa.exe
  C:\Windows\System\BmmBQLa.exe
  2⤵
  PID:6212
- C:\Windows\System\dOyKSBh.exe
  C:\Windows\System\dOyKSBh.exe
  2⤵
  PID:6480
- C:\Windows\System\JffNVgu.exe
  C:\Windows\System\JffNVgu.exe
  2⤵
  PID:6624
- C:\Windows\System\mTbyDQh.exe
  C:\Windows\System\mTbyDQh.exe
  2⤵
  PID:6516
- C:\Windows\System\EGiCZGn.exe
  C:\Windows\System\EGiCZGn.exe
  2⤵
  PID:6228
- C:\Windows\System\XwZRNmF.exe
  C:\Windows\System\XwZRNmF.exe
  2⤵
  PID:4516
- C:\Windows\System\OFBaxPG.exe
  C:\Windows\System\OFBaxPG.exe
  2⤵
  PID:6140
- C:\Windows\System\HykHUwl.exe
  C:\Windows\System\HykHUwl.exe
  2⤵
  PID:5220
- C:\Windows\System\WgbYGlm.exe
  C:\Windows\System\WgbYGlm.exe
  2⤵
  PID:6340
- C:\Windows\System\xhbxeif.exe
  C:\Windows\System\xhbxeif.exe
  2⤵
  PID:6500
- C:\Windows\System\itaUIqy.exe
  C:\Windows\System\itaUIqy.exe
  2⤵
  PID:6544
- C:\Windows\System\bpzSkLM.exe
  C:\Windows\System\bpzSkLM.exe
  2⤵
  PID:6820
- C:\Windows\System\OOXsYEf.exe
  C:\Windows\System\OOXsYEf.exe
  2⤵
  PID:6740
- C:\Windows\System\ghsLAzT.exe
  C:\Windows\System\ghsLAzT.exe
  2⤵
  PID:6804
- C:\Windows\System\yyOEBlt.exe
  C:\Windows\System\yyOEBlt.exe
  2⤵
  PID:7096
- C:\Windows\System\AmchfSI.exe
  C:\Windows\System\AmchfSI.exe
  2⤵
  PID:7176
- C:\Windows\System\SgnkQLh.exe
  C:\Windows\System\SgnkQLh.exe
  2⤵
  PID:7192
- C:\Windows\System\UzuTXbl.exe
  C:\Windows\System\UzuTXbl.exe
  2⤵
  PID:7208
- C:\Windows\System\rhgizuC.exe
  C:\Windows\System\rhgizuC.exe
  2⤵
  PID:7224
- C:\Windows\System\ujIMvWs.exe
  C:\Windows\System\ujIMvWs.exe
  2⤵
  PID:7240
- C:\Windows\System\nXIPJbf.exe
  C:\Windows\System\nXIPJbf.exe
  2⤵
  PID:7256
- C:\Windows\System\xlcZkse.exe
  C:\Windows\System\xlcZkse.exe
  2⤵
  PID:7276
- C:\Windows\System\Gxcnmuk.exe
  C:\Windows\System\Gxcnmuk.exe
  2⤵
  PID:7296
- C:\Windows\System\oCDilsq.exe
  C:\Windows\System\oCDilsq.exe
  2⤵
  PID:7312
- C:\Windows\System\voerYIW.exe
  C:\Windows\System\voerYIW.exe
  2⤵
  PID:7332
- C:\Windows\System\gcIVRnN.exe
  C:\Windows\System\gcIVRnN.exe
  2⤵
  PID:7348
- C:\Windows\System\VLDazCN.exe
  C:\Windows\System\VLDazCN.exe
  2⤵
  PID:7364
- C:\Windows\System\ERzcEAU.exe
  C:\Windows\System\ERzcEAU.exe
  2⤵
  PID:7380
- C:\Windows\System\gdMqVgD.exe
  C:\Windows\System\gdMqVgD.exe
  2⤵
  PID:7396
- C:\Windows\System\DgUaGIY.exe
  C:\Windows\System\DgUaGIY.exe
  2⤵
  PID:7412
- C:\Windows\System\FGVAfTE.exe
  C:\Windows\System\FGVAfTE.exe
  2⤵
  PID:7444
- C:\Windows\System\YWvWPdM.exe
  C:\Windows\System\YWvWPdM.exe
  2⤵
  PID:7460
- C:\Windows\System\btkmtmF.exe
  C:\Windows\System\btkmtmF.exe
  2⤵
  PID:7480
- C:\Windows\System\mMhTlwu.exe
  C:\Windows\System\mMhTlwu.exe
  2⤵
  PID:7504
- C:\Windows\System\nEzoPeD.exe
  C:\Windows\System\nEzoPeD.exe
  2⤵
  PID:7528
- C:\Windows\System\fmITxOs.exe
  C:\Windows\System\fmITxOs.exe
  2⤵
  PID:7568
- C:\Windows\System\ENWbRBC.exe
  C:\Windows\System\ENWbRBC.exe
  2⤵
  PID:7620
- C:\Windows\System\CnxADFX.exe
  C:\Windows\System\CnxADFX.exe
  2⤵
  PID:7636
- C:\Windows\System\DxyqpQR.exe
  C:\Windows\System\DxyqpQR.exe
  2⤵
  PID:7652
- C:\Windows\System\okXDdCg.exe
  C:\Windows\System\okXDdCg.exe
  2⤵
  PID:7668
- C:\Windows\System\HAxkSoo.exe
  C:\Windows\System\HAxkSoo.exe
  2⤵
  PID:7684
- C:\Windows\System\WZuEhWu.exe
  C:\Windows\System\WZuEhWu.exe
  2⤵
  PID:7700
- C:\Windows\System\skaecbD.exe
  C:\Windows\System\skaecbD.exe
  2⤵
  PID:7720
- C:\Windows\System\LRcZmCL.exe
  C:\Windows\System\LRcZmCL.exe
  2⤵
  PID:7736
- C:\Windows\System\AhVJLqL.exe
  C:\Windows\System\AhVJLqL.exe
  2⤵
  PID:7752
- C:\Windows\System\vRpyGMJ.exe
  C:\Windows\System\vRpyGMJ.exe
  2⤵
  PID:7768
- C:\Windows\System\XkmpBBe.exe
  C:\Windows\System\XkmpBBe.exe
  2⤵
  PID:7784
- C:\Windows\System\PRQkyUi.exe
  C:\Windows\System\PRQkyUi.exe
  2⤵
  PID:7800
- C:\Windows\System\nwBaaAn.exe
  C:\Windows\System\nwBaaAn.exe
  2⤵
  PID:7816
- C:\Windows\System\SYwBoKU.exe
  C:\Windows\System\SYwBoKU.exe
  2⤵
  PID:7832
- C:\Windows\System\tnHXeVm.exe
  C:\Windows\System\tnHXeVm.exe
  2⤵
  PID:7848
- C:\Windows\System\cTimziM.exe
  C:\Windows\System\cTimziM.exe
  2⤵
  PID:7864
- C:\Windows\System\JoUQIgd.exe
  C:\Windows\System\JoUQIgd.exe
  2⤵
  PID:7880
- C:\Windows\System\zctPTgI.exe
  C:\Windows\System\zctPTgI.exe
  2⤵
  PID:7896
- C:\Windows\System\dCIFIzW.exe
  C:\Windows\System\dCIFIzW.exe
  2⤵
  PID:7912
- C:\Windows\System\CmWFpsh.exe
  C:\Windows\System\CmWFpsh.exe
  2⤵
  PID:7928
- C:\Windows\System\tRIROUA.exe
  C:\Windows\System\tRIROUA.exe
  2⤵
  PID:7944
- C:\Windows\System\OxaXOMh.exe
  C:\Windows\System\OxaXOMh.exe
  2⤵
  PID:7960
- C:\Windows\System\LCUFwux.exe
  C:\Windows\System\LCUFwux.exe
  2⤵
  PID:7984
- C:\Windows\System\gwQecaD.exe
  C:\Windows\System\gwQecaD.exe
  2⤵
  PID:8004
- C:\Windows\System\UMyxbWd.exe
  C:\Windows\System\UMyxbWd.exe
  2⤵
  PID:8020
- C:\Windows\System\AFrxzyY.exe
  C:\Windows\System\AFrxzyY.exe
  2⤵
  PID:8036
- C:\Windows\System\ucvYkRe.exe
  C:\Windows\System\ucvYkRe.exe
  2⤵
  PID:8052
- C:\Windows\System\iCBQzTn.exe
  C:\Windows\System\iCBQzTn.exe
  2⤵
  PID:8068
- C:\Windows\System\GqtNvHp.exe
  C:\Windows\System\GqtNvHp.exe
  2⤵
  PID:8084
- C:\Windows\System\tZKiUII.exe
  C:\Windows\System\tZKiUII.exe
  2⤵
  PID:8100
- C:\Windows\System\SInaUIW.exe
  C:\Windows\System\SInaUIW.exe
  2⤵
  PID:8116
- C:\Windows\System\WJfwGhc.exe
  C:\Windows\System\WJfwGhc.exe
  2⤵
  PID:8132
- C:\Windows\System\XUdneNO.exe
  C:\Windows\System\XUdneNO.exe
  2⤵
  PID:8148
- C:\Windows\System\BbDulmF.exe
  C:\Windows\System\BbDulmF.exe
  2⤵
  PID:8164
- C:\Windows\System\sfHmjDi.exe
  C:\Windows\System\sfHmjDi.exe
  2⤵
  PID:8180
- C:\Windows\System\zUOTfeO.exe
  C:\Windows\System\zUOTfeO.exe
  2⤵
  PID:6432
- C:\Windows\System\psjdhBd.exe
  C:\Windows\System\psjdhBd.exe
  2⤵
  PID:6176
- C:\Windows\System\VUrSKul.exe
  C:\Windows\System\VUrSKul.exe
  2⤵
  PID:2036
- C:\Windows\System\mUvhMpr.exe
  C:\Windows\System\mUvhMpr.exe
  2⤵
  PID:6304
- C:\Windows\System\HudknjU.exe
  C:\Windows\System\HudknjU.exe
  2⤵
  PID:7152
- C:\Windows\System\QYqhmLm.exe
  C:\Windows\System\QYqhmLm.exe
  2⤵
  PID:7184
- C:\Windows\System\kfPKIjr.exe
  C:\Windows\System\kfPKIjr.exe
  2⤵
  PID:6784
- C:\Windows\System\AsEQwZx.exe
  C:\Windows\System\AsEQwZx.exe
  2⤵
  PID:6996
- C:\Windows\System\ANmXyCl.exe
  C:\Windows\System\ANmXyCl.exe
  2⤵
  PID:7248
- C:\Windows\System\PNvETtE.exe
  C:\Windows\System\PNvETtE.exe
  2⤵
  PID:7284
- C:\Windows\System\LaqHSnV.exe
  C:\Windows\System\LaqHSnV.exe
  2⤵
  PID:7328
- C:\Windows\System\lHpEtXq.exe
  C:\Windows\System\lHpEtXq.exe
  2⤵
  PID:7420
- C:\Windows\System\OFYhcIa.exe
  C:\Windows\System\OFYhcIa.exe
  2⤵
  PID:7436
- C:\Windows\System\bAdPONb.exe
  C:\Windows\System\bAdPONb.exe
  2⤵
  PID:7476
- C:\Windows\System\QaIwYrz.exe
  C:\Windows\System\QaIwYrz.exe
  2⤵
  PID:7524
- C:\Windows\System\ViuhXlH.exe
  C:\Windows\System\ViuhXlH.exe
  2⤵
  PID:6968
- C:\Windows\System\idTLpfg.exe
  C:\Windows\System\idTLpfg.exe
  2⤵
  PID:7044
- C:\Windows\System\usqcGUk.exe
  C:\Windows\System\usqcGUk.exe
  2⤵
  PID:3336
- C:\Windows\System\gcduWsZ.exe
  C:\Windows\System\gcduWsZ.exe
  2⤵
  PID:7516
- C:\Windows\System\ssjtHzq.exe
  C:\Windows\System\ssjtHzq.exe
  2⤵
  PID:6320
- C:\Windows\System\TxQcRXu.exe
  C:\Windows\System\TxQcRXu.exe
  2⤵
  PID:6656
- C:\Windows\System\jRIgLip.exe
  C:\Windows\System\jRIgLip.exe
  2⤵
  PID:6496
- C:\Windows\System\mlifjAn.exe
  C:\Windows\System\mlifjAn.exe
  2⤵
  PID:7748
- C:\Windows\System\WzEHGLA.exe
  C:\Windows\System\WzEHGLA.exe
  2⤵
  PID:7200
- C:\Windows\System\JVPvehp.exe
  C:\Windows\System\JVPvehp.exe
  2⤵
  PID:7304
- C:\Windows\System\rRclFXO.exe
  C:\Windows\System\rRclFXO.exe
  2⤵
  PID:7564
- C:\Windows\System\hRdBErt.exe
  C:\Windows\System\hRdBErt.exe
  2⤵
  PID:6836
- C:\Windows\System\lloUwyE.exe
  C:\Windows\System\lloUwyE.exe
  2⤵
  PID:7576
- C:\Windows\System\VSDZryX.exe
  C:\Windows\System\VSDZryX.exe
  2⤵
  PID:7592
- C:\Windows\System\IrOnsZc.exe
  C:\Windows\System\IrOnsZc.exe
  2⤵
  PID:7612
- C:\Windows\System\FXNGGUv.exe
  C:\Windows\System\FXNGGUv.exe
  2⤵
  PID:7012
- C:\Windows\System\harIfHS.exe
  C:\Windows\System\harIfHS.exe
  2⤵
  PID:6756
- C:\Windows\System\XVpxXoD.exe
  C:\Windows\System\XVpxXoD.exe
  2⤵
  PID:7696
- C:\Windows\System\AVjaYbv.exe
  C:\Windows\System\AVjaYbv.exe
  2⤵
  PID:7760
- C:\Windows\System\bwAnfru.exe
  C:\Windows\System\bwAnfru.exe
  2⤵
  PID:7808
- C:\Windows\System\eBmQzki.exe
  C:\Windows\System\eBmQzki.exe
  2⤵
  PID:7792
- C:\Windows\System\qiOxqnF.exe
  C:\Windows\System\qiOxqnF.exe
  2⤵
  PID:7856
- C:\Windows\System\CacniBe.exe
  C:\Windows\System\CacniBe.exe
  2⤵
  PID:7904
- C:\Windows\System\TfYHOhz.exe
  C:\Windows\System\TfYHOhz.exe
  2⤵
  PID:7980
- C:\Windows\System\GjGkKLP.exe
  C:\Windows\System\GjGkKLP.exe
  2⤵
  PID:7892
- C:\Windows\System\cKjxbRJ.exe
  C:\Windows\System\cKjxbRJ.exe
  2⤵
  PID:7956
- C:\Windows\System\ItWduCT.exe
  C:\Windows\System\ItWduCT.exe
  2⤵
  PID:8064
- C:\Windows\System\TOHbXqA.exe
  C:\Windows\System\TOHbXqA.exe
  2⤵
  PID:8128
- C:\Windows\System\ENhTNvj.exe
  C:\Windows\System\ENhTNvj.exe
  2⤵
  PID:3176
- C:\Windows\System\aLJPbzF.exe
  C:\Windows\System\aLJPbzF.exe
  2⤵
  PID:1760
- C:\Windows\System\CyuTnxA.exe
  C:\Windows\System\CyuTnxA.exe
  2⤵
  PID:7220
- C:\Windows\System\AWLKCRx.exe
  C:\Windows\System\AWLKCRx.exe
  2⤵
  PID:7428
- C:\Windows\System\btWcVWV.exe
  C:\Windows\System\btWcVWV.exe
  2⤵
  PID:6976
- C:\Windows\System\szWDNDY.exe
  C:\Windows\System\szWDNDY.exe
  2⤵
  PID:6452
- C:\Windows\System\yOrdfMW.exe
  C:\Windows\System\yOrdfMW.exe
  2⤵
  PID:7232
- C:\Windows\System\iRkfebg.exe
  C:\Windows\System\iRkfebg.exe
  2⤵
  PID:6124
- C:\Windows\System\AxqvnSq.exe
  C:\Windows\System\AxqvnSq.exe
  2⤵
  PID:8044
- C:\Windows\System\rkyUGHS.exe
  C:\Windows\System\rkyUGHS.exe
  2⤵
  PID:8108
- C:\Windows\System\uvpwEbQ.exe
  C:\Windows\System\uvpwEbQ.exe
  2⤵
  PID:2952
- C:\Windows\System\YlFcBeg.exe
  C:\Windows\System\YlFcBeg.exe
  2⤵
  PID:6052
- C:\Windows\System\nWcmlug.exe
  C:\Windows\System\nWcmlug.exe
  2⤵
  PID:7500
- C:\Windows\System\wGeLRNL.exe
  C:\Windows\System\wGeLRNL.exe
  2⤵
  PID:7408
- C:\Windows\System\mOZSkNL.exe
  C:\Windows\System\mOZSkNL.exe
  2⤵
  PID:7496
- C:\Windows\System\DhCanfL.exe
  C:\Windows\System\DhCanfL.exe
  2⤵
  PID:6904
- C:\Windows\System\ARYpeph.exe
  C:\Windows\System\ARYpeph.exe
  2⤵
  PID:7632
- C:\Windows\System\KkEDzti.exe
  C:\Windows\System\KkEDzti.exe
  2⤵
  PID:7644
- C:\Windows\System\gPbvHbv.exe
  C:\Windows\System\gPbvHbv.exe
  2⤵
  PID:7744
- C:\Windows\System\qtJBuIh.exe
  C:\Windows\System\qtJBuIh.exe
  2⤵
  PID:7828
- C:\Windows\System\ZCgKhiX.exe
  C:\Windows\System\ZCgKhiX.exe
  2⤵
  PID:7264
- C:\Windows\System\GojnOsh.exe
  C:\Windows\System\GojnOsh.exe
  2⤵
  PID:7608
- C:\Windows\System\EQdXabM.exe
  C:\Windows\System\EQdXabM.exe
  2⤵
  PID:7080
- C:\Windows\System\bMjxtJZ.exe
  C:\Windows\System\bMjxtJZ.exe
  2⤵
  PID:7732
- C:\Windows\System\bLmvCty.exe
  C:\Windows\System\bLmvCty.exe
  2⤵
  PID:8000
- C:\Windows\System\irYOIRr.exe
  C:\Windows\System\irYOIRr.exe
  2⤵
  PID:7952
- C:\Windows\System\ZfgEdqq.exe
  C:\Windows\System\ZfgEdqq.exe
  2⤵
  PID:3920
- C:\Windows\System\kAjptVL.exe
  C:\Windows\System\kAjptVL.exe
  2⤵
  PID:7676
- C:\Windows\System\JkdSgMd.exe
  C:\Windows\System\JkdSgMd.exe
  2⤵
  PID:4296
- C:\Windows\System\avDXGmO.exe
  C:\Windows\System\avDXGmO.exe
  2⤵
  PID:8060
- C:\Windows\System\xShBjEq.exe
  C:\Windows\System\xShBjEq.exe
  2⤵
  PID:8160
- C:\Windows\System\HbUWePe.exe
  C:\Windows\System\HbUWePe.exe
  2⤵
  PID:7512
- C:\Windows\System\cFMiWag.exe
  C:\Windows\System\cFMiWag.exe
  2⤵
  PID:6992
- C:\Windows\System\acSTgcr.exe
  C:\Windows\System\acSTgcr.exe
  2⤵
  PID:8080
- C:\Windows\System\KmtprjQ.exe
  C:\Windows\System\KmtprjQ.exe
  2⤵
  PID:7468
- C:\Windows\System\QFpDizQ.exe
  C:\Windows\System\QFpDizQ.exe
  2⤵
  PID:7136
- C:\Windows\System\CgoOEng.exe
  C:\Windows\System\CgoOEng.exe
  2⤵
  PID:7712
- C:\Windows\System\DprmVCZ.exe
  C:\Windows\System\DprmVCZ.exe
  2⤵
  PID:6884
- C:\Windows\System\BnHpmWd.exe
  C:\Windows\System\BnHpmWd.exe
  2⤵
  PID:7556
- C:\Windows\System\thYRoxi.exe
  C:\Windows\System\thYRoxi.exe
  2⤵
  PID:7584
- C:\Windows\System\PpIUhFD.exe
  C:\Windows\System\PpIUhFD.exe
  2⤵
  PID:7776
- C:\Windows\System\lxukgtX.exe
  C:\Windows\System\lxukgtX.exe
  2⤵
  PID:7764
- C:\Windows\System\cGCNcLk.exe
  C:\Windows\System\cGCNcLk.exe
  2⤵
  PID:8144
- C:\Windows\System\NaRpSRQ.exe
  C:\Windows\System\NaRpSRQ.exe
  2⤵
  PID:7164
- C:\Windows\System\curMKTh.exe
  C:\Windows\System\curMKTh.exe
  2⤵
  PID:7472
- C:\Windows\System\kiZuusP.exe
  C:\Windows\System\kiZuusP.exe
  2⤵
  PID:7456
- C:\Windows\System\gJVQHta.exe
  C:\Windows\System\gJVQHta.exe
  2⤵
  PID:8172
- C:\Windows\System\GwdluqW.exe
  C:\Windows\System\GwdluqW.exe
  2⤵
  PID:4116
- C:\Windows\System\GtxgqBc.exe
  C:\Windows\System\GtxgqBc.exe
  2⤵
  PID:8196
- C:\Windows\System\HafQbJZ.exe
  C:\Windows\System\HafQbJZ.exe
  2⤵
  PID:8212
- C:\Windows\System\yTqaARL.exe
  C:\Windows\System\yTqaARL.exe
  2⤵
  PID:8228
- C:\Windows\System\ZzroChG.exe
  C:\Windows\System\ZzroChG.exe
  2⤵
  PID:8244
- C:\Windows\System\AIkEVPr.exe
  C:\Windows\System\AIkEVPr.exe
  2⤵
  PID:8260
- C:\Windows\System\AEWpaSi.exe
  C:\Windows\System\AEWpaSi.exe
  2⤵
  PID:8276
- C:\Windows\System\JjjhUAt.exe
  C:\Windows\System\JjjhUAt.exe
  2⤵
  PID:8292
- C:\Windows\System\ypVWxgE.exe
  C:\Windows\System\ypVWxgE.exe
  2⤵
  PID:8308
- C:\Windows\System\lSjiEXV.exe
  C:\Windows\System\lSjiEXV.exe
  2⤵
  PID:8324
- C:\Windows\System\GjqmZCp.exe
  C:\Windows\System\GjqmZCp.exe
  2⤵
  PID:8340
- C:\Windows\System\mkSvMfH.exe
  C:\Windows\System\mkSvMfH.exe
  2⤵
  PID:8356
- C:\Windows\System\YcgpNHM.exe
  C:\Windows\System\YcgpNHM.exe
  2⤵
  PID:8372
- C:\Windows\System\QfcKsou.exe
  C:\Windows\System\QfcKsou.exe
  2⤵
  PID:8388
- C:\Windows\System\mQRJZDJ.exe
  C:\Windows\System\mQRJZDJ.exe
  2⤵
  PID:8404
- C:\Windows\System\CSMcQOf.exe
  C:\Windows\System\CSMcQOf.exe
  2⤵
  PID:8420
- C:\Windows\System\fBdXHea.exe
  C:\Windows\System\fBdXHea.exe
  2⤵
  PID:8436
- C:\Windows\System\WnAbnrf.exe
  C:\Windows\System\WnAbnrf.exe
  2⤵
  PID:8452
- C:\Windows\System\EHqxGdu.exe
  C:\Windows\System\EHqxGdu.exe
  2⤵
  PID:8468
- C:\Windows\System\qxAhiBT.exe
  C:\Windows\System\qxAhiBT.exe
  2⤵
  PID:8484
- C:\Windows\System\OEXeHIw.exe
  C:\Windows\System\OEXeHIw.exe
  2⤵
  PID:8500
- C:\Windows\System\nuramwq.exe
  C:\Windows\System\nuramwq.exe
  2⤵
  PID:8516
- C:\Windows\System\oCirVBl.exe
  C:\Windows\System\oCirVBl.exe
  2⤵
  PID:8532
- C:\Windows\System\cnzbuZn.exe
  C:\Windows\System\cnzbuZn.exe
  2⤵
  PID:8548
- C:\Windows\System\dotCuCc.exe
  C:\Windows\System\dotCuCc.exe
  2⤵
  PID:8564
- C:\Windows\System\FQxXJzV.exe
  C:\Windows\System\FQxXJzV.exe
  2⤵
  PID:8580
- C:\Windows\System\tncKihA.exe
  C:\Windows\System\tncKihA.exe
  2⤵
  PID:8596
- C:\Windows\System\KPQeKdk.exe
  C:\Windows\System\KPQeKdk.exe
  2⤵
  PID:8612
- C:\Windows\System\PiMQSgf.exe
  C:\Windows\System\PiMQSgf.exe
  2⤵
  PID:8628
- C:\Windows\System\XyBvDIf.exe
  C:\Windows\System\XyBvDIf.exe
  2⤵
  PID:8644
- C:\Windows\System\FkCOSun.exe
  C:\Windows\System\FkCOSun.exe
  2⤵
  PID:8660
- C:\Windows\System\nmCLrYt.exe
  C:\Windows\System\nmCLrYt.exe
  2⤵
  PID:8676
- C:\Windows\System\DThUSNg.exe
  C:\Windows\System\DThUSNg.exe
  2⤵
  PID:8692
- C:\Windows\System\RRPTNVH.exe
  C:\Windows\System\RRPTNVH.exe
  2⤵
  PID:8708
- C:\Windows\System\quXeemI.exe
  C:\Windows\System\quXeemI.exe
  2⤵
  PID:8724
- C:\Windows\System\bUsZpRN.exe
  C:\Windows\System\bUsZpRN.exe
  2⤵
  PID:8744
- C:\Windows\System\YaFMabb.exe
  C:\Windows\System\YaFMabb.exe
  2⤵
  PID:8760
- C:\Windows\System\HXgPTVV.exe
  C:\Windows\System\HXgPTVV.exe
  2⤵
  PID:8776
- C:\Windows\System\OpgQpWV.exe
  C:\Windows\System\OpgQpWV.exe
  2⤵
  PID:8792
- C:\Windows\System\cPjKKSG.exe
  C:\Windows\System\cPjKKSG.exe
  2⤵
  PID:8808
- C:\Windows\System\YmSOVEN.exe
  C:\Windows\System\YmSOVEN.exe
  2⤵
  PID:8824
- C:\Windows\System\gedWCKZ.exe
  C:\Windows\System\gedWCKZ.exe
  2⤵
  PID:8840
- C:\Windows\System\lrYhkse.exe
  C:\Windows\System\lrYhkse.exe
  2⤵
  PID:8856
- C:\Windows\System\wkBJLMM.exe
  C:\Windows\System\wkBJLMM.exe
  2⤵
  PID:8872
- C:\Windows\System\NyDVtoh.exe
  C:\Windows\System\NyDVtoh.exe
  2⤵
  PID:8888
- C:\Windows\System\UZBMXor.exe
  C:\Windows\System\UZBMXor.exe
  2⤵
  PID:8904
- C:\Windows\System\yaGGRdp.exe
  C:\Windows\System\yaGGRdp.exe
  2⤵
  PID:8920
- C:\Windows\System\nuDuGBH.exe
  C:\Windows\System\nuDuGBH.exe
  2⤵
  PID:8936
- C:\Windows\System\admYSys.exe
  C:\Windows\System\admYSys.exe
  2⤵
  PID:8952
- C:\Windows\System\vmflJeK.exe
  C:\Windows\System\vmflJeK.exe
  2⤵
  PID:8968
- C:\Windows\System\GCxdSOv.exe
  C:\Windows\System\GCxdSOv.exe
  2⤵
  PID:8984
- C:\Windows\System\uvQGwhi.exe
  C:\Windows\System\uvQGwhi.exe
  2⤵
  PID:9000
- C:\Windows\System\TtLzCBn.exe
  C:\Windows\System\TtLzCBn.exe
  2⤵
  PID:9016
- C:\Windows\System\iHVhdRF.exe
  C:\Windows\System\iHVhdRF.exe
  2⤵
  PID:9032
- C:\Windows\System\WjWLJgq.exe
  C:\Windows\System\WjWLJgq.exe
  2⤵
  PID:9052
- C:\Windows\System\ZSWHEiy.exe
  C:\Windows\System\ZSWHEiy.exe
  2⤵
  PID:9068
- C:\Windows\System\tljQymt.exe
  C:\Windows\System\tljQymt.exe
  2⤵
  PID:9084
- C:\Windows\System\iNWgStm.exe
  C:\Windows\System\iNWgStm.exe
  2⤵
  PID:9100
- C:\Windows\System\TwBSBDj.exe
  C:\Windows\System\TwBSBDj.exe
  2⤵
  PID:9116
- C:\Windows\System\cNggqMN.exe
  C:\Windows\System\cNggqMN.exe
  2⤵
  PID:9132
- C:\Windows\System\RSxjnnw.exe
  C:\Windows\System\RSxjnnw.exe
  2⤵
  PID:9148
- C:\Windows\System\QGRoFKH.exe
  C:\Windows\System\QGRoFKH.exe
  2⤵
  PID:9164
- C:\Windows\System\FwbPeHi.exe
  C:\Windows\System\FwbPeHi.exe
  2⤵
  PID:9180
- C:\Windows\System\EUTroVB.exe
  C:\Windows\System\EUTroVB.exe
  2⤵
  PID:9196
- C:\Windows\System\SBLpxMj.exe
  C:\Windows\System\SBLpxMj.exe
  2⤵
  PID:9212
- C:\Windows\System\wtoNSVE.exe
  C:\Windows\System\wtoNSVE.exe
  2⤵
  PID:7844
- C:\Windows\System\CSEgpUK.exe
  C:\Windows\System\CSEgpUK.exe
  2⤵
  PID:7536
- C:\Windows\System\ONdfrBQ.exe
  C:\Windows\System\ONdfrBQ.exe
  2⤵
  PID:7344
- C:\Windows\System\citThfs.exe
  C:\Windows\System\citThfs.exe
  2⤵
  PID:7268
- C:\Windows\System\iILzAia.exe
  C:\Windows\System\iILzAia.exe
  2⤵
  PID:8236
- C:\Windows\System\vMlYhva.exe
  C:\Windows\System\vMlYhva.exe
  2⤵
  PID:8076
- C:\Windows\System\jcwQzSi.exe
  C:\Windows\System\jcwQzSi.exe
  2⤵
  PID:8240
- C:\Windows\System\ngiWDtH.exe
  C:\Windows\System\ngiWDtH.exe
  2⤵
  PID:8272
- C:\Windows\System\ovhVrjA.exe
  C:\Windows\System\ovhVrjA.exe
  2⤵
  PID:6720
- C:\Windows\System\tHOHOGZ.exe
  C:\Windows\System\tHOHOGZ.exe
  2⤵
  PID:8224
- C:\Windows\System\cHfyOlh.exe
  C:\Windows\System\cHfyOlh.exe
  2⤵
  PID:8332
- C:\Windows\System\cxVjSIE.exe
  C:\Windows\System\cxVjSIE.exe
  2⤵
  PID:8288
- C:\Windows\System\cpynhiT.exe
  C:\Windows\System\cpynhiT.exe
  2⤵
  PID:8400
- C:\Windows\System\HAbjnEm.exe
  C:\Windows\System\HAbjnEm.exe
  2⤵
  PID:8352
- C:\Windows\System\ECbwUse.exe
  C:\Windows\System\ECbwUse.exe
  2⤵
  PID:8496
- C:\Windows\System\hjOyCRQ.exe
  C:\Windows\System\hjOyCRQ.exe
  2⤵
  PID:8348
- C:\Windows\System\FUIcTMS.exe
  C:\Windows\System\FUIcTMS.exe
  2⤵
  PID:8512
- C:\Windows\System\XTbMrtm.exe
  C:\Windows\System\XTbMrtm.exe
  2⤵
  PID:8560
- C:\Windows\System\vigFCMk.exe
  C:\Windows\System\vigFCMk.exe
  2⤵
  PID:8588
- C:\Windows\System\sdfrzZH.exe
  C:\Windows\System\sdfrzZH.exe
  2⤵
  PID:8652
- C:\Windows\System\mgYLgOw.exe
  C:\Windows\System\mgYLgOw.exe
  2⤵
  PID:8508
- C:\Windows\System\WjgChkv.exe
  C:\Windows\System\WjgChkv.exe
  2⤵
  PID:8756
- C:\Windows\System\RkgJXjr.exe
  C:\Windows\System\RkgJXjr.exe
  2⤵
  PID:8816
- C:\Windows\System\mMujecp.exe
  C:\Windows\System\mMujecp.exe
  2⤵
  PID:8604
- C:\Windows\System\KqCHUSo.exe
  C:\Windows\System\KqCHUSo.exe
  2⤵
  PID:8572
- C:\Windows\System\cyQGkkq.exe
  C:\Windows\System\cyQGkkq.exe
  2⤵
  PID:8912
- C:\Windows\System\xppXvll.exe
  C:\Windows\System\xppXvll.exe
  2⤵
  PID:8976
- C:\Windows\System\XGJxsrl.exe
  C:\Windows\System\XGJxsrl.exe
  2⤵
  PID:8608
- C:\Windows\System\sLgGstL.exe
  C:\Windows\System\sLgGstL.exe
  2⤵
  PID:8700
- C:\Windows\System\nrpLIHd.exe
  C:\Windows\System\nrpLIHd.exe
  2⤵
  PID:8772
- C:\Windows\System\gtdltVi.exe
  C:\Windows\System\gtdltVi.exe
  2⤵
  PID:8768
- C:\Windows\System\GunUMkm.exe
  C:\Windows\System\GunUMkm.exe
  2⤵
  PID:9108
- C:\Windows\System\Ldijvps.exe
  C:\Windows\System\Ldijvps.exe
  2⤵
  PID:8832
- C:\Windows\System\WXPRUkQ.exe
  C:\Windows\System\WXPRUkQ.exe
  2⤵
  PID:8900
- C:\Windows\System\wSAlauk.exe
  C:\Windows\System\wSAlauk.exe
  2⤵
  PID:9176
- C:\Windows\System\iTSTsgp.exe
  C:\Windows\System\iTSTsgp.exe
  2⤵
  PID:8928
- C:\Windows\System\AeDwGcl.exe
  C:\Windows\System\AeDwGcl.exe
  2⤵
  PID:8964
- C:\Windows\System\csPlAvm.exe
  C:\Windows\System\csPlAvm.exe
  2⤵
  PID:9060
- C:\Windows\System\PJWZLDG.exe
  C:\Windows\System\PJWZLDG.exe
  2⤵
  PID:9128
- C:\Windows\System\aegedWK.exe
  C:\Windows\System\aegedWK.exe
  2⤵
  PID:7872
- C:\Windows\System\hsmBMGq.exe
  C:\Windows\System\hsmBMGq.exe
  2⤵
  PID:9096
- C:\Windows\System\pvhdiBL.exe
  C:\Windows\System\pvhdiBL.exe
  2⤵
  PID:6368
- C:\Windows\System\RSqKmaO.exe
  C:\Windows\System\RSqKmaO.exe
  2⤵
  PID:7780
- C:\Windows\System\VmpuDpz.exe
  C:\Windows\System\VmpuDpz.exe
  2⤵
  PID:7308
- C:\Windows\System\VIcEXKW.exe
  C:\Windows\System\VIcEXKW.exe
  2⤵
  PID:7292
- C:\Windows\System\capwBoB.exe
  C:\Windows\System\capwBoB.exe
  2⤵
  PID:8368
- C:\Windows\System\RGTMnXj.exe
  C:\Windows\System\RGTMnXj.exe
  2⤵
  PID:8380
- C:\Windows\System\zxLItpL.exe
  C:\Windows\System\zxLItpL.exe
  2⤵
  PID:8620
- C:\Windows\System\BfMJKxP.exe
  C:\Windows\System\BfMJKxP.exe
  2⤵
  PID:8492
- C:\Windows\System\KzMQZlz.exe
  C:\Windows\System\KzMQZlz.exe
  2⤵
  PID:8684
- C:\Windows\System\FUKhymV.exe
  C:\Windows\System\FUKhymV.exe
  2⤵
  PID:8852
- C:\Windows\System\DQbwRAp.exe
  C:\Windows\System\DQbwRAp.exe
  2⤵
  PID:9012
- C:\Windows\System\HZUDmDk.exe
  C:\Windows\System\HZUDmDk.exe
  2⤵
  PID:9080
- C:\Windows\System\LicDlfg.exe
  C:\Windows\System\LicDlfg.exe
  2⤵
  PID:9208
- C:\Windows\System\IJqtkPF.exe
  C:\Windows\System\IJqtkPF.exe
  2⤵
  PID:7520
- C:\Windows\System\btxowSN.exe
  C:\Windows\System\btxowSN.exe
  2⤵
  PID:8732
- C:\Windows\System\NOBkYvw.exe
  C:\Windows\System\NOBkYvw.exe
  2⤵
  PID:9172
- C:\Windows\System\qbljUgi.exe
  C:\Windows\System\qbljUgi.exe
  2⤵
  PID:8640
- C:\Windows\System\JuSmrVH.exe
  C:\Windows\System\JuSmrVH.exe
  2⤵
  PID:8736
- C:\Windows\System\UmaSHQw.exe
  C:\Windows\System\UmaSHQw.exe
  2⤵
  PID:8960
- C:\Windows\System\edqLRtm.exe
  C:\Windows\System\edqLRtm.exe
  2⤵
  PID:8948
- C:\Windows\System\xgMLuef.exe
  C:\Windows\System\xgMLuef.exe
  2⤵
  PID:5588
- C:\Windows\System\dbaESPn.exe
  C:\Windows\System\dbaESPn.exe
  2⤵
  PID:8220
- C:\Windows\System\HXpCIqe.exe
  C:\Windows\System\HXpCIqe.exe
  2⤵
  PID:8480
- C:\Windows\System\itYHJym.exe
  C:\Windows\System\itYHJym.exe
  2⤵
  PID:9008
- C:\Windows\System\kOugqaO.exe
  C:\Windows\System\kOugqaO.exe
  2⤵
  PID:8868
- C:\Windows\System\AQyjeQh.exe
  C:\Windows\System\AQyjeQh.exe
  2⤵
  PID:8688
- C:\Windows\System\YBpvmvJ.exe
  C:\Windows\System\YBpvmvJ.exe
  2⤵
  PID:8804
- C:\Windows\System\CGShqoG.exe
  C:\Windows\System\CGShqoG.exe
  2⤵
  PID:8460
- C:\Windows\System\dKYShcc.exe
  C:\Windows\System\dKYShcc.exe
  2⤵
  PID:7388
- C:\Windows\System\xIaTHiO.exe
  C:\Windows\System\xIaTHiO.exe
  2⤵
  PID:7540
- C:\Windows\System\DEKmxJz.exe
  C:\Windows\System\DEKmxJz.exe
  2⤵
  PID:9044
- C:\Windows\System\rnkpwFV.exe
  C:\Windows\System\rnkpwFV.exe
  2⤵
  PID:8208
- C:\Windows\System\pSjNFEw.exe
  C:\Windows\System\pSjNFEw.exe
  2⤵
  PID:8432
- C:\Windows\System\kkbMZCM.exe
  C:\Windows\System\kkbMZCM.exe
  2⤵
  PID:9232
- C:\Windows\System\ViMXhND.exe
  C:\Windows\System\ViMXhND.exe
  2⤵
  PID:9248
- C:\Windows\System\GhDCnmk.exe
  C:\Windows\System\GhDCnmk.exe
  2⤵
  PID:9264
- C:\Windows\System\OhrwVIB.exe
  C:\Windows\System\OhrwVIB.exe
  2⤵
  PID:9280
- C:\Windows\System\emcgSnw.exe
  C:\Windows\System\emcgSnw.exe
  2⤵
  PID:9300
- C:\Windows\System\llfnWck.exe
  C:\Windows\System\llfnWck.exe
  2⤵
  PID:9316
- C:\Windows\System\QQxiaTB.exe
  C:\Windows\System\QQxiaTB.exe
  2⤵
  PID:9332
- C:\Windows\System\FGFnWjN.exe
  C:\Windows\System\FGFnWjN.exe
  2⤵
  PID:9348
- C:\Windows\System\ThQrBQe.exe
  C:\Windows\System\ThQrBQe.exe
  2⤵
  PID:9364
- C:\Windows\System\eKRgYDF.exe
  C:\Windows\System\eKRgYDF.exe
  2⤵
  PID:9380
- C:\Windows\System\qkfexrg.exe
  C:\Windows\System\qkfexrg.exe
  2⤵
  PID:9396
- C:\Windows\System\WdmXNta.exe
  C:\Windows\System\WdmXNta.exe
  2⤵
  PID:9412
- C:\Windows\System\XhukKfy.exe
  C:\Windows\System\XhukKfy.exe
  2⤵
  PID:9428
- C:\Windows\System\hKJTaHH.exe
  C:\Windows\System\hKJTaHH.exe
  2⤵
  PID:9444
- C:\Windows\System\nAfHSju.exe
  C:\Windows\System\nAfHSju.exe
  2⤵
  PID:9460
- C:\Windows\System\qtpqtmG.exe
  C:\Windows\System\qtpqtmG.exe
  2⤵
  PID:9476
- C:\Windows\System\KxCGFCP.exe
  C:\Windows\System\KxCGFCP.exe
  2⤵
  PID:9492
- C:\Windows\System\mVTWcIW.exe
  C:\Windows\System\mVTWcIW.exe
  2⤵
  PID:9508
- C:\Windows\System\bKSICeN.exe
  C:\Windows\System\bKSICeN.exe
  2⤵
  PID:9524
- C:\Windows\System\cTHquwQ.exe
  C:\Windows\System\cTHquwQ.exe
  2⤵
  PID:9540
- C:\Windows\System\JLBsgYZ.exe
  C:\Windows\System\JLBsgYZ.exe
  2⤵
  PID:9556
- C:\Windows\System\yQczDlB.exe
  C:\Windows\System\yQczDlB.exe
  2⤵
  PID:9572
- C:\Windows\System\ZFuymck.exe
  C:\Windows\System\ZFuymck.exe
  2⤵
  PID:9592
- C:\Windows\System\PFrqTNw.exe
  C:\Windows\System\PFrqTNw.exe
  2⤵
  PID:9608
- C:\Windows\System\XCHdPLA.exe
  C:\Windows\System\XCHdPLA.exe
  2⤵
  PID:9624
- C:\Windows\System\IgInIPy.exe
  C:\Windows\System\IgInIPy.exe
  2⤵
  PID:9640
- C:\Windows\System\HPBLAKB.exe
  C:\Windows\System\HPBLAKB.exe
  2⤵
  PID:9656
- C:\Windows\System\JZtUvsQ.exe
  C:\Windows\System\JZtUvsQ.exe
  2⤵
  PID:9672
- C:\Windows\System\fEbJvuC.exe
  C:\Windows\System\fEbJvuC.exe
  2⤵
  PID:9688
- C:\Windows\System\SfSJhkd.exe
  C:\Windows\System\SfSJhkd.exe
  2⤵
  PID:9704
- C:\Windows\System\HiggkDr.exe
  C:\Windows\System\HiggkDr.exe
  2⤵
  PID:9720
- C:\Windows\System\wWTVuMb.exe
  C:\Windows\System\wWTVuMb.exe
  2⤵
  PID:9736
- C:\Windows\System\cChlEvC.exe
  C:\Windows\System\cChlEvC.exe
  2⤵
  PID:9752
- C:\Windows\System\KbwUjsE.exe
  C:\Windows\System\KbwUjsE.exe
  2⤵
  PID:9768
- C:\Windows\System\wUCeCZB.exe
  C:\Windows\System\wUCeCZB.exe
  2⤵
  PID:9784
- C:\Windows\System\IoYsNKG.exe
  C:\Windows\System\IoYsNKG.exe
  2⤵
  PID:9800
- C:\Windows\System\jpUTWXf.exe
  C:\Windows\System\jpUTWXf.exe
  2⤵
  PID:9816
- C:\Windows\System\eznrdMP.exe
  C:\Windows\System\eznrdMP.exe
  2⤵
  PID:9832
- C:\Windows\System\AYCthZT.exe
  C:\Windows\System\AYCthZT.exe
  2⤵
  PID:9848
- C:\Windows\System\vYRgbdB.exe
  C:\Windows\System\vYRgbdB.exe
  2⤵
  PID:9864
- C:\Windows\System\pEXfjDG.exe
  C:\Windows\System\pEXfjDG.exe
  2⤵
  PID:9880
- C:\Windows\System\jrHlpVb.exe
  C:\Windows\System\jrHlpVb.exe
  2⤵
  PID:9896
- C:\Windows\System\vXncgEk.exe
  C:\Windows\System\vXncgEk.exe
  2⤵
  PID:9912
- C:\Windows\System\aryGeUQ.exe
  C:\Windows\System\aryGeUQ.exe
  2⤵
  PID:9928
- C:\Windows\System\gjyJSao.exe
  C:\Windows\System\gjyJSao.exe
  2⤵
  PID:9944
- C:\Windows\System\HwWwyyd.exe
  C:\Windows\System\HwWwyyd.exe
  2⤵
  PID:9960
- C:\Windows\System\QJJtpCC.exe
  C:\Windows\System\QJJtpCC.exe
  2⤵
  PID:9976
- C:\Windows\System\lRfCeCw.exe
  C:\Windows\System\lRfCeCw.exe
  2⤵
  PID:9992
- C:\Windows\System\RxCHldh.exe
  C:\Windows\System\RxCHldh.exe
  2⤵
  PID:10008
- C:\Windows\System\UFUmwCm.exe
  C:\Windows\System\UFUmwCm.exe
  2⤵
  PID:10024
- C:\Windows\System\PguAwfK.exe
  C:\Windows\System\PguAwfK.exe
  2⤵
  PID:10040
- C:\Windows\System\DBsyGRg.exe
  C:\Windows\System\DBsyGRg.exe
  2⤵
  PID:10056
- C:\Windows\System\yxCNrrI.exe
  C:\Windows\System\yxCNrrI.exe
  2⤵
  PID:10072
- C:\Windows\System\THdfzcF.exe
  C:\Windows\System\THdfzcF.exe
  2⤵
  PID:10088
- C:\Windows\System\AttleGw.exe
  C:\Windows\System\AttleGw.exe
  2⤵
  PID:10104
- C:\Windows\System\eFqQMVW.exe
  C:\Windows\System\eFqQMVW.exe
  2⤵
  PID:10124
- C:\Windows\System\gBHKSzQ.exe
  C:\Windows\System\gBHKSzQ.exe
  2⤵
  PID:10140
- C:\Windows\System\IsxANMe.exe
  C:\Windows\System\IsxANMe.exe
  2⤵
  PID:10156
- C:\Windows\System\wFLNEWH.exe
  C:\Windows\System\wFLNEWH.exe
  2⤵
  PID:10172
- C:\Windows\System\RZqPAND.exe
  C:\Windows\System\RZqPAND.exe
  2⤵
  PID:10188
- C:\Windows\System\awxrmrW.exe
  C:\Windows\System\awxrmrW.exe
  2⤵
  PID:10204
- C:\Windows\System\saEYrdQ.exe
  C:\Windows\System\saEYrdQ.exe
  2⤵
  PID:10220
- C:\Windows\System\DixVHpd.exe
  C:\Windows\System\DixVHpd.exe
  2⤵
  PID:10236
- C:\Windows\System\oGGoeAS.exe
  C:\Windows\System\oGGoeAS.exe
  2⤵
  PID:9272
- C:\Windows\System\aLWoALE.exe
  C:\Windows\System\aLWoALE.exe
  2⤵
  PID:8884
- C:\Windows\System\lSvmyha.exe
  C:\Windows\System\lSvmyha.exe
  2⤵
  PID:8668
- C:\Windows\System\iWiwxry.exe
  C:\Windows\System\iWiwxry.exe
  2⤵
  PID:9224
- C:\Windows\System\QwHvrdB.exe
  C:\Windows\System\QwHvrdB.exe
  2⤵
  PID:9340
- C:\Windows\System\gBttaMp.exe
  C:\Windows\System\gBttaMp.exe
  2⤵
  PID:9404
- C:\Windows\System\XWOfSih.exe
  C:\Windows\System\XWOfSih.exe
  2⤵
  PID:9468
- C:\Windows\System\jlwYaQK.exe
  C:\Windows\System\jlwYaQK.exe
  2⤵
  PID:9536
- C:\Windows\System\HRJffzj.exe
  C:\Windows\System\HRJffzj.exe
  2⤵
  PID:9420
- C:\Windows\System\ZtThgSl.exe
  C:\Windows\System\ZtThgSl.exe
  2⤵
  PID:9452
- C:\Windows\System\EqMxovq.exe
  C:\Windows\System\EqMxovq.exe
  2⤵
  PID:9360
- C:\Windows\System\ViylqgE.exe
  C:\Windows\System\ViylqgE.exe
  2⤵
  PID:9580
- C:\Windows\System\AJXTeLi.exe
  C:\Windows\System\AJXTeLi.exe
  2⤵
  PID:9516
- C:\Windows\System\RVKrHxc.exe
  C:\Windows\System\RVKrHxc.exe
  2⤵
  PID:9664
- C:\Windows\System\mVYyCIr.exe
  C:\Windows\System\mVYyCIr.exe
  2⤵
  PID:9616
- C:\Windows\System\UGKoiBc.exe
  C:\Windows\System\UGKoiBc.exe
  2⤵
  PID:9764
- C:\Windows\System\drbvPdi.exe
  C:\Windows\System\drbvPdi.exe
  2⤵
  PID:9652
- C:\Windows\System\cCKwrSO.exe
  C:\Windows\System\cCKwrSO.exe
  2⤵
  PID:9716
- C:\Windows\System\yVeUDHC.exe
  C:\Windows\System\yVeUDHC.exe
  2⤵
  PID:9748
- C:\Windows\System\BrYAkuY.exe
  C:\Windows\System\BrYAkuY.exe
  2⤵
  PID:9860
- C:\Windows\System\aGpsUoD.exe
  C:\Windows\System\aGpsUoD.exe
  2⤵
  PID:9840
- C:\Windows\System\mVVnKIA.exe
  C:\Windows\System\mVVnKIA.exe
  2⤵
  PID:9808
- C:\Windows\System\VeYtWbB.exe
  C:\Windows\System\VeYtWbB.exe
  2⤵
  PID:9952
- C:\Windows\System\LsMDsIT.exe
  C:\Windows\System\LsMDsIT.exe
  2⤵
  PID:9904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CBHIDQy.exe

Filesize
2.2MB

MD5
5b3b6f8e155a80500a1c869568fee7a6

SHA1
64e4ed5a87a85dac20c2c8846f7a655e56c97e02

SHA256
2e2d2f076589e745745f42946a2e1dd226e5395ca14374bb82c45d1c0d67c724

SHA512
404eb77e50f07475d89c0ef39c3e386ab3ca818463ae01f7dd5cb048325c1e33da589fab4f03c9c163d5878d16bc2d2066d62350974c90ec53bbbff913cd2b47

Download Submit
C:\Windows\system\CPXkuyk.exe

Filesize
2.2MB

MD5
febdc99a4d4c2ecb6a77a51d6d0d954f

SHA1
97bfd47d46c65acd8b13d3a978baf780f8dafd78

SHA256
369a55cab2efd4916be554dc68b8f39a8b4a8f8e03f61281a0113685d83fd7d2

SHA512
3d8ecd42caf727bc747018f9cc53112664a817ad584f3c3474828ac6c88905898120db5ee13d24de96a179ffdb1db9510a1315b310baafa9801bfd00649c2cfe

Download Submit
C:\Windows\system\DdYdUxq.exe

Filesize
2.2MB

MD5
ecb8d0220be4b69c99960972a87ed4a1

SHA1
4e46837d7a90060004d2bbc784927a27fbc90a80

SHA256
96892648e4b34e5315ebb72628f8ebadd39b81b806373478bd4515e936145f8b

SHA512
39e09273d1e6e9116188df0ed438485796db03797610180efb813394fce27ca7466c5f9aca6b456488b95932b669836b7269efd68c91c63f46bf9e6f9d41c54e

Download Submit
C:\Windows\system\EZhoPCU.exe

Filesize
2.2MB

MD5
d52f2b314e84479fac622abb61f79b99

SHA1
fe93a8afeab3d90883f65e870c220e65261547fd

SHA256
85c0771b2c7493859f3468f0a052d2e7541ebccfbf3bb778734e5bd9a5895fdc

SHA512
39254a5fd255547e05801e9f829676f3d679b598f06b5fa10c6edbcb1c750996cb12cc42733b489d90ebb87cd8a0e33b80b3a8e2160d1362fded0ee950cb9a28

Download Submit
C:\Windows\system\GGRJqXG.exe

Filesize
2.2MB

MD5
abaf3d31ea9e1633f97eb28b57be8a78

SHA1
db7a12cdf19971d3525413de9eca072f9dc2cf65

SHA256
51983d17294cc134144922e2f9d8fa35625552ec3207e83b1b88a81a0d051d47

SHA512
375565db394891a06622cb99e7771893c4f7d92e58d67054bd1e99ad877fd1684b033f2394d70aef047a0cb746314403b889bc91869a611f42c3a0f01ce2194b

Download Submit
C:\Windows\system\IlwAVkb.exe

Filesize
2.2MB

MD5
318b8d7b402bfb1882ab44b7f4419ca9

SHA1
4f2933638ad5c3f9c415edd77e71965fb3de698c

SHA256
7b6ae8730e4b407236684d6d4446a7216fd8bc06362df0f70149d34358103a1d

SHA512
647827720aaac92537392da8ecead7da7d42821d676541e36e4715f465a0506fb79f4ba86f6fcf08d85c6de3f510ce9c510b24dadac12911d1f51b33cd966f2d

Download Submit
C:\Windows\system\JRZUyRa.exe

Filesize
2.2MB

MD5
4426e29cb6e6966f476be54d1a138ce0

SHA1
70c46317672fd2455cc9c24a4973e846adb61576

SHA256
cbd4d2166b21385560e7cf80dc744a792b539333dc296c537f77b1832c8836cf

SHA512
1c90be1d51df33759fc39d6d33124b3606f35eb604fcdf0aa347b7d5a82e4944ac80f54fb67bfbac945879ec1d0d311238866cc17de7e3d3e683ad67fbac0a5c

Download Submit
C:\Windows\system\KzMspDL.exe

Filesize
2.2MB

MD5
ec444da512bd3cf081866c0ca9eb080c

SHA1
0dd1e2dd6e26f0b171084ba06fc3b64b9d5b3940

SHA256
8e990a8fc42c53de318fec7d758fd8680b7f4b461d3e637853b3e473aa2b95c0

SHA512
c1ee0406f3ef13eccd7186efbbe1a7cb70e2ef39c5afc413265de254a2d548adcc0d0a551cab614e955825d1643ea69bc03d9907bfd8640ea4f25d431361e969

Download Submit
C:\Windows\system\ODZkiyF.exe

Filesize
2.2MB

MD5
cb236d395402e1d784d15b57ba44f541

SHA1
4a56b710c6f0afe19893bc396c11ff4edd677adc

SHA256
7dfc70a88b38104554892ffa70001efc565d85514ca18d76d7ceea42666da926

SHA512
4187237e189785125f08a0f28c03954614c2835e8006cb3bbd8e9c648e6dd597d3bf562355775c39d7faabaef711eb42582d1e1ea5db931d28b79e183331d5c4

Download Submit
C:\Windows\system\RbteIoH.exe

Filesize
2.2MB

MD5
d7ab49e88313dc7d8648a9fb1b1a44c7

SHA1
186ffd75573ed2094c9dc163532dd77de70d15ce

SHA256
0a5463d5bac0c3507788e78b798c7b0830f3dfb00d761081ef17fda49eed8170

SHA512
8843e2e6764a4983ec61b34be2ab1fcfc2cec8302fb85e25b2a1db10c2796bf07fb5786db8c25c4f44c191b987532ded282b4a4cc4812c4adacf68ddd1ccc1ca

Download Submit
C:\Windows\system\RcFxgOr.exe

Filesize
2.2MB

MD5
527b4a6eac0f2c5c59a734d52bc011c6

SHA1
8a20f62bd9204c40b3c1f4fe8fb4f07021ec9df1

SHA256
1b1a29a76ee0445c2216664217581c3b31c71566057123125caa9e6fa03afe2c

SHA512
7faf806383a69e86f0c92f4778d2594ba4c0cf2b5b13766a985a5660c5d8b71e97f5673fdaea962bc30b45c8cb4f962b1dab3779472432560ff755e2b68fad4a

Download Submit
C:\Windows\system\RwdTmQr.exe

Filesize
2.2MB

MD5
6da1877ba1b937c9ccebfecbef7b0557

SHA1
391b9f69a462e41a3d1877231b47af9379734bee

SHA256
124923450391dee0158ccd7199f251ad2eccb5ff752b8ac2e8e237336fb3452d

SHA512
41650c21a8db589e7ba8d2c38c79cc726f8e595715b44b15cbe8b8fdb610a743122d7b8f5857ec3ef5dbde70d62a2d2062c58d187bf9ee4239fb810612a6eeb3

Download Submit
C:\Windows\system\SlfoXks.exe

Filesize
2.2MB

MD5
695ab80bc3b70851b774229e1d93aac6

SHA1
36573856c7effeaeef4b13aa5ac7ebddd7957438

SHA256
be53351fb0b5c7c2b47eeb3e0df941b0fdeb1f1148b886f791cc7421c61a7be5

SHA512
b14403e58b2d87f311a8389fe740f76001922286c6383c16a06e86a53215f980284e6a037bd794be8b11694802e5f7912eb7c6c93b6ccc71fd6a7d3f4672de3e

Download Submit
C:\Windows\system\VlYFJDW.exe

Filesize
2.2MB

MD5
263f18f45e1ccb330d4ef3db40064f7f

SHA1
ae9c81ab50b198a8d78e63f5c52d4675f0949ec6

SHA256
f99879a6e48380b142c3cb8ff0221b64882f81df2e41efb67ff86dff1bb29eb9

SHA512
c329e790eab169e3b2194ea5d3d25e4ecad589e18e34abc6355964fa60a3b856f0e0d7db7b3954ea31cf1e9a55efc7fd277c585b9a61e8788ef0022486d598fe

Download Submit
C:\Windows\system\VvvbNpY.exe

Filesize
2.2MB

MD5
c8b8c5eec7c389464e5e2fc872476587

SHA1
d8d010dfb50fe32989c1710ebf08a281abcc9a6e

SHA256
1bad7ffc4427d71bf067e43f2a19cd429329b414d2c8591814efab6786300189

SHA512
dfe5619823258f30ba71eaeb7b800cca94c1083bb6cc8b52b00526d5b92c5c09eec074189df826a05938784274d1d3139081dca6643aede79131d03dc0dcb465

Download Submit
C:\Windows\system\ZRgHVDm.exe

Filesize
2.2MB

MD5
8a248f6a677d4db0468fa94dcf6db49a

SHA1
62c407a3572be5caaf3b805c517de58ae3c93819

SHA256
5d0334188e986cee8667412d621a4ceae8e2021417f51b1fbd69548583c78e24

SHA512
03ab4453eaf2fc36d40375d249e8abe907b7bc912a9af88d5526ee19a887603bbafbbf1b2991ca190e45c3b407c2b26152fc0b07c649418ad34cc7ab2f6e2f11

Download Submit
C:\Windows\system\dqpwUlQ.exe

Filesize
2.2MB

MD5
74bed30565a3681e997fb729ad841d1f

SHA1
75280edc7b8c7f144dc298134bfa56630a591f8b

SHA256
4dbd4dd9d63008670842531e72115137373f3955331e95791e152ce4b3e22937

SHA512
673c3beae1aca17f6875d394dcf5a2c850baef7dfab919413201c70c813e0a12acf7a5cc36b2300949c462aeeaed0f0e06d62fe53f5869ce5ee1fccd09089c45

Download Submit
C:\Windows\system\nBHhOgO.exe

Filesize
2.2MB

MD5
bbd9e4f1439d7c05d6cd0775180b0d2c

SHA1
6c263185273a8f7e3d7664fe64a705041004e7af

SHA256
b44534a655b75c7f5d1a83c196365481b90595a2d3262c223321cb7c5f024c4c

SHA512
54e20d044bece886c9bb2a0ae5e6a37ac770151b60a518f90f02bf4b6c77009aac21bb354c531c267272ae7b8f2a63ef7a0662bb3af51a716e4d684ebb6abdc2

Download Submit
C:\Windows\system\qGwjgjP.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\system\sdtggqF.exe

Filesize
2.2MB

MD5
6729ecece55f91c653bf237ee01eb546

SHA1
45da433fee52762a2a1ca1128368e4fcdb1679cf

SHA256
cfa6664ea6370ec7d96f6cf5275382a6959c92ab7c6782c8a636a3a63b92c9db

SHA512
a577b0b486489c5716df8f4c8d2bb7088ff2cceb87508637197a6884e86d70fad8b100b51dff5114fd13f3817d81d2d3631788cc112cf38b12d5db4da981f35f

Download Submit
C:\Windows\system\tftdxuT.exe

Filesize
2.2MB

MD5
ffa6af42e93ba16076564feea61b4b72

SHA1
feed57f261ed61920940434b45481953bcd6888d

SHA256
e839bcb09f61100a804686f7c9ec4acc2d563d9aac8436a25e36471f2af49bd3

SHA512
aee47ce491abb24770def4903d68da39db002c12959e5732ef2fc930e103d1b0a0b4ca7d48e58fcb014367e9dc2aa30186b98a3a6bcea7ee985c61f70793161c

Download Submit
C:\Windows\system\wxvyjXz.exe

Filesize
2.2MB

MD5
842cb35098a741a627465be054c95fbf

SHA1
13c405a9485c48fda9938d1024dd28aa0505b70d

SHA256
1710d0cbc6fb3c9165a21ac0249fe455bd0322fe76ea410430f4bfdd010d5d5b

SHA512
efbb4fa893bcf46ab8d64692620114396b94af8cb146320160f2a47693694275a9aa9d0e19483c9bc05a0b9ef3dc6ff47d4c45e293f40e55bfbf343ada7ab979

Download Submit
C:\Windows\system\xXbbEBQ.exe

Filesize
2.2MB

MD5
8e5f5594616e250e3c50a18e966753e3

SHA1
bf8d9090a39c2f51a806c885a76e85e40d01db22

SHA256
e2557feace196d1d0f9ca49ca9c00b417397262394978aac42badd65f43087b2

SHA512
d600fd77ba7ca0145e6357ee96285077dc4c4f02288fdbee2332c7dffc099f97dd2d4e3016da6b972b87b68864edee1f9bdbd54b47f81366f113aa1b358652f3

Download Submit
C:\Windows\system\yZtXiKC.exe

Filesize
2.2MB

MD5
8a04457c877eb99bda5a61fc198cce8b

SHA1
6d48b6e846d97c3231b298b0ce2e56bf9d287d3a

SHA256
5a4841bdc70a9b45a8409a28746f444a7f1014e2c678cd1c2707e3cc470f9513

SHA512
fb4c47ca1807ad8d4900265e5a39b8add0bee5f6281bb7d7708180457bad3574e79e3e17bde1363cc733a6604f135b03cf70b17b0e4cbef9c19b43ef27d7d446

Download Submit
C:\Windows\system\yzFZyBu.exe

Filesize
2.2MB

MD5
d84b5a74348c40762d96a03cbfdc31b7

SHA1
df2b994de177da762dbed14092516ae90f63eebd

SHA256
e11ca0816c3cbbc371fc3eed567982f1b02daccfe9fc4826d6164ba2eeddc653

SHA512
7cd484758d34f07a3d2e46100dc5182b026c054c41cb8830a19d1d4b8ce65ca319b9127eca8500a03f855c2f5b776c01e8e421d91fbfd36fc49ab3fcb65aa651

Download Submit
\Windows\system\FSEMzVD.exe

Filesize
2.2MB

MD5
74f63f49a079b398ff89f8bc3ffa3894

SHA1
8eaa740accba0e46a70d7dd16563cb28482c87d1

SHA256
d12dfec6265ce0c19a1742abfa8b1f6874089459bd99a88de59a972516f52b42

SHA512
197010e31fae38bbc1c20d0ebfece781cae9cd24e56b6ff0ec182e22d947643c18f99042ba1dd39e76b35017d13a48ec7f661515e2b779670c51258644ecbbbb

Download Submit
\Windows\system\JTFttgw.exe

Filesize
2.2MB

MD5
6dd3a1777eab865101445ebf3b7a00c1

SHA1
d09fb0b7755c40fb50e2e8b132576fee5bb73b01

SHA256
c9cebfd24fc2ee53957a4960118fd1874ad51411728e961ec8f5dd271e650e1c

SHA512
cffddaaa242d6908bce546438ce7df2c8d37dbfa976f167ed1429dcffe4057475c75752f9cfe59f349c1dc7b62919c1207ec45c74b5db83d3a9cc33f3208b3c6

Download Submit
\Windows\system\WBNmviF.exe

Filesize
2.2MB

MD5
2bb06bcd0553f58eab9b69bc1e187aae

SHA1
71af2d5362d63d747ca700024a3135a37f4b2fd3

SHA256
9d989df459a358a24eabd8762cf8ae79bab5629dec959f479bbc1123c9d49e6e

SHA512
eaed013a50064f50b69cb5016d4e208564f5171ac26e20a60117783b2b58d75a14765590ddfaaa49e4eb8b1cf1885675a82a8676b48a3f913ed70bcd57277bf9

Download Submit
\Windows\system\hXQZKWc.exe

Filesize
2.2MB

MD5
536cd6ffa52f7f9dfbfff2d447607bf9

SHA1
a8841c83e6f999af2c89ccf814951eb53980f0e7

SHA256
4abf563f6eade0905d1a5eefb04a2b2f44cec830976c6fe049e048e5553c6526

SHA512
d5aa49c87246cd78280d44bd4fc18610e5c93d21ff8fdab1551ea80042aa5aa880f6eec3b67dbfcb958e194ef4eae3e08ab5bbcf6d2f60322e238128d066b0e6

Download Submit
\Windows\system\lnWqMiC.exe

Filesize
2.2MB

MD5
d561d82e50e5a84ea3fc07e0bc5a569c

SHA1
64d2c17cbd986f239aa78e1eb2307979a69a3483

SHA256
ebb504cec3089e799eded8669dfd33e306d8b8d67dc5ea172bc16fb50f227791

SHA512
c8138d22ba7114447e6706573575c4aa1e3b25cd8477085e36cc0cfb3ee6d7f89c5e5a3b735b8080ab8c50d2f7a60823c15a9948c002b4a16be1c008347e1a98

Download Submit
\Windows\system\tTzdwCC.exe

Filesize
2.2MB

MD5
c0085910fd48758b5c16e8095536ed1e

SHA1
cf062911b81db844a407182f2d8093228eb175ad

SHA256
4c5927096d2d95a9138f96d92657e80d20dfc8e25ab43081d33cb59e3f5a551c

SHA512
01a1d14173a69fda9b3bad68ee215ca5318b6aeb2658d65d75978c2430c758fbb5531af8d349d1c6bb45b66dc67d1bbdde73f155f3d6ddc5c758ff012363e5e1

Download Submit
\Windows\system\wSVYXEI.exe

Filesize
2.2MB

MD5
b6444a6b0d5b64fd6aba425745c48151

SHA1
ae3ee6cfd39b218083d8fbe7ec65fb4de7b022fe

SHA256
2a4a92271c127929d4675a72480761f57eda4d50365022af0499da9164c4bd81

SHA512
b04e776c27190cb3fb18befbc8ecdb4159ff4bdefdeaac0cfb5d402d048ec9bcb6bb9639adbc830f64b09a90503f9b770da403b7ff2ee10483d6ca87533dd2c5

Download Submit
\Windows\system\wbtquwe.exe

Filesize
2.2MB

MD5
5ad9bad5b9206e29493ed3085965573f

SHA1
998343864bf5fb2da7f4db89b5468d71ee6216f8

SHA256
73da9223e4c804bcae28a4192aa13fea465c3b21bc6df120c291fc2e8f0c7510

SHA512
fa56d6587c3b584b54f88feb750a1b40af69b63b5cac2d212acc95cbe0edba3e470bcf4a229bce0fd32738929656b38af068ab882c6800ee0ac2c4cb3fdf3733

Download Submit
\Windows\system\yZrzATB.exe

Filesize
2.2MB

MD5
13f6bceb70672d86a1570dc476bcfa49

SHA1
eb01179bcded19aeac1a0d41405faa790baf0475

SHA256
ad74c9a07e01c407c06e76fe3b7a9398f8aee58abe879e025b8836e5ddc8c915

SHA512
132fabd345fc4cdf36bd38761f06b5e1619562a4264db56d27adc953ef03f939b1676693c32ae76f5b2b14c226471cf9864c58256ef412c0c4497c9b01ead184

Download Submit
memory/1516-7-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1632-136-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/1632-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1632-8-0x000000013FE80000-0x0000000140272000-memory.dmp

Filesize
3.9MB

Download
memory/1632-15-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/1632-131-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/1632-6-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/1632-129-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/1632-146-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/1632-126-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/1632-133-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/1632-124-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-138-0x0000000002F80000-0x0000000003372000-memory.dmp

Filesize
3.9MB

Download
memory/2100-123-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2100-230-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2100-122-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/2100-228-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/2100-147-0x00000000027F0000-0x0000000002870000-memory.dmp

Filesize
512KB

Download
memory/2100-1549-0x000007FEF58C0000-0x000007FEF625D000-memory.dmp

Filesize
9.6MB

Download
memory/2424-142-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2516-19-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2536-137-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2548-128-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2652-125-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2656-132-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2740-135-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/3016-130-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download