xmrig | 7fd086b5c8d02fa2221730f5c5a88b452b7a6bc499d7cbe5a28f55c80f13e01c

Analysis

max time kernel
39s
max time network
36s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
Size

1.8MB
MD5

07d7ea1cdda277dedfc21ad5b8b80568
SHA1

5edf5f7f08e23d21fdd0d9087fbdd13691565cde
SHA256

7fd086b5c8d02fa2221730f5c5a88b452b7a6bc499d7cbe5a28f55c80f13e01c
SHA512

283cda7a695dcedd2d08ede9522c8be308c9b77b8ba62ff5e49d40a2dac52ca26031ac2f24678bb0562f1374c586734043a5233634d71b7d17e50c44395a7d85
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlE:NABR

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/1108-239-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2756-242-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2676-226-0x000000013F580000-0x000000013F972000-memory.dmp	xmrig
behavioral1/memory/2308-240-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2500-238-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2528-236-0x000000013F940000-0x000000013FD32000-memory.dmp	xmrig
behavioral1/memory/2600-233-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3060	GjKtyMz.exe
2676	MwFqqCs.exe
2756	nluHpaU.exe
2600	OaEcvvh.exe
2528	QAnGbMY.exe
2500	ZIyHmdE.exe
1108	mUQMlzP.exe
2308	eFvZdDf.exe
1804	hWszLFH.exe
1520	qmWDikb.exe
2724	ZSazSdX.exe
1584	DdesnKm.exe
236	NrDnWEY.exe
2712	TPvxPvV.exe
2604	gIzoQoS.exe
1088	bCFNrsd.exe
1636	LNSeriV.exe
276	uOWEIYj.exe
2808	yxfYMSA.exe
2728	klvWGHJ.exe
1364	KAqJjcC.exe
1772	NmDvoKg.exe
2784	BzggdJV.exe
1556	byhyDJP.exe
780	NkuZvgP.exe
2124	EhqSbCm.exe
1564	hhBkLRo.exe
1672	ALRHjCP.exe
1576	QeRjwFW.exe
1168	xnhKktl.exe
832	sOzUaRq.exe
1440	ZDkxHrM.exe
2104	BKDwGWT.exe
1468	mJvXCsf.exe
928	HeXoEwl.exe
1752	BhrQRiq.exe
1184	oiyCpeC.exe
2252	eqafeWa.exe
2060	WqXsqDS.exe
1796	xBuQhtr.exe
872	XqOGEJu.exe
640	YkBLhjk.exe
1112	dOrAUkG.exe
3052	vzAWqNg.exe
1760	CTIvkjG.exe
2276	sXqgzpz.exe
1432	kSAjmww.exe
952	zTMafvN.exe
340	IMqtPBs.exe
372	mMZCOnW.exe
1828	sVYmnfE.exe
1984	eThHfNr.exe
1164	fLAulzJ.exe
1916	CrKXdSg.exe
1720	dmaqDpa.exe
2700	xoPXDXx.exe
2516	KeIfqPz.exe
2944	pgWtmrG.exe
2376	mWTlsDK.exe
1816	ufRHNuy.exe
2468	DtcQkuG.exe
2212	sCfAOKb.exe
1208	yNctzjI.exe
2164	xznwemN.exe

Loads dropped DLL 64 IoCs

pid	Process
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1992-1-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x00090000000122ee-3.dat	upx
behavioral1/memory/3060-8-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/files/0x00090000000145d4-20.dat	upx
behavioral1/files/0x00080000000146a7-24.dat	upx
behavioral1/files/0x000700000001475f-34.dat	upx
behavioral1/files/0x0009000000014c0b-44.dat	upx
behavioral1/files/0x0006000000015d02-69.dat	upx
behavioral1/files/0x0006000000015d89-88.dat	upx
behavioral1/files/0x0006000000015f40-103.dat	upx
behavioral1/files/0x0006000000016020-112.dat	upx
behavioral1/files/0x0006000000016228-124.dat	upx
behavioral1/files/0x0006000000016c5b-160.dat	upx
behavioral1/files/0x0006000000015cca-98.dat	upx
behavioral1/files/0x0006000000015fbb-107.dat	upx
behavioral1/memory/1108-239-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2756-242-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0006000000016126-167.dat	upx
behavioral1/memory/2676-226-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/files/0x0006000000016ca1-163.dat	upx
behavioral1/files/0x0006000000016c57-155.dat	upx
behavioral1/files/0x0006000000016a3a-145.dat	upx
behavioral1/files/0x0006000000015d99-139.dat	upx
behavioral1/files/0x0006000000016591-135.dat	upx
behavioral1/files/0x0006000000015d28-130.dat	upx
behavioral1/files/0x000600000001640f-125.dat	upx
behavioral1/memory/2308-240-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x0006000000015d13-119.dat	upx
behavioral1/memory/2500-238-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2528-236-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2600-233-0x000000013F3E0000-0x000000013F7D2000-memory.dmp	upx
behavioral1/files/0x0006000000015cf5-102.dat	upx
behavioral1/files/0x0006000000015ce1-100.dat	upx
behavioral1/files/0x00070000000148af-96.dat	upx
behavioral1/files/0x0006000000015d1e-83.dat	upx
behavioral1/files/0x000700000001474b-78.dat	upx
behavioral1/files/0x0006000000016ccd-169.dat	upx
behavioral1/files/0x0006000000016c3a-154.dat	upx
behavioral1/files/0x00060000000167e8-144.dat	upx
behavioral1/files/0x00130000000054a8-31.dat	upx
behavioral1/files/0x000600000001650f-133.dat	upx
behavioral1/files/0x003700000001448b-17.dat	upx
behavioral1/files/0x0006000000015ced-62.dat	upx
behavioral1/files/0x0006000000015cd8-52.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\KeIfqPz.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\mWTlsDK.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\bwTkgSl.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\zEWKuuI.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ZqoMxee.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\gQuoiyM.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\cWanBxI.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\fzmslyX.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\CwCLHAZ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\Iodonlg.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\BZKmZAm.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\OpvZDES.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\jHjcUfu.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\glyXOrE.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ZCHqWFu.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\Cpeqqoe.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\qUKBwnP.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\EFyMXDl.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\oUuGwmK.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\KHNRiLk.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\lzOYXco.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\oCjGIOD.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xznwemN.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\VRULmIy.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\OaEcvvh.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\DDlsAPk.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\wJwJnnh.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\rqLhWhF.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\dEIjiuZ.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\zSZbxTT.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\siKrwjt.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\NFZufOR.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\HPvVFUx.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\uDKewFH.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\xbaEaWo.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\iOWmTQR.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\wwgBnbW.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\XwCGaZg.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\cgsArvs.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\aNBJpYU.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\sVROStC.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\nqnrlaa.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ABuKlSM.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\QHbKlQY.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\PPgNWHs.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\FXaPdfc.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\MIsBFMg.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\MYPEHWj.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\chKYrCr.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\MvhMYAV.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ZDkxHrM.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\ptQJJvr.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\kqYzWpY.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\HnolyRC.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\XdcNOdU.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\BiIqJUW.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\XahGmid.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\oMKEdrK.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\OcEjqTK.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\yvrpjhi.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\MsGhgQP.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\qDVvMTE.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\rUCCngn.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
File created	C:\Windows\System\NtUlOjq.exe	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1676	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
Token: SeDebugPrivilege	1676	powershell.exe
Token: SeLockMemoryPrivilege	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 1676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	29
PID 1992 wrote to memory of 1676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	29
PID 1992 wrote to memory of 1676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	29
PID 1992 wrote to memory of 3060	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3060	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3060	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	30
PID 1992 wrote to memory of 2676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2676	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	31
PID 1992 wrote to memory of 2756	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	32
PID 1992 wrote to memory of 2756	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	32
PID 1992 wrote to memory of 2756	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	32
PID 1992 wrote to memory of 1108	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	33
PID 1992 wrote to memory of 1108	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	33
PID 1992 wrote to memory of 1108	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	33
PID 1992 wrote to memory of 2600	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2600	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2600	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	34
PID 1992 wrote to memory of 2724	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2724	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2724	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	35
PID 1992 wrote to memory of 2528	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2528	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2528	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	36
PID 1992 wrote to memory of 2712	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2712	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2712	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	37
PID 1992 wrote to memory of 2500	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2500	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2500	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	38
PID 1992 wrote to memory of 2604	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2604	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2604	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	39
PID 1992 wrote to memory of 2308	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	40
PID 1992 wrote to memory of 2308	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	40
PID 1992 wrote to memory of 2308	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	40
PID 1992 wrote to memory of 1088	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	41
PID 1992 wrote to memory of 1088	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	41
PID 1992 wrote to memory of 1088	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	41
PID 1992 wrote to memory of 1804	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1804	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1804	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	42
PID 1992 wrote to memory of 1636	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1636	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1636	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	43
PID 1992 wrote to memory of 1520	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	44
PID 1992 wrote to memory of 1520	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	44
PID 1992 wrote to memory of 1520	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	44
PID 1992 wrote to memory of 2728	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	45
PID 1992 wrote to memory of 2728	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	45
PID 1992 wrote to memory of 2728	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	45
PID 1992 wrote to memory of 1584	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	46
PID 1992 wrote to memory of 1584	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	46
PID 1992 wrote to memory of 1584	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	46
PID 1992 wrote to memory of 1772	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	47
PID 1992 wrote to memory of 1772	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	47
PID 1992 wrote to memory of 1772	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	47
PID 1992 wrote to memory of 236	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	48
PID 1992 wrote to memory of 236	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	48
PID 1992 wrote to memory of 236	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	48
PID 1992 wrote to memory of 1556	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	49
PID 1992 wrote to memory of 1556	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	49
PID 1992 wrote to memory of 1556	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	49
PID 1992 wrote to memory of 276	1992	07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\07d7ea1cdda277dedfc21ad5b8b80568_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Windows\System\GjKtyMz.exe
  C:\Windows\System\GjKtyMz.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\MwFqqCs.exe
  C:\Windows\System\MwFqqCs.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\nluHpaU.exe
  C:\Windows\System\nluHpaU.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\mUQMlzP.exe
  C:\Windows\System\mUQMlzP.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\OaEcvvh.exe
  C:\Windows\System\OaEcvvh.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\ZSazSdX.exe
  C:\Windows\System\ZSazSdX.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\QAnGbMY.exe
  C:\Windows\System\QAnGbMY.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\TPvxPvV.exe
  C:\Windows\System\TPvxPvV.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\ZIyHmdE.exe
  C:\Windows\System\ZIyHmdE.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\gIzoQoS.exe
  C:\Windows\System\gIzoQoS.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\eFvZdDf.exe
  C:\Windows\System\eFvZdDf.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\bCFNrsd.exe
  C:\Windows\System\bCFNrsd.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\hWszLFH.exe
  C:\Windows\System\hWszLFH.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\LNSeriV.exe
  C:\Windows\System\LNSeriV.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\qmWDikb.exe
  C:\Windows\System\qmWDikb.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\klvWGHJ.exe
  C:\Windows\System\klvWGHJ.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\DdesnKm.exe
  C:\Windows\System\DdesnKm.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\NmDvoKg.exe
  C:\Windows\System\NmDvoKg.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\NrDnWEY.exe
  C:\Windows\System\NrDnWEY.exe
  2⤵
  - Executes dropped EXE
  PID:236
- C:\Windows\System\byhyDJP.exe
  C:\Windows\System\byhyDJP.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\uOWEIYj.exe
  C:\Windows\System\uOWEIYj.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\EhqSbCm.exe
  C:\Windows\System\EhqSbCm.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\yxfYMSA.exe
  C:\Windows\System\yxfYMSA.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\QeRjwFW.exe
  C:\Windows\System\QeRjwFW.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\KAqJjcC.exe
  C:\Windows\System\KAqJjcC.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\ZDkxHrM.exe
  C:\Windows\System\ZDkxHrM.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\BzggdJV.exe
  C:\Windows\System\BzggdJV.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\eqafeWa.exe
  C:\Windows\System\eqafeWa.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\NkuZvgP.exe
  C:\Windows\System\NkuZvgP.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\XqOGEJu.exe
  C:\Windows\System\XqOGEJu.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\hhBkLRo.exe
  C:\Windows\System\hhBkLRo.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\YkBLhjk.exe
  C:\Windows\System\YkBLhjk.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\ALRHjCP.exe
  C:\Windows\System\ALRHjCP.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\dOrAUkG.exe
  C:\Windows\System\dOrAUkG.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\xnhKktl.exe
  C:\Windows\System\xnhKktl.exe
  2⤵
  - Executes dropped EXE
  PID:1168
- C:\Windows\System\vzAWqNg.exe
  C:\Windows\System\vzAWqNg.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\sOzUaRq.exe
  C:\Windows\System\sOzUaRq.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\CTIvkjG.exe
  C:\Windows\System\CTIvkjG.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\BKDwGWT.exe
  C:\Windows\System\BKDwGWT.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\sXqgzpz.exe
  C:\Windows\System\sXqgzpz.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\mJvXCsf.exe
  C:\Windows\System\mJvXCsf.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\zTMafvN.exe
  C:\Windows\System\zTMafvN.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\HeXoEwl.exe
  C:\Windows\System\HeXoEwl.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\IMqtPBs.exe
  C:\Windows\System\IMqtPBs.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\BhrQRiq.exe
  C:\Windows\System\BhrQRiq.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\mMZCOnW.exe
  C:\Windows\System\mMZCOnW.exe
  2⤵
  - Executes dropped EXE
  PID:372
- C:\Windows\System\oiyCpeC.exe
  C:\Windows\System\oiyCpeC.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\sVYmnfE.exe
  C:\Windows\System\sVYmnfE.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\WqXsqDS.exe
  C:\Windows\System\WqXsqDS.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\eThHfNr.exe
  C:\Windows\System\eThHfNr.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\xBuQhtr.exe
  C:\Windows\System\xBuQhtr.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\fLAulzJ.exe
  C:\Windows\System\fLAulzJ.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\kSAjmww.exe
  C:\Windows\System\kSAjmww.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\CrKXdSg.exe
  C:\Windows\System\CrKXdSg.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\dmaqDpa.exe
  C:\Windows\System\dmaqDpa.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\xoPXDXx.exe
  C:\Windows\System\xoPXDXx.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\KeIfqPz.exe
  C:\Windows\System\KeIfqPz.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\mWTlsDK.exe
  C:\Windows\System\mWTlsDK.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\pgWtmrG.exe
  C:\Windows\System\pgWtmrG.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\DtcQkuG.exe
  C:\Windows\System\DtcQkuG.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ufRHNuy.exe
  C:\Windows\System\ufRHNuy.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\PUgxsrb.exe
  C:\Windows\System\PUgxsrb.exe
  2⤵
  PID:1944
- C:\Windows\System\sCfAOKb.exe
  C:\Windows\System\sCfAOKb.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\QtSZVXL.exe
  C:\Windows\System\QtSZVXL.exe
  2⤵
  PID:1116
- C:\Windows\System\yNctzjI.exe
  C:\Windows\System\yNctzjI.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\XedysJD.exe
  C:\Windows\System\XedysJD.exe
  2⤵
  PID:2100
- C:\Windows\System\xznwemN.exe
  C:\Windows\System\xznwemN.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\xEyoVlx.exe
  C:\Windows\System\xEyoVlx.exe
  2⤵
  PID:2132
- C:\Windows\System\QAVPNxE.exe
  C:\Windows\System\QAVPNxE.exe
  2⤵
  PID:2760
- C:\Windows\System\yunfLoQ.exe
  C:\Windows\System\yunfLoQ.exe
  2⤵
  PID:2492
- C:\Windows\System\BcQtBGk.exe
  C:\Windows\System\BcQtBGk.exe
  2⤵
  PID:668
- C:\Windows\System\QbLUNbC.exe
  C:\Windows\System\QbLUNbC.exe
  2⤵
  PID:2192
- C:\Windows\System\XFivoUD.exe
  C:\Windows\System\XFivoUD.exe
  2⤵
  PID:568
- C:\Windows\System\QvmtjSk.exe
  C:\Windows\System\QvmtjSk.exe
  2⤵
  PID:1592
- C:\Windows\System\xVGJWbU.exe
  C:\Windows\System\xVGJWbU.exe
  2⤵
  PID:1372
- C:\Windows\System\DrjTUIl.exe
  C:\Windows\System\DrjTUIl.exe
  2⤵
  PID:2156
- C:\Windows\System\ikOIcCT.exe
  C:\Windows\System\ikOIcCT.exe
  2⤵
  PID:1800
- C:\Windows\System\pyjxskP.exe
  C:\Windows\System\pyjxskP.exe
  2⤵
  PID:2136
- C:\Windows\System\PKSJPAU.exe
  C:\Windows\System\PKSJPAU.exe
  2⤵
  PID:2384
- C:\Windows\System\HdOCCsX.exe
  C:\Windows\System\HdOCCsX.exe
  2⤵
  PID:1428
- C:\Windows\System\zLnlwJE.exe
  C:\Windows\System\zLnlwJE.exe
  2⤵
  PID:2916
- C:\Windows\System\LMdVIBC.exe
  C:\Windows\System\LMdVIBC.exe
  2⤵
  PID:380
- C:\Windows\System\hnEfjaj.exe
  C:\Windows\System\hnEfjaj.exe
  2⤵
  PID:944
- C:\Windows\System\MAjMrVg.exe
  C:\Windows\System\MAjMrVg.exe
  2⤵
  PID:1464
- C:\Windows\System\laXwFdZ.exe
  C:\Windows\System\laXwFdZ.exe
  2⤵
  PID:444
- C:\Windows\System\BYdiasg.exe
  C:\Windows\System\BYdiasg.exe
  2⤵
  PID:2116
- C:\Windows\System\hFndlMi.exe
  C:\Windows\System\hFndlMi.exe
  2⤵
  PID:2836
- C:\Windows\System\fOKXngb.exe
  C:\Windows\System\fOKXngb.exe
  2⤵
  PID:2708
- C:\Windows\System\xARXlUP.exe
  C:\Windows\System\xARXlUP.exe
  2⤵
  PID:2536
- C:\Windows\System\cjtAoaa.exe
  C:\Windows\System\cjtAoaa.exe
  2⤵
  PID:756
- C:\Windows\System\oUuGwmK.exe
  C:\Windows\System\oUuGwmK.exe
  2⤵
  PID:1764
- C:\Windows\System\kDouKTj.exe
  C:\Windows\System\kDouKTj.exe
  2⤵
  PID:1632
- C:\Windows\System\iGpjtlz.exe
  C:\Windows\System\iGpjtlz.exe
  2⤵
  PID:2652
- C:\Windows\System\OPuHpTK.exe
  C:\Windows\System\OPuHpTK.exe
  2⤵
  PID:1856
- C:\Windows\System\qlbjipC.exe
  C:\Windows\System\qlbjipC.exe
  2⤵
  PID:2476
- C:\Windows\System\tzVHJwo.exe
  C:\Windows\System\tzVHJwo.exe
  2⤵
  PID:1836
- C:\Windows\System\HVuuAyk.exe
  C:\Windows\System\HVuuAyk.exe
  2⤵
  PID:1268
- C:\Windows\System\iizUnFq.exe
  C:\Windows\System\iizUnFq.exe
  2⤵
  PID:348
- C:\Windows\System\LuGbVDM.exe
  C:\Windows\System\LuGbVDM.exe
  2⤵
  PID:2820
- C:\Windows\System\xgldZgm.exe
  C:\Windows\System\xgldZgm.exe
  2⤵
  PID:1448
- C:\Windows\System\cbKNOgw.exe
  C:\Windows\System\cbKNOgw.exe
  2⤵
  PID:648
- C:\Windows\System\tPYKMbi.exe
  C:\Windows\System\tPYKMbi.exe
  2⤵
  PID:1808
- C:\Windows\System\KQBxtnZ.exe
  C:\Windows\System\KQBxtnZ.exe
  2⤵
  PID:808
- C:\Windows\System\QkKKeWF.exe
  C:\Windows\System\QkKKeWF.exe
  2⤵
  PID:3028
- C:\Windows\System\VIroSXD.exe
  C:\Windows\System\VIroSXD.exe
  2⤵
  PID:2744
- C:\Windows\System\EidhUNW.exe
  C:\Windows\System\EidhUNW.exe
  2⤵
  PID:2344
- C:\Windows\System\MOkdbox.exe
  C:\Windows\System\MOkdbox.exe
  2⤵
  PID:1924
- C:\Windows\System\FTdMlkZ.exe
  C:\Windows\System\FTdMlkZ.exe
  2⤵
  PID:3080
- C:\Windows\System\mFVNCKs.exe
  C:\Windows\System\mFVNCKs.exe
  2⤵
  PID:3096
- C:\Windows\System\IHHmdNe.exe
  C:\Windows\System\IHHmdNe.exe
  2⤵
  PID:3112
- C:\Windows\System\zSZbxTT.exe
  C:\Windows\System\zSZbxTT.exe
  2⤵
  PID:3128
- C:\Windows\System\dNSftil.exe
  C:\Windows\System\dNSftil.exe
  2⤵
  PID:3144
- C:\Windows\System\FXaPdfc.exe
  C:\Windows\System\FXaPdfc.exe
  2⤵
  PID:3160
- C:\Windows\System\fqysXai.exe
  C:\Windows\System\fqysXai.exe
  2⤵
  PID:3176
- C:\Windows\System\AmrASlD.exe
  C:\Windows\System\AmrASlD.exe
  2⤵
  PID:3192
- C:\Windows\System\TZiUFoJ.exe
  C:\Windows\System\TZiUFoJ.exe
  2⤵
  PID:3208
- C:\Windows\System\hCzVmiQ.exe
  C:\Windows\System\hCzVmiQ.exe
  2⤵
  PID:3224
- C:\Windows\System\xCwGkeK.exe
  C:\Windows\System\xCwGkeK.exe
  2⤵
  PID:3240
- C:\Windows\System\oEPQWGX.exe
  C:\Windows\System\oEPQWGX.exe
  2⤵
  PID:3256
- C:\Windows\System\XBIXfFb.exe
  C:\Windows\System\XBIXfFb.exe
  2⤵
  PID:3272
- C:\Windows\System\mJjeKrC.exe
  C:\Windows\System\mJjeKrC.exe
  2⤵
  PID:3288
- C:\Windows\System\nBmffLU.exe
  C:\Windows\System\nBmffLU.exe
  2⤵
  PID:3304
- C:\Windows\System\aUaszpK.exe
  C:\Windows\System\aUaszpK.exe
  2⤵
  PID:3320
- C:\Windows\System\FojZOSK.exe
  C:\Windows\System\FojZOSK.exe
  2⤵
  PID:3336
- C:\Windows\System\pKkBXlE.exe
  C:\Windows\System\pKkBXlE.exe
  2⤵
  PID:3352
- C:\Windows\System\eEpHPZd.exe
  C:\Windows\System\eEpHPZd.exe
  2⤵
  PID:3368
- C:\Windows\System\jKxZtnp.exe
  C:\Windows\System\jKxZtnp.exe
  2⤵
  PID:3384
- C:\Windows\System\bHzrwQH.exe
  C:\Windows\System\bHzrwQH.exe
  2⤵
  PID:3400
- C:\Windows\System\DUZmzIc.exe
  C:\Windows\System\DUZmzIc.exe
  2⤵
  PID:3416
- C:\Windows\System\wDGmfJz.exe
  C:\Windows\System\wDGmfJz.exe
  2⤵
  PID:3432
- C:\Windows\System\TUhhQGJ.exe
  C:\Windows\System\TUhhQGJ.exe
  2⤵
  PID:3448
- C:\Windows\System\hBiZAef.exe
  C:\Windows\System\hBiZAef.exe
  2⤵
  PID:3464
- C:\Windows\System\QrCrjsd.exe
  C:\Windows\System\QrCrjsd.exe
  2⤵
  PID:3480
- C:\Windows\System\MyaErpB.exe
  C:\Windows\System\MyaErpB.exe
  2⤵
  PID:3496
- C:\Windows\System\XFPGuaR.exe
  C:\Windows\System\XFPGuaR.exe
  2⤵
  PID:3512
- C:\Windows\System\siKrwjt.exe
  C:\Windows\System\siKrwjt.exe
  2⤵
  PID:3528
- C:\Windows\System\CerKKqd.exe
  C:\Windows\System\CerKKqd.exe
  2⤵
  PID:3544
- C:\Windows\System\ecxTTZc.exe
  C:\Windows\System\ecxTTZc.exe
  2⤵
  PID:3560
- C:\Windows\System\MsGhgQP.exe
  C:\Windows\System\MsGhgQP.exe
  2⤵
  PID:3576
- C:\Windows\System\JsAnAmo.exe
  C:\Windows\System\JsAnAmo.exe
  2⤵
  PID:3592
- C:\Windows\System\XFYlZQO.exe
  C:\Windows\System\XFYlZQO.exe
  2⤵
  PID:3608
- C:\Windows\System\Hguzhhp.exe
  C:\Windows\System\Hguzhhp.exe
  2⤵
  PID:3624
- C:\Windows\System\wbQqPXE.exe
  C:\Windows\System\wbQqPXE.exe
  2⤵
  PID:3640
- C:\Windows\System\NAydLfv.exe
  C:\Windows\System\NAydLfv.exe
  2⤵
  PID:3656
- C:\Windows\System\pgaaLaG.exe
  C:\Windows\System\pgaaLaG.exe
  2⤵
  PID:3672
- C:\Windows\System\jteJsUm.exe
  C:\Windows\System\jteJsUm.exe
  2⤵
  PID:3688
- C:\Windows\System\guhbAxY.exe
  C:\Windows\System\guhbAxY.exe
  2⤵
  PID:3704
- C:\Windows\System\iSAgTLl.exe
  C:\Windows\System\iSAgTLl.exe
  2⤵
  PID:3720
- C:\Windows\System\QBoncXU.exe
  C:\Windows\System\QBoncXU.exe
  2⤵
  PID:3736
- C:\Windows\System\zTvvtQi.exe
  C:\Windows\System\zTvvtQi.exe
  2⤵
  PID:3752
- C:\Windows\System\gmWMGAJ.exe
  C:\Windows\System\gmWMGAJ.exe
  2⤵
  PID:3768
- C:\Windows\System\KMOGTNJ.exe
  C:\Windows\System\KMOGTNJ.exe
  2⤵
  PID:3784
- C:\Windows\System\iuKnHDX.exe
  C:\Windows\System\iuKnHDX.exe
  2⤵
  PID:3800
- C:\Windows\System\zFeEuar.exe
  C:\Windows\System\zFeEuar.exe
  2⤵
  PID:3816
- C:\Windows\System\OgTfssu.exe
  C:\Windows\System\OgTfssu.exe
  2⤵
  PID:3832
- C:\Windows\System\TsoUtup.exe
  C:\Windows\System\TsoUtup.exe
  2⤵
  PID:3848
- C:\Windows\System\RGYFQbJ.exe
  C:\Windows\System\RGYFQbJ.exe
  2⤵
  PID:3864
- C:\Windows\System\BNgtxgC.exe
  C:\Windows\System\BNgtxgC.exe
  2⤵
  PID:3880
- C:\Windows\System\cdYzNrE.exe
  C:\Windows\System\cdYzNrE.exe
  2⤵
  PID:3896
- C:\Windows\System\tIMuiej.exe
  C:\Windows\System\tIMuiej.exe
  2⤵
  PID:3912
- C:\Windows\System\LcZCgFU.exe
  C:\Windows\System\LcZCgFU.exe
  2⤵
  PID:3928
- C:\Windows\System\cgsArvs.exe
  C:\Windows\System\cgsArvs.exe
  2⤵
  PID:3944
- C:\Windows\System\ZBwjstg.exe
  C:\Windows\System\ZBwjstg.exe
  2⤵
  PID:3960
- C:\Windows\System\khkdMCI.exe
  C:\Windows\System\khkdMCI.exe
  2⤵
  PID:3976
- C:\Windows\System\mONTUiI.exe
  C:\Windows\System\mONTUiI.exe
  2⤵
  PID:3992
- C:\Windows\System\CjudUlb.exe
  C:\Windows\System\CjudUlb.exe
  2⤵
  PID:4008
- C:\Windows\System\JPZjnmo.exe
  C:\Windows\System\JPZjnmo.exe
  2⤵
  PID:4024
- C:\Windows\System\fwVdBht.exe
  C:\Windows\System\fwVdBht.exe
  2⤵
  PID:4040
- C:\Windows\System\wvibBEA.exe
  C:\Windows\System\wvibBEA.exe
  2⤵
  PID:4056
- C:\Windows\System\UqmNaUG.exe
  C:\Windows\System\UqmNaUG.exe
  2⤵
  PID:4072
- C:\Windows\System\kMKHIJa.exe
  C:\Windows\System\kMKHIJa.exe
  2⤵
  PID:4088
- C:\Windows\System\vqPdLef.exe
  C:\Windows\System\vqPdLef.exe
  2⤵
  PID:2696
- C:\Windows\System\mjTyISj.exe
  C:\Windows\System\mjTyISj.exe
  2⤵
  PID:536
- C:\Windows\System\ffDkLNW.exe
  C:\Windows\System\ffDkLNW.exe
  2⤵
  PID:2692
- C:\Windows\System\nruyxnU.exe
  C:\Windows\System\nruyxnU.exe
  2⤵
  PID:3172
- C:\Windows\System\QDXlpQM.exe
  C:\Windows\System\QDXlpQM.exe
  2⤵
  PID:3236
- C:\Windows\System\mWkrEhB.exe
  C:\Windows\System\mWkrEhB.exe
  2⤵
  PID:3300
- C:\Windows\System\TgMZUMT.exe
  C:\Windows\System\TgMZUMT.exe
  2⤵
  PID:3364
- C:\Windows\System\nycQgeh.exe
  C:\Windows\System\nycQgeh.exe
  2⤵
  PID:3492
- C:\Windows\System\cwViFvS.exe
  C:\Windows\System\cwViFvS.exe
  2⤵
  PID:3556
- C:\Windows\System\ZnSGQwv.exe
  C:\Windows\System\ZnSGQwv.exe
  2⤵
  PID:3620
- C:\Windows\System\KppGSYX.exe
  C:\Windows\System\KppGSYX.exe
  2⤵
  PID:3684
- C:\Windows\System\knXLgqX.exe
  C:\Windows\System\knXLgqX.exe
  2⤵
  PID:2548
- C:\Windows\System\tZlqEcK.exe
  C:\Windows\System\tZlqEcK.exe
  2⤵
  PID:2444
- C:\Windows\System\XAxyspA.exe
  C:\Windows\System\XAxyspA.exe
  2⤵
  PID:2568
- C:\Windows\System\DDlsAPk.exe
  C:\Windows\System\DDlsAPk.exe
  2⤵
  PID:2940
- C:\Windows\System\mfyQqDE.exe
  C:\Windows\System\mfyQqDE.exe
  2⤵
  PID:1292
- C:\Windows\System\QPgjbJZ.exe
  C:\Windows\System\QPgjbJZ.exe
  2⤵
  PID:560
- C:\Windows\System\wkfvKGv.exe
  C:\Windows\System\wkfvKGv.exe
  2⤵
  PID:4116
- C:\Windows\System\DcEmwWT.exe
  C:\Windows\System\DcEmwWT.exe
  2⤵
  PID:4132
- C:\Windows\System\EuwNTqe.exe
  C:\Windows\System\EuwNTqe.exe
  2⤵
  PID:4148
- C:\Windows\System\AzUsIus.exe
  C:\Windows\System\AzUsIus.exe
  2⤵
  PID:4168
- C:\Windows\System\yPXRPUd.exe
  C:\Windows\System\yPXRPUd.exe
  2⤵
  PID:4184
- C:\Windows\System\pPiWLtq.exe
  C:\Windows\System\pPiWLtq.exe
  2⤵
  PID:4204
- C:\Windows\System\gkbCAbL.exe
  C:\Windows\System\gkbCAbL.exe
  2⤵
  PID:4220
- C:\Windows\System\GTUdKxF.exe
  C:\Windows\System\GTUdKxF.exe
  2⤵
  PID:4404
- C:\Windows\System\JibhXbw.exe
  C:\Windows\System\JibhXbw.exe
  2⤵
  PID:4600
- C:\Windows\System\TzvHXEp.exe
  C:\Windows\System\TzvHXEp.exe
  2⤵
  PID:4616
- C:\Windows\System\eeYduQt.exe
  C:\Windows\System\eeYduQt.exe
  2⤵
  PID:4640
- C:\Windows\System\qryJdMm.exe
  C:\Windows\System\qryJdMm.exe
  2⤵
  PID:4656
- C:\Windows\System\zfbqSGc.exe
  C:\Windows\System\zfbqSGc.exe
  2⤵
  PID:4676
- C:\Windows\System\gobDHAO.exe
  C:\Windows\System\gobDHAO.exe
  2⤵
  PID:4692
- C:\Windows\System\ayCQrZT.exe
  C:\Windows\System\ayCQrZT.exe
  2⤵
  PID:4716
- C:\Windows\System\LJaBSEs.exe
  C:\Windows\System\LJaBSEs.exe
  2⤵
  PID:4732
- C:\Windows\System\TQqmQXb.exe
  C:\Windows\System\TQqmQXb.exe
  2⤵
  PID:4756
- C:\Windows\System\reHBkcz.exe
  C:\Windows\System\reHBkcz.exe
  2⤵
  PID:4772
- C:\Windows\System\gQIHmwV.exe
  C:\Windows\System\gQIHmwV.exe
  2⤵
  PID:4792
- C:\Windows\System\TlJZpmt.exe
  C:\Windows\System\TlJZpmt.exe
  2⤵
  PID:4808
- C:\Windows\System\jPreJFL.exe
  C:\Windows\System\jPreJFL.exe
  2⤵
  PID:4828
- C:\Windows\System\yccGaBN.exe
  C:\Windows\System\yccGaBN.exe
  2⤵
  PID:4848
- C:\Windows\System\Bviuecb.exe
  C:\Windows\System\Bviuecb.exe
  2⤵
  PID:4864
- C:\Windows\System\WxnaaYy.exe
  C:\Windows\System\WxnaaYy.exe
  2⤵
  PID:4896
- C:\Windows\System\iGxWkpi.exe
  C:\Windows\System\iGxWkpi.exe
  2⤵
  PID:4912
- C:\Windows\System\iDujrYz.exe
  C:\Windows\System\iDujrYz.exe
  2⤵
  PID:4928
- C:\Windows\System\AjTQOgP.exe
  C:\Windows\System\AjTQOgP.exe
  2⤵
  PID:4952
- C:\Windows\System\nBbiFWC.exe
  C:\Windows\System\nBbiFWC.exe
  2⤵
  PID:4972
- C:\Windows\System\DARMnow.exe
  C:\Windows\System\DARMnow.exe
  2⤵
  PID:4988
- C:\Windows\System\EaDqxaO.exe
  C:\Windows\System\EaDqxaO.exe
  2⤵
  PID:5004
- C:\Windows\System\QStlFWj.exe
  C:\Windows\System\QStlFWj.exe
  2⤵
  PID:5024
- C:\Windows\System\LSmTEgD.exe
  C:\Windows\System\LSmTEgD.exe
  2⤵
  PID:5040
- C:\Windows\System\babLPeq.exe
  C:\Windows\System\babLPeq.exe
  2⤵
  PID:5056
- C:\Windows\System\DbpZsIe.exe
  C:\Windows\System\DbpZsIe.exe
  2⤵
  PID:5072
- C:\Windows\System\HNTuvMN.exe
  C:\Windows\System\HNTuvMN.exe
  2⤵
  PID:5088
- C:\Windows\System\gAPxFgT.exe
  C:\Windows\System\gAPxFgT.exe
  2⤵
  PID:5108
- C:\Windows\System\EIPQfKh.exe
  C:\Windows\System\EIPQfKh.exe
  2⤵
  PID:3552
- C:\Windows\System\YBtIEiT.exe
  C:\Windows\System\YBtIEiT.exe
  2⤵
  PID:2560
- C:\Windows\System\pZqYwAX.exe
  C:\Windows\System\pZqYwAX.exe
  2⤵
  PID:2584
- C:\Windows\System\zDJPRyC.exe
  C:\Windows\System\zDJPRyC.exe
  2⤵
  PID:4160
- C:\Windows\System\kQZfiuu.exe
  C:\Windows\System\kQZfiuu.exe
  2⤵
  PID:4196
- C:\Windows\System\nAWTfCk.exe
  C:\Windows\System\nAWTfCk.exe
  2⤵
  PID:4240
- C:\Windows\System\BiIqJUW.exe
  C:\Windows\System\BiIqJUW.exe
  2⤵
  PID:4256
- C:\Windows\System\JmFnGML.exe
  C:\Windows\System\JmFnGML.exe
  2⤵
  PID:2044
- C:\Windows\System\NTiQXkB.exe
  C:\Windows\System\NTiQXkB.exe
  2⤵
  PID:2608
- C:\Windows\System\TWibWvf.exe
  C:\Windows\System\TWibWvf.exe
  2⤵
  PID:4276
- C:\Windows\System\EBMsRHe.exe
  C:\Windows\System\EBMsRHe.exe
  2⤵
  PID:4288
- C:\Windows\System\SKmLXfg.exe
  C:\Windows\System\SKmLXfg.exe
  2⤵
  PID:4304
- C:\Windows\System\lIpiobG.exe
  C:\Windows\System\lIpiobG.exe
  2⤵
  PID:4320
- C:\Windows\System\zQRPULm.exe
  C:\Windows\System\zQRPULm.exe
  2⤵
  PID:4336
- C:\Windows\System\NFZufOR.exe
  C:\Windows\System\NFZufOR.exe
  2⤵
  PID:4352
- C:\Windows\System\jDptGQN.exe
  C:\Windows\System\jDptGQN.exe
  2⤵
  PID:4372
- C:\Windows\System\bwcaSSr.exe
  C:\Windows\System\bwcaSSr.exe
  2⤵
  PID:3632
- C:\Windows\System\uZChqrH.exe
  C:\Windows\System\uZChqrH.exe
  2⤵
  PID:3696
- C:\Windows\System\MptDDXW.exe
  C:\Windows\System\MptDDXW.exe
  2⤵
  PID:3760
- C:\Windows\System\eXrHrtr.exe
  C:\Windows\System\eXrHrtr.exe
  2⤵
  PID:1624
- C:\Windows\System\pUNuauo.exe
  C:\Windows\System\pUNuauo.exe
  2⤵
  PID:2572
- C:\Windows\System\gCzEQQt.exe
  C:\Windows\System\gCzEQQt.exe
  2⤵
  PID:4392
- C:\Windows\System\JmBtaZs.exe
  C:\Windows\System\JmBtaZs.exe
  2⤵
  PID:3856
- C:\Windows\System\KHNRiLk.exe
  C:\Windows\System\KHNRiLk.exe
  2⤵
  PID:1708
- C:\Windows\System\JUCkiNL.exe
  C:\Windows\System\JUCkiNL.exe
  2⤵
  PID:596
- C:\Windows\System\ObAAKnC.exe
  C:\Windows\System\ObAAKnC.exe
  2⤵
  PID:840
- C:\Windows\System\tNmuqZx.exe
  C:\Windows\System\tNmuqZx.exe
  2⤵
  PID:2540
- C:\Windows\System\FznPveZ.exe
  C:\Windows\System\FznPveZ.exe
  2⤵
  PID:316
- C:\Windows\System\yIqMzXR.exe
  C:\Windows\System\yIqMzXR.exe
  2⤵
  PID:2348
- C:\Windows\System\kEGXxVx.exe
  C:\Windows\System\kEGXxVx.exe
  2⤵
  PID:2036
- C:\Windows\System\qPGGFYo.exe
  C:\Windows\System\qPGGFYo.exe
  2⤵
  PID:3120
- C:\Windows\System\hvOdlFU.exe
  C:\Windows\System\hvOdlFU.exe
  2⤵
  PID:3184
- C:\Windows\System\RLYKdTW.exe
  C:\Windows\System\RLYKdTW.exe
  2⤵
  PID:3248
- C:\Windows\System\gBLhFGz.exe
  C:\Windows\System\gBLhFGz.exe
  2⤵
  PID:3312
- C:\Windows\System\gaeaIRu.exe
  C:\Windows\System\gaeaIRu.exe
  2⤵
  PID:3376
- C:\Windows\System\wWwZLjv.exe
  C:\Windows\System\wWwZLjv.exe
  2⤵
  PID:3440
- C:\Windows\System\YfxoEPd.exe
  C:\Windows\System\YfxoEPd.exe
  2⤵
  PID:3504
- C:\Windows\System\fwaHleG.exe
  C:\Windows\System\fwaHleG.exe
  2⤵
  PID:3568
- C:\Windows\System\yQzmtGy.exe
  C:\Windows\System\yQzmtGy.exe
  2⤵
  PID:3892
- C:\Windows\System\IvGbWtt.exe
  C:\Windows\System\IvGbWtt.exe
  2⤵
  PID:3956
- C:\Windows\System\USgnCNb.exe
  C:\Windows\System\USgnCNb.exe
  2⤵
  PID:4020
- C:\Windows\System\xXWYRHX.exe
  C:\Windows\System\xXWYRHX.exe
  2⤵
  PID:4052
- C:\Windows\System\CGCGzru.exe
  C:\Windows\System\CGCGzru.exe
  2⤵
  PID:3168
- C:\Windows\System\nkfYggY.exe
  C:\Windows\System\nkfYggY.exe
  2⤵
  PID:3716
- C:\Windows\System\lewGoKy.exe
  C:\Windows\System\lewGoKy.exe
  2⤵
  PID:3840
- C:\Windows\System\ctGaDOJ.exe
  C:\Windows\System\ctGaDOJ.exe
  2⤵
  PID:3904
- C:\Windows\System\gGCjIga.exe
  C:\Windows\System\gGCjIga.exe
  2⤵
  PID:3968
- C:\Windows\System\LptjAuF.exe
  C:\Windows\System\LptjAuF.exe
  2⤵
  PID:4036
- C:\Windows\System\nWafWLJ.exe
  C:\Windows\System\nWafWLJ.exe
  2⤵
  PID:876
- C:\Windows\System\puNqlOt.exe
  C:\Windows\System\puNqlOt.exe
  2⤵
  PID:3204
- C:\Windows\System\aTTtazt.exe
  C:\Windows\System\aTTtazt.exe
  2⤵
  PID:1436
- C:\Windows\System\rdHxQrb.exe
  C:\Windows\System\rdHxQrb.exe
  2⤵
  PID:2016
- C:\Windows\System\bRKoqkJ.exe
  C:\Windows\System\bRKoqkJ.exe
  2⤵
  PID:1668
- C:\Windows\System\DcgPNBt.exe
  C:\Windows\System\DcgPNBt.exe
  2⤵
  PID:1348
- C:\Windows\System\uVdyIua.exe
  C:\Windows\System\uVdyIua.exe
  2⤵
  PID:2184
- C:\Windows\System\YgwZQzk.exe
  C:\Windows\System\YgwZQzk.exe
  2⤵
  PID:2752
- C:\Windows\System\GeOfHge.exe
  C:\Windows\System\GeOfHge.exe
  2⤵
  PID:1504
- C:\Windows\System\ptQJJvr.exe
  C:\Windows\System\ptQJJvr.exe
  2⤵
  PID:1532
- C:\Windows\System\sHzRIVy.exe
  C:\Windows\System\sHzRIVy.exe
  2⤵
  PID:556
- C:\Windows\System\cAazxMQ.exe
  C:\Windows\System\cAazxMQ.exe
  2⤵
  PID:4140
- C:\Windows\System\NDWwNFh.exe
  C:\Windows\System\NDWwNFh.exe
  2⤵
  PID:1740
- C:\Windows\System\dCnbzHi.exe
  C:\Windows\System\dCnbzHi.exe
  2⤵
  PID:620
- C:\Windows\System\MKHxYrr.exe
  C:\Windows\System\MKHxYrr.exe
  2⤵
  PID:2216
- C:\Windows\System\jHjcUfu.exe
  C:\Windows\System\jHjcUfu.exe
  2⤵
  PID:2592
- C:\Windows\System\ygLfBam.exe
  C:\Windows\System\ygLfBam.exe
  2⤵
  PID:4612
- C:\Windows\System\vcFDqZt.exe
  C:\Windows\System\vcFDqZt.exe
  2⤵
  PID:4688
- C:\Windows\System\JBJzpkE.exe
  C:\Windows\System\JBJzpkE.exe
  2⤵
  PID:1660
- C:\Windows\System\kqYzWpY.exe
  C:\Windows\System\kqYzWpY.exe
  2⤵
  PID:4764
- C:\Windows\System\UYIEVKa.exe
  C:\Windows\System\UYIEVKa.exe
  2⤵
  PID:4800
- C:\Windows\System\GGAKhBN.exe
  C:\Windows\System\GGAKhBN.exe
  2⤵
  PID:4840
- C:\Windows\System\augEqNp.exe
  C:\Windows\System\augEqNp.exe
  2⤵
  PID:4436
- C:\Windows\System\XwRZkQY.exe
  C:\Windows\System\XwRZkQY.exe
  2⤵
  PID:4452
- C:\Windows\System\zUVvkuC.exe
  C:\Windows\System\zUVvkuC.exe
  2⤵
  PID:4508
- C:\Windows\System\SIoSyzi.exe
  C:\Windows\System\SIoSyzi.exe
  2⤵
  PID:4872
- C:\Windows\System\OtOQsRo.exe
  C:\Windows\System\OtOQsRo.exe
  2⤵
  PID:4544
- C:\Windows\System\eOozOSy.exe
  C:\Windows\System\eOozOSy.exe
  2⤵
  PID:4532
- C:\Windows\System\nvneckm.exe
  C:\Windows\System\nvneckm.exe
  2⤵
  PID:4920
- C:\Windows\System\Vtpwwca.exe
  C:\Windows\System\Vtpwwca.exe
  2⤵
  PID:4964
- C:\Windows\System\gLbhtDG.exe
  C:\Windows\System\gLbhtDG.exe
  2⤵
  PID:5036
- C:\Windows\System\xTaWbIx.exe
  C:\Windows\System\xTaWbIx.exe
  2⤵
  PID:5104
- C:\Windows\System\VwThLBt.exe
  C:\Windows\System\VwThLBt.exe
  2⤵
  PID:4704
- C:\Windows\System\kUXFqio.exe
  C:\Windows\System\kUXFqio.exe
  2⤵
  PID:4296
- C:\Windows\System\waeubRc.exe
  C:\Windows\System\waeubRc.exe
  2⤵
  PID:4156
- C:\Windows\System\xHTFpCM.exe
  C:\Windows\System\xHTFpCM.exe
  2⤵
  PID:2680
- C:\Windows\System\jHJzSWq.exe
  C:\Windows\System\jHJzSWq.exe
  2⤵
  PID:4360
- C:\Windows\System\LfAYRLn.exe
  C:\Windows\System\LfAYRLn.exe
  2⤵
  PID:3668
- C:\Windows\System\TXpnKaR.exe
  C:\Windows\System\TXpnKaR.exe
  2⤵
  PID:1128
- C:\Windows\System\bMOoxTU.exe
  C:\Windows\System\bMOoxTU.exe
  2⤵
  PID:1604
- C:\Windows\System\hxwwkgL.exe
  C:\Windows\System\hxwwkgL.exe
  2⤵
  PID:3280
- C:\Windows\System\ceXUEEC.exe
  C:\Windows\System\ceXUEEC.exe
  2⤵
  PID:3536
- C:\Windows\System\btCNHxT.exe
  C:\Windows\System\btCNHxT.exe
  2⤵
  PID:2128
- C:\Windows\System\qskweyl.exe
  C:\Windows\System\qskweyl.exe
  2⤵
  PID:3396
- C:\Windows\System\LLRNdYt.exe
  C:\Windows\System\LLRNdYt.exe
  2⤵
  PID:4592
- C:\Windows\System\jNRyNyj.exe
  C:\Windows\System\jNRyNyj.exe
  2⤵
  PID:3616
- C:\Windows\System\ZQGwZtS.exe
  C:\Windows\System\ZQGwZtS.exe
  2⤵
  PID:4664
- C:\Windows\System\JlnGzoO.exe
  C:\Windows\System\JlnGzoO.exe
  2⤵
  PID:4004
- C:\Windows\System\WHbwrkL.exe
  C:\Windows\System\WHbwrkL.exe
  2⤵
  PID:2588
- C:\Windows\System\HCoMkfy.exe
  C:\Windows\System\HCoMkfy.exe
  2⤵
  PID:1328
- C:\Windows\System\wPEhtDw.exe
  C:\Windows\System\wPEhtDw.exe
  2⤵
  PID:1536
- C:\Windows\System\EFyMXDl.exe
  C:\Windows\System\EFyMXDl.exe
  2⤵
  PID:1988
- C:\Windows\System\ebaqqbs.exe
  C:\Windows\System\ebaqqbs.exe
  2⤵
  PID:2432
- C:\Windows\System\YuDZjXP.exe
  C:\Windows\System\YuDZjXP.exe
  2⤵
  PID:4444
- C:\Windows\System\TmVsTZD.exe
  C:\Windows\System\TmVsTZD.exe
  2⤵
  PID:2496
- C:\Windows\System\VpmlZTy.exe
  C:\Windows\System\VpmlZTy.exe
  2⤵
  PID:4740
- C:\Windows\System\zlkyhPX.exe
  C:\Windows\System\zlkyhPX.exe
  2⤵
  PID:3876
- C:\Windows\System\JpSMYYC.exe
  C:\Windows\System\JpSMYYC.exe
  2⤵
  PID:4940
- C:\Windows\System\OFCpkNb.exe
  C:\Windows\System\OFCpkNb.exe
  2⤵
  PID:5012
- C:\Windows\System\IvWZJek.exe
  C:\Windows\System\IvWZJek.exe
  2⤵
  PID:5052
- C:\Windows\System\fvuexmI.exe
  C:\Windows\System\fvuexmI.exe
  2⤵
  PID:3524
- C:\Windows\System\ukXPQWM.exe
  C:\Windows\System\ukXPQWM.exe
  2⤵
  PID:4200
- C:\Windows\System\VNnYGGn.exe
  C:\Windows\System\VNnYGGn.exe
  2⤵
  PID:2684
- C:\Windows\System\zUNmAeg.exe
  C:\Windows\System\zUNmAeg.exe
  2⤵
  PID:4312
- C:\Windows\System\weLZvMD.exe
  C:\Windows\System\weLZvMD.exe
  2⤵
  PID:3600
- C:\Windows\System\aqnilDg.exe
  C:\Windows\System\aqnilDg.exe
  2⤵
  PID:4368
- C:\Windows\System\KhYkrYo.exe
  C:\Windows\System\KhYkrYo.exe
  2⤵
  PID:4536
- C:\Windows\System\sduyRpo.exe
  C:\Windows\System\sduyRpo.exe
  2⤵
  PID:4968
- C:\Windows\System\vYgmYXf.exe
  C:\Windows\System\vYgmYXf.exe
  2⤵
  PID:4272
- C:\Windows\System\QZMCFmL.exe
  C:\Windows\System\QZMCFmL.exe
  2⤵
  PID:2332
- C:\Windows\System\YoOBGuB.exe
  C:\Windows\System\YoOBGuB.exe
  2⤵
  PID:3216
- C:\Windows\System\zTpHXJZ.exe
  C:\Windows\System\zTpHXJZ.exe
  2⤵
  PID:3088
- C:\Windows\System\ehCQhOP.exe
  C:\Windows\System\ehCQhOP.exe
  2⤵
  PID:3888
- C:\Windows\System\BURzjES.exe
  C:\Windows\System\BURzjES.exe
  2⤵
  PID:3140
- C:\Windows\System\YjVhkdo.exe
  C:\Windows\System\YjVhkdo.exe
  2⤵
  PID:3808
- C:\Windows\System\qLJaqIq.exe
  C:\Windows\System\qLJaqIq.exe
  2⤵
  PID:4068
- C:\Windows\System\WoRJndN.exe
  C:\Windows\System\WoRJndN.exe
  2⤵
  PID:2260
- C:\Windows\System\oaIicgT.exe
  C:\Windows\System\oaIicgT.exe
  2⤵
  PID:1860
- C:\Windows\System\JIeHQGq.exe
  C:\Windows\System\JIeHQGq.exe
  2⤵
  PID:4176
- C:\Windows\System\kwXCNHf.exe
  C:\Windows\System\kwXCNHf.exe
  2⤵
  PID:804
- C:\Windows\System\NNEUTln.exe
  C:\Windows\System\NNEUTln.exe
  2⤵
  PID:4836
- C:\Windows\System\xvqKNxe.exe
  C:\Windows\System\xvqKNxe.exe
  2⤵
  PID:4460
- C:\Windows\System\ArrLzRr.exe
  C:\Windows\System\ArrLzRr.exe
  2⤵
  PID:4476
- C:\Windows\System\aZqESfW.exe
  C:\Windows\System\aZqESfW.exe
  2⤵
  PID:4492
- C:\Windows\System\oHYYmvM.exe
  C:\Windows\System\oHYYmvM.exe
  2⤵
  PID:1572
- C:\Windows\System\VRULmIy.exe
  C:\Windows\System\VRULmIy.exe
  2⤵
  PID:5100
- C:\Windows\System\gLSTZAA.exe
  C:\Windows\System\gLSTZAA.exe
  2⤵
  PID:4128
- C:\Windows\System\DzlPDYC.exe
  C:\Windows\System\DzlPDYC.exe
  2⤵
  PID:4332
- C:\Windows\System\upmbVMM.exe
  C:\Windows\System\upmbVMM.exe
  2⤵
  PID:4892
- C:\Windows\System\jNlwcEk.exe
  C:\Windows\System\jNlwcEk.exe
  2⤵
  PID:4596
- C:\Windows\System\fbEgkos.exe
  C:\Windows\System\fbEgkos.exe
  2⤵
  PID:2800
- C:\Windows\System\MIsBFMg.exe
  C:\Windows\System\MIsBFMg.exe
  2⤵
  PID:2792
- C:\Windows\System\VKlWNCI.exe
  C:\Windows\System\VKlWNCI.exe
  2⤵
  PID:3412
- C:\Windows\System\crXjnMO.exe
  C:\Windows\System\crXjnMO.exe
  2⤵
  PID:2824
- C:\Windows\System\vuudSbv.exe
  C:\Windows\System\vuudSbv.exe
  2⤵
  PID:4636
- C:\Windows\System\bZQaSBe.exe
  C:\Windows\System\bZQaSBe.exe
  2⤵
  PID:3588
- C:\Windows\System\BMvLTQz.exe
  C:\Windows\System\BMvLTQz.exe
  2⤵
  PID:4824
- C:\Windows\System\ledlSiE.exe
  C:\Windows\System\ledlSiE.exe
  2⤵
  PID:2448
- C:\Windows\System\kdYQlEp.exe
  C:\Windows\System\kdYQlEp.exe
  2⤵
  PID:2556
- C:\Windows\System\hjNkNiG.exe
  C:\Windows\System\hjNkNiG.exe
  2⤵
  PID:2628
- C:\Windows\System\NgEDDdb.exe
  C:\Windows\System\NgEDDdb.exe
  2⤵
  PID:2180
- C:\Windows\System\XwrNxhZ.exe
  C:\Windows\System\XwrNxhZ.exe
  2⤵
  PID:4652
- C:\Windows\System\CjDMSKO.exe
  C:\Windows\System\CjDMSKO.exe
  2⤵
  PID:4844
- C:\Windows\System\aMviqvi.exe
  C:\Windows\System\aMviqvi.exe
  2⤵
  PID:3016
- C:\Windows\System\ZmUKoCO.exe
  C:\Windows\System\ZmUKoCO.exe
  2⤵
  PID:4820
- C:\Windows\System\GDSEQew.exe
  C:\Windows\System\GDSEQew.exe
  2⤵
  PID:4520
- C:\Windows\System\AAGDBFg.exe
  C:\Windows\System\AAGDBFg.exe
  2⤵
  PID:580
- C:\Windows\System\ttkflRZ.exe
  C:\Windows\System\ttkflRZ.exe
  2⤵
  PID:3732
- C:\Windows\System\UlYCDbT.exe
  C:\Windows\System\UlYCDbT.exe
  2⤵
  PID:4344
- C:\Windows\System\fDryEXR.exe
  C:\Windows\System\fDryEXR.exe
  2⤵
  PID:4588
- C:\Windows\System\pGEVpFF.exe
  C:\Windows\System\pGEVpFF.exe
  2⤵
  PID:2508
- C:\Windows\System\sFdOqYi.exe
  C:\Windows\System\sFdOqYi.exe
  2⤵
  PID:1560
- C:\Windows\System\YNAcoAQ.exe
  C:\Windows\System\YNAcoAQ.exe
  2⤵
  PID:3232
- C:\Windows\System\ViprXBQ.exe
  C:\Windows\System\ViprXBQ.exe
  2⤵
  PID:2264
- C:\Windows\System\uSGVIqh.exe
  C:\Windows\System\uSGVIqh.exe
  2⤵
  PID:4468
- C:\Windows\System\MYPEHWj.exe
  C:\Windows\System\MYPEHWj.exe
  2⤵
  PID:1656
- C:\Windows\System\rJgMBIm.exe
  C:\Windows\System\rJgMBIm.exe
  2⤵
  PID:3220
- C:\Windows\System\OtCUXXV.exe
  C:\Windows\System\OtCUXXV.exe
  2⤵
  PID:2004
- C:\Windows\System\WlhYkIU.exe
  C:\Windows\System\WlhYkIU.exe
  2⤵
  PID:4428
- C:\Windows\System\ByWesmW.exe
  C:\Windows\System\ByWesmW.exe
  2⤵
  PID:2248
- C:\Windows\System\OESnfga.exe
  C:\Windows\System\OESnfga.exe
  2⤵
  PID:1188
- C:\Windows\System\oRFkRJa.exe
  C:\Windows\System\oRFkRJa.exe
  2⤵
  PID:1684
- C:\Windows\System\NyyDbUf.exe
  C:\Windows\System\NyyDbUf.exe
  2⤵
  PID:2404
- C:\Windows\System\qWDrVjw.exe
  C:\Windows\System\qWDrVjw.exe
  2⤵
  PID:2408
- C:\Windows\System\QXQFzWn.exe
  C:\Windows\System\QXQFzWn.exe
  2⤵
  PID:680
- C:\Windows\System\RwmrFdK.exe
  C:\Windows\System\RwmrFdK.exe
  2⤵
  PID:4112
- C:\Windows\System\DotHmPN.exe
  C:\Windows\System\DotHmPN.exe
  2⤵
  PID:4784
- C:\Windows\System\NRoIWbk.exe
  C:\Windows\System\NRoIWbk.exe
  2⤵
  PID:2620
- C:\Windows\System\iOWmTQR.exe
  C:\Windows\System\iOWmTQR.exe
  2⤵
  PID:4672
- C:\Windows\System\XahGmid.exe
  C:\Windows\System\XahGmid.exe
  2⤵
  PID:4860
- C:\Windows\System\hOySNhK.exe
  C:\Windows\System\hOySNhK.exe
  2⤵
  PID:4936
- C:\Windows\System\rinMRqt.exe
  C:\Windows\System\rinMRqt.exe
  2⤵
  PID:4284
- C:\Windows\System\yxNoLoj.exe
  C:\Windows\System\yxNoLoj.exe
  2⤵
  PID:4192
- C:\Windows\System\ufVOARS.exe
  C:\Windows\System\ufVOARS.exe
  2⤵
  PID:4984
- C:\Windows\System\onWSwRw.exe
  C:\Windows\System\onWSwRw.exe
  2⤵
  PID:1728
- C:\Windows\System\aXWCYYs.exe
  C:\Windows\System\aXWCYYs.exe
  2⤵
  PID:2688
- C:\Windows\System\DZPyjDg.exe
  C:\Windows\System\DZPyjDg.exe
  2⤵
  PID:5132
- C:\Windows\System\okeldGP.exe
  C:\Windows\System\okeldGP.exe
  2⤵
  PID:5148
- C:\Windows\System\DRblwRE.exe
  C:\Windows\System\DRblwRE.exe
  2⤵
  PID:5164
- C:\Windows\System\BLNZShF.exe
  C:\Windows\System\BLNZShF.exe
  2⤵
  PID:5180
- C:\Windows\System\lbdhKhA.exe
  C:\Windows\System\lbdhKhA.exe
  2⤵
  PID:5196
- C:\Windows\System\kiPfpHP.exe
  C:\Windows\System\kiPfpHP.exe
  2⤵
  PID:5216
- C:\Windows\System\cTMuDWA.exe
  C:\Windows\System\cTMuDWA.exe
  2⤵
  PID:5236
- C:\Windows\System\xoLQPTa.exe
  C:\Windows\System\xoLQPTa.exe
  2⤵
  PID:5252
- C:\Windows\System\JTcbbqk.exe
  C:\Windows\System\JTcbbqk.exe
  2⤵
  PID:5276
- C:\Windows\System\rPbYSVk.exe
  C:\Windows\System\rPbYSVk.exe
  2⤵
  PID:5292
- C:\Windows\System\SYpaWOt.exe
  C:\Windows\System\SYpaWOt.exe
  2⤵
  PID:5308
- C:\Windows\System\qhBndMc.exe
  C:\Windows\System\qhBndMc.exe
  2⤵
  PID:5324
- C:\Windows\System\bpLnocJ.exe
  C:\Windows\System\bpLnocJ.exe
  2⤵
  PID:5344
- C:\Windows\System\aAWdOgz.exe
  C:\Windows\System\aAWdOgz.exe
  2⤵
  PID:5396
- C:\Windows\System\LwvLkmH.exe
  C:\Windows\System\LwvLkmH.exe
  2⤵
  PID:5416
- C:\Windows\System\PKtgfdH.exe
  C:\Windows\System\PKtgfdH.exe
  2⤵
  PID:5432
- C:\Windows\System\fDlcgLZ.exe
  C:\Windows\System\fDlcgLZ.exe
  2⤵
  PID:5480
- C:\Windows\System\YMapfJw.exe
  C:\Windows\System\YMapfJw.exe
  2⤵
  PID:5496
- C:\Windows\System\oMKEdrK.exe
  C:\Windows\System\oMKEdrK.exe
  2⤵
  PID:5524
- C:\Windows\System\OJisXEi.exe
  C:\Windows\System\OJisXEi.exe
  2⤵
  PID:5540
- C:\Windows\System\GWYRoZt.exe
  C:\Windows\System\GWYRoZt.exe
  2⤵
  PID:5560
- C:\Windows\System\DRMPiSr.exe
  C:\Windows\System\DRMPiSr.exe
  2⤵
  PID:5576
- C:\Windows\System\weYKWxM.exe
  C:\Windows\System\weYKWxM.exe
  2⤵
  PID:5592
- C:\Windows\System\bNuSGKa.exe
  C:\Windows\System\bNuSGKa.exe
  2⤵
  PID:5616
- C:\Windows\System\NsRCSMx.exe
  C:\Windows\System\NsRCSMx.exe
  2⤵
  PID:5636
- C:\Windows\System\peTUYvG.exe
  C:\Windows\System\peTUYvG.exe
  2⤵
  PID:5652
- C:\Windows\System\vIVyLLw.exe
  C:\Windows\System\vIVyLLw.exe
  2⤵
  PID:5700
- C:\Windows\System\joxRFcD.exe
  C:\Windows\System\joxRFcD.exe
  2⤵
  PID:5716
- C:\Windows\System\atIGJqi.exe
  C:\Windows\System\atIGJqi.exe
  2⤵
  PID:5732
- C:\Windows\System\ECsocZI.exe
  C:\Windows\System\ECsocZI.exe
  2⤵
  PID:5748
- C:\Windows\System\PNvZsgX.exe
  C:\Windows\System\PNvZsgX.exe
  2⤵
  PID:5764
- C:\Windows\System\wGRtrIm.exe
  C:\Windows\System\wGRtrIm.exe
  2⤵
  PID:5784
- C:\Windows\System\PQHVriR.exe
  C:\Windows\System\PQHVriR.exe
  2⤵
  PID:5836
- C:\Windows\System\erRwBMc.exe
  C:\Windows\System\erRwBMc.exe
  2⤵
  PID:5860
- C:\Windows\System\styhdRD.exe
  C:\Windows\System\styhdRD.exe
  2⤵
  PID:5876
- C:\Windows\System\JrtkyqJ.exe
  C:\Windows\System\JrtkyqJ.exe
  2⤵
  PID:5892
- C:\Windows\System\XtUWHpv.exe
  C:\Windows\System\XtUWHpv.exe
  2⤵
  PID:5912
- C:\Windows\System\UebAyKE.exe
  C:\Windows\System\UebAyKE.exe
  2⤵
  PID:5928
- C:\Windows\System\OhUvEzX.exe
  C:\Windows\System\OhUvEzX.exe
  2⤵
  PID:5944
- C:\Windows\System\Wsbpfoo.exe
  C:\Windows\System\Wsbpfoo.exe
  2⤵
  PID:5960
- C:\Windows\System\iPTlEiB.exe
  C:\Windows\System\iPTlEiB.exe
  2⤵
  PID:5976
- C:\Windows\System\CYCxgwb.exe
  C:\Windows\System\CYCxgwb.exe
  2⤵
  PID:5992
- C:\Windows\System\zAFMkpX.exe
  C:\Windows\System\zAFMkpX.exe
  2⤵
  PID:6008
- C:\Windows\System\aFGdBsC.exe
  C:\Windows\System\aFGdBsC.exe
  2⤵
  PID:6028
- C:\Windows\System\gCudSqN.exe
  C:\Windows\System\gCudSqN.exe
  2⤵
  PID:6044
- C:\Windows\System\KgsyzNS.exe
  C:\Windows\System\KgsyzNS.exe
  2⤵
  PID:6060
- C:\Windows\System\StqhJFJ.exe
  C:\Windows\System\StqhJFJ.exe
  2⤵
  PID:6076
- C:\Windows\System\cWanBxI.exe
  C:\Windows\System\cWanBxI.exe
  2⤵
  PID:6092
- C:\Windows\System\jcyqsDJ.exe
  C:\Windows\System\jcyqsDJ.exe
  2⤵
  PID:6108
- C:\Windows\System\HPsDSCZ.exe
  C:\Windows\System\HPsDSCZ.exe
  2⤵
  PID:6128
- C:\Windows\System\frKoicU.exe
  C:\Windows\System\frKoicU.exe
  2⤵
  PID:4500
- C:\Windows\System\ZmajBXg.exe
  C:\Windows\System\ZmajBXg.exe
  2⤵
  PID:3940
- C:\Windows\System\hFjtGDB.exe
  C:\Windows\System\hFjtGDB.exe
  2⤵
  PID:5248
- C:\Windows\System\ORkshXl.exe
  C:\Windows\System\ORkshXl.exe
  2⤵
  PID:2852
- C:\Windows\System\rkGHavq.exe
  C:\Windows\System\rkGHavq.exe
  2⤵
  PID:3824
- C:\Windows\System\flExUBb.exe
  C:\Windows\System\flExUBb.exe
  2⤵
  PID:5032
- C:\Windows\System\dzcQNWD.exe
  C:\Windows\System\dzcQNWD.exe
  2⤵
  PID:5320
- C:\Windows\System\fTzNwFg.exe
  C:\Windows\System\fTzNwFg.exe
  2⤵
  PID:5144
- C:\Windows\System\wKHYgCK.exe
  C:\Windows\System\wKHYgCK.exe
  2⤵
  PID:4632
- C:\Windows\System\fzmslyX.exe
  C:\Windows\System\fzmslyX.exe
  2⤵
  PID:5172
- C:\Windows\System\UgLVMIl.exe
  C:\Windows\System\UgLVMIl.exe
  2⤵
  PID:5288
- C:\Windows\System\COFvfDo.exe
  C:\Windows\System\COFvfDo.exe
  2⤵
  PID:5336
- C:\Windows\System\FCHRobT.exe
  C:\Windows\System\FCHRobT.exe
  2⤵
  PID:5380
- C:\Windows\System\ETjPasq.exe
  C:\Windows\System\ETjPasq.exe
  2⤵
  PID:3860
- C:\Windows\System\tdvyQXS.exe
  C:\Windows\System\tdvyQXS.exe
  2⤵
  PID:3476
- C:\Windows\System\ecrudFn.exe
  C:\Windows\System\ecrudFn.exe
  2⤵
  PID:2172
- C:\Windows\System\pZaNaKh.exe
  C:\Windows\System\pZaNaKh.exe
  2⤵
  PID:4380
- C:\Windows\System\ZjczdCD.exe
  C:\Windows\System\ZjczdCD.exe
  2⤵
  PID:4668
- C:\Windows\System\wJwJnnh.exe
  C:\Windows\System\wJwJnnh.exe
  2⤵
  PID:3872
- C:\Windows\System\ancmVqI.exe
  C:\Windows\System\ancmVqI.exe
  2⤵
  PID:5156
- C:\Windows\System\IOPruOi.exe
  C:\Windows\System\IOPruOi.exe
  2⤵
  PID:5192
- C:\Windows\System\MGXSCkH.exe
  C:\Windows\System\MGXSCkH.exe
  2⤵
  PID:5272
- C:\Windows\System\rleLzNR.exe
  C:\Windows\System\rleLzNR.exe
  2⤵
  PID:5340
- C:\Windows\System\cPUmLeE.exe
  C:\Windows\System\cPUmLeE.exe
  2⤵
  PID:5412
- C:\Windows\System\bzkpWYw.exe
  C:\Windows\System\bzkpWYw.exe
  2⤵
  PID:3828
- C:\Windows\System\OqLLvjb.exe
  C:\Windows\System\OqLLvjb.exe
  2⤵
  PID:5460
- C:\Windows\System\VdfGfKb.exe
  C:\Windows\System\VdfGfKb.exe
  2⤵
  PID:5472
- C:\Windows\System\IXjNWwd.exe
  C:\Windows\System\IXjNWwd.exe
  2⤵
  PID:5508
- C:\Windows\System\XiClCGq.exe
  C:\Windows\System\XiClCGq.exe
  2⤵
  PID:5512
- C:\Windows\System\qrVxhrB.exe
  C:\Windows\System\qrVxhrB.exe
  2⤵
  PID:5556
- C:\Windows\System\chKYrCr.exe
  C:\Windows\System\chKYrCr.exe
  2⤵
  PID:5588
- C:\Windows\System\AKnmPXa.exe
  C:\Windows\System\AKnmPXa.exe
  2⤵
  PID:5604
- C:\Windows\System\sXBoDvT.exe
  C:\Windows\System\sXBoDvT.exe
  2⤵
  PID:5628
- C:\Windows\System\mUbVjfF.exe
  C:\Windows\System\mUbVjfF.exe
  2⤵
  PID:5708
- C:\Windows\System\NSWwMoP.exe
  C:\Windows\System\NSWwMoP.exe
  2⤵
  PID:5680
- C:\Windows\System\QgOBzDX.exe
  C:\Windows\System\QgOBzDX.exe
  2⤵
  PID:5672
- C:\Windows\System\bqENpGu.exe
  C:\Windows\System\bqENpGu.exe
  2⤵
  PID:5728
- C:\Windows\System\CIwBAoT.exe
  C:\Windows\System\CIwBAoT.exe
  2⤵
  PID:5780
- C:\Windows\System\XyWrBcI.exe
  C:\Windows\System\XyWrBcI.exe
  2⤵
  PID:5796
- C:\Windows\System\xpmjDQy.exe
  C:\Windows\System\xpmjDQy.exe
  2⤵
  PID:5828
- C:\Windows\System\AdPoKXZ.exe
  C:\Windows\System\AdPoKXZ.exe
  2⤵
  PID:5812
- C:\Windows\System\tuTYQAh.exe
  C:\Windows\System\tuTYQAh.exe
  2⤵
  PID:5800
- C:\Windows\System\SMwpgzj.exe
  C:\Windows\System\SMwpgzj.exe
  2⤵
  PID:5908
- C:\Windows\System\KxbAOhu.exe
  C:\Windows\System\KxbAOhu.exe
  2⤵
  PID:5972
- C:\Windows\System\YzNVGpU.exe
  C:\Windows\System\YzNVGpU.exe
  2⤵
  PID:5936
- C:\Windows\System\SWKiOqs.exe
  C:\Windows\System\SWKiOqs.exe
  2⤵
  PID:5316
- C:\Windows\System\VbflyFl.exe
  C:\Windows\System\VbflyFl.exe
  2⤵
  PID:5208
- C:\Windows\System\WeZHYvn.exe
  C:\Windows\System\WeZHYvn.exe
  2⤵
  PID:5068
- C:\Windows\System\ABuKlSM.exe
  C:\Windows\System\ABuKlSM.exe
  2⤵
  PID:5952
- C:\Windows\System\yiZqTtx.exe
  C:\Windows\System\yiZqTtx.exe
  2⤵
  PID:5884
- C:\Windows\System\igvWodJ.exe
  C:\Windows\System\igvWodJ.exe
  2⤵
  PID:5984
- C:\Windows\System\WhtHoLn.exe
  C:\Windows\System\WhtHoLn.exe
  2⤵
  PID:6024
- C:\Windows\System\NUHGaHF.exe
  C:\Windows\System\NUHGaHF.exe
  2⤵
  PID:6116
- C:\Windows\System\ryBNIJQ.exe
  C:\Windows\System\ryBNIJQ.exe
  2⤵
  PID:5244
- C:\Windows\System\GBMFHLm.exe
  C:\Windows\System\GBMFHLm.exe
  2⤵
  PID:2936
- C:\Windows\System\DhnnOUQ.exe
  C:\Windows\System\DhnnOUQ.exe
  2⤵
  PID:3348
- C:\Windows\System\MVTuVFP.exe
  C:\Windows\System\MVTuVFP.exe
  2⤵
  PID:4960
- C:\Windows\System\lhmxTkE.exe
  C:\Windows\System\lhmxTkE.exe
  2⤵
  PID:2388
- C:\Windows\System\nxTuXsb.exe
  C:\Windows\System\nxTuXsb.exe
  2⤵
  PID:5124
- C:\Windows\System\ykjFapz.exe
  C:\Windows\System\ykjFapz.exe
  2⤵
  PID:5304
- C:\Windows\System\adqQAte.exe
  C:\Windows\System\adqQAte.exe
  2⤵
  PID:5464
- C:\Windows\System\HNmkrpT.exe
  C:\Windows\System\HNmkrpT.exe
  2⤵
  PID:5264
- C:\Windows\System\tVkatEt.exe
  C:\Windows\System\tVkatEt.exe
  2⤵
  PID:5552
- C:\Windows\System\IpUSMYC.exe
  C:\Windows\System\IpUSMYC.exe
  2⤵
  PID:5584
- C:\Windows\System\lFuGvJz.exe
  C:\Windows\System\lFuGvJz.exe
  2⤵
  PID:5676
- C:\Windows\System\VDTdDBI.exe
  C:\Windows\System\VDTdDBI.exe
  2⤵
  PID:5692
- C:\Windows\System\UZdnCFY.exe
  C:\Windows\System\UZdnCFY.exe
  2⤵
  PID:5824
- C:\Windows\System\nWLHYPX.exe
  C:\Windows\System\nWLHYPX.exe
  2⤵
  PID:5900
- C:\Windows\System\MEtpIBX.exe
  C:\Windows\System\MEtpIBX.exe
  2⤵
  PID:5968
- C:\Windows\System\YHwnMLn.exe
  C:\Windows\System\YHwnMLn.exe
  2⤵
  PID:6100
- C:\Windows\System\WJsPDbG.exe
  C:\Windows\System\WJsPDbG.exe
  2⤵
  PID:4484
- C:\Windows\System\CwCLHAZ.exe
  C:\Windows\System\CwCLHAZ.exe
  2⤵
  PID:1928
- C:\Windows\System\JoxtUEY.exe
  C:\Windows\System\JoxtUEY.exe
  2⤵
  PID:6016
- C:\Windows\System\IJAODgY.exe
  C:\Windows\System\IJAODgY.exe
  2⤵
  PID:6020
- C:\Windows\System\SPFCuqR.exe
  C:\Windows\System\SPFCuqR.exe
  2⤵
  PID:3092
- C:\Windows\System\zJfvNbW.exe
  C:\Windows\System\zJfvNbW.exe
  2⤵
  PID:5920
- C:\Windows\System\vjihDIC.exe
  C:\Windows\System\vjihDIC.exe
  2⤵
  PID:4524
- C:\Windows\System\eVdVRkR.exe
  C:\Windows\System\eVdVRkR.exe
  2⤵
  PID:5388
- C:\Windows\System\QywbgBr.exe
  C:\Windows\System\QywbgBr.exe
  2⤵
  PID:5392
- C:\Windows\System\veRjmwg.exe
  C:\Windows\System\veRjmwg.exe
  2⤵
  PID:4432
- C:\Windows\System\KVoIFnN.exe
  C:\Windows\System\KVoIFnN.exe
  2⤵
  PID:5268
- C:\Windows\System\DwlaHFF.exe
  C:\Windows\System\DwlaHFF.exe
  2⤵
  PID:5608
- C:\Windows\System\nNgFoQB.exe
  C:\Windows\System\nNgFoQB.exe
  2⤵
  PID:5756
- C:\Windows\System\hUrGrrQ.exe
  C:\Windows\System\hUrGrrQ.exe
  2⤵
  PID:5776
- C:\Windows\System\JpUNzkF.exe
  C:\Windows\System\JpUNzkF.exe
  2⤵
  PID:5820
- C:\Windows\System\LcnnqJf.exe
  C:\Windows\System\LcnnqJf.exe
  2⤵
  PID:5856
- C:\Windows\System\xbTpJkT.exe
  C:\Windows\System\xbTpJkT.exe
  2⤵
  PID:5176
- C:\Windows\System\nxmoWkf.exe
  C:\Windows\System\nxmoWkf.exe
  2⤵
  PID:3296
- C:\Windows\System\DZPHrqN.exe
  C:\Windows\System\DZPHrqN.exe
  2⤵
  PID:5488
- C:\Windows\System\HPvVFUx.exe
  C:\Windows\System\HPvVFUx.exe
  2⤵
  PID:5664
- C:\Windows\System\ysHRDJo.exe
  C:\Windows\System\ysHRDJo.exe
  2⤵
  PID:6140
- C:\Windows\System\PgVPQqe.exe
  C:\Windows\System\PgVPQqe.exe
  2⤵
  PID:6152
- C:\Windows\System\MdLhvxJ.exe
  C:\Windows\System\MdLhvxJ.exe
  2⤵
  PID:6168
- C:\Windows\System\cDaJLBe.exe
  C:\Windows\System\cDaJLBe.exe
  2⤵
  PID:6184
- C:\Windows\System\uwxoZHk.exe
  C:\Windows\System\uwxoZHk.exe
  2⤵
  PID:6204
- C:\Windows\System\jLFPsum.exe
  C:\Windows\System\jLFPsum.exe
  2⤵
  PID:6220
- C:\Windows\System\OFjbaUp.exe
  C:\Windows\System\OFjbaUp.exe
  2⤵
  PID:6240
- C:\Windows\System\fDhrDVb.exe
  C:\Windows\System\fDhrDVb.exe
  2⤵
  PID:6292
- C:\Windows\System\IQxHJgo.exe
  C:\Windows\System\IQxHJgo.exe
  2⤵
  PID:6308
- C:\Windows\System\usXZgzk.exe
  C:\Windows\System\usXZgzk.exe
  2⤵
  PID:6324
- C:\Windows\System\KDSyXCP.exe
  C:\Windows\System\KDSyXCP.exe
  2⤵
  PID:6340
- C:\Windows\System\FiqVCqD.exe
  C:\Windows\System\FiqVCqD.exe
  2⤵
  PID:6364
- C:\Windows\System\CgBROCC.exe
  C:\Windows\System\CgBROCC.exe
  2⤵
  PID:6380
- C:\Windows\System\nPcSWiY.exe
  C:\Windows\System\nPcSWiY.exe
  2⤵
  PID:6396
- C:\Windows\System\JgxJLHI.exe
  C:\Windows\System\JgxJLHI.exe
  2⤵
  PID:6412
- C:\Windows\System\NZcFebq.exe
  C:\Windows\System\NZcFebq.exe
  2⤵
  PID:6428
- C:\Windows\System\hZTkEZn.exe
  C:\Windows\System\hZTkEZn.exe
  2⤵
  PID:6444
- C:\Windows\System\hJAqXqN.exe
  C:\Windows\System\hJAqXqN.exe
  2⤵
  PID:6460
- C:\Windows\System\fSWKrhx.exe
  C:\Windows\System\fSWKrhx.exe
  2⤵
  PID:6476
- C:\Windows\System\DqbTlog.exe
  C:\Windows\System\DqbTlog.exe
  2⤵
  PID:6492
- C:\Windows\System\FSSATXJ.exe
  C:\Windows\System\FSSATXJ.exe
  2⤵
  PID:6508
- C:\Windows\System\sbIGLvr.exe
  C:\Windows\System\sbIGLvr.exe
  2⤵
  PID:6524
- C:\Windows\System\mMbvLEX.exe
  C:\Windows\System\mMbvLEX.exe
  2⤵
  PID:6540
- C:\Windows\System\AlTOPwe.exe
  C:\Windows\System\AlTOPwe.exe
  2⤵
  PID:6556
- C:\Windows\System\rqLhWhF.exe
  C:\Windows\System\rqLhWhF.exe
  2⤵
  PID:6572
- C:\Windows\System\dRFwEgx.exe
  C:\Windows\System\dRFwEgx.exe
  2⤵
  PID:6588
- C:\Windows\System\sBXHvXY.exe
  C:\Windows\System\sBXHvXY.exe
  2⤵
  PID:6604
- C:\Windows\System\UrXIPDT.exe
  C:\Windows\System\UrXIPDT.exe
  2⤵
  PID:6620
- C:\Windows\System\YIvxKjg.exe
  C:\Windows\System\YIvxKjg.exe
  2⤵
  PID:6636
- C:\Windows\System\aQgomvA.exe
  C:\Windows\System\aQgomvA.exe
  2⤵
  PID:6652
- C:\Windows\System\AcOUmim.exe
  C:\Windows\System\AcOUmim.exe
  2⤵
  PID:6668
- C:\Windows\System\pndhgbf.exe
  C:\Windows\System\pndhgbf.exe
  2⤵
  PID:6684
- C:\Windows\System\aklbKbP.exe
  C:\Windows\System\aklbKbP.exe
  2⤵
  PID:6700
- C:\Windows\System\AttlURJ.exe
  C:\Windows\System\AttlURJ.exe
  2⤵
  PID:6716
- C:\Windows\System\oGcVPXQ.exe
  C:\Windows\System\oGcVPXQ.exe
  2⤵
  PID:6732
- C:\Windows\System\suzwmeB.exe
  C:\Windows\System\suzwmeB.exe
  2⤵
  PID:6748
- C:\Windows\System\oiwPMId.exe
  C:\Windows\System\oiwPMId.exe
  2⤵
  PID:6764
- C:\Windows\System\YlfZwDd.exe
  C:\Windows\System\YlfZwDd.exe
  2⤵
  PID:6780
- C:\Windows\System\FXvfpeR.exe
  C:\Windows\System\FXvfpeR.exe
  2⤵
  PID:6796
- C:\Windows\System\bwTkgSl.exe
  C:\Windows\System\bwTkgSl.exe
  2⤵
  PID:6812
- C:\Windows\System\SZImsDC.exe
  C:\Windows\System\SZImsDC.exe
  2⤵
  PID:6828
- C:\Windows\System\xkpfeWy.exe
  C:\Windows\System\xkpfeWy.exe
  2⤵
  PID:6844
- C:\Windows\System\dqmUGOx.exe
  C:\Windows\System\dqmUGOx.exe
  2⤵
  PID:6860
- C:\Windows\System\cQZHhaO.exe
  C:\Windows\System\cQZHhaO.exe
  2⤵
  PID:6876
- C:\Windows\System\LvVIEiU.exe
  C:\Windows\System\LvVIEiU.exe
  2⤵
  PID:6892
- C:\Windows\System\crQyQIA.exe
  C:\Windows\System\crQyQIA.exe
  2⤵
  PID:6908
- C:\Windows\System\GhPLBXk.exe
  C:\Windows\System\GhPLBXk.exe
  2⤵
  PID:6924
- C:\Windows\System\DADBJgm.exe
  C:\Windows\System\DADBJgm.exe
  2⤵
  PID:6940
- C:\Windows\System\KTjrssr.exe
  C:\Windows\System\KTjrssr.exe
  2⤵
  PID:6956
- C:\Windows\System\VFoIaih.exe
  C:\Windows\System\VFoIaih.exe
  2⤵
  PID:6972
- C:\Windows\System\OcEjqTK.exe
  C:\Windows\System\OcEjqTK.exe
  2⤵
  PID:6988
- C:\Windows\System\Cpeqqoe.exe
  C:\Windows\System\Cpeqqoe.exe
  2⤵
  PID:7004
- C:\Windows\System\sEMibKV.exe
  C:\Windows\System\sEMibKV.exe
  2⤵
  PID:7020
- C:\Windows\System\LSnPTUY.exe
  C:\Windows\System\LSnPTUY.exe
  2⤵
  PID:7036
- C:\Windows\System\SzHjxtX.exe
  C:\Windows\System\SzHjxtX.exe
  2⤵
  PID:7052
- C:\Windows\System\eWwzpCk.exe
  C:\Windows\System\eWwzpCk.exe
  2⤵
  PID:7068
- C:\Windows\System\QMAIHTW.exe
  C:\Windows\System\QMAIHTW.exe
  2⤵
  PID:7084
- C:\Windows\System\IigIVqV.exe
  C:\Windows\System\IigIVqV.exe
  2⤵
  PID:7100
- C:\Windows\System\TGUZgkH.exe
  C:\Windows\System\TGUZgkH.exe
  2⤵
  PID:7116
- C:\Windows\System\VbXXzzU.exe
  C:\Windows\System\VbXXzzU.exe
  2⤵
  PID:7136
- C:\Windows\System\hTNFPJc.exe
  C:\Windows\System\hTNFPJc.exe
  2⤵
  PID:7152
- C:\Windows\System\WSPdCiA.exe
  C:\Windows\System\WSPdCiA.exe
  2⤵
  PID:5804
- C:\Windows\System\CtqBWNV.exe
  C:\Windows\System\CtqBWNV.exe
  2⤵
  PID:6192
- C:\Windows\System\aNBJpYU.exe
  C:\Windows\System\aNBJpYU.exe
  2⤵
  PID:6236
- C:\Windows\System\bVbYwQr.exe
  C:\Windows\System\bVbYwQr.exe
  2⤵
  PID:4816
- C:\Windows\System\HgGSmWM.exe
  C:\Windows\System\HgGSmWM.exe
  2⤵
  PID:5624
- C:\Windows\System\bUOuUnR.exe
  C:\Windows\System\bUOuUnR.exe
  2⤵
  PID:5368
- C:\Windows\System\lFWtLIp.exe
  C:\Windows\System\lFWtLIp.exe
  2⤵
  PID:5532
- C:\Windows\System\yISDKGi.exe
  C:\Windows\System\yISDKGi.exe
  2⤵
  PID:344
- C:\Windows\System\lKnwCBE.exe
  C:\Windows\System\lKnwCBE.exe
  2⤵
  PID:5140
- C:\Windows\System\oiaFfZa.exe
  C:\Windows\System\oiaFfZa.exe
  2⤵
  PID:6212
- C:\Windows\System\ljJsaNq.exe
  C:\Windows\System\ljJsaNq.exe
  2⤵
  PID:6256
- C:\Windows\System\mwQBndz.exe
  C:\Windows\System\mwQBndz.exe
  2⤵
  PID:6272
- C:\Windows\System\twGOchZ.exe
  C:\Windows\System\twGOchZ.exe
  2⤵
  PID:6288
- C:\Windows\System\ecmUlgJ.exe
  C:\Windows\System\ecmUlgJ.exe
  2⤵
  PID:6336
- C:\Windows\System\XOoHNCl.exe
  C:\Windows\System\XOoHNCl.exe
  2⤵
  PID:6408
- C:\Windows\System\auWtrmB.exe
  C:\Windows\System\auWtrmB.exe
  2⤵
  PID:6440
- C:\Windows\System\lzOYXco.exe
  C:\Windows\System\lzOYXco.exe
  2⤵
  PID:6504
- C:\Windows\System\aSjGJcp.exe
  C:\Windows\System\aSjGJcp.exe
  2⤵
  PID:6568
- C:\Windows\System\SwSDvJk.exe
  C:\Windows\System\SwSDvJk.exe
  2⤵
  PID:6632
- C:\Windows\System\rpvKmfQ.exe
  C:\Windows\System\rpvKmfQ.exe
  2⤵
  PID:6696
- C:\Windows\System\GtruAmX.exe
  C:\Windows\System\GtruAmX.exe
  2⤵
  PID:6788
- C:\Windows\System\aBwVzsX.exe
  C:\Windows\System\aBwVzsX.exe
  2⤵
  PID:6824
- C:\Windows\System\fMBEObP.exe
  C:\Windows\System\fMBEObP.exe
  2⤵
  PID:6888
- C:\Windows\System\eWjQkDc.exe
  C:\Windows\System\eWjQkDc.exe
  2⤵
  PID:6952
- C:\Windows\System\qbEoXXm.exe
  C:\Windows\System\qbEoXXm.exe
  2⤵
  PID:6984
- C:\Windows\System\glokxDQ.exe
  C:\Windows\System\glokxDQ.exe
  2⤵
  PID:6872
- C:\Windows\System\DlfQdBK.exe
  C:\Windows\System\DlfQdBK.exe
  2⤵
  PID:6360
- C:\Windows\System\wqjsaKn.exe
  C:\Windows\System\wqjsaKn.exe
  2⤵
  PID:6612
- C:\Windows\System\yBYPUSI.exe
  C:\Windows\System\yBYPUSI.exe
  2⤵
  PID:6420
- C:\Windows\System\JtmKnJj.exe
  C:\Windows\System\JtmKnJj.exe
  2⤵
  PID:6488
- C:\Windows\System\PiSqiZP.exe
  C:\Windows\System\PiSqiZP.exe
  2⤵
  PID:6580
- C:\Windows\System\mwAAfBV.exe
  C:\Windows\System\mwAAfBV.exe
  2⤵
  PID:6676
- C:\Windows\System\JSaBSga.exe
  C:\Windows\System\JSaBSga.exe
  2⤵
  PID:6740
- C:\Windows\System\DGxSeDG.exe
  C:\Windows\System\DGxSeDG.exe
  2⤵
  PID:6804
- C:\Windows\System\ylWEcRe.exe
  C:\Windows\System\ylWEcRe.exe
  2⤵
  PID:6936
- C:\Windows\System\UsTXNHJ.exe
  C:\Windows\System\UsTXNHJ.exe
  2⤵
  PID:7044
- C:\Windows\System\aKFPRXa.exe
  C:\Windows\System\aKFPRXa.exe
  2⤵
  PID:7076
- C:\Windows\System\nvYrtwV.exe
  C:\Windows\System\nvYrtwV.exe
  2⤵
  PID:7064
- C:\Windows\System\BZrkWPt.exe
  C:\Windows\System\BZrkWPt.exe
  2⤵
  PID:7144
- C:\Windows\System\gEbvGLR.exe
  C:\Windows\System\gEbvGLR.exe
  2⤵
  PID:6072
- C:\Windows\System\gHvfBWK.exe
  C:\Windows\System\gHvfBWK.exe
  2⤵
  PID:5516
- C:\Windows\System\FOIbAnV.exe
  C:\Windows\System\FOIbAnV.exe
  2⤵
  PID:7160
- C:\Windows\System\NuMFpSZ.exe
  C:\Windows\System\NuMFpSZ.exe
  2⤵
  PID:7124
- C:\Windows\System\EOfQuuq.exe
  C:\Windows\System\EOfQuuq.exe
  2⤵
  PID:5792
- C:\Windows\System\trFeQnt.exe
  C:\Windows\System\trFeQnt.exe
  2⤵
  PID:6248
- C:\Windows\System\QPVOnmn.exe
  C:\Windows\System\QPVOnmn.exe
  2⤵
  PID:6332
- C:\Windows\System\sgBcDpv.exe
  C:\Windows\System\sgBcDpv.exe
  2⤵
  PID:6536
- C:\Windows\System\WOVvhwv.exe
  C:\Windows\System\WOVvhwv.exe
  2⤵
  PID:6404
- C:\Windows\System\GUHQJJR.exe
  C:\Windows\System\GUHQJJR.exe
  2⤵
  PID:6600
- C:\Windows\System\xBtrDDS.exe
  C:\Windows\System\xBtrDDS.exe
  2⤵
  PID:6856
- C:\Windows\System\qbNSizo.exe
  C:\Windows\System\qbNSizo.exe
  2⤵
  PID:6792
- C:\Windows\System\qDVvMTE.exe
  C:\Windows\System\qDVvMTE.exe
  2⤵
  PID:6388
- C:\Windows\System\gdaGSoE.exe
  C:\Windows\System\gdaGSoE.exe
  2⤵
  PID:6456
- C:\Windows\System\npbbPcx.exe
  C:\Windows\System\npbbPcx.exe
  2⤵
  PID:6548
- C:\Windows\System\JZgvjqG.exe
  C:\Windows\System\JZgvjqG.exe
  2⤵
  PID:6968
- C:\Windows\System\SmmTqaX.exe
  C:\Windows\System\SmmTqaX.exe
  2⤵
  PID:6160
- C:\Windows\System\CxEESVW.exe
  C:\Windows\System\CxEESVW.exe
  2⤵
  PID:6176
- C:\Windows\System\VPpdrAw.exe
  C:\Windows\System\VPpdrAw.exe
  2⤵
  PID:6376
- C:\Windows\System\dMdNtXC.exe
  C:\Windows\System\dMdNtXC.exe
  2⤵
  PID:6920
- C:\Windows\System\IVDHfGt.exe
  C:\Windows\System\IVDHfGt.exe
  2⤵
  PID:6452
- C:\Windows\System\JlYovIW.exe
  C:\Windows\System\JlYovIW.exe
  2⤵
  PID:7096
- C:\Windows\System\qzhTQMu.exe
  C:\Windows\System\qzhTQMu.exe
  2⤵
  PID:6200
- C:\Windows\System\eersdqY.exe
  C:\Windows\System\eersdqY.exe
  2⤵
  PID:6836
- C:\Windows\System\SLdqgcy.exe
  C:\Windows\System\SLdqgcy.exe
  2⤵
  PID:6264
- C:\Windows\System\sVROStC.exe
  C:\Windows\System\sVROStC.exe
  2⤵
  PID:6516
- C:\Windows\System\pxprqcD.exe
  C:\Windows\System\pxprqcD.exe
  2⤵
  PID:6980
- C:\Windows\System\WnpCszr.exe
  C:\Windows\System\WnpCszr.exe
  2⤵
  PID:6252
- C:\Windows\System\WdPCmkQ.exe
  C:\Windows\System\WdPCmkQ.exe
  2⤵
  PID:5376
- C:\Windows\System\lWBHnWB.exe
  C:\Windows\System\lWBHnWB.exe
  2⤵
  PID:6840
- C:\Windows\System\qsPOfzQ.exe
  C:\Windows\System\qsPOfzQ.exe
  2⤵
  PID:7184
- C:\Windows\System\FWLcjfK.exe
  C:\Windows\System\FWLcjfK.exe
  2⤵
  PID:7200
- C:\Windows\System\fQCfGUQ.exe
  C:\Windows\System\fQCfGUQ.exe
  2⤵
  PID:7216
- C:\Windows\System\WwUsBkg.exe
  C:\Windows\System\WwUsBkg.exe
  2⤵
  PID:7232
- C:\Windows\System\tVUUMPd.exe
  C:\Windows\System\tVUUMPd.exe
  2⤵
  PID:7252
- C:\Windows\System\gPwZxMU.exe
  C:\Windows\System\gPwZxMU.exe
  2⤵
  PID:7268
- C:\Windows\System\XviPKKM.exe
  C:\Windows\System\XviPKKM.exe
  2⤵
  PID:7284
- C:\Windows\System\hlWtTyG.exe
  C:\Windows\System\hlWtTyG.exe
  2⤵
  PID:7300
- C:\Windows\System\APwghVf.exe
  C:\Windows\System\APwghVf.exe
  2⤵
  PID:7320
- C:\Windows\System\nqTmWxV.exe
  C:\Windows\System\nqTmWxV.exe
  2⤵
  PID:7344
- C:\Windows\System\rJZzeWL.exe
  C:\Windows\System\rJZzeWL.exe
  2⤵
  PID:7360
- C:\Windows\System\SyRiSfK.exe
  C:\Windows\System\SyRiSfK.exe
  2⤵
  PID:7380
- C:\Windows\System\BfNWMuQ.exe
  C:\Windows\System\BfNWMuQ.exe
  2⤵
  PID:7396
- C:\Windows\System\cXbjcSe.exe
  C:\Windows\System\cXbjcSe.exe
  2⤵
  PID:7412
- C:\Windows\System\QkMcEaL.exe
  C:\Windows\System\QkMcEaL.exe
  2⤵
  PID:7428
- C:\Windows\System\vNgnzBi.exe
  C:\Windows\System\vNgnzBi.exe
  2⤵
  PID:7444
- C:\Windows\System\rJlGCBI.exe
  C:\Windows\System\rJlGCBI.exe
  2⤵
  PID:7460
- C:\Windows\System\qUKBwnP.exe
  C:\Windows\System\qUKBwnP.exe
  2⤵
  PID:7476
- C:\Windows\System\wrqxAqY.exe
  C:\Windows\System\wrqxAqY.exe
  2⤵
  PID:7492
- C:\Windows\System\Xakadkj.exe
  C:\Windows\System\Xakadkj.exe
  2⤵
  PID:7508
- C:\Windows\System\tNAkVuX.exe
  C:\Windows\System\tNAkVuX.exe
  2⤵
  PID:7524
- C:\Windows\System\oidzfIP.exe
  C:\Windows\System\oidzfIP.exe
  2⤵
  PID:7540
- C:\Windows\System\glyXOrE.exe
  C:\Windows\System\glyXOrE.exe
  2⤵
  PID:7584
- C:\Windows\System\naMHmED.exe
  C:\Windows\System\naMHmED.exe
  2⤵
  PID:7604
- C:\Windows\System\OeLKGtC.exe
  C:\Windows\System\OeLKGtC.exe
  2⤵
  PID:7620
- C:\Windows\System\GfgcvYK.exe
  C:\Windows\System\GfgcvYK.exe
  2⤵
  PID:7636
- C:\Windows\System\VwMIfSX.exe
  C:\Windows\System\VwMIfSX.exe
  2⤵
  PID:7656
- C:\Windows\System\CvkeTNl.exe
  C:\Windows\System\CvkeTNl.exe
  2⤵
  PID:7672
- C:\Windows\System\NyYgqxx.exe
  C:\Windows\System\NyYgqxx.exe
  2⤵
  PID:7688
- C:\Windows\System\Iodonlg.exe
  C:\Windows\System\Iodonlg.exe
  2⤵
  PID:7712
- C:\Windows\System\ZYyXSjh.exe
  C:\Windows\System\ZYyXSjh.exe
  2⤵
  PID:7732
- C:\Windows\System\iQfnyDI.exe
  C:\Windows\System\iQfnyDI.exe
  2⤵
  PID:7748
- C:\Windows\System\fpOveAb.exe
  C:\Windows\System\fpOveAb.exe
  2⤵
  PID:7764
- C:\Windows\System\NPAzvdj.exe
  C:\Windows\System\NPAzvdj.exe
  2⤵
  PID:7780
- C:\Windows\System\ZvbksxB.exe
  C:\Windows\System\ZvbksxB.exe
  2⤵
  PID:7796
- C:\Windows\System\jlHJDSq.exe
  C:\Windows\System\jlHJDSq.exe
  2⤵
  PID:7812
- C:\Windows\System\bNMzsBu.exe
  C:\Windows\System\bNMzsBu.exe
  2⤵
  PID:7828
- C:\Windows\System\VNMohES.exe
  C:\Windows\System\VNMohES.exe
  2⤵
  PID:7844
- C:\Windows\System\sjKJyBk.exe
  C:\Windows\System\sjKJyBk.exe
  2⤵
  PID:7860
- C:\Windows\System\OqjhEYI.exe
  C:\Windows\System\OqjhEYI.exe
  2⤵
  PID:7876
- C:\Windows\System\wWOETkd.exe
  C:\Windows\System\wWOETkd.exe
  2⤵
  PID:7892
- C:\Windows\System\WjtYeGC.exe
  C:\Windows\System\WjtYeGC.exe
  2⤵
  PID:7908
- C:\Windows\System\JFnvcYq.exe
  C:\Windows\System\JFnvcYq.exe
  2⤵
  PID:7924
- C:\Windows\System\yRhJYaM.exe
  C:\Windows\System\yRhJYaM.exe
  2⤵
  PID:7940
- C:\Windows\System\ALTMXHC.exe
  C:\Windows\System\ALTMXHC.exe
  2⤵
  PID:7956
- C:\Windows\System\HnolyRC.exe
  C:\Windows\System\HnolyRC.exe
  2⤵
  PID:7972
- C:\Windows\System\NFvTtOK.exe
  C:\Windows\System\NFvTtOK.exe
  2⤵
  PID:7988
- C:\Windows\System\ESeeFwy.exe
  C:\Windows\System\ESeeFwy.exe
  2⤵
  PID:8004
- C:\Windows\System\kwtUAdJ.exe
  C:\Windows\System\kwtUAdJ.exe
  2⤵
  PID:8020
- C:\Windows\System\gXJvKgf.exe
  C:\Windows\System\gXJvKgf.exe
  2⤵
  PID:8036
- C:\Windows\System\oxqdLwx.exe
  C:\Windows\System\oxqdLwx.exe
  2⤵
  PID:8052
- C:\Windows\System\RnifnOi.exe
  C:\Windows\System\RnifnOi.exe
  2⤵
  PID:8068
- C:\Windows\System\cGQvtsa.exe
  C:\Windows\System\cGQvtsa.exe
  2⤵
  PID:8084
- C:\Windows\System\uOoBoWZ.exe
  C:\Windows\System\uOoBoWZ.exe
  2⤵
  PID:8100
- C:\Windows\System\HJTlIZL.exe
  C:\Windows\System\HJTlIZL.exe
  2⤵
  PID:8116
- C:\Windows\System\ThNBjBn.exe
  C:\Windows\System\ThNBjBn.exe
  2⤵
  PID:8132
- C:\Windows\System\mUpCSNN.exe
  C:\Windows\System\mUpCSNN.exe
  2⤵
  PID:8148
- C:\Windows\System\ibEYZVJ.exe
  C:\Windows\System\ibEYZVJ.exe
  2⤵
  PID:8164
- C:\Windows\System\sDcFITU.exe
  C:\Windows\System\sDcFITU.exe
  2⤵
  PID:8180
- C:\Windows\System\uDKewFH.exe
  C:\Windows\System\uDKewFH.exe
  2⤵
  PID:6708
- C:\Windows\System\GWUUqJi.exe
  C:\Windows\System\GWUUqJi.exe
  2⤵
  PID:7212
- C:\Windows\System\yvrpjhi.exe
  C:\Windows\System\yvrpjhi.exe
  2⤵
  PID:7276
- C:\Windows\System\lcrwFoj.exe
  C:\Windows\System\lcrwFoj.exe
  2⤵
  PID:6692
- C:\Windows\System\rUCCngn.exe
  C:\Windows\System\rUCCngn.exe
  2⤵
  PID:6776
- C:\Windows\System\zEWKuuI.exe
  C:\Windows\System\zEWKuuI.exe
  2⤵
  PID:7228
- C:\Windows\System\oKAUJPh.exe
  C:\Windows\System\oKAUJPh.exe
  2⤵
  PID:6728
- C:\Windows\System\FdbddZC.exe
  C:\Windows\System\FdbddZC.exe
  2⤵
  PID:6564
- C:\Windows\System\iRmTRRv.exe
  C:\Windows\System\iRmTRRv.exe
  2⤵
  PID:7092
- C:\Windows\System\mjfinet.exe
  C:\Windows\System\mjfinet.exe
  2⤵
  PID:5660
- C:\Windows\System\sQBFWub.exe
  C:\Windows\System\sQBFWub.exe
  2⤵
  PID:7224
- C:\Windows\System\npCEScL.exe
  C:\Windows\System\npCEScL.exe
  2⤵
  PID:7328
- C:\Windows\System\DyVmlBX.exe
  C:\Windows\System\DyVmlBX.exe
  2⤵
  PID:7420
- C:\Windows\System\aRkuBst.exe
  C:\Windows\System\aRkuBst.exe
  2⤵
  PID:7456
- C:\Windows\System\bbJDMiz.exe
  C:\Windows\System\bbJDMiz.exe
  2⤵
  PID:7488
- C:\Windows\System\BZKmZAm.exe
  C:\Windows\System\BZKmZAm.exe
  2⤵
  PID:7404
- C:\Windows\System\CIUjdHj.exe
  C:\Windows\System\CIUjdHj.exe
  2⤵
  PID:7500
- C:\Windows\System\nvfvMMJ.exe
  C:\Windows\System\nvfvMMJ.exe
  2⤵
  PID:7720
- C:\Windows\System\TvpczVM.exe
  C:\Windows\System\TvpczVM.exe
  2⤵
  PID:7760
- C:\Windows\System\sykCQeZ.exe
  C:\Windows\System\sykCQeZ.exe
  2⤵
  PID:7744
- C:\Windows\System\qvcGqDt.exe
  C:\Windows\System\qvcGqDt.exe
  2⤵
  PID:7820
- C:\Windows\System\hJwMwsa.exe
  C:\Windows\System\hJwMwsa.exe
  2⤵
  PID:7884
- C:\Windows\System\wwgBnbW.exe
  C:\Windows\System\wwgBnbW.exe
  2⤵
  PID:7804
- C:\Windows\System\ngvgXjY.exe
  C:\Windows\System\ngvgXjY.exe
  2⤵
  PID:7872
- C:\Windows\System\XjIofmm.exe
  C:\Windows\System\XjIofmm.exe
  2⤵
  PID:7936
- C:\Windows\System\hgxUypU.exe
  C:\Windows\System\hgxUypU.exe
  2⤵
  PID:7980
- C:\Windows\System\lHBYYLk.exe
  C:\Windows\System\lHBYYLk.exe
  2⤵
  PID:8000
- C:\Windows\System\bbjpzBG.exe
  C:\Windows\System\bbjpzBG.exe
  2⤵
  PID:8048
- C:\Windows\System\KAzdkYe.exe
  C:\Windows\System\KAzdkYe.exe
  2⤵
  PID:8064
- C:\Windows\System\tERMNcZ.exe
  C:\Windows\System\tERMNcZ.exe
  2⤵
  PID:8144
- C:\Windows\System\vUTOVAy.exe
  C:\Windows\System\vUTOVAy.exe
  2⤵
  PID:8092
- C:\Windows\System\yRBdrmJ.exe
  C:\Windows\System\yRBdrmJ.exe
  2⤵
  PID:8156
- C:\Windows\System\jiFGGvD.exe
  C:\Windows\System\jiFGGvD.exe
  2⤵
  PID:7248
- C:\Windows\System\OpvZDES.exe
  C:\Windows\System\OpvZDES.exe
  2⤵
  PID:7292
- C:\Windows\System\QHbKlQY.exe
  C:\Windows\System\QHbKlQY.exe
  2⤵
  PID:7312
- C:\Windows\System\JegXcMP.exe
  C:\Windows\System\JegXcMP.exe
  2⤵
  PID:7356
- C:\Windows\System\fPzUdiy.exe
  C:\Windows\System\fPzUdiy.exe
  2⤵
  PID:7632
- C:\Windows\System\lkLcCWI.exe
  C:\Windows\System\lkLcCWI.exe
  2⤵
  PID:6904
- C:\Windows\System\UEhGVPw.exe
  C:\Windows\System\UEhGVPw.exe
  2⤵
  PID:7580
- C:\Windows\System\ICaOdlV.exe
  C:\Windows\System\ICaOdlV.exe
  2⤵
  PID:7708
- C:\Windows\System\xIHvVPP.exe
  C:\Windows\System\xIHvVPP.exe
  2⤵
  PID:7696
- C:\Windows\System\hKtrhwW.exe
  C:\Windows\System\hKtrhwW.exe
  2⤵
  PID:7756
- C:\Windows\System\NgqggVL.exe
  C:\Windows\System\NgqggVL.exe
  2⤵
  PID:7740
- C:\Windows\System\UahbPBY.exe
  C:\Windows\System\UahbPBY.exe
  2⤵
  PID:7920
- C:\Windows\System\oCjGIOD.exe
  C:\Windows\System\oCjGIOD.exe
  2⤵
  PID:7856
- C:\Windows\System\FROBypX.exe
  C:\Windows\System\FROBypX.exe
  2⤵
  PID:7836
- C:\Windows\System\gQuoiyM.exe
  C:\Windows\System\gQuoiyM.exe
  2⤵
  PID:8140
- C:\Windows\System\KdAqyQE.exe
  C:\Windows\System\KdAqyQE.exe
  2⤵
  PID:6760
- C:\Windows\System\JYwrUYq.exe
  C:\Windows\System\JYwrUYq.exe
  2⤵
  PID:8060
- C:\Windows\System\yHNgffl.exe
  C:\Windows\System\yHNgffl.exe
  2⤵
  PID:7208
- C:\Windows\System\EMiFleo.exe
  C:\Windows\System\EMiFleo.exe
  2⤵
  PID:7196
- C:\Windows\System\LWKGMWL.exe
  C:\Windows\System\LWKGMWL.exe
  2⤵
  PID:7520
- C:\Windows\System\dklsTjZ.exe
  C:\Windows\System\dklsTjZ.exe
  2⤵
  PID:7316
- C:\Windows\System\XDtTIXE.exe
  C:\Windows\System\XDtTIXE.exe
  2⤵
  PID:7548
- C:\Windows\System\lTTzxyf.exe
  C:\Windows\System\lTTzxyf.exe
  2⤵
  PID:7468
- C:\Windows\System\IIEtUpr.exe
  C:\Windows\System\IIEtUpr.exe
  2⤵
  PID:7568
- C:\Windows\System\LAMDAgE.exe
  C:\Windows\System\LAMDAgE.exe
  2⤵
  PID:7612
- C:\Windows\System\ZEjJAMy.exe
  C:\Windows\System\ZEjJAMy.exe
  2⤵
  PID:7592
- C:\Windows\System\oehLnzE.exe
  C:\Windows\System\oehLnzE.exe
  2⤵
  PID:7792
- C:\Windows\System\iYAgWaH.exe
  C:\Windows\System\iYAgWaH.exe
  2⤵
  PID:7644
- C:\Windows\System\vMhbWZB.exe
  C:\Windows\System\vMhbWZB.exe
  2⤵
  PID:7868
- C:\Windows\System\QqrbEOo.exe
  C:\Windows\System\QqrbEOo.exe
  2⤵
  PID:8012
- C:\Windows\System\NuBQtNB.exe
  C:\Windows\System\NuBQtNB.exe
  2⤵
  PID:8176
- C:\Windows\System\PBBVgMm.exe
  C:\Windows\System\PBBVgMm.exe
  2⤵
  PID:7340
- C:\Windows\System\WwEqAFa.exe
  C:\Windows\System\WwEqAFa.exe
  2⤵
  PID:7564
- C:\Windows\System\Pjnhcek.exe
  C:\Windows\System\Pjnhcek.exe
  2⤵
  PID:7916
- C:\Windows\System\oSLuRNl.exe
  C:\Windows\System\oSLuRNl.exe
  2⤵
  PID:8208
- C:\Windows\System\XdcNOdU.exe
  C:\Windows\System\XdcNOdU.exe
  2⤵
  PID:8224
- C:\Windows\System\zXReeYB.exe
  C:\Windows\System\zXReeYB.exe
  2⤵
  PID:8240
- C:\Windows\System\JxAQbYM.exe
  C:\Windows\System\JxAQbYM.exe
  2⤵
  PID:8256
- C:\Windows\System\LggjYMj.exe
  C:\Windows\System\LggjYMj.exe
  2⤵
  PID:8272
- C:\Windows\System\rbjIMVk.exe
  C:\Windows\System\rbjIMVk.exe
  2⤵
  PID:8288
- C:\Windows\System\ScUPfWf.exe
  C:\Windows\System\ScUPfWf.exe
  2⤵
  PID:8304
- C:\Windows\System\hfSfrNQ.exe
  C:\Windows\System\hfSfrNQ.exe
  2⤵
  PID:8320
- C:\Windows\System\pdDaWKi.exe
  C:\Windows\System\pdDaWKi.exe
  2⤵
  PID:8336
- C:\Windows\System\jSNdPyo.exe
  C:\Windows\System\jSNdPyo.exe
  2⤵
  PID:8352
- C:\Windows\System\xMPIGPc.exe
  C:\Windows\System\xMPIGPc.exe
  2⤵
  PID:8448
- C:\Windows\System\ilbhkSr.exe
  C:\Windows\System\ilbhkSr.exe
  2⤵
  PID:8464
- C:\Windows\System\PPgNWHs.exe
  C:\Windows\System\PPgNWHs.exe
  2⤵
  PID:8480
- C:\Windows\System\EyxXfAV.exe
  C:\Windows\System\EyxXfAV.exe
  2⤵
  PID:8500
- C:\Windows\System\xsOsFPN.exe
  C:\Windows\System\xsOsFPN.exe
  2⤵
  PID:8520
- C:\Windows\System\FhVSFTx.exe
  C:\Windows\System\FhVSFTx.exe
  2⤵
  PID:8536
- C:\Windows\System\LQODijS.exe
  C:\Windows\System\LQODijS.exe
  2⤵
  PID:8552
- C:\Windows\System\UCMjZWx.exe
  C:\Windows\System\UCMjZWx.exe
  2⤵
  PID:8568
- C:\Windows\System\CBODoHA.exe
  C:\Windows\System\CBODoHA.exe
  2⤵
  PID:8584
- C:\Windows\System\QDdrmiM.exe
  C:\Windows\System\QDdrmiM.exe
  2⤵
  PID:8600
- C:\Windows\System\xGSxXYH.exe
  C:\Windows\System\xGSxXYH.exe
  2⤵
  PID:8616
- C:\Windows\System\HpmlxXB.exe
  C:\Windows\System\HpmlxXB.exe
  2⤵
  PID:8632
- C:\Windows\System\vPkhfEL.exe
  C:\Windows\System\vPkhfEL.exe
  2⤵
  PID:8648
- C:\Windows\System\Edufsek.exe
  C:\Windows\System\Edufsek.exe
  2⤵
  PID:8664
- C:\Windows\System\MwUOdol.exe
  C:\Windows\System\MwUOdol.exe
  2⤵
  PID:8680
- C:\Windows\System\RnzvqnL.exe
  C:\Windows\System\RnzvqnL.exe
  2⤵
  PID:8696
- C:\Windows\System\KyDIxHS.exe
  C:\Windows\System\KyDIxHS.exe
  2⤵
  PID:8712
- C:\Windows\System\xbaEaWo.exe
  C:\Windows\System\xbaEaWo.exe
  2⤵
  PID:8728
- C:\Windows\System\MvhMYAV.exe
  C:\Windows\System\MvhMYAV.exe
  2⤵
  PID:8744
- C:\Windows\System\rDFMSMX.exe
  C:\Windows\System\rDFMSMX.exe
  2⤵
  PID:8760
- C:\Windows\System\rAbeOKc.exe
  C:\Windows\System\rAbeOKc.exe
  2⤵
  PID:8776
- C:\Windows\System\uzqRCfF.exe
  C:\Windows\System\uzqRCfF.exe
  2⤵
  PID:8792
- C:\Windows\System\QrKBXRT.exe
  C:\Windows\System\QrKBXRT.exe
  2⤵
  PID:8808
- C:\Windows\System\pjiqjNP.exe
  C:\Windows\System\pjiqjNP.exe
  2⤵
  PID:8824
- C:\Windows\System\FypTMAs.exe
  C:\Windows\System\FypTMAs.exe
  2⤵
  PID:8840
- C:\Windows\System\XflDBnm.exe
  C:\Windows\System\XflDBnm.exe
  2⤵
  PID:8856
- C:\Windows\System\CkOlFKC.exe
  C:\Windows\System\CkOlFKC.exe
  2⤵
  PID:8872
- C:\Windows\System\TqbqxsB.exe
  C:\Windows\System\TqbqxsB.exe
  2⤵
  PID:8888
- C:\Windows\System\errUecf.exe
  C:\Windows\System\errUecf.exe
  2⤵
  PID:8904
- C:\Windows\System\KWeygQY.exe
  C:\Windows\System\KWeygQY.exe
  2⤵
  PID:8920
- C:\Windows\System\XwCGaZg.exe
  C:\Windows\System\XwCGaZg.exe
  2⤵
  PID:8936
- C:\Windows\System\bQoDIOm.exe
  C:\Windows\System\bQoDIOm.exe
  2⤵
  PID:8952
- C:\Windows\System\DKNJuEb.exe
  C:\Windows\System\DKNJuEb.exe
  2⤵
  PID:8968
- C:\Windows\System\wVTfRJt.exe
  C:\Windows\System\wVTfRJt.exe
  2⤵
  PID:8984
- C:\Windows\System\sLDvEQb.exe
  C:\Windows\System\sLDvEQb.exe
  2⤵
  PID:9000
- C:\Windows\System\YGudotf.exe
  C:\Windows\System\YGudotf.exe
  2⤵
  PID:9040
- C:\Windows\System\gJvzdLN.exe
  C:\Windows\System\gJvzdLN.exe
  2⤵
  PID:9056
- C:\Windows\System\LzzzFdB.exe
  C:\Windows\System\LzzzFdB.exe
  2⤵
  PID:9072
- C:\Windows\System\LdqmvpG.exe
  C:\Windows\System\LdqmvpG.exe
  2⤵
  PID:9088
- C:\Windows\System\glkdzKq.exe
  C:\Windows\System\glkdzKq.exe
  2⤵
  PID:9104
- C:\Windows\System\YmyLcEg.exe
  C:\Windows\System\YmyLcEg.exe
  2⤵
  PID:9120
- C:\Windows\System\WKzMrFI.exe
  C:\Windows\System\WKzMrFI.exe
  2⤵
  PID:9136
- C:\Windows\System\yKlGKth.exe
  C:\Windows\System\yKlGKth.exe
  2⤵
  PID:9152
- C:\Windows\System\BQFHXsF.exe
  C:\Windows\System\BQFHXsF.exe
  2⤵
  PID:9168
- C:\Windows\System\bXmuOeY.exe
  C:\Windows\System\bXmuOeY.exe
  2⤵
  PID:9184
- C:\Windows\System\mhCOZAx.exe
  C:\Windows\System\mhCOZAx.exe
  2⤵
  PID:9200
- C:\Windows\System\fyBOtDj.exe
  C:\Windows\System\fyBOtDj.exe
  2⤵
  PID:7376
- C:\Windows\System\UegxpSQ.exe
  C:\Windows\System\UegxpSQ.exe
  2⤵
  PID:8124
- C:\Windows\System\DJGwJTa.exe
  C:\Windows\System\DJGwJTa.exe
  2⤵
  PID:7560
- C:\Windows\System\KxPJOxH.exe
  C:\Windows\System\KxPJOxH.exe
  2⤵
  PID:7808
- C:\Windows\System\IRZzLJD.exe
  C:\Windows\System\IRZzLJD.exe
  2⤵
  PID:7600
- C:\Windows\System\PjvrGXI.exe
  C:\Windows\System\PjvrGXI.exe
  2⤵
  PID:7452
- C:\Windows\System\NfqKsaf.exe
  C:\Windows\System\NfqKsaf.exe
  2⤵
  PID:6772
- C:\Windows\System\fOqVfDV.exe
  C:\Windows\System\fOqVfDV.exe
  2⤵
  PID:8236
- C:\Windows\System\fzOkSQM.exe
  C:\Windows\System\fzOkSQM.exe
  2⤵
  PID:8216
- C:\Windows\System\npQajPY.exe
  C:\Windows\System\npQajPY.exe
  2⤵
  PID:8296
- C:\Windows\System\LqWAMbL.exe
  C:\Windows\System\LqWAMbL.exe
  2⤵
  PID:8312
- C:\Windows\System\APvoowg.exe
  C:\Windows\System\APvoowg.exe
  2⤵
  PID:8344
- C:\Windows\System\QhhZEFS.exe
  C:\Windows\System\QhhZEFS.exe
  2⤵
  PID:8372
- C:\Windows\System\sNtJNPq.exe
  C:\Windows\System\sNtJNPq.exe
  2⤵
  PID:8388
- C:\Windows\System\USzmVDu.exe
  C:\Windows\System\USzmVDu.exe
  2⤵
  PID:8408
- C:\Windows\System\jShMkFm.exe
  C:\Windows\System\jShMkFm.exe
  2⤵
  PID:8424
- C:\Windows\System\AwooeZt.exe
  C:\Windows\System\AwooeZt.exe
  2⤵
  PID:8444
- C:\Windows\System\hVAiWNP.exe
  C:\Windows\System\hVAiWNP.exe
  2⤵
  PID:8508
- C:\Windows\System\FziIqAm.exe
  C:\Windows\System\FziIqAm.exe
  2⤵
  PID:8488
- C:\Windows\System\HtTqaTd.exe
  C:\Windows\System\HtTqaTd.exe
  2⤵
  PID:8548
- C:\Windows\System\ZCHqWFu.exe
  C:\Windows\System\ZCHqWFu.exe
  2⤵
  PID:8492
- C:\Windows\System\tTmxkrA.exe
  C:\Windows\System\tTmxkrA.exe
  2⤵
  PID:8644
- C:\Windows\System\vrZFDUq.exe
  C:\Windows\System\vrZFDUq.exe
  2⤵
  PID:8768
- C:\Windows\System\FaLGPTy.exe
  C:\Windows\System\FaLGPTy.exe
  2⤵
  PID:8736
- C:\Windows\System\AWlHnnk.exe
  C:\Windows\System\AWlHnnk.exe
  2⤵
  PID:8800
- C:\Windows\System\CQNMfLP.exe
  C:\Windows\System\CQNMfLP.exe
  2⤵
  PID:8596
- C:\Windows\System\jHlFlSr.exe
  C:\Windows\System\jHlFlSr.exe
  2⤵
  PID:8656
- C:\Windows\System\NtUlOjq.exe
  C:\Windows\System\NtUlOjq.exe
  2⤵
  PID:8868
- C:\Windows\System\ZqoMxee.exe
  C:\Windows\System\ZqoMxee.exe
  2⤵
  PID:8724
- C:\Windows\System\dEIjiuZ.exe
  C:\Windows\System\dEIjiuZ.exe
  2⤵
  PID:8784
- C:\Windows\System\FxUeEzO.exe
  C:\Windows\System\FxUeEzO.exe
  2⤵
  PID:8976
- C:\Windows\System\yVHqbja.exe
  C:\Windows\System\yVHqbja.exe
  2⤵
  PID:8816
- C:\Windows\System\XPEaonu.exe
  C:\Windows\System\XPEaonu.exe
  2⤵
  PID:8964
- C:\Windows\System\CRHNazG.exe
  C:\Windows\System\CRHNazG.exe
  2⤵
  PID:8884
- C:\Windows\System\fZiVxYB.exe
  C:\Windows\System\fZiVxYB.exe
  2⤵
  PID:8944
- C:\Windows\System\qyFZLjD.exe
  C:\Windows\System\qyFZLjD.exe
  2⤵
  PID:9024
- C:\Windows\System\kYMxYxW.exe
  C:\Windows\System\kYMxYxW.exe
  2⤵
  PID:9112
- C:\Windows\System\KZXxwJd.exe
  C:\Windows\System\KZXxwJd.exe
  2⤵
  PID:9180
- C:\Windows\System\Swhauly.exe
  C:\Windows\System\Swhauly.exe
  2⤵
  PID:9208
- C:\Windows\System\NvuaNqm.exe
  C:\Windows\System\NvuaNqm.exe
  2⤵
  PID:9064
- C:\Windows\System\aszqLZC.exe
  C:\Windows\System\aszqLZC.exe
  2⤵
  PID:9100
- C:\Windows\System\zCNdLvq.exe
  C:\Windows\System\zCNdLvq.exe
  2⤵
  PID:7700
- C:\Windows\System\FVlIZNy.exe
  C:\Windows\System\FVlIZNy.exe
  2⤵
  PID:8316
- C:\Windows\System\SHqYgek.exe
  C:\Windows\System\SHqYgek.exe
  2⤵
  PID:8400
- C:\Windows\System\nqnrlaa.exe
  C:\Windows\System\nqnrlaa.exe
  2⤵
  PID:9196
- C:\Windows\System\gvicIpZ.exe
  C:\Windows\System\gvicIpZ.exe
  2⤵
  PID:9212
- C:\Windows\System\iArlbWp.exe
  C:\Windows\System\iArlbWp.exe
  2⤵
  PID:8384
- C:\Windows\System\KxUNjsU.exe
  C:\Windows\System\KxUNjsU.exe
  2⤵
  PID:8516
- C:\Windows\System\GUExnnR.exe
  C:\Windows\System\GUExnnR.exe
  2⤵
  PID:8704
- C:\Windows\System\hsQgALP.exe
  C:\Windows\System\hsQgALP.exe
  2⤵
  PID:8512
- C:\Windows\System\jbpqIQq.exe
  C:\Windows\System\jbpqIQq.exe
  2⤵
  PID:8980
- C:\Windows\System\jxrjiPr.exe
  C:\Windows\System\jxrjiPr.exe
  2⤵
  PID:8960
- C:\Windows\System\QlwayOZ.exe
  C:\Windows\System\QlwayOZ.exe
  2⤵
  PID:8916
- C:\Windows\System\rTGuRWD.exe
  C:\Windows\System\rTGuRWD.exe
  2⤵
  PID:8628
- C:\Windows\System\qROwruX.exe
  C:\Windows\System\qROwruX.exe
  2⤵
  PID:8592
- C:\Windows\System\LRpOAXc.exe
  C:\Windows\System\LRpOAXc.exe
  2⤵
  PID:8932
- C:\Windows\System\PbwGkyZ.exe
  C:\Windows\System\PbwGkyZ.exe
  2⤵
  PID:8476
- C:\Windows\System\kTPkXcj.exe
  C:\Windows\System\kTPkXcj.exe
  2⤵
  PID:8864
- C:\Windows\System\PlNAlUg.exe
  C:\Windows\System\PlNAlUg.exe
  2⤵
  PID:8612
- C:\Windows\System\XKveJNM.exe
  C:\Windows\System\XKveJNM.exe
  2⤵
  PID:9148
- C:\Windows\System\eEHOEBp.exe
  C:\Windows\System\eEHOEBp.exe
  2⤵
  PID:8832
- C:\Windows\System\vhreCKU.exe
  C:\Windows\System\vhreCKU.exe
  2⤵
  PID:9008
- C:\Windows\System\TtlpiZS.exe
  C:\Windows\System\TtlpiZS.exe
  2⤵
  PID:9096
- C:\Windows\System\OcBLHti.exe
  C:\Windows\System\OcBLHti.exe
  2⤵
  PID:7308
- C:\Windows\System\gvafKeK.exe
  C:\Windows\System\gvafKeK.exe
  2⤵
  PID:9192
- C:\Windows\System\NCALlQQ.exe
  C:\Windows\System\NCALlQQ.exe
  2⤵
  PID:8368
- C:\Windows\System\wyGyKnX.exe
  C:\Windows\System\wyGyKnX.exe
  2⤵
  PID:8300
- C:\Windows\System\SxxtGfr.exe
  C:\Windows\System\SxxtGfr.exe
  2⤵
  PID:8472
- C:\Windows\System\hxaGZOn.exe
  C:\Windows\System\hxaGZOn.exe
  2⤵
  PID:8912
- C:\Windows\System\AtwPLFe.exe
  C:\Windows\System\AtwPLFe.exe
  2⤵
  PID:8640
- C:\Windows\System\wdYdRvX.exe
  C:\Windows\System\wdYdRvX.exe
  2⤵
  PID:8460
- C:\Windows\System\Kcaajxz.exe
  C:\Windows\System\Kcaajxz.exe
  2⤵
  PID:9052
- C:\Windows\System\DMmQqdo.exe
  C:\Windows\System\DMmQqdo.exe
  2⤵
  PID:8364
- C:\Windows\System\HwVuOdR.exe
  C:\Windows\System\HwVuOdR.exe
  2⤵
  PID:8392
- C:\Windows\System\ZyWThNd.exe
  C:\Windows\System\ZyWThNd.exe
  2⤵
  PID:8676
- C:\Windows\System\UhpCsPY.exe
  C:\Windows\System\UhpCsPY.exe
  2⤵
  PID:8360
- C:\Windows\System\FMfvJrL.exe
  C:\Windows\System\FMfvJrL.exe
  2⤵
  PID:7952
- C:\Windows\System\ZsxYKnx.exe
  C:\Windows\System\ZsxYKnx.exe
  2⤵
  PID:7436
- C:\Windows\System\SuVQBqT.exe
  C:\Windows\System\SuVQBqT.exe
  2⤵
  PID:7664
- C:\Windows\System\hopxqdN.exe
  C:\Windows\System\hopxqdN.exe
  2⤵
  PID:9016
- C:\Windows\System\TGXdRSI.exe
  C:\Windows\System\TGXdRSI.exe
  2⤵
  PID:9236
- C:\Windows\System\TiHOZtZ.exe
  C:\Windows\System\TiHOZtZ.exe
  2⤵
  PID:9252
- C:\Windows\System\VfjlNzH.exe
  C:\Windows\System\VfjlNzH.exe
  2⤵
  PID:9268
- C:\Windows\System\phKsfrj.exe
  C:\Windows\System\phKsfrj.exe
  2⤵
  PID:9284
- C:\Windows\System\CMhXbXb.exe
  C:\Windows\System\CMhXbXb.exe
  2⤵
  PID:9300
- C:\Windows\System\vgaRFxT.exe
  C:\Windows\System\vgaRFxT.exe
  2⤵
  PID:9316
- C:\Windows\System\QcgFRWB.exe
  C:\Windows\System\QcgFRWB.exe
  2⤵
  PID:9336
- C:\Windows\System\pdatbjO.exe
  C:\Windows\System\pdatbjO.exe
  2⤵
  PID:9352
- C:\Windows\System\zICGEGb.exe
  C:\Windows\System\zICGEGb.exe
  2⤵
  PID:9368
- C:\Windows\System\wtipeQD.exe
  C:\Windows\System\wtipeQD.exe
  2⤵
  PID:9384
- C:\Windows\System\tvvRVru.exe
  C:\Windows\System\tvvRVru.exe
  2⤵
  PID:9404
- C:\Windows\System\ePBgGvo.exe
  C:\Windows\System\ePBgGvo.exe
  2⤵
  PID:9420
- C:\Windows\System\VhqzfoD.exe
  C:\Windows\System\VhqzfoD.exe
  2⤵
  PID:9436
- C:\Windows\System\fLnbvMl.exe
  C:\Windows\System\fLnbvMl.exe
  2⤵
  PID:9456
- C:\Windows\System\umwSOaT.exe
  C:\Windows\System\umwSOaT.exe
  2⤵
  PID:9472
- C:\Windows\System\MfhVskx.exe
  C:\Windows\System\MfhVskx.exe
  2⤵
  PID:9492
- C:\Windows\System\kuLgCVL.exe
  C:\Windows\System\kuLgCVL.exe
  2⤵
  PID:9508
- C:\Windows\System\LfTWDXP.exe
  C:\Windows\System\LfTWDXP.exe
  2⤵
  PID:9524
- C:\Windows\System\MlvwAgt.exe
  C:\Windows\System\MlvwAgt.exe
  2⤵
  PID:9540
- C:\Windows\System\FOXgbCW.exe
  C:\Windows\System\FOXgbCW.exe
  2⤵
  PID:9556
- C:\Windows\System\bEneGiR.exe
  C:\Windows\System\bEneGiR.exe
  2⤵
  PID:9572
- C:\Windows\System\SAXYBUD.exe
  C:\Windows\System\SAXYBUD.exe
  2⤵
  PID:9588
- C:\Windows\System\MTHRowG.exe
  C:\Windows\System\MTHRowG.exe
  2⤵
  PID:9604
- C:\Windows\System\EqlKKDa.exe
  C:\Windows\System\EqlKKDa.exe
  2⤵
  PID:9620
- C:\Windows\System\YhbBDYR.exe
  C:\Windows\System\YhbBDYR.exe
  2⤵
  PID:9636
- C:\Windows\System\pwMjAWy.exe
  C:\Windows\System\pwMjAWy.exe
  2⤵
  PID:9652
- C:\Windows\System\xaEmusR.exe
  C:\Windows\System\xaEmusR.exe
  2⤵
  PID:9668
- C:\Windows\System\nstKRRC.exe
  C:\Windows\System\nstKRRC.exe
  2⤵
  PID:9684
- C:\Windows\System\zLYlPqR.exe
  C:\Windows\System\zLYlPqR.exe
  2⤵
  PID:9700
- C:\Windows\System\iMjMmZS.exe
  C:\Windows\System\iMjMmZS.exe
  2⤵
  PID:9716
- C:\Windows\System\hIURZpB.exe
  C:\Windows\System\hIURZpB.exe
  2⤵
  PID:9772
- C:\Windows\System\tWtIAFf.exe
  C:\Windows\System\tWtIAFf.exe
  2⤵
  PID:9788
- C:\Windows\System\OukirIm.exe
  C:\Windows\System\OukirIm.exe
  2⤵
  PID:9804
- C:\Windows\System\WPvkgdF.exe
  C:\Windows\System\WPvkgdF.exe
  2⤵
  PID:9820
- C:\Windows\System\gdoIxiK.exe
  C:\Windows\System\gdoIxiK.exe
  2⤵
  PID:9836
- C:\Windows\System\Uulgbrd.exe
  C:\Windows\System\Uulgbrd.exe
  2⤵
  PID:9852
- C:\Windows\System\POYhyss.exe
  C:\Windows\System\POYhyss.exe
  2⤵
  PID:9868
- C:\Windows\System\jltNgtO.exe
  C:\Windows\System\jltNgtO.exe
  2⤵
  PID:9884
- C:\Windows\System\jAtomaj.exe
  C:\Windows\System\jAtomaj.exe
  2⤵
  PID:9900
- C:\Windows\System\qKwZwtd.exe
  C:\Windows\System\qKwZwtd.exe
  2⤵
  PID:9928
- C:\Windows\System\cBwTMjT.exe
  C:\Windows\System\cBwTMjT.exe
  2⤵
  PID:9944
- C:\Windows\System\DIxqBdK.exe
  C:\Windows\System\DIxqBdK.exe
  2⤵
  PID:9960
- C:\Windows\System\wgNDATD.exe
  C:\Windows\System\wgNDATD.exe
  2⤵
  PID:9976
- C:\Windows\System\BLtKKIt.exe
  C:\Windows\System\BLtKKIt.exe
  2⤵
  PID:9992
- C:\Windows\System\dltAbSX.exe
  C:\Windows\System\dltAbSX.exe
  2⤵
  PID:10008
- C:\Windows\System\SqkrILK.exe
  C:\Windows\System\SqkrILK.exe
  2⤵
  PID:10024
- C:\Windows\System\uJHDmJm.exe
  C:\Windows\System\uJHDmJm.exe
  2⤵
  PID:10040
- C:\Windows\System\RyBoiDx.exe
  C:\Windows\System\RyBoiDx.exe
  2⤵
  PID:10056
- C:\Windows\System\tIydSEJ.exe
  C:\Windows\System\tIydSEJ.exe
  2⤵
  PID:10072
- C:\Windows\System\woVQXSa.exe
  C:\Windows\System\woVQXSa.exe
  2⤵
  PID:10088
- C:\Windows\System\PcEpXLF.exe
  C:\Windows\System\PcEpXLF.exe
  2⤵
  PID:10104
- C:\Windows\System\TRpHRfy.exe
  C:\Windows\System\TRpHRfy.exe
  2⤵
  PID:10120
- C:\Windows\System\SJXwlAl.exe
  C:\Windows\System\SJXwlAl.exe
  2⤵
  PID:10136
- C:\Windows\System\PIjEQmA.exe
  C:\Windows\System\PIjEQmA.exe
  2⤵
  PID:10152
- C:\Windows\System\qFqskpw.exe
  C:\Windows\System\qFqskpw.exe
  2⤵
  PID:10168
- C:\Windows\System\IgRVZEP.exe
  C:\Windows\System\IgRVZEP.exe
  2⤵
  PID:10184
- C:\Windows\System\ZdpBRFv.exe
  C:\Windows\System\ZdpBRFv.exe
  2⤵
  PID:10200
- C:\Windows\System\OtWbCMd.exe
  C:\Windows\System\OtWbCMd.exe
  2⤵
  PID:10216
- C:\Windows\System\gPXoVVU.exe
  C:\Windows\System\gPXoVVU.exe
  2⤵
  PID:10232
- C:\Windows\System\lkhxXIY.exe
  C:\Windows\System\lkhxXIY.exe
  2⤵
  PID:8564
- C:\Windows\System\RGQhAWT.exe
  C:\Windows\System\RGQhAWT.exe
  2⤵
  PID:8248
- C:\Windows\System\HHrkBDz.exe
  C:\Windows\System\HHrkBDz.exe
  2⤵
  PID:9276
- C:\Windows\System\fZTCiMq.exe
  C:\Windows\System\fZTCiMq.exe
  2⤵
  PID:9344
- C:\Windows\System\adcmtyi.exe
  C:\Windows\System\adcmtyi.exe
  2⤵
  PID:9248
- C:\Windows\System\AGpbynX.exe
  C:\Windows\System\AGpbynX.exe
  2⤵
  PID:9444
- C:\Windows\System\IvvOCBc.exe
  C:\Windows\System\IvvOCBc.exe
  2⤵
  PID:9292
- C:\Windows\System\zDfsQZl.exe
  C:\Windows\System\zDfsQZl.exe
  2⤵
  PID:9400
- C:\Windows\System\caXNfBS.exe
  C:\Windows\System\caXNfBS.exe
  2⤵
  PID:9516
- C:\Windows\System\Gkpfyah.exe
  C:\Windows\System\Gkpfyah.exe
  2⤵
  PID:9364
- C:\Windows\System\lHLDkay.exe
  C:\Windows\System\lHLDkay.exe
  2⤵
  PID:9500
- C:\Windows\System\hJERpEa.exe
  C:\Windows\System\hJERpEa.exe
  2⤵
  PID:9552
- C:\Windows\System\ADcfroQ.exe
  C:\Windows\System\ADcfroQ.exe
  2⤵
  PID:9616
- C:\Windows\System\mneisQd.exe
  C:\Windows\System\mneisQd.exe
  2⤵
  PID:9644
- C:\Windows\System\tBSlGjp.exe
  C:\Windows\System\tBSlGjp.exe
  2⤵
  PID:9676
- C:\Windows\System\YazaETm.exe
  C:\Windows\System\YazaETm.exe
  2⤵
  PID:9664
- C:\Windows\System\oOIABdu.exe
  C:\Windows\System\oOIABdu.exe
  2⤵
  PID:9708
- C:\Windows\System\zDdyDHm.exe
  C:\Windows\System\zDdyDHm.exe
  2⤵
  PID:9736
- C:\Windows\System\nqVRiIG.exe
  C:\Windows\System\nqVRiIG.exe
  2⤵
  PID:9752
- C:\Windows\System\DyZqJmf.exe
  C:\Windows\System\DyZqJmf.exe
  2⤵
  PID:9768
- C:\Windows\System\UYejBHz.exe
  C:\Windows\System\UYejBHz.exe
  2⤵
  PID:9812
- C:\Windows\System\yVwHIWM.exe
  C:\Windows\System\yVwHIWM.exe
  2⤵
  PID:9848
- C:\Windows\System\iLYjNju.exe
  C:\Windows\System\iLYjNju.exe
  2⤵
  PID:9864
- C:\Windows\System\gdmBKrY.exe
  C:\Windows\System\gdmBKrY.exe
  2⤵
  PID:9916

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\ALRHjCP.exe

Filesize
1.8MB

MD5
e879ebd4f988db5350455bb533f21db6

SHA1
cfedf9a8ca5be8de21d39143a327b82444ee6d43

SHA256
d09514d5a0230932b52c2b4605ac41c657dd7a294d733295bde4bde7efb31026

SHA512
32997c6fd1bcdf1b643a0b5e9ba05b1eabea99b349f037b305c85939282c46b0530e3231e2715c447f27bc15cc85b88b8d23da2d1501508d00ae88bc4e22f113

Download Submit
C:\Windows\system\BzggdJV.exe

Filesize
1.8MB

MD5
6e7ab9a180760443e96bab9e4479aa05

SHA1
c22407c8ec820e8750b3f18f0f2fefd8b07be121

SHA256
b74a78bfce896682a0970429f7ed2a695f04af48c934d646d3bcdc55c75afbce

SHA512
0502f5bf03858022ce2537b75ca4844c9a6753eae6672863a76cf452c2cd0778392e3eb44d4844b3a4937c51c8cdd82643e85eab861acb51fe96356c4b88b866

Download Submit
C:\Windows\system\DdesnKm.exe

Filesize
1.8MB

MD5
5fba138e48bdfe87d1625d711e01c616

SHA1
9a85528a4b291cb00bcf6df5798f98dce54b9110

SHA256
6e6acd5a457d4ccfee67354ce498b0520a2d7633da444f9045d2359ede3f316c

SHA512
43d27a4d14bd54b49976dff111271b2464c25240b97bcfb1aba2d3898ba4a0a0a37a3163fe1cfcb0e847e2a03f2f7cff62c771fe1db83cd4653e42d7a3df66c2

Download Submit
C:\Windows\system\KAqJjcC.exe

Filesize
1.8MB

MD5
8189b3a55b71f77ec4906fa1832b4abb

SHA1
696cd42a431304ca6380efee0fbe4927d27db1c5

SHA256
2ed1447e745271d7f4014228561e1ad598f27c513cb30032cb6bb7ddc080cf47

SHA512
6645b9de5caaac940578ca499bf016fe9a015bce7cce8b1da583c64ed3a627225e4c0a87732f9007e796f7c21d297b5715cbce48be7eca400597b7f24141d6bf

Download Submit
C:\Windows\system\LNSeriV.exe

Filesize
1.8MB

MD5
361a15ebec200e811e504bf309784237

SHA1
3e61b758e1488088b31b2db81a44654b1b18b4cc

SHA256
599afa38d48ad43c4e7f115125d19e46a9fc3c2ee2053369f2088f80f9bcbd2c

SHA512
cfe472f018f38802b23eebd9d6e1221c5ae11488a0e212946ee891f97f7c18182456520ce3a10ffc7c3f0f4a5ca922e7309b1beb50724ccb79d603d4ae309f2a

Download Submit
C:\Windows\system\MwFqqCs.exe

Filesize
1.8MB

MD5
7f00acfb7c6d29d2984eea46c0ca3e9a

SHA1
84b69625210e047b558904f54b3ecf3aa7e6d7d4

SHA256
0744fca59c3691b473bee22763075f1f0a01a1d4935c3f3af5e91fd3558f48f0

SHA512
93aa577787fe4d817df2d2160df4bffcd1ed4d06d82648bd84c32f8f9ea23f8e0d24cbd0596a6f4f2cee33d4fafae0a86f61a36b4e7dc4eca0a6faa8321df702

Download Submit
C:\Windows\system\NkuZvgP.exe

Filesize
1.8MB

MD5
4e4dabfbaeec51f90b571236c5e97eda

SHA1
14f55e0c954272634f0b3c8467f4962bdde2b569

SHA256
8fa65408ae963fe9b80232e0814837bcfd00ce9ec6cb8ca7d03d55d5dcab07b8

SHA512
e4de1bbb0da1697f1c01d039fb265979b290b2839e06665c61e6008c8c5547fabf10689a06308dd7dfefa1a05d67966c818555d14ed317431286b7018e0a98bb

Download Submit
C:\Windows\system\NmDvoKg.exe

Filesize
1.8MB

MD5
f758b35be1121d566cda99e4f0532a65

SHA1
fbbfeb100f6dae2a2d5ed58a087ed04aa0499611

SHA256
af124212b0719facbf0d8a06f9b3fdc0231e0c4d3844c0eedec0a996762236f6

SHA512
81106c4080044595836362d8810a6b710ecf1109f841bb9b9429f4ef26827dc38fb90dee3218e23fa6dd3eb56e7ad07be2315dd9b19957a728b469952805b0a2

Download Submit
C:\Windows\system\NrDnWEY.exe

Filesize
1.8MB

MD5
22fd51f5e4da980f15fb78ca32f5c4bc

SHA1
09aab4850ce2a8c919cd3ec7e7e6e4865a18b6e6

SHA256
643bab6595198be5bd6d5254b80737a1f632a3c95f78877b223e1e626b88f876

SHA512
9af96690b8380adaf8bc377a076b9181fd8647e4ca2856eb2d32ca61b78956e611523d199c3a22248aa34612484e0232c2daaa9816a3344079e1d9e92622d27c

Download Submit
C:\Windows\system\QeRjwFW.exe

Filesize
1.8MB

MD5
3608a59bccf7311f17ea352719fafe27

SHA1
e58abfab75a04fa5a99d8bb45da272c061597210

SHA256
26a6d3719fb494789006213f0fab9e4bbca946579fe115aff099917928d5b4ac

SHA512
57b63d527d0c3d83101b67647c333f967afea36e36040179d5d4f0d1dfb93014c35b64471f7f06d44d896367d01febf1235152523da95874a63792f60d133a12

Download Submit
C:\Windows\system\TPvxPvV.exe

Filesize
1.8MB

MD5
030eaeea668a5dbf7c577ee534110e72

SHA1
8cdfb428980ce4f91859d887ce51cec72fb5c48d

SHA256
023a4b689094945308608a585ed425256bf4c7ff7b22bbf7d793e17c2d7e56a7

SHA512
5225c897b359ee8f26a6db88c4ed7fc9a7381ce1df43719da273023621bdef47017e2dcc1ea0de2dc042cb7793b4b3e55f831ac9663864b045f16cd9108afb1b

Download Submit
C:\Windows\system\ZIyHmdE.exe

Filesize
1.8MB

MD5
e28bf88047287a0214ed4d20565e7fbd

SHA1
e796ed123ab3e2ecd6afd072644e07647fe173c6

SHA256
3c31d428728132261f33f10b85d4ad4ffdf12d86e51cf9709c0b1a39930c196c

SHA512
1af9d2734dfc8edb1ee8c31e4fc7c064b042abe61d9fc5439a53399d4bc71f2b52045c4c43ad4c36d18ada2059e8f79c7909bcbf7934f2ff4b6c934050f82920

Download Submit
C:\Windows\system\ZSazSdX.exe

Filesize
1.8MB

MD5
61ab1ac29bc628520e63b724f2a6ccb8

SHA1
c7a3e3f3460a89fc3a3458fb041b8e07fb2701dc

SHA256
bda7826e850a2720742b343140e668afecffc8def2553c8df2f2e3777d1396a4

SHA512
d5e654ad5bb5853cf640abd4e7ce1d119026d219e89a087bc10b46cc40f250878f814fa31259984a972a392d5057da6ee7897a255b615e65bf86e122fc58a43e

Download Submit
C:\Windows\system\bCFNrsd.exe

Filesize
1.8MB

MD5
dcb55e6b1118bcd711fff2fb6aab7e08

SHA1
6ebe91ec4e2dd6976652c972843538d2778f82f7

SHA256
9fcbe4682645a510aea17876ecdbc984180da6347a852ec1c3f90733f0c096dc

SHA512
d99d09b0c904fbca44f417b5f928c4dda436a37bf121187dd821c84624d8f0969889f341f1dc0af9a45a20afb697d1f3c8d9dc6c663cb05cf5d17e073fcf10bf

Download Submit
C:\Windows\system\byhyDJP.exe

Filesize
1.8MB

MD5
5ebdc5bc93bb9cc6bdf3879685ca5461

SHA1
e3760432675149599fb88d1f1af989ea349fe39a

SHA256
ee7615889808929d1ed1c0c828150743590822397858ac27d753fac40ec3c163

SHA512
e55f74de9df62c1073562db8fe245f2dc450bdf650e54639a67f9e5acccf6cc2bbc9164358551d3841d96d15e8e7fce2dad77c469edaf913295174f97022745f

Download Submit
C:\Windows\system\eFvZdDf.exe

Filesize
1.8MB

MD5
167bc920fa365ba2d44c1064227a2145

SHA1
ab1f499a5ba1d6d28b4fd4a3fe00bb18d4e8e2b6

SHA256
6533e7ab6ffa1b5a6de213812d4c620a75c4f16afa122fc7efaff8122d8bad43

SHA512
1307f38b8c0da5cd1ce6122fe09f47d95fe0d6b8cf4f0172f8398a8b445b180f9d2c5e76280d2c51ead8651fe43df8ca059d51c7a1db709417b0377d2678f76e

Download Submit
C:\Windows\system\gIzoQoS.exe

Filesize
1.8MB

MD5
4fab8086672e7e27b76fd66a5d9eb9f1

SHA1
96b7a8a16614c7e301b2be35f526d1f1d42f7032

SHA256
87c0fc7bcb96d23e2ce22bad70f7d4db0425b4cc6c207a7c92c7c7e3670236a4

SHA512
286b251a96a9abd5b74a45e44092e7c2e9dc5e614d38c50ce62c0d9957968dd7baaa7a55a8bfab07fcd1d6f7b3826fe5da32c4fd1e18555dbcbd4285907f3b93

Download Submit
C:\Windows\system\hWszLFH.exe

Filesize
1.8MB

MD5
e5e586bbc2a6baa4c6a5e2b309d548b5

SHA1
d4c8ed88335b4842e75ccfbb5e696e664c132943

SHA256
6a51c9b30a57487288280b7a2f2be2047db63b3f1fd9c2ee1992a03cbe965a24

SHA512
95cb2e3bee2c3cbbe2a6feebde54f177eef22e54f9a161ab2bafdc08611084c63e5abffc873bd9c604d652ccfbc00347ae8a2866e55d01a50cfc7a3391c5bcb5

Download Submit
C:\Windows\system\hhBkLRo.exe

Filesize
1.8MB

MD5
55889f5b50324e05a562f81a9f69ed52

SHA1
e5b48fa87b483d2fd53da02cd19f3c461758db76

SHA256
2cbe07a504ac5f50d1274636fb4508024313f2780ee7a707608f43389c1369b7

SHA512
9083238e0b915e99e3676fe5a582225ac386d4bf88a14fe211d00c3cd86f0892398df6cf5d2858067eedfd9ec74b74f42e75e120d083d20aa449b35801ca109d

Download Submit
C:\Windows\system\klvWGHJ.exe

Filesize
1.8MB

MD5
63f3ff06745072a3fc6a202649d0250f

SHA1
e162f9f08435a8565da0a2191cb7db9a925ccee8

SHA256
654bcb56f6b2422a810193545308071674f3662b90528850898af891d9d40da6

SHA512
854306f85ae80f93940a7f0640723b43a74c42a5337247a369ef5fe98730d12d0a5afa4b9ac25bf8719d122d15cb9628f7c57ee88626e863e23810f7f965696e

Download Submit
C:\Windows\system\mUQMlzP.exe

Filesize
1.8MB

MD5
b410eb5cde5a06f431f7ae1726c87616

SHA1
1d229dae909f50134b386e3fac691b11b8636d76

SHA256
37ce023fc4a4717201b88a379bd8a412cf5262a312c73720e6ce2e00df3fb798

SHA512
89b64c4ad53666efe1e5627a3781764ec6b0dc2a0f351708f51c55d864b2aa51b0be46e6d11bb836a37f5b1fee68fd904d3b9a07a977b136b810e907af02de58

Download Submit
C:\Windows\system\nluHpaU.exe

Filesize
1.8MB

MD5
219138eb5c584cef62151eacf9333d66

SHA1
c6b5e9084769ecb63e440b6eaf5bca70a2fee46d

SHA256
ea500e3c875082bdabdffd6f5861aa01ab02514aac6a2ab97c7a017b063c1b28

SHA512
3ae7e7f5315f47d7e207329ea70982b188f23849bad46a26d2f05c87721a8208805bf40056fbf240c1f831f843a3ed1d61f3f42168857c227b14d9fd6ebd498a

Download Submit
C:\Windows\system\yxfYMSA.exe

Filesize
1.8MB

MD5
16a20f6f1d9dbe737501f790503af7c1

SHA1
416da0d9f162cbbc0251fb96719a63edcafcdfbb

SHA256
df915d856a794036b0979e49593b16125e4fc590949b19c78423d2da79909786

SHA512
1aec4cc112413e9b401937adafb5670381c5588bf5599088438c436f66de38c19936d2cd1620bf9f797f9c9095792c6e6fa947d904392e0b864a5df4fa8b4872

Download Submit
\Windows\system\EhqSbCm.exe

Filesize
1.8MB

MD5
16253a5fa6eac749021776b9b0a7a40c

SHA1
2bf106f68bafa6e1eeca5f8cc48ce3db703b3252

SHA256
8a24c632195c1b3c70f0a02fc9adf0095912ec67c3e7372dc38b2c923476ac43

SHA512
549c0468fc9203a56aa5cd0e5a79ea7748525b12c2674b4b3f12e72f8d0cdee11ee1e206bc13da14fed5e66dc31221dfe5c3a4d4e5f9080fc2f94010f9a7d2b9

Download Submit
\Windows\system\GjKtyMz.exe

Filesize
1.8MB

MD5
8391f67bedc7048eb9890a70d90fbaa2

SHA1
b2e14e7e9030e15095c046a925d6507492c6b8cb

SHA256
329bfa1b3877f81958765f0285515496b292b1aec3a2f5a7d878f16af1db60a8

SHA512
6b76485fbab0a58c9c74b06ab3094744a3233c2c2b00af7dac23ecffc25eaf0a238579cf8f4f98e7cc0b1eee0df83fd56bc976ef69ec6712a2262fd73c6ff779

Download Submit
\Windows\system\OaEcvvh.exe

Filesize
1.8MB

MD5
77a18bb54fb721a942f382a0d0bfd38f

SHA1
6f628fe4d872a2c4c6e185f56d034b5f257be7ae

SHA256
f7598bd579bdb40135b3a0240fad49271032f2eb9ce925c580a62631f6275ebe

SHA512
68290fd2e719c72e57803624be98cb631e973a3c207d0187243bc04da73f5f0e31a7d7a1a54d0e73c14072772ffb22bc80574ab012128a54083d64724cee3f7d

Download Submit
\Windows\system\QAnGbMY.exe

Filesize
1.8MB

MD5
538c7114a56280d9acbbd2f8f3ed7408

SHA1
410bedf789254a13106e4a6c1dd9928548bc3583

SHA256
20bdb4c2c0add89825209b8e728057f0c0b47055b883fcc922ae9695acd5ef40

SHA512
03acc4f558b73f3677877899378a70f757e9dea1ff18fdab112149b4c9b961d8f3a94114231585a6194a0ada0ce698b5f23ecc4c7f8a09000858c4bdec5ab1da

Download Submit
\Windows\system\XqOGEJu.exe

Filesize
1.8MB

MD5
e42233c700533bb1baa14e457a2252af

SHA1
2d5f1ad75e38dc8fc0740583cf96e28f053e032f

SHA256
550fc91e816c20a5894bee5008132b0320b5c806b6eba8f6f558415a5e7bc4b2

SHA512
0ab31fa310e3f1be1c113f47037f708074a4a656214db3955c330d11aa746e7d838d6712528efad5103c969ca6212d4059ec99a25de85cebead12aad92c0d8e2

Download Submit
\Windows\system\YkBLhjk.exe

Filesize
1.8MB

MD5
4650564152d81f7973da6dd95b6806aa

SHA1
7002a58d21cd9a9f07ea411859dbaaeedfac6b3e

SHA256
644a5ab5bf9931246dade29cd079d0f59b6fd31a5e128d85cab180d87f20c1db

SHA512
f1cf4093fc0c73cc8dc40635df3c914803438490cd69344dd93256a4b34fcc38ecc15fba575ba37845555e999731ee1126166614714684fe66a695e5371db68a

Download Submit
\Windows\system\ZDkxHrM.exe

Filesize
1.8MB

MD5
a5249571cdba4c7c8f48aae756f6c138

SHA1
849c8be947d03e3c6e5c8f5ebbfb8298927d9eda

SHA256
80b9b516ad48ee7585d54552af535f7eee76ad5c094f496bad711452c0444b64

SHA512
53ca8ee3f5be7027b59dddfe78fa3bbd4fe33978f89167f2393b8b6300d24b6b204829c7bdca1fd91cd05845feba08dea1faa702fe33144031f5e3d07c846de8

Download Submit
\Windows\system\dOrAUkG.exe

Filesize
1.8MB

MD5
1dae209a000029145de85a126dd92263

SHA1
b8204cd54e7351535868455aa93c3c4e3a03d1a5

SHA256
b759ba3c2527e683a02defb410c37772787ebbf59973a70a074cad83fdec0d9f

SHA512
f16fdeb09338cb399c04205017e2c55c501696e8853e7dde34a7bd0416659cc9b200386c353e9bc3cdee0cd2d4d2a182aaea56dc11d984ad2293281d9274f22e

Download Submit
\Windows\system\eqafeWa.exe

Filesize
1.8MB

MD5
68801a59c0e2a04d3085051d07a4adc2

SHA1
e5017b8c0c1d7a0b9247d50313060f6b3a94976a

SHA256
7a33c972a74e57990282f8607b36745991235dbe332c7de05ab1acd151f8ccc9

SHA512
ebc175b70ad202dd836ca6a9865ca30111f076ef535f27993e58fcd7a1a118824495c7f5eb7dd58040da55c84fa59e2b3c0bf1e672367734fcb593d101a01847

Download Submit
\Windows\system\qmWDikb.exe

Filesize
1.8MB

MD5
61f2571415dc9b038cc92b351776de1c

SHA1
ef4d7863a9d1010f8a60e0459ebdfa5537aafb63

SHA256
007c6f4bbd7632782bf1a65a22aa06207933374031749c74a334ba89fd448631

SHA512
0ae202e1b366c2fbf3c656c04f01367f23f9282d076dac8b5b5328b838d836da7edae542afc0efbb0b924a0c1709e0b1056d9c0b3f1aba3d4c36007f0f044c01

Download Submit
\Windows\system\uOWEIYj.exe

Filesize
1.8MB

MD5
3fd37b34492749997764981f52557dce

SHA1
4d65a3a8cbb04dda0cd623b8e4c44ad06cfcf805

SHA256
14af6078c71d617877395fedcffeb3c1f103bc01585e9fc1abbb8d40b847ff3f

SHA512
f1c8bbe5343f8bbbee8579ea61291c287ae9fbfea75b33a92d6e669e10819d2ee708f0f068039b425546d048db00a6373dfbe58141712164b8024eb6dd51f065

Download Submit
\Windows\system\xnhKktl.exe

Filesize
1.8MB

MD5
fe52e5002276092d3a8a83dea0b22866

SHA1
6da5acd9eb8666c12bc5f93e84d55e26f49b89e6

SHA256
39cbc4a0fb5a53b8f41e94285411619a782c095145e276eb6f7c8b1ecff348a1

SHA512
2093c037901ea9354abdd2c28edaccb9dad00cb36d28a36dc6ac957888377f7306425593517e91eef4afbd6f74cce1d59dad442b18575ab83c41cebfe23988fa

Download Submit
memory/1108-239-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1676-612-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/1676-274-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1676-276-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/1676-225-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/1676-224-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/1676-231-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/1992-237-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/1992-230-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/1992-232-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/1992-235-0x000000013F3C0000-0x000000013F7B2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-234-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/1992-241-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/1992-1-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1992-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/1992-227-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/1992-30-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/1992-6-0x0000000002E80000-0x0000000003272000-memory.dmp

Filesize
3.9MB

Download
memory/2308-240-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2500-238-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2528-236-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2600-233-0x000000013F3E0000-0x000000013F7D2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-226-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2756-242-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/3060-8-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download