xmrig | a40c81159d30d421e24552430f17ff6622c22c276565df0faf3dc56067b4e676

Analysis

max time kernel
24s
max time network
32s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 22:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
Size

2.3MB
MD5

0a8aa340f84f3d4b352c5f12dbfbafd4
SHA1

88aabb6dc1e07b93366257c2e0ea60dde653cd6b
SHA256

a40c81159d30d421e24552430f17ff6622c22c276565df0faf3dc56067b4e676
SHA512

436ed45f3c4820479e2984397c92b46e079dfa219200a830cc57d8e38231f9efb58461482f5c0a53a0e8efb05bfd8c85fd755f56eda15e333c83c8046b7c6665
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//2o:NABF

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2796-83-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2816-79-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2628-78-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2664-77-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/2696-76-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/2668-75-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2252-19-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/3040-89-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2252	QrJXsdF.exe
2728	vhoGBdV.exe
2668	AgzQzXv.exe
2696	IGHjuhc.exe
2664	WBROMgV.exe
2628	RizfTMn.exe
2816	aBsmOGu.exe
2796	hVZCHwW.exe
3040	zAehWWF.exe
2656	xrpctDv.exe
3024	lpiwzUd.exe
2676	FlEkrhV.exe
2560	nhVRedA.exe
2256	PSBWhYk.exe
2608	PrtMCYB.exe
1156	fQPsurI.exe
2880	HsoMVUX.exe
1516	Tnkzlka.exe
1324	CzWtQhL.exe
2904	BBNRPFd.exe
1872	siAYaop.exe
1528	vXXeRuK.exe
2964	xPSiVme.exe
756	cxfPXaC.exe
1756	sIjsHJN.exe
532	gZLCsfe.exe
1656	tjJTusB.exe
580	XrfmCni.exe
1484	nFOoozq.exe
1840	eNiTadX.exe
1900	JxYekCx.exe
952	WRlswgP.exe
292	tPIcMyD.exe
2264	XXRvRoo.exe
1596	SHJgZQN.exe
1780	dFpcdWX.exe
1352	QRHsTPd.exe
928	JujOKhb.exe
1048	JJIvLdb.exe
2424	blmhlCj.exe
900	xLoPefY.exe
564	rPgTfff.exe
2224	sUtBrYu.exe
2736	WOUawSL.exe
2024	OHiJSZy.exe
2436	clnooGM.exe
2440	OgqyDIQ.exe
2992	Rfcxjtd.exe
892	VvytQcy.exe
2316	eLepHFx.exe
2472	ZXIsGrQ.exe
2832	xIUGrBj.exe
2332	KWkVggj.exe
2564	zHoLlHz.exe
2804	ICJofAo.exe
1716	WVREXzE.exe
3052	xfLvoJK.exe
2344	VNUhALd.exe
2644	TapoNDU.exe
2756	MFYygXg.exe
2548	hzSnyjZ.exe
2640	XHFCLEa.exe
2404	tGfcuwO.exe
1868	YxzZxqO.exe

Loads dropped DLL 64 IoCs

pid	Process
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1700-1-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x003a0000000132f2-9.dat	upx
behavioral1/files/0x00090000000134f5-13.dat	upx
behavioral1/files/0x0008000000013a85-46.dat	upx
behavioral1/files/0x000a00000001211e-18.dat	upx
behavioral1/files/0x000600000001474b-56.dat	upx
behavioral1/files/0x00060000000145d4-48.dat	upx
behavioral1/files/0x0006000000014525-47.dat	upx
behavioral1/files/0x0008000000013a15-45.dat	upx
behavioral1/files/0x000700000001475f-88.dat	upx
behavioral1/files/0x0008000000013a65-91.dat	upx
behavioral1/files/0x00060000000146a7-97.dat	upx
behavioral1/memory/2796-83-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2816-79-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2628-78-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2664-77-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/memory/2696-76-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/memory/2668-75-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0008000000013735-62.dat	upx
behavioral1/files/0x00130000000054a8-59.dat	upx
behavioral1/memory/2728-40-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x00060000000145c9-36.dat	upx
behavioral1/files/0x000800000001451d-30.dat	upx
behavioral1/memory/2252-19-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/3040-89-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0006000000014a29-111.dat	upx
behavioral1/files/0x0006000000014d0f-118.dat	upx
behavioral1/files/0x0006000000015077-125.dat	upx
behavioral1/files/0x000600000001523e-143.dat	upx
behavioral1/files/0x00060000000148af-134.dat	upx
behavioral1/files/0x0006000000015c91-178.dat	upx
behavioral1/files/0x0006000000015b37-167.dat	upx
behavioral1/files/0x0006000000015c9b-187.dat	upx
behavioral1/files/0x0006000000015bb5-173.dat	upx
behavioral1/files/0x00060000000155e8-157.dat	upx
behavioral1/files/0x0006000000015b72-171.dat	upx
behavioral1/files/0x0006000000015a15-162.dat	upx
behavioral1/files/0x003a000000013362-148.dat	upx
behavioral1/files/0x000600000001543a-152.dat	upx
behavioral1/files/0x00060000000150aa-139.dat	upx
behavioral1/files/0x0006000000014fac-137.dat	upx
behavioral1/files/0x0006000000014c0b-135.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QWRkKaf.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\BhaGjQO.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\UaGJtYI.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\wKuJgeF.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\tnzndkT.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jiqrJRV.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\gfLcRtX.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\bgfnhpy.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\oJSRPnc.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\HsRbWBW.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\eWggFKf.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\znyHoRH.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\nKYekpY.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\iNxqRkJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\yAMAoIS.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\LapEGwO.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\wjhqhGu.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ALTpeTe.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\lIjwfPJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\XzJartr.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\SwYPjVJ.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\eDEqcjj.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\bkjdTsC.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\LGnnCWb.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\uEiVdmy.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jtZlxNb.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\UYDNBRS.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZoJWlxk.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\iSPGyYN.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\bCrVdbw.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\NQMFfmp.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\DMtTJmR.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\jNXtkbF.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\RNhgWiM.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\pAnTPUG.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\SzsWJyV.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\apzvXlA.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\LHMtXWt.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\AgKwBsL.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZsHAZvq.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\yjdESgh.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\GjquZVe.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\HnXaRqA.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\Gntbbxb.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\GoucJhX.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\tQtbbfI.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\KhRPESA.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ZexulBi.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\QKsNimI.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\dBxYzia.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\WtGkbqD.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\dGBctTp.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\pggQNVF.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\EwwxQNU.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\mKePsmq.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\GrIPxdm.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\qJFAwwk.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\zJAytyI.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\PXZAwSm.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\Bhskggt.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\ykDpkrz.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\WBROMgV.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\oihRsKL.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
File created	C:\Windows\System\lKxQlPy.exe	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2208	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
Token: SeDebugPrivilege	2208	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2208	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2208	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2208	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	29
PID 1700 wrote to memory of 2728	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	30
PID 1700 wrote to memory of 2728	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	30
PID 1700 wrote to memory of 2728	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	30
PID 1700 wrote to memory of 2252	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2252	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2252	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	31
PID 1700 wrote to memory of 2668	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2668	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2668	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	32
PID 1700 wrote to memory of 2796	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	33
PID 1700 wrote to memory of 2796	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	33
PID 1700 wrote to memory of 2796	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	33
PID 1700 wrote to memory of 2696	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	34
PID 1700 wrote to memory of 2696	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	34
PID 1700 wrote to memory of 2696	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	34
PID 1700 wrote to memory of 2656	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	35
PID 1700 wrote to memory of 2656	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	35
PID 1700 wrote to memory of 2656	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	35
PID 1700 wrote to memory of 2664	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	36
PID 1700 wrote to memory of 2664	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	36
PID 1700 wrote to memory of 2664	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	36
PID 1700 wrote to memory of 3024	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	37
PID 1700 wrote to memory of 3024	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	37
PID 1700 wrote to memory of 3024	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	37
PID 1700 wrote to memory of 2628	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	38
PID 1700 wrote to memory of 2628	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	38
PID 1700 wrote to memory of 2628	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	38
PID 1700 wrote to memory of 2676	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	39
PID 1700 wrote to memory of 2676	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	39
PID 1700 wrote to memory of 2676	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	39
PID 1700 wrote to memory of 2816	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	40
PID 1700 wrote to memory of 2816	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	40
PID 1700 wrote to memory of 2816	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	40
PID 1700 wrote to memory of 2560	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	41
PID 1700 wrote to memory of 2560	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	41
PID 1700 wrote to memory of 2560	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	41
PID 1700 wrote to memory of 3040	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	42
PID 1700 wrote to memory of 3040	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	42
PID 1700 wrote to memory of 3040	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	42
PID 1700 wrote to memory of 2256	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	43
PID 1700 wrote to memory of 2256	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	43
PID 1700 wrote to memory of 2256	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	43
PID 1700 wrote to memory of 2608	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	44
PID 1700 wrote to memory of 2608	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	44
PID 1700 wrote to memory of 2608	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	44
PID 1700 wrote to memory of 1324	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	45
PID 1700 wrote to memory of 1324	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	45
PID 1700 wrote to memory of 1324	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	45
PID 1700 wrote to memory of 1156	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	46
PID 1700 wrote to memory of 1156	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	46
PID 1700 wrote to memory of 1156	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	46
PID 1700 wrote to memory of 2904	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	47
PID 1700 wrote to memory of 2904	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	47
PID 1700 wrote to memory of 2904	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	47
PID 1700 wrote to memory of 2880	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	48
PID 1700 wrote to memory of 2880	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	48
PID 1700 wrote to memory of 2880	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	48
PID 1700 wrote to memory of 1872	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	49
PID 1700 wrote to memory of 1872	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	49
PID 1700 wrote to memory of 1872	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	49
PID 1700 wrote to memory of 1516	1700	0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a8aa340f84f3d4b352c5f12dbfbafd4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2208
- C:\Windows\System\vhoGBdV.exe
  C:\Windows\System\vhoGBdV.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\QrJXsdF.exe
  C:\Windows\System\QrJXsdF.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\AgzQzXv.exe
  C:\Windows\System\AgzQzXv.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\hVZCHwW.exe
  C:\Windows\System\hVZCHwW.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\IGHjuhc.exe
  C:\Windows\System\IGHjuhc.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\xrpctDv.exe
  C:\Windows\System\xrpctDv.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\WBROMgV.exe
  C:\Windows\System\WBROMgV.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\lpiwzUd.exe
  C:\Windows\System\lpiwzUd.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\RizfTMn.exe
  C:\Windows\System\RizfTMn.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\FlEkrhV.exe
  C:\Windows\System\FlEkrhV.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\aBsmOGu.exe
  C:\Windows\System\aBsmOGu.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\nhVRedA.exe
  C:\Windows\System\nhVRedA.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\zAehWWF.exe
  C:\Windows\System\zAehWWF.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\PSBWhYk.exe
  C:\Windows\System\PSBWhYk.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\PrtMCYB.exe
  C:\Windows\System\PrtMCYB.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\CzWtQhL.exe
  C:\Windows\System\CzWtQhL.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\fQPsurI.exe
  C:\Windows\System\fQPsurI.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\BBNRPFd.exe
  C:\Windows\System\BBNRPFd.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\HsoMVUX.exe
  C:\Windows\System\HsoMVUX.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\siAYaop.exe
  C:\Windows\System\siAYaop.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\Tnkzlka.exe
  C:\Windows\System\Tnkzlka.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\vXXeRuK.exe
  C:\Windows\System\vXXeRuK.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\xPSiVme.exe
  C:\Windows\System\xPSiVme.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\cxfPXaC.exe
  C:\Windows\System\cxfPXaC.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\sIjsHJN.exe
  C:\Windows\System\sIjsHJN.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\gZLCsfe.exe
  C:\Windows\System\gZLCsfe.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\tjJTusB.exe
  C:\Windows\System\tjJTusB.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\XrfmCni.exe
  C:\Windows\System\XrfmCni.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\nFOoozq.exe
  C:\Windows\System\nFOoozq.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\JxYekCx.exe
  C:\Windows\System\JxYekCx.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\eNiTadX.exe
  C:\Windows\System\eNiTadX.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\WRlswgP.exe
  C:\Windows\System\WRlswgP.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\tPIcMyD.exe
  C:\Windows\System\tPIcMyD.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\XXRvRoo.exe
  C:\Windows\System\XXRvRoo.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\SHJgZQN.exe
  C:\Windows\System\SHJgZQN.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\dFpcdWX.exe
  C:\Windows\System\dFpcdWX.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\QRHsTPd.exe
  C:\Windows\System\QRHsTPd.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\JujOKhb.exe
  C:\Windows\System\JujOKhb.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\JJIvLdb.exe
  C:\Windows\System\JJIvLdb.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\blmhlCj.exe
  C:\Windows\System\blmhlCj.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\xLoPefY.exe
  C:\Windows\System\xLoPefY.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\rPgTfff.exe
  C:\Windows\System\rPgTfff.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\sUtBrYu.exe
  C:\Windows\System\sUtBrYu.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\WOUawSL.exe
  C:\Windows\System\WOUawSL.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\OHiJSZy.exe
  C:\Windows\System\OHiJSZy.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\clnooGM.exe
  C:\Windows\System\clnooGM.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\OgqyDIQ.exe
  C:\Windows\System\OgqyDIQ.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\Rfcxjtd.exe
  C:\Windows\System\Rfcxjtd.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\VvytQcy.exe
  C:\Windows\System\VvytQcy.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\eLepHFx.exe
  C:\Windows\System\eLepHFx.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\ZXIsGrQ.exe
  C:\Windows\System\ZXIsGrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\xIUGrBj.exe
  C:\Windows\System\xIUGrBj.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\KWkVggj.exe
  C:\Windows\System\KWkVggj.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\zHoLlHz.exe
  C:\Windows\System\zHoLlHz.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\ICJofAo.exe
  C:\Windows\System\ICJofAo.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xfLvoJK.exe
  C:\Windows\System\xfLvoJK.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\WVREXzE.exe
  C:\Windows\System\WVREXzE.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\TapoNDU.exe
  C:\Windows\System\TapoNDU.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\VNUhALd.exe
  C:\Windows\System\VNUhALd.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\MFYygXg.exe
  C:\Windows\System\MFYygXg.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\hzSnyjZ.exe
  C:\Windows\System\hzSnyjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\XHFCLEa.exe
  C:\Windows\System\XHFCLEa.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\tGfcuwO.exe
  C:\Windows\System\tGfcuwO.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\YxzZxqO.exe
  C:\Windows\System\YxzZxqO.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\UrrNiGa.exe
  C:\Windows\System\UrrNiGa.exe
  2⤵
  PID:316
- C:\Windows\System\gpfXkpb.exe
  C:\Windows\System\gpfXkpb.exe
  2⤵
  PID:2828
- C:\Windows\System\jRBDQfv.exe
  C:\Windows\System\jRBDQfv.exe
  2⤵
  PID:2612
- C:\Windows\System\qzEBlqS.exe
  C:\Windows\System\qzEBlqS.exe
  2⤵
  PID:792
- C:\Windows\System\SeoTinI.exe
  C:\Windows\System\SeoTinI.exe
  2⤵
  PID:1704
- C:\Windows\System\GrIPxdm.exe
  C:\Windows\System\GrIPxdm.exe
  2⤵
  PID:2900
- C:\Windows\System\wyGmwze.exe
  C:\Windows\System\wyGmwze.exe
  2⤵
  PID:2116
- C:\Windows\System\GMFHrZI.exe
  C:\Windows\System\GMFHrZI.exe
  2⤵
  PID:1672
- C:\Windows\System\eWggFKf.exe
  C:\Windows\System\eWggFKf.exe
  2⤵
  PID:1708
- C:\Windows\System\BQFveYf.exe
  C:\Windows\System\BQFveYf.exe
  2⤵
  PID:1960
- C:\Windows\System\wjhqhGu.exe
  C:\Windows\System\wjhqhGu.exe
  2⤵
  PID:320
- C:\Windows\System\sQWRLcD.exe
  C:\Windows\System\sQWRLcD.exe
  2⤵
  PID:2760
- C:\Windows\System\ABEEkeo.exe
  C:\Windows\System\ABEEkeo.exe
  2⤵
  PID:2604
- C:\Windows\System\DnBbEmx.exe
  C:\Windows\System\DnBbEmx.exe
  2⤵
  PID:2600
- C:\Windows\System\AANpExK.exe
  C:\Windows\System\AANpExK.exe
  2⤵
  PID:288
- C:\Windows\System\AKgOxJL.exe
  C:\Windows\System\AKgOxJL.exe
  2⤵
  PID:700
- C:\Windows\System\VxBegkP.exe
  C:\Windows\System\VxBegkP.exe
  2⤵
  PID:1028
- C:\Windows\System\hymFSZA.exe
  C:\Windows\System\hymFSZA.exe
  2⤵
  PID:1540
- C:\Windows\System\wGTCvOG.exe
  C:\Windows\System\wGTCvOG.exe
  2⤵
  PID:1784
- C:\Windows\System\NpZFqOx.exe
  C:\Windows\System\NpZFqOx.exe
  2⤵
  PID:2004
- C:\Windows\System\INKjjIO.exe
  C:\Windows\System\INKjjIO.exe
  2⤵
  PID:1912
- C:\Windows\System\BSaBhov.exe
  C:\Windows\System\BSaBhov.exe
  2⤵
  PID:2184
- C:\Windows\System\ZEcnCdC.exe
  C:\Windows\System\ZEcnCdC.exe
  2⤵
  PID:356
- C:\Windows\System\mIcKGTW.exe
  C:\Windows\System\mIcKGTW.exe
  2⤵
  PID:1712
- C:\Windows\System\coBmNKM.exe
  C:\Windows\System\coBmNKM.exe
  2⤵
  PID:1788
- C:\Windows\System\hfsWHja.exe
  C:\Windows\System\hfsWHja.exe
  2⤵
  PID:2260
- C:\Windows\System\puZUhFH.exe
  C:\Windows\System\puZUhFH.exe
  2⤵
  PID:2356
- C:\Windows\System\KhRPESA.exe
  C:\Windows\System\KhRPESA.exe
  2⤵
  PID:2416
- C:\Windows\System\shPcBzq.exe
  C:\Windows\System\shPcBzq.exe
  2⤵
  PID:1512
- C:\Windows\System\ESBDgwm.exe
  C:\Windows\System\ESBDgwm.exe
  2⤵
  PID:2496
- C:\Windows\System\AZzMQuP.exe
  C:\Windows\System\AZzMQuP.exe
  2⤵
  PID:2248
- C:\Windows\System\QWRkKaf.exe
  C:\Windows\System\QWRkKaf.exe
  2⤵
  PID:1304
- C:\Windows\System\DsNEYwe.exe
  C:\Windows\System\DsNEYwe.exe
  2⤵
  PID:1808
- C:\Windows\System\pdmSdyu.exe
  C:\Windows\System\pdmSdyu.exe
  2⤵
  PID:1608
- C:\Windows\System\goOidZV.exe
  C:\Windows\System\goOidZV.exe
  2⤵
  PID:2540
- C:\Windows\System\bLKhAHq.exe
  C:\Windows\System\bLKhAHq.exe
  2⤵
  PID:2724
- C:\Windows\System\nwdJhED.exe
  C:\Windows\System\nwdJhED.exe
  2⤵
  PID:2708
- C:\Windows\System\DJpqksm.exe
  C:\Windows\System\DJpqksm.exe
  2⤵
  PID:2028
- C:\Windows\System\mIpzfaJ.exe
  C:\Windows\System\mIpzfaJ.exe
  2⤵
  PID:988
- C:\Windows\System\KIfisxe.exe
  C:\Windows\System\KIfisxe.exe
  2⤵
  PID:1644
- C:\Windows\System\ZYEsQLE.exe
  C:\Windows\System\ZYEsQLE.exe
  2⤵
  PID:2960
- C:\Windows\System\nTurMCz.exe
  C:\Windows\System\nTurMCz.exe
  2⤵
  PID:2984
- C:\Windows\System\fkWqMnU.exe
  C:\Windows\System\fkWqMnU.exe
  2⤵
  PID:352
- C:\Windows\System\WyZZhcb.exe
  C:\Windows\System\WyZZhcb.exe
  2⤵
  PID:2836
- C:\Windows\System\pAYDnix.exe
  C:\Windows\System\pAYDnix.exe
  2⤵
  PID:1604
- C:\Windows\System\EAQdfmu.exe
  C:\Windows\System\EAQdfmu.exe
  2⤵
  PID:2160
- C:\Windows\System\sIhpfWs.exe
  C:\Windows\System\sIhpfWs.exe
  2⤵
  PID:1580
- C:\Windows\System\ssMTWsT.exe
  C:\Windows\System\ssMTWsT.exe
  2⤵
  PID:2524
- C:\Windows\System\hDyplgU.exe
  C:\Windows\System\hDyplgU.exe
  2⤵
  PID:2056
- C:\Windows\System\RNhgWiM.exe
  C:\Windows\System\RNhgWiM.exe
  2⤵
  PID:1732
- C:\Windows\System\lJqavqD.exe
  C:\Windows\System\lJqavqD.exe
  2⤵
  PID:2052
- C:\Windows\System\sOnVFbH.exe
  C:\Windows\System\sOnVFbH.exe
  2⤵
  PID:2080
- C:\Windows\System\cHTlQrS.exe
  C:\Windows\System\cHTlQrS.exe
  2⤵
  PID:2036
- C:\Windows\System\WtGkbqD.exe
  C:\Windows\System\WtGkbqD.exe
  2⤵
  PID:1916
- C:\Windows\System\UYDNBRS.exe
  C:\Windows\System\UYDNBRS.exe
  2⤵
  PID:2704
- C:\Windows\System\VqHQSgx.exe
  C:\Windows\System\VqHQSgx.exe
  2⤵
  PID:1236
- C:\Windows\System\maTmubs.exe
  C:\Windows\System\maTmubs.exe
  2⤵
  PID:2872
- C:\Windows\System\dWHJSyj.exe
  C:\Windows\System\dWHJSyj.exe
  2⤵
  PID:2032
- C:\Windows\System\lOdERzV.exe
  C:\Windows\System\lOdERzV.exe
  2⤵
  PID:836
- C:\Windows\System\rMSLTMi.exe
  C:\Windows\System\rMSLTMi.exe
  2⤵
  PID:1616
- C:\Windows\System\xbySPYF.exe
  C:\Windows\System\xbySPYF.exe
  2⤵
  PID:1832
- C:\Windows\System\pBfTPBr.exe
  C:\Windows\System\pBfTPBr.exe
  2⤵
  PID:2996
- C:\Windows\System\VRdvSxp.exe
  C:\Windows\System\VRdvSxp.exe
  2⤵
  PID:468
- C:\Windows\System\CosmNUo.exe
  C:\Windows\System\CosmNUo.exe
  2⤵
  PID:2528
- C:\Windows\System\DXmnhUg.exe
  C:\Windows\System\DXmnhUg.exe
  2⤵
  PID:2328
- C:\Windows\System\pjDIcBE.exe
  C:\Windows\System\pjDIcBE.exe
  2⤵
  PID:996
- C:\Windows\System\oihRsKL.exe
  C:\Windows\System\oihRsKL.exe
  2⤵
  PID:1984
- C:\Windows\System\etcUPrM.exe
  C:\Windows\System\etcUPrM.exe
  2⤵
  PID:2100
- C:\Windows\System\amjxmvg.exe
  C:\Windows\System\amjxmvg.exe
  2⤵
  PID:1736
- C:\Windows\System\ZxwVOpj.exe
  C:\Windows\System\ZxwVOpj.exe
  2⤵
  PID:2016
- C:\Windows\System\tybeJaR.exe
  C:\Windows\System\tybeJaR.exe
  2⤵
  PID:3084
- C:\Windows\System\kUpHSmm.exe
  C:\Windows\System\kUpHSmm.exe
  2⤵
  PID:3100
- C:\Windows\System\qJFAwwk.exe
  C:\Windows\System\qJFAwwk.exe
  2⤵
  PID:3116
- C:\Windows\System\KSQfZGx.exe
  C:\Windows\System\KSQfZGx.exe
  2⤵
  PID:3132
- C:\Windows\System\EvIkUVK.exe
  C:\Windows\System\EvIkUVK.exe
  2⤵
  PID:3152
- C:\Windows\System\AgKwBsL.exe
  C:\Windows\System\AgKwBsL.exe
  2⤵
  PID:3168
- C:\Windows\System\umNlZZv.exe
  C:\Windows\System\umNlZZv.exe
  2⤵
  PID:3184
- C:\Windows\System\LHWvTJZ.exe
  C:\Windows\System\LHWvTJZ.exe
  2⤵
  PID:3200
- C:\Windows\System\nMCJXDS.exe
  C:\Windows\System\nMCJXDS.exe
  2⤵
  PID:3216
- C:\Windows\System\ztFQdoT.exe
  C:\Windows\System\ztFQdoT.exe
  2⤵
  PID:3232
- C:\Windows\System\KkQEXhk.exe
  C:\Windows\System\KkQEXhk.exe
  2⤵
  PID:3248
- C:\Windows\System\yckPlMz.exe
  C:\Windows\System\yckPlMz.exe
  2⤵
  PID:3268
- C:\Windows\System\HRUmgaG.exe
  C:\Windows\System\HRUmgaG.exe
  2⤵
  PID:3284
- C:\Windows\System\FjnSOxA.exe
  C:\Windows\System\FjnSOxA.exe
  2⤵
  PID:3304
- C:\Windows\System\jIHAcry.exe
  C:\Windows\System\jIHAcry.exe
  2⤵
  PID:3352
- C:\Windows\System\rvWzGrD.exe
  C:\Windows\System\rvWzGrD.exe
  2⤵
  PID:3368
- C:\Windows\System\FsiwgVk.exe
  C:\Windows\System\FsiwgVk.exe
  2⤵
  PID:3384
- C:\Windows\System\QqTaEvt.exe
  C:\Windows\System\QqTaEvt.exe
  2⤵
  PID:3400
- C:\Windows\System\jiqrJRV.exe
  C:\Windows\System\jiqrJRV.exe
  2⤵
  PID:3416
- C:\Windows\System\LqibpOq.exe
  C:\Windows\System\LqibpOq.exe
  2⤵
  PID:3432
- C:\Windows\System\qZPkIEB.exe
  C:\Windows\System\qZPkIEB.exe
  2⤵
  PID:3448
- C:\Windows\System\JpTPvmM.exe
  C:\Windows\System\JpTPvmM.exe
  2⤵
  PID:3464
- C:\Windows\System\qZaCdiC.exe
  C:\Windows\System\qZaCdiC.exe
  2⤵
  PID:3480
- C:\Windows\System\uFbopzp.exe
  C:\Windows\System\uFbopzp.exe
  2⤵
  PID:3504
- C:\Windows\System\ejDAsiV.exe
  C:\Windows\System\ejDAsiV.exe
  2⤵
  PID:3520
- C:\Windows\System\eDEqcjj.exe
  C:\Windows\System\eDEqcjj.exe
  2⤵
  PID:3536
- C:\Windows\System\ksygaaX.exe
  C:\Windows\System\ksygaaX.exe
  2⤵
  PID:3552
- C:\Windows\System\lkCekGL.exe
  C:\Windows\System\lkCekGL.exe
  2⤵
  PID:3568
- C:\Windows\System\rmaTJVC.exe
  C:\Windows\System\rmaTJVC.exe
  2⤵
  PID:3584
- C:\Windows\System\locuiaT.exe
  C:\Windows\System\locuiaT.exe
  2⤵
  PID:3600
- C:\Windows\System\zChPSXJ.exe
  C:\Windows\System\zChPSXJ.exe
  2⤵
  PID:3616
- C:\Windows\System\UPOqPYS.exe
  C:\Windows\System\UPOqPYS.exe
  2⤵
  PID:3632
- C:\Windows\System\ndWuFwR.exe
  C:\Windows\System\ndWuFwR.exe
  2⤵
  PID:3648
- C:\Windows\System\zcPlrLQ.exe
  C:\Windows\System\zcPlrLQ.exe
  2⤵
  PID:3664
- C:\Windows\System\NsZBUQX.exe
  C:\Windows\System\NsZBUQX.exe
  2⤵
  PID:3680
- C:\Windows\System\RlqYIXz.exe
  C:\Windows\System\RlqYIXz.exe
  2⤵
  PID:3696
- C:\Windows\System\vaeJYJn.exe
  C:\Windows\System\vaeJYJn.exe
  2⤵
  PID:3712
- C:\Windows\System\qsOwAOE.exe
  C:\Windows\System\qsOwAOE.exe
  2⤵
  PID:3732
- C:\Windows\System\lKzHgPY.exe
  C:\Windows\System\lKzHgPY.exe
  2⤵
  PID:3764
- C:\Windows\System\LZMALzq.exe
  C:\Windows\System\LZMALzq.exe
  2⤵
  PID:3780
- C:\Windows\System\xXkfVQH.exe
  C:\Windows\System\xXkfVQH.exe
  2⤵
  PID:3796
- C:\Windows\System\IaiSDSl.exe
  C:\Windows\System\IaiSDSl.exe
  2⤵
  PID:3812
- C:\Windows\System\TxnQmug.exe
  C:\Windows\System\TxnQmug.exe
  2⤵
  PID:3828
- C:\Windows\System\RrzgHCP.exe
  C:\Windows\System\RrzgHCP.exe
  2⤵
  PID:3844
- C:\Windows\System\CkiggLb.exe
  C:\Windows\System\CkiggLb.exe
  2⤵
  PID:3860
- C:\Windows\System\hIzsRTQ.exe
  C:\Windows\System\hIzsRTQ.exe
  2⤵
  PID:3876
- C:\Windows\System\HcZfbiU.exe
  C:\Windows\System\HcZfbiU.exe
  2⤵
  PID:3892
- C:\Windows\System\lJkYHsq.exe
  C:\Windows\System\lJkYHsq.exe
  2⤵
  PID:3908
- C:\Windows\System\zJBOEjR.exe
  C:\Windows\System\zJBOEjR.exe
  2⤵
  PID:3928
- C:\Windows\System\yllgYhp.exe
  C:\Windows\System\yllgYhp.exe
  2⤵
  PID:3944
- C:\Windows\System\oSsfLAi.exe
  C:\Windows\System\oSsfLAi.exe
  2⤵
  PID:3960
- C:\Windows\System\XUXAePR.exe
  C:\Windows\System\XUXAePR.exe
  2⤵
  PID:3976
- C:\Windows\System\fvMUBxO.exe
  C:\Windows\System\fvMUBxO.exe
  2⤵
  PID:3992
- C:\Windows\System\SWkrTCv.exe
  C:\Windows\System\SWkrTCv.exe
  2⤵
  PID:4008
- C:\Windows\System\VQEKSpB.exe
  C:\Windows\System\VQEKSpB.exe
  2⤵
  PID:4024
- C:\Windows\System\fWZIdGn.exe
  C:\Windows\System\fWZIdGn.exe
  2⤵
  PID:4040
- C:\Windows\System\YPMlkOe.exe
  C:\Windows\System\YPMlkOe.exe
  2⤵
  PID:4060
- C:\Windows\System\hMMtIsO.exe
  C:\Windows\System\hMMtIsO.exe
  2⤵
  PID:4076
- C:\Windows\System\dGBctTp.exe
  C:\Windows\System\dGBctTp.exe
  2⤵
  PID:4092
- C:\Windows\System\vrVfWXT.exe
  C:\Windows\System\vrVfWXT.exe
  2⤵
  PID:760
- C:\Windows\System\tAUMzLk.exe
  C:\Windows\System\tAUMzLk.exe
  2⤵
  PID:308
- C:\Windows\System\JZfTLOM.exe
  C:\Windows\System\JZfTLOM.exe
  2⤵
  PID:1340
- C:\Windows\System\SoUYkex.exe
  C:\Windows\System\SoUYkex.exe
  2⤵
  PID:1120
- C:\Windows\System\smYDThq.exe
  C:\Windows\System\smYDThq.exe
  2⤵
  PID:1388
- C:\Windows\System\NQMFfmp.exe
  C:\Windows\System\NQMFfmp.exe
  2⤵
  PID:1956
- C:\Windows\System\XgMZwBp.exe
  C:\Windows\System\XgMZwBp.exe
  2⤵
  PID:1728
- C:\Windows\System\JmVBcTw.exe
  C:\Windows\System\JmVBcTw.exe
  2⤵
  PID:2168
- C:\Windows\System\wKWJKTT.exe
  C:\Windows\System\wKWJKTT.exe
  2⤵
  PID:628
- C:\Windows\System\lKxQlPy.exe
  C:\Windows\System\lKxQlPy.exe
  2⤵
  PID:1908
- C:\Windows\System\EgTHcwO.exe
  C:\Windows\System\EgTHcwO.exe
  2⤵
  PID:1576
- C:\Windows\System\IUjspTa.exe
  C:\Windows\System\IUjspTa.exe
  2⤵
  PID:3128
- C:\Windows\System\ddmqAsS.exe
  C:\Windows\System\ddmqAsS.exe
  2⤵
  PID:3196
- C:\Windows\System\mHCKLdA.exe
  C:\Windows\System\mHCKLdA.exe
  2⤵
  PID:3260
- C:\Windows\System\AxMtUVA.exe
  C:\Windows\System\AxMtUVA.exe
  2⤵
  PID:2588
- C:\Windows\System\PirarDT.exe
  C:\Windows\System\PirarDT.exe
  2⤵
  PID:1432
- C:\Windows\System\FKpaSdW.exe
  C:\Windows\System\FKpaSdW.exe
  2⤵
  PID:3396
- C:\Windows\System\XMfADBJ.exe
  C:\Windows\System\XMfADBJ.exe
  2⤵
  PID:3460
- C:\Windows\System\AsYnsZw.exe
  C:\Windows\System\AsYnsZw.exe
  2⤵
  PID:3500
- C:\Windows\System\zfhHEcu.exe
  C:\Windows\System\zfhHEcu.exe
  2⤵
  PID:3564
- C:\Windows\System\PfOxMOZ.exe
  C:\Windows\System\PfOxMOZ.exe
  2⤵
  PID:3628
- C:\Windows\System\YqkcIlU.exe
  C:\Windows\System\YqkcIlU.exe
  2⤵
  PID:3692
- C:\Windows\System\fWUExKN.exe
  C:\Windows\System\fWUExKN.exe
  2⤵
  PID:2976
- C:\Windows\System\hTAsjUE.exe
  C:\Windows\System\hTAsjUE.exe
  2⤵
  PID:2060
- C:\Windows\System\OKXrbXX.exe
  C:\Windows\System\OKXrbXX.exe
  2⤵
  PID:1796
- C:\Windows\System\QNExJCX.exe
  C:\Windows\System\QNExJCX.exe
  2⤵
  PID:4104
- C:\Windows\System\vllCPmC.exe
  C:\Windows\System\vllCPmC.exe
  2⤵
  PID:4120
- C:\Windows\System\pfLtUIm.exe
  C:\Windows\System\pfLtUIm.exe
  2⤵
  PID:4136
- C:\Windows\System\kLwlfeK.exe
  C:\Windows\System\kLwlfeK.exe
  2⤵
  PID:4152
- C:\Windows\System\idIwwQl.exe
  C:\Windows\System\idIwwQl.exe
  2⤵
  PID:4172
- C:\Windows\System\euFKYbs.exe
  C:\Windows\System\euFKYbs.exe
  2⤵
  PID:4188
- C:\Windows\System\sOPrkdT.exe
  C:\Windows\System\sOPrkdT.exe
  2⤵
  PID:4204
- C:\Windows\System\ZzDYadq.exe
  C:\Windows\System\ZzDYadq.exe
  2⤵
  PID:4220
- C:\Windows\System\bkjdTsC.exe
  C:\Windows\System\bkjdTsC.exe
  2⤵
  PID:4236
- C:\Windows\System\yzSegAq.exe
  C:\Windows\System\yzSegAq.exe
  2⤵
  PID:4252
- C:\Windows\System\wannTVH.exe
  C:\Windows\System\wannTVH.exe
  2⤵
  PID:4268
- C:\Windows\System\lDIOros.exe
  C:\Windows\System\lDIOros.exe
  2⤵
  PID:4284
- C:\Windows\System\SpnCkKn.exe
  C:\Windows\System\SpnCkKn.exe
  2⤵
  PID:4300
- C:\Windows\System\kFcOJLv.exe
  C:\Windows\System\kFcOJLv.exe
  2⤵
  PID:4316
- C:\Windows\System\vDKBMlL.exe
  C:\Windows\System\vDKBMlL.exe
  2⤵
  PID:4484
- C:\Windows\System\jiIrjmM.exe
  C:\Windows\System\jiIrjmM.exe
  2⤵
  PID:4500
- C:\Windows\System\dMMpUCV.exe
  C:\Windows\System\dMMpUCV.exe
  2⤵
  PID:4516
- C:\Windows\System\thDrDwA.exe
  C:\Windows\System\thDrDwA.exe
  2⤵
  PID:4532
- C:\Windows\System\ropFkqL.exe
  C:\Windows\System\ropFkqL.exe
  2⤵
  PID:4548
- C:\Windows\System\xQZYRNV.exe
  C:\Windows\System\xQZYRNV.exe
  2⤵
  PID:4564
- C:\Windows\System\xlGBjyc.exe
  C:\Windows\System\xlGBjyc.exe
  2⤵
  PID:4580
- C:\Windows\System\dwafDDI.exe
  C:\Windows\System\dwafDDI.exe
  2⤵
  PID:4596
- C:\Windows\System\dmQwZIC.exe
  C:\Windows\System\dmQwZIC.exe
  2⤵
  PID:4612
- C:\Windows\System\GFDyslW.exe
  C:\Windows\System\GFDyslW.exe
  2⤵
  PID:4628
- C:\Windows\System\hEgtnMi.exe
  C:\Windows\System\hEgtnMi.exe
  2⤵
  PID:4644
- C:\Windows\System\mUTOVro.exe
  C:\Windows\System\mUTOVro.exe
  2⤵
  PID:4660
- C:\Windows\System\TdADFmm.exe
  C:\Windows\System\TdADFmm.exe
  2⤵
  PID:4676
- C:\Windows\System\EUJHrwn.exe
  C:\Windows\System\EUJHrwn.exe
  2⤵
  PID:4692
- C:\Windows\System\qhnysqK.exe
  C:\Windows\System\qhnysqK.exe
  2⤵
  PID:4708
- C:\Windows\System\YxRBYFd.exe
  C:\Windows\System\YxRBYFd.exe
  2⤵
  PID:4724
- C:\Windows\System\xImwMJm.exe
  C:\Windows\System\xImwMJm.exe
  2⤵
  PID:4740
- C:\Windows\System\bJMcNAn.exe
  C:\Windows\System\bJMcNAn.exe
  2⤵
  PID:4756
- C:\Windows\System\WWOuoTa.exe
  C:\Windows\System\WWOuoTa.exe
  2⤵
  PID:4772
- C:\Windows\System\XSmaYRD.exe
  C:\Windows\System\XSmaYRD.exe
  2⤵
  PID:4788
- C:\Windows\System\PpMARjR.exe
  C:\Windows\System\PpMARjR.exe
  2⤵
  PID:4804
- C:\Windows\System\MlWgXkp.exe
  C:\Windows\System\MlWgXkp.exe
  2⤵
  PID:4820
- C:\Windows\System\pAnTPUG.exe
  C:\Windows\System\pAnTPUG.exe
  2⤵
  PID:4836
- C:\Windows\System\JcOJeHl.exe
  C:\Windows\System\JcOJeHl.exe
  2⤵
  PID:4852
- C:\Windows\System\DEYhKKr.exe
  C:\Windows\System\DEYhKKr.exe
  2⤵
  PID:4876
- C:\Windows\System\nCiQUnV.exe
  C:\Windows\System\nCiQUnV.exe
  2⤵
  PID:4896
- C:\Windows\System\QvYBZjh.exe
  C:\Windows\System\QvYBZjh.exe
  2⤵
  PID:4916
- C:\Windows\System\rfzlghW.exe
  C:\Windows\System\rfzlghW.exe
  2⤵
  PID:4932
- C:\Windows\System\AJfZyvV.exe
  C:\Windows\System\AJfZyvV.exe
  2⤵
  PID:4948
- C:\Windows\System\OiMEWGI.exe
  C:\Windows\System\OiMEWGI.exe
  2⤵
  PID:4964
- C:\Windows\System\ciZgejU.exe
  C:\Windows\System\ciZgejU.exe
  2⤵
  PID:4984
- C:\Windows\System\fdFINCX.exe
  C:\Windows\System\fdFINCX.exe
  2⤵
  PID:5000
- C:\Windows\System\bWilhnd.exe
  C:\Windows\System\bWilhnd.exe
  2⤵
  PID:5016
- C:\Windows\System\bqNpzSi.exe
  C:\Windows\System\bqNpzSi.exe
  2⤵
  PID:5032
- C:\Windows\System\zjIhGTz.exe
  C:\Windows\System\zjIhGTz.exe
  2⤵
  PID:5048
- C:\Windows\System\KOgJptW.exe
  C:\Windows\System\KOgJptW.exe
  2⤵
  PID:5064
- C:\Windows\System\YnslBIF.exe
  C:\Windows\System\YnslBIF.exe
  2⤵
  PID:5080
- C:\Windows\System\zWvZegm.exe
  C:\Windows\System\zWvZegm.exe
  2⤵
  PID:5096
- C:\Windows\System\AcLtxIw.exe
  C:\Windows\System\AcLtxIw.exe
  2⤵
  PID:5112
- C:\Windows\System\RmOmuAc.exe
  C:\Windows\System\RmOmuAc.exe
  2⤵
  PID:1864
- C:\Windows\System\qmnXspg.exe
  C:\Windows\System\qmnXspg.exe
  2⤵
  PID:3148
- C:\Windows\System\odgAqRJ.exe
  C:\Windows\System\odgAqRJ.exe
  2⤵
  PID:3212
- C:\Windows\System\gwEHSfJ.exe
  C:\Windows\System\gwEHSfJ.exe
  2⤵
  PID:2596
- C:\Windows\System\iHyXrBX.exe
  C:\Windows\System\iHyXrBX.exe
  2⤵
  PID:1792
- C:\Windows\System\Mrmvskv.exe
  C:\Windows\System\Mrmvskv.exe
  2⤵
  PID:3808
- C:\Windows\System\fhiaPOJ.exe
  C:\Windows\System\fhiaPOJ.exe
  2⤵
  PID:3868
- C:\Windows\System\OGScwNT.exe
  C:\Windows\System\OGScwNT.exe
  2⤵
  PID:3936
- C:\Windows\System\sGYolHN.exe
  C:\Windows\System\sGYolHN.exe
  2⤵
  PID:4000
- C:\Windows\System\ymKJJkZ.exe
  C:\Windows\System\ymKJJkZ.exe
  2⤵
  PID:4068
- C:\Windows\System\zqGwDqL.exe
  C:\Windows\System\zqGwDqL.exe
  2⤵
  PID:2500
- C:\Windows\System\gCCfSvq.exe
  C:\Windows\System\gCCfSvq.exe
  2⤵
  PID:3096
- C:\Windows\System\xKrelDe.exe
  C:\Windows\System\xKrelDe.exe
  2⤵
  PID:1264
- C:\Windows\System\OguxOIy.exe
  C:\Windows\System\OguxOIy.exe
  2⤵
  PID:3376
- C:\Windows\System\QgaBmjx.exe
  C:\Windows\System\QgaBmjx.exe
  2⤵
  PID:3472
- C:\Windows\System\OVJcdaM.exe
  C:\Windows\System\OVJcdaM.exe
  2⤵
  PID:3544
- C:\Windows\System\jknfYRk.exe
  C:\Windows\System\jknfYRk.exe
  2⤵
  PID:2924
- C:\Windows\System\DYQiYBF.exe
  C:\Windows\System\DYQiYBF.exe
  2⤵
  PID:3644
- C:\Windows\System\THensnc.exe
  C:\Windows\System\THensnc.exe
  2⤵
  PID:768
- C:\Windows\System\gfLcRtX.exe
  C:\Windows\System\gfLcRtX.exe
  2⤵
  PID:4560
- C:\Windows\System\eBvqDcX.exe
  C:\Windows\System\eBvqDcX.exe
  2⤵
  PID:4620
- C:\Windows\System\WmfFOim.exe
  C:\Windows\System\WmfFOim.exe
  2⤵
  PID:4688
- C:\Windows\System\gnqJJRx.exe
  C:\Windows\System\gnqJJRx.exe
  2⤵
  PID:4752
- C:\Windows\System\JHcRsNf.exe
  C:\Windows\System\JHcRsNf.exe
  2⤵
  PID:4848
- C:\Windows\System\zqgcJWi.exe
  C:\Windows\System\zqgcJWi.exe
  2⤵
  PID:4924
- C:\Windows\System\ZsHAZvq.exe
  C:\Windows\System\ZsHAZvq.exe
  2⤵
  PID:4992
- C:\Windows\System\bJIrypw.exe
  C:\Windows\System\bJIrypw.exe
  2⤵
  PID:5056
- C:\Windows\System\LLojupH.exe
  C:\Windows\System\LLojupH.exe
  2⤵
  PID:3108
- C:\Windows\System\PwYFIcV.exe
  C:\Windows\System\PwYFIcV.exe
  2⤵
  PID:1436
- C:\Windows\System\NvFwLgu.exe
  C:\Windows\System\NvFwLgu.exe
  2⤵
  PID:3968
- C:\Windows\System\WeqnXzl.exe
  C:\Windows\System\WeqnXzl.exe
  2⤵
  PID:1776
- C:\Windows\System\BypzXpT.exe
  C:\Windows\System\BypzXpT.exe
  2⤵
  PID:5124
- C:\Windows\System\HLsOXme.exe
  C:\Windows\System\HLsOXme.exe
  2⤵
  PID:5140
- C:\Windows\System\muOPdPS.exe
  C:\Windows\System\muOPdPS.exe
  2⤵
  PID:5156
- C:\Windows\System\EtNewHW.exe
  C:\Windows\System\EtNewHW.exe
  2⤵
  PID:5176
- C:\Windows\System\QEULGTG.exe
  C:\Windows\System\QEULGTG.exe
  2⤵
  PID:5192
- C:\Windows\System\tCrwrve.exe
  C:\Windows\System\tCrwrve.exe
  2⤵
  PID:5208
- C:\Windows\System\QvGcOKh.exe
  C:\Windows\System\QvGcOKh.exe
  2⤵
  PID:5224
- C:\Windows\System\lSIClkW.exe
  C:\Windows\System\lSIClkW.exe
  2⤵
  PID:5256
- C:\Windows\System\jjhaBpG.exe
  C:\Windows\System\jjhaBpG.exe
  2⤵
  PID:5284
- C:\Windows\System\ztgfcsZ.exe
  C:\Windows\System\ztgfcsZ.exe
  2⤵
  PID:5300
- C:\Windows\System\aVkwLXZ.exe
  C:\Windows\System\aVkwLXZ.exe
  2⤵
  PID:5320
- C:\Windows\System\oAsanza.exe
  C:\Windows\System\oAsanza.exe
  2⤵
  PID:5336
- C:\Windows\System\KByRyzD.exe
  C:\Windows\System\KByRyzD.exe
  2⤵
  PID:5352
- C:\Windows\System\UloFKgA.exe
  C:\Windows\System\UloFKgA.exe
  2⤵
  PID:5368
- C:\Windows\System\mTjEmJd.exe
  C:\Windows\System\mTjEmJd.exe
  2⤵
  PID:5384
- C:\Windows\System\cbUkLqt.exe
  C:\Windows\System\cbUkLqt.exe
  2⤵
  PID:5400
- C:\Windows\System\bDiUnab.exe
  C:\Windows\System\bDiUnab.exe
  2⤵
  PID:5416
- C:\Windows\System\LihHTlX.exe
  C:\Windows\System\LihHTlX.exe
  2⤵
  PID:5432
- C:\Windows\System\stPCMaY.exe
  C:\Windows\System\stPCMaY.exe
  2⤵
  PID:5448
- C:\Windows\System\XvsWFST.exe
  C:\Windows\System\XvsWFST.exe
  2⤵
  PID:5468
- C:\Windows\System\YeLbLFG.exe
  C:\Windows\System\YeLbLFG.exe
  2⤵
  PID:5488
- C:\Windows\System\ZQfPSxq.exe
  C:\Windows\System\ZQfPSxq.exe
  2⤵
  PID:5504
- C:\Windows\System\KocArPm.exe
  C:\Windows\System\KocArPm.exe
  2⤵
  PID:5520
- C:\Windows\System\PFcamrj.exe
  C:\Windows\System\PFcamrj.exe
  2⤵
  PID:5536
- C:\Windows\System\SFCPzUt.exe
  C:\Windows\System\SFCPzUt.exe
  2⤵
  PID:5552
- C:\Windows\System\ALTpeTe.exe
  C:\Windows\System\ALTpeTe.exe
  2⤵
  PID:5572
- C:\Windows\System\lIjwfPJ.exe
  C:\Windows\System\lIjwfPJ.exe
  2⤵
  PID:5592
- C:\Windows\System\LDyqPTs.exe
  C:\Windows\System\LDyqPTs.exe
  2⤵
  PID:5608
- C:\Windows\System\esFIWFz.exe
  C:\Windows\System\esFIWFz.exe
  2⤵
  PID:5720
- C:\Windows\System\EDGHOfZ.exe
  C:\Windows\System\EDGHOfZ.exe
  2⤵
  PID:5760
- C:\Windows\System\uSvbzrc.exe
  C:\Windows\System\uSvbzrc.exe
  2⤵
  PID:5776
- C:\Windows\System\LSUkJVP.exe
  C:\Windows\System\LSUkJVP.exe
  2⤵
  PID:5796
- C:\Windows\System\hosBPPe.exe
  C:\Windows\System\hosBPPe.exe
  2⤵
  PID:5816
- C:\Windows\System\kvdGzaB.exe
  C:\Windows\System\kvdGzaB.exe
  2⤵
  PID:5948
- C:\Windows\System\FpOjrIz.exe
  C:\Windows\System\FpOjrIz.exe
  2⤵
  PID:5980
- C:\Windows\System\dwdauow.exe
  C:\Windows\System\dwdauow.exe
  2⤵
  PID:6004
- C:\Windows\System\OIjEwzp.exe
  C:\Windows\System\OIjEwzp.exe
  2⤵
  PID:6028
- C:\Windows\System\LloPAKc.exe
  C:\Windows\System\LloPAKc.exe
  2⤵
  PID:6044
- C:\Windows\System\qfxxHnz.exe
  C:\Windows\System\qfxxHnz.exe
  2⤵
  PID:6104
- C:\Windows\System\SvWzcmv.exe
  C:\Windows\System\SvWzcmv.exe
  2⤵
  PID:2236
- C:\Windows\System\HmUPmfL.exe
  C:\Windows\System\HmUPmfL.exe
  2⤵
  PID:3140
- C:\Windows\System\ZPVKAvV.exe
  C:\Windows\System\ZPVKAvV.exe
  2⤵
  PID:5424
- C:\Windows\System\uFYGQsw.exe
  C:\Windows\System\uFYGQsw.exe
  2⤵
  PID:5528
- C:\Windows\System\QXDqLJk.exe
  C:\Windows\System\QXDqLJk.exe
  2⤵
  PID:5364
- C:\Windows\System\APvMROZ.exe
  C:\Windows\System\APvMROZ.exe
  2⤵
  PID:2932
- C:\Windows\System\RXdhDJw.exe
  C:\Windows\System\RXdhDJw.exe
  2⤵
  PID:4868
- C:\Windows\System\DjbAney.exe
  C:\Windows\System\DjbAney.exe
  2⤵
  PID:2432
- C:\Windows\System\nHslSfe.exe
  C:\Windows\System\nHslSfe.exe
  2⤵
  PID:3516
- C:\Windows\System\cXevMAw.exe
  C:\Windows\System\cXevMAw.exe
  2⤵
  PID:4528
- C:\Windows\System\JMMqvOx.exe
  C:\Windows\System\JMMqvOx.exe
  2⤵
  PID:3336
- C:\Windows\System\FzuVcJR.exe
  C:\Windows\System\FzuVcJR.exe
  2⤵
  PID:2112
- C:\Windows\System\yAMAoIS.exe
  C:\Windows\System\yAMAoIS.exe
  2⤵
  PID:3756
- C:\Windows\System\WHUCCxw.exe
  C:\Windows\System\WHUCCxw.exe
  2⤵
  PID:3984
- C:\Windows\System\NtJSAEz.exe
  C:\Windows\System\NtJSAEz.exe
  2⤵
  PID:4048
- C:\Windows\System\VHOgwVA.exe
  C:\Windows\System\VHOgwVA.exe
  2⤵
  PID:4088
- C:\Windows\System\DktETHQ.exe
  C:\Windows\System\DktETHQ.exe
  2⤵
  PID:2940
- C:\Windows\System\zAGzZYF.exe
  C:\Windows\System\zAGzZYF.exe
  2⤵
  PID:2952
- C:\Windows\System\DcOMVIV.exe
  C:\Windows\System\DcOMVIV.exe
  2⤵
  PID:3456
- C:\Windows\System\qsUIgiv.exe
  C:\Windows\System\qsUIgiv.exe
  2⤵
  PID:4168
- C:\Windows\System\EsDtLKZ.exe
  C:\Windows\System\EsDtLKZ.exe
  2⤵
  PID:4232
- C:\Windows\System\PefDvnC.exe
  C:\Windows\System\PefDvnC.exe
  2⤵
  PID:4292
- C:\Windows\System\wShTCjF.exe
  C:\Windows\System\wShTCjF.exe
  2⤵
  PID:4324
- C:\Windows\System\hHzNxYC.exe
  C:\Windows\System\hHzNxYC.exe
  2⤵
  PID:3440
- C:\Windows\System\mXbuDOM.exe
  C:\Windows\System\mXbuDOM.exe
  2⤵
  PID:5264
- C:\Windows\System\PNhwUhw.exe
  C:\Windows\System\PNhwUhw.exe
  2⤵
  PID:4956
- C:\Windows\System\ebEqhjV.exe
  C:\Windows\System\ebEqhjV.exe
  2⤵
  PID:4344
- C:\Windows\System\qIHhWmY.exe
  C:\Windows\System\qIHhWmY.exe
  2⤵
  PID:4360
- C:\Windows\System\zwZQrfR.exe
  C:\Windows\System\zwZQrfR.exe
  2⤵
  PID:4404
- C:\Windows\System\BhaGjQO.exe
  C:\Windows\System\BhaGjQO.exe
  2⤵
  PID:4416
- C:\Windows\System\AbuOCly.exe
  C:\Windows\System\AbuOCly.exe
  2⤵
  PID:4432
- C:\Windows\System\LOSbuQr.exe
  C:\Windows\System\LOSbuQr.exe
  2⤵
  PID:4448
- C:\Windows\System\hbuZshf.exe
  C:\Windows\System\hbuZshf.exe
  2⤵
  PID:4464
- C:\Windows\System\MgYtXEP.exe
  C:\Windows\System\MgYtXEP.exe
  2⤵
  PID:4508
- C:\Windows\System\neYwfRN.exe
  C:\Windows\System\neYwfRN.exe
  2⤵
  PID:4572
- C:\Windows\System\qVaZryZ.exe
  C:\Windows\System\qVaZryZ.exe
  2⤵
  PID:4636
- C:\Windows\System\eTutgcc.exe
  C:\Windows\System\eTutgcc.exe
  2⤵
  PID:4700
- C:\Windows\System\foDmgdD.exe
  C:\Windows\System\foDmgdD.exe
  2⤵
  PID:4764
- C:\Windows\System\cHeMVsz.exe
  C:\Windows\System\cHeMVsz.exe
  2⤵
  PID:4864
- C:\Windows\System\iGPBXVJ.exe
  C:\Windows\System\iGPBXVJ.exe
  2⤵
  PID:4976
- C:\Windows\System\znyHoRH.exe
  C:\Windows\System\znyHoRH.exe
  2⤵
  PID:3276
- C:\Windows\System\zJJdcFD.exe
  C:\Windows\System\zJJdcFD.exe
  2⤵
  PID:3904
- C:\Windows\System\hcnHPFW.exe
  C:\Windows\System\hcnHPFW.exe
  2⤵
  PID:2240
- C:\Windows\System\nQzSUKD.exe
  C:\Windows\System\nQzSUKD.exe
  2⤵
  PID:3360
- C:\Windows\System\cUhmJYF.exe
  C:\Windows\System\cUhmJYF.exe
  2⤵
  PID:272
- C:\Windows\System\MWwjrLv.exe
  C:\Windows\System\MWwjrLv.exe
  2⤵
  PID:4112
- C:\Windows\System\tArYVpJ.exe
  C:\Windows\System\tArYVpJ.exe
  2⤵
  PID:4180
- C:\Windows\System\KrYIDKm.exe
  C:\Windows\System\KrYIDKm.exe
  2⤵
  PID:4244
- C:\Windows\System\nCgqEpR.exe
  C:\Windows\System\nCgqEpR.exe
  2⤵
  PID:4312
- C:\Windows\System\nIoxYCU.exe
  C:\Windows\System\nIoxYCU.exe
  2⤵
  PID:5272
- C:\Windows\System\fFosVVJ.exe
  C:\Windows\System\fFosVVJ.exe
  2⤵
  PID:5316
- C:\Windows\System\FmcbiID.exe
  C:\Windows\System\FmcbiID.exe
  2⤵
  PID:5380
- C:\Windows\System\pgSxGor.exe
  C:\Windows\System\pgSxGor.exe
  2⤵
  PID:5476
- C:\Windows\System\eilcBjU.exe
  C:\Windows\System\eilcBjU.exe
  2⤵
  PID:5516
- C:\Windows\System\cKLtUxa.exe
  C:\Windows\System\cKLtUxa.exe
  2⤵
  PID:5584
- C:\Windows\System\smkyZEv.exe
  C:\Windows\System\smkyZEv.exe
  2⤵
  PID:5632
- C:\Windows\System\vslbReP.exe
  C:\Windows\System\vslbReP.exe
  2⤵
  PID:5656
- C:\Windows\System\BKyweji.exe
  C:\Windows\System\BKyweji.exe
  2⤵
  PID:5728
- C:\Windows\System\UFKfzne.exe
  C:\Windows\System\UFKfzne.exe
  2⤵
  PID:5752
- C:\Windows\System\yjdESgh.exe
  C:\Windows\System\yjdESgh.exe
  2⤵
  PID:5708
- C:\Windows\System\zJAytyI.exe
  C:\Windows\System\zJAytyI.exe
  2⤵
  PID:5716
- C:\Windows\System\xlNyiiZ.exe
  C:\Windows\System\xlNyiiZ.exe
  2⤵
  PID:5804
- C:\Windows\System\cRKiZLH.exe
  C:\Windows\System\cRKiZLH.exe
  2⤵
  PID:5828
- C:\Windows\System\VwOBYAA.exe
  C:\Windows\System\VwOBYAA.exe
  2⤵
  PID:2716
- C:\Windows\System\nWqkBjz.exe
  C:\Windows\System\nWqkBjz.exe
  2⤵
  PID:5840
- C:\Windows\System\bgfnhpy.exe
  C:\Windows\System\bgfnhpy.exe
  2⤵
  PID:2272
- C:\Windows\System\gcwNLBp.exe
  C:\Windows\System\gcwNLBp.exe
  2⤵
  PID:5868
- C:\Windows\System\ZJqaVpK.exe
  C:\Windows\System\ZJqaVpK.exe
  2⤵
  PID:3056
- C:\Windows\System\LkGOiGQ.exe
  C:\Windows\System\LkGOiGQ.exe
  2⤵
  PID:5892
- C:\Windows\System\VBSpwEX.exe
  C:\Windows\System\VBSpwEX.exe
  2⤵
  PID:5904
- C:\Windows\System\ZmLzjbN.exe
  C:\Windows\System\ZmLzjbN.exe
  2⤵
  PID:5936
- C:\Windows\System\aqPcnwS.exe
  C:\Windows\System\aqPcnwS.exe
  2⤵
  PID:2840
- C:\Windows\System\iVGYMlB.exe
  C:\Windows\System\iVGYMlB.exe
  2⤵
  PID:5964
- C:\Windows\System\Okvykcv.exe
  C:\Windows\System\Okvykcv.exe
  2⤵
  PID:2568
- C:\Windows\System\AEvKFem.exe
  C:\Windows\System\AEvKFem.exe
  2⤵
  PID:5976
- C:\Windows\System\LGnnCWb.exe
  C:\Windows\System\LGnnCWb.exe
  2⤵
  PID:6020
- C:\Windows\System\mFLjvDh.exe
  C:\Windows\System\mFLjvDh.exe
  2⤵
  PID:5812
- C:\Windows\System\STAAejx.exe
  C:\Windows\System\STAAejx.exe
  2⤵
  PID:6060
- C:\Windows\System\jhHJxdU.exe
  C:\Windows\System\jhHJxdU.exe
  2⤵
  PID:6092
- C:\Windows\System\Vgyhirf.exe
  C:\Windows\System\Vgyhirf.exe
  2⤵
  PID:6076
- C:\Windows\System\otXHDVU.exe
  C:\Windows\System\otXHDVU.exe
  2⤵
  PID:3060
- C:\Windows\System\QMHxjQJ.exe
  C:\Windows\System\QMHxjQJ.exe
  2⤵
  PID:6128
- C:\Windows\System\UaGJtYI.exe
  C:\Windows\System\UaGJtYI.exe
  2⤵
  PID:1724
- C:\Windows\System\GmVjwtG.exe
  C:\Windows\System\GmVjwtG.exe
  2⤵
  PID:5028
- C:\Windows\System\afrlwhe.exe
  C:\Windows\System\afrlwhe.exe
  2⤵
  PID:812
- C:\Windows\System\USzwQEh.exe
  C:\Windows\System\USzwQEh.exe
  2⤵
  PID:4888
- C:\Windows\System\QHCRBsv.exe
  C:\Windows\System\QHCRBsv.exe
  2⤵
  PID:5132
- C:\Windows\System\qjbHybt.exe
  C:\Windows\System\qjbHybt.exe
  2⤵
  PID:5232
- C:\Windows\System\abkkvOZ.exe
  C:\Windows\System\abkkvOZ.exe
  2⤵
  PID:5252
- C:\Windows\System\dXUpyOf.exe
  C:\Windows\System\dXUpyOf.exe
  2⤵
  PID:3852
- C:\Windows\System\ybzsLnM.exe
  C:\Windows\System\ybzsLnM.exe
  2⤵
  PID:3916
- C:\Windows\System\lhkXcGF.exe
  C:\Windows\System\lhkXcGF.exe
  2⤵
  PID:5560
- C:\Windows\System\ThvveNl.exe
  C:\Windows\System\ThvveNl.exe
  2⤵
  PID:5460
- C:\Windows\System\SCOHAgS.exe
  C:\Windows\System\SCOHAgS.exe
  2⤵
  PID:5332
- C:\Windows\System\CjjHKWk.exe
  C:\Windows\System\CjjHKWk.exe
  2⤵
  PID:4480
- C:\Windows\System\bOUTdwy.exe
  C:\Windows\System\bOUTdwy.exe
  2⤵
  PID:4860
- C:\Windows\System\BGUYoyz.exe
  C:\Windows\System\BGUYoyz.exe
  2⤵
  PID:4980
- C:\Windows\System\crCMXoT.exe
  C:\Windows\System\crCMXoT.exe
  2⤵
  PID:3708
- C:\Windows\System\kkTNgIx.exe
  C:\Windows\System\kkTNgIx.exe
  2⤵
  PID:5600
- C:\Windows\System\gDUMIeQ.exe
  C:\Windows\System\gDUMIeQ.exe
  2⤵
  PID:632
- C:\Windows\System\uHOCIhb.exe
  C:\Windows\System\uHOCIhb.exe
  2⤵
  PID:5168
- C:\Windows\System\dgjtkvU.exe
  C:\Windows\System\dgjtkvU.exe
  2⤵
  PID:3956
- C:\Windows\System\jvICJRx.exe
  C:\Windows\System\jvICJRx.exe
  2⤵
  PID:3748
- C:\Windows\System\DJawbzW.exe
  C:\Windows\System\DJawbzW.exe
  2⤵
  PID:3752
- C:\Windows\System\JfcvOJI.exe
  C:\Windows\System\JfcvOJI.exe
  2⤵
  PID:2700
- C:\Windows\System\uFQGfFZ.exe
  C:\Windows\System\uFQGfFZ.exe
  2⤵
  PID:3256
- C:\Windows\System\lmXUDUl.exe
  C:\Windows\System\lmXUDUl.exe
  2⤵
  PID:2848
- C:\Windows\System\ydmSMkY.exe
  C:\Windows\System\ydmSMkY.exe
  2⤵
  PID:2460
- C:\Windows\System\btTUMIc.exe
  C:\Windows\System\btTUMIc.exe
  2⤵
  PID:4228
- C:\Windows\System\ObTBHaA.exe
  C:\Windows\System\ObTBHaA.exe
  2⤵
  PID:4128
- C:\Windows\System\pjzJhiJ.exe
  C:\Windows\System\pjzJhiJ.exe
  2⤵
  PID:4960
- C:\Windows\System\rCduyvP.exe
  C:\Windows\System\rCduyvP.exe
  2⤵
  PID:3408
- C:\Windows\System\OtVviHN.exe
  C:\Windows\System\OtVviHN.exe
  2⤵
  PID:540
- C:\Windows\System\YJJnjMi.exe
  C:\Windows\System\YJJnjMi.exe
  2⤵
  PID:4336
- C:\Windows\System\KArUcbF.exe
  C:\Windows\System\KArUcbF.exe
  2⤵
  PID:4380
- C:\Windows\System\dpqOSZP.exe
  C:\Windows\System\dpqOSZP.exe
  2⤵
  PID:4424
- C:\Windows\System\TSQNAKW.exe
  C:\Windows\System\TSQNAKW.exe
  2⤵
  PID:4440
- C:\Windows\System\IACWUCt.exe
  C:\Windows\System\IACWUCt.exe
  2⤵
  PID:4604
- C:\Windows\System\AgEKcYx.exe
  C:\Windows\System\AgEKcYx.exe
  2⤵
  PID:4460
- C:\Windows\System\XibLJln.exe
  C:\Windows\System\XibLJln.exe
  2⤵
  PID:4796
- C:\Windows\System\ONGdmoB.exe
  C:\Windows\System\ONGdmoB.exe
  2⤵
  PID:5076
- C:\Windows\System\IXfSXQM.exe
  C:\Windows\System\IXfSXQM.exe
  2⤵
  PID:3192
- C:\Windows\System\ZwGWSPv.exe
  C:\Windows\System\ZwGWSPv.exe
  2⤵
  PID:2372
- C:\Windows\System\XrVkvEo.exe
  C:\Windows\System\XrVkvEo.exe
  2⤵
  PID:4684
- C:\Windows\System\qVFcXOP.exe
  C:\Windows\System\qVFcXOP.exe
  2⤵
  PID:3492
- C:\Windows\System\JDMueLl.exe
  C:\Windows\System\JDMueLl.exe
  2⤵
  PID:3244
- C:\Windows\System\HpQBXJU.exe
  C:\Windows\System\HpQBXJU.exe
  2⤵
  PID:3596
- C:\Windows\System\FaNilsh.exe
  C:\Windows\System\FaNilsh.exe
  2⤵
  PID:4276
- C:\Windows\System\ExfYwlO.exe
  C:\Windows\System\ExfYwlO.exe
  2⤵
  PID:5148
- C:\Windows\System\qVJiBDH.exe
  C:\Windows\System\qVJiBDH.exe
  2⤵
  PID:4308
- C:\Windows\System\wKuJgeF.exe
  C:\Windows\System\wKuJgeF.exe
  2⤵
  PID:5484
- C:\Windows\System\rxJleDW.exe
  C:\Windows\System\rxJleDW.exe
  2⤵
  PID:5624
- C:\Windows\System\HbPsYFV.exe
  C:\Windows\System\HbPsYFV.exe
  2⤵
  PID:5748
- C:\Windows\System\oDrtChC.exe
  C:\Windows\System\oDrtChC.exe
  2⤵
  PID:1284
- C:\Windows\System\PISikSH.exe
  C:\Windows\System\PISikSH.exe
  2⤵
  PID:2928
- C:\Windows\System\plIuLkL.exe
  C:\Windows\System\plIuLkL.exe
  2⤵
  PID:5440
- C:\Windows\System\YxsHyLf.exe
  C:\Windows\System\YxsHyLf.exe
  2⤵
  PID:1844
- C:\Windows\System\TMNxtkQ.exe
  C:\Windows\System\TMNxtkQ.exe
  2⤵
  PID:5920
- C:\Windows\System\IdQIyIv.exe
  C:\Windows\System\IdQIyIv.exe
  2⤵
  PID:5652
- C:\Windows\System\HDhxlXv.exe
  C:\Windows\System\HDhxlXv.exe
  2⤵
  PID:5712
- C:\Windows\System\vHNPWQL.exe
  C:\Windows\System\vHNPWQL.exe
  2⤵
  PID:5944
- C:\Windows\System\WMqlVcO.exe
  C:\Windows\System\WMqlVcO.exe
  2⤵
  PID:5888
- C:\Windows\System\sCmsoew.exe
  C:\Windows\System\sCmsoew.exe
  2⤵
  PID:5996
- C:\Windows\System\LapEGwO.exe
  C:\Windows\System\LapEGwO.exe
  2⤵
  PID:6012
- C:\Windows\System\RYFVoIT.exe
  C:\Windows\System\RYFVoIT.exe
  2⤵
  PID:6056
- C:\Windows\System\cCtzGBP.exe
  C:\Windows\System\cCtzGBP.exe
  2⤵
  PID:6120
- C:\Windows\System\KCoknPX.exe
  C:\Windows\System\KCoknPX.exe
  2⤵
  PID:4892
- C:\Windows\System\FfOBdNH.exe
  C:\Windows\System\FfOBdNH.exe
  2⤵
  PID:6000
- C:\Windows\System\pwqOMPi.exe
  C:\Windows\System\pwqOMPi.exe
  2⤵
  PID:6068
- C:\Windows\System\iLGLYvo.exe
  C:\Windows\System\iLGLYvo.exe
  2⤵
  PID:6136
- C:\Windows\System\AacSVNP.exe
  C:\Windows\System\AacSVNP.exe
  2⤵
  PID:3208
- C:\Windows\System\EkhjORp.exe
  C:\Windows\System\EkhjORp.exe
  2⤵
  PID:5244
- C:\Windows\System\MhFupus.exe
  C:\Windows\System\MhFupus.exe
  2⤵
  PID:332
- C:\Windows\System\CHnlpbB.exe
  C:\Windows\System\CHnlpbB.exe
  2⤵
  PID:3824
- C:\Windows\System\cQwwQuP.exe
  C:\Windows\System\cQwwQuP.exe
  2⤵
  PID:3920
- C:\Windows\System\TtClLrA.exe
  C:\Windows\System\TtClLrA.exe
  2⤵
  PID:5396
- C:\Windows\System\FqjfTGU.exe
  C:\Windows\System\FqjfTGU.exe
  2⤵
  PID:5012
- C:\Windows\System\JwJeAjK.exe
  C:\Windows\System\JwJeAjK.exe
  2⤵
  PID:3952
- C:\Windows\System\PaToXRA.exe
  C:\Windows\System\PaToXRA.exe
  2⤵
  PID:3560
- C:\Windows\System\gKoZAzh.exe
  C:\Windows\System\gKoZAzh.exe
  2⤵
  PID:4264
- C:\Windows\System\fPDGRAM.exe
  C:\Windows\System\fPDGRAM.exe
  2⤵
  PID:4388
- C:\Windows\System\qZxHflR.exe
  C:\Windows\System\qZxHflR.exe
  2⤵
  PID:4944
- C:\Windows\System\vCDpdfF.exe
  C:\Windows\System\vCDpdfF.exe
  2⤵
  PID:3924
- C:\Windows\System\KXzQOtM.exe
  C:\Windows\System\KXzQOtM.exe
  2⤵
  PID:5564
- C:\Windows\System\irNtMbu.exe
  C:\Windows\System\irNtMbu.exe
  2⤵
  PID:3348
- C:\Windows\System\cZRFYOh.exe
  C:\Windows\System\cZRFYOh.exe
  2⤵
  PID:3324
- C:\Windows\System\JWfVvCp.exe
  C:\Windows\System\JWfVvCp.exe
  2⤵
  PID:4160
- C:\Windows\System\lVmJqdm.exe
  C:\Windows\System\lVmJqdm.exe
  2⤵
  PID:4376
- C:\Windows\System\uEiVdmy.exe
  C:\Windows\System\uEiVdmy.exe
  2⤵
  PID:4476
- C:\Windows\System\lwwqORF.exe
  C:\Windows\System\lwwqORF.exe
  2⤵
  PID:3804
- C:\Windows\System\uBGvOtw.exe
  C:\Windows\System\uBGvOtw.exe
  2⤵
  PID:5108
- C:\Windows\System\AWeWmpP.exe
  C:\Windows\System\AWeWmpP.exe
  2⤵
  PID:5268
- C:\Windows\System\roEHijf.exe
  C:\Windows\System\roEHijf.exe
  2⤵
  PID:5768
- C:\Windows\System\pggQNVF.exe
  C:\Windows\System\pggQNVF.exe
  2⤵
  PID:4456
- C:\Windows\System\kYfOOwY.exe
  C:\Windows\System\kYfOOwY.exe
  2⤵
  PID:4908
- C:\Windows\System\RThFQzw.exe
  C:\Windows\System\RThFQzw.exe
  2⤵
  PID:4784
- C:\Windows\System\RQBHBfX.exe
  C:\Windows\System\RQBHBfX.exe
  2⤵
  PID:3444
- C:\Windows\System\HwDFLrN.exe
  C:\Windows\System\HwDFLrN.exe
  2⤵
  PID:5376
- C:\Windows\System\XvVOavs.exe
  C:\Windows\System\XvVOavs.exe
  2⤵
  PID:5852
- C:\Windows\System\PEvQgDt.exe
  C:\Windows\System\PEvQgDt.exe
  2⤵
  PID:5412
- C:\Windows\System\TgbfWsM.exe
  C:\Windows\System\TgbfWsM.exe
  2⤵
  PID:5924
- C:\Windows\System\GjquZVe.exe
  C:\Windows\System\GjquZVe.exe
  2⤵
  PID:6064
- C:\Windows\System\zJyvxvW.exe
  C:\Windows\System\zJyvxvW.exe
  2⤵
  PID:5788
- C:\Windows\System\kzwmtsP.exe
  C:\Windows\System\kzwmtsP.exe
  2⤵
  PID:2072
- C:\Windows\System\IgEPkbR.exe
  C:\Windows\System\IgEPkbR.exe
  2⤵
  PID:5972
- C:\Windows\System\aPMhZlp.exe
  C:\Windows\System\aPMhZlp.exe
  2⤵
  PID:844
- C:\Windows\System\HvMyNds.exe
  C:\Windows\System\HvMyNds.exe
  2⤵
  PID:5496
- C:\Windows\System\LCgHZxO.exe
  C:\Windows\System\LCgHZxO.exe
  2⤵
  PID:5968
- C:\Windows\System\mjJYbYn.exe
  C:\Windows\System\mjJYbYn.exe
  2⤵
  PID:5248
- C:\Windows\System\HZGcZrd.exe
  C:\Windows\System\HZGcZrd.exe
  2⤵
  PID:668
- C:\Windows\System\eWGcLwD.exe
  C:\Windows\System\eWGcLwD.exe
  2⤵
  PID:2204
- C:\Windows\System\WxGVNKW.exe
  C:\Windows\System\WxGVNKW.exe
  2⤵
  PID:4368
- C:\Windows\System\JCfQEby.exe
  C:\Windows\System\JCfQEby.exe
  2⤵
  PID:4296
- C:\Windows\System\EokgCCK.exe
  C:\Windows\System\EokgCCK.exe
  2⤵
  PID:2532
- C:\Windows\System\RhSUheF.exe
  C:\Windows\System\RhSUheF.exe
  2⤵
  PID:2536
- C:\Windows\System\dnTMtJL.exe
  C:\Windows\System\dnTMtJL.exe
  2⤵
  PID:4356
- C:\Windows\System\wRLAVXK.exe
  C:\Windows\System\wRLAVXK.exe
  2⤵
  PID:4216
- C:\Windows\System\EGqWTkB.exe
  C:\Windows\System\EGqWTkB.exe
  2⤵
  PID:4668
- C:\Windows\System\lwEbeuo.exe
  C:\Windows\System\lwEbeuo.exe
  2⤵
  PID:5308
- C:\Windows\System\OqsZlOA.exe
  C:\Windows\System\OqsZlOA.exe
  2⤵
  PID:3300
- C:\Windows\System\sEbGGVy.exe
  C:\Windows\System\sEbGGVy.exe
  2⤵
  PID:6052
- C:\Windows\System\LumXfkz.exe
  C:\Windows\System\LumXfkz.exe
  2⤵
  PID:6116
- C:\Windows\System\VKcsatI.exe
  C:\Windows\System\VKcsatI.exe
  2⤵
  PID:3792
- C:\Windows\System\jqyGSpx.exe
  C:\Windows\System\jqyGSpx.exe
  2⤵
  PID:3332
- C:\Windows\System\eKtlUwG.exe
  C:\Windows\System\eKtlUwG.exe
  2⤵
  PID:6244
- C:\Windows\System\IaKHbsr.exe
  C:\Windows\System\IaKHbsr.exe
  2⤵
  PID:6260
- C:\Windows\System\AbgHAcd.exe
  C:\Windows\System\AbgHAcd.exe
  2⤵
  PID:6276
- C:\Windows\System\KZiISnZ.exe
  C:\Windows\System\KZiISnZ.exe
  2⤵
  PID:6292
- C:\Windows\System\tFofCHo.exe
  C:\Windows\System\tFofCHo.exe
  2⤵
  PID:6308
- C:\Windows\System\zHfsqmk.exe
  C:\Windows\System\zHfsqmk.exe
  2⤵
  PID:6328
- C:\Windows\System\RFkVwgy.exe
  C:\Windows\System\RFkVwgy.exe
  2⤵
  PID:6344
- C:\Windows\System\HvsLbZW.exe
  C:\Windows\System\HvsLbZW.exe
  2⤵
  PID:6360
- C:\Windows\System\BMXJSAD.exe
  C:\Windows\System\BMXJSAD.exe
  2⤵
  PID:6376
- C:\Windows\System\ZAefrxv.exe
  C:\Windows\System\ZAefrxv.exe
  2⤵
  PID:6392
- C:\Windows\System\SQODSXq.exe
  C:\Windows\System\SQODSXq.exe
  2⤵
  PID:6408
- C:\Windows\System\HtNdOFs.exe
  C:\Windows\System\HtNdOFs.exe
  2⤵
  PID:6424
- C:\Windows\System\yeKrMzh.exe
  C:\Windows\System\yeKrMzh.exe
  2⤵
  PID:6448
- C:\Windows\System\xuHBNIY.exe
  C:\Windows\System\xuHBNIY.exe
  2⤵
  PID:6464
- C:\Windows\System\SKKdQku.exe
  C:\Windows\System\SKKdQku.exe
  2⤵
  PID:6480
- C:\Windows\System\VrgigEM.exe
  C:\Windows\System\VrgigEM.exe
  2⤵
  PID:6496
- C:\Windows\System\YQyKICc.exe
  C:\Windows\System\YQyKICc.exe
  2⤵
  PID:6512
- C:\Windows\System\duOrzkH.exe
  C:\Windows\System\duOrzkH.exe
  2⤵
  PID:6536
- C:\Windows\System\bffEpkC.exe
  C:\Windows\System\bffEpkC.exe
  2⤵
  PID:6552
- C:\Windows\System\ZfudpFY.exe
  C:\Windows\System\ZfudpFY.exe
  2⤵
  PID:6568
- C:\Windows\System\BYZYrjI.exe
  C:\Windows\System\BYZYrjI.exe
  2⤵
  PID:6584
- C:\Windows\System\YZoFJrt.exe
  C:\Windows\System\YZoFJrt.exe
  2⤵
  PID:6604
- C:\Windows\System\qdCOysZ.exe
  C:\Windows\System\qdCOysZ.exe
  2⤵
  PID:6620
- C:\Windows\System\HXJreGb.exe
  C:\Windows\System\HXJreGb.exe
  2⤵
  PID:6636
- C:\Windows\System\gshdDNJ.exe
  C:\Windows\System\gshdDNJ.exe
  2⤵
  PID:6656
- C:\Windows\System\MzuLSJm.exe
  C:\Windows\System\MzuLSJm.exe
  2⤵
  PID:6672
- C:\Windows\System\aENuhoy.exe
  C:\Windows\System\aENuhoy.exe
  2⤵
  PID:6692
- C:\Windows\System\ICxPExv.exe
  C:\Windows\System\ICxPExv.exe
  2⤵
  PID:6708
- C:\Windows\System\qxZYNvn.exe
  C:\Windows\System\qxZYNvn.exe
  2⤵
  PID:6724
- C:\Windows\System\mWLePCH.exe
  C:\Windows\System\mWLePCH.exe
  2⤵
  PID:6740
- C:\Windows\System\UBikHez.exe
  C:\Windows\System\UBikHez.exe
  2⤵
  PID:6756
- C:\Windows\System\mwWpRUd.exe
  C:\Windows\System\mwWpRUd.exe
  2⤵
  PID:6772
- C:\Windows\System\AenbjhR.exe
  C:\Windows\System\AenbjhR.exe
  2⤵
  PID:6792
- C:\Windows\System\ShLFvqS.exe
  C:\Windows\System\ShLFvqS.exe
  2⤵
  PID:6808
- C:\Windows\System\SzsWJyV.exe
  C:\Windows\System\SzsWJyV.exe
  2⤵
  PID:6824
- C:\Windows\System\cMfKhBJ.exe
  C:\Windows\System\cMfKhBJ.exe
  2⤵
  PID:6840
- C:\Windows\System\GNuuKWr.exe
  C:\Windows\System\GNuuKWr.exe
  2⤵
  PID:6856
- C:\Windows\System\GTUiQHb.exe
  C:\Windows\System\GTUiQHb.exe
  2⤵
  PID:6872
- C:\Windows\System\dbcCWaH.exe
  C:\Windows\System\dbcCWaH.exe
  2⤵
  PID:6888
- C:\Windows\System\dlUiiiC.exe
  C:\Windows\System\dlUiiiC.exe
  2⤵
  PID:6904
- C:\Windows\System\kAdXaMo.exe
  C:\Windows\System\kAdXaMo.exe
  2⤵
  PID:6920
- C:\Windows\System\mXrLtWz.exe
  C:\Windows\System\mXrLtWz.exe
  2⤵
  PID:6936
- C:\Windows\System\tkTQifO.exe
  C:\Windows\System\tkTQifO.exe
  2⤵
  PID:6952
- C:\Windows\System\RNvXgRO.exe
  C:\Windows\System\RNvXgRO.exe
  2⤵
  PID:6968
- C:\Windows\System\VGNYsyX.exe
  C:\Windows\System\VGNYsyX.exe
  2⤵
  PID:6984
- C:\Windows\System\TtCnUfP.exe
  C:\Windows\System\TtCnUfP.exe
  2⤵
  PID:7000
- C:\Windows\System\WPQwymN.exe
  C:\Windows\System\WPQwymN.exe
  2⤵
  PID:7016
- C:\Windows\System\yMAWUDS.exe
  C:\Windows\System\yMAWUDS.exe
  2⤵
  PID:7032
- C:\Windows\System\XhqNghn.exe
  C:\Windows\System\XhqNghn.exe
  2⤵
  PID:7048
- C:\Windows\System\pYNjEqW.exe
  C:\Windows\System\pYNjEqW.exe
  2⤵
  PID:7064
- C:\Windows\System\TzVWgYl.exe
  C:\Windows\System\TzVWgYl.exe
  2⤵
  PID:7080
- C:\Windows\System\BcdFwwn.exe
  C:\Windows\System\BcdFwwn.exe
  2⤵
  PID:7096
- C:\Windows\System\IVUMEmV.exe
  C:\Windows\System\IVUMEmV.exe
  2⤵
  PID:7112
- C:\Windows\System\aSPWkyf.exe
  C:\Windows\System\aSPWkyf.exe
  2⤵
  PID:7136
- C:\Windows\System\jwssMsu.exe
  C:\Windows\System\jwssMsu.exe
  2⤵
  PID:7152
- C:\Windows\System\dXCTVQH.exe
  C:\Windows\System\dXCTVQH.exe
  2⤵
  PID:5348
- C:\Windows\System\qRoNJYv.exe
  C:\Windows\System\qRoNJYv.exe
  2⤵
  PID:4352
- C:\Windows\System\tCbFAWI.exe
  C:\Windows\System\tCbFAWI.exe
  2⤵
  PID:4732
- C:\Windows\System\ifbdJGf.exe
  C:\Windows\System\ifbdJGf.exe
  2⤵
  PID:5740
- C:\Windows\System\IGCebAR.exe
  C:\Windows\System\IGCebAR.exe
  2⤵
  PID:5916
- C:\Windows\System\wClwTxw.exe
  C:\Windows\System\wClwTxw.exe
  2⤵
  PID:5456
- C:\Windows\System\aXUNmBQ.exe
  C:\Windows\System\aXUNmBQ.exe
  2⤵
  PID:5040
- C:\Windows\System\YwFmiMJ.exe
  C:\Windows\System\YwFmiMJ.exe
  2⤵
  PID:2888
- C:\Windows\System\NcIHbEl.exe
  C:\Windows\System\NcIHbEl.exe
  2⤵
  PID:1684
- C:\Windows\System\lZjRlnF.exe
  C:\Windows\System\lZjRlnF.exe
  2⤵
  PID:6160
- C:\Windows\System\DMtTJmR.exe
  C:\Windows\System\DMtTJmR.exe
  2⤵
  PID:444
- C:\Windows\System\kCeJJWF.exe
  C:\Windows\System\kCeJJWF.exe
  2⤵
  PID:5932
- C:\Windows\System\ZoJWlxk.exe
  C:\Windows\System\ZoJWlxk.exe
  2⤵
  PID:6180
- C:\Windows\System\UCXFJEM.exe
  C:\Windows\System\UCXFJEM.exe
  2⤵
  PID:6196
- C:\Windows\System\xXIBEcm.exe
  C:\Windows\System\xXIBEcm.exe
  2⤵
  PID:6212
- C:\Windows\System\mqDcRIG.exe
  C:\Windows\System\mqDcRIG.exe
  2⤵
  PID:6228
- C:\Windows\System\RpJZqmU.exe
  C:\Windows\System\RpJZqmU.exe
  2⤵
  PID:6268
- C:\Windows\System\qCiBUQl.exe
  C:\Windows\System\qCiBUQl.exe
  2⤵
  PID:6252
- C:\Windows\System\ZexulBi.exe
  C:\Windows\System\ZexulBi.exe
  2⤵
  PID:6316
- C:\Windows\System\oBvXtNm.exe
  C:\Windows\System\oBvXtNm.exe
  2⤵
  PID:6356
- C:\Windows\System\HfjwQAA.exe
  C:\Windows\System\HfjwQAA.exe
  2⤵
  PID:6420
- C:\Windows\System\adMwwQs.exe
  C:\Windows\System\adMwwQs.exe
  2⤵
  PID:6492
- C:\Windows\System\YQytnXS.exe
  C:\Windows\System\YQytnXS.exe
  2⤵
  PID:6532
- C:\Windows\System\SsnoDkx.exe
  C:\Windows\System\SsnoDkx.exe
  2⤵
  PID:6592
- C:\Windows\System\VsSvdCf.exe
  C:\Windows\System\VsSvdCf.exe
  2⤵
  PID:6664
- C:\Windows\System\vqyunJE.exe
  C:\Windows\System\vqyunJE.exe
  2⤵
  PID:6732
- C:\Windows\System\OqhBRwf.exe
  C:\Windows\System\OqhBRwf.exe
  2⤵
  PID:6768
- C:\Windows\System\CugwMcD.exe
  C:\Windows\System\CugwMcD.exe
  2⤵
  PID:6688
- C:\Windows\System\UMzmKOv.exe
  C:\Windows\System\UMzmKOv.exe
  2⤵
  PID:6404
- C:\Windows\System\yXAJLym.exe
  C:\Windows\System\yXAJLym.exe
  2⤵
  PID:6444
- C:\Windows\System\pJqzUpn.exe
  C:\Windows\System\pJqzUpn.exe
  2⤵
  PID:6508
- C:\Windows\System\bJPFNMK.exe
  C:\Windows\System\bJPFNMK.exe
  2⤵
  PID:6612
- C:\Windows\System\DlQaaLI.exe
  C:\Windows\System\DlQaaLI.exe
  2⤵
  PID:6652
- C:\Windows\System\SeQjUNg.exe
  C:\Windows\System\SeQjUNg.exe
  2⤵
  PID:6716
- C:\Windows\System\utQPMun.exe
  C:\Windows\System\utQPMun.exe
  2⤵
  PID:6836
- C:\Windows\System\ncoHRHe.exe
  C:\Windows\System\ncoHRHe.exe
  2⤵
  PID:6748
- C:\Windows\System\tLumCLU.exe
  C:\Windows\System\tLumCLU.exe
  2⤵
  PID:6820
- C:\Windows\System\awzKGoR.exe
  C:\Windows\System\awzKGoR.exe
  2⤵
  PID:6928
- C:\Windows\System\DSTuoXb.exe
  C:\Windows\System\DSTuoXb.exe
  2⤵
  PID:6964
- C:\Windows\System\TpgaQMK.exe
  C:\Windows\System\TpgaQMK.exe
  2⤵
  PID:6992
- C:\Windows\System\iSNEoLc.exe
  C:\Windows\System\iSNEoLc.exe
  2⤵
  PID:7028
- C:\Windows\System\yGkCgxo.exe
  C:\Windows\System\yGkCgxo.exe
  2⤵
  PID:7092
- C:\Windows\System\vMIcAOk.exe
  C:\Windows\System\vMIcAOk.exe
  2⤵
  PID:7132
- C:\Windows\System\nKYekpY.exe
  C:\Windows\System\nKYekpY.exe
  2⤵
  PID:6944
- C:\Windows\System\FRLBmSG.exe
  C:\Windows\System\FRLBmSG.exe
  2⤵
  PID:7012
- C:\Windows\System\vMKWIfJ.exe
  C:\Windows\System\vMKWIfJ.exe
  2⤵
  PID:7076
- C:\Windows\System\AvmHarO.exe
  C:\Windows\System\AvmHarO.exe
  2⤵
  PID:5824
- C:\Windows\System\IoZzvXT.exe
  C:\Windows\System\IoZzvXT.exe
  2⤵
  PID:4212
- C:\Windows\System\eImEyxI.exe
  C:\Windows\System\eImEyxI.exe
  2⤵
  PID:6084
- C:\Windows\System\hblQiDT.exe
  C:\Windows\System\hblQiDT.exe
  2⤵
  PID:3392
- C:\Windows\System\HnXaRqA.exe
  C:\Windows\System\HnXaRqA.exe
  2⤵
  PID:6204
- C:\Windows\System\myNEpwD.exe
  C:\Windows\System\myNEpwD.exe
  2⤵
  PID:6240
- C:\Windows\System\MLtVCNy.exe
  C:\Windows\System\MLtVCNy.exe
  2⤵
  PID:6416
- C:\Windows\System\RbCNwRj.exe
  C:\Windows\System\RbCNwRj.exe
  2⤵
  PID:6156
- C:\Windows\System\IGEIjCc.exe
  C:\Windows\System\IGEIjCc.exe
  2⤵
  PID:3344
- C:\Windows\System\DUqYLhK.exe
  C:\Windows\System\DUqYLhK.exe
  2⤵
  PID:6764
- C:\Windows\System\EwwxQNU.exe
  C:\Windows\System\EwwxQNU.exe
  2⤵
  PID:5704
- C:\Windows\System\drOATNH.exe
  C:\Windows\System\drOATNH.exe
  2⤵
  PID:6192
- C:\Windows\System\dIDsmPy.exe
  C:\Windows\System\dIDsmPy.exe
  2⤵
  PID:6340
- C:\Windows\System\oezQRco.exe
  C:\Windows\System\oezQRco.exe
  2⤵
  PID:6504
- C:\Windows\System\MzbTbzs.exe
  C:\Windows\System\MzbTbzs.exe
  2⤵
  PID:6700
- C:\Windows\System\aUdnmeW.exe
  C:\Windows\System\aUdnmeW.exe
  2⤵
  PID:6644
- C:\Windows\System\DSycoze.exe
  C:\Windows\System\DSycoze.exe
  2⤵
  PID:6576
- C:\Windows\System\WEoBbRS.exe
  C:\Windows\System\WEoBbRS.exe
  2⤵
  PID:6804
- C:\Windows\System\ZLkSmEp.exe
  C:\Windows\System\ZLkSmEp.exe
  2⤵
  PID:6852
- C:\Windows\System\VpEgJIU.exe
  C:\Windows\System\VpEgJIU.exe
  2⤵
  PID:6868
- C:\Windows\System\nKLBjqI.exe
  C:\Windows\System\nKLBjqI.exe
  2⤵
  PID:7008
- C:\Windows\System\eIqehvI.exe
  C:\Windows\System\eIqehvI.exe
  2⤵
  PID:4412
- C:\Windows\System\zcWMQjh.exe
  C:\Windows\System\zcWMQjh.exe
  2⤵
  PID:6912
- C:\Windows\System\zGkyUFM.exe
  C:\Windows\System\zGkyUFM.exe
  2⤵
  PID:7060
- C:\Windows\System\VfNqWff.exe
  C:\Windows\System\VfNqWff.exe
  2⤵
  PID:7164
- C:\Windows\System\wDwVEKS.exe
  C:\Windows\System\wDwVEKS.exe
  2⤵
  PID:7148
- C:\Windows\System\TtaUdvE.exe
  C:\Windows\System\TtaUdvE.exe
  2⤵
  PID:5184
- C:\Windows\System\KVPGVZg.exe
  C:\Windows\System\KVPGVZg.exe
  2⤵
  PID:6528
- C:\Windows\System\bmpExLW.exe
  C:\Windows\System\bmpExLW.exe
  2⤵
  PID:6324
- C:\Windows\System\Gntbbxb.exe
  C:\Windows\System\Gntbbxb.exe
  2⤵
  PID:1572
- C:\Windows\System\akWCDRD.exe
  C:\Windows\System\akWCDRD.exe
  2⤵
  PID:4544
- C:\Windows\System\iNxqRkJ.exe
  C:\Windows\System\iNxqRkJ.exe
  2⤵
  PID:6580
- C:\Windows\System\LRiqSHP.exe
  C:\Windows\System\LRiqSHP.exe
  2⤵
  PID:6680
- C:\Windows\System\bvPPgrN.exe
  C:\Windows\System\bvPPgrN.exe
  2⤵
  PID:6880
- C:\Windows\System\lCzuOoH.exe
  C:\Windows\System\lCzuOoH.exe
  2⤵
  PID:3888
- C:\Windows\System\BgzQSuG.exe
  C:\Windows\System\BgzQSuG.exe
  2⤵
  PID:6980
- C:\Windows\System\GBOVaAp.exe
  C:\Windows\System\GBOVaAp.exe
  2⤵
  PID:6388
- C:\Windows\System\JMRfEAh.exe
  C:\Windows\System\JMRfEAh.exe
  2⤵
  PID:5884
- C:\Windows\System\QKsNimI.exe
  C:\Windows\System\QKsNimI.exe
  2⤵
  PID:6784
- C:\Windows\System\iLFdBWl.exe
  C:\Windows\System\iLFdBWl.exe
  2⤵
  PID:6460
- C:\Windows\System\egOUFqe.exe
  C:\Windows\System\egOUFqe.exe
  2⤵
  PID:7072
- C:\Windows\System\zjKkhOg.exe
  C:\Windows\System\zjKkhOg.exe
  2⤵
  PID:4144
- C:\Windows\System\tcUgMsA.exe
  C:\Windows\System\tcUgMsA.exe
  2⤵
  PID:6916
- C:\Windows\System\ktxremg.exe
  C:\Windows\System\ktxremg.exe
  2⤵
  PID:6436
- C:\Windows\System\AyxxGXc.exe
  C:\Windows\System\AyxxGXc.exe
  2⤵
  PID:5700
- C:\Windows\System\Bhskggt.exe
  C:\Windows\System\Bhskggt.exe
  2⤵
  PID:7172
- C:\Windows\System\BWNxidq.exe
  C:\Windows\System\BWNxidq.exe
  2⤵
  PID:7188
- C:\Windows\System\qAriTih.exe
  C:\Windows\System\qAriTih.exe
  2⤵
  PID:7204
- C:\Windows\System\GzhBMMz.exe
  C:\Windows\System\GzhBMMz.exe
  2⤵
  PID:7220
- C:\Windows\System\BdGhHOG.exe
  C:\Windows\System\BdGhHOG.exe
  2⤵
  PID:7236
- C:\Windows\System\nlPcIBv.exe
  C:\Windows\System\nlPcIBv.exe
  2⤵
  PID:7252
- C:\Windows\System\SMsrxUM.exe
  C:\Windows\System\SMsrxUM.exe
  2⤵
  PID:7268
- C:\Windows\System\EXcwZWV.exe
  C:\Windows\System\EXcwZWV.exe
  2⤵
  PID:7284
- C:\Windows\System\KHjkKqY.exe
  C:\Windows\System\KHjkKqY.exe
  2⤵
  PID:7300
- C:\Windows\System\axtsyAR.exe
  C:\Windows\System\axtsyAR.exe
  2⤵
  PID:7316
- C:\Windows\System\NdWwVyy.exe
  C:\Windows\System\NdWwVyy.exe
  2⤵
  PID:7332
- C:\Windows\System\DBTJLZd.exe
  C:\Windows\System\DBTJLZd.exe
  2⤵
  PID:7348
- C:\Windows\System\vmpGciC.exe
  C:\Windows\System\vmpGciC.exe
  2⤵
  PID:7364
- C:\Windows\System\BalHNCq.exe
  C:\Windows\System\BalHNCq.exe
  2⤵
  PID:7380
- C:\Windows\System\BmzSHMn.exe
  C:\Windows\System\BmzSHMn.exe
  2⤵
  PID:7400
- C:\Windows\System\iHYssct.exe
  C:\Windows\System\iHYssct.exe
  2⤵
  PID:7416
- C:\Windows\System\Lfhupcd.exe
  C:\Windows\System\Lfhupcd.exe
  2⤵
  PID:7432
- C:\Windows\System\qnNtxqH.exe
  C:\Windows\System\qnNtxqH.exe
  2⤵
  PID:7448
- C:\Windows\System\bLzwjMS.exe
  C:\Windows\System\bLzwjMS.exe
  2⤵
  PID:7464
- C:\Windows\System\lbsvZMg.exe
  C:\Windows\System\lbsvZMg.exe
  2⤵
  PID:7480
- C:\Windows\System\QxhuuXe.exe
  C:\Windows\System\QxhuuXe.exe
  2⤵
  PID:7496
- C:\Windows\System\WjAJfhB.exe
  C:\Windows\System\WjAJfhB.exe
  2⤵
  PID:7512
- C:\Windows\System\ogQjwsO.exe
  C:\Windows\System\ogQjwsO.exe
  2⤵
  PID:7528
- C:\Windows\System\YENnsUe.exe
  C:\Windows\System\YENnsUe.exe
  2⤵
  PID:7544
- C:\Windows\System\rXPQNxj.exe
  C:\Windows\System\rXPQNxj.exe
  2⤵
  PID:7560
- C:\Windows\System\sCYRToy.exe
  C:\Windows\System\sCYRToy.exe
  2⤵
  PID:7576
- C:\Windows\System\lqExaaS.exe
  C:\Windows\System\lqExaaS.exe
  2⤵
  PID:7592
- C:\Windows\System\EuNdVtX.exe
  C:\Windows\System\EuNdVtX.exe
  2⤵
  PID:7608
- C:\Windows\System\oJSRPnc.exe
  C:\Windows\System\oJSRPnc.exe
  2⤵
  PID:7624
- C:\Windows\System\FHAPVAQ.exe
  C:\Windows\System\FHAPVAQ.exe
  2⤵
  PID:7640
- C:\Windows\System\UzvEtEv.exe
  C:\Windows\System\UzvEtEv.exe
  2⤵
  PID:7656
- C:\Windows\System\CcTTDHT.exe
  C:\Windows\System\CcTTDHT.exe
  2⤵
  PID:7672
- C:\Windows\System\IbiZUoy.exe
  C:\Windows\System\IbiZUoy.exe
  2⤵
  PID:7688
- C:\Windows\System\lMCrcCx.exe
  C:\Windows\System\lMCrcCx.exe
  2⤵
  PID:7704
- C:\Windows\System\QQWeWaN.exe
  C:\Windows\System\QQWeWaN.exe
  2⤵
  PID:7724
- C:\Windows\System\aNpFAAL.exe
  C:\Windows\System\aNpFAAL.exe
  2⤵
  PID:7740
- C:\Windows\System\GoucJhX.exe
  C:\Windows\System\GoucJhX.exe
  2⤵
  PID:7756
- C:\Windows\System\oZjoAUd.exe
  C:\Windows\System\oZjoAUd.exe
  2⤵
  PID:7772
- C:\Windows\System\dBxYzia.exe
  C:\Windows\System\dBxYzia.exe
  2⤵
  PID:7788
- C:\Windows\System\KHsjWRr.exe
  C:\Windows\System\KHsjWRr.exe
  2⤵
  PID:7804
- C:\Windows\System\FFlHjIv.exe
  C:\Windows\System\FFlHjIv.exe
  2⤵
  PID:7820
- C:\Windows\System\zeURYmH.exe
  C:\Windows\System\zeURYmH.exe
  2⤵
  PID:7836
- C:\Windows\System\KNaHHRW.exe
  C:\Windows\System\KNaHHRW.exe
  2⤵
  PID:7852
- C:\Windows\System\apzvXlA.exe
  C:\Windows\System\apzvXlA.exe
  2⤵
  PID:7868
- C:\Windows\System\IOyxWvM.exe
  C:\Windows\System\IOyxWvM.exe
  2⤵
  PID:7884
- C:\Windows\System\glMIpLF.exe
  C:\Windows\System\glMIpLF.exe
  2⤵
  PID:7900
- C:\Windows\System\DlplApT.exe
  C:\Windows\System\DlplApT.exe
  2⤵
  PID:7916
- C:\Windows\System\AyYvtHY.exe
  C:\Windows\System\AyYvtHY.exe
  2⤵
  PID:7932
- C:\Windows\System\cIwMGtP.exe
  C:\Windows\System\cIwMGtP.exe
  2⤵
  PID:7948
- C:\Windows\System\MEdPYAn.exe
  C:\Windows\System\MEdPYAn.exe
  2⤵
  PID:7972
- C:\Windows\System\YqMqnWA.exe
  C:\Windows\System\YqMqnWA.exe
  2⤵
  PID:7988
- C:\Windows\System\zWsqCWa.exe
  C:\Windows\System\zWsqCWa.exe
  2⤵
  PID:8004
- C:\Windows\System\uMOlPgp.exe
  C:\Windows\System\uMOlPgp.exe
  2⤵
  PID:8020
- C:\Windows\System\VmtXYSx.exe
  C:\Windows\System\VmtXYSx.exe
  2⤵
  PID:8036
- C:\Windows\System\ArGXmzz.exe
  C:\Windows\System\ArGXmzz.exe
  2⤵
  PID:8052
- C:\Windows\System\hIdryGB.exe
  C:\Windows\System\hIdryGB.exe
  2⤵
  PID:8068
- C:\Windows\System\oevfdQR.exe
  C:\Windows\System\oevfdQR.exe
  2⤵
  PID:8084
- C:\Windows\System\bZuAjSw.exe
  C:\Windows\System\bZuAjSw.exe
  2⤵
  PID:8100
- C:\Windows\System\RYPyHhl.exe
  C:\Windows\System\RYPyHhl.exe
  2⤵
  PID:8116
- C:\Windows\System\wHOXhZX.exe
  C:\Windows\System\wHOXhZX.exe
  2⤵
  PID:8132
- C:\Windows\System\hykOnoc.exe
  C:\Windows\System\hykOnoc.exe
  2⤵
  PID:8152
- C:\Windows\System\EyaAYHX.exe
  C:\Windows\System\EyaAYHX.exe
  2⤵
  PID:8168
- C:\Windows\System\eAVykek.exe
  C:\Windows\System\eAVykek.exe
  2⤵
  PID:8184
- C:\Windows\System\YScmrsQ.exe
  C:\Windows\System\YScmrsQ.exe
  2⤵
  PID:7180
- C:\Windows\System\eSFPSJe.exe
  C:\Windows\System\eSFPSJe.exe
  2⤵
  PID:7184
- C:\Windows\System\Otipxnh.exe
  C:\Windows\System\Otipxnh.exe
  2⤵
  PID:7216
- C:\Windows\System\BAmvdfr.exe
  C:\Windows\System\BAmvdfr.exe
  2⤵
  PID:7280
- C:\Windows\System\BnAedjG.exe
  C:\Windows\System\BnAedjG.exe
  2⤵
  PID:7344
- C:\Windows\System\DGjnhTf.exe
  C:\Windows\System\DGjnhTf.exe
  2⤵
  PID:7324
- C:\Windows\System\ZEyWyjw.exe
  C:\Windows\System\ZEyWyjw.exe
  2⤵
  PID:7232
- C:\Windows\System\PnLsVpP.exe
  C:\Windows\System\PnLsVpP.exe
  2⤵
  PID:7472
- C:\Windows\System\ULLvlwi.exe
  C:\Windows\System\ULLvlwi.exe
  2⤵
  PID:7504
- C:\Windows\System\hROhcad.exe
  C:\Windows\System\hROhcad.exe
  2⤵
  PID:7128
- C:\Windows\System\FXKbOQC.exe
  C:\Windows\System\FXKbOQC.exe
  2⤵
  PID:7396
- C:\Windows\System\SSVpoVp.exe
  C:\Windows\System\SSVpoVp.exe
  2⤵
  PID:7460
- C:\Windows\System\OLXETcp.exe
  C:\Windows\System\OLXETcp.exe
  2⤵
  PID:7632
- C:\Windows\System\sIMvAqx.exe
  C:\Windows\System\sIMvAqx.exe
  2⤵
  PID:7696
- C:\Windows\System\MdaJDzh.exe
  C:\Windows\System\MdaJDzh.exe
  2⤵
  PID:7700
- C:\Windows\System\tLlXqFv.exe
  C:\Windows\System\tLlXqFv.exe
  2⤵
  PID:7524
- C:\Windows\System\ZrBSHdf.exe
  C:\Windows\System\ZrBSHdf.exe
  2⤵
  PID:7716
- C:\Windows\System\uuGtzsI.exe
  C:\Windows\System\uuGtzsI.exe
  2⤵
  PID:7652
- C:\Windows\System\tGtDgAR.exe
  C:\Windows\System\tGtDgAR.exe
  2⤵
  PID:7684
- C:\Windows\System\OLwLyOU.exe
  C:\Windows\System\OLwLyOU.exe
  2⤵
  PID:7800
- C:\Windows\System\hJLvuek.exe
  C:\Windows\System\hJLvuek.exe
  2⤵
  PID:7864
- C:\Windows\System\JfniYOK.exe
  C:\Windows\System\JfniYOK.exe
  2⤵
  PID:7924
- C:\Windows\System\tPKiBuQ.exe
  C:\Windows\System\tPKiBuQ.exe
  2⤵
  PID:7964
- C:\Windows\System\BJcoSAh.exe
  C:\Windows\System\BJcoSAh.exe
  2⤵
  PID:8028
- C:\Windows\System\jtZlxNb.exe
  C:\Windows\System\jtZlxNb.exe
  2⤵
  PID:8092
- C:\Windows\System\uSFPbrc.exe
  C:\Windows\System\uSFPbrc.exe
  2⤵
  PID:8128
- C:\Windows\System\tOqCguK.exe
  C:\Windows\System\tOqCguK.exe
  2⤵
  PID:7844
- C:\Windows\System\fYKWxba.exe
  C:\Windows\System\fYKWxba.exe
  2⤵
  PID:8016
- C:\Windows\System\qgPyHlA.exe
  C:\Windows\System\qgPyHlA.exe
  2⤵
  PID:7848
- C:\Windows\System\XvMIecR.exe
  C:\Windows\System\XvMIecR.exe
  2⤵
  PID:6288
- C:\Windows\System\FAYqMLa.exe
  C:\Windows\System\FAYqMLa.exe
  2⤵
  PID:7880
- C:\Windows\System\RGXGnVr.exe
  C:\Windows\System\RGXGnVr.exe
  2⤵
  PID:7944
- C:\Windows\System\LhRnTKM.exe
  C:\Windows\System\LhRnTKM.exe
  2⤵
  PID:8176
- C:\Windows\System\PwpLJeV.exe
  C:\Windows\System\PwpLJeV.exe
  2⤵
  PID:7340
- C:\Windows\System\TVMkwbP.exe
  C:\Windows\System\TVMkwbP.exe
  2⤵
  PID:6476
- C:\Windows\System\hMTEaPi.exe
  C:\Windows\System\hMTEaPi.exe
  2⤵
  PID:7408
- C:\Windows\System\hrcWyJb.exe
  C:\Windows\System\hrcWyJb.exe
  2⤵
  PID:7440
- C:\Windows\System\wFWhGXX.exe
  C:\Windows\System\wFWhGXX.exe
  2⤵
  PID:7540
- C:\Windows\System\mJaGXIo.exe
  C:\Windows\System\mJaGXIo.exe
  2⤵
  PID:7388
- C:\Windows\System\jmNaxaz.exe
  C:\Windows\System\jmNaxaz.exe
  2⤵
  PID:7664
- C:\Windows\System\mxQnXbL.exe
  C:\Windows\System\mxQnXbL.exe
  2⤵
  PID:7588
- C:\Windows\System\jzwzxSE.exe
  C:\Windows\System\jzwzxSE.exe
  2⤵
  PID:7492
- C:\Windows\System\kRIiTnw.exe
  C:\Windows\System\kRIiTnw.exe
  2⤵
  PID:7768
- C:\Windows\System\PXZAwSm.exe
  C:\Windows\System\PXZAwSm.exe
  2⤵
  PID:7892
- C:\Windows\System\fONcuAg.exe
  C:\Windows\System\fONcuAg.exe
  2⤵
  PID:7812
- C:\Windows\System\iaGLKut.exe
  C:\Windows\System\iaGLKut.exe
  2⤵
  PID:8000
- C:\Windows\System\sPSoZcP.exe
  C:\Windows\System\sPSoZcP.exe
  2⤵
  PID:8160
- C:\Windows\System\aSexWwu.exe
  C:\Windows\System\aSexWwu.exe
  2⤵
  PID:8076
- C:\Windows\System\KuocYZC.exe
  C:\Windows\System\KuocYZC.exe
  2⤵
  PID:8012
- C:\Windows\System\lzqhDqG.exe
  C:\Windows\System\lzqhDqG.exe
  2⤵
  PID:7424
- C:\Windows\System\XJCygCm.exe
  C:\Windows\System\XJCygCm.exe
  2⤵
  PID:8112
- C:\Windows\System\YeXTZci.exe
  C:\Windows\System\YeXTZci.exe
  2⤵
  PID:7376
- C:\Windows\System\rxfCbqP.exe
  C:\Windows\System\rxfCbqP.exe
  2⤵
  PID:7392
- C:\Windows\System\qKzwBUZ.exe
  C:\Windows\System\qKzwBUZ.exe
  2⤵
  PID:7648
- C:\Windows\System\IULUCBh.exe
  C:\Windows\System\IULUCBh.exe
  2⤵
  PID:7796
- C:\Windows\System\ViwJRGJ.exe
  C:\Windows\System\ViwJRGJ.exe
  2⤵
  PID:8144
- C:\Windows\System\EwOCOCA.exe
  C:\Windows\System\EwOCOCA.exe
  2⤵
  PID:7956
- C:\Windows\System\LnRWHEw.exe
  C:\Windows\System\LnRWHEw.exe
  2⤵
  PID:7264
- C:\Windows\System\ylHkzQN.exe
  C:\Windows\System\ylHkzQN.exe
  2⤵
  PID:7200
- C:\Windows\System\fnZCvgy.exe
  C:\Windows\System\fnZCvgy.exe
  2⤵
  PID:6780
- C:\Windows\System\UwCmyhj.exe
  C:\Windows\System\UwCmyhj.exe
  2⤵
  PID:7764
- C:\Windows\System\AurWHYj.exe
  C:\Windows\System\AurWHYj.exe
  2⤵
  PID:8212
- C:\Windows\System\CjcAhzR.exe
  C:\Windows\System\CjcAhzR.exe
  2⤵
  PID:8228
- C:\Windows\System\JZUXFEA.exe
  C:\Windows\System\JZUXFEA.exe
  2⤵
  PID:8244
- C:\Windows\System\wjWBGMp.exe
  C:\Windows\System\wjWBGMp.exe
  2⤵
  PID:8268
- C:\Windows\System\nJSmMOk.exe
  C:\Windows\System\nJSmMOk.exe
  2⤵
  PID:8284
- C:\Windows\System\sgFsTrN.exe
  C:\Windows\System\sgFsTrN.exe
  2⤵
  PID:8304
- C:\Windows\System\nvJrwMf.exe
  C:\Windows\System\nvJrwMf.exe
  2⤵
  PID:8320
- C:\Windows\System\vGUePXS.exe
  C:\Windows\System\vGUePXS.exe
  2⤵
  PID:8336
- C:\Windows\System\jfinFqc.exe
  C:\Windows\System\jfinFqc.exe
  2⤵
  PID:8356
- C:\Windows\System\fKEjebj.exe
  C:\Windows\System\fKEjebj.exe
  2⤵
  PID:8372
- C:\Windows\System\xDQuVBe.exe
  C:\Windows\System\xDQuVBe.exe
  2⤵
  PID:8388
- C:\Windows\System\ZPsLwFA.exe
  C:\Windows\System\ZPsLwFA.exe
  2⤵
  PID:8408
- C:\Windows\System\LBhdPCb.exe
  C:\Windows\System\LBhdPCb.exe
  2⤵
  PID:8428
- C:\Windows\System\lKSHNLj.exe
  C:\Windows\System\lKSHNLj.exe
  2⤵
  PID:8448
- C:\Windows\System\vpDyFVq.exe
  C:\Windows\System\vpDyFVq.exe
  2⤵
  PID:8464
- C:\Windows\System\kvDnYnI.exe
  C:\Windows\System\kvDnYnI.exe
  2⤵
  PID:8480
- C:\Windows\System\rmcemox.exe
  C:\Windows\System\rmcemox.exe
  2⤵
  PID:8572
- C:\Windows\System\aqmjbsH.exe
  C:\Windows\System\aqmjbsH.exe
  2⤵
  PID:8588
- C:\Windows\System\fQknoly.exe
  C:\Windows\System\fQknoly.exe
  2⤵
  PID:8604
- C:\Windows\System\CXhhywd.exe
  C:\Windows\System\CXhhywd.exe
  2⤵
  PID:8620
- C:\Windows\System\hFWguxt.exe
  C:\Windows\System\hFWguxt.exe
  2⤵
  PID:8636
- C:\Windows\System\ENjbGVW.exe
  C:\Windows\System\ENjbGVW.exe
  2⤵
  PID:8652
- C:\Windows\System\gnNJIcF.exe
  C:\Windows\System\gnNJIcF.exe
  2⤵
  PID:8668
- C:\Windows\System\YaRbHka.exe
  C:\Windows\System\YaRbHka.exe
  2⤵
  PID:8684
- C:\Windows\System\rqmcZTO.exe
  C:\Windows\System\rqmcZTO.exe
  2⤵
  PID:8700
- C:\Windows\System\knMesHY.exe
  C:\Windows\System\knMesHY.exe
  2⤵
  PID:8716
- C:\Windows\System\yHamffh.exe
  C:\Windows\System\yHamffh.exe
  2⤵
  PID:8732
- C:\Windows\System\kHUFmFl.exe
  C:\Windows\System\kHUFmFl.exe
  2⤵
  PID:8748
- C:\Windows\System\tMvCReE.exe
  C:\Windows\System\tMvCReE.exe
  2⤵
  PID:8764
- C:\Windows\System\XyOJbiz.exe
  C:\Windows\System\XyOJbiz.exe
  2⤵
  PID:8780
- C:\Windows\System\dQoGlEF.exe
  C:\Windows\System\dQoGlEF.exe
  2⤵
  PID:8796
- C:\Windows\System\kBtuaOP.exe
  C:\Windows\System\kBtuaOP.exe
  2⤵
  PID:8812
- C:\Windows\System\CBoQwbj.exe
  C:\Windows\System\CBoQwbj.exe
  2⤵
  PID:8828
- C:\Windows\System\ZBRbXHf.exe
  C:\Windows\System\ZBRbXHf.exe
  2⤵
  PID:8844
- C:\Windows\System\XzJartr.exe
  C:\Windows\System\XzJartr.exe
  2⤵
  PID:8860
- C:\Windows\System\aGmBmPY.exe
  C:\Windows\System\aGmBmPY.exe
  2⤵
  PID:8876
- C:\Windows\System\NikbKPL.exe
  C:\Windows\System\NikbKPL.exe
  2⤵
  PID:8892
- C:\Windows\System\aasboGQ.exe
  C:\Windows\System\aasboGQ.exe
  2⤵
  PID:8908
- C:\Windows\System\QKQiPMR.exe
  C:\Windows\System\QKQiPMR.exe
  2⤵
  PID:8924
- C:\Windows\System\rcLjRIY.exe
  C:\Windows\System\rcLjRIY.exe
  2⤵
  PID:8940
- C:\Windows\System\KbIcusI.exe
  C:\Windows\System\KbIcusI.exe
  2⤵
  PID:8956
- C:\Windows\System\jcBfgWQ.exe
  C:\Windows\System\jcBfgWQ.exe
  2⤵
  PID:8972
- C:\Windows\System\REPhFeZ.exe
  C:\Windows\System\REPhFeZ.exe
  2⤵
  PID:8988
- C:\Windows\System\IzKccTu.exe
  C:\Windows\System\IzKccTu.exe
  2⤵
  PID:9004
- C:\Windows\System\YFLHBJk.exe
  C:\Windows\System\YFLHBJk.exe
  2⤵
  PID:9112
- C:\Windows\System\nEzCyfJ.exe
  C:\Windows\System\nEzCyfJ.exe
  2⤵
  PID:9128
- C:\Windows\System\TPQBNgg.exe
  C:\Windows\System\TPQBNgg.exe
  2⤵
  PID:9144
- C:\Windows\System\uZfAyYR.exe
  C:\Windows\System\uZfAyYR.exe
  2⤵
  PID:9160
- C:\Windows\System\RTAneMb.exe
  C:\Windows\System\RTAneMb.exe
  2⤵
  PID:9176
- C:\Windows\System\cYZIjlQ.exe
  C:\Windows\System\cYZIjlQ.exe
  2⤵
  PID:9192
- C:\Windows\System\SwYPjVJ.exe
  C:\Windows\System\SwYPjVJ.exe
  2⤵
  PID:9208
- C:\Windows\System\RyrGayE.exe
  C:\Windows\System\RyrGayE.exe
  2⤵
  PID:7860
- C:\Windows\System\twBOUzG.exe
  C:\Windows\System\twBOUzG.exe
  2⤵
  PID:8224
- C:\Windows\System\IXZGIOC.exe
  C:\Windows\System\IXZGIOC.exe
  2⤵
  PID:7552
- C:\Windows\System\MZfvxOd.exe
  C:\Windows\System\MZfvxOd.exe
  2⤵
  PID:8300
- C:\Windows\System\eLFiZLG.exe
  C:\Windows\System\eLFiZLG.exe
  2⤵
  PID:8368
- C:\Windows\System\WdONyCl.exe
  C:\Windows\System\WdONyCl.exe
  2⤵
  PID:8436
- C:\Windows\System\eBpoOZz.exe
  C:\Windows\System\eBpoOZz.exe
  2⤵
  PID:8472
- C:\Windows\System\TGHMgUO.exe
  C:\Windows\System\TGHMgUO.exe
  2⤵
  PID:8200
- C:\Windows\System\xclaEto.exe
  C:\Windows\System\xclaEto.exe
  2⤵
  PID:8048
- C:\Windows\System\eGrhBlF.exe
  C:\Windows\System\eGrhBlF.exe
  2⤵
  PID:8208
- C:\Windows\System\LhmeyaV.exe
  C:\Windows\System\LhmeyaV.exe
  2⤵
  PID:8280
- C:\Windows\System\ZtXtrMu.exe
  C:\Windows\System\ZtXtrMu.exe
  2⤵
  PID:8352
- C:\Windows\System\btWEASC.exe
  C:\Windows\System\btWEASC.exe
  2⤵
  PID:8456
- C:\Windows\System\BbgzbOL.exe
  C:\Windows\System\BbgzbOL.exe
  2⤵
  PID:8580
- C:\Windows\System\DKyfXgA.exe
  C:\Windows\System\DKyfXgA.exe
  2⤵
  PID:8648
- C:\Windows\System\liRCZRl.exe
  C:\Windows\System\liRCZRl.exe
  2⤵
  PID:8712
- C:\Windows\System\uxhSNDi.exe
  C:\Windows\System\uxhSNDi.exe
  2⤵
  PID:8776
- C:\Windows\System\TfbdUxB.exe
  C:\Windows\System\TfbdUxB.exe
  2⤵
  PID:8868
- C:\Windows\System\EISfcCR.exe
  C:\Windows\System\EISfcCR.exe
  2⤵
  PID:8932
- C:\Windows\System\wNcHYxa.exe
  C:\Windows\System\wNcHYxa.exe
  2⤵
  PID:8996
- C:\Windows\System\JYPHCot.exe
  C:\Windows\System\JYPHCot.exe
  2⤵
  PID:8552
- C:\Windows\System\ZBEUdhN.exe
  C:\Windows\System\ZBEUdhN.exe
  2⤵
  PID:8756
- C:\Windows\System\LHMtXWt.exe
  C:\Windows\System\LHMtXWt.exe
  2⤵
  PID:8496
- C:\Windows\System\EDrTvoC.exe
  C:\Windows\System\EDrTvoC.exe
  2⤵
  PID:8520
- C:\Windows\System\brGxixB.exe
  C:\Windows\System\brGxixB.exe
  2⤵
  PID:8544
- C:\Windows\System\MowJvDz.exe
  C:\Windows\System\MowJvDz.exe
  2⤵
  PID:8564
- C:\Windows\System\iSPGyYN.exe
  C:\Windows\System\iSPGyYN.exe
  2⤵
  PID:8628
- C:\Windows\System\HmayzdW.exe
  C:\Windows\System\HmayzdW.exe
  2⤵
  PID:8760
- C:\Windows\System\xeTRKjM.exe
  C:\Windows\System\xeTRKjM.exe
  2⤵
  PID:8852
- C:\Windows\System\adTPXKI.exe
  C:\Windows\System\adTPXKI.exe
  2⤵
  PID:8916
- C:\Windows\System\maGoPZX.exe
  C:\Windows\System\maGoPZX.exe
  2⤵
  PID:9012
- C:\Windows\System\hqivBcJ.exe
  C:\Windows\System\hqivBcJ.exe
  2⤵
  PID:9036
- C:\Windows\System\QIrCvXv.exe
  C:\Windows\System\QIrCvXv.exe
  2⤵
  PID:9048
- C:\Windows\System\WpTmeDl.exe
  C:\Windows\System\WpTmeDl.exe
  2⤵
  PID:9064
- C:\Windows\System\RVswPtc.exe
  C:\Windows\System\RVswPtc.exe
  2⤵
  PID:9076
- C:\Windows\System\ZBPnKjY.exe
  C:\Windows\System\ZBPnKjY.exe
  2⤵
  PID:9088
- C:\Windows\System\bJPqKrG.exe
  C:\Windows\System\bJPqKrG.exe
  2⤵
  PID:9120
- C:\Windows\System\HJUUmXW.exe
  C:\Windows\System\HJUUmXW.exe
  2⤵
  PID:9184
- C:\Windows\System\hJGmMZX.exe
  C:\Windows\System\hJGmMZX.exe
  2⤵
  PID:8264
- C:\Windows\System\ANvaXAl.exe
  C:\Windows\System\ANvaXAl.exe
  2⤵
  PID:8444
- C:\Windows\System\RKoaKze.exe
  C:\Windows\System\RKoaKze.exe
  2⤵
  PID:8240
- C:\Windows\System\SEBhIpe.exe
  C:\Windows\System\SEBhIpe.exe
  2⤵
  PID:9140
- C:\Windows\System\qPoKOVv.exe
  C:\Windows\System\qPoKOVv.exe
  2⤵
  PID:8644
- C:\Windows\System\WcWVGrq.exe
  C:\Windows\System\WcWVGrq.exe
  2⤵
  PID:6932
- C:\Windows\System\RcnKnrM.exe
  C:\Windows\System\RcnKnrM.exe
  2⤵
  PID:8204
- C:\Windows\System\PcHidpg.exe
  C:\Windows\System\PcHidpg.exe
  2⤵
  PID:8400
- C:\Windows\System\zTxlgQZ.exe
  C:\Windows\System\zTxlgQZ.exe
  2⤵
  PID:8900
- C:\Windows\System\tQtbbfI.exe
  C:\Windows\System\tQtbbfI.exe
  2⤵
  PID:8540
- C:\Windows\System\jkQUMrB.exe
  C:\Windows\System\jkQUMrB.exe
  2⤵
  PID:8980
- C:\Windows\System\jYnYkOT.exe
  C:\Windows\System\jYnYkOT.exe
  2⤵
  PID:8808
- C:\Windows\System\CgaIjxO.exe
  C:\Windows\System\CgaIjxO.exe
  2⤵
  PID:8536
- C:\Windows\System\LLdcyHy.exe
  C:\Windows\System\LLdcyHy.exe
  2⤵
  PID:8824
- C:\Windows\System\pzvjEfk.exe
  C:\Windows\System\pzvjEfk.exe
  2⤵
  PID:8968
- C:\Windows\System\GdlUyYl.exe
  C:\Windows\System\GdlUyYl.exe
  2⤵
  PID:9044
- C:\Windows\System\nWgQtAS.exe
  C:\Windows\System\nWgQtAS.exe
  2⤵
  PID:8884
- C:\Windows\System\tnzndkT.exe
  C:\Windows\System\tnzndkT.exe
  2⤵
  PID:9108
- C:\Windows\System\mKePsmq.exe
  C:\Windows\System\mKePsmq.exe
  2⤵
  PID:9016
- C:\Windows\System\pxyPVAF.exe
  C:\Windows\System\pxyPVAF.exe
  2⤵
  PID:7996
- C:\Windows\System\aEnvfhm.exe
  C:\Windows\System\aEnvfhm.exe
  2⤵
  PID:9056
- C:\Windows\System\zavObbE.exe
  C:\Windows\System\zavObbE.exe
  2⤵
  PID:8364
- C:\Windows\System\FTRQact.exe
  C:\Windows\System\FTRQact.exe
  2⤵
  PID:9156
- C:\Windows\System\ZcMtpNF.exe
  C:\Windows\System\ZcMtpNF.exe
  2⤵
  PID:7212
- C:\Windows\System\aLnDSfr.exe
  C:\Windows\System\aLnDSfr.exe
  2⤵
  PID:8276
- C:\Windows\System\jKZXgRd.exe
  C:\Windows\System\jKZXgRd.exe
  2⤵
  PID:9200
- C:\Windows\System\SLQCzqy.exe
  C:\Windows\System\SLQCzqy.exe
  2⤵
  PID:8744
- C:\Windows\System\YMISvMd.exe
  C:\Windows\System\YMISvMd.exe
  2⤵
  PID:8524
- C:\Windows\System\FtfIexR.exe
  C:\Windows\System\FtfIexR.exe
  2⤵
  PID:8724
- C:\Windows\System\vumKOpX.exe
  C:\Windows\System\vumKOpX.exe
  2⤵
  PID:8508
- C:\Windows\System\cQHRMkr.exe
  C:\Windows\System\cQHRMkr.exe
  2⤵
  PID:8416
- C:\Windows\System\QZjwKvx.exe
  C:\Windows\System\QZjwKvx.exe
  2⤵
  PID:9028
- C:\Windows\System\PgTojdz.exe
  C:\Windows\System\PgTojdz.exe
  2⤵
  PID:8316
- C:\Windows\System\OndIFsE.exe
  C:\Windows\System\OndIFsE.exe
  2⤵
  PID:8600
- C:\Windows\System\XxzBSrE.exe
  C:\Windows\System\XxzBSrE.exe
  2⤵
  PID:8964
- C:\Windows\System\PHizFuw.exe
  C:\Windows\System\PHizFuw.exe
  2⤵
  PID:8696
- C:\Windows\System\JHjpoOt.exe
  C:\Windows\System\JHjpoOt.exe
  2⤵
  PID:8660
- C:\Windows\System\hphxZlE.exe
  C:\Windows\System\hphxZlE.exe
  2⤵
  PID:8708
- C:\Windows\System\CrGCHPG.exe
  C:\Windows\System\CrGCHPG.exe
  2⤵
  PID:9236
- C:\Windows\System\qYESKQH.exe
  C:\Windows\System\qYESKQH.exe
  2⤵
  PID:9256
- C:\Windows\System\HsRbWBW.exe
  C:\Windows\System\HsRbWBW.exe
  2⤵
  PID:9272
- C:\Windows\System\PPAWolN.exe
  C:\Windows\System\PPAWolN.exe
  2⤵
  PID:9292
- C:\Windows\System\dbOYbwj.exe
  C:\Windows\System\dbOYbwj.exe
  2⤵
  PID:9308
- C:\Windows\System\OEQrRXo.exe
  C:\Windows\System\OEQrRXo.exe
  2⤵
  PID:9324
- C:\Windows\System\ZIBVYPA.exe
  C:\Windows\System\ZIBVYPA.exe
  2⤵
  PID:9344
- C:\Windows\System\xZnmpMm.exe
  C:\Windows\System\xZnmpMm.exe
  2⤵
  PID:9360
- C:\Windows\System\iErXTpJ.exe
  C:\Windows\System\iErXTpJ.exe
  2⤵
  PID:9376
- C:\Windows\System\rwPfwlK.exe
  C:\Windows\System\rwPfwlK.exe
  2⤵
  PID:9396
- C:\Windows\System\bCrVdbw.exe
  C:\Windows\System\bCrVdbw.exe
  2⤵
  PID:9412
- C:\Windows\System\McoVYdC.exe
  C:\Windows\System\McoVYdC.exe
  2⤵
  PID:9428
- C:\Windows\System\ykDpkrz.exe
  C:\Windows\System\ykDpkrz.exe
  2⤵
  PID:9464
- C:\Windows\System\kxwksZS.exe
  C:\Windows\System\kxwksZS.exe
  2⤵
  PID:9480
- C:\Windows\System\cGLVXLW.exe
  C:\Windows\System\cGLVXLW.exe
  2⤵
  PID:9496
- C:\Windows\System\eeqruBv.exe
  C:\Windows\System\eeqruBv.exe
  2⤵
  PID:9512
- C:\Windows\System\yDXqeIf.exe
  C:\Windows\System\yDXqeIf.exe
  2⤵
  PID:9532
- C:\Windows\System\bEQRgRY.exe
  C:\Windows\System\bEQRgRY.exe
  2⤵
  PID:9548
- C:\Windows\System\CljtcLZ.exe
  C:\Windows\System\CljtcLZ.exe
  2⤵
  PID:9564
- C:\Windows\System\lRJSxdF.exe
  C:\Windows\System\lRJSxdF.exe
  2⤵
  PID:9584
- C:\Windows\System\jNXtkbF.exe
  C:\Windows\System\jNXtkbF.exe
  2⤵
  PID:9600
- C:\Windows\System\zhBhjAO.exe
  C:\Windows\System\zhBhjAO.exe
  2⤵
  PID:9616
- C:\Windows\System\rKabTXO.exe
  C:\Windows\System\rKabTXO.exe
  2⤵
  PID:9632
- C:\Windows\System\NCkMNCk.exe
  C:\Windows\System\NCkMNCk.exe
  2⤵
  PID:9648
- C:\Windows\System\EzONdaB.exe
  C:\Windows\System\EzONdaB.exe
  2⤵
  PID:9664
- C:\Windows\System\jNYRCdm.exe
  C:\Windows\System\jNYRCdm.exe
  2⤵
  PID:9684
- C:\Windows\System\KCQqhsk.exe
  C:\Windows\System\KCQqhsk.exe
  2⤵
  PID:9700
- C:\Windows\System\kImDaIM.exe
  C:\Windows\System\kImDaIM.exe
  2⤵
  PID:9724
- C:\Windows\System\zdGZCAo.exe
  C:\Windows\System\zdGZCAo.exe
  2⤵
  PID:9740
- C:\Windows\System\zLkbRdO.exe
  C:\Windows\System\zLkbRdO.exe
  2⤵
  PID:9756
- C:\Windows\System\OEcQQWI.exe
  C:\Windows\System\OEcQQWI.exe
  2⤵
  PID:9772
- C:\Windows\System\aZYQoOQ.exe
  C:\Windows\System\aZYQoOQ.exe
  2⤵
  PID:9796
- C:\Windows\System\ROGOcgr.exe
  C:\Windows\System\ROGOcgr.exe
  2⤵
  PID:9812
- C:\Windows\System\RkHCJiy.exe
  C:\Windows\System\RkHCJiy.exe
  2⤵
  PID:9832
- C:\Windows\System\dJtRqla.exe
  C:\Windows\System\dJtRqla.exe
  2⤵
  PID:9848
- C:\Windows\System\ZSHGGgY.exe
  C:\Windows\System\ZSHGGgY.exe
  2⤵
  PID:9864
- C:\Windows\System\sDglBKv.exe
  C:\Windows\System\sDglBKv.exe
  2⤵
  PID:9880
- C:\Windows\System\fQGsEZF.exe
  C:\Windows\System\fQGsEZF.exe
  2⤵
  PID:9896
- C:\Windows\System\jDyudWg.exe
  C:\Windows\System\jDyudWg.exe
  2⤵
  PID:9912
- C:\Windows\System\pCjpVpB.exe
  C:\Windows\System\pCjpVpB.exe
  2⤵
  PID:9928
- C:\Windows\System\hsaXBGq.exe
  C:\Windows\System\hsaXBGq.exe
  2⤵
  PID:9944
- C:\Windows\System\PgrBsGf.exe
  C:\Windows\System\PgrBsGf.exe
  2⤵
  PID:9960
- C:\Windows\System\rirNQKr.exe
  C:\Windows\System\rirNQKr.exe
  2⤵
  PID:9976
- C:\Windows\System\iOeOYwI.exe
  C:\Windows\System\iOeOYwI.exe
  2⤵
  PID:9992
- C:\Windows\System\SakXnrK.exe
  C:\Windows\System\SakXnrK.exe
  2⤵
  PID:10008
- C:\Windows\System\oUZCbAt.exe
  C:\Windows\System\oUZCbAt.exe
  2⤵
  PID:10044
- C:\Windows\System\PtmhniQ.exe
  C:\Windows\System\PtmhniQ.exe
  2⤵
  PID:10060
- C:\Windows\System\ijuafSS.exe
  C:\Windows\System\ijuafSS.exe
  2⤵
  PID:10076
- C:\Windows\System\LEogspD.exe
  C:\Windows\System\LEogspD.exe
  2⤵
  PID:10092
- C:\Windows\System\uOOYHYT.exe
  C:\Windows\System\uOOYHYT.exe
  2⤵
  PID:10108
- C:\Windows\System\gBhiSFA.exe
  C:\Windows\System\gBhiSFA.exe
  2⤵
  PID:10124
- C:\Windows\System\FhTkAop.exe
  C:\Windows\System\FhTkAop.exe
  2⤵
  PID:10140
- C:\Windows\System\vpDXfsc.exe
  C:\Windows\System\vpDXfsc.exe
  2⤵
  PID:10156
- C:\Windows\System\WTMKKHt.exe
  C:\Windows\System\WTMKKHt.exe
  2⤵
  PID:10172
- C:\Windows\System\csqEUHR.exe
  C:\Windows\System\csqEUHR.exe
  2⤵
  PID:10188
- C:\Windows\System\wWJtwJT.exe
  C:\Windows\System\wWJtwJT.exe
  2⤵
  PID:10204
- C:\Windows\System\hLmLVdq.exe
  C:\Windows\System\hLmLVdq.exe
  2⤵
  PID:10220
- C:\Windows\System\QRCABzF.exe
  C:\Windows\System\QRCABzF.exe
  2⤵
  PID:10236
- C:\Windows\System\vyVERCF.exe
  C:\Windows\System\vyVERCF.exe
  2⤵
  PID:9152
- C:\Windows\System\uMNzmYi.exe
  C:\Windows\System\uMNzmYi.exe
  2⤵
  PID:9264
- C:\Windows\System\yLWlSrc.exe
  C:\Windows\System\yLWlSrc.exe
  2⤵
  PID:9304
- C:\Windows\System\rIshPFp.exe
  C:\Windows\System\rIshPFp.exe
  2⤵
  PID:9336
- C:\Windows\System\DcGahxq.exe
  C:\Windows\System\DcGahxq.exe
  2⤵
  PID:8952
- C:\Windows\System\sIDHACs.exe
  C:\Windows\System\sIDHACs.exe
  2⤵
  PID:8728
- C:\Windows\System\odmrLWo.exe
  C:\Windows\System\odmrLWo.exe
  2⤵
  PID:9252
- C:\Windows\System\cuRzULH.exe
  C:\Windows\System\cuRzULH.exe
  2⤵
  PID:9320
- C:\Windows\System\qFvhiKF.exe
  C:\Windows\System\qFvhiKF.exe
  2⤵
  PID:9424
- C:\Windows\System\JhivHHe.exe
  C:\Windows\System\JhivHHe.exe
  2⤵
  PID:9408
- C:\Windows\System\sGCYoAg.exe
  C:\Windows\System\sGCYoAg.exe
  2⤵
  PID:9444
- C:\Windows\System\AAJlHzW.exe
  C:\Windows\System\AAJlHzW.exe
  2⤵
  PID:9476
- C:\Windows\System\Stecggc.exe
  C:\Windows\System\Stecggc.exe
  2⤵
  PID:9460
- C:\Windows\System\JbPdjHg.exe
  C:\Windows\System\JbPdjHg.exe
  2⤵
  PID:9524
- C:\Windows\System\qTOroPk.exe
  C:\Windows\System\qTOroPk.exe
  2⤵
  PID:9592
- C:\Windows\System\KvBnuBL.exe
  C:\Windows\System\KvBnuBL.exe
  2⤵
  PID:9656
- C:\Windows\System\KEOKUPy.exe
  C:\Windows\System\KEOKUPy.exe
  2⤵
  PID:9572
- C:\Windows\System\ZpXFJpW.exe
  C:\Windows\System\ZpXFJpW.exe
  2⤵
  PID:9612
- C:\Windows\System\uuOCIQN.exe
  C:\Windows\System\uuOCIQN.exe
  2⤵
  PID:9680
- C:\Windows\System\ntfnGbC.exe
  C:\Windows\System\ntfnGbC.exe
  2⤵
  PID:9748
- C:\Windows\System\THgrXuE.exe
  C:\Windows\System\THgrXuE.exe
  2⤵
  PID:9784
- C:\Windows\System\VJpKCPO.exe
  C:\Windows\System\VJpKCPO.exe
  2⤵
  PID:9732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AgzQzXv.exe

Filesize
2.3MB

MD5
74f476a0ee0e51707bee7e074f6e8fc5

SHA1
f8f25a20f2cffc8a3580d30a94e8a168110e5390

SHA256
a127f656b9ab7c300261ea79388d921859ea8cb7bad16cc8884f9abd8d2a2ddb

SHA512
4d209f394e436cc2790438005be833fb7c37d9ff976cec491098f85a5b5f116866ee2145446352a309ddd41c8fd23338e816f062944405a83dc9476dfb6f48e5

Download Submit
C:\Windows\system\BBNRPFd.exe

Filesize
2.3MB

MD5
3690b69c865983df4aecbfa9e4744589

SHA1
1486d3430e06944ac1aeec2e216f698738dd4fc2

SHA256
1766a03885e3b986031e486481d2e4e71870778e4de52e43c2a3de8238be7863

SHA512
0be74ec29ec144eaacb67ddd014f9b66091a8525d2079b726198104f897bed6c20dc3b7b0c02062a21a279de4c3f222be2fee42815f56d1e594909d870ae1ce7

Download Submit
C:\Windows\system\CzWtQhL.exe

Filesize
2.3MB

MD5
1c8bfeb6e0df22a37201bf996c58479e

SHA1
39341b12aeb80cad77ceaabab91d1c298d628b91

SHA256
b5a594377b9e6ee1e94589831c10907b1beb2bde5d0c63f01130034f3745619c

SHA512
e8665d239676e7a18f8956cb8a64e29bd3ae6ab411ab88bcb93fbd44ca71f87ddb1cd6bd3c6b2eea6e7afd03cd56111d518ea3f5f6afff27a8993eac83b91c78

Download Submit
C:\Windows\system\HsoMVUX.exe

Filesize
2.3MB

MD5
90d7ee40110ce1aa4ec40cb121227bf6

SHA1
36998ccbc18ff098325e8be10384e940bdbd49a9

SHA256
d32e813930a0b97f8e680ec002ae1af744bf9ed60cb6bbf8978d76165261f85e

SHA512
ca421ca70f43366d490acb162f2193839672f5c96e03401a3e8077811f10d316ec8ef3ed3e6c5c24a1b40687ece488a4f7e6573835c3dcf23dc26b8083a8a3f0

Download Submit
C:\Windows\system\IGHjuhc.exe

Filesize
2.3MB

MD5
5abce0e221c915385466088a2c9feef2

SHA1
01dd808ac5b16f19c80bb878e1754c3a9e2c74db

SHA256
3a64f78d3ce0dfd5ca7371cc22c5993be9d315bd31bd5cc6640dbc22e03e87da

SHA512
1398b43d17e3528022379f872e9f8ffbc5247587509468dc91b21675d307c8ed2dc164d1d48dae597378890fc884d5a358a7d0f26f5a313053fd815b97505382

Download Submit
C:\Windows\system\QrJXsdF.exe

Filesize
2.3MB

MD5
56fdccbcece5b75ae28b10477eafc6c8

SHA1
3c1e3e6e77d9a003e4b7d9d3d5a1cb325619d97c

SHA256
b3d7aec24828263d6cdb07b9ea8aac04f6668fa42e4bef54a49158f8c9b9b8b9

SHA512
5256a39e35b0e19d49cebe793b113b0e09ac920f85e2d7b04fc7dd3b026d3dc028e66b084a7c0e0c3c4d73623039ed25164fd0a8bc22a6cc76cc9146f7b308d1

Download Submit
C:\Windows\system\RizfTMn.exe

Filesize
2.3MB

MD5
34fbc097a077a6e276092a7b467279e1

SHA1
c670e7d8ae64711625ce33e4e53b1fc0e37a9b4f

SHA256
6093fe0a469b323843a0b5bf788b18339760c8bc752594e3d6456ebae45ced36

SHA512
573f28db3c275acab80015ff820c94e40ed3370f93251e9a4431079ca99cf984bf7cacf5a97cbd164745fad17795d247de3a5aec81f2945a5678f0b531ec5baa

Download Submit
C:\Windows\system\Tnkzlka.exe

Filesize
2.3MB

MD5
11bed2eb4de907f9b402e398d3cb80c6

SHA1
0a113257d139a03a2e1eb144af165afcc5948227

SHA256
0690dbad52a809c4d238712241fb43b786b263c34b67a74b2f77256f1c92e47a

SHA512
27c9252a9bb0864a7798e1fbd8910cc165fe8f361f502d2cd23459117b0340e8ded973781ded456c7821cfe31b55531e99d4d7cef9d8f63f341415cff623fad1

Download Submit
C:\Windows\system\WBROMgV.exe

Filesize
2.3MB

MD5
3e33ad4516eff625ddf043ef38f6317f

SHA1
b4210d13591a1486f033b1d1e4cc255c99e5adbf

SHA256
4a19486547b9eea426a9cc20fda8701ce14fca0e1f009a10663731b136f1d061

SHA512
9bca91af71c7c8126520fa1d38cc9556841185d4cfadc1eac2a5e7f7ab3538ab1cfc4c20796a2b60c42129e1a97bc1c71af11e750442f9ea25d7e9d578b38ec7

Download Submit
C:\Windows\system\WRlswgP.exe

Filesize
2.3MB

MD5
4e90367975af4e33cbc1450b18475521

SHA1
a229ef78e260a7ee88528cd3ff36f18dc253f395

SHA256
fc1b9fc3d6d6b09f7749691ff0af62fc467ff613b52707a245cd6d77745bd659

SHA512
d331b15feab7f1f5833857ece58c8fe106fe91189cd0728be0e2134b0b88e417485dec501ca6d88cb359758c1de0dcd0cf3dee427da1cc3e5b7201004239b536

Download Submit
C:\Windows\system\XrfmCni.exe

Filesize
2.3MB

MD5
7ca0ddc81a66b75ec7f4f1e31b202e63

SHA1
823136f6f0bc1da8a7a58534863240e979b248d4

SHA256
9f8620e04af1db46b90b694f199928d0c9a79b23e5fbd435566d8313ea309bcb

SHA512
490b6c11e195f041373cb18f25631d601f6b0b881f53be526a7fd068b6abd881154aa93e56ac410754ac585397d480f085cd4172643d275849d0759ab28f3c9c

Download Submit
C:\Windows\system\aBsmOGu.exe

Filesize
2.3MB

MD5
c1cccb4a61f7c7a942a06b993eca8831

SHA1
8c36009e9e1ab30b896a00e6fef1da6720c07747

SHA256
0ecfb6215b1b15f623eca0e7da533365e5f7b907a8a96bdbdf721d2a6ea97e85

SHA512
93bb856c7e0ebfadd17969c2e746dba23475f657099fa02f57e451dad0aeac67e21fe56ace375d3e39c1f94ddbb635b19fd4451b640606e6dca62fd2c56588e3

Download Submit
C:\Windows\system\cxfPXaC.exe

Filesize
2.3MB

MD5
3a6691de71d50c7e8031ee82213b9f76

SHA1
eb2b040c00944c3397c3b8bc426098a490e8683d

SHA256
7994ecf07d4a015a417d9c64a721963e55fb2be28cb824e3c10aec4683c616d6

SHA512
995f7ee96e954c1a05632e0bf06e7ac9964c02e14fef241317cf7c0d80979e852322ccf8f085a1e2c3ba842a6003e7e3a4385a0544ab5c699524e2cb16da22f6

Download Submit
C:\Windows\system\eNiTadX.exe

Filesize
2.3MB

MD5
cd869858216d0d52d5f4815b34ebe156

SHA1
5921c6aba045a5431960450a3b9b065552bb4a19

SHA256
a94ba42774e42b609c94db7cc45ef35470ba5126f3a56f7b96a2bf6547ff466b

SHA512
351638a225445bd23da3acaf74ff4ea442472974b1a18b51ec5610514dd6bd474ee2005f0abf946b553056e827da3dd26e895e73975b1bae09ecb9bd4b6513a7

Download Submit
C:\Windows\system\fQPsurI.exe

Filesize
2.3MB

MD5
ffe79cda3261ee38348d5a0a85b14c17

SHA1
d0257e8e1c142bd9dd0a498a18dff94b9144ef51

SHA256
3624040d306262d6faf0334bf0d186bb49f9a4e46f92ba32ebaadcd35dae5dd2

SHA512
186c7a5bffea2d78f2d89477c7816cc81e7c0bbe42bb75b6cb15c8475f77909d91c08e91bf30bf52f25afc83cd6d46b26870083877b3af7d5ee14f9f19b0a7e5

Download Submit
C:\Windows\system\gZLCsfe.exe

Filesize
2.3MB

MD5
8310645de1ea37e19877b84423083b64

SHA1
8a6e8106c8dc3e8f1c546827247bd868435543ad

SHA256
c7eaf24bbca77033a004995ca9b46cec7f3d907fc7013915ea72124f4a6de216

SHA512
c6c8b93bec0bfc5518a5ecf03e940f05e6cab060f6d56860e5ff4cd63839d6850ea5180d1f38709ab8f98581f3ff7b4a030607de2dcbc1c3ce756240f7d17c68

Download Submit
C:\Windows\system\hVZCHwW.exe

Filesize
2.3MB

MD5
9dfe0cb8a5c453af967261c1a12360e0

SHA1
a5377f37a2a1882cbbca9766dd9e2db5eabfcbf7

SHA256
adc3d0e1f371488a6359a2606b1cc193cb0c27991195f4369c10db30bd0f3610

SHA512
4365f4629ae48aa01adab4473faf479fb1be1e360fbc3d480a825aaabb038b9f87318b984980db40837984a93e6a3c995d935d11cd6e9ff9bbd17605dcbdd34b

Download Submit
C:\Windows\system\nFOoozq.exe

Filesize
2.3MB

MD5
4aeddaf3246b74d2e80d5f676ceb7b48

SHA1
c35510fb5fabf90fd2882e2fdc8039587f248116

SHA256
bffa3e8b120e2b09c649458917b88a36c3f094e138ee592e0411facfc0cfbe7c

SHA512
ba6b10e1d66a34a2277f5d92e7b8dd8b9f2a1cec73bc66320bb4bb24c2ba90cb1d8af3047b16551a542953008503169464bf3927b186647fa2549a3b458f1863

Download Submit
C:\Windows\system\nhVRedA.exe

Filesize
2.3MB

MD5
c7b4d8ecb51d5789bf506b4ad4d4e45b

SHA1
925d6337e421b39a32b483683d597c7f0f415f42

SHA256
9faeb837475671a456a218966935fcf5b2e7245a82304e7d11a8eadcca6c208f

SHA512
dc63050ee560acdaa5b4095fecd97197756fd549db5ea0d1fa1413406ad7e07dc6b690ee439c66f93527b5ea99c4755d78389616f87e7c673a5509fb0384cc4e

Download Submit
C:\Windows\system\sIjsHJN.exe

Filesize
2.3MB

MD5
6e000399178df5956e1371ad105432c0

SHA1
fc55c43be066d2f94f618f2264f875c4d653a592

SHA256
aec5b6c7c21a5067c1196d27bc018eb49dc34a0a6627e9dfb7f51d1d71df49ed

SHA512
6a7e5a133023b7602400a499cdcb217568b3df5929c6d446f27ee01dde37258733a63eff1bbd9f4994c7217fb9290e5baf341686edf23ba62b2ca1a70564e493

Download Submit
C:\Windows\system\siAYaop.exe

Filesize
2.3MB

MD5
282bebf0f3930658c7922be4347bd699

SHA1
e08db5c269c5275aa481a022295b658f75a129e7

SHA256
105a0c361e7c25bd9afc72288fbe8e407ebcf38a7edab03b4f2f88b2471b2af4

SHA512
1dd26593b1a8559798b32eac0d022b5e8e20047ee2bdb8f0255b68c49567013925df888390aa41d21d6067ee09bd812e1d298fc94e7fe047e3b1d4f6f5510d82

Download Submit
C:\Windows\system\tjJTusB.exe

Filesize
2.3MB

MD5
54b24736bc0da6a1eb68072eb8434c1b

SHA1
56a201e1887aaef782de3c497d1d3ebc62436675

SHA256
6ce39125cc83faeb523fd596e07676c1b7f0e7218a3002606703126d1a1f65a7

SHA512
43f3a7c32eca4728e331e8f559d05286224a3c7d4c2aacdebbf8192e7db1a7a868d7c4a8930a55cea40b4f447ad5111dcd2dc79a3db9ea80f03683c973106ba0

Download Submit
C:\Windows\system\vXXeRuK.exe

Filesize
2.3MB

MD5
459d2cfdc94b0e7fbe53727e2ffa2787

SHA1
ec125349e673c477be5da813c72f894260eb73a3

SHA256
5ac995885840d313fa605f7a5c7a8fd7dee82b25366fac349b30455adc065250

SHA512
cafc4e2e480631f7336c62b20a01cf9c1e000754a08fe93686b8b0392f321d7b786816790fbbd30fa1c659069540c21dd3f89c53ff1ff68200af59a2a1f15673

Download Submit
C:\Windows\system\vhoGBdV.exe

Filesize
2.3MB

MD5
b5ea597126f477638dd894ce0122181e

SHA1
1e5da24d265923fe23b3fd214aa1b397e966027e

SHA256
15f3c7b226d9ba60437fd9d41d758b00416792a4c87121ae1a1002647a9a8300

SHA512
83e887bdbcf51b73b0aef790d1cca0f73ab213801943ca66d944c7b6b05eaae3ffc1e2538c7d3b717044939582e2fc8e61545653d578a724e2b4985433743575

Download Submit
C:\Windows\system\xPSiVme.exe

Filesize
2.3MB

MD5
3c24c583789a1477f98ae146942ada33

SHA1
21ecad3d9fc3188a2c74a7e3a4890cf5ecb756f8

SHA256
27668bdfc825488a80f864ff697da654e4d25315aa0624f2975ff62370021cec

SHA512
c073c9237aba753503b485bfc0a453941dbd9475e23d05d1c2a6f32c864a6fabcc326fe181d2739fe32d26dbdf665077e70772b9a930a6c9d597a4b1f44b8a46

Download Submit
C:\Windows\system\xrpctDv.exe

Filesize
2.3MB

MD5
17c3bb1cdee2a17d55eafe9bb492f2ac

SHA1
ccdea1caec4f78646d982b3772e19872171a61dd

SHA256
6528455e60e1fcdb51a49846b54ab371488bf88e28c96b9bbd2b974012a046f6

SHA512
115a9ea30a31664d052ef040aa6d12fe5dad9542488da937b32d2d8b04e0e2aa2523ddb37ea7dd9f0d61004381815a2fbe7a90a129a873617241c30ba766fae7

Download Submit
\Windows\system\FlEkrhV.exe

Filesize
2.3MB

MD5
c1a5180ee913c43ab6af3becbfbf921e

SHA1
8b32757238b4e518f185799b52313ef12882e951

SHA256
55e69406aa2cf238d05fd3cdfedab2ac9c43235aab481762991f1b5f4ddaba87

SHA512
9a83a0edc4bf8ded210cffe7e91d3d7a06121294d619fa1137816eb864e3ec1e81d8408237d98d87a709c4c79ef56b4991c97770d9aac70b1986cb4c147dbf61

Download Submit
\Windows\system\JxYekCx.exe

Filesize
2.3MB

MD5
c00043f984e22f7d342e2717b3806cc6

SHA1
bedc643258ef2c35701611708e52aea302495ebb

SHA256
c72f344d5c5536ced92e2e3b28f40d9afd8a1f6913d69039dc8a8251bd415f2f

SHA512
323bd3c94c5653371c168ef3471af45a544e4fe4a3ebaed3ef87e6741542a52f378783a9b1d5912114c4d98dd2867130ab84c503fae4ba9b8dde551359cdc365

Download Submit
\Windows\system\PSBWhYk.exe

Filesize
2.3MB

MD5
968030036e52bf4363921fc7c9252602

SHA1
c37ba55721ddb62fcd1f6c037ebc2b98bbdcb08e

SHA256
b2eaf7e7626fa849e14c67f07be878de1e6eebc21b44accadb73934101b7b2c3

SHA512
fbcfaaab6f9809e879cce4bf64fd87e1a5df405e58bf166a60344f003945feafd2afd48ef1da69fb7cc1309aa6146ab619e48f6f94907009d69e0ec9496373cb

Download Submit
\Windows\system\PrtMCYB.exe

Filesize
2.3MB

MD5
22c3198de00d36519464fc34588bc5b6

SHA1
e77a22fbe01585fdc0f4d29dc42e586eca6afcdb

SHA256
608d00b8a477fdfd18969f00755856fd61f24a3885bc0e79ffeb0f4acac90e96

SHA512
9f5debda0a12d5265654212e5e1b7e859b50a64ea6b12f8e3d6defa47b9eec83e39b31109d93a5da8733fa53f55734b42a201533f080cbd92fb21a1b330b0d9c

Download Submit
\Windows\system\lpiwzUd.exe

Filesize
2.3MB

MD5
e5a05ba44a2c38c0102421c849b83691

SHA1
55a0c087d2ab81f3e622511d3faebb14cd0d61ab

SHA256
d0ca6db34060e11655e3353f92aca07e996b343ad3a963b56ae14fd7a5edfd82

SHA512
6bc73ca8173b265bb71f74b7f068dc6f0df0d47e04de7f9b4de6c015e02c1b504f5badcc2885a66f5af1e32452de475ea1d4f66e313c3b1cefd5d42ee24d19b2

Download Submit
\Windows\system\zAehWWF.exe

Filesize
2.3MB

MD5
7f95c72dc587cf8aa842701a7eb0d221

SHA1
863920cd1bef49e7d44d98e8f28fc188d17abb98

SHA256
27221c693fefdd27247c984771515d6d4b2c5e4098e475e2848b8545889de4c9

SHA512
5afdbc70854f139d2f440637ad9375c403a156e17986ca361096281f5bd51b797050514f617f659875fb2fb68a06876b50b6a29aeac232ff37ed69daf7c0ceee

Download Submit
memory/1700-86-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/1700-81-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-68-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/1700-87-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/1700-1-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-90-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-85-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/1700-27-0x00000000031F0000-0x00000000035E2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-6-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/1700-70-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/1700-72-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/1700-74-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1700-84-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/1700-82-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-80-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2208-102-0x00000000021C0000-0x00000000021C8000-memory.dmp

Filesize
32KB

Download
memory/2208-101-0x000000001B620000-0x000000001B902000-memory.dmp

Filesize
2.9MB

Download
memory/2252-19-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2628-78-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2664-77-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2668-75-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2696-76-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2728-40-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-83-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-79-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/3040-89-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download