xmrig | 82c8a0a9e5ec83173ad54a78cfeccd4b4bd75f81f1b6f3f19829e808475f4356

Analysis

max time kernel
33s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
Size

1.8MB
MD5

0a951e54e12b1ef0849949cab693b8d0
SHA1

e26183a919f263d2ca70e5572c021bef99d0913e
SHA256

82c8a0a9e5ec83173ad54a78cfeccd4b4bd75f81f1b6f3f19829e808475f4356
SHA512

c28171a15e64da1cd036b91729b93082d6d27f054dff9f6f8a1df2972bc2c03beccc5e59fb927c11d28a87848cb02dbad523a398f0e9d69dcfb49b5bb30ab11f
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlZ:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2080-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2560-17-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2524-86-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2272-87-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	xmrig
behavioral1/memory/2456-84-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2616-77-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2472-74-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2560	NXODSSO.exe
2760	ExJpqoD.exe
2456	svTbEuP.exe
2780	DMNhUYo.exe
2472	gbozfGJ.exe
2616	ztLTFId.exe
2524	bogmbBD.exe
2272	YvqLGlH.exe
2444	LonQZTY.exe
2964	WbIzSji.exe
2980	TKLvMHA.exe
1524	govHwrD.exe
2176	pgRPief.exe
2336	ClwSgbI.exe
2512	RBcoJfO.exe
2520	vHmiSQu.exe
1652	gPGyodq.exe
648	clBrtUy.exe
1296	aBSsXfE.exe
2984	sKDxbPT.exe
1200	ItffdaS.exe
2304	edDJmwc.exe
1856	yxVpbZG.exe
872	lvjitpv.exe
692	zZqaIEb.exe
584	ElLoWHp.exe
1416	otEsSbg.exe
1756	GiLTHrY.exe
1992	APboGhs.exe
2940	biBfEcJ.exe
704	kqRqtuU.exe
1744	UPqtpHA.exe
2364	xXKgbtN.exe
1320	KvKaXrW.exe
1720	wagDqQo.exe
1712	IfIwRas.exe
1312	OlvqLrd.exe
3056	itebJAA.exe
1932	OHfOKat.exe
1220	mpfoies.exe
960	lNdqFOe.exe
2056	GcXngBu.exe
2900	XoDdbyG.exe
2340	VXHEQcQ.exe
1456	ErJPftt.exe
2408	ZJaLXaV.exe
2044	QWTBqkq.exe
996	OQGTGxu.exe
2108	UMInTac.exe
1444	HVkJJLm.exe
900	iwlEXbv.exe
1948	iOGhjUH.exe
1540	SIqqPWa.exe
2084	AJNOUJS.exe
2992	gwLbKjA.exe
2744	WedUwtr.exe
2568	meWctjC.exe
2844	BiXLSBY.exe
2976	HHjFCwd.exe
1956	vDNLqgc.exe
2692	VMCoLoK.exe
2824	YPEBgAg.exe
1868	EcqIYwf.exe
1740	LhbyTSx.exe

Loads dropped DLL 64 IoCs

pid	Process
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2080-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x000a000000012255-5.dat	upx
behavioral1/files/0x000b00000001444f-16.dat	upx
behavioral1/memory/2560-17-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x001400000000549e-19.dat	upx
behavioral1/memory/2760-22-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x0008000000014b12-24.dat	upx
behavioral1/files/0x0007000000014c25-28.dat	upx
behavioral1/files/0x0006000000015cb9-50.dat	upx
behavioral1/files/0x0007000000014e5a-44.dat	upx
behavioral1/memory/2524-86-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/memory/2272-87-0x000000013F9D0000-0x000000013FDC2000-memory.dmp	upx
behavioral1/memory/2456-84-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/files/0x0006000000015cca-91.dat	upx
behavioral1/files/0x0006000000015cec-100.dat	upx
behavioral1/files/0x0006000000015d06-110.dat	upx
behavioral1/files/0x0006000000015d6e-121.dat	upx
behavioral1/files/0x0006000000016056-135.dat	upx
behavioral1/files/0x00060000000160f8-140.dat	upx
behavioral1/files/0x0006000000016411-150.dat	upx
behavioral1/files/0x0006000000016597-160.dat	upx
behavioral1/files/0x0006000000016c26-180.dat	upx
behavioral1/files/0x0006000000016c7a-190.dat	upx
behavioral1/files/0x0006000000016c2e-185.dat	upx
behavioral1/files/0x0006000000016a45-170.dat	upx
behavioral1/files/0x0006000000016c17-174.dat	upx
behavioral1/files/0x00060000000167ef-165.dat	upx
behavioral1/files/0x0006000000016525-155.dat	upx
behavioral1/files/0x0006000000016277-145.dat	upx
behavioral1/files/0x0006000000015f9e-130.dat	upx
behavioral1/files/0x0006000000015f1b-124.dat	upx
behavioral1/files/0x0006000000015d5d-115.dat	upx
behavioral1/files/0x0006000000015cf7-105.dat	upx
behavioral1/files/0x0006000000015cdb-95.dat	upx
behavioral1/memory/2616-77-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2472-74-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2780-64-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x0006000000015cc1-63.dat	upx
behavioral1/files/0x0006000000015cad-62.dat	upx
behavioral1/files/0x0009000000015136-61.dat	upx
behavioral1/files/0x0007000000015ca5-57.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QdMNNHo.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\YntjcuM.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\zJOhkul.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\EiEmjtg.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\GmHLBMq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\WqAvVfW.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\dbnqjOZ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\KJbchES.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\xKjLhlq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\BOBGkuq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\cZCoucR.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\hPpJOKg.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\hLaqxSJ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\Walmyse.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\iqUBYSR.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\iwjQhCL.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\NaRSDOj.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\znqsRXb.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\hoKRznQ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\uzPbEvC.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\FKJYlNx.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\AIKhweN.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\mpfoies.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\trusyiO.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\sZrXpIs.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\qkKBeNi.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\jgxyatq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ikzeNIp.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\bhIOXAK.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\tUTBTam.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MOtzXnc.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\reRDSWf.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\pRhjLJW.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\CfFSsGa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\uikynwY.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\bCIGbjQ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\BSQLbkF.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\TBjMkCu.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\EraiZgk.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\MCduAFJ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\vMQIWVt.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ozlMCRQ.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ndHZMHu.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\PBVgJti.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\zZEKlIB.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\SXyugrh.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\ypmmJro.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\rNytduo.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\iWoNlwM.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\WGLORFp.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\cdRTuzK.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\cGXnHBk.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\xKSPdhD.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\SvagRze.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\NsOuZnI.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\VWxNeQq.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\UIHHJXP.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\NXODSSO.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\yNhxFMe.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\PZpyNix.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\aRcXdQa.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\vPdrBQF.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\OvvNtnP.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
File created	C:\Windows\System\zmLqZRz.exe	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2088	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
Token: SeDebugPrivilege	2088	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2088	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2088	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2088	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	29
PID 2080 wrote to memory of 2560	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	30
PID 2080 wrote to memory of 2560	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	30
PID 2080 wrote to memory of 2560	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	30
PID 2080 wrote to memory of 2760	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2760	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2760	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	31
PID 2080 wrote to memory of 2456	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2456	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2456	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	32
PID 2080 wrote to memory of 2780	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2780	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2780	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	33
PID 2080 wrote to memory of 2472	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2472	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2472	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	34
PID 2080 wrote to memory of 2616	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	35
PID 2080 wrote to memory of 2616	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	35
PID 2080 wrote to memory of 2616	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	35
PID 2080 wrote to memory of 2444	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	36
PID 2080 wrote to memory of 2444	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	36
PID 2080 wrote to memory of 2444	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	36
PID 2080 wrote to memory of 2524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	37
PID 2080 wrote to memory of 2524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	37
PID 2080 wrote to memory of 2524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	37
PID 2080 wrote to memory of 2964	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	38
PID 2080 wrote to memory of 2964	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	38
PID 2080 wrote to memory of 2964	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	38
PID 2080 wrote to memory of 2272	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2272	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2272	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	39
PID 2080 wrote to memory of 2980	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	40
PID 2080 wrote to memory of 2980	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	40
PID 2080 wrote to memory of 2980	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	40
PID 2080 wrote to memory of 1524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	41
PID 2080 wrote to memory of 1524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	41
PID 2080 wrote to memory of 1524	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	41
PID 2080 wrote to memory of 2176	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	42
PID 2080 wrote to memory of 2176	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	42
PID 2080 wrote to memory of 2176	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	42
PID 2080 wrote to memory of 2336	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	43
PID 2080 wrote to memory of 2336	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	43
PID 2080 wrote to memory of 2336	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	43
PID 2080 wrote to memory of 2512	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	44
PID 2080 wrote to memory of 2512	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	44
PID 2080 wrote to memory of 2512	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	44
PID 2080 wrote to memory of 2520	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	45
PID 2080 wrote to memory of 2520	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	45
PID 2080 wrote to memory of 2520	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	45
PID 2080 wrote to memory of 1652	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	46
PID 2080 wrote to memory of 1652	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	46
PID 2080 wrote to memory of 1652	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	46
PID 2080 wrote to memory of 648	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	47
PID 2080 wrote to memory of 648	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	47
PID 2080 wrote to memory of 648	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	47
PID 2080 wrote to memory of 1296	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	48
PID 2080 wrote to memory of 1296	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	48
PID 2080 wrote to memory of 1296	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	48
PID 2080 wrote to memory of 2984	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	49
PID 2080 wrote to memory of 2984	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	49
PID 2080 wrote to memory of 2984	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	49
PID 2080 wrote to memory of 1200	2080	0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a951e54e12b1ef0849949cab693b8d0_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\System\NXODSSO.exe
  C:\Windows\System\NXODSSO.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\ExJpqoD.exe
  C:\Windows\System\ExJpqoD.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\svTbEuP.exe
  C:\Windows\System\svTbEuP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\DMNhUYo.exe
  C:\Windows\System\DMNhUYo.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\gbozfGJ.exe
  C:\Windows\System\gbozfGJ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\ztLTFId.exe
  C:\Windows\System\ztLTFId.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\LonQZTY.exe
  C:\Windows\System\LonQZTY.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\bogmbBD.exe
  C:\Windows\System\bogmbBD.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\WbIzSji.exe
  C:\Windows\System\WbIzSji.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YvqLGlH.exe
  C:\Windows\System\YvqLGlH.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\TKLvMHA.exe
  C:\Windows\System\TKLvMHA.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\govHwrD.exe
  C:\Windows\System\govHwrD.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\pgRPief.exe
  C:\Windows\System\pgRPief.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\ClwSgbI.exe
  C:\Windows\System\ClwSgbI.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\RBcoJfO.exe
  C:\Windows\System\RBcoJfO.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\vHmiSQu.exe
  C:\Windows\System\vHmiSQu.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\gPGyodq.exe
  C:\Windows\System\gPGyodq.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\clBrtUy.exe
  C:\Windows\System\clBrtUy.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\aBSsXfE.exe
  C:\Windows\System\aBSsXfE.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\sKDxbPT.exe
  C:\Windows\System\sKDxbPT.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\ItffdaS.exe
  C:\Windows\System\ItffdaS.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\edDJmwc.exe
  C:\Windows\System\edDJmwc.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\yxVpbZG.exe
  C:\Windows\System\yxVpbZG.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\lvjitpv.exe
  C:\Windows\System\lvjitpv.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\zZqaIEb.exe
  C:\Windows\System\zZqaIEb.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\ElLoWHp.exe
  C:\Windows\System\ElLoWHp.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\otEsSbg.exe
  C:\Windows\System\otEsSbg.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\GiLTHrY.exe
  C:\Windows\System\GiLTHrY.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\APboGhs.exe
  C:\Windows\System\APboGhs.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\biBfEcJ.exe
  C:\Windows\System\biBfEcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\kqRqtuU.exe
  C:\Windows\System\kqRqtuU.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\UPqtpHA.exe
  C:\Windows\System\UPqtpHA.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\xXKgbtN.exe
  C:\Windows\System\xXKgbtN.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\wagDqQo.exe
  C:\Windows\System\wagDqQo.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\KvKaXrW.exe
  C:\Windows\System\KvKaXrW.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\IfIwRas.exe
  C:\Windows\System\IfIwRas.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\OlvqLrd.exe
  C:\Windows\System\OlvqLrd.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\itebJAA.exe
  C:\Windows\System\itebJAA.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\OHfOKat.exe
  C:\Windows\System\OHfOKat.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\mpfoies.exe
  C:\Windows\System\mpfoies.exe
  2⤵
  - Executes dropped EXE
  PID:1220
- C:\Windows\System\lNdqFOe.exe
  C:\Windows\System\lNdqFOe.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\GcXngBu.exe
  C:\Windows\System\GcXngBu.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XoDdbyG.exe
  C:\Windows\System\XoDdbyG.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\VXHEQcQ.exe
  C:\Windows\System\VXHEQcQ.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\ErJPftt.exe
  C:\Windows\System\ErJPftt.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\ZJaLXaV.exe
  C:\Windows\System\ZJaLXaV.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\QWTBqkq.exe
  C:\Windows\System\QWTBqkq.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\OQGTGxu.exe
  C:\Windows\System\OQGTGxu.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\UMInTac.exe
  C:\Windows\System\UMInTac.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\HVkJJLm.exe
  C:\Windows\System\HVkJJLm.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\iwlEXbv.exe
  C:\Windows\System\iwlEXbv.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\iOGhjUH.exe
  C:\Windows\System\iOGhjUH.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\SIqqPWa.exe
  C:\Windows\System\SIqqPWa.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\AJNOUJS.exe
  C:\Windows\System\AJNOUJS.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\gwLbKjA.exe
  C:\Windows\System\gwLbKjA.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\WedUwtr.exe
  C:\Windows\System\WedUwtr.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\meWctjC.exe
  C:\Windows\System\meWctjC.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\BiXLSBY.exe
  C:\Windows\System\BiXLSBY.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\HHjFCwd.exe
  C:\Windows\System\HHjFCwd.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\vDNLqgc.exe
  C:\Windows\System\vDNLqgc.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\VMCoLoK.exe
  C:\Windows\System\VMCoLoK.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\YPEBgAg.exe
  C:\Windows\System\YPEBgAg.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\EcqIYwf.exe
  C:\Windows\System\EcqIYwf.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\LhbyTSx.exe
  C:\Windows\System\LhbyTSx.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\yazjVZO.exe
  C:\Windows\System\yazjVZO.exe
  2⤵
  PID:1476
- C:\Windows\System\WJvaUHA.exe
  C:\Windows\System\WJvaUHA.exe
  2⤵
  PID:1472
- C:\Windows\System\wrYebSg.exe
  C:\Windows\System\wrYebSg.exe
  2⤵
  PID:1972
- C:\Windows\System\ZbhpfgP.exe
  C:\Windows\System\ZbhpfgP.exe
  2⤵
  PID:1336
- C:\Windows\System\dPfyILH.exe
  C:\Windows\System\dPfyILH.exe
  2⤵
  PID:2028
- C:\Windows\System\OObZqnN.exe
  C:\Windows\System\OObZqnN.exe
  2⤵
  PID:2244
- C:\Windows\System\tusgMRY.exe
  C:\Windows\System\tusgMRY.exe
  2⤵
  PID:2432
- C:\Windows\System\AFTtIEu.exe
  C:\Windows\System\AFTtIEu.exe
  2⤵
  PID:604
- C:\Windows\System\ilwoxjJ.exe
  C:\Windows\System\ilwoxjJ.exe
  2⤵
  PID:2064
- C:\Windows\System\rnrxBiW.exe
  C:\Windows\System\rnrxBiW.exe
  2⤵
  PID:2416
- C:\Windows\System\ACNHmTV.exe
  C:\Windows\System\ACNHmTV.exe
  2⤵
  PID:2224
- C:\Windows\System\GmHLBMq.exe
  C:\Windows\System\GmHLBMq.exe
  2⤵
  PID:848
- C:\Windows\System\PrnpJwD.exe
  C:\Windows\System\PrnpJwD.exe
  2⤵
  PID:1940
- C:\Windows\System\VQmwUCK.exe
  C:\Windows\System\VQmwUCK.exe
  2⤵
  PID:1236
- C:\Windows\System\DYWfSoX.exe
  C:\Windows\System\DYWfSoX.exe
  2⤵
  PID:972
- C:\Windows\System\zmLqZRz.exe
  C:\Windows\System\zmLqZRz.exe
  2⤵
  PID:976
- C:\Windows\System\jJaFKyK.exe
  C:\Windows\System\jJaFKyK.exe
  2⤵
  PID:1000
- C:\Windows\System\ZbHqJHv.exe
  C:\Windows\System\ZbHqJHv.exe
  2⤵
  PID:856
- C:\Windows\System\uJpEeNf.exe
  C:\Windows\System\uJpEeNf.exe
  2⤵
  PID:928
- C:\Windows\System\bCIGbjQ.exe
  C:\Windows\System\bCIGbjQ.exe
  2⤵
  PID:2172
- C:\Windows\System\nZIvfyy.exe
  C:\Windows\System\nZIvfyy.exe
  2⤵
  PID:2208
- C:\Windows\System\uFayRNg.exe
  C:\Windows\System\uFayRNg.exe
  2⤵
  PID:1700
- C:\Windows\System\LODNqSy.exe
  C:\Windows\System\LODNqSy.exe
  2⤵
  PID:2876
- C:\Windows\System\MOVWdvO.exe
  C:\Windows\System\MOVWdvO.exe
  2⤵
  PID:2608
- C:\Windows\System\BEqkOiy.exe
  C:\Windows\System\BEqkOiy.exe
  2⤵
  PID:1616
- C:\Windows\System\uIYxutR.exe
  C:\Windows\System\uIYxutR.exe
  2⤵
  PID:2192
- C:\Windows\System\EYyvdJa.exe
  C:\Windows\System\EYyvdJa.exe
  2⤵
  PID:1676
- C:\Windows\System\OEqrnCA.exe
  C:\Windows\System\OEqrnCA.exe
  2⤵
  PID:1808
- C:\Windows\System\YTZosjh.exe
  C:\Windows\System\YTZosjh.exe
  2⤵
  PID:2768
- C:\Windows\System\JFvJYBE.exe
  C:\Windows\System\JFvJYBE.exe
  2⤵
  PID:2752
- C:\Windows\System\UEiVIMQ.exe
  C:\Windows\System\UEiVIMQ.exe
  2⤵
  PID:2604
- C:\Windows\System\xTxOqYQ.exe
  C:\Windows\System\xTxOqYQ.exe
  2⤵
  PID:2360
- C:\Windows\System\YufVAxy.exe
  C:\Windows\System\YufVAxy.exe
  2⤵
  PID:2968
- C:\Windows\System\hXXOfJu.exe
  C:\Windows\System\hXXOfJu.exe
  2⤵
  PID:1896
- C:\Windows\System\UgdQdEx.exe
  C:\Windows\System\UgdQdEx.exe
  2⤵
  PID:2796
- C:\Windows\System\AGMYrsA.exe
  C:\Windows\System\AGMYrsA.exe
  2⤵
  PID:1124
- C:\Windows\System\MMxNtpO.exe
  C:\Windows\System\MMxNtpO.exe
  2⤵
  PID:2712
- C:\Windows\System\CJOJxQd.exe
  C:\Windows\System\CJOJxQd.exe
  2⤵
  PID:1568
- C:\Windows\System\HeyciLQ.exe
  C:\Windows\System\HeyciLQ.exe
  2⤵
  PID:2008
- C:\Windows\System\xrTEbiZ.exe
  C:\Windows\System\xrTEbiZ.exe
  2⤵
  PID:2300
- C:\Windows\System\QNapUFo.exe
  C:\Windows\System\QNapUFo.exe
  2⤵
  PID:1668
- C:\Windows\System\RsOYFCm.exe
  C:\Windows\System\RsOYFCm.exe
  2⤵
  PID:268
- C:\Windows\System\RckBPLf.exe
  C:\Windows\System\RckBPLf.exe
  2⤵
  PID:2696
- C:\Windows\System\CDgTRnC.exe
  C:\Windows\System\CDgTRnC.exe
  2⤵
  PID:1156
- C:\Windows\System\UTwjBtg.exe
  C:\Windows\System\UTwjBtg.exe
  2⤵
  PID:2332
- C:\Windows\System\nOmHEzS.exe
  C:\Windows\System\nOmHEzS.exe
  2⤵
  PID:2960
- C:\Windows\System\wFlFZyT.exe
  C:\Windows\System\wFlFZyT.exe
  2⤵
  PID:1328
- C:\Windows\System\KemHPSr.exe
  C:\Windows\System\KemHPSr.exe
  2⤵
  PID:2620
- C:\Windows\System\BSQLbkF.exe
  C:\Windows\System\BSQLbkF.exe
  2⤵
  PID:1120
- C:\Windows\System\OjuSlIF.exe
  C:\Windows\System\OjuSlIF.exe
  2⤵
  PID:1232
- C:\Windows\System\ZUtSyTQ.exe
  C:\Windows\System\ZUtSyTQ.exe
  2⤵
  PID:1052
- C:\Windows\System\WGLORFp.exe
  C:\Windows\System\WGLORFp.exe
  2⤵
  PID:3024
- C:\Windows\System\GHeafXy.exe
  C:\Windows\System\GHeafXy.exe
  2⤵
  PID:332
- C:\Windows\System\GYUfWbC.exe
  C:\Windows\System\GYUfWbC.exe
  2⤵
  PID:3052
- C:\Windows\System\kUqmtmM.exe
  C:\Windows\System\kUqmtmM.exe
  2⤵
  PID:576
- C:\Windows\System\DespwNH.exe
  C:\Windows\System\DespwNH.exe
  2⤵
  PID:1960
- C:\Windows\System\gGXhcsY.exe
  C:\Windows\System\gGXhcsY.exe
  2⤵
  PID:1380
- C:\Windows\System\rYbDifF.exe
  C:\Windows\System\rYbDifF.exe
  2⤵
  PID:3060
- C:\Windows\System\UxUTWxC.exe
  C:\Windows\System\UxUTWxC.exe
  2⤵
  PID:2320
- C:\Windows\System\zrPmeWP.exe
  C:\Windows\System\zrPmeWP.exe
  2⤵
  PID:1908
- C:\Windows\System\LZgalUQ.exe
  C:\Windows\System\LZgalUQ.exe
  2⤵
  PID:2636
- C:\Windows\System\VQbykdB.exe
  C:\Windows\System\VQbykdB.exe
  2⤵
  PID:2756
- C:\Windows\System\RebXZAo.exe
  C:\Windows\System\RebXZAo.exe
  2⤵
  PID:2772
- C:\Windows\System\IANrJXB.exe
  C:\Windows\System\IANrJXB.exe
  2⤵
  PID:2420
- C:\Windows\System\zZVglOI.exe
  C:\Windows\System\zZVglOI.exe
  2⤵
  PID:2676
- C:\Windows\System\CfKWcuU.exe
  C:\Windows\System\CfKWcuU.exe
  2⤵
  PID:1624
- C:\Windows\System\FeXphhV.exe
  C:\Windows\System\FeXphhV.exe
  2⤵
  PID:1572
- C:\Windows\System\bjFNkPr.exe
  C:\Windows\System\bjFNkPr.exe
  2⤵
  PID:2840
- C:\Windows\System\zNUoUtM.exe
  C:\Windows\System\zNUoUtM.exe
  2⤵
  PID:2592
- C:\Windows\System\nSoPJoo.exe
  C:\Windows\System\nSoPJoo.exe
  2⤵
  PID:1020
- C:\Windows\System\KouhUVx.exe
  C:\Windows\System\KouhUVx.exe
  2⤵
  PID:2868
- C:\Windows\System\usvDNeh.exe
  C:\Windows\System\usvDNeh.exe
  2⤵
  PID:2908
- C:\Windows\System\gUviJRG.exe
  C:\Windows\System\gUviJRG.exe
  2⤵
  PID:2764
- C:\Windows\System\mKNGbPF.exe
  C:\Windows\System\mKNGbPF.exe
  2⤵
  PID:2736
- C:\Windows\System\SxAicIi.exe
  C:\Windows\System\SxAicIi.exe
  2⤵
  PID:3048
- C:\Windows\System\agHYerb.exe
  C:\Windows\System\agHYerb.exe
  2⤵
  PID:2784
- C:\Windows\System\asLurSj.exe
  C:\Windows\System\asLurSj.exe
  2⤵
  PID:2536
- C:\Windows\System\jCQqNzK.exe
  C:\Windows\System\jCQqNzK.exe
  2⤵
  PID:820
- C:\Windows\System\vPvHIPp.exe
  C:\Windows\System\vPvHIPp.exe
  2⤵
  PID:108
- C:\Windows\System\YDhGDfI.exe
  C:\Windows\System\YDhGDfI.exe
  2⤵
  PID:2428
- C:\Windows\System\NPuBXFY.exe
  C:\Windows\System\NPuBXFY.exe
  2⤵
  PID:1600
- C:\Windows\System\GWqAMKf.exe
  C:\Windows\System\GWqAMKf.exe
  2⤵
  PID:1636
- C:\Windows\System\nTluhap.exe
  C:\Windows\System\nTluhap.exe
  2⤵
  PID:880
- C:\Windows\System\YXNPHCa.exe
  C:\Windows\System\YXNPHCa.exe
  2⤵
  PID:608
- C:\Windows\System\ifLudby.exe
  C:\Windows\System\ifLudby.exe
  2⤵
  PID:1796
- C:\Windows\System\JkOASLJ.exe
  C:\Windows\System\JkOASLJ.exe
  2⤵
  PID:2356
- C:\Windows\System\fAEiNFw.exe
  C:\Windows\System\fAEiNFw.exe
  2⤵
  PID:1632
- C:\Windows\System\IiByNGc.exe
  C:\Windows\System\IiByNGc.exe
  2⤵
  PID:1640
- C:\Windows\System\aelqBKv.exe
  C:\Windows\System\aelqBKv.exe
  2⤵
  PID:2788
- C:\Windows\System\gpTBzDt.exe
  C:\Windows\System\gpTBzDt.exe
  2⤵
  PID:1656
- C:\Windows\System\qlhBmWv.exe
  C:\Windows\System\qlhBmWv.exe
  2⤵
  PID:2912
- C:\Windows\System\GWiNLoZ.exe
  C:\Windows\System\GWiNLoZ.exe
  2⤵
  PID:1148
- C:\Windows\System\ROQLxRx.exe
  C:\Windows\System\ROQLxRx.exe
  2⤵
  PID:1376
- C:\Windows\System\tMsEoUM.exe
  C:\Windows\System\tMsEoUM.exe
  2⤵
  PID:2680
- C:\Windows\System\iKmUMgy.exe
  C:\Windows\System\iKmUMgy.exe
  2⤵
  PID:1628
- C:\Windows\System\PwGztMc.exe
  C:\Windows\System\PwGztMc.exe
  2⤵
  PID:1576
- C:\Windows\System\CBIemQB.exe
  C:\Windows\System\CBIemQB.exe
  2⤵
  PID:2668
- C:\Windows\System\zyYgfKx.exe
  C:\Windows\System\zyYgfKx.exe
  2⤵
  PID:2412
- C:\Windows\System\fEZoqdf.exe
  C:\Windows\System\fEZoqdf.exe
  2⤵
  PID:2424
- C:\Windows\System\fhUFpcB.exe
  C:\Windows\System\fhUFpcB.exe
  2⤵
  PID:3084
- C:\Windows\System\rVgjCDr.exe
  C:\Windows\System\rVgjCDr.exe
  2⤵
  PID:3100
- C:\Windows\System\kRbolik.exe
  C:\Windows\System\kRbolik.exe
  2⤵
  PID:3116
- C:\Windows\System\sOhDHXA.exe
  C:\Windows\System\sOhDHXA.exe
  2⤵
  PID:3132
- C:\Windows\System\tvgQrSR.exe
  C:\Windows\System\tvgQrSR.exe
  2⤵
  PID:3148
- C:\Windows\System\dRnqcWX.exe
  C:\Windows\System\dRnqcWX.exe
  2⤵
  PID:3164
- C:\Windows\System\xtbFRDY.exe
  C:\Windows\System\xtbFRDY.exe
  2⤵
  PID:3180
- C:\Windows\System\HReXdnr.exe
  C:\Windows\System\HReXdnr.exe
  2⤵
  PID:3196
- C:\Windows\System\WjWPDJp.exe
  C:\Windows\System\WjWPDJp.exe
  2⤵
  PID:3212
- C:\Windows\System\RFoOrpC.exe
  C:\Windows\System\RFoOrpC.exe
  2⤵
  PID:3228
- C:\Windows\System\giltJbQ.exe
  C:\Windows\System\giltJbQ.exe
  2⤵
  PID:3244
- C:\Windows\System\hESFSGy.exe
  C:\Windows\System\hESFSGy.exe
  2⤵
  PID:3260
- C:\Windows\System\jiIDycw.exe
  C:\Windows\System\jiIDycw.exe
  2⤵
  PID:3276
- C:\Windows\System\kUoEnMD.exe
  C:\Windows\System\kUoEnMD.exe
  2⤵
  PID:3332
- C:\Windows\System\SAWCjVn.exe
  C:\Windows\System\SAWCjVn.exe
  2⤵
  PID:3352
- C:\Windows\System\IsyuTWQ.exe
  C:\Windows\System\IsyuTWQ.exe
  2⤵
  PID:3368
- C:\Windows\System\UXTNcdX.exe
  C:\Windows\System\UXTNcdX.exe
  2⤵
  PID:3384
- C:\Windows\System\FJkUlIK.exe
  C:\Windows\System\FJkUlIK.exe
  2⤵
  PID:3400
- C:\Windows\System\aAXhciF.exe
  C:\Windows\System\aAXhciF.exe
  2⤵
  PID:3416
- C:\Windows\System\nLRuYAV.exe
  C:\Windows\System\nLRuYAV.exe
  2⤵
  PID:3432
- C:\Windows\System\JDlrnpk.exe
  C:\Windows\System\JDlrnpk.exe
  2⤵
  PID:3448
- C:\Windows\System\gvACTIU.exe
  C:\Windows\System\gvACTIU.exe
  2⤵
  PID:3464
- C:\Windows\System\JEknldg.exe
  C:\Windows\System\JEknldg.exe
  2⤵
  PID:3480
- C:\Windows\System\VVKYMbg.exe
  C:\Windows\System\VVKYMbg.exe
  2⤵
  PID:3496
- C:\Windows\System\aPImvDG.exe
  C:\Windows\System\aPImvDG.exe
  2⤵
  PID:3512
- C:\Windows\System\OxAPVES.exe
  C:\Windows\System\OxAPVES.exe
  2⤵
  PID:3528
- C:\Windows\System\RVjPUjk.exe
  C:\Windows\System\RVjPUjk.exe
  2⤵
  PID:3544
- C:\Windows\System\kkzPQZe.exe
  C:\Windows\System\kkzPQZe.exe
  2⤵
  PID:3560
- C:\Windows\System\jABDuDx.exe
  C:\Windows\System\jABDuDx.exe
  2⤵
  PID:3576
- C:\Windows\System\SQJyRKc.exe
  C:\Windows\System\SQJyRKc.exe
  2⤵
  PID:3592
- C:\Windows\System\dvMyzJY.exe
  C:\Windows\System\dvMyzJY.exe
  2⤵
  PID:3608
- C:\Windows\System\zugLFIt.exe
  C:\Windows\System\zugLFIt.exe
  2⤵
  PID:3628
- C:\Windows\System\PiEbggG.exe
  C:\Windows\System\PiEbggG.exe
  2⤵
  PID:3644
- C:\Windows\System\eZieCjM.exe
  C:\Windows\System\eZieCjM.exe
  2⤵
  PID:3660
- C:\Windows\System\afMLrYL.exe
  C:\Windows\System\afMLrYL.exe
  2⤵
  PID:3676
- C:\Windows\System\xSmDRnR.exe
  C:\Windows\System\xSmDRnR.exe
  2⤵
  PID:3692
- C:\Windows\System\gdWIcsv.exe
  C:\Windows\System\gdWIcsv.exe
  2⤵
  PID:3708
- C:\Windows\System\MSeapxs.exe
  C:\Windows\System\MSeapxs.exe
  2⤵
  PID:3724
- C:\Windows\System\luhiAgA.exe
  C:\Windows\System\luhiAgA.exe
  2⤵
  PID:3740
- C:\Windows\System\RBtMMRG.exe
  C:\Windows\System\RBtMMRG.exe
  2⤵
  PID:3756
- C:\Windows\System\qHubIsF.exe
  C:\Windows\System\qHubIsF.exe
  2⤵
  PID:3772
- C:\Windows\System\RzEnMgv.exe
  C:\Windows\System\RzEnMgv.exe
  2⤵
  PID:3788
- C:\Windows\System\vBRabJn.exe
  C:\Windows\System\vBRabJn.exe
  2⤵
  PID:3804
- C:\Windows\System\CmcAaXN.exe
  C:\Windows\System\CmcAaXN.exe
  2⤵
  PID:3820
- C:\Windows\System\hSpRMRQ.exe
  C:\Windows\System\hSpRMRQ.exe
  2⤵
  PID:3836
- C:\Windows\System\KZyymuH.exe
  C:\Windows\System\KZyymuH.exe
  2⤵
  PID:3852
- C:\Windows\System\EQHqpxr.exe
  C:\Windows\System\EQHqpxr.exe
  2⤵
  PID:3868
- C:\Windows\System\kHwYWHf.exe
  C:\Windows\System\kHwYWHf.exe
  2⤵
  PID:3884
- C:\Windows\System\sTdiweO.exe
  C:\Windows\System\sTdiweO.exe
  2⤵
  PID:3900
- C:\Windows\System\SUMMocu.exe
  C:\Windows\System\SUMMocu.exe
  2⤵
  PID:3916
- C:\Windows\System\KoBLqMh.exe
  C:\Windows\System\KoBLqMh.exe
  2⤵
  PID:3932
- C:\Windows\System\JWNkpio.exe
  C:\Windows\System\JWNkpio.exe
  2⤵
  PID:3948
- C:\Windows\System\MNXsKYO.exe
  C:\Windows\System\MNXsKYO.exe
  2⤵
  PID:3964
- C:\Windows\System\hIkmIVi.exe
  C:\Windows\System\hIkmIVi.exe
  2⤵
  PID:3980
- C:\Windows\System\HoHUMVZ.exe
  C:\Windows\System\HoHUMVZ.exe
  2⤵
  PID:3996
- C:\Windows\System\LgjCJcA.exe
  C:\Windows\System\LgjCJcA.exe
  2⤵
  PID:4012
- C:\Windows\System\LkFjNwX.exe
  C:\Windows\System\LkFjNwX.exe
  2⤵
  PID:4028
- C:\Windows\System\GKRRIcc.exe
  C:\Windows\System\GKRRIcc.exe
  2⤵
  PID:2252
- C:\Windows\System\citwtNp.exe
  C:\Windows\System\citwtNp.exe
  2⤵
  PID:3108
- C:\Windows\System\TgyRVbR.exe
  C:\Windows\System\TgyRVbR.exe
  2⤵
  PID:3236
- C:\Windows\System\SQRjXZL.exe
  C:\Windows\System\SQRjXZL.exe
  2⤵
  PID:3208
- C:\Windows\System\yNhxFMe.exe
  C:\Windows\System\yNhxFMe.exe
  2⤵
  PID:2584
- C:\Windows\System\JvaBtnC.exe
  C:\Windows\System\JvaBtnC.exe
  2⤵
  PID:3092
- C:\Windows\System\rhyUyfZ.exe
  C:\Windows\System\rhyUyfZ.exe
  2⤵
  PID:2556
- C:\Windows\System\YpzPMGg.exe
  C:\Windows\System\YpzPMGg.exe
  2⤵
  PID:2184
- C:\Windows\System\SIaoqdf.exe
  C:\Windows\System\SIaoqdf.exe
  2⤵
  PID:3224
- C:\Windows\System\tWWkeqx.exe
  C:\Windows\System\tWWkeqx.exe
  2⤵
  PID:3256
- C:\Windows\System\bGIgYML.exe
  C:\Windows\System\bGIgYML.exe
  2⤵
  PID:3344
- C:\Windows\System\SBfmRHB.exe
  C:\Windows\System\SBfmRHB.exe
  2⤵
  PID:3380
- C:\Windows\System\VmEIURY.exe
  C:\Windows\System\VmEIURY.exe
  2⤵
  PID:3440
- C:\Windows\System\AtaBjcb.exe
  C:\Windows\System\AtaBjcb.exe
  2⤵
  PID:3392
- C:\Windows\System\eFBlHoI.exe
  C:\Windows\System\eFBlHoI.exe
  2⤵
  PID:3456
- C:\Windows\System\trusyiO.exe
  C:\Windows\System\trusyiO.exe
  2⤵
  PID:3600
- C:\Windows\System\yVmkDGn.exe
  C:\Windows\System\yVmkDGn.exe
  2⤵
  PID:3556
- C:\Windows\System\MPULbtg.exe
  C:\Windows\System\MPULbtg.exe
  2⤵
  PID:3668
- C:\Windows\System\GbPbGYX.exe
  C:\Windows\System\GbPbGYX.exe
  2⤵
  PID:3652
- C:\Windows\System\RozFQZI.exe
  C:\Windows\System\RozFQZI.exe
  2⤵
  PID:2600
- C:\Windows\System\qTcmoOr.exe
  C:\Windows\System\qTcmoOr.exe
  2⤵
  PID:3700
- C:\Windows\System\OCEYnPo.exe
  C:\Windows\System\OCEYnPo.exe
  2⤵
  PID:3764
- C:\Windows\System\IpRlYmA.exe
  C:\Windows\System\IpRlYmA.exe
  2⤵
  PID:3800
- C:\Windows\System\ZLPUras.exe
  C:\Windows\System\ZLPUras.exe
  2⤵
  PID:3864
- C:\Windows\System\lknWedx.exe
  C:\Windows\System\lknWedx.exe
  2⤵
  PID:3928
- C:\Windows\System\MgWhoAx.exe
  C:\Windows\System\MgWhoAx.exe
  2⤵
  PID:3924
- C:\Windows\System\VHgKcQH.exe
  C:\Windows\System\VHgKcQH.exe
  2⤵
  PID:3960
- C:\Windows\System\wHHLYOk.exe
  C:\Windows\System\wHHLYOk.exe
  2⤵
  PID:3688
- C:\Windows\System\HPpMKKd.exe
  C:\Windows\System\HPpMKKd.exe
  2⤵
  PID:3784
- C:\Windows\System\BKrtXnE.exe
  C:\Windows\System\BKrtXnE.exe
  2⤵
  PID:3880
- C:\Windows\System\fMiJxRN.exe
  C:\Windows\System\fMiJxRN.exe
  2⤵
  PID:3844
- C:\Windows\System\LAwYduE.exe
  C:\Windows\System\LAwYduE.exe
  2⤵
  PID:3908
- C:\Windows\System\qmebMoE.exe
  C:\Windows\System\qmebMoE.exe
  2⤵
  PID:1580
- C:\Windows\System\rBVuBno.exe
  C:\Windows\System\rBVuBno.exe
  2⤵
  PID:4056
- C:\Windows\System\aivlndy.exe
  C:\Windows\System\aivlndy.exe
  2⤵
  PID:4060
- C:\Windows\System\uPGeiYo.exe
  C:\Windows\System\uPGeiYo.exe
  2⤵
  PID:4084
- C:\Windows\System\ojWZGgW.exe
  C:\Windows\System\ojWZGgW.exe
  2⤵
  PID:836
- C:\Windows\System\yVDBkgA.exe
  C:\Windows\System\yVDBkgA.exe
  2⤵
  PID:2248
- C:\Windows\System\UpTtQsl.exe
  C:\Windows\System\UpTtQsl.exe
  2⤵
  PID:1496
- C:\Windows\System\WyPJukK.exe
  C:\Windows\System\WyPJukK.exe
  2⤵
  PID:2660
- C:\Windows\System\OnqWDpg.exe
  C:\Windows\System\OnqWDpg.exe
  2⤵
  PID:3176
- C:\Windows\System\dHvvPFF.exe
  C:\Windows\System\dHvvPFF.exe
  2⤵
  PID:3124
- C:\Windows\System\HMLmSEq.exe
  C:\Windows\System\HMLmSEq.exe
  2⤵
  PID:3096
- C:\Windows\System\WABvubh.exe
  C:\Windows\System\WABvubh.exe
  2⤵
  PID:2684
- C:\Windows\System\QNFyufs.exe
  C:\Windows\System\QNFyufs.exe
  2⤵
  PID:2732
- C:\Windows\System\qhutkFC.exe
  C:\Windows\System\qhutkFC.exe
  2⤵
  PID:3376
- C:\Windows\System\MonhWmS.exe
  C:\Windows\System\MonhWmS.exe
  2⤵
  PID:3460
- C:\Windows\System\HZIGvXN.exe
  C:\Windows\System\HZIGvXN.exe
  2⤵
  PID:2228
- C:\Windows\System\dUnDLCu.exe
  C:\Windows\System\dUnDLCu.exe
  2⤵
  PID:2664
- C:\Windows\System\iQSTFmq.exe
  C:\Windows\System\iQSTFmq.exe
  2⤵
  PID:3492
- C:\Windows\System\cdRTuzK.exe
  C:\Windows\System\cdRTuzK.exe
  2⤵
  PID:3572
- C:\Windows\System\TjXrrek.exe
  C:\Windows\System\TjXrrek.exe
  2⤵
  PID:3640
- C:\Windows\System\NwhRllw.exe
  C:\Windows\System\NwhRllw.exe
  2⤵
  PID:3832
- C:\Windows\System\PrlWhxT.exe
  C:\Windows\System\PrlWhxT.exe
  2⤵
  PID:3752
- C:\Windows\System\KpnRJll.exe
  C:\Windows\System\KpnRJll.exe
  2⤵
  PID:4052
- C:\Windows\System\GIlSuZj.exe
  C:\Windows\System\GIlSuZj.exe
  2⤵
  PID:3848
- C:\Windows\System\rPeGLVl.exe
  C:\Windows\System\rPeGLVl.exe
  2⤵
  PID:2808
- C:\Windows\System\aLHHITJ.exe
  C:\Windows\System\aLHHITJ.exe
  2⤵
  PID:4072
- C:\Windows\System\OcRcOZG.exe
  C:\Windows\System\OcRcOZG.exe
  2⤵
  PID:3524
- C:\Windows\System\JSCaHfs.exe
  C:\Windows\System\JSCaHfs.exe
  2⤵
  PID:4020
- C:\Windows\System\PnzPgCe.exe
  C:\Windows\System\PnzPgCe.exe
  2⤵
  PID:3796
- C:\Windows\System\OlFWTLI.exe
  C:\Windows\System\OlFWTLI.exe
  2⤵
  PID:3076
- C:\Windows\System\yxBavKJ.exe
  C:\Windows\System\yxBavKJ.exe
  2⤵
  PID:1672
- C:\Windows\System\cGXnHBk.exe
  C:\Windows\System\cGXnHBk.exe
  2⤵
  PID:3300
- C:\Windows\System\wFPPmaU.exe
  C:\Windows\System\wFPPmaU.exe
  2⤵
  PID:3080
- C:\Windows\System\BlSGKhh.exe
  C:\Windows\System\BlSGKhh.exe
  2⤵
  PID:2640
- C:\Windows\System\mudjSDm.exe
  C:\Windows\System\mudjSDm.exe
  2⤵
  PID:2628
- C:\Windows\System\BOBGkuq.exe
  C:\Windows\System\BOBGkuq.exe
  2⤵
  PID:3444
- C:\Windows\System\ucdUwTI.exe
  C:\Windows\System\ucdUwTI.exe
  2⤵
  PID:3732
- C:\Windows\System\YDCxldA.exe
  C:\Windows\System\YDCxldA.exe
  2⤵
  PID:3140
- C:\Windows\System\LBpyQQL.exe
  C:\Windows\System\LBpyQQL.exe
  2⤵
  PID:4036
- C:\Windows\System\IgKigux.exe
  C:\Windows\System\IgKigux.exe
  2⤵
  PID:2688
- C:\Windows\System\qNUIIHn.exe
  C:\Windows\System\qNUIIHn.exe
  2⤵
  PID:3268
- C:\Windows\System\JTCxkNL.exe
  C:\Windows\System\JTCxkNL.exe
  2⤵
  PID:4100
- C:\Windows\System\cGKNxoy.exe
  C:\Windows\System\cGKNxoy.exe
  2⤵
  PID:4116
- C:\Windows\System\nZsYyQp.exe
  C:\Windows\System\nZsYyQp.exe
  2⤵
  PID:4132
- C:\Windows\System\EPBvpCL.exe
  C:\Windows\System\EPBvpCL.exe
  2⤵
  PID:4148
- C:\Windows\System\JTWQLxB.exe
  C:\Windows\System\JTWQLxB.exe
  2⤵
  PID:4164
- C:\Windows\System\urquWxv.exe
  C:\Windows\System\urquWxv.exe
  2⤵
  PID:4180
- C:\Windows\System\ikzeNIp.exe
  C:\Windows\System\ikzeNIp.exe
  2⤵
  PID:4196
- C:\Windows\System\gMuySWE.exe
  C:\Windows\System\gMuySWE.exe
  2⤵
  PID:4212
- C:\Windows\System\yoDbZdC.exe
  C:\Windows\System\yoDbZdC.exe
  2⤵
  PID:4228
- C:\Windows\System\tjDGcMF.exe
  C:\Windows\System\tjDGcMF.exe
  2⤵
  PID:4244
- C:\Windows\System\vkPTlvA.exe
  C:\Windows\System\vkPTlvA.exe
  2⤵
  PID:4260
- C:\Windows\System\TJPNtmR.exe
  C:\Windows\System\TJPNtmR.exe
  2⤵
  PID:4276
- C:\Windows\System\Trjmzce.exe
  C:\Windows\System\Trjmzce.exe
  2⤵
  PID:4292
- C:\Windows\System\MsegjRj.exe
  C:\Windows\System\MsegjRj.exe
  2⤵
  PID:4308
- C:\Windows\System\tUTBTam.exe
  C:\Windows\System\tUTBTam.exe
  2⤵
  PID:4324
- C:\Windows\System\emZPyOg.exe
  C:\Windows\System\emZPyOg.exe
  2⤵
  PID:4340
- C:\Windows\System\izUNgIm.exe
  C:\Windows\System\izUNgIm.exe
  2⤵
  PID:4356
- C:\Windows\System\tsKgVeT.exe
  C:\Windows\System\tsKgVeT.exe
  2⤵
  PID:4372
- C:\Windows\System\rBTybfH.exe
  C:\Windows\System\rBTybfH.exe
  2⤵
  PID:4388
- C:\Windows\System\IgBzTtQ.exe
  C:\Windows\System\IgBzTtQ.exe
  2⤵
  PID:4404
- C:\Windows\System\ETcHYRH.exe
  C:\Windows\System\ETcHYRH.exe
  2⤵
  PID:4420
- C:\Windows\System\iwcJVDe.exe
  C:\Windows\System\iwcJVDe.exe
  2⤵
  PID:4440
- C:\Windows\System\CcZuvmz.exe
  C:\Windows\System\CcZuvmz.exe
  2⤵
  PID:4456
- C:\Windows\System\euRyRll.exe
  C:\Windows\System\euRyRll.exe
  2⤵
  PID:4472
- C:\Windows\System\QCMCrOO.exe
  C:\Windows\System\QCMCrOO.exe
  2⤵
  PID:4488
- C:\Windows\System\zgKPWKA.exe
  C:\Windows\System\zgKPWKA.exe
  2⤵
  PID:4504
- C:\Windows\System\dIttQNv.exe
  C:\Windows\System\dIttQNv.exe
  2⤵
  PID:4520
- C:\Windows\System\ovWqnbl.exe
  C:\Windows\System\ovWqnbl.exe
  2⤵
  PID:4536
- C:\Windows\System\nBrWUID.exe
  C:\Windows\System\nBrWUID.exe
  2⤵
  PID:4552
- C:\Windows\System\byrFiss.exe
  C:\Windows\System\byrFiss.exe
  2⤵
  PID:4568
- C:\Windows\System\TdOlEJL.exe
  C:\Windows\System\TdOlEJL.exe
  2⤵
  PID:4588
- C:\Windows\System\qjIaGco.exe
  C:\Windows\System\qjIaGco.exe
  2⤵
  PID:4604
- C:\Windows\System\hMitvtc.exe
  C:\Windows\System\hMitvtc.exe
  2⤵
  PID:4620
- C:\Windows\System\UyfyEXY.exe
  C:\Windows\System\UyfyEXY.exe
  2⤵
  PID:4636
- C:\Windows\System\mlrnaVC.exe
  C:\Windows\System\mlrnaVC.exe
  2⤵
  PID:4652
- C:\Windows\System\agzgrHN.exe
  C:\Windows\System\agzgrHN.exe
  2⤵
  PID:4668
- C:\Windows\System\jKFYiaY.exe
  C:\Windows\System\jKFYiaY.exe
  2⤵
  PID:4688
- C:\Windows\System\cNnWvre.exe
  C:\Windows\System\cNnWvre.exe
  2⤵
  PID:4704
- C:\Windows\System\QbuvHEj.exe
  C:\Windows\System\QbuvHEj.exe
  2⤵
  PID:4720
- C:\Windows\System\JMMqtFl.exe
  C:\Windows\System\JMMqtFl.exe
  2⤵
  PID:4736
- C:\Windows\System\bnCikFa.exe
  C:\Windows\System\bnCikFa.exe
  2⤵
  PID:4752
- C:\Windows\System\UwpeBoN.exe
  C:\Windows\System\UwpeBoN.exe
  2⤵
  PID:4772
- C:\Windows\System\WzjxpAc.exe
  C:\Windows\System\WzjxpAc.exe
  2⤵
  PID:4788
- C:\Windows\System\bqEIRCy.exe
  C:\Windows\System\bqEIRCy.exe
  2⤵
  PID:4804
- C:\Windows\System\CJpakAS.exe
  C:\Windows\System\CJpakAS.exe
  2⤵
  PID:4820
- C:\Windows\System\BhlNgLW.exe
  C:\Windows\System\BhlNgLW.exe
  2⤵
  PID:4840
- C:\Windows\System\LAsTQGa.exe
  C:\Windows\System\LAsTQGa.exe
  2⤵
  PID:4856
- C:\Windows\System\QXquQLf.exe
  C:\Windows\System\QXquQLf.exe
  2⤵
  PID:4880
- C:\Windows\System\sDBYyoo.exe
  C:\Windows\System\sDBYyoo.exe
  2⤵
  PID:4896
- C:\Windows\System\pWhgXeV.exe
  C:\Windows\System\pWhgXeV.exe
  2⤵
  PID:4912
- C:\Windows\System\awzTFVO.exe
  C:\Windows\System\awzTFVO.exe
  2⤵
  PID:4928
- C:\Windows\System\YuZlxFw.exe
  C:\Windows\System\YuZlxFw.exe
  2⤵
  PID:4948
- C:\Windows\System\eUQXBhT.exe
  C:\Windows\System\eUQXBhT.exe
  2⤵
  PID:4968
- C:\Windows\System\RYGlwMG.exe
  C:\Windows\System\RYGlwMG.exe
  2⤵
  PID:4984
- C:\Windows\System\PBVgJti.exe
  C:\Windows\System\PBVgJti.exe
  2⤵
  PID:5000
- C:\Windows\System\vKzsDlH.exe
  C:\Windows\System\vKzsDlH.exe
  2⤵
  PID:5016
- C:\Windows\System\WorkgCC.exe
  C:\Windows\System\WorkgCC.exe
  2⤵
  PID:5032
- C:\Windows\System\AphtEis.exe
  C:\Windows\System\AphtEis.exe
  2⤵
  PID:5048
- C:\Windows\System\tGzkkfp.exe
  C:\Windows\System\tGzkkfp.exe
  2⤵
  PID:5064
- C:\Windows\System\rABdMUk.exe
  C:\Windows\System\rABdMUk.exe
  2⤵
  PID:5084
- C:\Windows\System\DAPFNeZ.exe
  C:\Windows\System\DAPFNeZ.exe
  2⤵
  PID:5100
- C:\Windows\System\oLawZGs.exe
  C:\Windows\System\oLawZGs.exe
  2⤵
  PID:5116
- C:\Windows\System\bIAjJEX.exe
  C:\Windows\System\bIAjJEX.exe
  2⤵
  PID:4044
- C:\Windows\System\yJRTFef.exe
  C:\Windows\System\yJRTFef.exe
  2⤵
  PID:2804
- C:\Windows\System\rzJQaZv.exe
  C:\Windows\System\rzJQaZv.exe
  2⤵
  PID:2220
- C:\Windows\System\EqQcQdc.exe
  C:\Windows\System\EqQcQdc.exe
  2⤵
  PID:3944
- C:\Windows\System\cQaYVsJ.exe
  C:\Windows\System\cQaYVsJ.exe
  2⤵
  PID:3540
- C:\Windows\System\FDpEjCf.exe
  C:\Windows\System\FDpEjCf.exe
  2⤵
  PID:4156
- C:\Windows\System\STsGvSn.exe
  C:\Windows\System\STsGvSn.exe
  2⤵
  PID:4192
- C:\Windows\System\WapWNSf.exe
  C:\Windows\System\WapWNSf.exe
  2⤵
  PID:2740
- C:\Windows\System\tgrlgMp.exe
  C:\Windows\System\tgrlgMp.exe
  2⤵
  PID:4080
- C:\Windows\System\rgzqTDV.exe
  C:\Windows\System\rgzqTDV.exe
  2⤵
  PID:3620
- C:\Windows\System\jFRUMzB.exe
  C:\Windows\System\jFRUMzB.exe
  2⤵
  PID:2828
- C:\Windows\System\SWbymup.exe
  C:\Windows\System\SWbymup.exe
  2⤵
  PID:4204
- C:\Windows\System\yjhMopE.exe
  C:\Windows\System\yjhMopE.exe
  2⤵
  PID:4252
- C:\Windows\System\KcGtrhs.exe
  C:\Windows\System\KcGtrhs.exe
  2⤵
  PID:4236
- C:\Windows\System\cqkklWn.exe
  C:\Windows\System\cqkklWn.exe
  2⤵
  PID:4316
- C:\Windows\System\dpkRQtG.exe
  C:\Windows\System\dpkRQtG.exe
  2⤵
  PID:4348
- C:\Windows\System\LpiagYu.exe
  C:\Windows\System\LpiagYu.exe
  2⤵
  PID:4400
- C:\Windows\System\cecnlPP.exe
  C:\Windows\System\cecnlPP.exe
  2⤵
  PID:4384
- C:\Windows\System\iDuLgGa.exe
  C:\Windows\System\iDuLgGa.exe
  2⤵
  PID:4436
- C:\Windows\System\wMoryPN.exe
  C:\Windows\System\wMoryPN.exe
  2⤵
  PID:4452
- C:\Windows\System\zZBspTn.exe
  C:\Windows\System\zZBspTn.exe
  2⤵
  PID:4516
- C:\Windows\System\AxJoXbR.exe
  C:\Windows\System\AxJoXbR.exe
  2⤵
  PID:4560
- C:\Windows\System\ttioLDx.exe
  C:\Windows\System\ttioLDx.exe
  2⤵
  PID:4468
- C:\Windows\System\iyTzvti.exe
  C:\Windows\System\iyTzvti.exe
  2⤵
  PID:4500
- C:\Windows\System\thZOaBY.exe
  C:\Windows\System\thZOaBY.exe
  2⤵
  PID:4612
- C:\Windows\System\fUOAlSF.exe
  C:\Windows\System\fUOAlSF.exe
  2⤵
  PID:4616
- C:\Windows\System\LkeThKK.exe
  C:\Windows\System\LkeThKK.exe
  2⤵
  PID:4680
- C:\Windows\System\GXFiLCX.exe
  C:\Windows\System\GXFiLCX.exe
  2⤵
  PID:4760
- C:\Windows\System\hLaqxSJ.exe
  C:\Windows\System\hLaqxSJ.exe
  2⤵
  PID:4780
- C:\Windows\System\jiKjmZa.exe
  C:\Windows\System\jiKjmZa.exe
  2⤵
  PID:4816
- C:\Windows\System\dkBvfrq.exe
  C:\Windows\System\dkBvfrq.exe
  2⤵
  PID:4796
- C:\Windows\System\SlEAirr.exe
  C:\Windows\System\SlEAirr.exe
  2⤵
  PID:4852
- C:\Windows\System\bhIOXAK.exe
  C:\Windows\System\bhIOXAK.exe
  2⤵
  PID:4872
- C:\Windows\System\mmjdgST.exe
  C:\Windows\System\mmjdgST.exe
  2⤵
  PID:4924
- C:\Windows\System\pZRUryc.exe
  C:\Windows\System\pZRUryc.exe
  2⤵
  PID:4992
- C:\Windows\System\MwTbjzV.exe
  C:\Windows\System\MwTbjzV.exe
  2⤵
  PID:5012
- C:\Windows\System\aRmVBAA.exe
  C:\Windows\System\aRmVBAA.exe
  2⤵
  PID:5028
- C:\Windows\System\qeJzBih.exe
  C:\Windows\System\qeJzBih.exe
  2⤵
  PID:4904
- C:\Windows\System\shmRjDl.exe
  C:\Windows\System\shmRjDl.exe
  2⤵
  PID:4980
- C:\Windows\System\VUJFrUJ.exe
  C:\Windows\System\VUJFrUJ.exe
  2⤵
  PID:5096
- C:\Windows\System\juYJXwq.exe
  C:\Windows\System\juYJXwq.exe
  2⤵
  PID:3188
- C:\Windows\System\eJiMywg.exe
  C:\Windows\System\eJiMywg.exe
  2⤵
  PID:4188
- C:\Windows\System\wKiBLOg.exe
  C:\Windows\System\wKiBLOg.exe
  2⤵
  PID:3812
- C:\Windows\System\TUhvyPa.exe
  C:\Windows\System\TUhvyPa.exe
  2⤵
  PID:4284
- C:\Windows\System\VsIlmas.exe
  C:\Windows\System\VsIlmas.exe
  2⤵
  PID:4428
- C:\Windows\System\wRHdJWm.exe
  C:\Windows\System\wRHdJWm.exe
  2⤵
  PID:4596
- C:\Windows\System\qNDcNok.exe
  C:\Windows\System\qNDcNok.exe
  2⤵
  PID:1936
- C:\Windows\System\QwskohP.exe
  C:\Windows\System\QwskohP.exe
  2⤵
  PID:3876
- C:\Windows\System\SFTOrRu.exe
  C:\Windows\System\SFTOrRu.exe
  2⤵
  PID:4664
- C:\Windows\System\WmEmQQa.exe
  C:\Windows\System\WmEmQQa.exe
  2⤵
  PID:4548
- C:\Windows\System\qzDipPo.exe
  C:\Windows\System\qzDipPo.exe
  2⤵
  PID:4332
- C:\Windows\System\QcpmstN.exe
  C:\Windows\System\QcpmstN.exe
  2⤵
  PID:4172
- C:\Windows\System\ttdTfUj.exe
  C:\Windows\System\ttdTfUj.exe
  2⤵
  PID:3520
- C:\Windows\System\nJbcquc.exe
  C:\Windows\System\nJbcquc.exe
  2⤵
  PID:4744
- C:\Windows\System\vSxYZfF.exe
  C:\Windows\System\vSxYZfF.exe
  2⤵
  PID:4868
- C:\Windows\System\gmgzMOu.exe
  C:\Windows\System\gmgzMOu.exe
  2⤵
  PID:5024
- C:\Windows\System\QzTCIjd.exe
  C:\Windows\System\QzTCIjd.exe
  2⤵
  PID:3684
- C:\Windows\System\uNFHWDZ.exe
  C:\Windows\System\uNFHWDZ.exe
  2⤵
  PID:4580
- C:\Windows\System\MgisPqk.exe
  C:\Windows\System\MgisPqk.exe
  2⤵
  PID:4512
- C:\Windows\System\FvUtrnc.exe
  C:\Windows\System\FvUtrnc.exe
  2⤵
  PID:2792
- C:\Windows\System\GAWBiAL.exe
  C:\Windows\System\GAWBiAL.exe
  2⤵
  PID:5044
- C:\Windows\System\DPgvgnq.exe
  C:\Windows\System\DPgvgnq.exe
  2⤵
  PID:4940
- C:\Windows\System\fQmjngN.exe
  C:\Windows\System\fQmjngN.exe
  2⤵
  PID:4732
- C:\Windows\System\azdlRwl.exe
  C:\Windows\System\azdlRwl.exe
  2⤵
  PID:4528
- C:\Windows\System\AYqQqJT.exe
  C:\Windows\System\AYqQqJT.exe
  2⤵
  PID:3288
- C:\Windows\System\nivmEMC.exe
  C:\Windows\System\nivmEMC.exe
  2⤵
  PID:4364
- C:\Windows\System\IscLBYw.exe
  C:\Windows\System\IscLBYw.exe
  2⤵
  PID:328
- C:\Windows\System\LzuYiBj.exe
  C:\Windows\System\LzuYiBj.exe
  2⤵
  PID:3472
- C:\Windows\System\DIukMFA.exe
  C:\Windows\System\DIukMFA.exe
  2⤵
  PID:4944
- C:\Windows\System\xEAVhjZ.exe
  C:\Windows\System\xEAVhjZ.exe
  2⤵
  PID:4108
- C:\Windows\System\sZrXpIs.exe
  C:\Windows\System\sZrXpIs.exe
  2⤵
  PID:4648
- C:\Windows\System\XYuReny.exe
  C:\Windows\System\XYuReny.exe
  2⤵
  PID:5124
- C:\Windows\System\oxzyFDb.exe
  C:\Windows\System\oxzyFDb.exe
  2⤵
  PID:5140
- C:\Windows\System\qTmibzF.exe
  C:\Windows\System\qTmibzF.exe
  2⤵
  PID:5156
- C:\Windows\System\OCbeAfu.exe
  C:\Windows\System\OCbeAfu.exe
  2⤵
  PID:5172
- C:\Windows\System\byvwNuD.exe
  C:\Windows\System\byvwNuD.exe
  2⤵
  PID:5188
- C:\Windows\System\WHloijX.exe
  C:\Windows\System\WHloijX.exe
  2⤵
  PID:5204
- C:\Windows\System\wmIimlN.exe
  C:\Windows\System\wmIimlN.exe
  2⤵
  PID:5220
- C:\Windows\System\znqsRXb.exe
  C:\Windows\System\znqsRXb.exe
  2⤵
  PID:5236
- C:\Windows\System\fdQuUBR.exe
  C:\Windows\System\fdQuUBR.exe
  2⤵
  PID:5252
- C:\Windows\System\QlttRYj.exe
  C:\Windows\System\QlttRYj.exe
  2⤵
  PID:5268
- C:\Windows\System\yEMSKxN.exe
  C:\Windows\System\yEMSKxN.exe
  2⤵
  PID:5284
- C:\Windows\System\MrAOBHC.exe
  C:\Windows\System\MrAOBHC.exe
  2⤵
  PID:5304
- C:\Windows\System\hQNrldV.exe
  C:\Windows\System\hQNrldV.exe
  2⤵
  PID:5320
- C:\Windows\System\rfoWSwW.exe
  C:\Windows\System\rfoWSwW.exe
  2⤵
  PID:5336
- C:\Windows\System\GWNmdDc.exe
  C:\Windows\System\GWNmdDc.exe
  2⤵
  PID:5352
- C:\Windows\System\GCSMslQ.exe
  C:\Windows\System\GCSMslQ.exe
  2⤵
  PID:5368
- C:\Windows\System\qjgNrLO.exe
  C:\Windows\System\qjgNrLO.exe
  2⤵
  PID:5384
- C:\Windows\System\SNsyZOy.exe
  C:\Windows\System\SNsyZOy.exe
  2⤵
  PID:5400
- C:\Windows\System\MEIxQOO.exe
  C:\Windows\System\MEIxQOO.exe
  2⤵
  PID:5416
- C:\Windows\System\RNoFUFL.exe
  C:\Windows\System\RNoFUFL.exe
  2⤵
  PID:5432
- C:\Windows\System\ABcDcsM.exe
  C:\Windows\System\ABcDcsM.exe
  2⤵
  PID:5448
- C:\Windows\System\iYUzsLv.exe
  C:\Windows\System\iYUzsLv.exe
  2⤵
  PID:5464
- C:\Windows\System\FyxWYBY.exe
  C:\Windows\System\FyxWYBY.exe
  2⤵
  PID:5480
- C:\Windows\System\PghLkTg.exe
  C:\Windows\System\PghLkTg.exe
  2⤵
  PID:5496
- C:\Windows\System\WqAvVfW.exe
  C:\Windows\System\WqAvVfW.exe
  2⤵
  PID:5512
- C:\Windows\System\VdOQKuv.exe
  C:\Windows\System\VdOQKuv.exe
  2⤵
  PID:5528
- C:\Windows\System\QSQfJoG.exe
  C:\Windows\System\QSQfJoG.exe
  2⤵
  PID:5544
- C:\Windows\System\XSokJSr.exe
  C:\Windows\System\XSokJSr.exe
  2⤵
  PID:5560
- C:\Windows\System\WmGiueK.exe
  C:\Windows\System\WmGiueK.exe
  2⤵
  PID:5580
- C:\Windows\System\nmXyWzY.exe
  C:\Windows\System\nmXyWzY.exe
  2⤵
  PID:5600
- C:\Windows\System\VtjHoit.exe
  C:\Windows\System\VtjHoit.exe
  2⤵
  PID:5616
- C:\Windows\System\CqAyiJT.exe
  C:\Windows\System\CqAyiJT.exe
  2⤵
  PID:5632
- C:\Windows\System\GJMsihg.exe
  C:\Windows\System\GJMsihg.exe
  2⤵
  PID:5648
- C:\Windows\System\QEeMLNG.exe
  C:\Windows\System\QEeMLNG.exe
  2⤵
  PID:5664
- C:\Windows\System\UFyRJqG.exe
  C:\Windows\System\UFyRJqG.exe
  2⤵
  PID:5680
- C:\Windows\System\eNmiDaA.exe
  C:\Windows\System\eNmiDaA.exe
  2⤵
  PID:5696
- C:\Windows\System\JkNBXUc.exe
  C:\Windows\System\JkNBXUc.exe
  2⤵
  PID:5712
- C:\Windows\System\tMCQRVn.exe
  C:\Windows\System\tMCQRVn.exe
  2⤵
  PID:5728
- C:\Windows\System\PUdfqrI.exe
  C:\Windows\System\PUdfqrI.exe
  2⤵
  PID:5744
- C:\Windows\System\CruypsH.exe
  C:\Windows\System\CruypsH.exe
  2⤵
  PID:5760
- C:\Windows\System\UshvoXo.exe
  C:\Windows\System\UshvoXo.exe
  2⤵
  PID:5776
- C:\Windows\System\NiulaCM.exe
  C:\Windows\System\NiulaCM.exe
  2⤵
  PID:5792
- C:\Windows\System\IzTdeaI.exe
  C:\Windows\System\IzTdeaI.exe
  2⤵
  PID:5808
- C:\Windows\System\ZvYtwkp.exe
  C:\Windows\System\ZvYtwkp.exe
  2⤵
  PID:5824
- C:\Windows\System\svwwHyz.exe
  C:\Windows\System\svwwHyz.exe
  2⤵
  PID:5840
- C:\Windows\System\TBNqfzz.exe
  C:\Windows\System\TBNqfzz.exe
  2⤵
  PID:5856
- C:\Windows\System\pIgAcxV.exe
  C:\Windows\System\pIgAcxV.exe
  2⤵
  PID:5872
- C:\Windows\System\QNwjEKk.exe
  C:\Windows\System\QNwjEKk.exe
  2⤵
  PID:5888
- C:\Windows\System\lNYdioK.exe
  C:\Windows\System\lNYdioK.exe
  2⤵
  PID:5904
- C:\Windows\System\ZCxKYvi.exe
  C:\Windows\System\ZCxKYvi.exe
  2⤵
  PID:5920
- C:\Windows\System\yKIqkKn.exe
  C:\Windows\System\yKIqkKn.exe
  2⤵
  PID:5936
- C:\Windows\System\GjOkmMQ.exe
  C:\Windows\System\GjOkmMQ.exe
  2⤵
  PID:5952
- C:\Windows\System\EqWLOqi.exe
  C:\Windows\System\EqWLOqi.exe
  2⤵
  PID:5968
- C:\Windows\System\jMDJXpZ.exe
  C:\Windows\System\jMDJXpZ.exe
  2⤵
  PID:5984
- C:\Windows\System\eLLuuAt.exe
  C:\Windows\System\eLLuuAt.exe
  2⤵
  PID:6000
- C:\Windows\System\ARXRjFm.exe
  C:\Windows\System\ARXRjFm.exe
  2⤵
  PID:6016
- C:\Windows\System\oFJJPel.exe
  C:\Windows\System\oFJJPel.exe
  2⤵
  PID:6032
- C:\Windows\System\cEMDTEZ.exe
  C:\Windows\System\cEMDTEZ.exe
  2⤵
  PID:6048
- C:\Windows\System\lCCPuvB.exe
  C:\Windows\System\lCCPuvB.exe
  2⤵
  PID:6064
- C:\Windows\System\LlyEdhv.exe
  C:\Windows\System\LlyEdhv.exe
  2⤵
  PID:6084
- C:\Windows\System\wDzJOPH.exe
  C:\Windows\System\wDzJOPH.exe
  2⤵
  PID:6100
- C:\Windows\System\iDozBmW.exe
  C:\Windows\System\iDozBmW.exe
  2⤵
  PID:6116
- C:\Windows\System\fhcEEzl.exe
  C:\Windows\System\fhcEEzl.exe
  2⤵
  PID:6132
- C:\Windows\System\HZoDSBp.exe
  C:\Windows\System\HZoDSBp.exe
  2⤵
  PID:4684
- C:\Windows\System\shQrCVQ.exe
  C:\Windows\System\shQrCVQ.exe
  2⤵
  PID:4268
- C:\Windows\System\BdKLqjv.exe
  C:\Windows\System\BdKLqjv.exe
  2⤵
  PID:5108
- C:\Windows\System\uLzEdct.exe
  C:\Windows\System\uLzEdct.exe
  2⤵
  PID:5136
- C:\Windows\System\okohpOp.exe
  C:\Windows\System\okohpOp.exe
  2⤵
  PID:5328
- C:\Windows\System\yqfaMZm.exe
  C:\Windows\System\yqfaMZm.exe
  2⤵
  PID:5232
- C:\Windows\System\umjDuGa.exe
  C:\Windows\System\umjDuGa.exe
  2⤵
  PID:5300
- C:\Windows\System\RZOExcY.exe
  C:\Windows\System\RZOExcY.exe
  2⤵
  PID:4024
- C:\Windows\System\xKSPdhD.exe
  C:\Windows\System\xKSPdhD.exe
  2⤵
  PID:5184
- C:\Windows\System\hjGaTRw.exe
  C:\Windows\System\hjGaTRw.exe
  2⤵
  PID:5248
- C:\Windows\System\oCbhDqa.exe
  C:\Windows\System\oCbhDqa.exe
  2⤵
  PID:5008
- C:\Windows\System\hwmdBmS.exe
  C:\Windows\System\hwmdBmS.exe
  2⤵
  PID:4748
- C:\Windows\System\JPxubxV.exe
  C:\Windows\System\JPxubxV.exe
  2⤵
  PID:5280
- C:\Windows\System\BxSxDZy.exe
  C:\Windows\System\BxSxDZy.exe
  2⤵
  PID:5492
- C:\Windows\System\xzRPilo.exe
  C:\Windows\System\xzRPilo.exe
  2⤵
  PID:5588
- C:\Windows\System\nrQInZE.exe
  C:\Windows\System\nrQInZE.exe
  2⤵
  PID:4700
- C:\Windows\System\zoPblsZ.exe
  C:\Windows\System\zoPblsZ.exe
  2⤵
  PID:4532
- C:\Windows\System\KyaGLRS.exe
  C:\Windows\System\KyaGLRS.exe
  2⤵
  PID:5412
- C:\Windows\System\pyoMJeC.exe
  C:\Windows\System\pyoMJeC.exe
  2⤵
  PID:5540
- C:\Windows\System\GSgulXi.exe
  C:\Windows\System\GSgulXi.exe
  2⤵
  PID:5440
- C:\Windows\System\yuxZomK.exe
  C:\Windows\System\yuxZomK.exe
  2⤵
  PID:5628
- C:\Windows\System\hkOthQi.exe
  C:\Windows\System\hkOthQi.exe
  2⤵
  PID:5640
- C:\Windows\System\QvUXCYV.exe
  C:\Windows\System\QvUXCYV.exe
  2⤵
  PID:5476
- C:\Windows\System\pKAJEUQ.exe
  C:\Windows\System\pKAJEUQ.exe
  2⤵
  PID:5692
- C:\Windows\System\uzPbEvC.exe
  C:\Windows\System\uzPbEvC.exe
  2⤵
  PID:5720
- C:\Windows\System\eRRRqwI.exe
  C:\Windows\System\eRRRqwI.exe
  2⤵
  PID:5736
- C:\Windows\System\upjrKGF.exe
  C:\Windows\System\upjrKGF.exe
  2⤵
  PID:5756
- C:\Windows\System\OBGEwHZ.exe
  C:\Windows\System\OBGEwHZ.exe
  2⤵
  PID:5816
- C:\Windows\System\IvKBCkS.exe
  C:\Windows\System\IvKBCkS.exe
  2⤵
  PID:5880
- C:\Windows\System\CNlVOHq.exe
  C:\Windows\System\CNlVOHq.exe
  2⤵
  PID:5804
- C:\Windows\System\cexmOSF.exe
  C:\Windows\System\cexmOSF.exe
  2⤵
  PID:5944
- C:\Windows\System\nJQYjxA.exe
  C:\Windows\System\nJQYjxA.exe
  2⤵
  PID:5932
- C:\Windows\System\RdwKMGT.exe
  C:\Windows\System\RdwKMGT.exe
  2⤵
  PID:6044
- C:\Windows\System\TQxyTyn.exe
  C:\Windows\System\TQxyTyn.exe
  2⤵
  PID:6076
- C:\Windows\System\VnTMspt.exe
  C:\Windows\System\VnTMspt.exe
  2⤵
  PID:6112
- C:\Windows\System\uivJDhU.exe
  C:\Windows\System\uivJDhU.exe
  2⤵
  PID:5992
- C:\Windows\System\QdJHkTF.exe
  C:\Windows\System\QdJHkTF.exe
  2⤵
  PID:6028
- C:\Windows\System\dHkEAAA.exe
  C:\Windows\System\dHkEAAA.exe
  2⤵
  PID:5964
- C:\Windows\System\CdbjqXJ.exe
  C:\Windows\System\CdbjqXJ.exe
  2⤵
  PID:4304
- C:\Windows\System\pzrmYTQ.exe
  C:\Windows\System\pzrmYTQ.exe
  2⤵
  PID:4176
- C:\Windows\System\DYjLgPV.exe
  C:\Windows\System\DYjLgPV.exe
  2⤵
  PID:5264
- C:\Windows\System\VzrMitg.exe
  C:\Windows\System\VzrMitg.exe
  2⤵
  PID:5344
- C:\Windows\System\tjtVupQ.exe
  C:\Windows\System\tjtVupQ.exe
  2⤵
  PID:5244
- C:\Windows\System\DLgKXjF.exe
  C:\Windows\System\DLgKXjF.exe
  2⤵
  PID:5380
- C:\Windows\System\QPBagoZ.exe
  C:\Windows\System\QPBagoZ.exe
  2⤵
  PID:5228
- C:\Windows\System\sdLwaCn.exe
  C:\Windows\System\sdLwaCn.exe
  2⤵
  PID:5312
- C:\Windows\System\PCHgCaA.exe
  C:\Windows\System\PCHgCaA.exe
  2⤵
  PID:5060
- C:\Windows\System\FHdKeeg.exe
  C:\Windows\System\FHdKeeg.exe
  2⤵
  PID:5216
- C:\Windows\System\SzEeywZ.exe
  C:\Windows\System\SzEeywZ.exe
  2⤵
  PID:5472
- C:\Windows\System\uThSfzp.exe
  C:\Windows\System\uThSfzp.exe
  2⤵
  PID:5752
- C:\Windows\System\chyCZxV.exe
  C:\Windows\System\chyCZxV.exe
  2⤵
  PID:5836
- C:\Windows\System\eRRMxdd.exe
  C:\Windows\System\eRRMxdd.exe
  2⤵
  PID:5800
- C:\Windows\System\Walmyse.exe
  C:\Windows\System\Walmyse.exe
  2⤵
  PID:5912
- C:\Windows\System\elkVaLV.exe
  C:\Windows\System\elkVaLV.exe
  2⤵
  PID:5900
- C:\Windows\System\NqeYeKH.exe
  C:\Windows\System\NqeYeKH.exe
  2⤵
  PID:5724
- C:\Windows\System\UPCbDfN.exe
  C:\Windows\System\UPCbDfN.exe
  2⤵
  PID:6092
- C:\Windows\System\BNdBKXK.exe
  C:\Windows\System\BNdBKXK.exe
  2⤵
  PID:4964
- C:\Windows\System\OprtMEm.exe
  C:\Windows\System\OprtMEm.exe
  2⤵
  PID:4660
- C:\Windows\System\uoFWloo.exe
  C:\Windows\System\uoFWloo.exe
  2⤵
  PID:5524
- C:\Windows\System\LQIUDZL.exe
  C:\Windows\System\LQIUDZL.exe
  2⤵
  PID:5488
- C:\Windows\System\tfcFZsg.exe
  C:\Windows\System\tfcFZsg.exe
  2⤵
  PID:5848
- C:\Windows\System\sgsPODm.exe
  C:\Windows\System\sgsPODm.exe
  2⤵
  PID:6108
- C:\Windows\System\xULpofc.exe
  C:\Windows\System\xULpofc.exe
  2⤵
  PID:6140
- C:\Windows\System\JfnDkJu.exe
  C:\Windows\System\JfnDkJu.exe
  2⤵
  PID:6156
- C:\Windows\System\iPPnRHO.exe
  C:\Windows\System\iPPnRHO.exe
  2⤵
  PID:6172
- C:\Windows\System\vDkdQyP.exe
  C:\Windows\System\vDkdQyP.exe
  2⤵
  PID:6192
- C:\Windows\System\gSFmbyE.exe
  C:\Windows\System\gSFmbyE.exe
  2⤵
  PID:6208
- C:\Windows\System\nqtSLVt.exe
  C:\Windows\System\nqtSLVt.exe
  2⤵
  PID:6224
- C:\Windows\System\hdVFaal.exe
  C:\Windows\System\hdVFaal.exe
  2⤵
  PID:6240
- C:\Windows\System\XtyaoVK.exe
  C:\Windows\System\XtyaoVK.exe
  2⤵
  PID:6256
- C:\Windows\System\LDylVYM.exe
  C:\Windows\System\LDylVYM.exe
  2⤵
  PID:6272
- C:\Windows\System\owcUZlo.exe
  C:\Windows\System\owcUZlo.exe
  2⤵
  PID:6288
- C:\Windows\System\hTcKXHf.exe
  C:\Windows\System\hTcKXHf.exe
  2⤵
  PID:6304
- C:\Windows\System\UyVxxxe.exe
  C:\Windows\System\UyVxxxe.exe
  2⤵
  PID:6320
- C:\Windows\System\qEmSJvj.exe
  C:\Windows\System\qEmSJvj.exe
  2⤵
  PID:6336
- C:\Windows\System\kHOmTkU.exe
  C:\Windows\System\kHOmTkU.exe
  2⤵
  PID:6352
- C:\Windows\System\BLiPdlF.exe
  C:\Windows\System\BLiPdlF.exe
  2⤵
  PID:6368
- C:\Windows\System\QtjvDkE.exe
  C:\Windows\System\QtjvDkE.exe
  2⤵
  PID:6384
- C:\Windows\System\iNAasKK.exe
  C:\Windows\System\iNAasKK.exe
  2⤵
  PID:6400
- C:\Windows\System\HAzMCWx.exe
  C:\Windows\System\HAzMCWx.exe
  2⤵
  PID:6416
- C:\Windows\System\hZbtwHP.exe
  C:\Windows\System\hZbtwHP.exe
  2⤵
  PID:6432
- C:\Windows\System\nCLGVQJ.exe
  C:\Windows\System\nCLGVQJ.exe
  2⤵
  PID:6448
- C:\Windows\System\kvuzaXv.exe
  C:\Windows\System\kvuzaXv.exe
  2⤵
  PID:6464
- C:\Windows\System\dLSxhst.exe
  C:\Windows\System\dLSxhst.exe
  2⤵
  PID:6480
- C:\Windows\System\tsGRUNb.exe
  C:\Windows\System\tsGRUNb.exe
  2⤵
  PID:6496
- C:\Windows\System\gXELHaT.exe
  C:\Windows\System\gXELHaT.exe
  2⤵
  PID:6512
- C:\Windows\System\CsSenWe.exe
  C:\Windows\System\CsSenWe.exe
  2⤵
  PID:6528
- C:\Windows\System\QCSeEEh.exe
  C:\Windows\System\QCSeEEh.exe
  2⤵
  PID:6548
- C:\Windows\System\hoKRznQ.exe
  C:\Windows\System\hoKRznQ.exe
  2⤵
  PID:6564
- C:\Windows\System\MqnJzAC.exe
  C:\Windows\System\MqnJzAC.exe
  2⤵
  PID:6580
- C:\Windows\System\ONAcuLZ.exe
  C:\Windows\System\ONAcuLZ.exe
  2⤵
  PID:6596
- C:\Windows\System\QmjkGqL.exe
  C:\Windows\System\QmjkGqL.exe
  2⤵
  PID:6612
- C:\Windows\System\LUIMFkk.exe
  C:\Windows\System\LUIMFkk.exe
  2⤵
  PID:6628
- C:\Windows\System\WjQyWOb.exe
  C:\Windows\System\WjQyWOb.exe
  2⤵
  PID:6644
- C:\Windows\System\KgVqBpZ.exe
  C:\Windows\System\KgVqBpZ.exe
  2⤵
  PID:6660
- C:\Windows\System\EktuLmc.exe
  C:\Windows\System\EktuLmc.exe
  2⤵
  PID:6676
- C:\Windows\System\EKdxBws.exe
  C:\Windows\System\EKdxBws.exe
  2⤵
  PID:6700
- C:\Windows\System\SFMbyMV.exe
  C:\Windows\System\SFMbyMV.exe
  2⤵
  PID:6716
- C:\Windows\System\vGQRCzF.exe
  C:\Windows\System\vGQRCzF.exe
  2⤵
  PID:6732
- C:\Windows\System\ReCQMMl.exe
  C:\Windows\System\ReCQMMl.exe
  2⤵
  PID:6748
- C:\Windows\System\UYEWZmo.exe
  C:\Windows\System\UYEWZmo.exe
  2⤵
  PID:6764
- C:\Windows\System\wHbkHmJ.exe
  C:\Windows\System\wHbkHmJ.exe
  2⤵
  PID:6780
- C:\Windows\System\bRJpbhw.exe
  C:\Windows\System\bRJpbhw.exe
  2⤵
  PID:6796
- C:\Windows\System\luxmWJR.exe
  C:\Windows\System\luxmWJR.exe
  2⤵
  PID:6812
- C:\Windows\System\lyZPtjC.exe
  C:\Windows\System\lyZPtjC.exe
  2⤵
  PID:6828
- C:\Windows\System\SQPBbHQ.exe
  C:\Windows\System\SQPBbHQ.exe
  2⤵
  PID:6852
- C:\Windows\System\doafbTO.exe
  C:\Windows\System\doafbTO.exe
  2⤵
  PID:6868
- C:\Windows\System\nwvfXhS.exe
  C:\Windows\System\nwvfXhS.exe
  2⤵
  PID:6884
- C:\Windows\System\NkqYltm.exe
  C:\Windows\System\NkqYltm.exe
  2⤵
  PID:6900
- C:\Windows\System\dYqdFQV.exe
  C:\Windows\System\dYqdFQV.exe
  2⤵
  PID:6916
- C:\Windows\System\jRfRrFU.exe
  C:\Windows\System\jRfRrFU.exe
  2⤵
  PID:6932
- C:\Windows\System\wayQtBQ.exe
  C:\Windows\System\wayQtBQ.exe
  2⤵
  PID:6948
- C:\Windows\System\FHuQOrj.exe
  C:\Windows\System\FHuQOrj.exe
  2⤵
  PID:6964
- C:\Windows\System\jLYheNM.exe
  C:\Windows\System\jLYheNM.exe
  2⤵
  PID:6980
- C:\Windows\System\xgigaiR.exe
  C:\Windows\System\xgigaiR.exe
  2⤵
  PID:6996
- C:\Windows\System\fPLRoQq.exe
  C:\Windows\System\fPLRoQq.exe
  2⤵
  PID:7012
- C:\Windows\System\gCEJKWB.exe
  C:\Windows\System\gCEJKWB.exe
  2⤵
  PID:7028
- C:\Windows\System\joqoKma.exe
  C:\Windows\System\joqoKma.exe
  2⤵
  PID:7044
- C:\Windows\System\TeWrIwY.exe
  C:\Windows\System\TeWrIwY.exe
  2⤵
  PID:7068
- C:\Windows\System\ozlMCRQ.exe
  C:\Windows\System\ozlMCRQ.exe
  2⤵
  PID:7084
- C:\Windows\System\HLllYRB.exe
  C:\Windows\System\HLllYRB.exe
  2⤵
  PID:7100
- C:\Windows\System\egWbzuh.exe
  C:\Windows\System\egWbzuh.exe
  2⤵
  PID:7116
- C:\Windows\System\nEqnYDF.exe
  C:\Windows\System\nEqnYDF.exe
  2⤵
  PID:7132
- C:\Windows\System\ugvoqgZ.exe
  C:\Windows\System\ugvoqgZ.exe
  2⤵
  PID:7152
- C:\Windows\System\CQFYOJi.exe
  C:\Windows\System\CQFYOJi.exe
  2⤵
  PID:5112
- C:\Windows\System\jcUCftm.exe
  C:\Windows\System\jcUCftm.exe
  2⤵
  PID:5708
- C:\Windows\System\NroqCMy.exe
  C:\Windows\System\NroqCMy.exe
  2⤵
  PID:5364
- C:\Windows\System\kUFUYER.exe
  C:\Windows\System\kUFUYER.exe
  2⤵
  PID:5676
- C:\Windows\System\NfnJLFu.exe
  C:\Windows\System\NfnJLFu.exe
  2⤵
  PID:5772
- C:\Windows\System\JXVZlvl.exe
  C:\Windows\System\JXVZlvl.exe
  2⤵
  PID:5868
- C:\Windows\System\CDEeJrn.exe
  C:\Windows\System\CDEeJrn.exe
  2⤵
  PID:6096
- C:\Windows\System\oXBnOWs.exe
  C:\Windows\System\oXBnOWs.exe
  2⤵
  PID:6204
- C:\Windows\System\cTOGrpr.exe
  C:\Windows\System\cTOGrpr.exe
  2⤵
  PID:6268
- C:\Windows\System\zZEKlIB.exe
  C:\Windows\System\zZEKlIB.exe
  2⤵
  PID:6184
- C:\Windows\System\hWjyTyj.exe
  C:\Windows\System\hWjyTyj.exe
  2⤵
  PID:6252
- C:\Windows\System\iPVlSgS.exe
  C:\Windows\System\iPVlSgS.exe
  2⤵
  PID:5688
- C:\Windows\System\tPbEvdH.exe
  C:\Windows\System\tPbEvdH.exe
  2⤵
  PID:6300
- C:\Windows\System\AoeDxaf.exe
  C:\Windows\System\AoeDxaf.exe
  2⤵
  PID:6360
- C:\Windows\System\HBXMkdJ.exe
  C:\Windows\System\HBXMkdJ.exe
  2⤵
  PID:6316
- C:\Windows\System\cDvvgaV.exe
  C:\Windows\System\cDvvgaV.exe
  2⤵
  PID:6376
- C:\Windows\System\bEuBsAj.exe
  C:\Windows\System\bEuBsAj.exe
  2⤵
  PID:6428
- C:\Windows\System\JWfzWJh.exe
  C:\Windows\System\JWfzWJh.exe
  2⤵
  PID:6488
- C:\Windows\System\ZmclBLM.exe
  C:\Windows\System\ZmclBLM.exe
  2⤵
  PID:6520
- C:\Windows\System\NlepdkN.exe
  C:\Windows\System\NlepdkN.exe
  2⤵
  PID:6504
- C:\Windows\System\ccLCRVM.exe
  C:\Windows\System\ccLCRVM.exe
  2⤵
  PID:6572
- C:\Windows\System\FhoKqqU.exe
  C:\Windows\System\FhoKqqU.exe
  2⤵
  PID:6636
- C:\Windows\System\MsJPTav.exe
  C:\Windows\System\MsJPTav.exe
  2⤵
  PID:6592
- C:\Windows\System\EttwfxQ.exe
  C:\Windows\System\EttwfxQ.exe
  2⤵
  PID:6656
- C:\Windows\System\DtPrpKV.exe
  C:\Windows\System\DtPrpKV.exe
  2⤵
  PID:6692
- C:\Windows\System\aKWPqCo.exe
  C:\Windows\System\aKWPqCo.exe
  2⤵
  PID:6760
- C:\Windows\System\skBsWTz.exe
  C:\Windows\System\skBsWTz.exe
  2⤵
  PID:6824
- C:\Windows\System\RmdQRmZ.exe
  C:\Windows\System\RmdQRmZ.exe
  2⤵
  PID:6708
- C:\Windows\System\SXyugrh.exe
  C:\Windows\System\SXyugrh.exe
  2⤵
  PID:6772
- C:\Windows\System\lynFZcX.exe
  C:\Windows\System\lynFZcX.exe
  2⤵
  PID:6808
- C:\Windows\System\RpdVgTP.exe
  C:\Windows\System\RpdVgTP.exe
  2⤵
  PID:6864
- C:\Windows\System\zhofipV.exe
  C:\Windows\System\zhofipV.exe
  2⤵
  PID:6928
- C:\Windows\System\BqBHIOb.exe
  C:\Windows\System\BqBHIOb.exe
  2⤵
  PID:6992
- C:\Windows\System\gyuYgAO.exe
  C:\Windows\System\gyuYgAO.exe
  2⤵
  PID:6908
- C:\Windows\System\kAfBHAB.exe
  C:\Windows\System\kAfBHAB.exe
  2⤵
  PID:7004
- C:\Windows\System\fHxRvhe.exe
  C:\Windows\System\fHxRvhe.exe
  2⤵
  PID:7024
- C:\Windows\System\MapzYag.exe
  C:\Windows\System\MapzYag.exe
  2⤵
  PID:7064
- C:\Windows\System\thoXhBz.exe
  C:\Windows\System\thoXhBz.exe
  2⤵
  PID:7092
- C:\Windows\System\hRQTVny.exe
  C:\Windows\System\hRQTVny.exe
  2⤵
  PID:7128
- C:\Windows\System\wwLTrXu.exe
  C:\Windows\System\wwLTrXu.exe
  2⤵
  PID:7148
- C:\Windows\System\uwbenIt.exe
  C:\Windows\System\uwbenIt.exe
  2⤵
  PID:7164
- C:\Windows\System\eDRhKVd.exe
  C:\Windows\System\eDRhKVd.exe
  2⤵
  PID:5536
- C:\Windows\System\RjcxmYR.exe
  C:\Windows\System\RjcxmYR.exe
  2⤵
  PID:6168
- C:\Windows\System\tZqLJtX.exe
  C:\Windows\System\tZqLJtX.exe
  2⤵
  PID:6236
- C:\Windows\System\ASdXlzM.exe
  C:\Windows\System\ASdXlzM.exe
  2⤵
  PID:5428
- C:\Windows\System\wXxoyxX.exe
  C:\Windows\System\wXxoyxX.exe
  2⤵
  PID:6392
- C:\Windows\System\LhwikGp.exe
  C:\Windows\System\LhwikGp.exe
  2⤵
  PID:6444
- C:\Windows\System\kjfIprn.exe
  C:\Windows\System\kjfIprn.exe
  2⤵
  PID:6424
- C:\Windows\System\NIWeWds.exe
  C:\Windows\System\NIWeWds.exe
  2⤵
  PID:6544
- C:\Windows\System\efUHSLE.exe
  C:\Windows\System\efUHSLE.exe
  2⤵
  PID:6652
- C:\Windows\System\cXYmspr.exe
  C:\Windows\System\cXYmspr.exe
  2⤵
  PID:6608
- C:\Windows\System\WGKIxPa.exe
  C:\Windows\System\WGKIxPa.exe
  2⤵
  PID:6756
- C:\Windows\System\ohCElCn.exe
  C:\Windows\System\ohCElCn.exe
  2⤵
  PID:6848
- C:\Windows\System\xtYcIoj.exe
  C:\Windows\System\xtYcIoj.exe
  2⤵
  PID:6944
- C:\Windows\System\FXzCbwb.exe
  C:\Windows\System\FXzCbwb.exe
  2⤵
  PID:2500
- C:\Windows\System\FaXBKDv.exe
  C:\Windows\System\FaXBKDv.exe
  2⤵
  PID:5148
- C:\Windows\System\yuzNHGm.exe
  C:\Windows\System\yuzNHGm.exe
  2⤵
  PID:6672
- C:\Windows\System\SHLZrbB.exe
  C:\Windows\System\SHLZrbB.exe
  2⤵
  PID:6408
- C:\Windows\System\iVUFRlx.exe
  C:\Windows\System\iVUFRlx.exe
  2⤵
  PID:7008
- C:\Windows\System\zrLnhgs.exe
  C:\Windows\System\zrLnhgs.exe
  2⤵
  PID:6180
- C:\Windows\System\hHCQhXU.exe
  C:\Windows\System\hHCQhXU.exe
  2⤵
  PID:6924
- C:\Windows\System\CszANpt.exe
  C:\Windows\System\CszANpt.exe
  2⤵
  PID:6164
- C:\Windows\System\zZOVMoM.exe
  C:\Windows\System\zZOVMoM.exe
  2⤵
  PID:6804
- C:\Windows\System\tOHWYvH.exe
  C:\Windows\System\tOHWYvH.exe
  2⤵
  PID:6476
- C:\Windows\System\VhWQzMi.exe
  C:\Windows\System\VhWQzMi.exe
  2⤵
  PID:6744
- C:\Windows\System\IRkjEun.exe
  C:\Windows\System\IRkjEun.exe
  2⤵
  PID:6604
- C:\Windows\System\ygGSfSM.exe
  C:\Windows\System\ygGSfSM.exe
  2⤵
  PID:7060
- C:\Windows\System\vNwulau.exe
  C:\Windows\System\vNwulau.exe
  2⤵
  PID:1228
- C:\Windows\System\GWZXXju.exe
  C:\Windows\System\GWZXXju.exe
  2⤵
  PID:7020
- C:\Windows\System\RaoBpNS.exe
  C:\Windows\System\RaoBpNS.exe
  2⤵
  PID:6412
- C:\Windows\System\vUKbYyj.exe
  C:\Windows\System\vUKbYyj.exe
  2⤵
  PID:6836
- C:\Windows\System\eeTLFYn.exe
  C:\Windows\System\eeTLFYn.exe
  2⤵
  PID:7188
- C:\Windows\System\qkKBeNi.exe
  C:\Windows\System\qkKBeNi.exe
  2⤵
  PID:7208
- C:\Windows\System\KRusqFN.exe
  C:\Windows\System\KRusqFN.exe
  2⤵
  PID:7224
- C:\Windows\System\nHBrPtU.exe
  C:\Windows\System\nHBrPtU.exe
  2⤵
  PID:7240
- C:\Windows\System\yemiHVF.exe
  C:\Windows\System\yemiHVF.exe
  2⤵
  PID:7256
- C:\Windows\System\xUMAKPW.exe
  C:\Windows\System\xUMAKPW.exe
  2⤵
  PID:7272
- C:\Windows\System\QkodDmc.exe
  C:\Windows\System\QkodDmc.exe
  2⤵
  PID:7288
- C:\Windows\System\muVUEmF.exe
  C:\Windows\System\muVUEmF.exe
  2⤵
  PID:7304
- C:\Windows\System\FFSGkch.exe
  C:\Windows\System\FFSGkch.exe
  2⤵
  PID:7320
- C:\Windows\System\wkWwkVi.exe
  C:\Windows\System\wkWwkVi.exe
  2⤵
  PID:7336
- C:\Windows\System\lfnTfYf.exe
  C:\Windows\System\lfnTfYf.exe
  2⤵
  PID:7352
- C:\Windows\System\EAejwxm.exe
  C:\Windows\System\EAejwxm.exe
  2⤵
  PID:7368
- C:\Windows\System\GTQshZW.exe
  C:\Windows\System\GTQshZW.exe
  2⤵
  PID:7388
- C:\Windows\System\UNODxgF.exe
  C:\Windows\System\UNODxgF.exe
  2⤵
  PID:7404
- C:\Windows\System\AuMQFBG.exe
  C:\Windows\System\AuMQFBG.exe
  2⤵
  PID:7420
- C:\Windows\System\kpLEhAr.exe
  C:\Windows\System\kpLEhAr.exe
  2⤵
  PID:7436
- C:\Windows\System\YeKqwmL.exe
  C:\Windows\System\YeKqwmL.exe
  2⤵
  PID:7452
- C:\Windows\System\szXdORd.exe
  C:\Windows\System\szXdORd.exe
  2⤵
  PID:7468
- C:\Windows\System\udnkxxw.exe
  C:\Windows\System\udnkxxw.exe
  2⤵
  PID:7484
- C:\Windows\System\YWJhMJA.exe
  C:\Windows\System\YWJhMJA.exe
  2⤵
  PID:7500
- C:\Windows\System\tyCbqvi.exe
  C:\Windows\System\tyCbqvi.exe
  2⤵
  PID:7516
- C:\Windows\System\OElTfDy.exe
  C:\Windows\System\OElTfDy.exe
  2⤵
  PID:7532
- C:\Windows\System\YDtoPMN.exe
  C:\Windows\System\YDtoPMN.exe
  2⤵
  PID:7548
- C:\Windows\System\GilIVpy.exe
  C:\Windows\System\GilIVpy.exe
  2⤵
  PID:7564
- C:\Windows\System\negSeQX.exe
  C:\Windows\System\negSeQX.exe
  2⤵
  PID:7580
- C:\Windows\System\erCUkWw.exe
  C:\Windows\System\erCUkWw.exe
  2⤵
  PID:7596
- C:\Windows\System\oxQTFLu.exe
  C:\Windows\System\oxQTFLu.exe
  2⤵
  PID:7612
- C:\Windows\System\HSeXzMM.exe
  C:\Windows\System\HSeXzMM.exe
  2⤵
  PID:7628
- C:\Windows\System\AfFmQmd.exe
  C:\Windows\System\AfFmQmd.exe
  2⤵
  PID:7644
- C:\Windows\System\BbBAmgf.exe
  C:\Windows\System\BbBAmgf.exe
  2⤵
  PID:7660
- C:\Windows\System\IqJeCbg.exe
  C:\Windows\System\IqJeCbg.exe
  2⤵
  PID:7676
- C:\Windows\System\RgYDMVS.exe
  C:\Windows\System\RgYDMVS.exe
  2⤵
  PID:7692
- C:\Windows\System\dEVAUzz.exe
  C:\Windows\System\dEVAUzz.exe
  2⤵
  PID:7708
- C:\Windows\System\jkNPeUL.exe
  C:\Windows\System\jkNPeUL.exe
  2⤵
  PID:7724
- C:\Windows\System\ewbHZXN.exe
  C:\Windows\System\ewbHZXN.exe
  2⤵
  PID:7740
- C:\Windows\System\TndBbuP.exe
  C:\Windows\System\TndBbuP.exe
  2⤵
  PID:7756
- C:\Windows\System\WUCiIXg.exe
  C:\Windows\System\WUCiIXg.exe
  2⤵
  PID:7772
- C:\Windows\System\nFjVrEh.exe
  C:\Windows\System\nFjVrEh.exe
  2⤵
  PID:7788
- C:\Windows\System\zIQngQu.exe
  C:\Windows\System\zIQngQu.exe
  2⤵
  PID:7804
- C:\Windows\System\wLViKUp.exe
  C:\Windows\System\wLViKUp.exe
  2⤵
  PID:7820
- C:\Windows\System\FllXOBE.exe
  C:\Windows\System\FllXOBE.exe
  2⤵
  PID:7836
- C:\Windows\System\PRiCYPQ.exe
  C:\Windows\System\PRiCYPQ.exe
  2⤵
  PID:7852
- C:\Windows\System\BKxPuFh.exe
  C:\Windows\System\BKxPuFh.exe
  2⤵
  PID:7868
- C:\Windows\System\deuaWkb.exe
  C:\Windows\System\deuaWkb.exe
  2⤵
  PID:7884
- C:\Windows\System\CJiZJWO.exe
  C:\Windows\System\CJiZJWO.exe
  2⤵
  PID:7900
- C:\Windows\System\IVzsGZY.exe
  C:\Windows\System\IVzsGZY.exe
  2⤵
  PID:7916
- C:\Windows\System\UdPWcah.exe
  C:\Windows\System\UdPWcah.exe
  2⤵
  PID:7932
- C:\Windows\System\cCvuaxf.exe
  C:\Windows\System\cCvuaxf.exe
  2⤵
  PID:7948
- C:\Windows\System\rQlxWbc.exe
  C:\Windows\System\rQlxWbc.exe
  2⤵
  PID:7964
- C:\Windows\System\WVRjlgN.exe
  C:\Windows\System\WVRjlgN.exe
  2⤵
  PID:7980
- C:\Windows\System\kmUexXJ.exe
  C:\Windows\System\kmUexXJ.exe
  2⤵
  PID:7996
- C:\Windows\System\OqURozR.exe
  C:\Windows\System\OqURozR.exe
  2⤵
  PID:8012
- C:\Windows\System\MswKQGG.exe
  C:\Windows\System\MswKQGG.exe
  2⤵
  PID:8028
- C:\Windows\System\IFBzcOL.exe
  C:\Windows\System\IFBzcOL.exe
  2⤵
  PID:8044
- C:\Windows\System\ejWturA.exe
  C:\Windows\System\ejWturA.exe
  2⤵
  PID:8060
- C:\Windows\System\lRaMELY.exe
  C:\Windows\System\lRaMELY.exe
  2⤵
  PID:8076
- C:\Windows\System\NiZAsqo.exe
  C:\Windows\System\NiZAsqo.exe
  2⤵
  PID:8092
- C:\Windows\System\PnvWplo.exe
  C:\Windows\System\PnvWplo.exe
  2⤵
  PID:8108
- C:\Windows\System\UiMsKEy.exe
  C:\Windows\System\UiMsKEy.exe
  2⤵
  PID:8124
- C:\Windows\System\IHmiePB.exe
  C:\Windows\System\IHmiePB.exe
  2⤵
  PID:8140
- C:\Windows\System\gTddSHQ.exe
  C:\Windows\System\gTddSHQ.exe
  2⤵
  PID:8156
- C:\Windows\System\DvdQSFV.exe
  C:\Windows\System\DvdQSFV.exe
  2⤵
  PID:8172
- C:\Windows\System\xqcvbDP.exe
  C:\Windows\System\xqcvbDP.exe
  2⤵
  PID:8188
- C:\Windows\System\fxwJErJ.exe
  C:\Windows\System\fxwJErJ.exe
  2⤵
  PID:6792
- C:\Windows\System\sbOmGBq.exe
  C:\Windows\System\sbOmGBq.exe
  2⤵
  PID:5896
- C:\Windows\System\zeukEQL.exe
  C:\Windows\System\zeukEQL.exe
  2⤵
  PID:7200
- C:\Windows\System\waIroIG.exe
  C:\Windows\System\waIroIG.exe
  2⤵
  PID:7056
- C:\Windows\System\OClSWES.exe
  C:\Windows\System\OClSWES.exe
  2⤵
  PID:7232
- C:\Windows\System\RmntxQi.exe
  C:\Windows\System\RmntxQi.exe
  2⤵
  PID:7296
- C:\Windows\System\HYiQEVA.exe
  C:\Windows\System\HYiQEVA.exe
  2⤵
  PID:6220
- C:\Windows\System\taMBBDd.exe
  C:\Windows\System\taMBBDd.exe
  2⤵
  PID:7216
- C:\Windows\System\gwaIwMS.exe
  C:\Windows\System\gwaIwMS.exe
  2⤵
  PID:7328
- C:\Windows\System\Sqndeay.exe
  C:\Windows\System\Sqndeay.exe
  2⤵
  PID:7360
- C:\Windows\System\cBuQIcP.exe
  C:\Windows\System\cBuQIcP.exe
  2⤵
  PID:7348
- C:\Windows\System\HInNABq.exe
  C:\Windows\System\HInNABq.exe
  2⤵
  PID:7380
- C:\Windows\System\rNhdWKX.exe
  C:\Windows\System\rNhdWKX.exe
  2⤵
  PID:7432
- C:\Windows\System\KUpvSXI.exe
  C:\Windows\System\KUpvSXI.exe
  2⤵
  PID:7496
- C:\Windows\System\QoeOYLF.exe
  C:\Windows\System\QoeOYLF.exe
  2⤵
  PID:7476
- C:\Windows\System\DFJKDUA.exe
  C:\Windows\System\DFJKDUA.exe
  2⤵
  PID:7528
- C:\Windows\System\ualjsMq.exe
  C:\Windows\System\ualjsMq.exe
  2⤵
  PID:7592
- C:\Windows\System\JcoLwcm.exe
  C:\Windows\System\JcoLwcm.exe
  2⤵
  PID:7540
- C:\Windows\System\ndHZMHu.exe
  C:\Windows\System\ndHZMHu.exe
  2⤵
  PID:7668
- C:\Windows\System\JUbaZVN.exe
  C:\Windows\System\JUbaZVN.exe
  2⤵
  PID:7544
- C:\Windows\System\QdMNNHo.exe
  C:\Windows\System\QdMNNHo.exe
  2⤵
  PID:7688
- C:\Windows\System\UTAvIBw.exe
  C:\Windows\System\UTAvIBw.exe
  2⤵
  PID:7752
- C:\Windows\System\YvVfuzb.exe
  C:\Windows\System\YvVfuzb.exe
  2⤵
  PID:7812
- C:\Windows\System\aXVOjlh.exe
  C:\Windows\System\aXVOjlh.exe
  2⤵
  PID:7732
- C:\Windows\System\tKNHcSr.exe
  C:\Windows\System\tKNHcSr.exe
  2⤵
  PID:7972
- C:\Windows\System\oNxDbvI.exe
  C:\Windows\System\oNxDbvI.exe
  2⤵
  PID:7944
- C:\Windows\System\FVGmUte.exe
  C:\Windows\System\FVGmUte.exe
  2⤵
  PID:8008
- C:\Windows\System\bIxnIdA.exe
  C:\Windows\System\bIxnIdA.exe
  2⤵
  PID:7828
- C:\Windows\System\XivYRzz.exe
  C:\Windows\System\XivYRzz.exe
  2⤵
  PID:8040
- C:\Windows\System\hWVbOJu.exe
  C:\Windows\System\hWVbOJu.exe
  2⤵
  PID:7864
- C:\Windows\System\CrIVOGT.exe
  C:\Windows\System\CrIVOGT.exe
  2⤵
  PID:7992
- C:\Windows\System\FKJYlNx.exe
  C:\Windows\System\FKJYlNx.exe
  2⤵
  PID:8052
- C:\Windows\System\cAgMoBy.exe
  C:\Windows\System\cAgMoBy.exe
  2⤵
  PID:8132
- C:\Windows\System\BWNddCb.exe
  C:\Windows\System\BWNddCb.exe
  2⤵
  PID:8164
- C:\Windows\System\TQndpWb.exe
  C:\Windows\System\TQndpWb.exe
  2⤵
  PID:8152
- C:\Windows\System\UkVvNXQ.exe
  C:\Windows\System\UkVvNXQ.exe
  2⤵
  PID:7196
- C:\Windows\System\eucRkpE.exe
  C:\Windows\System\eucRkpE.exe
  2⤵
  PID:8180
- C:\Windows\System\zHjJoLN.exe
  C:\Windows\System\zHjJoLN.exe
  2⤵
  PID:3624
- C:\Windows\System\qWmSUAF.exe
  C:\Windows\System\qWmSUAF.exe
  2⤵
  PID:7180
- C:\Windows\System\KTtVxiN.exe
  C:\Windows\System\KTtVxiN.exe
  2⤵
  PID:7332
- C:\Windows\System\DUajZbg.exe
  C:\Windows\System\DUajZbg.exe
  2⤵
  PID:7400
- C:\Windows\System\CdMtVLE.exe
  C:\Windows\System\CdMtVLE.exe
  2⤵
  PID:7464
- C:\Windows\System\ItGHXnO.exe
  C:\Windows\System\ItGHXnO.exe
  2⤵
  PID:7636
- C:\Windows\System\zJvDkRf.exe
  C:\Windows\System\zJvDkRf.exe
  2⤵
  PID:7576
- C:\Windows\System\bASEMcB.exe
  C:\Windows\System\bASEMcB.exe
  2⤵
  PID:7624
- C:\Windows\System\NNiumAD.exe
  C:\Windows\System\NNiumAD.exe
  2⤵
  PID:7672
- C:\Windows\System\IHygLok.exe
  C:\Windows\System\IHygLok.exe
  2⤵
  PID:8168
- C:\Windows\System\MjqXkNz.exe
  C:\Windows\System\MjqXkNz.exe
  2⤵
  PID:7764
- C:\Windows\System\NtqzZIc.exe
  C:\Windows\System\NtqzZIc.exe
  2⤵
  PID:7880
- C:\Windows\System\ajMrFqs.exe
  C:\Windows\System\ajMrFqs.exe
  2⤵
  PID:7924
- C:\Windows\System\wBudnsR.exe
  C:\Windows\System\wBudnsR.exe
  2⤵
  PID:8020
- C:\Windows\System\MRZRrUD.exe
  C:\Windows\System\MRZRrUD.exe
  2⤵
  PID:8184
- C:\Windows\System\uQxxWRt.exe
  C:\Windows\System\uQxxWRt.exe
  2⤵
  PID:8116
- C:\Windows\System\wEhPtql.exe
  C:\Windows\System\wEhPtql.exe
  2⤵
  PID:6960
- C:\Windows\System\cZCoucR.exe
  C:\Windows\System\cZCoucR.exe
  2⤵
  PID:7316
- C:\Windows\System\grWBFeO.exe
  C:\Windows\System\grWBFeO.exe
  2⤵
  PID:7524
- C:\Windows\System\miChlxZ.exe
  C:\Windows\System\miChlxZ.exe
  2⤵
  PID:7444
- C:\Windows\System\GwlKThR.exe
  C:\Windows\System\GwlKThR.exe
  2⤵
  PID:7860
- C:\Windows\System\chgkQBP.exe
  C:\Windows\System\chgkQBP.exe
  2⤵
  PID:8148
- C:\Windows\System\qfvvpBb.exe
  C:\Windows\System\qfvvpBb.exe
  2⤵
  PID:6456
- C:\Windows\System\yYMskZi.exe
  C:\Windows\System\yYMskZi.exe
  2⤵
  PID:8084
- C:\Windows\System\zpbhYNL.exe
  C:\Windows\System\zpbhYNL.exe
  2⤵
  PID:7796
- C:\Windows\System\EpyfoLs.exe
  C:\Windows\System\EpyfoLs.exe
  2⤵
  PID:7876
- C:\Windows\System\htvRQdQ.exe
  C:\Windows\System\htvRQdQ.exe
  2⤵
  PID:7940
- C:\Windows\System\ZzNQArN.exe
  C:\Windows\System\ZzNQArN.exe
  2⤵
  PID:4584
- C:\Windows\System\AGfMmSc.exe
  C:\Windows\System\AGfMmSc.exe
  2⤵
  PID:6844
- C:\Windows\System\uUKdsBu.exe
  C:\Windows\System\uUKdsBu.exe
  2⤵
  PID:7912
- C:\Windows\System\gOqHSpe.exe
  C:\Windows\System\gOqHSpe.exe
  2⤵
  PID:8104
- C:\Windows\System\tXndwbD.exe
  C:\Windows\System\tXndwbD.exe
  2⤵
  PID:7656
- C:\Windows\System\LlvJzZt.exe
  C:\Windows\System\LlvJzZt.exe
  2⤵
  PID:7588
- C:\Windows\System\dWPzQwr.exe
  C:\Windows\System\dWPzQwr.exe
  2⤵
  PID:6740
- C:\Windows\System\SvagRze.exe
  C:\Windows\System\SvagRze.exe
  2⤵
  PID:7428
- C:\Windows\System\tpCRZtq.exe
  C:\Windows\System\tpCRZtq.exe
  2⤵
  PID:7844
- C:\Windows\System\QFNrzYa.exe
  C:\Windows\System\QFNrzYa.exe
  2⤵
  PID:8208
- C:\Windows\System\mqdilgi.exe
  C:\Windows\System\mqdilgi.exe
  2⤵
  PID:8224
- C:\Windows\System\MtSoCQj.exe
  C:\Windows\System\MtSoCQj.exe
  2⤵
  PID:8244
- C:\Windows\System\bQWNTkj.exe
  C:\Windows\System\bQWNTkj.exe
  2⤵
  PID:8260
- C:\Windows\System\cKTjnos.exe
  C:\Windows\System\cKTjnos.exe
  2⤵
  PID:8276
- C:\Windows\System\lCzhOXl.exe
  C:\Windows\System\lCzhOXl.exe
  2⤵
  PID:8292
- C:\Windows\System\XvXmvbe.exe
  C:\Windows\System\XvXmvbe.exe
  2⤵
  PID:8312
- C:\Windows\System\rceGfVe.exe
  C:\Windows\System\rceGfVe.exe
  2⤵
  PID:8328
- C:\Windows\System\mBdbiBI.exe
  C:\Windows\System\mBdbiBI.exe
  2⤵
  PID:8392
- C:\Windows\System\dbnqjOZ.exe
  C:\Windows\System\dbnqjOZ.exe
  2⤵
  PID:8412
- C:\Windows\System\bEoOyEP.exe
  C:\Windows\System\bEoOyEP.exe
  2⤵
  PID:8436
- C:\Windows\System\AjkpUxo.exe
  C:\Windows\System\AjkpUxo.exe
  2⤵
  PID:8520
- C:\Windows\System\hPpJOKg.exe
  C:\Windows\System\hPpJOKg.exe
  2⤵
  PID:8540
- C:\Windows\System\KgOiTgf.exe
  C:\Windows\System\KgOiTgf.exe
  2⤵
  PID:8556
- C:\Windows\System\yROUNma.exe
  C:\Windows\System\yROUNma.exe
  2⤵
  PID:8584
- C:\Windows\System\YLRErMy.exe
  C:\Windows\System\YLRErMy.exe
  2⤵
  PID:8600
- C:\Windows\System\lajcYql.exe
  C:\Windows\System\lajcYql.exe
  2⤵
  PID:8616
- C:\Windows\System\PrLcdRO.exe
  C:\Windows\System\PrLcdRO.exe
  2⤵
  PID:8632
- C:\Windows\System\tbqsmIP.exe
  C:\Windows\System\tbqsmIP.exe
  2⤵
  PID:8652
- C:\Windows\System\HwFsjTt.exe
  C:\Windows\System\HwFsjTt.exe
  2⤵
  PID:8668
- C:\Windows\System\vOYiNuw.exe
  C:\Windows\System\vOYiNuw.exe
  2⤵
  PID:8684
- C:\Windows\System\ENYoxUa.exe
  C:\Windows\System\ENYoxUa.exe
  2⤵
  PID:8704
- C:\Windows\System\mYuCLHG.exe
  C:\Windows\System\mYuCLHG.exe
  2⤵
  PID:8720
- C:\Windows\System\xLXNMQR.exe
  C:\Windows\System\xLXNMQR.exe
  2⤵
  PID:8736
- C:\Windows\System\PnrNgST.exe
  C:\Windows\System\PnrNgST.exe
  2⤵
  PID:8756
- C:\Windows\System\iAgAJqI.exe
  C:\Windows\System\iAgAJqI.exe
  2⤵
  PID:8772
- C:\Windows\System\aICvKVk.exe
  C:\Windows\System\aICvKVk.exe
  2⤵
  PID:8788
- C:\Windows\System\yuYTKIt.exe
  C:\Windows\System\yuYTKIt.exe
  2⤵
  PID:8804
- C:\Windows\System\SnnGdmp.exe
  C:\Windows\System\SnnGdmp.exe
  2⤵
  PID:8824
- C:\Windows\System\eFTjgcl.exe
  C:\Windows\System\eFTjgcl.exe
  2⤵
  PID:8840
- C:\Windows\System\xpzmcxM.exe
  C:\Windows\System\xpzmcxM.exe
  2⤵
  PID:8856
- C:\Windows\System\pyPZMlo.exe
  C:\Windows\System\pyPZMlo.exe
  2⤵
  PID:8876
- C:\Windows\System\szpffBP.exe
  C:\Windows\System\szpffBP.exe
  2⤵
  PID:8892
- C:\Windows\System\LCxhCZl.exe
  C:\Windows\System\LCxhCZl.exe
  2⤵
  PID:8908
- C:\Windows\System\QkEAekb.exe
  C:\Windows\System\QkEAekb.exe
  2⤵
  PID:8932
- C:\Windows\System\BgoWbrI.exe
  C:\Windows\System\BgoWbrI.exe
  2⤵
  PID:8952
- C:\Windows\System\PVtBMEC.exe
  C:\Windows\System\PVtBMEC.exe
  2⤵
  PID:8980
- C:\Windows\System\NsOuZnI.exe
  C:\Windows\System\NsOuZnI.exe
  2⤵
  PID:8996
- C:\Windows\System\IUMHpwF.exe
  C:\Windows\System\IUMHpwF.exe
  2⤵
  PID:9016
- C:\Windows\System\VBhdsFP.exe
  C:\Windows\System\VBhdsFP.exe
  2⤵
  PID:9032
- C:\Windows\System\qhJBTiI.exe
  C:\Windows\System\qhJBTiI.exe
  2⤵
  PID:9048
- C:\Windows\System\RBAdePL.exe
  C:\Windows\System\RBAdePL.exe
  2⤵
  PID:9064
- C:\Windows\System\vxpFmkm.exe
  C:\Windows\System\vxpFmkm.exe
  2⤵
  PID:9080
- C:\Windows\System\HRwcnjN.exe
  C:\Windows\System\HRwcnjN.exe
  2⤵
  PID:9096
- C:\Windows\System\TkaVJPi.exe
  C:\Windows\System\TkaVJPi.exe
  2⤵
  PID:9112
- C:\Windows\System\xQkoKSb.exe
  C:\Windows\System\xQkoKSb.exe
  2⤵
  PID:9140
- C:\Windows\System\uWYYPJQ.exe
  C:\Windows\System\uWYYPJQ.exe
  2⤵
  PID:9156
- C:\Windows\System\qapGyUN.exe
  C:\Windows\System\qapGyUN.exe
  2⤵
  PID:9172
- C:\Windows\System\PQDOZlS.exe
  C:\Windows\System\PQDOZlS.exe
  2⤵
  PID:9188
- C:\Windows\System\HCIjbeM.exe
  C:\Windows\System\HCIjbeM.exe
  2⤵
  PID:9204
- C:\Windows\System\jwuPQzd.exe
  C:\Windows\System\jwuPQzd.exe
  2⤵
  PID:8220
- C:\Windows\System\MjbKlqe.exe
  C:\Windows\System\MjbKlqe.exe
  2⤵
  PID:8204
- C:\Windows\System\FaUyflJ.exe
  C:\Windows\System\FaUyflJ.exe
  2⤵
  PID:8324
- C:\Windows\System\euhmtlv.exe
  C:\Windows\System\euhmtlv.exe
  2⤵
  PID:8348
- C:\Windows\System\eueqjPZ.exe
  C:\Windows\System\eueqjPZ.exe
  2⤵
  PID:8372
- C:\Windows\System\dwGUJMi.exe
  C:\Windows\System\dwGUJMi.exe
  2⤵
  PID:8428
- C:\Windows\System\fcRWAAW.exe
  C:\Windows\System\fcRWAAW.exe
  2⤵
  PID:8464
- C:\Windows\System\wSJzEEC.exe
  C:\Windows\System\wSJzEEC.exe
  2⤵
  PID:2168
- C:\Windows\System\iaPohki.exe
  C:\Windows\System\iaPohki.exe
  2⤵
  PID:8552
- C:\Windows\System\BCWDgyv.exe
  C:\Windows\System\BCWDgyv.exe
  2⤵
  PID:8712
- C:\Windows\System\zBSuGkN.exe
  C:\Windows\System\zBSuGkN.exe
  2⤵
  PID:8864
- C:\Windows\System\PqEpTyF.exe
  C:\Windows\System\PqEpTyF.exe
  2⤵
  PID:8832
- C:\Windows\System\ANpLvcm.exe
  C:\Windows\System\ANpLvcm.exe
  2⤵
  PID:8940
- C:\Windows\System\MXvsGAq.exe
  C:\Windows\System\MXvsGAq.exe
  2⤵
  PID:8944
- C:\Windows\System\fSxoqjd.exe
  C:\Windows\System\fSxoqjd.exe
  2⤵
  PID:8992
- C:\Windows\System\LmwtOwG.exe
  C:\Windows\System\LmwtOwG.exe
  2⤵
  PID:9024
- C:\Windows\System\UWBUkdu.exe
  C:\Windows\System\UWBUkdu.exe
  2⤵
  PID:9076
- C:\Windows\System\AZFQCGA.exe
  C:\Windows\System\AZFQCGA.exe
  2⤵
  PID:9120
- C:\Windows\System\VoUVlbG.exe
  C:\Windows\System\VoUVlbG.exe
  2⤵
  PID:9132
- C:\Windows\System\exyPCGB.exe
  C:\Windows\System\exyPCGB.exe
  2⤵
  PID:9164
- C:\Windows\System\nikeeiP.exe
  C:\Windows\System\nikeeiP.exe
  2⤵
  PID:9184
- C:\Windows\System\GZfXTls.exe
  C:\Windows\System\GZfXTls.exe
  2⤵
  PID:9212
- C:\Windows\System\EgeKvDx.exe
  C:\Windows\System\EgeKvDx.exe
  2⤵
  PID:8240
- C:\Windows\System\JtGMacG.exe
  C:\Windows\System\JtGMacG.exe
  2⤵
  PID:8256
- C:\Windows\System\IDgaHEM.exe
  C:\Windows\System\IDgaHEM.exe
  2⤵
  PID:8344
- C:\Windows\System\hrWLiPn.exe
  C:\Windows\System\hrWLiPn.exe
  2⤵
  PID:8340
- C:\Windows\System\tUKzWdO.exe
  C:\Windows\System\tUKzWdO.exe
  2⤵
  PID:7512
- C:\Windows\System\ZUtsTMf.exe
  C:\Windows\System\ZUtsTMf.exe
  2⤵
  PID:8424
- C:\Windows\System\exggKDG.exe
  C:\Windows\System\exggKDG.exe
  2⤵
  PID:8456
- C:\Windows\System\JEYCOsG.exe
  C:\Windows\System\JEYCOsG.exe
  2⤵
  PID:2164
- C:\Windows\System\CuDwbNt.exe
  C:\Windows\System\CuDwbNt.exe
  2⤵
  PID:8504
- C:\Windows\System\wELMPYE.exe
  C:\Windows\System\wELMPYE.exe
  2⤵
  PID:8512
- C:\Windows\System\FvzSiOF.exe
  C:\Windows\System\FvzSiOF.exe
  2⤵
  PID:8592
- C:\Windows\System\wRZHTnU.exe
  C:\Windows\System\wRZHTnU.exe
  2⤵
  PID:8580
- C:\Windows\System\hSHGsmt.exe
  C:\Windows\System\hSHGsmt.exe
  2⤵
  PID:8612
- C:\Windows\System\nxJHnCU.exe
  C:\Windows\System\nxJHnCU.exe
  2⤵
  PID:8648
- C:\Windows\System\nMsWERe.exe
  C:\Windows\System\nMsWERe.exe
  2⤵
  PID:8696
- C:\Windows\System\drmcZAN.exe
  C:\Windows\System\drmcZAN.exe
  2⤵
  PID:8900
- C:\Windows\System\hxCMNpz.exe
  C:\Windows\System\hxCMNpz.exe
  2⤵
  PID:8784
- C:\Windows\System\HMRElYb.exe
  C:\Windows\System\HMRElYb.exe
  2⤵
  PID:9092
- C:\Windows\System\KNnZUmV.exe
  C:\Windows\System\KNnZUmV.exe
  2⤵
  PID:8812
- C:\Windows\System\mQHAgjd.exe
  C:\Windows\System\mQHAgjd.exe
  2⤵
  PID:8796
- C:\Windows\System\rOCPCOO.exe
  C:\Windows\System\rOCPCOO.exe
  2⤵
  PID:8972
- C:\Windows\System\XOKzaxZ.exe
  C:\Windows\System\XOKzaxZ.exe
  2⤵
  PID:8988
- C:\Windows\System\iUzreMN.exe
  C:\Windows\System\iUzreMN.exe
  2⤵
  PID:9072
- C:\Windows\System\FsLIAlZ.exe
  C:\Windows\System\FsLIAlZ.exe
  2⤵
  PID:8236
- C:\Windows\System\DTYrYIP.exe
  C:\Windows\System\DTYrYIP.exe
  2⤵
  PID:9108
- C:\Windows\System\GPfweFy.exe
  C:\Windows\System\GPfweFy.exe
  2⤵
  PID:8356
- C:\Windows\System\vPdrBQF.exe
  C:\Windows\System\vPdrBQF.exe
  2⤵
  PID:8452
- C:\Windows\System\YaUHeXW.exe
  C:\Windows\System\YaUHeXW.exe
  2⤵
  PID:8460
- C:\Windows\System\bAsKOuP.exe
  C:\Windows\System\bAsKOuP.exe
  2⤵
  PID:8288
- C:\Windows\System\TqkXTzn.exe
  C:\Windows\System\TqkXTzn.exe
  2⤵
  PID:8872
- C:\Windows\System\Eqnfina.exe
  C:\Windows\System\Eqnfina.exe
  2⤵
  PID:8368
- C:\Windows\System\oQcAgUg.exe
  C:\Windows\System\oQcAgUg.exe
  2⤵
  PID:8608
- C:\Windows\System\KBAyfBc.exe
  C:\Windows\System\KBAyfBc.exe
  2⤵
  PID:8488
- C:\Windows\System\VWxNeQq.exe
  C:\Windows\System\VWxNeQq.exe
  2⤵
  PID:8680
- C:\Windows\System\FgBKyCj.exe
  C:\Windows\System\FgBKyCj.exe
  2⤵
  PID:8692
- C:\Windows\System\QMYaepQ.exe
  C:\Windows\System\QMYaepQ.exe
  2⤵
  PID:8780
- C:\Windows\System\kJvUrzA.exe
  C:\Windows\System\kJvUrzA.exe
  2⤵
  PID:9012
- C:\Windows\System\KsUAJFZ.exe
  C:\Windows\System\KsUAJFZ.exe
  2⤵
  PID:9104
- C:\Windows\System\QHLKsgu.exe
  C:\Windows\System\QHLKsgu.exe
  2⤵
  PID:9128
- C:\Windows\System\YnwpApC.exe
  C:\Windows\System\YnwpApC.exe
  2⤵
  PID:8548
- C:\Windows\System\hjupJsa.exe
  C:\Windows\System\hjupJsa.exe
  2⤵
  PID:8764
- C:\Windows\System\ZYXwDme.exe
  C:\Windows\System\ZYXwDme.exe
  2⤵
  PID:8732
- C:\Windows\System\zKpnsIp.exe
  C:\Windows\System\zKpnsIp.exe
  2⤵
  PID:8200
- C:\Windows\System\wVsLMUe.exe
  C:\Windows\System\wVsLMUe.exe
  2⤵
  PID:8676
- C:\Windows\System\eQVhmUU.exe
  C:\Windows\System\eQVhmUU.exe
  2⤵
  PID:9060
- C:\Windows\System\NBVZgLZ.exe
  C:\Windows\System\NBVZgLZ.exe
  2⤵
  PID:9236
- C:\Windows\System\wFYGJNp.exe
  C:\Windows\System\wFYGJNp.exe
  2⤵
  PID:9256
- C:\Windows\System\JmHlKYJ.exe
  C:\Windows\System\JmHlKYJ.exe
  2⤵
  PID:9272
- C:\Windows\System\AfxmxCX.exe
  C:\Windows\System\AfxmxCX.exe
  2⤵
  PID:9288
- C:\Windows\System\oJUpFZE.exe
  C:\Windows\System\oJUpFZE.exe
  2⤵
  PID:9304
- C:\Windows\System\MfEKNqB.exe
  C:\Windows\System\MfEKNqB.exe
  2⤵
  PID:9320
- C:\Windows\System\CkrbfBL.exe
  C:\Windows\System\CkrbfBL.exe
  2⤵
  PID:9336
- C:\Windows\System\uIStCiP.exe
  C:\Windows\System\uIStCiP.exe
  2⤵
  PID:9352
- C:\Windows\System\CQUbtJO.exe
  C:\Windows\System\CQUbtJO.exe
  2⤵
  PID:9368
- C:\Windows\System\LuaNYJy.exe
  C:\Windows\System\LuaNYJy.exe
  2⤵
  PID:9384
- C:\Windows\System\edzYlFB.exe
  C:\Windows\System\edzYlFB.exe
  2⤵
  PID:9400
- C:\Windows\System\iRmkcJE.exe
  C:\Windows\System\iRmkcJE.exe
  2⤵
  PID:9416
- C:\Windows\System\DDHhcdQ.exe
  C:\Windows\System\DDHhcdQ.exe
  2⤵
  PID:9432
- C:\Windows\System\fvDBDsj.exe
  C:\Windows\System\fvDBDsj.exe
  2⤵
  PID:9448
- C:\Windows\System\iYxbEAX.exe
  C:\Windows\System\iYxbEAX.exe
  2⤵
  PID:9464
- C:\Windows\System\RKwovsx.exe
  C:\Windows\System\RKwovsx.exe
  2⤵
  PID:9480
- C:\Windows\System\ITDgINQ.exe
  C:\Windows\System\ITDgINQ.exe
  2⤵
  PID:9496
- C:\Windows\System\soFFAZU.exe
  C:\Windows\System\soFFAZU.exe
  2⤵
  PID:9512
- C:\Windows\System\kfYMUnz.exe
  C:\Windows\System\kfYMUnz.exe
  2⤵
  PID:9528
- C:\Windows\System\jVWozRT.exe
  C:\Windows\System\jVWozRT.exe
  2⤵
  PID:9544
- C:\Windows\System\wXIvmbs.exe
  C:\Windows\System\wXIvmbs.exe
  2⤵
  PID:9560
- C:\Windows\System\ubMcdrm.exe
  C:\Windows\System\ubMcdrm.exe
  2⤵
  PID:9576
- C:\Windows\System\XVBJeBr.exe
  C:\Windows\System\XVBJeBr.exe
  2⤵
  PID:9592
- C:\Windows\System\olafNKF.exe
  C:\Windows\System\olafNKF.exe
  2⤵
  PID:9608
- C:\Windows\System\IZOJZRS.exe
  C:\Windows\System\IZOJZRS.exe
  2⤵
  PID:9624
- C:\Windows\System\HHdcqbS.exe
  C:\Windows\System\HHdcqbS.exe
  2⤵
  PID:9640
- C:\Windows\System\YNnVTzY.exe
  C:\Windows\System\YNnVTzY.exe
  2⤵
  PID:9656
- C:\Windows\System\FnFrVBV.exe
  C:\Windows\System\FnFrVBV.exe
  2⤵
  PID:9672
- C:\Windows\System\jymxtgD.exe
  C:\Windows\System\jymxtgD.exe
  2⤵
  PID:9688
- C:\Windows\System\oGzWeqE.exe
  C:\Windows\System\oGzWeqE.exe
  2⤵
  PID:9704
- C:\Windows\System\WcbZhnd.exe
  C:\Windows\System\WcbZhnd.exe
  2⤵
  PID:9720
- C:\Windows\System\JGhbHXq.exe
  C:\Windows\System\JGhbHXq.exe
  2⤵
  PID:9736
- C:\Windows\System\abpsbVa.exe
  C:\Windows\System\abpsbVa.exe
  2⤵
  PID:9752
- C:\Windows\System\pqxCbru.exe
  C:\Windows\System\pqxCbru.exe
  2⤵
  PID:9768
- C:\Windows\System\seogbrr.exe
  C:\Windows\System\seogbrr.exe
  2⤵
  PID:9784
- C:\Windows\System\vyvWOxi.exe
  C:\Windows\System\vyvWOxi.exe
  2⤵
  PID:9800
- C:\Windows\System\vASCecs.exe
  C:\Windows\System\vASCecs.exe
  2⤵
  PID:9816
- C:\Windows\System\wZAcaIt.exe
  C:\Windows\System\wZAcaIt.exe
  2⤵
  PID:9832
- C:\Windows\System\zJOhkul.exe
  C:\Windows\System\zJOhkul.exe
  2⤵
  PID:9848
- C:\Windows\System\MCduAFJ.exe
  C:\Windows\System\MCduAFJ.exe
  2⤵
  PID:9864
- C:\Windows\System\FhamHKI.exe
  C:\Windows\System\FhamHKI.exe
  2⤵
  PID:9880
- C:\Windows\System\baxWDDP.exe
  C:\Windows\System\baxWDDP.exe
  2⤵
  PID:9896
- C:\Windows\System\xSyAwTE.exe
  C:\Windows\System\xSyAwTE.exe
  2⤵
  PID:9912
- C:\Windows\System\nRYfzuC.exe
  C:\Windows\System\nRYfzuC.exe
  2⤵
  PID:9928
- C:\Windows\System\KoOVefd.exe
  C:\Windows\System\KoOVefd.exe
  2⤵
  PID:9944
- C:\Windows\System\YntjcuM.exe
  C:\Windows\System\YntjcuM.exe
  2⤵
  PID:9960
- C:\Windows\System\MOtzXnc.exe
  C:\Windows\System\MOtzXnc.exe
  2⤵
  PID:9976
- C:\Windows\System\ydmjFCl.exe
  C:\Windows\System\ydmjFCl.exe
  2⤵
  PID:9992
- C:\Windows\System\hbMgLen.exe
  C:\Windows\System\hbMgLen.exe
  2⤵
  PID:10008
- C:\Windows\System\OvvNtnP.exe
  C:\Windows\System\OvvNtnP.exe
  2⤵
  PID:10024
- C:\Windows\System\VcCspVa.exe
  C:\Windows\System\VcCspVa.exe
  2⤵
  PID:10040
- C:\Windows\System\rbQqeJL.exe
  C:\Windows\System\rbQqeJL.exe
  2⤵
  PID:10056
- C:\Windows\System\reRDSWf.exe
  C:\Windows\System\reRDSWf.exe
  2⤵
  PID:10072
- C:\Windows\System\VQYgyiq.exe
  C:\Windows\System\VQYgyiq.exe
  2⤵
  PID:10088
- C:\Windows\System\GxLQzHb.exe
  C:\Windows\System\GxLQzHb.exe
  2⤵
  PID:10104
- C:\Windows\System\kinYpiA.exe
  C:\Windows\System\kinYpiA.exe
  2⤵
  PID:10120
- C:\Windows\System\PXyyKoi.exe
  C:\Windows\System\PXyyKoi.exe
  2⤵
  PID:10136
- C:\Windows\System\bqsrjrI.exe
  C:\Windows\System\bqsrjrI.exe
  2⤵
  PID:10152
- C:\Windows\System\VQHkftA.exe
  C:\Windows\System\VQHkftA.exe
  2⤵
  PID:10168
- C:\Windows\System\gDKosMG.exe
  C:\Windows\System\gDKosMG.exe
  2⤵
  PID:10184
- C:\Windows\System\WmHtgkK.exe
  C:\Windows\System\WmHtgkK.exe
  2⤵
  PID:10200
- C:\Windows\System\hvvtlDL.exe
  C:\Windows\System\hvvtlDL.exe
  2⤵
  PID:10216
- C:\Windows\System\YlLyiOK.exe
  C:\Windows\System\YlLyiOK.exe
  2⤵
  PID:10232
- C:\Windows\System\GCpACoY.exe
  C:\Windows\System\GCpACoY.exe
  2⤵
  PID:8444
- C:\Windows\System\ZmnidSX.exe
  C:\Windows\System\ZmnidSX.exe
  2⤵
  PID:8820
- C:\Windows\System\rarmmnY.exe
  C:\Windows\System\rarmmnY.exe
  2⤵
  PID:8400
- C:\Windows\System\mkPYgRS.exe
  C:\Windows\System\mkPYgRS.exe
  2⤵
  PID:8664
- C:\Windows\System\NBLmUbs.exe
  C:\Windows\System\NBLmUbs.exe
  2⤵
  PID:8448
- C:\Windows\System\TrLZqBL.exe
  C:\Windows\System\TrLZqBL.exe
  2⤵
  PID:9300
- C:\Windows\System\kkYiNlN.exe
  C:\Windows\System\kkYiNlN.exe
  2⤵
  PID:9328
- C:\Windows\System\HwtXQQP.exe
  C:\Windows\System\HwtXQQP.exe
  2⤵
  PID:9396
- C:\Windows\System\ooZEiOP.exe
  C:\Windows\System\ooZEiOP.exe
  2⤵
  PID:9456
- C:\Windows\System\uMdzNQX.exe
  C:\Windows\System\uMdzNQX.exe
  2⤵
  PID:9520
- C:\Windows\System\KMVaoap.exe
  C:\Windows\System\KMVaoap.exe
  2⤵
  PID:9008
- C:\Windows\System\OPCZbUl.exe
  C:\Windows\System\OPCZbUl.exe
  2⤵
  PID:9440
- C:\Windows\System\SqJHdwX.exe
  C:\Windows\System\SqJHdwX.exe
  2⤵
  PID:9248
- C:\Windows\System\FlRhXUH.exe
  C:\Windows\System\FlRhXUH.exe
  2⤵
  PID:9588
- C:\Windows\System\UNhTHKV.exe
  C:\Windows\System\UNhTHKV.exe
  2⤵
  PID:9344
- C:\Windows\System\MxvMcmL.exe
  C:\Windows\System\MxvMcmL.exe
  2⤵
  PID:9616
- C:\Windows\System\fYJjybe.exe
  C:\Windows\System\fYJjybe.exe
  2⤵
  PID:9508
- C:\Windows\System\zimsetb.exe
  C:\Windows\System\zimsetb.exe
  2⤵
  PID:9600
- C:\Windows\System\CLBjhsR.exe
  C:\Windows\System\CLBjhsR.exe
  2⤵
  PID:9652
- C:\Windows\System\hAkjlUg.exe
  C:\Windows\System\hAkjlUg.exe
  2⤵
  PID:9712
- C:\Windows\System\SALGNKo.exe
  C:\Windows\System\SALGNKo.exe
  2⤵
  PID:9780
- C:\Windows\System\mCXAzxI.exe
  C:\Windows\System\mCXAzxI.exe
  2⤵
  PID:9636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\APboGhs.exe

Filesize
1.8MB

MD5
4106eb2151af0a29547c209d7cb74602

SHA1
12048d0fb3e77c5cd0a89b77023ae75688854c73

SHA256
56291ba6e77e798bce9009e5ccfaa466acefeb4e84f7b05a856154d3121b68fa

SHA512
a09589f02006dc6e7df1211878bf12a4ac80cc95425e115a94e2837d3bb8ebee33709e248d3e71bed571362b95b5384118fb44bafe9024a066a90c388a9a463f

Download Submit
C:\Windows\system\ClwSgbI.exe

Filesize
1.8MB

MD5
3617e71e39b449fe4975aef25727c7f6

SHA1
734d000eca0b9bf8105a2582777b460ca30b9acc

SHA256
0b1566836eb61eb35c25e0a420054eb14bb034b809d1b3945f99219547fd0020

SHA512
6c127ad385b099746a3107b5dd7b66a678af73d1dde30618d76b1502abddb73fb201d5942f70ac4e8b4d8cbdaf764881d2ad75a7ae1bdfabe99ba9975255e6bf

Download Submit
C:\Windows\system\ElLoWHp.exe

Filesize
1.8MB

MD5
254a35426026aeaf45011ee8196005db

SHA1
c3ff0e1f6e6db20b8b698c8cf7c142ef93ff5acf

SHA256
9a42f94cdf7e61e234b7c49cc8d50fac9daab4aa229d576833181076c08ebe65

SHA512
52e62c7c4d13c902bf06d05c09120c01073f1eeb9f0c0e2c6ba3da6f5f77e84bd9769a7a997cf0c277cfbd31ef97121fb855ae781776c85d3a7a056a9d7639b3

Download Submit
C:\Windows\system\ExJpqoD.exe

Filesize
1.8MB

MD5
2064643a0851334768e1a7dd717fb4be

SHA1
b7375921ed7264da21ece20838596d0f2dd4434a

SHA256
ed04c60144fc36bf5213063474b8674bac769e8c1cda1e2e4bccb44824322f49

SHA512
94c92044ae06aae31fdc0f48c023da7a6cf979620c2072a6056a6acf147e03cde9239c6694c88313c57540b2b94ef93e690e15b4a3c0b0d62fa7c3d9edd38499

Download Submit
C:\Windows\system\GiLTHrY.exe

Filesize
1.8MB

MD5
bb481ef64c01e212dac55ceb39271d4c

SHA1
1389b54c8ac9240b0ab9cc9714b0d1674ab2e6aa

SHA256
48b607a86e5c48a1e2570964da70736d5ee81e2cad410488063ed508ca68e31c

SHA512
a4d23208216931126e9c1167d77617556a8da98a85bb49b725ab90bddeda37f859b00d8c31129f50e550f9e1b758f223a43715c0ac4953c90fd416124c5d2af8

Download Submit
C:\Windows\system\ItffdaS.exe

Filesize
1.8MB

MD5
a356a8750632cb3612fef6c3c1e6e8d3

SHA1
f53db924dc68c3f537f4d3280bc85cb28ae25d8d

SHA256
a905343e4641db50edd16faed14b9c3170838fc29d176a48fe7c9591aacb5451

SHA512
15dd81f83954a89ee4f4d331fd957d2ed07929527970a6dbde72b5669179678f0975e5f11457975e7a13ae30592722b9b0e2c7ff4c80975b10de1a027e927f0d

Download Submit
C:\Windows\system\LonQZTY.exe

Filesize
1.8MB

MD5
85938f85da5a8c7920269f1214ed2406

SHA1
00bdd13153a7267dd1c065dab63b33ad94c7a560

SHA256
6c7d8b0b2f9127b6562502a06f22e532a9491f4179de854e312e7d0e33d2dd0c

SHA512
aba9e541f603f51d1dfeaabc7edb5ebc26a29dde42ee9f622239ebaa468419c9243a89c8dd52713ed3cf2883eb37ea0c92d5c1c53930cac1b166d644dabe3a44

Download Submit
C:\Windows\system\NXODSSO.exe

Filesize
1.8MB

MD5
4bb6dbbfa7d079cf13c58b1e0142c1b7

SHA1
0f323396c195c51e3c0db87a59e3fe46edadd808

SHA256
de4ed49e133b89ce1760b5a79aadda7cf753f07f20fdd58d4b5dd735394a33d2

SHA512
e21ecb4b0c21c81bd846c8d3f793774ebd19d45f5849792059df1cc284fe7b0d79f7cb43ef8bd32a7478f2e20c50d784f3cc32364eaac24c6f59100494fac94e

Download Submit
C:\Windows\system\RBcoJfO.exe

Filesize
1.8MB

MD5
40acd21781cee3cdf56c39fa045edaa8

SHA1
e0081e362b1b1938c738a9e4b9f297a0a7c72205

SHA256
8f2a14cabb443c8c98e6589a0b2b8dedace2da9e1e6280978eb2be182354f4c3

SHA512
176d43e9383d77a8f918bb0072e62cbed4f3db678c59df420c863872fe271eac2aec0066483d4accb2c25730425d0d8d12b9918cb74e9fafa6f0eb7ca784196b

Download Submit
C:\Windows\system\TKLvMHA.exe

Filesize
1.8MB

MD5
d17934fdf96b540d7a48f1711122ce57

SHA1
881b763706e94d72799344d637e928ace3576e87

SHA256
01b4d2c385c391207d27e800a9bf7b194ff0567217e27b9c84d636e43a7f89fb

SHA512
f3de058fcfa2f1a36adb51cc9751af588c9448b1af14c3afea0b22ed2d8e7af342c99e2bdb51d76d6d4aec46123544e2d17908bba57b53ec79794958db885928

Download Submit
C:\Windows\system\UPqtpHA.exe

Filesize
1.8MB

MD5
9b721b128e5e78d46b0f6580f5bd4f38

SHA1
910df439a42b14a4d144b8e3dfad89e53a51b9d1

SHA256
021a52ad5de563634d5c0dc13fc4a08a73227ad18105f429df743e2d908a511c

SHA512
5990712128e87d8869bbc95f6ac9c3f7333614a76c3e0f08dd78cf23a8171250d442c0075b70b7c65222f5db7a1734f619cc6ce37c266e79e1becabc22051fe6

Download Submit
C:\Windows\system\WbIzSji.exe

Filesize
1.8MB

MD5
7c52fa6b246bcc3c4534232ce49aea44

SHA1
6c9711eb015466308d0070e7a6bba5064cf6a9cf

SHA256
d8f6913b948a7b24c8b5242b8be2a125aaa9af1dab7928f57418902f1b1c4de7

SHA512
eee46ad6847d157c0d268e79e6a7cc5426cc5d153272b40b22c79e9f66b6096666f983b0d469eda2fbe42e184c985270fdf256fe109aa4618e1ca6ec423439ab

Download Submit
C:\Windows\system\aBSsXfE.exe

Filesize
1.8MB

MD5
485b84406dfd0954e3b3f5851118da85

SHA1
1117eb3633fa725d6b84738de304553410f4df60

SHA256
b5d818631e6a5229b776c6666e1eb6d1a4a0ae1d30b8106b92889b6656f2b766

SHA512
aa7f90dd6c7cf8f05ac05db9c122c8e29c450f688b2faf9243b04177c2752b106f0b469ecf8f65a190870d10801e03d863409610dd5903a5e20e732e8fb6e054

Download Submit
C:\Windows\system\biBfEcJ.exe

Filesize
1.8MB

MD5
94db0c17e2e50a1b30f4d4334ce42c0a

SHA1
83f82e2a930dd29c7968f391a5912dafc668b482

SHA256
6eb079e5843320b4d46912c6d0845162919b13a58e2e2f91c6901ced280750bd

SHA512
29d6f27a750041d914b00ace58db1d7f85344385b2464d48277c124f2f0f2b627a30761c8d9af5f76bb0ca83fdfb22b4444f4071ebdd8da490377ca10c4bb24d

Download Submit
C:\Windows\system\bogmbBD.exe

Filesize
1.8MB

MD5
369e720da9019b224485a8726b34d937

SHA1
493dca276c4b19b6bf79a258bbb890f9df20ff81

SHA256
5e3936cbef682b176ad559cbf58bf3b608e9a769df3503c4bed0ce364cedf7a6

SHA512
7aeb2aa4c7256bc4e2dadc890ce1c42f4cc4c8854a2122f282843d6fe03ea62f35fbd09e33cd1cc90bd0a8b096ee2d6496088a9c3f2a1e91073c30e51105d345

Download Submit
C:\Windows\system\clBrtUy.exe

Filesize
1.8MB

MD5
5a4f850c72990e33ce549ef0f6c51bab

SHA1
ff994ae7e60ff1cdebdd764cd6a3a75b32e3231f

SHA256
9901f216cb61234a6e0e4a9c64f3b96f5c453ed78d5b97b65bf6787f79f24b3b

SHA512
8c7337a7b569c0b3ce939b045b01d8770b2ae1262f96a6c520b2f50dbe8579608583209d7014f7bdc2226e5f61644c16e298889fc493513576d700f2983b33e2

Download Submit
C:\Windows\system\edDJmwc.exe

Filesize
1.8MB

MD5
249e27a7be91fb2f9b13cf1d8f2ac04c

SHA1
d40e9b86d5cb03bf555571270b9109ee54c7d40b

SHA256
d8116bbb5e927eb6d2c3d960182f320c4b71f8403c72d8bcb2ecf29c30359bbe

SHA512
fc2f04bf6e24b31b89c3e26bfdf37bcf7e1a1e59f6e6d2499a36f56dc47107250cc9c71ccf5044b8b141e9890bb3b42011c62f09e423d6d33bfaf13ab569dbda

Download Submit
C:\Windows\system\gPGyodq.exe

Filesize
1.8MB

MD5
a2b230ea814d8921d7372bf773a89dc9

SHA1
9e51a94b0c6adf2352dc17fa8947f4ed082bde77

SHA256
631791fcd64fd3cf43abe02a4fcc0dc2d2481ee259c80dbc15565d90d225e20d

SHA512
83a3f6defbeb71682e82bf8d2d6fe38f2a18a82f053b3399462b315406993dfdf7d90d43a7c5c0ea0dce27292dd6960a1cdee5d837762c3fe7fd3dd9322e66d5

Download Submit
C:\Windows\system\govHwrD.exe

Filesize
1.8MB

MD5
f2d770635e8725520d9c424e10e7e68d

SHA1
951926e940f7b548d7117df8af3f7c36416ed509

SHA256
508be6c7dca2877a7131b9ab3aadddea7ce904d2d28bc8cc88900791aa223268

SHA512
d722926d2c9deebaaaa30acebdee4e55e132d35ace5bcbbe4c2161c2e5119ce70f6c7d80a0c23d2328f24bda38d0041769066cbb44eba8994d543c8a59d9b367

Download Submit
C:\Windows\system\kqRqtuU.exe

Filesize
1.8MB

MD5
af447c0ac19bf71f2db00a17021d4c73

SHA1
59680d00141be343d9e0bd8918e319fd9a4e5de2

SHA256
63be367ec180d26e20add6f4f14d608b23c6b8c2751c4cf91521ad80716872e3

SHA512
6d4f58ba5314b3963cacd3c64bce99ed52874689ce6e628a28000e23807c293256c1af5e797bd14e92cc450910729e1f176599b766da83b1f3a71a2da1800e42

Download Submit
C:\Windows\system\lvjitpv.exe

Filesize
1.8MB

MD5
8ede628afbd70cbdfadeae3dfcc18db8

SHA1
bcc2dfce0bf654d6a3f418f72ceb8d8b8e3b92d0

SHA256
262ec6fec5eec1e70c435793b36dd4eadffe4d4db09655cff4de7d5d081a4b7f

SHA512
52aa4bc82a11a37371d8c6f89e421d39b02d1993b9ae17c440e88aaf982109793f772554b28683cc238e1894a41d3c6b498be788a90c4e7e7fb8ebcff71f9643

Download Submit
C:\Windows\system\otEsSbg.exe

Filesize
1.8MB

MD5
ab5008d97c809b2881c9db3523b5f6f0

SHA1
2157f5dfdd8c8cf359ad474bfee596958a2e41c2

SHA256
854853544ae9441fb804f2ba60c0ad61b94a3369a77415e2f36041ea3eb645fe

SHA512
1d15ef3c898f23e69cd22ff6a31ca191c1d49832b9df8ded52a6863b53919378fc13d071c1b02ec3667383964820beb1d80b8e1d8eff97082093de0b54c4af4c

Download Submit
C:\Windows\system\pgRPief.exe

Filesize
1.8MB

MD5
727600866e15327859d46b2f4104df14

SHA1
73d6acefdbe80fd6b38ac3db5f9187a528a6c805

SHA256
72b62e105b789a671ed2cb66378cfbec650a222757a48a5134f4c3604c48187d

SHA512
47b416c7c95f80eca6223f4bf2e5c96894902522af63e905936756dfd824795f9399464f89edfa94f950d47c8131e623cc776b98fe708c7fc420f62ad79346a4

Download Submit
C:\Windows\system\sKDxbPT.exe

Filesize
1.8MB

MD5
062574fa073baa659653f6d447d2669e

SHA1
ddc0b285b24481ce100d41205b6b2a81f9dda3f8

SHA256
9ab0497490a30b8731c8cc90473aa5e4ef9fe7383a81f2318636a5e6cf346120

SHA512
7755d9abd5a24dc7254fdb8bec805395b752249f5a75a20c245584212cb88b60fe2d9e548f02b6f0f39cc6694bd32a36efce0cb3253f0cb91fa87e70b7ccae33

Download Submit
C:\Windows\system\vHmiSQu.exe

Filesize
1.8MB

MD5
d80a91c14d2153e9b0249516346d2202

SHA1
70472d94719a8e3e15cbad147b4e63f8e26789b7

SHA256
39f34baf1aac4cf2192bce5616d36715c7c227b9c134a5ec39f0a269a5b45566

SHA512
7a0894474b1cc9cabb8f68bf6fa4eb0c7edfcd69a145e506d999d1f104b1f97cfd28542f0616f1fb9c770d68dda2bade5647272a1aae5559326b3bf5e0ddcd77

Download Submit
C:\Windows\system\yxVpbZG.exe

Filesize
1.8MB

MD5
ce0d8ba9931f07d4b7084b896cc3fcf2

SHA1
45833a4e09e76acd9446886abf1350864213915b

SHA256
ec576e8cac70fa1f7873aa14c96eb980428dabd2eb85384961daba53ec8bdd77

SHA512
ca7e76d719bbe47230867f0fbae31ba1ffcf3d4178704629d1982f90b3631878395ea981c43ac269796292f79ac6ccdedac14b40d73b8d2a5eea1f874ae3e5df

Download Submit
C:\Windows\system\zZqaIEb.exe

Filesize
1.8MB

MD5
30cfd38f0ad9a0b48bcdc380e673ef85

SHA1
bde812b4703d749110509855699262779781ed2b

SHA256
dc6079edd403c82202e9086926b2f8da04d2db3869d0138e38fe58761b8faee1

SHA512
ce2d79d5e3622eed66a20842f81b02529887734ed2a16ff7b34a7bd9ef2e9b5767be1c555f90cbdb8b1b2f17f84f1c080387b43a05584f29f44efbe62625a1fc

Download Submit
C:\Windows\system\ztLTFId.exe

Filesize
1.8MB

MD5
7199bedb114722ebaf1bf1a1b4bbb265

SHA1
0e7408cb9d20ee45709bf3bf0aeddf0c4ab193fd

SHA256
565b159b76bf4607763614082eb37a45ea400757809b347e11b076df5e25e9d9

SHA512
db7c67704c757f8b34432fe26c99d16509991b7edb44ce534694e9469ca72d3790ba0d1105d24ee32e41384b8454ac926ce48972ca880f701f6ddee333942694

Download Submit
\Windows\system\DMNhUYo.exe

Filesize
1.8MB

MD5
6d2427d435067c7c91ea209046355ce4

SHA1
9e0de7df0706ac12dbf9a3c83f3aaf9174989930

SHA256
176d0159a52f38be71dbd316799c53ce86d8873f444c19d1ce5409cc2f6f7e63

SHA512
4e6da4939ba4bef410b265bb3e8073757e1aeef625901f541f86e68420acfc25d11b1dc7ac22b6cbedb7693b9b343112def6b6f7fa6f8f4bd85563091d3665cf

Download Submit
\Windows\system\YvqLGlH.exe

Filesize
1.8MB

MD5
a2eda7272eaaae5e132fb78458427e6b

SHA1
614f2276e9e802015ba3ca9257e7e36fd6337024

SHA256
3f26e1a39237e2f06f69080bd2ab9d0585a3c38334a886d6705afe868ec1db7b

SHA512
028b06a73de59eecc5f7c5130f1ccdcdadb1df80d8926c30f9f0e7d65fc2b5067cf59ecccc2fda5523d89fbd377eccef7e2f29a83c757bca672a8a7a7d6f082a

Download Submit
\Windows\system\gbozfGJ.exe

Filesize
1.8MB

MD5
33a5dbd62c48b16cc3e6ca5a22ea0ba9

SHA1
6d813293ebb714a45ff449e6ccda5cd48016bcfa

SHA256
add8c6bf544032ee7bdfcdb30ca1e3f55d88379dae3db7ff212ec2648f8cfcb0

SHA512
46c2ea42ca351cbc8c31d0412de8a257bcf9956e3c274911d6d2c0da5f5095022689385978d22be1b4c2cb21a64fca26db15281db05341c3e5f13f701676467c

Download Submit
\Windows\system\svTbEuP.exe

Filesize
1.8MB

MD5
1f97d9bbb24d05bb43bce70161a0ddfa

SHA1
593ed098d1ab3667a473a7a561248c579a57ea10

SHA256
bdd22e224042813156da51ad3e93d401936fbad99786b8632fe97b03df0564ba

SHA512
b921b3f6cdd1e0387a82676077a5da503e1ff7b0ff908413ec07b68d87881ffef54504ec21d901f8e0c574330041f129570eb69447ab109fd2eb40e2a901072e

Download Submit
memory/2080-79-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2080-76-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2080-60-0x0000000003310000-0x0000000003702000-memory.dmp

Filesize
3.9MB

Download
memory/2080-82-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2080-83-0x0000000003030000-0x0000000003422000-memory.dmp

Filesize
3.9MB

Download
memory/2080-11-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2080-85-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2080-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-78-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-67-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-73-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2080-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2080-80-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2088-36-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2088-580-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2088-41-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2088-58-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2088-75-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2088-42-0x00000000027B0000-0x0000000002830000-memory.dmp

Filesize
512KB

Download
memory/2088-56-0x000007FEF5B10000-0x000007FEF64AD000-memory.dmp

Filesize
9.6MB

Download
memory/2088-81-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2272-87-0x000000013F9D0000-0x000000013FDC2000-memory.dmp

Filesize
3.9MB

Download
memory/2456-84-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2472-74-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-86-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2560-17-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2616-77-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-22-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2780-64-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download