xmrig | cbae8bc119404ce8d077ee1ce50bde550dd8e609d1b17ee2a8ea684fc91bc4da

Analysis

max time kernel
27s
max time network
35s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
Size

1.9MB
MD5

0a960ec79155a7cb0c3259a68bc621ce
SHA1

4c56ff5f2fbb30057e4d133ce494a10a0534fff5
SHA256

cbae8bc119404ce8d077ee1ce50bde550dd8e609d1b17ee2a8ea684fc91bc4da
SHA512

82ea5779509dbaa6645fcfe5b6f170e6b20d958eacb50462f8028d9569b475e22ea97df0e7f02234c0117118ed981e62c3cb0b385b24097987fbad81f0d51d27
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOG:NAB9

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2904-106-0x000000013F120000-0x000000013F512000-memory.dmp	xmrig
behavioral1/memory/2312-121-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2600-120-0x000000013F790000-0x000000013FB82000-memory.dmp	xmrig
behavioral1/memory/2540-118-0x000000013FE20000-0x0000000140212000-memory.dmp	xmrig
behavioral1/memory/2196-116-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2560-114-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2828-112-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig
behavioral1/memory/2832-110-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2900-108-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
876	hoEkjuh.exe
2904	RoEVaxe.exe
2900	nCSddSb.exe
2832	nWaCNay.exe
2828	dDzChKk.exe
2560	dqKNaTa.exe
2196	foyLALH.exe
2540	nATJFEF.exe
2600	pJKkaIr.exe
2984	qrfWtjU.exe
2992	TpEslvr.exe
608	VjbcOTS.exe
2020	CBQRnvt.exe
2636	pFjhVot.exe
2780	CarvXJy.exe
760	tiPmXAN.exe
2024	nLwYOFV.exe
2968	jkQtikg.exe
324	GzKgMmQ.exe
1588	lQYOelS.exe
2004	kkTrwwq.exe
2136	BkghfqO.exe
2872	ytHHpqB.exe
288	ZUnyMpi.exe
2052	ElDaAsu.exe
1940	lvSYEtN.exe
2500	ZaYoDiW.exe
2276	aXqYdky.exe
2332	dPiDpyb.exe
940	wJxyNzt.exe
1904	vhDsRdu.exe
1908	DJcJXTQ.exe
1148	kQHeBpM.exe
1688	PFjbpIB.exe
1180	dnmFLzY.exe
2108	iUVHAJq.exe
1512	uNCDbYN.exe
2964	EZpffrX.exe
2072	urVFooM.exe
1712	MFNkgBR.exe
2288	XxCWaVB.exe
2812	jPJmxZF.exe
2604	XnsmNxH.exe
2880	jrwOMZL.exe
2184	ecCJcXU.exe
3060	zOXbJjB.exe
2568	pXSEERq.exe
984	QezZXIJ.exe
684	LSOHjYT.exe
2492	VMeZEEj.exe
2696	LLMIeBf.exe
2896	MJEfTxd.exe
2068	dZnCvZd.exe
2212	zPtdHSF.exe
3144	eJkzyol.exe
1636	jTudGnO.exe
1720	mzGBwWp.exe
2284	KHDxhtL.exe
1488	Flcvehw.exe
1696	CNVxaHw.exe
904	cHOWsAW.exe
1156	qWShSzu.exe
668	scGCgTS.exe
628	LnnXGdz.exe

Loads dropped DLL 64 IoCs

pid	Process
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2312-0-0x000000013F660000-0x000000013FA52000-memory.dmp	upx
behavioral1/files/0x000c00000001227b-6.dat	upx
behavioral1/memory/876-12-0x000000013F490000-0x000000013F882000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-21.dat	upx
behavioral1/files/0x00310000000144d6-17.dat	upx
behavioral1/files/0x00070000000148af-38.dat	upx
behavioral1/files/0x0006000000015cca-58.dat	upx
behavioral1/files/0x0006000000015cc2-57.dat	upx
behavioral1/files/0x0006000000015d28-96.dat	upx
behavioral1/files/0x0006000000015d13-86.dat	upx
behavioral1/files/0x0006000000016126-141.dat	upx
behavioral1/files/0x0006000000016c5b-183.dat	upx
behavioral1/files/0x0006000000016ccd-192.dat	upx
behavioral1/files/0x0006000000015d89-98.dat	upx
behavioral1/files/0x0006000000015d02-102.dat	upx
behavioral1/memory/2904-106-0x000000013F120000-0x000000013F512000-memory.dmp	upx
behavioral1/files/0x0006000000015cd8-74.dat	upx
behavioral1/files/0x0006000000016020-135.dat	upx
behavioral1/files/0x0006000000015ced-85.dat	upx
behavioral1/files/0x0006000000016c3a-176.dat	upx
behavioral1/files/0x00060000000167e8-170.dat	upx
behavioral1/files/0x003000000001451d-161.dat	upx
behavioral1/files/0x000600000001640f-152.dat	upx
behavioral1/files/0x0006000000015fbb-132.dat	upx
behavioral1/files/0x0006000000015d99-122.dat	upx
behavioral1/files/0x0006000000015cf5-79.dat	upx
behavioral1/files/0x0007000000015c9b-46.dat	upx
behavioral1/files/0x0006000000015ce1-68.dat	upx
behavioral1/files/0x0006000000016a3a-172.dat	upx
behavioral1/files/0x0006000000015ca9-51.dat	upx
behavioral1/files/0x000700000001475f-36.dat	upx
behavioral1/files/0x0006000000015d1e-89.dat	upx
behavioral1/files/0x00090000000146a7-27.dat	upx
behavioral1/files/0x0006000000016ca1-188.dat	upx
behavioral1/files/0x0006000000016c57-179.dat	upx
behavioral1/files/0x0006000000016591-163.dat	upx
behavioral1/files/0x000600000001650f-154.dat	upx
behavioral1/files/0x0006000000016228-145.dat	upx
behavioral1/files/0x0006000000015f40-125.dat	upx
behavioral1/memory/2600-120-0x000000013F790000-0x000000013FB82000-memory.dmp	upx
behavioral1/memory/2540-118-0x000000013FE20000-0x0000000140212000-memory.dmp	upx
behavioral1/memory/2196-116-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/memory/2560-114-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2828-112-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/memory/2832-110-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2900-108-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x000700000001474b-31.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qWsoKrG.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\WTUAHuD.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\ZEkgmxu.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\fzIBVWq.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\cHOWsAW.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\xgUMEkC.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\VAiDAOC.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\MoBKFSC.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\ejWtSuA.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\lRmYUxe.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\IbDmHAQ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\HyCGnFK.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\VsBskte.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\pOkqdJL.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\gomvIfx.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\ZLjlIFd.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\fVOqZUB.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\dRilFAL.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\EhiDWPK.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\ZUnyMpi.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\Flcvehw.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\uHQWBqQ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\UpitGOp.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\sovKSun.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\SKtFiGm.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\cbviLwo.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\cakhxzZ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\JGSWISf.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\LCeRGDR.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\CUxCsfv.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\qMJiwwE.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\nATJFEF.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\VMeZEEj.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\oPgWaOX.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\fOhDWKg.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\utsrbEZ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\KNwGgPv.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\lntkexP.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\YUwiOae.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\uNCDbYN.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\YqhdZWs.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\actRIFB.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\JlIHhra.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\bYBJIGx.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\FxdZJpa.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\SCrNAvN.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\vEfcLys.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\KssLneJ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\WPbvkdQ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\CWslWuQ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\aFwxXWE.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\rvewhrP.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\EXdaupG.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\PxRzQqW.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\tJHBYdh.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\wOliPfZ.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\bDDPkLj.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\IGfKmhp.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\vRtlDuw.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\rAZsobm.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\EVShxXX.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\AgObPdA.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\qJWPbhK.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
File created	C:\Windows\System\vhDsRdu.exe	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3004	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
Token: SeDebugPrivilege	3004	powershell.exe
Token: SeLockMemoryPrivilege	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	29
PID 2312 wrote to memory of 3004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	29
PID 2312 wrote to memory of 3004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	29
PID 2312 wrote to memory of 876	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	30
PID 2312 wrote to memory of 876	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	30
PID 2312 wrote to memory of 876	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	30
PID 2312 wrote to memory of 2904	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	31
PID 2312 wrote to memory of 2904	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	31
PID 2312 wrote to memory of 2904	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	31
PID 2312 wrote to memory of 2900	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2900	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2900	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	32
PID 2312 wrote to memory of 2832	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2832	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2832	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	33
PID 2312 wrote to memory of 2828	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2828	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2828	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	34
PID 2312 wrote to memory of 2560	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2560	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2560	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	35
PID 2312 wrote to memory of 2196	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2196	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2196	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	36
PID 2312 wrote to memory of 2540	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	37
PID 2312 wrote to memory of 2540	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	37
PID 2312 wrote to memory of 2540	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	37
PID 2312 wrote to memory of 2600	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	38
PID 2312 wrote to memory of 2600	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	38
PID 2312 wrote to memory of 2600	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	38
PID 2312 wrote to memory of 2984	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	39
PID 2312 wrote to memory of 2984	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	39
PID 2312 wrote to memory of 2984	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	39
PID 2312 wrote to memory of 2992	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2992	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2992	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	40
PID 2312 wrote to memory of 2020	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	41
PID 2312 wrote to memory of 2020	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	41
PID 2312 wrote to memory of 2020	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	41
PID 2312 wrote to memory of 608	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	42
PID 2312 wrote to memory of 608	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	42
PID 2312 wrote to memory of 608	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	42
PID 2312 wrote to memory of 2780	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2780	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2780	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	43
PID 2312 wrote to memory of 2636	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	44
PID 2312 wrote to memory of 2636	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	44
PID 2312 wrote to memory of 2636	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	44
PID 2312 wrote to memory of 2968	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	45
PID 2312 wrote to memory of 2968	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	45
PID 2312 wrote to memory of 2968	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	45
PID 2312 wrote to memory of 760	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	46
PID 2312 wrote to memory of 760	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	46
PID 2312 wrote to memory of 760	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	46
PID 2312 wrote to memory of 2004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	47
PID 2312 wrote to memory of 2004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	47
PID 2312 wrote to memory of 2004	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	47
PID 2312 wrote to memory of 2024	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	48
PID 2312 wrote to memory of 2024	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	48
PID 2312 wrote to memory of 2024	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	48
PID 2312 wrote to memory of 2332	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	49
PID 2312 wrote to memory of 2332	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	49
PID 2312 wrote to memory of 2332	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	49
PID 2312 wrote to memory of 324	2312	0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a960ec79155a7cb0c3259a68bc621ce_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3004
- C:\Windows\System\hoEkjuh.exe
  C:\Windows\System\hoEkjuh.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\RoEVaxe.exe
  C:\Windows\System\RoEVaxe.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\nCSddSb.exe
  C:\Windows\System\nCSddSb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\nWaCNay.exe
  C:\Windows\System\nWaCNay.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\dDzChKk.exe
  C:\Windows\System\dDzChKk.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\dqKNaTa.exe
  C:\Windows\System\dqKNaTa.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\foyLALH.exe
  C:\Windows\System\foyLALH.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\nATJFEF.exe
  C:\Windows\System\nATJFEF.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\pJKkaIr.exe
  C:\Windows\System\pJKkaIr.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\qrfWtjU.exe
  C:\Windows\System\qrfWtjU.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\TpEslvr.exe
  C:\Windows\System\TpEslvr.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\CBQRnvt.exe
  C:\Windows\System\CBQRnvt.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\VjbcOTS.exe
  C:\Windows\System\VjbcOTS.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\CarvXJy.exe
  C:\Windows\System\CarvXJy.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\pFjhVot.exe
  C:\Windows\System\pFjhVot.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\jkQtikg.exe
  C:\Windows\System\jkQtikg.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\tiPmXAN.exe
  C:\Windows\System\tiPmXAN.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\kkTrwwq.exe
  C:\Windows\System\kkTrwwq.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\nLwYOFV.exe
  C:\Windows\System\nLwYOFV.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dPiDpyb.exe
  C:\Windows\System\dPiDpyb.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\GzKgMmQ.exe
  C:\Windows\System\GzKgMmQ.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\zPtdHSF.exe
  C:\Windows\System\zPtdHSF.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\lQYOelS.exe
  C:\Windows\System\lQYOelS.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\jTudGnO.exe
  C:\Windows\System\jTudGnO.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\BkghfqO.exe
  C:\Windows\System\BkghfqO.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\mzGBwWp.exe
  C:\Windows\System\mzGBwWp.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ytHHpqB.exe
  C:\Windows\System\ytHHpqB.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\KHDxhtL.exe
  C:\Windows\System\KHDxhtL.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\ZUnyMpi.exe
  C:\Windows\System\ZUnyMpi.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\Flcvehw.exe
  C:\Windows\System\Flcvehw.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\ElDaAsu.exe
  C:\Windows\System\ElDaAsu.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\CNVxaHw.exe
  C:\Windows\System\CNVxaHw.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\lvSYEtN.exe
  C:\Windows\System\lvSYEtN.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\cHOWsAW.exe
  C:\Windows\System\cHOWsAW.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\ZaYoDiW.exe
  C:\Windows\System\ZaYoDiW.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\qWShSzu.exe
  C:\Windows\System\qWShSzu.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\aXqYdky.exe
  C:\Windows\System\aXqYdky.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\scGCgTS.exe
  C:\Windows\System\scGCgTS.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\wJxyNzt.exe
  C:\Windows\System\wJxyNzt.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\LnnXGdz.exe
  C:\Windows\System\LnnXGdz.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\vhDsRdu.exe
  C:\Windows\System\vhDsRdu.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\HtuqjYH.exe
  C:\Windows\System\HtuqjYH.exe
  2⤵
  PID:1876
- C:\Windows\System\DJcJXTQ.exe
  C:\Windows\System\DJcJXTQ.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\gIvNngw.exe
  C:\Windows\System\gIvNngw.exe
  2⤵
  PID:824
- C:\Windows\System\kQHeBpM.exe
  C:\Windows\System\kQHeBpM.exe
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Windows\System\HyCGnFK.exe
  C:\Windows\System\HyCGnFK.exe
  2⤵
  PID:2080
- C:\Windows\System\PFjbpIB.exe
  C:\Windows\System\PFjbpIB.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\XhgDoKQ.exe
  C:\Windows\System\XhgDoKQ.exe
  2⤵
  PID:1836
- C:\Windows\System\dnmFLzY.exe
  C:\Windows\System\dnmFLzY.exe
  2⤵
  - Executes dropped EXE
  PID:1180
- C:\Windows\System\zclTaqq.exe
  C:\Windows\System\zclTaqq.exe
  2⤵
  PID:2176
- C:\Windows\System\iUVHAJq.exe
  C:\Windows\System\iUVHAJq.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\FlJyYPb.exe
  C:\Windows\System\FlJyYPb.exe
  2⤵
  PID:816
- C:\Windows\System\uNCDbYN.exe
  C:\Windows\System\uNCDbYN.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\DveJtWL.exe
  C:\Windows\System\DveJtWL.exe
  2⤵
  PID:868
- C:\Windows\System\EZpffrX.exe
  C:\Windows\System\EZpffrX.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\YaSTuCA.exe
  C:\Windows\System\YaSTuCA.exe
  2⤵
  PID:2488
- C:\Windows\System\urVFooM.exe
  C:\Windows\System\urVFooM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\Wufwwui.exe
  C:\Windows\System\Wufwwui.exe
  2⤵
  PID:1620
- C:\Windows\System\MFNkgBR.exe
  C:\Windows\System\MFNkgBR.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\fMOsgDk.exe
  C:\Windows\System\fMOsgDk.exe
  2⤵
  PID:2740
- C:\Windows\System\XxCWaVB.exe
  C:\Windows\System\XxCWaVB.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\TaBEqbX.exe
  C:\Windows\System\TaBEqbX.exe
  2⤵
  PID:2816
- C:\Windows\System\jPJmxZF.exe
  C:\Windows\System\jPJmxZF.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\ZbvcvFN.exe
  C:\Windows\System\ZbvcvFN.exe
  2⤵
  PID:2656
- C:\Windows\System\XnsmNxH.exe
  C:\Windows\System\XnsmNxH.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\lcgKmhv.exe
  C:\Windows\System\lcgKmhv.exe
  2⤵
  PID:2824
- C:\Windows\System\jrwOMZL.exe
  C:\Windows\System\jrwOMZL.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\jmSnVtm.exe
  C:\Windows\System\jmSnVtm.exe
  2⤵
  PID:1796
- C:\Windows\System\ecCJcXU.exe
  C:\Windows\System\ecCJcXU.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\hCvVHNA.exe
  C:\Windows\System\hCvVHNA.exe
  2⤵
  PID:1376
- C:\Windows\System\zOXbJjB.exe
  C:\Windows\System\zOXbJjB.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\qKcSIeJ.exe
  C:\Windows\System\qKcSIeJ.exe
  2⤵
  PID:2576
- C:\Windows\System\pXSEERq.exe
  C:\Windows\System\pXSEERq.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\DBxaqjQ.exe
  C:\Windows\System\DBxaqjQ.exe
  2⤵
  PID:2504
- C:\Windows\System\QezZXIJ.exe
  C:\Windows\System\QezZXIJ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\XmFanWm.exe
  C:\Windows\System\XmFanWm.exe
  2⤵
  PID:2936
- C:\Windows\System\LSOHjYT.exe
  C:\Windows\System\LSOHjYT.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\LdPdogt.exe
  C:\Windows\System\LdPdogt.exe
  2⤵
  PID:2348
- C:\Windows\System\VMeZEEj.exe
  C:\Windows\System\VMeZEEj.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\dkQofrH.exe
  C:\Windows\System\dkQofrH.exe
  2⤵
  PID:1084
- C:\Windows\System\LLMIeBf.exe
  C:\Windows\System\LLMIeBf.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\azYYFLx.exe
  C:\Windows\System\azYYFLx.exe
  2⤵
  PID:2672
- C:\Windows\System\MJEfTxd.exe
  C:\Windows\System\MJEfTxd.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\iSiKldl.exe
  C:\Windows\System\iSiKldl.exe
  2⤵
  PID:1924
- C:\Windows\System\dZnCvZd.exe
  C:\Windows\System\dZnCvZd.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\vBaBaOP.exe
  C:\Windows\System\vBaBaOP.exe
  2⤵
  PID:1100
- C:\Windows\System\eJkzyol.exe
  C:\Windows\System\eJkzyol.exe
  2⤵
  - Executes dropped EXE
  PID:3144
- C:\Windows\System\JDIXqVv.exe
  C:\Windows\System\JDIXqVv.exe
  2⤵
  PID:3256
- C:\Windows\System\lSLSoWv.exe
  C:\Windows\System\lSLSoWv.exe
  2⤵
  PID:3276
- C:\Windows\System\GBFOmvo.exe
  C:\Windows\System\GBFOmvo.exe
  2⤵
  PID:3292
- C:\Windows\System\VJjhgrP.exe
  C:\Windows\System\VJjhgrP.exe
  2⤵
  PID:3308
- C:\Windows\System\gomvIfx.exe
  C:\Windows\System\gomvIfx.exe
  2⤵
  PID:3324
- C:\Windows\System\wNyMCqy.exe
  C:\Windows\System\wNyMCqy.exe
  2⤵
  PID:3340
- C:\Windows\System\GDOuirI.exe
  C:\Windows\System\GDOuirI.exe
  2⤵
  PID:3356
- C:\Windows\System\YiASqOI.exe
  C:\Windows\System\YiASqOI.exe
  2⤵
  PID:3372
- C:\Windows\System\wCgsqsi.exe
  C:\Windows\System\wCgsqsi.exe
  2⤵
  PID:3412
- C:\Windows\System\oovbTOx.exe
  C:\Windows\System\oovbTOx.exe
  2⤵
  PID:3428
- C:\Windows\System\vvdxIMV.exe
  C:\Windows\System\vvdxIMV.exe
  2⤵
  PID:3444
- C:\Windows\System\fyknIut.exe
  C:\Windows\System\fyknIut.exe
  2⤵
  PID:3460
- C:\Windows\System\bsjbIgA.exe
  C:\Windows\System\bsjbIgA.exe
  2⤵
  PID:3480
- C:\Windows\System\nVMThmb.exe
  C:\Windows\System\nVMThmb.exe
  2⤵
  PID:3496
- C:\Windows\System\VCMrHwm.exe
  C:\Windows\System\VCMrHwm.exe
  2⤵
  PID:3512
- C:\Windows\System\DCNRugQ.exe
  C:\Windows\System\DCNRugQ.exe
  2⤵
  PID:3528
- C:\Windows\System\QFiuEgB.exe
  C:\Windows\System\QFiuEgB.exe
  2⤵
  PID:3544
- C:\Windows\System\moDEuDK.exe
  C:\Windows\System\moDEuDK.exe
  2⤵
  PID:3560
- C:\Windows\System\UgcyQCE.exe
  C:\Windows\System\UgcyQCE.exe
  2⤵
  PID:3576
- C:\Windows\System\oPgWaOX.exe
  C:\Windows\System\oPgWaOX.exe
  2⤵
  PID:3592
- C:\Windows\System\cBGVSwC.exe
  C:\Windows\System\cBGVSwC.exe
  2⤵
  PID:3608
- C:\Windows\System\uHQWBqQ.exe
  C:\Windows\System\uHQWBqQ.exe
  2⤵
  PID:3624
- C:\Windows\System\GthjvVV.exe
  C:\Windows\System\GthjvVV.exe
  2⤵
  PID:3640
- C:\Windows\System\HnUMmXN.exe
  C:\Windows\System\HnUMmXN.exe
  2⤵
  PID:3656
- C:\Windows\System\xpdKyfp.exe
  C:\Windows\System\xpdKyfp.exe
  2⤵
  PID:3672
- C:\Windows\System\ACNIEPg.exe
  C:\Windows\System\ACNIEPg.exe
  2⤵
  PID:3688
- C:\Windows\System\zCPNWZo.exe
  C:\Windows\System\zCPNWZo.exe
  2⤵
  PID:3704
- C:\Windows\System\MZjvDlJ.exe
  C:\Windows\System\MZjvDlJ.exe
  2⤵
  PID:3724
- C:\Windows\System\kTBKVuo.exe
  C:\Windows\System\kTBKVuo.exe
  2⤵
  PID:3740
- C:\Windows\System\pMohaUU.exe
  C:\Windows\System\pMohaUU.exe
  2⤵
  PID:3756
- C:\Windows\System\fHBplCo.exe
  C:\Windows\System\fHBplCo.exe
  2⤵
  PID:3772
- C:\Windows\System\biQeGIT.exe
  C:\Windows\System\biQeGIT.exe
  2⤵
  PID:3788
- C:\Windows\System\balOdtI.exe
  C:\Windows\System\balOdtI.exe
  2⤵
  PID:3804
- C:\Windows\System\tJHBYdh.exe
  C:\Windows\System\tJHBYdh.exe
  2⤵
  PID:3820
- C:\Windows\System\ywatyMn.exe
  C:\Windows\System\ywatyMn.exe
  2⤵
  PID:3836
- C:\Windows\System\rbhGQAP.exe
  C:\Windows\System\rbhGQAP.exe
  2⤵
  PID:3852
- C:\Windows\System\vFYFWCX.exe
  C:\Windows\System\vFYFWCX.exe
  2⤵
  PID:3868
- C:\Windows\System\UeXebuU.exe
  C:\Windows\System\UeXebuU.exe
  2⤵
  PID:3888
- C:\Windows\System\WAyFhXL.exe
  C:\Windows\System\WAyFhXL.exe
  2⤵
  PID:3904
- C:\Windows\System\OWfrEKx.exe
  C:\Windows\System\OWfrEKx.exe
  2⤵
  PID:3920
- C:\Windows\System\jWLqwID.exe
  C:\Windows\System\jWLqwID.exe
  2⤵
  PID:3936
- C:\Windows\System\HaTeqFF.exe
  C:\Windows\System\HaTeqFF.exe
  2⤵
  PID:3952
- C:\Windows\System\Rfcrotl.exe
  C:\Windows\System\Rfcrotl.exe
  2⤵
  PID:3968
- C:\Windows\System\vHiGMsw.exe
  C:\Windows\System\vHiGMsw.exe
  2⤵
  PID:3984
- C:\Windows\System\JWoOvSq.exe
  C:\Windows\System\JWoOvSq.exe
  2⤵
  PID:3216
- C:\Windows\System\QrlcpbK.exe
  C:\Windows\System\QrlcpbK.exe
  2⤵
  PID:3236
- C:\Windows\System\XCdQzZv.exe
  C:\Windows\System\XCdQzZv.exe
  2⤵
  PID:1032
- C:\Windows\System\ZPKRmlM.exe
  C:\Windows\System\ZPKRmlM.exe
  2⤵
  PID:2996
- C:\Windows\System\JPeHFGu.exe
  C:\Windows\System\JPeHFGu.exe
  2⤵
  PID:2012
- C:\Windows\System\SrVDScq.exe
  C:\Windows\System\SrVDScq.exe
  2⤵
  PID:2248
- C:\Windows\System\zNzRrIC.exe
  C:\Windows\System\zNzRrIC.exe
  2⤵
  PID:2140
- C:\Windows\System\UpitGOp.exe
  C:\Windows\System\UpitGOp.exe
  2⤵
  PID:1528
- C:\Windows\System\WwLhWOD.exe
  C:\Windows\System\WwLhWOD.exe
  2⤵
  PID:1564
- C:\Windows\System\rkpEiKP.exe
  C:\Windows\System\rkpEiKP.exe
  2⤵
  PID:2480
- C:\Windows\System\FEhVwRc.exe
  C:\Windows\System\FEhVwRc.exe
  2⤵
  PID:2384
- C:\Windows\System\moETXuJ.exe
  C:\Windows\System\moETXuJ.exe
  2⤵
  PID:2544
- C:\Windows\System\OKZXNGh.exe
  C:\Windows\System\OKZXNGh.exe
  2⤵
  PID:2536
- C:\Windows\System\xgUMEkC.exe
  C:\Windows\System\xgUMEkC.exe
  2⤵
  PID:272
- C:\Windows\System\gIcArWy.exe
  C:\Windows\System\gIcArWy.exe
  2⤵
  PID:648
- C:\Windows\System\DlgpJRr.exe
  C:\Windows\System\DlgpJRr.exe
  2⤵
  PID:2508
- C:\Windows\System\FXYKTKL.exe
  C:\Windows\System\FXYKTKL.exe
  2⤵
  PID:2224
- C:\Windows\System\qWhASbh.exe
  C:\Windows\System\qWhASbh.exe
  2⤵
  PID:2860
- C:\Windows\System\MkiXUJK.exe
  C:\Windows\System\MkiXUJK.exe
  2⤵
  PID:2764
- C:\Windows\System\YqhdZWs.exe
  C:\Windows\System\YqhdZWs.exe
  2⤵
  PID:2868
- C:\Windows\System\ijtzvDr.exe
  C:\Windows\System\ijtzvDr.exe
  2⤵
  PID:2876
- C:\Windows\System\KEEJsFE.exe
  C:\Windows\System\KEEJsFE.exe
  2⤵
  PID:2564
- C:\Windows\System\VREmtzS.exe
  C:\Windows\System\VREmtzS.exe
  2⤵
  PID:1256
- C:\Windows\System\cXjOIkq.exe
  C:\Windows\System\cXjOIkq.exe
  2⤵
  PID:3008
- C:\Windows\System\GxjqBTo.exe
  C:\Windows\System\GxjqBTo.exe
  2⤵
  PID:1900
- C:\Windows\System\aWZRVGN.exe
  C:\Windows\System\aWZRVGN.exe
  2⤵
  PID:2928
- C:\Windows\System\IpaWpYU.exe
  C:\Windows\System\IpaWpYU.exe
  2⤵
  PID:3284
- C:\Windows\System\YwDTSbi.exe
  C:\Windows\System\YwDTSbi.exe
  2⤵
  PID:3400
- C:\Windows\System\aeoiUlZ.exe
  C:\Windows\System\aeoiUlZ.exe
  2⤵
  PID:4000
- C:\Windows\System\UKWHNSx.exe
  C:\Windows\System\UKWHNSx.exe
  2⤵
  PID:3636
- C:\Windows\System\sQvcoYX.exe
  C:\Windows\System\sQvcoYX.exe
  2⤵
  PID:3696
- C:\Windows\System\ExkhuaR.exe
  C:\Windows\System\ExkhuaR.exe
  2⤵
  PID:3796
- C:\Windows\System\FyqfMBH.exe
  C:\Windows\System\FyqfMBH.exe
  2⤵
  PID:3860
- C:\Windows\System\QiLSGty.exe
  C:\Windows\System\QiLSGty.exe
  2⤵
  PID:3928
- C:\Windows\System\DYLDhwD.exe
  C:\Windows\System\DYLDhwD.exe
  2⤵
  PID:3992
- C:\Windows\System\LZnZRjC.exe
  C:\Windows\System\LZnZRjC.exe
  2⤵
  PID:4040
- C:\Windows\System\FVOhfUe.exe
  C:\Windows\System\FVOhfUe.exe
  2⤵
  PID:4056
- C:\Windows\System\aTNVXzW.exe
  C:\Windows\System\aTNVXzW.exe
  2⤵
  PID:4072
- C:\Windows\System\ERGlzVj.exe
  C:\Windows\System\ERGlzVj.exe
  2⤵
  PID:4092
- C:\Windows\System\rnnuFOY.exe
  C:\Windows\System\rnnuFOY.exe
  2⤵
  PID:3212
- C:\Windows\System\JzLWtNP.exe
  C:\Windows\System\JzLWtNP.exe
  2⤵
  PID:1656
- C:\Windows\System\IIVaTon.exe
  C:\Windows\System\IIVaTon.exe
  2⤵
  PID:2400
- C:\Windows\System\LFCyzQw.exe
  C:\Windows\System\LFCyzQw.exe
  2⤵
  PID:1844
- C:\Windows\System\RtuSzVZ.exe
  C:\Windows\System\RtuSzVZ.exe
  2⤵
  PID:2204
- C:\Windows\System\hFmdxUg.exe
  C:\Windows\System\hFmdxUg.exe
  2⤵
  PID:2132
- C:\Windows\System\vemsUeQ.exe
  C:\Windows\System\vemsUeQ.exe
  2⤵
  PID:2608
- C:\Windows\System\KeuwqMo.exe
  C:\Windows\System\KeuwqMo.exe
  2⤵
  PID:2804
- C:\Windows\System\VAiDAOC.exe
  C:\Windows\System\VAiDAOC.exe
  2⤵
  PID:1060
- C:\Windows\System\HSAXtrQ.exe
  C:\Windows\System\HSAXtrQ.exe
  2⤵
  PID:3300
- C:\Windows\System\SvmmDas.exe
  C:\Windows\System\SvmmDas.exe
  2⤵
  PID:3364
- C:\Windows\System\ZQmspgo.exe
  C:\Windows\System\ZQmspgo.exe
  2⤵
  PID:3452
- C:\Windows\System\cDMrdzq.exe
  C:\Windows\System\cDMrdzq.exe
  2⤵
  PID:3520
- C:\Windows\System\ZptMMUH.exe
  C:\Windows\System\ZptMMUH.exe
  2⤵
  PID:3584
- C:\Windows\System\RfESgNO.exe
  C:\Windows\System\RfESgNO.exe
  2⤵
  PID:3652
- C:\Windows\System\MGFNubN.exe
  C:\Windows\System\MGFNubN.exe
  2⤵
  PID:3716
- C:\Windows\System\eLxvxcI.exe
  C:\Windows\System\eLxvxcI.exe
  2⤵
  PID:3780
- C:\Windows\System\xenrvLt.exe
  C:\Windows\System\xenrvLt.exe
  2⤵
  PID:3848
- C:\Windows\System\bSUGhHd.exe
  C:\Windows\System\bSUGhHd.exe
  2⤵
  PID:3912
- C:\Windows\System\LTeQgKz.exe
  C:\Windows\System\LTeQgKz.exe
  2⤵
  PID:3976
- C:\Windows\System\bWvVyql.exe
  C:\Windows\System\bWvVyql.exe
  2⤵
  PID:1768
- C:\Windows\System\JfLoOnH.exe
  C:\Windows\System\JfLoOnH.exe
  2⤵
  PID:2252
- C:\Windows\System\kTzXtFA.exe
  C:\Windows\System\kTzXtFA.exe
  2⤵
  PID:3036
- C:\Windows\System\oAVnvey.exe
  C:\Windows\System\oAVnvey.exe
  2⤵
  PID:2684
- C:\Windows\System\GddqchI.exe
  C:\Windows\System\GddqchI.exe
  2⤵
  PID:2756
- C:\Windows\System\MoBKFSC.exe
  C:\Windows\System\MoBKFSC.exe
  2⤵
  PID:3404
- C:\Windows\System\oxTamdX.exe
  C:\Windows\System\oxTamdX.exe
  2⤵
  PID:3440
- C:\Windows\System\GXSYDsh.exe
  C:\Windows\System\GXSYDsh.exe
  2⤵
  PID:3536
- C:\Windows\System\bCHEdWS.exe
  C:\Windows\System\bCHEdWS.exe
  2⤵
  PID:3316
- C:\Windows\System\nirEHyZ.exe
  C:\Windows\System\nirEHyZ.exe
  2⤵
  PID:3568
- C:\Windows\System\UqeDSlC.exe
  C:\Windows\System\UqeDSlC.exe
  2⤵
  PID:3352
- C:\Windows\System\PIFcqRm.exe
  C:\Windows\System\PIFcqRm.exe
  2⤵
  PID:3392
- C:\Windows\System\WPeReUX.exe
  C:\Windows\System\WPeReUX.exe
  2⤵
  PID:4008
- C:\Windows\System\ZLjlIFd.exe
  C:\Windows\System\ZLjlIFd.exe
  2⤵
  PID:4080
- C:\Windows\System\qFoSqAZ.exe
  C:\Windows\System\qFoSqAZ.exe
  2⤵
  PID:2856
- C:\Windows\System\kIRGrJg.exe
  C:\Windows\System\kIRGrJg.exe
  2⤵
  PID:2796
- C:\Windows\System\kskOVvH.exe
  C:\Windows\System\kskOVvH.exe
  2⤵
  PID:888
- C:\Windows\System\aXyeMGd.exe
  C:\Windows\System\aXyeMGd.exe
  2⤵
  PID:3736
- C:\Windows\System\ejWtSuA.exe
  C:\Windows\System\ejWtSuA.exe
  2⤵
  PID:4036
- C:\Windows\System\oEYUXGO.exe
  C:\Windows\System\oEYUXGO.exe
  2⤵
  PID:2424
- C:\Windows\System\ifcfQPw.exe
  C:\Windows\System\ifcfQPw.exe
  2⤵
  PID:4024
- C:\Windows\System\GATABDG.exe
  C:\Windows\System\GATABDG.exe
  2⤵
  PID:3204
- C:\Windows\System\jGXpfrf.exe
  C:\Windows\System\jGXpfrf.exe
  2⤵
  PID:2396
- C:\Windows\System\yroGBHw.exe
  C:\Windows\System\yroGBHw.exe
  2⤵
  PID:2392
- C:\Windows\System\PTJknzz.exe
  C:\Windows\System\PTJknzz.exe
  2⤵
  PID:1700
- C:\Windows\System\ZVnUxGd.exe
  C:\Windows\System\ZVnUxGd.exe
  2⤵
  PID:1056
- C:\Windows\System\VnPRHmx.exe
  C:\Windows\System\VnPRHmx.exe
  2⤵
  PID:1872
- C:\Windows\System\roAmJtt.exe
  C:\Windows\System\roAmJtt.exe
  2⤵
  PID:2552
- C:\Windows\System\NFQHWzQ.exe
  C:\Windows\System\NFQHWzQ.exe
  2⤵
  PID:3424
- C:\Windows\System\eeeruin.exe
  C:\Windows\System\eeeruin.exe
  2⤵
  PID:568
- C:\Windows\System\bNgrGIl.exe
  C:\Windows\System\bNgrGIl.exe
  2⤵
  PID:3844
- C:\Windows\System\MkhwfQk.exe
  C:\Windows\System\MkhwfQk.exe
  2⤵
  PID:1984
- C:\Windows\System\BCoyOLk.exe
  C:\Windows\System\BCoyOLk.exe
  2⤵
  PID:1864
- C:\Windows\System\bUwgeHq.exe
  C:\Windows\System\bUwgeHq.exe
  2⤵
  PID:3472
- C:\Windows\System\GYAOCJp.exe
  C:\Windows\System\GYAOCJp.exe
  2⤵
  PID:3084
- C:\Windows\System\MNRyppX.exe
  C:\Windows\System\MNRyppX.exe
  2⤵
  PID:3348
- C:\Windows\System\QOsnmyg.exe
  C:\Windows\System\QOsnmyg.exe
  2⤵
  PID:3488
- C:\Windows\System\VmUIrQt.exe
  C:\Windows\System\VmUIrQt.exe
  2⤵
  PID:4052
- C:\Windows\System\EZSsBFX.exe
  C:\Windows\System\EZSsBFX.exe
  2⤵
  PID:3040
- C:\Windows\System\nkVrCeT.exe
  C:\Windows\System\nkVrCeT.exe
  2⤵
  PID:1652
- C:\Windows\System\MDPnkRU.exe
  C:\Windows\System\MDPnkRU.exe
  2⤵
  PID:3632
- C:\Windows\System\prqcYAg.exe
  C:\Windows\System\prqcYAg.exe
  2⤵
  PID:4068
- C:\Windows\System\ucooLmK.exe
  C:\Windows\System\ucooLmK.exe
  2⤵
  PID:3648
- C:\Windows\System\jKATCkg.exe
  C:\Windows\System\jKATCkg.exe
  2⤵
  PID:1520
- C:\Windows\System\KWfiaDD.exe
  C:\Windows\System\KWfiaDD.exe
  2⤵
  PID:1816
- C:\Windows\System\zejaKeZ.exe
  C:\Windows\System\zejaKeZ.exe
  2⤵
  PID:3948
- C:\Windows\System\RUWJJas.exe
  C:\Windows\System\RUWJJas.exe
  2⤵
  PID:3964
- C:\Windows\System\BRxalRo.exe
  C:\Windows\System\BRxalRo.exe
  2⤵
  PID:4064
- C:\Windows\System\wXXzGRx.exe
  C:\Windows\System\wXXzGRx.exe
  2⤵
  PID:3828
- C:\Windows\System\pnnTMnN.exe
  C:\Windows\System\pnnTMnN.exe
  2⤵
  PID:2572
- C:\Windows\System\wOliPfZ.exe
  C:\Windows\System\wOliPfZ.exe
  2⤵
  PID:3540
- C:\Windows\System\FFIugxb.exe
  C:\Windows\System\FFIugxb.exe
  2⤵
  PID:3264
- C:\Windows\System\FKcfJsV.exe
  C:\Windows\System\FKcfJsV.exe
  2⤵
  PID:3616
- C:\Windows\System\cOxJAiE.exe
  C:\Windows\System\cOxJAiE.exe
  2⤵
  PID:1824
- C:\Windows\System\nbXvwYv.exe
  C:\Windows\System\nbXvwYv.exe
  2⤵
  PID:688
- C:\Windows\System\zZtUUtR.exe
  C:\Windows\System\zZtUUtR.exe
  2⤵
  PID:820
- C:\Windows\System\FJTBqtd.exe
  C:\Windows\System\FJTBqtd.exe
  2⤵
  PID:3336
- C:\Windows\System\bagvVHE.exe
  C:\Windows\System\bagvVHE.exe
  2⤵
  PID:3816
- C:\Windows\System\GLeGynz.exe
  C:\Windows\System\GLeGynz.exe
  2⤵
  PID:3052
- C:\Windows\System\qWsoKrG.exe
  C:\Windows\System\qWsoKrG.exe
  2⤵
  PID:1800
- C:\Windows\System\rNqsLhj.exe
  C:\Windows\System\rNqsLhj.exe
  2⤵
  PID:2152
- C:\Windows\System\fsRzTDg.exe
  C:\Windows\System\fsRzTDg.exe
  2⤵
  PID:1232
- C:\Windows\System\actRIFB.exe
  C:\Windows\System\actRIFB.exe
  2⤵
  PID:1692
- C:\Windows\System\hasFRbk.exe
  C:\Windows\System\hasFRbk.exe
  2⤵
  PID:1752
- C:\Windows\System\ZLaxXdZ.exe
  C:\Windows\System\ZLaxXdZ.exe
  2⤵
  PID:1152
- C:\Windows\System\xHvdhcW.exe
  C:\Windows\System\xHvdhcW.exe
  2⤵
  PID:544
- C:\Windows\System\qvJPkLS.exe
  C:\Windows\System\qvJPkLS.exe
  2⤵
  PID:4012
- C:\Windows\System\ejVbHzl.exe
  C:\Windows\System\ejVbHzl.exe
  2⤵
  PID:1860
- C:\Windows\System\klDWOea.exe
  C:\Windows\System\klDWOea.exe
  2⤵
  PID:3436
- C:\Windows\System\wFvdycT.exe
  C:\Windows\System\wFvdycT.exe
  2⤵
  PID:548
- C:\Windows\System\XmegJzt.exe
  C:\Windows\System\XmegJzt.exe
  2⤵
  PID:1928
- C:\Windows\System\mpwNado.exe
  C:\Windows\System\mpwNado.exe
  2⤵
  PID:2732
- C:\Windows\System\LlKwDpk.exe
  C:\Windows\System\LlKwDpk.exe
  2⤵
  PID:348
- C:\Windows\System\NMlQern.exe
  C:\Windows\System\NMlQern.exe
  2⤵
  PID:2180
- C:\Windows\System\sXJpuVq.exe
  C:\Windows\System\sXJpuVq.exe
  2⤵
  PID:3556
- C:\Windows\System\Zmkjazg.exe
  C:\Windows\System\Zmkjazg.exe
  2⤵
  PID:2580
- C:\Windows\System\JfpZEGv.exe
  C:\Windows\System\JfpZEGv.exe
  2⤵
  PID:4112
- C:\Windows\System\aiebdzr.exe
  C:\Windows\System\aiebdzr.exe
  2⤵
  PID:4136
- C:\Windows\System\hYnfUPR.exe
  C:\Windows\System\hYnfUPR.exe
  2⤵
  PID:4152
- C:\Windows\System\sojdVov.exe
  C:\Windows\System\sojdVov.exe
  2⤵
  PID:4168
- C:\Windows\System\HtBcOvd.exe
  C:\Windows\System\HtBcOvd.exe
  2⤵
  PID:4184
- C:\Windows\System\mCfZNKb.exe
  C:\Windows\System\mCfZNKb.exe
  2⤵
  PID:4200
- C:\Windows\System\DdyLeDm.exe
  C:\Windows\System\DdyLeDm.exe
  2⤵
  PID:4216
- C:\Windows\System\AeBwPjb.exe
  C:\Windows\System\AeBwPjb.exe
  2⤵
  PID:4232
- C:\Windows\System\zJRwwpO.exe
  C:\Windows\System\zJRwwpO.exe
  2⤵
  PID:4248
- C:\Windows\System\fOhDWKg.exe
  C:\Windows\System\fOhDWKg.exe
  2⤵
  PID:4264
- C:\Windows\System\DkIiuzb.exe
  C:\Windows\System\DkIiuzb.exe
  2⤵
  PID:4280
- C:\Windows\System\lTkLSXv.exe
  C:\Windows\System\lTkLSXv.exe
  2⤵
  PID:4296
- C:\Windows\System\zijFsaf.exe
  C:\Windows\System\zijFsaf.exe
  2⤵
  PID:4312
- C:\Windows\System\IJpEEqt.exe
  C:\Windows\System\IJpEEqt.exe
  2⤵
  PID:4328
- C:\Windows\System\wLVPFyC.exe
  C:\Windows\System\wLVPFyC.exe
  2⤵
  PID:4344
- C:\Windows\System\FtnBCjb.exe
  C:\Windows\System\FtnBCjb.exe
  2⤵
  PID:4360
- C:\Windows\System\CBQcUuw.exe
  C:\Windows\System\CBQcUuw.exe
  2⤵
  PID:4376
- C:\Windows\System\rgTyuMd.exe
  C:\Windows\System\rgTyuMd.exe
  2⤵
  PID:4392
- C:\Windows\System\DLLszyw.exe
  C:\Windows\System\DLLszyw.exe
  2⤵
  PID:4408
- C:\Windows\System\AguXUaV.exe
  C:\Windows\System\AguXUaV.exe
  2⤵
  PID:4424
- C:\Windows\System\MZUKZdW.exe
  C:\Windows\System\MZUKZdW.exe
  2⤵
  PID:4440
- C:\Windows\System\besheSy.exe
  C:\Windows\System\besheSy.exe
  2⤵
  PID:4456
- C:\Windows\System\oLXiDGS.exe
  C:\Windows\System\oLXiDGS.exe
  2⤵
  PID:4472
- C:\Windows\System\wcgLkzh.exe
  C:\Windows\System\wcgLkzh.exe
  2⤵
  PID:4488
- C:\Windows\System\wKdgifZ.exe
  C:\Windows\System\wKdgifZ.exe
  2⤵
  PID:4504
- C:\Windows\System\pinnumY.exe
  C:\Windows\System\pinnumY.exe
  2⤵
  PID:4520
- C:\Windows\System\ejpGUZv.exe
  C:\Windows\System\ejpGUZv.exe
  2⤵
  PID:4536
- C:\Windows\System\TYsamns.exe
  C:\Windows\System\TYsamns.exe
  2⤵
  PID:4552
- C:\Windows\System\PbxHaOb.exe
  C:\Windows\System\PbxHaOb.exe
  2⤵
  PID:4568
- C:\Windows\System\bxhmRdJ.exe
  C:\Windows\System\bxhmRdJ.exe
  2⤵
  PID:4584
- C:\Windows\System\gAqpGbv.exe
  C:\Windows\System\gAqpGbv.exe
  2⤵
  PID:4600
- C:\Windows\System\RJXCOhv.exe
  C:\Windows\System\RJXCOhv.exe
  2⤵
  PID:4616
- C:\Windows\System\rkSSwck.exe
  C:\Windows\System\rkSSwck.exe
  2⤵
  PID:4632
- C:\Windows\System\vNkPHNn.exe
  C:\Windows\System\vNkPHNn.exe
  2⤵
  PID:4648
- C:\Windows\System\RiPAdWv.exe
  C:\Windows\System\RiPAdWv.exe
  2⤵
  PID:4664
- C:\Windows\System\omysThn.exe
  C:\Windows\System\omysThn.exe
  2⤵
  PID:4680
- C:\Windows\System\vzKJNYW.exe
  C:\Windows\System\vzKJNYW.exe
  2⤵
  PID:4696
- C:\Windows\System\EokmVpk.exe
  C:\Windows\System\EokmVpk.exe
  2⤵
  PID:4712
- C:\Windows\System\CculxLx.exe
  C:\Windows\System\CculxLx.exe
  2⤵
  PID:4728
- C:\Windows\System\SLjDzas.exe
  C:\Windows\System\SLjDzas.exe
  2⤵
  PID:4744
- C:\Windows\System\IfmmMWe.exe
  C:\Windows\System\IfmmMWe.exe
  2⤵
  PID:4760
- C:\Windows\System\yKQeidN.exe
  C:\Windows\System\yKQeidN.exe
  2⤵
  PID:4776
- C:\Windows\System\mjJYzKI.exe
  C:\Windows\System\mjJYzKI.exe
  2⤵
  PID:4792
- C:\Windows\System\nzOyqNW.exe
  C:\Windows\System\nzOyqNW.exe
  2⤵
  PID:4808
- C:\Windows\System\UMstrVp.exe
  C:\Windows\System\UMstrVp.exe
  2⤵
  PID:4824
- C:\Windows\System\TCAcLfj.exe
  C:\Windows\System\TCAcLfj.exe
  2⤵
  PID:4840
- C:\Windows\System\gDzTUtc.exe
  C:\Windows\System\gDzTUtc.exe
  2⤵
  PID:4856
- C:\Windows\System\XFAgIDU.exe
  C:\Windows\System\XFAgIDU.exe
  2⤵
  PID:4872
- C:\Windows\System\bnrQimM.exe
  C:\Windows\System\bnrQimM.exe
  2⤵
  PID:4888
- C:\Windows\System\TvVQXqf.exe
  C:\Windows\System\TvVQXqf.exe
  2⤵
  PID:4904
- C:\Windows\System\sNuMITu.exe
  C:\Windows\System\sNuMITu.exe
  2⤵
  PID:4920
- C:\Windows\System\xunTmaA.exe
  C:\Windows\System\xunTmaA.exe
  2⤵
  PID:4936
- C:\Windows\System\UROOTym.exe
  C:\Windows\System\UROOTym.exe
  2⤵
  PID:4952
- C:\Windows\System\NpHaxJi.exe
  C:\Windows\System\NpHaxJi.exe
  2⤵
  PID:4968
- C:\Windows\System\RxKcaEw.exe
  C:\Windows\System\RxKcaEw.exe
  2⤵
  PID:4984
- C:\Windows\System\rGmOMdj.exe
  C:\Windows\System\rGmOMdj.exe
  2⤵
  PID:5000
- C:\Windows\System\xFpxtju.exe
  C:\Windows\System\xFpxtju.exe
  2⤵
  PID:5016
- C:\Windows\System\FskkjNP.exe
  C:\Windows\System\FskkjNP.exe
  2⤵
  PID:5032
- C:\Windows\System\FxdZJpa.exe
  C:\Windows\System\FxdZJpa.exe
  2⤵
  PID:5048
- C:\Windows\System\bbFhfyT.exe
  C:\Windows\System\bbFhfyT.exe
  2⤵
  PID:5064
- C:\Windows\System\wRwDxXH.exe
  C:\Windows\System\wRwDxXH.exe
  2⤵
  PID:5080
- C:\Windows\System\NRXsKgm.exe
  C:\Windows\System\NRXsKgm.exe
  2⤵
  PID:5096
- C:\Windows\System\sIqIsQv.exe
  C:\Windows\System\sIqIsQv.exe
  2⤵
  PID:5112
- C:\Windows\System\LGeZTJw.exe
  C:\Windows\System\LGeZTJw.exe
  2⤵
  PID:2932
- C:\Windows\System\SWtRCSC.exe
  C:\Windows\System\SWtRCSC.exe
  2⤵
  PID:3768
- C:\Windows\System\AZeTlgx.exe
  C:\Windows\System\AZeTlgx.exe
  2⤵
  PID:4124
- C:\Windows\System\iGqcyGD.exe
  C:\Windows\System\iGqcyGD.exe
  2⤵
  PID:2916
- C:\Windows\System\ulLGTZz.exe
  C:\Windows\System\ulLGTZz.exe
  2⤵
  PID:4164
- C:\Windows\System\EbxyuNz.exe
  C:\Windows\System\EbxyuNz.exe
  2⤵
  PID:4228
- C:\Windows\System\AIUfmsb.exe
  C:\Windows\System\AIUfmsb.exe
  2⤵
  PID:4292
- C:\Windows\System\BlUACiV.exe
  C:\Windows\System\BlUACiV.exe
  2⤵
  PID:4356
- C:\Windows\System\rLWjQQL.exe
  C:\Windows\System\rLWjQQL.exe
  2⤵
  PID:4420
- C:\Windows\System\UJtJVcS.exe
  C:\Windows\System\UJtJVcS.exe
  2⤵
  PID:4484
- C:\Windows\System\ZROxijT.exe
  C:\Windows\System\ZROxijT.exe
  2⤵
  PID:4104
- C:\Windows\System\fVOqZUB.exe
  C:\Windows\System\fVOqZUB.exe
  2⤵
  PID:4548
- C:\Windows\System\FrzCRKK.exe
  C:\Windows\System\FrzCRKK.exe
  2⤵
  PID:4612
- C:\Windows\System\oQDQAHi.exe
  C:\Windows\System\oQDQAHi.exe
  2⤵
  PID:4676
- C:\Windows\System\usbAtXb.exe
  C:\Windows\System\usbAtXb.exe
  2⤵
  PID:4740
- C:\Windows\System\FDQvvAM.exe
  C:\Windows\System\FDQvvAM.exe
  2⤵
  PID:4804
- C:\Windows\System\lRmYUxe.exe
  C:\Windows\System\lRmYUxe.exe
  2⤵
  PID:4868
- C:\Windows\System\OXZckZO.exe
  C:\Windows\System\OXZckZO.exe
  2⤵
  PID:4932
- C:\Windows\System\GnWehIA.exe
  C:\Windows\System\GnWehIA.exe
  2⤵
  PID:3476
- C:\Windows\System\HfOAScw.exe
  C:\Windows\System\HfOAScw.exe
  2⤵
  PID:5028
- C:\Windows\System\WsUxUjK.exe
  C:\Windows\System\WsUxUjK.exe
  2⤵
  PID:5088
- C:\Windows\System\vRtlDuw.exe
  C:\Windows\System\vRtlDuw.exe
  2⤵
  PID:2100
- C:\Windows\System\PdgWmxz.exe
  C:\Windows\System\PdgWmxz.exe
  2⤵
  PID:1352
- C:\Windows\System\MbVQGea.exe
  C:\Windows\System\MbVQGea.exe
  2⤵
  PID:2308
- C:\Windows\System\KlHEAxK.exe
  C:\Windows\System\KlHEAxK.exe
  2⤵
  PID:2208
- C:\Windows\System\aVpdolA.exe
  C:\Windows\System\aVpdolA.exe
  2⤵
  PID:4212
- C:\Windows\System\jeVgIam.exe
  C:\Windows\System\jeVgIam.exe
  2⤵
  PID:4532
- C:\Windows\System\IHkTEqR.exe
  C:\Windows\System\IHkTEqR.exe
  2⤵
  PID:4416
- C:\Windows\System\RwKKVCZ.exe
  C:\Windows\System\RwKKVCZ.exe
  2⤵
  PID:4244
- C:\Windows\System\qPaovZp.exe
  C:\Windows\System\qPaovZp.exe
  2⤵
  PID:5072
- C:\Windows\System\NgtjczD.exe
  C:\Windows\System\NgtjczD.exe
  2⤵
  PID:5008
- C:\Windows\System\vivzYbz.exe
  C:\Windows\System\vivzYbz.exe
  2⤵
  PID:4944
- C:\Windows\System\OftkcZQ.exe
  C:\Windows\System\OftkcZQ.exe
  2⤵
  PID:4880
- C:\Windows\System\IMmJTxs.exe
  C:\Windows\System\IMmJTxs.exe
  2⤵
  PID:4816
- C:\Windows\System\DZoBnzl.exe
  C:\Windows\System\DZoBnzl.exe
  2⤵
  PID:4756
- C:\Windows\System\AnkOCpM.exe
  C:\Windows\System\AnkOCpM.exe
  2⤵
  PID:4688
- C:\Windows\System\IrWjoAr.exe
  C:\Windows\System\IrWjoAr.exe
  2⤵
  PID:4596
- C:\Windows\System\YizcfhK.exe
  C:\Windows\System\YizcfhK.exe
  2⤵
  PID:4528
- C:\Windows\System\OHRXrpV.exe
  C:\Windows\System\OHRXrpV.exe
  2⤵
  PID:4464
- C:\Windows\System\VBROaqS.exe
  C:\Windows\System\VBROaqS.exe
  2⤵
  PID:4400
- C:\Windows\System\CjmkfPK.exe
  C:\Windows\System\CjmkfPK.exe
  2⤵
  PID:4336
- C:\Windows\System\PmdZYdi.exe
  C:\Windows\System\PmdZYdi.exe
  2⤵
  PID:4272
- C:\Windows\System\JzxsAqe.exe
  C:\Windows\System\JzxsAqe.exe
  2⤵
  PID:4196
- C:\Windows\System\tNAsjRU.exe
  C:\Windows\System\tNAsjRU.exe
  2⤵
  PID:4544
- C:\Windows\System\smmKzXf.exe
  C:\Windows\System\smmKzXf.exe
  2⤵
  PID:4708
- C:\Windows\System\IbDmHAQ.exe
  C:\Windows\System\IbDmHAQ.exe
  2⤵
  PID:2980
- C:\Windows\System\vAUmGwo.exe
  C:\Windows\System\vAUmGwo.exe
  2⤵
  PID:4672
- C:\Windows\System\brJBZEZ.exe
  C:\Windows\System\brJBZEZ.exe
  2⤵
  PID:4928
- C:\Windows\System\HqTrvQh.exe
  C:\Windows\System\HqTrvQh.exe
  2⤵
  PID:4020
- C:\Windows\System\PeTwmsj.exe
  C:\Windows\System\PeTwmsj.exe
  2⤵
  PID:5060
- C:\Windows\System\kisTGcq.exe
  C:\Windows\System\kisTGcq.exe
  2⤵
  PID:3604
- C:\Windows\System\JNzWZGa.exe
  C:\Windows\System\JNzWZGa.exe
  2⤵
  PID:4016
- C:\Windows\System\pOFDCYh.exe
  C:\Windows\System\pOFDCYh.exe
  2⤵
  PID:2232
- C:\Windows\System\EjxFLqW.exe
  C:\Windows\System\EjxFLqW.exe
  2⤵
  PID:4208
- C:\Windows\System\wunbmmR.exe
  C:\Windows\System\wunbmmR.exe
  2⤵
  PID:5104
- C:\Windows\System\pjImLHz.exe
  C:\Windows\System\pjImLHz.exe
  2⤵
  PID:5012
- C:\Windows\System\zCTVyMy.exe
  C:\Windows\System\zCTVyMy.exe
  2⤵
  PID:2144
- C:\Windows\System\lzssZdk.exe
  C:\Windows\System\lzssZdk.exe
  2⤵
  PID:4564
- C:\Windows\System\rWnGmoY.exe
  C:\Windows\System\rWnGmoY.exe
  2⤵
  PID:4432
- C:\Windows\System\nnUWKNw.exe
  C:\Windows\System\nnUWKNw.exe
  2⤵
  PID:4784
- C:\Windows\System\teQhgcC.exe
  C:\Windows\System\teQhgcC.exe
  2⤵
  PID:4496
- C:\Windows\System\SpHXZMd.exe
  C:\Windows\System\SpHXZMd.exe
  2⤵
  PID:4108
- C:\Windows\System\IYNnzqM.exe
  C:\Windows\System\IYNnzqM.exe
  2⤵
  PID:4900
- C:\Windows\System\KWhpmFz.exe
  C:\Windows\System\KWhpmFz.exe
  2⤵
  PID:4288
- C:\Windows\System\QJpTFcK.exe
  C:\Windows\System\QJpTFcK.exe
  2⤵
  PID:1772
- C:\Windows\System\GHRQqaL.exe
  C:\Windows\System\GHRQqaL.exe
  2⤵
  PID:4304
- C:\Windows\System\TepMNrb.exe
  C:\Windows\System\TepMNrb.exe
  2⤵
  PID:5056
- C:\Windows\System\nWaYpbf.exe
  C:\Windows\System\nWaYpbf.exe
  2⤵
  PID:5132
- C:\Windows\System\trmIbFX.exe
  C:\Windows\System\trmIbFX.exe
  2⤵
  PID:5148
- C:\Windows\System\plzXmdC.exe
  C:\Windows\System\plzXmdC.exe
  2⤵
  PID:5164
- C:\Windows\System\qRtkFBl.exe
  C:\Windows\System\qRtkFBl.exe
  2⤵
  PID:5184
- C:\Windows\System\BNINhgv.exe
  C:\Windows\System\BNINhgv.exe
  2⤵
  PID:5200
- C:\Windows\System\BifazGp.exe
  C:\Windows\System\BifazGp.exe
  2⤵
  PID:5216
- C:\Windows\System\wXOyULN.exe
  C:\Windows\System\wXOyULN.exe
  2⤵
  PID:5232
- C:\Windows\System\VsYjhEW.exe
  C:\Windows\System\VsYjhEW.exe
  2⤵
  PID:5248
- C:\Windows\System\RkxqJVB.exe
  C:\Windows\System\RkxqJVB.exe
  2⤵
  PID:5264
- C:\Windows\System\TkDWsDx.exe
  C:\Windows\System\TkDWsDx.exe
  2⤵
  PID:5280
- C:\Windows\System\rAZsobm.exe
  C:\Windows\System\rAZsobm.exe
  2⤵
  PID:5296
- C:\Windows\System\AGhbGkP.exe
  C:\Windows\System\AGhbGkP.exe
  2⤵
  PID:5316
- C:\Windows\System\jEecrlt.exe
  C:\Windows\System\jEecrlt.exe
  2⤵
  PID:5332
- C:\Windows\System\pUibwsk.exe
  C:\Windows\System\pUibwsk.exe
  2⤵
  PID:5348
- C:\Windows\System\BQSAptG.exe
  C:\Windows\System\BQSAptG.exe
  2⤵
  PID:5364
- C:\Windows\System\paTzIzP.exe
  C:\Windows\System\paTzIzP.exe
  2⤵
  PID:5380
- C:\Windows\System\hiKxmwr.exe
  C:\Windows\System\hiKxmwr.exe
  2⤵
  PID:5396
- C:\Windows\System\FxBHzby.exe
  C:\Windows\System\FxBHzby.exe
  2⤵
  PID:5412
- C:\Windows\System\wlNcsVz.exe
  C:\Windows\System\wlNcsVz.exe
  2⤵
  PID:5428
- C:\Windows\System\BEdGEZT.exe
  C:\Windows\System\BEdGEZT.exe
  2⤵
  PID:5444
- C:\Windows\System\kDNfdBz.exe
  C:\Windows\System\kDNfdBz.exe
  2⤵
  PID:5460
- C:\Windows\System\cRyFEJw.exe
  C:\Windows\System\cRyFEJw.exe
  2⤵
  PID:5476
- C:\Windows\System\QquaqYt.exe
  C:\Windows\System\QquaqYt.exe
  2⤵
  PID:5492
- C:\Windows\System\NAVClJx.exe
  C:\Windows\System\NAVClJx.exe
  2⤵
  PID:5508
- C:\Windows\System\SeTgeos.exe
  C:\Windows\System\SeTgeos.exe
  2⤵
  PID:5524
- C:\Windows\System\YVWgUQK.exe
  C:\Windows\System\YVWgUQK.exe
  2⤵
  PID:5540
- C:\Windows\System\nfETvDk.exe
  C:\Windows\System\nfETvDk.exe
  2⤵
  PID:5556
- C:\Windows\System\GTdQQNs.exe
  C:\Windows\System\GTdQQNs.exe
  2⤵
  PID:5572
- C:\Windows\System\XQRmRmj.exe
  C:\Windows\System\XQRmRmj.exe
  2⤵
  PID:5588
- C:\Windows\System\HzQFTbP.exe
  C:\Windows\System\HzQFTbP.exe
  2⤵
  PID:5604
- C:\Windows\System\UHeQrLe.exe
  C:\Windows\System\UHeQrLe.exe
  2⤵
  PID:5632
- C:\Windows\System\FKGBiwT.exe
  C:\Windows\System\FKGBiwT.exe
  2⤵
  PID:5648
- C:\Windows\System\irmZUyk.exe
  C:\Windows\System\irmZUyk.exe
  2⤵
  PID:5668
- C:\Windows\System\BpjFwNX.exe
  C:\Windows\System\BpjFwNX.exe
  2⤵
  PID:5684
- C:\Windows\System\KHmKzhS.exe
  C:\Windows\System\KHmKzhS.exe
  2⤵
  PID:5700
- C:\Windows\System\DxOduRU.exe
  C:\Windows\System\DxOduRU.exe
  2⤵
  PID:5716
- C:\Windows\System\BouxHru.exe
  C:\Windows\System\BouxHru.exe
  2⤵
  PID:5732
- C:\Windows\System\yqxFMNT.exe
  C:\Windows\System\yqxFMNT.exe
  2⤵
  PID:5748
- C:\Windows\System\ccQoFFU.exe
  C:\Windows\System\ccQoFFU.exe
  2⤵
  PID:5764
- C:\Windows\System\xAtvVJe.exe
  C:\Windows\System\xAtvVJe.exe
  2⤵
  PID:5784
- C:\Windows\System\neGsMdZ.exe
  C:\Windows\System\neGsMdZ.exe
  2⤵
  PID:5800
- C:\Windows\System\amjXHgE.exe
  C:\Windows\System\amjXHgE.exe
  2⤵
  PID:5816
- C:\Windows\System\JrwCmyE.exe
  C:\Windows\System\JrwCmyE.exe
  2⤵
  PID:5832
- C:\Windows\System\duQriiE.exe
  C:\Windows\System\duQriiE.exe
  2⤵
  PID:5848
- C:\Windows\System\EVShxXX.exe
  C:\Windows\System\EVShxXX.exe
  2⤵
  PID:5960
- C:\Windows\System\mqrtXus.exe
  C:\Windows\System\mqrtXus.exe
  2⤵
  PID:5976
- C:\Windows\System\hlkEXGA.exe
  C:\Windows\System\hlkEXGA.exe
  2⤵
  PID:5992
- C:\Windows\System\utsrbEZ.exe
  C:\Windows\System\utsrbEZ.exe
  2⤵
  PID:6012
- C:\Windows\System\drBQLdk.exe
  C:\Windows\System\drBQLdk.exe
  2⤵
  PID:6028
- C:\Windows\System\KcRppZC.exe
  C:\Windows\System\KcRppZC.exe
  2⤵
  PID:6044
- C:\Windows\System\mhBWChy.exe
  C:\Windows\System\mhBWChy.exe
  2⤵
  PID:6140
- C:\Windows\System\CaIjZtK.exe
  C:\Windows\System\CaIjZtK.exe
  2⤵
  PID:4452
- C:\Windows\System\WFBqvFa.exe
  C:\Windows\System\WFBqvFa.exe
  2⤵
  PID:4992
- C:\Windows\System\KyEomPn.exe
  C:\Windows\System\KyEomPn.exe
  2⤵
  PID:4948
- C:\Windows\System\cbviLwo.exe
  C:\Windows\System\cbviLwo.exe
  2⤵
  PID:5224
- C:\Windows\System\SCrNAvN.exe
  C:\Windows\System\SCrNAvN.exe
  2⤵
  PID:5288
- C:\Windows\System\IzIjYxt.exe
  C:\Windows\System\IzIjYxt.exe
  2⤵
  PID:5356
- C:\Windows\System\xONUwCR.exe
  C:\Windows\System\xONUwCR.exe
  2⤵
  PID:5424
- C:\Windows\System\RqJoBXQ.exe
  C:\Windows\System\RqJoBXQ.exe
  2⤵
  PID:5488
- C:\Windows\System\XmvqdMk.exe
  C:\Windows\System\XmvqdMk.exe
  2⤵
  PID:1064
- C:\Windows\System\AgObPdA.exe
  C:\Windows\System\AgObPdA.exe
  2⤵
  PID:5620
- C:\Windows\System\QnDgwAX.exe
  C:\Windows\System\QnDgwAX.exe
  2⤵
  PID:5660
- C:\Windows\System\BAZOWGB.exe
  C:\Windows\System\BAZOWGB.exe
  2⤵
  PID:5760
- C:\Windows\System\rCeDfph.exe
  C:\Windows\System\rCeDfph.exe
  2⤵
  PID:5180
- C:\Windows\System\HZtIuXJ.exe
  C:\Windows\System\HZtIuXJ.exe
  2⤵
  PID:5312
- C:\Windows\System\cdSwDkX.exe
  C:\Windows\System\cdSwDkX.exe
  2⤵
  PID:5404
- C:\Windows\System\wQnZsFs.exe
  C:\Windows\System\wQnZsFs.exe
  2⤵
  PID:5532
- C:\Windows\System\CIfBYQF.exe
  C:\Windows\System\CIfBYQF.exe
  2⤵
  PID:5644
- C:\Windows\System\RKTJPZe.exe
  C:\Windows\System\RKTJPZe.exe
  2⤵
  PID:5792
- C:\Windows\System\mRkRiRJ.exe
  C:\Windows\System\mRkRiRJ.exe
  2⤵
  PID:5856
- C:\Windows\System\LRKKHbK.exe
  C:\Windows\System\LRKKHbK.exe
  2⤵
  PID:5888
- C:\Windows\System\Nrworaw.exe
  C:\Windows\System\Nrworaw.exe
  2⤵
  PID:5932
- C:\Windows\System\HuzqzTz.exe
  C:\Windows\System\HuzqzTz.exe
  2⤵
  PID:6040
- C:\Windows\System\CKyUKIs.exe
  C:\Windows\System\CKyUKIs.exe
  2⤵
  PID:6080
- C:\Windows\System\GMhGWiO.exe
  C:\Windows\System\GMhGWiO.exe
  2⤵
  PID:6096
- C:\Windows\System\UfbKppq.exe
  C:\Windows\System\UfbKppq.exe
  2⤵
  PID:4864
- C:\Windows\System\iJiznFa.exe
  C:\Windows\System\iJiznFa.exe
  2⤵
  PID:5124
- C:\Windows\System\YVylQgU.exe
  C:\Windows\System\YVylQgU.exe
  2⤵
  PID:5192
- C:\Windows\System\vEfcLys.exe
  C:\Windows\System\vEfcLys.exe
  2⤵
  PID:304
- C:\Windows\System\OSeTVcu.exe
  C:\Windows\System\OSeTVcu.exe
  2⤵
  PID:5324
- C:\Windows\System\PQxJXsU.exe
  C:\Windows\System\PQxJXsU.exe
  2⤵
  PID:5484
- C:\Windows\System\NSkAKZT.exe
  C:\Windows\System\NSkAKZT.exe
  2⤵
  PID:4180
- C:\Windows\System\eeeScrV.exe
  C:\Windows\System\eeeScrV.exe
  2⤵
  PID:5756
- C:\Windows\System\CZdmbJd.exe
  C:\Windows\System\CZdmbJd.exe
  2⤵
  PID:5436
- C:\Windows\System\mcmAumk.exe
  C:\Windows\System\mcmAumk.exe
  2⤵
  PID:5504
- C:\Windows\System\ZoFuOEg.exe
  C:\Windows\System\ZoFuOEg.exe
  2⤵
  PID:5656
- C:\Windows\System\Viemirw.exe
  C:\Windows\System\Viemirw.exe
  2⤵
  PID:5376
- C:\Windows\System\pSnuBCo.exe
  C:\Windows\System\pSnuBCo.exe
  2⤵
  PID:5600
- C:\Windows\System\Gkikdui.exe
  C:\Windows\System\Gkikdui.exe
  2⤵
  PID:5744
- C:\Windows\System\onEvxBf.exe
  C:\Windows\System\onEvxBf.exe
  2⤵
  PID:5864
- C:\Windows\System\RhxDXIT.exe
  C:\Windows\System\RhxDXIT.exe
  2⤵
  PID:5824
- C:\Windows\System\mkiBpwT.exe
  C:\Windows\System\mkiBpwT.exe
  2⤵
  PID:5900
- C:\Windows\System\RzRUmvI.exe
  C:\Windows\System\RzRUmvI.exe
  2⤵
  PID:5808
- C:\Windows\System\KSrHalN.exe
  C:\Windows\System\KSrHalN.exe
  2⤵
  PID:5840
- C:\Windows\System\bpaaEeF.exe
  C:\Windows\System\bpaaEeF.exe
  2⤵
  PID:5948
- C:\Windows\System\znlHATB.exe
  C:\Windows\System\znlHATB.exe
  2⤵
  PID:6020
- C:\Windows\System\slPCHHN.exe
  C:\Windows\System\slPCHHN.exe
  2⤵
  PID:6056
- C:\Windows\System\jUzPHRP.exe
  C:\Windows\System\jUzPHRP.exe
  2⤵
  PID:6088
- C:\Windows\System\BYvUfQH.exe
  C:\Windows\System\BYvUfQH.exe
  2⤵
  PID:6128
- C:\Windows\System\viIabeZ.exe
  C:\Windows\System\viIabeZ.exe
  2⤵
  PID:4628
- C:\Windows\System\eLBtKfT.exe
  C:\Windows\System\eLBtKfT.exe
  2⤵
  PID:4692
- C:\Windows\System\pDEiage.exe
  C:\Windows\System\pDEiage.exe
  2⤵
  PID:5420
- C:\Windows\System\FVeyLNn.exe
  C:\Windows\System\FVeyLNn.exe
  2⤵
  PID:4388
- C:\Windows\System\mumpsvD.exe
  C:\Windows\System\mumpsvD.exe
  2⤵
  PID:5548
- C:\Windows\System\wZYkGxo.exe
  C:\Windows\System\wZYkGxo.exe
  2⤵
  PID:4608
- C:\Windows\System\VerJrHt.exe
  C:\Windows\System\VerJrHt.exe
  2⤵
  PID:4912
- C:\Windows\System\zPnGoik.exe
  C:\Windows\System\zPnGoik.exe
  2⤵
  PID:5440
- C:\Windows\System\vtRcPcN.exe
  C:\Windows\System\vtRcPcN.exe
  2⤵
  PID:5708
- C:\Windows\System\RSNDwEY.exe
  C:\Windows\System\RSNDwEY.exe
  2⤵
  PID:5928
- C:\Windows\System\BQjLkcZ.exe
  C:\Windows\System\BQjLkcZ.exe
  2⤵
  PID:5872
- C:\Windows\System\rmFnKFr.exe
  C:\Windows\System\rmFnKFr.exe
  2⤵
  PID:6100
- C:\Windows\System\NGySsXI.exe
  C:\Windows\System\NGySsXI.exe
  2⤵
  PID:6152
- C:\Windows\System\IUaqDSP.exe
  C:\Windows\System\IUaqDSP.exe
  2⤵
  PID:6168
- C:\Windows\System\pVXgHVb.exe
  C:\Windows\System\pVXgHVb.exe
  2⤵
  PID:6188
- C:\Windows\System\okYgnuz.exe
  C:\Windows\System\okYgnuz.exe
  2⤵
  PID:6204
- C:\Windows\System\zssbkLd.exe
  C:\Windows\System\zssbkLd.exe
  2⤵
  PID:6220
- C:\Windows\System\pEgULZt.exe
  C:\Windows\System\pEgULZt.exe
  2⤵
  PID:6236
- C:\Windows\System\NAxWCbr.exe
  C:\Windows\System\NAxWCbr.exe
  2⤵
  PID:6252
- C:\Windows\System\vmZAxDO.exe
  C:\Windows\System\vmZAxDO.exe
  2⤵
  PID:6268
- C:\Windows\System\feaRKHG.exe
  C:\Windows\System\feaRKHG.exe
  2⤵
  PID:6288
- C:\Windows\System\smnQklo.exe
  C:\Windows\System\smnQklo.exe
  2⤵
  PID:6304
- C:\Windows\System\BSAQnaY.exe
  C:\Windows\System\BSAQnaY.exe
  2⤵
  PID:6320
- C:\Windows\System\izRvYpD.exe
  C:\Windows\System\izRvYpD.exe
  2⤵
  PID:6336
- C:\Windows\System\BeRlhIe.exe
  C:\Windows\System\BeRlhIe.exe
  2⤵
  PID:6356
- C:\Windows\System\YzWYjYY.exe
  C:\Windows\System\YzWYjYY.exe
  2⤵
  PID:6372
- C:\Windows\System\zbKJRAN.exe
  C:\Windows\System\zbKJRAN.exe
  2⤵
  PID:6392
- C:\Windows\System\ACxckUi.exe
  C:\Windows\System\ACxckUi.exe
  2⤵
  PID:6408
- C:\Windows\System\hMVgVVH.exe
  C:\Windows\System\hMVgVVH.exe
  2⤵
  PID:6448
- C:\Windows\System\iftUItW.exe
  C:\Windows\System\iftUItW.exe
  2⤵
  PID:6468
- C:\Windows\System\hQxiWdL.exe
  C:\Windows\System\hQxiWdL.exe
  2⤵
  PID:6484
- C:\Windows\System\rvewhrP.exe
  C:\Windows\System\rvewhrP.exe
  2⤵
  PID:6500
- C:\Windows\System\myMWxzk.exe
  C:\Windows\System\myMWxzk.exe
  2⤵
  PID:6520
- C:\Windows\System\jPzmoot.exe
  C:\Windows\System\jPzmoot.exe
  2⤵
  PID:6536
- C:\Windows\System\iddbfkn.exe
  C:\Windows\System\iddbfkn.exe
  2⤵
  PID:6552
- C:\Windows\System\NxbSMrB.exe
  C:\Windows\System\NxbSMrB.exe
  2⤵
  PID:6568
- C:\Windows\System\bwXCsIA.exe
  C:\Windows\System\bwXCsIA.exe
  2⤵
  PID:6588
- C:\Windows\System\DvVNZGU.exe
  C:\Windows\System\DvVNZGU.exe
  2⤵
  PID:6604
- C:\Windows\System\FYSXWqr.exe
  C:\Windows\System\FYSXWqr.exe
  2⤵
  PID:6620
- C:\Windows\System\HRPCQIW.exe
  C:\Windows\System\HRPCQIW.exe
  2⤵
  PID:6636
- C:\Windows\System\EmdRsMa.exe
  C:\Windows\System\EmdRsMa.exe
  2⤵
  PID:6652
- C:\Windows\System\SUgEhXU.exe
  C:\Windows\System\SUgEhXU.exe
  2⤵
  PID:6672
- C:\Windows\System\NZqjSxm.exe
  C:\Windows\System\NZqjSxm.exe
  2⤵
  PID:6688
- C:\Windows\System\hjMrKbB.exe
  C:\Windows\System\hjMrKbB.exe
  2⤵
  PID:6704
- C:\Windows\System\nnEENAK.exe
  C:\Windows\System\nnEENAK.exe
  2⤵
  PID:6724
- C:\Windows\System\ckpwsor.exe
  C:\Windows\System\ckpwsor.exe
  2⤵
  PID:6744
- C:\Windows\System\eACyHyE.exe
  C:\Windows\System\eACyHyE.exe
  2⤵
  PID:6768
- C:\Windows\System\hwSlvUw.exe
  C:\Windows\System\hwSlvUw.exe
  2⤵
  PID:6784
- C:\Windows\System\fwqSvjB.exe
  C:\Windows\System\fwqSvjB.exe
  2⤵
  PID:6800
- C:\Windows\System\VOyyHSt.exe
  C:\Windows\System\VOyyHSt.exe
  2⤵
  PID:6816
- C:\Windows\System\pOkqdJL.exe
  C:\Windows\System\pOkqdJL.exe
  2⤵
  PID:6832
- C:\Windows\System\Ntjmrqi.exe
  C:\Windows\System\Ntjmrqi.exe
  2⤵
  PID:6852
- C:\Windows\System\CkbLcOz.exe
  C:\Windows\System\CkbLcOz.exe
  2⤵
  PID:6872
- C:\Windows\System\lpWVhhe.exe
  C:\Windows\System\lpWVhhe.exe
  2⤵
  PID:6888
- C:\Windows\System\BGogCdd.exe
  C:\Windows\System\BGogCdd.exe
  2⤵
  PID:6904
- C:\Windows\System\MfANNbK.exe
  C:\Windows\System\MfANNbK.exe
  2⤵
  PID:6920
- C:\Windows\System\ikuSLnk.exe
  C:\Windows\System\ikuSLnk.exe
  2⤵
  PID:6936
- C:\Windows\System\fmovVzZ.exe
  C:\Windows\System\fmovVzZ.exe
  2⤵
  PID:6952
- C:\Windows\System\tLSLPPt.exe
  C:\Windows\System\tLSLPPt.exe
  2⤵
  PID:6968
- C:\Windows\System\NVqomSX.exe
  C:\Windows\System\NVqomSX.exe
  2⤵
  PID:6984
- C:\Windows\System\DtbedUT.exe
  C:\Windows\System\DtbedUT.exe
  2⤵
  PID:7000
- C:\Windows\System\AKhcgEg.exe
  C:\Windows\System\AKhcgEg.exe
  2⤵
  PID:7016
- C:\Windows\System\CfQUSvf.exe
  C:\Windows\System\CfQUSvf.exe
  2⤵
  PID:7032
- C:\Windows\System\KabFeNc.exe
  C:\Windows\System\KabFeNc.exe
  2⤵
  PID:7048
- C:\Windows\System\TFFDEnd.exe
  C:\Windows\System\TFFDEnd.exe
  2⤵
  PID:7064
- C:\Windows\System\EWPftJk.exe
  C:\Windows\System\EWPftJk.exe
  2⤵
  PID:7100
- C:\Windows\System\mfbaGAL.exe
  C:\Windows\System\mfbaGAL.exe
  2⤵
  PID:7116
- C:\Windows\System\pwpAqeR.exe
  C:\Windows\System\pwpAqeR.exe
  2⤵
  PID:7132
- C:\Windows\System\IFWzfUV.exe
  C:\Windows\System\IFWzfUV.exe
  2⤵
  PID:7152
- C:\Windows\System\kvbLNOe.exe
  C:\Windows\System\kvbLNOe.exe
  2⤵
  PID:5360
- C:\Windows\System\uyMKBBz.exe
  C:\Windows\System\uyMKBBz.exe
  2⤵
  PID:4884
- C:\Windows\System\OkFxBxk.exe
  C:\Windows\System\OkFxBxk.exe
  2⤵
  PID:6404
- C:\Windows\System\UMRQNmd.exe
  C:\Windows\System\UMRQNmd.exe
  2⤵
  PID:6300
- C:\Windows\System\cZmeOfC.exe
  C:\Windows\System\cZmeOfC.exe
  2⤵
  PID:6736
- C:\Windows\System\WerJWns.exe
  C:\Windows\System\WerJWns.exe
  2⤵
  PID:6084
- C:\Windows\System\IGfKmhp.exe
  C:\Windows\System\IGfKmhp.exe
  2⤵
  PID:4580
- C:\Windows\System\pLrlown.exe
  C:\Windows\System\pLrlown.exe
  2⤵
  PID:5844
- C:\Windows\System\KssLneJ.exe
  C:\Windows\System\KssLneJ.exe
  2⤵
  PID:6216
- C:\Windows\System\JgMlUPY.exe
  C:\Windows\System\JgMlUPY.exe
  2⤵
  PID:6284
- C:\Windows\System\QENMEqo.exe
  C:\Windows\System\QENMEqo.exe
  2⤵
  PID:6380
- C:\Windows\System\jpVvlDm.exe
  C:\Windows\System\jpVvlDm.exe
  2⤵
  PID:6428
- C:\Windows\System\wwlHtIo.exe
  C:\Windows\System\wwlHtIo.exe
  2⤵
  PID:6848
- C:\Windows\System\ChSMMoV.exe
  C:\Windows\System\ChSMMoV.exe
  2⤵
  PID:6440
- C:\Windows\System\wYMGcbb.exe
  C:\Windows\System\wYMGcbb.exe
  2⤵
  PID:6516
- C:\Windows\System\oPLQavr.exe
  C:\Windows\System\oPLQavr.exe
  2⤵
  PID:7040
- C:\Windows\System\fQqAwOB.exe
  C:\Windows\System\fQqAwOB.exe
  2⤵
  PID:7084
- C:\Windows\System\nyBSmpE.exe
  C:\Windows\System\nyBSmpE.exe
  2⤵
  PID:7128
- C:\Windows\System\vuHMCVC.exe
  C:\Windows\System\vuHMCVC.exe
  2⤵
  PID:6508
- C:\Windows\System\JlIHhra.exe
  C:\Windows\System\JlIHhra.exe
  2⤵
  PID:6612
- C:\Windows\System\dTLJKtl.exe
  C:\Windows\System\dTLJKtl.exe
  2⤵
  PID:7164
- C:\Windows\System\ZCdaylW.exe
  C:\Windows\System\ZCdaylW.exe
  2⤵
  PID:6264
- C:\Windows\System\acRSnpJ.exe
  C:\Windows\System\acRSnpJ.exe
  2⤵
  PID:6260
- C:\Windows\System\jSqeyYG.exe
  C:\Windows\System\jSqeyYG.exe
  2⤵
  PID:6824
- C:\Windows\System\wXUjfLE.exe
  C:\Windows\System\wXUjfLE.exe
  2⤵
  PID:6868
- C:\Windows\System\zcWFsZz.exe
  C:\Windows\System\zcWFsZz.exe
  2⤵
  PID:6928
- C:\Windows\System\wDyCazy.exe
  C:\Windows\System\wDyCazy.exe
  2⤵
  PID:6160
- C:\Windows\System\hHCnbat.exe
  C:\Windows\System\hHCnbat.exe
  2⤵
  PID:5584
- C:\Windows\System\eZOtcqY.exe
  C:\Windows\System\eZOtcqY.exe
  2⤵
  PID:6060
- C:\Windows\System\dRilFAL.exe
  C:\Windows\System\dRilFAL.exe
  2⤵
  PID:5968
- C:\Windows\System\XHcaeNm.exe
  C:\Windows\System\XHcaeNm.exe
  2⤵
  PID:6416
- C:\Windows\System\alTeRoX.exe
  C:\Windows\System\alTeRoX.exe
  2⤵
  PID:1728
- C:\Windows\System\jywwNBi.exe
  C:\Windows\System\jywwNBi.exe
  2⤵
  PID:6176
- C:\Windows\System\unlRSsT.exe
  C:\Windows\System\unlRSsT.exe
  2⤵
  PID:4340
- C:\Windows\System\waorZUm.exe
  C:\Windows\System\waorZUm.exe
  2⤵
  PID:2944
- C:\Windows\System\yvsDxrt.exe
  C:\Windows\System\yvsDxrt.exe
  2⤵
  PID:6460
- C:\Windows\System\fSESvcm.exe
  C:\Windows\System\fSESvcm.exe
  2⤵
  PID:5692
- C:\Windows\System\GjWZRSv.exe
  C:\Windows\System\GjWZRSv.exe
  2⤵
  PID:5680
- C:\Windows\System\VMBiKRn.exe
  C:\Windows\System\VMBiKRn.exe
  2⤵
  PID:6000
- C:\Windows\System\CgEmtHJ.exe
  C:\Windows\System\CgEmtHJ.exe
  2⤵
  PID:6388
- C:\Windows\System\DTxbsdQ.exe
  C:\Windows\System\DTxbsdQ.exe
  2⤵
  PID:6576
- C:\Windows\System\wDlZQVK.exe
  C:\Windows\System\wDlZQVK.exe
  2⤵
  PID:6960
- C:\Windows\System\JKUqWfz.exe
  C:\Windows\System\JKUqWfz.exe
  2⤵
  PID:6996
- C:\Windows\System\bfeCtof.exe
  C:\Windows\System\bfeCtof.exe
  2⤵
  PID:5196
- C:\Windows\System\FsFejVy.exe
  C:\Windows\System\FsFejVy.exe
  2⤵
  PID:6212
- C:\Windows\System\oCbuClw.exe
  C:\Windows\System\oCbuClw.exe
  2⤵
  PID:6844
- C:\Windows\System\cakhxzZ.exe
  C:\Windows\System\cakhxzZ.exe
  2⤵
  PID:7112
- C:\Windows\System\EXdaupG.exe
  C:\Windows\System\EXdaupG.exe
  2⤵
  PID:6712
- C:\Windows\System\IYRgmQY.exe
  C:\Windows\System\IYRgmQY.exe
  2⤵
  PID:6948
- C:\Windows\System\rtjOCDG.exe
  C:\Windows\System\rtjOCDG.exe
  2⤵
  PID:7012
- C:\Windows\System\YRVZDtF.exe
  C:\Windows\System\YRVZDtF.exe
  2⤵
  PID:7092
- C:\Windows\System\YquOWMT.exe
  C:\Windows\System\YquOWMT.exe
  2⤵
  PID:7080
- C:\Windows\System\bSkjMSR.exe
  C:\Windows\System\bSkjMSR.exe
  2⤵
  PID:6680
- C:\Windows\System\nzVwyjy.exe
  C:\Windows\System\nzVwyjy.exe
  2⤵
  PID:6796
- C:\Windows\System\ifuuaWX.exe
  C:\Windows\System\ifuuaWX.exe
  2⤵
  PID:6860
- C:\Windows\System\QTUHSNe.exe
  C:\Windows\System\QTUHSNe.exe
  2⤵
  PID:6196
- C:\Windows\System\MBLZRza.exe
  C:\Windows\System\MBLZRza.exe
  2⤵
  PID:6328
- C:\Windows\System\nTkOfJz.exe
  C:\Windows\System\nTkOfJz.exe
  2⤵
  PID:5972
- C:\Windows\System\TYYPJlV.exe
  C:\Windows\System\TYYPJlV.exe
  2⤵
  PID:6108
- C:\Windows\System\VbfXLhP.exe
  C:\Windows\System\VbfXLhP.exe
  2⤵
  PID:5140
- C:\Windows\System\ELPfLyJ.exe
  C:\Windows\System\ELPfLyJ.exe
  2⤵
  PID:6492
- C:\Windows\System\feyNqIP.exe
  C:\Windows\System\feyNqIP.exe
  2⤵
  PID:6532
- C:\Windows\System\USINWPV.exe
  C:\Windows\System\USINWPV.exe
  2⤵
  PID:6600
- C:\Windows\System\ccPQBgu.exe
  C:\Windows\System\ccPQBgu.exe
  2⤵
  PID:6660
- C:\Windows\System\HIRFxER.exe
  C:\Windows\System\HIRFxER.exe
  2⤵
  PID:6912
- C:\Windows\System\bTcEvKI.exe
  C:\Windows\System\bTcEvKI.exe
  2⤵
  PID:6352
- C:\Windows\System\CWslWuQ.exe
  C:\Windows\System\CWslWuQ.exe
  2⤵
  PID:7108
- C:\Windows\System\NxtgcpK.exe
  C:\Windows\System\NxtgcpK.exe
  2⤵
  PID:6944
- C:\Windows\System\gcVbUxM.exe
  C:\Windows\System\gcVbUxM.exe
  2⤵
  PID:7008
- C:\Windows\System\TRDCJia.exe
  C:\Windows\System\TRDCJia.exe
  2⤵
  PID:6228
- C:\Windows\System\gYENSVE.exe
  C:\Windows\System\gYENSVE.exe
  2⤵
  PID:6864
- C:\Windows\System\SIGbAgj.exe
  C:\Windows\System\SIGbAgj.exe
  2⤵
  PID:6116
- C:\Windows\System\cKGMlsu.exe
  C:\Windows\System\cKGMlsu.exe
  2⤵
  PID:4996
- C:\Windows\System\VfebYkp.exe
  C:\Windows\System\VfebYkp.exe
  2⤵
  PID:6632
- C:\Windows\System\cxEisld.exe
  C:\Windows\System\cxEisld.exe
  2⤵
  PID:5628
- C:\Windows\System\aJCOPHl.exe
  C:\Windows\System\aJCOPHl.exe
  2⤵
  PID:6780
- C:\Windows\System\FdAQTeH.exe
  C:\Windows\System\FdAQTeH.exe
  2⤵
  PID:5276
- C:\Windows\System\fkrqfhs.exe
  C:\Windows\System\fkrqfhs.exe
  2⤵
  PID:6668
- C:\Windows\System\tlPHVId.exe
  C:\Windows\System\tlPHVId.exe
  2⤵
  PID:6732
- C:\Windows\System\bsDQaJs.exe
  C:\Windows\System\bsDQaJs.exe
  2⤵
  PID:6280
- C:\Windows\System\pUGDuMg.exe
  C:\Windows\System\pUGDuMg.exe
  2⤵
  PID:6148
- C:\Windows\System\RoBxraH.exe
  C:\Windows\System\RoBxraH.exe
  2⤵
  PID:7024
- C:\Windows\System\axLfPUl.exe
  C:\Windows\System\axLfPUl.exe
  2⤵
  PID:6648
- C:\Windows\System\tLOVzYg.exe
  C:\Windows\System\tLOVzYg.exe
  2⤵
  PID:6580
- C:\Windows\System\XLTlIZO.exe
  C:\Windows\System\XLTlIZO.exe
  2⤵
  PID:6456
- C:\Windows\System\KkACNnt.exe
  C:\Windows\System\KkACNnt.exe
  2⤵
  PID:6368
- C:\Windows\System\DEKsHoG.exe
  C:\Windows\System\DEKsHoG.exe
  2⤵
  PID:7180
- C:\Windows\System\DRxKOaM.exe
  C:\Windows\System\DRxKOaM.exe
  2⤵
  PID:7196
- C:\Windows\System\pGEurJx.exe
  C:\Windows\System\pGEurJx.exe
  2⤵
  PID:7216
- C:\Windows\System\uQESlnf.exe
  C:\Windows\System\uQESlnf.exe
  2⤵
  PID:7232
- C:\Windows\System\CwdJeOR.exe
  C:\Windows\System\CwdJeOR.exe
  2⤵
  PID:7248
- C:\Windows\System\PmEXGHf.exe
  C:\Windows\System\PmEXGHf.exe
  2⤵
  PID:7268
- C:\Windows\System\eIuJMuH.exe
  C:\Windows\System\eIuJMuH.exe
  2⤵
  PID:7288
- C:\Windows\System\ErLWIsm.exe
  C:\Windows\System\ErLWIsm.exe
  2⤵
  PID:7304
- C:\Windows\System\bYBJIGx.exe
  C:\Windows\System\bYBJIGx.exe
  2⤵
  PID:7320
- C:\Windows\System\aWiHUXC.exe
  C:\Windows\System\aWiHUXC.exe
  2⤵
  PID:7340
- C:\Windows\System\mwuDuVj.exe
  C:\Windows\System\mwuDuVj.exe
  2⤵
  PID:7356
- C:\Windows\System\IvabqYO.exe
  C:\Windows\System\IvabqYO.exe
  2⤵
  PID:7372
- C:\Windows\System\nwuWsrG.exe
  C:\Windows\System\nwuWsrG.exe
  2⤵
  PID:7388
- C:\Windows\System\YUWZfqB.exe
  C:\Windows\System\YUWZfqB.exe
  2⤵
  PID:7404
- C:\Windows\System\WOimcfY.exe
  C:\Windows\System\WOimcfY.exe
  2⤵
  PID:7420
- C:\Windows\System\jwCOpoB.exe
  C:\Windows\System\jwCOpoB.exe
  2⤵
  PID:7436
- C:\Windows\System\lbfEvkU.exe
  C:\Windows\System\lbfEvkU.exe
  2⤵
  PID:7468
- C:\Windows\System\CaVjYsp.exe
  C:\Windows\System\CaVjYsp.exe
  2⤵
  PID:7484
- C:\Windows\System\KNwGgPv.exe
  C:\Windows\System\KNwGgPv.exe
  2⤵
  PID:7500
- C:\Windows\System\wfOCgnf.exe
  C:\Windows\System\wfOCgnf.exe
  2⤵
  PID:7516
- C:\Windows\System\mFwEPNu.exe
  C:\Windows\System\mFwEPNu.exe
  2⤵
  PID:7532
- C:\Windows\System\CkTBDDn.exe
  C:\Windows\System\CkTBDDn.exe
  2⤵
  PID:7548
- C:\Windows\System\nKRwDOT.exe
  C:\Windows\System\nKRwDOT.exe
  2⤵
  PID:7564
- C:\Windows\System\OAKZffP.exe
  C:\Windows\System\OAKZffP.exe
  2⤵
  PID:7580
- C:\Windows\System\KCawQIr.exe
  C:\Windows\System\KCawQIr.exe
  2⤵
  PID:7596
- C:\Windows\System\cXZvLjq.exe
  C:\Windows\System\cXZvLjq.exe
  2⤵
  PID:7612
- C:\Windows\System\RhxQQRB.exe
  C:\Windows\System\RhxQQRB.exe
  2⤵
  PID:7628
- C:\Windows\System\mIPWRfE.exe
  C:\Windows\System\mIPWRfE.exe
  2⤵
  PID:7644
- C:\Windows\System\RgcObpU.exe
  C:\Windows\System\RgcObpU.exe
  2⤵
  PID:7660
- C:\Windows\System\mDPOKcg.exe
  C:\Windows\System\mDPOKcg.exe
  2⤵
  PID:7676
- C:\Windows\System\bLzCari.exe
  C:\Windows\System\bLzCari.exe
  2⤵
  PID:7692
- C:\Windows\System\QKsktCC.exe
  C:\Windows\System\QKsktCC.exe
  2⤵
  PID:7708
- C:\Windows\System\DhHTWHl.exe
  C:\Windows\System\DhHTWHl.exe
  2⤵
  PID:7724
- C:\Windows\System\PuuShQA.exe
  C:\Windows\System\PuuShQA.exe
  2⤵
  PID:7740
- C:\Windows\System\jgxdXKe.exe
  C:\Windows\System\jgxdXKe.exe
  2⤵
  PID:7756
- C:\Windows\System\pLutgoH.exe
  C:\Windows\System\pLutgoH.exe
  2⤵
  PID:7772
- C:\Windows\System\mvkXOPa.exe
  C:\Windows\System\mvkXOPa.exe
  2⤵
  PID:7788
- C:\Windows\System\PkpTyTC.exe
  C:\Windows\System\PkpTyTC.exe
  2⤵
  PID:7804
- C:\Windows\System\ocEQMSe.exe
  C:\Windows\System\ocEQMSe.exe
  2⤵
  PID:7820
- C:\Windows\System\LzVFccE.exe
  C:\Windows\System\LzVFccE.exe
  2⤵
  PID:7836
- C:\Windows\System\iyrCQRw.exe
  C:\Windows\System\iyrCQRw.exe
  2⤵
  PID:7852
- C:\Windows\System\sovKSun.exe
  C:\Windows\System\sovKSun.exe
  2⤵
  PID:7868
- C:\Windows\System\WTUAHuD.exe
  C:\Windows\System\WTUAHuD.exe
  2⤵
  PID:7884
- C:\Windows\System\qJWPbhK.exe
  C:\Windows\System\qJWPbhK.exe
  2⤵
  PID:7900
- C:\Windows\System\wUiDZSI.exe
  C:\Windows\System\wUiDZSI.exe
  2⤵
  PID:7916
- C:\Windows\System\YsecVpW.exe
  C:\Windows\System\YsecVpW.exe
  2⤵
  PID:7932
- C:\Windows\System\RUrWEaC.exe
  C:\Windows\System\RUrWEaC.exe
  2⤵
  PID:7948
- C:\Windows\System\CcDjieZ.exe
  C:\Windows\System\CcDjieZ.exe
  2⤵
  PID:7964
- C:\Windows\System\PxRzQqW.exe
  C:\Windows\System\PxRzQqW.exe
  2⤵
  PID:7980
- C:\Windows\System\pfOiKXT.exe
  C:\Windows\System\pfOiKXT.exe
  2⤵
  PID:7996
- C:\Windows\System\EPkpMuE.exe
  C:\Windows\System\EPkpMuE.exe
  2⤵
  PID:8012
- C:\Windows\System\TmCbPTr.exe
  C:\Windows\System\TmCbPTr.exe
  2⤵
  PID:8028
- C:\Windows\System\CKlNTaO.exe
  C:\Windows\System\CKlNTaO.exe
  2⤵
  PID:8048
- C:\Windows\System\pvbFuQi.exe
  C:\Windows\System\pvbFuQi.exe
  2⤵
  PID:8064
- C:\Windows\System\DKqLPbq.exe
  C:\Windows\System\DKqLPbq.exe
  2⤵
  PID:8084
- C:\Windows\System\zKBbDrC.exe
  C:\Windows\System\zKBbDrC.exe
  2⤵
  PID:8100
- C:\Windows\System\hIDQfZi.exe
  C:\Windows\System\hIDQfZi.exe
  2⤵
  PID:8116
- C:\Windows\System\fzIBVWq.exe
  C:\Windows\System\fzIBVWq.exe
  2⤵
  PID:8132
- C:\Windows\System\WTGqIeO.exe
  C:\Windows\System\WTGqIeO.exe
  2⤵
  PID:7056
- C:\Windows\System\JGSWISf.exe
  C:\Windows\System\JGSWISf.exe
  2⤵
  PID:6752
- C:\Windows\System\pMtvLux.exe
  C:\Windows\System\pMtvLux.exe
  2⤵
  PID:5176
- C:\Windows\System\ojtHqFw.exe
  C:\Windows\System\ojtHqFw.exe
  2⤵
  PID:7060
- C:\Windows\System\isBOVAz.exe
  C:\Windows\System\isBOVAz.exe
  2⤵
  PID:7244
- C:\Windows\System\LAbyxxW.exe
  C:\Windows\System\LAbyxxW.exe
  2⤵
  PID:7208
- C:\Windows\System\unCNgHl.exe
  C:\Windows\System\unCNgHl.exe
  2⤵
  PID:7276
- C:\Windows\System\csCMpKH.exe
  C:\Windows\System\csCMpKH.exe
  2⤵
  PID:7316
- C:\Windows\System\lLkskAI.exe
  C:\Windows\System\lLkskAI.exe
  2⤵
  PID:7380
- C:\Windows\System\yxpIVAv.exe
  C:\Windows\System\yxpIVAv.exe
  2⤵
  PID:7368
- C:\Windows\System\hBxdRYw.exe
  C:\Windows\System\hBxdRYw.exe
  2⤵
  PID:7448
- C:\Windows\System\gMePOnI.exe
  C:\Windows\System\gMePOnI.exe
  2⤵
  PID:7396
- C:\Windows\System\LHhbWyP.exe
  C:\Windows\System\LHhbWyP.exe
  2⤵
  PID:7432
- C:\Windows\System\VsBskte.exe
  C:\Windows\System\VsBskte.exe
  2⤵
  PID:5952
- C:\Windows\System\boDgBdO.exe
  C:\Windows\System\boDgBdO.exe
  2⤵
  PID:7556
- C:\Windows\System\bpLWLkZ.exe
  C:\Windows\System\bpLWLkZ.exe
  2⤵
  PID:7620
- C:\Windows\System\gRJJgeu.exe
  C:\Windows\System\gRJJgeu.exe
  2⤵
  PID:7688
- C:\Windows\System\jrFYgGa.exe
  C:\Windows\System\jrFYgGa.exe
  2⤵
  PID:7752
- C:\Windows\System\HjfWHkm.exe
  C:\Windows\System\HjfWHkm.exe
  2⤵
  PID:7844
- C:\Windows\System\RPNaOzs.exe
  C:\Windows\System\RPNaOzs.exe
  2⤵
  PID:7908
- C:\Windows\System\hKiDwKi.exe
  C:\Windows\System\hKiDwKi.exe
  2⤵
  PID:7972
- C:\Windows\System\WIKzaWl.exe
  C:\Windows\System\WIKzaWl.exe
  2⤵
  PID:8036
- C:\Windows\System\UeQedLj.exe
  C:\Windows\System\UeQedLj.exe
  2⤵
  PID:8080
- C:\Windows\System\jFJNucA.exe
  C:\Windows\System\jFJNucA.exe
  2⤵
  PID:8144
- C:\Windows\System\BhkYlVg.exe
  C:\Windows\System\BhkYlVg.exe
  2⤵
  PID:8160
- C:\Windows\System\AHupXAA.exe
  C:\Windows\System\AHupXAA.exe
  2⤵
  PID:8184
- C:\Windows\System\AEekEdJ.exe
  C:\Windows\System\AEekEdJ.exe
  2⤵
  PID:5520
- C:\Windows\System\krsPqyK.exe
  C:\Windows\System\krsPqyK.exe
  2⤵
  PID:6004
- C:\Windows\System\FmbIhpE.exe
  C:\Windows\System\FmbIhpE.exe
  2⤵
  PID:7608
- C:\Windows\System\EOWYxxg.exe
  C:\Windows\System\EOWYxxg.exe
  2⤵
  PID:7832
- C:\Windows\System\kMLHJtv.exe
  C:\Windows\System\kMLHJtv.exe
  2⤵
  PID:7672
- C:\Windows\System\AjzZkfV.exe
  C:\Windows\System\AjzZkfV.exe
  2⤵
  PID:7768
- C:\Windows\System\idhXXNn.exe
  C:\Windows\System\idhXXNn.exe
  2⤵
  PID:7924
- C:\Windows\System\GFmYDaN.exe
  C:\Windows\System\GFmYDaN.exe
  2⤵
  PID:8020
- C:\Windows\System\nQZtrsP.exe
  C:\Windows\System\nQZtrsP.exe
  2⤵
  PID:7332
- C:\Windows\System\WTUNLyU.exe
  C:\Windows\System\WTUNLyU.exe
  2⤵
  PID:7364
- C:\Windows\System\lIEFDXz.exe
  C:\Windows\System\lIEFDXz.exe
  2⤵
  PID:7492
- C:\Windows\System\EEHotbk.exe
  C:\Windows\System\EEHotbk.exe
  2⤵
  PID:6884
- C:\Windows\System\GxTkIEK.exe
  C:\Windows\System\GxTkIEK.exe
  2⤵
  PID:7296
- C:\Windows\System\GSeCQdj.exe
  C:\Windows\System\GSeCQdj.exe
  2⤵
  PID:8008
- C:\Windows\System\NIXWnhw.exe
  C:\Windows\System\NIXWnhw.exe
  2⤵
  PID:7400
- C:\Windows\System\bYarEnY.exe
  C:\Windows\System\bYarEnY.exe
  2⤵
  PID:7656
- C:\Windows\System\lntkexP.exe
  C:\Windows\System\lntkexP.exe
  2⤵
  PID:8112
- C:\Windows\System\AXbjbjc.exe
  C:\Windows\System\AXbjbjc.exe
  2⤵
  PID:7944
- C:\Windows\System\uFsPkhE.exe
  C:\Windows\System\uFsPkhE.exe
  2⤵
  PID:8152
- C:\Windows\System\yrZfqqE.exe
  C:\Windows\System\yrZfqqE.exe
  2⤵
  PID:7544
- C:\Windows\System\Hdrfewo.exe
  C:\Windows\System\Hdrfewo.exe
  2⤵
  PID:7956
- C:\Windows\System\eQRKzqJ.exe
  C:\Windows\System\eQRKzqJ.exe
  2⤵
  PID:8092
- C:\Windows\System\PZraRZv.exe
  C:\Windows\System\PZraRZv.exe
  2⤵
  PID:7540
- C:\Windows\System\NkGBrzf.exe
  C:\Windows\System\NkGBrzf.exe
  2⤵
  PID:6596
- C:\Windows\System\qzJuoxF.exe
  C:\Windows\System\qzJuoxF.exe
  2⤵
  PID:8176
- C:\Windows\System\yDbPbuQ.exe
  C:\Windows\System\yDbPbuQ.exe
  2⤵
  PID:5944
- C:\Windows\System\fsOCoqE.exe
  C:\Windows\System\fsOCoqE.exe
  2⤵
  PID:1580
- C:\Windows\System\xxbUQbq.exe
  C:\Windows\System\xxbUQbq.exe
  2⤵
  PID:7828
- C:\Windows\System\ytDpjMq.exe
  C:\Windows\System\ytDpjMq.exe
  2⤵
  PID:8056
- C:\Windows\System\wVNHvMC.exe
  C:\Windows\System\wVNHvMC.exe
  2⤵
  PID:7328
- C:\Windows\System\MKaZsts.exe
  C:\Windows\System\MKaZsts.exe
  2⤵
  PID:7736
- C:\Windows\System\mLJlWVM.exe
  C:\Windows\System\mLJlWVM.exe
  2⤵
  PID:7876
- C:\Windows\System\xAgpdSD.exe
  C:\Windows\System\xAgpdSD.exe
  2⤵
  PID:7312
- C:\Windows\System\mQMgyFO.exe
  C:\Windows\System\mQMgyFO.exe
  2⤵
  PID:7784
- C:\Windows\System\uTprjKF.exe
  C:\Windows\System\uTprjKF.exe
  2⤵
  PID:7764
- C:\Windows\System\GzuIcZO.exe
  C:\Windows\System\GzuIcZO.exe
  2⤵
  PID:7748
- C:\Windows\System\LCeRGDR.exe
  C:\Windows\System\LCeRGDR.exe
  2⤵
  PID:7460
- C:\Windows\System\YFnUHNj.exe
  C:\Windows\System\YFnUHNj.exe
  2⤵
  PID:8164
- C:\Windows\System\ucOBQBJ.exe
  C:\Windows\System\ucOBQBJ.exe
  2⤵
  PID:7940
- C:\Windows\System\yoSxfhb.exe
  C:\Windows\System\yoSxfhb.exe
  2⤵
  PID:5244
- C:\Windows\System\qEpdPrE.exe
  C:\Windows\System\qEpdPrE.exe
  2⤵
  PID:6564
- C:\Windows\System\rqUMSjf.exe
  C:\Windows\System\rqUMSjf.exe
  2⤵
  PID:7892
- C:\Windows\System\LaNhyBM.exe
  C:\Windows\System\LaNhyBM.exe
  2⤵
  PID:7880
- C:\Windows\System\iuXtmgp.exe
  C:\Windows\System\iuXtmgp.exe
  2⤵
  PID:8072
- C:\Windows\System\SIvOazX.exe
  C:\Windows\System\SIvOazX.exe
  2⤵
  PID:7416
- C:\Windows\System\lEqrDBa.exe
  C:\Windows\System\lEqrDBa.exe
  2⤵
  PID:7508
- C:\Windows\System\FPkSSYR.exe
  C:\Windows\System\FPkSSYR.exe
  2⤵
  PID:7816
- C:\Windows\System\QSZIUos.exe
  C:\Windows\System\QSZIUos.exe
  2⤵
  PID:7636
- C:\Windows\System\BLkPbVz.exe
  C:\Windows\System\BLkPbVz.exe
  2⤵
  PID:7352
- C:\Windows\System\ttQSolD.exe
  C:\Windows\System\ttQSolD.exe
  2⤵
  PID:8124
- C:\Windows\System\lfCHADC.exe
  C:\Windows\System\lfCHADC.exe
  2⤵
  PID:8076
- C:\Windows\System\GXCISLt.exe
  C:\Windows\System\GXCISLt.exe
  2⤵
  PID:7476
- C:\Windows\System\FeICuQF.exe
  C:\Windows\System\FeICuQF.exe
  2⤵
  PID:7444
- C:\Windows\System\tXaGxMF.exe
  C:\Windows\System\tXaGxMF.exe
  2⤵
  PID:8204
- C:\Windows\System\pEszfnH.exe
  C:\Windows\System\pEszfnH.exe
  2⤵
  PID:8220
- C:\Windows\System\HEWSxwi.exe
  C:\Windows\System\HEWSxwi.exe
  2⤵
  PID:8236
- C:\Windows\System\UOSxKAz.exe
  C:\Windows\System\UOSxKAz.exe
  2⤵
  PID:8252
- C:\Windows\System\pYMrSPp.exe
  C:\Windows\System\pYMrSPp.exe
  2⤵
  PID:8268
- C:\Windows\System\qvlLYGw.exe
  C:\Windows\System\qvlLYGw.exe
  2⤵
  PID:8284
- C:\Windows\System\giunEVw.exe
  C:\Windows\System\giunEVw.exe
  2⤵
  PID:8300
- C:\Windows\System\pjmMxDs.exe
  C:\Windows\System\pjmMxDs.exe
  2⤵
  PID:8316
- C:\Windows\System\dUvMTDY.exe
  C:\Windows\System\dUvMTDY.exe
  2⤵
  PID:8332
- C:\Windows\System\qMJiwwE.exe
  C:\Windows\System\qMJiwwE.exe
  2⤵
  PID:8348
- C:\Windows\System\WfsuhTi.exe
  C:\Windows\System\WfsuhTi.exe
  2⤵
  PID:8364
- C:\Windows\System\QcTpYIg.exe
  C:\Windows\System\QcTpYIg.exe
  2⤵
  PID:8380
- C:\Windows\System\FJJKbau.exe
  C:\Windows\System\FJJKbau.exe
  2⤵
  PID:8396
- C:\Windows\System\wGQxigS.exe
  C:\Windows\System\wGQxigS.exe
  2⤵
  PID:8412
- C:\Windows\System\oOlnpYT.exe
  C:\Windows\System\oOlnpYT.exe
  2⤵
  PID:8428
- C:\Windows\System\AdQVWTd.exe
  C:\Windows\System\AdQVWTd.exe
  2⤵
  PID:8444
- C:\Windows\System\GoUtHdx.exe
  C:\Windows\System\GoUtHdx.exe
  2⤵
  PID:8460
- C:\Windows\System\CUxCsfv.exe
  C:\Windows\System\CUxCsfv.exe
  2⤵
  PID:8476
- C:\Windows\System\QaqgcUD.exe
  C:\Windows\System\QaqgcUD.exe
  2⤵
  PID:8492
- C:\Windows\System\qsUJeSv.exe
  C:\Windows\System\qsUJeSv.exe
  2⤵
  PID:8508
- C:\Windows\System\yZhAywl.exe
  C:\Windows\System\yZhAywl.exe
  2⤵
  PID:8524
- C:\Windows\System\cabXnpp.exe
  C:\Windows\System\cabXnpp.exe
  2⤵
  PID:8540
- C:\Windows\System\zcmzzAI.exe
  C:\Windows\System\zcmzzAI.exe
  2⤵
  PID:8556
- C:\Windows\System\FHoVjOw.exe
  C:\Windows\System\FHoVjOw.exe
  2⤵
  PID:8572
- C:\Windows\System\CixUSaa.exe
  C:\Windows\System\CixUSaa.exe
  2⤵
  PID:8588
- C:\Windows\System\iYtaUhE.exe
  C:\Windows\System\iYtaUhE.exe
  2⤵
  PID:8604
- C:\Windows\System\XyMlWYk.exe
  C:\Windows\System\XyMlWYk.exe
  2⤵
  PID:8620
- C:\Windows\System\GbdvGwY.exe
  C:\Windows\System\GbdvGwY.exe
  2⤵
  PID:8636
- C:\Windows\System\YJxaxOs.exe
  C:\Windows\System\YJxaxOs.exe
  2⤵
  PID:8652
- C:\Windows\System\RLiXHGF.exe
  C:\Windows\System\RLiXHGF.exe
  2⤵
  PID:8668
- C:\Windows\System\pahaCMZ.exe
  C:\Windows\System\pahaCMZ.exe
  2⤵
  PID:8688
- C:\Windows\System\DfuDysS.exe
  C:\Windows\System\DfuDysS.exe
  2⤵
  PID:8704
- C:\Windows\System\VZFLaSm.exe
  C:\Windows\System\VZFLaSm.exe
  2⤵
  PID:8720
- C:\Windows\System\oOOjRcl.exe
  C:\Windows\System\oOOjRcl.exe
  2⤵
  PID:8736
- C:\Windows\System\eHVbKwp.exe
  C:\Windows\System\eHVbKwp.exe
  2⤵
  PID:8752
- C:\Windows\System\qLbjdKR.exe
  C:\Windows\System\qLbjdKR.exe
  2⤵
  PID:8768
- C:\Windows\System\wrYuxvo.exe
  C:\Windows\System\wrYuxvo.exe
  2⤵
  PID:8784
- C:\Windows\System\mxzcjIS.exe
  C:\Windows\System\mxzcjIS.exe
  2⤵
  PID:8800
- C:\Windows\System\nBwcyYi.exe
  C:\Windows\System\nBwcyYi.exe
  2⤵
  PID:8816
- C:\Windows\System\fLxWfmU.exe
  C:\Windows\System\fLxWfmU.exe
  2⤵
  PID:8832
- C:\Windows\System\RBaZMkC.exe
  C:\Windows\System\RBaZMkC.exe
  2⤵
  PID:8848
- C:\Windows\System\fxgtVYf.exe
  C:\Windows\System\fxgtVYf.exe
  2⤵
  PID:8864
- C:\Windows\System\rMWMrei.exe
  C:\Windows\System\rMWMrei.exe
  2⤵
  PID:8880
- C:\Windows\System\dySULsY.exe
  C:\Windows\System\dySULsY.exe
  2⤵
  PID:8896
- C:\Windows\System\TDpKbPj.exe
  C:\Windows\System\TDpKbPj.exe
  2⤵
  PID:8912
- C:\Windows\System\uqrlqzt.exe
  C:\Windows\System\uqrlqzt.exe
  2⤵
  PID:8928
- C:\Windows\System\AmswCRR.exe
  C:\Windows\System\AmswCRR.exe
  2⤵
  PID:8944
- C:\Windows\System\SKtFiGm.exe
  C:\Windows\System\SKtFiGm.exe
  2⤵
  PID:8960
- C:\Windows\System\eJdlovF.exe
  C:\Windows\System\eJdlovF.exe
  2⤵
  PID:8976
- C:\Windows\System\KFmMhRn.exe
  C:\Windows\System\KFmMhRn.exe
  2⤵
  PID:8992
- C:\Windows\System\QAPxCmu.exe
  C:\Windows\System\QAPxCmu.exe
  2⤵
  PID:9008
- C:\Windows\System\AdvoFuf.exe
  C:\Windows\System\AdvoFuf.exe
  2⤵
  PID:9024
- C:\Windows\System\cHzxfBX.exe
  C:\Windows\System\cHzxfBX.exe
  2⤵
  PID:9040
- C:\Windows\System\QMvpZAt.exe
  C:\Windows\System\QMvpZAt.exe
  2⤵
  PID:9056
- C:\Windows\System\VgiJAfW.exe
  C:\Windows\System\VgiJAfW.exe
  2⤵
  PID:9072
- C:\Windows\System\UgLqKTe.exe
  C:\Windows\System\UgLqKTe.exe
  2⤵
  PID:9088
- C:\Windows\System\ERXDEHg.exe
  C:\Windows\System\ERXDEHg.exe
  2⤵
  PID:9104
- C:\Windows\System\DudIRFg.exe
  C:\Windows\System\DudIRFg.exe
  2⤵
  PID:9120
- C:\Windows\System\OEuqyyd.exe
  C:\Windows\System\OEuqyyd.exe
  2⤵
  PID:9136
- C:\Windows\System\PmdPUcq.exe
  C:\Windows\System\PmdPUcq.exe
  2⤵
  PID:9152
- C:\Windows\System\IISJyTU.exe
  C:\Windows\System\IISJyTU.exe
  2⤵
  PID:9168
- C:\Windows\System\IzVgMMh.exe
  C:\Windows\System\IzVgMMh.exe
  2⤵
  PID:9184
- C:\Windows\System\SxAVwRZ.exe
  C:\Windows\System\SxAVwRZ.exe
  2⤵
  PID:9200
- C:\Windows\System\vHtUUQH.exe
  C:\Windows\System\vHtUUQH.exe
  2⤵
  PID:8196
- C:\Windows\System\UnfUWLd.exe
  C:\Windows\System\UnfUWLd.exe
  2⤵
  PID:7172
- C:\Windows\System\ZaHMLdy.exe
  C:\Windows\System\ZaHMLdy.exe
  2⤵
  PID:8216
- C:\Windows\System\VNpNerm.exe
  C:\Windows\System\VNpNerm.exe
  2⤵
  PID:8232
- C:\Windows\System\qiHEfHL.exe
  C:\Windows\System\qiHEfHL.exe
  2⤵
  PID:8308
- C:\Windows\System\YAHYAJM.exe
  C:\Windows\System\YAHYAJM.exe
  2⤵
  PID:8264
- C:\Windows\System\XwanKuC.exe
  C:\Windows\System\XwanKuC.exe
  2⤵
  PID:8376
- C:\Windows\System\mLnLLYR.exe
  C:\Windows\System\mLnLLYR.exe
  2⤵
  PID:8360
- C:\Windows\System\eazBmUX.exe
  C:\Windows\System\eazBmUX.exe
  2⤵
  PID:8468
- C:\Windows\System\AsDxPUA.exe
  C:\Windows\System\AsDxPUA.exe
  2⤵
  PID:8504
- C:\Windows\System\axNMnEO.exe
  C:\Windows\System\axNMnEO.exe
  2⤵
  PID:8488
- C:\Windows\System\lUTIKNQ.exe
  C:\Windows\System\lUTIKNQ.exe
  2⤵
  PID:8424
- C:\Windows\System\VpZFvOb.exe
  C:\Windows\System\VpZFvOb.exe
  2⤵
  PID:8520
- C:\Windows\System\xyCIRSV.exe
  C:\Windows\System\xyCIRSV.exe
  2⤵
  PID:8584
- C:\Windows\System\BaiDLRj.exe
  C:\Windows\System\BaiDLRj.exe
  2⤵
  PID:8616
- C:\Windows\System\EwFBeHA.exe
  C:\Windows\System\EwFBeHA.exe
  2⤵
  PID:8596
- C:\Windows\System\UZuXdCx.exe
  C:\Windows\System\UZuXdCx.exe
  2⤵
  PID:8660
- C:\Windows\System\IaDTueo.exe
  C:\Windows\System\IaDTueo.exe
  2⤵
  PID:8728
- C:\Windows\System\lipMdlC.exe
  C:\Windows\System\lipMdlC.exe
  2⤵
  PID:8792
- C:\Windows\System\fPdpdFV.exe
  C:\Windows\System\fPdpdFV.exe
  2⤵
  PID:8856
- C:\Windows\System\Dpygkai.exe
  C:\Windows\System\Dpygkai.exe
  2⤵
  PID:8920
- C:\Windows\System\JWtTFqN.exe
  C:\Windows\System\JWtTFqN.exe
  2⤵
  PID:8956
- C:\Windows\System\YUwiOae.exe
  C:\Windows\System\YUwiOae.exe
  2⤵
  PID:9016
- C:\Windows\System\RqemFWr.exe
  C:\Windows\System\RqemFWr.exe
  2⤵
  PID:8876
- C:\Windows\System\etxZLBh.exe
  C:\Windows\System\etxZLBh.exe
  2⤵
  PID:8716
- C:\Windows\System\ojRAfkZ.exe
  C:\Windows\System\ojRAfkZ.exe
  2⤵
  PID:9144
- C:\Windows\System\qKrBGeO.exe
  C:\Windows\System\qKrBGeO.exe
  2⤵
  PID:9180
- C:\Windows\System\AdRuIfl.exe
  C:\Windows\System\AdRuIfl.exe
  2⤵
  PID:9000
- C:\Windows\System\AULEJLF.exe
  C:\Windows\System\AULEJLF.exe
  2⤵
  PID:9132
- C:\Windows\System\TpfxMbK.exe
  C:\Windows\System\TpfxMbK.exe
  2⤵
  PID:8780
- C:\Windows\System\YqSxhVb.exe
  C:\Windows\System\YqSxhVb.exe
  2⤵
  PID:8908
- C:\Windows\System\irMEjqd.exe
  C:\Windows\System\irMEjqd.exe
  2⤵
  PID:9004
- C:\Windows\System\KTGTjsb.exe
  C:\Windows\System\KTGTjsb.exe
  2⤵
  PID:9068
- C:\Windows\System\IXjuBsg.exe
  C:\Windows\System\IXjuBsg.exe
  2⤵
  PID:9128
- C:\Windows\System\YdlFapB.exe
  C:\Windows\System\YdlFapB.exe
  2⤵
  PID:7336
- C:\Windows\System\YKFsYvL.exe
  C:\Windows\System\YKFsYvL.exe
  2⤵
  PID:8276
- C:\Windows\System\eXHBSmi.exe
  C:\Windows\System\eXHBSmi.exe
  2⤵
  PID:8440
- C:\Windows\System\hvBRxxe.exe
  C:\Windows\System\hvBRxxe.exe
  2⤵
  PID:8500
- C:\Windows\System\aXPgtAR.exe
  C:\Windows\System\aXPgtAR.exe
  2⤵
  PID:8344
- C:\Windows\System\kTkYSOg.exe
  C:\Windows\System\kTkYSOg.exe
  2⤵
  PID:8484
- C:\Windows\System\QAOQodE.exe
  C:\Windows\System\QAOQodE.exe
  2⤵
  PID:8632
- C:\Windows\System\TpyhrOW.exe
  C:\Windows\System\TpyhrOW.exe
  2⤵
  PID:8552
- C:\Windows\System\lhjQzgc.exe
  C:\Windows\System\lhjQzgc.exe
  2⤵
  PID:8764
- C:\Windows\System\UhFFkpr.exe
  C:\Windows\System\UhFFkpr.exe
  2⤵
  PID:8840
- C:\Windows\System\qpxErde.exe
  C:\Windows\System\qpxErde.exe
  2⤵
  PID:9148
- C:\Windows\System\nNGbBmH.exe
  C:\Windows\System\nNGbBmH.exe
  2⤵
  PID:8812
- C:\Windows\System\rxGAkwF.exe
  C:\Windows\System\rxGAkwF.exe
  2⤵
  PID:8924
- C:\Windows\System\JAitxAp.exe
  C:\Windows\System\JAitxAp.exe
  2⤵
  PID:8936
- C:\Windows\System\ndhZztJ.exe
  C:\Windows\System\ndhZztJ.exe
  2⤵
  PID:9048
- C:\Windows\System\NoRjNwf.exe
  C:\Windows\System\NoRjNwf.exe
  2⤵
  PID:9100
- C:\Windows\System\MDiaTpa.exe
  C:\Windows\System\MDiaTpa.exe
  2⤵
  PID:8248
- C:\Windows\System\bwPPQqq.exe
  C:\Windows\System\bwPPQqq.exe
  2⤵
  PID:8516
- C:\Windows\System\zKcJvzj.exe
  C:\Windows\System\zKcJvzj.exe
  2⤵
  PID:8420
- C:\Windows\System\MAqFJcS.exe
  C:\Windows\System\MAqFJcS.exe
  2⤵
  PID:8568
- C:\Windows\System\bDDPkLj.exe
  C:\Windows\System\bDDPkLj.exe
  2⤵
  PID:8892
- C:\Windows\System\DwOPjXp.exe
  C:\Windows\System\DwOPjXp.exe
  2⤵
  PID:9160
- C:\Windows\System\xuoeuco.exe
  C:\Windows\System\xuoeuco.exe
  2⤵
  PID:9084
- C:\Windows\System\MKbudff.exe
  C:\Windows\System\MKbudff.exe
  2⤵
  PID:9052
- C:\Windows\System\tPNZqWB.exe
  C:\Windows\System\tPNZqWB.exe
  2⤵
  PID:8536
- C:\Windows\System\WLlVEjB.exe
  C:\Windows\System\WLlVEjB.exe
  2⤵
  PID:8700
- C:\Windows\System\xNQZINO.exe
  C:\Windows\System\xNQZINO.exe
  2⤵
  PID:8888
- C:\Windows\System\DOQgSqT.exe
  C:\Windows\System\DOQgSqT.exe
  2⤵
  PID:9112
- C:\Windows\System\pMOzQHF.exe
  C:\Windows\System\pMOzQHF.exe
  2⤵
  PID:9096
- C:\Windows\System\FNaRsUI.exe
  C:\Windows\System\FNaRsUI.exe
  2⤵
  PID:8684
- C:\Windows\System\UrjmDIK.exe
  C:\Windows\System\UrjmDIK.exe
  2⤵
  PID:8776
- C:\Windows\System\pfasaUs.exe
  C:\Windows\System\pfasaUs.exe
  2⤵
  PID:9228
- C:\Windows\System\kGWFIHb.exe
  C:\Windows\System\kGWFIHb.exe
  2⤵
  PID:9244
- C:\Windows\System\XvvHWqy.exe
  C:\Windows\System\XvvHWqy.exe
  2⤵
  PID:9260
- C:\Windows\System\KSmajgY.exe
  C:\Windows\System\KSmajgY.exe
  2⤵
  PID:9276
- C:\Windows\System\GTOcWLK.exe
  C:\Windows\System\GTOcWLK.exe
  2⤵
  PID:9292
- C:\Windows\System\yygSUoR.exe
  C:\Windows\System\yygSUoR.exe
  2⤵
  PID:9308
- C:\Windows\System\WPbvkdQ.exe
  C:\Windows\System\WPbvkdQ.exe
  2⤵
  PID:9324
- C:\Windows\System\mVNmPRQ.exe
  C:\Windows\System\mVNmPRQ.exe
  2⤵
  PID:9340
- C:\Windows\System\gMZEuAw.exe
  C:\Windows\System\gMZEuAw.exe
  2⤵
  PID:9356
- C:\Windows\System\yVdtAYR.exe
  C:\Windows\System\yVdtAYR.exe
  2⤵
  PID:9372
- C:\Windows\System\dyFYWeN.exe
  C:\Windows\System\dyFYWeN.exe
  2⤵
  PID:9388
- C:\Windows\System\ueCVBmn.exe
  C:\Windows\System\ueCVBmn.exe
  2⤵
  PID:9404
- C:\Windows\System\cxIFQHd.exe
  C:\Windows\System\cxIFQHd.exe
  2⤵
  PID:9420
- C:\Windows\System\rUvAKsR.exe
  C:\Windows\System\rUvAKsR.exe
  2⤵
  PID:9440
- C:\Windows\System\DeRDobD.exe
  C:\Windows\System\DeRDobD.exe
  2⤵
  PID:9460
- C:\Windows\System\Ozzxwyr.exe
  C:\Windows\System\Ozzxwyr.exe
  2⤵
  PID:9476
- C:\Windows\System\QMHCQeg.exe
  C:\Windows\System\QMHCQeg.exe
  2⤵
  PID:9492
- C:\Windows\System\HWdGQjT.exe
  C:\Windows\System\HWdGQjT.exe
  2⤵
  PID:9508
- C:\Windows\System\eBuvQEH.exe
  C:\Windows\System\eBuvQEH.exe
  2⤵
  PID:9524
- C:\Windows\System\QPOnVZG.exe
  C:\Windows\System\QPOnVZG.exe
  2⤵
  PID:9540
- C:\Windows\System\zNfJiCv.exe
  C:\Windows\System\zNfJiCv.exe
  2⤵
  PID:9556
- C:\Windows\System\FLTDQGj.exe
  C:\Windows\System\FLTDQGj.exe
  2⤵
  PID:9572
- C:\Windows\System\rsKdlcT.exe
  C:\Windows\System\rsKdlcT.exe
  2⤵
  PID:9588
- C:\Windows\System\PNqRUIX.exe
  C:\Windows\System\PNqRUIX.exe
  2⤵
  PID:9604
- C:\Windows\System\aFwxXWE.exe
  C:\Windows\System\aFwxXWE.exe
  2⤵
  PID:9664
- C:\Windows\System\FfKUZsG.exe
  C:\Windows\System\FfKUZsG.exe
  2⤵
  PID:9680
- C:\Windows\System\HobohFC.exe
  C:\Windows\System\HobohFC.exe
  2⤵
  PID:9700
- C:\Windows\System\DtzCagr.exe
  C:\Windows\System\DtzCagr.exe
  2⤵
  PID:9720
- C:\Windows\System\ZIJnIEj.exe
  C:\Windows\System\ZIJnIEj.exe
  2⤵
  PID:9736
- C:\Windows\System\FqlpyDg.exe
  C:\Windows\System\FqlpyDg.exe
  2⤵
  PID:9752
- C:\Windows\System\HLAmlCH.exe
  C:\Windows\System\HLAmlCH.exe
  2⤵
  PID:9772
- C:\Windows\System\NCtKBUW.exe
  C:\Windows\System\NCtKBUW.exe
  2⤵
  PID:9788
- C:\Windows\System\mWofOIW.exe
  C:\Windows\System\mWofOIW.exe
  2⤵
  PID:9804
- C:\Windows\System\veIdgxs.exe
  C:\Windows\System\veIdgxs.exe
  2⤵
  PID:9820
- C:\Windows\System\bHfqyBB.exe
  C:\Windows\System\bHfqyBB.exe
  2⤵
  PID:9836
- C:\Windows\System\IctVuhC.exe
  C:\Windows\System\IctVuhC.exe
  2⤵
  PID:9852
- C:\Windows\System\EhiDWPK.exe
  C:\Windows\System\EhiDWPK.exe
  2⤵
  PID:9868
- C:\Windows\System\wVxReIT.exe
  C:\Windows\System\wVxReIT.exe
  2⤵
  PID:9884
- C:\Windows\System\UQpwDYg.exe
  C:\Windows\System\UQpwDYg.exe
  2⤵
  PID:9900
- C:\Windows\System\HwUsPoq.exe
  C:\Windows\System\HwUsPoq.exe
  2⤵
  PID:9916
- C:\Windows\System\OCXCSfu.exe
  C:\Windows\System\OCXCSfu.exe
  2⤵
  PID:9956
- C:\Windows\System\uFNHmZW.exe
  C:\Windows\System\uFNHmZW.exe
  2⤵
  PID:9972
- C:\Windows\System\aTOsoLZ.exe
  C:\Windows\System\aTOsoLZ.exe
  2⤵
  PID:9988
- C:\Windows\System\pxvRPVj.exe
  C:\Windows\System\pxvRPVj.exe
  2⤵
  PID:10004
- C:\Windows\System\mSjxJFR.exe
  C:\Windows\System\mSjxJFR.exe
  2⤵
  PID:10020
- C:\Windows\System\JcAJRPA.exe
  C:\Windows\System\JcAJRPA.exe
  2⤵
  PID:10036
- C:\Windows\System\dZYAJxT.exe
  C:\Windows\System\dZYAJxT.exe
  2⤵
  PID:10052
- C:\Windows\System\nbpoVVW.exe
  C:\Windows\System\nbpoVVW.exe
  2⤵
  PID:10068
- C:\Windows\System\ppmjArR.exe
  C:\Windows\System\ppmjArR.exe
  2⤵
  PID:10084
- C:\Windows\System\mNCQiyM.exe
  C:\Windows\System\mNCQiyM.exe
  2⤵
  PID:10100
- C:\Windows\System\coNqdEb.exe
  C:\Windows\System\coNqdEb.exe
  2⤵
  PID:10116
- C:\Windows\System\rETzMTb.exe
  C:\Windows\System\rETzMTb.exe
  2⤵
  PID:10132
- C:\Windows\System\QitlEPj.exe
  C:\Windows\System\QitlEPj.exe
  2⤵
  PID:10148
- C:\Windows\System\LqNCGAY.exe
  C:\Windows\System\LqNCGAY.exe
  2⤵
  PID:10164
- C:\Windows\System\UmxqvIz.exe
  C:\Windows\System\UmxqvIz.exe
  2⤵
  PID:10184
- C:\Windows\System\prhCwWT.exe
  C:\Windows\System\prhCwWT.exe
  2⤵
  PID:10204
- C:\Windows\System\SwhWAiD.exe
  C:\Windows\System\SwhWAiD.exe
  2⤵
  PID:10224
- C:\Windows\System\ijGCzMd.exe
  C:\Windows\System\ijGCzMd.exe
  2⤵
  PID:8748
- C:\Windows\System\LGLWxTC.exe
  C:\Windows\System\LGLWxTC.exe
  2⤵
  PID:9300
- C:\Windows\System\ldZQImd.exe
  C:\Windows\System\ldZQImd.exe
  2⤵
  PID:9268
- C:\Windows\System\VCrqzRx.exe
  C:\Windows\System\VCrqzRx.exe
  2⤵
  PID:9400
- C:\Windows\System\SeqfvEZ.exe
  C:\Windows\System\SeqfvEZ.exe
  2⤵
  PID:9380
- C:\Windows\System\PdAwkTt.exe
  C:\Windows\System\PdAwkTt.exe
  2⤵
  PID:9256
- C:\Windows\System\EttjQRg.exe
  C:\Windows\System\EttjQRg.exe
  2⤵
  PID:9412
- C:\Windows\System\eoAelkM.exe
  C:\Windows\System\eoAelkM.exe
  2⤵
  PID:9316
- C:\Windows\System\jBayLCD.exe
  C:\Windows\System\jBayLCD.exe
  2⤵
  PID:9448
- C:\Windows\System\vKquAbq.exe
  C:\Windows\System\vKquAbq.exe
  2⤵
  PID:9500
- C:\Windows\System\mzLZrUd.exe
  C:\Windows\System\mzLZrUd.exe
  2⤵
  PID:9488
- C:\Windows\System\LVNsaeB.exe
  C:\Windows\System\LVNsaeB.exe
  2⤵
  PID:9564
- C:\Windows\System\eQhaEAj.exe
  C:\Windows\System\eQhaEAj.exe
  2⤵
  PID:9584
- C:\Windows\System\OtIWNFJ.exe
  C:\Windows\System\OtIWNFJ.exe
  2⤵
  PID:9616
- C:\Windows\System\ylPbWef.exe
  C:\Windows\System\ylPbWef.exe
  2⤵
  PID:9632
- C:\Windows\System\eFKUEyg.exe
  C:\Windows\System\eFKUEyg.exe
  2⤵
  PID:9648
- C:\Windows\System\oYmCeFH.exe
  C:\Windows\System\oYmCeFH.exe
  2⤵
  PID:9672
- C:\Windows\System\OdJpOlX.exe
  C:\Windows\System\OdJpOlX.exe
  2⤵
  PID:9688
- C:\Windows\System\ZEkgmxu.exe
  C:\Windows\System\ZEkgmxu.exe
  2⤵
  PID:9744
- C:\Windows\System\PPBmQAY.exe
  C:\Windows\System\PPBmQAY.exe
  2⤵
  PID:9764
- C:\Windows\System\iieednb.exe
  C:\Windows\System\iieednb.exe
  2⤵
  PID:9828
- C:\Windows\System\ZptMWsp.exe
  C:\Windows\System\ZptMWsp.exe
  2⤵
  PID:9812
- C:\Windows\System\cUZGhCz.exe
  C:\Windows\System\cUZGhCz.exe
  2⤵
  PID:9844
- C:\Windows\System\ljmzNZc.exe
  C:\Windows\System\ljmzNZc.exe
  2⤵
  PID:9896
- C:\Windows\System\ktBgTia.exe
  C:\Windows\System\ktBgTia.exe
  2⤵
  PID:9964
- C:\Windows\System\jIFELKp.exe
  C:\Windows\System\jIFELKp.exe
  2⤵
  PID:9936
- C:\Windows\System\vlndWKS.exe
  C:\Windows\System\vlndWKS.exe
  2⤵
  PID:9952
- C:\Windows\System\EnQfstG.exe
  C:\Windows\System\EnQfstG.exe
  2⤵
  PID:10032
- C:\Windows\System\PvJtNIB.exe
  C:\Windows\System\PvJtNIB.exe
  2⤵
  PID:10124
- C:\Windows\System\jENLarV.exe
  C:\Windows\System\jENLarV.exe
  2⤵
  PID:10192
- C:\Windows\System\fnvgSkk.exe
  C:\Windows\System\fnvgSkk.exe
  2⤵
  PID:10112
- C:\Windows\System\iTpIeCz.exe
  C:\Windows\System\iTpIeCz.exe
  2⤵
  PID:10108
- C:\Windows\System\zWUXNWB.exe
  C:\Windows\System\zWUXNWB.exe
  2⤵
  PID:10044
- C:\Windows\System\SPUcGyP.exe
  C:\Windows\System\SPUcGyP.exe
  2⤵
  PID:10212
- C:\Windows\System\PPeKTnY.exe
  C:\Windows\System\PPeKTnY.exe
  2⤵
  PID:9332
- C:\Windows\System\CqMZNuR.exe
  C:\Windows\System\CqMZNuR.exe
  2⤵
  PID:9436
- C:\Windows\System\AeVmDYy.exe
  C:\Windows\System\AeVmDYy.exe
  2⤵
  PID:10220
- C:\Windows\System\GKYnkVT.exe
  C:\Windows\System\GKYnkVT.exe
  2⤵
  PID:9368
- C:\Windows\System\folasNS.exe
  C:\Windows\System\folasNS.exe
  2⤵
  PID:9224
- C:\Windows\System\YZSlvXk.exe
  C:\Windows\System\YZSlvXk.exe
  2⤵
  PID:9504
- C:\Windows\System\dHnWfDU.exe
  C:\Windows\System\dHnWfDU.exe
  2⤵
  PID:9552
- C:\Windows\System\TYsWOtP.exe
  C:\Windows\System\TYsWOtP.exe
  2⤵
  PID:9656
- C:\Windows\System\jlGrlSv.exe
  C:\Windows\System\jlGrlSv.exe
  2⤵
  PID:9800
- C:\Windows\System\narBZyV.exe
  C:\Windows\System\narBZyV.exe
  2⤵
  PID:9944
- C:\Windows\System\OMFAeiG.exe
  C:\Windows\System\OMFAeiG.exe
  2⤵
  PID:9996
- C:\Windows\System\kzmDFgm.exe
  C:\Windows\System\kzmDFgm.exe
  2⤵
  PID:9600
- C:\Windows\System\GqaBOAO.exe
  C:\Windows\System\GqaBOAO.exe
  2⤵
  PID:9928
- C:\Windows\System\WDuWInj.exe
  C:\Windows\System\WDuWInj.exe
  2⤵
  PID:9780
- C:\Windows\System\KDAiHCT.exe
  C:\Windows\System\KDAiHCT.exe
  2⤵
  PID:9716
- C:\Windows\System\WOtIzvb.exe
  C:\Windows\System\WOtIzvb.exe
  2⤵
  PID:10160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CBQRnvt.exe

Filesize
1.9MB

MD5
52644002326fc0ace509d0e476125759

SHA1
41d01767c5c89a3c4ebfdf940ee912927260f7aa

SHA256
cb58fc9f398918fc0450274f6efeccad99086058c42b417e696482789a028cd2

SHA512
789ad9cd11a839f42293d36736d2bb8e0e56ffcd758979bc200bef355137f5a23fd30ea70b0ec492114d6aff6fdfc4b1784513f3010908956411f803b343bae8

Download Submit
C:\Windows\system\CarvXJy.exe

Filesize
1.9MB

MD5
1f7e67992a344731fa75890a73761994

SHA1
88ed03a92b3b64b31454eae55df2fdae6700c4df

SHA256
1d9f083df8965d9c6746f5666870d4ef86ca15963ba31c644938dac077b2fc8a

SHA512
0e8092e134283008caa40d322c179966747c0b6e0167d130b4c29247795c9396cf48e8c0b61e83181f326f778c6fb81f59ba8c635ba174a502d4cf17e83ff14b

Download Submit
C:\Windows\system\ElDaAsu.exe

Filesize
1.9MB

MD5
6a35d45539dbe407c1bb546e222cbc6f

SHA1
790c1023222a1b8b6f207fcdd0338bc61e358c0c

SHA256
ab6104026e220d6d71b0c41bb76ec6eec85b21296264de89959d5898ba14b229

SHA512
e6865fd483a7db3c0c32ef3527e03da045acb792c1caa2533c919649f52bd05ae902b6aacf6b9dc8713a015d34a3062ced469d0b0af7adc62db3a7e6a1f1cca6

Download Submit
C:\Windows\system\RoEVaxe.exe

Filesize
1.9MB

MD5
ec06a2339353aff25f2eb3a5012d04e7

SHA1
44028ea847a672bc27563d107da562bff4ccdade

SHA256
e192776e4d2592bc27318a1f8bd422d2d880f28b553aff158e40f10b15485901

SHA512
fb01e579287327144f1f1e1b31a5b6ffd3aa6c6f423a5a00ec68136d4278a4eacfa0cec74325a0d909be685dd2c5e8cc5128b3949f191b5b4dc6833e67a69135

Download Submit
C:\Windows\system\VjbcOTS.exe

Filesize
1.9MB

MD5
eaaeae4e05035d4350b555fc8bcb6441

SHA1
134fa09f687757ee1bcbf2c544239515e6c61fe5

SHA256
06c2a9c9b60807c3e07c0b6531c27119bf1cd8aee79ba4c45a15aeabdb8652ee

SHA512
51f24462bc3bbe4962e09432530ae519d5fa5e4f82d2eadee0cd24403eded2198021e758b8a86da251f3089849b0ddb230fec85c090bb8f2c21a045a92db4783

Download Submit
C:\Windows\system\ZUnyMpi.exe

Filesize
1.9MB

MD5
6b63f64b45f31ad2238afff5a745a306

SHA1
db3e161b49b218d950d893c487ae3c6258b517ec

SHA256
19c9895414df0b1eaabfb20a8b661df84bb685484dac7c878a34b6e232dc6d68

SHA512
ff1a18e11461bf5295dc54e1f86206c332cb33f5e5857e346cf8208c3e321f7a9431e2c63bafcd73c57b4c490984b0d9089710a23955f358c49d6b8f7e43d09b

Download Submit
C:\Windows\system\dDzChKk.exe

Filesize
1.9MB

MD5
f61a40c1cc43b3ef0dddaa53b4e49cab

SHA1
c9759f86269a80718cd65b3e95d279bdf26cbef3

SHA256
6792ad0e6ff8699eadd54b04fa8f48e763b4cf6b7b562df321556bfc2045c46d

SHA512
6dce5f09796c3d225a07d4707ac4e2c77d46eb79c472ae24d2a7366a638470d1598eaddc19b6abd59a4a60780f82eb705a750e4587d1dedd2e1a699db37b2406

Download Submit
C:\Windows\system\dqKNaTa.exe

Filesize
1.9MB

MD5
7ab0eea64c67b6dc8d693d82ac9e268a

SHA1
04d3c2ac3655cb56c13a019a5ce7b58a1e3f6c67

SHA256
6ba00823f6e20a76fe71b77e9373fa6db5c524c226283e2bb09c5dbb846c8d60

SHA512
a3980b467c9b2cefd6fb60961ea20507a9766cfc90041ae6f7b19f50f7544ccd91a2cc3e03f2359a9c2a3b00aff3e321690c11a30a4b1ef505f59e176d8bc203

Download Submit
C:\Windows\system\hoEkjuh.exe

Filesize
1.9MB

MD5
c5de6cc0dde7dd69d94d730d38088ae4

SHA1
03395cdf8fb45f80c7463ad9fa22f4af262aa96a

SHA256
eaec93c7190b6cce2dbbc23aba1bdc0fe5e1f3c9496594dbbd87ab5e3d319e33

SHA512
6c8252a335cfc141e0b62ec153fdbe734beceeb2aace951e3a894f79405b45a7ed48826ffb160887ecdb219ea230a9fd3d1bf2006aa61cae1b71617c7d9c51b6

Download Submit
C:\Windows\system\jkQtikg.exe

Filesize
1.9MB

MD5
c5e2eb6f48ce4c4ccf0cbd17990a19f9

SHA1
f8a44172ee99f4ae723d4903a9af1c1d525b6f3b

SHA256
92a33c9cca8aa10c191c7277a9e438fad1d7f4427b4013cb79c039e6143df4cf

SHA512
0fd881914939d917dd746189627d5db2a9b2953e17b22896dd3b1f1ce49213a727d24421a8c55dfd88493c15e8b7ca67a8d78bbb6263b9e68ffb4fb80ab72ce6

Download Submit
C:\Windows\system\lQYOelS.exe

Filesize
1.9MB

MD5
6530af8cd9c7ee1152ced22b7479f029

SHA1
70c10ff9134f505eadd9eed655289bc6a25c5a0d

SHA256
1ed841bd8b060a544bdb0bc01824c7176376959bf3d9fe9ebc14f231dcd7c38f

SHA512
95b515819bc96a7bcfadd09b8222efc0ad65887e64d45a3944fa456e4a0a17bf6d9613bb6c8efa1ea75b2cacdbc77e2aee4d60b497cec1deeff2cf941d184c7a

Download Submit
C:\Windows\system\nATJFEF.exe

Filesize
1.9MB

MD5
b3f70d5af6a0d8fbf824ce9d168a1b16

SHA1
f4a114b9456a274d35160ba05f09e71f83ce823f

SHA256
ff1bb78261c83ce96ef7a417de82ed2c675cbf9046263867c4b677f934af1dac

SHA512
6137ac3fad93f3b805a38718b90219d713dfe89d5b44f0a7b7fdcdf79718225d82ad1d791c8580fe65aa04fb8fa43cbf164170b0ec6d64de09641029fcceb69f

Download Submit
C:\Windows\system\nCSddSb.exe

Filesize
1.9MB

MD5
f407373d5253024f82617bca2402f4ae

SHA1
ee5b7c8af3bb3ec38610fee06dbc40cf0886fe66

SHA256
1debb1801a7b901065d2950c666b84a18052db7cc9cb4ce564e50343a88c9f90

SHA512
d45e48568fad7b9d8dd52eddf4e2a375267613dc3c16d3b73bb314cf4ced2fb90571117e36174581d533e1b4ab316be9954e2f9458dbb1d3419349d964dd1ce2

Download Submit
C:\Windows\system\nLwYOFV.exe

Filesize
1.9MB

MD5
c757652ff7e4aea5525c8f58f852ee68

SHA1
c9558c074f0c151a4524f84b6bb3b889a914f8ae

SHA256
984853418f4b524458e6d85967cd4f0d52e6c7abbbc22f617a727bf5a866fd4a

SHA512
87796d58347b196282aaad49701fcc4d8e3f919d191d2dd9caa245e6d813db653bb54dbe729a51c7049c84c8b2c3ce3c7c16a0fb39eabe6eb78b82eaa0e64852

Download Submit
C:\Windows\system\nWaCNay.exe

Filesize
1.9MB

MD5
e6e7579f72a77d83b1864752f57727d4

SHA1
5d541f4def0cfd495b444452be0ea54e9951fa3f

SHA256
79552bb893158473fdfa280510883331ec0a9c02ffec078bcb81391b3d73acb0

SHA512
721cbdc5692c729d55d3f2898000158acddd1d78ac71c68290d74febec89ed28d6322337426da71e6bd436d6a87f3d49d5420b875b0d581a88ce8d1a83a7d2ae

Download Submit
C:\Windows\system\pFjhVot.exe

Filesize
1.9MB

MD5
93ae988304541b242bf0bb2b60dcb86f

SHA1
f0ede35de7bd4f188ac65dbffc62ac5a2e01df6b

SHA256
759455c179e3bbdf75da7a04c597b052547c721aacf8bdd9387f1489824a960f

SHA512
b7633a3b0e17455188dd7ddae129ae8ca4864dabef976d768dfb5109ba81da4b00d0320161c3d88cbdfc47a2c31b4c2ff2bd8bf989d720f6b84ecc00d271e7bd

Download Submit
C:\Windows\system\pJKkaIr.exe

Filesize
1.9MB

MD5
e38d1bf54c609a23b1cca9f3fab9655c

SHA1
2082c5af2e7859f96c9b7a18730a7b3f23dce010

SHA256
545c144ada0fd37187afc6e4cb2335c39369647e75b043b5f6f815ce768c49f9

SHA512
dd1f900e867a7fd7c6ed2060176ddd14696a75a72d08d8f29c0a06272d0503de6b73e5ecbc2a815a4b85f4937aab0569ba9f1e4fa04b2bb073a7183daefddf8d

Download Submit
C:\Windows\system\qrfWtjU.exe

Filesize
1.9MB

MD5
6d26142801dda2f9acbc27a10d7e49e4

SHA1
e5afb7072b41cd0c3f413162a9776612fca54f64

SHA256
252d285fabf9899fb3a552c122d38e97aec91945a27594e0562e6b078122f8a6

SHA512
7fc9bd54df647896170836a4f3e4fcda8e5fa4ff1ebc8300690061ab9f9e3a4a0030a1c03f955a7976150e2119232c4b0e8d8f34ea945c7e4b967e6b597260c1

Download Submit
C:\Windows\system\ytHHpqB.exe

Filesize
1.9MB

MD5
0d546c17583d8faf3c2e7a02fcb7e111

SHA1
b99a89c60c818f22bca0f02295e389a8fe80eed1

SHA256
e4db1b271c0aed0a4945eac36873ff3298017b7e217c8cbe230826ad0868f42c

SHA512
5549a14ae2d4e9ccbcb4e17d4ebad00ef65aafb54ce225aca92c9c0d666fd7b6f8d3230783e7830f8bfd8b9264839619b278e1a29758820e7c8019faa038a889

Download Submit
\Windows\system\BkghfqO.exe

Filesize
1.9MB

MD5
b81b13b8e2ada384211963fe56e2f54e

SHA1
5ed1d1984de12d8f72781fa7b597c7a2e07156be

SHA256
6f00ae66444db93429706a4529ab6c5f0fe16221e8c287c0fb3f0a938fc7cd9e

SHA512
26bf9460af81fe054c66a0cf9bcdf1fddc4a8243ac7ff26d2b22b3c02f62a222e5692d2c971b03d53307c4049e0331b7e0286f230e002b88a5d4200684b598e8

Download Submit
\Windows\system\CNVxaHw.exe

Filesize
1.9MB

MD5
41db75b774c8c9ee7d26200f027104d4

SHA1
cb2e9a623dd7fbbd84245fce65a949de71156954

SHA256
02e31324d156474cf6fe7522736c28a42cd8d9190f52b11ec19d6899cfbf7660

SHA512
6c87b3823fd0b6c2d4d313bbcc2182453bd830700d7457983bbbce07f31c0bf1f54a13a3492a65074ce297b6f11ce86a2b22f43a5bf93ac1038e412615643716

Download Submit
\Windows\system\Flcvehw.exe

Filesize
1.9MB

MD5
c7419881cd3ad773ca0ce4cbe8138862

SHA1
e181116b8022c9508d561428cb83d03b4e667e60

SHA256
7c1aeab4030b8281952d65f4238835d62507790ea57870b8953f062eb992c4e5

SHA512
bc91c52f138a660837d17ed897120b941c2ddf4fba6b4eb86de528f91f2ac7c3397628316ed739271f547ff01878266e8bfdd5b0651b62e1569584cb17aab410

Download Submit
\Windows\system\GzKgMmQ.exe

Filesize
1.9MB

MD5
3ca639e6344cef159f63606a3fd2c1bc

SHA1
4af481bb467fc873cc9d8f32d18034e95a89ceba

SHA256
5300e9c3f36dde3a48100bed5ec77ddb10902956092c9a878128766c646d0004

SHA512
55dcb3107ee9179e30a9072fb28a1563c49424f75069ae9623e0e6c4066b3aec0599df134a14c6f31a161cac135225a6fe823a10afc38db3914865064a25b36e

Download Submit
\Windows\system\KHDxhtL.exe

Filesize
1.9MB

MD5
3f6a69f236872f6a5ce01116040ea3df

SHA1
a42032a3ecd8e35a17ed4a7fd76c234bf58f68c3

SHA256
4d4ff3fd8c18a2d91aad95cb7af3d531e9377cea983bccb35dd481dbaaf66b16

SHA512
98e2ad33965e36c7743f7f3b47b5f542c9565a23d2e164d37008d752a188f7fa586c2e471269ba51107fca9e34a783a94aeb10f8e1e27a3ee5c5626edf50cbb3

Download Submit
\Windows\system\TpEslvr.exe

Filesize
1.9MB

MD5
96f44ffabc8aeac05ae7e18798b78e3f

SHA1
03546ded8eef36301f14674900137c78d26e308e

SHA256
2c11a7db3a890b11916b3709a62a87f0115119971102b5bf58853219ba5ada6e

SHA512
4edb308d5ee75f994182df5d5fe3041835e54c32e1b607521f86d401f7e96ed473ecbbc9c95ef810c0664ae879fd588affade4a1243a280203e55321fd9eef9d

Download Submit
\Windows\system\ZaYoDiW.exe

Filesize
1.9MB

MD5
23a2c3965ce6b77076ff89b27b503a09

SHA1
2e0922a039a337cc32b66e128327e4cdcbf43c9f

SHA256
9ab289ce179e26da3b8c8fe1a7f3bec8b8f0115bf82815f454223b4fa57981b4

SHA512
121a617c1e2d20a9d04fcebeb3af4828170de9a38e4a580dab81c13e1d518d3be73cd92a9519a56c4529930c0892516365b59729ac11094b05cfee5410545111

Download Submit
\Windows\system\aXqYdky.exe

Filesize
1.9MB

MD5
41946be9eb137b0267a00b722d7387d5

SHA1
1210167852a7147e6cef5fd2df5aabdd02ef7661

SHA256
dfc6996a4b4770060ea8cdb7088639be099fe8225cc54af66a8a6a29bd453b08

SHA512
ecd9fcf4b1c1db2ba138146c68f44a8fa4b1868e5dc8b5766674a776aabe337c9ddfdffc2f74bc1f07ade6a3edf4849abf5676eb4f50a9d349162ef90dbd1b32

Download Submit
\Windows\system\cHOWsAW.exe

Filesize
1.9MB

MD5
3f47aaa2d926b10132d6fe65acf1528b

SHA1
dbb347ccc772e93943c180fdfd9ff7d70bdb4bc6

SHA256
94453ecbbd763db1c4502cfa4772b15fd23a4eb29dc042b4866488dbe2aa7a18

SHA512
f3aef5801ba38e0522ba9af91adf1f74e22933be0622c0c9351e9d40f76a41954e388f972fa4d11f4802a776d8669a0446dc69386b47214a8c6c12b0c9a6e794

Download Submit
\Windows\system\dPiDpyb.exe

Filesize
1.9MB

MD5
55f67b75f1bda92eb77dff7dff1f6f3f

SHA1
9b9d0e6168bd70482e37f148329515cbf4b138e0

SHA256
f77fc024015f44baba149c8a6213631abda08ff88f6d2b773b1a4b803baf3112

SHA512
3db21ce68ba7cf3e59d8d41ca24dd76f8ec0917c31340481a8761b9c03b432d75d40293069bd16fba653437706f5dba32540c330fe614e0eb305fb066efe0ffd

Download Submit
\Windows\system\foyLALH.exe

Filesize
1.9MB

MD5
c25a169d4aa1fbbb9efb4aafd44201ef

SHA1
38458a937a5e30ba1c9d3a60aaf927e66c3ae23c

SHA256
d190ced3d1f6059dce2ef7d68db02867be6ca95ab971c90a1b6be4c4769181a9

SHA512
9c366b48289fa3bdff3a514d1da966542c61fb5dd0e98ca05ec0de4fba12eaeda933d36427e741b49c8eda962de88b8102da699e659154aa3e79af3cd031097a

Download Submit
\Windows\system\jTudGnO.exe

Filesize
1.9MB

MD5
bc1f57c56fc89c9ea6fb348e082790ea

SHA1
4761ed511bc05be7ed81c907e83ffbe41d85eee2

SHA256
0662f509376a4eef388b34124cf176899d063afeb2d15da349c092a6ee60e098

SHA512
03bb560aab0517222f2a139f8ddfd903ba00980eb15f6a1e00ebca103c5a5f9ddd444b396309890388f836f0c3ad1a9e7b03958af76172200d996c14e2a2fed5

Download Submit
\Windows\system\kkTrwwq.exe

Filesize
1.9MB

MD5
ec89e49e75a5b9600336ffd6c375f5ad

SHA1
27717d8a62f43b92778197a32217eab220efcb0f

SHA256
24e708d7def76ed63b1c2c5ab33391b8eb12d3364a008bff6f7805dc8da5e0d2

SHA512
3d6f5aab5a7751916210f81a2a8a9ada6669c2cf17fc763d8b2d250a49c5082c2c052650947d9bd5172989122f864be24d9232c4291c462b7d0c17e0dd1b4661

Download Submit
\Windows\system\lvSYEtN.exe

Filesize
1.9MB

MD5
2473d9380014493285837d8031c0fe09

SHA1
91a0f089451d152a0f46936d547d301816379dd1

SHA256
635e1cd2650942663ee43fbeeec3e146f2150c192c4a3cc722bad2114486fe9d

SHA512
6f3e707a1507481a3ed47a56fa1884f7f0f469e4c36e89ae6b6e2f24b60bc9d99f000d1dfa52017dd65e2754c3029be63e52981f1aee166d645b39d78152fe41

Download Submit
\Windows\system\mzGBwWp.exe

Filesize
1.9MB

MD5
06a23e6ef4d258143f46141129efdb70

SHA1
1a37bd531eed9f79893cd3dc5f9f440778d5b372

SHA256
394a730f4003d17ed08e7875ab39026b001e156af8ccae0e349bf5ec3c353230

SHA512
667781c2e68e6fd7df39842da5df240518da6c11f6d7baaf4fd3920c450c1ba95f501f6f35dbe21dab0cd6393afde82b4114c40f3f57950e7cc9f16da4e8e170

Download Submit
\Windows\system\qWShSzu.exe

Filesize
1.9MB

MD5
9159b7eab059b4e1573d044c34cdae3e

SHA1
0bcfd06818b59ce9febc2cdab467f16a0b392edb

SHA256
a5fe8b06fe9533665be10e6f8e7308519e6b2e7fbe083e4ab49a5eb537e74762

SHA512
77e274ff7c08e5b1c0181155760d80883f2b87b8121b4b252761d1ef6a1d9093c411ad58d77ec2da3aa4b415ba769ab328f0f1518a909f48928e0731b8098a05

Download Submit
\Windows\system\tiPmXAN.exe

Filesize
1.9MB

MD5
b86d2d69078fe8337d72b0731432b67a

SHA1
35e46c1afd4fa2b95c14c398956777345545109e

SHA256
5fa9f857fbb4685131ea903e85cb6c53688aa649feef9f029d1c46b6513ff855

SHA512
63e95fa03b4ac40cb4f53ef59792c083d236039d50ba59109684fd8ac77de137bb1dd0fe1666378dc32bed8770ba3505490e9c5a0c6c0d2c78e3b652aaf67eed

Download Submit
\Windows\system\zPtdHSF.exe

Filesize
1.9MB

MD5
22b45fec9671a912ff44624657609f6b

SHA1
bbdc77d65a0db8c27aabf372f7ab8961781da765

SHA256
ca7c3df40b0a1a10381c610868547302c616ac2b9fea656f95e72a01502fe64e

SHA512
503e9f8be27d75b758e7c17709574ed2e89737055176136eb96616277391bca44dee0f0d4aae2be1bd037e41661fb0068d221e1c7646af2d9b5d336b50022e25

Download Submit
memory/876-12-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2196-116-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2312-11-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-109-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2312-111-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-117-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2312-113-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-0-0x000000013F660000-0x000000013FA52000-memory.dmp

Filesize
3.9MB

Download
memory/2312-115-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-127-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/2312-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2312-121-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2312-107-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2312-119-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-118-0x000000013FE20000-0x0000000140212000-memory.dmp

Filesize
3.9MB

Download
memory/2560-114-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-120-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2828-112-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2832-110-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2900-108-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2904-106-0x000000013F120000-0x000000013F512000-memory.dmp

Filesize
3.9MB

Download
memory/3004-104-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3004-149-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/3004-13-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/3004-166-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/3004-105-0x0000000002A60000-0x0000000002AE0000-memory.dmp

Filesize
512KB

Download
memory/3004-515-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download