xmrig | 9e854150cc36fc734272d3adb59f389094950ce21b5ccd584df15da9af63aedc

Analysis

max time kernel
39s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
Size

1.8MB
MD5

08984a6d97b90ede38202a444e0ca949
SHA1

ca4f8dcd20883ff0bbbe8f6c2d64d7430c0ab291
SHA256

9e854150cc36fc734272d3adb59f389094950ce21b5ccd584df15da9af63aedc
SHA512

d903c4fa9672ac05ff767c5aa0a213933a5c6e7bf0c0f9b79d12cb5de7189d287ac557776f3f401e4333c2485118769ef75e82fb8cd5b5e763d383988f58268d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlN:NABa

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2716-9-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2148-134-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig
behavioral1/memory/2916-132-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2512-130-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2436-128-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2468-126-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2484-125-0x000000013F920000-0x000000013FD12000-memory.dmp	xmrig
behavioral1/memory/2688-122-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2244-114-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2672-113-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2576-109-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2716	hEpFfIo.exe
2588	bARNHHP.exe
2576	QCPvhar.exe
2672	DNofBSu.exe
2688	ijjoiAK.exe
2484	lywjLrv.exe
2468	LPkcpXK.exe
2436	NXkTqpd.exe
2512	WKReGtK.exe
2916	ZPzDgYD.exe
2148	YHHLiKy.exe
1656	EnXyxJH.exe
2676	mPerjpc.exe
2724	blmIYYB.exe
2652	FWUbUdg.exe
2884	gZuVZhN.exe
772	aXcOutX.exe
2224	dqZNkCe.exe
1688	FbryaAz.exe
1956	nqwSvcE.exe
1764	TofcjLk.exe
2280	LwKhCKU.exe
868	aXrryFw.exe
2948	VbrXvWq.exe
1040	jtwOjGz.exe
584	MJBUwvU.exe
1472	byqYBNv.exe
832	KnBdtFo.exe
1140	YycLZvd.exe
2308	VJXMscY.exe
2396	FiOBvFD.exe
2168	tbQjUvm.exe
996	ZeLrxvH.exe
288	GFALbYc.exe
1700	gLQqQpt.exe
776	GxSqpfo.exe
876	dWhlxgW.exe
2808	iDkSKKM.exe
1048	FHfmbMq.exe
916	HszGCog.exe
964	kGIuGUe.exe
1288	RIiDSmT.exe
1064	TuQlZwr.exe
2064	qXcSUyY.exe
2804	OeqvDyp.exe
468	xycDxpJ.exe
548	JWqfjXR.exe
2864	imzgaET.exe
2016	ZyQIbaJ.exe
3064	FpKEDKn.exe
896	bOgDCLO.exe
1504	SyTgqAr.exe
2368	TpXEhTm.exe
2364	UcRyWRV.exe
1572	JCzdLdI.exe
1728	oicubYT.exe
2192	VIOJxRC.exe
1284	OhcPLyL.exe
2600	sufYFZs.exe
2380	QDdBPqA.exe
2464	CbzrVvd.exe
2712	WbeYBLZ.exe
2608	FzrxYRP.exe
2472	iBFFzUs.exe

Loads dropped DLL 64 IoCs

pid	Process
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000013a06-3.dat	upx
behavioral1/memory/2244-2-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/memory/2716-9-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x0039000000015d56-10.dat	upx
behavioral1/memory/2588-15-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x0007000000015d93-24.dat	upx
behavioral1/files/0x0008000000015ecc-30.dat	upx
behavioral1/files/0x0006000000016d20-51.dat	upx
behavioral1/files/0x000900000001621e-44.dat	upx
behavioral1/files/0x0006000000016d3a-59.dat	upx
behavioral1/files/0x0006000000016d5f-71.dat	upx
behavioral1/files/0x0006000000016d9d-83.dat	upx
behavioral1/files/0x0039000000015d5f-140.dat	upx
behavioral1/files/0x0006000000016db9-138.dat	upx
behavioral1/files/0x00060000000171df-156.dat	upx
behavioral1/files/0x0015000000018644-167.dat	upx
behavioral1/files/0x0005000000018665-175.dat	upx
behavioral1/files/0x00050000000186fa-183.dat	upx
behavioral1/files/0x00050000000186f6-179.dat	upx
behavioral1/files/0x0031000000018649-171.dat	upx
behavioral1/files/0x0006000000017437-163.dat	upx
behavioral1/files/0x00060000000173d0-159.dat	upx
behavioral1/files/0x000600000001704a-149.dat	upx
behavioral1/files/0x000600000001708b-146.dat	upx
behavioral1/memory/2148-134-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2916-132-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0006000000016da5-89.dat	upx
behavioral1/memory/2512-130-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/memory/2436-128-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2468-126-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2484-125-0x000000013F920000-0x000000013FD12000-memory.dmp	upx
behavioral1/memory/2688-122-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2672-113-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x0006000000016dbe-112.dat	upx
behavioral1/files/0x0006000000016db1-111.dat	upx
behavioral1/memory/2576-109-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x0006000000016d8e-79.dat	upx
behavioral1/files/0x0006000000016d74-75.dat	upx
behavioral1/files/0x0006000000016d43-67.dat	upx
behavioral1/files/0x0006000000016d3e-63.dat	upx
behavioral1/files/0x0006000000016d34-56.dat	upx
behavioral1/files/0x0007000000015f65-35.dat	upx
behavioral1/files/0x0007000000015fe5-42.dat	upx
behavioral1/files/0x000e0000000054ab-28.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xWSbNkY.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\BHTnfch.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\IaZTIYi.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\xjKnqur.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\wLMOiPB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\zhomdyB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\SyTgqAr.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\lJISklA.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\OXOpUMh.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\PvAhCIH.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\TofcjLk.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\rviIEKW.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\XisAgrg.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\ZTKjCka.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\bQzGouu.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\LIHPTwX.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\ADuTkIt.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\CdCotqN.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\GFJXmQD.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\KbANIPp.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\bJVRmDP.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\CMnLnmM.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\pALwebp.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\JCmQyep.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\zasRKOH.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\mfpFzWy.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\YmNcJZv.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\mxVBPVa.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\TpyguwB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\bLvdtoz.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\opKxzAC.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\xzDMnAg.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\zygcHca.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\tvVdQZV.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\ZrSsAGG.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\cPqRrXK.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\cONtczP.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\AwBSKdA.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\nJnzBih.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\fSIhAhc.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\clXUotc.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\greZUst.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\zZqofxg.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\ocInkKc.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\PmDOKLU.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\HQUQVaC.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\SuWSMRo.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\xtiShpP.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\fwqyEQN.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\AELrCsv.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\PuFNnOx.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\DPdHCUO.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\jyMrdeB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\anHqjpv.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\AozjosD.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\blmIYYB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\qINBDkn.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\HnojJva.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\dkwyeTB.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\WDAYGUR.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\nuIOXXl.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\FWUbUdg.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\FMJhyNf.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
File created	C:\Windows\System\HRojBSi.exe	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2352	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
Token: SeDebugPrivilege	2352	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2352	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2352	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2352	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	29
PID 2244 wrote to memory of 2716	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2716	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2716	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	30
PID 2244 wrote to memory of 2588	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2588	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2588	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	31
PID 2244 wrote to memory of 2576	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2576	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2576	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	32
PID 2244 wrote to memory of 2672	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	33
PID 2244 wrote to memory of 2672	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	33
PID 2244 wrote to memory of 2672	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	33
PID 2244 wrote to memory of 2688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	34
PID 2244 wrote to memory of 2468	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2468	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2468	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	35
PID 2244 wrote to memory of 2484	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	36
PID 2244 wrote to memory of 2484	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	36
PID 2244 wrote to memory of 2484	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	36
PID 2244 wrote to memory of 2436	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	37
PID 2244 wrote to memory of 2436	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	37
PID 2244 wrote to memory of 2436	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	37
PID 2244 wrote to memory of 2512	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	38
PID 2244 wrote to memory of 2512	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	38
PID 2244 wrote to memory of 2512	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	38
PID 2244 wrote to memory of 2916	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	39
PID 2244 wrote to memory of 2916	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	39
PID 2244 wrote to memory of 2916	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	39
PID 2244 wrote to memory of 2148	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	40
PID 2244 wrote to memory of 2148	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	40
PID 2244 wrote to memory of 2148	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	40
PID 2244 wrote to memory of 1656	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	41
PID 2244 wrote to memory of 1656	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	41
PID 2244 wrote to memory of 1656	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	41
PID 2244 wrote to memory of 2676	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	42
PID 2244 wrote to memory of 2676	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	42
PID 2244 wrote to memory of 2676	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	42
PID 2244 wrote to memory of 2724	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	43
PID 2244 wrote to memory of 2724	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	43
PID 2244 wrote to memory of 2724	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	43
PID 2244 wrote to memory of 2652	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	44
PID 2244 wrote to memory of 2652	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	44
PID 2244 wrote to memory of 2652	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	44
PID 2244 wrote to memory of 2884	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	45
PID 2244 wrote to memory of 2884	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	45
PID 2244 wrote to memory of 2884	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	45
PID 2244 wrote to memory of 772	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	46
PID 2244 wrote to memory of 772	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	46
PID 2244 wrote to memory of 772	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	46
PID 2244 wrote to memory of 2224	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	47
PID 2244 wrote to memory of 2224	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	47
PID 2244 wrote to memory of 2224	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	47
PID 2244 wrote to memory of 1688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	48
PID 2244 wrote to memory of 1688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	48
PID 2244 wrote to memory of 1688	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	48
PID 2244 wrote to memory of 1764	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	49
PID 2244 wrote to memory of 1764	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	49
PID 2244 wrote to memory of 1764	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	49
PID 2244 wrote to memory of 1956	2244	08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08984a6d97b90ede38202a444e0ca949_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\System\hEpFfIo.exe
  C:\Windows\System\hEpFfIo.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\bARNHHP.exe
  C:\Windows\System\bARNHHP.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\QCPvhar.exe
  C:\Windows\System\QCPvhar.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\DNofBSu.exe
  C:\Windows\System\DNofBSu.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ijjoiAK.exe
  C:\Windows\System\ijjoiAK.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LPkcpXK.exe
  C:\Windows\System\LPkcpXK.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\lywjLrv.exe
  C:\Windows\System\lywjLrv.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\NXkTqpd.exe
  C:\Windows\System\NXkTqpd.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\WKReGtK.exe
  C:\Windows\System\WKReGtK.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\ZPzDgYD.exe
  C:\Windows\System\ZPzDgYD.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\YHHLiKy.exe
  C:\Windows\System\YHHLiKy.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\EnXyxJH.exe
  C:\Windows\System\EnXyxJH.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\mPerjpc.exe
  C:\Windows\System\mPerjpc.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\blmIYYB.exe
  C:\Windows\System\blmIYYB.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\FWUbUdg.exe
  C:\Windows\System\FWUbUdg.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\gZuVZhN.exe
  C:\Windows\System\gZuVZhN.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\aXcOutX.exe
  C:\Windows\System\aXcOutX.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\dqZNkCe.exe
  C:\Windows\System\dqZNkCe.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\FbryaAz.exe
  C:\Windows\System\FbryaAz.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\TofcjLk.exe
  C:\Windows\System\TofcjLk.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\nqwSvcE.exe
  C:\Windows\System\nqwSvcE.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\aXrryFw.exe
  C:\Windows\System\aXrryFw.exe
  2⤵
  - Executes dropped EXE
  PID:868
- C:\Windows\System\LwKhCKU.exe
  C:\Windows\System\LwKhCKU.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\VbrXvWq.exe
  C:\Windows\System\VbrXvWq.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\jtwOjGz.exe
  C:\Windows\System\jtwOjGz.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\MJBUwvU.exe
  C:\Windows\System\MJBUwvU.exe
  2⤵
  - Executes dropped EXE
  PID:584
- C:\Windows\System\byqYBNv.exe
  C:\Windows\System\byqYBNv.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\KnBdtFo.exe
  C:\Windows\System\KnBdtFo.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\YycLZvd.exe
  C:\Windows\System\YycLZvd.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\VJXMscY.exe
  C:\Windows\System\VJXMscY.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\FiOBvFD.exe
  C:\Windows\System\FiOBvFD.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\tbQjUvm.exe
  C:\Windows\System\tbQjUvm.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\ZeLrxvH.exe
  C:\Windows\System\ZeLrxvH.exe
  2⤵
  - Executes dropped EXE
  PID:996
- C:\Windows\System\GFALbYc.exe
  C:\Windows\System\GFALbYc.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\gLQqQpt.exe
  C:\Windows\System\gLQqQpt.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\dWhlxgW.exe
  C:\Windows\System\dWhlxgW.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\GxSqpfo.exe
  C:\Windows\System\GxSqpfo.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\iDkSKKM.exe
  C:\Windows\System\iDkSKKM.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\FHfmbMq.exe
  C:\Windows\System\FHfmbMq.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\HszGCog.exe
  C:\Windows\System\HszGCog.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\kGIuGUe.exe
  C:\Windows\System\kGIuGUe.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\RIiDSmT.exe
  C:\Windows\System\RIiDSmT.exe
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Windows\System\TuQlZwr.exe
  C:\Windows\System\TuQlZwr.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\qXcSUyY.exe
  C:\Windows\System\qXcSUyY.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\OeqvDyp.exe
  C:\Windows\System\OeqvDyp.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\xycDxpJ.exe
  C:\Windows\System\xycDxpJ.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\JWqfjXR.exe
  C:\Windows\System\JWqfjXR.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\imzgaET.exe
  C:\Windows\System\imzgaET.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\ZyQIbaJ.exe
  C:\Windows\System\ZyQIbaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\FpKEDKn.exe
  C:\Windows\System\FpKEDKn.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\bOgDCLO.exe
  C:\Windows\System\bOgDCLO.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\SyTgqAr.exe
  C:\Windows\System\SyTgqAr.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\TpXEhTm.exe
  C:\Windows\System\TpXEhTm.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\UcRyWRV.exe
  C:\Windows\System\UcRyWRV.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\JCzdLdI.exe
  C:\Windows\System\JCzdLdI.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\oicubYT.exe
  C:\Windows\System\oicubYT.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\VIOJxRC.exe
  C:\Windows\System\VIOJxRC.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\OhcPLyL.exe
  C:\Windows\System\OhcPLyL.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\sufYFZs.exe
  C:\Windows\System\sufYFZs.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\QDdBPqA.exe
  C:\Windows\System\QDdBPqA.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\CbzrVvd.exe
  C:\Windows\System\CbzrVvd.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\WbeYBLZ.exe
  C:\Windows\System\WbeYBLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\FzrxYRP.exe
  C:\Windows\System\FzrxYRP.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\iBFFzUs.exe
  C:\Windows\System\iBFFzUs.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\BfHjVvt.exe
  C:\Windows\System\BfHjVvt.exe
  2⤵
  PID:2960
- C:\Windows\System\FOQTwpZ.exe
  C:\Windows\System\FOQTwpZ.exe
  2⤵
  PID:2744
- C:\Windows\System\JADbxvu.exe
  C:\Windows\System\JADbxvu.exe
  2⤵
  PID:2528
- C:\Windows\System\XhXBiHM.exe
  C:\Windows\System\XhXBiHM.exe
  2⤵
  PID:1692
- C:\Windows\System\KSDJBJk.exe
  C:\Windows\System\KSDJBJk.exe
  2⤵
  PID:1784
- C:\Windows\System\FNamFVk.exe
  C:\Windows\System\FNamFVk.exe
  2⤵
  PID:2328
- C:\Windows\System\kBojLLW.exe
  C:\Windows\System\kBojLLW.exe
  2⤵
  PID:1332
- C:\Windows\System\QMKMRIf.exe
  C:\Windows\System\QMKMRIf.exe
  2⤵
  PID:1576
- C:\Windows\System\QYSVcVC.exe
  C:\Windows\System\QYSVcVC.exe
  2⤵
  PID:1580
- C:\Windows\System\nipRDjT.exe
  C:\Windows\System\nipRDjT.exe
  2⤵
  PID:3044
- C:\Windows\System\TFnqyEG.exe
  C:\Windows\System\TFnqyEG.exe
  2⤵
  PID:2668
- C:\Windows\System\XNiAHeB.exe
  C:\Windows\System\XNiAHeB.exe
  2⤵
  PID:2704
- C:\Windows\System\jyMrdeB.exe
  C:\Windows\System\jyMrdeB.exe
  2⤵
  PID:2216
- C:\Windows\System\NiFaMYw.exe
  C:\Windows\System\NiFaMYw.exe
  2⤵
  PID:1264
- C:\Windows\System\AmAyqfH.exe
  C:\Windows\System\AmAyqfH.exe
  2⤵
  PID:2480
- C:\Windows\System\pALwebp.exe
  C:\Windows\System\pALwebp.exe
  2⤵
  PID:2920
- C:\Windows\System\YhNLmWX.exe
  C:\Windows\System\YhNLmWX.exe
  2⤵
  PID:2736
- C:\Windows\System\RqsdTjk.exe
  C:\Windows\System\RqsdTjk.exe
  2⤵
  PID:3028
- C:\Windows\System\GkBuyHJ.exe
  C:\Windows\System\GkBuyHJ.exe
  2⤵
  PID:1104
- C:\Windows\System\jJjrQgv.exe
  C:\Windows\System\jJjrQgv.exe
  2⤵
  PID:1856
- C:\Windows\System\QWCXNtd.exe
  C:\Windows\System\QWCXNtd.exe
  2⤵
  PID:2200
- C:\Windows\System\ppooRjZ.exe
  C:\Windows\System\ppooRjZ.exe
  2⤵
  PID:1532
- C:\Windows\System\RTLISNk.exe
  C:\Windows\System\RTLISNk.exe
  2⤵
  PID:1632
- C:\Windows\System\lJISklA.exe
  C:\Windows\System\lJISklA.exe
  2⤵
  PID:1032
- C:\Windows\System\vjhtcAT.exe
  C:\Windows\System\vjhtcAT.exe
  2⤵
  PID:1328
- C:\Windows\System\pqopDLJ.exe
  C:\Windows\System\pqopDLJ.exe
  2⤵
  PID:2868
- C:\Windows\System\MLTLIdA.exe
  C:\Windows\System\MLTLIdA.exe
  2⤵
  PID:2860
- C:\Windows\System\wdIsbpH.exe
  C:\Windows\System\wdIsbpH.exe
  2⤵
  PID:2132
- C:\Windows\System\jCCtuNe.exe
  C:\Windows\System\jCCtuNe.exe
  2⤵
  PID:2080
- C:\Windows\System\SyiuTPY.exe
  C:\Windows\System\SyiuTPY.exe
  2⤵
  PID:2852
- C:\Windows\System\tyxXzRZ.exe
  C:\Windows\System\tyxXzRZ.exe
  2⤵
  PID:1560
- C:\Windows\System\PrnzqMd.exe
  C:\Windows\System\PrnzqMd.exe
  2⤵
  PID:2976
- C:\Windows\System\LtRlBwq.exe
  C:\Windows\System\LtRlBwq.exe
  2⤵
  PID:3032
- C:\Windows\System\qosTDsg.exe
  C:\Windows\System\qosTDsg.exe
  2⤵
  PID:1732
- C:\Windows\System\ruVoroX.exe
  C:\Windows\System\ruVoroX.exe
  2⤵
  PID:1872
- C:\Windows\System\KpcvAmd.exe
  C:\Windows\System\KpcvAmd.exe
  2⤵
  PID:1600
- C:\Windows\System\ujlLCtq.exe
  C:\Windows\System\ujlLCtq.exe
  2⤵
  PID:552
- C:\Windows\System\tWqAxMG.exe
  C:\Windows\System\tWqAxMG.exe
  2⤵
  PID:2692
- C:\Windows\System\bJSQjzw.exe
  C:\Windows\System\bJSQjzw.exe
  2⤵
  PID:2648
- C:\Windows\System\LCehsUg.exe
  C:\Windows\System\LCehsUg.exe
  2⤵
  PID:2176
- C:\Windows\System\CGWDkjJ.exe
  C:\Windows\System\CGWDkjJ.exe
  2⤵
  PID:1996
- C:\Windows\System\fCvlSdA.exe
  C:\Windows\System\fCvlSdA.exe
  2⤵
  PID:2892
- C:\Windows\System\aDDweWn.exe
  C:\Windows\System\aDDweWn.exe
  2⤵
  PID:2536
- C:\Windows\System\oftXjSl.exe
  C:\Windows\System\oftXjSl.exe
  2⤵
  PID:2180
- C:\Windows\System\teFQpqg.exe
  C:\Windows\System\teFQpqg.exe
  2⤵
  PID:1924
- C:\Windows\System\bJdgltD.exe
  C:\Windows\System\bJdgltD.exe
  2⤵
  PID:2940
- C:\Windows\System\VvymLex.exe
  C:\Windows\System\VvymLex.exe
  2⤵
  PID:2440
- C:\Windows\System\zsSzgJb.exe
  C:\Windows\System\zsSzgJb.exe
  2⤵
  PID:2444
- C:\Windows\System\xshehky.exe
  C:\Windows\System\xshehky.exe
  2⤵
  PID:536
- C:\Windows\System\LRCNKim.exe
  C:\Windows\System\LRCNKim.exe
  2⤵
  PID:600
- C:\Windows\System\TpyguwB.exe
  C:\Windows\System\TpyguwB.exe
  2⤵
  PID:2936
- C:\Windows\System\vLTnmiQ.exe
  C:\Windows\System\vLTnmiQ.exe
  2⤵
  PID:1780
- C:\Windows\System\QpgBfzv.exe
  C:\Windows\System\QpgBfzv.exe
  2⤵
  PID:1696
- C:\Windows\System\tiyrnBL.exe
  C:\Windows\System\tiyrnBL.exe
  2⤵
  PID:1612
- C:\Windows\System\OnFnPyi.exe
  C:\Windows\System\OnFnPyi.exe
  2⤵
  PID:2424
- C:\Windows\System\PtTKQwr.exe
  C:\Windows\System\PtTKQwr.exe
  2⤵
  PID:612
- C:\Windows\System\RAovOuB.exe
  C:\Windows\System\RAovOuB.exe
  2⤵
  PID:2664
- C:\Windows\System\XmdrrGt.exe
  C:\Windows\System\XmdrrGt.exe
  2⤵
  PID:2544
- C:\Windows\System\mJymSwU.exe
  C:\Windows\System\mJymSwU.exe
  2⤵
  PID:352
- C:\Windows\System\xDeWZFl.exe
  C:\Windows\System\xDeWZFl.exe
  2⤵
  PID:840
- C:\Windows\System\rcWemHQ.exe
  C:\Windows\System\rcWemHQ.exe
  2⤵
  PID:1296
- C:\Windows\System\qOnBgmv.exe
  C:\Windows\System\qOnBgmv.exe
  2⤵
  PID:2632
- C:\Windows\System\uXuovum.exe
  C:\Windows\System\uXuovum.exe
  2⤵
  PID:2896
- C:\Windows\System\psGgCZI.exe
  C:\Windows\System\psGgCZI.exe
  2⤵
  PID:1796
- C:\Windows\System\BVBBTko.exe
  C:\Windows\System\BVBBTko.exe
  2⤵
  PID:1540
- C:\Windows\System\AOhDfmu.exe
  C:\Windows\System\AOhDfmu.exe
  2⤵
  PID:1636
- C:\Windows\System\KQphDUi.exe
  C:\Windows\System\KQphDUi.exe
  2⤵
  PID:2776
- C:\Windows\System\uUCDvGk.exe
  C:\Windows\System\uUCDvGk.exe
  2⤵
  PID:2416
- C:\Windows\System\zUMtEPJ.exe
  C:\Windows\System\zUMtEPJ.exe
  2⤵
  PID:1648
- C:\Windows\System\pwkcfoT.exe
  C:\Windows\System\pwkcfoT.exe
  2⤵
  PID:1604
- C:\Windows\System\SlQLUtP.exe
  C:\Windows\System\SlQLUtP.exe
  2⤵
  PID:2792
- C:\Windows\System\CXakzKd.exe
  C:\Windows\System\CXakzKd.exe
  2⤵
  PID:2508
- C:\Windows\System\RSOZmuT.exe
  C:\Windows\System\RSOZmuT.exe
  2⤵
  PID:1684
- C:\Windows\System\FfwqYGQ.exe
  C:\Windows\System\FfwqYGQ.exe
  2⤵
  PID:1824
- C:\Windows\System\tNxRcuF.exe
  C:\Windows\System\tNxRcuF.exe
  2⤵
  PID:2768
- C:\Windows\System\lLVoeRd.exe
  C:\Windows\System\lLVoeRd.exe
  2⤵
  PID:892
- C:\Windows\System\QjluewG.exe
  C:\Windows\System\QjluewG.exe
  2⤵
  PID:2928
- C:\Windows\System\KbANIPp.exe
  C:\Windows\System\KbANIPp.exe
  2⤵
  PID:984
- C:\Windows\System\ZDMqowo.exe
  C:\Windows\System\ZDMqowo.exe
  2⤵
  PID:848
- C:\Windows\System\kBIyFwN.exe
  C:\Windows\System\kBIyFwN.exe
  2⤵
  PID:768
- C:\Windows\System\JnKdftS.exe
  C:\Windows\System\JnKdftS.exe
  2⤵
  PID:3012
- C:\Windows\System\ZLofRBC.exe
  C:\Windows\System\ZLofRBC.exe
  2⤵
  PID:2604
- C:\Windows\System\HQUQVaC.exe
  C:\Windows\System\HQUQVaC.exe
  2⤵
  PID:2568
- C:\Windows\System\JRTPybF.exe
  C:\Windows\System\JRTPybF.exe
  2⤵
  PID:1660
- C:\Windows\System\HwSEFCd.exe
  C:\Windows\System\HwSEFCd.exe
  2⤵
  PID:2612
- C:\Windows\System\zHgyhQM.exe
  C:\Windows\System\zHgyhQM.exe
  2⤵
  PID:1280
- C:\Windows\System\VrCNGFY.exe
  C:\Windows\System\VrCNGFY.exe
  2⤵
  PID:2980
- C:\Windows\System\OSEQlTW.exe
  C:\Windows\System\OSEQlTW.exe
  2⤵
  PID:2992
- C:\Windows\System\LtRmNQt.exe
  C:\Windows\System\LtRmNQt.exe
  2⤵
  PID:2788
- C:\Windows\System\KFXBQze.exe
  C:\Windows\System\KFXBQze.exe
  2⤵
  PID:1644
- C:\Windows\System\epJQKkU.exe
  C:\Windows\System\epJQKkU.exe
  2⤵
  PID:1136
- C:\Windows\System\EbLoVrL.exe
  C:\Windows\System\EbLoVrL.exe
  2⤵
  PID:1624
- C:\Windows\System\uUKqxvv.exe
  C:\Windows\System\uUKqxvv.exe
  2⤵
  PID:2888
- C:\Windows\System\yfJJuUB.exe
  C:\Windows\System\yfJJuUB.exe
  2⤵
  PID:444
- C:\Windows\System\UaNeoXe.exe
  C:\Windows\System\UaNeoXe.exe
  2⤵
  PID:2580
- C:\Windows\System\rBfmzpc.exe
  C:\Windows\System\rBfmzpc.exe
  2⤵
  PID:2728
- C:\Windows\System\nAToeqJ.exe
  C:\Windows\System\nAToeqJ.exe
  2⤵
  PID:2932
- C:\Windows\System\bJVRmDP.exe
  C:\Windows\System\bJVRmDP.exe
  2⤵
  PID:2012
- C:\Windows\System\LbkQZXQ.exe
  C:\Windows\System\LbkQZXQ.exe
  2⤵
  PID:2924
- C:\Windows\System\OVvCkHK.exe
  C:\Windows\System\OVvCkHK.exe
  2⤵
  PID:852
- C:\Windows\System\ckBqeyz.exe
  C:\Windows\System\ckBqeyz.exe
  2⤵
  PID:1588
- C:\Windows\System\WwUrloW.exe
  C:\Windows\System\WwUrloW.exe
  2⤵
  PID:824
- C:\Windows\System\IqbTAET.exe
  C:\Windows\System\IqbTAET.exe
  2⤵
  PID:2824
- C:\Windows\System\UjLyJVU.exe
  C:\Windows\System\UjLyJVU.exe
  2⤵
  PID:496
- C:\Windows\System\uqoWeTZ.exe
  C:\Windows\System\uqoWeTZ.exe
  2⤵
  PID:1152
- C:\Windows\System\lNNaFcc.exe
  C:\Windows\System\lNNaFcc.exe
  2⤵
  PID:2616
- C:\Windows\System\tiYOCRi.exe
  C:\Windows\System\tiYOCRi.exe
  2⤵
  PID:1232
- C:\Windows\System\JsxligT.exe
  C:\Windows\System\JsxligT.exe
  2⤵
  PID:3084
- C:\Windows\System\BgPJJqL.exe
  C:\Windows\System\BgPJJqL.exe
  2⤵
  PID:3100
- C:\Windows\System\XMmhizP.exe
  C:\Windows\System\XMmhizP.exe
  2⤵
  PID:3116
- C:\Windows\System\grGCcMD.exe
  C:\Windows\System\grGCcMD.exe
  2⤵
  PID:3132
- C:\Windows\System\mMWUwnL.exe
  C:\Windows\System\mMWUwnL.exe
  2⤵
  PID:3148
- C:\Windows\System\fGygQsa.exe
  C:\Windows\System\fGygQsa.exe
  2⤵
  PID:3168
- C:\Windows\System\uUzxgFy.exe
  C:\Windows\System\uUzxgFy.exe
  2⤵
  PID:3184
- C:\Windows\System\ztaEMJg.exe
  C:\Windows\System\ztaEMJg.exe
  2⤵
  PID:3200
- C:\Windows\System\qbfoqyC.exe
  C:\Windows\System\qbfoqyC.exe
  2⤵
  PID:3216
- C:\Windows\System\DiXZAUf.exe
  C:\Windows\System\DiXZAUf.exe
  2⤵
  PID:3232
- C:\Windows\System\sUmKJbi.exe
  C:\Windows\System\sUmKJbi.exe
  2⤵
  PID:3252
- C:\Windows\System\mdPLHuC.exe
  C:\Windows\System\mdPLHuC.exe
  2⤵
  PID:3268
- C:\Windows\System\anHqjpv.exe
  C:\Windows\System\anHqjpv.exe
  2⤵
  PID:3284
- C:\Windows\System\QsiWYpW.exe
  C:\Windows\System\QsiWYpW.exe
  2⤵
  PID:3300
- C:\Windows\System\BkfndyC.exe
  C:\Windows\System\BkfndyC.exe
  2⤵
  PID:3388
- C:\Windows\System\IbHkhcY.exe
  C:\Windows\System\IbHkhcY.exe
  2⤵
  PID:3404
- C:\Windows\System\RjaFHeU.exe
  C:\Windows\System\RjaFHeU.exe
  2⤵
  PID:3420
- C:\Windows\System\pbvllfv.exe
  C:\Windows\System\pbvllfv.exe
  2⤵
  PID:3440
- C:\Windows\System\Ntfnkmb.exe
  C:\Windows\System\Ntfnkmb.exe
  2⤵
  PID:3456
- C:\Windows\System\TmFzWxH.exe
  C:\Windows\System\TmFzWxH.exe
  2⤵
  PID:3472
- C:\Windows\System\RVpvMeL.exe
  C:\Windows\System\RVpvMeL.exe
  2⤵
  PID:3516
- C:\Windows\System\fcCBacB.exe
  C:\Windows\System\fcCBacB.exe
  2⤵
  PID:3536
- C:\Windows\System\TxkbxTP.exe
  C:\Windows\System\TxkbxTP.exe
  2⤵
  PID:3564
- C:\Windows\System\Yzdzopp.exe
  C:\Windows\System\Yzdzopp.exe
  2⤵
  PID:3584
- C:\Windows\System\HIFXBUm.exe
  C:\Windows\System\HIFXBUm.exe
  2⤵
  PID:3604
- C:\Windows\System\ZgbMxsT.exe
  C:\Windows\System\ZgbMxsT.exe
  2⤵
  PID:3624
- C:\Windows\System\gjRIVtY.exe
  C:\Windows\System\gjRIVtY.exe
  2⤵
  PID:3648
- C:\Windows\System\isUxtBp.exe
  C:\Windows\System\isUxtBp.exe
  2⤵
  PID:3664
- C:\Windows\System\OdsjXRP.exe
  C:\Windows\System\OdsjXRP.exe
  2⤵
  PID:3688
- C:\Windows\System\IgxWFeS.exe
  C:\Windows\System\IgxWFeS.exe
  2⤵
  PID:3704
- C:\Windows\System\oZJjQuY.exe
  C:\Windows\System\oZJjQuY.exe
  2⤵
  PID:3728
- C:\Windows\System\VjIXMNF.exe
  C:\Windows\System\VjIXMNF.exe
  2⤵
  PID:3744
- C:\Windows\System\ptXMlXn.exe
  C:\Windows\System\ptXMlXn.exe
  2⤵
  PID:3772
- C:\Windows\System\GhjdFaL.exe
  C:\Windows\System\GhjdFaL.exe
  2⤵
  PID:3788
- C:\Windows\System\JoKxRkY.exe
  C:\Windows\System\JoKxRkY.exe
  2⤵
  PID:3812
- C:\Windows\System\hksXgmq.exe
  C:\Windows\System\hksXgmq.exe
  2⤵
  PID:3828
- C:\Windows\System\qAIMHuJ.exe
  C:\Windows\System\qAIMHuJ.exe
  2⤵
  PID:3852
- C:\Windows\System\sNqgUmC.exe
  C:\Windows\System\sNqgUmC.exe
  2⤵
  PID:3872
- C:\Windows\System\KLmtWKr.exe
  C:\Windows\System\KLmtWKr.exe
  2⤵
  PID:3892
- C:\Windows\System\dyhaXyH.exe
  C:\Windows\System\dyhaXyH.exe
  2⤵
  PID:3908
- C:\Windows\System\yKqQcEf.exe
  C:\Windows\System\yKqQcEf.exe
  2⤵
  PID:3932
- C:\Windows\System\dVrAfKd.exe
  C:\Windows\System\dVrAfKd.exe
  2⤵
  PID:3948
- C:\Windows\System\oMsdlfZ.exe
  C:\Windows\System\oMsdlfZ.exe
  2⤵
  PID:3972
- C:\Windows\System\oaejagn.exe
  C:\Windows\System\oaejagn.exe
  2⤵
  PID:3988
- C:\Windows\System\fllsQyD.exe
  C:\Windows\System\fllsQyD.exe
  2⤵
  PID:4012
- C:\Windows\System\tMNnTqM.exe
  C:\Windows\System\tMNnTqM.exe
  2⤵
  PID:4032
- C:\Windows\System\cONtczP.exe
  C:\Windows\System\cONtczP.exe
  2⤵
  PID:4052
- C:\Windows\System\EytlSrA.exe
  C:\Windows\System\EytlSrA.exe
  2⤵
  PID:4068
- C:\Windows\System\TKJJXuJ.exe
  C:\Windows\System\TKJJXuJ.exe
  2⤵
  PID:4092
- C:\Windows\System\WRMaDBL.exe
  C:\Windows\System\WRMaDBL.exe
  2⤵
  PID:572
- C:\Windows\System\wonqSkE.exe
  C:\Windows\System\wonqSkE.exe
  2⤵
  PID:1976
- C:\Windows\System\upXDZsc.exe
  C:\Windows\System\upXDZsc.exe
  2⤵
  PID:1524
- C:\Windows\System\PhpcPqX.exe
  C:\Windows\System\PhpcPqX.exe
  2⤵
  PID:2024
- C:\Windows\System\SzUIEKb.exe
  C:\Windows\System\SzUIEKb.exe
  2⤵
  PID:3080
- C:\Windows\System\cMRGTPa.exe
  C:\Windows\System\cMRGTPa.exe
  2⤵
  PID:3208
- C:\Windows\System\rWwjhCM.exe
  C:\Windows\System\rWwjhCM.exe
  2⤵
  PID:3276
- C:\Windows\System\NRBiMdY.exe
  C:\Windows\System\NRBiMdY.exe
  2⤵
  PID:3320
- C:\Windows\System\OzvNUUo.exe
  C:\Windows\System\OzvNUUo.exe
  2⤵
  PID:3336
- C:\Windows\System\rvhXZHw.exe
  C:\Windows\System\rvhXZHw.exe
  2⤵
  PID:3352
- C:\Windows\System\cgpgOLo.exe
  C:\Windows\System\cgpgOLo.exe
  2⤵
  PID:3368
- C:\Windows\System\mpRbtKv.exe
  C:\Windows\System\mpRbtKv.exe
  2⤵
  PID:1820
- C:\Windows\System\FKWyWSv.exe
  C:\Windows\System\FKWyWSv.exe
  2⤵
  PID:3312
- C:\Windows\System\kHFCuDr.exe
  C:\Windows\System\kHFCuDr.exe
  2⤵
  PID:3196
- C:\Windows\System\pAmcUTF.exe
  C:\Windows\System\pAmcUTF.exe
  2⤵
  PID:3264
- C:\Windows\System\NwyhtVw.exe
  C:\Windows\System\NwyhtVw.exe
  2⤵
  PID:3480
- C:\Windows\System\VkeJUKx.exe
  C:\Windows\System\VkeJUKx.exe
  2⤵
  PID:3416
- C:\Windows\System\GzCoHbc.exe
  C:\Windows\System\GzCoHbc.exe
  2⤵
  PID:3496
- C:\Windows\System\hQKoSPu.exe
  C:\Windows\System\hQKoSPu.exe
  2⤵
  PID:3508
- C:\Windows\System\luNxMdL.exe
  C:\Windows\System\luNxMdL.exe
  2⤵
  PID:3468
- C:\Windows\System\gMKYHui.exe
  C:\Windows\System\gMKYHui.exe
  2⤵
  PID:3544
- C:\Windows\System\qVmYcxN.exe
  C:\Windows\System\qVmYcxN.exe
  2⤵
  PID:3556
- C:\Windows\System\DgQvxDD.exe
  C:\Windows\System\DgQvxDD.exe
  2⤵
  PID:3592
- C:\Windows\System\kAilOoa.exe
  C:\Windows\System\kAilOoa.exe
  2⤵
  PID:3612
- C:\Windows\System\mpvRYhT.exe
  C:\Windows\System\mpvRYhT.exe
  2⤵
  PID:3640
- C:\Windows\System\qxWBoHH.exe
  C:\Windows\System\qxWBoHH.exe
  2⤵
  PID:3660
- C:\Windows\System\wjQfMEP.exe
  C:\Windows\System\wjQfMEP.exe
  2⤵
  PID:3684
- C:\Windows\System\aXFkySu.exe
  C:\Windows\System\aXFkySu.exe
  2⤵
  PID:3716
- C:\Windows\System\xIcuPPo.exe
  C:\Windows\System\xIcuPPo.exe
  2⤵
  PID:3736
- C:\Windows\System\jQQmHWO.exe
  C:\Windows\System\jQQmHWO.exe
  2⤵
  PID:3764
- C:\Windows\System\nbSsSDc.exe
  C:\Windows\System\nbSsSDc.exe
  2⤵
  PID:3784
- C:\Windows\System\PcCwyNV.exe
  C:\Windows\System\PcCwyNV.exe
  2⤵
  PID:3800
- C:\Windows\System\LtlrSXh.exe
  C:\Windows\System\LtlrSXh.exe
  2⤵
  PID:3844
- C:\Windows\System\PsbWQlN.exe
  C:\Windows\System\PsbWQlN.exe
  2⤵
  PID:3868
- C:\Windows\System\tmDsqDa.exe
  C:\Windows\System\tmDsqDa.exe
  2⤵
  PID:3884
- C:\Windows\System\tUaUhrJ.exe
  C:\Windows\System\tUaUhrJ.exe
  2⤵
  PID:3924
- C:\Windows\System\TfcqWNj.exe
  C:\Windows\System\TfcqWNj.exe
  2⤵
  PID:3956
- C:\Windows\System\ihgmCFw.exe
  C:\Windows\System\ihgmCFw.exe
  2⤵
  PID:3964
- C:\Windows\System\DvyocmT.exe
  C:\Windows\System\DvyocmT.exe
  2⤵
  PID:4000
- C:\Windows\System\nwTcEDZ.exe
  C:\Windows\System\nwTcEDZ.exe
  2⤵
  PID:4024
- C:\Windows\System\rCkWIGw.exe
  C:\Windows\System\rCkWIGw.exe
  2⤵
  PID:4044
- C:\Windows\System\SeapTVT.exe
  C:\Windows\System\SeapTVT.exe
  2⤵
  PID:4084
- C:\Windows\System\VArovIN.exe
  C:\Windows\System\VArovIN.exe
  2⤵
  PID:1516
- C:\Windows\System\CUXliwo.exe
  C:\Windows\System\CUXliwo.exe
  2⤵
  PID:2172
- C:\Windows\System\yjZIxor.exe
  C:\Windows\System\yjZIxor.exe
  2⤵
  PID:2784
- C:\Windows\System\LWEGvRr.exe
  C:\Windows\System\LWEGvRr.exe
  2⤵
  PID:3076
- C:\Windows\System\hoGAwTr.exe
  C:\Windows\System\hoGAwTr.exe
  2⤵
  PID:3180
- C:\Windows\System\MwFGZGS.exe
  C:\Windows\System\MwFGZGS.exe
  2⤵
  PID:3376
- C:\Windows\System\ZGDOvsj.exe
  C:\Windows\System\ZGDOvsj.exe
  2⤵
  PID:3380
- C:\Windows\System\INgefzg.exe
  C:\Windows\System\INgefzg.exe
  2⤵
  PID:4100
- C:\Windows\System\nZgdTzX.exe
  C:\Windows\System\nZgdTzX.exe
  2⤵
  PID:4116
- C:\Windows\System\iiRIfcl.exe
  C:\Windows\System\iiRIfcl.exe
  2⤵
  PID:4132
- C:\Windows\System\KrOcKZr.exe
  C:\Windows\System\KrOcKZr.exe
  2⤵
  PID:4148
- C:\Windows\System\AtGSZsT.exe
  C:\Windows\System\AtGSZsT.exe
  2⤵
  PID:4220
- C:\Windows\System\UuMCjND.exe
  C:\Windows\System\UuMCjND.exe
  2⤵
  PID:4236
- C:\Windows\System\mztirbY.exe
  C:\Windows\System\mztirbY.exe
  2⤵
  PID:4252
- C:\Windows\System\lLrPwrZ.exe
  C:\Windows\System\lLrPwrZ.exe
  2⤵
  PID:4268
- C:\Windows\System\viMCJNb.exe
  C:\Windows\System\viMCJNb.exe
  2⤵
  PID:4284
- C:\Windows\System\KSRSIJD.exe
  C:\Windows\System\KSRSIJD.exe
  2⤵
  PID:4300
- C:\Windows\System\pCjQNZc.exe
  C:\Windows\System\pCjQNZc.exe
  2⤵
  PID:4316
- C:\Windows\System\auseubN.exe
  C:\Windows\System\auseubN.exe
  2⤵
  PID:4332
- C:\Windows\System\fCcPWHU.exe
  C:\Windows\System\fCcPWHU.exe
  2⤵
  PID:4352
- C:\Windows\System\INalBfI.exe
  C:\Windows\System\INalBfI.exe
  2⤵
  PID:4368
- C:\Windows\System\hUfnWoI.exe
  C:\Windows\System\hUfnWoI.exe
  2⤵
  PID:4384
- C:\Windows\System\fjrusPb.exe
  C:\Windows\System\fjrusPb.exe
  2⤵
  PID:4400
- C:\Windows\System\ZtRnXFA.exe
  C:\Windows\System\ZtRnXFA.exe
  2⤵
  PID:4416
- C:\Windows\System\uJuMfWP.exe
  C:\Windows\System\uJuMfWP.exe
  2⤵
  PID:4444
- C:\Windows\System\LTlFpvh.exe
  C:\Windows\System\LTlFpvh.exe
  2⤵
  PID:4460
- C:\Windows\System\cCRWWFO.exe
  C:\Windows\System\cCRWWFO.exe
  2⤵
  PID:4476
- C:\Windows\System\mqGHjOx.exe
  C:\Windows\System\mqGHjOx.exe
  2⤵
  PID:4492
- C:\Windows\System\EMyqAyR.exe
  C:\Windows\System\EMyqAyR.exe
  2⤵
  PID:4512
- C:\Windows\System\ulPYBWM.exe
  C:\Windows\System\ulPYBWM.exe
  2⤵
  PID:4544
- C:\Windows\System\sErDleN.exe
  C:\Windows\System\sErDleN.exe
  2⤵
  PID:4560
- C:\Windows\System\duJxCMQ.exe
  C:\Windows\System\duJxCMQ.exe
  2⤵
  PID:4576
- C:\Windows\System\qyuZsYG.exe
  C:\Windows\System\qyuZsYG.exe
  2⤵
  PID:4592
- C:\Windows\System\cqVXfHC.exe
  C:\Windows\System\cqVXfHC.exe
  2⤵
  PID:4608
- C:\Windows\System\qTPLWDW.exe
  C:\Windows\System\qTPLWDW.exe
  2⤵
  PID:4624
- C:\Windows\System\MXGJurH.exe
  C:\Windows\System\MXGJurH.exe
  2⤵
  PID:4640
- C:\Windows\System\trelQic.exe
  C:\Windows\System\trelQic.exe
  2⤵
  PID:4656
- C:\Windows\System\LFlFqnC.exe
  C:\Windows\System\LFlFqnC.exe
  2⤵
  PID:4672
- C:\Windows\System\mGyMpaT.exe
  C:\Windows\System\mGyMpaT.exe
  2⤵
  PID:4688
- C:\Windows\System\bGuUgVb.exe
  C:\Windows\System\bGuUgVb.exe
  2⤵
  PID:4704
- C:\Windows\System\pqhnMNb.exe
  C:\Windows\System\pqhnMNb.exe
  2⤵
  PID:4720
- C:\Windows\System\JrZJFbu.exe
  C:\Windows\System\JrZJFbu.exe
  2⤵
  PID:4736
- C:\Windows\System\vSGUsqR.exe
  C:\Windows\System\vSGUsqR.exe
  2⤵
  PID:4760
- C:\Windows\System\aouiWsD.exe
  C:\Windows\System\aouiWsD.exe
  2⤵
  PID:4776
- C:\Windows\System\IVMlNEl.exe
  C:\Windows\System\IVMlNEl.exe
  2⤵
  PID:4792
- C:\Windows\System\BRJcnkr.exe
  C:\Windows\System\BRJcnkr.exe
  2⤵
  PID:4808
- C:\Windows\System\CPhQLWj.exe
  C:\Windows\System\CPhQLWj.exe
  2⤵
  PID:4824
- C:\Windows\System\qrayrVe.exe
  C:\Windows\System\qrayrVe.exe
  2⤵
  PID:4840
- C:\Windows\System\ZVZFFbq.exe
  C:\Windows\System\ZVZFFbq.exe
  2⤵
  PID:4856
- C:\Windows\System\CFwaSHl.exe
  C:\Windows\System\CFwaSHl.exe
  2⤵
  PID:4872
- C:\Windows\System\KBdbyag.exe
  C:\Windows\System\KBdbyag.exe
  2⤵
  PID:4888
- C:\Windows\System\GvaUCnv.exe
  C:\Windows\System\GvaUCnv.exe
  2⤵
  PID:4904
- C:\Windows\System\GxqPOzQ.exe
  C:\Windows\System\GxqPOzQ.exe
  2⤵
  PID:4920
- C:\Windows\System\sImNViL.exe
  C:\Windows\System\sImNViL.exe
  2⤵
  PID:4936
- C:\Windows\System\ygpfucb.exe
  C:\Windows\System\ygpfucb.exe
  2⤵
  PID:4952
- C:\Windows\System\brLeZSQ.exe
  C:\Windows\System\brLeZSQ.exe
  2⤵
  PID:4968
- C:\Windows\System\nrymmiz.exe
  C:\Windows\System\nrymmiz.exe
  2⤵
  PID:4984
- C:\Windows\System\uBwBJoL.exe
  C:\Windows\System\uBwBJoL.exe
  2⤵
  PID:5000
- C:\Windows\System\yrkoudv.exe
  C:\Windows\System\yrkoudv.exe
  2⤵
  PID:5016
- C:\Windows\System\nEKgJuF.exe
  C:\Windows\System\nEKgJuF.exe
  2⤵
  PID:5032
- C:\Windows\System\SmxgykN.exe
  C:\Windows\System\SmxgykN.exe
  2⤵
  PID:5048
- C:\Windows\System\lIBuvxK.exe
  C:\Windows\System\lIBuvxK.exe
  2⤵
  PID:5068
- C:\Windows\System\eCjMqYA.exe
  C:\Windows\System\eCjMqYA.exe
  2⤵
  PID:5084
- C:\Windows\System\ypGTjHH.exe
  C:\Windows\System\ypGTjHH.exe
  2⤵
  PID:5100
- C:\Windows\System\PwuEaMq.exe
  C:\Windows\System\PwuEaMq.exe
  2⤵
  PID:3436
- C:\Windows\System\CWYPfLR.exe
  C:\Windows\System\CWYPfLR.exe
  2⤵
  PID:3364
- C:\Windows\System\LFYANEt.exe
  C:\Windows\System\LFYANEt.exe
  2⤵
  PID:3600
- C:\Windows\System\beMhwQu.exe
  C:\Windows\System\beMhwQu.exe
  2⤵
  PID:3504
- C:\Windows\System\piwgpaS.exe
  C:\Windows\System\piwgpaS.exe
  2⤵
  PID:3572
- C:\Windows\System\eXexWMz.exe
  C:\Windows\System\eXexWMz.exe
  2⤵
  PID:3644
- C:\Windows\System\YJgPQLa.exe
  C:\Windows\System\YJgPQLa.exe
  2⤵
  PID:3700
- C:\Windows\System\gCeplNZ.exe
  C:\Windows\System\gCeplNZ.exe
  2⤵
  PID:3488
- C:\Windows\System\gKPBwSY.exe
  C:\Windows\System\gKPBwSY.exe
  2⤵
  PID:3548
- C:\Windows\System\aGkzSXY.exe
  C:\Windows\System\aGkzSXY.exe
  2⤵
  PID:3696
- C:\Windows\System\vZapUyP.exe
  C:\Windows\System\vZapUyP.exe
  2⤵
  PID:3804
- C:\Windows\System\XVvlDuY.exe
  C:\Windows\System\XVvlDuY.exe
  2⤵
  PID:3916
- C:\Windows\System\sgcaeIb.exe
  C:\Windows\System\sgcaeIb.exe
  2⤵
  PID:4020
- C:\Windows\System\QAYevAS.exe
  C:\Windows\System\QAYevAS.exe
  2⤵
  PID:3096
- C:\Windows\System\lYnOAEl.exe
  C:\Windows\System\lYnOAEl.exe
  2⤵
  PID:3328
- C:\Windows\System\FoDHnoS.exe
  C:\Windows\System\FoDHnoS.exe
  2⤵
  PID:4128
- C:\Windows\System\yaArtkx.exe
  C:\Windows\System\yaArtkx.exe
  2⤵
  PID:4168
- C:\Windows\System\AlnLdgp.exe
  C:\Windows\System\AlnLdgp.exe
  2⤵
  PID:3756
- C:\Windows\System\RRziVBo.exe
  C:\Windows\System\RRziVBo.exe
  2⤵
  PID:3996
- C:\Windows\System\GDZBbkc.exe
  C:\Windows\System\GDZBbkc.exe
  2⤵
  PID:1496
- C:\Windows\System\XaOArvv.exe
  C:\Windows\System\XaOArvv.exe
  2⤵
  PID:3212
- C:\Windows\System\RbEmKRF.exe
  C:\Windows\System\RbEmKRF.exe
  2⤵
  PID:4108
- C:\Windows\System\YYAwQtf.exe
  C:\Windows\System\YYAwQtf.exe
  2⤵
  PID:1508
- C:\Windows\System\QKCiYpm.exe
  C:\Windows\System\QKCiYpm.exe
  2⤵
  PID:3500
- C:\Windows\System\JqsrSqo.exe
  C:\Windows\System\JqsrSqo.exe
  2⤵
  PID:3920
- C:\Windows\System\kfSBFAb.exe
  C:\Windows\System\kfSBFAb.exe
  2⤵
  PID:4380
- C:\Windows\System\ZBKNUxW.exe
  C:\Windows\System\ZBKNUxW.exe
  2⤵
  PID:4500
- C:\Windows\System\dOMOJGb.exe
  C:\Windows\System\dOMOJGb.exe
  2⤵
  PID:4424
- C:\Windows\System\mQGrqZt.exe
  C:\Windows\System\mQGrqZt.exe
  2⤵
  PID:4292
- C:\Windows\System\qpZjDAO.exe
  C:\Windows\System\qpZjDAO.exe
  2⤵
  PID:4668
- C:\Windows\System\XjQkAkx.exe
  C:\Windows\System\XjQkAkx.exe
  2⤵
  PID:4652
- C:\Windows\System\zFNsMqB.exe
  C:\Windows\System\zFNsMqB.exe
  2⤵
  PID:4772
- C:\Windows\System\LIHPTwX.exe
  C:\Windows\System\LIHPTwX.exe
  2⤵
  PID:4868
- C:\Windows\System\TYbZYQl.exe
  C:\Windows\System\TYbZYQl.exe
  2⤵
  PID:4816
- C:\Windows\System\yPUdyuL.exe
  C:\Windows\System\yPUdyuL.exe
  2⤵
  PID:4852
- C:\Windows\System\BNNPxaO.exe
  C:\Windows\System\BNNPxaO.exe
  2⤵
  PID:4932
- C:\Windows\System\OxEgLsu.exe
  C:\Windows\System\OxEgLsu.exe
  2⤵
  PID:4996
- C:\Windows\System\MhZPDQp.exe
  C:\Windows\System\MhZPDQp.exe
  2⤵
  PID:5064
- C:\Windows\System\PmQuRyp.exe
  C:\Windows\System\PmQuRyp.exe
  2⤵
  PID:5096
- C:\Windows\System\nWpBTiX.exe
  C:\Windows\System\nWpBTiX.exe
  2⤵
  PID:4980
- C:\Windows\System\XzUXXpm.exe
  C:\Windows\System\XzUXXpm.exe
  2⤵
  PID:5008
- C:\Windows\System\JCmQyep.exe
  C:\Windows\System\JCmQyep.exe
  2⤵
  PID:5108
- C:\Windows\System\VEmeocl.exe
  C:\Windows\System\VEmeocl.exe
  2⤵
  PID:3092
- C:\Windows\System\rlYfvIp.exe
  C:\Windows\System\rlYfvIp.exe
  2⤵
  PID:3140
- C:\Windows\System\ipRebeX.exe
  C:\Windows\System\ipRebeX.exe
  2⤵
  PID:4144
- C:\Windows\System\tWjINOW.exe
  C:\Windows\System\tWjINOW.exe
  2⤵
  PID:4188
- C:\Windows\System\uaNVQbi.exe
  C:\Windows\System\uaNVQbi.exe
  2⤵
  PID:4216
- C:\Windows\System\BBxMOdL.exe
  C:\Windows\System\BBxMOdL.exe
  2⤵
  PID:4440
- C:\Windows\System\pumggxP.exe
  C:\Windows\System\pumggxP.exe
  2⤵
  PID:4396
- C:\Windows\System\zdpKikY.exe
  C:\Windows\System\zdpKikY.exe
  2⤵
  PID:4600
- C:\Windows\System\MlOtRsW.exe
  C:\Windows\System\MlOtRsW.exe
  2⤵
  PID:4556
- C:\Windows\System\CshtlXz.exe
  C:\Windows\System\CshtlXz.exe
  2⤵
  PID:4664
- C:\Windows\System\PlQaZrL.exe
  C:\Windows\System\PlQaZrL.exe
  2⤵
  PID:4732
- C:\Windows\System\YRdbxZr.exe
  C:\Windows\System\YRdbxZr.exe
  2⤵
  PID:4648
- C:\Windows\System\xWSbNkY.exe
  C:\Windows\System\xWSbNkY.exe
  2⤵
  PID:4848
- C:\Windows\System\BHTnfch.exe
  C:\Windows\System\BHTnfch.exe
  2⤵
  PID:4928
- C:\Windows\System\LXfSzvV.exe
  C:\Windows\System\LXfSzvV.exe
  2⤵
  PID:4948
- C:\Windows\System\fkwprVV.exe
  C:\Windows\System\fkwprVV.exe
  2⤵
  PID:5044
- C:\Windows\System\gyRfXOM.exe
  C:\Windows\System\gyRfXOM.exe
  2⤵
  PID:5076
- C:\Windows\System\oENhPoJ.exe
  C:\Windows\System\oENhPoJ.exe
  2⤵
  PID:4180
- C:\Windows\System\qyZLLtD.exe
  C:\Windows\System\qyZLLtD.exe
  2⤵
  PID:3448
- C:\Windows\System\vUetbsg.exe
  C:\Windows\System\vUetbsg.exe
  2⤵
  PID:2872
- C:\Windows\System\RYroDGM.exe
  C:\Windows\System\RYroDGM.exe
  2⤵
  PID:3596
- C:\Windows\System\FQymiTB.exe
  C:\Windows\System\FQymiTB.exe
  2⤵
  PID:1952
- C:\Windows\System\voMNdjJ.exe
  C:\Windows\System\voMNdjJ.exe
  2⤵
  PID:4176
- C:\Windows\System\kJuDAOV.exe
  C:\Windows\System\kJuDAOV.exe
  2⤵
  PID:3880
- C:\Windows\System\qYfcxip.exe
  C:\Windows\System\qYfcxip.exe
  2⤵
  PID:4452
- C:\Windows\System\ADuTkIt.exe
  C:\Windows\System\ADuTkIt.exe
  2⤵
  PID:4308
- C:\Windows\System\PTJgWZE.exe
  C:\Windows\System\PTJgWZE.exe
  2⤵
  PID:4196
- C:\Windows\System\GxAxLTR.exe
  C:\Windows\System\GxAxLTR.exe
  2⤵
  PID:4484
- C:\Windows\System\cffmAxm.exe
  C:\Windows\System\cffmAxm.exe
  2⤵
  PID:4488
- C:\Windows\System\EgbIjkh.exe
  C:\Windows\System\EgbIjkh.exe
  2⤵
  PID:4504
- C:\Windows\System\EnRFRTw.exe
  C:\Windows\System\EnRFRTw.exe
  2⤵
  PID:4696
- C:\Windows\System\WDsuEdS.exe
  C:\Windows\System\WDsuEdS.exe
  2⤵
  PID:4900
- C:\Windows\System\WXNMrJY.exe
  C:\Windows\System\WXNMrJY.exe
  2⤵
  PID:5040
- C:\Windows\System\ubagrrU.exe
  C:\Windows\System\ubagrrU.exe
  2⤵
  PID:4768
- C:\Windows\System\QAuVQgz.exe
  C:\Windows\System\QAuVQgz.exe
  2⤵
  PID:3620
- C:\Windows\System\lRDSnXa.exe
  C:\Windows\System\lRDSnXa.exe
  2⤵
  PID:3296
- C:\Windows\System\FSeHvFw.exe
  C:\Windows\System\FSeHvFw.exe
  2⤵
  PID:4864
- C:\Windows\System\hDiFthH.exe
  C:\Windows\System\hDiFthH.exe
  2⤵
  PID:4912
- C:\Windows\System\dSqoQRw.exe
  C:\Windows\System\dSqoQRw.exe
  2⤵
  PID:3524
- C:\Windows\System\wSRmovB.exe
  C:\Windows\System\wSRmovB.exe
  2⤵
  PID:4076
- C:\Windows\System\nLlWtuA.exe
  C:\Windows\System\nLlWtuA.exe
  2⤵
  PID:3836
- C:\Windows\System\ezHhDpT.exe
  C:\Windows\System\ezHhDpT.exe
  2⤵
  PID:4524
- C:\Windows\System\oaKirHy.exe
  C:\Windows\System\oaKirHy.exe
  2⤵
  PID:3680
- C:\Windows\System\EOFiPjo.exe
  C:\Windows\System\EOFiPjo.exe
  2⤵
  PID:4140
- C:\Windows\System\qrCeqQu.exe
  C:\Windows\System\qrCeqQu.exe
  2⤵
  PID:4276
- C:\Windows\System\SgUOGnu.exe
  C:\Windows\System\SgUOGnu.exe
  2⤵
  PID:4472
- C:\Windows\System\WmBjldn.exe
  C:\Windows\System\WmBjldn.exe
  2⤵
  PID:4364
- C:\Windows\System\mVclplN.exe
  C:\Windows\System\mVclplN.exe
  2⤵
  PID:4992
- C:\Windows\System\glaIjYd.exe
  C:\Windows\System\glaIjYd.exe
  2⤵
  PID:1316
- C:\Windows\System\kLpVfKp.exe
  C:\Windows\System\kLpVfKp.exe
  2⤵
  PID:5124
- C:\Windows\System\ctLYWZM.exe
  C:\Windows\System\ctLYWZM.exe
  2⤵
  PID:5140
- C:\Windows\System\kVCahlR.exe
  C:\Windows\System\kVCahlR.exe
  2⤵
  PID:5156
- C:\Windows\System\nQncPmV.exe
  C:\Windows\System\nQncPmV.exe
  2⤵
  PID:5172
- C:\Windows\System\HsZjiDv.exe
  C:\Windows\System\HsZjiDv.exe
  2⤵
  PID:5188
- C:\Windows\System\mKHrLVc.exe
  C:\Windows\System\mKHrLVc.exe
  2⤵
  PID:5204
- C:\Windows\System\PlCsfpb.exe
  C:\Windows\System\PlCsfpb.exe
  2⤵
  PID:5220
- C:\Windows\System\goccLIC.exe
  C:\Windows\System\goccLIC.exe
  2⤵
  PID:5236
- C:\Windows\System\mqaICuY.exe
  C:\Windows\System\mqaICuY.exe
  2⤵
  PID:5252
- C:\Windows\System\QJfnhrg.exe
  C:\Windows\System\QJfnhrg.exe
  2⤵
  PID:5268
- C:\Windows\System\YijpMPi.exe
  C:\Windows\System\YijpMPi.exe
  2⤵
  PID:5284
- C:\Windows\System\VUMvYza.exe
  C:\Windows\System\VUMvYza.exe
  2⤵
  PID:5300
- C:\Windows\System\yJIjaEt.exe
  C:\Windows\System\yJIjaEt.exe
  2⤵
  PID:5316
- C:\Windows\System\EwnIerO.exe
  C:\Windows\System\EwnIerO.exe
  2⤵
  PID:5332
- C:\Windows\System\eCpeRQD.exe
  C:\Windows\System\eCpeRQD.exe
  2⤵
  PID:5348
- C:\Windows\System\qzFBOoX.exe
  C:\Windows\System\qzFBOoX.exe
  2⤵
  PID:5364
- C:\Windows\System\kMgofYD.exe
  C:\Windows\System\kMgofYD.exe
  2⤵
  PID:5388
- C:\Windows\System\pKzvArI.exe
  C:\Windows\System\pKzvArI.exe
  2⤵
  PID:5404
- C:\Windows\System\vzWRHyv.exe
  C:\Windows\System\vzWRHyv.exe
  2⤵
  PID:5452
- C:\Windows\System\fwqyEQN.exe
  C:\Windows\System\fwqyEQN.exe
  2⤵
  PID:5468
- C:\Windows\System\DgUDHgp.exe
  C:\Windows\System\DgUDHgp.exe
  2⤵
  PID:5484
- C:\Windows\System\zFuwGGx.exe
  C:\Windows\System\zFuwGGx.exe
  2⤵
  PID:5504
- C:\Windows\System\BsHWIti.exe
  C:\Windows\System\BsHWIti.exe
  2⤵
  PID:5528
- C:\Windows\System\pKeJNIJ.exe
  C:\Windows\System\pKeJNIJ.exe
  2⤵
  PID:5556
- C:\Windows\System\qiWBqki.exe
  C:\Windows\System\qiWBqki.exe
  2⤵
  PID:5576
- C:\Windows\System\TcMznrZ.exe
  C:\Windows\System\TcMznrZ.exe
  2⤵
  PID:5592
- C:\Windows\System\KOsJqyZ.exe
  C:\Windows\System\KOsJqyZ.exe
  2⤵
  PID:5612
- C:\Windows\System\aayiWgN.exe
  C:\Windows\System\aayiWgN.exe
  2⤵
  PID:5852
- C:\Windows\System\HWuyJhk.exe
  C:\Windows\System\HWuyJhk.exe
  2⤵
  PID:5868
- C:\Windows\System\GnJqFDQ.exe
  C:\Windows\System\GnJqFDQ.exe
  2⤵
  PID:5884
- C:\Windows\System\FpygIPi.exe
  C:\Windows\System\FpygIPi.exe
  2⤵
  PID:5908
- C:\Windows\System\sytkhSw.exe
  C:\Windows\System\sytkhSw.exe
  2⤵
  PID:5924
- C:\Windows\System\lPmikqA.exe
  C:\Windows\System\lPmikqA.exe
  2⤵
  PID:5940
- C:\Windows\System\bRjyfjY.exe
  C:\Windows\System\bRjyfjY.exe
  2⤵
  PID:5956
- C:\Windows\System\CwHmUWw.exe
  C:\Windows\System\CwHmUWw.exe
  2⤵
  PID:5976
- C:\Windows\System\dUksftk.exe
  C:\Windows\System\dUksftk.exe
  2⤵
  PID:5992
- C:\Windows\System\eDyfTxg.exe
  C:\Windows\System\eDyfTxg.exe
  2⤵
  PID:6008
- C:\Windows\System\qEGnxLR.exe
  C:\Windows\System\qEGnxLR.exe
  2⤵
  PID:6028
- C:\Windows\System\mrKTCJV.exe
  C:\Windows\System\mrKTCJV.exe
  2⤵
  PID:6044
- C:\Windows\System\AnFyzHf.exe
  C:\Windows\System\AnFyzHf.exe
  2⤵
  PID:6060
- C:\Windows\System\NaKkvQL.exe
  C:\Windows\System\NaKkvQL.exe
  2⤵
  PID:6080
- C:\Windows\System\JijaBYd.exe
  C:\Windows\System\JijaBYd.exe
  2⤵
  PID:6096
- C:\Windows\System\BMQjBNR.exe
  C:\Windows\System\BMQjBNR.exe
  2⤵
  PID:6112
- C:\Windows\System\MGrdeHN.exe
  C:\Windows\System\MGrdeHN.exe
  2⤵
  PID:6132
- C:\Windows\System\mFopzSO.exe
  C:\Windows\System\mFopzSO.exe
  2⤵
  PID:3360
- C:\Windows\System\vlMnHyJ.exe
  C:\Windows\System\vlMnHyJ.exe
  2⤵
  PID:3888
- C:\Windows\System\LLuwUHh.exe
  C:\Windows\System\LLuwUHh.exe
  2⤵
  PID:5116
- C:\Windows\System\Uesrzai.exe
  C:\Windows\System\Uesrzai.exe
  2⤵
  PID:4800
- C:\Windows\System\CEWKTNX.exe
  C:\Windows\System\CEWKTNX.exe
  2⤵
  PID:5060
- C:\Windows\System\IaZTIYi.exe
  C:\Windows\System\IaZTIYi.exe
  2⤵
  PID:5152
- C:\Windows\System\AWRELsL.exe
  C:\Windows\System\AWRELsL.exe
  2⤵
  PID:5248
- C:\Windows\System\ObavQDO.exe
  C:\Windows\System\ObavQDO.exe
  2⤵
  PID:5372
- C:\Windows\System\EZBZoBm.exe
  C:\Windows\System\EZBZoBm.exe
  2⤵
  PID:3532
- C:\Windows\System\yqQSroV.exe
  C:\Windows\System\yqQSroV.exe
  2⤵
  PID:4520
- C:\Windows\System\ouEfiuN.exe
  C:\Windows\System\ouEfiuN.exe
  2⤵
  PID:5380
- C:\Windows\System\gCrECdu.exe
  C:\Windows\System\gCrECdu.exe
  2⤵
  PID:5136
- C:\Windows\System\WVThdVX.exe
  C:\Windows\System\WVThdVX.exe
  2⤵
  PID:5412
- C:\Windows\System\hbBzyHV.exe
  C:\Windows\System\hbBzyHV.exe
  2⤵
  PID:5260
- C:\Windows\System\qdKwALJ.exe
  C:\Windows\System\qdKwALJ.exe
  2⤵
  PID:5200
- C:\Windows\System\pXmiOOp.exe
  C:\Windows\System\pXmiOOp.exe
  2⤵
  PID:5228
- C:\Windows\System\zZhrcvb.exe
  C:\Windows\System\zZhrcvb.exe
  2⤵
  PID:5428
- C:\Windows\System\yCeLpms.exe
  C:\Windows\System\yCeLpms.exe
  2⤵
  PID:5444
- C:\Windows\System\AJNXDrO.exe
  C:\Windows\System\AJNXDrO.exe
  2⤵
  PID:5536
- C:\Windows\System\VEKdzFN.exe
  C:\Windows\System\VEKdzFN.exe
  2⤵
  PID:5552
- C:\Windows\System\sHLbOSL.exe
  C:\Windows\System\sHLbOSL.exe
  2⤵
  PID:5620
- C:\Windows\System\XFOoptA.exe
  C:\Windows\System\XFOoptA.exe
  2⤵
  PID:5636
- C:\Windows\System\NRTLMMy.exe
  C:\Windows\System\NRTLMMy.exe
  2⤵
  PID:5648
- C:\Windows\System\bUHvDtx.exe
  C:\Windows\System\bUHvDtx.exe
  2⤵
  PID:5664
- C:\Windows\System\SAZwBCk.exe
  C:\Windows\System\SAZwBCk.exe
  2⤵
  PID:5680
- C:\Windows\System\RYvgTJY.exe
  C:\Windows\System\RYvgTJY.exe
  2⤵
  PID:5572
- C:\Windows\System\nQiFlal.exe
  C:\Windows\System\nQiFlal.exe
  2⤵
  PID:5524
- C:\Windows\System\CZUMRDj.exe
  C:\Windows\System\CZUMRDj.exe
  2⤵
  PID:5604
- C:\Windows\System\XEYpuVH.exe
  C:\Windows\System\XEYpuVH.exe
  2⤵
  PID:5704
- C:\Windows\System\yDElaKZ.exe
  C:\Windows\System\yDElaKZ.exe
  2⤵
  PID:5712
- C:\Windows\System\iPShCbR.exe
  C:\Windows\System\iPShCbR.exe
  2⤵
  PID:5724
- C:\Windows\System\YoRsdXP.exe
  C:\Windows\System\YoRsdXP.exe
  2⤵
  PID:5740
- C:\Windows\System\npLayRt.exe
  C:\Windows\System\npLayRt.exe
  2⤵
  PID:5760
- C:\Windows\System\oWBqfzw.exe
  C:\Windows\System\oWBqfzw.exe
  2⤵
  PID:5768
- C:\Windows\System\ndufTKS.exe
  C:\Windows\System\ndufTKS.exe
  2⤵
  PID:5788
- C:\Windows\System\xRQWgXi.exe
  C:\Windows\System\xRQWgXi.exe
  2⤵
  PID:5804
- C:\Windows\System\qStAqcp.exe
  C:\Windows\System\qStAqcp.exe
  2⤵
  PID:5828
- C:\Windows\System\opAjohV.exe
  C:\Windows\System\opAjohV.exe
  2⤵
  PID:5812
- C:\Windows\System\sYrbCBd.exe
  C:\Windows\System\sYrbCBd.exe
  2⤵
  PID:5968
- C:\Windows\System\AwBSKdA.exe
  C:\Windows\System\AwBSKdA.exe
  2⤵
  PID:5932
- C:\Windows\System\EaaPAUU.exe
  C:\Windows\System\EaaPAUU.exe
  2⤵
  PID:5876
- C:\Windows\System\YnWNKIB.exe
  C:\Windows\System\YnWNKIB.exe
  2⤵
  PID:5948
- C:\Windows\System\fgwVVmA.exe
  C:\Windows\System\fgwVVmA.exe
  2⤵
  PID:6020
- C:\Windows\System\lXixCSN.exe
  C:\Windows\System\lXixCSN.exe
  2⤵
  PID:5112
- C:\Windows\System\HDJYNZB.exe
  C:\Windows\System\HDJYNZB.exe
  2⤵
  PID:6092
- C:\Windows\System\lMtszzY.exe
  C:\Windows\System\lMtszzY.exe
  2⤵
  PID:6024
- C:\Windows\System\HHjWTao.exe
  C:\Windows\System\HHjWTao.exe
  2⤵
  PID:6004
- C:\Windows\System\fIWRGlW.exe
  C:\Windows\System\fIWRGlW.exe
  2⤵
  PID:5148
- C:\Windows\System\fSIhAhc.exe
  C:\Windows\System\fSIhAhc.exe
  2⤵
  PID:6040
- C:\Windows\System\LIafTJd.exe
  C:\Windows\System\LIafTJd.exe
  2⤵
  PID:6140
- C:\Windows\System\sNpKvob.exe
  C:\Windows\System\sNpKvob.exe
  2⤵
  PID:3144
- C:\Windows\System\rNdVfwM.exe
  C:\Windows\System\rNdVfwM.exe
  2⤵
  PID:3248
- C:\Windows\System\zYBBjgk.exe
  C:\Windows\System\zYBBjgk.exe
  2⤵
  PID:5312
- C:\Windows\System\wiTXxFq.exe
  C:\Windows\System\wiTXxFq.exe
  2⤵
  PID:5360
- C:\Windows\System\FssLVCS.exe
  C:\Windows\System\FssLVCS.exe
  2⤵
  PID:5328
- C:\Windows\System\abnzZvf.exe
  C:\Windows\System\abnzZvf.exe
  2⤵
  PID:5496
- C:\Windows\System\maWUkxt.exe
  C:\Windows\System\maWUkxt.exe
  2⤵
  PID:5644
- C:\Windows\System\PxouGuI.exe
  C:\Windows\System\PxouGuI.exe
  2⤵
  PID:5480
- C:\Windows\System\QvXNwkl.exe
  C:\Windows\System\QvXNwkl.exe
  2⤵
  PID:5720
- C:\Windows\System\RSnlBJK.exe
  C:\Windows\System\RSnlBJK.exe
  2⤵
  PID:5780
- C:\Windows\System\gsLUErB.exe
  C:\Windows\System\gsLUErB.exe
  2⤵
  PID:5864
- C:\Windows\System\bXiErvf.exe
  C:\Windows\System\bXiErvf.exe
  2⤵
  PID:5988
- C:\Windows\System\ajVBQRn.exe
  C:\Windows\System\ajVBQRn.exe
  2⤵
  PID:5972
- C:\Windows\System\xjKnqur.exe
  C:\Windows\System\xjKnqur.exe
  2⤵
  PID:5816
- C:\Windows\System\KXhTzBg.exe
  C:\Windows\System\KXhTzBg.exe
  2⤵
  PID:5344
- C:\Windows\System\gWOJFzE.exe
  C:\Windows\System\gWOJFzE.exe
  2⤵
  PID:5584
- C:\Windows\System\RNBFXCi.exe
  C:\Windows\System\RNBFXCi.exe
  2⤵
  PID:5396
- C:\Windows\System\tpTQXye.exe
  C:\Windows\System\tpTQXye.exe
  2⤵
  PID:5436
- C:\Windows\System\iqpQcXj.exe
  C:\Windows\System\iqpQcXj.exe
  2⤵
  PID:5568
- C:\Windows\System\SnCNrcd.exe
  C:\Windows\System\SnCNrcd.exe
  2⤵
  PID:6052
- C:\Windows\System\qvaDpsS.exe
  C:\Windows\System\qvaDpsS.exe
  2⤵
  PID:5732
- C:\Windows\System\UubTfgx.exe
  C:\Windows\System\UubTfgx.exe
  2⤵
  PID:5548
- C:\Windows\System\WXXOnWr.exe
  C:\Windows\System\WXXOnWr.exe
  2⤵
  PID:5308
- C:\Windows\System\jSOSvpI.exe
  C:\Windows\System\jSOSvpI.exe
  2⤵
  PID:5708
- C:\Windows\System\svtAahJ.exe
  C:\Windows\System\svtAahJ.exe
  2⤵
  PID:5292
- C:\Windows\System\LJJovWG.exe
  C:\Windows\System\LJJovWG.exe
  2⤵
  PID:5424
- C:\Windows\System\ANEUyCK.exe
  C:\Windows\System\ANEUyCK.exe
  2⤵
  PID:5836
- C:\Windows\System\jiZrbvf.exe
  C:\Windows\System\jiZrbvf.exe
  2⤵
  PID:5904
- C:\Windows\System\CEOWpOj.exe
  C:\Windows\System\CEOWpOj.exe
  2⤵
  PID:5164
- C:\Windows\System\omPauJz.exe
  C:\Windows\System\omPauJz.exe
  2⤵
  PID:2964
- C:\Windows\System\iPFBzly.exe
  C:\Windows\System\iPFBzly.exe
  2⤵
  PID:5920
- C:\Windows\System\BXLxOwq.exe
  C:\Windows\System\BXLxOwq.exe
  2⤵
  PID:5800
- C:\Windows\System\nsTRcYD.exe
  C:\Windows\System\nsTRcYD.exe
  2⤵
  PID:6076
- C:\Windows\System\OQVjowa.exe
  C:\Windows\System\OQVjowa.exe
  2⤵
  PID:5056
- C:\Windows\System\sFOEZuQ.exe
  C:\Windows\System\sFOEZuQ.exe
  2⤵
  PID:5696
- C:\Windows\System\uzjnzca.exe
  C:\Windows\System\uzjnzca.exe
  2⤵
  PID:5844
- C:\Windows\System\RNjdDpU.exe
  C:\Windows\System\RNjdDpU.exe
  2⤵
  PID:5736
- C:\Windows\System\wxhmrfs.exe
  C:\Windows\System\wxhmrfs.exe
  2⤵
  PID:5600
- C:\Windows\System\LfkmgsS.exe
  C:\Windows\System\LfkmgsS.exe
  2⤵
  PID:6152
- C:\Windows\System\pOmCEPl.exe
  C:\Windows\System\pOmCEPl.exe
  2⤵
  PID:6168
- C:\Windows\System\YtdxCLO.exe
  C:\Windows\System\YtdxCLO.exe
  2⤵
  PID:6184
- C:\Windows\System\CCUBDYx.exe
  C:\Windows\System\CCUBDYx.exe
  2⤵
  PID:6200
- C:\Windows\System\mFUlJRs.exe
  C:\Windows\System\mFUlJRs.exe
  2⤵
  PID:6216
- C:\Windows\System\NnuuJWa.exe
  C:\Windows\System\NnuuJWa.exe
  2⤵
  PID:6232
- C:\Windows\System\vQkGtyJ.exe
  C:\Windows\System\vQkGtyJ.exe
  2⤵
  PID:6248
- C:\Windows\System\DfIjtQT.exe
  C:\Windows\System\DfIjtQT.exe
  2⤵
  PID:6264
- C:\Windows\System\jYtXmrb.exe
  C:\Windows\System\jYtXmrb.exe
  2⤵
  PID:6280
- C:\Windows\System\aPapfyH.exe
  C:\Windows\System\aPapfyH.exe
  2⤵
  PID:6296
- C:\Windows\System\pyUwDdL.exe
  C:\Windows\System\pyUwDdL.exe
  2⤵
  PID:6312
- C:\Windows\System\rkCfenv.exe
  C:\Windows\System\rkCfenv.exe
  2⤵
  PID:6332
- C:\Windows\System\FpcijgO.exe
  C:\Windows\System\FpcijgO.exe
  2⤵
  PID:6348
- C:\Windows\System\jbllmvy.exe
  C:\Windows\System\jbllmvy.exe
  2⤵
  PID:6364
- C:\Windows\System\rGhKOdp.exe
  C:\Windows\System\rGhKOdp.exe
  2⤵
  PID:6380
- C:\Windows\System\CidBnDG.exe
  C:\Windows\System\CidBnDG.exe
  2⤵
  PID:6396
- C:\Windows\System\bdgxVHa.exe
  C:\Windows\System\bdgxVHa.exe
  2⤵
  PID:6416
- C:\Windows\System\vtZfmwm.exe
  C:\Windows\System\vtZfmwm.exe
  2⤵
  PID:6432
- C:\Windows\System\uXJnAbx.exe
  C:\Windows\System\uXJnAbx.exe
  2⤵
  PID:6452
- C:\Windows\System\oMJzYOY.exe
  C:\Windows\System\oMJzYOY.exe
  2⤵
  PID:6472
- C:\Windows\System\waxjHuo.exe
  C:\Windows\System\waxjHuo.exe
  2⤵
  PID:6528
- C:\Windows\System\HHYkSnK.exe
  C:\Windows\System\HHYkSnK.exe
  2⤵
  PID:6636
- C:\Windows\System\yIhTJzt.exe
  C:\Windows\System\yIhTJzt.exe
  2⤵
  PID:6652
- C:\Windows\System\AIFexay.exe
  C:\Windows\System\AIFexay.exe
  2⤵
  PID:6672
- C:\Windows\System\dSPenWa.exe
  C:\Windows\System\dSPenWa.exe
  2⤵
  PID:6768
- C:\Windows\System\bUGyCNc.exe
  C:\Windows\System\bUGyCNc.exe
  2⤵
  PID:6784
- C:\Windows\System\LGaHNWI.exe
  C:\Windows\System\LGaHNWI.exe
  2⤵
  PID:6800
- C:\Windows\System\lpYAigD.exe
  C:\Windows\System\lpYAigD.exe
  2⤵
  PID:6816
- C:\Windows\System\WrdMVmv.exe
  C:\Windows\System\WrdMVmv.exe
  2⤵
  PID:6832
- C:\Windows\System\idAjWHW.exe
  C:\Windows\System\idAjWHW.exe
  2⤵
  PID:6848
- C:\Windows\System\OYcejQF.exe
  C:\Windows\System\OYcejQF.exe
  2⤵
  PID:6864
- C:\Windows\System\TfIhBlq.exe
  C:\Windows\System\TfIhBlq.exe
  2⤵
  PID:6880
- C:\Windows\System\NipnajU.exe
  C:\Windows\System\NipnajU.exe
  2⤵
  PID:6896
- C:\Windows\System\nZFffDr.exe
  C:\Windows\System\nZFffDr.exe
  2⤵
  PID:6916
- C:\Windows\System\rxvvYXA.exe
  C:\Windows\System\rxvvYXA.exe
  2⤵
  PID:6932
- C:\Windows\System\wxMZnyb.exe
  C:\Windows\System\wxMZnyb.exe
  2⤵
  PID:6948
- C:\Windows\System\SPpXErX.exe
  C:\Windows\System\SPpXErX.exe
  2⤵
  PID:6964
- C:\Windows\System\yGAwvuD.exe
  C:\Windows\System\yGAwvuD.exe
  2⤵
  PID:6980
- C:\Windows\System\bfBMzzW.exe
  C:\Windows\System\bfBMzzW.exe
  2⤵
  PID:7000
- C:\Windows\System\rXFwFxB.exe
  C:\Windows\System\rXFwFxB.exe
  2⤵
  PID:7016
- C:\Windows\System\Nlpezjg.exe
  C:\Windows\System\Nlpezjg.exe
  2⤵
  PID:7032
- C:\Windows\System\rcfZozs.exe
  C:\Windows\System\rcfZozs.exe
  2⤵
  PID:7048
- C:\Windows\System\AVzJxQw.exe
  C:\Windows\System\AVzJxQw.exe
  2⤵
  PID:7068
- C:\Windows\System\MvdSIfY.exe
  C:\Windows\System\MvdSIfY.exe
  2⤵
  PID:7084
- C:\Windows\System\HDMcpuR.exe
  C:\Windows\System\HDMcpuR.exe
  2⤵
  PID:7100
- C:\Windows\System\whpVZQo.exe
  C:\Windows\System\whpVZQo.exe
  2⤵
  PID:7116
- C:\Windows\System\rhDmTxH.exe
  C:\Windows\System\rhDmTxH.exe
  2⤵
  PID:7132
- C:\Windows\System\PLjSmar.exe
  C:\Windows\System\PLjSmar.exe
  2⤵
  PID:7152
- C:\Windows\System\ueZgnSx.exe
  C:\Windows\System\ueZgnSx.exe
  2⤵
  PID:5752
- C:\Windows\System\JbDTnlk.exe
  C:\Windows\System\JbDTnlk.exe
  2⤵
  PID:5244
- C:\Windows\System\KDIjAlU.exe
  C:\Windows\System\KDIjAlU.exe
  2⤵
  PID:5028
- C:\Windows\System\BwzoJhT.exe
  C:\Windows\System\BwzoJhT.exe
  2⤵
  PID:4784
- C:\Windows\System\dDrGZns.exe
  C:\Windows\System\dDrGZns.exe
  2⤵
  PID:6120
- C:\Windows\System\xoXXHDB.exe
  C:\Windows\System\xoXXHDB.exe
  2⤵
  PID:6104
- C:\Windows\System\pXaOEuC.exe
  C:\Windows\System\pXaOEuC.exe
  2⤵
  PID:4328
- C:\Windows\System\kTPpPUa.exe
  C:\Windows\System\kTPpPUa.exe
  2⤵
  PID:4160
- C:\Windows\System\oJZsXCr.exe
  C:\Windows\System\oJZsXCr.exe
  2⤵
  PID:6256
- C:\Windows\System\uogNDBp.exe
  C:\Windows\System\uogNDBp.exe
  2⤵
  PID:6240
- C:\Windows\System\zRyRDGj.exe
  C:\Windows\System\zRyRDGj.exe
  2⤵
  PID:6304
- C:\Windows\System\kMteZVt.exe
  C:\Windows\System\kMteZVt.exe
  2⤵
  PID:6372
- C:\Windows\System\NZzcOWN.exe
  C:\Windows\System\NZzcOWN.exe
  2⤵
  PID:6408
- C:\Windows\System\LXdVnwJ.exe
  C:\Windows\System\LXdVnwJ.exe
  2⤵
  PID:6360
- C:\Windows\System\jiPgbME.exe
  C:\Windows\System\jiPgbME.exe
  2⤵
  PID:6424
- C:\Windows\System\iNBztyT.exe
  C:\Windows\System\iNBztyT.exe
  2⤵
  PID:5132
- C:\Windows\System\vXfSkPF.exe
  C:\Windows\System\vXfSkPF.exe
  2⤵
  PID:6480
- C:\Windows\System\pphVSnj.exe
  C:\Windows\System\pphVSnj.exe
  2⤵
  PID:6496
- C:\Windows\System\pARstdn.exe
  C:\Windows\System\pARstdn.exe
  2⤵
  PID:6524
- C:\Windows\System\ErLcKYE.exe
  C:\Windows\System\ErLcKYE.exe
  2⤵
  PID:6612
- C:\Windows\System\hPurOBS.exe
  C:\Windows\System\hPurOBS.exe
  2⤵
  PID:6596
- C:\Windows\System\ABKbfdP.exe
  C:\Windows\System\ABKbfdP.exe
  2⤵
  PID:6576
- C:\Windows\System\OeaEtgs.exe
  C:\Windows\System\OeaEtgs.exe
  2⤵
  PID:6552
- C:\Windows\System\bMNykZP.exe
  C:\Windows\System\bMNykZP.exe
  2⤵
  PID:6644
- C:\Windows\System\aUTUfQm.exe
  C:\Windows\System\aUTUfQm.exe
  2⤵
  PID:6628
- C:\Windows\System\LpUxlGN.exe
  C:\Windows\System\LpUxlGN.exe
  2⤵
  PID:6716
- C:\Windows\System\kqQbqkx.exe
  C:\Windows\System\kqQbqkx.exe
  2⤵
  PID:6728
- C:\Windows\System\UvINeKp.exe
  C:\Windows\System\UvINeKp.exe
  2⤵
  PID:6748
- C:\Windows\System\gbdUTkW.exe
  C:\Windows\System\gbdUTkW.exe
  2⤵
  PID:6764
- C:\Windows\System\YmhzrRL.exe
  C:\Windows\System\YmhzrRL.exe
  2⤵
  PID:6780
- C:\Windows\System\ZTKjCka.exe
  C:\Windows\System\ZTKjCka.exe
  2⤵
  PID:6892
- C:\Windows\System\RKvELUn.exe
  C:\Windows\System\RKvELUn.exe
  2⤵
  PID:7096
- C:\Windows\System\ozWXHQl.exe
  C:\Windows\System\ozWXHQl.exe
  2⤵
  PID:7160
- C:\Windows\System\dkwyeTB.exe
  C:\Windows\System\dkwyeTB.exe
  2⤵
  PID:6844
- C:\Windows\System\ejZcmhq.exe
  C:\Windows\System\ejZcmhq.exe
  2⤵
  PID:6912
- C:\Windows\System\VNNSmUg.exe
  C:\Windows\System\VNNSmUg.exe
  2⤵
  PID:6976
- C:\Windows\System\PYDIcra.exe
  C:\Windows\System\PYDIcra.exe
  2⤵
  PID:7044
- C:\Windows\System\JzBTfnj.exe
  C:\Windows\System\JzBTfnj.exe
  2⤵
  PID:6488
- C:\Windows\System\tRulkzH.exe
  C:\Windows\System\tRulkzH.exe
  2⤵
  PID:6444
- C:\Windows\System\iytWKDm.exe
  C:\Windows\System\iytWKDm.exe
  2⤵
  PID:6320
- C:\Windows\System\jFQAvpB.exe
  C:\Windows\System\jFQAvpB.exe
  2⤵
  PID:6192
- C:\Windows\System\aZnqVrZ.exe
  C:\Windows\System\aZnqVrZ.exe
  2⤵
  PID:5820
- C:\Windows\System\XCorBQk.exe
  C:\Windows\System\XCorBQk.exe
  2⤵
  PID:6996
- C:\Windows\System\NVDTdyX.exe
  C:\Windows\System\NVDTdyX.exe
  2⤵
  PID:6492
- C:\Windows\System\WovNJBV.exe
  C:\Windows\System\WovNJBV.exe
  2⤵
  PID:6520
- C:\Windows\System\AyHLmli.exe
  C:\Windows\System\AyHLmli.exe
  2⤵
  PID:6564
- C:\Windows\System\NtQVtQC.exe
  C:\Windows\System\NtQVtQC.exe
  2⤵
  PID:6584
- C:\Windows\System\ZCzaFEJ.exe
  C:\Windows\System\ZCzaFEJ.exe
  2⤵
  PID:6928
- C:\Windows\System\ymTCkHh.exe
  C:\Windows\System\ymTCkHh.exe
  2⤵
  PID:6988
- C:\Windows\System\CdCotqN.exe
  C:\Windows\System\CdCotqN.exe
  2⤵
  PID:6632
- C:\Windows\System\DSMUnDn.exe
  C:\Windows\System\DSMUnDn.exe
  2⤵
  PID:5744
- C:\Windows\System\GoNObQV.exe
  C:\Windows\System\GoNObQV.exe
  2⤵
  PID:6404
- C:\Windows\System\ZtKlyHU.exe
  C:\Windows\System\ZtKlyHU.exe
  2⤵
  PID:6536
- C:\Windows\System\eTXYDZQ.exe
  C:\Windows\System\eTXYDZQ.exe
  2⤵
  PID:6692
- C:\Windows\System\dKoNPTf.exe
  C:\Windows\System\dKoNPTf.exe
  2⤵
  PID:6664
- C:\Windows\System\BBbwbEb.exe
  C:\Windows\System\BBbwbEb.exe
  2⤵
  PID:6904
- C:\Windows\System\vXduUfC.exe
  C:\Windows\System\vXduUfC.exe
  2⤵
  PID:6176
- C:\Windows\System\puMyQAC.exe
  C:\Windows\System\puMyQAC.exe
  2⤵
  PID:6796
- C:\Windows\System\PvBAhLV.exe
  C:\Windows\System\PvBAhLV.exe
  2⤵
  PID:6324
- C:\Windows\System\SWvhazn.exe
  C:\Windows\System\SWvhazn.exe
  2⤵
  PID:6460
- C:\Windows\System\MSGUQQI.exe
  C:\Windows\System\MSGUQQI.exe
  2⤵
  PID:7148
- C:\Windows\System\qmNgxMW.exe
  C:\Windows\System\qmNgxMW.exe
  2⤵
  PID:6616
- C:\Windows\System\eSAXtpJ.exe
  C:\Windows\System\eSAXtpJ.exe
  2⤵
  PID:6712
- C:\Windows\System\KjLQrLI.exe
  C:\Windows\System\KjLQrLI.exe
  2⤵
  PID:6180
- C:\Windows\System\hAHPnMh.exe
  C:\Windows\System\hAHPnMh.exe
  2⤵
  PID:6696
- C:\Windows\System\bTYxUSq.exe
  C:\Windows\System\bTYxUSq.exe
  2⤵
  PID:7056
- C:\Windows\System\kgsSykb.exe
  C:\Windows\System\kgsSykb.exe
  2⤵
  PID:6228
- C:\Windows\System\xLAhHOO.exe
  C:\Windows\System\xLAhHOO.exe
  2⤵
  PID:6356
- C:\Windows\System\AjMHwgW.exe
  C:\Windows\System\AjMHwgW.exe
  2⤵
  PID:7176
- C:\Windows\System\EMCNObS.exe
  C:\Windows\System\EMCNObS.exe
  2⤵
  PID:7192
- C:\Windows\System\uvuTmFH.exe
  C:\Windows\System\uvuTmFH.exe
  2⤵
  PID:7208
- C:\Windows\System\kfTzIzX.exe
  C:\Windows\System\kfTzIzX.exe
  2⤵
  PID:7224
- C:\Windows\System\ZTphrEV.exe
  C:\Windows\System\ZTphrEV.exe
  2⤵
  PID:7240
- C:\Windows\System\iYIZdEP.exe
  C:\Windows\System\iYIZdEP.exe
  2⤵
  PID:7256
- C:\Windows\System\bLvdtoz.exe
  C:\Windows\System\bLvdtoz.exe
  2⤵
  PID:7272
- C:\Windows\System\WAfbDYG.exe
  C:\Windows\System\WAfbDYG.exe
  2⤵
  PID:7288
- C:\Windows\System\XsGfemx.exe
  C:\Windows\System\XsGfemx.exe
  2⤵
  PID:7304
- C:\Windows\System\zOsiCBn.exe
  C:\Windows\System\zOsiCBn.exe
  2⤵
  PID:7320
- C:\Windows\System\wCvJIJC.exe
  C:\Windows\System\wCvJIJC.exe
  2⤵
  PID:7336
- C:\Windows\System\gLSgdId.exe
  C:\Windows\System\gLSgdId.exe
  2⤵
  PID:7352
- C:\Windows\System\uCJqdMi.exe
  C:\Windows\System\uCJqdMi.exe
  2⤵
  PID:7368
- C:\Windows\System\zTQtgFE.exe
  C:\Windows\System\zTQtgFE.exe
  2⤵
  PID:7388
- C:\Windows\System\EBfTDyE.exe
  C:\Windows\System\EBfTDyE.exe
  2⤵
  PID:7404
- C:\Windows\System\RIqAWml.exe
  C:\Windows\System\RIqAWml.exe
  2⤵
  PID:7420
- C:\Windows\System\EwBBmiv.exe
  C:\Windows\System\EwBBmiv.exe
  2⤵
  PID:7436
- C:\Windows\System\ohUmbIT.exe
  C:\Windows\System\ohUmbIT.exe
  2⤵
  PID:7452
- C:\Windows\System\wjoTZvz.exe
  C:\Windows\System\wjoTZvz.exe
  2⤵
  PID:7468
- C:\Windows\System\cCXcleL.exe
  C:\Windows\System\cCXcleL.exe
  2⤵
  PID:7484
- C:\Windows\System\nMZvMrW.exe
  C:\Windows\System\nMZvMrW.exe
  2⤵
  PID:7500
- C:\Windows\System\njhHXxT.exe
  C:\Windows\System\njhHXxT.exe
  2⤵
  PID:7520
- C:\Windows\System\IPqqvvK.exe
  C:\Windows\System\IPqqvvK.exe
  2⤵
  PID:7536
- C:\Windows\System\LSOhGHi.exe
  C:\Windows\System\LSOhGHi.exe
  2⤵
  PID:7552
- C:\Windows\System\QvDJBZz.exe
  C:\Windows\System\QvDJBZz.exe
  2⤵
  PID:7572
- C:\Windows\System\ssawinf.exe
  C:\Windows\System\ssawinf.exe
  2⤵
  PID:7588
- C:\Windows\System\mRGMnNB.exe
  C:\Windows\System\mRGMnNB.exe
  2⤵
  PID:7604
- C:\Windows\System\lcjhNSV.exe
  C:\Windows\System\lcjhNSV.exe
  2⤵
  PID:7620
- C:\Windows\System\hufnWfZ.exe
  C:\Windows\System\hufnWfZ.exe
  2⤵
  PID:7636
- C:\Windows\System\yqfyEfi.exe
  C:\Windows\System\yqfyEfi.exe
  2⤵
  PID:7652
- C:\Windows\System\euywrqz.exe
  C:\Windows\System\euywrqz.exe
  2⤵
  PID:7668
- C:\Windows\System\tGIyVMe.exe
  C:\Windows\System\tGIyVMe.exe
  2⤵
  PID:7684
- C:\Windows\System\dzPJUsw.exe
  C:\Windows\System\dzPJUsw.exe
  2⤵
  PID:7700
- C:\Windows\System\lePFvEl.exe
  C:\Windows\System\lePFvEl.exe
  2⤵
  PID:7724
- C:\Windows\System\pXsYTpT.exe
  C:\Windows\System\pXsYTpT.exe
  2⤵
  PID:7740
- C:\Windows\System\FmiSeoS.exe
  C:\Windows\System\FmiSeoS.exe
  2⤵
  PID:7760
- C:\Windows\System\elmXsXW.exe
  C:\Windows\System\elmXsXW.exe
  2⤵
  PID:7776
- C:\Windows\System\jGnyVzn.exe
  C:\Windows\System\jGnyVzn.exe
  2⤵
  PID:7792
- C:\Windows\System\zwQftio.exe
  C:\Windows\System\zwQftio.exe
  2⤵
  PID:7808
- C:\Windows\System\ctlgVXA.exe
  C:\Windows\System\ctlgVXA.exe
  2⤵
  PID:7824
- C:\Windows\System\SQDSkfv.exe
  C:\Windows\System\SQDSkfv.exe
  2⤵
  PID:7840
- C:\Windows\System\XpMiUfO.exe
  C:\Windows\System\XpMiUfO.exe
  2⤵
  PID:7860
- C:\Windows\System\EeQasLB.exe
  C:\Windows\System\EeQasLB.exe
  2⤵
  PID:7876
- C:\Windows\System\UfXenXP.exe
  C:\Windows\System\UfXenXP.exe
  2⤵
  PID:7892
- C:\Windows\System\OJRTjWK.exe
  C:\Windows\System\OJRTjWK.exe
  2⤵
  PID:7908
- C:\Windows\System\TGbXzPg.exe
  C:\Windows\System\TGbXzPg.exe
  2⤵
  PID:7932
- C:\Windows\System\XgeMUHW.exe
  C:\Windows\System\XgeMUHW.exe
  2⤵
  PID:7948
- C:\Windows\System\iTWEnxF.exe
  C:\Windows\System\iTWEnxF.exe
  2⤵
  PID:7972
- C:\Windows\System\tdgjYod.exe
  C:\Windows\System\tdgjYod.exe
  2⤵
  PID:7988
- C:\Windows\System\iSbDIVM.exe
  C:\Windows\System\iSbDIVM.exe
  2⤵
  PID:8084
- C:\Windows\System\zZMjnmB.exe
  C:\Windows\System\zZMjnmB.exe
  2⤵
  PID:8100
- C:\Windows\System\okSEsvZ.exe
  C:\Windows\System\okSEsvZ.exe
  2⤵
  PID:8124
- C:\Windows\System\MZYnCZy.exe
  C:\Windows\System\MZYnCZy.exe
  2⤵
  PID:8140
- C:\Windows\System\iAJoEUd.exe
  C:\Windows\System\iAJoEUd.exe
  2⤵
  PID:8156
- C:\Windows\System\aQiuAyC.exe
  C:\Windows\System\aQiuAyC.exe
  2⤵
  PID:8172
- C:\Windows\System\LthNQJY.exe
  C:\Windows\System\LthNQJY.exe
  2⤵
  PID:7108
- C:\Windows\System\nuFieyG.exe
  C:\Windows\System\nuFieyG.exe
  2⤵
  PID:6744
- C:\Windows\System\qlDDgUA.exe
  C:\Windows\System\qlDDgUA.exe
  2⤵
  PID:5324
- C:\Windows\System\UodSInJ.exe
  C:\Windows\System\UodSInJ.exe
  2⤵
  PID:6812
- C:\Windows\System\eAGxGZR.exe
  C:\Windows\System\eAGxGZR.exe
  2⤵
  PID:7204
- C:\Windows\System\HHwTcgO.exe
  C:\Windows\System\HHwTcgO.exe
  2⤵
  PID:7264
- C:\Windows\System\SMFfuiF.exe
  C:\Windows\System\SMFfuiF.exe
  2⤵
  PID:7328
- C:\Windows\System\OwugqAF.exe
  C:\Windows\System\OwugqAF.exe
  2⤵
  PID:6428
- C:\Windows\System\kCUMeRG.exe
  C:\Windows\System\kCUMeRG.exe
  2⤵
  PID:7188
- C:\Windows\System\PGbzAZI.exe
  C:\Windows\System\PGbzAZI.exe
  2⤵
  PID:6344
- C:\Windows\System\barHDMn.exe
  C:\Windows\System\barHDMn.exe
  2⤵
  PID:7400
- C:\Windows\System\OuJZiaq.exe
  C:\Windows\System\OuJZiaq.exe
  2⤵
  PID:6620
- C:\Windows\System\RouAvKp.exe
  C:\Windows\System\RouAvKp.exe
  2⤵
  PID:6668
- C:\Windows\System\ApsyIZt.exe
  C:\Windows\System\ApsyIZt.exe
  2⤵
  PID:7012
- C:\Windows\System\ABLSLCO.exe
  C:\Windows\System\ABLSLCO.exe
  2⤵
  PID:6944
- C:\Windows\System\gQScdmb.exe
  C:\Windows\System\gQScdmb.exe
  2⤵
  PID:6960
- C:\Windows\System\usqEBGd.exe
  C:\Windows\System\usqEBGd.exe
  2⤵
  PID:7280
- C:\Windows\System\pYSSgTl.exe
  C:\Windows\System\pYSSgTl.exe
  2⤵
  PID:7412
- C:\Windows\System\NqWHXph.exe
  C:\Windows\System\NqWHXph.exe
  2⤵
  PID:7444
- C:\Windows\System\gfeiNBZ.exe
  C:\Windows\System\gfeiNBZ.exe
  2⤵
  PID:7496
- C:\Windows\System\XmBQlDH.exe
  C:\Windows\System\XmBQlDH.exe
  2⤵
  PID:7532
- C:\Windows\System\jGvrGIV.exe
  C:\Windows\System\jGvrGIV.exe
  2⤵
  PID:7480
- C:\Windows\System\bqfKDNq.exe
  C:\Windows\System\bqfKDNq.exe
  2⤵
  PID:7924
- C:\Windows\System\OFmgsEd.exe
  C:\Windows\System\OFmgsEd.exe
  2⤵
  PID:7648
- C:\Windows\System\BVhsOuA.exe
  C:\Windows\System\BVhsOuA.exe
  2⤵
  PID:7712
- C:\Windows\System\IvOOgSg.exe
  C:\Windows\System\IvOOgSg.exe
  2⤵
  PID:7752
- C:\Windows\System\NrPUeMb.exe
  C:\Windows\System\NrPUeMb.exe
  2⤵
  PID:7816
- C:\Windows\System\tIBrhcI.exe
  C:\Windows\System\tIBrhcI.exe
  2⤵
  PID:7916
- C:\Windows\System\lPLZQDG.exe
  C:\Windows\System\lPLZQDG.exe
  2⤵
  PID:8008
- C:\Windows\System\XMqjGsN.exe
  C:\Windows\System\XMqjGsN.exe
  2⤵
  PID:8080
- C:\Windows\System\dxpqdWA.exe
  C:\Windows\System\dxpqdWA.exe
  2⤵
  PID:8076
- C:\Windows\System\EapYkCq.exe
  C:\Windows\System\EapYkCq.exe
  2⤵
  PID:8188
- C:\Windows\System\BtjNudz.exe
  C:\Windows\System\BtjNudz.exe
  2⤵
  PID:1568
- C:\Windows\System\pZrOKlq.exe
  C:\Windows\System\pZrOKlq.exe
  2⤵
  PID:7236
- C:\Windows\System\iApUsaK.exe
  C:\Windows\System\iApUsaK.exe
  2⤵
  PID:6860
- C:\Windows\System\xzPDpQm.exe
  C:\Windows\System\xzPDpQm.exe
  2⤵
  PID:6708
- C:\Windows\System\VZwiOEi.exe
  C:\Windows\System\VZwiOEi.exe
  2⤵
  PID:6888
- C:\Windows\System\HNkLeUI.exe
  C:\Windows\System\HNkLeUI.exe
  2⤵
  PID:7172
- C:\Windows\System\ldRMuqc.exe
  C:\Windows\System\ldRMuqc.exe
  2⤵
  PID:5520
- C:\Windows\System\vHpsiAb.exe
  C:\Windows\System\vHpsiAb.exe
  2⤵
  PID:7284
- C:\Windows\System\rweXIOx.exe
  C:\Windows\System\rweXIOx.exe
  2⤵
  PID:7596
- C:\Windows\System\NYgBOpi.exe
  C:\Windows\System\NYgBOpi.exe
  2⤵
  PID:7344
- C:\Windows\System\EXOTWEp.exe
  C:\Windows\System\EXOTWEp.exe
  2⤵
  PID:7628
- C:\Windows\System\tQFRzhl.exe
  C:\Windows\System\tQFRzhl.exe
  2⤵
  PID:7736
- C:\Windows\System\swuRsdl.exe
  C:\Windows\System\swuRsdl.exe
  2⤵
  PID:7800
- C:\Windows\System\phXntut.exe
  C:\Windows\System\phXntut.exe
  2⤵
  PID:7868
- C:\Windows\System\TLaYutX.exe
  C:\Windows\System\TLaYutX.exe
  2⤵
  PID:7680
- C:\Windows\System\dMWpKUf.exe
  C:\Windows\System\dMWpKUf.exe
  2⤵
  PID:7852
- C:\Windows\System\FtkaCdX.exe
  C:\Windows\System\FtkaCdX.exe
  2⤵
  PID:7928
- C:\Windows\System\WtMeyqd.exe
  C:\Windows\System\WtMeyqd.exe
  2⤵
  PID:7956
- C:\Windows\System\rviIEKW.exe
  C:\Windows\System\rviIEKW.exe
  2⤵
  PID:7996
- C:\Windows\System\JajQwDx.exe
  C:\Windows\System\JajQwDx.exe
  2⤵
  PID:8028
- C:\Windows\System\PuFNnOx.exe
  C:\Windows\System\PuFNnOx.exe
  2⤵
  PID:8024
- C:\Windows\System\BJrtDHG.exe
  C:\Windows\System\BJrtDHG.exe
  2⤵
  PID:8060
- C:\Windows\System\PnPHWuB.exe
  C:\Windows\System\PnPHWuB.exe
  2⤵
  PID:8092
- C:\Windows\System\csOTMyw.exe
  C:\Windows\System\csOTMyw.exe
  2⤵
  PID:8164
- C:\Windows\System\ZSfYbUT.exe
  C:\Windows\System\ZSfYbUT.exe
  2⤵
  PID:6972
- C:\Windows\System\ajzEPQm.exe
  C:\Windows\System\ajzEPQm.exe
  2⤵
  PID:8180
- C:\Windows\System\zcttkpA.exe
  C:\Windows\System\zcttkpA.exe
  2⤵
  PID:7476
- C:\Windows\System\vdXNcCV.exe
  C:\Windows\System\vdXNcCV.exe
  2⤵
  PID:7904
- C:\Windows\System\TaPCfCa.exe
  C:\Windows\System\TaPCfCa.exe
  2⤵
  PID:7940
- C:\Windows\System\vXLOJlj.exe
  C:\Windows\System\vXLOJlj.exe
  2⤵
  PID:8132
- C:\Windows\System\aaGTNaq.exe
  C:\Windows\System\aaGTNaq.exe
  2⤵
  PID:7944
- C:\Windows\System\DSYTeRu.exe
  C:\Windows\System\DSYTeRu.exe
  2⤵
  PID:8048
- C:\Windows\System\ekqundb.exe
  C:\Windows\System\ekqundb.exe
  2⤵
  PID:7964
- C:\Windows\System\elZIqdY.exe
  C:\Windows\System\elZIqdY.exe
  2⤵
  PID:6756
- C:\Windows\System\JunFBYZ.exe
  C:\Windows\System\JunFBYZ.exe
  2⤵
  PID:7348
- C:\Windows\System\lCZNwrj.exe
  C:\Windows\System\lCZNwrj.exe
  2⤵
  PID:7300
- C:\Windows\System\ODedkji.exe
  C:\Windows\System\ODedkji.exe
  2⤵
  PID:7252
- C:\Windows\System\TmVUyOF.exe
  C:\Windows\System\TmVUyOF.exe
  2⤵
  PID:7432
- C:\Windows\System\NxtcEMa.exe
  C:\Windows\System\NxtcEMa.exe
  2⤵
  PID:7664
- C:\Windows\System\ZOylUMT.exe
  C:\Windows\System\ZOylUMT.exe
  2⤵
  PID:7836
- C:\Windows\System\aSdTWXZ.exe
  C:\Windows\System\aSdTWXZ.exe
  2⤵
  PID:7564
- C:\Windows\System\XOPDULm.exe
  C:\Windows\System\XOPDULm.exe
  2⤵
  PID:7568
- C:\Windows\System\EKxgjII.exe
  C:\Windows\System\EKxgjII.exe
  2⤵
  PID:7616
- C:\Windows\System\daIMGFj.exe
  C:\Windows\System\daIMGFj.exe
  2⤵
  PID:6516
- C:\Windows\System\jzeQNFW.exe
  C:\Windows\System\jzeQNFW.exe
  2⤵
  PID:5168
- C:\Windows\System\KXLFuLS.exe
  C:\Windows\System\KXLFuLS.exe
  2⤵
  PID:8208
- C:\Windows\System\CqDRedC.exe
  C:\Windows\System\CqDRedC.exe
  2⤵
  PID:8224
- C:\Windows\System\mLfKQke.exe
  C:\Windows\System\mLfKQke.exe
  2⤵
  PID:8240
- C:\Windows\System\doYCExl.exe
  C:\Windows\System\doYCExl.exe
  2⤵
  PID:8256
- C:\Windows\System\MqILlsR.exe
  C:\Windows\System\MqILlsR.exe
  2⤵
  PID:8272
- C:\Windows\System\HEBaHtW.exe
  C:\Windows\System\HEBaHtW.exe
  2⤵
  PID:8296
- C:\Windows\System\GcxkXaK.exe
  C:\Windows\System\GcxkXaK.exe
  2⤵
  PID:8320
- C:\Windows\System\jYujemx.exe
  C:\Windows\System\jYujemx.exe
  2⤵
  PID:8336
- C:\Windows\System\vGZeUqW.exe
  C:\Windows\System\vGZeUqW.exe
  2⤵
  PID:8352
- C:\Windows\System\yNBgyTV.exe
  C:\Windows\System\yNBgyTV.exe
  2⤵
  PID:8372
- C:\Windows\System\iSPljud.exe
  C:\Windows\System\iSPljud.exe
  2⤵
  PID:8388
- C:\Windows\System\TXbuDoB.exe
  C:\Windows\System\TXbuDoB.exe
  2⤵
  PID:8404
- C:\Windows\System\hEMSJeo.exe
  C:\Windows\System\hEMSJeo.exe
  2⤵
  PID:8500
- C:\Windows\System\qYImknz.exe
  C:\Windows\System\qYImknz.exe
  2⤵
  PID:8536
- C:\Windows\System\kilBXAH.exe
  C:\Windows\System\kilBXAH.exe
  2⤵
  PID:8552
- C:\Windows\System\jCJZrcx.exe
  C:\Windows\System\jCJZrcx.exe
  2⤵
  PID:8572
- C:\Windows\System\ptHAhDo.exe
  C:\Windows\System\ptHAhDo.exe
  2⤵
  PID:8620
- C:\Windows\System\SHClooy.exe
  C:\Windows\System\SHClooy.exe
  2⤵
  PID:8640
- C:\Windows\System\wUKlKFG.exe
  C:\Windows\System\wUKlKFG.exe
  2⤵
  PID:8656
- C:\Windows\System\ZEoLjmv.exe
  C:\Windows\System\ZEoLjmv.exe
  2⤵
  PID:8672
- C:\Windows\System\qdklmua.exe
  C:\Windows\System\qdklmua.exe
  2⤵
  PID:8688
- C:\Windows\System\IaNglIJ.exe
  C:\Windows\System\IaNglIJ.exe
  2⤵
  PID:8704
- C:\Windows\System\rFDzfFs.exe
  C:\Windows\System\rFDzfFs.exe
  2⤵
  PID:8720
- C:\Windows\System\trnxlCe.exe
  C:\Windows\System\trnxlCe.exe
  2⤵
  PID:8736
- C:\Windows\System\hYNVaPj.exe
  C:\Windows\System\hYNVaPj.exe
  2⤵
  PID:8752
- C:\Windows\System\bQbHAnQ.exe
  C:\Windows\System\bQbHAnQ.exe
  2⤵
  PID:8768
- C:\Windows\System\NitWUGP.exe
  C:\Windows\System\NitWUGP.exe
  2⤵
  PID:8784
- C:\Windows\System\AVwNQfK.exe
  C:\Windows\System\AVwNQfK.exe
  2⤵
  PID:8800
- C:\Windows\System\Vgrkirf.exe
  C:\Windows\System\Vgrkirf.exe
  2⤵
  PID:8816
- C:\Windows\System\BWgPXZu.exe
  C:\Windows\System\BWgPXZu.exe
  2⤵
  PID:8832
- C:\Windows\System\zeprvrs.exe
  C:\Windows\System\zeprvrs.exe
  2⤵
  PID:8848
- C:\Windows\System\cNTqpaM.exe
  C:\Windows\System\cNTqpaM.exe
  2⤵
  PID:8864
- C:\Windows\System\qeEUvYR.exe
  C:\Windows\System\qeEUvYR.exe
  2⤵
  PID:8880
- C:\Windows\System\xoFnnJY.exe
  C:\Windows\System\xoFnnJY.exe
  2⤵
  PID:8896
- C:\Windows\System\SWlfvWP.exe
  C:\Windows\System\SWlfvWP.exe
  2⤵
  PID:8912
- C:\Windows\System\ZtVhPaQ.exe
  C:\Windows\System\ZtVhPaQ.exe
  2⤵
  PID:8928
- C:\Windows\System\oxPhisn.exe
  C:\Windows\System\oxPhisn.exe
  2⤵
  PID:8944
- C:\Windows\System\XGWVUIl.exe
  C:\Windows\System\XGWVUIl.exe
  2⤵
  PID:8960
- C:\Windows\System\QLSXAmG.exe
  C:\Windows\System\QLSXAmG.exe
  2⤵
  PID:8976
- C:\Windows\System\TzwUqlb.exe
  C:\Windows\System\TzwUqlb.exe
  2⤵
  PID:8992
- C:\Windows\System\OxlkDFj.exe
  C:\Windows\System\OxlkDFj.exe
  2⤵
  PID:9008
- C:\Windows\System\uIjYqsb.exe
  C:\Windows\System\uIjYqsb.exe
  2⤵
  PID:9024
- C:\Windows\System\OzESaua.exe
  C:\Windows\System\OzESaua.exe
  2⤵
  PID:9040
- C:\Windows\System\XWnEMRK.exe
  C:\Windows\System\XWnEMRK.exe
  2⤵
  PID:9056
- C:\Windows\System\DPdHCUO.exe
  C:\Windows\System\DPdHCUO.exe
  2⤵
  PID:9072
- C:\Windows\System\tzBDXoT.exe
  C:\Windows\System\tzBDXoT.exe
  2⤵
  PID:9088
- C:\Windows\System\FMJhyNf.exe
  C:\Windows\System\FMJhyNf.exe
  2⤵
  PID:9104
- C:\Windows\System\QeRkBhL.exe
  C:\Windows\System\QeRkBhL.exe
  2⤵
  PID:9120
- C:\Windows\System\VRSpQXp.exe
  C:\Windows\System\VRSpQXp.exe
  2⤵
  PID:9136
- C:\Windows\System\Ykmsved.exe
  C:\Windows\System\Ykmsved.exe
  2⤵
  PID:9152
- C:\Windows\System\IzAweMa.exe
  C:\Windows\System\IzAweMa.exe
  2⤵
  PID:9168
- C:\Windows\System\LIeRHfr.exe
  C:\Windows\System\LIeRHfr.exe
  2⤵
  PID:9184
- C:\Windows\System\ROLZZEJ.exe
  C:\Windows\System\ROLZZEJ.exe
  2⤵
  PID:9200
- C:\Windows\System\mlgptJC.exe
  C:\Windows\System\mlgptJC.exe
  2⤵
  PID:7200
- C:\Windows\System\YrgRhVW.exe
  C:\Windows\System\YrgRhVW.exe
  2⤵
  PID:7516
- C:\Windows\System\rZIUltz.exe
  C:\Windows\System\rZIUltz.exe
  2⤵
  PID:8200
- C:\Windows\System\yFFuRbK.exe
  C:\Windows\System\yFFuRbK.exe
  2⤵
  PID:8264
- C:\Windows\System\emEBngZ.exe
  C:\Windows\System\emEBngZ.exe
  2⤵
  PID:8316
- C:\Windows\System\BSvxhAZ.exe
  C:\Windows\System\BSvxhAZ.exe
  2⤵
  PID:7528
- C:\Windows\System\qpNQSXE.exe
  C:\Windows\System\qpNQSXE.exe
  2⤵
  PID:8148
- C:\Windows\System\zxghqUD.exe
  C:\Windows\System\zxghqUD.exe
  2⤵
  PID:8380
- C:\Windows\System\sMiIGBs.exe
  C:\Windows\System\sMiIGBs.exe
  2⤵
  PID:7748
- C:\Windows\System\OBSMPSB.exe
  C:\Windows\System\OBSMPSB.exe
  2⤵
  PID:7788
- C:\Windows\System\tRMbNQu.exe
  C:\Windows\System\tRMbNQu.exe
  2⤵
  PID:8052
- C:\Windows\System\qlWdccC.exe
  C:\Windows\System\qlWdccC.exe
  2⤵
  PID:7248
- C:\Windows\System\VwCsiKQ.exe
  C:\Windows\System\VwCsiKQ.exe
  2⤵
  PID:8360
- C:\Windows\System\sMdwaip.exe
  C:\Windows\System\sMdwaip.exe
  2⤵
  PID:8292
- C:\Windows\System\iAZKMzi.exe
  C:\Windows\System\iAZKMzi.exe
  2⤵
  PID:7464
- C:\Windows\System\AjEoxQY.exe
  C:\Windows\System\AjEoxQY.exe
  2⤵
  PID:8420
- C:\Windows\System\hFCBuKD.exe
  C:\Windows\System\hFCBuKD.exe
  2⤵
  PID:8432
- C:\Windows\System\fBAoSuB.exe
  C:\Windows\System\fBAoSuB.exe
  2⤵
  PID:8440
- C:\Windows\System\bJEFvNm.exe
  C:\Windows\System\bJEFvNm.exe
  2⤵
  PID:8456
- C:\Windows\System\xCuRzWo.exe
  C:\Windows\System\xCuRzWo.exe
  2⤵
  PID:8472
- C:\Windows\System\QEOkmYa.exe
  C:\Windows\System\QEOkmYa.exe
  2⤵
  PID:8496
- C:\Windows\System\yyVxlsg.exe
  C:\Windows\System\yyVxlsg.exe
  2⤵
  PID:8528
- C:\Windows\System\EQldEUr.exe
  C:\Windows\System\EQldEUr.exe
  2⤵
  PID:8548
- C:\Windows\System\zfMeRfI.exe
  C:\Windows\System\zfMeRfI.exe
  2⤵
  PID:8580
- C:\Windows\System\kjrDATu.exe
  C:\Windows\System\kjrDATu.exe
  2⤵
  PID:8588
- C:\Windows\System\KEaXVZo.exe
  C:\Windows\System\KEaXVZo.exe
  2⤵
  PID:8604
- C:\Windows\System\xLUYMJf.exe
  C:\Windows\System\xLUYMJf.exe
  2⤵
  PID:8652
- C:\Windows\System\GpoaxlS.exe
  C:\Windows\System\GpoaxlS.exe
  2⤵
  PID:8716
- C:\Windows\System\NllWUpx.exe
  C:\Windows\System\NllWUpx.exe
  2⤵
  PID:8628
- C:\Windows\System\OkMxcom.exe
  C:\Windows\System\OkMxcom.exe
  2⤵
  PID:8636
- C:\Windows\System\YrxmpKU.exe
  C:\Windows\System\YrxmpKU.exe
  2⤵
  PID:8728
- C:\Windows\System\zPPLYbR.exe
  C:\Windows\System\zPPLYbR.exe
  2⤵
  PID:8668
- C:\Windows\System\HGnCsjg.exe
  C:\Windows\System\HGnCsjg.exe
  2⤵
  PID:8700
- C:\Windows\System\TjKsacs.exe
  C:\Windows\System\TjKsacs.exe
  2⤵
  PID:8872
- C:\Windows\System\HoQIgUn.exe
  C:\Windows\System\HoQIgUn.exe
  2⤵
  PID:9068
- C:\Windows\System\tfhIbJV.exe
  C:\Windows\System\tfhIbJV.exe
  2⤵
  PID:8988
- C:\Windows\System\bzlKjKW.exe
  C:\Windows\System\bzlKjKW.exe
  2⤵
  PID:9132
- C:\Windows\System\jTzIAYW.exe
  C:\Windows\System\jTzIAYW.exe
  2⤵
  PID:9160
- C:\Windows\System\kTaAhik.exe
  C:\Windows\System\kTaAhik.exe
  2⤵
  PID:9196
- C:\Windows\System\RlXySkU.exe
  C:\Windows\System\RlXySkU.exe
  2⤵
  PID:8348
- C:\Windows\System\ebzHjmK.exe
  C:\Windows\System\ebzHjmK.exe
  2⤵
  PID:8136
- C:\Windows\System\roiZtHd.exe
  C:\Windows\System\roiZtHd.exe
  2⤵
  PID:8328
- C:\Windows\System\BAVLpDW.exe
  C:\Windows\System\BAVLpDW.exe
  2⤵
  PID:9176
- C:\Windows\System\yuwrFYr.exe
  C:\Windows\System\yuwrFYr.exe
  2⤵
  PID:8308
- C:\Windows\System\WpoXlAf.exe
  C:\Windows\System\WpoXlAf.exe
  2⤵
  PID:9144
- C:\Windows\System\ByOgucx.exe
  C:\Windows\System\ByOgucx.exe
  2⤵
  PID:9148
- C:\Windows\System\INnpJID.exe
  C:\Windows\System\INnpJID.exe
  2⤵
  PID:8020
- C:\Windows\System\eePLJjo.exe
  C:\Windows\System\eePLJjo.exe
  2⤵
  PID:8368
- C:\Windows\System\AgfJSjI.exe
  C:\Windows\System\AgfJSjI.exe
  2⤵
  PID:8412
- C:\Windows\System\mQEvBzG.exe
  C:\Windows\System\mQEvBzG.exe
  2⤵
  PID:8512
- C:\Windows\System\nCVtQEM.exe
  C:\Windows\System\nCVtQEM.exe
  2⤵
  PID:8520
- C:\Windows\System\lNyRAum.exe
  C:\Windows\System\lNyRAum.exe
  2⤵
  PID:8600
- C:\Windows\System\bVPCWXL.exe
  C:\Windows\System\bVPCWXL.exe
  2⤵
  PID:8508
- C:\Windows\System\EMLfreH.exe
  C:\Windows\System\EMLfreH.exe
  2⤵
  PID:8808
- C:\Windows\System\DlKCWsP.exe
  C:\Windows\System\DlKCWsP.exe
  2⤵
  PID:8648
- C:\Windows\System\NRgGHNi.exe
  C:\Windows\System\NRgGHNi.exe
  2⤵
  PID:8840
- C:\Windows\System\XhyblYu.exe
  C:\Windows\System\XhyblYu.exe
  2⤵
  PID:8696
- C:\Windows\System\bQzGouu.exe
  C:\Windows\System\bQzGouu.exe
  2⤵
  PID:8856
- C:\Windows\System\YpZVtJz.exe
  C:\Windows\System\YpZVtJz.exe
  2⤵
  PID:8924
- C:\Windows\System\VsMKbsi.exe
  C:\Windows\System\VsMKbsi.exe
  2⤵
  PID:8920
- C:\Windows\System\Jqdddwm.exe
  C:\Windows\System\Jqdddwm.exe
  2⤵
  PID:9004
- C:\Windows\System\NyZXQQu.exe
  C:\Windows\System\NyZXQQu.exe
  2⤵
  PID:9100
- C:\Windows\System\cLjwjbN.exe
  C:\Windows\System\cLjwjbN.exe
  2⤵
  PID:9080
- C:\Windows\System\JunZKrS.exe
  C:\Windows\System\JunZKrS.exe
  2⤵
  PID:9116
- C:\Windows\System\vyLREhT.exe
  C:\Windows\System\vyLREhT.exe
  2⤵
  PID:8068
- C:\Windows\System\uCUHmJP.exe
  C:\Windows\System\uCUHmJP.exe
  2⤵
  PID:8248
- C:\Windows\System\cxreBHL.exe
  C:\Windows\System\cxreBHL.exe
  2⤵
  PID:8416
- C:\Windows\System\HwNSQJg.exe
  C:\Windows\System\HwNSQJg.exe
  2⤵
  PID:7984
- C:\Windows\System\uDUzOKS.exe
  C:\Windows\System\uDUzOKS.exe
  2⤵
  PID:8252
- C:\Windows\System\SZCkBwX.exe
  C:\Windows\System\SZCkBwX.exe
  2⤵
  PID:8748
- C:\Windows\System\xBomvwW.exe
  C:\Windows\System\xBomvwW.exe
  2⤵
  PID:8908
- C:\Windows\System\QSUnWqj.exe
  C:\Windows\System\QSUnWqj.exe
  2⤵
  PID:8796
- C:\Windows\System\KsnnTOg.exe
  C:\Windows\System\KsnnTOg.exe
  2⤵
  PID:8904
- C:\Windows\System\yFQiMhV.exe
  C:\Windows\System\yFQiMhV.exe
  2⤵
  PID:8760
- C:\Windows\System\odbqUoD.exe
  C:\Windows\System\odbqUoD.exe
  2⤵
  PID:8016
- C:\Windows\System\lssCnLe.exe
  C:\Windows\System\lssCnLe.exe
  2⤵
  PID:8232
- C:\Windows\System\Yhotiew.exe
  C:\Windows\System\Yhotiew.exe
  2⤵
  PID:8544
- C:\Windows\System\ucRInID.exe
  C:\Windows\System\ucRInID.exe
  2⤵
  PID:8616
- C:\Windows\System\OFbHwSe.exe
  C:\Windows\System\OFbHwSe.exe
  2⤵
  PID:9036
- C:\Windows\System\AOFUfNv.exe
  C:\Windows\System\AOFUfNv.exe
  2⤵
  PID:8220
- C:\Windows\System\ZIMOjqA.exe
  C:\Windows\System\ZIMOjqA.exe
  2⤵
  PID:9000
- C:\Windows\System\KiilZIZ.exe
  C:\Windows\System\KiilZIZ.exe
  2⤵
  PID:8452
- C:\Windows\System\XHDueAr.exe
  C:\Windows\System\XHDueAr.exe
  2⤵
  PID:8436
- C:\Windows\System\iWrumLT.exe
  C:\Windows\System\iWrumLT.exe
  2⤵
  PID:8516
- C:\Windows\System\hLYNrOR.exe
  C:\Windows\System\hLYNrOR.exe
  2⤵
  PID:9212
- C:\Windows\System\KgVoJqf.exe
  C:\Windows\System\KgVoJqf.exe
  2⤵
  PID:8448
- C:\Windows\System\AmaJeOX.exe
  C:\Windows\System\AmaJeOX.exe
  2⤵
  PID:8712
- C:\Windows\System\xgegzXo.exe
  C:\Windows\System\xgegzXo.exe
  2⤵
  PID:9220
- C:\Windows\System\PffbzzR.exe
  C:\Windows\System\PffbzzR.exe
  2⤵
  PID:9236
- C:\Windows\System\nmeLbJm.exe
  C:\Windows\System\nmeLbJm.exe
  2⤵
  PID:9252
- C:\Windows\System\gfcioPh.exe
  C:\Windows\System\gfcioPh.exe
  2⤵
  PID:9268
- C:\Windows\System\CVIxVUV.exe
  C:\Windows\System\CVIxVUV.exe
  2⤵
  PID:9288
- C:\Windows\System\zPVAhgG.exe
  C:\Windows\System\zPVAhgG.exe
  2⤵
  PID:9304
- C:\Windows\System\HRFEUnC.exe
  C:\Windows\System\HRFEUnC.exe
  2⤵
  PID:9320
- C:\Windows\System\mfJufHP.exe
  C:\Windows\System\mfJufHP.exe
  2⤵
  PID:9340
- C:\Windows\System\anAhZss.exe
  C:\Windows\System\anAhZss.exe
  2⤵
  PID:9356
- C:\Windows\System\epDkOVD.exe
  C:\Windows\System\epDkOVD.exe
  2⤵
  PID:9372
- C:\Windows\System\KJlSVlO.exe
  C:\Windows\System\KJlSVlO.exe
  2⤵
  PID:9388
- C:\Windows\System\lXeqIOG.exe
  C:\Windows\System\lXeqIOG.exe
  2⤵
  PID:9404
- C:\Windows\System\AqxEUcA.exe
  C:\Windows\System\AqxEUcA.exe
  2⤵
  PID:9420
- C:\Windows\System\GmGfDrB.exe
  C:\Windows\System\GmGfDrB.exe
  2⤵
  PID:9436
- C:\Windows\System\hvzdgqW.exe
  C:\Windows\System\hvzdgqW.exe
  2⤵
  PID:9452
- C:\Windows\System\iwHBuKU.exe
  C:\Windows\System\iwHBuKU.exe
  2⤵
  PID:9468
- C:\Windows\System\qFxnQKp.exe
  C:\Windows\System\qFxnQKp.exe
  2⤵
  PID:9484
- C:\Windows\System\ASbhyHC.exe
  C:\Windows\System\ASbhyHC.exe
  2⤵
  PID:9500
- C:\Windows\System\OBVdilQ.exe
  C:\Windows\System\OBVdilQ.exe
  2⤵
  PID:9516
- C:\Windows\System\qcZjDJY.exe
  C:\Windows\System\qcZjDJY.exe
  2⤵
  PID:9532
- C:\Windows\System\IvYONOD.exe
  C:\Windows\System\IvYONOD.exe
  2⤵
  PID:9548
- C:\Windows\System\mDPxEpo.exe
  C:\Windows\System\mDPxEpo.exe
  2⤵
  PID:9564
- C:\Windows\System\csYAoCY.exe
  C:\Windows\System\csYAoCY.exe
  2⤵
  PID:9580
- C:\Windows\System\laoHoBr.exe
  C:\Windows\System\laoHoBr.exe
  2⤵
  PID:9596
- C:\Windows\System\QahFKGd.exe
  C:\Windows\System\QahFKGd.exe
  2⤵
  PID:9612
- C:\Windows\System\SYKoKJC.exe
  C:\Windows\System\SYKoKJC.exe
  2⤵
  PID:9628
- C:\Windows\System\ztmRTRX.exe
  C:\Windows\System\ztmRTRX.exe
  2⤵
  PID:9644
- C:\Windows\System\crzesLV.exe
  C:\Windows\System\crzesLV.exe
  2⤵
  PID:9660
- C:\Windows\System\AGqqFxX.exe
  C:\Windows\System\AGqqFxX.exe
  2⤵
  PID:9676
- C:\Windows\System\rOOxnVB.exe
  C:\Windows\System\rOOxnVB.exe
  2⤵
  PID:9692
- C:\Windows\System\TCUUTas.exe
  C:\Windows\System\TCUUTas.exe
  2⤵
  PID:9708
- C:\Windows\System\ypdAMaG.exe
  C:\Windows\System\ypdAMaG.exe
  2⤵
  PID:9724
- C:\Windows\System\PpcQqeV.exe
  C:\Windows\System\PpcQqeV.exe
  2⤵
  PID:9740
- C:\Windows\System\CRxupoJ.exe
  C:\Windows\System\CRxupoJ.exe
  2⤵
  PID:9756
- C:\Windows\System\qINBDkn.exe
  C:\Windows\System\qINBDkn.exe
  2⤵
  PID:9772
- C:\Windows\System\qxiIAgb.exe
  C:\Windows\System\qxiIAgb.exe
  2⤵
  PID:9788
- C:\Windows\System\EuOXEGk.exe
  C:\Windows\System\EuOXEGk.exe
  2⤵
  PID:9804
- C:\Windows\System\YoBUQUw.exe
  C:\Windows\System\YoBUQUw.exe
  2⤵
  PID:9820
- C:\Windows\System\wLMOiPB.exe
  C:\Windows\System\wLMOiPB.exe
  2⤵
  PID:9836
- C:\Windows\System\DrHRPpJ.exe
  C:\Windows\System\DrHRPpJ.exe
  2⤵
  PID:9856
- C:\Windows\System\enlUPWb.exe
  C:\Windows\System\enlUPWb.exe
  2⤵
  PID:9872
- C:\Windows\System\dKUMBaf.exe
  C:\Windows\System\dKUMBaf.exe
  2⤵
  PID:9888
- C:\Windows\System\asrZgMh.exe
  C:\Windows\System\asrZgMh.exe
  2⤵
  PID:9904
- C:\Windows\System\nOwETdW.exe
  C:\Windows\System\nOwETdW.exe
  2⤵
  PID:9920
- C:\Windows\System\bspKLKI.exe
  C:\Windows\System\bspKLKI.exe
  2⤵
  PID:9936
- C:\Windows\System\FwnbWek.exe
  C:\Windows\System\FwnbWek.exe
  2⤵
  PID:9952
- C:\Windows\System\fJyqcYQ.exe
  C:\Windows\System\fJyqcYQ.exe
  2⤵
  PID:9968
- C:\Windows\System\rVrldQB.exe
  C:\Windows\System\rVrldQB.exe
  2⤵
  PID:9988
- C:\Windows\System\NIpXmcE.exe
  C:\Windows\System\NIpXmcE.exe
  2⤵
  PID:10004
- C:\Windows\System\EuTxzrH.exe
  C:\Windows\System\EuTxzrH.exe
  2⤵
  PID:10020
- C:\Windows\System\odKouXC.exe
  C:\Windows\System\odKouXC.exe
  2⤵
  PID:10036
- C:\Windows\System\XXsoSvK.exe
  C:\Windows\System\XXsoSvK.exe
  2⤵
  PID:10052
- C:\Windows\System\bimseUd.exe
  C:\Windows\System\bimseUd.exe
  2⤵
  PID:10088
- C:\Windows\System\tqbnXse.exe
  C:\Windows\System\tqbnXse.exe
  2⤵
  PID:10104
- C:\Windows\System\iNeHSnq.exe
  C:\Windows\System\iNeHSnq.exe
  2⤵
  PID:10120
- C:\Windows\System\dpTtNoP.exe
  C:\Windows\System\dpTtNoP.exe
  2⤵
  PID:10136
- C:\Windows\System\BXoTAet.exe
  C:\Windows\System\BXoTAet.exe
  2⤵
  PID:10152
- C:\Windows\System\YZkPjnA.exe
  C:\Windows\System\YZkPjnA.exe
  2⤵
  PID:10168
- C:\Windows\System\lfsHVkL.exe
  C:\Windows\System\lfsHVkL.exe
  2⤵
  PID:10188
- C:\Windows\System\RrxWowo.exe
  C:\Windows\System\RrxWowo.exe
  2⤵
  PID:10204
- C:\Windows\System\WDAYGUR.exe
  C:\Windows\System\WDAYGUR.exe
  2⤵
  PID:10220
- C:\Windows\System\wyFeYPZ.exe
  C:\Windows\System\wyFeYPZ.exe
  2⤵
  PID:9244
- C:\Windows\System\vIvStoq.exe
  C:\Windows\System\vIvStoq.exe
  2⤵
  PID:7692
- C:\Windows\System\CYDvpeU.exe
  C:\Windows\System\CYDvpeU.exe
  2⤵
  PID:9316
- C:\Windows\System\sENewQT.exe
  C:\Windows\System\sENewQT.exe
  2⤵
  PID:9380
- C:\Windows\System\iKZKoHX.exe
  C:\Windows\System\iKZKoHX.exe
  2⤵
  PID:9232
- C:\Windows\System\CctAGPi.exe
  C:\Windows\System\CctAGPi.exe
  2⤵
  PID:9668
- C:\Windows\System\AELrCsv.exe
  C:\Windows\System\AELrCsv.exe
  2⤵
  PID:9428
- C:\Windows\System\cKXBByG.exe
  C:\Windows\System\cKXBByG.exe
  2⤵
  PID:9736
- C:\Windows\System\UGQnyil.exe
  C:\Windows\System\UGQnyil.exe
  2⤵
  PID:9764
- C:\Windows\System\KxeamfF.exe
  C:\Windows\System\KxeamfF.exe
  2⤵
  PID:9828
- C:\Windows\System\uuJHTqj.exe
  C:\Windows\System\uuJHTqj.exe
  2⤵
  PID:9556
- C:\Windows\System\hKOmYBK.exe
  C:\Windows\System\hKOmYBK.exe
  2⤵
  PID:9652
- C:\Windows\System\qJkwHUd.exe
  C:\Windows\System\qJkwHUd.exe
  2⤵
  PID:9900
- C:\Windows\System\EHIJdNJ.exe
  C:\Windows\System\EHIJdNJ.exe
  2⤵
  PID:9880
- C:\Windows\System\LUuTINu.exe
  C:\Windows\System\LUuTINu.exe
  2⤵
  PID:9720
- C:\Windows\System\hpMpquZ.exe
  C:\Windows\System\hpMpquZ.exe
  2⤵
  PID:9812
- C:\Windows\System\YFPZwCm.exe
  C:\Windows\System\YFPZwCm.exe
  2⤵
  PID:9752
- C:\Windows\System\tQUVhYA.exe
  C:\Windows\System\tQUVhYA.exe
  2⤵
  PID:9976
- C:\Windows\System\zCMegFu.exe
  C:\Windows\System\zCMegFu.exe
  2⤵
  PID:10000
- C:\Windows\System\IjlvAkx.exe
  C:\Windows\System\IjlvAkx.exe
  2⤵
  PID:10068
- C:\Windows\System\KsizHgh.exe
  C:\Windows\System\KsizHgh.exe
  2⤵
  PID:10064
- C:\Windows\System\YnVOFSY.exe
  C:\Windows\System\YnVOFSY.exe
  2⤵
  PID:10148
- C:\Windows\System\kDbfMGi.exe
  C:\Windows\System\kDbfMGi.exe
  2⤵
  PID:10216
- C:\Windows\System\VnkzIak.exe
  C:\Windows\System\VnkzIak.exe
  2⤵
  PID:9384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DNofBSu.exe

Filesize
1.8MB

MD5
ff5390d3287131267b14d253a4235c3a

SHA1
8c0a5f376eb9f88693553507020196ba4efd694b

SHA256
0b37a62e63e402f06b7d218dc4359c15f9caf177025221a95e45b29d1f713b07

SHA512
cc9715444c47fd9ba4beb48cf80003b5c3d0292721b8e71d720776cb0140b954645af48a6797e300af7cedfc8dd50e7526a2995e9d50cacf27d2c0e74c48e9da

Download Submit
C:\Windows\system\EnXyxJH.exe

Filesize
1.9MB

MD5
6de3ec1abb69f25dccbffe502ddce003

SHA1
078dfe391d527c7e2a9e3aaa7d41ed193d4b05c6

SHA256
6f26b01854ad1076ee551e1d5eccaa2d18d4d8c8cadf55177cfe7771f884dd32

SHA512
3da9f80e0b187809f6452b97aa1506df9a9ea846f26c18c5e181ca097fb24cc744bf6c77e27566b441b5e29630f06a277c994b0833c6ff6a453a74f13eea403b

Download Submit
C:\Windows\system\FWUbUdg.exe

Filesize
1.9MB

MD5
f3e57a08c6e49f420b41e33f8ccafbe6

SHA1
f1d264ea1c34a22cd044f99b2b2e21953d787577

SHA256
5cdea819b8f3fa25968fce938617b298078139980a8134c5f56ca684c833e3e5

SHA512
efaee1a6b0983c37c7734363a3a20201c4a674d49f6287263f3d420bbf09baa8b004f04c63b9d45aa997e5634e9ad97b9534bd85d433d8754af18efbae0a0da1

Download Submit
C:\Windows\system\FbryaAz.exe

Filesize
1.9MB

MD5
74d7200fc0a8ed60f998cd636b461adb

SHA1
39b45378e069918b0ffc8b272f28153f10077ce6

SHA256
9783d0051dff487746f8f5adcbc67f5171299b082a2b03b6b73c3402688400c4

SHA512
e7d5ecf3e879728a7b348a37a230438b932c077cb38f4c28f9a76c120cd96b599d0d5c7fa9f4753a61316fd9d59d2bf3bf8d66c15fb451623e5d75a1337b557e

Download Submit
C:\Windows\system\FiOBvFD.exe

Filesize
1.9MB

MD5
c3c3894118878d507ebece765b34ee1c

SHA1
aed3589fe31ddebc1dc43fb7f31f615cef5630a4

SHA256
63cb9c58457cc2f6e0277f8b975c2272b4bd6e3a52c8059f0bd3a4eb76a1e29a

SHA512
2dbfa9ff065d50cb19761c0aac6df64bcb550059d161d25a132048f76cc8b188e408a3422f16dedc1a6981a1123d298a0d43143e53c92746d84fa1d68b390512

Download Submit
C:\Windows\system\KnBdtFo.exe

Filesize
1.9MB

MD5
de0a0ea761647da174516e856f6876c0

SHA1
d8e3ffb8d61cceb682038c9656849af4b29f6c9e

SHA256
c3bf044eea59d7ebffcf6e521c2c400f6a28be29ca0dc73c121df08775288753

SHA512
2651fb5ad625fa5df6d514a246cfc0c5bdfe12812c7179f235a308dc92952e39b87131c9459f17068d13be97e2f0cf1a282f70c80c9863c995ecd13671c1adaa

Download Submit
C:\Windows\system\MJBUwvU.exe

Filesize
1.9MB

MD5
b2894b4ca58e4a44bf0de13f328cd623

SHA1
6c03b6b02db699b9dca6e700125d7fa41c7ededf

SHA256
a9d75a9923b81206b7a1b9effc89ca3dac4be3d3482bab803e0f1239678f43fa

SHA512
252b37433e0c839a6abf34ab78c9362c28fd060e6f4d47792ffac9733d2aeedc850debf1d3ae20653d7b11185da6f9c6dae0c7dade961e6d5acc758e6871f164

Download Submit
C:\Windows\system\QCPvhar.exe

Filesize
1.8MB

MD5
74d67552d8e3072d8f75af47ffe891d8

SHA1
07055a13e4ba1ba760edb08152d882d0ceaebae9

SHA256
588fccec9b4b0ab503c33c8da42fa5fcf68954cc8f9bd09a4d10b136940230a2

SHA512
2c7d6105621f942c56f90c47a6d66bfda2e4f595ec760854b3f2ff8384ff061dfd24ff031824769125bfbf60b47a11437ff432439780b4a3846af5ae5c18755d

Download Submit
C:\Windows\system\TofcjLk.exe

Filesize
1.9MB

MD5
a3ffc8659b3bd5ca23226822e1ef3138

SHA1
a34babe8ed3a376614fb9393ab5adaa12ed12001

SHA256
0af576101a87f1f5feaacea90405445e981566dd834e00026fb560b8d3ad07b1

SHA512
a526fbfdba74101fa09add02f7b4890a0a814a39d92e52bf2dadb1c4a3eb9a83d40c72bfa219ee6ffd00f52ea1d050cca67ad58ad30a0936de200be32f8f946b

Download Submit
C:\Windows\system\VJXMscY.exe

Filesize
1.9MB

MD5
6856e7fb4ec8604e197117d8d427898a

SHA1
7f704acaf07f05c8690c17970826a62385490d47

SHA256
11e6ebf9f62db1b3f4cff189e9a602c3933492e9592d5d0054f0ca6c754351d3

SHA512
a2f99309c3bf566d3d939691f157432a567c666a3004ef2372db535ab24f1e52f3b5aa3aaf93dcd9e79163ed4ead8e6ab10af5aafb5818c7c0b9a8a158d985c1

Download Submit
C:\Windows\system\WKReGtK.exe

Filesize
1.9MB

MD5
93cf312b4536dcb5c6a947a4c4ae2ab7

SHA1
16cc5750d455a8c50e7cd114fd23fe5ae15ee62c

SHA256
3de4cae5183ab5eaa962560ef1ca7878cde97529d97e77f566c09ae1ac588ef0

SHA512
c7c6a2f03b94413d7469ad9d3675dbff148970f0e73a6b7c57dc49f1d5d38e4ea39121b47ef12fcc0a4b383586001476134ff46f7d4ec7b2572785c539720e64

Download Submit
C:\Windows\system\YHHLiKy.exe

Filesize
1.9MB

MD5
9f59555ab5f18dec585285369df5bfe4

SHA1
e77cd5473b8d84e94c63a86a62cda1d9c74c3123

SHA256
fd54067502c42d897dd03a0ce52d95b7cc45084675fd0c6a1d51878e0e173c82

SHA512
e6e0676e1b752aa056d59c8a18fe8e15a3d455f2ab49a95a9d79dc20a6b8fad49f96ac941451ed804e0a1bf956ee54b2ef1962fbd78214ee2be3f73e309c24fa

Download Submit
C:\Windows\system\YycLZvd.exe

Filesize
1.9MB

MD5
1b189fbbdfe00dc83ccbff173356da30

SHA1
e8acac217e645ca1d18bf6f33d5e3d3e295e3fc3

SHA256
2f29653c1c5258290b2e1d773b675e24e245b4fa55da9046a7334b97813f4d04

SHA512
338742b9a7d186839339a443e76311640e3d60040a22040f2a95d5f757321729d0e235c0d4735bde8ba25bdf04f021b4e05d4f8f00bc6c123bafa8cb0ea08a9a

Download Submit
C:\Windows\system\ZPzDgYD.exe

Filesize
1.9MB

MD5
8f73784d3b4ec7872efe0cb5cf45a6bb

SHA1
5b819c92595f3c24a650a3d3f6db6c865492c2ad

SHA256
bcf78783461e053a7684c7b55e98935c3cfc3029e45aa19d4a5dcb0f1fcbd240

SHA512
7cfe165b8a78ad0828fb68794a30094a02288ab6c1fbd13de0d15c8230945c27b741ba919f00f836349c602d20514c51d928f10511391eb9550217e8328fc050

Download Submit
C:\Windows\system\aXcOutX.exe

Filesize
1.9MB

MD5
566edbccff9827009ee744c2739f1ecf

SHA1
e4a55e1400a7a090995960f3941d46f41067181c

SHA256
ddf8f1525ed8741f05ba10e5cad18f8f4f403989a17ff57bcd3eea24a3183b04

SHA512
70a54ab41c9934de9be821e974de6a53c7c4f9058af02a8989cf90ac33522180aeac3988eed0c262591c58924d8401e0c016040c7e0c5d66dfdaca0378d5f2b1

Download Submit
C:\Windows\system\aXrryFw.exe

Filesize
1.9MB

MD5
f564ead2025b3089b45cceeded33176c

SHA1
30166b5fe252b44183190645d1b9960c2504ee83

SHA256
4ef23fafdd857f1f62ed0e213ab7f516d4dd6b2f964d6f8c96a90736f43ac5b8

SHA512
7c32bc99ef7dcab64b000bd4c4a0b82d6a0d776e6b3f8a6f974a2df635605d3b2cfca8a47c08faa9b67d2708bbeca6b251bc31ba2b30f7dc1877fca6998b9afe

Download Submit
C:\Windows\system\blmIYYB.exe

Filesize
1.9MB

MD5
fd648dd392bf4c48cbd7335d267b72dc

SHA1
7b529a39cc369f2bbae312855f928556c37f5d0c

SHA256
507becfaba17ec4e5949441d23505b668cdff04ce2cfc3ed9ffd0372aabdbd9d

SHA512
ebc59eeead88f4a2303279c5fa6f9f69cbee2cf573b8edf9d4839e86c156e95e173549780a6fa55c7aecc081688d00fbcbe919a0b53ff9f2e703cf5432c9a4c2

Download Submit
C:\Windows\system\byqYBNv.exe

Filesize
1.9MB

MD5
643a44120d90116fa3c93cda3c6bb2dd

SHA1
86e4c6b7fba6761e8f5bf3f545b05783929ad5ac

SHA256
74017593aeae2d2bb67d42efc4001e0fbe3cb85949cae571e773f5e35e84addd

SHA512
776bf4fd4519e1b9a4214be52d7b82ea3fa65bff615bc4bb9523e1d4f5aedd9ace98e094ce9c5aa1b07935be467a155791f016dcc7900ac26aac8827e92f9fbc

Download Submit
C:\Windows\system\dqZNkCe.exe

Filesize
1.9MB

MD5
8ef8fbdf588ebcd8718b7479e8b31ff2

SHA1
32a88d20d83895e5ad232c14443dcbc307ad93b1

SHA256
26a3bb63a822c89a86cf7039d3194bc536bda77bc36c04a83c854070e2e02b88

SHA512
bb582b03c1a430de7a95a1b2cd2fdf7ca4ed408ef637081187145e81a100bd94cce8e61312318ef1582814a51ae4da9795b458eb0bfa1938178b3d3c8c2b57b6

Download Submit
C:\Windows\system\gZuVZhN.exe

Filesize
1.9MB

MD5
2990d06a87ceae862fd32c1e27be1348

SHA1
653cf5dfc8923f396ef785aefc6b76669c558bcc

SHA256
3f6307accdfaf0db0fc5efb1f1b8567ec704bb78abdb7060db266e7f026ccf14

SHA512
9a86974a8a9e0bb871757c1ed512e7dc15f936b136e07466ab36b9003dcbf4c42a49f54ce4c75d114c328afa152637e29d7e1c9878efa66470845c00c8155454

Download Submit
C:\Windows\system\jtwOjGz.exe

Filesize
1.9MB

MD5
fa9debb39861603440d3387722a17067

SHA1
46666652cdeb22a4e4af0fa91a353d2aed2b9b9e

SHA256
e4340554cba910541a6f01a6bf549aab8119c076104f89d7333483e5c676df35

SHA512
4cf1c162f05c18ab1e61970d3f7079d0c72c96793fdaa2286195b586c97f3413993172bb9e75fc78ed96a765793b0c1e19f60b247779edc2aee15c398c942af2

Download Submit
C:\Windows\system\lywjLrv.exe

Filesize
1.9MB

MD5
901f48d07f599649d11c2c93d3e95ea3

SHA1
a894779b37de4d629b58f17cc07ba1931445de79

SHA256
3f070aa67c361420517f9f6b85fcd022cc62ec6eb4b025e3308f2a89a4cf67df

SHA512
7832aecc44a3b45cb3e709e1b790b1c446ac925f5f9c5f878ef41cfdcf3fbb847f2ae500c34979108c84b12e559b5bb6116f1b39fd569052b1023be471ba6dee

Download Submit
C:\Windows\system\mPerjpc.exe

Filesize
1.9MB

MD5
c8c9eabe5320c8c1a528736f762e973e

SHA1
3503e0cb8ed65bcec2ad347200285fbda6b96b71

SHA256
e2b91b07d876cbdf6a7cbeb4b53342df8b10131e92b08b42aee0b8eb8c3ae576

SHA512
f86fb0e44a7ce2a0ffbdca59c353f16596f7d93189b51d02bdf0b851861ede671aa3afbb4d2c2ceecda448b0a7ab006d61801d7c92806953d8e5b42e62c24c4c

Download Submit
C:\Windows\system\nqwSvcE.exe

Filesize
1.9MB

MD5
720f0689c6b5d48abbf6d2e10c3efd24

SHA1
ed861c7ae5999b6bbf165e81df35337378640c5a

SHA256
18b7aff3438f92b005883e16e7b0573b06290e716ec778115bec867e2b541574

SHA512
fc50622cdfdada231154d95b7385cb9fffddfb2c92cd60d663094254ea321b125074e85c21716fb5587d06de258a7a61fbcce084f0b134fc6ec8c806d0ed0c73

Download Submit
C:\Windows\system\tbQjUvm.exe

Filesize
1.9MB

MD5
3fb25967d1a49850b17879db10c5d8f8

SHA1
25a5e26c95072e6bff44a1c23563b7c088e98ada

SHA256
ed7eb8f82487719767aa5374b24c29c1e8eb6227deee012a4560d67d0757a12a

SHA512
4242deea02943d4bc0e420bcbb0028fd95f4ce18d5b4cf5f58860da088b5fb01fe4941126c442cdd53c244dfb9dbea0cb52afd9961fd282de341692786d6cff9

Download Submit
\Windows\system\LPkcpXK.exe

Filesize
1.9MB

MD5
55511330804a308a5524b3bd42aef4a3

SHA1
64113d96d255a8e9c25b39bb6cc50d4f34559a5e

SHA256
e52879403527721fba8042b54dbe671f539e1d57f00a75131df29a77f2499bbe

SHA512
38c538d11c3c6221579f682135d40de77fe9a91f375cc5c59bf53e656be0f3777d545247876b5be728390fd18841fc8cd1529437b11899f9f665f7a007b5cfb0

Download Submit
\Windows\system\LwKhCKU.exe

Filesize
1.9MB

MD5
2b192596a07c55c77bf277ebbced065d

SHA1
55a7efb30f09796cb9ca62ea13c8a5aa54429379

SHA256
ff6d6a2f4a0bcefa6fa94b5942c7b5e05469ec4129c9c8ff1f4f9ce19d2734dd

SHA512
5171eaa3996354fe3b0a6613112ac76d25e5c4d791ab75617448f19bf078c2fbf7f68cd68b0572cf6dd2390aab195001e648e905d8335c3a693050080f0dae3c

Download Submit
\Windows\system\NXkTqpd.exe

Filesize
1.9MB

MD5
c28ab5f5e0d6600c8279138b5cfd1a33

SHA1
e30799bb3f2f285b6c185be772fb3486d542088c

SHA256
d37d4edae17c1dc9377e0002f3865c936cd22e0c03d114b485b89eddc0ee0e28

SHA512
8e9531805aecacce2076b7201822cd59c665dd122347ce01e8926c0276bc5c2872fe79e0d475e3e4ca18598f7c44cdea93662101d76ed8a0c3395eebf2c11bdc

Download Submit
\Windows\system\VbrXvWq.exe

Filesize
1.9MB

MD5
0a60771797c1a63400a1ddc2119e31f4

SHA1
6c8f745fb8a61c6510e0643bcb0fcbb8beadd640

SHA256
9bef421e2ff15ef70eea7532a157d58572cf64dca7cec8c43a2841c764bfe1ab

SHA512
e3c15e3221aefa0f12424e4e8656a6303337024e616243d3532f45748a97d4886b1faee4406bc901c72999b73e5df93b41cf29d1989b4414133aabed2abc30df

Download Submit
\Windows\system\bARNHHP.exe

Filesize
1.8MB

MD5
df3a7569cd839abeb298be3ac55c40d7

SHA1
6aa244cac004f17b04b6b2b0f08886c27fd9306d

SHA256
04755f1feaf3426add8411158b716000810aa5176c7877ab11341b21931c2c9b

SHA512
1c9d53d86351c525348f63ae85fe7301faff88c8f16f41ca91712a0f082c126df8a35e7a24b524d99f22c74d50d2f52015f4f8d17657684a82746a5960b01159

Download Submit
\Windows\system\hEpFfIo.exe

Filesize
1.8MB

MD5
26bd775a2b7046741e1b770f7a297ca6

SHA1
3caca86ee13c745a10f28fca66559ce19fa44afb

SHA256
42daaae5be21f2c380482b3683680c54a09dad64cf54c8fc7901b65eb18704ae

SHA512
9efd1d678c034936a29a7b0a0401e141d1d377c7ff550d29f46c93b9553437b1c49d9f032f767a4d84244b5c6e2eb2d04ec193e40c5b4f54f7521f5e1a7cb4ef

Download Submit
\Windows\system\ijjoiAK.exe

Filesize
1.9MB

MD5
fd647194a1ebba6111d87529bf63943e

SHA1
840c556b9a9ea76a88b54855776d5add73462f8d

SHA256
240b2cbfdc1823ecb25130361608bf5430fc92d3a806277439f3fb5d08ae0073

SHA512
679fac15b0782f56d9e3ff2f58248d0075577bd9d377907239cae116bbf21ae772c196c7c3fa1a7ec1866f1d90a21910993536c4530a73b5e9d21f19a5c8d0fa

Download Submit
memory/2148-134-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2244-129-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-131-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2244-145-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2244-14-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-127-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-2-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2244-7-0x00000000031C0000-0x00000000035B2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-124-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-123-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2244-133-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2244-114-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2244-110-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2244-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2352-90-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2352-507-0x000007FEF5D30000-0x000007FEF66CD000-memory.dmp

Filesize
9.6MB

Download
memory/2352-101-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/2352-85-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2352-91-0x0000000002950000-0x00000000029D0000-memory.dmp

Filesize
512KB

Download
memory/2436-128-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-126-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2484-125-0x000000013F920000-0x000000013FD12000-memory.dmp

Filesize
3.9MB

Download
memory/2512-130-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-109-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2588-15-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2672-113-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/2688-122-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2716-9-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2916-132-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download