xmrig | a441bf67e2131f7cce8961084f1a236b1a1209c8980d3783bf6945fe18d6c02a

Analysis

max time kernel
33s
max time network
31s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
Size

1.9MB
MD5

090ed9728133ec123c17fb688e5e0f5b
SHA1

7110cbccef466701bd9e205747c33811b77ff94e
SHA256

a441bf67e2131f7cce8961084f1a236b1a1209c8980d3783bf6945fe18d6c02a
SHA512

60cb9a69d8dd107f86e6daedfc7f61b3ca323e01d8a21ba0822c230d12d20460897dee47aef4a583858e9bb8d2ccd061a54cc649753fbb8373016c7a81853e4c
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1P:NABK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/3024-98-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2104-95-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2784-93-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/3028-92-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2632-91-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2672-90-0x000000013F400000-0x000000013F7F2000-memory.dmp	xmrig
behavioral1/memory/2572-87-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3024	ZPOpilK.exe
2572	GQtpkTP.exe
2672	RJkNRPm.exe
2632	JpfoGsC.exe
3028	gpCweld.exe
2784	zwEdUEd.exe
2104	CdKuOdV.exe
2620	qWmOXGI.exe
2492	lYmLdUY.exe
2960	tleghIe.exe
792	WoyOgsa.exe
2708	YQkTgyc.exe
1500	AUTrNhI.exe
2612	BLsgnlE.exe
2596	gIrBGxh.exe
1924	yXKdnoh.exe
2292	UFgasXg.exe
2168	IfkQySt.exe
756	iMbdxTw.exe
828	yAAOxGx.exe
2600	heUUqwa.exe
2312	GjTAGTR.exe
1616	NAuAnvq.exe
1216	jZptELR.exe
2280	dQmByVu.exe
1844	pPWRuTA.exe
1624	owZpVqM.exe
1372	YaaUgjx.exe
1260	KfogyFU.exe
1816	hhPFsYa.exe
1468	YEDMqoV.exe
448	uYdVIEn.exe
2324	aLKcLkp.exe
3044	IztYbyL.exe
1764	uSIcNyR.exe
1772	zeSqFfy.exe
1776	WFBMwDD.exe
1268	JPQUgkb.exe
1068	AKPTwfi.exe
896	IUSkkPt.exe
1036	irWSozA.exe
1028	gqudwhW.exe
2036	fvXSjYx.exe
780	EHKiMMb.exe
2948	WGdmqpo.exe
2228	RsLilvl.exe
2992	vARKFNl.exe
2076	RYMRqmk.exe
2832	FRXInud.exe
2968	gfGFGuR.exe
1592	lfgauNh.exe
2744	gzbYawp.exe
1828	CToZKIF.exe
876	nymqyih.exe
1700	QRwXjFw.exe
2100	TZYKBCV.exe
1596	npPrzgO.exe
2704	vMTiWoJ.exe
2320	iqfOYcg.exe
532	yoHkTjw.exe
764	dyAKIdO.exe
2472	CcMKjBj.exe
1988	cQcFsgF.exe
2480	mkLufaT.exe

Loads dropped DLL 64 IoCs

pid	Process
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2188-0-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/files/0x0008000000013a15-13.dat	upx
behavioral1/files/0x000b000000013abd-42.dat	upx
behavioral1/files/0x0008000000013a85-20.dat	upx
behavioral1/files/0x00060000000148af-64.dat	upx
behavioral1/files/0x003a000000013362-60.dat	upx
behavioral1/files/0x000600000001474b-57.dat	upx
behavioral1/files/0x00060000000146a7-51.dat	upx
behavioral1/files/0x0006000000014c0b-102.dat	upx
behavioral1/files/0x0006000000015a15-137.dat	upx
behavioral1/files/0x0006000000015b72-149.dat	upx
behavioral1/files/0x00130000000054a8-151.dat	upx
behavioral1/files/0x000a000000013b02-26.dat	upx
behavioral1/files/0x0006000000015c91-172.dat	upx
behavioral1/files/0x003900000001340e-185.dat	upx
behavioral1/files/0x0006000000015bb5-183.dat	upx
behavioral1/files/0x0006000000015b37-168.dat	upx
behavioral1/files/0x00060000000155e8-166.dat	upx
behavioral1/files/0x000600000001523e-164.dat	upx
behavioral1/files/0x0006000000015077-162.dat	upx
behavioral1/files/0x0006000000014a29-146.dat	upx
behavioral1/files/0x000600000001475f-145.dat	upx
behavioral1/files/0x0006000000014730-144.dat	upx
behavioral1/files/0x000600000001543a-134.dat	upx
behavioral1/files/0x00060000000145d4-128.dat	upx
behavioral1/files/0x0007000000014fac-121.dat	upx
behavioral1/files/0x0006000000014525-114.dat	upx
behavioral1/memory/3024-98-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/memory/2104-95-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/2784-93-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/3028-92-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2632-91-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2672-90-0x000000013F400000-0x000000013F7F2000-memory.dmp	upx
behavioral1/memory/2572-87-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x00060000000150aa-124.dat	upx
behavioral1/files/0x00060000000145c9-44.dat	upx
behavioral1/files/0x000800000001451d-43.dat	upx
behavioral1/files/0x0008000000013a65-41.dat	upx
behavioral1/files/0x000a0000000134f5-40.dat	upx
behavioral1/files/0x000d00000001228a-10.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\jVhrgYt.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\uVxIaOK.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\tUOOnYp.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\bCwbiKV.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\lPTDYdQ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\gPwUbOY.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ExrdsoC.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\oJlXoSw.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\SWGatiK.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\iSgZKRu.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\uiwCfzb.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\VlqDyuL.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\zqnCvDH.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\OwzrtRN.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\McMiEwB.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\DQMWvFt.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\lBACPuD.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\CXKUfrR.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\hTodUDJ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\DPPHadn.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\yLMrzUK.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\Omtjihc.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\RlDNkmF.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\YaaUgjx.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\odeGntX.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\kZsbFjR.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\lnFBCkS.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\idUgfFd.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\qBAZiCl.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\PJYVLfY.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\tCnYjzb.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\xDciDNJ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\KNZKmTk.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dIrXeyg.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\iKADcYG.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dWBhZSe.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\OkTcXGx.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\DNplCKm.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\FvxmhEV.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dTfBewX.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\dKeTewf.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\WromfwL.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\TYJnVnj.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\gqMRPXN.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\NocoPTp.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\cZmCVoY.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\iAIVlWv.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\jYwXnFV.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\sPSiSPh.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\eryJAGH.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\VsPjFQr.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\uWeEiNb.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\UkkRuLm.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\EeorJWe.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\JpfoGsC.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\usOyPKD.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ifdYvSQ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\GDTMDRL.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\hnnyuTJ.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\DDFAvRT.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\ESjjvIl.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\lPeFgNB.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\RdjWUnK.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
File created	C:\Windows\System\jEiRYCd.exe	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2812	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
Token: SeDebugPrivilege	2812	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2812	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	29
PID 2188 wrote to memory of 2812	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	29
PID 2188 wrote to memory of 2812	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	29
PID 2188 wrote to memory of 3024	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	30
PID 2188 wrote to memory of 3024	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	30
PID 2188 wrote to memory of 3024	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	30
PID 2188 wrote to memory of 2104	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	31
PID 2188 wrote to memory of 2104	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	31
PID 2188 wrote to memory of 2104	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	31
PID 2188 wrote to memory of 2572	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	32
PID 2188 wrote to memory of 2572	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	32
PID 2188 wrote to memory of 2572	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	32
PID 2188 wrote to memory of 2620	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	33
PID 2188 wrote to memory of 2620	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	33
PID 2188 wrote to memory of 2620	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	33
PID 2188 wrote to memory of 2672	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	34
PID 2188 wrote to memory of 2672	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	34
PID 2188 wrote to memory of 2672	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	34
PID 2188 wrote to memory of 2708	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	35
PID 2188 wrote to memory of 2708	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	35
PID 2188 wrote to memory of 2708	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	35
PID 2188 wrote to memory of 2632	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	36
PID 2188 wrote to memory of 2632	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	36
PID 2188 wrote to memory of 2632	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	36
PID 2188 wrote to memory of 2612	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	37
PID 2188 wrote to memory of 2612	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	37
PID 2188 wrote to memory of 2612	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	37
PID 2188 wrote to memory of 3028	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	38
PID 2188 wrote to memory of 3028	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	38
PID 2188 wrote to memory of 3028	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	38
PID 2188 wrote to memory of 2596	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	39
PID 2188 wrote to memory of 2596	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	39
PID 2188 wrote to memory of 2596	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	39
PID 2188 wrote to memory of 2784	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	40
PID 2188 wrote to memory of 2784	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	40
PID 2188 wrote to memory of 2784	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	40
PID 2188 wrote to memory of 2168	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	41
PID 2188 wrote to memory of 2168	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	41
PID 2188 wrote to memory of 2168	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	41
PID 2188 wrote to memory of 2492	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	42
PID 2188 wrote to memory of 2492	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	42
PID 2188 wrote to memory of 2492	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	42
PID 2188 wrote to memory of 2600	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	43
PID 2188 wrote to memory of 2600	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	43
PID 2188 wrote to memory of 2600	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	43
PID 2188 wrote to memory of 2960	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	44
PID 2188 wrote to memory of 2960	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	44
PID 2188 wrote to memory of 2960	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	44
PID 2188 wrote to memory of 2312	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	45
PID 2188 wrote to memory of 2312	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	45
PID 2188 wrote to memory of 2312	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	45
PID 2188 wrote to memory of 792	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	46
PID 2188 wrote to memory of 792	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	46
PID 2188 wrote to memory of 792	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	46
PID 2188 wrote to memory of 1616	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	47
PID 2188 wrote to memory of 1616	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	47
PID 2188 wrote to memory of 1616	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	47
PID 2188 wrote to memory of 1500	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	48
PID 2188 wrote to memory of 1500	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	48
PID 2188 wrote to memory of 1500	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	48
PID 2188 wrote to memory of 2280	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	49
PID 2188 wrote to memory of 2280	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	49
PID 2188 wrote to memory of 2280	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	49
PID 2188 wrote to memory of 1924	2188	090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\090ed9728133ec123c17fb688e5e0f5b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Windows\System\ZPOpilK.exe
  C:\Windows\System\ZPOpilK.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\CdKuOdV.exe
  C:\Windows\System\CdKuOdV.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\GQtpkTP.exe
  C:\Windows\System\GQtpkTP.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\qWmOXGI.exe
  C:\Windows\System\qWmOXGI.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\RJkNRPm.exe
  C:\Windows\System\RJkNRPm.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\YQkTgyc.exe
  C:\Windows\System\YQkTgyc.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\JpfoGsC.exe
  C:\Windows\System\JpfoGsC.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\BLsgnlE.exe
  C:\Windows\System\BLsgnlE.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\gpCweld.exe
  C:\Windows\System\gpCweld.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\gIrBGxh.exe
  C:\Windows\System\gIrBGxh.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\zwEdUEd.exe
  C:\Windows\System\zwEdUEd.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\IfkQySt.exe
  C:\Windows\System\IfkQySt.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\lYmLdUY.exe
  C:\Windows\System\lYmLdUY.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\heUUqwa.exe
  C:\Windows\System\heUUqwa.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\tleghIe.exe
  C:\Windows\System\tleghIe.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\GjTAGTR.exe
  C:\Windows\System\GjTAGTR.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\WoyOgsa.exe
  C:\Windows\System\WoyOgsa.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\NAuAnvq.exe
  C:\Windows\System\NAuAnvq.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\AUTrNhI.exe
  C:\Windows\System\AUTrNhI.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\dQmByVu.exe
  C:\Windows\System\dQmByVu.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\yXKdnoh.exe
  C:\Windows\System\yXKdnoh.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\pPWRuTA.exe
  C:\Windows\System\pPWRuTA.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\UFgasXg.exe
  C:\Windows\System\UFgasXg.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\owZpVqM.exe
  C:\Windows\System\owZpVqM.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\iMbdxTw.exe
  C:\Windows\System\iMbdxTw.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\YaaUgjx.exe
  C:\Windows\System\YaaUgjx.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\yAAOxGx.exe
  C:\Windows\System\yAAOxGx.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\KfogyFU.exe
  C:\Windows\System\KfogyFU.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\jZptELR.exe
  C:\Windows\System\jZptELR.exe
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Windows\System\YEDMqoV.exe
  C:\Windows\System\YEDMqoV.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\hhPFsYa.exe
  C:\Windows\System\hhPFsYa.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\uYdVIEn.exe
  C:\Windows\System\uYdVIEn.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\aLKcLkp.exe
  C:\Windows\System\aLKcLkp.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\IztYbyL.exe
  C:\Windows\System\IztYbyL.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\uSIcNyR.exe
  C:\Windows\System\uSIcNyR.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\WFBMwDD.exe
  C:\Windows\System\WFBMwDD.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\zeSqFfy.exe
  C:\Windows\System\zeSqFfy.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\AKPTwfi.exe
  C:\Windows\System\AKPTwfi.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\JPQUgkb.exe
  C:\Windows\System\JPQUgkb.exe
  2⤵
  - Executes dropped EXE
  PID:1268
- C:\Windows\System\IUSkkPt.exe
  C:\Windows\System\IUSkkPt.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\irWSozA.exe
  C:\Windows\System\irWSozA.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\gqudwhW.exe
  C:\Windows\System\gqudwhW.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\fvXSjYx.exe
  C:\Windows\System\fvXSjYx.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\EHKiMMb.exe
  C:\Windows\System\EHKiMMb.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\WGdmqpo.exe
  C:\Windows\System\WGdmqpo.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\RsLilvl.exe
  C:\Windows\System\RsLilvl.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\vARKFNl.exe
  C:\Windows\System\vARKFNl.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\nymqyih.exe
  C:\Windows\System\nymqyih.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\RYMRqmk.exe
  C:\Windows\System\RYMRqmk.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\QRwXjFw.exe
  C:\Windows\System\QRwXjFw.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\FRXInud.exe
  C:\Windows\System\FRXInud.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\TZYKBCV.exe
  C:\Windows\System\TZYKBCV.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\gfGFGuR.exe
  C:\Windows\System\gfGFGuR.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\npPrzgO.exe
  C:\Windows\System\npPrzgO.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\lfgauNh.exe
  C:\Windows\System\lfgauNh.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\vMTiWoJ.exe
  C:\Windows\System\vMTiWoJ.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\gzbYawp.exe
  C:\Windows\System\gzbYawp.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\iqfOYcg.exe
  C:\Windows\System\iqfOYcg.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\CToZKIF.exe
  C:\Windows\System\CToZKIF.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\yoHkTjw.exe
  C:\Windows\System\yoHkTjw.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\dyAKIdO.exe
  C:\Windows\System\dyAKIdO.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\CcMKjBj.exe
  C:\Windows\System\CcMKjBj.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\cQcFsgF.exe
  C:\Windows\System\cQcFsgF.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\mkLufaT.exe
  C:\Windows\System\mkLufaT.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\yQjNXhP.exe
  C:\Windows\System\yQjNXhP.exe
  2⤵
  PID:2528
- C:\Windows\System\VfDFMmW.exe
  C:\Windows\System\VfDFMmW.exe
  2⤵
  PID:1196
- C:\Windows\System\bvrPOty.exe
  C:\Windows\System\bvrPOty.exe
  2⤵
  PID:2008
- C:\Windows\System\gTxKbON.exe
  C:\Windows\System\gTxKbON.exe
  2⤵
  PID:2460
- C:\Windows\System\TQSqgwI.exe
  C:\Windows\System\TQSqgwI.exe
  2⤵
  PID:2568
- C:\Windows\System\oqnvaAp.exe
  C:\Windows\System\oqnvaAp.exe
  2⤵
  PID:268
- C:\Windows\System\rblCnZS.exe
  C:\Windows\System\rblCnZS.exe
  2⤵
  PID:2384
- C:\Windows\System\WebpzqK.exe
  C:\Windows\System\WebpzqK.exe
  2⤵
  PID:2224
- C:\Windows\System\QQApstQ.exe
  C:\Windows\System\QQApstQ.exe
  2⤵
  PID:1460
- C:\Windows\System\pnWpghy.exe
  C:\Windows\System\pnWpghy.exe
  2⤵
  PID:556
- C:\Windows\System\JcEaFSb.exe
  C:\Windows\System\JcEaFSb.exe
  2⤵
  PID:1120
- C:\Windows\System\LMgmPAc.exe
  C:\Windows\System\LMgmPAc.exe
  2⤵
  PID:1760
- C:\Windows\System\WromfwL.exe
  C:\Windows\System\WromfwL.exe
  2⤵
  PID:300
- C:\Windows\System\txslsig.exe
  C:\Windows\System\txslsig.exe
  2⤵
  PID:2956
- C:\Windows\System\PjHNVsK.exe
  C:\Windows\System\PjHNVsK.exe
  2⤵
  PID:2892
- C:\Windows\System\mSupgGA.exe
  C:\Windows\System\mSupgGA.exe
  2⤵
  PID:2816
- C:\Windows\System\sldSEMw.exe
  C:\Windows\System\sldSEMw.exe
  2⤵
  PID:2084
- C:\Windows\System\sikIWYu.exe
  C:\Windows\System\sikIWYu.exe
  2⤵
  PID:2688
- C:\Windows\System\CIIseMV.exe
  C:\Windows\System\CIIseMV.exe
  2⤵
  PID:2644
- C:\Windows\System\paNXLbi.exe
  C:\Windows\System\paNXLbi.exe
  2⤵
  PID:2512
- C:\Windows\System\FwLqCUJ.exe
  C:\Windows\System\FwLqCUJ.exe
  2⤵
  PID:2160
- C:\Windows\System\RQbiEZO.exe
  C:\Windows\System\RQbiEZO.exe
  2⤵
  PID:1532
- C:\Windows\System\PfWWMJa.exe
  C:\Windows\System\PfWWMJa.exe
  2⤵
  PID:2196
- C:\Windows\System\rSFLrWK.exe
  C:\Windows\System\rSFLrWK.exe
  2⤵
  PID:2476
- C:\Windows\System\bogzvcJ.exe
  C:\Windows\System\bogzvcJ.exe
  2⤵
  PID:2400
- C:\Windows\System\JVTGckm.exe
  C:\Windows\System\JVTGckm.exe
  2⤵
  PID:1464
- C:\Windows\System\UBpxoZY.exe
  C:\Windows\System\UBpxoZY.exe
  2⤵
  PID:1612
- C:\Windows\System\idUgfFd.exe
  C:\Windows\System\idUgfFd.exe
  2⤵
  PID:1072
- C:\Windows\System\nEJerUI.exe
  C:\Windows\System\nEJerUI.exe
  2⤵
  PID:1488
- C:\Windows\System\OyBOUPh.exe
  C:\Windows\System\OyBOUPh.exe
  2⤵
  PID:2156
- C:\Windows\System\XOzDWjv.exe
  C:\Windows\System\XOzDWjv.exe
  2⤵
  PID:2828
- C:\Windows\System\bCwbiKV.exe
  C:\Windows\System\bCwbiKV.exe
  2⤵
  PID:680
- C:\Windows\System\KQuesdq.exe
  C:\Windows\System\KQuesdq.exe
  2⤵
  PID:476
- C:\Windows\System\ojWTZtN.exe
  C:\Windows\System\ojWTZtN.exe
  2⤵
  PID:1412
- C:\Windows\System\HOlbLeB.exe
  C:\Windows\System\HOlbLeB.exe
  2⤵
  PID:2796
- C:\Windows\System\lPTDYdQ.exe
  C:\Windows\System\lPTDYdQ.exe
  2⤵
  PID:1420
- C:\Windows\System\mHdOnYX.exe
  C:\Windows\System\mHdOnYX.exe
  2⤵
  PID:604
- C:\Windows\System\nUdLCHT.exe
  C:\Windows\System\nUdLCHT.exe
  2⤵
  PID:468
- C:\Windows\System\bAXjqgV.exe
  C:\Windows\System\bAXjqgV.exe
  2⤵
  PID:2656
- C:\Windows\System\sUhgpaQ.exe
  C:\Windows\System\sUhgpaQ.exe
  2⤵
  PID:1508
- C:\Windows\System\mFZYzrx.exe
  C:\Windows\System\mFZYzrx.exe
  2⤵
  PID:1320
- C:\Windows\System\OwzrtRN.exe
  C:\Windows\System\OwzrtRN.exe
  2⤵
  PID:540
- C:\Windows\System\TvcMjHX.exe
  C:\Windows\System\TvcMjHX.exe
  2⤵
  PID:3036
- C:\Windows\System\ofSRKKs.exe
  C:\Windows\System\ofSRKKs.exe
  2⤵
  PID:2524
- C:\Windows\System\HLYSNXE.exe
  C:\Windows\System\HLYSNXE.exe
  2⤵
  PID:664
- C:\Windows\System\CRvnOEB.exe
  C:\Windows\System\CRvnOEB.exe
  2⤵
  PID:2172
- C:\Windows\System\veyOEnG.exe
  C:\Windows\System\veyOEnG.exe
  2⤵
  PID:1288
- C:\Windows\System\odeGntX.exe
  C:\Windows\System\odeGntX.exe
  2⤵
  PID:2556
- C:\Windows\System\pxCIKGq.exe
  C:\Windows\System\pxCIKGq.exe
  2⤵
  PID:1140
- C:\Windows\System\eAujDgB.exe
  C:\Windows\System\eAujDgB.exe
  2⤵
  PID:2088
- C:\Windows\System\LzDZMwC.exe
  C:\Windows\System\LzDZMwC.exe
  2⤵
  PID:2132
- C:\Windows\System\dEbnppJ.exe
  C:\Windows\System\dEbnppJ.exe
  2⤵
  PID:3000
- C:\Windows\System\VAaBEio.exe
  C:\Windows\System\VAaBEio.exe
  2⤵
  PID:2700
- C:\Windows\System\iOTyUzw.exe
  C:\Windows\System\iOTyUzw.exe
  2⤵
  PID:2936
- C:\Windows\System\dbXusmZ.exe
  C:\Windows\System\dbXusmZ.exe
  2⤵
  PID:1832
- C:\Windows\System\GkHUsbA.exe
  C:\Windows\System\GkHUsbA.exe
  2⤵
  PID:980
- C:\Windows\System\JVGIxVc.exe
  C:\Windows\System\JVGIxVc.exe
  2⤵
  PID:1076
- C:\Windows\System\dNWCflg.exe
  C:\Windows\System\dNWCflg.exe
  2⤵
  PID:1756
- C:\Windows\System\xLneUXL.exe
  C:\Windows\System\xLneUXL.exe
  2⤵
  PID:2864
- C:\Windows\System\jUvcVmP.exe
  C:\Windows\System\jUvcVmP.exe
  2⤵
  PID:2532
- C:\Windows\System\Quvfwwm.exe
  C:\Windows\System\Quvfwwm.exe
  2⤵
  PID:2420
- C:\Windows\System\peDBzKC.exe
  C:\Windows\System\peDBzKC.exe
  2⤵
  PID:1556
- C:\Windows\System\NGsZuVm.exe
  C:\Windows\System\NGsZuVm.exe
  2⤵
  PID:1840
- C:\Windows\System\ltsaYkU.exe
  C:\Windows\System\ltsaYkU.exe
  2⤵
  PID:3088
- C:\Windows\System\lCCHvHU.exe
  C:\Windows\System\lCCHvHU.exe
  2⤵
  PID:3104
- C:\Windows\System\kMcsffh.exe
  C:\Windows\System\kMcsffh.exe
  2⤵
  PID:3152
- C:\Windows\System\MYkdFfL.exe
  C:\Windows\System\MYkdFfL.exe
  2⤵
  PID:3184
- C:\Windows\System\GprnGSC.exe
  C:\Windows\System\GprnGSC.exe
  2⤵
  PID:3216
- C:\Windows\System\jhIgseP.exe
  C:\Windows\System\jhIgseP.exe
  2⤵
  PID:3240
- C:\Windows\System\tokpERS.exe
  C:\Windows\System\tokpERS.exe
  2⤵
  PID:3260
- C:\Windows\System\lhyLmhm.exe
  C:\Windows\System\lhyLmhm.exe
  2⤵
  PID:3280
- C:\Windows\System\STympLL.exe
  C:\Windows\System\STympLL.exe
  2⤵
  PID:3300
- C:\Windows\System\NggIlgf.exe
  C:\Windows\System\NggIlgf.exe
  2⤵
  PID:3320
- C:\Windows\System\pEpprBg.exe
  C:\Windows\System\pEpprBg.exe
  2⤵
  PID:3340
- C:\Windows\System\WfryINQ.exe
  C:\Windows\System\WfryINQ.exe
  2⤵
  PID:3360
- C:\Windows\System\Laqijyz.exe
  C:\Windows\System\Laqijyz.exe
  2⤵
  PID:3376
- C:\Windows\System\WNjtvFA.exe
  C:\Windows\System\WNjtvFA.exe
  2⤵
  PID:3396
- C:\Windows\System\MIdKeqC.exe
  C:\Windows\System\MIdKeqC.exe
  2⤵
  PID:3412
- C:\Windows\System\tyvRviL.exe
  C:\Windows\System\tyvRviL.exe
  2⤵
  PID:3436
- C:\Windows\System\IPYvctS.exe
  C:\Windows\System\IPYvctS.exe
  2⤵
  PID:3456
- C:\Windows\System\bevsfqG.exe
  C:\Windows\System\bevsfqG.exe
  2⤵
  PID:3480
- C:\Windows\System\hKCYCdB.exe
  C:\Windows\System\hKCYCdB.exe
  2⤵
  PID:3496
- C:\Windows\System\AqoBwxI.exe
  C:\Windows\System\AqoBwxI.exe
  2⤵
  PID:3516
- C:\Windows\System\WdTjPQf.exe
  C:\Windows\System\WdTjPQf.exe
  2⤵
  PID:3532
- C:\Windows\System\DDFAvRT.exe
  C:\Windows\System\DDFAvRT.exe
  2⤵
  PID:3556
- C:\Windows\System\btHkgFA.exe
  C:\Windows\System\btHkgFA.exe
  2⤵
  PID:3572
- C:\Windows\System\biiorKQ.exe
  C:\Windows\System\biiorKQ.exe
  2⤵
  PID:3588
- C:\Windows\System\OXVNtgh.exe
  C:\Windows\System\OXVNtgh.exe
  2⤵
  PID:3608
- C:\Windows\System\VgQfEXD.exe
  C:\Windows\System\VgQfEXD.exe
  2⤵
  PID:3624
- C:\Windows\System\NDYMhNp.exe
  C:\Windows\System\NDYMhNp.exe
  2⤵
  PID:3644
- C:\Windows\System\NFWjdpB.exe
  C:\Windows\System\NFWjdpB.exe
  2⤵
  PID:3680
- C:\Windows\System\vbBJzvG.exe
  C:\Windows\System\vbBJzvG.exe
  2⤵
  PID:3700
- C:\Windows\System\ixQGjdx.exe
  C:\Windows\System\ixQGjdx.exe
  2⤵
  PID:3720
- C:\Windows\System\BemNCkt.exe
  C:\Windows\System\BemNCkt.exe
  2⤵
  PID:3736
- C:\Windows\System\eEerfOh.exe
  C:\Windows\System\eEerfOh.exe
  2⤵
  PID:3752
- C:\Windows\System\zqacSIR.exe
  C:\Windows\System\zqacSIR.exe
  2⤵
  PID:3768
- C:\Windows\System\gaoXDAb.exe
  C:\Windows\System\gaoXDAb.exe
  2⤵
  PID:3784
- C:\Windows\System\CdOFIll.exe
  C:\Windows\System\CdOFIll.exe
  2⤵
  PID:3800
- C:\Windows\System\HAXQWnU.exe
  C:\Windows\System\HAXQWnU.exe
  2⤵
  PID:3816
- C:\Windows\System\CGkTnSh.exe
  C:\Windows\System\CGkTnSh.exe
  2⤵
  PID:3832
- C:\Windows\System\AIBJduN.exe
  C:\Windows\System\AIBJduN.exe
  2⤵
  PID:3848
- C:\Windows\System\KWBvjdc.exe
  C:\Windows\System\KWBvjdc.exe
  2⤵
  PID:3868
- C:\Windows\System\SRFgfQf.exe
  C:\Windows\System\SRFgfQf.exe
  2⤵
  PID:3884
- C:\Windows\System\gzsJvNW.exe
  C:\Windows\System\gzsJvNW.exe
  2⤵
  PID:3904
- C:\Windows\System\TDKrulX.exe
  C:\Windows\System\TDKrulX.exe
  2⤵
  PID:3920
- C:\Windows\System\AgspGZL.exe
  C:\Windows\System\AgspGZL.exe
  2⤵
  PID:3936
- C:\Windows\System\mhFrEyu.exe
  C:\Windows\System\mhFrEyu.exe
  2⤵
  PID:3952
- C:\Windows\System\MTFiQrd.exe
  C:\Windows\System\MTFiQrd.exe
  2⤵
  PID:3968
- C:\Windows\System\beStVif.exe
  C:\Windows\System\beStVif.exe
  2⤵
  PID:3984
- C:\Windows\System\FvxmhEV.exe
  C:\Windows\System\FvxmhEV.exe
  2⤵
  PID:4000
- C:\Windows\System\opMYWLu.exe
  C:\Windows\System\opMYWLu.exe
  2⤵
  PID:2580
- C:\Windows\System\IKnVhhw.exe
  C:\Windows\System\IKnVhhw.exe
  2⤵
  PID:3080
- C:\Windows\System\jmvNkWw.exe
  C:\Windows\System\jmvNkWw.exe
  2⤵
  PID:1636
- C:\Windows\System\ESjjvIl.exe
  C:\Windows\System\ESjjvIl.exe
  2⤵
  PID:3124
- C:\Windows\System\MXsaXLC.exe
  C:\Windows\System\MXsaXLC.exe
  2⤵
  PID:1456
- C:\Windows\System\EbDxJsu.exe
  C:\Windows\System\EbDxJsu.exe
  2⤵
  PID:3128
- C:\Windows\System\tnhoDPZ.exe
  C:\Windows\System\tnhoDPZ.exe
  2⤵
  PID:3148
- C:\Windows\System\SUaIIYO.exe
  C:\Windows\System\SUaIIYO.exe
  2⤵
  PID:2288
- C:\Windows\System\xEUFxiR.exe
  C:\Windows\System\xEUFxiR.exe
  2⤵
  PID:2376
- C:\Windows\System\QqvFbfB.exe
  C:\Windows\System\QqvFbfB.exe
  2⤵
  PID:832
- C:\Windows\System\wwXMQoc.exe
  C:\Windows\System\wwXMQoc.exe
  2⤵
  PID:2780
- C:\Windows\System\SfKWzfD.exe
  C:\Windows\System\SfKWzfD.exe
  2⤵
  PID:2144
- C:\Windows\System\IKrKvob.exe
  C:\Windows\System\IKrKvob.exe
  2⤵
  PID:3020
- C:\Windows\System\kcuODke.exe
  C:\Windows\System\kcuODke.exe
  2⤵
  PID:2504
- C:\Windows\System\rlDTlLN.exe
  C:\Windows\System\rlDTlLN.exe
  2⤵
  PID:304
- C:\Windows\System\tUJpiPQ.exe
  C:\Windows\System\tUJpiPQ.exe
  2⤵
  PID:2588
- C:\Windows\System\uhdsXto.exe
  C:\Windows\System\uhdsXto.exe
  2⤵
  PID:3100
- C:\Windows\System\btINnXH.exe
  C:\Windows\System\btINnXH.exe
  2⤵
  PID:3176
- C:\Windows\System\xxjqOoG.exe
  C:\Windows\System\xxjqOoG.exe
  2⤵
  PID:3232
- C:\Windows\System\SwVjWVf.exe
  C:\Windows\System\SwVjWVf.exe
  2⤵
  PID:3256
- C:\Windows\System\DLazwmX.exe
  C:\Windows\System\DLazwmX.exe
  2⤵
  PID:3288
- C:\Windows\System\aYimFIA.exe
  C:\Windows\System\aYimFIA.exe
  2⤵
  PID:3328
- C:\Windows\System\DgBJqsF.exe
  C:\Windows\System\DgBJqsF.exe
  2⤵
  PID:3316
- C:\Windows\System\nzopcor.exe
  C:\Windows\System\nzopcor.exe
  2⤵
  PID:3448
- C:\Windows\System\JBNVhkL.exe
  C:\Windows\System\JBNVhkL.exe
  2⤵
  PID:3640
- C:\Windows\System\xclqjMd.exe
  C:\Windows\System\xclqjMd.exe
  2⤵
  PID:3468
- C:\Windows\System\GNGsGqD.exe
  C:\Windows\System\GNGsGqD.exe
  2⤵
  PID:3476
- C:\Windows\System\hkFxDSd.exe
  C:\Windows\System\hkFxDSd.exe
  2⤵
  PID:3688
- C:\Windows\System\GpamjIy.exe
  C:\Windows\System\GpamjIy.exe
  2⤵
  PID:3764
- C:\Windows\System\IFSYWOe.exe
  C:\Windows\System\IFSYWOe.exe
  2⤵
  PID:3828
- C:\Windows\System\pGJwTrU.exe
  C:\Windows\System\pGJwTrU.exe
  2⤵
  PID:3892
- C:\Windows\System\fJMyDtN.exe
  C:\Windows\System\fJMyDtN.exe
  2⤵
  PID:3992
- C:\Windows\System\pxhRlQz.exe
  C:\Windows\System\pxhRlQz.exe
  2⤵
  PID:3580
- C:\Windows\System\KkHEYJd.exe
  C:\Windows\System\KkHEYJd.exe
  2⤵
  PID:2664
- C:\Windows\System\MLCPpeA.exe
  C:\Windows\System\MLCPpeA.exe
  2⤵
  PID:3660
- C:\Windows\System\ayAPDHO.exe
  C:\Windows\System\ayAPDHO.exe
  2⤵
  PID:316
- C:\Windows\System\kkpBDKt.exe
  C:\Windows\System\kkpBDKt.exe
  2⤵
  PID:1668
- C:\Windows\System\UVbdaoT.exe
  C:\Windows\System\UVbdaoT.exe
  2⤵
  PID:3672
- C:\Windows\System\FlDhYqj.exe
  C:\Windows\System\FlDhYqj.exe
  2⤵
  PID:3712
- C:\Windows\System\lnJMXom.exe
  C:\Windows\System\lnJMXom.exe
  2⤵
  PID:3844
- C:\Windows\System\AdFHpaO.exe
  C:\Windows\System\AdFHpaO.exe
  2⤵
  PID:3916
- C:\Windows\System\ovJiZFk.exe
  C:\Windows\System\ovJiZFk.exe
  2⤵
  PID:3980
- C:\Windows\System\ENKwcmI.exe
  C:\Windows\System\ENKwcmI.exe
  2⤵
  PID:4020
- C:\Windows\System\wAWyozm.exe
  C:\Windows\System\wAWyozm.exe
  2⤵
  PID:4036
- C:\Windows\System\hTkGzWQ.exe
  C:\Windows\System\hTkGzWQ.exe
  2⤵
  PID:1316
- C:\Windows\System\mNFMtgX.exe
  C:\Windows\System\mNFMtgX.exe
  2⤵
  PID:3120
- C:\Windows\System\IqMRxOI.exe
  C:\Windows\System\IqMRxOI.exe
  2⤵
  PID:2336
- C:\Windows\System\uOdemny.exe
  C:\Windows\System\uOdemny.exe
  2⤵
  PID:2508
- C:\Windows\System\yXCMEfq.exe
  C:\Windows\System\yXCMEfq.exe
  2⤵
  PID:2616
- C:\Windows\System\DJJNbXX.exe
  C:\Windows\System\DJJNbXX.exe
  2⤵
  PID:3276
- C:\Windows\System\qVcBSTk.exe
  C:\Windows\System\qVcBSTk.exe
  2⤵
  PID:4048
- C:\Windows\System\IuQUllX.exe
  C:\Windows\System\IuQUllX.exe
  2⤵
  PID:4056
- C:\Windows\System\GttaXwM.exe
  C:\Windows\System\GttaXwM.exe
  2⤵
  PID:3744
- C:\Windows\System\dRipdJG.exe
  C:\Windows\System\dRipdJG.exe
  2⤵
  PID:4084
- C:\Windows\System\yndQhxS.exe
  C:\Windows\System\yndQhxS.exe
  2⤵
  PID:2128
- C:\Windows\System\Hxwqrml.exe
  C:\Windows\System\Hxwqrml.exe
  2⤵
  PID:2040
- C:\Windows\System\KWFvjah.exe
  C:\Windows\System\KWFvjah.exe
  2⤵
  PID:3432
- C:\Windows\System\KtjROtl.exe
  C:\Windows\System\KtjROtl.exe
  2⤵
  PID:3932
- C:\Windows\System\maVoMaQ.exe
  C:\Windows\System\maVoMaQ.exe
  2⤵
  PID:3664
- C:\Windows\System\MAyStOH.exe
  C:\Windows\System\MAyStOH.exe
  2⤵
  PID:3164
- C:\Windows\System\kyXxmFM.exe
  C:\Windows\System\kyXxmFM.exe
  2⤵
  PID:3268
- C:\Windows\System\eEyQBLu.exe
  C:\Windows\System\eEyQBLu.exe
  2⤵
  PID:3368
- C:\Windows\System\poJXtCg.exe
  C:\Windows\System\poJXtCg.exe
  2⤵
  PID:3812
- C:\Windows\System\hpqSjmC.exe
  C:\Windows\System\hpqSjmC.exe
  2⤵
  PID:4032
- C:\Windows\System\qFpwgZC.exe
  C:\Windows\System\qFpwgZC.exe
  2⤵
  PID:1476
- C:\Windows\System\vdAksVO.exe
  C:\Windows\System\vdAksVO.exe
  2⤵
  PID:3348
- C:\Windows\System\GIOPCQv.exe
  C:\Windows\System\GIOPCQv.exe
  2⤵
  PID:3352
- C:\Windows\System\YmKyJgL.exe
  C:\Windows\System\YmKyJgL.exe
  2⤵
  PID:3528
- C:\Windows\System\sFkymLI.exe
  C:\Windows\System\sFkymLI.exe
  2⤵
  PID:3728
- C:\Windows\System\svzhMdq.exe
  C:\Windows\System\svzhMdq.exe
  2⤵
  PID:2204
- C:\Windows\System\owVzrZM.exe
  C:\Windows\System\owVzrZM.exe
  2⤵
  PID:3204
- C:\Windows\System\vWPCXFY.exe
  C:\Windows\System\vWPCXFY.exe
  2⤵
  PID:2792
- C:\Windows\System\LuPVZFN.exe
  C:\Windows\System\LuPVZFN.exe
  2⤵
  PID:3508
- C:\Windows\System\ODnuovk.exe
  C:\Windows\System\ODnuovk.exe
  2⤵
  PID:3652
- C:\Windows\System\LjNCZhY.exe
  C:\Windows\System\LjNCZhY.exe
  2⤵
  PID:3512
- C:\Windows\System\CjxZsCn.exe
  C:\Windows\System\CjxZsCn.exe
  2⤵
  PID:3912
- C:\Windows\System\hYaiAUh.exe
  C:\Windows\System\hYaiAUh.exe
  2⤵
  PID:4112
- C:\Windows\System\TVCeLMl.exe
  C:\Windows\System\TVCeLMl.exe
  2⤵
  PID:4128
- C:\Windows\System\sLPSDDJ.exe
  C:\Windows\System\sLPSDDJ.exe
  2⤵
  PID:4144
- C:\Windows\System\iqlLsWL.exe
  C:\Windows\System\iqlLsWL.exe
  2⤵
  PID:4160
- C:\Windows\System\NocoPTp.exe
  C:\Windows\System\NocoPTp.exe
  2⤵
  PID:4176
- C:\Windows\System\YDFQKiM.exe
  C:\Windows\System\YDFQKiM.exe
  2⤵
  PID:4196
- C:\Windows\System\PUbLMwj.exe
  C:\Windows\System\PUbLMwj.exe
  2⤵
  PID:4212
- C:\Windows\System\LyuBrsO.exe
  C:\Windows\System\LyuBrsO.exe
  2⤵
  PID:4228
- C:\Windows\System\qNIUhGo.exe
  C:\Windows\System\qNIUhGo.exe
  2⤵
  PID:4252
- C:\Windows\System\bzAHWRB.exe
  C:\Windows\System\bzAHWRB.exe
  2⤵
  PID:4368
- C:\Windows\System\xyfesHp.exe
  C:\Windows\System\xyfesHp.exe
  2⤵
  PID:4384
- C:\Windows\System\aGROcGU.exe
  C:\Windows\System\aGROcGU.exe
  2⤵
  PID:4400
- C:\Windows\System\apigHyP.exe
  C:\Windows\System\apigHyP.exe
  2⤵
  PID:4416
- C:\Windows\System\fCAmfvG.exe
  C:\Windows\System\fCAmfvG.exe
  2⤵
  PID:4432
- C:\Windows\System\RDzphen.exe
  C:\Windows\System\RDzphen.exe
  2⤵
  PID:4448
- C:\Windows\System\nTEVsTk.exe
  C:\Windows\System\nTEVsTk.exe
  2⤵
  PID:4464
- C:\Windows\System\CxKSEgj.exe
  C:\Windows\System\CxKSEgj.exe
  2⤵
  PID:4480
- C:\Windows\System\SIwfsBp.exe
  C:\Windows\System\SIwfsBp.exe
  2⤵
  PID:4576
- C:\Windows\System\DlYasNe.exe
  C:\Windows\System\DlYasNe.exe
  2⤵
  PID:4592
- C:\Windows\System\jRxvjDL.exe
  C:\Windows\System\jRxvjDL.exe
  2⤵
  PID:4608
- C:\Windows\System\qRZkiMI.exe
  C:\Windows\System\qRZkiMI.exe
  2⤵
  PID:4624
- C:\Windows\System\LCOAGGX.exe
  C:\Windows\System\LCOAGGX.exe
  2⤵
  PID:4640
- C:\Windows\System\VOYFOin.exe
  C:\Windows\System\VOYFOin.exe
  2⤵
  PID:4656
- C:\Windows\System\qLaTBqR.exe
  C:\Windows\System\qLaTBqR.exe
  2⤵
  PID:4672
- C:\Windows\System\cDuhjYk.exe
  C:\Windows\System\cDuhjYk.exe
  2⤵
  PID:4688
- C:\Windows\System\XeNgVSv.exe
  C:\Windows\System\XeNgVSv.exe
  2⤵
  PID:4708
- C:\Windows\System\ZylNzQd.exe
  C:\Windows\System\ZylNzQd.exe
  2⤵
  PID:4728
- C:\Windows\System\txFSiqc.exe
  C:\Windows\System\txFSiqc.exe
  2⤵
  PID:4744
- C:\Windows\System\WdZAXMB.exe
  C:\Windows\System\WdZAXMB.exe
  2⤵
  PID:4760
- C:\Windows\System\lqhHacc.exe
  C:\Windows\System\lqhHacc.exe
  2⤵
  PID:4776
- C:\Windows\System\dftLbzC.exe
  C:\Windows\System\dftLbzC.exe
  2⤵
  PID:4792
- C:\Windows\System\GffvzOx.exe
  C:\Windows\System\GffvzOx.exe
  2⤵
  PID:4808
- C:\Windows\System\IsNvinR.exe
  C:\Windows\System\IsNvinR.exe
  2⤵
  PID:4824
- C:\Windows\System\RtSULTZ.exe
  C:\Windows\System\RtSULTZ.exe
  2⤵
  PID:4840
- C:\Windows\System\hJgVklO.exe
  C:\Windows\System\hJgVklO.exe
  2⤵
  PID:4856
- C:\Windows\System\fTOZSCG.exe
  C:\Windows\System\fTOZSCG.exe
  2⤵
  PID:4872
- C:\Windows\System\zKMTbis.exe
  C:\Windows\System\zKMTbis.exe
  2⤵
  PID:4888
- C:\Windows\System\ODIZtDv.exe
  C:\Windows\System\ODIZtDv.exe
  2⤵
  PID:4904
- C:\Windows\System\uMrwAcS.exe
  C:\Windows\System\uMrwAcS.exe
  2⤵
  PID:4920
- C:\Windows\System\wtxOqWP.exe
  C:\Windows\System\wtxOqWP.exe
  2⤵
  PID:4936
- C:\Windows\System\sdrbAin.exe
  C:\Windows\System\sdrbAin.exe
  2⤵
  PID:4952
- C:\Windows\System\kITtyvA.exe
  C:\Windows\System\kITtyvA.exe
  2⤵
  PID:5056
- C:\Windows\System\eQJyqEZ.exe
  C:\Windows\System\eQJyqEZ.exe
  2⤵
  PID:5072
- C:\Windows\System\RlAejtb.exe
  C:\Windows\System\RlAejtb.exe
  2⤵
  PID:5088
- C:\Windows\System\gwzkDLY.exe
  C:\Windows\System\gwzkDLY.exe
  2⤵
  PID:5104
- C:\Windows\System\QpLpvur.exe
  C:\Windows\System\QpLpvur.exe
  2⤵
  PID:3808
- C:\Windows\System\NiuPRqC.exe
  C:\Windows\System\NiuPRqC.exe
  2⤵
  PID:3976
- C:\Windows\System\UGLwZcQ.exe
  C:\Windows\System\UGLwZcQ.exe
  2⤵
  PID:3492
- C:\Windows\System\hmwrCKL.exe
  C:\Windows\System\hmwrCKL.exe
  2⤵
  PID:3208
- C:\Windows\System\kNOkYtT.exe
  C:\Windows\System\kNOkYtT.exe
  2⤵
  PID:3552
- C:\Windows\System\fJwJvfH.exe
  C:\Windows\System\fJwJvfH.exe
  2⤵
  PID:4124
- C:\Windows\System\VIQUhrm.exe
  C:\Windows\System\VIQUhrm.exe
  2⤵
  PID:4188
- C:\Windows\System\qCQFkbr.exe
  C:\Windows\System\qCQFkbr.exe
  2⤵
  PID:2900
- C:\Windows\System\yvhuMCH.exe
  C:\Windows\System\yvhuMCH.exe
  2⤵
  PID:376
- C:\Windows\System\mzOveYt.exe
  C:\Windows\System\mzOveYt.exe
  2⤵
  PID:1588
- C:\Windows\System\kVIBfib.exe
  C:\Windows\System\kVIBfib.exe
  2⤵
  PID:1684
- C:\Windows\System\rmNiPbs.exe
  C:\Windows\System\rmNiPbs.exe
  2⤵
  PID:2216
- C:\Windows\System\iEQvmYL.exe
  C:\Windows\System\iEQvmYL.exe
  2⤵
  PID:3428
- C:\Windows\System\qYRNxXK.exe
  C:\Windows\System\qYRNxXK.exe
  2⤵
  PID:4044
- C:\Windows\System\BpurlgK.exe
  C:\Windows\System\BpurlgK.exe
  2⤵
  PID:1228
- C:\Windows\System\NoVfMmW.exe
  C:\Windows\System\NoVfMmW.exe
  2⤵
  PID:3420
- C:\Windows\System\SPfXxYm.exe
  C:\Windows\System\SPfXxYm.exe
  2⤵
  PID:2368
- C:\Windows\System\ITiGmOU.exe
  C:\Windows\System\ITiGmOU.exe
  2⤵
  PID:4268
- C:\Windows\System\ClMoytJ.exe
  C:\Windows\System\ClMoytJ.exe
  2⤵
  PID:4284
- C:\Windows\System\iAKuGah.exe
  C:\Windows\System\iAKuGah.exe
  2⤵
  PID:4300
- C:\Windows\System\THRjbDl.exe
  C:\Windows\System\THRjbDl.exe
  2⤵
  PID:3564
- C:\Windows\System\dTfBewX.exe
  C:\Windows\System\dTfBewX.exe
  2⤵
  PID:4108
- C:\Windows\System\khLKtjZ.exe
  C:\Windows\System\khLKtjZ.exe
  2⤵
  PID:4204
- C:\Windows\System\ALKOikr.exe
  C:\Windows\System\ALKOikr.exe
  2⤵
  PID:4248
- C:\Windows\System\gwqWbOA.exe
  C:\Windows\System\gwqWbOA.exe
  2⤵
  PID:2764
- C:\Windows\System\xPkZBmN.exe
  C:\Windows\System\xPkZBmN.exe
  2⤵
  PID:1932
- C:\Windows\System\kbjHFjr.exe
  C:\Windows\System\kbjHFjr.exe
  2⤵
  PID:1404
- C:\Windows\System\oamlfeU.exe
  C:\Windows\System\oamlfeU.exe
  2⤵
  PID:4340
- C:\Windows\System\BnkRrIz.exe
  C:\Windows\System\BnkRrIz.exe
  2⤵
  PID:4360
- C:\Windows\System\HnpGIjz.exe
  C:\Windows\System\HnpGIjz.exe
  2⤵
  PID:4392
- C:\Windows\System\LqllDvl.exe
  C:\Windows\System\LqllDvl.exe
  2⤵
  PID:4408
- C:\Windows\System\wRttjSQ.exe
  C:\Windows\System\wRttjSQ.exe
  2⤵
  PID:4440
- C:\Windows\System\ZgTZEmB.exe
  C:\Windows\System\ZgTZEmB.exe
  2⤵
  PID:4504
- C:\Windows\System\GZNxflr.exe
  C:\Windows\System\GZNxflr.exe
  2⤵
  PID:1644
- C:\Windows\System\wQbUXCt.exe
  C:\Windows\System\wQbUXCt.exe
  2⤵
  PID:4528
- C:\Windows\System\IoyyWdd.exe
  C:\Windows\System\IoyyWdd.exe
  2⤵
  PID:4540
- C:\Windows\System\JHQExmc.exe
  C:\Windows\System\JHQExmc.exe
  2⤵
  PID:2152
- C:\Windows\System\RLzAXwy.exe
  C:\Windows\System\RLzAXwy.exe
  2⤵
  PID:4568
- C:\Windows\System\IPRaWrC.exe
  C:\Windows\System\IPRaWrC.exe
  2⤵
  PID:4636
- C:\Windows\System\zCPgCid.exe
  C:\Windows\System\zCPgCid.exe
  2⤵
  PID:4716
- C:\Windows\System\bQNdwPn.exe
  C:\Windows\System\bQNdwPn.exe
  2⤵
  PID:4752
- C:\Windows\System\MwMrSoF.exe
  C:\Windows\System\MwMrSoF.exe
  2⤵
  PID:4684
- C:\Windows\System\JskBQaC.exe
  C:\Windows\System\JskBQaC.exe
  2⤵
  PID:4772
- C:\Windows\System\GaDlBCt.exe
  C:\Windows\System\GaDlBCt.exe
  2⤵
  PID:4852
- C:\Windows\System\TDCYyrw.exe
  C:\Windows\System\TDCYyrw.exe
  2⤵
  PID:4964
- C:\Windows\System\hGjuXjS.exe
  C:\Windows\System\hGjuXjS.exe
  2⤵
  PID:4944
- C:\Windows\System\yNXpwOn.exe
  C:\Windows\System\yNXpwOn.exe
  2⤵
  PID:4976
- C:\Windows\System\xakjrob.exe
  C:\Windows\System\xakjrob.exe
  2⤵
  PID:4988
- C:\Windows\System\hXNvcPy.exe
  C:\Windows\System\hXNvcPy.exe
  2⤵
  PID:5004
- C:\Windows\System\GRbgyWs.exe
  C:\Windows\System\GRbgyWs.exe
  2⤵
  PID:4492
- C:\Windows\System\HldAYdz.exe
  C:\Windows\System\HldAYdz.exe
  2⤵
  PID:5052
- C:\Windows\System\zsrtuBM.exe
  C:\Windows\System\zsrtuBM.exe
  2⤵
  PID:5112
- C:\Windows\System\aACSZRW.exe
  C:\Windows\System\aACSZRW.exe
  2⤵
  PID:3168
- C:\Windows\System\dqXLDIx.exe
  C:\Windows\System\dqXLDIx.exe
  2⤵
  PID:2116
- C:\Windows\System\qNZJZzr.exe
  C:\Windows\System\qNZJZzr.exe
  2⤵
  PID:3760
- C:\Windows\System\JepgOti.exe
  C:\Windows\System\JepgOti.exe
  2⤵
  PID:4012
- C:\Windows\System\bfrGULC.exe
  C:\Windows\System\bfrGULC.exe
  2⤵
  PID:4308
- C:\Windows\System\XcjRZfo.exe
  C:\Windows\System\XcjRZfo.exe
  2⤵
  PID:4276
- C:\Windows\System\AfyPNoC.exe
  C:\Windows\System\AfyPNoC.exe
  2⤵
  PID:2912
- C:\Windows\System\SLZnrNU.exe
  C:\Windows\System\SLZnrNU.exe
  2⤵
  PID:1340
- C:\Windows\System\YASieEm.exe
  C:\Windows\System\YASieEm.exe
  2⤵
  PID:2716
- C:\Windows\System\BgNctse.exe
  C:\Windows\System\BgNctse.exe
  2⤵
  PID:3404
- C:\Windows\System\IlXMprM.exe
  C:\Windows\System\IlXMprM.exe
  2⤵
  PID:3252
- C:\Windows\System\urLyRma.exe
  C:\Windows\System\urLyRma.exe
  2⤵
  PID:4172
- C:\Windows\System\dvqsAbz.exe
  C:\Windows\System\dvqsAbz.exe
  2⤵
  PID:1780
- C:\Windows\System\GmKfhMY.exe
  C:\Windows\System\GmKfhMY.exe
  2⤵
  PID:1852
- C:\Windows\System\jvdpWzV.exe
  C:\Windows\System\jvdpWzV.exe
  2⤵
  PID:2060
- C:\Windows\System\ZIqAOLV.exe
  C:\Windows\System\ZIqAOLV.exe
  2⤵
  PID:4348
- C:\Windows\System\MXvWjZx.exe
  C:\Windows\System\MXvWjZx.exe
  2⤵
  PID:4356
- C:\Windows\System\sMCPzUg.exe
  C:\Windows\System\sMCPzUg.exe
  2⤵
  PID:4428
- C:\Windows\System\LwdQxDH.exe
  C:\Windows\System\LwdQxDH.exe
  2⤵
  PID:1740
- C:\Windows\System\OnSQEOA.exe
  C:\Windows\System\OnSQEOA.exe
  2⤵
  PID:4496
- C:\Windows\System\HkywKQW.exe
  C:\Windows\System\HkywKQW.exe
  2⤵
  PID:4536
- C:\Windows\System\rWFVWEM.exe
  C:\Windows\System\rWFVWEM.exe
  2⤵
  PID:4564
- C:\Windows\System\CXKUfrR.exe
  C:\Windows\System\CXKUfrR.exe
  2⤵
  PID:4604
- C:\Windows\System\pWumNPb.exe
  C:\Windows\System\pWumNPb.exe
  2⤵
  PID:4620
- C:\Windows\System\FCDDffL.exe
  C:\Windows\System\FCDDffL.exe
  2⤵
  PID:4724
- C:\Windows\System\nTOrjyZ.exe
  C:\Windows\System\nTOrjyZ.exe
  2⤵
  PID:4700
- C:\Windows\System\UgjBmed.exe
  C:\Windows\System\UgjBmed.exe
  2⤵
  PID:4648
- C:\Windows\System\JvRqOaq.exe
  C:\Windows\System\JvRqOaq.exe
  2⤵
  PID:4832
- C:\Windows\System\mVvfMZx.exe
  C:\Windows\System\mVvfMZx.exe
  2⤵
  PID:4868
- C:\Windows\System\GEVcikH.exe
  C:\Windows\System\GEVcikH.exe
  2⤵
  PID:4948
- C:\Windows\System\dXgDZwG.exe
  C:\Windows\System\dXgDZwG.exe
  2⤵
  PID:5016
- C:\Windows\System\qHBBNMT.exe
  C:\Windows\System\qHBBNMT.exe
  2⤵
  PID:5000
- C:\Windows\System\cZmCVoY.exe
  C:\Windows\System\cZmCVoY.exe
  2⤵
  PID:5068
- C:\Windows\System\tmiYrRY.exe
  C:\Windows\System\tmiYrRY.exe
  2⤵
  PID:4184
- C:\Windows\System\HlfHKEY.exe
  C:\Windows\System\HlfHKEY.exe
  2⤵
  PID:4260
- C:\Windows\System\tQypwMl.exe
  C:\Windows\System\tQypwMl.exe
  2⤵
  PID:3636
- C:\Windows\System\APfkgrV.exe
  C:\Windows\System\APfkgrV.exe
  2⤵
  PID:3880
- C:\Windows\System\UkkRuLm.exe
  C:\Windows\System\UkkRuLm.exe
  2⤵
  PID:3136
- C:\Windows\System\TWZAhXD.exe
  C:\Windows\System\TWZAhXD.exe
  2⤵
  PID:1220
- C:\Windows\System\puQhfHC.exe
  C:\Windows\System\puQhfHC.exe
  2⤵
  PID:2256
- C:\Windows\System\YQFNzuE.exe
  C:\Windows\System\YQFNzuE.exe
  2⤵
  PID:4080
- C:\Windows\System\QPEqxvP.exe
  C:\Windows\System\QPEqxvP.exe
  2⤵
  PID:4104
- C:\Windows\System\VPeCZGX.exe
  C:\Windows\System\VPeCZGX.exe
  2⤵
  PID:1296
- C:\Windows\System\TyOkDAc.exe
  C:\Windows\System\TyOkDAc.exe
  2⤵
  PID:4424
- C:\Windows\System\hQntWRq.exe
  C:\Windows\System\hQntWRq.exe
  2⤵
  PID:2468
- C:\Windows\System\TzxqZGL.exe
  C:\Windows\System\TzxqZGL.exe
  2⤵
  PID:3928
- C:\Windows\System\lYzWGEY.exe
  C:\Windows\System\lYzWGEY.exe
  2⤵
  PID:2804
- C:\Windows\System\CahFtSO.exe
  C:\Windows\System\CahFtSO.exe
  2⤵
  PID:1248
- C:\Windows\System\qsCOCWQ.exe
  C:\Windows\System\qsCOCWQ.exe
  2⤵
  PID:4524
- C:\Windows\System\qsCaTnI.exe
  C:\Windows\System\qsCaTnI.exe
  2⤵
  PID:4588
- C:\Windows\System\LcvSgyZ.exe
  C:\Windows\System\LcvSgyZ.exe
  2⤵
  PID:1708
- C:\Windows\System\morKRDd.exe
  C:\Windows\System\morKRDd.exe
  2⤵
  PID:4960
- C:\Windows\System\aYQdYFN.exe
  C:\Windows\System\aYQdYFN.exe
  2⤵
  PID:4820
- C:\Windows\System\HQaUBYw.exe
  C:\Windows\System\HQaUBYw.exe
  2⤵
  PID:5040
- C:\Windows\System\fHOAVid.exe
  C:\Windows\System\fHOAVid.exe
  2⤵
  PID:4968
- C:\Windows\System\gPwUbOY.exe
  C:\Windows\System\gPwUbOY.exe
  2⤵
  PID:3604
- C:\Windows\System\gsEPnPB.exe
  C:\Windows\System\gsEPnPB.exe
  2⤵
  PID:5032
- C:\Windows\System\UAlhoWA.exe
  C:\Windows\System\UAlhoWA.exe
  2⤵
  PID:3964
- C:\Windows\System\IQXSNZt.exe
  C:\Windows\System\IQXSNZt.exe
  2⤵
  PID:1100
- C:\Windows\System\ufwfLQK.exe
  C:\Windows\System\ufwfLQK.exe
  2⤵
  PID:3200
- C:\Windows\System\YaifgXm.exe
  C:\Windows\System\YaifgXm.exe
  2⤵
  PID:4292
- C:\Windows\System\psnyXoq.exe
  C:\Windows\System\psnyXoq.exe
  2⤵
  PID:3864
- C:\Windows\System\LeOdChr.exe
  C:\Windows\System\LeOdChr.exe
  2⤵
  PID:1136
- C:\Windows\System\IKlKUHx.exe
  C:\Windows\System\IKlKUHx.exe
  2⤵
  PID:3392
- C:\Windows\System\jdQSxqn.exe
  C:\Windows\System\jdQSxqn.exe
  2⤵
  PID:4512
- C:\Windows\System\RmPmAkj.exe
  C:\Windows\System\RmPmAkj.exe
  2⤵
  PID:4972
- C:\Windows\System\uvenLGU.exe
  C:\Windows\System\uvenLGU.exe
  2⤵
  PID:3824
- C:\Windows\System\kPICMlc.exe
  C:\Windows\System\kPICMlc.exe
  2⤵
  PID:2396
- C:\Windows\System\EafNQcy.exe
  C:\Windows\System\EafNQcy.exe
  2⤵
  PID:4880
- C:\Windows\System\VReIpGh.exe
  C:\Windows\System\VReIpGh.exe
  2⤵
  PID:4616
- C:\Windows\System\zAXFhqP.exe
  C:\Windows\System\zAXFhqP.exe
  2⤵
  PID:4836
- C:\Windows\System\ykXTnwC.exe
  C:\Windows\System\ykXTnwC.exe
  2⤵
  PID:2380
- C:\Windows\System\Kdvwuzj.exe
  C:\Windows\System\Kdvwuzj.exe
  2⤵
  PID:4332
- C:\Windows\System\krhOQgF.exe
  C:\Windows\System\krhOQgF.exe
  2⤵
  PID:4560
- C:\Windows\System\QCXHfcW.exe
  C:\Windows\System\QCXHfcW.exe
  2⤵
  PID:4120
- C:\Windows\System\SmxFOYZ.exe
  C:\Windows\System\SmxFOYZ.exe
  2⤵
  PID:4520
- C:\Windows\System\RNWXGxh.exe
  C:\Windows\System\RNWXGxh.exe
  2⤵
  PID:5080
- C:\Windows\System\QfnBQJu.exe
  C:\Windows\System\QfnBQJu.exe
  2⤵
  PID:4992
- C:\Windows\System\VOqZAWf.exe
  C:\Windows\System\VOqZAWf.exe
  2⤵
  PID:5132
- C:\Windows\System\UpwFgIh.exe
  C:\Windows\System\UpwFgIh.exe
  2⤵
  PID:5148
- C:\Windows\System\piChhFq.exe
  C:\Windows\System\piChhFq.exe
  2⤵
  PID:5164
- C:\Windows\System\dGdRzSn.exe
  C:\Windows\System\dGdRzSn.exe
  2⤵
  PID:5180
- C:\Windows\System\vwztxBs.exe
  C:\Windows\System\vwztxBs.exe
  2⤵
  PID:5196
- C:\Windows\System\gRJVmFV.exe
  C:\Windows\System\gRJVmFV.exe
  2⤵
  PID:5212
- C:\Windows\System\EEQCMqf.exe
  C:\Windows\System\EEQCMqf.exe
  2⤵
  PID:5232
- C:\Windows\System\VueYhCP.exe
  C:\Windows\System\VueYhCP.exe
  2⤵
  PID:5248
- C:\Windows\System\MflKkqV.exe
  C:\Windows\System\MflKkqV.exe
  2⤵
  PID:5264
- C:\Windows\System\XpXFktT.exe
  C:\Windows\System\XpXFktT.exe
  2⤵
  PID:5280
- C:\Windows\System\pMtEzEw.exe
  C:\Windows\System\pMtEzEw.exe
  2⤵
  PID:5296
- C:\Windows\System\zYeNnmP.exe
  C:\Windows\System\zYeNnmP.exe
  2⤵
  PID:5312
- C:\Windows\System\hBOJfWk.exe
  C:\Windows\System\hBOJfWk.exe
  2⤵
  PID:5328
- C:\Windows\System\SrnMHxT.exe
  C:\Windows\System\SrnMHxT.exe
  2⤵
  PID:5344
- C:\Windows\System\hCYjsvK.exe
  C:\Windows\System\hCYjsvK.exe
  2⤵
  PID:5360
- C:\Windows\System\BVOnJGM.exe
  C:\Windows\System\BVOnJGM.exe
  2⤵
  PID:5376
- C:\Windows\System\XvUtqxZ.exe
  C:\Windows\System\XvUtqxZ.exe
  2⤵
  PID:5392
- C:\Windows\System\FcJAonb.exe
  C:\Windows\System\FcJAonb.exe
  2⤵
  PID:5408
- C:\Windows\System\XclbbIk.exe
  C:\Windows\System\XclbbIk.exe
  2⤵
  PID:5424
- C:\Windows\System\QvDewby.exe
  C:\Windows\System\QvDewby.exe
  2⤵
  PID:5440
- C:\Windows\System\fZRiJKz.exe
  C:\Windows\System\fZRiJKz.exe
  2⤵
  PID:5456
- C:\Windows\System\PMAKGeL.exe
  C:\Windows\System\PMAKGeL.exe
  2⤵
  PID:5472
- C:\Windows\System\adhiDAg.exe
  C:\Windows\System\adhiDAg.exe
  2⤵
  PID:5488
- C:\Windows\System\ddRjCPI.exe
  C:\Windows\System\ddRjCPI.exe
  2⤵
  PID:5504
- C:\Windows\System\NkutpwB.exe
  C:\Windows\System\NkutpwB.exe
  2⤵
  PID:5520
- C:\Windows\System\xACpnRq.exe
  C:\Windows\System\xACpnRq.exe
  2⤵
  PID:5536
- C:\Windows\System\kpxvWum.exe
  C:\Windows\System\kpxvWum.exe
  2⤵
  PID:5552
- C:\Windows\System\dluVbcZ.exe
  C:\Windows\System\dluVbcZ.exe
  2⤵
  PID:5568
- C:\Windows\System\vAKkWYB.exe
  C:\Windows\System\vAKkWYB.exe
  2⤵
  PID:5584
- C:\Windows\System\joxxKlV.exe
  C:\Windows\System\joxxKlV.exe
  2⤵
  PID:5600
- C:\Windows\System\xGSnBtR.exe
  C:\Windows\System\xGSnBtR.exe
  2⤵
  PID:5616
- C:\Windows\System\RjAgWLD.exe
  C:\Windows\System\RjAgWLD.exe
  2⤵
  PID:5632
- C:\Windows\System\IXHRnAF.exe
  C:\Windows\System\IXHRnAF.exe
  2⤵
  PID:5648
- C:\Windows\System\fipgNwt.exe
  C:\Windows\System\fipgNwt.exe
  2⤵
  PID:5664
- C:\Windows\System\XRXyidj.exe
  C:\Windows\System\XRXyidj.exe
  2⤵
  PID:5680
- C:\Windows\System\FDZzbcU.exe
  C:\Windows\System\FDZzbcU.exe
  2⤵
  PID:5696
- C:\Windows\System\WHvwtnc.exe
  C:\Windows\System\WHvwtnc.exe
  2⤵
  PID:5712
- C:\Windows\System\vyWZXLy.exe
  C:\Windows\System\vyWZXLy.exe
  2⤵
  PID:5728
- C:\Windows\System\ITkEBvd.exe
  C:\Windows\System\ITkEBvd.exe
  2⤵
  PID:5744
- C:\Windows\System\IEuyYYj.exe
  C:\Windows\System\IEuyYYj.exe
  2⤵
  PID:5760
- C:\Windows\System\Yhtmqni.exe
  C:\Windows\System\Yhtmqni.exe
  2⤵
  PID:5776
- C:\Windows\System\VrVDTVS.exe
  C:\Windows\System\VrVDTVS.exe
  2⤵
  PID:5792
- C:\Windows\System\yvlePNd.exe
  C:\Windows\System\yvlePNd.exe
  2⤵
  PID:5808
- C:\Windows\System\qBAZiCl.exe
  C:\Windows\System\qBAZiCl.exe
  2⤵
  PID:5824
- C:\Windows\System\vRdZpTI.exe
  C:\Windows\System\vRdZpTI.exe
  2⤵
  PID:5840
- C:\Windows\System\rNjpGCx.exe
  C:\Windows\System\rNjpGCx.exe
  2⤵
  PID:5856
- C:\Windows\System\vVebAnh.exe
  C:\Windows\System\vVebAnh.exe
  2⤵
  PID:5872
- C:\Windows\System\kXGKwtM.exe
  C:\Windows\System\kXGKwtM.exe
  2⤵
  PID:5892
- C:\Windows\System\fNEZxGg.exe
  C:\Windows\System\fNEZxGg.exe
  2⤵
  PID:5908
- C:\Windows\System\pnLTSKV.exe
  C:\Windows\System\pnLTSKV.exe
  2⤵
  PID:5924
- C:\Windows\System\qqksUBV.exe
  C:\Windows\System\qqksUBV.exe
  2⤵
  PID:5940
- C:\Windows\System\vZsQCMy.exe
  C:\Windows\System\vZsQCMy.exe
  2⤵
  PID:5956
- C:\Windows\System\jVhrgYt.exe
  C:\Windows\System\jVhrgYt.exe
  2⤵
  PID:5976
- C:\Windows\System\tUtmRRu.exe
  C:\Windows\System\tUtmRRu.exe
  2⤵
  PID:5992
- C:\Windows\System\UbSlZul.exe
  C:\Windows\System\UbSlZul.exe
  2⤵
  PID:6008
- C:\Windows\System\MmWIMvH.exe
  C:\Windows\System\MmWIMvH.exe
  2⤵
  PID:6024
- C:\Windows\System\dzFKRhd.exe
  C:\Windows\System\dzFKRhd.exe
  2⤵
  PID:6040
- C:\Windows\System\abhPLcz.exe
  C:\Windows\System\abhPLcz.exe
  2⤵
  PID:6056
- C:\Windows\System\lPeFgNB.exe
  C:\Windows\System\lPeFgNB.exe
  2⤵
  PID:6072
- C:\Windows\System\eYOHota.exe
  C:\Windows\System\eYOHota.exe
  2⤵
  PID:6088
- C:\Windows\System\yEyAIjs.exe
  C:\Windows\System\yEyAIjs.exe
  2⤵
  PID:6104
- C:\Windows\System\nCmzHtg.exe
  C:\Windows\System\nCmzHtg.exe
  2⤵
  PID:6120
- C:\Windows\System\EVNiSHd.exe
  C:\Windows\System\EVNiSHd.exe
  2⤵
  PID:6136
- C:\Windows\System\rlzsrIc.exe
  C:\Windows\System\rlzsrIc.exe
  2⤵
  PID:4224
- C:\Windows\System\OskBnOz.exe
  C:\Windows\System\OskBnOz.exe
  2⤵
  PID:2412
- C:\Windows\System\usOyPKD.exe
  C:\Windows\System\usOyPKD.exe
  2⤵
  PID:4740
- C:\Windows\System\PJYVLfY.exe
  C:\Windows\System\PJYVLfY.exe
  2⤵
  PID:5172
- C:\Windows\System\gChewQU.exe
  C:\Windows\System\gChewQU.exe
  2⤵
  PID:5240
- C:\Windows\System\rpYUkGV.exe
  C:\Windows\System\rpYUkGV.exe
  2⤵
  PID:5304
- C:\Windows\System\zvGTcqm.exe
  C:\Windows\System\zvGTcqm.exe
  2⤵
  PID:5368
- C:\Windows\System\YGpLIVO.exe
  C:\Windows\System\YGpLIVO.exe
  2⤵
  PID:5124
- C:\Windows\System\gSmBXyx.exe
  C:\Windows\System\gSmBXyx.exe
  2⤵
  PID:5220
- C:\Windows\System\JqTjLBb.exe
  C:\Windows\System\JqTjLBb.exe
  2⤵
  PID:5452
- C:\Windows\System\jeFgcDV.exe
  C:\Windows\System\jeFgcDV.exe
  2⤵
  PID:5260
- C:\Windows\System\uWULijJ.exe
  C:\Windows\System\uWULijJ.exe
  2⤵
  PID:5352
- C:\Windows\System\rMiazWf.exe
  C:\Windows\System\rMiazWf.exe
  2⤵
  PID:2652
- C:\Windows\System\SxIGqBW.exe
  C:\Windows\System\SxIGqBW.exe
  2⤵
  PID:5188
- C:\Windows\System\ErKqUak.exe
  C:\Windows\System\ErKqUak.exe
  2⤵
  PID:5256
- C:\Windows\System\LCdPZeC.exe
  C:\Windows\System\LCdPZeC.exe
  2⤵
  PID:5372
- C:\Windows\System\ifdYvSQ.exe
  C:\Windows\System\ifdYvSQ.exe
  2⤵
  PID:5608
- C:\Windows\System\URIbrVG.exe
  C:\Windows\System\URIbrVG.exe
  2⤵
  PID:5676
- C:\Windows\System\DxdaSuW.exe
  C:\Windows\System\DxdaSuW.exe
  2⤵
  PID:5656
- C:\Windows\System\eryJAGH.exe
  C:\Windows\System\eryJAGH.exe
  2⤵
  PID:5592
- C:\Windows\System\iDHMPiv.exe
  C:\Windows\System\iDHMPiv.exe
  2⤵
  PID:5528
- C:\Windows\System\lbGyMoy.exe
  C:\Windows\System\lbGyMoy.exe
  2⤵
  PID:5464
- C:\Windows\System\macRSjZ.exe
  C:\Windows\System\macRSjZ.exe
  2⤵
  PID:5692
- C:\Windows\System\ISKHPGi.exe
  C:\Windows\System\ISKHPGi.exe
  2⤵
  PID:5708
- C:\Windows\System\uaNqMBO.exe
  C:\Windows\System\uaNqMBO.exe
  2⤵
  PID:5784
- C:\Windows\System\vJcOeBN.exe
  C:\Windows\System\vJcOeBN.exe
  2⤵
  PID:5852
- C:\Windows\System\kpwtYbE.exe
  C:\Windows\System\kpwtYbE.exe
  2⤵
  PID:5916
- C:\Windows\System\dbQycCk.exe
  C:\Windows\System\dbQycCk.exe
  2⤵
  PID:5768
- C:\Windows\System\MFksaxl.exe
  C:\Windows\System\MFksaxl.exe
  2⤵
  PID:5836
- C:\Windows\System\DuAPbpq.exe
  C:\Windows\System\DuAPbpq.exe
  2⤵
  PID:5932
- C:\Windows\System\levHZJi.exe
  C:\Windows\System\levHZJi.exe
  2⤵
  PID:5984
- C:\Windows\System\zwqOtuG.exe
  C:\Windows\System\zwqOtuG.exe
  2⤵
  PID:5972
- C:\Windows\System\huNQepz.exe
  C:\Windows\System\huNQepz.exe
  2⤵
  PID:6048
- C:\Windows\System\nsHudUE.exe
  C:\Windows\System\nsHudUE.exe
  2⤵
  PID:6112
- C:\Windows\System\GRJeTLe.exe
  C:\Windows\System\GRJeTLe.exe
  2⤵
  PID:3112
- C:\Windows\System\yOCzomr.exe
  C:\Windows\System\yOCzomr.exe
  2⤵
  PID:5336
- C:\Windows\System\gBIgRYO.exe
  C:\Windows\System\gBIgRYO.exe
  2⤵
  PID:5192
- C:\Windows\System\nexkWAf.exe
  C:\Windows\System\nexkWAf.exe
  2⤵
  PID:6032
- C:\Windows\System\oImexGE.exe
  C:\Windows\System\oImexGE.exe
  2⤵
  PID:6096
- C:\Windows\System\eEXfbSz.exe
  C:\Windows\System\eEXfbSz.exe
  2⤵
  PID:4236
- C:\Windows\System\OVVRhBu.exe
  C:\Windows\System\OVVRhBu.exe
  2⤵
  PID:5272
- C:\Windows\System\dRLLFMN.exe
  C:\Windows\System\dRLLFMN.exe
  2⤵
  PID:5420
- C:\Windows\System\NhmKwKR.exe
  C:\Windows\System\NhmKwKR.exe
  2⤵
  PID:5516
- C:\Windows\System\WqrQymu.exe
  C:\Windows\System\WqrQymu.exe
  2⤵
  PID:5160
- C:\Windows\System\nYyYubI.exe
  C:\Windows\System\nYyYubI.exe
  2⤵
  PID:5612
- C:\Windows\System\zGiZYnD.exe
  C:\Windows\System\zGiZYnD.exe
  2⤵
  PID:5624
- C:\Windows\System\uUMEkqw.exe
  C:\Windows\System\uUMEkqw.exe
  2⤵
  PID:5644
- C:\Windows\System\EeLWGoG.exe
  C:\Windows\System\EeLWGoG.exe
  2⤵
  PID:5496
- C:\Windows\System\lfSEjIu.exe
  C:\Windows\System\lfSEjIu.exe
  2⤵
  PID:6016
- C:\Windows\System\VzeZpXI.exe
  C:\Windows\System\VzeZpXI.exe
  2⤵
  PID:5660
- C:\Windows\System\cKVfqGH.exe
  C:\Windows\System\cKVfqGH.exe
  2⤵
  PID:5560
- C:\Windows\System\KUujrDj.exe
  C:\Windows\System\KUujrDj.exe
  2⤵
  PID:5816
- C:\Windows\System\dqQqqhs.exe
  C:\Windows\System\dqQqqhs.exe
  2⤵
  PID:5772
- C:\Windows\System\thHgMFC.exe
  C:\Windows\System\thHgMFC.exe
  2⤵
  PID:5804
- C:\Windows\System\WWIPFTo.exe
  C:\Windows\System\WWIPFTo.exe
  2⤵
  PID:5340
- C:\Windows\System\kHJcIgN.exe
  C:\Windows\System\kHJcIgN.exe
  2⤵
  PID:5292
- C:\Windows\System\McVbSOZ.exe
  C:\Windows\System\McVbSOZ.exe
  2⤵
  PID:5140
- C:\Windows\System\qBfeXsO.exe
  C:\Windows\System\qBfeXsO.exe
  2⤵
  PID:3308
- C:\Windows\System\FVfrlhu.exe
  C:\Windows\System\FVfrlhu.exe
  2⤵
  PID:5156
- C:\Windows\System\kZjrqFj.exe
  C:\Windows\System\kZjrqFj.exe
  2⤵
  PID:5468
- C:\Windows\System\vYqYaPV.exe
  C:\Windows\System\vYqYaPV.exe
  2⤵
  PID:5672
- C:\Windows\System\cmHKYlx.exe
  C:\Windows\System\cmHKYlx.exe
  2⤵
  PID:5432
- C:\Windows\System\RTYyfsT.exe
  C:\Windows\System\RTYyfsT.exe
  2⤵
  PID:5688
- C:\Windows\System\nzFkDKT.exe
  C:\Windows\System\nzFkDKT.exe
  2⤵
  PID:5208
- C:\Windows\System\bTJJsun.exe
  C:\Windows\System\bTJJsun.exe
  2⤵
  PID:4980
- C:\Windows\System\jEiRYCd.exe
  C:\Windows\System\jEiRYCd.exe
  2⤵
  PID:6004
- C:\Windows\System\EnYuSJH.exe
  C:\Windows\System\EnYuSJH.exe
  2⤵
  PID:5548
- C:\Windows\System\upAsDXN.exe
  C:\Windows\System\upAsDXN.exe
  2⤵
  PID:5952
- C:\Windows\System\uiwCfzb.exe
  C:\Windows\System\uiwCfzb.exe
  2⤵
  PID:5740
- C:\Windows\System\ILTJGhC.exe
  C:\Windows\System\ILTJGhC.exe
  2⤵
  PID:6128
- C:\Windows\System\aGWLNeX.exe
  C:\Windows\System\aGWLNeX.exe
  2⤵
  PID:5704
- C:\Windows\System\neGQYQn.exe
  C:\Windows\System\neGQYQn.exe
  2⤵
  PID:5320
- C:\Windows\System\RzvboVN.exe
  C:\Windows\System\RzvboVN.exe
  2⤵
  PID:6164
- C:\Windows\System\ZkCBGZo.exe
  C:\Windows\System\ZkCBGZo.exe
  2⤵
  PID:6180
- C:\Windows\System\PNqmZBq.exe
  C:\Windows\System\PNqmZBq.exe
  2⤵
  PID:6196
- C:\Windows\System\Atynphm.exe
  C:\Windows\System\Atynphm.exe
  2⤵
  PID:6212
- C:\Windows\System\iHnvhTE.exe
  C:\Windows\System\iHnvhTE.exe
  2⤵
  PID:6228
- C:\Windows\System\ZLjpVKB.exe
  C:\Windows\System\ZLjpVKB.exe
  2⤵
  PID:6244
- C:\Windows\System\MsRffmR.exe
  C:\Windows\System\MsRffmR.exe
  2⤵
  PID:6260
- C:\Windows\System\UgZaTZA.exe
  C:\Windows\System\UgZaTZA.exe
  2⤵
  PID:6276
- C:\Windows\System\vhLCQJs.exe
  C:\Windows\System\vhLCQJs.exe
  2⤵
  PID:6292
- C:\Windows\System\gibNeXl.exe
  C:\Windows\System\gibNeXl.exe
  2⤵
  PID:6312
- C:\Windows\System\QzFQwar.exe
  C:\Windows\System\QzFQwar.exe
  2⤵
  PID:6328
- C:\Windows\System\SLFxAUL.exe
  C:\Windows\System\SLFxAUL.exe
  2⤵
  PID:6344
- C:\Windows\System\XCXOvdm.exe
  C:\Windows\System\XCXOvdm.exe
  2⤵
  PID:6360
- C:\Windows\System\zoAcuMt.exe
  C:\Windows\System\zoAcuMt.exe
  2⤵
  PID:6376
- C:\Windows\System\GISJOyL.exe
  C:\Windows\System\GISJOyL.exe
  2⤵
  PID:6392
- C:\Windows\System\UZAQUZS.exe
  C:\Windows\System\UZAQUZS.exe
  2⤵
  PID:6408
- C:\Windows\System\dIrXeyg.exe
  C:\Windows\System\dIrXeyg.exe
  2⤵
  PID:6424
- C:\Windows\System\EMROBTH.exe
  C:\Windows\System\EMROBTH.exe
  2⤵
  PID:6440
- C:\Windows\System\nUeArOk.exe
  C:\Windows\System\nUeArOk.exe
  2⤵
  PID:6456
- C:\Windows\System\nNkDlXa.exe
  C:\Windows\System\nNkDlXa.exe
  2⤵
  PID:6472
- C:\Windows\System\yxbjufP.exe
  C:\Windows\System\yxbjufP.exe
  2⤵
  PID:6488
- C:\Windows\System\gMsBaQw.exe
  C:\Windows\System\gMsBaQw.exe
  2⤵
  PID:6504
- C:\Windows\System\DJibuIf.exe
  C:\Windows\System\DJibuIf.exe
  2⤵
  PID:6520
- C:\Windows\System\hwSMLAd.exe
  C:\Windows\System\hwSMLAd.exe
  2⤵
  PID:6536
- C:\Windows\System\SbQmpnb.exe
  C:\Windows\System\SbQmpnb.exe
  2⤵
  PID:6552
- C:\Windows\System\JQXYAUi.exe
  C:\Windows\System\JQXYAUi.exe
  2⤵
  PID:6576
- C:\Windows\System\JmNspqF.exe
  C:\Windows\System\JmNspqF.exe
  2⤵
  PID:6592
- C:\Windows\System\VlqDyuL.exe
  C:\Windows\System\VlqDyuL.exe
  2⤵
  PID:6608
- C:\Windows\System\aFMsoGf.exe
  C:\Windows\System\aFMsoGf.exe
  2⤵
  PID:6624
- C:\Windows\System\dWBhZSe.exe
  C:\Windows\System\dWBhZSe.exe
  2⤵
  PID:6640
- C:\Windows\System\iktpZrx.exe
  C:\Windows\System\iktpZrx.exe
  2⤵
  PID:6656
- C:\Windows\System\egTqHGr.exe
  C:\Windows\System\egTqHGr.exe
  2⤵
  PID:6672
- C:\Windows\System\RmhjOaB.exe
  C:\Windows\System\RmhjOaB.exe
  2⤵
  PID:6688
- C:\Windows\System\soeodGn.exe
  C:\Windows\System\soeodGn.exe
  2⤵
  PID:6704
- C:\Windows\System\QWgkhWD.exe
  C:\Windows\System\QWgkhWD.exe
  2⤵
  PID:6720
- C:\Windows\System\PNYXslT.exe
  C:\Windows\System\PNYXslT.exe
  2⤵
  PID:6736
- C:\Windows\System\rahHyUR.exe
  C:\Windows\System\rahHyUR.exe
  2⤵
  PID:6752
- C:\Windows\System\obEyKWO.exe
  C:\Windows\System\obEyKWO.exe
  2⤵
  PID:6768
- C:\Windows\System\mbrhNVb.exe
  C:\Windows\System\mbrhNVb.exe
  2⤵
  PID:6788
- C:\Windows\System\ltslMlY.exe
  C:\Windows\System\ltslMlY.exe
  2⤵
  PID:6804
- C:\Windows\System\LMkHSPp.exe
  C:\Windows\System\LMkHSPp.exe
  2⤵
  PID:6820
- C:\Windows\System\LbIQOxa.exe
  C:\Windows\System\LbIQOxa.exe
  2⤵
  PID:6836
- C:\Windows\System\HEjDfiy.exe
  C:\Windows\System\HEjDfiy.exe
  2⤵
  PID:6856
- C:\Windows\System\zSrTMoR.exe
  C:\Windows\System\zSrTMoR.exe
  2⤵
  PID:6872
- C:\Windows\System\GLwLGek.exe
  C:\Windows\System\GLwLGek.exe
  2⤵
  PID:6888
- C:\Windows\System\MJuWUBT.exe
  C:\Windows\System\MJuWUBT.exe
  2⤵
  PID:6908
- C:\Windows\System\hsRiMQa.exe
  C:\Windows\System\hsRiMQa.exe
  2⤵
  PID:6924
- C:\Windows\System\yCByjjQ.exe
  C:\Windows\System\yCByjjQ.exe
  2⤵
  PID:6940
- C:\Windows\System\BrWeIkr.exe
  C:\Windows\System\BrWeIkr.exe
  2⤵
  PID:6956
- C:\Windows\System\DuUqmNV.exe
  C:\Windows\System\DuUqmNV.exe
  2⤵
  PID:6972
- C:\Windows\System\PeuOhOg.exe
  C:\Windows\System\PeuOhOg.exe
  2⤵
  PID:6988
- C:\Windows\System\tUOOnYp.exe
  C:\Windows\System\tUOOnYp.exe
  2⤵
  PID:7008
- C:\Windows\System\bzTdxOj.exe
  C:\Windows\System\bzTdxOj.exe
  2⤵
  PID:7024
- C:\Windows\System\ANqqjRX.exe
  C:\Windows\System\ANqqjRX.exe
  2⤵
  PID:7040
- C:\Windows\System\ogJWimm.exe
  C:\Windows\System\ogJWimm.exe
  2⤵
  PID:7056
- C:\Windows\System\okdelmL.exe
  C:\Windows\System\okdelmL.exe
  2⤵
  PID:7072
- C:\Windows\System\wqNoVzd.exe
  C:\Windows\System\wqNoVzd.exe
  2⤵
  PID:7088
- C:\Windows\System\CXQkVri.exe
  C:\Windows\System\CXQkVri.exe
  2⤵
  PID:7108
- C:\Windows\System\ELWybZx.exe
  C:\Windows\System\ELWybZx.exe
  2⤵
  PID:7124
- C:\Windows\System\vmGwmKT.exe
  C:\Windows\System\vmGwmKT.exe
  2⤵
  PID:7144
- C:\Windows\System\sDPjyrV.exe
  C:\Windows\System\sDPjyrV.exe
  2⤵
  PID:7160
- C:\Windows\System\bpILvrD.exe
  C:\Windows\System\bpILvrD.exe
  2⤵
  PID:6020
- C:\Windows\System\PqrhpwA.exe
  C:\Windows\System\PqrhpwA.exe
  2⤵
  PID:6156
- C:\Windows\System\BaYFqAS.exe
  C:\Windows\System\BaYFqAS.exe
  2⤵
  PID:6220
- C:\Windows\System\TVOkELo.exe
  C:\Windows\System\TVOkELo.exe
  2⤵
  PID:6252
- C:\Windows\System\AkBqahq.exe
  C:\Windows\System\AkBqahq.exe
  2⤵
  PID:6320
- C:\Windows\System\FQAIMZJ.exe
  C:\Windows\System\FQAIMZJ.exe
  2⤵
  PID:6388
- C:\Windows\System\HxytaSP.exe
  C:\Windows\System\HxytaSP.exe
  2⤵
  PID:6452
- C:\Windows\System\fkwDsBY.exe
  C:\Windows\System\fkwDsBY.exe
  2⤵
  PID:6516
- C:\Windows\System\dYhlbTw.exe
  C:\Windows\System\dYhlbTw.exe
  2⤵
  PID:6208
- C:\Windows\System\stNcywq.exe
  C:\Windows\System\stNcywq.exe
  2⤵
  PID:6588
- C:\Windows\System\kNeBuFQ.exe
  C:\Windows\System\kNeBuFQ.exe
  2⤵
  PID:6272
- C:\Windows\System\ecCqdKE.exe
  C:\Windows\System\ecCqdKE.exe
  2⤵
  PID:6336
- C:\Windows\System\PGMSudW.exe
  C:\Windows\System\PGMSudW.exe
  2⤵
  PID:6432
- C:\Windows\System\RNiiDOZ.exe
  C:\Windows\System\RNiiDOZ.exe
  2⤵
  PID:6496
- C:\Windows\System\AsLajoL.exe
  C:\Windows\System\AsLajoL.exe
  2⤵
  PID:6560
- C:\Windows\System\sYLHcZL.exe
  C:\Windows\System\sYLHcZL.exe
  2⤵
  PID:6604
- C:\Windows\System\zqhzmHc.exe
  C:\Windows\System\zqhzmHc.exe
  2⤵
  PID:6680
- C:\Windows\System\rveXxEZ.exe
  C:\Windows\System\rveXxEZ.exe
  2⤵
  PID:6716
- C:\Windows\System\ojtwqgU.exe
  C:\Windows\System\ojtwqgU.exe
  2⤵
  PID:6668
- C:\Windows\System\BDThbhr.exe
  C:\Windows\System\BDThbhr.exe
  2⤵
  PID:6732
- C:\Windows\System\omrWIlP.exe
  C:\Windows\System\omrWIlP.exe
  2⤵
  PID:6780
- C:\Windows\System\YOpnrxq.exe
  C:\Windows\System\YOpnrxq.exe
  2⤵
  PID:6760
- C:\Windows\System\HMmpugQ.exe
  C:\Windows\System\HMmpugQ.exe
  2⤵
  PID:6828
- C:\Windows\System\sTaeHSk.exe
  C:\Windows\System\sTaeHSk.exe
  2⤵
  PID:6864
- C:\Windows\System\SrGQxmi.exe
  C:\Windows\System\SrGQxmi.exe
  2⤵
  PID:6884
- C:\Windows\System\TVIYOto.exe
  C:\Windows\System\TVIYOto.exe
  2⤵
  PID:6952
- C:\Windows\System\SWGatiK.exe
  C:\Windows\System\SWGatiK.exe
  2⤵
  PID:6932
- C:\Windows\System\nklWDrQ.exe
  C:\Windows\System\nklWDrQ.exe
  2⤵
  PID:6936
- C:\Windows\System\yGHVEau.exe
  C:\Windows\System\yGHVEau.exe
  2⤵
  PID:7000
- C:\Windows\System\sqOKVZm.exe
  C:\Windows\System\sqOKVZm.exe
  2⤵
  PID:7052
- C:\Windows\System\KoBnntb.exe
  C:\Windows\System\KoBnntb.exe
  2⤵
  PID:7064
- C:\Windows\System\kELxUgp.exe
  C:\Windows\System\kELxUgp.exe
  2⤵
  PID:7152
- C:\Windows\System\cCTwwgZ.exe
  C:\Windows\System\cCTwwgZ.exe
  2⤵
  PID:7132
- C:\Windows\System\qgWJxDq.exe
  C:\Windows\System\qgWJxDq.exe
  2⤵
  PID:5848
- C:\Windows\System\yHDMveV.exe
  C:\Windows\System\yHDMveV.exe
  2⤵
  PID:5888
- C:\Windows\System\BszKKFQ.exe
  C:\Windows\System\BszKKFQ.exe
  2⤵
  PID:6352
- C:\Windows\System\DRRhalz.exe
  C:\Windows\System\DRRhalz.exe
  2⤵
  PID:6512
- C:\Windows\System\GWtWsIH.exe
  C:\Windows\System\GWtWsIH.exe
  2⤵
  PID:6448
- C:\Windows\System\spTAJHt.exe
  C:\Windows\System\spTAJHt.exe
  2⤵
  PID:6268
- C:\Windows\System\WSPREWo.exe
  C:\Windows\System\WSPREWo.exe
  2⤵
  PID:6528
- C:\Windows\System\rGJyboJ.exe
  C:\Windows\System\rGJyboJ.exe
  2⤵
  PID:6600
- C:\Windows\System\DHFAdbi.exe
  C:\Windows\System\DHFAdbi.exe
  2⤵
  PID:6616
- C:\Windows\System\xjZwYMJ.exe
  C:\Windows\System\xjZwYMJ.exe
  2⤵
  PID:6636
- C:\Windows\System\KdRwMXj.exe
  C:\Windows\System\KdRwMXj.exe
  2⤵
  PID:6812
- C:\Windows\System\UzCbofK.exe
  C:\Windows\System\UzCbofK.exe
  2⤵
  PID:6844
- C:\Windows\System\ZpdaFPE.exe
  C:\Windows\System\ZpdaFPE.exe
  2⤵
  PID:6900
- C:\Windows\System\hFZdpHS.exe
  C:\Windows\System\hFZdpHS.exe
  2⤵
  PID:6852
- C:\Windows\System\aJFQzkK.exe
  C:\Windows\System\aJFQzkK.exe
  2⤵
  PID:7140
- C:\Windows\System\UlsDKHx.exe
  C:\Windows\System\UlsDKHx.exe
  2⤵
  PID:7080
- C:\Windows\System\BDEPvbg.exe
  C:\Windows\System\BDEPvbg.exe
  2⤵
  PID:6984
- C:\Windows\System\PXhBsLd.exe
  C:\Windows\System\PXhBsLd.exe
  2⤵
  PID:7096
- C:\Windows\System\YqBAQVG.exe
  C:\Windows\System\YqBAQVG.exe
  2⤵
  PID:6176
- C:\Windows\System\OBymfVP.exe
  C:\Windows\System\OBymfVP.exe
  2⤵
  PID:6288
- C:\Windows\System\Adgptjf.exe
  C:\Windows\System\Adgptjf.exe
  2⤵
  PID:6532
- C:\Windows\System\vDUnnar.exe
  C:\Windows\System\vDUnnar.exe
  2⤵
  PID:6920
- C:\Windows\System\CsjZBdm.exe
  C:\Windows\System\CsjZBdm.exe
  2⤵
  PID:7120
- C:\Windows\System\UEgMVdO.exe
  C:\Windows\System\UEgMVdO.exe
  2⤵
  PID:6712
- C:\Windows\System\EGkYYOh.exe
  C:\Windows\System\EGkYYOh.exe
  2⤵
  PID:7136
- C:\Windows\System\pgNfseW.exe
  C:\Windows\System\pgNfseW.exe
  2⤵
  PID:6284
- C:\Windows\System\nFLoYCr.exe
  C:\Windows\System\nFLoYCr.exe
  2⤵
  PID:6172
- C:\Windows\System\FVufQtV.exe
  C:\Windows\System\FVufQtV.exe
  2⤵
  PID:6728
- C:\Windows\System\oLUhSxt.exe
  C:\Windows\System\oLUhSxt.exe
  2⤵
  PID:6468
- C:\Windows\System\YTZKpcl.exe
  C:\Windows\System\YTZKpcl.exe
  2⤵
  PID:6816
- C:\Windows\System\BsXibPk.exe
  C:\Windows\System\BsXibPk.exe
  2⤵
  PID:7184
- C:\Windows\System\qXAaLkZ.exe
  C:\Windows\System\qXAaLkZ.exe
  2⤵
  PID:7200
- C:\Windows\System\NmjsMly.exe
  C:\Windows\System\NmjsMly.exe
  2⤵
  PID:7220
- C:\Windows\System\mTKZdhE.exe
  C:\Windows\System\mTKZdhE.exe
  2⤵
  PID:7236
- C:\Windows\System\NrglHMT.exe
  C:\Windows\System\NrglHMT.exe
  2⤵
  PID:7252
- C:\Windows\System\qXMDYSb.exe
  C:\Windows\System\qXMDYSb.exe
  2⤵
  PID:7268
- C:\Windows\System\DlVSbFe.exe
  C:\Windows\System\DlVSbFe.exe
  2⤵
  PID:7284
- C:\Windows\System\PisgzZI.exe
  C:\Windows\System\PisgzZI.exe
  2⤵
  PID:7300
- C:\Windows\System\YIMDMnf.exe
  C:\Windows\System\YIMDMnf.exe
  2⤵
  PID:7316
- C:\Windows\System\OThAwRH.exe
  C:\Windows\System\OThAwRH.exe
  2⤵
  PID:7332
- C:\Windows\System\trLEkBf.exe
  C:\Windows\System\trLEkBf.exe
  2⤵
  PID:7348
- C:\Windows\System\LEjLilJ.exe
  C:\Windows\System\LEjLilJ.exe
  2⤵
  PID:7368
- C:\Windows\System\pYkoMGJ.exe
  C:\Windows\System\pYkoMGJ.exe
  2⤵
  PID:7384
- C:\Windows\System\NBgnbkJ.exe
  C:\Windows\System\NBgnbkJ.exe
  2⤵
  PID:7400
- C:\Windows\System\QFmPjgy.exe
  C:\Windows\System\QFmPjgy.exe
  2⤵
  PID:7416
- C:\Windows\System\nSmVueb.exe
  C:\Windows\System\nSmVueb.exe
  2⤵
  PID:7432
- C:\Windows\System\DwMYSlq.exe
  C:\Windows\System\DwMYSlq.exe
  2⤵
  PID:7448
- C:\Windows\System\URcEzgE.exe
  C:\Windows\System\URcEzgE.exe
  2⤵
  PID:7464
- C:\Windows\System\eygbfJo.exe
  C:\Windows\System\eygbfJo.exe
  2⤵
  PID:7480
- C:\Windows\System\fcToZAY.exe
  C:\Windows\System\fcToZAY.exe
  2⤵
  PID:7496
- C:\Windows\System\WXFBzbV.exe
  C:\Windows\System\WXFBzbV.exe
  2⤵
  PID:7512
- C:\Windows\System\juBCZUJ.exe
  C:\Windows\System\juBCZUJ.exe
  2⤵
  PID:7528
- C:\Windows\System\ZnEqHRK.exe
  C:\Windows\System\ZnEqHRK.exe
  2⤵
  PID:7544
- C:\Windows\System\vsrdNfT.exe
  C:\Windows\System\vsrdNfT.exe
  2⤵
  PID:7560
- C:\Windows\System\IngkFle.exe
  C:\Windows\System\IngkFle.exe
  2⤵
  PID:7576
- C:\Windows\System\ybPsSqt.exe
  C:\Windows\System\ybPsSqt.exe
  2⤵
  PID:7596
- C:\Windows\System\stcLexx.exe
  C:\Windows\System\stcLexx.exe
  2⤵
  PID:7612
- C:\Windows\System\aPCbpUy.exe
  C:\Windows\System\aPCbpUy.exe
  2⤵
  PID:7628
- C:\Windows\System\aCorwpc.exe
  C:\Windows\System\aCorwpc.exe
  2⤵
  PID:7644
- C:\Windows\System\WfHCJkn.exe
  C:\Windows\System\WfHCJkn.exe
  2⤵
  PID:7664
- C:\Windows\System\VRWPGuy.exe
  C:\Windows\System\VRWPGuy.exe
  2⤵
  PID:7680
- C:\Windows\System\ULaebSL.exe
  C:\Windows\System\ULaebSL.exe
  2⤵
  PID:7696
- C:\Windows\System\QybwuGS.exe
  C:\Windows\System\QybwuGS.exe
  2⤵
  PID:7716
- C:\Windows\System\ssnVuAt.exe
  C:\Windows\System\ssnVuAt.exe
  2⤵
  PID:7732
- C:\Windows\System\OEEDDFk.exe
  C:\Windows\System\OEEDDFk.exe
  2⤵
  PID:7748
- C:\Windows\System\VUWuVTe.exe
  C:\Windows\System\VUWuVTe.exe
  2⤵
  PID:7764
- C:\Windows\System\vHEyxDo.exe
  C:\Windows\System\vHEyxDo.exe
  2⤵
  PID:7780
- C:\Windows\System\xVYGAkE.exe
  C:\Windows\System\xVYGAkE.exe
  2⤵
  PID:7800
- C:\Windows\System\okHXpup.exe
  C:\Windows\System\okHXpup.exe
  2⤵
  PID:7816
- C:\Windows\System\reEeBwO.exe
  C:\Windows\System\reEeBwO.exe
  2⤵
  PID:7832
- C:\Windows\System\RiiLugB.exe
  C:\Windows\System\RiiLugB.exe
  2⤵
  PID:7848
- C:\Windows\System\GdEXYcM.exe
  C:\Windows\System\GdEXYcM.exe
  2⤵
  PID:7864
- C:\Windows\System\RPQstnp.exe
  C:\Windows\System\RPQstnp.exe
  2⤵
  PID:7884
- C:\Windows\System\kgWCxOU.exe
  C:\Windows\System\kgWCxOU.exe
  2⤵
  PID:7900
- C:\Windows\System\mHgmRDy.exe
  C:\Windows\System\mHgmRDy.exe
  2⤵
  PID:7916
- C:\Windows\System\MwEmomx.exe
  C:\Windows\System\MwEmomx.exe
  2⤵
  PID:7936
- C:\Windows\System\mkEpgZM.exe
  C:\Windows\System\mkEpgZM.exe
  2⤵
  PID:7952
- C:\Windows\System\AZSFJhN.exe
  C:\Windows\System\AZSFJhN.exe
  2⤵
  PID:7968
- C:\Windows\System\FaltyXe.exe
  C:\Windows\System\FaltyXe.exe
  2⤵
  PID:7988
- C:\Windows\System\evopgzq.exe
  C:\Windows\System\evopgzq.exe
  2⤵
  PID:8004
- C:\Windows\System\eTqpsRb.exe
  C:\Windows\System\eTqpsRb.exe
  2⤵
  PID:8020
- C:\Windows\System\UbZrJXU.exe
  C:\Windows\System\UbZrJXU.exe
  2⤵
  PID:8036
- C:\Windows\System\rayuUoA.exe
  C:\Windows\System\rayuUoA.exe
  2⤵
  PID:8052
- C:\Windows\System\tncNcjy.exe
  C:\Windows\System\tncNcjy.exe
  2⤵
  PID:8072
- C:\Windows\System\UPXjuOo.exe
  C:\Windows\System\UPXjuOo.exe
  2⤵
  PID:8088
- C:\Windows\System\LTvaaDq.exe
  C:\Windows\System\LTvaaDq.exe
  2⤵
  PID:8104
- C:\Windows\System\QIkZmsY.exe
  C:\Windows\System\QIkZmsY.exe
  2⤵
  PID:8120
- C:\Windows\System\OgzUems.exe
  C:\Windows\System\OgzUems.exe
  2⤵
  PID:8136
- C:\Windows\System\WxpQFRA.exe
  C:\Windows\System\WxpQFRA.exe
  2⤵
  PID:8152
- C:\Windows\System\oThMgHO.exe
  C:\Windows\System\oThMgHO.exe
  2⤵
  PID:8172
- C:\Windows\System\SOHePAa.exe
  C:\Windows\System\SOHePAa.exe
  2⤵
  PID:8188
- C:\Windows\System\KGhmoTB.exe
  C:\Windows\System\KGhmoTB.exe
  2⤵
  PID:6308
- C:\Windows\System\DpDAtxQ.exe
  C:\Windows\System\DpDAtxQ.exe
  2⤵
  PID:7180
- C:\Windows\System\flYdPRQ.exe
  C:\Windows\System\flYdPRQ.exe
  2⤵
  PID:7244
- C:\Windows\System\BmeOhoi.exe
  C:\Windows\System\BmeOhoi.exe
  2⤵
  PID:6304
- C:\Windows\System\PrNwTzS.exe
  C:\Windows\System\PrNwTzS.exe
  2⤵
  PID:7192
- C:\Windows\System\xHRkWJD.exe
  C:\Windows\System\xHRkWJD.exe
  2⤵
  PID:7032
- C:\Windows\System\iAIVlWv.exe
  C:\Windows\System\iAIVlWv.exe
  2⤵
  PID:7308
- C:\Windows\System\lawxeDi.exe
  C:\Windows\System\lawxeDi.exe
  2⤵
  PID:7376
- C:\Windows\System\bxnTaXS.exe
  C:\Windows\System\bxnTaXS.exe
  2⤵
  PID:7324
- C:\Windows\System\MwnbMVN.exe
  C:\Windows\System\MwnbMVN.exe
  2⤵
  PID:7364
- C:\Windows\System\RXUyDUu.exe
  C:\Windows\System\RXUyDUu.exe
  2⤵
  PID:7456
- C:\Windows\System\UjZPaSb.exe
  C:\Windows\System\UjZPaSb.exe
  2⤵
  PID:7440
- C:\Windows\System\wWLbcTn.exe
  C:\Windows\System\wWLbcTn.exe
  2⤵
  PID:7504
- C:\Windows\System\cePtIJk.exe
  C:\Windows\System\cePtIJk.exe
  2⤵
  PID:7568
- C:\Windows\System\KTFdMLm.exe
  C:\Windows\System\KTFdMLm.exe
  2⤵
  PID:7488
- C:\Windows\System\SYkPDJC.exe
  C:\Windows\System\SYkPDJC.exe
  2⤵
  PID:7556
- C:\Windows\System\fWkIpvm.exe
  C:\Windows\System\fWkIpvm.exe
  2⤵
  PID:7624
- C:\Windows\System\TfjQpCF.exe
  C:\Windows\System\TfjQpCF.exe
  2⤵
  PID:7640
- C:\Windows\System\jngOPPH.exe
  C:\Windows\System\jngOPPH.exe
  2⤵
  PID:7692
- C:\Windows\System\WqtQpWb.exe
  C:\Windows\System\WqtQpWb.exe
  2⤵
  PID:7744
- C:\Windows\System\ydFryoL.exe
  C:\Windows\System\ydFryoL.exe
  2⤵
  PID:7772
- C:\Windows\System\ZeVoMAe.exe
  C:\Windows\System\ZeVoMAe.exe
  2⤵
  PID:7760
- C:\Windows\System\VLRMVEq.exe
  C:\Windows\System\VLRMVEq.exe
  2⤵
  PID:7872
- C:\Windows\System\gftPHET.exe
  C:\Windows\System\gftPHET.exe
  2⤵
  PID:7788
- C:\Windows\System\dqDpzAV.exe
  C:\Windows\System\dqDpzAV.exe
  2⤵
  PID:7908
- C:\Windows\System\hqqctqh.exe
  C:\Windows\System\hqqctqh.exe
  2⤵
  PID:7896
- C:\Windows\System\pEVfghx.exe
  C:\Windows\System\pEVfghx.exe
  2⤵
  PID:7960
- C:\Windows\System\QmnZFJH.exe
  C:\Windows\System\QmnZFJH.exe
  2⤵
  PID:7980
- C:\Windows\System\yvhzLNf.exe
  C:\Windows\System\yvhzLNf.exe
  2⤵
  PID:7996
- C:\Windows\System\uqikVXe.exe
  C:\Windows\System\uqikVXe.exe
  2⤵
  PID:8016
- C:\Windows\System\WfWESIv.exe
  C:\Windows\System\WfWESIv.exe
  2⤵
  PID:8032
- C:\Windows\System\uIBNxDl.exe
  C:\Windows\System\uIBNxDl.exe
  2⤵
  PID:8112
- C:\Windows\System\dfPOfqH.exe
  C:\Windows\System\dfPOfqH.exe
  2⤵
  PID:6464
- C:\Windows\System\tCnYjzb.exe
  C:\Windows\System\tCnYjzb.exe
  2⤵
  PID:6384
- C:\Windows\System\vHtmbRb.exe
  C:\Windows\System\vHtmbRb.exe
  2⤵
  PID:8132
- C:\Windows\System\HeqcYmV.exe
  C:\Windows\System\HeqcYmV.exe
  2⤵
  PID:7212
- C:\Windows\System\idKDzyo.exe
  C:\Windows\System\idKDzyo.exe
  2⤵
  PID:6880
- C:\Windows\System\wtFvZiN.exe
  C:\Windows\System\wtFvZiN.exe
  2⤵
  PID:7228
- C:\Windows\System\TIyUThQ.exe
  C:\Windows\System\TIyUThQ.exe
  2⤵
  PID:7340
- C:\Windows\System\hqzAvvX.exe
  C:\Windows\System\hqzAvvX.exe
  2⤵
  PID:7408
- C:\Windows\System\qUPWzEc.exe
  C:\Windows\System\qUPWzEc.exe
  2⤵
  PID:7424
- C:\Windows\System\chtYatl.exe
  C:\Windows\System\chtYatl.exe
  2⤵
  PID:7476
- C:\Windows\System\LETyAYf.exe
  C:\Windows\System\LETyAYf.exe
  2⤵
  PID:7636
- C:\Windows\System\ecdcOrQ.exe
  C:\Windows\System\ecdcOrQ.exe
  2⤵
  PID:7808
- C:\Windows\System\zoRdzqP.exe
  C:\Windows\System\zoRdzqP.exe
  2⤵
  PID:7592
- C:\Windows\System\sQBmbiY.exe
  C:\Windows\System\sQBmbiY.exe
  2⤵
  PID:7948
- C:\Windows\System\OkTcXGx.exe
  C:\Windows\System\OkTcXGx.exe
  2⤵
  PID:8148
- C:\Windows\System\cGMnpwN.exe
  C:\Windows\System\cGMnpwN.exe
  2⤵
  PID:8068
- C:\Windows\System\XBnAdCt.exe
  C:\Windows\System\XBnAdCt.exe
  2⤵
  PID:7672
- C:\Windows\System\WCykIbC.exe
  C:\Windows\System\WCykIbC.exe
  2⤵
  PID:7840
- C:\Windows\System\NZwjUBb.exe
  C:\Windows\System\NZwjUBb.exe
  2⤵
  PID:7932
- C:\Windows\System\jyeNKLF.exe
  C:\Windows\System\jyeNKLF.exe
  2⤵
  PID:8180
- C:\Windows\System\QwawcTQ.exe
  C:\Windows\System\QwawcTQ.exe
  2⤵
  PID:8168
- C:\Windows\System\QzFRtGa.exe
  C:\Windows\System\QzFRtGa.exe
  2⤵
  PID:7356
- C:\Windows\System\HNBsAQR.exe
  C:\Windows\System\HNBsAQR.exe
  2⤵
  PID:6564
- C:\Windows\System\ACizfaf.exe
  C:\Windows\System\ACizfaf.exe
  2⤵
  PID:7536
- C:\Windows\System\GDTMDRL.exe
  C:\Windows\System\GDTMDRL.exe
  2⤵
  PID:7656
- C:\Windows\System\HAyRNhE.exe
  C:\Windows\System\HAyRNhE.exe
  2⤵
  PID:7944
- C:\Windows\System\zPdPAeI.exe
  C:\Windows\System\zPdPAeI.exe
  2⤵
  PID:8048
- C:\Windows\System\pKZdAsc.exe
  C:\Windows\System\pKZdAsc.exe
  2⤵
  PID:7608
- C:\Windows\System\pdgJWvu.exe
  C:\Windows\System\pdgJWvu.exe
  2⤵
  PID:8028
- C:\Windows\System\UwwtRbk.exe
  C:\Windows\System\UwwtRbk.exe
  2⤵
  PID:7928
- C:\Windows\System\boJNFBZ.exe
  C:\Windows\System\boJNFBZ.exe
  2⤵
  PID:7292
- C:\Windows\System\zGexldN.exe
  C:\Windows\System\zGexldN.exe
  2⤵
  PID:7740
- C:\Windows\System\zVbsdqg.exe
  C:\Windows\System\zVbsdqg.exe
  2⤵
  PID:7880
- C:\Windows\System\dNVfNfd.exe
  C:\Windows\System\dNVfNfd.exe
  2⤵
  PID:7232
- C:\Windows\System\WvEKnIu.exe
  C:\Windows\System\WvEKnIu.exe
  2⤵
  PID:7756
- C:\Windows\System\wwWhoSi.exe
  C:\Windows\System\wwWhoSi.exe
  2⤵
  PID:7824
- C:\Windows\System\hjVXxlY.exe
  C:\Windows\System\hjVXxlY.exe
  2⤵
  PID:7264
- C:\Windows\System\RgdPMHh.exe
  C:\Windows\System\RgdPMHh.exe
  2⤵
  PID:8204
- C:\Windows\System\GbesiIl.exe
  C:\Windows\System\GbesiIl.exe
  2⤵
  PID:8220
- C:\Windows\System\GGqSkgu.exe
  C:\Windows\System\GGqSkgu.exe
  2⤵
  PID:8236
- C:\Windows\System\IpqPaqv.exe
  C:\Windows\System\IpqPaqv.exe
  2⤵
  PID:8252
- C:\Windows\System\QrBkKqu.exe
  C:\Windows\System\QrBkKqu.exe
  2⤵
  PID:8268
- C:\Windows\System\DpmBegn.exe
  C:\Windows\System\DpmBegn.exe
  2⤵
  PID:8284
- C:\Windows\System\rEOeUFp.exe
  C:\Windows\System\rEOeUFp.exe
  2⤵
  PID:8300
- C:\Windows\System\HiPNnra.exe
  C:\Windows\System\HiPNnra.exe
  2⤵
  PID:8316
- C:\Windows\System\AVaQpHS.exe
  C:\Windows\System\AVaQpHS.exe
  2⤵
  PID:8332
- C:\Windows\System\DzKbuQI.exe
  C:\Windows\System\DzKbuQI.exe
  2⤵
  PID:8348
- C:\Windows\System\MhaAZii.exe
  C:\Windows\System\MhaAZii.exe
  2⤵
  PID:8364
- C:\Windows\System\fhFgcHa.exe
  C:\Windows\System\fhFgcHa.exe
  2⤵
  PID:8380
- C:\Windows\System\oJLlMgu.exe
  C:\Windows\System\oJLlMgu.exe
  2⤵
  PID:8396
- C:\Windows\System\TKrUozH.exe
  C:\Windows\System\TKrUozH.exe
  2⤵
  PID:8416
- C:\Windows\System\sLdUdsz.exe
  C:\Windows\System\sLdUdsz.exe
  2⤵
  PID:8432
- C:\Windows\System\JJwcovj.exe
  C:\Windows\System\JJwcovj.exe
  2⤵
  PID:8448
- C:\Windows\System\CrLekyJ.exe
  C:\Windows\System\CrLekyJ.exe
  2⤵
  PID:8464
- C:\Windows\System\KNzHLNq.exe
  C:\Windows\System\KNzHLNq.exe
  2⤵
  PID:8480
- C:\Windows\System\XsoqdLy.exe
  C:\Windows\System\XsoqdLy.exe
  2⤵
  PID:8572
- C:\Windows\System\uzWcmdk.exe
  C:\Windows\System\uzWcmdk.exe
  2⤵
  PID:8592
- C:\Windows\System\HgJiQHa.exe
  C:\Windows\System\HgJiQHa.exe
  2⤵
  PID:8608
- C:\Windows\System\cFmSmVA.exe
  C:\Windows\System\cFmSmVA.exe
  2⤵
  PID:8632
- C:\Windows\System\rYWvaCC.exe
  C:\Windows\System\rYWvaCC.exe
  2⤵
  PID:8648
- C:\Windows\System\jkOarjJ.exe
  C:\Windows\System\jkOarjJ.exe
  2⤵
  PID:8664
- C:\Windows\System\hjWiPUc.exe
  C:\Windows\System\hjWiPUc.exe
  2⤵
  PID:8680
- C:\Windows\System\AFWUXLH.exe
  C:\Windows\System\AFWUXLH.exe
  2⤵
  PID:8700
- C:\Windows\System\TfZWoyu.exe
  C:\Windows\System\TfZWoyu.exe
  2⤵
  PID:8716
- C:\Windows\System\wegGrlp.exe
  C:\Windows\System\wegGrlp.exe
  2⤵
  PID:8732
- C:\Windows\System\BmbEyUr.exe
  C:\Windows\System\BmbEyUr.exe
  2⤵
  PID:8752
- C:\Windows\System\cwHgxov.exe
  C:\Windows\System\cwHgxov.exe
  2⤵
  PID:8768
- C:\Windows\System\udKvsBG.exe
  C:\Windows\System\udKvsBG.exe
  2⤵
  PID:8784
- C:\Windows\System\IwCfHwM.exe
  C:\Windows\System\IwCfHwM.exe
  2⤵
  PID:8800
- C:\Windows\System\fzFsetf.exe
  C:\Windows\System\fzFsetf.exe
  2⤵
  PID:8816
- C:\Windows\System\MGyRLfZ.exe
  C:\Windows\System\MGyRLfZ.exe
  2⤵
  PID:8832
- C:\Windows\System\RKAsQiD.exe
  C:\Windows\System\RKAsQiD.exe
  2⤵
  PID:8848
- C:\Windows\System\KKeOXcO.exe
  C:\Windows\System\KKeOXcO.exe
  2⤵
  PID:8864
- C:\Windows\System\AtfxIoX.exe
  C:\Windows\System\AtfxIoX.exe
  2⤵
  PID:8884
- C:\Windows\System\cKYcLVZ.exe
  C:\Windows\System\cKYcLVZ.exe
  2⤵
  PID:8900
- C:\Windows\System\bUsGPjK.exe
  C:\Windows\System\bUsGPjK.exe
  2⤵
  PID:8916
- C:\Windows\System\RgMmmEv.exe
  C:\Windows\System\RgMmmEv.exe
  2⤵
  PID:8936
- C:\Windows\System\kGtudcg.exe
  C:\Windows\System\kGtudcg.exe
  2⤵
  PID:8956
- C:\Windows\System\HWBBqaB.exe
  C:\Windows\System\HWBBqaB.exe
  2⤵
  PID:8976
- C:\Windows\System\ahPQhNn.exe
  C:\Windows\System\ahPQhNn.exe
  2⤵
  PID:8992
- C:\Windows\System\FkRqSjo.exe
  C:\Windows\System\FkRqSjo.exe
  2⤵
  PID:9008
- C:\Windows\System\hnlnplK.exe
  C:\Windows\System\hnlnplK.exe
  2⤵
  PID:9028
- C:\Windows\System\Cmluikx.exe
  C:\Windows\System\Cmluikx.exe
  2⤵
  PID:9044
- C:\Windows\System\YxnJXDx.exe
  C:\Windows\System\YxnJXDx.exe
  2⤵
  PID:9060
- C:\Windows\System\gzGZshx.exe
  C:\Windows\System\gzGZshx.exe
  2⤵
  PID:9080
- C:\Windows\System\HobTRlM.exe
  C:\Windows\System\HobTRlM.exe
  2⤵
  PID:9096
- C:\Windows\System\GClBkNY.exe
  C:\Windows\System\GClBkNY.exe
  2⤵
  PID:9112
- C:\Windows\System\ynbJRnF.exe
  C:\Windows\System\ynbJRnF.exe
  2⤵
  PID:9128
- C:\Windows\System\DWNfybf.exe
  C:\Windows\System\DWNfybf.exe
  2⤵
  PID:9144
- C:\Windows\System\aXlLAkK.exe
  C:\Windows\System\aXlLAkK.exe
  2⤵
  PID:9164
- C:\Windows\System\YRFFpHH.exe
  C:\Windows\System\YRFFpHH.exe
  2⤵
  PID:9180
- C:\Windows\System\ukTcjBy.exe
  C:\Windows\System\ukTcjBy.exe
  2⤵
  PID:9196
- C:\Windows\System\FOgTiyp.exe
  C:\Windows\System\FOgTiyp.exe
  2⤵
  PID:7524
- C:\Windows\System\UspwtTD.exe
  C:\Windows\System\UspwtTD.exe
  2⤵
  PID:7492
- C:\Windows\System\VECRQDK.exe
  C:\Windows\System\VECRQDK.exe
  2⤵
  PID:8196
- C:\Windows\System\sQGCyMc.exe
  C:\Windows\System\sQGCyMc.exe
  2⤵
  PID:8200
- C:\Windows\System\femKTVB.exe
  C:\Windows\System\femKTVB.exe
  2⤵
  PID:8324
- C:\Windows\System\yNwhvUv.exe
  C:\Windows\System\yNwhvUv.exe
  2⤵
  PID:8312
- C:\Windows\System\beiwHiA.exe
  C:\Windows\System\beiwHiA.exe
  2⤵
  PID:8392
- C:\Windows\System\uECEIIg.exe
  C:\Windows\System\uECEIIg.exe
  2⤵
  PID:8376
- C:\Windows\System\kHuXDih.exe
  C:\Windows\System\kHuXDih.exe
  2⤵
  PID:8412
- C:\Windows\System\WOzrMUT.exe
  C:\Windows\System\WOzrMUT.exe
  2⤵
  PID:8460
- C:\Windows\System\kZsbFjR.exe
  C:\Windows\System\kZsbFjR.exe
  2⤵
  PID:8476
- C:\Windows\System\kyqIgAi.exe
  C:\Windows\System\kyqIgAi.exe
  2⤵
  PID:8508
- C:\Windows\System\vjlGDwW.exe
  C:\Windows\System\vjlGDwW.exe
  2⤵
  PID:8524
- C:\Windows\System\kTbEJkp.exe
  C:\Windows\System\kTbEJkp.exe
  2⤵
  PID:8540
- C:\Windows\System\LnqtMHt.exe
  C:\Windows\System\LnqtMHt.exe
  2⤵
  PID:8556
- C:\Windows\System\iYbFQVi.exe
  C:\Windows\System\iYbFQVi.exe
  2⤵
  PID:8584
- C:\Windows\System\jfZodpN.exe
  C:\Windows\System\jfZodpN.exe
  2⤵
  PID:8628
- C:\Windows\System\FBbpAoX.exe
  C:\Windows\System\FBbpAoX.exe
  2⤵
  PID:8688
- C:\Windows\System\UrzIujw.exe
  C:\Windows\System\UrzIujw.exe
  2⤵
  PID:8728
- C:\Windows\System\nihvumz.exe
  C:\Windows\System\nihvumz.exe
  2⤵
  PID:8712
- C:\Windows\System\XAdjsIP.exe
  C:\Windows\System\XAdjsIP.exe
  2⤵
  PID:8744
- C:\Windows\System\FdQtfny.exe
  C:\Windows\System\FdQtfny.exe
  2⤵
  PID:8568
- C:\Windows\System\ypJAkBU.exe
  C:\Windows\System\ypJAkBU.exe
  2⤵
  PID:8776
- C:\Windows\System\BnOMGWs.exe
  C:\Windows\System\BnOMGWs.exe
  2⤵
  PID:8924
- C:\Windows\System\FytSFgz.exe
  C:\Windows\System\FytSFgz.exe
  2⤵
  PID:8856
- C:\Windows\System\HogDnjQ.exe
  C:\Windows\System\HogDnjQ.exe
  2⤵
  PID:8964
- C:\Windows\System\DVditXk.exe
  C:\Windows\System\DVditXk.exe
  2⤵
  PID:8844
- C:\Windows\System\wpgvPRJ.exe
  C:\Windows\System\wpgvPRJ.exe
  2⤵
  PID:9040
- C:\Windows\System\SEAqSKc.exe
  C:\Windows\System\SEAqSKc.exe
  2⤵
  PID:9056
- C:\Windows\System\xsovRxY.exe
  C:\Windows\System\xsovRxY.exe
  2⤵
  PID:9076
- C:\Windows\System\kjZTSoS.exe
  C:\Windows\System\kjZTSoS.exe
  2⤵
  PID:9172
- C:\Windows\System\pRaQPbH.exe
  C:\Windows\System\pRaQPbH.exe
  2⤵
  PID:9124
- C:\Windows\System\mCwsyHo.exe
  C:\Windows\System\mCwsyHo.exe
  2⤵
  PID:9188
- C:\Windows\System\xlQKfAV.exe
  C:\Windows\System\xlQKfAV.exe
  2⤵
  PID:9204
- C:\Windows\System\eiTtSYd.exe
  C:\Windows\System\eiTtSYd.exe
  2⤵
  PID:8244
- C:\Windows\System\qvKwjdv.exe
  C:\Windows\System\qvKwjdv.exe
  2⤵
  PID:8248
- C:\Windows\System\xDciDNJ.exe
  C:\Windows\System\xDciDNJ.exe
  2⤵
  PID:8340
- C:\Windows\System\fdMhKzN.exe
  C:\Windows\System\fdMhKzN.exe
  2⤵
  PID:8344
- C:\Windows\System\JdeLmVI.exe
  C:\Windows\System\JdeLmVI.exe
  2⤵
  PID:8504
- C:\Windows\System\HSCZgCp.exe
  C:\Windows\System\HSCZgCp.exe
  2⤵
  PID:8520
- C:\Windows\System\QCNUWsE.exe
  C:\Windows\System\QCNUWsE.exe
  2⤵
  PID:8656
- C:\Windows\System\DCuDuQt.exe
  C:\Windows\System\DCuDuQt.exe
  2⤵
  PID:8424
- C:\Windows\System\IbnOkCg.exe
  C:\Windows\System\IbnOkCg.exe
  2⤵
  PID:8548
- C:\Windows\System\RWvWcwi.exe
  C:\Windows\System\RWvWcwi.exe
  2⤵
  PID:8696
- C:\Windows\System\JuOlphi.exe
  C:\Windows\System\JuOlphi.exe
  2⤵
  PID:8748
- C:\Windows\System\LPVVQln.exe
  C:\Windows\System\LPVVQln.exe
  2⤵
  PID:8892
- C:\Windows\System\jJkjwyf.exe
  C:\Windows\System\jJkjwyf.exe
  2⤵
  PID:8828
- C:\Windows\System\LHoepfV.exe
  C:\Windows\System\LHoepfV.exe
  2⤵
  PID:8908
- C:\Windows\System\MlNEgMa.exe
  C:\Windows\System\MlNEgMa.exe
  2⤵
  PID:8952
- C:\Windows\System\VsPjFQr.exe
  C:\Windows\System\VsPjFQr.exe
  2⤵
  PID:8876
- C:\Windows\System\XeCmifG.exe
  C:\Windows\System\XeCmifG.exe
  2⤵
  PID:8988
- C:\Windows\System\mpgMboq.exe
  C:\Windows\System\mpgMboq.exe
  2⤵
  PID:9072
- C:\Windows\System\GVEwFzM.exe
  C:\Windows\System\GVEwFzM.exe
  2⤵
  PID:9176
- C:\Windows\System\kucdPNN.exe
  C:\Windows\System\kucdPNN.exe
  2⤵
  PID:8408
- C:\Windows\System\FIEvsuY.exe
  C:\Windows\System\FIEvsuY.exe
  2⤵
  PID:8708
- C:\Windows\System\FicRsPM.exe
  C:\Windows\System\FicRsPM.exe
  2⤵
  PID:8796
- C:\Windows\System\ZWcoDFj.exe
  C:\Windows\System\ZWcoDFj.exe
  2⤵
  PID:8984
- C:\Windows\System\zqnCvDH.exe
  C:\Windows\System\zqnCvDH.exe
  2⤵
  PID:8360
- C:\Windows\System\gKteOjK.exe
  C:\Windows\System\gKteOjK.exe
  2⤵
  PID:9136
- C:\Windows\System\FtjhyyI.exe
  C:\Windows\System\FtjhyyI.exe
  2⤵
  PID:9156
- C:\Windows\System\TULdjXE.exe
  C:\Windows\System\TULdjXE.exe
  2⤵
  PID:8296
- C:\Windows\System\fkwchNq.exe
  C:\Windows\System\fkwchNq.exe
  2⤵
  PID:8740
- C:\Windows\System\nTvQdzC.exe
  C:\Windows\System\nTvQdzC.exe
  2⤵
  PID:8948
- C:\Windows\System\trEuLjG.exe
  C:\Windows\System\trEuLjG.exe
  2⤵
  PID:8184
- C:\Windows\System\GQWgUnz.exe
  C:\Windows\System\GQWgUnz.exe
  2⤵
  PID:8280
- C:\Windows\System\oMYNbKD.exe
  C:\Windows\System\oMYNbKD.exe
  2⤵
  PID:8472
- C:\Windows\System\CuSJzGF.exe
  C:\Windows\System\CuSJzGF.exe
  2⤵
  PID:8968
- C:\Windows\System\DWJlWKv.exe
  C:\Windows\System\DWJlWKv.exe
  2⤵
  PID:9248
- C:\Windows\System\OCkDGhN.exe
  C:\Windows\System\OCkDGhN.exe
  2⤵
  PID:9264
- C:\Windows\System\aSLbJPQ.exe
  C:\Windows\System\aSLbJPQ.exe
  2⤵
  PID:9280
- C:\Windows\System\dqHkKCP.exe
  C:\Windows\System\dqHkKCP.exe
  2⤵
  PID:9296
- C:\Windows\System\zHiuxDY.exe
  C:\Windows\System\zHiuxDY.exe
  2⤵
  PID:9312
- C:\Windows\System\EJyiUJH.exe
  C:\Windows\System\EJyiUJH.exe
  2⤵
  PID:9328
- C:\Windows\System\BVscMgZ.exe
  C:\Windows\System\BVscMgZ.exe
  2⤵
  PID:9344
- C:\Windows\System\yxSCwqP.exe
  C:\Windows\System\yxSCwqP.exe
  2⤵
  PID:9360
- C:\Windows\System\jbcscvl.exe
  C:\Windows\System\jbcscvl.exe
  2⤵
  PID:9376
- C:\Windows\System\WZRNRcP.exe
  C:\Windows\System\WZRNRcP.exe
  2⤵
  PID:9392
- C:\Windows\System\GPBcZOO.exe
  C:\Windows\System\GPBcZOO.exe
  2⤵
  PID:9408
- C:\Windows\System\QuRfdRL.exe
  C:\Windows\System\QuRfdRL.exe
  2⤵
  PID:9424
- C:\Windows\System\PWVYcaA.exe
  C:\Windows\System\PWVYcaA.exe
  2⤵
  PID:9440
- C:\Windows\System\xEZtqbl.exe
  C:\Windows\System\xEZtqbl.exe
  2⤵
  PID:9456
- C:\Windows\System\XmGTykB.exe
  C:\Windows\System\XmGTykB.exe
  2⤵
  PID:9472
- C:\Windows\System\AdtdLyH.exe
  C:\Windows\System\AdtdLyH.exe
  2⤵
  PID:9488
- C:\Windows\System\vMAbWYU.exe
  C:\Windows\System\vMAbWYU.exe
  2⤵
  PID:9504
- C:\Windows\System\SFKrJVP.exe
  C:\Windows\System\SFKrJVP.exe
  2⤵
  PID:9520
- C:\Windows\System\drJRUTL.exe
  C:\Windows\System\drJRUTL.exe
  2⤵
  PID:9536
- C:\Windows\System\lNhKeOY.exe
  C:\Windows\System\lNhKeOY.exe
  2⤵
  PID:9552
- C:\Windows\System\tGfPlRQ.exe
  C:\Windows\System\tGfPlRQ.exe
  2⤵
  PID:9568
- C:\Windows\System\XPYNGof.exe
  C:\Windows\System\XPYNGof.exe
  2⤵
  PID:9640
- C:\Windows\System\uCbVCab.exe
  C:\Windows\System\uCbVCab.exe
  2⤵
  PID:9664
- C:\Windows\System\yQYFtFl.exe
  C:\Windows\System\yQYFtFl.exe
  2⤵
  PID:9680
- C:\Windows\System\djDmfGD.exe
  C:\Windows\System\djDmfGD.exe
  2⤵
  PID:9696
- C:\Windows\System\mPSQIDz.exe
  C:\Windows\System\mPSQIDz.exe
  2⤵
  PID:9716
- C:\Windows\System\DLDAqHd.exe
  C:\Windows\System\DLDAqHd.exe
  2⤵
  PID:9732
- C:\Windows\System\JlCtGah.exe
  C:\Windows\System\JlCtGah.exe
  2⤵
  PID:9752
- C:\Windows\System\uMBMmdi.exe
  C:\Windows\System\uMBMmdi.exe
  2⤵
  PID:9768
- C:\Windows\System\mQxrAOP.exe
  C:\Windows\System\mQxrAOP.exe
  2⤵
  PID:9784
- C:\Windows\System\uoJnsqH.exe
  C:\Windows\System\uoJnsqH.exe
  2⤵
  PID:9800
- C:\Windows\System\uaLgLxZ.exe
  C:\Windows\System\uaLgLxZ.exe
  2⤵
  PID:9816
- C:\Windows\System\JLCDlWs.exe
  C:\Windows\System\JLCDlWs.exe
  2⤵
  PID:9832
- C:\Windows\System\qmldNGr.exe
  C:\Windows\System\qmldNGr.exe
  2⤵
  PID:9848
- C:\Windows\System\ZGpsICF.exe
  C:\Windows\System\ZGpsICF.exe
  2⤵
  PID:9864
- C:\Windows\System\YvoUjhc.exe
  C:\Windows\System\YvoUjhc.exe
  2⤵
  PID:9880
- C:\Windows\System\ISOLSHy.exe
  C:\Windows\System\ISOLSHy.exe
  2⤵
  PID:9896
- C:\Windows\System\gSqzsqU.exe
  C:\Windows\System\gSqzsqU.exe
  2⤵
  PID:9912
- C:\Windows\System\wdBjWgD.exe
  C:\Windows\System\wdBjWgD.exe
  2⤵
  PID:9928
- C:\Windows\System\LHXXmGd.exe
  C:\Windows\System\LHXXmGd.exe
  2⤵
  PID:9944
- C:\Windows\System\nHAJkQi.exe
  C:\Windows\System\nHAJkQi.exe
  2⤵
  PID:9960
- C:\Windows\System\LMtQDnF.exe
  C:\Windows\System\LMtQDnF.exe
  2⤵
  PID:9976
- C:\Windows\System\psXRsly.exe
  C:\Windows\System\psXRsly.exe
  2⤵
  PID:9992
- C:\Windows\System\qkNsxtF.exe
  C:\Windows\System\qkNsxtF.exe
  2⤵
  PID:10012
- C:\Windows\System\SxzTsQT.exe
  C:\Windows\System\SxzTsQT.exe
  2⤵
  PID:10028
- C:\Windows\System\EeorJWe.exe
  C:\Windows\System\EeorJWe.exe
  2⤵
  PID:10044
- C:\Windows\System\cHzKxXr.exe
  C:\Windows\System\cHzKxXr.exe
  2⤵
  PID:10060
- C:\Windows\System\iKADcYG.exe
  C:\Windows\System\iKADcYG.exe
  2⤵
  PID:10076
- C:\Windows\System\WRjRJOi.exe
  C:\Windows\System\WRjRJOi.exe
  2⤵
  PID:10092
- C:\Windows\System\LCLZhdz.exe
  C:\Windows\System\LCLZhdz.exe
  2⤵
  PID:10108
- C:\Windows\System\VMHKjFR.exe
  C:\Windows\System\VMHKjFR.exe
  2⤵
  PID:10124
- C:\Windows\System\FytVAma.exe
  C:\Windows\System\FytVAma.exe
  2⤵
  PID:10140
- C:\Windows\System\Qelgwgc.exe
  C:\Windows\System\Qelgwgc.exe
  2⤵
  PID:10164
- C:\Windows\System\zyhhhAF.exe
  C:\Windows\System\zyhhhAF.exe
  2⤵
  PID:10180
- C:\Windows\System\NoMDZHq.exe
  C:\Windows\System\NoMDZHq.exe
  2⤵
  PID:10200
- C:\Windows\System\JsZKoqV.exe
  C:\Windows\System\JsZKoqV.exe
  2⤵
  PID:10216
- C:\Windows\System\NfUCGEz.exe
  C:\Windows\System\NfUCGEz.exe
  2⤵
  PID:10232
- C:\Windows\System\SECfxns.exe
  C:\Windows\System\SECfxns.exe
  2⤵
  PID:9120
- C:\Windows\System\QFvRztM.exe
  C:\Windows\System\QFvRztM.exe
  2⤵
  PID:9228
- C:\Windows\System\mhPCtaN.exe
  C:\Windows\System\mhPCtaN.exe
  2⤵
  PID:8944
- C:\Windows\System\AOpdJRk.exe
  C:\Windows\System\AOpdJRk.exe
  2⤵
  PID:8564
- C:\Windows\System\pnuayES.exe
  C:\Windows\System\pnuayES.exe
  2⤵
  PID:9224
- C:\Windows\System\GlWXZcb.exe
  C:\Windows\System\GlWXZcb.exe
  2⤵
  PID:9276
- C:\Windows\System\iTzhIam.exe
  C:\Windows\System\iTzhIam.exe
  2⤵
  PID:9308
- C:\Windows\System\bAJmKSa.exe
  C:\Windows\System\bAJmKSa.exe
  2⤵
  PID:9324
- C:\Windows\System\wpTkWGe.exe
  C:\Windows\System\wpTkWGe.exe
  2⤵
  PID:9372
- C:\Windows\System\hfiBFCr.exe
  C:\Windows\System\hfiBFCr.exe
  2⤵
  PID:9384
- C:\Windows\System\MqZqBtF.exe
  C:\Windows\System\MqZqBtF.exe
  2⤵
  PID:8356
- C:\Windows\System\vNCQDqO.exe
  C:\Windows\System\vNCQDqO.exe
  2⤵
  PID:9448
- C:\Windows\System\NHkOYft.exe
  C:\Windows\System\NHkOYft.exe
  2⤵
  PID:9516
- C:\Windows\System\JoaMHOH.exe
  C:\Windows\System\JoaMHOH.exe
  2⤵
  PID:9496
- C:\Windows\System\jEBIBKH.exe
  C:\Windows\System\jEBIBKH.exe
  2⤵
  PID:9560
- C:\Windows\System\IcMmfZV.exe
  C:\Windows\System\IcMmfZV.exe
  2⤵
  PID:9576
- C:\Windows\System\ARckssK.exe
  C:\Windows\System\ARckssK.exe
  2⤵
  PID:9588
- C:\Windows\System\nNXsiRG.exe
  C:\Windows\System\nNXsiRG.exe
  2⤵
  PID:9604
- C:\Windows\System\mulTxmd.exe
  C:\Windows\System\mulTxmd.exe
  2⤵
  PID:9652
- C:\Windows\System\Hjaeajx.exe
  C:\Windows\System\Hjaeajx.exe
  2⤵
  PID:9688
- C:\Windows\System\gBTzPfR.exe
  C:\Windows\System\gBTzPfR.exe
  2⤵
  PID:9760
- C:\Windows\System\GnmOnWX.exe
  C:\Windows\System\GnmOnWX.exe
  2⤵
  PID:9824
- C:\Windows\System\PpSdxFD.exe
  C:\Windows\System\PpSdxFD.exe
  2⤵
  PID:9888
- C:\Windows\System\croZZpq.exe
  C:\Windows\System\croZZpq.exe
  2⤵
  PID:9952
- C:\Windows\System\goTWMjx.exe
  C:\Windows\System\goTWMjx.exe
  2⤵
  PID:9624
- C:\Windows\System\YoiBWbv.exe
  C:\Windows\System\YoiBWbv.exe
  2⤵
  PID:10040
- C:\Windows\System\VKTFkeN.exe
  C:\Windows\System\VKTFkeN.exe
  2⤵
  PID:9628
- C:\Windows\System\wbBChFC.exe
  C:\Windows\System\wbBChFC.exe
  2⤵
  PID:9676
- C:\Windows\System\thSHGGj.exe
  C:\Windows\System\thSHGGj.exe
  2⤵
  PID:9740

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CdKuOdV.exe

Filesize
1.9MB

MD5
868a6683fedbcfa6b48ceab22be330bf

SHA1
662bf2224f432fd7d1b8855ec1dea75f5333514f

SHA256
6ad8a402ad07f5fcbf631a872b96959090a9b5199a5c99f4e73c883c55dfea75

SHA512
39cdc074d0a0eb0a5b7a695230674074e6e881f6ae63da94d0ef8f6420c3f3cc0eb882e8ea364770b4a0de528a57ccd3a8c2a5e2cc22b71441b06702f517af70

Download Submit
C:\Windows\system\GQtpkTP.exe

Filesize
1.9MB

MD5
103c56652b6d0708cb8d33e6218b430e

SHA1
884ad7e44883444bf2814020d00713ec578dafa8

SHA256
dc21c9c124dcacaaf1b8c43f46bcbc3ec0fb8c256e5dec84bc0b2c7c39d79839

SHA512
c0f17ac70149763d74f8e5fd117779b5346a883b030189481b69a33e6a8d3757f0282d1ae5ded1cb48deb7b7529bb13d76f04325c01d576b6a0aa77174db4329

Download Submit
C:\Windows\system\GjTAGTR.exe

Filesize
1.9MB

MD5
d95235908a42a203699b95bd60068275

SHA1
268cd08c43ba4bd59a6172d4aa9b97df71c5eb83

SHA256
c5024b184f4dbfb5b9f6ffd65a15473fe9e46b2a9201eea8bd70987c24e6d67a

SHA512
bdd6c62e8d7ef698980ad5be690f2a89087477034729850ed295ebeb7efd47cff4b0882ee3b3b00d69fd88a2dcb91c303817c82724bb20e570e03b3378a9a728

Download Submit
C:\Windows\system\IfkQySt.exe

Filesize
1.9MB

MD5
2bd95df5ed037c8edf90493a55fffdf3

SHA1
21def6d07a5785b28eed05530d2d18f5ccfe84d9

SHA256
504be9ce6461141915d9c6d15b17923dafaf3fca752831480c97fe34fd61add3

SHA512
b5816b1457665f0f2758878cf59c72dd22b7ece1f463d90ee41805c548bebea48ea7bf51512cec01328b3ef0556dbe0a91350b4ab57f2f41066890da072db8bb

Download Submit
C:\Windows\system\JpfoGsC.exe

Filesize
1.9MB

MD5
a652985339116ad263cd639ba175579b

SHA1
43039b01d7a44583c8317845a0281d431020c537

SHA256
7991beeac7daeea8949f9bf7115d969653bdc7fa199aeff0c6c686e98a265e3e

SHA512
626e407f9085498c85d97d10788b4ea1f094d81cdb71ff34b8845684e814aa344e8a103e44a9ffee220cf4bf5c66758cd2ebc850b4e89ddec433dce0279659d1

Download Submit
C:\Windows\system\KfogyFU.exe

Filesize
1.9MB

MD5
450f635afdd2b355c57481e632aad78e

SHA1
90d2f1e382c6dfc20577637d290b9f3d3f917b88

SHA256
59c3858c588f0bcee807a6ec9d7d078421b97c285e96a92fb2fb0e9166ef7122

SHA512
93e5068020e140f55ef32d0294acf560016a0e6876ad86acaf3832cf09b9f4d3fb2d99362f25068048a2e922f3e567989e7de2d5163c9943faa3ed861220bac6

Download Submit
C:\Windows\system\NAuAnvq.exe

Filesize
1.9MB

MD5
f2489d26d0f2df68f1f82ac72af93e4e

SHA1
28f63e0b1f25479daa84576e6643aa1dd2117624

SHA256
c945304db0b07a0cf2f398ded512d1e2ae6dcedfef1dc10a968ed13f1dbcd948

SHA512
00ede2069cb21d262397209d3461f0418f72ad1d4dba521d5cc874703825f792185f0b524b29652977a31ea589b607c45ca6c12f585cdcc7f0bced5ac7b1ca1b

Download Submit
C:\Windows\system\RJkNRPm.exe

Filesize
1.9MB

MD5
0e41c42fea0d33b4759eb9ebd07b83ab

SHA1
25c99bce6872f5e1f1129f81f00c0030045e702a

SHA256
9dbabb0980d44a40f0088c98943c4475af2ef0f663e31d08549758c6145979f2

SHA512
beacb436cee2a9fd61cbd77e197d71cb0c72a799d06b779c8161bc6d5f1a481ac49cd93927fc747b9eb205871b8efad974501fa222813c740276692a013e66cf

Download Submit
C:\Windows\system\UFgasXg.exe

Filesize
1.9MB

MD5
288a113e4aeed0072ff114963f35155e

SHA1
d845e2ed6af4da9c5fba9c8404eb86687c3d4791

SHA256
37598e509af0ef792380429d073775ddb739f96ecced65f4cebf4b75f9ffef5c

SHA512
a33c8637f6e7f7a87bdfa48cc20455975517b394be35a926fb9b78c6962862ef4d254d6cf6f68d052954037c9db5eff75377026003689310919d57e53be988f7

Download Submit
C:\Windows\system\YEDMqoV.exe

Filesize
1.9MB

MD5
6d35b4f2e2271d87fc70111eb4af55ab

SHA1
af2d4c73fb7a7f167051d2ac3df55ee352d29c2a

SHA256
8b39f67d733217057da80ae3713a579e59dfe1c571dd4e3f24a0d874cb4e66bc

SHA512
025863ee6243e0d29e81c6b1975f49408fd52c431f58357d0593f18c9238ef9089a89836162d16bc1e2d5a9cb9571bb2d1fd776f09eaeb4280bb07c267e4b0f9

Download Submit
C:\Windows\system\YaaUgjx.exe

Filesize
1.9MB

MD5
1fc9262baab85cc1f64289145ed1b1ff

SHA1
95cd7c5484f2fa41bbcfd8afd753d9bb764333ad

SHA256
68069cdb35625fe1293a072de60562af90a2aa70585e4147e7c4e007cdda3609

SHA512
3c1c46397e4b230711398420ce90ba09528936e3dc18d3d1dbaad9e8e881f8aff2a136285538efaff845c6367aebd822e659b5af3fb587df14b095c6c883a68b

Download Submit
C:\Windows\system\ZPOpilK.exe

Filesize
1.9MB

MD5
b84e9b17fd3b2a6173d34e3326397aaf

SHA1
8c98e875f3a409ac32d395b67e547427713a7e14

SHA256
e42d7f3d96d5e19e22bda50b0b6b694d78d6ded5aef153b277710a52896dac03

SHA512
35cbac652fac4127c55a23a03c4143746bddda3a25d0a74d809c9d465994d8faa81b85ec1b4afcaefe9442fe2355978e2210c59c2b043aecebf3fceb9c006070

Download Submit
C:\Windows\system\dQmByVu.exe

Filesize
1.9MB

MD5
47357d0928fafef6a4266aa16541e380

SHA1
b83cb7c11445c1060aaf36a9ec196f9b013c159e

SHA256
6711c927cddeb83f9a6e1b1d825a8b85742707c176fc55730e9e14f1d029b890

SHA512
639cefdbdc5b83dce70634616884ca3e6268bae5e05c9bb5a03bd218aed11b938cbaf2516235d468a4964a19f47accbd61b994c96aa807e352ef33b4f931cc76

Download Submit
C:\Windows\system\gIrBGxh.exe

Filesize
1.9MB

MD5
b00f38c83ac8ec588cef41b0a75db35e

SHA1
55cae158248a15b4f993d4b28784e3ef8e47bef8

SHA256
eabbdaf9902c408481da2e82b1170e43a38396bbfad66a270dc6eadd2be8db5a

SHA512
924b525277271dbedcacedcdc98fdb5d8f48852116483fbce94070c4f1119c2b703e9b34c5c7d57206598633c7189c5fd0bd4130478038e04028efe017d5a9d0

Download Submit
C:\Windows\system\gpCweld.exe

Filesize
1.9MB

MD5
3c0aed02c94d17f0adcf88d6e05c953a

SHA1
89db3ece28d0831d12fcfb9d07abb8cdef90c53d

SHA256
cfd78cfda49028cecb6cd3101435e10d4fdf81d6e3e197ed4064aa7f7fcb8b96

SHA512
04e341825e85984507848ccfbbd61153913a8fc845f0e5e2d013303f3305a18044af0337b4a1220f8e21efac62bdd0abe41fc711f6dc487d4cc257cd48e2d7a6

Download Submit
C:\Windows\system\heUUqwa.exe

Filesize
1.9MB

MD5
3413c31c6bfe51ac06de74e353376448

SHA1
14bae5d72dedd0f4d05352fe13ebfe66fa041b82

SHA256
a0e70bf955b1dbf033635ec3fae13c29839d8abdec24bce89551f82abe1a4470

SHA512
c83f42a8511925db1a73a89433fb54ba3c4e2fce4662d7f886b8e886bafea509f491c16bb3a7c4b42d213368c29556f64a5488336276e737e2b09c34c7267197

Download Submit
C:\Windows\system\hhPFsYa.exe

Filesize
1.9MB

MD5
646a22b434ada6d359925c0652ea8b44

SHA1
209bfd464d2e364aab0236ba13d1573e420f157b

SHA256
0bd1687ee3b14acd19aa01fc1b41c11358b725c89917d8e5b8e66afce048e98a

SHA512
de680353fdf19e50089c87f1e5b19e50b838a3d71326f41e715f7cbd3db067076d1a8c4286bf5a4b1d3dc22b4d7bfef4e99d4d5860c6602a781cdedce1419ac8

Download Submit
C:\Windows\system\iMbdxTw.exe

Filesize
1.9MB

MD5
487b1f8f61011a76a31a20dbbd47cfc6

SHA1
53dc076a7d754f60d742b791751d9544a1a500b1

SHA256
2d2f7f3ab824145590bc04b383cebba8f118dba47ef081cd41f4b9489c84b3a8

SHA512
fa3fefb45ff8260f4553f2aeee2b6d4af9b36b6b486b8f8f032086a93b67d7b99de50b59c350ebb5aab92bbd39094af353303fb6b3a0b7bc49901a3e4dc16bf7

Download Submit
C:\Windows\system\jZptELR.exe

Filesize
1.9MB

MD5
823f1d4cf4705850de61a0423f45bd3d

SHA1
914738266415af9a51eb305e27b6fb862306a6fd

SHA256
575728c1baf561aacc458a1ee3c0795470dd8c3d06a448c37b102ecd372497e2

SHA512
be442bff011db9e429d00c886980a5958d5daee8636b6a44b1790e9c9022ef461951900e9f4fabd730a5820decf88d1843b339f92ea8148fe7e9fa69bc92e449

Download Submit
C:\Windows\system\owZpVqM.exe

Filesize
1.9MB

MD5
ed90a5cc35edc649a3ac4b63be8be22d

SHA1
b10b1e34eb903618d7ab9313138e3ab80a8f2c81

SHA256
9598c84b9d605867866f2bb0de3e11e062f2a858d50ae09452be8186c19f3789

SHA512
c858e79d725eba0eac947d5b3a5fefad79631520f7cca147776e4eca4e7e7081f3ef7a657eb40c642f3e16bbb377abe9e9dd31630d0b88679f50eebe872fc475

Download Submit
C:\Windows\system\pPWRuTA.exe

Filesize
1.9MB

MD5
8c7d3575b6d438f09254a4ab092bbf93

SHA1
8c6c2c9bbc882545ddb0db64f24f1aaffe96cfdc

SHA256
a5cd08c34455e1e59e362195085a4efb0748d1dca3059773c8cec462c1137405

SHA512
4ddc91ab552dbafcca841b7fb7fc71ecbb269afc1bfce2daf22e4ae11da6de9ffe603a2645b689dc9d5bf7000bf2f549b5006a708dcd60257c1a43817ccf418f

Download Submit
C:\Windows\system\qWmOXGI.exe

Filesize
1.9MB

MD5
57d2300a25b62b4e187c81567018ec53

SHA1
a378ea73b891743f367c0c60a0085a0eceee08d4

SHA256
3d42cedbef116ef8a363d856e9865e4d43530b9443dc934051928c7808c027a0

SHA512
1fcc09df7dc7b86f024738cbeea8514fa2cfa7fb50317a60878f836aa21380f445178df107a7d48f925f28eea36da7faba0e031b2d36674851cf9568b066e76f

Download Submit
C:\Windows\system\uYdVIEn.exe

Filesize
1.9MB

MD5
5861ca3d0d588b2c7226c18cd1f06244

SHA1
800bba444d40c1b8e7be7940acd48eaf7e091360

SHA256
aa78e2670ca8c3c1a27304371c0311b01dd2468b861a3628deaf50d436a0c889

SHA512
ced8d6d34fd44021e513630dd8c668d6917ee4156c513461fdbafeb8be58cae5dc0a18d674f7673e6d0f337ae59d91ffc937c53d382f82522dc8a43859132dcd

Download Submit
C:\Windows\system\yXKdnoh.exe

Filesize
1.9MB

MD5
2c14165a9705e2ed7d44cb6568d1b16e

SHA1
61c34aa154d713d7254641e031b567569e81251c

SHA256
5b828cacd6a046acb8fa5f510d7c36f649245193f2e15667c4db2295b86e595b

SHA512
19a51e4e4a11b7a1644997d7c0d09c85ce4230216671044290c994dd6b3252697ac17afeff5977f2807e2bc1193882f1f63ac26645dc5f6a3a75d70a53e52ead

Download Submit
C:\Windows\system\zwEdUEd.exe

Filesize
1.9MB

MD5
b5fe5f7e43af4ee9b1587b6c5a0aab92

SHA1
5749ed5e5dfafa5bcfa0014109878dfe52eaf434

SHA256
08a7fdde9ebaea29029c2bd21685750d6aec0a40db81d0a21993c48cdeabc69c

SHA512
8006701b3d9690d9219f871b468b3fb705ff54c3cacbd2c86f86551ae4e68589e4792cd88c53d5b759d1bcc96bf512f24b71aac1869d5b949c27f8aaabb1650b

Download Submit
\Windows\system\AUTrNhI.exe

Filesize
1.9MB

MD5
d11ab983f431c7e67d72ecca2425512e

SHA1
a7ef43ff984fa8f5eeaf9638a5b5d70ddd28c425

SHA256
a0f69ccb13c2edd4f46a6b7edab261e3d5a0164688cf707d7f6a074897bb4448

SHA512
82d526ead89e6649e472808ceeda3bbfab1f2ca3f8c4aabb5cacdd34913c94d912d836d9e52f6ae8392c910bd18ab67b22997b3e2c2c2aec113b2b738f62229c

Download Submit
\Windows\system\BLsgnlE.exe

Filesize
1.9MB

MD5
847be44e6f0d57e17f6bcb93b6a04a08

SHA1
7e44f9429763d2249e270af6e1845faaffa1dd37

SHA256
5747195474901863baa5a8e581f2f4ee80dde8224b28cb87705ed9e249f27335

SHA512
ddfcb83866ceb303675957e9264987799a5830eff650bdba50f26a49b27fddf93ade11f0e92b508357c607dfb6fda5f8d3688850ed5865894edc1898f4f14869

Download Submit
\Windows\system\WoyOgsa.exe

Filesize
1.9MB

MD5
47b45aa7e086e0610941aac5f673c6e0

SHA1
efefb771a5f69fb4952c8fdb9129e3326e8ed16e

SHA256
38f7996a50f3152fd41ee05de0965c98353e894ed5961780c06ee51977c35237

SHA512
9ec152c3a5a5d9cb019a9d88cb73451836151cf7d3e765de6adefbbf3b4602031a8cc7dbb6fab4abddb3bf7903f55b7eb49e1bbb1693f2d5fa89cdda53f450b4

Download Submit
\Windows\system\YQkTgyc.exe

Filesize
1.9MB

MD5
54f4443b268fa74dd949ece73c63ab41

SHA1
1a7abe2f0b54de78ac61e952ca21a5ad6ac8c564

SHA256
ca75a15edb77b18dedf1ff01e74d4b8e2e1d787950a08c436a14df13d8f5652e

SHA512
1a88f52c0b4044a616a67b8986e792311ff36d0a8e3d9a741bed43e32868cc8e572a0a5cb8d5c4b2e4f19472681885b41b089bf088d0955401e2b914aa0a548a

Download Submit
\Windows\system\lYmLdUY.exe

Filesize
1.9MB

MD5
88d105e5db21c63f2ae5fdc12a9e2c71

SHA1
37134eea9877517c7a93821c6f180b457a71999d

SHA256
840a801d7a9e49b846c63ac99236ca4b258b1b5a168c596a92be090dce0965ec

SHA512
a41752f5c995af9a685101b9128b61a043e10979e1d31563876775724bafa24aa4e98be2e34e639da30b888c1a58b2ee2151fa5805feb50b69b50096c8a733a0

Download Submit
\Windows\system\tleghIe.exe

Filesize
1.9MB

MD5
db9b7005dc98ecbc9ef5c80f7718335f

SHA1
b9068addb5dbe97fcd9daa81fe3f6e449b5a1a29

SHA256
ce9b22d6f0600c3967d73ec26f0cdea891ae8870a2d9e680c392481ec444e861

SHA512
cf2b44d93c8cd3d676427ff33e1ac58b845cbfcddd05916848f3a66ea6472e9cf83e5915c85850afb5247d125d68d48d43552b0e1153ee4c113dc0d9b5ea645d

Download Submit
\Windows\system\yAAOxGx.exe

Filesize
1.9MB

MD5
f23e9e397af9404bbaf699a6cd76d31e

SHA1
382d92c20c068a7b524557881d398fa9edb584bb

SHA256
e2275b8dcbf7a99cd005f7618c1ebf58f2ccf7bfe919e7dea9e2d56171c1a5b4

SHA512
cfebde8c121f104971d714f3966d033a7082bb3105a61050e7adc4fe6486c44e6614e15523d5643cddbdf5fd1113126082d65fcd0e565ffd1d23d715c57238c1

Download Submit
memory/2104-95-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2188-46-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-45-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-96-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-7-0x0000000002C80000-0x0000000003072000-memory.dmp

Filesize
3.9MB

Download
memory/2188-94-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2188-0-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-106-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-101-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-100-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-81-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-50-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2188-36-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2188-99-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2188-97-0x0000000002BF0000-0x0000000002FE2000-memory.dmp

Filesize
3.9MB

Download
memory/2572-87-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2632-91-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2672-90-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-93-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-226-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

Filesize
2.9MB

Download
memory/2812-229-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/3024-98-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/3028-92-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download