xmrig | b8685b9188e596aef8bcde8edf8e73cbb15c8d2f5c46d14b3c90dc9e5f9ccd76

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
Size

1.9MB
MD5

0914ee9102023925991c53a9f0fe8a28
SHA1

659a574e9975a7a82d19146906935bee2a444f5c
SHA256

b8685b9188e596aef8bcde8edf8e73cbb15c8d2f5c46d14b3c90dc9e5f9ccd76
SHA512

5d7ac0cb75441c945088d5ed497bde467355c8e23cdbd71a5f59ce0fb8a751afcb2b788e20d411685cb7539f97525c893c501a9c523e3e71bb56e2f63c3def62
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U13:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2468-31-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2112-56-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig
behavioral1/memory/2644-64-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2664-67-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2492-65-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2488-342-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2756-84-0x000000013FC60000-0x0000000140052000-memory.dmp	xmrig
behavioral1/memory/2112-71-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2112-57-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2488-40-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2644	bjkaZXt.exe
2664	kllLdDk.exe
2468	hDdTsZo.exe
2488	lKQUFTZ.exe
2680	hKBiBPH.exe
2380	OTaDYTx.exe
2492	xWTuKDi.exe
1036	TwknPMk.exe
2756	lzOXApF.exe
2548	zMOlmQo.exe
2884	ndrsCCm.exe
2024	cTyOdze.exe
1988	ebPbVuG.exe
1060	EQmiqYv.exe
312	KZTvFdC.exe
1648	MmpVGYe.exe
1576	uYBdhfU.exe
2556	MhgaGkG.exe
2788	yIyumLO.exe
2128	CNUSyTq.exe
604	QZttSZc.exe
1496	LlJEtkw.exe
1868	zJfyWJT.exe
2428	QYcWHSQ.exe
2332	vYaIdut.exe
2152	TjsnOTw.exe
1340	ioRiYDG.exe
1936	aQlWKmG.exe
1932	nIbkbAw.exe
1944	OPSbtvu.exe
1164	UCiJIcO.exe
2116	yGUMkVl.exe
1528	OBKzyDQ.exe
2836	jCCWCUf.exe
1448	PVPGbGv.exe
872	wtzCvME.exe
2892	vblpjUO.exe
1248	FtTJYer.exe
2552	MAdlPrO.exe
2600	SoHMvnH.exe
2464	cDfjmlI.exe
860	QulWeBX.exe
2780	oVHDTTr.exe
1804	ZOUUpKA.exe
1596	UqTFfvA.exe
876	gjjsXYX.exe
2500	sRLMFey.exe
2608	proOugg.exe
1948	BOaievA.exe
1828	dILekrT.exe
320	aKfSuvR.exe
2220	bdeUQbj.exe
2228	BPOFHbS.exe
1692	ukqZCBI.exe
2108	RJSgvkf.exe
2440	ulBftkH.exe
2144	joTUKsi.exe
3000	IpNVQxR.exe
832	XJyLeYZ.exe
3028	YUYYGAU.exe
1796	cKaWSSn.exe
2052	mMPBihi.exe
2064	eaDvjxo.exe
3008	pmFTsFU.exe

Loads dropped DLL 64 IoCs

pid	Process
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-1-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x000d00000001231a-3.dat	upx
behavioral1/memory/2644-8-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/files/0x0033000000013a3d-9.dat	upx
behavioral1/files/0x000f000000013f21-20.dat	upx
behavioral1/memory/2664-19-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2468-31-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x001400000000549e-35.dat	upx
behavioral1/files/0x0008000000014183-45.dat	upx
behavioral1/memory/2680-47-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x00070000000141b5-55.dat	upx
behavioral1/memory/2112-56-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/memory/2380-62-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/2644-64-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2664-67-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x0007000000014216-66.dat	upx
behavioral1/memory/2492-65-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x0033000000013a7c-76.dat	upx
behavioral1/files/0x0006000000014c25-101.dat	upx
behavioral1/files/0x0006000000015b13-129.dat	upx
behavioral1/files/0x0006000000015bb9-136.dat	upx
behavioral1/files/0x0006000000015cca-171.dat	upx
behavioral1/files/0x0006000000015d06-185.dat	upx
behavioral1/files/0x0006000000015d6e-192.dat	upx
behavioral1/files/0x0006000000015cec-178.dat	upx
behavioral1/files/0x0006000000015cb9-164.dat	upx
behavioral1/files/0x0006000000015ca5-157.dat	upx
behavioral1/files/0x0006000000015c86-150.dat	upx
behavioral1/files/0x0008000000014983-87.dat	upx
behavioral1/files/0x0006000000015d5d-187.dat	upx
behavioral1/files/0x0006000000015cf7-180.dat	upx
behavioral1/memory/2488-342-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0006000000015cdb-173.dat	upx
behavioral1/files/0x0006000000015cc1-166.dat	upx
behavioral1/files/0x0006000000015cad-159.dat	upx
behavioral1/files/0x0006000000015c9c-152.dat	upx
behavioral1/files/0x0006000000015c7c-145.dat	upx
behavioral1/files/0x0006000000015c51-138.dat	upx
behavioral1/files/0x0006000000015b77-131.dat	upx
behavioral1/files/0x0006000000015642-124.dat	upx
behavioral1/files/0x00060000000153cf-117.dat	upx
behavioral1/files/0x0006000000015136-110.dat	upx
behavioral1/files/0x0006000000014e5a-103.dat	upx
behavioral1/files/0x0006000000014b12-96.dat	upx
behavioral1/files/0x0006000000015c6d-143.dat	upx
behavioral1/files/0x00060000000155e3-122.dat	upx
behavioral1/files/0x0006000000015362-115.dat	upx
behavioral1/files/0x0006000000015023-108.dat	upx
behavioral1/files/0x00060000000149ea-91.dat	upx
behavioral1/memory/2756-84-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/memory/1036-75-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/files/0x000700000001418d-59.dat	upx
behavioral1/memory/2488-40-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\udSNpxO.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\seQwrFZ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\DalRwFp.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\WkGkWWA.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\TisIlPe.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\WRCSJSb.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\VYsxALB.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ttXTJtI.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\fLWenoQ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\xzmhIJA.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\BOJHyYT.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\UpKfKiZ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\kFJxWbr.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\nmwLFgK.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ynRNeVp.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\MrgIGlZ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\hJkxrlZ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\XQfdHtw.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\KVJHLQj.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\VUnArYN.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\uYBdhfU.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\KSrPEps.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\SoQbcZg.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\hwXePBq.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\sBvefDR.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\CjfwwPj.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\HkLJCcc.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\wmEToQz.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\pnkiUcA.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ndrsCCm.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ZPxTWtC.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\btcQPys.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\RiVvBht.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\znwBCZG.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\aSLWzSx.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\LDoBFkE.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\sFIRunT.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\kAjqTAp.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\PEfjxXs.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\twzCwtL.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\FtTJYer.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\Gdfjrhs.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\MYVIcUN.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\wktDXWf.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\edGMwBN.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\myZnSSX.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ygVSFxB.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\dvGZWUd.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ZUACJJn.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\ddaQWUl.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\qFinOAN.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\RnYuLNF.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\YRuuMWW.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\IomAINI.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\PQFnUWQ.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\JUoGTNd.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\XnlyOKu.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\zckxLOM.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\LrAGJpv.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\NUGUOkp.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\EcqOgOI.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\WbNincu.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\aZjgilW.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
File created	C:\Windows\System\WZoVzbM.exe	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2192	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
Token: SeDebugPrivilege	2192	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2192	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	29
PID 2112 wrote to memory of 2192	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	29
PID 2112 wrote to memory of 2192	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	29
PID 2112 wrote to memory of 2644	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2644	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2644	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2664	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2664	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2664	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2468	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2468	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2468	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2488	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2488	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2488	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2680	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2680	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2680	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2492	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2492	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2492	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2380	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2380	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2380	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	36
PID 2112 wrote to memory of 1036	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	37
PID 2112 wrote to memory of 1036	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	37
PID 2112 wrote to memory of 1036	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2756	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2756	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2756	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2548	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2548	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2548	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2884	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2884	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2884	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	40
PID 2112 wrote to memory of 1948	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	41
PID 2112 wrote to memory of 1948	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	41
PID 2112 wrote to memory of 1948	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2024	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2024	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2024	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	42
PID 2112 wrote to memory of 1828	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1828	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1828	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	43
PID 2112 wrote to memory of 1988	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	44
PID 2112 wrote to memory of 1988	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	44
PID 2112 wrote to memory of 1988	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	44
PID 2112 wrote to memory of 320	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	45
PID 2112 wrote to memory of 320	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	45
PID 2112 wrote to memory of 320	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1060	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	46
PID 2112 wrote to memory of 1060	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	46
PID 2112 wrote to memory of 1060	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	46
PID 2112 wrote to memory of 2220	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	47
PID 2112 wrote to memory of 2220	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	47
PID 2112 wrote to memory of 2220	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	47
PID 2112 wrote to memory of 312	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	48
PID 2112 wrote to memory of 312	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	48
PID 2112 wrote to memory of 312	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	48
PID 2112 wrote to memory of 2228	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	49
PID 2112 wrote to memory of 2228	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	49
PID 2112 wrote to memory of 2228	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	49
PID 2112 wrote to memory of 1648	2112	0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0914ee9102023925991c53a9f0fe8a28_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2192
- C:\Windows\System\bjkaZXt.exe
  C:\Windows\System\bjkaZXt.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\kllLdDk.exe
  C:\Windows\System\kllLdDk.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\hDdTsZo.exe
  C:\Windows\System\hDdTsZo.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\lKQUFTZ.exe
  C:\Windows\System\lKQUFTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\hKBiBPH.exe
  C:\Windows\System\hKBiBPH.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\xWTuKDi.exe
  C:\Windows\System\xWTuKDi.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\OTaDYTx.exe
  C:\Windows\System\OTaDYTx.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\TwknPMk.exe
  C:\Windows\System\TwknPMk.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\lzOXApF.exe
  C:\Windows\System\lzOXApF.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\zMOlmQo.exe
  C:\Windows\System\zMOlmQo.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\ndrsCCm.exe
  C:\Windows\System\ndrsCCm.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\BOaievA.exe
  C:\Windows\System\BOaievA.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\cTyOdze.exe
  C:\Windows\System\cTyOdze.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\dILekrT.exe
  C:\Windows\System\dILekrT.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ebPbVuG.exe
  C:\Windows\System\ebPbVuG.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\aKfSuvR.exe
  C:\Windows\System\aKfSuvR.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\EQmiqYv.exe
  C:\Windows\System\EQmiqYv.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\bdeUQbj.exe
  C:\Windows\System\bdeUQbj.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\KZTvFdC.exe
  C:\Windows\System\KZTvFdC.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\BPOFHbS.exe
  C:\Windows\System\BPOFHbS.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\MmpVGYe.exe
  C:\Windows\System\MmpVGYe.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ukqZCBI.exe
  C:\Windows\System\ukqZCBI.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\uYBdhfU.exe
  C:\Windows\System\uYBdhfU.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\RJSgvkf.exe
  C:\Windows\System\RJSgvkf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\MhgaGkG.exe
  C:\Windows\System\MhgaGkG.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\ulBftkH.exe
  C:\Windows\System\ulBftkH.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\yIyumLO.exe
  C:\Windows\System\yIyumLO.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\joTUKsi.exe
  C:\Windows\System\joTUKsi.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\CNUSyTq.exe
  C:\Windows\System\CNUSyTq.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\IpNVQxR.exe
  C:\Windows\System\IpNVQxR.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\QZttSZc.exe
  C:\Windows\System\QZttSZc.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\XJyLeYZ.exe
  C:\Windows\System\XJyLeYZ.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\LlJEtkw.exe
  C:\Windows\System\LlJEtkw.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\YUYYGAU.exe
  C:\Windows\System\YUYYGAU.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\zJfyWJT.exe
  C:\Windows\System\zJfyWJT.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\cKaWSSn.exe
  C:\Windows\System\cKaWSSn.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\QYcWHSQ.exe
  C:\Windows\System\QYcWHSQ.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\mMPBihi.exe
  C:\Windows\System\mMPBihi.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\vYaIdut.exe
  C:\Windows\System\vYaIdut.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\eaDvjxo.exe
  C:\Windows\System\eaDvjxo.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\TjsnOTw.exe
  C:\Windows\System\TjsnOTw.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\pmFTsFU.exe
  C:\Windows\System\pmFTsFU.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\ioRiYDG.exe
  C:\Windows\System\ioRiYDG.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\sPLrcST.exe
  C:\Windows\System\sPLrcST.exe
  2⤵
  PID:1792
- C:\Windows\System\aQlWKmG.exe
  C:\Windows\System\aQlWKmG.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\HKIQyuz.exe
  C:\Windows\System\HKIQyuz.exe
  2⤵
  PID:1636
- C:\Windows\System\nIbkbAw.exe
  C:\Windows\System\nIbkbAw.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\wdrgrZe.exe
  C:\Windows\System\wdrgrZe.exe
  2⤵
  PID:1856
- C:\Windows\System\OPSbtvu.exe
  C:\Windows\System\OPSbtvu.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\OYtRyxq.exe
  C:\Windows\System\OYtRyxq.exe
  2⤵
  PID:276
- C:\Windows\System\UCiJIcO.exe
  C:\Windows\System\UCiJIcO.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\fYCKJEJ.exe
  C:\Windows\System\fYCKJEJ.exe
  2⤵
  PID:1264
- C:\Windows\System\yGUMkVl.exe
  C:\Windows\System\yGUMkVl.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\tXOnZEs.exe
  C:\Windows\System\tXOnZEs.exe
  2⤵
  PID:2544
- C:\Windows\System\OBKzyDQ.exe
  C:\Windows\System\OBKzyDQ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\MclcsXX.exe
  C:\Windows\System\MclcsXX.exe
  2⤵
  PID:360
- C:\Windows\System\jCCWCUf.exe
  C:\Windows\System\jCCWCUf.exe
  2⤵
  - Executes dropped EXE
  PID:2836
- C:\Windows\System\eFqyXTz.exe
  C:\Windows\System\eFqyXTz.exe
  2⤵
  PID:2880
- C:\Windows\System\PVPGbGv.exe
  C:\Windows\System\PVPGbGv.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\MnvAHpL.exe
  C:\Windows\System\MnvAHpL.exe
  2⤵
  PID:1752
- C:\Windows\System\wtzCvME.exe
  C:\Windows\System\wtzCvME.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\NWLsqwA.exe
  C:\Windows\System\NWLsqwA.exe
  2⤵
  PID:1256
- C:\Windows\System\vblpjUO.exe
  C:\Windows\System\vblpjUO.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\DalRwFp.exe
  C:\Windows\System\DalRwFp.exe
  2⤵
  PID:1612
- C:\Windows\System\FtTJYer.exe
  C:\Windows\System\FtTJYer.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\bigzKlH.exe
  C:\Windows\System\bigzKlH.exe
  2⤵
  PID:2196
- C:\Windows\System\MAdlPrO.exe
  C:\Windows\System\MAdlPrO.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\EQCirRW.exe
  C:\Windows\System\EQCirRW.exe
  2⤵
  PID:2832
- C:\Windows\System\SoHMvnH.exe
  C:\Windows\System\SoHMvnH.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\MSgmuXr.exe
  C:\Windows\System\MSgmuXr.exe
  2⤵
  PID:2708
- C:\Windows\System\cDfjmlI.exe
  C:\Windows\System\cDfjmlI.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\HVJfARx.exe
  C:\Windows\System\HVJfARx.exe
  2⤵
  PID:2712
- C:\Windows\System\QulWeBX.exe
  C:\Windows\System\QulWeBX.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\kFJxWbr.exe
  C:\Windows\System\kFJxWbr.exe
  2⤵
  PID:2532
- C:\Windows\System\oVHDTTr.exe
  C:\Windows\System\oVHDTTr.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\oOdNqcx.exe
  C:\Windows\System\oOdNqcx.exe
  2⤵
  PID:1820
- C:\Windows\System\ZOUUpKA.exe
  C:\Windows\System\ZOUUpKA.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\AHMqRXX.exe
  C:\Windows\System\AHMqRXX.exe
  2⤵
  PID:784
- C:\Windows\System\UqTFfvA.exe
  C:\Windows\System\UqTFfvA.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\yUNPkUY.exe
  C:\Windows\System\yUNPkUY.exe
  2⤵
  PID:2068
- C:\Windows\System\gjjsXYX.exe
  C:\Windows\System\gjjsXYX.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\TuiwFdB.exe
  C:\Windows\System\TuiwFdB.exe
  2⤵
  PID:2732
- C:\Windows\System\sRLMFey.exe
  C:\Windows\System\sRLMFey.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\NHuYNAy.exe
  C:\Windows\System\NHuYNAy.exe
  2⤵
  PID:2148
- C:\Windows\System\proOugg.exe
  C:\Windows\System\proOugg.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\sMLtuZK.exe
  C:\Windows\System\sMLtuZK.exe
  2⤵
  PID:3216
- C:\Windows\System\IFSVNXC.exe
  C:\Windows\System\IFSVNXC.exe
  2⤵
  PID:3256
- C:\Windows\System\qfoDISN.exe
  C:\Windows\System\qfoDISN.exe
  2⤵
  PID:3296
- C:\Windows\System\CaQnKuz.exe
  C:\Windows\System\CaQnKuz.exe
  2⤵
  PID:3328
- C:\Windows\System\KADQPly.exe
  C:\Windows\System\KADQPly.exe
  2⤵
  PID:3364
- C:\Windows\System\xjQuYrU.exe
  C:\Windows\System\xjQuYrU.exe
  2⤵
  PID:3380
- C:\Windows\System\eyWIYDJ.exe
  C:\Windows\System\eyWIYDJ.exe
  2⤵
  PID:3416
- C:\Windows\System\ICzvOvn.exe
  C:\Windows\System\ICzvOvn.exe
  2⤵
  PID:3440
- C:\Windows\System\zyqBOLr.exe
  C:\Windows\System\zyqBOLr.exe
  2⤵
  PID:3456
- C:\Windows\System\vMLXZmv.exe
  C:\Windows\System\vMLXZmv.exe
  2⤵
  PID:3476
- C:\Windows\System\fGokPuH.exe
  C:\Windows\System\fGokPuH.exe
  2⤵
  PID:3492
- C:\Windows\System\wiPgMMX.exe
  C:\Windows\System\wiPgMMX.exe
  2⤵
  PID:3524
- C:\Windows\System\DIPHUGd.exe
  C:\Windows\System\DIPHUGd.exe
  2⤵
  PID:3540
- C:\Windows\System\GvjjSAj.exe
  C:\Windows\System\GvjjSAj.exe
  2⤵
  PID:3556
- C:\Windows\System\VaMZcgx.exe
  C:\Windows\System\VaMZcgx.exe
  2⤵
  PID:3588
- C:\Windows\System\GYCQwFP.exe
  C:\Windows\System\GYCQwFP.exe
  2⤵
  PID:3604
- C:\Windows\System\ICsyZAf.exe
  C:\Windows\System\ICsyZAf.exe
  2⤵
  PID:3620
- C:\Windows\System\yoUfdKT.exe
  C:\Windows\System\yoUfdKT.exe
  2⤵
  PID:3636
- C:\Windows\System\SaEUeHn.exe
  C:\Windows\System\SaEUeHn.exe
  2⤵
  PID:3668
- C:\Windows\System\jONVWpd.exe
  C:\Windows\System\jONVWpd.exe
  2⤵
  PID:3688
- C:\Windows\System\INPjgXO.exe
  C:\Windows\System\INPjgXO.exe
  2⤵
  PID:3704
- C:\Windows\System\JaURtfT.exe
  C:\Windows\System\JaURtfT.exe
  2⤵
  PID:3724
- C:\Windows\System\pkAiWxG.exe
  C:\Windows\System\pkAiWxG.exe
  2⤵
  PID:3740
- C:\Windows\System\XQfdHtw.exe
  C:\Windows\System\XQfdHtw.exe
  2⤵
  PID:3756
- C:\Windows\System\kaIvxMV.exe
  C:\Windows\System\kaIvxMV.exe
  2⤵
  PID:3776
- C:\Windows\System\vSjnZVW.exe
  C:\Windows\System\vSjnZVW.exe
  2⤵
  PID:3792
- C:\Windows\System\ygVSFxB.exe
  C:\Windows\System\ygVSFxB.exe
  2⤵
  PID:3816
- C:\Windows\System\twjfubG.exe
  C:\Windows\System\twjfubG.exe
  2⤵
  PID:3844
- C:\Windows\System\XRRBcgy.exe
  C:\Windows\System\XRRBcgy.exe
  2⤵
  PID:3876
- C:\Windows\System\ayyLaPn.exe
  C:\Windows\System\ayyLaPn.exe
  2⤵
  PID:3892
- C:\Windows\System\ZPxTWtC.exe
  C:\Windows\System\ZPxTWtC.exe
  2⤵
  PID:3912
- C:\Windows\System\YqSxMpi.exe
  C:\Windows\System\YqSxMpi.exe
  2⤵
  PID:3928
- C:\Windows\System\aqzYeZS.exe
  C:\Windows\System\aqzYeZS.exe
  2⤵
  PID:3956
- C:\Windows\System\szIGIEU.exe
  C:\Windows\System\szIGIEU.exe
  2⤵
  PID:3972
- C:\Windows\System\hezaXCy.exe
  C:\Windows\System\hezaXCy.exe
  2⤵
  PID:3988
- C:\Windows\System\mbHNYoG.exe
  C:\Windows\System\mbHNYoG.exe
  2⤵
  PID:4012
- C:\Windows\System\YmLPIXf.exe
  C:\Windows\System\YmLPIXf.exe
  2⤵
  PID:4028
- C:\Windows\System\MNYuscg.exe
  C:\Windows\System\MNYuscg.exe
  2⤵
  PID:4052
- C:\Windows\System\btcQPys.exe
  C:\Windows\System\btcQPys.exe
  2⤵
  PID:4072
- C:\Windows\System\SFyCctn.exe
  C:\Windows\System\SFyCctn.exe
  2⤵
  PID:4088
- C:\Windows\System\NUGUOkp.exe
  C:\Windows\System\NUGUOkp.exe
  2⤵
  PID:2460
- C:\Windows\System\RFwASZt.exe
  C:\Windows\System\RFwASZt.exe
  2⤵
  PID:2224
- C:\Windows\System\pFTWgKC.exe
  C:\Windows\System\pFTWgKC.exe
  2⤵
  PID:1664
- C:\Windows\System\cZNSwVW.exe
  C:\Windows\System\cZNSwVW.exe
  2⤵
  PID:1040
- C:\Windows\System\TFwVZMJ.exe
  C:\Windows\System\TFwVZMJ.exe
  2⤵
  PID:2308
- C:\Windows\System\vhKPsGP.exe
  C:\Windows\System\vhKPsGP.exe
  2⤵
  PID:2156
- C:\Windows\System\gzwaiXc.exe
  C:\Windows\System\gzwaiXc.exe
  2⤵
  PID:1688
- C:\Windows\System\aSLWzSx.exe
  C:\Windows\System\aSLWzSx.exe
  2⤵
  PID:2388
- C:\Windows\System\uDNNtCs.exe
  C:\Windows\System\uDNNtCs.exe
  2⤵
  PID:1044
- C:\Windows\System\YUXhTqQ.exe
  C:\Windows\System\YUXhTqQ.exe
  2⤵
  PID:1668
- C:\Windows\System\YRrXgHq.exe
  C:\Windows\System\YRrXgHq.exe
  2⤵
  PID:2668
- C:\Windows\System\VHkkoyb.exe
  C:\Windows\System\VHkkoyb.exe
  2⤵
  PID:2888
- C:\Windows\System\pWCJlAx.exe
  C:\Windows\System\pWCJlAx.exe
  2⤵
  PID:2872
- C:\Windows\System\llQKHSI.exe
  C:\Windows\System\llQKHSI.exe
  2⤵
  PID:2960
- C:\Windows\System\SsoIGYj.exe
  C:\Windows\System\SsoIGYj.exe
  2⤵
  PID:1512
- C:\Windows\System\uxPaLaE.exe
  C:\Windows\System\uxPaLaE.exe
  2⤵
  PID:2824
- C:\Windows\System\WkGkWWA.exe
  C:\Windows\System\WkGkWWA.exe
  2⤵
  PID:2776
- C:\Windows\System\nuDuNcP.exe
  C:\Windows\System\nuDuNcP.exe
  2⤵
  PID:2140
- C:\Windows\System\LxBVBPW.exe
  C:\Windows\System\LxBVBPW.exe
  2⤵
  PID:1736
- C:\Windows\System\yLvmfwc.exe
  C:\Windows\System\yLvmfwc.exe
  2⤵
  PID:2720
- C:\Windows\System\gHTysOD.exe
  C:\Windows\System\gHTysOD.exe
  2⤵
  PID:2000
- C:\Windows\System\SRLojBp.exe
  C:\Windows\System\SRLojBp.exe
  2⤵
  PID:2516
- C:\Windows\System\ywsCWNf.exe
  C:\Windows\System\ywsCWNf.exe
  2⤵
  PID:2012
- C:\Windows\System\hFxIpPZ.exe
  C:\Windows\System\hFxIpPZ.exe
  2⤵
  PID:3016
- C:\Windows\System\gdWbTOZ.exe
  C:\Windows\System\gdWbTOZ.exe
  2⤵
  PID:2092
- C:\Windows\System\gcVMRKo.exe
  C:\Windows\System\gcVMRKo.exe
  2⤵
  PID:3224
- C:\Windows\System\kpffAet.exe
  C:\Windows\System\kpffAet.exe
  2⤵
  PID:3276
- C:\Windows\System\HMWRCUV.exe
  C:\Windows\System\HMWRCUV.exe
  2⤵
  PID:3288
- C:\Windows\System\dvGZWUd.exe
  C:\Windows\System\dvGZWUd.exe
  2⤵
  PID:1924
- C:\Windows\System\ssQKoMB.exe
  C:\Windows\System\ssQKoMB.exe
  2⤵
  PID:2736
- C:\Windows\System\bpIjLKh.exe
  C:\Windows\System\bpIjLKh.exe
  2⤵
  PID:3336
- C:\Windows\System\eCDSXlf.exe
  C:\Windows\System\eCDSXlf.exe
  2⤵
  PID:3340
- C:\Windows\System\AknUJsq.exe
  C:\Windows\System\AknUJsq.exe
  2⤵
  PID:3356
- C:\Windows\System\FJFEYAH.exe
  C:\Windows\System\FJFEYAH.exe
  2⤵
  PID:3320
- C:\Windows\System\jftxWdk.exe
  C:\Windows\System\jftxWdk.exe
  2⤵
  PID:3392
- C:\Windows\System\LEYDUfi.exe
  C:\Windows\System\LEYDUfi.exe
  2⤵
  PID:3408
- C:\Windows\System\yPgaRCJ.exe
  C:\Windows\System\yPgaRCJ.exe
  2⤵
  PID:2476
- C:\Windows\System\xkxbsRi.exe
  C:\Windows\System\xkxbsRi.exe
  2⤵
  PID:2656
- C:\Windows\System\JslTfhD.exe
  C:\Windows\System\JslTfhD.exe
  2⤵
  PID:2828
- C:\Windows\System\hfMHUWt.exe
  C:\Windows\System\hfMHUWt.exe
  2⤵
  PID:2604
- C:\Windows\System\pWIihsq.exe
  C:\Windows\System\pWIihsq.exe
  2⤵
  PID:3564
- C:\Windows\System\TnetZRS.exe
  C:\Windows\System\TnetZRS.exe
  2⤵
  PID:3568
- C:\Windows\System\zbDiXuJ.exe
  C:\Windows\System\zbDiXuJ.exe
  2⤵
  PID:3436
- C:\Windows\System\dkmbiHz.exe
  C:\Windows\System\dkmbiHz.exe
  2⤵
  PID:3512
- C:\Windows\System\kAynKOn.exe
  C:\Windows\System\kAynKOn.exe
  2⤵
  PID:3576
- C:\Windows\System\krngEoL.exe
  C:\Windows\System\krngEoL.exe
  2⤵
  PID:3584
- C:\Windows\System\TisIlPe.exe
  C:\Windows\System\TisIlPe.exe
  2⤵
  PID:3648
- C:\Windows\System\AzeeqyG.exe
  C:\Windows\System\AzeeqyG.exe
  2⤵
  PID:1976
- C:\Windows\System\GbGJzJl.exe
  C:\Windows\System\GbGJzJl.exe
  2⤵
  PID:3908
- C:\Windows\System\OFCxLJB.exe
  C:\Windows\System\OFCxLJB.exe
  2⤵
  PID:2376
- C:\Windows\System\QzTBJzC.exe
  C:\Windows\System\QzTBJzC.exe
  2⤵
  PID:3924
- C:\Windows\System\KfHtXLv.exe
  C:\Windows\System\KfHtXLv.exe
  2⤵
  PID:1956
- C:\Windows\System\vOfQUGG.exe
  C:\Windows\System\vOfQUGG.exe
  2⤵
  PID:3984
- C:\Windows\System\IKDGFbk.exe
  C:\Windows\System\IKDGFbk.exe
  2⤵
  PID:4020
- C:\Windows\System\STTyoCj.exe
  C:\Windows\System\STTyoCj.exe
  2⤵
  PID:4036
- C:\Windows\System\vJpHSuL.exe
  C:\Windows\System\vJpHSuL.exe
  2⤵
  PID:4040
- C:\Windows\System\Kuarugy.exe
  C:\Windows\System\Kuarugy.exe
  2⤵
  PID:2636
- C:\Windows\System\paFRKha.exe
  C:\Windows\System\paFRKha.exe
  2⤵
  PID:1940
- C:\Windows\System\KHXsfqU.exe
  C:\Windows\System\KHXsfqU.exe
  2⤵
  PID:1764
- C:\Windows\System\cyzXuAr.exe
  C:\Windows\System\cyzXuAr.exe
  2⤵
  PID:2996
- C:\Windows\System\RDQVSYZ.exe
  C:\Windows\System\RDQVSYZ.exe
  2⤵
  PID:596
- C:\Windows\System\lcmKsIN.exe
  C:\Windows\System\lcmKsIN.exe
  2⤵
  PID:1556
- C:\Windows\System\dFDmjqf.exe
  C:\Windows\System\dFDmjqf.exe
  2⤵
  PID:1772
- C:\Windows\System\MlvPbjg.exe
  C:\Windows\System\MlvPbjg.exe
  2⤵
  PID:2808
- C:\Windows\System\brdOnPr.exe
  C:\Windows\System\brdOnPr.exe
  2⤵
  PID:2392
- C:\Windows\System\CFdapOK.exe
  C:\Windows\System\CFdapOK.exe
  2⤵
  PID:1972
- C:\Windows\System\MkpDKwr.exe
  C:\Windows\System\MkpDKwr.exe
  2⤵
  PID:2180
- C:\Windows\System\OedSkMD.exe
  C:\Windows\System\OedSkMD.exe
  2⤵
  PID:796
- C:\Windows\System\aJljjcb.exe
  C:\Windows\System\aJljjcb.exe
  2⤵
  PID:412
- C:\Windows\System\fidvbEH.exe
  C:\Windows\System\fidvbEH.exe
  2⤵
  PID:2700
- C:\Windows\System\PodNYEf.exe
  C:\Windows\System\PodNYEf.exe
  2⤵
  PID:3548
- C:\Windows\System\mrEGJZa.exe
  C:\Windows\System\mrEGJZa.exe
  2⤵
  PID:2496
- C:\Windows\System\hhlihxf.exe
  C:\Windows\System\hhlihxf.exe
  2⤵
  PID:2660
- C:\Windows\System\nPCyJPO.exe
  C:\Windows\System\nPCyJPO.exe
  2⤵
  PID:1016
- C:\Windows\System\QmyburW.exe
  C:\Windows\System\QmyburW.exe
  2⤵
  PID:2744
- C:\Windows\System\DxahGBw.exe
  C:\Windows\System\DxahGBw.exe
  2⤵
  PID:2416
- C:\Windows\System\HHbCnOy.exe
  C:\Windows\System\HHbCnOy.exe
  2⤵
  PID:1780
- C:\Windows\System\qVWNBGr.exe
  C:\Windows\System\qVWNBGr.exe
  2⤵
  PID:3228
- C:\Windows\System\dbZVadu.exe
  C:\Windows\System\dbZVadu.exe
  2⤵
  PID:868
- C:\Windows\System\nMfFQPA.exe
  C:\Windows\System\nMfFQPA.exe
  2⤵
  PID:336
- C:\Windows\System\uHWFGpD.exe
  C:\Windows\System\uHWFGpD.exe
  2⤵
  PID:2256
- C:\Windows\System\MxJtbkT.exe
  C:\Windows\System\MxJtbkT.exe
  2⤵
  PID:3520
- C:\Windows\System\beOkUIv.exe
  C:\Windows\System\beOkUIv.exe
  2⤵
  PID:3644
- C:\Windows\System\eYfxoQB.exe
  C:\Windows\System\eYfxoQB.exe
  2⤵
  PID:1276
- C:\Windows\System\cvmEJoh.exe
  C:\Windows\System\cvmEJoh.exe
  2⤵
  PID:848
- C:\Windows\System\khRaweb.exe
  C:\Windows\System\khRaweb.exe
  2⤵
  PID:3656
- C:\Windows\System\dIifABO.exe
  C:\Windows\System\dIifABO.exe
  2⤵
  PID:3716
- C:\Windows\System\GWyHyPJ.exe
  C:\Windows\System\GWyHyPJ.exe
  2⤵
  PID:3676
- C:\Windows\System\aIpMTNl.exe
  C:\Windows\System\aIpMTNl.exe
  2⤵
  PID:3768
- C:\Windows\System\iJkBchY.exe
  C:\Windows\System\iJkBchY.exe
  2⤵
  PID:3784
- C:\Windows\System\hOLoxHd.exe
  C:\Windows\System\hOLoxHd.exe
  2⤵
  PID:3840
- C:\Windows\System\JvYPqmI.exe
  C:\Windows\System\JvYPqmI.exe
  2⤵
  PID:3720
- C:\Windows\System\hiFvQgj.exe
  C:\Windows\System\hiFvQgj.exe
  2⤵
  PID:3068
- C:\Windows\System\DNhGbGN.exe
  C:\Windows\System\DNhGbGN.exe
  2⤵
  PID:3952
- C:\Windows\System\yqFpVoO.exe
  C:\Windows\System\yqFpVoO.exe
  2⤵
  PID:3920
- C:\Windows\System\cyZVTEO.exe
  C:\Windows\System\cyZVTEO.exe
  2⤵
  PID:3936
- C:\Windows\System\zwHSkdn.exe
  C:\Windows\System\zwHSkdn.exe
  2⤵
  PID:1680
- C:\Windows\System\RITPfdR.exe
  C:\Windows\System\RITPfdR.exe
  2⤵
  PID:3980
- C:\Windows\System\zYGfweL.exe
  C:\Windows\System\zYGfweL.exe
  2⤵
  PID:4060
- C:\Windows\System\PgsVwls.exe
  C:\Windows\System\PgsVwls.exe
  2⤵
  PID:1644
- C:\Windows\System\mSebQLg.exe
  C:\Windows\System\mSebQLg.exe
  2⤵
  PID:2616
- C:\Windows\System\YUoJEbv.exe
  C:\Windows\System\YUoJEbv.exe
  2⤵
  PID:1564
- C:\Windows\System\HAavmfv.exe
  C:\Windows\System\HAavmfv.exe
  2⤵
  PID:1504
- C:\Windows\System\nmwLFgK.exe
  C:\Windows\System\nmwLFgK.exe
  2⤵
  PID:2968
- C:\Windows\System\jngpJCd.exe
  C:\Windows\System\jngpJCd.exe
  2⤵
  PID:1396
- C:\Windows\System\frvZRIC.exe
  C:\Windows\System\frvZRIC.exe
  2⤵
  PID:3304
- C:\Windows\System\nbqZyGr.exe
  C:\Windows\System\nbqZyGr.exe
  2⤵
  PID:2432
- C:\Windows\System\FndXTdv.exe
  C:\Windows\System\FndXTdv.exe
  2⤵
  PID:3472
- C:\Windows\System\byasyPo.exe
  C:\Windows\System\byasyPo.exe
  2⤵
  PID:3272
- C:\Windows\System\PNEgZDO.exe
  C:\Windows\System\PNEgZDO.exe
  2⤵
  PID:3504
- C:\Windows\System\XiLAnNU.exe
  C:\Windows\System\XiLAnNU.exe
  2⤵
  PID:2216
- C:\Windows\System\KSrPEps.exe
  C:\Windows\System\KSrPEps.exe
  2⤵
  PID:3812
- C:\Windows\System\HmIhyiG.exe
  C:\Windows\System\HmIhyiG.exe
  2⤵
  PID:3884
- C:\Windows\System\KasmRhW.exe
  C:\Windows\System\KasmRhW.exe
  2⤵
  PID:3964
- C:\Windows\System\ueOUXHn.exe
  C:\Windows\System\ueOUXHn.exe
  2⤵
  PID:2820
- C:\Windows\System\eLqOomi.exe
  C:\Windows\System\eLqOomi.exe
  2⤵
  PID:984
- C:\Windows\System\LiWtXFE.exe
  C:\Windows\System\LiWtXFE.exe
  2⤵
  PID:624
- C:\Windows\System\eZxqXgv.exe
  C:\Windows\System\eZxqXgv.exe
  2⤵
  PID:2236
- C:\Windows\System\gukUGOW.exe
  C:\Windows\System\gukUGOW.exe
  2⤵
  PID:4024
- C:\Windows\System\ZUACJJn.exe
  C:\Windows\System\ZUACJJn.exe
  2⤵
  PID:1620
- C:\Windows\System\DUMOPQa.exe
  C:\Windows\System\DUMOPQa.exe
  2⤵
  PID:2900
- C:\Windows\System\EcqOgOI.exe
  C:\Windows\System\EcqOgOI.exe
  2⤵
  PID:2004
- C:\Windows\System\gwIrFwF.exe
  C:\Windows\System\gwIrFwF.exe
  2⤵
  PID:4100
- C:\Windows\System\bnKAtHl.exe
  C:\Windows\System\bnKAtHl.exe
  2⤵
  PID:4116
- C:\Windows\System\brmTXIa.exe
  C:\Windows\System\brmTXIa.exe
  2⤵
  PID:4132
- C:\Windows\System\OLpPmqJ.exe
  C:\Windows\System\OLpPmqJ.exe
  2⤵
  PID:4148
- C:\Windows\System\pfuXkeT.exe
  C:\Windows\System\pfuXkeT.exe
  2⤵
  PID:4164
- C:\Windows\System\yUJMwTF.exe
  C:\Windows\System\yUJMwTF.exe
  2⤵
  PID:4184
- C:\Windows\System\EjmvIqy.exe
  C:\Windows\System\EjmvIqy.exe
  2⤵
  PID:4200
- C:\Windows\System\iOSWcDw.exe
  C:\Windows\System\iOSWcDw.exe
  2⤵
  PID:4216
- C:\Windows\System\WbNincu.exe
  C:\Windows\System\WbNincu.exe
  2⤵
  PID:4232
- C:\Windows\System\uRNdsuJ.exe
  C:\Windows\System\uRNdsuJ.exe
  2⤵
  PID:4248
- C:\Windows\System\lcPVHLn.exe
  C:\Windows\System\lcPVHLn.exe
  2⤵
  PID:4264
- C:\Windows\System\aiEqwfO.exe
  C:\Windows\System\aiEqwfO.exe
  2⤵
  PID:4280
- C:\Windows\System\EHVjjpv.exe
  C:\Windows\System\EHVjjpv.exe
  2⤵
  PID:4300
- C:\Windows\System\LAySiHj.exe
  C:\Windows\System\LAySiHj.exe
  2⤵
  PID:4316
- C:\Windows\System\PFhOkTj.exe
  C:\Windows\System\PFhOkTj.exe
  2⤵
  PID:4332
- C:\Windows\System\nwkGrnZ.exe
  C:\Windows\System\nwkGrnZ.exe
  2⤵
  PID:4348
- C:\Windows\System\ddaQWUl.exe
  C:\Windows\System\ddaQWUl.exe
  2⤵
  PID:4364
- C:\Windows\System\ApHwkxm.exe
  C:\Windows\System\ApHwkxm.exe
  2⤵
  PID:4380
- C:\Windows\System\lvCzyaO.exe
  C:\Windows\System\lvCzyaO.exe
  2⤵
  PID:4400
- C:\Windows\System\PgKFagG.exe
  C:\Windows\System\PgKFagG.exe
  2⤵
  PID:4416
- C:\Windows\System\ecCJnYq.exe
  C:\Windows\System\ecCJnYq.exe
  2⤵
  PID:4432
- C:\Windows\System\MXccOWq.exe
  C:\Windows\System\MXccOWq.exe
  2⤵
  PID:4448
- C:\Windows\System\zvFErUa.exe
  C:\Windows\System\zvFErUa.exe
  2⤵
  PID:4464
- C:\Windows\System\YgCHSAc.exe
  C:\Windows\System\YgCHSAc.exe
  2⤵
  PID:4480
- C:\Windows\System\vPIkRTz.exe
  C:\Windows\System\vPIkRTz.exe
  2⤵
  PID:4496
- C:\Windows\System\hwmkarQ.exe
  C:\Windows\System\hwmkarQ.exe
  2⤵
  PID:4516
- C:\Windows\System\xDpPQAx.exe
  C:\Windows\System\xDpPQAx.exe
  2⤵
  PID:4532
- C:\Windows\System\LosffZk.exe
  C:\Windows\System\LosffZk.exe
  2⤵
  PID:4548
- C:\Windows\System\LhvCKZh.exe
  C:\Windows\System\LhvCKZh.exe
  2⤵
  PID:4564
- C:\Windows\System\qfouFFw.exe
  C:\Windows\System\qfouFFw.exe
  2⤵
  PID:4580
- C:\Windows\System\bZDAUFu.exe
  C:\Windows\System\bZDAUFu.exe
  2⤵
  PID:4596
- C:\Windows\System\afOtIEl.exe
  C:\Windows\System\afOtIEl.exe
  2⤵
  PID:4616
- C:\Windows\System\vKxRsmA.exe
  C:\Windows\System\vKxRsmA.exe
  2⤵
  PID:4640
- C:\Windows\System\ZAJvWQI.exe
  C:\Windows\System\ZAJvWQI.exe
  2⤵
  PID:4656
- C:\Windows\System\JwimAXX.exe
  C:\Windows\System\JwimAXX.exe
  2⤵
  PID:4672
- C:\Windows\System\WuqMIPE.exe
  C:\Windows\System\WuqMIPE.exe
  2⤵
  PID:4688
- C:\Windows\System\jgSpIlw.exe
  C:\Windows\System\jgSpIlw.exe
  2⤵
  PID:4708
- C:\Windows\System\mRrwdER.exe
  C:\Windows\System\mRrwdER.exe
  2⤵
  PID:4724
- C:\Windows\System\VNqOPJE.exe
  C:\Windows\System\VNqOPJE.exe
  2⤵
  PID:4740
- C:\Windows\System\nAXBKmH.exe
  C:\Windows\System\nAXBKmH.exe
  2⤵
  PID:4756
- C:\Windows\System\MdcOrBm.exe
  C:\Windows\System\MdcOrBm.exe
  2⤵
  PID:4772
- C:\Windows\System\COIhovm.exe
  C:\Windows\System\COIhovm.exe
  2⤵
  PID:4788
- C:\Windows\System\RhFvsuK.exe
  C:\Windows\System\RhFvsuK.exe
  2⤵
  PID:4804
- C:\Windows\System\IMkvqXs.exe
  C:\Windows\System\IMkvqXs.exe
  2⤵
  PID:4824
- C:\Windows\System\bFhqxoY.exe
  C:\Windows\System\bFhqxoY.exe
  2⤵
  PID:4840
- C:\Windows\System\KBITMgi.exe
  C:\Windows\System\KBITMgi.exe
  2⤵
  PID:4856
- C:\Windows\System\smLqMla.exe
  C:\Windows\System\smLqMla.exe
  2⤵
  PID:4872
- C:\Windows\System\hYOYpuz.exe
  C:\Windows\System\hYOYpuz.exe
  2⤵
  PID:4888
- C:\Windows\System\MqjBrdD.exe
  C:\Windows\System\MqjBrdD.exe
  2⤵
  PID:4904
- C:\Windows\System\vroSTWP.exe
  C:\Windows\System\vroSTWP.exe
  2⤵
  PID:4920
- C:\Windows\System\zNjaxGY.exe
  C:\Windows\System\zNjaxGY.exe
  2⤵
  PID:4936
- C:\Windows\System\iNCMYsc.exe
  C:\Windows\System\iNCMYsc.exe
  2⤵
  PID:4956
- C:\Windows\System\yctLeDP.exe
  C:\Windows\System\yctLeDP.exe
  2⤵
  PID:4972
- C:\Windows\System\jcpMXxo.exe
  C:\Windows\System\jcpMXxo.exe
  2⤵
  PID:4988
- C:\Windows\System\GXRgpXY.exe
  C:\Windows\System\GXRgpXY.exe
  2⤵
  PID:5004
- C:\Windows\System\BQZZkkE.exe
  C:\Windows\System\BQZZkkE.exe
  2⤵
  PID:5020
- C:\Windows\System\hovwXUW.exe
  C:\Windows\System\hovwXUW.exe
  2⤵
  PID:5040
- C:\Windows\System\DOhKlNt.exe
  C:\Windows\System\DOhKlNt.exe
  2⤵
  PID:5056
- C:\Windows\System\Uaiinli.exe
  C:\Windows\System\Uaiinli.exe
  2⤵
  PID:5072
- C:\Windows\System\BMNKDna.exe
  C:\Windows\System\BMNKDna.exe
  2⤵
  PID:5088
- C:\Windows\System\tRBEIuq.exe
  C:\Windows\System\tRBEIuq.exe
  2⤵
  PID:5104
- C:\Windows\System\YWxOXqu.exe
  C:\Windows\System\YWxOXqu.exe
  2⤵
  PID:3904
- C:\Windows\System\qTCvzHI.exe
  C:\Windows\System\qTCvzHI.exe
  2⤵
  PID:2184
- C:\Windows\System\mHaNKSw.exe
  C:\Windows\System\mHaNKSw.exe
  2⤵
  PID:3940
- C:\Windows\System\qFinOAN.exe
  C:\Windows\System\qFinOAN.exe
  2⤵
  PID:1452
- C:\Windows\System\gVEbrHH.exe
  C:\Windows\System\gVEbrHH.exe
  2⤵
  PID:3372
- C:\Windows\System\NziuWpX.exe
  C:\Windows\System\NziuWpX.exe
  2⤵
  PID:3376
- C:\Windows\System\TqdhBtY.exe
  C:\Windows\System\TqdhBtY.exe
  2⤵
  PID:3696
- C:\Windows\System\nKEnFuY.exe
  C:\Windows\System\nKEnFuY.exe
  2⤵
  PID:3852
- C:\Windows\System\FInmLgR.exe
  C:\Windows\System\FInmLgR.exe
  2⤵
  PID:1132
- C:\Windows\System\iejKxkm.exe
  C:\Windows\System\iejKxkm.exe
  2⤵
  PID:2404
- C:\Windows\System\bdaBwkf.exe
  C:\Windows\System\bdaBwkf.exe
  2⤵
  PID:2956
- C:\Windows\System\YZCdteY.exe
  C:\Windows\System\YZCdteY.exe
  2⤵
  PID:4140
- C:\Windows\System\wmEToQz.exe
  C:\Windows\System\wmEToQz.exe
  2⤵
  PID:4412
- C:\Windows\System\pHbVdzL.exe
  C:\Windows\System\pHbVdzL.exe
  2⤵
  PID:4476
- C:\Windows\System\BChjbEp.exe
  C:\Windows\System\BChjbEp.exe
  2⤵
  PID:4636
- C:\Windows\System\Xngzuuh.exe
  C:\Windows\System\Xngzuuh.exe
  2⤵
  PID:4700
- C:\Windows\System\EUensKD.exe
  C:\Windows\System\EUensKD.exe
  2⤵
  PID:4528
- C:\Windows\System\bDntAes.exe
  C:\Windows\System\bDntAes.exe
  2⤵
  PID:4004
- C:\Windows\System\quSwVsV.exe
  C:\Windows\System\quSwVsV.exe
  2⤵
  PID:4124
- C:\Windows\System\Bpvqcnj.exe
  C:\Windows\System\Bpvqcnj.exe
  2⤵
  PID:4836
- C:\Windows\System\zyXmvgV.exe
  C:\Windows\System\zyXmvgV.exe
  2⤵
  PID:4900
- C:\Windows\System\XDuZnfp.exe
  C:\Windows\System\XDuZnfp.exe
  2⤵
  PID:4732
- C:\Windows\System\kOOmQcf.exe
  C:\Windows\System\kOOmQcf.exe
  2⤵
  PID:4196
- C:\Windows\System\aTSPkAP.exe
  C:\Windows\System\aTSPkAP.exe
  2⤵
  PID:4288
- C:\Windows\System\CtWUXnM.exe
  C:\Windows\System\CtWUXnM.exe
  2⤵
  PID:4324
- C:\Windows\System\nIsDQmH.exe
  C:\Windows\System\nIsDQmH.exe
  2⤵
  PID:4388
- C:\Windows\System\exfMIDy.exe
  C:\Windows\System\exfMIDy.exe
  2⤵
  PID:4456
- C:\Windows\System\MTvQwTS.exe
  C:\Windows\System\MTvQwTS.exe
  2⤵
  PID:4932
- C:\Windows\System\VlHVDeY.exe
  C:\Windows\System\VlHVDeY.exe
  2⤵
  PID:5000
- C:\Windows\System\JuKCapg.exe
  C:\Windows\System\JuKCapg.exe
  2⤵
  PID:5064
- C:\Windows\System\RnYuLNF.exe
  C:\Windows\System\RnYuLNF.exe
  2⤵
  PID:3284
- C:\Windows\System\afmQYlm.exe
  C:\Windows\System\afmQYlm.exe
  2⤵
  PID:1440
- C:\Windows\System\XXoqKIf.exe
  C:\Windows\System\XXoqKIf.exe
  2⤵
  PID:5052
- C:\Windows\System\tzQeFUZ.exe
  C:\Windows\System\tzQeFUZ.exe
  2⤵
  PID:5116
- C:\Windows\System\YDkgZyQ.exe
  C:\Windows\System\YDkgZyQ.exe
  2⤵
  PID:2132
- C:\Windows\System\sfPfqmG.exe
  C:\Windows\System\sfPfqmG.exe
  2⤵
  PID:4044
- C:\Windows\System\oTtpfFu.exe
  C:\Windows\System\oTtpfFu.exe
  2⤵
  PID:4544
- C:\Windows\System\waoVNmo.exe
  C:\Windows\System\waoVNmo.exe
  2⤵
  PID:4912
- C:\Windows\System\VzZKfFD.exe
  C:\Windows\System\VzZKfFD.exe
  2⤵
  PID:4340
- C:\Windows\System\qsxYXDk.exe
  C:\Windows\System\qsxYXDk.exe
  2⤵
  PID:4800
- C:\Windows\System\NQiotja.exe
  C:\Windows\System\NQiotja.exe
  2⤵
  PID:5048
- C:\Windows\System\MghBOOL.exe
  C:\Windows\System\MghBOOL.exe
  2⤵
  PID:4868
- C:\Windows\System\wdWhRKf.exe
  C:\Windows\System\wdWhRKf.exe
  2⤵
  PID:4356
- C:\Windows\System\UhvhpeI.exe
  C:\Windows\System\UhvhpeI.exe
  2⤵
  PID:4632
- C:\Windows\System\blSjFBx.exe
  C:\Windows\System\blSjFBx.exe
  2⤵
  PID:2328
- C:\Windows\System\pEZZHvn.exe
  C:\Windows\System\pEZZHvn.exe
  2⤵
  PID:4664
- C:\Windows\System\nwCCHJs.exe
  C:\Windows\System\nwCCHJs.exe
  2⤵
  PID:4576
- C:\Windows\System\ZskjQES.exe
  C:\Windows\System\ZskjQES.exe
  2⤵
  PID:4612
- C:\Windows\System\sDWIGqF.exe
  C:\Windows\System\sDWIGqF.exe
  2⤵
  PID:4780
- C:\Windows\System\rfFOUKj.exe
  C:\Windows\System\rfFOUKj.exe
  2⤵
  PID:4784
- C:\Windows\System\cHqBhwC.exe
  C:\Windows\System\cHqBhwC.exe
  2⤵
  PID:4848
- C:\Windows\System\NRRxOtT.exe
  C:\Windows\System\NRRxOtT.exe
  2⤵
  PID:4948
- C:\Windows\System\neCbMbl.exe
  C:\Windows\System\neCbMbl.exe
  2⤵
  PID:2344
- C:\Windows\System\jqyExOK.exe
  C:\Windows\System\jqyExOK.exe
  2⤵
  PID:344
- C:\Windows\System\iClxJXd.exe
  C:\Windows\System\iClxJXd.exe
  2⤵
  PID:2436
- C:\Windows\System\PTfEdIO.exe
  C:\Windows\System\PTfEdIO.exe
  2⤵
  PID:3232
- C:\Windows\System\ZiXLxiL.exe
  C:\Windows\System\ZiXLxiL.exe
  2⤵
  PID:4444
- C:\Windows\System\biJJMHD.exe
  C:\Windows\System\biJJMHD.exe
  2⤵
  PID:4240
- C:\Windows\System\WIpbKkP.exe
  C:\Windows\System\WIpbKkP.exe
  2⤵
  PID:4376
- C:\Windows\System\fiZAVvJ.exe
  C:\Windows\System\fiZAVvJ.exe
  2⤵
  PID:4588
- C:\Windows\System\rVKRCYi.exe
  C:\Windows\System\rVKRCYi.exe
  2⤵
  PID:4156
- C:\Windows\System\lVcItbH.exe
  C:\Windows\System\lVcItbH.exe
  2⤵
  PID:4492
- C:\Windows\System\PLlLZYo.exe
  C:\Windows\System\PLlLZYo.exe
  2⤵
  PID:4524
- C:\Windows\System\UrsMiRc.exe
  C:\Windows\System\UrsMiRc.exe
  2⤵
  PID:4764
- C:\Windows\System\nEoyAAs.exe
  C:\Windows\System\nEoyAAs.exe
  2⤵
  PID:3764
- C:\Windows\System\MUKqYej.exe
  C:\Windows\System\MUKqYej.exe
  2⤵
  PID:4592
- C:\Windows\System\hvkbMWp.exe
  C:\Windows\System\hvkbMWp.exe
  2⤵
  PID:4160
- C:\Windows\System\PFBnlxF.exe
  C:\Windows\System\PFBnlxF.exe
  2⤵
  PID:3616
- C:\Windows\System\UEOxuFz.exe
  C:\Windows\System\UEOxuFz.exe
  2⤵
  PID:2792
- C:\Windows\System\XzuCfYe.exe
  C:\Windows\System\XzuCfYe.exe
  2⤵
  PID:4604
- C:\Windows\System\JFbzDKO.exe
  C:\Windows\System\JFbzDKO.exe
  2⤵
  PID:4648
- C:\Windows\System\vrllxdC.exe
  C:\Windows\System\vrllxdC.exe
  2⤵
  PID:2576
- C:\Windows\System\jPfsIDE.exe
  C:\Windows\System\jPfsIDE.exe
  2⤵
  PID:4820
- C:\Windows\System\DFTVqeo.exe
  C:\Windows\System\DFTVqeo.exe
  2⤵
  PID:3872
- C:\Windows\System\KVJHLQj.exe
  C:\Windows\System\KVJHLQj.exe
  2⤵
  PID:4984
- C:\Windows\System\zXcwadC.exe
  C:\Windows\System\zXcwadC.exe
  2⤵
  PID:4172
- C:\Windows\System\UcifFGH.exe
  C:\Windows\System\UcifFGH.exe
  2⤵
  PID:4272
- C:\Windows\System\dZXUVMe.exe
  C:\Windows\System\dZXUVMe.exe
  2⤵
  PID:4312
- C:\Windows\System\BqXYtyX.exe
  C:\Windows\System\BqXYtyX.exe
  2⤵
  PID:4276
- C:\Windows\System\FJSmZSL.exe
  C:\Windows\System\FJSmZSL.exe
  2⤵
  PID:3204
- C:\Windows\System\YcaIpKJ.exe
  C:\Windows\System\YcaIpKJ.exe
  2⤵
  PID:4428
- C:\Windows\System\ligesHb.exe
  C:\Windows\System\ligesHb.exe
  2⤵
  PID:4996
- C:\Windows\System\DaCtkbW.exe
  C:\Windows\System\DaCtkbW.exe
  2⤵
  PID:5136
- C:\Windows\System\OQpFksM.exe
  C:\Windows\System\OQpFksM.exe
  2⤵
  PID:5152
- C:\Windows\System\clXjRrm.exe
  C:\Windows\System\clXjRrm.exe
  2⤵
  PID:5180
- C:\Windows\System\pyLcDmb.exe
  C:\Windows\System\pyLcDmb.exe
  2⤵
  PID:5240
- C:\Windows\System\SoQbcZg.exe
  C:\Windows\System\SoQbcZg.exe
  2⤵
  PID:5256
- C:\Windows\System\gjtExPN.exe
  C:\Windows\System\gjtExPN.exe
  2⤵
  PID:5272
- C:\Windows\System\rfRpdeR.exe
  C:\Windows\System\rfRpdeR.exe
  2⤵
  PID:5288
- C:\Windows\System\NwJvlcY.exe
  C:\Windows\System\NwJvlcY.exe
  2⤵
  PID:5304
- C:\Windows\System\qQnDqKV.exe
  C:\Windows\System\qQnDqKV.exe
  2⤵
  PID:5320
- C:\Windows\System\IXLldYQ.exe
  C:\Windows\System\IXLldYQ.exe
  2⤵
  PID:5336
- C:\Windows\System\gLMJsku.exe
  C:\Windows\System\gLMJsku.exe
  2⤵
  PID:5352
- C:\Windows\System\aqwKdob.exe
  C:\Windows\System\aqwKdob.exe
  2⤵
  PID:5368
- C:\Windows\System\IRVxiac.exe
  C:\Windows\System\IRVxiac.exe
  2⤵
  PID:5384
- C:\Windows\System\YjBMmow.exe
  C:\Windows\System\YjBMmow.exe
  2⤵
  PID:5400
- C:\Windows\System\YjNyhto.exe
  C:\Windows\System\YjNyhto.exe
  2⤵
  PID:5416
- C:\Windows\System\CawTuOU.exe
  C:\Windows\System\CawTuOU.exe
  2⤵
  PID:5432
- C:\Windows\System\MIYmpnP.exe
  C:\Windows\System\MIYmpnP.exe
  2⤵
  PID:5448
- C:\Windows\System\WDPqShH.exe
  C:\Windows\System\WDPqShH.exe
  2⤵
  PID:5464
- C:\Windows\System\JMsLUVw.exe
  C:\Windows\System\JMsLUVw.exe
  2⤵
  PID:5480
- C:\Windows\System\pnkFhMb.exe
  C:\Windows\System\pnkFhMb.exe
  2⤵
  PID:5496
- C:\Windows\System\hTFsEtM.exe
  C:\Windows\System\hTFsEtM.exe
  2⤵
  PID:5512
- C:\Windows\System\zCAmJgF.exe
  C:\Windows\System\zCAmJgF.exe
  2⤵
  PID:5604
- C:\Windows\System\QbPdjTL.exe
  C:\Windows\System\QbPdjTL.exe
  2⤵
  PID:5628
- C:\Windows\System\WRCSJSb.exe
  C:\Windows\System\WRCSJSb.exe
  2⤵
  PID:5652
- C:\Windows\System\ONNopGz.exe
  C:\Windows\System\ONNopGz.exe
  2⤵
  PID:5668
- C:\Windows\System\RIgpVcZ.exe
  C:\Windows\System\RIgpVcZ.exe
  2⤵
  PID:5684
- C:\Windows\System\PWARxyO.exe
  C:\Windows\System\PWARxyO.exe
  2⤵
  PID:5852
- C:\Windows\System\tGmjISr.exe
  C:\Windows\System\tGmjISr.exe
  2⤵
  PID:5868
- C:\Windows\System\LDoBFkE.exe
  C:\Windows\System\LDoBFkE.exe
  2⤵
  PID:5884
- C:\Windows\System\OJezTYV.exe
  C:\Windows\System\OJezTYV.exe
  2⤵
  PID:5900
- C:\Windows\System\rxhCCtf.exe
  C:\Windows\System\rxhCCtf.exe
  2⤵
  PID:5916
- C:\Windows\System\kNmhAAS.exe
  C:\Windows\System\kNmhAAS.exe
  2⤵
  PID:5932
- C:\Windows\System\ysUuBiZ.exe
  C:\Windows\System\ysUuBiZ.exe
  2⤵
  PID:5948
- C:\Windows\System\SYEubSy.exe
  C:\Windows\System\SYEubSy.exe
  2⤵
  PID:5964
- C:\Windows\System\pGSnYzk.exe
  C:\Windows\System\pGSnYzk.exe
  2⤵
  PID:5980
- C:\Windows\System\rQlboMg.exe
  C:\Windows\System\rQlboMg.exe
  2⤵
  PID:5996
- C:\Windows\System\VyeThfF.exe
  C:\Windows\System\VyeThfF.exe
  2⤵
  PID:6012
- C:\Windows\System\CorFkVr.exe
  C:\Windows\System\CorFkVr.exe
  2⤵
  PID:6028
- C:\Windows\System\yfXSgiW.exe
  C:\Windows\System\yfXSgiW.exe
  2⤵
  PID:6044
- C:\Windows\System\iSsZkDT.exe
  C:\Windows\System\iSsZkDT.exe
  2⤵
  PID:6064
- C:\Windows\System\hqMwhuH.exe
  C:\Windows\System\hqMwhuH.exe
  2⤵
  PID:6128
- C:\Windows\System\OUXdNXH.exe
  C:\Windows\System\OUXdNXH.exe
  2⤵
  PID:5084
- C:\Windows\System\pnGqYOM.exe
  C:\Windows\System\pnGqYOM.exe
  2⤵
  PID:5032
- C:\Windows\System\xcquyLD.exe
  C:\Windows\System\xcquyLD.exe
  2⤵
  PID:5164
- C:\Windows\System\epnZdfd.exe
  C:\Windows\System\epnZdfd.exe
  2⤵
  PID:4540
- C:\Windows\System\kSHtAsW.exe
  C:\Windows\System\kSHtAsW.exe
  2⤵
  PID:4748
- C:\Windows\System\meDjKsx.exe
  C:\Windows\System\meDjKsx.exe
  2⤵
  PID:2444
- C:\Windows\System\XaaYdxz.exe
  C:\Windows\System\XaaYdxz.exe
  2⤵
  PID:4472
- C:\Windows\System\WhOMHeC.exe
  C:\Windows\System\WhOMHeC.exe
  2⤵
  PID:5160
- C:\Windows\System\BcZoWIf.exe
  C:\Windows\System\BcZoWIf.exe
  2⤵
  PID:4084
- C:\Windows\System\myvaQgh.exe
  C:\Windows\System\myvaQgh.exe
  2⤵
  PID:2588
- C:\Windows\System\xeUCeYp.exe
  C:\Windows\System\xeUCeYp.exe
  2⤵
  PID:5132
- C:\Windows\System\uHhyHcz.exe
  C:\Windows\System\uHhyHcz.exe
  2⤵
  PID:5196
- C:\Windows\System\ShlWesd.exe
  C:\Windows\System\ShlWesd.exe
  2⤵
  PID:5208
- C:\Windows\System\qdlDDIj.exe
  C:\Windows\System\qdlDDIj.exe
  2⤵
  PID:5228
- C:\Windows\System\xvWhHEa.exe
  C:\Windows\System\xvWhHEa.exe
  2⤵
  PID:5284
- C:\Windows\System\rgjjjgQ.exe
  C:\Windows\System\rgjjjgQ.exe
  2⤵
  PID:5360
- C:\Windows\System\tMXoFOr.exe
  C:\Windows\System\tMXoFOr.exe
  2⤵
  PID:5364
- C:\Windows\System\qUwVBrE.exe
  C:\Windows\System\qUwVBrE.exe
  2⤵
  PID:5428
- C:\Windows\System\lDVlrXn.exe
  C:\Windows\System\lDVlrXn.exe
  2⤵
  PID:5488
- C:\Windows\System\FZOhQSb.exe
  C:\Windows\System\FZOhQSb.exe
  2⤵
  PID:5344
- C:\Windows\System\YsnnYej.exe
  C:\Windows\System\YsnnYej.exe
  2⤵
  PID:2188
- C:\Windows\System\VEQGoAT.exe
  C:\Windows\System\VEQGoAT.exe
  2⤵
  PID:5248
- C:\Windows\System\ZDxCwJC.exe
  C:\Windows\System\ZDxCwJC.exe
  2⤵
  PID:5440
- C:\Windows\System\WoaIaPg.exe
  C:\Windows\System\WoaIaPg.exe
  2⤵
  PID:5508
- C:\Windows\System\rbBoDLE.exe
  C:\Windows\System\rbBoDLE.exe
  2⤵
  PID:5544
- C:\Windows\System\IipacVr.exe
  C:\Windows\System\IipacVr.exe
  2⤵
  PID:5556
- C:\Windows\System\HyFXsbJ.exe
  C:\Windows\System\HyFXsbJ.exe
  2⤵
  PID:5572
- C:\Windows\System\jKfBvIU.exe
  C:\Windows\System\jKfBvIU.exe
  2⤵
  PID:5584
- C:\Windows\System\klvnuKN.exe
  C:\Windows\System\klvnuKN.exe
  2⤵
  PID:5624
- C:\Windows\System\JAWuyqZ.exe
  C:\Windows\System\JAWuyqZ.exe
  2⤵
  PID:5648
- C:\Windows\System\WRWDXCT.exe
  C:\Windows\System\WRWDXCT.exe
  2⤵
  PID:5664
- C:\Windows\System\MVuRltG.exe
  C:\Windows\System\MVuRltG.exe
  2⤵
  PID:5676
- C:\Windows\System\VetuJYe.exe
  C:\Windows\System\VetuJYe.exe
  2⤵
  PID:5704
- C:\Windows\System\lLALmuY.exe
  C:\Windows\System\lLALmuY.exe
  2⤵
  PID:5760
- C:\Windows\System\LFTDbZA.exe
  C:\Windows\System\LFTDbZA.exe
  2⤵
  PID:5724
- C:\Windows\System\vjrlvqn.exe
  C:\Windows\System\vjrlvqn.exe
  2⤵
  PID:5772
- C:\Windows\System\kBMzAjD.exe
  C:\Windows\System\kBMzAjD.exe
  2⤵
  PID:5824
- C:\Windows\System\lWeLOgB.exe
  C:\Windows\System\lWeLOgB.exe
  2⤵
  PID:5808
- C:\Windows\System\JUoGTNd.exe
  C:\Windows\System\JUoGTNd.exe
  2⤵
  PID:5796
- C:\Windows\System\DbwCBRL.exe
  C:\Windows\System\DbwCBRL.exe
  2⤵
  PID:5820
- C:\Windows\System\kisJUsb.exe
  C:\Windows\System\kisJUsb.exe
  2⤵
  PID:5836
- C:\Windows\System\fKObIJg.exe
  C:\Windows\System\fKObIJg.exe
  2⤵
  PID:5880
- C:\Windows\System\VYsxALB.exe
  C:\Windows\System\VYsxALB.exe
  2⤵
  PID:5960
- C:\Windows\System\IruXHqh.exe
  C:\Windows\System\IruXHqh.exe
  2⤵
  PID:5864
- C:\Windows\System\nNWGoIC.exe
  C:\Windows\System\nNWGoIC.exe
  2⤵
  PID:6080
- C:\Windows\System\ytFWcsv.exe
  C:\Windows\System\ytFWcsv.exe
  2⤵
  PID:6084
- C:\Windows\System\drqGpxk.exe
  C:\Windows\System\drqGpxk.exe
  2⤵
  PID:6096
- C:\Windows\System\XmealBF.exe
  C:\Windows\System\XmealBF.exe
  2⤵
  PID:6104
- C:\Windows\System\VcWKPMC.exe
  C:\Windows\System\VcWKPMC.exe
  2⤵
  PID:6120
- C:\Windows\System\EkpFBbH.exe
  C:\Windows\System\EkpFBbH.exe
  2⤵
  PID:6060
- C:\Windows\System\hUwyHmv.exe
  C:\Windows\System\hUwyHmv.exe
  2⤵
  PID:4256
- C:\Windows\System\DKQdmYi.exe
  C:\Windows\System\DKQdmYi.exe
  2⤵
  PID:4768
- C:\Windows\System\UbLyugp.exe
  C:\Windows\System\UbLyugp.exe
  2⤵
  PID:5168
- C:\Windows\System\umxAjqJ.exe
  C:\Windows\System\umxAjqJ.exe
  2⤵
  PID:5096
- C:\Windows\System\gxCqUBa.exe
  C:\Windows\System\gxCqUBa.exe
  2⤵
  PID:4684
- C:\Windows\System\uCRwqHy.exe
  C:\Windows\System\uCRwqHy.exe
  2⤵
  PID:5224
- C:\Windows\System\DfQXjhs.exe
  C:\Windows\System\DfQXjhs.exe
  2⤵
  PID:5128
- C:\Windows\System\xzWpJcY.exe
  C:\Windows\System\xzWpJcY.exe
  2⤵
  PID:5280
- C:\Windows\System\jlKDILR.exe
  C:\Windows\System\jlKDILR.exe
  2⤵
  PID:5392
- C:\Windows\System\luXFuQB.exe
  C:\Windows\System\luXFuQB.exe
  2⤵
  PID:5524
- C:\Windows\System\WXfPnRx.exe
  C:\Windows\System\WXfPnRx.exe
  2⤵
  PID:5504
- C:\Windows\System\sFIRunT.exe
  C:\Windows\System\sFIRunT.exe
  2⤵
  PID:5588
- C:\Windows\System\fUaQriY.exe
  C:\Windows\System\fUaQriY.exe
  2⤵
  PID:5700
- C:\Windows\System\Gdfjrhs.exe
  C:\Windows\System\Gdfjrhs.exe
  2⤵
  PID:5736
- C:\Windows\System\NNDLEyE.exe
  C:\Windows\System\NNDLEyE.exe
  2⤵
  PID:5768
- C:\Windows\System\wmCFVAT.exe
  C:\Windows\System\wmCFVAT.exe
  2⤵
  PID:5296
- C:\Windows\System\STSJJJa.exe
  C:\Windows\System\STSJJJa.exe
  2⤵
  PID:5536
- C:\Windows\System\hHuXnDF.exe
  C:\Windows\System\hHuXnDF.exe
  2⤵
  PID:5640
- C:\Windows\System\buoyiTt.exe
  C:\Windows\System\buoyiTt.exe
  2⤵
  PID:5776
- C:\Windows\System\tIjImBx.exe
  C:\Windows\System\tIjImBx.exe
  2⤵
  PID:5784
- C:\Windows\System\ZbtRiTR.exe
  C:\Windows\System\ZbtRiTR.exe
  2⤵
  PID:5804
- C:\Windows\System\ixrPFth.exe
  C:\Windows\System\ixrPFth.exe
  2⤵
  PID:5972
- C:\Windows\System\vsrlVRd.exe
  C:\Windows\System\vsrlVRd.exe
  2⤵
  PID:6092
- C:\Windows\System\KUytLeX.exe
  C:\Windows\System\KUytLeX.exe
  2⤵
  PID:5924
- C:\Windows\System\vpHrHer.exe
  C:\Windows\System\vpHrHer.exe
  2⤵
  PID:5144
- C:\Windows\System\YMBttZz.exe
  C:\Windows\System\YMBttZz.exe
  2⤵
  PID:5220
- C:\Windows\System\ChtdDaB.exe
  C:\Windows\System\ChtdDaB.exe
  2⤵
  PID:6148
- C:\Windows\System\VDbTMGc.exe
  C:\Windows\System\VDbTMGc.exe
  2⤵
  PID:6164
- C:\Windows\System\eGwJVRC.exe
  C:\Windows\System\eGwJVRC.exe
  2⤵
  PID:6180
- C:\Windows\System\XXwaLXn.exe
  C:\Windows\System\XXwaLXn.exe
  2⤵
  PID:6196
- C:\Windows\System\YSHBGBz.exe
  C:\Windows\System\YSHBGBz.exe
  2⤵
  PID:6212
- C:\Windows\System\DNIPKjO.exe
  C:\Windows\System\DNIPKjO.exe
  2⤵
  PID:6228
- C:\Windows\System\NMkqDkE.exe
  C:\Windows\System\NMkqDkE.exe
  2⤵
  PID:6248
- C:\Windows\System\dgyECjf.exe
  C:\Windows\System\dgyECjf.exe
  2⤵
  PID:6264
- C:\Windows\System\qpkTMSj.exe
  C:\Windows\System\qpkTMSj.exe
  2⤵
  PID:6280
- C:\Windows\System\mzeMZwA.exe
  C:\Windows\System\mzeMZwA.exe
  2⤵
  PID:6300
- C:\Windows\System\AysogGf.exe
  C:\Windows\System\AysogGf.exe
  2⤵
  PID:6316
- C:\Windows\System\zrdGMyP.exe
  C:\Windows\System\zrdGMyP.exe
  2⤵
  PID:6332
- C:\Windows\System\MNJrnbs.exe
  C:\Windows\System\MNJrnbs.exe
  2⤵
  PID:6348
- C:\Windows\System\tMDYTPS.exe
  C:\Windows\System\tMDYTPS.exe
  2⤵
  PID:6364
- C:\Windows\System\JwQDAxa.exe
  C:\Windows\System\JwQDAxa.exe
  2⤵
  PID:6380
- C:\Windows\System\Zobgvkj.exe
  C:\Windows\System\Zobgvkj.exe
  2⤵
  PID:6396
- C:\Windows\System\WMoNrYt.exe
  C:\Windows\System\WMoNrYt.exe
  2⤵
  PID:6492
- C:\Windows\System\fhfgxkI.exe
  C:\Windows\System\fhfgxkI.exe
  2⤵
  PID:6508
- C:\Windows\System\MvCxkfj.exe
  C:\Windows\System\MvCxkfj.exe
  2⤵
  PID:6524
- C:\Windows\System\AfIKQDg.exe
  C:\Windows\System\AfIKQDg.exe
  2⤵
  PID:6540
- C:\Windows\System\aZjgilW.exe
  C:\Windows\System\aZjgilW.exe
  2⤵
  PID:6556
- C:\Windows\System\oBcEvMP.exe
  C:\Windows\System\oBcEvMP.exe
  2⤵
  PID:6572
- C:\Windows\System\QbPAzTl.exe
  C:\Windows\System\QbPAzTl.exe
  2⤵
  PID:6588
- C:\Windows\System\mNvRffY.exe
  C:\Windows\System\mNvRffY.exe
  2⤵
  PID:6604
- C:\Windows\System\mtltKFT.exe
  C:\Windows\System\mtltKFT.exe
  2⤵
  PID:6620
- C:\Windows\System\maxNKEF.exe
  C:\Windows\System\maxNKEF.exe
  2⤵
  PID:6636
- C:\Windows\System\hfOwUXr.exe
  C:\Windows\System\hfOwUXr.exe
  2⤵
  PID:6652
- C:\Windows\System\TgSkyqN.exe
  C:\Windows\System\TgSkyqN.exe
  2⤵
  PID:6668
- C:\Windows\System\mhyBISi.exe
  C:\Windows\System\mhyBISi.exe
  2⤵
  PID:6684
- C:\Windows\System\UWPdNtV.exe
  C:\Windows\System\UWPdNtV.exe
  2⤵
  PID:6792
- C:\Windows\System\xleiYMy.exe
  C:\Windows\System\xleiYMy.exe
  2⤵
  PID:6812
- C:\Windows\System\cSpbgFN.exe
  C:\Windows\System\cSpbgFN.exe
  2⤵
  PID:6832
- C:\Windows\System\AyrRHAh.exe
  C:\Windows\System\AyrRHAh.exe
  2⤵
  PID:6848
- C:\Windows\System\BfLMSnq.exe
  C:\Windows\System\BfLMSnq.exe
  2⤵
  PID:6864
- C:\Windows\System\bfCpUIS.exe
  C:\Windows\System\bfCpUIS.exe
  2⤵
  PID:6880
- C:\Windows\System\ZMPGYps.exe
  C:\Windows\System\ZMPGYps.exe
  2⤵
  PID:6896
- C:\Windows\System\SOcrvVh.exe
  C:\Windows\System\SOcrvVh.exe
  2⤵
  PID:6912
- C:\Windows\System\PFprGUu.exe
  C:\Windows\System\PFprGUu.exe
  2⤵
  PID:6928
- C:\Windows\System\ZljhlzF.exe
  C:\Windows\System\ZljhlzF.exe
  2⤵
  PID:6944
- C:\Windows\System\PxUGITj.exe
  C:\Windows\System\PxUGITj.exe
  2⤵
  PID:6960
- C:\Windows\System\pXbQVDS.exe
  C:\Windows\System\pXbQVDS.exe
  2⤵
  PID:6976
- C:\Windows\System\xXPXDFV.exe
  C:\Windows\System\xXPXDFV.exe
  2⤵
  PID:6992
- C:\Windows\System\dWVyEuH.exe
  C:\Windows\System\dWVyEuH.exe
  2⤵
  PID:7008
- C:\Windows\System\kOJmuQc.exe
  C:\Windows\System\kOJmuQc.exe
  2⤵
  PID:7024
- C:\Windows\System\oltJoqV.exe
  C:\Windows\System\oltJoqV.exe
  2⤵
  PID:7040
- C:\Windows\System\gqZLunV.exe
  C:\Windows\System\gqZLunV.exe
  2⤵
  PID:7056
- C:\Windows\System\ERcXbUe.exe
  C:\Windows\System\ERcXbUe.exe
  2⤵
  PID:7072
- C:\Windows\System\YlWQekH.exe
  C:\Windows\System\YlWQekH.exe
  2⤵
  PID:7088
- C:\Windows\System\ynRNeVp.exe
  C:\Windows\System\ynRNeVp.exe
  2⤵
  PID:7108
- C:\Windows\System\ShCpGdI.exe
  C:\Windows\System\ShCpGdI.exe
  2⤵
  PID:7124
- C:\Windows\System\PnEhqFf.exe
  C:\Windows\System\PnEhqFf.exe
  2⤵
  PID:7140
- C:\Windows\System\lmYtCDG.exe
  C:\Windows\System\lmYtCDG.exe
  2⤵
  PID:7156
- C:\Windows\System\AeQRoxk.exe
  C:\Windows\System\AeQRoxk.exe
  2⤵
  PID:6004
- C:\Windows\System\uSVzfSH.exe
  C:\Windows\System\uSVzfSH.exe
  2⤵
  PID:5956
- C:\Windows\System\HVikVMx.exe
  C:\Windows\System\HVikVMx.exe
  2⤵
  PID:6056
- C:\Windows\System\UhWdrls.exe
  C:\Windows\System\UhWdrls.exe
  2⤵
  PID:5204
- C:\Windows\System\EcdRkBG.exe
  C:\Windows\System\EcdRkBG.exe
  2⤵
  PID:5540
- C:\Windows\System\EpNmlkI.exe
  C:\Windows\System\EpNmlkI.exe
  2⤵
  PID:5620
- C:\Windows\System\NQjUMAj.exe
  C:\Windows\System\NQjUMAj.exe
  2⤵
  PID:6116
- C:\Windows\System\jHstQUS.exe
  C:\Windows\System\jHstQUS.exe
  2⤵
  PID:5716
- C:\Windows\System\tbNfyfq.exe
  C:\Windows\System\tbNfyfq.exe
  2⤵
  PID:5412
- C:\Windows\System\MthvWAa.exe
  C:\Windows\System\MthvWAa.exe
  2⤵
  PID:5780
- C:\Windows\System\aUPQqpQ.exe
  C:\Windows\System\aUPQqpQ.exe
  2⤵
  PID:5176
- C:\Windows\System\dpOBamG.exe
  C:\Windows\System\dpOBamG.exe
  2⤵
  PID:2760
- C:\Windows\System\NnvQlMP.exe
  C:\Windows\System\NnvQlMP.exe
  2⤵
  PID:6172
- C:\Windows\System\URmzsKd.exe
  C:\Windows\System\URmzsKd.exe
  2⤵
  PID:6236
- C:\Windows\System\dDxHWau.exe
  C:\Windows\System\dDxHWau.exe
  2⤵
  PID:6192
- C:\Windows\System\FNAEiKC.exe
  C:\Windows\System\FNAEiKC.exe
  2⤵
  PID:6260
- C:\Windows\System\LSBftlO.exe
  C:\Windows\System\LSBftlO.exe
  2⤵
  PID:6340
- C:\Windows\System\JEsXSYC.exe
  C:\Windows\System\JEsXSYC.exe
  2⤵
  PID:6328
- C:\Windows\System\FKMsRzM.exe
  C:\Windows\System\FKMsRzM.exe
  2⤵
  PID:6404
- C:\Windows\System\hWDnCuW.exe
  C:\Windows\System\hWDnCuW.exe
  2⤵
  PID:6356
- C:\Windows\System\VkzSXZV.exe
  C:\Windows\System\VkzSXZV.exe
  2⤵
  PID:5644
- C:\Windows\System\AaebgeU.exe
  C:\Windows\System\AaebgeU.exe
  2⤵
  PID:6432
- C:\Windows\System\QazVFmQ.exe
  C:\Windows\System\QazVFmQ.exe
  2⤵
  PID:6440
- C:\Windows\System\WkTrbdQ.exe
  C:\Windows\System\WkTrbdQ.exe
  2⤵
  PID:6468
- C:\Windows\System\ljHcawm.exe
  C:\Windows\System\ljHcawm.exe
  2⤵
  PID:6504
- C:\Windows\System\BsnFSVN.exe
  C:\Windows\System\BsnFSVN.exe
  2⤵
  PID:6568
- C:\Windows\System\vLBLORh.exe
  C:\Windows\System\vLBLORh.exe
  2⤵
  PID:6632
- C:\Windows\System\zpIjCax.exe
  C:\Windows\System\zpIjCax.exe
  2⤵
  PID:6520
- C:\Windows\System\mxgOAeT.exe
  C:\Windows\System\mxgOAeT.exe
  2⤵
  PID:6644
- C:\Windows\System\RimuanD.exe
  C:\Windows\System\RimuanD.exe
  2⤵
  PID:6708
- C:\Windows\System\EbxhSQQ.exe
  C:\Windows\System\EbxhSQQ.exe
  2⤵
  PID:6724
- C:\Windows\System\aHdRfxe.exe
  C:\Windows\System\aHdRfxe.exe
  2⤵
  PID:6740
- C:\Windows\System\rcHLyfy.exe
  C:\Windows\System\rcHLyfy.exe
  2⤵
  PID:6756
- C:\Windows\System\FBSENJs.exe
  C:\Windows\System\FBSENJs.exe
  2⤵
  PID:6800
- C:\Windows\System\dVcCtjp.exe
  C:\Windows\System\dVcCtjp.exe
  2⤵
  PID:6844
- C:\Windows\System\RmbPgFB.exe
  C:\Windows\System\RmbPgFB.exe
  2⤵
  PID:6908
- C:\Windows\System\CyhZlsE.exe
  C:\Windows\System\CyhZlsE.exe
  2⤵
  PID:6968
- C:\Windows\System\bwNzneM.exe
  C:\Windows\System\bwNzneM.exe
  2⤵
  PID:7000
- C:\Windows\System\wjoFJst.exe
  C:\Windows\System\wjoFJst.exe
  2⤵
  PID:7064
- C:\Windows\System\umsWmKU.exe
  C:\Windows\System\umsWmKU.exe
  2⤵
  PID:7136
- C:\Windows\System\BANteJs.exe
  C:\Windows\System\BANteJs.exe
  2⤵
  PID:5988
- C:\Windows\System\HzoiSpP.exe
  C:\Windows\System\HzoiSpP.exe
  2⤵
  PID:5744
- C:\Windows\System\BhEUien.exe
  C:\Windows\System\BhEUien.exe
  2⤵
  PID:6772
- C:\Windows\System\QFwHzps.exe
  C:\Windows\System\QFwHzps.exe
  2⤵
  PID:6888
- C:\Windows\System\kAjqTAp.exe
  C:\Windows\System\kAjqTAp.exe
  2⤵
  PID:6952
- C:\Windows\System\ccXfbcw.exe
  C:\Windows\System\ccXfbcw.exe
  2⤵
  PID:7016
- C:\Windows\System\jZVmcLi.exe
  C:\Windows\System\jZVmcLi.exe
  2⤵
  PID:7080
- C:\Windows\System\qBjtsnw.exe
  C:\Windows\System\qBjtsnw.exe
  2⤵
  PID:7148
- C:\Windows\System\TFIxNYY.exe
  C:\Windows\System\TFIxNYY.exe
  2⤵
  PID:6052
- C:\Windows\System\VSkVnoy.exe
  C:\Windows\System\VSkVnoy.exe
  2⤵
  PID:5216
- C:\Windows\System\NCstkbr.exe
  C:\Windows\System\NCstkbr.exe
  2⤵
  PID:5376
- C:\Windows\System\vbuDtbo.exe
  C:\Windows\System\vbuDtbo.exe
  2⤵
  PID:6824
- C:\Windows\System\HIOcVep.exe
  C:\Windows\System\HIOcVep.exe
  2⤵
  PID:5712
- C:\Windows\System\hwJGuZl.exe
  C:\Windows\System\hwJGuZl.exe
  2⤵
  PID:5380
- C:\Windows\System\RhjIhCt.exe
  C:\Windows\System\RhjIhCt.exe
  2⤵
  PID:5476
- C:\Windows\System\tktBXEX.exe
  C:\Windows\System\tktBXEX.exe
  2⤵
  PID:6188
- C:\Windows\System\dHrAwFJ.exe
  C:\Windows\System\dHrAwFJ.exe
  2⤵
  PID:6204
- C:\Windows\System\kDMyLPX.exe
  C:\Windows\System\kDMyLPX.exe
  2⤵
  PID:6256
- C:\Windows\System\QdnYcjd.exe
  C:\Windows\System\QdnYcjd.exe
  2⤵
  PID:6376
- C:\Windows\System\MYVIcUN.exe
  C:\Windows\System\MYVIcUN.exe
  2⤵
  PID:6428
- C:\Windows\System\jZDhxpt.exe
  C:\Windows\System\jZDhxpt.exe
  2⤵
  PID:6464
- C:\Windows\System\suKaUWY.exe
  C:\Windows\System\suKaUWY.exe
  2⤵
  PID:6420
- C:\Windows\System\ssgFykW.exe
  C:\Windows\System\ssgFykW.exe
  2⤵
  PID:6536
- C:\Windows\System\iZlKBJN.exe
  C:\Windows\System\iZlKBJN.exe
  2⤵
  PID:6700
- C:\Windows\System\zmPIzPo.exe
  C:\Windows\System\zmPIzPo.exe
  2⤵
  PID:6612
- C:\Windows\System\DsLkBTI.exe
  C:\Windows\System\DsLkBTI.exe
  2⤵
  PID:6676
- C:\Windows\System\RzkBgsu.exe
  C:\Windows\System\RzkBgsu.exe
  2⤵
  PID:6616
- C:\Windows\System\vGLRtIz.exe
  C:\Windows\System\vGLRtIz.exe
  2⤵
  PID:6720
- C:\Windows\System\EYFqfjU.exe
  C:\Windows\System\EYFqfjU.exe
  2⤵
  PID:5944
- C:\Windows\System\rZPxRBD.exe
  C:\Windows\System\rZPxRBD.exe
  2⤵
  PID:7100
- C:\Windows\System\DsoPNmu.exe
  C:\Windows\System\DsoPNmu.exe
  2⤵
  PID:6788
- C:\Windows\System\ziTWeur.exe
  C:\Windows\System\ziTWeur.exe
  2⤵
  PID:6840
- C:\Windows\System\cNpihPy.exe
  C:\Windows\System\cNpihPy.exe
  2⤵
  PID:6160
- C:\Windows\System\wbnTltv.exe
  C:\Windows\System\wbnTltv.exe
  2⤵
  PID:6224
- C:\Windows\System\gugOYmw.exe
  C:\Windows\System\gugOYmw.exe
  2⤵
  PID:6924
- C:\Windows\System\TiMmced.exe
  C:\Windows\System\TiMmced.exe
  2⤵
  PID:7164
- C:\Windows\System\aeJoyuR.exe
  C:\Windows\System\aeJoyuR.exe
  2⤵
  PID:6920
- C:\Windows\System\bCrcCcQ.exe
  C:\Windows\System\bCrcCcQ.exe
  2⤵
  PID:7048
- C:\Windows\System\utZHovo.exe
  C:\Windows\System\utZHovo.exe
  2⤵
  PID:6308
- C:\Windows\System\lIQwudD.exe
  C:\Windows\System\lIQwudD.exe
  2⤵
  PID:6808
- C:\Windows\System\eTHJqDk.exe
  C:\Windows\System\eTHJqDk.exe
  2⤵
  PID:6940
- C:\Windows\System\mgyxrAa.exe
  C:\Windows\System\mgyxrAa.exe
  2⤵
  PID:5332
- C:\Windows\System\BOhyKbY.exe
  C:\Windows\System\BOhyKbY.exe
  2⤵
  PID:6452
- C:\Windows\System\tgBKLjY.exe
  C:\Windows\System\tgBKLjY.exe
  2⤵
  PID:6732
- C:\Windows\System\TACnLcM.exe
  C:\Windows\System\TACnLcM.exe
  2⤵
  PID:6024
- C:\Windows\System\ttXTJtI.exe
  C:\Windows\System\ttXTJtI.exe
  2⤵
  PID:6480
- C:\Windows\System\bMxRZTH.exe
  C:\Windows\System\bMxRZTH.exe
  2⤵
  PID:7176
- C:\Windows\System\QvsOSDN.exe
  C:\Windows\System\QvsOSDN.exe
  2⤵
  PID:7192
- C:\Windows\System\bECxGLU.exe
  C:\Windows\System\bECxGLU.exe
  2⤵
  PID:7208
- C:\Windows\System\aOHcRee.exe
  C:\Windows\System\aOHcRee.exe
  2⤵
  PID:7224
- C:\Windows\System\iNehOKg.exe
  C:\Windows\System\iNehOKg.exe
  2⤵
  PID:7240
- C:\Windows\System\laiHvmf.exe
  C:\Windows\System\laiHvmf.exe
  2⤵
  PID:7256
- C:\Windows\System\AMXqdTS.exe
  C:\Windows\System\AMXqdTS.exe
  2⤵
  PID:7272
- C:\Windows\System\faOVpkI.exe
  C:\Windows\System\faOVpkI.exe
  2⤵
  PID:7288
- C:\Windows\System\vtjRTMm.exe
  C:\Windows\System\vtjRTMm.exe
  2⤵
  PID:7304
- C:\Windows\System\ywlnySS.exe
  C:\Windows\System\ywlnySS.exe
  2⤵
  PID:7320
- C:\Windows\System\gSYicXJ.exe
  C:\Windows\System\gSYicXJ.exe
  2⤵
  PID:7336
- C:\Windows\System\gWbSTOC.exe
  C:\Windows\System\gWbSTOC.exe
  2⤵
  PID:7352
- C:\Windows\System\CbqkVso.exe
  C:\Windows\System\CbqkVso.exe
  2⤵
  PID:7380
- C:\Windows\System\YnhALRx.exe
  C:\Windows\System\YnhALRx.exe
  2⤵
  PID:7396
- C:\Windows\System\lYNEPJW.exe
  C:\Windows\System\lYNEPJW.exe
  2⤵
  PID:7480
- C:\Windows\System\QrjmDlm.exe
  C:\Windows\System\QrjmDlm.exe
  2⤵
  PID:7496
- C:\Windows\System\RaRtjJR.exe
  C:\Windows\System\RaRtjJR.exe
  2⤵
  PID:7512
- C:\Windows\System\HShCfLb.exe
  C:\Windows\System\HShCfLb.exe
  2⤵
  PID:7528
- C:\Windows\System\XnlyOKu.exe
  C:\Windows\System\XnlyOKu.exe
  2⤵
  PID:7544
- C:\Windows\System\tqbWfAW.exe
  C:\Windows\System\tqbWfAW.exe
  2⤵
  PID:7560
- C:\Windows\System\mhIabSb.exe
  C:\Windows\System\mhIabSb.exe
  2⤵
  PID:7580
- C:\Windows\System\wwQUBnC.exe
  C:\Windows\System\wwQUBnC.exe
  2⤵
  PID:7596
- C:\Windows\System\WQmmuEO.exe
  C:\Windows\System\WQmmuEO.exe
  2⤵
  PID:7612
- C:\Windows\System\jWwGFGR.exe
  C:\Windows\System\jWwGFGR.exe
  2⤵
  PID:7632
- C:\Windows\System\hwXePBq.exe
  C:\Windows\System\hwXePBq.exe
  2⤵
  PID:7648
- C:\Windows\System\VOaOQSC.exe
  C:\Windows\System\VOaOQSC.exe
  2⤵
  PID:7664
- C:\Windows\System\sXhHppB.exe
  C:\Windows\System\sXhHppB.exe
  2⤵
  PID:7680
- C:\Windows\System\ZqWdcYT.exe
  C:\Windows\System\ZqWdcYT.exe
  2⤵
  PID:7696
- C:\Windows\System\xnyiqns.exe
  C:\Windows\System\xnyiqns.exe
  2⤵
  PID:7796
- C:\Windows\System\jNJNggo.exe
  C:\Windows\System\jNJNggo.exe
  2⤵
  PID:7812
- C:\Windows\System\wzwGEJg.exe
  C:\Windows\System\wzwGEJg.exe
  2⤵
  PID:7828
- C:\Windows\System\UocKqLs.exe
  C:\Windows\System\UocKqLs.exe
  2⤵
  PID:7844
- C:\Windows\System\iCdFRrh.exe
  C:\Windows\System\iCdFRrh.exe
  2⤵
  PID:7860
- C:\Windows\System\rrHEgNb.exe
  C:\Windows\System\rrHEgNb.exe
  2⤵
  PID:7876
- C:\Windows\System\igLbWRE.exe
  C:\Windows\System\igLbWRE.exe
  2⤵
  PID:7892
- C:\Windows\System\fFtFkqq.exe
  C:\Windows\System\fFtFkqq.exe
  2⤵
  PID:7908
- C:\Windows\System\BlfBLvP.exe
  C:\Windows\System\BlfBLvP.exe
  2⤵
  PID:7924
- C:\Windows\System\knGoQnS.exe
  C:\Windows\System\knGoQnS.exe
  2⤵
  PID:7940
- C:\Windows\System\eZggMsK.exe
  C:\Windows\System\eZggMsK.exe
  2⤵
  PID:7956
- C:\Windows\System\OWukgrv.exe
  C:\Windows\System\OWukgrv.exe
  2⤵
  PID:7972
- C:\Windows\System\cTcEaGH.exe
  C:\Windows\System\cTcEaGH.exe
  2⤵
  PID:7988
- C:\Windows\System\uxtNoaO.exe
  C:\Windows\System\uxtNoaO.exe
  2⤵
  PID:8004
- C:\Windows\System\KyyIQyq.exe
  C:\Windows\System\KyyIQyq.exe
  2⤵
  PID:8020
- C:\Windows\System\JsoEDju.exe
  C:\Windows\System\JsoEDju.exe
  2⤵
  PID:8036
- C:\Windows\System\KhPhJvf.exe
  C:\Windows\System\KhPhJvf.exe
  2⤵
  PID:8052
- C:\Windows\System\KbhdWNU.exe
  C:\Windows\System\KbhdWNU.exe
  2⤵
  PID:8068
- C:\Windows\System\ViInGxu.exe
  C:\Windows\System\ViInGxu.exe
  2⤵
  PID:8084
- C:\Windows\System\vlrssnh.exe
  C:\Windows\System\vlrssnh.exe
  2⤵
  PID:8100
- C:\Windows\System\nlZbPbn.exe
  C:\Windows\System\nlZbPbn.exe
  2⤵
  PID:8116
- C:\Windows\System\daFhBAF.exe
  C:\Windows\System\daFhBAF.exe
  2⤵
  PID:8132
- C:\Windows\System\akpiOQN.exe
  C:\Windows\System\akpiOQN.exe
  2⤵
  PID:8148
- C:\Windows\System\unsnoqs.exe
  C:\Windows\System\unsnoqs.exe
  2⤵
  PID:8164
- C:\Windows\System\bvnRLND.exe
  C:\Windows\System\bvnRLND.exe
  2⤵
  PID:8180
- C:\Windows\System\BnXjBXK.exe
  C:\Windows\System\BnXjBXK.exe
  2⤵
  PID:6768
- C:\Windows\System\krOorvl.exe
  C:\Windows\System\krOorvl.exe
  2⤵
  PID:6776
- C:\Windows\System\WbICpzD.exe
  C:\Windows\System\WbICpzD.exe
  2⤵
  PID:6664
- C:\Windows\System\pVdKuLr.exe
  C:\Windows\System\pVdKuLr.exe
  2⤵
  PID:5552
- C:\Windows\System\zIibafp.exe
  C:\Windows\System\zIibafp.exe
  2⤵
  PID:6764
- C:\Windows\System\dvnIimB.exe
  C:\Windows\System\dvnIimB.exe
  2⤵
  PID:7268
- C:\Windows\System\pnkiUcA.exe
  C:\Windows\System\pnkiUcA.exe
  2⤵
  PID:7300
- C:\Windows\System\NTLJwBC.exe
  C:\Windows\System\NTLJwBC.exe
  2⤵
  PID:7364
- C:\Windows\System\hiROkOG.exe
  C:\Windows\System\hiROkOG.exe
  2⤵
  PID:5788
- C:\Windows\System\bKkrKWs.exe
  C:\Windows\System\bKkrKWs.exe
  2⤵
  PID:5844
- C:\Windows\System\mfNkcBe.exe
  C:\Windows\System\mfNkcBe.exe
  2⤵
  PID:7376
- C:\Windows\System\XjGkmOz.exe
  C:\Windows\System\XjGkmOz.exe
  2⤵
  PID:5756
- C:\Windows\System\THoMNtU.exe
  C:\Windows\System\THoMNtU.exe
  2⤵
  PID:7416
- C:\Windows\System\UmOmhIt.exe
  C:\Windows\System\UmOmhIt.exe
  2⤵
  PID:6472
- C:\Windows\System\apOOELQ.exe
  C:\Windows\System\apOOELQ.exe
  2⤵
  PID:7220
- C:\Windows\System\IKhyUCK.exe
  C:\Windows\System\IKhyUCK.exe
  2⤵
  PID:7284
- C:\Windows\System\jStLWXj.exe
  C:\Windows\System\jStLWXj.exe
  2⤵
  PID:7348
- C:\Windows\System\tAGQXoe.exe
  C:\Windows\System\tAGQXoe.exe
  2⤵
  PID:7428
- C:\Windows\System\RyCtqzk.exe
  C:\Windows\System\RyCtqzk.exe
  2⤵
  PID:7444
- C:\Windows\System\kBYDtYZ.exe
  C:\Windows\System\kBYDtYZ.exe
  2⤵
  PID:7460
- C:\Windows\System\dTkcJAj.exe
  C:\Windows\System\dTkcJAj.exe
  2⤵
  PID:7472
- C:\Windows\System\FEFCIVP.exe
  C:\Windows\System\FEFCIVP.exe
  2⤵
  PID:7552
- C:\Windows\System\RMIzFvY.exe
  C:\Windows\System\RMIzFvY.exe
  2⤵
  PID:7620
- C:\Windows\System\IUCUPjG.exe
  C:\Windows\System\IUCUPjG.exe
  2⤵
  PID:7504
- C:\Windows\System\DUvTFTY.exe
  C:\Windows\System\DUvTFTY.exe
  2⤵
  PID:7656
- C:\Windows\System\JpTKarZ.exe
  C:\Windows\System\JpTKarZ.exe
  2⤵
  PID:7692
- C:\Windows\System\qBhCROj.exe
  C:\Windows\System\qBhCROj.exe
  2⤵
  PID:7576
- C:\Windows\System\VeIDseb.exe
  C:\Windows\System\VeIDseb.exe
  2⤵
  PID:7672
- C:\Windows\System\mXVwYbg.exe
  C:\Windows\System\mXVwYbg.exe
  2⤵
  PID:7720
- C:\Windows\System\JJaoBUv.exe
  C:\Windows\System\JJaoBUv.exe
  2⤵
  PID:7732
- C:\Windows\System\suOhwPa.exe
  C:\Windows\System\suOhwPa.exe
  2⤵
  PID:5580
- C:\Windows\System\XVxlNkF.exe
  C:\Windows\System\XVxlNkF.exe
  2⤵
  PID:7776
- C:\Windows\System\kyeagXb.exe
  C:\Windows\System\kyeagXb.exe
  2⤵
  PID:7788
- C:\Windows\System\OiIZGjl.exe
  C:\Windows\System\OiIZGjl.exe
  2⤵
  PID:7808
- C:\Windows\System\ayPSmvu.exe
  C:\Windows\System\ayPSmvu.exe
  2⤵
  PID:7996
- C:\Windows\System\WZoVzbM.exe
  C:\Windows\System\WZoVzbM.exe
  2⤵
  PID:8000
- C:\Windows\System\yqseEwg.exe
  C:\Windows\System\yqseEwg.exe
  2⤵
  PID:8032
- C:\Windows\System\mxrOMTS.exe
  C:\Windows\System\mxrOMTS.exe
  2⤵
  PID:7852
- C:\Windows\System\qPEDdPF.exe
  C:\Windows\System\qPEDdPF.exe
  2⤵
  PID:8124
- C:\Windows\System\BHYrZyH.exe
  C:\Windows\System\BHYrZyH.exe
  2⤵
  PID:8188
- C:\Windows\System\bvRLxbC.exe
  C:\Windows\System\bvRLxbC.exe
  2⤵
  PID:7884
- C:\Windows\System\TwGbobd.exe
  C:\Windows\System\TwGbobd.exe
  2⤵
  PID:7916
- C:\Windows\System\cgZDMjC.exe
  C:\Windows\System\cgZDMjC.exe
  2⤵
  PID:8108
- C:\Windows\System\yMhdKih.exe
  C:\Windows\System\yMhdKih.exe
  2⤵
  PID:6416
- C:\Windows\System\sUFRRUE.exe
  C:\Windows\System\sUFRRUE.exe
  2⤵
  PID:7172
- C:\Windows\System\ANfXSar.exe
  C:\Windows\System\ANfXSar.exe
  2⤵
  PID:8172
- C:\Windows\System\gtSChxH.exe
  C:\Windows\System\gtSChxH.exe
  2⤵
  PID:7032
- C:\Windows\System\xJkQsJx.exe
  C:\Windows\System\xJkQsJx.exe
  2⤵
  PID:7236
- C:\Windows\System\AxMJCXe.exe
  C:\Windows\System\AxMJCXe.exe
  2⤵
  PID:7096
- C:\Windows\System\QGApwTR.exe
  C:\Windows\System\QGApwTR.exe
  2⤵
  PID:7412
- C:\Windows\System\sBvefDR.exe
  C:\Windows\System\sBvefDR.exe
  2⤵
  PID:7216
- C:\Windows\System\eTjJCUJ.exe
  C:\Windows\System\eTjJCUJ.exe
  2⤵
  PID:7476
- C:\Windows\System\DHEfrLT.exe
  C:\Windows\System\DHEfrLT.exe
  2⤵
  PID:7660
- C:\Windows\System\xyiIbeA.exe
  C:\Windows\System\xyiIbeA.exe
  2⤵
  PID:7332
- C:\Windows\System\ZSEqdIF.exe
  C:\Windows\System\ZSEqdIF.exe
  2⤵
  PID:4884
- C:\Windows\System\TSPzFra.exe
  C:\Windows\System\TSPzFra.exe
  2⤵
  PID:7716
- C:\Windows\System\GjYlAIJ.exe
  C:\Windows\System\GjYlAIJ.exe
  2⤵
  PID:7760
- C:\Windows\System\YRuuMWW.exe
  C:\Windows\System\YRuuMWW.exe
  2⤵
  PID:7280
- C:\Windows\System\WlUgJPJ.exe
  C:\Windows\System\WlUgJPJ.exe
  2⤵
  PID:7792
- C:\Windows\System\dEweEDB.exe
  C:\Windows\System\dEweEDB.exe
  2⤵
  PID:7740
- C:\Windows\System\hBfHEaJ.exe
  C:\Windows\System\hBfHEaJ.exe
  2⤵
  PID:7900
- C:\Windows\System\FOzuewP.exe
  C:\Windows\System\FOzuewP.exe
  2⤵
  PID:7872
- C:\Windows\System\mQpUEfr.exe
  C:\Windows\System\mQpUEfr.exe
  2⤵
  PID:7524
- C:\Windows\System\dtSoVZB.exe
  C:\Windows\System\dtSoVZB.exe
  2⤵
  PID:7644
- C:\Windows\System\gnTJDVj.exe
  C:\Windows\System\gnTJDVj.exe
  2⤵
  PID:7840
- C:\Windows\System\NBRixYG.exe
  C:\Windows\System\NBRixYG.exe
  2⤵
  PID:7824
- C:\Windows\System\VUnArYN.exe
  C:\Windows\System\VUnArYN.exe
  2⤵
  PID:7984
- C:\Windows\System\CjfwwPj.exe
  C:\Windows\System\CjfwwPj.exe
  2⤵
  PID:8048
- C:\Windows\System\XPcEzdT.exe
  C:\Windows\System\XPcEzdT.exe
  2⤵
  PID:7296
- C:\Windows\System\RyXHbnp.exe
  C:\Windows\System\RyXHbnp.exe
  2⤵
  PID:6344
- C:\Windows\System\WzJetrK.exe
  C:\Windows\System\WzJetrK.exe
  2⤵
  PID:7312
- C:\Windows\System\qTCRlMs.exe
  C:\Windows\System\qTCRlMs.exe
  2⤵
  PID:7452
- C:\Windows\System\eLJTque.exe
  C:\Windows\System\eLJTque.exe
  2⤵
  PID:7456
- C:\Windows\System\pZBeuIi.exe
  C:\Windows\System\pZBeuIi.exe
  2⤵
  PID:7836
- C:\Windows\System\ItspGEQ.exe
  C:\Windows\System\ItspGEQ.exe
  2⤵
  PID:7772
- C:\Windows\System\ycKsmaM.exe
  C:\Windows\System\ycKsmaM.exe
  2⤵
  PID:8016
- C:\Windows\System\pwrcAjg.exe
  C:\Windows\System\pwrcAjg.exe
  2⤵
  PID:7372
- C:\Windows\System\eiroOHJ.exe
  C:\Windows\System\eiroOHJ.exe
  2⤵
  PID:7712
- C:\Windows\System\gGcmgvH.exe
  C:\Windows\System\gGcmgvH.exe
  2⤵
  PID:7728
- C:\Windows\System\bUghAmj.exe
  C:\Windows\System\bUghAmj.exe
  2⤵
  PID:7200
- C:\Windows\System\JqedzSK.exe
  C:\Windows\System\JqedzSK.exe
  2⤵
  PID:7536
- C:\Windows\System\TGPMYNj.exe
  C:\Windows\System\TGPMYNj.exe
  2⤵
  PID:8096
- C:\Windows\System\oNNlOTk.exe
  C:\Windows\System\oNNlOTk.exe
  2⤵
  PID:7424
- C:\Windows\System\GiobrgG.exe
  C:\Windows\System\GiobrgG.exe
  2⤵
  PID:8196
- C:\Windows\System\xEfjUsa.exe
  C:\Windows\System\xEfjUsa.exe
  2⤵
  PID:8212
- C:\Windows\System\SFIiGNk.exe
  C:\Windows\System\SFIiGNk.exe
  2⤵
  PID:8228
- C:\Windows\System\BQQufbQ.exe
  C:\Windows\System\BQQufbQ.exe
  2⤵
  PID:8244
- C:\Windows\System\tpKXbQX.exe
  C:\Windows\System\tpKXbQX.exe
  2⤵
  PID:8260
- C:\Windows\System\LwnRVLm.exe
  C:\Windows\System\LwnRVLm.exe
  2⤵
  PID:8276
- C:\Windows\System\THNqZsC.exe
  C:\Windows\System\THNqZsC.exe
  2⤵
  PID:8292
- C:\Windows\System\LrAGJpv.exe
  C:\Windows\System\LrAGJpv.exe
  2⤵
  PID:8308
- C:\Windows\System\uPPfyXp.exe
  C:\Windows\System\uPPfyXp.exe
  2⤵
  PID:8324
- C:\Windows\System\TvIhRaC.exe
  C:\Windows\System\TvIhRaC.exe
  2⤵
  PID:8340
- C:\Windows\System\sSIyVEi.exe
  C:\Windows\System\sSIyVEi.exe
  2⤵
  PID:8356
- C:\Windows\System\xpUiShb.exe
  C:\Windows\System\xpUiShb.exe
  2⤵
  PID:8372
- C:\Windows\System\jszVmbL.exe
  C:\Windows\System\jszVmbL.exe
  2⤵
  PID:8388
- C:\Windows\System\sYRwatb.exe
  C:\Windows\System\sYRwatb.exe
  2⤵
  PID:8404
- C:\Windows\System\EBNylqc.exe
  C:\Windows\System\EBNylqc.exe
  2⤵
  PID:8420
- C:\Windows\System\CjSTJsJ.exe
  C:\Windows\System\CjSTJsJ.exe
  2⤵
  PID:8436
- C:\Windows\System\UzsKXZe.exe
  C:\Windows\System\UzsKXZe.exe
  2⤵
  PID:8452
- C:\Windows\System\ljFBVWr.exe
  C:\Windows\System\ljFBVWr.exe
  2⤵
  PID:8468
- C:\Windows\System\DijukjS.exe
  C:\Windows\System\DijukjS.exe
  2⤵
  PID:8484
- C:\Windows\System\SmcIOiA.exe
  C:\Windows\System\SmcIOiA.exe
  2⤵
  PID:8500
- C:\Windows\System\mncVDOe.exe
  C:\Windows\System\mncVDOe.exe
  2⤵
  PID:8524
- C:\Windows\System\sgSiFoc.exe
  C:\Windows\System\sgSiFoc.exe
  2⤵
  PID:8544
- C:\Windows\System\EKyrMVr.exe
  C:\Windows\System\EKyrMVr.exe
  2⤵
  PID:8560
- C:\Windows\System\bAnodAX.exe
  C:\Windows\System\bAnodAX.exe
  2⤵
  PID:8576
- C:\Windows\System\wktDXWf.exe
  C:\Windows\System\wktDXWf.exe
  2⤵
  PID:8592
- C:\Windows\System\ynWlCsO.exe
  C:\Windows\System\ynWlCsO.exe
  2⤵
  PID:8608
- C:\Windows\System\RedrsOs.exe
  C:\Windows\System\RedrsOs.exe
  2⤵
  PID:8624
- C:\Windows\System\zjtCzfR.exe
  C:\Windows\System\zjtCzfR.exe
  2⤵
  PID:8640
- C:\Windows\System\aoCuUlG.exe
  C:\Windows\System\aoCuUlG.exe
  2⤵
  PID:8660
- C:\Windows\System\hbDCahV.exe
  C:\Windows\System\hbDCahV.exe
  2⤵
  PID:8676
- C:\Windows\System\rRnFLig.exe
  C:\Windows\System\rRnFLig.exe
  2⤵
  PID:8692
- C:\Windows\System\TFWoDwu.exe
  C:\Windows\System\TFWoDwu.exe
  2⤵
  PID:8708
- C:\Windows\System\ydQhmRI.exe
  C:\Windows\System\ydQhmRI.exe
  2⤵
  PID:8728
- C:\Windows\System\nvGbrka.exe
  C:\Windows\System\nvGbrka.exe
  2⤵
  PID:8744
- C:\Windows\System\EBUVgFk.exe
  C:\Windows\System\EBUVgFk.exe
  2⤵
  PID:8760
- C:\Windows\System\Idzbnky.exe
  C:\Windows\System\Idzbnky.exe
  2⤵
  PID:8776
- C:\Windows\System\pCYNaAp.exe
  C:\Windows\System\pCYNaAp.exe
  2⤵
  PID:8792
- C:\Windows\System\FTVTNMI.exe
  C:\Windows\System\FTVTNMI.exe
  2⤵
  PID:8808
- C:\Windows\System\CywHnjv.exe
  C:\Windows\System\CywHnjv.exe
  2⤵
  PID:8824
- C:\Windows\System\edGMwBN.exe
  C:\Windows\System\edGMwBN.exe
  2⤵
  PID:8840
- C:\Windows\System\ykTsion.exe
  C:\Windows\System\ykTsion.exe
  2⤵
  PID:8856
- C:\Windows\System\HtQPfjh.exe
  C:\Windows\System\HtQPfjh.exe
  2⤵
  PID:8872
- C:\Windows\System\fLWenoQ.exe
  C:\Windows\System\fLWenoQ.exe
  2⤵
  PID:8888
- C:\Windows\System\pbwlHnv.exe
  C:\Windows\System\pbwlHnv.exe
  2⤵
  PID:8904
- C:\Windows\System\oCrMxHr.exe
  C:\Windows\System\oCrMxHr.exe
  2⤵
  PID:8920
- C:\Windows\System\mPIgQZb.exe
  C:\Windows\System\mPIgQZb.exe
  2⤵
  PID:8936
- C:\Windows\System\xakaiMo.exe
  C:\Windows\System\xakaiMo.exe
  2⤵
  PID:8952
- C:\Windows\System\pkrDrfy.exe
  C:\Windows\System\pkrDrfy.exe
  2⤵
  PID:8968
- C:\Windows\System\iKNlOyM.exe
  C:\Windows\System\iKNlOyM.exe
  2⤵
  PID:8984
- C:\Windows\System\lLVgriv.exe
  C:\Windows\System\lLVgriv.exe
  2⤵
  PID:9000
- C:\Windows\System\sVhPPeZ.exe
  C:\Windows\System\sVhPPeZ.exe
  2⤵
  PID:9016
- C:\Windows\System\VwFJnuG.exe
  C:\Windows\System\VwFJnuG.exe
  2⤵
  PID:9032
- C:\Windows\System\azCxgdU.exe
  C:\Windows\System\azCxgdU.exe
  2⤵
  PID:9048
- C:\Windows\System\ygbAWPK.exe
  C:\Windows\System\ygbAWPK.exe
  2⤵
  PID:9064
- C:\Windows\System\tGdHyWA.exe
  C:\Windows\System\tGdHyWA.exe
  2⤵
  PID:9080
- C:\Windows\System\CyICNIA.exe
  C:\Windows\System\CyICNIA.exe
  2⤵
  PID:9096
- C:\Windows\System\jvCcLZC.exe
  C:\Windows\System\jvCcLZC.exe
  2⤵
  PID:9112
- C:\Windows\System\Msmrnsw.exe
  C:\Windows\System\Msmrnsw.exe
  2⤵
  PID:9128
- C:\Windows\System\jXFjdjU.exe
  C:\Windows\System\jXFjdjU.exe
  2⤵
  PID:9144
- C:\Windows\System\cQtRLzD.exe
  C:\Windows\System\cQtRLzD.exe
  2⤵
  PID:9160
- C:\Windows\System\WRxAXhE.exe
  C:\Windows\System\WRxAXhE.exe
  2⤵
  PID:9176
- C:\Windows\System\zKTKPbR.exe
  C:\Windows\System\zKTKPbR.exe
  2⤵
  PID:9192
- C:\Windows\System\sGsjWqp.exe
  C:\Windows\System\sGsjWqp.exe
  2⤵
  PID:9208
- C:\Windows\System\SwMOjhD.exe
  C:\Windows\System\SwMOjhD.exe
  2⤵
  PID:8156
- C:\Windows\System\zsoiVPn.exe
  C:\Windows\System\zsoiVPn.exe
  2⤵
  PID:8092
- C:\Windows\System\UqUEzBJ.exe
  C:\Windows\System\UqUEzBJ.exe
  2⤵
  PID:6372
- C:\Windows\System\AaprmuY.exe
  C:\Windows\System\AaprmuY.exe
  2⤵
  PID:7592
- C:\Windows\System\KmmgVHt.exe
  C:\Windows\System\KmmgVHt.exe
  2⤵
  PID:8208
- C:\Windows\System\DGIAVTA.exe
  C:\Windows\System\DGIAVTA.exe
  2⤵
  PID:8268
- C:\Windows\System\egExWYX.exe
  C:\Windows\System\egExWYX.exe
  2⤵
  PID:8332
- C:\Windows\System\ISGxYcr.exe
  C:\Windows\System\ISGxYcr.exe
  2⤵
  PID:8396
- C:\Windows\System\ZUVHTxj.exe
  C:\Windows\System\ZUVHTxj.exe
  2⤵
  PID:8460
- C:\Windows\System\xCdKMHU.exe
  C:\Windows\System\xCdKMHU.exe
  2⤵
  PID:8272
- C:\Windows\System\mrKVuli.exe
  C:\Windows\System\mrKVuli.exe
  2⤵
  PID:8316
- C:\Windows\System\ncspgJl.exe
  C:\Windows\System\ncspgJl.exe
  2⤵
  PID:8288
- C:\Windows\System\RNdRnfu.exe
  C:\Windows\System\RNdRnfu.exe
  2⤵
  PID:8384
- C:\Windows\System\gjKxFkA.exe
  C:\Windows\System\gjKxFkA.exe
  2⤵
  PID:8448
- C:\Windows\System\QWVnSQb.exe
  C:\Windows\System\QWVnSQb.exe
  2⤵
  PID:8536
- C:\Windows\System\EaKKpkN.exe
  C:\Windows\System\EaKKpkN.exe
  2⤵
  PID:8600
- C:\Windows\System\lvOoSsw.exe
  C:\Windows\System\lvOoSsw.exe
  2⤵
  PID:8668
- C:\Windows\System\YQnunau.exe
  C:\Windows\System\YQnunau.exe
  2⤵
  PID:8588
- C:\Windows\System\yaGiVDE.exe
  C:\Windows\System\yaGiVDE.exe
  2⤵
  PID:8584
- C:\Windows\System\ozzevIJ.exe
  C:\Windows\System\ozzevIJ.exe
  2⤵
  PID:8656
- C:\Windows\System\oWgkfZw.exe
  C:\Windows\System\oWgkfZw.exe
  2⤵
  PID:8720
- C:\Windows\System\zmlEfgx.exe
  C:\Windows\System\zmlEfgx.exe
  2⤵
  PID:8752
- C:\Windows\System\QIwiSvy.exe
  C:\Windows\System\QIwiSvy.exe
  2⤵
  PID:8800
- C:\Windows\System\rWiWgzq.exe
  C:\Windows\System\rWiWgzq.exe
  2⤵
  PID:8832
- C:\Windows\System\TPWazbH.exe
  C:\Windows\System\TPWazbH.exe
  2⤵
  PID:8816
- C:\Windows\System\seQwrFZ.exe
  C:\Windows\System\seQwrFZ.exe
  2⤵
  PID:8896
- C:\Windows\System\DHGUfTa.exe
  C:\Windows\System\DHGUfTa.exe
  2⤵
  PID:8928
- C:\Windows\System\fOkYcbd.exe
  C:\Windows\System\fOkYcbd.exe
  2⤵
  PID:8992
- C:\Windows\System\kaMQIRz.exe
  C:\Windows\System\kaMQIRz.exe
  2⤵
  PID:8912
- C:\Windows\System\TWtGtOl.exe
  C:\Windows\System\TWtGtOl.exe
  2⤵
  PID:8976
- C:\Windows\System\hAvEhkf.exe
  C:\Windows\System\hAvEhkf.exe
  2⤵
  PID:9092
- C:\Windows\System\pFmgPEZ.exe
  C:\Windows\System\pFmgPEZ.exe
  2⤵
  PID:7736
- C:\Windows\System\dgmsinP.exe
  C:\Windows\System\dgmsinP.exe
  2⤵
  PID:9124
- C:\Windows\System\MkGfOTg.exe
  C:\Windows\System\MkGfOTg.exe
  2⤵
  PID:9156
- C:\Windows\System\lofWCYK.exe
  C:\Windows\System\lofWCYK.exe
  2⤵
  PID:9188
- C:\Windows\System\QYXavlE.exe
  C:\Windows\System\QYXavlE.exe
  2⤵
  PID:9140
- C:\Windows\System\MVJiJLf.exe
  C:\Windows\System\MVJiJLf.exe
  2⤵
  PID:7904
- C:\Windows\System\jnyktfT.exe
  C:\Windows\System\jnyktfT.exe
  2⤵
  PID:7756
- C:\Windows\System\FrGhgin.exe
  C:\Windows\System\FrGhgin.exe
  2⤵
  PID:8368
- C:\Windows\System\KUELCvy.exe
  C:\Windows\System\KUELCvy.exe
  2⤵
  PID:8480
- C:\Windows\System\iwhaJwI.exe
  C:\Windows\System\iwhaJwI.exe
  2⤵
  PID:8444
- C:\Windows\System\wesJkPz.exe
  C:\Windows\System\wesJkPz.exe
  2⤵
  PID:8648
- C:\Windows\System\wujWiAn.exe
  C:\Windows\System\wujWiAn.exe
  2⤵
  PID:8724
- C:\Windows\System\aoizTfR.exe
  C:\Windows\System\aoizTfR.exe
  2⤵
  PID:8304
- C:\Windows\System\pgjcPbU.exe
  C:\Windows\System\pgjcPbU.exe
  2⤵
  PID:1588
- C:\Windows\System\XSgsLLr.exe
  C:\Windows\System\XSgsLLr.exe
  2⤵
  PID:8520
- C:\Windows\System\UKLzznO.exe
  C:\Windows\System\UKLzznO.exe
  2⤵
  PID:8804
- C:\Windows\System\qTShQsL.exe
  C:\Windows\System\qTShQsL.exe
  2⤵
  PID:8716
- C:\Windows\System\AcUSRnK.exe
  C:\Windows\System\AcUSRnK.exe
  2⤵
  PID:8864
- C:\Windows\System\PruIshn.exe
  C:\Windows\System\PruIshn.exe
  2⤵
  PID:8848
- C:\Windows\System\FoZLPjZ.exe
  C:\Windows\System\FoZLPjZ.exe
  2⤵
  PID:9028
- C:\Windows\System\kQQrgOX.exe
  C:\Windows\System\kQQrgOX.exe
  2⤵
  PID:9088
- C:\Windows\System\yfQSkMP.exe
  C:\Windows\System\yfQSkMP.exe
  2⤵
  PID:8980
- C:\Windows\System\zqMCdns.exe
  C:\Windows\System\zqMCdns.exe
  2⤵
  PID:9136
- C:\Windows\System\nFiWkno.exe
  C:\Windows\System\nFiWkno.exe
  2⤵
  PID:9200
- C:\Windows\System\DFczeHz.exe
  C:\Windows\System\DFczeHz.exe
  2⤵
  PID:7948
- C:\Windows\System\XjuVDVI.exe
  C:\Windows\System\XjuVDVI.exe
  2⤵
  PID:8432
- C:\Windows\System\uIMqkwV.exe
  C:\Windows\System\uIMqkwV.exe
  2⤵
  PID:8492
- C:\Windows\System\SFfZKpT.exe
  C:\Windows\System\SFfZKpT.exe
  2⤵
  PID:9204
- C:\Windows\System\RTpevxS.exe
  C:\Windows\System\RTpevxS.exe
  2⤵
  PID:8964
- C:\Windows\System\mktPnrR.exe
  C:\Windows\System\mktPnrR.exe
  2⤵
  PID:8352
- C:\Windows\System\dZbQjZP.exe
  C:\Windows\System\dZbQjZP.exe
  2⤵
  PID:9044
- C:\Windows\System\KxyZYJr.exe
  C:\Windows\System\KxyZYJr.exe
  2⤵
  PID:8900
- C:\Windows\System\SnIZkid.exe
  C:\Windows\System\SnIZkid.exe
  2⤵
  PID:9172
- C:\Windows\System\tzIwnRh.exe
  C:\Windows\System\tzIwnRh.exe
  2⤵
  PID:8568
- C:\Windows\System\udSIjOe.exe
  C:\Windows\System\udSIjOe.exe
  2⤵
  PID:6140
- C:\Windows\System\RaFRvRV.exe
  C:\Windows\System\RaFRvRV.exe
  2⤵
  PID:9224
- C:\Windows\System\xzmhIJA.exe
  C:\Windows\System\xzmhIJA.exe
  2⤵
  PID:9240
- C:\Windows\System\aqwRrqY.exe
  C:\Windows\System\aqwRrqY.exe
  2⤵
  PID:9256
- C:\Windows\System\ZqbNubz.exe
  C:\Windows\System\ZqbNubz.exe
  2⤵
  PID:9272
- C:\Windows\System\KQmtGiA.exe
  C:\Windows\System\KQmtGiA.exe
  2⤵
  PID:9288
- C:\Windows\System\XPCafpi.exe
  C:\Windows\System\XPCafpi.exe
  2⤵
  PID:9304
- C:\Windows\System\zxuErnR.exe
  C:\Windows\System\zxuErnR.exe
  2⤵
  PID:9320
- C:\Windows\System\XvXQaaR.exe
  C:\Windows\System\XvXQaaR.exe
  2⤵
  PID:9336
- C:\Windows\System\gqPnvUm.exe
  C:\Windows\System\gqPnvUm.exe
  2⤵
  PID:9352
- C:\Windows\System\uVxBFoj.exe
  C:\Windows\System\uVxBFoj.exe
  2⤵
  PID:9368
- C:\Windows\System\amBkBFN.exe
  C:\Windows\System\amBkBFN.exe
  2⤵
  PID:9384
- C:\Windows\System\tRuWaqg.exe
  C:\Windows\System\tRuWaqg.exe
  2⤵
  PID:9400
- C:\Windows\System\FnePQAZ.exe
  C:\Windows\System\FnePQAZ.exe
  2⤵
  PID:9416
- C:\Windows\System\itqBJiy.exe
  C:\Windows\System\itqBJiy.exe
  2⤵
  PID:9432
- C:\Windows\System\lKoOVYl.exe
  C:\Windows\System\lKoOVYl.exe
  2⤵
  PID:9448
- C:\Windows\System\bplYTDn.exe
  C:\Windows\System\bplYTDn.exe
  2⤵
  PID:9464
- C:\Windows\System\WmJWyYe.exe
  C:\Windows\System\WmJWyYe.exe
  2⤵
  PID:9480
- C:\Windows\System\aoFjcDX.exe
  C:\Windows\System\aoFjcDX.exe
  2⤵
  PID:9496
- C:\Windows\System\JMuadne.exe
  C:\Windows\System\JMuadne.exe
  2⤵
  PID:9512
- C:\Windows\System\XBnDhHa.exe
  C:\Windows\System\XBnDhHa.exe
  2⤵
  PID:9528
- C:\Windows\System\FNsWJHG.exe
  C:\Windows\System\FNsWJHG.exe
  2⤵
  PID:9544
- C:\Windows\System\pQhrkEW.exe
  C:\Windows\System\pQhrkEW.exe
  2⤵
  PID:9560
- C:\Windows\System\DSZxgjP.exe
  C:\Windows\System\DSZxgjP.exe
  2⤵
  PID:9576
- C:\Windows\System\eJajUrp.exe
  C:\Windows\System\eJajUrp.exe
  2⤵
  PID:9592
- C:\Windows\System\GFZNUpa.exe
  C:\Windows\System\GFZNUpa.exe
  2⤵
  PID:9608
- C:\Windows\System\FqUCeRF.exe
  C:\Windows\System\FqUCeRF.exe
  2⤵
  PID:9624
- C:\Windows\System\zHSVqKX.exe
  C:\Windows\System\zHSVqKX.exe
  2⤵
  PID:9640
- C:\Windows\System\kBiyBNI.exe
  C:\Windows\System\kBiyBNI.exe
  2⤵
  PID:9656
- C:\Windows\System\FNQzZhs.exe
  C:\Windows\System\FNQzZhs.exe
  2⤵
  PID:9672
- C:\Windows\System\dzzJLmP.exe
  C:\Windows\System\dzzJLmP.exe
  2⤵
  PID:9688
- C:\Windows\System\werAjzS.exe
  C:\Windows\System\werAjzS.exe
  2⤵
  PID:9704
- C:\Windows\System\oBGQGzx.exe
  C:\Windows\System\oBGQGzx.exe
  2⤵
  PID:9720
- C:\Windows\System\FOvYuof.exe
  C:\Windows\System\FOvYuof.exe
  2⤵
  PID:9740
- C:\Windows\System\YLCQkGL.exe
  C:\Windows\System\YLCQkGL.exe
  2⤵
  PID:9756
- C:\Windows\System\nwbggfS.exe
  C:\Windows\System\nwbggfS.exe
  2⤵
  PID:9772
- C:\Windows\System\ATiLXss.exe
  C:\Windows\System\ATiLXss.exe
  2⤵
  PID:9788
- C:\Windows\System\RiVvBht.exe
  C:\Windows\System\RiVvBht.exe
  2⤵
  PID:9804
- C:\Windows\System\MQsqBfZ.exe
  C:\Windows\System\MQsqBfZ.exe
  2⤵
  PID:9820
- C:\Windows\System\aHFHEJy.exe
  C:\Windows\System\aHFHEJy.exe
  2⤵
  PID:9836
- C:\Windows\System\ltFoyvN.exe
  C:\Windows\System\ltFoyvN.exe
  2⤵
  PID:9852
- C:\Windows\System\SpaYChe.exe
  C:\Windows\System\SpaYChe.exe
  2⤵
  PID:9876
- C:\Windows\System\hxPFZzU.exe
  C:\Windows\System\hxPFZzU.exe
  2⤵
  PID:9892
- C:\Windows\System\IyMRWam.exe
  C:\Windows\System\IyMRWam.exe
  2⤵
  PID:9908
- C:\Windows\System\KHnqnor.exe
  C:\Windows\System\KHnqnor.exe
  2⤵
  PID:9924
- C:\Windows\System\HZWjIvc.exe
  C:\Windows\System\HZWjIvc.exe
  2⤵
  PID:9940
- C:\Windows\System\JvIDOwb.exe
  C:\Windows\System\JvIDOwb.exe
  2⤵
  PID:9956
- C:\Windows\System\wvKempB.exe
  C:\Windows\System\wvKempB.exe
  2⤵
  PID:9972
- C:\Windows\System\fqCSiAu.exe
  C:\Windows\System\fqCSiAu.exe
  2⤵
  PID:9988
- C:\Windows\System\sLkkUcX.exe
  C:\Windows\System\sLkkUcX.exe
  2⤵
  PID:10004
- C:\Windows\System\jPktEwl.exe
  C:\Windows\System\jPktEwl.exe
  2⤵
  PID:10020
- C:\Windows\System\NcKJJaV.exe
  C:\Windows\System\NcKJJaV.exe
  2⤵
  PID:10036
- C:\Windows\System\sVPrMEb.exe
  C:\Windows\System\sVPrMEb.exe
  2⤵
  PID:10052
- C:\Windows\System\QpGlVkW.exe
  C:\Windows\System\QpGlVkW.exe
  2⤵
  PID:10068
- C:\Windows\System\LGftGgs.exe
  C:\Windows\System\LGftGgs.exe
  2⤵
  PID:10084
- C:\Windows\System\hEYQewH.exe
  C:\Windows\System\hEYQewH.exe
  2⤵
  PID:10100
- C:\Windows\System\PKOTxax.exe
  C:\Windows\System\PKOTxax.exe
  2⤵
  PID:10116
- C:\Windows\System\enEqNdS.exe
  C:\Windows\System\enEqNdS.exe
  2⤵
  PID:10132
- C:\Windows\System\HmpTaUk.exe
  C:\Windows\System\HmpTaUk.exe
  2⤵
  PID:10148
- C:\Windows\System\myZnSSX.exe
  C:\Windows\System\myZnSSX.exe
  2⤵
  PID:10164
- C:\Windows\System\UxigiPF.exe
  C:\Windows\System\UxigiPF.exe
  2⤵
  PID:10180
- C:\Windows\System\IomAINI.exe
  C:\Windows\System\IomAINI.exe
  2⤵
  PID:10196
- C:\Windows\System\nSfCuNp.exe
  C:\Windows\System\nSfCuNp.exe
  2⤵
  PID:10212
- C:\Windows\System\DlFWlOm.exe
  C:\Windows\System\DlFWlOm.exe
  2⤵
  PID:10228
- C:\Windows\System\MrgIGlZ.exe
  C:\Windows\System\MrgIGlZ.exe
  2⤵
  PID:8240
- C:\Windows\System\QQRIOsT.exe
  C:\Windows\System\QQRIOsT.exe
  2⤵
  PID:9220
- C:\Windows\System\zjscUhm.exe
  C:\Windows\System\zjscUhm.exe
  2⤵
  PID:8772
- C:\Windows\System\ITpAyRD.exe
  C:\Windows\System\ITpAyRD.exe
  2⤵
  PID:9236
- C:\Windows\System\CyDGAce.exe
  C:\Windows\System\CyDGAce.exe
  2⤵
  PID:8572
- C:\Windows\System\ivGiUfb.exe
  C:\Windows\System\ivGiUfb.exe
  2⤵
  PID:9312
- C:\Windows\System\ouFWqgG.exe
  C:\Windows\System\ouFWqgG.exe
  2⤵
  PID:9268
- C:\Windows\System\ZVFClrj.exe
  C:\Windows\System\ZVFClrj.exe
  2⤵
  PID:9376
- C:\Windows\System\zxzhYae.exe
  C:\Windows\System\zxzhYae.exe
  2⤵
  PID:9392
- C:\Windows\System\rScQtmf.exe
  C:\Windows\System\rScQtmf.exe
  2⤵
  PID:9412
- C:\Windows\System\FhOJANw.exe
  C:\Windows\System\FhOJANw.exe
  2⤵
  PID:9424
- C:\Windows\System\KZsRfGK.exe
  C:\Windows\System\KZsRfGK.exe
  2⤵
  PID:9456
- C:\Windows\System\KTfDtOY.exe
  C:\Windows\System\KTfDtOY.exe
  2⤵
  PID:9488
- C:\Windows\System\JggHAWj.exe
  C:\Windows\System\JggHAWj.exe
  2⤵
  PID:9652
- C:\Windows\System\vFEuZrB.exe
  C:\Windows\System\vFEuZrB.exe
  2⤵
  PID:9588
- C:\Windows\System\tWzErbi.exe
  C:\Windows\System\tWzErbi.exe
  2⤵
  PID:9568
- C:\Windows\System\UtndQfx.exe
  C:\Windows\System\UtndQfx.exe
  2⤵
  PID:9572
- C:\Windows\System\XIgxyks.exe
  C:\Windows\System\XIgxyks.exe
  2⤵
  PID:9604
- C:\Windows\System\sIrUyoA.exe
  C:\Windows\System\sIrUyoA.exe
  2⤵
  PID:9668
- C:\Windows\System\vTIvCBI.exe
  C:\Windows\System\vTIvCBI.exe
  2⤵
  PID:9748
- C:\Windows\System\QgiLlYq.exe
  C:\Windows\System\QgiLlYq.exe
  2⤵
  PID:9780
- C:\Windows\System\aZULDtp.exe
  C:\Windows\System\aZULDtp.exe
  2⤵
  PID:9844
- C:\Windows\System\sbXbAZv.exe
  C:\Windows\System\sbXbAZv.exe
  2⤵
  PID:9868
- C:\Windows\System\foLAblZ.exe
  C:\Windows\System\foLAblZ.exe
  2⤵
  PID:9872
- C:\Windows\System\iKXZaBG.exe
  C:\Windows\System\iKXZaBG.exe
  2⤵
  PID:9964
- C:\Windows\System\nUYIuYQ.exe
  C:\Windows\System\nUYIuYQ.exe
  2⤵
  PID:9904
- C:\Windows\System\fRpwHVs.exe
  C:\Windows\System\fRpwHVs.exe
  2⤵
  PID:10060
- C:\Windows\System\cKjZwzQ.exe
  C:\Windows\System\cKjZwzQ.exe
  2⤵
  PID:9948
- C:\Windows\System\pPTeSpy.exe
  C:\Windows\System\pPTeSpy.exe
  2⤵
  PID:10128
- C:\Windows\System\uaLGwUF.exe
  C:\Windows\System\uaLGwUF.exe
  2⤵
  PID:9920
- C:\Windows\System\fvEproy.exe
  C:\Windows\System\fvEproy.exe
  2⤵
  PID:10080
- C:\Windows\System\LYBkltR.exe
  C:\Windows\System\LYBkltR.exe
  2⤵
  PID:10016
- C:\Windows\System\eIVYmYz.exe
  C:\Windows\System\eIVYmYz.exe
  2⤵
  PID:10224
- C:\Windows\System\XHmkdzB.exe
  C:\Windows\System\XHmkdzB.exe
  2⤵
  PID:10048
- C:\Windows\System\LpbLsZp.exe
  C:\Windows\System\LpbLsZp.exe
  2⤵
  PID:10172
- C:\Windows\System\YoLheCC.exe
  C:\Windows\System\YoLheCC.exe
  2⤵
  PID:10204
- C:\Windows\System\qXenPnc.exe
  C:\Windows\System\qXenPnc.exe
  2⤵
  PID:9248
- C:\Windows\System\JNFmsDi.exe
  C:\Windows\System\JNFmsDi.exe
  2⤵
  PID:9380
- C:\Windows\System\MBmEpfZ.exe
  C:\Windows\System\MBmEpfZ.exe
  2⤵
  PID:7676
- C:\Windows\System\GJHmWTA.exe
  C:\Windows\System\GJHmWTA.exe
  2⤵
  PID:9364
- C:\Windows\System\EfNigqP.exe
  C:\Windows\System\EfNigqP.exe
  2⤵
  PID:9520
- C:\Windows\System\bOYdldy.exe
  C:\Windows\System\bOYdldy.exe
  2⤵
  PID:9504
- C:\Windows\System\slmgZUL.exe
  C:\Windows\System\slmgZUL.exe
  2⤵
  PID:9712
- C:\Windows\System\pWlduNd.exe
  C:\Windows\System\pWlduNd.exe
  2⤵
  PID:9600
- C:\Windows\System\FyfDdza.exe
  C:\Windows\System\FyfDdza.exe
  2⤵
  PID:9816
- C:\Windows\System\NcHDzcB.exe
  C:\Windows\System\NcHDzcB.exe
  2⤵
  PID:9900
- C:\Windows\System\HAEcksw.exe
  C:\Windows\System\HAEcksw.exe
  2⤵
  PID:9636
- C:\Windows\System\kqpbckI.exe
  C:\Windows\System\kqpbckI.exe
  2⤵
  PID:8868
- C:\Windows\System\BilecGr.exe
  C:\Windows\System\BilecGr.exe
  2⤵
  PID:10236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CNUSyTq.exe

Filesize
1.9MB

MD5
297b63c765edaca056da790589f5809f

SHA1
6d13d14412802d8caa4ee754b200396b546d308b

SHA256
6fa20be0e48a741b8b4ed4a7f721fca4f28626b06fe8129bf002f9455a2a20e8

SHA512
fd5e06dd86c2ccd8c7b5798cf53938cb9eaa9a79d691adfea2b363562acff3c5713bce43a9fccb84295f4d9183f67ec92980151c347f327c377e175890f9fb71

Download Submit
C:\Windows\system\EQmiqYv.exe

Filesize
1.9MB

MD5
fff419b6a375b3e05c83ccd1f3b9aa23

SHA1
c1bf0b72e37183b484f60c2497c35d645248124b

SHA256
e2ade04b9e200ff6ec950b9d29769c321c8e8ca1ed88740de28b706fdac689d2

SHA512
9be68533ad499217f4a35f3037ac659189e3162b2e5c815650f2606b18128136813c64d1f0514ec0bb3fafc25579672cb5c030074c991cca3e06e8ca414ffb33

Download Submit
C:\Windows\system\KZTvFdC.exe

Filesize
1.9MB

MD5
f2b8ad6d3c581e6207d98ae4746e13ce

SHA1
e1c326a4058799e80014d89582a3328eb462e0fd

SHA256
bdf04f843a86463c391664be6713b86decaafe5b2a74e2e32620fcc3c8e5f18c

SHA512
85b204f75e50f9b610ab34ad1ff39aa4c7e9c07303cb5f4571ba3a2cee86bd4358917cc9993c2f701e0aac54ee3d90c2d7ca564b08ae2c9adaf83d0c6316a1dd

Download Submit
C:\Windows\system\LlJEtkw.exe

Filesize
1.9MB

MD5
284a5506ec0b551eadeddb0c29f35d1a

SHA1
39998ac1e4cab89f8de8ec0ec6fff11075291281

SHA256
833c4dba004f40fea9544a955760a0c54edf85c19fdf490edf0d507be0411401

SHA512
2847712ebda5bb4526d0074eb231960d70e09f2f643fc685e44329defe52f8bd7f178da1f3be307866a4e3aaf15aa80744329c4880743f5dd6f2f341b705fe0a

Download Submit
C:\Windows\system\MhgaGkG.exe

Filesize
1.9MB

MD5
e94fd83704ddb2386f33f7cde19decf8

SHA1
077aefec86cf1287a008d78d458f95feb9e571fd

SHA256
e39b0bcc9bce1fa0e522c9ad4220d6065cebad9069c8dbadb46dce3c1e81880e

SHA512
4797c6017b983462b0cd88fe25d526e50123a61011059f4d97c0215802576a0a06fbb64bfcf78cbde55f7aafea6fbec7037dba97d443bb872ecf9d3a1077af87

Download Submit
C:\Windows\system\MmpVGYe.exe

Filesize
1.9MB

MD5
b9ae41a0bccd323ad279facc0c4f7e25

SHA1
d52a9849288c49b25d49f12f5f1199d0faa33d34

SHA256
a4d5654228a996bc93affcb1972b3acdb9573419af8e274b6e78beb82ea7882a

SHA512
057e0111190d71d9836410466a9fa264e190e8a2d2e421fb919ce213b537780fe78c14a1e5810c347c63e3466af0699ed5b32d81950547a2dec1735e0d4f70bc

Download Submit
C:\Windows\system\OTaDYTx.exe

Filesize
1.9MB

MD5
33562c77fcbfa4443e6638e32088aebc

SHA1
6494701a9807bb23bdd18ac750dae2c8aaf7da41

SHA256
05e4341dfc3b227d77a127c0b70f6b7a280afbebf302812871573e8488914a2b

SHA512
93086615cfeeffacc846d22a2a18827d11974919fcebe8a6c88a54785629da07c729da0de5301faf4a74298723cb4bbb92f812bfdf108d80a372005506f879b1

Download Submit
C:\Windows\system\QYcWHSQ.exe

Filesize
1.9MB

MD5
fa6da490ea836b6cc675a643d570a254

SHA1
ec790205ca4c58e57185d330eaeaad8849a8b17b

SHA256
d559c3c20537f29107e47a1ddd0aeac1db5d4ed0d09125862c9bb0d9219f7dd6

SHA512
4f92de82fd2a425c98914a6edd458c7c7d1a886be7f410c69945246a8e76d9116895e73e64395177dc0baf468d45d4ebc993a3661e09ab01b071c714c4c1735a

Download Submit
C:\Windows\system\QZttSZc.exe

Filesize
1.9MB

MD5
fe134f94048da851d1cd905276c5122b

SHA1
fed3796c4a3444938f4a546b59c476415947b6ef

SHA256
a314e7e3b7b4ac25e58370d6b5e07232458301e3acb335e9b84ba65f511a793c

SHA512
e00d8b961bc4a429756209f4d79a8165fb01c1e38fea7264dfc5670756af5b172082e5a4bc20b8da1ad373bf2dcbcacc46b8344bc64a3c82a3a12921699ac1af

Download Submit
C:\Windows\system\cTyOdze.exe

Filesize
1.9MB

MD5
da39a0665df7b8a5c9b2d9df6837a3f9

SHA1
4400c5f8b93639829620fea9c46befa69224f75b

SHA256
ca27495613ae1490f0619106e44e3d23bb29a7c5f30455b5589c371037ddb3d5

SHA512
8abfcb04d4e40cd2ce66ff6003f6981f8b550d594b995f5ff0a1bedd980f576ce40598b4099ca65abcf5fce221f1cb4ab7eb59988555445c028468855523e1ed

Download Submit
C:\Windows\system\ebPbVuG.exe

Filesize
1.9MB

MD5
7d424e7c55ba496ca547aff2ff3614e4

SHA1
26301553035d09d27830002d119b4bbdf700731e

SHA256
e3021bbfb6e21ab208040e2241e06e2eed58f0c5aa31f8e81452e8d9f5aaed3f

SHA512
7f01875d802e184674c60e659c14e0b70940366564562fca635a79f886254d293c98d36c5360eebc7b6cd27e8bdb9fd83f26a73a6d582dc59ab411a3417595b5

Download Submit
C:\Windows\system\hKBiBPH.exe

Filesize
1.9MB

MD5
d43b4cb99f196cd7f53222136b7928ab

SHA1
55d9dd348ade982d321af35a22a59503ee122563

SHA256
3de2b40f145617cc2ef56dffb75bdb764a8dfa75db78deb80f1c286f6754e48b

SHA512
8e490d004cd9531bc61798bec9ec4d93ae353a2f5e165fa55ac712728223d4ecf688283d9514eb0e5d0403f6d5fa4c53b9e618a7f12289d6da0d19bca1d54deb

Download Submit
C:\Windows\system\ndrsCCm.exe

Filesize
1.9MB

MD5
66e71c382f371ee7c22e08e000c1315f

SHA1
84346077891dde2a1443b74cc38255b41d44bdc7

SHA256
cc3efdd6511522dab0e245b8e26d1abd0ddb6c101d1e56553a687833ab0606c3

SHA512
7246cc75e518b1484d5424d70594fde4ff248edc9e63d8ca5c9353923f29ee3b2ca451047e7c3d0cc278d24adf7f441903abc1ae1fdd5c855ae77894149a1c64

Download Submit
C:\Windows\system\uYBdhfU.exe

Filesize
1.9MB

MD5
4c1808174909f024b22c215f2a64b79e

SHA1
b7b33be709cec89bda33b22c6e53986ea9bd9dcb

SHA256
60f6a3ba0475d7c4db9bcf18631408e7d146b00f3255c24d1d009c1b0a5195a6

SHA512
be6073c0cf6d8cbe34b5b6739b7dcc2991b47375bcaf5d9fcd475b129ce0f54fa9a0d2d3545b94ed7033c6805c4367451e7e4acb300353dad2931133048ca272

Download Submit
C:\Windows\system\vYaIdut.exe

Filesize
1.9MB

MD5
937451dc79a8e17887eedf49df0fcca0

SHA1
ac0f9541dfc10cfe0164957dc6a9a3433e449acc

SHA256
dc4befe75edd61c9b2eb80fd7b8ce4d3555ec0f13e1283b66363786e6b0eb141

SHA512
9c37236917c1006a293b229656d4c51228f3bba8b6e470bc251d3699fc656440942a9a10e5dff255db1c6de533e81800a9cbb11c24da95b50c39b682a8e1959e

Download Submit
C:\Windows\system\xWTuKDi.exe

Filesize
1.9MB

MD5
e10b264dead12e2f70c1ce10d724a4b0

SHA1
4cb4612d0ca135cb842a692e1d63267097850f0c

SHA256
aef1ab66e0e3f073a41346ee15e569089942dde7e1f24c252a7b831ee2e518ca

SHA512
fa1373a606ec532873a9ccf2913ed0883e7bf1718990b43e9a94fbe4fdda915bbb0a9b79dec087c4961154956aedbe0587bd22cfebc9126bb8e254a43c67ddc7

Download Submit
C:\Windows\system\yIyumLO.exe

Filesize
1.9MB

MD5
ea049e012267e61b2941543017bff2f4

SHA1
b03b07251086364e4f94cf335ea2d4e886bf3344

SHA256
e6e8df93f04f55d88967cd8fe6408fb777d580b9f1444951e25796bf73e1bd77

SHA512
fb64970bda6bb50db801f5d80ea492c8f7e5b141dbba29312dbf7c81d080b65d51a7c852f9c72531a9b62903b75be859a4de72f28ad874f530ef4e8bc13b5a6d

Download Submit
C:\Windows\system\zJfyWJT.exe

Filesize
1.9MB

MD5
d29f96e6106d55129c7a4929cbf8a1cb

SHA1
377c0033dafb0eaec4b012ec94012d21387f7ccf

SHA256
c384ed8ea62685e47956a6e0be712636b716373da997bf31fabc0277843cd5df

SHA512
5ba6d9afa7d2c02b558df5b3b57a143d31992732a310f856625594072c44f88080e4b9264ded72fbaf7796759242e9ed873a108a3bc453ebbccf90334df2b4ca

Download Submit
C:\Windows\system\zMOlmQo.exe

Filesize
1.9MB

MD5
940b523b9cdd6a67bbd6b7a20a516970

SHA1
1343d62a1e08a8b8c6fcbbf4156812590500a217

SHA256
ba210a9790509b9f7a0b5b2e4d0440bb3728f911b1ea0cfe44e22469ce0388ad

SHA512
3888da61d71177323dd1e74aa7b70c94b4634d3691e8ab2a122bd0911710d2ea68e23c0de1f067dca51e634e4c76f0f07da0ef1c6b5d1c82f6c4b87cc9f14550

Download Submit
\Windows\system\BOaievA.exe

Filesize
1.9MB

MD5
709984683d2974d4ce940962d06a84fa

SHA1
64fd0f6e3f932ed1770c7a36e3a66ae0ba6a18c1

SHA256
faf24fe1531984e03680d9847c1e46caf0d995920d60efa0ffffa55b0f165222

SHA512
6093c4a6409aee8d312eb970ba62c70b5cdc255700cec19c7b333d7cda90fc5592fca4f3af118973dfec9bcfecfec720655d5f8bd655c788b43252761951f037

Download Submit
\Windows\system\BPOFHbS.exe

Filesize
1.9MB

MD5
304da44df69e4cafd5476006d2e6ea10

SHA1
d92af358bfbdd74162dcad3788a4fc7044b62cc8

SHA256
72e9c02aaf3d829ca47c8e9a8f6390e9cc29f96e84776f8f5f514c726df7e49e

SHA512
b6985b3406506bc99bfff874ca1700e3dc9033f5a70673387e2bb5b7376cf3bd02df0c4ebfdf0606dfcc9b1ff059d693bce3a57a1d9bb4ef941fefba66cf55ab

Download Submit
\Windows\system\IpNVQxR.exe

Filesize
1.9MB

MD5
839d327c7e6e6cb186131b391f15865c

SHA1
3e584a906d09613e0efb0213e0ce1caa990966f4

SHA256
39cf39169914e349a6ef5c0425e6996d98368105d3a330e370c87aaf0eccc827

SHA512
85ce5ef2ea122fe1500010320a4d39ca06a7a60a459b4f19ede70e046c2a046b35812c50befbb9b0a7ff96a332e081f5daa236a619f7ee378d62f2a6300e8943

Download Submit
\Windows\system\RJSgvkf.exe

Filesize
1.9MB

MD5
13c0e2431a401a0c87b946ef0fead971

SHA1
9c307f6ace3e99ef943f6d657635b10566114fdb

SHA256
586149935a311f9c3ae3a5efb558fe02162d31683e826b127b9c81d0fab5ed78

SHA512
dbea777c7cd6127f5bf6dc4a7c5374a27df3a52f6912b1f3d816ea581c9eb8089d7adf6892558535c597d5273a2b128c69aac3565b9b11696aa42a773d84476f

Download Submit
\Windows\system\TwknPMk.exe

Filesize
1.9MB

MD5
0b1985c6a1171f5e5c19929c343597eb

SHA1
b014b7d9af953d1071a591fde917cf069fd865b2

SHA256
c97629e236912f2a269be030352b605bbe9655c3714a0bf39eaadb550379626a

SHA512
5fdfab81d4510ac11145ef6e5aef289e999cbc064c8598647c9d991a3c4808aecab1c0c143aa69e97436f3bccd2edbb3f59bdd442017053f5dad40eacff5efd6

Download Submit
\Windows\system\XJyLeYZ.exe

Filesize
1.9MB

MD5
70b68686eaf23318edba0841eee426d3

SHA1
9282070684eebab9d609307bc259708081558e49

SHA256
038822ea160115740d3eeee2084df54b002894cd8e6939c5d62acf91c9704dee

SHA512
e3bc74ff5b383af6b477b927c9a00d1964b41543a1008e604544b3710025527d787f734c656c3e11b5709f6328e70381e3b6701956315b427279ac5e5d836ccc

Download Submit
\Windows\system\YUYYGAU.exe

Filesize
1.9MB

MD5
22ca91a16eb65da016017c75ed73eff7

SHA1
15b033d45276950e3d9a7ba183a89ebcba84da0c

SHA256
e504daaa63b3be7a30de0d9dd7a77cc33ef56da3cc53f74b339cbf8b903e5d13

SHA512
875480bcc7ddccf78eaf8cbecfe45ba8522054b676c242b28e9d5a90af668b863360bf9eb048109006e6f9efe0d175bcaec44c11653b4549c3bcb0fc1f473bac

Download Submit
\Windows\system\aKfSuvR.exe

Filesize
1.9MB

MD5
6ce47e9b7d196dc8e8fd6a40f29856f5

SHA1
3fee9f86e80985e9805216267c25f0b7288453e9

SHA256
377f976a4b3ee02feacc808baa8dbe6106e0c0bde1f8d36bd043dc5d4bc0123e

SHA512
712cac588509a996e8775d273da5812b0d943edb957b89bf871199e5416c93f2293c905c89a4d4bc2b7370e999450524d2d1e513304e6f54d2d6dad6a168a565

Download Submit
\Windows\system\bdeUQbj.exe

Filesize
1.9MB

MD5
03b7fa74671342bc52543bcb6666c19d

SHA1
0041f42147b9d1dff7c6ef4e70fab270e9f71390

SHA256
cdb83586a7b97a13e128cafc4c259bc0778479e31efd2de558d464c6fea81ff6

SHA512
151241a315990898f8253e5fcb9ccfedb23f44ca6f24fb468e90ce9bc23da6a528b77da89b56e1eda2e2a4d03571c872a2b77324449a1c10857a6b2f747b79e9

Download Submit
\Windows\system\bjkaZXt.exe

Filesize
1.9MB

MD5
698cfe8ecc31614c8945488e3c9b44af

SHA1
cd56f0b4aba4f21430d43a0f444e6596fb37798f

SHA256
ab5c57445b2ac4e6a1cb095c11a439214eda9e23c281ff7ee2f43f23620d38f4

SHA512
b00c8721f9e86e8dc6e5854ea2ae40ab3769b713a6614bf6de96e7af2181351f5c8da2cc9a1a7fa9fe5af1ae39a8b7865c6b783ad50bf2c87a971a094e6a61a6

Download Submit
\Windows\system\cKaWSSn.exe

Filesize
1.9MB

MD5
401b3112ff06386e184412896d5a2a25

SHA1
691631e67dfe7c91fd08badae7b94462e8fc3e7d

SHA256
66b4c26a6655463467f13b1f2e11451278bc093e14b83d5ec8f2a1632e9dc343

SHA512
8e727ce04835b5d7f697ddf62fc25ae2330481fb2cfb9b73c909b6574233ad8cc07d14707a23dba7ff55411386e6d9eabed004e18b0d9ab6b9930bdcd4b4eb62

Download Submit
\Windows\system\dILekrT.exe

Filesize
1.9MB

MD5
b1bf4d4d662a9769711c469ef250bc9c

SHA1
00b12a2afaf671c0a3ac4e8aeb793ab150b5c113

SHA256
9950da43d73e657c32b85e70e05d1df956827be3deea05735b279947dcd91146

SHA512
40630d0e9b63597eaf07f896d5d00e3cc492bec549426a6892e014c4ce8bc297fc0565174fd5bf32c7cdc78ad7780bdf56c2bde6836c070eff1301724c3d526c

Download Submit
\Windows\system\hDdTsZo.exe

Filesize
1.9MB

MD5
8781e92c4c842dc0d88f8b0001683c3c

SHA1
811fa990f731e1e97cce411100f35e3556fd914f

SHA256
7a5fe79195ea154b67b2b7c3806adaacb36745c50517dcf6f3e92d1338b5a04c

SHA512
cc3bfc734262e823c974a7a73204a8638c9842a5e48a1366945cceaa866d32d31f2a90ff3d299362ac7c4f629c8e5d118f96251dcb1862ed54631df7cf69247f

Download Submit
\Windows\system\joTUKsi.exe

Filesize
1.9MB

MD5
3fe2fbb499451056600137e422202065

SHA1
2cc99c3a9b79f49bb5325e80d7cbf60d6a979548

SHA256
b36648c470cc224be3481ad8f2bb516496f060d77bb65da6f478e2397c5a5b19

SHA512
3fffe1c2bbe393815367a8509e0a5bb191c83fe91d5bccec1e86227cb948a33a856aab25b141b08af4e1f47595bc012e485d600832b1c8d21aa7d8daf33790f2

Download Submit
\Windows\system\kllLdDk.exe

Filesize
1.9MB

MD5
c0372afce5740dc4f98c9b18221aadcf

SHA1
793674c387518f2f56be54e66ab267a33e573f56

SHA256
f5933bc30850623cd8019c2b7f2759984ee3eb21b9a479c0395172ee32acb166

SHA512
1dbdd72737aaaccd28439024178b5106629905c5bf35d3618cddacf6d0dd7355a8a39b2246b7c9198b3c47dea9553806b5ae3b0b846ea6315293e5b4850bcb8d

Download Submit
\Windows\system\lKQUFTZ.exe

Filesize
1.9MB

MD5
43e6324745723f915704ab1ccc635145

SHA1
aac40eced2877bda62256b81f0fe3d257b2ad747

SHA256
807ef164cd56603a216b1784abf870cab94b205ba374a835f355102e5d687770

SHA512
9a5502dc71e6aedde8f8e15bf82168ed06d4eedb6275c26ba06e6cba20a8bcc97c4d5a5657c0978201afb38f4852511a5757ba68dedaef76e81b7834f2ddca6d

Download Submit
\Windows\system\lzOXApF.exe

Filesize
1.9MB

MD5
2678e770c9f81e04248f64ac486d41f3

SHA1
307bcdcd8dc2642610d54f38fe7c58094a1764f8

SHA256
bb15a2e2c5f6ab9aadb33053b0fa896b6312ecd55110604574efa4fcf0e777f8

SHA512
2914bbfddcbd39e80e0b20d39ed8fbf911703633484ef51c3e159cf9522f672919dcfe564c03f6e18916bbab305ba2965a7ebeb7b973009b1024098ef8fc8caf

Download Submit
\Windows\system\mMPBihi.exe

Filesize
1.9MB

MD5
0703723def2c98e5963e9be0a4c9aa1c

SHA1
3e5b0af75b9590919857788f0d7ae0761f826c92

SHA256
23519c0429ef420f57987cad5d7295e6b66849d0df0eceba1c66a5f8894554f7

SHA512
4cb8aaf79ee1e4cb0081bf3532e72e05112df6cbdf3267de28cdce7ce079c7aa7c3a524b04af0ae7f534d927cdd73c6c349a99c348043384dd2711c4db754c32

Download Submit
\Windows\system\ukqZCBI.exe

Filesize
1.9MB

MD5
770ce100d0bc98200b7f5dbc77186791

SHA1
a3fc7d734fc66bc3d0fedd5edaa303caa970548c

SHA256
149c37abe626a264a9096ba3e42a1591efa4d304476388d5665c36041ad48092

SHA512
b2faf5dfec2f165fbf7ec268574551c9db5dd5577d3193dd385659c5c5077f104d6fe7f6fbcfb2108c7f72270df94e9b16e80d3f547ab7bef77585f72c1807a4

Download Submit
\Windows\system\ulBftkH.exe

Filesize
1.9MB

MD5
f0e06326a8b922ce758777aed921954b

SHA1
455fc97f5b69946a4cf27de6c670f3d92011c14e

SHA256
6a5ce4bb4b472e6e67b8ce34151ce50a796336f9fa423fe564e4f5b84b1d503b

SHA512
29528917ca140d8ed932670c73104a1831083b5171d5a51c5a7b2144cf2fbf64d8942523a7d6c08a268aa390c8646371ed9a7004826376a9a1b496627b3c3c4f

Download Submit
memory/1036-75-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2112-7-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-36-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2112-57-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2112-71-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2112-30-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-51-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2112-83-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2112-1-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2112-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2112-46-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2112-56-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2112-93-0x0000000003480000-0x0000000003872000-memory.dmp

Filesize
3.9MB

Download
memory/2112-18-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-74-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-41-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-28-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-32-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2192-29-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2192-81-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-346-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-33-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-34-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-26-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2192-70-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-80-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-25-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/2192-73-0x0000000002AE0000-0x0000000002B60000-memory.dmp

Filesize
512KB

Download
memory/2380-62-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2468-31-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-40-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2488-342-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-65-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2644-64-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-8-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-19-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-67-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2680-47-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2756-84-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download