xmrig | 40ff4511f21d942351ec84bbd58ab93031ebceff24895c4ded471b2bccd88e3e

Analysis

max time kernel
6s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Size

2.3MB
MD5

099afeb55ae7d1d3e728ab46d93e3b71
SHA1

ceddd02f71a1de5e5f656cc80fddc0553382a96a
SHA256

40ff4511f21d942351ec84bbd58ab93031ebceff24895c4ded471b2bccd88e3e
SHA512

e7f5bb48a6cafbf456514204375b7c1d559437d9649ae5b0b73c6d864ab16ac7e3c6d1c7f82ca0f31f26b6c54e811601185188f93a0e791b9c54cc9456742e21
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aDisy:NAB5

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1748-18-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/820-42-0x000000013F550000-0x000000013F942000-memory.dmp	xmrig
behavioral1/memory/2516-137-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2608-155-0x000000013F980000-0x000000013FD72000-memory.dmp	xmrig
behavioral1/memory/1888-160-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2116-154-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2160-139-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2732-136-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2800-84-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2596-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2676-65-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1748	gREtpWq.exe
820	aBsuuiv.exe
2116	CUDBQAU.exe
2676	AVAFcdW.exe
2608	OALeKXg.exe
2596	kYAPTMr.exe
2800	uHmmrZy.exe
2732	nldveJE.exe
2516	VSWUmRk.exe
2160	ojtmueX.exe
1888	FafPXhS.exe
2692	tTGAVUv.exe
2752	GhRAPKY.exe
2352	JuqSGeY.exe
2964	KnfIhmP.exe
1364	KlxFLax.exe
856	GmTjxfG.exe
2640	TjlqPvS.exe
1676	wMsyqse.exe
1128	ZPEKkru.exe
2968	WxsVPAd.exe
2192	ajDHxmP.exe
1960	IcFEDCz.exe
2704	kodiPaz.exe
2900	qiNDczM.exe
2952	FjsLdPI.exe
2060	jpnfrVu.exe
1432	knIFhhE.exe
848	gsMOJLW.exe
1100	mfRzwfv.exe
1940	tHcSWRL.exe
2920	TQezKRz.exe
1992	WpDGYpI.exe
2428	ZsJvjMT.exe
1560	dMTxYNU.exe
1692	MzzCWQc.exe
1176	vuplqBx.exe
632	pgWYUEg.exe
1056	dTIqkHg.exe
1116	DLioLOr.exe
1064	ezQfFwe.exe
2284	ZqUvMqO.exe
1944	pzhZsjZ.exe
2200	lhArcID.exe
564	OCLAwuW.exe
1900	vCUOlTY.exe
1752	evbUZtt.exe
1780	GlmLivL.exe
968	qaklRaM.exe
2860	ZWvzQFv.exe
908	wHZroSD.exe
2408	QxcoUaC.exe
1736	HIBFzGZ.exe
2572	VAtWQvQ.exe
2716	cObpapP.exe
2484	RGFtTgm.exe
2768	YRyivti.exe
2804	vpPZlHX.exe
2504	QvnCBXC.exe
2960	unTcACy.exe
2420	kwEHKLh.exe
2772	mJXZKTJ.exe
1656	ltKESad.exe
3032	oWhRlhN.exe

Loads dropped DLL 64 IoCs

pid	Process
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2216-5-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x000b000000015605-6.dat	upx
behavioral1/memory/1748-18-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x0007000000015cf6-24.dat	upx
behavioral1/files/0x0007000000015cee-26.dat	upx
behavioral1/memory/820-42-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x0007000000015d31-50.dat	upx
behavioral1/files/0x0006000000015f01-68.dat	upx
behavioral1/files/0x0006000000016287-125.dat	upx
behavioral1/memory/2516-137-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/files/0x00060000000165ae-150.dat	upx
behavioral1/memory/2608-155-0x000000013F980000-0x000000013FD72000-memory.dmp	upx
behavioral1/files/0x0006000000016a29-161.dat	upx
behavioral1/files/0x0009000000015c9f-189.dat	upx
behavioral1/files/0x0006000000016cc6-185.dat	upx
behavioral1/files/0x0006000000016cbe-179.dat	upx
behavioral1/files/0x0006000000016ca5-170.dat	upx
behavioral1/files/0x0006000000016c51-168.dat	upx
behavioral1/files/0x0006000000016bfb-165.dat	upx
behavioral1/files/0x0006000000016cb6-174.dat	upx
behavioral1/files/0x0006000000016c04-131.dat	upx
behavioral1/files/0x0006000000016be2-130.dat	upx
behavioral1/files/0x0006000000015f7a-119.dat	upx
behavioral1/memory/1888-160-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/memory/2116-154-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0006000000016448-145.dat	upx
behavioral1/files/0x0006000000016176-143.dat	upx
behavioral1/memory/2160-139-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0006000000016c7c-138.dat	upx
behavioral1/memory/2732-136-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x00060000000167d5-127.dat	upx
behavioral1/files/0x000600000001650c-126.dat	upx
behavioral1/files/0x00060000000160af-94.dat	upx
behavioral1/files/0x0006000000015df1-87.dat	upx
behavioral1/memory/2800-84-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/memory/2596-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0008000000015d27-70.dat	upx
behavioral1/files/0x0007000000015d98-67.dat	upx
behavioral1/files/0x000f000000005578-66.dat	upx
behavioral1/memory/2676-65-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x000a000000015cfe-31.dat	upx
behavioral1/files/0x0009000000015d07-41.dat	upx
behavioral1/files/0x0008000000015cce-23.dat	upx
behavioral1/files/0x0009000000015c78-14.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DLioLOr.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ltKESad.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\uXTPmRN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\zkpmmNN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\lhArcID.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ghUkJPn.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\PqEsXcY.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\FwKBeNr.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YhdVIni.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\WVIBMnT.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\FjsLdPI.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\WxsVPAd.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YRyivti.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\KqfSsMl.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\bCXPBUt.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\WkbwJlk.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ouanRYN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\afEURKZ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kGsvWxz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\rmaWVUP.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\SzevIBQ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kwEHKLh.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\SrfGPre.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\BJFiXTT.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\qOLHcUo.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\eOsAczg.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\zsvkdjW.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\LBSnqvR.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\QleNboE.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\EbTeflY.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\rvwyixA.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\PzVcomN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\mbJcvbX.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\yIYgivR.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\nVMAZoI.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\wfgTENC.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\qiNDczM.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\QvnCBXC.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\LNiUoRz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\snbIWYb.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\jwUbFls.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ezwLAJD.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\OALeKXg.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\HIBFzGZ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\biApdVH.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YTvtGaU.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\WyRicEn.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\yCnagDh.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\xsaJJeQ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\aBsuuiv.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ytGAIHr.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\ZGreEdL.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\rakafWN.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\VghiFxg.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\LULQQok.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\kodiPaz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\yxeMSuX.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\CcySsyZ.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\wCVueDU.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\DMqmwwz.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\MGJzHVr.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\sbYBXOD.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\EwBKDCv.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
File created	C:\Windows\System\YrPJccf.exe	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2644	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
Token: SeDebugPrivilege	2644	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2644	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2644	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	29
PID 2216 wrote to memory of 2644	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	29
PID 2216 wrote to memory of 1748	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	30
PID 2216 wrote to memory of 1748	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	30
PID 2216 wrote to memory of 1748	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	30
PID 2216 wrote to memory of 820	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	31
PID 2216 wrote to memory of 820	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	31
PID 2216 wrote to memory of 820	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	31
PID 2216 wrote to memory of 2116	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2116	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2116	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	32
PID 2216 wrote to memory of 2608	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2608	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2608	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	33
PID 2216 wrote to memory of 2676	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2676	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2676	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	34
PID 2216 wrote to memory of 2596	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2596	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2596	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	35
PID 2216 wrote to memory of 2800	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2800	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	36
PID 2216 wrote to memory of 2800	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	36
PID 2216 wrote to memory of 1888	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	37
PID 2216 wrote to memory of 1888	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	37
PID 2216 wrote to memory of 1888	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	37
PID 2216 wrote to memory of 2732	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2732	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2732	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	38
PID 2216 wrote to memory of 2692	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2692	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2692	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	39
PID 2216 wrote to memory of 2516	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2516	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2516	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	40
PID 2216 wrote to memory of 2752	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2752	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2752	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	41
PID 2216 wrote to memory of 2160	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	42
PID 2216 wrote to memory of 2160	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	42
PID 2216 wrote to memory of 2160	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	42
PID 2216 wrote to memory of 2964	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	43
PID 2216 wrote to memory of 2964	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	43
PID 2216 wrote to memory of 2964	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	43
PID 2216 wrote to memory of 2352	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2352	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2352	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	44
PID 2216 wrote to memory of 2192	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	45
PID 2216 wrote to memory of 2192	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	45
PID 2216 wrote to memory of 2192	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	45
PID 2216 wrote to memory of 1364	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1364	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1364	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	46
PID 2216 wrote to memory of 1960	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1960	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	47
PID 2216 wrote to memory of 1960	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	47
PID 2216 wrote to memory of 856	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	48
PID 2216 wrote to memory of 856	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	48
PID 2216 wrote to memory of 856	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	48
PID 2216 wrote to memory of 2704	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	49
PID 2216 wrote to memory of 2704	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	49
PID 2216 wrote to memory of 2704	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	49
PID 2216 wrote to memory of 2640	2216	099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\099afeb55ae7d1d3e728ab46d93e3b71_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\System\gREtpWq.exe
  C:\Windows\System\gREtpWq.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\aBsuuiv.exe
  C:\Windows\System\aBsuuiv.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\CUDBQAU.exe
  C:\Windows\System\CUDBQAU.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\OALeKXg.exe
  C:\Windows\System\OALeKXg.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\AVAFcdW.exe
  C:\Windows\System\AVAFcdW.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\kYAPTMr.exe
  C:\Windows\System\kYAPTMr.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\uHmmrZy.exe
  C:\Windows\System\uHmmrZy.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\FafPXhS.exe
  C:\Windows\System\FafPXhS.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\nldveJE.exe
  C:\Windows\System\nldveJE.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\tTGAVUv.exe
  C:\Windows\System\tTGAVUv.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\VSWUmRk.exe
  C:\Windows\System\VSWUmRk.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\GhRAPKY.exe
  C:\Windows\System\GhRAPKY.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\ojtmueX.exe
  C:\Windows\System\ojtmueX.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\KnfIhmP.exe
  C:\Windows\System\KnfIhmP.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\JuqSGeY.exe
  C:\Windows\System\JuqSGeY.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\ajDHxmP.exe
  C:\Windows\System\ajDHxmP.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\KlxFLax.exe
  C:\Windows\System\KlxFLax.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\IcFEDCz.exe
  C:\Windows\System\IcFEDCz.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\GmTjxfG.exe
  C:\Windows\System\GmTjxfG.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\kodiPaz.exe
  C:\Windows\System\kodiPaz.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\TjlqPvS.exe
  C:\Windows\System\TjlqPvS.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\qiNDczM.exe
  C:\Windows\System\qiNDczM.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\wMsyqse.exe
  C:\Windows\System\wMsyqse.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\FjsLdPI.exe
  C:\Windows\System\FjsLdPI.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\ZPEKkru.exe
  C:\Windows\System\ZPEKkru.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\jpnfrVu.exe
  C:\Windows\System\jpnfrVu.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\WxsVPAd.exe
  C:\Windows\System\WxsVPAd.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\knIFhhE.exe
  C:\Windows\System\knIFhhE.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\gsMOJLW.exe
  C:\Windows\System\gsMOJLW.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\mfRzwfv.exe
  C:\Windows\System\mfRzwfv.exe
  2⤵
  - Executes dropped EXE
  PID:1100
- C:\Windows\System\tHcSWRL.exe
  C:\Windows\System\tHcSWRL.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\TQezKRz.exe
  C:\Windows\System\TQezKRz.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\WpDGYpI.exe
  C:\Windows\System\WpDGYpI.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\ZsJvjMT.exe
  C:\Windows\System\ZsJvjMT.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\dMTxYNU.exe
  C:\Windows\System\dMTxYNU.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\MzzCWQc.exe
  C:\Windows\System\MzzCWQc.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\vuplqBx.exe
  C:\Windows\System\vuplqBx.exe
  2⤵
  - Executes dropped EXE
  PID:1176
- C:\Windows\System\pgWYUEg.exe
  C:\Windows\System\pgWYUEg.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\dTIqkHg.exe
  C:\Windows\System\dTIqkHg.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\DLioLOr.exe
  C:\Windows\System\DLioLOr.exe
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Windows\System\ezQfFwe.exe
  C:\Windows\System\ezQfFwe.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\ZqUvMqO.exe
  C:\Windows\System\ZqUvMqO.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\pzhZsjZ.exe
  C:\Windows\System\pzhZsjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\lhArcID.exe
  C:\Windows\System\lhArcID.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\OCLAwuW.exe
  C:\Windows\System\OCLAwuW.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\vCUOlTY.exe
  C:\Windows\System\vCUOlTY.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\evbUZtt.exe
  C:\Windows\System\evbUZtt.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\ZWvzQFv.exe
  C:\Windows\System\ZWvzQFv.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\GlmLivL.exe
  C:\Windows\System\GlmLivL.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\wHZroSD.exe
  C:\Windows\System\wHZroSD.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\qaklRaM.exe
  C:\Windows\System\qaklRaM.exe
  2⤵
  - Executes dropped EXE
  PID:968
- C:\Windows\System\QxcoUaC.exe
  C:\Windows\System\QxcoUaC.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\HIBFzGZ.exe
  C:\Windows\System\HIBFzGZ.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\oWhRlhN.exe
  C:\Windows\System\oWhRlhN.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\VAtWQvQ.exe
  C:\Windows\System\VAtWQvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\bKnKUGm.exe
  C:\Windows\System\bKnKUGm.exe
  2⤵
  PID:2568
- C:\Windows\System\cObpapP.exe
  C:\Windows\System\cObpapP.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\KwegYod.exe
  C:\Windows\System\KwegYod.exe
  2⤵
  PID:2488
- C:\Windows\System\RGFtTgm.exe
  C:\Windows\System\RGFtTgm.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\ikzSsbN.exe
  C:\Windows\System\ikzSsbN.exe
  2⤵
  PID:2512
- C:\Windows\System\YRyivti.exe
  C:\Windows\System\YRyivti.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\YWgsNdl.exe
  C:\Windows\System\YWgsNdl.exe
  2⤵
  PID:1788
- C:\Windows\System\vpPZlHX.exe
  C:\Windows\System\vpPZlHX.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\mgEOQXw.exe
  C:\Windows\System\mgEOQXw.exe
  2⤵
  PID:1896
- C:\Windows\System\QvnCBXC.exe
  C:\Windows\System\QvnCBXC.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\vXmNNGF.exe
  C:\Windows\System\vXmNNGF.exe
  2⤵
  PID:1860
- C:\Windows\System\unTcACy.exe
  C:\Windows\System\unTcACy.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\tRkagbj.exe
  C:\Windows\System\tRkagbj.exe
  2⤵
  PID:2324
- C:\Windows\System\kwEHKLh.exe
  C:\Windows\System\kwEHKLh.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\Rxpjbqq.exe
  C:\Windows\System\Rxpjbqq.exe
  2⤵
  PID:380
- C:\Windows\System\mJXZKTJ.exe
  C:\Windows\System\mJXZKTJ.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\IorvZxJ.exe
  C:\Windows\System\IorvZxJ.exe
  2⤵
  PID:2296
- C:\Windows\System\ltKESad.exe
  C:\Windows\System\ltKESad.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\rpfIsDx.exe
  C:\Windows\System\rpfIsDx.exe
  2⤵
  PID:1740
- C:\Windows\System\BPwxybJ.exe
  C:\Windows\System\BPwxybJ.exe
  2⤵
  PID:1092
- C:\Windows\System\WWbuSsh.exe
  C:\Windows\System\WWbuSsh.exe
  2⤵
  PID:1068
- C:\Windows\System\TLiSzyV.exe
  C:\Windows\System\TLiSzyV.exe
  2⤵
  PID:972
- C:\Windows\System\ghUkJPn.exe
  C:\Windows\System\ghUkJPn.exe
  2⤵
  PID:1288
- C:\Windows\System\RoWcAyb.exe
  C:\Windows\System\RoWcAyb.exe
  2⤵
  PID:240
- C:\Windows\System\nhTghpL.exe
  C:\Windows\System\nhTghpL.exe
  2⤵
  PID:2380
- C:\Windows\System\nyHylaa.exe
  C:\Windows\System\nyHylaa.exe
  2⤵
  PID:784
- C:\Windows\System\gKcwDjF.exe
  C:\Windows\System\gKcwDjF.exe
  2⤵
  PID:2636
- C:\Windows\System\jLWwkzO.exe
  C:\Windows\System\jLWwkzO.exe
  2⤵
  PID:1912
- C:\Windows\System\tWqAlck.exe
  C:\Windows\System\tWqAlck.exe
  2⤵
  PID:1728
- C:\Windows\System\tQVQpsw.exe
  C:\Windows\System\tQVQpsw.exe
  2⤵
  PID:2212
- C:\Windows\System\PqEsXcY.exe
  C:\Windows\System\PqEsXcY.exe
  2⤵
  PID:2944
- C:\Windows\System\KnsDtSf.exe
  C:\Windows\System\KnsDtSf.exe
  2⤵
  PID:2448
- C:\Windows\System\ytGAIHr.exe
  C:\Windows\System\ytGAIHr.exe
  2⤵
  PID:2236
- C:\Windows\System\pXghMlO.exe
  C:\Windows\System\pXghMlO.exe
  2⤵
  PID:2368
- C:\Windows\System\FMtthah.exe
  C:\Windows\System\FMtthah.exe
  2⤵
  PID:3016
- C:\Windows\System\unMpNAS.exe
  C:\Windows\System\unMpNAS.exe
  2⤵
  PID:2584
- C:\Windows\System\NYhIPFi.exe
  C:\Windows\System\NYhIPFi.exe
  2⤵
  PID:2552
- C:\Windows\System\zfaHXUj.exe
  C:\Windows\System\zfaHXUj.exe
  2⤵
  PID:1164
- C:\Windows\System\xJpUjhx.exe
  C:\Windows\System\xJpUjhx.exe
  2⤵
  PID:2796
- C:\Windows\System\hlvATtD.exe
  C:\Windows\System\hlvATtD.exe
  2⤵
  PID:448
- C:\Windows\System\yxeMSuX.exe
  C:\Windows\System\yxeMSuX.exe
  2⤵
  PID:844
- C:\Windows\System\tbxxfbY.exe
  C:\Windows\System\tbxxfbY.exe
  2⤵
  PID:3036
- C:\Windows\System\SrfGPre.exe
  C:\Windows\System\SrfGPre.exe
  2⤵
  PID:1768
- C:\Windows\System\AMrfhCT.exe
  C:\Windows\System\AMrfhCT.exe
  2⤵
  PID:2700
- C:\Windows\System\VtvQwBG.exe
  C:\Windows\System\VtvQwBG.exe
  2⤵
  PID:3008
- C:\Windows\System\hEXZWvU.exe
  C:\Windows\System\hEXZWvU.exe
  2⤵
  PID:2908
- C:\Windows\System\BJFiXTT.exe
  C:\Windows\System\BJFiXTT.exe
  2⤵
  PID:3004
- C:\Windows\System\NQSmZxw.exe
  C:\Windows\System\NQSmZxw.exe
  2⤵
  PID:3088
- C:\Windows\System\lDnYtMw.exe
  C:\Windows\System\lDnYtMw.exe
  2⤵
  PID:3104
- C:\Windows\System\cKyOzEO.exe
  C:\Windows\System\cKyOzEO.exe
  2⤵
  PID:3124
- C:\Windows\System\FwKBeNr.exe
  C:\Windows\System\FwKBeNr.exe
  2⤵
  PID:3144
- C:\Windows\System\nItYPmx.exe
  C:\Windows\System\nItYPmx.exe
  2⤵
  PID:3160
- C:\Windows\System\CcySsyZ.exe
  C:\Windows\System\CcySsyZ.exe
  2⤵
  PID:3176
- C:\Windows\System\afEURKZ.exe
  C:\Windows\System\afEURKZ.exe
  2⤵
  PID:3192
- C:\Windows\System\OLKHXUy.exe
  C:\Windows\System\OLKHXUy.exe
  2⤵
  PID:3212
- C:\Windows\System\RmWRHDr.exe
  C:\Windows\System\RmWRHDr.exe
  2⤵
  PID:3232
- C:\Windows\System\IQVWeUb.exe
  C:\Windows\System\IQVWeUb.exe
  2⤵
  PID:3252
- C:\Windows\System\ZGreEdL.exe
  C:\Windows\System\ZGreEdL.exe
  2⤵
  PID:3268
- C:\Windows\System\vGsmpBq.exe
  C:\Windows\System\vGsmpBq.exe
  2⤵
  PID:3288
- C:\Windows\System\XQLGdNE.exe
  C:\Windows\System\XQLGdNE.exe
  2⤵
  PID:3312
- C:\Windows\System\ovAdKiU.exe
  C:\Windows\System\ovAdKiU.exe
  2⤵
  PID:3328
- C:\Windows\System\OsnlgHj.exe
  C:\Windows\System\OsnlgHj.exe
  2⤵
  PID:3348
- C:\Windows\System\YLbMEQR.exe
  C:\Windows\System\YLbMEQR.exe
  2⤵
  PID:3364
- C:\Windows\System\LNiUoRz.exe
  C:\Windows\System\LNiUoRz.exe
  2⤵
  PID:3384
- C:\Windows\System\AWcrwka.exe
  C:\Windows\System\AWcrwka.exe
  2⤵
  PID:3400
- C:\Windows\System\wJMkHqp.exe
  C:\Windows\System\wJMkHqp.exe
  2⤵
  PID:3420
- C:\Windows\System\eezMkRO.exe
  C:\Windows\System\eezMkRO.exe
  2⤵
  PID:3440
- C:\Windows\System\PnbOAYy.exe
  C:\Windows\System\PnbOAYy.exe
  2⤵
  PID:3460
- C:\Windows\System\wbdiwKB.exe
  C:\Windows\System\wbdiwKB.exe
  2⤵
  PID:3476
- C:\Windows\System\GSAqFwp.exe
  C:\Windows\System\GSAqFwp.exe
  2⤵
  PID:3492
- C:\Windows\System\wCVueDU.exe
  C:\Windows\System\wCVueDU.exe
  2⤵
  PID:3508
- C:\Windows\System\unhPqhH.exe
  C:\Windows\System\unhPqhH.exe
  2⤵
  PID:3524
- C:\Windows\System\rwStfwD.exe
  C:\Windows\System\rwStfwD.exe
  2⤵
  PID:3540
- C:\Windows\System\udxIPOy.exe
  C:\Windows\System\udxIPOy.exe
  2⤵
  PID:3556
- C:\Windows\System\vbYrRXm.exe
  C:\Windows\System\vbYrRXm.exe
  2⤵
  PID:3572
- C:\Windows\System\BAzjlRa.exe
  C:\Windows\System\BAzjlRa.exe
  2⤵
  PID:3596
- C:\Windows\System\hjLfFWq.exe
  C:\Windows\System\hjLfFWq.exe
  2⤵
  PID:3612
- C:\Windows\System\biApdVH.exe
  C:\Windows\System\biApdVH.exe
  2⤵
  PID:3628
- C:\Windows\System\YTvtGaU.exe
  C:\Windows\System\YTvtGaU.exe
  2⤵
  PID:3644
- C:\Windows\System\DMqmwwz.exe
  C:\Windows\System\DMqmwwz.exe
  2⤵
  PID:3660
- C:\Windows\System\pFobEFj.exe
  C:\Windows\System\pFobEFj.exe
  2⤵
  PID:3680
- C:\Windows\System\kGsvWxz.exe
  C:\Windows\System\kGsvWxz.exe
  2⤵
  PID:3700
- C:\Windows\System\RiDrZbd.exe
  C:\Windows\System\RiDrZbd.exe
  2⤵
  PID:3720
- C:\Windows\System\limOHvj.exe
  C:\Windows\System\limOHvj.exe
  2⤵
  PID:3736
- C:\Windows\System\wnqJHFN.exe
  C:\Windows\System\wnqJHFN.exe
  2⤵
  PID:3760
- C:\Windows\System\KqfSsMl.exe
  C:\Windows\System\KqfSsMl.exe
  2⤵
  PID:3776
- C:\Windows\System\okimgrf.exe
  C:\Windows\System\okimgrf.exe
  2⤵
  PID:3792
- C:\Windows\System\qEREBxu.exe
  C:\Windows\System\qEREBxu.exe
  2⤵
  PID:3808
- C:\Windows\System\Hawppjq.exe
  C:\Windows\System\Hawppjq.exe
  2⤵
  PID:3824
- C:\Windows\System\AnzIiIn.exe
  C:\Windows\System\AnzIiIn.exe
  2⤵
  PID:3840
- C:\Windows\System\bCXPBUt.exe
  C:\Windows\System\bCXPBUt.exe
  2⤵
  PID:3856
- C:\Windows\System\WyRicEn.exe
  C:\Windows\System\WyRicEn.exe
  2⤵
  PID:3880
- C:\Windows\System\jxarXgO.exe
  C:\Windows\System\jxarXgO.exe
  2⤵
  PID:3896
- C:\Windows\System\eYCaIBF.exe
  C:\Windows\System\eYCaIBF.exe
  2⤵
  PID:3912
- C:\Windows\System\ybNJAAH.exe
  C:\Windows\System\ybNJAAH.exe
  2⤵
  PID:3928
- C:\Windows\System\QCXhWwk.exe
  C:\Windows\System\QCXhWwk.exe
  2⤵
  PID:3944
- C:\Windows\System\fZPFkkU.exe
  C:\Windows\System\fZPFkkU.exe
  2⤵
  PID:3960
- C:\Windows\System\NQixodu.exe
  C:\Windows\System\NQixodu.exe
  2⤵
  PID:3980
- C:\Windows\System\rakafWN.exe
  C:\Windows\System\rakafWN.exe
  2⤵
  PID:4004
- C:\Windows\System\GDQocwR.exe
  C:\Windows\System\GDQocwR.exe
  2⤵
  PID:4020
- C:\Windows\System\IWQAQqp.exe
  C:\Windows\System\IWQAQqp.exe
  2⤵
  PID:4036
- C:\Windows\System\YucICZn.exe
  C:\Windows\System\YucICZn.exe
  2⤵
  PID:4056
- C:\Windows\System\WAfPmif.exe
  C:\Windows\System\WAfPmif.exe
  2⤵
  PID:4084
- C:\Windows\System\iscJekf.exe
  C:\Windows\System\iscJekf.exe
  2⤵
  PID:1628
- C:\Windows\System\QleNboE.exe
  C:\Windows\System\QleNboE.exe
  2⤵
  PID:568
- C:\Windows\System\tiiuprv.exe
  C:\Windows\System\tiiuprv.exe
  2⤵
  PID:2880
- C:\Windows\System\SliwYWU.exe
  C:\Windows\System\SliwYWU.exe
  2⤵
  PID:2580
- C:\Windows\System\rnvumnX.exe
  C:\Windows\System\rnvumnX.exe
  2⤵
  PID:3132
- C:\Windows\System\PzVcomN.exe
  C:\Windows\System\PzVcomN.exe
  2⤵
  PID:3172
- C:\Windows\System\ZxFsDph.exe
  C:\Windows\System\ZxFsDph.exe
  2⤵
  PID:3248
- C:\Windows\System\uXTPmRN.exe
  C:\Windows\System\uXTPmRN.exe
  2⤵
  PID:3280
- C:\Windows\System\vlykotJ.exe
  C:\Windows\System\vlykotJ.exe
  2⤵
  PID:3392
- C:\Windows\System\eBfMZbr.exe
  C:\Windows\System\eBfMZbr.exe
  2⤵
  PID:3436
- C:\Windows\System\YhdVIni.exe
  C:\Windows\System\YhdVIni.exe
  2⤵
  PID:3532
- C:\Windows\System\EExTpJT.exe
  C:\Windows\System\EExTpJT.exe
  2⤵
  PID:3608
- C:\Windows\System\MGJzHVr.exe
  C:\Windows\System\MGJzHVr.exe
  2⤵
  PID:3676
- C:\Windows\System\QYXuLiE.exe
  C:\Windows\System\QYXuLiE.exe
  2⤵
  PID:3716
- C:\Windows\System\MLhUEZy.exe
  C:\Windows\System\MLhUEZy.exe
  2⤵
  PID:3756
- C:\Windows\System\aAhxojc.exe
  C:\Windows\System\aAhxojc.exe
  2⤵
  PID:3848
- C:\Windows\System\AKHEHYS.exe
  C:\Windows\System\AKHEHYS.exe
  2⤵
  PID:3920
- C:\Windows\System\WwPRGPJ.exe
  C:\Windows\System\WwPRGPJ.exe
  2⤵
  PID:3956
- C:\Windows\System\JkyMoYE.exe
  C:\Windows\System\JkyMoYE.exe
  2⤵
  PID:3996
- C:\Windows\System\WHomLYs.exe
  C:\Windows\System\WHomLYs.exe
  2⤵
  PID:4064
- C:\Windows\System\CVGniEa.exe
  C:\Windows\System\CVGniEa.exe
  2⤵
  PID:4072
- C:\Windows\System\AanLAcW.exe
  C:\Windows\System\AanLAcW.exe
  2⤵
  PID:1480
- C:\Windows\System\cUVAZkO.exe
  C:\Windows\System\cUVAZkO.exe
  2⤵
  PID:3276
- C:\Windows\System\WkbwJlk.exe
  C:\Windows\System\WkbwJlk.exe
  2⤵
  PID:1680
- C:\Windows\System\CWyHnmt.exe
  C:\Windows\System\CWyHnmt.exe
  2⤵
  PID:2744
- C:\Windows\System\MQqMNHF.exe
  C:\Windows\System\MQqMNHF.exe
  2⤵
  PID:2748
- C:\Windows\System\VEbhktv.exe
  C:\Windows\System\VEbhktv.exe
  2⤵
  PID:4100
- C:\Windows\System\kPIbGGi.exe
  C:\Windows\System\kPIbGGi.exe
  2⤵
  PID:4116
- C:\Windows\System\nKFjWEI.exe
  C:\Windows\System\nKFjWEI.exe
  2⤵
  PID:4132
- C:\Windows\System\XDVzHHi.exe
  C:\Windows\System\XDVzHHi.exe
  2⤵
  PID:4152
- C:\Windows\System\XeKXJgt.exe
  C:\Windows\System\XeKXJgt.exe
  2⤵
  PID:4168
- C:\Windows\System\yMJqXfk.exe
  C:\Windows\System\yMJqXfk.exe
  2⤵
  PID:4184
- C:\Windows\System\SKASBRT.exe
  C:\Windows\System\SKASBRT.exe
  2⤵
  PID:4200
- C:\Windows\System\mbJcvbX.exe
  C:\Windows\System\mbJcvbX.exe
  2⤵
  PID:4216
- C:\Windows\System\kEoXZzt.exe
  C:\Windows\System\kEoXZzt.exe
  2⤵
  PID:4232
- C:\Windows\System\zWzZjBZ.exe
  C:\Windows\System\zWzZjBZ.exe
  2⤵
  PID:4248
- C:\Windows\System\jEDhwRU.exe
  C:\Windows\System\jEDhwRU.exe
  2⤵
  PID:4268
- C:\Windows\System\ahUZpAY.exe
  C:\Windows\System\ahUZpAY.exe
  2⤵
  PID:4288
- C:\Windows\System\dKdzVgA.exe
  C:\Windows\System\dKdzVgA.exe
  2⤵
  PID:4328
- C:\Windows\System\chwoMRT.exe
  C:\Windows\System\chwoMRT.exe
  2⤵
  PID:4344
- C:\Windows\System\tILhNTm.exe
  C:\Windows\System\tILhNTm.exe
  2⤵
  PID:4360
- C:\Windows\System\SxobwmP.exe
  C:\Windows\System\SxobwmP.exe
  2⤵
  PID:4376
- C:\Windows\System\FzhMVcZ.exe
  C:\Windows\System\FzhMVcZ.exe
  2⤵
  PID:4392
- C:\Windows\System\tKcPOsT.exe
  C:\Windows\System\tKcPOsT.exe
  2⤵
  PID:4408
- C:\Windows\System\kYPrliw.exe
  C:\Windows\System\kYPrliw.exe
  2⤵
  PID:4424
- C:\Windows\System\WBIqYdm.exe
  C:\Windows\System\WBIqYdm.exe
  2⤵
  PID:4440
- C:\Windows\System\sbYBXOD.exe
  C:\Windows\System\sbYBXOD.exe
  2⤵
  PID:4456
- C:\Windows\System\ckPJKqO.exe
  C:\Windows\System\ckPJKqO.exe
  2⤵
  PID:4472
- C:\Windows\System\EANZdDx.exe
  C:\Windows\System\EANZdDx.exe
  2⤵
  PID:4488
- C:\Windows\System\fWktTXH.exe
  C:\Windows\System\fWktTXH.exe
  2⤵
  PID:4504
- C:\Windows\System\fVlMbZg.exe
  C:\Windows\System\fVlMbZg.exe
  2⤵
  PID:4520
- C:\Windows\System\lVnWbWj.exe
  C:\Windows\System\lVnWbWj.exe
  2⤵
  PID:4536
- C:\Windows\System\FYQbOam.exe
  C:\Windows\System\FYQbOam.exe
  2⤵
  PID:4552
- C:\Windows\System\LULQQok.exe
  C:\Windows\System\LULQQok.exe
  2⤵
  PID:4568
- C:\Windows\System\mbqgcrP.exe
  C:\Windows\System\mbqgcrP.exe
  2⤵
  PID:4584
- C:\Windows\System\ecAJtnj.exe
  C:\Windows\System\ecAJtnj.exe
  2⤵
  PID:4600
- C:\Windows\System\MWsZrMw.exe
  C:\Windows\System\MWsZrMw.exe
  2⤵
  PID:4616
- C:\Windows\System\OVhWdto.exe
  C:\Windows\System\OVhWdto.exe
  2⤵
  PID:4632
- C:\Windows\System\TxSrisS.exe
  C:\Windows\System\TxSrisS.exe
  2⤵
  PID:4652
- C:\Windows\System\LyzDXQU.exe
  C:\Windows\System\LyzDXQU.exe
  2⤵
  PID:4668
- C:\Windows\System\QKYydJv.exe
  C:\Windows\System\QKYydJv.exe
  2⤵
  PID:4684
- C:\Windows\System\YUtfRTH.exe
  C:\Windows\System\YUtfRTH.exe
  2⤵
  PID:4700
- C:\Windows\System\liCIyoN.exe
  C:\Windows\System\liCIyoN.exe
  2⤵
  PID:4716
- C:\Windows\System\AoHLgdl.exe
  C:\Windows\System\AoHLgdl.exe
  2⤵
  PID:4732
- C:\Windows\System\svnKpBH.exe
  C:\Windows\System\svnKpBH.exe
  2⤵
  PID:4748
- C:\Windows\System\JXyNBXM.exe
  C:\Windows\System\JXyNBXM.exe
  2⤵
  PID:4768
- C:\Windows\System\aFsAyCP.exe
  C:\Windows\System\aFsAyCP.exe
  2⤵
  PID:4784
- C:\Windows\System\FBQKCmg.exe
  C:\Windows\System\FBQKCmg.exe
  2⤵
  PID:4800
- C:\Windows\System\dEzPJdK.exe
  C:\Windows\System\dEzPJdK.exe
  2⤵
  PID:4816
- C:\Windows\System\TFJRwZs.exe
  C:\Windows\System\TFJRwZs.exe
  2⤵
  PID:4832
- C:\Windows\System\VQXYiwg.exe
  C:\Windows\System\VQXYiwg.exe
  2⤵
  PID:4848
- C:\Windows\System\sWfYExU.exe
  C:\Windows\System\sWfYExU.exe
  2⤵
  PID:4864
- C:\Windows\System\WfdrHTu.exe
  C:\Windows\System\WfdrHTu.exe
  2⤵
  PID:4884
- C:\Windows\System\eiwgePY.exe
  C:\Windows\System\eiwgePY.exe
  2⤵
  PID:4900
- C:\Windows\System\xgzTwwO.exe
  C:\Windows\System\xgzTwwO.exe
  2⤵
  PID:4916
- C:\Windows\System\CbEkdmA.exe
  C:\Windows\System\CbEkdmA.exe
  2⤵
  PID:4932
- C:\Windows\System\EwBKDCv.exe
  C:\Windows\System\EwBKDCv.exe
  2⤵
  PID:4948
- C:\Windows\System\PIpgFJm.exe
  C:\Windows\System\PIpgFJm.exe
  2⤵
  PID:4964
- C:\Windows\System\ddKPnGC.exe
  C:\Windows\System\ddKPnGC.exe
  2⤵
  PID:4980
- C:\Windows\System\vKTZoVi.exe
  C:\Windows\System\vKTZoVi.exe
  2⤵
  PID:4996
- C:\Windows\System\NmzMPDx.exe
  C:\Windows\System\NmzMPDx.exe
  2⤵
  PID:5012
- C:\Windows\System\erazWHZ.exe
  C:\Windows\System\erazWHZ.exe
  2⤵
  PID:5032
- C:\Windows\System\yCnagDh.exe
  C:\Windows\System\yCnagDh.exe
  2⤵
  PID:5048
- C:\Windows\System\snbIWYb.exe
  C:\Windows\System\snbIWYb.exe
  2⤵
  PID:5072
- C:\Windows\System\ZAdwkYb.exe
  C:\Windows\System\ZAdwkYb.exe
  2⤵
  PID:5092
- C:\Windows\System\qOLHcUo.exe
  C:\Windows\System\qOLHcUo.exe
  2⤵
  PID:1984
- C:\Windows\System\eOsAczg.exe
  C:\Windows\System\eOsAczg.exe
  2⤵
  PID:920
- C:\Windows\System\cBNfuVA.exe
  C:\Windows\System\cBNfuVA.exe
  2⤵
  PID:4208
- C:\Windows\System\SAgPmJE.exe
  C:\Windows\System\SAgPmJE.exe
  2⤵
  PID:2412
- C:\Windows\System\yIYgivR.exe
  C:\Windows\System\yIYgivR.exe
  2⤵
  PID:4336
- C:\Windows\System\brtwFgp.exe
  C:\Windows\System\brtwFgp.exe
  2⤵
  PID:4404
- C:\Windows\System\mntWwAA.exe
  C:\Windows\System\mntWwAA.exe
  2⤵
  PID:4496
- C:\Windows\System\ERTblyV.exe
  C:\Windows\System\ERTblyV.exe
  2⤵
  PID:4560
- C:\Windows\System\wYrDVKS.exe
  C:\Windows\System\wYrDVKS.exe
  2⤵
  PID:4624
- C:\Windows\System\jwUbFls.exe
  C:\Windows\System\jwUbFls.exe
  2⤵
  PID:4664
- C:\Windows\System\gqKrjZI.exe
  C:\Windows\System\gqKrjZI.exe
  2⤵
  PID:4756
- C:\Windows\System\jmOWQMD.exe
  C:\Windows\System\jmOWQMD.exe
  2⤵
  PID:4824
- C:\Windows\System\pJHeQGm.exe
  C:\Windows\System\pJHeQGm.exe
  2⤵
  PID:4892
- C:\Windows\System\kcatqHB.exe
  C:\Windows\System\kcatqHB.exe
  2⤵
  PID:4988
- C:\Windows\System\xghTBTB.exe
  C:\Windows\System\xghTBTB.exe
  2⤵
  PID:5056
- C:\Windows\System\EbTeflY.exe
  C:\Windows\System\EbTeflY.exe
  2⤵
  PID:1204
- C:\Windows\System\YrPJccf.exe
  C:\Windows\System\YrPJccf.exe
  2⤵
  PID:3156
- C:\Windows\System\yMhMGTG.exe
  C:\Windows\System\yMhMGTG.exe
  2⤵
  PID:3260
- C:\Windows\System\IQvQpvC.exe
  C:\Windows\System\IQvQpvC.exe
  2⤵
  PID:3304
- C:\Windows\System\pUPJZJZ.exe
  C:\Windows\System\pUPJZJZ.exe
  2⤵
  PID:3372
- C:\Windows\System\SfVnpst.exe
  C:\Windows\System\SfVnpst.exe
  2⤵
  PID:3412
- C:\Windows\System\OJAGvUQ.exe
  C:\Windows\System\OJAGvUQ.exe
  2⤵
  PID:3484
- C:\Windows\System\VghiFxg.exe
  C:\Windows\System\VghiFxg.exe
  2⤵
  PID:3548
- C:\Windows\System\mVVIxTX.exe
  C:\Windows\System\mVVIxTX.exe
  2⤵
  PID:3624
- C:\Windows\System\GkTkPnS.exe
  C:\Windows\System\GkTkPnS.exe
  2⤵
  PID:952
- C:\Windows\System\QGlIfNT.exe
  C:\Windows\System\QGlIfNT.exe
  2⤵
  PID:5108
- C:\Windows\System\aAKpYfr.exe
  C:\Windows\System\aAKpYfr.exe
  2⤵
  PID:1876
- C:\Windows\System\nVMAZoI.exe
  C:\Windows\System\nVMAZoI.exe
  2⤵
  PID:3712
- C:\Windows\System\ZwEFDjX.exe
  C:\Windows\System\ZwEFDjX.exe
  2⤵
  PID:3784
- C:\Windows\System\zkpmmNN.exe
  C:\Windows\System\zkpmmNN.exe
  2⤵
  PID:2108
- C:\Windows\System\eeqRPUv.exe
  C:\Windows\System\eeqRPUv.exe
  2⤵
  PID:2836
- C:\Windows\System\LcUXdks.exe
  C:\Windows\System\LcUXdks.exe
  2⤵
  PID:4032
- C:\Windows\System\LAjrIVm.exe
  C:\Windows\System\LAjrIVm.exe
  2⤵
  PID:3564
- C:\Windows\System\xsaJJeQ.exe
  C:\Windows\System\xsaJJeQ.exe
  2⤵
  PID:4140
- C:\Windows\System\rmaWVUP.exe
  C:\Windows\System\rmaWVUP.exe
  2⤵
  PID:2392
- C:\Windows\System\wGLuTmF.exe
  C:\Windows\System\wGLuTmF.exe
  2⤵
  PID:1160
- C:\Windows\System\FbmaQzB.exe
  C:\Windows\System\FbmaQzB.exe
  2⤵
  PID:4180
- C:\Windows\System\ezwLAJD.exe
  C:\Windows\System\ezwLAJD.exe
  2⤵
  PID:4464
- C:\Windows\System\vZOkFuN.exe
  C:\Windows\System\vZOkFuN.exe
  2⤵
  PID:1764
- C:\Windows\System\OPENSzK.exe
  C:\Windows\System\OPENSzK.exe
  2⤵
  PID:4860
- C:\Windows\System\wfgTENC.exe
  C:\Windows\System\wfgTENC.exe
  2⤵
  PID:5144
- C:\Windows\System\NSAXfbA.exe
  C:\Windows\System\NSAXfbA.exe
  2⤵
  PID:5160
- C:\Windows\System\XgiVSnb.exe
  C:\Windows\System\XgiVSnb.exe
  2⤵
  PID:5176
- C:\Windows\System\YDEakJv.exe
  C:\Windows\System\YDEakJv.exe
  2⤵
  PID:5192
- C:\Windows\System\NgfpVuJ.exe
  C:\Windows\System\NgfpVuJ.exe
  2⤵
  PID:5208
- C:\Windows\System\lxlEHvP.exe
  C:\Windows\System\lxlEHvP.exe
  2⤵
  PID:5224
- C:\Windows\System\zsvkdjW.exe
  C:\Windows\System\zsvkdjW.exe
  2⤵
  PID:5240
- C:\Windows\System\iUvZlYv.exe
  C:\Windows\System\iUvZlYv.exe
  2⤵
  PID:5256
- C:\Windows\System\oQHMWqP.exe
  C:\Windows\System\oQHMWqP.exe
  2⤵
  PID:5276
- C:\Windows\System\ouanRYN.exe
  C:\Windows\System\ouanRYN.exe
  2⤵
  PID:5292
- C:\Windows\System\IJdwxYb.exe
  C:\Windows\System\IJdwxYb.exe
  2⤵
  PID:5308
- C:\Windows\System\impItYH.exe
  C:\Windows\System\impItYH.exe
  2⤵
  PID:5328
- C:\Windows\System\NdpvzTn.exe
  C:\Windows\System\NdpvzTn.exe
  2⤵
  PID:5344
- C:\Windows\System\HVrGEMK.exe
  C:\Windows\System\HVrGEMK.exe
  2⤵
  PID:5360
- C:\Windows\System\bZTkXnv.exe
  C:\Windows\System\bZTkXnv.exe
  2⤵
  PID:5376
- C:\Windows\System\IEZAJuV.exe
  C:\Windows\System\IEZAJuV.exe
  2⤵
  PID:5396
- C:\Windows\System\LBSnqvR.exe
  C:\Windows\System\LBSnqvR.exe
  2⤵
  PID:5412
- C:\Windows\System\GCMJfvH.exe
  C:\Windows\System\GCMJfvH.exe
  2⤵
  PID:5428
- C:\Windows\System\NNviXBs.exe
  C:\Windows\System\NNviXBs.exe
  2⤵
  PID:5444
- C:\Windows\System\rvwyixA.exe
  C:\Windows\System\rvwyixA.exe
  2⤵
  PID:5464
- C:\Windows\System\WVIBMnT.exe
  C:\Windows\System\WVIBMnT.exe
  2⤵
  PID:5480
- C:\Windows\System\JhDbkgK.exe
  C:\Windows\System\JhDbkgK.exe
  2⤵
  PID:5496
- C:\Windows\System\dtXrmpc.exe
  C:\Windows\System\dtXrmpc.exe
  2⤵
  PID:5512
- C:\Windows\System\aBwlQtK.exe
  C:\Windows\System\aBwlQtK.exe
  2⤵
  PID:5528
- C:\Windows\System\pmCkvnS.exe
  C:\Windows\System\pmCkvnS.exe
  2⤵
  PID:5544
- C:\Windows\System\SzevIBQ.exe
  C:\Windows\System\SzevIBQ.exe
  2⤵
  PID:5560
- C:\Windows\System\cgmnpPg.exe
  C:\Windows\System\cgmnpPg.exe
  2⤵
  PID:5576
- C:\Windows\System\vzcaXjf.exe
  C:\Windows\System\vzcaXjf.exe
  2⤵
  PID:5592
- C:\Windows\System\RrdcmHM.exe
  C:\Windows\System\RrdcmHM.exe
  2⤵
  PID:5608
- C:\Windows\System\bYoEUET.exe
  C:\Windows\System\bYoEUET.exe
  2⤵
  PID:5624
- C:\Windows\System\MZiporg.exe
  C:\Windows\System\MZiporg.exe
  2⤵
  PID:5640
- C:\Windows\System\PltfRUn.exe
  C:\Windows\System\PltfRUn.exe
  2⤵
  PID:5660
- C:\Windows\System\RBoLKUH.exe
  C:\Windows\System\RBoLKUH.exe
  2⤵
  PID:5676
- C:\Windows\System\iMWqLaN.exe
  C:\Windows\System\iMWqLaN.exe
  2⤵
  PID:5692
- C:\Windows\System\ocCSead.exe
  C:\Windows\System\ocCSead.exe
  2⤵
  PID:5712
- C:\Windows\System\FuidlhT.exe
  C:\Windows\System\FuidlhT.exe
  2⤵
  PID:5732
- C:\Windows\System\upWoZZu.exe
  C:\Windows\System\upWoZZu.exe
  2⤵
  PID:5772
- C:\Windows\System\pAykpeV.exe
  C:\Windows\System\pAykpeV.exe
  2⤵
  PID:5928
- C:\Windows\System\TEkktWs.exe
  C:\Windows\System\TEkktWs.exe
  2⤵
  PID:6016
- C:\Windows\System\dwjIIiC.exe
  C:\Windows\System\dwjIIiC.exe
  2⤵
  PID:6104
- C:\Windows\System\HzMLCrK.exe
  C:\Windows\System\HzMLCrK.exe
  2⤵
  PID:6136
- C:\Windows\System\bmmdIvO.exe
  C:\Windows\System\bmmdIvO.exe
  2⤵
  PID:5112
- C:\Windows\System\WAIfSfg.exe
  C:\Windows\System\WAIfSfg.exe
  2⤵
  PID:2304
- C:\Windows\System\lJAahVA.exe
  C:\Windows\System\lJAahVA.exe
  2⤵
  PID:320
- C:\Windows\System\gguKMre.exe
  C:\Windows\System\gguKMre.exe
  2⤵
  PID:5128
- C:\Windows\System\hPBCcIu.exe
  C:\Windows\System\hPBCcIu.exe
  2⤵
  PID:5172
- C:\Windows\System\MBeABei.exe
  C:\Windows\System\MBeABei.exe
  2⤵
  PID:5272
- C:\Windows\System\HBYkBMs.exe
  C:\Windows\System\HBYkBMs.exe
  2⤵
  PID:5304
- C:\Windows\System\jvNdywT.exe
  C:\Windows\System\jvNdywT.exe
  2⤵
  PID:5372
- C:\Windows\System\URaqUkB.exe
  C:\Windows\System\URaqUkB.exe
  2⤵
  PID:5440
- C:\Windows\System\ZdrUUTf.exe
  C:\Windows\System\ZdrUUTf.exe
  2⤵
  PID:2720
- C:\Windows\System\wKMJvXj.exe
  C:\Windows\System\wKMJvXj.exe
  2⤵
  PID:1920
- C:\Windows\System\GpZRHAA.exe
  C:\Windows\System\GpZRHAA.exe
  2⤵
  PID:3308
- C:\Windows\System\YTPxpkO.exe
  C:\Windows\System\YTPxpkO.exe
  2⤵
  PID:3864
- C:\Windows\System\fmKvMDe.exe
  C:\Windows\System\fmKvMDe.exe
  2⤵
  PID:3692
- C:\Windows\System\NTbAhzA.exe
  C:\Windows\System\NTbAhzA.exe
  2⤵
  PID:3728
- C:\Windows\System\ZwJHrSM.exe
  C:\Windows\System\ZwJHrSM.exe
  2⤵
  PID:3800
- C:\Windows\System\PofJENz.exe
  C:\Windows\System\PofJENz.exe
  2⤵
  PID:1660
- C:\Windows\System\OJeJJsz.exe
  C:\Windows\System\OJeJJsz.exe
  2⤵
  PID:4044
- C:\Windows\System\GzkaGbS.exe
  C:\Windows\System\GzkaGbS.exe
  2⤵
  PID:860
- C:\Windows\System\ePcusuN.exe
  C:\Windows\System\ePcusuN.exe
  2⤵
  PID:3888
- C:\Windows\System\uGFUlpf.exe
  C:\Windows\System\uGFUlpf.exe
  2⤵
  PID:4080
- C:\Windows\System\ZfphzFU.exe
  C:\Windows\System\ZfphzFU.exe
  2⤵
  PID:3568
- C:\Windows\System\rbkLNlc.exe
  C:\Windows\System\rbkLNlc.exe
  2⤵
  PID:4160
- C:\Windows\System\aWGALzJ.exe
  C:\Windows\System\aWGALzJ.exe
  2⤵
  PID:4260
- C:\Windows\System\TcWbxCa.exe
  C:\Windows\System\TcWbxCa.exe
  2⤵
  PID:4304
- C:\Windows\System\TxOFqrh.exe
  C:\Windows\System\TxOFqrh.exe
  2⤵
  PID:4320
- C:\Windows\System\BDXPtMr.exe
  C:\Windows\System\BDXPtMr.exe
  2⤵
  PID:4384
- C:\Windows\System\QkclxSV.exe
  C:\Windows\System\QkclxSV.exe
  2⤵
  PID:4448
- C:\Windows\System\clEquTj.exe
  C:\Windows\System\clEquTj.exe
  2⤵
  PID:4512
- C:\Windows\System\FOSNNgO.exe
  C:\Windows\System\FOSNNgO.exe
  2⤵
  PID:4576
- C:\Windows\System\FbAiKzD.exe
  C:\Windows\System\FbAiKzD.exe
  2⤵
  PID:4640
- C:\Windows\System\qsjRoeC.exe
  C:\Windows\System\qsjRoeC.exe
  2⤵
  PID:4648
- C:\Windows\System\uHpxeMR.exe
  C:\Windows\System\uHpxeMR.exe
  2⤵
  PID:4744
- C:\Windows\System\slNhxdy.exe
  C:\Windows\System\slNhxdy.exe
  2⤵
  PID:4812
- C:\Windows\System\nxIbWYM.exe
  C:\Windows\System\nxIbWYM.exe
  2⤵
  PID:4876
- C:\Windows\System\MMlyqcp.exe
  C:\Windows\System\MMlyqcp.exe
  2⤵
  PID:4940
- C:\Windows\System\KhpmvXr.exe
  C:\Windows\System\KhpmvXr.exe
  2⤵
  PID:5004
- C:\Windows\System\YludRxl.exe
  C:\Windows\System\YludRxl.exe
  2⤵
  PID:5080
- C:\Windows\System\uPFWUQd.exe
  C:\Windows\System\uPFWUQd.exe
  2⤵
  PID:3620
- C:\Windows\System\kXBwLrY.exe
  C:\Windows\System\kXBwLrY.exe
  2⤵
  PID:4244
- C:\Windows\System\pyBIxdW.exe
  C:\Windows\System\pyBIxdW.exe
  2⤵
  PID:4500
- C:\Windows\System\JwRyxcu.exe
  C:\Windows\System\JwRyxcu.exe
  2⤵
  PID:4660
- C:\Windows\System\GtMegpQ.exe
  C:\Windows\System\GtMegpQ.exe
  2⤵
  PID:4924
- C:\Windows\System\xFnSvEo.exe
  C:\Windows\System\xFnSvEo.exe
  2⤵
  PID:5060
- C:\Windows\System\MtYNasz.exe
  C:\Windows\System\MtYNasz.exe
  2⤵
  PID:3224
- C:\Windows\System\VffFsKE.exe
  C:\Windows\System\VffFsKE.exe
  2⤵
  PID:3452
- C:\Windows\System\nOINIeW.exe
  C:\Windows\System\nOINIeW.exe
  2⤵
  PID:5100
- C:\Windows\System\CvLDehY.exe
  C:\Windows\System\CvLDehY.exe
  2⤵
  PID:1872
- C:\Windows\System\SiZZpZa.exe
  C:\Windows\System\SiZZpZa.exe
  2⤵
  PID:4108
- C:\Windows\System\NvZUkFg.exe
  C:\Windows\System\NvZUkFg.exe
  2⤵
  PID:4436
- C:\Windows\System\FTimsjW.exe
  C:\Windows\System\FTimsjW.exe
  2⤵
  PID:5156
- C:\Windows\System\uVXseMp.exe
  C:\Windows\System\uVXseMp.exe
  2⤵
  PID:5220
- C:\Windows\System\XdmSSkK.exe
  C:\Windows\System\XdmSSkK.exe
  2⤵
  PID:5288
- C:\Windows\System\ouLLpOG.exe
  C:\Windows\System\ouLLpOG.exe
  2⤵
  PID:5352
- C:\Windows\System\JxXTWag.exe
  C:\Windows\System\JxXTWag.exe
  2⤵
  PID:5392
- C:\Windows\System\cauiGBw.exe
  C:\Windows\System\cauiGBw.exe
  2⤵
  PID:2280
- C:\Windows\System\YEJxCkI.exe
  C:\Windows\System\YEJxCkI.exe
  2⤵
  PID:5472
- C:\Windows\System\VQXOnih.exe
  C:\Windows\System\VQXOnih.exe
  2⤵
  PID:5632
- C:\Windows\System\gHhBqNr.exe
  C:\Windows\System\gHhBqNr.exe
  2⤵
  PID:5740
- C:\Windows\System\TwgBVZV.exe
  C:\Windows\System\TwgBVZV.exe
  2⤵
  PID:5504
- C:\Windows\System\eRoYdoO.exe
  C:\Windows\System\eRoYdoO.exe
  2⤵
  PID:5752
- C:\Windows\System\crXplld.exe
  C:\Windows\System\crXplld.exe
  2⤵
  PID:2040
- C:\Windows\System\oUsJJjC.exe
  C:\Windows\System\oUsJJjC.exe
  2⤵
  PID:5728
- C:\Windows\System\UPYSIoB.exe
  C:\Windows\System\UPYSIoB.exe
  2⤵
  PID:5524
- C:\Windows\System\SOmFPcF.exe
  C:\Windows\System\SOmFPcF.exe
  2⤵
  PID:5588
- C:\Windows\System\KwTvtmD.exe
  C:\Windows\System\KwTvtmD.exe
  2⤵
  PID:5652
- C:\Windows\System\vrwKfxP.exe
  C:\Windows\System\vrwKfxP.exe
  2⤵
  PID:5780
- C:\Windows\System\WEPgrOw.exe
  C:\Windows\System\WEPgrOw.exe
  2⤵
  PID:5804
- C:\Windows\System\MjsHQut.exe
  C:\Windows\System\MjsHQut.exe
  2⤵
  PID:5820
- C:\Windows\System\KAfCadL.exe
  C:\Windows\System\KAfCadL.exe
  2⤵
  PID:5836
- C:\Windows\System\HjqjzaY.exe
  C:\Windows\System\HjqjzaY.exe
  2⤵
  PID:5848
- C:\Windows\System\wfBmQTw.exe
  C:\Windows\System\wfBmQTw.exe
  2⤵
  PID:5860
- C:\Windows\System\YaAVSky.exe
  C:\Windows\System\YaAVSky.exe
  2⤵
  PID:5876
- C:\Windows\System\heCUIZD.exe
  C:\Windows\System\heCUIZD.exe
  2⤵
  PID:1400
- C:\Windows\System\FovDZMm.exe
  C:\Windows\System\FovDZMm.exe
  2⤵
  PID:2424
- C:\Windows\System\vZGtQFv.exe
  C:\Windows\System\vZGtQFv.exe
  2⤵
  PID:2620
- C:\Windows\System\KjEujtj.exe
  C:\Windows\System\KjEujtj.exe
  2⤵
  PID:5908
- C:\Windows\System\DcCJyvz.exe
  C:\Windows\System\DcCJyvz.exe
  2⤵
  PID:5924
- C:\Windows\System\RhLXyrV.exe
  C:\Windows\System\RhLXyrV.exe
  2⤵
  PID:1648
- C:\Windows\System\QSxNBhi.exe
  C:\Windows\System\QSxNBhi.exe
  2⤵
  PID:612
- C:\Windows\System\gHsGHNo.exe
  C:\Windows\System\gHsGHNo.exe
  2⤵
  PID:1828
- C:\Windows\System\JEPtPWn.exe
  C:\Windows\System\JEPtPWn.exe
  2⤵
  PID:1332
- C:\Windows\System\NNTWRDv.exe
  C:\Windows\System\NNTWRDv.exe
  2⤵
  PID:5956
- C:\Windows\System\jWiusZL.exe
  C:\Windows\System\jWiusZL.exe
  2⤵
  PID:1832
- C:\Windows\System\XtnDdcw.exe
  C:\Windows\System\XtnDdcw.exe
  2⤵
  PID:5976
- C:\Windows\System\DTsBqdp.exe
  C:\Windows\System\DTsBqdp.exe
  2⤵
  PID:2972
- C:\Windows\System\LeoEZYk.exe
  C:\Windows\System\LeoEZYk.exe
  2⤵
  PID:592
- C:\Windows\System\yCpwQzk.exe
  C:\Windows\System\yCpwQzk.exe
  2⤵
  PID:6004
- C:\Windows\System\ZUlmhWe.exe
  C:\Windows\System\ZUlmhWe.exe
  2⤵
  PID:6032
- C:\Windows\System\YvdSaCE.exe
  C:\Windows\System\YvdSaCE.exe
  2⤵
  PID:6044
- C:\Windows\System\iMAihtD.exe
  C:\Windows\System\iMAihtD.exe
  2⤵
  PID:6060
- C:\Windows\System\fCIIfXD.exe
  C:\Windows\System\fCIIfXD.exe
  2⤵
  PID:2776
- C:\Windows\System\QXpdNOs.exe
  C:\Windows\System\QXpdNOs.exe
  2⤵
  PID:2308
- C:\Windows\System\tKkSOaw.exe
  C:\Windows\System\tKkSOaw.exe
  2⤵
  PID:6092
- C:\Windows\System\ZIkzJOU.exe
  C:\Windows\System\ZIkzJOU.exe
  2⤵
  PID:6116
- C:\Windows\System\ZkeDdxR.exe
  C:\Windows\System\ZkeDdxR.exe
  2⤵
  PID:6100
- C:\Windows\System\HirQEZO.exe
  C:\Windows\System\HirQEZO.exe
  2⤵
  PID:2436
- C:\Windows\System\ixLIIZN.exe
  C:\Windows\System\ixLIIZN.exe
  2⤵
  PID:3516
- C:\Windows\System\Jtxfmvt.exe
  C:\Windows\System\Jtxfmvt.exe
  2⤵
  PID:3968
- C:\Windows\System\BQiAudQ.exe
  C:\Windows\System\BQiAudQ.exe
  2⤵
  PID:1792
- C:\Windows\System\PnRtkof.exe
  C:\Windows\System\PnRtkof.exe
  2⤵
  PID:3116
- C:\Windows\System\XAZpxIh.exe
  C:\Windows\System\XAZpxIh.exe
  2⤵
  PID:3904
- C:\Windows\System\ogWnVOM.exe
  C:\Windows\System\ogWnVOM.exe
  2⤵
  PID:3408
- C:\Windows\System\btyHOyj.exe
  C:\Windows\System\btyHOyj.exe
  2⤵
  PID:2956
- C:\Windows\System\ggmCsTg.exe
  C:\Windows\System\ggmCsTg.exe
  2⤵
  PID:1684
- C:\Windows\System\RvWGWWV.exe
  C:\Windows\System\RvWGWWV.exe
  2⤵
  PID:2132
- C:\Windows\System\qjiDtEz.exe
  C:\Windows\System\qjiDtEz.exe
  2⤵
  PID:5300
- C:\Windows\System\ooeczey.exe
  C:\Windows\System\ooeczey.exe
  2⤵
  PID:2872
- C:\Windows\System\BFMVriZ.exe
  C:\Windows\System\BFMVriZ.exe
  2⤵
  PID:412
- C:\Windows\System\MzvGyAe.exe
  C:\Windows\System\MzvGyAe.exe
  2⤵
  PID:2560
- C:\Windows\System\npMYqgh.exe
  C:\Windows\System\npMYqgh.exe
  2⤵
  PID:1600
- C:\Windows\System\jMaEQSK.exe
  C:\Windows\System\jMaEQSK.exe
  2⤵
  PID:3804
- C:\Windows\System\NIwfzRK.exe
  C:\Windows\System\NIwfzRK.exe
  2⤵
  PID:2400
- C:\Windows\System\HiFwiUY.exe
  C:\Windows\System\HiFwiUY.exe
  2⤵
  PID:2492
- C:\Windows\System\JzbXYLh.exe
  C:\Windows\System\JzbXYLh.exe
  2⤵
  PID:2876
- C:\Windows\System\mKBsHpc.exe
  C:\Windows\System\mKBsHpc.exe
  2⤵
  PID:5204
- C:\Windows\System\VKhCwGQ.exe
  C:\Windows\System\VKhCwGQ.exe
  2⤵
  PID:900
- C:\Windows\System\zJAFbKm.exe
  C:\Windows\System\zJAFbKm.exe
  2⤵
  PID:3096
- C:\Windows\System\nHmOFRr.exe
  C:\Windows\System\nHmOFRr.exe
  2⤵
  PID:3240
- C:\Windows\System\EByaitN.exe
  C:\Windows\System\EByaitN.exe
  2⤵
  PID:3472
- C:\Windows\System\qKHQCKJ.exe
  C:\Windows\System\qKHQCKJ.exe
  2⤵
  PID:3640
- C:\Windows\System\zUDkgkh.exe
  C:\Windows\System\zUDkgkh.exe
  2⤵
  PID:576
- C:\Windows\System\UAZqeUM.exe
  C:\Windows\System\UAZqeUM.exe
  2⤵
  PID:4000
- C:\Windows\System\rGfKNSW.exe
  C:\Windows\System\rGfKNSW.exe
  2⤵
  PID:1508
- C:\Windows\System\lqwGHYW.exe
  C:\Windows\System\lqwGHYW.exe
  2⤵
  PID:4192
- C:\Windows\System\osKebtV.exe
  C:\Windows\System\osKebtV.exe
  2⤵
  PID:4228
- C:\Windows\System\rbNNAhU.exe
  C:\Windows\System\rbNNAhU.exe
  2⤵
  PID:4256
- C:\Windows\System\JEhfEwF.exe
  C:\Windows\System\JEhfEwF.exe
  2⤵
  PID:4416
- C:\Windows\System\xczhIFJ.exe
  C:\Windows\System\xczhIFJ.exe
  2⤵
  PID:4680
- C:\Windows\System\ycxIUrj.exe
  C:\Windows\System\ycxIUrj.exe
  2⤵
  PID:4780
- C:\Windows\System\uNinJaC.exe
  C:\Windows\System\uNinJaC.exe
  2⤵
  PID:5040
- C:\Windows\System\gOkjcZo.exe
  C:\Windows\System\gOkjcZo.exe
  2⤵
  PID:4692
- C:\Windows\System\BaNajqb.exe
  C:\Windows\System\BaNajqb.exe
  2⤵
  PID:3344
- C:\Windows\System\TaccMYu.exe
  C:\Windows\System\TaccMYu.exe
  2⤵
  PID:3708
- C:\Windows\System\qvYOiwZ.exe
  C:\Windows\System\qvYOiwZ.exe
  2⤵
  PID:5188
- C:\Windows\System\fsfCRGp.exe
  C:\Windows\System\fsfCRGp.exe
  2⤵
  PID:5324
- C:\Windows\System\GFZmylN.exe
  C:\Windows\System\GFZmylN.exe
  2⤵
  PID:4480
- C:\Windows\System\WMEVbiL.exe
  C:\Windows\System\WMEVbiL.exe
  2⤵
  PID:5248
- C:\Windows\System\sCcXFNy.exe
  C:\Windows\System\sCcXFNy.exe
  2⤵
  PID:2616
- C:\Windows\System\rTLQvLh.exe
  C:\Windows\System\rTLQvLh.exe
  2⤵
  PID:3188
- C:\Windows\System\agLxcpw.exe
  C:\Windows\System\agLxcpw.exe
  2⤵
  PID:4372
- C:\Windows\System\BRieRbd.exe
  C:\Windows\System\BRieRbd.exe
  2⤵
  PID:4872
- C:\Windows\System\sJSTsDh.exe
  C:\Windows\System\sJSTsDh.exe
  2⤵
  PID:5452
- C:\Windows\System\gjXsGjU.exe
  C:\Windows\System\gjXsGjU.exe
  2⤵
  PID:1304
- C:\Windows\System\JAdeMBb.exe
  C:\Windows\System\JAdeMBb.exe
  2⤵
  PID:5572
- C:\Windows\System\uUHzpvT.exe
  C:\Windows\System\uUHzpvT.exe
  2⤵
  PID:5540
- C:\Windows\System\xPJliOl.exe
  C:\Windows\System\xPJliOl.exe
  2⤵
  PID:5720
- C:\Windows\System\vIUpqVb.exe
  C:\Windows\System\vIUpqVb.exe
  2⤵
  PID:5768
- C:\Windows\System\VVQYQFI.exe
  C:\Windows\System\VVQYQFI.exe
  2⤵
  PID:5520
- C:\Windows\System\sJfgrBw.exe
  C:\Windows\System\sJfgrBw.exe
  2⤵
  PID:5864
- C:\Windows\System\afhReHe.exe
  C:\Windows\System\afhReHe.exe
  2⤵
  PID:5872
- C:\Windows\System\mfXddSr.exe
  C:\Windows\System\mfXddSr.exe
  2⤵
  PID:312
- C:\Windows\System\uYbQpXF.exe
  C:\Windows\System\uYbQpXF.exe
  2⤵
  PID:1700
- C:\Windows\System\PNepEcK.exe
  C:\Windows\System\PNepEcK.exe
  2⤵
  PID:3732
- C:\Windows\System\BCXiVBY.exe
  C:\Windows\System\BCXiVBY.exe
  2⤵
  PID:1864
- C:\Windows\System\cvdDiIH.exe
  C:\Windows\System\cvdDiIH.exe
  2⤵
  PID:1884
- C:\Windows\System\qUEyKIw.exe
  C:\Windows\System\qUEyKIw.exe
  2⤵
  PID:4908
- C:\Windows\System\lVbaQUo.exe
  C:\Windows\System\lVbaQUo.exe
  2⤵
  PID:3048
- C:\Windows\System\bINbcfP.exe
  C:\Windows\System\bINbcfP.exe
  2⤵
  PID:1848
- C:\Windows\System\pJKXNaQ.exe
  C:\Windows\System\pJKXNaQ.exe
  2⤵
  PID:5648
- C:\Windows\System\rcCxXbu.exe
  C:\Windows\System\rcCxXbu.exe
  2⤵
  PID:5940
- C:\Windows\System\teLAyYQ.exe
  C:\Windows\System\teLAyYQ.exe
  2⤵
  PID:5996
- C:\Windows\System\lCcxtEO.exe
  C:\Windows\System\lCcxtEO.exe
  2⤵
  PID:5944
- C:\Windows\System\ygkjIzq.exe
  C:\Windows\System\ygkjIzq.exe
  2⤵
  PID:6112
- C:\Windows\System\MRrQZgo.exe
  C:\Windows\System\MRrQZgo.exe
  2⤵
  PID:2272
- C:\Windows\System\CFAMGnm.exe
  C:\Windows\System\CFAMGnm.exe
  2⤵
  PID:5992
- C:\Windows\System\Jgmsmgk.exe
  C:\Windows\System\Jgmsmgk.exe
  2⤵
  PID:5972
- C:\Windows\System\GIxntvW.exe
  C:\Windows\System\GIxntvW.exe
  2⤵
  PID:2344
- C:\Windows\System\aFMjQik.exe
  C:\Windows\System\aFMjQik.exe
  2⤵
  PID:3296
- C:\Windows\System\XQsRHCD.exe
  C:\Windows\System\XQsRHCD.exe
  2⤵
  PID:6008
- C:\Windows\System\nSBVdiP.exe
  C:\Windows\System\nSBVdiP.exe
  2⤵
  PID:6088
- C:\Windows\System\VqZEUMv.exe
  C:\Windows\System\VqZEUMv.exe
  2⤵
  PID:1148
- C:\Windows\System\zSxKwHO.exe
  C:\Windows\System\zSxKwHO.exe
  2⤵
  PID:5028
- C:\Windows\System\OpTIejp.exe
  C:\Windows\System\OpTIejp.exe
  2⤵
  PID:2588
- C:\Windows\System\uuHvsPq.exe
  C:\Windows\System\uuHvsPq.exe
  2⤵
  PID:2052
- C:\Windows\System\JjXGUhV.exe
  C:\Windows\System\JjXGUhV.exe
  2⤵
  PID:1704
- C:\Windows\System\LwPFuqM.exe
  C:\Windows\System\LwPFuqM.exe
  2⤵
  PID:4912
- C:\Windows\System\iuwALXs.exe
  C:\Windows\System\iuwALXs.exe
  2⤵
  PID:3588
- C:\Windows\System\GjpiHUl.exe
  C:\Windows\System\GjpiHUl.exe
  2⤵
  PID:1108
- C:\Windows\System\uRXPWzJ.exe
  C:\Windows\System\uRXPWzJ.exe
  2⤵
  PID:2760
- C:\Windows\System\YZjHkiz.exe
  C:\Windows\System\YZjHkiz.exe
  2⤵
  PID:2600
- C:\Windows\System\OfJvmyA.exe
  C:\Windows\System\OfJvmyA.exe
  2⤵
  PID:5892
- C:\Windows\System\TAQZMlA.exe
  C:\Windows\System\TAQZMlA.exe
  2⤵
  PID:5436
- C:\Windows\System\YwdkwHu.exe
  C:\Windows\System\YwdkwHu.exe
  2⤵
  PID:3504
- C:\Windows\System\HmuPHZU.exe
  C:\Windows\System\HmuPHZU.exe
  2⤵
  PID:2452
- C:\Windows\System\eQdUVRq.exe
  C:\Windows\System\eQdUVRq.exe
  2⤵
  PID:6160
- C:\Windows\System\CaPxBVs.exe
  C:\Windows\System\CaPxBVs.exe
  2⤵
  PID:6176
- C:\Windows\System\WqqriAh.exe
  C:\Windows\System\WqqriAh.exe
  2⤵
  PID:6192
- C:\Windows\System\ygmyoei.exe
  C:\Windows\System\ygmyoei.exe
  2⤵
  PID:6208
- C:\Windows\System\XsVumqe.exe
  C:\Windows\System\XsVumqe.exe
  2⤵
  PID:6224
- C:\Windows\System\AwRxIwh.exe
  C:\Windows\System\AwRxIwh.exe
  2⤵
  PID:6240
- C:\Windows\System\chtacHk.exe
  C:\Windows\System\chtacHk.exe
  2⤵
  PID:6260
- C:\Windows\System\yFoNJzA.exe
  C:\Windows\System\yFoNJzA.exe
  2⤵
  PID:6276
- C:\Windows\System\TGIkioy.exe
  C:\Windows\System\TGIkioy.exe
  2⤵
  PID:6296
- C:\Windows\System\qQSBBHl.exe
  C:\Windows\System\qQSBBHl.exe
  2⤵
  PID:6316
- C:\Windows\System\onJkqmr.exe
  C:\Windows\System\onJkqmr.exe
  2⤵
  PID:6444
- C:\Windows\System\vLEnqqK.exe
  C:\Windows\System\vLEnqqK.exe
  2⤵
  PID:6460
- C:\Windows\System\DHWJQnz.exe
  C:\Windows\System\DHWJQnz.exe
  2⤵
  PID:6476
- C:\Windows\System\YrvNFXR.exe
  C:\Windows\System\YrvNFXR.exe
  2⤵
  PID:6492
- C:\Windows\System\wRnXmCy.exe
  C:\Windows\System\wRnXmCy.exe
  2⤵
  PID:6508
- C:\Windows\System\XQjAmOR.exe
  C:\Windows\System\XQjAmOR.exe
  2⤵
  PID:6528
- C:\Windows\System\EnboVyg.exe
  C:\Windows\System\EnboVyg.exe
  2⤵
  PID:6544
- C:\Windows\System\nGHdRgi.exe
  C:\Windows\System\nGHdRgi.exe
  2⤵
  PID:6560
- C:\Windows\System\yckWiyQ.exe
  C:\Windows\System\yckWiyQ.exe
  2⤵
  PID:6576
- C:\Windows\System\KBTlUfm.exe
  C:\Windows\System\KBTlUfm.exe
  2⤵
  PID:6592
- C:\Windows\System\XZyzdEW.exe
  C:\Windows\System\XZyzdEW.exe
  2⤵
  PID:6608
- C:\Windows\System\nUSuLkz.exe
  C:\Windows\System\nUSuLkz.exe
  2⤵
  PID:6624
- C:\Windows\System\VKPlSfv.exe
  C:\Windows\System\VKPlSfv.exe
  2⤵
  PID:6640
- C:\Windows\System\gICpyuN.exe
  C:\Windows\System\gICpyuN.exe
  2⤵
  PID:6656
- C:\Windows\System\PJFHdPg.exe
  C:\Windows\System\PJFHdPg.exe
  2⤵
  PID:6672
- C:\Windows\System\eKoZyHm.exe
  C:\Windows\System\eKoZyHm.exe
  2⤵
  PID:6688
- C:\Windows\System\uETkFJZ.exe
  C:\Windows\System\uETkFJZ.exe
  2⤵
  PID:6704
- C:\Windows\System\QKTCOxd.exe
  C:\Windows\System\QKTCOxd.exe
  2⤵
  PID:6720
- C:\Windows\System\AHqgYhG.exe
  C:\Windows\System\AHqgYhG.exe
  2⤵
  PID:6900
- C:\Windows\System\UzRKcjm.exe
  C:\Windows\System\UzRKcjm.exe
  2⤵
  PID:6920
- C:\Windows\System\PcavNze.exe
  C:\Windows\System\PcavNze.exe
  2⤵
  PID:6940
- C:\Windows\System\TiOHnEt.exe
  C:\Windows\System\TiOHnEt.exe
  2⤵
  PID:6956
- C:\Windows\System\iIxiqkp.exe
  C:\Windows\System\iIxiqkp.exe
  2⤵
  PID:6976
- C:\Windows\System\VQBEbUZ.exe
  C:\Windows\System\VQBEbUZ.exe
  2⤵
  PID:6992
- C:\Windows\System\dPiSemR.exe
  C:\Windows\System\dPiSemR.exe
  2⤵
  PID:7008
- C:\Windows\System\ZDyBngZ.exe
  C:\Windows\System\ZDyBngZ.exe
  2⤵
  PID:7024
- C:\Windows\System\zqruYva.exe
  C:\Windows\System\zqruYva.exe
  2⤵
  PID:7040
- C:\Windows\System\MDmHQYZ.exe
  C:\Windows\System\MDmHQYZ.exe
  2⤵
  PID:7056
- C:\Windows\System\WndcYaM.exe
  C:\Windows\System\WndcYaM.exe
  2⤵
  PID:7072
- C:\Windows\System\nthvDZI.exe
  C:\Windows\System\nthvDZI.exe
  2⤵
  PID:7092
- C:\Windows\System\pMWeLWY.exe
  C:\Windows\System\pMWeLWY.exe
  2⤵
  PID:7108
- C:\Windows\System\VnlMbvE.exe
  C:\Windows\System\VnlMbvE.exe
  2⤵
  PID:7124
- C:\Windows\System\GmdoyCl.exe
  C:\Windows\System\GmdoyCl.exe
  2⤵
  PID:7140
- C:\Windows\System\nsXaVzp.exe
  C:\Windows\System\nsXaVzp.exe
  2⤵
  PID:7156
- C:\Windows\System\YhoQfHK.exe
  C:\Windows\System\YhoQfHK.exe
  2⤵
  PID:1868
- C:\Windows\System\JTbBAUP.exe
  C:\Windows\System\JTbBAUP.exe
  2⤵
  PID:1504
- C:\Windows\System\rbqdrXy.exe
  C:\Windows\System\rbqdrXy.exe
  2⤵
  PID:3500
- C:\Windows\System\PRScFhS.exe
  C:\Windows\System\PRScFhS.exe
  2⤵
  PID:5232
- C:\Windows\System\iRttGdq.exe
  C:\Windows\System\iRttGdq.exe
  2⤵
  PID:1424
- C:\Windows\System\NpoaZiy.exe
  C:\Windows\System\NpoaZiy.exe
  2⤵
  PID:4284
- C:\Windows\System\JyYRaHV.exe
  C:\Windows\System\JyYRaHV.exe
  2⤵
  PID:6204
- C:\Windows\System\iodpjTk.exe
  C:\Windows\System\iodpjTk.exe
  2⤵
  PID:1936
- C:\Windows\System\sajJjaz.exe
  C:\Windows\System\sajJjaz.exe
  2⤵
  PID:4356
- C:\Windows\System\QSTaIOF.exe
  C:\Windows\System\QSTaIOF.exe
  2⤵
  PID:4844
- C:\Windows\System\BNaiAWr.exe
  C:\Windows\System\BNaiAWr.exe
  2⤵
  PID:5840
- C:\Windows\System\YXqGfrh.exe
  C:\Windows\System\YXqGfrh.exe
  2⤵
  PID:5216
- C:\Windows\System\CTZDTcB.exe
  C:\Windows\System\CTZDTcB.exe
  2⤵
  PID:5384
- C:\Windows\System\TlyLBxY.exe
  C:\Windows\System\TlyLBxY.exe
  2⤵
  PID:5088
- C:\Windows\System\MnSFZaE.exe
  C:\Windows\System\MnSFZaE.exe
  2⤵
  PID:5508
- C:\Windows\System\DUvWspi.exe
  C:\Windows\System\DUvWspi.exe
  2⤵
  PID:2936
- C:\Windows\System\bErsezp.exe
  C:\Windows\System\bErsezp.exe
  2⤵
  PID:5724
- C:\Windows\System\rLPQliX.exe
  C:\Windows\System\rLPQliX.exe
  2⤵
  PID:1048
- C:\Windows\System\GLOzWEL.exe
  C:\Windows\System\GLOzWEL.exe
  2⤵
  PID:6248
- C:\Windows\System\yOhJhVW.exe
  C:\Windows\System\yOhJhVW.exe
  2⤵
  PID:6184
- C:\Windows\System\GdtGwBe.exe
  C:\Windows\System\GdtGwBe.exe
  2⤵
  PID:6324
- C:\Windows\System\YtsGvJN.exe
  C:\Windows\System\YtsGvJN.exe
  2⤵
  PID:1840
- C:\Windows\System\YJpLBGD.exe
  C:\Windows\System\YJpLBGD.exe
  2⤵
  PID:6080
- C:\Windows\System\Xrnrwkj.exe
  C:\Windows\System\Xrnrwkj.exe
  2⤵
  PID:3876
- C:\Windows\System\JbQaKXx.exe
  C:\Windows\System\JbQaKXx.exe
  2⤵
  PID:4012
- C:\Windows\System\RMedNDY.exe
  C:\Windows\System\RMedNDY.exe
  2⤵
  PID:4196
- C:\Windows\System\IfbOeUc.exe
  C:\Windows\System\IfbOeUc.exe
  2⤵
  PID:6252
- C:\Windows\System\vNNAcZl.exe
  C:\Windows\System\vNNAcZl.exe
  2⤵
  PID:6232
- C:\Windows\System\uYBpfmB.exe
  C:\Windows\System\uYBpfmB.exe
  2⤵
  PID:6268
- C:\Windows\System\HLkOlOh.exe
  C:\Windows\System\HLkOlOh.exe
  2⤵
  PID:5764
- C:\Windows\System\fmLWcvI.exe
  C:\Windows\System\fmLWcvI.exe
  2⤵
  PID:6344
- C:\Windows\System\bYFtTAl.exe
  C:\Windows\System\bYFtTAl.exe
  2⤵
  PID:6376
- C:\Windows\System\HSrXYnV.exe
  C:\Windows\System\HSrXYnV.exe
  2⤵
  PID:6388
- C:\Windows\System\iZegazS.exe
  C:\Windows\System\iZegazS.exe
  2⤵
  PID:6408
- C:\Windows\System\duFaRWE.exe
  C:\Windows\System\duFaRWE.exe
  2⤵
  PID:6424
- C:\Windows\System\EhdpAgI.exe
  C:\Windows\System\EhdpAgI.exe
  2⤵
  PID:6456
- C:\Windows\System\sGFRawB.exe
  C:\Windows\System\sGFRawB.exe
  2⤵
  PID:6524
- C:\Windows\System\AdgskxR.exe
  C:\Windows\System\AdgskxR.exe
  2⤵
  PID:6588
- C:\Windows\System\IXZgDBe.exe
  C:\Windows\System\IXZgDBe.exe
  2⤵
  PID:6440
- C:\Windows\System\zTSLvwL.exe
  C:\Windows\System\zTSLvwL.exe
  2⤵
  PID:6572
- C:\Windows\System\QkCkGBF.exe
  C:\Windows\System\QkCkGBF.exe
  2⤵
  PID:6664
- C:\Windows\System\AxeFHlo.exe
  C:\Windows\System\AxeFHlo.exe
  2⤵
  PID:6668
- C:\Windows\System\rxhIOeN.exe
  C:\Windows\System\rxhIOeN.exe
  2⤵
  PID:6648
- C:\Windows\System\nOfItwY.exe
  C:\Windows\System\nOfItwY.exe
  2⤵
  PID:6712
- C:\Windows\System\imFglRA.exe
  C:\Windows\System\imFglRA.exe
  2⤵
  PID:6744
- C:\Windows\System\VKmWmeb.exe
  C:\Windows\System\VKmWmeb.exe
  2⤵
  PID:6784
- C:\Windows\System\sEtitKu.exe
  C:\Windows\System\sEtitKu.exe
  2⤵
  PID:6800
- C:\Windows\System\BHQhDsi.exe
  C:\Windows\System\BHQhDsi.exe
  2⤵
  PID:6816
- C:\Windows\System\THeXnDl.exe
  C:\Windows\System\THeXnDl.exe
  2⤵
  PID:6832
- C:\Windows\System\leOrLkI.exe
  C:\Windows\System\leOrLkI.exe
  2⤵
  PID:6848
- C:\Windows\System\yOYDdDC.exe
  C:\Windows\System\yOYDdDC.exe
  2⤵
  PID:6948
- C:\Windows\System\uyBRKDf.exe
  C:\Windows\System\uyBRKDf.exe
  2⤵
  PID:7048
- C:\Windows\System\LMCMzDr.exe
  C:\Windows\System\LMCMzDr.exe
  2⤵
  PID:7116
- C:\Windows\System\bbBjllt.exe
  C:\Windows\System\bbBjllt.exe
  2⤵
  PID:6880
- C:\Windows\System\ZJLUbMZ.exe
  C:\Windows\System\ZJLUbMZ.exe
  2⤵
  PID:2724
- C:\Windows\System\gqRFfGR.exe
  C:\Windows\System\gqRFfGR.exe
  2⤵
  PID:4712
- C:\Windows\System\JmemArr.exe
  C:\Windows\System\JmemArr.exe
  2⤵
  PID:4400
- C:\Windows\System\QEHvKNp.exe
  C:\Windows\System\QEHvKNp.exe
  2⤵
  PID:6984
- C:\Windows\System\FRCICBw.exe
  C:\Windows\System\FRCICBw.exe
  2⤵
  PID:6808
- C:\Windows\System\lEswwYk.exe
  C:\Windows\System\lEswwYk.exe
  2⤵
  PID:6652
- C:\Windows\System\SOTGEeL.exe
  C:\Windows\System\SOTGEeL.exe
  2⤵
  PID:6540
- C:\Windows\System\HVodcmx.exe
  C:\Windows\System\HVodcmx.exe
  2⤵
  PID:6452
- C:\Windows\System\hTuupRj.exe
  C:\Windows\System\hTuupRj.exe
  2⤵
  PID:6368
- C:\Windows\System\rLWJYQW.exe
  C:\Windows\System\rLWJYQW.exe
  2⤵
  PID:6332
- C:\Windows\System\RwTqmkA.exe
  C:\Windows\System\RwTqmkA.exe
  2⤵
  PID:3936
- C:\Windows\System\wErhUEM.exe
  C:\Windows\System\wErhUEM.exe
  2⤵
  PID:6256
- C:\Windows\System\FnJtcGV.exe
  C:\Windows\System\FnJtcGV.exe
  2⤵
  PID:5492
- C:\Windows\System\fHENLFG.exe
  C:\Windows\System\fHENLFG.exe
  2⤵
  PID:3220
- C:\Windows\System\eeDCxbF.exe
  C:\Windows\System\eeDCxbF.exe
  2⤵
  PID:7148
- C:\Windows\System\NloALZS.exe
  C:\Windows\System\NloALZS.exe
  2⤵
  PID:6772
- C:\Windows\System\pNblxvG.exe
  C:\Windows\System\pNblxvG.exe
  2⤵
  PID:7020
- C:\Windows\System\uGTumJR.exe
  C:\Windows\System\uGTumJR.exe
  2⤵
  PID:5760
- C:\Windows\System\ouINZir.exe
  C:\Windows\System\ouINZir.exe
  2⤵
  PID:6400
- C:\Windows\System\JZbhVdP.exe
  C:\Windows\System\JZbhVdP.exe
  2⤵
  PID:6872
- C:\Windows\System\CdMbfXC.exe
  C:\Windows\System\CdMbfXC.exe
  2⤵
  PID:6932
- C:\Windows\System\QVdfwdv.exe
  C:\Windows\System\QVdfwdv.exe
  2⤵
  PID:1820
- C:\Windows\System\jxcHGDV.exe
  C:\Windows\System\jxcHGDV.exe
  2⤵
  PID:6892
- C:\Windows\System\eDAymsA.exe
  C:\Windows\System\eDAymsA.exe
  2⤵
  PID:7000
- C:\Windows\System\iLcrmGi.exe
  C:\Windows\System\iLcrmGi.exe
  2⤵
  PID:6936
- C:\Windows\System\AftrHXd.exe
  C:\Windows\System\AftrHXd.exe
  2⤵
  PID:7032
- C:\Windows\System\UjQEfRT.exe
  C:\Windows\System\UjQEfRT.exe
  2⤵
  PID:4548
- C:\Windows\System\WJSWLjU.exe
  C:\Windows\System\WJSWLjU.exe
  2⤵
  PID:7164
- C:\Windows\System\OvRcqrt.exe
  C:\Windows\System\OvRcqrt.exe
  2⤵
  PID:7136
- C:\Windows\System\pjgyRtl.exe
  C:\Windows\System\pjgyRtl.exe
  2⤵
  PID:6728
- C:\Windows\System\fDXRaHj.exe
  C:\Windows\System\fDXRaHj.exe
  2⤵
  PID:6780
- C:\Windows\System\EwXAJwi.exe
  C:\Windows\System\EwXAJwi.exe
  2⤵
  PID:6828
- C:\Windows\System\iecHQVS.exe
  C:\Windows\System\iecHQVS.exe
  2⤵
  PID:7088
- C:\Windows\System\ZjFikgw.exe
  C:\Windows\System\ZjFikgw.exe
  2⤵
  PID:5424
- C:\Windows\System\PMQxrNj.exe
  C:\Windows\System\PMQxrNj.exe
  2⤵
  PID:6620
- C:\Windows\System\BnnYnHI.exe
  C:\Windows\System\BnnYnHI.exe
  2⤵
  PID:6404
- C:\Windows\System\lRaoYQv.exe
  C:\Windows\System\lRaoYQv.exe
  2⤵
  PID:5584
- C:\Windows\System\HAXDcpg.exe
  C:\Windows\System\HAXDcpg.exe
  2⤵
  PID:6864
- C:\Windows\System\dahvnYJ.exe
  C:\Windows\System\dahvnYJ.exe
  2⤵
  PID:2136
- C:\Windows\System\ZTgjkPZ.exe
  C:\Windows\System\ZTgjkPZ.exe
  2⤵
  PID:6928
- C:\Windows\System\ucsrgYX.exe
  C:\Windows\System\ucsrgYX.exe
  2⤵
  PID:2072
- C:\Windows\System\fdlVUsk.exe
  C:\Windows\System\fdlVUsk.exe
  2⤵
  PID:4960
- C:\Windows\System\xgdjeov.exe
  C:\Windows\System\xgdjeov.exe
  2⤵
  PID:7104
- C:\Windows\System\PxsOAHK.exe
  C:\Windows\System\PxsOAHK.exe
  2⤵
  PID:6200
- C:\Windows\System\PteGTYh.exe
  C:\Windows\System\PteGTYh.exe
  2⤵
  PID:2532
- C:\Windows\System\ocjJiKB.exe
  C:\Windows\System\ocjJiKB.exe
  2⤵
  PID:6220
- C:\Windows\System\MWIcSRe.exe
  C:\Windows\System\MWIcSRe.exe
  2⤵
  PID:5916
- C:\Windows\System\qaXFaFh.exe
  C:\Windows\System\qaXFaFh.exe
  2⤵
  PID:6216
- C:\Windows\System\Jiaelhe.exe
  C:\Windows\System\Jiaelhe.exe
  2⤵
  PID:6348
- C:\Windows\System\udbyxbh.exe
  C:\Windows\System\udbyxbh.exe
  2⤵
  PID:6516
- C:\Windows\System\IZfEJLG.exe
  C:\Windows\System\IZfEJLG.exe
  2⤵
  PID:6700
- C:\Windows\System\ZySzZrm.exe
  C:\Windows\System\ZySzZrm.exe
  2⤵
  PID:1880
- C:\Windows\System\SxWkpMg.exe
  C:\Windows\System\SxWkpMg.exe
  2⤵
  PID:6584
- C:\Windows\System\xwEjNKC.exe
  C:\Windows\System\xwEjNKC.exe
  2⤵
  PID:6840
- C:\Windows\System\iIDXgWx.exe
  C:\Windows\System\iIDXgWx.exe
  2⤵
  PID:6908
- C:\Windows\System\UmhelBJ.exe
  C:\Windows\System\UmhelBJ.exe
  2⤵
  PID:5044
- C:\Windows\System\FRnUbEs.exe
  C:\Windows\System\FRnUbEs.exe
  2⤵
  PID:6860
- C:\Windows\System\ChXbItT.exe
  C:\Windows\System\ChXbItT.exe
  2⤵
  PID:6188
- C:\Windows\System\tFOpnFH.exe
  C:\Windows\System\tFOpnFH.exe
  2⤵
  PID:7036
- C:\Windows\System\FXzzsqk.exe
  C:\Windows\System\FXzzsqk.exe
  2⤵
  PID:6056
- C:\Windows\System\BAQxXWl.exe
  C:\Windows\System\BAQxXWl.exe
  2⤵
  PID:6304
- C:\Windows\System\UVISeFc.exe
  C:\Windows\System\UVISeFc.exe
  2⤵
  PID:6888
- C:\Windows\System\dAVIntC.exe
  C:\Windows\System\dAVIntC.exe
  2⤵
  PID:2180
- C:\Windows\System\VvOFGFK.exe
  C:\Windows\System\VvOFGFK.exe
  2⤵
  PID:7100
- C:\Windows\System\MaRCxTY.exe
  C:\Windows\System\MaRCxTY.exe
  2⤵
  PID:6432
- C:\Windows\System\NtvHefW.exe
  C:\Windows\System\NtvHefW.exe
  2⤵
  PID:6988
- C:\Windows\System\yxdJGnS.exe
  C:\Windows\System\yxdJGnS.exe
  2⤵
  PID:7064
- C:\Windows\System\coQSxMj.exe
  C:\Windows\System\coQSxMj.exe
  2⤵
  PID:7052
- C:\Windows\System\YIZwIuz.exe
  C:\Windows\System\YIZwIuz.exe
  2⤵
  PID:2624
- C:\Windows\System\rdYhWvK.exe
  C:\Windows\System\rdYhWvK.exe
  2⤵
  PID:7180
- C:\Windows\System\oBNrHUr.exe
  C:\Windows\System\oBNrHUr.exe
  2⤵
  PID:7200
- C:\Windows\System\lzNIdXH.exe
  C:\Windows\System\lzNIdXH.exe
  2⤵
  PID:7216
- C:\Windows\System\XeYXKdr.exe
  C:\Windows\System\XeYXKdr.exe
  2⤵
  PID:7232
- C:\Windows\System\rrWaKEj.exe
  C:\Windows\System\rrWaKEj.exe
  2⤵
  PID:7248
- C:\Windows\System\ZVvVvZg.exe
  C:\Windows\System\ZVvVvZg.exe
  2⤵
  PID:7264
- C:\Windows\System\OUolUUe.exe
  C:\Windows\System\OUolUUe.exe
  2⤵
  PID:7280
- C:\Windows\System\EcXuUPk.exe
  C:\Windows\System\EcXuUPk.exe
  2⤵
  PID:7296
- C:\Windows\System\yEqJyac.exe
  C:\Windows\System\yEqJyac.exe
  2⤵
  PID:7312
- C:\Windows\System\rZgeefv.exe
  C:\Windows\System\rZgeefv.exe
  2⤵
  PID:7332
- C:\Windows\System\pmCXJPy.exe
  C:\Windows\System\pmCXJPy.exe
  2⤵
  PID:7348
- C:\Windows\System\ECSJGbB.exe
  C:\Windows\System\ECSJGbB.exe
  2⤵
  PID:7364
- C:\Windows\System\bJPkkev.exe
  C:\Windows\System\bJPkkev.exe
  2⤵
  PID:7380
- C:\Windows\System\IMspoGC.exe
  C:\Windows\System\IMspoGC.exe
  2⤵
  PID:7396
- C:\Windows\System\dXznDmy.exe
  C:\Windows\System\dXznDmy.exe
  2⤵
  PID:7412
- C:\Windows\System\cdfOCRh.exe
  C:\Windows\System\cdfOCRh.exe
  2⤵
  PID:7428
- C:\Windows\System\kmYYrMw.exe
  C:\Windows\System\kmYYrMw.exe
  2⤵
  PID:7444
- C:\Windows\System\OLeZVuu.exe
  C:\Windows\System\OLeZVuu.exe
  2⤵
  PID:7460
- C:\Windows\System\iZheCRv.exe
  C:\Windows\System\iZheCRv.exe
  2⤵
  PID:7476
- C:\Windows\System\nmTRwyF.exe
  C:\Windows\System\nmTRwyF.exe
  2⤵
  PID:7492
- C:\Windows\System\nvhJdsI.exe
  C:\Windows\System\nvhJdsI.exe
  2⤵
  PID:7508
- C:\Windows\System\UtKlCTU.exe
  C:\Windows\System\UtKlCTU.exe
  2⤵
  PID:7524
- C:\Windows\System\UNBQSRM.exe
  C:\Windows\System\UNBQSRM.exe
  2⤵
  PID:7540
- C:\Windows\System\youWOdu.exe
  C:\Windows\System\youWOdu.exe
  2⤵
  PID:7556
- C:\Windows\System\jYvgRiv.exe
  C:\Windows\System\jYvgRiv.exe
  2⤵
  PID:7572
- C:\Windows\System\dFPpgIY.exe
  C:\Windows\System\dFPpgIY.exe
  2⤵
  PID:7588
- C:\Windows\System\lgQIJRb.exe
  C:\Windows\System\lgQIJRb.exe
  2⤵
  PID:7604
- C:\Windows\System\WqoTxgD.exe
  C:\Windows\System\WqoTxgD.exe
  2⤵
  PID:7620
- C:\Windows\System\FaKDaSg.exe
  C:\Windows\System\FaKDaSg.exe
  2⤵
  PID:7636
- C:\Windows\System\PcTkNcT.exe
  C:\Windows\System\PcTkNcT.exe
  2⤵
  PID:7652
- C:\Windows\System\lgUsLTL.exe
  C:\Windows\System\lgUsLTL.exe
  2⤵
  PID:7668
- C:\Windows\System\fNEANrv.exe
  C:\Windows\System\fNEANrv.exe
  2⤵
  PID:7684
- C:\Windows\System\rtgNIwl.exe
  C:\Windows\System\rtgNIwl.exe
  2⤵
  PID:7700
- C:\Windows\System\qGvnqsF.exe
  C:\Windows\System\qGvnqsF.exe
  2⤵
  PID:7716
- C:\Windows\System\EUPjOkA.exe
  C:\Windows\System\EUPjOkA.exe
  2⤵
  PID:7820
- C:\Windows\System\jBOMGig.exe
  C:\Windows\System\jBOMGig.exe
  2⤵
  PID:7836
- C:\Windows\System\YAKzcHT.exe
  C:\Windows\System\YAKzcHT.exe
  2⤵
  PID:7852
- C:\Windows\System\rFGvtpq.exe
  C:\Windows\System\rFGvtpq.exe
  2⤵
  PID:7868
- C:\Windows\System\yAHYUMs.exe
  C:\Windows\System\yAHYUMs.exe
  2⤵
  PID:7884
- C:\Windows\System\jIAINAX.exe
  C:\Windows\System\jIAINAX.exe
  2⤵
  PID:7900
- C:\Windows\System\SalOCtc.exe
  C:\Windows\System\SalOCtc.exe
  2⤵
  PID:7916
- C:\Windows\System\WLiMOli.exe
  C:\Windows\System\WLiMOli.exe
  2⤵
  PID:7936
- C:\Windows\System\OnYnwct.exe
  C:\Windows\System\OnYnwct.exe
  2⤵
  PID:7956
- C:\Windows\System\lSDgglI.exe
  C:\Windows\System\lSDgglI.exe
  2⤵
  PID:7972
- C:\Windows\System\WlTnvqH.exe
  C:\Windows\System\WlTnvqH.exe
  2⤵
  PID:7988
- C:\Windows\System\EMXQwiy.exe
  C:\Windows\System\EMXQwiy.exe
  2⤵
  PID:8092
- C:\Windows\System\poqZnmy.exe
  C:\Windows\System\poqZnmy.exe
  2⤵
  PID:8116
- C:\Windows\System\iJAOygD.exe
  C:\Windows\System\iJAOygD.exe
  2⤵
  PID:8132
- C:\Windows\System\ijZaSlR.exe
  C:\Windows\System\ijZaSlR.exe
  2⤵
  PID:8148
- C:\Windows\System\PesgOSB.exe
  C:\Windows\System\PesgOSB.exe
  2⤵
  PID:8168
- C:\Windows\System\lTrOHRr.exe
  C:\Windows\System\lTrOHRr.exe
  2⤵
  PID:6536
- C:\Windows\System\mhKutqV.exe
  C:\Windows\System\mhKutqV.exe
  2⤵
  PID:6356
- C:\Windows\System\xDsOTUE.exe
  C:\Windows\System\xDsOTUE.exe
  2⤵
  PID:6736
- C:\Windows\System\zjBzMDL.exe
  C:\Windows\System\zjBzMDL.exe
  2⤵
  PID:6964
- C:\Windows\System\tPgalYP.exe
  C:\Windows\System\tPgalYP.exe
  2⤵
  PID:7192
- C:\Windows\System\aXqUgTl.exe
  C:\Windows\System\aXqUgTl.exe
  2⤵
  PID:7240
- C:\Windows\System\effHzUL.exe
  C:\Windows\System\effHzUL.exe
  2⤵
  PID:7260
- C:\Windows\System\MEStCZR.exe
  C:\Windows\System\MEStCZR.exe
  2⤵
  PID:7292
- C:\Windows\System\MDugaAb.exe
  C:\Windows\System\MDugaAb.exe
  2⤵
  PID:7324
- C:\Windows\System\ytOXMzg.exe
  C:\Windows\System\ytOXMzg.exe
  2⤵
  PID:7340
- C:\Windows\System\ryOGEfn.exe
  C:\Windows\System\ryOGEfn.exe
  2⤵
  PID:7376
- C:\Windows\System\eWtIlIi.exe
  C:\Windows\System\eWtIlIi.exe
  2⤵
  PID:7440
- C:\Windows\System\LCtxBWD.exe
  C:\Windows\System\LCtxBWD.exe
  2⤵
  PID:7452
- C:\Windows\System\xLyXwGP.exe
  C:\Windows\System\xLyXwGP.exe
  2⤵
  PID:7472
- C:\Windows\System\fejlWPy.exe
  C:\Windows\System\fejlWPy.exe
  2⤵
  PID:7580
- C:\Windows\System\XAGiSxe.exe
  C:\Windows\System\XAGiSxe.exe
  2⤵
  PID:7596
- C:\Windows\System\ReFMJmV.exe
  C:\Windows\System\ReFMJmV.exe
  2⤵
  PID:7660
- C:\Windows\System\cAdnQNJ.exe
  C:\Windows\System\cAdnQNJ.exe
  2⤵
  PID:7600
- C:\Windows\System\JclkQaY.exe
  C:\Windows\System\JclkQaY.exe
  2⤵
  PID:7648
- C:\Windows\System\AFnvQWH.exe
  C:\Windows\System\AFnvQWH.exe
  2⤵
  PID:7488
- C:\Windows\System\PDBZidL.exe
  C:\Windows\System\PDBZidL.exe
  2⤵
  PID:7548
- C:\Windows\System\odClDHs.exe
  C:\Windows\System\odClDHs.exe
  2⤵
  PID:7732
- C:\Windows\System\cDEduEA.exe
  C:\Windows\System\cDEduEA.exe
  2⤵
  PID:7748
- C:\Windows\System\xAnebuS.exe
  C:\Windows\System\xAnebuS.exe
  2⤵
  PID:7768
- C:\Windows\System\XUONCHm.exe
  C:\Windows\System\XUONCHm.exe
  2⤵
  PID:7776
- C:\Windows\System\FGRwHMG.exe
  C:\Windows\System\FGRwHMG.exe
  2⤵
  PID:7808
- C:\Windows\System\ygJsJSt.exe
  C:\Windows\System\ygJsJSt.exe
  2⤵
  PID:7804
- C:\Windows\System\ntltUnK.exe
  C:\Windows\System\ntltUnK.exe
  2⤵
  PID:7876
- C:\Windows\System\FbYFWPz.exe
  C:\Windows\System\FbYFWPz.exe
  2⤵
  PID:7952
- C:\Windows\System\TVtTXPr.exe
  C:\Windows\System\TVtTXPr.exe
  2⤵
  PID:7908
- C:\Windows\System\elgEHnm.exe
  C:\Windows\System\elgEHnm.exe
  2⤵
  PID:7924
- C:\Windows\System\OVNAOvj.exe
  C:\Windows\System\OVNAOvj.exe
  2⤵
  PID:7832
- C:\Windows\System\HAYgidT.exe
  C:\Windows\System\HAYgidT.exe
  2⤵
  PID:7996
- C:\Windows\System\LkhnXuj.exe
  C:\Windows\System\LkhnXuj.exe
  2⤵
  PID:8016
- C:\Windows\System\uwXdOjD.exe
  C:\Windows\System\uwXdOjD.exe
  2⤵
  PID:8032
- C:\Windows\System\nmYltCn.exe
  C:\Windows\System\nmYltCn.exe
  2⤵
  PID:8048
- C:\Windows\System\xkoJWrh.exe
  C:\Windows\System\xkoJWrh.exe
  2⤵
  PID:8080
- C:\Windows\System\PmJfRuQ.exe
  C:\Windows\System\PmJfRuQ.exe
  2⤵
  PID:8076
- C:\Windows\System\wHeJzYH.exe
  C:\Windows\System\wHeJzYH.exe
  2⤵
  PID:8108
- C:\Windows\System\pQikJsN.exe
  C:\Windows\System\pQikJsN.exe
  2⤵
  PID:8176
- C:\Windows\System\LgaGxRM.exe
  C:\Windows\System\LgaGxRM.exe
  2⤵
  PID:8156
- C:\Windows\System\CtrOXEn.exe
  C:\Windows\System\CtrOXEn.exe
  2⤵
  PID:8184
- C:\Windows\System\djAtsrV.exe
  C:\Windows\System\djAtsrV.exe
  2⤵
  PID:6812
- C:\Windows\System\HjjXRDp.exe
  C:\Windows\System\HjjXRDp.exe
  2⤵
  PID:7224
- C:\Windows\System\LzuWbtk.exe
  C:\Windows\System\LzuWbtk.exe
  2⤵
  PID:7328
- C:\Windows\System\KIdtlQr.exe
  C:\Windows\System\KIdtlQr.exe
  2⤵
  PID:7392
- C:\Windows\System\BYJUett.exe
  C:\Windows\System\BYJUett.exe
  2⤵
  PID:7612
- C:\Windows\System\QBjZgWs.exe
  C:\Windows\System\QBjZgWs.exe
  2⤵
  PID:7680
- C:\Windows\System\QhTsUik.exe
  C:\Windows\System\QhTsUik.exe
  2⤵
  PID:6740
- C:\Windows\System\YUDkUlv.exe
  C:\Windows\System\YUDkUlv.exe
  2⤵
  PID:7276
- C:\Windows\System\nbOmTNu.exe
  C:\Windows\System\nbOmTNu.exe
  2⤵
  PID:7500
- C:\Windows\System\EoobMAP.exe
  C:\Windows\System\EoobMAP.exe
  2⤵
  PID:7484
- C:\Windows\System\NWGxclc.exe
  C:\Windows\System\NWGxclc.exe
  2⤵
  PID:7632
- C:\Windows\System\XbRgSUc.exe
  C:\Windows\System\XbRgSUc.exe
  2⤵
  PID:7744
- C:\Windows\System\EvvlDBu.exe
  C:\Windows\System\EvvlDBu.exe
  2⤵
  PID:7800
- C:\Windows\System\BEWNkLc.exe
  C:\Windows\System\BEWNkLc.exe
  2⤵
  PID:7892
- C:\Windows\System\KcoPAqt.exe
  C:\Windows\System\KcoPAqt.exe
  2⤵
  PID:8056
- C:\Windows\System\NKFlMGY.exe
  C:\Windows\System\NKFlMGY.exe
  2⤵
  PID:7784
- C:\Windows\System\zgEmPWx.exe
  C:\Windows\System\zgEmPWx.exe
  2⤵
  PID:7912
- C:\Windows\System\CDooBKv.exe
  C:\Windows\System\CDooBKv.exe
  2⤵
  PID:8012
- C:\Windows\System\USvznhJ.exe
  C:\Windows\System\USvznhJ.exe
  2⤵
  PID:8072
- C:\Windows\System\gGBZfHy.exe
  C:\Windows\System\gGBZfHy.exe
  2⤵
  PID:8128
- C:\Windows\System\OejMgBv.exe
  C:\Windows\System\OejMgBv.exe
  2⤵
  PID:7696
- C:\Windows\System\BxqWrIy.exe
  C:\Windows\System\BxqWrIy.exe
  2⤵
  PID:7436
- C:\Windows\System\GFjNcxJ.exe
  C:\Windows\System\GFjNcxJ.exe
  2⤵
  PID:7740
- C:\Windows\System\tABftRr.exe
  C:\Windows\System\tABftRr.exe
  2⤵
  PID:7828
- C:\Windows\System\FmbuuPd.exe
  C:\Windows\System\FmbuuPd.exe
  2⤵
  PID:7172
- C:\Windows\System\TXtVKqx.exe
  C:\Windows\System\TXtVKqx.exe
  2⤵
  PID:7552
- C:\Windows\System\cCZSAGr.exe
  C:\Windows\System\cCZSAGr.exe
  2⤵
  PID:7408
- C:\Windows\System\UvKxxzM.exe
  C:\Windows\System\UvKxxzM.exe
  2⤵
  PID:7780
- C:\Windows\System\nIWEdQr.exe
  C:\Windows\System\nIWEdQr.exe
  2⤵
  PID:7848
- C:\Windows\System\Qmuswkc.exe
  C:\Windows\System\Qmuswkc.exe
  2⤵
  PID:8044
- C:\Windows\System\RoYsphQ.exe
  C:\Windows\System\RoYsphQ.exe
  2⤵
  PID:6156
- C:\Windows\System\HzjEBjT.exe
  C:\Windows\System\HzjEBjT.exe
  2⤵
  PID:7536
- C:\Windows\System\vTAniyw.exe
  C:\Windows\System\vTAniyw.exe
  2⤵
  PID:7308
- C:\Windows\System\paBKVBB.exe
  C:\Windows\System\paBKVBB.exe
  2⤵
  PID:7964
- C:\Windows\System\BHmLGil.exe
  C:\Windows\System\BHmLGil.exe
  2⤵
  PID:7864
- C:\Windows\System\nbBWEZP.exe
  C:\Windows\System\nbBWEZP.exe
  2⤵
  PID:7844
- C:\Windows\System\bdzlqcs.exe
  C:\Windows\System\bdzlqcs.exe
  2⤵
  PID:8208
- C:\Windows\System\kxpjwVS.exe
  C:\Windows\System\kxpjwVS.exe
  2⤵
  PID:8228
- C:\Windows\System\uCumfMn.exe
  C:\Windows\System\uCumfMn.exe
  2⤵
  PID:8244
- C:\Windows\System\cZjDSCt.exe
  C:\Windows\System\cZjDSCt.exe
  2⤵
  PID:8284
- C:\Windows\System\EBikYzZ.exe
  C:\Windows\System\EBikYzZ.exe
  2⤵
  PID:8300
- C:\Windows\System\qHDxOpf.exe
  C:\Windows\System\qHDxOpf.exe
  2⤵
  PID:8316
- C:\Windows\System\YAeopHG.exe
  C:\Windows\System\YAeopHG.exe
  2⤵
  PID:8332
- C:\Windows\System\JPEhRyg.exe
  C:\Windows\System\JPEhRyg.exe
  2⤵
  PID:8348
- C:\Windows\System\uFWdYCe.exe
  C:\Windows\System\uFWdYCe.exe
  2⤵
  PID:8364
- C:\Windows\System\RbEhTLK.exe
  C:\Windows\System\RbEhTLK.exe
  2⤵
  PID:8380
- C:\Windows\System\CGFnqmq.exe
  C:\Windows\System\CGFnqmq.exe
  2⤵
  PID:8396
- C:\Windows\System\CpBbypN.exe
  C:\Windows\System\CpBbypN.exe
  2⤵
  PID:8412
- C:\Windows\System\lAithEv.exe
  C:\Windows\System\lAithEv.exe
  2⤵
  PID:8428
- C:\Windows\System\VxFkBVw.exe
  C:\Windows\System\VxFkBVw.exe
  2⤵
  PID:8444
- C:\Windows\System\vlgquof.exe
  C:\Windows\System\vlgquof.exe
  2⤵
  PID:8460
- C:\Windows\System\LvspTvG.exe
  C:\Windows\System\LvspTvG.exe
  2⤵
  PID:8476
- C:\Windows\System\YKXQPXD.exe
  C:\Windows\System\YKXQPXD.exe
  2⤵
  PID:8492
- C:\Windows\System\yBbhrqc.exe
  C:\Windows\System\yBbhrqc.exe
  2⤵
  PID:8508
- C:\Windows\System\twpXwIn.exe
  C:\Windows\System\twpXwIn.exe
  2⤵
  PID:8524
- C:\Windows\System\KcMcfjG.exe
  C:\Windows\System\KcMcfjG.exe
  2⤵
  PID:8540
- C:\Windows\System\WlvuWFe.exe
  C:\Windows\System\WlvuWFe.exe
  2⤵
  PID:8556
- C:\Windows\System\pVmcGFs.exe
  C:\Windows\System\pVmcGFs.exe
  2⤵
  PID:8572
- C:\Windows\System\VuTDzup.exe
  C:\Windows\System\VuTDzup.exe
  2⤵
  PID:8588
- C:\Windows\System\SAKAztK.exe
  C:\Windows\System\SAKAztK.exe
  2⤵
  PID:8604
- C:\Windows\System\RpVByil.exe
  C:\Windows\System\RpVByil.exe
  2⤵
  PID:8620
- C:\Windows\System\lkqPciK.exe
  C:\Windows\System\lkqPciK.exe
  2⤵
  PID:8636
- C:\Windows\System\KdMxHPJ.exe
  C:\Windows\System\KdMxHPJ.exe
  2⤵
  PID:8652
- C:\Windows\System\ZePluAZ.exe
  C:\Windows\System\ZePluAZ.exe
  2⤵
  PID:8668
- C:\Windows\System\fQZJBjK.exe
  C:\Windows\System\fQZJBjK.exe
  2⤵
  PID:8684
- C:\Windows\System\yciBVrh.exe
  C:\Windows\System\yciBVrh.exe
  2⤵
  PID:8700
- C:\Windows\System\wubNRar.exe
  C:\Windows\System\wubNRar.exe
  2⤵
  PID:8716
- C:\Windows\System\nVHkpQf.exe
  C:\Windows\System\nVHkpQf.exe
  2⤵
  PID:8732
- C:\Windows\System\mrHBKeC.exe
  C:\Windows\System\mrHBKeC.exe
  2⤵
  PID:8748
- C:\Windows\System\biREGrE.exe
  C:\Windows\System\biREGrE.exe
  2⤵
  PID:8764
- C:\Windows\System\KnqXcUE.exe
  C:\Windows\System\KnqXcUE.exe
  2⤵
  PID:8780
- C:\Windows\System\IWVALxM.exe
  C:\Windows\System\IWVALxM.exe
  2⤵
  PID:8796
- C:\Windows\System\eagLVlh.exe
  C:\Windows\System\eagLVlh.exe
  2⤵
  PID:8812
- C:\Windows\System\oyiTVuz.exe
  C:\Windows\System\oyiTVuz.exe
  2⤵
  PID:8828
- C:\Windows\System\TrNqJva.exe
  C:\Windows\System\TrNqJva.exe
  2⤵
  PID:8844
- C:\Windows\System\dcEFuSG.exe
  C:\Windows\System\dcEFuSG.exe
  2⤵
  PID:8860
- C:\Windows\System\RaptVGR.exe
  C:\Windows\System\RaptVGR.exe
  2⤵
  PID:8876
- C:\Windows\System\husBeLB.exe
  C:\Windows\System\husBeLB.exe
  2⤵
  PID:8892
- C:\Windows\System\ffGBrKW.exe
  C:\Windows\System\ffGBrKW.exe
  2⤵
  PID:8908
- C:\Windows\System\HseGNMC.exe
  C:\Windows\System\HseGNMC.exe
  2⤵
  PID:8924
- C:\Windows\System\xtzebWf.exe
  C:\Windows\System\xtzebWf.exe
  2⤵
  PID:8940
- C:\Windows\System\wIZzvam.exe
  C:\Windows\System\wIZzvam.exe
  2⤵
  PID:8956
- C:\Windows\System\ymbcwNK.exe
  C:\Windows\System\ymbcwNK.exe
  2⤵
  PID:8972
- C:\Windows\System\vjADfYd.exe
  C:\Windows\System\vjADfYd.exe
  2⤵
  PID:8988
- C:\Windows\System\FHIpsJz.exe
  C:\Windows\System\FHIpsJz.exe
  2⤵
  PID:9004
- C:\Windows\System\RpnNnRP.exe
  C:\Windows\System\RpnNnRP.exe
  2⤵
  PID:9020
- C:\Windows\System\VrFlgzP.exe
  C:\Windows\System\VrFlgzP.exe
  2⤵
  PID:9036
- C:\Windows\System\AqEARts.exe
  C:\Windows\System\AqEARts.exe
  2⤵
  PID:9056
- C:\Windows\System\WiUhksC.exe
  C:\Windows\System\WiUhksC.exe
  2⤵
  PID:9072
- C:\Windows\System\XBNTBKF.exe
  C:\Windows\System\XBNTBKF.exe
  2⤵
  PID:9088
- C:\Windows\System\Kvakwpe.exe
  C:\Windows\System\Kvakwpe.exe
  2⤵
  PID:9104
- C:\Windows\System\TsEUwSo.exe
  C:\Windows\System\TsEUwSo.exe
  2⤵
  PID:9120
- C:\Windows\System\enOkUNa.exe
  C:\Windows\System\enOkUNa.exe
  2⤵
  PID:9136
- C:\Windows\System\FULxxtj.exe
  C:\Windows\System\FULxxtj.exe
  2⤵
  PID:9152
- C:\Windows\System\HZsqDBW.exe
  C:\Windows\System\HZsqDBW.exe
  2⤵
  PID:9168
- C:\Windows\System\fEtBKww.exe
  C:\Windows\System\fEtBKww.exe
  2⤵
  PID:9184
- C:\Windows\System\fkUqSbZ.exe
  C:\Windows\System\fkUqSbZ.exe
  2⤵
  PID:9200
- C:\Windows\System\YZUUKsq.exe
  C:\Windows\System\YZUUKsq.exe
  2⤵
  PID:8188
- C:\Windows\System\BzsaIyZ.exe
  C:\Windows\System\BzsaIyZ.exe
  2⤵
  PID:8224
- C:\Windows\System\GMWwXWT.exe
  C:\Windows\System\GMWwXWT.exe
  2⤵
  PID:8200
- C:\Windows\System\GCOpYmV.exe
  C:\Windows\System\GCOpYmV.exe
  2⤵
  PID:7424
- C:\Windows\System\hBSRdkK.exe
  C:\Windows\System\hBSRdkK.exe
  2⤵
  PID:7388
- C:\Windows\System\YGCWFZN.exe
  C:\Windows\System\YGCWFZN.exe
  2⤵
  PID:8216
- C:\Windows\System\sEFfCwg.exe
  C:\Windows\System\sEFfCwg.exe
  2⤵
  PID:8268
- C:\Windows\System\xLJiwLK.exe
  C:\Windows\System\xLJiwLK.exe
  2⤵
  PID:8292
- C:\Windows\System\ocjeSAu.exe
  C:\Windows\System\ocjeSAu.exe
  2⤵
  PID:8360
- C:\Windows\System\XjwTBKg.exe
  C:\Windows\System\XjwTBKg.exe
  2⤵
  PID:8420
- C:\Windows\System\rRALXjk.exe
  C:\Windows\System\rRALXjk.exe
  2⤵
  PID:8452
- C:\Windows\System\yCxIucb.exe
  C:\Windows\System\yCxIucb.exe
  2⤵
  PID:8376
- C:\Windows\System\FnDVTLN.exe
  C:\Windows\System\FnDVTLN.exe
  2⤵
  PID:8456
- C:\Windows\System\mAGUxzD.exe
  C:\Windows\System\mAGUxzD.exe
  2⤵
  PID:8472
- C:\Windows\System\iepFubH.exe
  C:\Windows\System\iepFubH.exe
  2⤵
  PID:8516
- C:\Windows\System\ChMQEBJ.exe
  C:\Windows\System\ChMQEBJ.exe
  2⤵
  PID:8552
- C:\Windows\System\SfCwHfJ.exe
  C:\Windows\System\SfCwHfJ.exe
  2⤵
  PID:8564
- C:\Windows\System\NvwHkXN.exe
  C:\Windows\System\NvwHkXN.exe
  2⤵
  PID:8596
- C:\Windows\System\oEaVjOW.exe
  C:\Windows\System\oEaVjOW.exe
  2⤵
  PID:8648
- C:\Windows\System\BPnYljq.exe
  C:\Windows\System\BPnYljq.exe
  2⤵
  PID:8660
- C:\Windows\System\YFqzLcR.exe
  C:\Windows\System\YFqzLcR.exe
  2⤵
  PID:8740
- C:\Windows\System\tpIYKGb.exe
  C:\Windows\System\tpIYKGb.exe
  2⤵
  PID:8728
- C:\Windows\System\MnrhoxU.exe
  C:\Windows\System\MnrhoxU.exe
  2⤵
  PID:8776
- C:\Windows\System\kHWBmNK.exe
  C:\Windows\System\kHWBmNK.exe
  2⤵
  PID:8840
- C:\Windows\System\ibgEcZb.exe
  C:\Windows\System\ibgEcZb.exe
  2⤵
  PID:8872
- C:\Windows\System\JXWzxNP.exe
  C:\Windows\System\JXWzxNP.exe
  2⤵
  PID:8856
- C:\Windows\System\dfdUgnc.exe
  C:\Windows\System\dfdUgnc.exe
  2⤵
  PID:8932
- C:\Windows\System\klBJuBh.exe
  C:\Windows\System\klBJuBh.exe
  2⤵
  PID:8916
- C:\Windows\System\fAFhXCc.exe
  C:\Windows\System\fAFhXCc.exe
  2⤵
  PID:8996
- C:\Windows\System\WjzulAy.exe
  C:\Windows\System\WjzulAy.exe
  2⤵
  PID:9064
- C:\Windows\System\Geajqap.exe
  C:\Windows\System\Geajqap.exe
  2⤵
  PID:9100
- C:\Windows\System\CKQnRWA.exe
  C:\Windows\System\CKQnRWA.exe
  2⤵
  PID:8952
- C:\Windows\System\gcWrzrH.exe
  C:\Windows\System\gcWrzrH.exe
  2⤵
  PID:9192
- C:\Windows\System\ZHhCzxR.exe
  C:\Windows\System\ZHhCzxR.exe
  2⤵
  PID:8068
- C:\Windows\System\QmzQvyv.exe
  C:\Windows\System\QmzQvyv.exe
  2⤵
  PID:7616
- C:\Windows\System\vYBnGXh.exe
  C:\Windows\System\vYBnGXh.exe
  2⤵
  PID:8140
- C:\Windows\System\fXpxuHY.exe
  C:\Windows\System\fXpxuHY.exe
  2⤵
  PID:9052
- C:\Windows\System\BaKLHgU.exe
  C:\Windows\System\BaKLHgU.exe
  2⤵
  PID:8204
- C:\Windows\System\DqXssBL.exe
  C:\Windows\System\DqXssBL.exe
  2⤵
  PID:7708
- C:\Windows\System\rigRCcZ.exe
  C:\Windows\System\rigRCcZ.exe
  2⤵
  PID:8260
- C:\Windows\System\jLUSDRg.exe
  C:\Windows\System\jLUSDRg.exe
  2⤵
  PID:8392
- C:\Windows\System\oatjkqH.exe
  C:\Windows\System\oatjkqH.exe
  2⤵
  PID:8344
- C:\Windows\System\gBtEpaU.exe
  C:\Windows\System\gBtEpaU.exe
  2⤵
  PID:8308
- C:\Windows\System\loYAkHn.exe
  C:\Windows\System\loYAkHn.exe
  2⤵
  PID:8500
- C:\Windows\System\agsaGvG.exe
  C:\Windows\System\agsaGvG.exe
  2⤵
  PID:8680
- C:\Windows\System\GiRwGFq.exe
  C:\Windows\System\GiRwGFq.exe
  2⤵
  PID:8532
- C:\Windows\System\dkImAzv.exe
  C:\Windows\System\dkImAzv.exe
  2⤵
  PID:8724
- C:\Windows\System\cCtEiEt.exe
  C:\Windows\System\cCtEiEt.exe
  2⤵
  PID:8744
- C:\Windows\System\YfiKqOA.exe
  C:\Windows\System\YfiKqOA.exe
  2⤵
  PID:8760
- C:\Windows\System\YsUNaaQ.exe
  C:\Windows\System\YsUNaaQ.exe
  2⤵
  PID:8904
- C:\Windows\System\KGEBWoE.exe
  C:\Windows\System\KGEBWoE.exe
  2⤵
  PID:9032
- C:\Windows\System\DOinsSh.exe
  C:\Windows\System\DOinsSh.exe
  2⤵
  PID:8984
- C:\Windows\System\dthHOoo.exe
  C:\Windows\System\dthHOoo.exe
  2⤵
  PID:8008
- C:\Windows\System\xeWvjkZ.exe
  C:\Windows\System\xeWvjkZ.exe
  2⤵
  PID:9160
- C:\Windows\System\OyvZvFP.exe
  C:\Windows\System\OyvZvFP.exe
  2⤵
  PID:8424
- C:\Windows\System\QmIMhcc.exe
  C:\Windows\System\QmIMhcc.exe
  2⤵
  PID:9044
- C:\Windows\System\aedohvf.exe
  C:\Windows\System\aedohvf.exe
  2⤵
  PID:8388
- C:\Windows\System\OqvbwpL.exe
  C:\Windows\System\OqvbwpL.exe
  2⤵
  PID:8488
- C:\Windows\System\HJlAHzs.exe
  C:\Windows\System\HJlAHzs.exe
  2⤵
  PID:8712
- C:\Windows\System\FQlIRKP.exe
  C:\Windows\System\FQlIRKP.exe
  2⤵
  PID:8824
- C:\Windows\System\fyzPGRj.exe
  C:\Windows\System\fyzPGRj.exe
  2⤵
  PID:8948
- C:\Windows\System\tjXqJDD.exe
  C:\Windows\System\tjXqJDD.exe
  2⤵
  PID:8792
- C:\Windows\System\bnzRNGT.exe
  C:\Windows\System\bnzRNGT.exe
  2⤵
  PID:9084
- C:\Windows\System\QmieWDC.exe
  C:\Windows\System\QmieWDC.exe
  2⤵
  PID:9016
- C:\Windows\System\xuYGQWu.exe
  C:\Windows\System\xuYGQWu.exe
  2⤵
  PID:8612
- C:\Windows\System\eRJzfrv.exe
  C:\Windows\System\eRJzfrv.exe
  2⤵
  PID:9144
- C:\Windows\System\GemPVhs.exe
  C:\Windows\System\GemPVhs.exe
  2⤵
  PID:9224
- C:\Windows\System\UXmMrrP.exe
  C:\Windows\System\UXmMrrP.exe
  2⤵
  PID:9240
- C:\Windows\System\wHNdVZm.exe
  C:\Windows\System\wHNdVZm.exe
  2⤵
  PID:9256
- C:\Windows\System\XbwDiFH.exe
  C:\Windows\System\XbwDiFH.exe
  2⤵
  PID:9272
- C:\Windows\System\KmrLXOU.exe
  C:\Windows\System\KmrLXOU.exe
  2⤵
  PID:9288
- C:\Windows\System\ilSNDhI.exe
  C:\Windows\System\ilSNDhI.exe
  2⤵
  PID:9304
- C:\Windows\System\UALXury.exe
  C:\Windows\System\UALXury.exe
  2⤵
  PID:9320
- C:\Windows\System\iWpxexf.exe
  C:\Windows\System\iWpxexf.exe
  2⤵
  PID:9336
- C:\Windows\System\nhWTXbc.exe
  C:\Windows\System\nhWTXbc.exe
  2⤵
  PID:9352
- C:\Windows\System\upjHSIl.exe
  C:\Windows\System\upjHSIl.exe
  2⤵
  PID:9368
- C:\Windows\System\nowfteo.exe
  C:\Windows\System\nowfteo.exe
  2⤵
  PID:9384
- C:\Windows\System\PLkuLfb.exe
  C:\Windows\System\PLkuLfb.exe
  2⤵
  PID:9400
- C:\Windows\System\aOsAjaW.exe
  C:\Windows\System\aOsAjaW.exe
  2⤵
  PID:9416
- C:\Windows\System\AqdpzAn.exe
  C:\Windows\System\AqdpzAn.exe
  2⤵
  PID:9432
- C:\Windows\System\acrmDCg.exe
  C:\Windows\System\acrmDCg.exe
  2⤵
  PID:9448
- C:\Windows\System\unBoiSV.exe
  C:\Windows\System\unBoiSV.exe
  2⤵
  PID:9468
- C:\Windows\System\WTijuXB.exe
  C:\Windows\System\WTijuXB.exe
  2⤵
  PID:9484
- C:\Windows\System\AdzrAtT.exe
  C:\Windows\System\AdzrAtT.exe
  2⤵
  PID:9500
- C:\Windows\System\zpssOZe.exe
  C:\Windows\System\zpssOZe.exe
  2⤵
  PID:9516
- C:\Windows\System\luaufCr.exe
  C:\Windows\System\luaufCr.exe
  2⤵
  PID:9532
- C:\Windows\System\ZcyVqUE.exe
  C:\Windows\System\ZcyVqUE.exe
  2⤵
  PID:9548
- C:\Windows\System\iCzaswt.exe
  C:\Windows\System\iCzaswt.exe
  2⤵
  PID:9564
- C:\Windows\System\OTKeuio.exe
  C:\Windows\System\OTKeuio.exe
  2⤵
  PID:9580
- C:\Windows\System\XehAhKv.exe
  C:\Windows\System\XehAhKv.exe
  2⤵
  PID:9596
- C:\Windows\System\mSHJZTG.exe
  C:\Windows\System\mSHJZTG.exe
  2⤵
  PID:9612
- C:\Windows\System\ywIpzMv.exe
  C:\Windows\System\ywIpzMv.exe
  2⤵
  PID:9628
- C:\Windows\System\qhmsBKB.exe
  C:\Windows\System\qhmsBKB.exe
  2⤵
  PID:9644
- C:\Windows\System\QmsJOcQ.exe
  C:\Windows\System\QmsJOcQ.exe
  2⤵
  PID:9660
- C:\Windows\System\bJehzAf.exe
  C:\Windows\System\bJehzAf.exe
  2⤵
  PID:9676
- C:\Windows\System\OVNWwfl.exe
  C:\Windows\System\OVNWwfl.exe
  2⤵
  PID:9692
- C:\Windows\System\APKtKMf.exe
  C:\Windows\System\APKtKMf.exe
  2⤵
  PID:9708
- C:\Windows\System\IWqUvoQ.exe
  C:\Windows\System\IWqUvoQ.exe
  2⤵
  PID:9724
- C:\Windows\System\HDCysfk.exe
  C:\Windows\System\HDCysfk.exe
  2⤵
  PID:9740
- C:\Windows\System\CPKEXOT.exe
  C:\Windows\System\CPKEXOT.exe
  2⤵
  PID:9756
- C:\Windows\System\ghvwKyM.exe
  C:\Windows\System\ghvwKyM.exe
  2⤵
  PID:9772
- C:\Windows\System\URNhabw.exe
  C:\Windows\System\URNhabw.exe
  2⤵
  PID:9788
- C:\Windows\System\xpZLlBp.exe
  C:\Windows\System\xpZLlBp.exe
  2⤵
  PID:9804
- C:\Windows\System\xHGVKKY.exe
  C:\Windows\System\xHGVKKY.exe
  2⤵
  PID:9820
- C:\Windows\System\paXJzBY.exe
  C:\Windows\System\paXJzBY.exe
  2⤵
  PID:9836
- C:\Windows\System\ZDAXcld.exe
  C:\Windows\System\ZDAXcld.exe
  2⤵
  PID:9852
- C:\Windows\System\UGMUrVS.exe
  C:\Windows\System\UGMUrVS.exe
  2⤵
  PID:9868
- C:\Windows\System\pNzvgYG.exe
  C:\Windows\System\pNzvgYG.exe
  2⤵
  PID:9884
- C:\Windows\System\QzfwKJf.exe
  C:\Windows\System\QzfwKJf.exe
  2⤵
  PID:9900
- C:\Windows\System\JFjBsSC.exe
  C:\Windows\System\JFjBsSC.exe
  2⤵
  PID:9916
- C:\Windows\System\dLiOrSN.exe
  C:\Windows\System\dLiOrSN.exe
  2⤵
  PID:9932
- C:\Windows\System\svkjnZg.exe
  C:\Windows\System\svkjnZg.exe
  2⤵
  PID:9948
- C:\Windows\System\QBToanU.exe
  C:\Windows\System\QBToanU.exe
  2⤵
  PID:9964
- C:\Windows\System\YKQllnR.exe
  C:\Windows\System\YKQllnR.exe
  2⤵
  PID:9980
- C:\Windows\System\DwkudjA.exe
  C:\Windows\System\DwkudjA.exe
  2⤵
  PID:9996
- C:\Windows\System\BscgmLp.exe
  C:\Windows\System\BscgmLp.exe
  2⤵
  PID:10012
- C:\Windows\System\GmCWZbN.exe
  C:\Windows\System\GmCWZbN.exe
  2⤵
  PID:10028
- C:\Windows\System\mNAChLf.exe
  C:\Windows\System\mNAChLf.exe
  2⤵
  PID:10044
- C:\Windows\System\zRuNyek.exe
  C:\Windows\System\zRuNyek.exe
  2⤵
  PID:10060
- C:\Windows\System\jLeCNWe.exe
  C:\Windows\System\jLeCNWe.exe
  2⤵
  PID:10076
- C:\Windows\System\kWmovYj.exe
  C:\Windows\System\kWmovYj.exe
  2⤵
  PID:10096
- C:\Windows\System\KdFlCGu.exe
  C:\Windows\System\KdFlCGu.exe
  2⤵
  PID:10112
- C:\Windows\System\dOLCxvY.exe
  C:\Windows\System\dOLCxvY.exe
  2⤵
  PID:10128
- C:\Windows\System\rhNoOsH.exe
  C:\Windows\System\rhNoOsH.exe
  2⤵
  PID:10144
- C:\Windows\System\naRvWYq.exe
  C:\Windows\System\naRvWYq.exe
  2⤵
  PID:10160
- C:\Windows\System\xSzjNgl.exe
  C:\Windows\System\xSzjNgl.exe
  2⤵
  PID:10176
- C:\Windows\System\VBRtFYw.exe
  C:\Windows\System\VBRtFYw.exe
  2⤵
  PID:10192
- C:\Windows\System\vlyoFRs.exe
  C:\Windows\System\vlyoFRs.exe
  2⤵
  PID:10208
- C:\Windows\System\Cukrcqb.exe
  C:\Windows\System\Cukrcqb.exe
  2⤵
  PID:10224
- C:\Windows\System\ZyflQIg.exe
  C:\Windows\System\ZyflQIg.exe
  2⤵
  PID:7728
- C:\Windows\System\bYLYaUE.exe
  C:\Windows\System\bYLYaUE.exe
  2⤵
  PID:9212
- C:\Windows\System\tCGHXOw.exe
  C:\Windows\System\tCGHXOw.exe
  2⤵
  PID:9132
- C:\Windows\System\otTqwlr.exe
  C:\Windows\System\otTqwlr.exe
  2⤵
  PID:9220
- C:\Windows\System\kljGeHF.exe
  C:\Windows\System\kljGeHF.exe
  2⤵
  PID:9268
- C:\Windows\System\kOlmNtn.exe
  C:\Windows\System\kOlmNtn.exe
  2⤵
  PID:9332
- C:\Windows\System\JoxWwea.exe
  C:\Windows\System\JoxWwea.exe
  2⤵
  PID:9280
- C:\Windows\System\QLnfUwR.exe
  C:\Windows\System\QLnfUwR.exe
  2⤵
  PID:9344
- C:\Windows\System\UbWAoAR.exe
  C:\Windows\System\UbWAoAR.exe
  2⤵
  PID:9380
- C:\Windows\System\HUakztc.exe
  C:\Windows\System\HUakztc.exe
  2⤵
  PID:9456
- C:\Windows\System\RbuefEy.exe
  C:\Windows\System\RbuefEy.exe
  2⤵
  PID:9428
- C:\Windows\System\BFoOmXk.exe
  C:\Windows\System\BFoOmXk.exe
  2⤵
  PID:9440
- C:\Windows\System\hjxSkCU.exe
  C:\Windows\System\hjxSkCU.exe
  2⤵
  PID:8436
- C:\Windows\System\IZIxlpc.exe
  C:\Windows\System\IZIxlpc.exe
  2⤵
  PID:9512
- C:\Windows\System\igsHAmy.exe
  C:\Windows\System\igsHAmy.exe
  2⤵
  PID:9560
- C:\Windows\System\mvwIYqw.exe
  C:\Windows\System\mvwIYqw.exe
  2⤵
  PID:9604
- C:\Windows\System\yxGYqlj.exe
  C:\Windows\System\yxGYqlj.exe
  2⤵
  PID:9636
- C:\Windows\System\ueomTXc.exe
  C:\Windows\System\ueomTXc.exe
  2⤵
  PID:9688
- C:\Windows\System\bneZFyT.exe
  C:\Windows\System\bneZFyT.exe
  2⤵
  PID:9704
- C:\Windows\System\LCAhoxD.exe
  C:\Windows\System\LCAhoxD.exe
  2⤵
  PID:9752
- C:\Windows\System\bfxjTRU.exe
  C:\Windows\System\bfxjTRU.exe
  2⤵
  PID:9780
- C:\Windows\System\CsJdqDG.exe
  C:\Windows\System\CsJdqDG.exe
  2⤵
  PID:9800
- C:\Windows\System\KlpEiip.exe
  C:\Windows\System\KlpEiip.exe
  2⤵
  PID:9828
- C:\Windows\System\eyIpvET.exe
  C:\Windows\System\eyIpvET.exe
  2⤵
  PID:2496
- C:\Windows\System\lndktWt.exe
  C:\Windows\System\lndktWt.exe
  2⤵
  PID:9848
- C:\Windows\System\QuaAMuQ.exe
  C:\Windows\System\QuaAMuQ.exe
  2⤵
  PID:9912
- C:\Windows\System\kaIZVAD.exe
  C:\Windows\System\kaIZVAD.exe
  2⤵
  PID:9976
- C:\Windows\System\KDRZeca.exe
  C:\Windows\System\KDRZeca.exe
  2⤵
  PID:10040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AVAFcdW.exe

Filesize
2.3MB

MD5
3cc81a8e8a8f2813b8b671d45cc9e266

SHA1
01b7351cb51dbdf12675c8a90914ce131b137d71

SHA256
1b75a79d37bc1c8f98baecc53831560ef24046c3cffa77e4195e7d18ddb2a807

SHA512
7d65e323ed01b21d4bea5df550760e892d31b92fda60554cc3076f8e3b0055d2315fc36ec0af037594c9d2498afed604fede8c7ac33af84510dfcaa96d2fd54c

Download Submit
C:\Windows\system\CUDBQAU.exe

Filesize
2.3MB

MD5
7d36be5256b6225b8185b3b4a53ebb7e

SHA1
b5edcec26de45f9d0fb988540f75bb5d8602c74d

SHA256
810977559e30d3ba8771c10ccd7a42cb822e9a3b27056f772ec6eadf72be77d8

SHA512
0f7fdabe88e763b51b4cc27d4d1c8c6434e0b9f2992e74f1fe4c17aec808932bbcae40df70fc0044900f6f9716f9165d948c755e2b9de83aba92c33edb3bd80c

Download Submit
C:\Windows\system\FafPXhS.exe

Filesize
2.3MB

MD5
44e7401ca9310ae198857301856aea27

SHA1
5a5b61459ad65af7889f7809cd2df3cdc9c6d91d

SHA256
772adfb54f51e3537b34daaf0c5d30f2050a143d8c06b9ed34dd11dc477186b7

SHA512
e866231cbec601980f56ef74a2af4949f124f8faa342ca335819aa2939d651416e1c7c735966ab8ba2a1f83fcdec8af45df26cf50ffac1c551a06a11e14c48e8

Download Submit
C:\Windows\system\FjsLdPI.exe

Filesize
2.3MB

MD5
c797996a80ecfb559ac0ce2cfaeba665

SHA1
167d9e49975d9f4cf27c4f3eaed143c5d1a9eaf0

SHA256
ca4abe3d4701b98045963534024094ae3073cda810a81a018b2eec86fd1697a0

SHA512
76a42aeed518bf51f4c10d67ce89ee47638f1182e973f3c9a59937c342043362b463e47a1aff53f56e81093d4b9a3d552bb39ed1e243ac5765c7db8f7361345c

Download Submit
C:\Windows\system\GhRAPKY.exe

Filesize
2.3MB

MD5
d1cd7009072928a940f2359f8eb159a8

SHA1
fedcd5b3005cfbd293b5831fc8de73c658a4b2e5

SHA256
5b6157b78d1c53f144b09d503e08755afe88e84122e67c2ae6c2a03dd07169dd

SHA512
d33be3e38a2c4fecb5ff38bdec596ac94880c67fdd51370f0179d5ad092d5aba7d91bb70e92a1cfb1237a8da847bc78b69a84ae6985ba02fcfab1a9784a64e6b

Download Submit
C:\Windows\system\GmTjxfG.exe

Filesize
2.3MB

MD5
6f23ae5bb547a327845ac88e351a1e84

SHA1
7a877d0a588308cac68c8dab0a37549329289fe0

SHA256
8036eb9df62fdc4ac1240e561f3c0892bc43054324a69aa456b54921e1f4b889

SHA512
276ab6d8da3f55e698e4bf4552155538ba2ff3b96a3150a56d07ebfb5d3032f083c8fd83ffc8c193bd4db681d6534ad645b9e792db73da019756d4bd67646f0e

Download Submit
C:\Windows\system\IcFEDCz.exe

Filesize
2.3MB

MD5
33f606b766a4954186737f1f354f9d5f

SHA1
30838781b7a65f99b45bd1274293d94be9030578

SHA256
41c5a880ac1832574622cb4c562e30ae90d232981b66fc3c963a061c82284153

SHA512
5711dc983a4cdb2ac45576ec3877ed7a99bcf995c272406bd91c74bf431fef70635ad2baa1adcf952735b4b71b0fa8f1e467eb88ffbe7366e95f1e8334c1ef6e

Download Submit
C:\Windows\system\JuqSGeY.exe

Filesize
2.3MB

MD5
55d8110d4efe9eb8d6b0403124d0088d

SHA1
afcb176ff2385cd0dea53adf75f2a62d88201448

SHA256
6029975677390d29c84c44e31543cfd39008a4421f18b3be0da41b22e6143bd7

SHA512
8dfef02caadb96293685c4cff7e72aafc22423c2ae8a809f21d33f6726372fc455f1cb0a13bf16845734dcf4d17df640ab33ad7b84cb70bed91c8ed8f1462ff9

Download Submit
C:\Windows\system\KlxFLax.exe

Filesize
2.3MB

MD5
52095a70c453c8919e28620da315ceb4

SHA1
e6c08889496e84d69604ea8932f3a344183546f7

SHA256
8b42a2737bcd007a8ad824bb9c7cab69c9707a2543e897354e7719d1505a619a

SHA512
3ab4d0ce2c3bfeb7ff0fa86dc3c7f2a06032edcf3273c581871c035f56161d21313dc8dbbaa01a086ede19e2012ffac35a33af1ab89120fbab0ac08a2a4d2e4c

Download Submit
C:\Windows\system\KnfIhmP.exe

Filesize
2.3MB

MD5
306f1bdc0ba0ebbae2ae605aeb981d58

SHA1
f6c2e35118852aa2df23df126cd03b14e8ea0ebb

SHA256
d2f8d25d13467565328b347dd941fc494c1dfbba9188c4d76b4461e6a0dc1db7

SHA512
822fe05a85ddf3e0264430e8e9ead1ea429e552baa31d219af3ada70cf8a4901013e3c73ec3c58840bfe8b033363cf5065563a68e097ecd0ac68b462f09b4602

Download Submit
C:\Windows\system\OALeKXg.exe

Filesize
2.3MB

MD5
1cd522eb6aa289155ed43c953ceddf49

SHA1
191f4612b894427b263356953740671866f0c74b

SHA256
3c9a92b33340e83121810d1139cb26463a1bac3f1afc3e193d924c73a21b5e78

SHA512
68b732502bf431e397ca30285f801a114ff7d562f43f860f6ba9d9ac2f421eb38c05a49a025ee676dc64435cf4e52911d098d80d24d3b4392851387457ac9552

Download Submit
C:\Windows\system\TQezKRz.exe

Filesize
2.3MB

MD5
b20747e3bb5b687ac967d1e5fa704ed8

SHA1
1bce32cb6aaa26b91ac6b7e4b8f2a61706759ea6

SHA256
1530d65889bb5613a0bdcfbf13ddfda266152f9fab60b1e23c4ce510f0b220b6

SHA512
e180b66aab680728bc2a5176292d3f4ac16854e787cc1203929453e163936d5c5c3f17cbaf12e268175aadacb92c9fbafc3698b85f7361506ab69c4c4f1716ef

Download Submit
C:\Windows\system\TjlqPvS.exe

Filesize
2.3MB

MD5
494f5ffb55f3ea803419fa884415ddae

SHA1
097f54bd93e23c49ed9957c3e9b23c28797dd89a

SHA256
9b289e58801c9e2b848b7d8a95c90bcf91f4d475137aaae86233494dd712a9ca

SHA512
5bb41bbdd0266dd3bb28fbe4375b0f4b2ff01d891887126b7d6aa32878f7fd9be93ab6d5c573b0d8272e5ce9542b4bd3975d1749bc73b94d635757e0baf8bdde

Download Submit
C:\Windows\system\VSWUmRk.exe

Filesize
2.3MB

MD5
9f2ca42c8ccb1966d92941ee97491c75

SHA1
10721617657bef447a9c065b7e730a3abe9f957b

SHA256
3a15782df54fa79c35fc5c5244bec3789906327c1f82a5a109b86d0c21b02d0a

SHA512
4565dd72ef6cf844e0eda9dd2aa5c63aae228dccc03693e35d1e5f7188367edf02b8da42fdd6996074674554a71f8f9c4beb2cd41b25b4aadea9339137af48e3

Download Submit
C:\Windows\system\WxsVPAd.exe

Filesize
2.3MB

MD5
759bf23cc89e19b67ce2be0157388f4d

SHA1
280fbbbac3f476efce96a0d5ac787fbded6ef5e4

SHA256
4bd557cb09569774c34cdac951fd3ce07b5381cf8e8e38daa199ff89647a2e60

SHA512
ccddcd7f145267cfea0c6d696ab3c11161a8d15dd0de2ec458ceae752b17d5f4aa46e7b70eda9617cdee87878e2af024917d9bdf88e8e320074b1218904434be

Download Submit
C:\Windows\system\ZPEKkru.exe

Filesize
2.3MB

MD5
99774d75884f3a42b5a2ba9cb65a7145

SHA1
fe2eb3ab8cbdbb574c658aacdd9d6dcdf3c655cc

SHA256
64ef238521d09e41f6b21ffb588822943a776dc9146a69e3a29d66c1f7c3507e

SHA512
5371b8b0be9257f74fc1e452c34baff2ce2a9aba885c0a62dc5b1e555eb7499bb018d363832a35567c541e27ea7a303ed50805d5aef4c1b7e4528785dbd3b954

Download Submit
C:\Windows\system\aBsuuiv.exe

Filesize
2.3MB

MD5
36d76bfe5f4cbc52949e9704ceff716e

SHA1
33d842a207ffc2689cafffbe6cbc97f8e4bd91d0

SHA256
7ac4a309afd5190fcfad7d896bc3cad1b186cb853c23bc27cd9e79ae01d02081

SHA512
1e3453e29eee05d3528d742a960367f55167c3d834d7d6bb782b471051978561fde385630be26b17b0d96eff15566b9df4f6ceb13a1a05a7c70384c10476a950

Download Submit
C:\Windows\system\ajDHxmP.exe

Filesize
2.3MB

MD5
8fd423e9fbd757b7574359300eb77522

SHA1
93ef4e37e641a40b67395eba10a3e606afd83344

SHA256
6818afc3b8946954fef6f621a5695e70ae7daabd0cc49957f13431e0b9a6a530

SHA512
b73801ff616b7056608f5923062639bc8555a99bb19aafdf63a7b946982668fa085b7d47e56e5a0f59de08fef4cbd995184832a0661d1a3dfbfa9cd5fcdc907f

Download Submit
C:\Windows\system\gREtpWq.exe

Filesize
2.3MB

MD5
6b816ea35c8931355143f7bb0e9fed96

SHA1
e4526a5421c5611eabbf199eed9f23b1b830108d

SHA256
168d415494bb29dae9151ea1f06817a590692ded4f159614802127fdfb48df58

SHA512
175e1a5a5cf856ef96a81d33bb5cd14d981465cef8fe8e524894d63f2625952fc4089d95ccb5e9ad183c2eb1efde74274897d13a20f205223267bc4f106c60c1

Download Submit
C:\Windows\system\gsMOJLW.exe

Filesize
2.3MB

MD5
ee0e9408e0cd6238df3d3cf648138002

SHA1
c2a4c51d094da051538b3b7299c094afc1b4c040

SHA256
8f1bb55446b5b26e707c51c76c85fcadaca09c4885acc9c931e1b0e9e6d8290a

SHA512
8cb3ca17a49289abad57653bbf1c6c8c8fdc8dccf30df5989f89f989e7884d8b457be7826fcab29b93e6d49f7d62a67458b1bd12b999fcbd12ed51ea0d845c6c

Download Submit
C:\Windows\system\jpnfrVu.exe

Filesize
2.3MB

MD5
174a04aa30667f31b49f61eb38450f26

SHA1
41205acda40fa0fb1c477caef215fdcd3edb9efc

SHA256
0569eb7f76769086bf65543d1f6f3e9ef072e8fad91d329a4833c4b5760a0574

SHA512
a7f9c5350ab1ab5db038bcebe029ae9788ecb95d1a7dc00077229057b036bf09282a30ea19717fb9325b6a51283994299fe5b9f1615868e80eafa4443e427dd8

Download Submit
C:\Windows\system\kYAPTMr.exe

Filesize
2.3MB

MD5
837044c73442bd26a8e3aace970b6225

SHA1
2cef8c2ef07531b07e9fc02c21b08a9758bb9be6

SHA256
9dd3040de6a9fb1436be870c210e8d4e5580b97896307dcb6fb0084103e21faf

SHA512
5b957bfd46c94ffa6cd4ee40b67f6f49fa6a16b6f533d5f5bcd536c04118a31c8d2343d54e4ca8961978cb1ef79c5d5c26b1fe3111d4f4d307ae48d00a0d8a57

Download Submit
C:\Windows\system\knIFhhE.exe

Filesize
2.3MB

MD5
f66a5eda9df31ef4803fee863fc3fddd

SHA1
3a6745834ba50b0d6c23b350f0b5249cc86784c1

SHA256
7fece67978f30a0bec8184d8038857773872464e5bdc5e9a1e261a8f47329ea0

SHA512
b3983f758b4763a92967a9a7d640b1c904264c697290827138b1839be995ce684c322387a36df6856aa41652fefa95016bfe173ee165d163dbd1b49a778b4a35

Download Submit
C:\Windows\system\kodiPaz.exe

Filesize
2.3MB

MD5
5669ff66c57c6dfd6b787fa88e23aa4e

SHA1
f021141049f2900cec91f86acf4d4b344189d738

SHA256
fe2574972a738c6200f3ac92fef6c1c600dd784fc07aa0cfda9a154b93a2c0f2

SHA512
636fe4718bb36768d2a204680b6172f14b60546b351b561351075b70d89a3135f31d5745980f6ede049a4fa855fe38967544ebe9f32534f6aa356c990d503d0c

Download Submit
C:\Windows\system\mfRzwfv.exe

Filesize
2.3MB

MD5
65d3b362b755a11ef7fe8b873622b530

SHA1
91ee74b2d400751db307c4952bfe7185199b46cf

SHA256
ed978669c97be2b8fa186653d196cdeff6c11961b815f9392a6cdf1e21020743

SHA512
7cfc3080e26295158ded2abff75b3b2228c11910d1aeebc5f9777033588fbc83a0d94eed95cfb9b817fddf3bd0451faac636c2e373726f642bba650540091eda

Download Submit
C:\Windows\system\nldveJE.exe

Filesize
2.3MB

MD5
4e4e554f4b4a610eeeb6a51bbfbed5a4

SHA1
0666d652413ac013dea01d1c5b7de27b4fdec47b

SHA256
a630166395b104d48beab72f64e8401edfd76f53763200ef77e5c3fdf10ac0a4

SHA512
3842e38161a2f116f5007afa9fd3d0d95cee29bb6f2f9b282d0643c481dc6d4cfe47f23f54b73804878335ce55605e803522c97eaf2cb3e1da3fc5a82a174e44

Download Submit
C:\Windows\system\ojtmueX.exe

Filesize
2.3MB

MD5
8ece387c42838729389718afe827583b

SHA1
0d330bf628d338861aa1fbee9715e5ab9c606c39

SHA256
0874dff6365912ecd05ece49a7149796bb884434bb4cd6a33e4d81af5a62ed7e

SHA512
bf5cb099a02514c691f75da81175a89c4510d3427d5942eb2d7a14fc142e096c59e14916efb50042d86597fe05aa6efee3bdc880cff4c3ad2187ffb23dce4bbc

Download Submit
C:\Windows\system\qiNDczM.exe

Filesize
2.3MB

MD5
dc6b662074917fd9d12d4b51513c7e8f

SHA1
50498c440131db36c0a610f61667e45b442331ec

SHA256
d22174d73e89b81380fd77fdfac1d1312e3e2382f6648a37fa3cd3f223d98121

SHA512
489f84c2968583e5faf2b00a227649cd2faf828ca34bcaafbe1a8de805f1d6e0ab752b68d9785065f08d4bf62da2a75ecd50b8ec3c9ce6ffe815ea662a258acc

Download Submit
C:\Windows\system\tHcSWRL.exe

Filesize
2.3MB

MD5
11095b8496688f1c2908141647f50768

SHA1
db53ab94172fb36101d30064827822686d832a28

SHA256
69bf5c99ef7454a732158311fc205a576c222f41f6de15070a27749f134e337f

SHA512
a756ec67d8bd50083e2e442347cb13d6130f187e57542b56cd11cee8f929fe2548ba8d00fc06639ad6df859a547e6a638831962eecb337c7da1be9aa8a795d27

Download Submit
C:\Windows\system\uHmmrZy.exe

Filesize
2.3MB

MD5
769f694ada111946dcf021db5eb641cd

SHA1
03a1ed4686aa729fb55d64243d48f8024253069e

SHA256
6555ae516e2f2cd93ef30de4beec8cc8955d4ad14af1124f0c947831e3fb0c7f

SHA512
8da3c154cd454a9dd76aa0a0df7e2ccd8b1d067479d6d05e69e5fff8ce99cbd362019eabe7530b28c73dd28eee6d3871674bd6db0215a9dc1aff7b08f02b7af5

Download Submit
C:\Windows\system\wMsyqse.exe

Filesize
2.3MB

MD5
5f296df98f4408ebb35ab46d3eaa7261

SHA1
52a0ef70a0ce2d9480e2d7c928036874729c5cb0

SHA256
9ac5f1cedd95916cd26c8bbb21b7d0d626a8429362013c0417a3f6088f349378

SHA512
5411488d361b9baad51798e6d8a3c3dc2e1c1831f8514e0c279d471f4c3e783cc519bd96873591afb04ccb690dbd03ed0c85072847480eae3b5d94a6e2dfba1e

Download Submit
\Windows\system\tTGAVUv.exe

Filesize
2.3MB

MD5
5de623ac8625667ec9b0250d84d48a5f

SHA1
026a29af7d908cd9bd92e8d8f49a135fcaa74302

SHA256
6018901c2a668dc3181519d493f3aa40b25a490aad3733a4cc22ccd95fb06303

SHA512
b19483d62e5cdfface531bae76c699c90ea56153c12a1f9d64880950f8e1a44f7807148e3cacaa5ec66f60722bb5e56bbfec943493b789052ad159a865f440a2

Download Submit
memory/820-42-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/1748-18-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1888-160-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2116-154-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2160-139-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2216-158-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2216-58-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2216-141-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-99-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-91-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2216-82-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2216-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2216-69-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-5-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2216-25-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2216-140-0x0000000002F70000-0x0000000003362000-memory.dmp

Filesize
3.9MB

Download
memory/2216-44-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2216-157-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/2216-159-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2216-121-0x00000000035E0000-0x00000000039D2000-memory.dmp

Filesize
3.9MB

Download
memory/2516-137-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-76-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2608-155-0x000000013F980000-0x000000013FD72000-memory.dmp

Filesize
3.9MB

Download
memory/2644-588-0x0000000001E00000-0x0000000001E08000-memory.dmp

Filesize
32KB

Download
memory/2644-78-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/2676-65-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2732-136-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2800-84-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download