xmrig | 34c6360cf6581f7d7e6876ee0f243396e652c0631e160c1848f46068b94990c8

Analysis

max time kernel
33s
max time network
30s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
Size

2.3MB
MD5

0a12ff01ee7bb42e2a3840eeb4b19b22
SHA1

800cfe60273225a80a05ed5d944cafeda6b2ed2f
SHA256

34c6360cf6581f7d7e6876ee0f243396e652c0631e160c1848f46068b94990c8
SHA512

b3c06da82c6131b5c9cb0d5b8d5f4a32862ce26c582fb05c864fabb36aee019cd407a66ef4cd7322f064b4c4c8d813d1b1147cf4edbbb22639bad596164271fd
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pCkc30JqMopiqEE:NABw

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2816-68-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2452-77-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2756-103-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2812-85-0x000000013FC40000-0x0000000140032000-memory.dmp	xmrig
behavioral1/memory/2604-84-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/1528-83-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2668-81-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2968-79-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2524-78-0x000000013FDD0000-0x00000001401C2000-memory.dmp	xmrig
behavioral1/memory/2640-76-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2612-69-0x000000013FCF0000-0x00000001400E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2968	TiXVYdC.exe
2668	vVXzAMZ.exe
2816	Dlortsb.exe
2612	Lankwxj.exe
2640	FvkwBDt.exe
1528	bTaEKoL.exe
2452	cAfkhMW.exe
2524	FVTgqWN.exe
2604	nhRMRRU.exe
2812	XDUbzcf.exe
2756	nCIoisq.exe
2620	OZsCTTA.exe
1840	zqwWtJZ.exe
1612	yziuJyd.exe
1536	HRypAbB.exe
1432	lIdMNCq.exe
1244	LlcgNwN.exe
1960	EZAzuQl.exe
2480	JmhzoCw.exe
668	cikBbFb.exe
1572	VLFShfz.exe
1608	pjJBQgT.exe
2404	zsZaZos.exe
112	pFNzzGp.exe
2348	PXkdstG.exe
1208	UMPngxW.exe
2400	VhwofXK.exe
580	OLSqOAY.exe
1732	yatBeMU.exe
2996	hhZWEMZ.exe
1096	EueXRhf.exe
2128	yDbEDFw.exe
344	WYmHZCh.exe
1228	xItKsir.exe
1916	GEezehG.exe
2056	UrFZSts.exe
1304	rAVWwkr.exe
2064	eyAQQrS.exe
900	JbrPgLm.exe
1108	JnIvIto.exe
2108	ZdiQMzG.exe
1452	XzMCqLI.exe
1648	QujgEeB.exe
2184	vkjlVLF.exe
296	CJzVQPU.exe
880	IGimxiX.exe
2528	KlgiGqI.exe
2920	eFeaHUx.exe
2992	fnoamqA.exe
2628	VGJUcpn.exe
2464	LiLECkw.exe
1020	PkbDHfR.exe
2892	qVCVTWh.exe
1356	joHzpaD.exe
2336	NveZnOq.exe
2672	GrHxOne.exe
1552	yNJDKwV.exe
1136	iaEgNKZ.exe
1044	iiwkdEO.exe
2280	oGkEGGX.exe
448	WkatbCw.exe
844	OPxfhgB.exe
1224	HGGPmJM.exe
352	XSOTBSU.exe

Loads dropped DLL 64 IoCs

pid	Process
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2932-1-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x0030000000016126-7.dat	upx
behavioral1/files/0x0007000000016a3a-14.dat	upx
behavioral1/files/0x0006000000016fa9-56.dat	upx
behavioral1/memory/2816-68-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2452-77-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x00130000000054a8-91.dat	upx
behavioral1/files/0x000600000001738e-88.dat	upx
behavioral1/files/0x000500000001870e-164.dat	upx
behavioral1/files/0x0005000000019254-185.dat	upx
behavioral1/files/0x000600000001902f-180.dat	upx
behavioral1/files/0x0030000000016228-175.dat	upx
behavioral1/files/0x000500000001878f-171.dat	upx
behavioral1/files/0x0005000000018749-166.dat	upx
behavioral1/files/0x000d000000018689-162.dat	upx
behavioral1/files/0x00060000000175fd-160.dat	upx
behavioral1/files/0x0006000000017577-158.dat	upx
behavioral1/files/0x0006000000017436-156.dat	upx
behavioral1/files/0x00070000000173e2-154.dat	upx
behavioral1/files/0x000600000001708c-141.dat	upx
behavioral1/files/0x00060000000173e5-104.dat	upx
behavioral1/memory/2756-103-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/files/0x0006000000016d7d-37.dat	upx
behavioral1/files/0x0007000000016c5b-32.dat	upx
behavioral1/files/0x0007000000016c3a-31.dat	upx
behavioral1/files/0x00080000000167e8-30.dat	upx
behavioral1/files/0x0009000000016ccd-27.dat	upx
behavioral1/files/0x000500000001871c-146.dat	upx
behavioral1/files/0x00050000000186a2-136.dat	upx
behavioral1/files/0x0006000000017603-125.dat	upx
behavioral1/files/0x00060000000175f7-118.dat	upx
behavioral1/files/0x00060000000174ef-108.dat	upx
behavioral1/memory/2812-85-0x000000013FC40000-0x0000000140032000-memory.dmp	upx
behavioral1/memory/2604-84-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/1528-83-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/memory/2668-81-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2968-79-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2524-78-0x000000013FDD0000-0x00000001401C2000-memory.dmp	upx
behavioral1/memory/2640-76-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0007000000016c57-70.dat	upx
behavioral1/memory/2612-69-0x000000013FCF0000-0x00000001400E2000-memory.dmp	upx
behavioral1/files/0x00060000000171ad-57.dat	upx
behavioral1/files/0x0008000000016cf2-55.dat	upx
behavioral1/files/0x0007000000012120-10.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ScNEVzg.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\NinpjCq.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\DcsmZDc.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\uZtqPNe.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\qiwDqIn.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\kifGLyI.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\nCIoisq.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\oqPTCjr.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\FVWIKrd.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\CwrYYJp.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\maSosRP.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ReijoBB.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\AWBDTAC.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\dUfVPnH.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\giLeCkq.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\yziuJyd.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\jAbYGwT.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\AkXjubz.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\kEVlzfC.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\Otqtgmk.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\pkfOjDU.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\hkSHUPP.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\lKqmBOA.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ZqaqQkL.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\fnoamqA.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\uQnIqYs.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\igaTfxe.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\bxkBKGZ.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\NtaKMOw.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\LrnUXcU.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\atxtKVx.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\TuSUMGo.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\qPzScJM.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\jsxLwKu.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\PqJYhaK.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\vVXzAMZ.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\nkMelsZ.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ZZQCXGP.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\LCyYiFO.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\rKxuEQV.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\jWeGWLt.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\LTVcCxy.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\KDDFzRG.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\bMectEm.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\JjQGSJg.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\YLpGihD.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\kOMXxEM.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ZXhTYaU.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\tNUoecx.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\XhKtELI.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\CWSOiYY.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ouSZhBC.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\qWAPcHF.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\TVEmpzt.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\ejmhRtL.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\DvEvELI.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\eUMvBNP.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\lkUtbpg.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\Fzfjtnw.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\iiigirI.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\EujlTOs.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\WFxmvag.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\zrfGpki.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
File created	C:\Windows\System\lGYCVlm.exe	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
Token: SeDebugPrivilege	1936	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1936	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	29
PID 2932 wrote to memory of 1936	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	29
PID 2932 wrote to memory of 1936	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	29
PID 2932 wrote to memory of 2968	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2968	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2968	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	30
PID 2932 wrote to memory of 2640	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2640	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2640	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	31
PID 2932 wrote to memory of 2668	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2668	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2668	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	32
PID 2932 wrote to memory of 2604	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2604	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2604	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	33
PID 2932 wrote to memory of 2816	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	34
PID 2932 wrote to memory of 2816	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	34
PID 2932 wrote to memory of 2816	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	34
PID 2932 wrote to memory of 2812	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	35
PID 2932 wrote to memory of 2812	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	35
PID 2932 wrote to memory of 2812	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	35
PID 2932 wrote to memory of 2612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	36
PID 2932 wrote to memory of 2612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	36
PID 2932 wrote to memory of 2612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	36
PID 2932 wrote to memory of 2756	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	37
PID 2932 wrote to memory of 2756	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	37
PID 2932 wrote to memory of 2756	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	37
PID 2932 wrote to memory of 1528	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	38
PID 2932 wrote to memory of 1528	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	38
PID 2932 wrote to memory of 1528	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	38
PID 2932 wrote to memory of 2620	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	39
PID 2932 wrote to memory of 2620	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	39
PID 2932 wrote to memory of 2620	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	39
PID 2932 wrote to memory of 2452	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2452	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2452	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	40
PID 2932 wrote to memory of 2480	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	41
PID 2932 wrote to memory of 2480	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	41
PID 2932 wrote to memory of 2480	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	41
PID 2932 wrote to memory of 2524	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	42
PID 2932 wrote to memory of 2524	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	42
PID 2932 wrote to memory of 2524	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	42
PID 2932 wrote to memory of 1572	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1572	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1572	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	43
PID 2932 wrote to memory of 1840	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	44
PID 2932 wrote to memory of 1840	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	44
PID 2932 wrote to memory of 1840	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	44
PID 2932 wrote to memory of 1608	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	45
PID 2932 wrote to memory of 1608	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	45
PID 2932 wrote to memory of 1608	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	45
PID 2932 wrote to memory of 1612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	46
PID 2932 wrote to memory of 1612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	46
PID 2932 wrote to memory of 1612	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	46
PID 2932 wrote to memory of 2404	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	47
PID 2932 wrote to memory of 2404	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	47
PID 2932 wrote to memory of 2404	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	47
PID 2932 wrote to memory of 1536	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	48
PID 2932 wrote to memory of 1536	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	48
PID 2932 wrote to memory of 1536	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	48
PID 2932 wrote to memory of 112	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	49
PID 2932 wrote to memory of 112	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	49
PID 2932 wrote to memory of 112	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	49
PID 2932 wrote to memory of 1432	2932	0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0a12ff01ee7bb42e2a3840eeb4b19b22_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1936
- C:\Windows\System\TiXVYdC.exe
  C:\Windows\System\TiXVYdC.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\FvkwBDt.exe
  C:\Windows\System\FvkwBDt.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\vVXzAMZ.exe
  C:\Windows\System\vVXzAMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\nhRMRRU.exe
  C:\Windows\System\nhRMRRU.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\Dlortsb.exe
  C:\Windows\System\Dlortsb.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\XDUbzcf.exe
  C:\Windows\System\XDUbzcf.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\Lankwxj.exe
  C:\Windows\System\Lankwxj.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\nCIoisq.exe
  C:\Windows\System\nCIoisq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\bTaEKoL.exe
  C:\Windows\System\bTaEKoL.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\OZsCTTA.exe
  C:\Windows\System\OZsCTTA.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\cAfkhMW.exe
  C:\Windows\System\cAfkhMW.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\JmhzoCw.exe
  C:\Windows\System\JmhzoCw.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\FVTgqWN.exe
  C:\Windows\System\FVTgqWN.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\VLFShfz.exe
  C:\Windows\System\VLFShfz.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\zqwWtJZ.exe
  C:\Windows\System\zqwWtJZ.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\pjJBQgT.exe
  C:\Windows\System\pjJBQgT.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\yziuJyd.exe
  C:\Windows\System\yziuJyd.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\zsZaZos.exe
  C:\Windows\System\zsZaZos.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\HRypAbB.exe
  C:\Windows\System\HRypAbB.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\pFNzzGp.exe
  C:\Windows\System\pFNzzGp.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\lIdMNCq.exe
  C:\Windows\System\lIdMNCq.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\PXkdstG.exe
  C:\Windows\System\PXkdstG.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\LlcgNwN.exe
  C:\Windows\System\LlcgNwN.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\UMPngxW.exe
  C:\Windows\System\UMPngxW.exe
  2⤵
  - Executes dropped EXE
  PID:1208
- C:\Windows\System\EZAzuQl.exe
  C:\Windows\System\EZAzuQl.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\VhwofXK.exe
  C:\Windows\System\VhwofXK.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\cikBbFb.exe
  C:\Windows\System\cikBbFb.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\OLSqOAY.exe
  C:\Windows\System\OLSqOAY.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\yatBeMU.exe
  C:\Windows\System\yatBeMU.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\hhZWEMZ.exe
  C:\Windows\System\hhZWEMZ.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\EueXRhf.exe
  C:\Windows\System\EueXRhf.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\yDbEDFw.exe
  C:\Windows\System\yDbEDFw.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\WYmHZCh.exe
  C:\Windows\System\WYmHZCh.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\xItKsir.exe
  C:\Windows\System\xItKsir.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\GEezehG.exe
  C:\Windows\System\GEezehG.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\rAVWwkr.exe
  C:\Windows\System\rAVWwkr.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\UrFZSts.exe
  C:\Windows\System\UrFZSts.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\eyAQQrS.exe
  C:\Windows\System\eyAQQrS.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\JbrPgLm.exe
  C:\Windows\System\JbrPgLm.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\JnIvIto.exe
  C:\Windows\System\JnIvIto.exe
  2⤵
  - Executes dropped EXE
  PID:1108
- C:\Windows\System\ZdiQMzG.exe
  C:\Windows\System\ZdiQMzG.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\XzMCqLI.exe
  C:\Windows\System\XzMCqLI.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\QujgEeB.exe
  C:\Windows\System\QujgEeB.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\XSzXwfV.exe
  C:\Windows\System\XSzXwfV.exe
  2⤵
  PID:1640
- C:\Windows\System\vkjlVLF.exe
  C:\Windows\System\vkjlVLF.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\xxYtITk.exe
  C:\Windows\System\xxYtITk.exe
  2⤵
  PID:1576
- C:\Windows\System\CJzVQPU.exe
  C:\Windows\System\CJzVQPU.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\NofsQgI.exe
  C:\Windows\System\NofsQgI.exe
  2⤵
  PID:1168
- C:\Windows\System\IGimxiX.exe
  C:\Windows\System\IGimxiX.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\uUkAflD.exe
  C:\Windows\System\uUkAflD.exe
  2⤵
  PID:872
- C:\Windows\System\KlgiGqI.exe
  C:\Windows\System\KlgiGqI.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JdmSSlY.exe
  C:\Windows\System\JdmSSlY.exe
  2⤵
  PID:2204
- C:\Windows\System\eFeaHUx.exe
  C:\Windows\System\eFeaHUx.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\BChRICf.exe
  C:\Windows\System\BChRICf.exe
  2⤵
  PID:2652
- C:\Windows\System\fnoamqA.exe
  C:\Windows\System\fnoamqA.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\pJlqFEt.exe
  C:\Windows\System\pJlqFEt.exe
  2⤵
  PID:1512
- C:\Windows\System\VGJUcpn.exe
  C:\Windows\System\VGJUcpn.exe
  2⤵
  - Executes dropped EXE
  PID:2628
- C:\Windows\System\dILKqYf.exe
  C:\Windows\System\dILKqYf.exe
  2⤵
  PID:2576
- C:\Windows\System\LiLECkw.exe
  C:\Windows\System\LiLECkw.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\ElRMlvY.exe
  C:\Windows\System\ElRMlvY.exe
  2⤵
  PID:2228
- C:\Windows\System\PkbDHfR.exe
  C:\Windows\System\PkbDHfR.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\KYGVhbP.exe
  C:\Windows\System\KYGVhbP.exe
  2⤵
  PID:2516
- C:\Windows\System\qVCVTWh.exe
  C:\Windows\System\qVCVTWh.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\efFrkHY.exe
  C:\Windows\System\efFrkHY.exe
  2⤵
  PID:2172
- C:\Windows\System\joHzpaD.exe
  C:\Windows\System\joHzpaD.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\AYPJFul.exe
  C:\Windows\System\AYPJFul.exe
  2⤵
  PID:2328
- C:\Windows\System\NveZnOq.exe
  C:\Windows\System\NveZnOq.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\mgmkOXF.exe
  C:\Windows\System\mgmkOXF.exe
  2⤵
  PID:2728
- C:\Windows\System\GrHxOne.exe
  C:\Windows\System\GrHxOne.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\UqTUUtj.exe
  C:\Windows\System\UqTUUtj.exe
  2⤵
  PID:1896
- C:\Windows\System\yNJDKwV.exe
  C:\Windows\System\yNJDKwV.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\AOrlkdi.exe
  C:\Windows\System\AOrlkdi.exe
  2⤵
  PID:1476
- C:\Windows\System\iaEgNKZ.exe
  C:\Windows\System\iaEgNKZ.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\ENDzieL.exe
  C:\Windows\System\ENDzieL.exe
  2⤵
  PID:2292
- C:\Windows\System\iiwkdEO.exe
  C:\Windows\System\iiwkdEO.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\cJKFdfP.exe
  C:\Windows\System\cJKFdfP.exe
  2⤵
  PID:2840
- C:\Windows\System\oGkEGGX.exe
  C:\Windows\System\oGkEGGX.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\AOFYbWL.exe
  C:\Windows\System\AOFYbWL.exe
  2⤵
  PID:2024
- C:\Windows\System\WkatbCw.exe
  C:\Windows\System\WkatbCw.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\NFsHknp.exe
  C:\Windows\System\NFsHknp.exe
  2⤵
  PID:984
- C:\Windows\System\OPxfhgB.exe
  C:\Windows\System\OPxfhgB.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\qBAeeqz.exe
  C:\Windows\System\qBAeeqz.exe
  2⤵
  PID:316
- C:\Windows\System\HGGPmJM.exe
  C:\Windows\System\HGGPmJM.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\yYTxWZw.exe
  C:\Windows\System\yYTxWZw.exe
  2⤵
  PID:760
- C:\Windows\System\XSOTBSU.exe
  C:\Windows\System\XSOTBSU.exe
  2⤵
  - Executes dropped EXE
  PID:352
- C:\Windows\System\MIiHZRh.exe
  C:\Windows\System\MIiHZRh.exe
  2⤵
  PID:768
- C:\Windows\System\maSosRP.exe
  C:\Windows\System\maSosRP.exe
  2⤵
  PID:780
- C:\Windows\System\dZqjKZW.exe
  C:\Windows\System\dZqjKZW.exe
  2⤵
  PID:980
- C:\Windows\System\zyCbXbG.exe
  C:\Windows\System\zyCbXbG.exe
  2⤵
  PID:1664
- C:\Windows\System\kaLNsVa.exe
  C:\Windows\System\kaLNsVa.exe
  2⤵
  PID:2484
- C:\Windows\System\XpiJFqh.exe
  C:\Windows\System\XpiJFqh.exe
  2⤵
  PID:2948
- C:\Windows\System\dhqtDiD.exe
  C:\Windows\System\dhqtDiD.exe
  2⤵
  PID:1656
- C:\Windows\System\MjZTSzW.exe
  C:\Windows\System\MjZTSzW.exe
  2⤵
  PID:484
- C:\Windows\System\MqtxUEV.exe
  C:\Windows\System\MqtxUEV.exe
  2⤵
  PID:2320
- C:\Windows\System\fFDqIWh.exe
  C:\Windows\System\fFDqIWh.exe
  2⤵
  PID:632
- C:\Windows\System\AIYXXRN.exe
  C:\Windows\System\AIYXXRN.exe
  2⤵
  PID:3088
- C:\Windows\System\rsVjMun.exe
  C:\Windows\System\rsVjMun.exe
  2⤵
  PID:3104
- C:\Windows\System\GjEHvVF.exe
  C:\Windows\System\GjEHvVF.exe
  2⤵
  PID:3124
- C:\Windows\System\CNtpQOk.exe
  C:\Windows\System\CNtpQOk.exe
  2⤵
  PID:3140
- C:\Windows\System\XgBBzQJ.exe
  C:\Windows\System\XgBBzQJ.exe
  2⤵
  PID:3156
- C:\Windows\System\fmDEcBi.exe
  C:\Windows\System\fmDEcBi.exe
  2⤵
  PID:3172
- C:\Windows\System\MXLbnqO.exe
  C:\Windows\System\MXLbnqO.exe
  2⤵
  PID:3188
- C:\Windows\System\jWeGWLt.exe
  C:\Windows\System\jWeGWLt.exe
  2⤵
  PID:3204
- C:\Windows\System\QrDbVWl.exe
  C:\Windows\System\QrDbVWl.exe
  2⤵
  PID:3220
- C:\Windows\System\bohYjhe.exe
  C:\Windows\System\bohYjhe.exe
  2⤵
  PID:3236
- C:\Windows\System\lEWLuXy.exe
  C:\Windows\System\lEWLuXy.exe
  2⤵
  PID:3252
- C:\Windows\System\yQmGdIl.exe
  C:\Windows\System\yQmGdIl.exe
  2⤵
  PID:3268
- C:\Windows\System\ZABohpW.exe
  C:\Windows\System\ZABohpW.exe
  2⤵
  PID:3284
- C:\Windows\System\gjXEUXw.exe
  C:\Windows\System\gjXEUXw.exe
  2⤵
  PID:3300
- C:\Windows\System\mYJbjut.exe
  C:\Windows\System\mYJbjut.exe
  2⤵
  PID:3316
- C:\Windows\System\jwgFETg.exe
  C:\Windows\System\jwgFETg.exe
  2⤵
  PID:3332
- C:\Windows\System\MysDREp.exe
  C:\Windows\System\MysDREp.exe
  2⤵
  PID:3348
- C:\Windows\System\ZnDeHff.exe
  C:\Windows\System\ZnDeHff.exe
  2⤵
  PID:3364
- C:\Windows\System\fvbUWnU.exe
  C:\Windows\System\fvbUWnU.exe
  2⤵
  PID:3380
- C:\Windows\System\IopMHIw.exe
  C:\Windows\System\IopMHIw.exe
  2⤵
  PID:3396
- C:\Windows\System\SxnaWPj.exe
  C:\Windows\System\SxnaWPj.exe
  2⤵
  PID:3412
- C:\Windows\System\UXezcSW.exe
  C:\Windows\System\UXezcSW.exe
  2⤵
  PID:3428
- C:\Windows\System\nRrVDGP.exe
  C:\Windows\System\nRrVDGP.exe
  2⤵
  PID:3444
- C:\Windows\System\NcKqFnY.exe
  C:\Windows\System\NcKqFnY.exe
  2⤵
  PID:3460
- C:\Windows\System\YxYxvUq.exe
  C:\Windows\System\YxYxvUq.exe
  2⤵
  PID:3476
- C:\Windows\System\bvblQUT.exe
  C:\Windows\System\bvblQUT.exe
  2⤵
  PID:3492
- C:\Windows\System\wTxoQfi.exe
  C:\Windows\System\wTxoQfi.exe
  2⤵
  PID:3508
- C:\Windows\System\GpvNAel.exe
  C:\Windows\System\GpvNAel.exe
  2⤵
  PID:3524
- C:\Windows\System\WKTqiqO.exe
  C:\Windows\System\WKTqiqO.exe
  2⤵
  PID:3540
- C:\Windows\System\bgngTis.exe
  C:\Windows\System\bgngTis.exe
  2⤵
  PID:3556
- C:\Windows\System\IdcAEcR.exe
  C:\Windows\System\IdcAEcR.exe
  2⤵
  PID:3572
- C:\Windows\System\CSmSbmA.exe
  C:\Windows\System\CSmSbmA.exe
  2⤵
  PID:3588
- C:\Windows\System\wdcgNpA.exe
  C:\Windows\System\wdcgNpA.exe
  2⤵
  PID:3604
- C:\Windows\System\atxtKVx.exe
  C:\Windows\System\atxtKVx.exe
  2⤵
  PID:3620
- C:\Windows\System\LWTpjpf.exe
  C:\Windows\System\LWTpjpf.exe
  2⤵
  PID:3636
- C:\Windows\System\yPaGsbl.exe
  C:\Windows\System\yPaGsbl.exe
  2⤵
  PID:3652
- C:\Windows\System\muCkSNM.exe
  C:\Windows\System\muCkSNM.exe
  2⤵
  PID:3668
- C:\Windows\System\RLHBYkU.exe
  C:\Windows\System\RLHBYkU.exe
  2⤵
  PID:3684
- C:\Windows\System\TIBKdqY.exe
  C:\Windows\System\TIBKdqY.exe
  2⤵
  PID:3700
- C:\Windows\System\jzJCkoD.exe
  C:\Windows\System\jzJCkoD.exe
  2⤵
  PID:3716
- C:\Windows\System\BoDIzmZ.exe
  C:\Windows\System\BoDIzmZ.exe
  2⤵
  PID:3732
- C:\Windows\System\XEcjlxq.exe
  C:\Windows\System\XEcjlxq.exe
  2⤵
  PID:3748
- C:\Windows\System\KbwqzPo.exe
  C:\Windows\System\KbwqzPo.exe
  2⤵
  PID:3764
- C:\Windows\System\gJuzbwy.exe
  C:\Windows\System\gJuzbwy.exe
  2⤵
  PID:3780
- C:\Windows\System\YLpGihD.exe
  C:\Windows\System\YLpGihD.exe
  2⤵
  PID:3796
- C:\Windows\System\ucJxoWs.exe
  C:\Windows\System\ucJxoWs.exe
  2⤵
  PID:3812
- C:\Windows\System\QccSWDX.exe
  C:\Windows\System\QccSWDX.exe
  2⤵
  PID:3828
- C:\Windows\System\EoivhUI.exe
  C:\Windows\System\EoivhUI.exe
  2⤵
  PID:3844
- C:\Windows\System\DgweCEF.exe
  C:\Windows\System\DgweCEF.exe
  2⤵
  PID:3860
- C:\Windows\System\kGlaSfy.exe
  C:\Windows\System\kGlaSfy.exe
  2⤵
  PID:3876
- C:\Windows\System\ZLvRQrx.exe
  C:\Windows\System\ZLvRQrx.exe
  2⤵
  PID:3892
- C:\Windows\System\GIzYBHd.exe
  C:\Windows\System\GIzYBHd.exe
  2⤵
  PID:3908
- C:\Windows\System\QhfUwqv.exe
  C:\Windows\System\QhfUwqv.exe
  2⤵
  PID:3924
- C:\Windows\System\lkUtbpg.exe
  C:\Windows\System\lkUtbpg.exe
  2⤵
  PID:3940
- C:\Windows\System\aUvQCrF.exe
  C:\Windows\System\aUvQCrF.exe
  2⤵
  PID:3956
- C:\Windows\System\fjaMWmV.exe
  C:\Windows\System\fjaMWmV.exe
  2⤵
  PID:3972
- C:\Windows\System\GPZdmdh.exe
  C:\Windows\System\GPZdmdh.exe
  2⤵
  PID:3988
- C:\Windows\System\hLOAvnM.exe
  C:\Windows\System\hLOAvnM.exe
  2⤵
  PID:4004
- C:\Windows\System\fJETmOj.exe
  C:\Windows\System\fJETmOj.exe
  2⤵
  PID:4020
- C:\Windows\System\upYQgBt.exe
  C:\Windows\System\upYQgBt.exe
  2⤵
  PID:4036
- C:\Windows\System\eqlQpdw.exe
  C:\Windows\System\eqlQpdw.exe
  2⤵
  PID:4052
- C:\Windows\System\mNtkwhW.exe
  C:\Windows\System\mNtkwhW.exe
  2⤵
  PID:4068
- C:\Windows\System\NHfNbal.exe
  C:\Windows\System\NHfNbal.exe
  2⤵
  PID:4084
- C:\Windows\System\TIOYawd.exe
  C:\Windows\System\TIOYawd.exe
  2⤵
  PID:2216
- C:\Windows\System\iHqpdlF.exe
  C:\Windows\System\iHqpdlF.exe
  2⤵
  PID:948
- C:\Windows\System\uHHHeId.exe
  C:\Windows\System\uHHHeId.exe
  2⤵
  PID:928
- C:\Windows\System\vIYyfyB.exe
  C:\Windows\System\vIYyfyB.exe
  2⤵
  PID:2592
- C:\Windows\System\KPKUonU.exe
  C:\Windows\System\KPKUonU.exe
  2⤵
  PID:2520
- C:\Windows\System\wYojRFg.exe
  C:\Windows\System\wYojRFg.exe
  2⤵
  PID:3112
- C:\Windows\System\yaBhPAP.exe
  C:\Windows\System\yaBhPAP.exe
  2⤵
  PID:3180
- C:\Windows\System\obQXCmH.exe
  C:\Windows\System\obQXCmH.exe
  2⤵
  PID:3244
- C:\Windows\System\PTIRDzV.exe
  C:\Windows\System\PTIRDzV.exe
  2⤵
  PID:3308
- C:\Windows\System\mvwVHqt.exe
  C:\Windows\System\mvwVHqt.exe
  2⤵
  PID:3372
- C:\Windows\System\zKyDqdO.exe
  C:\Windows\System\zKyDqdO.exe
  2⤵
  PID:3436
- C:\Windows\System\jmoHQSm.exe
  C:\Windows\System\jmoHQSm.exe
  2⤵
  PID:3500
- C:\Windows\System\UDeCvZY.exe
  C:\Windows\System\UDeCvZY.exe
  2⤵
  PID:3564
- C:\Windows\System\QueGJTl.exe
  C:\Windows\System\QueGJTl.exe
  2⤵
  PID:3628
- C:\Windows\System\McAlcGj.exe
  C:\Windows\System\McAlcGj.exe
  2⤵
  PID:3692
- C:\Windows\System\yKyeVnw.exe
  C:\Windows\System\yKyeVnw.exe
  2⤵
  PID:3756
- C:\Windows\System\VPsKovx.exe
  C:\Windows\System\VPsKovx.exe
  2⤵
  PID:3820
- C:\Windows\System\LOXgUvN.exe
  C:\Windows\System\LOXgUvN.exe
  2⤵
  PID:3884
- C:\Windows\System\PADilcU.exe
  C:\Windows\System\PADilcU.exe
  2⤵
  PID:3948
- C:\Windows\System\csOtnnv.exe
  C:\Windows\System\csOtnnv.exe
  2⤵
  PID:4108
- C:\Windows\System\JxukdqW.exe
  C:\Windows\System\JxukdqW.exe
  2⤵
  PID:4124
- C:\Windows\System\hgHiTCP.exe
  C:\Windows\System\hgHiTCP.exe
  2⤵
  PID:4140
- C:\Windows\System\CWilObG.exe
  C:\Windows\System\CWilObG.exe
  2⤵
  PID:4156
- C:\Windows\System\eLfNZez.exe
  C:\Windows\System\eLfNZez.exe
  2⤵
  PID:4172
- C:\Windows\System\REoGLZQ.exe
  C:\Windows\System\REoGLZQ.exe
  2⤵
  PID:4188
- C:\Windows\System\uJEudAC.exe
  C:\Windows\System\uJEudAC.exe
  2⤵
  PID:4204
- C:\Windows\System\DfROoxz.exe
  C:\Windows\System\DfROoxz.exe
  2⤵
  PID:4220
- C:\Windows\System\TKwXnyX.exe
  C:\Windows\System\TKwXnyX.exe
  2⤵
  PID:4236
- C:\Windows\System\devBwLY.exe
  C:\Windows\System\devBwLY.exe
  2⤵
  PID:4252
- C:\Windows\System\hffVklg.exe
  C:\Windows\System\hffVklg.exe
  2⤵
  PID:4268
- C:\Windows\System\zkbTgku.exe
  C:\Windows\System\zkbTgku.exe
  2⤵
  PID:4284
- C:\Windows\System\PFQgXaD.exe
  C:\Windows\System\PFQgXaD.exe
  2⤵
  PID:4300
- C:\Windows\System\jmMuDbM.exe
  C:\Windows\System\jmMuDbM.exe
  2⤵
  PID:4316
- C:\Windows\System\ZUpyHCj.exe
  C:\Windows\System\ZUpyHCj.exe
  2⤵
  PID:4332
- C:\Windows\System\GGKfGtL.exe
  C:\Windows\System\GGKfGtL.exe
  2⤵
  PID:4348
- C:\Windows\System\qdIzeKZ.exe
  C:\Windows\System\qdIzeKZ.exe
  2⤵
  PID:4364
- C:\Windows\System\gnLcLkr.exe
  C:\Windows\System\gnLcLkr.exe
  2⤵
  PID:4380
- C:\Windows\System\YXYhOVO.exe
  C:\Windows\System\YXYhOVO.exe
  2⤵
  PID:4396
- C:\Windows\System\UHIHUtM.exe
  C:\Windows\System\UHIHUtM.exe
  2⤵
  PID:4412
- C:\Windows\System\MWOjZZN.exe
  C:\Windows\System\MWOjZZN.exe
  2⤵
  PID:4428
- C:\Windows\System\JQExRth.exe
  C:\Windows\System\JQExRth.exe
  2⤵
  PID:4444
- C:\Windows\System\BfMukKS.exe
  C:\Windows\System\BfMukKS.exe
  2⤵
  PID:4460
- C:\Windows\System\ihzznNd.exe
  C:\Windows\System\ihzznNd.exe
  2⤵
  PID:4476
- C:\Windows\System\kOMXxEM.exe
  C:\Windows\System\kOMXxEM.exe
  2⤵
  PID:4492
- C:\Windows\System\yNAkenk.exe
  C:\Windows\System\yNAkenk.exe
  2⤵
  PID:4508
- C:\Windows\System\uQnIqYs.exe
  C:\Windows\System\uQnIqYs.exe
  2⤵
  PID:4524
- C:\Windows\System\InmFwIE.exe
  C:\Windows\System\InmFwIE.exe
  2⤵
  PID:4540
- C:\Windows\System\iNWFMIA.exe
  C:\Windows\System\iNWFMIA.exe
  2⤵
  PID:4556
- C:\Windows\System\WsienYV.exe
  C:\Windows\System\WsienYV.exe
  2⤵
  PID:4572
- C:\Windows\System\ylwUahp.exe
  C:\Windows\System\ylwUahp.exe
  2⤵
  PID:4588
- C:\Windows\System\vZJoSTf.exe
  C:\Windows\System\vZJoSTf.exe
  2⤵
  PID:4604
- C:\Windows\System\sSCtsTi.exe
  C:\Windows\System\sSCtsTi.exe
  2⤵
  PID:4620
- C:\Windows\System\KPxkvUU.exe
  C:\Windows\System\KPxkvUU.exe
  2⤵
  PID:4636
- C:\Windows\System\PqGmaYD.exe
  C:\Windows\System\PqGmaYD.exe
  2⤵
  PID:4652
- C:\Windows\System\fQzUGUD.exe
  C:\Windows\System\fQzUGUD.exe
  2⤵
  PID:4668
- C:\Windows\System\ucGuauV.exe
  C:\Windows\System\ucGuauV.exe
  2⤵
  PID:4684
- C:\Windows\System\mDtEshT.exe
  C:\Windows\System\mDtEshT.exe
  2⤵
  PID:4704
- C:\Windows\System\KXVlcsu.exe
  C:\Windows\System\KXVlcsu.exe
  2⤵
  PID:4720
- C:\Windows\System\sPwRTJP.exe
  C:\Windows\System\sPwRTJP.exe
  2⤵
  PID:4736
- C:\Windows\System\lyNYqzU.exe
  C:\Windows\System\lyNYqzU.exe
  2⤵
  PID:4752
- C:\Windows\System\YDKwUQo.exe
  C:\Windows\System\YDKwUQo.exe
  2⤵
  PID:4768
- C:\Windows\System\ACneaxQ.exe
  C:\Windows\System\ACneaxQ.exe
  2⤵
  PID:4784
- C:\Windows\System\gRKyYex.exe
  C:\Windows\System\gRKyYex.exe
  2⤵
  PID:4800
- C:\Windows\System\LTVcCxy.exe
  C:\Windows\System\LTVcCxy.exe
  2⤵
  PID:4816
- C:\Windows\System\KBMXbst.exe
  C:\Windows\System\KBMXbst.exe
  2⤵
  PID:4832
- C:\Windows\System\jTpksDr.exe
  C:\Windows\System\jTpksDr.exe
  2⤵
  PID:4848
- C:\Windows\System\XFPToOf.exe
  C:\Windows\System\XFPToOf.exe
  2⤵
  PID:4864
- C:\Windows\System\AFVTRLn.exe
  C:\Windows\System\AFVTRLn.exe
  2⤵
  PID:4880
- C:\Windows\System\VCDidWg.exe
  C:\Windows\System\VCDidWg.exe
  2⤵
  PID:4896
- C:\Windows\System\HqqGXbH.exe
  C:\Windows\System\HqqGXbH.exe
  2⤵
  PID:4912
- C:\Windows\System\kfYNkSn.exe
  C:\Windows\System\kfYNkSn.exe
  2⤵
  PID:4928
- C:\Windows\System\qWAPcHF.exe
  C:\Windows\System\qWAPcHF.exe
  2⤵
  PID:4944
- C:\Windows\System\cYdwUBa.exe
  C:\Windows\System\cYdwUBa.exe
  2⤵
  PID:4960
- C:\Windows\System\kJFyXKE.exe
  C:\Windows\System\kJFyXKE.exe
  2⤵
  PID:4976
- C:\Windows\System\USKbFtn.exe
  C:\Windows\System\USKbFtn.exe
  2⤵
  PID:4992
- C:\Windows\System\gqDWPwh.exe
  C:\Windows\System\gqDWPwh.exe
  2⤵
  PID:5008
- C:\Windows\System\ZMrwHBR.exe
  C:\Windows\System\ZMrwHBR.exe
  2⤵
  PID:5024
- C:\Windows\System\xfVEdmk.exe
  C:\Windows\System\xfVEdmk.exe
  2⤵
  PID:5040
- C:\Windows\System\XliLyMj.exe
  C:\Windows\System\XliLyMj.exe
  2⤵
  PID:5056
- C:\Windows\System\nihoDuD.exe
  C:\Windows\System\nihoDuD.exe
  2⤵
  PID:5072
- C:\Windows\System\BcbfXxy.exe
  C:\Windows\System\BcbfXxy.exe
  2⤵
  PID:5088
- C:\Windows\System\ZXhTYaU.exe
  C:\Windows\System\ZXhTYaU.exe
  2⤵
  PID:5104
- C:\Windows\System\kwKKrrC.exe
  C:\Windows\System\kwKKrrC.exe
  2⤵
  PID:3980
- C:\Windows\System\lWihGza.exe
  C:\Windows\System\lWihGza.exe
  2⤵
  PID:4016
- C:\Windows\System\jiYWZmr.exe
  C:\Windows\System\jiYWZmr.exe
  2⤵
  PID:4080
- C:\Windows\System\JzFfWDv.exe
  C:\Windows\System\JzFfWDv.exe
  2⤵
  PID:2200
- C:\Windows\System\kPQOufw.exe
  C:\Windows\System\kPQOufw.exe
  2⤵
  PID:3216
- C:\Windows\System\DAFUXHA.exe
  C:\Windows\System\DAFUXHA.exe
  2⤵
  PID:3344
- C:\Windows\System\nkMelsZ.exe
  C:\Windows\System\nkMelsZ.exe
  2⤵
  PID:3472
- C:\Windows\System\ELIJSmY.exe
  C:\Windows\System\ELIJSmY.exe
  2⤵
  PID:3728
- C:\Windows\System\RzgLkbM.exe
  C:\Windows\System\RzgLkbM.exe
  2⤵
  PID:4104
- C:\Windows\System\djbJzcX.exe
  C:\Windows\System\djbJzcX.exe
  2⤵
  PID:4168
- C:\Windows\System\bUwiNfm.exe
  C:\Windows\System\bUwiNfm.exe
  2⤵
  PID:2676
- C:\Windows\System\TuSUMGo.exe
  C:\Windows\System\TuSUMGo.exe
  2⤵
  PID:4232
- C:\Windows\System\GmcUOcC.exe
  C:\Windows\System\GmcUOcC.exe
  2⤵
  PID:4296
- C:\Windows\System\ZBSPKmC.exe
  C:\Windows\System\ZBSPKmC.exe
  2⤵
  PID:4360
- C:\Windows\System\exlzHFE.exe
  C:\Windows\System\exlzHFE.exe
  2⤵
  PID:1340
- C:\Windows\System\rQyjPeA.exe
  C:\Windows\System\rQyjPeA.exe
  2⤵
  PID:2344
- C:\Windows\System\fKRKWje.exe
  C:\Windows\System\fKRKWje.exe
  2⤵
  PID:1792
- C:\Windows\System\pBRonbU.exe
  C:\Windows\System\pBRonbU.exe
  2⤵
  PID:1308
- C:\Windows\System\xxkpLHP.exe
  C:\Windows\System\xxkpLHP.exe
  2⤵
  PID:2304
- C:\Windows\System\gjFiWZm.exe
  C:\Windows\System\gjFiWZm.exe
  2⤵
  PID:4484
- C:\Windows\System\udOLqBT.exe
  C:\Windows\System\udOLqBT.exe
  2⤵
  PID:4516
- C:\Windows\System\yTNJNVf.exe
  C:\Windows\System\yTNJNVf.exe
  2⤵
  PID:4580
- C:\Windows\System\RseRlwo.exe
  C:\Windows\System\RseRlwo.exe
  2⤵
  PID:4644
- C:\Windows\System\FPtZzOW.exe
  C:\Windows\System\FPtZzOW.exe
  2⤵
  PID:4712
- C:\Windows\System\mdNHeKI.exe
  C:\Windows\System\mdNHeKI.exe
  2⤵
  PID:4748
- C:\Windows\System\tCWOdbm.exe
  C:\Windows\System\tCWOdbm.exe
  2⤵
  PID:4808
- C:\Windows\System\HSHYbJc.exe
  C:\Windows\System\HSHYbJc.exe
  2⤵
  PID:4872
- C:\Windows\System\mFrKmMJ.exe
  C:\Windows\System\mFrKmMJ.exe
  2⤵
  PID:4936
- C:\Windows\System\efFbtpe.exe
  C:\Windows\System\efFbtpe.exe
  2⤵
  PID:4968
- C:\Windows\System\SOGIVvN.exe
  C:\Windows\System\SOGIVvN.exe
  2⤵
  PID:5032
- C:\Windows\System\DHndNcz.exe
  C:\Windows\System\DHndNcz.exe
  2⤵
  PID:5096
- C:\Windows\System\QGZdTBb.exe
  C:\Windows\System\QGZdTBb.exe
  2⤵
  PID:3044
- C:\Windows\System\UuvGOFR.exe
  C:\Windows\System\UuvGOFR.exe
  2⤵
  PID:3600
- C:\Windows\System\aPXUNjS.exe
  C:\Windows\System\aPXUNjS.exe
  2⤵
  PID:4200
- C:\Windows\System\gLkxNYO.exe
  C:\Windows\System\gLkxNYO.exe
  2⤵
  PID:4388
- C:\Windows\System\oCMpnTI.exe
  C:\Windows\System\oCMpnTI.exe
  2⤵
  PID:1440
- C:\Windows\System\YlHaTRh.exe
  C:\Windows\System\YlHaTRh.exe
  2⤵
  PID:4552
- C:\Windows\System\QeoACqz.exe
  C:\Windows\System\QeoACqz.exe
  2⤵
  PID:4780
- C:\Windows\System\bOuByoX.exe
  C:\Windows\System\bOuByoX.exe
  2⤵
  PID:5000
- C:\Windows\System\ZfBnDSd.exe
  C:\Windows\System\ZfBnDSd.exe
  2⤵
  PID:5132
- C:\Windows\System\UyVSevG.exe
  C:\Windows\System\UyVSevG.exe
  2⤵
  PID:5148
- C:\Windows\System\PbCjjOn.exe
  C:\Windows\System\PbCjjOn.exe
  2⤵
  PID:5164
- C:\Windows\System\CpiXKVB.exe
  C:\Windows\System\CpiXKVB.exe
  2⤵
  PID:5180
- C:\Windows\System\UJTpDDW.exe
  C:\Windows\System\UJTpDDW.exe
  2⤵
  PID:5196
- C:\Windows\System\ZRrKeOb.exe
  C:\Windows\System\ZRrKeOb.exe
  2⤵
  PID:5212
- C:\Windows\System\zfVwYFA.exe
  C:\Windows\System\zfVwYFA.exe
  2⤵
  PID:5228
- C:\Windows\System\aCAOxxC.exe
  C:\Windows\System\aCAOxxC.exe
  2⤵
  PID:5244
- C:\Windows\System\cDASMhr.exe
  C:\Windows\System\cDASMhr.exe
  2⤵
  PID:5260
- C:\Windows\System\eTdjGKe.exe
  C:\Windows\System\eTdjGKe.exe
  2⤵
  PID:5276
- C:\Windows\System\kgPCFcQ.exe
  C:\Windows\System\kgPCFcQ.exe
  2⤵
  PID:5292
- C:\Windows\System\nDoKZFu.exe
  C:\Windows\System\nDoKZFu.exe
  2⤵
  PID:5308
- C:\Windows\System\IgeMQLL.exe
  C:\Windows\System\IgeMQLL.exe
  2⤵
  PID:5324
- C:\Windows\System\SVMqyEF.exe
  C:\Windows\System\SVMqyEF.exe
  2⤵
  PID:5340
- C:\Windows\System\VInPhmv.exe
  C:\Windows\System\VInPhmv.exe
  2⤵
  PID:5356
- C:\Windows\System\HQsXNMM.exe
  C:\Windows\System\HQsXNMM.exe
  2⤵
  PID:5372
- C:\Windows\System\ubakRRV.exe
  C:\Windows\System\ubakRRV.exe
  2⤵
  PID:5388
- C:\Windows\System\jiZjbfB.exe
  C:\Windows\System\jiZjbfB.exe
  2⤵
  PID:5404
- C:\Windows\System\dSnaAVb.exe
  C:\Windows\System\dSnaAVb.exe
  2⤵
  PID:5420
- C:\Windows\System\GONYJRx.exe
  C:\Windows\System\GONYJRx.exe
  2⤵
  PID:5436
- C:\Windows\System\YeHCZrb.exe
  C:\Windows\System\YeHCZrb.exe
  2⤵
  PID:5452
- C:\Windows\System\XoFkaBT.exe
  C:\Windows\System\XoFkaBT.exe
  2⤵
  PID:5468
- C:\Windows\System\NmiPIpz.exe
  C:\Windows\System\NmiPIpz.exe
  2⤵
  PID:5484
- C:\Windows\System\yIwgbYU.exe
  C:\Windows\System\yIwgbYU.exe
  2⤵
  PID:5500
- C:\Windows\System\zttYaHl.exe
  C:\Windows\System\zttYaHl.exe
  2⤵
  PID:5524
- C:\Windows\System\Fzfjtnw.exe
  C:\Windows\System\Fzfjtnw.exe
  2⤵
  PID:5540
- C:\Windows\System\ZNjWqCG.exe
  C:\Windows\System\ZNjWqCG.exe
  2⤵
  PID:5560
- C:\Windows\System\bdnnTCe.exe
  C:\Windows\System\bdnnTCe.exe
  2⤵
  PID:5576
- C:\Windows\System\TkKcSMY.exe
  C:\Windows\System\TkKcSMY.exe
  2⤵
  PID:5592
- C:\Windows\System\FIlBECR.exe
  C:\Windows\System\FIlBECR.exe
  2⤵
  PID:5608
- C:\Windows\System\BwOQpOG.exe
  C:\Windows\System\BwOQpOG.exe
  2⤵
  PID:5624
- C:\Windows\System\uyvDStj.exe
  C:\Windows\System\uyvDStj.exe
  2⤵
  PID:5640
- C:\Windows\System\SeJSMEp.exe
  C:\Windows\System\SeJSMEp.exe
  2⤵
  PID:5656
- C:\Windows\System\IyzwbKu.exe
  C:\Windows\System\IyzwbKu.exe
  2⤵
  PID:5672
- C:\Windows\System\nJPxFNh.exe
  C:\Windows\System\nJPxFNh.exe
  2⤵
  PID:5688
- C:\Windows\System\VziykWv.exe
  C:\Windows\System\VziykWv.exe
  2⤵
  PID:5704
- C:\Windows\System\uxnrJIT.exe
  C:\Windows\System\uxnrJIT.exe
  2⤵
  PID:5720
- C:\Windows\System\mFmYKsJ.exe
  C:\Windows\System\mFmYKsJ.exe
  2⤵
  PID:5736
- C:\Windows\System\wscbESm.exe
  C:\Windows\System\wscbESm.exe
  2⤵
  PID:5752
- C:\Windows\System\rUtRWMd.exe
  C:\Windows\System\rUtRWMd.exe
  2⤵
  PID:5768
- C:\Windows\System\nxzlolw.exe
  C:\Windows\System\nxzlolw.exe
  2⤵
  PID:5784
- C:\Windows\System\CgfUBdJ.exe
  C:\Windows\System\CgfUBdJ.exe
  2⤵
  PID:5800
- C:\Windows\System\nSyymqP.exe
  C:\Windows\System\nSyymqP.exe
  2⤵
  PID:5816
- C:\Windows\System\tIqQhZn.exe
  C:\Windows\System\tIqQhZn.exe
  2⤵
  PID:5832
- C:\Windows\System\xGZGFHm.exe
  C:\Windows\System\xGZGFHm.exe
  2⤵
  PID:5848
- C:\Windows\System\YQwKVAd.exe
  C:\Windows\System\YQwKVAd.exe
  2⤵
  PID:5864
- C:\Windows\System\GvnvVWy.exe
  C:\Windows\System\GvnvVWy.exe
  2⤵
  PID:5880
- C:\Windows\System\bHqkiDA.exe
  C:\Windows\System\bHqkiDA.exe
  2⤵
  PID:1248
- C:\Windows\System\cIPzEgt.exe
  C:\Windows\System\cIPzEgt.exe
  2⤵
  PID:1460
- C:\Windows\System\DNhkssk.exe
  C:\Windows\System\DNhkssk.exe
  2⤵
  PID:2276
- C:\Windows\System\qnsIXiz.exe
  C:\Windows\System\qnsIXiz.exe
  2⤵
  PID:1900
- C:\Windows\System\MoPJNyA.exe
  C:\Windows\System\MoPJNyA.exe
  2⤵
  PID:5552
- C:\Windows\System\bcrAhFn.exe
  C:\Windows\System\bcrAhFn.exe
  2⤵
  PID:5648
- C:\Windows\System\fIDvbuC.exe
  C:\Windows\System\fIDvbuC.exe
  2⤵
  PID:5712
- C:\Windows\System\ENhSWDj.exe
  C:\Windows\System\ENhSWDj.exe
  2⤵
  PID:5776
- C:\Windows\System\hZogCph.exe
  C:\Windows\System\hZogCph.exe
  2⤵
  PID:5844
- C:\Windows\System\FBffWEU.exe
  C:\Windows\System\FBffWEU.exe
  2⤵
  PID:6148
- C:\Windows\System\fDQIxvc.exe
  C:\Windows\System\fDQIxvc.exe
  2⤵
  PID:6164
- C:\Windows\System\AcnpUlo.exe
  C:\Windows\System\AcnpUlo.exe
  2⤵
  PID:6180
- C:\Windows\System\bkHEiXH.exe
  C:\Windows\System\bkHEiXH.exe
  2⤵
  PID:6200
- C:\Windows\System\HRUcRXN.exe
  C:\Windows\System\HRUcRXN.exe
  2⤵
  PID:6216
- C:\Windows\System\JjrWVaJ.exe
  C:\Windows\System\JjrWVaJ.exe
  2⤵
  PID:6232
- C:\Windows\System\DcsmZDc.exe
  C:\Windows\System\DcsmZDc.exe
  2⤵
  PID:6248
- C:\Windows\System\BEOlHVv.exe
  C:\Windows\System\BEOlHVv.exe
  2⤵
  PID:6264
- C:\Windows\System\hkSHUPP.exe
  C:\Windows\System\hkSHUPP.exe
  2⤵
  PID:6280
- C:\Windows\System\CBdrdqm.exe
  C:\Windows\System\CBdrdqm.exe
  2⤵
  PID:6296
- C:\Windows\System\hVxLmBN.exe
  C:\Windows\System\hVxLmBN.exe
  2⤵
  PID:6320
- C:\Windows\System\oZOICql.exe
  C:\Windows\System\oZOICql.exe
  2⤵
  PID:6336
- C:\Windows\System\SDCUXFI.exe
  C:\Windows\System\SDCUXFI.exe
  2⤵
  PID:6352
- C:\Windows\System\OLdpBiI.exe
  C:\Windows\System\OLdpBiI.exe
  2⤵
  PID:6368
- C:\Windows\System\phPUSSu.exe
  C:\Windows\System\phPUSSu.exe
  2⤵
  PID:6384
- C:\Windows\System\nOIeOGP.exe
  C:\Windows\System\nOIeOGP.exe
  2⤵
  PID:6400
- C:\Windows\System\ZZQCXGP.exe
  C:\Windows\System\ZZQCXGP.exe
  2⤵
  PID:6420
- C:\Windows\System\WjPYXby.exe
  C:\Windows\System\WjPYXby.exe
  2⤵
  PID:6436
- C:\Windows\System\MsJfGrc.exe
  C:\Windows\System\MsJfGrc.exe
  2⤵
  PID:6452
- C:\Windows\System\iEuXZDG.exe
  C:\Windows\System\iEuXZDG.exe
  2⤵
  PID:6468
- C:\Windows\System\mttnBnP.exe
  C:\Windows\System\mttnBnP.exe
  2⤵
  PID:6484
- C:\Windows\System\oVEOaci.exe
  C:\Windows\System\oVEOaci.exe
  2⤵
  PID:6500
- C:\Windows\System\lCYXvhG.exe
  C:\Windows\System\lCYXvhG.exe
  2⤵
  PID:6516
- C:\Windows\System\gfdTBIu.exe
  C:\Windows\System\gfdTBIu.exe
  2⤵
  PID:6536
- C:\Windows\System\PHRtgDZ.exe
  C:\Windows\System\PHRtgDZ.exe
  2⤵
  PID:6552
- C:\Windows\System\zRzQZlD.exe
  C:\Windows\System\zRzQZlD.exe
  2⤵
  PID:6568
- C:\Windows\System\iIAYamn.exe
  C:\Windows\System\iIAYamn.exe
  2⤵
  PID:6584
- C:\Windows\System\LlfqUgU.exe
  C:\Windows\System\LlfqUgU.exe
  2⤵
  PID:6600
- C:\Windows\System\gBzgAlY.exe
  C:\Windows\System\gBzgAlY.exe
  2⤵
  PID:6616
- C:\Windows\System\qAUfARl.exe
  C:\Windows\System\qAUfARl.exe
  2⤵
  PID:6636
- C:\Windows\System\ZefqxJP.exe
  C:\Windows\System\ZefqxJP.exe
  2⤵
  PID:6652
- C:\Windows\System\dwoqJoi.exe
  C:\Windows\System\dwoqJoi.exe
  2⤵
  PID:6668
- C:\Windows\System\wIlQWgt.exe
  C:\Windows\System\wIlQWgt.exe
  2⤵
  PID:6684
- C:\Windows\System\VxfzGJn.exe
  C:\Windows\System\VxfzGJn.exe
  2⤵
  PID:6700
- C:\Windows\System\dhAmMwi.exe
  C:\Windows\System\dhAmMwi.exe
  2⤵
  PID:6716
- C:\Windows\System\HAyhGhl.exe
  C:\Windows\System\HAyhGhl.exe
  2⤵
  PID:6736
- C:\Windows\System\HBGxBjS.exe
  C:\Windows\System\HBGxBjS.exe
  2⤵
  PID:6752
- C:\Windows\System\BHACHVR.exe
  C:\Windows\System\BHACHVR.exe
  2⤵
  PID:6768
- C:\Windows\System\BLWQSeY.exe
  C:\Windows\System\BLWQSeY.exe
  2⤵
  PID:6784
- C:\Windows\System\jAsvfqx.exe
  C:\Windows\System\jAsvfqx.exe
  2⤵
  PID:6800
- C:\Windows\System\PGaqDkd.exe
  C:\Windows\System\PGaqDkd.exe
  2⤵
  PID:7024
- C:\Windows\System\hzUNqeY.exe
  C:\Windows\System\hzUNqeY.exe
  2⤵
  PID:7140
- C:\Windows\System\QgfnpBi.exe
  C:\Windows\System\QgfnpBi.exe
  2⤵
  PID:7160
- C:\Windows\System\uTgQdRK.exe
  C:\Windows\System\uTgQdRK.exe
  2⤵
  PID:824
- C:\Windows\System\OnnGBjQ.exe
  C:\Windows\System\OnnGBjQ.exe
  2⤵
  PID:3096
- C:\Windows\System\sdktMfL.exe
  C:\Windows\System\sdktMfL.exe
  2⤵
  PID:6176
- C:\Windows\System\IOoPGgb.exe
  C:\Windows\System\IOoPGgb.exe
  2⤵
  PID:6272
- C:\Windows\System\yJcmgAP.exe
  C:\Windows\System\yJcmgAP.exe
  2⤵
  PID:536
- C:\Windows\System\oDiOPrP.exe
  C:\Windows\System\oDiOPrP.exe
  2⤵
  PID:6376
- C:\Windows\System\PGMDkAR.exe
  C:\Windows\System\PGMDkAR.exe
  2⤵
  PID:3516
- C:\Windows\System\cgRKGlw.exe
  C:\Windows\System\cgRKGlw.exe
  2⤵
  PID:3648
- C:\Windows\System\tgFRlXs.exe
  C:\Windows\System\tgFRlXs.exe
  2⤵
  PID:3772
- C:\Windows\System\pJnvIqb.exe
  C:\Windows\System\pJnvIqb.exe
  2⤵
  PID:3808
- C:\Windows\System\JIqymGV.exe
  C:\Windows\System\JIqymGV.exe
  2⤵
  PID:6208
- C:\Windows\System\DWPxIsN.exe
  C:\Windows\System\DWPxIsN.exe
  2⤵
  PID:6312
- C:\Windows\System\WmtMWwx.exe
  C:\Windows\System\WmtMWwx.exe
  2⤵
  PID:4340
- C:\Windows\System\LnazCVm.exe
  C:\Windows\System\LnazCVm.exe
  2⤵
  PID:4436
- C:\Windows\System\fnnwaHl.exe
  C:\Windows\System\fnnwaHl.exe
  2⤵
  PID:5336
- C:\Windows\System\SlvDysb.exe
  C:\Windows\System\SlvDysb.exe
  2⤵
  PID:5272
- C:\Windows\System\kvrEyaO.exe
  C:\Windows\System\kvrEyaO.exe
  2⤵
  PID:5204
- C:\Windows\System\iHUmYDW.exe
  C:\Windows\System\iHUmYDW.exe
  2⤵
  PID:5140
- C:\Windows\System\ryHpPmW.exe
  C:\Windows\System\ryHpPmW.exe
  2⤵
  PID:4328
- C:\Windows\System\qsvpncK.exe
  C:\Windows\System\qsvpncK.exe
  2⤵
  PID:5064
- C:\Windows\System\NmjUisc.exe
  C:\Windows\System\NmjUisc.exe
  2⤵
  PID:4840
- C:\Windows\System\rQyLCOz.exe
  C:\Windows\System\rQyLCOz.exe
  2⤵
  PID:4612
- C:\Windows\System\fbfXEjb.exe
  C:\Windows\System\fbfXEjb.exe
  2⤵
  PID:4292
- C:\Windows\System\qnlstjd.exe
  C:\Windows\System\qnlstjd.exe
  2⤵
  PID:4100
- C:\Windows\System\lCqekiT.exe
  C:\Windows\System\lCqekiT.exe
  2⤵
  PID:3212
- C:\Windows\System\kHzflgD.exe
  C:\Windows\System\kHzflgD.exe
  2⤵
  PID:5112
- C:\Windows\System\BXwUWik.exe
  C:\Windows\System\BXwUWik.exe
  2⤵
  PID:5020
- C:\Windows\System\otTAUWL.exe
  C:\Windows\System\otTAUWL.exe
  2⤵
  PID:4956
- C:\Windows\System\JmJywLz.exe
  C:\Windows\System\JmJywLz.exe
  2⤵
  PID:4892
- C:\Windows\System\UPgCmbE.exe
  C:\Windows\System\UPgCmbE.exe
  2⤵
  PID:4828
- C:\Windows\System\SCMJknn.exe
  C:\Windows\System\SCMJknn.exe
  2⤵
  PID:4760
- C:\Windows\System\qxLKHet.exe
  C:\Windows\System\qxLKHet.exe
  2⤵
  PID:4692
- C:\Windows\System\RpqLsmD.exe
  C:\Windows\System\RpqLsmD.exe
  2⤵
  PID:4628
- C:\Windows\System\CMrIftn.exe
  C:\Windows\System\CMrIftn.exe
  2⤵
  PID:4564
- C:\Windows\System\LpUdJsH.exe
  C:\Windows\System\LpUdJsH.exe
  2⤵
  PID:5396
- C:\Windows\System\JKpgEsh.exe
  C:\Windows\System\JKpgEsh.exe
  2⤵
  PID:5460
- C:\Windows\System\OZNZSpp.exe
  C:\Windows\System\OZNZSpp.exe
  2⤵
  PID:5496
- C:\Windows\System\tsEvyNJ.exe
  C:\Windows\System\tsEvyNJ.exe
  2⤵
  PID:2068
- C:\Windows\System\PSDIAVb.exe
  C:\Windows\System\PSDIAVb.exe
  2⤵
  PID:6548
- C:\Windows\System\oRXbWFy.exe
  C:\Windows\System\oRXbWFy.exe
  2⤵
  PID:5732
- C:\Windows\System\IHFbUIV.exe
  C:\Windows\System\IHFbUIV.exe
  2⤵
  PID:5796
- C:\Windows\System\eBvqKIg.exe
  C:\Windows\System\eBvqKIg.exe
  2⤵
  PID:592
- C:\Windows\System\NhhDYom.exe
  C:\Windows\System\NhhDYom.exe
  2⤵
  PID:6444
- C:\Windows\System\caoPMCi.exe
  C:\Windows\System\caoPMCi.exe
  2⤵
  PID:6776
- C:\Windows\System\aJSONaE.exe
  C:\Windows\System\aJSONaE.exe
  2⤵
  PID:6744
- C:\Windows\System\MgDsxQz.exe
  C:\Windows\System\MgDsxQz.exe
  2⤵
  PID:6808
- C:\Windows\System\JHfUuxi.exe
  C:\Windows\System\JHfUuxi.exe
  2⤵
  PID:6508
- C:\Windows\System\enVVyBK.exe
  C:\Windows\System\enVVyBK.exe
  2⤵
  PID:6476
- C:\Windows\System\HoRfdJF.exe
  C:\Windows\System\HoRfdJF.exe
  2⤵
  PID:5156
- C:\Windows\System\OEqmXYV.exe
  C:\Windows\System\OEqmXYV.exe
  2⤵
  PID:5192
- C:\Windows\System\gYIUvoV.exe
  C:\Windows\System\gYIUvoV.exe
  2⤵
  PID:2884
- C:\Windows\System\zotpyLs.exe
  C:\Windows\System\zotpyLs.exe
  2⤵
  PID:5284
- C:\Windows\System\NDSDcFJ.exe
  C:\Windows\System\NDSDcFJ.exe
  2⤵
  PID:2888
- C:\Windows\System\tdaVPvY.exe
  C:\Windows\System\tdaVPvY.exe
  2⤵
  PID:5348
- C:\Windows\System\qHiInvH.exe
  C:\Windows\System\qHiInvH.exe
  2⤵
  PID:1884
- C:\Windows\System\AGKMjRg.exe
  C:\Windows\System\AGKMjRg.exe
  2⤵
  PID:5412
- C:\Windows\System\rFamDDJ.exe
  C:\Windows\System\rFamDDJ.exe
  2⤵
  PID:756
- C:\Windows\System\oJQuDHE.exe
  C:\Windows\System\oJQuDHE.exe
  2⤵
  PID:2824
- C:\Windows\System\BDXtkiH.exe
  C:\Windows\System\BDXtkiH.exe
  2⤵
  PID:2132
- C:\Windows\System\PdAhjzy.exe
  C:\Windows\System\PdAhjzy.exe
  2⤵
  PID:584
- C:\Windows\System\CBYYEhc.exe
  C:\Windows\System\CBYYEhc.exe
  2⤵
  PID:3000
- C:\Windows\System\sDEPhET.exe
  C:\Windows\System\sDEPhET.exe
  2⤵
  PID:2096
- C:\Windows\System\MkYWgnT.exe
  C:\Windows\System\MkYWgnT.exe
  2⤵
  PID:1544
- C:\Windows\System\CYdDzlB.exe
  C:\Windows\System\CYdDzlB.exe
  2⤵
  PID:2820
- C:\Windows\System\oMbEvus.exe
  C:\Windows\System\oMbEvus.exe
  2⤵
  PID:6908
- C:\Windows\System\YcWdNbB.exe
  C:\Windows\System\YcWdNbB.exe
  2⤵
  PID:1408
- C:\Windows\System\DaHdQpv.exe
  C:\Windows\System\DaHdQpv.exe
  2⤵
  PID:3048
- C:\Windows\System\mPOrwXA.exe
  C:\Windows\System\mPOrwXA.exe
  2⤵
  PID:6156
- C:\Windows\System\KZxrHxF.exe
  C:\Windows\System\KZxrHxF.exe
  2⤵
  PID:6256
- C:\Windows\System\QzwZkFo.exe
  C:\Windows\System\QzwZkFo.exe
  2⤵
  PID:6228
- C:\Windows\System\KDDFzRG.exe
  C:\Windows\System\KDDFzRG.exe
  2⤵
  PID:6396
- C:\Windows\System\qAYVQvw.exe
  C:\Windows\System\qAYVQvw.exe
  2⤵
  PID:6532
- C:\Windows\System\tNUoecx.exe
  C:\Windows\System\tNUoecx.exe
  2⤵
  PID:4248
- C:\Windows\System\puMwHaA.exe
  C:\Windows\System\puMwHaA.exe
  2⤵
  PID:3932
- C:\Windows\System\XhKtELI.exe
  C:\Windows\System\XhKtELI.exe
  2⤵
  PID:3996
- C:\Windows\System\awiofXh.exe
  C:\Windows\System\awiofXh.exe
  2⤵
  PID:4060
- C:\Windows\System\PfvDZOi.exe
  C:\Windows\System\PfvDZOi.exe
  2⤵
  PID:1588
- C:\Windows\System\uKlRVea.exe
  C:\Windows\System\uKlRVea.exe
  2⤵
  PID:3152
- C:\Windows\System\oBVoHku.exe
  C:\Windows\System\oBVoHku.exe
  2⤵
  PID:3408
- C:\Windows\System\ORqpnJt.exe
  C:\Windows\System\ORqpnJt.exe
  2⤵
  PID:3664
- C:\Windows\System\YcIujRa.exe
  C:\Windows\System\YcIujRa.exe
  2⤵
  PID:4116
- C:\Windows\System\vAFcLHx.exe
  C:\Windows\System\vAFcLHx.exe
  2⤵
  PID:4184
- C:\Windows\System\cqfdVdI.exe
  C:\Windows\System\cqfdVdI.exe
  2⤵
  PID:4468
- C:\Windows\System\XinUceF.exe
  C:\Windows\System\XinUceF.exe
  2⤵
  PID:5572
- C:\Windows\System\OaVDmwX.exe
  C:\Windows\System\OaVDmwX.exe
  2⤵
  PID:5636
- C:\Windows\System\MdJGgrB.exe
  C:\Windows\System\MdJGgrB.exe
  2⤵
  PID:5764
- C:\Windows\System\hpxWyMf.exe
  C:\Windows\System\hpxWyMf.exe
  2⤵
  PID:5908
- C:\Windows\System\zLrNjXY.exe
  C:\Windows\System\zLrNjXY.exe
  2⤵
  PID:5924
- C:\Windows\System\rybZvfd.exe
  C:\Windows\System\rybZvfd.exe
  2⤵
  PID:5856
- C:\Windows\System\WhMqCiG.exe
  C:\Windows\System\WhMqCiG.exe
  2⤵
  PID:4680
- C:\Windows\System\RXRZYZp.exe
  C:\Windows\System\RXRZYZp.exe
  2⤵
  PID:2748
- C:\Windows\System\uZtqPNe.exe
  C:\Windows\System\uZtqPNe.exe
  2⤵
  PID:2904
- C:\Windows\System\euGCkKc.exe
  C:\Windows\System\euGCkKc.exe
  2⤵
  PID:2072
- C:\Windows\System\qrWOyzI.exe
  C:\Windows\System\qrWOyzI.exe
  2⤵
  PID:6128
- C:\Windows\System\baRqmVE.exe
  C:\Windows\System\baRqmVE.exe
  2⤵
  PID:6112
- C:\Windows\System\HGvHFXY.exe
  C:\Windows\System\HGvHFXY.exe
  2⤵
  PID:6096
- C:\Windows\System\CHfcHdQ.exe
  C:\Windows\System\CHfcHdQ.exe
  2⤵
  PID:6080
- C:\Windows\System\HNHvzGe.exe
  C:\Windows\System\HNHvzGe.exe
  2⤵
  PID:6064
- C:\Windows\System\XJzowyU.exe
  C:\Windows\System\XJzowyU.exe
  2⤵
  PID:6048
- C:\Windows\System\SnEUeLk.exe
  C:\Windows\System\SnEUeLk.exe
  2⤵
  PID:6024
- C:\Windows\System\TTCcWRf.exe
  C:\Windows\System\TTCcWRf.exe
  2⤵
  PID:6008
- C:\Windows\System\cgyrIYl.exe
  C:\Windows\System\cgyrIYl.exe
  2⤵
  PID:5992
- C:\Windows\System\HBplMYA.exe
  C:\Windows\System\HBplMYA.exe
  2⤵
  PID:5976
- C:\Windows\System\LPvAunP.exe
  C:\Windows\System\LPvAunP.exe
  2⤵
  PID:5964
- C:\Windows\System\ZeFykRr.exe
  C:\Windows\System\ZeFykRr.exe
  2⤵
  PID:5948
- C:\Windows\System\vULFivm.exe
  C:\Windows\System\vULFivm.exe
  2⤵
  PID:4776
- C:\Windows\System\ePfrHbM.exe
  C:\Windows\System\ePfrHbM.exe
  2⤵
  PID:2772
- C:\Windows\System\AqODsIu.exe
  C:\Windows\System\AqODsIu.exe
  2⤵
  PID:1768
- C:\Windows\System\uCleIwk.exe
  C:\Windows\System\uCleIwk.exe
  2⤵
  PID:2212
- C:\Windows\System\hijdnYR.exe
  C:\Windows\System\hijdnYR.exe
  2⤵
  PID:1596
- C:\Windows\System\BZNcYGl.exe
  C:\Windows\System\BZNcYGl.exe
  2⤵
  PID:6288
- C:\Windows\System\KriPAkE.exe
  C:\Windows\System\KriPAkE.exe
  2⤵
  PID:6460
- C:\Windows\System\TOxWwCl.exe
  C:\Windows\System\TOxWwCl.exe
  2⤵
  PID:6528
- C:\Windows\System\hlQcZsS.exe
  C:\Windows\System\hlQcZsS.exe
  2⤵
  PID:6624
- C:\Windows\System\qSEkHDl.exe
  C:\Windows\System\qSEkHDl.exe
  2⤵
  PID:6696
- C:\Windows\System\mFfAOZx.exe
  C:\Windows\System\mFfAOZx.exe
  2⤵
  PID:6760
- C:\Windows\System\ENvsaTF.exe
  C:\Windows\System\ENvsaTF.exe
  2⤵
  PID:6948
- C:\Windows\System\qCfROGd.exe
  C:\Windows\System\qCfROGd.exe
  2⤵
  PID:808
- C:\Windows\System\prrEPGb.exe
  C:\Windows\System\prrEPGb.exe
  2⤵
  PID:6996
- C:\Windows\System\TQoQEtl.exe
  C:\Windows\System\TQoQEtl.exe
  2⤵
  PID:7032
- C:\Windows\System\jzzUpIJ.exe
  C:\Windows\System\jzzUpIJ.exe
  2⤵
  PID:1492
- C:\Windows\System\rUVbBDr.exe
  C:\Windows\System\rUVbBDr.exe
  2⤵
  PID:1748
- C:\Windows\System\pkfOjDU.exe
  C:\Windows\System\pkfOjDU.exe
  2⤵
  PID:1592
- C:\Windows\System\aHCRYRK.exe
  C:\Windows\System\aHCRYRK.exe
  2⤵
  PID:7048
- C:\Windows\System\etrlocM.exe
  C:\Windows\System\etrlocM.exe
  2⤵
  PID:7064
- C:\Windows\System\UNLLjXT.exe
  C:\Windows\System\UNLLjXT.exe
  2⤵
  PID:604
- C:\Windows\System\wkaIeJD.exe
  C:\Windows\System\wkaIeJD.exe
  2⤵
  PID:7084
- C:\Windows\System\ONKZujE.exe
  C:\Windows\System\ONKZujE.exe
  2⤵
  PID:7100
- C:\Windows\System\AaWWDjg.exe
  C:\Windows\System\AaWWDjg.exe
  2⤵
  PID:7120
- C:\Windows\System\osYdQkG.exe
  C:\Windows\System\osYdQkG.exe
  2⤵
  PID:7136
- C:\Windows\System\RFXbtOG.exe
  C:\Windows\System\RFXbtOG.exe
  2⤵
  PID:2544
- C:\Windows\System\WjjnRbG.exe
  C:\Windows\System\WjjnRbG.exe
  2⤵
  PID:876
- C:\Windows\System\fFoxRwI.exe
  C:\Windows\System\fFoxRwI.exe
  2⤵
  PID:5620
- C:\Windows\System\XQMKWVQ.exe
  C:\Windows\System\XQMKWVQ.exe
  2⤵
  PID:5744
- C:\Windows\System\ScNEVzg.exe
  C:\Windows\System\ScNEVzg.exe
  2⤵
  PID:3328
- C:\Windows\System\nJHhgYm.exe
  C:\Windows\System\nJHhgYm.exe
  2⤵
  PID:2124
- C:\Windows\System\sLwRZbk.exe
  C:\Windows\System\sLwRZbk.exe
  2⤵
  PID:3392
- C:\Windows\System\fTbBJTK.exe
  C:\Windows\System\fTbBJTK.exe
  2⤵
  PID:3424
- C:\Windows\System\DTRSEPt.exe
  C:\Windows\System\DTRSEPt.exe
  2⤵
  PID:6380
- C:\Windows\System\TVEmpzt.exe
  C:\Windows\System\TVEmpzt.exe
  2⤵
  PID:3552
- C:\Windows\System\SwzHQRX.exe
  C:\Windows\System\SwzHQRX.exe
  2⤵
  PID:3616
- C:\Windows\System\YnlJaVQ.exe
  C:\Windows\System\YnlJaVQ.exe
  2⤵
  PID:3744
- C:\Windows\System\OGxdYFT.exe
  C:\Windows\System\OGxdYFT.exe
  2⤵
  PID:3840
- C:\Windows\System\OhSElpW.exe
  C:\Windows\System\OhSElpW.exe
  2⤵
  PID:1420
- C:\Windows\System\cxiuzgR.exe
  C:\Windows\System\cxiuzgR.exe
  2⤵
  PID:6172
- C:\Windows\System\FlMXFjp.exe
  C:\Windows\System\FlMXFjp.exe
  2⤵
  PID:2376
- C:\Windows\System\EKIgJTw.exe
  C:\Windows\System\EKIgJTw.exe
  2⤵
  PID:6856
- C:\Windows\System\ReijoBB.exe
  C:\Windows\System\ReijoBB.exe
  2⤵
  PID:6872
- C:\Windows\System\hOZLSMD.exe
  C:\Windows\System\hOZLSMD.exe
  2⤵
  PID:4344
- C:\Windows\System\UTcKALt.exe
  C:\Windows\System\UTcKALt.exe
  2⤵
  PID:4308
- C:\Windows\System\trJYEWs.exe
  C:\Windows\System\trJYEWs.exe
  2⤵
  PID:6840
- C:\Windows\System\sYasrbq.exe
  C:\Windows\System\sYasrbq.exe
  2⤵
  PID:6860
- C:\Windows\System\saQnZcp.exe
  C:\Windows\System\saQnZcp.exe
  2⤵
  PID:4472
- C:\Windows\System\lFJZuCt.exe
  C:\Windows\System\lFJZuCt.exe
  2⤵
  PID:5240
- C:\Windows\System\RwTfXny.exe
  C:\Windows\System\RwTfXny.exe
  2⤵
  PID:5208
- C:\Windows\System\foSBtGW.exe
  C:\Windows\System\foSBtGW.exe
  2⤵
  PID:4356
- C:\Windows\System\JNGTcjq.exe
  C:\Windows\System\JNGTcjq.exe
  2⤵
  PID:1172
- C:\Windows\System\hbpJEZm.exe
  C:\Windows\System\hbpJEZm.exe
  2⤵
  PID:1540
- C:\Windows\System\CmYIkYq.exe
  C:\Windows\System\CmYIkYq.exe
  2⤵
  PID:2460
- C:\Windows\System\EXzTZvB.exe
  C:\Windows\System\EXzTZvB.exe
  2⤵
  PID:5080
- C:\Windows\System\qypLcQM.exe
  C:\Windows\System\qypLcQM.exe
  2⤵
  PID:4984
- C:\Windows\System\NgqeGfa.exe
  C:\Windows\System\NgqeGfa.exe
  2⤵
  PID:4856
- C:\Windows\System\bCPpESc.exe
  C:\Windows\System\bCPpESc.exe
  2⤵
  PID:4568
- C:\Windows\System\MvLILww.exe
  C:\Windows\System\MvLILww.exe
  2⤵
  PID:1644
- C:\Windows\System\mgpkuuW.exe
  C:\Windows\System\mgpkuuW.exe
  2⤵
  PID:5892
- C:\Windows\System\sJDaPjc.exe
  C:\Windows\System\sJDaPjc.exe
  2⤵
  PID:6644
- C:\Windows\System\cjnOIsG.exe
  C:\Windows\System\cjnOIsG.exe
  2⤵
  PID:6480
- C:\Windows\System\WuWQwbD.exe
  C:\Windows\System\WuWQwbD.exe
  2⤵
  PID:2796
- C:\Windows\System\zjxeKsH.exe
  C:\Windows\System\zjxeKsH.exe
  2⤵
  PID:5380
- C:\Windows\System\iiigirI.exe
  C:\Windows\System\iiigirI.exe
  2⤵
  PID:5516
- C:\Windows\System\bORBQhF.exe
  C:\Windows\System\bORBQhF.exe
  2⤵
  PID:2308
- C:\Windows\System\VBzwdvH.exe
  C:\Windows\System\VBzwdvH.exe
  2⤵
  PID:6224
- C:\Windows\System\HqyCzUQ.exe
  C:\Windows\System\HqyCzUQ.exe
  2⤵
  PID:4792
- C:\Windows\System\VtnofzE.exe
  C:\Windows\System\VtnofzE.exe
  2⤵
  PID:4532
- C:\Windows\System\GprBAhZ.exe
  C:\Windows\System\GprBAhZ.exe
  2⤵
  PID:1176
- C:\Windows\System\usEAPqw.exe
  C:\Windows\System\usEAPqw.exe
  2⤵
  PID:6708
- C:\Windows\System\esViwGr.exe
  C:\Windows\System\esViwGr.exe
  2⤵
  PID:340
- C:\Windows\System\ipwHTRs.exe
  C:\Windows\System\ipwHTRs.exe
  2⤵
  PID:5684
- C:\Windows\System\cWdhqoD.exe
  C:\Windows\System\cWdhqoD.exe
  2⤵
  PID:3900
- C:\Windows\System\Hyvrqps.exe
  C:\Windows\System\Hyvrqps.exe
  2⤵
  PID:2436
- C:\Windows\System\ASXukXh.exe
  C:\Windows\System\ASXukXh.exe
  2⤵
  PID:4148
- C:\Windows\System\usxWDgV.exe
  C:\Windows\System\usxWDgV.exe
  2⤵
  PID:5124
- C:\Windows\System\RTjZbDA.exe
  C:\Windows\System\RTjZbDA.exe
  2⤵
  PID:3916
- C:\Windows\System\OcIHPtQ.exe
  C:\Windows\System\OcIHPtQ.exe
  2⤵
  PID:5252
- C:\Windows\System\ySYlKMD.exe
  C:\Windows\System\ySYlKMD.exe
  2⤵
  PID:5568
- C:\Windows\System\MeYwPFu.exe
  C:\Windows\System\MeYwPFu.exe
  2⤵
  PID:5448
- C:\Windows\System\RubCPeD.exe
  C:\Windows\System\RubCPeD.exe
  2⤵
  PID:1784
- C:\Windows\System\XTFVwAe.exe
  C:\Windows\System\XTFVwAe.exe
  2⤵
  PID:1520
- C:\Windows\System\wkYusFM.exe
  C:\Windows\System\wkYusFM.exe
  2⤵
  PID:5584
- C:\Windows\System\oRmQgpH.exe
  C:\Windows\System\oRmQgpH.exe
  2⤵
  PID:6664
- C:\Windows\System\iInJUZj.exe
  C:\Windows\System\iInJUZj.exe
  2⤵
  PID:1692
- C:\Windows\System\LwhdGkR.exe
  C:\Windows\System\LwhdGkR.exe
  2⤵
  PID:3404
- C:\Windows\System\FKmbxng.exe
  C:\Windows\System\FKmbxng.exe
  2⤵
  PID:5604
- C:\Windows\System\eLsUPft.exe
  C:\Windows\System\eLsUPft.exe
  2⤵
  PID:5900
- C:\Windows\System\rcvLgvL.exe
  C:\Windows\System\rcvLgvL.exe
  2⤵
  PID:5932
- C:\Windows\System\YKLDass.exe
  C:\Windows\System\YKLDass.exe
  2⤵
  PID:2580
- C:\Windows\System\OEPWmwr.exe
  C:\Windows\System\OEPWmwr.exe
  2⤵
  PID:6104
- C:\Windows\System\mCINyxL.exe
  C:\Windows\System\mCINyxL.exe
  2⤵
  PID:6116
- C:\Windows\System\MDOPPqa.exe
  C:\Windows\System\MDOPPqa.exe
  2⤵
  PID:6040
- C:\Windows\System\rSYgxAr.exe
  C:\Windows\System\rSYgxAr.exe
  2⤵
  PID:6052
- C:\Windows\System\gDMIGOx.exe
  C:\Windows\System\gDMIGOx.exe
  2⤵
  PID:6000
- C:\Windows\System\rrtzmep.exe
  C:\Windows\System\rrtzmep.exe
  2⤵
  PID:6012
- C:\Windows\System\UfWBavB.exe
  C:\Windows\System\UfWBavB.exe
  2⤵
  PID:5952
- C:\Windows\System\KiAEjJz.exe
  C:\Windows\System\KiAEjJz.exe
  2⤵
  PID:1456
- C:\Windows\System\igaTfxe.exe
  C:\Windows\System\igaTfxe.exe
  2⤵
  PID:5936
- C:\Windows\System\KMZbRkN.exe
  C:\Windows\System\KMZbRkN.exe
  2⤵
  PID:5940
- C:\Windows\System\CqDRlsq.exe
  C:\Windows\System\CqDRlsq.exe
  2⤵
  PID:6392
- C:\Windows\System\xHeKRFW.exe
  C:\Windows\System\xHeKRFW.exe
  2⤵
  PID:6796
- C:\Windows\System\bsUEwZL.exe
  C:\Windows\System\bsUEwZL.exe
  2⤵
  PID:6592
- C:\Windows\System\hVNVLdZ.exe
  C:\Windows\System\hVNVLdZ.exe
  2⤵
  PID:6952
- C:\Windows\System\fQdQuEz.exe
  C:\Windows\System\fQdQuEz.exe
  2⤵
  PID:7012
- C:\Windows\System\RaXTomp.exe
  C:\Windows\System\RaXTomp.exe
  2⤵
  PID:7040
- C:\Windows\System\WccqGqs.exe
  C:\Windows\System\WccqGqs.exe
  2⤵
  PID:2852
- C:\Windows\System\sOpJhTA.exe
  C:\Windows\System\sOpJhTA.exe
  2⤵
  PID:7068
- C:\Windows\System\iANfipJ.exe
  C:\Windows\System\iANfipJ.exe
  2⤵
  PID:2476
- C:\Windows\System\YOphAuK.exe
  C:\Windows\System\YOphAuK.exe
  2⤵
  PID:7128
- C:\Windows\System\xAxLgod.exe
  C:\Windows\System\xAxLgod.exe
  2⤵
  PID:7156
- C:\Windows\System\TFvAxKo.exe
  C:\Windows\System\TFvAxKo.exe
  2⤵
  PID:2448
- C:\Windows\System\wvebwks.exe
  C:\Windows\System\wvebwks.exe
  2⤵
  PID:1676
- C:\Windows\System\AWBDTAC.exe
  C:\Windows\System\AWBDTAC.exe
  2⤵
  PID:3420
- C:\Windows\System\WYEQkMR.exe
  C:\Windows\System\WYEQkMR.exe
  2⤵
  PID:5748
- C:\Windows\System\ilFVbTj.exe
  C:\Windows\System\ilFVbTj.exe
  2⤵
  PID:3388
- C:\Windows\System\DJCBVYp.exe
  C:\Windows\System\DJCBVYp.exe
  2⤵
  PID:3644
- C:\Windows\System\oWYsCSO.exe
  C:\Windows\System\oWYsCSO.exe
  2⤵
  PID:7016
- C:\Windows\System\jOjpexn.exe
  C:\Windows\System\jOjpexn.exe
  2⤵
  PID:2572
- C:\Windows\System\lfjeVGz.exe
  C:\Windows\System\lfjeVGz.exe
  2⤵
  PID:5236
- C:\Windows\System\TkPsNGv.exe
  C:\Windows\System\TkPsNGv.exe
  2⤵
  PID:6876
- C:\Windows\System\wtoYnKp.exe
  C:\Windows\System\wtoYnKp.exe
  2⤵
  PID:6816
- C:\Windows\System\akeEGxS.exe
  C:\Windows\System\akeEGxS.exe
  2⤵
  PID:4700
- C:\Windows\System\LkiuQoi.exe
  C:\Windows\System\LkiuQoi.exe
  2⤵
  PID:5888
- C:\Windows\System\aQmnAWc.exe
  C:\Windows\System\aQmnAWc.exe
  2⤵
  PID:6896
- C:\Windows\System\QyrOYDR.exe
  C:\Windows\System\QyrOYDR.exe
  2⤵
  PID:6844
- C:\Windows\System\HNBcFfy.exe
  C:\Windows\System\HNBcFfy.exe
  2⤵
  PID:4048
- C:\Windows\System\jAbYGwT.exe
  C:\Windows\System\jAbYGwT.exe
  2⤵
  PID:2912
- C:\Windows\System\fOIxCmI.exe
  C:\Windows\System\fOIxCmI.exe
  2⤵
  PID:6880
- C:\Windows\System\wHrcUHY.exe
  C:\Windows\System\wHrcUHY.exe
  2⤵
  PID:4904
- C:\Windows\System\CWSOiYY.exe
  C:\Windows\System\CWSOiYY.exe
  2⤵
  PID:4860
- C:\Windows\System\UhslBNP.exe
  C:\Windows\System\UhslBNP.exe
  2⤵
  PID:2780
- C:\Windows\System\BJreJIq.exe
  C:\Windows\System\BJreJIq.exe
  2⤵
  PID:4796
- C:\Windows\System\hyLPgSj.exe
  C:\Windows\System\hyLPgSj.exe
  2⤵
  PID:6680
- C:\Windows\System\hvBtSJQ.exe
  C:\Windows\System\hvBtSJQ.exe
  2⤵
  PID:3660
- C:\Windows\System\RRXKVjj.exe
  C:\Windows\System\RRXKVjj.exe
  2⤵
  PID:5476
- C:\Windows\System\haDdWRP.exe
  C:\Windows\System\haDdWRP.exe
  2⤵
  PID:1736
- C:\Windows\System\mBuKhSq.exe
  C:\Windows\System\mBuKhSq.exe
  2⤵
  PID:2488
- C:\Windows\System\BqBUtPq.exe
  C:\Windows\System\BqBUtPq.exe
  2⤵
  PID:4180
- C:\Windows\System\usriVJQ.exe
  C:\Windows\System\usriVJQ.exe
  2⤵
  PID:1424
- C:\Windows\System\jluyXdy.exe
  C:\Windows\System\jluyXdy.exe
  2⤵
  PID:2832
- C:\Windows\System\MRLzLji.exe
  C:\Windows\System\MRLzLji.exe
  2⤵
  PID:5548
- C:\Windows\System\hemcrnr.exe
  C:\Windows\System\hemcrnr.exe
  2⤵
  PID:5916
- C:\Windows\System\ejmhRtL.exe
  C:\Windows\System\ejmhRtL.exe
  2⤵
  PID:2692
- C:\Windows\System\UpkLVRd.exe
  C:\Windows\System\UpkLVRd.exe
  2⤵
  PID:6028
- C:\Windows\System\aDYWPQi.exe
  C:\Windows\System\aDYWPQi.exe
  2⤵
  PID:5824
- C:\Windows\System\rGkegzl.exe
  C:\Windows\System\rGkegzl.exe
  2⤵
  PID:624
- C:\Windows\System\sFmUyaV.exe
  C:\Windows\System\sFmUyaV.exe
  2⤵
  PID:6136
- C:\Windows\System\RKvDVxA.exe
  C:\Windows\System\RKvDVxA.exe
  2⤵
  PID:3792
- C:\Windows\System\TDQjwxg.exe
  C:\Windows\System\TDQjwxg.exe
  2⤵
  PID:1016
- C:\Windows\System\VHbNUWd.exe
  C:\Windows\System\VHbNUWd.exe
  2⤵
  PID:6056
- C:\Windows\System\plmAGuY.exe
  C:\Windows\System\plmAGuY.exe
  2⤵
  PID:2700
- C:\Windows\System\Qlshous.exe
  C:\Windows\System\Qlshous.exe
  2⤵
  PID:2600
- C:\Windows\System\vERzWuP.exe
  C:\Windows\System\vERzWuP.exe
  2⤵
  PID:7036
- C:\Windows\System\zirUItX.exe
  C:\Windows\System\zirUItX.exe
  2⤵
  PID:6888
- C:\Windows\System\tYBDcIA.exe
  C:\Windows\System\tYBDcIA.exe
  2⤵
  PID:5520
- C:\Windows\System\TNBGwpg.exe
  C:\Windows\System\TNBGwpg.exe
  2⤵
  PID:1632
- C:\Windows\System\HttZnUa.exe
  C:\Windows\System\HttZnUa.exe
  2⤵
  PID:3360
- C:\Windows\System\qjNecYG.exe
  C:\Windows\System\qjNecYG.exe
  2⤵
  PID:5048
- C:\Windows\System\JmiIwpc.exe
  C:\Windows\System\JmiIwpc.exe
  2⤵
  PID:3548
- C:\Windows\System\AnbCltQ.exe
  C:\Windows\System\AnbCltQ.exe
  2⤵
  PID:3920
- C:\Windows\System\eVjPlbc.exe
  C:\Windows\System\eVjPlbc.exe
  2⤵
  PID:6512
- C:\Windows\System\QnbniGk.exe
  C:\Windows\System\QnbniGk.exe
  2⤵
  PID:5432
- C:\Windows\System\EfWvqON.exe
  C:\Windows\System\EfWvqON.exe
  2⤵
  PID:6852
- C:\Windows\System\kdpaJcx.exe
  C:\Windows\System\kdpaJcx.exe
  2⤵
  PID:3008
- C:\Windows\System\caQyTPE.exe
  C:\Windows\System\caQyTPE.exe
  2⤵
  PID:2112
- C:\Windows\System\OAfcuCP.exe
  C:\Windows\System\OAfcuCP.exe
  2⤵
  PID:6292
- C:\Windows\System\WoOAVIW.exe
  C:\Windows\System\WoOAVIW.exe
  2⤵
  PID:5288
- C:\Windows\System\HTzXJcp.exe
  C:\Windows\System\HTzXJcp.exe
  2⤵
  PID:2028
- C:\Windows\System\iyXCvPD.exe
  C:\Windows\System\iyXCvPD.exe
  2⤵
  PID:6824
- C:\Windows\System\MepuhiJ.exe
  C:\Windows\System\MepuhiJ.exe
  2⤵
  PID:2296
- C:\Windows\System\YmhqIOe.exe
  C:\Windows\System\YmhqIOe.exe
  2⤵
  PID:5316
- C:\Windows\System\VNuKYtP.exe
  C:\Windows\System\VNuKYtP.exe
  2⤵
  PID:5128
- C:\Windows\System\dFNdcoi.exe
  C:\Windows\System\dFNdcoi.exe
  2⤵
  PID:2316
- C:\Windows\System\pGDtYGn.exe
  C:\Windows\System\pGDtYGn.exe
  2⤵
  PID:6764
- C:\Windows\System\JgxrZgx.exe
  C:\Windows\System\JgxrZgx.exe
  2⤵
  PID:6728
- C:\Windows\System\HfZKvhW.exe
  C:\Windows\System\HfZKvhW.exe
  2⤵
  PID:1004
- C:\Windows\System\APeetKL.exe
  C:\Windows\System\APeetKL.exe
  2⤵
  PID:3296
- C:\Windows\System\gyKlDOs.exe
  C:\Windows\System\gyKlDOs.exe
  2⤵
  PID:3136
- C:\Windows\System\UZxsEXa.exe
  C:\Windows\System\UZxsEXa.exe
  2⤵
  PID:7096
- C:\Windows\System\hjnrbRk.exe
  C:\Windows\System\hjnrbRk.exe
  2⤵
  PID:6244
- C:\Windows\System\cKBjpVc.exe
  C:\Windows\System\cKBjpVc.exe
  2⤵
  PID:6496
- C:\Windows\System\iPWEOWY.exe
  C:\Windows\System\iPWEOWY.exe
  2⤵
  PID:5444
- C:\Windows\System\DNbiHrg.exe
  C:\Windows\System\DNbiHrg.exe
  2⤵
  PID:3804
- C:\Windows\System\ezBBMhd.exe
  C:\Windows\System\ezBBMhd.exe
  2⤵
  PID:5492
- C:\Windows\System\KvYdAki.exe
  C:\Windows\System\KvYdAki.exe
  2⤵
  PID:4012
- C:\Windows\System\bMectEm.exe
  C:\Windows\System\bMectEm.exe
  2⤵
  PID:5956
- C:\Windows\System\uTpUeMH.exe
  C:\Windows\System\uTpUeMH.exe
  2⤵
  PID:3536
- C:\Windows\System\WMpkbQX.exe
  C:\Windows\System\WMpkbQX.exe
  2⤵
  PID:3968
- C:\Windows\System\WgkKuWi.exe
  C:\Windows\System\WgkKuWi.exe
  2⤵
  PID:5728
- C:\Windows\System\AIfRugo.exe
  C:\Windows\System\AIfRugo.exe
  2⤵
  PID:2736
- C:\Windows\System\REXnBCr.exe
  C:\Windows\System\REXnBCr.exe
  2⤵
  PID:108
- C:\Windows\System\jDLnCay.exe
  C:\Windows\System\jDLnCay.exe
  2⤵
  PID:4408
- C:\Windows\System\VIBRkcL.exe
  C:\Windows\System\VIBRkcL.exe
  2⤵
  PID:7184
- C:\Windows\System\jMtiMWa.exe
  C:\Windows\System\jMtiMWa.exe
  2⤵
  PID:7200
- C:\Windows\System\QPJlkXQ.exe
  C:\Windows\System\QPJlkXQ.exe
  2⤵
  PID:7216
- C:\Windows\System\GndHVgr.exe
  C:\Windows\System\GndHVgr.exe
  2⤵
  PID:7232
- C:\Windows\System\DevoKSc.exe
  C:\Windows\System\DevoKSc.exe
  2⤵
  PID:7248
- C:\Windows\System\wMqKhEg.exe
  C:\Windows\System\wMqKhEg.exe
  2⤵
  PID:7264
- C:\Windows\System\BjxYWKW.exe
  C:\Windows\System\BjxYWKW.exe
  2⤵
  PID:7280
- C:\Windows\System\WTtGrtS.exe
  C:\Windows\System\WTtGrtS.exe
  2⤵
  PID:7296
- C:\Windows\System\mQTudsG.exe
  C:\Windows\System\mQTudsG.exe
  2⤵
  PID:7312
- C:\Windows\System\kNSiiNU.exe
  C:\Windows\System\kNSiiNU.exe
  2⤵
  PID:7328
- C:\Windows\System\CpzMxBp.exe
  C:\Windows\System\CpzMxBp.exe
  2⤵
  PID:7344
- C:\Windows\System\XvfDerE.exe
  C:\Windows\System\XvfDerE.exe
  2⤵
  PID:7360
- C:\Windows\System\euMqdVy.exe
  C:\Windows\System\euMqdVy.exe
  2⤵
  PID:7376
- C:\Windows\System\bsNJPxn.exe
  C:\Windows\System\bsNJPxn.exe
  2⤵
  PID:7392
- C:\Windows\System\ePDXyRr.exe
  C:\Windows\System\ePDXyRr.exe
  2⤵
  PID:7408
- C:\Windows\System\XNyHBjq.exe
  C:\Windows\System\XNyHBjq.exe
  2⤵
  PID:7424
- C:\Windows\System\OWkXzCw.exe
  C:\Windows\System\OWkXzCw.exe
  2⤵
  PID:7440
- C:\Windows\System\QnuAfiu.exe
  C:\Windows\System\QnuAfiu.exe
  2⤵
  PID:7456
- C:\Windows\System\bDaKuOa.exe
  C:\Windows\System\bDaKuOa.exe
  2⤵
  PID:7472
- C:\Windows\System\qzZdyDV.exe
  C:\Windows\System\qzZdyDV.exe
  2⤵
  PID:7488
- C:\Windows\System\eMPkYpK.exe
  C:\Windows\System\eMPkYpK.exe
  2⤵
  PID:7504
- C:\Windows\System\UMseBcy.exe
  C:\Windows\System\UMseBcy.exe
  2⤵
  PID:7520
- C:\Windows\System\tfvbErD.exe
  C:\Windows\System\tfvbErD.exe
  2⤵
  PID:7536
- C:\Windows\System\tiRpaNy.exe
  C:\Windows\System\tiRpaNy.exe
  2⤵
  PID:7552
- C:\Windows\System\LCyYiFO.exe
  C:\Windows\System\LCyYiFO.exe
  2⤵
  PID:7568
- C:\Windows\System\SzvOpaM.exe
  C:\Windows\System\SzvOpaM.exe
  2⤵
  PID:7584
- C:\Windows\System\AQKWjlf.exe
  C:\Windows\System\AQKWjlf.exe
  2⤵
  PID:7600
- C:\Windows\System\sbftlHg.exe
  C:\Windows\System\sbftlHg.exe
  2⤵
  PID:7616
- C:\Windows\System\rlyMcyp.exe
  C:\Windows\System\rlyMcyp.exe
  2⤵
  PID:7632
- C:\Windows\System\FVTRguB.exe
  C:\Windows\System\FVTRguB.exe
  2⤵
  PID:7652
- C:\Windows\System\kIuBhBo.exe
  C:\Windows\System\kIuBhBo.exe
  2⤵
  PID:7668
- C:\Windows\System\jpNVeHi.exe
  C:\Windows\System\jpNVeHi.exe
  2⤵
  PID:7684
- C:\Windows\System\nwFuqTz.exe
  C:\Windows\System\nwFuqTz.exe
  2⤵
  PID:7700
- C:\Windows\System\vtQTQAo.exe
  C:\Windows\System\vtQTQAo.exe
  2⤵
  PID:7716
- C:\Windows\System\pjYuAnP.exe
  C:\Windows\System\pjYuAnP.exe
  2⤵
  PID:7732
- C:\Windows\System\DzdHJBA.exe
  C:\Windows\System\DzdHJBA.exe
  2⤵
  PID:7748
- C:\Windows\System\bqNUydR.exe
  C:\Windows\System\bqNUydR.exe
  2⤵
  PID:7764
- C:\Windows\System\MtLaKue.exe
  C:\Windows\System\MtLaKue.exe
  2⤵
  PID:7780
- C:\Windows\System\ZSRLaAY.exe
  C:\Windows\System\ZSRLaAY.exe
  2⤵
  PID:7796
- C:\Windows\System\NbWTFjK.exe
  C:\Windows\System\NbWTFjK.exe
  2⤵
  PID:7812
- C:\Windows\System\WUmuSaY.exe
  C:\Windows\System\WUmuSaY.exe
  2⤵
  PID:7828
- C:\Windows\System\ATeacaj.exe
  C:\Windows\System\ATeacaj.exe
  2⤵
  PID:7844
- C:\Windows\System\bsfRZzz.exe
  C:\Windows\System\bsfRZzz.exe
  2⤵
  PID:7860
- C:\Windows\System\NYjpFDJ.exe
  C:\Windows\System\NYjpFDJ.exe
  2⤵
  PID:7876
- C:\Windows\System\IhaKIqQ.exe
  C:\Windows\System\IhaKIqQ.exe
  2⤵
  PID:7892
- C:\Windows\System\eOWtqsb.exe
  C:\Windows\System\eOWtqsb.exe
  2⤵
  PID:7908
- C:\Windows\System\eRRvMXm.exe
  C:\Windows\System\eRRvMXm.exe
  2⤵
  PID:7924
- C:\Windows\System\qcFvjwO.exe
  C:\Windows\System\qcFvjwO.exe
  2⤵
  PID:7940
- C:\Windows\System\dsqFeih.exe
  C:\Windows\System\dsqFeih.exe
  2⤵
  PID:7956
- C:\Windows\System\MztmeKv.exe
  C:\Windows\System\MztmeKv.exe
  2⤵
  PID:7972
- C:\Windows\System\NhqtHvQ.exe
  C:\Windows\System\NhqtHvQ.exe
  2⤵
  PID:7988
- C:\Windows\System\dUfVPnH.exe
  C:\Windows\System\dUfVPnH.exe
  2⤵
  PID:8004
- C:\Windows\System\DQLpKae.exe
  C:\Windows\System\DQLpKae.exe
  2⤵
  PID:8020
- C:\Windows\System\iqmeIJz.exe
  C:\Windows\System\iqmeIJz.exe
  2⤵
  PID:8036
- C:\Windows\System\biGtZIa.exe
  C:\Windows\System\biGtZIa.exe
  2⤵
  PID:8052
- C:\Windows\System\dnKEFUN.exe
  C:\Windows\System\dnKEFUN.exe
  2⤵
  PID:8068
- C:\Windows\System\yAmtrYk.exe
  C:\Windows\System\yAmtrYk.exe
  2⤵
  PID:8084
- C:\Windows\System\TyBzLkT.exe
  C:\Windows\System\TyBzLkT.exe
  2⤵
  PID:8100
- C:\Windows\System\wwZdqAu.exe
  C:\Windows\System\wwZdqAu.exe
  2⤵
  PID:8116
- C:\Windows\System\wHKJmMO.exe
  C:\Windows\System\wHKJmMO.exe
  2⤵
  PID:8132
- C:\Windows\System\MeacRAq.exe
  C:\Windows\System\MeacRAq.exe
  2⤵
  PID:8148
- C:\Windows\System\QYlzZlI.exe
  C:\Windows\System\QYlzZlI.exe
  2⤵
  PID:8164
- C:\Windows\System\dgiXotf.exe
  C:\Windows\System\dgiXotf.exe
  2⤵
  PID:8180
- C:\Windows\System\mJwXsFP.exe
  C:\Windows\System\mJwXsFP.exe
  2⤵
  PID:3264
- C:\Windows\System\kcaWTeN.exe
  C:\Windows\System\kcaWTeN.exe
  2⤵
  PID:4376
- C:\Windows\System\hqneapn.exe
  C:\Windows\System\hqneapn.exe
  2⤵
  PID:7196
- C:\Windows\System\XBDaFfv.exe
  C:\Windows\System\XBDaFfv.exe
  2⤵
  PID:4092
- C:\Windows\System\kZyrEWt.exe
  C:\Windows\System\kZyrEWt.exe
  2⤵
  PID:6360
- C:\Windows\System\KerraeY.exe
  C:\Windows\System\KerraeY.exe
  2⤵
  PID:7176
- C:\Windows\System\OZgqORm.exe
  C:\Windows\System\OZgqORm.exe
  2⤵
  PID:7240
- C:\Windows\System\bVhjzLK.exe
  C:\Windows\System\bVhjzLK.exe
  2⤵
  PID:7276
- C:\Windows\System\zewiSgQ.exe
  C:\Windows\System\zewiSgQ.exe
  2⤵
  PID:7308
- C:\Windows\System\cOHVHPW.exe
  C:\Windows\System\cOHVHPW.exe
  2⤵
  PID:7352
- C:\Windows\System\tnJcTEK.exe
  C:\Windows\System\tnJcTEK.exe
  2⤵
  PID:7416
- C:\Windows\System\dLWEKow.exe
  C:\Windows\System\dLWEKow.exe
  2⤵
  PID:7480
- C:\Windows\System\wgfMBPa.exe
  C:\Windows\System\wgfMBPa.exe
  2⤵
  PID:7544
- C:\Windows\System\UNNaxaR.exe
  C:\Windows\System\UNNaxaR.exe
  2⤵
  PID:7580
- C:\Windows\System\NOgEsvR.exe
  C:\Windows\System\NOgEsvR.exe
  2⤵
  PID:7496
- C:\Windows\System\HKeIeiZ.exe
  C:\Windows\System\HKeIeiZ.exe
  2⤵
  PID:7532
- C:\Windows\System\JGUdmUh.exe
  C:\Windows\System\JGUdmUh.exe
  2⤵
  PID:7964
- C:\Windows\System\sIwwuoW.exe
  C:\Windows\System\sIwwuoW.exe
  2⤵
  PID:7884
- C:\Windows\System\rILZqug.exe
  C:\Windows\System\rILZqug.exe
  2⤵
  PID:8064
- C:\Windows\System\OWwCjCp.exe
  C:\Windows\System\OWwCjCp.exe
  2⤵
  PID:7888
- C:\Windows\System\ZUqfDiX.exe
  C:\Windows\System\ZUqfDiX.exe
  2⤵
  PID:7852
- C:\Windows\System\qiwDqIn.exe
  C:\Windows\System\qiwDqIn.exe
  2⤵
  PID:7984
- C:\Windows\System\zzSAjRV.exe
  C:\Windows\System\zzSAjRV.exe
  2⤵
  PID:8092
- C:\Windows\System\UnXXmpj.exe
  C:\Windows\System\UnXXmpj.exe
  2⤵
  PID:8080
- C:\Windows\System\txHjOuA.exe
  C:\Windows\System\txHjOuA.exe
  2⤵
  PID:8112
- C:\Windows\System\KDGhutX.exe
  C:\Windows\System\KDGhutX.exe
  2⤵
  PID:8140
- C:\Windows\System\GDJgVOl.exe
  C:\Windows\System\GDJgVOl.exe
  2⤵
  PID:7192
- C:\Windows\System\mCgYEXq.exe
  C:\Windows\System\mCgYEXq.exe
  2⤵
  PID:8172
- C:\Windows\System\PIzYGZv.exe
  C:\Windows\System\PIzYGZv.exe
  2⤵
  PID:6884
- C:\Windows\System\rqMxWUp.exe
  C:\Windows\System\rqMxWUp.exe
  2⤵
  PID:7388
- C:\Windows\System\qvRbZqm.exe
  C:\Windows\System\qvRbZqm.exe
  2⤵
  PID:7260
- C:\Windows\System\tVjztbA.exe
  C:\Windows\System\tVjztbA.exe
  2⤵
  PID:7516
- C:\Windows\System\zrfGpki.exe
  C:\Windows\System\zrfGpki.exe
  2⤵
  PID:7340
- C:\Windows\System\SJJNPIu.exe
  C:\Windows\System\SJJNPIu.exe
  2⤵
  PID:7372
- C:\Windows\System\MiWPFcY.exe
  C:\Windows\System\MiWPFcY.exe
  2⤵
  PID:7448
- C:\Windows\System\GoeOYbo.exe
  C:\Windows\System\GoeOYbo.exe
  2⤵
  PID:7464
- C:\Windows\System\FlPoont.exe
  C:\Windows\System\FlPoont.exe
  2⤵
  PID:6192
- C:\Windows\System\Fjgofdw.exe
  C:\Windows\System\Fjgofdw.exe
  2⤵
  PID:7500
- C:\Windows\System\qPzScJM.exe
  C:\Windows\System\qPzScJM.exe
  2⤵
  PID:7920
- C:\Windows\System\SUGGPBC.exe
  C:\Windows\System\SUGGPBC.exe
  2⤵
  PID:7788
- C:\Windows\System\MApeLml.exe
  C:\Windows\System\MApeLml.exe
  2⤵
  PID:7576
- C:\Windows\System\yNvFRdL.exe
  C:\Windows\System\yNvFRdL.exe
  2⤵
  PID:7680
- C:\Windows\System\KSEWyPN.exe
  C:\Windows\System\KSEWyPN.exe
  2⤵
  PID:7804
- C:\Windows\System\qeRSHMq.exe
  C:\Windows\System\qeRSHMq.exe
  2⤵
  PID:7676
- C:\Windows\System\vXORhVA.exe
  C:\Windows\System\vXORhVA.exe
  2⤵
  PID:7628
- C:\Windows\System\kifGLyI.exe
  C:\Windows\System\kifGLyI.exe
  2⤵
  PID:7648
- C:\Windows\System\ZvKHiVb.exe
  C:\Windows\System\ZvKHiVb.exe
  2⤵
  PID:7436
- C:\Windows\System\oqPTCjr.exe
  C:\Windows\System\oqPTCjr.exe
  2⤵
  PID:7596
- C:\Windows\System\caeOlPM.exe
  C:\Windows\System\caeOlPM.exe
  2⤵
  PID:7712
- C:\Windows\System\bzlcfXv.exe
  C:\Windows\System\bzlcfXv.exe
  2⤵
  PID:7776
- C:\Windows\System\VvsIljA.exe
  C:\Windows\System\VvsIljA.exe
  2⤵
  PID:8044
- C:\Windows\System\aGvADGN.exe
  C:\Windows\System\aGvADGN.exe
  2⤵
  PID:7836
- C:\Windows\System\qItTYaw.exe
  C:\Windows\System\qItTYaw.exe
  2⤵
  PID:7904
- C:\Windows\System\qaetgvm.exe
  C:\Windows\System\qaetgvm.exe
  2⤵
  PID:7324
- C:\Windows\System\xxOmvMi.exe
  C:\Windows\System\xxOmvMi.exe
  2⤵
  PID:8048
- C:\Windows\System\EujlTOs.exe
  C:\Windows\System\EujlTOs.exe
  2⤵
  PID:1484
- C:\Windows\System\rlZyjdI.exe
  C:\Windows\System\rlZyjdI.exe
  2⤵
  PID:4032
- C:\Windows\System\jRzyfZz.exe
  C:\Windows\System\jRzyfZz.exe
  2⤵
  PID:7868
- C:\Windows\System\cgfoGSZ.exe
  C:\Windows\System\cgfoGSZ.exe
  2⤵
  PID:7400
- C:\Windows\System\SOVfkKD.exe
  C:\Windows\System\SOVfkKD.exe
  2⤵
  PID:7756
- C:\Windows\System\HdKOJBH.exe
  C:\Windows\System\HdKOJBH.exe
  2⤵
  PID:7660
- C:\Windows\System\FOcESFk.exe
  C:\Windows\System\FOcESFk.exe
  2⤵
  PID:7692
- C:\Windows\System\USzoBVP.exe
  C:\Windows\System\USzoBVP.exe
  2⤵
  PID:7932
- C:\Windows\System\TzbuGxw.exe
  C:\Windows\System\TzbuGxw.exe
  2⤵
  PID:7792
- C:\Windows\System\NEkCwEO.exe
  C:\Windows\System\NEkCwEO.exe
  2⤵
  PID:7640
- C:\Windows\System\YMazeJZ.exe
  C:\Windows\System\YMazeJZ.exe
  2⤵
  PID:8000
- C:\Windows\System\tPrTLdW.exe
  C:\Windows\System\tPrTLdW.exe
  2⤵
  PID:8016
- C:\Windows\System\VlaWsvO.exe
  C:\Windows\System\VlaWsvO.exe
  2⤵
  PID:7872
- C:\Windows\System\oSixYgr.exe
  C:\Windows\System\oSixYgr.exe
  2⤵
  PID:7900
- C:\Windows\System\YAMAoYT.exe
  C:\Windows\System\YAMAoYT.exe
  2⤵
  PID:7820
- C:\Windows\System\gcGfVOb.exe
  C:\Windows\System\gcGfVOb.exe
  2⤵
  PID:8208
- C:\Windows\System\PCsGUBb.exe
  C:\Windows\System\PCsGUBb.exe
  2⤵
  PID:8224
- C:\Windows\System\TNQknWk.exe
  C:\Windows\System\TNQknWk.exe
  2⤵
  PID:8240
- C:\Windows\System\wbetuIr.exe
  C:\Windows\System\wbetuIr.exe
  2⤵
  PID:8256
- C:\Windows\System\vtDeXsl.exe
  C:\Windows\System\vtDeXsl.exe
  2⤵
  PID:8272
- C:\Windows\System\QuTqVTL.exe
  C:\Windows\System\QuTqVTL.exe
  2⤵
  PID:8292
- C:\Windows\System\bcZWvAm.exe
  C:\Windows\System\bcZWvAm.exe
  2⤵
  PID:8308
- C:\Windows\System\FVuhmSb.exe
  C:\Windows\System\FVuhmSb.exe
  2⤵
  PID:8324
- C:\Windows\System\bqAKuop.exe
  C:\Windows\System\bqAKuop.exe
  2⤵
  PID:8340
- C:\Windows\System\CtoqjBr.exe
  C:\Windows\System\CtoqjBr.exe
  2⤵
  PID:8356
- C:\Windows\System\rxXpJIn.exe
  C:\Windows\System\rxXpJIn.exe
  2⤵
  PID:8372
- C:\Windows\System\rFGNoEQ.exe
  C:\Windows\System\rFGNoEQ.exe
  2⤵
  PID:8388
- C:\Windows\System\bsnqwgz.exe
  C:\Windows\System\bsnqwgz.exe
  2⤵
  PID:8404
- C:\Windows\System\YiRcGQb.exe
  C:\Windows\System\YiRcGQb.exe
  2⤵
  PID:8420
- C:\Windows\System\xLZhLCq.exe
  C:\Windows\System\xLZhLCq.exe
  2⤵
  PID:8436
- C:\Windows\System\AwhTpKS.exe
  C:\Windows\System\AwhTpKS.exe
  2⤵
  PID:8452
- C:\Windows\System\ivpVjNK.exe
  C:\Windows\System\ivpVjNK.exe
  2⤵
  PID:8468
- C:\Windows\System\UzmfAsE.exe
  C:\Windows\System\UzmfAsE.exe
  2⤵
  PID:8484
- C:\Windows\System\CZWIjTA.exe
  C:\Windows\System\CZWIjTA.exe
  2⤵
  PID:8500
- C:\Windows\System\VecthnI.exe
  C:\Windows\System\VecthnI.exe
  2⤵
  PID:8516
- C:\Windows\System\oSyixqH.exe
  C:\Windows\System\oSyixqH.exe
  2⤵
  PID:8532
- C:\Windows\System\AkXjubz.exe
  C:\Windows\System\AkXjubz.exe
  2⤵
  PID:8548
- C:\Windows\System\DLuEXMw.exe
  C:\Windows\System\DLuEXMw.exe
  2⤵
  PID:8564
- C:\Windows\System\yxzllgN.exe
  C:\Windows\System\yxzllgN.exe
  2⤵
  PID:8580
- C:\Windows\System\YPEjIZa.exe
  C:\Windows\System\YPEjIZa.exe
  2⤵
  PID:8596
- C:\Windows\System\bxkBKGZ.exe
  C:\Windows\System\bxkBKGZ.exe
  2⤵
  PID:8612
- C:\Windows\System\WjGKFQQ.exe
  C:\Windows\System\WjGKFQQ.exe
  2⤵
  PID:8628
- C:\Windows\System\zCosXyS.exe
  C:\Windows\System\zCosXyS.exe
  2⤵
  PID:8644
- C:\Windows\System\vXIcvwV.exe
  C:\Windows\System\vXIcvwV.exe
  2⤵
  PID:8660
- C:\Windows\System\qmRJJDg.exe
  C:\Windows\System\qmRJJDg.exe
  2⤵
  PID:8676
- C:\Windows\System\jdEdfWZ.exe
  C:\Windows\System\jdEdfWZ.exe
  2⤵
  PID:8692
- C:\Windows\System\HpHvGdi.exe
  C:\Windows\System\HpHvGdi.exe
  2⤵
  PID:8708
- C:\Windows\System\YLbEoPw.exe
  C:\Windows\System\YLbEoPw.exe
  2⤵
  PID:8724
- C:\Windows\System\wcqlDfp.exe
  C:\Windows\System\wcqlDfp.exe
  2⤵
  PID:8740
- C:\Windows\System\OSVzTXj.exe
  C:\Windows\System\OSVzTXj.exe
  2⤵
  PID:8756
- C:\Windows\System\NinpjCq.exe
  C:\Windows\System\NinpjCq.exe
  2⤵
  PID:8772
- C:\Windows\System\NtaKMOw.exe
  C:\Windows\System\NtaKMOw.exe
  2⤵
  PID:8788
- C:\Windows\System\FKoprYL.exe
  C:\Windows\System\FKoprYL.exe
  2⤵
  PID:8804
- C:\Windows\System\fgkgaBk.exe
  C:\Windows\System\fgkgaBk.exe
  2⤵
  PID:8820
- C:\Windows\System\vxJsfhL.exe
  C:\Windows\System\vxJsfhL.exe
  2⤵
  PID:8836
- C:\Windows\System\dmiggic.exe
  C:\Windows\System\dmiggic.exe
  2⤵
  PID:8852
- C:\Windows\System\YWkyQQO.exe
  C:\Windows\System\YWkyQQO.exe
  2⤵
  PID:8868
- C:\Windows\System\yJHfFFW.exe
  C:\Windows\System\yJHfFFW.exe
  2⤵
  PID:8884
- C:\Windows\System\QiXTTye.exe
  C:\Windows\System\QiXTTye.exe
  2⤵
  PID:8900
- C:\Windows\System\QeldTJJ.exe
  C:\Windows\System\QeldTJJ.exe
  2⤵
  PID:8916
- C:\Windows\System\ahRiBwI.exe
  C:\Windows\System\ahRiBwI.exe
  2⤵
  PID:8936
- C:\Windows\System\pjadwjx.exe
  C:\Windows\System\pjadwjx.exe
  2⤵
  PID:8952
- C:\Windows\System\tFZfkqE.exe
  C:\Windows\System\tFZfkqE.exe
  2⤵
  PID:8968
- C:\Windows\System\LyDfoqv.exe
  C:\Windows\System\LyDfoqv.exe
  2⤵
  PID:8984
- C:\Windows\System\ndnFkSb.exe
  C:\Windows\System\ndnFkSb.exe
  2⤵
  PID:9000
- C:\Windows\System\NbUVkRp.exe
  C:\Windows\System\NbUVkRp.exe
  2⤵
  PID:9016
- C:\Windows\System\qQiLuji.exe
  C:\Windows\System\qQiLuji.exe
  2⤵
  PID:9032
- C:\Windows\System\WlvkHlT.exe
  C:\Windows\System\WlvkHlT.exe
  2⤵
  PID:9048
- C:\Windows\System\zFSwrgw.exe
  C:\Windows\System\zFSwrgw.exe
  2⤵
  PID:9064
- C:\Windows\System\gTcgfDL.exe
  C:\Windows\System\gTcgfDL.exe
  2⤵
  PID:9080
- C:\Windows\System\STzboFd.exe
  C:\Windows\System\STzboFd.exe
  2⤵
  PID:9096
- C:\Windows\System\bYabPMZ.exe
  C:\Windows\System\bYabPMZ.exe
  2⤵
  PID:9112
- C:\Windows\System\OknCUiZ.exe
  C:\Windows\System\OknCUiZ.exe
  2⤵
  PID:9132
- C:\Windows\System\YAmKtVY.exe
  C:\Windows\System\YAmKtVY.exe
  2⤵
  PID:9148
- C:\Windows\System\VeIwgGh.exe
  C:\Windows\System\VeIwgGh.exe
  2⤵
  PID:9168
- C:\Windows\System\azdjkCN.exe
  C:\Windows\System\azdjkCN.exe
  2⤵
  PID:9184
- C:\Windows\System\QddwIqv.exe
  C:\Windows\System\QddwIqv.exe
  2⤵
  PID:9200
- C:\Windows\System\eiJOjIr.exe
  C:\Windows\System\eiJOjIr.exe
  2⤵
  PID:7512
- C:\Windows\System\NShIztc.exe
  C:\Windows\System\NShIztc.exe
  2⤵
  PID:8204
- C:\Windows\System\asJiRRr.exe
  C:\Windows\System\asJiRRr.exe
  2⤵
  PID:7044
- C:\Windows\System\kiVJgPM.exe
  C:\Windows\System\kiVJgPM.exe
  2⤵
  PID:8268
- C:\Windows\System\PGAoyTv.exe
  C:\Windows\System\PGAoyTv.exe
  2⤵
  PID:8280
- C:\Windows\System\xfXBMBs.exe
  C:\Windows\System\xfXBMBs.exe
  2⤵
  PID:8300
- C:\Windows\System\TdgwvFg.exe
  C:\Windows\System\TdgwvFg.exe
  2⤵
  PID:8352
- C:\Windows\System\mCwSuwY.exe
  C:\Windows\System\mCwSuwY.exe
  2⤵
  PID:8400
- C:\Windows\System\rTqDxCq.exe
  C:\Windows\System\rTqDxCq.exe
  2⤵
  PID:8464
- C:\Windows\System\SOwSFRY.exe
  C:\Windows\System\SOwSFRY.exe
  2⤵
  PID:8528
- C:\Windows\System\oDAlWLU.exe
  C:\Windows\System\oDAlWLU.exe
  2⤵
  PID:8592
- C:\Windows\System\rflEbMR.exe
  C:\Windows\System\rflEbMR.exe
  2⤵
  PID:8416
- C:\Windows\System\dVOzlAw.exe
  C:\Windows\System\dVOzlAw.exe
  2⤵
  PID:8656
- C:\Windows\System\klbifhT.exe
  C:\Windows\System\klbifhT.exe
  2⤵
  PID:8480
- C:\Windows\System\NyhISKa.exe
  C:\Windows\System\NyhISKa.exe
  2⤵
  PID:8576
- C:\Windows\System\rrEBPmz.exe
  C:\Windows\System\rrEBPmz.exe
  2⤵
  PID:8476
- C:\Windows\System\bKfnDDF.exe
  C:\Windows\System\bKfnDDF.exe
  2⤵
  PID:8608
- C:\Windows\System\rouuSfU.exe
  C:\Windows\System\rouuSfU.exe
  2⤵
  PID:8704
- C:\Windows\System\BUwwdJi.exe
  C:\Windows\System\BUwwdJi.exe
  2⤵
  PID:8748
- C:\Windows\System\JCffJEB.exe
  C:\Windows\System\JCffJEB.exe
  2⤵
  PID:8764
- C:\Windows\System\ZiVWyXr.exe
  C:\Windows\System\ZiVWyXr.exe
  2⤵
  PID:8828
- C:\Windows\System\TNxyIOJ.exe
  C:\Windows\System\TNxyIOJ.exe
  2⤵
  PID:8876
- C:\Windows\System\fwJktPC.exe
  C:\Windows\System\fwJktPC.exe
  2⤵
  PID:8944
- C:\Windows\System\BfSBuWa.exe
  C:\Windows\System\BfSBuWa.exe
  2⤵
  PID:9008
- C:\Windows\System\duwPLNl.exe
  C:\Windows\System\duwPLNl.exe
  2⤵
  PID:8896
- C:\Windows\System\lwKmHMH.exe
  C:\Windows\System\lwKmHMH.exe
  2⤵
  PID:8932
- C:\Windows\System\xALhZQl.exe
  C:\Windows\System\xALhZQl.exe
  2⤵
  PID:9060
- C:\Windows\System\nVrTZCT.exe
  C:\Windows\System\nVrTZCT.exe
  2⤵
  PID:8960
- C:\Windows\System\QIWHHbd.exe
  C:\Windows\System\QIWHHbd.exe
  2⤵
  PID:9104
- C:\Windows\System\Oyhjoli.exe
  C:\Windows\System\Oyhjoli.exe
  2⤵
  PID:7004
- C:\Windows\System\bygYMey.exe
  C:\Windows\System\bygYMey.exe
  2⤵
  PID:8812
- C:\Windows\System\GehGIly.exe
  C:\Windows\System\GehGIly.exe
  2⤵
  PID:9120
- C:\Windows\System\kBYCqLL.exe
  C:\Windows\System\kBYCqLL.exe
  2⤵
  PID:8288
- C:\Windows\System\kUHzGsX.exe
  C:\Windows\System\kUHzGsX.exe
  2⤵
  PID:9212
- C:\Windows\System\NLZBFsT.exe
  C:\Windows\System\NLZBFsT.exe
  2⤵
  PID:8200
- C:\Windows\System\codgbax.exe
  C:\Windows\System\codgbax.exe
  2⤵
  PID:8144
- C:\Windows\System\ESNCswL.exe
  C:\Windows\System\ESNCswL.exe
  2⤵
  PID:8368
- C:\Windows\System\JpOFZwN.exe
  C:\Windows\System\JpOFZwN.exe
  2⤵
  PID:8560
- C:\Windows\System\aQWbaxw.exe
  C:\Windows\System\aQWbaxw.exe
  2⤵
  PID:8640
- C:\Windows\System\nKjOtTo.exe
  C:\Windows\System\nKjOtTo.exe
  2⤵
  PID:8720
- C:\Windows\System\wpUIqxI.exe
  C:\Windows\System\wpUIqxI.exe
  2⤵
  PID:8908
- C:\Windows\System\BtIkkgB.exe
  C:\Windows\System\BtIkkgB.exe
  2⤵
  PID:9024
- C:\Windows\System\cNGqLFF.exe
  C:\Windows\System\cNGqLFF.exe
  2⤵
  PID:9176
- C:\Windows\System\hecmqSp.exe
  C:\Windows\System\hecmqSp.exe
  2⤵
  PID:8800
- C:\Windows\System\XBFCSlW.exe
  C:\Windows\System\XBFCSlW.exe
  2⤵
  PID:8716
- C:\Windows\System\ecjOzJN.exe
  C:\Windows\System\ecjOzJN.exe
  2⤵
  PID:8848
- C:\Windows\System\hQsylIu.exe
  C:\Windows\System\hQsylIu.exe
  2⤵
  PID:9164
- C:\Windows\System\yoMJQdq.exe
  C:\Windows\System\yoMJQdq.exe
  2⤵
  PID:8688
- C:\Windows\System\WhdPPBm.exe
  C:\Windows\System\WhdPPBm.exe
  2⤵
  PID:8320
- C:\Windows\System\baRPSVm.exe
  C:\Windows\System\baRPSVm.exe
  2⤵
  PID:8780
- C:\Windows\System\ynZfOTu.exe
  C:\Windows\System\ynZfOTu.exe
  2⤵
  PID:9076
- C:\Windows\System\fYhJZKr.exe
  C:\Windows\System\fYhJZKr.exe
  2⤵
  PID:8332
- C:\Windows\System\PPHvVxF.exe
  C:\Windows\System\PPHvVxF.exe
  2⤵
  PID:9232
- C:\Windows\System\qKtEBqR.exe
  C:\Windows\System\qKtEBqR.exe
  2⤵
  PID:9248
- C:\Windows\System\WVqApNO.exe
  C:\Windows\System\WVqApNO.exe
  2⤵
  PID:9268
- C:\Windows\System\ZBnXAxb.exe
  C:\Windows\System\ZBnXAxb.exe
  2⤵
  PID:9284
- C:\Windows\System\HvxdBuN.exe
  C:\Windows\System\HvxdBuN.exe
  2⤵
  PID:9300
- C:\Windows\System\CRHDkdk.exe
  C:\Windows\System\CRHDkdk.exe
  2⤵
  PID:9316
- C:\Windows\System\mMmEWqd.exe
  C:\Windows\System\mMmEWqd.exe
  2⤵
  PID:9332
- C:\Windows\System\TBZGGNP.exe
  C:\Windows\System\TBZGGNP.exe
  2⤵
  PID:9348
- C:\Windows\System\OOchfKp.exe
  C:\Windows\System\OOchfKp.exe
  2⤵
  PID:9364
- C:\Windows\System\pAsJqvF.exe
  C:\Windows\System\pAsJqvF.exe
  2⤵
  PID:9380
- C:\Windows\System\SqjolAV.exe
  C:\Windows\System\SqjolAV.exe
  2⤵
  PID:9396
- C:\Windows\System\aHBIOQe.exe
  C:\Windows\System\aHBIOQe.exe
  2⤵
  PID:9412
- C:\Windows\System\lVKPVpi.exe
  C:\Windows\System\lVKPVpi.exe
  2⤵
  PID:9428
- C:\Windows\System\LmHtEuw.exe
  C:\Windows\System\LmHtEuw.exe
  2⤵
  PID:9444
- C:\Windows\System\zlBUvoJ.exe
  C:\Windows\System\zlBUvoJ.exe
  2⤵
  PID:9460
- C:\Windows\System\jZxIUTi.exe
  C:\Windows\System\jZxIUTi.exe
  2⤵
  PID:9476
- C:\Windows\System\XAdmaPt.exe
  C:\Windows\System\XAdmaPt.exe
  2⤵
  PID:9492
- C:\Windows\System\cezdZPO.exe
  C:\Windows\System\cezdZPO.exe
  2⤵
  PID:9508
- C:\Windows\System\RlMCmjM.exe
  C:\Windows\System\RlMCmjM.exe
  2⤵
  PID:9528
- C:\Windows\System\AzuJoVn.exe
  C:\Windows\System\AzuJoVn.exe
  2⤵
  PID:9544
- C:\Windows\System\JhGxLaq.exe
  C:\Windows\System\JhGxLaq.exe
  2⤵
  PID:9560
- C:\Windows\System\GYzhdfn.exe
  C:\Windows\System\GYzhdfn.exe
  2⤵
  PID:9576
- C:\Windows\System\VIRTcCu.exe
  C:\Windows\System\VIRTcCu.exe
  2⤵
  PID:9596
- C:\Windows\System\JjQGSJg.exe
  C:\Windows\System\JjQGSJg.exe
  2⤵
  PID:9612
- C:\Windows\System\qlqXvWX.exe
  C:\Windows\System\qlqXvWX.exe
  2⤵
  PID:9628
- C:\Windows\System\vhqfoPX.exe
  C:\Windows\System\vhqfoPX.exe
  2⤵
  PID:9644
- C:\Windows\System\BkSBYZq.exe
  C:\Windows\System\BkSBYZq.exe
  2⤵
  PID:9660
- C:\Windows\System\QFHXBrv.exe
  C:\Windows\System\QFHXBrv.exe
  2⤵
  PID:9676
- C:\Windows\System\WsUyeNx.exe
  C:\Windows\System\WsUyeNx.exe
  2⤵
  PID:9692
- C:\Windows\System\pmkrAXp.exe
  C:\Windows\System\pmkrAXp.exe
  2⤵
  PID:9708
- C:\Windows\System\LuEJQfx.exe
  C:\Windows\System\LuEJQfx.exe
  2⤵
  PID:9724
- C:\Windows\System\wkLsyVv.exe
  C:\Windows\System\wkLsyVv.exe
  2⤵
  PID:9740
- C:\Windows\System\BoRTiiI.exe
  C:\Windows\System\BoRTiiI.exe
  2⤵
  PID:9756
- C:\Windows\System\KPxTzmX.exe
  C:\Windows\System\KPxTzmX.exe
  2⤵
  PID:9772
- C:\Windows\System\wKHXgJJ.exe
  C:\Windows\System\wKHXgJJ.exe
  2⤵
  PID:9788
- C:\Windows\System\akOlkEt.exe
  C:\Windows\System\akOlkEt.exe
  2⤵
  PID:9804
- C:\Windows\System\UwczCef.exe
  C:\Windows\System\UwczCef.exe
  2⤵
  PID:9820
- C:\Windows\System\vBuKNrA.exe
  C:\Windows\System\vBuKNrA.exe
  2⤵
  PID:9836
- C:\Windows\System\emTlzWz.exe
  C:\Windows\System\emTlzWz.exe
  2⤵
  PID:9852
- C:\Windows\System\ZnhlFbp.exe
  C:\Windows\System\ZnhlFbp.exe
  2⤵
  PID:9868
- C:\Windows\System\qmijGhJ.exe
  C:\Windows\System\qmijGhJ.exe
  2⤵
  PID:9884
- C:\Windows\System\alJGLVv.exe
  C:\Windows\System\alJGLVv.exe
  2⤵
  PID:9900
- C:\Windows\System\NJuJIRg.exe
  C:\Windows\System\NJuJIRg.exe
  2⤵
  PID:9916
- C:\Windows\System\WqxtBbT.exe
  C:\Windows\System\WqxtBbT.exe
  2⤵
  PID:9932
- C:\Windows\System\JvWcogp.exe
  C:\Windows\System\JvWcogp.exe
  2⤵
  PID:9948
- C:\Windows\System\hNXekWW.exe
  C:\Windows\System\hNXekWW.exe
  2⤵
  PID:9964
- C:\Windows\System\SIPnkIV.exe
  C:\Windows\System\SIPnkIV.exe
  2⤵
  PID:9980
- C:\Windows\System\mGXjnrd.exe
  C:\Windows\System\mGXjnrd.exe
  2⤵
  PID:9996
- C:\Windows\System\xiWTHYu.exe
  C:\Windows\System\xiWTHYu.exe
  2⤵
  PID:10012
- C:\Windows\System\ScDdyba.exe
  C:\Windows\System\ScDdyba.exe
  2⤵
  PID:10028
- C:\Windows\System\Mtlrnqo.exe
  C:\Windows\System\Mtlrnqo.exe
  2⤵
  PID:10044
- C:\Windows\System\pcnGkFT.exe
  C:\Windows\System\pcnGkFT.exe
  2⤵
  PID:10060
- C:\Windows\System\XFXHNHx.exe
  C:\Windows\System\XFXHNHx.exe
  2⤵
  PID:10076
- C:\Windows\System\UxjyYCN.exe
  C:\Windows\System\UxjyYCN.exe
  2⤵
  PID:10092
- C:\Windows\System\XxonvTs.exe
  C:\Windows\System\XxonvTs.exe
  2⤵
  PID:10108
- C:\Windows\System\xYXyTRA.exe
  C:\Windows\System\xYXyTRA.exe
  2⤵
  PID:10124
- C:\Windows\System\UWnnJNM.exe
  C:\Windows\System\UWnnJNM.exe
  2⤵
  PID:10140
- C:\Windows\System\dZWZvOt.exe
  C:\Windows\System\dZWZvOt.exe
  2⤵
  PID:10156
- C:\Windows\System\TefQKkw.exe
  C:\Windows\System\TefQKkw.exe
  2⤵
  PID:10172
- C:\Windows\System\KxHSVuq.exe
  C:\Windows\System\KxHSVuq.exe
  2⤵
  PID:10188
- C:\Windows\System\sfnOHXZ.exe
  C:\Windows\System\sfnOHXZ.exe
  2⤵
  PID:10204
- C:\Windows\System\loBltLe.exe
  C:\Windows\System\loBltLe.exe
  2⤵
  PID:10220
- C:\Windows\System\UineSvg.exe
  C:\Windows\System\UineSvg.exe
  2⤵
  PID:10236
- C:\Windows\System\FBbuykL.exe
  C:\Windows\System\FBbuykL.exe
  2⤵
  PID:8992
- C:\Windows\System\crUmgDD.exe
  C:\Windows\System\crUmgDD.exe
  2⤵
  PID:8624
- C:\Windows\System\kEVlzfC.exe
  C:\Windows\System\kEVlzfC.exe
  2⤵
  PID:8216
- C:\Windows\System\oQnAiWC.exe
  C:\Windows\System\oQnAiWC.exe
  2⤵
  PID:8432
- C:\Windows\System\lOJEOhs.exe
  C:\Windows\System\lOJEOhs.exe
  2⤵
  PID:9228
- C:\Windows\System\rfdzOuD.exe
  C:\Windows\System\rfdzOuD.exe
  2⤵
  PID:8460
- C:\Windows\System\CQzKqfm.exe
  C:\Windows\System\CQzKqfm.exe
  2⤵
  PID:9044
- C:\Windows\System\REPLfHb.exe
  C:\Windows\System\REPLfHb.exe
  2⤵
  PID:9160
- C:\Windows\System\pKamLEy.exe
  C:\Windows\System\pKamLEy.exe
  2⤵
  PID:9296
- C:\Windows\System\UputbNU.exe
  C:\Windows\System\UputbNU.exe
  2⤵
  PID:9312
- C:\Windows\System\GgQeQej.exe
  C:\Windows\System\GgQeQej.exe
  2⤵
  PID:9344
- C:\Windows\System\SsnUNcZ.exe
  C:\Windows\System\SsnUNcZ.exe
  2⤵
  PID:9408
- C:\Windows\System\rKtGBBg.exe
  C:\Windows\System\rKtGBBg.exe
  2⤵
  PID:9392
- C:\Windows\System\KntAvPL.exe
  C:\Windows\System\KntAvPL.exe
  2⤵
  PID:9456
- C:\Windows\System\TPyhDxr.exe
  C:\Windows\System\TPyhDxr.exe
  2⤵
  PID:9520
- C:\Windows\System\AjBnOaO.exe
  C:\Windows\System\AjBnOaO.exe
  2⤵
  PID:9584
- C:\Windows\System\jXkAAod.exe
  C:\Windows\System\jXkAAod.exe
  2⤵
  PID:9620
- C:\Windows\System\OPmqDbd.exe
  C:\Windows\System\OPmqDbd.exe
  2⤵
  PID:9568
- C:\Windows\System\QoZtrLI.exe
  C:\Windows\System\QoZtrLI.exe
  2⤵
  PID:9472
- C:\Windows\System\AMmtxup.exe
  C:\Windows\System\AMmtxup.exe
  2⤵
  PID:9536
- C:\Windows\System\SyAdAhl.exe
  C:\Windows\System\SyAdAhl.exe
  2⤵
  PID:9668
- C:\Windows\System\FXUDsqg.exe
  C:\Windows\System\FXUDsqg.exe
  2⤵
  PID:9672
- C:\Windows\System\CkbWrIA.exe
  C:\Windows\System\CkbWrIA.exe
  2⤵
  PID:9748
- C:\Windows\System\dLOOwAa.exe
  C:\Windows\System\dLOOwAa.exe
  2⤵
  PID:9812
- C:\Windows\System\VPekxbo.exe
  C:\Windows\System\VPekxbo.exe
  2⤵
  PID:9876
- C:\Windows\System\LXHBfgt.exe
  C:\Windows\System\LXHBfgt.exe
  2⤵
  PID:9940
- C:\Windows\System\ovowGiP.exe
  C:\Windows\System\ovowGiP.exe
  2⤵
  PID:9832
- C:\Windows\System\SpuLpqW.exe
  C:\Windows\System\SpuLpqW.exe
  2⤵
  PID:9736
- C:\Windows\System\OEuAtnI.exe
  C:\Windows\System\OEuAtnI.exe
  2⤵
  PID:9976
- C:\Windows\System\odbAJYO.exe
  C:\Windows\System\odbAJYO.exe
  2⤵
  PID:9864
- C:\Windows\System\TMTDUDQ.exe
  C:\Windows\System\TMTDUDQ.exe
  2⤵
  PID:10008
- C:\Windows\System\kOkMJBv.exe
  C:\Windows\System\kOkMJBv.exe
  2⤵
  PID:10036
- C:\Windows\System\VFJYePe.exe
  C:\Windows\System\VFJYePe.exe
  2⤵
  PID:10100
- C:\Windows\System\MUCKgIE.exe
  C:\Windows\System\MUCKgIE.exe
  2⤵
  PID:10164
- C:\Windows\System\DEDgBCW.exe
  C:\Windows\System\DEDgBCW.exe
  2⤵
  PID:10228

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Dlortsb.exe

Filesize
2.3MB

MD5
d9675851f4dae9bebbb419e5711ab56d

SHA1
0c9e12ba425894d9ee6f511e6cf53fa097b54b0a

SHA256
e53d5ce660673058ceeb9e52b3a5f3033c940df54868323c652ae697d07045dd

SHA512
675cc5794e3bbb43d0f90aeea603255351945b556d8dd2234d4443a99b2c9b7359a9fcc3a704cd00d12c2111602fca13cef23f81e476232022e471df6dca0322

Download Submit
C:\Windows\system\EZAzuQl.exe

Filesize
2.3MB

MD5
0e8570422fdd2ed4535f34b8ed17cbbb

SHA1
685a7ba2648d5378c73716c85e332083e99f538a

SHA256
d452e16ca2f5cfaf7339164c3f68d47902169106cdcee7c4c67791f29ecc51d3

SHA512
ae1e48122184a6505098489fb2565ddf00b97403334fb316ff86efa8a48fc4c3ca7fb4b934d9215c09a72a2de9627450e5f050c6ed81d6b134f8c320bd0e04d2

Download Submit
C:\Windows\system\EueXRhf.exe

Filesize
2.3MB

MD5
92cdbaa0a13c1e5917b85ddd153bbc94

SHA1
c3ac560291511c0af00d12ef2d767740c578bf9a

SHA256
69e9a370f055d3d4f85ff6081a0cdcd3b8f77e28e91adcc91f331b600798f8a5

SHA512
dc38e1f6ce1abf280af4c8bfcdbf9d82a030da9c7fd4ed0bf3c757e3fd1da72996878744297df961a5a4ec020a124ea8cb9b4b0d6cfab68328a90e2bca6b0c95

Download Submit
C:\Windows\system\FVTgqWN.exe

Filesize
2.3MB

MD5
7f2a562fbb1fbd3f1d58b76252a8f254

SHA1
a393de35be33aab3d8ea3ab2b8deff092ef6d3c0

SHA256
05bb3d57923e13aeb50f4b285791597f9cc575a8da76b6b2dbea7f79dc9bb616

SHA512
36797ab3136f819392df7eb234ce47cf28088b9ef593d7d888273e4518a104f019462643429b0b5fabf8df59878aa576ed57a68e70c9a53b36584080a20d3bef

Download Submit
C:\Windows\system\HRypAbB.exe

Filesize
2.3MB

MD5
55bfe071b76440fd658216dbc559b4a5

SHA1
63c7021212a66c807003550e3a1559fa173f32eb

SHA256
4159de86751989c1075eed7c35fb6d15fc09b94340f3a3101d282d9ff296b934

SHA512
93c392a66884c24c536998400d3c05dbad2bc8a810dafeecd84b50044d37d469225280082d90e1e9d23811f9f3f4eba484a258cdc363e0173ad879415d8fe194

Download Submit
C:\Windows\system\JmhzoCw.exe

Filesize
2.3MB

MD5
283e312f7b1fc236d966d8996f99680f

SHA1
08ba35a9126f08e1b4b757ac8fa8cb60e854d8ed

SHA256
41517dce598243fc77543fb14e4ec7a9605624f0cc4af1c267e287aa7b5328cc

SHA512
eb68ef3d058ef5c8b51ba8de1303df742439b48900cdb5a40d480c1dca08611fa7ff6552bf7f93166be54f7fef943e95144c4173e61fccf2834888a22cf9b5f0

Download Submit
C:\Windows\system\Lankwxj.exe

Filesize
2.3MB

MD5
8471cf3ad933ff8cc6d673543a89c495

SHA1
756905562e30be1bcab674ef10530726a24aefd7

SHA256
cbe604243e6041eb72ef1f50c27ba20b65b715e964c425df9d34070a5fc3a7d2

SHA512
5c1ba76ddf95cc9e9e7829b360138710c3c4dce731bd61eb187b16a8d2fd861cd9b3cdd8688f4d7ccb9e27f4ee584361a9022bf202b15e8391830891691ff7c7

Download Submit
C:\Windows\system\LlcgNwN.exe

Filesize
2.3MB

MD5
7b6ab55f5279369be0fbcef203bf0c16

SHA1
ef6799a41c50cac80bdde3e54ffc7ab70f3ae664

SHA256
11f3f9ce98aadbc0b0fc718a3506f3310c6086b2b2ea3ee333f1e66a3ed23d17

SHA512
7e71a52df4a6580d20a152261e9eec0fc06d97700c3057007d572899134fb10a2d2f3f12c230c561fa66bebf5d6641962484189a5613c575a635abbfe5930bbe

Download Submit
C:\Windows\system\OLSqOAY.exe

Filesize
2.3MB

MD5
4ff205bbe7735f932001ee1ac21d87ac

SHA1
07a8b659df8bffdd1bd42b426a10bc6e4304c7d4

SHA256
c3048e5808c5fc724f51f6a776c1bb309d8258da3240438c9634e1debcada19d

SHA512
c32be8d39bd97bd50eb89b5e497250c334dbadc3c965af82cd9beae3b7903307798ef17a3230a43309d3b7eaa0dcaab28cb9c6ed55a9a43a71a19767ef133ecc

Download Submit
C:\Windows\system\OYPjYEc.exe

Filesize
18B

MD5
b0ce6cfd7adfa2a2ac8258485a5cb279

SHA1
7b40a580431de17fbac688fb86de9bd5a156cd21

SHA256
bd650a2baf71609d723ebd75e0c6c938067406e57d5e80cec86bd9162ab5b10c

SHA512
107fc307e13b0ac2fdfd2a988662ef1274a95d78ff717c971632ef49ca9c9ef1a3e2bfaf20cde619c9ddc0ce2412de1ca0af65582b8a143eef4fd273e3c869f6

Download Submit
C:\Windows\system\PXkdstG.exe

Filesize
2.3MB

MD5
c18724e49b9b43cf0a11ff2026f43d70

SHA1
5e29f280b884464f7e62b6a6fbfc81a0db49275b

SHA256
76d5c9889d7f13ac991119561c64ff65cbbe8b1b21281a5de6907002fdf6edf7

SHA512
309130ba9662d125026ef4574fc8234e2c11b16854fa2bf837fd5cbaa522a8a119db617aca2e00a64c5f6a6311cb33192f626551b8a584e2fe9141cb3aa3c02c

Download Submit
C:\Windows\system\TiXVYdC.exe

Filesize
2.3MB

MD5
195aa9867a07e45033b80849aa4f665a

SHA1
246d54ed091770eea130bbcbcabdd9730058b364

SHA256
d27fce6af7495cfae8aaed8ff529e91eb1d40d024948e3c8ecc081af370cea5a

SHA512
a70d752a8419ccb47942fcef4644b1e5ecd37678cd26d61fe1e1096844e161e703805050120e7aad7c6bd488f0a705074a56b6669dace30704e766e8bb5689d4

Download Submit
C:\Windows\system\UMPngxW.exe

Filesize
2.3MB

MD5
47a20c364b9aa24fdc3823ff88ccb73a

SHA1
a85ca8a72addd4ac16fd39bb8b87d5a6a88a3bfa

SHA256
813f9278e2fec50dce0448c12a7104be8f93451ddf1cff70e62e6c7630b34709

SHA512
e493d828ac54724ee2b89167e6d10a3970bf05c4d8aec558f1c0df1afdbba5ca960968b7439cabf7570feeae901caea6709fc627b31782034da114cc87c17ed3

Download Submit
C:\Windows\system\VhwofXK.exe

Filesize
2.3MB

MD5
d507f5d36dd68e6a3de310f5a7dcd6bf

SHA1
7985033353ed55627b6f23d6319c5eb5025328ce

SHA256
2cbfeeaf537ac11219e78eea9deeb3edbba9496fcefb6969a44413fc6826ea15

SHA512
f2d9a47af06cd426acd29601753bcf01c195adea404a7056c909135247fedf436ffd1f4654e04372257108cd66752d4b76be2cebca0e2111f12fc7e86cd4ed76

Download Submit
C:\Windows\system\XDUbzcf.exe

Filesize
2.3MB

MD5
36ebf15cdb3af5f492295359d8687ea4

SHA1
686a239f04858c02e6c0d9061913f03d4522a25b

SHA256
023a5a94b3b382cf794b7311803ba9ccf095023762c9e5a4ab97fbee2fab3acd

SHA512
7a4b200b037567c52cf00bfc69602f506eab93f3e7b952a616d4cce970a8bc5182fb4b147c2b11f917dd3d066e7ea94e388b247f18f3d5368044c35a735a6fa6

Download Submit
C:\Windows\system\bTaEKoL.exe

Filesize
2.3MB

MD5
5d00da37591c109c3d27b628adfcf3d4

SHA1
c9140ac282be025f34146521fbf1e9f6a82d99d1

SHA256
b128151ee2f60376036bfa036e3cd1d9684fe84f315b045cf937a6d4885e7092

SHA512
8bb6a4e189a9366e76edd31164f2026ae100954ae081fadbcef9ae33d37ac6859c3f9340b02dee75cd8d0c472709daaa78d71e9dc48dd0544f6bbbfbedb739b5

Download Submit
C:\Windows\system\cAfkhMW.exe

Filesize
2.3MB

MD5
d7a25559673a75ed516d506a262d64ca

SHA1
d22d923bdd63ac105eaa1bec9df030d38d61e3d4

SHA256
0590bb80af88da8f2b93e4e8b9ec5a579ca226f0e737a9dc79c92b73b625a218

SHA512
27ad65608221e876282a2a71ff6629d2bfabfd9cc16b87dac5505cb212fb19945adc704266dcb3bb259a2ba3746aeef8aa24ce3515f0c761b0229e8d84855393

Download Submit
C:\Windows\system\cikBbFb.exe

Filesize
2.3MB

MD5
4b200e991da1a10032710a07e1822a7e

SHA1
5e3891666c3f675d5f1d34d5d5f2ea9b37fed90b

SHA256
f8f5d758d7daca14f62bdc292ceb2433ac8e097275df71dbec197aa284d4647c

SHA512
8f2bb933cd97dc54920f6d1e8932b461c23e99b8a7592edbadee76d88e2bc2ae377a85bcd99c4dd6d1546dd2feb7df7422a7da8d21200a16c2ea059e1b12ac23

Download Submit
C:\Windows\system\hhZWEMZ.exe

Filesize
2.3MB

MD5
05c1141bdf9417db74c13786bd7cd4df

SHA1
99e43af24255b7bf7c9b9b08f742e21ab49846dc

SHA256
6088afeac5f8678cc56f9b48050645e2b5aa78c3148a4eb3c0d14f43e74eeaef

SHA512
3820cffe6bba0b1ed93a1de2bcad7969c6d3a903a59b614e687ddc66248f65aefe232e45476c70c5555ee67cb68bce332d66bb5feb3fae9404efa5249a63669e

Download Submit
C:\Windows\system\lIdMNCq.exe

Filesize
2.3MB

MD5
cd6cacca2282ed1416f44397dd583254

SHA1
93d02110b8024d6a653420c2bdfd7af8c21db837

SHA256
341ed754c3ee0ba7ea665d06f2fbd6886eaa6a2376d964a3c00ce64ec47019b5

SHA512
b5d6589809ee4424e97f46506557525948b17bcf42bd2e3723f68578bdb90f378bd6ad4fc93f13acd1fa4fa7d0bac0af36923ed3b76abb09ed43aea3965a8038

Download Submit
C:\Windows\system\pFNzzGp.exe

Filesize
2.3MB

MD5
f70b540a709cace206475aa43650e81c

SHA1
d0634fd1acbc64d8647e1171a50dabce4d79a1b0

SHA256
4359628e7fa8756580965a80f318aee7409e63622cc050516cd09e5a7d817a6f

SHA512
2bb0f0edf9834c749a4eb94f26ac243a538e323efe5acf0829d36355ec3eb90c9bdc2111a99d60b1e83d7f925e1df6fe5a5a1b07a8c5229c616198b518d3c266

Download Submit
C:\Windows\system\pjJBQgT.exe

Filesize
2.3MB

MD5
cf908c193090a1d4f53b7575bfa09566

SHA1
67e14cc1931b9da7e1113bd7f4c89fc102a034d7

SHA256
8eed225c284b0d36b6bca3899a4c2e800c5bbbf7198148920a2229a84c97e494

SHA512
c61074f53f1143690d173d468c5717714fbbfc0000d96703bf62b44da383f686043c204dc7c05633f93a4326d3a74cc3d3d148ec1b8ed84b58fdea55bdb1a310

Download Submit
C:\Windows\system\vVXzAMZ.exe

Filesize
2.3MB

MD5
68c25323112c464754ccad4f449d13c1

SHA1
f2d6f82683267afd6828fb2f3983f9c1e591dd22

SHA256
4d60744926f1ace350ffe80f32bd7599a036d4d8b06043358898378dcd757886

SHA512
d33b7e504134f9e93f4dd0e1efd9a80643821569ee7f5c215d0288c01b4062f8885b337697b7f27889dc7112a7a216ad94f75023be9f9a22bc3f9cc358406c2b

Download Submit
C:\Windows\system\yDbEDFw.exe

Filesize
2.3MB

MD5
c1cba61eeb64af28b5c8048eebc56eef

SHA1
b81b39467b4759f91360a7124e2998af99391e11

SHA256
c85ef9d305074ad9e0c563030ce93012aaa848ed4739ae6a257d5cd213515566

SHA512
17266096f57fe8813397c0a38e4696f50c8963aedfd8c0c8d16d2fe60459d09a80c01f603749ced166a13e46521d3ca392a9291a1ef881629e3a4fda9f67e601

Download Submit
C:\Windows\system\yatBeMU.exe

Filesize
2.3MB

MD5
2772968ded9ab08ef930b9dcd5ed054f

SHA1
eecabf4dd4bc3421b3ce1c0eb26c06023e6aec01

SHA256
fd794b876de85e3b9d005610cdd3c5961d2e4b0cccd3cd5e7bd461cb950750f5

SHA512
96c7fb5fb2d7a019bffd40cb6482d8eafa07de751509ef2c140c0c5d3fde9be76bcc31fd3e27afcb2f9c1979ba360f9668e4bb7b1408db33e69390d638fa1a65

Download Submit
C:\Windows\system\yziuJyd.exe

Filesize
2.3MB

MD5
040b270aec1b660cb24b42c22bc22769

SHA1
48e3345c6b90885bde14ba53dd5dce345b7f0ba7

SHA256
96471c3d887753b3a185ccc6e46cde01f86fffdd69a9fd9de96e910d2c8be7bc

SHA512
3fe7007c3389f86aac583b012f01c2dc4d46245eda7bed30153bf6ab0e54b82e32a70fccd3bf6918717ddd5e66c917160e45837130240cfd2ebcae2d4a19f8e0

Download Submit
C:\Windows\system\zsZaZos.exe

Filesize
2.3MB

MD5
b685a7821128790c15c204b034178fd8

SHA1
62c85336169eb73b355368745a38271caf55d81d

SHA256
b6a0aee16aefbef8cbd3c09934cf995d80a78a2ffaa5e805f76c495f589c46c5

SHA512
9cd76df50a1351338138de25d32b5be9c2a8fa37a7ae9dd082fb6ce71b2d9ca3e1673986c131ec09d32f1b3367b97251a13fd61d85b40204a9e9e1527e59af1f

Download Submit
\Windows\system\FvkwBDt.exe

Filesize
2.3MB

MD5
332a4238e9b94947f4394787f1b1b219

SHA1
97f0ea7bdfbfae5e22d58957bfd4005d4d600e29

SHA256
94dd0cbbcee51ccf9574883bb0a010e8c88aad15271a331cb2bcd99890d9818b

SHA512
8d814810402d40b39ab4d2b5b41deb7a65b2ee0c84ee2a8c56cd0e592934217b0a10f2b361d948c9e715249a65e9b6624e494bc43bdaa6aabac06cb33f50e6f4

Download Submit
\Windows\system\OZsCTTA.exe

Filesize
2.3MB

MD5
740499600200dc978db7d8712db7b2a6

SHA1
36607141ebab39a259fe05cfc1054e3e9bfad9c3

SHA256
2cafe902c77684a96e75945f74be38f7d132584b2768bc05112b190a4f688bbd

SHA512
27da0b3b6c3b474a9dfc9b97093385bc9bdfb86c3b51ca9c1bf1b2dc06b4a07248ac8a6d4a76f971e2659eea31dd020c2719cf2ae0d8f8d3d6af1005b630956e

Download Submit
\Windows\system\VLFShfz.exe

Filesize
2.3MB

MD5
a03f2d71c7e856f2d54993602dab565e

SHA1
14c5b0452e09c3cbf5f7d868d7399efd6e484bcb

SHA256
28fff59ae49784923e3ff3c572f104f5674c82a48ad957dfe8f2d1c9019a651f

SHA512
c36c36feaf44933ff7f04e7403f5ebfb50633b0be26a2a1f159c06c8b5c97a407e87be5a37cf6966e65518b638d28701fcba22de25122419a0c0439335e3777b

Download Submit
\Windows\system\nCIoisq.exe

Filesize
2.3MB

MD5
f3f6fb5c441315c6164e5ec1a11dcec7

SHA1
e1d90d54ab168deaab4997354fe6133218d36aec

SHA256
6bda19db558673934ab83a1531d88636f7f5efb44012920487e529603e5ae17f

SHA512
57d22c301ad786b2dfd967df952131886dcc2049c491b4658d18c8ea61fbf3891479cab9a97c4a2a7d8f322a17b904a6be94efac246334331ef64a4e225d0415

Download Submit
\Windows\system\nhRMRRU.exe

Filesize
2.3MB

MD5
83c7766aafa5f3ccbb1340c2cdce9f51

SHA1
3c438b72b29296e16f8efd77046f0cc2f6310e58

SHA256
c1c504bd6de703b37ca6d8b6cfada231e892dc42ff7b63868b8fae684a55441a

SHA512
ab77c810bad4024861cbdb7ea9376be21a57d13feccceda1ab9da75808c8b3cb1b56067f77e00d29c9682afa3253fe5c2a0cafc86e907daf8895ec77d54bab48

Download Submit
\Windows\system\zqwWtJZ.exe

Filesize
2.3MB

MD5
020a7d1d65d7ae71e97889fa50ecfedb

SHA1
198ff535a0b33d8c2c9212e5addb0fd8e7f0cd0b

SHA256
c91601a4494b227faded85aba18f3b8f4900e3feaf4c7529ab6cbf8a2e3ecc42

SHA512
9fdac3f0cc4314b9eec449f39c5d2d058cc523fcc9e4a9c8a37a10a1eaa1d6862d5a3642bf0d1554cf6386978a6b072f2b53fbf57ca9a24cd3ce9fc8e3c33736

Download Submit
memory/1528-83-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/1936-218-0x0000000001D10000-0x0000000001D18000-memory.dmp

Filesize
32KB

Download
memory/1936-215-0x000000001B5E0000-0x000000001B8C2000-memory.dmp

Filesize
2.9MB

Download
memory/2452-77-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2524-78-0x000000013FDD0000-0x00000001401C2000-memory.dmp

Filesize
3.9MB

Download
memory/2604-84-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2612-69-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2640-76-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2668-81-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2756-103-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2812-85-0x000000013FC40000-0x0000000140032000-memory.dmp

Filesize
3.9MB

Download
memory/2816-68-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-71-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-73-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2932-74-0x0000000003020000-0x0000000003412000-memory.dmp

Filesize
3.9MB

Download
memory/2932-33-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2932-66-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2932-72-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2932-82-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2932-53-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-1-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2932-6-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2932-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2932-80-0x0000000002DA0000-0x0000000003192000-memory.dmp

Filesize
3.9MB

Download
memory/2968-79-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download