xmrig | 9dc8d35c6fd562a912357acc38e5a55a306606ca690b7e5f2ea309165b5312aa

Analysis

max time kernel
26s
max time network
20s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 00:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
Size

1.7MB
MD5

0ac435a3af8d413325ac48e93c6a306b
SHA1

44040c2cc5e32c0b59c337a7b52507b5b688d216
SHA256

9dc8d35c6fd562a912357acc38e5a55a306606ca690b7e5f2ea309165b5312aa
SHA512

d4ee238d66c589995263858eb09ae3bed8183353be1d87f474ebf2c8e4b690e1b8b9f03d1a67a5f75ba3ad117dd80c723a49f52e5853d80ad1c07ab6af7fea34
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKP4:NABj

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2528-32-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2148-28-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	xmrig
behavioral1/memory/2624-69-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2444-91-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/1948-89-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig
behavioral1/memory/2404-88-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2564-80-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2148	GerKiPX.exe
2528	AkBthQs.exe
2624	gAZXlVo.exe
2404	lHpeOIf.exe
1948	tFcyGOP.exe
2564	QNRXIFs.exe
2444	XvtAFWs.exe
2400	FSwrfLC.exe
2520	AILDyZA.exe
2896	XsaUPnq.exe
2888	zOgAMym.exe
1564	YbuSnsZ.exe
2752	XEVcMel.exe
1732	KzQGHVE.exe
1344	LLAjuTO.exe
2372	igLVQZd.exe
2188	oJfkgpZ.exe
2880	FBBEVhm.exe
1984	OEktBCM.exe
1896	VqwovNM.exe
1832	XyvqHLO.exe
324	QfQtIOH.exe
1404	qxVHFSs.exe
1704	QSTQeSJ.exe
1848	pMVMOCr.exe
2116	bKdkVXT.exe
412	WpzIUxz.exe
2144	XlwGhwb.exe
1688	WwPqfsR.exe
1660	sbuUmAQ.exe
1656	rEpVhTo.exe
2824	KMLSWyZ.exe
608	nkDxLoH.exe
2160	rueZDJM.exe
2156	LMGcZIm.exe
2832	TAhsCOy.exe
572	pzCRlZU.exe
876	ueSQnqg.exe
1976	gznLUps.exe
2976	MfbWGLf.exe
1620	ECDsVWk.exe
2504	pbBjSpJ.exe
2600	XhJJshJ.exe
2472	WMXXsrx.exe
360	AbUEMKa.exe
2712	RHBYgQw.exe
356	XDwJBtb.exe
1256	VGDwYqr.exe
2220	TDrvWLL.exe
1560	JzYbLHE.exe
1880	mYVgfAP.exe
2132	qhLWDMe.exe
1248	Uhnrpnk.exe
2016	TTRYfvW.exe
3064	vUpqNqd.exe
2992	oYqhaeI.exe
2228	RFcAHPF.exe
2052	mNcxhja.exe
768	bIosoyu.exe
1392	OKPZcXF.exe
564	DanzFfh.exe
1140	SNlYGIN.exe
2200	KFoqOJd.exe
2272	FsbkqHV.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x000c000000012707-3.dat	upx
behavioral1/files/0x002f000000014c2d-8.dat	upx
behavioral1/files/0x00080000000153ee-26.dat	upx
behavioral1/files/0x0016000000005586-31.dat	upx
behavioral1/memory/2528-32-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x0007000000015662-33.dat	upx
behavioral1/memory/2148-28-0x000000013F1D0000-0x000000013F5C2000-memory.dmp	upx
behavioral1/files/0x0008000000015ae3-35.dat	upx
behavioral1/files/0x000a000000015b50-42.dat	upx
behavioral1/files/0x0009000000015c9a-46.dat	upx
behavioral1/files/0x0006000000015f23-56.dat	upx
behavioral1/memory/2624-69-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/files/0x00060000000163eb-108.dat	upx
behavioral1/files/0x0006000000016575-115.dat	upx
behavioral1/files/0x0006000000016a28-122.dat	upx
behavioral1/files/0x0006000000016c30-129.dat	upx
behavioral1/files/0x0006000000016ce0-143.dat	upx
behavioral1/files/0x0006000000016cf3-150.dat	upx
behavioral1/files/0x0006000000016d85-180.dat	upx
behavioral1/files/0x0006000000016d31-173.dat	upx
behavioral1/files/0x0006000000016d21-166.dat	upx
behavioral1/files/0x0006000000016d10-159.dat	upx
behavioral1/files/0x0006000000016cfd-152.dat	upx
behavioral1/files/0x0006000000016ced-145.dat	upx
behavioral1/files/0x0006000000016cb5-138.dat	upx
behavioral1/files/0x0006000000016c38-131.dat	upx
behavioral1/files/0x0006000000016c1f-124.dat	upx
behavioral1/files/0x00060000000164ec-110.dat	upx
behavioral1/files/0x00060000000161ee-103.dat	upx
behavioral1/files/0x002f000000014f57-96.dat	upx
behavioral1/memory/2444-91-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/1948-89-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx
behavioral1/memory/2404-88-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2564-80-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x0006000000015fa6-79.dat	upx
behavioral1/files/0x00060000000167bf-117.dat	upx
behavioral1/files/0x0006000000016da9-183.dat	upx
behavioral1/files/0x0006000000016d81-178.dat	upx
behavioral1/files/0x0006000000016d29-171.dat	upx
behavioral1/files/0x0006000000016d18-164.dat	upx
behavioral1/files/0x0006000000016d06-157.dat	upx
behavioral1/files/0x0006000000016c84-136.dat	upx
behavioral1/files/0x0006000000016122-101.dat	upx
behavioral1/files/0x0006000000016013-95.dat	upx
behavioral1/files/0x0006000000015d9c-72.dat	upx
behavioral1/files/0x0006000000015d85-67.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\ffXnYTJ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\eqKQWOq.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HntPnOj.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\DSwfVsg.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\QsUYDNy.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\JBfXIex.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\etzgyhU.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\sCIWZKZ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\ygmfxrM.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\RcTebht.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\yufGOzs.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\JXMIcQC.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\JVUZEtg.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\KTxauaa.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\JnViGfK.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PyclIUM.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\daUDlXE.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\wNdXQWe.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\qHCJSMQ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\RFcAHPF.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\RSJmxmu.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\zSSVmMo.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\OnNcwfL.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\NaUrfKK.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\CKknycv.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\KpTESGo.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HXgdegz.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PVLPlwD.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\NsrqHNW.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\GpFzuvA.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\VUJcLzh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\hKHFRqh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\nfoHEjc.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HxPGjcQ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\FSwrfLC.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\roAbOFt.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PriWulx.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PmoPEJr.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\mPqPwYd.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\ceVnFUL.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\HUhvoZD.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\VhAEBKB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\EHFxSky.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\gsOBgIH.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\CAOQVqU.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\smWaMBQ.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\hRgxGTe.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\MQXATYC.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\GUAQgiT.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\ZIvSGpE.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\iLHixix.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\VWYRXtB.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\pFiWdGh.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\EhwYRgk.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\eRNopdF.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\jQoenMj.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\BaYEfEY.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\NgiPgew.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\MKZJzER.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\uBdSKsd.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\PRVjoFq.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\KqscaAy.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\wlGHXGi.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
File created	C:\Windows\System\DbXgXdS.exe	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
Token: SeDebugPrivilege	1624	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	29
PID 2860 wrote to memory of 1624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	29
PID 2860 wrote to memory of 1624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2148	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2148	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2148	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2528	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2528	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2528	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2624	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	32
PID 2860 wrote to memory of 1948	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	33
PID 2860 wrote to memory of 1948	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	33
PID 2860 wrote to memory of 1948	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2404	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2404	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2404	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2400	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2400	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2400	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2444	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2444	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2444	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2520	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2520	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2520	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2888	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	39
PID 2860 wrote to memory of 2888	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	39
PID 2860 wrote to memory of 2888	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	39
PID 2860 wrote to memory of 2896	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	40
PID 2860 wrote to memory of 2896	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	40
PID 2860 wrote to memory of 2896	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	41
PID 2860 wrote to memory of 1564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	41
PID 2860 wrote to memory of 1564	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	41
PID 2860 wrote to memory of 2752	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2752	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2752	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	42
PID 2860 wrote to memory of 1560	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	43
PID 2860 wrote to memory of 1560	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	43
PID 2860 wrote to memory of 1560	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	43
PID 2860 wrote to memory of 1732	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1732	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1732	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1880	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1880	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1880	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1344	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1344	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1344	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	46
PID 2860 wrote to memory of 2132	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2132	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2132	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	47
PID 2860 wrote to memory of 2372	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	48
PID 2860 wrote to memory of 2372	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	48
PID 2860 wrote to memory of 2372	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	48
PID 2860 wrote to memory of 1248	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	49
PID 2860 wrote to memory of 1248	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	49
PID 2860 wrote to memory of 1248	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	49
PID 2860 wrote to memory of 2188	2860	0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ac435a3af8d413325ac48e93c6a306b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\System\GerKiPX.exe
  C:\Windows\System\GerKiPX.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\AkBthQs.exe
  C:\Windows\System\AkBthQs.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\gAZXlVo.exe
  C:\Windows\System\gAZXlVo.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\tFcyGOP.exe
  C:\Windows\System\tFcyGOP.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\lHpeOIf.exe
  C:\Windows\System\lHpeOIf.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\QNRXIFs.exe
  C:\Windows\System\QNRXIFs.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\FSwrfLC.exe
  C:\Windows\System\FSwrfLC.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\XvtAFWs.exe
  C:\Windows\System\XvtAFWs.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\AILDyZA.exe
  C:\Windows\System\AILDyZA.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zOgAMym.exe
  C:\Windows\System\zOgAMym.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\XsaUPnq.exe
  C:\Windows\System\XsaUPnq.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\YbuSnsZ.exe
  C:\Windows\System\YbuSnsZ.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\XEVcMel.exe
  C:\Windows\System\XEVcMel.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\JzYbLHE.exe
  C:\Windows\System\JzYbLHE.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KzQGHVE.exe
  C:\Windows\System\KzQGHVE.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\mYVgfAP.exe
  C:\Windows\System\mYVgfAP.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\LLAjuTO.exe
  C:\Windows\System\LLAjuTO.exe
  2⤵
  - Executes dropped EXE
  PID:1344
- C:\Windows\System\qhLWDMe.exe
  C:\Windows\System\qhLWDMe.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\igLVQZd.exe
  C:\Windows\System\igLVQZd.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\Uhnrpnk.exe
  C:\Windows\System\Uhnrpnk.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\oJfkgpZ.exe
  C:\Windows\System\oJfkgpZ.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\TTRYfvW.exe
  C:\Windows\System\TTRYfvW.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\FBBEVhm.exe
  C:\Windows\System\FBBEVhm.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\vUpqNqd.exe
  C:\Windows\System\vUpqNqd.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\OEktBCM.exe
  C:\Windows\System\OEktBCM.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\oYqhaeI.exe
  C:\Windows\System\oYqhaeI.exe
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Windows\System\VqwovNM.exe
  C:\Windows\System\VqwovNM.exe
  2⤵
  - Executes dropped EXE
  PID:1896
- C:\Windows\System\RFcAHPF.exe
  C:\Windows\System\RFcAHPF.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\XyvqHLO.exe
  C:\Windows\System\XyvqHLO.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\mNcxhja.exe
  C:\Windows\System\mNcxhja.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\QfQtIOH.exe
  C:\Windows\System\QfQtIOH.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\bIosoyu.exe
  C:\Windows\System\bIosoyu.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\qxVHFSs.exe
  C:\Windows\System\qxVHFSs.exe
  2⤵
  - Executes dropped EXE
  PID:1404
- C:\Windows\System\OKPZcXF.exe
  C:\Windows\System\OKPZcXF.exe
  2⤵
  - Executes dropped EXE
  PID:1392
- C:\Windows\System\QSTQeSJ.exe
  C:\Windows\System\QSTQeSJ.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\DanzFfh.exe
  C:\Windows\System\DanzFfh.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\pMVMOCr.exe
  C:\Windows\System\pMVMOCr.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\SNlYGIN.exe
  C:\Windows\System\SNlYGIN.exe
  2⤵
  - Executes dropped EXE
  PID:1140
- C:\Windows\System\bKdkVXT.exe
  C:\Windows\System\bKdkVXT.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\KFoqOJd.exe
  C:\Windows\System\KFoqOJd.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\WpzIUxz.exe
  C:\Windows\System\WpzIUxz.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\FsbkqHV.exe
  C:\Windows\System\FsbkqHV.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\XlwGhwb.exe
  C:\Windows\System\XlwGhwb.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\WbHearM.exe
  C:\Windows\System\WbHearM.exe
  2⤵
  PID:864
- C:\Windows\System\WwPqfsR.exe
  C:\Windows\System\WwPqfsR.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\JrOaIpe.exe
  C:\Windows\System\JrOaIpe.exe
  2⤵
  PID:1448
- C:\Windows\System\sbuUmAQ.exe
  C:\Windows\System\sbuUmAQ.exe
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Windows\System\TqJQlvq.exe
  C:\Windows\System\TqJQlvq.exe
  2⤵
  PID:1304
- C:\Windows\System\rEpVhTo.exe
  C:\Windows\System\rEpVhTo.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\gExIQPO.exe
  C:\Windows\System\gExIQPO.exe
  2⤵
  PID:292
- C:\Windows\System\KMLSWyZ.exe
  C:\Windows\System\KMLSWyZ.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\YhXyYPs.exe
  C:\Windows\System\YhXyYPs.exe
  2⤵
  PID:880
- C:\Windows\System\nkDxLoH.exe
  C:\Windows\System\nkDxLoH.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\RaISdEk.exe
  C:\Windows\System\RaISdEk.exe
  2⤵
  PID:2072
- C:\Windows\System\rueZDJM.exe
  C:\Windows\System\rueZDJM.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\GsxidMx.exe
  C:\Windows\System\GsxidMx.exe
  2⤵
  PID:2192
- C:\Windows\System\LMGcZIm.exe
  C:\Windows\System\LMGcZIm.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\PpMnJYs.exe
  C:\Windows\System\PpMnJYs.exe
  2⤵
  PID:2484
- C:\Windows\System\TAhsCOy.exe
  C:\Windows\System\TAhsCOy.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\GUnGQIX.exe
  C:\Windows\System\GUnGQIX.exe
  2⤵
  PID:3024
- C:\Windows\System\pzCRlZU.exe
  C:\Windows\System\pzCRlZU.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\XxSfnVh.exe
  C:\Windows\System\XxSfnVh.exe
  2⤵
  PID:2936
- C:\Windows\System\ueSQnqg.exe
  C:\Windows\System\ueSQnqg.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\fUorQeb.exe
  C:\Windows\System\fUorQeb.exe
  2⤵
  PID:1420
- C:\Windows\System\gznLUps.exe
  C:\Windows\System\gznLUps.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\sDbZRLM.exe
  C:\Windows\System\sDbZRLM.exe
  2⤵
  PID:2912
- C:\Windows\System\MfbWGLf.exe
  C:\Windows\System\MfbWGLf.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\MhGnkvq.exe
  C:\Windows\System\MhGnkvq.exe
  2⤵
  PID:1516
- C:\Windows\System\ECDsVWk.exe
  C:\Windows\System\ECDsVWk.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\CMdZdHp.exe
  C:\Windows\System\CMdZdHp.exe
  2⤵
  PID:3016
- C:\Windows\System\pbBjSpJ.exe
  C:\Windows\System\pbBjSpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\YAkLTxm.exe
  C:\Windows\System\YAkLTxm.exe
  2⤵
  PID:2688
- C:\Windows\System\XhJJshJ.exe
  C:\Windows\System\XhJJshJ.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\voKOTdO.exe
  C:\Windows\System\voKOTdO.exe
  2⤵
  PID:2596
- C:\Windows\System\WMXXsrx.exe
  C:\Windows\System\WMXXsrx.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\sxbRIdb.exe
  C:\Windows\System\sxbRIdb.exe
  2⤵
  PID:2416
- C:\Windows\System\AbUEMKa.exe
  C:\Windows\System\AbUEMKa.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\XWFRrnI.exe
  C:\Windows\System\XWFRrnI.exe
  2⤵
  PID:2908
- C:\Windows\System\RHBYgQw.exe
  C:\Windows\System\RHBYgQw.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\RtkQnrb.exe
  C:\Windows\System\RtkQnrb.exe
  2⤵
  PID:1028
- C:\Windows\System\XDwJBtb.exe
  C:\Windows\System\XDwJBtb.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\ntwUmAs.exe
  C:\Windows\System\ntwUmAs.exe
  2⤵
  PID:1640
- C:\Windows\System\VGDwYqr.exe
  C:\Windows\System\VGDwYqr.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\XnNbeXI.exe
  C:\Windows\System\XnNbeXI.exe
  2⤵
  PID:1996
- C:\Windows\System\TDrvWLL.exe
  C:\Windows\System\TDrvWLL.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\IVWjRur.exe
  C:\Windows\System\IVWjRur.exe
  2⤵
  PID:2204
- C:\Windows\System\JqIOSQm.exe
  C:\Windows\System\JqIOSQm.exe
  2⤵
  PID:1992
- C:\Windows\System\mKzTnqx.exe
  C:\Windows\System\mKzTnqx.exe
  2⤵
  PID:1416
- C:\Windows\System\FSbpJLp.exe
  C:\Windows\System\FSbpJLp.exe
  2⤵
  PID:2560
- C:\Windows\System\ezgleYz.exe
  C:\Windows\System\ezgleYz.exe
  2⤵
  PID:2508
- C:\Windows\System\nruNdva.exe
  C:\Windows\System\nruNdva.exe
  2⤵
  PID:2000
- C:\Windows\System\VkGdOZw.exe
  C:\Windows\System\VkGdOZw.exe
  2⤵
  PID:1952
- C:\Windows\System\lNSDUch.exe
  C:\Windows\System\lNSDUch.exe
  2⤵
  PID:1208
- C:\Windows\System\cUftQMC.exe
  C:\Windows\System\cUftQMC.exe
  2⤵
  PID:2804
- C:\Windows\System\qLHwmFb.exe
  C:\Windows\System\qLHwmFb.exe
  2⤵
  PID:3040
- C:\Windows\System\OrKpSmf.exe
  C:\Windows\System\OrKpSmf.exe
  2⤵
  PID:2060
- C:\Windows\System\jnEcbqK.exe
  C:\Windows\System\jnEcbqK.exe
  2⤵
  PID:2360
- C:\Windows\System\uziKVxD.exe
  C:\Windows\System\uziKVxD.exe
  2⤵
  PID:896
- C:\Windows\System\gYWlVIe.exe
  C:\Windows\System\gYWlVIe.exe
  2⤵
  PID:2756
- C:\Windows\System\qjiTbfp.exe
  C:\Windows\System\qjiTbfp.exe
  2⤵
  PID:828
- C:\Windows\System\CAOQVqU.exe
  C:\Windows\System\CAOQVqU.exe
  2⤵
  PID:2040
- C:\Windows\System\cdBCspL.exe
  C:\Windows\System\cdBCspL.exe
  2⤵
  PID:972
- C:\Windows\System\hKstWFJ.exe
  C:\Windows\System\hKstWFJ.exe
  2⤵
  PID:1260
- C:\Windows\System\gRjaVfN.exe
  C:\Windows\System\gRjaVfN.exe
  2⤵
  PID:1776
- C:\Windows\System\LhXcJZe.exe
  C:\Windows\System\LhXcJZe.exe
  2⤵
  PID:3048
- C:\Windows\System\DPEolgR.exe
  C:\Windows\System\DPEolgR.exe
  2⤵
  PID:2084
- C:\Windows\System\VhkPdau.exe
  C:\Windows\System\VhkPdau.exe
  2⤵
  PID:2164
- C:\Windows\System\Txxriax.exe
  C:\Windows\System\Txxriax.exe
  2⤵
  PID:1532
- C:\Windows\System\LVkKxjv.exe
  C:\Windows\System\LVkKxjv.exe
  2⤵
  PID:2316
- C:\Windows\System\pIRGvFR.exe
  C:\Windows\System\pIRGvFR.exe
  2⤵
  PID:2604
- C:\Windows\System\XUbHgxV.exe
  C:\Windows\System\XUbHgxV.exe
  2⤵
  PID:2608
- C:\Windows\System\wjjbUQK.exe
  C:\Windows\System\wjjbUQK.exe
  2⤵
  PID:2684
- C:\Windows\System\cehmELi.exe
  C:\Windows\System\cehmELi.exe
  2⤵
  PID:2540
- C:\Windows\System\NKAeVmV.exe
  C:\Windows\System\NKAeVmV.exe
  2⤵
  PID:1944
- C:\Windows\System\mUwVvaZ.exe
  C:\Windows\System\mUwVvaZ.exe
  2⤵
  PID:1192
- C:\Windows\System\DYhJihJ.exe
  C:\Windows\System\DYhJihJ.exe
  2⤵
  PID:2136
- C:\Windows\System\MPquILh.exe
  C:\Windows\System\MPquILh.exe
  2⤵
  PID:1916
- C:\Windows\System\yNZRsMu.exe
  C:\Windows\System\yNZRsMu.exe
  2⤵
  PID:296
- C:\Windows\System\FrLnDwn.exe
  C:\Windows\System\FrLnDwn.exe
  2⤵
  PID:2432
- C:\Windows\System\NIzEsbT.exe
  C:\Windows\System\NIzEsbT.exe
  2⤵
  PID:2424
- C:\Windows\System\QBcGMVa.exe
  C:\Windows\System\QBcGMVa.exe
  2⤵
  PID:3080
- C:\Windows\System\UINqMGz.exe
  C:\Windows\System\UINqMGz.exe
  2⤵
  PID:3096
- C:\Windows\System\QZqzTlk.exe
  C:\Windows\System\QZqzTlk.exe
  2⤵
  PID:3112
- C:\Windows\System\zCPlCbN.exe
  C:\Windows\System\zCPlCbN.exe
  2⤵
  PID:3128
- C:\Windows\System\QImDrVg.exe
  C:\Windows\System\QImDrVg.exe
  2⤵
  PID:3144
- C:\Windows\System\TsTNcSs.exe
  C:\Windows\System\TsTNcSs.exe
  2⤵
  PID:3160
- C:\Windows\System\UCYoGHd.exe
  C:\Windows\System\UCYoGHd.exe
  2⤵
  PID:3176
- C:\Windows\System\lMlqKXs.exe
  C:\Windows\System\lMlqKXs.exe
  2⤵
  PID:3192
- C:\Windows\System\pOSMbuj.exe
  C:\Windows\System\pOSMbuj.exe
  2⤵
  PID:3208
- C:\Windows\System\kvnjIsz.exe
  C:\Windows\System\kvnjIsz.exe
  2⤵
  PID:3224
- C:\Windows\System\FIPoHoy.exe
  C:\Windows\System\FIPoHoy.exe
  2⤵
  PID:3240
- C:\Windows\System\CACrSdP.exe
  C:\Windows\System\CACrSdP.exe
  2⤵
  PID:3256
- C:\Windows\System\vHSgaot.exe
  C:\Windows\System\vHSgaot.exe
  2⤵
  PID:3272
- C:\Windows\System\UZVyTuI.exe
  C:\Windows\System\UZVyTuI.exe
  2⤵
  PID:3288
- C:\Windows\System\JXqVeUK.exe
  C:\Windows\System\JXqVeUK.exe
  2⤵
  PID:3304
- C:\Windows\System\nfoHEjc.exe
  C:\Windows\System\nfoHEjc.exe
  2⤵
  PID:3320
- C:\Windows\System\pVCnHyn.exe
  C:\Windows\System\pVCnHyn.exe
  2⤵
  PID:3336
- C:\Windows\System\gOZhSIO.exe
  C:\Windows\System\gOZhSIO.exe
  2⤵
  PID:3352
- C:\Windows\System\HELTojc.exe
  C:\Windows\System\HELTojc.exe
  2⤵
  PID:3368
- C:\Windows\System\fuTovwE.exe
  C:\Windows\System\fuTovwE.exe
  2⤵
  PID:3384
- C:\Windows\System\DeORMQa.exe
  C:\Windows\System\DeORMQa.exe
  2⤵
  PID:3400
- C:\Windows\System\pCqHpEu.exe
  C:\Windows\System\pCqHpEu.exe
  2⤵
  PID:3416
- C:\Windows\System\cRLaerr.exe
  C:\Windows\System\cRLaerr.exe
  2⤵
  PID:3432
- C:\Windows\System\NJlCNKT.exe
  C:\Windows\System\NJlCNKT.exe
  2⤵
  PID:3448
- C:\Windows\System\nlwKOnx.exe
  C:\Windows\System\nlwKOnx.exe
  2⤵
  PID:3464
- C:\Windows\System\ltsPFON.exe
  C:\Windows\System\ltsPFON.exe
  2⤵
  PID:3480
- C:\Windows\System\hoxpeFe.exe
  C:\Windows\System\hoxpeFe.exe
  2⤵
  PID:3496
- C:\Windows\System\WXPyULz.exe
  C:\Windows\System\WXPyULz.exe
  2⤵
  PID:3512
- C:\Windows\System\OHJPqsN.exe
  C:\Windows\System\OHJPqsN.exe
  2⤵
  PID:3528
- C:\Windows\System\QqnChwd.exe
  C:\Windows\System\QqnChwd.exe
  2⤵
  PID:3544
- C:\Windows\System\YjHuZkQ.exe
  C:\Windows\System\YjHuZkQ.exe
  2⤵
  PID:3560
- C:\Windows\System\VhatoVJ.exe
  C:\Windows\System\VhatoVJ.exe
  2⤵
  PID:3576
- C:\Windows\System\LWvFLlc.exe
  C:\Windows\System\LWvFLlc.exe
  2⤵
  PID:3592
- C:\Windows\System\tfYfREb.exe
  C:\Windows\System\tfYfREb.exe
  2⤵
  PID:3608
- C:\Windows\System\iUSXdUg.exe
  C:\Windows\System\iUSXdUg.exe
  2⤵
  PID:3624
- C:\Windows\System\YhdmHRd.exe
  C:\Windows\System\YhdmHRd.exe
  2⤵
  PID:3752
- C:\Windows\System\xhHqPrb.exe
  C:\Windows\System\xhHqPrb.exe
  2⤵
  PID:3768
- C:\Windows\System\WNqNwSs.exe
  C:\Windows\System\WNqNwSs.exe
  2⤵
  PID:3784
- C:\Windows\System\sVlfyRB.exe
  C:\Windows\System\sVlfyRB.exe
  2⤵
  PID:3800
- C:\Windows\System\nniPngN.exe
  C:\Windows\System\nniPngN.exe
  2⤵
  PID:3816
- C:\Windows\System\svAIaqe.exe
  C:\Windows\System\svAIaqe.exe
  2⤵
  PID:3832
- C:\Windows\System\HObQJqY.exe
  C:\Windows\System\HObQJqY.exe
  2⤵
  PID:3848
- C:\Windows\System\iavTcHH.exe
  C:\Windows\System\iavTcHH.exe
  2⤵
  PID:3868
- C:\Windows\System\cPdvmHE.exe
  C:\Windows\System\cPdvmHE.exe
  2⤵
  PID:3912
- C:\Windows\System\gAVzKoZ.exe
  C:\Windows\System\gAVzKoZ.exe
  2⤵
  PID:3944
- C:\Windows\System\pAtLnaw.exe
  C:\Windows\System\pAtLnaw.exe
  2⤵
  PID:3980
- C:\Windows\System\uRzxdAB.exe
  C:\Windows\System\uRzxdAB.exe
  2⤵
  PID:4076
- C:\Windows\System\PeBbwMx.exe
  C:\Windows\System\PeBbwMx.exe
  2⤵
  PID:4092
- C:\Windows\System\bkSjjag.exe
  C:\Windows\System\bkSjjag.exe
  2⤵
  PID:832
- C:\Windows\System\WOSGKUF.exe
  C:\Windows\System\WOSGKUF.exe
  2⤵
  PID:1960
- C:\Windows\System\QiDWIyJ.exe
  C:\Windows\System\QiDWIyJ.exe
  2⤵
  PID:872
- C:\Windows\System\MhwMHUw.exe
  C:\Windows\System\MhwMHUw.exe
  2⤵
  PID:1608
- C:\Windows\System\ufXVCtC.exe
  C:\Windows\System\ufXVCtC.exe
  2⤵
  PID:1080
- C:\Windows\System\sEtCQyy.exe
  C:\Windows\System\sEtCQyy.exe
  2⤵
  PID:2932
- C:\Windows\System\FPtwvPZ.exe
  C:\Windows\System\FPtwvPZ.exe
  2⤵
  PID:2964
- C:\Windows\System\vQHzyUi.exe
  C:\Windows\System\vQHzyUi.exe
  2⤵
  PID:2224
- C:\Windows\System\DShINLh.exe
  C:\Windows\System\DShINLh.exe
  2⤵
  PID:3120
- C:\Windows\System\HQYudPN.exe
  C:\Windows\System\HQYudPN.exe
  2⤵
  PID:3188
- C:\Windows\System\eVHrrNC.exe
  C:\Windows\System\eVHrrNC.exe
  2⤵
  PID:3504
- C:\Windows\System\imXkIzR.exe
  C:\Windows\System\imXkIzR.exe
  2⤵
  PID:3568
- C:\Windows\System\OHTZEts.exe
  C:\Windows\System\OHTZEts.exe
  2⤵
  PID:3632
- C:\Windows\System\CrusQGh.exe
  C:\Windows\System\CrusQGh.exe
  2⤵
  PID:3664
- C:\Windows\System\mjIKUks.exe
  C:\Windows\System\mjIKUks.exe
  2⤵
  PID:3680
- C:\Windows\System\OZgPbxN.exe
  C:\Windows\System\OZgPbxN.exe
  2⤵
  PID:3692
- C:\Windows\System\wdxTcrI.exe
  C:\Windows\System\wdxTcrI.exe
  2⤵
  PID:3716
- C:\Windows\System\lUQSnIW.exe
  C:\Windows\System\lUQSnIW.exe
  2⤵
  PID:3736
- C:\Windows\System\RjhtTHP.exe
  C:\Windows\System\RjhtTHP.exe
  2⤵
  PID:1268
- C:\Windows\System\PbMgJjJ.exe
  C:\Windows\System\PbMgJjJ.exe
  2⤵
  PID:3780
- C:\Windows\System\ImIzITN.exe
  C:\Windows\System\ImIzITN.exe
  2⤵
  PID:2088
- C:\Windows\System\NIMDPwN.exe
  C:\Windows\System\NIMDPwN.exe
  2⤵
  PID:3844
- C:\Windows\System\lNjWKdI.exe
  C:\Windows\System\lNjWKdI.exe
  2⤵
  PID:3892
- C:\Windows\System\AAEjmPp.exe
  C:\Windows\System\AAEjmPp.exe
  2⤵
  PID:2172
- C:\Windows\System\NLhsPFY.exe
  C:\Windows\System\NLhsPFY.exe
  2⤵
  PID:3960
- C:\Windows\System\qHZKSgD.exe
  C:\Windows\System\qHZKSgD.exe
  2⤵
  PID:3972
- C:\Windows\System\fUOXjvl.exe
  C:\Windows\System\fUOXjvl.exe
  2⤵
  PID:2288
- C:\Windows\System\nFBDWUr.exe
  C:\Windows\System\nFBDWUr.exe
  2⤵
  PID:2632
- C:\Windows\System\EwAJjbW.exe
  C:\Windows\System\EwAJjbW.exe
  2⤵
  PID:2428
- C:\Windows\System\gVJQvll.exe
  C:\Windows\System\gVJQvll.exe
  2⤵
  PID:3104
- C:\Windows\System\DxYkHXi.exe
  C:\Windows\System\DxYkHXi.exe
  2⤵
  PID:3200
- C:\Windows\System\ueuyNzG.exe
  C:\Windows\System\ueuyNzG.exe
  2⤵
  PID:3928
- C:\Windows\System\TbkMwbM.exe
  C:\Windows\System\TbkMwbM.exe
  2⤵
  PID:3236
- C:\Windows\System\OWbhjdf.exe
  C:\Windows\System\OWbhjdf.exe
  2⤵
  PID:3920
- C:\Windows\System\BVgZKUr.exe
  C:\Windows\System\BVgZKUr.exe
  2⤵
  PID:3796
- C:\Windows\System\ZmIjarK.exe
  C:\Windows\System\ZmIjarK.exe
  2⤵
  PID:3588
- C:\Windows\System\KvqlbqH.exe
  C:\Windows\System\KvqlbqH.exe
  2⤵
  PID:3524
- C:\Windows\System\xSYFUJC.exe
  C:\Windows\System\xSYFUJC.exe
  2⤵
  PID:3428
- C:\Windows\System\yudAmTU.exe
  C:\Windows\System\yudAmTU.exe
  2⤵
  PID:3364
- C:\Windows\System\mflZHDM.exe
  C:\Windows\System\mflZHDM.exe
  2⤵
  PID:3300
- C:\Windows\System\GnhnzdO.exe
  C:\Windows\System\GnhnzdO.exe
  2⤵
  PID:4012
- C:\Windows\System\UptrqaH.exe
  C:\Windows\System\UptrqaH.exe
  2⤵
  PID:4028
- C:\Windows\System\GHhrUDh.exe
  C:\Windows\System\GHhrUDh.exe
  2⤵
  PID:4044
- C:\Windows\System\FCZpboY.exe
  C:\Windows\System\FCZpboY.exe
  2⤵
  PID:4060
- C:\Windows\System\DzxAibk.exe
  C:\Windows\System\DzxAibk.exe
  2⤵
  PID:2644
- C:\Windows\System\HRUgBAu.exe
  C:\Windows\System\HRUgBAu.exe
  2⤵
  PID:1188
- C:\Windows\System\POrvggE.exe
  C:\Windows\System\POrvggE.exe
  2⤵
  PID:1504
- C:\Windows\System\qUEVEie.exe
  C:\Windows\System\qUEVEie.exe
  2⤵
  PID:2744
- C:\Windows\System\NJPgJwp.exe
  C:\Windows\System\NJPgJwp.exe
  2⤵
  PID:2488
- C:\Windows\System\doqiraO.exe
  C:\Windows\System\doqiraO.exe
  2⤵
  PID:2436
- C:\Windows\System\yKQwlDz.exe
  C:\Windows\System\yKQwlDz.exe
  2⤵
  PID:1580
- C:\Windows\System\BxsDVto.exe
  C:\Windows\System\BxsDVto.exe
  2⤵
  PID:1708
- C:\Windows\System\itqKypi.exe
  C:\Windows\System\itqKypi.exe
  2⤵
  PID:3252
- C:\Windows\System\mRVwxhA.exe
  C:\Windows\System\mRVwxhA.exe
  2⤵
  PID:1488
- C:\Windows\System\dBAuvNm.exe
  C:\Windows\System\dBAuvNm.exe
  2⤵
  PID:1228
- C:\Windows\System\AjEGUEO.exe
  C:\Windows\System\AjEGUEO.exe
  2⤵
  PID:1428
- C:\Windows\System\QmHwzHg.exe
  C:\Windows\System\QmHwzHg.exe
  2⤵
  PID:3444
- C:\Windows\System\dwOIxRy.exe
  C:\Windows\System\dwOIxRy.exe
  2⤵
  PID:3316
- C:\Windows\System\MpzDNew.exe
  C:\Windows\System\MpzDNew.exe
  2⤵
  PID:3508
- C:\Windows\System\hCkvKsE.exe
  C:\Windows\System\hCkvKsE.exe
  2⤵
  PID:3600
- C:\Windows\System\ztNzqJL.exe
  C:\Windows\System\ztNzqJL.exe
  2⤵
  PID:3652
- C:\Windows\System\RdBMrTO.exe
  C:\Windows\System\RdBMrTO.exe
  2⤵
  PID:3672
- C:\Windows\System\WHzqsXD.exe
  C:\Windows\System\WHzqsXD.exe
  2⤵
  PID:276
- C:\Windows\System\vnQPWMK.exe
  C:\Windows\System\vnQPWMK.exe
  2⤵
  PID:2216
- C:\Windows\System\aiGWmQA.exe
  C:\Windows\System\aiGWmQA.exe
  2⤵
  PID:3728
- C:\Windows\System\fRDWneC.exe
  C:\Windows\System\fRDWneC.exe
  2⤵
  PID:3748
- C:\Windows\System\ZzDzTRN.exe
  C:\Windows\System\ZzDzTRN.exe
  2⤵
  PID:2532
- C:\Windows\System\fAfJVsl.exe
  C:\Windows\System\fAfJVsl.exe
  2⤵
  PID:2328
- C:\Windows\System\WBklDeo.exe
  C:\Windows\System\WBklDeo.exe
  2⤵
  PID:3136
- C:\Windows\System\GzkBBwl.exe
  C:\Windows\System\GzkBBwl.exe
  2⤵
  PID:1780
- C:\Windows\System\fuKWPpr.exe
  C:\Windows\System\fuKWPpr.exe
  2⤵
  PID:3856
- C:\Windows\System\jqydzqb.exe
  C:\Windows\System\jqydzqb.exe
  2⤵
  PID:3620
- C:\Windows\System\aYCNjwH.exe
  C:\Windows\System\aYCNjwH.exe
  2⤵
  PID:3552
- C:\Windows\System\ffXnYTJ.exe
  C:\Windows\System\ffXnYTJ.exe
  2⤵
  PID:3492
- C:\Windows\System\IiYGmqT.exe
  C:\Windows\System\IiYGmqT.exe
  2⤵
  PID:3268
- C:\Windows\System\nPFDjSr.exe
  C:\Windows\System\nPFDjSr.exe
  2⤵
  PID:4068
- C:\Windows\System\tnftrqm.exe
  C:\Windows\System\tnftrqm.exe
  2⤵
  PID:2412
- C:\Windows\System\pQDqxAn.exe
  C:\Windows\System\pQDqxAn.exe
  2⤵
  PID:4024
- C:\Windows\System\SFqYOon.exe
  C:\Windows\System\SFqYOon.exe
  2⤵
  PID:4084
- C:\Windows\System\LKXHoCv.exe
  C:\Windows\System\LKXHoCv.exe
  2⤵
  PID:2552
- C:\Windows\System\qrnAemA.exe
  C:\Windows\System\qrnAemA.exe
  2⤵
  PID:2720
- C:\Windows\System\wJxgdoS.exe
  C:\Windows\System\wJxgdoS.exe
  2⤵
  PID:3284
- C:\Windows\System\ARaoXMV.exe
  C:\Windows\System\ARaoXMV.exe
  2⤵
  PID:3660
- C:\Windows\System\OHVSSEX.exe
  C:\Windows\System\OHVSSEX.exe
  2⤵
  PID:3704
- C:\Windows\System\eRNopdF.exe
  C:\Windows\System\eRNopdF.exe
  2⤵
  PID:4072
- C:\Windows\System\Iwuoabd.exe
  C:\Windows\System\Iwuoabd.exe
  2⤵
  PID:3348
- C:\Windows\System\FbJRUvC.exe
  C:\Windows\System\FbJRUvC.exe
  2⤵
  PID:3220
- C:\Windows\System\sVxheNX.exe
  C:\Windows\System\sVxheNX.exe
  2⤵
  PID:2396
- C:\Windows\System\MwVggwj.exe
  C:\Windows\System\MwVggwj.exe
  2⤵
  PID:3808
- C:\Windows\System\ZlNfHKP.exe
  C:\Windows\System\ZlNfHKP.exe
  2⤵
  PID:3644
- C:\Windows\System\upXLehI.exe
  C:\Windows\System\upXLehI.exe
  2⤵
  PID:3412
- C:\Windows\System\kVgjiQU.exe
  C:\Windows\System\kVgjiQU.exe
  2⤵
  PID:3812
- C:\Windows\System\pxoYXSL.exe
  C:\Windows\System\pxoYXSL.exe
  2⤵
  PID:3908
- C:\Windows\System\MzVlXNp.exe
  C:\Windows\System\MzVlXNp.exe
  2⤵
  PID:3172
- C:\Windows\System\FrxOReX.exe
  C:\Windows\System\FrxOReX.exe
  2⤵
  PID:3968
- C:\Windows\System\rdbqMqI.exe
  C:\Windows\System\rdbqMqI.exe
  2⤵
  PID:2724
- C:\Windows\System\HAmBFBj.exe
  C:\Windows\System\HAmBFBj.exe
  2⤵
  PID:3076
- C:\Windows\System\hZCIMgH.exe
  C:\Windows\System\hZCIMgH.exe
  2⤵
  PID:1940
- C:\Windows\System\UDQcMJq.exe
  C:\Windows\System\UDQcMJq.exe
  2⤵
  PID:2576
- C:\Windows\System\OQxVbbf.exe
  C:\Windows\System\OQxVbbf.exe
  2⤵
  PID:2616
- C:\Windows\System\jsolCeX.exe
  C:\Windows\System\jsolCeX.exe
  2⤵
  PID:3828
- C:\Windows\System\JodmTDz.exe
  C:\Windows\System\JodmTDz.exe
  2⤵
  PID:3888
- C:\Windows\System\nmGdKwf.exe
  C:\Windows\System\nmGdKwf.exe
  2⤵
  PID:4020
- C:\Windows\System\xxSKzOg.exe
  C:\Windows\System\xxSKzOg.exe
  2⤵
  PID:4056
- C:\Windows\System\VXVclsN.exe
  C:\Windows\System\VXVclsN.exe
  2⤵
  PID:3396
- C:\Windows\System\AXxOHaN.exe
  C:\Windows\System\AXxOHaN.exe
  2⤵
  PID:4040
- C:\Windows\System\QGLPcrY.exe
  C:\Windows\System\QGLPcrY.exe
  2⤵
  PID:1540
- C:\Windows\System\mgMHrmj.exe
  C:\Windows\System\mgMHrmj.exe
  2⤵
  PID:3776
- C:\Windows\System\hgsDJte.exe
  C:\Windows\System\hgsDJte.exe
  2⤵
  PID:3940
- C:\Windows\System\eHhCjoF.exe
  C:\Windows\System\eHhCjoF.exe
  2⤵
  PID:2780
- C:\Windows\System\ssGfNte.exe
  C:\Windows\System\ssGfNte.exe
  2⤵
  PID:352
- C:\Windows\System\EUMKbRO.exe
  C:\Windows\System\EUMKbRO.exe
  2⤵
  PID:1300
- C:\Windows\System\pvXHtLR.exe
  C:\Windows\System\pvXHtLR.exe
  2⤵
  PID:1352
- C:\Windows\System\XpOeMYm.exe
  C:\Windows\System\XpOeMYm.exe
  2⤵
  PID:2740
- C:\Windows\System\DNMWAZp.exe
  C:\Windows\System\DNMWAZp.exe
  2⤵
  PID:3696
- C:\Windows\System\SELXgaN.exe
  C:\Windows\System\SELXgaN.exe
  2⤵
  PID:1552
- C:\Windows\System\YGMJwus.exe
  C:\Windows\System\YGMJwus.exe
  2⤵
  PID:3956
- C:\Windows\System\CcJfzwH.exe
  C:\Windows\System\CcJfzwH.exe
  2⤵
  PID:2460
- C:\Windows\System\McjEVxg.exe
  C:\Windows\System\McjEVxg.exe
  2⤵
  PID:3556
- C:\Windows\System\nxMsDQI.exe
  C:\Windows\System\nxMsDQI.exe
  2⤵
  PID:2512
- C:\Windows\System\vwvHtAh.exe
  C:\Windows\System\vwvHtAh.exe
  2⤵
  PID:3676
- C:\Windows\System\NoXyPzI.exe
  C:\Windows\System\NoXyPzI.exe
  2⤵
  PID:4100
- C:\Windows\System\gFVUFTR.exe
  C:\Windows\System\gFVUFTR.exe
  2⤵
  PID:4116
- C:\Windows\System\RvMSTaD.exe
  C:\Windows\System\RvMSTaD.exe
  2⤵
  PID:4132
- C:\Windows\System\bXIMiJg.exe
  C:\Windows\System\bXIMiJg.exe
  2⤵
  PID:4148
- C:\Windows\System\JlFRsWq.exe
  C:\Windows\System\JlFRsWq.exe
  2⤵
  PID:4164
- C:\Windows\System\lnaxtHA.exe
  C:\Windows\System\lnaxtHA.exe
  2⤵
  PID:4184
- C:\Windows\System\wlGHXGi.exe
  C:\Windows\System\wlGHXGi.exe
  2⤵
  PID:4200
- C:\Windows\System\QauRSiO.exe
  C:\Windows\System\QauRSiO.exe
  2⤵
  PID:4216
- C:\Windows\System\hCuPcnD.exe
  C:\Windows\System\hCuPcnD.exe
  2⤵
  PID:4232
- C:\Windows\System\uFWJsfE.exe
  C:\Windows\System\uFWJsfE.exe
  2⤵
  PID:4248
- C:\Windows\System\OtGJMIh.exe
  C:\Windows\System\OtGJMIh.exe
  2⤵
  PID:4268
- C:\Windows\System\ndymjhL.exe
  C:\Windows\System\ndymjhL.exe
  2⤵
  PID:4288
- C:\Windows\System\HQDAnum.exe
  C:\Windows\System\HQDAnum.exe
  2⤵
  PID:4304
- C:\Windows\System\njUTEkH.exe
  C:\Windows\System\njUTEkH.exe
  2⤵
  PID:4320
- C:\Windows\System\IQSpfHT.exe
  C:\Windows\System\IQSpfHT.exe
  2⤵
  PID:4336
- C:\Windows\System\XCrJmKP.exe
  C:\Windows\System\XCrJmKP.exe
  2⤵
  PID:4352
- C:\Windows\System\njISnSJ.exe
  C:\Windows\System\njISnSJ.exe
  2⤵
  PID:4376
- C:\Windows\System\jnXfAOA.exe
  C:\Windows\System\jnXfAOA.exe
  2⤵
  PID:4392
- C:\Windows\System\gqIBMKz.exe
  C:\Windows\System\gqIBMKz.exe
  2⤵
  PID:4408
- C:\Windows\System\OgQbuxA.exe
  C:\Windows\System\OgQbuxA.exe
  2⤵
  PID:4428
- C:\Windows\System\THFsEGb.exe
  C:\Windows\System\THFsEGb.exe
  2⤵
  PID:4448
- C:\Windows\System\ROLyNNE.exe
  C:\Windows\System\ROLyNNE.exe
  2⤵
  PID:4464
- C:\Windows\System\xholxZS.exe
  C:\Windows\System\xholxZS.exe
  2⤵
  PID:4480
- C:\Windows\System\QYVZsRX.exe
  C:\Windows\System\QYVZsRX.exe
  2⤵
  PID:4496
- C:\Windows\System\IvBwOaC.exe
  C:\Windows\System\IvBwOaC.exe
  2⤵
  PID:4520
- C:\Windows\System\cdypRLX.exe
  C:\Windows\System\cdypRLX.exe
  2⤵
  PID:4536
- C:\Windows\System\BROEjJD.exe
  C:\Windows\System\BROEjJD.exe
  2⤵
  PID:4552
- C:\Windows\System\kgfXAZm.exe
  C:\Windows\System\kgfXAZm.exe
  2⤵
  PID:4576
- C:\Windows\System\VWvBvWO.exe
  C:\Windows\System\VWvBvWO.exe
  2⤵
  PID:4604
- C:\Windows\System\FwgfSiJ.exe
  C:\Windows\System\FwgfSiJ.exe
  2⤵
  PID:4648
- C:\Windows\System\dSEWNJJ.exe
  C:\Windows\System\dSEWNJJ.exe
  2⤵
  PID:4740
- C:\Windows\System\bvJXGnt.exe
  C:\Windows\System\bvJXGnt.exe
  2⤵
  PID:4756
- C:\Windows\System\dKwhTsj.exe
  C:\Windows\System\dKwhTsj.exe
  2⤵
  PID:4776
- C:\Windows\System\yrBRUhn.exe
  C:\Windows\System\yrBRUhn.exe
  2⤵
  PID:4792
- C:\Windows\System\PIXGMLg.exe
  C:\Windows\System\PIXGMLg.exe
  2⤵
  PID:4816
- C:\Windows\System\gjqceLV.exe
  C:\Windows\System\gjqceLV.exe
  2⤵
  PID:4836
- C:\Windows\System\XRCxxKu.exe
  C:\Windows\System\XRCxxKu.exe
  2⤵
  PID:4864
- C:\Windows\System\mmbQxrD.exe
  C:\Windows\System\mmbQxrD.exe
  2⤵
  PID:4880
- C:\Windows\System\cONPfIT.exe
  C:\Windows\System\cONPfIT.exe
  2⤵
  PID:4904
- C:\Windows\System\HAIaIPM.exe
  C:\Windows\System\HAIaIPM.exe
  2⤵
  PID:4924
- C:\Windows\System\aGskXvk.exe
  C:\Windows\System\aGskXvk.exe
  2⤵
  PID:4940
- C:\Windows\System\QluOqsq.exe
  C:\Windows\System\QluOqsq.exe
  2⤵
  PID:4964
- C:\Windows\System\egPDZzB.exe
  C:\Windows\System\egPDZzB.exe
  2⤵
  PID:4980
- C:\Windows\System\opEcfoU.exe
  C:\Windows\System\opEcfoU.exe
  2⤵
  PID:4996
- C:\Windows\System\cQnDcxH.exe
  C:\Windows\System\cQnDcxH.exe
  2⤵
  PID:5016
- C:\Windows\System\rcUqIFA.exe
  C:\Windows\System\rcUqIFA.exe
  2⤵
  PID:5032
- C:\Windows\System\xjmZrhh.exe
  C:\Windows\System\xjmZrhh.exe
  2⤵
  PID:5048
- C:\Windows\System\eNCYloW.exe
  C:\Windows\System\eNCYloW.exe
  2⤵
  PID:5072
- C:\Windows\System\RgPFjDr.exe
  C:\Windows\System\RgPFjDr.exe
  2⤵
  PID:5104
- C:\Windows\System\wSDdkyb.exe
  C:\Windows\System\wSDdkyb.exe
  2⤵
  PID:3536
- C:\Windows\System\aMaWsco.exe
  C:\Windows\System\aMaWsco.exe
  2⤵
  PID:3964
- C:\Windows\System\MdkUDil.exe
  C:\Windows\System\MdkUDil.exe
  2⤵
  PID:4140
- C:\Windows\System\kkSfCJS.exe
  C:\Windows\System\kkSfCJS.exe
  2⤵
  PID:2676
- C:\Windows\System\VwqOGyK.exe
  C:\Windows\System\VwqOGyK.exe
  2⤵
  PID:4144
- C:\Windows\System\fgbNuQO.exe
  C:\Windows\System\fgbNuQO.exe
  2⤵
  PID:4176
- C:\Windows\System\ITKWmuG.exe
  C:\Windows\System\ITKWmuG.exe
  2⤵
  PID:4300
- C:\Windows\System\ROFBNrK.exe
  C:\Windows\System\ROFBNrK.exe
  2⤵
  PID:4244
- C:\Windows\System\mUCJOKL.exe
  C:\Windows\System\mUCJOKL.exe
  2⤵
  PID:4348
- C:\Windows\System\ahbvAEY.exe
  C:\Windows\System\ahbvAEY.exe
  2⤵
  PID:4384
- C:\Windows\System\LgvgxdT.exe
  C:\Windows\System\LgvgxdT.exe
  2⤵
  PID:4364
- C:\Windows\System\gBFGGzL.exe
  C:\Windows\System\gBFGGzL.exe
  2⤵
  PID:4572
- C:\Windows\System\riGJIfl.exe
  C:\Windows\System\riGJIfl.exe
  2⤵
  PID:4420
- C:\Windows\System\vaKHBZm.exe
  C:\Windows\System\vaKHBZm.exe
  2⤵
  PID:4404
- C:\Windows\System\RcXjEeL.exe
  C:\Windows\System\RcXjEeL.exe
  2⤵
  PID:4544
- C:\Windows\System\hcvtFMW.exe
  C:\Windows\System\hcvtFMW.exe
  2⤵
  PID:4624
- C:\Windows\System\FdErRzK.exe
  C:\Windows\System\FdErRzK.exe
  2⤵
  PID:4564
- C:\Windows\System\ALvheQH.exe
  C:\Windows\System\ALvheQH.exe
  2⤵
  PID:4644
- C:\Windows\System\cyVslfK.exe
  C:\Windows\System\cyVslfK.exe
  2⤵
  PID:4620
- C:\Windows\System\PriWulx.exe
  C:\Windows\System\PriWulx.exe
  2⤵
  PID:4664
- C:\Windows\System\AGSZfEv.exe
  C:\Windows\System\AGSZfEv.exe
  2⤵
  PID:4704
- C:\Windows\System\vQxyXjK.exe
  C:\Windows\System\vQxyXjK.exe
  2⤵
  PID:4672
- C:\Windows\System\hNmHvpC.exe
  C:\Windows\System\hNmHvpC.exe
  2⤵
  PID:4720
- C:\Windows\System\cXrWvXD.exe
  C:\Windows\System\cXrWvXD.exe
  2⤵
  PID:4752
- C:\Windows\System\RErRJnI.exe
  C:\Windows\System\RErRJnI.exe
  2⤵
  PID:4788
- C:\Windows\System\ktelocv.exe
  C:\Windows\System\ktelocv.exe
  2⤵
  PID:4824
- C:\Windows\System\VwAKKrG.exe
  C:\Windows\System\VwAKKrG.exe
  2⤵
  PID:4888
- C:\Windows\System\IAHfjxt.exe
  C:\Windows\System\IAHfjxt.exe
  2⤵
  PID:4916
- C:\Windows\System\PiaMnPh.exe
  C:\Windows\System\PiaMnPh.exe
  2⤵
  PID:4948
- C:\Windows\System\mTtOurM.exe
  C:\Windows\System\mTtOurM.exe
  2⤵
  PID:4976
- C:\Windows\System\ACfpiQB.exe
  C:\Windows\System\ACfpiQB.exe
  2⤵
  PID:5040
- C:\Windows\System\BTzDsXV.exe
  C:\Windows\System\BTzDsXV.exe
  2⤵
  PID:5088
- C:\Windows\System\PiQhpUi.exe
  C:\Windows\System\PiQhpUi.exe
  2⤵
  PID:5092
- C:\Windows\System\YLKXaWh.exe
  C:\Windows\System\YLKXaWh.exe
  2⤵
  PID:5116
- C:\Windows\System\gCUbPXr.exe
  C:\Windows\System\gCUbPXr.exe
  2⤵
  PID:3092
- C:\Windows\System\EeeVHpR.exe
  C:\Windows\System\EeeVHpR.exe
  2⤵
  PID:2036
- C:\Windows\System\MlVvJPT.exe
  C:\Windows\System\MlVvJPT.exe
  2⤵
  PID:4208
- C:\Windows\System\FnvhFek.exe
  C:\Windows\System\FnvhFek.exe
  2⤵
  PID:4296
- C:\Windows\System\tMPNodn.exe
  C:\Windows\System\tMPNodn.exe
  2⤵
  PID:4240
- C:\Windows\System\OpipaHO.exe
  C:\Windows\System\OpipaHO.exe
  2⤵
  PID:4332
- C:\Windows\System\NgHvKhW.exe
  C:\Windows\System\NgHvKhW.exe
  2⤵
  PID:4592
- C:\Windows\System\euEqiKp.exe
  C:\Windows\System\euEqiKp.exe
  2⤵
  PID:4456
- C:\Windows\System\PkAAvvT.exe
  C:\Windows\System\PkAAvvT.exe
  2⤵
  PID:4596
- C:\Windows\System\RSJmxmu.exe
  C:\Windows\System\RSJmxmu.exe
  2⤵
  PID:4476
- C:\Windows\System\jfHMOiH.exe
  C:\Windows\System\jfHMOiH.exe
  2⤵
  PID:4584
- C:\Windows\System\UYNbDAu.exe
  C:\Windows\System\UYNbDAu.exe
  2⤵
  PID:4636
- C:\Windows\System\BkVGlgB.exe
  C:\Windows\System\BkVGlgB.exe
  2⤵
  PID:4668
- C:\Windows\System\GVgdunb.exe
  C:\Windows\System\GVgdunb.exe
  2⤵
  PID:4684
- C:\Windows\System\LayVtoe.exe
  C:\Windows\System\LayVtoe.exe
  2⤵
  PID:4772
- C:\Windows\System\etnVHkJ.exe
  C:\Windows\System\etnVHkJ.exe
  2⤵
  PID:4736
- C:\Windows\System\YqGyhii.exe
  C:\Windows\System\YqGyhii.exe
  2⤵
  PID:4828
- C:\Windows\System\ZMSOgrG.exe
  C:\Windows\System\ZMSOgrG.exe
  2⤵
  PID:4860
- C:\Windows\System\asgVtEI.exe
  C:\Windows\System\asgVtEI.exe
  2⤵
  PID:4892
- C:\Windows\System\HLGjckF.exe
  C:\Windows\System\HLGjckF.exe
  2⤵
  PID:4956
- C:\Windows\System\CiGysqr.exe
  C:\Windows\System\CiGysqr.exe
  2⤵
  PID:5004
- C:\Windows\System\jXYpaMZ.exe
  C:\Windows\System\jXYpaMZ.exe
  2⤵
  PID:5064
- C:\Windows\System\tMeUmxV.exe
  C:\Windows\System\tMeUmxV.exe
  2⤵
  PID:5124
- C:\Windows\System\CAohXUS.exe
  C:\Windows\System\CAohXUS.exe
  2⤵
  PID:5160
- C:\Windows\System\vLugHOt.exe
  C:\Windows\System\vLugHOt.exe
  2⤵
  PID:5176
- C:\Windows\System\uYYHXUy.exe
  C:\Windows\System\uYYHXUy.exe
  2⤵
  PID:5192
- C:\Windows\System\GVSDbnT.exe
  C:\Windows\System\GVSDbnT.exe
  2⤵
  PID:5208
- C:\Windows\System\VXMZyOS.exe
  C:\Windows\System\VXMZyOS.exe
  2⤵
  PID:5224
- C:\Windows\System\SGPkKFV.exe
  C:\Windows\System\SGPkKFV.exe
  2⤵
  PID:5240
- C:\Windows\System\LbvPWkF.exe
  C:\Windows\System\LbvPWkF.exe
  2⤵
  PID:5260
- C:\Windows\System\BnCUrQD.exe
  C:\Windows\System\BnCUrQD.exe
  2⤵
  PID:5276
- C:\Windows\System\efdLWOL.exe
  C:\Windows\System\efdLWOL.exe
  2⤵
  PID:5292
- C:\Windows\System\YfDDMNr.exe
  C:\Windows\System\YfDDMNr.exe
  2⤵
  PID:5308
- C:\Windows\System\sswwuWt.exe
  C:\Windows\System\sswwuWt.exe
  2⤵
  PID:5324
- C:\Windows\System\xXmdhcU.exe
  C:\Windows\System\xXmdhcU.exe
  2⤵
  PID:5340
- C:\Windows\System\bhHmjxf.exe
  C:\Windows\System\bhHmjxf.exe
  2⤵
  PID:5356
- C:\Windows\System\jiTIcWi.exe
  C:\Windows\System\jiTIcWi.exe
  2⤵
  PID:5372
- C:\Windows\System\ZNhxpme.exe
  C:\Windows\System\ZNhxpme.exe
  2⤵
  PID:5388
- C:\Windows\System\NsrqHNW.exe
  C:\Windows\System\NsrqHNW.exe
  2⤵
  PID:5404
- C:\Windows\System\VuiGpCh.exe
  C:\Windows\System\VuiGpCh.exe
  2⤵
  PID:5420
- C:\Windows\System\vOdWNLm.exe
  C:\Windows\System\vOdWNLm.exe
  2⤵
  PID:5436
- C:\Windows\System\aVAkDMi.exe
  C:\Windows\System\aVAkDMi.exe
  2⤵
  PID:5452
- C:\Windows\System\VrNDgFw.exe
  C:\Windows\System\VrNDgFw.exe
  2⤵
  PID:5468
- C:\Windows\System\IRWzjGP.exe
  C:\Windows\System\IRWzjGP.exe
  2⤵
  PID:5484
- C:\Windows\System\ebjeDdE.exe
  C:\Windows\System\ebjeDdE.exe
  2⤵
  PID:5508
- C:\Windows\System\fcMamvQ.exe
  C:\Windows\System\fcMamvQ.exe
  2⤵
  PID:5524
- C:\Windows\System\yaWcMJb.exe
  C:\Windows\System\yaWcMJb.exe
  2⤵
  PID:5548
- C:\Windows\System\emfEhHe.exe
  C:\Windows\System\emfEhHe.exe
  2⤵
  PID:5564
- C:\Windows\System\HBJYDcz.exe
  C:\Windows\System\HBJYDcz.exe
  2⤵
  PID:5580
- C:\Windows\System\RUeOJoW.exe
  C:\Windows\System\RUeOJoW.exe
  2⤵
  PID:5596
- C:\Windows\System\RMqwChM.exe
  C:\Windows\System\RMqwChM.exe
  2⤵
  PID:5612
- C:\Windows\System\OPvCbDn.exe
  C:\Windows\System\OPvCbDn.exe
  2⤵
  PID:5628
- C:\Windows\System\RqaCyEk.exe
  C:\Windows\System\RqaCyEk.exe
  2⤵
  PID:5648
- C:\Windows\System\IoqGxRw.exe
  C:\Windows\System\IoqGxRw.exe
  2⤵
  PID:5664
- C:\Windows\System\dLmjxKT.exe
  C:\Windows\System\dLmjxKT.exe
  2⤵
  PID:5680
- C:\Windows\System\ZQNgaFb.exe
  C:\Windows\System\ZQNgaFb.exe
  2⤵
  PID:5696
- C:\Windows\System\BJzOsgd.exe
  C:\Windows\System\BJzOsgd.exe
  2⤵
  PID:5712
- C:\Windows\System\QLvFMUS.exe
  C:\Windows\System\QLvFMUS.exe
  2⤵
  PID:5728
- C:\Windows\System\aMQQKza.exe
  C:\Windows\System\aMQQKza.exe
  2⤵
  PID:5744
- C:\Windows\System\muORBlx.exe
  C:\Windows\System\muORBlx.exe
  2⤵
  PID:5760
- C:\Windows\System\gYMljKS.exe
  C:\Windows\System\gYMljKS.exe
  2⤵
  PID:5776
- C:\Windows\System\kswtRvh.exe
  C:\Windows\System\kswtRvh.exe
  2⤵
  PID:5792
- C:\Windows\System\AxUFyhn.exe
  C:\Windows\System\AxUFyhn.exe
  2⤵
  PID:5808
- C:\Windows\System\bAxBAQq.exe
  C:\Windows\System\bAxBAQq.exe
  2⤵
  PID:5824
- C:\Windows\System\SUKwUcl.exe
  C:\Windows\System\SUKwUcl.exe
  2⤵
  PID:5840
- C:\Windows\System\UecqMpW.exe
  C:\Windows\System\UecqMpW.exe
  2⤵
  PID:5856
- C:\Windows\System\BYDkiqI.exe
  C:\Windows\System\BYDkiqI.exe
  2⤵
  PID:5876
- C:\Windows\System\SrRPMjj.exe
  C:\Windows\System\SrRPMjj.exe
  2⤵
  PID:5892
- C:\Windows\System\piVdIOK.exe
  C:\Windows\System\piVdIOK.exe
  2⤵
  PID:5908
- C:\Windows\System\ADiMpny.exe
  C:\Windows\System\ADiMpny.exe
  2⤵
  PID:5924
- C:\Windows\System\HRSnveE.exe
  C:\Windows\System\HRSnveE.exe
  2⤵
  PID:5940
- C:\Windows\System\nBNvVNh.exe
  C:\Windows\System\nBNvVNh.exe
  2⤵
  PID:5956
- C:\Windows\System\MReaJIU.exe
  C:\Windows\System\MReaJIU.exe
  2⤵
  PID:5972
- C:\Windows\System\cdfuUXk.exe
  C:\Windows\System\cdfuUXk.exe
  2⤵
  PID:5988
- C:\Windows\System\ZRyyfCj.exe
  C:\Windows\System\ZRyyfCj.exe
  2⤵
  PID:6004
- C:\Windows\System\QPxXFmA.exe
  C:\Windows\System\QPxXFmA.exe
  2⤵
  PID:6020
- C:\Windows\System\BohJuhS.exe
  C:\Windows\System\BohJuhS.exe
  2⤵
  PID:6036
- C:\Windows\System\YozHYCf.exe
  C:\Windows\System\YozHYCf.exe
  2⤵
  PID:6052
- C:\Windows\System\GNpqBWt.exe
  C:\Windows\System\GNpqBWt.exe
  2⤵
  PID:6068
- C:\Windows\System\cdjnjdd.exe
  C:\Windows\System\cdjnjdd.exe
  2⤵
  PID:6084
- C:\Windows\System\dCBOuZU.exe
  C:\Windows\System\dCBOuZU.exe
  2⤵
  PID:6104
- C:\Windows\System\CTSOzVY.exe
  C:\Windows\System\CTSOzVY.exe
  2⤵
  PID:6120
- C:\Windows\System\ptGertk.exe
  C:\Windows\System\ptGertk.exe
  2⤵
  PID:6136
- C:\Windows\System\XcdQhDo.exe
  C:\Windows\System\XcdQhDo.exe
  2⤵
  PID:4312
- C:\Windows\System\sCIWZKZ.exe
  C:\Windows\System\sCIWZKZ.exe
  2⤵
  PID:4488
- C:\Windows\System\eZecErS.exe
  C:\Windows\System\eZecErS.exe
  2⤵
  PID:4700
- C:\Windows\System\vsoZlal.exe
  C:\Windows\System\vsoZlal.exe
  2⤵
  PID:4616
- C:\Windows\System\waxyrBl.exe
  C:\Windows\System\waxyrBl.exe
  2⤵
  PID:4808
- C:\Windows\System\nyqVLFi.exe
  C:\Windows\System\nyqVLFi.exe
  2⤵
  PID:5232
- C:\Windows\System\jmysuYO.exe
  C:\Windows\System\jmysuYO.exe
  2⤵
  PID:5336
- C:\Windows\System\JcEnThl.exe
  C:\Windows\System\JcEnThl.exe
  2⤵
  PID:5460
- C:\Windows\System\PmoPEJr.exe
  C:\Windows\System\PmoPEJr.exe
  2⤵
  PID:5500
- C:\Windows\System\GOgwDeX.exe
  C:\Windows\System\GOgwDeX.exe
  2⤵
  PID:5540
- C:\Windows\System\DOhKgbL.exe
  C:\Windows\System\DOhKgbL.exe
  2⤵
  PID:5204
- C:\Windows\System\CwGZhMe.exe
  C:\Windows\System\CwGZhMe.exe
  2⤵
  PID:5300
- C:\Windows\System\wtLBFaB.exe
  C:\Windows\System\wtLBFaB.exe
  2⤵
  PID:5868
- C:\Windows\System\mlYXMLe.exe
  C:\Windows\System\mlYXMLe.exe
  2⤵
  PID:4732
- C:\Windows\System\omhJXRP.exe
  C:\Windows\System\omhJXRP.exe
  2⤵
  PID:5968
- C:\Windows\System\QwFQBjI.exe
  C:\Windows\System\QwFQBjI.exe
  2⤵
  PID:5348
- C:\Windows\System\wbBwMsw.exe
  C:\Windows\System\wbBwMsw.exe
  2⤵
  PID:5604
- C:\Windows\System\hHfeXfg.exe
  C:\Windows\System\hHfeXfg.exe
  2⤵
  PID:5720
- C:\Windows\System\ikgqPLO.exe
  C:\Windows\System\ikgqPLO.exe
  2⤵
  PID:5952
- C:\Windows\System\CZOdDDt.exe
  C:\Windows\System\CZOdDDt.exe
  2⤵
  PID:4156
- C:\Windows\System\AsJBTkF.exe
  C:\Windows\System\AsJBTkF.exe
  2⤵
  PID:5056
- C:\Windows\System\ENVFhnt.exe
  C:\Windows\System\ENVFhnt.exe
  2⤵
  PID:5096
- C:\Windows\System\fkcmYML.exe
  C:\Windows\System\fkcmYML.exe
  2⤵
  PID:4328
- C:\Windows\System\aOocdPB.exe
  C:\Windows\System\aOocdPB.exe
  2⤵
  PID:4660
- C:\Windows\System\qsVuwRl.exe
  C:\Windows\System\qsVuwRl.exe
  2⤵
  PID:5800
- C:\Windows\System\uEPQRcj.exe
  C:\Windows\System\uEPQRcj.exe
  2⤵
  PID:5172
- C:\Windows\System\JWEtqIr.exe
  C:\Windows\System\JWEtqIr.exe
  2⤵
  PID:5432
- C:\Windows\System\JvHOpWF.exe
  C:\Windows\System\JvHOpWF.exe
  2⤵
  PID:5644
- C:\Windows\System\ITvqurD.exe
  C:\Windows\System\ITvqurD.exe
  2⤵
  PID:4932
- C:\Windows\System\OgOXTQZ.exe
  C:\Windows\System\OgOXTQZ.exe
  2⤵
  PID:5724
- C:\Windows\System\RYbxmVx.exe
  C:\Windows\System\RYbxmVx.exe
  2⤵
  PID:5140
- C:\Windows\System\mseDGza.exe
  C:\Windows\System\mseDGza.exe
  2⤵
  PID:6112
- C:\Windows\System\PzDAxpA.exe
  C:\Windows\System\PzDAxpA.exe
  2⤵
  PID:5152
- C:\Windows\System\FOHbtkd.exe
  C:\Windows\System\FOHbtkd.exe
  2⤵
  PID:5252
- C:\Windows\System\VGPgbqJ.exe
  C:\Windows\System\VGPgbqJ.exe
  2⤵
  PID:5384
- C:\Windows\System\Vzvmgwr.exe
  C:\Windows\System\Vzvmgwr.exe
  2⤵
  PID:5448
- C:\Windows\System\pVpHEjU.exe
  C:\Windows\System\pVpHEjU.exe
  2⤵
  PID:5520
- C:\Windows\System\NqgBhrI.exe
  C:\Windows\System\NqgBhrI.exe
  2⤵
  PID:5660
- C:\Windows\System\uAnrhQx.exe
  C:\Windows\System\uAnrhQx.exe
  2⤵
  PID:5620
- C:\Windows\System\HVSozgs.exe
  C:\Windows\System\HVSozgs.exe
  2⤵
  PID:5920
- C:\Windows\System\KTxauaa.exe
  C:\Windows\System\KTxauaa.exe
  2⤵
  PID:6016
- C:\Windows\System\nhJkWis.exe
  C:\Windows\System\nhJkWis.exe
  2⤵
  PID:5572
- C:\Windows\System\ExXtFZp.exe
  C:\Windows\System\ExXtFZp.exe
  2⤵
  PID:6012
- C:\Windows\System\DMxvtRo.exe
  C:\Windows\System\DMxvtRo.exe
  2⤵
  PID:5608
- C:\Windows\System\VTkaYZk.exe
  C:\Windows\System\VTkaYZk.exe
  2⤵
  PID:4440
- C:\Windows\System\aXOXEzM.exe
  C:\Windows\System\aXOXEzM.exe
  2⤵
  PID:5316
- C:\Windows\System\UFBKlFw.exe
  C:\Windows\System\UFBKlFw.exe
  2⤵
  PID:5832
- C:\Windows\System\CdNNRZw.exe
  C:\Windows\System\CdNNRZw.exe
  2⤵
  PID:4276
- C:\Windows\System\zXsaWyG.exe
  C:\Windows\System\zXsaWyG.exe
  2⤵
  PID:6092
- C:\Windows\System\FGsZGPf.exe
  C:\Windows\System\FGsZGPf.exe
  2⤵
  PID:4124
- C:\Windows\System\javIDOi.exe
  C:\Windows\System\javIDOi.exe
  2⤵
  PID:4632
- C:\Windows\System\OqUBTFv.exe
  C:\Windows\System\OqUBTFv.exe
  2⤵
  PID:5536
- C:\Windows\System\fffAOYM.exe
  C:\Windows\System\fffAOYM.exe
  2⤵
  PID:6076
- C:\Windows\System\OCjmuwt.exe
  C:\Windows\System\OCjmuwt.exe
  2⤵
  PID:5784
- C:\Windows\System\HXxGAYo.exe
  C:\Windows\System\HXxGAYo.exe
  2⤵
  PID:4108
- C:\Windows\System\ypBecDx.exe
  C:\Windows\System\ypBecDx.exe
  2⤵
  PID:4912
- C:\Windows\System\MTeohby.exe
  C:\Windows\System\MTeohby.exe
  2⤵
  PID:5428
- C:\Windows\System\JfBrMeu.exe
  C:\Windows\System\JfBrMeu.exe
  2⤵
  PID:5132
- C:\Windows\System\nXvGmfH.exe
  C:\Windows\System\nXvGmfH.exe
  2⤵
  PID:5708
- C:\Windows\System\pFiWdGh.exe
  C:\Windows\System\pFiWdGh.exe
  2⤵
  PID:5284
- C:\Windows\System\BceFtzH.exe
  C:\Windows\System\BceFtzH.exe
  2⤵
  PID:5444
- C:\Windows\System\jiJDniW.exe
  C:\Windows\System\jiJDniW.exe
  2⤵
  PID:5380
- C:\Windows\System\Wbrtwnw.exe
  C:\Windows\System\Wbrtwnw.exe
  2⤵
  PID:5692
- C:\Windows\System\gpUzajW.exe
  C:\Windows\System\gpUzajW.exe
  2⤵
  PID:5304
- C:\Windows\System\EmeCZlf.exe
  C:\Windows\System\EmeCZlf.exe
  2⤵
  PID:5496
- C:\Windows\System\peexTig.exe
  C:\Windows\System\peexTig.exe
  2⤵
  PID:5024
- C:\Windows\System\xDLZxFX.exe
  C:\Windows\System\xDLZxFX.exe
  2⤵
  PID:5492
- C:\Windows\System\XEQjctF.exe
  C:\Windows\System\XEQjctF.exe
  2⤵
  PID:5872
- C:\Windows\System\WTzrdrq.exe
  C:\Windows\System\WTzrdrq.exe
  2⤵
  PID:4388
- C:\Windows\System\cFJZNoT.exe
  C:\Windows\System\cFJZNoT.exe
  2⤵
  PID:4436
- C:\Windows\System\MeQLuMI.exe
  C:\Windows\System\MeQLuMI.exe
  2⤵
  PID:6048
- C:\Windows\System\yeKnEIc.exe
  C:\Windows\System\yeKnEIc.exe
  2⤵
  PID:4260
- C:\Windows\System\ObOHRHs.exe
  C:\Windows\System\ObOHRHs.exe
  2⤵
  PID:2308
- C:\Windows\System\ddpLWPi.exe
  C:\Windows\System\ddpLWPi.exe
  2⤵
  PID:3904
- C:\Windows\System\XWVXuFS.exe
  C:\Windows\System\XWVXuFS.exe
  2⤵
  PID:5848
- C:\Windows\System\lSxruPq.exe
  C:\Windows\System\lSxruPq.exe
  2⤵
  PID:5216
- C:\Windows\System\WReCOmo.exe
  C:\Windows\System\WReCOmo.exe
  2⤵
  PID:5984
- C:\Windows\System\khXVjkd.exe
  C:\Windows\System\khXVjkd.exe
  2⤵
  PID:6156
- C:\Windows\System\vCjaGDe.exe
  C:\Windows\System\vCjaGDe.exe
  2⤵
  PID:6172
- C:\Windows\System\OklrWqn.exe
  C:\Windows\System\OklrWqn.exe
  2⤵
  PID:6188
- C:\Windows\System\bleoESF.exe
  C:\Windows\System\bleoESF.exe
  2⤵
  PID:6204
- C:\Windows\System\BrDPEZQ.exe
  C:\Windows\System\BrDPEZQ.exe
  2⤵
  PID:6220
- C:\Windows\System\cfRBRnq.exe
  C:\Windows\System\cfRBRnq.exe
  2⤵
  PID:6236
- C:\Windows\System\zSSVmMo.exe
  C:\Windows\System\zSSVmMo.exe
  2⤵
  PID:6252
- C:\Windows\System\tmtwjIm.exe
  C:\Windows\System\tmtwjIm.exe
  2⤵
  PID:6268
- C:\Windows\System\mUryriI.exe
  C:\Windows\System\mUryriI.exe
  2⤵
  PID:6284
- C:\Windows\System\HBAobWu.exe
  C:\Windows\System\HBAobWu.exe
  2⤵
  PID:6300
- C:\Windows\System\PIbBwyc.exe
  C:\Windows\System\PIbBwyc.exe
  2⤵
  PID:6316
- C:\Windows\System\ODleQbr.exe
  C:\Windows\System\ODleQbr.exe
  2⤵
  PID:6332
- C:\Windows\System\iNDuPYk.exe
  C:\Windows\System\iNDuPYk.exe
  2⤵
  PID:6348
- C:\Windows\System\RQiVRtF.exe
  C:\Windows\System\RQiVRtF.exe
  2⤵
  PID:6364
- C:\Windows\System\ihZWGCi.exe
  C:\Windows\System\ihZWGCi.exe
  2⤵
  PID:6380
- C:\Windows\System\YzaUAri.exe
  C:\Windows\System\YzaUAri.exe
  2⤵
  PID:6396
- C:\Windows\System\vJlvgCH.exe
  C:\Windows\System\vJlvgCH.exe
  2⤵
  PID:6412
- C:\Windows\System\VKIhbFK.exe
  C:\Windows\System\VKIhbFK.exe
  2⤵
  PID:6428
- C:\Windows\System\KjWNouP.exe
  C:\Windows\System\KjWNouP.exe
  2⤵
  PID:6444
- C:\Windows\System\EDhniyB.exe
  C:\Windows\System\EDhniyB.exe
  2⤵
  PID:6460
- C:\Windows\System\XBPkuhr.exe
  C:\Windows\System\XBPkuhr.exe
  2⤵
  PID:6480
- C:\Windows\System\XVywgxO.exe
  C:\Windows\System\XVywgxO.exe
  2⤵
  PID:6496
- C:\Windows\System\zjGnOAL.exe
  C:\Windows\System\zjGnOAL.exe
  2⤵
  PID:6512
- C:\Windows\System\odAJsWV.exe
  C:\Windows\System\odAJsWV.exe
  2⤵
  PID:6528
- C:\Windows\System\PwAthdT.exe
  C:\Windows\System\PwAthdT.exe
  2⤵
  PID:6544
- C:\Windows\System\swzMIBL.exe
  C:\Windows\System\swzMIBL.exe
  2⤵
  PID:6560
- C:\Windows\System\IwRoYNp.exe
  C:\Windows\System\IwRoYNp.exe
  2⤵
  PID:6576
- C:\Windows\System\gXSkDhn.exe
  C:\Windows\System\gXSkDhn.exe
  2⤵
  PID:6596
- C:\Windows\System\upyHFSU.exe
  C:\Windows\System\upyHFSU.exe
  2⤵
  PID:6612
- C:\Windows\System\VTQvnOd.exe
  C:\Windows\System\VTQvnOd.exe
  2⤵
  PID:6628
- C:\Windows\System\eBZCsDy.exe
  C:\Windows\System\eBZCsDy.exe
  2⤵
  PID:6644
- C:\Windows\System\DIjDpsR.exe
  C:\Windows\System\DIjDpsR.exe
  2⤵
  PID:6660
- C:\Windows\System\jjALiNn.exe
  C:\Windows\System\jjALiNn.exe
  2⤵
  PID:6676
- C:\Windows\System\erjfYal.exe
  C:\Windows\System\erjfYal.exe
  2⤵
  PID:6696
- C:\Windows\System\BszpMEp.exe
  C:\Windows\System\BszpMEp.exe
  2⤵
  PID:6712
- C:\Windows\System\efqPELl.exe
  C:\Windows\System\efqPELl.exe
  2⤵
  PID:6728
- C:\Windows\System\nieItFm.exe
  C:\Windows\System\nieItFm.exe
  2⤵
  PID:6744
- C:\Windows\System\AKzOxPS.exe
  C:\Windows\System\AKzOxPS.exe
  2⤵
  PID:6760
- C:\Windows\System\OjQQmzW.exe
  C:\Windows\System\OjQQmzW.exe
  2⤵
  PID:6776
- C:\Windows\System\eYcxwsw.exe
  C:\Windows\System\eYcxwsw.exe
  2⤵
  PID:6792
- C:\Windows\System\FUmTeHu.exe
  C:\Windows\System\FUmTeHu.exe
  2⤵
  PID:6808
- C:\Windows\System\RILVZaC.exe
  C:\Windows\System\RILVZaC.exe
  2⤵
  PID:6824
- C:\Windows\System\RoRjDBZ.exe
  C:\Windows\System\RoRjDBZ.exe
  2⤵
  PID:6840
- C:\Windows\System\CyiXgGl.exe
  C:\Windows\System\CyiXgGl.exe
  2⤵
  PID:6856
- C:\Windows\System\oNxtmcc.exe
  C:\Windows\System\oNxtmcc.exe
  2⤵
  PID:6872
- C:\Windows\System\MvirKKk.exe
  C:\Windows\System\MvirKKk.exe
  2⤵
  PID:6888
- C:\Windows\System\SluWLFl.exe
  C:\Windows\System\SluWLFl.exe
  2⤵
  PID:6904
- C:\Windows\System\JVKPLeL.exe
  C:\Windows\System\JVKPLeL.exe
  2⤵
  PID:6920
- C:\Windows\System\CGXqStA.exe
  C:\Windows\System\CGXqStA.exe
  2⤵
  PID:6936
- C:\Windows\System\xLcMCPW.exe
  C:\Windows\System\xLcMCPW.exe
  2⤵
  PID:6952
- C:\Windows\System\NzSXJuu.exe
  C:\Windows\System\NzSXJuu.exe
  2⤵
  PID:6968
- C:\Windows\System\XlBuYRi.exe
  C:\Windows\System\XlBuYRi.exe
  2⤵
  PID:6984
- C:\Windows\System\doRQafG.exe
  C:\Windows\System\doRQafG.exe
  2⤵
  PID:7000
- C:\Windows\System\aSxLeOw.exe
  C:\Windows\System\aSxLeOw.exe
  2⤵
  PID:7016
- C:\Windows\System\vIaaKWV.exe
  C:\Windows\System\vIaaKWV.exe
  2⤵
  PID:7032
- C:\Windows\System\ryVjbCp.exe
  C:\Windows\System\ryVjbCp.exe
  2⤵
  PID:7048
- C:\Windows\System\yVxKjxY.exe
  C:\Windows\System\yVxKjxY.exe
  2⤵
  PID:7064
- C:\Windows\System\XFqTwhd.exe
  C:\Windows\System\XFqTwhd.exe
  2⤵
  PID:7080
- C:\Windows\System\Tntargy.exe
  C:\Windows\System\Tntargy.exe
  2⤵
  PID:7096
- C:\Windows\System\yUicpwB.exe
  C:\Windows\System\yUicpwB.exe
  2⤵
  PID:7112
- C:\Windows\System\myquuGQ.exe
  C:\Windows\System\myquuGQ.exe
  2⤵
  PID:7128
- C:\Windows\System\lykNaVw.exe
  C:\Windows\System\lykNaVw.exe
  2⤵
  PID:7144
- C:\Windows\System\VRWHndt.exe
  C:\Windows\System\VRWHndt.exe
  2⤵
  PID:7160
- C:\Windows\System\ngtKzWu.exe
  C:\Windows\System\ngtKzWu.exe
  2⤵
  PID:6164
- C:\Windows\System\wMEEiro.exe
  C:\Windows\System\wMEEiro.exe
  2⤵
  PID:5852
- C:\Windows\System\thVuBrY.exe
  C:\Windows\System\thVuBrY.exe
  2⤵
  PID:5916
- C:\Windows\System\fPWpAuw.exe
  C:\Windows\System\fPWpAuw.exe
  2⤵
  PID:6128
- C:\Windows\System\KgUpCzi.exe
  C:\Windows\System\KgUpCzi.exe
  2⤵
  PID:5148
- C:\Windows\System\tuYIFfO.exe
  C:\Windows\System\tuYIFfO.exe
  2⤵
  PID:5400
- C:\Windows\System\rsUmGFS.exe
  C:\Windows\System\rsUmGFS.exe
  2⤵
  PID:5352
- C:\Windows\System\OAVQFzT.exe
  C:\Windows\System\OAVQFzT.exe
  2⤵
  PID:6028
- C:\Windows\System\qZxaXom.exe
  C:\Windows\System\qZxaXom.exe
  2⤵
  PID:3140
- C:\Windows\System\qQnwRYb.exe
  C:\Windows\System\qQnwRYb.exe
  2⤵
  PID:6000
- C:\Windows\System\bNwlzgD.exe
  C:\Windows\System\bNwlzgD.exe
  2⤵
  PID:6196
- C:\Windows\System\ukGJTqB.exe
  C:\Windows\System\ukGJTqB.exe
  2⤵
  PID:6216
- C:\Windows\System\yMUXzXK.exe
  C:\Windows\System\yMUXzXK.exe
  2⤵
  PID:6232
- C:\Windows\System\UrjUOUH.exe
  C:\Windows\System\UrjUOUH.exe
  2⤵
  PID:6276
- C:\Windows\System\eiJrrsE.exe
  C:\Windows\System\eiJrrsE.exe
  2⤵
  PID:6296
- C:\Windows\System\TsxfyYg.exe
  C:\Windows\System\TsxfyYg.exe
  2⤵
  PID:6372
- C:\Windows\System\QGeWjwn.exe
  C:\Windows\System\QGeWjwn.exe
  2⤵
  PID:6328
- C:\Windows\System\leLxHjN.exe
  C:\Windows\System\leLxHjN.exe
  2⤵
  PID:6392
- C:\Windows\System\UTkMKTx.exe
  C:\Windows\System\UTkMKTx.exe
  2⤵
  PID:6468
- C:\Windows\System\RQyPSRn.exe
  C:\Windows\System\RQyPSRn.exe
  2⤵
  PID:6540
- C:\Windows\System\fYNkrue.exe
  C:\Windows\System\fYNkrue.exe
  2⤵
  PID:6536
- C:\Windows\System\hmXdLiU.exe
  C:\Windows\System\hmXdLiU.exe
  2⤵
  PID:6668
- C:\Windows\System\PMDNjHk.exe
  C:\Windows\System\PMDNjHk.exe
  2⤵
  PID:6524
- C:\Windows\System\ngENHHb.exe
  C:\Windows\System\ngENHHb.exe
  2⤵
  PID:6588
- C:\Windows\System\mYkghZP.exe
  C:\Windows\System\mYkghZP.exe
  2⤵
  PID:6624
- C:\Windows\System\aiBfUVi.exe
  C:\Windows\System\aiBfUVi.exe
  2⤵
  PID:6688
- C:\Windows\System\xufSQGq.exe
  C:\Windows\System\xufSQGq.exe
  2⤵
  PID:6452
- C:\Windows\System\xijPznv.exe
  C:\Windows\System\xijPznv.exe
  2⤵
  PID:6740
- C:\Windows\System\eFVwPXN.exe
  C:\Windows\System\eFVwPXN.exe
  2⤵
  PID:6800
- C:\Windows\System\HrgOSGP.exe
  C:\Windows\System\HrgOSGP.exe
  2⤵
  PID:6836
- C:\Windows\System\fyQetCi.exe
  C:\Windows\System\fyQetCi.exe
  2⤵
  PID:6900
- C:\Windows\System\nebHuAU.exe
  C:\Windows\System\nebHuAU.exe
  2⤵
  PID:6960
- C:\Windows\System\TEuTcin.exe
  C:\Windows\System\TEuTcin.exe
  2⤵
  PID:6720
- C:\Windows\System\FXgWYli.exe
  C:\Windows\System\FXgWYli.exe
  2⤵
  PID:6944
- C:\Windows\System\kchHYcr.exe
  C:\Windows\System\kchHYcr.exe
  2⤵
  PID:6788
- C:\Windows\System\wyVpxBJ.exe
  C:\Windows\System\wyVpxBJ.exe
  2⤵
  PID:6996
- C:\Windows\System\yteFwvs.exe
  C:\Windows\System\yteFwvs.exe
  2⤵
  PID:7056
- C:\Windows\System\hAVPhXn.exe
  C:\Windows\System\hAVPhXn.exe
  2⤵
  PID:6916
- C:\Windows\System\JnViGfK.exe
  C:\Windows\System\JnViGfK.exe
  2⤵
  PID:7008
- C:\Windows\System\AxqJAYl.exe
  C:\Windows\System\AxqJAYl.exe
  2⤵
  PID:7124
- C:\Windows\System\QDeVLsL.exe
  C:\Windows\System\QDeVLsL.exe
  2⤵
  PID:1536
- C:\Windows\System\tyfztET.exe
  C:\Windows\System\tyfztET.exe
  2⤵
  PID:5396
- C:\Windows\System\hPZwbAi.exe
  C:\Windows\System\hPZwbAi.exe
  2⤵
  PID:7136
- C:\Windows\System\AaUfIzL.exe
  C:\Windows\System\AaUfIzL.exe
  2⤵
  PID:6184
- C:\Windows\System\hzPznIr.exe
  C:\Windows\System\hzPznIr.exe
  2⤵
  PID:5248
- C:\Windows\System\GpFzuvA.exe
  C:\Windows\System\GpFzuvA.exe
  2⤵
  PID:5416
- C:\Windows\System\ZIvSGpE.exe
  C:\Windows\System\ZIvSGpE.exe
  2⤵
  PID:4512
- C:\Windows\System\syDsRfk.exe
  C:\Windows\System\syDsRfk.exe
  2⤵
  PID:6248
- C:\Windows\System\MNesWNC.exe
  C:\Windows\System\MNesWNC.exe
  2⤵
  PID:6244
- C:\Windows\System\jkkfhvS.exe
  C:\Windows\System\jkkfhvS.exe
  2⤵
  PID:6360
- C:\Windows\System\cpJHqSW.exe
  C:\Windows\System\cpJHqSW.exe
  2⤵
  PID:6404
- C:\Windows\System\KIlrSph.exe
  C:\Windows\System\KIlrSph.exe
  2⤵
  PID:6508
- C:\Windows\System\GdugDkt.exe
  C:\Windows\System\GdugDkt.exe
  2⤵
  PID:6584
- C:\Windows\System\MYjTStN.exe
  C:\Windows\System\MYjTStN.exe
  2⤵
  PID:6708
- C:\Windows\System\EuVQJNt.exe
  C:\Windows\System\EuVQJNt.exe
  2⤵
  PID:6604
- C:\Windows\System\xSrHaeZ.exe
  C:\Windows\System\xSrHaeZ.exe
  2⤵
  PID:6620
- C:\Windows\System\HYCLiSe.exe
  C:\Windows\System\HYCLiSe.exe
  2⤵
  PID:6772
- C:\Windows\System\huYUwBV.exe
  C:\Windows\System\huYUwBV.exe
  2⤵
  PID:6488
- C:\Windows\System\efsaCnI.exe
  C:\Windows\System\efsaCnI.exe
  2⤵
  PID:6992
- C:\Windows\System\OSPdWMx.exe
  C:\Windows\System\OSPdWMx.exe
  2⤵
  PID:6912
- C:\Windows\System\guUaovy.exe
  C:\Windows\System\guUaovy.exe
  2⤵
  PID:6976
- C:\Windows\System\vqPoEBL.exe
  C:\Windows\System\vqPoEBL.exe
  2⤵
  PID:6884
- C:\Windows\System\MHIhlQL.exe
  C:\Windows\System\MHIhlQL.exe
  2⤵
  PID:4172
- C:\Windows\System\mApFCNV.exe
  C:\Windows\System\mApFCNV.exe
  2⤵
  PID:7156
- C:\Windows\System\nFIHqwi.exe
  C:\Windows\System\nFIHqwi.exe
  2⤵
  PID:6388
- C:\Windows\System\ElXNfdj.exe
  C:\Windows\System\ElXNfdj.exe
  2⤵
  PID:6692
- C:\Windows\System\WDPJZiT.exe
  C:\Windows\System\WDPJZiT.exe
  2⤵
  PID:5804
- C:\Windows\System\kluvbDq.exe
  C:\Windows\System\kluvbDq.exe
  2⤵
  PID:6504
- C:\Windows\System\jYVdcLH.exe
  C:\Windows\System\jYVdcLH.exe
  2⤵
  PID:6868
- C:\Windows\System\knwdAGa.exe
  C:\Windows\System\knwdAGa.exe
  2⤵
  PID:6292
- C:\Windows\System\PEdRPuS.exe
  C:\Windows\System\PEdRPuS.exe
  2⤵
  PID:7012
- C:\Windows\System\eLKLmxS.exe
  C:\Windows\System\eLKLmxS.exe
  2⤵
  PID:6420
- C:\Windows\System\NolAZEs.exe
  C:\Windows\System\NolAZEs.exe
  2⤵
  PID:6684
- C:\Windows\System\WhNgtNf.exe
  C:\Windows\System\WhNgtNf.exe
  2⤵
  PID:6340
- C:\Windows\System\lbUiwDi.exe
  C:\Windows\System\lbUiwDi.exe
  2⤵
  PID:5640
- C:\Windows\System\EnuVgyw.exe
  C:\Windows\System\EnuVgyw.exe
  2⤵
  PID:7184
- C:\Windows\System\rxluhOY.exe
  C:\Windows\System\rxluhOY.exe
  2⤵
  PID:7200
- C:\Windows\System\KhXdXJU.exe
  C:\Windows\System\KhXdXJU.exe
  2⤵
  PID:7216
- C:\Windows\System\QJsWwpi.exe
  C:\Windows\System\QJsWwpi.exe
  2⤵
  PID:7232
- C:\Windows\System\lwQCKdi.exe
  C:\Windows\System\lwQCKdi.exe
  2⤵
  PID:7248
- C:\Windows\System\PLrvnRP.exe
  C:\Windows\System\PLrvnRP.exe
  2⤵
  PID:7264
- C:\Windows\System\QjPYVGr.exe
  C:\Windows\System\QjPYVGr.exe
  2⤵
  PID:7280
- C:\Windows\System\OyZmiVC.exe
  C:\Windows\System\OyZmiVC.exe
  2⤵
  PID:7296
- C:\Windows\System\nBuheos.exe
  C:\Windows\System\nBuheos.exe
  2⤵
  PID:7312
- C:\Windows\System\bqsanEv.exe
  C:\Windows\System\bqsanEv.exe
  2⤵
  PID:7328
- C:\Windows\System\KmQyisO.exe
  C:\Windows\System\KmQyisO.exe
  2⤵
  PID:7344
- C:\Windows\System\zcDYaAh.exe
  C:\Windows\System\zcDYaAh.exe
  2⤵
  PID:7360
- C:\Windows\System\zqftTMD.exe
  C:\Windows\System\zqftTMD.exe
  2⤵
  PID:7376
- C:\Windows\System\cVMyzpX.exe
  C:\Windows\System\cVMyzpX.exe
  2⤵
  PID:7396
- C:\Windows\System\ttxOzES.exe
  C:\Windows\System\ttxOzES.exe
  2⤵
  PID:7412
- C:\Windows\System\tPHyWgM.exe
  C:\Windows\System\tPHyWgM.exe
  2⤵
  PID:7432
- C:\Windows\System\QLeKreE.exe
  C:\Windows\System\QLeKreE.exe
  2⤵
  PID:7448
- C:\Windows\System\GDnayQa.exe
  C:\Windows\System\GDnayQa.exe
  2⤵
  PID:7464
- C:\Windows\System\rYhcgAE.exe
  C:\Windows\System\rYhcgAE.exe
  2⤵
  PID:7480
- C:\Windows\System\rFFnaEL.exe
  C:\Windows\System\rFFnaEL.exe
  2⤵
  PID:7496
- C:\Windows\System\wvHeTAK.exe
  C:\Windows\System\wvHeTAK.exe
  2⤵
  PID:7512
- C:\Windows\System\bndTnuc.exe
  C:\Windows\System\bndTnuc.exe
  2⤵
  PID:7528
- C:\Windows\System\NruFiRB.exe
  C:\Windows\System\NruFiRB.exe
  2⤵
  PID:7544
- C:\Windows\System\lnPiJqw.exe
  C:\Windows\System\lnPiJqw.exe
  2⤵
  PID:7560
- C:\Windows\System\GnHRPtb.exe
  C:\Windows\System\GnHRPtb.exe
  2⤵
  PID:7576
- C:\Windows\System\kiPtcOD.exe
  C:\Windows\System\kiPtcOD.exe
  2⤵
  PID:7592
- C:\Windows\System\lgzpKWy.exe
  C:\Windows\System\lgzpKWy.exe
  2⤵
  PID:7608
- C:\Windows\System\coZjpRr.exe
  C:\Windows\System\coZjpRr.exe
  2⤵
  PID:7624
- C:\Windows\System\ygmfxrM.exe
  C:\Windows\System\ygmfxrM.exe
  2⤵
  PID:7640
- C:\Windows\System\NBktAdQ.exe
  C:\Windows\System\NBktAdQ.exe
  2⤵
  PID:7656
- C:\Windows\System\GhPzzXF.exe
  C:\Windows\System\GhPzzXF.exe
  2⤵
  PID:7672
- C:\Windows\System\VlbjPjI.exe
  C:\Windows\System\VlbjPjI.exe
  2⤵
  PID:7688
- C:\Windows\System\GeQnZhX.exe
  C:\Windows\System\GeQnZhX.exe
  2⤵
  PID:7704
- C:\Windows\System\FEbxxYp.exe
  C:\Windows\System\FEbxxYp.exe
  2⤵
  PID:7720
- C:\Windows\System\MLmUjTn.exe
  C:\Windows\System\MLmUjTn.exe
  2⤵
  PID:7736
- C:\Windows\System\UKiSpih.exe
  C:\Windows\System\UKiSpih.exe
  2⤵
  PID:7756
- C:\Windows\System\HkHQljU.exe
  C:\Windows\System\HkHQljU.exe
  2⤵
  PID:7776
- C:\Windows\System\vXPVLUW.exe
  C:\Windows\System\vXPVLUW.exe
  2⤵
  PID:7792
- C:\Windows\System\oFPZnMk.exe
  C:\Windows\System\oFPZnMk.exe
  2⤵
  PID:7808
- C:\Windows\System\dWGlWDw.exe
  C:\Windows\System\dWGlWDw.exe
  2⤵
  PID:7824
- C:\Windows\System\iLHixix.exe
  C:\Windows\System\iLHixix.exe
  2⤵
  PID:7840
- C:\Windows\System\SFeHINI.exe
  C:\Windows\System\SFeHINI.exe
  2⤵
  PID:7856
- C:\Windows\System\TIOiYff.exe
  C:\Windows\System\TIOiYff.exe
  2⤵
  PID:7872
- C:\Windows\System\PKIBQHT.exe
  C:\Windows\System\PKIBQHT.exe
  2⤵
  PID:7888
- C:\Windows\System\wUhSOVN.exe
  C:\Windows\System\wUhSOVN.exe
  2⤵
  PID:7908
- C:\Windows\System\JIsjXuR.exe
  C:\Windows\System\JIsjXuR.exe
  2⤵
  PID:7924
- C:\Windows\System\OnNcwfL.exe
  C:\Windows\System\OnNcwfL.exe
  2⤵
  PID:7940
- C:\Windows\System\grjcStg.exe
  C:\Windows\System\grjcStg.exe
  2⤵
  PID:7956
- C:\Windows\System\ZgGwrRT.exe
  C:\Windows\System\ZgGwrRT.exe
  2⤵
  PID:7972
- C:\Windows\System\aUEbDhI.exe
  C:\Windows\System\aUEbDhI.exe
  2⤵
  PID:7988
- C:\Windows\System\PAFGmQJ.exe
  C:\Windows\System\PAFGmQJ.exe
  2⤵
  PID:8004
- C:\Windows\System\opDzYBW.exe
  C:\Windows\System\opDzYBW.exe
  2⤵
  PID:8020
- C:\Windows\System\csuwlYZ.exe
  C:\Windows\System\csuwlYZ.exe
  2⤵
  PID:8036
- C:\Windows\System\iBbCSWX.exe
  C:\Windows\System\iBbCSWX.exe
  2⤵
  PID:8052
- C:\Windows\System\quoroxW.exe
  C:\Windows\System\quoroxW.exe
  2⤵
  PID:8068
- C:\Windows\System\zsZVzXh.exe
  C:\Windows\System\zsZVzXh.exe
  2⤵
  PID:8084
- C:\Windows\System\DJeAEEj.exe
  C:\Windows\System\DJeAEEj.exe
  2⤵
  PID:8100
- C:\Windows\System\NcUtGhg.exe
  C:\Windows\System\NcUtGhg.exe
  2⤵
  PID:8116
- C:\Windows\System\TbVNQJM.exe
  C:\Windows\System\TbVNQJM.exe
  2⤵
  PID:8132
- C:\Windows\System\xuUhaeX.exe
  C:\Windows\System\xuUhaeX.exe
  2⤵
  PID:8148
- C:\Windows\System\rChwLdt.exe
  C:\Windows\System\rChwLdt.exe
  2⤵
  PID:8164
- C:\Windows\System\cZdmcdw.exe
  C:\Windows\System\cZdmcdw.exe
  2⤵
  PID:8180
- C:\Windows\System\MvNlZQW.exe
  C:\Windows\System\MvNlZQW.exe
  2⤵
  PID:7180
- C:\Windows\System\uMtbWmA.exe
  C:\Windows\System\uMtbWmA.exe
  2⤵
  PID:5756
- C:\Windows\System\yxKEyHF.exe
  C:\Windows\System\yxKEyHF.exe
  2⤵
  PID:5676
- C:\Windows\System\CKknycv.exe
  C:\Windows\System\CKknycv.exe
  2⤵
  PID:7040
- C:\Windows\System\rVwWYjQ.exe
  C:\Windows\System\rVwWYjQ.exe
  2⤵
  PID:7208
- C:\Windows\System\YtgfwyV.exe
  C:\Windows\System\YtgfwyV.exe
  2⤵
  PID:5084
- C:\Windows\System\hjwDAZg.exe
  C:\Windows\System\hjwDAZg.exe
  2⤵
  PID:5996
- C:\Windows\System\lvDcYPY.exe
  C:\Windows\System\lvDcYPY.exe
  2⤵
  PID:7336
- C:\Windows\System\MKZJzER.exe
  C:\Windows\System\MKZJzER.exe
  2⤵
  PID:7292
- C:\Windows\System\boqgHcR.exe
  C:\Windows\System\boqgHcR.exe
  2⤵
  PID:7340
- C:\Windows\System\tLPKnFH.exe
  C:\Windows\System\tLPKnFH.exe
  2⤵
  PID:7228
- C:\Windows\System\ooAbWog.exe
  C:\Windows\System\ooAbWog.exe
  2⤵
  PID:7404
- C:\Windows\System\ChtyOfL.exe
  C:\Windows\System\ChtyOfL.exe
  2⤵
  PID:7384
- C:\Windows\System\thNQgnT.exe
  C:\Windows\System\thNQgnT.exe
  2⤵
  PID:7388
- C:\Windows\System\wMdzbkX.exe
  C:\Windows\System\wMdzbkX.exe
  2⤵
  PID:7536
- C:\Windows\System\AtMredR.exe
  C:\Windows\System\AtMredR.exe
  2⤵
  PID:7604
- C:\Windows\System\aYbPgGl.exe
  C:\Windows\System\aYbPgGl.exe
  2⤵
  PID:7668
- C:\Windows\System\hfLPozg.exe
  C:\Windows\System\hfLPozg.exe
  2⤵
  PID:7696
- C:\Windows\System\eGUIwVj.exe
  C:\Windows\System\eGUIwVj.exe
  2⤵
  PID:7768
- C:\Windows\System\zuqlcHD.exe
  C:\Windows\System\zuqlcHD.exe
  2⤵
  PID:7804
- C:\Windows\System\rkvqTeD.exe
  C:\Windows\System\rkvqTeD.exe
  2⤵
  PID:7684
- C:\Windows\System\fJdtXBk.exe
  C:\Windows\System\fJdtXBk.exe
  2⤵
  PID:7784
- C:\Windows\System\XJRGvSE.exe
  C:\Windows\System\XJRGvSE.exe
  2⤵
  PID:7556
- C:\Windows\System\NYcTLef.exe
  C:\Windows\System\NYcTLef.exe
  2⤵
  PID:7820
- C:\Windows\System\ZJKDSax.exe
  C:\Windows\System\ZJKDSax.exe
  2⤵
  PID:7680
- C:\Windows\System\dpNlbdj.exe
  C:\Windows\System\dpNlbdj.exe
  2⤵
  PID:7864
- C:\Windows\System\naGkevP.exe
  C:\Windows\System\naGkevP.exe
  2⤵
  PID:7932
- C:\Windows\System\WRLiSTW.exe
  C:\Windows\System\WRLiSTW.exe
  2⤵
  PID:7848
- C:\Windows\System\NgiPgew.exe
  C:\Windows\System\NgiPgew.exe
  2⤵
  PID:8028
- C:\Windows\System\EukygGz.exe
  C:\Windows\System\EukygGz.exe
  2⤵
  PID:8064
- C:\Windows\System\icUHZkr.exe
  C:\Windows\System\icUHZkr.exe
  2⤵
  PID:8096
- C:\Windows\System\edSYhCb.exe
  C:\Windows\System\edSYhCb.exe
  2⤵
  PID:8124
- C:\Windows\System\AxguUaq.exe
  C:\Windows\System\AxguUaq.exe
  2⤵
  PID:7984
- C:\Windows\System\wJZZUrZ.exe
  C:\Windows\System\wJZZUrZ.exe
  2⤵
  PID:8108
- C:\Windows\System\kNLKjxm.exe
  C:\Windows\System\kNLKjxm.exe
  2⤵
  PID:8140
- C:\Windows\System\SeZomHw.exe
  C:\Windows\System\SeZomHw.exe
  2⤵
  PID:7980
- C:\Windows\System\MVKIxLX.exe
  C:\Windows\System\MVKIxLX.exe
  2⤵
  PID:6440
- C:\Windows\System\QsUYDNy.exe
  C:\Windows\System\QsUYDNy.exe
  2⤵
  PID:5480
- C:\Windows\System\vywaJGA.exe
  C:\Windows\System\vywaJGA.exe
  2⤵
  PID:6152
- C:\Windows\System\csvWFdI.exe
  C:\Windows\System\csvWFdI.exe
  2⤵
  PID:7240
- C:\Windows\System\LkghITz.exe
  C:\Windows\System\LkghITz.exe
  2⤵
  PID:7356
- C:\Windows\System\eSrPQwt.exe
  C:\Windows\System\eSrPQwt.exe
  2⤵
  PID:7372
- C:\Windows\System\ABVpYOr.exe
  C:\Windows\System\ABVpYOr.exe
  2⤵
  PID:7524
- C:\Windows\System\QBDcMtP.exe
  C:\Windows\System\QBDcMtP.exe
  2⤵
  PID:7600
- C:\Windows\System\AexoqeH.exe
  C:\Windows\System\AexoqeH.exe
  2⤵
  PID:7764
- C:\Windows\System\Hzdgxcx.exe
  C:\Windows\System\Hzdgxcx.exe
  2⤵
  PID:7700
- C:\Windows\System\MKuPpqR.exe
  C:\Windows\System\MKuPpqR.exe
  2⤵
  PID:7664
- C:\Windows\System\krqaYiz.exe
  C:\Windows\System\krqaYiz.exe
  2⤵
  PID:7744
- C:\Windows\System\HxPGjcQ.exe
  C:\Windows\System\HxPGjcQ.exe
  2⤵
  PID:7520
- C:\Windows\System\MqlGjEX.exe
  C:\Windows\System\MqlGjEX.exe
  2⤵
  PID:7652
- C:\Windows\System\bNpOEqH.exe
  C:\Windows\System\bNpOEqH.exe
  2⤵
  PID:7916
- C:\Windows\System\tLTBhWB.exe
  C:\Windows\System\tLTBhWB.exe
  2⤵
  PID:7968
- C:\Windows\System\jhTUJoJ.exe
  C:\Windows\System\jhTUJoJ.exe
  2⤵
  PID:8080
- C:\Windows\System\hrsymGM.exe
  C:\Windows\System\hrsymGM.exe
  2⤵
  PID:8160
- C:\Windows\System\MUdhuxR.exe
  C:\Windows\System\MUdhuxR.exe
  2⤵
  PID:8144
- C:\Windows\System\AkXSjsP.exe
  C:\Windows\System\AkXSjsP.exe
  2⤵
  PID:8016
- C:\Windows\System\FksEscB.exe
  C:\Windows\System\FksEscB.exe
  2⤵
  PID:6896
- C:\Windows\System\SLbEuEp.exe
  C:\Windows\System\SLbEuEp.exe
  2⤵
  PID:7572
- C:\Windows\System\mbrhBqW.exe
  C:\Windows\System\mbrhBqW.exe
  2⤵
  PID:7620
- C:\Windows\System\YBhMyqR.exe
  C:\Windows\System\YBhMyqR.exe
  2⤵
  PID:7304
- C:\Windows\System\cmCFAdR.exe
  C:\Windows\System\cmCFAdR.exe
  2⤵
  PID:7508
- C:\Windows\System\PgVmAQr.exe
  C:\Windows\System\PgVmAQr.exe
  2⤵
  PID:1712
- C:\Windows\System\iOOzngc.exe
  C:\Windows\System\iOOzngc.exe
  2⤵
  PID:7884
- C:\Windows\System\iBRbDTO.exe
  C:\Windows\System\iBRbDTO.exe
  2⤵
  PID:6832
- C:\Windows\System\nRcxopK.exe
  C:\Windows\System\nRcxopK.exe
  2⤵
  PID:7952
- C:\Windows\System\rEtvZWf.exe
  C:\Windows\System\rEtvZWf.exe
  2⤵
  PID:7308
- C:\Windows\System\nNFAtRF.exe
  C:\Windows\System\nNFAtRF.exe
  2⤵
  PID:7408
- C:\Windows\System\SMJhTIB.exe
  C:\Windows\System\SMJhTIB.exe
  2⤵
  PID:7588
- C:\Windows\System\jTELjJF.exe
  C:\Windows\System\jTELjJF.exe
  2⤵
  PID:8000
- C:\Windows\System\smWaMBQ.exe
  C:\Windows\System\smWaMBQ.exe
  2⤵
  PID:6476
- C:\Windows\System\NUTtRvy.exe
  C:\Windows\System\NUTtRvy.exe
  2⤵
  PID:7120
- C:\Windows\System\KpTESGo.exe
  C:\Windows\System\KpTESGo.exe
  2⤵
  PID:7904
- C:\Windows\System\pAJwzxY.exe
  C:\Windows\System\pAJwzxY.exe
  2⤵
  PID:8092
- C:\Windows\System\vBgCJbX.exe
  C:\Windows\System\vBgCJbX.exe
  2⤵
  PID:8208
- C:\Windows\System\JBfXIex.exe
  C:\Windows\System\JBfXIex.exe
  2⤵
  PID:8224
- C:\Windows\System\CfDIQYZ.exe
  C:\Windows\System\CfDIQYZ.exe
  2⤵
  PID:8240
- C:\Windows\System\FKaujmy.exe
  C:\Windows\System\FKaujmy.exe
  2⤵
  PID:8256
- C:\Windows\System\DyESGtc.exe
  C:\Windows\System\DyESGtc.exe
  2⤵
  PID:8272
- C:\Windows\System\TftChPv.exe
  C:\Windows\System\TftChPv.exe
  2⤵
  PID:8288
- C:\Windows\System\kfgkyaK.exe
  C:\Windows\System\kfgkyaK.exe
  2⤵
  PID:8304
- C:\Windows\System\FxTaFGp.exe
  C:\Windows\System\FxTaFGp.exe
  2⤵
  PID:8320
- C:\Windows\System\DJAjHmK.exe
  C:\Windows\System\DJAjHmK.exe
  2⤵
  PID:8336
- C:\Windows\System\EAnuLdY.exe
  C:\Windows\System\EAnuLdY.exe
  2⤵
  PID:8352
- C:\Windows\System\dxEiNNB.exe
  C:\Windows\System\dxEiNNB.exe
  2⤵
  PID:8368
- C:\Windows\System\GyYILwQ.exe
  C:\Windows\System\GyYILwQ.exe
  2⤵
  PID:8384
- C:\Windows\System\lWrRaQI.exe
  C:\Windows\System\lWrRaQI.exe
  2⤵
  PID:8404
- C:\Windows\System\nUVrafq.exe
  C:\Windows\System\nUVrafq.exe
  2⤵
  PID:8420
- C:\Windows\System\ngXKBHQ.exe
  C:\Windows\System\ngXKBHQ.exe
  2⤵
  PID:8436
- C:\Windows\System\aPBGVrI.exe
  C:\Windows\System\aPBGVrI.exe
  2⤵
  PID:8452
- C:\Windows\System\kBrAvNQ.exe
  C:\Windows\System\kBrAvNQ.exe
  2⤵
  PID:8468
- C:\Windows\System\roAbOFt.exe
  C:\Windows\System\roAbOFt.exe
  2⤵
  PID:8488
- C:\Windows\System\xcJKQTB.exe
  C:\Windows\System\xcJKQTB.exe
  2⤵
  PID:8504
- C:\Windows\System\EpFRUeD.exe
  C:\Windows\System\EpFRUeD.exe
  2⤵
  PID:8520
- C:\Windows\System\tUomWxM.exe
  C:\Windows\System\tUomWxM.exe
  2⤵
  PID:8536
- C:\Windows\System\LkMhAlX.exe
  C:\Windows\System\LkMhAlX.exe
  2⤵
  PID:8552
- C:\Windows\System\dMMDrIg.exe
  C:\Windows\System\dMMDrIg.exe
  2⤵
  PID:8568
- C:\Windows\System\ghIeJrs.exe
  C:\Windows\System\ghIeJrs.exe
  2⤵
  PID:8584
- C:\Windows\System\HEovdjn.exe
  C:\Windows\System\HEovdjn.exe
  2⤵
  PID:8600
- C:\Windows\System\YbjJTVW.exe
  C:\Windows\System\YbjJTVW.exe
  2⤵
  PID:8616
- C:\Windows\System\ZhliVxa.exe
  C:\Windows\System\ZhliVxa.exe
  2⤵
  PID:8632
- C:\Windows\System\kxfBlvW.exe
  C:\Windows\System\kxfBlvW.exe
  2⤵
  PID:8648
- C:\Windows\System\RyzUQLz.exe
  C:\Windows\System\RyzUQLz.exe
  2⤵
  PID:8664
- C:\Windows\System\whstIrN.exe
  C:\Windows\System\whstIrN.exe
  2⤵
  PID:8680
- C:\Windows\System\VgHWICV.exe
  C:\Windows\System\VgHWICV.exe
  2⤵
  PID:8696
- C:\Windows\System\DzDucVF.exe
  C:\Windows\System\DzDucVF.exe
  2⤵
  PID:8712
- C:\Windows\System\WcQlWVH.exe
  C:\Windows\System\WcQlWVH.exe
  2⤵
  PID:8728
- C:\Windows\System\GCcYYfs.exe
  C:\Windows\System\GCcYYfs.exe
  2⤵
  PID:8744
- C:\Windows\System\DzPjEgf.exe
  C:\Windows\System\DzPjEgf.exe
  2⤵
  PID:8760
- C:\Windows\System\pyQlGeF.exe
  C:\Windows\System\pyQlGeF.exe
  2⤵
  PID:8776
- C:\Windows\System\hRgxGTe.exe
  C:\Windows\System\hRgxGTe.exe
  2⤵
  PID:8792
- C:\Windows\System\BmdVvDO.exe
  C:\Windows\System\BmdVvDO.exe
  2⤵
  PID:8808
- C:\Windows\System\RVdVLoD.exe
  C:\Windows\System\RVdVLoD.exe
  2⤵
  PID:8824
- C:\Windows\System\aXRROMW.exe
  C:\Windows\System\aXRROMW.exe
  2⤵
  PID:8840
- C:\Windows\System\wQkstMw.exe
  C:\Windows\System\wQkstMw.exe
  2⤵
  PID:8856
- C:\Windows\System\wIUAPUd.exe
  C:\Windows\System\wIUAPUd.exe
  2⤵
  PID:8872
- C:\Windows\System\mTUMxNf.exe
  C:\Windows\System\mTUMxNf.exe
  2⤵
  PID:8888
- C:\Windows\System\xVoVeZT.exe
  C:\Windows\System\xVoVeZT.exe
  2⤵
  PID:8904
- C:\Windows\System\TqbbTxr.exe
  C:\Windows\System\TqbbTxr.exe
  2⤵
  PID:8920
- C:\Windows\System\UxWkfaa.exe
  C:\Windows\System\UxWkfaa.exe
  2⤵
  PID:8936
- C:\Windows\System\uxGJlLO.exe
  C:\Windows\System\uxGJlLO.exe
  2⤵
  PID:8952
- C:\Windows\System\FWdivCJ.exe
  C:\Windows\System\FWdivCJ.exe
  2⤵
  PID:8968
- C:\Windows\System\dcReOOn.exe
  C:\Windows\System\dcReOOn.exe
  2⤵
  PID:8984
- C:\Windows\System\AdPCEkL.exe
  C:\Windows\System\AdPCEkL.exe
  2⤵
  PID:9000
- C:\Windows\System\gigcZZb.exe
  C:\Windows\System\gigcZZb.exe
  2⤵
  PID:9016
- C:\Windows\System\YffoiKj.exe
  C:\Windows\System\YffoiKj.exe
  2⤵
  PID:9032
- C:\Windows\System\XjgaeNM.exe
  C:\Windows\System\XjgaeNM.exe
  2⤵
  PID:9048
- C:\Windows\System\lqysyWI.exe
  C:\Windows\System\lqysyWI.exe
  2⤵
  PID:9064
- C:\Windows\System\DvxoMWW.exe
  C:\Windows\System\DvxoMWW.exe
  2⤵
  PID:9080
- C:\Windows\System\nDkNWZq.exe
  C:\Windows\System\nDkNWZq.exe
  2⤵
  PID:9096
- C:\Windows\System\PWqWxrV.exe
  C:\Windows\System\PWqWxrV.exe
  2⤵
  PID:9112
- C:\Windows\System\XAFadfj.exe
  C:\Windows\System\XAFadfj.exe
  2⤵
  PID:9128
- C:\Windows\System\XzsJiXw.exe
  C:\Windows\System\XzsJiXw.exe
  2⤵
  PID:9144
- C:\Windows\System\KVJrfgR.exe
  C:\Windows\System\KVJrfgR.exe
  2⤵
  PID:9160
- C:\Windows\System\BHuCnCL.exe
  C:\Windows\System\BHuCnCL.exe
  2⤵
  PID:9176
- C:\Windows\System\zVgJKjo.exe
  C:\Windows\System\zVgJKjo.exe
  2⤵
  PID:9192
- C:\Windows\System\emoshhN.exe
  C:\Windows\System\emoshhN.exe
  2⤵
  PID:9208
- C:\Windows\System\MQXATYC.exe
  C:\Windows\System\MQXATYC.exe
  2⤵
  PID:8216
- C:\Windows\System\jZpsEbq.exe
  C:\Windows\System\jZpsEbq.exe
  2⤵
  PID:8284
- C:\Windows\System\kVskvXd.exe
  C:\Windows\System\kVskvXd.exe
  2⤵
  PID:7244
- C:\Windows\System\ifnEhqr.exe
  C:\Windows\System\ifnEhqr.exe
  2⤵
  PID:8236
- C:\Windows\System\fqLdaOv.exe
  C:\Windows\System\fqLdaOv.exe
  2⤵
  PID:8300
- C:\Windows\System\bsOCWOa.exe
  C:\Windows\System\bsOCWOa.exe
  2⤵
  PID:8344
- C:\Windows\System\OmOHDwk.exe
  C:\Windows\System\OmOHDwk.exe
  2⤵
  PID:8360
- C:\Windows\System\XJspTQZ.exe
  C:\Windows\System\XJspTQZ.exe
  2⤵
  PID:8396
- C:\Windows\System\cFFKZpV.exe
  C:\Windows\System\cFFKZpV.exe
  2⤵
  PID:8432
- C:\Windows\System\EKlqwSC.exe
  C:\Windows\System\EKlqwSC.exe
  2⤵
  PID:8448
- C:\Windows\System\kpGoadP.exe
  C:\Windows\System\kpGoadP.exe
  2⤵
  PID:8516
- C:\Windows\System\glbcVKX.exe
  C:\Windows\System\glbcVKX.exe
  2⤵
  PID:8548
- C:\Windows\System\UnuZIPr.exe
  C:\Windows\System\UnuZIPr.exe
  2⤵
  PID:8580
- C:\Windows\System\gvbHgGu.exe
  C:\Windows\System\gvbHgGu.exe
  2⤵
  PID:8564
- C:\Windows\System\oLsvlWQ.exe
  C:\Windows\System\oLsvlWQ.exe
  2⤵
  PID:8644
- C:\Windows\System\IfHxgUz.exe
  C:\Windows\System\IfHxgUz.exe
  2⤵
  PID:8704
- C:\Windows\System\lFVzkao.exe
  C:\Windows\System\lFVzkao.exe
  2⤵
  PID:8740
- C:\Windows\System\igWujxX.exe
  C:\Windows\System\igWujxX.exe
  2⤵
  PID:8656
- C:\Windows\System\ztvFfkB.exe
  C:\Windows\System\ztvFfkB.exe
  2⤵
  PID:8692
- C:\Windows\System\GoGXlGF.exe
  C:\Windows\System\GoGXlGF.exe
  2⤵
  PID:8896
- C:\Windows\System\OCYHEDh.exe
  C:\Windows\System\OCYHEDh.exe
  2⤵
  PID:8932
- C:\Windows\System\bfGJXIV.exe
  C:\Windows\System\bfGJXIV.exe
  2⤵
  PID:8724
- C:\Windows\System\BYbsDAG.exe
  C:\Windows\System\BYbsDAG.exe
  2⤵
  PID:8788
- C:\Windows\System\EmaGbnn.exe
  C:\Windows\System\EmaGbnn.exe
  2⤵
  PID:8848
- C:\Windows\System\wudPZyi.exe
  C:\Windows\System\wudPZyi.exe
  2⤵
  PID:8912
- C:\Windows\System\MCHhMMs.exe
  C:\Windows\System\MCHhMMs.exe
  2⤵
  PID:8996
- C:\Windows\System\bXngvpl.exe
  C:\Windows\System\bXngvpl.exe
  2⤵
  PID:9060
- C:\Windows\System\goEgdll.exe
  C:\Windows\System\goEgdll.exe
  2⤵
  PID:9120
- C:\Windows\System\eXIZZVu.exe
  C:\Windows\System\eXIZZVu.exe
  2⤵
  PID:8980
- C:\Windows\System\PyclIUM.exe
  C:\Windows\System\PyclIUM.exe
  2⤵
  PID:9072
- C:\Windows\System\SpSyTXx.exe
  C:\Windows\System\SpSyTXx.exe
  2⤵
  PID:9156
- C:\Windows\System\lKIKgHY.exe
  C:\Windows\System\lKIKgHY.exe
  2⤵
  PID:9168
- C:\Windows\System\cvstjqs.exe
  C:\Windows\System\cvstjqs.exe
  2⤵
  PID:7636
- C:\Windows\System\loqGqoQ.exe
  C:\Windows\System\loqGqoQ.exe
  2⤵
  PID:8268
- C:\Windows\System\zpTCyRf.exe
  C:\Windows\System\zpTCyRf.exe
  2⤵
  PID:8376
- C:\Windows\System\fVxbTFy.exe
  C:\Windows\System\fVxbTFy.exe
  2⤵
  PID:8428
- C:\Windows\System\pdnKvyR.exe
  C:\Windows\System\pdnKvyR.exe
  2⤵
  PID:8232
- C:\Windows\System\LXpMuFg.exe
  C:\Windows\System\LXpMuFg.exe
  2⤵
  PID:8364
- C:\Windows\System\HdilddW.exe
  C:\Windows\System\HdilddW.exe
  2⤵
  PID:8532
- C:\Windows\System\ZWnozOY.exe
  C:\Windows\System\ZWnozOY.exe
  2⤵
  PID:8596
- C:\Windows\System\arkWTOk.exe
  C:\Windows\System\arkWTOk.exe
  2⤵
  PID:8560
- C:\Windows\System\nsqiMUY.exe
  C:\Windows\System\nsqiMUY.exe
  2⤵
  PID:8804
- C:\Windows\System\sKHiXHi.exe
  C:\Windows\System\sKHiXHi.exe
  2⤵
  PID:8864
- C:\Windows\System\sDGtljB.exe
  C:\Windows\System\sDGtljB.exe
  2⤵
  PID:8820
- C:\Windows\System\uzSWUPf.exe
  C:\Windows\System\uzSWUPf.exe
  2⤵
  PID:9028
- C:\Windows\System\DZIRHWr.exe
  C:\Windows\System\DZIRHWr.exe
  2⤵
  PID:9124
- C:\Windows\System\SvGwnAO.exe
  C:\Windows\System\SvGwnAO.exe
  2⤵
  PID:8688
- C:\Windows\System\alecwTC.exe
  C:\Windows\System\alecwTC.exe
  2⤵
  PID:8252
- C:\Windows\System\iFNlhKd.exe
  C:\Windows\System\iFNlhKd.exe
  2⤵
  PID:9108
- C:\Windows\System\upoYHgr.exe
  C:\Windows\System\upoYHgr.exe
  2⤵
  PID:9092
- C:\Windows\System\wFgecHf.exe
  C:\Windows\System\wFgecHf.exe
  2⤵
  PID:8416
- C:\Windows\System\hUquQHw.exe
  C:\Windows\System\hUquQHw.exe
  2⤵
  PID:8316
- C:\Windows\System\cnoExfs.exe
  C:\Windows\System\cnoExfs.exe
  2⤵
  PID:8512
- C:\Windows\System\TOqTCVR.exe
  C:\Windows\System\TOqTCVR.exe
  2⤵
  PID:8800
- C:\Windows\System\yHrukGD.exe
  C:\Windows\System\yHrukGD.exe
  2⤵
  PID:8884
- C:\Windows\System\fYVojFA.exe
  C:\Windows\System\fYVojFA.exe
  2⤵
  PID:9188
- C:\Windows\System\QPDIwQN.exe
  C:\Windows\System\QPDIwQN.exe
  2⤵
  PID:9044
- C:\Windows\System\yzyuWMk.exe
  C:\Windows\System\yzyuWMk.exe
  2⤵
  PID:9200
- C:\Windows\System\KtlNGyq.exe
  C:\Windows\System\KtlNGyq.exe
  2⤵
  PID:8736
- C:\Windows\System\FWdPZpb.exe
  C:\Windows\System\FWdPZpb.exe
  2⤵
  PID:8944
- C:\Windows\System\AICPwwu.exe
  C:\Windows\System\AICPwwu.exe
  2⤵
  PID:8880
- C:\Windows\System\wwdEwOu.exe
  C:\Windows\System\wwdEwOu.exe
  2⤵
  PID:9012
- C:\Windows\System\uHPvGbr.exe
  C:\Windows\System\uHPvGbr.exe
  2⤵
  PID:8500
- C:\Windows\System\RGsUWpx.exe
  C:\Windows\System\RGsUWpx.exe
  2⤵
  PID:8380
- C:\Windows\System\robKOqx.exe
  C:\Windows\System\robKOqx.exe
  2⤵
  PID:9228
- C:\Windows\System\ZTTtAIA.exe
  C:\Windows\System\ZTTtAIA.exe
  2⤵
  PID:9244
- C:\Windows\System\DPNEDCK.exe
  C:\Windows\System\DPNEDCK.exe
  2⤵
  PID:9260
- C:\Windows\System\yDyptCN.exe
  C:\Windows\System\yDyptCN.exe
  2⤵
  PID:9276
- C:\Windows\System\JQEMJqa.exe
  C:\Windows\System\JQEMJqa.exe
  2⤵
  PID:9292
- C:\Windows\System\IWuDVNk.exe
  C:\Windows\System\IWuDVNk.exe
  2⤵
  PID:9308
- C:\Windows\System\DDCWoMx.exe
  C:\Windows\System\DDCWoMx.exe
  2⤵
  PID:9324
- C:\Windows\System\REtRKWG.exe
  C:\Windows\System\REtRKWG.exe
  2⤵
  PID:9340
- C:\Windows\System\UDJsEyV.exe
  C:\Windows\System\UDJsEyV.exe
  2⤵
  PID:9356
- C:\Windows\System\heVOaCQ.exe
  C:\Windows\System\heVOaCQ.exe
  2⤵
  PID:9372
- C:\Windows\System\sotRqWB.exe
  C:\Windows\System\sotRqWB.exe
  2⤵
  PID:9388
- C:\Windows\System\NRZwhtl.exe
  C:\Windows\System\NRZwhtl.exe
  2⤵
  PID:9404
- C:\Windows\System\JXERSbc.exe
  C:\Windows\System\JXERSbc.exe
  2⤵
  PID:9420
- C:\Windows\System\stdqufb.exe
  C:\Windows\System\stdqufb.exe
  2⤵
  PID:9436
- C:\Windows\System\ebscOkr.exe
  C:\Windows\System\ebscOkr.exe
  2⤵
  PID:9452
- C:\Windows\System\gEvwnjR.exe
  C:\Windows\System\gEvwnjR.exe
  2⤵
  PID:9468
- C:\Windows\System\pFcFlrT.exe
  C:\Windows\System\pFcFlrT.exe
  2⤵
  PID:9488
- C:\Windows\System\HaEwBZE.exe
  C:\Windows\System\HaEwBZE.exe
  2⤵
  PID:9504
- C:\Windows\System\FkWfibM.exe
  C:\Windows\System\FkWfibM.exe
  2⤵
  PID:9520
- C:\Windows\System\UgkdZbV.exe
  C:\Windows\System\UgkdZbV.exe
  2⤵
  PID:9536
- C:\Windows\System\LRzHSJp.exe
  C:\Windows\System\LRzHSJp.exe
  2⤵
  PID:9552
- C:\Windows\System\DbXgXdS.exe
  C:\Windows\System\DbXgXdS.exe
  2⤵
  PID:9568
- C:\Windows\System\ImfxNtO.exe
  C:\Windows\System\ImfxNtO.exe
  2⤵
  PID:9584
- C:\Windows\System\NaVMUWk.exe
  C:\Windows\System\NaVMUWk.exe
  2⤵
  PID:9600
- C:\Windows\System\mMVDLYc.exe
  C:\Windows\System\mMVDLYc.exe
  2⤵
  PID:9616
- C:\Windows\System\gGluEmi.exe
  C:\Windows\System\gGluEmi.exe
  2⤵
  PID:9632
- C:\Windows\System\yuvOlKW.exe
  C:\Windows\System\yuvOlKW.exe
  2⤵
  PID:9648
- C:\Windows\System\tfMxPsU.exe
  C:\Windows\System\tfMxPsU.exe
  2⤵
  PID:9664
- C:\Windows\System\YYRZrCB.exe
  C:\Windows\System\YYRZrCB.exe
  2⤵
  PID:9680
- C:\Windows\System\maojYEV.exe
  C:\Windows\System\maojYEV.exe
  2⤵
  PID:9696
- C:\Windows\System\CZuEIWd.exe
  C:\Windows\System\CZuEIWd.exe
  2⤵
  PID:9712
- C:\Windows\System\brJClqB.exe
  C:\Windows\System\brJClqB.exe
  2⤵
  PID:9728
- C:\Windows\System\envSqNy.exe
  C:\Windows\System\envSqNy.exe
  2⤵
  PID:9744
- C:\Windows\System\DwTDLPv.exe
  C:\Windows\System\DwTDLPv.exe
  2⤵
  PID:9760
- C:\Windows\System\cnigcMM.exe
  C:\Windows\System\cnigcMM.exe
  2⤵
  PID:9776
- C:\Windows\System\krMlBJO.exe
  C:\Windows\System\krMlBJO.exe
  2⤵
  PID:9792
- C:\Windows\System\nbCzdev.exe
  C:\Windows\System\nbCzdev.exe
  2⤵
  PID:9808
- C:\Windows\System\bmkIlKq.exe
  C:\Windows\System\bmkIlKq.exe
  2⤵
  PID:9824
- C:\Windows\System\rCpaJGr.exe
  C:\Windows\System\rCpaJGr.exe
  2⤵
  PID:9840
- C:\Windows\System\ttlKwUY.exe
  C:\Windows\System\ttlKwUY.exe
  2⤵
  PID:9860
- C:\Windows\System\bqxNYri.exe
  C:\Windows\System\bqxNYri.exe
  2⤵
  PID:9876
- C:\Windows\System\ivdbsEx.exe
  C:\Windows\System\ivdbsEx.exe
  2⤵
  PID:9892
- C:\Windows\System\wjuXcOQ.exe
  C:\Windows\System\wjuXcOQ.exe
  2⤵
  PID:9908
- C:\Windows\System\TEDYMAP.exe
  C:\Windows\System\TEDYMAP.exe
  2⤵
  PID:9924
- C:\Windows\System\rsQTOdB.exe
  C:\Windows\System\rsQTOdB.exe
  2⤵
  PID:9940
- C:\Windows\System\zGjuayq.exe
  C:\Windows\System\zGjuayq.exe
  2⤵
  PID:9956
- C:\Windows\System\ZxrqGiG.exe
  C:\Windows\System\ZxrqGiG.exe
  2⤵
  PID:9972
- C:\Windows\System\ywmSxnU.exe
  C:\Windows\System\ywmSxnU.exe
  2⤵
  PID:9988
- C:\Windows\System\hprmqBA.exe
  C:\Windows\System\hprmqBA.exe
  2⤵
  PID:10004
- C:\Windows\System\fIiypcm.exe
  C:\Windows\System\fIiypcm.exe
  2⤵
  PID:10020
- C:\Windows\System\YfNStng.exe
  C:\Windows\System\YfNStng.exe
  2⤵
  PID:10036
- C:\Windows\System\rDBppga.exe
  C:\Windows\System\rDBppga.exe
  2⤵
  PID:10052
- C:\Windows\System\rRRGyhX.exe
  C:\Windows\System\rRRGyhX.exe
  2⤵
  PID:10068
- C:\Windows\System\xSWBynW.exe
  C:\Windows\System\xSWBynW.exe
  2⤵
  PID:10084
- C:\Windows\System\HtjORtj.exe
  C:\Windows\System\HtjORtj.exe
  2⤵
  PID:10100
- C:\Windows\System\GsKcSgw.exe
  C:\Windows\System\GsKcSgw.exe
  2⤵
  PID:10116
- C:\Windows\System\uKMkYqt.exe
  C:\Windows\System\uKMkYqt.exe
  2⤵
  PID:10132
- C:\Windows\System\UTLNtaS.exe
  C:\Windows\System\UTLNtaS.exe
  2⤵
  PID:10148
- C:\Windows\System\gtJHUKE.exe
  C:\Windows\System\gtJHUKE.exe
  2⤵
  PID:10164
- C:\Windows\System\sGkajdu.exe
  C:\Windows\System\sGkajdu.exe
  2⤵
  PID:10180
- C:\Windows\System\uPfyCYC.exe
  C:\Windows\System\uPfyCYC.exe
  2⤵
  PID:10196
- C:\Windows\System\UTObRhV.exe
  C:\Windows\System\UTObRhV.exe
  2⤵
  PID:10212
- C:\Windows\System\OSsulpx.exe
  C:\Windows\System\OSsulpx.exe
  2⤵
  PID:10228
- C:\Windows\System\HUhvoZD.exe
  C:\Windows\System\HUhvoZD.exe
  2⤵
  PID:8484
- C:\Windows\System\UJZeYbc.exe
  C:\Windows\System\UJZeYbc.exe
  2⤵
  PID:7420
- C:\Windows\System\DrcFmFE.exe
  C:\Windows\System\DrcFmFE.exe
  2⤵
  PID:9240
- C:\Windows\System\dkOvhUq.exe
  C:\Windows\System\dkOvhUq.exe
  2⤵
  PID:9268
- C:\Windows\System\QwHkFqC.exe
  C:\Windows\System\QwHkFqC.exe
  2⤵
  PID:9320
- C:\Windows\System\VdhTJHI.exe
  C:\Windows\System\VdhTJHI.exe
  2⤵
  PID:9396
- C:\Windows\System\qtFWQHu.exe
  C:\Windows\System\qtFWQHu.exe
  2⤵
  PID:9428
- C:\Windows\System\xvAqkzh.exe
  C:\Windows\System\xvAqkzh.exe
  2⤵
  PID:9368
- C:\Windows\System\CLZRZZw.exe
  C:\Windows\System\CLZRZZw.exe
  2⤵
  PID:9444
- C:\Windows\System\ydDjyHZ.exe
  C:\Windows\System\ydDjyHZ.exe
  2⤵
  PID:9480
- C:\Windows\System\xQOVAzV.exe
  C:\Windows\System\xQOVAzV.exe
  2⤵
  PID:9496
- C:\Windows\System\DCEaIUM.exe
  C:\Windows\System\DCEaIUM.exe
  2⤵
  PID:9548
- C:\Windows\System\uvxGDfP.exe
  C:\Windows\System\uvxGDfP.exe
  2⤵
  PID:9532
- C:\Windows\System\JVeWpXH.exe
  C:\Windows\System\JVeWpXH.exe
  2⤵
  PID:9560
- C:\Windows\System\hDJvzfE.exe
  C:\Windows\System\hDJvzfE.exe
  2⤵
  PID:9672
- C:\Windows\System\RcTebht.exe
  C:\Windows\System\RcTebht.exe
  2⤵
  PID:9736
- C:\Windows\System\zcOGwlA.exe
  C:\Windows\System\zcOGwlA.exe
  2⤵
  PID:9800
- C:\Windows\System\SNJxajP.exe
  C:\Windows\System\SNJxajP.exe
  2⤵
  PID:9624
- C:\Windows\System\zirCLzo.exe
  C:\Windows\System\zirCLzo.exe
  2⤵
  PID:9756
- C:\Windows\System\fWtJNTs.exe
  C:\Windows\System\fWtJNTs.exe
  2⤵
  PID:9752
- C:\Windows\System\XhcRgDk.exe
  C:\Windows\System\XhcRgDk.exe
  2⤵
  PID:9852
- C:\Windows\System\rfiURPX.exe
  C:\Windows\System\rfiURPX.exe
  2⤵
  PID:9836
- C:\Windows\System\jHeyfAb.exe
  C:\Windows\System\jHeyfAb.exe
  2⤵
  PID:9904
- C:\Windows\System\gcKMNSe.exe
  C:\Windows\System\gcKMNSe.exe
  2⤵
  PID:9964
- C:\Windows\System\qJLyJqA.exe
  C:\Windows\System\qJLyJqA.exe
  2⤵
  PID:9948
- C:\Windows\System\kWnbFpq.exe
  C:\Windows\System\kWnbFpq.exe
  2⤵
  PID:10032
- C:\Windows\System\YZMTFAb.exe
  C:\Windows\System\YZMTFAb.exe
  2⤵
  PID:10096

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AILDyZA.exe

Filesize
1.7MB

MD5
88b696f7f6ee5a12fcb5ba84c66382c7

SHA1
ab9dc4f5c58e5ee13a8638e046930932fe31a4bc

SHA256
ddc8c1e016da462a7d22d5c82e63be6cb36548199554d1133b6b5ecb99b26624

SHA512
ba588ab887b5fe8935d2eee2d92e8a965404110a65cf039b956455b04e38f4e6727c0c9e236f8d6a90c7d0cf598ce8dd126571b35238ba2bd8aaecd131f71987

Download Submit
C:\Windows\system\FBBEVhm.exe

Filesize
1.7MB

MD5
df2a06f72a2b84921df52fae094ec1ff

SHA1
b7740a4eb6b0a86eb8ef34b1e3beeb19683c39b6

SHA256
49e91dc61c208d10731b8fb454a38caa33faf53d3d378e4897169ff9424f6a39

SHA512
1b88d5834688abb95f7f444ab41aa893612603e765bd29a7268d048d6d22a6b9319472e3494a50a02ecfc5df805a9c15014c0a6a4689f517be0935d5bae21424

Download Submit
C:\Windows\system\KzQGHVE.exe

Filesize
1.7MB

MD5
d8d408c33e2eec86f9a69651741bbc7e

SHA1
b2184fe1a9de7fc94cfa5910e392d468469b209d

SHA256
3adaa0629a4e4432b7743a1a17f6ecae3ee9e3b2ec7162d5bb960aa8186f9a63

SHA512
327055736ed5951ca8945c6f46d998a2ff7bd4c61593ff43e2b325becd6662c9ca9fdc5e2d4c0856eb6589268af7e0eff8b01c151fd7812d0d9085354c1d9b77

Download Submit
C:\Windows\system\LLAjuTO.exe

Filesize
1.7MB

MD5
b05accd4b4da9785da82dc638130e4b0

SHA1
1a840baf1d5a35d27dd4b571827bdc7e18c82e0b

SHA256
1c9cf989205bca6f4bbb55a4960f00b7b16fb1f3bcd1d4d5c954f625368e50de

SHA512
f992dc9367b4c8a75d61eb0abf73cb4c79e9ca5699a695c8620dd3f9e75bbba6bfee275bb6d1b6931a6a4c0a662a811e4b2316c038f5bc2cb47ba6c92e98354a

Download Submit
C:\Windows\system\OEktBCM.exe

Filesize
1.7MB

MD5
00af9f950059bc98d5f4fcd4cf7a76a2

SHA1
7fa9fdcadfa2084babaed746ba2c139ce827f2ba

SHA256
8194adabb4530c21afa8890d8dca1933683c7839207eac93772f9aa60a15a8c1

SHA512
99123a00500e3791dd7bac744380a81ba5ad3e5bdacf968adf03238b71da70d4bf1d74a7a3da9d3583aef7c9a2a2ab595c7762bfb2071765d9610453d687ded0

Download Submit
C:\Windows\system\QSTQeSJ.exe

Filesize
1.7MB

MD5
89d190089fb50b168a211ca32cad47dc

SHA1
9d95bc3c5cb7c1604747232025fa94e3178b15f4

SHA256
a7fbcfc27baa3981929c8346ff269611d55155dfce70cef4a529e63bf2fed8e0

SHA512
abaaed37a02df0421c95a0afc3bd9fd05440fd6541ce5663a7fa7e17d687e17623516f370ab0ac23f160bd34d14011b985d5c04b77d0ca566ccdcf1538b51f80

Download Submit
C:\Windows\system\QfQtIOH.exe

Filesize
1.7MB

MD5
cd49e433a739dfc249f4230a8d534c81

SHA1
21596dd1244035441c93e762348993d20296faf6

SHA256
091489f2fcc94f05c6b9a47cbb2a91062cd498e472f6ec934c55965bb6e3caf8

SHA512
19faf11aacaf1b38b00dcf7c24e963ce7a64893fb1962534d8fac36123ccca06d0f25bf5f9dab245332bcae8dc8dbecd9290606c14f28ecab2162501fe0ecfa3

Download Submit
C:\Windows\system\VqwovNM.exe

Filesize
1.7MB

MD5
9a274870bb162a022b4d526d6dd43476

SHA1
20a6be1a805f03274167b46d704caac61fffeeef

SHA256
e0bbe04df0f0e2914576a42ee3f0e440c4cb9ed2f0fe44ab4db19a82419172dc

SHA512
3faf9512aa3aa8c2f02aeb94f0579966d1895fc16a358f6b27ccdbd52a45264c489bda544cd926f8196654b8c8030b7f414431809fddcb302736457d8eeeab81

Download Submit
C:\Windows\system\XEVcMel.exe

Filesize
1.7MB

MD5
1c1666e0bc976f2ac4421bd9cd7fbbc4

SHA1
edbc1c24d6f30111c8953deea2087afda50f366c

SHA256
7f98625768047c8bae9a35f71b3212bf4ba6ceb7d27fc2925df73e815c807da8

SHA512
5d78a271680b1be44b50bf776b4cf84f6c4337a7be3bb1490416e05df11310683b247bd1b8f8bc7e5c8d6a8e845384e43bcf5f9625102cdc56af908361306972

Download Submit
C:\Windows\system\XyvqHLO.exe

Filesize
1.7MB

MD5
e785cc42358c825876ae859c3580f7fa

SHA1
8ab45b214a9dd94ff2b949aa2835739d157fe1b8

SHA256
3872f1521354190fc0ec27e12bdeaed6d39a7f623cc242ecc2f00b421e3c0002

SHA512
d56b19ab0c997cd87883ef69353c4407b8dfe58b52f242ecd02663d182fb5994a2515aa89831862144e11463b1fc0a1db402fd82c8c132c23b861aeb9d435ecd

Download Submit
C:\Windows\system\YbuSnsZ.exe

Filesize
1.7MB

MD5
fc0c5895379c3c2b016092ec011ec4a5

SHA1
571cf6070975bd1de6425860ea77d1483935f477

SHA256
23e497a1758c62bf39744fe42c9021dd399e34b79d7a6832577d00c4b637fb2a

SHA512
7882d4ff5d6e148b1dae3978faa6a8792980e84d4d0bc67ac3ea450742123ae6ba288cee466ec9535f3b6563d8dffe7639103dba5310305a7e8461f6266308e7

Download Submit
C:\Windows\system\gAZXlVo.exe

Filesize
1.7MB

MD5
f044a8e7225726f85caa154928690332

SHA1
620e9be33300950b547ed0d9a63e7f128ca2bbea

SHA256
6767ef96077b52094084c34111643f88062f137ffecccf7b7905d91db64ecda0

SHA512
ef18f6b45d555b11b5ad0accb0bf388e05840b76687b9f1de58880d0f2a7bbd69727cba0e07ca3de5ff84aba38e3fb560e4a14399b3508a0390186f4c88c6335

Download Submit
C:\Windows\system\igLVQZd.exe

Filesize
1.7MB

MD5
4c2cc5a15203365fd608ace05c533451

SHA1
6f591a65222dadbc02616b7a34009e3c800e9420

SHA256
5ced61be1fc1c29935b951d8fd515233d05e138c28b57e38163a9a0a2d6a2591

SHA512
03a270d4c5fb16a6bc1f0ea77a65787fb9d05a036d6660c37a9a0907623da4caecd20dff102b74706fa452ad560c113e174612bcfa0f63d0f704eacab979bacd

Download Submit
C:\Windows\system\lHpeOIf.exe

Filesize
1.7MB

MD5
8aa31683cd9ef7e73c7e72bbdc923a6d

SHA1
8ba2d59c91dabf3e23a50ec212140d8ad03a6449

SHA256
ec25b4e8bd3d07cd9a50521d44850d5430c843b22deed7eebc2ca100f0546b57

SHA512
5ec0aed7496806e2a89c87e7832b25ceef072a15c276f4bf43153e1372969864efee61345c986322226000e3880156234403893e8968127ed12962042580fc2f

Download Submit
C:\Windows\system\oJfkgpZ.exe

Filesize
1.7MB

MD5
18f65e356c18814661188e3c36c020ec

SHA1
47a8cac001444b15c63e9e33aad332d651247090

SHA256
a91ae5d334964280ac3fb9b87160a0801d620b18d6c99f71982f57c66666821d

SHA512
d7305c7a5107ce8691c7a9441a9047c466a35b402e5ff36f14937b96ac5a27e62a223ee95bdcc960c0c7d76905018617190456638f1e3b42d5e1339bcd61b421

Download Submit
C:\Windows\system\pMVMOCr.exe

Filesize
1.7MB

MD5
d80d22673a5934325982f4200752e4e0

SHA1
25d35f96e3d74d257f3289530b5293a5a066376a

SHA256
631348a4bc91d876b0a5ff1f80b036b9a719a7a0e97a7ce661dffd5edea31914

SHA512
ad9f650f61247778396ba4256ad46242383ccb34e308e09078c35fff80af3677d775c533ce711e060cbdfdcda572f1989db0d7471f2fd5b8e1412036c86cab6e

Download Submit
C:\Windows\system\qxVHFSs.exe

Filesize
1.7MB

MD5
6701c0606f96128ae555362eb1cd6d1b

SHA1
e40d750db2a41cec3c68140c3bd056a8c2556039

SHA256
596c3cbc00ffb9c9e46da63f9d7aaa9b833835b10067e5a458eed89bb2978a88

SHA512
b0a45923bd7bce66e09edb27d740ec2992d13e3ef0efd7be45346d667752c4bca972e88c3e02d2e28d4f7687fc58d4221b98ac24e7f1fae43fa2014d9b76e5a5

Download Submit
C:\Windows\system\tFcyGOP.exe

Filesize
1.7MB

MD5
6ca3e081ac10a80c75075d330c1a087e

SHA1
c373434ee0dda7b0f2b00fd901148cb69eec160f

SHA256
1e4f903b31386e2fcad3bfddd6a9e07bfa3817fcfe6309243e758a64e5173fe3

SHA512
27bacd974f352625fb87e970f541754115f377c6cd90d4fb0198f2261e299878d7dd1c64c4a74a6c52344a05610fc1581d8a7f27ea98f46320d1868859e1ac09

Download Submit
C:\Windows\system\zOgAMym.exe

Filesize
1.7MB

MD5
a662bc76f651691ce340472a8591b807

SHA1
6f71d807ae02f30a75be34c0252cc9b2a66a34d7

SHA256
4267fba3e8837cac3dbb15a9cf3bf27b286878af93975eab0d6bda265dc240fc

SHA512
51498f12ebee79025a022951e77d8a3c316f864e27741df5e48f30f56526f728b660e5c7eeadddbdeeaecd9b0a512b9ad36029cc0546583f18cae45ca09f1027

Download Submit
\Windows\system\AkBthQs.exe

Filesize
1.7MB

MD5
7899f77133f6a5953517e9de78459d5c

SHA1
94d4a6e6a0c3a89f837ada8a17d5593f829e143f

SHA256
7818aaeb68e823a1270565038e12437556237b181a38740abe56a6d391a394fa

SHA512
a8fac995b3ba7447ef74773eb96134eeda1f0b2f9f0f978cbeaa157abd52cdd8f127a9e36bb682f0869786f892a3dc08f5a030805cf96fee9258dc2de9b80b99

Download Submit
\Windows\system\DanzFfh.exe

Filesize
1.7MB

MD5
2c11a5e6ec5e0e878b3084f7375c70d4

SHA1
4d50864361990eb7a81ee56b1c8e87f9472434c4

SHA256
4e7f50fb89b3991eceb31801d0aa6a5fff2033de07f2e777348fe4b5af38fd7d

SHA512
f4bda5d31143f981c807964012297480547a64d2e8142410414ee06b18413d5a7e46f84c033c0bf7d7e5bc6111c1e3830be5692c8f51e2600004736f137f95c6

Download Submit
\Windows\system\FSwrfLC.exe

Filesize
1.7MB

MD5
ec047135871c89b94023bdeb3cf9896f

SHA1
2d6cb90b5864492fb4f0ead273ac2a00e69adb47

SHA256
ecb2a706b4d881dc4d26dc786a6a4d780a283f66de290ad08aecd0e4e5045603

SHA512
3ebba78bd1d4150bd04bcabb794e5b6c916a11a4aae31badb552111a188e247185f1df00c26ef3f1c50689b47fe5d380e152ccb347191ac90454bd61f66ff9af

Download Submit
\Windows\system\GerKiPX.exe

Filesize
1.7MB

MD5
b8c0a646ae4423f1c41f77cb869364de

SHA1
ce1f551c65c44f13ac712e1eee19d95aa5be0e93

SHA256
5b37026fc2468bdac132807a5d3b6e115016b94c19bfcc30d84b3c81626e5369

SHA512
20a8d661e89c64ac27ab6e1c7fc858a9880e240c4c294ef1b18bd2da8ceb0a728bc44f328d5d32990da44e4c669e3f84660f3b57cdd5c36e50cfd35cbc5f4cb7

Download Submit
\Windows\system\JzYbLHE.exe

Filesize
1.7MB

MD5
8fbc833b36c70d11c76fc80df4ac9a47

SHA1
f1cb4dc6c9450c7cbfbea99da2e87d17b90ba75e

SHA256
4a90e4f2195dbea314941ec99bd019a3fe8aec51f4f4276318e80ee9168a787d

SHA512
576a457acab122ec637592d72726026518137872480e6c7c050801b080ca6165cde7423784e6a95019979c165d3a649acbd2b52eec2ab5f68c0e2e17b1837216

Download Submit
\Windows\system\OKPZcXF.exe

Filesize
1.7MB

MD5
34b9696704a28e6ef3fcb33ef2710152

SHA1
14ccbafda3cf9cb0d897e70c6a7043ad050630f3

SHA256
4337a6dc09cd01001597d3ccccfc5ad09bb72e8f8ebad46ae6090013190238f1

SHA512
9cc435a09e0dbb26dd5f8b511be8ad4a4fdf3b1797911db8a85b090c041d56b24f66439df862c1e2a228d10f08851bdfffa979a97ac33e96eeba53228707920b

Download Submit
\Windows\system\QNRXIFs.exe

Filesize
1.7MB

MD5
ab22c55d97e5b402c17914eafdb7709e

SHA1
faf4ef13dae62fda447a81566ec316e1c46989c6

SHA256
7943686faf6be598f0c7d4c0c0e3195f774700e398a5451643885be1477e9fca

SHA512
184e1b2da0e335ed4a00cbd3e944f21f074d373d6628a03d00a7c96c4d1db955f672c1c141aa0d67c9b4e5d9be132d9d2c8cb2d18fff87b56743492a7610ff19

Download Submit
\Windows\system\RFcAHPF.exe

Filesize
1.7MB

MD5
a66c254d1cfe4f03ac927a457d92013b

SHA1
a02c7035bbf3472c55c8c77fa15482c71aa72030

SHA256
d010776012554e5dc5e77413056e837ac293ed958019dc5faf0ef32958e83af2

SHA512
25ebec8afcb855580c8d843b2c462c9883b4a7bd80a3e5fb0097d883b8ca62fec94a73270003a58de7fd03e03ecc6b91945b7285166f95894837e150cd5f7600

Download Submit
\Windows\system\SNlYGIN.exe

Filesize
1.7MB

MD5
6206a5602e61fb1469369771018f00a8

SHA1
926644319695d63ab94a9fee06fa938af8823ab7

SHA256
a0f54954f1a7246c6bf2b321f3a7634afc0a306f8026555f98181d3b626a4000

SHA512
db1107ea5bcbb4c1a698164675ab52eedf7d8cc3caf43ec919f0abb49336e330ae379c9df91a143de89760c7d0c4cd11957d75f5bfe40b0e9e122748450726eb

Download Submit
\Windows\system\TTRYfvW.exe

Filesize
1.7MB

MD5
da667e9bea6d9ffa49ebc50ca093e0c7

SHA1
7dae96f0a85d29c73348ff9991ae2369648da4c1

SHA256
9519c377ed6996de4cd1a6d4b7aa8092cb8bb278065c14017d51ff326d9dfeb3

SHA512
12a2a0b8bdd0e4aae462276832c9fd7d7490aea92ce1df888d18d43a5acdce48912743db743d1f3fffcdda987692257312b58c192cf6ff7dc7c0fd8003c612d0

Download Submit
\Windows\system\Uhnrpnk.exe

Filesize
1.7MB

MD5
27609ceed732fb06c7924605110fa829

SHA1
4ff62b2de94f7c08a0e64ba51e85164a2a1ecbd3

SHA256
57b3d76572ffd9fbb22c4d4fe2f72f9bd1b37060a24d1f5b8fbce462307c7bee

SHA512
1a3b0a45b1f270e5f042e332fbccad598977d1bab8c36d180990d07fd1da95f814188cb72712825239034e173d89a2da48125c33446bc07550843ce6339eb536

Download Submit
\Windows\system\XsaUPnq.exe

Filesize
1.7MB

MD5
a3a18255cc1bb78055ff584442b425e5

SHA1
0c0bb36a465e4cd7b545fc0ba7cdbcf5c94bf4aa

SHA256
a1c0f74e15bbc594cb7a2fab1345cf6ce661dbfa0c2e6e4ab9d630a70f6c6515

SHA512
4274aa731098c807c61c39b773595160d3bb6b55098502a8aa057f7e6ecba8d0c743ac045291d7508afa17fd1ba74ebe82fab0d3f82ec91b6e34f58e830e0fc8

Download Submit
\Windows\system\XvtAFWs.exe

Filesize
1.7MB

MD5
a5893950380d8b1f30435b766a917a35

SHA1
397a3c68e150295d8217a6576d82514f160efe47

SHA256
099b601a70dcf7b89a250e68d31df77bcb3fde7bfb2c9382625e65fb38cfdd2e

SHA512
4bf9a6ece09097db8cd6bfc670e47e9b4be40cfdf8e74beab32b7dd302176eb37e96b7257b0be605d1bb3f66c264228c5dc419f021d30b79bd0b8bf2df82923b

Download Submit
\Windows\system\bIosoyu.exe

Filesize
1.7MB

MD5
1c6eecf50a657f3d98dcb7a072bc6493

SHA1
2f30fa0fe2a93a2e0dc8783e1dda272be5ad6457

SHA256
f6c6fcf857fd5bf565e9e56e32e8a858212a2f71184df78da42c31bb11f10d99

SHA512
9e98c58dfd6b27e90e83fdee93062777cec53ecf5e0dac64fb3d4ae35bbfe22b75013908028846ed3d1e8760336b4c6818972b4f2515a9f0f017343d0ccfc0ce

Download Submit
\Windows\system\bKdkVXT.exe

Filesize
1.7MB

MD5
5f1f95f3b8f58f44bd76d583005205c7

SHA1
c5f5eb8222f907e4b6e4a4e24d993ddbc45c5771

SHA256
1028be45d50fd198b06f42bdb7f403210260e6c2fde6d1f6fecac09723ac0b29

SHA512
e44d820dc0ded886f76c35b10fbf937020b083a270c347cb3763dcb0a00042bb20ef0d5b58f3bf96df131b9f4ffc5545de278aec21fdae062103afa12f4d275b

Download Submit
\Windows\system\mNcxhja.exe

Filesize
1.7MB

MD5
b0009659426f49600ae126b971372822

SHA1
4e1379c2c57114d87684c18589cf6a814484a5ba

SHA256
c7cee7f59cc55f0406411167b008bf905fe1934432f99c3f75c36fe90f1b94e3

SHA512
6a903ed2110180fdbf4d9325e3e43d1dc498bfa31021d18c91ad4013034dfd116c2e2f0c962ef9eff43e7023eca38cf884f7b6993054dc33e89e4745519704c6

Download Submit
\Windows\system\mYVgfAP.exe

Filesize
1.7MB

MD5
3ed3adc5941beff1be65863b085cd752

SHA1
e665b0fe0eea129a5e613a83c0ccbb54c5de8520

SHA256
23bf5c6e772a92d66b20eb67c5809eb7a455023f6d2b81811e849f81c83b5635

SHA512
d56193c492f497613f138ad88dcd6dea5b2f896a58566bb06d80b5e4d5944797ab5c4990010f4d38c358887b753ac9ff507e374893968f5d2e01bd0fb7437419

Download Submit
\Windows\system\oYqhaeI.exe

Filesize
1.7MB

MD5
ccb35a5bfe45c0f036cdad265a0b77d0

SHA1
cc153bde5c11f268164474894ea5194ded2cdda9

SHA256
2b555166aec3462c661ca9a8104d5fd04e0625609aab118e926bed6955b6781b

SHA512
db040d14a4c7f7a764d520881d117fd8b1786e9f6ceceec339d151bf098ec5a839b8649abe7c3ae229e43d02f873b2c0ec26adfd65e760d4c64adf50cc46af6f

Download Submit
\Windows\system\qhLWDMe.exe

Filesize
1.7MB

MD5
c980620852b59d759c104aed4f955bfd

SHA1
f8a6b6c89c04b39bacd61007e2b1a87775ac37e6

SHA256
aa30b98cfedff7d15368bf8599c9f4bb20e408c460cb2f1c1f6bd3fb9c449381

SHA512
20a157edd787ad76c88e324e9c33df15252f813b9e640af3ecf35d4732ce920d01db74d7ce58ca8621d86abf2c009df81875d27cc1756bdf528630706ab6989d

Download Submit
\Windows\system\vUpqNqd.exe

Filesize
1.7MB

MD5
0c1d1fd97e7273ce7897c90c52752101

SHA1
6d4e64ff6f1e4c88a635a200f5aa45b5545df9b9

SHA256
47208734973e448803b62e17e617c5f2c991e7af8bb8c81e57f58c313b71ccc2

SHA512
526c26d8bdb0a0fb31fee9dcb7d7bc15cc0235fd01f8f5e2ae04ca41cc9b30c6a7cd1d81155d79eec469e7dbca9aa9dab27b1bcd28dff60406fa50efb3924f46

Download Submit
memory/1624-38-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-45-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/1624-63-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-77-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/1624-70-0x0000000002D70000-0x0000000002DF0000-memory.dmp

Filesize
512KB

Download
memory/1624-55-0x0000000001F30000-0x0000000001F38000-memory.dmp

Filesize
32KB

Download
memory/1624-36-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/1624-370-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/1948-89-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2148-28-0x000000013F1D0000-0x000000013F5C2000-memory.dmp

Filesize
3.9MB

Download
memory/2404-88-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2444-91-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2528-32-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2564-80-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-69-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2860-90-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2860-65-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2860-76-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-81-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2860-82-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-84-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2860-11-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-85-0x00000000035D0000-0x00000000039C2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-86-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2860-30-0x0000000002EC0000-0x00000000032B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-87-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2860-0-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download