xmrig | 3d4f6f2832c26e403f8c72357a5074b7a053d919296ae985f24826e2eef5c17b

Analysis

max time kernel
14s
max time network
22s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
Size

1.8MB
MD5

0ae0d4b6cb9a501d1305cd7a8780734a
SHA1

a02c41c407fc94d7a908304837986fcaa9015310
SHA256

3d4f6f2832c26e403f8c72357a5074b7a053d919296ae985f24826e2eef5c17b
SHA512

753d248c1a5745ca9360f512cf87b7a87e4b597e250afbe7ae56dfb68f337cdc6d9c3cbc6e42c493836423cb95cb2ffcc02bdc2763c80b6156d5e1b846c88428
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlZ:NABU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2544-32-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2948-41-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2156-82-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2772-92-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2540-106-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2156-72-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2720-36-0x000000013F140000-0x000000013F532000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2540	kegASJH.exe
2544	WsdDMPd.exe
2720	pJlrZjg.exe
2948	htInFZi.exe
2444	UTjNdnd.exe
2172	goIvfIx.exe
2920	xSOGpMx.exe
2772	hbaPBJH.exe
2792	wrhelEt.exe
1508	gfzllVR.exe
1904	HXoSVZC.exe
2140	JizOljO.exe
2696	AbRsCwp.exe
1592	RbczCrE.exe
1612	WZJUVDf.exe
3028	xGjGmVw.exe
2392	akMoCyC.exe
2256	QakOxVz.exe
988	gDnaQMx.exe
2840	vegJzgG.exe
1724	uicSOWX.exe
360	yQEOuNL.exe
452	MIvHHpY.exe
3012	bXHMuFE.exe
2116	YzoYveH.exe
1784	NkMZNqA.exe
1768	XwUqFfx.exe
2308	rnMoxdb.exe
1212	pUGqmlE.exe
684	GtSAMAs.exe
1624	dKDKjrZ.exe
572	ikHyZVp.exe
1636	ncsPFaq.exe
892	giHAkQy.exe
812	AsgLape.exe
2968	OMyKHOh.exe
1520	lawCEWp.exe
2520	OjNPDWr.exe
2796	izxsIOn.exe
2468	LvIiXDi.exe
2956	aWYZGDM.exe
1860	koNCbLr.exe
1596	axIzKOu.exe
2852	EwNdSNa.exe
1124	iuPzlFR.exe
2848	KyraAOZ.exe
1012	FPAZAnI.exe
2684	IWFDKTf.exe
2760	reMbjNF.exe
356	YLZpBKc.exe
1908	buXiFUg.exe
1744	TgwIRRC.exe
1352	YLoJnYP.exe
1544	UmNZfsK.exe
1444	ismrkfA.exe
2224	PJafQDQ.exe
1616	wGZSfwS.exe
2088	yEMmOkD.exe
668	KVviNpJ.exe
576	sLdQbWW.exe
2924	VcEmJFW.exe
1120	DSQnAch.exe
2212	xWykzXn.exe
3040	vKWEryc.exe

Loads dropped DLL 64 IoCs

pid	Process
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2156-1-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x000c00000001444f-3.dat	upx
behavioral1/memory/2540-8-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x0035000000014701-14.dat	upx
behavioral1/files/0x001400000000549e-16.dat	upx
behavioral1/files/0x00080000000149ea-26.dat	upx
behavioral1/memory/2544-32-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/files/0x0007000000014b12-42.dat	upx
behavioral1/memory/2948-41-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/files/0x0007000000014e5a-59.dat	upx
behavioral1/memory/2920-61-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/files/0x0006000000015cf7-99.dat	upx
behavioral1/memory/2772-92-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x0006000000015d5d-115.dat	upx
behavioral1/files/0x0006000000016056-129.dat	upx
behavioral1/files/0x00060000000167ef-150.dat	upx
behavioral1/files/0x0006000000016d06-190.dat	upx
behavioral1/files/0x0006000000016cfe-187.dat	upx
behavioral1/files/0x0006000000016ced-180.dat	upx
behavioral1/files/0x0006000000016cc9-173.dat	upx
behavioral1/files/0x0006000000016c7a-166.dat	upx
behavioral1/files/0x0006000000016c26-159.dat	upx
behavioral1/files/0x0006000000016a45-152.dat	upx
behavioral1/files/0x0006000000016597-145.dat	upx
behavioral1/files/0x0006000000016411-138.dat	upx
behavioral1/files/0x00060000000160f8-131.dat	upx
behavioral1/files/0x0006000000015f9e-124.dat	upx
behavioral1/files/0x0006000000015d6e-117.dat	upx
behavioral1/memory/2540-106-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x0006000000015d06-103.dat	upx
behavioral1/files/0x0006000000015cdb-98.dat	upx
behavioral1/files/0x0006000000015cca-97.dat	upx
behavioral1/files/0x0006000000015cec-93.dat	upx
behavioral1/files/0x003500000001470b-86.dat	upx
behavioral1/files/0x0006000000015cb9-80.dat	upx
behavioral1/files/0x0006000000015cc1-77.dat	upx
behavioral1/memory/2156-72-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/files/0x0006000000015cad-70.dat	upx
behavioral1/files/0x0009000000015136-63.dat	upx
behavioral1/files/0x0006000000016cf5-185.dat	upx
behavioral1/files/0x0006000000016ce1-178.dat	upx
behavioral1/files/0x0006000000016cab-171.dat	upx
behavioral1/files/0x0006000000016c2e-164.dat	upx
behavioral1/files/0x0006000000016c17-157.dat	upx
behavioral1/files/0x0006000000016525-143.dat	upx
behavioral1/files/0x0006000000016277-136.dat	upx
behavioral1/files/0x0006000000015f1b-122.dat	upx
behavioral1/memory/2172-54-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/files/0x0007000000015ca5-68.dat	upx
behavioral1/files/0x0007000000014c25-53.dat	upx
behavioral1/memory/2444-51-0x000000013F4B0000-0x000000013F8A2000-memory.dmp	upx
behavioral1/memory/2720-36-0x000000013F140000-0x000000013F532000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\OmlIFly.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\wnnOAZE.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\jXcSsFa.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\JaBBZju.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\wcrGNuA.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\GWVSPKs.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\rZkopuw.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\mVkMUXe.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\thLtWap.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\AEvgVck.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\ifOuTGv.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\YfgQIja.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\UGNOjRN.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\nXbhhgV.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\buXiFUg.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\HXoSVZC.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\LvIiXDi.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\gHLbvJK.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\jNImfDa.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\oujABFJ.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\pFICEMQ.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\UZFfpaQ.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\gtsaVLk.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\AsgLape.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\nDBLDJj.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\KzvQmWk.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\Xlciage.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\kQdbriZ.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\qJxSiUs.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\dhxupWV.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\rREMiyE.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\ClmKilj.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\sZdRCtF.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\RCvGYKK.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\FelEkZP.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\kegASJH.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\mzHJIaJ.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\dtVkDKg.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\WrjguMy.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\FfLeCPm.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\XSoWxaI.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\pdJOuIC.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\reMbjNF.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\vtvXoJP.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\WkqlIYb.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\pgZLqUE.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\iJlxwFO.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\FQWywNF.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\TJUgxnD.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\gNrwtzf.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\WBknYZK.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\pBIRIEf.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\XPvOIpG.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\afAGYdG.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\AIvPHbl.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\XRlqGjf.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\axIzKOu.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\NKJwGeF.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\VGCBOJG.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\mIXvzpM.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\EAioDut.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\gaWzPfc.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\vBFQIlh.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
File created	C:\Windows\System\nzLNPPa.exe	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeLockMemoryPrivilege	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2992	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2992	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2992	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	29
PID 2156 wrote to memory of 2540	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2540	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2540	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	30
PID 2156 wrote to memory of 2544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	31
PID 2156 wrote to memory of 2720	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2720	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2720	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	32
PID 2156 wrote to memory of 2948	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2948	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2948	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	33
PID 2156 wrote to memory of 2444	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2444	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2444	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	34
PID 2156 wrote to memory of 2172	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2172	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2172	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	35
PID 2156 wrote to memory of 2920	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2920	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2920	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	36
PID 2156 wrote to memory of 2684	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2684	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2684	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	37
PID 2156 wrote to memory of 2772	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2772	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2772	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	38
PID 2156 wrote to memory of 2760	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2760	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2760	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	39
PID 2156 wrote to memory of 2792	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2792	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	40
PID 2156 wrote to memory of 2792	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	40
PID 2156 wrote to memory of 356	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	41
PID 2156 wrote to memory of 356	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	41
PID 2156 wrote to memory of 356	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	41
PID 2156 wrote to memory of 1508	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	42
PID 2156 wrote to memory of 1508	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	42
PID 2156 wrote to memory of 1508	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	42
PID 2156 wrote to memory of 1908	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	43
PID 2156 wrote to memory of 1908	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	43
PID 2156 wrote to memory of 1908	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	43
PID 2156 wrote to memory of 1904	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	44
PID 2156 wrote to memory of 1904	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	44
PID 2156 wrote to memory of 1904	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	44
PID 2156 wrote to memory of 1744	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	45
PID 2156 wrote to memory of 1744	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	45
PID 2156 wrote to memory of 1744	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	45
PID 2156 wrote to memory of 2140	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2140	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	46
PID 2156 wrote to memory of 2140	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	46
PID 2156 wrote to memory of 1352	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	47
PID 2156 wrote to memory of 1352	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	47
PID 2156 wrote to memory of 1352	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	47
PID 2156 wrote to memory of 2696	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2696	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	48
PID 2156 wrote to memory of 2696	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	48
PID 2156 wrote to memory of 1544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1544	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	49
PID 2156 wrote to memory of 1592	2156	0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0ae0d4b6cb9a501d1305cd7a8780734a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\System\kegASJH.exe
  C:\Windows\System\kegASJH.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\WsdDMPd.exe
  C:\Windows\System\WsdDMPd.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\pJlrZjg.exe
  C:\Windows\System\pJlrZjg.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\htInFZi.exe
  C:\Windows\System\htInFZi.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\UTjNdnd.exe
  C:\Windows\System\UTjNdnd.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\goIvfIx.exe
  C:\Windows\System\goIvfIx.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xSOGpMx.exe
  C:\Windows\System\xSOGpMx.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\IWFDKTf.exe
  C:\Windows\System\IWFDKTf.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\hbaPBJH.exe
  C:\Windows\System\hbaPBJH.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\reMbjNF.exe
  C:\Windows\System\reMbjNF.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\wrhelEt.exe
  C:\Windows\System\wrhelEt.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\YLZpBKc.exe
  C:\Windows\System\YLZpBKc.exe
  2⤵
  - Executes dropped EXE
  PID:356
- C:\Windows\System\gfzllVR.exe
  C:\Windows\System\gfzllVR.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\buXiFUg.exe
  C:\Windows\System\buXiFUg.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\HXoSVZC.exe
  C:\Windows\System\HXoSVZC.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\TgwIRRC.exe
  C:\Windows\System\TgwIRRC.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\JizOljO.exe
  C:\Windows\System\JizOljO.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\YLoJnYP.exe
  C:\Windows\System\YLoJnYP.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\AbRsCwp.exe
  C:\Windows\System\AbRsCwp.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\UmNZfsK.exe
  C:\Windows\System\UmNZfsK.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\RbczCrE.exe
  C:\Windows\System\RbczCrE.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ismrkfA.exe
  C:\Windows\System\ismrkfA.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WZJUVDf.exe
  C:\Windows\System\WZJUVDf.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\PJafQDQ.exe
  C:\Windows\System\PJafQDQ.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\xGjGmVw.exe
  C:\Windows\System\xGjGmVw.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\wGZSfwS.exe
  C:\Windows\System\wGZSfwS.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\akMoCyC.exe
  C:\Windows\System\akMoCyC.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\yEMmOkD.exe
  C:\Windows\System\yEMmOkD.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\QakOxVz.exe
  C:\Windows\System\QakOxVz.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\KVviNpJ.exe
  C:\Windows\System\KVviNpJ.exe
  2⤵
  - Executes dropped EXE
  PID:668
- C:\Windows\System\gDnaQMx.exe
  C:\Windows\System\gDnaQMx.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\sLdQbWW.exe
  C:\Windows\System\sLdQbWW.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\vegJzgG.exe
  C:\Windows\System\vegJzgG.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\VcEmJFW.exe
  C:\Windows\System\VcEmJFW.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\uicSOWX.exe
  C:\Windows\System\uicSOWX.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\DSQnAch.exe
  C:\Windows\System\DSQnAch.exe
  2⤵
  - Executes dropped EXE
  PID:1120
- C:\Windows\System\yQEOuNL.exe
  C:\Windows\System\yQEOuNL.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\xWykzXn.exe
  C:\Windows\System\xWykzXn.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\MIvHHpY.exe
  C:\Windows\System\MIvHHpY.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\vKWEryc.exe
  C:\Windows\System\vKWEryc.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\bXHMuFE.exe
  C:\Windows\System\bXHMuFE.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\uYxkusz.exe
  C:\Windows\System\uYxkusz.exe
  2⤵
  PID:1548
- C:\Windows\System\YzoYveH.exe
  C:\Windows\System\YzoYveH.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\nOJKfsE.exe
  C:\Windows\System\nOJKfsE.exe
  2⤵
  PID:1456
- C:\Windows\System\NkMZNqA.exe
  C:\Windows\System\NkMZNqA.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\faNtQbY.exe
  C:\Windows\System\faNtQbY.exe
  2⤵
  PID:1536
- C:\Windows\System\XwUqFfx.exe
  C:\Windows\System\XwUqFfx.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\zpWIhDf.exe
  C:\Windows\System\zpWIhDf.exe
  2⤵
  PID:1572
- C:\Windows\System\rnMoxdb.exe
  C:\Windows\System\rnMoxdb.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\qLiuDUs.exe
  C:\Windows\System\qLiuDUs.exe
  2⤵
  PID:908
- C:\Windows\System\pUGqmlE.exe
  C:\Windows\System\pUGqmlE.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\fpawieI.exe
  C:\Windows\System\fpawieI.exe
  2⤵
  PID:2220
- C:\Windows\System\GtSAMAs.exe
  C:\Windows\System\GtSAMAs.exe
  2⤵
  - Executes dropped EXE
  PID:684
- C:\Windows\System\fDsZzZY.exe
  C:\Windows\System\fDsZzZY.exe
  2⤵
  PID:2008
- C:\Windows\System\dKDKjrZ.exe
  C:\Windows\System\dKDKjrZ.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\BdpmfXk.exe
  C:\Windows\System\BdpmfXk.exe
  2⤵
  PID:2080
- C:\Windows\System\ikHyZVp.exe
  C:\Windows\System\ikHyZVp.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\IUvejZG.exe
  C:\Windows\System\IUvejZG.exe
  2⤵
  PID:1148
- C:\Windows\System\ncsPFaq.exe
  C:\Windows\System\ncsPFaq.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\PZnVVeA.exe
  C:\Windows\System\PZnVVeA.exe
  2⤵
  PID:1868
- C:\Windows\System\giHAkQy.exe
  C:\Windows\System\giHAkQy.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\DtylfhA.exe
  C:\Windows\System\DtylfhA.exe
  2⤵
  PID:876
- C:\Windows\System\AsgLape.exe
  C:\Windows\System\AsgLape.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\zJVAgMj.exe
  C:\Windows\System\zJVAgMj.exe
  2⤵
  PID:2264
- C:\Windows\System\OMyKHOh.exe
  C:\Windows\System\OMyKHOh.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ckZhMXg.exe
  C:\Windows\System\ckZhMXg.exe
  2⤵
  PID:2552
- C:\Windows\System\lawCEWp.exe
  C:\Windows\System\lawCEWp.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\OmlIFly.exe
  C:\Windows\System\OmlIFly.exe
  2⤵
  PID:1500
- C:\Windows\System\OjNPDWr.exe
  C:\Windows\System\OjNPDWr.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\znRFWOi.exe
  C:\Windows\System\znRFWOi.exe
  2⤵
  PID:2420
- C:\Windows\System\izxsIOn.exe
  C:\Windows\System\izxsIOn.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\XNdwrnv.exe
  C:\Windows\System\XNdwrnv.exe
  2⤵
  PID:2640
- C:\Windows\System\LvIiXDi.exe
  C:\Windows\System\LvIiXDi.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\xfcLbtl.exe
  C:\Windows\System\xfcLbtl.exe
  2⤵
  PID:2504
- C:\Windows\System\aWYZGDM.exe
  C:\Windows\System\aWYZGDM.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\eYqmvUw.exe
  C:\Windows\System\eYqmvUw.exe
  2⤵
  PID:2752
- C:\Windows\System\koNCbLr.exe
  C:\Windows\System\koNCbLr.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\NXLcumG.exe
  C:\Windows\System\NXLcumG.exe
  2⤵
  PID:404
- C:\Windows\System\axIzKOu.exe
  C:\Windows\System\axIzKOu.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\KPnGarJ.exe
  C:\Windows\System\KPnGarJ.exe
  2⤵
  PID:2004
- C:\Windows\System\EwNdSNa.exe
  C:\Windows\System\EwNdSNa.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\qgeWSuK.exe
  C:\Windows\System\qgeWSuK.exe
  2⤵
  PID:2448
- C:\Windows\System\iuPzlFR.exe
  C:\Windows\System\iuPzlFR.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\lJEuEGC.exe
  C:\Windows\System\lJEuEGC.exe
  2⤵
  PID:2528
- C:\Windows\System\KyraAOZ.exe
  C:\Windows\System\KyraAOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\TbrqiCI.exe
  C:\Windows\System\TbrqiCI.exe
  2⤵
  PID:1008
- C:\Windows\System\FPAZAnI.exe
  C:\Windows\System\FPAZAnI.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\NIEdLgh.exe
  C:\Windows\System\NIEdLgh.exe
  2⤵
  PID:1424
- C:\Windows\System\eQBchcC.exe
  C:\Windows\System\eQBchcC.exe
  2⤵
  PID:2648
- C:\Windows\System\qRNdmlV.exe
  C:\Windows\System\qRNdmlV.exe
  2⤵
  PID:2516
- C:\Windows\System\BtqxmbO.exe
  C:\Windows\System\BtqxmbO.exe
  2⤵
  PID:1920
- C:\Windows\System\GyFVlQH.exe
  C:\Windows\System\GyFVlQH.exe
  2⤵
  PID:1956
- C:\Windows\System\oTokakm.exe
  C:\Windows\System\oTokakm.exe
  2⤵
  PID:2476
- C:\Windows\System\gHLbvJK.exe
  C:\Windows\System\gHLbvJK.exe
  2⤵
  PID:3352
- C:\Windows\System\RBXVEKc.exe
  C:\Windows\System\RBXVEKc.exe
  2⤵
  PID:3376
- C:\Windows\System\TOFjFdB.exe
  C:\Windows\System\TOFjFdB.exe
  2⤵
  PID:3392
- C:\Windows\System\xSwwXUy.exe
  C:\Windows\System\xSwwXUy.exe
  2⤵
  PID:3408
- C:\Windows\System\JESOwCs.exe
  C:\Windows\System\JESOwCs.exe
  2⤵
  PID:3424
- C:\Windows\System\DKQvrhH.exe
  C:\Windows\System\DKQvrhH.exe
  2⤵
  PID:3448
- C:\Windows\System\VlmScPX.exe
  C:\Windows\System\VlmScPX.exe
  2⤵
  PID:3464
- C:\Windows\System\sEHUMhh.exe
  C:\Windows\System\sEHUMhh.exe
  2⤵
  PID:3480
- C:\Windows\System\JkoqHkP.exe
  C:\Windows\System\JkoqHkP.exe
  2⤵
  PID:3496
- C:\Windows\System\jRZkuNi.exe
  C:\Windows\System\jRZkuNi.exe
  2⤵
  PID:3512
- C:\Windows\System\LQcTOOf.exe
  C:\Windows\System\LQcTOOf.exe
  2⤵
  PID:3532
- C:\Windows\System\wQkmnpn.exe
  C:\Windows\System\wQkmnpn.exe
  2⤵
  PID:3576
- C:\Windows\System\baJUCaZ.exe
  C:\Windows\System\baJUCaZ.exe
  2⤵
  PID:3592
- C:\Windows\System\OrTGdQj.exe
  C:\Windows\System\OrTGdQj.exe
  2⤵
  PID:3608
- C:\Windows\System\nQwtRPM.exe
  C:\Windows\System\nQwtRPM.exe
  2⤵
  PID:3624
- C:\Windows\System\PcULzEB.exe
  C:\Windows\System\PcULzEB.exe
  2⤵
  PID:3640
- C:\Windows\System\dkYNxaS.exe
  C:\Windows\System\dkYNxaS.exe
  2⤵
  PID:3656
- C:\Windows\System\TPRIToz.exe
  C:\Windows\System\TPRIToz.exe
  2⤵
  PID:3672
- C:\Windows\System\qJxSiUs.exe
  C:\Windows\System\qJxSiUs.exe
  2⤵
  PID:3688
- C:\Windows\System\mzHJIaJ.exe
  C:\Windows\System\mzHJIaJ.exe
  2⤵
  PID:3704
- C:\Windows\System\yqWkUKq.exe
  C:\Windows\System\yqWkUKq.exe
  2⤵
  PID:3720
- C:\Windows\System\DnrbYzv.exe
  C:\Windows\System\DnrbYzv.exe
  2⤵
  PID:3736
- C:\Windows\System\EeWSwAq.exe
  C:\Windows\System\EeWSwAq.exe
  2⤵
  PID:3824
- C:\Windows\System\jVKzjdv.exe
  C:\Windows\System\jVKzjdv.exe
  2⤵
  PID:3848
- C:\Windows\System\otGhjLK.exe
  C:\Windows\System\otGhjLK.exe
  2⤵
  PID:3864
- C:\Windows\System\GExpacx.exe
  C:\Windows\System\GExpacx.exe
  2⤵
  PID:3880
- C:\Windows\System\RDVyQdQ.exe
  C:\Windows\System\RDVyQdQ.exe
  2⤵
  PID:3896
- C:\Windows\System\xmdiHCP.exe
  C:\Windows\System\xmdiHCP.exe
  2⤵
  PID:3912
- C:\Windows\System\qEnMGxm.exe
  C:\Windows\System\qEnMGxm.exe
  2⤵
  PID:3928
- C:\Windows\System\ifilOyT.exe
  C:\Windows\System\ifilOyT.exe
  2⤵
  PID:3944
- C:\Windows\System\JbXvYLj.exe
  C:\Windows\System\JbXvYLj.exe
  2⤵
  PID:3960
- C:\Windows\System\SWBUAnE.exe
  C:\Windows\System\SWBUAnE.exe
  2⤵
  PID:3976
- C:\Windows\System\PwdQdyo.exe
  C:\Windows\System\PwdQdyo.exe
  2⤵
  PID:3992
- C:\Windows\System\pEVbcnS.exe
  C:\Windows\System\pEVbcnS.exe
  2⤵
  PID:4016
- C:\Windows\System\AVgDvNL.exe
  C:\Windows\System\AVgDvNL.exe
  2⤵
  PID:4032
- C:\Windows\System\wnnOAZE.exe
  C:\Windows\System\wnnOAZE.exe
  2⤵
  PID:4048
- C:\Windows\System\lbZDaco.exe
  C:\Windows\System\lbZDaco.exe
  2⤵
  PID:4064
- C:\Windows\System\PpSBHFZ.exe
  C:\Windows\System\PpSBHFZ.exe
  2⤵
  PID:4084
- C:\Windows\System\VjNTDkC.exe
  C:\Windows\System\VjNTDkC.exe
  2⤵
  PID:2936
- C:\Windows\System\URQJtwr.exe
  C:\Windows\System\URQJtwr.exe
  2⤵
  PID:1672
- C:\Windows\System\DzVUDLk.exe
  C:\Windows\System\DzVUDLk.exe
  2⤵
  PID:1224
- C:\Windows\System\kwuEZTg.exe
  C:\Windows\System\kwuEZTg.exe
  2⤵
  PID:1680
- C:\Windows\System\MuFIoLp.exe
  C:\Windows\System\MuFIoLp.exe
  2⤵
  PID:2236
- C:\Windows\System\atwkbvh.exe
  C:\Windows\System\atwkbvh.exe
  2⤵
  PID:2592
- C:\Windows\System\NylOvBM.exe
  C:\Windows\System\NylOvBM.exe
  2⤵
  PID:1704
- C:\Windows\System\sEqzcbl.exe
  C:\Windows\System\sEqzcbl.exe
  2⤵
  PID:3320
- C:\Windows\System\AaAIphM.exe
  C:\Windows\System\AaAIphM.exe
  2⤵
  PID:3336
- C:\Windows\System\ETHKTKT.exe
  C:\Windows\System\ETHKTKT.exe
  2⤵
  PID:3384
- C:\Windows\System\dtVkDKg.exe
  C:\Windows\System\dtVkDKg.exe
  2⤵
  PID:2788
- C:\Windows\System\GnzvRvj.exe
  C:\Windows\System\GnzvRvj.exe
  2⤵
  PID:3680
- C:\Windows\System\NZJopKT.exe
  C:\Windows\System\NZJopKT.exe
  2⤵
  PID:2036
- C:\Windows\System\nDBLDJj.exe
  C:\Windows\System\nDBLDJj.exe
  2⤵
  PID:2496
- C:\Windows\System\uzkSKgA.exe
  C:\Windows\System\uzkSKgA.exe
  2⤵
  PID:3744
- C:\Windows\System\mMOahPT.exe
  C:\Windows\System\mMOahPT.exe
  2⤵
  PID:3764
- C:\Windows\System\PkFIpra.exe
  C:\Windows\System\PkFIpra.exe
  2⤵
  PID:3800
- C:\Windows\System\zMLRgJk.exe
  C:\Windows\System\zMLRgJk.exe
  2⤵
  PID:3816
- C:\Windows\System\AQyrwLI.exe
  C:\Windows\System\AQyrwLI.exe
  2⤵
  PID:3892
- C:\Windows\System\VhezPKF.exe
  C:\Windows\System\VhezPKF.exe
  2⤵
  PID:2928
- C:\Windows\System\fuPgzlw.exe
  C:\Windows\System\fuPgzlw.exe
  2⤵
  PID:2200
- C:\Windows\System\TeWYGiZ.exe
  C:\Windows\System\TeWYGiZ.exe
  2⤵
  PID:3952
- C:\Windows\System\LucwKgx.exe
  C:\Windows\System\LucwKgx.exe
  2⤵
  PID:2712
- C:\Windows\System\rpguwVd.exe
  C:\Windows\System\rpguwVd.exe
  2⤵
  PID:348
- C:\Windows\System\jNImfDa.exe
  C:\Windows\System\jNImfDa.exe
  2⤵
  PID:3348
- C:\Windows\System\oPJmAQn.exe
  C:\Windows\System\oPJmAQn.exe
  2⤵
  PID:2144
- C:\Windows\System\WuxNQDr.exe
  C:\Windows\System\WuxNQDr.exe
  2⤵
  PID:2132
- C:\Windows\System\CfNOjLO.exe
  C:\Windows\System\CfNOjLO.exe
  2⤵
  PID:604
- C:\Windows\System\oXQGVIr.exe
  C:\Windows\System\oXQGVIr.exe
  2⤵
  PID:1836
- C:\Windows\System\UTmdNai.exe
  C:\Windows\System\UTmdNai.exe
  2⤵
  PID:3416
- C:\Windows\System\DpcKcHQ.exe
  C:\Windows\System\DpcKcHQ.exe
  2⤵
  PID:3492
- C:\Windows\System\qthrNQy.exe
  C:\Windows\System\qthrNQy.exe
  2⤵
  PID:2296
- C:\Windows\System\hcqtIVN.exe
  C:\Windows\System\hcqtIVN.exe
  2⤵
  PID:3716
- C:\Windows\System\xzmyXLa.exe
  C:\Windows\System\xzmyXLa.exe
  2⤵
  PID:2076
- C:\Windows\System\uKcCKMn.exe
  C:\Windows\System\uKcCKMn.exe
  2⤵
  PID:3888
- C:\Windows\System\nOJCTrf.exe
  C:\Windows\System\nOJCTrf.exe
  2⤵
  PID:3456
- C:\Windows\System\axCluDh.exe
  C:\Windows\System\axCluDh.exe
  2⤵
  PID:2748
- C:\Windows\System\paIqTGm.exe
  C:\Windows\System\paIqTGm.exe
  2⤵
  PID:2012
- C:\Windows\System\XrODLNA.exe
  C:\Windows\System\XrODLNA.exe
  2⤵
  PID:4092
- C:\Windows\System\jPqsMul.exe
  C:\Windows\System\jPqsMul.exe
  2⤵
  PID:1600
- C:\Windows\System\QGuueWs.exe
  C:\Windows\System\QGuueWs.exe
  2⤵
  PID:2884
- C:\Windows\System\kzwBFTh.exe
  C:\Windows\System\kzwBFTh.exe
  2⤵
  PID:2708
- C:\Windows\System\rSpMhgs.exe
  C:\Windows\System\rSpMhgs.exe
  2⤵
  PID:1588
- C:\Windows\System\rIJosDV.exe
  C:\Windows\System\rIJosDV.exe
  2⤵
  PID:1100
- C:\Windows\System\MoLYxqj.exe
  C:\Windows\System\MoLYxqj.exe
  2⤵
  PID:836
- C:\Windows\System\jgMDfdv.exe
  C:\Windows\System\jgMDfdv.exe
  2⤵
  PID:996
- C:\Windows\System\shaWCgX.exe
  C:\Windows\System\shaWCgX.exe
  2⤵
  PID:4108
- C:\Windows\System\FcITOuA.exe
  C:\Windows\System\FcITOuA.exe
  2⤵
  PID:4128
- C:\Windows\System\boMZqdM.exe
  C:\Windows\System\boMZqdM.exe
  2⤵
  PID:4144
- C:\Windows\System\XEipUeP.exe
  C:\Windows\System\XEipUeP.exe
  2⤵
  PID:4160
- C:\Windows\System\HrGrekc.exe
  C:\Windows\System\HrGrekc.exe
  2⤵
  PID:4176
- C:\Windows\System\JbWWIEC.exe
  C:\Windows\System\JbWWIEC.exe
  2⤵
  PID:4196
- C:\Windows\System\TUxfHaC.exe
  C:\Windows\System\TUxfHaC.exe
  2⤵
  PID:4216
- C:\Windows\System\lJJNoey.exe
  C:\Windows\System\lJJNoey.exe
  2⤵
  PID:4244
- C:\Windows\System\LTSzCOv.exe
  C:\Windows\System\LTSzCOv.exe
  2⤵
  PID:4260
- C:\Windows\System\cLEJYun.exe
  C:\Windows\System\cLEJYun.exe
  2⤵
  PID:4276
- C:\Windows\System\dytuqrL.exe
  C:\Windows\System\dytuqrL.exe
  2⤵
  PID:4292
- C:\Windows\System\PyTUgXo.exe
  C:\Windows\System\PyTUgXo.exe
  2⤵
  PID:4308
- C:\Windows\System\UzblSyp.exe
  C:\Windows\System\UzblSyp.exe
  2⤵
  PID:4324
- C:\Windows\System\TJUgxnD.exe
  C:\Windows\System\TJUgxnD.exe
  2⤵
  PID:4340
- C:\Windows\System\tAgRjjC.exe
  C:\Windows\System\tAgRjjC.exe
  2⤵
  PID:4356
- C:\Windows\System\kyeMRLO.exe
  C:\Windows\System\kyeMRLO.exe
  2⤵
  PID:4372
- C:\Windows\System\NEtdYKv.exe
  C:\Windows\System\NEtdYKv.exe
  2⤵
  PID:4388
- C:\Windows\System\NHNHcwu.exe
  C:\Windows\System\NHNHcwu.exe
  2⤵
  PID:4404
- C:\Windows\System\lVDMIVi.exe
  C:\Windows\System\lVDMIVi.exe
  2⤵
  PID:4544
- C:\Windows\System\dhvbZUl.exe
  C:\Windows\System\dhvbZUl.exe
  2⤵
  PID:4580
- C:\Windows\System\hMaNImT.exe
  C:\Windows\System\hMaNImT.exe
  2⤵
  PID:4604
- C:\Windows\System\yWlFKjC.exe
  C:\Windows\System\yWlFKjC.exe
  2⤵
  PID:4660
- C:\Windows\System\pxaJnIe.exe
  C:\Windows\System\pxaJnIe.exe
  2⤵
  PID:4676
- C:\Windows\System\SbDCPyZ.exe
  C:\Windows\System\SbDCPyZ.exe
  2⤵
  PID:4692
- C:\Windows\System\dhxupWV.exe
  C:\Windows\System\dhxupWV.exe
  2⤵
  PID:4708
- C:\Windows\System\ssRloYg.exe
  C:\Windows\System\ssRloYg.exe
  2⤵
  PID:4724
- C:\Windows\System\EQNLZVA.exe
  C:\Windows\System\EQNLZVA.exe
  2⤵
  PID:4740
- C:\Windows\System\HJFmMti.exe
  C:\Windows\System\HJFmMti.exe
  2⤵
  PID:4756
- C:\Windows\System\iflxSmC.exe
  C:\Windows\System\iflxSmC.exe
  2⤵
  PID:4864
- C:\Windows\System\vtvXoJP.exe
  C:\Windows\System\vtvXoJP.exe
  2⤵
  PID:4880
- C:\Windows\System\nNkuQyE.exe
  C:\Windows\System\nNkuQyE.exe
  2⤵
  PID:4896
- C:\Windows\System\lqEdTrH.exe
  C:\Windows\System\lqEdTrH.exe
  2⤵
  PID:4912
- C:\Windows\System\iJSpfCP.exe
  C:\Windows\System\iJSpfCP.exe
  2⤵
  PID:4928
- C:\Windows\System\ZZIgHqb.exe
  C:\Windows\System\ZZIgHqb.exe
  2⤵
  PID:4944
- C:\Windows\System\iFkwQvy.exe
  C:\Windows\System\iFkwQvy.exe
  2⤵
  PID:4960
- C:\Windows\System\uoTApwS.exe
  C:\Windows\System\uoTApwS.exe
  2⤵
  PID:4976
- C:\Windows\System\DAfdALs.exe
  C:\Windows\System\DAfdALs.exe
  2⤵
  PID:4992
- C:\Windows\System\WYdmJPl.exe
  C:\Windows\System\WYdmJPl.exe
  2⤵
  PID:5008
- C:\Windows\System\HqhmIsZ.exe
  C:\Windows\System\HqhmIsZ.exe
  2⤵
  PID:5028
- C:\Windows\System\hFVpDrb.exe
  C:\Windows\System\hFVpDrb.exe
  2⤵
  PID:5044
- C:\Windows\System\IGAGDbs.exe
  C:\Windows\System\IGAGDbs.exe
  2⤵
  PID:5060
- C:\Windows\System\gDaHikt.exe
  C:\Windows\System\gDaHikt.exe
  2⤵
  PID:5076
- C:\Windows\System\VMFYQox.exe
  C:\Windows\System\VMFYQox.exe
  2⤵
  PID:5092
- C:\Windows\System\yuhcwtK.exe
  C:\Windows\System\yuhcwtK.exe
  2⤵
  PID:5108
- C:\Windows\System\tiyNhwY.exe
  C:\Windows\System\tiyNhwY.exe
  2⤵
  PID:4060
- C:\Windows\System\NKJwGeF.exe
  C:\Windows\System\NKJwGeF.exe
  2⤵
  PID:1952
- C:\Windows\System\xzoQRwn.exe
  C:\Windows\System\xzoQRwn.exe
  2⤵
  PID:560
- C:\Windows\System\cYuvDwb.exe
  C:\Windows\System\cYuvDwb.exe
  2⤵
  PID:3780
- C:\Windows\System\VGCBOJG.exe
  C:\Windows\System\VGCBOJG.exe
  2⤵
  PID:4136
- C:\Windows\System\Wqislcy.exe
  C:\Windows\System\Wqislcy.exe
  2⤵
  PID:4172
- C:\Windows\System\FNNvXpQ.exe
  C:\Windows\System\FNNvXpQ.exe
  2⤵
  PID:3020
- C:\Windows\System\qtdcPwq.exe
  C:\Windows\System\qtdcPwq.exe
  2⤵
  PID:4252
- C:\Windows\System\gNrwtzf.exe
  C:\Windows\System\gNrwtzf.exe
  2⤵
  PID:4316
- C:\Windows\System\RUDCAER.exe
  C:\Windows\System\RUDCAER.exe
  2⤵
  PID:4380
- C:\Windows\System\YABbvwJ.exe
  C:\Windows\System\YABbvwJ.exe
  2⤵
  PID:4420
- C:\Windows\System\wcBcnrp.exe
  C:\Windows\System\wcBcnrp.exe
  2⤵
  PID:2364
- C:\Windows\System\bTnuBsP.exe
  C:\Windows\System\bTnuBsP.exe
  2⤵
  PID:4448
- C:\Windows\System\LVtRUxG.exe
  C:\Windows\System\LVtRUxG.exe
  2⤵
  PID:2488
- C:\Windows\System\XMpACjd.exe
  C:\Windows\System\XMpACjd.exe
  2⤵
  PID:3232
- C:\Windows\System\AUAPhnv.exe
  C:\Windows\System\AUAPhnv.exe
  2⤵
  PID:1732
- C:\Windows\System\DNUwIIm.exe
  C:\Windows\System\DNUwIIm.exe
  2⤵
  PID:4460
- C:\Windows\System\pIGhMho.exe
  C:\Windows\System\pIGhMho.exe
  2⤵
  PID:4472
- C:\Windows\System\dKaBxoU.exe
  C:\Windows\System\dKaBxoU.exe
  2⤵
  PID:2248
- C:\Windows\System\EqcqMbe.exe
  C:\Windows\System\EqcqMbe.exe
  2⤵
  PID:1740
- C:\Windows\System\FOKbyXZ.exe
  C:\Windows\System\FOKbyXZ.exe
  2⤵
  PID:3812
- C:\Windows\System\KEUUetI.exe
  C:\Windows\System\KEUUetI.exe
  2⤵
  PID:2240
- C:\Windows\System\HetSfEH.exe
  C:\Windows\System\HetSfEH.exe
  2⤵
  PID:4044
- C:\Windows\System\uRqUVoK.exe
  C:\Windows\System\uRqUVoK.exe
  2⤵
  PID:3940
- C:\Windows\System\eTkiYnz.exe
  C:\Windows\System\eTkiYnz.exe
  2⤵
  PID:3700
- C:\Windows\System\sWRQVCD.exe
  C:\Windows\System\sWRQVCD.exe
  2⤵
  PID:3604
- C:\Windows\System\ZYavfhH.exe
  C:\Windows\System\ZYavfhH.exe
  2⤵
  PID:4396
- C:\Windows\System\CMbNEUY.exe
  C:\Windows\System\CMbNEUY.exe
  2⤵
  PID:3544
- C:\Windows\System\HciBLzf.exe
  C:\Windows\System\HciBLzf.exe
  2⤵
  PID:3564
- C:\Windows\System\BvOGPHd.exe
  C:\Windows\System\BvOGPHd.exe
  2⤵
  PID:4488
- C:\Windows\System\yuZfjWm.exe
  C:\Windows\System\yuZfjWm.exe
  2⤵
  PID:4184
- C:\Windows\System\nQFHWkG.exe
  C:\Windows\System\nQFHWkG.exe
  2⤵
  PID:4520
- C:\Windows\System\iLLAxgq.exe
  C:\Windows\System\iLLAxgq.exe
  2⤵
  PID:4536
- C:\Windows\System\KuNHNdL.exe
  C:\Windows\System\KuNHNdL.exe
  2⤵
  PID:3316
- C:\Windows\System\WBknYZK.exe
  C:\Windows\System\WBknYZK.exe
  2⤵
  PID:4596
- C:\Windows\System\duznYIR.exe
  C:\Windows\System\duznYIR.exe
  2⤵
  PID:4700
- C:\Windows\System\IsNyIsY.exe
  C:\Windows\System\IsNyIsY.exe
  2⤵
  PID:4736
- C:\Windows\System\ZYklScW.exe
  C:\Windows\System\ZYklScW.exe
  2⤵
  PID:4780
- C:\Windows\System\ePuONla.exe
  C:\Windows\System\ePuONla.exe
  2⤵
  PID:4792
- C:\Windows\System\sQOMqUh.exe
  C:\Windows\System\sQOMqUh.exe
  2⤵
  PID:4812
- C:\Windows\System\UJWHYTl.exe
  C:\Windows\System\UJWHYTl.exe
  2⤵
  PID:4828
- C:\Windows\System\mIXvzpM.exe
  C:\Windows\System\mIXvzpM.exe
  2⤵
  PID:2612
- C:\Windows\System\EAioDut.exe
  C:\Windows\System\EAioDut.exe
  2⤵
  PID:4152
- C:\Windows\System\nZAHuUQ.exe
  C:\Windows\System\nZAHuUQ.exe
  2⤵
  PID:4236
- C:\Windows\System\YhqdPfI.exe
  C:\Windows\System\YhqdPfI.exe
  2⤵
  PID:4332
- C:\Windows\System\sroeElK.exe
  C:\Windows\System\sroeElK.exe
  2⤵
  PID:3832
- C:\Windows\System\lLHJBHd.exe
  C:\Windows\System\lLHJBHd.exe
  2⤵
  PID:3632
- C:\Windows\System\lCABLlz.exe
  C:\Windows\System\lCABLlz.exe
  2⤵
  PID:3472
- C:\Windows\System\UmfAFzI.exe
  C:\Windows\System\UmfAFzI.exe
  2⤵
  PID:3872
- C:\Windows\System\hduVdeU.exe
  C:\Windows\System\hduVdeU.exe
  2⤵
  PID:4748
- C:\Windows\System\bMvTQbS.exe
  C:\Windows\System\bMvTQbS.exe
  2⤵
  PID:4856
- C:\Windows\System\jaNeaNc.exe
  C:\Windows\System\jaNeaNc.exe
  2⤵
  PID:4920
- C:\Windows\System\xdccNyB.exe
  C:\Windows\System\xdccNyB.exe
  2⤵
  PID:3400
- C:\Windows\System\vcbKJxt.exe
  C:\Windows\System\vcbKJxt.exe
  2⤵
  PID:2784
- C:\Windows\System\OtuWuOu.exe
  C:\Windows\System\OtuWuOu.exe
  2⤵
  PID:3520
- C:\Windows\System\xnXqblK.exe
  C:\Windows\System\xnXqblK.exe
  2⤵
  PID:2568
- C:\Windows\System\nmyVopI.exe
  C:\Windows\System\nmyVopI.exe
  2⤵
  PID:1852
- C:\Windows\System\kYfABDK.exe
  C:\Windows\System\kYfABDK.exe
  2⤵
  PID:1580
- C:\Windows\System\rREMiyE.exe
  C:\Windows\System\rREMiyE.exe
  2⤵
  PID:1696
- C:\Windows\System\FhbszPd.exe
  C:\Windows\System\FhbszPd.exe
  2⤵
  PID:4560
- C:\Windows\System\rZkopuw.exe
  C:\Windows\System\rZkopuw.exe
  2⤵
  PID:4988
- C:\Windows\System\xAwHGjw.exe
  C:\Windows\System\xAwHGjw.exe
  2⤵
  PID:5052
- C:\Windows\System\gMUnVgJ.exe
  C:\Windows\System\gMUnVgJ.exe
  2⤵
  PID:5116
- C:\Windows\System\QrhFoSv.exe
  C:\Windows\System\QrhFoSv.exe
  2⤵
  PID:4104
- C:\Windows\System\FCxmAbR.exe
  C:\Windows\System\FCxmAbR.exe
  2⤵
  PID:4284
- C:\Windows\System\UpfLbkH.exe
  C:\Windows\System\UpfLbkH.exe
  2⤵
  PID:2564
- C:\Windows\System\MqsOfxI.exe
  C:\Windows\System\MqsOfxI.exe
  2⤵
  PID:4632
- C:\Windows\System\OyYbIMg.exe
  C:\Windows\System\OyYbIMg.exe
  2⤵
  PID:4648
- C:\Windows\System\mVkMUXe.exe
  C:\Windows\System\mVkMUXe.exe
  2⤵
  PID:4688
- C:\Windows\System\oujABFJ.exe
  C:\Windows\System\oujABFJ.exe
  2⤵
  PID:4876
- C:\Windows\System\biKShsu.exe
  C:\Windows\System\biKShsu.exe
  2⤵
  PID:3228
- C:\Windows\System\dGodQDb.exe
  C:\Windows\System\dGodQDb.exe
  2⤵
  PID:4476
- C:\Windows\System\oxcryEs.exe
  C:\Windows\System\oxcryEs.exe
  2⤵
  PID:2644
- C:\Windows\System\HXosnQL.exe
  C:\Windows\System\HXosnQL.exe
  2⤵
  PID:2804
- C:\Windows\System\dFnFSSW.exe
  C:\Windows\System\dFnFSSW.exe
  2⤵
  PID:2816
- C:\Windows\System\MzFfluh.exe
  C:\Windows\System\MzFfluh.exe
  2⤵
  PID:4968
- C:\Windows\System\pBIRIEf.exe
  C:\Windows\System\pBIRIEf.exe
  2⤵
  PID:5036
- C:\Windows\System\rFQatMs.exe
  C:\Windows\System\rFQatMs.exe
  2⤵
  PID:5100
- C:\Windows\System\SwfMmqZ.exe
  C:\Windows\System\SwfMmqZ.exe
  2⤵
  PID:3616
- C:\Windows\System\AUgAubu.exe
  C:\Windows\System\AUgAubu.exe
  2⤵
  PID:5132
- C:\Windows\System\zgaeObQ.exe
  C:\Windows\System\zgaeObQ.exe
  2⤵
  PID:5148
- C:\Windows\System\QqyoHeP.exe
  C:\Windows\System\QqyoHeP.exe
  2⤵
  PID:5164
- C:\Windows\System\CCJaCjE.exe
  C:\Windows\System\CCJaCjE.exe
  2⤵
  PID:5180
- C:\Windows\System\fgWwtgF.exe
  C:\Windows\System\fgWwtgF.exe
  2⤵
  PID:5196
- C:\Windows\System\WueMXuC.exe
  C:\Windows\System\WueMXuC.exe
  2⤵
  PID:5216
- C:\Windows\System\iKBkzEt.exe
  C:\Windows\System\iKBkzEt.exe
  2⤵
  PID:5232
- C:\Windows\System\UdbIyBd.exe
  C:\Windows\System\UdbIyBd.exe
  2⤵
  PID:5248
- C:\Windows\System\UdeqETa.exe
  C:\Windows\System\UdeqETa.exe
  2⤵
  PID:5264
- C:\Windows\System\LmVfVJR.exe
  C:\Windows\System\LmVfVJR.exe
  2⤵
  PID:5280
- C:\Windows\System\xWRQysc.exe
  C:\Windows\System\xWRQysc.exe
  2⤵
  PID:5296
- C:\Windows\System\ueXirQp.exe
  C:\Windows\System\ueXirQp.exe
  2⤵
  PID:5312
- C:\Windows\System\kEwXfAu.exe
  C:\Windows\System\kEwXfAu.exe
  2⤵
  PID:5332
- C:\Windows\System\WwCTipI.exe
  C:\Windows\System\WwCTipI.exe
  2⤵
  PID:5348
- C:\Windows\System\pFICEMQ.exe
  C:\Windows\System\pFICEMQ.exe
  2⤵
  PID:5384
- C:\Windows\System\nzLNPPa.exe
  C:\Windows\System\nzLNPPa.exe
  2⤵
  PID:5400
- C:\Windows\System\yxkyRCu.exe
  C:\Windows\System\yxkyRCu.exe
  2⤵
  PID:5420
- C:\Windows\System\RAgMAxf.exe
  C:\Windows\System\RAgMAxf.exe
  2⤵
  PID:5436
- C:\Windows\System\nDEAULw.exe
  C:\Windows\System\nDEAULw.exe
  2⤵
  PID:5452
- C:\Windows\System\FFAVGUF.exe
  C:\Windows\System\FFAVGUF.exe
  2⤵
  PID:5468
- C:\Windows\System\LGXfqXP.exe
  C:\Windows\System\LGXfqXP.exe
  2⤵
  PID:5484
- C:\Windows\System\SqlbZGU.exe
  C:\Windows\System\SqlbZGU.exe
  2⤵
  PID:5500
- C:\Windows\System\ZTTrmlE.exe
  C:\Windows\System\ZTTrmlE.exe
  2⤵
  PID:5516
- C:\Windows\System\UjYORLL.exe
  C:\Windows\System\UjYORLL.exe
  2⤵
  PID:5532
- C:\Windows\System\jOKlAFf.exe
  C:\Windows\System\jOKlAFf.exe
  2⤵
  PID:5548
- C:\Windows\System\IHMcLob.exe
  C:\Windows\System\IHMcLob.exe
  2⤵
  PID:5564
- C:\Windows\System\ATWcyWW.exe
  C:\Windows\System\ATWcyWW.exe
  2⤵
  PID:5580
- C:\Windows\System\DFLIUcq.exe
  C:\Windows\System\DFLIUcq.exe
  2⤵
  PID:5596
- C:\Windows\System\WkqlIYb.exe
  C:\Windows\System\WkqlIYb.exe
  2⤵
  PID:5612
- C:\Windows\System\aRHXjVC.exe
  C:\Windows\System\aRHXjVC.exe
  2⤵
  PID:5628
- C:\Windows\System\jpcDuaZ.exe
  C:\Windows\System\jpcDuaZ.exe
  2⤵
  PID:5644
- C:\Windows\System\DysvwgG.exe
  C:\Windows\System\DysvwgG.exe
  2⤵
  PID:5660
- C:\Windows\System\uSGMOtB.exe
  C:\Windows\System\uSGMOtB.exe
  2⤵
  PID:5676
- C:\Windows\System\gyTdaoy.exe
  C:\Windows\System\gyTdaoy.exe
  2⤵
  PID:5692
- C:\Windows\System\thLtWap.exe
  C:\Windows\System\thLtWap.exe
  2⤵
  PID:5708
- C:\Windows\System\vVifSIq.exe
  C:\Windows\System\vVifSIq.exe
  2⤵
  PID:5732
- C:\Windows\System\ibzUsUx.exe
  C:\Windows\System\ibzUsUx.exe
  2⤵
  PID:5748
- C:\Windows\System\oMOPENk.exe
  C:\Windows\System\oMOPENk.exe
  2⤵
  PID:5764
- C:\Windows\System\BKuQBty.exe
  C:\Windows\System\BKuQBty.exe
  2⤵
  PID:5780
- C:\Windows\System\DflJQnb.exe
  C:\Windows\System\DflJQnb.exe
  2⤵
  PID:5796
- C:\Windows\System\uUYDOSU.exe
  C:\Windows\System\uUYDOSU.exe
  2⤵
  PID:5812
- C:\Windows\System\YsIfbmB.exe
  C:\Windows\System\YsIfbmB.exe
  2⤵
  PID:5828
- C:\Windows\System\wMreddv.exe
  C:\Windows\System\wMreddv.exe
  2⤵
  PID:5844
- C:\Windows\System\JjqJCSd.exe
  C:\Windows\System\JjqJCSd.exe
  2⤵
  PID:5860
- C:\Windows\System\GOqtxRE.exe
  C:\Windows\System\GOqtxRE.exe
  2⤵
  PID:5876
- C:\Windows\System\mGQFELH.exe
  C:\Windows\System\mGQFELH.exe
  2⤵
  PID:5940
- C:\Windows\System\xLyfPzR.exe
  C:\Windows\System\xLyfPzR.exe
  2⤵
  PID:5964
- C:\Windows\System\oJeRhDh.exe
  C:\Windows\System\oJeRhDh.exe
  2⤵
  PID:5980
- C:\Windows\System\JTiCWPn.exe
  C:\Windows\System\JTiCWPn.exe
  2⤵
  PID:5996
- C:\Windows\System\rnxxCte.exe
  C:\Windows\System\rnxxCte.exe
  2⤵
  PID:6012
- C:\Windows\System\VhIIsdO.exe
  C:\Windows\System\VhIIsdO.exe
  2⤵
  PID:6028
- C:\Windows\System\LTQoiaQ.exe
  C:\Windows\System\LTQoiaQ.exe
  2⤵
  PID:6044
- C:\Windows\System\NxIcsqE.exe
  C:\Windows\System\NxIcsqE.exe
  2⤵
  PID:6064
- C:\Windows\System\yDzLvWp.exe
  C:\Windows\System\yDzLvWp.exe
  2⤵
  PID:6084
- C:\Windows\System\dgYjPOe.exe
  C:\Windows\System\dgYjPOe.exe
  2⤵
  PID:6100
- C:\Windows\System\pLtrLOo.exe
  C:\Windows\System\pLtrLOo.exe
  2⤵
  PID:6116
- C:\Windows\System\PhLJHSy.exe
  C:\Windows\System\PhLJHSy.exe
  2⤵
  PID:6132
- C:\Windows\System\QprszPs.exe
  C:\Windows\System\QprszPs.exe
  2⤵
  PID:4140
- C:\Windows\System\zSOfyOl.exe
  C:\Windows\System\zSOfyOl.exe
  2⤵
  PID:3560
- C:\Windows\System\SpKmisq.exe
  C:\Windows\System\SpKmisq.exe
  2⤵
  PID:4592
- C:\Windows\System\RyvcXvk.exe
  C:\Windows\System\RyvcXvk.exe
  2⤵
  PID:4788
- C:\Windows\System\nOpDsEd.exe
  C:\Windows\System\nOpDsEd.exe
  2⤵
  PID:4124
- C:\Windows\System\FYznvMd.exe
  C:\Windows\System\FYznvMd.exe
  2⤵
  PID:4368
- C:\Windows\System\XPvOIpG.exe
  C:\Windows\System\XPvOIpG.exe
  2⤵
  PID:4348
- C:\Windows\System\ezpJTMM.exe
  C:\Windows\System\ezpJTMM.exe
  2⤵
  PID:4956
- C:\Windows\System\lMBBLtO.exe
  C:\Windows\System\lMBBLtO.exe
  2⤵
  PID:1976
- C:\Windows\System\MIklKVW.exe
  C:\Windows\System\MIklKVW.exe
  2⤵
  PID:4628
- C:\Windows\System\pdQKcKB.exe
  C:\Windows\System\pdQKcKB.exe
  2⤵
  PID:5208
- C:\Windows\System\TXeLZDH.exe
  C:\Windows\System\TXeLZDH.exe
  2⤵
  PID:5276
- C:\Windows\System\CoCVInp.exe
  C:\Windows\System\CoCVInp.exe
  2⤵
  PID:776
- C:\Windows\System\tPyrJdc.exe
  C:\Windows\System\tPyrJdc.exe
  2⤵
  PID:1944
- C:\Windows\System\JNzAqKL.exe
  C:\Windows\System\JNzAqKL.exe
  2⤵
  PID:4484
- C:\Windows\System\VIvnnqd.exe
  C:\Windows\System\VIvnnqd.exe
  2⤵
  PID:4936
- C:\Windows\System\cDbZqZk.exe
  C:\Windows\System\cDbZqZk.exe
  2⤵
  PID:4672
- C:\Windows\System\LOEapnl.exe
  C:\Windows\System\LOEapnl.exe
  2⤵
  PID:4716
- C:\Windows\System\nXbhhgV.exe
  C:\Windows\System\nXbhhgV.exe
  2⤵
  PID:5540
- C:\Windows\System\ztmyVgx.exe
  C:\Windows\System\ztmyVgx.exe
  2⤵
  PID:5820
- C:\Windows\System\QbCguDI.exe
  C:\Windows\System\QbCguDI.exe
  2⤵
  PID:5428
- C:\Windows\System\MGaKRvO.exe
  C:\Windows\System\MGaKRvO.exe
  2⤵
  PID:5476
- C:\Windows\System\aMotmLS.exe
  C:\Windows\System\aMotmLS.exe
  2⤵
  PID:3540
- C:\Windows\System\psXZtsB.exe
  C:\Windows\System\psXZtsB.exe
  2⤵
  PID:5900
- C:\Windows\System\ZRYiOoR.exe
  C:\Windows\System\ZRYiOoR.exe
  2⤵
  PID:5544
- C:\Windows\System\UCSGiqR.exe
  C:\Windows\System\UCSGiqR.exe
  2⤵
  PID:5640
- C:\Windows\System\zLsHmfS.exe
  C:\Windows\System\zLsHmfS.exe
  2⤵
  PID:5024
- C:\Windows\System\afAGYdG.exe
  C:\Windows\System\afAGYdG.exe
  2⤵
  PID:5344
- C:\Windows\System\ofZvLCd.exe
  C:\Windows\System\ofZvLCd.exe
  2⤵
  PID:6112
- C:\Windows\System\EpywqvA.exe
  C:\Windows\System\EpywqvA.exe
  2⤵
  PID:5772
- C:\Windows\System\LrcEwkz.exe
  C:\Windows\System\LrcEwkz.exe
  2⤵
  PID:2072
- C:\Windows\System\hyNijmY.exe
  C:\Windows\System\hyNijmY.exe
  2⤵
  PID:4532
- C:\Windows\System\FaYNxHq.exe
  C:\Windows\System\FaYNxHq.exe
  2⤵
  PID:4000
- C:\Windows\System\efPqoJE.exe
  C:\Windows\System\efPqoJE.exe
  2⤵
  PID:4508
- C:\Windows\System\lAQveTd.exe
  C:\Windows\System\lAQveTd.exe
  2⤵
  PID:108
- C:\Windows\System\lcbxpzj.exe
  C:\Windows\System\lcbxpzj.exe
  2⤵
  PID:6056
- C:\Windows\System\DXUZAEd.exe
  C:\Windows\System\DXUZAEd.exe
  2⤵
  PID:5192
- C:\Windows\System\FqHDpVT.exe
  C:\Windows\System\FqHDpVT.exe
  2⤵
  PID:3664
- C:\Windows\System\WrjguMy.exe
  C:\Windows\System\WrjguMy.exe
  2⤵
  PID:1208
- C:\Windows\System\KsBjana.exe
  C:\Windows\System\KsBjana.exe
  2⤵
  PID:4824
- C:\Windows\System\gaWzPfc.exe
  C:\Windows\System\gaWzPfc.exe
  2⤵
  PID:4364
- C:\Windows\System\GluHCNW.exe
  C:\Windows\System\GluHCNW.exe
  2⤵
  PID:2208
- C:\Windows\System\vBFQIlh.exe
  C:\Windows\System\vBFQIlh.exe
  2⤵
  PID:4504
- C:\Windows\System\qUksaLZ.exe
  C:\Windows\System\qUksaLZ.exe
  2⤵
  PID:4572
- C:\Windows\System\leBhkum.exe
  C:\Windows\System\leBhkum.exe
  2⤵
  PID:3548
- C:\Windows\System\uDVhVmg.exe
  C:\Windows\System\uDVhVmg.exe
  2⤵
  PID:4224
- C:\Windows\System\qNmKIKz.exe
  C:\Windows\System\qNmKIKz.exe
  2⤵
  PID:2824
- C:\Windows\System\fgwdDTc.exe
  C:\Windows\System\fgwdDTc.exe
  2⤵
  PID:4492
- C:\Windows\System\vHXKlKx.exe
  C:\Windows\System\vHXKlKx.exe
  2⤵
  PID:4840
- C:\Windows\System\UZFfpaQ.exe
  C:\Windows\System\UZFfpaQ.exe
  2⤵
  PID:1440
- C:\Windows\System\rzpaeWF.exe
  C:\Windows\System\rzpaeWF.exe
  2⤵
  PID:2912
- C:\Windows\System\cLzDbxG.exe
  C:\Windows\System\cLzDbxG.exe
  2⤵
  PID:488
- C:\Windows\System\ACkeQvw.exe
  C:\Windows\System\ACkeQvw.exe
  2⤵
  PID:5368
- C:\Windows\System\gtsaVLk.exe
  C:\Windows\System\gtsaVLk.exe
  2⤵
  PID:352
- C:\Windows\System\JOFLTsk.exe
  C:\Windows\System\JOFLTsk.exe
  2⤵
  PID:5592
- C:\Windows\System\BGyPMKU.exe
  C:\Windows\System\BGyPMKU.exe
  2⤵
  PID:5656
- C:\Windows\System\idIiImn.exe
  C:\Windows\System\idIiImn.exe
  2⤵
  PID:5720
- C:\Windows\System\rmGPjMN.exe
  C:\Windows\System\rmGPjMN.exe
  2⤵
  PID:5528
- C:\Windows\System\pLkdCAy.exe
  C:\Windows\System\pLkdCAy.exe
  2⤵
  PID:4772
- C:\Windows\System\AIvPHbl.exe
  C:\Windows\System\AIvPHbl.exe
  2⤵
  PID:3332
- C:\Windows\System\VHBNwOx.exe
  C:\Windows\System\VHBNwOx.exe
  2⤵
  PID:5572
- C:\Windows\System\itNTGAR.exe
  C:\Windows\System\itNTGAR.exe
  2⤵
  PID:5576
- C:\Windows\System\JVWBDuz.exe
  C:\Windows\System\JVWBDuz.exe
  2⤵
  PID:5888
- C:\Windows\System\BOfijxc.exe
  C:\Windows\System\BOfijxc.exe
  2⤵
  PID:5668
- C:\Windows\System\CCcDjad.exe
  C:\Windows\System\CCcDjad.exe
  2⤵
  PID:5392
- C:\Windows\System\MmPkMPz.exe
  C:\Windows\System\MmPkMPz.exe
  2⤵
  PID:1608
- C:\Windows\System\pgZLqUE.exe
  C:\Windows\System\pgZLqUE.exe
  2⤵
  PID:5920
- C:\Windows\System\bPnHQsU.exe
  C:\Windows\System\bPnHQsU.exe
  2⤵
  PID:5460
- C:\Windows\System\LdGdmRN.exe
  C:\Windows\System\LdGdmRN.exe
  2⤵
  PID:4412
- C:\Windows\System\fyXkqNr.exe
  C:\Windows\System\fyXkqNr.exe
  2⤵
  PID:4304
- C:\Windows\System\EcRdmGH.exe
  C:\Windows\System\EcRdmGH.exe
  2⤵
  PID:2180
- C:\Windows\System\EcSOOOc.exe
  C:\Windows\System\EcSOOOc.exe
  2⤵
  PID:2688
- C:\Windows\System\wRGirxc.exe
  C:\Windows\System\wRGirxc.exe
  2⤵
  PID:4620
- C:\Windows\System\NbkPPDB.exe
  C:\Windows\System\NbkPPDB.exe
  2⤵
  PID:3372
- C:\Windows\System\oyzTbat.exe
  C:\Windows\System\oyzTbat.exe
  2⤵
  PID:5836
- C:\Windows\System\MyMLElS.exe
  C:\Windows\System\MyMLElS.exe
  2⤵
  PID:5260
- C:\Windows\System\lFyVTgd.exe
  C:\Windows\System\lFyVTgd.exe
  2⤵
  PID:5872
- C:\Windows\System\nTXqsWa.exe
  C:\Windows\System\nTXqsWa.exe
  2⤵
  PID:5224
- C:\Windows\System\BNKegpe.exe
  C:\Windows\System\BNKegpe.exe
  2⤵
  PID:3420
- C:\Windows\System\JNLMQGa.exe
  C:\Windows\System\JNLMQGa.exe
  2⤵
  PID:2064
- C:\Windows\System\vYMhZIq.exe
  C:\Windows\System\vYMhZIq.exe
  2⤵
  PID:6036
- C:\Windows\System\KzBVwCm.exe
  C:\Windows\System\KzBVwCm.exe
  2⤵
  PID:2500
- C:\Windows\System\qzscIso.exe
  C:\Windows\System\qzscIso.exe
  2⤵
  PID:5088
- C:\Windows\System\bSGbnhM.exe
  C:\Windows\System\bSGbnhM.exe
  2⤵
  PID:4576
- C:\Windows\System\WYGpyLu.exe
  C:\Windows\System\WYGpyLu.exe
  2⤵
  PID:5140
- C:\Windows\System\rFtxsBf.exe
  C:\Windows\System\rFtxsBf.exe
  2⤵
  PID:5172
- C:\Windows\System\WNKHMOB.exe
  C:\Windows\System\WNKHMOB.exe
  2⤵
  PID:6072
- C:\Windows\System\WGpMjOp.exe
  C:\Windows\System\WGpMjOp.exe
  2⤵
  PID:5952
- C:\Windows\System\yHqJIqK.exe
  C:\Windows\System\yHqJIqK.exe
  2⤵
  PID:6128
- C:\Windows\System\iJlxwFO.exe
  C:\Windows\System\iJlxwFO.exe
  2⤵
  PID:6096
- C:\Windows\System\doEwGHR.exe
  C:\Windows\System\doEwGHR.exe
  2⤵
  PID:5700
- C:\Windows\System\zlsGhet.exe
  C:\Windows\System\zlsGhet.exe
  2⤵
  PID:5804
- C:\Windows\System\NDegKCU.exe
  C:\Windows\System\NDegKCU.exe
  2⤵
  PID:4080
- C:\Windows\System\KBFZbtq.exe
  C:\Windows\System\KBFZbtq.exe
  2⤵
  PID:3556
- C:\Windows\System\HjaLucY.exe
  C:\Windows\System\HjaLucY.exe
  2⤵
  PID:5324
- C:\Windows\System\HFUKzMu.exe
  C:\Windows\System\HFUKzMu.exe
  2⤵
  PID:2312
- C:\Windows\System\rdiZjYw.exe
  C:\Windows\System\rdiZjYw.exe
  2⤵
  PID:4848
- C:\Windows\System\FfLeCPm.exe
  C:\Windows\System\FfLeCPm.exe
  2⤵
  PID:4952
- C:\Windows\System\aedyuyy.exe
  C:\Windows\System\aedyuyy.exe
  2⤵
  PID:5212
- C:\Windows\System\ClmKilj.exe
  C:\Windows\System\ClmKilj.exe
  2⤵
  PID:3404
- C:\Windows\System\fQKjWrK.exe
  C:\Windows\System\fQKjWrK.exe
  2⤵
  PID:2216
- C:\Windows\System\mRmYUoq.exe
  C:\Windows\System\mRmYUoq.exe
  2⤵
  PID:1780
- C:\Windows\System\GzIaPaD.exe
  C:\Windows\System\GzIaPaD.exe
  2⤵
  PID:344
- C:\Windows\System\dUkFQMx.exe
  C:\Windows\System\dUkFQMx.exe
  2⤵
  PID:4228
- C:\Windows\System\Rnqrzpz.exe
  C:\Windows\System\Rnqrzpz.exe
  2⤵
  PID:5916
- C:\Windows\System\jSzytCv.exe
  C:\Windows\System\jSzytCv.exe
  2⤵
  PID:5688
- C:\Windows\System\hkUogYd.exe
  C:\Windows\System\hkUogYd.exe
  2⤵
  PID:1652
- C:\Windows\System\QyzlSgW.exe
  C:\Windows\System\QyzlSgW.exe
  2⤵
  PID:2672
- C:\Windows\System\VajrqXW.exe
  C:\Windows\System\VajrqXW.exe
  2⤵
  PID:2380
- C:\Windows\System\pmcyLTB.exe
  C:\Windows\System\pmcyLTB.exe
  2⤵
  PID:5376
- C:\Windows\System\pXChEFM.exe
  C:\Windows\System\pXChEFM.exe
  2⤵
  PID:2512
- C:\Windows\System\jXcSsFa.exe
  C:\Windows\System\jXcSsFa.exe
  2⤵
  PID:3972
- C:\Windows\System\SydHmES.exe
  C:\Windows\System\SydHmES.exe
  2⤵
  PID:5908
- C:\Windows\System\eKtNPSm.exe
  C:\Windows\System\eKtNPSm.exe
  2⤵
  PID:4556
- C:\Windows\System\QGovsar.exe
  C:\Windows\System\QGovsar.exe
  2⤵
  PID:4908
- C:\Windows\System\eYTfool.exe
  C:\Windows\System\eYTfool.exe
  2⤵
  PID:1844
- C:\Windows\System\tEIHxRr.exe
  C:\Windows\System\tEIHxRr.exe
  2⤵
  PID:5480
- C:\Windows\System\ZyzFEdW.exe
  C:\Windows\System\ZyzFEdW.exe
  2⤵
  PID:4416
- C:\Windows\System\AEvgVck.exe
  C:\Windows\System\AEvgVck.exe
  2⤵
  PID:5976
- C:\Windows\System\UnDbwZc.exe
  C:\Windows\System\UnDbwZc.exe
  2⤵
  PID:6140
- C:\Windows\System\RrWodpN.exe
  C:\Windows\System\RrWodpN.exe
  2⤵
  PID:2892
- C:\Windows\System\KzvQmWk.exe
  C:\Windows\System\KzvQmWk.exe
  2⤵
  PID:3344
- C:\Windows\System\qVgmDqv.exe
  C:\Windows\System\qVgmDqv.exe
  2⤵
  PID:5084
- C:\Windows\System\NIvsBLS.exe
  C:\Windows\System\NIvsBLS.exe
  2⤵
  PID:5972
- C:\Windows\System\feMXSGn.exe
  C:\Windows\System\feMXSGn.exe
  2⤵
  PID:5868
- C:\Windows\System\pJmdKWj.exe
  C:\Windows\System\pJmdKWj.exe
  2⤵
  PID:4984
- C:\Windows\System\mYhJjZG.exe
  C:\Windows\System\mYhJjZG.exe
  2⤵
  PID:5320
- C:\Windows\System\ifOuTGv.exe
  C:\Windows\System\ifOuTGv.exe
  2⤵
  PID:6080
- C:\Windows\System\MDfbGHh.exe
  C:\Windows\System\MDfbGHh.exe
  2⤵
  PID:6124
- C:\Windows\System\WbNzhym.exe
  C:\Windows\System\WbNzhym.exe
  2⤵
  PID:6020
- C:\Windows\System\IuwfILY.exe
  C:\Windows\System\IuwfILY.exe
  2⤵
  PID:648
- C:\Windows\System\OjBTIfA.exe
  C:\Windows\System\OjBTIfA.exe
  2⤵
  PID:5588
- C:\Windows\System\XTDTYHo.exe
  C:\Windows\System\XTDTYHo.exe
  2⤵
  PID:2396
- C:\Windows\System\cKykfeE.exe
  C:\Windows\System\cKykfeE.exe
  2⤵
  PID:4432
- C:\Windows\System\LdJeyhI.exe
  C:\Windows\System\LdJeyhI.exe
  2⤵
  PID:3904
- C:\Windows\System\lsqazwW.exe
  C:\Windows\System\lsqazwW.exe
  2⤵
  PID:4588
- C:\Windows\System\gmalzxn.exe
  C:\Windows\System\gmalzxn.exe
  2⤵
  PID:3460
- C:\Windows\System\kGCvILI.exe
  C:\Windows\System\kGCvILI.exe
  2⤵
  PID:4644
- C:\Windows\System\qmyCzfe.exe
  C:\Windows\System\qmyCzfe.exe
  2⤵
  PID:5932
- C:\Windows\System\aTEdqlN.exe
  C:\Windows\System\aTEdqlN.exe
  2⤵
  PID:5884
- C:\Windows\System\XlrpTFd.exe
  C:\Windows\System\XlrpTFd.exe
  2⤵
  PID:1184
- C:\Windows\System\JaBBZju.exe
  C:\Windows\System\JaBBZju.exe
  2⤵
  PID:5988
- C:\Windows\System\hCnmxKB.exe
  C:\Windows\System\hCnmxKB.exe
  2⤵
  PID:5604
- C:\Windows\System\ltQdaaZ.exe
  C:\Windows\System\ltQdaaZ.exe
  2⤵
  PID:5004
- C:\Windows\System\XlmvodV.exe
  C:\Windows\System\XlmvodV.exe
  2⤵
  PID:5124
- C:\Windows\System\XRlqGjf.exe
  C:\Windows\System\XRlqGjf.exe
  2⤵
  PID:5444
- C:\Windows\System\MhtnBtx.exe
  C:\Windows\System\MhtnBtx.exe
  2⤵
  PID:6024
- C:\Windows\System\hQtCkuH.exe
  C:\Windows\System\hQtCkuH.exe
  2⤵
  PID:2616
- C:\Windows\System\CPPJEGi.exe
  C:\Windows\System\CPPJEGi.exe
  2⤵
  PID:5508
- C:\Windows\System\kLLEnJl.exe
  C:\Windows\System\kLLEnJl.exe
  2⤵
  PID:2204
- C:\Windows\System\PjvOOjN.exe
  C:\Windows\System\PjvOOjN.exe
  2⤵
  PID:2600
- C:\Windows\System\XSoWxaI.exe
  C:\Windows\System\XSoWxaI.exe
  2⤵
  PID:5356
- C:\Windows\System\gVyWQfA.exe
  C:\Windows\System\gVyWQfA.exe
  2⤵
  PID:5144
- C:\Windows\System\OwPzoSz.exe
  C:\Windows\System\OwPzoSz.exe
  2⤵
  PID:1556
- C:\Windows\System\lUkEMsS.exe
  C:\Windows\System\lUkEMsS.exe
  2⤵
  PID:5776
- C:\Windows\System\IzBTwdk.exe
  C:\Windows\System\IzBTwdk.exe
  2⤵
  PID:764
- C:\Windows\System\IByXizC.exe
  C:\Windows\System\IByXizC.exe
  2⤵
  PID:5340
- C:\Windows\System\Xlciage.exe
  C:\Windows\System\Xlciage.exe
  2⤵
  PID:6160
- C:\Windows\System\NQqgXGd.exe
  C:\Windows\System\NQqgXGd.exe
  2⤵
  PID:6176
- C:\Windows\System\XDwZMnf.exe
  C:\Windows\System\XDwZMnf.exe
  2⤵
  PID:6192
- C:\Windows\System\OdWCbJj.exe
  C:\Windows\System\OdWCbJj.exe
  2⤵
  PID:6208
- C:\Windows\System\KolDGMp.exe
  C:\Windows\System\KolDGMp.exe
  2⤵
  PID:6224
- C:\Windows\System\PvGsWSJ.exe
  C:\Windows\System\PvGsWSJ.exe
  2⤵
  PID:6240
- C:\Windows\System\wSPNFRT.exe
  C:\Windows\System\wSPNFRT.exe
  2⤵
  PID:6256
- C:\Windows\System\rTnphvW.exe
  C:\Windows\System\rTnphvW.exe
  2⤵
  PID:6272
- C:\Windows\System\XqiQxrI.exe
  C:\Windows\System\XqiQxrI.exe
  2⤵
  PID:6288
- C:\Windows\System\HhoqbnU.exe
  C:\Windows\System\HhoqbnU.exe
  2⤵
  PID:6304
- C:\Windows\System\MjinfbD.exe
  C:\Windows\System\MjinfbD.exe
  2⤵
  PID:6320
- C:\Windows\System\sZdRCtF.exe
  C:\Windows\System\sZdRCtF.exe
  2⤵
  PID:6336
- C:\Windows\System\CQqzUmM.exe
  C:\Windows\System\CQqzUmM.exe
  2⤵
  PID:6352
- C:\Windows\System\aVDXtzg.exe
  C:\Windows\System\aVDXtzg.exe
  2⤵
  PID:6368
- C:\Windows\System\zUpgakn.exe
  C:\Windows\System\zUpgakn.exe
  2⤵
  PID:6384
- C:\Windows\System\NFaRYNM.exe
  C:\Windows\System\NFaRYNM.exe
  2⤵
  PID:6400
- C:\Windows\System\wbwjqho.exe
  C:\Windows\System\wbwjqho.exe
  2⤵
  PID:6416
- C:\Windows\System\irIdbtN.exe
  C:\Windows\System\irIdbtN.exe
  2⤵
  PID:6432
- C:\Windows\System\aUtOTcm.exe
  C:\Windows\System\aUtOTcm.exe
  2⤵
  PID:6448
- C:\Windows\System\XqcRqNr.exe
  C:\Windows\System\XqcRqNr.exe
  2⤵
  PID:6464
- C:\Windows\System\Vovhswb.exe
  C:\Windows\System\Vovhswb.exe
  2⤵
  PID:6480
- C:\Windows\System\oAbLzsW.exe
  C:\Windows\System\oAbLzsW.exe
  2⤵
  PID:6496
- C:\Windows\System\bLhAhKg.exe
  C:\Windows\System\bLhAhKg.exe
  2⤵
  PID:6512
- C:\Windows\System\FFJvIXM.exe
  C:\Windows\System\FFJvIXM.exe
  2⤵
  PID:6532
- C:\Windows\System\vpiUByl.exe
  C:\Windows\System\vpiUByl.exe
  2⤵
  PID:6548
- C:\Windows\System\EfXSaic.exe
  C:\Windows\System\EfXSaic.exe
  2⤵
  PID:6564
- C:\Windows\System\WzozdcV.exe
  C:\Windows\System\WzozdcV.exe
  2⤵
  PID:6580
- C:\Windows\System\OepEFTK.exe
  C:\Windows\System\OepEFTK.exe
  2⤵
  PID:6596
- C:\Windows\System\ipWOcKP.exe
  C:\Windows\System\ipWOcKP.exe
  2⤵
  PID:6612
- C:\Windows\System\eGAqxFB.exe
  C:\Windows\System\eGAqxFB.exe
  2⤵
  PID:6628
- C:\Windows\System\TxyHKif.exe
  C:\Windows\System\TxyHKif.exe
  2⤵
  PID:6644
- C:\Windows\System\gYipBrU.exe
  C:\Windows\System\gYipBrU.exe
  2⤵
  PID:6660
- C:\Windows\System\Agfgvta.exe
  C:\Windows\System\Agfgvta.exe
  2⤵
  PID:6696
- C:\Windows\System\EXanRat.exe
  C:\Windows\System\EXanRat.exe
  2⤵
  PID:6712
- C:\Windows\System\maytRnx.exe
  C:\Windows\System\maytRnx.exe
  2⤵
  PID:6728
- C:\Windows\System\YZYBsCy.exe
  C:\Windows\System\YZYBsCy.exe
  2⤵
  PID:6744
- C:\Windows\System\dcizdIU.exe
  C:\Windows\System\dcizdIU.exe
  2⤵
  PID:6760
- C:\Windows\System\eerXTMf.exe
  C:\Windows\System\eerXTMf.exe
  2⤵
  PID:6776
- C:\Windows\System\mdtxLIg.exe
  C:\Windows\System\mdtxLIg.exe
  2⤵
  PID:6796
- C:\Windows\System\CAlYYZF.exe
  C:\Windows\System\CAlYYZF.exe
  2⤵
  PID:6812
- C:\Windows\System\bpSvgUH.exe
  C:\Windows\System\bpSvgUH.exe
  2⤵
  PID:6828
- C:\Windows\System\nHEtOjN.exe
  C:\Windows\System\nHEtOjN.exe
  2⤵
  PID:6844
- C:\Windows\System\RCvGYKK.exe
  C:\Windows\System\RCvGYKK.exe
  2⤵
  PID:6860
- C:\Windows\System\FkodNWd.exe
  C:\Windows\System\FkodNWd.exe
  2⤵
  PID:6876
- C:\Windows\System\XbvxYCn.exe
  C:\Windows\System\XbvxYCn.exe
  2⤵
  PID:6892
- C:\Windows\System\qNKGJki.exe
  C:\Windows\System\qNKGJki.exe
  2⤵
  PID:6908
- C:\Windows\System\tneFLcR.exe
  C:\Windows\System\tneFLcR.exe
  2⤵
  PID:6924
- C:\Windows\System\YfgQIja.exe
  C:\Windows\System\YfgQIja.exe
  2⤵
  PID:6940
- C:\Windows\System\xLqHKlY.exe
  C:\Windows\System\xLqHKlY.exe
  2⤵
  PID:6956
- C:\Windows\System\CcOLJWA.exe
  C:\Windows\System\CcOLJWA.exe
  2⤵
  PID:6976
- C:\Windows\System\nMQianj.exe
  C:\Windows\System\nMQianj.exe
  2⤵
  PID:6992
- C:\Windows\System\wcrGNuA.exe
  C:\Windows\System\wcrGNuA.exe
  2⤵
  PID:7008
- C:\Windows\System\UzKxXnV.exe
  C:\Windows\System\UzKxXnV.exe
  2⤵
  PID:7024
- C:\Windows\System\iGaduWk.exe
  C:\Windows\System\iGaduWk.exe
  2⤵
  PID:7040
- C:\Windows\System\YHyyPty.exe
  C:\Windows\System\YHyyPty.exe
  2⤵
  PID:7056
- C:\Windows\System\OCnRnLM.exe
  C:\Windows\System\OCnRnLM.exe
  2⤵
  PID:7072
- C:\Windows\System\FQWywNF.exe
  C:\Windows\System\FQWywNF.exe
  2⤵
  PID:7088
- C:\Windows\System\RmanuXi.exe
  C:\Windows\System\RmanuXi.exe
  2⤵
  PID:7104
- C:\Windows\System\fmbLBVE.exe
  C:\Windows\System\fmbLBVE.exe
  2⤵
  PID:7120
- C:\Windows\System\EwxBfqt.exe
  C:\Windows\System\EwxBfqt.exe
  2⤵
  PID:7136
- C:\Windows\System\rVriQiY.exe
  C:\Windows\System\rVriQiY.exe
  2⤵
  PID:7152
- C:\Windows\System\ZLNceyS.exe
  C:\Windows\System\ZLNceyS.exe
  2⤵
  PID:3808
- C:\Windows\System\GWVSPKs.exe
  C:\Windows\System\GWVSPKs.exe
  2⤵
  PID:2596
- C:\Windows\System\PiHvcsa.exe
  C:\Windows\System\PiHvcsa.exe
  2⤵
  PID:6188
- C:\Windows\System\rGDumXl.exe
  C:\Windows\System\rGDumXl.exe
  2⤵
  PID:6248
- C:\Windows\System\IWlWznO.exe
  C:\Windows\System\IWlWznO.exe
  2⤵
  PID:5624
- C:\Windows\System\iPQpGay.exe
  C:\Windows\System\iPQpGay.exe
  2⤵
  PID:5556
- C:\Windows\System\qJwoPwS.exe
  C:\Windows\System\qJwoPwS.exe
  2⤵
  PID:1664
- C:\Windows\System\LeVGeDb.exe
  C:\Windows\System\LeVGeDb.exe
  2⤵
  PID:6232
- C:\Windows\System\SfzGADm.exe
  C:\Windows\System\SfzGADm.exe
  2⤵
  PID:4640
- C:\Windows\System\WwzOUcL.exe
  C:\Windows\System\WwzOUcL.exe
  2⤵
  PID:6472
- C:\Windows\System\NpQSdUA.exe
  C:\Windows\System\NpQSdUA.exe
  2⤵
  PID:6572
- C:\Windows\System\OnqzrjQ.exe
  C:\Windows\System\OnqzrjQ.exe
  2⤵
  PID:6608
- C:\Windows\System\avdbjGm.exe
  C:\Windows\System\avdbjGm.exe
  2⤵
  PID:6444
- C:\Windows\System\pZZtmyC.exe
  C:\Windows\System\pZZtmyC.exe
  2⤵
  PID:6492
- C:\Windows\System\cDScwsg.exe
  C:\Windows\System\cDScwsg.exe
  2⤵
  PID:6524
- C:\Windows\System\yqcJxUh.exe
  C:\Windows\System\yqcJxUh.exe
  2⤵
  PID:6588
- C:\Windows\System\ruHOXGx.exe
  C:\Windows\System\ruHOXGx.exe
  2⤵
  PID:6652
- C:\Windows\System\aXMFcWx.exe
  C:\Windows\System\aXMFcWx.exe
  2⤵
  PID:6720
- C:\Windows\System\XztCYvx.exe
  C:\Windows\System\XztCYvx.exe
  2⤵
  PID:6724
- C:\Windows\System\agvTOMx.exe
  C:\Windows\System\agvTOMx.exe
  2⤵
  PID:6788
- C:\Windows\System\UeUXZpi.exe
  C:\Windows\System\UeUXZpi.exe
  2⤵
  PID:6852
- C:\Windows\System\kUGveLw.exe
  C:\Windows\System\kUGveLw.exe
  2⤵
  PID:6948
- C:\Windows\System\weediQU.exe
  C:\Windows\System\weediQU.exe
  2⤵
  PID:6768
- C:\Windows\System\FTgidNh.exe
  C:\Windows\System\FTgidNh.exe
  2⤵
  PID:7016
- C:\Windows\System\PUTvCJo.exe
  C:\Windows\System\PUTvCJo.exe
  2⤵
  PID:6900
- C:\Windows\System\ktEbsPz.exe
  C:\Windows\System\ktEbsPz.exe
  2⤵
  PID:7004
- C:\Windows\System\BpFrzWX.exe
  C:\Windows\System\BpFrzWX.exe
  2⤵
  PID:6872
- C:\Windows\System\HvAHupe.exe
  C:\Windows\System\HvAHupe.exe
  2⤵
  PID:6936
- C:\Windows\System\UORaWvV.exe
  C:\Windows\System\UORaWvV.exe
  2⤵
  PID:7000
- C:\Windows\System\UGNOjRN.exe
  C:\Windows\System\UGNOjRN.exe
  2⤵
  PID:7084
- C:\Windows\System\IRmCEIY.exe
  C:\Windows\System\IRmCEIY.exe
  2⤵
  PID:7148
- C:\Windows\System\cDquWpG.exe
  C:\Windows\System\cDquWpG.exe
  2⤵
  PID:6544
- C:\Windows\System\ZaZGctp.exe
  C:\Windows\System\ZaZGctp.exe
  2⤵
  PID:6556
- C:\Windows\System\OizHjXt.exe
  C:\Windows\System\OizHjXt.exe
  2⤵
  PID:6756
- C:\Windows\System\xUJKRdH.exe
  C:\Windows\System\xUJKRdH.exe
  2⤵
  PID:6916
- C:\Windows\System\GdJWmZj.exe
  C:\Windows\System\GdJWmZj.exe
  2⤵
  PID:6808
- C:\Windows\System\PTqeTTk.exe
  C:\Windows\System\PTqeTTk.exe
  2⤵
  PID:7064
- C:\Windows\System\BHuYUIt.exe
  C:\Windows\System\BHuYUIt.exe
  2⤵
  PID:6220
- C:\Windows\System\FsjIlMH.exe
  C:\Windows\System\FsjIlMH.exe
  2⤵
  PID:6672
- C:\Windows\System\FelEkZP.exe
  C:\Windows\System\FelEkZP.exe
  2⤵
  PID:6736
- C:\Windows\System\rNCnXZT.exe
  C:\Windows\System\rNCnXZT.exe
  2⤵
  PID:6428
- C:\Windows\System\MPUgBUM.exe
  C:\Windows\System\MPUgBUM.exe
  2⤵
  PID:6824
- C:\Windows\System\kXuxhUD.exe
  C:\Windows\System\kXuxhUD.exe
  2⤵
  PID:7052
- C:\Windows\System\ODJfbic.exe
  C:\Windows\System\ODJfbic.exe
  2⤵
  PID:7144
- C:\Windows\System\oxkRVsm.exe
  C:\Windows\System\oxkRVsm.exe
  2⤵
  PID:7068
- C:\Windows\System\skAhaSR.exe
  C:\Windows\System\skAhaSR.exe
  2⤵
  PID:2664
- C:\Windows\System\AKcHXqE.exe
  C:\Windows\System\AKcHXqE.exe
  2⤵
  PID:6280
- C:\Windows\System\QnhojEa.exe
  C:\Windows\System\QnhojEa.exe
  2⤵
  PID:5380
- C:\Windows\System\TDFdXew.exe
  C:\Windows\System\TDFdXew.exe
  2⤵
  PID:6172
- C:\Windows\System\uVWbPWY.exe
  C:\Windows\System\uVWbPWY.exe
  2⤵
  PID:6392
- C:\Windows\System\kQdbriZ.exe
  C:\Windows\System\kQdbriZ.exe
  2⤵
  PID:6300
- C:\Windows\System\BmHNdMo.exe
  C:\Windows\System\BmHNdMo.exe
  2⤵
  PID:6668
- C:\Windows\System\cOmRVhf.exe
  C:\Windows\System\cOmRVhf.exe
  2⤵
  PID:5364
- C:\Windows\System\RhlWelm.exe
  C:\Windows\System\RhlWelm.exe
  2⤵
  PID:6624
- C:\Windows\System\XairuRL.exe
  C:\Windows\System\XairuRL.exe
  2⤵
  PID:7164
- C:\Windows\System\DeplPFm.exe
  C:\Windows\System\DeplPFm.exe
  2⤵
  PID:7116
- C:\Windows\System\nxMWUJh.exe
  C:\Windows\System\nxMWUJh.exe
  2⤵
  PID:6364
- C:\Windows\System\PiJAKrF.exe
  C:\Windows\System\PiJAKrF.exe
  2⤵
  PID:6268
- C:\Windows\System\JLodLMt.exe
  C:\Windows\System\JLodLMt.exe
  2⤵
  PID:6344
- C:\Windows\System\pLNxOaA.exe
  C:\Windows\System\pLNxOaA.exe
  2⤵
  PID:2560
- C:\Windows\System\JqbGWlW.exe
  C:\Windows\System\JqbGWlW.exe
  2⤵
  PID:6380
- C:\Windows\System\NXuhxiD.exe
  C:\Windows\System\NXuhxiD.exe
  2⤵
  PID:6884
- C:\Windows\System\wEhlaUL.exe
  C:\Windows\System\wEhlaUL.exe
  2⤵
  PID:7096
- C:\Windows\System\pdJOuIC.exe
  C:\Windows\System\pdJOuIC.exe
  2⤵
  PID:6640
- C:\Windows\System\wgdUaEn.exe
  C:\Windows\System\wgdUaEn.exe
  2⤵
  PID:7048
- C:\Windows\System\OifvZbP.exe
  C:\Windows\System\OifvZbP.exe
  2⤵
  PID:6704
- C:\Windows\System\ZSICiac.exe
  C:\Windows\System\ZSICiac.exe
  2⤵
  PID:2872
- C:\Windows\System\fPbufbt.exe
  C:\Windows\System\fPbufbt.exe
  2⤵
  PID:2024
- C:\Windows\System\XARSmWj.exe
  C:\Windows\System\XARSmWj.exe
  2⤵
  PID:6604
- C:\Windows\System\xarAqeS.exe
  C:\Windows\System\xarAqeS.exe
  2⤵
  PID:6152
- C:\Windows\System\QSVVJhZ.exe
  C:\Windows\System\QSVVJhZ.exe
  2⤵
  PID:6620
- C:\Windows\System\mMnqVxq.exe
  C:\Windows\System\mMnqVxq.exe
  2⤵
  PID:6412
- C:\Windows\System\wxQoOlS.exe
  C:\Windows\System\wxQoOlS.exe
  2⤵
  PID:6312
- C:\Windows\System\jKAwJhn.exe
  C:\Windows\System\jKAwJhn.exe
  2⤵
  PID:7184
- C:\Windows\System\bemObBQ.exe
  C:\Windows\System\bemObBQ.exe
  2⤵
  PID:7200
- C:\Windows\System\BdFODEa.exe
  C:\Windows\System\BdFODEa.exe
  2⤵
  PID:7216
- C:\Windows\System\metaxUX.exe
  C:\Windows\System\metaxUX.exe
  2⤵
  PID:7232
- C:\Windows\System\Syceviz.exe
  C:\Windows\System\Syceviz.exe
  2⤵
  PID:7248
- C:\Windows\System\dqNUuqz.exe
  C:\Windows\System\dqNUuqz.exe
  2⤵
  PID:7264
- C:\Windows\System\ABTBZlu.exe
  C:\Windows\System\ABTBZlu.exe
  2⤵
  PID:7280
- C:\Windows\System\akyRaWc.exe
  C:\Windows\System\akyRaWc.exe
  2⤵
  PID:7296
- C:\Windows\System\vDNTGry.exe
  C:\Windows\System\vDNTGry.exe
  2⤵
  PID:7312
- C:\Windows\System\ZvLPRef.exe
  C:\Windows\System\ZvLPRef.exe
  2⤵
  PID:7328
- C:\Windows\System\sXDHXbw.exe
  C:\Windows\System\sXDHXbw.exe
  2⤵
  PID:7344
- C:\Windows\System\XPGOeTP.exe
  C:\Windows\System\XPGOeTP.exe
  2⤵
  PID:7360
- C:\Windows\System\KnbrnnF.exe
  C:\Windows\System\KnbrnnF.exe
  2⤵
  PID:7376
- C:\Windows\System\LYqXUqd.exe
  C:\Windows\System\LYqXUqd.exe
  2⤵
  PID:7392
- C:\Windows\System\SuSxEtS.exe
  C:\Windows\System\SuSxEtS.exe
  2⤵
  PID:7408
- C:\Windows\System\JqCWvcM.exe
  C:\Windows\System\JqCWvcM.exe
  2⤵
  PID:7424
- C:\Windows\System\udqgKuG.exe
  C:\Windows\System\udqgKuG.exe
  2⤵
  PID:7440
- C:\Windows\System\rbKfMxp.exe
  C:\Windows\System\rbKfMxp.exe
  2⤵
  PID:7456
- C:\Windows\System\WIrRAsa.exe
  C:\Windows\System\WIrRAsa.exe
  2⤵
  PID:7472
- C:\Windows\System\ieljiDJ.exe
  C:\Windows\System\ieljiDJ.exe
  2⤵
  PID:7488
- C:\Windows\System\wPKWvxf.exe
  C:\Windows\System\wPKWvxf.exe
  2⤵
  PID:7504
- C:\Windows\System\jxFNqHW.exe
  C:\Windows\System\jxFNqHW.exe
  2⤵
  PID:7520
- C:\Windows\System\CDiDizq.exe
  C:\Windows\System\CDiDizq.exe
  2⤵
  PID:7536
- C:\Windows\System\AYaqERk.exe
  C:\Windows\System\AYaqERk.exe
  2⤵
  PID:7552
- C:\Windows\System\aoWMyim.exe
  C:\Windows\System\aoWMyim.exe
  2⤵
  PID:7568
- C:\Windows\System\MzoTCrw.exe
  C:\Windows\System\MzoTCrw.exe
  2⤵
  PID:7584
- C:\Windows\System\vMKApNn.exe
  C:\Windows\System\vMKApNn.exe
  2⤵
  PID:7600
- C:\Windows\System\sUnDwdr.exe
  C:\Windows\System\sUnDwdr.exe
  2⤵
  PID:7616
- C:\Windows\System\nMNHQmv.exe
  C:\Windows\System\nMNHQmv.exe
  2⤵
  PID:7632
- C:\Windows\System\zHhlBNg.exe
  C:\Windows\System\zHhlBNg.exe
  2⤵
  PID:7648
- C:\Windows\System\jgacbQF.exe
  C:\Windows\System\jgacbQF.exe
  2⤵
  PID:7668
- C:\Windows\System\nSerpWy.exe
  C:\Windows\System\nSerpWy.exe
  2⤵
  PID:7692
- C:\Windows\System\eJUtino.exe
  C:\Windows\System\eJUtino.exe
  2⤵
  PID:7708
- C:\Windows\System\FtYGjjQ.exe
  C:\Windows\System\FtYGjjQ.exe
  2⤵
  PID:7724
- C:\Windows\System\JHJePND.exe
  C:\Windows\System\JHJePND.exe
  2⤵
  PID:7740
- C:\Windows\System\ukjXnvk.exe
  C:\Windows\System\ukjXnvk.exe
  2⤵
  PID:7760
- C:\Windows\System\qbaUGyp.exe
  C:\Windows\System\qbaUGyp.exe
  2⤵
  PID:7776
- C:\Windows\System\TuaTgBn.exe
  C:\Windows\System\TuaTgBn.exe
  2⤵
  PID:7792
- C:\Windows\System\ydSRFgy.exe
  C:\Windows\System\ydSRFgy.exe
  2⤵
  PID:7808
- C:\Windows\System\uOZznEc.exe
  C:\Windows\System\uOZznEc.exe
  2⤵
  PID:7824
- C:\Windows\System\bLFeWOH.exe
  C:\Windows\System\bLFeWOH.exe
  2⤵
  PID:7840
- C:\Windows\System\PkVCGJm.exe
  C:\Windows\System\PkVCGJm.exe
  2⤵
  PID:7856
- C:\Windows\System\bBpvIwC.exe
  C:\Windows\System\bBpvIwC.exe
  2⤵
  PID:7872
- C:\Windows\System\QpGiAfy.exe
  C:\Windows\System\QpGiAfy.exe
  2⤵
  PID:7892
- C:\Windows\System\KVqVfDc.exe
  C:\Windows\System\KVqVfDc.exe
  2⤵
  PID:7908
- C:\Windows\System\iSnlumK.exe
  C:\Windows\System\iSnlumK.exe
  2⤵
  PID:7924
- C:\Windows\System\iSLnSKQ.exe
  C:\Windows\System\iSLnSKQ.exe
  2⤵
  PID:7940
- C:\Windows\System\rHJIoDU.exe
  C:\Windows\System\rHJIoDU.exe
  2⤵
  PID:7956
- C:\Windows\System\sCKLIvc.exe
  C:\Windows\System\sCKLIvc.exe
  2⤵
  PID:7972
- C:\Windows\System\vKcFhyD.exe
  C:\Windows\System\vKcFhyD.exe
  2⤵
  PID:7992
- C:\Windows\System\nhgKFTp.exe
  C:\Windows\System\nhgKFTp.exe
  2⤵
  PID:8008
- C:\Windows\System\dCGmZGK.exe
  C:\Windows\System\dCGmZGK.exe
  2⤵
  PID:8028
- C:\Windows\System\LQddDTM.exe
  C:\Windows\System\LQddDTM.exe
  2⤵
  PID:8044
- C:\Windows\System\WgkzntF.exe
  C:\Windows\System\WgkzntF.exe
  2⤵
  PID:8060
- C:\Windows\System\MTldwhf.exe
  C:\Windows\System\MTldwhf.exe
  2⤵
  PID:8076
- C:\Windows\System\ebuQjmv.exe
  C:\Windows\System\ebuQjmv.exe
  2⤵
  PID:8092
- C:\Windows\System\bWPGyyq.exe
  C:\Windows\System\bWPGyyq.exe
  2⤵
  PID:8108
- C:\Windows\System\WoNAmYv.exe
  C:\Windows\System\WoNAmYv.exe
  2⤵
  PID:8124
- C:\Windows\System\RSfGdsU.exe
  C:\Windows\System\RSfGdsU.exe
  2⤵
  PID:8140
- C:\Windows\System\ELgQpMY.exe
  C:\Windows\System\ELgQpMY.exe
  2⤵
  PID:8156
- C:\Windows\System\KUbyjOJ.exe
  C:\Windows\System\KUbyjOJ.exe
  2⤵
  PID:8172
- C:\Windows\System\WwDHPJs.exe
  C:\Windows\System\WwDHPJs.exe
  2⤵
  PID:8188
- C:\Windows\System\evPdDqB.exe
  C:\Windows\System\evPdDqB.exe
  2⤵
  PID:7208
- C:\Windows\System\aBqdCmb.exe
  C:\Windows\System\aBqdCmb.exe
  2⤵
  PID:7276
- C:\Windows\System\cdsIOFH.exe
  C:\Windows\System\cdsIOFH.exe
  2⤵
  PID:7340
- C:\Windows\System\YlQbRfB.exe
  C:\Windows\System\YlQbRfB.exe
  2⤵
  PID:7404
- C:\Windows\System\SPNdXyO.exe
  C:\Windows\System\SPNdXyO.exe
  2⤵
  PID:7468
- C:\Windows\System\aNerHxY.exe
  C:\Windows\System\aNerHxY.exe
  2⤵
  PID:7560
- C:\Windows\System\CpEDhmP.exe
  C:\Windows\System\CpEDhmP.exe
  2⤵
  PID:7352
- C:\Windows\System\Dxezymq.exe
  C:\Windows\System\Dxezymq.exe
  2⤵
  PID:7416
- C:\Windows\System\aJpTRRA.exe
  C:\Windows\System\aJpTRRA.exe
  2⤵
  PID:6316
- C:\Windows\System\dJGPGTN.exe
  C:\Windows\System\dJGPGTN.exe
  2⤵
  PID:7516
- C:\Windows\System\NgtvrTQ.exe
  C:\Windows\System\NgtvrTQ.exe
  2⤵
  PID:7608
- C:\Windows\System\CSWknOD.exe
  C:\Windows\System\CSWknOD.exe
  2⤵
  PID:6932
- C:\Windows\System\MkSGBLN.exe
  C:\Windows\System\MkSGBLN.exe
  2⤵
  PID:7256
- C:\Windows\System\jwqXiIY.exe
  C:\Windows\System\jwqXiIY.exe
  2⤵
  PID:7484
- C:\Windows\System\OsQilIv.exe
  C:\Windows\System\OsQilIv.exe
  2⤵
  PID:7612
- C:\Windows\System\zZIWqLq.exe
  C:\Windows\System\zZIWqLq.exe
  2⤵
  PID:7700
- C:\Windows\System\QKHeXnE.exe
  C:\Windows\System\QKHeXnE.exe
  2⤵
  PID:7704
- C:\Windows\System\DklCina.exe
  C:\Windows\System\DklCina.exe
  2⤵
  PID:7800
- C:\Windows\System\CZyqYIt.exe
  C:\Windows\System\CZyqYIt.exe
  2⤵
  PID:7864
- C:\Windows\System\YsHqKtk.exe
  C:\Windows\System\YsHqKtk.exe
  2⤵
  PID:7932
- C:\Windows\System\tTSesjw.exe
  C:\Windows\System\tTSesjw.exe
  2⤵
  PID:8000
- C:\Windows\System\duDmYmV.exe
  C:\Windows\System\duDmYmV.exe
  2⤵
  PID:7684
- C:\Windows\System\ILPYnPL.exe
  C:\Windows\System\ILPYnPL.exe
  2⤵
  PID:7916
- C:\Windows\System\YazJblc.exe
  C:\Windows\System\YazJblc.exe
  2⤵
  PID:7920
- C:\Windows\System\yKzuRzJ.exe
  C:\Windows\System\yKzuRzJ.exe
  2⤵
  PID:7756
- C:\Windows\System\BhiZGqA.exe
  C:\Windows\System\BhiZGqA.exe
  2⤵
  PID:7852
- C:\Windows\System\sbLbZJY.exe
  C:\Windows\System\sbLbZJY.exe
  2⤵
  PID:7980
- C:\Windows\System\nAvvIKr.exe
  C:\Windows\System\nAvvIKr.exe
  2⤵
  PID:8040
- C:\Windows\System\rWgVaCZ.exe
  C:\Windows\System\rWgVaCZ.exe
  2⤵
  PID:8104
- C:\Windows\System\JpHpAre.exe
  C:\Windows\System\JpHpAre.exe
  2⤵
  PID:8024
- C:\Windows\System\ciBZxdP.exe
  C:\Windows\System\ciBZxdP.exe
  2⤵
  PID:8088
- C:\Windows\System\engAUxp.exe
  C:\Windows\System\engAUxp.exe
  2⤵
  PID:8148
- C:\Windows\System\hAJVYGg.exe
  C:\Windows\System\hAJVYGg.exe
  2⤵
  PID:8120
- C:\Windows\System\yuNOTxO.exe
  C:\Windows\System\yuNOTxO.exe
  2⤵
  PID:7464
- C:\Windows\System\qVjEKtE.exe
  C:\Windows\System\qVjEKtE.exe
  2⤵
  PID:7240
- C:\Windows\System\myueOLn.exe
  C:\Windows\System\myueOLn.exe
  2⤵
  PID:7400
- C:\Windows\System\iKloQtQ.exe
  C:\Windows\System\iKloQtQ.exe
  2⤵
  PID:7320
- C:\Windows\System\mkTewVN.exe
  C:\Windows\System\mkTewVN.exe
  2⤵
  PID:7324
- C:\Windows\System\sKXbmug.exe
  C:\Windows\System\sKXbmug.exe
  2⤵
  PID:7196
- C:\Windows\System\oNWIQHm.exe
  C:\Windows\System\oNWIQHm.exe
  2⤵
  PID:6688
- C:\Windows\System\ESQrqft.exe
  C:\Windows\System\ESQrqft.exe
  2⤵
  PID:7660
- C:\Windows\System\wxhuYvK.exe
  C:\Windows\System\wxhuYvK.exe
  2⤵
  PID:7968
- C:\Windows\System\ClhOBFH.exe
  C:\Windows\System\ClhOBFH.exe
  2⤵
  PID:7716
- C:\Windows\System\aGDEuVG.exe
  C:\Windows\System\aGDEuVG.exe
  2⤵
  PID:8072
- C:\Windows\System\RyzsZIG.exe
  C:\Windows\System\RyzsZIG.exe
  2⤵
  PID:7452
- C:\Windows\System\RMDDuTB.exe
  C:\Windows\System\RMDDuTB.exe
  2⤵
  PID:7580
- C:\Windows\System\efPheOn.exe
  C:\Windows\System\efPheOn.exe
  2⤵
  PID:7768
- C:\Windows\System\OKmJGCR.exe
  C:\Windows\System\OKmJGCR.exe
  2⤵
  PID:7680
- C:\Windows\System\Xerioti.exe
  C:\Windows\System\Xerioti.exe
  2⤵
  PID:8100
- C:\Windows\System\VIrFRvF.exe
  C:\Windows\System\VIrFRvF.exe
  2⤵
  PID:8132
- C:\Windows\System\GmZEhPL.exe
  C:\Windows\System\GmZEhPL.exe
  2⤵
  PID:7272
- C:\Windows\System\sVdEzIA.exe
  C:\Windows\System\sVdEzIA.exe
  2⤵
  PID:8180
- C:\Windows\System\lFvwVxP.exe
  C:\Windows\System\lFvwVxP.exe
  2⤵
  PID:6236
- C:\Windows\System\HXTMbev.exe
  C:\Windows\System\HXTMbev.exe
  2⤵
  PID:1656
- C:\Windows\System\VfNqypQ.exe
  C:\Windows\System\VfNqypQ.exe
  2⤵
  PID:8196
- C:\Windows\System\NpwrYIb.exe
  C:\Windows\System\NpwrYIb.exe
  2⤵
  PID:8220
- C:\Windows\System\cZvwdxp.exe
  C:\Windows\System\cZvwdxp.exe
  2⤵
  PID:8236
- C:\Windows\System\vFfzNRN.exe
  C:\Windows\System\vFfzNRN.exe
  2⤵
  PID:8252
- C:\Windows\System\xjxeDPy.exe
  C:\Windows\System\xjxeDPy.exe
  2⤵
  PID:8272
- C:\Windows\System\CZyLLXS.exe
  C:\Windows\System\CZyLLXS.exe
  2⤵
  PID:8288
- C:\Windows\System\DPexoxd.exe
  C:\Windows\System\DPexoxd.exe
  2⤵
  PID:8304
- C:\Windows\System\CzlfKxN.exe
  C:\Windows\System\CzlfKxN.exe
  2⤵
  PID:8324
- C:\Windows\System\zMbVszL.exe
  C:\Windows\System\zMbVszL.exe
  2⤵
  PID:8340
- C:\Windows\System\GSoqosw.exe
  C:\Windows\System\GSoqosw.exe
  2⤵
  PID:8356
- C:\Windows\System\LixMIJf.exe
  C:\Windows\System\LixMIJf.exe
  2⤵
  PID:8372
- C:\Windows\System\zpHGbVj.exe
  C:\Windows\System\zpHGbVj.exe
  2⤵
  PID:8388
- C:\Windows\System\iNlWmsf.exe
  C:\Windows\System\iNlWmsf.exe
  2⤵
  PID:8404
- C:\Windows\System\gvarNBK.exe
  C:\Windows\System\gvarNBK.exe
  2⤵
  PID:8420
- C:\Windows\System\rvFzFEZ.exe
  C:\Windows\System\rvFzFEZ.exe
  2⤵
  PID:8436
- C:\Windows\System\kheZQAu.exe
  C:\Windows\System\kheZQAu.exe
  2⤵
  PID:8452
- C:\Windows\System\FmzDxDd.exe
  C:\Windows\System\FmzDxDd.exe
  2⤵
  PID:8468
- C:\Windows\System\aiJvCNZ.exe
  C:\Windows\System\aiJvCNZ.exe
  2⤵
  PID:8484
- C:\Windows\System\ZNESIvR.exe
  C:\Windows\System\ZNESIvR.exe
  2⤵
  PID:8500
- C:\Windows\System\nlyRQMo.exe
  C:\Windows\System\nlyRQMo.exe
  2⤵
  PID:8516
- C:\Windows\System\VwjczFJ.exe
  C:\Windows\System\VwjczFJ.exe
  2⤵
  PID:8532
- C:\Windows\System\anmMCOK.exe
  C:\Windows\System\anmMCOK.exe
  2⤵
  PID:8548
- C:\Windows\System\ncyVpTF.exe
  C:\Windows\System\ncyVpTF.exe
  2⤵
  PID:8564
- C:\Windows\System\EiUeenl.exe
  C:\Windows\System\EiUeenl.exe
  2⤵
  PID:8584
- C:\Windows\System\CwNZUFo.exe
  C:\Windows\System\CwNZUFo.exe
  2⤵
  PID:8600
- C:\Windows\System\MUMzinf.exe
  C:\Windows\System\MUMzinf.exe
  2⤵
  PID:8616
- C:\Windows\System\XDGkxAm.exe
  C:\Windows\System\XDGkxAm.exe
  2⤵
  PID:8632
- C:\Windows\System\DglEhXj.exe
  C:\Windows\System\DglEhXj.exe
  2⤵
  PID:8848
- C:\Windows\System\CSZaFkV.exe
  C:\Windows\System\CSZaFkV.exe
  2⤵
  PID:8864
- C:\Windows\System\NsMtxmm.exe
  C:\Windows\System\NsMtxmm.exe
  2⤵
  PID:8880
- C:\Windows\System\OppPhPv.exe
  C:\Windows\System\OppPhPv.exe
  2⤵
  PID:8896
- C:\Windows\System\pXvnSzu.exe
  C:\Windows\System\pXvnSzu.exe
  2⤵
  PID:8912
- C:\Windows\System\mRNjUNJ.exe
  C:\Windows\System\mRNjUNJ.exe
  2⤵
  PID:8928
- C:\Windows\System\xjPkfla.exe
  C:\Windows\System\xjPkfla.exe
  2⤵
  PID:8944
- C:\Windows\System\OnOXcGZ.exe
  C:\Windows\System\OnOXcGZ.exe
  2⤵
  PID:8960
- C:\Windows\System\usHcdYD.exe
  C:\Windows\System\usHcdYD.exe
  2⤵
  PID:8976
- C:\Windows\System\SGSAXqJ.exe
  C:\Windows\System\SGSAXqJ.exe
  2⤵
  PID:8992
- C:\Windows\System\FYaTTJU.exe
  C:\Windows\System\FYaTTJU.exe
  2⤵
  PID:9008
- C:\Windows\System\eLyKXsJ.exe
  C:\Windows\System\eLyKXsJ.exe
  2⤵
  PID:9028
- C:\Windows\System\nrJpfnJ.exe
  C:\Windows\System\nrJpfnJ.exe
  2⤵
  PID:9044
- C:\Windows\System\YoWooxF.exe
  C:\Windows\System\YoWooxF.exe
  2⤵
  PID:9060
- C:\Windows\System\KkqQnjn.exe
  C:\Windows\System\KkqQnjn.exe
  2⤵
  PID:9076
- C:\Windows\System\dLevRHH.exe
  C:\Windows\System\dLevRHH.exe
  2⤵
  PID:9092
- C:\Windows\System\sdZsHUR.exe
  C:\Windows\System\sdZsHUR.exe
  2⤵
  PID:9112
- C:\Windows\System\XBvQmpg.exe
  C:\Windows\System\XBvQmpg.exe
  2⤵
  PID:9132
- C:\Windows\System\lVwBKMY.exe
  C:\Windows\System\lVwBKMY.exe
  2⤵
  PID:9164
- C:\Windows\System\CLFCaJM.exe
  C:\Windows\System\CLFCaJM.exe
  2⤵
  PID:9180
- C:\Windows\System\mMGHlCD.exe
  C:\Windows\System\mMGHlCD.exe
  2⤵
  PID:7884
- C:\Windows\System\YvEFEcx.exe
  C:\Windows\System\YvEFEcx.exe
  2⤵
  PID:7436
- C:\Windows\System\tGEPbXF.exe
  C:\Windows\System\tGEPbXF.exe
  2⤵
  PID:7576
- C:\Windows\System\slNvKtF.exe
  C:\Windows\System\slNvKtF.exe
  2⤵
  PID:7832
- C:\Windows\System\ZWdnCbX.exe
  C:\Windows\System\ZWdnCbX.exe
  2⤵
  PID:7900
- C:\Windows\System\iFMRXfX.exe
  C:\Windows\System\iFMRXfX.exe
  2⤵
  PID:8152
- C:\Windows\System\bzQycSg.exe
  C:\Windows\System\bzQycSg.exe
  2⤵
  PID:8208
- C:\Windows\System\ShFRDsh.exe
  C:\Windows\System\ShFRDsh.exe
  2⤵
  PID:8260
- C:\Windows\System\PMCDiBp.exe
  C:\Windows\System\PMCDiBp.exe
  2⤵
  PID:7752
- C:\Windows\System\NBQEJqx.exe
  C:\Windows\System\NBQEJqx.exe
  2⤵
  PID:8332
- C:\Windows\System\gXLXcFV.exe
  C:\Windows\System\gXLXcFV.exe
  2⤵
  PID:8368
- C:\Windows\System\pjovKYM.exe
  C:\Windows\System\pjovKYM.exe
  2⤵
  PID:8320
- C:\Windows\System\kvIxGfU.exe
  C:\Windows\System\kvIxGfU.exe
  2⤵
  PID:8316
- C:\Windows\System\hcWXGAH.exe
  C:\Windows\System\hcWXGAH.exe
  2⤵
  PID:8444
- C:\Windows\System\MtiWTPi.exe
  C:\Windows\System\MtiWTPi.exe
  2⤵
  PID:8508
- C:\Windows\System\PIaBHjs.exe
  C:\Windows\System\PIaBHjs.exe
  2⤵
  PID:8380
- C:\Windows\System\RwWHkQj.exe
  C:\Windows\System\RwWHkQj.exe
  2⤵
  PID:8528
- C:\Windows\System\NVgCSjd.exe
  C:\Windows\System\NVgCSjd.exe
  2⤵
  PID:8676
- C:\Windows\System\FvnUQSR.exe
  C:\Windows\System\FvnUQSR.exe
  2⤵
  PID:8856
- C:\Windows\System\VcvyVze.exe
  C:\Windows\System\VcvyVze.exe
  2⤵
  PID:8748
- C:\Windows\System\fuMuIZo.exe
  C:\Windows\System\fuMuIZo.exe
  2⤵
  PID:8792
- C:\Windows\System\QMxPCga.exe
  C:\Windows\System\QMxPCga.exe
  2⤵
  PID:8808
- C:\Windows\System\SkPQljS.exe
  C:\Windows\System\SkPQljS.exe
  2⤵
  PID:8832
- C:\Windows\System\QjyMorY.exe
  C:\Windows\System\QjyMorY.exe
  2⤵
  PID:8956
- C:\Windows\System\xLvwnUn.exe
  C:\Windows\System\xLvwnUn.exe
  2⤵
  PID:9020
- C:\Windows\System\LLkmPxq.exe
  C:\Windows\System\LLkmPxq.exe
  2⤵
  PID:9088
- C:\Windows\System\zJLTgJL.exe
  C:\Windows\System\zJLTgJL.exe
  2⤵
  PID:8752
- C:\Windows\System\VKJyozu.exe
  C:\Windows\System\VKJyozu.exe
  2⤵
  PID:8724
- C:\Windows\System\TTJaJot.exe
  C:\Windows\System\TTJaJot.exe
  2⤵
  PID:8760
- C:\Windows\System\xdhFhOQ.exe
  C:\Windows\System\xdhFhOQ.exe
  2⤵
  PID:8784
- C:\Windows\System\fAUyWYM.exe
  C:\Windows\System\fAUyWYM.exe
  2⤵
  PID:8872
- C:\Windows\System\LWxpfmV.exe
  C:\Windows\System\LWxpfmV.exe
  2⤵
  PID:8936
- C:\Windows\System\bVghvmQ.exe
  C:\Windows\System\bVghvmQ.exe
  2⤵
  PID:8216
- C:\Windows\System\LPjTlls.exe
  C:\Windows\System\LPjTlls.exe
  2⤵
  PID:8248
- C:\Windows\System\GiywEKw.exe
  C:\Windows\System\GiywEKw.exe
  2⤵
  PID:8460
- C:\Windows\System\WKSjmgr.exe
  C:\Windows\System\WKSjmgr.exe
  2⤵
  PID:8476
- C:\Windows\System\oUenqXy.exe
  C:\Windows\System\oUenqXy.exe
  2⤵
  PID:8312
- C:\Windows\System\NKSbmyL.exe
  C:\Windows\System\NKSbmyL.exe
  2⤵
  PID:8572
- C:\Windows\System\RXlcaXP.exe
  C:\Windows\System\RXlcaXP.exe
  2⤵
  PID:8640
- C:\Windows\System\abqABMC.exe
  C:\Windows\System\abqABMC.exe
  2⤵
  PID:8624
- C:\Windows\System\TUtqQRL.exe
  C:\Windows\System\TUtqQRL.exe
  2⤵
  PID:8672
- C:\Windows\System\JWechLL.exe
  C:\Windows\System\JWechLL.exe
  2⤵
  PID:8660
- C:\Windows\System\enDGCdR.exe
  C:\Windows\System\enDGCdR.exe
  2⤵
  PID:8800
- C:\Windows\System\UIbwKYw.exe
  C:\Windows\System\UIbwKYw.exe
  2⤵
  PID:9084
- C:\Windows\System\jetPhnN.exe
  C:\Windows\System\jetPhnN.exe
  2⤵
  PID:8464
- C:\Windows\System\UPJQVXE.exe
  C:\Windows\System\UPJQVXE.exe
  2⤵
  PID:8540
- C:\Windows\System\luFblDF.exe
  C:\Windows\System\luFblDF.exe
  2⤵
  PID:8560
- C:\Windows\System\TxQoHwt.exe
  C:\Windows\System\TxQoHwt.exe
  2⤵
  PID:7548
- C:\Windows\System\PNBRWSH.exe
  C:\Windows\System\PNBRWSH.exe
  2⤵
  PID:8836
- C:\Windows\System\QqelDIG.exe
  C:\Windows\System\QqelDIG.exe
  2⤵
  PID:8688
- C:\Windows\System\cFlMXEA.exe
  C:\Windows\System\cFlMXEA.exe
  2⤵
  PID:8888
- C:\Windows\System\kkLRxgZ.exe
  C:\Windows\System\kkLRxgZ.exe
  2⤵
  PID:8736
- C:\Windows\System\STMLoak.exe
  C:\Windows\System\STMLoak.exe
  2⤵
  PID:8844
- C:\Windows\System\aNfTUtr.exe
  C:\Windows\System\aNfTUtr.exe
  2⤵
  PID:9004
- C:\Windows\System\GzhLgRX.exe
  C:\Windows\System\GzhLgRX.exe
  2⤵
  PID:8772
- C:\Windows\System\MLwGqCD.exe
  C:\Windows\System\MLwGqCD.exe
  2⤵
  PID:9140
- C:\Windows\System\nWBfVqZ.exe
  C:\Windows\System\nWBfVqZ.exe
  2⤵
  PID:8056
- C:\Windows\System\cMChzVN.exe
  C:\Windows\System\cMChzVN.exe
  2⤵
  PID:8136
- C:\Windows\System\MtGGYzw.exe
  C:\Windows\System\MtGGYzw.exe
  2⤵
  PID:8432
- C:\Windows\System\xgisZSa.exe
  C:\Windows\System\xgisZSa.exe
  2⤵
  PID:8492
- C:\Windows\System\CGMXnDO.exe
  C:\Windows\System\CGMXnDO.exe
  2⤵
  PID:8788
- C:\Windows\System\JxeCALx.exe
  C:\Windows\System\JxeCALx.exe
  2⤵
  PID:8652
- C:\Windows\System\gLiNYeI.exe
  C:\Windows\System\gLiNYeI.exe
  2⤵
  PID:8656
- C:\Windows\System\evqkBmh.exe
  C:\Windows\System\evqkBmh.exe
  2⤵
  PID:8280
- C:\Windows\System\TVHWApo.exe
  C:\Windows\System\TVHWApo.exe
  2⤵
  PID:8036
- C:\Windows\System\ACCLXqQ.exe
  C:\Windows\System\ACCLXqQ.exe
  2⤵
  PID:7532
- C:\Windows\System\IrADVCg.exe
  C:\Windows\System\IrADVCg.exe
  2⤵
  PID:7888
- C:\Windows\System\uoUhyZZ.exe
  C:\Windows\System\uoUhyZZ.exe
  2⤵
  PID:8696
- C:\Windows\System\qKtJtLx.exe
  C:\Windows\System\qKtJtLx.exe
  2⤵
  PID:8228
- C:\Windows\System\vhFovbq.exe
  C:\Windows\System\vhFovbq.exe
  2⤵
  PID:9108
- C:\Windows\System\UaZorrH.exe
  C:\Windows\System\UaZorrH.exe
  2⤵
  PID:8776
- C:\Windows\System\CjHxqOB.exe
  C:\Windows\System\CjHxqOB.exe
  2⤵
  PID:8428
- C:\Windows\System\BdYYXfc.exe
  C:\Windows\System\BdYYXfc.exe
  2⤵
  PID:9100
- C:\Windows\System\QgmaOuR.exe
  C:\Windows\System\QgmaOuR.exe
  2⤵
  PID:8716
- C:\Windows\System\PUXmhKk.exe
  C:\Windows\System\PUXmhKk.exe
  2⤵
  PID:8920
- C:\Windows\System\sZMGSIC.exe
  C:\Windows\System\sZMGSIC.exe
  2⤵
  PID:8556
- C:\Windows\System\lJSdZAO.exe
  C:\Windows\System\lJSdZAO.exe
  2⤵
  PID:8908
- C:\Windows\System\OxJktlu.exe
  C:\Windows\System\OxJktlu.exe
  2⤵
  PID:8804
- C:\Windows\System\vBDtLyz.exe
  C:\Windows\System\vBDtLyz.exe
  2⤵
  PID:8824
- C:\Windows\System\nClKluv.exe
  C:\Windows\System\nClKluv.exe
  2⤵
  PID:8988
- C:\Windows\System\ZWEJABg.exe
  C:\Windows\System\ZWEJABg.exe
  2⤵
  PID:9176
- C:\Windows\System\kxwyHuU.exe
  C:\Windows\System\kxwyHuU.exe
  2⤵
  PID:9056
- C:\Windows\System\WtozzCX.exe
  C:\Windows\System\WtozzCX.exe
  2⤵
  PID:9188
- C:\Windows\System\HTGZMAU.exe
  C:\Windows\System\HTGZMAU.exe
  2⤵
  PID:8364
- C:\Windows\System\yydglSS.exe
  C:\Windows\System\yydglSS.exe
  2⤵
  PID:9228
- C:\Windows\System\MqgTVPx.exe
  C:\Windows\System\MqgTVPx.exe
  2⤵
  PID:9244
- C:\Windows\System\IisOYjE.exe
  C:\Windows\System\IisOYjE.exe
  2⤵
  PID:9260
- C:\Windows\System\kaqSJBJ.exe
  C:\Windows\System\kaqSJBJ.exe
  2⤵
  PID:9276
- C:\Windows\System\pQMbDGM.exe
  C:\Windows\System\pQMbDGM.exe
  2⤵
  PID:9292
- C:\Windows\System\Okkorff.exe
  C:\Windows\System\Okkorff.exe
  2⤵
  PID:9308
- C:\Windows\System\NsYCXZr.exe
  C:\Windows\System\NsYCXZr.exe
  2⤵
  PID:9324
- C:\Windows\System\FXcZffy.exe
  C:\Windows\System\FXcZffy.exe
  2⤵
  PID:9340
- C:\Windows\System\OHzmNAZ.exe
  C:\Windows\System\OHzmNAZ.exe
  2⤵
  PID:9356
- C:\Windows\System\uqrenuI.exe
  C:\Windows\System\uqrenuI.exe
  2⤵
  PID:9372
- C:\Windows\System\lTKNAco.exe
  C:\Windows\System\lTKNAco.exe
  2⤵
  PID:9388
- C:\Windows\System\KbWzjms.exe
  C:\Windows\System\KbWzjms.exe
  2⤵
  PID:9404
- C:\Windows\System\DmMSeXZ.exe
  C:\Windows\System\DmMSeXZ.exe
  2⤵
  PID:9420
- C:\Windows\System\IOeTqrq.exe
  C:\Windows\System\IOeTqrq.exe
  2⤵
  PID:9436
- C:\Windows\System\PIeUuKf.exe
  C:\Windows\System\PIeUuKf.exe
  2⤵
  PID:9452
- C:\Windows\System\wcaJzsZ.exe
  C:\Windows\System\wcaJzsZ.exe
  2⤵
  PID:9468
- C:\Windows\System\MZCQatt.exe
  C:\Windows\System\MZCQatt.exe
  2⤵
  PID:9484
- C:\Windows\System\SsEgViZ.exe
  C:\Windows\System\SsEgViZ.exe
  2⤵
  PID:9500
- C:\Windows\System\bmUzTRy.exe
  C:\Windows\System\bmUzTRy.exe
  2⤵
  PID:9524
- C:\Windows\System\YRqiXuu.exe
  C:\Windows\System\YRqiXuu.exe
  2⤵
  PID:9540
- C:\Windows\System\KvzUeGI.exe
  C:\Windows\System\KvzUeGI.exe
  2⤵
  PID:9556
- C:\Windows\System\Wvfqmqg.exe
  C:\Windows\System\Wvfqmqg.exe
  2⤵
  PID:9572
- C:\Windows\System\hXjGxlu.exe
  C:\Windows\System\hXjGxlu.exe
  2⤵
  PID:9588
- C:\Windows\System\RiilOuK.exe
  C:\Windows\System\RiilOuK.exe
  2⤵
  PID:9608
- C:\Windows\System\WAIFLkK.exe
  C:\Windows\System\WAIFLkK.exe
  2⤵
  PID:9624
- C:\Windows\System\jhjnbZE.exe
  C:\Windows\System\jhjnbZE.exe
  2⤵
  PID:9640
- C:\Windows\System\EDSmaVr.exe
  C:\Windows\System\EDSmaVr.exe
  2⤵
  PID:9656
- C:\Windows\System\vEMdiGi.exe
  C:\Windows\System\vEMdiGi.exe
  2⤵
  PID:9672
- C:\Windows\System\lXihmkQ.exe
  C:\Windows\System\lXihmkQ.exe
  2⤵
  PID:9688
- C:\Windows\System\NaUODrE.exe
  C:\Windows\System\NaUODrE.exe
  2⤵
  PID:9704
- C:\Windows\System\fXhhRii.exe
  C:\Windows\System\fXhhRii.exe
  2⤵
  PID:9720
- C:\Windows\System\jFnJeIB.exe
  C:\Windows\System\jFnJeIB.exe
  2⤵
  PID:9736
- C:\Windows\System\FnxZVdL.exe
  C:\Windows\System\FnxZVdL.exe
  2⤵
  PID:9752
- C:\Windows\System\KOjTMIN.exe
  C:\Windows\System\KOjTMIN.exe
  2⤵
  PID:9768
- C:\Windows\System\CVBaBmh.exe
  C:\Windows\System\CVBaBmh.exe
  2⤵
  PID:9784
- C:\Windows\System\GtinGRj.exe
  C:\Windows\System\GtinGRj.exe
  2⤵
  PID:9800
- C:\Windows\System\QVnrHLM.exe
  C:\Windows\System\QVnrHLM.exe
  2⤵
  PID:9816
- C:\Windows\System\yPirUJc.exe
  C:\Windows\System\yPirUJc.exe
  2⤵
  PID:9836
- C:\Windows\System\uzYONru.exe
  C:\Windows\System\uzYONru.exe
  2⤵
  PID:9852
- C:\Windows\System\XNrygrp.exe
  C:\Windows\System\XNrygrp.exe
  2⤵
  PID:9868
- C:\Windows\System\emYVJHV.exe
  C:\Windows\System\emYVJHV.exe
  2⤵
  PID:9884
- C:\Windows\System\kmLyisa.exe
  C:\Windows\System\kmLyisa.exe
  2⤵
  PID:9900
- C:\Windows\System\JXgguQp.exe
  C:\Windows\System\JXgguQp.exe
  2⤵
  PID:9916
- C:\Windows\System\sGedNoF.exe
  C:\Windows\System\sGedNoF.exe
  2⤵
  PID:9936
- C:\Windows\System\imOWzHK.exe
  C:\Windows\System\imOWzHK.exe
  2⤵
  PID:9952
- C:\Windows\System\bpbcLsV.exe
  C:\Windows\System\bpbcLsV.exe
  2⤵
  PID:9968
- C:\Windows\System\wVfxvvI.exe
  C:\Windows\System\wVfxvvI.exe
  2⤵
  PID:9984
- C:\Windows\System\EwtYMIh.exe
  C:\Windows\System\EwtYMIh.exe
  2⤵
  PID:10000
- C:\Windows\System\CNFqxcG.exe
  C:\Windows\System\CNFqxcG.exe
  2⤵
  PID:10016
- C:\Windows\System\lxwibSi.exe
  C:\Windows\System\lxwibSi.exe
  2⤵
  PID:10032
- C:\Windows\System\ogKRvNJ.exe
  C:\Windows\System\ogKRvNJ.exe
  2⤵
  PID:10048
- C:\Windows\System\OcFpCgM.exe
  C:\Windows\System\OcFpCgM.exe
  2⤵
  PID:10064
- C:\Windows\System\yWfTiLQ.exe
  C:\Windows\System\yWfTiLQ.exe
  2⤵
  PID:10080
- C:\Windows\System\JzvtEfP.exe
  C:\Windows\System\JzvtEfP.exe
  2⤵
  PID:10096
- C:\Windows\System\SiYPaCg.exe
  C:\Windows\System\SiYPaCg.exe
  2⤵
  PID:10112
- C:\Windows\System\wvOGaYo.exe
  C:\Windows\System\wvOGaYo.exe
  2⤵
  PID:10128
- C:\Windows\System\ZyMNBZt.exe
  C:\Windows\System\ZyMNBZt.exe
  2⤵
  PID:10144
- C:\Windows\System\LMzOMTK.exe
  C:\Windows\System\LMzOMTK.exe
  2⤵
  PID:10160
- C:\Windows\System\CXUGdbu.exe
  C:\Windows\System\CXUGdbu.exe
  2⤵
  PID:10176
- C:\Windows\System\qzASJKc.exe
  C:\Windows\System\qzASJKc.exe
  2⤵
  PID:10192
- C:\Windows\System\mJQvYkN.exe
  C:\Windows\System\mJQvYkN.exe
  2⤵
  PID:10208
- C:\Windows\System\fMblmGa.exe
  C:\Windows\System\fMblmGa.exe
  2⤵
  PID:10228
- C:\Windows\System\sAzXxZK.exe
  C:\Windows\System\sAzXxZK.exe
  2⤵
  PID:8720
- C:\Windows\System\TzWKHgq.exe
  C:\Windows\System\TzWKHgq.exe
  2⤵
  PID:8972
- C:\Windows\System\FoqOazO.exe
  C:\Windows\System\FoqOazO.exe
  2⤵
  PID:8336
- C:\Windows\System\ZtAUiYZ.exe
  C:\Windows\System\ZtAUiYZ.exe
  2⤵
  PID:8284
- C:\Windows\System\OXOncUB.exe
  C:\Windows\System\OXOncUB.exe
  2⤵
  PID:9400
- C:\Windows\System\bIbQQwU.exe
  C:\Windows\System\bIbQQwU.exe
  2⤵
  PID:9464
- C:\Windows\System\nVIjmfG.exe
  C:\Windows\System\nVIjmfG.exe
  2⤵
  PID:9256
- C:\Windows\System\ggNVVSL.exe
  C:\Windows\System\ggNVVSL.exe
  2⤵
  PID:8664
- C:\Windows\System\gRjuKAK.exe
  C:\Windows\System\gRjuKAK.exe
  2⤵
  PID:9380
- C:\Windows\System\hwEmSid.exe
  C:\Windows\System\hwEmSid.exe
  2⤵
  PID:9476
- C:\Windows\System\sKVStxP.exe
  C:\Windows\System\sKVStxP.exe
  2⤵
  PID:9564
- C:\Windows\System\wfrAVst.exe
  C:\Windows\System\wfrAVst.exe
  2⤵
  PID:9320
- C:\Windows\System\akYYDcL.exe
  C:\Windows\System\akYYDcL.exe
  2⤵
  PID:9516
- C:\Windows\System\gDeokCs.exe
  C:\Windows\System\gDeokCs.exe
  2⤵
  PID:1496
- C:\Windows\System\sECGoef.exe
  C:\Windows\System\sECGoef.exe
  2⤵
  PID:9700
- C:\Windows\System\gXqCBeK.exe
  C:\Windows\System\gXqCBeK.exe
  2⤵
  PID:9648
- C:\Windows\System\mezkvZS.exe
  C:\Windows\System\mezkvZS.exe
  2⤵
  PID:9792
- C:\Windows\System\SCkNHmr.exe
  C:\Windows\System\SCkNHmr.exe
  2⤵
  PID:9548
- C:\Windows\System\bdWxycL.exe
  C:\Windows\System\bdWxycL.exe
  2⤵
  PID:9652
- C:\Windows\System\RrUiyQr.exe
  C:\Windows\System\RrUiyQr.exe
  2⤵
  PID:9776
- C:\Windows\System\JXQKefX.exe
  C:\Windows\System\JXQKefX.exe
  2⤵
  PID:9924
- C:\Windows\System\AhTEFEj.exe
  C:\Windows\System\AhTEFEj.exe
  2⤵
  PID:9812
- C:\Windows\System\zngUeZW.exe
  C:\Windows\System\zngUeZW.exe
  2⤵
  PID:9964
- C:\Windows\System\jXNYMdL.exe
  C:\Windows\System\jXNYMdL.exe
  2⤵
  PID:9844
- C:\Windows\System\inCALFQ.exe
  C:\Windows\System\inCALFQ.exe
  2⤵
  PID:9880
- C:\Windows\System\AMbwtyg.exe
  C:\Windows\System\AMbwtyg.exe
  2⤵
  PID:9912
- C:\Windows\System\nPgiRCc.exe
  C:\Windows\System\nPgiRCc.exe
  2⤵
  PID:9908
- C:\Windows\System\TIccihY.exe
  C:\Windows\System\TIccihY.exe
  2⤵
  PID:10060
- C:\Windows\System\SybnsrD.exe
  C:\Windows\System\SybnsrD.exe
  2⤵
  PID:10088
- C:\Windows\System\aOrheMM.exe
  C:\Windows\System\aOrheMM.exe
  2⤵
  PID:10104
- C:\Windows\System\JipvNJp.exe
  C:\Windows\System\JipvNJp.exe
  2⤵
  PID:10152
- C:\Windows\System\JIKzAbN.exe
  C:\Windows\System\JIKzAbN.exe
  2⤵
  PID:10184
- C:\Windows\System\sDjpfDR.exe
  C:\Windows\System\sDjpfDR.exe
  2⤵
  PID:10224
- C:\Windows\System\zkhfuzZ.exe
  C:\Windows\System\zkhfuzZ.exe
  2⤵
  PID:10168
- C:\Windows\System\vTGjjwI.exe
  C:\Windows\System\vTGjjwI.exe
  2⤵
  PID:9332
- C:\Windows\System\oPIpvcT.exe
  C:\Windows\System\oPIpvcT.exe
  2⤵
  PID:8352
- C:\Windows\System\hBYVIXM.exe
  C:\Windows\System\hBYVIXM.exe
  2⤵
  PID:10172
- C:\Windows\System\SywKPwt.exe
  C:\Windows\System\SywKPwt.exe
  2⤵
  PID:9288
- C:\Windows\System\WpTgHDY.exe
  C:\Windows\System\WpTgHDY.exe
  2⤵
  PID:9220
- C:\Windows\System\QMnfmnk.exe
  C:\Windows\System\QMnfmnk.exe
  2⤵
  PID:9352
- C:\Windows\System\CpknVls.exe
  C:\Windows\System\CpknVls.exe
  2⤵
  PID:9316
- C:\Windows\System\aWrBmYI.exe
  C:\Windows\System\aWrBmYI.exe
  2⤵
  PID:9620
- C:\Windows\System\qosCgsW.exe
  C:\Windows\System\qosCgsW.exe
  2⤵
  PID:9864
- C:\Windows\System\EcGPXIa.exe
  C:\Windows\System\EcGPXIa.exe
  2⤵
  PID:9960
- C:\Windows\System\miiWGqd.exe
  C:\Windows\System\miiWGqd.exe
  2⤵
  PID:10012
- C:\Windows\System\KTiqPqC.exe
  C:\Windows\System\KTiqPqC.exe
  2⤵
  PID:10072
- C:\Windows\System\ugnEMAk.exe
  C:\Windows\System\ugnEMAk.exe
  2⤵
  PID:10076
- C:\Windows\System\Qytpcno.exe
  C:\Windows\System\Qytpcno.exe
  2⤵
  PID:8204
- C:\Windows\System\FLPdnzT.exe
  C:\Windows\System\FLPdnzT.exe
  2⤵
  PID:9760
- C:\Windows\System\jAsBaRt.exe
  C:\Windows\System\jAsBaRt.exe
  2⤵
  PID:9808
- C:\Windows\System\pyVPSOI.exe
  C:\Windows\System\pyVPSOI.exe
  2⤵
  PID:9460
- C:\Windows\System\AyhxKge.exe
  C:\Windows\System\AyhxKge.exe
  2⤵
  PID:9016
- C:\Windows\System\ndcmAfN.exe
  C:\Windows\System\ndcmAfN.exe
  2⤵
  PID:9728
- C:\Windows\System\ErvBYSw.exe
  C:\Windows\System\ErvBYSw.exe
  2⤵
  PID:9832
- C:\Windows\System\vUlLoRL.exe
  C:\Windows\System\vUlLoRL.exe
  2⤵
  PID:9224
- C:\Windows\System\ZslaPUv.exe
  C:\Windows\System\ZslaPUv.exe
  2⤵
  PID:9584
- C:\Windows\System\DVwmBpT.exe
  C:\Windows\System\DVwmBpT.exe
  2⤵
  PID:9532
- C:\Windows\System\pyjUZGv.exe
  C:\Windows\System\pyjUZGv.exe
  2⤵
  PID:10124
- C:\Windows\System\xhSxXbn.exe
  C:\Windows\System\xhSxXbn.exe
  2⤵
  PID:10216
- C:\Windows\System\ujzJBVa.exe
  C:\Windows\System\ujzJBVa.exe
  2⤵
  PID:9696
- C:\Windows\System\MUaognv.exe
  C:\Windows\System\MUaognv.exe
  2⤵
  PID:9596
- C:\Windows\System\duAutfA.exe
  C:\Windows\System\duAutfA.exe
  2⤵
  PID:9744
- C:\Windows\System\MQdMCHS.exe
  C:\Windows\System\MQdMCHS.exe
  2⤵
  PID:9300
- C:\Windows\System\sFToVGd.exe
  C:\Windows\System\sFToVGd.exe
  2⤵
  PID:8596
- C:\Windows\System\XnwZjbU.exe
  C:\Windows\System\XnwZjbU.exe
  2⤵
  PID:9636

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AbRsCwp.exe

Filesize
1.9MB

MD5
51408bc7ff73384074fc5041c84017c3

SHA1
fea28bd55f13502482f746840ff5c7fb9f8aa7c1

SHA256
eec691403cdfca4b0b68813ec72d7152c82800ffe1c188b6afbb791952412be4

SHA512
270871a97b16d85d58911805e0d20617653c16ad9b2a1398eb32a2ae903aede9350bbadb97f40a3da5c917b9b9292bff27f79f31b014337a48486f8947cb3449

Download Submit
C:\Windows\system\HXoSVZC.exe

Filesize
1.9MB

MD5
a1a9f4fc4eb4df43b896356b3b664a14

SHA1
0250baf47c7102243d87d57bf35e64f8c1713ea8

SHA256
232e56e1e16dc5fbf17d81cda7ba4c54dc1a014c47282f3c036ecfa8bf55d207

SHA512
9d5d29bd77a06720b3c0ed59c82142f4669394d86328b9ffe73bc4b2c23b86a9bceb6321281605f8eeb046355c8231ddac82d98d174fe885628e85e7e1c474ed

Download Submit
C:\Windows\system\MIvHHpY.exe

Filesize
1.9MB

MD5
193f1a64575f1e1de239dac77d483cd7

SHA1
2d3dbbb3beeaf4dfbb8f02e24061e3b860425d8c

SHA256
d38f0027c0970894f9132fdda63df4a402df3a035b3c795098086417377fc21f

SHA512
c0be9b5f930f56ea5d2fce2b6ba804f82fb2cab27f61f473ea27358450a659eeaf001b14c55d1d522d9dba16ed0d8b34c951781be23a2ac3870f1601cf75a2cd

Download Submit
C:\Windows\system\QakOxVz.exe

Filesize
1.9MB

MD5
27ef235b3c706fdddbaa7266f715db2f

SHA1
98139be736b03838feb70a938bf833bc66ca6da5

SHA256
a8e6e0f7620beed7d1b3a6a99fd49b126149dced7653d570b89d8a450fabba55

SHA512
eb96fb8e5e2b9e9a992d84a8b12e813e10627e4eb1d61ae27f6800f6648e17de53a0fa609f266e7a01bd39dd85106577f186a88042cb36f2631cfbdcd46c7993

Download Submit
C:\Windows\system\RbczCrE.exe

Filesize
1.9MB

MD5
639c72d32065304cdeff858323b46366

SHA1
8cd1637de3978e7336a3fe7f3127ba27acb3c6c6

SHA256
fe644695180a1f2bee3678496b098a1780fc6c9ea02c6af9176489261cdc1017

SHA512
f616cfb57bcec10c40b41e98512101741ba238272183812fc2be2b7c57006e18dabb5218021d79991c19c1c78b0e07c77f98f136d7cc6e85482e778243697312

Download Submit
C:\Windows\system\WZJUVDf.exe

Filesize
1.9MB

MD5
e01e71d20ae467f5d9c9c2e093a6d84c

SHA1
e86af08a8c38e32c7536f36776a49bdcc173ea22

SHA256
560be1b93ec488a805e9afa7ea09091ed31615d42edd0f364259276d3bc0ea3a

SHA512
e54f0a36bb6efdd71eb9ae6070f915abddfd118d1c37ea4804767bfc255296d99d4dd4791c64a8a0ba05697b643a0ca0f5eba1c9e0452e1e932b34618a9a4b66

Download Submit
C:\Windows\system\akMoCyC.exe

Filesize
1.9MB

MD5
4515bc11fae119bb89394459b14fa9b9

SHA1
b04fee3b3ee7474500b981105a8c3271309b10fd

SHA256
ce3b87e9e3610d09e976723e56130ea0d825974bd6fa63aeebbe37ed93e41f24

SHA512
247a628707f741992ce0c1be9fe1be35a72200ec6820729ff3f3692b5306d01ae9fa42b0a20cce2ff68c415aa0c48ec78673151209896d268b42de3dabf6a81e

Download Submit
C:\Windows\system\gDnaQMx.exe

Filesize
1.9MB

MD5
e46230b8cf510c2727fe7af4c2e065c0

SHA1
ae0cd674f837d098022985293005fe3e4740dfb5

SHA256
d079196e76cd241ad03a11aa8af07bbda6b99ec4a7085939c14ac999cb8eea3f

SHA512
ffd65ba3d0e688c7889e3130cbea7622cfc021a0fe19abc30e672b60c2aaa3b23523ba0ea49be51107aa0951f926fdde2c83fb3fd4949f7cbd2c0f458bcef0de

Download Submit
C:\Windows\system\gfzllVR.exe

Filesize
1.9MB

MD5
a7c72a28314d9cfe63c0af7c30fc5e9d

SHA1
93aa158028080b85cca1aca6c5c27973567b5cb9

SHA256
eec873ef32aefca64cdc4703b1b178295236bfdce42f1bd3a9db6d83d6f8a6dc

SHA512
bef6dd69b2651bc38f70333fdf82a7b90a3bd8dce04eeedfabf65522cff308049e33697271c6f2f0d7ed40c8edf16c149100d3f269cb5127d3262d7b50a7cbec

Download Submit
C:\Windows\system\goIvfIx.exe

Filesize
1.8MB

MD5
1ce4f1218e82fa2a731995fb638fcb70

SHA1
ae7a86cead25136e76a537afdb03023abac2ddc7

SHA256
0fc631fdbc0f7ee2e01568fd47d4fc513712db3b44f76dfd1864986734927dd7

SHA512
6659b79314b08b5c6b106afd3d679d308f0b89280d7607d7e4eba2db166972e298ffa02edaae70731489da55f990de175495e084b652dabedb7be7b70a1d8ad9

Download Submit
C:\Windows\system\hbaPBJH.exe

Filesize
1.8MB

MD5
a758550ec3b6c82d294c02de51d08e41

SHA1
61d5805c8cc4123a609078ae13f98f6b89d7ef4f

SHA256
8b5507a001ed662ea9f8a15bf95dea5ee24cf6468f2f08590cab6c4d94044ebb

SHA512
f88d8d1f49e1416412a5e826f0bf409b78ccc6b2c45f3b6bea27b39574d2a94fecff839860e9726be6cd557580c102752fec33342619f323aa888cd59188265f

Download Submit
C:\Windows\system\pJlrZjg.exe

Filesize
1.8MB

MD5
e30f481fb766b466f61ac873a837b109

SHA1
5a96a36a42105c8173eacb7aa58fbe4527c33064

SHA256
43fe1fc9cc3b7d74637e5cc7e0f9f8f2ea1be277181b8adf4c6cd24a5ed16847

SHA512
a9a507f58f1372b93918cd0dc6203192ceb1468b0ed9f2b286354d7bc3915124e39467b05494a71edc997cc83caf6ab4634604f30cda97bded4ab777663f14f5

Download Submit
C:\Windows\system\uicSOWX.exe

Filesize
1.9MB

MD5
b7619d85363e4f4d53a005477041a03c

SHA1
4abee57063a09cc2ba1ac401903389318b8ace76

SHA256
aca6bc8755396b0429195eeb42c5987cfedf96c68fc10a889b2a978cbe773180

SHA512
8d913eacf727f1f301504310939e98a171c40f2774ba5fa632677254e2a4e190df1a09ab84e63fb61f3d9f401db1f9d981809adbf5eca6beb4a852f221565763

Download Submit
C:\Windows\system\vegJzgG.exe

Filesize
1.9MB

MD5
31a2a24cfc36801e1a89370a0267bf06

SHA1
4ca2e7e2768a37bf54984099390cea6f4d0ce9fa

SHA256
be3bd0639a98d8830850352843cc9d1cbd8405f7fc0c05385d865aa32e70d843

SHA512
bfd6fd6e780a1190263d264b2f80a2ef89dcff5524464c0c9d8486cf64f05980b59b70a0764828adc479a3e0ed606cd289f8828f971548450a0a05e178baeea2

Download Submit
C:\Windows\system\wrhelEt.exe

Filesize
1.8MB

MD5
996ecefee10d4520da56ef26d102492e

SHA1
cb7a5e4f6653e9e3973a3e0912f9e59face4f5ac

SHA256
e9dbe8785ff561230292bf3159dc0dd7f3619f0c0ec2ad5c54f6413b4ea9abbb

SHA512
b8cdfc22cd0114c545caf8ace6d0a40040fb0909a473588d2a5feeed8823275765896f13507273f17b65c607f2f1b80a6367af95a601490ea90363ff51c5138e

Download Submit
C:\Windows\system\xGjGmVw.exe

Filesize
1.9MB

MD5
c13e1f16b6107cb2dffa9423268f0cb0

SHA1
2074738fdae5cc9ef113c716c10707ad33cdf324

SHA256
2c67a009e133c177ef8d696c9521ea652f6dcb5fe6f2172b23461b59617f07a2

SHA512
8345bdd29dfac6d94dc78c898ff0749a73e4bd7384bc004e3dadb0287a5021a96687396ba89f989ca38b278fb0e82ba51c575c936edc0ecf361acc28295677f6

Download Submit
C:\Windows\system\xSOGpMx.exe

Filesize
1.8MB

MD5
dbcf2958b9bc1a459609c8335c29baaf

SHA1
174e62fd88e7e85cd02e9feab1c3b7b5178efdd5

SHA256
7f1f1c9fc0b4b09e01d79524dbc92a9628293b2853811270331bb6ee803a6966

SHA512
4ed35d5fcc27760d62e81df2805aebdf020e96fdd82098d17109c8b0b3884f36378039af7cd71f1838852e3993c7ecb0a5bdf38580253a4506e1b9f23e258abb

Download Submit
C:\Windows\system\yQEOuNL.exe

Filesize
1.9MB

MD5
ccd468d97aeee454ed3b0bdd5a25b509

SHA1
20ed2fa3df5cd3628a638ce738b390f7ee0c88fc

SHA256
c679ef987e5b956e4c9c575d2860df1d38a80324d6e5966ec64fab3e8e2145fe

SHA512
408f7c9ffcc8fb9a9bf2b4c796d262a8d0cc60739e5eb85385f7b237adbe56a7b30fede24e4febbb4fa652a3659cac47978280ee8d253e454433346ab57a1bb0

Download Submit
\Windows\system\DSQnAch.exe

Filesize
1.9MB

MD5
1673d6cbffbe415875a763f2bc85a18d

SHA1
c896d41105431f104122e8538baf068fd7316fe3

SHA256
a4d8af8e6a853e1745182c2e9a2fccd8cfa5a158806f87beb873d14e0b5be2af

SHA512
dee8f7f429318b9e9b7782b4d284ac3bdd3984c04cf3d2aa5b194936ac190f1108c9e9f962f9262fdb82767e3a4fd716f8bd8709fdda4a51b518d0394e9f6149

Download Submit
\Windows\system\IWFDKTf.exe

Filesize
1.8MB

MD5
c5377bb4a181e1756a063a703f36c3ee

SHA1
45f425319d20f83e230584b55c6a9f5d3842976c

SHA256
7478044bedd502cf105341acecf00b004a13fe9e8dbb9d1fb87f0f5287c46a41

SHA512
40781705caf3a9c1de2fa35335881407d389a096270183b9cfd7c95ab45a16486ed1cd19cfa4805c2d8ca4e6aa90b881b0d88e0ab3ffb91a380d4d00baa1d066

Download Submit
\Windows\system\JizOljO.exe

Filesize
1.9MB

MD5
86a660981b63c1640141e3b05740da8f

SHA1
a9219ea73fe6634213ac88e9e9c00c803afafd39

SHA256
361897c108f3ffec71f2de34e73d57b0a32c2b2983604f76afbd4e3fc7f13534

SHA512
c39af191c244cee473d9b4dfa37a63660d215d2f4b158fd8de0f5955a7dbf9b9da21c2ef0c8b9a775b8865d2c92def896f6a1ebc3162ef3f84525255faca14ba

Download Submit
\Windows\system\KVviNpJ.exe

Filesize
1.9MB

MD5
0b8ebb45f3181e19d8581a51d389480f

SHA1
040ce74a72d01c5d3251fce29b34f5b318cb86e9

SHA256
c5c4ccbd9280a93b3a5e2db8e2dc5f20ee9aafc1ecc86646bc2faa38a55969e7

SHA512
4bb9de83e5ce0a9df52d48bba47eb6fa763d33d92d2a1916e0cdc330862bda53bec018fd3b017b1ce36962b423118738e484f1b41a64fe5584c30faaa90632af

Download Submit
\Windows\system\PJafQDQ.exe

Filesize
1.9MB

MD5
79697ca8c79bbc6cbbb180a805fd7155

SHA1
364f1df3f3d219024d06da92303ae8596278025c

SHA256
aa25b31b0935dd6248868fb8197ac2a143cb1b0e25f24bc946a010225fb0c74f

SHA512
60574972082c1ad233f9f8db09c1e0774162c26dfd9f8e8afd3f26b3bba11c26df1b97905bc262b682da7704642a0cc53b2ab4a55810f181cd17f1932f40ba1e

Download Submit
\Windows\system\TgwIRRC.exe

Filesize
1.9MB

MD5
f0ea14ee4cf67c187e4befa007c856a0

SHA1
dc869632b8df16da25046f1e77dd88d4dc07e85a

SHA256
2af2cfe9c426dbe5041711c15c4dc63267ce54a4e348c9724d81b7dd550d0cb2

SHA512
b778361f3cd85f2117f83b3081bae458b0d6a18a599cc0085d42b4f58c5da72abac86897226869cc45628a2a5747502969120d0a886b73de607d219a12d40689

Download Submit
\Windows\system\UTjNdnd.exe

Filesize
1.8MB

MD5
2be1aec84f42f0c6fe17e326f7949c66

SHA1
d17b456c911dd239b9b5be4528c926415fa5cdee

SHA256
e950a0644b458d5f6fc945ba28ec5dd0ae1c918a6d0ff9b63fef917aac6347c6

SHA512
a3cc23ba1c7ed2515ddfc9b90f34afb3765c03605563038b5eb23d594eb56952b0bd481f52c6a9e46f757d7eb1daed953bee6d4beaf35965cae262a03f2ed17c

Download Submit
\Windows\system\UmNZfsK.exe

Filesize
1.9MB

MD5
e1f2ff6d52a227ac4edddc7657c297b9

SHA1
380eeaad07f226f2110f255678e0fc504bfd09bf

SHA256
87adf3bf506222a8f8bfd309adae7fc208f9fe4210865217d2b3c730c7b5c50f

SHA512
3cde0fafe0624f536044d4c71cde526f9832c00cee09573293ba100e2a9ad575c879f0af777006784574d680cac80a4f74b4eda810b95a1141e6bac9d02999a3

Download Submit
\Windows\system\VcEmJFW.exe

Filesize
1.9MB

MD5
5efafb3bd0bcb57a30bb8ffad0145d26

SHA1
1db405041feb4c31fcc8571f4bbbceec8a1884a6

SHA256
cfbd4f0373eb0caabfa565118fb5616c108edb3f312fc72176a3421db50e6b77

SHA512
24f69ee9261d153a18e636d8cc7b3bf1294dee6aa8bc790068bae33d8f124f216b0211612d295226f276b949aa25595032f9ca3518a01ead4fc4a6925b32574f

Download Submit
\Windows\system\WsdDMPd.exe

Filesize
1.8MB

MD5
842953cba420dcfa8a5e6b45fe526e3a

SHA1
a8c5dfbce007ad3a07f903e26e479a27641d076e

SHA256
6ace074632d4675ef4d20ff928d79257d80807cf61415f324dcb8f070ee6615f

SHA512
a414991f25446bb9ad1bcfc9b5b76aaeb3985c4f9ae29a0dafce5af69e73be98ba2af9447b4133709a3a60bc5183092b3ecd57891b56deac538f767f1f995561

Download Submit
\Windows\system\YLZpBKc.exe

Filesize
1.9MB

MD5
bcfab8215ef60ef787fd7dcd25656ac1

SHA1
084dd78b2c2b7b640cda1886edc236af5e6eee3f

SHA256
5b8686116d66971dab4b530ed8847c6923051cf437697cce8f18151ecb3ed868

SHA512
504bbcdca1cf7e6bb49fb8c75fc2a69f66966adc2f53c620cca2a2ff7ce9aa543da578b561c18672f864d92828b6e2793b2d2b60b10487f69b3dd1d6d5cb2926

Download Submit
\Windows\system\YLoJnYP.exe

Filesize
1.9MB

MD5
a0f7a4a1a69a8b97f22be308e01e7e72

SHA1
e999e3f6019b918438f3e4191fc6ae633af3bc01

SHA256
4f8b69aba86a39a848db621941b4ae75ae8863f6b6e2e0e5ae0b36a7466ce84b

SHA512
4381f944e9f30ac964d8635b9612648c2b0998cf6f06cfd11cfad62fdab68de15480e80bc8d865578d4ec54951deb99a77753b16421cb366349ca4ec21fb38aa

Download Submit
\Windows\system\bXHMuFE.exe

Filesize
1.9MB

MD5
56072179ee264056aa035e4f076d350e

SHA1
9aed071def27cfd477c8d9da9a7a7303dbedc81a

SHA256
a66609ff791be03d69995b6bb45b22da239999bc11bc638bfaa7984b41011b77

SHA512
d10d8034b1170b74877f85134aba6d724ea4262f4335a5e7acb0120e494955430cc62ff2d3128b1464757dfd2c4477103e603d343e63aec9c75438561b6c4132

Download Submit
\Windows\system\buXiFUg.exe

Filesize
1.9MB

MD5
27a2d41d5eeac5f6a73d0d6da1d9374d

SHA1
30632ae9dd81f7e758ec7ac189802090f9f0ffd9

SHA256
bf214883d0af8babfe20244befc19a53c5a7917781a9d43a4069d2fe94bef48e

SHA512
8d76d14215d4f56c5e562998dcb68b190644efe50e08d8c63fa77fe48d11d94e1ec2b4c98dca9a27a19a34e70de6bb34d5c96ede4acabced5fd30a6c60249b9e

Download Submit
\Windows\system\htInFZi.exe

Filesize
1.8MB

MD5
d4c89bee4bda3c4b8ec01d364d2f1e13

SHA1
3aa2c5e90cf1c8cac72bd2d00a5302bef1e0c443

SHA256
4f27efc3bccdea57672a3572a5b906af2a997b6de8e83e5a23211be6bdce59d3

SHA512
c9f19c1f14b1aa345f6e7118f8deb276b276783e441975ce9fbaa7a0e9aaca1aa257e9922b99536f3712691f19bdf1fd8f37c11f1506f758df86727d1dd85818

Download Submit
\Windows\system\ismrkfA.exe

Filesize
1.9MB

MD5
890f708a1c673b5bbd4ce484de166ca9

SHA1
f86182a5438effe69e62a33ff9d95b55fee7ce13

SHA256
bdada661b15f7c31ee090ecb74485ee1aa058554c7268d55a9eccd3c9c424d8e

SHA512
b65bf29c74a8176e8626a439c3b1fa90dab5adadce4fda7600f578954cba19126c67e4987b8942ce93ad0bacaa7a3401609c42df1dc8107364fccb5ce781dd45

Download Submit
\Windows\system\kegASJH.exe

Filesize
1.8MB

MD5
b7ef03ddab36a310f9bf2c69ff2d1c9f

SHA1
f4f3eeddd214120c07bc5d357fb43c0beb8c941e

SHA256
677daa335d1a07483c6cc09828b91b0d22d7706824f27f775fb7235dd2fcee76

SHA512
415435ea2d975baeb12fde3c5c9a8f0790289542708d66e8ffbfbc6d8ecca82792c1c3149150872f8925a7c48be6922cedaaf8c09833c3beb3f541069e4aa591

Download Submit
\Windows\system\reMbjNF.exe

Filesize
1.8MB

MD5
18ecaeb60ea3dd87c3b7e08daf677daa

SHA1
dbe68d510794d640bc6465c31b1dcea177904d0e

SHA256
f15bb17d36ed0f3540d38f2873b3dd7c8c47dd054873a1ff9ceb84b023c1cc2f

SHA512
9c49d76bf8189fd47abb04b142e247483f0d93002f9f6a3cfc50d93035bbc029f086a68f77666b6bfc9e9d1f15f11bd18e917d879ae814f0905970aa55d1191b

Download Submit
\Windows\system\sLdQbWW.exe

Filesize
1.9MB

MD5
e6dafef1f45ab30a06294cdffa579394

SHA1
8504efd561ce60946cd392407158888f93f8598c

SHA256
07fa25eec635cb0dca63c0945b978c515bc7e4dd8acf3d122d9697f73b61ae01

SHA512
12a82290fe3a2f5eabe643f21f2cc5380c587a943f5385f37205cd7b894651d05cabc93caea48edfe95a645c0d64f715b76aaeea9238e14f747c7a76328c9ea9

Download Submit
\Windows\system\vKWEryc.exe

Filesize
1.9MB

MD5
b535ba5822d4c854dac91f87f7a8e444

SHA1
3bc7a93d2f9acc7044e9192c27805002ed055e28

SHA256
0787e5f9e1db23a9b156ef254c645d8d9215966ae2a3aeb31bb432548a341e7f

SHA512
6292e4db6237b404d67be908905a391f14dfaf08a8dcce5e231ba0200b88a3dbb8c4c02480cb50edd6607319398c857a9eff35b038302f2aad0c89a779fecdef

Download Submit
\Windows\system\wGZSfwS.exe

Filesize
1.9MB

MD5
bc9f6c325f863a63913f7b58895944d2

SHA1
090582b4cfc5789a8062a9d35932d246725d07df

SHA256
0f199fbabf03059c240c1f756e961296a774b21fbe2762635b1d3a7f2e7f1706

SHA512
74b03cd3a24c3ea25329e716558b3e7e3d12f7ac7e043df8ef06d1ad504d258d92744bd30e94feb32d5bb73a3e13f269bb5b68890a73ec0c049326f1f1413840

Download Submit
\Windows\system\xWykzXn.exe

Filesize
1.9MB

MD5
1792d37a776aaec62cd9de11bb9e3745

SHA1
1bd7435548dd4b7eb034fea07589413ecea8a50e

SHA256
43f2ee1d80128b26ddd6a435d7f931043cfeb019610ab0dc6df4034bb899e06e

SHA512
76415a723a8750792c5dcb0419e72a6f2b1d3d982ff7be5f7a5f5cf57b6824a3c1039eccd06fbc6f74e9591899881c8dd9ce49af4a84e9b805ec803079fd4167

Download Submit
\Windows\system\yEMmOkD.exe

Filesize
1.9MB

MD5
caef8d143d9e7cb364efbf0d3e1e4280

SHA1
b8f6e9d874ca8e6435c0e6463025c728dea14d2f

SHA256
bf9f79694dba44f77f54003b4dcd1241c78c2c324c52c41930e26f7311741885

SHA512
9f02ee7a94ca7b028790e3b34c58c243546186b0dbeea151c1945cf7936fb25f12b219369188b1b4c864a402e0389fc2889d5f803dd814bc8b31d47d73967d75

Download Submit
memory/2156-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2156-1-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-31-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2156-35-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2156-37-0x0000000003800000-0x0000000003BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-52-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-102-0x0000000003800000-0x0000000003BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-82-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2156-60-0x0000000003800000-0x0000000003BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-72-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2156-7-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2156-49-0x0000000003800000-0x0000000003BF2000-memory.dmp

Filesize
3.9MB

Download
memory/2172-54-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2444-51-0x000000013F4B0000-0x000000013F8A2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-106-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2540-8-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2544-32-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2720-36-0x000000013F140000-0x000000013F532000-memory.dmp

Filesize
3.9MB

Download
memory/2772-92-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2920-61-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2948-41-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2992-24-0x0000000001F80000-0x0000000001F88000-memory.dmp

Filesize
32KB

Download
memory/2992-34-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2992-39-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2992-19-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2992-112-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2992-29-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2992-484-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download
memory/2992-33-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2992-30-0x0000000002A20000-0x0000000002AA0000-memory.dmp

Filesize
512KB

Download
memory/2992-110-0x000007FEF5F60000-0x000007FEF68FD000-memory.dmp

Filesize
9.6MB

Download