xmrig | 7990fedf0084fbf65547234ca24489116a5595f8ce323231fb8adb9b1454fb69

Analysis

max time kernel
35s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
Size

1.7MB
MD5

0b62e58a8777c2850ddf227cc5f0986a
SHA1

fd5d1faf8748c0f1b52515e380b19b851ed767a6
SHA256

7990fedf0084fbf65547234ca24489116a5595f8ce323231fb8adb9b1454fb69
SHA512

cc64cc62ac5a2d721792ad68e33b76cbf36e104dba01413eab8536b1fb92ff6bbd29d854fe1515eb97d7395a8f6ed4e18da233186621482ea00c70a95564d5d0
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKZ:NABG

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2548-47-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2528-55-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2652-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2596-51-0x000000013F020000-0x000000013F412000-memory.dmp	xmrig
behavioral1/memory/2712-49-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2632-44-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2168-909-0x000000013F390000-0x000000013F782000-memory.dmp	xmrig
behavioral1/memory/2040-1166-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2040	qdoLnje.exe
2632	yfPrXlg.exe
2548	vruSRYZ.exe
2712	GwnLQtp.exe
2596	lkdFWXu.exe
2528	oAMrflk.exe
2968	SwfViYB.exe
2652	faIBroi.exe
2936	tZEWsry.exe
2996	VNntPrz.exe
2772	SmMJTCU.exe
2292	NOjWmEc.exe
2592	tTLtMrm.exe
2812	zXuVkHp.exe
1844	cOLQfyV.exe
2368	KYTuJKp.exe
1224	UVWAxxe.exe
2080	ZDfbOsa.exe
1664	ihLRFBe.exe
1036	TLvMGLJ.exe
988	MwLgFoJ.exe
2880	ZCkOEBz.exe
2376	FkkkEpK.exe
1988	LWkHXAT.exe
1172	TflgQXc.exe
1052	NaAikyW.exe
1708	vWpxTxo.exe
1544	XhhgwBM.exe
2900	uZwAOfv.exe
904	BuHnacW.exe
1000	UzrdiMe.exe
1768	aEMNDAO.exe
1480	UKetpIQ.exe
1536	XUtxsWW.exe
344	jMaeKrA.exe
892	EFJcYDn.exe
2356	NWEGEQh.exe
1516	gxXlAGJ.exe
1728	CnUYyRq.exe
2568	dxPLEar.exe
2660	JtfpbrQ.exe
2408	MKOdRTl.exe
2740	ZBcfaEU.exe
2024	TQJSeDn.exe
2844	MxXfvgb.exe
2272	MTEKmEM.exe
1616	qJfuPIM.exe
2920	WmLMtwW.exe
2672	bsXytGO.exe
1808	YYpaZYR.exe
1488	JEZhRIX.exe
2720	tOUetFE.exe
2776	MhkPBLK.exe
1256	iInqAQO.exe
864	EIIRDne.exe
2204	dWNHGKj.exe
1620	WKnqOrw.exe
2316	IQZxCGY.exe
600	TtWvaBy.exe
932	nZonZlr.exe
568	QEJGJlV.exe
2300	hJSogda.exe
452	mDdrLqa.exe
1996	qGAfXFi.exe

Loads dropped DLL 64 IoCs

pid	Process
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-1-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/files/0x000c000000013413-3.dat	upx
behavioral1/memory/2040-12-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x0035000000013a3a-16.dat	upx
behavioral1/files/0x000e0000000054ab-21.dat	upx
behavioral1/files/0x000800000001415f-25.dat	upx
behavioral1/files/0x0007000000014175-31.dat	upx
behavioral1/files/0x0007000000014186-33.dat	upx
behavioral1/memory/2548-47-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x0007000000014207-59.dat	upx
behavioral1/files/0x000800000001471a-63.dat	upx
behavioral1/memory/2968-62-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2528-55-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/files/0x0006000000014826-71.dat	upx
behavioral1/files/0x0006000000014a9a-82.dat	upx
behavioral1/files/0x0006000000014b4c-89.dat	upx
behavioral1/files/0x0006000000014bbc-95.dat	upx
behavioral1/files/0x0006000000014fa2-102.dat	upx
behavioral1/files/0x0006000000015cff-151.dat	upx
behavioral1/files/0x0006000000015d56-165.dat	upx
behavioral1/files/0x0006000000015d93-181.dat	upx
behavioral1/files/0x0006000000015d7f-174.dat	upx
behavioral1/files/0x0006000000015d5f-167.dat	upx
behavioral1/files/0x0006000000015d4e-160.dat	upx
behavioral1/files/0x0006000000015d20-153.dat	upx
behavioral1/files/0x0006000000015ce3-146.dat	upx
behavioral1/files/0x0006000000015ccd-139.dat	upx
behavioral1/files/0x0006000000015cae-132.dat	upx
behavioral1/files/0x0006000000015c87-125.dat	upx
behavioral1/files/0x0006000000015677-118.dat	upx
behavioral1/files/0x0006000000015653-111.dat	upx
behavioral1/files/0x000600000001535e-104.dat	upx
behavioral1/files/0x0006000000014e71-97.dat	upx
behavioral1/files/0x0035000000013a46-90.dat	upx
behavioral1/files/0x0006000000014b18-83.dat	upx
behavioral1/files/0x000600000001487f-75.dat	upx
behavioral1/files/0x0006000000015d87-179.dat	upx
behavioral1/files/0x0006000000015d6b-172.dat	upx
behavioral1/files/0x0006000000015d42-158.dat	upx
behavioral1/files/0x0006000000015cd9-144.dat	upx
behavioral1/files/0x0006000000015cb6-137.dat	upx
behavioral1/files/0x0006000000015c9e-130.dat	upx
behavioral1/files/0x0006000000015684-123.dat	upx
behavioral1/files/0x000600000001565d-116.dat	upx
behavioral1/files/0x000600000001564f-109.dat	upx
behavioral1/memory/2936-74-0x000000013F180000-0x000000013F572000-memory.dmp	upx
behavioral1/memory/2652-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/memory/2596-51-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/memory/2712-49-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2632-44-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2168-909-0x000000013F390000-0x000000013F782000-memory.dmp	upx
behavioral1/memory/2040-1166-0x000000013FC20000-0x0000000140012000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\QszKxOX.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\tlhkLrF.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\KHnyxhR.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\altaoeS.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\cbbgCjS.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\GVINkzR.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\vvBVBOA.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\OYiBdnU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\vXtjRUX.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\RrNYgnv.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\mFgjDDF.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\LsbPkNN.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\SUJmMLL.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\oAMrflk.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\RNsDihs.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\inwimJS.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\UVvCnmm.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\YdpogJU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\GdIbUzJ.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\fkLEToi.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\HNjfCqD.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\ujqQnsa.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\zXMeNjr.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\vaaMQCR.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\oZEVuIH.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\SKbMbuf.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\WRrwYTE.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\KtMlAJG.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\kmnaBGJ.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\wFCIuJd.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\YCQWXsY.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\FXjSFUM.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\jdYFIWc.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\yPEjhdz.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\uCmOwGc.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\nlGjKug.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\btbBJRn.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\eLPMyBB.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\HceRrVS.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\JyrogMk.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\zTLkWlU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\akfsuyP.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\tplzwlo.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\RHlrkJH.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\kWAuNHX.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\lDuMvLa.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\hpKRGEK.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\AnKUWzJ.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\eXulxZY.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\PduZCPL.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\HaikmkO.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\PnlytjU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\ZxaudvU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\VEUgexy.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\GREScdn.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\nQbUFgX.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\AcXRpVU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\tZEWsry.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\avivVEl.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\oQFRVcU.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\FchYJSH.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\XcaPfCo.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\bychUXy.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
File created	C:\Windows\System\iVNbjzZ.exe	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2600	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
Token: SeDebugPrivilege	2600	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2600	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2600	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2600	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	29
PID 2168 wrote to memory of 2040	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2040	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2040	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2632	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2632	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2632	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	31
PID 2168 wrote to memory of 2548	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2548	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2548	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	32
PID 2168 wrote to memory of 2712	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	33
PID 2168 wrote to memory of 2712	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	33
PID 2168 wrote to memory of 2712	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	33
PID 2168 wrote to memory of 2596	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	34
PID 2168 wrote to memory of 2596	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	34
PID 2168 wrote to memory of 2596	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	34
PID 2168 wrote to memory of 2528	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	35
PID 2168 wrote to memory of 2528	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	35
PID 2168 wrote to memory of 2528	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	35
PID 2168 wrote to memory of 2968	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	36
PID 2168 wrote to memory of 2968	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	36
PID 2168 wrote to memory of 2968	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	36
PID 2168 wrote to memory of 2652	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2652	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2652	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	37
PID 2168 wrote to memory of 2936	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2936	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2936	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	38
PID 2168 wrote to memory of 2920	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	39
PID 2168 wrote to memory of 2920	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	39
PID 2168 wrote to memory of 2920	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	39
PID 2168 wrote to memory of 2996	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	40
PID 2168 wrote to memory of 2996	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	40
PID 2168 wrote to memory of 2996	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	40
PID 2168 wrote to memory of 2672	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	41
PID 2168 wrote to memory of 2672	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	41
PID 2168 wrote to memory of 2672	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	41
PID 2168 wrote to memory of 2772	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	42
PID 2168 wrote to memory of 2772	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	42
PID 2168 wrote to memory of 2772	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	42
PID 2168 wrote to memory of 1808	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	43
PID 2168 wrote to memory of 1808	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	43
PID 2168 wrote to memory of 1808	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	43
PID 2168 wrote to memory of 2292	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	44
PID 2168 wrote to memory of 2292	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	44
PID 2168 wrote to memory of 2292	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	44
PID 2168 wrote to memory of 1488	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	45
PID 2168 wrote to memory of 1488	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	45
PID 2168 wrote to memory of 1488	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	45
PID 2168 wrote to memory of 2592	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	46
PID 2168 wrote to memory of 2592	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	46
PID 2168 wrote to memory of 2592	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	46
PID 2168 wrote to memory of 2720	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	47
PID 2168 wrote to memory of 2720	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	47
PID 2168 wrote to memory of 2720	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	47
PID 2168 wrote to memory of 2812	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	48
PID 2168 wrote to memory of 2812	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	48
PID 2168 wrote to memory of 2812	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	48
PID 2168 wrote to memory of 2776	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	49
PID 2168 wrote to memory of 2776	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	49
PID 2168 wrote to memory of 2776	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	49
PID 2168 wrote to memory of 1844	2168	0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b62e58a8777c2850ddf227cc5f0986a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\System\qdoLnje.exe
  C:\Windows\System\qdoLnje.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\yfPrXlg.exe
  C:\Windows\System\yfPrXlg.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\vruSRYZ.exe
  C:\Windows\System\vruSRYZ.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\GwnLQtp.exe
  C:\Windows\System\GwnLQtp.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\lkdFWXu.exe
  C:\Windows\System\lkdFWXu.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\oAMrflk.exe
  C:\Windows\System\oAMrflk.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\SwfViYB.exe
  C:\Windows\System\SwfViYB.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\faIBroi.exe
  C:\Windows\System\faIBroi.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\tZEWsry.exe
  C:\Windows\System\tZEWsry.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\WmLMtwW.exe
  C:\Windows\System\WmLMtwW.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\VNntPrz.exe
  C:\Windows\System\VNntPrz.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\bsXytGO.exe
  C:\Windows\System\bsXytGO.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\SmMJTCU.exe
  C:\Windows\System\SmMJTCU.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\YYpaZYR.exe
  C:\Windows\System\YYpaZYR.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\NOjWmEc.exe
  C:\Windows\System\NOjWmEc.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\JEZhRIX.exe
  C:\Windows\System\JEZhRIX.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\tTLtMrm.exe
  C:\Windows\System\tTLtMrm.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\tOUetFE.exe
  C:\Windows\System\tOUetFE.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\zXuVkHp.exe
  C:\Windows\System\zXuVkHp.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\MhkPBLK.exe
  C:\Windows\System\MhkPBLK.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\cOLQfyV.exe
  C:\Windows\System\cOLQfyV.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\iInqAQO.exe
  C:\Windows\System\iInqAQO.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\KYTuJKp.exe
  C:\Windows\System\KYTuJKp.exe
  2⤵
  - Executes dropped EXE
  PID:2368
- C:\Windows\System\EIIRDne.exe
  C:\Windows\System\EIIRDne.exe
  2⤵
  - Executes dropped EXE
  PID:864
- C:\Windows\System\UVWAxxe.exe
  C:\Windows\System\UVWAxxe.exe
  2⤵
  - Executes dropped EXE
  PID:1224
- C:\Windows\System\dWNHGKj.exe
  C:\Windows\System\dWNHGKj.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ZDfbOsa.exe
  C:\Windows\System\ZDfbOsa.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\WKnqOrw.exe
  C:\Windows\System\WKnqOrw.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\ihLRFBe.exe
  C:\Windows\System\ihLRFBe.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\IQZxCGY.exe
  C:\Windows\System\IQZxCGY.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\TLvMGLJ.exe
  C:\Windows\System\TLvMGLJ.exe
  2⤵
  - Executes dropped EXE
  PID:1036
- C:\Windows\System\TtWvaBy.exe
  C:\Windows\System\TtWvaBy.exe
  2⤵
  - Executes dropped EXE
  PID:600
- C:\Windows\System\MwLgFoJ.exe
  C:\Windows\System\MwLgFoJ.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\nZonZlr.exe
  C:\Windows\System\nZonZlr.exe
  2⤵
  - Executes dropped EXE
  PID:932
- C:\Windows\System\ZCkOEBz.exe
  C:\Windows\System\ZCkOEBz.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\QEJGJlV.exe
  C:\Windows\System\QEJGJlV.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\FkkkEpK.exe
  C:\Windows\System\FkkkEpK.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\hJSogda.exe
  C:\Windows\System\hJSogda.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\LWkHXAT.exe
  C:\Windows\System\LWkHXAT.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\mDdrLqa.exe
  C:\Windows\System\mDdrLqa.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\TflgQXc.exe
  C:\Windows\System\TflgQXc.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\qGAfXFi.exe
  C:\Windows\System\qGAfXFi.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\NaAikyW.exe
  C:\Windows\System\NaAikyW.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\NkdcTpi.exe
  C:\Windows\System\NkdcTpi.exe
  2⤵
  PID:2888
- C:\Windows\System\vWpxTxo.exe
  C:\Windows\System\vWpxTxo.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\pyyKpdW.exe
  C:\Windows\System\pyyKpdW.exe
  2⤵
  PID:1760
- C:\Windows\System\XhhgwBM.exe
  C:\Windows\System\XhhgwBM.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\HlTxFMp.exe
  C:\Windows\System\HlTxFMp.exe
  2⤵
  PID:1724
- C:\Windows\System\uZwAOfv.exe
  C:\Windows\System\uZwAOfv.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\uOXqkYR.exe
  C:\Windows\System\uOXqkYR.exe
  2⤵
  PID:1268
- C:\Windows\System\BuHnacW.exe
  C:\Windows\System\BuHnacW.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\WOSePHa.exe
  C:\Windows\System\WOSePHa.exe
  2⤵
  PID:1572
- C:\Windows\System\UzrdiMe.exe
  C:\Windows\System\UzrdiMe.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\yEUuGHj.exe
  C:\Windows\System\yEUuGHj.exe
  2⤵
  PID:784
- C:\Windows\System\aEMNDAO.exe
  C:\Windows\System\aEMNDAO.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\jxYwMhL.exe
  C:\Windows\System\jxYwMhL.exe
  2⤵
  PID:2184
- C:\Windows\System\UKetpIQ.exe
  C:\Windows\System\UKetpIQ.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\gGeiXHc.exe
  C:\Windows\System\gGeiXHc.exe
  2⤵
  PID:1596
- C:\Windows\System\XUtxsWW.exe
  C:\Windows\System\XUtxsWW.exe
  2⤵
  - Executes dropped EXE
  PID:1536
- C:\Windows\System\hhmPwRN.exe
  C:\Windows\System\hhmPwRN.exe
  2⤵
  PID:1912
- C:\Windows\System\jMaeKrA.exe
  C:\Windows\System\jMaeKrA.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\EjKenUQ.exe
  C:\Windows\System\EjKenUQ.exe
  2⤵
  PID:1288
- C:\Windows\System\EFJcYDn.exe
  C:\Windows\System\EFJcYDn.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\YWKdrul.exe
  C:\Windows\System\YWKdrul.exe
  2⤵
  PID:1560
- C:\Windows\System\NWEGEQh.exe
  C:\Windows\System\NWEGEQh.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\yeHZzUj.exe
  C:\Windows\System\yeHZzUj.exe
  2⤵
  PID:1840
- C:\Windows\System\gxXlAGJ.exe
  C:\Windows\System\gxXlAGJ.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\xQerLss.exe
  C:\Windows\System\xQerLss.exe
  2⤵
  PID:1636
- C:\Windows\System\CnUYyRq.exe
  C:\Windows\System\CnUYyRq.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\JBATHMX.exe
  C:\Windows\System\JBATHMX.exe
  2⤵
  PID:2620
- C:\Windows\System\dxPLEar.exe
  C:\Windows\System\dxPLEar.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\ZxaudvU.exe
  C:\Windows\System\ZxaudvU.exe
  2⤵
  PID:2532
- C:\Windows\System\JtfpbrQ.exe
  C:\Windows\System\JtfpbrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\MvrgZbY.exe
  C:\Windows\System\MvrgZbY.exe
  2⤵
  PID:2544
- C:\Windows\System\MKOdRTl.exe
  C:\Windows\System\MKOdRTl.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\YlGwzxU.exe
  C:\Windows\System\YlGwzxU.exe
  2⤵
  PID:2588
- C:\Windows\System\ZBcfaEU.exe
  C:\Windows\System\ZBcfaEU.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\GrXdcli.exe
  C:\Windows\System\GrXdcli.exe
  2⤵
  PID:2172
- C:\Windows\System\TQJSeDn.exe
  C:\Windows\System\TQJSeDn.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\IqwstCx.exe
  C:\Windows\System\IqwstCx.exe
  2⤵
  PID:2724
- C:\Windows\System\MxXfvgb.exe
  C:\Windows\System\MxXfvgb.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\ftHTBAE.exe
  C:\Windows\System\ftHTBAE.exe
  2⤵
  PID:1328
- C:\Windows\System\MTEKmEM.exe
  C:\Windows\System\MTEKmEM.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\dnxkpoy.exe
  C:\Windows\System\dnxkpoy.exe
  2⤵
  PID:392
- C:\Windows\System\qJfuPIM.exe
  C:\Windows\System\qJfuPIM.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\npTFbDU.exe
  C:\Windows\System\npTFbDU.exe
  2⤵
  PID:3216
- C:\Windows\System\mfIgIyq.exe
  C:\Windows\System\mfIgIyq.exe
  2⤵
  PID:3324
- C:\Windows\System\oIlZSnp.exe
  C:\Windows\System\oIlZSnp.exe
  2⤵
  PID:3344
- C:\Windows\System\ZqbnAOn.exe
  C:\Windows\System\ZqbnAOn.exe
  2⤵
  PID:3364
- C:\Windows\System\HhHLwmr.exe
  C:\Windows\System\HhHLwmr.exe
  2⤵
  PID:3384
- C:\Windows\System\gurfTNb.exe
  C:\Windows\System\gurfTNb.exe
  2⤵
  PID:3404
- C:\Windows\System\YcSsMfF.exe
  C:\Windows\System\YcSsMfF.exe
  2⤵
  PID:3424
- C:\Windows\System\vwqfpvc.exe
  C:\Windows\System\vwqfpvc.exe
  2⤵
  PID:3444
- C:\Windows\System\XEBsJYh.exe
  C:\Windows\System\XEBsJYh.exe
  2⤵
  PID:3464
- C:\Windows\System\RBarQfr.exe
  C:\Windows\System\RBarQfr.exe
  2⤵
  PID:3484
- C:\Windows\System\fWeQOew.exe
  C:\Windows\System\fWeQOew.exe
  2⤵
  PID:3504
- C:\Windows\System\RbBbUrG.exe
  C:\Windows\System\RbBbUrG.exe
  2⤵
  PID:3520
- C:\Windows\System\KibVhvi.exe
  C:\Windows\System\KibVhvi.exe
  2⤵
  PID:3536
- C:\Windows\System\YCQWXsY.exe
  C:\Windows\System\YCQWXsY.exe
  2⤵
  PID:3560
- C:\Windows\System\JenCjSc.exe
  C:\Windows\System\JenCjSc.exe
  2⤵
  PID:3580
- C:\Windows\System\vJseXkw.exe
  C:\Windows\System\vJseXkw.exe
  2⤵
  PID:3604
- C:\Windows\System\hgAMYnh.exe
  C:\Windows\System\hgAMYnh.exe
  2⤵
  PID:3620
- C:\Windows\System\GPdkvbb.exe
  C:\Windows\System\GPdkvbb.exe
  2⤵
  PID:3636
- C:\Windows\System\jxyJBtY.exe
  C:\Windows\System\jxyJBtY.exe
  2⤵
  PID:3656
- C:\Windows\System\ojiptUa.exe
  C:\Windows\System\ojiptUa.exe
  2⤵
  PID:3672
- C:\Windows\System\yJICkla.exe
  C:\Windows\System\yJICkla.exe
  2⤵
  PID:3688
- C:\Windows\System\lRNlhDb.exe
  C:\Windows\System\lRNlhDb.exe
  2⤵
  PID:3708
- C:\Windows\System\VEUgexy.exe
  C:\Windows\System\VEUgexy.exe
  2⤵
  PID:3724
- C:\Windows\System\grhEWyd.exe
  C:\Windows\System\grhEWyd.exe
  2⤵
  PID:3740
- C:\Windows\System\LRNDZmw.exe
  C:\Windows\System\LRNDZmw.exe
  2⤵
  PID:3760
- C:\Windows\System\EdOQzzK.exe
  C:\Windows\System\EdOQzzK.exe
  2⤵
  PID:3776
- C:\Windows\System\TLnunoW.exe
  C:\Windows\System\TLnunoW.exe
  2⤵
  PID:3792
- C:\Windows\System\DFfKUPv.exe
  C:\Windows\System\DFfKUPv.exe
  2⤵
  PID:3808
- C:\Windows\System\fwyINDa.exe
  C:\Windows\System\fwyINDa.exe
  2⤵
  PID:3824
- C:\Windows\System\htwFLGW.exe
  C:\Windows\System\htwFLGW.exe
  2⤵
  PID:3840
- C:\Windows\System\FqWHebl.exe
  C:\Windows\System\FqWHebl.exe
  2⤵
  PID:3856
- C:\Windows\System\rDlOogM.exe
  C:\Windows\System\rDlOogM.exe
  2⤵
  PID:3876
- C:\Windows\System\ZHLlMpc.exe
  C:\Windows\System\ZHLlMpc.exe
  2⤵
  PID:3892
- C:\Windows\System\CqyuPQd.exe
  C:\Windows\System\CqyuPQd.exe
  2⤵
  PID:3912
- C:\Windows\System\fDMVfhr.exe
  C:\Windows\System\fDMVfhr.exe
  2⤵
  PID:3928
- C:\Windows\System\FzHydGv.exe
  C:\Windows\System\FzHydGv.exe
  2⤵
  PID:3984
- C:\Windows\System\HeKODRS.exe
  C:\Windows\System\HeKODRS.exe
  2⤵
  PID:4016
- C:\Windows\System\PQPwDhp.exe
  C:\Windows\System\PQPwDhp.exe
  2⤵
  PID:4052
- C:\Windows\System\HCDvmSA.exe
  C:\Windows\System\HCDvmSA.exe
  2⤵
  PID:4072
- C:\Windows\System\vmBMSFi.exe
  C:\Windows\System\vmBMSFi.exe
  2⤵
  PID:4092
- C:\Windows\System\oPenvDW.exe
  C:\Windows\System\oPenvDW.exe
  2⤵
  PID:868
- C:\Windows\System\RpystKU.exe
  C:\Windows\System\RpystKU.exe
  2⤵
  PID:772
- C:\Windows\System\eMrNxuK.exe
  C:\Windows\System\eMrNxuK.exe
  2⤵
  PID:2312
- C:\Windows\System\YLVJCyy.exe
  C:\Windows\System\YLVJCyy.exe
  2⤵
  PID:1520
- C:\Windows\System\feKlSPb.exe
  C:\Windows\System\feKlSPb.exe
  2⤵
  PID:2456
- C:\Windows\System\arPPKxS.exe
  C:\Windows\System\arPPKxS.exe
  2⤵
  PID:2940
- C:\Windows\System\UgXEVwe.exe
  C:\Windows\System\UgXEVwe.exe
  2⤵
  PID:3012
- C:\Windows\System\xwRyGHm.exe
  C:\Windows\System\xwRyGHm.exe
  2⤵
  PID:3008
- C:\Windows\System\XSUXyNB.exe
  C:\Windows\System\XSUXyNB.exe
  2⤵
  PID:1372
- C:\Windows\System\syByNmA.exe
  C:\Windows\System\syByNmA.exe
  2⤵
  PID:1960
- C:\Windows\System\FWPlLhv.exe
  C:\Windows\System\FWPlLhv.exe
  2⤵
  PID:588
- C:\Windows\System\ilcJRMs.exe
  C:\Windows\System\ilcJRMs.exe
  2⤵
  PID:1748
- C:\Windows\System\NmxrBAW.exe
  C:\Windows\System\NmxrBAW.exe
  2⤵
  PID:1332
- C:\Windows\System\xRtfoqk.exe
  C:\Windows\System\xRtfoqk.exe
  2⤵
  PID:2780
- C:\Windows\System\ohVyTqY.exe
  C:\Windows\System\ohVyTqY.exe
  2⤵
  PID:2792
- C:\Windows\System\hNvIyNa.exe
  C:\Windows\System\hNvIyNa.exe
  2⤵
  PID:1992
- C:\Windows\System\MiLExQG.exe
  C:\Windows\System\MiLExQG.exe
  2⤵
  PID:480
- C:\Windows\System\WWYLYUl.exe
  C:\Windows\System\WWYLYUl.exe
  2⤵
  PID:2520
- C:\Windows\System\hBNRdLY.exe
  C:\Windows\System\hBNRdLY.exe
  2⤵
  PID:2636
- C:\Windows\System\vmRiIHj.exe
  C:\Windows\System\vmRiIHj.exe
  2⤵
  PID:3032
- C:\Windows\System\PxwCiUu.exe
  C:\Windows\System\PxwCiUu.exe
  2⤵
  PID:532
- C:\Windows\System\rAdZPtl.exe
  C:\Windows\System\rAdZPtl.exe
  2⤵
  PID:2680
- C:\Windows\System\mVcqvjt.exe
  C:\Windows\System\mVcqvjt.exe
  2⤵
  PID:2808
- C:\Windows\System\fxSOfhB.exe
  C:\Windows\System\fxSOfhB.exe
  2⤵
  PID:2304
- C:\Windows\System\wWQMFkQ.exe
  C:\Windows\System\wWQMFkQ.exe
  2⤵
  PID:3248
- C:\Windows\System\uVfXsPH.exe
  C:\Windows\System\uVfXsPH.exe
  2⤵
  PID:3264
- C:\Windows\System\DFUARvy.exe
  C:\Windows\System\DFUARvy.exe
  2⤵
  PID:3320
- C:\Windows\System\nfVvqlH.exe
  C:\Windows\System\nfVvqlH.exe
  2⤵
  PID:3336
- C:\Windows\System\ohiPeeQ.exe
  C:\Windows\System\ohiPeeQ.exe
  2⤵
  PID:3372
- C:\Windows\System\UehlXuQ.exe
  C:\Windows\System\UehlXuQ.exe
  2⤵
  PID:2664
- C:\Windows\System\dJTijKO.exe
  C:\Windows\System\dJTijKO.exe
  2⤵
  PID:3376
- C:\Windows\System\KVAnKRi.exe
  C:\Windows\System\KVAnKRi.exe
  2⤵
  PID:3400
- C:\Windows\System\avivVEl.exe
  C:\Windows\System\avivVEl.exe
  2⤵
  PID:3396
- C:\Windows\System\kzhbUQY.exe
  C:\Windows\System\kzhbUQY.exe
  2⤵
  PID:3460
- C:\Windows\System\dFpkKEE.exe
  C:\Windows\System\dFpkKEE.exe
  2⤵
  PID:3500
- C:\Windows\System\SKJKuQr.exe
  C:\Windows\System\SKJKuQr.exe
  2⤵
  PID:3496
- C:\Windows\System\TRyLoqX.exe
  C:\Windows\System\TRyLoqX.exe
  2⤵
  PID:3572
- C:\Windows\System\iYAeqmt.exe
  C:\Windows\System\iYAeqmt.exe
  2⤵
  PID:3612
- C:\Windows\System\TUqjQhC.exe
  C:\Windows\System\TUqjQhC.exe
  2⤵
  PID:3652
- C:\Windows\System\LaTTtMv.exe
  C:\Windows\System\LaTTtMv.exe
  2⤵
  PID:3748
- C:\Windows\System\srTQyCO.exe
  C:\Windows\System\srTQyCO.exe
  2⤵
  PID:3476
- C:\Windows\System\pwfpZQJ.exe
  C:\Windows\System\pwfpZQJ.exe
  2⤵
  PID:3556
- C:\Windows\System\CFfJLAg.exe
  C:\Windows\System\CFfJLAg.exe
  2⤵
  PID:2836
- C:\Windows\System\pPXLcWM.exe
  C:\Windows\System\pPXLcWM.exe
  2⤵
  PID:3848
- C:\Windows\System\HFcAmMb.exe
  C:\Windows\System\HFcAmMb.exe
  2⤵
  PID:3920
- C:\Windows\System\bdSOxsR.exe
  C:\Windows\System\bdSOxsR.exe
  2⤵
  PID:3700
- C:\Windows\System\SzwJsCA.exe
  C:\Windows\System\SzwJsCA.exe
  2⤵
  PID:3736
- C:\Windows\System\kWAuNHX.exe
  C:\Windows\System\kWAuNHX.exe
  2⤵
  PID:4004
- C:\Windows\System\hLFNniW.exe
  C:\Windows\System\hLFNniW.exe
  2⤵
  PID:2608
- C:\Windows\System\FALdgaM.exe
  C:\Windows\System\FALdgaM.exe
  2⤵
  PID:3996
- C:\Windows\System\hfOTdrn.exe
  C:\Windows\System\hfOTdrn.exe
  2⤵
  PID:3592
- C:\Windows\System\IrPRQlv.exe
  C:\Windows\System\IrPRQlv.exe
  2⤵
  PID:3596
- C:\Windows\System\PbvdJus.exe
  C:\Windows\System\PbvdJus.exe
  2⤵
  PID:3900
- C:\Windows\System\rRhahLP.exe
  C:\Windows\System\rRhahLP.exe
  2⤵
  PID:3936
- C:\Windows\System\RlLRjFI.exe
  C:\Windows\System\RlLRjFI.exe
  2⤵
  PID:3952
- C:\Windows\System\JgytTbP.exe
  C:\Windows\System\JgytTbP.exe
  2⤵
  PID:3968
- C:\Windows\System\tiSQBwc.exe
  C:\Windows\System\tiSQBwc.exe
  2⤵
  PID:4028
- C:\Windows\System\qIhDoeA.exe
  C:\Windows\System\qIhDoeA.exe
  2⤵
  PID:3836
- C:\Windows\System\RDzprYo.exe
  C:\Windows\System\RDzprYo.exe
  2⤵
  PID:4036
- C:\Windows\System\rcGcfSI.exe
  C:\Windows\System\rcGcfSI.exe
  2⤵
  PID:4060
- C:\Windows\System\dvWZvWt.exe
  C:\Windows\System\dvWZvWt.exe
  2⤵
  PID:4080
- C:\Windows\System\kRjCFgB.exe
  C:\Windows\System\kRjCFgB.exe
  2⤵
  PID:2124
- C:\Windows\System\IzAsjOG.exe
  C:\Windows\System\IzAsjOG.exe
  2⤵
  PID:676
- C:\Windows\System\RSyKrzh.exe
  C:\Windows\System\RSyKrzh.exe
  2⤵
  PID:2308
- C:\Windows\System\TuThsAk.exe
  C:\Windows\System\TuThsAk.exe
  2⤵
  PID:2612
- C:\Windows\System\qwgcpCx.exe
  C:\Windows\System\qwgcpCx.exe
  2⤵
  PID:2424
- C:\Windows\System\VUctnNw.exe
  C:\Windows\System\VUctnNw.exe
  2⤵
  PID:2332
- C:\Windows\System\vgMRnaa.exe
  C:\Windows\System\vgMRnaa.exe
  2⤵
  PID:1196
- C:\Windows\System\bjIPOVw.exe
  C:\Windows\System\bjIPOVw.exe
  2⤵
  PID:2288
- C:\Windows\System\voePlrN.exe
  C:\Windows\System\voePlrN.exe
  2⤵
  PID:1696
- C:\Windows\System\YrUxdOv.exe
  C:\Windows\System\YrUxdOv.exe
  2⤵
  PID:1676
- C:\Windows\System\ubyGHHI.exe
  C:\Windows\System\ubyGHHI.exe
  2⤵
  PID:1680
- C:\Windows\System\lDuMvLa.exe
  C:\Windows\System\lDuMvLa.exe
  2⤵
  PID:1540
- C:\Windows\System\ALPpUDo.exe
  C:\Windows\System\ALPpUDo.exe
  2⤵
  PID:1416
- C:\Windows\System\bNzLRAw.exe
  C:\Windows\System\bNzLRAw.exe
  2⤵
  PID:2400
- C:\Windows\System\DgSlBvX.exe
  C:\Windows\System\DgSlBvX.exe
  2⤵
  PID:3628
- C:\Windows\System\wbCUJyl.exe
  C:\Windows\System\wbCUJyl.exe
  2⤵
  PID:3420
- C:\Windows\System\JibTapd.exe
  C:\Windows\System\JibTapd.exe
  2⤵
  PID:3544
- C:\Windows\System\tcyZlhw.exe
  C:\Windows\System\tcyZlhw.exe
  2⤵
  PID:4048
- C:\Windows\System\ErePZVw.exe
  C:\Windows\System\ErePZVw.exe
  2⤵
  PID:2496
- C:\Windows\System\ecXMckF.exe
  C:\Windows\System\ecXMckF.exe
  2⤵
  PID:2736
- C:\Windows\System\RXAsIaj.exe
  C:\Windows\System\RXAsIaj.exe
  2⤵
  PID:3568
- C:\Windows\System\LaqBycg.exe
  C:\Windows\System\LaqBycg.exe
  2⤵
  PID:3480
- C:\Windows\System\LKbREMC.exe
  C:\Windows\System\LKbREMC.exe
  2⤵
  PID:3888
- C:\Windows\System\KvmMnnY.exe
  C:\Windows\System\KvmMnnY.exe
  2⤵
  PID:3668
- C:\Windows\System\QbNHtCX.exe
  C:\Windows\System\QbNHtCX.exe
  2⤵
  PID:3940
- C:\Windows\System\ceIcDgb.exe
  C:\Windows\System\ceIcDgb.exe
  2⤵
  PID:1732
- C:\Windows\System\qjBUouD.exe
  C:\Windows\System\qjBUouD.exe
  2⤵
  PID:1524
- C:\Windows\System\KuhcEKI.exe
  C:\Windows\System\KuhcEKI.exe
  2⤵
  PID:2704
- C:\Windows\System\vSfWvOP.exe
  C:\Windows\System\vSfWvOP.exe
  2⤵
  PID:348
- C:\Windows\System\AYDJRmj.exe
  C:\Windows\System\AYDJRmj.exe
  2⤵
  PID:2976
- C:\Windows\System\hLpDBNa.exe
  C:\Windows\System\hLpDBNa.exe
  2⤵
  PID:640
- C:\Windows\System\yjLIwVt.exe
  C:\Windows\System\yjLIwVt.exe
  2⤵
  PID:2388
- C:\Windows\System\jxDLMTb.exe
  C:\Windows\System\jxDLMTb.exe
  2⤵
  PID:2768
- C:\Windows\System\bZpCFSy.exe
  C:\Windows\System\bZpCFSy.exe
  2⤵
  PID:3236
- C:\Windows\System\wgtlWre.exe
  C:\Windows\System\wgtlWre.exe
  2⤵
  PID:1580
- C:\Windows\System\WLroYmk.exe
  C:\Windows\System\WLroYmk.exe
  2⤵
  PID:3720
- C:\Windows\System\LcWQDTI.exe
  C:\Windows\System\LcWQDTI.exe
  2⤵
  PID:3696
- C:\Windows\System\RNsDihs.exe
  C:\Windows\System\RNsDihs.exe
  2⤵
  PID:1700
- C:\Windows\System\TNyWivX.exe
  C:\Windows\System\TNyWivX.exe
  2⤵
  PID:1744
- C:\Windows\System\ilYrAcd.exe
  C:\Windows\System\ilYrAcd.exe
  2⤵
  PID:2816
- C:\Windows\System\iDnshoF.exe
  C:\Windows\System\iDnshoF.exe
  2⤵
  PID:2992
- C:\Windows\System\YNmZzme.exe
  C:\Windows\System\YNmZzme.exe
  2⤵
  PID:2956
- C:\Windows\System\SuKOUCL.exe
  C:\Windows\System\SuKOUCL.exe
  2⤵
  PID:1368
- C:\Windows\System\MBcmybf.exe
  C:\Windows\System\MBcmybf.exe
  2⤵
  PID:3816
- C:\Windows\System\IoeCByv.exe
  C:\Windows\System\IoeCByv.exe
  2⤵
  PID:1984
- C:\Windows\System\AimAuaJ.exe
  C:\Windows\System\AimAuaJ.exe
  2⤵
  PID:2756
- C:\Windows\System\COqyEad.exe
  C:\Windows\System\COqyEad.exe
  2⤵
  PID:3028
- C:\Windows\System\LabAEYF.exe
  C:\Windows\System\LabAEYF.exe
  2⤵
  PID:860
- C:\Windows\System\jyRumYI.exe
  C:\Windows\System\jyRumYI.exe
  2⤵
  PID:2908
- C:\Windows\System\GLurHSl.exe
  C:\Windows\System\GLurHSl.exe
  2⤵
  PID:3664
- C:\Windows\System\WPeOYAu.exe
  C:\Windows\System\WPeOYAu.exe
  2⤵
  PID:2708
- C:\Windows\System\ElGTDGH.exe
  C:\Windows\System\ElGTDGH.exe
  2⤵
  PID:1208
- C:\Windows\System\eryPHbh.exe
  C:\Windows\System\eryPHbh.exe
  2⤵
  PID:3016
- C:\Windows\System\xRoiHKm.exe
  C:\Windows\System\xRoiHKm.exe
  2⤵
  PID:2824
- C:\Windows\System\yOcIKch.exe
  C:\Windows\System\yOcIKch.exe
  2⤵
  PID:2820
- C:\Windows\System\osUUepT.exe
  C:\Windows\System\osUUepT.exe
  2⤵
  PID:648
- C:\Windows\System\YGcJjsB.exe
  C:\Windows\System\YGcJjsB.exe
  2⤵
  PID:3228
- C:\Windows\System\IoWMjcZ.exe
  C:\Windows\System\IoWMjcZ.exe
  2⤵
  PID:3244
- C:\Windows\System\hXbzeyA.exe
  C:\Windows\System\hXbzeyA.exe
  2⤵
  PID:1976
- C:\Windows\System\AIKMUGA.exe
  C:\Windows\System\AIKMUGA.exe
  2⤵
  PID:268
- C:\Windows\System\nZNIMSW.exe
  C:\Windows\System\nZNIMSW.exe
  2⤵
  PID:2136
- C:\Windows\System\AxJIiHT.exe
  C:\Windows\System\AxJIiHT.exe
  2⤵
  PID:1432
- C:\Windows\System\VIGXEfV.exe
  C:\Windows\System\VIGXEfV.exe
  2⤵
  PID:1364
- C:\Windows\System\oShGPbt.exe
  C:\Windows\System\oShGPbt.exe
  2⤵
  PID:2380
- C:\Windows\System\QciXAKq.exe
  C:\Windows\System\QciXAKq.exe
  2⤵
  PID:2932
- C:\Windows\System\KbTyauI.exe
  C:\Windows\System\KbTyauI.exe
  2⤵
  PID:3492
- C:\Windows\System\qznOnIZ.exe
  C:\Windows\System\qznOnIZ.exe
  2⤵
  PID:3884
- C:\Windows\System\bhWgEic.exe
  C:\Windows\System\bhWgEic.exe
  2⤵
  PID:3048
- C:\Windows\System\XrLBXjl.exe
  C:\Windows\System\XrLBXjl.exe
  2⤵
  PID:4064
- C:\Windows\System\CFYadck.exe
  C:\Windows\System\CFYadck.exe
  2⤵
  PID:1228
- C:\Windows\System\Gsbyisu.exe
  C:\Windows\System\Gsbyisu.exe
  2⤵
  PID:2640
- C:\Windows\System\FLOcaSu.exe
  C:\Windows\System\FLOcaSu.exe
  2⤵
  PID:2192
- C:\Windows\System\WuRiEgh.exe
  C:\Windows\System\WuRiEgh.exe
  2⤵
  PID:2584
- C:\Windows\System\nqjbTmX.exe
  C:\Windows\System\nqjbTmX.exe
  2⤵
  PID:3532
- C:\Windows\System\aHWAwAC.exe
  C:\Windows\System\aHWAwAC.exe
  2⤵
  PID:3768
- C:\Windows\System\iDchTXG.exe
  C:\Windows\System\iDchTXG.exe
  2⤵
  PID:4012
- C:\Windows\System\PvnEpGz.exe
  C:\Windows\System\PvnEpGz.exe
  2⤵
  PID:2972
- C:\Windows\System\shKHAel.exe
  C:\Windows\System\shKHAel.exe
  2⤵
  PID:2488
- C:\Windows\System\sQyOPcy.exe
  C:\Windows\System\sQyOPcy.exe
  2⤵
  PID:3240
- C:\Windows\System\JpnUhjO.exe
  C:\Windows\System\JpnUhjO.exe
  2⤵
  PID:2840
- C:\Windows\System\qFEXFTm.exe
  C:\Windows\System\qFEXFTm.exe
  2⤵
  PID:4112
- C:\Windows\System\avcRadb.exe
  C:\Windows\System\avcRadb.exe
  2⤵
  PID:4128
- C:\Windows\System\JvUcAOA.exe
  C:\Windows\System\JvUcAOA.exe
  2⤵
  PID:4144
- C:\Windows\System\JKBxdeX.exe
  C:\Windows\System\JKBxdeX.exe
  2⤵
  PID:4160
- C:\Windows\System\wMqeaWH.exe
  C:\Windows\System\wMqeaWH.exe
  2⤵
  PID:4176
- C:\Windows\System\MlpLOBi.exe
  C:\Windows\System\MlpLOBi.exe
  2⤵
  PID:4268
- C:\Windows\System\qbfktWI.exe
  C:\Windows\System\qbfktWI.exe
  2⤵
  PID:4284
- C:\Windows\System\ObGVMeP.exe
  C:\Windows\System\ObGVMeP.exe
  2⤵
  PID:4300
- C:\Windows\System\zXAIfDm.exe
  C:\Windows\System\zXAIfDm.exe
  2⤵
  PID:4316
- C:\Windows\System\RjZHWyc.exe
  C:\Windows\System\RjZHWyc.exe
  2⤵
  PID:4332
- C:\Windows\System\TPTukiC.exe
  C:\Windows\System\TPTukiC.exe
  2⤵
  PID:4348
- C:\Windows\System\wfMxyvf.exe
  C:\Windows\System\wfMxyvf.exe
  2⤵
  PID:4364
- C:\Windows\System\DokenWu.exe
  C:\Windows\System\DokenWu.exe
  2⤵
  PID:4404
- C:\Windows\System\jZpJMVi.exe
  C:\Windows\System\jZpJMVi.exe
  2⤵
  PID:4420
- C:\Windows\System\cHJgbzB.exe
  C:\Windows\System\cHJgbzB.exe
  2⤵
  PID:4436
- C:\Windows\System\vfzBmsA.exe
  C:\Windows\System\vfzBmsA.exe
  2⤵
  PID:4452
- C:\Windows\System\oZQftLb.exe
  C:\Windows\System\oZQftLb.exe
  2⤵
  PID:4468
- C:\Windows\System\BFBVdLk.exe
  C:\Windows\System\BFBVdLk.exe
  2⤵
  PID:4484
- C:\Windows\System\HsxXyoT.exe
  C:\Windows\System\HsxXyoT.exe
  2⤵
  PID:4504
- C:\Windows\System\hmaFdtm.exe
  C:\Windows\System\hmaFdtm.exe
  2⤵
  PID:4520
- C:\Windows\System\XJYNkvD.exe
  C:\Windows\System\XJYNkvD.exe
  2⤵
  PID:4536
- C:\Windows\System\kPFEDNS.exe
  C:\Windows\System\kPFEDNS.exe
  2⤵
  PID:4552
- C:\Windows\System\VzMvUEa.exe
  C:\Windows\System\VzMvUEa.exe
  2⤵
  PID:4568
- C:\Windows\System\PMxhARE.exe
  C:\Windows\System\PMxhARE.exe
  2⤵
  PID:4584
- C:\Windows\System\MUxEMdp.exe
  C:\Windows\System\MUxEMdp.exe
  2⤵
  PID:4604
- C:\Windows\System\eiPLwJu.exe
  C:\Windows\System\eiPLwJu.exe
  2⤵
  PID:4620
- C:\Windows\System\eLPMyBB.exe
  C:\Windows\System\eLPMyBB.exe
  2⤵
  PID:4640
- C:\Windows\System\UrVnNeS.exe
  C:\Windows\System\UrVnNeS.exe
  2⤵
  PID:4660
- C:\Windows\System\wtSAXWM.exe
  C:\Windows\System\wtSAXWM.exe
  2⤵
  PID:4676
- C:\Windows\System\bRxSEIz.exe
  C:\Windows\System\bRxSEIz.exe
  2⤵
  PID:4696
- C:\Windows\System\DJOVsfB.exe
  C:\Windows\System\DJOVsfB.exe
  2⤵
  PID:4752
- C:\Windows\System\SNCPDKc.exe
  C:\Windows\System\SNCPDKc.exe
  2⤵
  PID:4780
- C:\Windows\System\KiUxzMQ.exe
  C:\Windows\System\KiUxzMQ.exe
  2⤵
  PID:4804
- C:\Windows\System\fCEhdDK.exe
  C:\Windows\System\fCEhdDK.exe
  2⤵
  PID:4828
- C:\Windows\System\WajtAke.exe
  C:\Windows\System\WajtAke.exe
  2⤵
  PID:4844
- C:\Windows\System\inwimJS.exe
  C:\Windows\System\inwimJS.exe
  2⤵
  PID:4864
- C:\Windows\System\YmyqFGR.exe
  C:\Windows\System\YmyqFGR.exe
  2⤵
  PID:4880
- C:\Windows\System\voBoRNK.exe
  C:\Windows\System\voBoRNK.exe
  2⤵
  PID:4912
- C:\Windows\System\XISgjBn.exe
  C:\Windows\System\XISgjBn.exe
  2⤵
  PID:4932
- C:\Windows\System\oLULXcD.exe
  C:\Windows\System\oLULXcD.exe
  2⤵
  PID:4952
- C:\Windows\System\GtLgJwt.exe
  C:\Windows\System\GtLgJwt.exe
  2⤵
  PID:4972
- C:\Windows\System\oHdDEZG.exe
  C:\Windows\System\oHdDEZG.exe
  2⤵
  PID:4992
- C:\Windows\System\rvioMwB.exe
  C:\Windows\System\rvioMwB.exe
  2⤵
  PID:5012
- C:\Windows\System\ECoFwNa.exe
  C:\Windows\System\ECoFwNa.exe
  2⤵
  PID:5028
- C:\Windows\System\zCWjdrW.exe
  C:\Windows\System\zCWjdrW.exe
  2⤵
  PID:5056
- C:\Windows\System\TkvFWqi.exe
  C:\Windows\System\TkvFWqi.exe
  2⤵
  PID:5072
- C:\Windows\System\osfGWmx.exe
  C:\Windows\System\osfGWmx.exe
  2⤵
  PID:5088
- C:\Windows\System\CbftAgL.exe
  C:\Windows\System\CbftAgL.exe
  2⤵
  PID:5108
- C:\Windows\System\iFMqvZd.exe
  C:\Windows\System\iFMqvZd.exe
  2⤵
  PID:2800
- C:\Windows\System\QzfwvtQ.exe
  C:\Windows\System\QzfwvtQ.exe
  2⤵
  PID:2432
- C:\Windows\System\wCjsYJP.exe
  C:\Windows\System\wCjsYJP.exe
  2⤵
  PID:1980
- C:\Windows\System\KcdjeiY.exe
  C:\Windows\System\KcdjeiY.exe
  2⤵
  PID:592
- C:\Windows\System\BirfuCn.exe
  C:\Windows\System\BirfuCn.exe
  2⤵
  PID:4120
- C:\Windows\System\GEbXbyA.exe
  C:\Windows\System\GEbXbyA.exe
  2⤵
  PID:3964
- C:\Windows\System\ucnPznk.exe
  C:\Windows\System\ucnPznk.exe
  2⤵
  PID:1736
- C:\Windows\System\CcyEicx.exe
  C:\Windows\System\CcyEicx.exe
  2⤵
  PID:4104
- C:\Windows\System\zxWszqh.exe
  C:\Windows\System\zxWszqh.exe
  2⤵
  PID:4152
- C:\Windows\System\zQCVnbj.exe
  C:\Windows\System\zQCVnbj.exe
  2⤵
  PID:4192
- C:\Windows\System\DlFpcEu.exe
  C:\Windows\System\DlFpcEu.exe
  2⤵
  PID:4216
- C:\Windows\System\cPwTwot.exe
  C:\Windows\System\cPwTwot.exe
  2⤵
  PID:4236
- C:\Windows\System\PHrlRra.exe
  C:\Windows\System\PHrlRra.exe
  2⤵
  PID:4252
- C:\Windows\System\qjMyPPk.exe
  C:\Windows\System\qjMyPPk.exe
  2⤵
  PID:4276
- C:\Windows\System\iyafXmM.exe
  C:\Windows\System\iyafXmM.exe
  2⤵
  PID:4328
- C:\Windows\System\UVXStbU.exe
  C:\Windows\System\UVXStbU.exe
  2⤵
  PID:4376
- C:\Windows\System\eRBIklx.exe
  C:\Windows\System\eRBIklx.exe
  2⤵
  PID:4292
- C:\Windows\System\vevhMXK.exe
  C:\Windows\System\vevhMXK.exe
  2⤵
  PID:4380
- C:\Windows\System\IocJsWg.exe
  C:\Windows\System\IocJsWg.exe
  2⤵
  PID:4400
- C:\Windows\System\EonnpFQ.exe
  C:\Windows\System\EonnpFQ.exe
  2⤵
  PID:4460
- C:\Windows\System\oZEVuIH.exe
  C:\Windows\System\oZEVuIH.exe
  2⤵
  PID:4500
- C:\Windows\System\zRMQmNA.exe
  C:\Windows\System\zRMQmNA.exe
  2⤵
  PID:4564
- C:\Windows\System\VKbltZm.exe
  C:\Windows\System\VKbltZm.exe
  2⤵
  PID:4412
- C:\Windows\System\lAxBlwI.exe
  C:\Windows\System\lAxBlwI.exe
  2⤵
  PID:4476
- C:\Windows\System\ZxSEdPC.exe
  C:\Windows\System\ZxSEdPC.exe
  2⤵
  PID:4544
- C:\Windows\System\XoDHKtU.exe
  C:\Windows\System\XoDHKtU.exe
  2⤵
  PID:4628
- C:\Windows\System\KQgGRay.exe
  C:\Windows\System\KQgGRay.exe
  2⤵
  PID:4656
- C:\Windows\System\SmFmeFJ.exe
  C:\Windows\System\SmFmeFJ.exe
  2⤵
  PID:4672
- C:\Windows\System\cYWaydV.exe
  C:\Windows\System\cYWaydV.exe
  2⤵
  PID:4716
- C:\Windows\System\kbyoUja.exe
  C:\Windows\System\kbyoUja.exe
  2⤵
  PID:4720
- C:\Windows\System\OfHyqbq.exe
  C:\Windows\System\OfHyqbq.exe
  2⤵
  PID:4748
- C:\Windows\System\mITUoXE.exe
  C:\Windows\System\mITUoXE.exe
  2⤵
  PID:4760
- C:\Windows\System\zaQBGfc.exe
  C:\Windows\System\zaQBGfc.exe
  2⤵
  PID:4796
- C:\Windows\System\zJlaTSu.exe
  C:\Windows\System\zJlaTSu.exe
  2⤵
  PID:4800
- C:\Windows\System\VVJnbJp.exe
  C:\Windows\System\VVJnbJp.exe
  2⤵
  PID:4824
- C:\Windows\System\dceaQyv.exe
  C:\Windows\System\dceaQyv.exe
  2⤵
  PID:4888
- C:\Windows\System\umPvDFm.exe
  C:\Windows\System\umPvDFm.exe
  2⤵
  PID:4904
- C:\Windows\System\dDCjPmV.exe
  C:\Windows\System\dDCjPmV.exe
  2⤵
  PID:4940
- C:\Windows\System\SZXJcGc.exe
  C:\Windows\System\SZXJcGc.exe
  2⤵
  PID:4960
- C:\Windows\System\OXlCwur.exe
  C:\Windows\System\OXlCwur.exe
  2⤵
  PID:5036
- C:\Windows\System\gCSrrmm.exe
  C:\Windows\System\gCSrrmm.exe
  2⤵
  PID:4232
- C:\Windows\System\rOdynlR.exe
  C:\Windows\System\rOdynlR.exe
  2⤵
  PID:4516
- C:\Windows\System\ddQFhfT.exe
  C:\Windows\System\ddQFhfT.exe
  2⤵
  PID:2428
- C:\Windows\System\sRziNyR.exe
  C:\Windows\System\sRziNyR.exe
  2⤵
  PID:4560
- C:\Windows\System\fQPXbHg.exe
  C:\Windows\System\fQPXbHg.exe
  2⤵
  PID:2628
- C:\Windows\System\ZCbGntb.exe
  C:\Windows\System\ZCbGntb.exe
  2⤵
  PID:4296
- C:\Windows\System\QvTFVGh.exe
  C:\Windows\System\QvTFVGh.exe
  2⤵
  PID:4392
- C:\Windows\System\yqLxxVB.exe
  C:\Windows\System\yqLxxVB.exe
  2⤵
  PID:4344
- C:\Windows\System\inmqsIB.exe
  C:\Windows\System\inmqsIB.exe
  2⤵
  PID:4684
- C:\Windows\System\kkwrEhC.exe
  C:\Windows\System\kkwrEhC.exe
  2⤵
  PID:4840
- C:\Windows\System\UezbIzz.exe
  C:\Windows\System\UezbIzz.exe
  2⤵
  PID:5000
- C:\Windows\System\BdvWypN.exe
  C:\Windows\System\BdvWypN.exe
  2⤵
  PID:4948
- C:\Windows\System\lVYJUTd.exe
  C:\Windows\System\lVYJUTd.exe
  2⤵
  PID:4792
- C:\Windows\System\bJWEYrv.exe
  C:\Windows\System\bJWEYrv.exe
  2⤵
  PID:4816
- C:\Windows\System\xiyxCfs.exe
  C:\Windows\System\xiyxCfs.exe
  2⤵
  PID:4896
- C:\Windows\System\BDeLgik.exe
  C:\Windows\System\BDeLgik.exe
  2⤵
  PID:4788
- C:\Windows\System\XWBcHQd.exe
  C:\Windows\System\XWBcHQd.exe
  2⤵
  PID:4260
- C:\Windows\System\fJtrULe.exe
  C:\Windows\System\fJtrULe.exe
  2⤵
  PID:5044
- C:\Windows\System\rlAfTmA.exe
  C:\Windows\System\rlAfTmA.exe
  2⤵
  PID:5100
- C:\Windows\System\gcLPvWI.exe
  C:\Windows\System\gcLPvWI.exe
  2⤵
  PID:3272
- C:\Windows\System\UnxhFqy.exe
  C:\Windows\System\UnxhFqy.exe
  2⤵
  PID:2128
- C:\Windows\System\bFPRuUj.exe
  C:\Windows\System\bFPRuUj.exe
  2⤵
  PID:3868
- C:\Windows\System\GjBaLyo.exe
  C:\Windows\System\GjBaLyo.exe
  2⤵
  PID:4168
- C:\Windows\System\upYYoYF.exe
  C:\Windows\System\upYYoYF.exe
  2⤵
  PID:2804
- C:\Windows\System\OnqsuyA.exe
  C:\Windows\System\OnqsuyA.exe
  2⤵
  PID:4908
- C:\Windows\System\iTYjiRH.exe
  C:\Windows\System\iTYjiRH.exe
  2⤵
  PID:4428
- C:\Windows\System\lCieoCe.exe
  C:\Windows\System\lCieoCe.exe
  2⤵
  PID:4856
- C:\Windows\System\yWOnOQT.exe
  C:\Windows\System\yWOnOQT.exe
  2⤵
  PID:5024
- C:\Windows\System\KtJZoLJ.exe
  C:\Windows\System\KtJZoLJ.exe
  2⤵
  PID:2476
- C:\Windows\System\UYNOicZ.exe
  C:\Windows\System\UYNOicZ.exe
  2⤵
  PID:4172
- C:\Windows\System\OkhpeoW.exe
  C:\Windows\System\OkhpeoW.exe
  2⤵
  PID:4492
- C:\Windows\System\QaOvGVK.exe
  C:\Windows\System\QaOvGVK.exe
  2⤵
  PID:4188
- C:\Windows\System\GzThmur.exe
  C:\Windows\System\GzThmur.exe
  2⤵
  PID:4388
- C:\Windows\System\nznItOu.exe
  C:\Windows\System\nznItOu.exe
  2⤵
  PID:4596
- C:\Windows\System\fYrRxgD.exe
  C:\Windows\System\fYrRxgD.exe
  2⤵
  PID:4496
- C:\Windows\System\aalKYLn.exe
  C:\Windows\System\aalKYLn.exe
  2⤵
  PID:4648
- C:\Windows\System\CHhuCRo.exe
  C:\Windows\System\CHhuCRo.exe
  2⤵
  PID:4244
- C:\Windows\System\LaVLxVA.exe
  C:\Windows\System\LaVLxVA.exe
  2⤵
  PID:4740
- C:\Windows\System\PFfZlih.exe
  C:\Windows\System\PFfZlih.exe
  2⤵
  PID:5104
- C:\Windows\System\OXCLSbv.exe
  C:\Windows\System\OXCLSbv.exe
  2⤵
  PID:2068
- C:\Windows\System\Hrwhnmx.exe
  C:\Windows\System\Hrwhnmx.exe
  2⤵
  PID:4836
- C:\Windows\System\UpTCNSr.exe
  C:\Windows\System\UpTCNSr.exe
  2⤵
  PID:4576
- C:\Windows\System\FLogfJy.exe
  C:\Windows\System\FLogfJy.exe
  2⤵
  PID:4200
- C:\Windows\System\KNHdSGR.exe
  C:\Windows\System\KNHdSGR.exe
  2⤵
  PID:5084
- C:\Windows\System\floYFjy.exe
  C:\Windows\System\floYFjy.exe
  2⤵
  PID:4712
- C:\Windows\System\RnakPZg.exe
  C:\Windows\System\RnakPZg.exe
  2⤵
  PID:5124
- C:\Windows\System\VKdKmnG.exe
  C:\Windows\System\VKdKmnG.exe
  2⤵
  PID:5140
- C:\Windows\System\GbYDeqe.exe
  C:\Windows\System\GbYDeqe.exe
  2⤵
  PID:5156
- C:\Windows\System\sxwWHDP.exe
  C:\Windows\System\sxwWHDP.exe
  2⤵
  PID:5172
- C:\Windows\System\NAqbVbc.exe
  C:\Windows\System\NAqbVbc.exe
  2⤵
  PID:5192
- C:\Windows\System\DfMQeqL.exe
  C:\Windows\System\DfMQeqL.exe
  2⤵
  PID:5208
- C:\Windows\System\YeacgQS.exe
  C:\Windows\System\YeacgQS.exe
  2⤵
  PID:5224
- C:\Windows\System\shxwXAu.exe
  C:\Windows\System\shxwXAu.exe
  2⤵
  PID:5240
- C:\Windows\System\zXulMBX.exe
  C:\Windows\System\zXulMBX.exe
  2⤵
  PID:5256
- C:\Windows\System\MiCMgsv.exe
  C:\Windows\System\MiCMgsv.exe
  2⤵
  PID:5276
- C:\Windows\System\KTNyHRS.exe
  C:\Windows\System\KTNyHRS.exe
  2⤵
  PID:5292
- C:\Windows\System\UVvCnmm.exe
  C:\Windows\System\UVvCnmm.exe
  2⤵
  PID:5308
- C:\Windows\System\hMOrYrv.exe
  C:\Windows\System\hMOrYrv.exe
  2⤵
  PID:5324
- C:\Windows\System\YNnJMJY.exe
  C:\Windows\System\YNnJMJY.exe
  2⤵
  PID:5340
- C:\Windows\System\VenEdQH.exe
  C:\Windows\System\VenEdQH.exe
  2⤵
  PID:5356
- C:\Windows\System\JinKzhv.exe
  C:\Windows\System\JinKzhv.exe
  2⤵
  PID:5372
- C:\Windows\System\DslSYFN.exe
  C:\Windows\System\DslSYFN.exe
  2⤵
  PID:5388
- C:\Windows\System\waXbimx.exe
  C:\Windows\System\waXbimx.exe
  2⤵
  PID:5404
- C:\Windows\System\XFIOEHl.exe
  C:\Windows\System\XFIOEHl.exe
  2⤵
  PID:5420
- C:\Windows\System\KyGhqfF.exe
  C:\Windows\System\KyGhqfF.exe
  2⤵
  PID:5436
- C:\Windows\System\RKYdcjQ.exe
  C:\Windows\System\RKYdcjQ.exe
  2⤵
  PID:5452
- C:\Windows\System\OSYUEcH.exe
  C:\Windows\System\OSYUEcH.exe
  2⤵
  PID:5472
- C:\Windows\System\kHrVkov.exe
  C:\Windows\System\kHrVkov.exe
  2⤵
  PID:5488
- C:\Windows\System\rIBWqek.exe
  C:\Windows\System\rIBWqek.exe
  2⤵
  PID:5504
- C:\Windows\System\VkjxySf.exe
  C:\Windows\System\VkjxySf.exe
  2⤵
  PID:5520
- C:\Windows\System\CqRRgzf.exe
  C:\Windows\System\CqRRgzf.exe
  2⤵
  PID:5536
- C:\Windows\System\kcDJkHC.exe
  C:\Windows\System\kcDJkHC.exe
  2⤵
  PID:5552
- C:\Windows\System\ZJnepMv.exe
  C:\Windows\System\ZJnepMv.exe
  2⤵
  PID:5568
- C:\Windows\System\NHpWKpJ.exe
  C:\Windows\System\NHpWKpJ.exe
  2⤵
  PID:5584
- C:\Windows\System\oUbPLba.exe
  C:\Windows\System\oUbPLba.exe
  2⤵
  PID:5600
- C:\Windows\System\gmouVrn.exe
  C:\Windows\System\gmouVrn.exe
  2⤵
  PID:5620
- C:\Windows\System\ubaEhtb.exe
  C:\Windows\System\ubaEhtb.exe
  2⤵
  PID:5636
- C:\Windows\System\xUdLTEW.exe
  C:\Windows\System\xUdLTEW.exe
  2⤵
  PID:5652
- C:\Windows\System\GPuGeIM.exe
  C:\Windows\System\GPuGeIM.exe
  2⤵
  PID:5668
- C:\Windows\System\BVxjuou.exe
  C:\Windows\System\BVxjuou.exe
  2⤵
  PID:5684
- C:\Windows\System\pFWgKYr.exe
  C:\Windows\System\pFWgKYr.exe
  2⤵
  PID:5700
- C:\Windows\System\jHnkWQN.exe
  C:\Windows\System\jHnkWQN.exe
  2⤵
  PID:5716
- C:\Windows\System\xBWFaPo.exe
  C:\Windows\System\xBWFaPo.exe
  2⤵
  PID:5732
- C:\Windows\System\clqFkcR.exe
  C:\Windows\System\clqFkcR.exe
  2⤵
  PID:5748
- C:\Windows\System\tbZVbbx.exe
  C:\Windows\System\tbZVbbx.exe
  2⤵
  PID:5764
- C:\Windows\System\tUHEBiA.exe
  C:\Windows\System\tUHEBiA.exe
  2⤵
  PID:5780
- C:\Windows\System\VOtjCEu.exe
  C:\Windows\System\VOtjCEu.exe
  2⤵
  PID:5796
- C:\Windows\System\QIgVRwZ.exe
  C:\Windows\System\QIgVRwZ.exe
  2⤵
  PID:5812
- C:\Windows\System\YTPclgJ.exe
  C:\Windows\System\YTPclgJ.exe
  2⤵
  PID:5832
- C:\Windows\System\AeyiAGe.exe
  C:\Windows\System\AeyiAGe.exe
  2⤵
  PID:5848
- C:\Windows\System\IIsWdaF.exe
  C:\Windows\System\IIsWdaF.exe
  2⤵
  PID:5864
- C:\Windows\System\OIHjEng.exe
  C:\Windows\System\OIHjEng.exe
  2⤵
  PID:5880
- C:\Windows\System\kPDkgqj.exe
  C:\Windows\System\kPDkgqj.exe
  2⤵
  PID:5896
- C:\Windows\System\HefrpOM.exe
  C:\Windows\System\HefrpOM.exe
  2⤵
  PID:5916
- C:\Windows\System\drQXkHb.exe
  C:\Windows\System\drQXkHb.exe
  2⤵
  PID:5932
- C:\Windows\System\EDdYPJf.exe
  C:\Windows\System\EDdYPJf.exe
  2⤵
  PID:5948
- C:\Windows\System\jezgyTy.exe
  C:\Windows\System\jezgyTy.exe
  2⤵
  PID:5972
- C:\Windows\System\XZNgJjj.exe
  C:\Windows\System\XZNgJjj.exe
  2⤵
  PID:5988
- C:\Windows\System\dFtkeot.exe
  C:\Windows\System\dFtkeot.exe
  2⤵
  PID:6004
- C:\Windows\System\cKDZhoN.exe
  C:\Windows\System\cKDZhoN.exe
  2⤵
  PID:6032
- C:\Windows\System\uacIWVc.exe
  C:\Windows\System\uacIWVc.exe
  2⤵
  PID:6048
- C:\Windows\System\qrlAwVl.exe
  C:\Windows\System\qrlAwVl.exe
  2⤵
  PID:6064
- C:\Windows\System\ljWQNkt.exe
  C:\Windows\System\ljWQNkt.exe
  2⤵
  PID:6080
- C:\Windows\System\huALOff.exe
  C:\Windows\System\huALOff.exe
  2⤵
  PID:6100
- C:\Windows\System\bGSEeYZ.exe
  C:\Windows\System\bGSEeYZ.exe
  2⤵
  PID:6116
- C:\Windows\System\RrNYgnv.exe
  C:\Windows\System\RrNYgnv.exe
  2⤵
  PID:6132
- C:\Windows\System\xPrBXwZ.exe
  C:\Windows\System\xPrBXwZ.exe
  2⤵
  PID:5008
- C:\Windows\System\lCEniJN.exe
  C:\Windows\System\lCEniJN.exe
  2⤵
  PID:3380
- C:\Windows\System\fhdIxsU.exe
  C:\Windows\System\fhdIxsU.exe
  2⤵
  PID:5148
- C:\Windows\System\cGHSrhp.exe
  C:\Windows\System\cGHSrhp.exe
  2⤵
  PID:4860
- C:\Windows\System\pZEzKem.exe
  C:\Windows\System\pZEzKem.exe
  2⤵
  PID:5136
- C:\Windows\System\VQNkbPh.exe
  C:\Windows\System\VQNkbPh.exe
  2⤵
  PID:5200
- C:\Windows\System\KWIueWN.exe
  C:\Windows\System\KWIueWN.exe
  2⤵
  PID:5216
- C:\Windows\System\voWoyyO.exe
  C:\Windows\System\voWoyyO.exe
  2⤵
  PID:5252
- C:\Windows\System\WfXpvei.exe
  C:\Windows\System\WfXpvei.exe
  2⤵
  PID:5264
- C:\Windows\System\GREScdn.exe
  C:\Windows\System\GREScdn.exe
  2⤵
  PID:5268
- C:\Windows\System\RxtdqOf.exe
  C:\Windows\System\RxtdqOf.exe
  2⤵
  PID:5412
- C:\Windows\System\AcVtDzx.exe
  C:\Windows\System\AcVtDzx.exe
  2⤵
  PID:5444
- C:\Windows\System\PZyvAbX.exe
  C:\Windows\System\PZyvAbX.exe
  2⤵
  PID:5364
- C:\Windows\System\lcjyZuE.exe
  C:\Windows\System\lcjyZuE.exe
  2⤵
  PID:5468
- C:\Windows\System\DSxSIqx.exe
  C:\Windows\System\DSxSIqx.exe
  2⤵
  PID:5460
- C:\Windows\System\XLNNqyc.exe
  C:\Windows\System\XLNNqyc.exe
  2⤵
  PID:5500
- C:\Windows\System\WNZLoVk.exe
  C:\Windows\System\WNZLoVk.exe
  2⤵
  PID:5560
- C:\Windows\System\hYtHcMG.exe
  C:\Windows\System\hYtHcMG.exe
  2⤵
  PID:5628
- C:\Windows\System\JqAZLSU.exe
  C:\Windows\System\JqAZLSU.exe
  2⤵
  PID:5516
- C:\Windows\System\APQfYhO.exe
  C:\Windows\System\APQfYhO.exe
  2⤵
  PID:5580
- C:\Windows\System\uDwVLby.exe
  C:\Windows\System\uDwVLby.exe
  2⤵
  PID:5660
- C:\Windows\System\nQbUFgX.exe
  C:\Windows\System\nQbUFgX.exe
  2⤵
  PID:5676
- C:\Windows\System\OYiBdnU.exe
  C:\Windows\System\OYiBdnU.exe
  2⤵
  PID:5776
- C:\Windows\System\fmZlYeB.exe
  C:\Windows\System\fmZlYeB.exe
  2⤵
  PID:5728
- C:\Windows\System\kbbmrqL.exe
  C:\Windows\System\kbbmrqL.exe
  2⤵
  PID:5840
- C:\Windows\System\UjbEYno.exe
  C:\Windows\System\UjbEYno.exe
  2⤵
  PID:5828
- C:\Windows\System\fDteiDa.exe
  C:\Windows\System\fDteiDa.exe
  2⤵
  PID:5940
- C:\Windows\System\yUXTJXc.exe
  C:\Windows\System\yUXTJXc.exe
  2⤵
  PID:5944
- C:\Windows\System\LLMOFRZ.exe
  C:\Windows\System\LLMOFRZ.exe
  2⤵
  PID:5928
- C:\Windows\System\FELoKQx.exe
  C:\Windows\System\FELoKQx.exe
  2⤵
  PID:5968
- C:\Windows\System\dFfQmzH.exe
  C:\Windows\System\dFfQmzH.exe
  2⤵
  PID:5860
- C:\Windows\System\mhLOefD.exe
  C:\Windows\System\mhLOefD.exe
  2⤵
  PID:6072
- C:\Windows\System\PLhqjaV.exe
  C:\Windows\System\PLhqjaV.exe
  2⤵
  PID:6140
- C:\Windows\System\XCZnRip.exe
  C:\Windows\System\XCZnRip.exe
  2⤵
  PID:4532
- C:\Windows\System\oQFRVcU.exe
  C:\Windows\System\oQFRVcU.exe
  2⤵
  PID:1604
- C:\Windows\System\JskJBSJ.exe
  C:\Windows\System\JskJBSJ.exe
  2⤵
  PID:5416
- C:\Windows\System\QAcQBlD.exe
  C:\Windows\System\QAcQBlD.exe
  2⤵
  PID:5400
- C:\Windows\System\HceRrVS.exe
  C:\Windows\System\HceRrVS.exe
  2⤵
  PID:5644
- C:\Windows\System\eVGyELS.exe
  C:\Windows\System\eVGyELS.exe
  2⤵
  PID:5740
- C:\Windows\System\PBeFShD.exe
  C:\Windows\System\PBeFShD.exe
  2⤵
  PID:5872
- C:\Windows\System\qGbVZlZ.exe
  C:\Windows\System\qGbVZlZ.exe
  2⤵
  PID:6000
- C:\Windows\System\JyrogMk.exe
  C:\Windows\System\JyrogMk.exe
  2⤵
  PID:6112
- C:\Windows\System\lHNtvdL.exe
  C:\Windows\System\lHNtvdL.exe
  2⤵
  PID:5336
- C:\Windows\System\xgVFJQb.exe
  C:\Windows\System\xgVFJQb.exe
  2⤵
  PID:6160
- C:\Windows\System\bZxIGEQ.exe
  C:\Windows\System\bZxIGEQ.exe
  2⤵
  PID:6180
- C:\Windows\System\YmzMRgS.exe
  C:\Windows\System\YmzMRgS.exe
  2⤵
  PID:6200
- C:\Windows\System\VNiAMgf.exe
  C:\Windows\System\VNiAMgf.exe
  2⤵
  PID:6216
- C:\Windows\System\KktWLBs.exe
  C:\Windows\System\KktWLBs.exe
  2⤵
  PID:6232
- C:\Windows\System\FcCwSKG.exe
  C:\Windows\System\FcCwSKG.exe
  2⤵
  PID:6252
- C:\Windows\System\WGOEkIp.exe
  C:\Windows\System\WGOEkIp.exe
  2⤵
  PID:6268
- C:\Windows\System\xozXSmD.exe
  C:\Windows\System\xozXSmD.exe
  2⤵
  PID:6284
- C:\Windows\System\JSvsvvb.exe
  C:\Windows\System\JSvsvvb.exe
  2⤵
  PID:6300
- C:\Windows\System\tWQCrnH.exe
  C:\Windows\System\tWQCrnH.exe
  2⤵
  PID:6316
- C:\Windows\System\HAHgPCC.exe
  C:\Windows\System\HAHgPCC.exe
  2⤵
  PID:6336
- C:\Windows\System\aWaxNXS.exe
  C:\Windows\System\aWaxNXS.exe
  2⤵
  PID:6352
- C:\Windows\System\TmIwMFo.exe
  C:\Windows\System\TmIwMFo.exe
  2⤵
  PID:6368
- C:\Windows\System\poBRDrc.exe
  C:\Windows\System\poBRDrc.exe
  2⤵
  PID:6384
- C:\Windows\System\nwflxyF.exe
  C:\Windows\System\nwflxyF.exe
  2⤵
  PID:6400
- C:\Windows\System\iBUWfLM.exe
  C:\Windows\System\iBUWfLM.exe
  2⤵
  PID:6420
- C:\Windows\System\vehurij.exe
  C:\Windows\System\vehurij.exe
  2⤵
  PID:6436
- C:\Windows\System\OwGfQvA.exe
  C:\Windows\System\OwGfQvA.exe
  2⤵
  PID:6452
- C:\Windows\System\HTtFnnM.exe
  C:\Windows\System\HTtFnnM.exe
  2⤵
  PID:6468
- C:\Windows\System\ZbMedgH.exe
  C:\Windows\System\ZbMedgH.exe
  2⤵
  PID:6484
- C:\Windows\System\WszOZSv.exe
  C:\Windows\System\WszOZSv.exe
  2⤵
  PID:6500
- C:\Windows\System\mOFajvJ.exe
  C:\Windows\System\mOFajvJ.exe
  2⤵
  PID:6516
- C:\Windows\System\szqqPxX.exe
  C:\Windows\System\szqqPxX.exe
  2⤵
  PID:6532
- C:\Windows\System\OZPhICZ.exe
  C:\Windows\System\OZPhICZ.exe
  2⤵
  PID:6548
- C:\Windows\System\RvDPIkP.exe
  C:\Windows\System\RvDPIkP.exe
  2⤵
  PID:6568
- C:\Windows\System\BwQNYug.exe
  C:\Windows\System\BwQNYug.exe
  2⤵
  PID:6584
- C:\Windows\System\yaaDlMx.exe
  C:\Windows\System\yaaDlMx.exe
  2⤵
  PID:6600
- C:\Windows\System\aRgeQVN.exe
  C:\Windows\System\aRgeQVN.exe
  2⤵
  PID:6616
- C:\Windows\System\RPjSlyY.exe
  C:\Windows\System\RPjSlyY.exe
  2⤵
  PID:6632
- C:\Windows\System\opFdENR.exe
  C:\Windows\System\opFdENR.exe
  2⤵
  PID:6648
- C:\Windows\System\EoEhjcG.exe
  C:\Windows\System\EoEhjcG.exe
  2⤵
  PID:6672
- C:\Windows\System\WNycXVa.exe
  C:\Windows\System\WNycXVa.exe
  2⤵
  PID:6692
- C:\Windows\System\MHMXvxx.exe
  C:\Windows\System\MHMXvxx.exe
  2⤵
  PID:6708
- C:\Windows\System\BvzeiAx.exe
  C:\Windows\System\BvzeiAx.exe
  2⤵
  PID:6732
- C:\Windows\System\aSQFsAz.exe
  C:\Windows\System\aSQFsAz.exe
  2⤵
  PID:6748
- C:\Windows\System\tUvJtsV.exe
  C:\Windows\System\tUvJtsV.exe
  2⤵
  PID:6764
- C:\Windows\System\hWlTKGr.exe
  C:\Windows\System\hWlTKGr.exe
  2⤵
  PID:6780
- C:\Windows\System\CYWHlFW.exe
  C:\Windows\System\CYWHlFW.exe
  2⤵
  PID:6796
- C:\Windows\System\xpNCBWd.exe
  C:\Windows\System\xpNCBWd.exe
  2⤵
  PID:6816
- C:\Windows\System\VlaMIpM.exe
  C:\Windows\System\VlaMIpM.exe
  2⤵
  PID:6832
- C:\Windows\System\jPmipYU.exe
  C:\Windows\System\jPmipYU.exe
  2⤵
  PID:6848
- C:\Windows\System\ocepVyp.exe
  C:\Windows\System\ocepVyp.exe
  2⤵
  PID:6864
- C:\Windows\System\wRoJRMa.exe
  C:\Windows\System\wRoJRMa.exe
  2⤵
  PID:6880
- C:\Windows\System\sfAEdDd.exe
  C:\Windows\System\sfAEdDd.exe
  2⤵
  PID:6896
- C:\Windows\System\llTudbe.exe
  C:\Windows\System\llTudbe.exe
  2⤵
  PID:6912
- C:\Windows\System\lXdOfvt.exe
  C:\Windows\System\lXdOfvt.exe
  2⤵
  PID:6932
- C:\Windows\System\wYlcLVw.exe
  C:\Windows\System\wYlcLVw.exe
  2⤵
  PID:6948
- C:\Windows\System\PlujdtH.exe
  C:\Windows\System\PlujdtH.exe
  2⤵
  PID:6964
- C:\Windows\System\WpuXIHD.exe
  C:\Windows\System\WpuXIHD.exe
  2⤵
  PID:6980
- C:\Windows\System\xNQANlZ.exe
  C:\Windows\System\xNQANlZ.exe
  2⤵
  PID:6996
- C:\Windows\System\jSViRuQ.exe
  C:\Windows\System\jSViRuQ.exe
  2⤵
  PID:7012
- C:\Windows\System\wHypvdT.exe
  C:\Windows\System\wHypvdT.exe
  2⤵
  PID:7028
- C:\Windows\System\cmyzsbI.exe
  C:\Windows\System\cmyzsbI.exe
  2⤵
  PID:7044
- C:\Windows\System\fkLEToi.exe
  C:\Windows\System\fkLEToi.exe
  2⤵
  PID:7060
- C:\Windows\System\WrUxIAt.exe
  C:\Windows\System\WrUxIAt.exe
  2⤵
  PID:7076
- C:\Windows\System\qKWdDCR.exe
  C:\Windows\System\qKWdDCR.exe
  2⤵
  PID:7096
- C:\Windows\System\oCGZsre.exe
  C:\Windows\System\oCGZsre.exe
  2⤵
  PID:7112
- C:\Windows\System\uFqrqNi.exe
  C:\Windows\System\uFqrqNi.exe
  2⤵
  PID:7128
- C:\Windows\System\oCSeBmG.exe
  C:\Windows\System\oCSeBmG.exe
  2⤵
  PID:6308
- C:\Windows\System\pbiKvmu.exe
  C:\Windows\System\pbiKvmu.exe
  2⤵
  PID:6244
- C:\Windows\System\HayHUdU.exe
  C:\Windows\System\HayHUdU.exe
  2⤵
  PID:6376
- C:\Windows\System\sxqEkZj.exe
  C:\Windows\System\sxqEkZj.exe
  2⤵
  PID:6416
- C:\Windows\System\RmZPZFf.exe
  C:\Windows\System\RmZPZFf.exe
  2⤵
  PID:6480
- C:\Windows\System\yKfuedY.exe
  C:\Windows\System\yKfuedY.exe
  2⤵
  PID:6512
- C:\Windows\System\IqfNaBz.exe
  C:\Windows\System\IqfNaBz.exe
  2⤵
  PID:6612
- C:\Windows\System\yrXGiSk.exe
  C:\Windows\System\yrXGiSk.exe
  2⤵
  PID:6044
- C:\Windows\System\GZlDqLE.exe
  C:\Windows\System\GZlDqLE.exe
  2⤵
  PID:6060
- C:\Windows\System\PMhtzpt.exe
  C:\Windows\System\PMhtzpt.exe
  2⤵
  PID:6124
- C:\Windows\System\JHtTkat.exe
  C:\Windows\System\JHtTkat.exe
  2⤵
  PID:5020
- C:\Windows\System\UFCtHaE.exe
  C:\Windows\System\UFCtHaE.exe
  2⤵
  PID:5232
- C:\Windows\System\yzSijSR.exe
  C:\Windows\System\yzSijSR.exe
  2⤵
  PID:5352
- C:\Windows\System\HBcQvQy.exe
  C:\Windows\System\HBcQvQy.exe
  2⤵
  PID:5484
- C:\Windows\System\RrquecY.exe
  C:\Windows\System\RrquecY.exe
  2⤵
  PID:5548
- C:\Windows\System\JpRqpJO.exe
  C:\Windows\System\JpRqpJO.exe
  2⤵
  PID:5804
- C:\Windows\System\ssYKQuO.exe
  C:\Windows\System\ssYKQuO.exe
  2⤵
  PID:5824
- C:\Windows\System\MAcyJHc.exe
  C:\Windows\System\MAcyJHc.exe
  2⤵
  PID:5964
- C:\Windows\System\fbMdgJg.exe
  C:\Windows\System\fbMdgJg.exe
  2⤵
  PID:4736
- C:\Windows\System\zgpFBFN.exe
  C:\Windows\System\zgpFBFN.exe
  2⤵
  PID:5532
- C:\Windows\System\lDDOrat.exe
  C:\Windows\System\lDDOrat.exe
  2⤵
  PID:6108
- C:\Windows\System\WXJNjuL.exe
  C:\Windows\System\WXJNjuL.exe
  2⤵
  PID:6364
- C:\Windows\System\yKUoOOq.exe
  C:\Windows\System\yKUoOOq.exe
  2⤵
  PID:6460
- C:\Windows\System\ghbTcYW.exe
  C:\Windows\System\ghbTcYW.exe
  2⤵
  PID:6680
- C:\Windows\System\altaoeS.exe
  C:\Windows\System\altaoeS.exe
  2⤵
  PID:6560
- C:\Windows\System\xNBeEhP.exe
  C:\Windows\System\xNBeEhP.exe
  2⤵
  PID:6628
- C:\Windows\System\nGfBoaW.exe
  C:\Windows\System\nGfBoaW.exe
  2⤵
  PID:6668
- C:\Windows\System\yNSgPFT.exe
  C:\Windows\System\yNSgPFT.exe
  2⤵
  PID:6720
- C:\Windows\System\bfuqnrZ.exe
  C:\Windows\System\bfuqnrZ.exe
  2⤵
  PID:6700
- C:\Windows\System\eYOyhyh.exe
  C:\Windows\System\eYOyhyh.exe
  2⤵
  PID:6760
- C:\Windows\System\VuzWtby.exe
  C:\Windows\System\VuzWtby.exe
  2⤵
  PID:6804
- C:\Windows\System\xGSEcRu.exe
  C:\Windows\System\xGSEcRu.exe
  2⤵
  PID:6840
- C:\Windows\System\ZmWtOVK.exe
  C:\Windows\System\ZmWtOVK.exe
  2⤵
  PID:6856
- C:\Windows\System\wKvsTgh.exe
  C:\Windows\System\wKvsTgh.exe
  2⤵
  PID:6920
- C:\Windows\System\buqgOdN.exe
  C:\Windows\System\buqgOdN.exe
  2⤵
  PID:6960
- C:\Windows\System\TVOjWXy.exe
  C:\Windows\System\TVOjWXy.exe
  2⤵
  PID:6904
- C:\Windows\System\zyAFLgt.exe
  C:\Windows\System\zyAFLgt.exe
  2⤵
  PID:6940
- C:\Windows\System\TwZPvth.exe
  C:\Windows\System\TwZPvth.exe
  2⤵
  PID:7092
- C:\Windows\System\GgtMwKl.exe
  C:\Windows\System\GgtMwKl.exe
  2⤵
  PID:7008
- C:\Windows\System\IdJaKeP.exe
  C:\Windows\System\IdJaKeP.exe
  2⤵
  PID:7136
- C:\Windows\System\eywOblY.exe
  C:\Windows\System\eywOblY.exe
  2⤵
  PID:7052
- C:\Windows\System\ocLCCXX.exe
  C:\Windows\System\ocLCCXX.exe
  2⤵
  PID:7152
- C:\Windows\System\UceyJbt.exe
  C:\Windows\System\UceyJbt.exe
  2⤵
  PID:7164
- C:\Windows\System\EUmZmgI.exe
  C:\Windows\System\EUmZmgI.exe
  2⤵
  PID:5184
- C:\Windows\System\duhatBn.exe
  C:\Windows\System\duhatBn.exe
  2⤵
  PID:5616
- C:\Windows\System\gcJdPRH.exe
  C:\Windows\System\gcJdPRH.exe
  2⤵
  PID:6344
- C:\Windows\System\MWzASXA.exe
  C:\Windows\System\MWzASXA.exe
  2⤵
  PID:6544
- C:\Windows\System\uAGJWfc.exe
  C:\Windows\System\uAGJWfc.exe
  2⤵
  PID:6092
- C:\Windows\System\EPFlKDW.exe
  C:\Windows\System\EPFlKDW.exe
  2⤵
  PID:5792
- C:\Windows\System\lMaSFqv.exe
  C:\Windows\System\lMaSFqv.exe
  2⤵
  PID:5396
- C:\Windows\System\DUNrlit.exe
  C:\Windows\System\DUNrlit.exe
  2⤵
  PID:5912
- C:\Windows\System\ZUulebs.exe
  C:\Windows\System\ZUulebs.exe
  2⤵
  PID:5316
- C:\Windows\System\doYdgPs.exe
  C:\Windows\System\doYdgPs.exe
  2⤵
  PID:6196
- C:\Windows\System\zjPsiJg.exe
  C:\Windows\System\zjPsiJg.exe
  2⤵
  PID:6228
- C:\Windows\System\ZMtyLLz.exe
  C:\Windows\System\ZMtyLLz.exe
  2⤵
  PID:6324
- C:\Windows\System\LSZmaLt.exe
  C:\Windows\System\LSZmaLt.exe
  2⤵
  PID:6496
- C:\Windows\System\QhLeEHN.exe
  C:\Windows\System\QhLeEHN.exe
  2⤵
  PID:6744
- C:\Windows\System\dyoxBvN.exe
  C:\Windows\System\dyoxBvN.exe
  2⤵
  PID:6888
- C:\Windows\System\FbWYUko.exe
  C:\Windows\System\FbWYUko.exe
  2⤵
  PID:7024
- C:\Windows\System\eCAQfLU.exe
  C:\Windows\System\eCAQfLU.exe
  2⤵
  PID:7072
- C:\Windows\System\RbMHpKs.exe
  C:\Windows\System\RbMHpKs.exe
  2⤵
  PID:7056
- C:\Windows\System\ULfHvYx.exe
  C:\Windows\System\ULfHvYx.exe
  2⤵
  PID:6016
- C:\Windows\System\dumwrXv.exe
  C:\Windows\System\dumwrXv.exe
  2⤵
  PID:6348
- C:\Windows\System\kFGmaer.exe
  C:\Windows\System\kFGmaer.exe
  2⤵
  PID:6396
- C:\Windows\System\uIRlirs.exe
  C:\Windows\System\uIRlirs.exe
  2⤵
  PID:6556
- C:\Windows\System\eiQCJUX.exe
  C:\Windows\System\eiQCJUX.exe
  2⤵
  PID:6704
- C:\Windows\System\bjztcmB.exe
  C:\Windows\System\bjztcmB.exe
  2⤵
  PID:6828
- C:\Windows\System\VmhCUia.exe
  C:\Windows\System\VmhCUia.exe
  2⤵
  PID:7084
- C:\Windows\System\FyYnUgZ.exe
  C:\Windows\System\FyYnUgZ.exe
  2⤵
  PID:5712
- C:\Windows\System\kRyDaOR.exe
  C:\Windows\System\kRyDaOR.exe
  2⤵
  PID:6028
- C:\Windows\System\ByUvqyY.exe
  C:\Windows\System\ByUvqyY.exe
  2⤵
  PID:4212
- C:\Windows\System\xxRcrpg.exe
  C:\Windows\System\xxRcrpg.exe
  2⤵
  PID:6248
- C:\Windows\System\SKbMbuf.exe
  C:\Windows\System\SKbMbuf.exe
  2⤵
  PID:5152
- C:\Windows\System\wRzGXtZ.exe
  C:\Windows\System\wRzGXtZ.exe
  2⤵
  PID:6040
- C:\Windows\System\HlGggNN.exe
  C:\Windows\System\HlGggNN.exe
  2⤵
  PID:5756
- C:\Windows\System\VoSdAxD.exe
  C:\Windows\System\VoSdAxD.exe
  2⤵
  PID:6156
- C:\Windows\System\iIDcfaN.exe
  C:\Windows\System\iIDcfaN.exe
  2⤵
  PID:7120
- C:\Windows\System\huyApzJ.exe
  C:\Windows\System\huyApzJ.exe
  2⤵
  PID:6664
- C:\Windows\System\wmNIRUC.exe
  C:\Windows\System\wmNIRUC.exe
  2⤵
  PID:6956
- C:\Windows\System\FXDOMEE.exe
  C:\Windows\System\FXDOMEE.exe
  2⤵
  PID:6312
- C:\Windows\System\WVgDMdv.exe
  C:\Windows\System\WVgDMdv.exe
  2⤵
  PID:5708
- C:\Windows\System\nkxpVie.exe
  C:\Windows\System\nkxpVie.exe
  2⤵
  PID:6192
- C:\Windows\System\XcaPfCo.exe
  C:\Windows\System\XcaPfCo.exe
  2⤵
  PID:6992
- C:\Windows\System\HmzLmAm.exe
  C:\Windows\System\HmzLmAm.exe
  2⤵
  PID:7040
- C:\Windows\System\PBkPTow.exe
  C:\Windows\System\PBkPTow.exe
  2⤵
  PID:6360
- C:\Windows\System\iFcwVXR.exe
  C:\Windows\System\iFcwVXR.exe
  2⤵
  PID:6608
- C:\Windows\System\PMWcWKi.exe
  C:\Windows\System\PMWcWKi.exe
  2⤵
  PID:6596
- C:\Windows\System\qqhMvCL.exe
  C:\Windows\System\qqhMvCL.exe
  2⤵
  PID:6684
- C:\Windows\System\kNYKRgK.exe
  C:\Windows\System\kNYKRgK.exe
  2⤵
  PID:6824
- C:\Windows\System\PaUJAFL.exe
  C:\Windows\System\PaUJAFL.exe
  2⤵
  PID:4224
- C:\Windows\System\JLvsRkX.exe
  C:\Windows\System\JLvsRkX.exe
  2⤵
  PID:6188
- C:\Windows\System\MfbeHkd.exe
  C:\Windows\System\MfbeHkd.exe
  2⤵
  PID:7108
- C:\Windows\System\LyOLVSi.exe
  C:\Windows\System\LyOLVSi.exe
  2⤵
  PID:6152
- C:\Windows\System\yaOAMss.exe
  C:\Windows\System\yaOAMss.exe
  2⤵
  PID:5592
- C:\Windows\System\fOBVWlW.exe
  C:\Windows\System\fOBVWlW.exe
  2⤵
  PID:6292
- C:\Windows\System\JsEEuMn.exe
  C:\Windows\System\JsEEuMn.exe
  2⤵
  PID:7184
- C:\Windows\System\yspxQSo.exe
  C:\Windows\System\yspxQSo.exe
  2⤵
  PID:7200
- C:\Windows\System\ggpoquD.exe
  C:\Windows\System\ggpoquD.exe
  2⤵
  PID:7216
- C:\Windows\System\FFVHJwh.exe
  C:\Windows\System\FFVHJwh.exe
  2⤵
  PID:7232
- C:\Windows\System\diroLVH.exe
  C:\Windows\System\diroLVH.exe
  2⤵
  PID:7248
- C:\Windows\System\RUmtVaq.exe
  C:\Windows\System\RUmtVaq.exe
  2⤵
  PID:7264
- C:\Windows\System\ErEDYPf.exe
  C:\Windows\System\ErEDYPf.exe
  2⤵
  PID:7280
- C:\Windows\System\puKMouv.exe
  C:\Windows\System\puKMouv.exe
  2⤵
  PID:7296
- C:\Windows\System\XLQDAit.exe
  C:\Windows\System\XLQDAit.exe
  2⤵
  PID:7312
- C:\Windows\System\LvzmGBp.exe
  C:\Windows\System\LvzmGBp.exe
  2⤵
  PID:7328
- C:\Windows\System\GWfBIZB.exe
  C:\Windows\System\GWfBIZB.exe
  2⤵
  PID:7344
- C:\Windows\System\eSwGSjH.exe
  C:\Windows\System\eSwGSjH.exe
  2⤵
  PID:7360
- C:\Windows\System\BihuMjs.exe
  C:\Windows\System\BihuMjs.exe
  2⤵
  PID:7376
- C:\Windows\System\FLHXemX.exe
  C:\Windows\System\FLHXemX.exe
  2⤵
  PID:7392
- C:\Windows\System\AbOuBcF.exe
  C:\Windows\System\AbOuBcF.exe
  2⤵
  PID:7408
- C:\Windows\System\jRcRXJM.exe
  C:\Windows\System\jRcRXJM.exe
  2⤵
  PID:7424
- C:\Windows\System\YQvpAhG.exe
  C:\Windows\System\YQvpAhG.exe
  2⤵
  PID:7440
- C:\Windows\System\SHNfjXQ.exe
  C:\Windows\System\SHNfjXQ.exe
  2⤵
  PID:7456
- C:\Windows\System\vHaWEmG.exe
  C:\Windows\System\vHaWEmG.exe
  2⤵
  PID:7472
- C:\Windows\System\GTpZrqk.exe
  C:\Windows\System\GTpZrqk.exe
  2⤵
  PID:7488
- C:\Windows\System\KnOzJHc.exe
  C:\Windows\System\KnOzJHc.exe
  2⤵
  PID:7504
- C:\Windows\System\lwQjvwO.exe
  C:\Windows\System\lwQjvwO.exe
  2⤵
  PID:7520
- C:\Windows\System\bZyCJjo.exe
  C:\Windows\System\bZyCJjo.exe
  2⤵
  PID:7536
- C:\Windows\System\tByfyXc.exe
  C:\Windows\System\tByfyXc.exe
  2⤵
  PID:7552
- C:\Windows\System\hDUBGyc.exe
  C:\Windows\System\hDUBGyc.exe
  2⤵
  PID:7568
- C:\Windows\System\PestXzr.exe
  C:\Windows\System\PestXzr.exe
  2⤵
  PID:7584
- C:\Windows\System\FDqTCBE.exe
  C:\Windows\System\FDqTCBE.exe
  2⤵
  PID:7600
- C:\Windows\System\jQTyKLL.exe
  C:\Windows\System\jQTyKLL.exe
  2⤵
  PID:7616
- C:\Windows\System\fbAXDMT.exe
  C:\Windows\System\fbAXDMT.exe
  2⤵
  PID:7632
- C:\Windows\System\smNGcTv.exe
  C:\Windows\System\smNGcTv.exe
  2⤵
  PID:7648
- C:\Windows\System\eXulxZY.exe
  C:\Windows\System\eXulxZY.exe
  2⤵
  PID:7668
- C:\Windows\System\DnehCMG.exe
  C:\Windows\System\DnehCMG.exe
  2⤵
  PID:7684
- C:\Windows\System\rFDGvEX.exe
  C:\Windows\System\rFDGvEX.exe
  2⤵
  PID:7704
- C:\Windows\System\iJsrErb.exe
  C:\Windows\System\iJsrErb.exe
  2⤵
  PID:7720
- C:\Windows\System\ljOwESl.exe
  C:\Windows\System\ljOwESl.exe
  2⤵
  PID:7736
- C:\Windows\System\czdICMk.exe
  C:\Windows\System\czdICMk.exe
  2⤵
  PID:7756
- C:\Windows\System\YITWvaK.exe
  C:\Windows\System\YITWvaK.exe
  2⤵
  PID:7772
- C:\Windows\System\qWpsyNP.exe
  C:\Windows\System\qWpsyNP.exe
  2⤵
  PID:7788
- C:\Windows\System\RszFpJU.exe
  C:\Windows\System\RszFpJU.exe
  2⤵
  PID:7804
- C:\Windows\System\XjFsyuW.exe
  C:\Windows\System\XjFsyuW.exe
  2⤵
  PID:7820
- C:\Windows\System\ArJTSVe.exe
  C:\Windows\System\ArJTSVe.exe
  2⤵
  PID:7836
- C:\Windows\System\lcYbMAD.exe
  C:\Windows\System\lcYbMAD.exe
  2⤵
  PID:7852
- C:\Windows\System\ODJNKZq.exe
  C:\Windows\System\ODJNKZq.exe
  2⤵
  PID:7868
- C:\Windows\System\mnZSmZo.exe
  C:\Windows\System\mnZSmZo.exe
  2⤵
  PID:7888
- C:\Windows\System\AVYMZUT.exe
  C:\Windows\System\AVYMZUT.exe
  2⤵
  PID:7904
- C:\Windows\System\qslPaAn.exe
  C:\Windows\System\qslPaAn.exe
  2⤵
  PID:7920
- C:\Windows\System\TfZOOEe.exe
  C:\Windows\System\TfZOOEe.exe
  2⤵
  PID:7936
- C:\Windows\System\EDjIcJt.exe
  C:\Windows\System\EDjIcJt.exe
  2⤵
  PID:7956
- C:\Windows\System\iJeHSxN.exe
  C:\Windows\System\iJeHSxN.exe
  2⤵
  PID:7976
- C:\Windows\System\vsbmBsZ.exe
  C:\Windows\System\vsbmBsZ.exe
  2⤵
  PID:7992
- C:\Windows\System\RhOOglx.exe
  C:\Windows\System\RhOOglx.exe
  2⤵
  PID:8008
- C:\Windows\System\bIUZQxK.exe
  C:\Windows\System\bIUZQxK.exe
  2⤵
  PID:8024
- C:\Windows\System\pSxQUmt.exe
  C:\Windows\System\pSxQUmt.exe
  2⤵
  PID:8040
- C:\Windows\System\uaTlpHO.exe
  C:\Windows\System\uaTlpHO.exe
  2⤵
  PID:8056
- C:\Windows\System\SfLsplD.exe
  C:\Windows\System\SfLsplD.exe
  2⤵
  PID:8072
- C:\Windows\System\CDiHtZr.exe
  C:\Windows\System\CDiHtZr.exe
  2⤵
  PID:8088
- C:\Windows\System\IrQhwmI.exe
  C:\Windows\System\IrQhwmI.exe
  2⤵
  PID:8104
- C:\Windows\System\cbbgCjS.exe
  C:\Windows\System\cbbgCjS.exe
  2⤵
  PID:8124
- C:\Windows\System\vAfzXVE.exe
  C:\Windows\System\vAfzXVE.exe
  2⤵
  PID:8140
- C:\Windows\System\HPxEovQ.exe
  C:\Windows\System\HPxEovQ.exe
  2⤵
  PID:8156
- C:\Windows\System\HWKeMFF.exe
  C:\Windows\System\HWKeMFF.exe
  2⤵
  PID:8172
- C:\Windows\System\GaHoRPO.exe
  C:\Windows\System\GaHoRPO.exe
  2⤵
  PID:8188
- C:\Windows\System\qBTqhDP.exe
  C:\Windows\System\qBTqhDP.exe
  2⤵
  PID:7212
- C:\Windows\System\HYvJXDL.exe
  C:\Windows\System\HYvJXDL.exe
  2⤵
  PID:7160
- C:\Windows\System\FafEbmj.exe
  C:\Windows\System\FafEbmj.exe
  2⤵
  PID:6380
- C:\Windows\System\uXntuSA.exe
  C:\Windows\System\uXntuSA.exe
  2⤵
  PID:5272
- C:\Windows\System\iIaIdAy.exe
  C:\Windows\System\iIaIdAy.exe
  2⤵
  PID:7340
- C:\Windows\System\oHGWnuI.exe
  C:\Windows\System\oHGWnuI.exe
  2⤵
  PID:7372
- C:\Windows\System\JNSkZbW.exe
  C:\Windows\System\JNSkZbW.exe
  2⤵
  PID:6776
- C:\Windows\System\chdKGOz.exe
  C:\Windows\System\chdKGOz.exe
  2⤵
  PID:7436
- C:\Windows\System\tuhjsrI.exe
  C:\Windows\System\tuhjsrI.exe
  2⤵
  PID:7500
- C:\Windows\System\XyxrQqR.exe
  C:\Windows\System\XyxrQqR.exe
  2⤵
  PID:7564
- C:\Windows\System\GVINkzR.exe
  C:\Windows\System\GVINkzR.exe
  2⤵
  PID:7628
- C:\Windows\System\vvBVBOA.exe
  C:\Windows\System\vvBVBOA.exe
  2⤵
  PID:7196
- C:\Windows\System\ithExad.exe
  C:\Windows\System\ithExad.exe
  2⤵
  PID:7352
- C:\Windows\System\FXjSFUM.exe
  C:\Windows\System\FXjSFUM.exe
  2⤵
  PID:7292
- C:\Windows\System\PlsyNWl.exe
  C:\Windows\System\PlsyNWl.exe
  2⤵
  PID:7388
- C:\Windows\System\WvqsyNf.exe
  C:\Windows\System\WvqsyNf.exe
  2⤵
  PID:7544
- C:\Windows\System\wJfzMXG.exe
  C:\Windows\System\wJfzMXG.exe
  2⤵
  PID:7612
- C:\Windows\System\JTLBcnq.exe
  C:\Windows\System\JTLBcnq.exe
  2⤵
  PID:7660
- C:\Windows\System\qIQHRNH.exe
  C:\Windows\System\qIQHRNH.exe
  2⤵
  PID:7644
- C:\Windows\System\OkrQvun.exe
  C:\Windows\System\OkrQvun.exe
  2⤵
  PID:7712
- C:\Windows\System\IHWdgwG.exe
  C:\Windows\System\IHWdgwG.exe
  2⤵
  PID:7796
- C:\Windows\System\UZyUOEq.exe
  C:\Windows\System\UZyUOEq.exe
  2⤵
  PID:7832
- C:\Windows\System\lftLZLF.exe
  C:\Windows\System\lftLZLF.exe
  2⤵
  PID:7900
- C:\Windows\System\WoFJseY.exe
  C:\Windows\System\WoFJseY.exe
  2⤵
  PID:7964
- C:\Windows\System\oTuECSS.exe
  C:\Windows\System\oTuECSS.exe
  2⤵
  PID:8004
- C:\Windows\System\zvnfOSu.exe
  C:\Windows\System\zvnfOSu.exe
  2⤵
  PID:7972
- C:\Windows\System\DnosEjO.exe
  C:\Windows\System\DnosEjO.exe
  2⤵
  PID:7912
- C:\Windows\System\cRgOSfS.exe
  C:\Windows\System\cRgOSfS.exe
  2⤵
  PID:7844
- C:\Windows\System\GiekQrU.exe
  C:\Windows\System\GiekQrU.exe
  2⤵
  PID:7944
- C:\Windows\System\MolIrrS.exe
  C:\Windows\System\MolIrrS.exe
  2⤵
  PID:7988
- C:\Windows\System\KwrQYaP.exe
  C:\Windows\System\KwrQYaP.exe
  2⤵
  PID:8084
- C:\Windows\System\MJzxpkx.exe
  C:\Windows\System\MJzxpkx.exe
  2⤵
  PID:7272
- C:\Windows\System\kzaQVDN.exe
  C:\Windows\System\kzaQVDN.exe
  2⤵
  PID:7244
- C:\Windows\System\kSORBkS.exe
  C:\Windows\System\kSORBkS.exe
  2⤵
  PID:7496
- C:\Windows\System\NUVqWdb.exe
  C:\Windows\System\NUVqWdb.exe
  2⤵
  PID:7384
- C:\Windows\System\tDuLWjT.exe
  C:\Windows\System\tDuLWjT.exe
  2⤵
  PID:7260
- C:\Windows\System\PauUvcZ.exe
  C:\Windows\System\PauUvcZ.exe
  2⤵
  PID:7864
- C:\Windows\System\QHIsXdL.exe
  C:\Windows\System\QHIsXdL.exe
  2⤵
  PID:8000
- C:\Windows\System\JvsxTig.exe
  C:\Windows\System\JvsxTig.exe
  2⤵
  PID:7656
- C:\Windows\System\PduZCPL.exe
  C:\Windows\System\PduZCPL.exe
  2⤵
  PID:7800
- C:\Windows\System\mDAYBOf.exe
  C:\Windows\System\mDAYBOf.exe
  2⤵
  PID:8064
- C:\Windows\System\ctEEjWN.exe
  C:\Windows\System\ctEEjWN.exe
  2⤵
  PID:7884
- C:\Windows\System\TsqjPvA.exe
  C:\Windows\System\TsqjPvA.exe
  2⤵
  PID:7816
- C:\Windows\System\tAjBRmB.exe
  C:\Windows\System\tAjBRmB.exe
  2⤵
  PID:6716
- C:\Windows\System\DYlCKMp.exe
  C:\Windows\System\DYlCKMp.exe
  2⤵
  PID:8132
- C:\Windows\System\IcxRujC.exe
  C:\Windows\System\IcxRujC.exe
  2⤵
  PID:7368
- C:\Windows\System\ObmFrOp.exe
  C:\Windows\System\ObmFrOp.exe
  2⤵
  PID:8136
- C:\Windows\System\zIwDCjh.exe
  C:\Windows\System\zIwDCjh.exe
  2⤵
  PID:7208
- C:\Windows\System\ZrNcMun.exe
  C:\Windows\System\ZrNcMun.exe
  2⤵
  PID:7288
- C:\Windows\System\axAroAp.exe
  C:\Windows\System\axAroAp.exe
  2⤵
  PID:7416
- C:\Windows\System\OOWkiEi.exe
  C:\Windows\System\OOWkiEi.exe
  2⤵
  PID:7304
- C:\Windows\System\WUapKXU.exe
  C:\Windows\System\WUapKXU.exe
  2⤵
  PID:7480
- C:\Windows\System\pwFeoEK.exe
  C:\Windows\System\pwFeoEK.exe
  2⤵
  PID:7716
- C:\Windows\System\ksEsryf.exe
  C:\Windows\System\ksEsryf.exe
  2⤵
  PID:7932
- C:\Windows\System\SjCMxHN.exe
  C:\Windows\System\SjCMxHN.exe
  2⤵
  PID:8080
- C:\Windows\System\FsDjVkT.exe
  C:\Windows\System\FsDjVkT.exe
  2⤵
  PID:7228
- C:\Windows\System\fwgJDVz.exe
  C:\Windows\System\fwgJDVz.exe
  2⤵
  PID:7448
- C:\Windows\System\EAPEYkm.exe
  C:\Windows\System\EAPEYkm.exe
  2⤵
  PID:7692
- C:\Windows\System\mXwHLkP.exe
  C:\Windows\System\mXwHLkP.exe
  2⤵
  PID:7484
- C:\Windows\System\mqwEjpk.exe
  C:\Windows\System\mqwEjpk.exe
  2⤵
  PID:7784
- C:\Windows\System\FnFHLkz.exe
  C:\Windows\System\FnFHLkz.exe
  2⤵
  PID:7532
- C:\Windows\System\QnUpadA.exe
  C:\Windows\System\QnUpadA.exe
  2⤵
  PID:6208
- C:\Windows\System\tGRVEWt.exe
  C:\Windows\System\tGRVEWt.exe
  2⤵
  PID:7180
- C:\Windows\System\ZNOSkCG.exe
  C:\Windows\System\ZNOSkCG.exe
  2⤵
  PID:7308
- C:\Windows\System\aXyqEkU.exe
  C:\Windows\System\aXyqEkU.exe
  2⤵
  PID:8052
- C:\Windows\System\VQvlwpq.exe
  C:\Windows\System\VQvlwpq.exe
  2⤵
  PID:8180
- C:\Windows\System\CPUolVX.exe
  C:\Windows\System\CPUolVX.exe
  2⤵
  PID:8196
- C:\Windows\System\HEsHcFI.exe
  C:\Windows\System\HEsHcFI.exe
  2⤵
  PID:8216
- C:\Windows\System\PxOtIKu.exe
  C:\Windows\System\PxOtIKu.exe
  2⤵
  PID:8288
- C:\Windows\System\yhsyala.exe
  C:\Windows\System\yhsyala.exe
  2⤵
  PID:8304
- C:\Windows\System\bidyapO.exe
  C:\Windows\System\bidyapO.exe
  2⤵
  PID:8320
- C:\Windows\System\vTxcJHr.exe
  C:\Windows\System\vTxcJHr.exe
  2⤵
  PID:8336
- C:\Windows\System\HgfUdxk.exe
  C:\Windows\System\HgfUdxk.exe
  2⤵
  PID:8352
- C:\Windows\System\DssoNCp.exe
  C:\Windows\System\DssoNCp.exe
  2⤵
  PID:8368
- C:\Windows\System\RSKDbCo.exe
  C:\Windows\System\RSKDbCo.exe
  2⤵
  PID:8384
- C:\Windows\System\sPPLgWQ.exe
  C:\Windows\System\sPPLgWQ.exe
  2⤵
  PID:8400
- C:\Windows\System\fKHVjza.exe
  C:\Windows\System\fKHVjza.exe
  2⤵
  PID:8416
- C:\Windows\System\scPbmmw.exe
  C:\Windows\System\scPbmmw.exe
  2⤵
  PID:8432
- C:\Windows\System\MqNwSYL.exe
  C:\Windows\System\MqNwSYL.exe
  2⤵
  PID:8448
- C:\Windows\System\CzyuAFe.exe
  C:\Windows\System\CzyuAFe.exe
  2⤵
  PID:8464
- C:\Windows\System\RvCuWRG.exe
  C:\Windows\System\RvCuWRG.exe
  2⤵
  PID:8480
- C:\Windows\System\MiRbqNU.exe
  C:\Windows\System\MiRbqNU.exe
  2⤵
  PID:8496
- C:\Windows\System\tffQsWb.exe
  C:\Windows\System\tffQsWb.exe
  2⤵
  PID:8512
- C:\Windows\System\ondQkEO.exe
  C:\Windows\System\ondQkEO.exe
  2⤵
  PID:8528
- C:\Windows\System\rdVacjj.exe
  C:\Windows\System\rdVacjj.exe
  2⤵
  PID:8544
- C:\Windows\System\DHoTkvz.exe
  C:\Windows\System\DHoTkvz.exe
  2⤵
  PID:8560
- C:\Windows\System\XhQGdif.exe
  C:\Windows\System\XhQGdif.exe
  2⤵
  PID:8576
- C:\Windows\System\LPzoINw.exe
  C:\Windows\System\LPzoINw.exe
  2⤵
  PID:8592
- C:\Windows\System\gUbXxvI.exe
  C:\Windows\System\gUbXxvI.exe
  2⤵
  PID:8608
- C:\Windows\System\gzqmdhp.exe
  C:\Windows\System\gzqmdhp.exe
  2⤵
  PID:8624
- C:\Windows\System\hfMdQlH.exe
  C:\Windows\System\hfMdQlH.exe
  2⤵
  PID:8640
- C:\Windows\System\HZrqlfK.exe
  C:\Windows\System\HZrqlfK.exe
  2⤵
  PID:8656
- C:\Windows\System\JSSMukN.exe
  C:\Windows\System\JSSMukN.exe
  2⤵
  PID:8672
- C:\Windows\System\mAxvpVQ.exe
  C:\Windows\System\mAxvpVQ.exe
  2⤵
  PID:8688
- C:\Windows\System\XYtgYTw.exe
  C:\Windows\System\XYtgYTw.exe
  2⤵
  PID:8704
- C:\Windows\System\TIOVxQd.exe
  C:\Windows\System\TIOVxQd.exe
  2⤵
  PID:8720
- C:\Windows\System\eXrHvLv.exe
  C:\Windows\System\eXrHvLv.exe
  2⤵
  PID:8736
- C:\Windows\System\rywotfL.exe
  C:\Windows\System\rywotfL.exe
  2⤵
  PID:8752
- C:\Windows\System\nzErwze.exe
  C:\Windows\System\nzErwze.exe
  2⤵
  PID:8768
- C:\Windows\System\NmaSguA.exe
  C:\Windows\System\NmaSguA.exe
  2⤵
  PID:8784
- C:\Windows\System\iqqXGFB.exe
  C:\Windows\System\iqqXGFB.exe
  2⤵
  PID:8800
- C:\Windows\System\hTNkpbB.exe
  C:\Windows\System\hTNkpbB.exe
  2⤵
  PID:8816
- C:\Windows\System\MhRjrRa.exe
  C:\Windows\System\MhRjrRa.exe
  2⤵
  PID:8832
- C:\Windows\System\oklvAfy.exe
  C:\Windows\System\oklvAfy.exe
  2⤵
  PID:8848
- C:\Windows\System\YFOTMAh.exe
  C:\Windows\System\YFOTMAh.exe
  2⤵
  PID:8864
- C:\Windows\System\LiaGXyy.exe
  C:\Windows\System\LiaGXyy.exe
  2⤵
  PID:8880
- C:\Windows\System\mFgjDDF.exe
  C:\Windows\System\mFgjDDF.exe
  2⤵
  PID:8896
- C:\Windows\System\AxKSaAb.exe
  C:\Windows\System\AxKSaAb.exe
  2⤵
  PID:8912
- C:\Windows\System\udkOqXs.exe
  C:\Windows\System\udkOqXs.exe
  2⤵
  PID:8928
- C:\Windows\System\nZtoAaU.exe
  C:\Windows\System\nZtoAaU.exe
  2⤵
  PID:8944
- C:\Windows\System\lfbQEUH.exe
  C:\Windows\System\lfbQEUH.exe
  2⤵
  PID:8960
- C:\Windows\System\LQhnBwt.exe
  C:\Windows\System\LQhnBwt.exe
  2⤵
  PID:8976
- C:\Windows\System\jbOCNPj.exe
  C:\Windows\System\jbOCNPj.exe
  2⤵
  PID:8992
- C:\Windows\System\DJEYvUP.exe
  C:\Windows\System\DJEYvUP.exe
  2⤵
  PID:9008
- C:\Windows\System\aPUWIkp.exe
  C:\Windows\System\aPUWIkp.exe
  2⤵
  PID:9024
- C:\Windows\System\fanlfxx.exe
  C:\Windows\System\fanlfxx.exe
  2⤵
  PID:9040
- C:\Windows\System\jdYFIWc.exe
  C:\Windows\System\jdYFIWc.exe
  2⤵
  PID:9056
- C:\Windows\System\kocUQwM.exe
  C:\Windows\System\kocUQwM.exe
  2⤵
  PID:9072
- C:\Windows\System\IueiXNl.exe
  C:\Windows\System\IueiXNl.exe
  2⤵
  PID:9088
- C:\Windows\System\otDifqz.exe
  C:\Windows\System\otDifqz.exe
  2⤵
  PID:9112
- C:\Windows\System\HNVHPbL.exe
  C:\Windows\System\HNVHPbL.exe
  2⤵
  PID:9128
- C:\Windows\System\LDKEcji.exe
  C:\Windows\System\LDKEcji.exe
  2⤵
  PID:9144
- C:\Windows\System\crBxIvO.exe
  C:\Windows\System\crBxIvO.exe
  2⤵
  PID:9184
- C:\Windows\System\mvpwYWe.exe
  C:\Windows\System\mvpwYWe.exe
  2⤵
  PID:9200
- C:\Windows\System\KUnODLi.exe
  C:\Windows\System\KUnODLi.exe
  2⤵
  PID:5664
- C:\Windows\System\CTouNLT.exe
  C:\Windows\System\CTouNLT.exe
  2⤵
  PID:7608
- C:\Windows\System\lxnaUvT.exe
  C:\Windows\System\lxnaUvT.exe
  2⤵
  PID:8212
- C:\Windows\System\hPuAIaM.exe
  C:\Windows\System\hPuAIaM.exe
  2⤵
  PID:8228
- C:\Windows\System\DtuddrV.exe
  C:\Windows\System\DtuddrV.exe
  2⤵
  PID:8244
- C:\Windows\System\pVrnKON.exe
  C:\Windows\System\pVrnKON.exe
  2⤵
  PID:8276
- C:\Windows\System\CkKSuqp.exe
  C:\Windows\System\CkKSuqp.exe
  2⤵
  PID:8284
- C:\Windows\System\zKszOZa.exe
  C:\Windows\System\zKszOZa.exe
  2⤵
  PID:8344
- C:\Windows\System\BUmufvn.exe
  C:\Windows\System\BUmufvn.exe
  2⤵
  PID:8380
- C:\Windows\System\NGvTYqD.exe
  C:\Windows\System\NGvTYqD.exe
  2⤵
  PID:8360
- C:\Windows\System\HAfvISD.exe
  C:\Windows\System\HAfvISD.exe
  2⤵
  PID:8440
- C:\Windows\System\VjGaSSO.exe
  C:\Windows\System\VjGaSSO.exe
  2⤵
  PID:8504
- C:\Windows\System\EqedNgo.exe
  C:\Windows\System\EqedNgo.exe
  2⤵
  PID:8460
- C:\Windows\System\JzqTGGi.exe
  C:\Windows\System\JzqTGGi.exe
  2⤵
  PID:8600
- C:\Windows\System\ZisVYLX.exe
  C:\Windows\System\ZisVYLX.exe
  2⤵
  PID:8428
- C:\Windows\System\QqvfYhR.exe
  C:\Windows\System\QqvfYhR.exe
  2⤵
  PID:8492
- C:\Windows\System\TFYgtIs.exe
  C:\Windows\System\TFYgtIs.exe
  2⤵
  PID:8520
- C:\Windows\System\LlcMRKL.exe
  C:\Windows\System\LlcMRKL.exe
  2⤵
  PID:8620
- C:\Windows\System\yRdBIem.exe
  C:\Windows\System\yRdBIem.exe
  2⤵
  PID:8684
- C:\Windows\System\PPPVciN.exe
  C:\Windows\System\PPPVciN.exe
  2⤵
  PID:8728
- C:\Windows\System\hpKRGEK.exe
  C:\Windows\System\hpKRGEK.exe
  2⤵
  PID:8792
- C:\Windows\System\uOXzTaU.exe
  C:\Windows\System\uOXzTaU.exe
  2⤵
  PID:8856
- C:\Windows\System\XqbPVFe.exe
  C:\Windows\System\XqbPVFe.exe
  2⤵
  PID:8780
- C:\Windows\System\QszKxOX.exe
  C:\Windows\System\QszKxOX.exe
  2⤵
  PID:8748
- C:\Windows\System\cwPvkxJ.exe
  C:\Windows\System\cwPvkxJ.exe
  2⤵
  PID:8892
- C:\Windows\System\BwTnZJT.exe
  C:\Windows\System\BwTnZJT.exe
  2⤵
  PID:8956
- C:\Windows\System\WRWnQuL.exe
  C:\Windows\System\WRWnQuL.exe
  2⤵
  PID:9020
- C:\Windows\System\kZfPJGk.exe
  C:\Windows\System\kZfPJGk.exe
  2⤵
  PID:8872
- C:\Windows\System\FpijmBV.exe
  C:\Windows\System\FpijmBV.exe
  2⤵
  PID:8908
- C:\Windows\System\iFNzdHp.exe
  C:\Windows\System\iFNzdHp.exe
  2⤵
  PID:9152
- C:\Windows\System\wmGlqNo.exe
  C:\Windows\System\wmGlqNo.exe
  2⤵
  PID:9172
- C:\Windows\System\QeVpNiY.exe
  C:\Windows\System\QeVpNiY.exe
  2⤵
  PID:9032
- C:\Windows\System\rEsGbdz.exe
  C:\Windows\System\rEsGbdz.exe
  2⤵
  PID:9004
- C:\Windows\System\IoibSQo.exe
  C:\Windows\System\IoibSQo.exe
  2⤵
  PID:9100
- C:\Windows\System\mdezhEi.exe
  C:\Windows\System\mdezhEi.exe
  2⤵
  PID:9176
- C:\Windows\System\ziOWyFR.exe
  C:\Windows\System\ziOWyFR.exe
  2⤵
  PID:9212
- C:\Windows\System\QXBDfMj.exe
  C:\Windows\System\QXBDfMj.exe
  2⤵
  PID:8236
- C:\Windows\System\cwdNoed.exe
  C:\Windows\System\cwdNoed.exe
  2⤵
  PID:8376
- C:\Windows\System\myVRHCA.exe
  C:\Windows\System\myVRHCA.exe
  2⤵
  PID:8396
- C:\Windows\System\cLScedW.exe
  C:\Windows\System\cLScedW.exe
  2⤵
  PID:8536
- C:\Windows\System\ccRhxiv.exe
  C:\Windows\System\ccRhxiv.exe
  2⤵
  PID:7512
- C:\Windows\System\aOWJaKe.exe
  C:\Windows\System\aOWJaKe.exe
  2⤵
  PID:8488
- C:\Windows\System\Zogvugm.exe
  C:\Windows\System\Zogvugm.exe
  2⤵
  PID:8572
- C:\Windows\System\sHIlYZd.exe
  C:\Windows\System\sHIlYZd.exe
  2⤵
  PID:8332
- C:\Windows\System\xGGXZUB.exe
  C:\Windows\System\xGGXZUB.exe
  2⤵
  PID:8668
- C:\Windows\System\NAQvsRP.exe
  C:\Windows\System\NAQvsRP.exe
  2⤵
  PID:8680
- C:\Windows\System\ddzMdRx.exe
  C:\Windows\System\ddzMdRx.exe
  2⤵
  PID:8888
- C:\Windows\System\tswVgpv.exe
  C:\Windows\System\tswVgpv.exe
  2⤵
  PID:8988
- C:\Windows\System\DFXtmel.exe
  C:\Windows\System\DFXtmel.exe
  2⤵
  PID:8904
- C:\Windows\System\WRrwYTE.exe
  C:\Windows\System\WRrwYTE.exe
  2⤵
  PID:8972
- C:\Windows\System\HNjfCqD.exe
  C:\Windows\System\HNjfCqD.exe
  2⤵
  PID:7780
- C:\Windows\System\AnKUWzJ.exe
  C:\Windows\System\AnKUWzJ.exe
  2⤵
  PID:8828
- C:\Windows\System\mKRxAMa.exe
  C:\Windows\System\mKRxAMa.exe
  2⤵
  PID:8392
- C:\Windows\System\WqrgKLl.exe
  C:\Windows\System\WqrgKLl.exe
  2⤵
  PID:9124
- C:\Windows\System\bQqdEuE.exe
  C:\Windows\System\bQqdEuE.exe
  2⤵
  PID:9080
- C:\Windows\System\bychUXy.exe
  C:\Windows\System\bychUXy.exe
  2⤵
  PID:9180
- C:\Windows\System\vXtjRUX.exe
  C:\Windows\System\vXtjRUX.exe
  2⤵
  PID:8260
- C:\Windows\System\FPaULUo.exe
  C:\Windows\System\FPaULUo.exe
  2⤵
  PID:8764
- C:\Windows\System\ZOavlhX.exe
  C:\Windows\System\ZOavlhX.exe
  2⤵
  PID:9108
- C:\Windows\System\nNJaYGL.exe
  C:\Windows\System\nNJaYGL.exe
  2⤵
  PID:9096
- C:\Windows\System\smgdiOx.exe
  C:\Windows\System\smgdiOx.exe
  2⤵
  PID:9196
- C:\Windows\System\ZQEnolq.exe
  C:\Windows\System\ZQEnolq.exe
  2⤵
  PID:9084
- C:\Windows\System\LiIELYk.exe
  C:\Windows\System\LiIELYk.exe
  2⤵
  PID:8272
- C:\Windows\System\BOhOOTi.exe
  C:\Windows\System\BOhOOTi.exe
  2⤵
  PID:9236
- C:\Windows\System\EXnUTqH.exe
  C:\Windows\System\EXnUTqH.exe
  2⤵
  PID:9252
- C:\Windows\System\cPhEHwG.exe
  C:\Windows\System\cPhEHwG.exe
  2⤵
  PID:9268
- C:\Windows\System\AVTydEK.exe
  C:\Windows\System\AVTydEK.exe
  2⤵
  PID:9284
- C:\Windows\System\FNSHzYS.exe
  C:\Windows\System\FNSHzYS.exe
  2⤵
  PID:9300
- C:\Windows\System\neOixTd.exe
  C:\Windows\System\neOixTd.exe
  2⤵
  PID:9316
- C:\Windows\System\TMGYLru.exe
  C:\Windows\System\TMGYLru.exe
  2⤵
  PID:9332
- C:\Windows\System\PdRMRYv.exe
  C:\Windows\System\PdRMRYv.exe
  2⤵
  PID:9356
- C:\Windows\System\xmMqMsp.exe
  C:\Windows\System\xmMqMsp.exe
  2⤵
  PID:9376
- C:\Windows\System\CRUZCUt.exe
  C:\Windows\System\CRUZCUt.exe
  2⤵
  PID:9396
- C:\Windows\System\ozfcrwc.exe
  C:\Windows\System\ozfcrwc.exe
  2⤵
  PID:9412
- C:\Windows\System\tUAzOri.exe
  C:\Windows\System\tUAzOri.exe
  2⤵
  PID:9428
- C:\Windows\System\RwINNaU.exe
  C:\Windows\System\RwINNaU.exe
  2⤵
  PID:9444
- C:\Windows\System\ujqQnsa.exe
  C:\Windows\System\ujqQnsa.exe
  2⤵
  PID:9460
- C:\Windows\System\xIvByBM.exe
  C:\Windows\System\xIvByBM.exe
  2⤵
  PID:9476
- C:\Windows\System\cCgMWlc.exe
  C:\Windows\System\cCgMWlc.exe
  2⤵
  PID:9492
- C:\Windows\System\yKDZHQL.exe
  C:\Windows\System\yKDZHQL.exe
  2⤵
  PID:9524
- C:\Windows\System\GlAaTRH.exe
  C:\Windows\System\GlAaTRH.exe
  2⤵
  PID:9540
- C:\Windows\System\qdviCod.exe
  C:\Windows\System\qdviCod.exe
  2⤵
  PID:9556
- C:\Windows\System\jxNVuPW.exe
  C:\Windows\System\jxNVuPW.exe
  2⤵
  PID:9572
- C:\Windows\System\gylkKSe.exe
  C:\Windows\System\gylkKSe.exe
  2⤵
  PID:9592
- C:\Windows\System\NCbAUYk.exe
  C:\Windows\System\NCbAUYk.exe
  2⤵
  PID:9608
- C:\Windows\System\ihcbNTR.exe
  C:\Windows\System\ihcbNTR.exe
  2⤵
  PID:9628
- C:\Windows\System\aYQORCw.exe
  C:\Windows\System\aYQORCw.exe
  2⤵
  PID:9700
- C:\Windows\System\HXTrDAd.exe
  C:\Windows\System\HXTrDAd.exe
  2⤵
  PID:9716
- C:\Windows\System\fWJJVzJ.exe
  C:\Windows\System\fWJJVzJ.exe
  2⤵
  PID:9732
- C:\Windows\System\gBYrnve.exe
  C:\Windows\System\gBYrnve.exe
  2⤵
  PID:9752
- C:\Windows\System\EqagMcj.exe
  C:\Windows\System\EqagMcj.exe
  2⤵
  PID:9768
- C:\Windows\System\tgrPsBD.exe
  C:\Windows\System\tgrPsBD.exe
  2⤵
  PID:9784
- C:\Windows\System\JZhLCFa.exe
  C:\Windows\System\JZhLCFa.exe
  2⤵
  PID:9812
- C:\Windows\System\nwbfNhq.exe
  C:\Windows\System\nwbfNhq.exe
  2⤵
  PID:9828
- C:\Windows\System\SNtfTHX.exe
  C:\Windows\System\SNtfTHX.exe
  2⤵
  PID:9844
- C:\Windows\System\MGHKYde.exe
  C:\Windows\System\MGHKYde.exe
  2⤵
  PID:9860
- C:\Windows\System\CAyrGZP.exe
  C:\Windows\System\CAyrGZP.exe
  2⤵
  PID:9876
- C:\Windows\System\GfPDtaY.exe
  C:\Windows\System\GfPDtaY.exe
  2⤵
  PID:9896
- C:\Windows\System\zQTkRgq.exe
  C:\Windows\System\zQTkRgq.exe
  2⤵
  PID:9912
- C:\Windows\System\nMnHmcw.exe
  C:\Windows\System\nMnHmcw.exe
  2⤵
  PID:9928
- C:\Windows\System\LmdImkS.exe
  C:\Windows\System\LmdImkS.exe
  2⤵
  PID:8812
- C:\Windows\System\wAKZctI.exe
  C:\Windows\System\wAKZctI.exe
  2⤵
  PID:8584
- C:\Windows\System\ppqLxbJ.exe
  C:\Windows\System\ppqLxbJ.exe
  2⤵
  PID:9052
- C:\Windows\System\VqNxAoB.exe
  C:\Windows\System\VqNxAoB.exe
  2⤵
  PID:8256
- C:\Windows\System\LnrRxnZ.exe
  C:\Windows\System\LnrRxnZ.exe
  2⤵
  PID:9352
- C:\Windows\System\idBjBDS.exe
  C:\Windows\System\idBjBDS.exe
  2⤵
  PID:8552
- C:\Windows\System\odbSain.exe
  C:\Windows\System\odbSain.exe
  2⤵
  PID:8476
- C:\Windows\System\eBFRWgX.exe
  C:\Windows\System\eBFRWgX.exe
  2⤵
  PID:9296
- C:\Windows\System\LsbPkNN.exe
  C:\Windows\System\LsbPkNN.exe
  2⤵
  PID:9368
- C:\Windows\System\MfoexUW.exe
  C:\Windows\System\MfoexUW.exe
  2⤵
  PID:9440
- C:\Windows\System\VxYqAUg.exe
  C:\Windows\System\VxYqAUg.exe
  2⤵
  PID:9388
- C:\Windows\System\LpabNmr.exe
  C:\Windows\System\LpabNmr.exe
  2⤵
  PID:9452
- C:\Windows\System\yxxXGQO.exe
  C:\Windows\System\yxxXGQO.exe
  2⤵
  PID:9532
- C:\Windows\System\JVKomuQ.exe
  C:\Windows\System\JVKomuQ.exe
  2⤵
  PID:9536
- C:\Windows\System\nUXsnvT.exe
  C:\Windows\System\nUXsnvT.exe
  2⤵
  PID:9516
- C:\Windows\System\teRtNLs.exe
  C:\Windows\System\teRtNLs.exe
  2⤵
  PID:9588
- C:\Windows\System\EZIhNgs.exe
  C:\Windows\System\EZIhNgs.exe
  2⤵
  PID:9580
- C:\Windows\System\yVpbWdl.exe
  C:\Windows\System\yVpbWdl.exe
  2⤵
  PID:9652
- C:\Windows\System\coaRHqC.exe
  C:\Windows\System\coaRHqC.exe
  2⤵
  PID:9676
- C:\Windows\System\UnsvBVB.exe
  C:\Windows\System\UnsvBVB.exe
  2⤵
  PID:9800
- C:\Windows\System\pHGjhBv.exe
  C:\Windows\System\pHGjhBv.exe
  2⤵
  PID:9868
- C:\Windows\System\KKhgceW.exe
  C:\Windows\System\KKhgceW.exe
  2⤵
  PID:9936
- C:\Windows\System\UYwWXOq.exe
  C:\Windows\System\UYwWXOq.exe
  2⤵
  PID:9884
- C:\Windows\System\SdoiXkd.exe
  C:\Windows\System\SdoiXkd.exe
  2⤵
  PID:9924
- C:\Windows\System\VCULSLT.exe
  C:\Windows\System\VCULSLT.exe
  2⤵
  PID:9960
- C:\Windows\System\NilwIfM.exe
  C:\Windows\System\NilwIfM.exe
  2⤵
  PID:10060
- C:\Windows\System\llTsRqB.exe
  C:\Windows\System\llTsRqB.exe
  2⤵
  PID:10044
- C:\Windows\System\paAHvwD.exe
  C:\Windows\System\paAHvwD.exe
  2⤵
  PID:10028
- C:\Windows\System\tbuwrcp.exe
  C:\Windows\System\tbuwrcp.exe
  2⤵
  PID:10008
- C:\Windows\System\yKUTXSD.exe
  C:\Windows\System\yKUTXSD.exe
  2⤵
  PID:10088
- C:\Windows\System\MynAqUK.exe
  C:\Windows\System\MynAqUK.exe
  2⤵
  PID:10104
- C:\Windows\System\FDMbXcO.exe
  C:\Windows\System\FDMbXcO.exe
  2⤵
  PID:10120
- C:\Windows\System\TLoTWxc.exe
  C:\Windows\System\TLoTWxc.exe
  2⤵
  PID:10136
- C:\Windows\System\DkMvtYw.exe
  C:\Windows\System\DkMvtYw.exe
  2⤵
  PID:9948
- C:\Windows\System\kFViVkT.exe
  C:\Windows\System\kFViVkT.exe
  2⤵
  PID:10172
- C:\Windows\System\BISkKus.exe
  C:\Windows\System\BISkKus.exe
  2⤵
  PID:10192
- C:\Windows\System\QriHFow.exe
  C:\Windows\System\QriHFow.exe
  2⤵
  PID:10144
- C:\Windows\System\esEuJcr.exe
  C:\Windows\System\esEuJcr.exe
  2⤵
  PID:10220
- C:\Windows\System\GJwdUHN.exe
  C:\Windows\System\GJwdUHN.exe
  2⤵
  PID:10236
- C:\Windows\System\MMDUWkt.exe
  C:\Windows\System\MMDUWkt.exe
  2⤵
  PID:9280
- C:\Windows\System\UArqXbM.exe
  C:\Windows\System\UArqXbM.exe
  2⤵
  PID:9340
- C:\Windows\System\oevqToE.exe
  C:\Windows\System\oevqToE.exe
  2⤵
  PID:10076
- C:\Windows\System\Yuhofll.exe
  C:\Windows\System\Yuhofll.exe
  2⤵
  PID:9264
- C:\Windows\System\GzhLHfL.exe
  C:\Windows\System\GzhLHfL.exe
  2⤵
  PID:8824
- C:\Windows\System\yPEjhdz.exe
  C:\Windows\System\yPEjhdz.exe
  2⤵
  PID:9472
- C:\Windows\System\BxaRZsy.exe
  C:\Windows\System\BxaRZsy.exe
  2⤵
  PID:8716
- C:\Windows\System\KHsDHIL.exe
  C:\Windows\System\KHsDHIL.exe
  2⤵
  PID:9408
- C:\Windows\System\FcsAWLK.exe
  C:\Windows\System\FcsAWLK.exe
  2⤵
  PID:9508
- C:\Windows\System\WfVUkPa.exe
  C:\Windows\System\WfVUkPa.exe
  2⤵
  PID:9500
- C:\Windows\System\oFstOXP.exe
  C:\Windows\System\oFstOXP.exe
  2⤵
  PID:9548
- C:\Windows\System\VinaGxd.exe
  C:\Windows\System\VinaGxd.exe
  2⤵
  PID:9648
- C:\Windows\System\nvmasCp.exe
  C:\Windows\System\nvmasCp.exe
  2⤵
  PID:9724
- C:\Windows\System\xMpzVIF.exe
  C:\Windows\System\xMpzVIF.exe
  2⤵
  PID:9760
- C:\Windows\System\XqdsvEg.exe
  C:\Windows\System\XqdsvEg.exe
  2⤵
  PID:9744
- C:\Windows\System\QJGSUit.exe
  C:\Windows\System\QJGSUit.exe
  2⤵
  PID:9904
- C:\Windows\System\WiFQuiZ.exe
  C:\Windows\System\WiFQuiZ.exe
  2⤵
  PID:9908
- C:\Windows\System\yNuQHTt.exe
  C:\Windows\System\yNuQHTt.exe
  2⤵
  PID:9964
- C:\Windows\System\SpchRvN.exe
  C:\Windows\System\SpchRvN.exe
  2⤵
  PID:9840
- C:\Windows\System\lohlRei.exe
  C:\Windows\System\lohlRei.exe
  2⤵
  PID:10036
- C:\Windows\System\tPzKkUO.exe
  C:\Windows\System\tPzKkUO.exe
  2⤵
  PID:10068
- C:\Windows\System\AlvKQxT.exe
  C:\Windows\System\AlvKQxT.exe
  2⤵
  PID:10152
- C:\Windows\System\JuKYWED.exe
  C:\Windows\System\JuKYWED.exe
  2⤵
  PID:9308
- C:\Windows\System\GwCQiYe.exe
  C:\Windows\System\GwCQiYe.exe
  2⤵
  PID:8936
- C:\Windows\System\XmiZfcb.exe
  C:\Windows\System\XmiZfcb.exe
  2⤵
  PID:9488
- C:\Windows\System\VgBxKMV.exe
  C:\Windows\System\VgBxKMV.exe
  2⤵
  PID:8952
- C:\Windows\System\tlhkLrF.exe
  C:\Windows\System\tlhkLrF.exe
  2⤵
  PID:9420
- C:\Windows\System\QPgmpmh.exe
  C:\Windows\System\QPgmpmh.exe
  2⤵
  PID:9624
- C:\Windows\System\ATnkfOu.exe
  C:\Windows\System\ATnkfOu.exe
  2⤵
  PID:10164
- C:\Windows\System\JMEMoHp.exe
  C:\Windows\System\JMEMoHp.exe
  2⤵
  PID:9684
- C:\Windows\System\bgsdlWR.exe
  C:\Windows\System\bgsdlWR.exe
  2⤵
  PID:9712
- C:\Windows\System\STcTPZF.exe
  C:\Windows\System\STcTPZF.exe
  2⤵
  PID:9604
- C:\Windows\System\zTLkWlU.exe
  C:\Windows\System\zTLkWlU.exe
  2⤵
  PID:9808
- C:\Windows\System\xFMNtYx.exe
  C:\Windows\System\xFMNtYx.exe
  2⤵
  PID:10116
- C:\Windows\System\pFMlGni.exe
  C:\Windows\System\pFMlGni.exe
  2⤵
  PID:10080
- C:\Windows\System\cJpcmBn.exe
  C:\Windows\System\cJpcmBn.exe
  2⤵
  PID:9920
- C:\Windows\System\YweIDbN.exe
  C:\Windows\System\YweIDbN.exe
  2⤵
  PID:10012
- C:\Windows\System\AcNXeGJ.exe
  C:\Windows\System\AcNXeGJ.exe
  2⤵
  PID:10132
- C:\Windows\System\hNThLuD.exe
  C:\Windows\System\hNThLuD.exe
  2⤵
  PID:9952
- C:\Windows\System\QchrBkN.exe
  C:\Windows\System\QchrBkN.exe
  2⤵
  PID:10232
- C:\Windows\System\uVBfzlq.exe
  C:\Windows\System\uVBfzlq.exe
  2⤵
  PID:9312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FkkkEpK.exe

Filesize
1.7MB

MD5
68f76d444faa4ba6a4d109e86b5bf712

SHA1
8b6b53e0d5047ac26039c78dddce386af245922c

SHA256
e4e591a7eb94102aabddc4463fec7b3a5ea0c76a52e5a7c5d041b7e81a85b64c

SHA512
0f3105150f30a710d30b8f963b676a744adb90148f454882b740201b132f3ffd5300513403e67d25f87b1eb046e1887e86f309b8109880a7021a1f745b8d6a9c

Download Submit
C:\Windows\system\GwnLQtp.exe

Filesize
1.7MB

MD5
101891c3249b22ff198d23b98640819f

SHA1
b9cea0c668cd4d0e58856252dce4a871d2cb078d

SHA256
64da01ea1075d6568f2baeeee784126767a2ddd546a1e0417b74eaa6ba95e7d6

SHA512
169c2d985796fd122cfa109da7b22d2e8c29278a3f4d4a22fa82184ef6c37a04171aeb15da47a724cc1c2243fd0370679f12d5eac86f004b7b391577b6f07aaa

Download Submit
C:\Windows\system\KYTuJKp.exe

Filesize
1.7MB

MD5
f6b224b76c06fc803ca73029960f20a8

SHA1
8026a1bb6e0d8bb87fbb7ea9709b38b1680fd719

SHA256
c042f787f04db7ba2429c0ff7fb0f070ab2786802d46cd6ecdb26f70f81707d0

SHA512
49b83ec8727705e19ce0e41d8ce532b3b9365bbad3b76dd3acf26fceedd178ad51a818903cd79018164889c8f588c0e9821b1736bc0ac23cb17371b9489e20bc

Download Submit
C:\Windows\system\LWkHXAT.exe

Filesize
1.7MB

MD5
9d454cd36d7b5283cedfaaa55476c043

SHA1
1ddb3d3f45aff38ba56e36e68bc5b711f1660825

SHA256
258d71e67bd84220eb80e854abcf92ea0faa9193a62e2a87f1e461ff86d34c18

SHA512
37f1949dfebad16fa11dbe13a6ea02cc01c437c52aa81b64e8bb3fef437a503a34e1872d2b7d3bf9e6135ec6fdb842c60119dd310e727b127fc98abc05027798

Download Submit
C:\Windows\system\MwLgFoJ.exe

Filesize
1.7MB

MD5
1d003d06f547e3e28381a4661113aaf1

SHA1
f0d668cb3c4c9942b53c7b95185e6b61d90d166d

SHA256
0478d929fe4ef3a820d7ad08cda8d28fb00dca5ba862a0ad80f437041bddab1f

SHA512
a33be37577db1c20ccd19b30b24174d922f4b05918df1ff6cfa152ee5cc970c09a71e34aad99ac34da6ae39ba9e12b774a545e8e1867d6ddf73a1714564b5d28

Download Submit
C:\Windows\system\NOjWmEc.exe

Filesize
1.7MB

MD5
f0394626befc29b7d96ef5fa50cb6b4d

SHA1
20c4a55cd1c42383010d9cb59a845e3a63a5bf5e

SHA256
20eb2e64f42427ad9ca997ebc02097e302c0686b955076a1d4362e03f454e37b

SHA512
69704e4d513644c007f0fa8d68d2c46e5be70cede1113edb4bd77c720a369ebc72163a1abb8bea282e5e2a2aebf5c2c6b5e3e8510e448f5143fdb2da7bc774f0

Download Submit
C:\Windows\system\SmMJTCU.exe

Filesize
1.7MB

MD5
7c43fa7ea966006b2eb96671f3d60dbc

SHA1
3ca52c8a4f569034bf8b9c8e1dcbc8a3223b1a37

SHA256
b3db5f9d16705d410c3854d5d2be41371da1f56681d9729d7fc3152149cb3ffb

SHA512
ba43175ca31937ee3c535f4abc18a188a009b5f68c0fb0e0aba722d2e5a674b18e4cb5dd7acf3f2bd3186b17dfac3c21635776207c227cb8a0309e2227346da1

Download Submit
C:\Windows\system\SwfViYB.exe

Filesize
1.7MB

MD5
3defd9dbdd21304b00b3ce72509757d5

SHA1
8c1bed2eac1c7d121504ec091e421134bdc581fb

SHA256
ba86e82517dc436f80e37957db7b6d6804c9d73ac9c911d74fba4638350a7391

SHA512
8fdb6b2320a95621d79851bde69263829264335393225f7415d8159aa5c030f9168ce51a2a1cbadca9060fbd4607fdc6e9250adb075f1210fc9205684c683bad

Download Submit
C:\Windows\system\TLvMGLJ.exe

Filesize
1.7MB

MD5
21ab27f0443a0a45bba852f5334e64ab

SHA1
8c1a98e4eac55e69c8b48020282a4ee225192181

SHA256
9f5e18441bc43507b2f41a8a2b617b891c8910db6c9534c4b320ab0bf0f609c0

SHA512
bddb87ab87ab9baad0ec9c34b107291d7ba1bd7b1228d571a1fc52eb5e07210a0fb2249b631bffff3e07c723e58cf0dfe0ad84c108ae9a01ed85e1e007377f84

Download Submit
C:\Windows\system\UVWAxxe.exe

Filesize
1.7MB

MD5
41fa8cf19f86c1e9eb4dde6d01d03b08

SHA1
81f22ae4e749ba6c8a812aa7c6cdb66c4d573d56

SHA256
185e8b545a47b08cc8653c0bc5412d432bfeb014768de54455aa3eea04f06e56

SHA512
35b3ebc07b78fb31d995efcf30a2db5407d8f1dc76cc5a203c06ae8d05498f084de788f7c945a645236aa413bb26e122f1b137d5b6404c25fc2c89cfea4fc03f

Download Submit
C:\Windows\system\VNntPrz.exe

Filesize
1.7MB

MD5
5fef2ffaa07cef25c09d92149493f34a

SHA1
abd37c130d3373aaac8ca93f3a7332c72b73235f

SHA256
58c5a4c4576ad37018e1d7e1c5b5fadd126d86a79130b7a5c30acaef4f1cce0a

SHA512
ed01d36be1cf59a3f4a899940e85c5d099e25a84f067f5d7831055ff573cecb2bfa7772a14f9c7f2e9c576f9711b054c73c247525a509f6aa3e843fa971a9b1c

Download Submit
C:\Windows\system\ZCkOEBz.exe

Filesize
1.7MB

MD5
232c911aea98c12afdcdec36ce3899d1

SHA1
d61591967dcd90a36aa5fcd38c2addcba7f3e8b8

SHA256
d94023c968f000f95ec10f306bd6f1a2ef6d5d78060126db9431764a358924e1

SHA512
be2da89f56ced8f181940b7ed60a0f71e2fa12bffec68f189ffc08477b7cd4a266039a87ad7f784e79baced09279b9987786fc264e22291e3991d968b9099466

Download Submit
C:\Windows\system\ZDfbOsa.exe

Filesize
1.7MB

MD5
692b671f31591f00e0fd1794d80fd3da

SHA1
d986dfa3da7f469d15d815aa932a5a13d0018b22

SHA256
c07c9e6d2386679f6aae25b507e0b092201e0bfea656b4aa4246df4bfce26d96

SHA512
06f585324a2a72de0e06f6752ae2d030cd76c5023cdfaae0c92c27e90cb875b8c5e5624f93ee4ab3b9ecdbc7467e2849d5b0c62821c13eae6f1c919b69f9ff69

Download Submit
C:\Windows\system\cOLQfyV.exe

Filesize
1.7MB

MD5
359604ccbbd21ee45b9ef99f85ce0817

SHA1
25f88dde053a981cbf06e6ec950b87a4d9c67dff

SHA256
41632e55d29ffe70c6836d33bfcf563e6588ad2a79f58385ced13a9e61d05eb6

SHA512
e8d80e3706751142cfe3f58e622fa8ae797dd0bf42d44bccc43bd27f27e45ee7831caf16b93308a0f9172b9ea886c4876d879cb739424e1fd8c2c1b6da7b2e42

Download Submit
C:\Windows\system\ihLRFBe.exe

Filesize
1.7MB

MD5
8afa4b28c3c97374cba8ffca2e707c9b

SHA1
fd613f0d14c84c894704b5b7b05ef087a9e12142

SHA256
b7467c2ab7a56b5d91504b9a48fcbd882870fb7aa8412556dbf6d978f094e7ea

SHA512
0225b7f45480ff5cbaea64f37e858dc73cbb33b5e45e72d48765bdbb8f97ac867a6e8beb3c5a12cd1e4d14b7a70c0ce30d8665e6569bba85de55491abb818b3d

Download Submit
C:\Windows\system\lkdFWXu.exe

Filesize
1.7MB

MD5
620628c1f3b3174d05f9ca774d72d6a4

SHA1
f3cbdeec6c8b3b751724d4b5d3486b79f304cc05

SHA256
da0599138b891cff508eca591a543994046efaa37f33fb3ab8e2f4fc268ad71a

SHA512
ff532131066462f01be8a8976f99b93e023ccd0d183d766a0e156297a708af41f4b282ae600587ed256af50cc9e12c07dbe03643e263c2191e6061f554334d78

Download Submit
C:\Windows\system\tTLtMrm.exe

Filesize
1.7MB

MD5
d170b026ad5ae2eca6503886591ce87b

SHA1
5cf0a5533eb797b8ed4977d25318c32fd111de89

SHA256
4e82b6ed9e396a83a63a5f37adf527afb557610986fd8edf39b10defae429cb7

SHA512
462913a54efe0226f2b5a0af8155adf60c41d88ffeba9141ef7a57da6bccc03fc7e79fae57382387fa6b97e583dff28ef4ee31d10ea046bebadf67b3cbadc686

Download Submit
C:\Windows\system\tZEWsry.exe

Filesize
1.7MB

MD5
cf0db5578b4ca359f6be7b4b866f7b7e

SHA1
6111d42f6895e51d462ae3a384bc0fa0611187bb

SHA256
487d8ae29425dc0ae92bdf4244602aedba11e9a7b16d8f378961fa1070913e41

SHA512
f712c2b97edab2d10944ba98b3af6db77ddf03f324df565afa1e7912b74b608ac94ea6db7698b33fee2425b152de320bec023c22491c43a7f9747623265ff78b

Download Submit
C:\Windows\system\vruSRYZ.exe

Filesize
1.7MB

MD5
2b8ac44d82392de2e5a83a3c79afbd75

SHA1
fcd2f6ce5543d9cde91fe3abcfbb70a8979a95d1

SHA256
0d10c5e84b1bb3c6f8b480137c5f5348d91415c4c194244d288c71e5e8995fc3

SHA512
29b4e677035f1cad921891e629c997f397c56f8f67b4a6aa33afbd3a89c389a10d975dfa135ab474324ab04f5ca4e25bed2730eab8c742cbb4b779a8add90512

Download Submit
C:\Windows\system\yfPrXlg.exe

Filesize
1.7MB

MD5
4a9e2fb1586bb2b1230cdb41378ef2e6

SHA1
cb60e41735bd82229679de8452b3d455156a34d9

SHA256
913b2075a5cb859ea5734d53fecd647e12b84711d5887dc22deeba727441c9d9

SHA512
c345402fcb61901f2335a8cd614d0b3820f51a92dbda04a04a27d77176ec07c213968e0ed46dd31638a7ad431ebb0c358be8234e8fa89cb09bae7923128cc24f

Download Submit
C:\Windows\system\zXuVkHp.exe

Filesize
1.7MB

MD5
46ea543e7bf92c9088cd159d643cee18

SHA1
9fb40b2f0b929d0e6b0d6cef58caceed3a17a11d

SHA256
f5663a997c9060fddeeea1c1820e2c6947bb9beabe9003828395e67b8aede961

SHA512
4f6308087ea0e9e897c67ff73e4c0c12031f92fcc07c5a1f7fdde5e75222b881ca3e04d36bca12f62fa657abb38d9e8e636063ee6cc18f68db7f238eeca1e6c0

Download Submit
\Windows\system\EIIRDne.exe

Filesize
1.7MB

MD5
b61817ddd159df8fe0ac191ab76d81f5

SHA1
2952c204e1fc77c9ac260302191e1b8fcb91bc99

SHA256
392999d875306d234cdaf599f104578cf912e7f5e4d3e40d7d558cb743cf5cc3

SHA512
812b97d1535c07985a3a5441d51fda6a3e1a0fb62b63aa02b685a6ae48449e284ef813bf2aa0109d345bfcf2a27f9ce855939578a1ecffc25c5c358e853b98fc

Download Submit
\Windows\system\IQZxCGY.exe

Filesize
1.7MB

MD5
474dea0c7a7542f806f0ff8b6aca2567

SHA1
469aff4a8b28990ac28fb3b6a46a3763527ca473

SHA256
51e533bf19a3372ada31f3b72e3faf16fca280b51ef023ca884c1fe74a160463

SHA512
bc47ca4ed26f622ee9bd838eac1d12df0f22addda13de9220ce8966d42aed8d67c9cfb60ffcf0564421fd635c0f1c706dea31e2edf1d8abb5919208ae76e090c

Download Submit
\Windows\system\JEZhRIX.exe

Filesize
1.7MB

MD5
8c78e7e6f83a44257b789f0d9a05d56c

SHA1
11393c5459d968a5ee4ec64332907033ea29f297

SHA256
f6021dc28d2365c74b1d1c5868acb49635952a034ca8bf6ad65e976b80d90664

SHA512
27be2e5cb1e12c4ab70ca9daf4c42071ab39191b23e6f0967b672b144ffc99a3402468a6fb8fb4dab41d6b998183f5d702db12942ac9d9b971dfa59ea4aa7b0f

Download Submit
\Windows\system\MhkPBLK.exe

Filesize
1.7MB

MD5
d305174cd2f65bf01de2f22e4f3c64ea

SHA1
19d87d552717e2f346bd6c49068777dba1424508

SHA256
bbda0ab7e1564e5fac6b2da349e461c240367db6943fc90512429ebccbbf5ed3

SHA512
b2e7c7b7e17822f0819e93121a22f3d5897efd002b3e9982e51eda47019c7b89c244c5857cb318dfb7cdcc3df4838d785abfe3ccc2ddf574987ddae3c2dc734b

Download Submit
\Windows\system\QEJGJlV.exe

Filesize
1.7MB

MD5
328fa14367151cc7f89387e1f8155b91

SHA1
cdfd449079b8c71e8227119cc6c5a3b0e3ed1a12

SHA256
9a846ffdf8d45df5962e6c5f8cf518bfc401332d2d63f688ea98d2e37d1d4435

SHA512
6d2bd3f853ccbe7a7036573ee07debb3ee7819d96920f80b2628dc9bdcaec61899aca108ac2fd9e45513c58371601ab2d00822149b7e6234ba5c30563decdce5

Download Submit
\Windows\system\TtWvaBy.exe

Filesize
1.7MB

MD5
addd6692bdd52aaf8548d1a654a83238

SHA1
bfe55cd53784d49201d5f49d7ca934ffd544240a

SHA256
567b4e157dab9916001bf168bfbc84ce80731efadff40cbc40af1e10eaf5573f

SHA512
7f63599eb824d279a0d008840e59945a33ebafc1dd60f5f9a54de19112532d6cd58bca5190f04a20cebfb1ad7511315f1c29535e2d541b80d33a59bd0defab9f

Download Submit
\Windows\system\WKnqOrw.exe

Filesize
1.7MB

MD5
2f8ee864ff0ce6470aa5cc37c5b5bce8

SHA1
dbb3d50cd4c2aa775ef8a7f4603b31c250783278

SHA256
a54520410af472dff59d9cd8007ecd7fdb2684038e70486cbe1e4d701e54c283

SHA512
927c4f9605cdde6daf6d32a78866728582bc9a29be4fec56f189f2c7921e8e5dfe4f215a3dd54759675f9f9816ee6f34e7442cc318092fe16221224979de64d7

Download Submit
\Windows\system\WmLMtwW.exe

Filesize
1.7MB

MD5
3b39e8af8dc868d4917f94217fdb1121

SHA1
280daab7786c75ca74d3d75fe7fc9b184b4f9172

SHA256
8198341b27e49b09bac5f0f5dbc6f481ea560fc847c2e0f3a9f7302b390db2c2

SHA512
68e6b084594f21030414594a04144540d57dd8ddc2550fac84234b5d2e95959afbb0cbf44ed5375194a96e4a1aa8f9f4a048f033fee634ca78156e74ce4f8dc7

Download Submit
\Windows\system\YYpaZYR.exe

Filesize
1.7MB

MD5
1dfb775dce754fd1155a76a305cab179

SHA1
d2857de4c9cd36614ffcd6f04a9a3b00f975b40c

SHA256
80dbcda3a1b89107e01547bade22ca3a05e9ebc4e7365d9dd55e9c931a44f6f7

SHA512
834b48799e595e015dd384f41148afc0f0213d13cb97b9de88bec354aea5830cfba1e7b93138fd4055bdfde067a06c5629e35b52a41a7b79a8344468b2969b43

Download Submit
\Windows\system\bsXytGO.exe

Filesize
1.7MB

MD5
525926e0c62f7e52c959d048228d1455

SHA1
282b4e474f23aeda1b535b2e5c4cf2d3a5055972

SHA256
f4d96d20bf1c494b8decfce3cfda678414c10471ae10e43ef125cd685428720a

SHA512
266ba3d3163544fdb542e777951da587b1acc15c4e86dfc0d7b9b01dd606b9a5b7ff69434919e34aa70c06a61a53f454be9b32ef81e560365fee96ad4237e4e3

Download Submit
\Windows\system\dWNHGKj.exe

Filesize
1.7MB

MD5
bc8d9855091aa0face3f935cb36b03c1

SHA1
0b971c343f6af8b9e190b457ec1ebd411fa350fc

SHA256
0ac0bc9d7af3caf9099e1b1176993f50dd39dd53ceecf8a6cf0bc6552607a34b

SHA512
a7d33dac7d2a536c3570b8215f5c3a5b637e86aec2074207aecd2e5c9af389f7d4709bf5c6dc8b77c06b5195da17dba47f5251228575d2de0718dd8237a86cd8

Download Submit
\Windows\system\faIBroi.exe

Filesize
1.7MB

MD5
9bddc1de72f07ca6dcbc54afeb94cf71

SHA1
3a6b9783418878926498d4f4c1a33657b0da79fd

SHA256
95420b1639e912e827bd086bed86d5bc32d1671d3c071058915a0bff87fc608d

SHA512
5b024839b96e4ec3e9fbaa36a831868f0dbdc3bac3e58c5ebd46c5a39c6ad3036d9eb27a65470e8e450a153e16a45f307620a951c25bc764938d199b75bc5f85

Download Submit
\Windows\system\hJSogda.exe

Filesize
1.7MB

MD5
db22dc607b685f53171d775375e8170d

SHA1
028eef06b795b4f2b918025fcd926e64f5ae4c35

SHA256
8fa867a3eaf2e2e1e5b91c7fb5e5b453c23890580cae2a4fa52dcafbea81c1ab

SHA512
9db793c4c8c8a323d7c22c1ba1b9539dc3c0c093e8186faeb016f15e4f836eab4d38588bf8f4224430d55ea87e8a7000a97bec9b4c81e19b0faf8caf6b843a8b

Download Submit
\Windows\system\iInqAQO.exe

Filesize
1.7MB

MD5
07deb6f8a6978c27087a6c06e904e108

SHA1
4186eeb1e79eddde0dfa11848468784df24568e8

SHA256
21fa3ac882b01693617701632a8eda797f15234335dd5c35658b50e91318427e

SHA512
697fba382ef2e189bd98bc6a8b0fb86d48ed867395202cd0ef2c497f43cd12ad0135b1498bcaca55708c177420e9a11a5249fda893ade7ecc25a3bb3ab7cc2d1

Download Submit
\Windows\system\mDdrLqa.exe

Filesize
1.7MB

MD5
daeff5f8de96ffa7956aeb21c5e6734d

SHA1
3b6186e43c1d75e99c8915b86ce3ae4d9eb01a83

SHA256
ff1e394f32312eb1e494fe4bc2fa475654fe9bbdaf58b3c326a93d6c509235e9

SHA512
271b08583948d118b59e5115d0fc02be2d23c96c56faeac757b9ae99f73de1bbfb47f8e29c7d14e3f45d94ae7492e914fec0edac241278915dd09fd6b7ff7db7

Download Submit
\Windows\system\nZonZlr.exe

Filesize
1.7MB

MD5
29b4b2dac2bd139265ef7fc3a3e3986d

SHA1
752091bd6beafe9d6a44dd0eda16c3ba3f90e804

SHA256
1d5b46cd272b84816de18b008bb52d8542ec379fafec5c1d06876e8aa025aaac

SHA512
56060d4d5bd41fd1a9ec6ddfa6db65d31cef103525cbc9b7f79a60deb590c232dfbcb41fb7f200cc3660f8a8369316aaed8fbcece18ccf75b36e4575e64f54d3

Download Submit
\Windows\system\oAMrflk.exe

Filesize
1.7MB

MD5
6638b968c61b95a598be9a69b56b5d2c

SHA1
33d4a8afcd828507524c95ec1b7cff0d58d8975d

SHA256
842259b8a1d28063756feae82420beec690844f20235246bf771cc4c32d72977

SHA512
53db2331b997eb0e51a3b7985d4b5b84e099ef12b9da6edd8eaa9dcfbbd1fa51dcbb1f9d84a915540ba8b9ef6994c626c796506e879506f5bd51f2ee3fb0a181

Download Submit
\Windows\system\qdoLnje.exe

Filesize
1.7MB

MD5
14cb37fb215e507b97bcedbf84d20b8a

SHA1
1931fe16f1f1edaa93c35a7aec97626daef673fb

SHA256
3134dc2e1a63e743c8f8cfbe503e04b4542c43fe1873acc99cda9ee3843ad070

SHA512
b3e6a991da6a204ed1db18ca807001f3b5df7dc8952345e5fdd8a48cab22082e0c1d17e14793df0ceb46b3b1b8f67606f5a1cd2073f4bb339df98f6b171b352e

Download Submit
\Windows\system\tOUetFE.exe

Filesize
1.7MB

MD5
058ad82a09dddc12cc8953a45d63e6df

SHA1
f8453a921ce0e60ddab14ec591dc08859e9ac345

SHA256
daa4f43f560767f93c30d0ea35fcff48a99322f2c9335346b807de2bd11f7ab7

SHA512
149f746a7bbe6a05fc88ae84ff4523c7e0155adfe865819c2305be17ccd187441d34d5d968287ca7814a9c3af05ed05baa81b96f5d05f3f581479da7af1de28a

Download Submit
memory/2040-12-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2040-1166-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2168-7-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2168-52-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-81-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-45-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2168-48-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2168-60-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-909-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2168-42-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2168-73-0x0000000003630000-0x0000000003A22000-memory.dmp

Filesize
3.9MB

Download
memory/2168-0-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2168-1-0x000000013F390000-0x000000013F782000-memory.dmp

Filesize
3.9MB

Download
memory/2168-50-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2528-55-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2548-47-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2596-51-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2600-38-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-34-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2600-41-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-53-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2600-40-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2600-37-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2600-352-0x000007FEF5760000-0x000007FEF60FD000-memory.dmp

Filesize
9.6MB

Download
memory/2600-54-0x0000000002CC0000-0x0000000002D40000-memory.dmp

Filesize
512KB

Download
memory/2632-44-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2652-68-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2712-49-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2936-74-0x000000013F180000-0x000000013F572000-memory.dmp

Filesize
3.9MB

Download
memory/2968-62-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download