xmrig | c55f43a7efc9a3aac2921be14983ac681ee108ce79395414cd8b88906a91a265

Analysis

max time kernel
27s
max time network
38s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
Size

2.0MB
MD5

0b7f68c5a9a307f5ee061cc5d9303371
SHA1

c0572f94f5ccbf1b7b373e4443bdb7cb768f7c90
SHA256

c55f43a7efc9a3aac2921be14983ac681ee108ce79395414cd8b88906a91a265
SHA512

357439768237918dc955b5d3a214730ede097e14d48937e3ea46114e1a0cfc51b89a9acdce8779c43cae80b71afcab07386ea1db71fa8f1b60b8a71108aea41b
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4p/pOMn+v:NABC

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2724-194-0x000000013F320000-0x000000013F712000-memory.dmp	xmrig
behavioral1/memory/2108-191-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2024-187-0x000000013F840000-0x000000013FC32000-memory.dmp	xmrig
behavioral1/memory/2972-178-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	xmrig
behavioral1/memory/2504-171-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2424-162-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2456-154-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2584-153-0x000000013FA00000-0x000000013FDF2000-memory.dmp	xmrig
behavioral1/memory/2576-152-0x000000013F860000-0x000000013FC52000-memory.dmp	xmrig
behavioral1/memory/2436-151-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2332-150-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	xmrig
behavioral1/memory/2764-21-0x000000013F680000-0x000000013FA72000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2764	AWxfkXI.exe
2332	EXMWchu.exe
2108	rApnXjU.exe
2724	hVDhoyj.exe
2436	JULWDGn.exe
2576	ukINkgA.exe
2584	InGbiBv.exe
2456	FPeSRkh.exe
2424	zmTTAtt.exe
2504	PIpYDBs.exe
2972	TOZfIyB.exe
2024	YuHaQIr.exe
2648	HOiqfOC.exe
2776	hLmjGsX.exe
2812	MOwmWft.exe
2840	MEpEerB.exe
2488	nHoipkF.exe
2240	WkDUoCj.exe
500	wtParhg.exe
1696	ZKQsYdd.exe
2012	JqbRhyO.exe
896	cFvhdXK.exe
2676	vdnafiI.exe
1068	GsAnYid.exe
1572	jAPcftJ.exe
2680	mbMxyMq.exe
2096	LHglSAF.exe
1480	wyNeFXb.exe
1808	kIUqxOL.exe
448	RqqewOi.exe
2064	QUeKYZn.exe
1768	UsqMtHt.exe
760	nicrxxe.exe
1628	LHtCNVD.exe
1304	dOIWYcN.exe
624	uxlyaxZ.exe
1680	pCWKTeO.exe
1252	UfbETZp.exe
2248	wFXPhDt.exe
1532	WKdudfH.exe
1324	gJgBgGm.exe
1804	iMLEzUE.exe
1872	kRVsAOM.exe
1944	ouoFanC.exe
1708	TxrkKzA.exe
2204	hNUTDJx.exe
852	KLnaDrn.exe
1756	pfxgGNH.exe
1452	GxcXmBX.exe
320	iPfFnQe.exe
1600	CwDKXCq.exe
1648	MoZAaJA.exe
2532	JpCBSoI.exe
2692	SiMwDIg.exe
2600	lfgVzuz.exe
2476	bhLmwkS.exe
1000	OvLCkQu.exe
3024	ncLldax.exe
2640	mwibbjt.exe
2804	EnsvbDN.exe
804	pLaFjRa.exe
1376	LCjTNiq.exe
812	EWVZFXU.exe
1776	qKTtTEX.exe

Loads dropped DLL 64 IoCs

pid	Process
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0009000000014971-38.dat	upx
behavioral1/files/0x0006000000015be6-57.dat	upx
behavioral1/files/0x0007000000015cba-66.dat	upx
behavioral1/files/0x0006000000015ceb-81.dat	upx
behavioral1/files/0x0006000000015d07-86.dat	upx
behavioral1/files/0x0006000000015d67-111.dat	upx
behavioral1/files/0x0006000000015d87-126.dat	upx
behavioral1/memory/2724-194-0x000000013F320000-0x000000013F712000-memory.dmp	upx
behavioral1/memory/2108-191-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x000600000001661c-188.dat	upx
behavioral1/files/0x00060000000164b2-180.dat	upx
behavioral1/files/0x00060000000161e7-173.dat	upx
behavioral1/files/0x0006000000015fe9-165.dat	upx
behavioral1/files/0x0006000000015eaf-157.dat	upx
behavioral1/files/0x0006000000016843-192.dat	upx
behavioral1/memory/2024-187-0x000000013F840000-0x000000013FC32000-memory.dmp	upx
behavioral1/files/0x0006000000016572-184.dat	upx
behavioral1/memory/2972-178-0x000000013F3B0000-0x000000013F7A2000-memory.dmp	upx
behavioral1/memory/2504-171-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x0006000000016117-168.dat	upx
behavioral1/memory/2424-162-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x000600000001630b-176.dat	upx
behavioral1/files/0x0006000000015f6d-160.dat	upx
behavioral1/memory/2456-154-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2584-153-0x000000013FA00000-0x000000013FDF2000-memory.dmp	upx
behavioral1/memory/2576-152-0x000000013F860000-0x000000013FC52000-memory.dmp	upx
behavioral1/memory/2436-151-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2332-150-0x000000013F6E0000-0x000000013FAD2000-memory.dmp	upx
behavioral1/files/0x00320000000144f0-146.dat	upx
behavioral1/files/0x0006000000015e3a-142.dat	upx
behavioral1/files/0x0006000000015d8f-131.dat	upx
behavioral1/files/0x0006000000015d9b-136.dat	upx
behavioral1/files/0x0006000000015d79-121.dat	upx
behavioral1/files/0x0006000000015d6f-116.dat	upx
behavioral1/files/0x0006000000015d56-101.dat	upx
behavioral1/files/0x0006000000015d5e-106.dat	upx
behavioral1/files/0x0006000000015d4a-96.dat	upx
behavioral1/files/0x0006000000015d28-91.dat	upx
behavioral1/files/0x0006000000015ce1-76.dat	upx
behavioral1/files/0x0006000000015cd5-71.dat	upx
behavioral1/files/0x0007000000004e76-62.dat	upx
behavioral1/files/0x000700000001568c-43.dat	upx
behavioral1/files/0x0007000000014857-42.dat	upx
behavioral1/files/0x000700000001471d-41.dat	upx
behavioral1/files/0x0007000000014726-35.dat	upx
behavioral1/files/0x00080000000146e6-32.dat	upx
behavioral1/files/0x000b00000001424e-29.dat	upx
behavioral1/memory/2764-21-0x000000013F680000-0x000000013FA72000-memory.dmp	upx
behavioral1/files/0x00320000000144e4-12.dat	upx
behavioral1/memory/2856-4-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AjyLZxf.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\ZdcKsjV.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\kxzFARU.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\XxGNMzC.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\pRhrugP.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\KRzCyQQ.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\feOaLGH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\kBQnwvc.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\vlhlBKq.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\JexGXOa.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\sSlkaCu.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\DMOSSLp.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\FxyIREf.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\vGgAXaH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\efPCHxZ.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\AMVlzuz.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\OIKfGNH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\JQVkPyf.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\NAxhksN.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\oZWNjVo.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\FqbGcrn.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\KASIENa.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\chQAhta.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\wHSvaqj.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\WwlfYqG.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\lnDmOAv.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\YuHaQIr.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\CzqCTDo.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\lieufrx.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\LnsYTft.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\SXqpvhN.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\PdkAZwy.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\CJNNsQi.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\wDnETIl.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\vmJTyQI.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\bxWuVfU.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\XkHeLor.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\zrNNSWF.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\PCwSrox.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\WUFPKxn.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\vGTPzqa.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\RxZFeGj.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\oabinsX.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\yUuxvfH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\PDGuoco.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\kGCIyLb.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\HYoYYuc.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\hwkPHqe.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\qbSCSrg.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\UktBpOv.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\fgHAqSa.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\lgxubCA.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\msqlnnr.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\NwXaxpg.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\EuVEqcv.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\JqbRhyO.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\nNLBnKH.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\QssWEYU.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\eHDXlyn.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\sATmFWP.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\KFTTPyz.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\evUftyD.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\yKumKEr.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
File created	C:\Windows\System\ksABAcm.exe	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1984	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeLockMemoryPrivilege	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 1984	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	29
PID 2856 wrote to memory of 1984	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	29
PID 2856 wrote to memory of 1984	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	29
PID 2856 wrote to memory of 2332	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2332	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2332	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	30
PID 2856 wrote to memory of 2764	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2764	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2764	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	31
PID 2856 wrote to memory of 2108	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2108	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2108	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	32
PID 2856 wrote to memory of 2576	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2576	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2576	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	33
PID 2856 wrote to memory of 2724	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2724	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2724	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	34
PID 2856 wrote to memory of 2584	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2584	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2584	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	35
PID 2856 wrote to memory of 2436	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2436	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2436	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	36
PID 2856 wrote to memory of 2456	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2456	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2456	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	37
PID 2856 wrote to memory of 2424	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	38
PID 2856 wrote to memory of 2424	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	38
PID 2856 wrote to memory of 2424	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	38
PID 2856 wrote to memory of 2504	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2504	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2504	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	39
PID 2856 wrote to memory of 2972	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	40
PID 2856 wrote to memory of 2972	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	40
PID 2856 wrote to memory of 2972	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	40
PID 2856 wrote to memory of 2024	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2024	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2024	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	41
PID 2856 wrote to memory of 2648	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	42
PID 2856 wrote to memory of 2648	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	42
PID 2856 wrote to memory of 2648	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	42
PID 2856 wrote to memory of 2776	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2776	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2776	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	43
PID 2856 wrote to memory of 2812	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	44
PID 2856 wrote to memory of 2812	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	44
PID 2856 wrote to memory of 2812	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	44
PID 2856 wrote to memory of 2840	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2840	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2840	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	45
PID 2856 wrote to memory of 2488	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2488	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2488	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	46
PID 2856 wrote to memory of 2240	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2240	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	47
PID 2856 wrote to memory of 2240	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	47
PID 2856 wrote to memory of 500	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	48
PID 2856 wrote to memory of 500	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	48
PID 2856 wrote to memory of 500	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	48
PID 2856 wrote to memory of 1696	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	49
PID 2856 wrote to memory of 1696	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	49
PID 2856 wrote to memory of 1696	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	49
PID 2856 wrote to memory of 2012	2856	0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b7f68c5a9a307f5ee061cc5d9303371_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1984
- C:\Windows\System\EXMWchu.exe
  C:\Windows\System\EXMWchu.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\AWxfkXI.exe
  C:\Windows\System\AWxfkXI.exe
  2⤵
  - Executes dropped EXE
  PID:2764
- C:\Windows\System\rApnXjU.exe
  C:\Windows\System\rApnXjU.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\ukINkgA.exe
  C:\Windows\System\ukINkgA.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\hVDhoyj.exe
  C:\Windows\System\hVDhoyj.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\InGbiBv.exe
  C:\Windows\System\InGbiBv.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\JULWDGn.exe
  C:\Windows\System\JULWDGn.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\FPeSRkh.exe
  C:\Windows\System\FPeSRkh.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\zmTTAtt.exe
  C:\Windows\System\zmTTAtt.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\PIpYDBs.exe
  C:\Windows\System\PIpYDBs.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\TOZfIyB.exe
  C:\Windows\System\TOZfIyB.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\YuHaQIr.exe
  C:\Windows\System\YuHaQIr.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\HOiqfOC.exe
  C:\Windows\System\HOiqfOC.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\hLmjGsX.exe
  C:\Windows\System\hLmjGsX.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\MOwmWft.exe
  C:\Windows\System\MOwmWft.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\MEpEerB.exe
  C:\Windows\System\MEpEerB.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\nHoipkF.exe
  C:\Windows\System\nHoipkF.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\WkDUoCj.exe
  C:\Windows\System\WkDUoCj.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\wtParhg.exe
  C:\Windows\System\wtParhg.exe
  2⤵
  - Executes dropped EXE
  PID:500
- C:\Windows\System\ZKQsYdd.exe
  C:\Windows\System\ZKQsYdd.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\JqbRhyO.exe
  C:\Windows\System\JqbRhyO.exe
  2⤵
  - Executes dropped EXE
  PID:2012
- C:\Windows\System\cFvhdXK.exe
  C:\Windows\System\cFvhdXK.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\vdnafiI.exe
  C:\Windows\System\vdnafiI.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\GsAnYid.exe
  C:\Windows\System\GsAnYid.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\jAPcftJ.exe
  C:\Windows\System\jAPcftJ.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\mbMxyMq.exe
  C:\Windows\System\mbMxyMq.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\LHglSAF.exe
  C:\Windows\System\LHglSAF.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\dOIWYcN.exe
  C:\Windows\System\dOIWYcN.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\wyNeFXb.exe
  C:\Windows\System\wyNeFXb.exe
  2⤵
  - Executes dropped EXE
  PID:1480
- C:\Windows\System\pCWKTeO.exe
  C:\Windows\System\pCWKTeO.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kIUqxOL.exe
  C:\Windows\System\kIUqxOL.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\UfbETZp.exe
  C:\Windows\System\UfbETZp.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\RqqewOi.exe
  C:\Windows\System\RqqewOi.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\wFXPhDt.exe
  C:\Windows\System\wFXPhDt.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\QUeKYZn.exe
  C:\Windows\System\QUeKYZn.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\WKdudfH.exe
  C:\Windows\System\WKdudfH.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\UsqMtHt.exe
  C:\Windows\System\UsqMtHt.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\gJgBgGm.exe
  C:\Windows\System\gJgBgGm.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\nicrxxe.exe
  C:\Windows\System\nicrxxe.exe
  2⤵
  - Executes dropped EXE
  PID:760
- C:\Windows\System\iMLEzUE.exe
  C:\Windows\System\iMLEzUE.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\LHtCNVD.exe
  C:\Windows\System\LHtCNVD.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\kRVsAOM.exe
  C:\Windows\System\kRVsAOM.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\uxlyaxZ.exe
  C:\Windows\System\uxlyaxZ.exe
  2⤵
  - Executes dropped EXE
  PID:624
- C:\Windows\System\hNUTDJx.exe
  C:\Windows\System\hNUTDJx.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\ouoFanC.exe
  C:\Windows\System\ouoFanC.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\KLnaDrn.exe
  C:\Windows\System\KLnaDrn.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\TxrkKzA.exe
  C:\Windows\System\TxrkKzA.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\pfxgGNH.exe
  C:\Windows\System\pfxgGNH.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\GxcXmBX.exe
  C:\Windows\System\GxcXmBX.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\iPfFnQe.exe
  C:\Windows\System\iPfFnQe.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\CwDKXCq.exe
  C:\Windows\System\CwDKXCq.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\MoZAaJA.exe
  C:\Windows\System\MoZAaJA.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\JpCBSoI.exe
  C:\Windows\System\JpCBSoI.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\SiMwDIg.exe
  C:\Windows\System\SiMwDIg.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\lfgVzuz.exe
  C:\Windows\System\lfgVzuz.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\bhLmwkS.exe
  C:\Windows\System\bhLmwkS.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\OvLCkQu.exe
  C:\Windows\System\OvLCkQu.exe
  2⤵
  - Executes dropped EXE
  PID:1000
- C:\Windows\System\ncLldax.exe
  C:\Windows\System\ncLldax.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\mwibbjt.exe
  C:\Windows\System\mwibbjt.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\EnsvbDN.exe
  C:\Windows\System\EnsvbDN.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\pLaFjRa.exe
  C:\Windows\System\pLaFjRa.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\LCjTNiq.exe
  C:\Windows\System\LCjTNiq.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\EWVZFXU.exe
  C:\Windows\System\EWVZFXU.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\qKTtTEX.exe
  C:\Windows\System\qKTtTEX.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ioBZFsv.exe
  C:\Windows\System\ioBZFsv.exe
  2⤵
  PID:1072
- C:\Windows\System\xdmyoYw.exe
  C:\Windows\System\xdmyoYw.exe
  2⤵
  PID:2652
- C:\Windows\System\eHdXWjc.exe
  C:\Windows\System\eHdXWjc.exe
  2⤵
  PID:1636
- C:\Windows\System\GckTrrd.exe
  C:\Windows\System\GckTrrd.exe
  2⤵
  PID:2556
- C:\Windows\System\yBmZbMb.exe
  C:\Windows\System\yBmZbMb.exe
  2⤵
  PID:2732
- C:\Windows\System\prZeXIz.exe
  C:\Windows\System\prZeXIz.exe
  2⤵
  PID:2416
- C:\Windows\System\oXNXGJd.exe
  C:\Windows\System\oXNXGJd.exe
  2⤵
  PID:1672
- C:\Windows\System\LVDjwvH.exe
  C:\Windows\System\LVDjwvH.exe
  2⤵
  PID:2580
- C:\Windows\System\tlhYXMY.exe
  C:\Windows\System\tlhYXMY.exe
  2⤵
  PID:532
- C:\Windows\System\vGgAXaH.exe
  C:\Windows\System\vGgAXaH.exe
  2⤵
  PID:1780
- C:\Windows\System\ZoRvMuI.exe
  C:\Windows\System\ZoRvMuI.exe
  2⤵
  PID:3020
- C:\Windows\System\tztmmys.exe
  C:\Windows\System\tztmmys.exe
  2⤵
  PID:1740
- C:\Windows\System\dQTaPQp.exe
  C:\Windows\System\dQTaPQp.exe
  2⤵
  PID:2412
- C:\Windows\System\IXmHIBV.exe
  C:\Windows\System\IXmHIBV.exe
  2⤵
  PID:2044
- C:\Windows\System\cRdcdHT.exe
  C:\Windows\System\cRdcdHT.exe
  2⤵
  PID:2132
- C:\Windows\System\ryoINEB.exe
  C:\Windows\System\ryoINEB.exe
  2⤵
  PID:1764
- C:\Windows\System\zcfqxjY.exe
  C:\Windows\System\zcfqxjY.exe
  2⤵
  PID:2176
- C:\Windows\System\xyHGqcm.exe
  C:\Windows\System\xyHGqcm.exe
  2⤵
  PID:2872
- C:\Windows\System\vOcfiAN.exe
  C:\Windows\System\vOcfiAN.exe
  2⤵
  PID:1544
- C:\Windows\System\REcNDdP.exe
  C:\Windows\System\REcNDdP.exe
  2⤵
  PID:836
- C:\Windows\System\OcILNAs.exe
  C:\Windows\System\OcILNAs.exe
  2⤵
  PID:684
- C:\Windows\System\SdMpQlm.exe
  C:\Windows\System\SdMpQlm.exe
  2⤵
  PID:1536
- C:\Windows\System\oVsdpZS.exe
  C:\Windows\System\oVsdpZS.exe
  2⤵
  PID:2336
- C:\Windows\System\dUkEBCS.exe
  C:\Windows\System\dUkEBCS.exe
  2⤵
  PID:3060
- C:\Windows\System\PUguZEo.exe
  C:\Windows\System\PUguZEo.exe
  2⤵
  PID:2284
- C:\Windows\System\sFfyofB.exe
  C:\Windows\System\sFfyofB.exe
  2⤵
  PID:2188
- C:\Windows\System\rRoyCjs.exe
  C:\Windows\System\rRoyCjs.exe
  2⤵
  PID:1568
- C:\Windows\System\YpiwsBl.exe
  C:\Windows\System\YpiwsBl.exe
  2⤵
  PID:3040
- C:\Windows\System\QnGhPlW.exe
  C:\Windows\System\QnGhPlW.exe
  2⤵
  PID:1996
- C:\Windows\System\PIJXQTg.exe
  C:\Windows\System\PIJXQTg.exe
  2⤵
  PID:1196
- C:\Windows\System\lHzcWpb.exe
  C:\Windows\System\lHzcWpb.exe
  2⤵
  PID:2588
- C:\Windows\System\krTaTej.exe
  C:\Windows\System\krTaTej.exe
  2⤵
  PID:2596
- C:\Windows\System\wmhkPxe.exe
  C:\Windows\System\wmhkPxe.exe
  2⤵
  PID:3032
- C:\Windows\System\zncnPty.exe
  C:\Windows\System\zncnPty.exe
  2⤵
  PID:2628
- C:\Windows\System\VwqChmr.exe
  C:\Windows\System\VwqChmr.exe
  2⤵
  PID:2772
- C:\Windows\System\mxTwhSU.exe
  C:\Windows\System\mxTwhSU.exe
  2⤵
  PID:612
- C:\Windows\System\juKrlkn.exe
  C:\Windows\System\juKrlkn.exe
  2⤵
  PID:1448
- C:\Windows\System\GQWXvEn.exe
  C:\Windows\System\GQWXvEn.exe
  2⤵
  PID:2660
- C:\Windows\System\MvyCHip.exe
  C:\Windows\System\MvyCHip.exe
  2⤵
  PID:1792
- C:\Windows\System\OVIadsT.exe
  C:\Windows\System\OVIadsT.exe
  2⤵
  PID:1576
- C:\Windows\System\UTYgLRY.exe
  C:\Windows\System\UTYgLRY.exe
  2⤵
  PID:2144
- C:\Windows\System\zNuAYGx.exe
  C:\Windows\System\zNuAYGx.exe
  2⤵
  PID:2688
- C:\Windows\System\fhPCqro.exe
  C:\Windows\System\fhPCqro.exe
  2⤵
  PID:1104
- C:\Windows\System\UvzYIoA.exe
  C:\Windows\System\UvzYIoA.exe
  2⤵
  PID:2400
- C:\Windows\System\DkZRMBe.exe
  C:\Windows\System\DkZRMBe.exe
  2⤵
  PID:2464
- C:\Windows\System\EYgQEKr.exe
  C:\Windows\System\EYgQEKr.exe
  2⤵
  PID:2496
- C:\Windows\System\ALPRyzR.exe
  C:\Windows\System\ALPRyzR.exe
  2⤵
  PID:2844
- C:\Windows\System\LIJyFAy.exe
  C:\Windows\System\LIJyFAy.exe
  2⤵
  PID:2168
- C:\Windows\System\ClJfqkG.exe
  C:\Windows\System\ClJfqkG.exe
  2⤵
  PID:2860
- C:\Windows\System\eBrEjHD.exe
  C:\Windows\System\eBrEjHD.exe
  2⤵
  PID:2072
- C:\Windows\System\KYMUMqs.exe
  C:\Windows\System\KYMUMqs.exe
  2⤵
  PID:2352
- C:\Windows\System\LSnFGZi.exe
  C:\Windows\System\LSnFGZi.exe
  2⤵
  PID:1992
- C:\Windows\System\BdFtvSN.exe
  C:\Windows\System\BdFtvSN.exe
  2⤵
  PID:1644
- C:\Windows\System\xaoTkuj.exe
  C:\Windows\System\xaoTkuj.exe
  2⤵
  PID:1512
- C:\Windows\System\UwChoLT.exe
  C:\Windows\System\UwChoLT.exe
  2⤵
  PID:2340
- C:\Windows\System\syCzbJd.exe
  C:\Windows\System\syCzbJd.exe
  2⤵
  PID:2564
- C:\Windows\System\YQqOlFu.exe
  C:\Windows\System\YQqOlFu.exe
  2⤵
  PID:2748
- C:\Windows\System\pwodsoG.exe
  C:\Windows\System\pwodsoG.exe
  2⤵
  PID:2316
- C:\Windows\System\mBAfvkn.exe
  C:\Windows\System\mBAfvkn.exe
  2⤵
  PID:2768
- C:\Windows\System\trvKjCQ.exe
  C:\Windows\System\trvKjCQ.exe
  2⤵
  PID:2800
- C:\Windows\System\SXqpvhN.exe
  C:\Windows\System\SXqpvhN.exe
  2⤵
  PID:1812
- C:\Windows\System\XZTSmpK.exe
  C:\Windows\System\XZTSmpK.exe
  2⤵
  PID:756
- C:\Windows\System\aQvLDiR.exe
  C:\Windows\System\aQvLDiR.exe
  2⤵
  PID:1128
- C:\Windows\System\JRldTUQ.exe
  C:\Windows\System\JRldTUQ.exe
  2⤵
  PID:488
- C:\Windows\System\NHbjyQX.exe
  C:\Windows\System\NHbjyQX.exe
  2⤵
  PID:1700
- C:\Windows\System\SYzasaq.exe
  C:\Windows\System\SYzasaq.exe
  2⤵
  PID:2016
- C:\Windows\System\MjVoRVJ.exe
  C:\Windows\System\MjVoRVJ.exe
  2⤵
  PID:1288
- C:\Windows\System\SNcwoyG.exe
  C:\Windows\System\SNcwoyG.exe
  2⤵
  PID:2900
- C:\Windows\System\koQyTUt.exe
  C:\Windows\System\koQyTUt.exe
  2⤵
  PID:1136
- C:\Windows\System\PVNYjHw.exe
  C:\Windows\System\PVNYjHw.exe
  2⤵
  PID:884
- C:\Windows\System\YUvwAdy.exe
  C:\Windows\System\YUvwAdy.exe
  2⤵
  PID:2820
- C:\Windows\System\XyAtkTT.exe
  C:\Windows\System\XyAtkTT.exe
  2⤵
  PID:2032
- C:\Windows\System\vlhlBKq.exe
  C:\Windows\System\vlhlBKq.exe
  2⤵
  PID:2448
- C:\Windows\System\UMXmDlL.exe
  C:\Windows\System\UMXmDlL.exe
  2⤵
  PID:3068
- C:\Windows\System\SHBlpUF.exe
  C:\Windows\System\SHBlpUF.exe
  2⤵
  PID:2944
- C:\Windows\System\vmadKDI.exe
  C:\Windows\System\vmadKDI.exe
  2⤵
  PID:2712
- C:\Windows\System\mNpWrDx.exe
  C:\Windows\System\mNpWrDx.exe
  2⤵
  PID:2832
- C:\Windows\System\lmQixyH.exe
  C:\Windows\System\lmQixyH.exe
  2⤵
  PID:992
- C:\Windows\System\tSIAPLk.exe
  C:\Windows\System\tSIAPLk.exe
  2⤵
  PID:1692
- C:\Windows\System\xEWMgmq.exe
  C:\Windows\System\xEWMgmq.exe
  2⤵
  PID:2968
- C:\Windows\System\Ybvdbpz.exe
  C:\Windows\System\Ybvdbpz.exe
  2⤵
  PID:956
- C:\Windows\System\ncfCEMD.exe
  C:\Windows\System\ncfCEMD.exe
  2⤵
  PID:2836
- C:\Windows\System\kCtZVmr.exe
  C:\Windows\System\kCtZVmr.exe
  2⤵
  PID:2920
- C:\Windows\System\YMdSoth.exe
  C:\Windows\System\YMdSoth.exe
  2⤵
  PID:3028
- C:\Windows\System\yKhmjJw.exe
  C:\Windows\System\yKhmjJw.exe
  2⤵
  PID:1620
- C:\Windows\System\xvnriXF.exe
  C:\Windows\System\xvnriXF.exe
  2⤵
  PID:1904
- C:\Windows\System\KwmfhEv.exe
  C:\Windows\System\KwmfhEv.exe
  2⤵
  PID:1044
- C:\Windows\System\DBLFzIx.exe
  C:\Windows\System\DBLFzIx.exe
  2⤵
  PID:2232
- C:\Windows\System\gnYMJLC.exe
  C:\Windows\System\gnYMJLC.exe
  2⤵
  PID:2984
- C:\Windows\System\BfiEcBJ.exe
  C:\Windows\System\BfiEcBJ.exe
  2⤵
  PID:2052
- C:\Windows\System\zDjkmjm.exe
  C:\Windows\System\zDjkmjm.exe
  2⤵
  PID:2816
- C:\Windows\System\XxGNMzC.exe
  C:\Windows\System\XxGNMzC.exe
  2⤵
  PID:1748
- C:\Windows\System\DgyFymG.exe
  C:\Windows\System\DgyFymG.exe
  2⤵
  PID:1504
- C:\Windows\System\GVOsfYl.exe
  C:\Windows\System\GVOsfYl.exe
  2⤵
  PID:2784
- C:\Windows\System\khhKVdU.exe
  C:\Windows\System\khhKVdU.exe
  2⤵
  PID:2796
- C:\Windows\System\aYMxfJb.exe
  C:\Windows\System\aYMxfJb.exe
  2⤵
  PID:2500
- C:\Windows\System\vXGGtAy.exe
  C:\Windows\System\vXGGtAy.exe
  2⤵
  PID:1108
- C:\Windows\System\JKtAagN.exe
  C:\Windows\System\JKtAagN.exe
  2⤵
  PID:1860
- C:\Windows\System\AfVkvUN.exe
  C:\Windows\System\AfVkvUN.exe
  2⤵
  PID:2604
- C:\Windows\System\DSrkUFR.exe
  C:\Windows\System\DSrkUFR.exe
  2⤵
  PID:1388
- C:\Windows\System\dUDuKwE.exe
  C:\Windows\System\dUDuKwE.exe
  2⤵
  PID:2892
- C:\Windows\System\MhyAgcf.exe
  C:\Windows\System\MhyAgcf.exe
  2⤵
  PID:2752
- C:\Windows\System\SldkoAY.exe
  C:\Windows\System\SldkoAY.exe
  2⤵
  PID:2624
- C:\Windows\System\ErgITlb.exe
  C:\Windows\System\ErgITlb.exe
  2⤵
  PID:2432
- C:\Windows\System\QdpeVmA.exe
  C:\Windows\System\QdpeVmA.exe
  2⤵
  PID:2924
- C:\Windows\System\YaHgYxo.exe
  C:\Windows\System\YaHgYxo.exe
  2⤵
  PID:2368
- C:\Windows\System\jygabEk.exe
  C:\Windows\System\jygabEk.exe
  2⤵
  PID:2896
- C:\Windows\System\ksABAcm.exe
  C:\Windows\System\ksABAcm.exe
  2⤵
  PID:2328
- C:\Windows\System\RJuePlj.exe
  C:\Windows\System\RJuePlj.exe
  2⤵
  PID:2444
- C:\Windows\System\ioWwgqC.exe
  C:\Windows\System\ioWwgqC.exe
  2⤵
  PID:3092
- C:\Windows\System\pfsdFIP.exe
  C:\Windows\System\pfsdFIP.exe
  2⤵
  PID:3108
- C:\Windows\System\wsdKciC.exe
  C:\Windows\System\wsdKciC.exe
  2⤵
  PID:3124
- C:\Windows\System\zrNNSWF.exe
  C:\Windows\System\zrNNSWF.exe
  2⤵
  PID:3140
- C:\Windows\System\uXnkUkt.exe
  C:\Windows\System\uXnkUkt.exe
  2⤵
  PID:3156
- C:\Windows\System\pRhrugP.exe
  C:\Windows\System\pRhrugP.exe
  2⤵
  PID:3172
- C:\Windows\System\QpvYZRk.exe
  C:\Windows\System\QpvYZRk.exe
  2⤵
  PID:3188
- C:\Windows\System\kJPjUug.exe
  C:\Windows\System\kJPjUug.exe
  2⤵
  PID:3204
- C:\Windows\System\UDSVXUm.exe
  C:\Windows\System\UDSVXUm.exe
  2⤵
  PID:3220
- C:\Windows\System\NAxhksN.exe
  C:\Windows\System\NAxhksN.exe
  2⤵
  PID:3236
- C:\Windows\System\ouWNTUB.exe
  C:\Windows\System\ouWNTUB.exe
  2⤵
  PID:3252
- C:\Windows\System\LUGeVKK.exe
  C:\Windows\System\LUGeVKK.exe
  2⤵
  PID:3272
- C:\Windows\System\IsZlAFK.exe
  C:\Windows\System\IsZlAFK.exe
  2⤵
  PID:3288
- C:\Windows\System\lJdAbHY.exe
  C:\Windows\System\lJdAbHY.exe
  2⤵
  PID:3304
- C:\Windows\System\fgHAqSa.exe
  C:\Windows\System\fgHAqSa.exe
  2⤵
  PID:3320
- C:\Windows\System\eEeBkby.exe
  C:\Windows\System\eEeBkby.exe
  2⤵
  PID:3336
- C:\Windows\System\gOhJAxS.exe
  C:\Windows\System\gOhJAxS.exe
  2⤵
  PID:3352
- C:\Windows\System\pZHIjed.exe
  C:\Windows\System\pZHIjed.exe
  2⤵
  PID:3368
- C:\Windows\System\LLjnPiv.exe
  C:\Windows\System\LLjnPiv.exe
  2⤵
  PID:3384
- C:\Windows\System\hgaUhvb.exe
  C:\Windows\System\hgaUhvb.exe
  2⤵
  PID:3400
- C:\Windows\System\wzYYpLe.exe
  C:\Windows\System\wzYYpLe.exe
  2⤵
  PID:3416
- C:\Windows\System\cyAStZP.exe
  C:\Windows\System\cyAStZP.exe
  2⤵
  PID:3432
- C:\Windows\System\gdzxoVK.exe
  C:\Windows\System\gdzxoVK.exe
  2⤵
  PID:3448
- C:\Windows\System\CxaowjM.exe
  C:\Windows\System\CxaowjM.exe
  2⤵
  PID:3464
- C:\Windows\System\eYXJuKY.exe
  C:\Windows\System\eYXJuKY.exe
  2⤵
  PID:3480
- C:\Windows\System\sEcDskz.exe
  C:\Windows\System\sEcDskz.exe
  2⤵
  PID:3496
- C:\Windows\System\HYoYYuc.exe
  C:\Windows\System\HYoYYuc.exe
  2⤵
  PID:3512
- C:\Windows\System\DsrgqFs.exe
  C:\Windows\System\DsrgqFs.exe
  2⤵
  PID:3528
- C:\Windows\System\NqqJMyN.exe
  C:\Windows\System\NqqJMyN.exe
  2⤵
  PID:3544
- C:\Windows\System\FhAkOIU.exe
  C:\Windows\System\FhAkOIU.exe
  2⤵
  PID:3560
- C:\Windows\System\BUnbGBA.exe
  C:\Windows\System\BUnbGBA.exe
  2⤵
  PID:3576
- C:\Windows\System\ijKAwQT.exe
  C:\Windows\System\ijKAwQT.exe
  2⤵
  PID:3592
- C:\Windows\System\NHLElUw.exe
  C:\Windows\System\NHLElUw.exe
  2⤵
  PID:3608
- C:\Windows\System\faQgeoN.exe
  C:\Windows\System\faQgeoN.exe
  2⤵
  PID:3624
- C:\Windows\System\trEWTHW.exe
  C:\Windows\System\trEWTHW.exe
  2⤵
  PID:3640
- C:\Windows\System\pVGTHwS.exe
  C:\Windows\System\pVGTHwS.exe
  2⤵
  PID:3656
- C:\Windows\System\vGTPzqa.exe
  C:\Windows\System\vGTPzqa.exe
  2⤵
  PID:3672
- C:\Windows\System\srthOBj.exe
  C:\Windows\System\srthOBj.exe
  2⤵
  PID:3688
- C:\Windows\System\dTkNIdS.exe
  C:\Windows\System\dTkNIdS.exe
  2⤵
  PID:3704
- C:\Windows\System\wIFXgMW.exe
  C:\Windows\System\wIFXgMW.exe
  2⤵
  PID:3720
- C:\Windows\System\FkgxGZg.exe
  C:\Windows\System\FkgxGZg.exe
  2⤵
  PID:3736
- C:\Windows\System\khaQwYr.exe
  C:\Windows\System\khaQwYr.exe
  2⤵
  PID:3752
- C:\Windows\System\MGqXpdG.exe
  C:\Windows\System\MGqXpdG.exe
  2⤵
  PID:3768
- C:\Windows\System\ZvhmdeQ.exe
  C:\Windows\System\ZvhmdeQ.exe
  2⤵
  PID:3784
- C:\Windows\System\YZFgcwY.exe
  C:\Windows\System\YZFgcwY.exe
  2⤵
  PID:3800
- C:\Windows\System\VmGjOBh.exe
  C:\Windows\System\VmGjOBh.exe
  2⤵
  PID:3816
- C:\Windows\System\oQPdOda.exe
  C:\Windows\System\oQPdOda.exe
  2⤵
  PID:3832
- C:\Windows\System\oxqmFJj.exe
  C:\Windows\System\oxqmFJj.exe
  2⤵
  PID:3848
- C:\Windows\System\lTMchWD.exe
  C:\Windows\System\lTMchWD.exe
  2⤵
  PID:3864
- C:\Windows\System\OpDKWEb.exe
  C:\Windows\System\OpDKWEb.exe
  2⤵
  PID:3880
- C:\Windows\System\jsLiseB.exe
  C:\Windows\System\jsLiseB.exe
  2⤵
  PID:3896
- C:\Windows\System\TXAqVsd.exe
  C:\Windows\System\TXAqVsd.exe
  2⤵
  PID:3912
- C:\Windows\System\JRpuFil.exe
  C:\Windows\System\JRpuFil.exe
  2⤵
  PID:3928
- C:\Windows\System\FDVbNdw.exe
  C:\Windows\System\FDVbNdw.exe
  2⤵
  PID:3944
- C:\Windows\System\locIdcV.exe
  C:\Windows\System\locIdcV.exe
  2⤵
  PID:3960
- C:\Windows\System\CifXLBa.exe
  C:\Windows\System\CifXLBa.exe
  2⤵
  PID:3976
- C:\Windows\System\rjzpEHn.exe
  C:\Windows\System\rjzpEHn.exe
  2⤵
  PID:3992
- C:\Windows\System\ZlrRIFi.exe
  C:\Windows\System\ZlrRIFi.exe
  2⤵
  PID:4008
- C:\Windows\System\chQAhta.exe
  C:\Windows\System\chQAhta.exe
  2⤵
  PID:4024
- C:\Windows\System\KcnXBHv.exe
  C:\Windows\System\KcnXBHv.exe
  2⤵
  PID:4040
- C:\Windows\System\gKUillh.exe
  C:\Windows\System\gKUillh.exe
  2⤵
  PID:4056
- C:\Windows\System\eSNQtPZ.exe
  C:\Windows\System\eSNQtPZ.exe
  2⤵
  PID:4072
- C:\Windows\System\FWXcPUg.exe
  C:\Windows\System\FWXcPUg.exe
  2⤵
  PID:4088
- C:\Windows\System\iLfpKUG.exe
  C:\Windows\System\iLfpKUG.exe
  2⤵
  PID:920
- C:\Windows\System\OiqMfJh.exe
  C:\Windows\System\OiqMfJh.exe
  2⤵
  PID:2792
- C:\Windows\System\jVEomQv.exe
  C:\Windows\System\jVEomQv.exe
  2⤵
  PID:2380
- C:\Windows\System\gBROoGc.exe
  C:\Windows\System\gBROoGc.exe
  2⤵
  PID:3104
- C:\Windows\System\cAirQdH.exe
  C:\Windows\System\cAirQdH.exe
  2⤵
  PID:2236
- C:\Windows\System\bxWuVfU.exe
  C:\Windows\System\bxWuVfU.exe
  2⤵
  PID:3132
- C:\Windows\System\WKJvltc.exe
  C:\Windows\System\WKJvltc.exe
  2⤵
  PID:3164
- C:\Windows\System\cKUbKVR.exe
  C:\Windows\System\cKUbKVR.exe
  2⤵
  PID:3212
- C:\Windows\System\tyBGrYw.exe
  C:\Windows\System\tyBGrYw.exe
  2⤵
  PID:2696
- C:\Windows\System\sedWROx.exe
  C:\Windows\System\sedWROx.exe
  2⤵
  PID:2828
- C:\Windows\System\NWpTuaw.exe
  C:\Windows\System\NWpTuaw.exe
  2⤵
  PID:4112
- C:\Windows\System\GPVkIGm.exe
  C:\Windows\System\GPVkIGm.exe
  2⤵
  PID:4128
- C:\Windows\System\PlwwoXO.exe
  C:\Windows\System\PlwwoXO.exe
  2⤵
  PID:4144
- C:\Windows\System\jUeTUYX.exe
  C:\Windows\System\jUeTUYX.exe
  2⤵
  PID:4160
- C:\Windows\System\eqKCQxZ.exe
  C:\Windows\System\eqKCQxZ.exe
  2⤵
  PID:4176
- C:\Windows\System\lgxubCA.exe
  C:\Windows\System\lgxubCA.exe
  2⤵
  PID:4192
- C:\Windows\System\dJprlPx.exe
  C:\Windows\System\dJprlPx.exe
  2⤵
  PID:4208
- C:\Windows\System\ZqcquQZ.exe
  C:\Windows\System\ZqcquQZ.exe
  2⤵
  PID:4224
- C:\Windows\System\kAZsypI.exe
  C:\Windows\System\kAZsypI.exe
  2⤵
  PID:4240
- C:\Windows\System\zCxOceE.exe
  C:\Windows\System\zCxOceE.exe
  2⤵
  PID:4256
- C:\Windows\System\SLIIGPq.exe
  C:\Windows\System\SLIIGPq.exe
  2⤵
  PID:4284
- C:\Windows\System\ayAveSv.exe
  C:\Windows\System\ayAveSv.exe
  2⤵
  PID:4352
- C:\Windows\System\XmzReHc.exe
  C:\Windows\System\XmzReHc.exe
  2⤵
  PID:4368
- C:\Windows\System\anfczYa.exe
  C:\Windows\System\anfczYa.exe
  2⤵
  PID:4384
- C:\Windows\System\alwrVfF.exe
  C:\Windows\System\alwrVfF.exe
  2⤵
  PID:4400
- C:\Windows\System\JWvRbpM.exe
  C:\Windows\System\JWvRbpM.exe
  2⤵
  PID:4416
- C:\Windows\System\ZlOFTXv.exe
  C:\Windows\System\ZlOFTXv.exe
  2⤵
  PID:4432
- C:\Windows\System\QmMgRLr.exe
  C:\Windows\System\QmMgRLr.exe
  2⤵
  PID:4448
- C:\Windows\System\aVWehIS.exe
  C:\Windows\System\aVWehIS.exe
  2⤵
  PID:4464
- C:\Windows\System\MJRhdZY.exe
  C:\Windows\System\MJRhdZY.exe
  2⤵
  PID:4480
- C:\Windows\System\LUTQUKk.exe
  C:\Windows\System\LUTQUKk.exe
  2⤵
  PID:4496
- C:\Windows\System\rnHAYPA.exe
  C:\Windows\System\rnHAYPA.exe
  2⤵
  PID:4512
- C:\Windows\System\AdCbykL.exe
  C:\Windows\System\AdCbykL.exe
  2⤵
  PID:4528
- C:\Windows\System\zFMFuZp.exe
  C:\Windows\System\zFMFuZp.exe
  2⤵
  PID:4544
- C:\Windows\System\lvaapxG.exe
  C:\Windows\System\lvaapxG.exe
  2⤵
  PID:4560
- C:\Windows\System\IGJRnCP.exe
  C:\Windows\System\IGJRnCP.exe
  2⤵
  PID:4576
- C:\Windows\System\mMpUDGM.exe
  C:\Windows\System\mMpUDGM.exe
  2⤵
  PID:4592
- C:\Windows\System\msqlnnr.exe
  C:\Windows\System\msqlnnr.exe
  2⤵
  PID:4608
- C:\Windows\System\SMhBTnl.exe
  C:\Windows\System\SMhBTnl.exe
  2⤵
  PID:4652
- C:\Windows\System\qLMzSRX.exe
  C:\Windows\System\qLMzSRX.exe
  2⤵
  PID:4684
- C:\Windows\System\xSIovFJ.exe
  C:\Windows\System\xSIovFJ.exe
  2⤵
  PID:4700
- C:\Windows\System\hqamtbH.exe
  C:\Windows\System\hqamtbH.exe
  2⤵
  PID:4720
- C:\Windows\System\goXsKrP.exe
  C:\Windows\System\goXsKrP.exe
  2⤵
  PID:4736
- C:\Windows\System\cTBbkDh.exe
  C:\Windows\System\cTBbkDh.exe
  2⤵
  PID:4752
- C:\Windows\System\bykKudt.exe
  C:\Windows\System\bykKudt.exe
  2⤵
  PID:4768
- C:\Windows\System\NIbcUmQ.exe
  C:\Windows\System\NIbcUmQ.exe
  2⤵
  PID:4784
- C:\Windows\System\BcJfseG.exe
  C:\Windows\System\BcJfseG.exe
  2⤵
  PID:4800
- C:\Windows\System\MpCceLF.exe
  C:\Windows\System\MpCceLF.exe
  2⤵
  PID:4820
- C:\Windows\System\oypMFmK.exe
  C:\Windows\System\oypMFmK.exe
  2⤵
  PID:4836
- C:\Windows\System\ITtPKbY.exe
  C:\Windows\System\ITtPKbY.exe
  2⤵
  PID:4852
- C:\Windows\System\STYtzgv.exe
  C:\Windows\System\STYtzgv.exe
  2⤵
  PID:4868
- C:\Windows\System\zxzfFyA.exe
  C:\Windows\System\zxzfFyA.exe
  2⤵
  PID:4884
- C:\Windows\System\kFteQEc.exe
  C:\Windows\System\kFteQEc.exe
  2⤵
  PID:4900
- C:\Windows\System\UcRxhSf.exe
  C:\Windows\System\UcRxhSf.exe
  2⤵
  PID:4916
- C:\Windows\System\OLsWMRS.exe
  C:\Windows\System\OLsWMRS.exe
  2⤵
  PID:4932
- C:\Windows\System\PpPcFnx.exe
  C:\Windows\System\PpPcFnx.exe
  2⤵
  PID:4948
- C:\Windows\System\KASIENa.exe
  C:\Windows\System\KASIENa.exe
  2⤵
  PID:4964
- C:\Windows\System\HcVgDGy.exe
  C:\Windows\System\HcVgDGy.exe
  2⤵
  PID:4984
- C:\Windows\System\gwlReqh.exe
  C:\Windows\System\gwlReqh.exe
  2⤵
  PID:5000
- C:\Windows\System\rjblYjR.exe
  C:\Windows\System\rjblYjR.exe
  2⤵
  PID:5016
- C:\Windows\System\YjknDYT.exe
  C:\Windows\System\YjknDYT.exe
  2⤵
  PID:5032
- C:\Windows\System\CGgMPXv.exe
  C:\Windows\System\CGgMPXv.exe
  2⤵
  PID:5048
- C:\Windows\System\PDGuoco.exe
  C:\Windows\System\PDGuoco.exe
  2⤵
  PID:5064
- C:\Windows\System\WGnHsYV.exe
  C:\Windows\System\WGnHsYV.exe
  2⤵
  PID:5112
- C:\Windows\System\mhLgesX.exe
  C:\Windows\System\mhLgesX.exe
  2⤵
  PID:4184
- C:\Windows\System\hSkTcFc.exe
  C:\Windows\System\hSkTcFc.exe
  2⤵
  PID:3316
- C:\Windows\System\uuISyFg.exe
  C:\Windows\System\uuISyFg.exe
  2⤵
  PID:3380
- C:\Windows\System\yhYshrE.exe
  C:\Windows\System\yhYshrE.exe
  2⤵
  PID:3444
- C:\Windows\System\yyUjkYN.exe
  C:\Windows\System\yyUjkYN.exe
  2⤵
  PID:3508
- C:\Windows\System\wXtErQq.exe
  C:\Windows\System\wXtErQq.exe
  2⤵
  PID:3572
- C:\Windows\System\uSlMkTD.exe
  C:\Windows\System\uSlMkTD.exe
  2⤵
  PID:3636
- C:\Windows\System\ClwBiBi.exe
  C:\Windows\System\ClwBiBi.exe
  2⤵
  PID:3700
- C:\Windows\System\lmrWFUu.exe
  C:\Windows\System\lmrWFUu.exe
  2⤵
  PID:3792
- C:\Windows\System\lUaPxkI.exe
  C:\Windows\System\lUaPxkI.exe
  2⤵
  PID:3856
- C:\Windows\System\vuUBXve.exe
  C:\Windows\System\vuUBXve.exe
  2⤵
  PID:3924
- C:\Windows\System\bUzMFxt.exe
  C:\Windows\System\bUzMFxt.exe
  2⤵
  PID:3988
- C:\Windows\System\jlEKVgp.exe
  C:\Windows\System\jlEKVgp.exe
  2⤵
  PID:4080
- C:\Windows\System\cpKCNtG.exe
  C:\Windows\System\cpKCNtG.exe
  2⤵
  PID:3100
- C:\Windows\System\qeydSht.exe
  C:\Windows\System\qeydSht.exe
  2⤵
  PID:3244
- C:\Windows\System\JexGXOa.exe
  C:\Windows\System\JexGXOa.exe
  2⤵
  PID:4216
- C:\Windows\System\iOpOLlB.exe
  C:\Windows\System\iOpOLlB.exe
  2⤵
  PID:4252
- C:\Windows\System\nHZSaEb.exe
  C:\Windows\System\nHZSaEb.exe
  2⤵
  PID:4312
- C:\Windows\System\EFYzktg.exe
  C:\Windows\System\EFYzktg.exe
  2⤵
  PID:4324
- C:\Windows\System\GpSOmRq.exe
  C:\Windows\System\GpSOmRq.exe
  2⤵
  PID:4340
- C:\Windows\System\vcPwuLN.exe
  C:\Windows\System\vcPwuLN.exe
  2⤵
  PID:4408
- C:\Windows\System\KBMiZzF.exe
  C:\Windows\System\KBMiZzF.exe
  2⤵
  PID:4476
- C:\Windows\System\dymOQnm.exe
  C:\Windows\System\dymOQnm.exe
  2⤵
  PID:4540
- C:\Windows\System\oLUXkMi.exe
  C:\Windows\System\oLUXkMi.exe
  2⤵
  PID:3232
- C:\Windows\System\RJSrvOn.exe
  C:\Windows\System\RJSrvOn.exe
  2⤵
  PID:3296
- C:\Windows\System\VCRkIpj.exe
  C:\Windows\System\VCRkIpj.exe
  2⤵
  PID:3360
- C:\Windows\System\rFxTlTn.exe
  C:\Windows\System\rFxTlTn.exe
  2⤵
  PID:3456
- C:\Windows\System\horlniU.exe
  C:\Windows\System\horlniU.exe
  2⤵
  PID:3524
- C:\Windows\System\HYbILLH.exe
  C:\Windows\System\HYbILLH.exe
  2⤵
  PID:3776
- C:\Windows\System\aLDGDTl.exe
  C:\Windows\System\aLDGDTl.exe
  2⤵
  PID:3940
- C:\Windows\System\znFePyG.exe
  C:\Windows\System\znFePyG.exe
  2⤵
  PID:3652
- C:\Windows\System\fosNMFI.exe
  C:\Windows\System\fosNMFI.exe
  2⤵
  PID:1384
- C:\Windows\System\FXWDEiZ.exe
  C:\Windows\System\FXWDEiZ.exe
  2⤵
  PID:4104
- C:\Windows\System\NSqJXLm.exe
  C:\Windows\System\NSqJXLm.exe
  2⤵
  PID:4264
- C:\Windows\System\AbKgONi.exe
  C:\Windows\System\AbKgONi.exe
  2⤵
  PID:4396
- C:\Windows\System\mIyuUnB.exe
  C:\Windows\System\mIyuUnB.exe
  2⤵
  PID:4552
- C:\Windows\System\kKzwhxO.exe
  C:\Windows\System\kKzwhxO.exe
  2⤵
  PID:3904
- C:\Windows\System\kaNMPxt.exe
  C:\Windows\System\kaNMPxt.exe
  2⤵
  PID:3648
- C:\Windows\System\ophDcvw.exe
  C:\Windows\System\ophDcvw.exe
  2⤵
  PID:3684
- C:\Windows\System\oZWNjVo.exe
  C:\Windows\System\oZWNjVo.exe
  2⤵
  PID:3716
- C:\Windows\System\YBgPCMS.exe
  C:\Windows\System\YBgPCMS.exe
  2⤵
  PID:3780
- C:\Windows\System\Czyyzuh.exe
  C:\Windows\System\Czyyzuh.exe
  2⤵
  PID:4272
- C:\Windows\System\zxSjmqf.exe
  C:\Windows\System\zxSjmqf.exe
  2⤵
  PID:4108
- C:\Windows\System\SAjnYDJ.exe
  C:\Windows\System\SAjnYDJ.exe
  2⤵
  PID:4204
- C:\Windows\System\SeMZjYi.exe
  C:\Windows\System\SeMZjYi.exe
  2⤵
  PID:4456
- C:\Windows\System\uypxxil.exe
  C:\Windows\System\uypxxil.exe
  2⤵
  PID:4616
- C:\Windows\System\ZbHBOpo.exe
  C:\Windows\System\ZbHBOpo.exe
  2⤵
  PID:4640
- C:\Windows\System\ugCupZV.exe
  C:\Windows\System\ugCupZV.exe
  2⤵
  PID:4624
- C:\Windows\System\evUftyD.exe
  C:\Windows\System\evUftyD.exe
  2⤵
  PID:4676
- C:\Windows\System\hOSdRxE.exe
  C:\Windows\System\hOSdRxE.exe
  2⤵
  PID:4744
- C:\Windows\System\WPWIyYy.exe
  C:\Windows\System\WPWIyYy.exe
  2⤵
  PID:4808
- C:\Windows\System\lieufrx.exe
  C:\Windows\System\lieufrx.exe
  2⤵
  PID:4816
- C:\Windows\System\KeDFpMf.exe
  C:\Windows\System\KeDFpMf.exe
  2⤵
  PID:4880
- C:\Windows\System\Zctyhom.exe
  C:\Windows\System\Zctyhom.exe
  2⤵
  PID:4912
- C:\Windows\System\AfmPMac.exe
  C:\Windows\System\AfmPMac.exe
  2⤵
  PID:4972
- C:\Windows\System\uYPOsqt.exe
  C:\Windows\System\uYPOsqt.exe
  2⤵
  PID:4796
- C:\Windows\System\wHSvaqj.exe
  C:\Windows\System\wHSvaqj.exe
  2⤵
  PID:5044
- C:\Windows\System\rktjdqW.exe
  C:\Windows\System\rktjdqW.exe
  2⤵
  PID:5024
- C:\Windows\System\UlGADoG.exe
  C:\Windows\System\UlGADoG.exe
  2⤵
  PID:4992
- C:\Windows\System\JxXvkjf.exe
  C:\Windows\System\JxXvkjf.exe
  2⤵
  PID:4892
- C:\Windows\System\Dfxekpu.exe
  C:\Windows\System\Dfxekpu.exe
  2⤵
  PID:5104
- C:\Windows\System\DTYMegD.exe
  C:\Windows\System\DTYMegD.exe
  2⤵
  PID:3728
- C:\Windows\System\HnOyzkx.exe
  C:\Windows\System\HnOyzkx.exe
  2⤵
  PID:3604
- C:\Windows\System\zBdBQcb.exe
  C:\Windows\System\zBdBQcb.exe
  2⤵
  PID:3408
- C:\Windows\System\MArlnTt.exe
  C:\Windows\System\MArlnTt.exe
  2⤵
  PID:3888
- C:\Windows\System\yQboEQq.exe
  C:\Windows\System\yQboEQq.exe
  2⤵
  PID:3920
- C:\Windows\System\BFjgpGg.exe
  C:\Windows\System\BFjgpGg.exe
  2⤵
  PID:1800
- C:\Windows\System\PerfaAW.exe
  C:\Windows\System\PerfaAW.exe
  2⤵
  PID:3180
- C:\Windows\System\hrRnXPz.exe
  C:\Windows\System\hrRnXPz.exe
  2⤵
  PID:3120
- C:\Windows\System\fFkkmgJ.exe
  C:\Windows\System\fFkkmgJ.exe
  2⤵
  PID:4124
- C:\Windows\System\gAkqsQT.exe
  C:\Windows\System\gAkqsQT.exe
  2⤵
  PID:4304
- C:\Windows\System\YPcuMei.exe
  C:\Windows\System\YPcuMei.exe
  2⤵
  PID:4336
- C:\Windows\System\cisXleG.exe
  C:\Windows\System\cisXleG.exe
  2⤵
  PID:4600
- C:\Windows\System\yHpGsvC.exe
  C:\Windows\System\yHpGsvC.exe
  2⤵
  PID:3876
- C:\Windows\System\JZraLlI.exe
  C:\Windows\System\JZraLlI.exe
  2⤵
  PID:3936
- C:\Windows\System\GlBljTu.exe
  C:\Windows\System\GlBljTu.exe
  2⤵
  PID:1688
- C:\Windows\System\wSNDpNc.exe
  C:\Windows\System\wSNDpNc.exe
  2⤵
  PID:3620
- C:\Windows\System\LlOqiEa.exe
  C:\Windows\System\LlOqiEa.exe
  2⤵
  PID:3088
- C:\Windows\System\RjPRUWi.exe
  C:\Windows\System\RjPRUWi.exe
  2⤵
  PID:4136
- C:\Windows\System\gqOyRyv.exe
  C:\Windows\System\gqOyRyv.exe
  2⤵
  PID:4508
- C:\Windows\System\uIYuqNO.exe
  C:\Windows\System\uIYuqNO.exe
  2⤵
  PID:3424
- C:\Windows\System\CfEmYnW.exe
  C:\Windows\System\CfEmYnW.exe
  2⤵
  PID:4588
- C:\Windows\System\cxJlUJi.exe
  C:\Windows\System\cxJlUJi.exe
  2⤵
  PID:4708
- C:\Windows\System\ngvPAlu.exe
  C:\Windows\System\ngvPAlu.exe
  2⤵
  PID:4792
- C:\Windows\System\ZfkCVbH.exe
  C:\Windows\System\ZfkCVbH.exe
  2⤵
  PID:3136
- C:\Windows\System\hwkPHqe.exe
  C:\Windows\System\hwkPHqe.exe
  2⤵
  PID:4068
- C:\Windows\System\JekvOJJ.exe
  C:\Windows\System\JekvOJJ.exe
  2⤵
  PID:636
- C:\Windows\System\rFvZcjh.exe
  C:\Windows\System\rFvZcjh.exe
  2⤵
  PID:3200
- C:\Windows\System\iOrUefA.exe
  C:\Windows\System\iOrUefA.exe
  2⤵
  PID:5060
- C:\Windows\System\ZYMimcy.exe
  C:\Windows\System\ZYMimcy.exe
  2⤵
  PID:4632
- C:\Windows\System\VLnApCb.exe
  C:\Windows\System\VLnApCb.exe
  2⤵
  PID:4692
- C:\Windows\System\cWKgdzy.exe
  C:\Windows\System\cWKgdzy.exe
  2⤵
  PID:4032
- C:\Windows\System\gmWVHLw.exe
  C:\Windows\System\gmWVHLw.exe
  2⤵
  PID:4876
- C:\Windows\System\SKhtuWw.exe
  C:\Windows\System\SKhtuWw.exe
  2⤵
  PID:5012
- C:\Windows\System\PVHAjFR.exe
  C:\Windows\System\PVHAjFR.exe
  2⤵
  PID:5056
- C:\Windows\System\TAPQLvr.exe
  C:\Windows\System\TAPQLvr.exe
  2⤵
  PID:3696
- C:\Windows\System\UKWoXpU.exe
  C:\Windows\System\UKWoXpU.exe
  2⤵
  PID:4152
- C:\Windows\System\kOWoaVu.exe
  C:\Windows\System\kOWoaVu.exe
  2⤵
  PID:3476
- C:\Windows\System\YEjJiyy.exe
  C:\Windows\System\YEjJiyy.exe
  2⤵
  PID:3828
- C:\Windows\System\KvbDqel.exe
  C:\Windows\System\KvbDqel.exe
  2⤵
  PID:2632
- C:\Windows\System\TCmAdIg.exe
  C:\Windows\System\TCmAdIg.exe
  2⤵
  PID:3492
- C:\Windows\System\VlnIsix.exe
  C:\Windows\System\VlnIsix.exe
  2⤵
  PID:4236
- C:\Windows\System\PCwSrox.exe
  C:\Windows\System\PCwSrox.exe
  2⤵
  PID:4472
- C:\Windows\System\GSuBvKw.exe
  C:\Windows\System\GSuBvKw.exe
  2⤵
  PID:4728
- C:\Windows\System\KvjGOON.exe
  C:\Windows\System\KvjGOON.exe
  2⤵
  PID:4732
- C:\Windows\System\ABjJYsr.exe
  C:\Windows\System\ABjJYsr.exe
  2⤵
  PID:3872
- C:\Windows\System\sATmFWP.exe
  C:\Windows\System\sATmFWP.exe
  2⤵
  PID:4248
- C:\Windows\System\fVxdUOO.exe
  C:\Windows\System\fVxdUOO.exe
  2⤵
  PID:4488
- C:\Windows\System\JVWQqTn.exe
  C:\Windows\System\JVWQqTn.exe
  2⤵
  PID:3284
- C:\Windows\System\VpLwTkI.exe
  C:\Windows\System\VpLwTkI.exe
  2⤵
  PID:2516
- C:\Windows\System\LGFsEmQ.exe
  C:\Windows\System\LGFsEmQ.exe
  2⤵
  PID:4556
- C:\Windows\System\gdwXXrs.exe
  C:\Windows\System\gdwXXrs.exe
  2⤵
  PID:4956
- C:\Windows\System\PsbcmLG.exe
  C:\Windows\System\PsbcmLG.exe
  2⤵
  PID:4364
- C:\Windows\System\CzqCTDo.exe
  C:\Windows\System\CzqCTDo.exe
  2⤵
  PID:3396
- C:\Windows\System\LGFdbYZ.exe
  C:\Windows\System\LGFdbYZ.exe
  2⤵
  PID:3984
- C:\Windows\System\uLctOLY.exe
  C:\Windows\System\uLctOLY.exe
  2⤵
  PID:4428
- C:\Windows\System\swSruoq.exe
  C:\Windows\System\swSruoq.exe
  2⤵
  PID:3540
- C:\Windows\System\lzMLjow.exe
  C:\Windows\System\lzMLjow.exe
  2⤵
  PID:4672
- C:\Windows\System\uvAxgxd.exe
  C:\Windows\System\uvAxgxd.exe
  2⤵
  PID:4760
- C:\Windows\System\BJFPRaU.exe
  C:\Windows\System\BJFPRaU.exe
  2⤵
  PID:3248
- C:\Windows\System\wJBnNaG.exe
  C:\Windows\System\wJBnNaG.exe
  2⤵
  PID:3972
- C:\Windows\System\kxzFARU.exe
  C:\Windows\System\kxzFARU.exe
  2⤵
  PID:4360
- C:\Windows\System\prAqDmU.exe
  C:\Windows\System\prAqDmU.exe
  2⤵
  PID:3084
- C:\Windows\System\aHFGBdy.exe
  C:\Windows\System\aHFGBdy.exe
  2⤵
  PID:4780
- C:\Windows\System\uphQUfc.exe
  C:\Windows\System\uphQUfc.exe
  2⤵
  PID:5080
- C:\Windows\System\iPgNQOZ.exe
  C:\Windows\System\iPgNQOZ.exe
  2⤵
  PID:3588
- C:\Windows\System\OIKfGNH.exe
  C:\Windows\System\OIKfGNH.exe
  2⤵
  PID:4380
- C:\Windows\System\VWNWOAH.exe
  C:\Windows\System\VWNWOAH.exe
  2⤵
  PID:4332
- C:\Windows\System\FiHeMYd.exe
  C:\Windows\System\FiHeMYd.exe
  2⤵
  PID:4828
- C:\Windows\System\bcYNeEU.exe
  C:\Windows\System\bcYNeEU.exe
  2⤵
  PID:5132
- C:\Windows\System\JSrkqnb.exe
  C:\Windows\System\JSrkqnb.exe
  2⤵
  PID:5148
- C:\Windows\System\urKzkuF.exe
  C:\Windows\System\urKzkuF.exe
  2⤵
  PID:5164
- C:\Windows\System\kSSGZyE.exe
  C:\Windows\System\kSSGZyE.exe
  2⤵
  PID:5180
- C:\Windows\System\hgmxtCh.exe
  C:\Windows\System\hgmxtCh.exe
  2⤵
  PID:5196
- C:\Windows\System\FJrJsfR.exe
  C:\Windows\System\FJrJsfR.exe
  2⤵
  PID:5212
- C:\Windows\System\GDnmFuK.exe
  C:\Windows\System\GDnmFuK.exe
  2⤵
  PID:5228
- C:\Windows\System\lfdpZTv.exe
  C:\Windows\System\lfdpZTv.exe
  2⤵
  PID:5244
- C:\Windows\System\cNdVShf.exe
  C:\Windows\System\cNdVShf.exe
  2⤵
  PID:5260
- C:\Windows\System\MxpmxWN.exe
  C:\Windows\System\MxpmxWN.exe
  2⤵
  PID:5276
- C:\Windows\System\oTzveqB.exe
  C:\Windows\System\oTzveqB.exe
  2⤵
  PID:5292
- C:\Windows\System\huETPGH.exe
  C:\Windows\System\huETPGH.exe
  2⤵
  PID:5308
- C:\Windows\System\SKxzsBc.exe
  C:\Windows\System\SKxzsBc.exe
  2⤵
  PID:5324
- C:\Windows\System\WkmGvql.exe
  C:\Windows\System\WkmGvql.exe
  2⤵
  PID:5344
- C:\Windows\System\RxZFeGj.exe
  C:\Windows\System\RxZFeGj.exe
  2⤵
  PID:5360
- C:\Windows\System\wBefBLZ.exe
  C:\Windows\System\wBefBLZ.exe
  2⤵
  PID:5376
- C:\Windows\System\dtcRhfD.exe
  C:\Windows\System\dtcRhfD.exe
  2⤵
  PID:5392
- C:\Windows\System\RCzabBp.exe
  C:\Windows\System\RCzabBp.exe
  2⤵
  PID:5408
- C:\Windows\System\QDTRnQv.exe
  C:\Windows\System\QDTRnQv.exe
  2⤵
  PID:5424
- C:\Windows\System\bkaYDHC.exe
  C:\Windows\System\bkaYDHC.exe
  2⤵
  PID:5440
- C:\Windows\System\GErlHrY.exe
  C:\Windows\System\GErlHrY.exe
  2⤵
  PID:5456
- C:\Windows\System\oSOeceW.exe
  C:\Windows\System\oSOeceW.exe
  2⤵
  PID:5472
- C:\Windows\System\TZoSfes.exe
  C:\Windows\System\TZoSfes.exe
  2⤵
  PID:5488
- C:\Windows\System\KuvnViJ.exe
  C:\Windows\System\KuvnViJ.exe
  2⤵
  PID:5504
- C:\Windows\System\mNIfjUV.exe
  C:\Windows\System\mNIfjUV.exe
  2⤵
  PID:5524
- C:\Windows\System\EXRYgSC.exe
  C:\Windows\System\EXRYgSC.exe
  2⤵
  PID:5540
- C:\Windows\System\yMNUASi.exe
  C:\Windows\System\yMNUASi.exe
  2⤵
  PID:5560
- C:\Windows\System\eFicKyA.exe
  C:\Windows\System\eFicKyA.exe
  2⤵
  PID:5576
- C:\Windows\System\xwqoBkh.exe
  C:\Windows\System\xwqoBkh.exe
  2⤵
  PID:5592
- C:\Windows\System\VcBLDhq.exe
  C:\Windows\System\VcBLDhq.exe
  2⤵
  PID:5608
- C:\Windows\System\PuPXRip.exe
  C:\Windows\System\PuPXRip.exe
  2⤵
  PID:5624
- C:\Windows\System\WAJfHPs.exe
  C:\Windows\System\WAJfHPs.exe
  2⤵
  PID:5640
- C:\Windows\System\LPcPsXq.exe
  C:\Windows\System\LPcPsXq.exe
  2⤵
  PID:5656
- C:\Windows\System\cgytJDh.exe
  C:\Windows\System\cgytJDh.exe
  2⤵
  PID:5672
- C:\Windows\System\FqbGcrn.exe
  C:\Windows\System\FqbGcrn.exe
  2⤵
  PID:5688
- C:\Windows\System\DgreIIp.exe
  C:\Windows\System\DgreIIp.exe
  2⤵
  PID:5704
- C:\Windows\System\AzhBCEm.exe
  C:\Windows\System\AzhBCEm.exe
  2⤵
  PID:5720
- C:\Windows\System\iHLKtQY.exe
  C:\Windows\System\iHLKtQY.exe
  2⤵
  PID:5736
- C:\Windows\System\RJvtFOM.exe
  C:\Windows\System\RJvtFOM.exe
  2⤵
  PID:5752
- C:\Windows\System\DytbKZx.exe
  C:\Windows\System\DytbKZx.exe
  2⤵
  PID:5768
- C:\Windows\System\qeCLCjU.exe
  C:\Windows\System\qeCLCjU.exe
  2⤵
  PID:5784
- C:\Windows\System\FCxMPKS.exe
  C:\Windows\System\FCxMPKS.exe
  2⤵
  PID:5800
- C:\Windows\System\eifwBfN.exe
  C:\Windows\System\eifwBfN.exe
  2⤵
  PID:5816
- C:\Windows\System\NyiJkOz.exe
  C:\Windows\System\NyiJkOz.exe
  2⤵
  PID:5832
- C:\Windows\System\OoAAitt.exe
  C:\Windows\System\OoAAitt.exe
  2⤵
  PID:5848
- C:\Windows\System\zxDvHRt.exe
  C:\Windows\System\zxDvHRt.exe
  2⤵
  PID:5864
- C:\Windows\System\vcAXnpe.exe
  C:\Windows\System\vcAXnpe.exe
  2⤵
  PID:5880
- C:\Windows\System\LeVlEeq.exe
  C:\Windows\System\LeVlEeq.exe
  2⤵
  PID:5896
- C:\Windows\System\bpjyTZU.exe
  C:\Windows\System\bpjyTZU.exe
  2⤵
  PID:5912
- C:\Windows\System\oabinsX.exe
  C:\Windows\System\oabinsX.exe
  2⤵
  PID:5928
- C:\Windows\System\NwXaxpg.exe
  C:\Windows\System\NwXaxpg.exe
  2⤵
  PID:5944
- C:\Windows\System\OYfRsgY.exe
  C:\Windows\System\OYfRsgY.exe
  2⤵
  PID:5960
- C:\Windows\System\QiDOwSi.exe
  C:\Windows\System\QiDOwSi.exe
  2⤵
  PID:5976
- C:\Windows\System\GHCQZHz.exe
  C:\Windows\System\GHCQZHz.exe
  2⤵
  PID:5992
- C:\Windows\System\dVBMttT.exe
  C:\Windows\System\dVBMttT.exe
  2⤵
  PID:6008
- C:\Windows\System\EArcFUK.exe
  C:\Windows\System\EArcFUK.exe
  2⤵
  PID:6024
- C:\Windows\System\VkvyHxv.exe
  C:\Windows\System\VkvyHxv.exe
  2⤵
  PID:6040
- C:\Windows\System\WQEkxLt.exe
  C:\Windows\System\WQEkxLt.exe
  2⤵
  PID:6056
- C:\Windows\System\pigaaGv.exe
  C:\Windows\System\pigaaGv.exe
  2⤵
  PID:6072
- C:\Windows\System\yKumKEr.exe
  C:\Windows\System\yKumKEr.exe
  2⤵
  PID:6088
- C:\Windows\System\BwjDYrA.exe
  C:\Windows\System\BwjDYrA.exe
  2⤵
  PID:6104
- C:\Windows\System\blxVrAP.exe
  C:\Windows\System\blxVrAP.exe
  2⤵
  PID:6120
- C:\Windows\System\gEuGHgg.exe
  C:\Windows\System\gEuGHgg.exe
  2⤵
  PID:6136
- C:\Windows\System\IIqVyLy.exe
  C:\Windows\System\IIqVyLy.exe
  2⤵
  PID:5156
- C:\Windows\System\JyyJUwu.exe
  C:\Windows\System\JyyJUwu.exe
  2⤵
  PID:3196
- C:\Windows\System\ZJccuEf.exe
  C:\Windows\System\ZJccuEf.exe
  2⤵
  PID:5256
- C:\Windows\System\JwQMSiZ.exe
  C:\Windows\System\JwQMSiZ.exe
  2⤵
  PID:4960
- C:\Windows\System\IXqkuht.exe
  C:\Windows\System\IXqkuht.exe
  2⤵
  PID:5320
- C:\Windows\System\VuYGBNH.exe
  C:\Windows\System\VuYGBNH.exe
  2⤵
  PID:5176
- C:\Windows\System\hqWyesI.exe
  C:\Windows\System\hqWyesI.exe
  2⤵
  PID:5236
- C:\Windows\System\JQTJdTK.exe
  C:\Windows\System\JQTJdTK.exe
  2⤵
  PID:5272
- C:\Windows\System\lMlAiBS.exe
  C:\Windows\System\lMlAiBS.exe
  2⤵
  PID:5336
- C:\Windows\System\HJfLiMN.exe
  C:\Windows\System\HJfLiMN.exe
  2⤵
  PID:5384
- C:\Windows\System\XzMOKIy.exe
  C:\Windows\System\XzMOKIy.exe
  2⤵
  PID:5448
- C:\Windows\System\NMobZQR.exe
  C:\Windows\System\NMobZQR.exe
  2⤵
  PID:5432
- C:\Windows\System\YQkSYYF.exe
  C:\Windows\System\YQkSYYF.exe
  2⤵
  PID:5464
- C:\Windows\System\rbsNXMw.exe
  C:\Windows\System\rbsNXMw.exe
  2⤵
  PID:5496
- C:\Windows\System\eNegawp.exe
  C:\Windows\System\eNegawp.exe
  2⤵
  PID:5548
- C:\Windows\System\mpZDKbc.exe
  C:\Windows\System\mpZDKbc.exe
  2⤵
  PID:5616
- C:\Windows\System\taAxdgS.exe
  C:\Windows\System\taAxdgS.exe
  2⤵
  PID:5572
- C:\Windows\System\pBSzRDN.exe
  C:\Windows\System\pBSzRDN.exe
  2⤵
  PID:5632
- C:\Windows\System\vZrGYVH.exe
  C:\Windows\System\vZrGYVH.exe
  2⤵
  PID:5664
- C:\Windows\System\SyjYnpO.exe
  C:\Windows\System\SyjYnpO.exe
  2⤵
  PID:5716
- C:\Windows\System\yUuxvfH.exe
  C:\Windows\System\yUuxvfH.exe
  2⤵
  PID:5780
- C:\Windows\System\qjeMLCH.exe
  C:\Windows\System\qjeMLCH.exe
  2⤵
  PID:5732
- C:\Windows\System\hTQxccx.exe
  C:\Windows\System\hTQxccx.exe
  2⤵
  PID:5792
- C:\Windows\System\LMPeMqL.exe
  C:\Windows\System\LMPeMqL.exe
  2⤵
  PID:5872
- C:\Windows\System\JrYSJLt.exe
  C:\Windows\System\JrYSJLt.exe
  2⤵
  PID:5892
- C:\Windows\System\MHTkzgr.exe
  C:\Windows\System\MHTkzgr.exe
  2⤵
  PID:5924
- C:\Windows\System\LlWHOGt.exe
  C:\Windows\System\LlWHOGt.exe
  2⤵
  PID:5952
- C:\Windows\System\GnTkjwj.exe
  C:\Windows\System\GnTkjwj.exe
  2⤵
  PID:6000
- C:\Windows\System\oPQLQxk.exe
  C:\Windows\System\oPQLQxk.exe
  2⤵
  PID:6032
- C:\Windows\System\OHndJwf.exe
  C:\Windows\System\OHndJwf.exe
  2⤵
  PID:6064
- C:\Windows\System\tXSkzQV.exe
  C:\Windows\System\tXSkzQV.exe
  2⤵
  PID:6100
- C:\Windows\System\dGBUpIw.exe
  C:\Windows\System\dGBUpIw.exe
  2⤵
  PID:5192
- C:\Windows\System\zPMKnXX.exe
  C:\Windows\System\zPMKnXX.exe
  2⤵
  PID:6080
- C:\Windows\System\rOHpRNR.exe
  C:\Windows\System\rOHpRNR.exe
  2⤵
  PID:5124
- C:\Windows\System\FSCcacw.exe
  C:\Windows\System\FSCcacw.exe
  2⤵
  PID:5288
- C:\Windows\System\aqHVSSP.exe
  C:\Windows\System\aqHVSSP.exe
  2⤵
  PID:5268
- C:\Windows\System\vcNkmTt.exe
  C:\Windows\System\vcNkmTt.exe
  2⤵
  PID:5368
- C:\Windows\System\ZCrMgNd.exe
  C:\Windows\System\ZCrMgNd.exe
  2⤵
  PID:5404
- C:\Windows\System\fNlrVWw.exe
  C:\Windows\System\fNlrVWw.exe
  2⤵
  PID:5420
- C:\Windows\System\kGCIyLb.exe
  C:\Windows\System\kGCIyLb.exe
  2⤵
  PID:5516
- C:\Windows\System\ixUZjTT.exe
  C:\Windows\System\ixUZjTT.exe
  2⤵
  PID:5536
- C:\Windows\System\lxXogWl.exe
  C:\Windows\System\lxXogWl.exe
  2⤵
  PID:5652
- C:\Windows\System\mpFATmZ.exe
  C:\Windows\System\mpFATmZ.exe
  2⤵
  PID:5808
- C:\Windows\System\ssUwXee.exe
  C:\Windows\System\ssUwXee.exe
  2⤵
  PID:5840
- C:\Windows\System\ldrSIyv.exe
  C:\Windows\System\ldrSIyv.exe
  2⤵
  PID:5828
- C:\Windows\System\HbZshnQ.exe
  C:\Windows\System\HbZshnQ.exe
  2⤵
  PID:5920
- C:\Windows\System\yEoorOs.exe
  C:\Windows\System\yEoorOs.exe
  2⤵
  PID:5940
- C:\Windows\System\OChPmMI.exe
  C:\Windows\System\OChPmMI.exe
  2⤵
  PID:6112
- C:\Windows\System\JzvcGQX.exe
  C:\Windows\System\JzvcGQX.exe
  2⤵
  PID:6096
- C:\Windows\System\dmtiTbX.exe
  C:\Windows\System\dmtiTbX.exe
  2⤵
  PID:5988
- C:\Windows\System\yppWSMR.exe
  C:\Windows\System\yppWSMR.exe
  2⤵
  PID:5316
- C:\Windows\System\PdkAZwy.exe
  C:\Windows\System\PdkAZwy.exe
  2⤵
  PID:1936
- C:\Windows\System\ujadaEV.exe
  C:\Windows\System\ujadaEV.exe
  2⤵
  PID:5520
- C:\Windows\System\JKKBbPn.exe
  C:\Windows\System\JKKBbPn.exe
  2⤵
  PID:5728
- C:\Windows\System\xoolDqq.exe
  C:\Windows\System\xoolDqq.exe
  2⤵
  PID:5696
- C:\Windows\System\iimTMNR.exe
  C:\Windows\System\iimTMNR.exe
  2⤵
  PID:5972
- C:\Windows\System\hrtCVwo.exe
  C:\Windows\System\hrtCVwo.exe
  2⤵
  PID:5188
- C:\Windows\System\POEKcNF.exe
  C:\Windows\System\POEKcNF.exe
  2⤵
  PID:5984
- C:\Windows\System\kblkCZK.exe
  C:\Windows\System\kblkCZK.exe
  2⤵
  PID:4280
- C:\Windows\System\eQifHst.exe
  C:\Windows\System\eQifHst.exe
  2⤵
  PID:5416
- C:\Windows\System\rEkuTOk.exe
  C:\Windows\System\rEkuTOk.exe
  2⤵
  PID:5876
- C:\Windows\System\GNuCwit.exe
  C:\Windows\System\GNuCwit.exe
  2⤵
  PID:6132
- C:\Windows\System\XucwcOd.exe
  C:\Windows\System\XucwcOd.exe
  2⤵
  PID:5224
- C:\Windows\System\AJEJHpo.exe
  C:\Windows\System\AJEJHpo.exe
  2⤵
  PID:5532
- C:\Windows\System\WfRlNsd.exe
  C:\Windows\System\WfRlNsd.exe
  2⤵
  PID:5796
- C:\Windows\System\LbCxjAD.exe
  C:\Windows\System\LbCxjAD.exe
  2⤵
  PID:6156
- C:\Windows\System\CioSQlN.exe
  C:\Windows\System\CioSQlN.exe
  2⤵
  PID:6176
- C:\Windows\System\lmWitQn.exe
  C:\Windows\System\lmWitQn.exe
  2⤵
  PID:6192
- C:\Windows\System\oObNhEu.exe
  C:\Windows\System\oObNhEu.exe
  2⤵
  PID:6208
- C:\Windows\System\sVNFyHL.exe
  C:\Windows\System\sVNFyHL.exe
  2⤵
  PID:6284
- C:\Windows\System\LnsYTft.exe
  C:\Windows\System\LnsYTft.exe
  2⤵
  PID:6512
- C:\Windows\System\dwZcDjp.exe
  C:\Windows\System\dwZcDjp.exe
  2⤵
  PID:6536
- C:\Windows\System\AMVlzuz.exe
  C:\Windows\System\AMVlzuz.exe
  2⤵
  PID:6556
- C:\Windows\System\ivufNva.exe
  C:\Windows\System\ivufNva.exe
  2⤵
  PID:6572
- C:\Windows\System\PIRwWSf.exe
  C:\Windows\System\PIRwWSf.exe
  2⤵
  PID:6588
- C:\Windows\System\AdRjdAa.exe
  C:\Windows\System\AdRjdAa.exe
  2⤵
  PID:6604
- C:\Windows\System\ONqcAlq.exe
  C:\Windows\System\ONqcAlq.exe
  2⤵
  PID:6628
- C:\Windows\System\ioblSNV.exe
  C:\Windows\System\ioblSNV.exe
  2⤵
  PID:6644
- C:\Windows\System\EuVEqcv.exe
  C:\Windows\System\EuVEqcv.exe
  2⤵
  PID:6672
- C:\Windows\System\QrQEIbs.exe
  C:\Windows\System\QrQEIbs.exe
  2⤵
  PID:6688
- C:\Windows\System\RcOUmnd.exe
  C:\Windows\System\RcOUmnd.exe
  2⤵
  PID:6720
- C:\Windows\System\xjNAwrW.exe
  C:\Windows\System\xjNAwrW.exe
  2⤵
  PID:6736
- C:\Windows\System\ZfhycVt.exe
  C:\Windows\System\ZfhycVt.exe
  2⤵
  PID:6756
- C:\Windows\System\UtLtPkb.exe
  C:\Windows\System\UtLtPkb.exe
  2⤵
  PID:6776
- C:\Windows\System\CyfFxUp.exe
  C:\Windows\System\CyfFxUp.exe
  2⤵
  PID:6792
- C:\Windows\System\dDUdwUI.exe
  C:\Windows\System\dDUdwUI.exe
  2⤵
  PID:6808
- C:\Windows\System\pfJqIta.exe
  C:\Windows\System\pfJqIta.exe
  2⤵
  PID:6828
- C:\Windows\System\sUzdIqt.exe
  C:\Windows\System\sUzdIqt.exe
  2⤵
  PID:6844
- C:\Windows\System\uUoXhuK.exe
  C:\Windows\System\uUoXhuK.exe
  2⤵
  PID:6860
- C:\Windows\System\qgLUWQd.exe
  C:\Windows\System\qgLUWQd.exe
  2⤵
  PID:6880
- C:\Windows\System\bBUNWqj.exe
  C:\Windows\System\bBUNWqj.exe
  2⤵
  PID:6896
- C:\Windows\System\JZVSXrL.exe
  C:\Windows\System\JZVSXrL.exe
  2⤵
  PID:6912
- C:\Windows\System\XujhIlc.exe
  C:\Windows\System\XujhIlc.exe
  2⤵
  PID:6928
- C:\Windows\System\LWMuSmC.exe
  C:\Windows\System\LWMuSmC.exe
  2⤵
  PID:6944
- C:\Windows\System\cvriAoW.exe
  C:\Windows\System\cvriAoW.exe
  2⤵
  PID:6960
- C:\Windows\System\WAMpgbB.exe
  C:\Windows\System\WAMpgbB.exe
  2⤵
  PID:6976
- C:\Windows\System\KFTTPyz.exe
  C:\Windows\System\KFTTPyz.exe
  2⤵
  PID:6996
- C:\Windows\System\YgcOUzs.exe
  C:\Windows\System\YgcOUzs.exe
  2⤵
  PID:7016
- C:\Windows\System\WuwaCaz.exe
  C:\Windows\System\WuwaCaz.exe
  2⤵
  PID:7032
- C:\Windows\System\KRzCyQQ.exe
  C:\Windows\System\KRzCyQQ.exe
  2⤵
  PID:7048
- C:\Windows\System\sSlkaCu.exe
  C:\Windows\System\sSlkaCu.exe
  2⤵
  PID:7068
- C:\Windows\System\tsADLYR.exe
  C:\Windows\System\tsADLYR.exe
  2⤵
  PID:7084
- C:\Windows\System\bGrJhzm.exe
  C:\Windows\System\bGrJhzm.exe
  2⤵
  PID:7100
- C:\Windows\System\hVDWSQm.exe
  C:\Windows\System\hVDWSQm.exe
  2⤵
  PID:7116
- C:\Windows\System\sHZExvS.exe
  C:\Windows\System\sHZExvS.exe
  2⤵
  PID:7132
- C:\Windows\System\typhgNa.exe
  C:\Windows\System\typhgNa.exe
  2⤵
  PID:7148
- C:\Windows\System\FPrwaSD.exe
  C:\Windows\System\FPrwaSD.exe
  2⤵
  PID:5304
- C:\Windows\System\pdBVprJ.exe
  C:\Windows\System\pdBVprJ.exe
  2⤵
  PID:6068
- C:\Windows\System\feOaLGH.exe
  C:\Windows\System\feOaLGH.exe
  2⤵
  PID:6184
- C:\Windows\System\xGuOsPc.exe
  C:\Windows\System\xGuOsPc.exe
  2⤵
  PID:6204
- C:\Windows\System\InxaUlN.exe
  C:\Windows\System\InxaUlN.exe
  2⤵
  PID:6232
- C:\Windows\System\OpwRsSS.exe
  C:\Windows\System\OpwRsSS.exe
  2⤵
  PID:6248
- C:\Windows\System\OdtktYX.exe
  C:\Windows\System\OdtktYX.exe
  2⤵
  PID:6268
- C:\Windows\System\AlmUEdi.exe
  C:\Windows\System\AlmUEdi.exe
  2⤵
  PID:6296
- C:\Windows\System\VNiZvYX.exe
  C:\Windows\System\VNiZvYX.exe
  2⤵
  PID:6332
- C:\Windows\System\ImiHZCB.exe
  C:\Windows\System\ImiHZCB.exe
  2⤵
  PID:6464
- C:\Windows\System\mUaMWxe.exe
  C:\Windows\System\mUaMWxe.exe
  2⤵
  PID:6356
- C:\Windows\System\dqEiqJV.exe
  C:\Windows\System\dqEiqJV.exe
  2⤵
  PID:6448
- C:\Windows\System\OkVaNwc.exe
  C:\Windows\System\OkVaNwc.exe
  2⤵
  PID:6472
- C:\Windows\System\vOpKRdL.exe
  C:\Windows\System\vOpKRdL.exe
  2⤵
  PID:6488
- C:\Windows\System\OarxWDA.exe
  C:\Windows\System\OarxWDA.exe
  2⤵
  PID:6492
- C:\Windows\System\upbhIVq.exe
  C:\Windows\System\upbhIVq.exe
  2⤵
  PID:6520
- C:\Windows\System\CVYkVAG.exe
  C:\Windows\System\CVYkVAG.exe
  2⤵
  PID:6548
- C:\Windows\System\rLEVqlF.exe
  C:\Windows\System\rLEVqlF.exe
  2⤵
  PID:6612
- C:\Windows\System\MNtWfDy.exe
  C:\Windows\System\MNtWfDy.exe
  2⤵
  PID:6636
- C:\Windows\System\huseRvv.exe
  C:\Windows\System\huseRvv.exe
  2⤵
  PID:6680
- C:\Windows\System\BwLtlOk.exe
  C:\Windows\System\BwLtlOk.exe
  2⤵
  PID:6684
- C:\Windows\System\cQNEVZk.exe
  C:\Windows\System\cQNEVZk.exe
  2⤵
  PID:6708
- C:\Windows\System\bSHSoHe.exe
  C:\Windows\System\bSHSoHe.exe
  2⤵
  PID:6732
- C:\Windows\System\CJkriQE.exe
  C:\Windows\System\CJkriQE.exe
  2⤵
  PID:6764
- C:\Windows\System\kFVcZSQ.exe
  C:\Windows\System\kFVcZSQ.exe
  2⤵
  PID:6836
- C:\Windows\System\BPLRtdT.exe
  C:\Windows\System\BPLRtdT.exe
  2⤵
  PID:6804
- C:\Windows\System\hneVukK.exe
  C:\Windows\System\hneVukK.exe
  2⤵
  PID:6876
- C:\Windows\System\CkXGzfg.exe
  C:\Windows\System\CkXGzfg.exe
  2⤵
  PID:6968
- C:\Windows\System\AtGCqdE.exe
  C:\Windows\System\AtGCqdE.exe
  2⤵
  PID:7012
- C:\Windows\System\aSkFAgA.exe
  C:\Windows\System\aSkFAgA.exe
  2⤵
  PID:7112
- C:\Windows\System\FBRGJpZ.exe
  C:\Windows\System\FBRGJpZ.exe
  2⤵
  PID:6048
- C:\Windows\System\abYXuum.exe
  C:\Windows\System\abYXuum.exe
  2⤵
  PID:6244
- C:\Windows\System\cDvtQAf.exe
  C:\Windows\System\cDvtQAf.exe
  2⤵
  PID:6352
- C:\Windows\System\mraxNuC.exe
  C:\Windows\System\mraxNuC.exe
  2⤵
  PID:6440
- C:\Windows\System\qbSCSrg.exe
  C:\Windows\System\qbSCSrg.exe
  2⤵
  PID:6496
- C:\Windows\System\QldpKVk.exe
  C:\Windows\System\QldpKVk.exe
  2⤵
  PID:6580
- C:\Windows\System\xzzErvL.exe
  C:\Windows\System\xzzErvL.exe
  2⤵
  PID:6952
- C:\Windows\System\iYnEpwn.exe
  C:\Windows\System\iYnEpwn.exe
  2⤵
  PID:6700
- C:\Windows\System\rmrQjPV.exe
  C:\Windows\System\rmrQjPV.exe
  2⤵
  PID:5252
- C:\Windows\System\ubfstID.exe
  C:\Windows\System\ubfstID.exe
  2⤵
  PID:6784
- C:\Windows\System\MDIcryO.exe
  C:\Windows\System\MDIcryO.exe
  2⤵
  PID:6664
- C:\Windows\System\gJiGgNx.exe
  C:\Windows\System\gJiGgNx.exe
  2⤵
  PID:6800
- C:\Windows\System\WZOsbIy.exe
  C:\Windows\System\WZOsbIy.exe
  2⤵
  PID:6228
- C:\Windows\System\STCWBvn.exe
  C:\Windows\System\STCWBvn.exe
  2⤵
  PID:1564
- C:\Windows\System\MnWoYEU.exe
  C:\Windows\System\MnWoYEU.exe
  2⤵
  PID:6824
- C:\Windows\System\KbhbrGT.exe
  C:\Windows\System\KbhbrGT.exe
  2⤵
  PID:6892
- C:\Windows\System\SRfBSPQ.exe
  C:\Windows\System\SRfBSPQ.exe
  2⤵
  PID:7096
- C:\Windows\System\FKgOjUy.exe
  C:\Windows\System\FKgOjUy.exe
  2⤵
  PID:7164
- C:\Windows\System\wvgqVet.exe
  C:\Windows\System\wvgqVet.exe
  2⤵
  PID:6308
- C:\Windows\System\bkatAxD.exe
  C:\Windows\System\bkatAxD.exe
  2⤵
  PID:6460
- C:\Windows\System\qIgPXtP.exe
  C:\Windows\System\qIgPXtP.exe
  2⤵
  PID:6532
- C:\Windows\System\dVMVvKY.exe
  C:\Windows\System\dVMVvKY.exe
  2⤵
  PID:6940
- C:\Windows\System\GWoJCTw.exe
  C:\Windows\System\GWoJCTw.exe
  2⤵
  PID:7144
- C:\Windows\System\JYWViVn.exe
  C:\Windows\System\JYWViVn.exe
  2⤵
  PID:6276
- C:\Windows\System\wcRgRGE.exe
  C:\Windows\System\wcRgRGE.exe
  2⤵
  PID:6988
- C:\Windows\System\pEWletv.exe
  C:\Windows\System\pEWletv.exe
  2⤵
  PID:6752
- C:\Windows\System\oVQkYTt.exe
  C:\Windows\System\oVQkYTt.exe
  2⤵
  PID:6480
- C:\Windows\System\lkaECMW.exe
  C:\Windows\System\lkaECMW.exe
  2⤵
  PID:6584
- C:\Windows\System\FSqQVSi.exe
  C:\Windows\System\FSqQVSi.exe
  2⤵
  PID:6924
- C:\Windows\System\InFcGRU.exe
  C:\Windows\System\InFcGRU.exe
  2⤵
  PID:6336
- C:\Windows\System\RIRUOhC.exe
  C:\Windows\System\RIRUOhC.exe
  2⤵
  PID:6856
- C:\Windows\System\BeNncpR.exe
  C:\Windows\System\BeNncpR.exe
  2⤵
  PID:7064
- C:\Windows\System\cCrknEn.exe
  C:\Windows\System\cCrknEn.exe
  2⤵
  PID:6468
- C:\Windows\System\RNZcfci.exe
  C:\Windows\System\RNZcfci.exe
  2⤵
  PID:6908
- C:\Windows\System\AvyPXeZ.exe
  C:\Windows\System\AvyPXeZ.exe
  2⤵
  PID:6920
- C:\Windows\System\UvBHneN.exe
  C:\Windows\System\UvBHneN.exe
  2⤵
  PID:7008
- C:\Windows\System\gCiVRZO.exe
  C:\Windows\System\gCiVRZO.exe
  2⤵
  PID:6264
- C:\Windows\System\LpuOBul.exe
  C:\Windows\System\LpuOBul.exe
  2⤵
  PID:7044
- C:\Windows\System\sHRVJiI.exe
  C:\Windows\System\sHRVJiI.exe
  2⤵
  PID:7028
- C:\Windows\System\DzBbkBQ.exe
  C:\Windows\System\DzBbkBQ.exe
  2⤵
  PID:6552
- C:\Windows\System\qDmFJqA.exe
  C:\Windows\System\qDmFJqA.exe
  2⤵
  PID:5484
- C:\Windows\System\ATsyNbF.exe
  C:\Windows\System\ATsyNbF.exe
  2⤵
  PID:7156
- C:\Windows\System\YQoXHFY.exe
  C:\Windows\System\YQoXHFY.exe
  2⤵
  PID:6456
- C:\Windows\System\ngTrObW.exe
  C:\Windows\System\ngTrObW.exe
  2⤵
  PID:6868
- C:\Windows\System\ibwnQJf.exe
  C:\Windows\System\ibwnQJf.exe
  2⤵
  PID:6200
- C:\Windows\System\vmOINOw.exe
  C:\Windows\System\vmOINOw.exe
  2⤵
  PID:6216
- C:\Windows\System\CJNNsQi.exe
  C:\Windows\System\CJNNsQi.exe
  2⤵
  PID:7172
- C:\Windows\System\FPaANpR.exe
  C:\Windows\System\FPaANpR.exe
  2⤵
  PID:7216
- C:\Windows\System\JVUmnDa.exe
  C:\Windows\System\JVUmnDa.exe
  2⤵
  PID:7232
- C:\Windows\System\RTTzXho.exe
  C:\Windows\System\RTTzXho.exe
  2⤵
  PID:7256
- C:\Windows\System\tMsTLWi.exe
  C:\Windows\System\tMsTLWi.exe
  2⤵
  PID:7284
- C:\Windows\System\qdJtVPi.exe
  C:\Windows\System\qdJtVPi.exe
  2⤵
  PID:7300
- C:\Windows\System\aszEtZb.exe
  C:\Windows\System\aszEtZb.exe
  2⤵
  PID:7320
- C:\Windows\System\PnazPun.exe
  C:\Windows\System\PnazPun.exe
  2⤵
  PID:7336
- C:\Windows\System\iBZSMUd.exe
  C:\Windows\System\iBZSMUd.exe
  2⤵
  PID:7352
- C:\Windows\System\FtnVyOz.exe
  C:\Windows\System\FtnVyOz.exe
  2⤵
  PID:7368
- C:\Windows\System\uIRdfBU.exe
  C:\Windows\System\uIRdfBU.exe
  2⤵
  PID:7384
- C:\Windows\System\yKDtvxd.exe
  C:\Windows\System\yKDtvxd.exe
  2⤵
  PID:7404
- C:\Windows\System\DSLFBMK.exe
  C:\Windows\System\DSLFBMK.exe
  2⤵
  PID:7424
- C:\Windows\System\XRcORUF.exe
  C:\Windows\System\XRcORUF.exe
  2⤵
  PID:7440
- C:\Windows\System\zvWhrTy.exe
  C:\Windows\System\zvWhrTy.exe
  2⤵
  PID:7456
- C:\Windows\System\eHDXlyn.exe
  C:\Windows\System\eHDXlyn.exe
  2⤵
  PID:7472
- C:\Windows\System\sOYiFsg.exe
  C:\Windows\System\sOYiFsg.exe
  2⤵
  PID:7488
- C:\Windows\System\TztKnte.exe
  C:\Windows\System\TztKnte.exe
  2⤵
  PID:7504
- C:\Windows\System\ZzQdnCJ.exe
  C:\Windows\System\ZzQdnCJ.exe
  2⤵
  PID:7520
- C:\Windows\System\GpefeJC.exe
  C:\Windows\System\GpefeJC.exe
  2⤵
  PID:7536
- C:\Windows\System\RrjmtLf.exe
  C:\Windows\System\RrjmtLf.exe
  2⤵
  PID:7552
- C:\Windows\System\jFyQbyv.exe
  C:\Windows\System\jFyQbyv.exe
  2⤵
  PID:7568
- C:\Windows\System\efPCHxZ.exe
  C:\Windows\System\efPCHxZ.exe
  2⤵
  PID:7588
- C:\Windows\System\FKbLPHM.exe
  C:\Windows\System\FKbLPHM.exe
  2⤵
  PID:7604
- C:\Windows\System\JlaSsbM.exe
  C:\Windows\System\JlaSsbM.exe
  2⤵
  PID:7624
- C:\Windows\System\JPpXRxX.exe
  C:\Windows\System\JPpXRxX.exe
  2⤵
  PID:7640
- C:\Windows\System\oMImxOL.exe
  C:\Windows\System\oMImxOL.exe
  2⤵
  PID:7656
- C:\Windows\System\kppfEgX.exe
  C:\Windows\System\kppfEgX.exe
  2⤵
  PID:7672
- C:\Windows\System\ExJCQCT.exe
  C:\Windows\System\ExJCQCT.exe
  2⤵
  PID:7688
- C:\Windows\System\yEJxFcd.exe
  C:\Windows\System\yEJxFcd.exe
  2⤵
  PID:7704
- C:\Windows\System\zzfSDxf.exe
  C:\Windows\System\zzfSDxf.exe
  2⤵
  PID:7720
- C:\Windows\System\uTcRXtQ.exe
  C:\Windows\System\uTcRXtQ.exe
  2⤵
  PID:7736
- C:\Windows\System\xgybxtb.exe
  C:\Windows\System\xgybxtb.exe
  2⤵
  PID:7752
- C:\Windows\System\IDctcKg.exe
  C:\Windows\System\IDctcKg.exe
  2⤵
  PID:7768
- C:\Windows\System\oimAcnA.exe
  C:\Windows\System\oimAcnA.exe
  2⤵
  PID:7784
- C:\Windows\System\xzjYbAv.exe
  C:\Windows\System\xzjYbAv.exe
  2⤵
  PID:7800
- C:\Windows\System\OPhiCWj.exe
  C:\Windows\System\OPhiCWj.exe
  2⤵
  PID:7816
- C:\Windows\System\LPQVhEC.exe
  C:\Windows\System\LPQVhEC.exe
  2⤵
  PID:7832
- C:\Windows\System\LUDvZRO.exe
  C:\Windows\System\LUDvZRO.exe
  2⤵
  PID:7848
- C:\Windows\System\nQwdUQC.exe
  C:\Windows\System\nQwdUQC.exe
  2⤵
  PID:7864
- C:\Windows\System\qVMdZkL.exe
  C:\Windows\System\qVMdZkL.exe
  2⤵
  PID:7880
- C:\Windows\System\siksSQU.exe
  C:\Windows\System\siksSQU.exe
  2⤵
  PID:7896
- C:\Windows\System\MrTPPQD.exe
  C:\Windows\System\MrTPPQD.exe
  2⤵
  PID:7912
- C:\Windows\System\nZjwKHl.exe
  C:\Windows\System\nZjwKHl.exe
  2⤵
  PID:7928
- C:\Windows\System\PVuAVBf.exe
  C:\Windows\System\PVuAVBf.exe
  2⤵
  PID:7944
- C:\Windows\System\WUFPKxn.exe
  C:\Windows\System\WUFPKxn.exe
  2⤵
  PID:7960
- C:\Windows\System\LxlvXBF.exe
  C:\Windows\System\LxlvXBF.exe
  2⤵
  PID:7976
- C:\Windows\System\uiieqwg.exe
  C:\Windows\System\uiieqwg.exe
  2⤵
  PID:7992
- C:\Windows\System\qdmQTtL.exe
  C:\Windows\System\qdmQTtL.exe
  2⤵
  PID:8008
- C:\Windows\System\DlITBaA.exe
  C:\Windows\System\DlITBaA.exe
  2⤵
  PID:8024
- C:\Windows\System\jGoVGwu.exe
  C:\Windows\System\jGoVGwu.exe
  2⤵
  PID:8040
- C:\Windows\System\pPPnAbe.exe
  C:\Windows\System\pPPnAbe.exe
  2⤵
  PID:8056
- C:\Windows\System\nNLBnKH.exe
  C:\Windows\System\nNLBnKH.exe
  2⤵
  PID:8072
- C:\Windows\System\iRVrXfb.exe
  C:\Windows\System\iRVrXfb.exe
  2⤵
  PID:8088
- C:\Windows\System\vrhXVZd.exe
  C:\Windows\System\vrhXVZd.exe
  2⤵
  PID:8104
- C:\Windows\System\DMOSSLp.exe
  C:\Windows\System\DMOSSLp.exe
  2⤵
  PID:8120
- C:\Windows\System\DCJuOCM.exe
  C:\Windows\System\DCJuOCM.exe
  2⤵
  PID:8136
- C:\Windows\System\wDnETIl.exe
  C:\Windows\System\wDnETIl.exe
  2⤵
  PID:8152
- C:\Windows\System\whXPFGi.exe
  C:\Windows\System\whXPFGi.exe
  2⤵
  PID:8168
- C:\Windows\System\MiTXYmH.exe
  C:\Windows\System\MiTXYmH.exe
  2⤵
  PID:8184
- C:\Windows\System\glAladd.exe
  C:\Windows\System\glAladd.exe
  2⤵
  PID:6328
- C:\Windows\System\thEMcVR.exe
  C:\Windows\System\thEMcVR.exe
  2⤵
  PID:7188
- C:\Windows\System\zIQhCeY.exe
  C:\Windows\System\zIQhCeY.exe
  2⤵
  PID:7196
- C:\Windows\System\RODPyNV.exe
  C:\Windows\System\RODPyNV.exe
  2⤵
  PID:7212
- C:\Windows\System\Imdwoib.exe
  C:\Windows\System\Imdwoib.exe
  2⤵
  PID:7248
- C:\Windows\System\wnshIlC.exe
  C:\Windows\System\wnshIlC.exe
  2⤵
  PID:7268
- C:\Windows\System\XgtfNWJ.exe
  C:\Windows\System\XgtfNWJ.exe
  2⤵
  PID:7328
- C:\Windows\System\dDZlYBZ.exe
  C:\Windows\System\dDZlYBZ.exe
  2⤵
  PID:7392
- C:\Windows\System\BdzRUQV.exe
  C:\Windows\System\BdzRUQV.exe
  2⤵
  PID:7280
- C:\Windows\System\vguqckV.exe
  C:\Windows\System\vguqckV.exe
  2⤵
  PID:7464
- C:\Windows\System\ARuSizw.exe
  C:\Windows\System\ARuSizw.exe
  2⤵
  PID:7448
- C:\Windows\System\oVIOxjN.exe
  C:\Windows\System\oVIOxjN.exe
  2⤵
  PID:7344
- C:\Windows\System\mDzdaQX.exe
  C:\Windows\System\mDzdaQX.exe
  2⤵
  PID:7412
- C:\Windows\System\GpKiuzi.exe
  C:\Windows\System\GpKiuzi.exe
  2⤵
  PID:7512
- C:\Windows\System\UzHsEUA.exe
  C:\Windows\System\UzHsEUA.exe
  2⤵
  PID:7532
- C:\Windows\System\uRcFfhp.exe
  C:\Windows\System\uRcFfhp.exe
  2⤵
  PID:7564
- C:\Windows\System\qajRjhM.exe
  C:\Windows\System\qajRjhM.exe
  2⤵
  PID:7632
- C:\Windows\System\vmJTyQI.exe
  C:\Windows\System\vmJTyQI.exe
  2⤵
  PID:7616
- C:\Windows\System\hIETiTB.exe
  C:\Windows\System\hIETiTB.exe
  2⤵
  PID:7700
- C:\Windows\System\NCINPuE.exe
  C:\Windows\System\NCINPuE.exe
  2⤵
  PID:7764
- C:\Windows\System\WwlfYqG.exe
  C:\Windows\System\WwlfYqG.exe
  2⤵
  PID:7824
- C:\Windows\System\JxbqBmR.exe
  C:\Windows\System\JxbqBmR.exe
  2⤵
  PID:7744
- C:\Windows\System\nQjEaBK.exe
  C:\Windows\System\nQjEaBK.exe
  2⤵
  PID:7860
- C:\Windows\System\vuzZNYi.exe
  C:\Windows\System\vuzZNYi.exe
  2⤵
  PID:7712
- C:\Windows\System\fmhWQlW.exe
  C:\Windows\System\fmhWQlW.exe
  2⤵
  PID:7872
- C:\Windows\System\ybSIcpR.exe
  C:\Windows\System\ybSIcpR.exe
  2⤵
  PID:7940
- C:\Windows\System\vCiaWzh.exe
  C:\Windows\System\vCiaWzh.exe
  2⤵
  PID:7988
- C:\Windows\System\kDVaMSW.exe
  C:\Windows\System\kDVaMSW.exe
  2⤵
  PID:8048
- C:\Windows\System\nSAVuOX.exe
  C:\Windows\System\nSAVuOX.exe
  2⤵
  PID:8112
- C:\Windows\System\UTkyrmy.exe
  C:\Windows\System\UTkyrmy.exe
  2⤵
  PID:8068
- C:\Windows\System\fpJBITK.exe
  C:\Windows\System\fpJBITK.exe
  2⤵
  PID:7972
- C:\Windows\System\CFCavEn.exe
  C:\Windows\System\CFCavEn.exe
  2⤵
  PID:7252
- C:\Windows\System\kBQnwvc.exe
  C:\Windows\System\kBQnwvc.exe
  2⤵
  PID:8128
- C:\Windows\System\wsEFfxP.exe
  C:\Windows\System\wsEFfxP.exe
  2⤵
  PID:8160
- C:\Windows\System\AjyLZxf.exe
  C:\Windows\System\AjyLZxf.exe
  2⤵
  PID:7292
- C:\Windows\System\sHhMxFe.exe
  C:\Windows\System\sHhMxFe.exe
  2⤵
  PID:7244
- C:\Windows\System\ZpSATEh.exe
  C:\Windows\System\ZpSATEh.exe
  2⤵
  PID:7696
- C:\Windows\System\PmdJMGx.exe
  C:\Windows\System\PmdJMGx.exe
  2⤵
  PID:7376
- C:\Windows\System\hrlMqka.exe
  C:\Windows\System\hrlMqka.exe
  2⤵
  PID:7920
- C:\Windows\System\xGIhZUE.exe
  C:\Windows\System\xGIhZUE.exe
  2⤵
  PID:7652
- C:\Windows\System\saUearY.exe
  C:\Windows\System\saUearY.exe
  2⤵
  PID:7968
- C:\Windows\System\WiUiryu.exe
  C:\Windows\System\WiUiryu.exe
  2⤵
  PID:8032
- C:\Windows\System\XqwiBdA.exe
  C:\Windows\System\XqwiBdA.exe
  2⤵
  PID:7204
- C:\Windows\System\XkHeLor.exe
  C:\Windows\System\XkHeLor.exe
  2⤵
  PID:8180
- C:\Windows\System\RlcSEjU.exe
  C:\Windows\System\RlcSEjU.exe
  2⤵
  PID:7956
- C:\Windows\System\QitPpnh.exe
  C:\Windows\System\QitPpnh.exe
  2⤵
  PID:7192
- C:\Windows\System\YOtnadI.exe
  C:\Windows\System\YOtnadI.exe
  2⤵
  PID:8176
- C:\Windows\System\edEbhyT.exe
  C:\Windows\System\edEbhyT.exe
  2⤵
  PID:7432
- C:\Windows\System\KkAsdih.exe
  C:\Windows\System\KkAsdih.exe
  2⤵
  PID:7480
- C:\Windows\System\yMXvgJh.exe
  C:\Windows\System\yMXvgJh.exe
  2⤵
  PID:7560
- C:\Windows\System\KFyBfFt.exe
  C:\Windows\System\KFyBfFt.exe
  2⤵
  PID:7312
- C:\Windows\System\uhyFfid.exe
  C:\Windows\System\uhyFfid.exe
  2⤵
  PID:7856
- C:\Windows\System\lTLeBQF.exe
  C:\Windows\System\lTLeBQF.exe
  2⤵
  PID:6364
- C:\Windows\System\dauKsjy.exe
  C:\Windows\System\dauKsjy.exe
  2⤵
  PID:7596
- C:\Windows\System\pRdXVya.exe
  C:\Windows\System\pRdXVya.exe
  2⤵
  PID:7776
- C:\Windows\System\LuypxKS.exe
  C:\Windows\System\LuypxKS.exe
  2⤵
  PID:8004
- C:\Windows\System\nhNTCjE.exe
  C:\Windows\System\nhNTCjE.exe
  2⤵
  PID:7844
- C:\Windows\System\rXxvPSG.exe
  C:\Windows\System\rXxvPSG.exe
  2⤵
  PID:7936
- C:\Windows\System\iHoUcVD.exe
  C:\Windows\System\iHoUcVD.exe
  2⤵
  PID:7500
- C:\Windows\System\KnBfbWV.exe
  C:\Windows\System\KnBfbWV.exe
  2⤵
  PID:7580
- C:\Windows\System\ROpzZvd.exe
  C:\Windows\System\ROpzZvd.exe
  2⤵
  PID:7812
- C:\Windows\System\itDYVPZ.exe
  C:\Windows\System\itDYVPZ.exe
  2⤵
  PID:7984
- C:\Windows\System\lnDmOAv.exe
  C:\Windows\System\lnDmOAv.exe
  2⤵
  PID:7452
- C:\Windows\System\srgTFcB.exe
  C:\Windows\System\srgTFcB.exe
  2⤵
  PID:7548
- C:\Windows\System\MYlpDKN.exe
  C:\Windows\System\MYlpDKN.exe
  2⤵
  PID:8196
- C:\Windows\System\KjYXKhx.exe
  C:\Windows\System\KjYXKhx.exe
  2⤵
  PID:8212
- C:\Windows\System\RvdOWbE.exe
  C:\Windows\System\RvdOWbE.exe
  2⤵
  PID:8228
- C:\Windows\System\EWcraNI.exe
  C:\Windows\System\EWcraNI.exe
  2⤵
  PID:8244
- C:\Windows\System\WaRdIOJ.exe
  C:\Windows\System\WaRdIOJ.exe
  2⤵
  PID:8260
- C:\Windows\System\nVUNtBn.exe
  C:\Windows\System\nVUNtBn.exe
  2⤵
  PID:8276
- C:\Windows\System\LTmCIOF.exe
  C:\Windows\System\LTmCIOF.exe
  2⤵
  PID:8292
- C:\Windows\System\ldlVDVh.exe
  C:\Windows\System\ldlVDVh.exe
  2⤵
  PID:8308
- C:\Windows\System\lZuKgOM.exe
  C:\Windows\System\lZuKgOM.exe
  2⤵
  PID:8324
- C:\Windows\System\bHPHoTa.exe
  C:\Windows\System\bHPHoTa.exe
  2⤵
  PID:8340
- C:\Windows\System\IcjjtNs.exe
  C:\Windows\System\IcjjtNs.exe
  2⤵
  PID:8356
- C:\Windows\System\PKVhnLs.exe
  C:\Windows\System\PKVhnLs.exe
  2⤵
  PID:8372
- C:\Windows\System\YIVAOav.exe
  C:\Windows\System\YIVAOav.exe
  2⤵
  PID:8388
- C:\Windows\System\kGQGoUx.exe
  C:\Windows\System\kGQGoUx.exe
  2⤵
  PID:8404
- C:\Windows\System\wmcJBem.exe
  C:\Windows\System\wmcJBem.exe
  2⤵
  PID:8420
- C:\Windows\System\zmzRJOg.exe
  C:\Windows\System\zmzRJOg.exe
  2⤵
  PID:8436
- C:\Windows\System\dHNkgvd.exe
  C:\Windows\System\dHNkgvd.exe
  2⤵
  PID:8452
- C:\Windows\System\nwVKTnx.exe
  C:\Windows\System\nwVKTnx.exe
  2⤵
  PID:8468
- C:\Windows\System\oUgpXHQ.exe
  C:\Windows\System\oUgpXHQ.exe
  2⤵
  PID:8484
- C:\Windows\System\aVopugq.exe
  C:\Windows\System\aVopugq.exe
  2⤵
  PID:8500
- C:\Windows\System\XmidBZx.exe
  C:\Windows\System\XmidBZx.exe
  2⤵
  PID:8516
- C:\Windows\System\DRQpGwu.exe
  C:\Windows\System\DRQpGwu.exe
  2⤵
  PID:8532
- C:\Windows\System\gFBdOup.exe
  C:\Windows\System\gFBdOup.exe
  2⤵
  PID:8548
- C:\Windows\System\JAZuPsS.exe
  C:\Windows\System\JAZuPsS.exe
  2⤵
  PID:8564
- C:\Windows\System\BkIQiLV.exe
  C:\Windows\System\BkIQiLV.exe
  2⤵
  PID:8580
- C:\Windows\System\otxJLtN.exe
  C:\Windows\System\otxJLtN.exe
  2⤵
  PID:8596
- C:\Windows\System\MyTRgpu.exe
  C:\Windows\System\MyTRgpu.exe
  2⤵
  PID:8612
- C:\Windows\System\GhWyCIW.exe
  C:\Windows\System\GhWyCIW.exe
  2⤵
  PID:8628
- C:\Windows\System\UktBpOv.exe
  C:\Windows\System\UktBpOv.exe
  2⤵
  PID:8648
- C:\Windows\System\RuQTsjE.exe
  C:\Windows\System\RuQTsjE.exe
  2⤵
  PID:8664
- C:\Windows\System\JQVkPyf.exe
  C:\Windows\System\JQVkPyf.exe
  2⤵
  PID:8680
- C:\Windows\System\tYYLwpH.exe
  C:\Windows\System\tYYLwpH.exe
  2⤵
  PID:8696
- C:\Windows\System\BrkPTPw.exe
  C:\Windows\System\BrkPTPw.exe
  2⤵
  PID:8712
- C:\Windows\System\sbeiONS.exe
  C:\Windows\System\sbeiONS.exe
  2⤵
  PID:8728
- C:\Windows\System\WyqYLKb.exe
  C:\Windows\System\WyqYLKb.exe
  2⤵
  PID:8744
- C:\Windows\System\pLuxBvF.exe
  C:\Windows\System\pLuxBvF.exe
  2⤵
  PID:8760
- C:\Windows\System\jSCxKZQ.exe
  C:\Windows\System\jSCxKZQ.exe
  2⤵
  PID:8776
- C:\Windows\System\fjYlOKK.exe
  C:\Windows\System\fjYlOKK.exe
  2⤵
  PID:8792
- C:\Windows\System\FtURJIS.exe
  C:\Windows\System\FtURJIS.exe
  2⤵
  PID:8808
- C:\Windows\System\SfjZmYk.exe
  C:\Windows\System\SfjZmYk.exe
  2⤵
  PID:8824
- C:\Windows\System\SKxYBTJ.exe
  C:\Windows\System\SKxYBTJ.exe
  2⤵
  PID:8844
- C:\Windows\System\HdZhpGz.exe
  C:\Windows\System\HdZhpGz.exe
  2⤵
  PID:8860
- C:\Windows\System\hWmRsRW.exe
  C:\Windows\System\hWmRsRW.exe
  2⤵
  PID:8876
- C:\Windows\System\BLKcWvt.exe
  C:\Windows\System\BLKcWvt.exe
  2⤵
  PID:8892
- C:\Windows\System\fxfgEsH.exe
  C:\Windows\System\fxfgEsH.exe
  2⤵
  PID:8908
- C:\Windows\System\kJrIuuV.exe
  C:\Windows\System\kJrIuuV.exe
  2⤵
  PID:8932
- C:\Windows\System\FxyIREf.exe
  C:\Windows\System\FxyIREf.exe
  2⤵
  PID:8948
- C:\Windows\System\lvMIvBF.exe
  C:\Windows\System\lvMIvBF.exe
  2⤵
  PID:8964
- C:\Windows\System\SUNSTwG.exe
  C:\Windows\System\SUNSTwG.exe
  2⤵
  PID:8980
- C:\Windows\System\ZTOwxzg.exe
  C:\Windows\System\ZTOwxzg.exe
  2⤵
  PID:8996
- C:\Windows\System\REheCZP.exe
  C:\Windows\System\REheCZP.exe
  2⤵
  PID:9016
- C:\Windows\System\VVexIJQ.exe
  C:\Windows\System\VVexIJQ.exe
  2⤵
  PID:9032
- C:\Windows\System\ctIhIli.exe
  C:\Windows\System\ctIhIli.exe
  2⤵
  PID:9048
- C:\Windows\System\zOtJWIj.exe
  C:\Windows\System\zOtJWIj.exe
  2⤵
  PID:9064
- C:\Windows\System\dkJXVDc.exe
  C:\Windows\System\dkJXVDc.exe
  2⤵
  PID:9084
- C:\Windows\System\NIPibdd.exe
  C:\Windows\System\NIPibdd.exe
  2⤵
  PID:9100
- C:\Windows\System\AfpbrbV.exe
  C:\Windows\System\AfpbrbV.exe
  2⤵
  PID:9116
- C:\Windows\System\SVMxQYD.exe
  C:\Windows\System\SVMxQYD.exe
  2⤵
  PID:9132
- C:\Windows\System\lUyAVZF.exe
  C:\Windows\System\lUyAVZF.exe
  2⤵
  PID:9148
- C:\Windows\System\njgBZjU.exe
  C:\Windows\System\njgBZjU.exe
  2⤵
  PID:9168
- C:\Windows\System\ZdcKsjV.exe
  C:\Windows\System\ZdcKsjV.exe
  2⤵
  PID:9184
- C:\Windows\System\gtUnRCq.exe
  C:\Windows\System\gtUnRCq.exe
  2⤵
  PID:9200
- C:\Windows\System\oVzrTEA.exe
  C:\Windows\System\oVzrTEA.exe
  2⤵
  PID:7892
- C:\Windows\System\qbfmiLa.exe
  C:\Windows\System\qbfmiLa.exe
  2⤵
  PID:7732
- C:\Windows\System\RVIVHLV.exe
  C:\Windows\System\RVIVHLV.exe
  2⤵
  PID:8272
- C:\Windows\System\VBUWlQb.exe
  C:\Windows\System\VBUWlQb.exe
  2⤵
  PID:8220
- C:\Windows\System\QssWEYU.exe
  C:\Windows\System\QssWEYU.exe
  2⤵
  PID:8364
- C:\Windows\System\rytRcQp.exe
  C:\Windows\System\rytRcQp.exe
  2⤵
  PID:8432
- C:\Windows\System\GbhTxox.exe
  C:\Windows\System\GbhTxox.exe
  2⤵
  PID:8496
- C:\Windows\System\vFdcAJX.exe
  C:\Windows\System\vFdcAJX.exe
  2⤵
  PID:8588
- C:\Windows\System\SnuxDhQ.exe
  C:\Windows\System\SnuxDhQ.exe
  2⤵
  PID:8624
- C:\Windows\System\mdWJKiR.exe
  C:\Windows\System\mdWJKiR.exe
  2⤵
  PID:8412
- C:\Windows\System\qycCiBH.exe
  C:\Windows\System\qycCiBH.exe
  2⤵
  PID:8252
- C:\Windows\System\qKXORoV.exe
  C:\Windows\System\qKXORoV.exe
  2⤵
  PID:8544
- C:\Windows\System\nhyLXno.exe
  C:\Windows\System\nhyLXno.exe
  2⤵
  PID:6348
- C:\Windows\System\VQGevAx.exe
  C:\Windows\System\VQGevAx.exe
  2⤵
  PID:8656
- C:\Windows\System\NqKJKOV.exe
  C:\Windows\System\NqKJKOV.exe
  2⤵
  PID:7364
- C:\Windows\System\DKOFRZf.exe
  C:\Windows\System\DKOFRZf.exe
  2⤵
  PID:8636
- C:\Windows\System\zldKiCt.exe
  C:\Windows\System\zldKiCt.exe
  2⤵
  PID:8288
- C:\Windows\System\spvUKKE.exe
  C:\Windows\System\spvUKKE.exe
  2⤵
  PID:8724
- C:\Windows\System\dHEfoFS.exe
  C:\Windows\System\dHEfoFS.exe
  2⤵
  PID:8756
- C:\Windows\System\oahSCEX.exe
  C:\Windows\System\oahSCEX.exe
  2⤵
  PID:8784
- C:\Windows\System\smpCnff.exe
  C:\Windows\System\smpCnff.exe
  2⤵
  PID:8852
- C:\Windows\System\qQfhSJG.exe
  C:\Windows\System\qQfhSJG.exe
  2⤵
  PID:8856
- C:\Windows\System\XMqYaHP.exe
  C:\Windows\System\XMqYaHP.exe
  2⤵
  PID:8768
- C:\Windows\System\GIBHaVc.exe
  C:\Windows\System\GIBHaVc.exe
  2⤵
  PID:9056
- C:\Windows\System\kWgDntC.exe
  C:\Windows\System\kWgDntC.exe
  2⤵
  PID:8800
- C:\Windows\System\rFYDXnJ.exe
  C:\Windows\System\rFYDXnJ.exe
  2⤵
  PID:8868
- C:\Windows\System\EzZGjOc.exe
  C:\Windows\System\EzZGjOc.exe
  2⤵
  PID:8940
- C:\Windows\System\IXIXuwT.exe
  C:\Windows\System\IXIXuwT.exe
  2⤵
  PID:9160
- C:\Windows\System\iptHVzt.exe
  C:\Windows\System\iptHVzt.exe
  2⤵
  PID:8976
- C:\Windows\System\TSffBUX.exe
  C:\Windows\System\TSffBUX.exe
  2⤵
  PID:9124
- C:\Windows\System\oiKCcZi.exe
  C:\Windows\System\oiKCcZi.exe
  2⤵
  PID:9040
- C:\Windows\System\NffYbYy.exe
  C:\Windows\System\NffYbYy.exe
  2⤵
  PID:8208
- C:\Windows\System\CCVBLoy.exe
  C:\Windows\System\CCVBLoy.exe
  2⤵
  PID:8236
- C:\Windows\System\VMDwziW.exe
  C:\Windows\System\VMDwziW.exe
  2⤵
  PID:8604
- C:\Windows\System\WniCEUw.exe
  C:\Windows\System\WniCEUw.exe
  2⤵
  PID:8560
- C:\Windows\System\GDgMlKG.exe
  C:\Windows\System\GDgMlKG.exe
  2⤵
  PID:8540
- C:\Windows\System\JuPLCfu.exe
  C:\Windows\System\JuPLCfu.exe
  2⤵
  PID:9140
- C:\Windows\System\FHuLMvD.exe
  C:\Windows\System\FHuLMvD.exe
  2⤵
  PID:8688
- C:\Windows\System\ozevBcE.exe
  C:\Windows\System\ozevBcE.exe
  2⤵
  PID:8336
- C:\Windows\System\TGsEbDG.exe
  C:\Windows\System\TGsEbDG.exe
  2⤵
  PID:9112
- C:\Windows\System\TeurtOD.exe
  C:\Windows\System\TeurtOD.exe
  2⤵
  PID:7600
- C:\Windows\System\fazRqlI.exe
  C:\Windows\System\fazRqlI.exe
  2⤵
  PID:8492
- C:\Windows\System\xZLWege.exe
  C:\Windows\System\xZLWege.exe
  2⤵
  PID:8256
- C:\Windows\System\HgpUYMK.exe
  C:\Windows\System\HgpUYMK.exe
  2⤵
  PID:9096
- C:\Windows\System\bJtfhZA.exe
  C:\Windows\System\bJtfhZA.exe
  2⤵
  PID:9192
- C:\Windows\System\nTJnGft.exe
  C:\Windows\System\nTJnGft.exe
  2⤵
  PID:8740
- C:\Windows\System\jcGzwoU.exe
  C:\Windows\System\jcGzwoU.exe
  2⤵
  PID:7584
- C:\Windows\System\JpXgbNB.exe
  C:\Windows\System\JpXgbNB.exe
  2⤵
  PID:8900
- C:\Windows\System\mQrflcT.exe
  C:\Windows\System\mQrflcT.exe
  2⤵
  PID:9060
- C:\Windows\System\drZMDTi.exe
  C:\Windows\System\drZMDTi.exe
  2⤵
  PID:8428
- C:\Windows\System\bLrcEyD.exe
  C:\Windows\System\bLrcEyD.exe
  2⤵
  PID:8384
- C:\Windows\System\CrHWsvt.exe
  C:\Windows\System\CrHWsvt.exe
  2⤵
  PID:8444
- C:\Windows\System\VdBrAVy.exe
  C:\Windows\System\VdBrAVy.exe
  2⤵
  PID:8080
- C:\Windows\System\qoZaqjN.exe
  C:\Windows\System\qoZaqjN.exe
  2⤵
  PID:8676
- C:\Windows\System\sbcIrwc.exe
  C:\Windows\System\sbcIrwc.exe
  2⤵
  PID:8916
- C:\Windows\System\XkhunOI.exe
  C:\Windows\System\XkhunOI.exe
  2⤵
  PID:8928
- C:\Windows\System\YUpXOdj.exe
  C:\Windows\System\YUpXOdj.exe
  2⤵
  PID:8840
- C:\Windows\System\LTlqldQ.exe
  C:\Windows\System\LTlqldQ.exe
  2⤵
  PID:8400
- C:\Windows\System\ennbXst.exe
  C:\Windows\System\ennbXst.exe
  2⤵
  PID:9012
- C:\Windows\System\DjrvVUe.exe
  C:\Windows\System\DjrvVUe.exe
  2⤵
  PID:9212
- C:\Windows\System\NgxEtuT.exe
  C:\Windows\System\NgxEtuT.exe
  2⤵
  PID:8464
- C:\Windows\System\PuXZICE.exe
  C:\Windows\System\PuXZICE.exe
  2⤵
  PID:8380
- C:\Windows\System\EZXJzJS.exe
  C:\Windows\System\EZXJzJS.exe
  2⤵
  PID:8972
- C:\Windows\System\DffVYxi.exe
  C:\Windows\System\DffVYxi.exe
  2⤵
  PID:9196
- C:\Windows\System\HvTsZaE.exe
  C:\Windows\System\HvTsZaE.exe
  2⤵
  PID:8304
- C:\Windows\System\UlAkRCr.exe
  C:\Windows\System\UlAkRCr.exe
  2⤵
  PID:8556
- C:\Windows\System\zIlPqkN.exe
  C:\Windows\System\zIlPqkN.exe
  2⤵
  PID:8772
- C:\Windows\System\zLgjhAn.exe
  C:\Windows\System\zLgjhAn.exe
  2⤵
  PID:9224
- C:\Windows\System\XPshFxT.exe
  C:\Windows\System\XPshFxT.exe
  2⤵
  PID:9240
- C:\Windows\System\kryzKaP.exe
  C:\Windows\System\kryzKaP.exe
  2⤵
  PID:9256
- C:\Windows\System\kBIqGNm.exe
  C:\Windows\System\kBIqGNm.exe
  2⤵
  PID:9272
- C:\Windows\System\bfsTTeH.exe
  C:\Windows\System\bfsTTeH.exe
  2⤵
  PID:9288
- C:\Windows\System\oiuazig.exe
  C:\Windows\System\oiuazig.exe
  2⤵
  PID:9304
- C:\Windows\System\IjZcbaF.exe
  C:\Windows\System\IjZcbaF.exe
  2⤵
  PID:9324
- C:\Windows\System\wKrdCMG.exe
  C:\Windows\System\wKrdCMG.exe
  2⤵
  PID:9340
- C:\Windows\System\YWjizTB.exe
  C:\Windows\System\YWjizTB.exe
  2⤵
  PID:9356
- C:\Windows\System\AJvHUmj.exe
  C:\Windows\System\AJvHUmj.exe
  2⤵
  PID:9376
- C:\Windows\System\KRDMTEk.exe
  C:\Windows\System\KRDMTEk.exe
  2⤵
  PID:9392
- C:\Windows\System\twfLPlA.exe
  C:\Windows\System\twfLPlA.exe
  2⤵
  PID:9408
- C:\Windows\System\mDvfMuZ.exe
  C:\Windows\System\mDvfMuZ.exe
  2⤵
  PID:9424
- C:\Windows\System\VlqNgUa.exe
  C:\Windows\System\VlqNgUa.exe
  2⤵
  PID:9440
- C:\Windows\System\SedqFLH.exe
  C:\Windows\System\SedqFLH.exe
  2⤵
  PID:9456
- C:\Windows\System\GlpEyrn.exe
  C:\Windows\System\GlpEyrn.exe
  2⤵
  PID:9472
- C:\Windows\System\xcUaIcz.exe
  C:\Windows\System\xcUaIcz.exe
  2⤵
  PID:9488
- C:\Windows\System\ouYOeDd.exe
  C:\Windows\System\ouYOeDd.exe
  2⤵
  PID:9504
- C:\Windows\System\ZcPjqHw.exe
  C:\Windows\System\ZcPjqHw.exe
  2⤵
  PID:9520
- C:\Windows\System\pOypjHh.exe
  C:\Windows\System\pOypjHh.exe
  2⤵
  PID:9536
- C:\Windows\System\yRVUMWB.exe
  C:\Windows\System\yRVUMWB.exe
  2⤵
  PID:9552
- C:\Windows\System\mEhzkag.exe
  C:\Windows\System\mEhzkag.exe
  2⤵
  PID:9568
- C:\Windows\System\mPiSxng.exe
  C:\Windows\System\mPiSxng.exe
  2⤵
  PID:9584
- C:\Windows\System\YAPsSha.exe
  C:\Windows\System\YAPsSha.exe
  2⤵
  PID:9600
- C:\Windows\System\vNLSpAj.exe
  C:\Windows\System\vNLSpAj.exe
  2⤵
  PID:9616
- C:\Windows\System\catsxFR.exe
  C:\Windows\System\catsxFR.exe
  2⤵
  PID:9632
- C:\Windows\System\qYrpIDS.exe
  C:\Windows\System\qYrpIDS.exe
  2⤵
  PID:9648
- C:\Windows\System\OELAcqd.exe
  C:\Windows\System\OELAcqd.exe
  2⤵
  PID:9664
- C:\Windows\System\rbHcJJk.exe
  C:\Windows\System\rbHcJJk.exe
  2⤵
  PID:9680
- C:\Windows\System\isYbjre.exe
  C:\Windows\System\isYbjre.exe
  2⤵
  PID:9696
- C:\Windows\System\NvlvujZ.exe
  C:\Windows\System\NvlvujZ.exe
  2⤵
  PID:9716
- C:\Windows\System\cVhMwtw.exe
  C:\Windows\System\cVhMwtw.exe
  2⤵
  PID:9768
- C:\Windows\System\vLlDleZ.exe
  C:\Windows\System\vLlDleZ.exe
  2⤵
  PID:9784
- C:\Windows\System\osbilsS.exe
  C:\Windows\System\osbilsS.exe
  2⤵
  PID:9800
- C:\Windows\System\zcnuplq.exe
  C:\Windows\System\zcnuplq.exe
  2⤵
  PID:9816
- C:\Windows\System\IcEfsqX.exe
  C:\Windows\System\IcEfsqX.exe
  2⤵
  PID:9832
- C:\Windows\System\EMWujra.exe
  C:\Windows\System\EMWujra.exe
  2⤵
  PID:9848
- C:\Windows\System\EsbTZtO.exe
  C:\Windows\System\EsbTZtO.exe
  2⤵
  PID:9864
- C:\Windows\System\hPUncZk.exe
  C:\Windows\System\hPUncZk.exe
  2⤵
  PID:9880
- C:\Windows\System\tazXWpm.exe
  C:\Windows\System\tazXWpm.exe
  2⤵
  PID:9900
- C:\Windows\System\CngpIMT.exe
  C:\Windows\System\CngpIMT.exe
  2⤵
  PID:9916
- C:\Windows\System\atyEpxW.exe
  C:\Windows\System\atyEpxW.exe
  2⤵
  PID:9932
- C:\Windows\System\jfLwayW.exe
  C:\Windows\System\jfLwayW.exe
  2⤵
  PID:9948
- C:\Windows\System\qoJAVli.exe
  C:\Windows\System\qoJAVli.exe
  2⤵
  PID:9964
- C:\Windows\System\rMwUZkR.exe
  C:\Windows\System\rMwUZkR.exe
  2⤵
  PID:9980
- C:\Windows\System\hjLupvg.exe
  C:\Windows\System\hjLupvg.exe
  2⤵
  PID:9996
- C:\Windows\System\FuDoyKr.exe
  C:\Windows\System\FuDoyKr.exe
  2⤵
  PID:10012
- C:\Windows\System\UEjBHsX.exe
  C:\Windows\System\UEjBHsX.exe
  2⤵
  PID:10028
- C:\Windows\System\ePVWnBA.exe
  C:\Windows\System\ePVWnBA.exe
  2⤵
  PID:10048
- C:\Windows\System\SYiiMhI.exe
  C:\Windows\System\SYiiMhI.exe
  2⤵
  PID:10064
- C:\Windows\System\aDEUVnj.exe
  C:\Windows\System\aDEUVnj.exe
  2⤵
  PID:10080
- C:\Windows\System\slYVjZT.exe
  C:\Windows\System\slYVjZT.exe
  2⤵
  PID:10096
- C:\Windows\System\zngPjzh.exe
  C:\Windows\System\zngPjzh.exe
  2⤵
  PID:10112
- C:\Windows\System\qDBpbBg.exe
  C:\Windows\System\qDBpbBg.exe
  2⤵
  PID:10128
- C:\Windows\System\jlmlZhv.exe
  C:\Windows\System\jlmlZhv.exe
  2⤵
  PID:10148
- C:\Windows\System\YeqpyxW.exe
  C:\Windows\System\YeqpyxW.exe
  2⤵
  PID:10164
- C:\Windows\System\cNFTTVe.exe
  C:\Windows\System\cNFTTVe.exe
  2⤵
  PID:10180
- C:\Windows\System\eqZCUaw.exe
  C:\Windows\System\eqZCUaw.exe
  2⤵
  PID:10196
- C:\Windows\System\RapunfG.exe
  C:\Windows\System\RapunfG.exe
  2⤵
  PID:10212
- C:\Windows\System\adOKbtw.exe
  C:\Windows\System\adOKbtw.exe
  2⤵
  PID:10232
- C:\Windows\System\zLovdIp.exe
  C:\Windows\System\zLovdIp.exe
  2⤵
  PID:9248
- C:\Windows\System\HpSDcfB.exe
  C:\Windows\System\HpSDcfB.exe
  2⤵
  PID:9252
- C:\Windows\System\KoquylY.exe
  C:\Windows\System\KoquylY.exe
  2⤵
  PID:9316
- C:\Windows\System\JSPhDZY.exe
  C:\Windows\System\JSPhDZY.exe
  2⤵
  PID:8836
- C:\Windows\System\DNfARbg.exe
  C:\Windows\System\DNfARbg.exe
  2⤵
  PID:9236
- C:\Windows\System\OBqTdGG.exe
  C:\Windows\System\OBqTdGG.exe
  2⤵
  PID:9300
- C:\Windows\System\HTifFlz.exe
  C:\Windows\System\HTifFlz.exe
  2⤵
  PID:8820
- C:\Windows\System\hejuAvN.exe
  C:\Windows\System\hejuAvN.exe
  2⤵
  PID:9388
- C:\Windows\System\sPRMQiv.exe
  C:\Windows\System\sPRMQiv.exe
  2⤵
  PID:9452
- C:\Windows\System\omOYPJZ.exe
  C:\Windows\System\omOYPJZ.exe
  2⤵
  PID:9516
- C:\Windows\System\fTNCSHt.exe
  C:\Windows\System\fTNCSHt.exe
  2⤵
  PID:9576
- C:\Windows\System\uwcQFbs.exe
  C:\Windows\System\uwcQFbs.exe
  2⤵
  PID:9532
- C:\Windows\System\sVyzVQe.exe
  C:\Windows\System\sVyzVQe.exe
  2⤵
  PID:9496
- C:\Windows\System\ZWVlMQH.exe
  C:\Windows\System\ZWVlMQH.exe
  2⤵
  PID:9404
- C:\Windows\System\lvnrzmQ.exe
  C:\Windows\System\lvnrzmQ.exe
  2⤵
  PID:9624
- C:\Windows\System\TunqwBt.exe
  C:\Windows\System\TunqwBt.exe
  2⤵
  PID:9564
- C:\Windows\System\mvJgisG.exe
  C:\Windows\System\mvJgisG.exe
  2⤵
  PID:9688
- C:\Windows\System\VAutngB.exe
  C:\Windows\System\VAutngB.exe
  2⤵
  PID:9692
- C:\Windows\System\FOIvYIR.exe
  C:\Windows\System\FOIvYIR.exe
  2⤵
  PID:9732
- C:\Windows\System\IhEBrNP.exe
  C:\Windows\System\IhEBrNP.exe
  2⤵
  PID:9752
- C:\Windows\System\kaUkARJ.exe
  C:\Windows\System\kaUkARJ.exe
  2⤵
  PID:9780
- C:\Windows\System\xkIJUPP.exe
  C:\Windows\System\xkIJUPP.exe
  2⤵
  PID:9844
- C:\Windows\System\inZmzsD.exe
  C:\Windows\System\inZmzsD.exe
  2⤵
  PID:9912
- C:\Windows\System\mBSKZZm.exe
  C:\Windows\System\mBSKZZm.exe
  2⤵
  PID:9972
- C:\Windows\System\OTKEkIB.exe
  C:\Windows\System\OTKEkIB.exe
  2⤵
  PID:10036
- C:\Windows\System\PqHLVSk.exe
  C:\Windows\System\PqHLVSk.exe
  2⤵
  PID:10104
- C:\Windows\System\pINxODW.exe
  C:\Windows\System\pINxODW.exe
  2⤵
  PID:9792
- C:\Windows\System\QkbwIQI.exe
  C:\Windows\System\QkbwIQI.exe
  2⤵
  PID:9856
- C:\Windows\System\tPyrFjY.exe
  C:\Windows\System\tPyrFjY.exe
  2⤵
  PID:9892
- C:\Windows\System\PJegrYA.exe
  C:\Windows\System\PJegrYA.exe
  2⤵
  PID:9928
- C:\Windows\System\QSAQHPD.exe
  C:\Windows\System\QSAQHPD.exe
  2⤵
  PID:9992
- C:\Windows\System\PaLrZZb.exe
  C:\Windows\System\PaLrZZb.exe
  2⤵
  PID:10024
- C:\Windows\System\VUoTeaR.exe
  C:\Windows\System\VUoTeaR.exe
  2⤵
  PID:10060
- C:\Windows\System\AfojsVo.exe
  C:\Windows\System\AfojsVo.exe
  2⤵
  PID:10160
- C:\Windows\System\qwvOyMI.exe
  C:\Windows\System\qwvOyMI.exe
  2⤵
  PID:10156

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AWxfkXI.exe

Filesize
2.0MB

MD5
af8854a482d01fa3e8526fddf59a0ba4

SHA1
3bdc2de58ddfe48381641fe5dc8eb4c91f26683f

SHA256
8f8f24e80a6752534e203562a6580ed58d1edfe30d1e067a1ef6dcf51b509bca

SHA512
dd1ace402c4bba17f2c53ba156379c40fc204b40ca0d9cf9f22b66313c6cee02ce0723ae836d4dcfed0086a68fe452dc8acf85da5f154358753e22a7c044e1a6

Download Submit
C:\Windows\system\EXMWchu.exe

Filesize
2.0MB

MD5
30b80e7bb11c442ba6cc8d57e9fb6a2e

SHA1
5e4162dcdf8c341c28e7dffba495414fd1c73260

SHA256
7d59031be7bc40336ee0c74f0ad5ae38f14a4095cbcd8f6b01c6174959503d5c

SHA512
dbf12d8bf2c033445086b6b7b50a4eb3810f1219a40d5eafe3b7094118c95539573b543ad123754f0c68c97d9b39fa9c2e853c4aac8170a54f48b5e19cd5ad58

Download Submit
C:\Windows\system\FPeSRkh.exe

Filesize
2.0MB

MD5
f23a2d662b29b93d71ab424f7d294d50

SHA1
ab3cb86a831bfd4bc1caaff87a3f053872c03b79

SHA256
b2ec32cdf4d0f08754868bc88763696904ba99062977bd8a0d0db83b2ea8d851

SHA512
1a030b6e8a1d57a7bceb7ee20ab91d6c09aefbdff1e4f0226272052c7ba57f2335d8c38e408b069ffe96061b9c7cc76c7fc457068e245bd1e9edee76c118a099

Download Submit
C:\Windows\system\GsAnYid.exe

Filesize
2.0MB

MD5
18dda9f574c02249041c24af11884f1d

SHA1
b9468abf96bfd2564be1a81bfc0f779a3a10faad

SHA256
dd88e85e4f11c274a20c15e5452be001d859debab9d75a49e2045e2381f689be

SHA512
06ed583b888019639875dbdd7802f26a91bf8bc4ee37ae0c9704a5894646fae7a51889b05e3d55e84011360639bd59f0c967184bc890bf4796e08ee0657b4196

Download Submit
C:\Windows\system\HOiqfOC.exe

Filesize
2.0MB

MD5
5df3959c81c0c24a607649e79c7e268e

SHA1
d27f876d0043fafe7c0fb2cc4463b2137b77af9c

SHA256
d7c74601eddd952f7258d9caddaffedb06d7e924c3e7b109739217358ea3de7f

SHA512
ebd84c8651d1336270e799607cce65152bbce9b00d3dc0ecefb029e2447220428a6c626a7d53af8f7c4dbfa4e4709c79587093b42a955d9a8b5eb8c07d36a8a7

Download Submit
C:\Windows\system\InGbiBv.exe

Filesize
2.0MB

MD5
2cb037767fe303fa08874860892b0de5

SHA1
6eb8215255e3b7c2fdad5a6689afe9f37b8fe4ca

SHA256
1ce0f6ea9820466ecb4978091551b71df209ba70214d268f5b43c87e6ef90a8f

SHA512
8a0058689bbbf378d6f250c7b60c131c4db1b1eab56c77a9d7b327aa6edbb4a0c30c5023f6f854e2d651eea139585e6b2a98022a891b0d531de62abae13a6322

Download Submit
C:\Windows\system\JULWDGn.exe

Filesize
2.0MB

MD5
1f85cbf1e9cb7c9f508a304f828ffc3a

SHA1
bc7b01554c756e268b10da50b8868f146cb4f4c0

SHA256
e401052df0d178f65ed80f43163ab8393958b65708986d2aa0b2b9423a6f595f

SHA512
3c9b4ca2443b25385498879101ea9272e4bec6d754ee2bf0301f008c2e8bf84efd08800cbb92a9c69dc9061c34c3ebb5d3304c704e6db2f3d320d64957ac4ee2

Download Submit
C:\Windows\system\JqbRhyO.exe

Filesize
2.0MB

MD5
2dd6dcb793374ad00f83961cee55e555

SHA1
03dbb9a9591bcc0af64b5f1b3cdf4f51b7d1ef7d

SHA256
ccc58a74109872570bdeae641370ab70dc41478b65e17f6bc9a279993712092d

SHA512
b33e0d035df067f64b08ca8286b8171f71ea1a5074f084c97dac65620279ba1b3ca114268354ef87e017b6891ec5b724572f76d0b6541f99d346738106bd0162

Download Submit
C:\Windows\system\LHglSAF.exe

Filesize
2.0MB

MD5
3ebc822c8fa309b7fd3630c49ab255e1

SHA1
b0ac4fd6761e365656455d43c7e32350f61af178

SHA256
decb6be96df5b7d0431cfd9e116b32345b47989829c098762193a003a1aad564

SHA512
27e0043111f07e6db9709a7ec609b652465fb61cba77a9418fd295c1a125c20d32274afcc83e2caed269152100536e54d8268b8087e96bdb4b203f870976affd

Download Submit
C:\Windows\system\MEpEerB.exe

Filesize
2.0MB

MD5
13932a00af9ed18dddf119ef9c7f5acc

SHA1
ad1621f1d1e2a7b5e61703a2aad2df8145b8ec7b

SHA256
19ca5e726d8076075f7c369bfb0f3e2adc5d97a15f2e2db61b3276774db94ca4

SHA512
6449bae781816e3e30660b546937c600be737ccca5e0ea77e18e753b4b8e493de432d36967e101b7930dc754f3269267c26103c77a03a3e127ce9a791e3a7720

Download Submit
C:\Windows\system\MOwmWft.exe

Filesize
2.0MB

MD5
77bc3db0abd8594cb3b1761ad668ac82

SHA1
1ca0047921c90676fc45158921f9e43e7355364a

SHA256
df21f43659003bbca6277eb1abc8714b323170f73cd66edda7a8d7c05f56353a

SHA512
849fc7debbeb0eec3db73019edaca0c5bb418ca16221b380bcc11c86e9813844e1618ef8fef64de1bd8d9102e7cec5b8a6817d78838db157ac9c06a417b27618

Download Submit
C:\Windows\system\PIpYDBs.exe

Filesize
2.0MB

MD5
507dab895c75b984d79e6c773a33bd27

SHA1
e542b5943d14bb8a7885dd42c12c8241778daaaf

SHA256
0b662c72968a92b470f425f528a51ef4ee5363204ddaa2c49d5ca9c3fcd05f2d

SHA512
eb6a0c4ee30eafad55e826d5cf49e411a2055ea9d26abcfb6cfe27cc89ed742a20ad549e427d6e0a3606e47e6d1b17d5de276ae88503366afef5e97efd89430e

Download Submit
C:\Windows\system\TOZfIyB.exe

Filesize
2.0MB

MD5
ad627bbe2e64c57214bf43225b2368c9

SHA1
41b2227bdf01d18ce5d2ad7a86b06318e06095c9

SHA256
a0a670088350632a5a6a85e7780e915f9641277d3ddd9ded11e47cf8af2abd76

SHA512
15b3292a8c2e7a28256c4475534e55222b47ef5845114878b59d75b40eb00c8a430f27dca9775947438fb1e73a1f6388a0829c0a3fdeff3523baee96ac25e848

Download Submit
C:\Windows\system\WkDUoCj.exe

Filesize
2.0MB

MD5
224a25e79c4af55aa3bcf60dbb1f1fca

SHA1
6bebd247b7a2eb121909fc61acedbba7a37081ea

SHA256
d7c2e0480bec3e10849db6d512e52a48c30e711fab62d8c3650a2e8e7171d7ce

SHA512
c64823c35f9e0ac37c83a70e6382ba6fbe54c1eff2e330885858250aec45606a59dcccf8cb211fb5f8cc8325d51312bfed6227db5aee45ded1ce43e4430e358c

Download Submit
C:\Windows\system\YuHaQIr.exe

Filesize
2.0MB

MD5
81c5b6f153d71be589a268d9cc706033

SHA1
3ac551751557d20c0a060edf6e2a409372d6f3ad

SHA256
c4f7976760575e64a45d3eae2d54a81f5222b34d8e04274ca87dd09361b5e69e

SHA512
b3f2ddd99940a346c0d7b79514da851cee8ff6e13f1bb04b015cdf2703237674d9e53c22bf8559c3a96f01700b50e737bd93951e8362917cda286240f13b108a

Download Submit
C:\Windows\system\ZKQsYdd.exe

Filesize
2.0MB

MD5
13aaf80285ce2a4eacae089ed883edc2

SHA1
631f4d6449c5be7207a3b28b73e8862f7489bc71

SHA256
00d7fe5faffa8fc3f3a2896b7a42527a97c0bc5d03694efc84cb67f2aa99378f

SHA512
34dff715b62722c3e8bb39252e04237424e79b7e4d0c20d58b8029c9afdc70da681daa589a24867b034cd54b0469f7f247f243d15ff23915e6815c2f22aa92a2

Download Submit
C:\Windows\system\cFvhdXK.exe

Filesize
2.0MB

MD5
2b7e14ae2c6de1327ad584634f79bde3

SHA1
1d49bb7686ae5e3d7d036b634b903cc913d30f51

SHA256
ddc1776496cc9d2175df61cec72cc7b567fa7506f01f41fa3db460316c754c44

SHA512
86b5c5acfbcbba5ab42bf04e6e9f795da202550088433dcc6c049891bdd9d49fd68029c0840149ad119772fc78f1e5a654ce4051614ca38380b5b0b2c9d649c8

Download Submit
C:\Windows\system\hLmjGsX.exe

Filesize
2.0MB

MD5
cc9540d7bb30f5e2e4dee1790b513eea

SHA1
a751648754033320e88a69b7772a7b9c9f8e1818

SHA256
d3c57458ba5055aaa6c46a50faa2dc08e181066924873363f7fd88f3186f111d

SHA512
a0652621fcf7a2ad277abd321be28d257509071ba3e8f1a74da87f62c2b01d07d9ac66090172bad63166325cfe1437d50f52e7a4c9d3317d13a23127d21f51fc

Download Submit
C:\Windows\system\hVDhoyj.exe

Filesize
2.0MB

MD5
003420d341f71fc262050fb99dde6f5b

SHA1
0b319b24bf48d455819b6ffc16c3dc6f201a4657

SHA256
45f19d4c21532eb71d226f9bf8aa0f467cce6c31377631c956859451200186b1

SHA512
e0fd04ce1a57094c78cc8b9fa2a7ebb91ea87fcfdc8f23668254572607c3a1f6e46b17d3908498330805102fed20886565c255e4483c1dc0639d2e523e7aea7f

Download Submit
C:\Windows\system\jAPcftJ.exe

Filesize
2.0MB

MD5
280b72f8b5e72c4a7e1045ac5b0fe91f

SHA1
38c591bcd254a56225114c38f697e6e10bb6af6c

SHA256
d3f93ec78213b2bbfc00cb3470329ee5e1c219234621178b19d6e12ded1d7620

SHA512
1b885a6c3756ccac9786fd756439d7da8dbb778033512613b66e604911a2a801db688ad446c42c620dad25dfbb93cfde32d0f760ce29aa3efbd62f3a6a889767

Download Submit
C:\Windows\system\mbMxyMq.exe

Filesize
2.0MB

MD5
8093d80bfb596f853dec827262749039

SHA1
8f401bdcc7ef6f538c3b9586285fbcd9a4360d3d

SHA256
5ca78a6ff3414d4c442aeb81d0f63ea11bb2898afa11d995c1b9fd669e392828

SHA512
19cac6a3339c8b98924532235197c12a77d93b02cdcbae89c276c975df5198121abc83b4f54ba537b27877778aa28294abeb03448798b0f4ee000971959002ab

Download Submit
C:\Windows\system\nHoipkF.exe

Filesize
2.0MB

MD5
6b2983b272efe11f31d125fe58904d91

SHA1
08b8e7eba00c1ef05c1a22b9805f138d071f577e

SHA256
bdd39167917eb081755979ae689ff351f938a43ea495896a580672322cd5960d

SHA512
9437524dc903732adcbdb8f1889b9c79f04da08667ee763b2de0af057802c3cd72a22c009b2afb6f29602f1e25b03c4d3a484921d597d38c8c2f6b698cd6b1de

Download Submit
C:\Windows\system\rApnXjU.exe

Filesize
2.0MB

MD5
bfaf119ede783a682a8e49474b1d1e7d

SHA1
45d828b598955e4441f9af82c4ee66be5f628e2e

SHA256
b13f6acb20464b5586dabdf4d4a36d71e884a4886d4e0f5981c095a7c4a60fe6

SHA512
13fae4b62402249bda28b10af4bab038ad8e5ae386901faac143333de37024dc774a373dc3326abd47d35910ea26d92b26644469353f33789b17389fbc51e9b1

Download Submit
C:\Windows\system\ukINkgA.exe

Filesize
2.0MB

MD5
411cd029bac05fa79014e4441014f7b4

SHA1
468dbfbacfb58b456c1d16c682b92436b0d53f7f

SHA256
925bb7b0c1656ffdd0e9907d12cfa52140d17ead0537b4dfa8da97f4254a773c

SHA512
c028fd3d5768b979d477eefac8242b86d5962eb412b3de6bf489cf88d41544ce15d428e4b90ac45b81e4951bc30a17d832e5bf339ee9bbc850235d20a905c59f

Download Submit
C:\Windows\system\vdnafiI.exe

Filesize
2.0MB

MD5
a3405d0cea3442e09eedcc1f91fa4320

SHA1
ab9bc0a0ca8d34a5dc147d062f50993a26bbdc21

SHA256
61d99c0fb05f3058b5033f1102edc17b6857ad430a7a9a8e1bd0ba45f4c18f9c

SHA512
c36ecbb394b38830dc7849cb685b0654f4dabf08b95f620be062c3cae3197d39182a89b3f6580e7ce149539874fccf3add9ca34de9f1d6eee87bbfbba9c5ed14

Download Submit
C:\Windows\system\wtParhg.exe

Filesize
2.0MB

MD5
c3f98ec0cbd4e67c5bba14de5d709c58

SHA1
1447f44f045730c961ea948650969d1a59b1b8cf

SHA256
aa8593f8b6ce54a63e0f825da424299b36bf17e82d5c344f46a26479f6260e2a

SHA512
83534790b2ad9fb79938fb813721c205f91d9fffd4c3acf42aa517540c11caa1588b6066628d64b84c61c3703db3e3b0be9dac1d802936cee23412ca2fb40cb1

Download Submit
C:\Windows\system\zmTTAtt.exe

Filesize
2.0MB

MD5
dffd4fafa86a5010dafa9de87db043a4

SHA1
86ab7dc642e85d2a4e62dbe80cb2243dba90d841

SHA256
2e989cb22be5666500d3b713b0c11ba1c7bd2e15426893f018b54a533cfceb35

SHA512
68a33eb9f68261f20303f659f1da26472bb0b72057a14145640a3c7cef44a6fa45f7ed32a4f9eec7ccd6fa2441cb2821fe8080c3ad985dc330bd81571a13040c

Download Submit
\Windows\system\QUeKYZn.exe

Filesize
2.0MB

MD5
32a61d4a46162a1d7ce06d50ef4e4ef2

SHA1
32c1e33c4795f04dae84f58bc28e1b138fd71d0a

SHA256
f6ca6aac88afac01923aa46f99cc8632d340cb7203f0bd056f52ddef0b087227

SHA512
305190a4cd98be1a8bd65c6ea69f05122136ad69c88cf63f85cf2c821a86970855509accf607154acfcaa160b7af6dd76bb552577868fc8c4e3fa2c521fc80fb

Download Submit
\Windows\system\RqqewOi.exe

Filesize
2.0MB

MD5
e99f2e99ae04ba289de8854784232f59

SHA1
0bc9f7cb8feee99695176c185af1e5f15d739f2e

SHA256
78bd1feb76eeb05ed21e57cbb86430a92178df8f7505531a635f033628aad07d

SHA512
a1bf83837fe818f83947eb637b1b85c22cbb332ed6d1e4e31dce0033888e16e32552112c5c4ffe49a2c8fcc187e4de2ee58bd721c7ab10969d949535c1570b3b

Download Submit
\Windows\system\UfbETZp.exe

Filesize
2.0MB

MD5
6052f6bd01664d6457aec6b809c286c1

SHA1
ab31f4f2cfb8a365a89a10cf636893719184eee4

SHA256
0c927b064aff759ae03f3b008f2abe7b39d44e16266bcc7f67e320118e1b53fb

SHA512
6e2640974e3ee80b70f76d79858c3ec9834bb413c6666a7068d9f5445fcca56deb37cb8cb572459b6eb25a78932b69c57958ba822070db60744d27608cf17092

Download Submit
\Windows\system\UsqMtHt.exe

Filesize
2.0MB

MD5
8ca0aa13e6a5616797eb1cc9e618d8de

SHA1
3b50516c61ec81e21b739f3f15b7bcf9bd847dbb

SHA256
7c58dea0d2e7538cb85e4bd7abff1dd7c716bb6499262fd0bc549843b6b5f7ae

SHA512
b8ae366feec499b091453cd7d9605effb7405f9a4b3cb4bd303f3f1d56598525383ee00a31b1926320f26f8597aed5dde4168211d2286b8777a9a2ed38e4a62a

Download Submit
\Windows\system\WKdudfH.exe

Filesize
2.0MB

MD5
a66be6b9817d9048d579045bbacaa593

SHA1
631c2db230611d2ff193dc88886e0d63badd3c1a

SHA256
2ce8630144e4fef8f21a07bffe66eae6b84364ef34e3fd98e789384cd8420f01

SHA512
87e06109b24973df8bd9425a5b3a2af4912280443690ac1c910c950cad13662b6c9ea5530f7ff3dfb4d76bb367501222c7d06c1d4d5937f65c88605e90a3d6d6

Download Submit
\Windows\system\dOIWYcN.exe

Filesize
2.0MB

MD5
d423aaac873974aba963e55643459401

SHA1
94ef639a65feeed9c39678551bed7e18014a1573

SHA256
b3f0bb58a043f8c45b99932abe28e44db708c2d9fa9d85c0a556a65c56dfdf14

SHA512
e9b4e5fd1aa9291aff7276493f1253e34b8a1a32a88f186835e5afae2028f32ab429b007a6cdee6c6811d63479e7bddcbf324c52f6dfe7066f2197829ae438b0

Download Submit
\Windows\system\kIUqxOL.exe

Filesize
2.0MB

MD5
7dfbda89ba67e389c369d29078e96993

SHA1
3320c244cd0f706acc11322977e3bbdf388e4ccc

SHA256
ff19d4e974cc2317607220394867c4173014bb8ddcb2195dfd3e12388688cccb

SHA512
f7ab820750e06999375f3ba9d2e968f418fa1ea54f084a9fb568c8e0ffe1305bb4f94902e8142b5fb192df66656b46038251567303e884a3b45fa71ca82c7b45

Download Submit
\Windows\system\pCWKTeO.exe

Filesize
2.0MB

MD5
03199de94f2f27c27cdd5366498d64fd

SHA1
5320a24d9e4582e1a652d05d739fdfcefaa6b453

SHA256
28fedcd3268a431556a390fbb260e2393a33c9f9ba7b0a07962cef8acd4402d7

SHA512
ee538ea1ce6866c191e640531e84be85648c8c17c3d287be9d7566037da005bb4098b1b13ab27ba5c660c9ffe3e5b8738b1e70096001bcae31000f3799d38ba8

Download Submit
\Windows\system\wFXPhDt.exe

Filesize
2.0MB

MD5
be26cd070bd178a92ad37f3116cff24f

SHA1
bb600965747487a1a36c5a1926e6249fe1da4592

SHA256
4fd2c18cf12d0cc8870fbfa8eb27c19d532a3e80b3bc7faf34c9234f8d779fa5

SHA512
cb08cc1d4c85ed54ec694bcdb2f74c39ccfed2f73f699d957a40eb91aebc5ff249aa8a4912ed03b35cfd41600cac537e89fd5930ce26c6bff5f11451448e0ea6

Download Submit
\Windows\system\wyNeFXb.exe

Filesize
2.0MB

MD5
962e0a3e63e8a4f52678df87f93c90cb

SHA1
320e9de68662799e1fe3f6149368482b7fa104cf

SHA256
c6e78972a9aecd06ff4d75de764992d1621af24f8bc4e7412b1a63d28d6c6be3

SHA512
b38dae322e3e9505901453afe2d02127580b7f0e49aee24ca148d9f2ffe0c897180d0ad33d7da1bc57251b3fb108d739202616d42991db318db828cd31eae675

Download Submit
memory/1984-148-0x000000001B520000-0x000000001B802000-memory.dmp

Filesize
2.9MB

Download
memory/1984-149-0x0000000002760000-0x0000000002768000-memory.dmp

Filesize
32KB

Download
memory/2024-187-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2108-191-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2332-150-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-162-0x000000013F6E0000-0x000000013FAD2000-memory.dmp

Filesize
3.9MB

Download
memory/2436-151-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2456-154-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2504-171-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-152-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2584-153-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-194-0x000000013F320000-0x000000013F712000-memory.dmp

Filesize
3.9MB

Download
memory/2764-21-0x000000013F680000-0x000000013FA72000-memory.dmp

Filesize
3.9MB

Download
memory/2856-181-0x000000013F840000-0x000000013FC32000-memory.dmp

Filesize
3.9MB

Download
memory/2856-26-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2856-33-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-30-0x000000013FA00000-0x000000013FDF2000-memory.dmp

Filesize
3.9MB

Download
memory/2856-172-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-23-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2856-164-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-19-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-13-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-155-0x0000000003090000-0x0000000003482000-memory.dmp

Filesize
3.9MB

Download
memory/2856-4-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2972-178-0x000000013F3B0000-0x000000013F7A2000-memory.dmp

Filesize
3.9MB

Download