xmrig | 679bb31e004b5a0ab73e7143d3b011c3f739cde38815daf69299b31e1f65cb1b

Analysis

max time kernel
17s
max time network
30s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01-05-2024 13:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
Size

2.8MB
MD5

0beb6d1d884c9a459cb6b04bf2dcc19e
SHA1

5d9d221491586a351a249988644272b7b410709d
SHA256

679bb31e004b5a0ab73e7143d3b011c3f739cde38815daf69299b31e1f65cb1b
SHA512

6d05eb348328f27e4cb3d347177f46d59b43dfbfa5435040354dee3057aee34d91662aa27b84f8764b288c649f7877edb479bdda96e707c65fdea9621c0337fd
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTleLWrJ5I/jaM:NABc

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2588-134-0x000000013F170000-0x000000013F562000-memory.dmp	xmrig
behavioral1/memory/2900-152-0x000000013F910000-0x000000013FD02000-memory.dmp	xmrig
behavioral1/memory/2612-157-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/2468-148-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2556-146-0x000000013FD00000-0x00000001400F2000-memory.dmp	xmrig
behavioral1/memory/2392-145-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2476-143-0x0000000003780000-0x0000000003B72000-memory.dmp	xmrig
behavioral1/memory/2432-142-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2400-140-0x000000013F970000-0x000000013FD62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1648	QuQSpcx.exe
2612	nKuIjEv.exe
2588	ZoPHyrt.exe
2400	EfmsrTj.exe
2432	dGFtajP.exe
2392	krfyIcl.exe
2556	BAOvjdi.exe
2468	RdzBOWq.exe
2900	ZlcyHKQ.exe
2120	ToGdvjk.exe
2660	JXGTVIy.exe
2720	LQFRbqi.exe
1440	vdtisyT.exe
1700	DzDUrbu.exe
1684	famQhMt.exe
852	JSVFnum.exe
2668	yOAftiW.exe
2724	nMhSBXS.exe
1548	DyvfwEH.exe
1516	qBJEyJw.exe
1460	zyjFmqX.exe
2640	ICgnoIM.exe
2040	jMgPpLw.exe
2488	pPtIoZH.exe
2000	dzfhkhX.exe
1772	vumqFjd.exe
2976	oKJBgNE.exe
2352	xjVAJpW.exe
344	ekHiNfO.exe
1452	KTmNXuR.exe
1292	uziQKUM.exe
2180	znMOzuz.exe
768	MjaNyEz.exe
2844	ipCbLdL.exe
2292	eTjXqim.exe
1132	fLtSYPd.exe
2108	cEgBdyf.exe
2100	LUqtWnk.exe
2840	qVMUrlx.exe
804	GDzrvaD.exe
2300	lmJpcle.exe
2248	cmKJexG.exe
2232	bfNNmTs.exe
2312	EBBqNhN.exe
2204	vcsllbG.exe
2084	zxInfuV.exe
276	herentQ.exe
2064	PPnmRhp.exe
2332	bsTxNaJ.exe
1816	IJXTtmb.exe
2700	lAwiAiY.exe
2684	aaidcjt.exe
2648	vjekIXO.exe
2632	UKDIvnI.exe
848	omHuQIa.exe
1520	szVWyxw.exe
2636	OBPHiuf.exe
2752	JExzAVU.exe
2616	LMzuNvS.exe
2028	CovvlHo.exe
2972	SRHGYPs.exe
108	aycWATS.exe
2080	rxAxbzE.exe
2132	lTcCNdo.exe

Loads dropped DLL 64 IoCs

pid	Process
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2476-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x000b000000015bb9-3.dat	upx
behavioral1/files/0x0007000000015cdb-15.dat	upx
behavioral1/files/0x0007000000015cec-13.dat	upx
behavioral1/memory/1648-14-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x0038000000015ca5-23.dat	upx
behavioral1/files/0x001400000000549e-32.dat	upx
behavioral1/files/0x0006000000016c7a-49.dat	upx
behavioral1/files/0x0006000000016cc9-57.dat	upx
behavioral1/files/0x0006000000016d0e-82.dat	upx
behavioral1/files/0x0006000000016d3b-97.dat	upx
behavioral1/files/0x0006000000016ce1-104.dat	upx
behavioral1/files/0x0006000000016d06-109.dat	upx
behavioral1/files/0x0006000000016d67-128.dat	upx
behavioral1/files/0x0006000000016d44-122.dat	upx
behavioral1/memory/2588-134-0x000000013F170000-0x000000013F562000-memory.dmp	upx
behavioral1/files/0x0006000000016d4b-141.dat	upx
behavioral1/memory/2900-152-0x000000013F910000-0x000000013FD02000-memory.dmp	upx
behavioral1/files/0x0006000000017060-162.dat	upx
behavioral1/files/0x0009000000018648-187.dat	upx
behavioral1/files/0x0006000000017474-184.dat	upx
behavioral1/files/0x0006000000017458-177.dat	upx
behavioral1/files/0x0006000000017384-170.dat	upx
behavioral1/files/0x0038000000015cad-163.dat	upx
behavioral1/memory/2612-157-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/files/0x0006000000016f82-154.dat	upx
behavioral1/files/0x0006000000017465-182.dat	upx
behavioral1/files/0x0006000000017387-175.dat	upx
behavioral1/files/0x0006000000017185-168.dat	upx
behavioral1/memory/2468-148-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2556-146-0x000000013FD00000-0x00000001400F2000-memory.dmp	upx
behavioral1/memory/2392-145-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2432-142-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2400-140-0x000000013F970000-0x000000013FD62000-memory.dmp	upx
behavioral1/files/0x0006000000016d40-118.dat	upx
behavioral1/files/0x0006000000016d27-116.dat	upx
behavioral1/files/0x0006000000016d17-113.dat	upx
behavioral1/files/0x0006000000016cab-89.dat	upx
behavioral1/files/0x0006000000016cf5-68.dat	upx
behavioral1/files/0x0006000000016d1f-100.dat	upx
behavioral1/files/0x0006000000016cfe-81.dat	upx
behavioral1/files/0x0007000000016c2e-47.dat	upx
behavioral1/files/0x0006000000016ced-66.dat	upx
behavioral1/files/0x0008000000015d06-33.dat	upx
behavioral1/files/0x0008000000015d6e-41.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\duSWjvB.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\vhiqLse.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\MkeiAzG.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\DcCerAz.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\UyGdVha.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\IaTRYKe.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\LMzuNvS.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\DSWXyIA.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\roHPKHb.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lsehYkb.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\OHVZteH.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\NaOlrAt.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\vjkHOcn.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\vdtisyT.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\SRHGYPs.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\yRDwFYG.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\iOknjnC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ywXPVSF.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ewUQIGh.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\JXGTVIy.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\tCScAFP.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\oggDnCe.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\tyJIKcU.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\OBCqckH.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\USbFcUH.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ULiqOgl.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ZbfdDOx.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\zxKhZDT.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lmJpcle.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\PCMqRPt.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\PwxeQKE.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\JTDYRLu.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\eKGpSLm.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\GDzrvaD.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ABDiyMX.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\NXbmMui.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\pqZgRXO.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\fuiDUbX.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\ttCycOZ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\cbVVbMQ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\xOIOAlv.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\CbawaUj.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\eTjXqim.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\wjaByJJ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\MrDvysu.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\UCMQqUj.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\oRdBKkc.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\XwuwDqC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\qRAHIBY.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\gXNjWPb.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\XODPzzd.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\gijKWxn.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\VJhLKQf.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\bERnsNp.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\PPnmRhp.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\sMznyIl.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\kTGqAcS.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\qjkuIrJ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\rGuexyl.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\wxPPDqJ.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\oztdaih.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\jaBnNmC.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\lhPgFbf.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
File created	C:\Windows\System\LWEHbJL.exe	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
Token: SeDebugPrivilege	2320	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2320	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	29
PID 2476 wrote to memory of 2320	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	29
PID 2476 wrote to memory of 2320	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	29
PID 2476 wrote to memory of 1648	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	30
PID 2476 wrote to memory of 1648	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	30
PID 2476 wrote to memory of 1648	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	30
PID 2476 wrote to memory of 2588	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2588	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2588	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	31
PID 2476 wrote to memory of 2612	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	32
PID 2476 wrote to memory of 2612	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	32
PID 2476 wrote to memory of 2612	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	32
PID 2476 wrote to memory of 2400	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	33
PID 2476 wrote to memory of 2400	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	33
PID 2476 wrote to memory of 2400	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	33
PID 2476 wrote to memory of 2432	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	34
PID 2476 wrote to memory of 2432	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	34
PID 2476 wrote to memory of 2432	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	34
PID 2476 wrote to memory of 2556	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	35
PID 2476 wrote to memory of 2556	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	35
PID 2476 wrote to memory of 2556	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	35
PID 2476 wrote to memory of 2392	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	36
PID 2476 wrote to memory of 2392	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	36
PID 2476 wrote to memory of 2392	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	36
PID 2476 wrote to memory of 2468	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	37
PID 2476 wrote to memory of 2468	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	37
PID 2476 wrote to memory of 2468	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	37
PID 2476 wrote to memory of 2900	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	38
PID 2476 wrote to memory of 2900	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	38
PID 2476 wrote to memory of 2900	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	38
PID 2476 wrote to memory of 1700	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	39
PID 2476 wrote to memory of 1700	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	39
PID 2476 wrote to memory of 1700	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	39
PID 2476 wrote to memory of 2120	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	40
PID 2476 wrote to memory of 2120	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	40
PID 2476 wrote to memory of 2120	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	40
PID 2476 wrote to memory of 2668	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	41
PID 2476 wrote to memory of 2668	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	41
PID 2476 wrote to memory of 2668	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	41
PID 2476 wrote to memory of 2660	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	42
PID 2476 wrote to memory of 2660	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	42
PID 2476 wrote to memory of 2660	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	42
PID 2476 wrote to memory of 2724	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	43
PID 2476 wrote to memory of 2724	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	43
PID 2476 wrote to memory of 2724	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	43
PID 2476 wrote to memory of 2720	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	44
PID 2476 wrote to memory of 2720	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	44
PID 2476 wrote to memory of 2720	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	44
PID 2476 wrote to memory of 1548	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	45
PID 2476 wrote to memory of 1548	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	45
PID 2476 wrote to memory of 1548	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	45
PID 2476 wrote to memory of 1440	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	46
PID 2476 wrote to memory of 1440	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	46
PID 2476 wrote to memory of 1440	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	46
PID 2476 wrote to memory of 1516	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	47
PID 2476 wrote to memory of 1516	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	47
PID 2476 wrote to memory of 1516	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	47
PID 2476 wrote to memory of 1684	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	48
PID 2476 wrote to memory of 1684	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	48
PID 2476 wrote to memory of 1684	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	48
PID 2476 wrote to memory of 1460	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	49
PID 2476 wrote to memory of 1460	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	49
PID 2476 wrote to memory of 1460	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	49
PID 2476 wrote to memory of 852	2476	0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0beb6d1d884c9a459cb6b04bf2dcc19e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2320
- C:\Windows\System\QuQSpcx.exe
  C:\Windows\System\QuQSpcx.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ZoPHyrt.exe
  C:\Windows\System\ZoPHyrt.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\nKuIjEv.exe
  C:\Windows\System\nKuIjEv.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\EfmsrTj.exe
  C:\Windows\System\EfmsrTj.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\dGFtajP.exe
  C:\Windows\System\dGFtajP.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\BAOvjdi.exe
  C:\Windows\System\BAOvjdi.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\krfyIcl.exe
  C:\Windows\System\krfyIcl.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\RdzBOWq.exe
  C:\Windows\System\RdzBOWq.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\ZlcyHKQ.exe
  C:\Windows\System\ZlcyHKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\DzDUrbu.exe
  C:\Windows\System\DzDUrbu.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\ToGdvjk.exe
  C:\Windows\System\ToGdvjk.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\yOAftiW.exe
  C:\Windows\System\yOAftiW.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\JXGTVIy.exe
  C:\Windows\System\JXGTVIy.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\nMhSBXS.exe
  C:\Windows\System\nMhSBXS.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\LQFRbqi.exe
  C:\Windows\System\LQFRbqi.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\DyvfwEH.exe
  C:\Windows\System\DyvfwEH.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\vdtisyT.exe
  C:\Windows\System\vdtisyT.exe
  2⤵
  - Executes dropped EXE
  PID:1440
- C:\Windows\System\qBJEyJw.exe
  C:\Windows\System\qBJEyJw.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\famQhMt.exe
  C:\Windows\System\famQhMt.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\zyjFmqX.exe
  C:\Windows\System\zyjFmqX.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\JSVFnum.exe
  C:\Windows\System\JSVFnum.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\ICgnoIM.exe
  C:\Windows\System\ICgnoIM.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\jMgPpLw.exe
  C:\Windows\System\jMgPpLw.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\dzfhkhX.exe
  C:\Windows\System\dzfhkhX.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\pPtIoZH.exe
  C:\Windows\System\pPtIoZH.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\ipCbLdL.exe
  C:\Windows\System\ipCbLdL.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\vumqFjd.exe
  C:\Windows\System\vumqFjd.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\fLtSYPd.exe
  C:\Windows\System\fLtSYPd.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\oKJBgNE.exe
  C:\Windows\System\oKJBgNE.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\cEgBdyf.exe
  C:\Windows\System\cEgBdyf.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\xjVAJpW.exe
  C:\Windows\System\xjVAJpW.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\LUqtWnk.exe
  C:\Windows\System\LUqtWnk.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\ekHiNfO.exe
  C:\Windows\System\ekHiNfO.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\qVMUrlx.exe
  C:\Windows\System\qVMUrlx.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\KTmNXuR.exe
  C:\Windows\System\KTmNXuR.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\GDzrvaD.exe
  C:\Windows\System\GDzrvaD.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\uziQKUM.exe
  C:\Windows\System\uziQKUM.exe
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Windows\System\lmJpcle.exe
  C:\Windows\System\lmJpcle.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\znMOzuz.exe
  C:\Windows\System\znMOzuz.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\cmKJexG.exe
  C:\Windows\System\cmKJexG.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\MjaNyEz.exe
  C:\Windows\System\MjaNyEz.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\bfNNmTs.exe
  C:\Windows\System\bfNNmTs.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\eTjXqim.exe
  C:\Windows\System\eTjXqim.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\vcsllbG.exe
  C:\Windows\System\vcsllbG.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\EBBqNhN.exe
  C:\Windows\System\EBBqNhN.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\zxInfuV.exe
  C:\Windows\System\zxInfuV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\herentQ.exe
  C:\Windows\System\herentQ.exe
  2⤵
  - Executes dropped EXE
  PID:276
- C:\Windows\System\PPnmRhp.exe
  C:\Windows\System\PPnmRhp.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\bsTxNaJ.exe
  C:\Windows\System\bsTxNaJ.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\szVWyxw.exe
  C:\Windows\System\szVWyxw.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\IJXTtmb.exe
  C:\Windows\System\IJXTtmb.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\BTZHLrz.exe
  C:\Windows\System\BTZHLrz.exe
  2⤵
  PID:2516
- C:\Windows\System\lAwiAiY.exe
  C:\Windows\System\lAwiAiY.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HgKzKSg.exe
  C:\Windows\System\HgKzKSg.exe
  2⤵
  PID:2672
- C:\Windows\System\aaidcjt.exe
  C:\Windows\System\aaidcjt.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\tCMHjea.exe
  C:\Windows\System\tCMHjea.exe
  2⤵
  PID:2436
- C:\Windows\System\vjekIXO.exe
  C:\Windows\System\vjekIXO.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\AVPpiit.exe
  C:\Windows\System\AVPpiit.exe
  2⤵
  PID:2904
- C:\Windows\System\UKDIvnI.exe
  C:\Windows\System\UKDIvnI.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\EQdBKwl.exe
  C:\Windows\System\EQdBKwl.exe
  2⤵
  PID:1760
- C:\Windows\System\omHuQIa.exe
  C:\Windows\System\omHuQIa.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\oRdBKkc.exe
  C:\Windows\System\oRdBKkc.exe
  2⤵
  PID:1592
- C:\Windows\System\OBPHiuf.exe
  C:\Windows\System\OBPHiuf.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\yiHlTeW.exe
  C:\Windows\System\yiHlTeW.exe
  2⤵
  PID:2016
- C:\Windows\System\JExzAVU.exe
  C:\Windows\System\JExzAVU.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\uxcdLFu.exe
  C:\Windows\System\uxcdLFu.exe
  2⤵
  PID:340
- C:\Windows\System\LMzuNvS.exe
  C:\Windows\System\LMzuNvS.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\iBMkNca.exe
  C:\Windows\System\iBMkNca.exe
  2⤵
  PID:2472
- C:\Windows\System\CovvlHo.exe
  C:\Windows\System\CovvlHo.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\IaTRYKe.exe
  C:\Windows\System\IaTRYKe.exe
  2⤵
  PID:1096
- C:\Windows\System\SRHGYPs.exe
  C:\Windows\System\SRHGYPs.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\jSOUnXg.exe
  C:\Windows\System\jSOUnXg.exe
  2⤵
  PID:1500
- C:\Windows\System\aycWATS.exe
  C:\Windows\System\aycWATS.exe
  2⤵
  - Executes dropped EXE
  PID:108
- C:\Windows\System\nAHstmr.exe
  C:\Windows\System\nAHstmr.exe
  2⤵
  PID:2096
- C:\Windows\System\rxAxbzE.exe
  C:\Windows\System\rxAxbzE.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\yLntPrZ.exe
  C:\Windows\System\yLntPrZ.exe
  2⤵
  PID:384
- C:\Windows\System\lTcCNdo.exe
  C:\Windows\System\lTcCNdo.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\JYfWIao.exe
  C:\Windows\System\JYfWIao.exe
  2⤵
  PID:1176
- C:\Windows\System\UDPCcrT.exe
  C:\Windows\System\UDPCcrT.exe
  2⤵
  PID:920
- C:\Windows\System\XdpCtVo.exe
  C:\Windows\System\XdpCtVo.exe
  2⤵
  PID:2956
- C:\Windows\System\DSWXyIA.exe
  C:\Windows\System\DSWXyIA.exe
  2⤵
  PID:376
- C:\Windows\System\zLvXfmO.exe
  C:\Windows\System\zLvXfmO.exe
  2⤵
  PID:908
- C:\Windows\System\wnakpsn.exe
  C:\Windows\System\wnakpsn.exe
  2⤵
  PID:2256
- C:\Windows\System\mQYBCek.exe
  C:\Windows\System\mQYBCek.exe
  2⤵
  PID:1640
- C:\Windows\System\VYjEJJc.exe
  C:\Windows\System\VYjEJJc.exe
  2⤵
  PID:1624
- C:\Windows\System\OmRfNaV.exe
  C:\Windows\System\OmRfNaV.exe
  2⤵
  PID:1920
- C:\Windows\System\hSKOPLK.exe
  C:\Windows\System\hSKOPLK.exe
  2⤵
  PID:1912
- C:\Windows\System\LxOhZeu.exe
  C:\Windows\System\LxOhZeu.exe
  2⤵
  PID:2412
- C:\Windows\System\vsawVUD.exe
  C:\Windows\System\vsawVUD.exe
  2⤵
  PID:1840
- C:\Windows\System\bAoWmYu.exe
  C:\Windows\System\bAoWmYu.exe
  2⤵
  PID:1776
- C:\Windows\System\YiaUWvr.exe
  C:\Windows\System\YiaUWvr.exe
  2⤵
  PID:1544
- C:\Windows\System\XwuwDqC.exe
  C:\Windows\System\XwuwDqC.exe
  2⤵
  PID:2376
- C:\Windows\System\UnHalwr.exe
  C:\Windows\System\UnHalwr.exe
  2⤵
  PID:480
- C:\Windows\System\OnsNRMn.exe
  C:\Windows\System\OnsNRMn.exe
  2⤵
  PID:452
- C:\Windows\System\lhPgFbf.exe
  C:\Windows\System\lhPgFbf.exe
  2⤵
  PID:1596
- C:\Windows\System\SrXIuyR.exe
  C:\Windows\System\SrXIuyR.exe
  2⤵
  PID:2176
- C:\Windows\System\rNOzZou.exe
  C:\Windows\System\rNOzZou.exe
  2⤵
  PID:3088
- C:\Windows\System\thMqioj.exe
  C:\Windows\System\thMqioj.exe
  2⤵
  PID:3104
- C:\Windows\System\qxjjvGs.exe
  C:\Windows\System\qxjjvGs.exe
  2⤵
  PID:3120
- C:\Windows\System\QhlKuDp.exe
  C:\Windows\System\QhlKuDp.exe
  2⤵
  PID:3136
- C:\Windows\System\PXidtbk.exe
  C:\Windows\System\PXidtbk.exe
  2⤵
  PID:3152
- C:\Windows\System\VTMiayS.exe
  C:\Windows\System\VTMiayS.exe
  2⤵
  PID:3172
- C:\Windows\System\bPVWjOA.exe
  C:\Windows\System\bPVWjOA.exe
  2⤵
  PID:3188
- C:\Windows\System\wjQkVDU.exe
  C:\Windows\System\wjQkVDU.exe
  2⤵
  PID:3212
- C:\Windows\System\roHPKHb.exe
  C:\Windows\System\roHPKHb.exe
  2⤵
  PID:3228
- C:\Windows\System\GKDnMBP.exe
  C:\Windows\System\GKDnMBP.exe
  2⤵
  PID:3252
- C:\Windows\System\FjXpSZR.exe
  C:\Windows\System\FjXpSZR.exe
  2⤵
  PID:3272
- C:\Windows\System\ZCcRTWn.exe
  C:\Windows\System\ZCcRTWn.exe
  2⤵
  PID:3288
- C:\Windows\System\hxSXQTL.exe
  C:\Windows\System\hxSXQTL.exe
  2⤵
  PID:3304
- C:\Windows\System\rpvwRQd.exe
  C:\Windows\System\rpvwRQd.exe
  2⤵
  PID:3320
- C:\Windows\System\aYryieo.exe
  C:\Windows\System\aYryieo.exe
  2⤵
  PID:3336
- C:\Windows\System\PorTyQI.exe
  C:\Windows\System\PorTyQI.exe
  2⤵
  PID:3356
- C:\Windows\System\bTjEwcN.exe
  C:\Windows\System\bTjEwcN.exe
  2⤵
  PID:3372
- C:\Windows\System\CYjeZTD.exe
  C:\Windows\System\CYjeZTD.exe
  2⤵
  PID:3392
- C:\Windows\System\WqXArHW.exe
  C:\Windows\System\WqXArHW.exe
  2⤵
  PID:3412
- C:\Windows\System\MZAfRXc.exe
  C:\Windows\System\MZAfRXc.exe
  2⤵
  PID:3436
- C:\Windows\System\sMznyIl.exe
  C:\Windows\System\sMznyIl.exe
  2⤵
  PID:3456
- C:\Windows\System\GfOfYMc.exe
  C:\Windows\System\GfOfYMc.exe
  2⤵
  PID:3472
- C:\Windows\System\vwNZxNM.exe
  C:\Windows\System\vwNZxNM.exe
  2⤵
  PID:3488
- C:\Windows\System\EEggSoS.exe
  C:\Windows\System\EEggSoS.exe
  2⤵
  PID:3504
- C:\Windows\System\nRMOVck.exe
  C:\Windows\System\nRMOVck.exe
  2⤵
  PID:3520
- C:\Windows\System\zeLmpwP.exe
  C:\Windows\System\zeLmpwP.exe
  2⤵
  PID:3544
- C:\Windows\System\fDNdlDp.exe
  C:\Windows\System\fDNdlDp.exe
  2⤵
  PID:3560
- C:\Windows\System\KqnJIBo.exe
  C:\Windows\System\KqnJIBo.exe
  2⤵
  PID:3576
- C:\Windows\System\dfhLGhS.exe
  C:\Windows\System\dfhLGhS.exe
  2⤵
  PID:3592
- C:\Windows\System\lFZiBUm.exe
  C:\Windows\System\lFZiBUm.exe
  2⤵
  PID:3608
- C:\Windows\System\eyPucvc.exe
  C:\Windows\System\eyPucvc.exe
  2⤵
  PID:3624
- C:\Windows\System\kTGqAcS.exe
  C:\Windows\System\kTGqAcS.exe
  2⤵
  PID:3648
- C:\Windows\System\rofURSf.exe
  C:\Windows\System\rofURSf.exe
  2⤵
  PID:3664
- C:\Windows\System\qRAHIBY.exe
  C:\Windows\System\qRAHIBY.exe
  2⤵
  PID:3684
- C:\Windows\System\xCnIYHn.exe
  C:\Windows\System\xCnIYHn.exe
  2⤵
  PID:3704
- C:\Windows\System\QKcjaKb.exe
  C:\Windows\System\QKcjaKb.exe
  2⤵
  PID:3720
- C:\Windows\System\JdkHItz.exe
  C:\Windows\System\JdkHItz.exe
  2⤵
  PID:3736
- C:\Windows\System\AqRdMep.exe
  C:\Windows\System\AqRdMep.exe
  2⤵
  PID:3752
- C:\Windows\System\JtVIgNf.exe
  C:\Windows\System\JtVIgNf.exe
  2⤵
  PID:3768
- C:\Windows\System\YTNcsDn.exe
  C:\Windows\System\YTNcsDn.exe
  2⤵
  PID:3784
- C:\Windows\System\oNKWcwV.exe
  C:\Windows\System\oNKWcwV.exe
  2⤵
  PID:3800
- C:\Windows\System\ZdLRfbE.exe
  C:\Windows\System\ZdLRfbE.exe
  2⤵
  PID:3816
- C:\Windows\System\BDJBAQd.exe
  C:\Windows\System\BDJBAQd.exe
  2⤵
  PID:3832
- C:\Windows\System\OeEjUsX.exe
  C:\Windows\System\OeEjUsX.exe
  2⤵
  PID:3848
- C:\Windows\System\gXNjWPb.exe
  C:\Windows\System\gXNjWPb.exe
  2⤵
  PID:3864
- C:\Windows\System\NmDBpqq.exe
  C:\Windows\System\NmDBpqq.exe
  2⤵
  PID:3880
- C:\Windows\System\lsehYkb.exe
  C:\Windows\System\lsehYkb.exe
  2⤵
  PID:3896
- C:\Windows\System\uIGGXfe.exe
  C:\Windows\System\uIGGXfe.exe
  2⤵
  PID:3916
- C:\Windows\System\soGibac.exe
  C:\Windows\System\soGibac.exe
  2⤵
  PID:3932
- C:\Windows\System\iAQnkJW.exe
  C:\Windows\System\iAQnkJW.exe
  2⤵
  PID:3956
- C:\Windows\System\sQiuuaj.exe
  C:\Windows\System\sQiuuaj.exe
  2⤵
  PID:3988
- C:\Windows\System\ydmhsOx.exe
  C:\Windows\System\ydmhsOx.exe
  2⤵
  PID:4008
- C:\Windows\System\fdNQDOT.exe
  C:\Windows\System\fdNQDOT.exe
  2⤵
  PID:4024
- C:\Windows\System\Jswzska.exe
  C:\Windows\System\Jswzska.exe
  2⤵
  PID:4040
- C:\Windows\System\QZxEHwO.exe
  C:\Windows\System\QZxEHwO.exe
  2⤵
  PID:4056
- C:\Windows\System\MveueBm.exe
  C:\Windows\System\MveueBm.exe
  2⤵
  PID:4072
- C:\Windows\System\tyJIKcU.exe
  C:\Windows\System\tyJIKcU.exe
  2⤵
  PID:4092
- C:\Windows\System\OHVZteH.exe
  C:\Windows\System\OHVZteH.exe
  2⤵
  PID:2020
- C:\Windows\System\vStnceT.exe
  C:\Windows\System\vStnceT.exe
  2⤵
  PID:1196
- C:\Windows\System\fScVNlX.exe
  C:\Windows\System\fScVNlX.exe
  2⤵
  PID:1636
- C:\Windows\System\udlsBWP.exe
  C:\Windows\System\udlsBWP.exe
  2⤵
  PID:2580
- C:\Windows\System\GUdPvir.exe
  C:\Windows\System\GUdPvir.exe
  2⤵
  PID:3168
- C:\Windows\System\JYTaNMM.exe
  C:\Windows\System\JYTaNMM.exe
  2⤵
  PID:3196
- C:\Windows\System\Qdcknvn.exe
  C:\Windows\System\Qdcknvn.exe
  2⤵
  PID:3248
- C:\Windows\System\BsUDItF.exe
  C:\Windows\System\BsUDItF.exe
  2⤵
  PID:2492
- C:\Windows\System\ShsxJsC.exe
  C:\Windows\System\ShsxJsC.exe
  2⤵
  PID:3352
- C:\Windows\System\qjkuIrJ.exe
  C:\Windows\System\qjkuIrJ.exe
  2⤵
  PID:3388
- C:\Windows\System\HEktIQi.exe
  C:\Windows\System\HEktIQi.exe
  2⤵
  PID:3432
- C:\Windows\System\avtoVJW.exe
  C:\Windows\System\avtoVJW.exe
  2⤵
  PID:3496
- C:\Windows\System\duSWjvB.exe
  C:\Windows\System\duSWjvB.exe
  2⤵
  PID:3540
- C:\Windows\System\IcsGWPd.exe
  C:\Windows\System\IcsGWPd.exe
  2⤵
  PID:3572
- C:\Windows\System\CoTBEjU.exe
  C:\Windows\System\CoTBEjU.exe
  2⤵
  PID:3640
- C:\Windows\System\PYpgFbL.exe
  C:\Windows\System\PYpgFbL.exe
  2⤵
  PID:1528
- C:\Windows\System\sVMLCxw.exe
  C:\Windows\System\sVMLCxw.exe
  2⤵
  PID:3000
- C:\Windows\System\yLugYeF.exe
  C:\Windows\System\yLugYeF.exe
  2⤵
  PID:2528
- C:\Windows\System\UKtdbBH.exe
  C:\Windows\System\UKtdbBH.exe
  2⤵
  PID:3160
- C:\Windows\System\hCDUvyX.exe
  C:\Windows\System\hCDUvyX.exe
  2⤵
  PID:2112
- C:\Windows\System\dgwkFOl.exe
  C:\Windows\System\dgwkFOl.exe
  2⤵
  PID:996
- C:\Windows\System\nMZBLbo.exe
  C:\Windows\System\nMZBLbo.exe
  2⤵
  PID:1348
- C:\Windows\System\ttCycOZ.exe
  C:\Windows\System\ttCycOZ.exe
  2⤵
  PID:2164
- C:\Windows\System\QtxrSXd.exe
  C:\Windows\System\QtxrSXd.exe
  2⤵
  PID:3244
- C:\Windows\System\PmvXdbA.exe
  C:\Windows\System\PmvXdbA.exe
  2⤵
  PID:2908
- C:\Windows\System\fTWneWf.exe
  C:\Windows\System\fTWneWf.exe
  2⤵
  PID:3948
- C:\Windows\System\QNaeEvs.exe
  C:\Windows\System\QNaeEvs.exe
  2⤵
  PID:4036
- C:\Windows\System\WsHGBID.exe
  C:\Windows\System\WsHGBID.exe
  2⤵
  PID:2664
- C:\Windows\System\BJjedpV.exe
  C:\Windows\System\BJjedpV.exe
  2⤵
  PID:1704
- C:\Windows\System\wdRlMMC.exe
  C:\Windows\System\wdRlMMC.exe
  2⤵
  PID:888
- C:\Windows\System\iDnROwv.exe
  C:\Windows\System\iDnROwv.exe
  2⤵
  PID:1416
- C:\Windows\System\LgwrYWy.exe
  C:\Windows\System\LgwrYWy.exe
  2⤵
  PID:2464
- C:\Windows\System\tfKEkxi.exe
  C:\Windows\System\tfKEkxi.exe
  2⤵
  PID:856
- C:\Windows\System\OBCqckH.exe
  C:\Windows\System\OBCqckH.exe
  2⤵
  PID:1352
- C:\Windows\System\gVGoVym.exe
  C:\Windows\System\gVGoVym.exe
  2⤵
  PID:3060
- C:\Windows\System\ABDiyMX.exe
  C:\Windows\System\ABDiyMX.exe
  2⤵
  PID:1476
- C:\Windows\System\roACykD.exe
  C:\Windows\System\roACykD.exe
  2⤵
  PID:1164
- C:\Windows\System\LsRIVFV.exe
  C:\Windows\System\LsRIVFV.exe
  2⤵
  PID:2568
- C:\Windows\System\xTxtZEM.exe
  C:\Windows\System\xTxtZEM.exe
  2⤵
  PID:2744
- C:\Windows\System\NOwLNIm.exe
  C:\Windows\System\NOwLNIm.exe
  2⤵
  PID:2156
- C:\Windows\System\oCAXmON.exe
  C:\Windows\System\oCAXmON.exe
  2⤵
  PID:4112
- C:\Windows\System\qoMojCU.exe
  C:\Windows\System\qoMojCU.exe
  2⤵
  PID:4132
- C:\Windows\System\fECZBzF.exe
  C:\Windows\System\fECZBzF.exe
  2⤵
  PID:4148
- C:\Windows\System\QrtkYCQ.exe
  C:\Windows\System\QrtkYCQ.exe
  2⤵
  PID:4164
- C:\Windows\System\prlZqDh.exe
  C:\Windows\System\prlZqDh.exe
  2⤵
  PID:4180
- C:\Windows\System\cfNOqMq.exe
  C:\Windows\System\cfNOqMq.exe
  2⤵
  PID:4196
- C:\Windows\System\YEPVuIY.exe
  C:\Windows\System\YEPVuIY.exe
  2⤵
  PID:4212
- C:\Windows\System\KWdlqaX.exe
  C:\Windows\System\KWdlqaX.exe
  2⤵
  PID:4228
- C:\Windows\System\mqmPSro.exe
  C:\Windows\System\mqmPSro.exe
  2⤵
  PID:4244
- C:\Windows\System\eFmTawo.exe
  C:\Windows\System\eFmTawo.exe
  2⤵
  PID:4260
- C:\Windows\System\bzaPkpx.exe
  C:\Windows\System\bzaPkpx.exe
  2⤵
  PID:4276
- C:\Windows\System\NkCdjAM.exe
  C:\Windows\System\NkCdjAM.exe
  2⤵
  PID:4292
- C:\Windows\System\tNdXBCw.exe
  C:\Windows\System\tNdXBCw.exe
  2⤵
  PID:4308
- C:\Windows\System\GDSQqVz.exe
  C:\Windows\System\GDSQqVz.exe
  2⤵
  PID:4324
- C:\Windows\System\MLHbBcS.exe
  C:\Windows\System\MLHbBcS.exe
  2⤵
  PID:4344
- C:\Windows\System\pVGEmdz.exe
  C:\Windows\System\pVGEmdz.exe
  2⤵
  PID:4360
- C:\Windows\System\UqJgfCE.exe
  C:\Windows\System\UqJgfCE.exe
  2⤵
  PID:4376
- C:\Windows\System\XVNlPno.exe
  C:\Windows\System\XVNlPno.exe
  2⤵
  PID:4392
- C:\Windows\System\qAPoNnx.exe
  C:\Windows\System\qAPoNnx.exe
  2⤵
  PID:4408
- C:\Windows\System\wjaByJJ.exe
  C:\Windows\System\wjaByJJ.exe
  2⤵
  PID:4424
- C:\Windows\System\FdgtOhC.exe
  C:\Windows\System\FdgtOhC.exe
  2⤵
  PID:4440
- C:\Windows\System\cbKpdJb.exe
  C:\Windows\System\cbKpdJb.exe
  2⤵
  PID:4456
- C:\Windows\System\jeNFwGJ.exe
  C:\Windows\System\jeNFwGJ.exe
  2⤵
  PID:4472
- C:\Windows\System\rzqKpHf.exe
  C:\Windows\System\rzqKpHf.exe
  2⤵
  PID:4488
- C:\Windows\System\rGuexyl.exe
  C:\Windows\System\rGuexyl.exe
  2⤵
  PID:4504
- C:\Windows\System\ImkHnCQ.exe
  C:\Windows\System\ImkHnCQ.exe
  2⤵
  PID:4520
- C:\Windows\System\gLcORcf.exe
  C:\Windows\System\gLcORcf.exe
  2⤵
  PID:4536
- C:\Windows\System\XODPzzd.exe
  C:\Windows\System\XODPzzd.exe
  2⤵
  PID:4552
- C:\Windows\System\WYJNTYX.exe
  C:\Windows\System\WYJNTYX.exe
  2⤵
  PID:4568
- C:\Windows\System\Wqkzbel.exe
  C:\Windows\System\Wqkzbel.exe
  2⤵
  PID:4584
- C:\Windows\System\IwRlRyX.exe
  C:\Windows\System\IwRlRyX.exe
  2⤵
  PID:4604
- C:\Windows\System\zBvqNGb.exe
  C:\Windows\System\zBvqNGb.exe
  2⤵
  PID:4668
- C:\Windows\System\tuYWKjn.exe
  C:\Windows\System\tuYWKjn.exe
  2⤵
  PID:4696
- C:\Windows\System\UpEqxfk.exe
  C:\Windows\System\UpEqxfk.exe
  2⤵
  PID:4712
- C:\Windows\System\OqsfdmX.exe
  C:\Windows\System\OqsfdmX.exe
  2⤵
  PID:4728
- C:\Windows\System\reETRRi.exe
  C:\Windows\System\reETRRi.exe
  2⤵
  PID:4744
- C:\Windows\System\avYajXY.exe
  C:\Windows\System\avYajXY.exe
  2⤵
  PID:4760
- C:\Windows\System\ufUpjcV.exe
  C:\Windows\System\ufUpjcV.exe
  2⤵
  PID:4776
- C:\Windows\System\GtdPpyW.exe
  C:\Windows\System\GtdPpyW.exe
  2⤵
  PID:4792
- C:\Windows\System\gfJQvSv.exe
  C:\Windows\System\gfJQvSv.exe
  2⤵
  PID:4808
- C:\Windows\System\QzZgFIW.exe
  C:\Windows\System\QzZgFIW.exe
  2⤵
  PID:4828
- C:\Windows\System\rfphaUG.exe
  C:\Windows\System\rfphaUG.exe
  2⤵
  PID:4848
- C:\Windows\System\PEhjmwP.exe
  C:\Windows\System\PEhjmwP.exe
  2⤵
  PID:4864
- C:\Windows\System\EGMKSQJ.exe
  C:\Windows\System\EGMKSQJ.exe
  2⤵
  PID:4880
- C:\Windows\System\rFPkUQc.exe
  C:\Windows\System\rFPkUQc.exe
  2⤵
  PID:4896
- C:\Windows\System\dGpHPIz.exe
  C:\Windows\System\dGpHPIz.exe
  2⤵
  PID:4916
- C:\Windows\System\eykabRk.exe
  C:\Windows\System\eykabRk.exe
  2⤵
  PID:4932
- C:\Windows\System\mchtHtk.exe
  C:\Windows\System\mchtHtk.exe
  2⤵
  PID:4948
- C:\Windows\System\KTwMRqy.exe
  C:\Windows\System\KTwMRqy.exe
  2⤵
  PID:4964
- C:\Windows\System\TlJSCot.exe
  C:\Windows\System\TlJSCot.exe
  2⤵
  PID:4980
- C:\Windows\System\cbVVbMQ.exe
  C:\Windows\System\cbVVbMQ.exe
  2⤵
  PID:4996
- C:\Windows\System\eoOlQKP.exe
  C:\Windows\System\eoOlQKP.exe
  2⤵
  PID:5012
- C:\Windows\System\hImAYfN.exe
  C:\Windows\System\hImAYfN.exe
  2⤵
  PID:5032
- C:\Windows\System\CALYSHo.exe
  C:\Windows\System\CALYSHo.exe
  2⤵
  PID:5100
- C:\Windows\System\eZuUCie.exe
  C:\Windows\System\eZuUCie.exe
  2⤵
  PID:5116
- C:\Windows\System\USCvbjI.exe
  C:\Windows\System\USCvbjI.exe
  2⤵
  PID:3096
- C:\Windows\System\mkNLQcD.exe
  C:\Windows\System\mkNLQcD.exe
  2⤵
  PID:3380
- C:\Windows\System\OHaAfPj.exe
  C:\Windows\System\OHaAfPj.exe
  2⤵
  PID:3568
- C:\Windows\System\AjOeEUA.exe
  C:\Windows\System\AjOeEUA.exe
  2⤵
  PID:2424
- C:\Windows\System\TSBFBdi.exe
  C:\Windows\System\TSBFBdi.exe
  2⤵
  PID:2380
- C:\Windows\System\OAodKsF.exe
  C:\Windows\System\OAodKsF.exe
  2⤵
  PID:2240
- C:\Windows\System\wJdpwzV.exe
  C:\Windows\System\wJdpwzV.exe
  2⤵
  PID:1728
- C:\Windows\System\ZwoVvOb.exe
  C:\Windows\System\ZwoVvOb.exe
  2⤵
  PID:2504
- C:\Windows\System\gGKSbZs.exe
  C:\Windows\System\gGKSbZs.exe
  2⤵
  PID:2944
- C:\Windows\System\ROUkUKW.exe
  C:\Windows\System\ROUkUKW.exe
  2⤵
  PID:4724
- C:\Windows\System\puHFLPM.exe
  C:\Windows\System\puHFLPM.exe
  2⤵
  PID:4788
- C:\Windows\System\vhiqLse.exe
  C:\Windows\System\vhiqLse.exe
  2⤵
  PID:4856
- C:\Windows\System\cdOugxq.exe
  C:\Windows\System\cdOugxq.exe
  2⤵
  PID:4924
- C:\Windows\System\KvXkHso.exe
  C:\Windows\System\KvXkHso.exe
  2⤵
  PID:4988
- C:\Windows\System\YgaSmTg.exe
  C:\Windows\System\YgaSmTg.exe
  2⤵
  PID:5028
- C:\Windows\System\ahwDlUG.exe
  C:\Windows\System\ahwDlUG.exe
  2⤵
  PID:3204
- C:\Windows\System\lxyKTXI.exe
  C:\Windows\System\lxyKTXI.exe
  2⤵
  PID:1252
- C:\Windows\System\pyouVst.exe
  C:\Windows\System\pyouVst.exe
  2⤵
  PID:2408
- C:\Windows\System\pjOaAag.exe
  C:\Windows\System\pjOaAag.exe
  2⤵
  PID:3020
- C:\Windows\System\IGuXKGT.exe
  C:\Windows\System\IGuXKGT.exe
  2⤵
  PID:2336
- C:\Windows\System\dxiopWS.exe
  C:\Windows\System\dxiopWS.exe
  2⤵
  PID:3680
- C:\Windows\System\BLBQUWl.exe
  C:\Windows\System\BLBQUWl.exe
  2⤵
  PID:3748
- C:\Windows\System\JxViwSm.exe
  C:\Windows\System\JxViwSm.exe
  2⤵
  PID:3812
- C:\Windows\System\kKndUmz.exe
  C:\Windows\System\kKndUmz.exe
  2⤵
  PID:3184
- C:\Windows\System\njxigff.exe
  C:\Windows\System\njxigff.exe
  2⤵
  PID:3268
- C:\Windows\System\lrlKFCH.exe
  C:\Windows\System\lrlKFCH.exe
  2⤵
  PID:3844
- C:\Windows\System\IectxRP.exe
  C:\Windows\System\IectxRP.exe
  2⤵
  PID:3452
- C:\Windows\System\PCMqRPt.exe
  C:\Windows\System\PCMqRPt.exe
  2⤵
  PID:3516
- C:\Windows\System\fFPrqXr.exe
  C:\Windows\System\fFPrqXr.exe
  2⤵
  PID:3588
- C:\Windows\System\JbiDzjW.exe
  C:\Windows\System\JbiDzjW.exe
  2⤵
  PID:3660
- C:\Windows\System\UjNafiX.exe
  C:\Windows\System\UjNafiX.exe
  2⤵
  PID:3728
- C:\Windows\System\hYTsTdo.exe
  C:\Windows\System\hYTsTdo.exe
  2⤵
  PID:3792
- C:\Windows\System\qGsYaXj.exe
  C:\Windows\System\qGsYaXj.exe
  2⤵
  PID:3860
- C:\Windows\System\PheDGQQ.exe
  C:\Windows\System\PheDGQQ.exe
  2⤵
  PID:3964
- C:\Windows\System\QmyAmIf.exe
  C:\Windows\System\QmyAmIf.exe
  2⤵
  PID:4020
- C:\Windows\System\aZFpnQO.exe
  C:\Windows\System\aZFpnQO.exe
  2⤵
  PID:4088
- C:\Windows\System\nkhXhdR.exe
  C:\Windows\System\nkhXhdR.exe
  2⤵
  PID:3952
- C:\Windows\System\yNKSWGS.exe
  C:\Windows\System\yNKSWGS.exe
  2⤵
  PID:2728
- C:\Windows\System\YOasEAt.exe
  C:\Windows\System\YOasEAt.exe
  2⤵
  PID:2708
- C:\Windows\System\rLBcPLl.exe
  C:\Windows\System\rLBcPLl.exe
  2⤵
  PID:4128
- C:\Windows\System\KkUAQMR.exe
  C:\Windows\System\KkUAQMR.exe
  2⤵
  PID:4316
- C:\Windows\System\MrDvysu.exe
  C:\Windows\System\MrDvysu.exe
  2⤵
  PID:4140
- C:\Windows\System\BsvELFt.exe
  C:\Windows\System\BsvELFt.exe
  2⤵
  PID:2044
- C:\Windows\System\edjrUTQ.exe
  C:\Windows\System\edjrUTQ.exe
  2⤵
  PID:4172
- C:\Windows\System\zeTYyOL.exe
  C:\Windows\System\zeTYyOL.exe
  2⤵
  PID:4208
- C:\Windows\System\wOxMdYr.exe
  C:\Windows\System\wOxMdYr.exe
  2⤵
  PID:4300
- C:\Windows\System\IJWMzdJ.exe
  C:\Windows\System\IJWMzdJ.exe
  2⤵
  PID:4336
- C:\Windows\System\qXmOmfF.exe
  C:\Windows\System\qXmOmfF.exe
  2⤵
  PID:4404
- C:\Windows\System\yLTAXWi.exe
  C:\Windows\System\yLTAXWi.exe
  2⤵
  PID:4464
- C:\Windows\System\rutqxMy.exe
  C:\Windows\System\rutqxMy.exe
  2⤵
  PID:4528
- C:\Windows\System\NXbmMui.exe
  C:\Windows\System\NXbmMui.exe
  2⤵
  PID:4564
- C:\Windows\System\vkpUXbm.exe
  C:\Windows\System\vkpUXbm.exe
  2⤵
  PID:4548
- C:\Windows\System\ZvohPfo.exe
  C:\Windows\System\ZvohPfo.exe
  2⤵
  PID:3284
- C:\Windows\System\qIDiySf.exe
  C:\Windows\System\qIDiySf.exe
  2⤵
  PID:5084
- C:\Windows\System\sfuIRhe.exe
  C:\Windows\System\sfuIRhe.exe
  2⤵
  PID:3808
- C:\Windows\System\RzzeGvs.exe
  C:\Windows\System\RzzeGvs.exe
  2⤵
  PID:1936
- C:\Windows\System\gGCCinb.exe
  C:\Windows\System\gGCCinb.exe
  2⤵
  PID:3744
- C:\Windows\System\EJcfyKG.exe
  C:\Windows\System\EJcfyKG.exe
  2⤵
  PID:3484
- C:\Windows\System\dukHWPV.exe
  C:\Windows\System\dukHWPV.exe
  2⤵
  PID:4416
- C:\Windows\System\NEeiMQA.exe
  C:\Windows\System\NEeiMQA.exe
  2⤵
  PID:4804
- C:\Windows\System\pMIKMjh.exe
  C:\Windows\System\pMIKMjh.exe
  2⤵
  PID:4908
- C:\Windows\System\iyPdWdg.exe
  C:\Windows\System\iyPdWdg.exe
  2⤵
  PID:5068
- C:\Windows\System\RNnqzBa.exe
  C:\Windows\System\RNnqzBa.exe
  2⤵
  PID:4144
- C:\Windows\System\VvEFTvL.exe
  C:\Windows\System\VvEFTvL.exe
  2⤵
  PID:4500
- C:\Windows\System\aKZmbNt.exe
  C:\Windows\System\aKZmbNt.exe
  2⤵
  PID:2964
- C:\Windows\System\KlXDtpp.exe
  C:\Windows\System\KlXDtpp.exe
  2⤵
  PID:4120
- C:\Windows\System\epbQyhp.exe
  C:\Windows\System\epbQyhp.exe
  2⤵
  PID:1856
- C:\Windows\System\kjwvONJ.exe
  C:\Windows\System\kjwvONJ.exe
  2⤵
  PID:1432
- C:\Windows\System\gcOWyND.exe
  C:\Windows\System\gcOWyND.exe
  2⤵
  PID:5020
- C:\Windows\System\EfSfEkB.exe
  C:\Windows\System\EfSfEkB.exe
  2⤵
  PID:356
- C:\Windows\System\qwzRWZx.exe
  C:\Windows\System\qwzRWZx.exe
  2⤵
  PID:3084
- C:\Windows\System\vNuuVKr.exe
  C:\Windows\System\vNuuVKr.exe
  2⤵
  PID:3696
- C:\Windows\System\jQZQUTC.exe
  C:\Windows\System\jQZQUTC.exe
  2⤵
  PID:3856
- C:\Windows\System\BDfagEi.exe
  C:\Windows\System\BDfagEi.exe
  2⤵
  PID:4692
- C:\Windows\System\fBvTzCp.exe
  C:\Windows\System\fBvTzCp.exe
  2⤵
  PID:1852
- C:\Windows\System\TITSIqf.exe
  C:\Windows\System\TITSIqf.exe
  2⤵
  PID:2832
- C:\Windows\System\Qfvduei.exe
  C:\Windows\System\Qfvduei.exe
  2⤵
  PID:4628
- C:\Windows\System\IeuiulC.exe
  C:\Windows\System\IeuiulC.exe
  2⤵
  PID:4740
- C:\Windows\System\BqdKhuO.exe
  C:\Windows\System\BqdKhuO.exe
  2⤵
  PID:3004
- C:\Windows\System\zuuzUSu.exe
  C:\Windows\System\zuuzUSu.exe
  2⤵
  PID:2356
- C:\Windows\System\tTMjKVZ.exe
  C:\Windows\System\tTMjKVZ.exe
  2⤵
  PID:5056
- C:\Windows\System\zIzLpYI.exe
  C:\Windows\System\zIzLpYI.exe
  2⤵
  PID:4976
- C:\Windows\System\HtvCjuH.exe
  C:\Windows\System\HtvCjuH.exe
  2⤵
  PID:1780
- C:\Windows\System\mPbWSYN.exe
  C:\Windows\System\mPbWSYN.exe
  2⤵
  PID:2576
- C:\Windows\System\kVTgfnq.exe
  C:\Windows\System\kVTgfnq.exe
  2⤵
  PID:1392
- C:\Windows\System\aQKIJXi.exe
  C:\Windows\System\aQKIJXi.exe
  2⤵
  PID:3872
- C:\Windows\System\ggEfjHh.exe
  C:\Windows\System\ggEfjHh.exe
  2⤵
  PID:3888
- C:\Windows\System\DFjZkvu.exe
  C:\Windows\System\DFjZkvu.exe
  2⤵
  PID:3968
- C:\Windows\System\uIFihex.exe
  C:\Windows\System\uIFihex.exe
  2⤵
  PID:1108
- C:\Windows\System\ANxmVPA.exe
  C:\Windows\System\ANxmVPA.exe
  2⤵
  PID:5108
- C:\Windows\System\EkqXMeM.exe
  C:\Windows\System\EkqXMeM.exe
  2⤵
  PID:3148
- C:\Windows\System\ApAPXgl.exe
  C:\Windows\System\ApAPXgl.exe
  2⤵
  PID:3656
- C:\Windows\System\WTvqXWw.exe
  C:\Windows\System\WTvqXWw.exe
  2⤵
  PID:4160
- C:\Windows\System\SkGASRt.exe
  C:\Windows\System\SkGASRt.exe
  2⤵
  PID:2460
- C:\Windows\System\llNtWyv.exe
  C:\Windows\System\llNtWyv.exe
  2⤵
  PID:4252
- C:\Windows\System\NGStfui.exe
  C:\Windows\System\NGStfui.exe
  2⤵
  PID:4256
- C:\Windows\System\Wactabm.exe
  C:\Windows\System\Wactabm.exe
  2⤵
  PID:4448
- C:\Windows\System\OUzmbQW.exe
  C:\Windows\System\OUzmbQW.exe
  2⤵
  PID:2604
- C:\Windows\System\HKcayxo.exe
  C:\Windows\System\HKcayxo.exe
  2⤵
  PID:4480
- C:\Windows\System\cekgZbN.exe
  C:\Windows\System\cekgZbN.exe
  2⤵
  PID:2508
- C:\Windows\System\tCScAFP.exe
  C:\Windows\System\tCScAFP.exe
  2⤵
  PID:1672
- C:\Windows\System\IRQeARk.exe
  C:\Windows\System\IRQeARk.exe
  2⤵
  PID:1784
- C:\Windows\System\CUmIjvZ.exe
  C:\Windows\System\CUmIjvZ.exe
  2⤵
  PID:5064
- C:\Windows\System\AfJvevh.exe
  C:\Windows\System\AfJvevh.exe
  2⤵
  PID:3468
- C:\Windows\System\eWCyHFL.exe
  C:\Windows\System\eWCyHFL.exe
  2⤵
  PID:1860
- C:\Windows\System\MkeiAzG.exe
  C:\Windows\System\MkeiAzG.exe
  2⤵
  PID:2388
- C:\Windows\System\gijKWxn.exe
  C:\Windows\System\gijKWxn.exe
  2⤵
  PID:3264
- C:\Windows\System\CfyDGtx.exe
  C:\Windows\System\CfyDGtx.exe
  2⤵
  PID:3828
- C:\Windows\System\KipBQuG.exe
  C:\Windows\System\KipBQuG.exe
  2⤵
  PID:3444
- C:\Windows\System\iLnaiRp.exe
  C:\Windows\System\iLnaiRp.exe
  2⤵
  PID:1720
- C:\Windows\System\TwqhZeZ.exe
  C:\Windows\System\TwqhZeZ.exe
  2⤵
  PID:4288
- C:\Windows\System\EIvqzGq.exe
  C:\Windows\System\EIvqzGq.exe
  2⤵
  PID:2704
- C:\Windows\System\MJieemN.exe
  C:\Windows\System\MJieemN.exe
  2⤵
  PID:4284
- C:\Windows\System\UaxlJPE.exe
  C:\Windows\System\UaxlJPE.exe
  2⤵
  PID:1904
- C:\Windows\System\PztUvNH.exe
  C:\Windows\System\PztUvNH.exe
  2⤵
  PID:4736
- C:\Windows\System\rzwdzPO.exe
  C:\Windows\System\rzwdzPO.exe
  2⤵
  PID:4904
- C:\Windows\System\poUGDVV.exe
  C:\Windows\System\poUGDVV.exe
  2⤵
  PID:3280
- C:\Windows\System\lNJQHkN.exe
  C:\Windows\System\lNJQHkN.exe
  2⤵
  PID:5076
- C:\Windows\System\vxgNCax.exe
  C:\Windows\System\vxgNCax.exe
  2⤵
  PID:4944
- C:\Windows\System\XYoMGji.exe
  C:\Windows\System\XYoMGji.exe
  2⤵
  PID:2368
- C:\Windows\System\XqlmIae.exe
  C:\Windows\System\XqlmIae.exe
  2⤵
  PID:964
- C:\Windows\System\FDcjIRc.exe
  C:\Windows\System\FDcjIRc.exe
  2⤵
  PID:1128
- C:\Windows\System\ujmpzNC.exe
  C:\Windows\System\ujmpzNC.exe
  2⤵
  PID:2592
- C:\Windows\System\LWEHbJL.exe
  C:\Windows\System\LWEHbJL.exe
  2⤵
  PID:528
- C:\Windows\System\qsaclVg.exe
  C:\Windows\System\qsaclVg.exe
  2⤵
  PID:1400
- C:\Windows\System\TJaeXro.exe
  C:\Windows\System\TJaeXro.exe
  2⤵
  PID:4824
- C:\Windows\System\UcMvWck.exe
  C:\Windows\System\UcMvWck.exe
  2⤵
  PID:4016
- C:\Windows\System\nuLKRFx.exe
  C:\Windows\System\nuLKRFx.exe
  2⤵
  PID:1168
- C:\Windows\System\koeUXPq.exe
  C:\Windows\System\koeUXPq.exe
  2⤵
  PID:3924
- C:\Windows\System\AapEPQZ.exe
  C:\Windows\System\AapEPQZ.exe
  2⤵
  PID:4640
- C:\Windows\System\ojjdfFY.exe
  C:\Windows\System\ojjdfFY.exe
  2⤵
  PID:4352
- C:\Windows\System\oggDnCe.exe
  C:\Windows\System\oggDnCe.exe
  2⤵
  PID:4512
- C:\Windows\System\nancXOd.exe
  C:\Windows\System\nancXOd.exe
  2⤵
  PID:5040
- C:\Windows\System\IkFJpwe.exe
  C:\Windows\System\IkFJpwe.exe
  2⤵
  PID:2416
- C:\Windows\System\IZWUPwN.exe
  C:\Windows\System\IZWUPwN.exe
  2⤵
  PID:4000
- C:\Windows\System\XPUskxV.exe
  C:\Windows\System\XPUskxV.exe
  2⤵
  PID:2440
- C:\Windows\System\LxChUYY.exe
  C:\Windows\System\LxChUYY.exe
  2⤵
  PID:796
- C:\Windows\System\DcCerAz.exe
  C:\Windows\System\DcCerAz.exe
  2⤵
  PID:1888
- C:\Windows\System\wbOCYns.exe
  C:\Windows\System\wbOCYns.exe
  2⤵
  PID:4756
- C:\Windows\System\QFtSrIf.exe
  C:\Windows\System\QFtSrIf.exe
  2⤵
  PID:1236
- C:\Windows\System\KFLBIxA.exe
  C:\Windows\System\KFLBIxA.exe
  2⤵
  PID:4620
- C:\Windows\System\SurfsiI.exe
  C:\Windows\System\SurfsiI.exe
  2⤵
  PID:3364
- C:\Windows\System\abORvln.exe
  C:\Windows\System\abORvln.exe
  2⤵
  PID:2136
- C:\Windows\System\asfTUyE.exe
  C:\Windows\System\asfTUyE.exe
  2⤵
  PID:4676
- C:\Windows\System\pqZgRXO.exe
  C:\Windows\System\pqZgRXO.exe
  2⤵
  PID:4800
- C:\Windows\System\QBNAipR.exe
  C:\Windows\System\QBNAipR.exe
  2⤵
  PID:5060
- C:\Windows\System\ovOzKlS.exe
  C:\Windows\System\ovOzKlS.exe
  2⤵
  PID:2680
- C:\Windows\System\Zvmgqhm.exe
  C:\Windows\System\Zvmgqhm.exe
  2⤵
  PID:808
- C:\Windows\System\BiylLWc.exe
  C:\Windows\System\BiylLWc.exe
  2⤵
  PID:984
- C:\Windows\System\sWJLwDu.exe
  C:\Windows\System\sWJLwDu.exe
  2⤵
  PID:4684
- C:\Windows\System\jiKjGwT.exe
  C:\Windows\System\jiKjGwT.exe
  2⤵
  PID:4192
- C:\Windows\System\IwndQWn.exe
  C:\Windows\System\IwndQWn.exe
  2⤵
  PID:4080
- C:\Windows\System\pHGeUYE.exe
  C:\Windows\System\pHGeUYE.exe
  2⤵
  PID:2480
- C:\Windows\System\SLNqQXG.exe
  C:\Windows\System\SLNqQXG.exe
  2⤵
  PID:4516
- C:\Windows\System\atQdDkK.exe
  C:\Windows\System\atQdDkK.exe
  2⤵
  PID:1836
- C:\Windows\System\KKhngBM.exe
  C:\Windows\System\KKhngBM.exe
  2⤵
  PID:3908
- C:\Windows\System\SpHPcsO.exe
  C:\Windows\System\SpHPcsO.exe
  2⤵
  PID:4592
- C:\Windows\System\oTnMIbg.exe
  C:\Windows\System\oTnMIbg.exe
  2⤵
  PID:3208
- C:\Windows\System\yRDwFYG.exe
  C:\Windows\System\yRDwFYG.exe
  2⤵
  PID:1656
- C:\Windows\System\wxPPDqJ.exe
  C:\Windows\System\wxPPDqJ.exe
  2⤵
  PID:2644
- C:\Windows\System\vNOptXJ.exe
  C:\Windows\System\vNOptXJ.exe
  2⤵
  PID:2936
- C:\Windows\System\TjfOBGc.exe
  C:\Windows\System\TjfOBGc.exe
  2⤵
  PID:2608
- C:\Windows\System\VqOtzke.exe
  C:\Windows\System\VqOtzke.exe
  2⤵
  PID:4688
- C:\Windows\System\LRIutDM.exe
  C:\Windows\System\LRIutDM.exe
  2⤵
  PID:2536
- C:\Windows\System\yEemfIu.exe
  C:\Windows\System\yEemfIu.exe
  2⤵
  PID:2892
- C:\Windows\System\efgpYfr.exe
  C:\Windows\System\efgpYfr.exe
  2⤵
  PID:4156
- C:\Windows\System\lMIGtRx.exe
  C:\Windows\System\lMIGtRx.exe
  2⤵
  PID:1688
- C:\Windows\System\MuxsRge.exe
  C:\Windows\System\MuxsRge.exe
  2⤵
  PID:4872
- C:\Windows\System\CpiGIfo.exe
  C:\Windows\System\CpiGIfo.exe
  2⤵
  PID:4820
- C:\Windows\System\cllOmQM.exe
  C:\Windows\System\cllOmQM.exe
  2⤵
  PID:2928
- C:\Windows\System\isqmuYa.exe
  C:\Windows\System\isqmuYa.exe
  2⤵
  PID:1220
- C:\Windows\System\YLAmzrx.exe
  C:\Windows\System\YLAmzrx.exe
  2⤵
  PID:5132
- C:\Windows\System\gfLACAq.exe
  C:\Windows\System\gfLACAq.exe
  2⤵
  PID:5148
- C:\Windows\System\EimuByv.exe
  C:\Windows\System\EimuByv.exe
  2⤵
  PID:5168
- C:\Windows\System\PiwlXDE.exe
  C:\Windows\System\PiwlXDE.exe
  2⤵
  PID:5184
- C:\Windows\System\JCcLVDo.exe
  C:\Windows\System\JCcLVDo.exe
  2⤵
  PID:5200
- C:\Windows\System\aGDMDuM.exe
  C:\Windows\System\aGDMDuM.exe
  2⤵
  PID:5216
- C:\Windows\System\QpJhCTn.exe
  C:\Windows\System\QpJhCTn.exe
  2⤵
  PID:5232
- C:\Windows\System\LnTQHuF.exe
  C:\Windows\System\LnTQHuF.exe
  2⤵
  PID:5252
- C:\Windows\System\sfQAOWA.exe
  C:\Windows\System\sfQAOWA.exe
  2⤵
  PID:5268
- C:\Windows\System\zFoEZpT.exe
  C:\Windows\System\zFoEZpT.exe
  2⤵
  PID:5284
- C:\Windows\System\mxVJSng.exe
  C:\Windows\System\mxVJSng.exe
  2⤵
  PID:5300
- C:\Windows\System\TWtseUE.exe
  C:\Windows\System\TWtseUE.exe
  2⤵
  PID:5316
- C:\Windows\System\gtCnyBp.exe
  C:\Windows\System\gtCnyBp.exe
  2⤵
  PID:5332
- C:\Windows\System\rIVSZlY.exe
  C:\Windows\System\rIVSZlY.exe
  2⤵
  PID:5348
- C:\Windows\System\klQkmZv.exe
  C:\Windows\System\klQkmZv.exe
  2⤵
  PID:5364
- C:\Windows\System\upAMhdp.exe
  C:\Windows\System\upAMhdp.exe
  2⤵
  PID:5380
- C:\Windows\System\hKUjpmq.exe
  C:\Windows\System\hKUjpmq.exe
  2⤵
  PID:5396
- C:\Windows\System\KUsLCad.exe
  C:\Windows\System\KUsLCad.exe
  2⤵
  PID:5412
- C:\Windows\System\JzKJyGn.exe
  C:\Windows\System\JzKJyGn.exe
  2⤵
  PID:5428
- C:\Windows\System\IpbvEcp.exe
  C:\Windows\System\IpbvEcp.exe
  2⤵
  PID:5444
- C:\Windows\System\LgMcTtd.exe
  C:\Windows\System\LgMcTtd.exe
  2⤵
  PID:5460
- C:\Windows\System\zYAGJda.exe
  C:\Windows\System\zYAGJda.exe
  2⤵
  PID:5476
- C:\Windows\System\pjvrZiP.exe
  C:\Windows\System\pjvrZiP.exe
  2⤵
  PID:5496
- C:\Windows\System\pyyjLTx.exe
  C:\Windows\System\pyyjLTx.exe
  2⤵
  PID:5512
- C:\Windows\System\VJhLKQf.exe
  C:\Windows\System\VJhLKQf.exe
  2⤵
  PID:5532
- C:\Windows\System\dIsrkGd.exe
  C:\Windows\System\dIsrkGd.exe
  2⤵
  PID:5548
- C:\Windows\System\UyGdVha.exe
  C:\Windows\System\UyGdVha.exe
  2⤵
  PID:5564
- C:\Windows\System\DZmGSqU.exe
  C:\Windows\System\DZmGSqU.exe
  2⤵
  PID:5580
- C:\Windows\System\bERnsNp.exe
  C:\Windows\System\bERnsNp.exe
  2⤵
  PID:5596
- C:\Windows\System\oztdaih.exe
  C:\Windows\System\oztdaih.exe
  2⤵
  PID:5612
- C:\Windows\System\UJAOMTd.exe
  C:\Windows\System\UJAOMTd.exe
  2⤵
  PID:5628
- C:\Windows\System\HqhGyDx.exe
  C:\Windows\System\HqhGyDx.exe
  2⤵
  PID:5644
- C:\Windows\System\hYyANWz.exe
  C:\Windows\System\hYyANWz.exe
  2⤵
  PID:5660
- C:\Windows\System\TXXiGeX.exe
  C:\Windows\System\TXXiGeX.exe
  2⤵
  PID:5676
- C:\Windows\System\FQJLdLq.exe
  C:\Windows\System\FQJLdLq.exe
  2⤵
  PID:5692
- C:\Windows\System\MFAfQII.exe
  C:\Windows\System\MFAfQII.exe
  2⤵
  PID:5780
- C:\Windows\System\USbFcUH.exe
  C:\Windows\System\USbFcUH.exe
  2⤵
  PID:5796
- C:\Windows\System\acGXSlb.exe
  C:\Windows\System\acGXSlb.exe
  2⤵
  PID:5812
- C:\Windows\System\weeXbRz.exe
  C:\Windows\System\weeXbRz.exe
  2⤵
  PID:5828
- C:\Windows\System\jialWdA.exe
  C:\Windows\System\jialWdA.exe
  2⤵
  PID:5844
- C:\Windows\System\kEvtgfq.exe
  C:\Windows\System\kEvtgfq.exe
  2⤵
  PID:5860
- C:\Windows\System\RDavSfL.exe
  C:\Windows\System\RDavSfL.exe
  2⤵
  PID:5876
- C:\Windows\System\aSVZrcm.exe
  C:\Windows\System\aSVZrcm.exe
  2⤵
  PID:5892
- C:\Windows\System\sWROzOS.exe
  C:\Windows\System\sWROzOS.exe
  2⤵
  PID:5908
- C:\Windows\System\UkWnZjd.exe
  C:\Windows\System\UkWnZjd.exe
  2⤵
  PID:5924
- C:\Windows\System\UkRtqTa.exe
  C:\Windows\System\UkRtqTa.exe
  2⤵
  PID:5940
- C:\Windows\System\yhQoNNm.exe
  C:\Windows\System\yhQoNNm.exe
  2⤵
  PID:5956
- C:\Windows\System\DDKNLxS.exe
  C:\Windows\System\DDKNLxS.exe
  2⤵
  PID:5972
- C:\Windows\System\xOIOAlv.exe
  C:\Windows\System\xOIOAlv.exe
  2⤵
  PID:5988
- C:\Windows\System\qgfRJfB.exe
  C:\Windows\System\qgfRJfB.exe
  2⤵
  PID:6004
- C:\Windows\System\mLiHIWn.exe
  C:\Windows\System\mLiHIWn.exe
  2⤵
  PID:6020
- C:\Windows\System\sMbOSRp.exe
  C:\Windows\System\sMbOSRp.exe
  2⤵
  PID:6036
- C:\Windows\System\dHNaTkK.exe
  C:\Windows\System\dHNaTkK.exe
  2⤵
  PID:6052
- C:\Windows\System\QLBAbrL.exe
  C:\Windows\System\QLBAbrL.exe
  2⤵
  PID:6068
- C:\Windows\System\wyOTPKt.exe
  C:\Windows\System\wyOTPKt.exe
  2⤵
  PID:6084
- C:\Windows\System\VCLCYhW.exe
  C:\Windows\System\VCLCYhW.exe
  2⤵
  PID:6100
- C:\Windows\System\fqDffyP.exe
  C:\Windows\System\fqDffyP.exe
  2⤵
  PID:6116
- C:\Windows\System\tmDyjge.exe
  C:\Windows\System\tmDyjge.exe
  2⤵
  PID:6136
- C:\Windows\System\QLanPWk.exe
  C:\Windows\System\QLanPWk.exe
  2⤵
  PID:3344
- C:\Windows\System\EPcoWnQ.exe
  C:\Windows\System\EPcoWnQ.exe
  2⤵
  PID:5140
- C:\Windows\System\zFgGlQE.exe
  C:\Windows\System\zFgGlQE.exe
  2⤵
  PID:5208
- C:\Windows\System\PDwynJa.exe
  C:\Windows\System\PDwynJa.exe
  2⤵
  PID:5276
- C:\Windows\System\ymTXJMn.exe
  C:\Windows\System\ymTXJMn.exe
  2⤵
  PID:5340
- C:\Windows\System\fvYrKkL.exe
  C:\Windows\System\fvYrKkL.exe
  2⤵
  PID:5404
- C:\Windows\System\lhTICNg.exe
  C:\Windows\System\lhTICNg.exe
  2⤵
  PID:5468
- C:\Windows\System\MzhwgYE.exe
  C:\Windows\System\MzhwgYE.exe
  2⤵
  PID:5700
- C:\Windows\System\wgomkcl.exe
  C:\Windows\System\wgomkcl.exe
  2⤵
  PID:2304
- C:\Windows\System\riHZyAz.exe
  C:\Windows\System\riHZyAz.exe
  2⤵
  PID:5192
- C:\Windows\System\InVRsqA.exe
  C:\Windows\System\InVRsqA.exe
  2⤵
  PID:5292
- C:\Windows\System\KsqdTOG.exe
  C:\Windows\System\KsqdTOG.exe
  2⤵
  PID:5488
- C:\Windows\System\PwxeQKE.exe
  C:\Windows\System\PwxeQKE.exe
  2⤵
  PID:5560
- C:\Windows\System\KfAVbpm.exe
  C:\Windows\System\KfAVbpm.exe
  2⤵
  PID:5656
- C:\Windows\System\CSdPjOb.exe
  C:\Windows\System\CSdPjOb.exe
  2⤵
  PID:5716
- C:\Windows\System\xOTezsX.exe
  C:\Windows\System\xOTezsX.exe
  2⤵
  PID:5732
- C:\Windows\System\ueKNXVm.exe
  C:\Windows\System\ueKNXVm.exe
  2⤵
  PID:5744
- C:\Windows\System\MpPvgdK.exe
  C:\Windows\System\MpPvgdK.exe
  2⤵
  PID:5764
- C:\Windows\System\vXXrDBm.exe
  C:\Windows\System\vXXrDBm.exe
  2⤵
  PID:2192
- C:\Windows\System\HgXMEYS.exe
  C:\Windows\System\HgXMEYS.exe
  2⤵
  PID:5808
- C:\Windows\System\trPeVwI.exe
  C:\Windows\System\trPeVwI.exe
  2⤵
  PID:5836
- C:\Windows\System\ovFwrDC.exe
  C:\Windows\System\ovFwrDC.exe
  2⤵
  PID:5888
- C:\Windows\System\whpmOLt.exe
  C:\Windows\System\whpmOLt.exe
  2⤵
  PID:5980
- C:\Windows\System\RgafgIf.exe
  C:\Windows\System\RgafgIf.exe
  2⤵
  PID:5932
- C:\Windows\System\DfLIrYR.exe
  C:\Windows\System\DfLIrYR.exe
  2⤵
  PID:6000
- C:\Windows\System\YtfPUDy.exe
  C:\Windows\System\YtfPUDy.exe
  2⤵
  PID:6064
- C:\Windows\System\CbawaUj.exe
  C:\Windows\System\CbawaUj.exe
  2⤵
  PID:5916
- C:\Windows\System\qesSGvP.exe
  C:\Windows\System\qesSGvP.exe
  2⤵
  PID:6044
- C:\Windows\System\kkQiMhq.exe
  C:\Windows\System\kkQiMhq.exe
  2⤵
  PID:6096
- C:\Windows\System\oMdOROE.exe
  C:\Windows\System\oMdOROE.exe
  2⤵
  PID:6076
- C:\Windows\System\njIRYaP.exe
  C:\Windows\System\njIRYaP.exe
  2⤵
  PID:4052
- C:\Windows\System\iOknjnC.exe
  C:\Windows\System\iOknjnC.exe
  2⤵
  PID:5308
- C:\Windows\System\RLhdfpS.exe
  C:\Windows\System\RLhdfpS.exe
  2⤵
  PID:5372
- C:\Windows\System\bKhwkNP.exe
  C:\Windows\System\bKhwkNP.exe
  2⤵
  PID:1388
- C:\Windows\System\VWOcQoj.exe
  C:\Windows\System\VWOcQoj.exe
  2⤵
  PID:1564
- C:\Windows\System\tMiYLIa.exe
  C:\Windows\System\tMiYLIa.exe
  2⤵
  PID:5164
- C:\Windows\System\DKWMFjS.exe
  C:\Windows\System\DKWMFjS.exe
  2⤵
  PID:5576
- C:\Windows\System\ZkzkoQT.exe
  C:\Windows\System\ZkzkoQT.exe
  2⤵
  PID:5636
- C:\Windows\System\PdwmKEi.exe
  C:\Windows\System\PdwmKEi.exe
  2⤵
  PID:5520
- C:\Windows\System\SSaZhZw.exe
  C:\Windows\System\SSaZhZw.exe
  2⤵
  PID:5356
- C:\Windows\System\FVdDJQM.exe
  C:\Windows\System\FVdDJQM.exe
  2⤵
  PID:5620
- C:\Windows\System\TisILft.exe
  C:\Windows\System\TisILft.exe
  2⤵
  PID:5556
- C:\Windows\System\kvwUFEQ.exe
  C:\Windows\System\kvwUFEQ.exe
  2⤵
  PID:5128
- C:\Windows\System\ocKhZPH.exe
  C:\Windows\System\ocKhZPH.exe
  2⤵
  PID:5684
- C:\Windows\System\aHonVri.exe
  C:\Windows\System\aHonVri.exe
  2⤵
  PID:5868
- C:\Windows\System\JwNIDTb.exe
  C:\Windows\System\JwNIDTb.exe
  2⤵
  PID:5652
- C:\Windows\System\UwqmItm.exe
  C:\Windows\System\UwqmItm.exe
  2⤵
  PID:5712
- C:\Windows\System\LsVyvGk.exe
  C:\Windows\System\LsVyvGk.exe
  2⤵
  PID:5792
- C:\Windows\System\JhjXEYK.exe
  C:\Windows\System\JhjXEYK.exe
  2⤵
  PID:5964
- C:\Windows\System\IMOsGvD.exe
  C:\Windows\System\IMOsGvD.exe
  2⤵
  PID:6048
- C:\Windows\System\bvRBCeF.exe
  C:\Windows\System\bvRBCeF.exe
  2⤵
  PID:5872
- C:\Windows\System\FjmjPqA.exe
  C:\Windows\System\FjmjPqA.exe
  2⤵
  PID:6132
- C:\Windows\System\pPLrKFQ.exe
  C:\Windows\System\pPLrKFQ.exe
  2⤵
  PID:5244
- C:\Windows\System\usbNgQI.exe
  C:\Windows\System\usbNgQI.exe
  2⤵
  PID:5156
- C:\Windows\System\MwUFKeV.exe
  C:\Windows\System\MwUFKeV.exe
  2⤵
  PID:5608
- C:\Windows\System\kayfTFr.exe
  C:\Windows\System\kayfTFr.exe
  2⤵
  PID:2888
- C:\Windows\System\NaOlrAt.exe
  C:\Windows\System\NaOlrAt.exe
  2⤵
  PID:5724
- C:\Windows\System\jAgTmqz.exe
  C:\Windows\System\jAgTmqz.exe
  2⤵
  PID:5968
- C:\Windows\System\iyqiwnk.exe
  C:\Windows\System\iyqiwnk.exe
  2⤵
  PID:5228
- C:\Windows\System\iyqWXnJ.exe
  C:\Windows\System\iyqWXnJ.exe
  2⤵
  PID:5392
- C:\Windows\System\aSVhSpn.exe
  C:\Windows\System\aSVhSpn.exe
  2⤵
  PID:5504
- C:\Windows\System\vjkHOcn.exe
  C:\Windows\System\vjkHOcn.exe
  2⤵
  PID:5572
- C:\Windows\System\LmqvlyJ.exe
  C:\Windows\System\LmqvlyJ.exe
  2⤵
  PID:5704
- C:\Windows\System\sofLMfY.exe
  C:\Windows\System\sofLMfY.exe
  2⤵
  PID:5688
- C:\Windows\System\TBdUtoi.exe
  C:\Windows\System\TBdUtoi.exe
  2⤵
  PID:6112
- C:\Windows\System\cLhVdeK.exe
  C:\Windows\System\cLhVdeK.exe
  2⤵
  PID:5540
- C:\Windows\System\cxHNZeR.exe
  C:\Windows\System\cxHNZeR.exe
  2⤵
  PID:5424
- C:\Windows\System\JTDYRLu.exe
  C:\Windows\System\JTDYRLu.exe
  2⤵
  PID:5524
- C:\Windows\System\jnxtYlA.exe
  C:\Windows\System\jnxtYlA.exe
  2⤵
  PID:6156
- C:\Windows\System\eKGpSLm.exe
  C:\Windows\System\eKGpSLm.exe
  2⤵
  PID:6172
- C:\Windows\System\EmEJQDk.exe
  C:\Windows\System\EmEJQDk.exe
  2⤵
  PID:6192
- C:\Windows\System\yXalMzA.exe
  C:\Windows\System\yXalMzA.exe
  2⤵
  PID:6208
- C:\Windows\System\UXSVUdW.exe
  C:\Windows\System\UXSVUdW.exe
  2⤵
  PID:6224
- C:\Windows\System\IQbMlZh.exe
  C:\Windows\System\IQbMlZh.exe
  2⤵
  PID:6240
- C:\Windows\System\CBtQDfq.exe
  C:\Windows\System\CBtQDfq.exe
  2⤵
  PID:6256
- C:\Windows\System\GdKsuik.exe
  C:\Windows\System\GdKsuik.exe
  2⤵
  PID:6276
- C:\Windows\System\QUsRWvu.exe
  C:\Windows\System\QUsRWvu.exe
  2⤵
  PID:6292
- C:\Windows\System\nsRXAPv.exe
  C:\Windows\System\nsRXAPv.exe
  2⤵
  PID:6308
- C:\Windows\System\ofEpnml.exe
  C:\Windows\System\ofEpnml.exe
  2⤵
  PID:6328
- C:\Windows\System\ULiqOgl.exe
  C:\Windows\System\ULiqOgl.exe
  2⤵
  PID:6344
- C:\Windows\System\oaJQwQj.exe
  C:\Windows\System\oaJQwQj.exe
  2⤵
  PID:6360
- C:\Windows\System\pSeptfj.exe
  C:\Windows\System\pSeptfj.exe
  2⤵
  PID:6376
- C:\Windows\System\hospZvF.exe
  C:\Windows\System\hospZvF.exe
  2⤵
  PID:6396
- C:\Windows\System\nmTKOvg.exe
  C:\Windows\System\nmTKOvg.exe
  2⤵
  PID:6412
- C:\Windows\System\SltalJq.exe
  C:\Windows\System\SltalJq.exe
  2⤵
  PID:6428
- C:\Windows\System\FIPlifw.exe
  C:\Windows\System\FIPlifw.exe
  2⤵
  PID:6444
- C:\Windows\System\UCMQqUj.exe
  C:\Windows\System\UCMQqUj.exe
  2⤵
  PID:6460
- C:\Windows\System\SBLJbRc.exe
  C:\Windows\System\SBLJbRc.exe
  2⤵
  PID:6480
- C:\Windows\System\WxymcKf.exe
  C:\Windows\System\WxymcKf.exe
  2⤵
  PID:6496
- C:\Windows\System\dGtFXmi.exe
  C:\Windows\System\dGtFXmi.exe
  2⤵
  PID:6512
- C:\Windows\System\YSvsyxy.exe
  C:\Windows\System\YSvsyxy.exe
  2⤵
  PID:6528
- C:\Windows\System\WKeKFFO.exe
  C:\Windows\System\WKeKFFO.exe
  2⤵
  PID:6548
- C:\Windows\System\KGpnHOf.exe
  C:\Windows\System\KGpnHOf.exe
  2⤵
  PID:6564
- C:\Windows\System\SHIujZg.exe
  C:\Windows\System\SHIujZg.exe
  2⤵
  PID:6580
- C:\Windows\System\VPVPtkj.exe
  C:\Windows\System\VPVPtkj.exe
  2⤵
  PID:6596
- C:\Windows\System\mQYkKLB.exe
  C:\Windows\System\mQYkKLB.exe
  2⤵
  PID:6612
- C:\Windows\System\nvVMYWd.exe
  C:\Windows\System\nvVMYWd.exe
  2⤵
  PID:6628
- C:\Windows\System\PCpBZbu.exe
  C:\Windows\System\PCpBZbu.exe
  2⤵
  PID:6644
- C:\Windows\System\hvTRpFa.exe
  C:\Windows\System\hvTRpFa.exe
  2⤵
  PID:6660
- C:\Windows\System\rTIPyqS.exe
  C:\Windows\System\rTIPyqS.exe
  2⤵
  PID:6676
- C:\Windows\System\JsgWGyI.exe
  C:\Windows\System\JsgWGyI.exe
  2⤵
  PID:6692
- C:\Windows\System\ajlaDMi.exe
  C:\Windows\System\ajlaDMi.exe
  2⤵
  PID:6708
- C:\Windows\System\ywXPVSF.exe
  C:\Windows\System\ywXPVSF.exe
  2⤵
  PID:6724
- C:\Windows\System\wINsJCr.exe
  C:\Windows\System\wINsJCr.exe
  2⤵
  PID:6740
- C:\Windows\System\ZbfdDOx.exe
  C:\Windows\System\ZbfdDOx.exe
  2⤵
  PID:6756
- C:\Windows\System\KJtYMGN.exe
  C:\Windows\System\KJtYMGN.exe
  2⤵
  PID:6772
- C:\Windows\System\cNHfjKH.exe
  C:\Windows\System\cNHfjKH.exe
  2⤵
  PID:6788
- C:\Windows\System\ilnTzCO.exe
  C:\Windows\System\ilnTzCO.exe
  2⤵
  PID:6808
- C:\Windows\System\Chosjjc.exe
  C:\Windows\System\Chosjjc.exe
  2⤵
  PID:6824
- C:\Windows\System\qTIYYAg.exe
  C:\Windows\System\qTIYYAg.exe
  2⤵
  PID:6840
- C:\Windows\System\ZOmVXmG.exe
  C:\Windows\System\ZOmVXmG.exe
  2⤵
  PID:6856
- C:\Windows\System\EGffcIO.exe
  C:\Windows\System\EGffcIO.exe
  2⤵
  PID:6872
- C:\Windows\System\tZPTTBN.exe
  C:\Windows\System\tZPTTBN.exe
  2⤵
  PID:6892
- C:\Windows\System\iwYeJJx.exe
  C:\Windows\System\iwYeJJx.exe
  2⤵
  PID:6908
- C:\Windows\System\cXUJIUz.exe
  C:\Windows\System\cXUJIUz.exe
  2⤵
  PID:6924
- C:\Windows\System\WRlAqVd.exe
  C:\Windows\System\WRlAqVd.exe
  2⤵
  PID:6940
- C:\Windows\System\fuiDUbX.exe
  C:\Windows\System\fuiDUbX.exe
  2⤵
  PID:6956
- C:\Windows\System\ZyALdxz.exe
  C:\Windows\System\ZyALdxz.exe
  2⤵
  PID:6972
- C:\Windows\System\wcGGekH.exe
  C:\Windows\System\wcGGekH.exe
  2⤵
  PID:6988
- C:\Windows\System\QApDqNe.exe
  C:\Windows\System\QApDqNe.exe
  2⤵
  PID:7004
- C:\Windows\System\okUWpDD.exe
  C:\Windows\System\okUWpDD.exe
  2⤵
  PID:7020
- C:\Windows\System\yrnXIDy.exe
  C:\Windows\System\yrnXIDy.exe
  2⤵
  PID:7040
- C:\Windows\System\lRLriFY.exe
  C:\Windows\System\lRLriFY.exe
  2⤵
  PID:7056
- C:\Windows\System\wTcbSTX.exe
  C:\Windows\System\wTcbSTX.exe
  2⤵
  PID:7076
- C:\Windows\System\IRsUexD.exe
  C:\Windows\System\IRsUexD.exe
  2⤵
  PID:7116
- C:\Windows\System\xYBegVr.exe
  C:\Windows\System\xYBegVr.exe
  2⤵
  PID:7132
- C:\Windows\System\njgaoiv.exe
  C:\Windows\System\njgaoiv.exe
  2⤵
  PID:7148
- C:\Windows\System\ISiENAw.exe
  C:\Windows\System\ISiENAw.exe
  2⤵
  PID:7164
- C:\Windows\System\zxKhZDT.exe
  C:\Windows\System\zxKhZDT.exe
  2⤵
  PID:6060
- C:\Windows\System\VOoKfBl.exe
  C:\Windows\System\VOoKfBl.exe
  2⤵
  PID:6164
- C:\Windows\System\IxetPBn.exe
  C:\Windows\System\IxetPBn.exe
  2⤵
  PID:6204
- C:\Windows\System\zFsimJu.exe
  C:\Windows\System\zFsimJu.exe
  2⤵
  PID:6264
- C:\Windows\System\KcCAYpT.exe
  C:\Windows\System\KcCAYpT.exe
  2⤵
  PID:6336
- C:\Windows\System\Exgkcbj.exe
  C:\Windows\System\Exgkcbj.exe
  2⤵
  PID:5668
- C:\Windows\System\TUaqgxL.exe
  C:\Windows\System\TUaqgxL.exe
  2⤵
  PID:6624
- C:\Windows\System\gQvncnF.exe
  C:\Windows\System\gQvncnF.exe
  2⤵
  PID:6748
- C:\Windows\System\sFLHsrX.exe
  C:\Windows\System\sFLHsrX.exe
  2⤵
  PID:6780
- C:\Windows\System\ZsZmqPL.exe
  C:\Windows\System\ZsZmqPL.exe
  2⤵
  PID:6864
- C:\Windows\System\KDYVMii.exe
  C:\Windows\System\KDYVMii.exe
  2⤵
  PID:6932
- C:\Windows\System\ewUQIGh.exe
  C:\Windows\System\ewUQIGh.exe
  2⤵
  PID:7000
- C:\Windows\System\wLiZBqz.exe
  C:\Windows\System\wLiZBqz.exe
  2⤵
  PID:7032
- C:\Windows\System\DFBGeHr.exe
  C:\Windows\System\DFBGeHr.exe
  2⤵
  PID:7072
- C:\Windows\System\Dihmhqu.exe
  C:\Windows\System\Dihmhqu.exe
  2⤵
  PID:6888
- C:\Windows\System\jAlzVCc.exe
  C:\Windows\System\jAlzVCc.exe
  2⤵
  PID:7016
- C:\Windows\System\NjhyOzU.exe
  C:\Windows\System\NjhyOzU.exe
  2⤵
  PID:6984
- C:\Windows\System\vRHulNp.exe
  C:\Windows\System\vRHulNp.exe
  2⤵
  PID:7096
- C:\Windows\System\qKUjcox.exe
  C:\Windows\System\qKUjcox.exe
  2⤵
  PID:7124
- C:\Windows\System\lrMeOWJ.exe
  C:\Windows\System\lrMeOWJ.exe
  2⤵
  PID:5508
- C:\Windows\System\FAwqtFa.exe
  C:\Windows\System\FAwqtFa.exe
  2⤵
  PID:7112
- C:\Windows\System\pSzcVhE.exe
  C:\Windows\System\pSzcVhE.exe
  2⤵
  PID:6304
- C:\Windows\System\sRhNspF.exe
  C:\Windows\System\sRhNspF.exe
  2⤵
  PID:6572
- C:\Windows\System\WlfHKUd.exe
  C:\Windows\System\WlfHKUd.exe
  2⤵
  PID:6588
- C:\Windows\System\GJHWfBJ.exe
  C:\Windows\System\GJHWfBJ.exe
  2⤵
  PID:7180
- C:\Windows\System\jaBnNmC.exe
  C:\Windows\System\jaBnNmC.exe
  2⤵
  PID:7200
- C:\Windows\System\gJjqKkz.exe
  C:\Windows\System\gJjqKkz.exe
  2⤵
  PID:7220
- C:\Windows\System\nhlxPkC.exe
  C:\Windows\System\nhlxPkC.exe
  2⤵
  PID:7236
- C:\Windows\System\PImFjKO.exe
  C:\Windows\System\PImFjKO.exe
  2⤵
  PID:7260
- C:\Windows\System\rBnDmdW.exe
  C:\Windows\System\rBnDmdW.exe
  2⤵
  PID:7284
- C:\Windows\System\INPEsCf.exe
  C:\Windows\System\INPEsCf.exe
  2⤵
  PID:7300
- C:\Windows\System\AvXjhBG.exe
  C:\Windows\System\AvXjhBG.exe
  2⤵
  PID:7316
- C:\Windows\System\lsbyMXM.exe
  C:\Windows\System\lsbyMXM.exe
  2⤵
  PID:7332
- C:\Windows\System\EnOMAag.exe
  C:\Windows\System\EnOMAag.exe
  2⤵
  PID:7356
- C:\Windows\System\pBnMisD.exe
  C:\Windows\System\pBnMisD.exe
  2⤵
  PID:7372
- C:\Windows\System\FszEtMu.exe
  C:\Windows\System\FszEtMu.exe
  2⤵
  PID:7388
- C:\Windows\System\apJORqf.exe
  C:\Windows\System\apJORqf.exe
  2⤵
  PID:7404
- C:\Windows\System\FajWrRs.exe
  C:\Windows\System\FajWrRs.exe
  2⤵
  PID:7420
- C:\Windows\System\aBhnPEA.exe
  C:\Windows\System\aBhnPEA.exe
  2⤵
  PID:7436
- C:\Windows\System\NXjRJiH.exe
  C:\Windows\System\NXjRJiH.exe
  2⤵
  PID:7452
- C:\Windows\System\aAmTTQu.exe
  C:\Windows\System\aAmTTQu.exe
  2⤵
  PID:7488
- C:\Windows\System\GbYgRuN.exe
  C:\Windows\System\GbYgRuN.exe
  2⤵
  PID:7524
- C:\Windows\System\JnvtNnH.exe
  C:\Windows\System\JnvtNnH.exe
  2⤵
  PID:7544
- C:\Windows\System\Vxlfkcq.exe
  C:\Windows\System\Vxlfkcq.exe
  2⤵
  PID:7560
- C:\Windows\System\yzxmuNr.exe
  C:\Windows\System\yzxmuNr.exe
  2⤵
  PID:7576
- C:\Windows\System\NteCKHm.exe
  C:\Windows\System\NteCKHm.exe
  2⤵
  PID:7592
- C:\Windows\System\mCLIpoq.exe
  C:\Windows\System\mCLIpoq.exe
  2⤵
  PID:7608
- C:\Windows\System\IfKwdLe.exe
  C:\Windows\System\IfKwdLe.exe
  2⤵
  PID:7624
- C:\Windows\System\pUcrxWY.exe
  C:\Windows\System\pUcrxWY.exe
  2⤵
  PID:7640
- C:\Windows\System\cmUaanu.exe
  C:\Windows\System\cmUaanu.exe
  2⤵
  PID:7656
- C:\Windows\System\QrWmPzW.exe
  C:\Windows\System\QrWmPzW.exe
  2⤵
  PID:7672
- C:\Windows\System\cItAUku.exe
  C:\Windows\System\cItAUku.exe
  2⤵
  PID:7688
- C:\Windows\System\XwEgCjY.exe
  C:\Windows\System\XwEgCjY.exe
  2⤵
  PID:7704
- C:\Windows\System\pEUyzJQ.exe
  C:\Windows\System\pEUyzJQ.exe
  2⤵
  PID:7720
- C:\Windows\System\guyPGtd.exe
  C:\Windows\System\guyPGtd.exe
  2⤵
  PID:7740
- C:\Windows\System\wLLMuzi.exe
  C:\Windows\System\wLLMuzi.exe
  2⤵
  PID:7756
- C:\Windows\System\cfIvJRx.exe
  C:\Windows\System\cfIvJRx.exe
  2⤵
  PID:7772
- C:\Windows\System\eLfClpn.exe
  C:\Windows\System\eLfClpn.exe
  2⤵
  PID:7788
- C:\Windows\System\qIbltxG.exe
  C:\Windows\System\qIbltxG.exe
  2⤵
  PID:7804
- C:\Windows\System\fvsvbgU.exe
  C:\Windows\System\fvsvbgU.exe
  2⤵
  PID:7820
- C:\Windows\System\HRStSck.exe
  C:\Windows\System\HRStSck.exe
  2⤵
  PID:7840
- C:\Windows\System\wEROvof.exe
  C:\Windows\System\wEROvof.exe
  2⤵
  PID:7856
- C:\Windows\System\VKrEXmk.exe
  C:\Windows\System\VKrEXmk.exe
  2⤵
  PID:7876
- C:\Windows\System\kFSXjfi.exe
  C:\Windows\System\kFSXjfi.exe
  2⤵
  PID:7896
- C:\Windows\System\rPtYEKc.exe
  C:\Windows\System\rPtYEKc.exe
  2⤵
  PID:7912
- C:\Windows\System\mCMZwkP.exe
  C:\Windows\System\mCMZwkP.exe
  2⤵
  PID:7932
- C:\Windows\System\vgYKErG.exe
  C:\Windows\System\vgYKErG.exe
  2⤵
  PID:7948
- C:\Windows\System\axWbWPy.exe
  C:\Windows\System\axWbWPy.exe
  2⤵
  PID:7964
- C:\Windows\System\UunsBSr.exe
  C:\Windows\System\UunsBSr.exe
  2⤵
  PID:7980
- C:\Windows\System\oIGQlyd.exe
  C:\Windows\System\oIGQlyd.exe
  2⤵
  PID:7996
- C:\Windows\System\WROtnLR.exe
  C:\Windows\System\WROtnLR.exe
  2⤵
  PID:8012
- C:\Windows\System\AtnSRSc.exe
  C:\Windows\System\AtnSRSc.exe
  2⤵
  PID:8028
- C:\Windows\System\ytdwZos.exe
  C:\Windows\System\ytdwZos.exe
  2⤵
  PID:8084
- C:\Windows\System\behDdMd.exe
  C:\Windows\System\behDdMd.exe
  2⤵
  PID:8100
- C:\Windows\System\lVEmQwf.exe
  C:\Windows\System\lVEmQwf.exe
  2⤵
  PID:8120
- C:\Windows\System\DxnmAzr.exe
  C:\Windows\System\DxnmAzr.exe
  2⤵
  PID:8140
- C:\Windows\System\rjkBcss.exe
  C:\Windows\System\rjkBcss.exe
  2⤵
  PID:8156
- C:\Windows\System\ZNKisUE.exe
  C:\Windows\System\ZNKisUE.exe
  2⤵
  PID:8172
- C:\Windows\System\Cncajyo.exe
  C:\Windows\System\Cncajyo.exe
  2⤵
  PID:6884
- C:\Windows\System\oevilfp.exe
  C:\Windows\System\oevilfp.exe
  2⤵
  PID:7092
- C:\Windows\System\wTDfkiZ.exe
  C:\Windows\System\wTDfkiZ.exe
  2⤵
  PID:5160
- C:\Windows\System\dqKijGd.exe
  C:\Windows\System\dqKijGd.exe
  2⤵
  PID:6764
- C:\Windows\System\RYsqvCj.exe
  C:\Windows\System\RYsqvCj.exe
  2⤵
  PID:7228
- C:\Windows\System\zNbKZdK.exe
  C:\Windows\System\zNbKZdK.exe
  2⤵
  PID:7276
- C:\Windows\System\rmqgFqQ.exe
  C:\Windows\System\rmqgFqQ.exe
  2⤵
  PID:7348
- C:\Windows\System\vMQPdhi.exe
  C:\Windows\System\vMQPdhi.exe
  2⤵
  PID:7412
- C:\Windows\System\NiIdlPj.exe
  C:\Windows\System\NiIdlPj.exe
  2⤵
  PID:7500
- C:\Windows\System\hCEjSpV.exe
  C:\Windows\System\hCEjSpV.exe
  2⤵
  PID:6656
- C:\Windows\System\nsyGQQj.exe
  C:\Windows\System\nsyGQQj.exe
  2⤵
  PID:7588
- C:\Windows\System\tQeodFi.exe
  C:\Windows\System\tQeodFi.exe
  2⤵
  PID:7312
- C:\Windows\System\boTJbht.exe
  C:\Windows\System\boTJbht.exe
  2⤵
  PID:7648
- C:\Windows\System\opqTIyB.exe
  C:\Windows\System\opqTIyB.exe
  2⤵
  PID:6352
- C:\Windows\System\GxGoPIK.exe
  C:\Windows\System\GxGoPIK.exe
  2⤵
  PID:6392
- C:\Windows\System\CYdFZnq.exe
  C:\Windows\System\CYdFZnq.exe
  2⤵
  PID:6404
- C:\Windows\System\cOrUigG.exe
  C:\Windows\System\cOrUigG.exe
  2⤵
  PID:6560
- C:\Windows\System\ERCCpJM.exe
  C:\Windows\System\ERCCpJM.exe
  2⤵
  PID:7208
- C:\Windows\System\rzmfqIH.exe
  C:\Windows\System\rzmfqIH.exe
  2⤵
  PID:7296
- C:\Windows\System\ijifOVO.exe
  C:\Windows\System\ijifOVO.exe
  2⤵
  PID:6216
- C:\Windows\System\zTTwVJx.exe
  C:\Windows\System\zTTwVJx.exe
  2⤵
  PID:5900
- C:\Windows\System\RLlpdGK.exe
  C:\Windows\System\RLlpdGK.exe
  2⤵
  PID:6900
- C:\Windows\System\RCqTUtc.exe
  C:\Windows\System\RCqTUtc.exe
  2⤵
  PID:6848
- C:\Windows\System\LxorDVz.exe
  C:\Windows\System\LxorDVz.exe
  2⤵
  PID:2824
- C:\Windows\System\KxnmbiP.exe
  C:\Windows\System\KxnmbiP.exe
  2⤵
  PID:7480
- C:\Windows\System\IGGzCjd.exe
  C:\Windows\System\IGGzCjd.exe
  2⤵
  PID:7604
- C:\Windows\System\HrPTCpG.exe
  C:\Windows\System\HrPTCpG.exe
  2⤵
  PID:7696
- C:\Windows\System\mmNqgmg.exe
  C:\Windows\System\mmNqgmg.exe
  2⤵
  PID:7764
- C:\Windows\System\uZSTMlh.exe
  C:\Windows\System\uZSTMlh.exe
  2⤵
  PID:7812
- C:\Windows\System\JjqTfjx.exe
  C:\Windows\System\JjqTfjx.exe
  2⤵
  PID:7872
- C:\Windows\System\wkpNWdr.exe
  C:\Windows\System\wkpNWdr.exe
  2⤵
  PID:7920
- C:\Windows\System\TcIxYwy.exe
  C:\Windows\System\TcIxYwy.exe
  2⤵
  PID:7960
- C:\Windows\System\AwKRazZ.exe
  C:\Windows\System\AwKRazZ.exe
  2⤵
  PID:8024
- C:\Windows\System\eFkTQBk.exe
  C:\Windows\System\eFkTQBk.exe
  2⤵
  PID:8040
- C:\Windows\System\yhnmSXi.exe
  C:\Windows\System\yhnmSXi.exe
  2⤵
  PID:7828
- C:\Windows\System\TOKmNUz.exe
  C:\Windows\System\TOKmNUz.exe
  2⤵
  PID:8004
- C:\Windows\System\OWsQSJy.exe
  C:\Windows\System\OWsQSJy.exe
  2⤵
  PID:8048
- C:\Windows\System\CqSMoQn.exe
  C:\Windows\System\CqSMoQn.exe
  2⤵
  PID:7108
- C:\Windows\System\anCCelH.exe
  C:\Windows\System\anCCelH.exe
  2⤵
  PID:8076
- C:\Windows\System\lSNmtCS.exe
  C:\Windows\System\lSNmtCS.exe
  2⤵
  PID:8128
- C:\Windows\System\OKXLoua.exe
  C:\Windows\System\OKXLoua.exe
  2⤵
  PID:8168
- C:\Windows\System\matuevg.exe
  C:\Windows\System\matuevg.exe
  2⤵
  PID:6732
- C:\Windows\System\tYBKgUq.exe
  C:\Windows\System\tYBKgUq.exe
  2⤵
  PID:7512
- C:\Windows\System\nyVItvJ.exe
  C:\Windows\System\nyVItvJ.exe
  2⤵
  PID:7680
- C:\Windows\System\ODfNMDB.exe
  C:\Windows\System\ODfNMDB.exe
  2⤵
  PID:6468
- C:\Windows\System\noWLvYZ.exe
  C:\Windows\System\noWLvYZ.exe
  2⤵
  PID:6316
- C:\Windows\System\KhoODVb.exe
  C:\Windows\System\KhoODVb.exe
  2⤵
  PID:7196
- C:\Windows\System\nNFTbWK.exe
  C:\Windows\System\nNFTbWK.exe
  2⤵
  PID:5772
- C:\Windows\System\ngMawaJ.exe
  C:\Windows\System\ngMawaJ.exe
  2⤵
  PID:6248
- C:\Windows\System\yXUfxsx.exe
  C:\Windows\System\yXUfxsx.exe
  2⤵
  PID:6284
- C:\Windows\System\tERnhts.exe
  C:\Windows\System\tERnhts.exe
  2⤵
  PID:6324
- C:\Windows\System\cVaTTGU.exe
  C:\Windows\System\cVaTTGU.exe
  2⤵
  PID:7064
- C:\Windows\System\wUpdzYj.exe
  C:\Windows\System\wUpdzYj.exe
  2⤵
  PID:6544
- C:\Windows\System\hHuwsdq.exe
  C:\Windows\System\hHuwsdq.exe
  2⤵
  PID:6804
- C:\Windows\System\xzUGiCZ.exe
  C:\Windows\System\xzUGiCZ.exe
  2⤵
  PID:7472
- C:\Windows\System\rrzhgzB.exe
  C:\Windows\System\rrzhgzB.exe
  2⤵
  PID:7444
- C:\Windows\System\DPcMReE.exe
  C:\Windows\System\DPcMReE.exe
  2⤵
  PID:6476
- C:\Windows\System\KOfnuqZ.exe
  C:\Windows\System\KOfnuqZ.exe
  2⤵
  PID:6540
- C:\Windows\System\bzppuGc.exe
  C:\Windows\System\bzppuGc.exe
  2⤵
  PID:6668
- C:\Windows\System\KCDfsui.exe
  C:\Windows\System\KCDfsui.exe
  2⤵
  PID:6620
- C:\Windows\System\nHOVxPB.exe
  C:\Windows\System\nHOVxPB.exe
  2⤵
  PID:7572
- C:\Windows\System\ZkwHuPj.exe
  C:\Windows\System\ZkwHuPj.exe
  2⤵
  PID:6752
- C:\Windows\System\UXuvIDQ.exe
  C:\Windows\System\UXuvIDQ.exe
  2⤵
  PID:7636
- C:\Windows\System\vChjzQj.exe
  C:\Windows\System\vChjzQj.exe
  2⤵
  PID:6340
- C:\Windows\System\aKYBeSV.exe
  C:\Windows\System\aKYBeSV.exe
  2⤵
  PID:7728
- C:\Windows\System\PjwdKtv.exe
  C:\Windows\System\PjwdKtv.exe
  2⤵
  PID:7600
- C:\Windows\System\LBXgcZV.exe
  C:\Windows\System\LBXgcZV.exe
  2⤵
  PID:7800
- C:\Windows\System\QGzFAYG.exe
  C:\Windows\System\QGzFAYG.exe
  2⤵
  PID:7832
- C:\Windows\System\HuIzizH.exe
  C:\Windows\System\HuIzizH.exe
  2⤵
  PID:7892
- C:\Windows\System\ZCnpPUS.exe
  C:\Windows\System\ZCnpPUS.exe
  2⤵
  PID:8056
- C:\Windows\System\nJLKrpr.exe
  C:\Windows\System\nJLKrpr.exe
  2⤵
  PID:7976
- C:\Windows\System\MKEUeAF.exe
  C:\Windows\System\MKEUeAF.exe
  2⤵
  PID:7940
- C:\Windows\System\ixsgYUc.exe
  C:\Windows\System\ixsgYUc.exe
  2⤵
  PID:7520
- C:\Windows\System\mHQTuQe.exe
  C:\Windows\System\mHQTuQe.exe
  2⤵
  PID:7140
- C:\Windows\System\QsiNhSU.exe
  C:\Windows\System\QsiNhSU.exe
  2⤵
  PID:6128
- C:\Windows\System\MvhHMpp.exe
  C:\Windows\System\MvhHMpp.exe
  2⤵
  PID:8072
- C:\Windows\System\wDrFAYF.exe
  C:\Windows\System\wDrFAYF.exe
  2⤵
  PID:8136
- C:\Windows\System\aUIofJj.exe
  C:\Windows\System\aUIofJj.exe
  2⤵
  PID:7380
- C:\Windows\System\cjScRUc.exe
  C:\Windows\System\cjScRUc.exe
  2⤵
  PID:6836
- C:\Windows\System\IfmBNgP.exe
  C:\Windows\System\IfmBNgP.exe
  2⤵
  PID:6964
- C:\Windows\System\MVdXaOV.exe
  C:\Windows\System\MVdXaOV.exe
  2⤵
  PID:7248
- C:\Windows\System\soRjyDo.exe
  C:\Windows\System\soRjyDo.exe
  2⤵
  PID:6636
- C:\Windows\System\LpTPXdl.exe
  C:\Windows\System\LpTPXdl.exe
  2⤵
  PID:6440
- C:\Windows\System\MhylXcP.exe
  C:\Windows\System\MhylXcP.exe
  2⤵
  PID:7244
- C:\Windows\System\TFPBrUt.exe
  C:\Windows\System\TFPBrUt.exe
  2⤵
  PID:6536
- C:\Windows\System\AgcApNm.exe
  C:\Windows\System\AgcApNm.exe
  2⤵
  PID:6488
- C:\Windows\System\XEWJraP.exe
  C:\Windows\System\XEWJraP.exe
  2⤵
  PID:7848
- C:\Windows\System\vVlgYvn.exe
  C:\Windows\System\vVlgYvn.exe
  2⤵
  PID:7476
- C:\Windows\System\ijkIGhV.exe
  C:\Windows\System\ijkIGhV.exe
  2⤵
  PID:7100
- C:\Windows\System\OUQasTs.exe
  C:\Windows\System\OUQasTs.exe
  2⤵
  PID:7328
- C:\Windows\System\KUmzEDm.exe
  C:\Windows\System\KUmzEDm.exe
  2⤵
  PID:6720
- C:\Windows\System\zzHoJdX.exe
  C:\Windows\System\zzHoJdX.exe
  2⤵
  PID:7368
- C:\Windows\System\tsxmMqE.exe
  C:\Windows\System\tsxmMqE.exe
  2⤵
  PID:7464
- C:\Windows\System\hokaRtz.exe
  C:\Windows\System\hokaRtz.exe
  2⤵
  PID:8020
- C:\Windows\System\IqpKaMK.exe
  C:\Windows\System\IqpKaMK.exe
  2⤵
  PID:7868
- C:\Windows\System\cvyQMHf.exe
  C:\Windows\System\cvyQMHf.exe
  2⤵
  PID:8164
- C:\Windows\System\iUzmplY.exe
  C:\Windows\System\iUzmplY.exe
  2⤵
  PID:7088
- C:\Windows\System\LaFDPNH.exe
  C:\Windows\System\LaFDPNH.exe
  2⤵
  PID:7508
- C:\Windows\System\YIvMSUV.exe
  C:\Windows\System\YIvMSUV.exe
  2⤵
  PID:6424
- C:\Windows\System\mVBxzfX.exe
  C:\Windows\System\mVBxzfX.exe
  2⤵
  PID:7716
- C:\Windows\System\wSFXmcx.exe
  C:\Windows\System\wSFXmcx.exe
  2⤵
  PID:6456
- C:\Windows\System\dyWSfzX.exe
  C:\Windows\System\dyWSfzX.exe
  2⤵
  PID:7852
- C:\Windows\System\kxzVBmz.exe
  C:\Windows\System\kxzVBmz.exe
  2⤵
  PID:7256
- C:\Windows\System\DNIzcyO.exe
  C:\Windows\System\DNIzcyO.exe
  2⤵
  PID:7768
- C:\Windows\System\DwyqlIL.exe
  C:\Windows\System\DwyqlIL.exe
  2⤵
  PID:7944
- C:\Windows\System\upbGvxw.exe
  C:\Windows\System\upbGvxw.exe
  2⤵
  PID:8204
- C:\Windows\System\qwItqnP.exe
  C:\Windows\System\qwItqnP.exe
  2⤵
  PID:8224
- C:\Windows\System\QTVxzBG.exe
  C:\Windows\System\QTVxzBG.exe
  2⤵
  PID:8240
- C:\Windows\System\FznGsTu.exe
  C:\Windows\System\FznGsTu.exe
  2⤵
  PID:8256
- C:\Windows\System\PYhVedN.exe
  C:\Windows\System\PYhVedN.exe
  2⤵
  PID:8272
- C:\Windows\System\PdehwQQ.exe
  C:\Windows\System\PdehwQQ.exe
  2⤵
  PID:8288
- C:\Windows\System\UOklUhW.exe
  C:\Windows\System\UOklUhW.exe
  2⤵
  PID:8304
- C:\Windows\System\dYGyoba.exe
  C:\Windows\System\dYGyoba.exe
  2⤵
  PID:8320
- C:\Windows\System\OObwwTy.exe
  C:\Windows\System\OObwwTy.exe
  2⤵
  PID:8336
- C:\Windows\System\WKDpGEA.exe
  C:\Windows\System\WKDpGEA.exe
  2⤵
  PID:8352
- C:\Windows\System\mmWdBma.exe
  C:\Windows\System\mmWdBma.exe
  2⤵
  PID:8368
- C:\Windows\System\oYnIeCG.exe
  C:\Windows\System\oYnIeCG.exe
  2⤵
  PID:8384
- C:\Windows\System\xDQTwwh.exe
  C:\Windows\System\xDQTwwh.exe
  2⤵
  PID:8400
- C:\Windows\System\EdAUMcR.exe
  C:\Windows\System\EdAUMcR.exe
  2⤵
  PID:8416
- C:\Windows\System\xuTMDSO.exe
  C:\Windows\System\xuTMDSO.exe
  2⤵
  PID:8432
- C:\Windows\System\ssjWlIR.exe
  C:\Windows\System\ssjWlIR.exe
  2⤵
  PID:8448
- C:\Windows\System\PanMoVj.exe
  C:\Windows\System\PanMoVj.exe
  2⤵
  PID:8472
- C:\Windows\System\WjyQZwY.exe
  C:\Windows\System\WjyQZwY.exe
  2⤵
  PID:8488
- C:\Windows\System\BZSawAD.exe
  C:\Windows\System\BZSawAD.exe
  2⤵
  PID:8504
- C:\Windows\System\saVFvVh.exe
  C:\Windows\System\saVFvVh.exe
  2⤵
  PID:8524
- C:\Windows\System\bKvLPwc.exe
  C:\Windows\System\bKvLPwc.exe
  2⤵
  PID:8540
- C:\Windows\System\sjwKJsV.exe
  C:\Windows\System\sjwKJsV.exe
  2⤵
  PID:8556
- C:\Windows\System\TztJymv.exe
  C:\Windows\System\TztJymv.exe
  2⤵
  PID:8576
- C:\Windows\System\TnRMpyN.exe
  C:\Windows\System\TnRMpyN.exe
  2⤵
  PID:8592
- C:\Windows\System\KpydnaU.exe
  C:\Windows\System\KpydnaU.exe
  2⤵
  PID:8612
- C:\Windows\System\bxgPjgx.exe
  C:\Windows\System\bxgPjgx.exe
  2⤵
  PID:8628
- C:\Windows\System\IflIvrK.exe
  C:\Windows\System\IflIvrK.exe
  2⤵
  PID:8644
- C:\Windows\System\wYrJOuQ.exe
  C:\Windows\System\wYrJOuQ.exe
  2⤵
  PID:8660
- C:\Windows\System\BxKrPQW.exe
  C:\Windows\System\BxKrPQW.exe
  2⤵
  PID:8676
- C:\Windows\System\mAFGxHA.exe
  C:\Windows\System\mAFGxHA.exe
  2⤵
  PID:8692
- C:\Windows\System\rpbZPEy.exe
  C:\Windows\System\rpbZPEy.exe
  2⤵
  PID:8708
- C:\Windows\System\QmpPaqB.exe
  C:\Windows\System\QmpPaqB.exe
  2⤵
  PID:8728
- C:\Windows\System\mIPdXVk.exe
  C:\Windows\System\mIPdXVk.exe
  2⤵
  PID:8744
- C:\Windows\System\FbYQrJo.exe
  C:\Windows\System\FbYQrJo.exe
  2⤵
  PID:8760
- C:\Windows\System\bNditxA.exe
  C:\Windows\System\bNditxA.exe
  2⤵
  PID:8776
- C:\Windows\System\gKTimtX.exe
  C:\Windows\System\gKTimtX.exe
  2⤵
  PID:8792
- C:\Windows\System\NBgQtoW.exe
  C:\Windows\System\NBgQtoW.exe
  2⤵
  PID:8812
- C:\Windows\System\cxNNemT.exe
  C:\Windows\System\cxNNemT.exe
  2⤵
  PID:8832
- C:\Windows\System\ImESKyK.exe
  C:\Windows\System\ImESKyK.exe
  2⤵
  PID:8848
- C:\Windows\System\VJMxNoX.exe
  C:\Windows\System\VJMxNoX.exe
  2⤵
  PID:8864
- C:\Windows\System\aKzQTEe.exe
  C:\Windows\System\aKzQTEe.exe
  2⤵
  PID:8892
- C:\Windows\System\zMKjWuP.exe
  C:\Windows\System\zMKjWuP.exe
  2⤵
  PID:8908
- C:\Windows\System\PNRSKvs.exe
  C:\Windows\System\PNRSKvs.exe
  2⤵
  PID:8924
- C:\Windows\System\CbuLTZT.exe
  C:\Windows\System\CbuLTZT.exe
  2⤵
  PID:8944
- C:\Windows\System\dXoTbjI.exe
  C:\Windows\System\dXoTbjI.exe
  2⤵
  PID:8960
- C:\Windows\System\QqOwTFD.exe
  C:\Windows\System\QqOwTFD.exe
  2⤵
  PID:8976
- C:\Windows\System\qANrdvO.exe
  C:\Windows\System\qANrdvO.exe
  2⤵
  PID:8992
- C:\Windows\System\rPaJUoK.exe
  C:\Windows\System\rPaJUoK.exe
  2⤵
  PID:9008
- C:\Windows\System\SLZSmZp.exe
  C:\Windows\System\SLZSmZp.exe
  2⤵
  PID:9024
- C:\Windows\System\gzmuFhZ.exe
  C:\Windows\System\gzmuFhZ.exe
  2⤵
  PID:9040
- C:\Windows\System\JXnRtBS.exe
  C:\Windows\System\JXnRtBS.exe
  2⤵
  PID:9056
- C:\Windows\System\HmnKUtd.exe
  C:\Windows\System\HmnKUtd.exe
  2⤵
  PID:9072
- C:\Windows\System\dSzsiUp.exe
  C:\Windows\System\dSzsiUp.exe
  2⤵
  PID:9088
- C:\Windows\System\vYIrDcu.exe
  C:\Windows\System\vYIrDcu.exe
  2⤵
  PID:9104
- C:\Windows\System\zGzBbke.exe
  C:\Windows\System\zGzBbke.exe
  2⤵
  PID:9128
- C:\Windows\System\JqWWubK.exe
  C:\Windows\System\JqWWubK.exe
  2⤵
  PID:9144
- C:\Windows\System\PQmEWOY.exe
  C:\Windows\System\PQmEWOY.exe
  2⤵
  PID:9160
- C:\Windows\System\qtBZIpC.exe
  C:\Windows\System\qtBZIpC.exe
  2⤵
  PID:9176
- C:\Windows\System\aZuzkJf.exe
  C:\Windows\System\aZuzkJf.exe
  2⤵
  PID:6508
- C:\Windows\System\nriIrmR.exe
  C:\Windows\System\nriIrmR.exe
  2⤵
  PID:6436
- C:\Windows\System\QvHMNLr.exe
  C:\Windows\System\QvHMNLr.exe
  2⤵
  PID:8092
- C:\Windows\System\AYsuKgh.exe
  C:\Windows\System\AYsuKgh.exe
  2⤵
  PID:7668
- C:\Windows\System\kbMmIXI.exe
  C:\Windows\System\kbMmIXI.exe
  2⤵
  PID:8044
- C:\Windows\System\WQqMUNY.exe
  C:\Windows\System\WQqMUNY.exe
  2⤵
  PID:6268
- C:\Windows\System\FAUawNm.exe
  C:\Windows\System\FAUawNm.exe
  2⤵
  PID:8248
- C:\Windows\System\cxdmCeb.exe
  C:\Windows\System\cxdmCeb.exe
  2⤵
  PID:8312
- C:\Windows\System\KGiCwjC.exe
  C:\Windows\System\KGiCwjC.exe
  2⤵
  PID:8316
- C:\Windows\System\SCOfQSk.exe
  C:\Windows\System\SCOfQSk.exe
  2⤵
  PID:8348
- C:\Windows\System\EuGznWN.exe
  C:\Windows\System\EuGznWN.exe
  2⤵
  PID:8380
- C:\Windows\System\HJHhvle.exe
  C:\Windows\System\HJHhvle.exe
  2⤵
  PID:8444
- C:\Windows\System\sXYMUrD.exe
  C:\Windows\System\sXYMUrD.exe
  2⤵
  PID:8480
- C:\Windows\System\MmuCyfK.exe
  C:\Windows\System\MmuCyfK.exe
  2⤵
  PID:8520
- C:\Windows\System\pldvsZw.exe
  C:\Windows\System\pldvsZw.exe
  2⤵
  PID:8588
- C:\Windows\System\IXjaIPE.exe
  C:\Windows\System\IXjaIPE.exe
  2⤵
  PID:8456
- C:\Windows\System\JhHKdxm.exe
  C:\Windows\System\JhHKdxm.exe
  2⤵
  PID:8500
- C:\Windows\System\SwMtCeH.exe
  C:\Windows\System\SwMtCeH.exe
  2⤵
  PID:8536
- C:\Windows\System\GZkdUSo.exe
  C:\Windows\System\GZkdUSo.exe
  2⤵
  PID:8600
- C:\Windows\System\SfYAqcy.exe
  C:\Windows\System\SfYAqcy.exe
  2⤵
  PID:8640
- C:\Windows\System\yOkjfXh.exe
  C:\Windows\System\yOkjfXh.exe
  2⤵
  PID:8684
- C:\Windows\System\BPgqYDn.exe
  C:\Windows\System\BPgqYDn.exe
  2⤵
  PID:8668
- C:\Windows\System\rYKfuKv.exe
  C:\Windows\System\rYKfuKv.exe
  2⤵
  PID:8672
- C:\Windows\System\RFJfLST.exe
  C:\Windows\System\RFJfLST.exe
  2⤵
  PID:8800
- C:\Windows\System\RRyoEWg.exe
  C:\Windows\System\RRyoEWg.exe
  2⤵
  PID:8844
- C:\Windows\System\LUrmuJf.exe
  C:\Windows\System\LUrmuJf.exe
  2⤵
  PID:8888
- C:\Windows\System\XZLrXpw.exe
  C:\Windows\System\XZLrXpw.exe
  2⤵
  PID:8956
- C:\Windows\System\WrVWWUg.exe
  C:\Windows\System\WrVWWUg.exe
  2⤵
  PID:9016
- C:\Windows\System\NNkVjzR.exe
  C:\Windows\System\NNkVjzR.exe
  2⤵
  PID:9112
- C:\Windows\System\AepJabB.exe
  C:\Windows\System\AepJabB.exe
  2⤵
  PID:8788
- C:\Windows\System\ybfrBxx.exe
  C:\Windows\System\ybfrBxx.exe
  2⤵
  PID:8856
- C:\Windows\System\rLnqAPN.exe
  C:\Windows\System\rLnqAPN.exe
  2⤵
  PID:8932
- C:\Windows\System\IjAJJJe.exe
  C:\Windows\System\IjAJJJe.exe
  2⤵
  PID:8972
- C:\Windows\System\vaWInKz.exe
  C:\Windows\System\vaWInKz.exe
  2⤵
  PID:9036
- C:\Windows\System\MyNwaLC.exe
  C:\Windows\System\MyNwaLC.exe
  2⤵
  PID:9100
- C:\Windows\System\rbxXLKj.exe
  C:\Windows\System\rbxXLKj.exe
  2⤵
  PID:9152
- C:\Windows\System\BXSEBns.exe
  C:\Windows\System\BXSEBns.exe
  2⤵
  PID:9200
- C:\Windows\System\LqJpSfR.exe
  C:\Windows\System\LqJpSfR.exe
  2⤵
  PID:6472
- C:\Windows\System\shicttE.exe
  C:\Windows\System\shicttE.exe
  2⤵
  PID:7340
- C:\Windows\System\rTPJlAJ.exe
  C:\Windows\System\rTPJlAJ.exe
  2⤵
  PID:6920
- C:\Windows\System\bqPwCpi.exe
  C:\Windows\System\bqPwCpi.exe
  2⤵
  PID:8220
- C:\Windows\System\PymsdlG.exe
  C:\Windows\System\PymsdlG.exe
  2⤵
  PID:7956
- C:\Windows\System\wcmHiTz.exe
  C:\Windows\System\wcmHiTz.exe
  2⤵
  PID:6640
- C:\Windows\System\TroINCk.exe
  C:\Windows\System\TroINCk.exe
  2⤵
  PID:8328
- C:\Windows\System\fZMbzze.exe
  C:\Windows\System\fZMbzze.exe
  2⤵
  PID:8280
- C:\Windows\System\TMAGvjK.exe
  C:\Windows\System\TMAGvjK.exe
  2⤵
  PID:8516
- C:\Windows\System\qpRbNmR.exe
  C:\Windows\System\qpRbNmR.exe
  2⤵
  PID:6852
- C:\Windows\System\nWSpsYY.exe
  C:\Windows\System\nWSpsYY.exe
  2⤵
  PID:8572
- C:\Windows\System\CzhncuN.exe
  C:\Windows\System\CzhncuN.exe
  2⤵
  PID:8740
- C:\Windows\System\whBynhm.exe
  C:\Windows\System\whBynhm.exe
  2⤵
  PID:9048
- C:\Windows\System\GlORjun.exe
  C:\Windows\System\GlORjun.exe
  2⤵
  PID:8824
- C:\Windows\System\DYqcMiR.exe
  C:\Windows\System\DYqcMiR.exe
  2⤵
  PID:9068
- C:\Windows\System\UfqAEqB.exe
  C:\Windows\System\UfqAEqB.exe
  2⤵
  PID:7344
- C:\Windows\System\NgqWUmw.exe
  C:\Windows\System\NgqWUmw.exe
  2⤵
  PID:8884
- C:\Windows\System\qbKvdFg.exe
  C:\Windows\System\qbKvdFg.exe
  2⤵
  PID:8756
- C:\Windows\System\EwYUonB.exe
  C:\Windows\System\EwYUonB.exe
  2⤵
  PID:8636
- C:\Windows\System\vAcMQph.exe
  C:\Windows\System\vAcMQph.exe
  2⤵
  PID:8880
- C:\Windows\System\rEtEFWY.exe
  C:\Windows\System\rEtEFWY.exe
  2⤵
  PID:9004
- C:\Windows\System\vqkppjn.exe
  C:\Windows\System\vqkppjn.exe
  2⤵
  PID:6288
- C:\Windows\System\VXDCRDj.exe
  C:\Windows\System\VXDCRDj.exe
  2⤵
  PID:7400
- C:\Windows\System\xaYzYHn.exe
  C:\Windows\System\xaYzYHn.exe
  2⤵
  PID:8216
- C:\Windows\System\JreBbiE.exe
  C:\Windows\System\JreBbiE.exe
  2⤵
  PID:8620
- C:\Windows\System\VqLOmKz.exe
  C:\Windows\System\VqLOmKz.exe
  2⤵
  PID:9084
- C:\Windows\System\ogpqVWs.exe
  C:\Windows\System\ogpqVWs.exe
  2⤵
  PID:8468
- C:\Windows\System\rQoYHLb.exe
  C:\Windows\System\rQoYHLb.exe
  2⤵
  PID:8784
- C:\Windows\System\CDfpEKD.exe
  C:\Windows\System\CDfpEKD.exe
  2⤵
  PID:9220
- C:\Windows\System\BvREdui.exe
  C:\Windows\System\BvREdui.exe
  2⤵
  PID:9236
- C:\Windows\System\vTxXGFY.exe
  C:\Windows\System\vTxXGFY.exe
  2⤵
  PID:9252
- C:\Windows\System\zlDZsjj.exe
  C:\Windows\System\zlDZsjj.exe
  2⤵
  PID:9272
- C:\Windows\System\hDsxmXM.exe
  C:\Windows\System\hDsxmXM.exe
  2⤵
  PID:9288
- C:\Windows\System\nDJzGgx.exe
  C:\Windows\System\nDJzGgx.exe
  2⤵
  PID:9312
- C:\Windows\System\zpTzlJk.exe
  C:\Windows\System\zpTzlJk.exe
  2⤵
  PID:9328
- C:\Windows\System\wHVafNn.exe
  C:\Windows\System\wHVafNn.exe
  2⤵
  PID:9344
- C:\Windows\System\amxWRew.exe
  C:\Windows\System\amxWRew.exe
  2⤵
  PID:9360
- C:\Windows\System\FKkoXax.exe
  C:\Windows\System\FKkoXax.exe
  2⤵
  PID:9376
- C:\Windows\System\NdwaBIa.exe
  C:\Windows\System\NdwaBIa.exe
  2⤵
  PID:9396
- C:\Windows\System\ateUiSi.exe
  C:\Windows\System\ateUiSi.exe
  2⤵
  PID:9412
- C:\Windows\System\YSfpzHC.exe
  C:\Windows\System\YSfpzHC.exe
  2⤵
  PID:9432
- C:\Windows\System\ngzeQgE.exe
  C:\Windows\System\ngzeQgE.exe
  2⤵
  PID:9448
- C:\Windows\System\XaQGOzX.exe
  C:\Windows\System\XaQGOzX.exe
  2⤵
  PID:9468
- C:\Windows\System\Zyadowf.exe
  C:\Windows\System\Zyadowf.exe
  2⤵
  PID:9488
- C:\Windows\System\HtAmepJ.exe
  C:\Windows\System\HtAmepJ.exe
  2⤵
  PID:9504
- C:\Windows\System\PqdnmZS.exe
  C:\Windows\System\PqdnmZS.exe
  2⤵
  PID:9520
- C:\Windows\System\idkZxDN.exe
  C:\Windows\System\idkZxDN.exe
  2⤵
  PID:9540
- C:\Windows\System\NBYQfyK.exe
  C:\Windows\System\NBYQfyK.exe
  2⤵
  PID:9556
- C:\Windows\System\PsbqeeQ.exe
  C:\Windows\System\PsbqeeQ.exe
  2⤵
  PID:9572
- C:\Windows\System\ixtrtpA.exe
  C:\Windows\System\ixtrtpA.exe
  2⤵
  PID:9588
- C:\Windows\System\xFKkMUu.exe
  C:\Windows\System\xFKkMUu.exe
  2⤵
  PID:9788
- C:\Windows\System\yYlKeAk.exe
  C:\Windows\System\yYlKeAk.exe
  2⤵
  PID:9840
- C:\Windows\System\InxkFnT.exe
  C:\Windows\System\InxkFnT.exe
  2⤵
  PID:9856
- C:\Windows\System\iyhSuen.exe
  C:\Windows\System\iyhSuen.exe
  2⤵
  PID:9872
- C:\Windows\System\TbCPEqA.exe
  C:\Windows\System\TbCPEqA.exe
  2⤵
  PID:9888
- C:\Windows\System\yWWVDhN.exe
  C:\Windows\System\yWWVDhN.exe
  2⤵
  PID:9904
- C:\Windows\System\GISSlQp.exe
  C:\Windows\System\GISSlQp.exe
  2⤵
  PID:9920
- C:\Windows\System\uJfBHCR.exe
  C:\Windows\System\uJfBHCR.exe
  2⤵
  PID:9936
- C:\Windows\System\dgUwcrg.exe
  C:\Windows\System\dgUwcrg.exe
  2⤵
  PID:9952
- C:\Windows\System\BYGWKbt.exe
  C:\Windows\System\BYGWKbt.exe
  2⤵
  PID:9968
- C:\Windows\System\AlMQBdn.exe
  C:\Windows\System\AlMQBdn.exe
  2⤵
  PID:9984
- C:\Windows\System\dtzcATd.exe
  C:\Windows\System\dtzcATd.exe
  2⤵
  PID:10000
- C:\Windows\System\IKOhfkD.exe
  C:\Windows\System\IKOhfkD.exe
  2⤵
  PID:10016
- C:\Windows\System\eKBQoQI.exe
  C:\Windows\System\eKBQoQI.exe
  2⤵
  PID:10032
- C:\Windows\System\bTahKZF.exe
  C:\Windows\System\bTahKZF.exe
  2⤵
  PID:10052
- C:\Windows\System\BWBQTqG.exe
  C:\Windows\System\BWBQTqG.exe
  2⤵
  PID:10068
- C:\Windows\System\aiEdFQU.exe
  C:\Windows\System\aiEdFQU.exe
  2⤵
  PID:10084
- C:\Windows\System\kEnKANg.exe
  C:\Windows\System\kEnKANg.exe
  2⤵
  PID:10100
- C:\Windows\System\IhAYISj.exe
  C:\Windows\System\IhAYISj.exe
  2⤵
  PID:10120
- C:\Windows\System\gFxGFFt.exe
  C:\Windows\System\gFxGFFt.exe
  2⤵
  PID:10136
- C:\Windows\System\tunHIgX.exe
  C:\Windows\System\tunHIgX.exe
  2⤵
  PID:10156
- C:\Windows\System\JNJeheo.exe
  C:\Windows\System\JNJeheo.exe
  2⤵
  PID:10172
- C:\Windows\System\BNnDvVT.exe
  C:\Windows\System\BNnDvVT.exe
  2⤵
  PID:10188
- C:\Windows\System\xUiLgzq.exe
  C:\Windows\System\xUiLgzq.exe
  2⤵
  PID:10204
- C:\Windows\System\lyInlVN.exe
  C:\Windows\System\lyInlVN.exe
  2⤵
  PID:10220
- C:\Windows\System\ajjesyZ.exe
  C:\Windows\System\ajjesyZ.exe
  2⤵
  PID:10236
- C:\Windows\System\sPzasSX.exe
  C:\Windows\System\sPzasSX.exe
  2⤵
  PID:8904
- C:\Windows\System\zIWSDxF.exe
  C:\Windows\System\zIWSDxF.exe
  2⤵
  PID:6032
- C:\Windows\System\leVRhaB.exe
  C:\Windows\System\leVRhaB.exe
  2⤵
  PID:9264
- C:\Windows\System\UrptKej.exe
  C:\Windows\System\UrptKej.exe
  2⤵
  PID:9304
- C:\Windows\System\gJfJDBI.exe
  C:\Windows\System\gJfJDBI.exe
  2⤵
  PID:9340
- C:\Windows\System\rmPqUHA.exe
  C:\Windows\System\rmPqUHA.exe
  2⤵
  PID:9372
- C:\Windows\System\Efnqmlv.exe
  C:\Windows\System\Efnqmlv.exe
  2⤵
  PID:7684
- C:\Windows\System\aIsAKGD.exe
  C:\Windows\System\aIsAKGD.exe
  2⤵
  PID:9476
- C:\Windows\System\mjHHWBI.exe
  C:\Windows\System\mjHHWBI.exe
  2⤵
  PID:9516
- C:\Windows\System\tRjtXqQ.exe
  C:\Windows\System\tRjtXqQ.exe
  2⤵
  PID:9580
- C:\Windows\System\dZOWDsy.exe
  C:\Windows\System\dZOWDsy.exe
  2⤵
  PID:9532
- C:\Windows\System\hZEaZsC.exe
  C:\Windows\System\hZEaZsC.exe
  2⤵
  PID:9596
- C:\Windows\System\NJoHqgt.exe
  C:\Windows\System\NJoHqgt.exe
  2⤵
  PID:9456
- C:\Windows\System\GgodDVP.exe
  C:\Windows\System\GgodDVP.exe
  2⤵
  PID:8496
- C:\Windows\System\oGCNIoB.exe
  C:\Windows\System\oGCNIoB.exe
  2⤵
  PID:8952
- C:\Windows\System\MlUkZBi.exe
  C:\Windows\System\MlUkZBi.exe
  2⤵
  PID:8608
- C:\Windows\System\njHUSMK.exe
  C:\Windows\System\njHUSMK.exe
  2⤵
  PID:9124
- C:\Windows\System\ZOCQUme.exe
  C:\Windows\System\ZOCQUme.exe
  2⤵
  PID:8428
- C:\Windows\System\NiJCQsx.exe
  C:\Windows\System\NiJCQsx.exe
  2⤵
  PID:9168
- C:\Windows\System\ZEVmJxo.exe
  C:\Windows\System\ZEVmJxo.exe
  2⤵
  PID:9248
- C:\Windows\System\sTYNyBw.exe
  C:\Windows\System\sTYNyBw.exe
  2⤵
  PID:9384
- C:\Windows\System\rWmehBh.exe
  C:\Windows\System\rWmehBh.exe
  2⤵
  PID:9496
- C:\Windows\System\iTHLygv.exe
  C:\Windows\System\iTHLygv.exe
  2⤵
  PID:9660
- C:\Windows\System\znOlBDT.exe
  C:\Windows\System\znOlBDT.exe
  2⤵
  PID:9640
- C:\Windows\System\dZQWzdK.exe
  C:\Windows\System\dZQWzdK.exe
  2⤵
  PID:9664
- C:\Windows\System\rIpwpUA.exe
  C:\Windows\System\rIpwpUA.exe
  2⤵
  PID:9700
- C:\Windows\System\KVAUFuo.exe
  C:\Windows\System\KVAUFuo.exe
  2⤵
  PID:9720
- C:\Windows\System\LuNmowj.exe
  C:\Windows\System\LuNmowj.exe
  2⤵
  PID:9736
- C:\Windows\System\NYXXHsJ.exe
  C:\Windows\System\NYXXHsJ.exe
  2⤵
  PID:9768
- C:\Windows\System\wrUqRiq.exe
  C:\Windows\System\wrUqRiq.exe
  2⤵
  PID:9760
- C:\Windows\System\XeztyqS.exe
  C:\Windows\System\XeztyqS.exe
  2⤵
  PID:9748
- C:\Windows\System\KeDgKwf.exe
  C:\Windows\System\KeDgKwf.exe
  2⤵
  PID:9900
- C:\Windows\System\rtYRzhA.exe
  C:\Windows\System\rtYRzhA.exe
  2⤵
  PID:9828
- C:\Windows\System\NhrPOkQ.exe
  C:\Windows\System\NhrPOkQ.exe
  2⤵
  PID:9812
- C:\Windows\System\WDTnlbi.exe
  C:\Windows\System\WDTnlbi.exe
  2⤵
  PID:9864
- C:\Windows\System\KJfqYwo.exe
  C:\Windows\System\KJfqYwo.exe
  2⤵
  PID:10024
- C:\Windows\System\ajDiaRx.exe
  C:\Windows\System\ajDiaRx.exe
  2⤵
  PID:9916
- C:\Windows\System\TakcVyb.exe
  C:\Windows\System\TakcVyb.exe
  2⤵
  PID:9944
- C:\Windows\System\ZnwZfPZ.exe
  C:\Windows\System\ZnwZfPZ.exe
  2⤵
  PID:10064
- C:\Windows\System\nFlaTas.exe
  C:\Windows\System\nFlaTas.exe
  2⤵
  PID:10132
- C:\Windows\System\MJeftfs.exe
  C:\Windows\System\MJeftfs.exe
  2⤵
  PID:10048
- C:\Windows\System\aeZHHnT.exe
  C:\Windows\System\aeZHHnT.exe
  2⤵
  PID:10080
- C:\Windows\System\PIGWjmm.exe
  C:\Windows\System\PIGWjmm.exe
  2⤵
  PID:10228
- C:\Windows\System\GXRvtRu.exe
  C:\Windows\System\GXRvtRu.exe
  2⤵
  PID:10112
- C:\Windows\System\BIMRwUR.exe
  C:\Windows\System\BIMRwUR.exe
  2⤵
  PID:1492
- C:\Windows\System\kLMJCFC.exe
  C:\Windows\System\kLMJCFC.exe
  2⤵
  PID:9408
- C:\Windows\System\SWSlvSL.exe
  C:\Windows\System\SWSlvSL.exe
  2⤵
  PID:9552
- C:\Windows\System\jkZtFGc.exe
  C:\Windows\System\jkZtFGc.exe
  2⤵
  PID:8376
- C:\Windows\System\FLfNrzS.exe
  C:\Windows\System\FLfNrzS.exe
  2⤵
  PID:9440
- C:\Windows\System\WCWAADU.exe
  C:\Windows\System\WCWAADU.exe
  2⤵
  PID:9600
- C:\Windows\System\Cpecjgl.exe
  C:\Windows\System\Cpecjgl.exe
  2⤵
  PID:8968
- C:\Windows\System\pEMVDLm.exe
  C:\Windows\System\pEMVDLm.exe
  2⤵
  PID:9032
- C:\Windows\System\iDspYDh.exe
  C:\Windows\System\iDspYDh.exe
  2⤵
  PID:9392
- C:\Windows\System\VMotWWu.exe
  C:\Windows\System\VMotWWu.exe
  2⤵
  PID:9644
- C:\Windows\System\arXJYTg.exe
  C:\Windows\System\arXJYTg.exe
  2⤵
  PID:9628
- C:\Windows\System\xQBGKhq.exe
  C:\Windows\System\xQBGKhq.exe
  2⤵
  PID:9612
- C:\Windows\System\sNXIYuO.exe
  C:\Windows\System\sNXIYuO.exe
  2⤵
  PID:9684
- C:\Windows\System\AMWTTxW.exe
  C:\Windows\System\AMWTTxW.exe
  2⤵
  PID:9716
- C:\Windows\System\VopMIVP.exe
  C:\Windows\System\VopMIVP.exe
  2⤵
  PID:9780
- C:\Windows\System\dMxSkjU.exe
  C:\Windows\System\dMxSkjU.exe
  2⤵
  PID:9784
- C:\Windows\System\gNTyScl.exe
  C:\Windows\System\gNTyScl.exe
  2⤵
  PID:9816
- C:\Windows\System\HbDgHBg.exe
  C:\Windows\System\HbDgHBg.exe
  2⤵
  PID:9880
- C:\Windows\System\WkocEzi.exe
  C:\Windows\System\WkocEzi.exe
  2⤵
  PID:10200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DyvfwEH.exe

Filesize
2.8MB

MD5
e6d29df38c4cb0b836013199094b2114

SHA1
9b923078db2799286977048ea23be6e736ab431f

SHA256
c288f6cb1665249da806ac0db3994d56611bcd3bf62d8e5356ac6829bb7a874e

SHA512
15d16b3f2c53ae64f474c6315af652747ed0730876ce33e32ec79a501f519b45571556829c75335b2a251dbe2200617ed84df916c8c53ba15a55c6ba99982d26

Download Submit
C:\Windows\system\DzDUrbu.exe

Filesize
2.8MB

MD5
7488c9f94f67620c3dec55f3044a9fdb

SHA1
bceb21f8b84ba90f56c10b8b8cf1cb77172b2207

SHA256
f429e3e6b6d052ed39bf64eafe1d41e080f731a12d0e035b2424303c03d24b02

SHA512
bd73b7ae09c3014a1cd9d1a3a23606a9920d33cdba5abb76278b86e8c8fd7d669b33a9cc61654cfbd2dc5c873f2791180821f563fe2e4209a66b3c121edabe49

Download Submit
C:\Windows\system\EfmsrTj.exe

Filesize
2.8MB

MD5
b211dc0b7fd325fbb40cd116b043b7b8

SHA1
d9874840137420e112e1ddf6e9292b225252dc71

SHA256
0d43fe6e52a761de71f3233f47015452b2da4646090ee0fc91602074895304cc

SHA512
cceed9b367b933c2acd3b2733577e8e923028a3580dbabd2a97d046be1bd90ebecfa8013e4145f8a9e2af7a61b98ebeed2543bc45c5c76304e64690904d6c162

Download Submit
C:\Windows\system\ICgnoIM.exe

Filesize
2.8MB

MD5
cfa61e9f4af77f8b79a7445e3f1a9d42

SHA1
f707de2602ad535844da543b8908336f31a5a660

SHA256
737486a121f19dbc06489caa65025cc9d07b4aac1fe0f70c50378559ea5b22ae

SHA512
0f5055edbe3628867d472df154d73b22cd2b9de6670e3075d8be7788d49467ffeedf4719284cc57ac877943b174d453ee94cefe71e0305a45d8689be884d1f8c

Download Submit
C:\Windows\system\JXGTVIy.exe

Filesize
2.8MB

MD5
eba468ff81947d11372e33fb4df09fa8

SHA1
282dedfda0cd7069ca7b82726b54e235234c20c8

SHA256
65e2b1e57d28feffbd65597443cc7c78f53f060ad70638f4d32289936dca894b

SHA512
6966b29be992aeaafbc1b1f68204d4df9fdbe2c26b9f81e471daa7f88b35feabe85ef33a01682ccd914fe51cba55a46349227b8d42be31135f217d235e29fdee

Download Submit
C:\Windows\system\LQFRbqi.exe

Filesize
2.8MB

MD5
e0bf4b4b49adf09ecd57207d32a1d725

SHA1
81286fb8cdd8a12b1fc19dbb738542127afca40a

SHA256
979e4e1f48c5bf8a2adfc58ebaefd8cb9eeb764ac285c0c5f39fe94c2418dd2c

SHA512
eda6933be0b086adaa39fd3af825b149741a09b387bd08387487e733ccea76e7b68cb17aa7562b4cacdc6aec2108c842bc6b00978575e16b05fb173f11e454a2

Download Submit
C:\Windows\system\RdzBOWq.exe

Filesize
2.8MB

MD5
39b1910c4849a550c36776867262723e

SHA1
7b0f42b893ef491d30a5c1e92f7ed8c5f399ac20

SHA256
d1fa3b6281d5baf78f30a33ebe953d4378f4947684955c3fad0413e8e3d20cac

SHA512
4cb13a38297856335ae8f75037572c1665f73bc112207b4d294f56a831f063896e6d49992ca6945daa7ab5efb821fe48e383d17ceebe37eb53861208d3e3e3da

Download Submit
C:\Windows\system\ZoPHyrt.exe

Filesize
2.8MB

MD5
5437cddbf1e0028a6da74f2be0ff8ff5

SHA1
c8175b7b17594a9a1cb63479bf23979389495790

SHA256
d975d4d2c57107e6fb196de74694fc499fb8d388c3102ee81271cd6d86bdf61d

SHA512
8a54dec42e12446158273c089a65c5905c9d002bf8f86863dd0112619967d924d2303cd473e028b5a5b2af1cdec1c166b7a6c25cf59cb011505d4788a781483e

Download Submit
C:\Windows\system\dGFtajP.exe

Filesize
2.8MB

MD5
68fb00cb4a8f7d9b92350dc7454d3920

SHA1
4882deda321c33736c12349cb85c42a744a47d55

SHA256
0236fcf432468d982dfe285b0a86c4e82928f3ea5504e0b59b9b718d709648e3

SHA512
ad9ba4b9c57b3676b98436b4e004da3724103769437dcb60127cfcf25d8a5423940309dbb7fb5645e3dd14c8b0484833452a7da6d9460eed7672dce19945f195

Download Submit
C:\Windows\system\dzfhkhX.exe

Filesize
2.8MB

MD5
c9f5cebf5f914163dd4448e1994d50e1

SHA1
2d9c00d081f9191f2bdeffb7e1de596adb544863

SHA256
54eb0872e969f98e75fd844b3f732d68bcdd64644b47f5605cb1ad5a96d9ac53

SHA512
0fc84694edfe057190cf2d9fdaf5a39958dd8e291f36a153e7a637963212921b4bd523a87b8ef63027b36289eda6ac85e4a23face866a895e4d94e72e4bafa10

Download Submit
C:\Windows\system\ekHiNfO.exe

Filesize
2.8MB

MD5
e4d2ea3b55d392c1d4c4867cf90057f0

SHA1
d070f2c715b6f9cb3dd04db542b44e0a014eff0b

SHA256
aff85b35d53f3cbbe14f73017db63d4edf74a002ef2185d5cdf8193051bbbaa6

SHA512
d791039e8da4dcc972a05d196859e5727a51f03fbcccc2f1e4d4774ae727736ef102d211bda20b0a6a0d6767131fddaa19f83b9f8d712e115aa3074f2743ff9a

Download Submit
C:\Windows\system\famQhMt.exe

Filesize
2.8MB

MD5
17d6cd70fe5b92761dead218a5fa345a

SHA1
d38d0a17eea43658cb44c37e44a90fc65ffe55cc

SHA256
39b0526a1c15aa29106509848d0a3ff98a1e2303a2f8c7b2b04813770629dfd6

SHA512
4d4eb4db37b763416553428f5017ff956610781afec84b4b63bb5bdb0052bbbc6a2d0dd5380c41dd5a8f8e3abf92365bdc043db5c8254091f285414d77eda681

Download Submit
C:\Windows\system\jMgPpLw.exe

Filesize
2.8MB

MD5
5ad41cec8c205c3ddd5fb7f93c893fdf

SHA1
86baa49ae7294ba7bbafd5aa7774e22455e229ba

SHA256
720030349ebf7c5cef08e41cfd080c41499c1b2a0789afe8d74c63049c7a5b13

SHA512
6a31516f6eca7030f8045bbab258a665aeec4cd202ff5cc411a157ebca844aaf890856b0b4e1d15dac860d3cb60826f6988346ffb887b13265d417dfc357b171

Download Submit
C:\Windows\system\krfyIcl.exe

Filesize
2.8MB

MD5
328759f0bccdff5e5ce92452af0033e3

SHA1
ef3656c421d3bf616f0f08161cbd7653ab067ebf

SHA256
a7352dc9783f51987a6cd2bf62c7ec208b94ca21e2354415d432e12efebbee73

SHA512
1590703a1c3dd6027ae2a36ed0068de64584ba5d9b15aab338eeef323b72d3481c38349418510712cf5a66664543e8621b33c98d4a5ae268dfce22f626cb9fc5

Download Submit
C:\Windows\system\nKuIjEv.exe

Filesize
2.8MB

MD5
0f958c644e2d4f5418d59a33f6c1e7c2

SHA1
0b10ab3cc77756cc24a1cdd6ca4e19e8f2d6d030

SHA256
2e694a2138a521c3f5750d64d76049e0a93ed9c5354d3c6d85d2d4bb3bfb33bd

SHA512
e9019e7f28a43b33bbfae7b5cb847d5264d6f9fb6641754a448da0eeb53bfc1dc6949bb36a9db91ad94db5595b69cf2c1eb3bca8d222d61299871796ba910803

Download Submit
C:\Windows\system\oKJBgNE.exe

Filesize
2.8MB

MD5
69f7c248341832525c0e92d778c29370

SHA1
6c8388f404e1115577aec9a92ed4f0029b80e61c

SHA256
be96dad76348a2766169e1b14f1b20fdf7158d5843315048a2dcd9f74656d476

SHA512
e461f8e66d645cab95db396df3c982a422c4ad074a624ef694a3e3edbf8454322444e993126eed630f7d3a0d01bb58a0a23d46ffc111578fe742bb28e2b23817

Download Submit
C:\Windows\system\qBJEyJw.exe

Filesize
2.8MB

MD5
b554d86fee4c1efa2cef6535b15fa0dc

SHA1
4da7f954741bc09429e355618b6e8edafa002c12

SHA256
13d8d5313200c8e3060c0217a487142ab68d8a2e02efaa116a1ebfc42e2f5eca

SHA512
81438b3bbce2f9e5441c8226248f24e5adeffc2da4ff58da481b16dd29a218d7d16e5346f5821289a73e66d38c5efacf2a60b8d6bae062e236f313d4f4604fd4

Download Submit
C:\Windows\system\vdtisyT.exe

Filesize
2.8MB

MD5
c0a9bdc13c2cafddda05f92be5230fcd

SHA1
4f42f15cdbec6b7482a9448c5306f41d2d1f7d5e

SHA256
30b178b961a0d518af72a075907bd05fecc2f6b0e508adf0258a56a9a93caeca

SHA512
9a97f705d0eb752722c44eb25829895f2c6112f3685fc1b225b17e8ceb5811e768950985bdaf82d01fd954084465b38f5acadea40a8a3e3ebc370fe26f4d52f6

Download Submit
C:\Windows\system\vumqFjd.exe

Filesize
2.8MB

MD5
84240120935231ebf09b97e22f9d245f

SHA1
0979f1b47c2682337d596ca44f35469824edc6b8

SHA256
9ac1c2bd85d717c38c7c8da1ddcd4cac8dde94913cbba99fc1e92592b5a40a88

SHA512
45b891faee567c1730ec8d0505e4bb22bc22777c60f155ff00f7f8ed762b86e455bc8b63788463daea05178227731cfd48c425788c24460152c4ff366a3038e6

Download Submit
C:\Windows\system\xjVAJpW.exe

Filesize
2.8MB

MD5
98c50d7f6efa9c0dcd2a91876ace0e2e

SHA1
7719ecf355ff630908abafc1eee7ed046be63ebd

SHA256
b0fc86aa9db1378ad4c5327bbbcc5c94a5866dec51fb0ada1696991c16aa35dc

SHA512
2fc20f084a8b6c1bbed31b82617c727bcf42f59f5f17fba1c8ce8010a4873ffd9340f697b23b9859de8621630b007512a2b91ff36adede79d5c55b325ff2a437

Download Submit
C:\Windows\system\yOAftiW.exe

Filesize
2.8MB

MD5
2e1cf250a7a90c6debf9f40f93f76653

SHA1
20cab648608676137794ba327b7d913e37a5f0b3

SHA256
b7a436feaffa7989b5d46a0709173a72e05d8ecaa67fb2309af454a938c98f01

SHA512
89dff12c6176a919cbf60ab8a364522b5427922bc2cae4b6bb4b42f6a63a0282ca42e8f1e85cb09c3f34392ebb4355c11b8a71021feec3256264a800863610cc

Download Submit
C:\Windows\system\zyjFmqX.exe

Filesize
2.8MB

MD5
72f0853746f6dff932216587d2e62a35

SHA1
4f1845cbfffb9fe7bd913a41a585e1ebec27a9da

SHA256
bdbf52cf21608b60dd75eec323b15c979b68b3a2e27de08830c47a664a1cdbd6

SHA512
b2623730d395cc1537b35526b9446f5d5b5588bd17bec378209735cb392473ed6c617acb57822a7ce6e81274bb1690261de659b12fabe000a22bf783874b3396

Download Submit
\Windows\system\BAOvjdi.exe

Filesize
2.8MB

MD5
525c4376c30f63d1cb70059afaad6d0b

SHA1
72d030afc9d826c3fb7eb0a4887516761ae8c1a3

SHA256
5c7c9d4622ba8bba0755f682759c6b4cc05edcfb6a6afa5cc4b86dfde13c4300

SHA512
09618f9bf4a6df9b82675aec52f0628fd8453979c081caed7436a537bc0f900b48f77ff02f95eb53478f837f6fdd4ef9de4e3c074d007529cf6cdef89080de75

Download Submit
\Windows\system\JSVFnum.exe

Filesize
2.8MB

MD5
10f8b152a86623ee7adb4ec7fabfed3a

SHA1
206de41c9c0cf2e6d95f792160067ca036868333

SHA256
dd1e0deacb09978e3eb5e989f8dfa8dfc2957957032c7169a265945e79d647db

SHA512
c97d8620856a7bebf8f73a7e1e1458423ab2a57e86099c1180773cff778783461386bbe193b2e0799996819a3ff2021e62f72accc4ef81b45d154b9f18ed4816

Download Submit
\Windows\system\KTmNXuR.exe

Filesize
2.8MB

MD5
eba60ed446f7160f7f2692aaac1e138e

SHA1
ece76590e160f30ce05b3417bc488edb86691b60

SHA256
f7ab83a5870d882870abd6b41fdd32456ad0e10619f66e92f5cc21c027efa8e6

SHA512
20968a7c552a1ac871b6834eb22e74118016b4901d2ec7b5c69932ced13a495a80d0203940ca98c1b49a5b900c929ab87e208b50b9a7d2053d6fcb097a1303a8

Download Submit
\Windows\system\LUqtWnk.exe

Filesize
2.8MB

MD5
7be50e1290230a3b75019e8c77502f82

SHA1
d907251dfd4aba495ca8d7e2c630a28ac7f3acc0

SHA256
81f30ff204e2df2c1b7850334f3ec2858f4ee91b91edd192558189c6ab453576

SHA512
7124de52e7b27f67691ea87fa5d479af084042b69afc5c31baba7628fee0dfc29aad77d0f6c2014c1562b069a6a6f9de0c3e57b8c719c09057a1ad7737bcb4f7

Download Submit
\Windows\system\QuQSpcx.exe

Filesize
2.8MB

MD5
af13e0c1d20fbff5d640e117db9e5621

SHA1
e22ac536e60e33ca8fd3512b90a791bdcb282bcf

SHA256
1deb575973c3d2b3e614e85f7f5027ac6d3afdceb1e453ccf669299a0f6009d6

SHA512
c4dab7d8cf9f94114d1aab6e4d18987c090f3f2274b9e0b05d7f70773fa51da7596575463513d32b75d2b0f6c4c3ff25f442f6b7448e4b152f36e7d5d4d7bb11

Download Submit
\Windows\system\ToGdvjk.exe

Filesize
2.8MB

MD5
f62cbe447742d56cf36eb19c77197cfe

SHA1
53a9c97e5743789296946dd6dfb4b62867ca6caa

SHA256
0bc5f76099b334480fa622d869c16e9985daa860d36eb7e97b98c18b6263a737

SHA512
d9b4254e65fdde797cabe53fc0e816d627f091b7290387e052de75acbf018da5ae3a0069744b7125797be1ecb418f68a4d935bbc3868c6970332510881c1859d

Download Submit
\Windows\system\ZlcyHKQ.exe

Filesize
2.8MB

MD5
d546f0ee11e70679f24bbf2ef04e9b5a

SHA1
66af35c9df5ae68c929b31139859c7f27bb883ca

SHA256
f2784a46ff9d237ade6946707eb2fe12bd838daf8b3783f42ace668f6adf706a

SHA512
261291a64f4252458cfa7070dd66be9a6f79b132af9ed85d177666b82cede55300b2d0fbc71bf50d5cdc769345fb2e2f011a51a7e85665dfda05156d56527c96

Download Submit
\Windows\system\cEgBdyf.exe

Filesize
2.8MB

MD5
a6c60778a559b9448216abd02741db9f

SHA1
92d8c49a2582610596ec48bd0c3ed6c4acaa2a7c

SHA256
a25a1001b26e1cf5958f8664809abee2e9df43c2d0801eb9713afc96656936bd

SHA512
02c87893f8117e4f81fbb2f398f33da5539015ff7aa35ca9776ed7a43459a51352f3f28997ba6de9a8f93dfaa823df5f469154c92b828288af3247ce58980431

Download Submit
\Windows\system\fLtSYPd.exe

Filesize
2.8MB

MD5
073047141728f8e5c898614b9412b14d

SHA1
72dbf88d93948b989fe0f59ce8f2b40ac3bbdd25

SHA256
6ba17b918853640b1b0923d8f8f32fdb260c7450cfc09d2e3948231e46375878

SHA512
f7d37d5600a3048da32fc403997a91869e9274cb478d0b24e676853a98815a7e5cf9178e14eb01c1f531ff38089ea8b511527f4b7395e0a7c22bfaafa3f65aca

Download Submit
\Windows\system\ipCbLdL.exe

Filesize
2.8MB

MD5
c61f96d5432980e625eaea9f99434e33

SHA1
0627a85e6b62de2b8f226350a8ed975a3d99adb4

SHA256
3f27144d7a0b2a335daa5a2fae5e2397489ef4d7376f2a01f57ddd9370950235

SHA512
104c262fe69f4357aa4ddf0a2b3e04c3b9fd404d2a1a3a011f1625f30bb8dcb55565ac7234913728049e1cb66e3b7ad616e4a93e584e16fd6fa2d78281b46c72

Download Submit
\Windows\system\nMhSBXS.exe

Filesize
2.8MB

MD5
9e864f5cf78d2d6ff237c3b20d346a51

SHA1
9e014a28ec64a0e78b9f8058d7278c9aeafaed6d

SHA256
0d3d49b52f4394052a7a80923a6c1be5edb90d8975a86883e07c8d404a38fe61

SHA512
bc0c0d3e1cbb1541cb65bb889d73592b94dfa27a95a06df79bbf39473f9b575753c4c1b49fd01cbe242b16f7f897a73f0e097a46b6f78fc0aadd60da14c52fbb

Download Submit
\Windows\system\pPtIoZH.exe

Filesize
2.8MB

MD5
dc6c80983d7d111c06aa1b5944efbe72

SHA1
1777188a135f7e479e291944af72959c0a3b5baa

SHA256
5310dba3ec0b1f5db9cfc4b6f5f79cadc617e33921d40d6ce099e8f178468320

SHA512
cfac323d3761b0a21ebde0f60e808471489cd74668f4b0e01d6edb9b48682c6f4e537365d0f2ae400b3bfe80e3e4534930901d91c86c5ce2c00c67dfa27d0a5a

Download Submit
\Windows\system\qVMUrlx.exe

Filesize
2.8MB

MD5
306390bc25d6ca3315fcd9d0a9e6b792

SHA1
beea814dded0d1d34c49cde0f7aca2aba140d784

SHA256
299806fdd05d8a60c35cd73b86560403e0739dee3fb9b7c29dc97487f9563060

SHA512
70e8d668e5ccb43bd16bbe8d9d0c20d572413ea94b132b80f366b4a7dcda473f936018457fefe165b54bcd3e33a8d531e9298964ba425f5ebaf7a8e0856c4938

Download Submit
memory/1648-14-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2320-27-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2320-231-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-36-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2320-133-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2320-131-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2320-139-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2320-138-0x0000000002840000-0x00000000028C0000-memory.dmp

Filesize
512KB

Download
memory/2320-137-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-145-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2400-140-0x000000013F970000-0x000000013FD62000-memory.dmp

Filesize
3.9MB

Download
memory/2432-142-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2468-148-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-1-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-153-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2476-150-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/2476-147-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-144-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2476-4-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2476-143-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/2476-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2476-151-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-158-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/2556-146-0x000000013FD00000-0x00000001400F2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-134-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2612-157-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2900-152-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download