xmrig | 625e31adb68a8d23216a407a855dfa37d73ee0bd48209df3efb92bbe9d03eca3

Analysis

max time kernel
150s
max time network
144s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
Size

2.0MB
MD5

0c44116212cc0c5217cf159831f10921
SHA1

502f4186832bffa22a343e90cbd3805df139b38a
SHA256

625e31adb68a8d23216a407a855dfa37d73ee0bd48209df3efb92bbe9d03eca3
SHA512

30d29f4826c1064c49377866bd80ecf4f370373d8cea5fb44bf87624ec8c0abfb5eda0aac22643ba94b9278796242d1cc476256c373598b4db43d099b6cbf86f
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1UU:NABs

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/2552-13-0x000000013F540000-0x000000013F932000-memory.dmp	xmrig
behavioral1/memory/1964-41-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2472-48-0x000000013F250000-0x000000013F642000-memory.dmp	xmrig
behavioral1/memory/2924-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2668-82-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2192-106-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2192-92-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig
behavioral1/memory/2624-45-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2528-38-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2924-1527-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	xmrig
behavioral1/memory/2964-1574-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2780-4791-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	xmrig
behavioral1/memory/2528-5111-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2552	xreZxFE.exe
2528	ipYmuUu.exe
1964	JZTdbjJ.exe
2624	gdXoSln.exe
2472	QULtLvP.exe
2924	srNmxOo.exe
2964	hEbqPhY.exe
2668	XSIPcBq.exe
2780	PbBgSJJ.exe
1892	gxkbHfO.exe
1668	YmQljXN.exe
780	byUduSq.exe
808	gqNLlIg.exe
2664	NFAIEZv.exe
1284	LdhtfwN.exe
2088	mnzAIZp.exe
2944	OoTmJrK.exe
2648	WbKvdBb.exe
2016	gTlLLJd.exe
2748	RaGUhRC.exe
2900	aCJONgb.exe
292	aABEJtw.exe
1456	kHUfXoa.exe
1920	WEURdkQ.exe
2008	XHFXich.exe
2636	TcyLzZd.exe
1496	kMhWtMk.exe
1592	bRXktpm.exe
1212	BKrTpdS.exe
628	Dvjacuk.exe
1332	UTPJzJa.exe
1228	DYoNQyB.exe
1364	kroKVbJ.exe
1724	JDHnxaa.exe
3060	MLrRBFG.exe
2252	zcJTVYE.exe
1880	JEORVYO.exe
696	lfmLHMI.exe
1860	arKKujA.exe
1684	fxfZrwp.exe
1716	VVBQKkb.exe
1304	zrOXihx.exe
2216	ygTXJAn.exe
912	sDDVcWb.exe
2324	DolWXid.exe
2128	luYQIdp.exe
1032	gHsXvxe.exe
3068	EaoeTAK.exe
1444	WzQxRYV.exe
1512	YjwsDhC.exe
2680	jUTBsMY.exe
2820	rvbZeFS.exe
2732	FgDrusB.exe
2420	RBOiETN.exe
2404	YHmJfdu.exe
2796	OHyJiAH.exe
828	KpOccpO.exe
1692	LLNKozD.exe
2268	QgmtkIo.exe
612	SPPHtAy.exe
452	lTehLne.exe
320	GZKtYxX.exe
2188	PCYqdOV.exe
2280	EVdAJSa.exe

Loads dropped DLL 64 IoCs

pid	Process
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe

UPX packed file 53 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-1-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/files/0x000b000000014e5a-3.dat	upx
behavioral1/files/0x0031000000015b13-17.dat	upx
behavioral1/memory/2552-13-0x000000013F540000-0x000000013F932000-memory.dmp	upx
behavioral1/files/0x001400000000549e-24.dat	upx
behavioral1/files/0x0008000000015c86-26.dat	upx
behavioral1/files/0x0007000000015c9c-33.dat	upx
behavioral1/memory/1964-41-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2472-48-0x000000013F250000-0x000000013F642000-memory.dmp	upx
behavioral1/files/0x0008000000015ca5-49.dat	upx
behavioral1/files/0x0008000000015cad-58.dat	upx
behavioral1/files/0x0006000000016277-72.dat	upx
behavioral1/files/0x0006000000016525-70.dat	upx
behavioral1/files/0x0006000000016cab-117.dat	upx
behavioral1/files/0x0006000000016cf5-129.dat	upx
behavioral1/files/0x0006000000016d06-139.dat	upx
behavioral1/files/0x0006000000016d27-150.dat	upx
behavioral1/memory/2924-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/files/0x0006000000016c17-103.dat	upx
behavioral1/files/0x0006000000016ce1-128.dat	upx
behavioral1/files/0x0006000000016f82-196.dat	upx
behavioral1/files/0x0006000000016c7a-190.dat	upx
behavioral1/files/0x0006000000016d4b-186.dat	upx
behavioral1/files/0x0006000000016d40-178.dat	upx
behavioral1/files/0x0031000000015b77-177.dat	upx
behavioral1/files/0x0006000000016c26-173.dat	upx
behavioral1/files/0x0006000000016a45-171.dat	upx
behavioral1/files/0x0006000000016597-169.dat	upx
behavioral1/files/0x0006000000016411-167.dat	upx
behavioral1/files/0x0006000000016d3b-159.dat	upx
behavioral1/files/0x0006000000016d1f-147.dat	upx
behavioral1/files/0x0006000000016d0e-140.dat	upx
behavioral1/files/0x0006000000016cfe-132.dat	upx
behavioral1/files/0x0006000000016ced-125.dat	upx
behavioral1/files/0x0006000000016cc9-118.dat	upx
behavioral1/files/0x00060000000167ef-96.dat	upx
behavioral1/memory/1892-87-0x000000013F450000-0x000000013F842000-memory.dmp	upx
behavioral1/files/0x00070000000160f8-86.dat	upx
behavioral1/memory/2780-85-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2668-82-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2964-69-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x0006000000017060-199.dat	upx
behavioral1/files/0x0006000000016d67-195.dat	upx
behavioral1/files/0x0006000000016d44-183.dat	upx
behavioral1/files/0x0006000000016d17-146.dat	upx
behavioral1/files/0x0006000000016c2e-116.dat	upx
behavioral1/memory/2192-92-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx
behavioral1/memory/2624-45-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2528-38-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2924-1527-0x000000013F4C0000-0x000000013F8B2000-memory.dmp	upx
behavioral1/memory/2964-1574-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/memory/2780-4791-0x000000013F7D0000-0x000000013FBC2000-memory.dmp	upx
behavioral1/memory/2528-5111-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\gGVSmYT.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\IaJkTiD.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\qRTuzCO.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\zKuNaJN.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\bYNTmtJ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\lVNLAJA.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\ngPBGPH.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\mCQMuUJ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\yDdXSzD.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\rcXEDMx.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\apYyWwo.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\NjJmjND.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\nKzlZVL.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\lehczJs.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\NubPEry.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\Jpczozv.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\hPvtIRy.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\OtOYNVZ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\lceVrBw.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\jQmCNPQ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\wvKDVND.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\EHPUsVJ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\dNLFsNB.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\zJFdCnE.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\TtkOXpJ.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\OjsbIxu.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\cHBesIn.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\MjQzbnT.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\cWrQbzm.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\lHTOVSf.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\MHNSjXq.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\MTafSaf.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\yrTqZDp.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\GYWCzSy.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\ZGVaako.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\jjKdYpg.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\DdAZmEq.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\EawTAZK.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\QvtKDdj.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\bERZuOh.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\hwxAxUW.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\CuYzsoK.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\SasoRvI.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\xMuFPDz.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\aLtUHen.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\OpynrOn.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\mcLSvOS.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\UxFnbva.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\yjqHMXT.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\StFLYhq.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\nhpCdzj.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\LvwkeRI.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\VRzIPBH.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\EsnjlkL.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\GSPCxQf.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\vwCiapY.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\tDaxCaR.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\oFFBvFm.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\OevQaYD.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\InIMrCo.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\VvBhYLC.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\MkKqQiO.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\oOLnHmE.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
File created	C:\Windows\System\aVcaner.exe	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 3040	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	29
PID 2192 wrote to memory of 3040	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	29
PID 2192 wrote to memory of 3040	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	29
PID 2192 wrote to memory of 2552	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2552	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2552	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	30
PID 2192 wrote to memory of 2528	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2528	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	31
PID 2192 wrote to memory of 2528	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	31
PID 2192 wrote to memory of 1964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	32
PID 2192 wrote to memory of 1964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	32
PID 2192 wrote to memory of 1964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	32
PID 2192 wrote to memory of 2624	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2624	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2624	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	33
PID 2192 wrote to memory of 2472	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	34
PID 2192 wrote to memory of 2472	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	34
PID 2192 wrote to memory of 2472	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	34
PID 2192 wrote to memory of 2924	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	35
PID 2192 wrote to memory of 2924	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	35
PID 2192 wrote to memory of 2924	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	35
PID 2192 wrote to memory of 2964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	36
PID 2192 wrote to memory of 2964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	36
PID 2192 wrote to memory of 2964	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	36
PID 2192 wrote to memory of 1892	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	37
PID 2192 wrote to memory of 1892	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	37
PID 2192 wrote to memory of 1892	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	37
PID 2192 wrote to memory of 2668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	38
PID 2192 wrote to memory of 2668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	38
PID 2192 wrote to memory of 2668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	38
PID 2192 wrote to memory of 2748	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	39
PID 2192 wrote to memory of 2748	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	39
PID 2192 wrote to memory of 2748	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	39
PID 2192 wrote to memory of 2780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	40
PID 2192 wrote to memory of 2780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	40
PID 2192 wrote to memory of 2780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	40
PID 2192 wrote to memory of 2900	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	41
PID 2192 wrote to memory of 2900	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	41
PID 2192 wrote to memory of 2900	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	41
PID 2192 wrote to memory of 1668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	42
PID 2192 wrote to memory of 1668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	42
PID 2192 wrote to memory of 1668	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	42
PID 2192 wrote to memory of 292	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	43
PID 2192 wrote to memory of 292	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	43
PID 2192 wrote to memory of 292	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	43
PID 2192 wrote to memory of 780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	44
PID 2192 wrote to memory of 780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	44
PID 2192 wrote to memory of 780	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	44
PID 2192 wrote to memory of 1456	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	45
PID 2192 wrote to memory of 1456	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	45
PID 2192 wrote to memory of 1456	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	45
PID 2192 wrote to memory of 808	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	46
PID 2192 wrote to memory of 808	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	46
PID 2192 wrote to memory of 808	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	46
PID 2192 wrote to memory of 2636	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	47
PID 2192 wrote to memory of 2636	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	47
PID 2192 wrote to memory of 2636	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	47
PID 2192 wrote to memory of 2664	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	48
PID 2192 wrote to memory of 2664	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	48
PID 2192 wrote to memory of 2664	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	48
PID 2192 wrote to memory of 1332	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	49
PID 2192 wrote to memory of 1332	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	49
PID 2192 wrote to memory of 1332	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	49
PID 2192 wrote to memory of 1284	2192	0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c44116212cc0c5217cf159831f10921_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\xreZxFE.exe
  C:\Windows\System\xreZxFE.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\ipYmuUu.exe
  C:\Windows\System\ipYmuUu.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\JZTdbjJ.exe
  C:\Windows\System\JZTdbjJ.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\gdXoSln.exe
  C:\Windows\System\gdXoSln.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\QULtLvP.exe
  C:\Windows\System\QULtLvP.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\srNmxOo.exe
  C:\Windows\System\srNmxOo.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\hEbqPhY.exe
  C:\Windows\System\hEbqPhY.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\gxkbHfO.exe
  C:\Windows\System\gxkbHfO.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\XSIPcBq.exe
  C:\Windows\System\XSIPcBq.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\RaGUhRC.exe
  C:\Windows\System\RaGUhRC.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\PbBgSJJ.exe
  C:\Windows\System\PbBgSJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\aCJONgb.exe
  C:\Windows\System\aCJONgb.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\YmQljXN.exe
  C:\Windows\System\YmQljXN.exe
  2⤵
  - Executes dropped EXE
  PID:1668
- C:\Windows\System\aABEJtw.exe
  C:\Windows\System\aABEJtw.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\byUduSq.exe
  C:\Windows\System\byUduSq.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\kHUfXoa.exe
  C:\Windows\System\kHUfXoa.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\gqNLlIg.exe
  C:\Windows\System\gqNLlIg.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\TcyLzZd.exe
  C:\Windows\System\TcyLzZd.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\NFAIEZv.exe
  C:\Windows\System\NFAIEZv.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\UTPJzJa.exe
  C:\Windows\System\UTPJzJa.exe
  2⤵
  - Executes dropped EXE
  PID:1332
- C:\Windows\System\LdhtfwN.exe
  C:\Windows\System\LdhtfwN.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\kroKVbJ.exe
  C:\Windows\System\kroKVbJ.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\mnzAIZp.exe
  C:\Windows\System\mnzAIZp.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MLrRBFG.exe
  C:\Windows\System\MLrRBFG.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\OoTmJrK.exe
  C:\Windows\System\OoTmJrK.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\zcJTVYE.exe
  C:\Windows\System\zcJTVYE.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\WbKvdBb.exe
  C:\Windows\System\WbKvdBb.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\JEORVYO.exe
  C:\Windows\System\JEORVYO.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\gTlLLJd.exe
  C:\Windows\System\gTlLLJd.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\lfmLHMI.exe
  C:\Windows\System\lfmLHMI.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\WEURdkQ.exe
  C:\Windows\System\WEURdkQ.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\fxfZrwp.exe
  C:\Windows\System\fxfZrwp.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\XHFXich.exe
  C:\Windows\System\XHFXich.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VVBQKkb.exe
  C:\Windows\System\VVBQKkb.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\kMhWtMk.exe
  C:\Windows\System\kMhWtMk.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\zrOXihx.exe
  C:\Windows\System\zrOXihx.exe
  2⤵
  - Executes dropped EXE
  PID:1304
- C:\Windows\System\bRXktpm.exe
  C:\Windows\System\bRXktpm.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\ygTXJAn.exe
  C:\Windows\System\ygTXJAn.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\BKrTpdS.exe
  C:\Windows\System\BKrTpdS.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\sDDVcWb.exe
  C:\Windows\System\sDDVcWb.exe
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Windows\System\Dvjacuk.exe
  C:\Windows\System\Dvjacuk.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\DolWXid.exe
  C:\Windows\System\DolWXid.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\DYoNQyB.exe
  C:\Windows\System\DYoNQyB.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\gHsXvxe.exe
  C:\Windows\System\gHsXvxe.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\JDHnxaa.exe
  C:\Windows\System\JDHnxaa.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\EaoeTAK.exe
  C:\Windows\System\EaoeTAK.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\arKKujA.exe
  C:\Windows\System\arKKujA.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\WzQxRYV.exe
  C:\Windows\System\WzQxRYV.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\luYQIdp.exe
  C:\Windows\System\luYQIdp.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\YjwsDhC.exe
  C:\Windows\System\YjwsDhC.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\jUTBsMY.exe
  C:\Windows\System\jUTBsMY.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\rvbZeFS.exe
  C:\Windows\System\rvbZeFS.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\FgDrusB.exe
  C:\Windows\System\FgDrusB.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\RBOiETN.exe
  C:\Windows\System\RBOiETN.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\YHmJfdu.exe
  C:\Windows\System\YHmJfdu.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\OHyJiAH.exe
  C:\Windows\System\OHyJiAH.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\KpOccpO.exe
  C:\Windows\System\KpOccpO.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\LLNKozD.exe
  C:\Windows\System\LLNKozD.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\QgmtkIo.exe
  C:\Windows\System\QgmtkIo.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\EVdAJSa.exe
  C:\Windows\System\EVdAJSa.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\SPPHtAy.exe
  C:\Windows\System\SPPHtAy.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\JbrRFWV.exe
  C:\Windows\System\JbrRFWV.exe
  2⤵
  PID:788
- C:\Windows\System\lTehLne.exe
  C:\Windows\System\lTehLne.exe
  2⤵
  - Executes dropped EXE
  PID:452
- C:\Windows\System\pGhNvHX.exe
  C:\Windows\System\pGhNvHX.exe
  2⤵
  PID:1624
- C:\Windows\System\GZKtYxX.exe
  C:\Windows\System\GZKtYxX.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\UzEZjcS.exe
  C:\Windows\System\UzEZjcS.exe
  2⤵
  PID:2148
- C:\Windows\System\PCYqdOV.exe
  C:\Windows\System\PCYqdOV.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\yjaGIEl.exe
  C:\Windows\System\yjaGIEl.exe
  2⤵
  PID:904
- C:\Windows\System\mYkITtR.exe
  C:\Windows\System\mYkITtR.exe
  2⤵
  PID:1836
- C:\Windows\System\tZWDasg.exe
  C:\Windows\System\tZWDasg.exe
  2⤵
  PID:1852
- C:\Windows\System\zDozjTZ.exe
  C:\Windows\System\zDozjTZ.exe
  2⤵
  PID:856
- C:\Windows\System\jZdGEEB.exe
  C:\Windows\System\jZdGEEB.exe
  2⤵
  PID:1548
- C:\Windows\System\lgEnGmp.exe
  C:\Windows\System\lgEnGmp.exe
  2⤵
  PID:2392
- C:\Windows\System\mxfjUkr.exe
  C:\Windows\System\mxfjUkr.exe
  2⤵
  PID:1432
- C:\Windows\System\XhUXzXy.exe
  C:\Windows\System\XhUXzXy.exe
  2⤵
  PID:1416
- C:\Windows\System\mXqbgPj.exe
  C:\Windows\System\mXqbgPj.exe
  2⤵
  PID:2828
- C:\Windows\System\SuzbpKs.exe
  C:\Windows\System\SuzbpKs.exe
  2⤵
  PID:1800
- C:\Windows\System\TVZhGzz.exe
  C:\Windows\System\TVZhGzz.exe
  2⤵
  PID:2156
- C:\Windows\System\EzjAsDx.exe
  C:\Windows\System\EzjAsDx.exe
  2⤵
  PID:800
- C:\Windows\System\eNkDlSk.exe
  C:\Windows\System\eNkDlSk.exe
  2⤵
  PID:1676
- C:\Windows\System\OgrsiDC.exe
  C:\Windows\System\OgrsiDC.exe
  2⤵
  PID:1540
- C:\Windows\System\zJFdCnE.exe
  C:\Windows\System\zJFdCnE.exe
  2⤵
  PID:1960
- C:\Windows\System\DCiRugs.exe
  C:\Windows\System\DCiRugs.exe
  2⤵
  PID:2612
- C:\Windows\System\BMiJMFZ.exe
  C:\Windows\System\BMiJMFZ.exe
  2⤵
  PID:2620
- C:\Windows\System\VPYjbmx.exe
  C:\Windows\System\VPYjbmx.exe
  2⤵
  PID:2760
- C:\Windows\System\pNDkJoI.exe
  C:\Windows\System\pNDkJoI.exe
  2⤵
  PID:1516
- C:\Windows\System\ywQyjbe.exe
  C:\Windows\System\ywQyjbe.exe
  2⤵
  PID:2576
- C:\Windows\System\ZJSnIQc.exe
  C:\Windows\System\ZJSnIQc.exe
  2⤵
  PID:324
- C:\Windows\System\OMCoeYO.exe
  C:\Windows\System\OMCoeYO.exe
  2⤵
  PID:2456
- C:\Windows\System\vbtVXmh.exe
  C:\Windows\System\vbtVXmh.exe
  2⤵
  PID:2520
- C:\Windows\System\wkdrpVN.exe
  C:\Windows\System\wkdrpVN.exe
  2⤵
  PID:1704
- C:\Windows\System\UvyYCfu.exe
  C:\Windows\System\UvyYCfu.exe
  2⤵
  PID:1632
- C:\Windows\System\zaWAHhj.exe
  C:\Windows\System\zaWAHhj.exe
  2⤵
  PID:1124
- C:\Windows\System\peRZyKn.exe
  C:\Windows\System\peRZyKn.exe
  2⤵
  PID:2416
- C:\Windows\System\UtFchsu.exe
  C:\Windows\System\UtFchsu.exe
  2⤵
  PID:1944
- C:\Windows\System\OVwbnRm.exe
  C:\Windows\System\OVwbnRm.exe
  2⤵
  PID:1888
- C:\Windows\System\oEgqqwQ.exe
  C:\Windows\System\oEgqqwQ.exe
  2⤵
  PID:552
- C:\Windows\System\svNIRFk.exe
  C:\Windows\System\svNIRFk.exe
  2⤵
  PID:548
- C:\Windows\System\QBSbJdQ.exe
  C:\Windows\System\QBSbJdQ.exe
  2⤵
  PID:2448
- C:\Windows\System\RcUUpsz.exe
  C:\Windows\System\RcUUpsz.exe
  2⤵
  PID:2968
- C:\Windows\System\QQXmVBe.exe
  C:\Windows\System\QQXmVBe.exe
  2⤵
  PID:796
- C:\Windows\System\PRSosuS.exe
  C:\Windows\System\PRSosuS.exe
  2⤵
  PID:2336
- C:\Windows\System\dnhNBZZ.exe
  C:\Windows\System\dnhNBZZ.exe
  2⤵
  PID:2320
- C:\Windows\System\MSLcroj.exe
  C:\Windows\System\MSLcroj.exe
  2⤵
  PID:1016
- C:\Windows\System\IGIEylh.exe
  C:\Windows\System\IGIEylh.exe
  2⤵
  PID:2728
- C:\Windows\System\zNTHbso.exe
  C:\Windows\System\zNTHbso.exe
  2⤵
  PID:2712
- C:\Windows\System\mHBXyLt.exe
  C:\Windows\System\mHBXyLt.exe
  2⤵
  PID:712
- C:\Windows\System\XCZmdaQ.exe
  C:\Windows\System\XCZmdaQ.exe
  2⤵
  PID:2804
- C:\Windows\System\LTNBZap.exe
  C:\Windows\System\LTNBZap.exe
  2⤵
  PID:1600
- C:\Windows\System\PUokCJr.exe
  C:\Windows\System\PUokCJr.exe
  2⤵
  PID:2644
- C:\Windows\System\YkwUhUi.exe
  C:\Windows\System\YkwUhUi.exe
  2⤵
  PID:596
- C:\Windows\System\fPCzfoD.exe
  C:\Windows\System\fPCzfoD.exe
  2⤵
  PID:2300
- C:\Windows\System\AgmBykL.exe
  C:\Windows\System\AgmBykL.exe
  2⤵
  PID:2052
- C:\Windows\System\BArKRYP.exe
  C:\Windows\System\BArKRYP.exe
  2⤵
  PID:2348
- C:\Windows\System\ydJncsB.exe
  C:\Windows\System\ydJncsB.exe
  2⤵
  PID:3084
- C:\Windows\System\YqFwlUt.exe
  C:\Windows\System\YqFwlUt.exe
  2⤵
  PID:3100
- C:\Windows\System\aRoHfpA.exe
  C:\Windows\System\aRoHfpA.exe
  2⤵
  PID:3120
- C:\Windows\System\nrcIJAf.exe
  C:\Windows\System\nrcIJAf.exe
  2⤵
  PID:3136
- C:\Windows\System\KtEJRlB.exe
  C:\Windows\System\KtEJRlB.exe
  2⤵
  PID:3152
- C:\Windows\System\cBxDDEW.exe
  C:\Windows\System\cBxDDEW.exe
  2⤵
  PID:3168
- C:\Windows\System\VKfnoMT.exe
  C:\Windows\System\VKfnoMT.exe
  2⤵
  PID:3184
- C:\Windows\System\acTrOQn.exe
  C:\Windows\System\acTrOQn.exe
  2⤵
  PID:3200
- C:\Windows\System\qPnHZTV.exe
  C:\Windows\System\qPnHZTV.exe
  2⤵
  PID:3220
- C:\Windows\System\ZJqcSLg.exe
  C:\Windows\System\ZJqcSLg.exe
  2⤵
  PID:3236
- C:\Windows\System\naoVURB.exe
  C:\Windows\System\naoVURB.exe
  2⤵
  PID:3252
- C:\Windows\System\fWrEPiu.exe
  C:\Windows\System\fWrEPiu.exe
  2⤵
  PID:3268
- C:\Windows\System\LbOEUcH.exe
  C:\Windows\System\LbOEUcH.exe
  2⤵
  PID:3284
- C:\Windows\System\msFarky.exe
  C:\Windows\System\msFarky.exe
  2⤵
  PID:3300
- C:\Windows\System\XucItUS.exe
  C:\Windows\System\XucItUS.exe
  2⤵
  PID:3316
- C:\Windows\System\cBsNkHA.exe
  C:\Windows\System\cBsNkHA.exe
  2⤵
  PID:3336
- C:\Windows\System\tWdvHMe.exe
  C:\Windows\System\tWdvHMe.exe
  2⤵
  PID:3352
- C:\Windows\System\IoQCgWL.exe
  C:\Windows\System\IoQCgWL.exe
  2⤵
  PID:3368
- C:\Windows\System\OlCRTVk.exe
  C:\Windows\System\OlCRTVk.exe
  2⤵
  PID:3384
- C:\Windows\System\mFQcDef.exe
  C:\Windows\System\mFQcDef.exe
  2⤵
  PID:3400
- C:\Windows\System\WULCfFB.exe
  C:\Windows\System\WULCfFB.exe
  2⤵
  PID:3416
- C:\Windows\System\wUgmNjl.exe
  C:\Windows\System\wUgmNjl.exe
  2⤵
  PID:3432
- C:\Windows\System\kUGOjAc.exe
  C:\Windows\System\kUGOjAc.exe
  2⤵
  PID:3448
- C:\Windows\System\GczWPFZ.exe
  C:\Windows\System\GczWPFZ.exe
  2⤵
  PID:3464
- C:\Windows\System\tOzYcyt.exe
  C:\Windows\System\tOzYcyt.exe
  2⤵
  PID:3480
- C:\Windows\System\ADxviSP.exe
  C:\Windows\System\ADxviSP.exe
  2⤵
  PID:3496
- C:\Windows\System\WqVWPyg.exe
  C:\Windows\System\WqVWPyg.exe
  2⤵
  PID:3512
- C:\Windows\System\EsCkxtp.exe
  C:\Windows\System\EsCkxtp.exe
  2⤵
  PID:3532
- C:\Windows\System\OKUaxhY.exe
  C:\Windows\System\OKUaxhY.exe
  2⤵
  PID:3548
- C:\Windows\System\mjbbABM.exe
  C:\Windows\System\mjbbABM.exe
  2⤵
  PID:3564
- C:\Windows\System\wxsbtZY.exe
  C:\Windows\System\wxsbtZY.exe
  2⤵
  PID:3580
- C:\Windows\System\NKYkmTl.exe
  C:\Windows\System\NKYkmTl.exe
  2⤵
  PID:3596
- C:\Windows\System\gEsIJuj.exe
  C:\Windows\System\gEsIJuj.exe
  2⤵
  PID:3612
- C:\Windows\System\efUVYQI.exe
  C:\Windows\System\efUVYQI.exe
  2⤵
  PID:3628
- C:\Windows\System\WSbSBiD.exe
  C:\Windows\System\WSbSBiD.exe
  2⤵
  PID:3644
- C:\Windows\System\oWANrNa.exe
  C:\Windows\System\oWANrNa.exe
  2⤵
  PID:3660
- C:\Windows\System\vTiEZWO.exe
  C:\Windows\System\vTiEZWO.exe
  2⤵
  PID:3676
- C:\Windows\System\cHBesIn.exe
  C:\Windows\System\cHBesIn.exe
  2⤵
  PID:3692
- C:\Windows\System\XqstaVI.exe
  C:\Windows\System\XqstaVI.exe
  2⤵
  PID:3708
- C:\Windows\System\yuZhxJP.exe
  C:\Windows\System\yuZhxJP.exe
  2⤵
  PID:3724
- C:\Windows\System\hyojeHs.exe
  C:\Windows\System\hyojeHs.exe
  2⤵
  PID:3740
- C:\Windows\System\AUsyOiC.exe
  C:\Windows\System\AUsyOiC.exe
  2⤵
  PID:3756
- C:\Windows\System\tVrSIgn.exe
  C:\Windows\System\tVrSIgn.exe
  2⤵
  PID:3772
- C:\Windows\System\AKeaUkx.exe
  C:\Windows\System\AKeaUkx.exe
  2⤵
  PID:3788
- C:\Windows\System\TZZDQVf.exe
  C:\Windows\System\TZZDQVf.exe
  2⤵
  PID:3804
- C:\Windows\System\jNiCnxM.exe
  C:\Windows\System\jNiCnxM.exe
  2⤵
  PID:3820
- C:\Windows\System\ifVNZPC.exe
  C:\Windows\System\ifVNZPC.exe
  2⤵
  PID:3836
- C:\Windows\System\yRtgpxe.exe
  C:\Windows\System\yRtgpxe.exe
  2⤵
  PID:3852
- C:\Windows\System\OhvhyIG.exe
  C:\Windows\System\OhvhyIG.exe
  2⤵
  PID:3868
- C:\Windows\System\sDEMvCp.exe
  C:\Windows\System\sDEMvCp.exe
  2⤵
  PID:3932
- C:\Windows\System\bWCNJIw.exe
  C:\Windows\System\bWCNJIw.exe
  2⤵
  PID:3948
- C:\Windows\System\xoQHywJ.exe
  C:\Windows\System\xoQHywJ.exe
  2⤵
  PID:3964
- C:\Windows\System\qtRaQNr.exe
  C:\Windows\System\qtRaQNr.exe
  2⤵
  PID:3980
- C:\Windows\System\TtqVLpw.exe
  C:\Windows\System\TtqVLpw.exe
  2⤵
  PID:3996
- C:\Windows\System\RvWRKxW.exe
  C:\Windows\System\RvWRKxW.exe
  2⤵
  PID:4012
- C:\Windows\System\jCddqEl.exe
  C:\Windows\System\jCddqEl.exe
  2⤵
  PID:4028
- C:\Windows\System\sGeSzBr.exe
  C:\Windows\System\sGeSzBr.exe
  2⤵
  PID:4044
- C:\Windows\System\XXhfqzK.exe
  C:\Windows\System\XXhfqzK.exe
  2⤵
  PID:4060
- C:\Windows\System\xrXsGkG.exe
  C:\Windows\System\xrXsGkG.exe
  2⤵
  PID:4076
- C:\Windows\System\PYWhhZv.exe
  C:\Windows\System\PYWhhZv.exe
  2⤵
  PID:4092
- C:\Windows\System\KaIZQBN.exe
  C:\Windows\System\KaIZQBN.exe
  2⤵
  PID:1596
- C:\Windows\System\TPcXiPN.exe
  C:\Windows\System\TPcXiPN.exe
  2⤵
  PID:1056
- C:\Windows\System\nkxAnbc.exe
  C:\Windows\System\nkxAnbc.exe
  2⤵
  PID:3064
- C:\Windows\System\IZlqftY.exe
  C:\Windows\System\IZlqftY.exe
  2⤵
  PID:2136
- C:\Windows\System\NbDWFKB.exe
  C:\Windows\System\NbDWFKB.exe
  2⤵
  PID:2596
- C:\Windows\System\GYybeYE.exe
  C:\Windows\System\GYybeYE.exe
  2⤵
  PID:3128
- C:\Windows\System\OZxFhVV.exe
  C:\Windows\System\OZxFhVV.exe
  2⤵
  PID:3192
- C:\Windows\System\OeMRsdd.exe
  C:\Windows\System\OeMRsdd.exe
  2⤵
  PID:3260
- C:\Windows\System\RRjcnhT.exe
  C:\Windows\System\RRjcnhT.exe
  2⤵
  PID:3324
- C:\Windows\System\EsfHhKq.exe
  C:\Windows\System\EsfHhKq.exe
  2⤵
  PID:3364
- C:\Windows\System\wdpBHjf.exe
  C:\Windows\System\wdpBHjf.exe
  2⤵
  PID:3424
- C:\Windows\System\cRVFxqI.exe
  C:\Windows\System\cRVFxqI.exe
  2⤵
  PID:3488
- C:\Windows\System\aXLHmBL.exe
  C:\Windows\System\aXLHmBL.exe
  2⤵
  PID:3528
- C:\Windows\System\brooxku.exe
  C:\Windows\System\brooxku.exe
  2⤵
  PID:3592
- C:\Windows\System\KVVnHhK.exe
  C:\Windows\System\KVVnHhK.exe
  2⤵
  PID:3656
- C:\Windows\System\tAsrgnG.exe
  C:\Windows\System\tAsrgnG.exe
  2⤵
  PID:3720
- C:\Windows\System\SOEiIgt.exe
  C:\Windows\System\SOEiIgt.exe
  2⤵
  PID:3784
- C:\Windows\System\HaYETmX.exe
  C:\Windows\System\HaYETmX.exe
  2⤵
  PID:3848
- C:\Windows\System\VUnKxRR.exe
  C:\Windows\System\VUnKxRR.exe
  2⤵
  PID:3888
- C:\Windows\System\IDwmKEr.exe
  C:\Windows\System\IDwmKEr.exe
  2⤵
  PID:3908
- C:\Windows\System\VvWamQh.exe
  C:\Windows\System\VvWamQh.exe
  2⤵
  PID:3924
- C:\Windows\System\HKydDBt.exe
  C:\Windows\System\HKydDBt.exe
  2⤵
  PID:3960
- C:\Windows\System\UVavczl.exe
  C:\Windows\System\UVavczl.exe
  2⤵
  PID:4180
- C:\Windows\System\EewjWwq.exe
  C:\Windows\System\EewjWwq.exe
  2⤵
  PID:4200
- C:\Windows\System\dkrlJTN.exe
  C:\Windows\System\dkrlJTN.exe
  2⤵
  PID:4216
- C:\Windows\System\oXYbTxf.exe
  C:\Windows\System\oXYbTxf.exe
  2⤵
  PID:4292
- C:\Windows\System\TDpsrdL.exe
  C:\Windows\System\TDpsrdL.exe
  2⤵
  PID:4328
- C:\Windows\System\BvKCnpE.exe
  C:\Windows\System\BvKCnpE.exe
  2⤵
  PID:4344
- C:\Windows\System\iDllPIe.exe
  C:\Windows\System\iDllPIe.exe
  2⤵
  PID:4360
- C:\Windows\System\BpFailS.exe
  C:\Windows\System\BpFailS.exe
  2⤵
  PID:4376
- C:\Windows\System\seKBKZG.exe
  C:\Windows\System\seKBKZG.exe
  2⤵
  PID:4392
- C:\Windows\System\bQpDSEH.exe
  C:\Windows\System\bQpDSEH.exe
  2⤵
  PID:4408
- C:\Windows\System\AzHjlmm.exe
  C:\Windows\System\AzHjlmm.exe
  2⤵
  PID:4424
- C:\Windows\System\ClfSzCy.exe
  C:\Windows\System\ClfSzCy.exe
  2⤵
  PID:4440
- C:\Windows\System\XEumDFF.exe
  C:\Windows\System\XEumDFF.exe
  2⤵
  PID:4464
- C:\Windows\System\KffwHpk.exe
  C:\Windows\System\KffwHpk.exe
  2⤵
  PID:4480
- C:\Windows\System\kJiwcRP.exe
  C:\Windows\System\kJiwcRP.exe
  2⤵
  PID:4504
- C:\Windows\System\gjrHjof.exe
  C:\Windows\System\gjrHjof.exe
  2⤵
  PID:4524
- C:\Windows\System\FAyqflO.exe
  C:\Windows\System\FAyqflO.exe
  2⤵
  PID:4548
- C:\Windows\System\roWOomU.exe
  C:\Windows\System\roWOomU.exe
  2⤵
  PID:4564
- C:\Windows\System\gbSgCom.exe
  C:\Windows\System\gbSgCom.exe
  2⤵
  PID:4580
- C:\Windows\System\tGDvwPw.exe
  C:\Windows\System\tGDvwPw.exe
  2⤵
  PID:4600
- C:\Windows\System\kiqRQef.exe
  C:\Windows\System\kiqRQef.exe
  2⤵
  PID:4624
- C:\Windows\System\Plxihnf.exe
  C:\Windows\System\Plxihnf.exe
  2⤵
  PID:4640
- C:\Windows\System\VvCxsEu.exe
  C:\Windows\System\VvCxsEu.exe
  2⤵
  PID:4660
- C:\Windows\System\AnHbtZF.exe
  C:\Windows\System\AnHbtZF.exe
  2⤵
  PID:4680
- C:\Windows\System\ZlDNVYs.exe
  C:\Windows\System\ZlDNVYs.exe
  2⤵
  PID:4696
- C:\Windows\System\tYsjMLD.exe
  C:\Windows\System\tYsjMLD.exe
  2⤵
  PID:4716
- C:\Windows\System\eTixhZE.exe
  C:\Windows\System\eTixhZE.exe
  2⤵
  PID:4732
- C:\Windows\System\DJvuXbU.exe
  C:\Windows\System\DJvuXbU.exe
  2⤵
  PID:4748
- C:\Windows\System\EQXaSUJ.exe
  C:\Windows\System\EQXaSUJ.exe
  2⤵
  PID:4764
- C:\Windows\System\iDoCpru.exe
  C:\Windows\System\iDoCpru.exe
  2⤵
  PID:4788
- C:\Windows\System\TGLsbhG.exe
  C:\Windows\System\TGLsbhG.exe
  2⤵
  PID:4808
- C:\Windows\System\nQunbpn.exe
  C:\Windows\System\nQunbpn.exe
  2⤵
  PID:4828
- C:\Windows\System\JNwyOhw.exe
  C:\Windows\System\JNwyOhw.exe
  2⤵
  PID:4844
- C:\Windows\System\LReKaSI.exe
  C:\Windows\System\LReKaSI.exe
  2⤵
  PID:4860
- C:\Windows\System\rpeHaph.exe
  C:\Windows\System\rpeHaph.exe
  2⤵
  PID:4876
- C:\Windows\System\cVWanvC.exe
  C:\Windows\System\cVWanvC.exe
  2⤵
  PID:4892
- C:\Windows\System\aXbolsK.exe
  C:\Windows\System\aXbolsK.exe
  2⤵
  PID:4912
- C:\Windows\System\FoXojLT.exe
  C:\Windows\System\FoXojLT.exe
  2⤵
  PID:4928
- C:\Windows\System\YBmuOKv.exe
  C:\Windows\System\YBmuOKv.exe
  2⤵
  PID:4948
- C:\Windows\System\neeYVQf.exe
  C:\Windows\System\neeYVQf.exe
  2⤵
  PID:4964
- C:\Windows\System\NrINkzl.exe
  C:\Windows\System\NrINkzl.exe
  2⤵
  PID:4984
- C:\Windows\System\MyqZSmr.exe
  C:\Windows\System\MyqZSmr.exe
  2⤵
  PID:5004
- C:\Windows\System\JCFydLH.exe
  C:\Windows\System\JCFydLH.exe
  2⤵
  PID:5020
- C:\Windows\System\mncvSbK.exe
  C:\Windows\System\mncvSbK.exe
  2⤵
  PID:5036
- C:\Windows\System\qyGaWqq.exe
  C:\Windows\System\qyGaWqq.exe
  2⤵
  PID:5052
- C:\Windows\System\iSgvhAw.exe
  C:\Windows\System\iSgvhAw.exe
  2⤵
  PID:5068
- C:\Windows\System\tocWOTu.exe
  C:\Windows\System\tocWOTu.exe
  2⤵
  PID:5084
- C:\Windows\System\hwABmMy.exe
  C:\Windows\System\hwABmMy.exe
  2⤵
  PID:5100
- C:\Windows\System\xyOLjiT.exe
  C:\Windows\System\xyOLjiT.exe
  2⤵
  PID:5116
- C:\Windows\System\SnVgGDX.exe
  C:\Windows\System\SnVgGDX.exe
  2⤵
  PID:3992
- C:\Windows\System\Evsubpk.exe
  C:\Windows\System\Evsubpk.exe
  2⤵
  PID:864
- C:\Windows\System\PuCQoJk.exe
  C:\Windows\System\PuCQoJk.exe
  2⤵
  PID:4088
- C:\Windows\System\MpIztPA.exe
  C:\Windows\System\MpIztPA.exe
  2⤵
  PID:108
- C:\Windows\System\RjGQMHz.exe
  C:\Windows\System\RjGQMHz.exe
  2⤵
  PID:3228
- C:\Windows\System\xGvrrsv.exe
  C:\Windows\System\xGvrrsv.exe
  2⤵
  PID:3456
- C:\Windows\System\dwhKDeb.exe
  C:\Windows\System\dwhKDeb.exe
  2⤵
  PID:3684
- C:\Windows\System\TpZfPuw.exe
  C:\Windows\System\TpZfPuw.exe
  2⤵
  PID:3844
- C:\Windows\System\EjIFYrS.exe
  C:\Windows\System\EjIFYrS.exe
  2⤵
  PID:1552
- C:\Windows\System\mDETDFB.exe
  C:\Windows\System\mDETDFB.exe
  2⤵
  PID:4192
- C:\Windows\System\uAPOgTW.exe
  C:\Windows\System\uAPOgTW.exe
  2⤵
  PID:2696
- C:\Windows\System\gIEbotH.exe
  C:\Windows\System\gIEbotH.exe
  2⤵
  PID:1424
- C:\Windows\System\BFLAFzo.exe
  C:\Windows\System\BFLAFzo.exe
  2⤵
  PID:412
- C:\Windows\System\XzWVGGx.exe
  C:\Windows\System\XzWVGGx.exe
  2⤵
  PID:4244
- C:\Windows\System\HOucErq.exe
  C:\Windows\System\HOucErq.exe
  2⤵
  PID:4260
- C:\Windows\System\ySvedTc.exe
  C:\Windows\System\ySvedTc.exe
  2⤵
  PID:4272
- C:\Windows\System\nueKUeA.exe
  C:\Windows\System\nueKUeA.exe
  2⤵
  PID:3012
- C:\Windows\System\gFafSpJ.exe
  C:\Windows\System\gFafSpJ.exe
  2⤵
  PID:4340
- C:\Windows\System\fffOuMa.exe
  C:\Windows\System\fffOuMa.exe
  2⤵
  PID:4400
- C:\Windows\System\TLuBZah.exe
  C:\Windows\System\TLuBZah.exe
  2⤵
  PID:4436
- C:\Windows\System\ebyQgiO.exe
  C:\Windows\System\ebyQgiO.exe
  2⤵
  PID:4476
- C:\Windows\System\CZXkhkB.exe
  C:\Windows\System\CZXkhkB.exe
  2⤵
  PID:4556
- C:\Windows\System\cJDdMBN.exe
  C:\Windows\System\cJDdMBN.exe
  2⤵
  PID:4592
- C:\Windows\System\SHAmKCy.exe
  C:\Windows\System\SHAmKCy.exe
  2⤵
  PID:576
- C:\Windows\System\ejhpzeZ.exe
  C:\Windows\System\ejhpzeZ.exe
  2⤵
  PID:2288
- C:\Windows\System\HrvDfYk.exe
  C:\Windows\System\HrvDfYk.exe
  2⤵
  PID:3248
- C:\Windows\System\rvRVPxl.exe
  C:\Windows\System\rvRVPxl.exe
  2⤵
  PID:2488
- C:\Windows\System\rNpMzwe.exe
  C:\Windows\System\rNpMzwe.exe
  2⤵
  PID:3280
- C:\Windows\System\hAdOMSs.exe
  C:\Windows\System\hAdOMSs.exe
  2⤵
  PID:4772
- C:\Windows\System\mHLRDTV.exe
  C:\Windows\System\mHLRDTV.exe
  2⤵
  PID:4780
- C:\Windows\System\zGwwwsB.exe
  C:\Windows\System\zGwwwsB.exe
  2⤵
  PID:4820
- C:\Windows\System\jnkottH.exe
  C:\Windows\System\jnkottH.exe
  2⤵
  PID:4856
- C:\Windows\System\jQqtnHN.exe
  C:\Windows\System\jQqtnHN.exe
  2⤵
  PID:2272
- C:\Windows\System\WWsklux.exe
  C:\Windows\System\WWsklux.exe
  2⤵
  PID:4924
- C:\Windows\System\SklYZAr.exe
  C:\Windows\System\SklYZAr.exe
  2⤵
  PID:4996
- C:\Windows\System\usvQNcF.exe
  C:\Windows\System\usvQNcF.exe
  2⤵
  PID:5064
- C:\Windows\System\DFUoIzF.exe
  C:\Windows\System\DFUoIzF.exe
  2⤵
  PID:312
- C:\Windows\System\nNMICmw.exe
  C:\Windows\System\nNMICmw.exe
  2⤵
  PID:3560
- C:\Windows\System\IhFjKFk.exe
  C:\Windows\System\IhFjKFk.exe
  2⤵
  PID:2036
- C:\Windows\System\QIXZvzb.exe
  C:\Windows\System\QIXZvzb.exe
  2⤵
  PID:2296
- C:\Windows\System\CxkiPVt.exe
  C:\Windows\System\CxkiPVt.exe
  2⤵
  PID:3472
- C:\Windows\System\mbEOxGx.exe
  C:\Windows\System\mbEOxGx.exe
  2⤵
  PID:3572
- C:\Windows\System\JRAAMzC.exe
  C:\Windows\System\JRAAMzC.exe
  2⤵
  PID:5136
- C:\Windows\System\PwrvKUK.exe
  C:\Windows\System\PwrvKUK.exe
  2⤵
  PID:5156
- C:\Windows\System\tZLVHzg.exe
  C:\Windows\System\tZLVHzg.exe
  2⤵
  PID:5172
- C:\Windows\System\vTHxRwD.exe
  C:\Windows\System\vTHxRwD.exe
  2⤵
  PID:5188
- C:\Windows\System\fktlacY.exe
  C:\Windows\System\fktlacY.exe
  2⤵
  PID:5204
- C:\Windows\System\GArPYEB.exe
  C:\Windows\System\GArPYEB.exe
  2⤵
  PID:5220
- C:\Windows\System\KIrtCRC.exe
  C:\Windows\System\KIrtCRC.exe
  2⤵
  PID:5236
- C:\Windows\System\RIVeCui.exe
  C:\Windows\System\RIVeCui.exe
  2⤵
  PID:5252
- C:\Windows\System\oAkRMXy.exe
  C:\Windows\System\oAkRMXy.exe
  2⤵
  PID:5268
- C:\Windows\System\tQpPvwa.exe
  C:\Windows\System\tQpPvwa.exe
  2⤵
  PID:5284
- C:\Windows\System\pJUUAjb.exe
  C:\Windows\System\pJUUAjb.exe
  2⤵
  PID:5300
- C:\Windows\System\jZCvRhQ.exe
  C:\Windows\System\jZCvRhQ.exe
  2⤵
  PID:5316
- C:\Windows\System\InIMrCo.exe
  C:\Windows\System\InIMrCo.exe
  2⤵
  PID:5332
- C:\Windows\System\XIhOySF.exe
  C:\Windows\System\XIhOySF.exe
  2⤵
  PID:5348
- C:\Windows\System\ZKjRlCG.exe
  C:\Windows\System\ZKjRlCG.exe
  2⤵
  PID:5364
- C:\Windows\System\QxIpQRM.exe
  C:\Windows\System\QxIpQRM.exe
  2⤵
  PID:5380
- C:\Windows\System\XvpNjdk.exe
  C:\Windows\System\XvpNjdk.exe
  2⤵
  PID:5400
- C:\Windows\System\aKgUkNS.exe
  C:\Windows\System\aKgUkNS.exe
  2⤵
  PID:5416
- C:\Windows\System\PHBxpGZ.exe
  C:\Windows\System\PHBxpGZ.exe
  2⤵
  PID:5432
- C:\Windows\System\dCNoABd.exe
  C:\Windows\System\dCNoABd.exe
  2⤵
  PID:5448
- C:\Windows\System\AujKBIM.exe
  C:\Windows\System\AujKBIM.exe
  2⤵
  PID:5468
- C:\Windows\System\WzebOen.exe
  C:\Windows\System\WzebOen.exe
  2⤵
  PID:5508
- C:\Windows\System\ivAHvcM.exe
  C:\Windows\System\ivAHvcM.exe
  2⤵
  PID:5524
- C:\Windows\System\NDCHmuy.exe
  C:\Windows\System\NDCHmuy.exe
  2⤵
  PID:5540
- C:\Windows\System\hhnGTzM.exe
  C:\Windows\System\hhnGTzM.exe
  2⤵
  PID:5556
- C:\Windows\System\wRiYhyr.exe
  C:\Windows\System\wRiYhyr.exe
  2⤵
  PID:5572
- C:\Windows\System\YEnRxWU.exe
  C:\Windows\System\YEnRxWU.exe
  2⤵
  PID:5596
- C:\Windows\System\jeLgiqd.exe
  C:\Windows\System\jeLgiqd.exe
  2⤵
  PID:5612
- C:\Windows\System\IancEjs.exe
  C:\Windows\System\IancEjs.exe
  2⤵
  PID:5628
- C:\Windows\System\cgpUDyb.exe
  C:\Windows\System\cgpUDyb.exe
  2⤵
  PID:5644
- C:\Windows\System\DxwmqYx.exe
  C:\Windows\System\DxwmqYx.exe
  2⤵
  PID:5660
- C:\Windows\System\vOhkkVW.exe
  C:\Windows\System\vOhkkVW.exe
  2⤵
  PID:5676
- C:\Windows\System\gPFSJCD.exe
  C:\Windows\System\gPFSJCD.exe
  2⤵
  PID:5692
- C:\Windows\System\rHfbtNE.exe
  C:\Windows\System\rHfbtNE.exe
  2⤵
  PID:5708
- C:\Windows\System\uDeLRka.exe
  C:\Windows\System\uDeLRka.exe
  2⤵
  PID:5724
- C:\Windows\System\MceuGCz.exe
  C:\Windows\System\MceuGCz.exe
  2⤵
  PID:5740
- C:\Windows\System\rxsShif.exe
  C:\Windows\System\rxsShif.exe
  2⤵
  PID:5756
- C:\Windows\System\BbHWrlE.exe
  C:\Windows\System\BbHWrlE.exe
  2⤵
  PID:5776
- C:\Windows\System\StFLYhq.exe
  C:\Windows\System\StFLYhq.exe
  2⤵
  PID:5792
- C:\Windows\System\xtBINUQ.exe
  C:\Windows\System\xtBINUQ.exe
  2⤵
  PID:5808
- C:\Windows\System\kWuNVxP.exe
  C:\Windows\System\kWuNVxP.exe
  2⤵
  PID:5824
- C:\Windows\System\gGVSmYT.exe
  C:\Windows\System\gGVSmYT.exe
  2⤵
  PID:5840
- C:\Windows\System\CelbGeF.exe
  C:\Windows\System\CelbGeF.exe
  2⤵
  PID:6068
- C:\Windows\System\weFDVul.exe
  C:\Windows\System\weFDVul.exe
  2⤵
  PID:2532
- C:\Windows\System\LzWGKIo.exe
  C:\Windows\System\LzWGKIo.exe
  2⤵
  PID:2752
- C:\Windows\System\qjAIfJf.exe
  C:\Windows\System\qjAIfJf.exe
  2⤵
  PID:4960
- C:\Windows\System\pscdulq.exe
  C:\Windows\System\pscdulq.exe
  2⤵
  PID:3880
- C:\Windows\System\HsIucFV.exe
  C:\Windows\System\HsIucFV.exe
  2⤵
  PID:5128
- C:\Windows\System\oGUdUjG.exe
  C:\Windows\System\oGUdUjG.exe
  2⤵
  PID:5196
- C:\Windows\System\sEaRqrC.exe
  C:\Windows\System\sEaRqrC.exe
  2⤵
  PID:5260
- C:\Windows\System\YKeoZUW.exe
  C:\Windows\System\YKeoZUW.exe
  2⤵
  PID:5324
- C:\Windows\System\vBYXUiZ.exe
  C:\Windows\System\vBYXUiZ.exe
  2⤵
  PID:5388
- C:\Windows\System\rHaRIXn.exe
  C:\Windows\System\rHaRIXn.exe
  2⤵
  PID:5428
- C:\Windows\System\nCqytIW.exe
  C:\Windows\System\nCqytIW.exe
  2⤵
  PID:3668
- C:\Windows\System\bfkDBRO.exe
  C:\Windows\System\bfkDBRO.exe
  2⤵
  PID:3704
- C:\Windows\System\wHXbjBh.exe
  C:\Windows\System\wHXbjBh.exe
  2⤵
  PID:3768
- C:\Windows\System\RnTvWfr.exe
  C:\Windows\System\RnTvWfr.exe
  2⤵
  PID:3832
- C:\Windows\System\lcpyJdz.exe
  C:\Windows\System\lcpyJdz.exe
  2⤵
  PID:5516
- C:\Windows\System\WAfThNI.exe
  C:\Windows\System\WAfThNI.exe
  2⤵
  PID:5580
- C:\Windows\System\wSdkEfF.exe
  C:\Windows\System\wSdkEfF.exe
  2⤵
  PID:5624
- C:\Windows\System\GEbqaJq.exe
  C:\Windows\System\GEbqaJq.exe
  2⤵
  PID:5716
- C:\Windows\System\CEvmmnI.exe
  C:\Windows\System\CEvmmnI.exe
  2⤵
  PID:5752
- C:\Windows\System\jjJpxsS.exe
  C:\Windows\System\jjJpxsS.exe
  2⤵
  PID:5820
- C:\Windows\System\DRoCAbZ.exe
  C:\Windows\System\DRoCAbZ.exe
  2⤵
  PID:5876
- C:\Windows\System\KGsuaxR.exe
  C:\Windows\System\KGsuaxR.exe
  2⤵
  PID:5872
- C:\Windows\System\LCsDZco.exe
  C:\Windows\System\LCsDZco.exe
  2⤵
  PID:3540
- C:\Windows\System\LfiQcNH.exe
  C:\Windows\System\LfiQcNH.exe
  2⤵
  PID:2500
- C:\Windows\System\KgHmbdG.exe
  C:\Windows\System\KgHmbdG.exe
  2⤵
  PID:5892
- C:\Windows\System\wpZeAjF.exe
  C:\Windows\System\wpZeAjF.exe
  2⤵
  PID:5908
- C:\Windows\System\xCBaPpQ.exe
  C:\Windows\System\xCBaPpQ.exe
  2⤵
  PID:5924
- C:\Windows\System\JpNaTjQ.exe
  C:\Windows\System\JpNaTjQ.exe
  2⤵
  PID:4004
- C:\Windows\System\wUapQmb.exe
  C:\Windows\System\wUapQmb.exe
  2⤵
  PID:3292
- C:\Windows\System\zAzNSug.exe
  C:\Windows\System\zAzNSug.exe
  2⤵
  PID:3520
- C:\Windows\System\McQNrHW.exe
  C:\Windows\System\McQNrHW.exe
  2⤵
  PID:4144
- C:\Windows\System\ZzMNxOt.exe
  C:\Windows\System\ZzMNxOt.exe
  2⤵
  PID:4208
- C:\Windows\System\NtZNlXL.exe
  C:\Windows\System\NtZNlXL.exe
  2⤵
  PID:4316
- C:\Windows\System\VuAzYoJ.exe
  C:\Windows\System\VuAzYoJ.exe
  2⤵
  PID:4384
- C:\Windows\System\NtGhVSH.exe
  C:\Windows\System\NtGhVSH.exe
  2⤵
  PID:4456
- C:\Windows\System\CAyHzzt.exe
  C:\Windows\System\CAyHzzt.exe
  2⤵
  PID:4496
- C:\Windows\System\EdMEPeR.exe
  C:\Windows\System\EdMEPeR.exe
  2⤵
  PID:4976
- C:\Windows\System\yDNQUis.exe
  C:\Windows\System\yDNQUis.exe
  2⤵
  PID:5108
- C:\Windows\System\nEklUBr.exe
  C:\Windows\System\nEklUBr.exe
  2⤵
  PID:960
- C:\Windows\System\rArEJxI.exe
  C:\Windows\System\rArEJxI.exe
  2⤵
  PID:4196
- C:\Windows\System\DgWWDuR.exe
  C:\Windows\System\DgWWDuR.exe
  2⤵
  PID:4236
- C:\Windows\System\kOsamzq.exe
  C:\Windows\System\kOsamzq.exe
  2⤵
  PID:4336
- C:\Windows\System\uoCEKzI.exe
  C:\Windows\System\uoCEKzI.exe
  2⤵
  PID:4516
- C:\Windows\System\KFwVuyF.exe
  C:\Windows\System\KFwVuyF.exe
  2⤵
  PID:3244
- C:\Windows\System\thOzvym.exe
  C:\Windows\System\thOzvym.exe
  2⤵
  PID:2264
- C:\Windows\System\FnhKfPt.exe
  C:\Windows\System\FnhKfPt.exe
  2⤵
  PID:5144
- C:\Windows\System\VeBggev.exe
  C:\Windows\System\VeBggev.exe
  2⤵
  PID:5184
- C:\Windows\System\aOgaBfC.exe
  C:\Windows\System\aOgaBfC.exe
  2⤵
  PID:5276
- C:\Windows\System\DyeXlNA.exe
  C:\Windows\System\DyeXlNA.exe
  2⤵
  PID:5344
- C:\Windows\System\YPKJjxc.exe
  C:\Windows\System\YPKJjxc.exe
  2⤵
  PID:5412
- C:\Windows\System\HkxtcTF.exe
  C:\Windows\System\HkxtcTF.exe
  2⤵
  PID:5480
- C:\Windows\System\fQnKndI.exe
  C:\Windows\System\fQnKndI.exe
  2⤵
  PID:5504
- C:\Windows\System\AzkbYmC.exe
  C:\Windows\System\AzkbYmC.exe
  2⤵
  PID:5564
- C:\Windows\System\AxvYfbR.exe
  C:\Windows\System\AxvYfbR.exe
  2⤵
  PID:5636
- C:\Windows\System\XQfnWpl.exe
  C:\Windows\System\XQfnWpl.exe
  2⤵
  PID:5736
- C:\Windows\System\dJwUZna.exe
  C:\Windows\System\dJwUZna.exe
  2⤵
  PID:5800
- C:\Windows\System\ItOcKYz.exe
  C:\Windows\System\ItOcKYz.exe
  2⤵
  PID:1796
- C:\Windows\System\MJArcRs.exe
  C:\Windows\System\MJArcRs.exe
  2⤵
  PID:2304
- C:\Windows\System\UbfXyZO.exe
  C:\Windows\System\UbfXyZO.exe
  2⤵
  PID:6028
- C:\Windows\System\dtSEXbA.exe
  C:\Windows\System\dtSEXbA.exe
  2⤵
  PID:6032
- C:\Windows\System\WCHYjqb.exe
  C:\Windows\System\WCHYjqb.exe
  2⤵
  PID:2888
- C:\Windows\System\wWwyRRV.exe
  C:\Windows\System\wWwyRRV.exe
  2⤵
  PID:288
- C:\Windows\System\ZuJaOSs.exe
  C:\Windows\System\ZuJaOSs.exe
  2⤵
  PID:6064
- C:\Windows\System\NiPvnTl.exe
  C:\Windows\System\NiPvnTl.exe
  2⤵
  PID:6080
- C:\Windows\System\FwuEJDW.exe
  C:\Windows\System\FwuEJDW.exe
  2⤵
  PID:2256
- C:\Windows\System\TfvzBIm.exe
  C:\Windows\System\TfvzBIm.exe
  2⤵
  PID:956
- C:\Windows\System\ssFTsXO.exe
  C:\Windows\System\ssFTsXO.exe
  2⤵
  PID:6128
- C:\Windows\System\hgENbkX.exe
  C:\Windows\System\hgENbkX.exe
  2⤵
  PID:3576
- C:\Windows\System\zIoYsTS.exe
  C:\Windows\System\zIoYsTS.exe
  2⤵
  PID:1084
- C:\Windows\System\HIqmxfw.exe
  C:\Windows\System\HIqmxfw.exe
  2⤵
  PID:4284
- C:\Windows\System\VZxawfv.exe
  C:\Windows\System\VZxawfv.exe
  2⤵
  PID:4740
- C:\Windows\System\IDXMLBy.exe
  C:\Windows\System\IDXMLBy.exe
  2⤵
  PID:5264
- C:\Windows\System\aLUmNcS.exe
  C:\Windows\System\aLUmNcS.exe
  2⤵
  PID:3828
- C:\Windows\System\nDOBurJ.exe
  C:\Windows\System\nDOBurJ.exe
  2⤵
  PID:5784
- C:\Windows\System\LtsqxVW.exe
  C:\Windows\System\LtsqxVW.exe
  2⤵
  PID:5788
- C:\Windows\System\oEDRmbP.exe
  C:\Windows\System\oEDRmbP.exe
  2⤵
  PID:3956
- C:\Windows\System\IPIhsvX.exe
  C:\Windows\System\IPIhsvX.exe
  2⤵
  PID:5356
- C:\Windows\System\WWIjQUR.exe
  C:\Windows\System\WWIjQUR.exe
  2⤵
  PID:3640
- C:\Windows\System\xaBQTLM.exe
  C:\Windows\System\xaBQTLM.exe
  2⤵
  PID:3864
- C:\Windows\System\bYNTmtJ.exe
  C:\Windows\System\bYNTmtJ.exe
  2⤵
  PID:5684
- C:\Windows\System\gUmlPyj.exe
  C:\Windows\System\gUmlPyj.exe
  2⤵
  PID:5880
- C:\Windows\System\MeIYxkJ.exe
  C:\Windows\System\MeIYxkJ.exe
  2⤵
  PID:2044
- C:\Windows\System\KgaRBWK.exe
  C:\Windows\System\KgaRBWK.exe
  2⤵
  PID:1640
- C:\Windows\System\SklTxzr.exe
  C:\Windows\System\SklTxzr.exe
  2⤵
  PID:3348
- C:\Windows\System\NNmFpIB.exe
  C:\Windows\System\NNmFpIB.exe
  2⤵
  PID:1868
- C:\Windows\System\aaUClte.exe
  C:\Windows\System\aaUClte.exe
  2⤵
  PID:3972
- C:\Windows\System\TtkOXpJ.exe
  C:\Windows\System\TtkOXpJ.exe
  2⤵
  PID:5916
- C:\Windows\System\HeAmrZY.exe
  C:\Windows\System\HeAmrZY.exe
  2⤵
  PID:5944
- C:\Windows\System\TFKgGEv.exe
  C:\Windows\System\TFKgGEv.exe
  2⤵
  PID:2592
- C:\Windows\System\JJoHoKJ.exe
  C:\Windows\System\JJoHoKJ.exe
  2⤵
  PID:3116
- C:\Windows\System\zZyCOEB.exe
  C:\Windows\System\zZyCOEB.exe
  2⤵
  PID:5952
- C:\Windows\System\ygZiXqe.exe
  C:\Windows\System\ygZiXqe.exe
  2⤵
  PID:5972
- C:\Windows\System\HfUzivH.exe
  C:\Windows\System\HfUzivH.exe
  2⤵
  PID:3216
- C:\Windows\System\gstWYLj.exe
  C:\Windows\System\gstWYLj.exe
  2⤵
  PID:4072
- C:\Windows\System\DWNDirF.exe
  C:\Windows\System\DWNDirF.exe
  2⤵
  PID:2436
- C:\Windows\System\TkFXsCl.exe
  C:\Windows\System\TkFXsCl.exe
  2⤵
  PID:3164
- C:\Windows\System\xBIVxWj.exe
  C:\Windows\System\xBIVxWj.exe
  2⤵
  PID:3624
- C:\Windows\System\MjuZjth.exe
  C:\Windows\System\MjuZjth.exe
  2⤵
  PID:380
- C:\Windows\System\lVOEsgq.exe
  C:\Windows\System\lVOEsgq.exe
  2⤵
  PID:4108
- C:\Windows\System\lIHFcgI.exe
  C:\Windows\System\lIHFcgI.exe
  2⤵
  PID:3780
- C:\Windows\System\EAXmvYC.exe
  C:\Windows\System\EAXmvYC.exe
  2⤵
  PID:1276
- C:\Windows\System\RAxohld.exe
  C:\Windows\System\RAxohld.exe
  2⤵
  PID:4128
- C:\Windows\System\gMJtbgb.exe
  C:\Windows\System\gMJtbgb.exe
  2⤵
  PID:4156
- C:\Windows\System\tOoMxbg.exe
  C:\Windows\System\tOoMxbg.exe
  2⤵
  PID:4176
- C:\Windows\System\Eyaielz.exe
  C:\Windows\System\Eyaielz.exe
  2⤵
  PID:4308
- C:\Windows\System\YgndqoH.exe
  C:\Windows\System\YgndqoH.exe
  2⤵
  PID:4352
- C:\Windows\System\BVdCWfb.exe
  C:\Windows\System\BVdCWfb.exe
  2⤵
  PID:4532
- C:\Windows\System\LoqzkzB.exe
  C:\Windows\System\LoqzkzB.exe
  2⤵
  PID:4536
- C:\Windows\System\XJkHTbj.exe
  C:\Windows\System\XJkHTbj.exe
  2⤵
  PID:1028
- C:\Windows\System\EequPmw.exe
  C:\Windows\System\EequPmw.exe
  2⤵
  PID:4616
- C:\Windows\System\LxVHyCe.exe
  C:\Windows\System\LxVHyCe.exe
  2⤵
  PID:4068
- C:\Windows\System\frwRzvG.exe
  C:\Windows\System\frwRzvG.exe
  2⤵
  PID:4724
- C:\Windows\System\SVVfUDB.exe
  C:\Windows\System\SVVfUDB.exe
  2⤵
  PID:4800
- C:\Windows\System\EmAQtvs.exe
  C:\Windows\System\EmAQtvs.exe
  2⤵
  PID:4868
- C:\Windows\System\IHgMdrA.exe
  C:\Windows\System\IHgMdrA.exe
  2⤵
  PID:4936
- C:\Windows\System\TubGOWv.exe
  C:\Windows\System\TubGOWv.exe
  2⤵
  PID:4872
- C:\Windows\System\WTRGTzK.exe
  C:\Windows\System\WTRGTzK.exe
  2⤵
  PID:4052
- C:\Windows\System\HgtSOPB.exe
  C:\Windows\System\HgtSOPB.exe
  2⤵
  PID:5048
- C:\Windows\System\XXRNcOi.exe
  C:\Windows\System\XXRNcOi.exe
  2⤵
  PID:3900
- C:\Windows\System\OcqdKgY.exe
  C:\Windows\System\OcqdKgY.exe
  2⤵
  PID:4432
- C:\Windows\System\PmRTMVE.exe
  C:\Windows\System\PmRTMVE.exe
  2⤵
  PID:3312
- C:\Windows\System\iwtLJQk.exe
  C:\Windows\System\iwtLJQk.exe
  2⤵
  PID:4276
- C:\Windows\System\BEGGizh.exe
  C:\Windows\System\BEGGizh.exe
  2⤵
  PID:5060
- C:\Windows\System\mrBsVOm.exe
  C:\Windows\System\mrBsVOm.exe
  2⤵
  PID:4084
- C:\Windows\System\DSSEYdR.exe
  C:\Windows\System\DSSEYdR.exe
  2⤵
  PID:3092
- C:\Windows\System\TCaLeXq.exe
  C:\Windows\System\TCaLeXq.exe
  2⤵
  PID:5180
- C:\Windows\System\bhrkEHx.exe
  C:\Windows\System\bhrkEHx.exe
  2⤵
  PID:5340
- C:\Windows\System\WelsqTv.exe
  C:\Windows\System\WelsqTv.exe
  2⤵
  PID:5532
- C:\Windows\System\YSnSGNO.exe
  C:\Windows\System\YSnSGNO.exe
  2⤵
  PID:5672
- C:\Windows\System\XBOCQgA.exe
  C:\Windows\System\XBOCQgA.exe
  2⤵
  PID:5836
- C:\Windows\System\KVpsKiK.exe
  C:\Windows\System\KVpsKiK.exe
  2⤵
  PID:472
- C:\Windows\System\iRtJzzU.exe
  C:\Windows\System\iRtJzzU.exe
  2⤵
  PID:5376
- C:\Windows\System\kaVGWRX.exe
  C:\Windows\System\kaVGWRX.exe
  2⤵
  PID:6040
- C:\Windows\System\YXPZvQd.exe
  C:\Windows\System\YXPZvQd.exe
  2⤵
  PID:5248
- C:\Windows\System\mhptkKu.exe
  C:\Windows\System\mhptkKu.exe
  2⤵
  PID:2672
- C:\Windows\System\IYUhWET.exe
  C:\Windows\System\IYUhWET.exe
  2⤵
  PID:4588
- C:\Windows\System\kNgDGgJ.exe
  C:\Windows\System\kNgDGgJ.exe
  2⤵
  PID:2484
- C:\Windows\System\sgALIQa.exe
  C:\Windows\System\sgALIQa.exe
  2⤵
  PID:4472
- C:\Windows\System\cMZutzk.exe
  C:\Windows\System\cMZutzk.exe
  2⤵
  PID:5168
- C:\Windows\System\ZDguxYP.exe
  C:\Windows\System\ZDguxYP.exe
  2⤵
  PID:2764
- C:\Windows\System\jAGCTmy.exe
  C:\Windows\System\jAGCTmy.exe
  2⤵
  PID:4620
- C:\Windows\System\jdVUjMJ.exe
  C:\Windows\System\jdVUjMJ.exe
  2⤵
  PID:4888
- C:\Windows\System\BfKsYhN.exe
  C:\Windows\System\BfKsYhN.exe
  2⤵
  PID:3736
- C:\Windows\System\vErEUQM.exe
  C:\Windows\System\vErEUQM.exe
  2⤵
  PID:2428
- C:\Windows\System\eiTbzDD.exe
  C:\Windows\System\eiTbzDD.exe
  2⤵
  PID:5932
- C:\Windows\System\SmumyoT.exe
  C:\Windows\System\SmumyoT.exe
  2⤵
  PID:5948
- C:\Windows\System\FDpopny.exe
  C:\Windows\System\FDpopny.exe
  2⤵
  PID:3764
- C:\Windows\System\szKgUyA.exe
  C:\Windows\System\szKgUyA.exe
  2⤵
  PID:1728
- C:\Windows\System\vYpvhBc.exe
  C:\Windows\System\vYpvhBc.exe
  2⤵
  PID:2352
- C:\Windows\System\snPzkMd.exe
  C:\Windows\System\snPzkMd.exe
  2⤵
  PID:3636
- C:\Windows\System\wfUkmZO.exe
  C:\Windows\System\wfUkmZO.exe
  2⤵
  PID:2776
- C:\Windows\System\OImAWHT.exe
  C:\Windows\System\OImAWHT.exe
  2⤵
  PID:5968
- C:\Windows\System\XqREOqx.exe
  C:\Windows\System\XqREOqx.exe
  2⤵
  PID:3080
- C:\Windows\System\zroSfJh.exe
  C:\Windows\System\zroSfJh.exe
  2⤵
  PID:4100
- C:\Windows\System\DVnrtyr.exe
  C:\Windows\System\DVnrtyr.exe
  2⤵
  PID:3652
- C:\Windows\System\ayGiGAH.exe
  C:\Windows\System\ayGiGAH.exe
  2⤵
  PID:4492
- C:\Windows\System\PsYjFss.exe
  C:\Windows\System\PsYjFss.exe
  2⤵
  PID:4652
- C:\Windows\System\sAHNTWY.exe
  C:\Windows\System\sAHNTWY.exe
  2⤵
  PID:4908
- C:\Windows\System\XisDUjU.exe
  C:\Windows\System\XisDUjU.exe
  2⤵
  PID:4124
- C:\Windows\System\rKhfrle.exe
  C:\Windows\System\rKhfrle.exe
  2⤵
  PID:4356
- C:\Windows\System\khDxWnO.exe
  C:\Windows\System\khDxWnO.exe
  2⤵
  PID:4612
- C:\Windows\System\GCSaZbF.exe
  C:\Windows\System\GCSaZbF.exe
  2⤵
  PID:4840
- C:\Windows\System\PmWZkoE.exe
  C:\Windows\System\PmWZkoE.exe
  2⤵
  PID:4904
- C:\Windows\System\oepRIVD.exe
  C:\Windows\System\oepRIVD.exe
  2⤵
  PID:3332
- C:\Windows\System\idafnaP.exe
  C:\Windows\System\idafnaP.exe
  2⤵
  PID:4776
- C:\Windows\System\WJhRfiM.exe
  C:\Windows\System\WJhRfiM.exe
  2⤵
  PID:1648
- C:\Windows\System\jLxEBMa.exe
  C:\Windows\System\jLxEBMa.exe
  2⤵
  PID:4852
- C:\Windows\System\dbtKPbe.exe
  C:\Windows\System\dbtKPbe.exe
  2⤵
  PID:3440
- C:\Windows\System\LIenaqb.exe
  C:\Windows\System\LIenaqb.exe
  2⤵
  PID:5476
- C:\Windows\System\VVrbIEo.exe
  C:\Windows\System\VVrbIEo.exe
  2⤵
  PID:6024
- C:\Windows\System\mqMKTxE.exe
  C:\Windows\System\mqMKTxE.exe
  2⤵
  PID:5488
- C:\Windows\System\BieHJJm.exe
  C:\Windows\System\BieHJJm.exe
  2⤵
  PID:6060
- C:\Windows\System\BPPupUT.exe
  C:\Windows\System\BPPupUT.exe
  2⤵
  PID:600
- C:\Windows\System\SpejUiw.exe
  C:\Windows\System\SpejUiw.exe
  2⤵
  PID:2956
- C:\Windows\System\JfLtmBx.exe
  C:\Windows\System\JfLtmBx.exe
  2⤵
  PID:6076
- C:\Windows\System\eNchxIb.exe
  C:\Windows\System\eNchxIb.exe
  2⤵
  PID:4256
- C:\Windows\System\nlkXwbs.exe
  C:\Windows\System\nlkXwbs.exe
  2⤵
  PID:1492
- C:\Windows\System\paqLVtU.exe
  C:\Windows\System\paqLVtU.exe
  2⤵
  PID:2996
- C:\Windows\System\szTFklg.exe
  C:\Windows\System\szTFklg.exe
  2⤵
  PID:3800
- C:\Windows\System\JqJcAvV.exe
  C:\Windows\System\JqJcAvV.exe
  2⤵
  PID:4608
- C:\Windows\System\QczIwEB.exe
  C:\Windows\System\QczIwEB.exe
  2⤵
  PID:4136
- C:\Windows\System\hfvtZYC.exe
  C:\Windows\System\hfvtZYC.exe
  2⤵
  PID:5852
- C:\Windows\System\lTBHBzj.exe
  C:\Windows\System\lTBHBzj.exe
  2⤵
  PID:2108
- C:\Windows\System\nOjEDXb.exe
  C:\Windows\System\nOjEDXb.exe
  2⤵
  PID:5216
- C:\Windows\System\kEsnCHT.exe
  C:\Windows\System\kEsnCHT.exe
  2⤵
  PID:4372
- C:\Windows\System\AlUmtHA.exe
  C:\Windows\System\AlUmtHA.exe
  2⤵
  PID:4172
- C:\Windows\System\JKlxWwK.exe
  C:\Windows\System\JKlxWwK.exe
  2⤵
  PID:3920
- C:\Windows\System\DfhnppX.exe
  C:\Windows\System\DfhnppX.exe
  2⤵
  PID:5496
- C:\Windows\System\poviDEP.exe
  C:\Windows\System\poviDEP.exe
  2⤵
  PID:6156
- C:\Windows\System\oekifDj.exe
  C:\Windows\System\oekifDj.exe
  2⤵
  PID:6204
- C:\Windows\System\dKjCZpK.exe
  C:\Windows\System\dKjCZpK.exe
  2⤵
  PID:6220
- C:\Windows\System\qiTKJZj.exe
  C:\Windows\System\qiTKJZj.exe
  2⤵
  PID:6236
- C:\Windows\System\TIolbWb.exe
  C:\Windows\System\TIolbWb.exe
  2⤵
  PID:6252
- C:\Windows\System\UqOpRcK.exe
  C:\Windows\System\UqOpRcK.exe
  2⤵
  PID:6272
- C:\Windows\System\lqlZkvE.exe
  C:\Windows\System\lqlZkvE.exe
  2⤵
  PID:6292
- C:\Windows\System\rcMvGmg.exe
  C:\Windows\System\rcMvGmg.exe
  2⤵
  PID:6308
- C:\Windows\System\pCLOHfH.exe
  C:\Windows\System\pCLOHfH.exe
  2⤵
  PID:6324
- C:\Windows\System\VKNdmoa.exe
  C:\Windows\System\VKNdmoa.exe
  2⤵
  PID:6388
- C:\Windows\System\lOXYrOC.exe
  C:\Windows\System\lOXYrOC.exe
  2⤵
  PID:6404
- C:\Windows\System\yOVDGtC.exe
  C:\Windows\System\yOVDGtC.exe
  2⤵
  PID:6420
- C:\Windows\System\RgsgIaJ.exe
  C:\Windows\System\RgsgIaJ.exe
  2⤵
  PID:6436
- C:\Windows\System\RzHJLMD.exe
  C:\Windows\System\RzHJLMD.exe
  2⤵
  PID:6452
- C:\Windows\System\FPCQqgP.exe
  C:\Windows\System\FPCQqgP.exe
  2⤵
  PID:6468
- C:\Windows\System\vwnGrSH.exe
  C:\Windows\System\vwnGrSH.exe
  2⤵
  PID:6484
- C:\Windows\System\wjCStJc.exe
  C:\Windows\System\wjCStJc.exe
  2⤵
  PID:6500
- C:\Windows\System\lsuuPFq.exe
  C:\Windows\System\lsuuPFq.exe
  2⤵
  PID:6520
- C:\Windows\System\RNZYMDq.exe
  C:\Windows\System\RNZYMDq.exe
  2⤵
  PID:6640
- C:\Windows\System\dYBKqIc.exe
  C:\Windows\System\dYBKqIc.exe
  2⤵
  PID:6660
- C:\Windows\System\LMIDYGw.exe
  C:\Windows\System\LMIDYGw.exe
  2⤵
  PID:6676
- C:\Windows\System\JstquUk.exe
  C:\Windows\System\JstquUk.exe
  2⤵
  PID:6692
- C:\Windows\System\DXwVVmb.exe
  C:\Windows\System\DXwVVmb.exe
  2⤵
  PID:6708
- C:\Windows\System\QIcYdtI.exe
  C:\Windows\System\QIcYdtI.exe
  2⤵
  PID:6724
- C:\Windows\System\VYjUTaU.exe
  C:\Windows\System\VYjUTaU.exe
  2⤵
  PID:6740
- C:\Windows\System\lLXljIh.exe
  C:\Windows\System\lLXljIh.exe
  2⤵
  PID:6772
- C:\Windows\System\tXvKFyq.exe
  C:\Windows\System\tXvKFyq.exe
  2⤵
  PID:6792
- C:\Windows\System\EPPbqsj.exe
  C:\Windows\System\EPPbqsj.exe
  2⤵
  PID:6816
- C:\Windows\System\VvMVaBl.exe
  C:\Windows\System\VvMVaBl.exe
  2⤵
  PID:6836
- C:\Windows\System\xHFlIgh.exe
  C:\Windows\System\xHFlIgh.exe
  2⤵
  PID:6856
- C:\Windows\System\OkgJOVv.exe
  C:\Windows\System\OkgJOVv.exe
  2⤵
  PID:6872
- C:\Windows\System\YZpgIXQ.exe
  C:\Windows\System\YZpgIXQ.exe
  2⤵
  PID:6896
- C:\Windows\System\fPGvAFE.exe
  C:\Windows\System\fPGvAFE.exe
  2⤵
  PID:6916
- C:\Windows\System\mgQUubz.exe
  C:\Windows\System\mgQUubz.exe
  2⤵
  PID:6936
- C:\Windows\System\QcYSYrD.exe
  C:\Windows\System\QcYSYrD.exe
  2⤵
  PID:6952
- C:\Windows\System\GMgACGo.exe
  C:\Windows\System\GMgACGo.exe
  2⤵
  PID:6968
- C:\Windows\System\pRxHEft.exe
  C:\Windows\System\pRxHEft.exe
  2⤵
  PID:6984
- C:\Windows\System\OUfaBFQ.exe
  C:\Windows\System\OUfaBFQ.exe
  2⤵
  PID:7004
- C:\Windows\System\sHBzNzi.exe
  C:\Windows\System\sHBzNzi.exe
  2⤵
  PID:7024
- C:\Windows\System\czNFCmR.exe
  C:\Windows\System\czNFCmR.exe
  2⤵
  PID:7044
- C:\Windows\System\LEELpET.exe
  C:\Windows\System\LEELpET.exe
  2⤵
  PID:7060
- C:\Windows\System\BmULuFk.exe
  C:\Windows\System\BmULuFk.exe
  2⤵
  PID:7080
- C:\Windows\System\lPtOhoB.exe
  C:\Windows\System\lPtOhoB.exe
  2⤵
  PID:7100
- C:\Windows\System\UBdEAVO.exe
  C:\Windows\System\UBdEAVO.exe
  2⤵
  PID:7116
- C:\Windows\System\VXqdilU.exe
  C:\Windows\System\VXqdilU.exe
  2⤵
  PID:7132
- C:\Windows\System\LrFdJox.exe
  C:\Windows\System\LrFdJox.exe
  2⤵
  PID:7152
- C:\Windows\System\aDHKEVa.exe
  C:\Windows\System\aDHKEVa.exe
  2⤵
  PID:3108
- C:\Windows\System\UyTSYPJ.exe
  C:\Windows\System\UyTSYPJ.exe
  2⤵
  PID:1464
- C:\Windows\System\fsojTpz.exe
  C:\Windows\System\fsojTpz.exe
  2⤵
  PID:1752
- C:\Windows\System\CwTqKdy.exe
  C:\Windows\System\CwTqKdy.exe
  2⤵
  PID:4452
- C:\Windows\System\oeLattP.exe
  C:\Windows\System\oeLattP.exe
  2⤵
  PID:6248
- C:\Windows\System\AfTyoMe.exe
  C:\Windows\System\AfTyoMe.exe
  2⤵
  PID:6280
- C:\Windows\System\EZSFdpM.exe
  C:\Windows\System\EZSFdpM.exe
  2⤵
  PID:6320
- C:\Windows\System\rpnywbj.exe
  C:\Windows\System\rpnywbj.exe
  2⤵
  PID:5312
- C:\Windows\System\zDZWyNW.exe
  C:\Windows\System\zDZWyNW.exe
  2⤵
  PID:6232
- C:\Windows\System\CogChwP.exe
  C:\Windows\System\CogChwP.exe
  2⤵
  PID:6368
- C:\Windows\System\XQnhstU.exe
  C:\Windows\System\XQnhstU.exe
  2⤵
  PID:2424
- C:\Windows\System\RJEqdcp.exe
  C:\Windows\System\RJEqdcp.exe
  2⤵
  PID:3604
- C:\Windows\System\qfyYxLH.exe
  C:\Windows\System\qfyYxLH.exe
  2⤵
  PID:1220
- C:\Windows\System\CVpENZw.exe
  C:\Windows\System\CVpENZw.exe
  2⤵
  PID:5552
- C:\Windows\System\zNSZYgk.exe
  C:\Windows\System\zNSZYgk.exe
  2⤵
  PID:4008
- C:\Windows\System\TIsYMHc.exe
  C:\Windows\System\TIsYMHc.exe
  2⤵
  PID:5396
- C:\Windows\System\fzIWufx.exe
  C:\Windows\System\fzIWufx.exe
  2⤵
  PID:3816
- C:\Windows\System\sCnRkAP.exe
  C:\Windows\System\sCnRkAP.exe
  2⤵
  PID:4796
- C:\Windows\System\IwRUBvZ.exe
  C:\Windows\System\IwRUBvZ.exe
  2⤵
  PID:4324
- C:\Windows\System\zKJaNFX.exe
  C:\Windows\System\zKJaNFX.exe
  2⤵
  PID:6400
- C:\Windows\System\URMnVzK.exe
  C:\Windows\System\URMnVzK.exe
  2⤵
  PID:6496
- C:\Windows\System\haNxxZp.exe
  C:\Windows\System\haNxxZp.exe
  2⤵
  PID:6432
- C:\Windows\System\bqEVdUd.exe
  C:\Windows\System\bqEVdUd.exe
  2⤵
  PID:6448
- C:\Windows\System\ewgrVUn.exe
  C:\Windows\System\ewgrVUn.exe
  2⤵
  PID:6516
- C:\Windows\System\MjQzbnT.exe
  C:\Windows\System\MjQzbnT.exe
  2⤵
  PID:6548
- C:\Windows\System\lehczJs.exe
  C:\Windows\System\lehczJs.exe
  2⤵
  PID:6592
- C:\Windows\System\YIgKeCv.exe
  C:\Windows\System\YIgKeCv.exe
  2⤵
  PID:6560
- C:\Windows\System\TEOBFei.exe
  C:\Windows\System\TEOBFei.exe
  2⤵
  PID:6532
- C:\Windows\System\IObNZCB.exe
  C:\Windows\System\IObNZCB.exe
  2⤵
  PID:6612
- C:\Windows\System\igBeGke.exe
  C:\Windows\System\igBeGke.exe
  2⤵
  PID:6624
- C:\Windows\System\MWTDrmb.exe
  C:\Windows\System\MWTDrmb.exe
  2⤵
  PID:5772
- C:\Windows\System\LxEGeYj.exe
  C:\Windows\System\LxEGeYj.exe
  2⤵
  PID:6704
- C:\Windows\System\IeHLYkM.exe
  C:\Windows\System\IeHLYkM.exe
  2⤵
  PID:6716
- C:\Windows\System\SfHVIcL.exe
  C:\Windows\System\SfHVIcL.exe
  2⤵
  PID:6652
- C:\Windows\System\hxoBSAV.exe
  C:\Windows\System\hxoBSAV.exe
  2⤵
  PID:6768
- C:\Windows\System\Dzqpzll.exe
  C:\Windows\System\Dzqpzll.exe
  2⤵
  PID:6784
- C:\Windows\System\zKWjSJm.exe
  C:\Windows\System\zKWjSJm.exe
  2⤵
  PID:6824
- C:\Windows\System\usqqpje.exe
  C:\Windows\System\usqqpje.exe
  2⤵
  PID:6828
- C:\Windows\System\OCcDljL.exe
  C:\Windows\System\OCcDljL.exe
  2⤵
  PID:6880
- C:\Windows\System\RUzaEQt.exe
  C:\Windows\System\RUzaEQt.exe
  2⤵
  PID:6928
- C:\Windows\System\HfmHLzq.exe
  C:\Windows\System\HfmHLzq.exe
  2⤵
  PID:6992
- C:\Windows\System\czcfdok.exe
  C:\Windows\System\czcfdok.exe
  2⤵
  PID:6976
- C:\Windows\System\VvBhYLC.exe
  C:\Windows\System\VvBhYLC.exe
  2⤵
  PID:6908
- C:\Windows\System\QIFYIrS.exe
  C:\Windows\System\QIFYIrS.exe
  2⤵
  PID:7016
- C:\Windows\System\AdDmiPO.exe
  C:\Windows\System\AdDmiPO.exe
  2⤵
  PID:7032
- C:\Windows\System\UasvOqB.exe
  C:\Windows\System\UasvOqB.exe
  2⤵
  PID:7068
- C:\Windows\System\GBmrrze.exe
  C:\Windows\System\GBmrrze.exe
  2⤵
  PID:7112
- C:\Windows\System\pxpDsQA.exe
  C:\Windows\System\pxpDsQA.exe
  2⤵
  PID:7160
- C:\Windows\System\ozVcjPU.exe
  C:\Windows\System\ozVcjPU.exe
  2⤵
  PID:2480
- C:\Windows\System\afyaECF.exe
  C:\Windows\System\afyaECF.exe
  2⤵
  PID:3892
- C:\Windows\System\UYlzxSr.exe
  C:\Windows\System\UYlzxSr.exe
  2⤵
  PID:6056
- C:\Windows\System\vAFoeCH.exe
  C:\Windows\System\vAFoeCH.exe
  2⤵
  PID:6288
- C:\Windows\System\SIOBHbd.exe
  C:\Windows\System\SIOBHbd.exe
  2⤵
  PID:3940
- C:\Windows\System\QWglSdM.exe
  C:\Windows\System\QWglSdM.exe
  2⤵
  PID:1520
- C:\Windows\System\ttTJOBD.exe
  C:\Windows\System\ttTJOBD.exe
  2⤵
  PID:4024
- C:\Windows\System\GfFyEYP.exe
  C:\Windows\System\GfFyEYP.exe
  2⤵
  PID:6344
- C:\Windows\System\YEsGaUz.exe
  C:\Windows\System\YEsGaUz.exe
  2⤵
  PID:1196
- C:\Windows\System\cWrQbzm.exe
  C:\Windows\System\cWrQbzm.exe
  2⤵
  PID:1420
- C:\Windows\System\SpnKWrm.exe
  C:\Windows\System\SpnKWrm.exe
  2⤵
  PID:4668
- C:\Windows\System\zGeHOiz.exe
  C:\Windows\System\zGeHOiz.exe
  2⤵
  PID:4288
- C:\Windows\System\EeQToEE.exe
  C:\Windows\System\EeQToEE.exe
  2⤵
  PID:5016
- C:\Windows\System\aPdQrpj.exe
  C:\Windows\System\aPdQrpj.exe
  2⤵
  PID:5028
- C:\Windows\System\mZpobaP.exe
  C:\Windows\System\mZpobaP.exe
  2⤵
  PID:6228
- C:\Windows\System\tMpqtIF.exe
  C:\Windows\System\tMpqtIF.exe
  2⤵
  PID:6372
- C:\Windows\System\Agdjebq.exe
  C:\Windows\System\Agdjebq.exe
  2⤵
  PID:6364
- C:\Windows\System\HRqdqZp.exe
  C:\Windows\System\HRqdqZp.exe
  2⤵
  PID:6396
- C:\Windows\System\rbzYzSi.exe
  C:\Windows\System\rbzYzSi.exe
  2⤵
  PID:6428
- C:\Windows\System\VbDOcZK.exe
  C:\Windows\System\VbDOcZK.exe
  2⤵
  PID:6596
- C:\Windows\System\YocWuOZ.exe
  C:\Windows\System\YocWuOZ.exe
  2⤵
  PID:6684
- C:\Windows\System\UVOwXdv.exe
  C:\Windows\System\UVOwXdv.exe
  2⤵
  PID:6780
- C:\Windows\System\SWcsLGG.exe
  C:\Windows\System\SWcsLGG.exe
  2⤵
  PID:6960
- C:\Windows\System\dzFPqtW.exe
  C:\Windows\System\dzFPqtW.exe
  2⤵
  PID:7088
- C:\Windows\System\dcHcere.exe
  C:\Windows\System\dcHcere.exe
  2⤵
  PID:7108
- C:\Windows\System\hAhOhpJ.exe
  C:\Windows\System\hAhOhpJ.exe
  2⤵
  PID:4252
- C:\Windows\System\rNptCnH.exe
  C:\Windows\System\rNptCnH.exe
  2⤵
  PID:6124
- C:\Windows\System\YcojWJF.exe
  C:\Windows\System\YcojWJF.exe
  2⤵
  PID:6352
- C:\Windows\System\dQtAsAP.exe
  C:\Windows\System\dQtAsAP.exe
  2⤵
  PID:3096
- C:\Windows\System\LkmhMwr.exe
  C:\Windows\System\LkmhMwr.exe
  2⤵
  PID:6356
- C:\Windows\System\GPYjMfy.exe
  C:\Windows\System\GPYjMfy.exe
  2⤵
  PID:6632
- C:\Windows\System\OpqqJaf.exe
  C:\Windows\System\OpqqJaf.exe
  2⤵
  PID:5244
- C:\Windows\System\QsCELbp.exe
  C:\Windows\System\QsCELbp.exe
  2⤵
  PID:6752
- C:\Windows\System\DnenFfQ.exe
  C:\Windows\System\DnenFfQ.exe
  2⤵
  PID:6804
- C:\Windows\System\oOdshqO.exe
  C:\Windows\System\oOdshqO.exe
  2⤵
  PID:6892
- C:\Windows\System\WmaLXRw.exe
  C:\Windows\System\WmaLXRw.exe
  2⤵
  PID:7056
- C:\Windows\System\gnvnnSG.exe
  C:\Windows\System\gnvnnSG.exe
  2⤵
  PID:7128
- C:\Windows\System\iCeJuLg.exe
  C:\Windows\System\iCeJuLg.exe
  2⤵
  PID:5464
- C:\Windows\System\HMDDUJO.exe
  C:\Windows\System\HMDDUJO.exe
  2⤵
  PID:5904
- C:\Windows\System\kJbgfkE.exe
  C:\Windows\System\kJbgfkE.exe
  2⤵
  PID:5768
- C:\Windows\System\dAzfSNd.exe
  C:\Windows\System\dAzfSNd.exe
  2⤵
  PID:4232
- C:\Windows\System\IWLhQVw.exe
  C:\Windows\System\IWLhQVw.exe
  2⤵
  PID:6528
- C:\Windows\System\eoGVgkC.exe
  C:\Windows\System\eoGVgkC.exe
  2⤵
  PID:6552
- C:\Windows\System\pviTFTf.exe
  C:\Windows\System\pviTFTf.exe
  2⤵
  PID:7148
- C:\Windows\System\rMIyNyo.exe
  C:\Windows\System\rMIyNyo.exe
  2⤵
  PID:6176
- C:\Windows\System\ZWpCzhE.exe
  C:\Windows\System\ZWpCzhE.exe
  2⤵
  PID:6852
- C:\Windows\System\GwmKGAX.exe
  C:\Windows\System\GwmKGAX.exe
  2⤵
  PID:6464
- C:\Windows\System\SBuyPNX.exe
  C:\Windows\System\SBuyPNX.exe
  2⤵
  PID:6512
- C:\Windows\System\OqzrfNj.exe
  C:\Windows\System\OqzrfNj.exe
  2⤵
  PID:6648
- C:\Windows\System\SUtDXqS.exe
  C:\Windows\System\SUtDXqS.exe
  2⤵
  PID:6672
- C:\Windows\System\mxzYFbq.exe
  C:\Windows\System\mxzYFbq.exe
  2⤵
  PID:6848
- C:\Windows\System\zSdhXmx.exe
  C:\Windows\System\zSdhXmx.exe
  2⤵
  PID:7092
- C:\Windows\System\NtotKDm.exe
  C:\Windows\System\NtotKDm.exe
  2⤵
  PID:5492
- C:\Windows\System\WEnDVbl.exe
  C:\Windows\System\WEnDVbl.exe
  2⤵
  PID:4304
- C:\Windows\System\kovlnKo.exe
  C:\Windows\System\kovlnKo.exe
  2⤵
  PID:5964
- C:\Windows\System\eKGBqFa.exe
  C:\Windows\System\eKGBqFa.exe
  2⤵
  PID:7020
- C:\Windows\System\NUIOISr.exe
  C:\Windows\System\NUIOISr.exe
  2⤵
  PID:6332
- C:\Windows\System\RIyJMcX.exe
  C:\Windows\System\RIyJMcX.exe
  2⤵
  PID:6508
- C:\Windows\System\xDOQAQd.exe
  C:\Windows\System\xDOQAQd.exe
  2⤵
  PID:6580
- C:\Windows\System\vpEUVTe.exe
  C:\Windows\System\vpEUVTe.exe
  2⤵
  PID:6748
- C:\Windows\System\SWMKSoR.exe
  C:\Windows\System\SWMKSoR.exe
  2⤵
  PID:7040
- C:\Windows\System\bRBJzXw.exe
  C:\Windows\System\bRBJzXw.exe
  2⤵
  PID:6800
- C:\Windows\System\GCEOpfl.exe
  C:\Windows\System\GCEOpfl.exe
  2⤵
  PID:7076
- C:\Windows\System\AJJkzvb.exe
  C:\Windows\System\AJJkzvb.exe
  2⤵
  PID:7188
- C:\Windows\System\UDxEsPU.exe
  C:\Windows\System\UDxEsPU.exe
  2⤵
  PID:7204
- C:\Windows\System\EugbTth.exe
  C:\Windows\System\EugbTth.exe
  2⤵
  PID:7220
- C:\Windows\System\eXCppve.exe
  C:\Windows\System\eXCppve.exe
  2⤵
  PID:7236
- C:\Windows\System\TkaODjB.exe
  C:\Windows\System\TkaODjB.exe
  2⤵
  PID:7252
- C:\Windows\System\kqyzYnD.exe
  C:\Windows\System\kqyzYnD.exe
  2⤵
  PID:7268
- C:\Windows\System\RAucPiO.exe
  C:\Windows\System\RAucPiO.exe
  2⤵
  PID:7284
- C:\Windows\System\wRFVpxO.exe
  C:\Windows\System\wRFVpxO.exe
  2⤵
  PID:7300
- C:\Windows\System\mhuJmay.exe
  C:\Windows\System\mhuJmay.exe
  2⤵
  PID:7316
- C:\Windows\System\DtPKkXt.exe
  C:\Windows\System\DtPKkXt.exe
  2⤵
  PID:7332
- C:\Windows\System\lqiqyZw.exe
  C:\Windows\System\lqiqyZw.exe
  2⤵
  PID:7348
- C:\Windows\System\pIItZVW.exe
  C:\Windows\System\pIItZVW.exe
  2⤵
  PID:7364
- C:\Windows\System\cUpzexq.exe
  C:\Windows\System\cUpzexq.exe
  2⤵
  PID:7380
- C:\Windows\System\MLMHNMT.exe
  C:\Windows\System\MLMHNMT.exe
  2⤵
  PID:7396
- C:\Windows\System\DBIhWvO.exe
  C:\Windows\System\DBIhWvO.exe
  2⤵
  PID:7412
- C:\Windows\System\ZQjdFRj.exe
  C:\Windows\System\ZQjdFRj.exe
  2⤵
  PID:7428
- C:\Windows\System\UriNTpx.exe
  C:\Windows\System\UriNTpx.exe
  2⤵
  PID:7444
- C:\Windows\System\ZOLCdMP.exe
  C:\Windows\System\ZOLCdMP.exe
  2⤵
  PID:7460
- C:\Windows\System\DdDziPE.exe
  C:\Windows\System\DdDziPE.exe
  2⤵
  PID:7476
- C:\Windows\System\jDHgxDl.exe
  C:\Windows\System\jDHgxDl.exe
  2⤵
  PID:7492
- C:\Windows\System\aXazTwf.exe
  C:\Windows\System\aXazTwf.exe
  2⤵
  PID:7508
- C:\Windows\System\YMnCqSf.exe
  C:\Windows\System\YMnCqSf.exe
  2⤵
  PID:7524
- C:\Windows\System\IMBjjpJ.exe
  C:\Windows\System\IMBjjpJ.exe
  2⤵
  PID:7540
- C:\Windows\System\UKlUpcF.exe
  C:\Windows\System\UKlUpcF.exe
  2⤵
  PID:7556
- C:\Windows\System\QuVHnzF.exe
  C:\Windows\System\QuVHnzF.exe
  2⤵
  PID:7572
- C:\Windows\System\xoVACMI.exe
  C:\Windows\System\xoVACMI.exe
  2⤵
  PID:7588
- C:\Windows\System\szjWjjq.exe
  C:\Windows\System\szjWjjq.exe
  2⤵
  PID:7604
- C:\Windows\System\DNsgTgx.exe
  C:\Windows\System\DNsgTgx.exe
  2⤵
  PID:7620
- C:\Windows\System\prAyzlA.exe
  C:\Windows\System\prAyzlA.exe
  2⤵
  PID:7636
- C:\Windows\System\QHpjVhW.exe
  C:\Windows\System\QHpjVhW.exe
  2⤵
  PID:7652
- C:\Windows\System\bDObzaP.exe
  C:\Windows\System\bDObzaP.exe
  2⤵
  PID:7668
- C:\Windows\System\jIunsge.exe
  C:\Windows\System\jIunsge.exe
  2⤵
  PID:7684
- C:\Windows\System\epaKxet.exe
  C:\Windows\System\epaKxet.exe
  2⤵
  PID:7700
- C:\Windows\System\ASomhWT.exe
  C:\Windows\System\ASomhWT.exe
  2⤵
  PID:7716
- C:\Windows\System\aKbHpOY.exe
  C:\Windows\System\aKbHpOY.exe
  2⤵
  PID:7732
- C:\Windows\System\ITjAQNf.exe
  C:\Windows\System\ITjAQNf.exe
  2⤵
  PID:7748
- C:\Windows\System\jaOtiDm.exe
  C:\Windows\System\jaOtiDm.exe
  2⤵
  PID:7764
- C:\Windows\System\QCjzDca.exe
  C:\Windows\System\QCjzDca.exe
  2⤵
  PID:7784
- C:\Windows\System\xquDnLg.exe
  C:\Windows\System\xquDnLg.exe
  2⤵
  PID:7800
- C:\Windows\System\ZzfxbEb.exe
  C:\Windows\System\ZzfxbEb.exe
  2⤵
  PID:7816
- C:\Windows\System\ncgIsoM.exe
  C:\Windows\System\ncgIsoM.exe
  2⤵
  PID:7832
- C:\Windows\System\FNpczZU.exe
  C:\Windows\System\FNpczZU.exe
  2⤵
  PID:7848
- C:\Windows\System\vYzkaUD.exe
  C:\Windows\System\vYzkaUD.exe
  2⤵
  PID:7864
- C:\Windows\System\SCFnVSd.exe
  C:\Windows\System\SCFnVSd.exe
  2⤵
  PID:7880
- C:\Windows\System\tnaiZVp.exe
  C:\Windows\System\tnaiZVp.exe
  2⤵
  PID:7896
- C:\Windows\System\MjneMWe.exe
  C:\Windows\System\MjneMWe.exe
  2⤵
  PID:7912
- C:\Windows\System\TYoAUwA.exe
  C:\Windows\System\TYoAUwA.exe
  2⤵
  PID:7928
- C:\Windows\System\jLxfKJY.exe
  C:\Windows\System\jLxfKJY.exe
  2⤵
  PID:7944
- C:\Windows\System\JqCiuFH.exe
  C:\Windows\System\JqCiuFH.exe
  2⤵
  PID:7960
- C:\Windows\System\CpbsakT.exe
  C:\Windows\System\CpbsakT.exe
  2⤵
  PID:7976
- C:\Windows\System\mjQcgYx.exe
  C:\Windows\System\mjQcgYx.exe
  2⤵
  PID:7992
- C:\Windows\System\kLwJjWj.exe
  C:\Windows\System\kLwJjWj.exe
  2⤵
  PID:8008
- C:\Windows\System\CZtvQuv.exe
  C:\Windows\System\CZtvQuv.exe
  2⤵
  PID:8024
- C:\Windows\System\HJsWyWV.exe
  C:\Windows\System\HJsWyWV.exe
  2⤵
  PID:8040
- C:\Windows\System\VskoxmG.exe
  C:\Windows\System\VskoxmG.exe
  2⤵
  PID:8056
- C:\Windows\System\FPODVrC.exe
  C:\Windows\System\FPODVrC.exe
  2⤵
  PID:8072
- C:\Windows\System\HmmjBZK.exe
  C:\Windows\System\HmmjBZK.exe
  2⤵
  PID:8092
- C:\Windows\System\fQOersV.exe
  C:\Windows\System\fQOersV.exe
  2⤵
  PID:8108
- C:\Windows\System\SgFahrq.exe
  C:\Windows\System\SgFahrq.exe
  2⤵
  PID:8124
- C:\Windows\System\ZanHWKX.exe
  C:\Windows\System\ZanHWKX.exe
  2⤵
  PID:8140
- C:\Windows\System\nDWFiif.exe
  C:\Windows\System\nDWFiif.exe
  2⤵
  PID:8156
- C:\Windows\System\aIMMFRN.exe
  C:\Windows\System\aIMMFRN.exe
  2⤵
  PID:8172
- C:\Windows\System\QERTwmt.exe
  C:\Windows\System\QERTwmt.exe
  2⤵
  PID:8188
- C:\Windows\System\EcOuflS.exe
  C:\Windows\System\EcOuflS.exe
  2⤵
  PID:6888
- C:\Windows\System\hcEAAna.exe
  C:\Windows\System\hcEAAna.exe
  2⤵
  PID:7200
- C:\Windows\System\bSAGyNw.exe
  C:\Windows\System\bSAGyNw.exe
  2⤵
  PID:6760
- C:\Windows\System\fEMTUpg.exe
  C:\Windows\System\fEMTUpg.exe
  2⤵
  PID:6460
- C:\Windows\System\AdYWXoJ.exe
  C:\Windows\System\AdYWXoJ.exe
  2⤵
  PID:7212
- C:\Windows\System\hBGRpGI.exe
  C:\Windows\System\hBGRpGI.exe
  2⤵
  PID:7276
- C:\Windows\System\SOfrIoQ.exe
  C:\Windows\System\SOfrIoQ.exe
  2⤵
  PID:7312
- C:\Windows\System\wbtgsaa.exe
  C:\Windows\System\wbtgsaa.exe
  2⤵
  PID:7356
- C:\Windows\System\NWaaVLm.exe
  C:\Windows\System\NWaaVLm.exe
  2⤵
  PID:7388
- C:\Windows\System\DFzWSEU.exe
  C:\Windows\System\DFzWSEU.exe
  2⤵
  PID:7408
- C:\Windows\System\QTuIejJ.exe
  C:\Windows\System\QTuIejJ.exe
  2⤵
  PID:7452
- C:\Windows\System\qBnPMCJ.exe
  C:\Windows\System\qBnPMCJ.exe
  2⤵
  PID:7436
- C:\Windows\System\puWeDMd.exe
  C:\Windows\System\puWeDMd.exe
  2⤵
  PID:7548
- C:\Windows\System\YZPJmOs.exe
  C:\Windows\System\YZPJmOs.exe
  2⤵
  PID:7612
- C:\Windows\System\dOeDFop.exe
  C:\Windows\System\dOeDFop.exe
  2⤵
  PID:7676
- C:\Windows\System\mjgLSAm.exe
  C:\Windows\System\mjgLSAm.exe
  2⤵
  PID:7472
- C:\Windows\System\PiqKLLp.exe
  C:\Windows\System\PiqKLLp.exe
  2⤵
  PID:7536
- C:\Windows\System\kYlgIyA.exe
  C:\Windows\System\kYlgIyA.exe
  2⤵
  PID:7600
- C:\Windows\System\VYtmEuv.exe
  C:\Windows\System\VYtmEuv.exe
  2⤵
  PID:7664
- C:\Windows\System\bvFXpaO.exe
  C:\Windows\System\bvFXpaO.exe
  2⤵
  PID:7740
- C:\Windows\System\fiFzCAA.exe
  C:\Windows\System\fiFzCAA.exe
  2⤵
  PID:7724
- C:\Windows\System\aWlpfRq.exe
  C:\Windows\System\aWlpfRq.exe
  2⤵
  PID:7792
- C:\Windows\System\RSocxSM.exe
  C:\Windows\System\RSocxSM.exe
  2⤵
  PID:7824
- C:\Windows\System\ZSkfHHJ.exe
  C:\Windows\System\ZSkfHHJ.exe
  2⤵
  PID:7872
- C:\Windows\System\gzuiTwy.exe
  C:\Windows\System\gzuiTwy.exe
  2⤵
  PID:7940
- C:\Windows\System\LfCHeKb.exe
  C:\Windows\System\LfCHeKb.exe
  2⤵
  PID:7856
- C:\Windows\System\EgSMniD.exe
  C:\Windows\System\EgSMniD.exe
  2⤵
  PID:7920
- C:\Windows\System\sbUVfYj.exe
  C:\Windows\System\sbUVfYj.exe
  2⤵
  PID:7984
- C:\Windows\System\kbxGPab.exe
  C:\Windows\System\kbxGPab.exe
  2⤵
  PID:8036
- C:\Windows\System\RvwCVzD.exe
  C:\Windows\System\RvwCVzD.exe
  2⤵
  PID:8104
- C:\Windows\System\YBLppjV.exe
  C:\Windows\System\YBLppjV.exe
  2⤵
  PID:8168
- C:\Windows\System\emeebKt.exe
  C:\Windows\System\emeebKt.exe
  2⤵
  PID:7264
- C:\Windows\System\GanfcbY.exe
  C:\Windows\System\GanfcbY.exe
  2⤵
  PID:8048
- C:\Windows\System\faLuMyY.exe
  C:\Windows\System\faLuMyY.exe
  2⤵
  PID:8088
- C:\Windows\System\OIBqMrT.exe
  C:\Windows\System\OIBqMrT.exe
  2⤵
  PID:7232
- C:\Windows\System\NvaPgZf.exe
  C:\Windows\System\NvaPgZf.exe
  2⤵
  PID:8148
- C:\Windows\System\gFeDuwc.exe
  C:\Windows\System\gFeDuwc.exe
  2⤵
  PID:7228
- C:\Windows\System\vvGguEb.exe
  C:\Windows\System\vvGguEb.exe
  2⤵
  PID:7180
- C:\Windows\System\BXVBTuF.exe
  C:\Windows\System\BXVBTuF.exe
  2⤵
  PID:7584
- C:\Windows\System\QbPdAyT.exe
  C:\Windows\System\QbPdAyT.exe
  2⤵
  PID:7504
- C:\Windows\System\eVeJHtL.exe
  C:\Windows\System\eVeJHtL.exe
  2⤵
  PID:7696
- C:\Windows\System\LZvnslc.exe
  C:\Windows\System\LZvnslc.exe
  2⤵
  PID:7756
- C:\Windows\System\HXwmzLE.exe
  C:\Windows\System\HXwmzLE.exe
  2⤵
  PID:7772
- C:\Windows\System\rYxDQsx.exe
  C:\Windows\System\rYxDQsx.exe
  2⤵
  PID:7904
- C:\Windows\System\SbqUQto.exe
  C:\Windows\System\SbqUQto.exe
  2⤵
  PID:7840
- C:\Windows\System\waKCGRa.exe
  C:\Windows\System\waKCGRa.exe
  2⤵
  PID:7876
- C:\Windows\System\sxMRRes.exe
  C:\Windows\System\sxMRRes.exe
  2⤵
  PID:6568
- C:\Windows\System\MWjKmGF.exe
  C:\Windows\System\MWjKmGF.exe
  2⤵
  PID:7308
- C:\Windows\System\OqTlfjb.exe
  C:\Windows\System\OqTlfjb.exe
  2⤵
  PID:7176
- C:\Windows\System\pmMwxqO.exe
  C:\Windows\System\pmMwxqO.exe
  2⤵
  PID:7292
- C:\Windows\System\phuKtyx.exe
  C:\Windows\System\phuKtyx.exe
  2⤵
  PID:7328
- C:\Windows\System\mdVgxDv.exe
  C:\Windows\System\mdVgxDv.exe
  2⤵
  PID:7644
- C:\Windows\System\PjHuThE.exe
  C:\Windows\System\PjHuThE.exe
  2⤵
  PID:7484
- C:\Windows\System\HhQpuMX.exe
  C:\Windows\System\HhQpuMX.exe
  2⤵
  PID:7780
- C:\Windows\System\WYJWMkM.exe
  C:\Windows\System\WYJWMkM.exe
  2⤵
  PID:7952
- C:\Windows\System\SpkLSXt.exe
  C:\Windows\System\SpkLSXt.exe
  2⤵
  PID:8184
- C:\Windows\System\EBtDcbe.exe
  C:\Windows\System\EBtDcbe.exe
  2⤵
  PID:6444
- C:\Windows\System\UdsMwti.exe
  C:\Windows\System\UdsMwti.exe
  2⤵
  PID:6192
- C:\Windows\System\TEXnift.exe
  C:\Windows\System\TEXnift.exe
  2⤵
  PID:8204
- C:\Windows\System\wFebRXR.exe
  C:\Windows\System\wFebRXR.exe
  2⤵
  PID:8220
- C:\Windows\System\qzvlbnM.exe
  C:\Windows\System\qzvlbnM.exe
  2⤵
  PID:8236
- C:\Windows\System\XkUgcTS.exe
  C:\Windows\System\XkUgcTS.exe
  2⤵
  PID:8252
- C:\Windows\System\yFRWOiP.exe
  C:\Windows\System\yFRWOiP.exe
  2⤵
  PID:8268
- C:\Windows\System\pTFPPjM.exe
  C:\Windows\System\pTFPPjM.exe
  2⤵
  PID:8284
- C:\Windows\System\NKDLqRQ.exe
  C:\Windows\System\NKDLqRQ.exe
  2⤵
  PID:8300
- C:\Windows\System\OoQHsaw.exe
  C:\Windows\System\OoQHsaw.exe
  2⤵
  PID:8316
- C:\Windows\System\RKMIlVf.exe
  C:\Windows\System\RKMIlVf.exe
  2⤵
  PID:8332
- C:\Windows\System\DkheIIw.exe
  C:\Windows\System\DkheIIw.exe
  2⤵
  PID:8348
- C:\Windows\System\XgYHIhP.exe
  C:\Windows\System\XgYHIhP.exe
  2⤵
  PID:8364
- C:\Windows\System\SRegHYN.exe
  C:\Windows\System\SRegHYN.exe
  2⤵
  PID:8380
- C:\Windows\System\WdaLTwx.exe
  C:\Windows\System\WdaLTwx.exe
  2⤵
  PID:8396
- C:\Windows\System\lFjaWXv.exe
  C:\Windows\System\lFjaWXv.exe
  2⤵
  PID:8412
- C:\Windows\System\tqncBjx.exe
  C:\Windows\System\tqncBjx.exe
  2⤵
  PID:8428
- C:\Windows\System\FvTnhrW.exe
  C:\Windows\System\FvTnhrW.exe
  2⤵
  PID:8444
- C:\Windows\System\XsgySPi.exe
  C:\Windows\System\XsgySPi.exe
  2⤵
  PID:8460
- C:\Windows\System\YOxbNEF.exe
  C:\Windows\System\YOxbNEF.exe
  2⤵
  PID:8476
- C:\Windows\System\ZhmfkCP.exe
  C:\Windows\System\ZhmfkCP.exe
  2⤵
  PID:8492
- C:\Windows\System\uykHkqn.exe
  C:\Windows\System\uykHkqn.exe
  2⤵
  PID:8508
- C:\Windows\System\GfploQb.exe
  C:\Windows\System\GfploQb.exe
  2⤵
  PID:8524
- C:\Windows\System\clKeqCk.exe
  C:\Windows\System\clKeqCk.exe
  2⤵
  PID:8544
- C:\Windows\System\gBAEmux.exe
  C:\Windows\System\gBAEmux.exe
  2⤵
  PID:8560
- C:\Windows\System\kDaeYef.exe
  C:\Windows\System\kDaeYef.exe
  2⤵
  PID:8576
- C:\Windows\System\fherYHr.exe
  C:\Windows\System\fherYHr.exe
  2⤵
  PID:8592
- C:\Windows\System\IIFrLUp.exe
  C:\Windows\System\IIFrLUp.exe
  2⤵
  PID:8616
- C:\Windows\System\IroWyOS.exe
  C:\Windows\System\IroWyOS.exe
  2⤵
  PID:8632
- C:\Windows\System\xKIYnsu.exe
  C:\Windows\System\xKIYnsu.exe
  2⤵
  PID:8648
- C:\Windows\System\XuuCmHN.exe
  C:\Windows\System\XuuCmHN.exe
  2⤵
  PID:8668
- C:\Windows\System\qVCZUzX.exe
  C:\Windows\System\qVCZUzX.exe
  2⤵
  PID:8684
- C:\Windows\System\iDTMPHd.exe
  C:\Windows\System\iDTMPHd.exe
  2⤵
  PID:8700
- C:\Windows\System\DzZlnEV.exe
  C:\Windows\System\DzZlnEV.exe
  2⤵
  PID:8720
- C:\Windows\System\FZrKknA.exe
  C:\Windows\System\FZrKknA.exe
  2⤵
  PID:8736
- C:\Windows\System\kmBrzqn.exe
  C:\Windows\System\kmBrzqn.exe
  2⤵
  PID:8752
- C:\Windows\System\RjTfRDM.exe
  C:\Windows\System\RjTfRDM.exe
  2⤵
  PID:8840
- C:\Windows\System\QmIvoTN.exe
  C:\Windows\System\QmIvoTN.exe
  2⤵
  PID:8856
- C:\Windows\System\IMHznUY.exe
  C:\Windows\System\IMHznUY.exe
  2⤵
  PID:8872
- C:\Windows\System\YWeLjYZ.exe
  C:\Windows\System\YWeLjYZ.exe
  2⤵
  PID:8888
- C:\Windows\System\pEYVlYj.exe
  C:\Windows\System\pEYVlYj.exe
  2⤵
  PID:8908
- C:\Windows\System\oqiABxq.exe
  C:\Windows\System\oqiABxq.exe
  2⤵
  PID:8924
- C:\Windows\System\fZrAzWY.exe
  C:\Windows\System\fZrAzWY.exe
  2⤵
  PID:8940
- C:\Windows\System\lqeeRdO.exe
  C:\Windows\System\lqeeRdO.exe
  2⤵
  PID:8960
- C:\Windows\System\OODteok.exe
  C:\Windows\System\OODteok.exe
  2⤵
  PID:8976
- C:\Windows\System\RoqNSaB.exe
  C:\Windows\System\RoqNSaB.exe
  2⤵
  PID:8996
- C:\Windows\System\nXRSxZE.exe
  C:\Windows\System\nXRSxZE.exe
  2⤵
  PID:9012
- C:\Windows\System\JHypXur.exe
  C:\Windows\System\JHypXur.exe
  2⤵
  PID:9028
- C:\Windows\System\dAkpXoo.exe
  C:\Windows\System\dAkpXoo.exe
  2⤵
  PID:9048
- C:\Windows\System\rkfWmqs.exe
  C:\Windows\System\rkfWmqs.exe
  2⤵
  PID:9064
- C:\Windows\System\AUKVxLi.exe
  C:\Windows\System\AUKVxLi.exe
  2⤵
  PID:9084
- C:\Windows\System\jOERzTk.exe
  C:\Windows\System\jOERzTk.exe
  2⤵
  PID:9100
- C:\Windows\System\OFZwioS.exe
  C:\Windows\System\OFZwioS.exe
  2⤵
  PID:9116
- C:\Windows\System\hFNYEsD.exe
  C:\Windows\System\hFNYEsD.exe
  2⤵
  PID:8232
- C:\Windows\System\GWendCx.exe
  C:\Windows\System\GWendCx.exe
  2⤵
  PID:8296
- C:\Windows\System\jAyGdRU.exe
  C:\Windows\System\jAyGdRU.exe
  2⤵
  PID:8360
- C:\Windows\System\ItlkQYH.exe
  C:\Windows\System\ItlkQYH.exe
  2⤵
  PID:7660
- C:\Windows\System\VMbGlDd.exe
  C:\Windows\System\VMbGlDd.exe
  2⤵
  PID:7892
- C:\Windows\System\ClxWqxF.exe
  C:\Windows\System\ClxWqxF.exe
  2⤵
  PID:8016
- C:\Windows\System\EYwcAZq.exe
  C:\Windows\System\EYwcAZq.exe
  2⤵
  PID:8216
- C:\Windows\System\jZzCWhg.exe
  C:\Windows\System\jZzCWhg.exe
  2⤵
  PID:8068
- C:\Windows\System\fsSRlYk.exe
  C:\Windows\System\fsSRlYk.exe
  2⤵
  PID:8456
- C:\Windows\System\CqkxofX.exe
  C:\Windows\System\CqkxofX.exe
  2⤵
  PID:8376
- C:\Windows\System\BRYzvOq.exe
  C:\Windows\System\BRYzvOq.exe
  2⤵
  PID:8100
- C:\Windows\System\yYkskZr.exe
  C:\Windows\System\yYkskZr.exe
  2⤵
  PID:8612
- C:\Windows\System\ThMQxWq.exe
  C:\Windows\System\ThMQxWq.exe
  2⤵
  PID:8708
- C:\Windows\System\hFTVxJG.exe
  C:\Windows\System\hFTVxJG.exe
  2⤵
  PID:8716
- C:\Windows\System\fhlywiD.exe
  C:\Windows\System\fhlywiD.exe
  2⤵
  PID:8784
- C:\Windows\System\oyYaXJS.exe
  C:\Windows\System\oyYaXJS.exe
  2⤵
  PID:8776
- C:\Windows\System\RhpTTKe.exe
  C:\Windows\System\RhpTTKe.exe
  2⤵
  PID:8796
- C:\Windows\System\KvvzVki.exe
  C:\Windows\System\KvvzVki.exe
  2⤵
  PID:8816
- C:\Windows\System\XqtMVCs.exe
  C:\Windows\System\XqtMVCs.exe
  2⤵
  PID:8828
- C:\Windows\System\JsHJZfk.exe
  C:\Windows\System\JsHJZfk.exe
  2⤵
  PID:8880
- C:\Windows\System\jXeZfSu.exe
  C:\Windows\System\jXeZfSu.exe
  2⤵
  PID:8936
- C:\Windows\System\FCzslPL.exe
  C:\Windows\System\FCzslPL.exe
  2⤵
  PID:8968
- C:\Windows\System\sSspnwD.exe
  C:\Windows\System\sSspnwD.exe
  2⤵
  PID:9040
- C:\Windows\System\fWqCUzx.exe
  C:\Windows\System\fWqCUzx.exe
  2⤵
  PID:9072
- C:\Windows\System\iSORBLw.exe
  C:\Windows\System\iSORBLw.exe
  2⤵
  PID:9080
- C:\Windows\System\iOquURG.exe
  C:\Windows\System\iOquURG.exe
  2⤵
  PID:9092
- C:\Windows\System\aoNEVLy.exe
  C:\Windows\System\aoNEVLy.exe
  2⤵
  PID:8956
- C:\Windows\System\orDAyZh.exe
  C:\Windows\System\orDAyZh.exe
  2⤵
  PID:8988
- C:\Windows\System\cvkznFf.exe
  C:\Windows\System\cvkznFf.exe
  2⤵
  PID:9128
- C:\Windows\System\eCxmJgx.exe
  C:\Windows\System\eCxmJgx.exe
  2⤵
  PID:9140
- C:\Windows\System\fixrACt.exe
  C:\Windows\System\fixrACt.exe
  2⤵
  PID:9156
- C:\Windows\System\GfMnPtZ.exe
  C:\Windows\System\GfMnPtZ.exe
  2⤵
  PID:9172
- C:\Windows\System\CriXGrv.exe
  C:\Windows\System\CriXGrv.exe
  2⤵
  PID:9192
- C:\Windows\System\oiufJMk.exe
  C:\Windows\System\oiufJMk.exe
  2⤵
  PID:9204
- C:\Windows\System\AEBaTTU.exe
  C:\Windows\System\AEBaTTU.exe
  2⤵
  PID:8228
- C:\Windows\System\ngVASQC.exe
  C:\Windows\System\ngVASQC.exe
  2⤵
  PID:8452
- C:\Windows\System\pQojKjm.exe
  C:\Windows\System\pQojKjm.exe
  2⤵
  PID:7468
- C:\Windows\System\YrXgNKS.exe
  C:\Windows\System\YrXgNKS.exe
  2⤵
  PID:8488
- C:\Windows\System\KWmejbS.exe
  C:\Windows\System\KWmejbS.exe
  2⤵
  PID:8164
- C:\Windows\System\qadbQrg.exe
  C:\Windows\System\qadbQrg.exe
  2⤵
  PID:7712
- C:\Windows\System\CRfcMFM.exe
  C:\Windows\System\CRfcMFM.exe
  2⤵
  PID:7728
- C:\Windows\System\VMqfWvu.exe
  C:\Windows\System\VMqfWvu.exe
  2⤵
  PID:8248
- C:\Windows\System\tHPnaZG.exe
  C:\Windows\System\tHPnaZG.exe
  2⤵
  PID:7596
- C:\Windows\System\sUTsHYx.exe
  C:\Windows\System\sUTsHYx.exe
  2⤵
  PID:8440
- C:\Windows\System\woWbEbK.exe
  C:\Windows\System\woWbEbK.exe
  2⤵
  PID:8628
- C:\Windows\System\VdcRuWy.exe
  C:\Windows\System\VdcRuWy.exe
  2⤵
  PID:8660
- C:\Windows\System\xSpEZck.exe
  C:\Windows\System\xSpEZck.exe
  2⤵
  PID:8540
- C:\Windows\System\LdHMyxJ.exe
  C:\Windows\System\LdHMyxJ.exe
  2⤵
  PID:8680
- C:\Windows\System\pdfhHlo.exe
  C:\Windows\System\pdfhHlo.exe
  2⤵
  PID:8732
- C:\Windows\System\dWYbElC.exe
  C:\Windows\System\dWYbElC.exe
  2⤵
  PID:8804
- C:\Windows\System\gNpQAEq.exe
  C:\Windows\System\gNpQAEq.exe
  2⤵
  PID:8868
- C:\Windows\System\pOJsXLc.exe
  C:\Windows\System\pOJsXLc.exe
  2⤵
  PID:8852
- C:\Windows\System\SvLaptf.exe
  C:\Windows\System\SvLaptf.exe
  2⤵
  PID:9132
- C:\Windows\System\TffCXHb.exe
  C:\Windows\System\TffCXHb.exe
  2⤵
  PID:9200
- C:\Windows\System\abcLRkB.exe
  C:\Windows\System\abcLRkB.exe
  2⤵
  PID:8276
- C:\Windows\System\MMtOFTA.exe
  C:\Windows\System\MMtOFTA.exe
  2⤵
  PID:7844
- C:\Windows\System\CgBebbw.exe
  C:\Windows\System\CgBebbw.exe
  2⤵
  PID:8404
- C:\Windows\System\hNufFgO.exe
  C:\Windows\System\hNufFgO.exe
  2⤵
  PID:8472
- C:\Windows\System\IQmSCxE.exe
  C:\Windows\System\IQmSCxE.exe
  2⤵
  PID:8372
- C:\Windows\System\zvfzQBn.exe
  C:\Windows\System\zvfzQBn.exe
  2⤵
  PID:8788
- C:\Windows\System\AhRHjqL.exe
  C:\Windows\System\AhRHjqL.exe
  2⤵
  PID:8468
- C:\Windows\System\EGblDNq.exe
  C:\Windows\System\EGblDNq.exe
  2⤵
  PID:8808
- C:\Windows\System\sOpWiPi.exe
  C:\Windows\System\sOpWiPi.exe
  2⤵
  PID:9036
- C:\Windows\System\wOBXjjI.exe
  C:\Windows\System\wOBXjjI.exe
  2⤵
  PID:7404
- C:\Windows\System\NBlWGUb.exe
  C:\Windows\System\NBlWGUb.exe
  2⤵
  PID:8420
- C:\Windows\System\AMZMoHC.exe
  C:\Windows\System\AMZMoHC.exe
  2⤵
  PID:9184
- C:\Windows\System\QTIHoDw.exe
  C:\Windows\System\QTIHoDw.exe
  2⤵
  PID:9056
- C:\Windows\System\lsuMufy.exe
  C:\Windows\System\lsuMufy.exe
  2⤵
  PID:7956
- C:\Windows\System\WNcGtIP.exe
  C:\Windows\System\WNcGtIP.exe
  2⤵
  PID:9008
- C:\Windows\System\nNIGePK.exe
  C:\Windows\System\nNIGePK.exe
  2⤵
  PID:8836
- C:\Windows\System\iywzdET.exe
  C:\Windows\System\iywzdET.exe
  2⤵
  PID:8504
- C:\Windows\System\XZVFAMD.exe
  C:\Windows\System\XZVFAMD.exe
  2⤵
  PID:8608
- C:\Windows\System\xMpmkSH.exe
  C:\Windows\System\xMpmkSH.exe
  2⤵
  PID:8520
- C:\Windows\System\KBBvkNW.exe
  C:\Windows\System\KBBvkNW.exe
  2⤵
  PID:8692
- C:\Windows\System\cunoxfs.exe
  C:\Windows\System\cunoxfs.exe
  2⤵
  PID:8196
- C:\Windows\System\TrayMUC.exe
  C:\Windows\System\TrayMUC.exe
  2⤵
  PID:8916
- C:\Windows\System\KMpLAbN.exe
  C:\Windows\System\KMpLAbN.exe
  2⤵
  PID:8984
- C:\Windows\System\fWMNxFG.exe
  C:\Windows\System\fWMNxFG.exe
  2⤵
  PID:9148
- C:\Windows\System\aHZlxKN.exe
  C:\Windows\System\aHZlxKN.exe
  2⤵
  PID:8792
- C:\Windows\System\PAjmpzz.exe
  C:\Windows\System\PAjmpzz.exe
  2⤵
  PID:8904
- C:\Windows\System\dTqwbjs.exe
  C:\Windows\System\dTqwbjs.exe
  2⤵
  PID:8624
- C:\Windows\System\bovXAhM.exe
  C:\Windows\System\bovXAhM.exe
  2⤵
  PID:8556
- C:\Windows\System\tyoORvG.exe
  C:\Windows\System\tyoORvG.exe
  2⤵
  PID:8676
- C:\Windows\System\vOANlfu.exe
  C:\Windows\System\vOANlfu.exe
  2⤵
  PID:8292
- C:\Windows\System\GjhXwir.exe
  C:\Windows\System\GjhXwir.exe
  2⤵
  PID:8308
- C:\Windows\System\wmhNNzM.exe
  C:\Windows\System\wmhNNzM.exe
  2⤵
  PID:9220
- C:\Windows\System\pLdeQDl.exe
  C:\Windows\System\pLdeQDl.exe
  2⤵
  PID:9332
- C:\Windows\System\nmNRaxj.exe
  C:\Windows\System\nmNRaxj.exe
  2⤵
  PID:9352
- C:\Windows\System\EfdrhRZ.exe
  C:\Windows\System\EfdrhRZ.exe
  2⤵
  PID:9368
- C:\Windows\System\mMYJQRm.exe
  C:\Windows\System\mMYJQRm.exe
  2⤵
  PID:9384
- C:\Windows\System\dXmTIMK.exe
  C:\Windows\System\dXmTIMK.exe
  2⤵
  PID:9400
- C:\Windows\System\hEfkjVq.exe
  C:\Windows\System\hEfkjVq.exe
  2⤵
  PID:9416
- C:\Windows\System\zRjGXcc.exe
  C:\Windows\System\zRjGXcc.exe
  2⤵
  PID:9432
- C:\Windows\System\aobyujV.exe
  C:\Windows\System\aobyujV.exe
  2⤵
  PID:9448
- C:\Windows\System\LHXdGoZ.exe
  C:\Windows\System\LHXdGoZ.exe
  2⤵
  PID:9472
- C:\Windows\System\kDnCNEj.exe
  C:\Windows\System\kDnCNEj.exe
  2⤵
  PID:9488
- C:\Windows\System\mhaMcDa.exe
  C:\Windows\System\mhaMcDa.exe
  2⤵
  PID:9504
- C:\Windows\System\iHEsdlx.exe
  C:\Windows\System\iHEsdlx.exe
  2⤵
  PID:9520
- C:\Windows\System\rOffpNN.exe
  C:\Windows\System\rOffpNN.exe
  2⤵
  PID:9536
- C:\Windows\System\lPfxekN.exe
  C:\Windows\System\lPfxekN.exe
  2⤵
  PID:9552
- C:\Windows\System\yrkPTYw.exe
  C:\Windows\System\yrkPTYw.exe
  2⤵
  PID:9568
- C:\Windows\System\XJIwiSW.exe
  C:\Windows\System\XJIwiSW.exe
  2⤵
  PID:9584
- C:\Windows\System\wrCRuNU.exe
  C:\Windows\System\wrCRuNU.exe
  2⤵
  PID:9600
- C:\Windows\System\ZAcEpFC.exe
  C:\Windows\System\ZAcEpFC.exe
  2⤵
  PID:9616
- C:\Windows\System\qNNRhwM.exe
  C:\Windows\System\qNNRhwM.exe
  2⤵
  PID:9632
- C:\Windows\System\jkgzVEm.exe
  C:\Windows\System\jkgzVEm.exe
  2⤵
  PID:9648
- C:\Windows\System\myZjBhX.exe
  C:\Windows\System\myZjBhX.exe
  2⤵
  PID:9664
- C:\Windows\System\YRbsTzj.exe
  C:\Windows\System\YRbsTzj.exe
  2⤵
  PID:9684
- C:\Windows\System\RcMkeyT.exe
  C:\Windows\System\RcMkeyT.exe
  2⤵
  PID:9700
- C:\Windows\System\LOwNMyO.exe
  C:\Windows\System\LOwNMyO.exe
  2⤵
  PID:9716
- C:\Windows\System\aNqBJKH.exe
  C:\Windows\System\aNqBJKH.exe
  2⤵
  PID:9740
- C:\Windows\System\itMINfu.exe
  C:\Windows\System\itMINfu.exe
  2⤵
  PID:9872
- C:\Windows\System\hViUbVJ.exe
  C:\Windows\System\hViUbVJ.exe
  2⤵
  PID:9888
- C:\Windows\System\mmznQrI.exe
  C:\Windows\System\mmznQrI.exe
  2⤵
  PID:9908
- C:\Windows\System\asIvaOJ.exe
  C:\Windows\System\asIvaOJ.exe
  2⤵
  PID:9924
- C:\Windows\System\hwxAxUW.exe
  C:\Windows\System\hwxAxUW.exe
  2⤵
  PID:9940
- C:\Windows\System\lbBjXVN.exe
  C:\Windows\System\lbBjXVN.exe
  2⤵
  PID:9956
- C:\Windows\System\hVAxrLP.exe
  C:\Windows\System\hVAxrLP.exe
  2⤵
  PID:9972
- C:\Windows\System\zmHMwAT.exe
  C:\Windows\System\zmHMwAT.exe
  2⤵
  PID:9992
- C:\Windows\System\WdRmLXn.exe
  C:\Windows\System\WdRmLXn.exe
  2⤵
  PID:10008
- C:\Windows\System\JtQVVOF.exe
  C:\Windows\System\JtQVVOF.exe
  2⤵
  PID:10024
- C:\Windows\System\glFDFSY.exe
  C:\Windows\System\glFDFSY.exe
  2⤵
  PID:10040
- C:\Windows\System\fwxENiH.exe
  C:\Windows\System\fwxENiH.exe
  2⤵
  PID:10056
- C:\Windows\System\rKoyqhn.exe
  C:\Windows\System\rKoyqhn.exe
  2⤵
  PID:10072
- C:\Windows\System\FcVYXnG.exe
  C:\Windows\System\FcVYXnG.exe
  2⤵
  PID:10088
- C:\Windows\System\yIcCqpH.exe
  C:\Windows\System\yIcCqpH.exe
  2⤵
  PID:10108
- C:\Windows\System\qcnefXf.exe
  C:\Windows\System\qcnefXf.exe
  2⤵
  PID:10128
- C:\Windows\System\alUCCdu.exe
  C:\Windows\System\alUCCdu.exe
  2⤵
  PID:10144
- C:\Windows\System\EkHuVrA.exe
  C:\Windows\System\EkHuVrA.exe
  2⤵
  PID:10160
- C:\Windows\System\jYnBVPz.exe
  C:\Windows\System\jYnBVPz.exe
  2⤵
  PID:10176
- C:\Windows\System\hFmQgnG.exe
  C:\Windows\System\hFmQgnG.exe
  2⤵
  PID:10192
- C:\Windows\System\sTfqtgR.exe
  C:\Windows\System\sTfqtgR.exe
  2⤵
  PID:10212
- C:\Windows\System\AnHGzhp.exe
  C:\Windows\System\AnHGzhp.exe
  2⤵
  PID:10228
- C:\Windows\System\JRekEnd.exe
  C:\Windows\System\JRekEnd.exe
  2⤵
  PID:9168
- C:\Windows\System\AOCwObd.exe
  C:\Windows\System\AOCwObd.exe
  2⤵
  PID:9228
- C:\Windows\System\PPRHkkv.exe
  C:\Windows\System\PPRHkkv.exe
  2⤵
  PID:9244
- C:\Windows\System\XUPrQPc.exe
  C:\Windows\System\XUPrQPc.exe
  2⤵
  PID:9256
- C:\Windows\System\vubNqEA.exe
  C:\Windows\System\vubNqEA.exe
  2⤵
  PID:9272
- C:\Windows\System\gjPzYaT.exe
  C:\Windows\System\gjPzYaT.exe
  2⤵
  PID:9296
- C:\Windows\System\GaAJVGD.exe
  C:\Windows\System\GaAJVGD.exe
  2⤵
  PID:9312
- C:\Windows\System\hZMyaIk.exe
  C:\Windows\System\hZMyaIk.exe
  2⤵
  PID:9340
- C:\Windows\System\vXgVmDa.exe
  C:\Windows\System\vXgVmDa.exe
  2⤵
  PID:9344
- C:\Windows\System\maDXlqq.exe
  C:\Windows\System\maDXlqq.exe
  2⤵
  PID:9440
- C:\Windows\System\CPPpWNL.exe
  C:\Windows\System\CPPpWNL.exe
  2⤵
  PID:9544
- C:\Windows\System\JQCmvDH.exe
  C:\Windows\System\JQCmvDH.exe
  2⤵
  PID:9576
- C:\Windows\System\tLpmRXy.exe
  C:\Windows\System\tLpmRXy.exe
  2⤵
  PID:9644
- C:\Windows\System\dReZVie.exe
  C:\Windows\System\dReZVie.exe
  2⤵
  PID:9708
- C:\Windows\System\UMIpmOh.exe
  C:\Windows\System\UMIpmOh.exe
  2⤵
  PID:9396
- C:\Windows\System\EuiUsHY.exe
  C:\Windows\System\EuiUsHY.exe
  2⤵
  PID:9760
- C:\Windows\System\deTTJeP.exe
  C:\Windows\System\deTTJeP.exe
  2⤵
  PID:9564
- C:\Windows\System\ipPDgPA.exe
  C:\Windows\System\ipPDgPA.exe
  2⤵
  PID:9392
- C:\Windows\System\gLOfrKs.exe
  C:\Windows\System\gLOfrKs.exe
  2⤵
  PID:9460
- C:\Windows\System\dYnHwlr.exe
  C:\Windows\System\dYnHwlr.exe
  2⤵
  PID:9596
- C:\Windows\System\ThMKDOu.exe
  C:\Windows\System\ThMKDOu.exe
  2⤵
  PID:9660
- C:\Windows\System\CBnMokE.exe
  C:\Windows\System\CBnMokE.exe
  2⤵
  PID:9780
- C:\Windows\System\JpHChcd.exe
  C:\Windows\System\JpHChcd.exe
  2⤵
  PID:9768
- C:\Windows\System\uevkSTd.exe
  C:\Windows\System\uevkSTd.exe
  2⤵
  PID:9792
- C:\Windows\System\imjIvkY.exe
  C:\Windows\System\imjIvkY.exe
  2⤵
  PID:9820
- C:\Windows\System\DyyPyqx.exe
  C:\Windows\System\DyyPyqx.exe
  2⤵
  PID:9836
- C:\Windows\System\GVQMBfd.exe
  C:\Windows\System\GVQMBfd.exe
  2⤵
  PID:9856
- C:\Windows\System\UnzWohq.exe
  C:\Windows\System\UnzWohq.exe
  2⤵
  PID:9864
- C:\Windows\System\NjBgYGJ.exe
  C:\Windows\System\NjBgYGJ.exe
  2⤵
  PID:9904
- C:\Windows\System\NBJOXqM.exe
  C:\Windows\System\NBJOXqM.exe
  2⤵
  PID:9936
- C:\Windows\System\hnUfrCC.exe
  C:\Windows\System\hnUfrCC.exe
  2⤵
  PID:10004
- C:\Windows\System\UIprySq.exe
  C:\Windows\System\UIprySq.exe
  2⤵
  PID:10104
- C:\Windows\System\drscQVT.exe
  C:\Windows\System\drscQVT.exe
  2⤵
  PID:8264
- C:\Windows\System\PWSeYgR.exe
  C:\Windows\System\PWSeYgR.exe
  2⤵
  PID:9920
- C:\Windows\System\YHgPlzX.exe
  C:\Windows\System\YHgPlzX.exe
  2⤵
  PID:10136
- C:\Windows\System\MVqczKS.exe
  C:\Windows\System\MVqczKS.exe
  2⤵
  PID:10236
- C:\Windows\System\DbfGSly.exe
  C:\Windows\System\DbfGSly.exe
  2⤵
  PID:9348
- C:\Windows\System\KVZYALl.exe
  C:\Windows\System\KVZYALl.exe
  2⤵
  PID:10124
- C:\Windows\System\iWnmIoL.exe
  C:\Windows\System\iWnmIoL.exe
  2⤵
  PID:9484
- C:\Windows\System\zmcUsFI.exe
  C:\Windows\System\zmcUsFI.exe
  2⤵
  PID:10188
- C:\Windows\System\dboqbtT.exe
  C:\Windows\System\dboqbtT.exe
  2⤵
  PID:10224
- C:\Windows\System\pyFYwMX.exe
  C:\Windows\System\pyFYwMX.exe
  2⤵
  PID:9500

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\JZTdbjJ.exe

Filesize
2.0MB

MD5
00a557d30277f6220080b66926087824

SHA1
919ad6ad4acb814170fbaf1ee3cc424219a57e10

SHA256
1447b0a1c570d8601769c61a1cc94a082adf0c99fc1f3bea442703ea1baa1613

SHA512
5c80f867598318d7fc70dc3b703c192dda8f1a27e6a700f89b46290bca33e232942c18ff07bda9f4a168312f75df188c7d6ab36df35ee72692407b9563d724a4

Download Submit
C:\Windows\system\LdhtfwN.exe

Filesize
2.0MB

MD5
7afcbaff948a29422daa06d2b721c581

SHA1
32345f106626974233f786ff1a89ff91e92225eb

SHA256
eee6c10569c9bde4245c3a9ad2592b8a88d2bd798269d4151ffeae69f84bcb59

SHA512
ef6cf2282f3c429a1d037649c8ba06cc209b24a42023f2289cc4db734251bbe99c7c533ef618d01dda46e8f9088faf319306f5423494615c81c20343fcc83d9c

Download Submit
C:\Windows\system\NFAIEZv.exe

Filesize
2.0MB

MD5
9877d2ea21a69b0766d1d2856d819e91

SHA1
d298c7b11571e3329910cf3baef151f0db53520e

SHA256
81a7f56dbaf3256b950e8748a65e07dfd8c60103076a640ae63856cced9be3f9

SHA512
0696404f002a34d01ad99f84fba25922dce8ed84f1aff0cb30b110c0127e18084e88a2ab4ebef0ea8d28506ae73df2dae7b1253e50d6f50110a1f726fd6d2768

Download Submit
C:\Windows\system\OoTmJrK.exe

Filesize
2.0MB

MD5
0b30a5ffb5824c1aada93dbf2594d637

SHA1
23c07494c1744b0aa82ca54b220e361e8134cdf5

SHA256
69ed85cc237af9459c3d2cd3ed1c362cb68537874682379c58bbd4cbf35b15e2

SHA512
81e088438cdb3a70494897c308c2b1b72ade419b8088ff66abcdcff21d7981f8ac179952734654950fc680ab76f67ec5d2c19d98331a2379840f9449a6b663f3

Download Submit
C:\Windows\system\RaGUhRC.exe

Filesize
2.0MB

MD5
28035bc0a1a624e7b52f70de5ddab4af

SHA1
9a225277c29011169751ad5bba7af074dbbfe3d9

SHA256
7af44e78dc33a2d9bce37d34050831b8d6b17662f1d7102881b834cfbb84623a

SHA512
9e26cf1eb72dbd85c14eb3f55704890faa936bf450f213d9aefaaf029d18cfa7a1190949cb0fa51d54dc9ef4b583b291e155911a26ac11c0c334b2a71ac40137

Download Submit
C:\Windows\system\TcyLzZd.exe

Filesize
2.0MB

MD5
f1f0dfe96777dfaa4ea1956339bf4919

SHA1
d8e0c8f3b1e4dc1db37ff28ff6b78f08c7d1bdd4

SHA256
f50b5710fa66371a7d3d9e6fc34bd68ac2c3e19d1cb3215deba1056e4d4d4717

SHA512
9afc9214395351ab4ac68feba9e98e8fa1229f502aa15d7c8c2929cb8e78d5d8b48a4137649c61a3db8451236f845168a9a3759ad158b29710a73f3457955cec

Download Submit
C:\Windows\system\WEURdkQ.exe

Filesize
2.0MB

MD5
c662a849a0a5a75a4c6a94a669196ceb

SHA1
39ceb848704f77238493b6d9638f5645b464bf04

SHA256
f3fa1ba5b0a42ad33bbe8d33e798b036f7ea91e50d741a37e3fcf5de229359cd

SHA512
e93ce65db81700b6698846ee3eaf53084fd776689e5fd3952db15e4a6c2408476ccb6a010370e06652ae9d7fccde608e6ed7bb5792fe01770b9213158200e44e

Download Submit
C:\Windows\system\WbKvdBb.exe

Filesize
2.0MB

MD5
5da2a54c7248feaaba23c8e5e21258e5

SHA1
55d1e82b4170f48406e96962b02ffb27ce697e19

SHA256
ef99360bb9391831fc88e8b2f7fc48be6fd44ed0c074319eff4fb9c550f4a20c

SHA512
b51932482ce07107bd440bcb1589a5f08bec24e4410a6eb8a0848541e812b50aa9a47653449f969550269e9a61a2c385cc82ed2868cae0d3c15b21da44f950df

Download Submit
C:\Windows\system\XHFXich.exe

Filesize
2.0MB

MD5
b4c967a45184e2f0cd817b60a6c6ab58

SHA1
b9f4674656238086d330cb05a7959c0d666d5c89

SHA256
b0c8324ca42d0755933baef2cb5b3f00f7427f3c5f70aa1b8faededed25ba4f2

SHA512
549856d9b8abc3fdadb63344c76c096855a9240e87249c85323fceae5fe6c0f9f551cc0229346405f8f47f69d40c2df1989e16461cb7034d2a7da6edcafb5194

Download Submit
C:\Windows\system\XSIPcBq.exe

Filesize
2.0MB

MD5
aeab71747591ac78e54395b0847e96f1

SHA1
b6c74be8d57e0ca1697bd9979e35a21e73cd3881

SHA256
1efaa7bda4a38d2a355034eb9afb61dea4f3dc595ede33b50ccd4b5e573f2991

SHA512
6efef2515a2eb0083734cf47ebea4367b92e0c65d8d35f440f1eb7206e1df45695aa6635c6f08e26340b8d8702f15ec93c6ce7345b7c90913453b666b93b4369

Download Submit
C:\Windows\system\YmQljXN.exe

Filesize
2.0MB

MD5
6f5dcc12ac8f92e8bb4b9884f07e1684

SHA1
1930ff8ac8812f0d9d30ca84b06c451a597f093c

SHA256
8624cc174414a95a264565b7ca8cf70fe7b0af8b566b108fbb596e67d7da0400

SHA512
9edfa9ee7c61f2461e0323cd993d571ca6e277822e9fc409edd443d0d54a1ba372aa75aed1958173828a7b7f047410f360ceee68d18426836e8c8e4a0b041a98

Download Submit
C:\Windows\system\aABEJtw.exe

Filesize
2.0MB

MD5
09fad959ab625be19c48c578270f9818

SHA1
87be88aace108dae2fcc2699dba3dc61279d9d5b

SHA256
c2b0503c09049e9e5d9475a25238e2b314299254db47055121bb16c0be3da8cf

SHA512
25974d044ba86588a899c942ae615a7ef39f71eb2a2b852457886c71427925143a9d0d013ef92780a2c46a3d4cf2dee4011383caa736239cfb8f1c1214034113

Download Submit
C:\Windows\system\aCJONgb.exe

Filesize
2.0MB

MD5
b2a5cdd0018034d6392ac1b289ed6c8c

SHA1
e848865e78101ca0464f157474f894e06eed7043

SHA256
e6f67d95f61eef01f32ec52379173aaeefeaca7e6d4b7e10405d4d5045e477a0

SHA512
a9e4e66bf65a1ff06ed62e8a68148fb01263f6f168f48fd7aedc1d33dcd2a2d35b8fa33a8f4da3c2b68e50b260f21ce883d926ea1928e35f0d721a30be9c8376

Download Submit
C:\Windows\system\byUduSq.exe

Filesize
2.0MB

MD5
0b665a33210ca740d9a26bcdb5c46667

SHA1
31888beec847720db178dd048365fa8114decb71

SHA256
d6336c9296566b148eb35856ee525e97b9de6f0dbd8b20883133fb55ecaf2499

SHA512
2e0f35e2d048f9c32d3623823877a624dd1a4a7abe7c2326e013d0cb2cf117d4079e44ff8fedb9bafc54012c4be89dc90407f30b4ff9db1232c0bbe52e4ccf91

Download Submit
C:\Windows\system\gqNLlIg.exe

Filesize
2.0MB

MD5
f8e34d2081c38ec3be5e70d8e71ace4f

SHA1
f8f95285c54a897da76ac0bce740ba7d017dd62d

SHA256
dda07950a7a5699bfcb547d6e41d2cb688129c193eb4d79e84b2bd37877151d3

SHA512
d2da449dab442b9c1033c6da3a4324aedfe89a95e0b1fd4fb31625ed3cfb6108734052a93345fe651999eb3ac3f080415f5b554415086f301533d623ea475e6f

Download Submit
C:\Windows\system\gxkbHfO.exe

Filesize
2.0MB

MD5
d280da68bb094c224ae4473f3bf164dd

SHA1
4949a591f1760e745f531b8000c6ed6cb3405076

SHA256
19b18b2d5b7420d250d5b0e768b118f13f9456d5185b142736caf2e5f6c9851e

SHA512
3308f1d5fc26f05d1859bc38a53299fd928c71f05877bb401a19457d79f51d2bb6ceaa8afd89d054573a2d4150606bc9f6ca63cd995f658596f1502dc43f123a

Download Submit
C:\Windows\system\hEbqPhY.exe

Filesize
2.0MB

MD5
a5265d95f6ccc5ad5db8ee264571761c

SHA1
cc19d3eb5318106e89a6a881ba468f1a278761af

SHA256
faaf470a39dac3289e3f0df6cc748ad9d6ca5a5effc9a335e7ae2466ccfa1f8b

SHA512
94afc8a908a9bcf0c8ecf7a026c9d39d3d95e5996935de67a189e4d65dde1fbe32db809e201b5bbbd278beac6a96c413ecee0da6066f48689626a17f701e0c58

Download Submit
C:\Windows\system\kHUfXoa.exe

Filesize
2.0MB

MD5
87a7551bc270c3ce8e0133e60318e9a6

SHA1
8921dcee630e16e8f27e6bb4ca49aec397b2195f

SHA256
65539db51c3f7b4b6b87b2b308f527229ee9649e1027de8008169cf44cf0f35b

SHA512
b759d657c49b1f94ac5e4d2f7716e036a7c42d8b4662e86c939917195dc96503009170217c03bae51a4ee25afe922fa92f60f1cc36da60d55b8538b07f9c3be0

Download Submit
C:\Windows\system\kMhWtMk.exe

Filesize
2.0MB

MD5
6b05a9aac94dc6a6aab648830cc3c423

SHA1
cb1ceb8dc519668fddbbb7797e80a15ee18fc51f

SHA256
707dcf1251697eb3264941e6a009ee2e2081851b7a3ce69f48d7a82692cbe5c7

SHA512
d2f042d3eaf14148123f5faaf1f8856f09b260b159c9e28013cc117c16787178af4ad8a9386c8f68337275d5eaeca9c3c8c6a13239a62827f3f94baa2b822ac8

Download Submit
C:\Windows\system\rdegBfn.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
\Windows\system\JEORVYO.exe

Filesize
2.0MB

MD5
c6e69e85fb10ca562379d41feac86a0e

SHA1
5fc72471fb8bbfc2966fd7cc038acc247cef7780

SHA256
1d075b3941307be7f6afa48f8d6d719ed678527355c3deea977c81ac48f06242

SHA512
fe034c9a7936513baeb9b8d90b35621644a3615bea92524d98d15fb4842dc0717d1501b9c5ea4409cd77cfa456bae6d6efd2048b31e4ecb01dc55432671520c3

Download Submit
\Windows\system\MLrRBFG.exe

Filesize
2.0MB

MD5
79daf45b2720920c0f36c16708a5554a

SHA1
ec58a43573b635118e9c90cb9885164ecc99ba9f

SHA256
105ca7539094fd9830cc2cd337bcf8a2904e86b36fbb74d4c398ead369d7c3f6

SHA512
fdfcb9730b5fb7892140c07a4430426435997b1c29198b6ea95e28f7381dc57aa49a7281215e0069ac23df3a73bbf6f1c31fa95a5a8016c8818b9f64757759ed

Download Submit
\Windows\system\PbBgSJJ.exe

Filesize
2.0MB

MD5
791e96ef6c6299392d5da2e5e131be8a

SHA1
8add8ca5223b2d31d02a9ffe473a937ec28ecd6d

SHA256
a28d62d2f547fc1fff84f5cb51bfba4f14265ef052629e201574851d2e767270

SHA512
d2f7d0183d91cecb82ee8e27db0142789c83ca127129f963467f3842eb06b6c7b2297a59699ce49c8411bf10184e1b094a366685a42680f310471f54fa6c4a13

Download Submit
\Windows\system\QULtLvP.exe

Filesize
2.0MB

MD5
807fce35088c5dabbe6c8724bcf3523d

SHA1
3b652084983357b892c1ec8dd1c8db51dd210606

SHA256
dd79c5e75049bb4597f6d731acb3939056ce5430caf34c0a452dc2c6f8150d64

SHA512
cc2c35ae0ed587995746cb2b9273f2af6e7f63b88b439642e48d08e9194a3d6979589db6442a86ce44d3e1638fc09e252129bfad9e4222b0897415f9d2a52c75

Download Submit
\Windows\system\UTPJzJa.exe

Filesize
2.0MB

MD5
a06c66c8acad9ba296ed8aea84fa1128

SHA1
ce19b0e1de0f69ded830036d956cad711d853dd7

SHA256
c646539302f22e3ee82f413c89e83634a517f1363c5013cd2d41468a98a512cf

SHA512
7832f1bf1a8d714f226a1f165ed99b79128abaa1d5a5432066a514acb33022e3ebd0efcd8015a719fe8b1b1b6a38979e772bb7a58afadb588d8de957a6022bf7

Download Submit
\Windows\system\VVBQKkb.exe

Filesize
2.0MB

MD5
306f44f151a0069043de26e6edf22ef2

SHA1
e402508a8e492c9081bb3c016ef2011f80838c7c

SHA256
ddd599ea427c04a3f5583412d95aa055d84a654f1e2a0550790f968a936d078b

SHA512
a5410884a983746a39cbbb1bdd281f06639990f6de95ff48f2358347faff4317bbce151dc706012dc0a0bc54514e9bd292b7bdd25a7c7b6fa406cd10e82d6d9c

Download Submit
\Windows\system\bRXktpm.exe

Filesize
2.0MB

MD5
1fb56c4fa9d841f20a4322f5f1c566ee

SHA1
d2ee778d138c32a61cd7c0985faa8743399fad92

SHA256
ae68331f56b0804545f977f74951671284ad9dfc1ac4e4a9d209129caacc6fb3

SHA512
98667cc72ecab41e538e58f1a48898243caccfb1ae419938f94191207c8ea07deb65adad9368252a96403f326fb6f0d672dd6e27cb55fcdbad2c3dbde1e19a6f

Download Submit
\Windows\system\fxfZrwp.exe

Filesize
2.0MB

MD5
be0d0aa33815ad4c146235373e018235

SHA1
e4517ba83b4f02fc539d5423d07be3ebc620d429

SHA256
544945a143d72a23f19182e17ae286328004b9ad837ee4697bf21a7f770320a8

SHA512
1d707db0663451ffb915acb5de25275c69768a264695060e4008b07bf84029dababf64cd17227f8cb6d2f38cbc77ce98c7ac9b8bbf0451324ba0fc6fae6b0794

Download Submit
\Windows\system\gTlLLJd.exe

Filesize
2.0MB

MD5
8d62c45b9bb4d205bab592549fe2cba9

SHA1
0e759efb096ace9c3534821cff3de0b02436871a

SHA256
7f7c8047489117442f5d3715c2dd5988c0e5f1b4948b3c43f05c88a58eb669de

SHA512
7910981f8f493c8ce5c9ec77c85246abaca6e258b267f34c5da61e20180925bd28f0bef94b746856074ab33b4fab27766e1e125b69b098f3ccf740f090216c9e

Download Submit
\Windows\system\gdXoSln.exe

Filesize
2.0MB

MD5
b9e93efd9f1eca9675c616936f9c529e

SHA1
e88bf7228d8dfb087d255ceee655519ee6f9b768

SHA256
ec30956bb7c21a0c083bcdb74af24de0a498fefd51a05f813c658e7f28ea8f6c

SHA512
8bafc7fabd6fbc2713658ab76688d1d2ccd8430294822aae29d6160c04b0218a3830b2f15ab23f1737decb23846e5f62cf2584e68492ffc68b72ba692bfdea97

Download Submit
\Windows\system\ipYmuUu.exe

Filesize
2.0MB

MD5
c504cca3c8e3987de4c06ca1ae56a890

SHA1
cacfbd4e0553584d36cc2f587be30426ac579d29

SHA256
d7bdf9c5142a032d611ad752d3ff50753999eda7847bf351ca8cfaa4835852bd

SHA512
4d827c274e14af34c3b8d21354116edc4ae3f957f940e38ed52639d96e5fe45c60fd008c3aab89eb230ee211b45401c4fa7f72210809d22543cba7b44b6f1d64

Download Submit
\Windows\system\kroKVbJ.exe

Filesize
2.0MB

MD5
efd6afb20d799947151b3577b3d4c8ed

SHA1
d01ba55d27d24988f405440afc9c037d196ed17e

SHA256
216550f4a4e81637380f5996f5e742f3d43ef58e416e62bc6a66962e9fa24099

SHA512
90f0887cf680bfa10673b481d6825478a3ff6b879493a95bf467b76609d3fa30cfdb577d4b2c290012af7115f7bcaddf4302860442e9b86cea89c35a638fbb0c

Download Submit
\Windows\system\lfmLHMI.exe

Filesize
2.0MB

MD5
5f63a02cfc8437e110c78628db8b9722

SHA1
fffa93e15af36ff270856012a6df1158c3d90e4d

SHA256
6f40b85383855f904adf1eaf3044f9d31dfa809a4517ad79c03cc1dd3187d7e1

SHA512
3d447f747b569bcc17c595d369cbae16ab6bdc9fb1a417acf08effe7eaa5e32f3c9dce2ccbea3d39b19fd7ea571e4344b74fad6207279e8c3956193d75591e81

Download Submit
\Windows\system\mnzAIZp.exe

Filesize
2.0MB

MD5
63f90570182a5f7cacf30718dc7e091b

SHA1
2ff488d8c2b6665bc0d1d00cf1bb48936d69032e

SHA256
e08d54921c0224e3c3777750bc46c8c0ee4de4286d79a676a2ac1527e4dc9eb7

SHA512
204fbbcfae707e10a8680427ebca266ac91486180594bee5b906844c059b02109aee8cea59d170977877479e7946d99a540fb30fca7dc9f13d49f3145a216a0d

Download Submit
\Windows\system\srNmxOo.exe

Filesize
2.0MB

MD5
2a23d412f8e807cc40302e9fa929e51e

SHA1
78d4ed713f24a6965f6da4788e923afd5a6453cc

SHA256
83bee6ddb23eb9e1af680a9cf36572f3aca7c1b32392b477f6be6489ae720d97

SHA512
2f006807b12c990d469b6bd5138364fdef381b1728eeb096cd5da8523045b4286ed09dab18eb4ef459fddb43f2ccad2dd588088e4c55ccc0b6d82d5b468c0407

Download Submit
\Windows\system\xreZxFE.exe

Filesize
2.0MB

MD5
06cb3a09488b2c615ec11780e973f2f6

SHA1
26868713196da03cdf795ed188d94c83915d336b

SHA256
0cd2d0550e8e176cf62103ac0c2fc00b5bb64fd58caed81f9141c0fb2cfa7cdd

SHA512
70ab92ea3f00e693f83851399842055c3f62b5256930543ee811ff2b113dc92bfc322d2e0d0b4218004010b004003af3cb943734b30065a84ced983ef9d6bb52

Download Submit
\Windows\system\zcJTVYE.exe

Filesize
2.0MB

MD5
484b4c671970c14a566b273f6aa83cac

SHA1
be314ccde2e0da52ba9691957abb07d71511e231

SHA256
80a3a284453a5ea4ace0e8bbd60554a9ab7384913ac26e863f7c8ab083b1fca4

SHA512
41c540657ef90f9e949c7a14b70c3f4025fb9fa775c35f222b9e47ee78795925d8fb34959311c63bd74c1240830d3db007245741a1ba89f039425000b382c16b

Download Submit
\Windows\system\zrOXihx.exe

Filesize
2.0MB

MD5
86645b0555b02abd3905e083f2851f8b

SHA1
733c12a193e17e4256fdb98450f53822d1be1c6e

SHA256
1da07b1f3881f8e6e46acba1a46ba75f96bd08bb7ab1facdfff0cfec6fbe035b

SHA512
0905e7049c7eb79bf8f637e784610bd6be84f2b46d2a304d951f13f4baad6b1db0cee465d4024223c5a37722040ba2dd4f6f3be3b2a14de2cb888a19765832a6

Download Submit
memory/1892-87-0x000000013F450000-0x000000013F842000-memory.dmp

Filesize
3.9MB

Download
memory/1964-41-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2192-83-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-65-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-52-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-12-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2192-46-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2192-44-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-0-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2192-47-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-4788-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-40-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2192-92-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-84-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-1-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2192-106-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2192-81-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/2192-109-0x000000013F170000-0x000000013F562000-memory.dmp

Filesize
3.9MB

Download
memory/2472-48-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/2528-38-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-5111-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2552-13-0x000000013F540000-0x000000013F932000-memory.dmp

Filesize
3.9MB

Download
memory/2624-45-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-82-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2780-4791-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-85-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-1527-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2924-54-0x000000013F4C0000-0x000000013F8B2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-69-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2964-1574-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/3040-14-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/3040-15-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/3040-124-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3040-34-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3040-43-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3040-16-0x000007FEF60DE000-0x000007FEF60DF000-memory.dmp

Filesize
4KB

Download
memory/3040-25-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/3040-243-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/3040-107-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/3040-29-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download