xmrig | 4446b25f630205fd0909d79add04d21cc512b11dc8a55c3bc911c60a025c557f

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 18:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
Size

1.9MB
MD5

0c8cb8340e3219f4a6c25a90e7ffacaa
SHA1

eb4e2b0c5f873492c968d2658b1a8617a9bb6a2f
SHA256

4446b25f630205fd0909d79add04d21cc512b11dc8a55c3bc911c60a025c557f
SHA512

89c4f09c9f456fd1d7d44e09cf7ceca8572a869a584c20d35b86f101894388d1ddf81593d92321e965bbee709bee9f5e7f3f6c7b94bd20268a154c86408128df
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1x:NABU

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2516-119-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2708-112-0x000000013F350000-0x000000013F742000-memory.dmp	xmrig
behavioral1/memory/2632-134-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2592-179-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/3024-178-0x000000013F110000-0x000000013F502000-memory.dmp	xmrig
behavioral1/memory/2528-175-0x000000013F960000-0x000000013FD52000-memory.dmp	xmrig
behavioral1/memory/2464-174-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2436-173-0x000000013FCE0000-0x00000001400D2000-memory.dmp	xmrig
behavioral1/memory/2912-69-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/1384-28-0x000000013F740000-0x000000013FB32000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1384	KahUhbG.exe
2912	nQlGpzv.exe
2708	dCjNGPV.exe
2516	qyNkxhV.exe
2632	DJowFNB.exe
3024	TrLiUzp.exe
2592	LKinpas.exe
2436	GnHLDGN.exe
2464	NPUXkKr.exe
2528	GhCdUAU.exe
1560	gQmPACh.exe
2572	ZwpXgCA.exe
2440	SJiuzJG.exe
1676	xJKQRAW.exe
1800	rjovaFx.exe
1848	yhiPJsa.exe
1836	xXyLQPY.exe
2016	iFmXwvb.exe
2332	hJUJvHm.exe
292	zXsahqz.exe
2984	HlrbFxP.exe
2176	CBddVjZ.exe
2336	cNlywlO.exe
2172	oIBHoUj.exe
892	jrcxOMu.exe
540	wzllrRL.exe
940	IMeUXBN.exe
1052	RwjHpAF.exe
2132	hhDqbQX.exe
1564	ceGuRHI.exe
1252	zSxHCMZ.exe
1868	qZZZJev.exe
1260	hTdYdhh.exe
928	wsCNKQv.exe
1584	WVMVBsV.exe
1988	nALuxxC.exe
628	RngZppQ.exe
1028	liyzrWP.exe
2140	rzCpdaA.exe
360	xTFkzZF.exe
1448	vooXkBS.exe
716	zZtQRMg.exe
2216	TNwEWeM.exe
1432	gHAaKTc.exe
2312	auTjMra.exe
2520	uhFwRSL.exe
2620	IvSoPAv.exe
2796	yZvPGws.exe
1812	OwEMrkj.exe
1328	oBqzjRG.exe
1628	EYAbRXS.exe
1084	OMExTXG.exe
1984	dUzgOdr.exe
3016	mNtenJn.exe
1524	KyhlpVi.exe
3004	BBBjTNZ.exe
288	vVmDjiy.exe
2956	curyeuS.exe
2308	HoFVJHl.exe
1020	qxWlYuQ.exe
1612	wTYtXaW.exe
920	plwAEUp.exe
1804	uShuFXC.exe
2980	wGBmxyW.exe

Loads dropped DLL 64 IoCs

pid	Process
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2832-0-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x000a000000015c85-6.dat	upx
behavioral1/files/0x0007000000015e09-21.dat	upx
behavioral1/files/0x0007000000015e6d-31.dat	upx
behavioral1/files/0x0006000000016cfd-67.dat	upx
behavioral1/files/0x0006000000016d36-125.dat	upx
behavioral1/files/0x00050000000186c1-151.dat	upx
behavioral1/files/0x0009000000018640-143.dat	upx
behavioral1/files/0x0006000000016d16-138.dat	upx
behavioral1/files/0x00060000000175b8-136.dat	upx
behavioral1/memory/2516-119-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/files/0x000600000001744c-116.dat	upx
behavioral1/memory/2708-112-0x000000013F350000-0x000000013F742000-memory.dmp	upx
behavioral1/memory/2632-134-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/files/0x001500000001863c-140.dat	upx
behavioral1/files/0x0006000000016d32-150.dat	upx
behavioral1/memory/2592-179-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/3024-178-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/memory/2528-175-0x000000013F960000-0x000000013FD52000-memory.dmp	upx
behavioral1/memory/2464-174-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2436-173-0x000000013FCE0000-0x00000001400D2000-memory.dmp	upx
behavioral1/files/0x0006000000016da4-160.dat	upx
behavioral1/files/0x0006000000016d3a-158.dat	upx
behavioral1/files/0x00050000000186d3-154.dat	upx
behavioral1/files/0x000500000001865a-147.dat	upx
behavioral1/files/0x00060000000175ac-132.dat	upx
behavioral1/files/0x00060000000173e5-131.dat	upx
behavioral1/files/0x0006000000016fe8-130.dat	upx
behavioral1/files/0x00060000000175b2-128.dat	upx
behavioral1/files/0x0006000000016d05-111.dat	upx
behavioral1/files/0x000600000001739d-108.dat	upx
behavioral1/files/0x0006000000016e78-98.dat	upx
behavioral1/files/0x0005000000018700-185.dat	upx
behavioral1/files/0x0006000000016db3-127.dat	upx
behavioral1/files/0x0006000000016d9f-126.dat	upx
behavioral1/files/0x0006000000016d1f-124.dat	upx
behavioral1/files/0x0008000000016cb2-75.dat	upx
behavioral1/memory/2912-69-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/files/0x0006000000016d0e-68.dat	upx
behavioral1/files/0x001800000000558a-66.dat	upx
behavioral1/files/0x0007000000016cf5-87.dat	upx
behavioral1/files/0x0007000000015d44-38.dat	upx
behavioral1/files/0x0007000000015d4c-30.dat	upx
behavioral1/files/0x0008000000015d24-29.dat	upx
behavioral1/memory/1384-28-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x0009000000015cd9-27.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\BKjdgKL.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\FwJMvbD.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ZTrUnYE.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\DMaImmH.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ZlVNqwb.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\DOaXjuI.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\byiwVNd.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\kobGbcO.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ycVAVVg.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\AxegDQy.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\uqPxhtM.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ikxraHZ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\PCGTetx.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ZbZUgSa.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\jmvgVAh.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\KOKsswQ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\mURuSbw.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\oIZVpoF.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\OQojWbA.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\rchFJEZ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\KeqLFtJ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\vUDZhvc.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\aEVZziQ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\KBLnnhA.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\MBukMxn.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\mJTbQnC.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\XaGgPTO.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\DeqUvCt.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\BBBjTNZ.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\pkTnAkw.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\rsaNeHn.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\PXQUQeC.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\IzCSwXW.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\nXpmSAt.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\VtRYVrB.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\hhLfbiI.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\saXYAXd.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\WZuNnvW.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\XtzIHLE.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\cNlywlO.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\kVQUYHW.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\GAMrUeX.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\xvEetWp.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\oVaPgmW.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\dKcgGTe.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\hvXFLyt.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\llpWokI.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\QWDtgyp.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\UKeIpgs.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\JinmajT.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\nALuxxC.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\ifwtNKG.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\VTlqVFg.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\mbyPTAd.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\sImhduw.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\wYSCRJC.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\yeCHBcg.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\sNaXKPb.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\UksuuhD.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\veztPXh.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\SOHvKdU.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\jDKmiZE.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\OCbzjTO.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
File created	C:\Windows\System\UYwuPEx.exe	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2056	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeLockMemoryPrivilege	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2056	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2056	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	29
PID 2832 wrote to memory of 2056	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	29
PID 2832 wrote to memory of 1384	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	30
PID 2832 wrote to memory of 1384	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	30
PID 2832 wrote to memory of 1384	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	30
PID 2832 wrote to memory of 2912	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2912	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2912	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	31
PID 2832 wrote to memory of 2708	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	32
PID 2832 wrote to memory of 2708	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	32
PID 2832 wrote to memory of 2708	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	32
PID 2832 wrote to memory of 3024	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	33
PID 2832 wrote to memory of 3024	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	33
PID 2832 wrote to memory of 3024	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	33
PID 2832 wrote to memory of 2516	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	34
PID 2832 wrote to memory of 2516	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	34
PID 2832 wrote to memory of 2516	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	34
PID 2832 wrote to memory of 2592	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	35
PID 2832 wrote to memory of 2592	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	35
PID 2832 wrote to memory of 2592	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	35
PID 2832 wrote to memory of 2632	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	36
PID 2832 wrote to memory of 2632	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	36
PID 2832 wrote to memory of 2632	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	36
PID 2832 wrote to memory of 1560	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	37
PID 2832 wrote to memory of 1560	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	37
PID 2832 wrote to memory of 1560	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	37
PID 2832 wrote to memory of 2436	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	38
PID 2832 wrote to memory of 2436	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	38
PID 2832 wrote to memory of 2436	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	38
PID 2832 wrote to memory of 2572	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	39
PID 2832 wrote to memory of 2572	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	39
PID 2832 wrote to memory of 2572	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	39
PID 2832 wrote to memory of 2464	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	40
PID 2832 wrote to memory of 2464	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	40
PID 2832 wrote to memory of 2464	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	40
PID 2832 wrote to memory of 2440	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	41
PID 2832 wrote to memory of 2440	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	41
PID 2832 wrote to memory of 2440	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	41
PID 2832 wrote to memory of 2528	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	42
PID 2832 wrote to memory of 2528	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	42
PID 2832 wrote to memory of 2528	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	42
PID 2832 wrote to memory of 2984	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	43
PID 2832 wrote to memory of 2984	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	43
PID 2832 wrote to memory of 2984	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	43
PID 2832 wrote to memory of 1676	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	44
PID 2832 wrote to memory of 1676	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	44
PID 2832 wrote to memory of 1676	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	44
PID 2832 wrote to memory of 2176	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	45
PID 2832 wrote to memory of 2176	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	45
PID 2832 wrote to memory of 2176	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	45
PID 2832 wrote to memory of 1800	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	46
PID 2832 wrote to memory of 1800	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	46
PID 2832 wrote to memory of 1800	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	46
PID 2832 wrote to memory of 2336	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	47
PID 2832 wrote to memory of 2336	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	47
PID 2832 wrote to memory of 2336	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	47
PID 2832 wrote to memory of 1848	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	48
PID 2832 wrote to memory of 1848	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	48
PID 2832 wrote to memory of 1848	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	48
PID 2832 wrote to memory of 2172	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	49
PID 2832 wrote to memory of 2172	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	49
PID 2832 wrote to memory of 2172	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	49
PID 2832 wrote to memory of 1836	2832	0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c8cb8340e3219f4a6c25a90e7ffacaa_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System\KahUhbG.exe
  C:\Windows\System\KahUhbG.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\nQlGpzv.exe
  C:\Windows\System\nQlGpzv.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\dCjNGPV.exe
  C:\Windows\System\dCjNGPV.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\TrLiUzp.exe
  C:\Windows\System\TrLiUzp.exe
  2⤵
  - Executes dropped EXE
  PID:3024
- C:\Windows\System\qyNkxhV.exe
  C:\Windows\System\qyNkxhV.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\LKinpas.exe
  C:\Windows\System\LKinpas.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\DJowFNB.exe
  C:\Windows\System\DJowFNB.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\gQmPACh.exe
  C:\Windows\System\gQmPACh.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\GnHLDGN.exe
  C:\Windows\System\GnHLDGN.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\ZwpXgCA.exe
  C:\Windows\System\ZwpXgCA.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\NPUXkKr.exe
  C:\Windows\System\NPUXkKr.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\SJiuzJG.exe
  C:\Windows\System\SJiuzJG.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\GhCdUAU.exe
  C:\Windows\System\GhCdUAU.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\HlrbFxP.exe
  C:\Windows\System\HlrbFxP.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\xJKQRAW.exe
  C:\Windows\System\xJKQRAW.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\CBddVjZ.exe
  C:\Windows\System\CBddVjZ.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\rjovaFx.exe
  C:\Windows\System\rjovaFx.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\cNlywlO.exe
  C:\Windows\System\cNlywlO.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\yhiPJsa.exe
  C:\Windows\System\yhiPJsa.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\oIBHoUj.exe
  C:\Windows\System\oIBHoUj.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\xXyLQPY.exe
  C:\Windows\System\xXyLQPY.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\hhDqbQX.exe
  C:\Windows\System\hhDqbQX.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\iFmXwvb.exe
  C:\Windows\System\iFmXwvb.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\zSxHCMZ.exe
  C:\Windows\System\zSxHCMZ.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\hJUJvHm.exe
  C:\Windows\System\hJUJvHm.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\hTdYdhh.exe
  C:\Windows\System\hTdYdhh.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\zXsahqz.exe
  C:\Windows\System\zXsahqz.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\WVMVBsV.exe
  C:\Windows\System\WVMVBsV.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\jrcxOMu.exe
  C:\Windows\System\jrcxOMu.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\liyzrWP.exe
  C:\Windows\System\liyzrWP.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\wzllrRL.exe
  C:\Windows\System\wzllrRL.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\zZtQRMg.exe
  C:\Windows\System\zZtQRMg.exe
  2⤵
  - Executes dropped EXE
  PID:716
- C:\Windows\System\IMeUXBN.exe
  C:\Windows\System\IMeUXBN.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\gHAaKTc.exe
  C:\Windows\System\gHAaKTc.exe
  2⤵
  - Executes dropped EXE
  PID:1432
- C:\Windows\System\RwjHpAF.exe
  C:\Windows\System\RwjHpAF.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\oBqzjRG.exe
  C:\Windows\System\oBqzjRG.exe
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Windows\System\ceGuRHI.exe
  C:\Windows\System\ceGuRHI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\OMExTXG.exe
  C:\Windows\System\OMExTXG.exe
  2⤵
  - Executes dropped EXE
  PID:1084
- C:\Windows\System\qZZZJev.exe
  C:\Windows\System\qZZZJev.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\vVmDjiy.exe
  C:\Windows\System\vVmDjiy.exe
  2⤵
  - Executes dropped EXE
  PID:288
- C:\Windows\System\wsCNKQv.exe
  C:\Windows\System\wsCNKQv.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\curyeuS.exe
  C:\Windows\System\curyeuS.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\nALuxxC.exe
  C:\Windows\System\nALuxxC.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\HoFVJHl.exe
  C:\Windows\System\HoFVJHl.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\RngZppQ.exe
  C:\Windows\System\RngZppQ.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\qxWlYuQ.exe
  C:\Windows\System\qxWlYuQ.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\rzCpdaA.exe
  C:\Windows\System\rzCpdaA.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\wTYtXaW.exe
  C:\Windows\System\wTYtXaW.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\xTFkzZF.exe
  C:\Windows\System\xTFkzZF.exe
  2⤵
  - Executes dropped EXE
  PID:360
- C:\Windows\System\plwAEUp.exe
  C:\Windows\System\plwAEUp.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\vooXkBS.exe
  C:\Windows\System\vooXkBS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\uShuFXC.exe
  C:\Windows\System\uShuFXC.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\TNwEWeM.exe
  C:\Windows\System\TNwEWeM.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\wGBmxyW.exe
  C:\Windows\System\wGBmxyW.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\auTjMra.exe
  C:\Windows\System\auTjMra.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\VEJVQDk.exe
  C:\Windows\System\VEJVQDk.exe
  2⤵
  PID:2556
- C:\Windows\System\uhFwRSL.exe
  C:\Windows\System\uhFwRSL.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\zrLxZMP.exe
  C:\Windows\System\zrLxZMP.exe
  2⤵
  PID:2648
- C:\Windows\System\IvSoPAv.exe
  C:\Windows\System\IvSoPAv.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\ekIyeUM.exe
  C:\Windows\System\ekIyeUM.exe
  2⤵
  PID:2292
- C:\Windows\System\yZvPGws.exe
  C:\Windows\System\yZvPGws.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\AaElryR.exe
  C:\Windows\System\AaElryR.exe
  2⤵
  PID:1636
- C:\Windows\System\OwEMrkj.exe
  C:\Windows\System\OwEMrkj.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\YuTzlwC.exe
  C:\Windows\System\YuTzlwC.exe
  2⤵
  PID:1264
- C:\Windows\System\EYAbRXS.exe
  C:\Windows\System\EYAbRXS.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\ixpTNie.exe
  C:\Windows\System\ixpTNie.exe
  2⤵
  PID:684
- C:\Windows\System\dUzgOdr.exe
  C:\Windows\System\dUzgOdr.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\rCJFjFV.exe
  C:\Windows\System\rCJFjFV.exe
  2⤵
  PID:1888
- C:\Windows\System\mNtenJn.exe
  C:\Windows\System\mNtenJn.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\jsCYGqv.exe
  C:\Windows\System\jsCYGqv.exe
  2⤵
  PID:2996
- C:\Windows\System\KyhlpVi.exe
  C:\Windows\System\KyhlpVi.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\QXCWiAW.exe
  C:\Windows\System\QXCWiAW.exe
  2⤵
  PID:1652
- C:\Windows\System\BBBjTNZ.exe
  C:\Windows\System\BBBjTNZ.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\xkFptmh.exe
  C:\Windows\System\xkFptmh.exe
  2⤵
  PID:2724
- C:\Windows\System\lMnZraZ.exe
  C:\Windows\System\lMnZraZ.exe
  2⤵
  PID:1716
- C:\Windows\System\uGOYTQx.exe
  C:\Windows\System\uGOYTQx.exe
  2⤵
  PID:1648
- C:\Windows\System\UXwJdNM.exe
  C:\Windows\System\UXwJdNM.exe
  2⤵
  PID:1840
- C:\Windows\System\vPpAlvR.exe
  C:\Windows\System\vPpAlvR.exe
  2⤵
  PID:2328
- C:\Windows\System\UdDoHJU.exe
  C:\Windows\System\UdDoHJU.exe
  2⤵
  PID:2968
- C:\Windows\System\jayFdmg.exe
  C:\Windows\System\jayFdmg.exe
  2⤵
  PID:532
- C:\Windows\System\voFznmB.exe
  C:\Windows\System\voFznmB.exe
  2⤵
  PID:1688
- C:\Windows\System\QOwYpwI.exe
  C:\Windows\System\QOwYpwI.exe
  2⤵
  PID:272
- C:\Windows\System\BMHJvgg.exe
  C:\Windows\System\BMHJvgg.exe
  2⤵
  PID:1876
- C:\Windows\System\AxegDQy.exe
  C:\Windows\System\AxegDQy.exe
  2⤵
  PID:3064
- C:\Windows\System\dkxWJSq.exe
  C:\Windows\System\dkxWJSq.exe
  2⤵
  PID:2276
- C:\Windows\System\kPNXxhG.exe
  C:\Windows\System\kPNXxhG.exe
  2⤵
  PID:2948
- C:\Windows\System\hbRBNIc.exe
  C:\Windows\System\hbRBNIc.exe
  2⤵
  PID:2716
- C:\Windows\System\AZEoITB.exe
  C:\Windows\System\AZEoITB.exe
  2⤵
  PID:3088
- C:\Windows\System\YHwjBUx.exe
  C:\Windows\System\YHwjBUx.exe
  2⤵
  PID:3108
- C:\Windows\System\zdCpyyx.exe
  C:\Windows\System\zdCpyyx.exe
  2⤵
  PID:3124
- C:\Windows\System\OKPXpoF.exe
  C:\Windows\System\OKPXpoF.exe
  2⤵
  PID:3144
- C:\Windows\System\VzSAzAR.exe
  C:\Windows\System\VzSAzAR.exe
  2⤵
  PID:3160
- C:\Windows\System\HZeWeJd.exe
  C:\Windows\System\HZeWeJd.exe
  2⤵
  PID:3184
- C:\Windows\System\UYOKpxx.exe
  C:\Windows\System\UYOKpxx.exe
  2⤵
  PID:3200
- C:\Windows\System\xjjOWit.exe
  C:\Windows\System\xjjOWit.exe
  2⤵
  PID:3216
- C:\Windows\System\oZsEvfh.exe
  C:\Windows\System\oZsEvfh.exe
  2⤵
  PID:3236
- C:\Windows\System\JvuvnMd.exe
  C:\Windows\System\JvuvnMd.exe
  2⤵
  PID:3252
- C:\Windows\System\AzdoIVu.exe
  C:\Windows\System\AzdoIVu.exe
  2⤵
  PID:3272
- C:\Windows\System\avoWWpK.exe
  C:\Windows\System\avoWWpK.exe
  2⤵
  PID:3300
- C:\Windows\System\XdMScZj.exe
  C:\Windows\System\XdMScZj.exe
  2⤵
  PID:3316
- C:\Windows\System\LhlLLcm.exe
  C:\Windows\System\LhlLLcm.exe
  2⤵
  PID:3336
- C:\Windows\System\VDoiEJX.exe
  C:\Windows\System\VDoiEJX.exe
  2⤵
  PID:3352
- C:\Windows\System\GWwLTCv.exe
  C:\Windows\System\GWwLTCv.exe
  2⤵
  PID:3372
- C:\Windows\System\LCCjHjJ.exe
  C:\Windows\System\LCCjHjJ.exe
  2⤵
  PID:3388
- C:\Windows\System\YKyPNTR.exe
  C:\Windows\System\YKyPNTR.exe
  2⤵
  PID:3404
- C:\Windows\System\qmqbrHK.exe
  C:\Windows\System\qmqbrHK.exe
  2⤵
  PID:3420
- C:\Windows\System\anZvPPF.exe
  C:\Windows\System\anZvPPF.exe
  2⤵
  PID:3436
- C:\Windows\System\JdnxraD.exe
  C:\Windows\System\JdnxraD.exe
  2⤵
  PID:3456
- C:\Windows\System\kPnunpm.exe
  C:\Windows\System\kPnunpm.exe
  2⤵
  PID:3472
- C:\Windows\System\XSNcHsJ.exe
  C:\Windows\System\XSNcHsJ.exe
  2⤵
  PID:3488
- C:\Windows\System\wEnEvpo.exe
  C:\Windows\System\wEnEvpo.exe
  2⤵
  PID:3504
- C:\Windows\System\UdzTOmh.exe
  C:\Windows\System\UdzTOmh.exe
  2⤵
  PID:3524
- C:\Windows\System\JOiQtsR.exe
  C:\Windows\System\JOiQtsR.exe
  2⤵
  PID:3544
- C:\Windows\System\SRRTHmF.exe
  C:\Windows\System\SRRTHmF.exe
  2⤵
  PID:3560
- C:\Windows\System\PKXezxK.exe
  C:\Windows\System\PKXezxK.exe
  2⤵
  PID:3580
- C:\Windows\System\qgyoAuB.exe
  C:\Windows\System\qgyoAuB.exe
  2⤵
  PID:3600
- C:\Windows\System\FAltzrr.exe
  C:\Windows\System\FAltzrr.exe
  2⤵
  PID:3616
- C:\Windows\System\WBerPFG.exe
  C:\Windows\System\WBerPFG.exe
  2⤵
  PID:3640
- C:\Windows\System\bjbLAES.exe
  C:\Windows\System\bjbLAES.exe
  2⤵
  PID:3656
- C:\Windows\System\LtpHQZK.exe
  C:\Windows\System\LtpHQZK.exe
  2⤵
  PID:3676
- C:\Windows\System\WTXQxLJ.exe
  C:\Windows\System\WTXQxLJ.exe
  2⤵
  PID:3780
- C:\Windows\System\nYiZOXf.exe
  C:\Windows\System\nYiZOXf.exe
  2⤵
  PID:3796
- C:\Windows\System\NCYvqoE.exe
  C:\Windows\System\NCYvqoE.exe
  2⤵
  PID:3812
- C:\Windows\System\YhUTmcj.exe
  C:\Windows\System\YhUTmcj.exe
  2⤵
  PID:3832
- C:\Windows\System\XiihDBd.exe
  C:\Windows\System\XiihDBd.exe
  2⤵
  PID:3852
- C:\Windows\System\xEWirKD.exe
  C:\Windows\System\xEWirKD.exe
  2⤵
  PID:3868
- C:\Windows\System\ypSUmrm.exe
  C:\Windows\System\ypSUmrm.exe
  2⤵
  PID:3884
- C:\Windows\System\EfluXMv.exe
  C:\Windows\System\EfluXMv.exe
  2⤵
  PID:3900
- C:\Windows\System\gsEilUc.exe
  C:\Windows\System\gsEilUc.exe
  2⤵
  PID:3916
- C:\Windows\System\qbEBaDS.exe
  C:\Windows\System\qbEBaDS.exe
  2⤵
  PID:3932
- C:\Windows\System\PCBNlRd.exe
  C:\Windows\System\PCBNlRd.exe
  2⤵
  PID:3948
- C:\Windows\System\pkTnAkw.exe
  C:\Windows\System\pkTnAkw.exe
  2⤵
  PID:4012
- C:\Windows\System\jILWkzQ.exe
  C:\Windows\System\jILWkzQ.exe
  2⤵
  PID:4032
- C:\Windows\System\mFmMrjx.exe
  C:\Windows\System\mFmMrjx.exe
  2⤵
  PID:4048
- C:\Windows\System\gCGJZal.exe
  C:\Windows\System\gCGJZal.exe
  2⤵
  PID:4064
- C:\Windows\System\wWfGkNU.exe
  C:\Windows\System\wWfGkNU.exe
  2⤵
  PID:4080
- C:\Windows\System\HyMPQJO.exe
  C:\Windows\System\HyMPQJO.exe
  2⤵
  PID:324
- C:\Windows\System\NxHxQgC.exe
  C:\Windows\System\NxHxQgC.exe
  2⤵
  PID:1596
- C:\Windows\System\ePoIqyg.exe
  C:\Windows\System\ePoIqyg.exe
  2⤵
  PID:1540
- C:\Windows\System\VFKEnbr.exe
  C:\Windows\System\VFKEnbr.exe
  2⤵
  PID:1572
- C:\Windows\System\giUbcRV.exe
  C:\Windows\System\giUbcRV.exe
  2⤵
  PID:2184
- C:\Windows\System\eYetWmJ.exe
  C:\Windows\System\eYetWmJ.exe
  2⤵
  PID:2112
- C:\Windows\System\JkYPmys.exe
  C:\Windows\System\JkYPmys.exe
  2⤵
  PID:2004
- C:\Windows\System\STkLcDY.exe
  C:\Windows\System\STkLcDY.exe
  2⤵
  PID:3084
- C:\Windows\System\noibZHW.exe
  C:\Windows\System\noibZHW.exe
  2⤵
  PID:3152
- C:\Windows\System\dMeMRia.exe
  C:\Windows\System\dMeMRia.exe
  2⤵
  PID:3260
- C:\Windows\System\KlDNoQj.exe
  C:\Windows\System\KlDNoQj.exe
  2⤵
  PID:2672
- C:\Windows\System\IogtLpu.exe
  C:\Windows\System\IogtLpu.exe
  2⤵
  PID:3380
- C:\Windows\System\zHumVUR.exe
  C:\Windows\System\zHumVUR.exe
  2⤵
  PID:2536
- C:\Windows\System\BsCZjVT.exe
  C:\Windows\System\BsCZjVT.exe
  2⤵
  PID:2644
- C:\Windows\System\fDnXYdE.exe
  C:\Windows\System\fDnXYdE.exe
  2⤵
  PID:2624
- C:\Windows\System\uQhaCcc.exe
  C:\Windows\System\uQhaCcc.exe
  2⤵
  PID:3516
- C:\Windows\System\CNpFdIv.exe
  C:\Windows\System\CNpFdIv.exe
  2⤵
  PID:3596
- C:\Windows\System\KKMXLCo.exe
  C:\Windows\System\KKMXLCo.exe
  2⤵
  PID:3636
- C:\Windows\System\SKlcItq.exe
  C:\Windows\System\SKlcItq.exe
  2⤵
  PID:3668
- C:\Windows\System\srIzKgk.exe
  C:\Windows\System\srIzKgk.exe
  2⤵
  PID:2732
- C:\Windows\System\sImhduw.exe
  C:\Windows\System\sImhduw.exe
  2⤵
  PID:2808
- C:\Windows\System\jedJRRS.exe
  C:\Windows\System\jedJRRS.exe
  2⤵
  PID:1968
- C:\Windows\System\lVhSnkV.exe
  C:\Windows\System\lVhSnkV.exe
  2⤵
  PID:1844
- C:\Windows\System\TSpKBgy.exe
  C:\Windows\System\TSpKBgy.exe
  2⤵
  PID:2508
- C:\Windows\System\VAKRcLU.exe
  C:\Windows\System\VAKRcLU.exe
  2⤵
  PID:2136
- C:\Windows\System\kfJHORg.exe
  C:\Windows\System\kfJHORg.exe
  2⤵
  PID:2652
- C:\Windows\System\oMEnPZm.exe
  C:\Windows\System\oMEnPZm.exe
  2⤵
  PID:1620
- C:\Windows\System\VIzEhrL.exe
  C:\Windows\System\VIzEhrL.exe
  2⤵
  PID:2152
- C:\Windows\System\mhHZgQb.exe
  C:\Windows\System\mhHZgQb.exe
  2⤵
  PID:644
- C:\Windows\System\IykaawB.exe
  C:\Windows\System\IykaawB.exe
  2⤵
  PID:3056
- C:\Windows\System\adXJbXx.exe
  C:\Windows\System\adXJbXx.exe
  2⤵
  PID:1976
- C:\Windows\System\gPFkSLx.exe
  C:\Windows\System\gPFkSLx.exe
  2⤵
  PID:2564
- C:\Windows\System\gGiYADG.exe
  C:\Windows\System\gGiYADG.exe
  2⤵
  PID:2660
- C:\Windows\System\ZnndimH.exe
  C:\Windows\System\ZnndimH.exe
  2⤵
  PID:384
- C:\Windows\System\WpVhBDP.exe
  C:\Windows\System\WpVhBDP.exe
  2⤵
  PID:1420
- C:\Windows\System\GQtbnCw.exe
  C:\Windows\System\GQtbnCw.exe
  2⤵
  PID:1788
- C:\Windows\System\xoEkAwR.exe
  C:\Windows\System\xoEkAwR.exe
  2⤵
  PID:2864
- C:\Windows\System\vKRTCPQ.exe
  C:\Windows\System\vKRTCPQ.exe
  2⤵
  PID:3788
- C:\Windows\System\FQUvzkd.exe
  C:\Windows\System\FQUvzkd.exe
  2⤵
  PID:2008
- C:\Windows\System\FSVoppZ.exe
  C:\Windows\System\FSVoppZ.exe
  2⤵
  PID:3136
- C:\Windows\System\cTnPvPX.exe
  C:\Windows\System\cTnPvPX.exe
  2⤵
  PID:3976
- C:\Windows\System\TFAwIvJ.exe
  C:\Windows\System\TFAwIvJ.exe
  2⤵
  PID:3992
- C:\Windows\System\ARLaWQP.exe
  C:\Windows\System\ARLaWQP.exe
  2⤵
  PID:3708
- C:\Windows\System\pxvdJqT.exe
  C:\Windows\System\pxvdJqT.exe
  2⤵
  PID:3728
- C:\Windows\System\lvlsXii.exe
  C:\Windows\System\lvlsXii.exe
  2⤵
  PID:3752
- C:\Windows\System\svgheER.exe
  C:\Windows\System\svgheER.exe
  2⤵
  PID:3292
- C:\Windows\System\yrQjGuB.exe
  C:\Windows\System\yrQjGuB.exe
  2⤵
  PID:3212
- C:\Windows\System\tzUKDev.exe
  C:\Windows\System\tzUKDev.exe
  2⤵
  PID:3140
- C:\Windows\System\usRongS.exe
  C:\Windows\System\usRongS.exe
  2⤵
  PID:2876
- C:\Windows\System\waXWOsy.exe
  C:\Windows\System\waXWOsy.exe
  2⤵
  PID:2544
- C:\Windows\System\LuxrFOG.exe
  C:\Windows\System\LuxrFOG.exe
  2⤵
  PID:3808
- C:\Windows\System\QhFQohw.exe
  C:\Windows\System\QhFQohw.exe
  2⤵
  PID:3876
- C:\Windows\System\ULnZYdi.exe
  C:\Windows\System\ULnZYdi.exe
  2⤵
  PID:4040
- C:\Windows\System\eVzyxeO.exe
  C:\Windows\System\eVzyxeO.exe
  2⤵
  PID:2360
- C:\Windows\System\uwEonfb.exe
  C:\Windows\System\uwEonfb.exe
  2⤵
  PID:1152
- C:\Windows\System\OUurcWg.exe
  C:\Windows\System\OUurcWg.exe
  2⤵
  PID:3080
- C:\Windows\System\QbMgXZD.exe
  C:\Windows\System\QbMgXZD.exe
  2⤵
  PID:3344
- C:\Windows\System\zZYFdPy.exe
  C:\Windows\System\zZYFdPy.exe
  2⤵
  PID:3512
- C:\Windows\System\FNNXsNU.exe
  C:\Windows\System\FNNXsNU.exe
  2⤵
  PID:2800
- C:\Windows\System\TcSxmUk.exe
  C:\Windows\System\TcSxmUk.exe
  2⤵
  PID:2484
- C:\Windows\System\RUYTVIq.exe
  C:\Windows\System\RUYTVIq.exe
  2⤵
  PID:4060
- C:\Windows\System\MVXAiYE.exe
  C:\Windows\System\MVXAiYE.exe
  2⤵
  PID:932
- C:\Windows\System\xtHkjzi.exe
  C:\Windows\System\xtHkjzi.exe
  2⤵
  PID:2252
- C:\Windows\System\OarltYF.exe
  C:\Windows\System\OarltYF.exe
  2⤵
  PID:608
- C:\Windows\System\AZGeSZZ.exe
  C:\Windows\System\AZGeSZZ.exe
  2⤵
  PID:2380
- C:\Windows\System\yyebbFn.exe
  C:\Windows\System\yyebbFn.exe
  2⤵
  PID:604
- C:\Windows\System\xKnxnAD.exe
  C:\Windows\System\xKnxnAD.exe
  2⤵
  PID:3588
- C:\Windows\System\PQnVRjn.exe
  C:\Windows\System\PQnVRjn.exe
  2⤵
  PID:3308
- C:\Windows\System\hFLaLPH.exe
  C:\Windows\System\hFLaLPH.exe
  2⤵
  PID:1580
- C:\Windows\System\IXwJwtL.exe
  C:\Windows\System\IXwJwtL.exe
  2⤵
  PID:2688
- C:\Windows\System\hZOyywL.exe
  C:\Windows\System\hZOyywL.exe
  2⤵
  PID:1704
- C:\Windows\System\CGFehfI.exe
  C:\Windows\System\CGFehfI.exe
  2⤵
  PID:3896
- C:\Windows\System\emDuoMV.exe
  C:\Windows\System\emDuoMV.exe
  2⤵
  PID:1820
- C:\Windows\System\kPqGomI.exe
  C:\Windows\System\kPqGomI.exe
  2⤵
  PID:3280
- C:\Windows\System\AmgyUaN.exe
  C:\Windows\System\AmgyUaN.exe
  2⤵
  PID:3324
- C:\Windows\System\OelOJPM.exe
  C:\Windows\System\OelOJPM.exe
  2⤵
  PID:3364
- C:\Windows\System\VCJkAZg.exe
  C:\Windows\System\VCJkAZg.exe
  2⤵
  PID:3400
- C:\Windows\System\afTKzXy.exe
  C:\Windows\System\afTKzXy.exe
  2⤵
  PID:3496
- C:\Windows\System\gKiEIQJ.exe
  C:\Windows\System\gKiEIQJ.exe
  2⤵
  PID:3540
- C:\Windows\System\hsEKuYQ.exe
  C:\Windows\System\hsEKuYQ.exe
  2⤵
  PID:3608
- C:\Windows\System\itxaxmP.exe
  C:\Windows\System\itxaxmP.exe
  2⤵
  PID:3940
- C:\Windows\System\BZAnfhE.exe
  C:\Windows\System\BZAnfhE.exe
  2⤵
  PID:2596
- C:\Windows\System\qCcQyEs.exe
  C:\Windows\System\qCcQyEs.exe
  2⤵
  PID:3756
- C:\Windows\System\nOGhiOc.exe
  C:\Windows\System\nOGhiOc.exe
  2⤵
  PID:2560
- C:\Windows\System\vPMWcFL.exe
  C:\Windows\System\vPMWcFL.exe
  2⤵
  PID:2420
- C:\Windows\System\ZqZfNtM.exe
  C:\Windows\System\ZqZfNtM.exe
  2⤵
  PID:3744
- C:\Windows\System\BKjdgKL.exe
  C:\Windows\System\BKjdgKL.exe
  2⤵
  PID:4076
- C:\Windows\System\HoUKKTS.exe
  C:\Windows\System\HoUKKTS.exe
  2⤵
  PID:3452
- C:\Windows\System\VMCHWzt.exe
  C:\Windows\System\VMCHWzt.exe
  2⤵
  PID:1480
- C:\Windows\System\yHeIXQW.exe
  C:\Windows\System\yHeIXQW.exe
  2⤵
  PID:3208
- C:\Windows\System\XVhyzIH.exe
  C:\Windows\System\XVhyzIH.exe
  2⤵
  PID:3804
- C:\Windows\System\iytGwcx.exe
  C:\Windows\System\iytGwcx.exe
  2⤵
  PID:1960
- C:\Windows\System\zVStcCR.exe
  C:\Windows\System\zVStcCR.exe
  2⤵
  PID:4028
- C:\Windows\System\dPBOSIe.exe
  C:\Windows\System\dPBOSIe.exe
  2⤵
  PID:3736
- C:\Windows\System\lnqKXJp.exe
  C:\Windows\System\lnqKXJp.exe
  2⤵
  PID:1224
- C:\Windows\System\HWCrMmU.exe
  C:\Windows\System\HWCrMmU.exe
  2⤵
  PID:2540
- C:\Windows\System\mlnClUk.exe
  C:\Windows\System\mlnClUk.exe
  2⤵
  PID:1692
- C:\Windows\System\RdOScxA.exe
  C:\Windows\System\RdOScxA.exe
  2⤵
  PID:2788
- C:\Windows\System\PVjJCuG.exe
  C:\Windows\System\PVjJCuG.exe
  2⤵
  PID:3824
- C:\Windows\System\KBXSHaH.exe
  C:\Windows\System\KBXSHaH.exe
  2⤵
  PID:3700
- C:\Windows\System\umIpdSJ.exe
  C:\Windows\System\umIpdSJ.exe
  2⤵
  PID:3864
- C:\Windows\System\bMsxrPZ.exe
  C:\Windows\System\bMsxrPZ.exe
  2⤵
  PID:2448
- C:\Windows\System\JmdavBt.exe
  C:\Windows\System\JmdavBt.exe
  2⤵
  PID:4140
- C:\Windows\System\kBtuiyl.exe
  C:\Windows\System\kBtuiyl.exe
  2⤵
  PID:4156
- C:\Windows\System\jHsGCvc.exe
  C:\Windows\System\jHsGCvc.exe
  2⤵
  PID:4176
- C:\Windows\System\CeduFjq.exe
  C:\Windows\System\CeduFjq.exe
  2⤵
  PID:4192
- C:\Windows\System\usKosZf.exe
  C:\Windows\System\usKosZf.exe
  2⤵
  PID:4208
- C:\Windows\System\roBpvOC.exe
  C:\Windows\System\roBpvOC.exe
  2⤵
  PID:4224
- C:\Windows\System\CuXBuAU.exe
  C:\Windows\System\CuXBuAU.exe
  2⤵
  PID:4240
- C:\Windows\System\EcRGvvh.exe
  C:\Windows\System\EcRGvvh.exe
  2⤵
  PID:4264
- C:\Windows\System\NhuuUJJ.exe
  C:\Windows\System\NhuuUJJ.exe
  2⤵
  PID:4304
- C:\Windows\System\xFAKVxh.exe
  C:\Windows\System\xFAKVxh.exe
  2⤵
  PID:4320
- C:\Windows\System\UncLqOV.exe
  C:\Windows\System\UncLqOV.exe
  2⤵
  PID:4336
- C:\Windows\System\ilbtlMi.exe
  C:\Windows\System\ilbtlMi.exe
  2⤵
  PID:4352
- C:\Windows\System\vzfRzjs.exe
  C:\Windows\System\vzfRzjs.exe
  2⤵
  PID:4368
- C:\Windows\System\AHVgmej.exe
  C:\Windows\System\AHVgmej.exe
  2⤵
  PID:4388
- C:\Windows\System\PBieUTD.exe
  C:\Windows\System\PBieUTD.exe
  2⤵
  PID:4404
- C:\Windows\System\ZklzUeM.exe
  C:\Windows\System\ZklzUeM.exe
  2⤵
  PID:4420
- C:\Windows\System\tWqHlgy.exe
  C:\Windows\System\tWqHlgy.exe
  2⤵
  PID:4440
- C:\Windows\System\cWUZNHJ.exe
  C:\Windows\System\cWUZNHJ.exe
  2⤵
  PID:4456
- C:\Windows\System\fUpqpbp.exe
  C:\Windows\System\fUpqpbp.exe
  2⤵
  PID:4472
- C:\Windows\System\BIfHfNj.exe
  C:\Windows\System\BIfHfNj.exe
  2⤵
  PID:4488
- C:\Windows\System\xEfWxnf.exe
  C:\Windows\System\xEfWxnf.exe
  2⤵
  PID:4504
- C:\Windows\System\gHxahkD.exe
  C:\Windows\System\gHxahkD.exe
  2⤵
  PID:4520
- C:\Windows\System\IVWewjg.exe
  C:\Windows\System\IVWewjg.exe
  2⤵
  PID:4540
- C:\Windows\System\JfbcWSS.exe
  C:\Windows\System\JfbcWSS.exe
  2⤵
  PID:4556
- C:\Windows\System\GqADWdl.exe
  C:\Windows\System\GqADWdl.exe
  2⤵
  PID:4576
- C:\Windows\System\JupFlKf.exe
  C:\Windows\System\JupFlKf.exe
  2⤵
  PID:4592
- C:\Windows\System\IjJypGv.exe
  C:\Windows\System\IjJypGv.exe
  2⤵
  PID:4608
- C:\Windows\System\lopKVVE.exe
  C:\Windows\System\lopKVVE.exe
  2⤵
  PID:4624
- C:\Windows\System\UGpUkUG.exe
  C:\Windows\System\UGpUkUG.exe
  2⤵
  PID:4640
- C:\Windows\System\xlPVEYl.exe
  C:\Windows\System\xlPVEYl.exe
  2⤵
  PID:4656
- C:\Windows\System\kBbDBxc.exe
  C:\Windows\System\kBbDBxc.exe
  2⤵
  PID:4672
- C:\Windows\System\NtehTBz.exe
  C:\Windows\System\NtehTBz.exe
  2⤵
  PID:4696
- C:\Windows\System\dJPIfbv.exe
  C:\Windows\System\dJPIfbv.exe
  2⤵
  PID:4712
- C:\Windows\System\LJAbOSc.exe
  C:\Windows\System\LJAbOSc.exe
  2⤵
  PID:4748
- C:\Windows\System\DjwRkHH.exe
  C:\Windows\System\DjwRkHH.exe
  2⤵
  PID:4780
- C:\Windows\System\XyEVuRW.exe
  C:\Windows\System\XyEVuRW.exe
  2⤵
  PID:4804
- C:\Windows\System\TrUtQaA.exe
  C:\Windows\System\TrUtQaA.exe
  2⤵
  PID:4820
- C:\Windows\System\AfDGndk.exe
  C:\Windows\System\AfDGndk.exe
  2⤵
  PID:4836
- C:\Windows\System\RqKHPMP.exe
  C:\Windows\System\RqKHPMP.exe
  2⤵
  PID:4852
- C:\Windows\System\OpxnNhE.exe
  C:\Windows\System\OpxnNhE.exe
  2⤵
  PID:4868
- C:\Windows\System\NYelOft.exe
  C:\Windows\System\NYelOft.exe
  2⤵
  PID:4884
- C:\Windows\System\tZWbKLn.exe
  C:\Windows\System\tZWbKLn.exe
  2⤵
  PID:4900
- C:\Windows\System\KzmriAd.exe
  C:\Windows\System\KzmriAd.exe
  2⤵
  PID:4916
- C:\Windows\System\SMbVpqs.exe
  C:\Windows\System\SMbVpqs.exe
  2⤵
  PID:4932
- C:\Windows\System\UvmhsnK.exe
  C:\Windows\System\UvmhsnK.exe
  2⤵
  PID:5080
- C:\Windows\System\oUpvUvC.exe
  C:\Windows\System\oUpvUvC.exe
  2⤵
  PID:5104
- C:\Windows\System\WPQMdPa.exe
  C:\Windows\System\WPQMdPa.exe
  2⤵
  PID:1892
- C:\Windows\System\uYhVnyp.exe
  C:\Windows\System\uYhVnyp.exe
  2⤵
  PID:3468
- C:\Windows\System\XNNdDBL.exe
  C:\Windows\System\XNNdDBL.exe
  2⤵
  PID:3944
- C:\Windows\System\ciunBRv.exe
  C:\Windows\System\ciunBRv.exe
  2⤵
  PID:2428
- C:\Windows\System\bHTJlnk.exe
  C:\Windows\System\bHTJlnk.exe
  2⤵
  PID:1504
- C:\Windows\System\dFumbKg.exe
  C:\Windows\System\dFumbKg.exe
  2⤵
  PID:3696
- C:\Windows\System\TvUbyRU.exe
  C:\Windows\System\TvUbyRU.exe
  2⤵
  PID:3228
- C:\Windows\System\DWMfPvk.exe
  C:\Windows\System\DWMfPvk.exe
  2⤵
  PID:2080
- C:\Windows\System\BSUjfXP.exe
  C:\Windows\System\BSUjfXP.exe
  2⤵
  PID:3396
- C:\Windows\System\uCdWucp.exe
  C:\Windows\System\uCdWucp.exe
  2⤵
  PID:3984
- C:\Windows\System\zftPAvf.exe
  C:\Windows\System\zftPAvf.exe
  2⤵
  PID:2856
- C:\Windows\System\GAswyTk.exe
  C:\Windows\System\GAswyTk.exe
  2⤵
  PID:1808
- C:\Windows\System\cKDLnhJ.exe
  C:\Windows\System\cKDLnhJ.exe
  2⤵
  PID:1372
- C:\Windows\System\iTvACNF.exe
  C:\Windows\System\iTvACNF.exe
  2⤵
  PID:3720
- C:\Windows\System\FxIKzMB.exe
  C:\Windows\System\FxIKzMB.exe
  2⤵
  PID:4360
- C:\Windows\System\ZaGEFzY.exe
  C:\Windows\System\ZaGEFzY.exe
  2⤵
  PID:4400
- C:\Windows\System\dEteIrk.exe
  C:\Windows\System\dEteIrk.exe
  2⤵
  PID:4496
- C:\Windows\System\CaYPJzV.exe
  C:\Windows\System\CaYPJzV.exe
  2⤵
  PID:4572
- C:\Windows\System\IDnEZCG.exe
  C:\Windows\System\IDnEZCG.exe
  2⤵
  PID:1056
- C:\Windows\System\nQTarOF.exe
  C:\Windows\System\nQTarOF.exe
  2⤵
  PID:4152
- C:\Windows\System\kZSZLMy.exe
  C:\Windows\System\kZSZLMy.exe
  2⤵
  PID:4448
- C:\Windows\System\enoyNFa.exe
  C:\Windows\System\enoyNFa.exe
  2⤵
  PID:4548
- C:\Windows\System\yIbgFBA.exe
  C:\Windows\System\yIbgFBA.exe
  2⤵
  PID:4516
- C:\Windows\System\oOXBquH.exe
  C:\Windows\System\oOXBquH.exe
  2⤵
  PID:4620
- C:\Windows\System\UyHDYtQ.exe
  C:\Windows\System\UyHDYtQ.exe
  2⤵
  PID:4220
- C:\Windows\System\rnbWVUf.exe
  C:\Windows\System\rnbWVUf.exe
  2⤵
  PID:4184
- C:\Windows\System\DmfBsYo.exe
  C:\Windows\System\DmfBsYo.exe
  2⤵
  PID:4348
- C:\Windows\System\eImEyHr.exe
  C:\Windows\System\eImEyHr.exe
  2⤵
  PID:4164
- C:\Windows\System\pNSyKof.exe
  C:\Windows\System\pNSyKof.exe
  2⤵
  PID:3096
- C:\Windows\System\pINZvSa.exe
  C:\Windows\System\pINZvSa.exe
  2⤵
  PID:4276
- C:\Windows\System\HcYpkje.exe
  C:\Windows\System\HcYpkje.exe
  2⤵
  PID:4292
- C:\Windows\System\DMWEuQV.exe
  C:\Windows\System\DMWEuQV.exe
  2⤵
  PID:4428
- C:\Windows\System\zPTpTMI.exe
  C:\Windows\System\zPTpTMI.exe
  2⤵
  PID:4328
- C:\Windows\System\UyPqMEs.exe
  C:\Windows\System\UyPqMEs.exe
  2⤵
  PID:3028
- C:\Windows\System\vbpywpj.exe
  C:\Windows\System\vbpywpj.exe
  2⤵
  PID:2608
- C:\Windows\System\IUZtUaW.exe
  C:\Windows\System\IUZtUaW.exe
  2⤵
  PID:2888
- C:\Windows\System\FMxkNei.exe
  C:\Windows\System\FMxkNei.exe
  2⤵
  PID:4768
- C:\Windows\System\AksqRmz.exe
  C:\Windows\System\AksqRmz.exe
  2⤵
  PID:1672
- C:\Windows\System\WYYMKHd.exe
  C:\Windows\System\WYYMKHd.exe
  2⤵
  PID:4792
- C:\Windows\System\AALTZtc.exe
  C:\Windows\System\AALTZtc.exe
  2⤵
  PID:2200
- C:\Windows\System\dKzbfFO.exe
  C:\Windows\System\dKzbfFO.exe
  2⤵
  PID:1740
- C:\Windows\System\BsQQfFa.exe
  C:\Windows\System\BsQQfFa.exe
  2⤵
  PID:4844
- C:\Windows\System\RmVKqTq.exe
  C:\Windows\System\RmVKqTq.exe
  2⤵
  PID:4828
- C:\Windows\System\xwNKsmB.exe
  C:\Windows\System\xwNKsmB.exe
  2⤵
  PID:4880
- C:\Windows\System\HMHIxwC.exe
  C:\Windows\System\HMHIxwC.exe
  2⤵
  PID:4912
- C:\Windows\System\huBnyfJ.exe
  C:\Windows\System\huBnyfJ.exe
  2⤵
  PID:2692
- C:\Windows\System\xSEYrXl.exe
  C:\Windows\System\xSEYrXl.exe
  2⤵
  PID:4952
- C:\Windows\System\VEAZARF.exe
  C:\Windows\System\VEAZARF.exe
  2⤵
  PID:852
- C:\Windows\System\PCSCSoN.exe
  C:\Windows\System\PCSCSoN.exe
  2⤵
  PID:336
- C:\Windows\System\piABEhG.exe
  C:\Windows\System\piABEhG.exe
  2⤵
  PID:1732
- C:\Windows\System\YLQiOGq.exe
  C:\Windows\System\YLQiOGq.exe
  2⤵
  PID:4996
- C:\Windows\System\dYFZfjA.exe
  C:\Windows\System\dYFZfjA.exe
  2⤵
  PID:5008
- C:\Windows\System\gXVztiq.exe
  C:\Windows\System\gXVztiq.exe
  2⤵
  PID:5092
- C:\Windows\System\sOZSkzx.exe
  C:\Windows\System\sOZSkzx.exe
  2⤵
  PID:3464
- C:\Windows\System\XVKGKZP.exe
  C:\Windows\System\XVKGKZP.exe
  2⤵
  PID:4072
- C:\Windows\System\ViFWmkn.exe
  C:\Windows\System\ViFWmkn.exe
  2⤵
  PID:3924
- C:\Windows\System\ZbZUgSa.exe
  C:\Windows\System\ZbZUgSa.exe
  2⤵
  PID:1904
- C:\Windows\System\FuPHfYv.exe
  C:\Windows\System\FuPHfYv.exe
  2⤵
  PID:4092
- C:\Windows\System\QIVWAmH.exe
  C:\Windows\System\QIVWAmH.exe
  2⤵
  PID:580
- C:\Windows\System\fqZitUb.exe
  C:\Windows\System\fqZitUb.exe
  2⤵
  PID:4024
- C:\Windows\System\hhagdbF.exe
  C:\Windows\System\hhagdbF.exe
  2⤵
  PID:3776
- C:\Windows\System\kPMcDCo.exe
  C:\Windows\System\kPMcDCo.exe
  2⤵
  PID:4256
- C:\Windows\System\fFqjETI.exe
  C:\Windows\System\fFqjETI.exe
  2⤵
  PID:4684
- C:\Windows\System\YEntKuH.exe
  C:\Windows\System\YEntKuH.exe
  2⤵
  PID:3428
- C:\Windows\System\bMCcyHl.exe
  C:\Windows\System\bMCcyHl.exe
  2⤵
  PID:5088
- C:\Windows\System\ONNHNvU.exe
  C:\Windows\System\ONNHNvU.exe
  2⤵
  PID:1164
- C:\Windows\System\VvEoaod.exe
  C:\Windows\System\VvEoaod.exe
  2⤵
  PID:4412
- C:\Windows\System\rQZKwSw.exe
  C:\Windows\System\rQZKwSw.exe
  2⤵
  PID:4108
- C:\Windows\System\JAjaegJ.exe
  C:\Windows\System\JAjaegJ.exe
  2⤵
  PID:4588
- C:\Windows\System\ReoPCqP.exe
  C:\Windows\System\ReoPCqP.exe
  2⤵
  PID:4484
- C:\Windows\System\ZxCxZNg.exe
  C:\Windows\System\ZxCxZNg.exe
  2⤵
  PID:4652
- C:\Windows\System\WZfkceH.exe
  C:\Windows\System\WZfkceH.exe
  2⤵
  PID:4116
- C:\Windows\System\UMgqRuB.exe
  C:\Windows\System\UMgqRuB.exe
  2⤵
  PID:2268
- C:\Windows\System\qJmVgVW.exe
  C:\Windows\System\qJmVgVW.exe
  2⤵
  PID:4736
- C:\Windows\System\UiIYrdn.exe
  C:\Windows\System\UiIYrdn.exe
  2⤵
  PID:4464
- C:\Windows\System\PEWXWLA.exe
  C:\Windows\System\PEWXWLA.exe
  2⤵
  PID:2524
- C:\Windows\System\VeEHJfc.exe
  C:\Windows\System\VeEHJfc.exe
  2⤵
  PID:4600
- C:\Windows\System\YqKXDhu.exe
  C:\Windows\System\YqKXDhu.exe
  2⤵
  PID:308
- C:\Windows\System\kiOhiVw.exe
  C:\Windows\System\kiOhiVw.exe
  2⤵
  PID:2296
- C:\Windows\System\LJtpDtf.exe
  C:\Windows\System\LJtpDtf.exe
  2⤵
  PID:4964
- C:\Windows\System\ZHhuzGL.exe
  C:\Windows\System\ZHhuzGL.exe
  2⤵
  PID:2368
- C:\Windows\System\kVQUYHW.exe
  C:\Windows\System\kVQUYHW.exe
  2⤵
  PID:4772
- C:\Windows\System\TTgewLm.exe
  C:\Windows\System\TTgewLm.exe
  2⤵
  PID:4892
- C:\Windows\System\gUPDqYd.exe
  C:\Windows\System\gUPDqYd.exe
  2⤵
  PID:2012
- C:\Windows\System\EajXtFb.exe
  C:\Windows\System\EajXtFb.exe
  2⤵
  PID:4812
- C:\Windows\System\vJWEXzO.exe
  C:\Windows\System\vJWEXzO.exe
  2⤵
  PID:4908
- C:\Windows\System\jguWxAp.exe
  C:\Windows\System\jguWxAp.exe
  2⤵
  PID:2104
- C:\Windows\System\ZjNVCUr.exe
  C:\Windows\System\ZjNVCUr.exe
  2⤵
  PID:1160
- C:\Windows\System\Yzunpwn.exe
  C:\Windows\System\Yzunpwn.exe
  2⤵
  PID:1460
- C:\Windows\System\iJtevBQ.exe
  C:\Windows\System\iJtevBQ.exe
  2⤵
  PID:5056
- C:\Windows\System\UGwoFUN.exe
  C:\Windows\System\UGwoFUN.exe
  2⤵
  PID:700
- C:\Windows\System\QYTceUF.exe
  C:\Windows\System\QYTceUF.exe
  2⤵
  PID:320
- C:\Windows\System\yaVdXnO.exe
  C:\Windows\System\yaVdXnO.exe
  2⤵
  PID:5112
- C:\Windows\System\OYhLlzz.exe
  C:\Windows\System\OYhLlzz.exe
  2⤵
  PID:3232
- C:\Windows\System\liPrQNg.exe
  C:\Windows\System\liPrQNg.exe
  2⤵
  PID:3536
- C:\Windows\System\BQqHjbg.exe
  C:\Windows\System\BQqHjbg.exe
  2⤵
  PID:2432
- C:\Windows\System\oqKqCYe.exe
  C:\Windows\System\oqKqCYe.exe
  2⤵
  PID:4148
- C:\Windows\System\pGxihpO.exe
  C:\Windows\System\pGxihpO.exe
  2⤵
  PID:2684
- C:\Windows\System\YyfBBHi.exe
  C:\Windows\System\YyfBBHi.exe
  2⤵
  PID:1684
- C:\Windows\System\ZLLXmFn.exe
  C:\Windows\System\ZLLXmFn.exe
  2⤵
  PID:4636
- C:\Windows\System\rPlFquQ.exe
  C:\Windows\System\rPlFquQ.exe
  2⤵
  PID:1276
- C:\Windows\System\dMmbFin.exe
  C:\Windows\System\dMmbFin.exe
  2⤵
  PID:4584
- C:\Windows\System\EBaeies.exe
  C:\Windows\System\EBaeies.exe
  2⤵
  PID:2452
- C:\Windows\System\PJuADuz.exe
  C:\Windows\System\PJuADuz.exe
  2⤵
  PID:4312
- C:\Windows\System\aQiVRSt.exe
  C:\Windows\System\aQiVRSt.exe
  2⤵
  PID:4568
- C:\Windows\System\kAhfxkI.exe
  C:\Windows\System\kAhfxkI.exe
  2⤵
  PID:4136
- C:\Windows\System\QkeJTyG.exe
  C:\Windows\System\QkeJTyG.exe
  2⤵
  PID:4132
- C:\Windows\System\zNHtSGT.exe
  C:\Windows\System\zNHtSGT.exe
  2⤵
  PID:4332
- C:\Windows\System\SPSDjWc.exe
  C:\Windows\System\SPSDjWc.exe
  2⤵
  PID:5068
- C:\Windows\System\xZLVLEG.exe
  C:\Windows\System\xZLVLEG.exe
  2⤵
  PID:2812
- C:\Windows\System\jDKmiZE.exe
  C:\Windows\System\jDKmiZE.exe
  2⤵
  PID:5096
- C:\Windows\System\pLwMqev.exe
  C:\Windows\System\pLwMqev.exe
  2⤵
  PID:3860
- C:\Windows\System\LHzOSLv.exe
  C:\Windows\System\LHzOSLv.exe
  2⤵
  PID:3020
- C:\Windows\System\JNmkNGW.exe
  C:\Windows\System\JNmkNGW.exe
  2⤵
  PID:4436
- C:\Windows\System\esycZKH.exe
  C:\Windows\System\esycZKH.exe
  2⤵
  PID:4468
- C:\Windows\System\UEMmiTc.exe
  C:\Windows\System\UEMmiTc.exe
  2⤵
  PID:2248
- C:\Windows\System\IaHBLhI.exe
  C:\Windows\System\IaHBLhI.exe
  2⤵
  PID:4288
- C:\Windows\System\VeDEskf.exe
  C:\Windows\System\VeDEskf.exe
  2⤵
  PID:1880
- C:\Windows\System\okawUva.exe
  C:\Windows\System\okawUva.exe
  2⤵
  PID:4992
- C:\Windows\System\wEbWzcv.exe
  C:\Windows\System\wEbWzcv.exe
  2⤵
  PID:4168
- C:\Windows\System\nQynJKl.exe
  C:\Windows\System\nQynJKl.exe
  2⤵
  PID:4816
- C:\Windows\System\nptLKrV.exe
  C:\Windows\System\nptLKrV.exe
  2⤵
  PID:2144
- C:\Windows\System\OcoyDiD.exe
  C:\Windows\System\OcoyDiD.exe
  2⤵
  PID:4988
- C:\Windows\System\VsHaKkD.exe
  C:\Windows\System\VsHaKkD.exe
  2⤵
  PID:2320
- C:\Windows\System\sVXUpWE.exe
  C:\Windows\System\sVXUpWE.exe
  2⤵
  PID:5044
- C:\Windows\System\rLTVsoh.exe
  C:\Windows\System\rLTVsoh.exe
  2⤵
  PID:3764
- C:\Windows\System\vnQMozS.exe
  C:\Windows\System\vnQMozS.exe
  2⤵
  PID:4280
- C:\Windows\System\UDGSqFp.exe
  C:\Windows\System\UDGSqFp.exe
  2⤵
  PID:5064
- C:\Windows\System\AWaWaep.exe
  C:\Windows\System\AWaWaep.exe
  2⤵
  PID:4796
- C:\Windows\System\pZdUJah.exe
  C:\Windows\System\pZdUJah.exe
  2⤵
  PID:1552
- C:\Windows\System\lobqvsq.exe
  C:\Windows\System\lobqvsq.exe
  2⤵
  PID:4536
- C:\Windows\System\GIXHKSK.exe
  C:\Windows\System\GIXHKSK.exe
  2⤵
  PID:3416
- C:\Windows\System\OIQDHOV.exe
  C:\Windows\System\OIQDHOV.exe
  2⤵
  PID:5028
- C:\Windows\System\ihoEolB.exe
  C:\Windows\System\ihoEolB.exe
  2⤵
  PID:2444
- C:\Windows\System\TANlmAp.exe
  C:\Windows\System\TANlmAp.exe
  2⤵
  PID:4864
- C:\Windows\System\JLGIWCf.exe
  C:\Windows\System\JLGIWCf.exe
  2⤵
  PID:5072
- C:\Windows\System\AKtbLsk.exe
  C:\Windows\System\AKtbLsk.exe
  2⤵
  PID:4188
- C:\Windows\System\QZrsWGZ.exe
  C:\Windows\System\QZrsWGZ.exe
  2⤵
  PID:3908
- C:\Windows\System\NMXcTla.exe
  C:\Windows\System\NMXcTla.exe
  2⤵
  PID:5016
- C:\Windows\System\lQdySCA.exe
  C:\Windows\System\lQdySCA.exe
  2⤵
  PID:5132
- C:\Windows\System\dIRbxCk.exe
  C:\Windows\System\dIRbxCk.exe
  2⤵
  PID:5148
- C:\Windows\System\sZQduHY.exe
  C:\Windows\System\sZQduHY.exe
  2⤵
  PID:5164
- C:\Windows\System\BfzmZcL.exe
  C:\Windows\System\BfzmZcL.exe
  2⤵
  PID:5180
- C:\Windows\System\IWryPzI.exe
  C:\Windows\System\IWryPzI.exe
  2⤵
  PID:5196
- C:\Windows\System\aWTnYDD.exe
  C:\Windows\System\aWTnYDD.exe
  2⤵
  PID:5212
- C:\Windows\System\tcYVAhK.exe
  C:\Windows\System\tcYVAhK.exe
  2⤵
  PID:5228
- C:\Windows\System\kBGwYdo.exe
  C:\Windows\System\kBGwYdo.exe
  2⤵
  PID:5244
- C:\Windows\System\BYhqFRF.exe
  C:\Windows\System\BYhqFRF.exe
  2⤵
  PID:5260
- C:\Windows\System\supRwjW.exe
  C:\Windows\System\supRwjW.exe
  2⤵
  PID:5276
- C:\Windows\System\KUBfpez.exe
  C:\Windows\System\KUBfpez.exe
  2⤵
  PID:5292
- C:\Windows\System\gRvxkZm.exe
  C:\Windows\System\gRvxkZm.exe
  2⤵
  PID:5308
- C:\Windows\System\ISnVfGd.exe
  C:\Windows\System\ISnVfGd.exe
  2⤵
  PID:5324
- C:\Windows\System\csCUlxq.exe
  C:\Windows\System\csCUlxq.exe
  2⤵
  PID:5340
- C:\Windows\System\rSCODWS.exe
  C:\Windows\System\rSCODWS.exe
  2⤵
  PID:5356
- C:\Windows\System\kNRynRQ.exe
  C:\Windows\System\kNRynRQ.exe
  2⤵
  PID:5372
- C:\Windows\System\rsaNeHn.exe
  C:\Windows\System\rsaNeHn.exe
  2⤵
  PID:5388
- C:\Windows\System\uVMDBPT.exe
  C:\Windows\System\uVMDBPT.exe
  2⤵
  PID:5404
- C:\Windows\System\sNaXKPb.exe
  C:\Windows\System\sNaXKPb.exe
  2⤵
  PID:5420
- C:\Windows\System\DUtikGL.exe
  C:\Windows\System\DUtikGL.exe
  2⤵
  PID:5436
- C:\Windows\System\eCTitCa.exe
  C:\Windows\System\eCTitCa.exe
  2⤵
  PID:5452
- C:\Windows\System\DWrgnCL.exe
  C:\Windows\System\DWrgnCL.exe
  2⤵
  PID:5468
- C:\Windows\System\mufRYAu.exe
  C:\Windows\System\mufRYAu.exe
  2⤵
  PID:5572
- C:\Windows\System\gAyPKlI.exe
  C:\Windows\System\gAyPKlI.exe
  2⤵
  PID:5588
- C:\Windows\System\HCAiQhk.exe
  C:\Windows\System\HCAiQhk.exe
  2⤵
  PID:5604
- C:\Windows\System\vcuWpWM.exe
  C:\Windows\System\vcuWpWM.exe
  2⤵
  PID:5620
- C:\Windows\System\qxfqFQQ.exe
  C:\Windows\System\qxfqFQQ.exe
  2⤵
  PID:5636
- C:\Windows\System\HanjFEz.exe
  C:\Windows\System\HanjFEz.exe
  2⤵
  PID:5668
- C:\Windows\System\FDBMxVZ.exe
  C:\Windows\System\FDBMxVZ.exe
  2⤵
  PID:5684
- C:\Windows\System\NjHZytn.exe
  C:\Windows\System\NjHZytn.exe
  2⤵
  PID:5700
- C:\Windows\System\XuluMoI.exe
  C:\Windows\System\XuluMoI.exe
  2⤵
  PID:5716
- C:\Windows\System\KdsXGKX.exe
  C:\Windows\System\KdsXGKX.exe
  2⤵
  PID:5732
- C:\Windows\System\tILybzZ.exe
  C:\Windows\System\tILybzZ.exe
  2⤵
  PID:5748
- C:\Windows\System\rBdBFFg.exe
  C:\Windows\System\rBdBFFg.exe
  2⤵
  PID:5768
- C:\Windows\System\fpYZuXz.exe
  C:\Windows\System\fpYZuXz.exe
  2⤵
  PID:5784
- C:\Windows\System\KNxtQhX.exe
  C:\Windows\System\KNxtQhX.exe
  2⤵
  PID:5804
- C:\Windows\System\sgFzART.exe
  C:\Windows\System\sgFzART.exe
  2⤵
  PID:5820
- C:\Windows\System\tlGoVkY.exe
  C:\Windows\System\tlGoVkY.exe
  2⤵
  PID:5836
- C:\Windows\System\vXkXAYZ.exe
  C:\Windows\System\vXkXAYZ.exe
  2⤵
  PID:5852
- C:\Windows\System\Dvodiiq.exe
  C:\Windows\System\Dvodiiq.exe
  2⤵
  PID:5872
- C:\Windows\System\EJpPYdM.exe
  C:\Windows\System\EJpPYdM.exe
  2⤵
  PID:5888
- C:\Windows\System\wegLvdM.exe
  C:\Windows\System\wegLvdM.exe
  2⤵
  PID:5904
- C:\Windows\System\wXcsriq.exe
  C:\Windows\System\wXcsriq.exe
  2⤵
  PID:5920
- C:\Windows\System\PowQAgp.exe
  C:\Windows\System\PowQAgp.exe
  2⤵
  PID:5936
- C:\Windows\System\DJplhgC.exe
  C:\Windows\System\DJplhgC.exe
  2⤵
  PID:5952
- C:\Windows\System\CBeXJdp.exe
  C:\Windows\System\CBeXJdp.exe
  2⤵
  PID:5972
- C:\Windows\System\ojyrjnk.exe
  C:\Windows\System\ojyrjnk.exe
  2⤵
  PID:5988
- C:\Windows\System\YdMygDp.exe
  C:\Windows\System\YdMygDp.exe
  2⤵
  PID:6008
- C:\Windows\System\tPvAzSj.exe
  C:\Windows\System\tPvAzSj.exe
  2⤵
  PID:6024
- C:\Windows\System\ZbgwSuU.exe
  C:\Windows\System\ZbgwSuU.exe
  2⤵
  PID:6044
- C:\Windows\System\vkAzIZt.exe
  C:\Windows\System\vkAzIZt.exe
  2⤵
  PID:6060
- C:\Windows\System\RmUyrFJ.exe
  C:\Windows\System\RmUyrFJ.exe
  2⤵
  PID:6076
- C:\Windows\System\uRJDCQa.exe
  C:\Windows\System\uRJDCQa.exe
  2⤵
  PID:6092
- C:\Windows\System\rchFJEZ.exe
  C:\Windows\System\rchFJEZ.exe
  2⤵
  PID:6108
- C:\Windows\System\gMtNWsI.exe
  C:\Windows\System\gMtNWsI.exe
  2⤵
  PID:6124
- C:\Windows\System\NjBkRVA.exe
  C:\Windows\System\NjBkRVA.exe
  2⤵
  PID:6140
- C:\Windows\System\bLrZvEz.exe
  C:\Windows\System\bLrZvEz.exe
  2⤵
  PID:5204
- C:\Windows\System\CbocecS.exe
  C:\Windows\System\CbocecS.exe
  2⤵
  PID:5512
- C:\Windows\System\AESktXk.exe
  C:\Windows\System\AESktXk.exe
  2⤵
  PID:5188
- C:\Windows\System\fsTmCZq.exe
  C:\Windows\System\fsTmCZq.exe
  2⤵
  PID:5160
- C:\Windows\System\rPRgFWt.exe
  C:\Windows\System\rPRgFWt.exe
  2⤵
  PID:5616
- C:\Windows\System\xhdKnRO.exe
  C:\Windows\System\xhdKnRO.exe
  2⤵
  PID:5488
- C:\Windows\System\uhsnWsS.exe
  C:\Windows\System\uhsnWsS.exe
  2⤵
  PID:5380
- C:\Windows\System\csnwIFq.exe
  C:\Windows\System\csnwIFq.exe
  2⤵
  PID:5524
- C:\Windows\System\EJqwRrs.exe
  C:\Windows\System\EJqwRrs.exe
  2⤵
  PID:5648
- C:\Windows\System\EGGXzhT.exe
  C:\Windows\System\EGGXzhT.exe
  2⤵
  PID:5660
- C:\Windows\System\EJTTNcJ.exe
  C:\Windows\System\EJTTNcJ.exe
  2⤵
  PID:5664
- C:\Windows\System\SlZUuyf.exe
  C:\Windows\System\SlZUuyf.exe
  2⤵
  PID:5728
- C:\Windows\System\VbmPwhj.exe
  C:\Windows\System\VbmPwhj.exe
  2⤵
  PID:5796
- C:\Windows\System\sDjdRnj.exe
  C:\Windows\System\sDjdRnj.exe
  2⤵
  PID:5860
- C:\Windows\System\VZlKFDr.exe
  C:\Windows\System\VZlKFDr.exe
  2⤵
  PID:5928
- C:\Windows\System\NisdGUk.exe
  C:\Windows\System\NisdGUk.exe
  2⤵
  PID:5968
- C:\Windows\System\kaheLdi.exe
  C:\Windows\System\kaheLdi.exe
  2⤵
  PID:6036
- C:\Windows\System\HoyPsVr.exe
  C:\Windows\System\HoyPsVr.exe
  2⤵
  PID:5596
- C:\Windows\System\pvnQmcT.exe
  C:\Windows\System\pvnQmcT.exe
  2⤵
  PID:5540
- C:\Windows\System\LLaWKcD.exe
  C:\Windows\System\LLaWKcD.exe
  2⤵
  PID:5268
- C:\Windows\System\bsVwZUI.exe
  C:\Windows\System\bsVwZUI.exe
  2⤵
  PID:6104
- C:\Windows\System\luNbket.exe
  C:\Windows\System\luNbket.exe
  2⤵
  PID:5560
- C:\Windows\System\stkSgtX.exe
  C:\Windows\System\stkSgtX.exe
  2⤵
  PID:5628
- C:\Windows\System\vhDISeB.exe
  C:\Windows\System\vhDISeB.exe
  2⤵
  PID:5816
- C:\Windows\System\TdCcYdF.exe
  C:\Windows\System\TdCcYdF.exe
  2⤵
  PID:5884
- C:\Windows\System\xDfoBwH.exe
  C:\Windows\System\xDfoBwH.exe
  2⤵
  PID:5984
- C:\Windows\System\CGbwFtL.exe
  C:\Windows\System\CGbwFtL.exe
  2⤵
  PID:6084
- C:\Windows\System\njUPKhV.exe
  C:\Windows\System\njUPKhV.exe
  2⤵
  PID:5176
- C:\Windows\System\ifwtNKG.exe
  C:\Windows\System\ifwtNKG.exe
  2⤵
  PID:5304
- C:\Windows\System\yaPAknl.exe
  C:\Windows\System\yaPAknl.exe
  2⤵
  PID:5368
- C:\Windows\System\izOkXPo.exe
  C:\Windows\System\izOkXPo.exe
  2⤵
  PID:5364
- C:\Windows\System\fxVFlEv.exe
  C:\Windows\System\fxVFlEv.exe
  2⤵
  PID:5288
- C:\Windows\System\inXDdRq.exe
  C:\Windows\System\inXDdRq.exe
  2⤵
  PID:3288
- C:\Windows\System\TsPOsSP.exe
  C:\Windows\System\TsPOsSP.exe
  2⤵
  PID:5464
- C:\Windows\System\JSnWQJN.exe
  C:\Windows\System\JSnWQJN.exe
  2⤵
  PID:4688
- C:\Windows\System\DUqhbhX.exe
  C:\Windows\System\DUqhbhX.exe
  2⤵
  PID:3740
- C:\Windows\System\mhtIZrA.exe
  C:\Windows\System\mhtIZrA.exe
  2⤵
  PID:5316
- C:\Windows\System\ZOqWeDl.exe
  C:\Windows\System\ZOqWeDl.exe
  2⤵
  PID:5484
- C:\Windows\System\wvKQQIe.exe
  C:\Windows\System\wvKQQIe.exe
  2⤵
  PID:5444
- C:\Windows\System\PFtgZOX.exe
  C:\Windows\System\PFtgZOX.exe
  2⤵
  PID:5480
- C:\Windows\System\lvyoXAD.exe
  C:\Windows\System\lvyoXAD.exe
  2⤵
  PID:5764
- C:\Windows\System\ASgipNW.exe
  C:\Windows\System\ASgipNW.exe
  2⤵
  PID:5912
- C:\Windows\System\mZebZpR.exe
  C:\Windows\System\mZebZpR.exe
  2⤵
  PID:5740
- C:\Windows\System\ynHqmwH.exe
  C:\Windows\System\ynHqmwH.exe
  2⤵
  PID:6052
- C:\Windows\System\arWyfEJ.exe
  C:\Windows\System\arWyfEJ.exe
  2⤵
  PID:5552
- C:\Windows\System\AbnfbLG.exe
  C:\Windows\System\AbnfbLG.exe
  2⤵
  PID:5900
- C:\Windows\System\BLauzCu.exe
  C:\Windows\System\BLauzCu.exe
  2⤵
  PID:5172
- C:\Windows\System\Liyawbb.exe
  C:\Windows\System\Liyawbb.exe
  2⤵
  PID:5460
- C:\Windows\System\hGJLiyh.exe
  C:\Windows\System\hGJLiyh.exe
  2⤵
  PID:4860
- C:\Windows\System\qySQjKm.exe
  C:\Windows\System\qySQjKm.exe
  2⤵
  PID:5724
- C:\Windows\System\kxCiGgU.exe
  C:\Windows\System\kxCiGgU.exe
  2⤵
  PID:5708
- C:\Windows\System\WcVuQPQ.exe
  C:\Windows\System\WcVuQPQ.exe
  2⤵
  PID:5812
- C:\Windows\System\GsHYcVb.exe
  C:\Windows\System\GsHYcVb.exe
  2⤵
  PID:6160
- C:\Windows\System\CYbloHA.exe
  C:\Windows\System\CYbloHA.exe
  2⤵
  PID:6180
- C:\Windows\System\kHBaUzK.exe
  C:\Windows\System\kHBaUzK.exe
  2⤵
  PID:6324
- C:\Windows\System\NJHuylR.exe
  C:\Windows\System\NJHuylR.exe
  2⤵
  PID:6340
- C:\Windows\System\OeZUEHb.exe
  C:\Windows\System\OeZUEHb.exe
  2⤵
  PID:6356
- C:\Windows\System\FwJMvbD.exe
  C:\Windows\System\FwJMvbD.exe
  2⤵
  PID:6372
- C:\Windows\System\ZOrMwhu.exe
  C:\Windows\System\ZOrMwhu.exe
  2⤵
  PID:6388
- C:\Windows\System\TtbhVOz.exe
  C:\Windows\System\TtbhVOz.exe
  2⤵
  PID:6404
- C:\Windows\System\MBsYQMx.exe
  C:\Windows\System\MBsYQMx.exe
  2⤵
  PID:6420
- C:\Windows\System\TiJefgM.exe
  C:\Windows\System\TiJefgM.exe
  2⤵
  PID:6436
- C:\Windows\System\JptRAgS.exe
  C:\Windows\System\JptRAgS.exe
  2⤵
  PID:6452
- C:\Windows\System\gdgmgyh.exe
  C:\Windows\System\gdgmgyh.exe
  2⤵
  PID:6480
- C:\Windows\System\kscZMUo.exe
  C:\Windows\System\kscZMUo.exe
  2⤵
  PID:6496
- C:\Windows\System\VYNgmnO.exe
  C:\Windows\System\VYNgmnO.exe
  2⤵
  PID:6512
- C:\Windows\System\joyFlbz.exe
  C:\Windows\System\joyFlbz.exe
  2⤵
  PID:6528
- C:\Windows\System\UgHZGoE.exe
  C:\Windows\System\UgHZGoE.exe
  2⤵
  PID:6544
- C:\Windows\System\omowJrJ.exe
  C:\Windows\System\omowJrJ.exe
  2⤵
  PID:6560
- C:\Windows\System\AhLqzkh.exe
  C:\Windows\System\AhLqzkh.exe
  2⤵
  PID:6576
- C:\Windows\System\YPBVfbN.exe
  C:\Windows\System\YPBVfbN.exe
  2⤵
  PID:6592
- C:\Windows\System\uTnQWFV.exe
  C:\Windows\System\uTnQWFV.exe
  2⤵
  PID:6612
- C:\Windows\System\sytbvHo.exe
  C:\Windows\System\sytbvHo.exe
  2⤵
  PID:6628
- C:\Windows\System\ChjKBxZ.exe
  C:\Windows\System\ChjKBxZ.exe
  2⤵
  PID:6644
- C:\Windows\System\KuZQLfu.exe
  C:\Windows\System\KuZQLfu.exe
  2⤵
  PID:6664
- C:\Windows\System\VnKcvSK.exe
  C:\Windows\System\VnKcvSK.exe
  2⤵
  PID:6680
- C:\Windows\System\MddAmJR.exe
  C:\Windows\System\MddAmJR.exe
  2⤵
  PID:6696
- C:\Windows\System\LfZJBOm.exe
  C:\Windows\System\LfZJBOm.exe
  2⤵
  PID:6712
- C:\Windows\System\gZJXjxv.exe
  C:\Windows\System\gZJXjxv.exe
  2⤵
  PID:6728
- C:\Windows\System\ciSdkMu.exe
  C:\Windows\System\ciSdkMu.exe
  2⤵
  PID:6744
- C:\Windows\System\MnkwQbC.exe
  C:\Windows\System\MnkwQbC.exe
  2⤵
  PID:6760
- C:\Windows\System\hRAUpUO.exe
  C:\Windows\System\hRAUpUO.exe
  2⤵
  PID:6776
- C:\Windows\System\qrWWXRU.exe
  C:\Windows\System\qrWWXRU.exe
  2⤵
  PID:6792
- C:\Windows\System\bSwYLrQ.exe
  C:\Windows\System\bSwYLrQ.exe
  2⤵
  PID:6812
- C:\Windows\System\oYTCdjO.exe
  C:\Windows\System\oYTCdjO.exe
  2⤵
  PID:6828
- C:\Windows\System\QhdcHRV.exe
  C:\Windows\System\QhdcHRV.exe
  2⤵
  PID:6844
- C:\Windows\System\YjzZzgy.exe
  C:\Windows\System\YjzZzgy.exe
  2⤵
  PID:6860
- C:\Windows\System\FpBlWUA.exe
  C:\Windows\System\FpBlWUA.exe
  2⤵
  PID:6876
- C:\Windows\System\oCJBOtH.exe
  C:\Windows\System\oCJBOtH.exe
  2⤵
  PID:6896
- C:\Windows\System\jHueJgQ.exe
  C:\Windows\System\jHueJgQ.exe
  2⤵
  PID:6916
- C:\Windows\System\OUdnQmQ.exe
  C:\Windows\System\OUdnQmQ.exe
  2⤵
  PID:6932
- C:\Windows\System\sXdxvTD.exe
  C:\Windows\System\sXdxvTD.exe
  2⤵
  PID:7076
- C:\Windows\System\hWhEFfo.exe
  C:\Windows\System\hWhEFfo.exe
  2⤵
  PID:7092
- C:\Windows\System\XzMmTbj.exe
  C:\Windows\System\XzMmTbj.exe
  2⤵
  PID:7108
- C:\Windows\System\ZsQeUnN.exe
  C:\Windows\System\ZsQeUnN.exe
  2⤵
  PID:7124
- C:\Windows\System\ysMfUzx.exe
  C:\Windows\System\ysMfUzx.exe
  2⤵
  PID:7140
- C:\Windows\System\aLgmsrH.exe
  C:\Windows\System\aLgmsrH.exe
  2⤵
  PID:5776
- C:\Windows\System\tjjqIIf.exe
  C:\Windows\System\tjjqIIf.exe
  2⤵
  PID:5568
- C:\Windows\System\VZEEyti.exe
  C:\Windows\System\VZEEyti.exe
  2⤵
  PID:5528
- C:\Windows\System\lHGZQEi.exe
  C:\Windows\System\lHGZQEi.exe
  2⤵
  PID:5792
- C:\Windows\System\jpAUyPR.exe
  C:\Windows\System\jpAUyPR.exe
  2⤵
  PID:5536
- C:\Windows\System\OpvdeAs.exe
  C:\Windows\System\OpvdeAs.exe
  2⤵
  PID:6116
- C:\Windows\System\BCEumBL.exe
  C:\Windows\System\BCEumBL.exe
  2⤵
  PID:6196
- C:\Windows\System\brDCpDk.exe
  C:\Windows\System\brDCpDk.exe
  2⤵
  PID:6056
- C:\Windows\System\RTiwHPh.exe
  C:\Windows\System\RTiwHPh.exe
  2⤵
  PID:5036
- C:\Windows\System\YRzQexS.exe
  C:\Windows\System\YRzQexS.exe
  2⤵
  PID:5348
- C:\Windows\System\vqPKqmG.exe
  C:\Windows\System\vqPKqmG.exe
  2⤵
  PID:5252
- C:\Windows\System\vOLVySy.exe
  C:\Windows\System\vOLVySy.exe
  2⤵
  PID:5744
- C:\Windows\System\LBXMccG.exe
  C:\Windows\System\LBXMccG.exe
  2⤵
  PID:5476
- C:\Windows\System\bfOcRJs.exe
  C:\Windows\System\bfOcRJs.exe
  2⤵
  PID:6208
- C:\Windows\System\GKtwMdw.exe
  C:\Windows\System\GKtwMdw.exe
  2⤵
  PID:6224
- C:\Windows\System\qmsrXdq.exe
  C:\Windows\System\qmsrXdq.exe
  2⤵
  PID:6176
- C:\Windows\System\QsuQKSx.exe
  C:\Windows\System\QsuQKSx.exe
  2⤵
  PID:5696
- C:\Windows\System\fAsJdgO.exe
  C:\Windows\System\fAsJdgO.exe
  2⤵
  PID:6248
- C:\Windows\System\NfvxEgT.exe
  C:\Windows\System\NfvxEgT.exe
  2⤵
  PID:6276
- C:\Windows\System\vEPhDFs.exe
  C:\Windows\System\vEPhDFs.exe
  2⤵
  PID:6284
- C:\Windows\System\bZBCUjK.exe
  C:\Windows\System\bZBCUjK.exe
  2⤵
  PID:6300
- C:\Windows\System\LLHEWXE.exe
  C:\Windows\System\LLHEWXE.exe
  2⤵
  PID:6320
- C:\Windows\System\kKfxfVG.exe
  C:\Windows\System\kKfxfVG.exe
  2⤵
  PID:6412
- C:\Windows\System\lUzJsPv.exe
  C:\Windows\System\lUzJsPv.exe
  2⤵
  PID:6368
- C:\Windows\System\rSFqLno.exe
  C:\Windows\System\rSFqLno.exe
  2⤵
  PID:6676
- C:\Windows\System\FoujDcz.exe
  C:\Windows\System\FoujDcz.exe
  2⤵
  PID:6768
- C:\Windows\System\PAIxCDK.exe
  C:\Windows\System\PAIxCDK.exe
  2⤵
  PID:6808
- C:\Windows\System\atXaKli.exe
  C:\Windows\System\atXaKli.exe
  2⤵
  PID:6940
- C:\Windows\System\ZEPIHde.exe
  C:\Windows\System\ZEPIHde.exe
  2⤵
  PID:6872
- C:\Windows\System\MWgsgHc.exe
  C:\Windows\System\MWgsgHc.exe
  2⤵
  PID:6444
- C:\Windows\System\uoqdDgN.exe
  C:\Windows\System\uoqdDgN.exe
  2⤵
  PID:6520
- C:\Windows\System\mpjwYcM.exe
  C:\Windows\System\mpjwYcM.exe
  2⤵
  PID:6588
- C:\Windows\System\XBNqvce.exe
  C:\Windows\System\XBNqvce.exe
  2⤵
  PID:6656
- C:\Windows\System\zkioHzc.exe
  C:\Windows\System\zkioHzc.exe
  2⤵
  PID:6720
- C:\Windows\System\DcsTdCC.exe
  C:\Windows\System\DcsTdCC.exe
  2⤵
  PID:6784
- C:\Windows\System\axRdBTV.exe
  C:\Windows\System\axRdBTV.exe
  2⤵
  PID:6852
- C:\Windows\System\MzsYqZc.exe
  C:\Windows\System\MzsYqZc.exe
  2⤵
  PID:6924
- C:\Windows\System\LJwkGmv.exe
  C:\Windows\System\LJwkGmv.exe
  2⤵
  PID:6948
- C:\Windows\System\EoOjpGL.exe
  C:\Windows\System\EoOjpGL.exe
  2⤵
  PID:6000
- C:\Windows\System\UJCnBDa.exe
  C:\Windows\System\UJCnBDa.exe
  2⤵
  PID:6996
- C:\Windows\System\tErgcth.exe
  C:\Windows\System\tErgcth.exe
  2⤵
  PID:7012
- C:\Windows\System\UIAqkNM.exe
  C:\Windows\System\UIAqkNM.exe
  2⤵
  PID:7032
- C:\Windows\System\VTlqVFg.exe
  C:\Windows\System\VTlqVFg.exe
  2⤵
  PID:7044
- C:\Windows\System\VSFaDtS.exe
  C:\Windows\System\VSFaDtS.exe
  2⤵
  PID:7060
- C:\Windows\System\fvkkBpQ.exe
  C:\Windows\System\fvkkBpQ.exe
  2⤵
  PID:7084
- C:\Windows\System\UpVDgIW.exe
  C:\Windows\System\UpVDgIW.exe
  2⤵
  PID:7148
- C:\Windows\System\zbNjzgt.exe
  C:\Windows\System\zbNjzgt.exe
  2⤵
  PID:7120
- C:\Windows\System\XQAyHUf.exe
  C:\Windows\System\XQAyHUf.exe
  2⤵
  PID:7160
- C:\Windows\System\ByAIgsn.exe
  C:\Windows\System\ByAIgsn.exe
  2⤵
  PID:5400
- C:\Windows\System\KIuFDsP.exe
  C:\Windows\System\KIuFDsP.exe
  2⤵
  PID:5492
- C:\Windows\System\bMkOqFF.exe
  C:\Windows\System\bMkOqFF.exe
  2⤵
  PID:6156
- C:\Windows\System\BhrAcES.exe
  C:\Windows\System\BhrAcES.exe
  2⤵
  PID:1416
- C:\Windows\System\BTyhZvy.exe
  C:\Windows\System\BTyhZvy.exe
  2⤵
  PID:6200
- C:\Windows\System\MYgOZGZ.exe
  C:\Windows\System\MYgOZGZ.exe
  2⤵
  PID:6236
- C:\Windows\System\LLVoivb.exe
  C:\Windows\System\LLVoivb.exe
  2⤵
  PID:6280
- C:\Windows\System\HnTCseG.exe
  C:\Windows\System\HnTCseG.exe
  2⤵
  PID:6332
- C:\Windows\System\bJTXLkK.exe
  C:\Windows\System\bJTXLkK.exe
  2⤵
  PID:5508
- C:\Windows\System\YTFbzek.exe
  C:\Windows\System\YTFbzek.exe
  2⤵
  PID:5948
- C:\Windows\System\zKtLCCZ.exe
  C:\Windows\System\zKtLCCZ.exe
  2⤵
  PID:6256
- C:\Windows\System\yHVhIjC.exe
  C:\Windows\System\yHVhIjC.exe
  2⤵
  PID:6384
- C:\Windows\System\YZKGmQE.exe
  C:\Windows\System\YZKGmQE.exe
  2⤵
  PID:6120
- C:\Windows\System\oBERalN.exe
  C:\Windows\System\oBERalN.exe
  2⤵
  PID:6216
- C:\Windows\System\XvbUijr.exe
  C:\Windows\System\XvbUijr.exe
  2⤵
  PID:6292
- C:\Windows\System\jmvgVAh.exe
  C:\Windows\System\jmvgVAh.exe
  2⤵
  PID:6472
- C:\Windows\System\XxPyjvp.exe
  C:\Windows\System\XxPyjvp.exe
  2⤵
  PID:6572
- C:\Windows\System\XoYeGeW.exe
  C:\Windows\System\XoYeGeW.exe
  2⤵
  PID:6968
- C:\Windows\System\SrbLjLv.exe
  C:\Windows\System\SrbLjLv.exe
  2⤵
  PID:6992
- C:\Windows\System\XuVKMxt.exe
  C:\Windows\System\XuVKMxt.exe
  2⤵
  PID:7028
- C:\Windows\System\mUzDbPt.exe
  C:\Windows\System\mUzDbPt.exe
  2⤵
  PID:6132
- C:\Windows\System\QKaKcPn.exe
  C:\Windows\System\QKaKcPn.exe
  2⤵
  PID:5960
- C:\Windows\System\RElYxvt.exe
  C:\Windows\System\RElYxvt.exe
  2⤵
  PID:5144
- C:\Windows\System\qMtPfJw.exe
  C:\Windows\System\qMtPfJw.exe
  2⤵
  PID:6476
- C:\Windows\System\rvxaRNn.exe
  C:\Windows\System\rvxaRNn.exe
  2⤵
  PID:6608
- C:\Windows\System\GTKQAmF.exe
  C:\Windows\System\GTKQAmF.exe
  2⤵
  PID:6908
- C:\Windows\System\AACnzdc.exe
  C:\Windows\System\AACnzdc.exe
  2⤵
  PID:6752
- C:\Windows\System\GZNVBeu.exe
  C:\Windows\System\GZNVBeu.exe
  2⤵
  PID:6904
- C:\Windows\System\fqwGSss.exe
  C:\Windows\System\fqwGSss.exe
  2⤵
  PID:7068
- C:\Windows\System\wWLzhKi.exe
  C:\Windows\System\wWLzhKi.exe
  2⤵
  PID:7136
- C:\Windows\System\qwruCEt.exe
  C:\Windows\System\qwruCEt.exe
  2⤵
  PID:5532
- C:\Windows\System\wyerPnQ.exe
  C:\Windows\System\wyerPnQ.exe
  2⤵
  PID:6272
- C:\Windows\System\orCSWIO.exe
  C:\Windows\System\orCSWIO.exe
  2⤵
  PID:6252
- C:\Windows\System\EtOKsSF.exe
  C:\Windows\System\EtOKsSF.exe
  2⤵
  PID:5944
- C:\Windows\System\kammpvK.exe
  C:\Windows\System\kammpvK.exe
  2⤵
  PID:6604
- C:\Windows\System\pugKdVf.exe
  C:\Windows\System\pugKdVf.exe
  2⤵
  PID:6800
- C:\Windows\System\PiENBZz.exe
  C:\Windows\System\PiENBZz.exe
  2⤵
  PID:6868
- C:\Windows\System\yyZBPOc.exe
  C:\Windows\System\yyZBPOc.exe
  2⤵
  PID:2836
- C:\Windows\System\SQRUzWY.exe
  C:\Windows\System\SQRUzWY.exe
  2⤵
  PID:6688
- C:\Windows\System\sifIcOz.exe
  C:\Windows\System\sifIcOz.exe
  2⤵
  PID:6824
- C:\Windows\System\uqPxhtM.exe
  C:\Windows\System\uqPxhtM.exe
  2⤵
  PID:6004
- C:\Windows\System\snXBPSu.exe
  C:\Windows\System\snXBPSu.exe
  2⤵
  PID:7004
- C:\Windows\System\jOIxMEj.exe
  C:\Windows\System\jOIxMEj.exe
  2⤵
  PID:7132
- C:\Windows\System\LeeRqzY.exe
  C:\Windows\System\LeeRqzY.exe
  2⤵
  PID:6168
- C:\Windows\System\dNOUXnp.exe
  C:\Windows\System\dNOUXnp.exe
  2⤵
  PID:6400
- C:\Windows\System\yRVUVMs.exe
  C:\Windows\System\yRVUVMs.exe
  2⤵
  PID:6820
- C:\Windows\System\hTGFnQD.exe
  C:\Windows\System\hTGFnQD.exe
  2⤵
  PID:5520
- C:\Windows\System\TsqxSvB.exe
  C:\Windows\System\TsqxSvB.exe
  2⤵
  PID:7056
- C:\Windows\System\XjbhyGc.exe
  C:\Windows\System\XjbhyGc.exe
  2⤵
  PID:6432
- C:\Windows\System\dCHPhzD.exe
  C:\Windows\System\dCHPhzD.exe
  2⤵
  PID:5676
- C:\Windows\System\xhFUUEZ.exe
  C:\Windows\System\xhFUUEZ.exe
  2⤵
  PID:7024
- C:\Windows\System\hyhIKAy.exe
  C:\Windows\System\hyhIKAy.exe
  2⤵
  PID:6232
- C:\Windows\System\PbvjRDJ.exe
  C:\Windows\System\PbvjRDJ.exe
  2⤵
  PID:6960
- C:\Windows\System\oNmYAXa.exe
  C:\Windows\System\oNmYAXa.exe
  2⤵
  PID:5236
- C:\Windows\System\PXQUQeC.exe
  C:\Windows\System\PXQUQeC.exe
  2⤵
  PID:7040
- C:\Windows\System\NxyqVBV.exe
  C:\Windows\System\NxyqVBV.exe
  2⤵
  PID:6672
- C:\Windows\System\HnDqgKh.exe
  C:\Windows\System\HnDqgKh.exe
  2⤵
  PID:6652
- C:\Windows\System\ABJIZCN.exe
  C:\Windows\System\ABJIZCN.exe
  2⤵
  PID:7104
- C:\Windows\System\RRfWZRq.exe
  C:\Windows\System\RRfWZRq.exe
  2⤵
  PID:6552
- C:\Windows\System\iOaZyCG.exe
  C:\Windows\System\iOaZyCG.exe
  2⤵
  PID:6840
- C:\Windows\System\xHAMxdi.exe
  C:\Windows\System\xHAMxdi.exe
  2⤵
  PID:7172
- C:\Windows\System\BrobmEW.exe
  C:\Windows\System\BrobmEW.exe
  2⤵
  PID:7192
- C:\Windows\System\kACOTYR.exe
  C:\Windows\System\kACOTYR.exe
  2⤵
  PID:7208
- C:\Windows\System\VtOSUwV.exe
  C:\Windows\System\VtOSUwV.exe
  2⤵
  PID:7224
- C:\Windows\System\bkrKAUg.exe
  C:\Windows\System\bkrKAUg.exe
  2⤵
  PID:7248
- C:\Windows\System\arwdigP.exe
  C:\Windows\System\arwdigP.exe
  2⤵
  PID:7264
- C:\Windows\System\aRowgza.exe
  C:\Windows\System\aRowgza.exe
  2⤵
  PID:7280
- C:\Windows\System\bUxCjEH.exe
  C:\Windows\System\bUxCjEH.exe
  2⤵
  PID:7296
- C:\Windows\System\ZhsLzQB.exe
  C:\Windows\System\ZhsLzQB.exe
  2⤵
  PID:7316
- C:\Windows\System\BsBChnl.exe
  C:\Windows\System\BsBChnl.exe
  2⤵
  PID:7332
- C:\Windows\System\ZWvuiny.exe
  C:\Windows\System\ZWvuiny.exe
  2⤵
  PID:7348
- C:\Windows\System\jAoTCVd.exe
  C:\Windows\System\jAoTCVd.exe
  2⤵
  PID:7364
- C:\Windows\System\OzuTPuo.exe
  C:\Windows\System\OzuTPuo.exe
  2⤵
  PID:7380
- C:\Windows\System\cIoLCUu.exe
  C:\Windows\System\cIoLCUu.exe
  2⤵
  PID:7396
- C:\Windows\System\KtAdvwt.exe
  C:\Windows\System\KtAdvwt.exe
  2⤵
  PID:7412
- C:\Windows\System\pMKyIrx.exe
  C:\Windows\System\pMKyIrx.exe
  2⤵
  PID:7428
- C:\Windows\System\JFfbRmu.exe
  C:\Windows\System\JFfbRmu.exe
  2⤵
  PID:7444
- C:\Windows\System\fzSSICD.exe
  C:\Windows\System\fzSSICD.exe
  2⤵
  PID:7460
- C:\Windows\System\wUBhwsg.exe
  C:\Windows\System\wUBhwsg.exe
  2⤵
  PID:7476
- C:\Windows\System\EaSBLdv.exe
  C:\Windows\System\EaSBLdv.exe
  2⤵
  PID:7492
- C:\Windows\System\yvooOLr.exe
  C:\Windows\System\yvooOLr.exe
  2⤵
  PID:7508
- C:\Windows\System\gcFBMQv.exe
  C:\Windows\System\gcFBMQv.exe
  2⤵
  PID:7524
- C:\Windows\System\szpEPkc.exe
  C:\Windows\System\szpEPkc.exe
  2⤵
  PID:7540
- C:\Windows\System\nqvZQqJ.exe
  C:\Windows\System\nqvZQqJ.exe
  2⤵
  PID:7556
- C:\Windows\System\FFrGabT.exe
  C:\Windows\System\FFrGabT.exe
  2⤵
  PID:7572
- C:\Windows\System\vnzFmhJ.exe
  C:\Windows\System\vnzFmhJ.exe
  2⤵
  PID:7588
- C:\Windows\System\QluBUxq.exe
  C:\Windows\System\QluBUxq.exe
  2⤵
  PID:7604
- C:\Windows\System\ArHLGXC.exe
  C:\Windows\System\ArHLGXC.exe
  2⤵
  PID:7620
- C:\Windows\System\uApBvpq.exe
  C:\Windows\System\uApBvpq.exe
  2⤵
  PID:7636
- C:\Windows\System\oXlZXzd.exe
  C:\Windows\System\oXlZXzd.exe
  2⤵
  PID:7652
- C:\Windows\System\aGnmXDi.exe
  C:\Windows\System\aGnmXDi.exe
  2⤵
  PID:7668
- C:\Windows\System\lxxLIRy.exe
  C:\Windows\System\lxxLIRy.exe
  2⤵
  PID:7684
- C:\Windows\System\zpGAFRt.exe
  C:\Windows\System\zpGAFRt.exe
  2⤵
  PID:7700
- C:\Windows\System\GzPvVWM.exe
  C:\Windows\System\GzPvVWM.exe
  2⤵
  PID:7716
- C:\Windows\System\ZICTRIp.exe
  C:\Windows\System\ZICTRIp.exe
  2⤵
  PID:7732
- C:\Windows\System\GAMrUeX.exe
  C:\Windows\System\GAMrUeX.exe
  2⤵
  PID:7748
- C:\Windows\System\wWcqtxT.exe
  C:\Windows\System\wWcqtxT.exe
  2⤵
  PID:7764
- C:\Windows\System\slsikMh.exe
  C:\Windows\System\slsikMh.exe
  2⤵
  PID:7780
- C:\Windows\System\PNvYVdp.exe
  C:\Windows\System\PNvYVdp.exe
  2⤵
  PID:7796
- C:\Windows\System\TkaECoj.exe
  C:\Windows\System\TkaECoj.exe
  2⤵
  PID:7812
- C:\Windows\System\XZeKrwf.exe
  C:\Windows\System\XZeKrwf.exe
  2⤵
  PID:7828
- C:\Windows\System\dykcrgT.exe
  C:\Windows\System\dykcrgT.exe
  2⤵
  PID:7844
- C:\Windows\System\IsXKsZE.exe
  C:\Windows\System\IsXKsZE.exe
  2⤵
  PID:7860
- C:\Windows\System\iiLqlBe.exe
  C:\Windows\System\iiLqlBe.exe
  2⤵
  PID:7876
- C:\Windows\System\TDrlPyh.exe
  C:\Windows\System\TDrlPyh.exe
  2⤵
  PID:7892
- C:\Windows\System\NgQoQhL.exe
  C:\Windows\System\NgQoQhL.exe
  2⤵
  PID:7908
- C:\Windows\System\QClWITY.exe
  C:\Windows\System\QClWITY.exe
  2⤵
  PID:7924
- C:\Windows\System\lLOttrD.exe
  C:\Windows\System\lLOttrD.exe
  2⤵
  PID:7940
- C:\Windows\System\UNSTgFn.exe
  C:\Windows\System\UNSTgFn.exe
  2⤵
  PID:7956
- C:\Windows\System\eqIGgxI.exe
  C:\Windows\System\eqIGgxI.exe
  2⤵
  PID:7972
- C:\Windows\System\gIbdRGe.exe
  C:\Windows\System\gIbdRGe.exe
  2⤵
  PID:7988
- C:\Windows\System\byKpAKQ.exe
  C:\Windows\System\byKpAKQ.exe
  2⤵
  PID:8004
- C:\Windows\System\QNzOjGi.exe
  C:\Windows\System\QNzOjGi.exe
  2⤵
  PID:8020
- C:\Windows\System\lsQeoYV.exe
  C:\Windows\System\lsQeoYV.exe
  2⤵
  PID:8036
- C:\Windows\System\fnbCtAU.exe
  C:\Windows\System\fnbCtAU.exe
  2⤵
  PID:8052
- C:\Windows\System\JkfrbPM.exe
  C:\Windows\System\JkfrbPM.exe
  2⤵
  PID:8068
- C:\Windows\System\tmvlUWD.exe
  C:\Windows\System\tmvlUWD.exe
  2⤵
  PID:8084
- C:\Windows\System\dbmJdSF.exe
  C:\Windows\System\dbmJdSF.exe
  2⤵
  PID:8100
- C:\Windows\System\OhpdFPc.exe
  C:\Windows\System\OhpdFPc.exe
  2⤵
  PID:8116
- C:\Windows\System\ZgScKPq.exe
  C:\Windows\System\ZgScKPq.exe
  2⤵
  PID:8132
- C:\Windows\System\vGpPzaK.exe
  C:\Windows\System\vGpPzaK.exe
  2⤵
  PID:8148
- C:\Windows\System\MdmCiMx.exe
  C:\Windows\System\MdmCiMx.exe
  2⤵
  PID:8164
- C:\Windows\System\yDzXkpc.exe
  C:\Windows\System\yDzXkpc.exe
  2⤵
  PID:8180
- C:\Windows\System\IzCSwXW.exe
  C:\Windows\System\IzCSwXW.exe
  2⤵
  PID:6260
- C:\Windows\System\OCbzjTO.exe
  C:\Windows\System\OCbzjTO.exe
  2⤵
  PID:7216
- C:\Windows\System\YKAgHre.exe
  C:\Windows\System\YKAgHre.exe
  2⤵
  PID:6244
- C:\Windows\System\tgbxthc.exe
  C:\Windows\System\tgbxthc.exe
  2⤵
  PID:7232
- C:\Windows\System\uIItaCu.exe
  C:\Windows\System\uIItaCu.exe
  2⤵
  PID:7260
- C:\Windows\System\zgExKaY.exe
  C:\Windows\System\zgExKaY.exe
  2⤵
  PID:7324
- C:\Windows\System\xTGBndg.exe
  C:\Windows\System\xTGBndg.exe
  2⤵
  PID:7356
- C:\Windows\System\qvmTusX.exe
  C:\Windows\System\qvmTusX.exe
  2⤵
  PID:7420
- C:\Windows\System\GckpCGp.exe
  C:\Windows\System\GckpCGp.exe
  2⤵
  PID:7304
- C:\Windows\System\EJbkONJ.exe
  C:\Windows\System\EJbkONJ.exe
  2⤵
  PID:7516
- C:\Windows\System\vZEfFlc.exe
  C:\Windows\System\vZEfFlc.exe
  2⤵
  PID:7580
- C:\Windows\System\fIiwQwj.exe
  C:\Windows\System\fIiwQwj.exe
  2⤵
  PID:7312
- C:\Windows\System\DQLnqVr.exe
  C:\Windows\System\DQLnqVr.exe
  2⤵
  PID:7504
- C:\Windows\System\jfnQOGn.exe
  C:\Windows\System\jfnQOGn.exe
  2⤵
  PID:7708
- C:\Windows\System\IBobSHa.exe
  C:\Windows\System\IBobSHa.exe
  2⤵
  PID:7740
- C:\Windows\System\VNEhLxG.exe
  C:\Windows\System\VNEhLxG.exe
  2⤵
  PID:7344
- C:\Windows\System\eaCiPlc.exe
  C:\Windows\System\eaCiPlc.exe
  2⤵
  PID:7408
- C:\Windows\System\elNwJky.exe
  C:\Windows\System\elNwJky.exe
  2⤵
  PID:7532
- C:\Windows\System\fyOpJpx.exe
  C:\Windows\System\fyOpJpx.exe
  2⤵
  PID:7632
- C:\Windows\System\FhkfMNv.exe
  C:\Windows\System\FhkfMNv.exe
  2⤵
  PID:7808
- C:\Windows\System\Ethamun.exe
  C:\Windows\System\Ethamun.exe
  2⤵
  PID:7692
- C:\Windows\System\hCbvfMB.exe
  C:\Windows\System\hCbvfMB.exe
  2⤵
  PID:7840
- C:\Windows\System\gargMny.exe
  C:\Windows\System\gargMny.exe
  2⤵
  PID:7824
- C:\Windows\System\jHkzLrB.exe
  C:\Windows\System\jHkzLrB.exe
  2⤵
  PID:7852
- C:\Windows\System\XCeKSJM.exe
  C:\Windows\System\XCeKSJM.exe
  2⤵
  PID:7904
- C:\Windows\System\nVegeYL.exe
  C:\Windows\System\nVegeYL.exe
  2⤵
  PID:8076
- C:\Windows\System\fJzomGg.exe
  C:\Windows\System\fJzomGg.exe
  2⤵
  PID:8124
- C:\Windows\System\SkgOBMp.exe
  C:\Windows\System\SkgOBMp.exe
  2⤵
  PID:8080
- C:\Windows\System\qiVHCKi.exe
  C:\Windows\System\qiVHCKi.exe
  2⤵
  PID:7184
- C:\Windows\System\OhMKIUB.exe
  C:\Windows\System\OhMKIUB.exe
  2⤵
  PID:8176
- C:\Windows\System\CmpFHJY.exe
  C:\Windows\System\CmpFHJY.exe
  2⤵
  PID:7272
- C:\Windows\System\qNKKSTE.exe
  C:\Windows\System\qNKKSTE.exe
  2⤵
  PID:7308
- C:\Windows\System\OCzHVHO.exe
  C:\Windows\System\OCzHVHO.exe
  2⤵
  PID:7376
- C:\Windows\System\hTfxBKU.exe
  C:\Windows\System\hTfxBKU.exe
  2⤵
  PID:7468
- C:\Windows\System\xUcRsUG.exe
  C:\Windows\System\xUcRsUG.exe
  2⤵
  PID:7628
- C:\Windows\System\THRkCVq.exe
  C:\Windows\System\THRkCVq.exe
  2⤵
  PID:7616
- C:\Windows\System\uJOOGeZ.exe
  C:\Windows\System\uJOOGeZ.exe
  2⤵
  PID:7436
- C:\Windows\System\SuXUjwQ.exe
  C:\Windows\System\SuXUjwQ.exe
  2⤵
  PID:7900
- C:\Windows\System\KPWCpoQ.exe
  C:\Windows\System\KPWCpoQ.exe
  2⤵
  PID:7724
- C:\Windows\System\nxqcwRV.exe
  C:\Windows\System\nxqcwRV.exe
  2⤵
  PID:7936
- C:\Windows\System\ryPYXmK.exe
  C:\Windows\System\ryPYXmK.exe
  2⤵
  PID:7920
- C:\Windows\System\pGRYSPg.exe
  C:\Windows\System\pGRYSPg.exe
  2⤵
  PID:7980
- C:\Windows\System\GrXsXQr.exe
  C:\Windows\System\GrXsXQr.exe
  2⤵
  PID:8060
- C:\Windows\System\pPCYqsv.exe
  C:\Windows\System\pPCYqsv.exe
  2⤵
  PID:8016
- C:\Windows\System\ntnZEdD.exe
  C:\Windows\System\ntnZEdD.exe
  2⤵
  PID:8112
- C:\Windows\System\EdGoDSy.exe
  C:\Windows\System\EdGoDSy.exe
  2⤵
  PID:8096
- C:\Windows\System\mHSODka.exe
  C:\Windows\System\mHSODka.exe
  2⤵
  PID:7036
- C:\Windows\System\NSFAQyZ.exe
  C:\Windows\System\NSFAQyZ.exe
  2⤵
  PID:7288
- C:\Windows\System\MJlfojK.exe
  C:\Windows\System\MJlfojK.exe
  2⤵
  PID:7404
- C:\Windows\System\foFOmra.exe
  C:\Windows\System\foFOmra.exe
  2⤵
  PID:7872
- C:\Windows\System\OXBNPXx.exe
  C:\Windows\System\OXBNPXx.exe
  2⤵
  PID:4876
- C:\Windows\System\qjkEjXw.exe
  C:\Windows\System\qjkEjXw.exe
  2⤵
  PID:7648
- C:\Windows\System\vXJCclV.exe
  C:\Windows\System\vXJCclV.exe
  2⤵
  PID:7548
- C:\Windows\System\OoFowFg.exe
  C:\Windows\System\OoFowFg.exe
  2⤵
  PID:7804
- C:\Windows\System\pHJlpGB.exe
  C:\Windows\System\pHJlpGB.exe
  2⤵
  PID:7888
- C:\Windows\System\XxYlOOr.exe
  C:\Windows\System\XxYlOOr.exe
  2⤵
  PID:8044
- C:\Windows\System\uHTBLWG.exe
  C:\Windows\System\uHTBLWG.exe
  2⤵
  PID:8000
- C:\Windows\System\nzSsBKA.exe
  C:\Windows\System\nzSsBKA.exe
  2⤵
  PID:7552
- C:\Windows\System\gdlUZUE.exe
  C:\Windows\System\gdlUZUE.exe
  2⤵
  PID:7612
- C:\Windows\System\zGTWSAQ.exe
  C:\Windows\System\zGTWSAQ.exe
  2⤵
  PID:8208
- C:\Windows\System\wlzuRqp.exe
  C:\Windows\System\wlzuRqp.exe
  2⤵
  PID:8224
- C:\Windows\System\fmoUmsb.exe
  C:\Windows\System\fmoUmsb.exe
  2⤵
  PID:8240
- C:\Windows\System\iDgIdCG.exe
  C:\Windows\System\iDgIdCG.exe
  2⤵
  PID:8256
- C:\Windows\System\kWRqjmC.exe
  C:\Windows\System\kWRqjmC.exe
  2⤵
  PID:8272
- C:\Windows\System\HYvsRlG.exe
  C:\Windows\System\HYvsRlG.exe
  2⤵
  PID:8288
- C:\Windows\System\CXyWBIA.exe
  C:\Windows\System\CXyWBIA.exe
  2⤵
  PID:8304
- C:\Windows\System\LtPmrUP.exe
  C:\Windows\System\LtPmrUP.exe
  2⤵
  PID:8320
- C:\Windows\System\QOMgwCc.exe
  C:\Windows\System\QOMgwCc.exe
  2⤵
  PID:8336
- C:\Windows\System\yGnsRoc.exe
  C:\Windows\System\yGnsRoc.exe
  2⤵
  PID:8352
- C:\Windows\System\TUjpUHJ.exe
  C:\Windows\System\TUjpUHJ.exe
  2⤵
  PID:8368
- C:\Windows\System\DrYNJXE.exe
  C:\Windows\System\DrYNJXE.exe
  2⤵
  PID:8384
- C:\Windows\System\vdOUzjV.exe
  C:\Windows\System\vdOUzjV.exe
  2⤵
  PID:8400
- C:\Windows\System\PNCywTD.exe
  C:\Windows\System\PNCywTD.exe
  2⤵
  PID:8416
- C:\Windows\System\WACFuCf.exe
  C:\Windows\System\WACFuCf.exe
  2⤵
  PID:8436
- C:\Windows\System\yeVnQPh.exe
  C:\Windows\System\yeVnQPh.exe
  2⤵
  PID:8452
- C:\Windows\System\jQQFbNX.exe
  C:\Windows\System\jQQFbNX.exe
  2⤵
  PID:8468
- C:\Windows\System\KaxPLJK.exe
  C:\Windows\System\KaxPLJK.exe
  2⤵
  PID:8484
- C:\Windows\System\pbzfIJx.exe
  C:\Windows\System\pbzfIJx.exe
  2⤵
  PID:8500
- C:\Windows\System\CIzjbDk.exe
  C:\Windows\System\CIzjbDk.exe
  2⤵
  PID:8516
- C:\Windows\System\xRXTDFr.exe
  C:\Windows\System\xRXTDFr.exe
  2⤵
  PID:8532
- C:\Windows\System\vosOlND.exe
  C:\Windows\System\vosOlND.exe
  2⤵
  PID:8548
- C:\Windows\System\GPqBxLt.exe
  C:\Windows\System\GPqBxLt.exe
  2⤵
  PID:8568
- C:\Windows\System\UxMVBzD.exe
  C:\Windows\System\UxMVBzD.exe
  2⤵
  PID:8584
- C:\Windows\System\ETzXCcb.exe
  C:\Windows\System\ETzXCcb.exe
  2⤵
  PID:8600
- C:\Windows\System\nXpmSAt.exe
  C:\Windows\System\nXpmSAt.exe
  2⤵
  PID:8616
- C:\Windows\System\ixJQfFP.exe
  C:\Windows\System\ixJQfFP.exe
  2⤵
  PID:8632
- C:\Windows\System\zbguRvX.exe
  C:\Windows\System\zbguRvX.exe
  2⤵
  PID:8652
- C:\Windows\System\HbuARhq.exe
  C:\Windows\System\HbuARhq.exe
  2⤵
  PID:8668
- C:\Windows\System\VXnUAOc.exe
  C:\Windows\System\VXnUAOc.exe
  2⤵
  PID:8684
- C:\Windows\System\UvWXYWV.exe
  C:\Windows\System\UvWXYWV.exe
  2⤵
  PID:8704
- C:\Windows\System\tbVqaRU.exe
  C:\Windows\System\tbVqaRU.exe
  2⤵
  PID:8720
- C:\Windows\System\reWeTwy.exe
  C:\Windows\System\reWeTwy.exe
  2⤵
  PID:8736
- C:\Windows\System\iCPvrxh.exe
  C:\Windows\System\iCPvrxh.exe
  2⤵
  PID:8756
- C:\Windows\System\jLVJoVQ.exe
  C:\Windows\System\jLVJoVQ.exe
  2⤵
  PID:8772
- C:\Windows\System\KsktYYc.exe
  C:\Windows\System\KsktYYc.exe
  2⤵
  PID:8788
- C:\Windows\System\HIDUgqi.exe
  C:\Windows\System\HIDUgqi.exe
  2⤵
  PID:8804
- C:\Windows\System\bskcyTy.exe
  C:\Windows\System\bskcyTy.exe
  2⤵
  PID:8824
- C:\Windows\System\nMROmVt.exe
  C:\Windows\System\nMROmVt.exe
  2⤵
  PID:8840
- C:\Windows\System\SJEsOks.exe
  C:\Windows\System\SJEsOks.exe
  2⤵
  PID:8856
- C:\Windows\System\hAEtrKh.exe
  C:\Windows\System\hAEtrKh.exe
  2⤵
  PID:8876
- C:\Windows\System\usttpCZ.exe
  C:\Windows\System\usttpCZ.exe
  2⤵
  PID:8892
- C:\Windows\System\hTdQUWd.exe
  C:\Windows\System\hTdQUWd.exe
  2⤵
  PID:8908
- C:\Windows\System\gTpVzUw.exe
  C:\Windows\System\gTpVzUw.exe
  2⤵
  PID:8928
- C:\Windows\System\JKXWGPk.exe
  C:\Windows\System\JKXWGPk.exe
  2⤵
  PID:8948
- C:\Windows\System\EBCmKSK.exe
  C:\Windows\System\EBCmKSK.exe
  2⤵
  PID:8964
- C:\Windows\System\DjAxjPf.exe
  C:\Windows\System\DjAxjPf.exe
  2⤵
  PID:8980
- C:\Windows\System\fNzClrI.exe
  C:\Windows\System\fNzClrI.exe
  2⤵
  PID:9000
- C:\Windows\System\ZlVNqwb.exe
  C:\Windows\System\ZlVNqwb.exe
  2⤵
  PID:9016
- C:\Windows\System\viviDNt.exe
  C:\Windows\System\viviDNt.exe
  2⤵
  PID:9032
- C:\Windows\System\yjuYHMe.exe
  C:\Windows\System\yjuYHMe.exe
  2⤵
  PID:9048
- C:\Windows\System\CWUXmID.exe
  C:\Windows\System\CWUXmID.exe
  2⤵
  PID:9064
- C:\Windows\System\sqqEzKa.exe
  C:\Windows\System\sqqEzKa.exe
  2⤵
  PID:9080
- C:\Windows\System\gjCPlEd.exe
  C:\Windows\System\gjCPlEd.exe
  2⤵
  PID:9096
- C:\Windows\System\wxxpeLL.exe
  C:\Windows\System\wxxpeLL.exe
  2⤵
  PID:9112
- C:\Windows\System\MFAiYdt.exe
  C:\Windows\System\MFAiYdt.exe
  2⤵
  PID:9128
- C:\Windows\System\jdpqjWc.exe
  C:\Windows\System\jdpqjWc.exe
  2⤵
  PID:9144
- C:\Windows\System\xSlKYaE.exe
  C:\Windows\System\xSlKYaE.exe
  2⤵
  PID:9160
- C:\Windows\System\ZQCMAry.exe
  C:\Windows\System\ZQCMAry.exe
  2⤵
  PID:9176
- C:\Windows\System\LmLkuMA.exe
  C:\Windows\System\LmLkuMA.exe
  2⤵
  PID:9192
- C:\Windows\System\cgDKusq.exe
  C:\Windows\System\cgDKusq.exe
  2⤵
  PID:9208
- C:\Windows\System\oGWYnbA.exe
  C:\Windows\System\oGWYnbA.exe
  2⤵
  PID:8220
- C:\Windows\System\jHepDyj.exe
  C:\Windows\System\jHepDyj.exe
  2⤵
  PID:8284
- C:\Windows\System\cDWwVcr.exe
  C:\Windows\System\cDWwVcr.exe
  2⤵
  PID:8348
- C:\Windows\System\MJQiRyC.exe
  C:\Windows\System\MJQiRyC.exe
  2⤵
  PID:8412
- C:\Windows\System\CtPoIGG.exe
  C:\Windows\System\CtPoIGG.exe
  2⤵
  PID:8160
- C:\Windows\System\tqHMzdT.exe
  C:\Windows\System\tqHMzdT.exe
  2⤵
  PID:7728
- C:\Windows\System\wYSCRJC.exe
  C:\Windows\System\wYSCRJC.exe
  2⤵
  PID:7664
- C:\Windows\System\HOxjVTk.exe
  C:\Windows\System\HOxjVTk.exe
  2⤵
  PID:7568
- C:\Windows\System\DJSsFzC.exe
  C:\Windows\System\DJSsFzC.exe
  2⤵
  PID:8232
- C:\Windows\System\FnytJXg.exe
  C:\Windows\System\FnytJXg.exe
  2⤵
  PID:8296
- C:\Windows\System\QFnfnQD.exe
  C:\Windows\System\QFnfnQD.exe
  2⤵
  PID:8360
- C:\Windows\System\LbNTQji.exe
  C:\Windows\System\LbNTQji.exe
  2⤵
  PID:8424
- C:\Windows\System\Knxrtid.exe
  C:\Windows\System\Knxrtid.exe
  2⤵
  PID:8460
- C:\Windows\System\pxEfsOX.exe
  C:\Windows\System\pxEfsOX.exe
  2⤵
  PID:8480
- C:\Windows\System\xRjMXtS.exe
  C:\Windows\System\xRjMXtS.exe
  2⤵
  PID:8544
- C:\Windows\System\hUlzaJO.exe
  C:\Windows\System\hUlzaJO.exe
  2⤵
  PID:8576
- C:\Windows\System\AzuQZWR.exe
  C:\Windows\System\AzuQZWR.exe
  2⤵
  PID:8640
- C:\Windows\System\QicWDtU.exe
  C:\Windows\System\QicWDtU.exe
  2⤵
  PID:8624
- C:\Windows\System\ynszeLF.exe
  C:\Windows\System\ynszeLF.exe
  2⤵
  PID:8832
- C:\Windows\System\jXHDTLc.exe
  C:\Windows\System\jXHDTLc.exe
  2⤵
  PID:8712
- C:\Windows\System\Aarfgew.exe
  C:\Windows\System\Aarfgew.exe
  2⤵
  PID:8784
- C:\Windows\System\wXUUNDg.exe
  C:\Windows\System\wXUUNDg.exe
  2⤵
  PID:8848
- C:\Windows\System\IpHPVrE.exe
  C:\Windows\System\IpHPVrE.exe
  2⤵
  PID:8916
- C:\Windows\System\PisehnV.exe
  C:\Windows\System\PisehnV.exe
  2⤵
  PID:8960
- C:\Windows\System\ijINGUu.exe
  C:\Windows\System\ijINGUu.exe
  2⤵
  PID:9024
- C:\Windows\System\dXMajDm.exe
  C:\Windows\System\dXMajDm.exe
  2⤵
  PID:8864
- C:\Windows\System\aqJiUIW.exe
  C:\Windows\System\aqJiUIW.exe
  2⤵
  PID:9092
- C:\Windows\System\rpiYESm.exe
  C:\Windows\System\rpiYESm.exe
  2⤵
  PID:9156
- C:\Windows\System\ZfQxfHC.exe
  C:\Windows\System\ZfQxfHC.exe
  2⤵
  PID:8800
- C:\Windows\System\QhlTPMF.exe
  C:\Windows\System\QhlTPMF.exe
  2⤵
  PID:8664
- C:\Windows\System\FDtpfTP.exe
  C:\Windows\System\FDtpfTP.exe
  2⤵
  PID:8700
- C:\Windows\System\pUiGjyk.exe
  C:\Windows\System\pUiGjyk.exe
  2⤵
  PID:8768
- C:\Windows\System\wlLEkTM.exe
  C:\Windows\System\wlLEkTM.exe
  2⤵
  PID:9200
- C:\Windows\System\cdGwGhR.exe
  C:\Windows\System\cdGwGhR.exe
  2⤵
  PID:7256
- C:\Windows\System\nOsBJHn.exe
  C:\Windows\System\nOsBJHn.exe
  2⤵
  PID:8204
- C:\Windows\System\XjDSygl.exe
  C:\Windows\System\XjDSygl.exe
  2⤵
  PID:8868
- C:\Windows\System\KeqLFtJ.exe
  C:\Windows\System\KeqLFtJ.exe
  2⤵
  PID:9168
- C:\Windows\System\NaAdvGu.exe
  C:\Windows\System\NaAdvGu.exe
  2⤵
  PID:9012
- C:\Windows\System\lAEkTnD.exe
  C:\Windows\System\lAEkTnD.exe
  2⤵
  PID:9104
- C:\Windows\System\wYLvJMw.exe
  C:\Windows\System\wYLvJMw.exe
  2⤵
  PID:8252
- C:\Windows\System\yliXKOu.exe
  C:\Windows\System\yliXKOu.exe
  2⤵
  PID:8140
- C:\Windows\System\IDmqQfM.exe
  C:\Windows\System\IDmqQfM.exe
  2⤵
  PID:8264
- C:\Windows\System\roGWTsr.exe
  C:\Windows\System\roGWTsr.exe
  2⤵
  PID:8464
- C:\Windows\System\dBnteAL.exe
  C:\Windows\System\dBnteAL.exe
  2⤵
  PID:8612
- C:\Windows\System\dKcgGTe.exe
  C:\Windows\System\dKcgGTe.exe
  2⤵
  PID:8744
- C:\Windows\System\RsalkPu.exe
  C:\Windows\System\RsalkPu.exe
  2⤵
  PID:8996
- C:\Windows\System\FrvkGIX.exe
  C:\Windows\System\FrvkGIX.exe
  2⤵
  PID:8796
- C:\Windows\System\AnzJYFb.exe
  C:\Windows\System\AnzJYFb.exe
  2⤵
  PID:8316
- C:\Windows\System\nJzBltW.exe
  C:\Windows\System\nJzBltW.exe
  2⤵
  PID:9108
- C:\Windows\System\wtvpBkl.exe
  C:\Windows\System\wtvpBkl.exe
  2⤵
  PID:8408
- C:\Windows\System\OfJinos.exe
  C:\Windows\System\OfJinos.exe
  2⤵
  PID:8396
- C:\Windows\System\MVMaCka.exe
  C:\Windows\System\MVMaCka.exe
  2⤵
  PID:8680
- C:\Windows\System\TCUcHHS.exe
  C:\Windows\System\TCUcHHS.exe
  2⤵
  PID:9088
- C:\Windows\System\WqFZulv.exe
  C:\Windows\System\WqFZulv.exe
  2⤵
  PID:7916
- C:\Windows\System\GGFpXoz.exe
  C:\Windows\System\GGFpXoz.exe
  2⤵
  PID:8328
- C:\Windows\System\wLuidqL.exe
  C:\Windows\System\wLuidqL.exe
  2⤵
  PID:8752
- C:\Windows\System\lzBwCtl.exe
  C:\Windows\System\lzBwCtl.exe
  2⤵
  PID:8496
- C:\Windows\System\lVQHmvb.exe
  C:\Windows\System\lVQHmvb.exe
  2⤵
  PID:8732
- C:\Windows\System\KPNBZNp.exe
  C:\Windows\System\KPNBZNp.exe
  2⤵
  PID:8644
- C:\Windows\System\IuGwIJG.exe
  C:\Windows\System\IuGwIJG.exe
  2⤵
  PID:8780
- C:\Windows\System\HTohajG.exe
  C:\Windows\System\HTohajG.exe
  2⤵
  PID:9152
- C:\Windows\System\SoxBPQc.exe
  C:\Windows\System\SoxBPQc.exe
  2⤵
  PID:8972
- C:\Windows\System\tXoJZWo.exe
  C:\Windows\System\tXoJZWo.exe
  2⤵
  PID:8592
- C:\Windows\System\KkTtWYK.exe
  C:\Windows\System\KkTtWYK.exe
  2⤵
  PID:8540
- C:\Windows\System\MSqVNCe.exe
  C:\Windows\System\MSqVNCe.exe
  2⤵
  PID:8728
- C:\Windows\System\PZyvCzd.exe
  C:\Windows\System\PZyvCzd.exe
  2⤵
  PID:8676
- C:\Windows\System\JGhijcm.exe
  C:\Windows\System\JGhijcm.exe
  2⤵
  PID:8924
- C:\Windows\System\MXCiIhq.exe
  C:\Windows\System\MXCiIhq.exe
  2⤵
  PID:8992
- C:\Windows\System\vYHpdOh.exe
  C:\Windows\System\vYHpdOh.exe
  2⤵
  PID:9248
- C:\Windows\System\sjfhMYA.exe
  C:\Windows\System\sjfhMYA.exe
  2⤵
  PID:9264
- C:\Windows\System\JsLHqpk.exe
  C:\Windows\System\JsLHqpk.exe
  2⤵
  PID:9280
- C:\Windows\System\XyMxFSq.exe
  C:\Windows\System\XyMxFSq.exe
  2⤵
  PID:9300
- C:\Windows\System\FIUyVfa.exe
  C:\Windows\System\FIUyVfa.exe
  2⤵
  PID:9320
- C:\Windows\System\nWCbayi.exe
  C:\Windows\System\nWCbayi.exe
  2⤵
  PID:9336
- C:\Windows\System\GZORejQ.exe
  C:\Windows\System\GZORejQ.exe
  2⤵
  PID:9352
- C:\Windows\System\ByCVpSX.exe
  C:\Windows\System\ByCVpSX.exe
  2⤵
  PID:9372
- C:\Windows\System\MaoGeZM.exe
  C:\Windows\System\MaoGeZM.exe
  2⤵
  PID:9388
- C:\Windows\System\vuLTIRo.exe
  C:\Windows\System\vuLTIRo.exe
  2⤵
  PID:9404
- C:\Windows\System\yhdjPEd.exe
  C:\Windows\System\yhdjPEd.exe
  2⤵
  PID:9424
- C:\Windows\System\wURfxCI.exe
  C:\Windows\System\wURfxCI.exe
  2⤵
  PID:9440
- C:\Windows\System\btoEFBP.exe
  C:\Windows\System\btoEFBP.exe
  2⤵
  PID:9460
- C:\Windows\System\QmHHlYL.exe
  C:\Windows\System\QmHHlYL.exe
  2⤵
  PID:9476
- C:\Windows\System\PKlKMKF.exe
  C:\Windows\System\PKlKMKF.exe
  2⤵
  PID:9496
- C:\Windows\System\pIGsMaE.exe
  C:\Windows\System\pIGsMaE.exe
  2⤵
  PID:9512
- C:\Windows\System\BuqeDno.exe
  C:\Windows\System\BuqeDno.exe
  2⤵
  PID:9528
- C:\Windows\System\QBcuGXP.exe
  C:\Windows\System\QBcuGXP.exe
  2⤵
  PID:9548
- C:\Windows\System\UpzaAvT.exe
  C:\Windows\System\UpzaAvT.exe
  2⤵
  PID:9564
- C:\Windows\System\hDTerXS.exe
  C:\Windows\System\hDTerXS.exe
  2⤵
  PID:9584
- C:\Windows\System\JmyBemJ.exe
  C:\Windows\System\JmyBemJ.exe
  2⤵
  PID:9624
- C:\Windows\System\LqaGurE.exe
  C:\Windows\System\LqaGurE.exe
  2⤵
  PID:9644
- C:\Windows\System\Fezynvk.exe
  C:\Windows\System\Fezynvk.exe
  2⤵
  PID:9660
- C:\Windows\System\NRNMXSA.exe
  C:\Windows\System\NRNMXSA.exe
  2⤵
  PID:9676
- C:\Windows\System\OGQdiGk.exe
  C:\Windows\System\OGQdiGk.exe
  2⤵
  PID:9696
- C:\Windows\System\fSOnNiv.exe
  C:\Windows\System\fSOnNiv.exe
  2⤵
  PID:9712
- C:\Windows\System\nlHWOoA.exe
  C:\Windows\System\nlHWOoA.exe
  2⤵
  PID:9728
- C:\Windows\System\baEFXJB.exe
  C:\Windows\System\baEFXJB.exe
  2⤵
  PID:9744
- C:\Windows\System\QTICAZU.exe
  C:\Windows\System\QTICAZU.exe
  2⤵
  PID:9764
- C:\Windows\System\DsaKyIr.exe
  C:\Windows\System\DsaKyIr.exe
  2⤵
  PID:9840
- C:\Windows\System\PNymbvu.exe
  C:\Windows\System\PNymbvu.exe
  2⤵
  PID:9856
- C:\Windows\System\qKBGqJq.exe
  C:\Windows\System\qKBGqJq.exe
  2⤵
  PID:9872
- C:\Windows\System\ZYYuYKn.exe
  C:\Windows\System\ZYYuYKn.exe
  2⤵
  PID:9888
- C:\Windows\System\UimPxgW.exe
  C:\Windows\System\UimPxgW.exe
  2⤵
  PID:9904
- C:\Windows\System\wPEvmPY.exe
  C:\Windows\System\wPEvmPY.exe
  2⤵
  PID:9920
- C:\Windows\System\DpoAChL.exe
  C:\Windows\System\DpoAChL.exe
  2⤵
  PID:9936
- C:\Windows\System\GgzEJDq.exe
  C:\Windows\System\GgzEJDq.exe
  2⤵
  PID:9952
- C:\Windows\System\zRYiLzh.exe
  C:\Windows\System\zRYiLzh.exe
  2⤵
  PID:9968
- C:\Windows\System\KyeMrKO.exe
  C:\Windows\System\KyeMrKO.exe
  2⤵
  PID:9984
- C:\Windows\System\pHildDz.exe
  C:\Windows\System\pHildDz.exe
  2⤵
  PID:10000
- C:\Windows\System\jPeSIdS.exe
  C:\Windows\System\jPeSIdS.exe
  2⤵
  PID:10024
- C:\Windows\System\Xdknsnn.exe
  C:\Windows\System\Xdknsnn.exe
  2⤵
  PID:10040
- C:\Windows\System\pJODXRs.exe
  C:\Windows\System\pJODXRs.exe
  2⤵
  PID:10056
- C:\Windows\System\LpIiwBb.exe
  C:\Windows\System\LpIiwBb.exe
  2⤵
  PID:10080
- C:\Windows\System\yeyWCSa.exe
  C:\Windows\System\yeyWCSa.exe
  2⤵
  PID:10100
- C:\Windows\System\wfuuXdZ.exe
  C:\Windows\System\wfuuXdZ.exe
  2⤵
  PID:10116
- C:\Windows\System\aZRjkUA.exe
  C:\Windows\System\aZRjkUA.exe
  2⤵
  PID:10132
- C:\Windows\System\iQfrLxK.exe
  C:\Windows\System\iQfrLxK.exe
  2⤵
  PID:10148
- C:\Windows\System\FNoZlot.exe
  C:\Windows\System\FNoZlot.exe
  2⤵
  PID:10164
- C:\Windows\System\KOKsswQ.exe
  C:\Windows\System\KOKsswQ.exe
  2⤵
  PID:10180
- C:\Windows\System\UOTqFxU.exe
  C:\Windows\System\UOTqFxU.exe
  2⤵
  PID:10200
- C:\Windows\System\eRgqyIJ.exe
  C:\Windows\System\eRgqyIJ.exe
  2⤵
  PID:10216
- C:\Windows\System\fquHmgo.exe
  C:\Windows\System\fquHmgo.exe
  2⤵
  PID:10232
- C:\Windows\System\cMIhIvF.exe
  C:\Windows\System\cMIhIvF.exe
  2⤵
  PID:8448
- C:\Windows\System\CShppvW.exe
  C:\Windows\System\CShppvW.exe
  2⤵
  PID:9236
- C:\Windows\System\fynyeRK.exe
  C:\Windows\System\fynyeRK.exe
  2⤵
  PID:8956
- C:\Windows\System\rfMgxpZ.exe
  C:\Windows\System\rfMgxpZ.exe
  2⤵
  PID:8904
- C:\Windows\System\jlpYhDW.exe
  C:\Windows\System\jlpYhDW.exe
  2⤵
  PID:9308
- C:\Windows\System\CGKHIiO.exe
  C:\Windows\System\CGKHIiO.exe
  2⤵
  PID:9384
- C:\Windows\System\FEqtEWe.exe
  C:\Windows\System\FEqtEWe.exe
  2⤵
  PID:9452
- C:\Windows\System\JTpHqkk.exe
  C:\Windows\System\JTpHqkk.exe
  2⤵
  PID:9456
- C:\Windows\System\CaacSoQ.exe
  C:\Windows\System\CaacSoQ.exe
  2⤵
  PID:9524
- C:\Windows\System\kaZapVe.exe
  C:\Windows\System\kaZapVe.exe
  2⤵
  PID:9592
- C:\Windows\System\TYgiJEE.exe
  C:\Windows\System\TYgiJEE.exe
  2⤵
  PID:9296
- C:\Windows\System\opYmjbf.exe
  C:\Windows\System\opYmjbf.exe
  2⤵
  PID:9360
- C:\Windows\System\ABhvQSu.exe
  C:\Windows\System\ABhvQSu.exe
  2⤵
  PID:9400
- C:\Windows\System\VmpgABc.exe
  C:\Windows\System\VmpgABc.exe
  2⤵
  PID:9536
- C:\Windows\System\JTcRVAl.exe
  C:\Windows\System\JTcRVAl.exe
  2⤵
  PID:9576
- C:\Windows\System\XTIVviO.exe
  C:\Windows\System\XTIVviO.exe
  2⤵
  PID:9604
- C:\Windows\System\dvaRsyW.exe
  C:\Windows\System\dvaRsyW.exe
  2⤵
  PID:9600
- C:\Windows\System\ZTrUnYE.exe
  C:\Windows\System\ZTrUnYE.exe
  2⤵
  PID:9688
- C:\Windows\System\bAHbDcO.exe
  C:\Windows\System\bAHbDcO.exe
  2⤵
  PID:9724
- C:\Windows\System\NofEUxp.exe
  C:\Windows\System\NofEUxp.exe
  2⤵
  PID:9632
- C:\Windows\System\jEctnRV.exe
  C:\Windows\System\jEctnRV.exe
  2⤵
  PID:9704
- C:\Windows\System\llUJMgH.exe
  C:\Windows\System\llUJMgH.exe
  2⤵
  PID:9800
- C:\Windows\System\dQEpbZV.exe
  C:\Windows\System\dQEpbZV.exe
  2⤵
  PID:9792
- C:\Windows\System\XwVKENN.exe
  C:\Windows\System\XwVKENN.exe
  2⤵
  PID:9812
- C:\Windows\System\wljzwvb.exe
  C:\Windows\System\wljzwvb.exe
  2⤵
  PID:9828
- C:\Windows\System\yFtSwnh.exe
  C:\Windows\System\yFtSwnh.exe
  2⤵
  PID:9880
- C:\Windows\System\PBNMydO.exe
  C:\Windows\System\PBNMydO.exe
  2⤵
  PID:9916
- C:\Windows\System\xMYlkym.exe
  C:\Windows\System\xMYlkym.exe
  2⤵
  PID:10016
- C:\Windows\System\hbOCJOD.exe
  C:\Windows\System\hbOCJOD.exe
  2⤵
  PID:10008
- C:\Windows\System\MYLcIZz.exe
  C:\Windows\System\MYLcIZz.exe
  2⤵
  PID:10048
- C:\Windows\System\pxcEHXj.exe
  C:\Windows\System\pxcEHXj.exe
  2⤵
  PID:10156
- C:\Windows\System\GOWbluF.exe
  C:\Windows\System\GOWbluF.exe
  2⤵
  PID:9868
- C:\Windows\System\UYwuPEx.exe
  C:\Windows\System\UYwuPEx.exe
  2⤵
  PID:9140
- C:\Windows\System\WgXrQVX.exe
  C:\Windows\System\WgXrQVX.exe
  2⤵
  PID:9420
- C:\Windows\System\mAkskmP.exe
  C:\Windows\System\mAkskmP.exe
  2⤵
  PID:9364

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CBddVjZ.exe

Filesize
1.9MB

MD5
56561d30d5edfb0803c77426e3acfe29

SHA1
a6039650b1877e89af308d658e90128054de3d62

SHA256
25ded1dc0ddbffd6f2c6acb07fc19cbb078172a761548dc75edabba3ae23f4c3

SHA512
c8b57d37075280e970bb0e152c1c9bd75221f5ef98168fefb243786519f4d79368fda48d3a713aadfb9d3f33dd867d2eb11b27944fe6909778518ae8ee42011f

Download Submit
C:\Windows\system\DJowFNB.exe

Filesize
1.9MB

MD5
af66b0eb7e9c3300bb500ef61ca31926

SHA1
0b0e7c5fb30b938a1c3747ae1ce99c6e4a162342

SHA256
120f2b18f3d7c8d20fbf09ee01e1240d1afcfaebc4c2cc13a5ff10a85e196ef2

SHA512
1f6051830a883fe859ef29f2b060802e9dcbacb31087aee20d000060828ca60298c0cc82f8d05ec771ec7bb72d4fa503fa22500055cc8dc4a6bbd05f5a677186

Download Submit
C:\Windows\system\GhCdUAU.exe

Filesize
1.9MB

MD5
e541742fa9f595a2b0d97911c6bb9cbd

SHA1
32dc74d12f7f33167f2551087d969084f6aa6ee1

SHA256
df6ab2830f8d40042e2986bad2b4f2bf71d2e2eb062c46b339dec9fe7de64fd3

SHA512
518faf544e2970d1ded2301138a4a83659372335add14923db11179432173650a1d6b24c3a2e0e3299eef47bf3f940a3aeb56382dbbc48ea7200ac68aea3e130

Download Submit
C:\Windows\system\GnHLDGN.exe

Filesize
1.9MB

MD5
a63f50043d3ca7a8de095e8eea293162

SHA1
d6ab4613f5a87ed752b40c8bb6c3ae84aa198652

SHA256
8e3811be96d5f3d7ba92c5648cd1027d1699435d29520eee07ea12aa1fd57d05

SHA512
40507bb8e80f2f642c4ea4ff7ea919f0d0c774f22f510c95c57854321d7ba1f199992d574d980246b1449e0a0b0cfc6d4ba714812e87bfadecee929075b5e1fd

Download Submit
C:\Windows\system\HlrbFxP.exe

Filesize
1.9MB

MD5
19fb89ced4b6249bbab69c8ab7c5a17e

SHA1
2565b6cdc02443f40989db0bee4b115ddb294676

SHA256
d71fb4dd839b54399edd82937ba5f28e50434ec8f0377271dd8064718a258c9f

SHA512
79df8b5a9fda00fbd17fc63371613cc10d87419bf57f4c037001750c8821d0c5b443995ac26521634b9eb77df50e65a6526d8d42e457fdf54a766358cb06d775

Download Submit
C:\Windows\system\KahUhbG.exe

Filesize
1.9MB

MD5
f4708794fbcb9da094dcff85bba77e07

SHA1
e4abb94ddd3b9d38f4396b9e2128e1060de41b16

SHA256
b0af9532d4e59a8347249ec9d09b948f6524e8da25f18e4f987c5e433ba1af97

SHA512
631ab6d8cba3dc823c9b00e067b2df178f3084434a1e904f5cc7596fb5e06b5a722266050a2ad6d80e4cc91deaf5f1c7dabe83ad45e703896a5ad6bd412b74b4

Download Submit
C:\Windows\system\LbtZAxO.exe

Filesize
8B

MD5
9e16362b7eef9ff59cf4576b688fec20

SHA1
58714a79316bdda8b345ca47c2a7e8087e024871

SHA256
cb157cd47cb9ddacb8fa194262e9cc1364ca68490d93ad041938e77ef90ead7c

SHA512
53056e2e9a952538e1c61538c2bad2166adaf2d4a03d0e97e211329cd7f80967988343aa21690b08c2f1ad6d3fabfdc6095392f57b127d575de79d724d1a09de

Download Submit
C:\Windows\system\NPUXkKr.exe

Filesize
1.9MB

MD5
f7a7210430abc0908de0f36d760538ea

SHA1
af2880ad6747fa6518053f5217c92d3cf66625ee

SHA256
dd106fc122dcd5ea423d724e6e706f04520bbaa3af10b6698be7d1024f5fddf7

SHA512
7085099ddc0fc3ab5db1f8d1d77a8a465a2a853d7db7b51b1a8ae45b28828eb3218473ff76bd31374f3476bea1245ca15fec0031be86d260adac0473eda1da25

Download Submit
C:\Windows\system\RwjHpAF.exe

Filesize
1.9MB

MD5
fb97fa7779b1c33f0fbdf34032d0cf99

SHA1
7b16775c9ad40dea180a7f86da6f99dadc4c6652

SHA256
b1103778b4ae57c6aa092ec820ef7f9910b8f9891074a193b97cc65bb8b8fe8b

SHA512
aac9f9731b9043aa55ad1819e7826d2ef61ee5253800a6b4de5792d092d1dafa9047c91ea6c11077969ad0b0856489201b754acb2fc2b7f0fc89aff056bfe211

Download Submit
C:\Windows\system\SJiuzJG.exe

Filesize
1.9MB

MD5
63d5449a6c2b33c89f8d7058e48cf78f

SHA1
f9064d1d1a63bf7c3f7363758214110a6f604284

SHA256
8bd7f442356ade5b7e4779edbb5a0f12ddb6b55bd83f344b1b32fcf141b7ea6f

SHA512
675dd24510a769c8098d18a667a6a6fffa20b66361bc9f362718a81078b9b6c17b1783f305c5f6f7b2584adb0d54c252035b48461344cd4ecbbf3e5d3062a7f3

Download Submit
C:\Windows\system\TrLiUzp.exe

Filesize
1.9MB

MD5
311c54a6ad1e5a60221f5aa99eeae6a8

SHA1
ab6cab41b4d1c304082511c4f95332bc75b7d912

SHA256
37cb0225ccfb3efff3a06ea52a1d5665025d1036058dbfd381513a307030f119

SHA512
d6cc0a69c984425a79a5d4a9aa3774ac4e9db9e3ec91d3faa60bec73102b33ab26c43b187e7adaa0cbcaf7d5504e093f652227dfa70f898d14d828e86e3abae4

Download Submit
C:\Windows\system\ZwpXgCA.exe

Filesize
1.9MB

MD5
1f3b532529126f83678967d6676389d9

SHA1
a97bdeb755237e82c771916889b8d49fe93e2a60

SHA256
f0bbc738ad70fd2db47be69f5f513fa338b83bd4d27144524e9bcc8a93fcabda

SHA512
42ab9676595248a1c81d55e3a266319f1ed6385181b67449f6cdd0d26d7fe1af624bb0c56b0a7ac5a58c9445c20e3b665e1a67a50adaf1b8c55e6cc3bbbf2fe0

Download Submit
C:\Windows\system\cNlywlO.exe

Filesize
1.9MB

MD5
90f07ad2b7281e341f7e8ab7c9b4c67b

SHA1
a1a674688fa0aec52c25157a902ba0a317ac821f

SHA256
7a059fcacb4bdb16cda1e8893d285fadbf87e5d591531243ec1e784bbfa4e30b

SHA512
7805b8f324fb0e09fdcb8839839304702cd96c617bebd69782039ba2ec3d1356759c3a08829e624ab3a69aa9c006a655a2ca602388d0c14101225856735ec577

Download Submit
C:\Windows\system\dCjNGPV.exe

Filesize
1.9MB

MD5
857606d8086f14a4540280b092424194

SHA1
25a4ab1f3eefd014416f0b41dd48aac487845d8d

SHA256
a14afe780dd70594cb3c68d4a9a5a42c8b1706a64878b96e82c0d6fe9ee2cf7e

SHA512
04856eceed4d56c42db11dbf033b720d72e8a5bfb722b860c05503e8a4011f61a5c0ec0f414253216ca8c75fe7f03914da0eab69f1ff71f5b22213045de68757

Download Submit
C:\Windows\system\gQmPACh.exe

Filesize
1.9MB

MD5
21544ba63860c4e3a81a1ebab2632b08

SHA1
7cf4d678de39d3f3bb618f8e4c47dd4b2ed5cf12

SHA256
117dcc4c369f49ed6c64e22ca6b056d8b8dcbd97a686cc5f6d1acf446c63e037

SHA512
a41740c77b051229810f923f1b45a9a662d329b852893fc1a2f919c0342bf683917ae61a676d19c3e2da4cbcf2aeafae24bdd68281b5d5da43aedac1170cad20

Download Submit
C:\Windows\system\hJUJvHm.exe

Filesize
1.9MB

MD5
70b0ad99ca8ebaf4b6a19b80cdf704d3

SHA1
009835a9ad5e0cf882cc1d099ff040f8f487f271

SHA256
066e27efe8f9c86c572133ba797a962fd9ebcfeb47988781754e7ed736a88a22

SHA512
be8e3acb6b6fa1d7893288edeb4bceef2795a05b9197dd6512c75ca3698731e25811de68b24241ecbfc12f123cb06150f449a83844c1380dea60ecfac5ba77e6

Download Submit
C:\Windows\system\iFmXwvb.exe

Filesize
1.9MB

MD5
3b4bf108511847b72cc8151c5e6df906

SHA1
0ad53fc642a1c1ffdb06daa59d5a0e09feed1944

SHA256
bf46b0052109795c1181e8e69b15bcff7ed21f636177ddf1b62555e3f0eca8e4

SHA512
0f9e1ac1c9d08df89f013fdaa6b3c232bc14e711eab40a19977b0fa756bc0a1b4ee7a5f77a495d700e187520e2d731899079c310ae7c2b7ba515d4c1bd8b4cb9

Download Submit
C:\Windows\system\nQlGpzv.exe

Filesize
1.9MB

MD5
a3cad1b0ef5e26bac5ff0d7113066d94

SHA1
831fbbc95b13ec2bb538981fe26b658e1c29db64

SHA256
6b7aad37b3063004e3e9fab636fe68e0f3c7cb750208ec2cbf14eb6a9ecae48b

SHA512
8b15f122ddd3d95664c5e43f3402a0e88f8da0f80d48100ffa0e01b29c588c73d0e69f4326675e71614fc3bf86be7d4a3b75e3a8706bf845511dbfee995281d1

Download Submit
C:\Windows\system\oIBHoUj.exe

Filesize
1.9MB

MD5
d02c9a4d725a86fd5fe7f562e9508a65

SHA1
65f083a7d083920f2d6f8e6d5a8f4470888dc2cf

SHA256
275a17411ff28d17fe424ee75bab8447e0a437006054b0d06317c85ee8cf00c7

SHA512
f514c88654c946a813feefc393286970be2860df9d68bfd1b58208660a6ee7feba65b467dae33900e0b5f4fb04beb92dc8f54b91a9d1c63f95a2b298a3a4761d

Download Submit
C:\Windows\system\qyNkxhV.exe

Filesize
1.9MB

MD5
747d27d068647f1baa35dfd00ad06dca

SHA1
dc13853d1dc933f6cc2567e2e2adcb63c3beefc7

SHA256
01172007bdda290198e4705eb5545a98bdf2c3f6a3a2e42c5e2611f4fb48f1db

SHA512
84dbf6d187aa7f4a2636f40356bb1494009847bf70b2b8fa0c939c3d9ddb20f697ff248cf2da1e850d41529c7701ed4a698c3c44469a1bc520bcc6df839585d2

Download Submit
C:\Windows\system\rjovaFx.exe

Filesize
1.9MB

MD5
5442ca0ad3402989cd9b28174bada7cf

SHA1
dd2f8b1bbb82712564e4311d7c8aa57d13a99a2a

SHA256
9847203803ffc2ca43bf7d10022f27245bb7093b65918cb22f3a8b8a4abe9804

SHA512
472674311dc16ed92ee197b6d2ca0f8e8e35a2168dfbcbbc94f6a3a47154ad86619cae0e5fc6c4f55e27ce7355c5833c22886b1b922fce4db0cf10e0dd92d449

Download Submit
C:\Windows\system\xJKQRAW.exe

Filesize
1.9MB

MD5
bab9882dcf6deeab1a17f2f8f4aa5b64

SHA1
7dbabaa1c119c57050fa0ca25e4ec56357aeb0c2

SHA256
c451e26759ff2eeb00c5f939a20215c1cf278612ff68b33b9a4fb5ec7982af62

SHA512
96d0b13c25c48abb77a328571828bad652d5b99de9f00362a9f913d9de9b2b04af029dd9fe25f08c3aa18b9c656bf3945841d695810003a8435a0929cd732280

Download Submit
C:\Windows\system\xXyLQPY.exe

Filesize
1.9MB

MD5
61b97619836a51d868b944deb3b3d139

SHA1
f8a3b80daadda6ba2d8054574297f9058fc9437e

SHA256
849ec1ed8ad824e3f905420558d440bf83989f9f0bcee9b19cae1dbed1743264

SHA512
37b102d873321d92cd596cab5464a89dca6a8a664430b606f6bc445a37d97e1927681fbf0a27bda5c7be5e6a3a9455592ed79a78b1a410ed47fc07d43e94cb17

Download Submit
C:\Windows\system\yhiPJsa.exe

Filesize
1.9MB

MD5
0faa57251c90e915378681eaf4814a09

SHA1
ec413e26b3c49fe8b5bb413925f2a8b56db9f20e

SHA256
82675e995d92b79801c0352324e979efd90804e6b8b14c12b392117a5cc162a3

SHA512
7edabb53f7210c5c871c9452df9314b81b0d335dd688643a622f908a8e590221b74f9646f4e8b22119c85e7c27936799c6f90278d84c9ee2da2877dffdfb9e23

Download Submit
C:\Windows\system\zXsahqz.exe

Filesize
1.9MB

MD5
4af4bf2d6170d9d2cb262fa51fc8ed5c

SHA1
280892e2cf58aaf5ca8efe5ce7c130f2cdd58db2

SHA256
c7cc639e4b5a0297c64c3a204284f8d45c8a0ca8b6335606221699ab3a027805

SHA512
ff07ab8ed0fe4ee5339cf04dc332c4be64a99dd2238b516f23cfb772f4dacb298570d6263abf9e2ca60e6521b65ea886ef2481036848bf566b5c0bacd8228d31

Download Submit
\Windows\system\IMeUXBN.exe

Filesize
1.9MB

MD5
3ae46ef24ee8bfcbabf9c39944cf8252

SHA1
231c4d8a48e52c548fb0071bb1873120ec1c7e36

SHA256
41a85def1c3cf89c0c561a23dc4fae1b3b5ef69c82800145604f5730eebb91f7

SHA512
1fb97d714158982dd1fff9399c3a47d794177fdf5f9b7311cc2bef346ab4bf9b28748608171dbfe087ef3d7c6f0091da4b219a8820da12714fa0ffd1d274cba9

Download Submit
\Windows\system\LKinpas.exe

Filesize
1.9MB

MD5
83040cf3f2aa47291d19af6fdffbb26d

SHA1
de277713f077b25362f46809bc782ca3d76f55c9

SHA256
cab5b12a60e92d819ac9871823786970a824df4a9aa26f88344ddc9575fbdb28

SHA512
3c6bd028daf95c658eb16a23570de235c103e5c3256e9b88dc66d0177425e49558e8fa1c4a626bf06817234860caf4f13dd6fe566e2f1bce399dc167dc401ab7

Download Submit
\Windows\system\WVMVBsV.exe

Filesize
1.9MB

MD5
ac00bce0d1cef430598f4304b601369e

SHA1
56e3c55a9b1fecd558270c64c5861a17ea648297

SHA256
ad712db25ed15d11c89890136c082666da4b0d6e0babbc48255ebe003f811365

SHA512
513fb461c11c86e9dbb608c5286d33324e3a8a005be4ed79a03d94203813a69d5d5791986842cf665c2e32b9781e8305c9580595c8032834de8e7aff4609c2eb

Download Submit
\Windows\system\gHAaKTc.exe

Filesize
1.9MB

MD5
648136a671af1e82cb938e3f3239cdfc

SHA1
b2df8d9551c059cb7c10fad56f0e3b120313ce95

SHA256
d0401dac969da037b28a17cda8989b8b2bb34ad19da550575351800c75f43497

SHA512
e5085c07cb24577fadb58220ad79acdcb11c5111094bc304dd54de81a69e0015606356704d4600bee26227e78b69e84abb7b34513387e2e0644247f337d2fc3e

Download Submit
\Windows\system\hTdYdhh.exe

Filesize
1.9MB

MD5
3ac4568a93b7af97354b33ba1972140e

SHA1
59ae4c5aaa70e10e1ce73d3f01d47785ae01fd8d

SHA256
7291f9cf27670bff66667cf2cabc2ea3cac8cfec2387bdd5d45af4c7f67718de

SHA512
47ad13caad0ccea709637c1b0934650bf65b3994d02ba255485d385518cadef519b8ed6e65ffe796d081475959eaef97dabea5a80b83707f171e4392b527c993

Download Submit
\Windows\system\hhDqbQX.exe

Filesize
1.9MB

MD5
585bf27a793fff28a57f3edd093fc174

SHA1
20018a06777c73a68a3ec15581bd076345e59aa7

SHA256
9b6b78371bc970d2decfac79d594bc2130f62f46f711cca6905b03fe0bbc2bd6

SHA512
fb235f42969e8c1176bbc4f5876b2579e196d056791e4311ac0f3c147933853907afd072a55fd8e77ce23dbb45c99f3f258a21b7e1e3471e361c08c6cd918f55

Download Submit
\Windows\system\jrcxOMu.exe

Filesize
1.9MB

MD5
1da2c80013616d136b7bbe881e8b5554

SHA1
e8fc5bc4695b817c0418acfb0a8311d6cdd341e9

SHA256
6a667183a7b272853418d586820d50667ffebebd56f4f537fb1cedba6967da17

SHA512
fd4fe75d2e27b89c890178717a0f65ac66f1ff3acf695ccc8138b1ad1736ee2c8665df9660f3be189515f1f9ce307597611e54f9e7f829b26a196461ae9962b9

Download Submit
\Windows\system\liyzrWP.exe

Filesize
1.9MB

MD5
642f4e860229beb21b5b90f1a79c667c

SHA1
0b6fa4e95fd5044a79a259e4755ff610efb1cc9b

SHA256
dfd6584ce8b6a2c0e6802a3e4d4fdabfb8e5ada7d3e6e785899f296c1b956af7

SHA512
e71b62e859cc1d654a9ecc60f9c49912a14448c89b87d21fddef8489e4e9e78b0f72741598f195cf4950f58aab9f4c5a1fd0fe95b5f34f6f24e0cc4f9f3e1378

Download Submit
\Windows\system\wzllrRL.exe

Filesize
1.9MB

MD5
f1e17432ceb809b72db5afd9b07b1877

SHA1
8371e8db8d44bb4daf209302dd6de7509ac1b383

SHA256
c70073d2145850a8087dc111309e2fdc6b77ae96da722fa1807fdd56952ea738

SHA512
b197ef160e5b6cc75b91021dcad5f016f7af10a7c96efdcaaa043115f9803c6a825b1256384c0fb3fe81c120444cd56643e531375359c1d8ee1dcb33a0ac0a1b

Download Submit
\Windows\system\zSxHCMZ.exe

Filesize
1.9MB

MD5
e09b4dda600d0300de359d36f0caf593

SHA1
c06917f7b66d0d921450ba9c33fe92620750e0f5

SHA256
64c22b9de9821f9e6882a668fc62005505e1c6713ebde40ff93a45a6ba296465

SHA512
2423186f325f652158b9c1097dd71b0a63089f6617c7712d7cd2c5a0990aa23407c7068c8c5a96849c83ddd8161ac9128f151c17e32ebff797869c4ffdf9db92

Download Submit
\Windows\system\zZtQRMg.exe

Filesize
1.9MB

MD5
660340825306ae126a781cf38e709f22

SHA1
cfad1e96bc5fd08c6930b041af8fc6a18b96492c

SHA256
0a860e4dd5304e7d4a7544b50248f7bc1d154aa9b06d83fca2f435c5a749e0ed

SHA512
a10c967e00e8f9fdc457463495d06eea00a29d0246c4212c97fad365f1d7d469e70f896918e4c69aacda662a200ac4bd587c5ca5914a7b3c1d26a7971d8b0a2e

Download Submit
memory/1384-28-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2056-298-0x0000000001FB0000-0x0000000001FB8000-memory.dmp

Filesize
32KB

Download
memory/2056-102-0x000000001B5F0000-0x000000001B8D2000-memory.dmp

Filesize
2.9MB

Download
memory/2436-173-0x000000013FCE0000-0x00000001400D2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-174-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2516-119-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-175-0x000000013F960000-0x000000013FD52000-memory.dmp

Filesize
3.9MB

Download
memory/2592-179-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2632-134-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2708-112-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2832-181-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2832-44-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2832-1-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2832-180-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-172-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2832-58-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-52-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2832-13-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2832-39-0x000000013F350000-0x000000013F742000-memory.dmp

Filesize
3.9MB

Download
memory/2832-182-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-177-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-135-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-176-0x0000000003100000-0x00000000034F2000-memory.dmp

Filesize
3.9MB

Download
memory/2832-0-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2912-69-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/3024-178-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download