xmrig | 12a4a19d0e5a39b142319249f87d8e3071f22149c79e0edf0e7952b5321680b2

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
Size

2.2MB
MD5

0f13d4ae2aac0ca3dd25198bbaf07750
SHA1

58f13960778b0ada1e3f76f7d850c568f2fa484c
SHA256

12a4a19d0e5a39b142319249f87d8e3071f22149c79e0edf0e7952b5321680b2
SHA512

edad6124ae22a0417fab8d40258d81e6e851821cf52083468f19370fcd0acdb63792123707e353e1c40646dade3a745a1be5abc788e9d11f126c8e15933efce6
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfC:NABt

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2744-78-0x000000013F310000-0x000000013F702000-memory.dmp	xmrig
behavioral1/memory/2736-99-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	xmrig
behavioral1/memory/2644-97-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2464-94-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2684-93-0x000000013FBA0000-0x000000013FF92000-memory.dmp	xmrig
behavioral1/memory/2668-88-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig
behavioral1/memory/2248-80-0x00000000025B0000-0x00000000029A2000-memory.dmp	xmrig
behavioral1/memory/2896-79-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	xmrig
behavioral1/memory/2608-77-0x000000013FCB0000-0x00000001400A2000-memory.dmp	xmrig
behavioral1/memory/2556-66-0x000000013FA10000-0x000000013FE02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2028	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2556	CEzCSoI.exe
2644	LloYwUp.exe
2608	bpvikSG.exe
2744	XtFQiFI.exe
2896	IzLnGcP.exe
2668	zVziDxz.exe
2736	BnlJklF.exe
2684	EiNysDr.exe
2464	RirjrkT.exe
2588	mBSYqWr.exe
2672	VIVyUvf.exe
2872	MAPybAs.exe
2472	WuqOQzQ.exe
2864	MlTqyBq.exe
2408	TzGnUhb.exe
2484	oeDklej.exe
2116	YgskrfO.exe
2788	qnOelHP.exe
1312	YLyUGvF.exe
1352	zvDstbb.exe
1028	flwlBpN.exe
2440	fDtsCTi.exe
1348	RBahXVj.exe
1204	sWvWhvr.exe
2024	cUbFhsk.exe
2560	XbfCkON.exe
1880	TbDozEe.exe
676	EIeRYmi.exe
980	PHTmmKt.exe
292	qYWSZuR.exe
572	yAGRtlg.exe
1172	TtIcPpF.exe
2656	HbEhTYA.exe
744	UeZSPpq.exe
2352	QaJpfKJ.exe
1900	aormjUA.exe
780	QXUgifK.exe
2272	zptsMWr.exe
2088	alqUxIm.exe
2904	jHUmtvO.exe
1212	wdQCtTX.exe
748	POYlKGJ.exe
752	NIWWMGz.exe
1532	ihRibGT.exe
2112	OtJZAPy.exe
1868	CCPZUvc.exe
804	tdyvNjz.exe
892	cPkfcaT.exe
1136	IlKSmkq.exe
776	cCBOXmA.exe
2136	RqXLjil.exe
2276	jiNLNsb.exe
2120	WhWOUzE.exe
2400	etteWkX.exe
2208	RqtKZmu.exe
2060	QclNDRh.exe
2072	HbdfZxC.exe
3032	BPklBGI.exe
1468	rUQMIqW.exe
1704	fqpeTDc.exe
2196	NOZreGH.exe
1588	rzZSmNu.exe
1608	qMnzuYI.exe
2216	tNnDDaC.exe

Loads dropped DLL 64 IoCs

pid	Process
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x002f00000001325f-6.dat	upx
behavioral1/files/0x000900000001344f-9.dat	upx
behavioral1/files/0x0008000000013f4b-33.dat	upx
behavioral1/files/0x00060000000148af-65.dat	upx
behavioral1/memory/2744-78-0x000000013F310000-0x000000013F702000-memory.dmp	upx
behavioral1/files/0x0006000000014c0b-89.dat	upx
behavioral1/files/0x0006000000014730-42.dat	upx
behavioral1/files/0x0006000000014a29-117.dat	upx
behavioral1/files/0x0006000000015ca9-167.dat	upx
behavioral1/files/0x0006000000015c91-158.dat	upx
behavioral1/files/0x0006000000015c9b-162.dat	upx
behavioral1/files/0x0006000000015b72-150.dat	upx
behavioral1/files/0x0006000000015bb5-155.dat	upx
behavioral1/files/0x0006000000015b37-143.dat	upx
behavioral1/files/0x00300000000132f2-146.dat	upx
behavioral1/files/0x0006000000015a15-138.dat	upx
behavioral1/files/0x00060000000155e8-135.dat	upx
behavioral1/files/0x000600000001523e-133.dat	upx
behavioral1/files/0x0006000000014d0f-125.dat	upx
behavioral1/files/0x0006000000015077-114.dat	upx
behavioral1/files/0x000600000001475f-107.dat	upx
behavioral1/files/0x00060000000145d4-103.dat	upx
behavioral1/files/0x000a000000013b02-101.dat	upx
behavioral1/memory/2736-99-0x000000013F8D0000-0x000000013FCC2000-memory.dmp	upx
behavioral1/memory/2644-97-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2464-94-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2684-93-0x000000013FBA0000-0x000000013FF92000-memory.dmp	upx
behavioral1/memory/2668-88-0x000000013F620000-0x000000013FA12000-memory.dmp	upx
behavioral1/files/0x000600000001543a-129.dat	upx
behavioral1/files/0x00060000000150aa-120.dat	upx
behavioral1/files/0x0008000000013a85-32.dat	upx
behavioral1/files/0x0008000000013a15-31.dat	upx
behavioral1/files/0x0007000000012120-29.dat	upx
behavioral1/files/0x0006000000014fac-112.dat	upx
behavioral1/memory/2896-79-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/memory/2608-77-0x000000013FCB0000-0x00000001400A2000-memory.dmp	upx
behavioral1/files/0x0008000000013a65-67.dat	upx
behavioral1/memory/2556-66-0x000000013FA10000-0x000000013FE02000-memory.dmp	upx
behavioral1/files/0x000600000001474b-64.dat	upx
behavioral1/files/0x00060000000146a7-63.dat	upx
behavioral1/files/0x00090000000134f5-56.dat	upx
behavioral1/memory/2248-0-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sWvWhvr.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\OClqIoX.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\WbxCxSL.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\MENYPty.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\POKNZUX.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\sGwqaHP.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\iXyyxqn.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\RqXLjil.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\JnXcjMQ.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\YqwrnFw.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ZEfXRhD.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\aYGsvkk.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\PKOArEh.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\CaifDZD.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\DbZSMwQ.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\uRCKUzw.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\SqqxZTG.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\Htqgfjz.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\DQGdCGh.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\sbDKSts.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ooLUIhX.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\WhiCFJS.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ckuNxhN.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\pBTrbsH.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\JJSomia.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\IjHSevA.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\mdNrnEf.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\lUjxNDM.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\dQmbCCs.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\yWAoUls.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ZbvxhNR.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\VTsZWQJ.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\dtucGUs.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\zXgSBeE.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\fqpeTDc.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\hrqRQEX.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\iCaxscP.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\sAvXBnS.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ihpHoWp.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\BnlJklF.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ejARAJk.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\DXhpdVV.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\waIFniq.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ivmZyHm.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\NekNEcT.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\yXXByBl.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\lAXAThK.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\zOvWOio.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\FbMbTJq.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\NjIKgNo.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\DGZJjkt.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\IVBJzzt.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\icvcUpa.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\dcPKiwK.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\aUYtViq.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\JiaOPfE.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\ftvFdKn.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\MNbTPFj.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\CLyzKqN.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\obwTaLN.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\uKFlnYB.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\dIHRvRv.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\LiBIQHi.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
File created	C:\Windows\System\EnbPzdG.exe	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	powershell.exe
2028	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
Token: SeDebugPrivilege	2028	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2028	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2028	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2028	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	29
PID 2248 wrote to memory of 2644	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2644	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2644	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	30
PID 2248 wrote to memory of 2556	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2556	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2556	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	31
PID 2248 wrote to memory of 2608	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2608	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2608	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	32
PID 2248 wrote to memory of 2668	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2668	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2668	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	33
PID 2248 wrote to memory of 2744	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2744	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2744	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	34
PID 2248 wrote to memory of 2672	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2672	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2672	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	35
PID 2248 wrote to memory of 2896	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2896	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2896	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	36
PID 2248 wrote to memory of 2472	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2472	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2472	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	37
PID 2248 wrote to memory of 2736	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2736	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2736	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	38
PID 2248 wrote to memory of 2864	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	39
PID 2248 wrote to memory of 2864	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	39
PID 2248 wrote to memory of 2864	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	39
PID 2248 wrote to memory of 2684	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	40
PID 2248 wrote to memory of 2684	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	40
PID 2248 wrote to memory of 2684	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	40
PID 2248 wrote to memory of 2408	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2408	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2408	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	41
PID 2248 wrote to memory of 2464	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2464	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2464	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	42
PID 2248 wrote to memory of 2484	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2484	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2484	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	43
PID 2248 wrote to memory of 2588	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	44
PID 2248 wrote to memory of 2588	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	44
PID 2248 wrote to memory of 2588	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	44
PID 2248 wrote to memory of 2788	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	45
PID 2248 wrote to memory of 2788	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	45
PID 2248 wrote to memory of 2788	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	45
PID 2248 wrote to memory of 2872	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	46
PID 2248 wrote to memory of 2872	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	46
PID 2248 wrote to memory of 2872	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	46
PID 2248 wrote to memory of 1352	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	47
PID 2248 wrote to memory of 1352	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	47
PID 2248 wrote to memory of 1352	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	47
PID 2248 wrote to memory of 2116	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	48
PID 2248 wrote to memory of 2116	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	48
PID 2248 wrote to memory of 2116	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	48
PID 2248 wrote to memory of 2440	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	49
PID 2248 wrote to memory of 2440	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	49
PID 2248 wrote to memory of 2440	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	49
PID 2248 wrote to memory of 1312	2248	0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f13d4ae2aac0ca3dd25198bbaf07750_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2028
- C:\Windows\System\LloYwUp.exe
  C:\Windows\System\LloYwUp.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\CEzCSoI.exe
  C:\Windows\System\CEzCSoI.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\bpvikSG.exe
  C:\Windows\System\bpvikSG.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\zVziDxz.exe
  C:\Windows\System\zVziDxz.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\XtFQiFI.exe
  C:\Windows\System\XtFQiFI.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\VIVyUvf.exe
  C:\Windows\System\VIVyUvf.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\IzLnGcP.exe
  C:\Windows\System\IzLnGcP.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\WuqOQzQ.exe
  C:\Windows\System\WuqOQzQ.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\BnlJklF.exe
  C:\Windows\System\BnlJklF.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\MlTqyBq.exe
  C:\Windows\System\MlTqyBq.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\EiNysDr.exe
  C:\Windows\System\EiNysDr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\TzGnUhb.exe
  C:\Windows\System\TzGnUhb.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\RirjrkT.exe
  C:\Windows\System\RirjrkT.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\oeDklej.exe
  C:\Windows\System\oeDklej.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\mBSYqWr.exe
  C:\Windows\System\mBSYqWr.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\qnOelHP.exe
  C:\Windows\System\qnOelHP.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\MAPybAs.exe
  C:\Windows\System\MAPybAs.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\zvDstbb.exe
  C:\Windows\System\zvDstbb.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\YgskrfO.exe
  C:\Windows\System\YgskrfO.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\fDtsCTi.exe
  C:\Windows\System\fDtsCTi.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\YLyUGvF.exe
  C:\Windows\System\YLyUGvF.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\RBahXVj.exe
  C:\Windows\System\RBahXVj.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\flwlBpN.exe
  C:\Windows\System\flwlBpN.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\sWvWhvr.exe
  C:\Windows\System\sWvWhvr.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\cUbFhsk.exe
  C:\Windows\System\cUbFhsk.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\XbfCkON.exe
  C:\Windows\System\XbfCkON.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\TbDozEe.exe
  C:\Windows\System\TbDozEe.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\EIeRYmi.exe
  C:\Windows\System\EIeRYmi.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\PHTmmKt.exe
  C:\Windows\System\PHTmmKt.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\qYWSZuR.exe
  C:\Windows\System\qYWSZuR.exe
  2⤵
  - Executes dropped EXE
  PID:292
- C:\Windows\System\yAGRtlg.exe
  C:\Windows\System\yAGRtlg.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\TtIcPpF.exe
  C:\Windows\System\TtIcPpF.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\HbEhTYA.exe
  C:\Windows\System\HbEhTYA.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\UeZSPpq.exe
  C:\Windows\System\UeZSPpq.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\QaJpfKJ.exe
  C:\Windows\System\QaJpfKJ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\aormjUA.exe
  C:\Windows\System\aormjUA.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\QXUgifK.exe
  C:\Windows\System\QXUgifK.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\zptsMWr.exe
  C:\Windows\System\zptsMWr.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\alqUxIm.exe
  C:\Windows\System\alqUxIm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\jHUmtvO.exe
  C:\Windows\System\jHUmtvO.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\wdQCtTX.exe
  C:\Windows\System\wdQCtTX.exe
  2⤵
  - Executes dropped EXE
  PID:1212
- C:\Windows\System\POYlKGJ.exe
  C:\Windows\System\POYlKGJ.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\System\NIWWMGz.exe
  C:\Windows\System\NIWWMGz.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\ihRibGT.exe
  C:\Windows\System\ihRibGT.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\OtJZAPy.exe
  C:\Windows\System\OtJZAPy.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\CCPZUvc.exe
  C:\Windows\System\CCPZUvc.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\tdyvNjz.exe
  C:\Windows\System\tdyvNjz.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\cPkfcaT.exe
  C:\Windows\System\cPkfcaT.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\IlKSmkq.exe
  C:\Windows\System\IlKSmkq.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\cCBOXmA.exe
  C:\Windows\System\cCBOXmA.exe
  2⤵
  - Executes dropped EXE
  PID:776
- C:\Windows\System\RqXLjil.exe
  C:\Windows\System\RqXLjil.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\jiNLNsb.exe
  C:\Windows\System\jiNLNsb.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\WhWOUzE.exe
  C:\Windows\System\WhWOUzE.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\etteWkX.exe
  C:\Windows\System\etteWkX.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\RqtKZmu.exe
  C:\Windows\System\RqtKZmu.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\QclNDRh.exe
  C:\Windows\System\QclNDRh.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\HbdfZxC.exe
  C:\Windows\System\HbdfZxC.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\BPklBGI.exe
  C:\Windows\System\BPklBGI.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\rUQMIqW.exe
  C:\Windows\System\rUQMIqW.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\rzZSmNu.exe
  C:\Windows\System\rzZSmNu.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\fqpeTDc.exe
  C:\Windows\System\fqpeTDc.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\qMnzuYI.exe
  C:\Windows\System\qMnzuYI.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\NOZreGH.exe
  C:\Windows\System\NOZreGH.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\tNnDDaC.exe
  C:\Windows\System\tNnDDaC.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\pUKNtxG.exe
  C:\Windows\System\pUKNtxG.exe
  2⤵
  PID:2908
- C:\Windows\System\wqSXXKo.exe
  C:\Windows\System\wqSXXKo.exe
  2⤵
  PID:2492
- C:\Windows\System\MgvKJiA.exe
  C:\Windows\System\MgvKJiA.exe
  2⤵
  PID:2476
- C:\Windows\System\ClLohhd.exe
  C:\Windows\System\ClLohhd.exe
  2⤵
  PID:2508
- C:\Windows\System\HeFEQRb.exe
  C:\Windows\System\HeFEQRb.exe
  2⤵
  PID:1256
- C:\Windows\System\NwIevGP.exe
  C:\Windows\System\NwIevGP.exe
  2⤵
  PID:2372
- C:\Windows\System\ZEfXRhD.exe
  C:\Windows\System\ZEfXRhD.exe
  2⤵
  PID:1496
- C:\Windows\System\pwIWSmS.exe
  C:\Windows\System\pwIWSmS.exe
  2⤵
  PID:2960
- C:\Windows\System\tnezNgi.exe
  C:\Windows\System\tnezNgi.exe
  2⤵
  PID:1656
- C:\Windows\System\qqyGxrl.exe
  C:\Windows\System\qqyGxrl.exe
  2⤵
  PID:2076
- C:\Windows\System\HTuaxEN.exe
  C:\Windows\System\HTuaxEN.exe
  2⤵
  PID:2368
- C:\Windows\System\ZkSMzXx.exe
  C:\Windows\System\ZkSMzXx.exe
  2⤵
  PID:2520
- C:\Windows\System\WlThgHR.exe
  C:\Windows\System\WlThgHR.exe
  2⤵
  PID:2704
- C:\Windows\System\RSPCTfV.exe
  C:\Windows\System\RSPCTfV.exe
  2⤵
  PID:1712
- C:\Windows\System\MWXSPMo.exe
  C:\Windows\System\MWXSPMo.exe
  2⤵
  PID:836
- C:\Windows\System\NhLiBDc.exe
  C:\Windows\System\NhLiBDc.exe
  2⤵
  PID:1192
- C:\Windows\System\YbVgoXC.exe
  C:\Windows\System\YbVgoXC.exe
  2⤵
  PID:2988
- C:\Windows\System\skEwmqQ.exe
  C:\Windows\System\skEwmqQ.exe
  2⤵
  PID:1400
- C:\Windows\System\iLrqkLH.exe
  C:\Windows\System\iLrqkLH.exe
  2⤵
  PID:764
- C:\Windows\System\bhmUIUC.exe
  C:\Windows\System\bhmUIUC.exe
  2⤵
  PID:2816
- C:\Windows\System\bVOWKYL.exe
  C:\Windows\System\bVOWKYL.exe
  2⤵
  PID:684
- C:\Windows\System\IptFJqQ.exe
  C:\Windows\System\IptFJqQ.exe
  2⤵
  PID:2200
- C:\Windows\System\kvlaElL.exe
  C:\Windows\System\kvlaElL.exe
  2⤵
  PID:1088
- C:\Windows\System\zzqBTHi.exe
  C:\Windows\System\zzqBTHi.exe
  2⤵
  PID:2924
- C:\Windows\System\IxBYjXC.exe
  C:\Windows\System\IxBYjXC.exe
  2⤵
  PID:1500
- C:\Windows\System\FffdLCm.exe
  C:\Windows\System\FffdLCm.exe
  2⤵
  PID:1304
- C:\Windows\System\SHBjYOm.exe
  C:\Windows\System\SHBjYOm.exe
  2⤵
  PID:2104
- C:\Windows\System\GWrbTLO.exe
  C:\Windows\System\GWrbTLO.exe
  2⤵
  PID:888
- C:\Windows\System\vsLGGqp.exe
  C:\Windows\System\vsLGGqp.exe
  2⤵
  PID:696
- C:\Windows\System\HhjSQrp.exe
  C:\Windows\System\HhjSQrp.exe
  2⤵
  PID:2140
- C:\Windows\System\eonfJRe.exe
  C:\Windows\System\eonfJRe.exe
  2⤵
  PID:2920
- C:\Windows\System\QhAKJSO.exe
  C:\Windows\System\QhAKJSO.exe
  2⤵
  PID:1728
- C:\Windows\System\goAJhbc.exe
  C:\Windows\System\goAJhbc.exe
  2⤵
  PID:2092
- C:\Windows\System\aTnppbe.exe
  C:\Windows\System\aTnppbe.exe
  2⤵
  PID:2708
- C:\Windows\System\tfExVzr.exe
  C:\Windows\System\tfExVzr.exe
  2⤵
  PID:2004
- C:\Windows\System\oNNKsfJ.exe
  C:\Windows\System\oNNKsfJ.exe
  2⤵
  PID:2972
- C:\Windows\System\yFlyTNm.exe
  C:\Windows\System\yFlyTNm.exe
  2⤵
  PID:3048
- C:\Windows\System\iyZTLUy.exe
  C:\Windows\System\iyZTLUy.exe
  2⤵
  PID:2636
- C:\Windows\System\ZNGJuuQ.exe
  C:\Windows\System\ZNGJuuQ.exe
  2⤵
  PID:1624
- C:\Windows\System\ylaKImI.exe
  C:\Windows\System\ylaKImI.exe
  2⤵
  PID:2388
- C:\Windows\System\tlAMFMs.exe
  C:\Windows\System\tlAMFMs.exe
  2⤵
  PID:1572
- C:\Windows\System\UgsaJim.exe
  C:\Windows\System\UgsaJim.exe
  2⤵
  PID:1196
- C:\Windows\System\qaQvzIL.exe
  C:\Windows\System\qaQvzIL.exe
  2⤵
  PID:2536
- C:\Windows\System\WBlggJi.exe
  C:\Windows\System\WBlggJi.exe
  2⤵
  PID:1720
- C:\Windows\System\zOvWOio.exe
  C:\Windows\System\zOvWOio.exe
  2⤵
  PID:2096
- C:\Windows\System\EzbYdaP.exe
  C:\Windows\System\EzbYdaP.exe
  2⤵
  PID:1660
- C:\Windows\System\GElfWws.exe
  C:\Windows\System\GElfWws.exe
  2⤵
  PID:824
- C:\Windows\System\Cbaljwm.exe
  C:\Windows\System\Cbaljwm.exe
  2⤵
  PID:1888
- C:\Windows\System\YCljGiX.exe
  C:\Windows\System\YCljGiX.exe
  2⤵
  PID:1816
- C:\Windows\System\VhkVxZl.exe
  C:\Windows\System\VhkVxZl.exe
  2⤵
  PID:2148
- C:\Windows\System\vUsYyxS.exe
  C:\Windows\System\vUsYyxS.exe
  2⤵
  PID:1688
- C:\Windows\System\yZIBPLK.exe
  C:\Windows\System\yZIBPLK.exe
  2⤵
  PID:2880
- C:\Windows\System\qAupoFo.exe
  C:\Windows\System\qAupoFo.exe
  2⤵
  PID:2760
- C:\Windows\System\EWatsdq.exe
  C:\Windows\System\EWatsdq.exe
  2⤵
  PID:1820
- C:\Windows\System\bYCzCnN.exe
  C:\Windows\System\bYCzCnN.exe
  2⤵
  PID:3064
- C:\Windows\System\LQDXplw.exe
  C:\Windows\System\LQDXplw.exe
  2⤵
  PID:1772
- C:\Windows\System\kNzjKRY.exe
  C:\Windows\System\kNzjKRY.exe
  2⤵
  PID:1784
- C:\Windows\System\iUdGown.exe
  C:\Windows\System\iUdGown.exe
  2⤵
  PID:2256
- C:\Windows\System\oBTZcWw.exe
  C:\Windows\System\oBTZcWw.exe
  2⤵
  PID:2100
- C:\Windows\System\jJtJrgv.exe
  C:\Windows\System\jJtJrgv.exe
  2⤵
  PID:3080
- C:\Windows\System\zKvnBnj.exe
  C:\Windows\System\zKvnBnj.exe
  2⤵
  PID:3096
- C:\Windows\System\EpAjnOI.exe
  C:\Windows\System\EpAjnOI.exe
  2⤵
  PID:3112
- C:\Windows\System\UFkLaZc.exe
  C:\Windows\System\UFkLaZc.exe
  2⤵
  PID:3128
- C:\Windows\System\VOsjBwl.exe
  C:\Windows\System\VOsjBwl.exe
  2⤵
  PID:3144
- C:\Windows\System\mzQsbbd.exe
  C:\Windows\System\mzQsbbd.exe
  2⤵
  PID:3160
- C:\Windows\System\vmcaOIw.exe
  C:\Windows\System\vmcaOIw.exe
  2⤵
  PID:3176
- C:\Windows\System\VYoirLJ.exe
  C:\Windows\System\VYoirLJ.exe
  2⤵
  PID:3192
- C:\Windows\System\XwOiCPA.exe
  C:\Windows\System\XwOiCPA.exe
  2⤵
  PID:3208
- C:\Windows\System\TtLAgZd.exe
  C:\Windows\System\TtLAgZd.exe
  2⤵
  PID:3224
- C:\Windows\System\IQevqvB.exe
  C:\Windows\System\IQevqvB.exe
  2⤵
  PID:3240
- C:\Windows\System\FtrQsfC.exe
  C:\Windows\System\FtrQsfC.exe
  2⤵
  PID:3256
- C:\Windows\System\kltFmkU.exe
  C:\Windows\System\kltFmkU.exe
  2⤵
  PID:3272
- C:\Windows\System\gkPhYys.exe
  C:\Windows\System\gkPhYys.exe
  2⤵
  PID:3288
- C:\Windows\System\BNWEjCA.exe
  C:\Windows\System\BNWEjCA.exe
  2⤵
  PID:3304
- C:\Windows\System\epkMvYr.exe
  C:\Windows\System\epkMvYr.exe
  2⤵
  PID:3320
- C:\Windows\System\SNhaLUN.exe
  C:\Windows\System\SNhaLUN.exe
  2⤵
  PID:3336
- C:\Windows\System\DlYqDOP.exe
  C:\Windows\System\DlYqDOP.exe
  2⤵
  PID:3352
- C:\Windows\System\xfHCSCp.exe
  C:\Windows\System\xfHCSCp.exe
  2⤵
  PID:3368
- C:\Windows\System\kerRNHg.exe
  C:\Windows\System\kerRNHg.exe
  2⤵
  PID:3384
- C:\Windows\System\JqZWYTk.exe
  C:\Windows\System\JqZWYTk.exe
  2⤵
  PID:3400
- C:\Windows\System\vqnrFgG.exe
  C:\Windows\System\vqnrFgG.exe
  2⤵
  PID:3416
- C:\Windows\System\SOtyslF.exe
  C:\Windows\System\SOtyslF.exe
  2⤵
  PID:3432
- C:\Windows\System\pUCrtKn.exe
  C:\Windows\System\pUCrtKn.exe
  2⤵
  PID:3448
- C:\Windows\System\FCrsHOo.exe
  C:\Windows\System\FCrsHOo.exe
  2⤵
  PID:3464
- C:\Windows\System\FSnDVIt.exe
  C:\Windows\System\FSnDVIt.exe
  2⤵
  PID:3480
- C:\Windows\System\BhTaDii.exe
  C:\Windows\System\BhTaDii.exe
  2⤵
  PID:3496
- C:\Windows\System\cNutXAP.exe
  C:\Windows\System\cNutXAP.exe
  2⤵
  PID:3512
- C:\Windows\System\WmrXbqd.exe
  C:\Windows\System\WmrXbqd.exe
  2⤵
  PID:3528
- C:\Windows\System\qvCMpUx.exe
  C:\Windows\System\qvCMpUx.exe
  2⤵
  PID:3544
- C:\Windows\System\sKtQSWL.exe
  C:\Windows\System\sKtQSWL.exe
  2⤵
  PID:3560
- C:\Windows\System\tWgtfgq.exe
  C:\Windows\System\tWgtfgq.exe
  2⤵
  PID:3576
- C:\Windows\System\WEzyDvY.exe
  C:\Windows\System\WEzyDvY.exe
  2⤵
  PID:3592
- C:\Windows\System\svBaFmT.exe
  C:\Windows\System\svBaFmT.exe
  2⤵
  PID:3608
- C:\Windows\System\mrYSPay.exe
  C:\Windows\System\mrYSPay.exe
  2⤵
  PID:3624
- C:\Windows\System\MNnSGLq.exe
  C:\Windows\System\MNnSGLq.exe
  2⤵
  PID:3640
- C:\Windows\System\akSgOur.exe
  C:\Windows\System\akSgOur.exe
  2⤵
  PID:3656
- C:\Windows\System\YtUXbFa.exe
  C:\Windows\System\YtUXbFa.exe
  2⤵
  PID:3672
- C:\Windows\System\ZKTICli.exe
  C:\Windows\System\ZKTICli.exe
  2⤵
  PID:3688
- C:\Windows\System\nGQRtXL.exe
  C:\Windows\System\nGQRtXL.exe
  2⤵
  PID:3704
- C:\Windows\System\ELdXjQf.exe
  C:\Windows\System\ELdXjQf.exe
  2⤵
  PID:3720
- C:\Windows\System\JdTPXgW.exe
  C:\Windows\System\JdTPXgW.exe
  2⤵
  PID:3736
- C:\Windows\System\EoBWfwD.exe
  C:\Windows\System\EoBWfwD.exe
  2⤵
  PID:3752
- C:\Windows\System\iCeaANT.exe
  C:\Windows\System\iCeaANT.exe
  2⤵
  PID:3768
- C:\Windows\System\CMtBuQC.exe
  C:\Windows\System\CMtBuQC.exe
  2⤵
  PID:3784
- C:\Windows\System\lChTaqT.exe
  C:\Windows\System\lChTaqT.exe
  2⤵
  PID:3800
- C:\Windows\System\toxOKCz.exe
  C:\Windows\System\toxOKCz.exe
  2⤵
  PID:3816
- C:\Windows\System\rmWvpGm.exe
  C:\Windows\System\rmWvpGm.exe
  2⤵
  PID:3832
- C:\Windows\System\ISAqyjP.exe
  C:\Windows\System\ISAqyjP.exe
  2⤵
  PID:3848
- C:\Windows\System\RmLbDpt.exe
  C:\Windows\System\RmLbDpt.exe
  2⤵
  PID:3864
- C:\Windows\System\FLnIKSL.exe
  C:\Windows\System\FLnIKSL.exe
  2⤵
  PID:3880
- C:\Windows\System\BufRMKC.exe
  C:\Windows\System\BufRMKC.exe
  2⤵
  PID:3896
- C:\Windows\System\npNGUzo.exe
  C:\Windows\System\npNGUzo.exe
  2⤵
  PID:3912
- C:\Windows\System\XbJksmd.exe
  C:\Windows\System\XbJksmd.exe
  2⤵
  PID:3928
- C:\Windows\System\jbwbJES.exe
  C:\Windows\System\jbwbJES.exe
  2⤵
  PID:3944
- C:\Windows\System\WPHRwBp.exe
  C:\Windows\System\WPHRwBp.exe
  2⤵
  PID:3960
- C:\Windows\System\vljdbZn.exe
  C:\Windows\System\vljdbZn.exe
  2⤵
  PID:3976
- C:\Windows\System\nGYcijI.exe
  C:\Windows\System\nGYcijI.exe
  2⤵
  PID:3992
- C:\Windows\System\pYCcjLH.exe
  C:\Windows\System\pYCcjLH.exe
  2⤵
  PID:4008
- C:\Windows\System\oGKKoax.exe
  C:\Windows\System\oGKKoax.exe
  2⤵
  PID:4024
- C:\Windows\System\yuqAvMq.exe
  C:\Windows\System\yuqAvMq.exe
  2⤵
  PID:4040
- C:\Windows\System\obwTaLN.exe
  C:\Windows\System\obwTaLN.exe
  2⤵
  PID:4056
- C:\Windows\System\zQEKBTy.exe
  C:\Windows\System\zQEKBTy.exe
  2⤵
  PID:4072
- C:\Windows\System\CJjpCPV.exe
  C:\Windows\System\CJjpCPV.exe
  2⤵
  PID:4088
- C:\Windows\System\hnpIyRF.exe
  C:\Windows\System\hnpIyRF.exe
  2⤵
  PID:1968
- C:\Windows\System\wMsaFzB.exe
  C:\Windows\System\wMsaFzB.exe
  2⤵
  PID:2160
- C:\Windows\System\pzJAwqK.exe
  C:\Windows\System\pzJAwqK.exe
  2⤵
  PID:2800
- C:\Windows\System\KsqFnGH.exe
  C:\Windows\System\KsqFnGH.exe
  2⤵
  PID:1808
- C:\Windows\System\VGDexXL.exe
  C:\Windows\System\VGDexXL.exe
  2⤵
  PID:2824
- C:\Windows\System\pKCougK.exe
  C:\Windows\System\pKCougK.exe
  2⤵
  PID:336
- C:\Windows\System\qkPRMmb.exe
  C:\Windows\System\qkPRMmb.exe
  2⤵
  PID:1200
- C:\Windows\System\fOrVBza.exe
  C:\Windows\System\fOrVBza.exe
  2⤵
  PID:3204
- C:\Windows\System\bAUalbC.exe
  C:\Windows\System\bAUalbC.exe
  2⤵
  PID:3268
- C:\Windows\System\YOqajlr.exe
  C:\Windows\System\YOqajlr.exe
  2⤵
  PID:3332
- C:\Windows\System\pkAwSDQ.exe
  C:\Windows\System\pkAwSDQ.exe
  2⤵
  PID:3396
- C:\Windows\System\kKLHoYC.exe
  C:\Windows\System\kKLHoYC.exe
  2⤵
  PID:3460
- C:\Windows\System\lDWUpLi.exe
  C:\Windows\System\lDWUpLi.exe
  2⤵
  PID:2616
- C:\Windows\System\NdDdTdn.exe
  C:\Windows\System\NdDdTdn.exe
  2⤵
  PID:3712
- C:\Windows\System\keIWEUy.exe
  C:\Windows\System\keIWEUy.exe
  2⤵
  PID:3776
- C:\Windows\System\GifOlcx.exe
  C:\Windows\System\GifOlcx.exe
  2⤵
  PID:3840
- C:\Windows\System\qesNDSX.exe
  C:\Windows\System\qesNDSX.exe
  2⤵
  PID:2460
- C:\Windows\System\pIfSdFk.exe
  C:\Windows\System\pIfSdFk.exe
  2⤵
  PID:3876
- C:\Windows\System\LAHqVAu.exe
  C:\Windows\System\LAHqVAu.exe
  2⤵
  PID:1672
- C:\Windows\System\mvYZnlV.exe
  C:\Windows\System\mvYZnlV.exe
  2⤵
  PID:3972
- C:\Windows\System\RxZNdTl.exe
  C:\Windows\System\RxZNdTl.exe
  2⤵
  PID:4004
- C:\Windows\System\JdITnDP.exe
  C:\Windows\System\JdITnDP.exe
  2⤵
  PID:4036
- C:\Windows\System\wzxraYR.exe
  C:\Windows\System\wzxraYR.exe
  2⤵
  PID:492
- C:\Windows\System\YnMPMam.exe
  C:\Windows\System\YnMPMam.exe
  2⤵
  PID:2436
- C:\Windows\System\tITuzbY.exe
  C:\Windows\System\tITuzbY.exe
  2⤵
  PID:3156
- C:\Windows\System\EAOEmIn.exe
  C:\Windows\System\EAOEmIn.exe
  2⤵
  PID:3220
- C:\Windows\System\hhRAKMq.exe
  C:\Windows\System\hhRAKMq.exe
  2⤵
  PID:3280
- C:\Windows\System\inqoAgw.exe
  C:\Windows\System\inqoAgw.exe
  2⤵
  PID:3348
- C:\Windows\System\prRgZaQ.exe
  C:\Windows\System\prRgZaQ.exe
  2⤵
  PID:3412
- C:\Windows\System\LhYRtzS.exe
  C:\Windows\System\LhYRtzS.exe
  2⤵
  PID:3476
- C:\Windows\System\fncZjaH.exe
  C:\Windows\System\fncZjaH.exe
  2⤵
  PID:3568
- C:\Windows\System\Fqdfhei.exe
  C:\Windows\System\Fqdfhei.exe
  2⤵
  PID:3632
- C:\Windows\System\dObfLSD.exe
  C:\Windows\System\dObfLSD.exe
  2⤵
  PID:3696
- C:\Windows\System\tgclqSi.exe
  C:\Windows\System\tgclqSi.exe
  2⤵
  PID:3760
- C:\Windows\System\gBEYqil.exe
  C:\Windows\System\gBEYqil.exe
  2⤵
  PID:3824
- C:\Windows\System\ZGLXffb.exe
  C:\Windows\System\ZGLXffb.exe
  2⤵
  PID:3888
- C:\Windows\System\sBiRymr.exe
  C:\Windows\System\sBiRymr.exe
  2⤵
  PID:3956
- C:\Windows\System\jivZCsu.exe
  C:\Windows\System\jivZCsu.exe
  2⤵
  PID:4020
- C:\Windows\System\gMJnZTV.exe
  C:\Windows\System\gMJnZTV.exe
  2⤵
  PID:4084
- C:\Windows\System\aYGsvkk.exe
  C:\Windows\System\aYGsvkk.exe
  2⤵
  PID:1780
- C:\Windows\System\PkahZvb.exe
  C:\Windows\System\PkahZvb.exe
  2⤵
  PID:1856
- C:\Windows\System\tbfXJCC.exe
  C:\Windows\System\tbfXJCC.exe
  2⤵
  PID:1724
- C:\Windows\System\MChCkTd.exe
  C:\Windows\System\MChCkTd.exe
  2⤵
  PID:856
- C:\Windows\System\mXllGLw.exe
  C:\Windows\System\mXllGLw.exe
  2⤵
  PID:1012
- C:\Windows\System\PqVCOHH.exe
  C:\Windows\System\PqVCOHH.exe
  2⤵
  PID:2284
- C:\Windows\System\YLdwTPc.exe
  C:\Windows\System\YLdwTPc.exe
  2⤵
  PID:2512
- C:\Windows\System\jiIZBvn.exe
  C:\Windows\System\jiIZBvn.exe
  2⤵
  PID:2524
- C:\Windows\System\qgDOyha.exe
  C:\Windows\System\qgDOyha.exe
  2⤵
  PID:2108
- C:\Windows\System\tfKSVqe.exe
  C:\Windows\System\tfKSVqe.exe
  2⤵
  PID:2628
- C:\Windows\System\nXhbiUn.exe
  C:\Windows\System\nXhbiUn.exe
  2⤵
  PID:3120
- C:\Windows\System\dIWpsIe.exe
  C:\Windows\System\dIWpsIe.exe
  2⤵
  PID:2764
- C:\Windows\System\rRtXyfm.exe
  C:\Windows\System\rRtXyfm.exe
  2⤵
  PID:2576
- C:\Windows\System\WhiCFJS.exe
  C:\Windows\System\WhiCFJS.exe
  2⤵
  PID:896
- C:\Windows\System\MsIvOAF.exe
  C:\Windows\System\MsIvOAF.exe
  2⤵
  PID:2720
- C:\Windows\System\xfDPoHG.exe
  C:\Windows\System\xfDPoHG.exe
  2⤵
  PID:1776
- C:\Windows\System\aqDQEBR.exe
  C:\Windows\System\aqDQEBR.exe
  2⤵
  PID:3328
- C:\Windows\System\PAZlLQS.exe
  C:\Windows\System\PAZlLQS.exe
  2⤵
  PID:3552
- C:\Windows\System\JxISmyj.exe
  C:\Windows\System\JxISmyj.exe
  2⤵
  PID:1412
- C:\Windows\System\gqpNaUm.exe
  C:\Windows\System\gqpNaUm.exe
  2⤵
  PID:908
- C:\Windows\System\zEbuGYQ.exe
  C:\Windows\System\zEbuGYQ.exe
  2⤵
  PID:3524
- C:\Windows\System\uinBjwN.exe
  C:\Windows\System\uinBjwN.exe
  2⤵
  PID:3648
- C:\Windows\System\ucxNcLD.exe
  C:\Windows\System\ucxNcLD.exe
  2⤵
  PID:2600
- C:\Windows\System\RKAFehU.exe
  C:\Windows\System\RKAFehU.exe
  2⤵
  PID:2980
- C:\Windows\System\QydIEfr.exe
  C:\Windows\System\QydIEfr.exe
  2⤵
  PID:3000
- C:\Windows\System\FNUBcMx.exe
  C:\Windows\System\FNUBcMx.exe
  2⤵
  PID:904
- C:\Windows\System\FYGtkzw.exe
  C:\Windows\System\FYGtkzw.exe
  2⤵
  PID:3216
- C:\Windows\System\YQZnOgO.exe
  C:\Windows\System\YQZnOgO.exe
  2⤵
  PID:3472
- C:\Windows\System\jjUIpqL.exe
  C:\Windows\System\jjUIpqL.exe
  2⤵
  PID:4112
- C:\Windows\System\NgrcgFV.exe
  C:\Windows\System\NgrcgFV.exe
  2⤵
  PID:4128
- C:\Windows\System\vhrFxel.exe
  C:\Windows\System\vhrFxel.exe
  2⤵
  PID:4144
- C:\Windows\System\pBbuIYy.exe
  C:\Windows\System\pBbuIYy.exe
  2⤵
  PID:4160
- C:\Windows\System\SvIEUoC.exe
  C:\Windows\System\SvIEUoC.exe
  2⤵
  PID:4180
- C:\Windows\System\uoKfYxN.exe
  C:\Windows\System\uoKfYxN.exe
  2⤵
  PID:4196
- C:\Windows\System\yJXAQKI.exe
  C:\Windows\System\yJXAQKI.exe
  2⤵
  PID:4212
- C:\Windows\System\ZcNbbkV.exe
  C:\Windows\System\ZcNbbkV.exe
  2⤵
  PID:4228
- C:\Windows\System\ZPCGVfw.exe
  C:\Windows\System\ZPCGVfw.exe
  2⤵
  PID:4244
- C:\Windows\System\NIuVjeb.exe
  C:\Windows\System\NIuVjeb.exe
  2⤵
  PID:4260
- C:\Windows\System\xdzmCvl.exe
  C:\Windows\System\xdzmCvl.exe
  2⤵
  PID:4280
- C:\Windows\System\IxYbHqB.exe
  C:\Windows\System\IxYbHqB.exe
  2⤵
  PID:4296
- C:\Windows\System\qNpvhxe.exe
  C:\Windows\System\qNpvhxe.exe
  2⤵
  PID:4312
- C:\Windows\System\kDSRgvn.exe
  C:\Windows\System\kDSRgvn.exe
  2⤵
  PID:4328
- C:\Windows\System\wZjJlIp.exe
  C:\Windows\System\wZjJlIp.exe
  2⤵
  PID:4372
- C:\Windows\System\IYKYVnx.exe
  C:\Windows\System\IYKYVnx.exe
  2⤵
  PID:4552
- C:\Windows\System\EgDCKtc.exe
  C:\Windows\System\EgDCKtc.exe
  2⤵
  PID:4568
- C:\Windows\System\KHDPsUp.exe
  C:\Windows\System\KHDPsUp.exe
  2⤵
  PID:4584
- C:\Windows\System\qwtItUu.exe
  C:\Windows\System\qwtItUu.exe
  2⤵
  PID:4600
- C:\Windows\System\DuyMafF.exe
  C:\Windows\System\DuyMafF.exe
  2⤵
  PID:4616
- C:\Windows\System\EsjOVyZ.exe
  C:\Windows\System\EsjOVyZ.exe
  2⤵
  PID:4632
- C:\Windows\System\lOkVrRF.exe
  C:\Windows\System\lOkVrRF.exe
  2⤵
  PID:4672
- C:\Windows\System\sNqrOgU.exe
  C:\Windows\System\sNqrOgU.exe
  2⤵
  PID:4696
- C:\Windows\System\jNKTuEH.exe
  C:\Windows\System\jNKTuEH.exe
  2⤵
  PID:4712
- C:\Windows\System\vxmlgiY.exe
  C:\Windows\System\vxmlgiY.exe
  2⤵
  PID:4728
- C:\Windows\System\FGZMvCO.exe
  C:\Windows\System\FGZMvCO.exe
  2⤵
  PID:4744
- C:\Windows\System\SegLAod.exe
  C:\Windows\System\SegLAod.exe
  2⤵
  PID:4760
- C:\Windows\System\ghlaOjT.exe
  C:\Windows\System\ghlaOjT.exe
  2⤵
  PID:4776
- C:\Windows\System\ilQzald.exe
  C:\Windows\System\ilQzald.exe
  2⤵
  PID:4792
- C:\Windows\System\DYyItaI.exe
  C:\Windows\System\DYyItaI.exe
  2⤵
  PID:4808
- C:\Windows\System\iXtryuc.exe
  C:\Windows\System\iXtryuc.exe
  2⤵
  PID:4824
- C:\Windows\System\tmUsiRd.exe
  C:\Windows\System\tmUsiRd.exe
  2⤵
  PID:4840
- C:\Windows\System\hHrkhSz.exe
  C:\Windows\System\hHrkhSz.exe
  2⤵
  PID:4856
- C:\Windows\System\LfTwcTj.exe
  C:\Windows\System\LfTwcTj.exe
  2⤵
  PID:4872
- C:\Windows\System\cTalamj.exe
  C:\Windows\System\cTalamj.exe
  2⤵
  PID:4888
- C:\Windows\System\YnhUvVc.exe
  C:\Windows\System\YnhUvVc.exe
  2⤵
  PID:4908
- C:\Windows\System\IYWxYVQ.exe
  C:\Windows\System\IYWxYVQ.exe
  2⤵
  PID:4924
- C:\Windows\System\FuWEJBV.exe
  C:\Windows\System\FuWEJBV.exe
  2⤵
  PID:4940
- C:\Windows\System\tDFaNQR.exe
  C:\Windows\System\tDFaNQR.exe
  2⤵
  PID:4956
- C:\Windows\System\DItUsrh.exe
  C:\Windows\System\DItUsrh.exe
  2⤵
  PID:4972
- C:\Windows\System\slYNtfq.exe
  C:\Windows\System\slYNtfq.exe
  2⤵
  PID:4992
- C:\Windows\System\cKvXpKR.exe
  C:\Windows\System\cKvXpKR.exe
  2⤵
  PID:5024
- C:\Windows\System\lcEpBeW.exe
  C:\Windows\System\lcEpBeW.exe
  2⤵
  PID:5108
- C:\Windows\System\BLczkXz.exe
  C:\Windows\System\BLczkXz.exe
  2⤵
  PID:3728
- C:\Windows\System\scZFxXJ.exe
  C:\Windows\System\scZFxXJ.exe
  2⤵
  PID:3988
- C:\Windows\System\AAEjgYy.exe
  C:\Windows\System\AAEjgYy.exe
  2⤵
  PID:2840
- C:\Windows\System\mzYiQzv.exe
  C:\Windows\System\mzYiQzv.exe
  2⤵
  PID:2504
- C:\Windows\System\LdVLqBN.exe
  C:\Windows\System\LdVLqBN.exe
  2⤵
  PID:2420
- C:\Windows\System\kMrTemn.exe
  C:\Windows\System\kMrTemn.exe
  2⤵
  PID:1600
- C:\Windows\System\hPtmswE.exe
  C:\Windows\System\hPtmswE.exe
  2⤵
  PID:3392
- C:\Windows\System\PhTDdYD.exe
  C:\Windows\System\PhTDdYD.exe
  2⤵
  PID:4176
- C:\Windows\System\VpqPtGW.exe
  C:\Windows\System\VpqPtGW.exe
  2⤵
  PID:340
- C:\Windows\System\SGZLXlo.exe
  C:\Windows\System\SGZLXlo.exe
  2⤵
  PID:3508
- C:\Windows\System\CYzrjSq.exe
  C:\Windows\System\CYzrjSq.exe
  2⤵
  PID:3792
- C:\Windows\System\DTNXGsW.exe
  C:\Windows\System\DTNXGsW.exe
  2⤵
  PID:4052
- C:\Windows\System\ycMfuXm.exe
  C:\Windows\System\ycMfuXm.exe
  2⤵
  PID:304
- C:\Windows\System\VGGYRfg.exe
  C:\Windows\System\VGGYRfg.exe
  2⤵
  PID:1756
- C:\Windows\System\SMepRAX.exe
  C:\Windows\System\SMepRAX.exe
  2⤵
  PID:3124
- C:\Windows\System\LmqsiRi.exe
  C:\Windows\System\LmqsiRi.exe
  2⤵
  PID:1224
- C:\Windows\System\UCezJQi.exe
  C:\Windows\System\UCezJQi.exe
  2⤵
  PID:3684
- C:\Windows\System\TewSEgP.exe
  C:\Windows\System\TewSEgP.exe
  2⤵
  PID:3344
- C:\Windows\System\ErLHsqf.exe
  C:\Windows\System\ErLHsqf.exe
  2⤵
  PID:4124
- C:\Windows\System\cGBKFrF.exe
  C:\Windows\System\cGBKFrF.exe
  2⤵
  PID:4252
- C:\Windows\System\OClqIoX.exe
  C:\Windows\System\OClqIoX.exe
  2⤵
  PID:4324
- C:\Windows\System\WOhcjbh.exe
  C:\Windows\System\WOhcjbh.exe
  2⤵
  PID:4408
- C:\Windows\System\uopdaIv.exe
  C:\Windows\System\uopdaIv.exe
  2⤵
  PID:4508
- C:\Windows\System\vsEDRXh.exe
  C:\Windows\System\vsEDRXh.exe
  2⤵
  PID:4412
- C:\Windows\System\WHdnIKB.exe
  C:\Windows\System\WHdnIKB.exe
  2⤵
  PID:4440
- C:\Windows\System\lKfprBC.exe
  C:\Windows\System\lKfprBC.exe
  2⤵
  PID:4460
- C:\Windows\System\vkkhAtx.exe
  C:\Windows\System\vkkhAtx.exe
  2⤵
  PID:4484
- C:\Windows\System\YGqhoul.exe
  C:\Windows\System\YGqhoul.exe
  2⤵
  PID:4512
- C:\Windows\System\fATzwcM.exe
  C:\Windows\System\fATzwcM.exe
  2⤵
  PID:4528
- C:\Windows\System\BoQGyoL.exe
  C:\Windows\System\BoQGyoL.exe
  2⤵
  PID:4544
- C:\Windows\System\jrTpngs.exe
  C:\Windows\System\jrTpngs.exe
  2⤵
  PID:4596
- C:\Windows\System\fmucuTU.exe
  C:\Windows\System\fmucuTU.exe
  2⤵
  PID:4628
- C:\Windows\System\NTVzIVW.exe
  C:\Windows\System\NTVzIVW.exe
  2⤵
  PID:4660
- C:\Windows\System\EnbPzdG.exe
  C:\Windows\System\EnbPzdG.exe
  2⤵
  PID:4688
- C:\Windows\System\xAEOxSE.exe
  C:\Windows\System\xAEOxSE.exe
  2⤵
  PID:4692
- C:\Windows\System\PjNgsza.exe
  C:\Windows\System\PjNgsza.exe
  2⤵
  PID:4772
- C:\Windows\System\ERNnWtu.exe
  C:\Windows\System\ERNnWtu.exe
  2⤵
  PID:4720
- C:\Windows\System\PJXJJvw.exe
  C:\Windows\System\PJXJJvw.exe
  2⤵
  PID:4896
- C:\Windows\System\Pergrdg.exe
  C:\Windows\System\Pergrdg.exe
  2⤵
  PID:4832
- C:\Windows\System\RAKjQAm.exe
  C:\Windows\System\RAKjQAm.exe
  2⤵
  PID:4920
- C:\Windows\System\CvMDNzA.exe
  C:\Windows\System\CvMDNzA.exe
  2⤵
  PID:4804
- C:\Windows\System\wDQMaVY.exe
  C:\Windows\System\wDQMaVY.exe
  2⤵
  PID:4816
- C:\Windows\System\uofWQuc.exe
  C:\Windows\System\uofWQuc.exe
  2⤵
  PID:4968
- C:\Windows\System\BwIypVV.exe
  C:\Windows\System\BwIypVV.exe
  2⤵
  PID:5016
- C:\Windows\System\sZXUvOW.exe
  C:\Windows\System\sZXUvOW.exe
  2⤵
  PID:5032
- C:\Windows\System\awuXSnk.exe
  C:\Windows\System\awuXSnk.exe
  2⤵
  PID:5056
- C:\Windows\System\uguDKqs.exe
  C:\Windows\System\uguDKqs.exe
  2⤵
  PID:5068
- C:\Windows\System\UclTBXy.exe
  C:\Windows\System\UclTBXy.exe
  2⤵
  PID:5088
- C:\Windows\System\ZqEipnD.exe
  C:\Windows\System\ZqEipnD.exe
  2⤵
  PID:5104
- C:\Windows\System\bicnpTv.exe
  C:\Windows\System\bicnpTv.exe
  2⤵
  PID:3600
- C:\Windows\System\MSdPywK.exe
  C:\Windows\System\MSdPywK.exe
  2⤵
  PID:108
- C:\Windows\System\hdTNZGh.exe
  C:\Windows\System\hdTNZGh.exe
  2⤵
  PID:2776
- C:\Windows\System\AQcQLDn.exe
  C:\Windows\System\AQcQLDn.exe
  2⤵
  PID:2328
- C:\Windows\System\oginseL.exe
  C:\Windows\System\oginseL.exe
  2⤵
  PID:4208
- C:\Windows\System\PsObRgu.exe
  C:\Windows\System\PsObRgu.exe
  2⤵
  PID:4276
- C:\Windows\System\kkYCyGy.exe
  C:\Windows\System\kkYCyGy.exe
  2⤵
  PID:924
- C:\Windows\System\BdmQPgO.exe
  C:\Windows\System\BdmQPgO.exe
  2⤵
  PID:4348
- C:\Windows\System\YdXSANM.exe
  C:\Windows\System\YdXSANM.exe
  2⤵
  PID:1700
- C:\Windows\System\qQGhBIF.exe
  C:\Windows\System\qQGhBIF.exe
  2⤵
  PID:3252
- C:\Windows\System\JmQtZTs.exe
  C:\Windows\System\JmQtZTs.exe
  2⤵
  PID:3088
- C:\Windows\System\NCruOeW.exe
  C:\Windows\System\NCruOeW.exe
  2⤵
  PID:3668
- C:\Windows\System\VqDuoxP.exe
  C:\Windows\System\VqDuoxP.exe
  2⤵
  PID:1356
- C:\Windows\System\yQTfmZl.exe
  C:\Windows\System\yQTfmZl.exe
  2⤵
  PID:2808
- C:\Windows\System\FVEAvba.exe
  C:\Windows\System\FVEAvba.exe
  2⤵
  PID:3200
- C:\Windows\System\cxSBRoL.exe
  C:\Windows\System\cxSBRoL.exe
  2⤵
  PID:4360
- C:\Windows\System\QCoyDaT.exe
  C:\Windows\System\QCoyDaT.exe
  2⤵
  PID:4188
- C:\Windows\System\KFWUMkc.exe
  C:\Windows\System\KFWUMkc.exe
  2⤵
  PID:2132
- C:\Windows\System\qVZkwPY.exe
  C:\Windows\System\qVZkwPY.exe
  2⤵
  PID:4292
- C:\Windows\System\UGcvRET.exe
  C:\Windows\System\UGcvRET.exe
  2⤵
  PID:4480
- C:\Windows\System\bbcMBvW.exe
  C:\Windows\System\bbcMBvW.exe
  2⤵
  PID:4400
- C:\Windows\System\tsZFxqd.exe
  C:\Windows\System\tsZFxqd.exe
  2⤵
  PID:4456
- C:\Windows\System\WvCwIvq.exe
  C:\Windows\System\WvCwIvq.exe
  2⤵
  PID:4500
- C:\Windows\System\IREjxNR.exe
  C:\Windows\System\IREjxNR.exe
  2⤵
  PID:4532
- C:\Windows\System\XwtAdAv.exe
  C:\Windows\System\XwtAdAv.exe
  2⤵
  PID:4592
- C:\Windows\System\bwZKkWc.exe
  C:\Windows\System\bwZKkWc.exe
  2⤵
  PID:4612
- C:\Windows\System\qLTjEHp.exe
  C:\Windows\System\qLTjEHp.exe
  2⤵
  PID:4644
- C:\Windows\System\WWjyXBA.exe
  C:\Windows\System\WWjyXBA.exe
  2⤵
  PID:4868
- C:\Windows\System\qRKKtBl.exe
  C:\Windows\System\qRKKtBl.exe
  2⤵
  PID:2016
- C:\Windows\System\ndaLqAE.exe
  C:\Windows\System\ndaLqAE.exe
  2⤵
  PID:840
- C:\Windows\System\SBystub.exe
  C:\Windows\System\SBystub.exe
  2⤵
  PID:564
- C:\Windows\System\HYFheiv.exe
  C:\Windows\System\HYFheiv.exe
  2⤵
  PID:1576
- C:\Windows\System\fwhrGAQ.exe
  C:\Windows\System\fwhrGAQ.exe
  2⤵
  PID:5064
- C:\Windows\System\mdCTMBy.exe
  C:\Windows\System\mdCTMBy.exe
  2⤵
  PID:2892
- C:\Windows\System\yPTjlfj.exe
  C:\Windows\System\yPTjlfj.exe
  2⤵
  PID:2424
- C:\Windows\System\nYxfXGO.exe
  C:\Windows\System\nYxfXGO.exe
  2⤵
  PID:3188
- C:\Windows\System\QVaBCbV.exe
  C:\Windows\System\QVaBCbV.exe
  2⤵
  PID:4104
- C:\Windows\System\IxJeGqY.exe
  C:\Windows\System\IxJeGqY.exe
  2⤵
  PID:4272
- C:\Windows\System\SsAnNWC.exe
  C:\Windows\System\SsAnNWC.exe
  2⤵
  PID:4268
- C:\Windows\System\bQRrlFn.exe
  C:\Windows\System\bQRrlFn.exe
  2⤵
  PID:3952
- C:\Windows\System\NnDxsyO.exe
  C:\Windows\System\NnDxsyO.exe
  2⤵
  PID:4452
- C:\Windows\System\rgWowwj.exe
  C:\Windows\System\rgWowwj.exe
  2⤵
  PID:4540
- C:\Windows\System\XKaZrTp.exe
  C:\Windows\System\XKaZrTp.exe
  2⤵
  PID:4652
- C:\Windows\System\RYrNWhA.exe
  C:\Windows\System\RYrNWhA.exe
  2⤵
  PID:4224
- C:\Windows\System\LqLAIPg.exe
  C:\Windows\System\LqLAIPg.exe
  2⤵
  PID:4344
- C:\Windows\System\BoxdaTE.exe
  C:\Windows\System\BoxdaTE.exe
  2⤵
  PID:4420
- C:\Windows\System\BsZLDNJ.exe
  C:\Windows\System\BsZLDNJ.exe
  2⤵
  PID:4680
- C:\Windows\System\imIiRsY.exe
  C:\Windows\System\imIiRsY.exe
  2⤵
  PID:3620
- C:\Windows\System\pukaNqX.exe
  C:\Windows\System\pukaNqX.exe
  2⤵
  PID:5084
- C:\Windows\System\IpKhoDW.exe
  C:\Windows\System\IpKhoDW.exe
  2⤵
  PID:4980
- C:\Windows\System\XEtNSOq.exe
  C:\Windows\System\XEtNSOq.exe
  2⤵
  PID:4752
- C:\Windows\System\aWTLrdY.exe
  C:\Windows\System\aWTLrdY.exe
  2⤵
  PID:3264
- C:\Windows\System\qGKsObS.exe
  C:\Windows\System\qGKsObS.exe
  2⤵
  PID:1736
- C:\Windows\System\VkEcgtv.exe
  C:\Windows\System\VkEcgtv.exe
  2⤵
  PID:1108
- C:\Windows\System\fDGasBE.exe
  C:\Windows\System\fDGasBE.exe
  2⤵
  PID:5044
- C:\Windows\System\vmBSiCz.exe
  C:\Windows\System\vmBSiCz.exe
  2⤵
  PID:3844
- C:\Windows\System\FUetwtn.exe
  C:\Windows\System\FUetwtn.exe
  2⤵
  PID:532
- C:\Windows\System\vGbjRVV.exe
  C:\Windows\System\vGbjRVV.exe
  2⤵
  PID:3520
- C:\Windows\System\mBLkWKG.exe
  C:\Windows\System\mBLkWKG.exe
  2⤵
  PID:4704
- C:\Windows\System\MdUdUyv.exe
  C:\Windows\System\MdUdUyv.exe
  2⤵
  PID:3408
- C:\Windows\System\QGttXCr.exe
  C:\Windows\System\QGttXCr.exe
  2⤵
  PID:4724
- C:\Windows\System\nrJZxSt.exe
  C:\Windows\System\nrJZxSt.exe
  2⤵
  PID:4428
- C:\Windows\System\FztDiVo.exe
  C:\Windows\System\FztDiVo.exe
  2⤵
  PID:4788
- C:\Windows\System\GVUpyMn.exe
  C:\Windows\System\GVUpyMn.exe
  2⤵
  PID:5116
- C:\Windows\System\lQOGXWl.exe
  C:\Windows\System\lQOGXWl.exe
  2⤵
  PID:4836
- C:\Windows\System\bcvHZRS.exe
  C:\Windows\System\bcvHZRS.exe
  2⤵
  PID:4880
- C:\Windows\System\UoDlyHS.exe
  C:\Windows\System\UoDlyHS.exe
  2⤵
  PID:5136
- C:\Windows\System\qCMhFmj.exe
  C:\Windows\System\qCMhFmj.exe
  2⤵
  PID:5156
- C:\Windows\System\JFhDLxu.exe
  C:\Windows\System\JFhDLxu.exe
  2⤵
  PID:5172
- C:\Windows\System\bfmVVYZ.exe
  C:\Windows\System\bfmVVYZ.exe
  2⤵
  PID:5188
- C:\Windows\System\SebTToK.exe
  C:\Windows\System\SebTToK.exe
  2⤵
  PID:5204
- C:\Windows\System\qsgQyaY.exe
  C:\Windows\System\qsgQyaY.exe
  2⤵
  PID:5220
- C:\Windows\System\IxiOHuL.exe
  C:\Windows\System\IxiOHuL.exe
  2⤵
  PID:5268
- C:\Windows\System\JalyZRi.exe
  C:\Windows\System\JalyZRi.exe
  2⤵
  PID:5284
- C:\Windows\System\XmVyfGG.exe
  C:\Windows\System\XmVyfGG.exe
  2⤵
  PID:5300
- C:\Windows\System\WlGyITZ.exe
  C:\Windows\System\WlGyITZ.exe
  2⤵
  PID:5316
- C:\Windows\System\VnVsQCJ.exe
  C:\Windows\System\VnVsQCJ.exe
  2⤵
  PID:5332
- C:\Windows\System\ZoZiKsh.exe
  C:\Windows\System\ZoZiKsh.exe
  2⤵
  PID:5452
- C:\Windows\System\HOvHWuf.exe
  C:\Windows\System\HOvHWuf.exe
  2⤵
  PID:5468
- C:\Windows\System\AuSRMJC.exe
  C:\Windows\System\AuSRMJC.exe
  2⤵
  PID:5484
- C:\Windows\System\AGGvghR.exe
  C:\Windows\System\AGGvghR.exe
  2⤵
  PID:5500
- C:\Windows\System\brErACD.exe
  C:\Windows\System\brErACD.exe
  2⤵
  PID:5516
- C:\Windows\System\uZHlrak.exe
  C:\Windows\System\uZHlrak.exe
  2⤵
  PID:5532
- C:\Windows\System\rbyYcIS.exe
  C:\Windows\System\rbyYcIS.exe
  2⤵
  PID:5548
- C:\Windows\System\AqRaWLH.exe
  C:\Windows\System\AqRaWLH.exe
  2⤵
  PID:5592
- C:\Windows\System\paHSxNC.exe
  C:\Windows\System\paHSxNC.exe
  2⤵
  PID:5608
- C:\Windows\System\jggakHf.exe
  C:\Windows\System\jggakHf.exe
  2⤵
  PID:5624
- C:\Windows\System\VLflIxE.exe
  C:\Windows\System\VLflIxE.exe
  2⤵
  PID:5640
- C:\Windows\System\ckuNxhN.exe
  C:\Windows\System\ckuNxhN.exe
  2⤵
  PID:5656
- C:\Windows\System\fIGWaAr.exe
  C:\Windows\System\fIGWaAr.exe
  2⤵
  PID:5672
- C:\Windows\System\JBgrYdv.exe
  C:\Windows\System\JBgrYdv.exe
  2⤵
  PID:5688
- C:\Windows\System\VJGmMEb.exe
  C:\Windows\System\VJGmMEb.exe
  2⤵
  PID:5704
- C:\Windows\System\VbVxZhh.exe
  C:\Windows\System\VbVxZhh.exe
  2⤵
  PID:5720
- C:\Windows\System\VTsZWQJ.exe
  C:\Windows\System\VTsZWQJ.exe
  2⤵
  PID:5736
- C:\Windows\System\FfiJIUK.exe
  C:\Windows\System\FfiJIUK.exe
  2⤵
  PID:5752
- C:\Windows\System\GUqhPBx.exe
  C:\Windows\System\GUqhPBx.exe
  2⤵
  PID:5808
- C:\Windows\System\DwYYsFc.exe
  C:\Windows\System\DwYYsFc.exe
  2⤵
  PID:5824
- C:\Windows\System\GQJvkLr.exe
  C:\Windows\System\GQJvkLr.exe
  2⤵
  PID:5840
- C:\Windows\System\uBBLwwI.exe
  C:\Windows\System\uBBLwwI.exe
  2⤵
  PID:5856
- C:\Windows\System\mGoxnaq.exe
  C:\Windows\System\mGoxnaq.exe
  2⤵
  PID:5872
- C:\Windows\System\oULUilS.exe
  C:\Windows\System\oULUilS.exe
  2⤵
  PID:5888
- C:\Windows\System\nmSFdtZ.exe
  C:\Windows\System\nmSFdtZ.exe
  2⤵
  PID:5908
- C:\Windows\System\kPgnqTy.exe
  C:\Windows\System\kPgnqTy.exe
  2⤵
  PID:5924
- C:\Windows\System\gerWqfh.exe
  C:\Windows\System\gerWqfh.exe
  2⤵
  PID:5940
- C:\Windows\System\uBMhAPx.exe
  C:\Windows\System\uBMhAPx.exe
  2⤵
  PID:5956
- C:\Windows\System\hkrcBoD.exe
  C:\Windows\System\hkrcBoD.exe
  2⤵
  PID:5972
- C:\Windows\System\XXAkYga.exe
  C:\Windows\System\XXAkYga.exe
  2⤵
  PID:5992
- C:\Windows\System\cscbRRK.exe
  C:\Windows\System\cscbRRK.exe
  2⤵
  PID:6008
- C:\Windows\System\YfVLuUT.exe
  C:\Windows\System\YfVLuUT.exe
  2⤵
  PID:6024
- C:\Windows\System\UjWIMbk.exe
  C:\Windows\System\UjWIMbk.exe
  2⤵
  PID:6040
- C:\Windows\System\sVkAdhL.exe
  C:\Windows\System\sVkAdhL.exe
  2⤵
  PID:6056
- C:\Windows\System\EsYwgOp.exe
  C:\Windows\System\EsYwgOp.exe
  2⤵
  PID:6072
- C:\Windows\System\ELeIMTX.exe
  C:\Windows\System\ELeIMTX.exe
  2⤵
  PID:6088
- C:\Windows\System\mWTouCC.exe
  C:\Windows\System\mWTouCC.exe
  2⤵
  PID:6104
- C:\Windows\System\zjqqOye.exe
  C:\Windows\System\zjqqOye.exe
  2⤵
  PID:6120
- C:\Windows\System\fjJkFHY.exe
  C:\Windows\System\fjJkFHY.exe
  2⤵
  PID:6136
- C:\Windows\System\nAwdexm.exe
  C:\Windows\System\nAwdexm.exe
  2⤵
  PID:656
- C:\Windows\System\ATLbXSG.exe
  C:\Windows\System\ATLbXSG.exe
  2⤵
  PID:2568
- C:\Windows\System\DnerUlc.exe
  C:\Windows\System\DnerUlc.exe
  2⤵
  PID:5216
- C:\Windows\System\nTPwyOu.exe
  C:\Windows\System\nTPwyOu.exe
  2⤵
  PID:5164
- C:\Windows\System\DQGdCGh.exe
  C:\Windows\System\DQGdCGh.exe
  2⤵
  PID:3924
- C:\Windows\System\iMuBXez.exe
  C:\Windows\System\iMuBXez.exe
  2⤵
  PID:5168
- C:\Windows\System\coxQWqe.exe
  C:\Windows\System\coxQWqe.exe
  2⤵
  PID:5196
- C:\Windows\System\aNkgxJR.exe
  C:\Windows\System\aNkgxJR.exe
  2⤵
  PID:5236
- C:\Windows\System\xxwdymr.exe
  C:\Windows\System\xxwdymr.exe
  2⤵
  PID:5252
- C:\Windows\System\tZuzmea.exe
  C:\Windows\System\tZuzmea.exe
  2⤵
  PID:5264
- C:\Windows\System\NhIZXQP.exe
  C:\Windows\System\NhIZXQP.exe
  2⤵
  PID:4320
- C:\Windows\System\IPKzxVe.exe
  C:\Windows\System\IPKzxVe.exe
  2⤵
  PID:5312
- C:\Windows\System\EJmcwRT.exe
  C:\Windows\System\EJmcwRT.exe
  2⤵
  PID:5324
- C:\Windows\System\sPuPIfk.exe
  C:\Windows\System\sPuPIfk.exe
  2⤵
  PID:5384
- C:\Windows\System\vWxZqjT.exe
  C:\Windows\System\vWxZqjT.exe
  2⤵
  PID:5400
- C:\Windows\System\qQHoLjc.exe
  C:\Windows\System\qQHoLjc.exe
  2⤵
  PID:5436
- C:\Windows\System\pqAIvKm.exe
  C:\Windows\System\pqAIvKm.exe
  2⤵
  PID:5460
- C:\Windows\System\UEQqbFw.exe
  C:\Windows\System\UEQqbFw.exe
  2⤵
  PID:5508
- C:\Windows\System\njdiMwU.exe
  C:\Windows\System\njdiMwU.exe
  2⤵
  PID:5524
- C:\Windows\System\USlKwxe.exe
  C:\Windows\System\USlKwxe.exe
  2⤵
  PID:5564
- C:\Windows\System\hrqRQEX.exe
  C:\Windows\System\hrqRQEX.exe
  2⤵
  PID:5580
- C:\Windows\System\HUQxjps.exe
  C:\Windows\System\HUQxjps.exe
  2⤵
  PID:5620
- C:\Windows\System\NtQbHBY.exe
  C:\Windows\System\NtQbHBY.exe
  2⤵
  PID:5652
- C:\Windows\System\FbMbTJq.exe
  C:\Windows\System\FbMbTJq.exe
  2⤵
  PID:5632
- C:\Windows\System\nZGrdQU.exe
  C:\Windows\System\nZGrdQU.exe
  2⤵
  PID:5668
- C:\Windows\System\USkBFzB.exe
  C:\Windows\System\USkBFzB.exe
  2⤵
  PID:5732
- C:\Windows\System\UEtMyLH.exe
  C:\Windows\System\UEtMyLH.exe
  2⤵
  PID:5776
- C:\Windows\System\ABfxOZt.exe
  C:\Windows\System\ABfxOZt.exe
  2⤵
  PID:5788
- C:\Windows\System\pNNGXUb.exe
  C:\Windows\System\pNNGXUb.exe
  2⤵
  PID:5804
- C:\Windows\System\akFguWA.exe
  C:\Windows\System\akFguWA.exe
  2⤵
  PID:5748
- C:\Windows\System\fXIlVuY.exe
  C:\Windows\System\fXIlVuY.exe
  2⤵
  PID:5884
- C:\Windows\System\NcwhNbH.exe
  C:\Windows\System\NcwhNbH.exe
  2⤵
  PID:5968
- C:\Windows\System\xyhpXUu.exe
  C:\Windows\System\xyhpXUu.exe
  2⤵
  PID:5984
- C:\Windows\System\SDLzwsD.exe
  C:\Windows\System\SDLzwsD.exe
  2⤵
  PID:5144
- C:\Windows\System\niGVVaO.exe
  C:\Windows\System\niGVVaO.exe
  2⤵
  PID:4708
- C:\Windows\System\GXoShRH.exe
  C:\Windows\System\GXoShRH.exe
  2⤵
  PID:4884
- C:\Windows\System\ynllIFf.exe
  C:\Windows\System\ynllIFf.exe
  2⤵
  PID:6080
- C:\Windows\System\NdHTZQs.exe
  C:\Windows\System\NdHTZQs.exe
  2⤵
  PID:5180
- C:\Windows\System\SRiNMwZ.exe
  C:\Windows\System\SRiNMwZ.exe
  2⤵
  PID:5896
- C:\Windows\System\vPsvnJI.exe
  C:\Windows\System\vPsvnJI.exe
  2⤵
  PID:5964
- C:\Windows\System\TGfqaXK.exe
  C:\Windows\System\TGfqaXK.exe
  2⤵
  PID:6100
- C:\Windows\System\zAvKtIK.exe
  C:\Windows\System\zAvKtIK.exe
  2⤵
  PID:5008
- C:\Windows\System\ZpxDQJf.exe
  C:\Windows\System\ZpxDQJf.exe
  2⤵
  PID:4140
- C:\Windows\System\vClBeAF.exe
  C:\Windows\System\vClBeAF.exe
  2⤵
  PID:4520
- C:\Windows\System\MyEPbSn.exe
  C:\Windows\System\MyEPbSn.exe
  2⤵
  PID:2792
- C:\Windows\System\tqzAWWB.exe
  C:\Windows\System\tqzAWWB.exe
  2⤵
  PID:3152
- C:\Windows\System\qOWiBcU.exe
  C:\Windows\System\qOWiBcU.exe
  2⤵
  PID:5148
- C:\Windows\System\IVrsDlY.exe
  C:\Windows\System\IVrsDlY.exe
  2⤵
  PID:5276
- C:\Windows\System\LDcHiFJ.exe
  C:\Windows\System\LDcHiFJ.exe
  2⤵
  PID:5248
- C:\Windows\System\egBgHES.exe
  C:\Windows\System\egBgHES.exe
  2⤵
  PID:5364
- C:\Windows\System\cvEJsCD.exe
  C:\Windows\System\cvEJsCD.exe
  2⤵
  PID:5380
- C:\Windows\System\HrqMhyn.exe
  C:\Windows\System\HrqMhyn.exe
  2⤵
  PID:5392
- C:\Windows\System\bfnkakc.exe
  C:\Windows\System\bfnkakc.exe
  2⤵
  PID:5476
- C:\Windows\System\aQUpTLl.exe
  C:\Windows\System\aQUpTLl.exe
  2⤵
  PID:5424
- C:\Windows\System\bzbucIK.exe
  C:\Windows\System\bzbucIK.exe
  2⤵
  PID:5528
- C:\Windows\System\fJkCQXt.exe
  C:\Windows\System\fJkCQXt.exe
  2⤵
  PID:5572
- C:\Windows\System\MFmatQr.exe
  C:\Windows\System\MFmatQr.exe
  2⤵
  PID:5636
- C:\Windows\System\nMgNIuo.exe
  C:\Windows\System\nMgNIuo.exe
  2⤵
  PID:5800
- C:\Windows\System\rKqNHrr.exe
  C:\Windows\System\rKqNHrr.exe
  2⤵
  PID:5700
- C:\Windows\System\DUCdBtS.exe
  C:\Windows\System\DUCdBtS.exe
  2⤵
  PID:5764
- C:\Windows\System\jzeWzMy.exe
  C:\Windows\System\jzeWzMy.exe
  2⤵
  PID:5920
- C:\Windows\System\TQMpqjI.exe
  C:\Windows\System\TQMpqjI.exe
  2⤵
  PID:6020
- C:\Windows\System\wBVuheV.exe
  C:\Windows\System\wBVuheV.exe
  2⤵
  PID:6112
- C:\Windows\System\mdHTvfS.exe
  C:\Windows\System\mdHTvfS.exe
  2⤵
  PID:5152
- C:\Windows\System\TFrbcab.exe
  C:\Windows\System\TFrbcab.exe
  2⤵
  PID:6036
- C:\Windows\System\vVPmxjB.exe
  C:\Windows\System\vVPmxjB.exe
  2⤵
  PID:4432
- C:\Windows\System\SKaFRKp.exe
  C:\Windows\System\SKaFRKp.exe
  2⤵
  PID:5244
- C:\Windows\System\hGOtNtp.exe
  C:\Windows\System\hGOtNtp.exe
  2⤵
  PID:1492
- C:\Windows\System\xewpGKv.exe
  C:\Windows\System\xewpGKv.exe
  2⤵
  PID:5132
- C:\Windows\System\kOkpKSr.exe
  C:\Windows\System\kOkpKSr.exe
  2⤵
  PID:4068
- C:\Windows\System\KlQgtjS.exe
  C:\Windows\System\KlQgtjS.exe
  2⤵
  PID:2996
- C:\Windows\System\XOkrQhJ.exe
  C:\Windows\System\XOkrQhJ.exe
  2⤵
  PID:5416
- C:\Windows\System\MnjbtpF.exe
  C:\Windows\System\MnjbtpF.exe
  2⤵
  PID:5444
- C:\Windows\System\owMfCuT.exe
  C:\Windows\System\owMfCuT.exe
  2⤵
  PID:5684
- C:\Windows\System\bDUwOyN.exe
  C:\Windows\System\bDUwOyN.exe
  2⤵
  PID:5240
- C:\Windows\System\vCGsTSg.exe
  C:\Windows\System\vCGsTSg.exe
  2⤵
  PID:5796
- C:\Windows\System\ftLtjkl.exe
  C:\Windows\System\ftLtjkl.exe
  2⤵
  PID:5744
- C:\Windows\System\Rtkxjoz.exe
  C:\Windows\System\Rtkxjoz.exe
  2⤵
  PID:6032
- C:\Windows\System\oCgzNUk.exe
  C:\Windows\System\oCgzNUk.exe
  2⤵
  PID:6016
- C:\Windows\System\ZvxntfP.exe
  C:\Windows\System\ZvxntfP.exe
  2⤵
  PID:6052
- C:\Windows\System\fEKOftT.exe
  C:\Windows\System\fEKOftT.exe
  2⤵
  PID:5496
- C:\Windows\System\NsAmsuy.exe
  C:\Windows\System\NsAmsuy.exe
  2⤵
  PID:5376
- C:\Windows\System\DZKbmuo.exe
  C:\Windows\System\DZKbmuo.exe
  2⤵
  PID:5372
- C:\Windows\System\zmPUQnP.exe
  C:\Windows\System\zmPUQnP.exe
  2⤵
  PID:5096
- C:\Windows\System\bXUMslR.exe
  C:\Windows\System\bXUMslR.exe
  2⤵
  PID:5728
- C:\Windows\System\LzGxpjk.exe
  C:\Windows\System\LzGxpjk.exe
  2⤵
  PID:4852
- C:\Windows\System\zSUaajC.exe
  C:\Windows\System\zSUaajC.exe
  2⤵
  PID:5128
- C:\Windows\System\mWeVjeE.exe
  C:\Windows\System\mWeVjeE.exe
  2⤵
  PID:6000
- C:\Windows\System\YPQciIh.exe
  C:\Windows\System\YPQciIh.exe
  2⤵
  PID:5412
- C:\Windows\System\rKZKfex.exe
  C:\Windows\System\rKZKfex.exe
  2⤵
  PID:6152
- C:\Windows\System\spPeLyL.exe
  C:\Windows\System\spPeLyL.exe
  2⤵
  PID:6168
- C:\Windows\System\BxeMHSz.exe
  C:\Windows\System\BxeMHSz.exe
  2⤵
  PID:6184
- C:\Windows\System\autVVTI.exe
  C:\Windows\System\autVVTI.exe
  2⤵
  PID:6200
- C:\Windows\System\ACGdbxX.exe
  C:\Windows\System\ACGdbxX.exe
  2⤵
  PID:6216
- C:\Windows\System\YDtxthj.exe
  C:\Windows\System\YDtxthj.exe
  2⤵
  PID:6232
- C:\Windows\System\WJOIVYB.exe
  C:\Windows\System\WJOIVYB.exe
  2⤵
  PID:6248
- C:\Windows\System\ARxRdvK.exe
  C:\Windows\System\ARxRdvK.exe
  2⤵
  PID:6264
- C:\Windows\System\zNEDSbP.exe
  C:\Windows\System\zNEDSbP.exe
  2⤵
  PID:6280
- C:\Windows\System\Rsfiiri.exe
  C:\Windows\System\Rsfiiri.exe
  2⤵
  PID:6296
- C:\Windows\System\IZSjFMt.exe
  C:\Windows\System\IZSjFMt.exe
  2⤵
  PID:6312
- C:\Windows\System\QAtsFtJ.exe
  C:\Windows\System\QAtsFtJ.exe
  2⤵
  PID:6328
- C:\Windows\System\GlzJoir.exe
  C:\Windows\System\GlzJoir.exe
  2⤵
  PID:6344
- C:\Windows\System\ybCnFbX.exe
  C:\Windows\System\ybCnFbX.exe
  2⤵
  PID:6364
- C:\Windows\System\PeWplFP.exe
  C:\Windows\System\PeWplFP.exe
  2⤵
  PID:6380
- C:\Windows\System\gBijczE.exe
  C:\Windows\System\gBijczE.exe
  2⤵
  PID:6396
- C:\Windows\System\CDQCuYD.exe
  C:\Windows\System\CDQCuYD.exe
  2⤵
  PID:6412
- C:\Windows\System\NAQewQZ.exe
  C:\Windows\System\NAQewQZ.exe
  2⤵
  PID:6428
- C:\Windows\System\IOlrvHK.exe
  C:\Windows\System\IOlrvHK.exe
  2⤵
  PID:6444
- C:\Windows\System\JKiyiTD.exe
  C:\Windows\System\JKiyiTD.exe
  2⤵
  PID:6460
- C:\Windows\System\rxcvsQF.exe
  C:\Windows\System\rxcvsQF.exe
  2⤵
  PID:6476
- C:\Windows\System\qZUglNd.exe
  C:\Windows\System\qZUglNd.exe
  2⤵
  PID:6492
- C:\Windows\System\sftocRs.exe
  C:\Windows\System\sftocRs.exe
  2⤵
  PID:6508
- C:\Windows\System\FbLrrLF.exe
  C:\Windows\System\FbLrrLF.exe
  2⤵
  PID:6524
- C:\Windows\System\ikiirLK.exe
  C:\Windows\System\ikiirLK.exe
  2⤵
  PID:6540
- C:\Windows\System\zuPYbIN.exe
  C:\Windows\System\zuPYbIN.exe
  2⤵
  PID:6556
- C:\Windows\System\NSzKqVw.exe
  C:\Windows\System\NSzKqVw.exe
  2⤵
  PID:6572
- C:\Windows\System\waIFniq.exe
  C:\Windows\System\waIFniq.exe
  2⤵
  PID:6588
- C:\Windows\System\CgIoZYQ.exe
  C:\Windows\System\CgIoZYQ.exe
  2⤵
  PID:6604
- C:\Windows\System\AlQoaNN.exe
  C:\Windows\System\AlQoaNN.exe
  2⤵
  PID:6620
- C:\Windows\System\wFzHUDT.exe
  C:\Windows\System\wFzHUDT.exe
  2⤵
  PID:6636
- C:\Windows\System\mHvzlJN.exe
  C:\Windows\System\mHvzlJN.exe
  2⤵
  PID:6652
- C:\Windows\System\sbDKSts.exe
  C:\Windows\System\sbDKSts.exe
  2⤵
  PID:6668
- C:\Windows\System\EYcoCQw.exe
  C:\Windows\System\EYcoCQw.exe
  2⤵
  PID:6684
- C:\Windows\System\yuiWFcy.exe
  C:\Windows\System\yuiWFcy.exe
  2⤵
  PID:6700
- C:\Windows\System\KJziYBR.exe
  C:\Windows\System\KJziYBR.exe
  2⤵
  PID:6716
- C:\Windows\System\uyNvqig.exe
  C:\Windows\System\uyNvqig.exe
  2⤵
  PID:6732
- C:\Windows\System\qEdBPtx.exe
  C:\Windows\System\qEdBPtx.exe
  2⤵
  PID:6748
- C:\Windows\System\wCsqXtd.exe
  C:\Windows\System\wCsqXtd.exe
  2⤵
  PID:6764
- C:\Windows\System\pXJpysa.exe
  C:\Windows\System\pXJpysa.exe
  2⤵
  PID:6780
- C:\Windows\System\vVRXeUb.exe
  C:\Windows\System\vVRXeUb.exe
  2⤵
  PID:6796
- C:\Windows\System\jmdILGM.exe
  C:\Windows\System\jmdILGM.exe
  2⤵
  PID:6812
- C:\Windows\System\vgrROND.exe
  C:\Windows\System\vgrROND.exe
  2⤵
  PID:6828
- C:\Windows\System\UFfbhac.exe
  C:\Windows\System\UFfbhac.exe
  2⤵
  PID:6844
- C:\Windows\System\cBTyuLI.exe
  C:\Windows\System\cBTyuLI.exe
  2⤵
  PID:6860
- C:\Windows\System\BUAouQx.exe
  C:\Windows\System\BUAouQx.exe
  2⤵
  PID:6876
- C:\Windows\System\XPMUnQL.exe
  C:\Windows\System\XPMUnQL.exe
  2⤵
  PID:6892
- C:\Windows\System\auVtlKg.exe
  C:\Windows\System\auVtlKg.exe
  2⤵
  PID:6908
- C:\Windows\System\LmUbcLj.exe
  C:\Windows\System\LmUbcLj.exe
  2⤵
  PID:6924
- C:\Windows\System\fSaLwCc.exe
  C:\Windows\System\fSaLwCc.exe
  2⤵
  PID:6944
- C:\Windows\System\yfbUUXu.exe
  C:\Windows\System\yfbUUXu.exe
  2⤵
  PID:6960
- C:\Windows\System\rOSJBfa.exe
  C:\Windows\System\rOSJBfa.exe
  2⤵
  PID:6976
- C:\Windows\System\oUxEfPM.exe
  C:\Windows\System\oUxEfPM.exe
  2⤵
  PID:6992
- C:\Windows\System\dXBRutg.exe
  C:\Windows\System\dXBRutg.exe
  2⤵
  PID:7008
- C:\Windows\System\vFDYBVz.exe
  C:\Windows\System\vFDYBVz.exe
  2⤵
  PID:7024
- C:\Windows\System\EdQVRSX.exe
  C:\Windows\System\EdQVRSX.exe
  2⤵
  PID:7044
- C:\Windows\System\LxNqnks.exe
  C:\Windows\System\LxNqnks.exe
  2⤵
  PID:7060
- C:\Windows\System\FTPktfF.exe
  C:\Windows\System\FTPktfF.exe
  2⤵
  PID:7076
- C:\Windows\System\qgOhrmE.exe
  C:\Windows\System\qgOhrmE.exe
  2⤵
  PID:7092
- C:\Windows\System\daAZuSY.exe
  C:\Windows\System\daAZuSY.exe
  2⤵
  PID:7108
- C:\Windows\System\OdJabfO.exe
  C:\Windows\System\OdJabfO.exe
  2⤵
  PID:7124
- C:\Windows\System\upKRAfn.exe
  C:\Windows\System\upKRAfn.exe
  2⤵
  PID:7144
- C:\Windows\System\ekkoDSk.exe
  C:\Windows\System\ekkoDSk.exe
  2⤵
  PID:7164
- C:\Windows\System\IJFdkjc.exe
  C:\Windows\System\IJFdkjc.exe
  2⤵
  PID:5448
- C:\Windows\System\wwDWLCM.exe
  C:\Windows\System\wwDWLCM.exe
  2⤵
  PID:6192
- C:\Windows\System\qbNmYkK.exe
  C:\Windows\System\qbNmYkK.exe
  2⤵
  PID:5852
- C:\Windows\System\SoCyjka.exe
  C:\Windows\System\SoCyjka.exe
  2⤵
  PID:6224
- C:\Windows\System\kcvvZCF.exe
  C:\Windows\System\kcvvZCF.exe
  2⤵
  PID:6288
- C:\Windows\System\JUWjiRf.exe
  C:\Windows\System\JUWjiRf.exe
  2⤵
  PID:6352
- C:\Windows\System\miZLUlO.exe
  C:\Windows\System\miZLUlO.exe
  2⤵
  PID:6388
- C:\Windows\System\dzLkjAZ.exe
  C:\Windows\System\dzLkjAZ.exe
  2⤵
  PID:6424
- C:\Windows\System\iNFbPtf.exe
  C:\Windows\System\iNFbPtf.exe
  2⤵
  PID:6304
- C:\Windows\System\WCDeKXD.exe
  C:\Windows\System\WCDeKXD.exe
  2⤵
  PID:6436
- C:\Windows\System\CdATYGs.exe
  C:\Windows\System\CdATYGs.exe
  2⤵
  PID:6532
- C:\Windows\System\CeOajgX.exe
  C:\Windows\System\CeOajgX.exe
  2⤵
  PID:6372
- C:\Windows\System\gyLKRNO.exe
  C:\Windows\System\gyLKRNO.exe
  2⤵
  PID:6468
- C:\Windows\System\GtrsjzT.exe
  C:\Windows\System\GtrsjzT.exe
  2⤵
  PID:6568
- C:\Windows\System\kADbqqU.exe
  C:\Windows\System\kADbqqU.exe
  2⤵
  PID:6520
- C:\Windows\System\WlrJQHY.exe
  C:\Windows\System\WlrJQHY.exe
  2⤵
  PID:6584
- C:\Windows\System\XMoqOts.exe
  C:\Windows\System\XMoqOts.exe
  2⤵
  PID:6648
- C:\Windows\System\ubXaxJr.exe
  C:\Windows\System\ubXaxJr.exe
  2⤵
  PID:6712
- C:\Windows\System\bSPjeFV.exe
  C:\Windows\System\bSPjeFV.exe
  2⤵
  PID:6776
- C:\Windows\System\qNjlPaW.exe
  C:\Windows\System\qNjlPaW.exe
  2⤵
  PID:6628
- C:\Windows\System\TgCYbkC.exe
  C:\Windows\System\TgCYbkC.exe
  2⤵
  PID:6632
- C:\Windows\System\bzSaKgj.exe
  C:\Windows\System\bzSaKgj.exe
  2⤵
  PID:6756
- C:\Windows\System\jewyUSV.exe
  C:\Windows\System\jewyUSV.exe
  2⤵
  PID:6824
- C:\Windows\System\nlDaCoJ.exe
  C:\Windows\System\nlDaCoJ.exe
  2⤵
  PID:6884
- C:\Windows\System\hLvpszz.exe
  C:\Windows\System\hLvpszz.exe
  2⤵
  PID:6916
- C:\Windows\System\iScbdnS.exe
  C:\Windows\System\iScbdnS.exe
  2⤵
  PID:6940
- C:\Windows\System\MymLGPt.exe
  C:\Windows\System\MymLGPt.exe
  2⤵
  PID:6920
- C:\Windows\System\NPpmOYN.exe
  C:\Windows\System\NPpmOYN.exe
  2⤵
  PID:6956
- C:\Windows\System\DvnarnF.exe
  C:\Windows\System\DvnarnF.exe
  2⤵
  PID:7020
- C:\Windows\System\QlczErY.exe
  C:\Windows\System\QlczErY.exe
  2⤵
  PID:7100
- C:\Windows\System\mNTMkfs.exe
  C:\Windows\System\mNTMkfs.exe
  2⤵
  PID:2040
- C:\Windows\System\TWTpwiN.exe
  C:\Windows\System\TWTpwiN.exe
  2⤵
  PID:7056
- C:\Windows\System\PVQRplV.exe
  C:\Windows\System\PVQRplV.exe
  2⤵
  PID:7088
- C:\Windows\System\UpUKstX.exe
  C:\Windows\System\UpUKstX.exe
  2⤵
  PID:5664
- C:\Windows\System\LpqQRSP.exe
  C:\Windows\System\LpqQRSP.exe
  2⤵
  PID:3936
- C:\Windows\System\KirJkUO.exe
  C:\Windows\System\KirJkUO.exe
  2⤵
  PID:6260
- C:\Windows\System\ONeaUaM.exe
  C:\Windows\System\ONeaUaM.exe
  2⤵
  PID:6276
- C:\Windows\System\EHFCXoF.exe
  C:\Windows\System\EHFCXoF.exe
  2⤵
  PID:6488
- C:\Windows\System\MNbTPFj.exe
  C:\Windows\System\MNbTPFj.exe
  2⤵
  PID:6744
- C:\Windows\System\xMhHeld.exe
  C:\Windows\System\xMhHeld.exe
  2⤵
  PID:6788
- C:\Windows\System\iMyFwdi.exe
  C:\Windows\System\iMyFwdi.exe
  2⤵
  PID:6868
- C:\Windows\System\nPZUdCA.exe
  C:\Windows\System\nPZUdCA.exe
  2⤵
  PID:6324
- C:\Windows\System\YKYIRQp.exe
  C:\Windows\System\YKYIRQp.exe
  2⤵
  PID:6404
- C:\Windows\System\dDeIqFo.exe
  C:\Windows\System\dDeIqFo.exe
  2⤵
  PID:6680
- C:\Windows\System\cXkBWfJ.exe
  C:\Windows\System\cXkBWfJ.exe
  2⤵
  PID:6164
- C:\Windows\System\LXhMqqP.exe
  C:\Windows\System\LXhMqqP.exe
  2⤵
  PID:6456
- C:\Windows\System\dmqiCyc.exe
  C:\Windows\System\dmqiCyc.exe
  2⤵
  PID:6820
- C:\Windows\System\xvjSyde.exe
  C:\Windows\System\xvjSyde.exe
  2⤵
  PID:7136
- C:\Windows\System\HRuEZSp.exe
  C:\Windows\System\HRuEZSp.exe
  2⤵
  PID:7172
- C:\Windows\System\jyiqRXb.exe
  C:\Windows\System\jyiqRXb.exe
  2⤵
  PID:7188
- C:\Windows\System\jlpEMAw.exe
  C:\Windows\System\jlpEMAw.exe
  2⤵
  PID:7204
- C:\Windows\System\aDdrAUA.exe
  C:\Windows\System\aDdrAUA.exe
  2⤵
  PID:7220
- C:\Windows\System\PFyNFfX.exe
  C:\Windows\System\PFyNFfX.exe
  2⤵
  PID:7236
- C:\Windows\System\BrilMkz.exe
  C:\Windows\System\BrilMkz.exe
  2⤵
  PID:7252
- C:\Windows\System\WDcaWWD.exe
  C:\Windows\System\WDcaWWD.exe
  2⤵
  PID:7268
- C:\Windows\System\UQluYkO.exe
  C:\Windows\System\UQluYkO.exe
  2⤵
  PID:7284
- C:\Windows\System\MbhtWFE.exe
  C:\Windows\System\MbhtWFE.exe
  2⤵
  PID:7300
- C:\Windows\System\egksBtG.exe
  C:\Windows\System\egksBtG.exe
  2⤵
  PID:7316
- C:\Windows\System\qZwScJM.exe
  C:\Windows\System\qZwScJM.exe
  2⤵
  PID:7336
- C:\Windows\System\yQrxQpJ.exe
  C:\Windows\System\yQrxQpJ.exe
  2⤵
  PID:7352
- C:\Windows\System\bGZWXsN.exe
  C:\Windows\System\bGZWXsN.exe
  2⤵
  PID:7368
- C:\Windows\System\QsysCdi.exe
  C:\Windows\System\QsysCdi.exe
  2⤵
  PID:7384
- C:\Windows\System\WqmzhmA.exe
  C:\Windows\System\WqmzhmA.exe
  2⤵
  PID:7400
- C:\Windows\System\hvZEAfK.exe
  C:\Windows\System\hvZEAfK.exe
  2⤵
  PID:7416
- C:\Windows\System\STFUjAY.exe
  C:\Windows\System\STFUjAY.exe
  2⤵
  PID:7432
- C:\Windows\System\NdrGllf.exe
  C:\Windows\System\NdrGllf.exe
  2⤵
  PID:7452
- C:\Windows\System\LwjqZLN.exe
  C:\Windows\System\LwjqZLN.exe
  2⤵
  PID:7468
- C:\Windows\System\RuIPVBj.exe
  C:\Windows\System\RuIPVBj.exe
  2⤵
  PID:7484
- C:\Windows\System\CRfBMRO.exe
  C:\Windows\System\CRfBMRO.exe
  2⤵
  PID:7500
- C:\Windows\System\gtyPlbZ.exe
  C:\Windows\System\gtyPlbZ.exe
  2⤵
  PID:7516
- C:\Windows\System\lGOJhth.exe
  C:\Windows\System\lGOJhth.exe
  2⤵
  PID:7536
- C:\Windows\System\HAQNlRq.exe
  C:\Windows\System\HAQNlRq.exe
  2⤵
  PID:7552
- C:\Windows\System\GtURGhL.exe
  C:\Windows\System\GtURGhL.exe
  2⤵
  PID:7568
- C:\Windows\System\slPpVaH.exe
  C:\Windows\System\slPpVaH.exe
  2⤵
  PID:7584
- C:\Windows\System\RjAWGnz.exe
  C:\Windows\System\RjAWGnz.exe
  2⤵
  PID:7600
- C:\Windows\System\ZhzVhUg.exe
  C:\Windows\System\ZhzVhUg.exe
  2⤵
  PID:7616
- C:\Windows\System\IDzjgaz.exe
  C:\Windows\System\IDzjgaz.exe
  2⤵
  PID:7636
- C:\Windows\System\YKDwkdh.exe
  C:\Windows\System\YKDwkdh.exe
  2⤵
  PID:7652
- C:\Windows\System\yqavlqB.exe
  C:\Windows\System\yqavlqB.exe
  2⤵
  PID:7668
- C:\Windows\System\EbgpQaC.exe
  C:\Windows\System\EbgpQaC.exe
  2⤵
  PID:7684
- C:\Windows\System\ZPZKgVu.exe
  C:\Windows\System\ZPZKgVu.exe
  2⤵
  PID:7700
- C:\Windows\System\aurMoRD.exe
  C:\Windows\System\aurMoRD.exe
  2⤵
  PID:7716
- C:\Windows\System\PpxEvYe.exe
  C:\Windows\System\PpxEvYe.exe
  2⤵
  PID:7732
- C:\Windows\System\UGSiuNO.exe
  C:\Windows\System\UGSiuNO.exe
  2⤵
  PID:7748
- C:\Windows\System\GtDtHuY.exe
  C:\Windows\System\GtDtHuY.exe
  2⤵
  PID:7764
- C:\Windows\System\GinndaC.exe
  C:\Windows\System\GinndaC.exe
  2⤵
  PID:7780
- C:\Windows\System\pBZGZPc.exe
  C:\Windows\System\pBZGZPc.exe
  2⤵
  PID:7796
- C:\Windows\System\NAlccVo.exe
  C:\Windows\System\NAlccVo.exe
  2⤵
  PID:7812
- C:\Windows\System\kqKQKVv.exe
  C:\Windows\System\kqKQKVv.exe
  2⤵
  PID:7828
- C:\Windows\System\rboHrGV.exe
  C:\Windows\System\rboHrGV.exe
  2⤵
  PID:7844
- C:\Windows\System\JmMgltf.exe
  C:\Windows\System\JmMgltf.exe
  2⤵
  PID:7860
- C:\Windows\System\RmhupXV.exe
  C:\Windows\System\RmhupXV.exe
  2⤵
  PID:7876
- C:\Windows\System\SznShFG.exe
  C:\Windows\System\SznShFG.exe
  2⤵
  PID:7892
- C:\Windows\System\dWUcnkz.exe
  C:\Windows\System\dWUcnkz.exe
  2⤵
  PID:7908
- C:\Windows\System\oLjUvwP.exe
  C:\Windows\System\oLjUvwP.exe
  2⤵
  PID:7936
- C:\Windows\System\dXCfpKm.exe
  C:\Windows\System\dXCfpKm.exe
  2⤵
  PID:7952
- C:\Windows\System\irJNerS.exe
  C:\Windows\System\irJNerS.exe
  2⤵
  PID:7968
- C:\Windows\System\mUvVIMB.exe
  C:\Windows\System\mUvVIMB.exe
  2⤵
  PID:7984
- C:\Windows\System\JHLwtHw.exe
  C:\Windows\System\JHLwtHw.exe
  2⤵
  PID:8000
- C:\Windows\System\iIugBni.exe
  C:\Windows\System\iIugBni.exe
  2⤵
  PID:8016
- C:\Windows\System\TrjMGvz.exe
  C:\Windows\System\TrjMGvz.exe
  2⤵
  PID:8032
- C:\Windows\System\Vttyork.exe
  C:\Windows\System\Vttyork.exe
  2⤵
  PID:8048
- C:\Windows\System\bNrIqtu.exe
  C:\Windows\System\bNrIqtu.exe
  2⤵
  PID:8064
- C:\Windows\System\olqUjzU.exe
  C:\Windows\System\olqUjzU.exe
  2⤵
  PID:8080
- C:\Windows\System\xGTeIEg.exe
  C:\Windows\System\xGTeIEg.exe
  2⤵
  PID:8096
- C:\Windows\System\JLKsrHi.exe
  C:\Windows\System\JLKsrHi.exe
  2⤵
  PID:8112
- C:\Windows\System\iCaxscP.exe
  C:\Windows\System\iCaxscP.exe
  2⤵
  PID:8128
- C:\Windows\System\BBKeQlu.exe
  C:\Windows\System\BBKeQlu.exe
  2⤵
  PID:8144
- C:\Windows\System\MXjuiva.exe
  C:\Windows\System\MXjuiva.exe
  2⤵
  PID:8160
- C:\Windows\System\ZuaOukw.exe
  C:\Windows\System\ZuaOukw.exe
  2⤵
  PID:8176
- C:\Windows\System\lpKjErf.exe
  C:\Windows\System\lpKjErf.exe
  2⤵
  PID:6616
- C:\Windows\System\aYuxyEv.exe
  C:\Windows\System\aYuxyEv.exe
  2⤵
  PID:7228
- C:\Windows\System\eIYVPPr.exe
  C:\Windows\System\eIYVPPr.exe
  2⤵
  PID:7292
- C:\Windows\System\jkpIlMu.exe
  C:\Windows\System\jkpIlMu.exe
  2⤵
  PID:7332
- C:\Windows\System\InHTwUO.exe
  C:\Windows\System\InHTwUO.exe
  2⤵
  PID:7036
- C:\Windows\System\jVSyKSy.exe
  C:\Windows\System\jVSyKSy.exe
  2⤵
  PID:6340
- C:\Windows\System\UnsDEKH.exe
  C:\Windows\System\UnsDEKH.exe
  2⤵
  PID:6580
- C:\Windows\System\eyTaKfz.exe
  C:\Windows\System\eyTaKfz.exe
  2⤵
  PID:7424
- C:\Windows\System\wekeNTP.exe
  C:\Windows\System\wekeNTP.exe
  2⤵
  PID:6692
- C:\Windows\System\qWHZBCl.exe
  C:\Windows\System\qWHZBCl.exe
  2⤵
  PID:7004
- C:\Windows\System\KViWxzm.exe
  C:\Windows\System\KViWxzm.exe
  2⤵
  PID:7052
- C:\Windows\System\lilaGqf.exe
  C:\Windows\System\lilaGqf.exe
  2⤵
  PID:5584
- C:\Windows\System\pLcykel.exe
  C:\Windows\System\pLcykel.exe
  2⤵
  PID:7464
- C:\Windows\System\iCukAIt.exe
  C:\Windows\System\iCukAIt.exe
  2⤵
  PID:6724
- C:\Windows\System\vhgRbZH.exe
  C:\Windows\System\vhgRbZH.exe
  2⤵
  PID:7440
- C:\Windows\System\EyYLqBb.exe
  C:\Windows\System\EyYLqBb.exe
  2⤵
  PID:5420
- C:\Windows\System\XJPFgVJ.exe
  C:\Windows\System\XJPFgVJ.exe
  2⤵
  PID:7212
- C:\Windows\System\zGJGtCh.exe
  C:\Windows\System\zGJGtCh.exe
  2⤵
  PID:7280
- C:\Windows\System\rJaMKGu.exe
  C:\Windows\System\rJaMKGu.exe
  2⤵
  PID:7348
- C:\Windows\System\qMgBXth.exe
  C:\Windows\System\qMgBXth.exe
  2⤵
  PID:7412
- C:\Windows\System\rakLEFD.exe
  C:\Windows\System\rakLEFD.exe
  2⤵
  PID:7528
- C:\Windows\System\vxkgeuJ.exe
  C:\Windows\System\vxkgeuJ.exe
  2⤵
  PID:7480
- C:\Windows\System\pcdZKxi.exe
  C:\Windows\System\pcdZKxi.exe
  2⤵
  PID:7564
- C:\Windows\System\WfinIsF.exe
  C:\Windows\System\WfinIsF.exe
  2⤵
  PID:7596
- C:\Windows\System\UhQilJX.exe
  C:\Windows\System\UhQilJX.exe
  2⤵
  PID:7576
- C:\Windows\System\cOQYsEu.exe
  C:\Windows\System\cOQYsEu.exe
  2⤵
  PID:7580
- C:\Windows\System\lUjxNDM.exe
  C:\Windows\System\lUjxNDM.exe
  2⤵
  PID:7648
- C:\Windows\System\ovdCelW.exe
  C:\Windows\System\ovdCelW.exe
  2⤵
  PID:7712
- C:\Windows\System\HxRaNmw.exe
  C:\Windows\System\HxRaNmw.exe
  2⤵
  PID:7772
- C:\Windows\System\BRXHool.exe
  C:\Windows\System\BRXHool.exe
  2⤵
  PID:7696
- C:\Windows\System\oOsotjf.exe
  C:\Windows\System\oOsotjf.exe
  2⤵
  PID:7760
- C:\Windows\System\tveGtuB.exe
  C:\Windows\System\tveGtuB.exe
  2⤵
  PID:7824
- C:\Windows\System\YvyGXxd.exe
  C:\Windows\System\YvyGXxd.exe
  2⤵
  PID:7852
- C:\Windows\System\EqRbdQV.exe
  C:\Windows\System\EqRbdQV.exe
  2⤵
  PID:7916
- C:\Windows\System\NOCzsHd.exe
  C:\Windows\System\NOCzsHd.exe
  2⤵
  PID:7924
- C:\Windows\System\PIJWVOm.exe
  C:\Windows\System\PIJWVOm.exe
  2⤵
  PID:7964
- C:\Windows\System\aAvXyxZ.exe
  C:\Windows\System\aAvXyxZ.exe
  2⤵
  PID:8028
- C:\Windows\System\rwzCTth.exe
  C:\Windows\System\rwzCTth.exe
  2⤵
  PID:7976
- C:\Windows\System\Bryxhva.exe
  C:\Windows\System\Bryxhva.exe
  2⤵
  PID:8040
- C:\Windows\System\cNHVpuX.exe
  C:\Windows\System\cNHVpuX.exe
  2⤵
  PID:8120
- C:\Windows\System\kyIStEj.exe
  C:\Windows\System\kyIStEj.exe
  2⤵
  PID:8152
- C:\Windows\System\xDyIXcd.exe
  C:\Windows\System\xDyIXcd.exe
  2⤵
  PID:8104
- C:\Windows\System\JmVQdRx.exe
  C:\Windows\System\JmVQdRx.exe
  2⤵
  PID:4684
- C:\Windows\System\Iydqnqg.exe
  C:\Windows\System\Iydqnqg.exe
  2⤵
  PID:6600
- C:\Windows\System\vCLGeIj.exe
  C:\Windows\System\vCLGeIj.exe
  2⤵
  PID:6148
- C:\Windows\System\yvrUbqB.exe
  C:\Windows\System\yvrUbqB.exe
  2⤵
  PID:7200
- C:\Windows\System\OYJSOug.exe
  C:\Windows\System\OYJSOug.exe
  2⤵
  PID:7312
- C:\Windows\System\haTqzDb.exe
  C:\Windows\System\haTqzDb.exe
  2⤵
  PID:7392
- C:\Windows\System\fLtqqhZ.exe
  C:\Windows\System\fLtqqhZ.exe
  2⤵
  PID:7524
- C:\Windows\System\uAErDwM.exe
  C:\Windows\System\uAErDwM.exe
  2⤵
  PID:8168
- C:\Windows\System\IVBJzzt.exe
  C:\Windows\System\IVBJzzt.exe
  2⤵
  PID:7508
- C:\Windows\System\bOjESEv.exe
  C:\Windows\System\bOjESEv.exe
  2⤵
  PID:7328
- C:\Windows\System\KhQyxhK.exe
  C:\Windows\System\KhQyxhK.exe
  2⤵
  PID:7152
- C:\Windows\System\fYDChqd.exe
  C:\Windows\System\fYDChqd.exe
  2⤵
  PID:6244
- C:\Windows\System\pjBGTpx.exe
  C:\Windows\System\pjBGTpx.exe
  2⤵
  PID:7380
- C:\Windows\System\MPsfqRk.exe
  C:\Windows\System\MPsfqRk.exe
  2⤵
  PID:7660
- C:\Windows\System\LPYdrxc.exe
  C:\Windows\System\LPYdrxc.exe
  2⤵
  PID:7644
- C:\Windows\System\ujSXYwI.exe
  C:\Windows\System\ujSXYwI.exe
  2⤵
  PID:7680
- C:\Windows\System\QUMlTFU.exe
  C:\Windows\System\QUMlTFU.exe
  2⤵
  PID:7872
- C:\Windows\System\SpdDkxP.exe
  C:\Windows\System\SpdDkxP.exe
  2⤵
  PID:7820
- C:\Windows\System\YKAErTP.exe
  C:\Windows\System\YKAErTP.exe
  2⤵
  PID:7996
- C:\Windows\System\ZBIwddH.exe
  C:\Windows\System\ZBIwddH.exe
  2⤵
  PID:8076
- C:\Windows\System\ZVvOBgq.exe
  C:\Windows\System\ZVvOBgq.exe
  2⤵
  PID:7960
- C:\Windows\System\pBTrbsH.exe
  C:\Windows\System\pBTrbsH.exe
  2⤵
  PID:7184
- C:\Windows\System\GrbgZsB.exe
  C:\Windows\System\GrbgZsB.exe
  2⤵
  PID:7932
- C:\Windows\System\qJUuHBR.exe
  C:\Windows\System\qJUuHBR.exe
  2⤵
  PID:6808
- C:\Windows\System\nHNCMSI.exe
  C:\Windows\System\nHNCMSI.exe
  2⤵
  PID:8088
- C:\Windows\System\IBmZbRp.exe
  C:\Windows\System\IBmZbRp.exe
  2⤵
  PID:7544
- C:\Windows\System\JeleFKi.exe
  C:\Windows\System\JeleFKi.exe
  2⤵
  PID:7628
- C:\Windows\System\YJsfynD.exe
  C:\Windows\System\YJsfynD.exe
  2⤵
  PID:7248
- C:\Windows\System\SictqlH.exe
  C:\Windows\System\SictqlH.exe
  2⤵
  PID:7744
- C:\Windows\System\IpjREwN.exe
  C:\Windows\System\IpjREwN.exe
  2⤵
  PID:7808
- C:\Windows\System\zuqFqAa.exe
  C:\Windows\System\zuqFqAa.exe
  2⤵
  PID:7756
- C:\Windows\System\ExUBSiH.exe
  C:\Windows\System\ExUBSiH.exe
  2⤵
  PID:7140
- C:\Windows\System\bLrtgSO.exe
  C:\Windows\System\bLrtgSO.exe
  2⤵
  PID:7496
- C:\Windows\System\ByjHVoo.exe
  C:\Windows\System\ByjHVoo.exe
  2⤵
  PID:8136
- C:\Windows\System\fVQilRP.exe
  C:\Windows\System\fVQilRP.exe
  2⤵
  PID:7928
- C:\Windows\System\bSrynUF.exe
  C:\Windows\System\bSrynUF.exe
  2⤵
  PID:7856
- C:\Windows\System\HxpgpvM.exe
  C:\Windows\System\HxpgpvM.exe
  2⤵
  PID:8188
- C:\Windows\System\LRFsXjm.exe
  C:\Windows\System\LRFsXjm.exe
  2⤵
  PID:7884
- C:\Windows\System\sChptgV.exe
  C:\Windows\System\sChptgV.exe
  2⤵
  PID:7708
- C:\Windows\System\XZeMHYW.exe
  C:\Windows\System\XZeMHYW.exe
  2⤵
  PID:6552
- C:\Windows\System\ivmZyHm.exe
  C:\Windows\System\ivmZyHm.exe
  2⤵
  PID:6440
- C:\Windows\System\BggTuVr.exe
  C:\Windows\System\BggTuVr.exe
  2⤵
  PID:8044
- C:\Windows\System\ZwcqeAm.exe
  C:\Windows\System\ZwcqeAm.exe
  2⤵
  PID:8200
- C:\Windows\System\PyRHlQy.exe
  C:\Windows\System\PyRHlQy.exe
  2⤵
  PID:8216
- C:\Windows\System\JCsYmUm.exe
  C:\Windows\System\JCsYmUm.exe
  2⤵
  PID:8232
- C:\Windows\System\qdhxwLC.exe
  C:\Windows\System\qdhxwLC.exe
  2⤵
  PID:8248
- C:\Windows\System\AiUxEqt.exe
  C:\Windows\System\AiUxEqt.exe
  2⤵
  PID:8264
- C:\Windows\System\nogDXWG.exe
  C:\Windows\System\nogDXWG.exe
  2⤵
  PID:8280
- C:\Windows\System\awiGmzu.exe
  C:\Windows\System\awiGmzu.exe
  2⤵
  PID:8296
- C:\Windows\System\ImpXmdY.exe
  C:\Windows\System\ImpXmdY.exe
  2⤵
  PID:8312
- C:\Windows\System\IUlXhHn.exe
  C:\Windows\System\IUlXhHn.exe
  2⤵
  PID:8328
- C:\Windows\System\lAXAThK.exe
  C:\Windows\System\lAXAThK.exe
  2⤵
  PID:8344
- C:\Windows\System\ZUfHtfv.exe
  C:\Windows\System\ZUfHtfv.exe
  2⤵
  PID:8360
- C:\Windows\System\RsVFuFW.exe
  C:\Windows\System\RsVFuFW.exe
  2⤵
  PID:8376
- C:\Windows\System\QKIsrwZ.exe
  C:\Windows\System\QKIsrwZ.exe
  2⤵
  PID:8392
- C:\Windows\System\vdZuKtb.exe
  C:\Windows\System\vdZuKtb.exe
  2⤵
  PID:8408
- C:\Windows\System\kRjhMAy.exe
  C:\Windows\System\kRjhMAy.exe
  2⤵
  PID:8424
- C:\Windows\System\AzxGYvJ.exe
  C:\Windows\System\AzxGYvJ.exe
  2⤵
  PID:8440
- C:\Windows\System\EnlLBgG.exe
  C:\Windows\System\EnlLBgG.exe
  2⤵
  PID:8456
- C:\Windows\System\ChKhvgc.exe
  C:\Windows\System\ChKhvgc.exe
  2⤵
  PID:8472
- C:\Windows\System\NwmsuxM.exe
  C:\Windows\System\NwmsuxM.exe
  2⤵
  PID:8488
- C:\Windows\System\MkrECJq.exe
  C:\Windows\System\MkrECJq.exe
  2⤵
  PID:8504
- C:\Windows\System\rtJoDBa.exe
  C:\Windows\System\rtJoDBa.exe
  2⤵
  PID:8520
- C:\Windows\System\wmjgeJz.exe
  C:\Windows\System\wmjgeJz.exe
  2⤵
  PID:8536
- C:\Windows\System\GOstMcP.exe
  C:\Windows\System\GOstMcP.exe
  2⤵
  PID:8556
- C:\Windows\System\rWoQdhb.exe
  C:\Windows\System\rWoQdhb.exe
  2⤵
  PID:8572
- C:\Windows\System\xDMuCOc.exe
  C:\Windows\System\xDMuCOc.exe
  2⤵
  PID:8588
- C:\Windows\System\TbeKLJh.exe
  C:\Windows\System\TbeKLJh.exe
  2⤵
  PID:8604
- C:\Windows\System\yIwkCIR.exe
  C:\Windows\System\yIwkCIR.exe
  2⤵
  PID:8620
- C:\Windows\System\jrmdskQ.exe
  C:\Windows\System\jrmdskQ.exe
  2⤵
  PID:8636
- C:\Windows\System\KVAgzjb.exe
  C:\Windows\System\KVAgzjb.exe
  2⤵
  PID:8660
- C:\Windows\System\aBOsVZn.exe
  C:\Windows\System\aBOsVZn.exe
  2⤵
  PID:8680
- C:\Windows\System\FHweStV.exe
  C:\Windows\System\FHweStV.exe
  2⤵
  PID:8696
- C:\Windows\System\uKFlnYB.exe
  C:\Windows\System\uKFlnYB.exe
  2⤵
  PID:8712
- C:\Windows\System\GLYBDCu.exe
  C:\Windows\System\GLYBDCu.exe
  2⤵
  PID:8728
- C:\Windows\System\xjZroeE.exe
  C:\Windows\System\xjZroeE.exe
  2⤵
  PID:8744
- C:\Windows\System\jhJTTGy.exe
  C:\Windows\System\jhJTTGy.exe
  2⤵
  PID:8760
- C:\Windows\System\yFDdkpi.exe
  C:\Windows\System\yFDdkpi.exe
  2⤵
  PID:8776
- C:\Windows\System\LWnYXqG.exe
  C:\Windows\System\LWnYXqG.exe
  2⤵
  PID:8792
- C:\Windows\System\HJOPpWt.exe
  C:\Windows\System\HJOPpWt.exe
  2⤵
  PID:8812
- C:\Windows\System\MOEMIQy.exe
  C:\Windows\System\MOEMIQy.exe
  2⤵
  PID:8828
- C:\Windows\System\xJhJraj.exe
  C:\Windows\System\xJhJraj.exe
  2⤵
  PID:8844
- C:\Windows\System\YOaTbDU.exe
  C:\Windows\System\YOaTbDU.exe
  2⤵
  PID:8860
- C:\Windows\System\ZTsIlmf.exe
  C:\Windows\System\ZTsIlmf.exe
  2⤵
  PID:8876
- C:\Windows\System\OxddKxi.exe
  C:\Windows\System\OxddKxi.exe
  2⤵
  PID:8892
- C:\Windows\System\cIIUxpS.exe
  C:\Windows\System\cIIUxpS.exe
  2⤵
  PID:8908
- C:\Windows\System\IXKjFGL.exe
  C:\Windows\System\IXKjFGL.exe
  2⤵
  PID:8924
- C:\Windows\System\UHOzJsl.exe
  C:\Windows\System\UHOzJsl.exe
  2⤵
  PID:8940
- C:\Windows\System\AzNlrwp.exe
  C:\Windows\System\AzNlrwp.exe
  2⤵
  PID:8956
- C:\Windows\System\ejARAJk.exe
  C:\Windows\System\ejARAJk.exe
  2⤵
  PID:8972
- C:\Windows\System\ohCGejj.exe
  C:\Windows\System\ohCGejj.exe
  2⤵
  PID:8988
- C:\Windows\System\eHrYmds.exe
  C:\Windows\System\eHrYmds.exe
  2⤵
  PID:9004
- C:\Windows\System\cIZWGxe.exe
  C:\Windows\System\cIZWGxe.exe
  2⤵
  PID:9020
- C:\Windows\System\movkWIY.exe
  C:\Windows\System\movkWIY.exe
  2⤵
  PID:9036
- C:\Windows\System\ucJzNBA.exe
  C:\Windows\System\ucJzNBA.exe
  2⤵
  PID:9052
- C:\Windows\System\EcVmwIq.exe
  C:\Windows\System\EcVmwIq.exe
  2⤵
  PID:9068
- C:\Windows\System\SBPkHsA.exe
  C:\Windows\System\SBPkHsA.exe
  2⤵
  PID:9084
- C:\Windows\System\qIXKzyF.exe
  C:\Windows\System\qIXKzyF.exe
  2⤵
  PID:9100
- C:\Windows\System\wzQYWKz.exe
  C:\Windows\System\wzQYWKz.exe
  2⤵
  PID:9116
- C:\Windows\System\RpdwhXk.exe
  C:\Windows\System\RpdwhXk.exe
  2⤵
  PID:9132
- C:\Windows\System\TQfuGth.exe
  C:\Windows\System\TQfuGth.exe
  2⤵
  PID:9148
- C:\Windows\System\VwVRYru.exe
  C:\Windows\System\VwVRYru.exe
  2⤵
  PID:9164
- C:\Windows\System\dtucGUs.exe
  C:\Windows\System\dtucGUs.exe
  2⤵
  PID:9180
- C:\Windows\System\ysWkBQQ.exe
  C:\Windows\System\ysWkBQQ.exe
  2⤵
  PID:9196
- C:\Windows\System\IZhzWLf.exe
  C:\Windows\System\IZhzWLf.exe
  2⤵
  PID:9212
- C:\Windows\System\YvNoRdV.exe
  C:\Windows\System\YvNoRdV.exe
  2⤵
  PID:8184
- C:\Windows\System\uaRhmuj.exe
  C:\Windows\System\uaRhmuj.exe
  2⤵
  PID:8256
- C:\Windows\System\zWklvti.exe
  C:\Windows\System\zWklvti.exe
  2⤵
  PID:8240
- C:\Windows\System\WdojNAS.exe
  C:\Windows\System\WdojNAS.exe
  2⤵
  PID:8304
- C:\Windows\System\aUYUlYx.exe
  C:\Windows\System\aUYUlYx.exe
  2⤵
  PID:8320
- C:\Windows\System\JJSomia.exe
  C:\Windows\System\JJSomia.exe
  2⤵
  PID:8336
- C:\Windows\System\tOsgrWF.exe
  C:\Windows\System\tOsgrWF.exe
  2⤵
  PID:8368
- C:\Windows\System\SIIgeRG.exe
  C:\Windows\System\SIIgeRG.exe
  2⤵
  PID:8416
- C:\Windows\System\NTqSFtr.exe
  C:\Windows\System\NTqSFtr.exe
  2⤵
  PID:8480
- C:\Windows\System\DeIhyiD.exe
  C:\Windows\System\DeIhyiD.exe
  2⤵
  PID:8544
- C:\Windows\System\yhGUwFm.exe
  C:\Windows\System\yhGUwFm.exe
  2⤵
  PID:8612
- C:\Windows\System\rrEmTQX.exe
  C:\Windows\System\rrEmTQX.exe
  2⤵
  PID:8468
- C:\Windows\System\HpEMJat.exe
  C:\Windows\System\HpEMJat.exe
  2⤵
  PID:8528
- C:\Windows\System\fXYJWwx.exe
  C:\Windows\System\fXYJWwx.exe
  2⤵
  PID:8596
- C:\Windows\System\EZJKErV.exe
  C:\Windows\System\EZJKErV.exe
  2⤵
  PID:8644
- C:\Windows\System\uIPFIOR.exe
  C:\Windows\System\uIPFIOR.exe
  2⤵
  PID:2836
- C:\Windows\System\aUeaiUz.exe
  C:\Windows\System\aUeaiUz.exe
  2⤵
  PID:6932
- C:\Windows\System\luukJms.exe
  C:\Windows\System\luukJms.exe
  2⤵
  PID:8720
- C:\Windows\System\yETgmoC.exe
  C:\Windows\System\yETgmoC.exe
  2⤵
  PID:8856
- C:\Windows\System\qrQqeCK.exe
  C:\Windows\System\qrQqeCK.exe
  2⤵
  PID:8784
- C:\Windows\System\uQbMnFW.exe
  C:\Windows\System\uQbMnFW.exe
  2⤵
  PID:8916
- C:\Windows\System\KvviUzs.exe
  C:\Windows\System\KvviUzs.exe
  2⤵
  PID:8980
- C:\Windows\System\hlAGDML.exe
  C:\Windows\System\hlAGDML.exe
  2⤵
  PID:9048
- C:\Windows\System\wmijQhw.exe
  C:\Windows\System\wmijQhw.exe
  2⤵
  PID:8668
- C:\Windows\System\elVanxp.exe
  C:\Windows\System\elVanxp.exe
  2⤵
  PID:8708
- C:\Windows\System\JXSmQau.exe
  C:\Windows\System\JXSmQau.exe
  2⤵
  PID:8836
- C:\Windows\System\BMnztxU.exe
  C:\Windows\System\BMnztxU.exe
  2⤵
  PID:8900
- C:\Windows\System\DmJlACh.exe
  C:\Windows\System\DmJlACh.exe
  2⤵
  PID:8964
- C:\Windows\System\Asgldor.exe
  C:\Windows\System\Asgldor.exe
  2⤵
  PID:9000
- C:\Windows\System\iOKxyop.exe
  C:\Windows\System\iOKxyop.exe
  2⤵
  PID:9064
- C:\Windows\System\wqULgAJ.exe
  C:\Windows\System\wqULgAJ.exe
  2⤵
  PID:9112
- C:\Windows\System\ghkdctv.exe
  C:\Windows\System\ghkdctv.exe
  2⤵
  PID:9176
- C:\Windows\System\NwBODQf.exe
  C:\Windows\System\NwBODQf.exe
  2⤵
  PID:9096
- C:\Windows\System\wtJWFdI.exe
  C:\Windows\System\wtJWFdI.exe
  2⤵
  PID:9160
- C:\Windows\System\PXVvhqa.exe
  C:\Windows\System\PXVvhqa.exe
  2⤵
  PID:6900
- C:\Windows\System\KNmzRUQ.exe
  C:\Windows\System\KNmzRUQ.exe
  2⤵
  PID:8276
- C:\Windows\System\WQWJwbi.exe
  C:\Windows\System\WQWJwbi.exe
  2⤵
  PID:8208
- C:\Windows\System\sEYvGuT.exe
  C:\Windows\System\sEYvGuT.exe
  2⤵
  PID:8288
- C:\Windows\System\izWcQTN.exe
  C:\Windows\System\izWcQTN.exe
  2⤵
  PID:8452
- C:\Windows\System\EkoVxRJ.exe
  C:\Windows\System\EkoVxRJ.exe
  2⤵
  PID:8436
- C:\Windows\System\wUHOBon.exe
  C:\Windows\System\wUHOBon.exe
  2⤵
  PID:8012
- C:\Windows\System\fDfEQtD.exe
  C:\Windows\System\fDfEQtD.exe
  2⤵
  PID:8820
- C:\Windows\System\yrdkDWP.exe
  C:\Windows\System\yrdkDWP.exe
  2⤵
  PID:8804
- C:\Windows\System\AskbuyK.exe
  C:\Windows\System\AskbuyK.exe
  2⤵
  PID:8932
- C:\Windows\System\NjIKgNo.exe
  C:\Windows\System\NjIKgNo.exe
  2⤵
  PID:9172
- C:\Windows\System\CNDajTc.exe
  C:\Windows\System\CNDajTc.exe
  2⤵
  PID:8228
- C:\Windows\System\pYolHZD.exe
  C:\Windows\System\pYolHZD.exe
  2⤵
  PID:8512
- C:\Windows\System\nKZdtDl.exe
  C:\Windows\System\nKZdtDl.exe
  2⤵
  PID:8740
- C:\Windows\System\oXgJXOb.exe
  C:\Windows\System\oXgJXOb.exe
  2⤵
  PID:8688
- C:\Windows\System\icvcUpa.exe
  C:\Windows\System\icvcUpa.exe
  2⤵
  PID:9228
- C:\Windows\System\AnQIYio.exe
  C:\Windows\System\AnQIYio.exe
  2⤵
  PID:9244
- C:\Windows\System\nIoltZu.exe
  C:\Windows\System\nIoltZu.exe
  2⤵
  PID:9260
- C:\Windows\System\yXXByBl.exe
  C:\Windows\System\yXXByBl.exe
  2⤵
  PID:9276
- C:\Windows\System\ShmpAeq.exe
  C:\Windows\System\ShmpAeq.exe
  2⤵
  PID:9292
- C:\Windows\System\bHFByVu.exe
  C:\Windows\System\bHFByVu.exe
  2⤵
  PID:9308
- C:\Windows\System\wfDxgfP.exe
  C:\Windows\System\wfDxgfP.exe
  2⤵
  PID:9324
- C:\Windows\System\vAJpIHh.exe
  C:\Windows\System\vAJpIHh.exe
  2⤵
  PID:9340
- C:\Windows\System\niXbAlh.exe
  C:\Windows\System\niXbAlh.exe
  2⤵
  PID:9356
- C:\Windows\System\jqQEByn.exe
  C:\Windows\System\jqQEByn.exe
  2⤵
  PID:9372
- C:\Windows\System\oFHPBvJ.exe
  C:\Windows\System\oFHPBvJ.exe
  2⤵
  PID:9388
- C:\Windows\System\BrigNeQ.exe
  C:\Windows\System\BrigNeQ.exe
  2⤵
  PID:9404
- C:\Windows\System\QrkvtMQ.exe
  C:\Windows\System\QrkvtMQ.exe
  2⤵
  PID:9420
- C:\Windows\System\DXhpdVV.exe
  C:\Windows\System\DXhpdVV.exe
  2⤵
  PID:9436
- C:\Windows\System\VsMCzYy.exe
  C:\Windows\System\VsMCzYy.exe
  2⤵
  PID:9452
- C:\Windows\System\PgXQCFm.exe
  C:\Windows\System\PgXQCFm.exe
  2⤵
  PID:9468
- C:\Windows\System\RYIWaWy.exe
  C:\Windows\System\RYIWaWy.exe
  2⤵
  PID:9484
- C:\Windows\System\rTJTLTj.exe
  C:\Windows\System\rTJTLTj.exe
  2⤵
  PID:9500
- C:\Windows\System\PKOArEh.exe
  C:\Windows\System\PKOArEh.exe
  2⤵
  PID:9516
- C:\Windows\System\nCuYDbh.exe
  C:\Windows\System\nCuYDbh.exe
  2⤵
  PID:9532
- C:\Windows\System\uSCzmuH.exe
  C:\Windows\System\uSCzmuH.exe
  2⤵
  PID:9548
- C:\Windows\System\dMDZvrh.exe
  C:\Windows\System\dMDZvrh.exe
  2⤵
  PID:9564
- C:\Windows\System\Jxezsdc.exe
  C:\Windows\System\Jxezsdc.exe
  2⤵
  PID:9580
- C:\Windows\System\izJNWgh.exe
  C:\Windows\System\izJNWgh.exe
  2⤵
  PID:9596
- C:\Windows\System\BoTguMd.exe
  C:\Windows\System\BoTguMd.exe
  2⤵
  PID:9612
- C:\Windows\System\rQyMUaG.exe
  C:\Windows\System\rQyMUaG.exe
  2⤵
  PID:9628
- C:\Windows\System\hseYsNO.exe
  C:\Windows\System\hseYsNO.exe
  2⤵
  PID:9644
- C:\Windows\System\EeahPhB.exe
  C:\Windows\System\EeahPhB.exe
  2⤵
  PID:9660
- C:\Windows\System\UWKyAQs.exe
  C:\Windows\System\UWKyAQs.exe
  2⤵
  PID:9676
- C:\Windows\System\EgonSHu.exe
  C:\Windows\System\EgonSHu.exe
  2⤵
  PID:9692
- C:\Windows\System\esztqjV.exe
  C:\Windows\System\esztqjV.exe
  2⤵
  PID:9708
- C:\Windows\System\RoRRLRO.exe
  C:\Windows\System\RoRRLRO.exe
  2⤵
  PID:9724
- C:\Windows\System\MdnaZtQ.exe
  C:\Windows\System\MdnaZtQ.exe
  2⤵
  PID:9740
- C:\Windows\System\DGZJjkt.exe
  C:\Windows\System\DGZJjkt.exe
  2⤵
  PID:9756
- C:\Windows\System\jkMoMIH.exe
  C:\Windows\System\jkMoMIH.exe
  2⤵
  PID:9772
- C:\Windows\System\ErmScMs.exe
  C:\Windows\System\ErmScMs.exe
  2⤵
  PID:9788
- C:\Windows\System\DmjHQoa.exe
  C:\Windows\System\DmjHQoa.exe
  2⤵
  PID:9804
- C:\Windows\System\BYYVbic.exe
  C:\Windows\System\BYYVbic.exe
  2⤵
  PID:9820
- C:\Windows\System\aLkuFHW.exe
  C:\Windows\System\aLkuFHW.exe
  2⤵
  PID:9836
- C:\Windows\System\BWvyXdn.exe
  C:\Windows\System\BWvyXdn.exe
  2⤵
  PID:9852
- C:\Windows\System\sDnjigH.exe
  C:\Windows\System\sDnjigH.exe
  2⤵
  PID:9868
- C:\Windows\System\csVzrgr.exe
  C:\Windows\System\csVzrgr.exe
  2⤵
  PID:9884
- C:\Windows\System\MeUORAC.exe
  C:\Windows\System\MeUORAC.exe
  2⤵
  PID:9900
- C:\Windows\System\bpuKHlw.exe
  C:\Windows\System\bpuKHlw.exe
  2⤵
  PID:9916
- C:\Windows\System\vgElAeW.exe
  C:\Windows\System\vgElAeW.exe
  2⤵
  PID:9932
- C:\Windows\System\AUBSEdQ.exe
  C:\Windows\System\AUBSEdQ.exe
  2⤵
  PID:9948
- C:\Windows\System\CcTZQXT.exe
  C:\Windows\System\CcTZQXT.exe
  2⤵
  PID:9968
- C:\Windows\System\RMOdKUQ.exe
  C:\Windows\System\RMOdKUQ.exe
  2⤵
  PID:9984
- C:\Windows\System\FDUfHab.exe
  C:\Windows\System\FDUfHab.exe
  2⤵
  PID:10000
- C:\Windows\System\WySuBVo.exe
  C:\Windows\System\WySuBVo.exe
  2⤵
  PID:10016
- C:\Windows\System\JANqaCh.exe
  C:\Windows\System\JANqaCh.exe
  2⤵
  PID:10032
- C:\Windows\System\FOclbXX.exe
  C:\Windows\System\FOclbXX.exe
  2⤵
  PID:10048
- C:\Windows\System\iBqIsbE.exe
  C:\Windows\System\iBqIsbE.exe
  2⤵
  PID:10064
- C:\Windows\System\AVZrSOG.exe
  C:\Windows\System\AVZrSOG.exe
  2⤵
  PID:10080
- C:\Windows\System\KicmzIB.exe
  C:\Windows\System\KicmzIB.exe
  2⤵
  PID:10096
- C:\Windows\System\bcLKmqn.exe
  C:\Windows\System\bcLKmqn.exe
  2⤵
  PID:10112
- C:\Windows\System\MbgmJGk.exe
  C:\Windows\System\MbgmJGk.exe
  2⤵
  PID:10128
- C:\Windows\System\IJUzoLP.exe
  C:\Windows\System\IJUzoLP.exe
  2⤵
  PID:10144
- C:\Windows\System\ToJYQTR.exe
  C:\Windows\System\ToJYQTR.exe
  2⤵
  PID:10160
- C:\Windows\System\FewSbQP.exe
  C:\Windows\System\FewSbQP.exe
  2⤵
  PID:10176
- C:\Windows\System\NBVAsFB.exe
  C:\Windows\System\NBVAsFB.exe
  2⤵
  PID:10192
- C:\Windows\System\wBNtmtK.exe
  C:\Windows\System\wBNtmtK.exe
  2⤵
  PID:10208
- C:\Windows\System\JexKtVy.exe
  C:\Windows\System\JexKtVy.exe
  2⤵
  PID:10224
- C:\Windows\System\rqebJgR.exe
  C:\Windows\System\rqebJgR.exe
  2⤵
  PID:9220
- C:\Windows\System\qggCraL.exe
  C:\Windows\System\qggCraL.exe
  2⤵
  PID:9284
- C:\Windows\System\HVfrMEw.exe
  C:\Windows\System\HVfrMEw.exe
  2⤵
  PID:9316
- C:\Windows\System\uKsgPlJ.exe
  C:\Windows\System\uKsgPlJ.exe
  2⤵
  PID:9188
- C:\Windows\System\tHKjSlA.exe
  C:\Windows\System\tHKjSlA.exe
  2⤵
  PID:8224
- C:\Windows\System\HndphUk.exe
  C:\Windows\System\HndphUk.exe
  2⤵
  PID:9032
- C:\Windows\System\kSFsxfl.exe
  C:\Windows\System\kSFsxfl.exe
  2⤵
  PID:8500
- C:\Windows\System\NxHPEBQ.exe
  C:\Windows\System\NxHPEBQ.exe
  2⤵
  PID:8632
- C:\Windows\System\cioMfNw.exe
  C:\Windows\System\cioMfNw.exe
  2⤵
  PID:6356
- C:\Windows\System\dQmbCCs.exe
  C:\Windows\System\dQmbCCs.exe
  2⤵
  PID:8888
- C:\Windows\System\Kkecjeq.exe
  C:\Windows\System\Kkecjeq.exe
  2⤵
  PID:9268
- C:\Windows\System\aYkbnlq.exe
  C:\Windows\System\aYkbnlq.exe
  2⤵
  PID:9304
- C:\Windows\System\DuyXsTk.exe
  C:\Windows\System\DuyXsTk.exe
  2⤵
  PID:9368
- C:\Windows\System\fufICAr.exe
  C:\Windows\System\fufICAr.exe
  2⤵
  PID:9476
- C:\Windows\System\DfkrpdW.exe
  C:\Windows\System\DfkrpdW.exe
  2⤵
  PID:9060
- C:\Windows\System\UyTGxzy.exe
  C:\Windows\System\UyTGxzy.exe
  2⤵
  PID:9236
- C:\Windows\System\DPnHehj.exe
  C:\Windows\System\DPnHehj.exe
  2⤵
  PID:9512
- C:\Windows\System\fzoEjNW.exe
  C:\Windows\System\fzoEjNW.exe
  2⤵
  PID:9576
- C:\Windows\System\dnLsfln.exe
  C:\Windows\System\dnLsfln.exe
  2⤵
  PID:9428
- C:\Windows\System\AKKhbss.exe
  C:\Windows\System\AKKhbss.exe
  2⤵
  PID:9672
- C:\Windows\System\oAEVFoD.exe
  C:\Windows\System\oAEVFoD.exe
  2⤵
  PID:9432
- C:\Windows\System\UBfEkrI.exe
  C:\Windows\System\UBfEkrI.exe
  2⤵
  PID:9620
- C:\Windows\System\himktHX.exe
  C:\Windows\System\himktHX.exe
  2⤵
  PID:9624
- C:\Windows\System\qtPvybM.exe
  C:\Windows\System\qtPvybM.exe
  2⤵
  PID:9748
- C:\Windows\System\UURbmsa.exe
  C:\Windows\System\UURbmsa.exe
  2⤵
  PID:9812
- C:\Windows\System\iXGYgEo.exe
  C:\Windows\System\iXGYgEo.exe
  2⤵
  PID:9780
- C:\Windows\System\FyYGyCW.exe
  C:\Windows\System\FyYGyCW.exe
  2⤵
  PID:9896
- C:\Windows\System\IIatgTh.exe
  C:\Windows\System\IIatgTh.exe
  2⤵
  PID:9880
- C:\Windows\System\TjIjfqz.exe
  C:\Windows\System\TjIjfqz.exe
  2⤵
  PID:9964
- C:\Windows\System\tXphcwP.exe
  C:\Windows\System\tXphcwP.exe
  2⤵
  PID:9908
- C:\Windows\System\HzvxNWs.exe
  C:\Windows\System\HzvxNWs.exe
  2⤵
  PID:9980
- C:\Windows\System\djLLwWz.exe
  C:\Windows\System\djLLwWz.exe
  2⤵
  PID:10040
- C:\Windows\System\UyWnueb.exe
  C:\Windows\System\UyWnueb.exe
  2⤵
  PID:10088
- C:\Windows\System\iQXZSPR.exe
  C:\Windows\System\iQXZSPR.exe
  2⤵
  PID:10124
- C:\Windows\System\xBoeHEe.exe
  C:\Windows\System\xBoeHEe.exe
  2⤵
  PID:10072
- C:\Windows\System\lrVsdqX.exe
  C:\Windows\System\lrVsdqX.exe
  2⤵
  PID:10136
- C:\Windows\System\oPxcysI.exe
  C:\Windows\System\oPxcysI.exe
  2⤵
  PID:10200
- C:\Windows\System\QkgjuOM.exe
  C:\Windows\System\QkgjuOM.exe
  2⤵
  PID:9252
- C:\Windows\System\EHwdpFI.exe
  C:\Windows\System\EHwdpFI.exe
  2⤵
  PID:9412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\EIeRYmi.exe

Filesize
2.2MB

MD5
b539e04b1cda3b4e818f9e4263446b2f

SHA1
035e01effe3098b8ef66dbec9a3aa087bf2b6fa2

SHA256
eea80114c8d57b683df248cba0c9475feeec5cf75612c53cc21a5c361098eaf8

SHA512
1af05fc1e690060aa6e90e7177e1e737510d101ae8597987e6d261c507f8ba354691d8772bb010dff5ebac96416aee9ee2aa53c2f6c9b53cf636c3ecac950e04

Download Submit
C:\Windows\system\EiNysDr.exe

Filesize
2.2MB

MD5
ca2497cdab0b225d37038f57050f62b6

SHA1
8e30e04e15d1f6ab0b5aaa2515e2e57b22890e42

SHA256
e010f018295348f2a8a3ef6ae8664f0eba94f4e87aa7fb0bed827cd98d3e582f

SHA512
57261446d01660d4a25b65b9652e54f08e7492ba2b0212a8e995baa935f4b15f744f37d8207ca8c4883907cf95df855aa666f8bd7bbf5ad4e51dab279e8ef64d

Download Submit
C:\Windows\system\IzLnGcP.exe

Filesize
2.2MB

MD5
ac54af056214a3e582cf3646b4c8166b

SHA1
2b0e3cceb77e2c702a53e64b64d1ef2f84a13d45

SHA256
21b9fd2876837724feade9fec673ea7b34e352c266e6b756b025ea2241dee8d0

SHA512
f7627a7be2cfd41a4c510f113234ff9e8b8c5c477912913957a7bfe0f2e723dfb5791cb3745ccd5747f5d1f907edd464abe243f0f97665936ef69267aace10e6

Download Submit
C:\Windows\system\LloYwUp.exe

Filesize
2.2MB

MD5
9dbeb48382f65aee19b775e45a527163

SHA1
875338648b19b0d2fdad52c5e9c28b075886016b

SHA256
50e1fedcc62f8cfb0be4874afd3204b01ded7aaa09d14a0100f8a412a24420a7

SHA512
efe1affe9d4d1221096136a5f4e4d6c9b77d254aa3ad37bf260720f630d8cc022690d0068b252e736092748cf160b84de5409316edd922042074b6e798762767

Download Submit
C:\Windows\system\MlTqyBq.exe

Filesize
2.2MB

MD5
91aded235f8c6ed1723fa8f77600b36c

SHA1
e68623da188bcdbe394fc47d63b1632bd653512b

SHA256
2347815668d3889c2a2450b3ada1c90c80fe7bfe01027ad709ce239bb81f5715

SHA512
4dc38ad508a053e0f61955810527861db44380c1e83ac922204957777aaeab577f77f6bbc6a150e74856abeaf88ed40cd1c098d1833b91570f8122a1b1c8a170

Download Submit
C:\Windows\system\PHTmmKt.exe

Filesize
2.2MB

MD5
c36aefbabab104d78dfcc85a7e019c08

SHA1
7c733417da732119000411296badd4b36f9f5bab

SHA256
4bc20581a8fc7350581433f351a2ea813c89354439973123e5bf6b864070f362

SHA512
952fe8e13fdede8c75c38a6b1121484b3a10ff58a1540cc5dadf1598ed7f6309d4e4eb2bfb8719d41fbab2c818a69670f5f63ec0ccd78e2c12a92660cec56cb3

Download Submit
C:\Windows\system\RBahXVj.exe

Filesize
2.2MB

MD5
4e6866f775da71c6b9c784191e8c0c80

SHA1
b2bbb2e90c07e4fb958d8ce5e4e6165a8fe0a792

SHA256
e96b18de5513cc3ac19af5b2f9c91333925c50ac1e99f05d58a117fb1b294924

SHA512
f23942141c05434e40767fed8961ecb2aedc564eb9881418e47b0b237ffaabc1a60b4d830bd2a954be96ac45a6a0c8df7be0c1705ba33091483c5e0f16c77aad

Download Submit
C:\Windows\system\RirjrkT.exe

Filesize
2.2MB

MD5
831dbadb7a64e00015859a3707e14df1

SHA1
a22b7f5ef4db04da3c708ed6e0d5af3b2f19c47f

SHA256
327183b64871f27664f98b42c2901f944b4a05a518d29edbb8eed5a394c5405b

SHA512
24573f1e9bc7782263509a0e8eacb70f527048e25b2791995a3805282754a400fc959d650cab1f5940e095cfb3b2547115aa11c3196edc3484e75aefc2a9499d

Download Submit
C:\Windows\system\TbDozEe.exe

Filesize
2.2MB

MD5
655e9bfa53026af1b426a04a86e2c189

SHA1
86275c7d3228efac37bfab53aaca37c66439a848

SHA256
bfb6705c161776e5168778f17fa8730f1c6ff6c478dfd485c3305c148a3045e7

SHA512
0992cd614066d8aa793647bc7fdbbecbf9ca0c528193c7a407b7a87b9a3120cef1cdb3a78185204329a0df47960bb491805acccc38e2f82162a024e33151f177

Download Submit
C:\Windows\system\TtIcPpF.exe

Filesize
2.2MB

MD5
a4f4ad5ac80ae3eba75b3d7d71acdbec

SHA1
100f67260ee5ef8a50869332a86905dd79698766

SHA256
4efdfd191357e44d369ba31bf88b7981f0b2205f5927823f11f218feb62cbfd5

SHA512
84ded5f40999d6ba4190c0523099aee2187be37dad77e9264ab9ab5a6f408faff418e7373e6c119fb47954681e641e27c87d2dac112d0ced118170675a1676df

Download Submit
C:\Windows\system\VIVyUvf.exe

Filesize
2.2MB

MD5
98100dfb861f5fb6f41a2737553f9967

SHA1
b45e1dce2a2f4d6816380f5bfb51caffcf952f14

SHA256
3eed9994914336a79b29af73c4cfc7ac8905ba58d98037e1ff9f187b3df6a01a

SHA512
006a8a30e8af09a9f65f910d7ccc2f74417d41d099bb019bbcf854a670f6f5ece856eb7c31f6c9a7293b7bd2630d3c3dcc31727151847d25e3cb7c0a60bfd299

Download Submit
C:\Windows\system\WuqOQzQ.exe

Filesize
2.2MB

MD5
d2d04612a986ba97905c9aafbc5a0bf5

SHA1
e2e198895a2c432ca81cf3bebaa70b144ae67179

SHA256
76998eaf1404b0dc80ab3ef4b78d60a85fa4afcf223d44c4cdf399d8e40a885f

SHA512
701aca95f4df6ee14a97292f1ecf245538372930df87b6c80569cfa772237573261c2ec59926e1d13030515d8dd1751d9d96da4fec66d65e5717bdc01799adab

Download Submit
C:\Windows\system\XbfCkON.exe

Filesize
2.2MB

MD5
d26baf7688aca568a5a38396264efc40

SHA1
33a7f12136aa9765791fd420dc7f2929845abf4a

SHA256
633fbba0521296cb68d82b3a5132daf7c391f82ed79b58c7f01ee26017b22416

SHA512
872ce04b8ebd638e1b70bf7b673a9f47fd3673541598b3c6411c7c20795bf329d8133e80d7ce27331939990ff78b90d79df15b77c18bcf6c545294636cbd57d4

Download Submit
C:\Windows\system\XtFQiFI.exe

Filesize
2.2MB

MD5
78b753323ed9a330d70a590472be4222

SHA1
fb5648f2e098a109ed5d1914f8d8b968174ef8ab

SHA256
cceaff263a8108e3b69aad78d8bf6e6232ad85625d66d97c17ebcd2a94620150

SHA512
04e562dba26d26f7dd2f6ba6ced83644801cfb3c2c0ef206782d24c6161b7faa92f3a71e9afa22487e2058ab07d4f2dc516c72db746b38d04f5e41eead5c2e9d

Download Submit
C:\Windows\system\YLyUGvF.exe

Filesize
2.2MB

MD5
caf6c636c95e693822013cdf010de03f

SHA1
49becc29662a5549b46dc549585f5c741a8472e3

SHA256
3c2c8b6348db94b99feaa2c5514c9fbe5d46e60c25111040f7d41e6e3bbc5362

SHA512
a046c653152ff2b9964402d8f1ef62d5e88278341981f4cd702bcc41b1f21b955d729115b7a6e700058d6ff6d01de731d5efd7edeef27f2e778630decbc219ae

Download Submit
C:\Windows\system\YgskrfO.exe

Filesize
2.2MB

MD5
c18c9993eb5eea5f26be44728fb884c6

SHA1
0f12aa304dac99e1d393405c9c7ad964fd47b641

SHA256
46183507ede0147ef3f74288267c602c00dd321123a5cba2bc9c80d5c0adffcb

SHA512
b410d8469a55135939fdaf6ad6258a85548320a1a40987ee611b0d2f28bfd4a9f3324abbf27bff779c5adcfd0297d9663c930ad76e0d672291fb4c0ed8384588

Download Submit
C:\Windows\system\cUbFhsk.exe

Filesize
2.2MB

MD5
8a8d5de287a897e32f9dbffd08b14c3a

SHA1
41c7c76e90ed33bf76cf9725ac05a5eb79b6f3e6

SHA256
396d7ce411ba83cf3a61af79ec00f30b4bbb9c7cf688b42755a6131552499d2c

SHA512
c9aa95cd205fefaac4ac40f36f7c2f0016fdd0376ef524986e2dcc1d405c0e175b1e1f4d209b20c03b781880f7f57e1cbf201d1f3249a28af5f92cc3ad4bdc32

Download Submit
C:\Windows\system\flwlBpN.exe

Filesize
2.2MB

MD5
48548f6a35ccffeab2ff7fcbd2a01ffa

SHA1
ed1398e4cc61fd54a01ad26dbd078aad336d5f59

SHA256
d0df1e0499a4b16207e656848beed78a0f0b9873294eea5f238579df63eefd39

SHA512
ac89c8d739d76db94957dc69c1516f77875787af13150c552f0a37ab5d07ed1e7368035755eddd347430ed9aca48d8b60bb6e01e847f7501ac8905f003a740f2

Download Submit
C:\Windows\system\mBSYqWr.exe

Filesize
2.2MB

MD5
743104bd62cb1ec0c303c65ad08e50b1

SHA1
a18790a0d27ba0146c4e330f4948214ddfdbbf82

SHA256
4041c702e6ce8c551a2a99f46cada15979efa14574d0568267412ff2617b376f

SHA512
2d1a73149a3c8914eada77166b51fc1b96106b84b1405f49c46fe1ec67759bb978f549d560ace099bffb55899a07aa59a3a7c5d9d8a04bce9819619da0926f39

Download Submit
C:\Windows\system\oeDklej.exe

Filesize
2.2MB

MD5
a259683e7d3f52924f4596653581270f

SHA1
a59adc0f5dd1047c44ef3653e288ff81509ec23a

SHA256
eec00cef27a73c8b1688e2858691e74af66185a6a96f350cb0c9a5a73773c103

SHA512
63b39a540777589888848acb018c7517ed2c9bb7d227317a69ca17a84bc878d0761dce804f0ba2d3c767dd25f3a7ef0d2348c354b2fe99316fc23a708df5135f

Download Submit
C:\Windows\system\qYWSZuR.exe

Filesize
2.2MB

MD5
204716be267a292db55641b85294058f

SHA1
a476b7c690148db6f8098e0b65d37b0dead56d87

SHA256
1e81521fd7bc11107ae267c594c9f7b7f98c684c1975218e5706c7ce34a3181a

SHA512
1f4838385ac5a0dcb1e8b7eceb2685c66233068a3dc683a8a56906a94cca2359d9319b47b41dd45ce27c697a8be87b93fa75edfce5a91f11117f3eb0cbec4bba

Download Submit
C:\Windows\system\qnOelHP.exe

Filesize
2.2MB

MD5
8a72d13bf4aab7c2e951729a4022c346

SHA1
f6fb804281ce1e1e66342af9bac89fd0caa70401

SHA256
dd93167607c50b4ea78146c486717a4299d3f5aa2fbd2283ce010e703d33be93

SHA512
2b2071418ce63b63b90d05a653f95a3b4d9290d52ee2a2d2aff2209eddeb883193810c6564303896f2f6a480739f88c1f901ee8c34a29b8a8c825ede18f0239a

Download Submit
C:\Windows\system\sWvWhvr.exe

Filesize
2.2MB

MD5
fdfbe80fd4c3391c7beef3c31c6c3193

SHA1
5e6b6a765647d8e500cf9a600a72a90868b52704

SHA256
03ff98ec89e73c9d7ac749d618c9f533f189bc34664656b1fc6f2a23e0a2b3ab

SHA512
aa83e13d7b251ea39a23711c1e3972d96bc13fee82960231100a9fa6deade3cba7a8c32a12c308f41b7874aceac6283eb87eabd632cdccf8a62244c62530a4c8

Download Submit
C:\Windows\system\yAGRtlg.exe

Filesize
2.2MB

MD5
0329114576c2cf6729a977789b7a3e71

SHA1
256b0cb0276ddf42af2cfceb31cc203d6ceac432

SHA256
5aa33ae1a4383e10a9b3adc6ae7096ebfbd93614b8a3b332f6b4a31587182130

SHA512
960eaaab23fd68de63d941e98cd4eafdf9fca207a952c7278d5411a2d5d8e154f86262df9b3f91d3880e9a4e8e9dcdd775ad30191b39cd7549c8b062ec25bfa7

Download Submit
C:\Windows\system\zVziDxz.exe

Filesize
2.2MB

MD5
fe2bff6bbb37016b689a09618898d0ef

SHA1
4b8b08ec711e1fc274682157c6cf2feb0369d43b

SHA256
75c64144fdd0ff132ca209d6c07d09452ecb13d20807726001b839711834af88

SHA512
a6a55e3fc1a4b6e7c47a038b4dffe5a83f978247e3f677c4e2fcbeb9e7d56e4bb701d5501ca18a57a1e330ab7c02b846dbd3c8404a3e4b74a0e20f7225b72e36

Download Submit
C:\Windows\system\zvDstbb.exe

Filesize
2.2MB

MD5
1b24c42899690fddf9708ea179fe5877

SHA1
02fc87423fb74a5f4b411bbbc23e24a62c5c5764

SHA256
d60f87d10b62948f2f99491399b570bf25a63d7f39b714f6f30230539bb3477d

SHA512
a7e49cefe7a14a7472f2e9fb3844d021c6edb38056fb9ab1ceea409445e562d94a64265c67fc7e4e5b9ecad167529dfe53371e3355591dff282eddd7b75cb1e5

Download Submit
\Windows\system\BnlJklF.exe

Filesize
2.2MB

MD5
c17ba726a741cadb034c062ab53a07ed

SHA1
b23a86bd348acaab00cd2617ea6b94a14c0e65e5

SHA256
15eb5381c38d22c4e29950c770d6ff636a76e8d9e791b7856908ee152742aacb

SHA512
c38170cdba76cd7657abaada7658b983f9c78a8aaf0763864dc4c1866f55e49472205f6921ee74784c76fe9ae6ae8e4f44647d2e10c2aa2655fe4611b3a41812

Download Submit
\Windows\system\CEzCSoI.exe

Filesize
2.2MB

MD5
d19eb1b10985b39a776bc7996a81ed4e

SHA1
06b6d4a43a45d1abb13ba03f3513fa3169157a1d

SHA256
bc87df19165a96014f7da10c2f01a29fb3199b975aeafda02be10e8fffb1f93f

SHA512
555b42ae534ab5a16e4c5b7b153368975b8552c436fd952e45b86b7b22230cc874e7b3f076ef9baed8f2a4280040b5f4653274f7a12ad994762e2cd862d85b93

Download Submit
\Windows\system\MAPybAs.exe

Filesize
2.2MB

MD5
9f22d3ec878a5baca5c0d77307c6ac81

SHA1
7318b7350056f4b5f218aa7013d0a0ac9410464e

SHA256
3cfdc071713130dbfeb7cd9ce36339cbd088541dc5451e891e50147bcc22a981

SHA512
15f642658225a19e3fa02b62da1a086ef28861d4df17a820410f109a5c941e03730a402dd1993eb30660e1180aee68d2ec2ea02775dabcaee46dc906cd358862

Download Submit
\Windows\system\TzGnUhb.exe

Filesize
2.2MB

MD5
50f58f16d389029330d96bc1e974237d

SHA1
d4ac91d585c6f0a3adf30ef6f40a3107c8f0f509

SHA256
4ee317fe38aa8baa113246fc4ec9832b60052953edd7482573812fbecb4e3a67

SHA512
540c8d25d390d0b2f7a9bcd3c3d807d1c1b2383180147a7aacd84f5b795482415d7d032b3441c9c2344deefe99855f340e69bfef2f4352100faf47f542eb9ce9

Download Submit
\Windows\system\bpvikSG.exe

Filesize
2.2MB

MD5
84cf07b8e5be9283d4df83191224fac0

SHA1
a4c9bb5114ebcf31f20f096467dad95ca245f1d3

SHA256
4468a0dc33c6b490c15a219be6718bddb37b9305a604d8bcca45a8c8f6a2c892

SHA512
66126c53fab7ad74ffa39f58285b3642ac048cd9f3613625ae6dd96c408447644eafaabc89df80805b53735459726f5e8fc0e71b5724a25af52ecb2e97a98de0

Download Submit
\Windows\system\fDtsCTi.exe

Filesize
2.2MB

MD5
5ad565912f8a6934acf5dcd45c03fcd6

SHA1
d9ee5a38167f46e76e136e0e0c9627bb39a495ca

SHA256
6d8aae42ee6b29b45ca495e2121e591c1111c364f1a29bac8152c5b9346b3db3

SHA512
fbd545be02cb5b1a860005f0dc821f015ad9dfa943fda0fd7539801c6e21b36b5a3e0def892dffdfd38fda5e052a7911b1cf80d1ff14d2e7c68fd0129612cb0d

Download Submit
memory/2028-1035-0x0000000002810000-0x0000000002818000-memory.dmp

Filesize
32KB

Download
memory/2028-1006-0x000000001B7A0000-0x000000001BA82000-memory.dmp

Filesize
2.9MB

Download
memory/2248-98-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-81-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2248-70-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-76-0x000000013FCF0000-0x00000001400E2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-96-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-0-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/2248-82-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2248-80-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-22-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-60-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-75-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-74-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/2248-84-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/2248-83-0x00000000025B0000-0x00000000029A2000-memory.dmp

Filesize
3.9MB

Download
memory/2464-94-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2556-66-0x000000013FA10000-0x000000013FE02000-memory.dmp

Filesize
3.9MB

Download
memory/2608-77-0x000000013FCB0000-0x00000001400A2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-97-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2668-88-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2684-93-0x000000013FBA0000-0x000000013FF92000-memory.dmp

Filesize
3.9MB

Download
memory/2736-99-0x000000013F8D0000-0x000000013FCC2000-memory.dmp

Filesize
3.9MB

Download
memory/2744-78-0x000000013F310000-0x000000013F702000-memory.dmp

Filesize
3.9MB

Download
memory/2896-79-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download