xmrig | 04914b15e840ee4af1d91ecaea3fc2b319d8d3fdde40be1d8732e47c8dfc8788

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
Size

2.2MB
MD5

0f21db21b0093fc38e6219d7ffdeafb7
SHA1

b0d00708a4c7a0d1f4db148087f45e8a148ccf13
SHA256

04914b15e840ee4af1d91ecaea3fc2b319d8d3fdde40be1d8732e47c8dfc8788
SHA512

8d19d23f54768e6f9364ecc80645e94f43672a323c65d8ef8f28e79729ab38a13ba317825d4b5aabb662eb3cbcb8f26394c5f21cd0add9e993768884d0706d11
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfT:NABu

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 22 IoCs

miner

resource	yara_rule
behavioral1/memory/1908-495-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/1908-107-0x000000013F7C0000-0x000000013FBB2000-memory.dmp	xmrig
behavioral1/memory/2460-71-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2448-70-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2596-67-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2848-66-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2600-105-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2420-43-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2700-29-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2868-23-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2636-12-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2868-2957-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2816-2931-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2848-3144-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2420-3141-0x000000013FA90000-0x000000013FE82000-memory.dmp	xmrig
behavioral1/memory/2460-2930-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	xmrig
behavioral1/memory/2700-2953-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/2448-2909-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2636-2911-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/880-2910-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2600-3143-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2596-4002-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2480	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2636	QxNNKBW.exe
2600	iDPMkgP.exe
2868	pBgwhAp.exe
2700	zZQHwdr.exe
2420	HaEedLz.exe
2448	fLdwONB.exe
2848	zBWezVL.exe
2596	hrRvOjR.exe
2460	VuQThtQ.exe
880	viPApKv.exe
2816	npEecqC.exe
1956	XLbwNOB.exe
2464	ZgskWJJ.exe
852	IotKRCj.exe
1020	xchtbMm.exe
1816	ZCvmJiy.exe
1988	iBuOOkK.exe
2672	xVrAAHA.exe
1240	cCfhDjp.exe
1976	kRHRdJz.exe
2332	AcOmYfz.exe
2336	VqQETrb.exe
936	QxcXToD.exe
1028	VXRVvVP.exe
1652	OPOlLDN.exe
2904	zFZUUle.exe
2432	morgRNv.exe
2140	XldVmSP.exe
2960	VuJllwL.exe
1712	wMxUWUD.exe
3064	NLHWrDc.exe
1424	kKGvFsk.exe
2020	PHWKUAI.exe
1080	nxhDxTR.exe
1780	qkkYXUl.exe
1156	zeHDonC.exe
1552	VSsweZN.exe
884	ZVXJIBX.exe
2972	QYRlebS.exe
1504	jPOBuDK.exe
1236	hQSYEFV.exe
1300	VmnbdIg.exe
2044	Siyxmji.exe
2300	sDJwDYj.exe
2344	cfNgLHf.exe
2352	oaolrbI.exe
580	qaLFTgT.exe
2908	mVRdYSN.exe
944	UTeuuAW.exe
1760	DbXlUhx.exe
2952	zRQXpfi.exe
756	VwuTtSF.exe
2772	GxdCPYE.exe
1340	duGYeSt.exe
2312	QOCuNaP.exe
2872	DtBspvc.exe
1608	gHGNhsa.exe
2536	qiACeXy.exe
2548	uErCOfI.exe
1724	yVNcsHB.exe
1744	LJSoBNA.exe
1052	WfthXEG.exe
2512	oPghkrq.exe
1812	BsuxbBZ.exe

Loads dropped DLL 64 IoCs

pid	Process
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000194d6-176.dat	upx
behavioral1/memory/1908-495-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x00040000000194dc-186.dat	upx
behavioral1/files/0x00040000000194d8-180.dat	upx
behavioral1/files/0x0005000000019485-166.dat	upx
behavioral1/files/0x00050000000194a4-170.dat	upx
behavioral1/files/0x000500000001946f-156.dat	upx
behavioral1/files/0x0005000000019410-143.dat	upx
behavioral1/files/0x0005000000019473-161.dat	upx
behavioral1/files/0x0005000000019368-134.dat	upx
behavioral1/files/0x000500000001939b-131.dat	upx
behavioral1/files/0x000500000001931b-125.dat	upx
behavioral1/files/0x000500000001946b-149.dat	upx
behavioral1/files/0x0006000000018ba2-112.dat	upx
behavioral1/files/0x00050000000193b0-138.dat	upx
behavioral1/files/0x0006000000018d06-99.dat	upx
behavioral1/files/0x00050000000192c9-96.dat	upx
behavioral1/files/0x0006000000018b96-90.dat	upx
behavioral1/memory/2816-86-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/files/0x0006000000018b73-80.dat	upx
behavioral1/files/0x0005000000019377-128.dat	upx
behavioral1/files/0x0005000000019333-116.dat	upx
behavioral1/memory/2460-71-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2448-70-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2596-67-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2848-66-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2600-105-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x00050000000192f4-104.dat	upx
behavioral1/files/0x0006000000018b42-60.dat	upx
behavioral1/memory/880-78-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/files/0x0006000000018b6a-75.dat	upx
behavioral1/files/0x0016000000015db4-74.dat	upx
behavioral1/files/0x000f0000000006fd-58.dat	upx
behavioral1/files/0x0006000000018b4a-57.dat	upx
behavioral1/files/0x0008000000016c23-50.dat	upx
behavioral1/memory/2420-43-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2700-29-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x0007000000015e6f-26.dat	upx
behavioral1/files/0x0007000000015e7c-37.dat	upx
behavioral1/memory/2868-23-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2636-12-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2600-22-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0027000000015d88-17.dat	upx
behavioral1/files/0x0008000000015e5b-16.dat	upx
behavioral1/files/0x0009000000015c5d-6.dat	upx
behavioral1/memory/1908-0-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/memory/2868-2957-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2816-2931-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2848-3144-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2420-3141-0x000000013FA90000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/2460-2930-0x000000013F3F0000-0x000000013F7E2000-memory.dmp	upx
behavioral1/memory/2700-2953-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/memory/2448-2909-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2636-2911-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/880-2910-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2600-3143-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2596-4002-0x000000013F710000-0x000000013FB02000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\DtBspvc.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\fGgapIL.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\OkVXOdN.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\huEcCnl.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\Ellkgxj.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\LZqUoTy.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ntWMmGk.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\vOWLiMa.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ujSyDaY.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\MhzDrUJ.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\oUjjjne.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\YslldKX.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\zykiWFr.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\RCLaKvF.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\Cciryyb.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\MjGHtor.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\bCkEhif.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\BpXpspe.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\mvCqLKT.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\RyyQNdu.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\evMtInQ.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\fHBEATN.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\LBadCEH.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\QYluKDX.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\NjbXmKb.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\KiIppfj.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\IREJcyS.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\shRSxgj.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\DUrrZMT.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\jerJVKy.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\UdKpsxU.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\zCriKiG.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\TvHHrKl.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\HfDXjek.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\vxnbtgl.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\BEdLlaP.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\Yajtpma.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\pvRNMWw.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ZfBpaYD.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\WfthXEG.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\XQOTPHb.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\SeJhlzv.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\noEsVQl.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\RXELFNq.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ofvypjK.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\XmbZjaW.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\kTbPyPd.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\pRrFLkE.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\BtkdVHG.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\DOByfRq.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ZrxFZSx.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ptkvdzN.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\kNIiCYi.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\PlhbPUG.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\yrampMZ.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\EWEXicC.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ASFHXyf.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\vJHlHUn.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\LtUowNO.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\LoUESIU.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\mVRdYSN.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\XqleVde.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ObmJuQZ.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
File created	C:\Windows\System\ZgskWJJ.exe	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2480	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
Token: SeDebugPrivilege	2480	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2480	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	29
PID 1908 wrote to memory of 2480	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	29
PID 1908 wrote to memory of 2480	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	29
PID 1908 wrote to memory of 2636	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2636	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2636	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	30
PID 1908 wrote to memory of 2868	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	31
PID 1908 wrote to memory of 2868	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	31
PID 1908 wrote to memory of 2868	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	31
PID 1908 wrote to memory of 2600	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	32
PID 1908 wrote to memory of 2600	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	32
PID 1908 wrote to memory of 2600	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	32
PID 1908 wrote to memory of 2700	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	33
PID 1908 wrote to memory of 2700	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	33
PID 1908 wrote to memory of 2700	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	33
PID 1908 wrote to memory of 2420	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	34
PID 1908 wrote to memory of 2420	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	34
PID 1908 wrote to memory of 2420	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	34
PID 1908 wrote to memory of 2596	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	35
PID 1908 wrote to memory of 2596	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	35
PID 1908 wrote to memory of 2596	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	35
PID 1908 wrote to memory of 2448	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	36
PID 1908 wrote to memory of 2448	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	36
PID 1908 wrote to memory of 2448	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	36
PID 1908 wrote to memory of 2460	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	37
PID 1908 wrote to memory of 2460	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	37
PID 1908 wrote to memory of 2460	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	37
PID 1908 wrote to memory of 2848	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	38
PID 1908 wrote to memory of 2848	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	38
PID 1908 wrote to memory of 2848	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	38
PID 1908 wrote to memory of 2816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	39
PID 1908 wrote to memory of 2816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	39
PID 1908 wrote to memory of 2816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	39
PID 1908 wrote to memory of 880	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	40
PID 1908 wrote to memory of 880	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	40
PID 1908 wrote to memory of 880	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	40
PID 1908 wrote to memory of 1020	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	41
PID 1908 wrote to memory of 1020	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	41
PID 1908 wrote to memory of 1020	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	41
PID 1908 wrote to memory of 1956	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	42
PID 1908 wrote to memory of 1956	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	42
PID 1908 wrote to memory of 1956	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	42
PID 1908 wrote to memory of 1816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	43
PID 1908 wrote to memory of 1816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	43
PID 1908 wrote to memory of 1816	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	43
PID 1908 wrote to memory of 2464	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	44
PID 1908 wrote to memory of 2464	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	44
PID 1908 wrote to memory of 2464	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	44
PID 1908 wrote to memory of 2672	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	45
PID 1908 wrote to memory of 2672	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	45
PID 1908 wrote to memory of 2672	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	45
PID 1908 wrote to memory of 852	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	46
PID 1908 wrote to memory of 852	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	46
PID 1908 wrote to memory of 852	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	46
PID 1908 wrote to memory of 1240	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	47
PID 1908 wrote to memory of 1240	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	47
PID 1908 wrote to memory of 1240	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	47
PID 1908 wrote to memory of 1988	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	48
PID 1908 wrote to memory of 1988	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	48
PID 1908 wrote to memory of 1988	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	48
PID 1908 wrote to memory of 2332	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	49
PID 1908 wrote to memory of 2332	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	49
PID 1908 wrote to memory of 2332	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	49
PID 1908 wrote to memory of 1976	1908	0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe	50

C:\Windows\System32\fixmxn.exe
"C:\Windows\System32\fixmxn.exe"
1⤵
PID:1572
- C:\Users\Admin\AppData\Local\Temp\1136674820\zmstage.exe
  C:\Users\Admin\AppData\Local\Temp\1136674820\zmstage.exe
  2⤵
  PID:1644

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2216

C:\Users\Admin\AppData\Local\Temp\0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0f21db21b0093fc38e6219d7ffdeafb7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2480
- C:\Windows\System\QxNNKBW.exe
  C:\Windows\System\QxNNKBW.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\pBgwhAp.exe
  C:\Windows\System\pBgwhAp.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\iDPMkgP.exe
  C:\Windows\System\iDPMkgP.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\zZQHwdr.exe
  C:\Windows\System\zZQHwdr.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\HaEedLz.exe
  C:\Windows\System\HaEedLz.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\hrRvOjR.exe
  C:\Windows\System\hrRvOjR.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\fLdwONB.exe
  C:\Windows\System\fLdwONB.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\VuQThtQ.exe
  C:\Windows\System\VuQThtQ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\zBWezVL.exe
  C:\Windows\System\zBWezVL.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\npEecqC.exe
  C:\Windows\System\npEecqC.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\viPApKv.exe
  C:\Windows\System\viPApKv.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\xchtbMm.exe
  C:\Windows\System\xchtbMm.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\XLbwNOB.exe
  C:\Windows\System\XLbwNOB.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\ZCvmJiy.exe
  C:\Windows\System\ZCvmJiy.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\ZgskWJJ.exe
  C:\Windows\System\ZgskWJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\xVrAAHA.exe
  C:\Windows\System\xVrAAHA.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\IotKRCj.exe
  C:\Windows\System\IotKRCj.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\cCfhDjp.exe
  C:\Windows\System\cCfhDjp.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\iBuOOkK.exe
  C:\Windows\System\iBuOOkK.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\AcOmYfz.exe
  C:\Windows\System\AcOmYfz.exe
  2⤵
  - Executes dropped EXE
  PID:2332
- C:\Windows\System\kRHRdJz.exe
  C:\Windows\System\kRHRdJz.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\QxcXToD.exe
  C:\Windows\System\QxcXToD.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\VqQETrb.exe
  C:\Windows\System\VqQETrb.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\OPOlLDN.exe
  C:\Windows\System\OPOlLDN.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\VXRVvVP.exe
  C:\Windows\System\VXRVvVP.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\zFZUUle.exe
  C:\Windows\System\zFZUUle.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\morgRNv.exe
  C:\Windows\System\morgRNv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\XldVmSP.exe
  C:\Windows\System\XldVmSP.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\VuJllwL.exe
  C:\Windows\System\VuJllwL.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\wMxUWUD.exe
  C:\Windows\System\wMxUWUD.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\NLHWrDc.exe
  C:\Windows\System\NLHWrDc.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\kKGvFsk.exe
  C:\Windows\System\kKGvFsk.exe
  2⤵
  - Executes dropped EXE
  PID:1424
- C:\Windows\System\PHWKUAI.exe
  C:\Windows\System\PHWKUAI.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\nxhDxTR.exe
  C:\Windows\System\nxhDxTR.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\qkkYXUl.exe
  C:\Windows\System\qkkYXUl.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\zeHDonC.exe
  C:\Windows\System\zeHDonC.exe
  2⤵
  - Executes dropped EXE
  PID:1156
- C:\Windows\System\VSsweZN.exe
  C:\Windows\System\VSsweZN.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ZVXJIBX.exe
  C:\Windows\System\ZVXJIBX.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\QYRlebS.exe
  C:\Windows\System\QYRlebS.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\jPOBuDK.exe
  C:\Windows\System\jPOBuDK.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\hQSYEFV.exe
  C:\Windows\System\hQSYEFV.exe
  2⤵
  - Executes dropped EXE
  PID:1236
- C:\Windows\System\VmnbdIg.exe
  C:\Windows\System\VmnbdIg.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\Siyxmji.exe
  C:\Windows\System\Siyxmji.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\sDJwDYj.exe
  C:\Windows\System\sDJwDYj.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\cfNgLHf.exe
  C:\Windows\System\cfNgLHf.exe
  2⤵
  - Executes dropped EXE
  PID:2344
- C:\Windows\System\mVRdYSN.exe
  C:\Windows\System\mVRdYSN.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\oaolrbI.exe
  C:\Windows\System\oaolrbI.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\zRQXpfi.exe
  C:\Windows\System\zRQXpfi.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\qaLFTgT.exe
  C:\Windows\System\qaLFTgT.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\GxdCPYE.exe
  C:\Windows\System\GxdCPYE.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\UTeuuAW.exe
  C:\Windows\System\UTeuuAW.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\duGYeSt.exe
  C:\Windows\System\duGYeSt.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\DbXlUhx.exe
  C:\Windows\System\DbXlUhx.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\QOCuNaP.exe
  C:\Windows\System\QOCuNaP.exe
  2⤵
  - Executes dropped EXE
  PID:2312
- C:\Windows\System\VwuTtSF.exe
  C:\Windows\System\VwuTtSF.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\gHGNhsa.exe
  C:\Windows\System\gHGNhsa.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\DtBspvc.exe
  C:\Windows\System\DtBspvc.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\uErCOfI.exe
  C:\Windows\System\uErCOfI.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\qiACeXy.exe
  C:\Windows\System\qiACeXy.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\WfthXEG.exe
  C:\Windows\System\WfthXEG.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\yVNcsHB.exe
  C:\Windows\System\yVNcsHB.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\oPghkrq.exe
  C:\Windows\System\oPghkrq.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\LJSoBNA.exe
  C:\Windows\System\LJSoBNA.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\BsuxbBZ.exe
  C:\Windows\System\BsuxbBZ.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\GiozvzH.exe
  C:\Windows\System\GiozvzH.exe
  2⤵
  PID:576
- C:\Windows\System\bstAjTF.exe
  C:\Windows\System\bstAjTF.exe
  2⤵
  PID:1964
- C:\Windows\System\wJqOogB.exe
  C:\Windows\System\wJqOogB.exe
  2⤵
  PID:2004
- C:\Windows\System\vLTROIS.exe
  C:\Windows\System\vLTROIS.exe
  2⤵
  PID:2800
- C:\Windows\System\rgUqgYC.exe
  C:\Windows\System\rgUqgYC.exe
  2⤵
  PID:1060
- C:\Windows\System\akBaMsS.exe
  C:\Windows\System\akBaMsS.exe
  2⤵
  PID:2660
- C:\Windows\System\xqHUHdv.exe
  C:\Windows\System\xqHUHdv.exe
  2⤵
  PID:1388
- C:\Windows\System\tRkrIqC.exe
  C:\Windows\System\tRkrIqC.exe
  2⤵
  PID:1476
- C:\Windows\System\IeXcIyN.exe
  C:\Windows\System\IeXcIyN.exe
  2⤵
  PID:1048
- C:\Windows\System\tQdXlVI.exe
  C:\Windows\System\tQdXlVI.exe
  2⤵
  PID:2928
- C:\Windows\System\OIgvzRd.exe
  C:\Windows\System\OIgvzRd.exe
  2⤵
  PID:3032
- C:\Windows\System\znfqzny.exe
  C:\Windows\System\znfqzny.exe
  2⤵
  PID:2124
- C:\Windows\System\jvPzMiq.exe
  C:\Windows\System\jvPzMiq.exe
  2⤵
  PID:2280
- C:\Windows\System\pWPlKTu.exe
  C:\Windows\System\pWPlKTu.exe
  2⤵
  PID:1296
- C:\Windows\System\yPmzIHp.exe
  C:\Windows\System\yPmzIHp.exe
  2⤵
  PID:1084
- C:\Windows\System\wamOIxL.exe
  C:\Windows\System\wamOIxL.exe
  2⤵
  PID:1320
- C:\Windows\System\DbuxMIy.exe
  C:\Windows\System\DbuxMIy.exe
  2⤵
  PID:972
- C:\Windows\System\sqZgXpz.exe
  C:\Windows\System\sqZgXpz.exe
  2⤵
  PID:1496
- C:\Windows\System\VKNBbBF.exe
  C:\Windows\System\VKNBbBF.exe
  2⤵
  PID:792
- C:\Windows\System\gvoPbiy.exe
  C:\Windows\System\gvoPbiy.exe
  2⤵
  PID:300
- C:\Windows\System\EWEXicC.exe
  C:\Windows\System\EWEXicC.exe
  2⤵
  PID:2260
- C:\Windows\System\DwJvPGt.exe
  C:\Windows\System\DwJvPGt.exe
  2⤵
  PID:2164
- C:\Windows\System\uZxuedg.exe
  C:\Windows\System\uZxuedg.exe
  2⤵
  PID:1288
- C:\Windows\System\kTbPyPd.exe
  C:\Windows\System\kTbPyPd.exe
  2⤵
  PID:752
- C:\Windows\System\QkcBHIb.exe
  C:\Windows\System\QkcBHIb.exe
  2⤵
  PID:1644
- C:\Windows\System\cSwhRzX.exe
  C:\Windows\System\cSwhRzX.exe
  2⤵
  PID:1152
- C:\Windows\System\cwyHHsE.exe
  C:\Windows\System\cwyHHsE.exe
  2⤵
  PID:1716
- C:\Windows\System\UHFhaHK.exe
  C:\Windows\System\UHFhaHK.exe
  2⤵
  PID:684
- C:\Windows\System\PjTQfau.exe
  C:\Windows\System\PjTQfau.exe
  2⤵
  PID:3000
- C:\Windows\System\zPDwKCp.exe
  C:\Windows\System\zPDwKCp.exe
  2⤵
  PID:2532
- C:\Windows\System\rAGpIzV.exe
  C:\Windows\System\rAGpIzV.exe
  2⤵
  PID:1224
- C:\Windows\System\hKRzesZ.exe
  C:\Windows\System\hKRzesZ.exe
  2⤵
  PID:1604
- C:\Windows\System\mCCvgNX.exe
  C:\Windows\System\mCCvgNX.exe
  2⤵
  PID:1972
- C:\Windows\System\QXfPfav.exe
  C:\Windows\System\QXfPfav.exe
  2⤵
  PID:1948
- C:\Windows\System\DOByfRq.exe
  C:\Windows\System\DOByfRq.exe
  2⤵
  PID:2212
- C:\Windows\System\xePEGaO.exe
  C:\Windows\System\xePEGaO.exe
  2⤵
  PID:2000
- C:\Windows\System\VxAqOYr.exe
  C:\Windows\System\VxAqOYr.exe
  2⤵
  PID:1484
- C:\Windows\System\gUnQVGa.exe
  C:\Windows\System\gUnQVGa.exe
  2⤵
  PID:1480
- C:\Windows\System\DxdbzRf.exe
  C:\Windows\System\DxdbzRf.exe
  2⤵
  PID:2184
- C:\Windows\System\GGMxKJO.exe
  C:\Windows\System\GGMxKJO.exe
  2⤵
  PID:2348
- C:\Windows\System\dzZfeFy.exe
  C:\Windows\System\dzZfeFy.exe
  2⤵
  PID:2944
- C:\Windows\System\DjXjFlG.exe
  C:\Windows\System\DjXjFlG.exe
  2⤵
  PID:664
- C:\Windows\System\ChCuWkc.exe
  C:\Windows\System\ChCuWkc.exe
  2⤵
  PID:3044
- C:\Windows\System\KuljoRG.exe
  C:\Windows\System\KuljoRG.exe
  2⤵
  PID:1356
- C:\Windows\System\nXWACzG.exe
  C:\Windows\System\nXWACzG.exe
  2⤵
  PID:928
- C:\Windows\System\qCTFigg.exe
  C:\Windows\System\qCTFigg.exe
  2⤵
  PID:1568
- C:\Windows\System\anmLQtc.exe
  C:\Windows\System\anmLQtc.exe
  2⤵
  PID:2364
- C:\Windows\System\MDCPaTO.exe
  C:\Windows\System\MDCPaTO.exe
  2⤵
  PID:2320
- C:\Windows\System\vUIiROI.exe
  C:\Windows\System\vUIiROI.exe
  2⤵
  PID:2416
- C:\Windows\System\RkFxDfF.exe
  C:\Windows\System\RkFxDfF.exe
  2⤵
  PID:1620
- C:\Windows\System\dwTtHqf.exe
  C:\Windows\System\dwTtHqf.exe
  2⤵
  PID:2308
- C:\Windows\System\fHBEATN.exe
  C:\Windows\System\fHBEATN.exe
  2⤵
  PID:3056
- C:\Windows\System\EHTFWHN.exe
  C:\Windows\System\EHTFWHN.exe
  2⤵
  PID:1732
- C:\Windows\System\tMfuVsT.exe
  C:\Windows\System\tMfuVsT.exe
  2⤵
  PID:1584
- C:\Windows\System\KoVuhKA.exe
  C:\Windows\System\KoVuhKA.exe
  2⤵
  PID:2668
- C:\Windows\System\NjdAIZR.exe
  C:\Windows\System\NjdAIZR.exe
  2⤵
  PID:2524
- C:\Windows\System\SvKYqEn.exe
  C:\Windows\System\SvKYqEn.exe
  2⤵
  PID:2056
- C:\Windows\System\bjpBRxi.exe
  C:\Windows\System\bjpBRxi.exe
  2⤵
  PID:876
- C:\Windows\System\tHnTytP.exe
  C:\Windows\System\tHnTytP.exe
  2⤵
  PID:2748
- C:\Windows\System\HlrxXLI.exe
  C:\Windows\System\HlrxXLI.exe
  2⤵
  PID:2752
- C:\Windows\System\cjEHCma.exe
  C:\Windows\System\cjEHCma.exe
  2⤵
  PID:2936
- C:\Windows\System\Wzhyhzk.exe
  C:\Windows\System\Wzhyhzk.exe
  2⤵
  PID:2080
- C:\Windows\System\kNOKkki.exe
  C:\Windows\System\kNOKkki.exe
  2⤵
  PID:1800
- C:\Windows\System\HbpruIa.exe
  C:\Windows\System\HbpruIa.exe
  2⤵
  PID:1576
- C:\Windows\System\OccPinA.exe
  C:\Windows\System\OccPinA.exe
  2⤵
  PID:3024
- C:\Windows\System\OipMUfe.exe
  C:\Windows\System\OipMUfe.exe
  2⤵
  PID:2224
- C:\Windows\System\UjAZURM.exe
  C:\Windows\System\UjAZURM.exe
  2⤵
  PID:2216
- C:\Windows\System\YPDarHv.exe
  C:\Windows\System\YPDarHv.exe
  2⤵
  PID:2832
- C:\Windows\System\wZDqyyd.exe
  C:\Windows\System\wZDqyyd.exe
  2⤵
  PID:1344
- C:\Windows\System\vmaUrdK.exe
  C:\Windows\System\vmaUrdK.exe
  2⤵
  PID:2104
- C:\Windows\System\ogPTcwL.exe
  C:\Windows\System\ogPTcwL.exe
  2⤵
  PID:2696
- C:\Windows\System\SofqjgB.exe
  C:\Windows\System\SofqjgB.exe
  2⤵
  PID:2392
- C:\Windows\System\FpAYCTt.exe
  C:\Windows\System\FpAYCTt.exe
  2⤵
  PID:2084
- C:\Windows\System\UGQNbsz.exe
  C:\Windows\System\UGQNbsz.exe
  2⤵
  PID:804
- C:\Windows\System\DlPydlD.exe
  C:\Windows\System\DlPydlD.exe
  2⤵
  PID:2940
- C:\Windows\System\AKKOJlx.exe
  C:\Windows\System\AKKOJlx.exe
  2⤵
  PID:2924
- C:\Windows\System\JbubvKg.exe
  C:\Windows\System\JbubvKg.exe
  2⤵
  PID:1148
- C:\Windows\System\svYytyU.exe
  C:\Windows\System\svYytyU.exe
  2⤵
  PID:2360
- C:\Windows\System\GXQswJC.exe
  C:\Windows\System\GXQswJC.exe
  2⤵
  PID:2996
- C:\Windows\System\FWkUqov.exe
  C:\Windows\System\FWkUqov.exe
  2⤵
  PID:2136
- C:\Windows\System\ionRVWI.exe
  C:\Windows\System\ionRVWI.exe
  2⤵
  PID:2304
- C:\Windows\System\aQbXblO.exe
  C:\Windows\System\aQbXblO.exe
  2⤵
  PID:2324
- C:\Windows\System\xDbdQUk.exe
  C:\Windows\System\xDbdQUk.exe
  2⤵
  PID:2624
- C:\Windows\System\sCnuAzf.exe
  C:\Windows\System\sCnuAzf.exe
  2⤵
  PID:1500
- C:\Windows\System\PIUlOFm.exe
  C:\Windows\System\PIUlOFm.exe
  2⤵
  PID:888
- C:\Windows\System\iTDqhPX.exe
  C:\Windows\System\iTDqhPX.exe
  2⤵
  PID:760
- C:\Windows\System\UdeDnLD.exe
  C:\Windows\System\UdeDnLD.exe
  2⤵
  PID:2812
- C:\Windows\System\kaoGQVW.exe
  C:\Windows\System\kaoGQVW.exe
  2⤵
  PID:2108
- C:\Windows\System\IejKJnG.exe
  C:\Windows\System\IejKJnG.exe
  2⤵
  PID:1960
- C:\Windows\System\zCKKrrB.exe
  C:\Windows\System\zCKKrrB.exe
  2⤵
  PID:2568
- C:\Windows\System\FTQCcIR.exe
  C:\Windows\System\FTQCcIR.exe
  2⤵
  PID:1540
- C:\Windows\System\oKGaPHj.exe
  C:\Windows\System\oKGaPHj.exe
  2⤵
  PID:320
- C:\Windows\System\HQQfVOW.exe
  C:\Windows\System\HQQfVOW.exe
  2⤵
  PID:2920
- C:\Windows\System\RYWvQTi.exe
  C:\Windows\System\RYWvQTi.exe
  2⤵
  PID:2040
- C:\Windows\System\pjurWFM.exe
  C:\Windows\System\pjurWFM.exe
  2⤵
  PID:2468
- C:\Windows\System\sqwYHxi.exe
  C:\Windows\System\sqwYHxi.exe
  2⤵
  PID:368
- C:\Windows\System\ULPiBxx.exe
  C:\Windows\System\ULPiBxx.exe
  2⤵
  PID:2948
- C:\Windows\System\OMwTnfC.exe
  C:\Windows\System\OMwTnfC.exe
  2⤵
  PID:2664
- C:\Windows\System\azgBTTj.exe
  C:\Windows\System\azgBTTj.exe
  2⤵
  PID:2656
- C:\Windows\System\TonPlYF.exe
  C:\Windows\System\TonPlYF.exe
  2⤵
  PID:1808
- C:\Windows\System\ngGwSiv.exe
  C:\Windows\System\ngGwSiv.exe
  2⤵
  PID:1952
- C:\Windows\System\KUENrPz.exe
  C:\Windows\System\KUENrPz.exe
  2⤵
  PID:1844
- C:\Windows\System\NjbXmKb.exe
  C:\Windows\System\NjbXmKb.exe
  2⤵
  PID:2612
- C:\Windows\System\uIEEMMz.exe
  C:\Windows\System\uIEEMMz.exe
  2⤵
  PID:2072
- C:\Windows\System\OaBMpjF.exe
  C:\Windows\System\OaBMpjF.exe
  2⤵
  PID:2736
- C:\Windows\System\bGqSIzR.exe
  C:\Windows\System\bGqSIzR.exe
  2⤵
  PID:2484
- C:\Windows\System\YAAHFDr.exe
  C:\Windows\System\YAAHFDr.exe
  2⤵
  PID:2760
- C:\Windows\System\rjWgmhE.exe
  C:\Windows\System\rjWgmhE.exe
  2⤵
  PID:1820
- C:\Windows\System\ozikJEi.exe
  C:\Windows\System\ozikJEi.exe
  2⤵
  PID:1468
- C:\Windows\System\VUWrZtu.exe
  C:\Windows\System\VUWrZtu.exe
  2⤵
  PID:2196
- C:\Windows\System\ASFHXyf.exe
  C:\Windows\System\ASFHXyf.exe
  2⤵
  PID:2272
- C:\Windows\System\SJrgaFa.exe
  C:\Windows\System\SJrgaFa.exe
  2⤵
  PID:432
- C:\Windows\System\cztKNfz.exe
  C:\Windows\System\cztKNfz.exe
  2⤵
  PID:2932
- C:\Windows\System\uGIpvPm.exe
  C:\Windows\System\uGIpvPm.exe
  2⤵
  PID:3060
- C:\Windows\System\ojaIAZc.exe
  C:\Windows\System\ojaIAZc.exe
  2⤵
  PID:3088
- C:\Windows\System\ZNsiPso.exe
  C:\Windows\System\ZNsiPso.exe
  2⤵
  PID:3108
- C:\Windows\System\oBSNsCO.exe
  C:\Windows\System\oBSNsCO.exe
  2⤵
  PID:3136
- C:\Windows\System\FSFzhpa.exe
  C:\Windows\System\FSFzhpa.exe
  2⤵
  PID:3160
- C:\Windows\System\LJBgHsC.exe
  C:\Windows\System\LJBgHsC.exe
  2⤵
  PID:3176
- C:\Windows\System\cFHORfk.exe
  C:\Windows\System\cFHORfk.exe
  2⤵
  PID:3192
- C:\Windows\System\deMXBkV.exe
  C:\Windows\System\deMXBkV.exe
  2⤵
  PID:3208
- C:\Windows\System\TIjBkDs.exe
  C:\Windows\System\TIjBkDs.exe
  2⤵
  PID:3240
- C:\Windows\System\noEsVQl.exe
  C:\Windows\System\noEsVQl.exe
  2⤵
  PID:3256
- C:\Windows\System\HNCcddA.exe
  C:\Windows\System\HNCcddA.exe
  2⤵
  PID:3272
- C:\Windows\System\ujSyDaY.exe
  C:\Windows\System\ujSyDaY.exe
  2⤵
  PID:3288
- C:\Windows\System\EpCCoKk.exe
  C:\Windows\System\EpCCoKk.exe
  2⤵
  PID:3304
- C:\Windows\System\MeGfJWr.exe
  C:\Windows\System\MeGfJWr.exe
  2⤵
  PID:3320
- C:\Windows\System\OAOJcoz.exe
  C:\Windows\System\OAOJcoz.exe
  2⤵
  PID:3336
- C:\Windows\System\nvZhiHa.exe
  C:\Windows\System\nvZhiHa.exe
  2⤵
  PID:3352
- C:\Windows\System\rHQUlRU.exe
  C:\Windows\System\rHQUlRU.exe
  2⤵
  PID:3368
- C:\Windows\System\trZrEPY.exe
  C:\Windows\System\trZrEPY.exe
  2⤵
  PID:3388
- C:\Windows\System\LDLwYlg.exe
  C:\Windows\System\LDLwYlg.exe
  2⤵
  PID:3404
- C:\Windows\System\iKQzjeo.exe
  C:\Windows\System\iKQzjeo.exe
  2⤵
  PID:3420
- C:\Windows\System\zgncJUY.exe
  C:\Windows\System\zgncJUY.exe
  2⤵
  PID:3440
- C:\Windows\System\GGqkQXS.exe
  C:\Windows\System\GGqkQXS.exe
  2⤵
  PID:3456
- C:\Windows\System\Slwiacs.exe
  C:\Windows\System\Slwiacs.exe
  2⤵
  PID:3472
- C:\Windows\System\NSLyyLP.exe
  C:\Windows\System\NSLyyLP.exe
  2⤵
  PID:3488
- C:\Windows\System\FDOaYZe.exe
  C:\Windows\System\FDOaYZe.exe
  2⤵
  PID:3508
- C:\Windows\System\yOZliSO.exe
  C:\Windows\System\yOZliSO.exe
  2⤵
  PID:3528
- C:\Windows\System\hvNEcPu.exe
  C:\Windows\System\hvNEcPu.exe
  2⤵
  PID:3544
- C:\Windows\System\gejTpoJ.exe
  C:\Windows\System\gejTpoJ.exe
  2⤵
  PID:3560
- C:\Windows\System\TuCBJZh.exe
  C:\Windows\System\TuCBJZh.exe
  2⤵
  PID:3576
- C:\Windows\System\CsPHFNf.exe
  C:\Windows\System\CsPHFNf.exe
  2⤵
  PID:3592
- C:\Windows\System\AFoGxdk.exe
  C:\Windows\System\AFoGxdk.exe
  2⤵
  PID:3612
- C:\Windows\System\wJVYESt.exe
  C:\Windows\System\wJVYESt.exe
  2⤵
  PID:3628
- C:\Windows\System\VynKLhC.exe
  C:\Windows\System\VynKLhC.exe
  2⤵
  PID:3672
- C:\Windows\System\biTUEPQ.exe
  C:\Windows\System\biTUEPQ.exe
  2⤵
  PID:3688
- C:\Windows\System\QbbHSMf.exe
  C:\Windows\System\QbbHSMf.exe
  2⤵
  PID:3708
- C:\Windows\System\rciUFrT.exe
  C:\Windows\System\rciUFrT.exe
  2⤵
  PID:3724
- C:\Windows\System\shRSxgj.exe
  C:\Windows\System\shRSxgj.exe
  2⤵
  PID:3740
- C:\Windows\System\RrcxOfE.exe
  C:\Windows\System\RrcxOfE.exe
  2⤵
  PID:3756
- C:\Windows\System\KcbFdIX.exe
  C:\Windows\System\KcbFdIX.exe
  2⤵
  PID:3772
- C:\Windows\System\PmMiJdD.exe
  C:\Windows\System\PmMiJdD.exe
  2⤵
  PID:3788
- C:\Windows\System\rlLUHED.exe
  C:\Windows\System\rlLUHED.exe
  2⤵
  PID:3804
- C:\Windows\System\rRZBJmb.exe
  C:\Windows\System\rRZBJmb.exe
  2⤵
  PID:3820
- C:\Windows\System\UqzStPP.exe
  C:\Windows\System\UqzStPP.exe
  2⤵
  PID:3920
- C:\Windows\System\hAzWKzm.exe
  C:\Windows\System\hAzWKzm.exe
  2⤵
  PID:3936
- C:\Windows\System\DqmTMcm.exe
  C:\Windows\System\DqmTMcm.exe
  2⤵
  PID:3952
- C:\Windows\System\jOWCCeC.exe
  C:\Windows\System\jOWCCeC.exe
  2⤵
  PID:3968
- C:\Windows\System\YNBErMY.exe
  C:\Windows\System\YNBErMY.exe
  2⤵
  PID:3984
- C:\Windows\System\GFczUpV.exe
  C:\Windows\System\GFczUpV.exe
  2⤵
  PID:4008
- C:\Windows\System\ytgPABK.exe
  C:\Windows\System\ytgPABK.exe
  2⤵
  PID:4028
- C:\Windows\System\azujuyt.exe
  C:\Windows\System\azujuyt.exe
  2⤵
  PID:4044
- C:\Windows\System\QTsVSZP.exe
  C:\Windows\System\QTsVSZP.exe
  2⤵
  PID:4060
- C:\Windows\System\qafmeYe.exe
  C:\Windows\System\qafmeYe.exe
  2⤵
  PID:4076
- C:\Windows\System\MeqAvKO.exe
  C:\Windows\System\MeqAvKO.exe
  2⤵
  PID:4092
- C:\Windows\System\LxRxCSB.exe
  C:\Windows\System\LxRxCSB.exe
  2⤵
  PID:3120
- C:\Windows\System\RVCQTIh.exe
  C:\Windows\System\RVCQTIh.exe
  2⤵
  PID:3200
- C:\Windows\System\CLxfqhj.exe
  C:\Windows\System\CLxfqhj.exe
  2⤵
  PID:1696
- C:\Windows\System\tdfOGqh.exe
  C:\Windows\System\tdfOGqh.exe
  2⤵
  PID:2068
- C:\Windows\System\omRUYne.exe
  C:\Windows\System\omRUYne.exe
  2⤵
  PID:3104
- C:\Windows\System\MQjDSkw.exe
  C:\Windows\System\MQjDSkw.exe
  2⤵
  PID:3184
- C:\Windows\System\SBZIfSi.exe
  C:\Windows\System\SBZIfSi.exe
  2⤵
  PID:3224
- C:\Windows\System\HvmDyyC.exe
  C:\Windows\System\HvmDyyC.exe
  2⤵
  PID:3268
- C:\Windows\System\KJohbmd.exe
  C:\Windows\System\KJohbmd.exe
  2⤵
  PID:3080
- C:\Windows\System\JFXUiQf.exe
  C:\Windows\System\JFXUiQf.exe
  2⤵
  PID:3132
- C:\Windows\System\YPYYKTt.exe
  C:\Windows\System\YPYYKTt.exe
  2⤵
  PID:3332
- C:\Windows\System\MsdADAk.exe
  C:\Windows\System\MsdADAk.exe
  2⤵
  PID:3436
- C:\Windows\System\ZOYEMSO.exe
  C:\Windows\System\ZOYEMSO.exe
  2⤵
  PID:3432
- C:\Windows\System\WMcCYRJ.exe
  C:\Windows\System\WMcCYRJ.exe
  2⤵
  PID:3496
- C:\Windows\System\hjPFdzn.exe
  C:\Windows\System\hjPFdzn.exe
  2⤵
  PID:3568
- C:\Windows\System\ROMfsBf.exe
  C:\Windows\System\ROMfsBf.exe
  2⤵
  PID:3608
- C:\Windows\System\crJInCr.exe
  C:\Windows\System\crJInCr.exe
  2⤵
  PID:3648
- C:\Windows\System\pXHhLuo.exe
  C:\Windows\System\pXHhLuo.exe
  2⤵
  PID:3316
- C:\Windows\System\IWiXZQZ.exe
  C:\Windows\System\IWiXZQZ.exe
  2⤵
  PID:3452
- C:\Windows\System\MAjIvLX.exe
  C:\Windows\System\MAjIvLX.exe
  2⤵
  PID:3620
- C:\Windows\System\SbfhgsH.exe
  C:\Windows\System\SbfhgsH.exe
  2⤵
  PID:3344
- C:\Windows\System\KtGQAts.exe
  C:\Windows\System\KtGQAts.exe
  2⤵
  PID:3448
- C:\Windows\System\zWyVIvr.exe
  C:\Windows\System\zWyVIvr.exe
  2⤵
  PID:3584
- C:\Windows\System\mLskNVP.exe
  C:\Windows\System\mLskNVP.exe
  2⤵
  PID:3656
- C:\Windows\System\bcOJwjy.exe
  C:\Windows\System\bcOJwjy.exe
  2⤵
  PID:3696
- C:\Windows\System\fwTIzFp.exe
  C:\Windows\System\fwTIzFp.exe
  2⤵
  PID:3736
- C:\Windows\System\PEHxMmI.exe
  C:\Windows\System\PEHxMmI.exe
  2⤵
  PID:3768
- C:\Windows\System\tTRBpTa.exe
  C:\Windows\System\tTRBpTa.exe
  2⤵
  PID:3812
- C:\Windows\System\IjkFPGE.exe
  C:\Windows\System\IjkFPGE.exe
  2⤵
  PID:3716
- C:\Windows\System\bxAtsZG.exe
  C:\Windows\System\bxAtsZG.exe
  2⤵
  PID:3840
- C:\Windows\System\PVEjhjx.exe
  C:\Windows\System\PVEjhjx.exe
  2⤵
  PID:2520
- C:\Windows\System\PAcrHzJ.exe
  C:\Windows\System\PAcrHzJ.exe
  2⤵
  PID:1636
- C:\Windows\System\stvIRJH.exe
  C:\Windows\System\stvIRJH.exe
  2⤵
  PID:3856
- C:\Windows\System\LycuUcU.exe
  C:\Windows\System\LycuUcU.exe
  2⤵
  PID:3864
- C:\Windows\System\FndWwGc.exe
  C:\Windows\System\FndWwGc.exe
  2⤵
  PID:3892
- C:\Windows\System\rEDwgPW.exe
  C:\Windows\System\rEDwgPW.exe
  2⤵
  PID:3896
- C:\Windows\System\OdZcDwu.exe
  C:\Windows\System\OdZcDwu.exe
  2⤵
  PID:3912
- C:\Windows\System\uVNtFfi.exe
  C:\Windows\System\uVNtFfi.exe
  2⤵
  PID:3944
- C:\Windows\System\lkPAnis.exe
  C:\Windows\System\lkPAnis.exe
  2⤵
  PID:3976
- C:\Windows\System\aiASHDZ.exe
  C:\Windows\System\aiASHDZ.exe
  2⤵
  PID:4024
- C:\Windows\System\ZmfsMda.exe
  C:\Windows\System\ZmfsMda.exe
  2⤵
  PID:4052
- C:\Windows\System\ZTHdfeV.exe
  C:\Windows\System\ZTHdfeV.exe
  2⤵
  PID:1656
- C:\Windows\System\OQwFQqg.exe
  C:\Windows\System\OQwFQqg.exe
  2⤵
  PID:768
- C:\Windows\System\OvGOKjq.exe
  C:\Windows\System\OvGOKjq.exe
  2⤵
  PID:3220
- C:\Windows\System\GtCwoMY.exe
  C:\Windows\System\GtCwoMY.exe
  2⤵
  PID:3236
- C:\Windows\System\HJzOWHR.exe
  C:\Windows\System\HJzOWHR.exe
  2⤵
  PID:3124
- C:\Windows\System\tnKGcah.exe
  C:\Windows\System\tnKGcah.exe
  2⤵
  PID:3500
- C:\Windows\System\ivMxyIh.exe
  C:\Windows\System\ivMxyIh.exe
  2⤵
  PID:3300
- C:\Windows\System\BJfaaWA.exe
  C:\Windows\System\BJfaaWA.exe
  2⤵
  PID:3624
- C:\Windows\System\VasveXx.exe
  C:\Windows\System\VasveXx.exe
  2⤵
  PID:1572
- C:\Windows\System\RehDqqj.exe
  C:\Windows\System\RehDqqj.exe
  2⤵
  PID:3400
- C:\Windows\System\dPaKMGC.exe
  C:\Windows\System\dPaKMGC.exe
  2⤵
  PID:4088
- C:\Windows\System\rWEdqBK.exe
  C:\Windows\System\rWEdqBK.exe
  2⤵
  PID:1104
- C:\Windows\System\jvNkqBa.exe
  C:\Windows\System\jvNkqBa.exe
  2⤵
  PID:3660
- C:\Windows\System\QCpJTZv.exe
  C:\Windows\System\QCpJTZv.exe
  2⤵
  PID:3684
- C:\Windows\System\wVGqNYc.exe
  C:\Windows\System\wVGqNYc.exe
  2⤵
  PID:3852
- C:\Windows\System\AbjcLXD.exe
  C:\Windows\System\AbjcLXD.exe
  2⤵
  PID:1640
- C:\Windows\System\WTgxTEy.exe
  C:\Windows\System\WTgxTEy.exe
  2⤵
  PID:3664
- C:\Windows\System\QkajtXk.exe
  C:\Windows\System\QkajtXk.exe
  2⤵
  PID:3908
- C:\Windows\System\nxaswUv.exe
  C:\Windows\System\nxaswUv.exe
  2⤵
  PID:3428
- C:\Windows\System\MjTqxiY.exe
  C:\Windows\System\MjTqxiY.exe
  2⤵
  PID:3800
- C:\Windows\System\KXtRIWf.exe
  C:\Windows\System\KXtRIWf.exe
  2⤵
  PID:3704
- C:\Windows\System\HreddXP.exe
  C:\Windows\System\HreddXP.exe
  2⤵
  PID:3828
- C:\Windows\System\mcwpZUt.exe
  C:\Windows\System\mcwpZUt.exe
  2⤵
  PID:3540
- C:\Windows\System\EJgtUCR.exe
  C:\Windows\System\EJgtUCR.exe
  2⤵
  PID:3524
- C:\Windows\System\MNwPRRn.exe
  C:\Windows\System\MNwPRRn.exe
  2⤵
  PID:3600
- C:\Windows\System\dlSVFdb.exe
  C:\Windows\System\dlSVFdb.exe
  2⤵
  PID:1512
- C:\Windows\System\MjnVJnt.exe
  C:\Windows\System\MjnVJnt.exe
  2⤵
  PID:3100
- C:\Windows\System\VvlSibO.exe
  C:\Windows\System\VvlSibO.exe
  2⤵
  PID:3980
- C:\Windows\System\wfBNEaM.exe
  C:\Windows\System\wfBNEaM.exe
  2⤵
  PID:3816
- C:\Windows\System\VjfFtxP.exe
  C:\Windows\System\VjfFtxP.exe
  2⤵
  PID:3732
- C:\Windows\System\OPnuFRt.exe
  C:\Windows\System\OPnuFRt.exe
  2⤵
  PID:4004
- C:\Windows\System\raUpkux.exe
  C:\Windows\System\raUpkux.exe
  2⤵
  PID:3964
- C:\Windows\System\vNtRmYB.exe
  C:\Windows\System\vNtRmYB.exe
  2⤵
  PID:3148
- C:\Windows\System\kcGPpDG.exe
  C:\Windows\System\kcGPpDG.exe
  2⤵
  PID:2528
- C:\Windows\System\fkJLqGL.exe
  C:\Windows\System\fkJLqGL.exe
  2⤵
  PID:4108
- C:\Windows\System\TUAbEfh.exe
  C:\Windows\System\TUAbEfh.exe
  2⤵
  PID:4124
- C:\Windows\System\LoAIvgN.exe
  C:\Windows\System\LoAIvgN.exe
  2⤵
  PID:4144
- C:\Windows\System\zoniKAR.exe
  C:\Windows\System\zoniKAR.exe
  2⤵
  PID:4164
- C:\Windows\System\BTXRQkr.exe
  C:\Windows\System\BTXRQkr.exe
  2⤵
  PID:4180
- C:\Windows\System\UCedsnb.exe
  C:\Windows\System\UCedsnb.exe
  2⤵
  PID:4204
- C:\Windows\System\HIGQUzk.exe
  C:\Windows\System\HIGQUzk.exe
  2⤵
  PID:4220
- C:\Windows\System\fzKGbio.exe
  C:\Windows\System\fzKGbio.exe
  2⤵
  PID:4240
- C:\Windows\System\ugloVPG.exe
  C:\Windows\System\ugloVPG.exe
  2⤵
  PID:4256
- C:\Windows\System\CaiTCpL.exe
  C:\Windows\System\CaiTCpL.exe
  2⤵
  PID:4272
- C:\Windows\System\afizWZq.exe
  C:\Windows\System\afizWZq.exe
  2⤵
  PID:4288
- C:\Windows\System\tNyBBCu.exe
  C:\Windows\System\tNyBBCu.exe
  2⤵
  PID:4308
- C:\Windows\System\TvHHrKl.exe
  C:\Windows\System\TvHHrKl.exe
  2⤵
  PID:4332
- C:\Windows\System\qPbmEHY.exe
  C:\Windows\System\qPbmEHY.exe
  2⤵
  PID:4348
- C:\Windows\System\CseWoYg.exe
  C:\Windows\System\CseWoYg.exe
  2⤵
  PID:4364
- C:\Windows\System\nlpULAc.exe
  C:\Windows\System\nlpULAc.exe
  2⤵
  PID:4392
- C:\Windows\System\uiopVPZ.exe
  C:\Windows\System\uiopVPZ.exe
  2⤵
  PID:4412
- C:\Windows\System\xWGwNXJ.exe
  C:\Windows\System\xWGwNXJ.exe
  2⤵
  PID:4472
- C:\Windows\System\KrSIhNo.exe
  C:\Windows\System\KrSIhNo.exe
  2⤵
  PID:4496
- C:\Windows\System\hgjYqFu.exe
  C:\Windows\System\hgjYqFu.exe
  2⤵
  PID:4516
- C:\Windows\System\yZfPAVx.exe
  C:\Windows\System\yZfPAVx.exe
  2⤵
  PID:4532
- C:\Windows\System\tigZbxz.exe
  C:\Windows\System\tigZbxz.exe
  2⤵
  PID:4548
- C:\Windows\System\RtyRGmt.exe
  C:\Windows\System\RtyRGmt.exe
  2⤵
  PID:4568
- C:\Windows\System\INxArto.exe
  C:\Windows\System\INxArto.exe
  2⤵
  PID:4588
- C:\Windows\System\vnWiUCz.exe
  C:\Windows\System\vnWiUCz.exe
  2⤵
  PID:4608
- C:\Windows\System\kfAoXwe.exe
  C:\Windows\System\kfAoXwe.exe
  2⤵
  PID:4676
- C:\Windows\System\GsFHMjx.exe
  C:\Windows\System\GsFHMjx.exe
  2⤵
  PID:4696
- C:\Windows\System\vGmEwWf.exe
  C:\Windows\System\vGmEwWf.exe
  2⤵
  PID:4712
- C:\Windows\System\EbHGeAL.exe
  C:\Windows\System\EbHGeAL.exe
  2⤵
  PID:4748
- C:\Windows\System\UKEgUcL.exe
  C:\Windows\System\UKEgUcL.exe
  2⤵
  PID:4764
- C:\Windows\System\PIhYpZP.exe
  C:\Windows\System\PIhYpZP.exe
  2⤵
  PID:4784
- C:\Windows\System\gkHIyBG.exe
  C:\Windows\System\gkHIyBG.exe
  2⤵
  PID:4800
- C:\Windows\System\AzLZFyr.exe
  C:\Windows\System\AzLZFyr.exe
  2⤵
  PID:4816
- C:\Windows\System\baEHTSJ.exe
  C:\Windows\System\baEHTSJ.exe
  2⤵
  PID:4832
- C:\Windows\System\ujbYIaG.exe
  C:\Windows\System\ujbYIaG.exe
  2⤵
  PID:4848
- C:\Windows\System\cVmBDif.exe
  C:\Windows\System\cVmBDif.exe
  2⤵
  PID:4864
- C:\Windows\System\bWQmpqz.exe
  C:\Windows\System\bWQmpqz.exe
  2⤵
  PID:4880
- C:\Windows\System\qBCtstL.exe
  C:\Windows\System\qBCtstL.exe
  2⤵
  PID:4896
- C:\Windows\System\umoSHgQ.exe
  C:\Windows\System\umoSHgQ.exe
  2⤵
  PID:4912
- C:\Windows\System\sYyrRWJ.exe
  C:\Windows\System\sYyrRWJ.exe
  2⤵
  PID:4928
- C:\Windows\System\UEAjoOO.exe
  C:\Windows\System\UEAjoOO.exe
  2⤵
  PID:4944
- C:\Windows\System\MKdMeYB.exe
  C:\Windows\System\MKdMeYB.exe
  2⤵
  PID:4964
- C:\Windows\System\axgjIqn.exe
  C:\Windows\System\axgjIqn.exe
  2⤵
  PID:4980
- C:\Windows\System\xVhUnUo.exe
  C:\Windows\System\xVhUnUo.exe
  2⤵
  PID:4996
- C:\Windows\System\thPLALl.exe
  C:\Windows\System\thPLALl.exe
  2⤵
  PID:5016
- C:\Windows\System\tUoQCXG.exe
  C:\Windows\System\tUoQCXG.exe
  2⤵
  PID:5032
- C:\Windows\System\aUrhOVu.exe
  C:\Windows\System\aUrhOVu.exe
  2⤵
  PID:5048
- C:\Windows\System\WkgEHJB.exe
  C:\Windows\System\WkgEHJB.exe
  2⤵
  PID:5064
- C:\Windows\System\KgXgYkA.exe
  C:\Windows\System\KgXgYkA.exe
  2⤵
  PID:5080
- C:\Windows\System\vNOcEDr.exe
  C:\Windows\System\vNOcEDr.exe
  2⤵
  PID:5100
- C:\Windows\System\yNnPcpO.exe
  C:\Windows\System\yNnPcpO.exe
  2⤵
  PID:4000
- C:\Windows\System\uXUsbDE.exe
  C:\Windows\System\uXUsbDE.exe
  2⤵
  PID:3844
- C:\Windows\System\LMicciR.exe
  C:\Windows\System\LMicciR.exe
  2⤵
  PID:3928
- C:\Windows\System\SmLPrMN.exe
  C:\Windows\System\SmLPrMN.exe
  2⤵
  PID:4156
- C:\Windows\System\mUsfbDG.exe
  C:\Windows\System\mUsfbDG.exe
  2⤵
  PID:4192
- C:\Windows\System\UQIUZFG.exe
  C:\Windows\System\UQIUZFG.exe
  2⤵
  PID:3552
- C:\Windows\System\dceFLsG.exe
  C:\Windows\System\dceFLsG.exe
  2⤵
  PID:4100
- C:\Windows\System\kXHHoJi.exe
  C:\Windows\System\kXHHoJi.exe
  2⤵
  PID:4248
- C:\Windows\System\QOQIwvW.exe
  C:\Windows\System\QOQIwvW.exe
  2⤵
  PID:4176
- C:\Windows\System\SYfhmpF.exe
  C:\Windows\System\SYfhmpF.exe
  2⤵
  PID:4304
- C:\Windows\System\cpUKVYT.exe
  C:\Windows\System\cpUKVYT.exe
  2⤵
  PID:4284
- C:\Windows\System\AAtcIwc.exe
  C:\Windows\System\AAtcIwc.exe
  2⤵
  PID:4340
- C:\Windows\System\FwaVSxn.exe
  C:\Windows\System\FwaVSxn.exe
  2⤵
  PID:4344
- C:\Windows\System\vGuhmxx.exe
  C:\Windows\System\vGuhmxx.exe
  2⤵
  PID:4388
- C:\Windows\System\RckTEeq.exe
  C:\Windows\System\RckTEeq.exe
  2⤵
  PID:4460
- C:\Windows\System\WWzfXJQ.exe
  C:\Windows\System\WWzfXJQ.exe
  2⤵
  PID:4432
- C:\Windows\System\IOhkTWL.exe
  C:\Windows\System\IOhkTWL.exe
  2⤵
  PID:4444
- C:\Windows\System\XQOTPHb.exe
  C:\Windows\System\XQOTPHb.exe
  2⤵
  PID:4488
- C:\Windows\System\QJrReGx.exe
  C:\Windows\System\QJrReGx.exe
  2⤵
  PID:4508
- C:\Windows\System\RHTFbgV.exe
  C:\Windows\System\RHTFbgV.exe
  2⤵
  PID:4556
- C:\Windows\System\TMrLZkl.exe
  C:\Windows\System\TMrLZkl.exe
  2⤵
  PID:4596
- C:\Windows\System\VZyjbsS.exe
  C:\Windows\System\VZyjbsS.exe
  2⤵
  PID:4580
- C:\Windows\System\DLKwXhy.exe
  C:\Windows\System\DLKwXhy.exe
  2⤵
  PID:4616
- C:\Windows\System\ZIrgEPS.exe
  C:\Windows\System\ZIrgEPS.exe
  2⤵
  PID:4684
- C:\Windows\System\NynQYsq.exe
  C:\Windows\System\NynQYsq.exe
  2⤵
  PID:4652
- C:\Windows\System\EyzQhuh.exe
  C:\Windows\System\EyzQhuh.exe
  2⤵
  PID:4668
- C:\Windows\System\cgWBSyp.exe
  C:\Windows\System\cgWBSyp.exe
  2⤵
  PID:4708
- C:\Windows\System\ZrxFZSx.exe
  C:\Windows\System\ZrxFZSx.exe
  2⤵
  PID:4756
- C:\Windows\System\qKTdmvv.exe
  C:\Windows\System\qKTdmvv.exe
  2⤵
  PID:4780
- C:\Windows\System\qAfAAOX.exe
  C:\Windows\System\qAfAAOX.exe
  2⤵
  PID:4812
- C:\Windows\System\TtHmVkY.exe
  C:\Windows\System\TtHmVkY.exe
  2⤵
  PID:4872
- C:\Windows\System\jcnrIZG.exe
  C:\Windows\System\jcnrIZG.exe
  2⤵
  PID:4936
- C:\Windows\System\szABwRk.exe
  C:\Windows\System\szABwRk.exe
  2⤵
  PID:5004
- C:\Windows\System\AJgUSYP.exe
  C:\Windows\System\AJgUSYP.exe
  2⤵
  PID:5072
- C:\Windows\System\VXSFSKH.exe
  C:\Windows\System\VXSFSKH.exe
  2⤵
  PID:4920
- C:\Windows\System\WfOMbpW.exe
  C:\Windows\System\WfOMbpW.exe
  2⤵
  PID:5028
- C:\Windows\System\eEzVUhu.exe
  C:\Windows\System\eEzVUhu.exe
  2⤵
  PID:4892
- C:\Windows\System\DFpFQuu.exe
  C:\Windows\System\DFpFQuu.exe
  2⤵
  PID:5024
- C:\Windows\System\txkIUic.exe
  C:\Windows\System\txkIUic.exe
  2⤵
  PID:5112
- C:\Windows\System\EpKrfov.exe
  C:\Windows\System\EpKrfov.exe
  2⤵
  PID:3376
- C:\Windows\System\WgubcSK.exe
  C:\Windows\System\WgubcSK.exe
  2⤵
  PID:4152
- C:\Windows\System\bqcgqTT.exe
  C:\Windows\System\bqcgqTT.exe
  2⤵
  PID:4232
- C:\Windows\System\qdirDUw.exe
  C:\Windows\System\qdirDUw.exe
  2⤵
  PID:3364
- C:\Windows\System\bSttTWs.exe
  C:\Windows\System\bSttTWs.exe
  2⤵
  PID:4268
- C:\Windows\System\vBZOaUx.exe
  C:\Windows\System\vBZOaUx.exe
  2⤵
  PID:4320
- C:\Windows\System\FlfNtTK.exe
  C:\Windows\System\FlfNtTK.exe
  2⤵
  PID:4408
- C:\Windows\System\QOrJYCQ.exe
  C:\Windows\System\QOrJYCQ.exe
  2⤵
  PID:4440
- C:\Windows\System\NLUjrJr.exe
  C:\Windows\System\NLUjrJr.exe
  2⤵
  PID:4424
- C:\Windows\System\JQlLHoe.exe
  C:\Windows\System\JQlLHoe.exe
  2⤵
  PID:4540
- C:\Windows\System\xTAPxvl.exe
  C:\Windows\System\xTAPxvl.exe
  2⤵
  PID:4620
- C:\Windows\System\QCYVKYv.exe
  C:\Windows\System\QCYVKYv.exe
  2⤵
  PID:4640
- C:\Windows\System\hCSuUrc.exe
  C:\Windows\System\hCSuUrc.exe
  2⤵
  PID:4672
- C:\Windows\System\ZWPhQen.exe
  C:\Windows\System\ZWPhQen.exe
  2⤵
  PID:4744
- C:\Windows\System\SbYhlRa.exe
  C:\Windows\System\SbYhlRa.exe
  2⤵
  PID:4824
- C:\Windows\System\RoohcSK.exe
  C:\Windows\System\RoohcSK.exe
  2⤵
  PID:4972
- C:\Windows\System\rKOIOZV.exe
  C:\Windows\System\rKOIOZV.exe
  2⤵
  PID:5012
- C:\Windows\System\xlbdrHz.exe
  C:\Windows\System\xlbdrHz.exe
  2⤵
  PID:4888
- C:\Windows\System\zKkIbMu.exe
  C:\Windows\System\zKkIbMu.exe
  2⤵
  PID:4992
- C:\Windows\System\ijUiRRo.exe
  C:\Windows\System\ijUiRRo.exe
  2⤵
  PID:4120
- C:\Windows\System\iTbSWqA.exe
  C:\Windows\System\iTbSWqA.exe
  2⤵
  PID:4228
- C:\Windows\System\DAoymeB.exe
  C:\Windows\System\DAoymeB.exe
  2⤵
  PID:4172
- C:\Windows\System\fNDcrKB.exe
  C:\Windows\System\fNDcrKB.exe
  2⤵
  PID:4252
- C:\Windows\System\SVjtDZR.exe
  C:\Windows\System\SVjtDZR.exe
  2⤵
  PID:2204
- C:\Windows\System\MmATCxv.exe
  C:\Windows\System\MmATCxv.exe
  2⤵
  PID:4664
- C:\Windows\System\jjtnNAr.exe
  C:\Windows\System\jjtnNAr.exe
  2⤵
  PID:4844
- C:\Windows\System\TWEeKdG.exe
  C:\Windows\System\TWEeKdG.exe
  2⤵
  PID:4776
- C:\Windows\System\MACGhOB.exe
  C:\Windows\System\MACGhOB.exe
  2⤵
  PID:4976
- C:\Windows\System\qQPUsFj.exe
  C:\Windows\System\qQPUsFj.exe
  2⤵
  PID:5096
- C:\Windows\System\leSvYfB.exe
  C:\Windows\System\leSvYfB.exe
  2⤵
  PID:5108
- C:\Windows\System\rAuOLcc.exe
  C:\Windows\System\rAuOLcc.exe
  2⤵
  PID:4428
- C:\Windows\System\rwjxEHo.exe
  C:\Windows\System\rwjxEHo.exe
  2⤵
  PID:4636
- C:\Windows\System\oKgtyND.exe
  C:\Windows\System\oKgtyND.exe
  2⤵
  PID:4420
- C:\Windows\System\jjHddDq.exe
  C:\Windows\System\jjHddDq.exe
  2⤵
  PID:4860
- C:\Windows\System\JQZKrXj.exe
  C:\Windows\System\JQZKrXj.exe
  2⤵
  PID:3996
- C:\Windows\System\WjhBnmH.exe
  C:\Windows\System\WjhBnmH.exe
  2⤵
  PID:4564
- C:\Windows\System\JbKclCu.exe
  C:\Windows\System\JbKclCu.exe
  2⤵
  PID:4484
- C:\Windows\System\muOutvK.exe
  C:\Windows\System\muOutvK.exe
  2⤵
  PID:5132
- C:\Windows\System\CeelcTO.exe
  C:\Windows\System\CeelcTO.exe
  2⤵
  PID:5148
- C:\Windows\System\XrhrnqO.exe
  C:\Windows\System\XrhrnqO.exe
  2⤵
  PID:5164
- C:\Windows\System\wqszGNk.exe
  C:\Windows\System\wqszGNk.exe
  2⤵
  PID:5184
- C:\Windows\System\oMXPBsE.exe
  C:\Windows\System\oMXPBsE.exe
  2⤵
  PID:5200
- C:\Windows\System\FTPLTXe.exe
  C:\Windows\System\FTPLTXe.exe
  2⤵
  PID:5216
- C:\Windows\System\DUrrZMT.exe
  C:\Windows\System\DUrrZMT.exe
  2⤵
  PID:5232
- C:\Windows\System\wQpvrLJ.exe
  C:\Windows\System\wQpvrLJ.exe
  2⤵
  PID:5248
- C:\Windows\System\tzEOlTX.exe
  C:\Windows\System\tzEOlTX.exe
  2⤵
  PID:5264
- C:\Windows\System\aBeeswe.exe
  C:\Windows\System\aBeeswe.exe
  2⤵
  PID:5280
- C:\Windows\System\RFmsJgL.exe
  C:\Windows\System\RFmsJgL.exe
  2⤵
  PID:5296
- C:\Windows\System\AhWqCOK.exe
  C:\Windows\System\AhWqCOK.exe
  2⤵
  PID:5320
- C:\Windows\System\jaEzVWp.exe
  C:\Windows\System\jaEzVWp.exe
  2⤵
  PID:5336
- C:\Windows\System\SfsMZaC.exe
  C:\Windows\System\SfsMZaC.exe
  2⤵
  PID:5352
- C:\Windows\System\MOqBIeg.exe
  C:\Windows\System\MOqBIeg.exe
  2⤵
  PID:5372
- C:\Windows\System\fosiRxY.exe
  C:\Windows\System\fosiRxY.exe
  2⤵
  PID:5388
- C:\Windows\System\YEMMLPP.exe
  C:\Windows\System\YEMMLPP.exe
  2⤵
  PID:5404
- C:\Windows\System\xYTbDiM.exe
  C:\Windows\System\xYTbDiM.exe
  2⤵
  PID:5420
- C:\Windows\System\TCAGMts.exe
  C:\Windows\System\TCAGMts.exe
  2⤵
  PID:5436
- C:\Windows\System\fJuSmfB.exe
  C:\Windows\System\fJuSmfB.exe
  2⤵
  PID:5452
- C:\Windows\System\OATIQPj.exe
  C:\Windows\System\OATIQPj.exe
  2⤵
  PID:5468
- C:\Windows\System\tmAdSoF.exe
  C:\Windows\System\tmAdSoF.exe
  2⤵
  PID:5484
- C:\Windows\System\IHKGyKM.exe
  C:\Windows\System\IHKGyKM.exe
  2⤵
  PID:5500
- C:\Windows\System\fGgapIL.exe
  C:\Windows\System\fGgapIL.exe
  2⤵
  PID:5516
- C:\Windows\System\MivZlBY.exe
  C:\Windows\System\MivZlBY.exe
  2⤵
  PID:5532
- C:\Windows\System\WZdbLbb.exe
  C:\Windows\System\WZdbLbb.exe
  2⤵
  PID:5552
- C:\Windows\System\snQSszO.exe
  C:\Windows\System\snQSszO.exe
  2⤵
  PID:5568
- C:\Windows\System\hmWbvmM.exe
  C:\Windows\System\hmWbvmM.exe
  2⤵
  PID:5596
- C:\Windows\System\hGIGSYK.exe
  C:\Windows\System\hGIGSYK.exe
  2⤵
  PID:5612
- C:\Windows\System\hJQBWlg.exe
  C:\Windows\System\hJQBWlg.exe
  2⤵
  PID:5628
- C:\Windows\System\TkCHWgv.exe
  C:\Windows\System\TkCHWgv.exe
  2⤵
  PID:5648
- C:\Windows\System\ZMqRKXL.exe
  C:\Windows\System\ZMqRKXL.exe
  2⤵
  PID:5664
- C:\Windows\System\kUAhDhd.exe
  C:\Windows\System\kUAhDhd.exe
  2⤵
  PID:5680
- C:\Windows\System\efvsqEZ.exe
  C:\Windows\System\efvsqEZ.exe
  2⤵
  PID:5700
- C:\Windows\System\aVNZWzT.exe
  C:\Windows\System\aVNZWzT.exe
  2⤵
  PID:5716
- C:\Windows\System\GfTHpRF.exe
  C:\Windows\System\GfTHpRF.exe
  2⤵
  PID:5732
- C:\Windows\System\XdTVMFh.exe
  C:\Windows\System\XdTVMFh.exe
  2⤵
  PID:5748
- C:\Windows\System\AwYuAad.exe
  C:\Windows\System\AwYuAad.exe
  2⤵
  PID:5764
- C:\Windows\System\RoNKwxV.exe
  C:\Windows\System\RoNKwxV.exe
  2⤵
  PID:5780
- C:\Windows\System\dUKRJMw.exe
  C:\Windows\System\dUKRJMw.exe
  2⤵
  PID:5796
- C:\Windows\System\pYRcYaX.exe
  C:\Windows\System\pYRcYaX.exe
  2⤵
  PID:5812
- C:\Windows\System\XvHOrXS.exe
  C:\Windows\System\XvHOrXS.exe
  2⤵
  PID:5836
- C:\Windows\System\QYgnLoH.exe
  C:\Windows\System\QYgnLoH.exe
  2⤵
  PID:5856
- C:\Windows\System\YkZjVzu.exe
  C:\Windows\System\YkZjVzu.exe
  2⤵
  PID:5872
- C:\Windows\System\XhnRdHV.exe
  C:\Windows\System\XhnRdHV.exe
  2⤵
  PID:5888
- C:\Windows\System\buqrHZJ.exe
  C:\Windows\System\buqrHZJ.exe
  2⤵
  PID:5904
- C:\Windows\System\mpaDLiC.exe
  C:\Windows\System\mpaDLiC.exe
  2⤵
  PID:5920
- C:\Windows\System\eTNWRwV.exe
  C:\Windows\System\eTNWRwV.exe
  2⤵
  PID:5936
- C:\Windows\System\FzfDYGK.exe
  C:\Windows\System\FzfDYGK.exe
  2⤵
  PID:5952
- C:\Windows\System\UvDVUuA.exe
  C:\Windows\System\UvDVUuA.exe
  2⤵
  PID:5968
- C:\Windows\System\wzteqkQ.exe
  C:\Windows\System\wzteqkQ.exe
  2⤵
  PID:5984
- C:\Windows\System\HrRuDcn.exe
  C:\Windows\System\HrRuDcn.exe
  2⤵
  PID:6000
- C:\Windows\System\vSYxZeX.exe
  C:\Windows\System\vSYxZeX.exe
  2⤵
  PID:6016
- C:\Windows\System\JhQhcwF.exe
  C:\Windows\System\JhQhcwF.exe
  2⤵
  PID:6032
- C:\Windows\System\JWqKgaj.exe
  C:\Windows\System\JWqKgaj.exe
  2⤵
  PID:6056
- C:\Windows\System\bMcWnWE.exe
  C:\Windows\System\bMcWnWE.exe
  2⤵
  PID:6076
- C:\Windows\System\WsLQBDJ.exe
  C:\Windows\System\WsLQBDJ.exe
  2⤵
  PID:6096
- C:\Windows\System\KxNRuCc.exe
  C:\Windows\System\KxNRuCc.exe
  2⤵
  PID:6116
- C:\Windows\System\bjLBuXC.exe
  C:\Windows\System\bjLBuXC.exe
  2⤵
  PID:6132
- C:\Windows\System\ascGINp.exe
  C:\Windows\System\ascGINp.exe
  2⤵
  PID:4264
- C:\Windows\System\DVPJXLR.exe
  C:\Windows\System\DVPJXLR.exe
  2⤵
  PID:5128
- C:\Windows\System\mXrmEhS.exe
  C:\Windows\System\mXrmEhS.exe
  2⤵
  PID:5156
- C:\Windows\System\jPYBjbm.exe
  C:\Windows\System\jPYBjbm.exe
  2⤵
  PID:5192
- C:\Windows\System\pbYbLzG.exe
  C:\Windows\System\pbYbLzG.exe
  2⤵
  PID:5224
- C:\Windows\System\QHQfseF.exe
  C:\Windows\System\QHQfseF.exe
  2⤵
  PID:5244
- C:\Windows\System\NyzQcXr.exe
  C:\Windows\System\NyzQcXr.exe
  2⤵
  PID:5276
- C:\Windows\System\ksVPlUq.exe
  C:\Windows\System\ksVPlUq.exe
  2⤵
  PID:112
- C:\Windows\System\jlRbdBR.exe
  C:\Windows\System\jlRbdBR.exe
  2⤵
  PID:5364
- C:\Windows\System\koVglck.exe
  C:\Windows\System\koVglck.exe
  2⤵
  PID:5344
- C:\Windows\System\JFjMfox.exe
  C:\Windows\System\JFjMfox.exe
  2⤵
  PID:5400
- C:\Windows\System\VgUnmwq.exe
  C:\Windows\System\VgUnmwq.exe
  2⤵
  PID:5428
- C:\Windows\System\QjArtpJ.exe
  C:\Windows\System\QjArtpJ.exe
  2⤵
  PID:5492
- C:\Windows\System\sxKVpLl.exe
  C:\Windows\System\sxKVpLl.exe
  2⤵
  PID:5524
- C:\Windows\System\MhzDrUJ.exe
  C:\Windows\System\MhzDrUJ.exe
  2⤵
  PID:5508
- C:\Windows\System\wyNUaYU.exe
  C:\Windows\System\wyNUaYU.exe
  2⤵
  PID:5564
- C:\Windows\System\qJRYzTn.exe
  C:\Windows\System\qJRYzTn.exe
  2⤵
  PID:5604
- C:\Windows\System\hfDQrEf.exe
  C:\Windows\System\hfDQrEf.exe
  2⤵
  PID:5644
- C:\Windows\System\MjGHtor.exe
  C:\Windows\System\MjGHtor.exe
  2⤵
  PID:5620
- C:\Windows\System\ddaACBt.exe
  C:\Windows\System\ddaACBt.exe
  2⤵
  PID:5688
- C:\Windows\System\FDXJGKK.exe
  C:\Windows\System\FDXJGKK.exe
  2⤵
  PID:5712
- C:\Windows\System\zpajDVA.exe
  C:\Windows\System\zpajDVA.exe
  2⤵
  PID:5756
- C:\Windows\System\PwHbTZo.exe
  C:\Windows\System\PwHbTZo.exe
  2⤵
  PID:5776
- C:\Windows\System\TrjLXEB.exe
  C:\Windows\System\TrjLXEB.exe
  2⤵
  PID:5760
- C:\Windows\System\AVchHrX.exe
  C:\Windows\System\AVchHrX.exe
  2⤵
  PID:5844
- C:\Windows\System\AqWRqYE.exe
  C:\Windows\System\AqWRqYE.exe
  2⤵
  PID:5832
- C:\Windows\System\ISzCmRo.exe
  C:\Windows\System\ISzCmRo.exe
  2⤵
  PID:5944
- C:\Windows\System\XjedXmX.exe
  C:\Windows\System\XjedXmX.exe
  2⤵
  PID:5976
- C:\Windows\System\zWbKpzL.exe
  C:\Windows\System\zWbKpzL.exe
  2⤵
  PID:6008
- C:\Windows\System\vvGqWWq.exe
  C:\Windows\System\vvGqWWq.exe
  2⤵
  PID:6040
- C:\Windows\System\oTTUnuL.exe
  C:\Windows\System\oTTUnuL.exe
  2⤵
  PID:5992
- C:\Windows\System\xwfYLFY.exe
  C:\Windows\System\xwfYLFY.exe
  2⤵
  PID:6088
- C:\Windows\System\MudDiBi.exe
  C:\Windows\System\MudDiBi.exe
  2⤵
  PID:6128
- C:\Windows\System\gsCLldA.exe
  C:\Windows\System\gsCLldA.exe
  2⤵
  PID:4960
- C:\Windows\System\oECOLQR.exe
  C:\Windows\System\oECOLQR.exe
  2⤵
  PID:6140
- C:\Windows\System\AgjQmKx.exe
  C:\Windows\System\AgjQmKx.exe
  2⤵
  PID:5228
- C:\Windows\System\vWxKcIM.exe
  C:\Windows\System\vWxKcIM.exe
  2⤵
  PID:5208
- C:\Windows\System\DjKALnY.exe
  C:\Windows\System\DjKALnY.exe
  2⤵
  PID:5308
- C:\Windows\System\iWtVNMf.exe
  C:\Windows\System\iWtVNMf.exe
  2⤵
  PID:5384
- C:\Windows\System\xKzpTFB.exe
  C:\Windows\System\xKzpTFB.exe
  2⤵
  PID:5460
- C:\Windows\System\YKxnoWM.exe
  C:\Windows\System\YKxnoWM.exe
  2⤵
  PID:5476
- C:\Windows\System\EjxwqxS.exe
  C:\Windows\System\EjxwqxS.exe
  2⤵
  PID:5548
- C:\Windows\System\EnjBdBZ.exe
  C:\Windows\System\EnjBdBZ.exe
  2⤵
  PID:5676
- C:\Windows\System\FTWVQdW.exe
  C:\Windows\System\FTWVQdW.exe
  2⤵
  PID:5728
- C:\Windows\System\UTTisQb.exe
  C:\Windows\System\UTTisQb.exe
  2⤵
  PID:5792
- C:\Windows\System\PmBsIqE.exe
  C:\Windows\System\PmBsIqE.exe
  2⤵
  PID:5820
- C:\Windows\System\AgyMnMc.exe
  C:\Windows\System\AgyMnMc.exe
  2⤵
  PID:5896
- C:\Windows\System\YWNmGGp.exe
  C:\Windows\System\YWNmGGp.exe
  2⤵
  PID:6048
- C:\Windows\System\uuujoyb.exe
  C:\Windows\System\uuujoyb.exe
  2⤵
  PID:5928
- C:\Windows\System\BvDocxC.exe
  C:\Windows\System\BvDocxC.exe
  2⤵
  PID:6124
- C:\Windows\System\xRmTaMg.exe
  C:\Windows\System\xRmTaMg.exe
  2⤵
  PID:5272
- C:\Windows\System\eZhOraf.exe
  C:\Windows\System\eZhOraf.exe
  2⤵
  PID:4904
- C:\Windows\System\OIpIQZw.exe
  C:\Windows\System\OIpIQZw.exe
  2⤵
  PID:5360
- C:\Windows\System\aCVkPCa.exe
  C:\Windows\System\aCVkPCa.exe
  2⤵
  PID:5496
- C:\Windows\System\cLrlcJl.exe
  C:\Windows\System\cLrlcJl.exe
  2⤵
  PID:5540
- C:\Windows\System\cnWXdHX.exe
  C:\Windows\System\cnWXdHX.exe
  2⤵
  PID:5576
- C:\Windows\System\zfYhpNQ.exe
  C:\Windows\System\zfYhpNQ.exe
  2⤵
  PID:5744
- C:\Windows\System\eDkJKXO.exe
  C:\Windows\System\eDkJKXO.exe
  2⤵
  PID:6028
- C:\Windows\System\UaSQlUw.exe
  C:\Windows\System\UaSQlUw.exe
  2⤵
  PID:6068
- C:\Windows\System\dpqTAts.exe
  C:\Windows\System\dpqTAts.exe
  2⤵
  PID:5144
- C:\Windows\System\HENLzyT.exe
  C:\Windows\System\HENLzyT.exe
  2⤵
  PID:5464
- C:\Windows\System\AYvQiVi.exe
  C:\Windows\System\AYvQiVi.exe
  2⤵
  PID:5708
- C:\Windows\System\cHdHTDH.exe
  C:\Windows\System\cHdHTDH.exe
  2⤵
  PID:5140
- C:\Windows\System\ZuZtGbt.exe
  C:\Windows\System\ZuZtGbt.exe
  2⤵
  PID:5196
- C:\Windows\System\CCWgJaA.exe
  C:\Windows\System\CCWgJaA.exe
  2⤵
  PID:5900
- C:\Windows\System\ZoknwRb.exe
  C:\Windows\System\ZoknwRb.exe
  2⤵
  PID:5868
- C:\Windows\System\wZSbQph.exe
  C:\Windows\System\wZSbQph.exe
  2⤵
  PID:6148
- C:\Windows\System\gMLAMjf.exe
  C:\Windows\System\gMLAMjf.exe
  2⤵
  PID:6164
- C:\Windows\System\gxLEbax.exe
  C:\Windows\System\gxLEbax.exe
  2⤵
  PID:6184
- C:\Windows\System\UnJYWra.exe
  C:\Windows\System\UnJYWra.exe
  2⤵
  PID:6200
- C:\Windows\System\LEsguLm.exe
  C:\Windows\System\LEsguLm.exe
  2⤵
  PID:6216
- C:\Windows\System\OJTnaLT.exe
  C:\Windows\System\OJTnaLT.exe
  2⤵
  PID:6232
- C:\Windows\System\oUjjjne.exe
  C:\Windows\System\oUjjjne.exe
  2⤵
  PID:6248
- C:\Windows\System\kNIiCYi.exe
  C:\Windows\System\kNIiCYi.exe
  2⤵
  PID:6264
- C:\Windows\System\SWGVOuS.exe
  C:\Windows\System\SWGVOuS.exe
  2⤵
  PID:6280
- C:\Windows\System\nRiNtwl.exe
  C:\Windows\System\nRiNtwl.exe
  2⤵
  PID:6300
- C:\Windows\System\SuEqNLf.exe
  C:\Windows\System\SuEqNLf.exe
  2⤵
  PID:6316
- C:\Windows\System\YfQMcbM.exe
  C:\Windows\System\YfQMcbM.exe
  2⤵
  PID:6332
- C:\Windows\System\VPdzPHX.exe
  C:\Windows\System\VPdzPHX.exe
  2⤵
  PID:6348
- C:\Windows\System\RmSMXJy.exe
  C:\Windows\System\RmSMXJy.exe
  2⤵
  PID:6364
- C:\Windows\System\xMidwlZ.exe
  C:\Windows\System\xMidwlZ.exe
  2⤵
  PID:6380
- C:\Windows\System\rZNjvMn.exe
  C:\Windows\System\rZNjvMn.exe
  2⤵
  PID:6400
- C:\Windows\System\FCMjQPk.exe
  C:\Windows\System\FCMjQPk.exe
  2⤵
  PID:6416
- C:\Windows\System\IJzEDmB.exe
  C:\Windows\System\IJzEDmB.exe
  2⤵
  PID:6432
- C:\Windows\System\vCXqsTL.exe
  C:\Windows\System\vCXqsTL.exe
  2⤵
  PID:6452
- C:\Windows\System\lVIeQEF.exe
  C:\Windows\System\lVIeQEF.exe
  2⤵
  PID:6468
- C:\Windows\System\WiXmRov.exe
  C:\Windows\System\WiXmRov.exe
  2⤵
  PID:6484
- C:\Windows\System\OLZohci.exe
  C:\Windows\System\OLZohci.exe
  2⤵
  PID:6500
- C:\Windows\System\rAVAAIT.exe
  C:\Windows\System\rAVAAIT.exe
  2⤵
  PID:6516
- C:\Windows\System\GBKEalY.exe
  C:\Windows\System\GBKEalY.exe
  2⤵
  PID:6536
- C:\Windows\System\NJcXJjj.exe
  C:\Windows\System\NJcXJjj.exe
  2⤵
  PID:6556
- C:\Windows\System\pNftWcx.exe
  C:\Windows\System\pNftWcx.exe
  2⤵
  PID:6572
- C:\Windows\System\jLurqAe.exe
  C:\Windows\System\jLurqAe.exe
  2⤵
  PID:6592
- C:\Windows\System\knrmqYl.exe
  C:\Windows\System\knrmqYl.exe
  2⤵
  PID:6608
- C:\Windows\System\CicTlJp.exe
  C:\Windows\System\CicTlJp.exe
  2⤵
  PID:6664
- C:\Windows\System\PIdKNFz.exe
  C:\Windows\System\PIdKNFz.exe
  2⤵
  PID:6684
- C:\Windows\System\pZzHNpd.exe
  C:\Windows\System\pZzHNpd.exe
  2⤵
  PID:6712
- C:\Windows\System\zwdtmJB.exe
  C:\Windows\System\zwdtmJB.exe
  2⤵
  PID:6728
- C:\Windows\System\ROfOjMm.exe
  C:\Windows\System\ROfOjMm.exe
  2⤵
  PID:7072
- C:\Windows\System\VKkokQC.exe
  C:\Windows\System\VKkokQC.exe
  2⤵
  PID:7088
- C:\Windows\System\pufiPzY.exe
  C:\Windows\System\pufiPzY.exe
  2⤵
  PID:7104
- C:\Windows\System\zJGbbaZ.exe
  C:\Windows\System\zJGbbaZ.exe
  2⤵
  PID:7120
- C:\Windows\System\yGKMlov.exe
  C:\Windows\System\yGKMlov.exe
  2⤵
  PID:7136
- C:\Windows\System\ynHJZFx.exe
  C:\Windows\System\ynHJZFx.exe
  2⤵
  PID:7160
- C:\Windows\System\fElvOkg.exe
  C:\Windows\System\fElvOkg.exe
  2⤵
  PID:6156
- C:\Windows\System\KWNiSZV.exe
  C:\Windows\System\KWNiSZV.exe
  2⤵
  PID:5416
- C:\Windows\System\aKlQKOx.exe
  C:\Windows\System\aKlQKOx.exe
  2⤵
  PID:6176
- C:\Windows\System\RXELFNq.exe
  C:\Windows\System\RXELFNq.exe
  2⤵
  PID:6224
- C:\Windows\System\zDFmQDo.exe
  C:\Windows\System\zDFmQDo.exe
  2⤵
  PID:6260
- C:\Windows\System\TzbHjLt.exe
  C:\Windows\System\TzbHjLt.exe
  2⤵
  PID:6292
- C:\Windows\System\laWQEZd.exe
  C:\Windows\System\laWQEZd.exe
  2⤵
  PID:6328
- C:\Windows\System\OkKAYeX.exe
  C:\Windows\System\OkKAYeX.exe
  2⤵
  PID:6388
- C:\Windows\System\iHrXvWV.exe
  C:\Windows\System\iHrXvWV.exe
  2⤵
  PID:6424
- C:\Windows\System\nqAskfe.exe
  C:\Windows\System\nqAskfe.exe
  2⤵
  PID:6460
- C:\Windows\System\MIFbBnw.exe
  C:\Windows\System\MIFbBnw.exe
  2⤵
  PID:6440
- C:\Windows\System\aplkAif.exe
  C:\Windows\System\aplkAif.exe
  2⤵
  PID:6480
- C:\Windows\System\heRMKpG.exe
  C:\Windows\System\heRMKpG.exe
  2⤵
  PID:6512
- C:\Windows\System\AXilVjc.exe
  C:\Windows\System\AXilVjc.exe
  2⤵
  PID:6532
- C:\Windows\System\MjwjIzd.exe
  C:\Windows\System\MjwjIzd.exe
  2⤵
  PID:6544
- C:\Windows\System\dOVEDsy.exe
  C:\Windows\System\dOVEDsy.exe
  2⤵
  PID:6644
- C:\Windows\System\lauIGKC.exe
  C:\Windows\System\lauIGKC.exe
  2⤵
  PID:6964
- C:\Windows\System\GdkLszL.exe
  C:\Windows\System\GdkLszL.exe
  2⤵
  PID:6748
- C:\Windows\System\ufOzaYD.exe
  C:\Windows\System\ufOzaYD.exe
  2⤵
  PID:6768
- C:\Windows\System\RdbzKvH.exe
  C:\Windows\System\RdbzKvH.exe
  2⤵
  PID:6788
- C:\Windows\System\iiLitNV.exe
  C:\Windows\System\iiLitNV.exe
  2⤵
  PID:6808
- C:\Windows\System\YIxkyXn.exe
  C:\Windows\System\YIxkyXn.exe
  2⤵
  PID:6832
- C:\Windows\System\hXVjuQB.exe
  C:\Windows\System\hXVjuQB.exe
  2⤵
  PID:6864
- C:\Windows\System\sXaKXBI.exe
  C:\Windows\System\sXaKXBI.exe
  2⤵
  PID:6944
- C:\Windows\System\nCzuZRz.exe
  C:\Windows\System\nCzuZRz.exe
  2⤵
  PID:6824
- C:\Windows\System\gotjSjn.exe
  C:\Windows\System\gotjSjn.exe
  2⤵
  PID:6860
- C:\Windows\System\UaVEMKZ.exe
  C:\Windows\System\UaVEMKZ.exe
  2⤵
  PID:6876
- C:\Windows\System\UuqNzaz.exe
  C:\Windows\System\UuqNzaz.exe
  2⤵
  PID:6904
- C:\Windows\System\cjCSttL.exe
  C:\Windows\System\cjCSttL.exe
  2⤵
  PID:6928
- C:\Windows\System\xHoBEcm.exe
  C:\Windows\System\xHoBEcm.exe
  2⤵
  PID:6960
- C:\Windows\System\tHWqxSz.exe
  C:\Windows\System\tHWqxSz.exe
  2⤵
  PID:6976
- C:\Windows\System\Wugznnd.exe
  C:\Windows\System\Wugznnd.exe
  2⤵
  PID:6992
- C:\Windows\System\umRDZmc.exe
  C:\Windows\System\umRDZmc.exe
  2⤵
  PID:7012
- C:\Windows\System\zffrZjf.exe
  C:\Windows\System\zffrZjf.exe
  2⤵
  PID:7028
- C:\Windows\System\gvTGJRz.exe
  C:\Windows\System\gvTGJRz.exe
  2⤵
  PID:6676
- C:\Windows\System\FnEmFLK.exe
  C:\Windows\System\FnEmFLK.exe
  2⤵
  PID:7040
- C:\Windows\System\VHsWmzn.exe
  C:\Windows\System\VHsWmzn.exe
  2⤵
  PID:7116
- C:\Windows\System\vjIUHdg.exe
  C:\Windows\System\vjIUHdg.exe
  2⤵
  PID:6160
- C:\Windows\System\xdrcJRj.exe
  C:\Windows\System\xdrcJRj.exe
  2⤵
  PID:6360
- C:\Windows\System\oRZJnoJ.exe
  C:\Windows\System\oRZJnoJ.exe
  2⤵
  PID:6524
- C:\Windows\System\eyNnxTD.exe
  C:\Windows\System\eyNnxTD.exe
  2⤵
  PID:7128
- C:\Windows\System\INRVkXe.exe
  C:\Windows\System\INRVkXe.exe
  2⤵
  PID:6308
- C:\Windows\System\zwMDLnu.exe
  C:\Windows\System\zwMDLnu.exe
  2⤵
  PID:6464
- C:\Windows\System\QWputbw.exe
  C:\Windows\System\QWputbw.exe
  2⤵
  PID:7056
- C:\Windows\System\ofvypjK.exe
  C:\Windows\System\ofvypjK.exe
  2⤵
  PID:6196
- C:\Windows\System\ToYlTgn.exe
  C:\Windows\System\ToYlTgn.exe
  2⤵
  PID:7132
- C:\Windows\System\LSAXdCM.exe
  C:\Windows\System\LSAXdCM.exe
  2⤵
  PID:6256
- C:\Windows\System\qVeqnOk.exe
  C:\Windows\System\qVeqnOk.exe
  2⤵
  PID:6508
- C:\Windows\System\UPYLBjT.exe
  C:\Windows\System\UPYLBjT.exe
  2⤵
  PID:6272
- C:\Windows\System\LxHmHQb.exe
  C:\Windows\System\LxHmHQb.exe
  2⤵
  PID:6552
- C:\Windows\System\jAYcUHL.exe
  C:\Windows\System\jAYcUHL.exe
  2⤵
  PID:6640
- C:\Windows\System\GfEwvOq.exe
  C:\Windows\System\GfEwvOq.exe
  2⤵
  PID:6696
- C:\Windows\System\GpzrsMr.exe
  C:\Windows\System\GpzrsMr.exe
  2⤵
  PID:6672
- C:\Windows\System\jCKLGLR.exe
  C:\Windows\System\jCKLGLR.exe
  2⤵
  PID:6700
- C:\Windows\System\ryzExLO.exe
  C:\Windows\System\ryzExLO.exe
  2⤵
  PID:7096
- C:\Windows\System\sHRVQhj.exe
  C:\Windows\System\sHRVQhj.exe
  2⤵
  PID:7148
- C:\Windows\System\HfDXjek.exe
  C:\Windows\System\HfDXjek.exe
  2⤵
  PID:7024
- C:\Windows\System\JkhylkN.exe
  C:\Windows\System\JkhylkN.exe
  2⤵
  PID:6180
- C:\Windows\System\oXnnrSR.exe
  C:\Windows\System\oXnnrSR.exe
  2⤵
  PID:6920
- C:\Windows\System\hACmMNF.exe
  C:\Windows\System\hACmMNF.exe
  2⤵
  PID:7036
- C:\Windows\System\ezrsfGj.exe
  C:\Windows\System\ezrsfGj.exe
  2⤵
  PID:6412
- C:\Windows\System\yxlaTqe.exe
  C:\Windows\System\yxlaTqe.exe
  2⤵
  PID:6548
- C:\Windows\System\CXhKPWq.exe
  C:\Windows\System\CXhKPWq.exe
  2⤵
  PID:6636
- C:\Windows\System\pqtJaBt.exe
  C:\Windows\System\pqtJaBt.exe
  2⤵
  PID:6816
- C:\Windows\System\gdYXoMI.exe
  C:\Windows\System\gdYXoMI.exe
  2⤵
  PID:6784
- C:\Windows\System\LLQKsbr.exe
  C:\Windows\System\LLQKsbr.exe
  2⤵
  PID:6804
- C:\Windows\System\NIKTDcq.exe
  C:\Windows\System\NIKTDcq.exe
  2⤵
  PID:6656
- C:\Windows\System\sMbiQnY.exe
  C:\Windows\System\sMbiQnY.exe
  2⤵
  PID:7060
- C:\Windows\System\dljXCZM.exe
  C:\Windows\System\dljXCZM.exe
  2⤵
  PID:6916
- C:\Windows\System\EvxuaSz.exe
  C:\Windows\System\EvxuaSz.exe
  2⤵
  PID:6376
- C:\Windows\System\CNXfbhI.exe
  C:\Windows\System\CNXfbhI.exe
  2⤵
  PID:6912
- C:\Windows\System\WJBunLi.exe
  C:\Windows\System\WJBunLi.exe
  2⤵
  PID:6936
- C:\Windows\System\ELxPyQf.exe
  C:\Windows\System\ELxPyQf.exe
  2⤵
  PID:6968
- C:\Windows\System\caWKmoo.exe
  C:\Windows\System\caWKmoo.exe
  2⤵
  PID:6584
- C:\Windows\System\VmOTUsA.exe
  C:\Windows\System\VmOTUsA.exe
  2⤵
  PID:6892
- C:\Windows\System\pPVLzkE.exe
  C:\Windows\System\pPVLzkE.exe
  2⤵
  PID:6228
- C:\Windows\System\YhRvVQy.exe
  C:\Windows\System\YhRvVQy.exe
  2⤵
  PID:6812
- C:\Windows\System\LgiWbxi.exe
  C:\Windows\System\LgiWbxi.exe
  2⤵
  PID:6800
- C:\Windows\System\AdZrnEU.exe
  C:\Windows\System\AdZrnEU.exe
  2⤵
  PID:6744
- C:\Windows\System\YZvFJWG.exe
  C:\Windows\System\YZvFJWG.exe
  2⤵
  PID:6796
- C:\Windows\System\UMaQKdk.exe
  C:\Windows\System\UMaQKdk.exe
  2⤵
  PID:6988
- C:\Windows\System\BzdEMyT.exe
  C:\Windows\System\BzdEMyT.exe
  2⤵
  PID:7172
- C:\Windows\System\JbJazPM.exe
  C:\Windows\System\JbJazPM.exe
  2⤵
  PID:7192
- C:\Windows\System\cbZdVEF.exe
  C:\Windows\System\cbZdVEF.exe
  2⤵
  PID:7208
- C:\Windows\System\SglnUzF.exe
  C:\Windows\System\SglnUzF.exe
  2⤵
  PID:7228
- C:\Windows\System\NDOlKHZ.exe
  C:\Windows\System\NDOlKHZ.exe
  2⤵
  PID:7328
- C:\Windows\System\rLmJavR.exe
  C:\Windows\System\rLmJavR.exe
  2⤵
  PID:7348
- C:\Windows\System\BEOODRs.exe
  C:\Windows\System\BEOODRs.exe
  2⤵
  PID:7364
- C:\Windows\System\yWGMyoW.exe
  C:\Windows\System\yWGMyoW.exe
  2⤵
  PID:7380
- C:\Windows\System\edrVpgC.exe
  C:\Windows\System\edrVpgC.exe
  2⤵
  PID:7396
- C:\Windows\System\ZjSZHMC.exe
  C:\Windows\System\ZjSZHMC.exe
  2⤵
  PID:7416
- C:\Windows\System\YhiIrYK.exe
  C:\Windows\System\YhiIrYK.exe
  2⤵
  PID:7456
- C:\Windows\System\zHanFoz.exe
  C:\Windows\System\zHanFoz.exe
  2⤵
  PID:7472
- C:\Windows\System\wBWDNPw.exe
  C:\Windows\System\wBWDNPw.exe
  2⤵
  PID:7496
- C:\Windows\System\yvVzask.exe
  C:\Windows\System\yvVzask.exe
  2⤵
  PID:7544
- C:\Windows\System\DNMnkAP.exe
  C:\Windows\System\DNMnkAP.exe
  2⤵
  PID:7564
- C:\Windows\System\imFnmKH.exe
  C:\Windows\System\imFnmKH.exe
  2⤵
  PID:7584
- C:\Windows\System\qmAOmND.exe
  C:\Windows\System\qmAOmND.exe
  2⤵
  PID:7600
- C:\Windows\System\pOOUkWg.exe
  C:\Windows\System\pOOUkWg.exe
  2⤵
  PID:7616
- C:\Windows\System\qPjUjpi.exe
  C:\Windows\System\qPjUjpi.exe
  2⤵
  PID:7632
- C:\Windows\System\LlwNpvX.exe
  C:\Windows\System\LlwNpvX.exe
  2⤵
  PID:7648
- C:\Windows\System\njWHaBs.exe
  C:\Windows\System\njWHaBs.exe
  2⤵
  PID:7792
- C:\Windows\System\SNGgNXG.exe
  C:\Windows\System\SNGgNXG.exe
  2⤵
  PID:7808
- C:\Windows\System\EQQpzHo.exe
  C:\Windows\System\EQQpzHo.exe
  2⤵
  PID:7836
- C:\Windows\System\QwzSdzq.exe
  C:\Windows\System\QwzSdzq.exe
  2⤵
  PID:7852
- C:\Windows\System\FxtUPms.exe
  C:\Windows\System\FxtUPms.exe
  2⤵
  PID:7868
- C:\Windows\System\XtnfFYR.exe
  C:\Windows\System\XtnfFYR.exe
  2⤵
  PID:7884
- C:\Windows\System\vxnbtgl.exe
  C:\Windows\System\vxnbtgl.exe
  2⤵
  PID:7900
- C:\Windows\System\ZlcbXyE.exe
  C:\Windows\System\ZlcbXyE.exe
  2⤵
  PID:7916
- C:\Windows\System\wiHRTtq.exe
  C:\Windows\System\wiHRTtq.exe
  2⤵
  PID:7932
- C:\Windows\System\BCOCKPc.exe
  C:\Windows\System\BCOCKPc.exe
  2⤵
  PID:7980
- C:\Windows\System\AvyzFES.exe
  C:\Windows\System\AvyzFES.exe
  2⤵
  PID:8000
- C:\Windows\System\OZFipqD.exe
  C:\Windows\System\OZFipqD.exe
  2⤵
  PID:8016
- C:\Windows\System\PLIpuHk.exe
  C:\Windows\System\PLIpuHk.exe
  2⤵
  PID:8032
- C:\Windows\System\fpaGrvc.exe
  C:\Windows\System\fpaGrvc.exe
  2⤵
  PID:8048
- C:\Windows\System\TjOyRfl.exe
  C:\Windows\System\TjOyRfl.exe
  2⤵
  PID:8064
- C:\Windows\System\pgTpxMH.exe
  C:\Windows\System\pgTpxMH.exe
  2⤵
  PID:8080
- C:\Windows\System\zdpHWrJ.exe
  C:\Windows\System\zdpHWrJ.exe
  2⤵
  PID:8096
- C:\Windows\System\ADqDyAF.exe
  C:\Windows\System\ADqDyAF.exe
  2⤵
  PID:8112
- C:\Windows\System\NJojxPL.exe
  C:\Windows\System\NJojxPL.exe
  2⤵
  PID:8128
- C:\Windows\System\eUCftgI.exe
  C:\Windows\System\eUCftgI.exe
  2⤵
  PID:8144
- C:\Windows\System\DqRNCaj.exe
  C:\Windows\System\DqRNCaj.exe
  2⤵
  PID:6736
- C:\Windows\System\MLioOEM.exe
  C:\Windows\System\MLioOEM.exe
  2⤵
  PID:6844
- C:\Windows\System\hUcSdpT.exe
  C:\Windows\System\hUcSdpT.exe
  2⤵
  PID:7216
- C:\Windows\System\XNbkGXV.exe
  C:\Windows\System\XNbkGXV.exe
  2⤵
  PID:7412
- C:\Windows\System\NCiqfzY.exe
  C:\Windows\System\NCiqfzY.exe
  2⤵
  PID:7376
- C:\Windows\System\FSAtXAI.exe
  C:\Windows\System\FSAtXAI.exe
  2⤵
  PID:7260
- C:\Windows\System\NVKFObV.exe
  C:\Windows\System\NVKFObV.exe
  2⤵
  PID:7288
- C:\Windows\System\ripsRQo.exe
  C:\Windows\System\ripsRQo.exe
  2⤵
  PID:7308
- C:\Windows\System\jhlwrwM.exe
  C:\Windows\System\jhlwrwM.exe
  2⤵
  PID:7484
- C:\Windows\System\yxprQnY.exe
  C:\Windows\System\yxprQnY.exe
  2⤵
  PID:7596
- C:\Windows\System\weyMVox.exe
  C:\Windows\System\weyMVox.exe
  2⤵
  PID:7536
- C:\Windows\System\rrSXqCT.exe
  C:\Windows\System\rrSXqCT.exe
  2⤵
  PID:7640
- C:\Windows\System\XqleVde.exe
  C:\Windows\System\XqleVde.exe
  2⤵
  PID:7876
- C:\Windows\System\GOMbYjP.exe
  C:\Windows\System\GOMbYjP.exe
  2⤵
  PID:7724
- C:\Windows\System\ThChtFW.exe
  C:\Windows\System\ThChtFW.exe
  2⤵
  PID:7712
- C:\Windows\System\TyzPImv.exe
  C:\Windows\System\TyzPImv.exe
  2⤵
  PID:7740
- C:\Windows\System\NrQLSQF.exe
  C:\Windows\System\NrQLSQF.exe
  2⤵
  PID:7748
- C:\Windows\System\MKiTWqR.exe
  C:\Windows\System\MKiTWqR.exe
  2⤵
  PID:7764
- C:\Windows\System\QqJBoap.exe
  C:\Windows\System\QqJBoap.exe
  2⤵
  PID:7780
- C:\Windows\System\TKnnOzt.exe
  C:\Windows\System\TKnnOzt.exe
  2⤵
  PID:7824
- C:\Windows\System\lsQAotl.exe
  C:\Windows\System\lsQAotl.exe
  2⤵
  PID:7864
- C:\Windows\System\nErFHFl.exe
  C:\Windows\System\nErFHFl.exe
  2⤵
  PID:8164
- C:\Windows\System\RismLJr.exe
  C:\Windows\System\RismLJr.exe
  2⤵
  PID:8184
- C:\Windows\System\ZBpTyNn.exe
  C:\Windows\System\ZBpTyNn.exe
  2⤵
  PID:8024
- C:\Windows\System\frvamIF.exe
  C:\Windows\System\frvamIF.exe
  2⤵
  PID:8124
- C:\Windows\System\dKvOsSh.exe
  C:\Windows\System\dKvOsSh.exe
  2⤵
  PID:8168
- C:\Windows\System\PlABmtu.exe
  C:\Windows\System\PlABmtu.exe
  2⤵
  PID:8180
- C:\Windows\System\lUdedQB.exe
  C:\Windows\System\lUdedQB.exe
  2⤵
  PID:7240
- C:\Windows\System\hVSxmso.exe
  C:\Windows\System\hVSxmso.exe
  2⤵
  PID:7052
- C:\Windows\System\YRvhwWI.exe
  C:\Windows\System\YRvhwWI.exe
  2⤵
  PID:7184
- C:\Windows\System\YXYfXxd.exe
  C:\Windows\System\YXYfXxd.exe
  2⤵
  PID:6692
- C:\Windows\System\XFMGmpK.exe
  C:\Windows\System\XFMGmpK.exe
  2⤵
  PID:7272
- C:\Windows\System\gztBWUA.exe
  C:\Windows\System\gztBWUA.exe
  2⤵
  PID:7280
- C:\Windows\System\oKWGjvP.exe
  C:\Windows\System\oKWGjvP.exe
  2⤵
  PID:6760
- C:\Windows\System\cRDFBiz.exe
  C:\Windows\System\cRDFBiz.exe
  2⤵
  PID:7252
- C:\Windows\System\xXCbOJN.exe
  C:\Windows\System\xXCbOJN.exe
  2⤵
  PID:7480
- C:\Windows\System\prroTrC.exe
  C:\Windows\System\prroTrC.exe
  2⤵
  PID:6296
- C:\Windows\System\vswGcWn.exe
  C:\Windows\System\vswGcWn.exe
  2⤵
  PID:7772
- C:\Windows\System\OrzPpum.exe
  C:\Windows\System\OrzPpum.exe
  2⤵
  PID:7924
- C:\Windows\System\fqcIzjW.exe
  C:\Windows\System\fqcIzjW.exe
  2⤵
  PID:7268
- C:\Windows\System\YOAvsyN.exe
  C:\Windows\System\YOAvsyN.exe
  2⤵
  PID:7572
- C:\Windows\System\PxdVLjO.exe
  C:\Windows\System\PxdVLjO.exe
  2⤵
  PID:7908
- C:\Windows\System\PgvNqWw.exe
  C:\Windows\System\PgvNqWw.exe
  2⤵
  PID:7760
- C:\Windows\System\FcuhCOg.exe
  C:\Windows\System\FcuhCOg.exe
  2⤵
  PID:8044
- C:\Windows\System\ESUHdph.exe
  C:\Windows\System\ESUHdph.exe
  2⤵
  PID:6600
- C:\Windows\System\VqeZavj.exe
  C:\Windows\System\VqeZavj.exe
  2⤵
  PID:8156
- C:\Windows\System\KtxKnoL.exe
  C:\Windows\System\KtxKnoL.exe
  2⤵
  PID:7360
- C:\Windows\System\IkUsdAF.exe
  C:\Windows\System\IkUsdAF.exe
  2⤵
  PID:7388
- C:\Windows\System\KbdqcoY.exe
  C:\Windows\System\KbdqcoY.exe
  2⤵
  PID:6344
- C:\Windows\System\AxRLfrl.exe
  C:\Windows\System\AxRLfrl.exe
  2⤵
  PID:7628
- C:\Windows\System\JoGuujp.exe
  C:\Windows\System\JoGuujp.exe
  2⤵
  PID:7688
- C:\Windows\System\SsijKMM.exe
  C:\Windows\System\SsijKMM.exe
  2⤵
  PID:7520
- C:\Windows\System\mowQSjR.exe
  C:\Windows\System\mowQSjR.exe
  2⤵
  PID:7844
- C:\Windows\System\Kztjpvv.exe
  C:\Windows\System\Kztjpvv.exe
  2⤵
  PID:7436
- C:\Windows\System\QBggend.exe
  C:\Windows\System\QBggend.exe
  2⤵
  PID:8060
- C:\Windows\System\KhueVWp.exe
  C:\Windows\System\KhueVWp.exe
  2⤵
  PID:7660
- C:\Windows\System\QxiPrto.exe
  C:\Windows\System\QxiPrto.exe
  2⤵
  PID:8092
- C:\Windows\System\YSLPFBh.exe
  C:\Windows\System\YSLPFBh.exe
  2⤵
  PID:8072
- C:\Windows\System\YslldKX.exe
  C:\Windows\System\YslldKX.exe
  2⤵
  PID:7804
- C:\Windows\System\AhRuLee.exe
  C:\Windows\System\AhRuLee.exe
  2⤵
  PID:5884
- C:\Windows\System\RyyQNdu.exe
  C:\Windows\System\RyyQNdu.exe
  2⤵
  PID:7720
- C:\Windows\System\ZNawdEL.exe
  C:\Windows\System\ZNawdEL.exe
  2⤵
  PID:940
- C:\Windows\System\BmeiDyQ.exe
  C:\Windows\System\BmeiDyQ.exe
  2⤵
  PID:7972
- C:\Windows\System\kUrLzLV.exe
  C:\Windows\System\kUrLzLV.exe
  2⤵
  PID:7304
- C:\Windows\System\MJBegkE.exe
  C:\Windows\System\MJBegkE.exe
  2⤵
  PID:7344
- C:\Windows\System\hGHVpIj.exe
  C:\Windows\System\hGHVpIj.exe
  2⤵
  PID:6652
- C:\Windows\System\hlPRYHg.exe
  C:\Windows\System\hlPRYHg.exe
  2⤵
  PID:7788
- C:\Windows\System\LtUyxUp.exe
  C:\Windows\System\LtUyxUp.exe
  2⤵
  PID:7068
- C:\Windows\System\HRaVaGC.exe
  C:\Windows\System\HRaVaGC.exe
  2⤵
  PID:8140
- C:\Windows\System\YOPbAxc.exe
  C:\Windows\System\YOPbAxc.exe
  2⤵
  PID:8160
- C:\Windows\System\PDyWnND.exe
  C:\Windows\System\PDyWnND.exe
  2⤵
  PID:6896
- C:\Windows\System\rVRcOqm.exe
  C:\Windows\System\rVRcOqm.exe
  2⤵
  PID:7956
- C:\Windows\System\sPOgwlE.exe
  C:\Windows\System\sPOgwlE.exe
  2⤵
  PID:7968
- C:\Windows\System\tamysXi.exe
  C:\Windows\System\tamysXi.exe
  2⤵
  PID:8012
- C:\Windows\System\uReDDJd.exe
  C:\Windows\System\uReDDJd.exe
  2⤵
  PID:2408
- C:\Windows\System\JXykorc.exe
  C:\Windows\System\JXykorc.exe
  2⤵
  PID:7532
- C:\Windows\System\vVjanCd.exe
  C:\Windows\System\vVjanCd.exe
  2⤵
  PID:7512
- C:\Windows\System\hLSKaFf.exe
  C:\Windows\System\hLSKaFf.exe
  2⤵
  PID:7848
- C:\Windows\System\awXYqMy.exe
  C:\Windows\System\awXYqMy.exe
  2⤵
  PID:7608
- C:\Windows\System\AEXrhmC.exe
  C:\Windows\System\AEXrhmC.exe
  2⤵
  PID:2780
- C:\Windows\System\NhXSQwF.exe
  C:\Windows\System\NhXSQwF.exe
  2⤵
  PID:8120
- C:\Windows\System\YydzgwX.exe
  C:\Windows\System\YydzgwX.exe
  2⤵
  PID:1528
- C:\Windows\System\LSuZWWY.exe
  C:\Windows\System\LSuZWWY.exe
  2⤵
  PID:7552
- C:\Windows\System\hPtawQr.exe
  C:\Windows\System\hPtawQr.exe
  2⤵
  PID:7048
- C:\Windows\System\rLkxZus.exe
  C:\Windows\System\rLkxZus.exe
  2⤵
  PID:7560
- C:\Windows\System\yQuBMYR.exe
  C:\Windows\System\yQuBMYR.exe
  2⤵
  PID:7940
- C:\Windows\System\PrIUsFB.exe
  C:\Windows\System\PrIUsFB.exe
  2⤵
  PID:7708
- C:\Windows\System\MJLPOuT.exe
  C:\Windows\System\MJLPOuT.exe
  2⤵
  PID:7756
- C:\Windows\System\BEdLlaP.exe
  C:\Windows\System\BEdLlaP.exe
  2⤵
  PID:8136
- C:\Windows\System\jMPpYye.exe
  C:\Windows\System\jMPpYye.exe
  2⤵
  PID:7860
- C:\Windows\System\SAPsVAt.exe
  C:\Windows\System\SAPsVAt.exe
  2⤵
  PID:7468
- C:\Windows\System\HFcvEcu.exe
  C:\Windows\System\HFcvEcu.exe
  2⤵
  PID:8088
- C:\Windows\System\ZSsSNKT.exe
  C:\Windows\System\ZSsSNKT.exe
  2⤵
  PID:7700
- C:\Windows\System\IIhssjN.exe
  C:\Windows\System\IIhssjN.exe
  2⤵
  PID:7800
- C:\Windows\System\wKxMiCe.exe
  C:\Windows\System\wKxMiCe.exe
  2⤵
  PID:6628
- C:\Windows\System\BbVZRLz.exe
  C:\Windows\System\BbVZRLz.exe
  2⤵
  PID:7200
- C:\Windows\System\ZvRzpvU.exe
  C:\Windows\System\ZvRzpvU.exe
  2⤵
  PID:8104
- C:\Windows\System\cponlPB.exe
  C:\Windows\System\cponlPB.exe
  2⤵
  PID:7256
- C:\Windows\System\nPEERWj.exe
  C:\Windows\System\nPEERWj.exe
  2⤵
  PID:8176
- C:\Windows\System\Qpwghlr.exe
  C:\Windows\System\Qpwghlr.exe
  2⤵
  PID:3764
- C:\Windows\System\nrCynko.exe
  C:\Windows\System\nrCynko.exe
  2⤵
  PID:7704
- C:\Windows\System\wmAygOk.exe
  C:\Windows\System\wmAygOk.exe
  2⤵
  PID:7684
- C:\Windows\System\rlwINBS.exe
  C:\Windows\System\rlwINBS.exe
  2⤵
  PID:8040
- C:\Windows\System\CBtNsJR.exe
  C:\Windows\System\CBtNsJR.exe
  2⤵
  PID:7944
- C:\Windows\System\qIqfIOS.exe
  C:\Windows\System\qIqfIOS.exe
  2⤵
  PID:8076
- C:\Windows\System\aTyfkOJ.exe
  C:\Windows\System\aTyfkOJ.exe
  2⤵
  PID:8208
- C:\Windows\System\wBHIXKx.exe
  C:\Windows\System\wBHIXKx.exe
  2⤵
  PID:8228
- C:\Windows\System\akPMgYF.exe
  C:\Windows\System\akPMgYF.exe
  2⤵
  PID:8244
- C:\Windows\System\PTgLrem.exe
  C:\Windows\System\PTgLrem.exe
  2⤵
  PID:8260
- C:\Windows\System\NkOJBeL.exe
  C:\Windows\System\NkOJBeL.exe
  2⤵
  PID:8276
- C:\Windows\System\GqcCWZA.exe
  C:\Windows\System\GqcCWZA.exe
  2⤵
  PID:8292
- C:\Windows\System\egzaYax.exe
  C:\Windows\System\egzaYax.exe
  2⤵
  PID:8312
- C:\Windows\System\amzWyxr.exe
  C:\Windows\System\amzWyxr.exe
  2⤵
  PID:8328
- C:\Windows\System\zdRTJGl.exe
  C:\Windows\System\zdRTJGl.exe
  2⤵
  PID:8344
- C:\Windows\System\wBuWCdH.exe
  C:\Windows\System\wBuWCdH.exe
  2⤵
  PID:8360
- C:\Windows\System\ywENzFX.exe
  C:\Windows\System\ywENzFX.exe
  2⤵
  PID:8380
- C:\Windows\System\xcgYleg.exe
  C:\Windows\System\xcgYleg.exe
  2⤵
  PID:8396
- C:\Windows\System\yycPxeI.exe
  C:\Windows\System\yycPxeI.exe
  2⤵
  PID:8412
- C:\Windows\System\dFEiDoN.exe
  C:\Windows\System\dFEiDoN.exe
  2⤵
  PID:8428
- C:\Windows\System\opJFJoi.exe
  C:\Windows\System\opJFJoi.exe
  2⤵
  PID:8444
- C:\Windows\System\IJJXBKa.exe
  C:\Windows\System\IJJXBKa.exe
  2⤵
  PID:8460
- C:\Windows\System\vJHlHUn.exe
  C:\Windows\System\vJHlHUn.exe
  2⤵
  PID:8476
- C:\Windows\System\JyIKvFs.exe
  C:\Windows\System\JyIKvFs.exe
  2⤵
  PID:8492
- C:\Windows\System\CuHYSoP.exe
  C:\Windows\System\CuHYSoP.exe
  2⤵
  PID:8512
- C:\Windows\System\ZvBRwEE.exe
  C:\Windows\System\ZvBRwEE.exe
  2⤵
  PID:8528
- C:\Windows\System\tJyglHs.exe
  C:\Windows\System\tJyglHs.exe
  2⤵
  PID:8544
- C:\Windows\System\yDOcEqK.exe
  C:\Windows\System\yDOcEqK.exe
  2⤵
  PID:8560
- C:\Windows\System\vkjTQMa.exe
  C:\Windows\System\vkjTQMa.exe
  2⤵
  PID:8576
- C:\Windows\System\atXWvJU.exe
  C:\Windows\System\atXWvJU.exe
  2⤵
  PID:8596
- C:\Windows\System\dQHfgBX.exe
  C:\Windows\System\dQHfgBX.exe
  2⤵
  PID:8616
- C:\Windows\System\MLbdACD.exe
  C:\Windows\System\MLbdACD.exe
  2⤵
  PID:8632
- C:\Windows\System\vVRbXQD.exe
  C:\Windows\System\vVRbXQD.exe
  2⤵
  PID:8648
- C:\Windows\System\ybBBABZ.exe
  C:\Windows\System\ybBBABZ.exe
  2⤵
  PID:8664
- C:\Windows\System\HqPXLlP.exe
  C:\Windows\System\HqPXLlP.exe
  2⤵
  PID:8684
- C:\Windows\System\fMAePZF.exe
  C:\Windows\System\fMAePZF.exe
  2⤵
  PID:8700
- C:\Windows\System\hQMhKhQ.exe
  C:\Windows\System\hQMhKhQ.exe
  2⤵
  PID:8720
- C:\Windows\System\zHISPNm.exe
  C:\Windows\System\zHISPNm.exe
  2⤵
  PID:8736
- C:\Windows\System\KRbOgcF.exe
  C:\Windows\System\KRbOgcF.exe
  2⤵
  PID:8752
- C:\Windows\System\Bprdfxr.exe
  C:\Windows\System\Bprdfxr.exe
  2⤵
  PID:8772
- C:\Windows\System\qsmQTCD.exe
  C:\Windows\System\qsmQTCD.exe
  2⤵
  PID:8788
- C:\Windows\System\haUiFIk.exe
  C:\Windows\System\haUiFIk.exe
  2⤵
  PID:8804
- C:\Windows\System\UaxfSuj.exe
  C:\Windows\System\UaxfSuj.exe
  2⤵
  PID:8820
- C:\Windows\System\GOSCTIq.exe
  C:\Windows\System\GOSCTIq.exe
  2⤵
  PID:8836
- C:\Windows\System\uRmQKSb.exe
  C:\Windows\System\uRmQKSb.exe
  2⤵
  PID:8852
- C:\Windows\System\ZgXynqH.exe
  C:\Windows\System\ZgXynqH.exe
  2⤵
  PID:8868
- C:\Windows\System\atHkuMd.exe
  C:\Windows\System\atHkuMd.exe
  2⤵
  PID:8884
- C:\Windows\System\Jbcbayi.exe
  C:\Windows\System\Jbcbayi.exe
  2⤵
  PID:8900
- C:\Windows\System\fuPjcto.exe
  C:\Windows\System\fuPjcto.exe
  2⤵
  PID:8916
- C:\Windows\System\odsHdsB.exe
  C:\Windows\System\odsHdsB.exe
  2⤵
  PID:8932
- C:\Windows\System\IJtEszz.exe
  C:\Windows\System\IJtEszz.exe
  2⤵
  PID:8948
- C:\Windows\System\XfWJNGf.exe
  C:\Windows\System\XfWJNGf.exe
  2⤵
  PID:8964
- C:\Windows\System\YtvGmQr.exe
  C:\Windows\System\YtvGmQr.exe
  2⤵
  PID:8980
- C:\Windows\System\bDMaaeS.exe
  C:\Windows\System\bDMaaeS.exe
  2⤵
  PID:8996
- C:\Windows\System\fNGRXjE.exe
  C:\Windows\System\fNGRXjE.exe
  2⤵
  PID:9016
- C:\Windows\System\INacBDD.exe
  C:\Windows\System\INacBDD.exe
  2⤵
  PID:9032
- C:\Windows\System\tLRDpnr.exe
  C:\Windows\System\tLRDpnr.exe
  2⤵
  PID:9048
- C:\Windows\System\sqBTMdH.exe
  C:\Windows\System\sqBTMdH.exe
  2⤵
  PID:9068
- C:\Windows\System\cwwYtMJ.exe
  C:\Windows\System\cwwYtMJ.exe
  2⤵
  PID:9088
- C:\Windows\System\eYFUtZc.exe
  C:\Windows\System\eYFUtZc.exe
  2⤵
  PID:9104
- C:\Windows\System\pMNbouZ.exe
  C:\Windows\System\pMNbouZ.exe
  2⤵
  PID:9128
- C:\Windows\System\SzcvGFP.exe
  C:\Windows\System\SzcvGFP.exe
  2⤵
  PID:9148
- C:\Windows\System\zLFRsEj.exe
  C:\Windows\System\zLFRsEj.exe
  2⤵
  PID:9168
- C:\Windows\System\qFCGSat.exe
  C:\Windows\System\qFCGSat.exe
  2⤵
  PID:9184
- C:\Windows\System\uoxnNtL.exe
  C:\Windows\System\uoxnNtL.exe
  2⤵
  PID:8308
- C:\Windows\System\jHULQCD.exe
  C:\Windows\System\jHULQCD.exe
  2⤵
  PID:8500
- C:\Windows\System\hmtVqpU.exe
  C:\Windows\System\hmtVqpU.exe
  2⤵
  PID:8584
- C:\Windows\System\ZZbQoWe.exe
  C:\Windows\System\ZZbQoWe.exe
  2⤵
  PID:8540
- C:\Windows\System\LkZBtlK.exe
  C:\Windows\System\LkZBtlK.exe
  2⤵
  PID:8608
- C:\Windows\System\EikEhxZ.exe
  C:\Windows\System\EikEhxZ.exe
  2⤵
  PID:8640
- C:\Windows\System\zoxQaVw.exe
  C:\Windows\System\zoxQaVw.exe
  2⤵
  PID:8692
- C:\Windows\System\gIkBSZk.exe
  C:\Windows\System\gIkBSZk.exe
  2⤵
  PID:8800
- C:\Windows\System\Qmetklc.exe
  C:\Windows\System\Qmetklc.exe
  2⤵
  PID:8780
- C:\Windows\System\EcGjABg.exe
  C:\Windows\System\EcGjABg.exe
  2⤵
  PID:8860
- C:\Windows\System\oLHrWhm.exe
  C:\Windows\System\oLHrWhm.exe
  2⤵
  PID:8924
- C:\Windows\System\XFzLJcd.exe
  C:\Windows\System\XFzLJcd.exe
  2⤵
  PID:8988
- C:\Windows\System\FDJRfee.exe
  C:\Windows\System\FDJRfee.exe
  2⤵
  PID:9056
- C:\Windows\System\qJMoapp.exe
  C:\Windows\System\qJMoapp.exe
  2⤵
  PID:8880
- C:\Windows\System\kQTMePp.exe
  C:\Windows\System\kQTMePp.exe
  2⤵
  PID:8940
- C:\Windows\System\uaiVaWB.exe
  C:\Windows\System\uaiVaWB.exe
  2⤵
  PID:8972
- C:\Windows\System\SBrtKZx.exe
  C:\Windows\System\SBrtKZx.exe
  2⤵
  PID:9080
- C:\Windows\System\Xcnbned.exe
  C:\Windows\System\Xcnbned.exe
  2⤵
  PID:9124
- C:\Windows\System\jJrAHcI.exe
  C:\Windows\System\jJrAHcI.exe
  2⤵
  PID:9164
- C:\Windows\System\noDzYyK.exe
  C:\Windows\System\noDzYyK.exe
  2⤵
  PID:8204
- C:\Windows\System\bYKVYfB.exe
  C:\Windows\System\bYKVYfB.exe
  2⤵
  PID:9212
- C:\Windows\System\bCkEhif.exe
  C:\Windows\System\bCkEhif.exe
  2⤵
  PID:8372
- C:\Windows\System\PolSZsS.exe
  C:\Windows\System\PolSZsS.exe
  2⤵
  PID:8456
- C:\Windows\System\NBIquvL.exe
  C:\Windows\System\NBIquvL.exe
  2⤵
  PID:8624
- C:\Windows\System\MNuInBu.exe
  C:\Windows\System\MNuInBu.exe
  2⤵
  PID:8304
- C:\Windows\System\KfrifXy.exe
  C:\Windows\System\KfrifXy.exe
  2⤵
  PID:8956
- C:\Windows\System\Rpflzes.exe
  C:\Windows\System\Rpflzes.exe
  2⤵
  PID:9136
- C:\Windows\System\MudftLc.exe
  C:\Windows\System\MudftLc.exe
  2⤵
  PID:9012
- C:\Windows\System\PuKYttg.exe
  C:\Windows\System\PuKYttg.exe
  2⤵
  PID:9120
- C:\Windows\System\aCtPgky.exe
  C:\Windows\System\aCtPgky.exe
  2⤵
  PID:9044
- C:\Windows\System\CKxEOvs.exe
  C:\Windows\System\CKxEOvs.exe
  2⤵
  PID:8712
- C:\Windows\System\TuzjiHJ.exe
  C:\Windows\System\TuzjiHJ.exe
  2⤵
  PID:9176
- C:\Windows\System\DSnlWTV.exe
  C:\Windows\System\DSnlWTV.exe
  2⤵
  PID:8356
- C:\Windows\System\nMCRLSY.exe
  C:\Windows\System\nMCRLSY.exe
  2⤵
  PID:8336
- C:\Windows\System\JQwlcog.exe
  C:\Windows\System\JQwlcog.exe
  2⤵
  PID:8404
- C:\Windows\System\wMlHayr.exe
  C:\Windows\System\wMlHayr.exe
  2⤵
  PID:8324
- C:\Windows\System\BZhaPVX.exe
  C:\Windows\System\BZhaPVX.exe
  2⤵
  PID:8300
- C:\Windows\System\HQyPPwX.exe
  C:\Windows\System\HQyPPwX.exe
  2⤵
  PID:9228
- C:\Windows\System\ocOuPOh.exe
  C:\Windows\System\ocOuPOh.exe
  2⤵
  PID:9244
- C:\Windows\System\TvsRdAo.exe
  C:\Windows\System\TvsRdAo.exe
  2⤵
  PID:9260
- C:\Windows\System\jqTuPFm.exe
  C:\Windows\System\jqTuPFm.exe
  2⤵
  PID:9276
- C:\Windows\System\tTQCWft.exe
  C:\Windows\System\tTQCWft.exe
  2⤵
  PID:9348
- C:\Windows\System\rBQijvx.exe
  C:\Windows\System\rBQijvx.exe
  2⤵
  PID:9368
- C:\Windows\System\IXndUyU.exe
  C:\Windows\System\IXndUyU.exe
  2⤵
  PID:9384
- C:\Windows\System\uCLIzEE.exe
  C:\Windows\System\uCLIzEE.exe
  2⤵
  PID:9400
- C:\Windows\System\pRrFLkE.exe
  C:\Windows\System\pRrFLkE.exe
  2⤵
  PID:9416
- C:\Windows\System\tzPwPCI.exe
  C:\Windows\System\tzPwPCI.exe
  2⤵
  PID:9432
- C:\Windows\System\COjfDVz.exe
  C:\Windows\System\COjfDVz.exe
  2⤵
  PID:9448
- C:\Windows\System\lKCmFhi.exe
  C:\Windows\System\lKCmFhi.exe
  2⤵
  PID:9464
- C:\Windows\System\qqxNyLp.exe
  C:\Windows\System\qqxNyLp.exe
  2⤵
  PID:9480
- C:\Windows\System\WfBopZh.exe
  C:\Windows\System\WfBopZh.exe
  2⤵
  PID:9500
- C:\Windows\System\ZuWHhcJ.exe
  C:\Windows\System\ZuWHhcJ.exe
  2⤵
  PID:9524
- C:\Windows\System\GHKWBDQ.exe
  C:\Windows\System\GHKWBDQ.exe
  2⤵
  PID:9540
- C:\Windows\System\keEDxep.exe
  C:\Windows\System\keEDxep.exe
  2⤵
  PID:9560
- C:\Windows\System\kVkpPqb.exe
  C:\Windows\System\kVkpPqb.exe
  2⤵
  PID:9576
- C:\Windows\System\infTbcM.exe
  C:\Windows\System\infTbcM.exe
  2⤵
  PID:9592
- C:\Windows\System\jaOMLCW.exe
  C:\Windows\System\jaOMLCW.exe
  2⤵
  PID:9608
- C:\Windows\System\kZYYGyI.exe
  C:\Windows\System\kZYYGyI.exe
  2⤵
  PID:9624
- C:\Windows\System\AlUPQQo.exe
  C:\Windows\System\AlUPQQo.exe
  2⤵
  PID:9640
- C:\Windows\System\BpXpspe.exe
  C:\Windows\System\BpXpspe.exe
  2⤵
  PID:9656
- C:\Windows\System\GQqyPOD.exe
  C:\Windows\System\GQqyPOD.exe
  2⤵
  PID:9972
- C:\Windows\System\fphqkCM.exe
  C:\Windows\System\fphqkCM.exe
  2⤵
  PID:9988
- C:\Windows\System\zIhemLO.exe
  C:\Windows\System\zIhemLO.exe
  2⤵
  PID:10004
- C:\Windows\System\VtlFBtO.exe
  C:\Windows\System\VtlFBtO.exe
  2⤵
  PID:10092
- C:\Windows\System\TYctLzB.exe
  C:\Windows\System\TYctLzB.exe
  2⤵
  PID:10168
- C:\Windows\System\VCtBYNL.exe
  C:\Windows\System\VCtBYNL.exe
  2⤵
  PID:10184
- C:\Windows\System\BOOCFcH.exe
  C:\Windows\System\BOOCFcH.exe
  2⤵
  PID:10200
- C:\Windows\System\dtVNgPX.exe
  C:\Windows\System\dtVNgPX.exe
  2⤵
  PID:10220
- C:\Windows\System\WBfGBRv.exe
  C:\Windows\System\WBfGBRv.exe
  2⤵
  PID:8504
- C:\Windows\System\lOXvUYn.exe
  C:\Windows\System\lOXvUYn.exe
  2⤵
  PID:9224
- C:\Windows\System\uQwiDqA.exe
  C:\Windows\System\uQwiDqA.exe
  2⤵
  PID:9292
- C:\Windows\System\goyYWIb.exe
  C:\Windows\System\goyYWIb.exe
  2⤵
  PID:9304
- C:\Windows\System\ggtoVBW.exe
  C:\Windows\System\ggtoVBW.exe
  2⤵
  PID:9320
- C:\Windows\System\vVHTOgj.exe
  C:\Windows\System\vVHTOgj.exe
  2⤵
  PID:8592
- C:\Windows\System\jUsrAnj.exe
  C:\Windows\System\jUsrAnj.exe
  2⤵
  PID:9328
- C:\Windows\System\eAbADkD.exe
  C:\Windows\System\eAbADkD.exe
  2⤵
  PID:9200
- C:\Windows\System\CFKXSKj.exe
  C:\Windows\System\CFKXSKj.exe
  2⤵
  PID:8644
- C:\Windows\System\aKrgPcJ.exe
  C:\Windows\System\aKrgPcJ.exe
  2⤵
  PID:8892
- C:\Windows\System\KVJwbJX.exe
  C:\Windows\System\KVJwbJX.exe
  2⤵
  PID:9376
- C:\Windows\System\jdPCdTM.exe
  C:\Windows\System\jdPCdTM.exe
  2⤵
  PID:9408
- C:\Windows\System\hrWPWYB.exe
  C:\Windows\System\hrWPWYB.exe
  2⤵
  PID:9460
- C:\Windows\System\ynUrpYS.exe
  C:\Windows\System\ynUrpYS.exe
  2⤵
  PID:9456
- C:\Windows\System\rGQYvJC.exe
  C:\Windows\System\rGQYvJC.exe
  2⤵
  PID:9332
- C:\Windows\System\YLNBIVr.exe
  C:\Windows\System\YLNBIVr.exe
  2⤵
  PID:9392
- C:\Windows\System\wmCFHms.exe
  C:\Windows\System\wmCFHms.exe
  2⤵
  PID:9516
- C:\Windows\System\GUkJuhn.exe
  C:\Windows\System\GUkJuhn.exe
  2⤵
  PID:9556
- C:\Windows\System\CSyMqBV.exe
  C:\Windows\System\CSyMqBV.exe
  2⤵
  PID:9620
- C:\Windows\System\txJHSdF.exe
  C:\Windows\System\txJHSdF.exe
  2⤵
  PID:9536
- C:\Windows\System\OkVXOdN.exe
  C:\Windows\System\OkVXOdN.exe
  2⤵
  PID:9632
- C:\Windows\System\tSYvJMh.exe
  C:\Windows\System\tSYvJMh.exe
  2⤵
  PID:8272
- C:\Windows\System\pPxtPnu.exe
  C:\Windows\System\pPxtPnu.exe
  2⤵
  PID:8452
- C:\Windows\System\NlbGVNP.exe
  C:\Windows\System\NlbGVNP.exe
  2⤵
  PID:9684
- C:\Windows\System\CUHYygC.exe
  C:\Windows\System\CUHYygC.exe
  2⤵
  PID:9692
- C:\Windows\System\bYwLjTb.exe
  C:\Windows\System\bYwLjTb.exe
  2⤵
  PID:9732
- C:\Windows\System\deWagqG.exe
  C:\Windows\System\deWagqG.exe
  2⤵
  PID:9980
- C:\Windows\System\huEcCnl.exe
  C:\Windows\System\huEcCnl.exe
  2⤵
  PID:2796
- C:\Windows\System\aFGSnll.exe
  C:\Windows\System\aFGSnll.exe
  2⤵
  PID:10020
- C:\Windows\System\RJWlIEw.exe
  C:\Windows\System\RJWlIEw.exe
  2⤵
  PID:10040
- C:\Windows\System\TnWhyOE.exe
  C:\Windows\System\TnWhyOE.exe
  2⤵
  PID:964
- C:\Windows\System\iYhYZcG.exe
  C:\Windows\System\iYhYZcG.exe
  2⤵
  PID:10056
- C:\Windows\System\SKlzGqe.exe
  C:\Windows\System\SKlzGqe.exe
  2⤵
  PID:10072
- C:\Windows\System\aHpZBWa.exe
  C:\Windows\System\aHpZBWa.exe
  2⤵
  PID:9968
- C:\Windows\System\fZDpeOl.exe
  C:\Windows\System\fZDpeOl.exe
  2⤵
  PID:9676
- C:\Windows\System\Alybgyo.exe
  C:\Windows\System\Alybgyo.exe
  2⤵
  PID:9712
- C:\Windows\System\jVQeBXr.exe
  C:\Windows\System\jVQeBXr.exe
  2⤵
  PID:9772
- C:\Windows\System\yGXiDfO.exe
  C:\Windows\System\yGXiDfO.exe
  2⤵
  PID:9812
- C:\Windows\System\SKMDGyt.exe
  C:\Windows\System\SKMDGyt.exe
  2⤵
  PID:9836
- C:\Windows\System\ogbgIYm.exe
  C:\Windows\System\ogbgIYm.exe
  2⤵
  PID:9860
- C:\Windows\System\olPdYnl.exe
  C:\Windows\System\olPdYnl.exe
  2⤵
  PID:9900
- C:\Windows\System\AGIqhYT.exe
  C:\Windows\System\AGIqhYT.exe
  2⤵
  PID:1396
- C:\Windows\System\CBpdUkw.exe
  C:\Windows\System\CBpdUkw.exe
  2⤵
  PID:9960
- C:\Windows\System\MxOFCka.exe
  C:\Windows\System\MxOFCka.exe
  2⤵
  PID:9768
- C:\Windows\System\iLezZEs.exe
  C:\Windows\System\iLezZEs.exe
  2⤵
  PID:9800
- C:\Windows\System\mqGrRTC.exe
  C:\Windows\System\mqGrRTC.exe
  2⤵
  PID:9888
- C:\Windows\System\MCiPPeo.exe
  C:\Windows\System\MCiPPeo.exe
  2⤵
  PID:9928
- C:\Windows\System\AURJBLV.exe
  C:\Windows\System\AURJBLV.exe
  2⤵
  PID:10112
- C:\Windows\System\CxMmYgh.exe
  C:\Windows\System\CxMmYgh.exe
  2⤵
  PID:10124
- C:\Windows\System\dScuNFa.exe
  C:\Windows\System\dScuNFa.exe
  2⤵
  PID:10148
- C:\Windows\System\bRkcuWT.exe
  C:\Windows\System\bRkcuWT.exe
  2⤵
  PID:10100
- C:\Windows\System\AWcfjhb.exe
  C:\Windows\System\AWcfjhb.exe
  2⤵
  PID:10140
- C:\Windows\System\obrcuDf.exe
  C:\Windows\System\obrcuDf.exe
  2⤵
  PID:10180
- C:\Windows\System\KQnFAvZ.exe
  C:\Windows\System\KQnFAvZ.exe
  2⤵
  PID:10192
- C:\Windows\System\gnvjsHB.exe
  C:\Windows\System\gnvjsHB.exe
  2⤵
  PID:8472
- C:\Windows\System\OGUeeVC.exe
  C:\Windows\System\OGUeeVC.exe
  2⤵
  PID:8912
- C:\Windows\System\hTnoezy.exe
  C:\Windows\System\hTnoezy.exe
  2⤵
  PID:9288
- C:\Windows\System\PceWTTF.exe
  C:\Windows\System\PceWTTF.exe
  2⤵
  PID:8748
- C:\Windows\System\oMjIbKm.exe
  C:\Windows\System\oMjIbKm.exe
  2⤵
  PID:9272
- C:\Windows\System\DywraPS.exe
  C:\Windows\System\DywraPS.exe
  2⤵
  PID:9340
- C:\Windows\System\IxScGZb.exe
  C:\Windows\System\IxScGZb.exe
  2⤵
  PID:9284
- C:\Windows\System\MIcHkSE.exe
  C:\Windows\System\MIcHkSE.exe
  2⤵
  PID:8732
- C:\Windows\System\IcwGKWU.exe
  C:\Windows\System\IcwGKWU.exe
  2⤵
  PID:8768
- C:\Windows\System\rECmXGx.exe
  C:\Windows\System\rECmXGx.exe
  2⤵
  PID:8488
- C:\Windows\System\WVBfcjg.exe
  C:\Windows\System\WVBfcjg.exe
  2⤵
  PID:8424
- C:\Windows\System\ePWltyo.exe
  C:\Windows\System\ePWltyo.exe
  2⤵
  PID:9236
- C:\Windows\System\LvwUocZ.exe
  C:\Windows\System\LvwUocZ.exe
  2⤵
  PID:8288
- C:\Windows\System\sNoBQJL.exe
  C:\Windows\System\sNoBQJL.exe
  2⤵
  PID:8976
- C:\Windows\System\ZkNlody.exe
  C:\Windows\System\ZkNlody.exe
  2⤵
  PID:9428
- C:\Windows\System\vUfzTdy.exe
  C:\Windows\System\vUfzTdy.exe
  2⤵
  PID:9440
- C:\Windows\System\JZOaIwj.exe
  C:\Windows\System\JZOaIwj.exe
  2⤵
  PID:10216
- C:\Windows\System\yWfBWZp.exe
  C:\Windows\System\yWfBWZp.exe
  2⤵
  PID:9652
- C:\Windows\System\guFakER.exe
  C:\Windows\System\guFakER.exe
  2⤵
  PID:9668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcOmYfz.exe

Filesize
2.2MB

MD5
a1afe5d1bd506fcf8e2f51fc65e72802

SHA1
7f41d4150e551ada972ace63a8ef766c0e96e02e

SHA256
d04c776a56f4d2659225e62ea99f6b48e749230bb7c148cd3d5f7c5a38c5c239

SHA512
52226803797c167e7ed635efd35a126ec5ebaa3502d7cc3f31ae0a385373c882dc99b593fb0080eedcaf058f790e2acbbad8b0a22ad84f42199d8929cca84d7f

Download Submit
C:\Windows\system\HaEedLz.exe

Filesize
2.2MB

MD5
5abb7f53cb4931bd8dd828e949b94e00

SHA1
b867cd677d9397ca1f60f1d9af3d25a6e4b9b568

SHA256
a76af7e4f6ba76057c6503b14f5e1e8537dc99fbeba8dd4b98db42aed3131456

SHA512
92774a7c09581d51906f4162c1c627814e6f5312667e59c378f0339b77d6b2f1ee14c3d89c637217606af885610f76f44b0ec234cc2c2a10ded3f523e1a3063e

Download Submit
C:\Windows\system\IotKRCj.exe

Filesize
2.2MB

MD5
918be2b695ab1d9c729f698be80b8d6a

SHA1
209abec6b37d895b032771929a3653fd2b4687d3

SHA256
aa86182ef6af9ef1380452fe6979f92ce3c5f16e62ccfca0a94acda42654cc5f

SHA512
952488bf3ac011028781dec655201a5b38a8543aa1b2e56af97f941dab68f1f4f8a1031e93c0f7e3c06c394411a08d75bdaa370885f8baa7ccd7713652f79593

Download Submit
C:\Windows\system\NLHWrDc.exe

Filesize
2.2MB

MD5
857153a3789a034521345ecfb57533ce

SHA1
036da22ccf76e5766cd8b16e6fe84876f8821dbe

SHA256
8b68655dc5163539e7af81d75e189798fc55ea344247918a5d645b571997a0f9

SHA512
a03312c261a80a2a9771e05bfc8b142ed4913f4bffe9386db4f8b58ebcb4bdced8befb07170293eeab7c7ea5ac3ae4db987884bd38e60de927465cc878646af7

Download Submit
C:\Windows\system\QxNNKBW.exe

Filesize
2.2MB

MD5
a75c27f2875ecd231aefa5a88da8d9ed

SHA1
ecd554e5be642366337380c04f5136e04c1a3b89

SHA256
ae1f355ef8eb4d4eebb418a2f7778d0b204f253ee47e818e7dec51b37dad3178

SHA512
e3fe2baaa7885e80374e31634919015f0fd991a688f936bd1ea199b9716a9f6730344dc49239afe510b004153652c7f8114b757c397cf02a552e632ff85b6149

Download Submit
C:\Windows\system\VXRVvVP.exe

Filesize
2.2MB

MD5
f98cd6905c0a77c65aa478c01ee53de3

SHA1
08f1c6d26e666aced83567685aa5ed3e1079e772

SHA256
05a5f5041fd10f28f0b6d799d25c14d393b9cba6651b935471238986c2ddb1f5

SHA512
9567eb164b4050a7a8c3ad25840dc0c433973ab47a6cf4644bc88fc18a8b088ea2eeb7efbbb6c395a29d4d0fc4719ac1af01344b9a9691d90d63998432e1bcd3

Download Submit
C:\Windows\system\VqQETrb.exe

Filesize
2.2MB

MD5
ed33999d93d7642a326f4c3eb73aef1e

SHA1
b35f6f50241daa12625203d5d1129ddc45cc2262

SHA256
6afc064675c2483aee86c974902a2217374ffe1f4fef439c7ca28f44b6aef540

SHA512
b253d5ca03222b46da5010d45a995832e79088a06143e018db76acf8b7cf2371bc8654a6799ee72fdfb58e0423867ada64f3f0ef1b42ffed4cbd0f89cea7a536

Download Submit
C:\Windows\system\VuJllwL.exe

Filesize
2.2MB

MD5
2ceff1fe9d53280e4b1edf0b6a5bfe74

SHA1
b9ceff6e34fc2a64bf8918c30f3bdb26d3876fee

SHA256
e1e455080c58d47edb8f56b45de2d28a383d26105ac40698469109f4900cc4fb

SHA512
101eed390ac70c67c10664bbe84e854fe28d18547d489d2b36d6ad5c06f2d83e737553bdd64b1acb22fe02f9d9f51b9728e0acd92e622e5dc350906734d181ab

Download Submit
C:\Windows\system\VuQThtQ.exe

Filesize
2.2MB

MD5
ae61a26a13681ac98b25fcc9b72d7ff8

SHA1
9f04f952c8fa0d948b9857a7890642a5fb6ad29a

SHA256
132c1b6687fe81d61960117b38c70e2f79c70c35af92e0edfd19c9c722bba6b1

SHA512
59dc925abe660fcc775b6c5697bb2e98d4d5c6148e6b55dce75cb9bfcf052f6c2583b6dca379578f682cc7cc8893969d3bf747f6744bf9cd565d3021e39ece2f

Download Submit
C:\Windows\system\XLbwNOB.exe

Filesize
2.2MB

MD5
bbf34c64c180adcbd6bb141dfa80be22

SHA1
df705639eea03bc85b750f9f137cdd033ebb857a

SHA256
19007cb25fd2c3ad9ae1288de5d3e885228cc0d1a84fd73a98806274c57f58e3

SHA512
c55eb0093ff8ebf107f7337476df401f7d4da4e90bef52821563249d66b7966eed795337d5fddc004f821c1a5ae016065ef6ba10cfbb22d3e1dd4d0d98339d6f

Download Submit
C:\Windows\system\XldVmSP.exe

Filesize
2.2MB

MD5
ceb00917aca8ca7ff7a81fda2b42c52a

SHA1
3ca3af1abe7d6911a4634818f489cd752d18e0af

SHA256
7a9140f7de1db5804ba9642957418b7c119b37ef7d57c5c0356ebd48fdb8507d

SHA512
9d18d30eecd10ab0911e90eacccfc44ac0403c34a021207725ba9ef1c999a45c3c21e032ca7e69eb8f34b1767dd6a5dff35a0e6b02f9f769008e8b244e2c4bdb

Download Submit
C:\Windows\system\ZCvmJiy.exe

Filesize
2.2MB

MD5
6f378452eb777fac5476601261da1a0e

SHA1
9c1566e8f36171598c01b477a0cd7c79a3bc774d

SHA256
83177bebca9c3f11bc54e1de65abdf755fd5c2b680ce673411e882c58670bd52

SHA512
bf2186d4c1495e9b7240c3629e8f9809a731399e07977270504d76df551fccf6ce6f2bf9485c9ecb06ce6f1193460c63b447c2952057fb10d2f7d16e77b7416f

Download Submit
C:\Windows\system\ZgskWJJ.exe

Filesize
2.2MB

MD5
8a3c7d0e0bd57284fe8c141dfba8a0ea

SHA1
cc7212572ec092d7746b44189a695547db1d683d

SHA256
34f94bc8839a1f6c3ab27e2b17234656e0b9ddd575732988ef170685107a46d8

SHA512
9f3e2a210caa5525e8afe6eb68c1479e4b5e363504f187bcc4f8127121e8fcd152b3728f6b561a4fa294babe8daa11b8d947162d12e6cb0266d76b7603a1c917

Download Submit
C:\Windows\system\cCfhDjp.exe

Filesize
2.2MB

MD5
665e108d4ded7c9935eb7ec1c0903821

SHA1
02097aa04001f99f606a80368af88d72d6ffa1fd

SHA256
7ef8e74d8988e90f8345f4a8b1690fca892b4ee6a988ab5b5468dec04d28c858

SHA512
5f5e6d9efafe344c6b5b0cfd5cd9c4b9c3a5647bfbe6c84567173c4689c89f041902530990c421f719595d260064648d20d35abcd89b52e66a3ee348bb468539

Download Submit
C:\Windows\system\fLdwONB.exe

Filesize
2.2MB

MD5
b4cc3082cbd0a0a94f068bf351906e8e

SHA1
180036fe28a47e07a430f1e02d6647bd0c8d3670

SHA256
bbb8fbd3bf4a758e4275484e2f8dbf16e852b07c3684befcec6ea6806e04c858

SHA512
1fbc305a872bb2f2af6371d47a61ac2a7f059075e5e5b780a244148eb424b79abb68287715d7a92218b76a43f061b0e08aeaa2937f0ac887092761aadf3b26d5

Download Submit
C:\Windows\system\hrRvOjR.exe

Filesize
2.2MB

MD5
bd5d460fb0c6db637e5199deb9fca2c0

SHA1
7d832ea4fbabfc7c171f408602fc52dbb7b3ff13

SHA256
813b9e77483204fc288889c174e7e2b9e30305cb3e012a65b5fccfffed765c87

SHA512
997e9f6a34ca26fefeeccfe332597c3c47f7b053b8c1d51156b653c309a4cf26f8e78f7dab1e9a7202a0e815feaed0f6b2809f5605fb947973b14fc2a7de2c13

Download Submit
C:\Windows\system\iBuOOkK.exe

Filesize
2.2MB

MD5
216a2b0d7133fe58a9a8602e258513e2

SHA1
35440ae1dc0762a091748d8995c15f2c83ece8f1

SHA256
3c6b2e4679ce30a8d01f7b6a79ca15967dc9a6bfdc2b9db57f2b721c041dd60f

SHA512
7766ac79963644d6f5a90aef82e1a830eacadd5ed7ca1147af222a8fcdd7aa43e7fe50a9a2413f1281112952a108e1e809f8b356c373d522306b16cf86f6448d

Download Submit
C:\Windows\system\iDPMkgP.exe

Filesize
2.2MB

MD5
a3a2049313bb7fba4400e6d2c951a51c

SHA1
53af8c72c2ba0a0101a616ee1a365074914185ce

SHA256
062a4fd582121e2063bce6017507420749f15307d9f067fed5950e3db1ec5044

SHA512
99da7aad7a623230f73420481914e758b6e9979485c95ae52d7827d17d26fc976a3fea9349d3555fe0b832096d5301a1fcd6b7abefc454436a7771710d6a4a48

Download Submit
C:\Windows\system\kKGvFsk.exe

Filesize
2.2MB

MD5
dc34fd520200986dd87f39d1a778f39f

SHA1
228c773ed652beba4d74b070f5d4b56ba18b5297

SHA256
1889c82467cf78d78c3a52ac7e4ebcc546b42b9819a1725b0f8c737650e5f936

SHA512
22989de98cee01c86fe1d47ae924319c86d7c50752cdc29e29777e429f7b7458eecb1cc56c7f747a411b693e49ea9456d0b0c8cdcf985d70d436db3e2f13a527

Download Submit
C:\Windows\system\kRHRdJz.exe

Filesize
2.2MB

MD5
a29b5aed6458dbf55ade0764ee343907

SHA1
baa9793281eeacd33c1a8c095c3f28a763b8dd0e

SHA256
cbcbdd642a5721ee08bab426c7b5d38a94310f29c28ab74d3080992507060b16

SHA512
b5683c3969b09faaf321af08a0d11333498214f2fee7d7d7e72cd5e3b70cb252e2c032d5f18f7773a9e28abb62a3254a9fe19ba75d17d7e775291a19908c7969

Download Submit
C:\Windows\system\morgRNv.exe

Filesize
2.2MB

MD5
455e319424a73ca867da76a7919b0cc3

SHA1
8cf8636abb3bced83d38d5ae32bc31fa832721be

SHA256
9f219ad01bcb36ffca7c5343e1e0dcc7a7dcf1c9be7a491066a19de04703f0c9

SHA512
a06a4570bd14132747056340ee178717eba3044b7cd9fc632958a0f84dfc079cefb7f7c1cab707cf7523d832777b371731c94dd064b7dcf2c791ed9350b1918a

Download Submit
C:\Windows\system\npEecqC.exe

Filesize
2.2MB

MD5
e204b5d5e63d2d230c129444b4759c1e

SHA1
4b004d7d2b75adcbd7112c7c6b5237f7de1edf70

SHA256
21b8bbcd4fd0c9b9225dab82e61d3b06f0ef4fbfddbf2273fb3c68425d5a640d

SHA512
73adec0b4870912d9ffc2a364f4e033ed0ea40fc7d2a2507a4d28c2205cabb82b4f9bd95d58a1f6f8feea5f12337a6e4c8df56cf2554e10f7a7d614516575e5a

Download Submit
C:\Windows\system\pBgwhAp.exe

Filesize
2.2MB

MD5
18a5584acae6bc2eb2b3eecd9479e548

SHA1
cb219bdcc56a747f6c353457231002e9b0c80e4c

SHA256
8d2b617b26f150d02df17db3965f18e251a0e5738069b481d88eb1370ac48487

SHA512
dd4bb86916adb260d0e50b0766e94d33ec76b201fc7f61dd94153bfbedf80064967b3cc0359670f3fa063b3b0e6feb96a49d790a129b55dd92897bb66f97f53f

Download Submit
C:\Windows\system\viPApKv.exe

Filesize
2.2MB

MD5
190fd12a203250c11181531bb2598d3f

SHA1
a8be261281d1703a40acf1c0b4edd77e64a7c21f

SHA256
055a6294fecaf49ab3b116575d2da5ad3e2fba1cb0dc179754cc863f151d6286

SHA512
132989a6dfdcdcb80b493c25baae897ddf4da2e0f4498b556a448511e6d30cbaaa1777a1bd64e4ee5e83ae8d49d3bcb35be9c25ce170c40a77123d766603a0ae

Download Submit
C:\Windows\system\wMxUWUD.exe

Filesize
2.2MB

MD5
7a52eab262a591ec958e968ea8ed5e4d

SHA1
798f4bea596622a114538bb0cce6e989dd864d60

SHA256
05ee3aa6939386df05d9e7c7e87ae08733874e1043f6110cb2298b9a2921913f

SHA512
6593ed866bdf93585123b362c27eca06fa8b4a83827945e63d33d0676ba10ba1be094c5e632d93d6ec344527cddb729f41703fc92e73d513107bd38385245976

Download Submit
C:\Windows\system\zBWezVL.exe

Filesize
2.2MB

MD5
f05756e01288ab933eb1c67971e2fa91

SHA1
55dc633c908562c265a48f2bb70951ba60e49b5e

SHA256
24235b8324309ebd42d608492f82af5cecf5ef175232ef631151d7019044b5c8

SHA512
84fa85e1e6c000091a70b0fe76fb6d771ba50cbf1ec393c40cd5d138efd81f1079a1f195decbcc9e058c019e0cf75ab06883c7c354bc078fa896f2075032da24

Download Submit
C:\Windows\system\zFZUUle.exe

Filesize
2.2MB

MD5
176648b5f983167884e9b738fdebaf96

SHA1
eb6676a027a88431693b377075ab466a5be020f0

SHA256
245cb0df57b545dff6895caeac60976e8bb6b46ac59047bd4e1baaf83a54b12a

SHA512
476e105ca280024f4011e13585e3a1c9514d66379a13fa836d1c16066f453dc306acc186728d5ee9e096c5f9c89f52af4361705f9100892921624792ce2ff7ff

Download Submit
C:\Windows\system\zZQHwdr.exe

Filesize
2.2MB

MD5
cd1bd6a7fbc6a9cbb5284735208352d0

SHA1
706f99a74019b18f9e4b916ebc7280a7c7824fe7

SHA256
47fbccb3bca778516bd616b34c421932f07ff44b66415854e47bdb859a31071c

SHA512
b0caa766626f0da43c3426ec85d7fe9d2b757a398140e8672cc85428a9b5e72d851cd26839ea70ccedbad979e3f04b1d710d3ca07215133acf107f52975bad82

Download Submit
\Windows\system\OPOlLDN.exe

Filesize
2.2MB

MD5
7703cc766af08b29c7508c586511bcd5

SHA1
b630b3af011a09a786365a5f9341989227680c60

SHA256
486ef654ad30e62c75da8c589e98e3f6076ba63eb2705a69b4109a77f92d8004

SHA512
000a601017a779573284bb3a5b7666d4312edc1bae8339e1159392d0dfe5b1f65b593ca2d4832154ed2ce9f4a0bfd120755a0ed0c314bdab1bd6aa7999a38b45

Download Submit
\Windows\system\QxcXToD.exe

Filesize
2.2MB

MD5
322d198fd6d901a587e0bed405d30d8e

SHA1
192b2303a1bfcd68f000bc2675c46234336a0229

SHA256
221e025ca25c081f84eea533f9e96d7c119852affff1aa590e28ca93f702ef13

SHA512
e493ed860e0e5c310a5e243da317dbbbc7c2a40d70203c2d5ab8248c82d2b71ffeda9d8378bcb88b3fa7e18cd59f3763ee3bf2bd6ced2431263865f38d065712

Download Submit
\Windows\system\xVrAAHA.exe

Filesize
2.2MB

MD5
498cbe557e0362d80c39ca8719360203

SHA1
bf85215cdcae4c6e46c6007c1b94cd8455941498

SHA256
a6eb35acbcbbf0e3753966a46dc018fe26a264d942b636ce5ce0e9208bd975ad

SHA512
2c826f805b44dec276bd2f36bebd05e1ddf8aa9fce20daf7407eafddda93515a4ce487b9c9934bc1569daef523162b452664cc289de8d8be8a4d421196ebc1c2

Download Submit
\Windows\system\xchtbMm.exe

Filesize
2.2MB

MD5
74b678b9fe27f88035fac5a37d8411ca

SHA1
6df53c56f6459b0a2f5485787fcfc6292a9416ee

SHA256
f93521122a97f4ebcf2f10f645e484c99d08338a01bf031b6295d9b1c535a65f

SHA512
6346f649ed1657dd593a32c931810c217d980cae33adc35b78b2891250848fe7bcf0a5d24473892269fe6dac640bb00be64e2d738319a322d1a0fa4f628835f6

Download Submit
memory/880-78-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/880-2910-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/1908-0-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-24-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1908-62-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-77-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1908-107-0x000000013F7C0000-0x000000013FBB2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-495-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-8-0x00000000027F0000-0x0000000002BE2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-69-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-56-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/1908-63-0x0000000003150000-0x0000000003542000-memory.dmp

Filesize
3.9MB

Download
memory/1908-68-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/1908-42-0x0000000002A30000-0x0000000002E22000-memory.dmp

Filesize
3.9MB

Download
memory/1908-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1908-25-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2420-3141-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2420-43-0x000000013FA90000-0x000000013FE82000-memory.dmp

Filesize
3.9MB

Download
memory/2448-2909-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2448-70-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-2930-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2460-71-0x000000013F3F0000-0x000000013F7E2000-memory.dmp

Filesize
3.9MB

Download
memory/2480-315-0x0000000002220000-0x0000000002228000-memory.dmp

Filesize
32KB

Download
memory/2480-310-0x000000001B400000-0x000000001B6E2000-memory.dmp

Filesize
2.9MB

Download
memory/2596-67-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2596-4002-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2600-22-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2600-105-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2600-3143-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2636-12-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2636-2911-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2700-2953-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2700-29-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/2816-2931-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-86-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-3144-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2848-66-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-2957-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-23-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download