xmrig | f8d6155ff6c273dd0d88dc78a4bb43b9ca6b87c0d0b04180aeb74e5115e7b9b6

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
Size

2.2MB
MD5

01abedb7757f98d056150771efcfe83d
SHA1

da2bfb5728515e4aa3ebc2ef5175e5f58fc3007b
SHA256

f8d6155ff6c273dd0d88dc78a4bb43b9ca6b87c0d0b04180aeb74e5115e7b9b6
SHA512

e97e211faa50808804a6294f4b1780cac1e00b6c3017797481d3705caacc08d706a14ec1f93d2d2eccab24281fa74791e968518a0fa216bb8cd679d4e4290ba7
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfBE:NABL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral1/memory/2492-9-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2020-914-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2108-25-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2108-2027-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2612-2029-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2492-2030-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2896-3292-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/2944-3297-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2416-3534-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2644-3621-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig
behavioral1/memory/2572-3523-0x000000013FC80000-0x0000000140072000-memory.dmp	xmrig
behavioral1/memory/2476-3522-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2492	kJlQSPQ.exe
2612	ASjptFf.exe
2108	kiuLyOZ.exe
2644	NKRUrRS.exe
2896	WsqlCxI.exe
2572	KHnTIau.exe
2944	quptgaF.exe
2416	paYaSwI.exe
2476	ICyjkmz.exe
2900	XvpAral.exe
464	lUKAsFI.exe
888	rGqmiNG.exe
2688	fzgHSlC.exe
2592	jJTqrjF.exe
2760	fGQzXWc.exe
1904	htmGFWV.exe
2144	TBDGXgU.exe
1952	MoKZCOK.exe
896	RddPtBY.exe
1936	uKFVjFU.exe
2236	FnxXZIG.exe
744	vPzFkeG.exe
940	AbQNPdv.exe
2388	vYlDcue.exe
1836	LMGLIpk.exe
1512	mgFhosF.exe
1444	egKmZGA.exe
1284	WwiTdbR.exe
3004	nVqvGYc.exe
2164	UeerWAd.exe
1312	rkXCnOj.exe
2072	vkVVNyU.exe
1848	zQrUegb.exe
1032	PKATZwb.exe
620	NdVklkS.exe
396	QfqxBzL.exe
2276	kUSjcUE.exe
2264	FgUztnZ.exe
1124	VVfWpkY.exe
1832	QupTjjv.exe
1776	OBLddAt.exe
1960	ulYYVst.exe
1780	kLjArgF.exe
1584	hJkGHoN.exe
1608	IeRmQsu.exe
1856	iFbBOdY.exe
2124	GbppfTH.exe
1768	cuenXnk.exe
1772	ICnOMrd.exe
596	fGsvlQj.exe
2092	XOeFYjI.exe
1532	wUEPjCS.exe
2956	dovEcyl.exe
2232	tZtXpMj.exe
1468	ooxEzVO.exe
2252	HBvkDwW.exe
2004	ziIQKsk.exe
2220	abWgdPH.exe
1520	SEhxXvY.exe
2176	fLizXnV.exe
2860	RSRajid.exe
2828	svhUQdf.exe
1988	EqdBnRX.exe
1280	ozjGWOS.exe

Loads dropped DLL 64 IoCs

pid	Process
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe

UPX packed file 52 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2020-0-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x000c000000015a2d-3.dat	upx
behavioral1/memory/2492-9-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/files/0x0026000000015c3c-10.dat	upx
behavioral1/memory/2612-14-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/files/0x0007000000015db4-40.dat	upx
behavioral1/files/0x00080000000167db-44.dat	upx
behavioral1/files/0x0006000000018b33-59.dat	upx
behavioral1/files/0x0006000000018b42-67.dat	upx
behavioral1/files/0x0006000000018d06-91.dat	upx
behavioral1/files/0x00050000000192f4-100.dat	upx
behavioral1/files/0x0005000000019368-112.dat	upx
behavioral1/files/0x000500000001946b-144.dat	upx
behavioral1/memory/2020-914-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/files/0x0005000000019485-156.dat	upx
behavioral1/files/0x0005000000019473-152.dat	upx
behavioral1/files/0x000500000001946f-148.dat	upx
behavioral1/files/0x0005000000019410-140.dat	upx
behavioral1/files/0x00050000000193b0-136.dat	upx
behavioral1/files/0x000500000001939b-132.dat	upx
behavioral1/files/0x000500000001931b-104.dat	upx
behavioral1/memory/2476-127-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx
behavioral1/memory/2416-125-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2944-124-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2572-122-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2896-121-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2644-119-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0005000000019377-116.dat	upx
behavioral1/files/0x0005000000019333-108.dat	upx
behavioral1/files/0x00050000000192c9-95.dat	upx
behavioral1/files/0x0006000000018ba2-87.dat	upx
behavioral1/files/0x0006000000018b96-83.dat	upx
behavioral1/files/0x0006000000018b73-79.dat	upx
behavioral1/files/0x0006000000018b6a-75.dat	upx
behavioral1/files/0x0006000000018b4a-71.dat	upx
behavioral1/files/0x0006000000018b37-63.dat	upx
behavioral1/files/0x0006000000018b15-55.dat	upx
behavioral1/files/0x0006000000018ae8-51.dat	upx
behavioral1/files/0x0007000000018ae2-47.dat	upx
behavioral1/files/0x0008000000015d88-36.dat	upx
behavioral1/files/0x000f0000000006fd-32.dat	upx
behavioral1/memory/2108-25-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/files/0x0009000000015c7c-12.dat	upx
behavioral1/memory/2108-2027-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2612-2029-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2492-2030-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2896-3292-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/2944-3297-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2416-3534-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2644-3621-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/memory/2572-3523-0x000000013FC80000-0x0000000140072000-memory.dmp	upx
behavioral1/memory/2476-3522-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qfwQlRL.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\azNjKJJ.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\ZzoMCeB.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\SesJPbV.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\NEFbgaB.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\gWiqwvY.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\qIQJSFN.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\FUVdTQT.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\LwUOAeS.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\vkVVNyU.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\JNlwqfQ.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\xFBhPrS.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\vhJEeDs.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\dXgPWtD.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\BhMqRMx.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\JKeVccc.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\yVxLwMK.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\FEsChkV.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\pKyUbIf.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\iFECStZ.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\sNWlaEq.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\KpkFZrS.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\KSxsPGk.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\TApAqAv.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\AFYVluw.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\LdaOSYS.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\WaKydEV.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\XECTUld.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\RlcqMMY.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\KJDWFrM.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\xPEQZYB.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\wSKScGs.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\QwCUMLI.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\nEjNMjI.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\lexmyAT.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\IgiWGpW.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\XxdpmKG.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\lNGGmsW.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\vImWHup.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\QfqxBzL.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\GcVDXba.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\cVCPwYI.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\YudtbzG.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\RuAqltn.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\gCbvhVJ.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\WUiuTdh.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\hsAAalf.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\jOvlVcv.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\GzZqiWO.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\flqKUUO.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\SWTLzTH.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\DlmgKWP.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\bqhVKZR.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\CZIxzMg.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\zFwgaER.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\hlmsBcg.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\nJmviIi.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\xddvmwR.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\ujdYxRq.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\iKonzky.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\gTUgwKw.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\BMnxlqu.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\QLYIhQu.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
File created	C:\Windows\System\FpOupse.exe	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1540	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
Token: SeDebugPrivilege	1540	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1540	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	29
PID 2020 wrote to memory of 1540	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	29
PID 2020 wrote to memory of 1540	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	29
PID 2020 wrote to memory of 2492	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	30
PID 2020 wrote to memory of 2492	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	30
PID 2020 wrote to memory of 2492	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	30
PID 2020 wrote to memory of 2612	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	31
PID 2020 wrote to memory of 2612	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	31
PID 2020 wrote to memory of 2612	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	31
PID 2020 wrote to memory of 2108	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	32
PID 2020 wrote to memory of 2108	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	32
PID 2020 wrote to memory of 2108	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	32
PID 2020 wrote to memory of 2644	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	33
PID 2020 wrote to memory of 2644	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	33
PID 2020 wrote to memory of 2644	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	33
PID 2020 wrote to memory of 2896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	34
PID 2020 wrote to memory of 2896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	34
PID 2020 wrote to memory of 2896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	34
PID 2020 wrote to memory of 2572	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2572	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2572	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	35
PID 2020 wrote to memory of 2944	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	36
PID 2020 wrote to memory of 2944	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	36
PID 2020 wrote to memory of 2944	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	36
PID 2020 wrote to memory of 2416	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	37
PID 2020 wrote to memory of 2416	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	37
PID 2020 wrote to memory of 2416	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	37
PID 2020 wrote to memory of 2476	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	38
PID 2020 wrote to memory of 2476	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	38
PID 2020 wrote to memory of 2476	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	38
PID 2020 wrote to memory of 2900	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	39
PID 2020 wrote to memory of 2900	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	39
PID 2020 wrote to memory of 2900	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	39
PID 2020 wrote to memory of 464	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	40
PID 2020 wrote to memory of 464	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	40
PID 2020 wrote to memory of 464	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	40
PID 2020 wrote to memory of 888	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	41
PID 2020 wrote to memory of 888	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	41
PID 2020 wrote to memory of 888	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	41
PID 2020 wrote to memory of 2688	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	42
PID 2020 wrote to memory of 2688	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	42
PID 2020 wrote to memory of 2688	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	42
PID 2020 wrote to memory of 2592	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	43
PID 2020 wrote to memory of 2592	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	43
PID 2020 wrote to memory of 2592	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	43
PID 2020 wrote to memory of 2760	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	44
PID 2020 wrote to memory of 2760	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	44
PID 2020 wrote to memory of 2760	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	44
PID 2020 wrote to memory of 1904	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	45
PID 2020 wrote to memory of 1904	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	45
PID 2020 wrote to memory of 1904	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	45
PID 2020 wrote to memory of 2144	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	46
PID 2020 wrote to memory of 2144	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	46
PID 2020 wrote to memory of 2144	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	46
PID 2020 wrote to memory of 1952	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	47
PID 2020 wrote to memory of 1952	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	47
PID 2020 wrote to memory of 1952	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	47
PID 2020 wrote to memory of 896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	48
PID 2020 wrote to memory of 896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	48
PID 2020 wrote to memory of 896	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	48
PID 2020 wrote to memory of 1936	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	49
PID 2020 wrote to memory of 1936	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	49
PID 2020 wrote to memory of 1936	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	49
PID 2020 wrote to memory of 2236	2020	01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01abedb7757f98d056150771efcfe83d_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1540
- C:\Windows\System\kJlQSPQ.exe
  C:\Windows\System\kJlQSPQ.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\ASjptFf.exe
  C:\Windows\System\ASjptFf.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\kiuLyOZ.exe
  C:\Windows\System\kiuLyOZ.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\NKRUrRS.exe
  C:\Windows\System\NKRUrRS.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\WsqlCxI.exe
  C:\Windows\System\WsqlCxI.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\KHnTIau.exe
  C:\Windows\System\KHnTIau.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\quptgaF.exe
  C:\Windows\System\quptgaF.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\paYaSwI.exe
  C:\Windows\System\paYaSwI.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\ICyjkmz.exe
  C:\Windows\System\ICyjkmz.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\XvpAral.exe
  C:\Windows\System\XvpAral.exe
  2⤵
  - Executes dropped EXE
  PID:2900
- C:\Windows\System\lUKAsFI.exe
  C:\Windows\System\lUKAsFI.exe
  2⤵
  - Executes dropped EXE
  PID:464
- C:\Windows\System\rGqmiNG.exe
  C:\Windows\System\rGqmiNG.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\fzgHSlC.exe
  C:\Windows\System\fzgHSlC.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\jJTqrjF.exe
  C:\Windows\System\jJTqrjF.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\fGQzXWc.exe
  C:\Windows\System\fGQzXWc.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\htmGFWV.exe
  C:\Windows\System\htmGFWV.exe
  2⤵
  - Executes dropped EXE
  PID:1904
- C:\Windows\System\TBDGXgU.exe
  C:\Windows\System\TBDGXgU.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\MoKZCOK.exe
  C:\Windows\System\MoKZCOK.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\RddPtBY.exe
  C:\Windows\System\RddPtBY.exe
  2⤵
  - Executes dropped EXE
  PID:896
- C:\Windows\System\uKFVjFU.exe
  C:\Windows\System\uKFVjFU.exe
  2⤵
  - Executes dropped EXE
  PID:1936
- C:\Windows\System\FnxXZIG.exe
  C:\Windows\System\FnxXZIG.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\vPzFkeG.exe
  C:\Windows\System\vPzFkeG.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\AbQNPdv.exe
  C:\Windows\System\AbQNPdv.exe
  2⤵
  - Executes dropped EXE
  PID:940
- C:\Windows\System\vYlDcue.exe
  C:\Windows\System\vYlDcue.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\LMGLIpk.exe
  C:\Windows\System\LMGLIpk.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\mgFhosF.exe
  C:\Windows\System\mgFhosF.exe
  2⤵
  - Executes dropped EXE
  PID:1512
- C:\Windows\System\egKmZGA.exe
  C:\Windows\System\egKmZGA.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\WwiTdbR.exe
  C:\Windows\System\WwiTdbR.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\nVqvGYc.exe
  C:\Windows\System\nVqvGYc.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\UeerWAd.exe
  C:\Windows\System\UeerWAd.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\rkXCnOj.exe
  C:\Windows\System\rkXCnOj.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\vkVVNyU.exe
  C:\Windows\System\vkVVNyU.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\zQrUegb.exe
  C:\Windows\System\zQrUegb.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\PKATZwb.exe
  C:\Windows\System\PKATZwb.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\NdVklkS.exe
  C:\Windows\System\NdVklkS.exe
  2⤵
  - Executes dropped EXE
  PID:620
- C:\Windows\System\QfqxBzL.exe
  C:\Windows\System\QfqxBzL.exe
  2⤵
  - Executes dropped EXE
  PID:396
- C:\Windows\System\kUSjcUE.exe
  C:\Windows\System\kUSjcUE.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\FgUztnZ.exe
  C:\Windows\System\FgUztnZ.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\VVfWpkY.exe
  C:\Windows\System\VVfWpkY.exe
  2⤵
  - Executes dropped EXE
  PID:1124
- C:\Windows\System\QupTjjv.exe
  C:\Windows\System\QupTjjv.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\OBLddAt.exe
  C:\Windows\System\OBLddAt.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\ulYYVst.exe
  C:\Windows\System\ulYYVst.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\kLjArgF.exe
  C:\Windows\System\kLjArgF.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\hJkGHoN.exe
  C:\Windows\System\hJkGHoN.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\IeRmQsu.exe
  C:\Windows\System\IeRmQsu.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\iFbBOdY.exe
  C:\Windows\System\iFbBOdY.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\GbppfTH.exe
  C:\Windows\System\GbppfTH.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\cuenXnk.exe
  C:\Windows\System\cuenXnk.exe
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Windows\System\ICnOMrd.exe
  C:\Windows\System\ICnOMrd.exe
  2⤵
  - Executes dropped EXE
  PID:1772
- C:\Windows\System\fGsvlQj.exe
  C:\Windows\System\fGsvlQj.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\XOeFYjI.exe
  C:\Windows\System\XOeFYjI.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\wUEPjCS.exe
  C:\Windows\System\wUEPjCS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\dovEcyl.exe
  C:\Windows\System\dovEcyl.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\tZtXpMj.exe
  C:\Windows\System\tZtXpMj.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\ooxEzVO.exe
  C:\Windows\System\ooxEzVO.exe
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\System\HBvkDwW.exe
  C:\Windows\System\HBvkDwW.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\ziIQKsk.exe
  C:\Windows\System\ziIQKsk.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\abWgdPH.exe
  C:\Windows\System\abWgdPH.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\SEhxXvY.exe
  C:\Windows\System\SEhxXvY.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\fLizXnV.exe
  C:\Windows\System\fLizXnV.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\RSRajid.exe
  C:\Windows\System\RSRajid.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\svhUQdf.exe
  C:\Windows\System\svhUQdf.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\EqdBnRX.exe
  C:\Windows\System\EqdBnRX.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\ozjGWOS.exe
  C:\Windows\System\ozjGWOS.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\NPJPpeD.exe
  C:\Windows\System\NPJPpeD.exe
  2⤵
  PID:2780
- C:\Windows\System\MrlDITX.exe
  C:\Windows\System\MrlDITX.exe
  2⤵
  PID:2908
- C:\Windows\System\HBsijyL.exe
  C:\Windows\System\HBsijyL.exe
  2⤵
  PID:3040
- C:\Windows\System\YamVWnf.exe
  C:\Windows\System\YamVWnf.exe
  2⤵
  PID:2552
- C:\Windows\System\AzoNkKj.exe
  C:\Windows\System\AzoNkKj.exe
  2⤵
  PID:2532
- C:\Windows\System\WxXvsdM.exe
  C:\Windows\System\WxXvsdM.exe
  2⤵
  PID:2428
- C:\Windows\System\MiyWXOq.exe
  C:\Windows\System\MiyWXOq.exe
  2⤵
  PID:2456
- C:\Windows\System\EFvUlkc.exe
  C:\Windows\System\EFvUlkc.exe
  2⤵
  PID:580
- C:\Windows\System\hsAAalf.exe
  C:\Windows\System\hsAAalf.exe
  2⤵
  PID:2872
- C:\Windows\System\dBYHnqO.exe
  C:\Windows\System\dBYHnqO.exe
  2⤵
  PID:2324
- C:\Windows\System\YXeoDHJ.exe
  C:\Windows\System\YXeoDHJ.exe
  2⤵
  PID:2656
- C:\Windows\System\sxdglXp.exe
  C:\Windows\System\sxdglXp.exe
  2⤵
  PID:2752
- C:\Windows\System\PqmXtfe.exe
  C:\Windows\System\PqmXtfe.exe
  2⤵
  PID:1324
- C:\Windows\System\XWTnxaz.exe
  C:\Windows\System\XWTnxaz.exe
  2⤵
  PID:2024
- C:\Windows\System\wRjgToI.exe
  C:\Windows\System\wRjgToI.exe
  2⤵
  PID:796
- C:\Windows\System\OSKHYtJ.exe
  C:\Windows\System\OSKHYtJ.exe
  2⤵
  PID:2936
- C:\Windows\System\qfwQlRL.exe
  C:\Windows\System\qfwQlRL.exe
  2⤵
  PID:1844
- C:\Windows\System\CIMmldy.exe
  C:\Windows\System\CIMmldy.exe
  2⤵
  PID:1624
- C:\Windows\System\yoJjcIO.exe
  C:\Windows\System\yoJjcIO.exe
  2⤵
  PID:2096
- C:\Windows\System\mQwsvvf.exe
  C:\Windows\System\mQwsvvf.exe
  2⤵
  PID:2540
- C:\Windows\System\JwRpSZp.exe
  C:\Windows\System\JwRpSZp.exe
  2⤵
  PID:2300
- C:\Windows\System\OFbCPiF.exe
  C:\Windows\System\OFbCPiF.exe
  2⤵
  PID:2260
- C:\Windows\System\qBecCEO.exe
  C:\Windows\System\qBecCEO.exe
  2⤵
  PID:1092
- C:\Windows\System\xdEMyiL.exe
  C:\Windows\System\xdEMyiL.exe
  2⤵
  PID:2256
- C:\Windows\System\QfsUKEx.exe
  C:\Windows\System\QfsUKEx.exe
  2⤵
  PID:2028
- C:\Windows\System\UyBwkKr.exe
  C:\Windows\System\UyBwkKr.exe
  2⤵
  PID:1140
- C:\Windows\System\hDESxGr.exe
  C:\Windows\System\hDESxGr.exe
  2⤵
  PID:2084
- C:\Windows\System\nBOzNBW.exe
  C:\Windows\System\nBOzNBW.exe
  2⤵
  PID:960
- C:\Windows\System\HuKNJnl.exe
  C:\Windows\System\HuKNJnl.exe
  2⤵
  PID:3012
- C:\Windows\System\YvTKUWo.exe
  C:\Windows\System\YvTKUWo.exe
  2⤵
  PID:644
- C:\Windows\System\GuPQCSP.exe
  C:\Windows\System\GuPQCSP.exe
  2⤵
  PID:2988
- C:\Windows\System\CTwbydo.exe
  C:\Windows\System\CTwbydo.exe
  2⤵
  PID:2188
- C:\Windows\System\vMKNqZZ.exe
  C:\Windows\System\vMKNqZZ.exe
  2⤵
  PID:564
- C:\Windows\System\uOhVdqa.exe
  C:\Windows\System\uOhVdqa.exe
  2⤵
  PID:2984
- C:\Windows\System\cLOaMkM.exe
  C:\Windows\System\cLOaMkM.exe
  2⤵
  PID:1340
- C:\Windows\System\zlIIlYL.exe
  C:\Windows\System\zlIIlYL.exe
  2⤵
  PID:2484
- C:\Windows\System\RAQJOzp.exe
  C:\Windows\System\RAQJOzp.exe
  2⤵
  PID:2140
- C:\Windows\System\JklCeQO.exe
  C:\Windows\System\JklCeQO.exe
  2⤵
  PID:1568
- C:\Windows\System\RtQcqAa.exe
  C:\Windows\System\RtQcqAa.exe
  2⤵
  PID:2632
- C:\Windows\System\LLndfeC.exe
  C:\Windows\System\LLndfeC.exe
  2⤵
  PID:2524
- C:\Windows\System\cDQWBVa.exe
  C:\Windows\System\cDQWBVa.exe
  2⤵
  PID:2564
- C:\Windows\System\CggxUWT.exe
  C:\Windows\System\CggxUWT.exe
  2⤵
  PID:2472
- C:\Windows\System\ZLIVGIk.exe
  C:\Windows\System\ZLIVGIk.exe
  2⤵
  PID:2728
- C:\Windows\System\QsXxYvt.exe
  C:\Windows\System\QsXxYvt.exe
  2⤵
  PID:2064
- C:\Windows\System\BMnxlqu.exe
  C:\Windows\System\BMnxlqu.exe
  2⤵
  PID:932
- C:\Windows\System\LKSSalr.exe
  C:\Windows\System\LKSSalr.exe
  2⤵
  PID:2496
- C:\Windows\System\ePnZzBm.exe
  C:\Windows\System\ePnZzBm.exe
  2⤵
  PID:612
- C:\Windows\System\TkCFRUb.exe
  C:\Windows\System\TkCFRUb.exe
  2⤵
  PID:1812
- C:\Windows\System\TiGcGXj.exe
  C:\Windows\System\TiGcGXj.exe
  2⤵
  PID:2272
- C:\Windows\System\mhFgtPz.exe
  C:\Windows\System\mhFgtPz.exe
  2⤵
  PID:1808
- C:\Windows\System\QdBoFit.exe
  C:\Windows\System\QdBoFit.exe
  2⤵
  PID:2328
- C:\Windows\System\splJAck.exe
  C:\Windows\System\splJAck.exe
  2⤵
  PID:1788
- C:\Windows\System\UetcQCG.exe
  C:\Windows\System\UetcQCG.exe
  2⤵
  PID:2352
- C:\Windows\System\TtyeNEU.exe
  C:\Windows\System\TtyeNEU.exe
  2⤵
  PID:1588
- C:\Windows\System\nqbrgRV.exe
  C:\Windows\System\nqbrgRV.exe
  2⤵
  PID:1984
- C:\Windows\System\ORdNrVD.exe
  C:\Windows\System\ORdNrVD.exe
  2⤵
  PID:1596
- C:\Windows\System\hVGuyse.exe
  C:\Windows\System\hVGuyse.exe
  2⤵
  PID:2996
- C:\Windows\System\jOvlVcv.exe
  C:\Windows\System\jOvlVcv.exe
  2⤵
  PID:1192
- C:\Windows\System\nsrSfZo.exe
  C:\Windows\System\nsrSfZo.exe
  2⤵
  PID:1652
- C:\Windows\System\VvaPJBf.exe
  C:\Windows\System\VvaPJBf.exe
  2⤵
  PID:1968
- C:\Windows\System\luPEjdz.exe
  C:\Windows\System\luPEjdz.exe
  2⤵
  PID:1976
- C:\Windows\System\oJODAwY.exe
  C:\Windows\System\oJODAwY.exe
  2⤵
  PID:3080
- C:\Windows\System\yublipO.exe
  C:\Windows\System\yublipO.exe
  2⤵
  PID:3096
- C:\Windows\System\JOverbJ.exe
  C:\Windows\System\JOverbJ.exe
  2⤵
  PID:3112
- C:\Windows\System\INyeBmT.exe
  C:\Windows\System\INyeBmT.exe
  2⤵
  PID:3128
- C:\Windows\System\AWckCNZ.exe
  C:\Windows\System\AWckCNZ.exe
  2⤵
  PID:3144
- C:\Windows\System\LmDMPiR.exe
  C:\Windows\System\LmDMPiR.exe
  2⤵
  PID:3160
- C:\Windows\System\fDyyiSl.exe
  C:\Windows\System\fDyyiSl.exe
  2⤵
  PID:3176
- C:\Windows\System\SxDRRHh.exe
  C:\Windows\System\SxDRRHh.exe
  2⤵
  PID:3192
- C:\Windows\System\VLKtBpk.exe
  C:\Windows\System\VLKtBpk.exe
  2⤵
  PID:3208
- C:\Windows\System\eDrMjzg.exe
  C:\Windows\System\eDrMjzg.exe
  2⤵
  PID:3224
- C:\Windows\System\bJspKbX.exe
  C:\Windows\System\bJspKbX.exe
  2⤵
  PID:3240
- C:\Windows\System\FyhJsDF.exe
  C:\Windows\System\FyhJsDF.exe
  2⤵
  PID:3256
- C:\Windows\System\zCIVNrq.exe
  C:\Windows\System\zCIVNrq.exe
  2⤵
  PID:3272
- C:\Windows\System\AYcPRRy.exe
  C:\Windows\System\AYcPRRy.exe
  2⤵
  PID:3292
- C:\Windows\System\QpAQNDa.exe
  C:\Windows\System\QpAQNDa.exe
  2⤵
  PID:3308
- C:\Windows\System\QznBwtm.exe
  C:\Windows\System\QznBwtm.exe
  2⤵
  PID:3984
- C:\Windows\System\lrWiLir.exe
  C:\Windows\System\lrWiLir.exe
  2⤵
  PID:4000
- C:\Windows\System\bzXGDxh.exe
  C:\Windows\System\bzXGDxh.exe
  2⤵
  PID:4016
- C:\Windows\System\TILDhMl.exe
  C:\Windows\System\TILDhMl.exe
  2⤵
  PID:4032
- C:\Windows\System\AGgAogY.exe
  C:\Windows\System\AGgAogY.exe
  2⤵
  PID:4048
- C:\Windows\System\mmsOKwd.exe
  C:\Windows\System\mmsOKwd.exe
  2⤵
  PID:4064
- C:\Windows\System\zqPKOrr.exe
  C:\Windows\System\zqPKOrr.exe
  2⤵
  PID:4080
- C:\Windows\System\ZOuMMQr.exe
  C:\Windows\System\ZOuMMQr.exe
  2⤵
  PID:2076
- C:\Windows\System\tqYSGPA.exe
  C:\Windows\System\tqYSGPA.exe
  2⤵
  PID:1352
- C:\Windows\System\wXWMfax.exe
  C:\Windows\System\wXWMfax.exe
  2⤵
  PID:1692
- C:\Windows\System\rSYDyAy.exe
  C:\Windows\System\rSYDyAy.exe
  2⤵
  PID:2424
- C:\Windows\System\obxkjnf.exe
  C:\Windows\System\obxkjnf.exe
  2⤵
  PID:2576
- C:\Windows\System\zVqXAFk.exe
  C:\Windows\System\zVqXAFk.exe
  2⤵
  PID:3108
- C:\Windows\System\mGvGvAh.exe
  C:\Windows\System\mGvGvAh.exe
  2⤵
  PID:3172
- C:\Windows\System\VYHcMKm.exe
  C:\Windows\System\VYHcMKm.exe
  2⤵
  PID:2136
- C:\Windows\System\KpOzwVk.exe
  C:\Windows\System\KpOzwVk.exe
  2⤵
  PID:2348
- C:\Windows\System\nJDTDuC.exe
  C:\Windows\System\nJDTDuC.exe
  2⤵
  PID:1980
- C:\Windows\System\etfGeaJ.exe
  C:\Windows\System\etfGeaJ.exe
  2⤵
  PID:1616
- C:\Windows\System\EJWuZBx.exe
  C:\Windows\System\EJWuZBx.exe
  2⤵
  PID:3092
- C:\Windows\System\dvJVygI.exe
  C:\Windows\System\dvJVygI.exe
  2⤵
  PID:3252
- C:\Windows\System\aQsjmxF.exe
  C:\Windows\System\aQsjmxF.exe
  2⤵
  PID:3248
- C:\Windows\System\PIbZcod.exe
  C:\Windows\System\PIbZcod.exe
  2⤵
  PID:2808
- C:\Windows\System\QLYIhQu.exe
  C:\Windows\System\QLYIhQu.exe
  2⤵
  PID:2412
- C:\Windows\System\UvTYZjU.exe
  C:\Windows\System\UvTYZjU.exe
  2⤵
  PID:2468
- C:\Windows\System\JyMVGTx.exe
  C:\Windows\System\JyMVGTx.exe
  2⤵
  PID:1576
- C:\Windows\System\XUuGvMp.exe
  C:\Windows\System\XUuGvMp.exe
  2⤵
  PID:2764
- C:\Windows\System\bWUXczh.exe
  C:\Windows\System\bWUXczh.exe
  2⤵
  PID:2672
- C:\Windows\System\HKaGSCi.exe
  C:\Windows\System\HKaGSCi.exe
  2⤵
  PID:2168
- C:\Windows\System\JNlwqfQ.exe
  C:\Windows\System\JNlwqfQ.exe
  2⤵
  PID:3344
- C:\Windows\System\bqhVKZR.exe
  C:\Windows\System\bqhVKZR.exe
  2⤵
  PID:3368
- C:\Windows\System\nmrRTEL.exe
  C:\Windows\System\nmrRTEL.exe
  2⤵
  PID:3384
- C:\Windows\System\dsChGQq.exe
  C:\Windows\System\dsChGQq.exe
  2⤵
  PID:3404
- C:\Windows\System\abqbRBO.exe
  C:\Windows\System\abqbRBO.exe
  2⤵
  PID:3428
- C:\Windows\System\uLVdnGX.exe
  C:\Windows\System\uLVdnGX.exe
  2⤵
  PID:3460
- C:\Windows\System\dwktrEq.exe
  C:\Windows\System\dwktrEq.exe
  2⤵
  PID:3596
- C:\Windows\System\roAvlZB.exe
  C:\Windows\System\roAvlZB.exe
  2⤵
  PID:3660
- C:\Windows\System\FGEKutv.exe
  C:\Windows\System\FGEKutv.exe
  2⤵
  PID:3724
- C:\Windows\System\aaEbQPO.exe
  C:\Windows\System\aaEbQPO.exe
  2⤵
  PID:3740
- C:\Windows\System\NuazAti.exe
  C:\Windows\System\NuazAti.exe
  2⤵
  PID:4088
- C:\Windows\System\SlpIVDE.exe
  C:\Windows\System\SlpIVDE.exe
  2⤵
  PID:4056
- C:\Windows\System\WGAmHBW.exe
  C:\Windows\System\WGAmHBW.exe
  2⤵
  PID:2284
- C:\Windows\System\MJvjNmD.exe
  C:\Windows\System\MJvjNmD.exe
  2⤵
  PID:1756
- C:\Windows\System\enVbmHa.exe
  C:\Windows\System\enVbmHa.exe
  2⤵
  PID:1728
- C:\Windows\System\tTVZGxL.exe
  C:\Windows\System\tTVZGxL.exe
  2⤵
  PID:3424
- C:\Windows\System\xsYGPae.exe
  C:\Windows\System\xsYGPae.exe
  2⤵
  PID:3464
- C:\Windows\System\bLJtTsr.exe
  C:\Windows\System\bLJtTsr.exe
  2⤵
  PID:3496
- C:\Windows\System\dysmxfx.exe
  C:\Windows\System\dysmxfx.exe
  2⤵
  PID:3588
- C:\Windows\System\qsREvee.exe
  C:\Windows\System\qsREvee.exe
  2⤵
  PID:3668
- C:\Windows\System\qwvtCgk.exe
  C:\Windows\System\qwvtCgk.exe
  2⤵
  PID:3692
- C:\Windows\System\fnZbpBW.exe
  C:\Windows\System\fnZbpBW.exe
  2⤵
  PID:3708
- C:\Windows\System\UyoSybb.exe
  C:\Windows\System\UyoSybb.exe
  2⤵
  PID:3616
- C:\Windows\System\nspxjsX.exe
  C:\Windows\System\nspxjsX.exe
  2⤵
  PID:2032
- C:\Windows\System\azNjKJJ.exe
  C:\Windows\System\azNjKJJ.exe
  2⤵
  PID:3612
- C:\Windows\System\ochASMs.exe
  C:\Windows\System\ochASMs.exe
  2⤵
  PID:3760
- C:\Windows\System\AxVxaqr.exe
  C:\Windows\System\AxVxaqr.exe
  2⤵
  PID:3780
- C:\Windows\System\obOteEp.exe
  C:\Windows\System\obOteEp.exe
  2⤵
  PID:3800
- C:\Windows\System\BcIHxVr.exe
  C:\Windows\System\BcIHxVr.exe
  2⤵
  PID:3836
- C:\Windows\System\DhNvrQt.exe
  C:\Windows\System\DhNvrQt.exe
  2⤵
  PID:3852
- C:\Windows\System\evgDPjg.exe
  C:\Windows\System\evgDPjg.exe
  2⤵
  PID:3868
- C:\Windows\System\gfmiaWO.exe
  C:\Windows\System\gfmiaWO.exe
  2⤵
  PID:3892
- C:\Windows\System\zglQrTk.exe
  C:\Windows\System\zglQrTk.exe
  2⤵
  PID:3912
- C:\Windows\System\KAenyMx.exe
  C:\Windows\System\KAenyMx.exe
  2⤵
  PID:3944
- C:\Windows\System\UEcVOvW.exe
  C:\Windows\System\UEcVOvW.exe
  2⤵
  PID:3964
- C:\Windows\System\fBOklqw.exe
  C:\Windows\System\fBOklqw.exe
  2⤵
  PID:4012
- C:\Windows\System\yVxLwMK.exe
  C:\Windows\System\yVxLwMK.exe
  2⤵
  PID:4076
- C:\Windows\System\aMsFydM.exe
  C:\Windows\System\aMsFydM.exe
  2⤵
  PID:2308
- C:\Windows\System\ximWUzA.exe
  C:\Windows\System\ximWUzA.exe
  2⤵
  PID:2396
- C:\Windows\System\aBGiNzl.exe
  C:\Windows\System\aBGiNzl.exe
  2⤵
  PID:3076
- C:\Windows\System\JYYhIWL.exe
  C:\Windows\System\JYYhIWL.exe
  2⤵
  PID:3288
- C:\Windows\System\CKxZKrh.exe
  C:\Windows\System\CKxZKrh.exe
  2⤵
  PID:1100
- C:\Windows\System\AJOQyKn.exe
  C:\Windows\System\AJOQyKn.exe
  2⤵
  PID:3156
- C:\Windows\System\DVExKaW.exe
  C:\Windows\System\DVExKaW.exe
  2⤵
  PID:368
- C:\Windows\System\HXUKAAS.exe
  C:\Windows\System\HXUKAAS.exe
  2⤵
  PID:2684
- C:\Windows\System\MllPwbH.exe
  C:\Windows\System\MllPwbH.exe
  2⤵
  PID:2744
- C:\Windows\System\DkxkiLT.exe
  C:\Windows\System\DkxkiLT.exe
  2⤵
  PID:2876
- C:\Windows\System\oUgDbTH.exe
  C:\Windows\System\oUgDbTH.exe
  2⤵
  PID:1688
- C:\Windows\System\xgATvct.exe
  C:\Windows\System\xgATvct.exe
  2⤵
  PID:3304
- C:\Windows\System\aESARfX.exe
  C:\Windows\System\aESARfX.exe
  2⤵
  PID:2624
- C:\Windows\System\tToSFmE.exe
  C:\Windows\System\tToSFmE.exe
  2⤵
  PID:3392
- C:\Windows\System\dCZxBak.exe
  C:\Windows\System\dCZxBak.exe
  2⤵
  PID:3320
- C:\Windows\System\YuVMHVn.exe
  C:\Windows\System\YuVMHVn.exe
  2⤵
  PID:3656
- C:\Windows\System\GvyfFAc.exe
  C:\Windows\System\GvyfFAc.exe
  2⤵
  PID:3376
- C:\Windows\System\tnBKFmg.exe
  C:\Windows\System\tnBKFmg.exe
  2⤵
  PID:3512
- C:\Windows\System\KJDWFrM.exe
  C:\Windows\System\KJDWFrM.exe
  2⤵
  PID:3560
- C:\Windows\System\gpiGzLq.exe
  C:\Windows\System\gpiGzLq.exe
  2⤵
  PID:3908
- C:\Windows\System\oxjZCLT.exe
  C:\Windows\System\oxjZCLT.exe
  2⤵
  PID:3400
- C:\Windows\System\ZtUJtUY.exe
  C:\Windows\System\ZtUJtUY.exe
  2⤵
  PID:3380
- C:\Windows\System\hCxieDS.exe
  C:\Windows\System\hCxieDS.exe
  2⤵
  PID:3508
- C:\Windows\System\fyulZmV.exe
  C:\Windows\System\fyulZmV.exe
  2⤵
  PID:3316
- C:\Windows\System\BAzclOV.exe
  C:\Windows\System\BAzclOV.exe
  2⤵
  PID:3572
- C:\Windows\System\RPJGnTi.exe
  C:\Windows\System\RPJGnTi.exe
  2⤵
  PID:3568
- C:\Windows\System\oovOvRJ.exe
  C:\Windows\System\oovOvRJ.exe
  2⤵
  PID:3632
- C:\Windows\System\QTZvLIY.exe
  C:\Windows\System\QTZvLIY.exe
  2⤵
  PID:3048
- C:\Windows\System\cFUcmHu.exe
  C:\Windows\System\cFUcmHu.exe
  2⤵
  PID:3704
- C:\Windows\System\yPnNfQx.exe
  C:\Windows\System\yPnNfQx.exe
  2⤵
  PID:944
- C:\Windows\System\FEsChkV.exe
  C:\Windows\System\FEsChkV.exe
  2⤵
  PID:3752
- C:\Windows\System\htnVLXK.exe
  C:\Windows\System\htnVLXK.exe
  2⤵
  PID:1360
- C:\Windows\System\EAnhEiy.exe
  C:\Windows\System\EAnhEiy.exe
  2⤵
  PID:3808
- C:\Windows\System\msRDwio.exe
  C:\Windows\System\msRDwio.exe
  2⤵
  PID:3812
- C:\Windows\System\DKMgFyH.exe
  C:\Windows\System\DKMgFyH.exe
  2⤵
  PID:3820
- C:\Windows\System\hSdGiOI.exe
  C:\Windows\System\hSdGiOI.exe
  2⤵
  PID:3844
- C:\Windows\System\ilEexqp.exe
  C:\Windows\System\ilEexqp.exe
  2⤵
  PID:3848
- C:\Windows\System\TwYkldO.exe
  C:\Windows\System\TwYkldO.exe
  2⤵
  PID:3928
- C:\Windows\System\nqtoDwF.exe
  C:\Windows\System\nqtoDwF.exe
  2⤵
  PID:1648
- C:\Windows\System\ujdYxRq.exe
  C:\Windows\System\ujdYxRq.exe
  2⤵
  PID:2156
- C:\Windows\System\YucgjrM.exe
  C:\Windows\System\YucgjrM.exe
  2⤵
  PID:1552
- C:\Windows\System\nRixVrg.exe
  C:\Windows\System\nRixVrg.exe
  2⤵
  PID:2336
- C:\Windows\System\BvPPryX.exe
  C:\Windows\System\BvPPryX.exe
  2⤵
  PID:2068
- C:\Windows\System\Njlmcbr.exe
  C:\Windows\System\Njlmcbr.exe
  2⤵
  PID:3444
- C:\Windows\System\dGmgslK.exe
  C:\Windows\System\dGmgslK.exe
  2⤵
  PID:3552
- C:\Windows\System\AShVGNt.exe
  C:\Windows\System\AShVGNt.exe
  2⤵
  PID:3516
- C:\Windows\System\uBlqytS.exe
  C:\Windows\System\uBlqytS.exe
  2⤵
  PID:3528
- C:\Windows\System\HsNSoUM.exe
  C:\Windows\System\HsNSoUM.exe
  2⤵
  PID:2244
- C:\Windows\System\FhZkLsF.exe
  C:\Windows\System\FhZkLsF.exe
  2⤵
  PID:2112
- C:\Windows\System\wDZYezF.exe
  C:\Windows\System\wDZYezF.exe
  2⤵
  PID:2432
- C:\Windows\System\KbMQRRE.exe
  C:\Windows\System\KbMQRRE.exe
  2⤵
  PID:2616
- C:\Windows\System\jJdsnSh.exe
  C:\Windows\System\jJdsnSh.exe
  2⤵
  PID:1800
- C:\Windows\System\mUkMFuS.exe
  C:\Windows\System\mUkMFuS.exe
  2⤵
  PID:3876
- C:\Windows\System\JynSzzA.exe
  C:\Windows\System\JynSzzA.exe
  2⤵
  PID:3904
- C:\Windows\System\PUqSXoP.exe
  C:\Windows\System\PUqSXoP.exe
  2⤵
  PID:4008
- C:\Windows\System\pZqwfGt.exe
  C:\Windows\System\pZqwfGt.exe
  2⤵
  PID:1328
- C:\Windows\System\wzsbRlE.exe
  C:\Windows\System\wzsbRlE.exe
  2⤵
  PID:2776
- C:\Windows\System\gAEsccq.exe
  C:\Windows\System\gAEsccq.exe
  2⤵
  PID:3888
- C:\Windows\System\VEKZxmh.exe
  C:\Windows\System\VEKZxmh.exe
  2⤵
  PID:1736
- C:\Windows\System\oORzyYt.exe
  C:\Windows\System\oORzyYt.exe
  2⤵
  PID:3044
- C:\Windows\System\KtSwiQV.exe
  C:\Windows\System\KtSwiQV.exe
  2⤵
  PID:3716
- C:\Windows\System\tCFauxm.exe
  C:\Windows\System\tCFauxm.exe
  2⤵
  PID:4072
- C:\Windows\System\cxIGWqQ.exe
  C:\Windows\System\cxIGWqQ.exe
  2⤵
  PID:2288
- C:\Windows\System\NeJUMyO.exe
  C:\Windows\System\NeJUMyO.exe
  2⤵
  PID:920
- C:\Windows\System\ltPCVSb.exe
  C:\Windows\System\ltPCVSb.exe
  2⤵
  PID:3520
- C:\Windows\System\awxepkN.exe
  C:\Windows\System\awxepkN.exe
  2⤵
  PID:3152
- C:\Windows\System\ckaMIqB.exe
  C:\Windows\System\ckaMIqB.exe
  2⤵
  PID:3524
- C:\Windows\System\cCcDAVL.exe
  C:\Windows\System\cCcDAVL.exe
  2⤵
  PID:3028
- C:\Windows\System\ecUHVvs.exe
  C:\Windows\System\ecUHVvs.exe
  2⤵
  PID:4044
- C:\Windows\System\qvPlxNH.exe
  C:\Windows\System\qvPlxNH.exe
  2⤵
  PID:3360
- C:\Windows\System\PUibgiS.exe
  C:\Windows\System\PUibgiS.exe
  2⤵
  PID:2332
- C:\Windows\System\tyKJhGD.exe
  C:\Windows\System\tyKJhGD.exe
  2⤵
  PID:3504
- C:\Windows\System\rjwHxez.exe
  C:\Windows\System\rjwHxez.exe
  2⤵
  PID:3980
- C:\Windows\System\dGCeHpO.exe
  C:\Windows\System\dGCeHpO.exe
  2⤵
  PID:3448
- C:\Windows\System\czBBRMr.exe
  C:\Windows\System\czBBRMr.exe
  2⤵
  PID:3480
- C:\Windows\System\RPpsTmD.exe
  C:\Windows\System\RPpsTmD.exe
  2⤵
  PID:3832
- C:\Windows\System\dIPkJuE.exe
  C:\Windows\System\dIPkJuE.exe
  2⤵
  PID:2240
- C:\Windows\System\KoXbJmC.exe
  C:\Windows\System\KoXbJmC.exe
  2⤵
  PID:1796
- C:\Windows\System\ZzoMCeB.exe
  C:\Windows\System\ZzoMCeB.exe
  2⤵
  PID:2708
- C:\Windows\System\aqVvSsz.exe
  C:\Windows\System\aqVvSsz.exe
  2⤵
  PID:1696
- C:\Windows\System\FVdYpdh.exe
  C:\Windows\System\FVdYpdh.exe
  2⤵
  PID:3664
- C:\Windows\System\cWMCJha.exe
  C:\Windows\System\cWMCJha.exe
  2⤵
  PID:2976
- C:\Windows\System\TmrmmTz.exe
  C:\Windows\System\TmrmmTz.exe
  2⤵
  PID:3332
- C:\Windows\System\QFjKtHo.exe
  C:\Windows\System\QFjKtHo.exe
  2⤵
  PID:3456
- C:\Windows\System\RgAYyFF.exe
  C:\Windows\System\RgAYyFF.exe
  2⤵
  PID:3940
- C:\Windows\System\WpSpMNt.exe
  C:\Windows\System\WpSpMNt.exe
  2⤵
  PID:2296
- C:\Windows\System\UJGpbvP.exe
  C:\Windows\System\UJGpbvP.exe
  2⤵
  PID:3680
- C:\Windows\System\pdBAPaR.exe
  C:\Windows\System\pdBAPaR.exe
  2⤵
  PID:3624
- C:\Windows\System\AFEmQdj.exe
  C:\Windows\System\AFEmQdj.exe
  2⤵
  PID:3880
- C:\Windows\System\pUYoiCk.exe
  C:\Windows\System\pUYoiCk.exe
  2⤵
  PID:872
- C:\Windows\System\RTiRjJv.exe
  C:\Windows\System\RTiRjJv.exe
  2⤵
  PID:3796
- C:\Windows\System\eFdMdLK.exe
  C:\Windows\System\eFdMdLK.exe
  2⤵
  PID:788
- C:\Windows\System\arEmReA.exe
  C:\Windows\System\arEmReA.exe
  2⤵
  PID:3268
- C:\Windows\System\pKxPOdn.exe
  C:\Windows\System\pKxPOdn.exe
  2⤵
  PID:3584
- C:\Windows\System\wMqUkpS.exe
  C:\Windows\System\wMqUkpS.exe
  2⤵
  PID:3476
- C:\Windows\System\vFqWPFp.exe
  C:\Windows\System\vFqWPFp.exe
  2⤵
  PID:3536
- C:\Windows\System\VRyXucS.exe
  C:\Windows\System\VRyXucS.exe
  2⤵
  PID:3556
- C:\Windows\System\KRJWWBD.exe
  C:\Windows\System\KRJWWBD.exe
  2⤵
  PID:1120
- C:\Windows\System\xKRvHEw.exe
  C:\Windows\System\xKRvHEw.exe
  2⤵
  PID:3264
- C:\Windows\System\gbnGXkn.exe
  C:\Windows\System\gbnGXkn.exe
  2⤵
  PID:2648
- C:\Windows\System\yXKMVCU.exe
  C:\Windows\System\yXKMVCU.exe
  2⤵
  PID:3972
- C:\Windows\System\yBQhywG.exe
  C:\Windows\System\yBQhywG.exe
  2⤵
  PID:3772
- C:\Windows\System\zKsNqsI.exe
  C:\Windows\System\zKsNqsI.exe
  2⤵
  PID:4108
- C:\Windows\System\yHDhBQV.exe
  C:\Windows\System\yHDhBQV.exe
  2⤵
  PID:4124
- C:\Windows\System\GCcTUdy.exe
  C:\Windows\System\GCcTUdy.exe
  2⤵
  PID:4144
- C:\Windows\System\enSXpNk.exe
  C:\Windows\System\enSXpNk.exe
  2⤵
  PID:4160
- C:\Windows\System\JdSdyin.exe
  C:\Windows\System\JdSdyin.exe
  2⤵
  PID:4200
- C:\Windows\System\iOyreNG.exe
  C:\Windows\System\iOyreNG.exe
  2⤵
  PID:4220
- C:\Windows\System\vbTKgKd.exe
  C:\Windows\System\vbTKgKd.exe
  2⤵
  PID:4236
- C:\Windows\System\rFlDBgx.exe
  C:\Windows\System\rFlDBgx.exe
  2⤵
  PID:4252
- C:\Windows\System\YKHhNWo.exe
  C:\Windows\System\YKHhNWo.exe
  2⤵
  PID:4268
- C:\Windows\System\hbAJdDo.exe
  C:\Windows\System\hbAJdDo.exe
  2⤵
  PID:4284
- C:\Windows\System\iLsjdKe.exe
  C:\Windows\System\iLsjdKe.exe
  2⤵
  PID:4304
- C:\Windows\System\WcpLyth.exe
  C:\Windows\System\WcpLyth.exe
  2⤵
  PID:4324
- C:\Windows\System\ZdoBtnK.exe
  C:\Windows\System\ZdoBtnK.exe
  2⤵
  PID:4340
- C:\Windows\System\Kgkvhxn.exe
  C:\Windows\System\Kgkvhxn.exe
  2⤵
  PID:4384
- C:\Windows\System\jFAHjZo.exe
  C:\Windows\System\jFAHjZo.exe
  2⤵
  PID:4400
- C:\Windows\System\SesJPbV.exe
  C:\Windows\System\SesJPbV.exe
  2⤵
  PID:4416
- C:\Windows\System\OINzNCa.exe
  C:\Windows\System\OINzNCa.exe
  2⤵
  PID:4432
- C:\Windows\System\hZGRwYf.exe
  C:\Windows\System\hZGRwYf.exe
  2⤵
  PID:4448
- C:\Windows\System\fmKQkkx.exe
  C:\Windows\System\fmKQkkx.exe
  2⤵
  PID:4464
- C:\Windows\System\ZpPNywF.exe
  C:\Windows\System\ZpPNywF.exe
  2⤵
  PID:4532
- C:\Windows\System\yOgEqqI.exe
  C:\Windows\System\yOgEqqI.exe
  2⤵
  PID:4556
- C:\Windows\System\TApAqAv.exe
  C:\Windows\System\TApAqAv.exe
  2⤵
  PID:4572
- C:\Windows\System\WQjXgdX.exe
  C:\Windows\System\WQjXgdX.exe
  2⤵
  PID:4592
- C:\Windows\System\SesCQXi.exe
  C:\Windows\System\SesCQXi.exe
  2⤵
  PID:4608
- C:\Windows\System\oheAgRq.exe
  C:\Windows\System\oheAgRq.exe
  2⤵
  PID:4624
- C:\Windows\System\ExTsuoV.exe
  C:\Windows\System\ExTsuoV.exe
  2⤵
  PID:4640
- C:\Windows\System\LKkkWRk.exe
  C:\Windows\System\LKkkWRk.exe
  2⤵
  PID:4660
- C:\Windows\System\dHXQTTD.exe
  C:\Windows\System\dHXQTTD.exe
  2⤵
  PID:4676
- C:\Windows\System\AFYVluw.exe
  C:\Windows\System\AFYVluw.exe
  2⤵
  PID:4692
- C:\Windows\System\GJfypLh.exe
  C:\Windows\System\GJfypLh.exe
  2⤵
  PID:4752
- C:\Windows\System\rMZdaTS.exe
  C:\Windows\System\rMZdaTS.exe
  2⤵
  PID:4768
- C:\Windows\System\BPGxzhz.exe
  C:\Windows\System\BPGxzhz.exe
  2⤵
  PID:4788
- C:\Windows\System\KuHvHdz.exe
  C:\Windows\System\KuHvHdz.exe
  2⤵
  PID:4856
- C:\Windows\System\nrBvtYd.exe
  C:\Windows\System\nrBvtYd.exe
  2⤵
  PID:4872
- C:\Windows\System\xamAjwE.exe
  C:\Windows\System\xamAjwE.exe
  2⤵
  PID:4888
- C:\Windows\System\mcfBdkn.exe
  C:\Windows\System\mcfBdkn.exe
  2⤵
  PID:4904
- C:\Windows\System\NdTfmNi.exe
  C:\Windows\System\NdTfmNi.exe
  2⤵
  PID:4920
- C:\Windows\System\gTymHRz.exe
  C:\Windows\System\gTymHRz.exe
  2⤵
  PID:4940
- C:\Windows\System\SquMUpR.exe
  C:\Windows\System\SquMUpR.exe
  2⤵
  PID:4956
- C:\Windows\System\MsLrEik.exe
  C:\Windows\System\MsLrEik.exe
  2⤵
  PID:4980
- C:\Windows\System\tMnDIRQ.exe
  C:\Windows\System\tMnDIRQ.exe
  2⤵
  PID:5004
- C:\Windows\System\ALzWkYf.exe
  C:\Windows\System\ALzWkYf.exe
  2⤵
  PID:5020
- C:\Windows\System\nPoLNrL.exe
  C:\Windows\System\nPoLNrL.exe
  2⤵
  PID:5036
- C:\Windows\System\GIugeHo.exe
  C:\Windows\System\GIugeHo.exe
  2⤵
  PID:5052
- C:\Windows\System\cFAViCn.exe
  C:\Windows\System\cFAViCn.exe
  2⤵
  PID:5076
- C:\Windows\System\KScwnhV.exe
  C:\Windows\System\KScwnhV.exe
  2⤵
  PID:5096
- C:\Windows\System\AATnxoy.exe
  C:\Windows\System\AATnxoy.exe
  2⤵
  PID:5112
- C:\Windows\System\wgVgRhy.exe
  C:\Windows\System\wgVgRhy.exe
  2⤵
  PID:4100
- C:\Windows\System\xPEQZYB.exe
  C:\Windows\System\xPEQZYB.exe
  2⤵
  PID:4232
- C:\Windows\System\rVSGrlQ.exe
  C:\Windows\System\rVSGrlQ.exe
  2⤵
  PID:4264
- C:\Windows\System\bdchbjr.exe
  C:\Windows\System\bdchbjr.exe
  2⤵
  PID:4332
- C:\Windows\System\nlAyeCN.exe
  C:\Windows\System\nlAyeCN.exe
  2⤵
  PID:4312
- C:\Windows\System\HpKLONa.exe
  C:\Windows\System\HpKLONa.exe
  2⤵
  PID:4360
- C:\Windows\System\TLFdLAF.exe
  C:\Windows\System\TLFdLAF.exe
  2⤵
  PID:4392
- C:\Windows\System\RnOPfVo.exe
  C:\Windows\System\RnOPfVo.exe
  2⤵
  PID:4380
- C:\Windows\System\NXRlLZg.exe
  C:\Windows\System\NXRlLZg.exe
  2⤵
  PID:4460
- C:\Windows\System\poLDYZk.exe
  C:\Windows\System\poLDYZk.exe
  2⤵
  PID:4540
- C:\Windows\System\HXytfkI.exe
  C:\Windows\System\HXytfkI.exe
  2⤵
  PID:4492
- C:\Windows\System\FTvlYkn.exe
  C:\Windows\System\FTvlYkn.exe
  2⤵
  PID:4620
- C:\Windows\System\gWiqwvY.exe
  C:\Windows\System\gWiqwvY.exe
  2⤵
  PID:4528
- C:\Windows\System\KMkqoVp.exe
  C:\Windows\System\KMkqoVp.exe
  2⤵
  PID:4600
- C:\Windows\System\NTkMIZc.exe
  C:\Windows\System\NTkMIZc.exe
  2⤵
  PID:4484
- C:\Windows\System\geeRQFG.exe
  C:\Windows\System\geeRQFG.exe
  2⤵
  PID:4632
- C:\Windows\System\ZoiVxAG.exe
  C:\Windows\System\ZoiVxAG.exe
  2⤵
  PID:4764
- C:\Windows\System\NDLjVyA.exe
  C:\Windows\System\NDLjVyA.exe
  2⤵
  PID:4720
- C:\Windows\System\PxUUwwJ.exe
  C:\Windows\System\PxUUwwJ.exe
  2⤵
  PID:4820
- C:\Windows\System\ffQWPui.exe
  C:\Windows\System\ffQWPui.exe
  2⤵
  PID:4776
- C:\Windows\System\IBzmxhq.exe
  C:\Windows\System\IBzmxhq.exe
  2⤵
  PID:4744
- C:\Windows\System\KpnKcHm.exe
  C:\Windows\System\KpnKcHm.exe
  2⤵
  PID:4832
- C:\Windows\System\rJrmNGT.exe
  C:\Windows\System\rJrmNGT.exe
  2⤵
  PID:4848
- C:\Windows\System\eWfnmjo.exe
  C:\Windows\System\eWfnmjo.exe
  2⤵
  PID:4932
- C:\Windows\System\PVuFzyo.exe
  C:\Windows\System\PVuFzyo.exe
  2⤵
  PID:4900
- C:\Windows\System\dTyCCWg.exe
  C:\Windows\System\dTyCCWg.exe
  2⤵
  PID:4988
- C:\Windows\System\IzsUPDY.exe
  C:\Windows\System\IzsUPDY.exe
  2⤵
  PID:5032
- C:\Windows\System\BqWGvxJ.exe
  C:\Windows\System\BqWGvxJ.exe
  2⤵
  PID:5068
- C:\Windows\System\MAdwoWD.exe
  C:\Windows\System\MAdwoWD.exe
  2⤵
  PID:5108
- C:\Windows\System\FpOupse.exe
  C:\Windows\System\FpOupse.exe
  2⤵
  PID:3564
- C:\Windows\System\UqvjDOW.exe
  C:\Windows\System\UqvjDOW.exe
  2⤵
  PID:1572
- C:\Windows\System\qdyAfLp.exe
  C:\Windows\System\qdyAfLp.exe
  2⤵
  PID:4156
- C:\Windows\System\prGoaYC.exe
  C:\Windows\System\prGoaYC.exe
  2⤵
  PID:4212
- C:\Windows\System\fBAVInL.exe
  C:\Windows\System\fBAVInL.exe
  2⤵
  PID:3436
- C:\Windows\System\GmwcweU.exe
  C:\Windows\System\GmwcweU.exe
  2⤵
  PID:4296
- C:\Windows\System\YUMSsZP.exe
  C:\Windows\System\YUMSsZP.exe
  2⤵
  PID:4364
- C:\Windows\System\lGukYyS.exe
  C:\Windows\System\lGukYyS.exe
  2⤵
  PID:4376
- C:\Windows\System\RnLyaZe.exe
  C:\Windows\System\RnLyaZe.exe
  2⤵
  PID:4584
- C:\Windows\System\BGpGjjD.exe
  C:\Windows\System\BGpGjjD.exe
  2⤵
  PID:4352
- C:\Windows\System\vRumZmi.exe
  C:\Windows\System\vRumZmi.exe
  2⤵
  PID:4552
- C:\Windows\System\gEAJVOB.exe
  C:\Windows\System\gEAJVOB.exe
  2⤵
  PID:4412
- C:\Windows\System\eFLUSSd.exe
  C:\Windows\System\eFLUSSd.exe
  2⤵
  PID:4496
- C:\Windows\System\EqOkqLs.exe
  C:\Windows\System\EqOkqLs.exe
  2⤵
  PID:4504
- C:\Windows\System\gLOvumK.exe
  C:\Windows\System\gLOvumK.exe
  2⤵
  PID:4712
- C:\Windows\System\PqpWVLz.exe
  C:\Windows\System\PqpWVLz.exe
  2⤵
  PID:4868
- C:\Windows\System\cZUKttD.exe
  C:\Windows\System\cZUKttD.exe
  2⤵
  PID:4964
- C:\Windows\System\LTxTPat.exe
  C:\Windows\System\LTxTPat.exe
  2⤵
  PID:5044
- C:\Windows\System\NDDpuut.exe
  C:\Windows\System\NDDpuut.exe
  2⤵
  PID:1020
- C:\Windows\System\xFWIDdb.exe
  C:\Windows\System\xFWIDdb.exe
  2⤵
  PID:4184
- C:\Windows\System\oJYQLKi.exe
  C:\Windows\System\oJYQLKi.exe
  2⤵
  PID:4472
- C:\Windows\System\SempvSq.exe
  C:\Windows\System\SempvSq.exe
  2⤵
  PID:4488
- C:\Windows\System\lkcWSPW.exe
  C:\Windows\System\lkcWSPW.exe
  2⤵
  PID:4520
- C:\Windows\System\ZGXxfFN.exe
  C:\Windows\System\ZGXxfFN.exe
  2⤵
  PID:4804
- C:\Windows\System\ewKQJxV.exe
  C:\Windows\System\ewKQJxV.exe
  2⤵
  PID:4828
- C:\Windows\System\umidYbJ.exe
  C:\Windows\System\umidYbJ.exe
  2⤵
  PID:4688
- C:\Windows\System\fHSausl.exe
  C:\Windows\System\fHSausl.exe
  2⤵
  PID:936
- C:\Windows\System\yJNGVzt.exe
  C:\Windows\System\yJNGVzt.exe
  2⤵
  PID:4228
- C:\Windows\System\HtlkqpN.exe
  C:\Windows\System\HtlkqpN.exe
  2⤵
  PID:4684
- C:\Windows\System\PXDcIPL.exe
  C:\Windows\System\PXDcIPL.exe
  2⤵
  PID:4816
- C:\Windows\System\nujgSwm.exe
  C:\Windows\System\nujgSwm.exe
  2⤵
  PID:4248
- C:\Windows\System\bLATgyZ.exe
  C:\Windows\System\bLATgyZ.exe
  2⤵
  PID:4724
- C:\Windows\System\HZfYtmV.exe
  C:\Windows\System\HZfYtmV.exe
  2⤵
  PID:4972
- C:\Windows\System\kaFeudf.exe
  C:\Windows\System\kaFeudf.exe
  2⤵
  PID:4740
- C:\Windows\System\fncQHrA.exe
  C:\Windows\System\fncQHrA.exe
  2⤵
  PID:4136
- C:\Windows\System\LAmaRqS.exe
  C:\Windows\System\LAmaRqS.exe
  2⤵
  PID:4896
- C:\Windows\System\auotYbQ.exe
  C:\Windows\System\auotYbQ.exe
  2⤵
  PID:4916
- C:\Windows\System\vwMryZP.exe
  C:\Windows\System\vwMryZP.exe
  2⤵
  PID:4396
- C:\Windows\System\UuHKTjo.exe
  C:\Windows\System\UuHKTjo.exe
  2⤵
  PID:4672
- C:\Windows\System\QafZfBe.exe
  C:\Windows\System\QafZfBe.exe
  2⤵
  PID:5048
- C:\Windows\System\CZIxzMg.exe
  C:\Windows\System\CZIxzMg.exe
  2⤵
  PID:4700
- C:\Windows\System\CFRPOTS.exe
  C:\Windows\System\CFRPOTS.exe
  2⤵
  PID:4656
- C:\Windows\System\ExCMrAl.exe
  C:\Windows\System\ExCMrAl.exe
  2⤵
  PID:5140
- C:\Windows\System\JGeGXdp.exe
  C:\Windows\System\JGeGXdp.exe
  2⤵
  PID:5164
- C:\Windows\System\IMoHNvM.exe
  C:\Windows\System\IMoHNvM.exe
  2⤵
  PID:5180
- C:\Windows\System\fHMgZmD.exe
  C:\Windows\System\fHMgZmD.exe
  2⤵
  PID:5196
- C:\Windows\System\zwlMciS.exe
  C:\Windows\System\zwlMciS.exe
  2⤵
  PID:5212
- C:\Windows\System\iHxDHjf.exe
  C:\Windows\System\iHxDHjf.exe
  2⤵
  PID:5228
- C:\Windows\System\Zcskfft.exe
  C:\Windows\System\Zcskfft.exe
  2⤵
  PID:5248
- C:\Windows\System\poQzebe.exe
  C:\Windows\System\poQzebe.exe
  2⤵
  PID:5264
- C:\Windows\System\Knzxxpc.exe
  C:\Windows\System\Knzxxpc.exe
  2⤵
  PID:5280
- C:\Windows\System\dpdQCwZ.exe
  C:\Windows\System\dpdQCwZ.exe
  2⤵
  PID:5300
- C:\Windows\System\qwaGhqO.exe
  C:\Windows\System\qwaGhqO.exe
  2⤵
  PID:5316
- C:\Windows\System\AaxztMj.exe
  C:\Windows\System\AaxztMj.exe
  2⤵
  PID:5332
- C:\Windows\System\brMbiMU.exe
  C:\Windows\System\brMbiMU.exe
  2⤵
  PID:5360
- C:\Windows\System\hPXrdAN.exe
  C:\Windows\System\hPXrdAN.exe
  2⤵
  PID:5376
- C:\Windows\System\QMNnJos.exe
  C:\Windows\System\QMNnJos.exe
  2⤵
  PID:5404
- C:\Windows\System\GRzKABN.exe
  C:\Windows\System\GRzKABN.exe
  2⤵
  PID:5420
- C:\Windows\System\VsozrcC.exe
  C:\Windows\System\VsozrcC.exe
  2⤵
  PID:5436
- C:\Windows\System\sYYxQNn.exe
  C:\Windows\System\sYYxQNn.exe
  2⤵
  PID:5456
- C:\Windows\System\gIQHqTS.exe
  C:\Windows\System\gIQHqTS.exe
  2⤵
  PID:5472
- C:\Windows\System\jiHZROw.exe
  C:\Windows\System\jiHZROw.exe
  2⤵
  PID:5488
- C:\Windows\System\GcVDXba.exe
  C:\Windows\System\GcVDXba.exe
  2⤵
  PID:5512
- C:\Windows\System\bhhRywi.exe
  C:\Windows\System\bhhRywi.exe
  2⤵
  PID:5536
- C:\Windows\System\hzCGneH.exe
  C:\Windows\System\hzCGneH.exe
  2⤵
  PID:5552
- C:\Windows\System\tVyheNH.exe
  C:\Windows\System\tVyheNH.exe
  2⤵
  PID:5568
- C:\Windows\System\preVWyu.exe
  C:\Windows\System\preVWyu.exe
  2⤵
  PID:5588
- C:\Windows\System\EXNazxG.exe
  C:\Windows\System\EXNazxG.exe
  2⤵
  PID:5616
- C:\Windows\System\OKTxPBR.exe
  C:\Windows\System\OKTxPBR.exe
  2⤵
  PID:5636
- C:\Windows\System\IyvDyYk.exe
  C:\Windows\System\IyvDyYk.exe
  2⤵
  PID:5652
- C:\Windows\System\BDltgAX.exe
  C:\Windows\System\BDltgAX.exe
  2⤵
  PID:5668
- C:\Windows\System\QvhYXmt.exe
  C:\Windows\System\QvhYXmt.exe
  2⤵
  PID:5688
- C:\Windows\System\zuAfoRn.exe
  C:\Windows\System\zuAfoRn.exe
  2⤵
  PID:5704
- C:\Windows\System\WNkhBnF.exe
  C:\Windows\System\WNkhBnF.exe
  2⤵
  PID:5720
- C:\Windows\System\QwCUMLI.exe
  C:\Windows\System\QwCUMLI.exe
  2⤵
  PID:5736
- C:\Windows\System\PkuQQAQ.exe
  C:\Windows\System\PkuQQAQ.exe
  2⤵
  PID:5752
- C:\Windows\System\LVQlRxa.exe
  C:\Windows\System\LVQlRxa.exe
  2⤵
  PID:5768
- C:\Windows\System\MaOeKGa.exe
  C:\Windows\System\MaOeKGa.exe
  2⤵
  PID:5792
- C:\Windows\System\YRzjsBe.exe
  C:\Windows\System\YRzjsBe.exe
  2⤵
  PID:5808
- C:\Windows\System\gtLWBCk.exe
  C:\Windows\System\gtLWBCk.exe
  2⤵
  PID:5860
- C:\Windows\System\NOFCYZp.exe
  C:\Windows\System\NOFCYZp.exe
  2⤵
  PID:5876
- C:\Windows\System\WqkgtYi.exe
  C:\Windows\System\WqkgtYi.exe
  2⤵
  PID:5892
- C:\Windows\System\HTPNESS.exe
  C:\Windows\System\HTPNESS.exe
  2⤵
  PID:5912
- C:\Windows\System\tdQbiVW.exe
  C:\Windows\System\tdQbiVW.exe
  2⤵
  PID:5928
- C:\Windows\System\wEFpLBb.exe
  C:\Windows\System\wEFpLBb.exe
  2⤵
  PID:5944
- C:\Windows\System\GUFdsfy.exe
  C:\Windows\System\GUFdsfy.exe
  2⤵
  PID:5964
- C:\Windows\System\MDtWxVL.exe
  C:\Windows\System\MDtWxVL.exe
  2⤵
  PID:5992
- C:\Windows\System\LMqeWxd.exe
  C:\Windows\System\LMqeWxd.exe
  2⤵
  PID:6012
- C:\Windows\System\QJjHUyI.exe
  C:\Windows\System\QJjHUyI.exe
  2⤵
  PID:6028
- C:\Windows\System\KmWtKTw.exe
  C:\Windows\System\KmWtKTw.exe
  2⤵
  PID:6052
- C:\Windows\System\UZMsOvd.exe
  C:\Windows\System\UZMsOvd.exe
  2⤵
  PID:6068
- C:\Windows\System\hBIQJvi.exe
  C:\Windows\System\hBIQJvi.exe
  2⤵
  PID:6084
- C:\Windows\System\guabhTf.exe
  C:\Windows\System\guabhTf.exe
  2⤵
  PID:6104
- C:\Windows\System\XhAyTXm.exe
  C:\Windows\System\XhAyTXm.exe
  2⤵
  PID:6120
- C:\Windows\System\usBtUfk.exe
  C:\Windows\System\usBtUfk.exe
  2⤵
  PID:6136
- C:\Windows\System\eaFLaYz.exe
  C:\Windows\System\eaFLaYz.exe
  2⤵
  PID:5148
- C:\Windows\System\BIMhmpL.exe
  C:\Windows\System\BIMhmpL.exe
  2⤵
  PID:5128
- C:\Windows\System\YblaFTK.exe
  C:\Windows\System\YblaFTK.exe
  2⤵
  PID:4216
- C:\Windows\System\GQCUHKM.exe
  C:\Windows\System\GQCUHKM.exe
  2⤵
  PID:5260
- C:\Windows\System\mbEjUHW.exe
  C:\Windows\System\mbEjUHW.exe
  2⤵
  PID:4568
- C:\Windows\System\wxZvTEh.exe
  C:\Windows\System\wxZvTEh.exe
  2⤵
  PID:5204
- C:\Windows\System\LRAAXlh.exe
  C:\Windows\System\LRAAXlh.exe
  2⤵
  PID:5244
- C:\Windows\System\LnjULuv.exe
  C:\Windows\System\LnjULuv.exe
  2⤵
  PID:5328
- C:\Windows\System\Arqusym.exe
  C:\Windows\System\Arqusym.exe
  2⤵
  PID:5372
- C:\Windows\System\VXYVLUR.exe
  C:\Windows\System\VXYVLUR.exe
  2⤵
  PID:5392
- C:\Windows\System\gUIzWNQ.exe
  C:\Windows\System\gUIzWNQ.exe
  2⤵
  PID:5484
- C:\Windows\System\cxfnCfo.exe
  C:\Windows\System\cxfnCfo.exe
  2⤵
  PID:5452
- C:\Windows\System\GzZqiWO.exe
  C:\Windows\System\GzZqiWO.exe
  2⤵
  PID:5464
- C:\Windows\System\fEFlOfi.exe
  C:\Windows\System\fEFlOfi.exe
  2⤵
  PID:5508
- C:\Windows\System\AeEqtxJ.exe
  C:\Windows\System\AeEqtxJ.exe
  2⤵
  PID:5428
- C:\Windows\System\PxeFDGr.exe
  C:\Windows\System\PxeFDGr.exe
  2⤵
  PID:5600
- C:\Windows\System\hIRyahD.exe
  C:\Windows\System\hIRyahD.exe
  2⤵
  PID:5676
- C:\Windows\System\YnqeRcK.exe
  C:\Windows\System\YnqeRcK.exe
  2⤵
  PID:5584
- C:\Windows\System\vJwvUcS.exe
  C:\Windows\System\vJwvUcS.exe
  2⤵
  PID:5744
- C:\Windows\System\krdshRe.exe
  C:\Windows\System\krdshRe.exe
  2⤵
  PID:5696
- C:\Windows\System\RgSKSHU.exe
  C:\Windows\System\RgSKSHU.exe
  2⤵
  PID:5732
- C:\Windows\System\hNhaBMa.exe
  C:\Windows\System\hNhaBMa.exe
  2⤵
  PID:5820
- C:\Windows\System\SEdGtIq.exe
  C:\Windows\System\SEdGtIq.exe
  2⤵
  PID:5804
- C:\Windows\System\lIrpBRL.exe
  C:\Windows\System\lIrpBRL.exe
  2⤵
  PID:5848
- C:\Windows\System\whCJfgq.exe
  C:\Windows\System\whCJfgq.exe
  2⤵
  PID:5888
- C:\Windows\System\yANyZRj.exe
  C:\Windows\System\yANyZRj.exe
  2⤵
  PID:5952
- C:\Windows\System\nMjboZJ.exe
  C:\Windows\System\nMjboZJ.exe
  2⤵
  PID:5904
- C:\Windows\System\dTTGqFM.exe
  C:\Windows\System\dTTGqFM.exe
  2⤵
  PID:5988
- C:\Windows\System\xFBhPrS.exe
  C:\Windows\System\xFBhPrS.exe
  2⤵
  PID:6004
- C:\Windows\System\eFVqoyp.exe
  C:\Windows\System\eFVqoyp.exe
  2⤵
  PID:6100
- C:\Windows\System\zneaRqb.exe
  C:\Windows\System\zneaRqb.exe
  2⤵
  PID:6132
- C:\Windows\System\fzfpLXs.exe
  C:\Windows\System\fzfpLXs.exe
  2⤵
  PID:5256
- C:\Windows\System\aqUURVD.exe
  C:\Windows\System\aqUURVD.exe
  2⤵
  PID:5176
- C:\Windows\System\bbUBHMP.exe
  C:\Windows\System\bbUBHMP.exe
  2⤵
  PID:6048
- C:\Windows\System\UgkfKDt.exe
  C:\Windows\System\UgkfKDt.exe
  2⤵
  PID:6080
- C:\Windows\System\JbvFTJX.exe
  C:\Windows\System\JbvFTJX.exe
  2⤵
  PID:5384
- C:\Windows\System\PFefzlq.exe
  C:\Windows\System\PFefzlq.exe
  2⤵
  PID:5296
- C:\Windows\System\AjJJCNB.exe
  C:\Windows\System\AjJJCNB.exe
  2⤵
  PID:5312
- C:\Windows\System\CMUhryt.exe
  C:\Windows\System\CMUhryt.exe
  2⤵
  PID:5448
- C:\Windows\System\XKflYxV.exe
  C:\Windows\System\XKflYxV.exe
  2⤵
  PID:5564
- C:\Windows\System\ZxAJSAp.exe
  C:\Windows\System\ZxAJSAp.exe
  2⤵
  PID:5612
- C:\Windows\System\vnGDydF.exe
  C:\Windows\System\vnGDydF.exe
  2⤵
  PID:5580
- C:\Windows\System\lbzJnhI.exe
  C:\Windows\System\lbzJnhI.exe
  2⤵
  PID:5664
- C:\Windows\System\itRNKdK.exe
  C:\Windows\System\itRNKdK.exe
  2⤵
  PID:5760
- C:\Windows\System\zeWBeXD.exe
  C:\Windows\System\zeWBeXD.exe
  2⤵
  PID:5764
- C:\Windows\System\DNwbkiU.exe
  C:\Windows\System\DNwbkiU.exe
  2⤵
  PID:5940
- C:\Windows\System\pzFgclM.exe
  C:\Windows\System\pzFgclM.exe
  2⤵
  PID:5884
- C:\Windows\System\SOkYeis.exe
  C:\Windows\System\SOkYeis.exe
  2⤵
  PID:6092
- C:\Windows\System\bYgnIPg.exe
  C:\Windows\System\bYgnIPg.exe
  2⤵
  PID:5188
- C:\Windows\System\eGgYJFL.exe
  C:\Windows\System\eGgYJFL.exe
  2⤵
  PID:6036
- C:\Windows\System\cVCPwYI.exe
  C:\Windows\System\cVCPwYI.exe
  2⤵
  PID:5172
- C:\Windows\System\imVwKCE.exe
  C:\Windows\System\imVwKCE.exe
  2⤵
  PID:5348
- C:\Windows\System\GvANocY.exe
  C:\Windows\System\GvANocY.exe
  2⤵
  PID:5548
- C:\Windows\System\vTlAceF.exe
  C:\Windows\System\vTlAceF.exe
  2⤵
  PID:5416
- C:\Windows\System\aftZTGi.exe
  C:\Windows\System\aftZTGi.exe
  2⤵
  PID:5400
- C:\Windows\System\KCiWVpF.exe
  C:\Windows\System\KCiWVpF.exe
  2⤵
  PID:5632
- C:\Windows\System\MjegOqP.exe
  C:\Windows\System\MjegOqP.exe
  2⤵
  PID:5924
- C:\Windows\System\flqKUUO.exe
  C:\Windows\System\flqKUUO.exe
  2⤵
  PID:6040
- C:\Windows\System\VVCDAtM.exe
  C:\Windows\System\VVCDAtM.exe
  2⤵
  PID:5776
- C:\Windows\System\TmgNJGV.exe
  C:\Windows\System\TmgNJGV.exe
  2⤵
  PID:5832
- C:\Windows\System\NfFRkkW.exe
  C:\Windows\System\NfFRkkW.exe
  2⤵
  PID:5936
- C:\Windows\System\Tkoytkz.exe
  C:\Windows\System\Tkoytkz.exe
  2⤵
  PID:6096
- C:\Windows\System\LxrywrV.exe
  C:\Windows\System\LxrywrV.exe
  2⤵
  PID:5504
- C:\Windows\System\AXmbmbT.exe
  C:\Windows\System\AXmbmbT.exe
  2⤵
  PID:5532
- C:\Windows\System\gJmcVza.exe
  C:\Windows\System\gJmcVza.exe
  2⤵
  PID:5340
- C:\Windows\System\lJayKxd.exe
  C:\Windows\System\lJayKxd.exe
  2⤵
  PID:5852
- C:\Windows\System\iEBTdov.exe
  C:\Windows\System\iEBTdov.exe
  2⤵
  PID:5728
- C:\Windows\System\qMaYGVV.exe
  C:\Windows\System\qMaYGVV.exe
  2⤵
  PID:5388
- C:\Windows\System\OIQwpYy.exe
  C:\Windows\System\OIQwpYy.exe
  2⤵
  PID:5644
- C:\Windows\System\SYhnPwk.exe
  C:\Windows\System\SYhnPwk.exe
  2⤵
  PID:6152
- C:\Windows\System\HAOvnCD.exe
  C:\Windows\System\HAOvnCD.exe
  2⤵
  PID:6168
- C:\Windows\System\lUlmMyr.exe
  C:\Windows\System\lUlmMyr.exe
  2⤵
  PID:6184
- C:\Windows\System\WlArGOb.exe
  C:\Windows\System\WlArGOb.exe
  2⤵
  PID:6204
- C:\Windows\System\tPpRBVy.exe
  C:\Windows\System\tPpRBVy.exe
  2⤵
  PID:6224
- C:\Windows\System\FzCAqQE.exe
  C:\Windows\System\FzCAqQE.exe
  2⤵
  PID:6244
- C:\Windows\System\QXWabvY.exe
  C:\Windows\System\QXWabvY.exe
  2⤵
  PID:6260
- C:\Windows\System\YudtbzG.exe
  C:\Windows\System\YudtbzG.exe
  2⤵
  PID:6276
- C:\Windows\System\gUxbgtJ.exe
  C:\Windows\System\gUxbgtJ.exe
  2⤵
  PID:6296
- C:\Windows\System\NalrEcb.exe
  C:\Windows\System\NalrEcb.exe
  2⤵
  PID:6316
- C:\Windows\System\nDqPItB.exe
  C:\Windows\System\nDqPItB.exe
  2⤵
  PID:6340
- C:\Windows\System\olsNOht.exe
  C:\Windows\System\olsNOht.exe
  2⤵
  PID:6356
- C:\Windows\System\LPCaBeh.exe
  C:\Windows\System\LPCaBeh.exe
  2⤵
  PID:6372
- C:\Windows\System\FGoUAXs.exe
  C:\Windows\System\FGoUAXs.exe
  2⤵
  PID:6388
- C:\Windows\System\QJivjxn.exe
  C:\Windows\System\QJivjxn.exe
  2⤵
  PID:6404
- C:\Windows\System\iqojxnL.exe
  C:\Windows\System\iqojxnL.exe
  2⤵
  PID:6420
- C:\Windows\System\DGLgzQn.exe
  C:\Windows\System\DGLgzQn.exe
  2⤵
  PID:6436
- C:\Windows\System\NoGTwYE.exe
  C:\Windows\System\NoGTwYE.exe
  2⤵
  PID:6452
- C:\Windows\System\CpuAlww.exe
  C:\Windows\System\CpuAlww.exe
  2⤵
  PID:6468
- C:\Windows\System\ucVcdXw.exe
  C:\Windows\System\ucVcdXw.exe
  2⤵
  PID:6484
- C:\Windows\System\JPHwzel.exe
  C:\Windows\System\JPHwzel.exe
  2⤵
  PID:6508
- C:\Windows\System\oUathAe.exe
  C:\Windows\System\oUathAe.exe
  2⤵
  PID:6524
- C:\Windows\System\OxXhAaF.exe
  C:\Windows\System\OxXhAaF.exe
  2⤵
  PID:6540
- C:\Windows\System\TMqMNOY.exe
  C:\Windows\System\TMqMNOY.exe
  2⤵
  PID:6556
- C:\Windows\System\TrCKugt.exe
  C:\Windows\System\TrCKugt.exe
  2⤵
  PID:6572
- C:\Windows\System\MCASMWi.exe
  C:\Windows\System\MCASMWi.exe
  2⤵
  PID:6588
- C:\Windows\System\KdsEfBc.exe
  C:\Windows\System\KdsEfBc.exe
  2⤵
  PID:6604
- C:\Windows\System\TYjgMDV.exe
  C:\Windows\System\TYjgMDV.exe
  2⤵
  PID:6620
- C:\Windows\System\gZbzGWj.exe
  C:\Windows\System\gZbzGWj.exe
  2⤵
  PID:6636
- C:\Windows\System\KfZeSml.exe
  C:\Windows\System\KfZeSml.exe
  2⤵
  PID:6656
- C:\Windows\System\pKyUbIf.exe
  C:\Windows\System\pKyUbIf.exe
  2⤵
  PID:6672
- C:\Windows\System\fFJLWut.exe
  C:\Windows\System\fFJLWut.exe
  2⤵
  PID:6688
- C:\Windows\System\NUrXToT.exe
  C:\Windows\System\NUrXToT.exe
  2⤵
  PID:6704
- C:\Windows\System\JoGWagp.exe
  C:\Windows\System\JoGWagp.exe
  2⤵
  PID:6720
- C:\Windows\System\hZXDGBs.exe
  C:\Windows\System\hZXDGBs.exe
  2⤵
  PID:6736
- C:\Windows\System\UuGXegz.exe
  C:\Windows\System\UuGXegz.exe
  2⤵
  PID:6752
- C:\Windows\System\bmKidmm.exe
  C:\Windows\System\bmKidmm.exe
  2⤵
  PID:6768
- C:\Windows\System\TWZmNSh.exe
  C:\Windows\System\TWZmNSh.exe
  2⤵
  PID:6784
- C:\Windows\System\ZUYmTmf.exe
  C:\Windows\System\ZUYmTmf.exe
  2⤵
  PID:6800
- C:\Windows\System\Pbnamil.exe
  C:\Windows\System\Pbnamil.exe
  2⤵
  PID:6816
- C:\Windows\System\xOgyEVF.exe
  C:\Windows\System\xOgyEVF.exe
  2⤵
  PID:6832
- C:\Windows\System\bXtYgUS.exe
  C:\Windows\System\bXtYgUS.exe
  2⤵
  PID:6848
- C:\Windows\System\SwEKpmj.exe
  C:\Windows\System\SwEKpmj.exe
  2⤵
  PID:6864
- C:\Windows\System\pXFhZTo.exe
  C:\Windows\System\pXFhZTo.exe
  2⤵
  PID:6880
- C:\Windows\System\MflyxNZ.exe
  C:\Windows\System\MflyxNZ.exe
  2⤵
  PID:6896
- C:\Windows\System\FIzmXqF.exe
  C:\Windows\System\FIzmXqF.exe
  2⤵
  PID:6916
- C:\Windows\System\izkRVet.exe
  C:\Windows\System\izkRVet.exe
  2⤵
  PID:6932
- C:\Windows\System\bIxFMgT.exe
  C:\Windows\System\bIxFMgT.exe
  2⤵
  PID:6948
- C:\Windows\System\oeVsBRt.exe
  C:\Windows\System\oeVsBRt.exe
  2⤵
  PID:6964
- C:\Windows\System\nFPcBUq.exe
  C:\Windows\System\nFPcBUq.exe
  2⤵
  PID:6984
- C:\Windows\System\iBHMWDE.exe
  C:\Windows\System\iBHMWDE.exe
  2⤵
  PID:7000
- C:\Windows\System\DdpvGWe.exe
  C:\Windows\System\DdpvGWe.exe
  2⤵
  PID:7016
- C:\Windows\System\OebIUxQ.exe
  C:\Windows\System\OebIUxQ.exe
  2⤵
  PID:7032
- C:\Windows\System\ThpBbxj.exe
  C:\Windows\System\ThpBbxj.exe
  2⤵
  PID:7048
- C:\Windows\System\OllhCOU.exe
  C:\Windows\System\OllhCOU.exe
  2⤵
  PID:7064
- C:\Windows\System\tncCNRG.exe
  C:\Windows\System\tncCNRG.exe
  2⤵
  PID:7080
- C:\Windows\System\xpVOBHM.exe
  C:\Windows\System\xpVOBHM.exe
  2⤵
  PID:7096
- C:\Windows\System\YLbVdLE.exe
  C:\Windows\System\YLbVdLE.exe
  2⤵
  PID:7112
- C:\Windows\System\UyYXlGn.exe
  C:\Windows\System\UyYXlGn.exe
  2⤵
  PID:7128
- C:\Windows\System\YhfCNhX.exe
  C:\Windows\System\YhfCNhX.exe
  2⤵
  PID:7144
- C:\Windows\System\thaddVX.exe
  C:\Windows\System\thaddVX.exe
  2⤵
  PID:7164
- C:\Windows\System\nxRBmui.exe
  C:\Windows\System\nxRBmui.exe
  2⤵
  PID:6180
- C:\Windows\System\TtIjvIF.exe
  C:\Windows\System\TtIjvIF.exe
  2⤵
  PID:6252
- C:\Windows\System\PTCDNxJ.exe
  C:\Windows\System\PTCDNxJ.exe
  2⤵
  PID:6288
- C:\Windows\System\WINTomV.exe
  C:\Windows\System\WINTomV.exe
  2⤵
  PID:5308
- C:\Windows\System\klhyuKl.exe
  C:\Windows\System\klhyuKl.exe
  2⤵
  PID:6196
- C:\Windows\System\iFECStZ.exe
  C:\Windows\System\iFECStZ.exe
  2⤵
  PID:6240
- C:\Windows\System\PqWKEbG.exe
  C:\Windows\System\PqWKEbG.exe
  2⤵
  PID:6332
- C:\Windows\System\NtsIWJr.exe
  C:\Windows\System\NtsIWJr.exe
  2⤵
  PID:6364
- C:\Windows\System\MJUVvKa.exe
  C:\Windows\System\MJUVvKa.exe
  2⤵
  PID:6348
- C:\Windows\System\JvDgzSz.exe
  C:\Windows\System\JvDgzSz.exe
  2⤵
  PID:6412
- C:\Windows\System\uUzTfgC.exe
  C:\Windows\System\uUzTfgC.exe
  2⤵
  PID:6460
- C:\Windows\System\EJtrqhm.exe
  C:\Windows\System\EJtrqhm.exe
  2⤵
  PID:6500
- C:\Windows\System\jBEranE.exe
  C:\Windows\System\jBEranE.exe
  2⤵
  PID:5716
- C:\Windows\System\Mhaaxlh.exe
  C:\Windows\System\Mhaaxlh.exe
  2⤵
  PID:6532
- C:\Windows\System\liOKvMR.exe
  C:\Windows\System\liOKvMR.exe
  2⤵
  PID:6600
- C:\Windows\System\cazBYst.exe
  C:\Windows\System\cazBYst.exe
  2⤵
  PID:6548
- C:\Windows\System\gDvqrgP.exe
  C:\Windows\System\gDvqrgP.exe
  2⤵
  PID:6616
- C:\Windows\System\AEEQExM.exe
  C:\Windows\System\AEEQExM.exe
  2⤵
  PID:6668
- C:\Windows\System\AZAbfAp.exe
  C:\Windows\System\AZAbfAp.exe
  2⤵
  PID:6728
- C:\Windows\System\kkwCgua.exe
  C:\Windows\System\kkwCgua.exe
  2⤵
  PID:6712
- C:\Windows\System\sfJnGYp.exe
  C:\Windows\System\sfJnGYp.exe
  2⤵
  PID:6796
- C:\Windows\System\KuoxqpW.exe
  C:\Windows\System\KuoxqpW.exe
  2⤵
  PID:6748
- C:\Windows\System\PqkInEo.exe
  C:\Windows\System\PqkInEo.exe
  2⤵
  PID:6776
- C:\Windows\System\JEmWoPi.exe
  C:\Windows\System\JEmWoPi.exe
  2⤵
  PID:6888
- C:\Windows\System\HIacOyq.exe
  C:\Windows\System\HIacOyq.exe
  2⤵
  PID:6876
- C:\Windows\System\bxJaBsK.exe
  C:\Windows\System\bxJaBsK.exe
  2⤵
  PID:6956
- C:\Windows\System\OhiatVO.exe
  C:\Windows\System\OhiatVO.exe
  2⤵
  PID:6908
- C:\Windows\System\qUDrMsM.exe
  C:\Windows\System\qUDrMsM.exe
  2⤵
  PID:7024
- C:\Windows\System\dXvBauI.exe
  C:\Windows\System\dXvBauI.exe
  2⤵
  PID:7008
- C:\Windows\System\DgdAkdd.exe
  C:\Windows\System\DgdAkdd.exe
  2⤵
  PID:7012
- C:\Windows\System\rletQUt.exe
  C:\Windows\System\rletQUt.exe
  2⤵
  PID:7072
- C:\Windows\System\fpckAQS.exe
  C:\Windows\System\fpckAQS.exe
  2⤵
  PID:7104
- C:\Windows\System\yWHHjsP.exe
  C:\Windows\System\yWHHjsP.exe
  2⤵
  PID:7140
- C:\Windows\System\uaazyAf.exe
  C:\Windows\System\uaazyAf.exe
  2⤵
  PID:6216
- C:\Windows\System\gDKKDks.exe
  C:\Windows\System\gDKKDks.exe
  2⤵
  PID:5132
- C:\Windows\System\oSxWwhW.exe
  C:\Windows\System\oSxWwhW.exe
  2⤵
  PID:6236
- C:\Windows\System\wSKScGs.exe
  C:\Windows\System\wSKScGs.exe
  2⤵
  PID:6312
- C:\Windows\System\hQgZsih.exe
  C:\Windows\System\hQgZsih.exe
  2⤵
  PID:6268
- C:\Windows\System\zAYrPOy.exe
  C:\Windows\System\zAYrPOy.exe
  2⤵
  PID:6444
- C:\Windows\System\MfYRcmW.exe
  C:\Windows\System\MfYRcmW.exe
  2⤵
  PID:6432
- C:\Windows\System\AZfZxwo.exe
  C:\Windows\System\AZfZxwo.exe
  2⤵
  PID:6520
- C:\Windows\System\RdSVXLI.exe
  C:\Windows\System\RdSVXLI.exe
  2⤵
  PID:6596
- C:\Windows\System\LdaOSYS.exe
  C:\Windows\System\LdaOSYS.exe
  2⤵
  PID:6664
- C:\Windows\System\myEmxeG.exe
  C:\Windows\System\myEmxeG.exe
  2⤵
  PID:6716
- C:\Windows\System\VcCgvLr.exe
  C:\Windows\System\VcCgvLr.exe
  2⤵
  PID:6792
- C:\Windows\System\xGspoHg.exe
  C:\Windows\System\xGspoHg.exe
  2⤵
  PID:6844
- C:\Windows\System\xudQqQX.exe
  C:\Windows\System\xudQqQX.exe
  2⤵
  PID:6892
- C:\Windows\System\mvHfoBe.exe
  C:\Windows\System\mvHfoBe.exe
  2⤵
  PID:7076
- C:\Windows\System\ojNDoOT.exe
  C:\Windows\System\ojNDoOT.exe
  2⤵
  PID:7156
- C:\Windows\System\GeFecDi.exe
  C:\Windows\System\GeFecDi.exe
  2⤵
  PID:7160
- C:\Windows\System\NekxCpN.exe
  C:\Windows\System\NekxCpN.exe
  2⤵
  PID:5680
- C:\Windows\System\kagpriH.exe
  C:\Windows\System\kagpriH.exe
  2⤵
  PID:6192
- C:\Windows\System\pMLyeGy.exe
  C:\Windows\System\pMLyeGy.exe
  2⤵
  PID:6380
- C:\Windows\System\JMLnfbu.exe
  C:\Windows\System\JMLnfbu.exe
  2⤵
  PID:6612
- C:\Windows\System\doswvIn.exe
  C:\Windows\System\doswvIn.exe
  2⤵
  PID:6644
- C:\Windows\System\OmtyaGd.exe
  C:\Windows\System\OmtyaGd.exe
  2⤵
  PID:6860
- C:\Windows\System\jJUJSXr.exe
  C:\Windows\System\jJUJSXr.exe
  2⤵
  PID:6700
- C:\Windows\System\VSQwKNX.exe
  C:\Windows\System\VSQwKNX.exe
  2⤵
  PID:7040
- C:\Windows\System\uZIhVyy.exe
  C:\Windows\System\uZIhVyy.exe
  2⤵
  PID:6148
- C:\Windows\System\uzqwyHX.exe
  C:\Windows\System\uzqwyHX.exe
  2⤵
  PID:6824
- C:\Windows\System\dPtIPLe.exe
  C:\Windows\System\dPtIPLe.exe
  2⤵
  PID:6652
- C:\Windows\System\fMxEdzK.exe
  C:\Windows\System\fMxEdzK.exe
  2⤵
  PID:7188
- C:\Windows\System\HofeJdm.exe
  C:\Windows\System\HofeJdm.exe
  2⤵
  PID:7204
- C:\Windows\System\OGoQSdA.exe
  C:\Windows\System\OGoQSdA.exe
  2⤵
  PID:7220
- C:\Windows\System\bikIjHm.exe
  C:\Windows\System\bikIjHm.exe
  2⤵
  PID:7236
- C:\Windows\System\AMHMsnI.exe
  C:\Windows\System\AMHMsnI.exe
  2⤵
  PID:7252
- C:\Windows\System\MMpqfSM.exe
  C:\Windows\System\MMpqfSM.exe
  2⤵
  PID:7268
- C:\Windows\System\BHcMRqb.exe
  C:\Windows\System\BHcMRqb.exe
  2⤵
  PID:7284
- C:\Windows\System\ucSooiu.exe
  C:\Windows\System\ucSooiu.exe
  2⤵
  PID:7300
- C:\Windows\System\ymufUJZ.exe
  C:\Windows\System\ymufUJZ.exe
  2⤵
  PID:7316
- C:\Windows\System\nwXmjCu.exe
  C:\Windows\System\nwXmjCu.exe
  2⤵
  PID:7332
- C:\Windows\System\qBpWOFT.exe
  C:\Windows\System\qBpWOFT.exe
  2⤵
  PID:7348
- C:\Windows\System\yEOQZOW.exe
  C:\Windows\System\yEOQZOW.exe
  2⤵
  PID:7368
- C:\Windows\System\fihRWWy.exe
  C:\Windows\System\fihRWWy.exe
  2⤵
  PID:7384
- C:\Windows\System\RvHZWQq.exe
  C:\Windows\System\RvHZWQq.exe
  2⤵
  PID:7400
- C:\Windows\System\OixotLB.exe
  C:\Windows\System\OixotLB.exe
  2⤵
  PID:7416
- C:\Windows\System\GtInLqh.exe
  C:\Windows\System\GtInLqh.exe
  2⤵
  PID:7432
- C:\Windows\System\JLyRuUD.exe
  C:\Windows\System\JLyRuUD.exe
  2⤵
  PID:7468
- C:\Windows\System\BQlgRsm.exe
  C:\Windows\System\BQlgRsm.exe
  2⤵
  PID:7484
- C:\Windows\System\wruESjk.exe
  C:\Windows\System\wruESjk.exe
  2⤵
  PID:7500
- C:\Windows\System\nEjNMjI.exe
  C:\Windows\System\nEjNMjI.exe
  2⤵
  PID:7520
- C:\Windows\System\YKHtcKV.exe
  C:\Windows\System\YKHtcKV.exe
  2⤵
  PID:7544
- C:\Windows\System\mzaHLcL.exe
  C:\Windows\System\mzaHLcL.exe
  2⤵
  PID:7580
- C:\Windows\System\gttOXeW.exe
  C:\Windows\System\gttOXeW.exe
  2⤵
  PID:7596
- C:\Windows\System\cgdXCxX.exe
  C:\Windows\System\cgdXCxX.exe
  2⤵
  PID:7612
- C:\Windows\System\AzGqoYC.exe
  C:\Windows\System\AzGqoYC.exe
  2⤵
  PID:7632
- C:\Windows\System\atvdmTi.exe
  C:\Windows\System\atvdmTi.exe
  2⤵
  PID:7648
- C:\Windows\System\taTLXxs.exe
  C:\Windows\System\taTLXxs.exe
  2⤵
  PID:7664
- C:\Windows\System\gkkcURK.exe
  C:\Windows\System\gkkcURK.exe
  2⤵
  PID:7680
- C:\Windows\System\VvRrsBz.exe
  C:\Windows\System\VvRrsBz.exe
  2⤵
  PID:7696
- C:\Windows\System\FkrfRsT.exe
  C:\Windows\System\FkrfRsT.exe
  2⤵
  PID:7712
- C:\Windows\System\gyQVnWk.exe
  C:\Windows\System\gyQVnWk.exe
  2⤵
  PID:7728
- C:\Windows\System\euIzGqC.exe
  C:\Windows\System\euIzGqC.exe
  2⤵
  PID:7744
- C:\Windows\System\AbeFuHw.exe
  C:\Windows\System\AbeFuHw.exe
  2⤵
  PID:7760
- C:\Windows\System\xOYXwjf.exe
  C:\Windows\System\xOYXwjf.exe
  2⤵
  PID:7780
- C:\Windows\System\yvONlCt.exe
  C:\Windows\System\yvONlCt.exe
  2⤵
  PID:7796
- C:\Windows\System\mNoENQe.exe
  C:\Windows\System\mNoENQe.exe
  2⤵
  PID:7812
- C:\Windows\System\kgEwYDW.exe
  C:\Windows\System\kgEwYDW.exe
  2⤵
  PID:7828
- C:\Windows\System\qLkYrFr.exe
  C:\Windows\System\qLkYrFr.exe
  2⤵
  PID:7848
- C:\Windows\System\iraetkL.exe
  C:\Windows\System\iraetkL.exe
  2⤵
  PID:7868
- C:\Windows\System\RuAqltn.exe
  C:\Windows\System\RuAqltn.exe
  2⤵
  PID:7884
- C:\Windows\System\QrcxKSQ.exe
  C:\Windows\System\QrcxKSQ.exe
  2⤵
  PID:7908
- C:\Windows\System\wCBzkfo.exe
  C:\Windows\System\wCBzkfo.exe
  2⤵
  PID:7924
- C:\Windows\System\NPzCRqG.exe
  C:\Windows\System\NPzCRqG.exe
  2⤵
  PID:7944
- C:\Windows\System\zQxcEVU.exe
  C:\Windows\System\zQxcEVU.exe
  2⤵
  PID:7960
- C:\Windows\System\dddfUpt.exe
  C:\Windows\System\dddfUpt.exe
  2⤵
  PID:7976
- C:\Windows\System\NGaUnwI.exe
  C:\Windows\System\NGaUnwI.exe
  2⤵
  PID:7992
- C:\Windows\System\SrMcipq.exe
  C:\Windows\System\SrMcipq.exe
  2⤵
  PID:8008
- C:\Windows\System\sAdfxWw.exe
  C:\Windows\System\sAdfxWw.exe
  2⤵
  PID:8024
- C:\Windows\System\vQUGEDK.exe
  C:\Windows\System\vQUGEDK.exe
  2⤵
  PID:8040
- C:\Windows\System\gyhwfQb.exe
  C:\Windows\System\gyhwfQb.exe
  2⤵
  PID:8056
- C:\Windows\System\OZObZpz.exe
  C:\Windows\System\OZObZpz.exe
  2⤵
  PID:8072
- C:\Windows\System\eylhosG.exe
  C:\Windows\System\eylhosG.exe
  2⤵
  PID:8092
- C:\Windows\System\vHPPhzG.exe
  C:\Windows\System\vHPPhzG.exe
  2⤵
  PID:8108
- C:\Windows\System\sjNYoFq.exe
  C:\Windows\System\sjNYoFq.exe
  2⤵
  PID:8132
- C:\Windows\System\jJDQeeW.exe
  C:\Windows\System\jJDQeeW.exe
  2⤵
  PID:8148
- C:\Windows\System\nOQfRlh.exe
  C:\Windows\System\nOQfRlh.exe
  2⤵
  PID:8164
- C:\Windows\System\Kzrrhdt.exe
  C:\Windows\System\Kzrrhdt.exe
  2⤵
  PID:8180
- C:\Windows\System\yLiWRgG.exe
  C:\Windows\System\yLiWRgG.exe
  2⤵
  PID:7180
- C:\Windows\System\uwVGjkS.exe
  C:\Windows\System\uwVGjkS.exe
  2⤵
  PID:7248
- C:\Windows\System\ylvOmrs.exe
  C:\Windows\System\ylvOmrs.exe
  2⤵
  PID:7136
- C:\Windows\System\NNgjxRm.exe
  C:\Windows\System\NNgjxRm.exe
  2⤵
  PID:6504
- C:\Windows\System\bdOEIDN.exe
  C:\Windows\System\bdOEIDN.exe
  2⤵
  PID:6996
- C:\Windows\System\ZFCbIaM.exe
  C:\Windows\System\ZFCbIaM.exe
  2⤵
  PID:7228
- C:\Windows\System\gtgmhPc.exe
  C:\Windows\System\gtgmhPc.exe
  2⤵
  PID:7260
- C:\Windows\System\xTZtxPJ.exe
  C:\Windows\System\xTZtxPJ.exe
  2⤵
  PID:7312
- C:\Windows\System\RwPeqXf.exe
  C:\Windows\System\RwPeqXf.exe
  2⤵
  PID:7324
- C:\Windows\System\bVHSZSJ.exe
  C:\Windows\System\bVHSZSJ.exe
  2⤵
  PID:7412
- C:\Windows\System\KbKYhat.exe
  C:\Windows\System\KbKYhat.exe
  2⤵
  PID:7396
- C:\Windows\System\GakxWbo.exe
  C:\Windows\System\GakxWbo.exe
  2⤵
  PID:7492
- C:\Windows\System\OjKgcgC.exe
  C:\Windows\System\OjKgcgC.exe
  2⤵
  PID:7536
- C:\Windows\System\OSXvXje.exe
  C:\Windows\System\OSXvXje.exe
  2⤵
  PID:7512
- C:\Windows\System\YNNEAvb.exe
  C:\Windows\System\YNNEAvb.exe
  2⤵
  PID:7552
- C:\Windows\System\MjoqHgW.exe
  C:\Windows\System\MjoqHgW.exe
  2⤵
  PID:7452
- C:\Windows\System\JhtDzEk.exe
  C:\Windows\System\JhtDzEk.exe
  2⤵
  PID:7576
- C:\Windows\System\goLXYqz.exe
  C:\Windows\System\goLXYqz.exe
  2⤵
  PID:7624
- C:\Windows\System\rTApvzf.exe
  C:\Windows\System\rTApvzf.exe
  2⤵
  PID:7692
- C:\Windows\System\tCFVTBJ.exe
  C:\Windows\System\tCFVTBJ.exe
  2⤵
  PID:7720
- C:\Windows\System\BFQtDGp.exe
  C:\Windows\System\BFQtDGp.exe
  2⤵
  PID:7640
- C:\Windows\System\HSoOVEd.exe
  C:\Windows\System\HSoOVEd.exe
  2⤵
  PID:7708
- C:\Windows\System\hkidaZG.exe
  C:\Windows\System\hkidaZG.exe
  2⤵
  PID:7768
- C:\Windows\System\QFiXBpq.exe
  C:\Windows\System\QFiXBpq.exe
  2⤵
  PID:7820
- C:\Windows\System\DNWCjbh.exe
  C:\Windows\System\DNWCjbh.exe
  2⤵
  PID:7864
- C:\Windows\System\yWPKTRb.exe
  C:\Windows\System\yWPKTRb.exe
  2⤵
  PID:7904
- C:\Windows\System\UZlqFtW.exe
  C:\Windows\System\UZlqFtW.exe
  2⤵
  PID:7840
- C:\Windows\System\dOFkKWd.exe
  C:\Windows\System\dOFkKWd.exe
  2⤵
  PID:7972
- C:\Windows\System\tDFuWkI.exe
  C:\Windows\System\tDFuWkI.exe
  2⤵
  PID:7880
- C:\Windows\System\KSivSNw.exe
  C:\Windows\System\KSivSNw.exe
  2⤵
  PID:8004
- C:\Windows\System\dLXxUBD.exe
  C:\Windows\System\dLXxUBD.exe
  2⤵
  PID:8016
- C:\Windows\System\VYsgCJc.exe
  C:\Windows\System\VYsgCJc.exe
  2⤵
  PID:7572
- C:\Windows\System\IQRfqkd.exe
  C:\Windows\System\IQRfqkd.exe
  2⤵
  PID:8088
- C:\Windows\System\GzqXtGR.exe
  C:\Windows\System\GzqXtGR.exe
  2⤵
  PID:8140
- C:\Windows\System\IMLleKd.exe
  C:\Windows\System\IMLleKd.exe
  2⤵
  PID:8144
- C:\Windows\System\XHeLqfI.exe
  C:\Windows\System\XHeLqfI.exe
  2⤵
  PID:8116
- C:\Windows\System\cNynOLw.exe
  C:\Windows\System\cNynOLw.exe
  2⤵
  PID:7244
- C:\Windows\System\NoMQrCZ.exe
  C:\Windows\System\NoMQrCZ.exe
  2⤵
  PID:7176
- C:\Windows\System\FkeMAbL.exe
  C:\Windows\System\FkeMAbL.exe
  2⤵
  PID:6696
- C:\Windows\System\aKyEYbZ.exe
  C:\Windows\System\aKyEYbZ.exe
  2⤵
  PID:7308
- C:\Windows\System\OoWyFsW.exe
  C:\Windows\System\OoWyFsW.exe
  2⤵
  PID:2704
- C:\Windows\System\yomQAwE.exe
  C:\Windows\System\yomQAwE.exe
  2⤵
  PID:7232
- C:\Windows\System\vkorfir.exe
  C:\Windows\System\vkorfir.exe
  2⤵
  PID:7292
- C:\Windows\System\eBIkwut.exe
  C:\Windows\System\eBIkwut.exe
  2⤵
  PID:7408
- C:\Windows\System\IhThJOt.exe
  C:\Windows\System\IhThJOt.exe
  2⤵
  PID:7480
- C:\Windows\System\XlnfbtV.exe
  C:\Windows\System\XlnfbtV.exe
  2⤵
  PID:7532
- C:\Windows\System\ZJMsITK.exe
  C:\Windows\System\ZJMsITK.exe
  2⤵
  PID:7588
- C:\Windows\System\NabauQM.exe
  C:\Windows\System\NabauQM.exe
  2⤵
  PID:7608
- C:\Windows\System\zzygate.exe
  C:\Windows\System\zzygate.exe
  2⤵
  PID:7752
- C:\Windows\System\DkgXQnm.exe
  C:\Windows\System\DkgXQnm.exe
  2⤵
  PID:7792
- C:\Windows\System\tHihBca.exe
  C:\Windows\System\tHihBca.exe
  2⤵
  PID:7740
- C:\Windows\System\dKhdhbJ.exe
  C:\Windows\System\dKhdhbJ.exe
  2⤵
  PID:7968
- C:\Windows\System\TtNuMzJ.exe
  C:\Windows\System\TtNuMzJ.exe
  2⤵
  PID:8020
- C:\Windows\System\UEvWoHf.exe
  C:\Windows\System\UEvWoHf.exe
  2⤵
  PID:7876
- C:\Windows\System\oailppc.exe
  C:\Windows\System\oailppc.exe
  2⤵
  PID:8048
- C:\Windows\System\MGDIcJi.exe
  C:\Windows\System\MGDIcJi.exe
  2⤵
  PID:7356
- C:\Windows\System\KpFSWRF.exe
  C:\Windows\System\KpFSWRF.exe
  2⤵
  PID:8120
- C:\Windows\System\FRkzARv.exe
  C:\Windows\System\FRkzARv.exe
  2⤵
  PID:6764
- C:\Windows\System\GZmMOZM.exe
  C:\Windows\System\GZmMOZM.exe
  2⤵
  PID:8172
- C:\Windows\System\cmUqQEu.exe
  C:\Windows\System\cmUqQEu.exe
  2⤵
  PID:2544
- C:\Windows\System\HSjOEpE.exe
  C:\Windows\System\HSjOEpE.exe
  2⤵
  PID:7380
- C:\Windows\System\YxOjZHb.exe
  C:\Windows\System\YxOjZHb.exe
  2⤵
  PID:7456
- C:\Windows\System\SWTLzTH.exe
  C:\Windows\System\SWTLzTH.exe
  2⤵
  PID:7592
- C:\Windows\System\OzWAbxd.exe
  C:\Windows\System\OzWAbxd.exe
  2⤵
  PID:7804
- C:\Windows\System\FBYQPyS.exe
  C:\Windows\System\FBYQPyS.exe
  2⤵
  PID:7556
- C:\Windows\System\swixSpn.exe
  C:\Windows\System\swixSpn.exe
  2⤵
  PID:7856
- C:\Windows\System\PtZELiI.exe
  C:\Windows\System\PtZELiI.exe
  2⤵
  PID:7860
- C:\Windows\System\yiyUWJs.exe
  C:\Windows\System\yiyUWJs.exe
  2⤵
  PID:8100
- C:\Windows\System\lnGaRkU.exe
  C:\Windows\System\lnGaRkU.exe
  2⤵
  PID:7568
- C:\Windows\System\LXCaCbP.exe
  C:\Windows\System\LXCaCbP.exe
  2⤵
  PID:8160
- C:\Windows\System\WaKydEV.exe
  C:\Windows\System\WaKydEV.exe
  2⤵
  PID:7628
- C:\Windows\System\RzNExMv.exe
  C:\Windows\System\RzNExMv.exe
  2⤵
  PID:7448
- C:\Windows\System\lnnsjbh.exe
  C:\Windows\System\lnnsjbh.exe
  2⤵
  PID:7216
- C:\Windows\System\hHEDQql.exe
  C:\Windows\System\hHEDQql.exe
  2⤵
  PID:7952
- C:\Windows\System\HptRHvo.exe
  C:\Windows\System\HptRHvo.exe
  2⤵
  PID:8196
- C:\Windows\System\hWjpcSO.exe
  C:\Windows\System\hWjpcSO.exe
  2⤵
  PID:8216
- C:\Windows\System\kMIpgxo.exe
  C:\Windows\System\kMIpgxo.exe
  2⤵
  PID:8236
- C:\Windows\System\GGiKekI.exe
  C:\Windows\System\GGiKekI.exe
  2⤵
  PID:8252
- C:\Windows\System\vhJEeDs.exe
  C:\Windows\System\vhJEeDs.exe
  2⤵
  PID:8272
- C:\Windows\System\cUdBGdZ.exe
  C:\Windows\System\cUdBGdZ.exe
  2⤵
  PID:8288
- C:\Windows\System\WTtVnbn.exe
  C:\Windows\System\WTtVnbn.exe
  2⤵
  PID:8308
- C:\Windows\System\agvXRSv.exe
  C:\Windows\System\agvXRSv.exe
  2⤵
  PID:8324
- C:\Windows\System\SyNOmfZ.exe
  C:\Windows\System\SyNOmfZ.exe
  2⤵
  PID:8340
- C:\Windows\System\IBeIbVD.exe
  C:\Windows\System\IBeIbVD.exe
  2⤵
  PID:8364
- C:\Windows\System\JtXJnXY.exe
  C:\Windows\System\JtXJnXY.exe
  2⤵
  PID:8380
- C:\Windows\System\eTDZtSH.exe
  C:\Windows\System\eTDZtSH.exe
  2⤵
  PID:8396
- C:\Windows\System\lxKDEBC.exe
  C:\Windows\System\lxKDEBC.exe
  2⤵
  PID:8424
- C:\Windows\System\mHtBvDz.exe
  C:\Windows\System\mHtBvDz.exe
  2⤵
  PID:8440
- C:\Windows\System\cXUWdfK.exe
  C:\Windows\System\cXUWdfK.exe
  2⤵
  PID:8456
- C:\Windows\System\MPBaqTZ.exe
  C:\Windows\System\MPBaqTZ.exe
  2⤵
  PID:8472
- C:\Windows\System\ULsMrQr.exe
  C:\Windows\System\ULsMrQr.exe
  2⤵
  PID:8488
- C:\Windows\System\rlMDXfZ.exe
  C:\Windows\System\rlMDXfZ.exe
  2⤵
  PID:8504
- C:\Windows\System\xFODbhN.exe
  C:\Windows\System\xFODbhN.exe
  2⤵
  PID:8520
- C:\Windows\System\GEHxNJY.exe
  C:\Windows\System\GEHxNJY.exe
  2⤵
  PID:8544
- C:\Windows\System\uYXXeKw.exe
  C:\Windows\System\uYXXeKw.exe
  2⤵
  PID:8560
- C:\Windows\System\UiVEodD.exe
  C:\Windows\System\UiVEodD.exe
  2⤵
  PID:8576
- C:\Windows\System\hPrmnra.exe
  C:\Windows\System\hPrmnra.exe
  2⤵
  PID:8592
- C:\Windows\System\fbyCOAl.exe
  C:\Windows\System\fbyCOAl.exe
  2⤵
  PID:8608
- C:\Windows\System\HYloRmt.exe
  C:\Windows\System\HYloRmt.exe
  2⤵
  PID:8624
- C:\Windows\System\uxtivlb.exe
  C:\Windows\System\uxtivlb.exe
  2⤵
  PID:8652
- C:\Windows\System\xIuvHeV.exe
  C:\Windows\System\xIuvHeV.exe
  2⤵
  PID:8668
- C:\Windows\System\YhQNgAE.exe
  C:\Windows\System\YhQNgAE.exe
  2⤵
  PID:8684
- C:\Windows\System\wfyxqfZ.exe
  C:\Windows\System\wfyxqfZ.exe
  2⤵
  PID:8700
- C:\Windows\System\cxGbzuv.exe
  C:\Windows\System\cxGbzuv.exe
  2⤵
  PID:8716
- C:\Windows\System\OyjKLzD.exe
  C:\Windows\System\OyjKLzD.exe
  2⤵
  PID:8732
- C:\Windows\System\CqcjBbG.exe
  C:\Windows\System\CqcjBbG.exe
  2⤵
  PID:8748
- C:\Windows\System\IgMnmKp.exe
  C:\Windows\System\IgMnmKp.exe
  2⤵
  PID:8768
- C:\Windows\System\RgVAqqo.exe
  C:\Windows\System\RgVAqqo.exe
  2⤵
  PID:8784
- C:\Windows\System\qJBWecf.exe
  C:\Windows\System\qJBWecf.exe
  2⤵
  PID:8800
- C:\Windows\System\yGfJikh.exe
  C:\Windows\System\yGfJikh.exe
  2⤵
  PID:8816
- C:\Windows\System\LpIdmew.exe
  C:\Windows\System\LpIdmew.exe
  2⤵
  PID:8832
- C:\Windows\System\BGezVgh.exe
  C:\Windows\System\BGezVgh.exe
  2⤵
  PID:8852
- C:\Windows\System\dFzTpSz.exe
  C:\Windows\System\dFzTpSz.exe
  2⤵
  PID:8868
- C:\Windows\System\KQbLnYN.exe
  C:\Windows\System\KQbLnYN.exe
  2⤵
  PID:8888
- C:\Windows\System\ZGHfStt.exe
  C:\Windows\System\ZGHfStt.exe
  2⤵
  PID:8904
- C:\Windows\System\WOwKkpZ.exe
  C:\Windows\System\WOwKkpZ.exe
  2⤵
  PID:8936
- C:\Windows\System\NGMYjeO.exe
  C:\Windows\System\NGMYjeO.exe
  2⤵
  PID:8992
- C:\Windows\System\VlxOPDt.exe
  C:\Windows\System\VlxOPDt.exe
  2⤵
  PID:9008
- C:\Windows\System\IWlKgNU.exe
  C:\Windows\System\IWlKgNU.exe
  2⤵
  PID:9024
- C:\Windows\System\joyuONM.exe
  C:\Windows\System\joyuONM.exe
  2⤵
  PID:9048
- C:\Windows\System\yRMQVJw.exe
  C:\Windows\System\yRMQVJw.exe
  2⤵
  PID:9064
- C:\Windows\System\ifbhjmf.exe
  C:\Windows\System\ifbhjmf.exe
  2⤵
  PID:9080
- C:\Windows\System\Rhygobf.exe
  C:\Windows\System\Rhygobf.exe
  2⤵
  PID:9096
- C:\Windows\System\WvlcTYS.exe
  C:\Windows\System\WvlcTYS.exe
  2⤵
  PID:9112
- C:\Windows\System\jHykbWE.exe
  C:\Windows\System\jHykbWE.exe
  2⤵
  PID:9128
- C:\Windows\System\sJkUhbm.exe
  C:\Windows\System\sJkUhbm.exe
  2⤵
  PID:9144
- C:\Windows\System\hwriIKy.exe
  C:\Windows\System\hwriIKy.exe
  2⤵
  PID:9160
- C:\Windows\System\lexmyAT.exe
  C:\Windows\System\lexmyAT.exe
  2⤵
  PID:9176
- C:\Windows\System\fElQKOX.exe
  C:\Windows\System\fElQKOX.exe
  2⤵
  PID:9192
- C:\Windows\System\ZaNIknr.exe
  C:\Windows\System\ZaNIknr.exe
  2⤵
  PID:9208
- C:\Windows\System\btHjYKo.exe
  C:\Windows\System\btHjYKo.exe
  2⤵
  PID:8204
- C:\Windows\System\sNWlaEq.exe
  C:\Windows\System\sNWlaEq.exe
  2⤵
  PID:7900
- C:\Windows\System\UQHHIxT.exe
  C:\Windows\System\UQHHIxT.exe
  2⤵
  PID:8248
- C:\Windows\System\rVRLlHP.exe
  C:\Windows\System\rVRLlHP.exe
  2⤵
  PID:7328
- C:\Windows\System\ecNqIkm.exe
  C:\Windows\System\ecNqIkm.exe
  2⤵
  PID:8280
- C:\Windows\System\DClwPgu.exe
  C:\Windows\System\DClwPgu.exe
  2⤵
  PID:8296
- C:\Windows\System\cTmfdFg.exe
  C:\Windows\System\cTmfdFg.exe
  2⤵
  PID:8404
- C:\Windows\System\UnCPZmR.exe
  C:\Windows\System\UnCPZmR.exe
  2⤵
  PID:8388
- C:\Windows\System\imTAaaG.exe
  C:\Windows\System\imTAaaG.exe
  2⤵
  PID:8360
- C:\Windows\System\oLzZjit.exe
  C:\Windows\System\oLzZjit.exe
  2⤵
  PID:8436
- C:\Windows\System\bEJtKLC.exe
  C:\Windows\System\bEJtKLC.exe
  2⤵
  PID:8496
- C:\Windows\System\YCsHhuj.exe
  C:\Windows\System\YCsHhuj.exe
  2⤵
  PID:8536
- C:\Windows\System\TyfrfYU.exe
  C:\Windows\System\TyfrfYU.exe
  2⤵
  PID:8640
- C:\Windows\System\ouexrYx.exe
  C:\Windows\System\ouexrYx.exe
  2⤵
  PID:8676
- C:\Windows\System\lRGYMdg.exe
  C:\Windows\System\lRGYMdg.exe
  2⤵
  PID:8664
- C:\Windows\System\BPUWtbG.exe
  C:\Windows\System\BPUWtbG.exe
  2⤵
  PID:8728
- C:\Windows\System\sWNsyFp.exe
  C:\Windows\System\sWNsyFp.exe
  2⤵
  PID:9256
- C:\Windows\System\gelyNVM.exe
  C:\Windows\System\gelyNVM.exe
  2⤵
  PID:9280
- C:\Windows\System\OfMHdUS.exe
  C:\Windows\System\OfMHdUS.exe
  2⤵
  PID:9308
- C:\Windows\System\IwJtiTu.exe
  C:\Windows\System\IwJtiTu.exe
  2⤵
  PID:9352
- C:\Windows\System\JEjoIsG.exe
  C:\Windows\System\JEjoIsG.exe
  2⤵
  PID:9472
- C:\Windows\System\utgYrwp.exe
  C:\Windows\System\utgYrwp.exe
  2⤵
  PID:9492
- C:\Windows\System\DVdDICE.exe
  C:\Windows\System\DVdDICE.exe
  2⤵
  PID:9544
- C:\Windows\System\nWNmryT.exe
  C:\Windows\System\nWNmryT.exe
  2⤵
  PID:9560
- C:\Windows\System\mwpepWg.exe
  C:\Windows\System\mwpepWg.exe
  2⤵
  PID:9576
- C:\Windows\System\htgBrMQ.exe
  C:\Windows\System\htgBrMQ.exe
  2⤵
  PID:9596
- C:\Windows\System\hRMsHNK.exe
  C:\Windows\System\hRMsHNK.exe
  2⤵
  PID:9748
- C:\Windows\System\dWjsuot.exe
  C:\Windows\System\dWjsuot.exe
  2⤵
  PID:9796
- C:\Windows\System\MfYIKXc.exe
  C:\Windows\System\MfYIKXc.exe
  2⤵
  PID:9816
- C:\Windows\System\mTepgWE.exe
  C:\Windows\System\mTepgWE.exe
  2⤵
  PID:9832
- C:\Windows\System\oCwXsoJ.exe
  C:\Windows\System\oCwXsoJ.exe
  2⤵
  PID:9848
- C:\Windows\System\pYMAFmd.exe
  C:\Windows\System\pYMAFmd.exe
  2⤵
  PID:9864
- C:\Windows\System\Mguctjq.exe
  C:\Windows\System\Mguctjq.exe
  2⤵
  PID:9880
- C:\Windows\System\aNlcGTj.exe
  C:\Windows\System\aNlcGTj.exe
  2⤵
  PID:9896
- C:\Windows\System\yCUBmaR.exe
  C:\Windows\System\yCUBmaR.exe
  2⤵
  PID:9916
- C:\Windows\System\KcDGxkp.exe
  C:\Windows\System\KcDGxkp.exe
  2⤵
  PID:9936
- C:\Windows\System\zFwgaER.exe
  C:\Windows\System\zFwgaER.exe
  2⤵
  PID:9956
- C:\Windows\System\YYGgfev.exe
  C:\Windows\System\YYGgfev.exe
  2⤵
  PID:9988
- C:\Windows\System\gLsbyFR.exe
  C:\Windows\System\gLsbyFR.exe
  2⤵
  PID:10004
- C:\Windows\System\DTPsCxo.exe
  C:\Windows\System\DTPsCxo.exe
  2⤵
  PID:10044
- C:\Windows\System\jXQEhIp.exe
  C:\Windows\System\jXQEhIp.exe
  2⤵
  PID:10060
- C:\Windows\System\JZAvnGm.exe
  C:\Windows\System\JZAvnGm.exe
  2⤵
  PID:10076
- C:\Windows\System\qIQJSFN.exe
  C:\Windows\System\qIQJSFN.exe
  2⤵
  PID:10096
- C:\Windows\System\MgLtRpb.exe
  C:\Windows\System\MgLtRpb.exe
  2⤵
  PID:10112
- C:\Windows\System\FMPOLle.exe
  C:\Windows\System\FMPOLle.exe
  2⤵
  PID:10128
- C:\Windows\System\MdlOSWF.exe
  C:\Windows\System\MdlOSWF.exe
  2⤵
  PID:10144
- C:\Windows\System\OHvzENR.exe
  C:\Windows\System\OHvzENR.exe
  2⤵
  PID:10164
- C:\Windows\System\BePyMdd.exe
  C:\Windows\System\BePyMdd.exe
  2⤵
  PID:10180
- C:\Windows\System\IZAygAy.exe
  C:\Windows\System\IZAygAy.exe
  2⤵
  PID:10196
- C:\Windows\System\McniGnN.exe
  C:\Windows\System\McniGnN.exe
  2⤵
  PID:10212
- C:\Windows\System\EZyQRpC.exe
  C:\Windows\System\EZyQRpC.exe
  2⤵
  PID:10228
- C:\Windows\System\pyHySQN.exe
  C:\Windows\System\pyHySQN.exe
  2⤵
  PID:8780
- C:\Windows\System\lAtDeUY.exe
  C:\Windows\System\lAtDeUY.exe
  2⤵
  PID:8764
- C:\Windows\System\FSZWLnr.exe
  C:\Windows\System\FSZWLnr.exe
  2⤵
  PID:8432
- C:\Windows\System\BRbooXR.exe
  C:\Windows\System\BRbooXR.exe
  2⤵
  PID:8260
- C:\Windows\System\LrEPInf.exe
  C:\Windows\System\LrEPInf.exe
  2⤵
  PID:9092
- C:\Windows\System\PcimGgj.exe
  C:\Windows\System\PcimGgj.exe
  2⤵
  PID:8660
- C:\Windows\System\Faxywxx.exe
  C:\Windows\System\Faxywxx.exe
  2⤵
  PID:9228
- C:\Windows\System\rmEEIHJ.exe
  C:\Windows\System\rmEEIHJ.exe
  2⤵
  PID:8916
- C:\Windows\System\LcKFuJe.exe
  C:\Windows\System\LcKFuJe.exe
  2⤵
  PID:9468
- C:\Windows\System\icFVPVs.exe
  C:\Windows\System\icFVPVs.exe
  2⤵
  PID:9372
- C:\Windows\System\WykZqML.exe
  C:\Windows\System\WykZqML.exe
  2⤵
  PID:9380
- C:\Windows\System\IfaNRZP.exe
  C:\Windows\System\IfaNRZP.exe
  2⤵
  PID:9436
- C:\Windows\System\QradwlP.exe
  C:\Windows\System\QradwlP.exe
  2⤵
  PID:9296
- C:\Windows\System\KJwLqBn.exe
  C:\Windows\System\KJwLqBn.exe
  2⤵
  PID:8392
- C:\Windows\System\uKrgscv.exe
  C:\Windows\System\uKrgscv.exe
  2⤵
  PID:9104
- C:\Windows\System\XuGDbrx.exe
  C:\Windows\System\XuGDbrx.exe
  2⤵
  PID:8884
- C:\Windows\System\nHQxksc.exe
  C:\Windows\System\nHQxksc.exe
  2⤵
  PID:8928
- C:\Windows\System\FVpGJJn.exe
  C:\Windows\System\FVpGJJn.exe
  2⤵
  PID:8796
- C:\Windows\System\pptOddb.exe
  C:\Windows\System\pptOddb.exe
  2⤵
  PID:9416
- C:\Windows\System\hvBTkuS.exe
  C:\Windows\System\hvBTkuS.exe
  2⤵
  PID:9444
- C:\Windows\System\jcGOMLd.exe
  C:\Windows\System\jcGOMLd.exe
  2⤵
  PID:9500
- C:\Windows\System\pIhjCvk.exe
  C:\Windows\System\pIhjCvk.exe
  2⤵
  PID:9552
- C:\Windows\System\IzIfOyn.exe
  C:\Windows\System\IzIfOyn.exe
  2⤵
  PID:9532
- C:\Windows\System\XaGgjUj.exe
  C:\Windows\System\XaGgjUj.exe
  2⤵
  PID:2888
- C:\Windows\System\uqqxIGz.exe
  C:\Windows\System\uqqxIGz.exe
  2⤵
  PID:1912
- C:\Windows\System\fuGurpI.exe
  C:\Windows\System\fuGurpI.exe
  2⤵
  PID:9588
- C:\Windows\System\yjjDXRQ.exe
  C:\Windows\System\yjjDXRQ.exe
  2⤵
  PID:9764
- C:\Windows\System\wsSMNBT.exe
  C:\Windows\System\wsSMNBT.exe
  2⤵
  PID:9664
- C:\Windows\System\FILZrox.exe
  C:\Windows\System\FILZrox.exe
  2⤵
  PID:9640
- C:\Windows\System\oRSkmeX.exe
  C:\Windows\System\oRSkmeX.exe
  2⤵
  PID:9660
- C:\Windows\System\EdSorBm.exe
  C:\Windows\System\EdSorBm.exe
  2⤵
  PID:9700
- C:\Windows\System\UzmBOCQ.exe
  C:\Windows\System\UzmBOCQ.exe
  2⤵
  PID:9964
- C:\Windows\System\lhnWAiL.exe
  C:\Windows\System\lhnWAiL.exe
  2⤵
  PID:9804
- C:\Windows\System\OVuHvoS.exe
  C:\Windows\System\OVuHvoS.exe
  2⤵
  PID:9840
- C:\Windows\System\tnKxLIS.exe
  C:\Windows\System\tnKxLIS.exe
  2⤵
  PID:2036
- C:\Windows\System\aaeSorb.exe
  C:\Windows\System\aaeSorb.exe
  2⤵
  PID:9876
- C:\Windows\System\ubfBsow.exe
  C:\Windows\System\ubfBsow.exe
  2⤵
  PID:10068
- C:\Windows\System\vmzSQmQ.exe
  C:\Windows\System\vmzSQmQ.exe
  2⤵
  PID:10136
- C:\Windows\System\MDGeBsj.exe
  C:\Windows\System\MDGeBsj.exe
  2⤵
  PID:10208
- C:\Windows\System\uvRAdqG.exe
  C:\Windows\System\uvRAdqG.exe
  2⤵
  PID:10084
- C:\Windows\System\HAnQCJk.exe
  C:\Windows\System\HAnQCJk.exe
  2⤵
  PID:10156
- C:\Windows\System\iEvEEoE.exe
  C:\Windows\System\iEvEEoE.exe
  2⤵
  PID:5524
- C:\Windows\System\rljjwKX.exe
  C:\Windows\System\rljjwKX.exe
  2⤵
  PID:9332
- C:\Windows\System\GZholEN.exe
  C:\Windows\System\GZholEN.exe
  2⤵
  PID:9320
- C:\Windows\System\ILXhbgt.exe
  C:\Windows\System\ILXhbgt.exe
  2⤵
  PID:8316
- C:\Windows\System\YFkUdfa.exe
  C:\Windows\System\YFkUdfa.exe
  2⤵
  PID:9060
- C:\Windows\System\aIPhARW.exe
  C:\Windows\System\aIPhARW.exe
  2⤵
  PID:6912
- C:\Windows\System\PhkzHpB.exe
  C:\Windows\System\PhkzHpB.exe
  2⤵
  PID:9508
- C:\Windows\System\qyOReWc.exe
  C:\Windows\System\qyOReWc.exe
  2⤵
  PID:8944
- C:\Windows\System\MAzXYES.exe
  C:\Windows\System\MAzXYES.exe
  2⤵
  PID:8976
- C:\Windows\System\PUJeLdt.exe
  C:\Windows\System\PUJeLdt.exe
  2⤵
  PID:8412
- C:\Windows\System\ZhtyVcp.exe
  C:\Windows\System\ZhtyVcp.exe
  2⤵
  PID:8512
- C:\Windows\System\MmMJpgx.exe
  C:\Windows\System\MmMJpgx.exe
  2⤵
  PID:8348
- C:\Windows\System\svcKFsv.exe
  C:\Windows\System\svcKFsv.exe
  2⤵
  PID:9188
- C:\Windows\System\lYsBLmI.exe
  C:\Windows\System\lYsBLmI.exe
  2⤵
  PID:8696
- C:\Windows\System\ytcUwvq.exe
  C:\Windows\System\ytcUwvq.exe
  2⤵
  PID:8968
- C:\Windows\System\JSrROkX.exe
  C:\Windows\System\JSrROkX.exe
  2⤵
  PID:9484
- C:\Windows\System\HxjaKkM.exe
  C:\Windows\System\HxjaKkM.exe
  2⤵
  PID:3024
- C:\Windows\System\xBwznOa.exe
  C:\Windows\System\xBwznOa.exe
  2⤵
  PID:9236
- C:\Windows\System\KWPcsmc.exe
  C:\Windows\System\KWPcsmc.exe
  2⤵
  PID:9404
- C:\Windows\System\BGdEPRD.exe
  C:\Windows\System\BGdEPRD.exe
  2⤵
  PID:8244
- C:\Windows\System\ixkOuZh.exe
  C:\Windows\System\ixkOuZh.exe
  2⤵
  PID:5828
- C:\Windows\System\nMJhzVk.exe
  C:\Windows\System\nMJhzVk.exe
  2⤵
  PID:9400
- C:\Windows\System\UuRXpJS.exe
  C:\Windows\System\UuRXpJS.exe
  2⤵
  PID:9528
- C:\Windows\System\rjpomED.exe
  C:\Windows\System\rjpomED.exe
  2⤵
  PID:9036
- C:\Windows\System\SoWKesv.exe
  C:\Windows\System\SoWKesv.exe
  2⤵
  PID:9540
- C:\Windows\System\pRTbKLc.exe
  C:\Windows\System\pRTbKLc.exe
  2⤵
  PID:9784
- C:\Windows\System\SZyxkrD.exe
  C:\Windows\System\SZyxkrD.exe
  2⤵
  PID:9268
- C:\Windows\System\NCOXrrL.exe
  C:\Windows\System\NCOXrrL.exe
  2⤵
  PID:9616
- C:\Windows\System\jgFIhPZ.exe
  C:\Windows\System\jgFIhPZ.exe
  2⤵
  PID:9692
- C:\Windows\System\wkNufGo.exe
  C:\Windows\System\wkNufGo.exe
  2⤵
  PID:9724
- C:\Windows\System\AHTccDh.exe
  C:\Windows\System\AHTccDh.exe
  2⤵
  PID:9856
- C:\Windows\System\UQQITxI.exe
  C:\Windows\System\UQQITxI.exe
  2⤵
  PID:9648
- C:\Windows\System\SCVqNwB.exe
  C:\Windows\System\SCVqNwB.exe
  2⤵
  PID:2044
- C:\Windows\System\mNyRGnY.exe
  C:\Windows\System\mNyRGnY.exe
  2⤵
  PID:9688
- C:\Windows\System\LnHQNdU.exe
  C:\Windows\System\LnHQNdU.exe
  2⤵
  PID:9928
- C:\Windows\System\zhYmkbH.exe
  C:\Windows\System\zhYmkbH.exe
  2⤵
  PID:9744
- C:\Windows\System\nuRYtyn.exe
  C:\Windows\System\nuRYtyn.exe
  2⤵
  PID:9844
- C:\Windows\System\oiOjhJk.exe
  C:\Windows\System\oiOjhJk.exe
  2⤵
  PID:10016
- C:\Windows\System\TbCWQAP.exe
  C:\Windows\System\TbCWQAP.exe
  2⤵
  PID:10204
- C:\Windows\System\YBnccfT.exe
  C:\Windows\System\YBnccfT.exe
  2⤵
  PID:10056
- C:\Windows\System\KQXYRqX.exe
  C:\Windows\System\KQXYRqX.exe
  2⤵
  PID:10028
- C:\Windows\System\ZtkUHpR.exe
  C:\Windows\System\ZtkUHpR.exe
  2⤵
  PID:10092
- C:\Windows\System\iLcIbEF.exe
  C:\Windows\System\iLcIbEF.exe
  2⤵
  PID:9088
- C:\Windows\System\TskdDUk.exe
  C:\Windows\System\TskdDUk.exe
  2⤵
  PID:9108
- C:\Windows\System\VJyYTah.exe
  C:\Windows\System\VJyYTah.exe
  2⤵
  PID:2368
- C:\Windows\System\ktIgrWh.exe
  C:\Windows\System\ktIgrWh.exe
  2⤵
  PID:8604
- C:\Windows\System\XxuaHGI.exe
  C:\Windows\System\XxuaHGI.exe
  2⤵
  PID:8620
- C:\Windows\System\uKjIlYZ.exe
  C:\Windows\System\uKjIlYZ.exe
  2⤵
  PID:8708
- C:\Windows\System\UcrzWSX.exe
  C:\Windows\System\UcrzWSX.exe
  2⤵
  PID:8468
- C:\Windows\System\iNbqhUD.exe
  C:\Windows\System\iNbqhUD.exe
  2⤵
  PID:8448
- C:\Windows\System\YmKmEjE.exe
  C:\Windows\System\YmKmEjE.exe
  2⤵
  PID:10088
- C:\Windows\System\tfUOIlj.exe
  C:\Windows\System\tfUOIlj.exe
  2⤵
  PID:8848
- C:\Windows\System\vwicqsD.exe
  C:\Windows\System\vwicqsD.exe
  2⤵
  PID:8744
- C:\Windows\System\lmEAelz.exe
  C:\Windows\System\lmEAelz.exe
  2⤵
  PID:10160
- C:\Windows\System\GJSKyLe.exe
  C:\Windows\System\GJSKyLe.exe
  2⤵
  PID:10120
- C:\Windows\System\dnhRCrS.exe
  C:\Windows\System\dnhRCrS.exe
  2⤵
  PID:8824
- C:\Windows\System\oFiuYMR.exe
  C:\Windows\System\oFiuYMR.exe
  2⤵
  PID:8912
- C:\Windows\System\jyYWQZT.exe
  C:\Windows\System\jyYWQZT.exe
  2⤵
  PID:9220
- C:\Windows\System\yNWhxaV.exe
  C:\Windows\System\yNWhxaV.exe
  2⤵
  PID:9428
- C:\Windows\System\WXGIvLO.exe
  C:\Windows\System\WXGIvLO.exe
  2⤵
  PID:8556
- C:\Windows\System\irwHjPN.exe
  C:\Windows\System\irwHjPN.exe
  2⤵
  PID:9368
- C:\Windows\System\IgiWGpW.exe
  C:\Windows\System\IgiWGpW.exe
  2⤵
  PID:8464
- C:\Windows\System\THufjre.exe
  C:\Windows\System\THufjre.exe
  2⤵
  PID:7672
- C:\Windows\System\guiZEoV.exe
  C:\Windows\System\guiZEoV.exe
  2⤵
  PID:9124
- C:\Windows\System\hHXzxtH.exe
  C:\Windows\System\hHXzxtH.exe
  2⤵
  PID:8808
- C:\Windows\System\OXziQQX.exe
  C:\Windows\System\OXziQQX.exe
  2⤵
  PID:9292
- C:\Windows\System\KoJXURP.exe
  C:\Windows\System\KoJXURP.exe
  2⤵
  PID:9524
- C:\Windows\System\UBopvSg.exe
  C:\Windows\System\UBopvSg.exe
  2⤵
  PID:2016
- C:\Windows\System\PpwuGFv.exe
  C:\Windows\System\PpwuGFv.exe
  2⤵
  PID:9712
- C:\Windows\System\bJHycrd.exe
  C:\Windows\System\bJHycrd.exe
  2⤵
  PID:8828
- C:\Windows\System\qLNUwpl.exe
  C:\Windows\System\qLNUwpl.exe
  2⤵
  PID:8648
- C:\Windows\System\RUUohPU.exe
  C:\Windows\System\RUUohPU.exe
  2⤵
  PID:9908
- C:\Windows\System\RqkgKZi.exe
  C:\Windows\System\RqkgKZi.exe
  2⤵
  PID:9656
- C:\Windows\System\cXookyI.exe
  C:\Windows\System\cXookyI.exe
  2⤵
  PID:9828

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AbQNPdv.exe

Filesize
2.2MB

MD5
ad9b72d466fbb2ea979164a83793d327

SHA1
428c718a6c6fc5f282c025b30d11b36e8c5a2f14

SHA256
67a7b07f709a0b096926e6a928782ca704dbef0fe40b25f9b03f01f666f8ec2b

SHA512
cfbca70dbd9f4b2db0af64c2f4db672f14b3b6a679cddfa57c353265fa7fe466feca72a1b2829a4318daecc1baf6960469aad85b1643d9dcdfe7db9199362738

Download Submit
C:\Windows\system\FnxXZIG.exe

Filesize
2.2MB

MD5
b1e74c6bd986c308972882c25cb0794e

SHA1
5eebc376e6af594bcd00d1345d7b40e545f77216

SHA256
bddd5f33907a22fdfd78c5f8697f97c10d14e440ba712bc928cab510eb6a8737

SHA512
864cc938ab6c6bf28abee10b0838aa235cb9d1bca5098cacaed91342767c683ca7e066c54ea996fce6ecf4d2524a020fa7022052538844ee5949cc4808f5fb3e

Download Submit
C:\Windows\system\ICyjkmz.exe

Filesize
2.2MB

MD5
9f198d133ed1e4ca3603c5431838f258

SHA1
30aa9720d31e49eda694ead9e87e00f7efa09129

SHA256
eda5315a2d65a4e689faac2630d74bbda90b28ce703138bab8c7aff7b5b8fe92

SHA512
d13f624479117c421adf1832ddeebd6787203c033858e83b301e7be826cf457eb34906555b0ca7bb35debc52d2d9c0ac6e18f0c835bd2dc75c16fe2b389a3c26

Download Submit
C:\Windows\system\KHnTIau.exe

Filesize
2.2MB

MD5
8f85e27f91aa91ddf8b6397a160382e7

SHA1
6b025802cd8014cd47a4f79eaaf06f87970f4a51

SHA256
d6bbdae0bade04ce4bf20289e9d767438ded7c076d619e170d407c403531a20e

SHA512
810cf84550c19eb26d66ff0ec895157d31dc06bdcba39e3e58b3aa6f50f0da5d819d0f43141755e6ef00e17de977f8e435b5c612d613ceecd1b1f346c85cbde2

Download Submit
C:\Windows\system\LMGLIpk.exe

Filesize
2.2MB

MD5
69fe325434cad4e8d75c417c9374cace

SHA1
7938140d838af6fae037df8574129dd7a4909a9e

SHA256
3aebfd9a5d41104c253aedf3c60ad192b6eaf4edc9ac1d3ccf60747202f95ecc

SHA512
37947436a322afc2d2397545586cbea4e60218a378e04f6bd6242f56343a217cfa26b9a885845a8a24b279800677ae769dcb325874e39452dea39080bda02cd4

Download Submit
C:\Windows\system\MoKZCOK.exe

Filesize
2.2MB

MD5
0f623c103a3bad7888ce7a419a2a1601

SHA1
a23671d339611a86189c461d19ad667482624a8a

SHA256
68f1271a135d50d74b3ca0a0b47d9f9d0780502e2a65678fb8e88421af1d79a3

SHA512
42341cebd9ec2565e586656c3f4a96e0bd66f96a18eed8ad16f6acfdf6e2e117e65902af41f2b016f08dba1e4d51c011e46f45d7a2a07bcb8854547c755ab17d

Download Submit
C:\Windows\system\NKRUrRS.exe

Filesize
2.2MB

MD5
054043af3ba8b1dda121cd8751cd9610

SHA1
5c199af1ffda8c7f312e6527f96ddfb64894ce93

SHA256
50c811ffba2cd9ed642acf5a0774284dce84ada12a890b17504ad0cf613e0524

SHA512
336f1266e1e665bcd15e0c44db00bafece0a30721b6f81e21ed6fb7627af269edc82628ca8adb1a66f2d03854712f160f8457ee4aac313d9ca4a70b097b2b32a

Download Submit
C:\Windows\system\RddPtBY.exe

Filesize
2.2MB

MD5
ff8819919473904609a18e75db4bc551

SHA1
355d11f64f9efba976c4a0b339684ffdf875ce1b

SHA256
2019532b400d633df3598bfc06352159cbb20af017caa0512f68196d8a1e9596

SHA512
b59a94d5a879484cb89802acd591967840b2dca80e37dd30f5943eb1e77f5a38be5b8c05eb596c3da58a0c49cf402317c02bb5e795cda0173fb225757a30abc7

Download Submit
C:\Windows\system\TBDGXgU.exe

Filesize
2.2MB

MD5
31c3de0e66896c743208d4eafe30f948

SHA1
d69d322f327f52825fd2726fe04e9ec8000c63d6

SHA256
d46c3c51911f8ffb583918372248e80a2fd61016f4b89645991d3854020cd164

SHA512
8c07633bc41df00270b14d90d68eef67b105683f11013497f285fa8d2e0ecdfd02f72924e79b40c4ec8f92e2b3a74b29af49d6a326ba94482f637ef4848f12d9

Download Submit
C:\Windows\system\UeerWAd.exe

Filesize
2.2MB

MD5
7818c5158dbcb2c60fa2fcdd6b565595

SHA1
cd57f5a631766d670c52e125b71f87317754cee6

SHA256
dea27a894ae4a9ae98f73edf9ce910be3042b9453f5b5eb7d849d45e416d82e2

SHA512
5065a728239a523bbb11f5826e0406252b81e59aeab1ce1ff4da81ae038e43eddd7ddea99b18377c4047830aa42a499e707b3953769e56c06b826b4b8661b58b

Download Submit
C:\Windows\system\WsqlCxI.exe

Filesize
2.2MB

MD5
3350dae0797c901f76443830d94522f5

SHA1
cba58ee0bc72168c3b3aa2625d4ba8619e1c744d

SHA256
9012ed9d4289551c0290443bb60dcee91a77279bfec6170bc448ad56d907fbb5

SHA512
66c5a38516526047ec699350d88c3fe312f96f0da38160abf3addb25e226c9439a50ae0d4e374481b09e3afd902f4147610e3418d3d55c27b1684810a4418d34

Download Submit
C:\Windows\system\WwiTdbR.exe

Filesize
2.2MB

MD5
152871048bea1e6e12a93ab15e2290eb

SHA1
032201427c8fe78853239199ea5383829d61112f

SHA256
f9ee6082ea64969159b5bc3792fecc78dcc788a270f8293e526476b441d85d5d

SHA512
c79a1692f920e110dad5e647e53b529df3e8fcdd67bd4110b339d2a1173e0a7ceec9200e12eaa3bb07b1f694cc1eda36638f8920198e55ccbe7cd8a87c08c797

Download Submit
C:\Windows\system\XvpAral.exe

Filesize
2.2MB

MD5
9538c9fba4568434e62db28960151ba0

SHA1
9d9823836feec7798e77167ece81d14ae4bcce7a

SHA256
665bef6005a38f42f2dd155605427d5984c5e530c038b141f36c65b27a66a9ba

SHA512
7e3829314f0aef77e4d5007758782f42e335bc1259e7d89fecadda0658a6fdba9e16cafc69fd59f13acf6c8a51ce161a563ee12da8fb1c98f8839b95e7ba6d65

Download Submit
C:\Windows\system\egKmZGA.exe

Filesize
2.2MB

MD5
86fbdc938ce16f93eb85d4b6f5ec3dd6

SHA1
25b61242e614f8bdeb78988d5b807861f2782575

SHA256
fd890951d826c3f5e4d87fc8e923beba5590db8c262818771274c2be897eaac0

SHA512
cde0024c04efb71128327486a3427a064b9d6b990be206779bea319eb059b8ab6ad834118d36f2ecd1e1aa2f766fec1070f78d63f68170d8fd6018c9b7879809

Download Submit
C:\Windows\system\fGQzXWc.exe

Filesize
2.2MB

MD5
5915df30ffd94fb9788d86f35aa0f66f

SHA1
9f1852c9b30a4412827dacf7c81f2cc3cfd5e513

SHA256
0595d1ce365e3946efab10ba51c4ebfe5b6379d31d7326fa648522e8b43b851f

SHA512
390c5e58be0656781e7f033feb03bc109ab55d231a5404434c5d31fecf9d32f28d40119818e196e9874123f08f8db6095e8779a706c4e71f2a3d0cb94d943c5b

Download Submit
C:\Windows\system\fzgHSlC.exe

Filesize
2.2MB

MD5
dc89dc826f29cdc220a87684ce398894

SHA1
2ec07160f5beb709221229c4b214864c82eca4e6

SHA256
849013dba7c311bf8beead55ba08e89cd57c5365c358d713585023685b13e6b3

SHA512
b3b977f89ddfd8621d7d45e7e07d7859bb2a0c80081c62922ff8f6684e2247b5cb1482bdd4a7dc81bc48decdb8239eed776099aa435271964186d1a21eabdad8

Download Submit
C:\Windows\system\htmGFWV.exe

Filesize
2.2MB

MD5
8ac988d5d1879ac88a0c7b0de461726f

SHA1
09bb46026e748e31e76e6f5d1ece2727997a0456

SHA256
f3400678ced9685ae78777e04b932710e22176731ceb3265819969de86fb1a58

SHA512
b91addaecc41b34bec66d0717351b059d36a12976979dbac44f44f376317aad67deed9a829ff7c9c343ae2fb136654b51e804657a2825271e8b73d5cd0bd79d9

Download Submit
C:\Windows\system\jJTqrjF.exe

Filesize
2.2MB

MD5
2d547c73bb4b785a517cedb02e8cc304

SHA1
cbd6e72dedd22d6df5d62fd957fc90fa710aa7d2

SHA256
7a248344aea84b8999141ec2e0b40fad3523fd661279e7dd0ea559186f81401f

SHA512
748f1a76df6b238251858f7508eeebc52af9e5b8c2cb7c28dd26b7a36ef606791b355d0d6b3155a56c0a9613417677685cbe98708d228e149e323d51b85ddd16

Download Submit
C:\Windows\system\kiuLyOZ.exe

Filesize
2.2MB

MD5
1caebec8270353b5bef6e3186d74d1e8

SHA1
c37c5c405e6b24dd91ada7dffe8f1db085758bdf

SHA256
52aeb4995e4f6e05db6feabcbfd58a18fcf5999d5152a3578e05f59533fa1c1a

SHA512
9dc49c19a4c422bde590bd7aeef1151575fa05184fc272d98a1fca396a3359ec5b0bc7d89cc47f5ac9a8719ebc585ce7f0db5468aaaac14ccca61574d7485337

Download Submit
C:\Windows\system\lUKAsFI.exe

Filesize
2.2MB

MD5
708331e27c0ccf87f623db41a2c8fd48

SHA1
28ffe76c10fe976b2b2a7a463b26c8b323aff90f

SHA256
626bce83e9a8e7bfa4105a87679d946d4f44f3e50b10a9c2c8502a34c1b44724

SHA512
ae1ac31a4e9adb82bc35ab40fe6aa4c373cd94459d13839d32e78c5f56506aa2c4fc68a520a7dbe2aed0d3a6ebf3f3d7dc51a86fa37792c45b18c3aff8b1ce7b

Download Submit
C:\Windows\system\mgFhosF.exe

Filesize
2.2MB

MD5
aaad99a39019e6439d375e606e43b8b5

SHA1
c6d8603b859aaeb968aa519fb8a6a837a9021c75

SHA256
020ebfc1d5d6115b9f1b807645a7ec2302d7471fe98654e022d5341fc2275fc4

SHA512
6428f9322ef3e0ddfac4d697f50e215202241bf56d07c3dcf0a0a63df843ca89722d29ef51b9352bd3f4c3791e0a3c65143a335e3ed45669cfee063784b1689d

Download Submit
C:\Windows\system\nVqvGYc.exe

Filesize
2.2MB

MD5
a84d83fa6c849045cdda8aff66b2ad41

SHA1
bc333dbb9216270ace4ba98eee3b529cb9f1e432

SHA256
dcb12b0ec148759fb9836307994171fe13cb0d9cb01ef46243ccc4a3cc5f8f0c

SHA512
07b88efd828b3581d4490adb480b9ebeacbe9bb2e9debf1748e77e0f1fa406aff0933a4b5b3fc23600ab61c617942b0aec302d67aabd21139f8ab02381515d2e

Download Submit
C:\Windows\system\paYaSwI.exe

Filesize
2.2MB

MD5
86f0f00885adf485123a2dc0b2d2adca

SHA1
c0a459a27acfbd3d6bef96063afddd83b4550e99

SHA256
417e743a6dc58ecae624f8f7e2b549cd289b894b24af742fe02cf285aab6108d

SHA512
69f48e94d39148722d0ed657ce0bde80e9383a55529145bdbdbcba94a2ff913f59caf6065f280a9d274e408b2836907cca284ce9f20b9e4d41aceffbe147f512

Download Submit
C:\Windows\system\quptgaF.exe

Filesize
2.2MB

MD5
c1c92384f4fe642f3c8c8de8b81465c9

SHA1
4dd44f6aa0f9b9bdb6b07657f3915343f039638f

SHA256
de22950d961b76727213c33ca30d8837d64784458c745284e88b4a3f00ab5698

SHA512
f979b7c11bc41059c834719268ef19e71a3617c97bf37b335b6e74429f4b6239f1b66ede1fb219a8c49cde0aaca1375c0a1156e10e5130fd085e4b0d17a2f784

Download Submit
C:\Windows\system\rGqmiNG.exe

Filesize
2.2MB

MD5
bbe7ef7d964ce353c810c601792d3bf8

SHA1
f2ea5763d80a76cd6cb919ea295b277fa9823bc6

SHA256
08f05358ef6b025b2cf27589b276e5f8962fb1bb5874d23317084b3b95d7ee42

SHA512
7fbd6ba609502269a9958d5edf77d2ba80586f28c26ecffca5f3e8c3f9ebdfccb37a0e41709f7569aa16dbdcad5cc43f789fd3fe66aa4404e2aaf03c921917f9

Download Submit
C:\Windows\system\rkXCnOj.exe

Filesize
2.2MB

MD5
c1b3bbf8068b2340d09cfda7e27d7eb6

SHA1
f48c664baf427b7e2862f18107ab62ff8e05987c

SHA256
9274fd6f65fe14e4b81bb9c55c1591131f95c456451b6e5dd21a397c0a2fb14f

SHA512
77f93f9258a391cc0519fa271d47dc5966a5879a2a7989ddb38ec452a1686506aa0aa686f6cb834db4e31e489f4c178553ad41b88e0541fc327a98d1cbf566f7

Download Submit
C:\Windows\system\uKFVjFU.exe

Filesize
2.2MB

MD5
66fc071dbf94ba403ec433d579e4aa8a

SHA1
ff80474f6c5bd5d3aa10746745873706a22e3ddd

SHA256
d7fe01d0f58918d097edc63c728d271b28c243a99c1db16028a8c17d3b5e067d

SHA512
8c5c395dbf6803cdb1ee2e626abf3438cbb139571c29bd6e2adc0aa4d77b386ff87feef06507af087293787d4859003b36b7f742b67e1ff9c42a9f190774d65a

Download Submit
C:\Windows\system\vPzFkeG.exe

Filesize
2.2MB

MD5
73acc83ff5f1fd4e407a9b3234c68f5e

SHA1
5127a9a8c4dcf9aa9f2a3133884b1df4778eec2d

SHA256
905baea490bc9d84b7fa8d6b3ea66117f2aa5d44947e07af103a50f64a5aeec8

SHA512
193c96903c6a800e60a2e1a950188c7b26fb30e82b2add7713b02da1b15801ba876064077325cf8524ddc646237099f6ee7ed5b5a0869a4b9c2affa30da3af5c

Download Submit
C:\Windows\system\vYlDcue.exe

Filesize
2.2MB

MD5
f900a5dd3dbd5a8d0b5da8de7a2c54f6

SHA1
9890ecd251e6a7d3387902a2da4151a0d0a247d0

SHA256
e35bb4ed777a5b30b825cbd0da2f34332b82310ebc630dae2b65dd590b99ec6f

SHA512
37bbdd4a9b55c0cba25343ceb02d2f5de32324e9fa6988dc531edb78afc85ca533590a2c23278fb5c9abf20157f0ca25b6f9fae6a357d11948f0669ac71026cc

Download Submit
C:\Windows\system\vkVVNyU.exe

Filesize
2.2MB

MD5
ddad1234930450c82528ce1a1b3948b7

SHA1
f416610d73a2c6f7d8263f1fbdaf00937359ecc6

SHA256
4bbc0d677503b9aa1138aff16fd9af5ba1e09bc053be63035d727dc926b3c7a7

SHA512
57cd50ecf5f160c31a53b81be890f2c7f90925a2d4cb069cf13752d1e15d1c39dc82d86f7e2bd0b102e42b44a9468fc63bd6e2c8ed904a6eaf9ac99034f610c6

Download Submit
\Windows\system\ASjptFf.exe

Filesize
2.2MB

MD5
054200420a3c28491003d91b6ad803da

SHA1
001ec4a6133e72d4d7c4e504f35603f3a4f60c24

SHA256
c8efa0b32d1233552e1895cfcc871167c02cbb3c1c53fd5f5e1f79e1eed4352b

SHA512
13bf32e9d12733772b1a4d53928d926cdc1825bb5647850705894d1268d5a224b2fcb49f9b6bbf1f995076ec8cab45f9b3b7a74af99b308cd7a6098d0500a224

Download Submit
\Windows\system\kJlQSPQ.exe

Filesize
2.2MB

MD5
3da050edb1f84366c987d1e0d601dad2

SHA1
98c99b52f94d591bae17cf83e42110f84edec3a0

SHA256
d067aee5dbed1dd06c6cfda2bbca76dc05a89eeceb844752f94e42e3133c5fc4

SHA512
b0f4088a9bda2f70ee9e85b36d975b0342741ee807fc7f9c06f782512ab1779e12c41d2eb8462d1c5557cb4c3e8a80126e79e34c2885631bf37af1e0c5d9a99f

Download Submit
memory/1540-605-0x0000000002460000-0x0000000002468000-memory.dmp

Filesize
32KB

Download
memory/1540-96-0x000000001B480000-0x000000001B762000-memory.dmp

Filesize
2.9MB

Download
memory/1540-26-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/1540-118-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-117-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-3340-0x000007FEF58F0000-0x000007FEF628D000-memory.dmp

Filesize
9.6MB

Download
memory/1540-27-0x0000000002910000-0x0000000002990000-memory.dmp

Filesize
512KB

Download
memory/2020-128-0x000000013F400000-0x000000013F7F2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-123-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2020-126-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2020-120-0x0000000003250000-0x0000000003642000-memory.dmp

Filesize
3.9MB

Download
memory/2020-914-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-0-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-6-0x0000000002AD0000-0x0000000002EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-24-0x0000000002AD0000-0x0000000002EC2000-memory.dmp

Filesize
3.9MB

Download
memory/2020-1-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2108-2027-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2108-25-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-3534-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2416-125-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-3522-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2476-127-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-9-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2492-2030-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2572-3523-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2572-122-0x000000013FC80000-0x0000000140072000-memory.dmp

Filesize
3.9MB

Download
memory/2612-2029-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-14-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-3621-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2644-119-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/2896-3292-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2896-121-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/2944-3297-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download
memory/2944-124-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download