xmrig | 1c0cb2ed8d6b87d6a4eef8d423969d9c41f3f4d0401637cbdd75ed62a12be13e

Analysis

max time kernel
15s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Size

2.1MB
MD5

03d07d05cd58a72933395a3073b9fe40
SHA1

af86ecf3a1b2d868977348a5fa5841a553005832
SHA256

1c0cb2ed8d6b87d6a4eef8d423969d9c41f3f4d0401637cbdd75ed62a12be13e
SHA512

bf52bb31f3571a4d3ec85ba0318eb7d412093703dd2db348e69dfc0a3e6d9604534398907aba5954923c2fe845bbbff77284eee0408d71d2f0e3f06c964d15fb
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1PO:NABL

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2000-539-0x000000013F430000-0x000000013F822000-memory.dmp	xmrig
behavioral1/memory/2928-60-0x000000013FC50000-0x0000000140042000-memory.dmp	xmrig
behavioral1/memory/2492-59-0x000000013FD90000-0x0000000140182000-memory.dmp	xmrig
behavioral1/memory/2528-58-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2400-54-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2624-49-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2520-15-0x000000013FDE0000-0x00000001401D2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2520	OGQyDCz.exe
2484	NwlyKVy.exe
2624	OhvAAml.exe
2508	WLHdMaO.exe
2400	RNJunJJ.exe
2528	wyXSyQx.exe
2492	FErhOem.exe
2928	PKeCQNa.exe
1580	hhLLzgC.exe
1348	yHskRwO.exe
2664	uhkevdg.exe
2684	dkfMsqb.exe
1544	rBFIldv.exe
2748	tIMOcnO.exe
1748	LeGwTJW.exe
2152	PywAVDX.exe
1732	UFmrKaR.exe
2164	TTcYdii.exe
1728	YuQQcrD.exe
1416	PPwPZhy.exe
1460	ONAJVne.exe
676	ejDXiis.exe
976	PNCngVe.exe
2120	ZmPvLIb.exe
2736	jmrMdov.exe
1640	QLgALFh.exe
2220	jxXfQAP.exe
3052	qgBvaCF.exe
400	kDyGeHT.exe
832	lvmfFyv.exe
1720	WZMYTyr.exe
908	kmfVNLB.exe
2972	dXHcvIF.exe
1496	xIDgdqe.exe
2328	tBMBJYk.exe
1988	JmbYuLO.exe
2096	NRzlsdN.exe
1228	VQFMzYy.exe
1596	jocyefN.exe
1456	dKpyzIw.exe
884	NZdOuWf.exe
1308	GMMesxL.exe
328	NGeBYgt.exe
3044	cEcuwmQ.exe
332	iHmGdnl.exe
756	obTtedD.exe
944	xzvTvZb.exe
1884	WNgXljc.exe
2844	zAzCOIx.exe
2792	RcWYJrJ.exe
2276	qsuYQvK.exe
1932	mDHzLqo.exe
2280	oEWkDmW.exe
980	KFbrcmZ.exe
2104	IXSZOYB.exe
2064	kIfVnes.exe
888	lKsayda.exe
1676	CzeHUIx.exe
2840	oOGPXar.exe
1972	qMhEolL.exe
1924	RGEmCig.exe
1504	iEKAnlG.exe
1608	koOccPU.exe
988	dlKjcbm.exe

Loads dropped DLL 64 IoCs

pid	Process
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2000-0-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x000c00000001340b-3.dat	upx
behavioral1/files/0x0031000000015d5e-30.dat	upx
behavioral1/files/0x0009000000015fe9-47.dat	upx
behavioral1/files/0x0009000000016117-64.dat	upx
behavioral1/memory/1580-66-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2664-77-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/files/0x0006000000016dbb-94.dat	upx
behavioral1/files/0x00060000000173d5-114.dat	upx
behavioral1/files/0x0006000000018c0a-161.dat	upx
behavioral1/memory/2000-539-0x000000013F430000-0x000000013F822000-memory.dmp	upx
behavioral1/files/0x0005000000018778-159.dat	upx
behavioral1/files/0x000500000001866d-154.dat	upx
behavioral1/files/0x000500000001866b-150.dat	upx
behavioral1/files/0x000900000001864e-146.dat	upx
behavioral1/files/0x0006000000017556-142.dat	upx
behavioral1/files/0x000600000001749c-139.dat	upx
behavioral1/files/0x000600000001747d-134.dat	upx
behavioral1/files/0x000600000001745e-130.dat	upx
behavioral1/files/0x0006000000017456-126.dat	upx
behavioral1/files/0x00060000000173e0-122.dat	upx
behavioral1/files/0x00060000000173d8-118.dat	upx
behavioral1/files/0x0006000000017052-110.dat	upx
behavioral1/files/0x0006000000016eb2-106.dat	upx
behavioral1/files/0x0006000000016e94-102.dat	upx
behavioral1/files/0x0006000000016dbf-98.dat	upx
behavioral1/files/0x0006000000016da7-90.dat	upx
behavioral1/files/0x0006000000016d90-86.dat	upx
behavioral1/memory/2684-83-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0006000000016d7e-81.dat	upx
behavioral1/memory/1348-72-0x000000013FAF0000-0x000000013FEE2000-memory.dmp	upx
behavioral1/files/0x0007000000016d3a-75.dat	upx
behavioral1/files/0x0007000000004e76-70.dat	upx
behavioral1/memory/2928-60-0x000000013FC50000-0x0000000140042000-memory.dmp	upx
behavioral1/memory/2492-59-0x000000013FD90000-0x0000000140182000-memory.dmp	upx
behavioral1/memory/2528-58-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2400-54-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2508-53-0x000000013FD60000-0x0000000140152000-memory.dmp	upx
behavioral1/memory/2624-49-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/files/0x0007000000015eaf-46.dat	upx
behavioral1/files/0x0008000000015d8f-45.dat	upx
behavioral1/files/0x0007000000015f6d-41.dat	upx
behavioral1/files/0x0007000000015e3a-40.dat	upx
behavioral1/files/0x0008000000015d87-39.dat	upx
behavioral1/memory/2484-35-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/memory/2520-15-0x000000013FDE0000-0x00000001401D2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\SpzMVwt.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\xnbyOXV.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wMHKaus.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\iFDlsit.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\hhLLzgC.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\dKpyzIw.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\hIAvzAu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\RrWePoa.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\OUywKtx.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\kIfVnes.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\XjRynsm.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\alLkyVm.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZMQfXTv.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\BDSOjOF.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\MOZGRyW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\PKeCQNa.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\dOLmjob.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\MswTtvB.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\kHcprTR.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\LmGKhsu.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\IVVCOjx.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\abgOBaa.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\HSLEFrs.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\peChxgK.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\NsFHOPW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\eZQzXMb.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wgDRZRW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\vZJJrtX.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\vLZLjfy.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\JBHsBOm.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\DkDkLGI.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\CvYikbD.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\Vkdplol.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\vMXIiue.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\cUYvBKW.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\lFjYRRV.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\TLvMzLa.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\VcYKqEd.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\RHgfwgb.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\VTtQTuH.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\YqMrSjI.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\iuWPpgk.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\nxdejJK.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\KbXOzgo.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\TOnJBTs.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\wHgSmrU.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ocyiqYR.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\cimDPyf.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\fTMIbjU.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\jacUlQw.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\zHcVAMg.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\qxUYTGF.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\UrAIKhO.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\rCpOnwx.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\GHXqJej.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\kDyGeHT.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\exJhJXc.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\oxMwQNi.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ZxPEvpt.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\cNjnEes.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\ROxSgat.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\WfsbEiE.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\LfuRRlK.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
File created	C:\Windows\System\GMoFkhg.exe	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2784	powershell.exe
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 2784	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	29
PID 2000 wrote to memory of 2784	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	29
PID 2000 wrote to memory of 2784	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	29
PID 2000 wrote to memory of 2520	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2520	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2520	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	30
PID 2000 wrote to memory of 2484	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	31
PID 2000 wrote to memory of 2484	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	31
PID 2000 wrote to memory of 2484	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	31
PID 2000 wrote to memory of 2624	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	32
PID 2000 wrote to memory of 2624	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	32
PID 2000 wrote to memory of 2624	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	32
PID 2000 wrote to memory of 2528	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	33
PID 2000 wrote to memory of 2528	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	33
PID 2000 wrote to memory of 2528	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	33
PID 2000 wrote to memory of 2508	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	34
PID 2000 wrote to memory of 2508	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	34
PID 2000 wrote to memory of 2508	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	34
PID 2000 wrote to memory of 2492	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	35
PID 2000 wrote to memory of 2492	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	35
PID 2000 wrote to memory of 2492	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	35
PID 2000 wrote to memory of 2400	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	36
PID 2000 wrote to memory of 2400	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	36
PID 2000 wrote to memory of 2400	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	36
PID 2000 wrote to memory of 2928	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	37
PID 2000 wrote to memory of 2928	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	37
PID 2000 wrote to memory of 2928	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	37
PID 2000 wrote to memory of 1580	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	38
PID 2000 wrote to memory of 1580	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	38
PID 2000 wrote to memory of 1580	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	38
PID 2000 wrote to memory of 1348	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	39
PID 2000 wrote to memory of 1348	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	39
PID 2000 wrote to memory of 1348	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	39
PID 2000 wrote to memory of 2664	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	40
PID 2000 wrote to memory of 2664	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	40
PID 2000 wrote to memory of 2664	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	40
PID 2000 wrote to memory of 2684	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	41
PID 2000 wrote to memory of 2684	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	41
PID 2000 wrote to memory of 2684	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	41
PID 2000 wrote to memory of 1544	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	42
PID 2000 wrote to memory of 1544	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	42
PID 2000 wrote to memory of 1544	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	42
PID 2000 wrote to memory of 2748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	43
PID 2000 wrote to memory of 2748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	43
PID 2000 wrote to memory of 2748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	43
PID 2000 wrote to memory of 1748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	44
PID 2000 wrote to memory of 1748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	44
PID 2000 wrote to memory of 1748	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	44
PID 2000 wrote to memory of 2152	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	45
PID 2000 wrote to memory of 2152	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	45
PID 2000 wrote to memory of 2152	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	45
PID 2000 wrote to memory of 1732	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	46
PID 2000 wrote to memory of 1732	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	46
PID 2000 wrote to memory of 1732	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	46
PID 2000 wrote to memory of 2164	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	47
PID 2000 wrote to memory of 2164	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	47
PID 2000 wrote to memory of 2164	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	47
PID 2000 wrote to memory of 1728	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	48
PID 2000 wrote to memory of 1728	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	48
PID 2000 wrote to memory of 1728	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	48
PID 2000 wrote to memory of 1416	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	49
PID 2000 wrote to memory of 1416	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	49
PID 2000 wrote to memory of 1416	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	49
PID 2000 wrote to memory of 1460	2000	03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03d07d05cd58a72933395a3073b9fe40_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System\OGQyDCz.exe
  C:\Windows\System\OGQyDCz.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\NwlyKVy.exe
  C:\Windows\System\NwlyKVy.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\OhvAAml.exe
  C:\Windows\System\OhvAAml.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\wyXSyQx.exe
  C:\Windows\System\wyXSyQx.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\WLHdMaO.exe
  C:\Windows\System\WLHdMaO.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\FErhOem.exe
  C:\Windows\System\FErhOem.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\RNJunJJ.exe
  C:\Windows\System\RNJunJJ.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\PKeCQNa.exe
  C:\Windows\System\PKeCQNa.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\hhLLzgC.exe
  C:\Windows\System\hhLLzgC.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\yHskRwO.exe
  C:\Windows\System\yHskRwO.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\uhkevdg.exe
  C:\Windows\System\uhkevdg.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\dkfMsqb.exe
  C:\Windows\System\dkfMsqb.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\rBFIldv.exe
  C:\Windows\System\rBFIldv.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\tIMOcnO.exe
  C:\Windows\System\tIMOcnO.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\LeGwTJW.exe
  C:\Windows\System\LeGwTJW.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\PywAVDX.exe
  C:\Windows\System\PywAVDX.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\UFmrKaR.exe
  C:\Windows\System\UFmrKaR.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\TTcYdii.exe
  C:\Windows\System\TTcYdii.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\YuQQcrD.exe
  C:\Windows\System\YuQQcrD.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\PPwPZhy.exe
  C:\Windows\System\PPwPZhy.exe
  2⤵
  - Executes dropped EXE
  PID:1416
- C:\Windows\System\ONAJVne.exe
  C:\Windows\System\ONAJVne.exe
  2⤵
  - Executes dropped EXE
  PID:1460
- C:\Windows\System\ejDXiis.exe
  C:\Windows\System\ejDXiis.exe
  2⤵
  - Executes dropped EXE
  PID:676
- C:\Windows\System\PNCngVe.exe
  C:\Windows\System\PNCngVe.exe
  2⤵
  - Executes dropped EXE
  PID:976
- C:\Windows\System\ZmPvLIb.exe
  C:\Windows\System\ZmPvLIb.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\jmrMdov.exe
  C:\Windows\System\jmrMdov.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\QLgALFh.exe
  C:\Windows\System\QLgALFh.exe
  2⤵
  - Executes dropped EXE
  PID:1640
- C:\Windows\System\jxXfQAP.exe
  C:\Windows\System\jxXfQAP.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\qgBvaCF.exe
  C:\Windows\System\qgBvaCF.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\kDyGeHT.exe
  C:\Windows\System\kDyGeHT.exe
  2⤵
  - Executes dropped EXE
  PID:400
- C:\Windows\System\lvmfFyv.exe
  C:\Windows\System\lvmfFyv.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\WZMYTyr.exe
  C:\Windows\System\WZMYTyr.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\kmfVNLB.exe
  C:\Windows\System\kmfVNLB.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\dXHcvIF.exe
  C:\Windows\System\dXHcvIF.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\xIDgdqe.exe
  C:\Windows\System\xIDgdqe.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\tBMBJYk.exe
  C:\Windows\System\tBMBJYk.exe
  2⤵
  - Executes dropped EXE
  PID:2328
- C:\Windows\System\JmbYuLO.exe
  C:\Windows\System\JmbYuLO.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\NRzlsdN.exe
  C:\Windows\System\NRzlsdN.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\VQFMzYy.exe
  C:\Windows\System\VQFMzYy.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\jocyefN.exe
  C:\Windows\System\jocyefN.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\dKpyzIw.exe
  C:\Windows\System\dKpyzIw.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\NZdOuWf.exe
  C:\Windows\System\NZdOuWf.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\GMMesxL.exe
  C:\Windows\System\GMMesxL.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\NGeBYgt.exe
  C:\Windows\System\NGeBYgt.exe
  2⤵
  - Executes dropped EXE
  PID:328
- C:\Windows\System\cEcuwmQ.exe
  C:\Windows\System\cEcuwmQ.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\iHmGdnl.exe
  C:\Windows\System\iHmGdnl.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\obTtedD.exe
  C:\Windows\System\obTtedD.exe
  2⤵
  - Executes dropped EXE
  PID:756
- C:\Windows\System\xzvTvZb.exe
  C:\Windows\System\xzvTvZb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\WNgXljc.exe
  C:\Windows\System\WNgXljc.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\zAzCOIx.exe
  C:\Windows\System\zAzCOIx.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\RcWYJrJ.exe
  C:\Windows\System\RcWYJrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2792
- C:\Windows\System\qsuYQvK.exe
  C:\Windows\System\qsuYQvK.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\mDHzLqo.exe
  C:\Windows\System\mDHzLqo.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\oEWkDmW.exe
  C:\Windows\System\oEWkDmW.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\KFbrcmZ.exe
  C:\Windows\System\KFbrcmZ.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\IXSZOYB.exe
  C:\Windows\System\IXSZOYB.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\kIfVnes.exe
  C:\Windows\System\kIfVnes.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\lKsayda.exe
  C:\Windows\System\lKsayda.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\CzeHUIx.exe
  C:\Windows\System\CzeHUIx.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\oOGPXar.exe
  C:\Windows\System\oOGPXar.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\qMhEolL.exe
  C:\Windows\System\qMhEolL.exe
  2⤵
  - Executes dropped EXE
  PID:1972
- C:\Windows\System\RGEmCig.exe
  C:\Windows\System\RGEmCig.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\iEKAnlG.exe
  C:\Windows\System\iEKAnlG.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\koOccPU.exe
  C:\Windows\System\koOccPU.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\dlKjcbm.exe
  C:\Windows\System\dlKjcbm.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\pJPdeIu.exe
  C:\Windows\System\pJPdeIu.exe
  2⤵
  PID:2976
- C:\Windows\System\NcXDIle.exe
  C:\Windows\System\NcXDIle.exe
  2⤵
  PID:2980
- C:\Windows\System\oQoraoi.exe
  C:\Windows\System\oQoraoi.exe
  2⤵
  PID:2500
- C:\Windows\System\MPNhNpw.exe
  C:\Windows\System\MPNhNpw.exe
  2⤵
  PID:2628
- C:\Windows\System\GeBjlMu.exe
  C:\Windows\System\GeBjlMu.exe
  2⤵
  PID:2440
- C:\Windows\System\ONUOnJY.exe
  C:\Windows\System\ONUOnJY.exe
  2⤵
  PID:2080
- C:\Windows\System\TLvMzLa.exe
  C:\Windows\System\TLvMzLa.exe
  2⤵
  PID:2540
- C:\Windows\System\tEwxXuH.exe
  C:\Windows\System\tEwxXuH.exe
  2⤵
  PID:2668
- C:\Windows\System\sXOVyAI.exe
  C:\Windows\System\sXOVyAI.exe
  2⤵
  PID:1760
- C:\Windows\System\eZQzXMb.exe
  C:\Windows\System\eZQzXMb.exe
  2⤵
  PID:1716
- C:\Windows\System\CZkZTIr.exe
  C:\Windows\System\CZkZTIr.exe
  2⤵
  PID:384
- C:\Windows\System\ocyiqYR.exe
  C:\Windows\System\ocyiqYR.exe
  2⤵
  PID:2196
- C:\Windows\System\MAKdcqB.exe
  C:\Windows\System\MAKdcqB.exe
  2⤵
  PID:1556
- C:\Windows\System\xbMVtka.exe
  C:\Windows\System\xbMVtka.exe
  2⤵
  PID:2148
- C:\Windows\System\fmXsxmn.exe
  C:\Windows\System\fmXsxmn.exe
  2⤵
  PID:1260
- C:\Windows\System\dYotyCk.exe
  C:\Windows\System\dYotyCk.exe
  2⤵
  PID:2472
- C:\Windows\System\KrsaMAw.exe
  C:\Windows\System\KrsaMAw.exe
  2⤵
  PID:1664
- C:\Windows\System\HHxsfYF.exe
  C:\Windows\System\HHxsfYF.exe
  2⤵
  PID:2772
- C:\Windows\System\cvBkpeN.exe
  C:\Windows\System\cvBkpeN.exe
  2⤵
  PID:2208
- C:\Windows\System\dRWICgG.exe
  C:\Windows\System\dRWICgG.exe
  2⤵
  PID:1164
- C:\Windows\System\ePINSTy.exe
  C:\Windows\System\ePINSTy.exe
  2⤵
  PID:360
- C:\Windows\System\qWKfHKO.exe
  C:\Windows\System\qWKfHKO.exe
  2⤵
  PID:1280
- C:\Windows\System\hTMCIUv.exe
  C:\Windows\System\hTMCIUv.exe
  2⤵
  PID:2052
- C:\Windows\System\DJhlvzo.exe
  C:\Windows\System\DJhlvzo.exe
  2⤵
  PID:1272
- C:\Windows\System\nbaHVJF.exe
  C:\Windows\System\nbaHVJF.exe
  2⤵
  PID:1232
- C:\Windows\System\WWJaLZu.exe
  C:\Windows\System\WWJaLZu.exe
  2⤵
  PID:864
- C:\Windows\System\grnSiyX.exe
  C:\Windows\System\grnSiyX.exe
  2⤵
  PID:2828
- C:\Windows\System\KGTGhVQ.exe
  C:\Windows\System\KGTGhVQ.exe
  2⤵
  PID:1860
- C:\Windows\System\qGryEYh.exe
  C:\Windows\System\qGryEYh.exe
  2⤵
  PID:2824
- C:\Windows\System\poOPrPH.exe
  C:\Windows\System\poOPrPH.exe
  2⤵
  PID:552
- C:\Windows\System\tvTwdgD.exe
  C:\Windows\System\tvTwdgD.exe
  2⤵
  PID:2252
- C:\Windows\System\kHyVdkZ.exe
  C:\Windows\System\kHyVdkZ.exe
  2⤵
  PID:2008
- C:\Windows\System\ItyhrNx.exe
  C:\Windows\System\ItyhrNx.exe
  2⤵
  PID:1500
- C:\Windows\System\jKtYupf.exe
  C:\Windows\System\jKtYupf.exe
  2⤵
  PID:2956
- C:\Windows\System\NStuaRG.exe
  C:\Windows\System\NStuaRG.exe
  2⤵
  PID:2812
- C:\Windows\System\WFIBrad.exe
  C:\Windows\System\WFIBrad.exe
  2⤵
  PID:2800
- C:\Windows\System\OBgQpwF.exe
  C:\Windows\System\OBgQpwF.exe
  2⤵
  PID:3076
- C:\Windows\System\OXpWWml.exe
  C:\Windows\System\OXpWWml.exe
  2⤵
  PID:3092
- C:\Windows\System\cmjIyGw.exe
  C:\Windows\System\cmjIyGw.exe
  2⤵
  PID:3108
- C:\Windows\System\lXkMBjC.exe
  C:\Windows\System\lXkMBjC.exe
  2⤵
  PID:3124
- C:\Windows\System\jjudhSI.exe
  C:\Windows\System\jjudhSI.exe
  2⤵
  PID:3140
- C:\Windows\System\Hmfqjfe.exe
  C:\Windows\System\Hmfqjfe.exe
  2⤵
  PID:3156
- C:\Windows\System\ETcJhQr.exe
  C:\Windows\System\ETcJhQr.exe
  2⤵
  PID:3172
- C:\Windows\System\FLRESsd.exe
  C:\Windows\System\FLRESsd.exe
  2⤵
  PID:3188
- C:\Windows\System\mhUWKAA.exe
  C:\Windows\System\mhUWKAA.exe
  2⤵
  PID:3204
- C:\Windows\System\qxUYTGF.exe
  C:\Windows\System\qxUYTGF.exe
  2⤵
  PID:3220
- C:\Windows\System\OsepEpg.exe
  C:\Windows\System\OsepEpg.exe
  2⤵
  PID:3236
- C:\Windows\System\orXmOwQ.exe
  C:\Windows\System\orXmOwQ.exe
  2⤵
  PID:3252
- C:\Windows\System\WsYjySc.exe
  C:\Windows\System\WsYjySc.exe
  2⤵
  PID:3268
- C:\Windows\System\qDEzuYu.exe
  C:\Windows\System\qDEzuYu.exe
  2⤵
  PID:3284
- C:\Windows\System\XEJfbtq.exe
  C:\Windows\System\XEJfbtq.exe
  2⤵
  PID:3300
- C:\Windows\System\VlsfGLo.exe
  C:\Windows\System\VlsfGLo.exe
  2⤵
  PID:3316
- C:\Windows\System\rqNoIzZ.exe
  C:\Windows\System\rqNoIzZ.exe
  2⤵
  PID:3332
- C:\Windows\System\PiaFvwT.exe
  C:\Windows\System\PiaFvwT.exe
  2⤵
  PID:3348
- C:\Windows\System\xEZgGcY.exe
  C:\Windows\System\xEZgGcY.exe
  2⤵
  PID:3364
- C:\Windows\System\wxhKaNy.exe
  C:\Windows\System\wxhKaNy.exe
  2⤵
  PID:3380
- C:\Windows\System\vrQKxTC.exe
  C:\Windows\System\vrQKxTC.exe
  2⤵
  PID:3396
- C:\Windows\System\XPBiZWx.exe
  C:\Windows\System\XPBiZWx.exe
  2⤵
  PID:3412
- C:\Windows\System\MlAvepO.exe
  C:\Windows\System\MlAvepO.exe
  2⤵
  PID:3428
- C:\Windows\System\AaYQKZo.exe
  C:\Windows\System\AaYQKZo.exe
  2⤵
  PID:3444
- C:\Windows\System\UcRdAWv.exe
  C:\Windows\System\UcRdAWv.exe
  2⤵
  PID:3460
- C:\Windows\System\SpzMVwt.exe
  C:\Windows\System\SpzMVwt.exe
  2⤵
  PID:3476
- C:\Windows\System\VuVeUMo.exe
  C:\Windows\System\VuVeUMo.exe
  2⤵
  PID:3492
- C:\Windows\System\CHnzUVd.exe
  C:\Windows\System\CHnzUVd.exe
  2⤵
  PID:3508
- C:\Windows\System\asFovgX.exe
  C:\Windows\System\asFovgX.exe
  2⤵
  PID:3524
- C:\Windows\System\cRirvTc.exe
  C:\Windows\System\cRirvTc.exe
  2⤵
  PID:3540
- C:\Windows\System\RIFQSlZ.exe
  C:\Windows\System\RIFQSlZ.exe
  2⤵
  PID:3556
- C:\Windows\System\TEJAsvY.exe
  C:\Windows\System\TEJAsvY.exe
  2⤵
  PID:3572
- C:\Windows\System\jKMXkpq.exe
  C:\Windows\System\jKMXkpq.exe
  2⤵
  PID:3588
- C:\Windows\System\MGYasOk.exe
  C:\Windows\System\MGYasOk.exe
  2⤵
  PID:3604
- C:\Windows\System\elQvGyn.exe
  C:\Windows\System\elQvGyn.exe
  2⤵
  PID:3620
- C:\Windows\System\yrMztli.exe
  C:\Windows\System\yrMztli.exe
  2⤵
  PID:3636
- C:\Windows\System\ZEkgYZr.exe
  C:\Windows\System\ZEkgYZr.exe
  2⤵
  PID:3652
- C:\Windows\System\XANXXoF.exe
  C:\Windows\System\XANXXoF.exe
  2⤵
  PID:3668
- C:\Windows\System\tDtiGZd.exe
  C:\Windows\System\tDtiGZd.exe
  2⤵
  PID:3684
- C:\Windows\System\kHcprTR.exe
  C:\Windows\System\kHcprTR.exe
  2⤵
  PID:3700
- C:\Windows\System\mVHNXnJ.exe
  C:\Windows\System\mVHNXnJ.exe
  2⤵
  PID:3716
- C:\Windows\System\jtXsZVb.exe
  C:\Windows\System\jtXsZVb.exe
  2⤵
  PID:3732
- C:\Windows\System\lMZkjxI.exe
  C:\Windows\System\lMZkjxI.exe
  2⤵
  PID:3748
- C:\Windows\System\GPRdzAD.exe
  C:\Windows\System\GPRdzAD.exe
  2⤵
  PID:3764
- C:\Windows\System\OXoJJMo.exe
  C:\Windows\System\OXoJJMo.exe
  2⤵
  PID:3780
- C:\Windows\System\HAnquRf.exe
  C:\Windows\System\HAnquRf.exe
  2⤵
  PID:3796
- C:\Windows\System\rGMBLAu.exe
  C:\Windows\System\rGMBLAu.exe
  2⤵
  PID:3812
- C:\Windows\System\tleubcS.exe
  C:\Windows\System\tleubcS.exe
  2⤵
  PID:3828
- C:\Windows\System\heVSIuo.exe
  C:\Windows\System\heVSIuo.exe
  2⤵
  PID:3844
- C:\Windows\System\cBJvsLp.exe
  C:\Windows\System\cBJvsLp.exe
  2⤵
  PID:3860
- C:\Windows\System\NTMKQRg.exe
  C:\Windows\System\NTMKQRg.exe
  2⤵
  PID:3876
- C:\Windows\System\wgDRZRW.exe
  C:\Windows\System\wgDRZRW.exe
  2⤵
  PID:3892
- C:\Windows\System\xzrXAkw.exe
  C:\Windows\System\xzrXAkw.exe
  2⤵
  PID:3908
- C:\Windows\System\LmGKhsu.exe
  C:\Windows\System\LmGKhsu.exe
  2⤵
  PID:3924
- C:\Windows\System\FihzmcB.exe
  C:\Windows\System\FihzmcB.exe
  2⤵
  PID:3940
- C:\Windows\System\aIwafSM.exe
  C:\Windows\System\aIwafSM.exe
  2⤵
  PID:3956
- C:\Windows\System\XzvMxbN.exe
  C:\Windows\System\XzvMxbN.exe
  2⤵
  PID:3972
- C:\Windows\System\LNtXhqU.exe
  C:\Windows\System\LNtXhqU.exe
  2⤵
  PID:3988
- C:\Windows\System\fTMIbjU.exe
  C:\Windows\System\fTMIbjU.exe
  2⤵
  PID:4004
- C:\Windows\System\dFlySnW.exe
  C:\Windows\System\dFlySnW.exe
  2⤵
  PID:4020
- C:\Windows\System\alryiCm.exe
  C:\Windows\System\alryiCm.exe
  2⤵
  PID:4036
- C:\Windows\System\sKYjjrb.exe
  C:\Windows\System\sKYjjrb.exe
  2⤵
  PID:4052
- C:\Windows\System\kpXOBST.exe
  C:\Windows\System\kpXOBST.exe
  2⤵
  PID:4068
- C:\Windows\System\xXbTUjp.exe
  C:\Windows\System\xXbTUjp.exe
  2⤵
  PID:4084
- C:\Windows\System\exJhJXc.exe
  C:\Windows\System\exJhJXc.exe
  2⤵
  PID:2932
- C:\Windows\System\hhggVpV.exe
  C:\Windows\System\hhggVpV.exe
  2⤵
  PID:2692
- C:\Windows\System\Skdnxhj.exe
  C:\Windows\System\Skdnxhj.exe
  2⤵
  PID:1776
- C:\Windows\System\sVwNaLO.exe
  C:\Windows\System\sVwNaLO.exe
  2⤵
  PID:1896
- C:\Windows\System\fYBrrgF.exe
  C:\Windows\System\fYBrrgF.exe
  2⤵
  PID:1448
- C:\Windows\System\LiSfIgM.exe
  C:\Windows\System\LiSfIgM.exe
  2⤵
  PID:1244
- C:\Windows\System\gaQcwDk.exe
  C:\Windows\System\gaQcwDk.exe
  2⤵
  PID:2060
- C:\Windows\System\ImErfAO.exe
  C:\Windows\System\ImErfAO.exe
  2⤵
  PID:2036
- C:\Windows\System\NQSldEK.exe
  C:\Windows\System\NQSldEK.exe
  2⤵
  PID:2300
- C:\Windows\System\Hzkbwgx.exe
  C:\Windows\System\Hzkbwgx.exe
  2⤵
  PID:1704
- C:\Windows\System\FMwgTTl.exe
  C:\Windows\System\FMwgTTl.exe
  2⤵
  PID:2216
- C:\Windows\System\dDrTFgu.exe
  C:\Windows\System\dDrTFgu.exe
  2⤵
  PID:2920
- C:\Windows\System\nCoclQs.exe
  C:\Windows\System\nCoclQs.exe
  2⤵
  PID:1604
- C:\Windows\System\QrOcMNp.exe
  C:\Windows\System\QrOcMNp.exe
  2⤵
  PID:1976
- C:\Windows\System\cNjnEes.exe
  C:\Windows\System\cNjnEes.exe
  2⤵
  PID:2264
- C:\Windows\System\RPkWBex.exe
  C:\Windows\System\RPkWBex.exe
  2⤵
  PID:2952
- C:\Windows\System\GyMXnnP.exe
  C:\Windows\System\GyMXnnP.exe
  2⤵
  PID:2384
- C:\Windows\System\hqAPFLa.exe
  C:\Windows\System\hqAPFLa.exe
  2⤵
  PID:3116
- C:\Windows\System\AUDQOBQ.exe
  C:\Windows\System\AUDQOBQ.exe
  2⤵
  PID:3136
- C:\Windows\System\nLYNrfu.exe
  C:\Windows\System\nLYNrfu.exe
  2⤵
  PID:3184
- C:\Windows\System\bPniFjv.exe
  C:\Windows\System\bPniFjv.exe
  2⤵
  PID:3212
- C:\Windows\System\YbMnfzE.exe
  C:\Windows\System\YbMnfzE.exe
  2⤵
  PID:3228
- C:\Windows\System\hAwhqYQ.exe
  C:\Windows\System\hAwhqYQ.exe
  2⤵
  PID:3280
- C:\Windows\System\sXfosWa.exe
  C:\Windows\System\sXfosWa.exe
  2⤵
  PID:3308
- C:\Windows\System\LPWmnpk.exe
  C:\Windows\System\LPWmnpk.exe
  2⤵
  PID:3344
- C:\Windows\System\LKHsefh.exe
  C:\Windows\System\LKHsefh.exe
  2⤵
  PID:3376
- C:\Windows\System\bsVFsqB.exe
  C:\Windows\System\bsVFsqB.exe
  2⤵
  PID:3392
- C:\Windows\System\iVRKarW.exe
  C:\Windows\System\iVRKarW.exe
  2⤵
  PID:3420
- C:\Windows\System\gOGzZQU.exe
  C:\Windows\System\gOGzZQU.exe
  2⤵
  PID:3468
- C:\Windows\System\XTNockh.exe
  C:\Windows\System\XTNockh.exe
  2⤵
  PID:3500
- C:\Windows\System\GWrHvxP.exe
  C:\Windows\System\GWrHvxP.exe
  2⤵
  PID:3516
- C:\Windows\System\DkDkLGI.exe
  C:\Windows\System\DkDkLGI.exe
  2⤵
  PID:3548
- C:\Windows\System\LHfREFg.exe
  C:\Windows\System\LHfREFg.exe
  2⤵
  PID:3580
- C:\Windows\System\AKGaNYI.exe
  C:\Windows\System\AKGaNYI.exe
  2⤵
  PID:3612
- C:\Windows\System\jibxxOJ.exe
  C:\Windows\System\jibxxOJ.exe
  2⤵
  PID:3644
- C:\Windows\System\bAAKcMj.exe
  C:\Windows\System\bAAKcMj.exe
  2⤵
  PID:3676
- C:\Windows\System\UVUjqgW.exe
  C:\Windows\System\UVUjqgW.exe
  2⤵
  PID:3708
- C:\Windows\System\GIHSRuf.exe
  C:\Windows\System\GIHSRuf.exe
  2⤵
  PID:3740
- C:\Windows\System\cerqdip.exe
  C:\Windows\System\cerqdip.exe
  2⤵
  PID:3772
- C:\Windows\System\KwMMQUt.exe
  C:\Windows\System\KwMMQUt.exe
  2⤵
  PID:3804
- C:\Windows\System\riumhPh.exe
  C:\Windows\System\riumhPh.exe
  2⤵
  PID:3836
- C:\Windows\System\abpvSAx.exe
  C:\Windows\System\abpvSAx.exe
  2⤵
  PID:3868
- C:\Windows\System\pqTUgGf.exe
  C:\Windows\System\pqTUgGf.exe
  2⤵
  PID:3900
- C:\Windows\System\EDjrTeV.exe
  C:\Windows\System\EDjrTeV.exe
  2⤵
  PID:3932
- C:\Windows\System\wPDEjFA.exe
  C:\Windows\System\wPDEjFA.exe
  2⤵
  PID:3964
- C:\Windows\System\OCRSsNw.exe
  C:\Windows\System\OCRSsNw.exe
  2⤵
  PID:4012
- C:\Windows\System\KqTVfNO.exe
  C:\Windows\System\KqTVfNO.exe
  2⤵
  PID:4028
- C:\Windows\System\WEuzUJE.exe
  C:\Windows\System\WEuzUJE.exe
  2⤵
  PID:4060
- C:\Windows\System\rOHWLcd.exe
  C:\Windows\System\rOHWLcd.exe
  2⤵
  PID:4080
- C:\Windows\System\rSWcwZI.exe
  C:\Windows\System\rSWcwZI.exe
  2⤵
  PID:292
- C:\Windows\System\LvndwWu.exe
  C:\Windows\System\LvndwWu.exe
  2⤵
  PID:336
- C:\Windows\System\ppbHESU.exe
  C:\Windows\System\ppbHESU.exe
  2⤵
  PID:1584
- C:\Windows\System\IbzLrMk.exe
  C:\Windows\System\IbzLrMk.exe
  2⤵
  PID:1292
- C:\Windows\System\EnQUMeQ.exe
  C:\Windows\System\EnQUMeQ.exe
  2⤵
  PID:556
- C:\Windows\System\RrWePoa.exe
  C:\Windows\System\RrWePoa.exe
  2⤵
  PID:2308
- C:\Windows\System\dkICFfg.exe
  C:\Windows\System\dkICFfg.exe
  2⤵
  PID:2916
- C:\Windows\System\MUNQnyU.exe
  C:\Windows\System\MUNQnyU.exe
  2⤵
  PID:3100
- C:\Windows\System\jKaraqu.exe
  C:\Windows\System\jKaraqu.exe
  2⤵
  PID:2336
- C:\Windows\System\CKsMgwB.exe
  C:\Windows\System\CKsMgwB.exe
  2⤵
  PID:3164
- C:\Windows\System\dYFixuz.exe
  C:\Windows\System\dYFixuz.exe
  2⤵
  PID:3196
- C:\Windows\System\pxjbeiT.exe
  C:\Windows\System\pxjbeiT.exe
  2⤵
  PID:3292
- C:\Windows\System\NPwvfMt.exe
  C:\Windows\System\NPwvfMt.exe
  2⤵
  PID:3324
- C:\Windows\System\rKdkZtO.exe
  C:\Windows\System\rKdkZtO.exe
  2⤵
  PID:3388
- C:\Windows\System\SxdkFIN.exe
  C:\Windows\System\SxdkFIN.exe
  2⤵
  PID:3472
- C:\Windows\System\NrPdBVl.exe
  C:\Windows\System\NrPdBVl.exe
  2⤵
  PID:3536
- C:\Windows\System\eryfgGS.exe
  C:\Windows\System\eryfgGS.exe
  2⤵
  PID:3552
- C:\Windows\System\itKiDOT.exe
  C:\Windows\System\itKiDOT.exe
  2⤵
  PID:3648
- C:\Windows\System\vIkffRB.exe
  C:\Windows\System\vIkffRB.exe
  2⤵
  PID:3712
- C:\Windows\System\EsniBLS.exe
  C:\Windows\System\EsniBLS.exe
  2⤵
  PID:3792
- C:\Windows\System\aGaPuAF.exe
  C:\Windows\System\aGaPuAF.exe
  2⤵
  PID:3808
- C:\Windows\System\rVMQhKI.exe
  C:\Windows\System\rVMQhKI.exe
  2⤵
  PID:3968
- C:\Windows\System\RDRmgVV.exe
  C:\Windows\System\RDRmgVV.exe
  2⤵
  PID:3872
- C:\Windows\System\wIMyZjO.exe
  C:\Windows\System\wIMyZjO.exe
  2⤵
  PID:4000
- C:\Windows\System\JUXKwUE.exe
  C:\Windows\System\JUXKwUE.exe
  2⤵
  PID:2632
- C:\Windows\System\BnZKCao.exe
  C:\Windows\System\BnZKCao.exe
  2⤵
  PID:1680
- C:\Windows\System\GHXqJej.exe
  C:\Windows\System\GHXqJej.exe
  2⤵
  PID:2720
- C:\Windows\System\VritYTY.exe
  C:\Windows\System\VritYTY.exe
  2⤵
  PID:752
- C:\Windows\System\RsFgItH.exe
  C:\Windows\System\RsFgItH.exe
  2⤵
  PID:2660
- C:\Windows\System\dQmCrnN.exe
  C:\Windows\System\dQmCrnN.exe
  2⤵
  PID:3104
- C:\Windows\System\QIbaAar.exe
  C:\Windows\System\QIbaAar.exe
  2⤵
  PID:3168
- C:\Windows\System\FrsPbHL.exe
  C:\Windows\System\FrsPbHL.exe
  2⤵
  PID:3276
- C:\Windows\System\VNQJYsu.exe
  C:\Windows\System\VNQJYsu.exe
  2⤵
  PID:3440
- C:\Windows\System\NQrvSvI.exe
  C:\Windows\System\NQrvSvI.exe
  2⤵
  PID:3504
- C:\Windows\System\mSTmFoo.exe
  C:\Windows\System\mSTmFoo.exe
  2⤵
  PID:3632
- C:\Windows\System\NqxKTbN.exe
  C:\Windows\System\NqxKTbN.exe
  2⤵
  PID:4100
- C:\Windows\System\RJsyPHu.exe
  C:\Windows\System\RJsyPHu.exe
  2⤵
  PID:4116
- C:\Windows\System\lFIhUbU.exe
  C:\Windows\System\lFIhUbU.exe
  2⤵
  PID:4132
- C:\Windows\System\tnwAOll.exe
  C:\Windows\System\tnwAOll.exe
  2⤵
  PID:4148
- C:\Windows\System\WbMdAbQ.exe
  C:\Windows\System\WbMdAbQ.exe
  2⤵
  PID:4164
- C:\Windows\System\FFdQvHV.exe
  C:\Windows\System\FFdQvHV.exe
  2⤵
  PID:4180
- C:\Windows\System\HpJvXVv.exe
  C:\Windows\System\HpJvXVv.exe
  2⤵
  PID:4196
- C:\Windows\System\qlPKKvl.exe
  C:\Windows\System\qlPKKvl.exe
  2⤵
  PID:4212
- C:\Windows\System\oXJiaSh.exe
  C:\Windows\System\oXJiaSh.exe
  2⤵
  PID:4228
- C:\Windows\System\KOtoKlt.exe
  C:\Windows\System\KOtoKlt.exe
  2⤵
  PID:4244
- C:\Windows\System\TVVAicQ.exe
  C:\Windows\System\TVVAicQ.exe
  2⤵
  PID:4260
- C:\Windows\System\oagsCmh.exe
  C:\Windows\System\oagsCmh.exe
  2⤵
  PID:4276
- C:\Windows\System\KlMZyZt.exe
  C:\Windows\System\KlMZyZt.exe
  2⤵
  PID:4292
- C:\Windows\System\mQkixbd.exe
  C:\Windows\System\mQkixbd.exe
  2⤵
  PID:4308
- C:\Windows\System\CnpsvwT.exe
  C:\Windows\System\CnpsvwT.exe
  2⤵
  PID:4324
- C:\Windows\System\oBIsYhk.exe
  C:\Windows\System\oBIsYhk.exe
  2⤵
  PID:4340
- C:\Windows\System\wxYScnO.exe
  C:\Windows\System\wxYScnO.exe
  2⤵
  PID:4356
- C:\Windows\System\ChBTIkv.exe
  C:\Windows\System\ChBTIkv.exe
  2⤵
  PID:4372
- C:\Windows\System\HiBTjmw.exe
  C:\Windows\System\HiBTjmw.exe
  2⤵
  PID:4388
- C:\Windows\System\hFfztpx.exe
  C:\Windows\System\hFfztpx.exe
  2⤵
  PID:4404
- C:\Windows\System\HBtGsOq.exe
  C:\Windows\System\HBtGsOq.exe
  2⤵
  PID:4420
- C:\Windows\System\nbROiAX.exe
  C:\Windows\System\nbROiAX.exe
  2⤵
  PID:4436
- C:\Windows\System\SXvVBrJ.exe
  C:\Windows\System\SXvVBrJ.exe
  2⤵
  PID:4452
- C:\Windows\System\goGXEGV.exe
  C:\Windows\System\goGXEGV.exe
  2⤵
  PID:4468
- C:\Windows\System\PSdTTnV.exe
  C:\Windows\System\PSdTTnV.exe
  2⤵
  PID:4484
- C:\Windows\System\cWYVmZv.exe
  C:\Windows\System\cWYVmZv.exe
  2⤵
  PID:4500
- C:\Windows\System\dDeSINN.exe
  C:\Windows\System\dDeSINN.exe
  2⤵
  PID:4516
- C:\Windows\System\dfcdIYq.exe
  C:\Windows\System\dfcdIYq.exe
  2⤵
  PID:4532
- C:\Windows\System\CYlEkpk.exe
  C:\Windows\System\CYlEkpk.exe
  2⤵
  PID:4548
- C:\Windows\System\gLWckMU.exe
  C:\Windows\System\gLWckMU.exe
  2⤵
  PID:4564
- C:\Windows\System\WSxNDNx.exe
  C:\Windows\System\WSxNDNx.exe
  2⤵
  PID:4580
- C:\Windows\System\RXOLBzb.exe
  C:\Windows\System\RXOLBzb.exe
  2⤵
  PID:4596
- C:\Windows\System\kBefmog.exe
  C:\Windows\System\kBefmog.exe
  2⤵
  PID:4612
- C:\Windows\System\wimtkQl.exe
  C:\Windows\System\wimtkQl.exe
  2⤵
  PID:4628
- C:\Windows\System\oMlTKIt.exe
  C:\Windows\System\oMlTKIt.exe
  2⤵
  PID:4644
- C:\Windows\System\QQPyLWt.exe
  C:\Windows\System\QQPyLWt.exe
  2⤵
  PID:4660
- C:\Windows\System\xnbyOXV.exe
  C:\Windows\System\xnbyOXV.exe
  2⤵
  PID:4676
- C:\Windows\System\RJifHfM.exe
  C:\Windows\System\RJifHfM.exe
  2⤵
  PID:4692
- C:\Windows\System\aprJllP.exe
  C:\Windows\System\aprJllP.exe
  2⤵
  PID:4708
- C:\Windows\System\BkOLWxK.exe
  C:\Windows\System\BkOLWxK.exe
  2⤵
  PID:4724
- C:\Windows\System\BnVwUGp.exe
  C:\Windows\System\BnVwUGp.exe
  2⤵
  PID:4740
- C:\Windows\System\OMcaAUm.exe
  C:\Windows\System\OMcaAUm.exe
  2⤵
  PID:4756
- C:\Windows\System\ZXIRvUQ.exe
  C:\Windows\System\ZXIRvUQ.exe
  2⤵
  PID:4772
- C:\Windows\System\ZBKqNPa.exe
  C:\Windows\System\ZBKqNPa.exe
  2⤵
  PID:4788
- C:\Windows\System\ROxSgat.exe
  C:\Windows\System\ROxSgat.exe
  2⤵
  PID:4804
- C:\Windows\System\IvmRunn.exe
  C:\Windows\System\IvmRunn.exe
  2⤵
  PID:4820
- C:\Windows\System\IMtAdso.exe
  C:\Windows\System\IMtAdso.exe
  2⤵
  PID:4836
- C:\Windows\System\VcZQXuT.exe
  C:\Windows\System\VcZQXuT.exe
  2⤵
  PID:4852
- C:\Windows\System\zTfBfvt.exe
  C:\Windows\System\zTfBfvt.exe
  2⤵
  PID:4868
- C:\Windows\System\qkfxWfV.exe
  C:\Windows\System\qkfxWfV.exe
  2⤵
  PID:4884
- C:\Windows\System\RGIvXvK.exe
  C:\Windows\System\RGIvXvK.exe
  2⤵
  PID:4900
- C:\Windows\System\XTZtscI.exe
  C:\Windows\System\XTZtscI.exe
  2⤵
  PID:4916
- C:\Windows\System\ihTQjyR.exe
  C:\Windows\System\ihTQjyR.exe
  2⤵
  PID:4932
- C:\Windows\System\VwVuLIV.exe
  C:\Windows\System\VwVuLIV.exe
  2⤵
  PID:4948
- C:\Windows\System\TxcpJNj.exe
  C:\Windows\System\TxcpJNj.exe
  2⤵
  PID:4964
- C:\Windows\System\vdkzzML.exe
  C:\Windows\System\vdkzzML.exe
  2⤵
  PID:4980
- C:\Windows\System\FsLOHAt.exe
  C:\Windows\System\FsLOHAt.exe
  2⤵
  PID:4996
- C:\Windows\System\RmoFKEI.exe
  C:\Windows\System\RmoFKEI.exe
  2⤵
  PID:5012
- C:\Windows\System\BDSOjOF.exe
  C:\Windows\System\BDSOjOF.exe
  2⤵
  PID:5028
- C:\Windows\System\fkgCSDx.exe
  C:\Windows\System\fkgCSDx.exe
  2⤵
  PID:5044
- C:\Windows\System\jxpOpyJ.exe
  C:\Windows\System\jxpOpyJ.exe
  2⤵
  PID:5060
- C:\Windows\System\XProGiS.exe
  C:\Windows\System\XProGiS.exe
  2⤵
  PID:5076
- C:\Windows\System\vKivRXl.exe
  C:\Windows\System\vKivRXl.exe
  2⤵
  PID:5092
- C:\Windows\System\ADbFlYh.exe
  C:\Windows\System\ADbFlYh.exe
  2⤵
  PID:5108
- C:\Windows\System\tYhSagv.exe
  C:\Windows\System\tYhSagv.exe
  2⤵
  PID:3888
- C:\Windows\System\toZIcWC.exe
  C:\Windows\System\toZIcWC.exe
  2⤵
  PID:3984
- C:\Windows\System\QXhbgIb.exe
  C:\Windows\System\QXhbgIb.exe
  2⤵
  PID:2548
- C:\Windows\System\kzkonAk.exe
  C:\Windows\System\kzkonAk.exe
  2⤵
  PID:3060
- C:\Windows\System\EsynuoL.exe
  C:\Windows\System\EsynuoL.exe
  2⤵
  PID:3244
- C:\Windows\System\BgeYIVx.exe
  C:\Windows\System\BgeYIVx.exe
  2⤵
  PID:3088
- C:\Windows\System\omvieNF.exe
  C:\Windows\System\omvieNF.exe
  2⤵
  PID:3600
- C:\Windows\System\JymVjvg.exe
  C:\Windows\System\JymVjvg.exe
  2⤵
  PID:4108
- C:\Windows\System\xUnCGhf.exe
  C:\Windows\System\xUnCGhf.exe
  2⤵
  PID:4140
- C:\Windows\System\xeyOqZT.exe
  C:\Windows\System\xeyOqZT.exe
  2⤵
  PID:4156
- C:\Windows\System\LwoLbqP.exe
  C:\Windows\System\LwoLbqP.exe
  2⤵
  PID:4176
- C:\Windows\System\DgYDkwe.exe
  C:\Windows\System\DgYDkwe.exe
  2⤵
  PID:4208
- C:\Windows\System\tQALJjg.exe
  C:\Windows\System\tQALJjg.exe
  2⤵
  PID:4224
- C:\Windows\System\NGLnRTb.exe
  C:\Windows\System\NGLnRTb.exe
  2⤵
  PID:2640
- C:\Windows\System\CGGnJiu.exe
  C:\Windows\System\CGGnJiu.exe
  2⤵
  PID:4300
- C:\Windows\System\MAuIfOD.exe
  C:\Windows\System\MAuIfOD.exe
  2⤵
  PID:4316
- C:\Windows\System\KUFZVIK.exe
  C:\Windows\System\KUFZVIK.exe
  2⤵
  PID:4348
- C:\Windows\System\RjcZhhO.exe
  C:\Windows\System\RjcZhhO.exe
  2⤵
  PID:4380
- C:\Windows\System\yrEredx.exe
  C:\Windows\System\yrEredx.exe
  2⤵
  PID:2432
- C:\Windows\System\rhQiZQT.exe
  C:\Windows\System\rhQiZQT.exe
  2⤵
  PID:4428
- C:\Windows\System\AQgIRYn.exe
  C:\Windows\System\AQgIRYn.exe
  2⤵
  PID:4444
- C:\Windows\System\mzjJlFa.exe
  C:\Windows\System\mzjJlFa.exe
  2⤵
  PID:4464
- C:\Windows\System\ZfBNqJV.exe
  C:\Windows\System\ZfBNqJV.exe
  2⤵
  PID:4496
- C:\Windows\System\hKpuuOs.exe
  C:\Windows\System\hKpuuOs.exe
  2⤵
  PID:4524
- C:\Windows\System\oYticie.exe
  C:\Windows\System\oYticie.exe
  2⤵
  PID:4556
- C:\Windows\System\njcljft.exe
  C:\Windows\System\njcljft.exe
  2⤵
  PID:4588
- C:\Windows\System\nZnmjEy.exe
  C:\Windows\System\nZnmjEy.exe
  2⤵
  PID:4620
- C:\Windows\System\WUwHMIE.exe
  C:\Windows\System\WUwHMIE.exe
  2⤵
  PID:4652
- C:\Windows\System\EqYEftS.exe
  C:\Windows\System\EqYEftS.exe
  2⤵
  PID:4684
- C:\Windows\System\zPQdQhN.exe
  C:\Windows\System\zPQdQhN.exe
  2⤵
  PID:4716
- C:\Windows\System\rwJNWpw.exe
  C:\Windows\System\rwJNWpw.exe
  2⤵
  PID:2436
- C:\Windows\System\divxEDS.exe
  C:\Windows\System\divxEDS.exe
  2⤵
  PID:4764
- C:\Windows\System\WfsbEiE.exe
  C:\Windows\System\WfsbEiE.exe
  2⤵
  PID:4796
- C:\Windows\System\IppjjZg.exe
  C:\Windows\System\IppjjZg.exe
  2⤵
  PID:2444
- C:\Windows\System\AuASDzY.exe
  C:\Windows\System\AuASDzY.exe
  2⤵
  PID:4848
- C:\Windows\System\ajUGEWS.exe
  C:\Windows\System\ajUGEWS.exe
  2⤵
  PID:4864
- C:\Windows\System\xTqXoIF.exe
  C:\Windows\System\xTqXoIF.exe
  2⤵
  PID:4908
- C:\Windows\System\kHsHbNb.exe
  C:\Windows\System\kHsHbNb.exe
  2⤵
  PID:4944
- C:\Windows\System\RjcaKwN.exe
  C:\Windows\System\RjcaKwN.exe
  2⤵
  PID:4976
- C:\Windows\System\AKvvUaL.exe
  C:\Windows\System\AKvvUaL.exe
  2⤵
  PID:5008
- C:\Windows\System\LpeuDDA.exe
  C:\Windows\System\LpeuDDA.exe
  2⤵
  PID:5020
- C:\Windows\System\ajxDbTS.exe
  C:\Windows\System\ajxDbTS.exe
  2⤵
  PID:5068
- C:\Windows\System\zRbfmCB.exe
  C:\Windows\System\zRbfmCB.exe
  2⤵
  PID:5100
- C:\Windows\System\lsFEtDg.exe
  C:\Windows\System\lsFEtDg.exe
  2⤵
  PID:5116
- C:\Windows\System\fFUJMKE.exe
  C:\Windows\System\fFUJMKE.exe
  2⤵
  PID:2556
- C:\Windows\System\QfRcfyR.exe
  C:\Windows\System\QfRcfyR.exe
  2⤵
  PID:2512
- C:\Windows\System\nzPTzTt.exe
  C:\Windows\System\nzPTzTt.exe
  2⤵
  PID:3728
- C:\Windows\System\ECWTASP.exe
  C:\Windows\System\ECWTASP.exe
  2⤵
  PID:3744
- C:\Windows\System\sOyJIkP.exe
  C:\Windows\System\sOyJIkP.exe
  2⤵
  PID:540
- C:\Windows\System\ozYZwaD.exe
  C:\Windows\System\ozYZwaD.exe
  2⤵
  PID:2516
- C:\Windows\System\UPRQjIL.exe
  C:\Windows\System\UPRQjIL.exe
  2⤵
  PID:4220
- C:\Windows\System\LbcMAfD.exe
  C:\Windows\System\LbcMAfD.exe
  2⤵
  PID:4272
- C:\Windows\System\wfrhXIH.exe
  C:\Windows\System\wfrhXIH.exe
  2⤵
  PID:2268
- C:\Windows\System\rPNRblq.exe
  C:\Windows\System\rPNRblq.exe
  2⤵
  PID:2376
- C:\Windows\System\zDKbcuu.exe
  C:\Windows\System\zDKbcuu.exe
  2⤵
  PID:2192
- C:\Windows\System\zDlvGyx.exe
  C:\Windows\System\zDlvGyx.exe
  2⤵
  PID:4448
- C:\Windows\System\vHHQNZX.exe
  C:\Windows\System\vHHQNZX.exe
  2⤵
  PID:2404
- C:\Windows\System\dxMopSn.exe
  C:\Windows\System\dxMopSn.exe
  2⤵
  PID:488
- C:\Windows\System\xwbZpZX.exe
  C:\Windows\System\xwbZpZX.exe
  2⤵
  PID:4540
- C:\Windows\System\hrgRnlQ.exe
  C:\Windows\System\hrgRnlQ.exe
  2⤵
  PID:5124
- C:\Windows\System\FgGbtbT.exe
  C:\Windows\System\FgGbtbT.exe
  2⤵
  PID:5140
- C:\Windows\System\XVkPvJn.exe
  C:\Windows\System\XVkPvJn.exe
  2⤵
  PID:5156
- C:\Windows\System\WwHHzTW.exe
  C:\Windows\System\WwHHzTW.exe
  2⤵
  PID:5176
- C:\Windows\System\mMIDizN.exe
  C:\Windows\System\mMIDizN.exe
  2⤵
  PID:5296
- C:\Windows\System\ytveUni.exe
  C:\Windows\System\ytveUni.exe
  2⤵
  PID:5312
- C:\Windows\System\BsunPYx.exe
  C:\Windows\System\BsunPYx.exe
  2⤵
  PID:5328
- C:\Windows\System\DCSMWIk.exe
  C:\Windows\System\DCSMWIk.exe
  2⤵
  PID:5344
- C:\Windows\System\gZfIoJv.exe
  C:\Windows\System\gZfIoJv.exe
  2⤵
  PID:5360
- C:\Windows\System\uHlOmYY.exe
  C:\Windows\System\uHlOmYY.exe
  2⤵
  PID:5376
- C:\Windows\System\bayNEMr.exe
  C:\Windows\System\bayNEMr.exe
  2⤵
  PID:5392
- C:\Windows\System\bdXgoSw.exe
  C:\Windows\System\bdXgoSw.exe
  2⤵
  PID:5408
- C:\Windows\System\hIGWCqV.exe
  C:\Windows\System\hIGWCqV.exe
  2⤵
  PID:5424
- C:\Windows\System\kfHxKpG.exe
  C:\Windows\System\kfHxKpG.exe
  2⤵
  PID:5636
- C:\Windows\System\XsHKDEQ.exe
  C:\Windows\System\XsHKDEQ.exe
  2⤵
  PID:5800
- C:\Windows\System\fNEcxYZ.exe
  C:\Windows\System\fNEcxYZ.exe
  2⤵
  PID:5860
- C:\Windows\System\kVLTxGM.exe
  C:\Windows\System\kVLTxGM.exe
  2⤵
  PID:5880
- C:\Windows\System\YhicmlS.exe
  C:\Windows\System\YhicmlS.exe
  2⤵
  PID:5896
- C:\Windows\System\ODdwwkV.exe
  C:\Windows\System\ODdwwkV.exe
  2⤵
  PID:5912
- C:\Windows\System\oEdeTue.exe
  C:\Windows\System\oEdeTue.exe
  2⤵
  PID:5928
- C:\Windows\System\wMHKaus.exe
  C:\Windows\System\wMHKaus.exe
  2⤵
  PID:5944
- C:\Windows\System\SyacuBI.exe
  C:\Windows\System\SyacuBI.exe
  2⤵
  PID:5960
- C:\Windows\System\UePKrNQ.exe
  C:\Windows\System\UePKrNQ.exe
  2⤵
  PID:5980
- C:\Windows\System\oaQdnzx.exe
  C:\Windows\System\oaQdnzx.exe
  2⤵
  PID:5996
- C:\Windows\System\Vkdplol.exe
  C:\Windows\System\Vkdplol.exe
  2⤵
  PID:6012
- C:\Windows\System\oxMwQNi.exe
  C:\Windows\System\oxMwQNi.exe
  2⤵
  PID:6028
- C:\Windows\System\WWxxYXZ.exe
  C:\Windows\System\WWxxYXZ.exe
  2⤵
  PID:6048
- C:\Windows\System\VCHKmdM.exe
  C:\Windows\System\VCHKmdM.exe
  2⤵
  PID:6064
- C:\Windows\System\NtgWXEC.exe
  C:\Windows\System\NtgWXEC.exe
  2⤵
  PID:6080
- C:\Windows\System\GRgGoGE.exe
  C:\Windows\System\GRgGoGE.exe
  2⤵
  PID:6096
- C:\Windows\System\dAQbphi.exe
  C:\Windows\System\dAQbphi.exe
  2⤵
  PID:6112
- C:\Windows\System\dEHkMeN.exe
  C:\Windows\System\dEHkMeN.exe
  2⤵
  PID:6128
- C:\Windows\System\UpDJokT.exe
  C:\Windows\System\UpDJokT.exe
  2⤵
  PID:2108
- C:\Windows\System\dOLmjob.exe
  C:\Windows\System\dOLmjob.exe
  2⤵
  PID:1684
- C:\Windows\System\bFVunSG.exe
  C:\Windows\System\bFVunSG.exe
  2⤵
  PID:5208
- C:\Windows\System\tGoVxaX.exe
  C:\Windows\System\tGoVxaX.exe
  2⤵
  PID:4700
- C:\Windows\System\FKYyQZb.exe
  C:\Windows\System\FKYyQZb.exe
  2⤵
  PID:4800
- C:\Windows\System\GAsjaBi.exe
  C:\Windows\System\GAsjaBi.exe
  2⤵
  PID:4940
- C:\Windows\System\EGtUiYW.exe
  C:\Windows\System\EGtUiYW.exe
  2⤵
  PID:5052
- C:\Windows\System\jacUlQw.exe
  C:\Windows\System\jacUlQw.exe
  2⤵
  PID:3456
- C:\Windows\System\tBYylcE.exe
  C:\Windows\System\tBYylcE.exe
  2⤵
  PID:4192
- C:\Windows\System\hQdJnYY.exe
  C:\Windows\System\hQdJnYY.exe
  2⤵
  PID:4400
- C:\Windows\System\QBdMnJv.exe
  C:\Windows\System\QBdMnJv.exe
  2⤵
  PID:1620
- C:\Windows\System\RcYOOMg.exe
  C:\Windows\System\RcYOOMg.exe
  2⤵
  PID:5148
- C:\Windows\System\XcFRrGo.exe
  C:\Windows\System\XcFRrGo.exe
  2⤵
  PID:5196
- C:\Windows\System\PyCzBOT.exe
  C:\Windows\System\PyCzBOT.exe
  2⤵
  PID:5216
- C:\Windows\System\aXfKDiY.exe
  C:\Windows\System\aXfKDiY.exe
  2⤵
  PID:5232
- C:\Windows\System\tVzPkLU.exe
  C:\Windows\System\tVzPkLU.exe
  2⤵
  PID:5248
- C:\Windows\System\aXPaYgn.exe
  C:\Windows\System\aXPaYgn.exe
  2⤵
  PID:5268
- C:\Windows\System\CaUvmdR.exe
  C:\Windows\System\CaUvmdR.exe
  2⤵
  PID:5284
- C:\Windows\System\alDrIdH.exe
  C:\Windows\System\alDrIdH.exe
  2⤵
  PID:5320
- C:\Windows\System\sdwiVPH.exe
  C:\Windows\System\sdwiVPH.exe
  2⤵
  PID:568
- C:\Windows\System\BQxoeOq.exe
  C:\Windows\System\BQxoeOq.exe
  2⤵
  PID:2056
- C:\Windows\System\mDAEkXL.exe
  C:\Windows\System\mDAEkXL.exe
  2⤵
  PID:5324
- C:\Windows\System\LWSnnrs.exe
  C:\Windows\System\LWSnnrs.exe
  2⤵
  PID:5384
- C:\Windows\System\emrrlDe.exe
  C:\Windows\System\emrrlDe.exe
  2⤵
  PID:5488
- C:\Windows\System\xSqoIvP.exe
  C:\Windows\System\xSqoIvP.exe
  2⤵
  PID:1948
- C:\Windows\System\yCUgUEb.exe
  C:\Windows\System\yCUgUEb.exe
  2⤵
  PID:1096
- C:\Windows\System\mKflaoQ.exe
  C:\Windows\System\mKflaoQ.exe
  2⤵
  PID:4076
- C:\Windows\System\IMnOupj.exe
  C:\Windows\System\IMnOupj.exe
  2⤵
  PID:4240
- C:\Windows\System\XHrIjim.exe
  C:\Windows\System\XHrIjim.exe
  2⤵
  PID:4416
- C:\Windows\System\GSNFTIl.exe
  C:\Windows\System\GSNFTIl.exe
  2⤵
  PID:4528
- C:\Windows\System\tJNaiLB.exe
  C:\Windows\System\tJNaiLB.exe
  2⤵
  PID:5164
- C:\Windows\System\laEypLo.exe
  C:\Windows\System\laEypLo.exe
  2⤵
  PID:5308
- C:\Windows\System\gaWJhFb.exe
  C:\Windows\System\gaWJhFb.exe
  2⤵
  PID:5372
- C:\Windows\System\uwYqaky.exe
  C:\Windows\System\uwYqaky.exe
  2⤵
  PID:2984
- C:\Windows\System\MhRRABJ.exe
  C:\Windows\System\MhRRABJ.exe
  2⤵
  PID:2580
- C:\Windows\System\XhHzKck.exe
  C:\Windows\System\XhHzKck.exe
  2⤵
  PID:1840
- C:\Windows\System\jDCeFVM.exe
  C:\Windows\System\jDCeFVM.exe
  2⤵
  PID:4880
- C:\Windows\System\MOZGRyW.exe
  C:\Windows\System\MOZGRyW.exe
  2⤵
  PID:4704
- C:\Windows\System\wlcVsui.exe
  C:\Windows\System\wlcVsui.exe
  2⤵
  PID:5516
- C:\Windows\System\qGoGFUo.exe
  C:\Windows\System\qGoGFUo.exe
  2⤵
  PID:5536
- C:\Windows\System\KqIQdvo.exe
  C:\Windows\System\KqIQdvo.exe
  2⤵
  PID:5556
- C:\Windows\System\MGJAIQI.exe
  C:\Windows\System\MGJAIQI.exe
  2⤵
  PID:1752
- C:\Windows\System\zHcVAMg.exe
  C:\Windows\System\zHcVAMg.exe
  2⤵
  PID:4892
- C:\Windows\System\ITmTOln.exe
  C:\Windows\System\ITmTOln.exe
  2⤵
  PID:5504
- C:\Windows\System\vvyJHUI.exe
  C:\Windows\System\vvyJHUI.exe
  2⤵
  PID:1424
- C:\Windows\System\ZGmpieC.exe
  C:\Windows\System\ZGmpieC.exe
  2⤵
  PID:5660
- C:\Windows\System\cSVQmKb.exe
  C:\Windows\System\cSVQmKb.exe
  2⤵
  PID:5576
- C:\Windows\System\KroolkS.exe
  C:\Windows\System\KroolkS.exe
  2⤵
  PID:5588
- C:\Windows\System\HZETjuv.exe
  C:\Windows\System\HZETjuv.exe
  2⤵
  PID:5664
- C:\Windows\System\imkzFJC.exe
  C:\Windows\System\imkzFJC.exe
  2⤵
  PID:5684
- C:\Windows\System\YEqsPSU.exe
  C:\Windows\System\YEqsPSU.exe
  2⤵
  PID:5696
- C:\Windows\System\gOjFIza.exe
  C:\Windows\System\gOjFIza.exe
  2⤵
  PID:5708
- C:\Windows\System\HZemwRU.exe
  C:\Windows\System\HZemwRU.exe
  2⤵
  PID:5724
- C:\Windows\System\nvZvjIB.exe
  C:\Windows\System\nvZvjIB.exe
  2⤵
  PID:5632
- C:\Windows\System\KbXOzgo.exe
  C:\Windows\System\KbXOzgo.exe
  2⤵
  PID:2452
- C:\Windows\System\NFshRYg.exe
  C:\Windows\System\NFshRYg.exe
  2⤵
  PID:2656
- C:\Windows\System\yrnkJdT.exe
  C:\Windows\System\yrnkJdT.exe
  2⤵
  PID:5720
- C:\Windows\System\TXJuwNH.exe
  C:\Windows\System\TXJuwNH.exe
  2⤵
  PID:5740
- C:\Windows\System\IzFcLqt.exe
  C:\Windows\System\IzFcLqt.exe
  2⤵
  PID:5756
- C:\Windows\System\EsrTexB.exe
  C:\Windows\System\EsrTexB.exe
  2⤵
  PID:5772
- C:\Windows\System\xGVNNua.exe
  C:\Windows\System\xGVNNua.exe
  2⤵
  PID:5788
- C:\Windows\System\SiuKEPn.exe
  C:\Windows\System\SiuKEPn.exe
  2⤵
  PID:5808
- C:\Windows\System\WndskyV.exe
  C:\Windows\System\WndskyV.exe
  2⤵
  PID:5824
- C:\Windows\System\SVJsHHk.exe
  C:\Windows\System\SVJsHHk.exe
  2⤵
  PID:5972
- C:\Windows\System\wZpDvmP.exe
  C:\Windows\System\wZpDvmP.exe
  2⤵
  PID:5904
- C:\Windows\System\zLTSBPO.exe
  C:\Windows\System\zLTSBPO.exe
  2⤵
  PID:5968
- C:\Windows\System\lrceeIw.exe
  C:\Windows\System\lrceeIw.exe
  2⤵
  PID:6008
- C:\Windows\System\RmRZzAk.exe
  C:\Windows\System\RmRZzAk.exe
  2⤵
  PID:6076
- C:\Windows\System\JzNQyjX.exe
  C:\Windows\System\JzNQyjX.exe
  2⤵
  PID:6140
- C:\Windows\System\UInkrmg.exe
  C:\Windows\System\UInkrmg.exe
  2⤵
  PID:4812
- C:\Windows\System\LfhyADL.exe
  C:\Windows\System\LfhyADL.exe
  2⤵
  PID:2688
- C:\Windows\System\JzULJGQ.exe
  C:\Windows\System\JzULJGQ.exe
  2⤵
  PID:4508
- C:\Windows\System\euabJCL.exe
  C:\Windows\System\euabJCL.exe
  2⤵
  PID:5892
- C:\Windows\System\AuROLjJ.exe
  C:\Windows\System\AuROLjJ.exe
  2⤵
  PID:5256
- C:\Windows\System\vZJJrtX.exe
  C:\Windows\System\vZJJrtX.exe
  2⤵
  PID:5844
- C:\Windows\System\isrbKNI.exe
  C:\Windows\System\isrbKNI.exe
  2⤵
  PID:6024
- C:\Windows\System\KcINZGe.exe
  C:\Windows\System\KcINZGe.exe
  2⤵
  PID:5288
- C:\Windows\System\tmoZGZj.exe
  C:\Windows\System\tmoZGZj.exe
  2⤵
  PID:6124
- C:\Windows\System\NwZXpnt.exe
  C:\Windows\System\NwZXpnt.exe
  2⤵
  PID:1256
- C:\Windows\System\OJIqCjG.exe
  C:\Windows\System\OJIqCjG.exe
  2⤵
  PID:5356
- C:\Windows\System\JhnIUyl.exe
  C:\Windows\System\JhnIUyl.exe
  2⤵
  PID:5924
- C:\Windows\System\MswTtvB.exe
  C:\Windows\System\MswTtvB.exe
  2⤵
  PID:1492
- C:\Windows\System\ZXPhNmu.exe
  C:\Windows\System\ZXPhNmu.exe
  2⤵
  PID:5856
- C:\Windows\System\SujJCdO.exe
  C:\Windows\System\SujJCdO.exe
  2⤵
  PID:5240
- C:\Windows\System\vsXTbxb.exe
  C:\Windows\System\vsXTbxb.exe
  2⤵
  PID:3920
- C:\Windows\System\issjhWL.exe
  C:\Windows\System\issjhWL.exe
  2⤵
  PID:5244
- C:\Windows\System\RHgfwgb.exe
  C:\Windows\System\RHgfwgb.exe
  2⤵
  PID:1724
- C:\Windows\System\zuKocKc.exe
  C:\Windows\System\zuKocKc.exe
  2⤵
  PID:580
- C:\Windows\System\ozCfnNQ.exe
  C:\Windows\System\ozCfnNQ.exe
  2⤵
  PID:3216
- C:\Windows\System\XjRynsm.exe
  C:\Windows\System\XjRynsm.exe
  2⤵
  PID:5136
- C:\Windows\System\qvBcUAa.exe
  C:\Windows\System\qvBcUAa.exe
  2⤵
  PID:2704
- C:\Windows\System\fnqNIUr.exe
  C:\Windows\System\fnqNIUr.exe
  2⤵
  PID:352
- C:\Windows\System\OUywKtx.exe
  C:\Windows\System\OUywKtx.exe
  2⤵
  PID:5544
- C:\Windows\System\fEmfFsU.exe
  C:\Windows\System\fEmfFsU.exe
  2⤵
  PID:5652
- C:\Windows\System\YiWGEwm.exe
  C:\Windows\System\YiWGEwm.exe
  2⤵
  PID:5584
- C:\Windows\System\AxupKkA.exe
  C:\Windows\System\AxupKkA.exe
  2⤵
  PID:1428
- C:\Windows\System\BvgWWhL.exe
  C:\Windows\System\BvgWWhL.exe
  2⤵
  PID:5568
- C:\Windows\System\LCqIFYN.exe
  C:\Windows\System\LCqIFYN.exe
  2⤵
  PID:4768
- C:\Windows\System\SVUExqn.exe
  C:\Windows\System\SVUExqn.exe
  2⤵
  PID:2408
- C:\Windows\System\epqDwzj.exe
  C:\Windows\System\epqDwzj.exe
  2⤵
  PID:4668
- C:\Windows\System\NjzkqnV.exe
  C:\Windows\System\NjzkqnV.exe
  2⤵
  PID:5692
- C:\Windows\System\hFRrLTe.exe
  C:\Windows\System\hFRrLTe.exe
  2⤵
  PID:2608
- C:\Windows\System\vMXIiue.exe
  C:\Windows\System\vMXIiue.exe
  2⤵
  PID:5748
- C:\Windows\System\kQnvFSf.exe
  C:\Windows\System\kQnvFSf.exe
  2⤵
  PID:5784
- C:\Windows\System\SLzZBdh.exe
  C:\Windows\System\SLzZBdh.exe
  2⤵
  PID:5876
- C:\Windows\System\VTtQTuH.exe
  C:\Windows\System\VTtQTuH.exe
  2⤵
  PID:6108
- C:\Windows\System\ELNicRv.exe
  C:\Windows\System\ELNicRv.exe
  2⤵
  PID:5264
- C:\Windows\System\eVQqQMv.exe
  C:\Windows\System\eVQqQMv.exe
  2⤵
  PID:5292
- C:\Windows\System\SDbGFha.exe
  C:\Windows\System\SDbGFha.exe
  2⤵
  PID:5036
- C:\Windows\System\vHowWYy.exe
  C:\Windows\System\vHowWYy.exe
  2⤵
  PID:5280
- C:\Windows\System\BOLQLTl.exe
  C:\Windows\System\BOLQLTl.exe
  2⤵
  PID:5368
- C:\Windows\System\piBerkh.exe
  C:\Windows\System\piBerkh.exe
  2⤵
  PID:5404
- C:\Windows\System\DxQgLam.exe
  C:\Windows\System\DxQgLam.exe
  2⤵
  PID:2996
- C:\Windows\System\YRmbBxy.exe
  C:\Windows\System\YRmbBxy.exe
  2⤵
  PID:2428
- C:\Windows\System\crSJapr.exe
  C:\Windows\System\crSJapr.exe
  2⤵
  PID:5852
- C:\Windows\System\RvLQtVz.exe
  C:\Windows\System\RvLQtVz.exe
  2⤵
  PID:5988
- C:\Windows\System\bnxcbkT.exe
  C:\Windows\System\bnxcbkT.exe
  2⤵
  PID:5620
- C:\Windows\System\ZfjvbYU.exe
  C:\Windows\System\ZfjvbYU.exe
  2⤵
  PID:6036
- C:\Windows\System\cUYvBKW.exe
  C:\Windows\System\cUYvBKW.exe
  2⤵
  PID:2016
- C:\Windows\System\TylDZhB.exe
  C:\Windows\System\TylDZhB.exe
  2⤵
  PID:5704
- C:\Windows\System\UsJoILe.exe
  C:\Windows\System\UsJoILe.exe
  2⤵
  PID:5228
- C:\Windows\System\yuHrBtM.exe
  C:\Windows\System\yuHrBtM.exe
  2⤵
  PID:4364
- C:\Windows\System\YADMVye.exe
  C:\Windows\System\YADMVye.exe
  2⤵
  PID:1788
- C:\Windows\System\DdhwGTW.exe
  C:\Windows\System\DdhwGTW.exe
  2⤵
  PID:5552
- C:\Windows\System\gfyZsXR.exe
  C:\Windows\System\gfyZsXR.exe
  2⤵
  PID:5548
- C:\Windows\System\IFCVruO.exe
  C:\Windows\System\IFCVruO.exe
  2⤵
  PID:6044
- C:\Windows\System\vnnbVJb.exe
  C:\Windows\System\vnnbVJb.exe
  2⤵
  PID:5832
- C:\Windows\System\fKrGfkw.exe
  C:\Windows\System\fKrGfkw.exe
  2⤵
  PID:5764
- C:\Windows\System\JQCFeVo.exe
  C:\Windows\System\JQCFeVo.exe
  2⤵
  PID:5628
- C:\Windows\System\rNcMtcM.exe
  C:\Windows\System\rNcMtcM.exe
  2⤵
  PID:5920
- C:\Windows\System\QNDfpsm.exe
  C:\Windows\System\QNDfpsm.exe
  2⤵
  PID:2416
- C:\Windows\System\blKpRTF.exe
  C:\Windows\System\blKpRTF.exe
  2⤵
  PID:6120
- C:\Windows\System\kKIhJMd.exe
  C:\Windows\System\kKIhJMd.exe
  2⤵
  PID:3840
- C:\Windows\System\nbUMgnW.exe
  C:\Windows\System\nbUMgnW.exe
  2⤵
  PID:5836
- C:\Windows\System\WGKXvBL.exe
  C:\Windows\System\WGKXvBL.exe
  2⤵
  PID:5688
- C:\Windows\System\LhppySO.exe
  C:\Windows\System\LhppySO.exe
  2⤵
  PID:6092
- C:\Windows\System\YKHvxVS.exe
  C:\Windows\System\YKHvxVS.exe
  2⤵
  PID:5608
- C:\Windows\System\TCZJZdt.exe
  C:\Windows\System\TCZJZdt.exe
  2⤵
  PID:1888
- C:\Windows\System\albRaSs.exe
  C:\Windows\System\albRaSs.exe
  2⤵
  PID:5780
- C:\Windows\System\lDgwBfs.exe
  C:\Windows\System\lDgwBfs.exe
  2⤵
  PID:5888
- C:\Windows\System\EhDPYdI.exe
  C:\Windows\System\EhDPYdI.exe
  2⤵
  PID:5872
- C:\Windows\System\gllrYuL.exe
  C:\Windows\System\gllrYuL.exe
  2⤵
  PID:4572
- C:\Windows\System\AnvbpwY.exe
  C:\Windows\System\AnvbpwY.exe
  2⤵
  PID:5956
- C:\Windows\System\PHtTDXn.exe
  C:\Windows\System\PHtTDXn.exe
  2⤵
  PID:5524
- C:\Windows\System\yNeSCyZ.exe
  C:\Windows\System\yNeSCyZ.exe
  2⤵
  PID:6156
- C:\Windows\System\eYVMnIU.exe
  C:\Windows\System\eYVMnIU.exe
  2⤵
  PID:6172
- C:\Windows\System\ecCcioK.exe
  C:\Windows\System\ecCcioK.exe
  2⤵
  PID:6188
- C:\Windows\System\KTlhaLV.exe
  C:\Windows\System\KTlhaLV.exe
  2⤵
  PID:6204
- C:\Windows\System\XsPkteD.exe
  C:\Windows\System\XsPkteD.exe
  2⤵
  PID:6220
- C:\Windows\System\gsXrdDY.exe
  C:\Windows\System\gsXrdDY.exe
  2⤵
  PID:6236
- C:\Windows\System\nabZTod.exe
  C:\Windows\System\nabZTod.exe
  2⤵
  PID:6252
- C:\Windows\System\oXtTNYJ.exe
  C:\Windows\System\oXtTNYJ.exe
  2⤵
  PID:6268
- C:\Windows\System\VcYKqEd.exe
  C:\Windows\System\VcYKqEd.exe
  2⤵
  PID:6284
- C:\Windows\System\UQuRnzk.exe
  C:\Windows\System\UQuRnzk.exe
  2⤵
  PID:6300
- C:\Windows\System\FopofNx.exe
  C:\Windows\System\FopofNx.exe
  2⤵
  PID:6316
- C:\Windows\System\AWkopkJ.exe
  C:\Windows\System\AWkopkJ.exe
  2⤵
  PID:6348
- C:\Windows\System\RqBBjDM.exe
  C:\Windows\System\RqBBjDM.exe
  2⤵
  PID:6376
- C:\Windows\System\lhaFOlo.exe
  C:\Windows\System\lhaFOlo.exe
  2⤵
  PID:6392
- C:\Windows\System\vlcoAnZ.exe
  C:\Windows\System\vlcoAnZ.exe
  2⤵
  PID:6408
- C:\Windows\System\npYnhMW.exe
  C:\Windows\System\npYnhMW.exe
  2⤵
  PID:6424
- C:\Windows\System\TUrqzTY.exe
  C:\Windows\System\TUrqzTY.exe
  2⤵
  PID:6440
- C:\Windows\System\McVrCTK.exe
  C:\Windows\System\McVrCTK.exe
  2⤵
  PID:6456
- C:\Windows\System\LTxDegG.exe
  C:\Windows\System\LTxDegG.exe
  2⤵
  PID:6472
- C:\Windows\System\HIccRje.exe
  C:\Windows\System\HIccRje.exe
  2⤵
  PID:6488
- C:\Windows\System\awmnkEB.exe
  C:\Windows\System\awmnkEB.exe
  2⤵
  PID:6504
- C:\Windows\System\nsoDvlb.exe
  C:\Windows\System\nsoDvlb.exe
  2⤵
  PID:6520
- C:\Windows\System\yfKWWeh.exe
  C:\Windows\System\yfKWWeh.exe
  2⤵
  PID:6536
- C:\Windows\System\WmWeXAs.exe
  C:\Windows\System\WmWeXAs.exe
  2⤵
  PID:6552
- C:\Windows\System\LfuRRlK.exe
  C:\Windows\System\LfuRRlK.exe
  2⤵
  PID:6568
- C:\Windows\System\CBuuwgU.exe
  C:\Windows\System\CBuuwgU.exe
  2⤵
  PID:6584
- C:\Windows\System\vLZLjfy.exe
  C:\Windows\System\vLZLjfy.exe
  2⤵
  PID:6600
- C:\Windows\System\mqxVZlQ.exe
  C:\Windows\System\mqxVZlQ.exe
  2⤵
  PID:6616
- C:\Windows\System\YxUBFJX.exe
  C:\Windows\System\YxUBFJX.exe
  2⤵
  PID:6632
- C:\Windows\System\DMEQBni.exe
  C:\Windows\System\DMEQBni.exe
  2⤵
  PID:6664
- C:\Windows\System\WjeKyTe.exe
  C:\Windows\System\WjeKyTe.exe
  2⤵
  PID:6696
- C:\Windows\System\EzzRmXj.exe
  C:\Windows\System\EzzRmXj.exe
  2⤵
  PID:6712
- C:\Windows\System\kTCcUUi.exe
  C:\Windows\System\kTCcUUi.exe
  2⤵
  PID:6732
- C:\Windows\System\SBNmvIb.exe
  C:\Windows\System\SBNmvIb.exe
  2⤵
  PID:6748
- C:\Windows\System\mJwagSf.exe
  C:\Windows\System\mJwagSf.exe
  2⤵
  PID:6772
- C:\Windows\System\sSuXJAY.exe
  C:\Windows\System\sSuXJAY.exe
  2⤵
  PID:6788
- C:\Windows\System\VqxMQZk.exe
  C:\Windows\System\VqxMQZk.exe
  2⤵
  PID:6812
- C:\Windows\System\CzPuLmn.exe
  C:\Windows\System\CzPuLmn.exe
  2⤵
  PID:6828
- C:\Windows\System\WrRSJAg.exe
  C:\Windows\System\WrRSJAg.exe
  2⤵
  PID:6844
- C:\Windows\System\YHCADAF.exe
  C:\Windows\System\YHCADAF.exe
  2⤵
  PID:6860
- C:\Windows\System\kRlzTOa.exe
  C:\Windows\System\kRlzTOa.exe
  2⤵
  PID:6880
- C:\Windows\System\daRJdLP.exe
  C:\Windows\System\daRJdLP.exe
  2⤵
  PID:6896
- C:\Windows\System\RMtQEXn.exe
  C:\Windows\System\RMtQEXn.exe
  2⤵
  PID:6912
- C:\Windows\System\JKuhheg.exe
  C:\Windows\System\JKuhheg.exe
  2⤵
  PID:6928
- C:\Windows\System\bSjINnq.exe
  C:\Windows\System\bSjINnq.exe
  2⤵
  PID:6948
- C:\Windows\System\PnNVitW.exe
  C:\Windows\System\PnNVitW.exe
  2⤵
  PID:6968
- C:\Windows\System\AEhIUoj.exe
  C:\Windows\System\AEhIUoj.exe
  2⤵
  PID:6984
- C:\Windows\System\cZaDIUc.exe
  C:\Windows\System\cZaDIUc.exe
  2⤵
  PID:7000
- C:\Windows\System\dydUcJJ.exe
  C:\Windows\System\dydUcJJ.exe
  2⤵
  PID:7016
- C:\Windows\System\coWMKBM.exe
  C:\Windows\System\coWMKBM.exe
  2⤵
  PID:7032
- C:\Windows\System\ZxPEvpt.exe
  C:\Windows\System\ZxPEvpt.exe
  2⤵
  PID:7048
- C:\Windows\System\mQoKuPK.exe
  C:\Windows\System\mQoKuPK.exe
  2⤵
  PID:7064
- C:\Windows\System\alLkyVm.exe
  C:\Windows\System\alLkyVm.exe
  2⤵
  PID:7080
- C:\Windows\System\olUhhhB.exe
  C:\Windows\System\olUhhhB.exe
  2⤵
  PID:7096
- C:\Windows\System\wegmcfR.exe
  C:\Windows\System\wegmcfR.exe
  2⤵
  PID:7112
- C:\Windows\System\lIaJNVK.exe
  C:\Windows\System\lIaJNVK.exe
  2⤵
  PID:7128
- C:\Windows\System\JBHsBOm.exe
  C:\Windows\System\JBHsBOm.exe
  2⤵
  PID:7144
- C:\Windows\System\iWbCBXs.exe
  C:\Windows\System\iWbCBXs.exe
  2⤵
  PID:7160
- C:\Windows\System\kksiZNB.exe
  C:\Windows\System\kksiZNB.exe
  2⤵
  PID:4860
- C:\Windows\System\iFDlsit.exe
  C:\Windows\System\iFDlsit.exe
  2⤵
  PID:632
- C:\Windows\System\eXCwcmI.exe
  C:\Windows\System\eXCwcmI.exe
  2⤵
  PID:6164
- C:\Windows\System\pMYEpwU.exe
  C:\Windows\System\pMYEpwU.exe
  2⤵
  PID:6228
- C:\Windows\System\vmvUugm.exe
  C:\Windows\System\vmvUugm.exe
  2⤵
  PID:6292
- C:\Windows\System\EOPOJRi.exe
  C:\Windows\System\EOPOJRi.exe
  2⤵
  PID:6332
- C:\Windows\System\ptcddyh.exe
  C:\Windows\System\ptcddyh.exe
  2⤵
  PID:6416
- C:\Windows\System\fUvwdRV.exe
  C:\Windows\System\fUvwdRV.exe
  2⤵
  PID:6480
- C:\Windows\System\VocYWXW.exe
  C:\Windows\System\VocYWXW.exe
  2⤵
  PID:6544
- C:\Windows\System\QaNEvzx.exe
  C:\Windows\System\QaNEvzx.exe
  2⤵
  PID:5796
- C:\Windows\System\EarfATG.exe
  C:\Windows\System\EarfATG.exe
  2⤵
  PID:4636
- C:\Windows\System\LzByYRJ.exe
  C:\Windows\System\LzByYRJ.exe
  2⤵
  PID:2588
- C:\Windows\System\UhPCvDW.exe
  C:\Windows\System\UhPCvDW.exe
  2⤵
  PID:6180
- C:\Windows\System\BKMBsRs.exe
  C:\Windows\System\BKMBsRs.exe
  2⤵
  PID:6244
- C:\Windows\System\XASGdTY.exe
  C:\Windows\System\XASGdTY.exe
  2⤵
  PID:6308
- C:\Windows\System\xLJyNVU.exe
  C:\Windows\System\xLJyNVU.exe
  2⤵
  PID:6364
- C:\Windows\System\NjPkIXN.exe
  C:\Windows\System\NjPkIXN.exe
  2⤵
  PID:6404
- C:\Windows\System\SQkjyaj.exe
  C:\Windows\System\SQkjyaj.exe
  2⤵
  PID:6468
- C:\Windows\System\MtthFZc.exe
  C:\Windows\System\MtthFZc.exe
  2⤵
  PID:6532
- C:\Windows\System\qZYLXHg.exe
  C:\Windows\System\qZYLXHg.exe
  2⤵
  PID:6596
- C:\Windows\System\ORCMeeu.exe
  C:\Windows\System\ORCMeeu.exe
  2⤵
  PID:6680
- C:\Windows\System\hqTiZjj.exe
  C:\Windows\System\hqTiZjj.exe
  2⤵
  PID:6720
- C:\Windows\System\nrOujlF.exe
  C:\Windows\System\nrOujlF.exe
  2⤵
  PID:6660
- C:\Windows\System\sgtkYda.exe
  C:\Windows\System\sgtkYda.exe
  2⤵
  PID:6648
- C:\Windows\System\IVVCOjx.exe
  C:\Windows\System\IVVCOjx.exe
  2⤵
  PID:6740
- C:\Windows\System\VOgYzUO.exe
  C:\Windows\System\VOgYzUO.exe
  2⤵
  PID:6724
- C:\Windows\System\myBZQDr.exe
  C:\Windows\System\myBZQDr.exe
  2⤵
  PID:6796
- C:\Windows\System\WOVUwYd.exe
  C:\Windows\System\WOVUwYd.exe
  2⤵
  PID:6820
- C:\Windows\System\EoaCwcm.exe
  C:\Windows\System\EoaCwcm.exe
  2⤵
  PID:6888
- C:\Windows\System\sZaunJo.exe
  C:\Windows\System\sZaunJo.exe
  2⤵
  PID:6800
- C:\Windows\System\iCfqIWx.exe
  C:\Windows\System\iCfqIWx.exe
  2⤵
  PID:6868
- C:\Windows\System\DYLGjpU.exe
  C:\Windows\System\DYLGjpU.exe
  2⤵
  PID:6908
- C:\Windows\System\rNjsmuu.exe
  C:\Windows\System\rNjsmuu.exe
  2⤵
  PID:6924
- C:\Windows\System\wVskKaF.exe
  C:\Windows\System\wVskKaF.exe
  2⤵
  PID:6980
- C:\Windows\System\qvOLKUb.exe
  C:\Windows\System\qvOLKUb.exe
  2⤵
  PID:7040
- C:\Windows\System\Jobgjnk.exe
  C:\Windows\System\Jobgjnk.exe
  2⤵
  PID:7024
- C:\Windows\System\DRKzKSh.exe
  C:\Windows\System\DRKzKSh.exe
  2⤵
  PID:7060
- C:\Windows\System\ScZbPRw.exe
  C:\Windows\System\ScZbPRw.exe
  2⤵
  PID:7092
- C:\Windows\System\UUPUQTv.exe
  C:\Windows\System\UUPUQTv.exe
  2⤵
  PID:5188
- C:\Windows\System\TJZzqKo.exe
  C:\Windows\System\TJZzqKo.exe
  2⤵
  PID:7124
- C:\Windows\System\NzpUmUf.exe
  C:\Windows\System\NzpUmUf.exe
  2⤵
  PID:6512
- C:\Windows\System\pZAfyAq.exe
  C:\Windows\System\pZAfyAq.exe
  2⤵
  PID:6344
- C:\Windows\System\wLhWmKA.exe
  C:\Windows\System\wLhWmKA.exe
  2⤵
  PID:5768
- C:\Windows\System\opOuOkW.exe
  C:\Windows\System\opOuOkW.exe
  2⤵
  PID:6576
- C:\Windows\System\XHTweww.exe
  C:\Windows\System\XHTweww.exe
  2⤵
  PID:6212
- C:\Windows\System\AWUuCjE.exe
  C:\Windows\System\AWUuCjE.exe
  2⤵
  PID:6216
- C:\Windows\System\NgLfVrO.exe
  C:\Windows\System\NgLfVrO.exe
  2⤵
  PID:6500
- C:\Windows\System\YvTFWNE.exe
  C:\Windows\System\YvTFWNE.exe
  2⤵
  PID:6356
- C:\Windows\System\QgoEZiJ.exe
  C:\Windows\System\QgoEZiJ.exe
  2⤵
  PID:6436
- C:\Windows\System\IBaOYKi.exe
  C:\Windows\System\IBaOYKi.exe
  2⤵
  PID:6656
- C:\Windows\System\RVRNEei.exe
  C:\Windows\System\RVRNEei.exe
  2⤵
  PID:6852
- C:\Windows\System\EBbVlGq.exe
  C:\Windows\System\EBbVlGq.exe
  2⤵
  PID:6836
- C:\Windows\System\NacTJze.exe
  C:\Windows\System\NacTJze.exe
  2⤵
  PID:6920
- C:\Windows\System\QwdJvue.exe
  C:\Windows\System\QwdJvue.exe
  2⤵
  PID:7012
- C:\Windows\System\xIuuinS.exe
  C:\Windows\System\xIuuinS.exe
  2⤵
  PID:7140
- C:\Windows\System\EokjBNr.exe
  C:\Windows\System\EokjBNr.exe
  2⤵
  PID:7044
- C:\Windows\System\cQHWRTV.exe
  C:\Windows\System\cQHWRTV.exe
  2⤵
  PID:6756
- C:\Windows\System\HeqmPZZ.exe
  C:\Windows\System\HeqmPZZ.exe
  2⤵
  PID:6072
- C:\Windows\System\peChxgK.exe
  C:\Windows\System\peChxgK.exe
  2⤵
  PID:7120
- C:\Windows\System\muqNtFZ.exe
  C:\Windows\System\muqNtFZ.exe
  2⤵
  PID:6264
- C:\Windows\System\eHyfqzR.exe
  C:\Windows\System\eHyfqzR.exe
  2⤵
  PID:6276
- C:\Windows\System\DoRDGTp.exe
  C:\Windows\System\DoRDGTp.exe
  2⤵
  PID:6200
- C:\Windows\System\WYlIYfe.exe
  C:\Windows\System\WYlIYfe.exe
  2⤵
  PID:6360
- C:\Windows\System\wsUZKnx.exe
  C:\Windows\System\wsUZKnx.exe
  2⤵
  PID:6760
- C:\Windows\System\LSzncBU.exe
  C:\Windows\System\LSzncBU.exe
  2⤵
  PID:7056
- C:\Windows\System\cimDPyf.exe
  C:\Windows\System\cimDPyf.exe
  2⤵
  PID:5492
- C:\Windows\System\PyXOiXj.exe
  C:\Windows\System\PyXOiXj.exe
  2⤵
  PID:6628
- C:\Windows\System\HNfOpnO.exe
  C:\Windows\System\HNfOpnO.exe
  2⤵
  PID:7008
- C:\Windows\System\VPHcdbH.exe
  C:\Windows\System\VPHcdbH.exe
  2⤵
  PID:6640
- C:\Windows\System\UGNiAzE.exe
  C:\Windows\System\UGNiAzE.exe
  2⤵
  PID:6196
- C:\Windows\System\hIAvzAu.exe
  C:\Windows\System\hIAvzAu.exe
  2⤵
  PID:6940
- C:\Windows\System\YRNqCIx.exe
  C:\Windows\System\YRNqCIx.exe
  2⤵
  PID:6452
- C:\Windows\System\pjQjqPD.exe
  C:\Windows\System\pjQjqPD.exe
  2⤵
  PID:6768
- C:\Windows\System\zgsAijB.exe
  C:\Windows\System\zgsAijB.exe
  2⤵
  PID:7184
- C:\Windows\System\QBARRDv.exe
  C:\Windows\System\QBARRDv.exe
  2⤵
  PID:7200
- C:\Windows\System\MBpiMnn.exe
  C:\Windows\System\MBpiMnn.exe
  2⤵
  PID:7220
- C:\Windows\System\lFjYRRV.exe
  C:\Windows\System\lFjYRRV.exe
  2⤵
  PID:7236
- C:\Windows\System\VtpUwaK.exe
  C:\Windows\System\VtpUwaK.exe
  2⤵
  PID:7256
- C:\Windows\System\MYhyXgK.exe
  C:\Windows\System\MYhyXgK.exe
  2⤵
  PID:7276
- C:\Windows\System\tTQOVSL.exe
  C:\Windows\System\tTQOVSL.exe
  2⤵
  PID:7296
- C:\Windows\System\iKcsCKZ.exe
  C:\Windows\System\iKcsCKZ.exe
  2⤵
  PID:7312
- C:\Windows\System\mxjTPIi.exe
  C:\Windows\System\mxjTPIi.exe
  2⤵
  PID:7328
- C:\Windows\System\nOBPEOY.exe
  C:\Windows\System\nOBPEOY.exe
  2⤵
  PID:7344
- C:\Windows\System\roBhbGl.exe
  C:\Windows\System\roBhbGl.exe
  2⤵
  PID:7364
- C:\Windows\System\wdFWtfP.exe
  C:\Windows\System\wdFWtfP.exe
  2⤵
  PID:7380
- C:\Windows\System\PIrTvVm.exe
  C:\Windows\System\PIrTvVm.exe
  2⤵
  PID:7396
- C:\Windows\System\wmbzzdz.exe
  C:\Windows\System\wmbzzdz.exe
  2⤵
  PID:7412
- C:\Windows\System\IcJgbrM.exe
  C:\Windows\System\IcJgbrM.exe
  2⤵
  PID:7428
- C:\Windows\System\IOkSVAB.exe
  C:\Windows\System\IOkSVAB.exe
  2⤵
  PID:7444
- C:\Windows\System\VjyFbKr.exe
  C:\Windows\System\VjyFbKr.exe
  2⤵
  PID:7460
- C:\Windows\System\qRBNSSc.exe
  C:\Windows\System\qRBNSSc.exe
  2⤵
  PID:7476
- C:\Windows\System\wKZdMMH.exe
  C:\Windows\System\wKZdMMH.exe
  2⤵
  PID:7492
- C:\Windows\System\yVTQTSi.exe
  C:\Windows\System\yVTQTSi.exe
  2⤵
  PID:7508
- C:\Windows\System\JiyRVdv.exe
  C:\Windows\System\JiyRVdv.exe
  2⤵
  PID:7524
- C:\Windows\System\mQqnQxP.exe
  C:\Windows\System\mQqnQxP.exe
  2⤵
  PID:7540
- C:\Windows\System\jAWEnxm.exe
  C:\Windows\System\jAWEnxm.exe
  2⤵
  PID:7556
- C:\Windows\System\hXMVkui.exe
  C:\Windows\System\hXMVkui.exe
  2⤵
  PID:7572
- C:\Windows\System\nsSovRv.exe
  C:\Windows\System\nsSovRv.exe
  2⤵
  PID:7588
- C:\Windows\System\DXVqhvR.exe
  C:\Windows\System\DXVqhvR.exe
  2⤵
  PID:7604
- C:\Windows\System\UrAIKhO.exe
  C:\Windows\System\UrAIKhO.exe
  2⤵
  PID:7620
- C:\Windows\System\XUKOLtH.exe
  C:\Windows\System\XUKOLtH.exe
  2⤵
  PID:7636
- C:\Windows\System\sTcfpij.exe
  C:\Windows\System\sTcfpij.exe
  2⤵
  PID:7652
- C:\Windows\System\xZrZcrk.exe
  C:\Windows\System\xZrZcrk.exe
  2⤵
  PID:7668
- C:\Windows\System\YPKqLTD.exe
  C:\Windows\System\YPKqLTD.exe
  2⤵
  PID:7684
- C:\Windows\System\SIclgGt.exe
  C:\Windows\System\SIclgGt.exe
  2⤵
  PID:7700
- C:\Windows\System\nngWlRh.exe
  C:\Windows\System\nngWlRh.exe
  2⤵
  PID:7716
- C:\Windows\System\KUaPuBz.exe
  C:\Windows\System\KUaPuBz.exe
  2⤵
  PID:7736
- C:\Windows\System\DzfixjD.exe
  C:\Windows\System\DzfixjD.exe
  2⤵
  PID:7752
- C:\Windows\System\AUGnYwa.exe
  C:\Windows\System\AUGnYwa.exe
  2⤵
  PID:7768
- C:\Windows\System\MyXrrpl.exe
  C:\Windows\System\MyXrrpl.exe
  2⤵
  PID:7784
- C:\Windows\System\IPcPvEr.exe
  C:\Windows\System\IPcPvEr.exe
  2⤵
  PID:7800
- C:\Windows\System\uaPMkGw.exe
  C:\Windows\System\uaPMkGw.exe
  2⤵
  PID:7816
- C:\Windows\System\wqjgaCk.exe
  C:\Windows\System\wqjgaCk.exe
  2⤵
  PID:7832
- C:\Windows\System\QcYsuvt.exe
  C:\Windows\System\QcYsuvt.exe
  2⤵
  PID:7848
- C:\Windows\System\wqoQxYF.exe
  C:\Windows\System\wqoQxYF.exe
  2⤵
  PID:7864
- C:\Windows\System\DyfVTAr.exe
  C:\Windows\System\DyfVTAr.exe
  2⤵
  PID:7880
- C:\Windows\System\RefcLsQ.exe
  C:\Windows\System\RefcLsQ.exe
  2⤵
  PID:7896
- C:\Windows\System\ARdhcsf.exe
  C:\Windows\System\ARdhcsf.exe
  2⤵
  PID:7912
- C:\Windows\System\cEXlYdJ.exe
  C:\Windows\System\cEXlYdJ.exe
  2⤵
  PID:7928
- C:\Windows\System\oRqEqkh.exe
  C:\Windows\System\oRqEqkh.exe
  2⤵
  PID:7944
- C:\Windows\System\gLxbWma.exe
  C:\Windows\System\gLxbWma.exe
  2⤵
  PID:7960
- C:\Windows\System\CjmDQDQ.exe
  C:\Windows\System\CjmDQDQ.exe
  2⤵
  PID:7976
- C:\Windows\System\qESMKis.exe
  C:\Windows\System\qESMKis.exe
  2⤵
  PID:7992
- C:\Windows\System\abgOBaa.exe
  C:\Windows\System\abgOBaa.exe
  2⤵
  PID:8008
- C:\Windows\System\AiIemiI.exe
  C:\Windows\System\AiIemiI.exe
  2⤵
  PID:8024
- C:\Windows\System\IprfUNH.exe
  C:\Windows\System\IprfUNH.exe
  2⤵
  PID:8040
- C:\Windows\System\iNmVDWw.exe
  C:\Windows\System\iNmVDWw.exe
  2⤵
  PID:8056
- C:\Windows\System\WqDiNTp.exe
  C:\Windows\System\WqDiNTp.exe
  2⤵
  PID:8072
- C:\Windows\System\QftAeKi.exe
  C:\Windows\System\QftAeKi.exe
  2⤵
  PID:8088
- C:\Windows\System\MHjoFMh.exe
  C:\Windows\System\MHjoFMh.exe
  2⤵
  PID:8104
- C:\Windows\System\YqMrSjI.exe
  C:\Windows\System\YqMrSjI.exe
  2⤵
  PID:8120
- C:\Windows\System\TOnJBTs.exe
  C:\Windows\System\TOnJBTs.exe
  2⤵
  PID:8136
- C:\Windows\System\jYPdpJy.exe
  C:\Windows\System\jYPdpJy.exe
  2⤵
  PID:8152
- C:\Windows\System\wHgSmrU.exe
  C:\Windows\System\wHgSmrU.exe
  2⤵
  PID:8168
- C:\Windows\System\DSzeQGg.exe
  C:\Windows\System\DSzeQGg.exe
  2⤵
  PID:8184
- C:\Windows\System\ZMQfXTv.exe
  C:\Windows\System\ZMQfXTv.exe
  2⤵
  PID:6564
- C:\Windows\System\CFWCNdJ.exe
  C:\Windows\System\CFWCNdJ.exe
  2⤵
  PID:7196
- C:\Windows\System\AuVDepm.exe
  C:\Windows\System\AuVDepm.exe
  2⤵
  PID:7232
- C:\Windows\System\QFxNIbn.exe
  C:\Windows\System\QFxNIbn.exe
  2⤵
  PID:6152
- C:\Windows\System\CmoSWfm.exe
  C:\Windows\System\CmoSWfm.exe
  2⤵
  PID:6448
- C:\Windows\System\azgBAij.exe
  C:\Windows\System\azgBAij.exe
  2⤵
  PID:7216
- C:\Windows\System\tuGaJty.exe
  C:\Windows\System\tuGaJty.exe
  2⤵
  PID:7244
- C:\Windows\System\FOkGZqy.exe
  C:\Windows\System\FOkGZqy.exe
  2⤵
  PID:7304
- C:\Windows\System\NMrQjXE.exe
  C:\Windows\System\NMrQjXE.exe
  2⤵
  PID:7372
- C:\Windows\System\BsYQXuG.exe
  C:\Windows\System\BsYQXuG.exe
  2⤵
  PID:7352
- C:\Windows\System\rCpOnwx.exe
  C:\Windows\System\rCpOnwx.exe
  2⤵
  PID:7392
- C:\Windows\System\xPGrtiu.exe
  C:\Windows\System\xPGrtiu.exe
  2⤵
  PID:7436
- C:\Windows\System\DaAPTKm.exe
  C:\Windows\System\DaAPTKm.exe
  2⤵
  PID:7452
- C:\Windows\System\aLBmmYy.exe
  C:\Windows\System\aLBmmYy.exe
  2⤵
  PID:7488
- C:\Windows\System\NULDHDw.exe
  C:\Windows\System\NULDHDw.exe
  2⤵
  PID:7532
- C:\Windows\System\fUSgCmO.exe
  C:\Windows\System\fUSgCmO.exe
  2⤵
  PID:7600
- C:\Windows\System\cKueJHl.exe
  C:\Windows\System\cKueJHl.exe
  2⤵
  PID:7664
- C:\Windows\System\dmJJVlm.exe
  C:\Windows\System\dmJJVlm.exe
  2⤵
  PID:7728
- C:\Windows\System\GMoFkhg.exe
  C:\Windows\System\GMoFkhg.exe
  2⤵
  PID:7764
- C:\Windows\System\iuWPpgk.exe
  C:\Windows\System\iuWPpgk.exe
  2⤵
  PID:7552
- C:\Windows\System\iGTOoRu.exe
  C:\Windows\System\iGTOoRu.exe
  2⤵
  PID:7828
- C:\Windows\System\gMokEDB.exe
  C:\Windows\System\gMokEDB.exe
  2⤵
  PID:7888
- C:\Windows\System\WEEPkMY.exe
  C:\Windows\System\WEEPkMY.exe
  2⤵
  PID:7712
- C:\Windows\System\oRMYKQL.exe
  C:\Windows\System\oRMYKQL.exe
  2⤵
  PID:7988
- C:\Windows\System\WNcAxwI.exe
  C:\Windows\System\WNcAxwI.exe
  2⤵
  PID:7616
- C:\Windows\System\VzXWWMT.exe
  C:\Windows\System\VzXWWMT.exe
  2⤵
  PID:7744
- C:\Windows\System\kKqLLRd.exe
  C:\Windows\System\kKqLLRd.exe
  2⤵
  PID:7808
- C:\Windows\System\cYcAixJ.exe
  C:\Windows\System\cYcAixJ.exe
  2⤵
  PID:8036
- C:\Windows\System\VRAIcUc.exe
  C:\Windows\System\VRAIcUc.exe
  2⤵
  PID:7876
- C:\Windows\System\XMzOrrg.exe
  C:\Windows\System\XMzOrrg.exe
  2⤵
  PID:7972
- C:\Windows\System\uqrRhew.exe
  C:\Windows\System\uqrRhew.exe
  2⤵
  PID:7968
- C:\Windows\System\nxdejJK.exe
  C:\Windows\System\nxdejJK.exe
  2⤵
  PID:8100
- C:\Windows\System\QnzQGnB.exe
  C:\Windows\System\QnzQGnB.exe
  2⤵
  PID:8128
- C:\Windows\System\FYGGJOj.exe
  C:\Windows\System\FYGGJOj.exe
  2⤵
  PID:8180
- C:\Windows\System\LZLyJbQ.exe
  C:\Windows\System\LZLyJbQ.exe
  2⤵
  PID:6708
- C:\Windows\System\LnkOrgA.exe
  C:\Windows\System\LnkOrgA.exe
  2⤵
  PID:8164
- C:\Windows\System\FIIKsAM.exe
  C:\Windows\System\FIIKsAM.exe
  2⤵
  PID:7268
- C:\Windows\System\kalZAjT.exe
  C:\Windows\System\kalZAjT.exe
  2⤵
  PID:7212
- C:\Windows\System\YHCJWKp.exe
  C:\Windows\System\YHCJWKp.exe
  2⤵
  PID:7336
- C:\Windows\System\kVYzNrF.exe
  C:\Windows\System\kVYzNrF.exe
  2⤵
  PID:7420
- C:\Windows\System\vdGNcWL.exe
  C:\Windows\System\vdGNcWL.exe
  2⤵
  PID:7568
- C:\Windows\System\WkssHmv.exe
  C:\Windows\System\WkssHmv.exe
  2⤵
  PID:7696
- C:\Windows\System\qyBVEGt.exe
  C:\Windows\System\qyBVEGt.exe
  2⤵
  PID:7516
- C:\Windows\System\tYsBDCm.exe
  C:\Windows\System\tYsBDCm.exe
  2⤵
  PID:7472
- C:\Windows\System\HiOhdLB.exe
  C:\Windows\System\HiOhdLB.exe
  2⤵
  PID:7548
- C:\Windows\System\QyHLeUM.exe
  C:\Windows\System\QyHLeUM.exe
  2⤵
  PID:7956
- C:\Windows\System\fzWEjlS.exe
  C:\Windows\System\fzWEjlS.exe
  2⤵
  PID:7908
- C:\Windows\System\sHZTdBM.exe
  C:\Windows\System\sHZTdBM.exe
  2⤵
  PID:7708
- C:\Windows\System\DoxOgmZ.exe
  C:\Windows\System\DoxOgmZ.exe
  2⤵
  PID:8032
- C:\Windows\System\mQVkQKD.exe
  C:\Windows\System\mQVkQKD.exe
  2⤵
  PID:8020
- C:\Windows\System\ynMkErb.exe
  C:\Windows\System\ynMkErb.exe
  2⤵
  PID:7760
- C:\Windows\System\ULbRwsd.exe
  C:\Windows\System\ULbRwsd.exe
  2⤵
  PID:7840
- C:\Windows\System\geoftLD.exe
  C:\Windows\System\geoftLD.exe
  2⤵
  PID:7264
- C:\Windows\System\uBsTwRG.exe
  C:\Windows\System\uBsTwRG.exe
  2⤵
  PID:6592
- C:\Windows\System\xvrFAuY.exe
  C:\Windows\System\xvrFAuY.exe
  2⤵
  PID:7456
- C:\Windows\System\LutOxml.exe
  C:\Windows\System\LutOxml.exe
  2⤵
  PID:7648
- C:\Windows\System\QqWVKlz.exe
  C:\Windows\System\QqWVKlz.exe
  2⤵
  PID:7812
- C:\Windows\System\mHuZcIy.exe
  C:\Windows\System\mHuZcIy.exe
  2⤵
  PID:8080
- C:\Windows\System\iyPFvmw.exe
  C:\Windows\System\iyPFvmw.exe
  2⤵
  PID:7920
- C:\Windows\System\RjpdIKY.exe
  C:\Windows\System\RjpdIKY.exe
  2⤵
  PID:7660
- C:\Windows\System\BxznFwH.exe
  C:\Windows\System\BxznFwH.exe
  2⤵
  PID:7192
- C:\Windows\System\JzNBnuU.exe
  C:\Windows\System\JzNBnuU.exe
  2⤵
  PID:7320
- C:\Windows\System\fhoLFXT.exe
  C:\Windows\System\fhoLFXT.exe
  2⤵
  PID:8064
- C:\Windows\System\GAhUNmG.exe
  C:\Windows\System\GAhUNmG.exe
  2⤵
  PID:7796
- C:\Windows\System\VwrtHNo.exe
  C:\Windows\System\VwrtHNo.exe
  2⤵
  PID:7632
- C:\Windows\System\CvYikbD.exe
  C:\Windows\System\CvYikbD.exe
  2⤵
  PID:7388
- C:\Windows\System\rLijxwo.exe
  C:\Windows\System\rLijxwo.exe
  2⤵
  PID:8004
- C:\Windows\System\Tabewhi.exe
  C:\Windows\System\Tabewhi.exe
  2⤵
  PID:7504
- C:\Windows\System\CnOGNMV.exe
  C:\Windows\System\CnOGNMV.exe
  2⤵
  PID:8196
- C:\Windows\System\etuklqU.exe
  C:\Windows\System\etuklqU.exe
  2⤵
  PID:8212
- C:\Windows\System\xnzxFvF.exe
  C:\Windows\System\xnzxFvF.exe
  2⤵
  PID:8228
- C:\Windows\System\RbpeKit.exe
  C:\Windows\System\RbpeKit.exe
  2⤵
  PID:8244
- C:\Windows\System\YysAGmQ.exe
  C:\Windows\System\YysAGmQ.exe
  2⤵
  PID:8260
- C:\Windows\System\WhCUADL.exe
  C:\Windows\System\WhCUADL.exe
  2⤵
  PID:8276
- C:\Windows\System\utlVTpd.exe
  C:\Windows\System\utlVTpd.exe
  2⤵
  PID:8292
- C:\Windows\System\aKYycZq.exe
  C:\Windows\System\aKYycZq.exe
  2⤵
  PID:8308
- C:\Windows\System\UkWVjgM.exe
  C:\Windows\System\UkWVjgM.exe
  2⤵
  PID:8328
- C:\Windows\System\DGqAgAL.exe
  C:\Windows\System\DGqAgAL.exe
  2⤵
  PID:8344
- C:\Windows\System\ykYhAYN.exe
  C:\Windows\System\ykYhAYN.exe
  2⤵
  PID:8360
- C:\Windows\System\AxAoVMl.exe
  C:\Windows\System\AxAoVMl.exe
  2⤵
  PID:8376
- C:\Windows\System\zloGIHh.exe
  C:\Windows\System\zloGIHh.exe
  2⤵
  PID:8392
- C:\Windows\System\IBJxQYL.exe
  C:\Windows\System\IBJxQYL.exe
  2⤵
  PID:8412
- C:\Windows\System\dbfSkNW.exe
  C:\Windows\System\dbfSkNW.exe
  2⤵
  PID:8432
- C:\Windows\System\BzzkWJC.exe
  C:\Windows\System\BzzkWJC.exe
  2⤵
  PID:8456
- C:\Windows\System\zKErHMJ.exe
  C:\Windows\System\zKErHMJ.exe
  2⤵
  PID:8472
- C:\Windows\System\NsFHOPW.exe
  C:\Windows\System\NsFHOPW.exe
  2⤵
  PID:8488
- C:\Windows\System\LfhOJKj.exe
  C:\Windows\System\LfhOJKj.exe
  2⤵
  PID:8508
- C:\Windows\System\gdBZdRD.exe
  C:\Windows\System\gdBZdRD.exe
  2⤵
  PID:8524
- C:\Windows\System\acEyQqT.exe
  C:\Windows\System\acEyQqT.exe
  2⤵
  PID:8544
- C:\Windows\System\ufNTgal.exe
  C:\Windows\System\ufNTgal.exe
  2⤵
  PID:8564
- C:\Windows\System\mrFnvyl.exe
  C:\Windows\System\mrFnvyl.exe
  2⤵
  PID:8584
- C:\Windows\System\IxcvcZh.exe
  C:\Windows\System\IxcvcZh.exe
  2⤵
  PID:8604
- C:\Windows\System\HSLEFrs.exe
  C:\Windows\System\HSLEFrs.exe
  2⤵
  PID:8620
- C:\Windows\System\WpFFIbz.exe
  C:\Windows\System\WpFFIbz.exe
  2⤵
  PID:8636
- C:\Windows\System\jznyHSl.exe
  C:\Windows\System\jznyHSl.exe
  2⤵
  PID:8652
- C:\Windows\System\PEuqSnc.exe
  C:\Windows\System\PEuqSnc.exe
  2⤵
  PID:8672
- C:\Windows\System\obMjGTx.exe
  C:\Windows\System\obMjGTx.exe
  2⤵
  PID:8692
- C:\Windows\System\NOrQuHt.exe
  C:\Windows\System\NOrQuHt.exe
  2⤵
  PID:8712
- C:\Windows\System\YttiUfI.exe
  C:\Windows\System\YttiUfI.exe
  2⤵
  PID:8728
- C:\Windows\System\pfWSPuc.exe
  C:\Windows\System\pfWSPuc.exe
  2⤵
  PID:8744
- C:\Windows\System\AnSGyFZ.exe
  C:\Windows\System\AnSGyFZ.exe
  2⤵
  PID:8760
- C:\Windows\System\oRdBqdj.exe
  C:\Windows\System\oRdBqdj.exe
  2⤵
  PID:8776
- C:\Windows\System\oCWSuGn.exe
  C:\Windows\System\oCWSuGn.exe
  2⤵
  PID:8792
- C:\Windows\System\WuXTizf.exe
  C:\Windows\System\WuXTizf.exe
  2⤵
  PID:8812
- C:\Windows\System\EKjQqBs.exe
  C:\Windows\System\EKjQqBs.exe
  2⤵
  PID:8828
- C:\Windows\System\SUkowkb.exe
  C:\Windows\System\SUkowkb.exe
  2⤵
  PID:8844
- C:\Windows\System\OjlvCxp.exe
  C:\Windows\System\OjlvCxp.exe
  2⤵
  PID:8860
- C:\Windows\System\rEIwqaG.exe
  C:\Windows\System\rEIwqaG.exe
  2⤵
  PID:8900
- C:\Windows\System\xBDGezL.exe
  C:\Windows\System\xBDGezL.exe
  2⤵
  PID:8924
- C:\Windows\System\wAAVgYX.exe
  C:\Windows\System\wAAVgYX.exe
  2⤵
  PID:8940
- C:\Windows\System\neLFbSw.exe
  C:\Windows\System\neLFbSw.exe
  2⤵
  PID:8956
- C:\Windows\System\xebiGFf.exe
  C:\Windows\System\xebiGFf.exe
  2⤵
  PID:8972
- C:\Windows\System\SbpjkbE.exe
  C:\Windows\System\SbpjkbE.exe
  2⤵
  PID:9008
- C:\Windows\System\mNRiIjg.exe
  C:\Windows\System\mNRiIjg.exe
  2⤵
  PID:9024
- C:\Windows\System\EOJAMsb.exe
  C:\Windows\System\EOJAMsb.exe
  2⤵
  PID:9068
- C:\Windows\System\lPQEzwl.exe
  C:\Windows\System\lPQEzwl.exe
  2⤵
  PID:9152
- C:\Windows\System\bNOEkag.exe
  C:\Windows\System\bNOEkag.exe
  2⤵
  PID:9168
- C:\Windows\System\rBozvLr.exe
  C:\Windows\System\rBozvLr.exe
  2⤵
  PID:9184
- C:\Windows\System\BbXRSBz.exe
  C:\Windows\System\BbXRSBz.exe
  2⤵
  PID:9200
- C:\Windows\System\VynrMTY.exe
  C:\Windows\System\VynrMTY.exe
  2⤵
  PID:7680
- C:\Windows\System\dLiDATM.exe
  C:\Windows\System\dLiDATM.exe
  2⤵
  PID:8236
- C:\Windows\System\GbirJnm.exe
  C:\Windows\System\GbirJnm.exe
  2⤵
  PID:8268
- C:\Windows\System\JZJTBWX.exe
  C:\Windows\System\JZJTBWX.exe
  2⤵
  PID:7780
- C:\Windows\System\BmwSTVz.exe
  C:\Windows\System\BmwSTVz.exe
  2⤵
  PID:8284
- C:\Windows\System\sIlZAGu.exe
  C:\Windows\System\sIlZAGu.exe
  2⤵
  PID:8336
- C:\Windows\System\WjLHril.exe
  C:\Windows\System\WjLHril.exe
  2⤵
  PID:8440
- C:\Windows\System\aBdqhmN.exe
  C:\Windows\System\aBdqhmN.exe
  2⤵
  PID:8388
- C:\Windows\System\rsVbmDs.exe
  C:\Windows\System\rsVbmDs.exe
  2⤵
  PID:8468
- C:\Windows\System\ZkPJIaU.exe
  C:\Windows\System\ZkPJIaU.exe
  2⤵
  PID:8504
- C:\Windows\System\njkxfLa.exe
  C:\Windows\System\njkxfLa.exe
  2⤵
  PID:8520
- C:\Windows\System\XjlPEIu.exe
  C:\Windows\System\XjlPEIu.exe
  2⤵
  PID:8592
- C:\Windows\System\PNROOqz.exe
  C:\Windows\System\PNROOqz.exe
  2⤵
  PID:8612
- C:\Windows\System\sSmObDx.exe
  C:\Windows\System\sSmObDx.exe
  2⤵
  PID:8632
- C:\Windows\System\uhwpUqb.exe
  C:\Windows\System\uhwpUqb.exe
  2⤵
  PID:8664
- C:\Windows\System\EyWjKhn.exe
  C:\Windows\System\EyWjKhn.exe
  2⤵
  PID:8668
- C:\Windows\System\CQJeDGe.exe
  C:\Windows\System\CQJeDGe.exe
  2⤵
  PID:8784
- C:\Windows\System\TloeydH.exe
  C:\Windows\System\TloeydH.exe
  2⤵
  PID:8824
- C:\Windows\System\NBwFQui.exe
  C:\Windows\System\NBwFQui.exe
  2⤵
  PID:8708
- C:\Windows\System\rEgRGDC.exe
  C:\Windows\System\rEgRGDC.exe
  2⤵
  PID:8840
- C:\Windows\System\POXmpbq.exe
  C:\Windows\System\POXmpbq.exe
  2⤵
  PID:8892
- C:\Windows\System\qBLXSfT.exe
  C:\Windows\System\qBLXSfT.exe
  2⤵
  PID:8980
- C:\Windows\System\FjfVEfw.exe
  C:\Windows\System\FjfVEfw.exe
  2⤵
  PID:9048
- C:\Windows\System\TGqtfHc.exe
  C:\Windows\System\TGqtfHc.exe
  2⤵
  PID:8964
- C:\Windows\System\vmJlkgN.exe
  C:\Windows\System\vmJlkgN.exe
  2⤵
  PID:9044
- C:\Windows\System\hZqoQiT.exe
  C:\Windows\System\hZqoQiT.exe
  2⤵
  PID:9084
- C:\Windows\System\kjwgCIl.exe
  C:\Windows\System\kjwgCIl.exe
  2⤵
  PID:9100
- C:\Windows\System\WSSnoao.exe
  C:\Windows\System\WSSnoao.exe
  2⤵
  PID:9120
- C:\Windows\System\YKAiIVX.exe
  C:\Windows\System\YKAiIVX.exe
  2⤵
  PID:9128
- C:\Windows\System\xEgwivd.exe
  C:\Windows\System\xEgwivd.exe
  2⤵
  PID:9148
- C:\Windows\System\eNUzznS.exe
  C:\Windows\System\eNUzznS.exe
  2⤵
  PID:9176
- C:\Windows\System\broPbYa.exe
  C:\Windows\System\broPbYa.exe
  2⤵
  PID:8208
- C:\Windows\System\RYpGXuk.exe
  C:\Windows\System\RYpGXuk.exe
  2⤵
  PID:8300
- C:\Windows\System\RXUnFYK.exe
  C:\Windows\System\RXUnFYK.exe
  2⤵
  PID:8408
- C:\Windows\System\lGikFqX.exe
  C:\Windows\System\lGikFqX.exe
  2⤵
  PID:9208
- C:\Windows\System\KQHeyBc.exe
  C:\Windows\System\KQHeyBc.exe
  2⤵
  PID:8500
- C:\Windows\System\lsoNYhX.exe
  C:\Windows\System\lsoNYhX.exe
  2⤵
  PID:8256
- C:\Windows\System\LjABasD.exe
  C:\Windows\System\LjABasD.exe
  2⤵
  PID:8096
- C:\Windows\System\NEDmqjJ.exe
  C:\Windows\System\NEDmqjJ.exe
  2⤵
  PID:8424
- C:\Windows\System\olsIKkA.exe
  C:\Windows\System\olsIKkA.exe
  2⤵
  PID:8404
- C:\Windows\System\duirFab.exe
  C:\Windows\System\duirFab.exe
  2⤵
  PID:8452
- C:\Windows\System\YcDkYFM.exe
  C:\Windows\System\YcDkYFM.exe
  2⤵
  PID:8616
- C:\Windows\System\fJWaTJo.exe
  C:\Windows\System\fJWaTJo.exe
  2⤵
  PID:8720
- C:\Windows\System\rINymkV.exe
  C:\Windows\System\rINymkV.exe
  2⤵
  PID:8752
- C:\Windows\System\hARdErX.exe
  C:\Windows\System\hARdErX.exe
  2⤵
  PID:8740
- C:\Windows\System\kGIGUsT.exe
  C:\Windows\System\kGIGUsT.exe
  2⤵
  PID:8800
- C:\Windows\System\MmKDuSO.exe
  C:\Windows\System\MmKDuSO.exe
  2⤵
  PID:8772
- C:\Windows\System\rhqhwJF.exe
  C:\Windows\System\rhqhwJF.exe
  2⤵
  PID:8908
- C:\Windows\System\WyknXXC.exe
  C:\Windows\System\WyknXXC.exe
  2⤵
  PID:8948
- C:\Windows\System\dMwFqbA.exe
  C:\Windows\System\dMwFqbA.exe
  2⤵
  PID:9000
- C:\Windows\System\fUSpkHj.exe
  C:\Windows\System\fUSpkHj.exe
  2⤵
  PID:9016
- C:\Windows\System\ULHJYCG.exe
  C:\Windows\System\ULHJYCG.exe
  2⤵
  PID:9116
- C:\Windows\System\sMtOcSh.exe
  C:\Windows\System\sMtOcSh.exe
  2⤵
  PID:9164
- C:\Windows\System\AjbWrUm.exe
  C:\Windows\System\AjbWrUm.exe
  2⤵
  PID:8384
- C:\Windows\System\mrJULzB.exe
  C:\Windows\System\mrJULzB.exe
  2⤵
  PID:9104
- C:\Windows\System\NKtEdZF.exe
  C:\Windows\System\NKtEdZF.exe
  2⤵
  PID:8480
- C:\Windows\System\tYPxbTD.exe
  C:\Windows\System\tYPxbTD.exe
  2⤵
  PID:9140
- C:\Windows\System\tgqyVHK.exe
  C:\Windows\System\tgqyVHK.exe
  2⤵
  PID:8324
- C:\Windows\System\PpjQxGz.exe
  C:\Windows\System\PpjQxGz.exe
  2⤵
  PID:8736
- C:\Windows\System\nQxhvJI.exe
  C:\Windows\System\nQxhvJI.exe
  2⤵
  PID:7324
- C:\Windows\System\SkWhMoD.exe
  C:\Windows\System\SkWhMoD.exe
  2⤵
  PID:8484
- C:\Windows\System\cDPqLWz.exe
  C:\Windows\System\cDPqLWz.exe
  2⤵
  PID:8992
- C:\Windows\System\LLNIQve.exe
  C:\Windows\System\LLNIQve.exe
  2⤵
  PID:9036
- C:\Windows\System\ZLAcRIZ.exe
  C:\Windows\System\ZLAcRIZ.exe
  2⤵
  PID:8932
- C:\Windows\System\FFAhxBD.exe
  C:\Windows\System\FFAhxBD.exe
  2⤵
  PID:8952
- C:\Windows\System\yJiyQQg.exe
  C:\Windows\System\yJiyQQg.exe
  2⤵
  PID:8996
- C:\Windows\System\MBkkyPC.exe
  C:\Windows\System\MBkkyPC.exe
  2⤵
  PID:8920
- C:\Windows\System\mfmlCDH.exe
  C:\Windows\System\mfmlCDH.exe
  2⤵
  PID:8552
- C:\Windows\System\lhWBXus.exe
  C:\Windows\System\lhWBXus.exe
  2⤵
  PID:8884
- C:\Windows\System\lumEPiD.exe
  C:\Windows\System\lumEPiD.exe
  2⤵
  PID:8788
- C:\Windows\System\nQtvQCg.exe
  C:\Windows\System\nQtvQCg.exe
  2⤵
  PID:9232
- C:\Windows\System\VJKsHQZ.exe
  C:\Windows\System\VJKsHQZ.exe
  2⤵
  PID:9248
- C:\Windows\System\KQMKDJY.exe
  C:\Windows\System\KQMKDJY.exe
  2⤵
  PID:9264
- C:\Windows\System\FGUIXOq.exe
  C:\Windows\System\FGUIXOq.exe
  2⤵
  PID:9280
- C:\Windows\System\lbqxVbR.exe
  C:\Windows\System\lbqxVbR.exe
  2⤵
  PID:9296
- C:\Windows\System\RyOvOtx.exe
  C:\Windows\System\RyOvOtx.exe
  2⤵
  PID:9312
- C:\Windows\System\NYBUebL.exe
  C:\Windows\System\NYBUebL.exe
  2⤵
  PID:9328
- C:\Windows\System\zBUuBid.exe
  C:\Windows\System\zBUuBid.exe
  2⤵
  PID:9344
- C:\Windows\System\qCTwgIo.exe
  C:\Windows\System\qCTwgIo.exe
  2⤵
  PID:9360
- C:\Windows\System\bKAvgGk.exe
  C:\Windows\System\bKAvgGk.exe
  2⤵
  PID:9376
- C:\Windows\System\EcvGcvH.exe
  C:\Windows\System\EcvGcvH.exe
  2⤵
  PID:9392
- C:\Windows\System\OCKawrw.exe
  C:\Windows\System\OCKawrw.exe
  2⤵
  PID:9408
- C:\Windows\System\VwnZAZI.exe
  C:\Windows\System\VwnZAZI.exe
  2⤵
  PID:9424
- C:\Windows\System\tdWhuSb.exe
  C:\Windows\System\tdWhuSb.exe
  2⤵
  PID:9440
- C:\Windows\System\oeykDgw.exe
  C:\Windows\System\oeykDgw.exe
  2⤵
  PID:9456
- C:\Windows\System\fYqilim.exe
  C:\Windows\System\fYqilim.exe
  2⤵
  PID:9476
- C:\Windows\System\hYwTuuK.exe
  C:\Windows\System\hYwTuuK.exe
  2⤵
  PID:9492
- C:\Windows\System\ghAPgmi.exe
  C:\Windows\System\ghAPgmi.exe
  2⤵
  PID:9508
- C:\Windows\System\PdBOCUe.exe
  C:\Windows\System\PdBOCUe.exe
  2⤵
  PID:9524
- C:\Windows\System\IrloKIM.exe
  C:\Windows\System\IrloKIM.exe
  2⤵
  PID:9540
- C:\Windows\System\qlVEsBU.exe
  C:\Windows\System\qlVEsBU.exe
  2⤵
  PID:9556
- C:\Windows\System\MgXQPtz.exe
  C:\Windows\System\MgXQPtz.exe
  2⤵
  PID:9572
- C:\Windows\System\jVTGwZe.exe
  C:\Windows\System\jVTGwZe.exe
  2⤵
  PID:9588
- C:\Windows\System\RhfVNUm.exe
  C:\Windows\System\RhfVNUm.exe
  2⤵
  PID:9604
- C:\Windows\System\iPbyEpo.exe
  C:\Windows\System\iPbyEpo.exe
  2⤵
  PID:9620
- C:\Windows\System\rEjrHoj.exe
  C:\Windows\System\rEjrHoj.exe
  2⤵
  PID:9636
- C:\Windows\System\kbffIZF.exe
  C:\Windows\System\kbffIZF.exe
  2⤵
  PID:9652
- C:\Windows\System\jckFAYH.exe
  C:\Windows\System\jckFAYH.exe
  2⤵
  PID:9668
- C:\Windows\System\ZIViGjG.exe
  C:\Windows\System\ZIViGjG.exe
  2⤵
  PID:9684
- C:\Windows\System\wfvSBst.exe
  C:\Windows\System\wfvSBst.exe
  2⤵
  PID:9700
- C:\Windows\System\ssKBJcv.exe
  C:\Windows\System\ssKBJcv.exe
  2⤵
  PID:9716
- C:\Windows\System\JuUhvyA.exe
  C:\Windows\System\JuUhvyA.exe
  2⤵
  PID:9732
- C:\Windows\System\knNBiKW.exe
  C:\Windows\System\knNBiKW.exe
  2⤵
  PID:9748
- C:\Windows\System\MkZFziR.exe
  C:\Windows\System\MkZFziR.exe
  2⤵
  PID:9764
- C:\Windows\System\pTkYjbv.exe
  C:\Windows\System\pTkYjbv.exe
  2⤵
  PID:9780
- C:\Windows\System\rrugcTh.exe
  C:\Windows\System\rrugcTh.exe
  2⤵
  PID:9796
- C:\Windows\System\uOoHnRg.exe
  C:\Windows\System\uOoHnRg.exe
  2⤵
  PID:9812
- C:\Windows\System\YLIWZVC.exe
  C:\Windows\System\YLIWZVC.exe
  2⤵
  PID:9828
- C:\Windows\System\SqUuqTM.exe
  C:\Windows\System\SqUuqTM.exe
  2⤵
  PID:9844
- C:\Windows\System\ytoTtcC.exe
  C:\Windows\System\ytoTtcC.exe
  2⤵
  PID:9860
- C:\Windows\System\XPHHjCr.exe
  C:\Windows\System\XPHHjCr.exe
  2⤵
  PID:9876
- C:\Windows\System\dhgSPvM.exe
  C:\Windows\System\dhgSPvM.exe
  2⤵
  PID:9900
- C:\Windows\System\AFojXdm.exe
  C:\Windows\System\AFojXdm.exe
  2⤵
  PID:9916
- C:\Windows\System\ifegnQb.exe
  C:\Windows\System\ifegnQb.exe
  2⤵
  PID:9932
- C:\Windows\System\ODvpkXo.exe
  C:\Windows\System\ODvpkXo.exe
  2⤵
  PID:9948
- C:\Windows\System\HKAmIrc.exe
  C:\Windows\System\HKAmIrc.exe
  2⤵
  PID:9968
- C:\Windows\System\hRiVCZC.exe
  C:\Windows\System\hRiVCZC.exe
  2⤵
  PID:9984
- C:\Windows\System\VUyPUqa.exe
  C:\Windows\System\VUyPUqa.exe
  2⤵
  PID:10000
- C:\Windows\System\ZyTyDUl.exe
  C:\Windows\System\ZyTyDUl.exe
  2⤵
  PID:10016
- C:\Windows\System\YIXlsno.exe
  C:\Windows\System\YIXlsno.exe
  2⤵
  PID:10032
- C:\Windows\System\ddukbKo.exe
  C:\Windows\System\ddukbKo.exe
  2⤵
  PID:10048
- C:\Windows\System\XafUMfy.exe
  C:\Windows\System\XafUMfy.exe
  2⤵
  PID:10064
- C:\Windows\System\GIfGdBZ.exe
  C:\Windows\System\GIfGdBZ.exe
  2⤵
  PID:10080
- C:\Windows\System\sFcXPsB.exe
  C:\Windows\System\sFcXPsB.exe
  2⤵
  PID:10096
- C:\Windows\System\OWdtXjw.exe
  C:\Windows\System\OWdtXjw.exe
  2⤵
  PID:10120
- C:\Windows\System\nAvHRwC.exe
  C:\Windows\System\nAvHRwC.exe
  2⤵
  PID:10136
- C:\Windows\System\LyukTPc.exe
  C:\Windows\System\LyukTPc.exe
  2⤵
  PID:10152
- C:\Windows\System\IlpMKyt.exe
  C:\Windows\System\IlpMKyt.exe
  2⤵
  PID:10168
- C:\Windows\System\jXsWHVC.exe
  C:\Windows\System\jXsWHVC.exe
  2⤵
  PID:10184
- C:\Windows\System\OojIJEm.exe
  C:\Windows\System\OojIJEm.exe
  2⤵
  PID:10200
- C:\Windows\System\bXASTdn.exe
  C:\Windows\System\bXASTdn.exe
  2⤵
  PID:9224
- C:\Windows\System\VcFLzBA.exe
  C:\Windows\System\VcFLzBA.exe
  2⤵
  PID:9288
- C:\Windows\System\tOuWSvc.exe
  C:\Windows\System\tOuWSvc.exe
  2⤵
  PID:7248
- C:\Windows\System\PbVqeuj.exe
  C:\Windows\System\PbVqeuj.exe
  2⤵
  PID:8240
- C:\Windows\System\UCAhPgy.exe
  C:\Windows\System\UCAhPgy.exe
  2⤵
  PID:9304
- C:\Windows\System\LXvnjtA.exe
  C:\Windows\System\LXvnjtA.exe
  2⤵
  PID:9244
- C:\Windows\System\yyZevAI.exe
  C:\Windows\System\yyZevAI.exe
  2⤵
  PID:8536
- C:\Windows\System\MhBlzhj.exe
  C:\Windows\System\MhBlzhj.exe
  2⤵
  PID:9020
- C:\Windows\System\iSrdPdZ.exe
  C:\Windows\System\iSrdPdZ.exe
  2⤵
  PID:9240
- C:\Windows\System\QwSndEM.exe
  C:\Windows\System\QwSndEM.exe
  2⤵
  PID:9340
- C:\Windows\System\stEcLHR.exe
  C:\Windows\System\stEcLHR.exe
  2⤵
  PID:9372
- C:\Windows\System\AuabSXC.exe
  C:\Windows\System\AuabSXC.exe
  2⤵
  PID:9484
- C:\Windows\System\xAatKal.exe
  C:\Windows\System\xAatKal.exe
  2⤵
  PID:9432
- C:\Windows\System\mzgBgpv.exe
  C:\Windows\System\mzgBgpv.exe
  2⤵
  PID:9516
- C:\Windows\System\UqArkWp.exe
  C:\Windows\System\UqArkWp.exe
  2⤵
  PID:9552
- C:\Windows\System\hLQcsbk.exe
  C:\Windows\System\hLQcsbk.exe
  2⤵
  PID:9580
- C:\Windows\System\yPBCUyg.exe
  C:\Windows\System\yPBCUyg.exe
  2⤵
  PID:2544
- C:\Windows\System\peGRIWh.exe
  C:\Windows\System\peGRIWh.exe
  2⤵
  PID:9744
- C:\Windows\System\dsZxaEQ.exe
  C:\Windows\System\dsZxaEQ.exe
  2⤵
  PID:9692
- C:\Windows\System\gPwJQXO.exe
  C:\Windows\System\gPwJQXO.exe
  2⤵
  PID:9776
- C:\Windows\System\Wqisyzg.exe
  C:\Windows\System\Wqisyzg.exe
  2⤵
  PID:9804
- C:\Windows\System\wQjniUH.exe
  C:\Windows\System\wQjniUH.exe
  2⤵
  PID:9872
- C:\Windows\System\UXrTIpL.exe
  C:\Windows\System\UXrTIpL.exe
  2⤵
  PID:9940
- C:\Windows\System\WRUaGtE.exe
  C:\Windows\System\WRUaGtE.exe
  2⤵
  PID:10008
- C:\Windows\System\ONtMCnP.exe
  C:\Windows\System\ONtMCnP.exe
  2⤵
  PID:10072
- C:\Windows\System\kJXBCEP.exe
  C:\Windows\System\kJXBCEP.exe
  2⤵
  PID:10112
- C:\Windows\System\hKGduXU.exe
  C:\Windows\System\hKGduXU.exe
  2⤵
  PID:9960
- C:\Windows\System\OeEbjqP.exe
  C:\Windows\System\OeEbjqP.exe
  2⤵
  PID:9824
- C:\Windows\System\KfKDYCJ.exe
  C:\Windows\System\KfKDYCJ.exe
  2⤵
  PID:9888
- C:\Windows\System\aCeQdgH.exe
  C:\Windows\System\aCeQdgH.exe
  2⤵
  PID:9992
- C:\Windows\System\Vsbptdn.exe
  C:\Windows\System\Vsbptdn.exe
  2⤵
  PID:10128
- C:\Windows\System\iOiiYkW.exe
  C:\Windows\System\iOiiYkW.exe
  2⤵
  PID:10208
- C:\Windows\System\bJTQKxC.exe
  C:\Windows\System\bJTQKxC.exe
  2⤵
  PID:10164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FErhOem.exe

Filesize
2.1MB

MD5
bc7820c0232988e1017bc43619fc1c62

SHA1
100f7aed5bd8fb39a6cccbec2bcfef75cca8b02e

SHA256
8a4a3f67ca50e6224ea3797dd76b778e5cb1045ffe0aea9f8f89d003588bd324

SHA512
80381b0de729fbc8bdffb48ccd6d05e7381f14149fc746949c7c4d83492969f1e6e79c7726efbef89a4868864302da56e5311ad82b0e5f9f5f32164a7f29d0ed

Download Submit
C:\Windows\system\LeGwTJW.exe

Filesize
2.1MB

MD5
0956c181c64191e8a96bbf0b716bca4e

SHA1
77fa27b5c785bca639d17c6138cadfb5d6ebdb24

SHA256
1b6978a04a4ca723b7853100b0d273aa9268f919f6ace9afcd895948d5f58d2e

SHA512
b775501455bda4dbeae80aa11fb0229fb21fc51a92e91b96ae2df887597b4a8089de47f7818f457cabc1382e41f03b1490014259e08bbd318289c9e44a49db5a

Download Submit
C:\Windows\system\NwlyKVy.exe

Filesize
2.1MB

MD5
1193c87a78d92d6f2e8a8fb7923323e8

SHA1
dc65a0980363fd0f5563ccab7813ac301b1ffe7f

SHA256
4badd32ba1c19cf36f4da5084c23aff637c78f5444767bf86cd890a5c572a6e8

SHA512
a2be1b96b4769eb54de29092341c940caa061312c4f2c7eff1462efd0dccd0987cf50089d71e070deb2828157278de7893b6f0cf90438a155e1f003ce612276b

Download Submit
C:\Windows\system\ONAJVne.exe

Filesize
2.1MB

MD5
b2095e7c962469347ff49895a52e5f37

SHA1
2c34272200e0e8ca19b1e5d34002c0a3dfa4d62a

SHA256
3756de70050ad012f8bfc13983c81471a165be63f01337af44ae4ca71d06c70d

SHA512
4c500294f643efa4fcf7d0f59493bcd3ed605e2c9e0f0e5e59de030d0023c4ea013a976e0f4fce7ce00b7f54f52b357072caf91e83a27bcbd9ffb8ba54a6a376

Download Submit
C:\Windows\system\OhvAAml.exe

Filesize
2.1MB

MD5
409234b164a48d3807e5cf15603891a7

SHA1
05a9c0ee8a6657707f9cd5a91d7f9c9c924ffefd

SHA256
c4c67a96c82656fd8ba17d439f65bcd6b2476335afa8250e250b69b9c0865ec9

SHA512
825227f06a3ba2ade5bc0a92f62bf4dd5e2e47a29dd99c38ebcfbcd5ec55c9480cbbc8ec5be363472fae3450973f120e95a5f84cd8d8dd7eb2bd38019aad84ef

Download Submit
C:\Windows\system\PKeCQNa.exe

Filesize
2.1MB

MD5
05f944cbd30f8e39e2ea5c44e44439a8

SHA1
3afa56dc11d2865348c31856610f23f97849f3bb

SHA256
9a9d849920af8c871e2f5e4a158ce9ae5d8ce149ca0b15296eb5846e36e6f952

SHA512
5d47e8bb8aa5accb59cbaf7ebb53796c0a4bb6200de24aa92f5443bb6457cc4bc5a719a44ac89b1426e39bf2c2f45198bb8d474345848d39c86a6aeb8f543b98

Download Submit
C:\Windows\system\PNCngVe.exe

Filesize
2.1MB

MD5
aba9a8d2404bcd5fb5f0f0b2621f81ff

SHA1
e56a0370f9e36efcdf88efc65b0c4f6a2e278de8

SHA256
85093ea04b2c14e1393c420bccff885ce8c7e9e5ec394a9a6776bc6e31f05cb7

SHA512
8ff6103e733977d972d079ec7e5e8e2352c907c087567d847afb7c5573dda41ebd83d270a284b4869c838dc3c313cd452dd7c168c46d0c16372af939cc5110da

Download Submit
C:\Windows\system\PPwPZhy.exe

Filesize
2.1MB

MD5
afb31ab59cb61f26dbd3f245f2034dbc

SHA1
18c704fd18faa975403393d4550c2d096aafb2f7

SHA256
e7f8bf25c875f17ffbb7b174ade78633a4d0c03bedddb21fb509b733a674cf52

SHA512
85cc17086aad10492bb9be5e684ddc503b162b4d49603230b0228aae7bfcbce9fb491a9cd64e3dc29fcab9f816cf36acb9b099af492fee3cd4df6423e0872a65

Download Submit
C:\Windows\system\PywAVDX.exe

Filesize
2.1MB

MD5
52b8af95c998a8295f978d19fd020811

SHA1
c6ead81b4174c57e25c41fe6ec8d599e8610b385

SHA256
de11bba970cb9b8ad3fcdba1b93b62087e8ff5d39f40b9d33b61315f3fa53ced

SHA512
f0acf78320bb1d2572edb2637ef92d2859134ade00cc2b1e10301b49205a8c534ddf230aba3f04993699f639e235c838a0d6f9e4bba410afeb71d541af31e316

Download Submit
C:\Windows\system\QLgALFh.exe

Filesize
2.1MB

MD5
b78382794804c55b794a8afa005489af

SHA1
e483681bb9ed81a6db06a7c8b56dffeb3d6f373d

SHA256
bba789306bb3c7dcb1cbba0f97619515b6fb0e88226a5e2e4f4233f4e3f15d94

SHA512
20d3893160b3cd52324c7a92aaa4b90a886729ccba7242e06483100f568ee6e8c8fb44909762975f416d62f013f09f42b04961ac41b5cacfd8ae18db4273d622

Download Submit
C:\Windows\system\RNJunJJ.exe

Filesize
2.1MB

MD5
c35569be207fd1f3a70cba1d47e82194

SHA1
00381ed7149c7ef46f4e18c8311203b3b96fa10c

SHA256
d9e02b1078e59c98a0a4e67368bcd180a597674e871d7468d38ecb621c56caef

SHA512
f1f0c7a5f2e1fa1b0da5ec08d4e29ea070c30e02f5c87baab9500b941842b9d4cb4b26a71b78e5ef10eddab15fbee58842195f537839a570f2bde9512e1674d6

Download Submit
C:\Windows\system\TTcYdii.exe

Filesize
2.1MB

MD5
446a8491bff8ab63b6ecddfd24fc1b7b

SHA1
23b5bbed7f861b348aa2c907e8922c06590a5092

SHA256
d17c43ca1621f6227d821a8e729db9db11865d15ca25c6b03fc7dc5f25eadd5a

SHA512
5ad74083babee818c18c8cec8c4178c2e141d22e8a30f28dfd1704232065fd06d7093ca0f27f0fbbf5a7530b6f0b29fb5b5a9c122c7b3f7521b64664afd7c153

Download Submit
C:\Windows\system\UFmrKaR.exe

Filesize
2.1MB

MD5
524edaae0df318dfc80e78aded1cfbab

SHA1
97f1bf03f6aeb0f4ef368e0a510101fd05c0ae95

SHA256
76de9078d1efc2924855f3782ca5c2a2bc2674378f456801fb4a81646b9de776

SHA512
b46244840fb83ab1d405dd82ca95127e5140e26e5cf87239ec93412761b2f506fe5c3f7d91cbac0a42d89ae296658613480b751ec5b1db54ee5f622c2755295d

Download Submit
C:\Windows\system\WLHdMaO.exe

Filesize
2.1MB

MD5
8ba383e3ccfcfc68cade8673e49b1ad7

SHA1
0b8651a4ee075ade07bd1298fc6d91bb25420a27

SHA256
1e50dec54dafcc56026b20ddb59994cf49e39e3ea0a4e6e200e2271cf4dc6f6c

SHA512
5d7d79c35aec821e9571a92388048dcfc2da7cb80fee7affe4c0b6122cd0f261660e04b78bd335270de38b9a7ed7f915bdd87d616df8293dbeb9542d79f45632

Download Submit
C:\Windows\system\WZMYTyr.exe

Filesize
2.1MB

MD5
aa3c1939894cd2b4b572d9b9cf2b6bd9

SHA1
d77dc3b60508216d71f9a9821d7852ff742e42d4

SHA256
db2783dbe4ac6b933910e0770431d568514517fca0e57388ff3696511a068147

SHA512
b0c187b60ea3ab54354f10131126193f40470b5e046cc1066f85cdb16ae3116d8f862fe55814018ea25186188cc26a7caf26edea20fda105b5737fbb394001f3

Download Submit
C:\Windows\system\YuQQcrD.exe

Filesize
2.1MB

MD5
89993e0fef23cab5ae716d9641ba5c0c

SHA1
78a444334bae5225921bb895a63d3a32bed25046

SHA256
5380a4b9a8cfca84ba8612de1b15cb604db8b37c822c101c2812d1c51583365c

SHA512
7fd7fdaa6e3ea8dd502613162c2360813f5f5c0670ccd14d3e184d626459d969ca1f2d8a92a411d5e7016c50f8d2836eb8f26763c848612cc67cf61c1776a0b5

Download Submit
C:\Windows\system\ZmPvLIb.exe

Filesize
2.1MB

MD5
4134c8263d64fcea95d285e569bedc49

SHA1
619b9b3e38da9bfd5bed86de2b42c36619605183

SHA256
019c01765590a578bf86784bb8bc8e6576e4e36bc54f01b491dd1a711d4850dd

SHA512
4732419076f0e9280c52f2fd0959a7d80827c1e6050e777864f99be1933d7d7a36784c0b038ae02df425bff3b55629ae5db6c020c651c2b60b112cfd30a77357

Download Submit
C:\Windows\system\dkfMsqb.exe

Filesize
2.1MB

MD5
3f856936078c9be481f1c13bbc0eebfa

SHA1
00566ddbd48dd2af8a120c7810d1c6de60899014

SHA256
11ff482d1eb46434229481f6bdfb0ff14e69e70d4e58b97737a6d39cd7f9baa7

SHA512
ab8ef5b6c7f7ebf8989ebba11261ea299c8442c1ff20c0990f0ca0e13e6f2d02338bed8c07cdd9bccdc6e87364446ade4ff38b70d502d1d4f7c2e0e9e54987e0

Download Submit
C:\Windows\system\ejDXiis.exe

Filesize
2.1MB

MD5
777b6408bb064f8579a3f98af01e74fb

SHA1
7cc43d9b271716beb9c520c09d254d4f92f699fb

SHA256
1ac247381d6de0aec2316cc17fbd9f5759bc572ca1dbbd6d3489f3cf319d7d07

SHA512
2d9032f8fcd0a4b0c2bf8351d168948a60aad810223b5661bde0b01e95aa5dc616a2910b2130cf2db70a7ada4d1a20bb84caa7fd95ed2b5a7980e040a893a294

Download Submit
C:\Windows\system\hhLLzgC.exe

Filesize
2.1MB

MD5
2419ed5bd95e8f647a792b89617c5416

SHA1
6e9ba5233dbb51db74482a58ab3d6479f9835266

SHA256
b25e0764a735abadc71fa02d3898b0353d44ce2d2256a24a736b22efaa2f3074

SHA512
07b1656d10b7953f8f9af4108be02a0206c38b4543a9d49d3b7f03048787641354571d205c66fe34b06bba1258e3eb1ebda07e9cb55a11b3aa4b4257cccddcdb

Download Submit
C:\Windows\system\jmrMdov.exe

Filesize
2.1MB

MD5
2899c54f3b24efd94178210c7b614b13

SHA1
686789a79e3612b08b5610e5967c57b90967cc78

SHA256
52168342c2567c37b1488db8367e479377d03574db196ab59056978fe7a3d9b0

SHA512
10fc4a5d44e79d06c41c623ae217420a71c850b98eec587747d634d22ae9837f8b1c6cca1a3983e36ddf9dbf087069d012891474042d53de3d4ec714328c433d

Download Submit
C:\Windows\system\jxXfQAP.exe

Filesize
2.1MB

MD5
33762646f8c7684b3a147c1f8dd784df

SHA1
9703182ac149b7398adf60e90ebc60206920d1cf

SHA256
442785e0dfbf410a64ac2ede7d4ab20ea06edcb99125df9b4ef98e228db1390f

SHA512
0d1c8ec6bf4e4c7cff1449adb1f0c176916dff2268cb7f86e632fed42209c918d023cb1a8258536479c7ba207798995c75bcbfc775f63d16a01c430a1741f3fd

Download Submit
C:\Windows\system\kDyGeHT.exe

Filesize
2.1MB

MD5
71a9160fb74c929dbee21027b39c9617

SHA1
a52fe3451c1693e9578fe4f5efc2075ad6d6aed8

SHA256
c6b8d0c6c418f8e5cf1590c2dd37746de9144145f104e56f14e3787efab88e28

SHA512
9be87b5f6a9b55a9e74d78af2c92a2da366a0bfeed617d35525b6d01174f3224b3ff3341dacf59b0c09b1d7a2b2ca8f971aeb3d487147bf51051e049ac425780

Download Submit
C:\Windows\system\lvmfFyv.exe

Filesize
2.1MB

MD5
e11076be4271dbfc4fcdfe9eb15d6337

SHA1
f242cd74454b93f999daceabd9b642d5ec06d9b4

SHA256
95f5fb07303298bb1a8fe2ed429b044efc4a1776afa5d4f25b29284079a117b4

SHA512
9336d136e2cfdeacf4c7070e4ad3dc9ebcdd98b60a10d23e29d1a5794704f7e5c4b8de4698f41b19863535f296aa4fe995e531e03eacd91987606bfba193d9ac

Download Submit
C:\Windows\system\qgBvaCF.exe

Filesize
2.1MB

MD5
25bcb833012a579b2b0e652993ef806b

SHA1
2a3b68ed83ce15b40a889df54fea8015abb50352

SHA256
a661e1c7f6372146a03d584b9c2ef10bc9adcb206c6e4fb1f5995e3e9ad3172d

SHA512
b3d4933bfd5e9ae0268ad2d43ad7ec3e720a2ef69ee1fc5670a5c8e5e34789fecf3fc7cd2574afd739d6acbff9188180503d470cab4c55d31cf03ebc8a75dcb2

Download Submit
C:\Windows\system\rBFIldv.exe

Filesize
2.1MB

MD5
8a3f16a39c740a28753153af3ab07465

SHA1
698c763fd51e587afcb50ac4ccd334f7b05637fc

SHA256
1a6b5f30527932d2734ca86014713edc3dbf96cd346a839c996f8a900b10000e

SHA512
aeb3b43a496ea3f7ee914a111c30503049b4b36317c995ee9076cc87cc250957f291c0c153bc48f71e844c9b986d967f7720fc8bd8e0c4f7cb3aadb0dea7c341

Download Submit
C:\Windows\system\tIMOcnO.exe

Filesize
2.1MB

MD5
56ad8efc70e6f052238c950e34b3dfd8

SHA1
b0ff3e3dae571d8316149423dee88307027e4428

SHA256
df69feb9616b7421e93b81edc0693971a33d55ebdc3923379ee3eb3d955dadbf

SHA512
bfe101fa1acb0d1c3d279bc47234091ae283100d428685bbaa2660ef11ab8f0ae82ea89dca63e1f82fb17a076d515a0ccab59173a4a549fb6c1db21eaef6538f

Download Submit
C:\Windows\system\uhkevdg.exe

Filesize
2.1MB

MD5
361ccff574a93120431c43803d0c7c41

SHA1
d51a6c2d5d6fb6e95cacfac4742d3349c0fa8a9f

SHA256
fd9eac5540123d4bc62b675126c3d8886e38deaadd30addcbe6d2bd6e2bfe9bb

SHA512
c78bd24bda453a977b99ee8ab544629b2c8f1593bf08e162fabe12eb807441846e79b6df75aa45d5d47fdb6223f5ed4d35706cb77563f5f5efc79f5963e77abe

Download Submit
C:\Windows\system\wyXSyQx.exe

Filesize
2.1MB

MD5
8044ecb5103616bb0b27f4e7e12f64d9

SHA1
502fd55cd669c677570b6936deab2752c2c84f9b

SHA256
e734e550870d7b11d0d7805010e90bb4c94952ca674058531d3d00ca4b5b627e

SHA512
643cc5058d31511c84456aa8772d2a18ae6b9cbbc61da0ce5c2190cb8434bb12d86f218602acc57a00f6d8e5383c1f84b09ef5c862ce1f0395117ce2cd6e54ac

Download Submit
C:\Windows\system\yHskRwO.exe

Filesize
2.1MB

MD5
961040aa5a37c40878f976dc32604749

SHA1
84beba910faacf55cbdafa2fd806eee76a03b4f9

SHA256
044761fb799a8305537844637251c181b9f71d3da8d7693c69b7d50b041fcc2b

SHA512
c0785f11614567f7e725169ad12cc0f2358c7c5fe9af6c2536725213446beddc316e6d8888a30613eb3a25f1f6405ab22d93a691b0535594f350d5a5dfef9679

Download Submit
\Windows\system\OGQyDCz.exe

Filesize
2.1MB

MD5
0fd9bce491dcf7b02fb0f17ba02aafbe

SHA1
64683b3299f1382c5a7d4256fda0ed96595dd4dd

SHA256
9f6f0dc33091781c29dd12e264a8831dc008ad9a43ec149df75c81303ba3252e

SHA512
ac03624da418eba4aaf04b3a5da7e69334bcb055ebfaddd621da8f792297d12ed4cb8b200893ae04e29dd569e404bef9fee44ab5e989d6d401ba5e878390490c

Download Submit
\Windows\system\kmfVNLB.exe

Filesize
2.1MB

MD5
1c7463a555e2cf7f441576a1257d807d

SHA1
b1eeedefdc6e2c765522184a1dac30c924b92300

SHA256
fa5bc62f28f348af6181cd10c8e47dd23f68f6f75456f9d74dcd61c5509d20b0

SHA512
60d57f2fa1aa639941972c6bfce980549e3cedeb9ffcbccef5984e36bed978cace24a72e9908ca909f4690018b1d66e360b52673e843f77532a8f3c539302cd1

Download Submit
memory/1348-72-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/1580-66-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-539-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2000-0-0x000000013F430000-0x000000013F822000-memory.dmp

Filesize
3.9MB

Download
memory/2000-11-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-38-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-22-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-65-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-34-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2000-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2000-26-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-36-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download
memory/2000-71-0x000000013FAF0000-0x000000013FEE2000-memory.dmp

Filesize
3.9MB

Download
memory/2000-76-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2400-54-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2484-35-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2492-59-0x000000013FD90000-0x0000000140182000-memory.dmp

Filesize
3.9MB

Download
memory/2508-53-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2520-15-0x000000013FDE0000-0x00000001401D2000-memory.dmp

Filesize
3.9MB

Download
memory/2528-58-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-49-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-77-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-83-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2784-908-0x0000000002AD0000-0x0000000002AD8000-memory.dmp

Filesize
32KB

Download
memory/2784-156-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/2928-60-0x000000013FC50000-0x0000000140042000-memory.dmp

Filesize
3.9MB

Download