xmrig | 40a28bb93d03379fb57662a234fe6e95e6a278c9d6a5a436003a8d09de99558d

Analysis

max time kernel
13s
max time network
17s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 00:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Size

2.3MB
MD5

01fc14956c8b3fa79a3c9f4b2a1d09c1
SHA1

fca7e22341fd2adecd35a53ec77a059d6a046300
SHA256

40a28bb93d03379fb57662a234fe6e95e6a278c9d6a5a436003a8d09de99558d
SHA512

131aa5621f866e9226cbb1e81fc36b1ef02cdc725c53baef292dea5e745c22d867608ca1f5572965e80ffbfd1c19180842123cef98b623ea5173c7df0a7d21b5
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfET3:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral1/memory/1164-17-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	xmrig
behavioral1/memory/1796-138-0x000000013F210000-0x000000013F602000-memory.dmp	xmrig
behavioral1/memory/2868-135-0x000000013F280000-0x000000013F672000-memory.dmp	xmrig
behavioral1/memory/2660-111-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1164	fElwnho.exe
1796	wTEaLpz.exe
2660	IYWTMJg.exe
2928	BlRIJQW.exe
2556	hkTjrWQ.exe
2916	sMomSfX.exe
2760	aftAOpI.exe
2744	jrimuiI.exe
2868	MohpSWL.exe
2752	tdwIKah.exe
2676	ZTzFkmk.exe
2472	FMNbvFD.exe
2128	FKgZPEj.exe
1348	MQMjkoX.exe
3020	ftymZKM.exe
2724	DFsERsJ.exe
2876	saYoQpJ.exe
2852	NOmfnVK.exe
2740	BwxvWif.exe
2808	oTDdtUy.exe
2848	MyPlgpp.exe
1584	AowzLpP.exe
2428	ecIjYNj.exe
2864	GGWywHr.exe
1308	epcEDla.exe
1496	fFJcRcj.exe
564	lkjglSY.exe
648	UPDIosP.exe
1492	qYIFvLc.exe
2056	jPIPZmK.exe
1680	wqVFNdx.exe
1756	XFmcQGe.exe
788	oTRdljs.exe
796	fMeHuMX.exe
1676	osQpHkh.exe
2088	uzRqSkm.exe
2940	ScKjirq.exe
2408	mUtByRl.exe
1696	AxNqCce.exe
2968	ZdjuKnV.exe
1272	isGVRfD.exe
1924	QrzFEhQ.exe
1604	YxnEXOF.exe
2672	hwcyYLj.exe
2112	ysUyShk.exe
2564	nhfrAce.exe
2468	IzEyvQe.exe
2972	IEzFsaC.exe
2416	ZqLElkj.exe
2284	JxGLETO.exe
1872	CYcjucL.exe
2080	pAYNmCP.exe
1136	vQfPTkm.exe
2168	leBIYuR.exe
2772	PvEYdxj.exe
3104	XMaqSXk.exe
3136	AQADosI.exe
3168	EsTGUqB.exe
3200	ncYwVeW.exe
3232	sBeDvkJ.exe
3264	hvForUt.exe
3296	YkXcUVX.exe
3328	bHKnsnx.exe
3360	vTmvtML.exe

Loads dropped DLL 64 IoCs

pid	Process
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1304-2-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/files/0x000a000000015cbd-3.dat	upx
behavioral1/files/0x0009000000015d24-8.dat	upx
behavioral1/memory/1164-17-0x000000013F4D0000-0x000000013F8C2000-memory.dmp	upx
behavioral1/files/0x0007000000015f3c-18.dat	upx
behavioral1/files/0x00080000000160cc-30.dat	upx
behavioral1/files/0x0007000000016d05-41.dat	upx
behavioral1/files/0x0006000000016d1f-53.dat	upx
behavioral1/files/0x0006000000016d36-62.dat	upx
behavioral1/files/0x00060000000173e5-94.dat	upx
behavioral1/files/0x00060000000175ac-102.dat	upx
behavioral1/files/0x000600000001739d-90.dat	upx
behavioral1/files/0x0006000000016fe8-86.dat	upx
behavioral1/files/0x0009000000018640-162.dat	upx
behavioral1/files/0x001500000001863c-155.dat	upx
behavioral1/memory/1796-138-0x000000013F210000-0x000000013F602000-memory.dmp	upx
behavioral1/memory/2868-135-0x000000013F280000-0x000000013F672000-memory.dmp	upx
behavioral1/memory/2744-133-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/memory/2760-119-0x000000013F590000-0x000000013F982000-memory.dmp	upx
behavioral1/memory/2916-117-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2556-115-0x000000013F580000-0x000000013F972000-memory.dmp	upx
behavioral1/memory/2928-113-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2660-111-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x000500000001874a-187.dat	upx
behavioral1/files/0x000500000001874c-186.dat	upx
behavioral1/files/0x0005000000018700-178.dat	upx
behavioral1/files/0x00050000000186c1-170.dat	upx
behavioral1/files/0x00050000000186d3-176.dat	upx
behavioral1/files/0x000500000001865a-168.dat	upx
behavioral1/files/0x0009000000015d4c-160.dat	upx
behavioral1/files/0x00060000000175b2-106.dat	upx
behavioral1/files/0x00060000000175b8-152.dat	upx
behavioral1/files/0x000600000001744c-98.dat	upx
behavioral1/files/0x0006000000016e78-82.dat	upx
behavioral1/files/0x0006000000016db3-78.dat	upx
behavioral1/files/0x0006000000016da4-74.dat	upx
behavioral1/files/0x0006000000016d9f-70.dat	upx
behavioral1/files/0x0006000000016d3a-66.dat	upx
behavioral1/files/0x0006000000016d32-58.dat	upx
behavioral1/files/0x0006000000016d16-49.dat	upx
behavioral1/files/0x0006000000016d0e-45.dat	upx
behavioral1/files/0x0009000000016476-38.dat	upx
behavioral1/files/0x00070000000161b3-33.dat	upx
behavioral1/files/0x001800000000558a-26.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\AOMrIla.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\hINAaik.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\uYTyVRX.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\MTwVGnW.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\uhxQUEM.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\vZvwVZp.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\dXIMMRZ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\gZBnuCB.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\sFPiOVy.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\FTxKiTR.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\xvJlQuD.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\LfztjOI.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\OCFAJDn.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\WicRdxL.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\zrpjEJq.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\leBtMEM.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\PFCNEeR.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\hcstSUB.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\pmfaCSI.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\WoRjnmS.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\wSiJCoP.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\EhSrgWL.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\rtgFHmi.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\eAMtLcC.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jTkEHvP.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\EPSURVl.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\TTdDZcf.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\vHHpRFa.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\XqbPAwX.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\jjjvVzZ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ALLoPGT.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\yjKgBEj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\dEkHTrZ.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ptKHkQr.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\FKgZPEj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\xeNmBKn.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\AUgujWq.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\oSNWWnm.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\amnXlHe.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\UyJwMMu.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\bVvazIX.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\fFJcRcj.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ExBYNZE.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\SdmBqwN.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\gxsUAmt.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\kcSsYoF.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\pwrLEqg.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ZrylOcl.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\QzNKZFe.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\BlRIJQW.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\heyGqwg.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ENmItTA.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\ZiSWPwN.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\TWBVzbt.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\PjxbAyX.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\CxiSoJb.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\xBDeTXC.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\lkjglSY.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\IzEyvQe.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\PLvgaZx.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\XhhcgEg.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\OiYSRbm.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\iwkYLkA.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
File created	C:\Windows\System\FMNbvFD.exe	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1712	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
Token: SeDebugPrivilege	1712	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1712	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1712	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1712	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	29
PID 1304 wrote to memory of 1164	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	30
PID 1304 wrote to memory of 1164	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	30
PID 1304 wrote to memory of 1164	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	30
PID 1304 wrote to memory of 1796	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	31
PID 1304 wrote to memory of 1796	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	31
PID 1304 wrote to memory of 1796	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	31
PID 1304 wrote to memory of 2660	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	32
PID 1304 wrote to memory of 2660	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	32
PID 1304 wrote to memory of 2660	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	32
PID 1304 wrote to memory of 2928	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2928	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2928	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	33
PID 1304 wrote to memory of 2556	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2556	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2556	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	34
PID 1304 wrote to memory of 2916	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2916	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2916	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	35
PID 1304 wrote to memory of 2760	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2760	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2760	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	36
PID 1304 wrote to memory of 2744	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2744	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2744	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	37
PID 1304 wrote to memory of 2868	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2868	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2868	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	38
PID 1304 wrote to memory of 2752	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	39
PID 1304 wrote to memory of 2752	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	39
PID 1304 wrote to memory of 2752	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	39
PID 1304 wrote to memory of 2676	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	40
PID 1304 wrote to memory of 2676	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	40
PID 1304 wrote to memory of 2676	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	40
PID 1304 wrote to memory of 2472	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2472	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2472	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	41
PID 1304 wrote to memory of 2128	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	42
PID 1304 wrote to memory of 2128	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	42
PID 1304 wrote to memory of 2128	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	42
PID 1304 wrote to memory of 1348	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	43
PID 1304 wrote to memory of 1348	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	43
PID 1304 wrote to memory of 1348	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	43
PID 1304 wrote to memory of 3020	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	44
PID 1304 wrote to memory of 3020	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	44
PID 1304 wrote to memory of 3020	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	44
PID 1304 wrote to memory of 2724	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2724	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2724	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	45
PID 1304 wrote to memory of 2876	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2876	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2876	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	46
PID 1304 wrote to memory of 2852	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	47
PID 1304 wrote to memory of 2852	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	47
PID 1304 wrote to memory of 2852	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	47
PID 1304 wrote to memory of 2740	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	48
PID 1304 wrote to memory of 2740	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	48
PID 1304 wrote to memory of 2740	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	48
PID 1304 wrote to memory of 2808	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2808	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2808	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	49
PID 1304 wrote to memory of 2848	1304	01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01fc14956c8b3fa79a3c9f4b2a1d09c1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Windows\System\fElwnho.exe
  C:\Windows\System\fElwnho.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\wTEaLpz.exe
  C:\Windows\System\wTEaLpz.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\IYWTMJg.exe
  C:\Windows\System\IYWTMJg.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\BlRIJQW.exe
  C:\Windows\System\BlRIJQW.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\hkTjrWQ.exe
  C:\Windows\System\hkTjrWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\sMomSfX.exe
  C:\Windows\System\sMomSfX.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\aftAOpI.exe
  C:\Windows\System\aftAOpI.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\jrimuiI.exe
  C:\Windows\System\jrimuiI.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\MohpSWL.exe
  C:\Windows\System\MohpSWL.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\tdwIKah.exe
  C:\Windows\System\tdwIKah.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\ZTzFkmk.exe
  C:\Windows\System\ZTzFkmk.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\FMNbvFD.exe
  C:\Windows\System\FMNbvFD.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\FKgZPEj.exe
  C:\Windows\System\FKgZPEj.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\MQMjkoX.exe
  C:\Windows\System\MQMjkoX.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\ftymZKM.exe
  C:\Windows\System\ftymZKM.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\DFsERsJ.exe
  C:\Windows\System\DFsERsJ.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\saYoQpJ.exe
  C:\Windows\System\saYoQpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\NOmfnVK.exe
  C:\Windows\System\NOmfnVK.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\BwxvWif.exe
  C:\Windows\System\BwxvWif.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\oTDdtUy.exe
  C:\Windows\System\oTDdtUy.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\MyPlgpp.exe
  C:\Windows\System\MyPlgpp.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\AowzLpP.exe
  C:\Windows\System\AowzLpP.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\ecIjYNj.exe
  C:\Windows\System\ecIjYNj.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\GGWywHr.exe
  C:\Windows\System\GGWywHr.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\epcEDla.exe
  C:\Windows\System\epcEDla.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\qYIFvLc.exe
  C:\Windows\System\qYIFvLc.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\fFJcRcj.exe
  C:\Windows\System\fFJcRcj.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\XFmcQGe.exe
  C:\Windows\System\XFmcQGe.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\lkjglSY.exe
  C:\Windows\System\lkjglSY.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\FcjlXXX.exe
  C:\Windows\System\FcjlXXX.exe
  2⤵
  PID:1868
- C:\Windows\System\UPDIosP.exe
  C:\Windows\System\UPDIosP.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\klffCSQ.exe
  C:\Windows\System\klffCSQ.exe
  2⤵
  PID:452
- C:\Windows\System\jPIPZmK.exe
  C:\Windows\System\jPIPZmK.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\pLMnyQQ.exe
  C:\Windows\System\pLMnyQQ.exe
  2⤵
  PID:2340
- C:\Windows\System\wqVFNdx.exe
  C:\Windows\System\wqVFNdx.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\kbWkzwb.exe
  C:\Windows\System\kbWkzwb.exe
  2⤵
  PID:2028
- C:\Windows\System\oTRdljs.exe
  C:\Windows\System\oTRdljs.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\UOIDXMV.exe
  C:\Windows\System\UOIDXMV.exe
  2⤵
  PID:960
- C:\Windows\System\fMeHuMX.exe
  C:\Windows\System\fMeHuMX.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\eNKUuib.exe
  C:\Windows\System\eNKUuib.exe
  2⤵
  PID:1964
- C:\Windows\System\osQpHkh.exe
  C:\Windows\System\osQpHkh.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\qiwcKVB.exe
  C:\Windows\System\qiwcKVB.exe
  2⤵
  PID:112
- C:\Windows\System\uzRqSkm.exe
  C:\Windows\System\uzRqSkm.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\MYYpKsT.exe
  C:\Windows\System\MYYpKsT.exe
  2⤵
  PID:2208
- C:\Windows\System\ScKjirq.exe
  C:\Windows\System\ScKjirq.exe
  2⤵
  - Executes dropped EXE
  PID:2940
- C:\Windows\System\IoIHEVY.exe
  C:\Windows\System\IoIHEVY.exe
  2⤵
  PID:1256
- C:\Windows\System\mUtByRl.exe
  C:\Windows\System\mUtByRl.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\QfUDkPu.exe
  C:\Windows\System\QfUDkPu.exe
  2⤵
  PID:1632
- C:\Windows\System\AxNqCce.exe
  C:\Windows\System\AxNqCce.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\JEpdcHT.exe
  C:\Windows\System\JEpdcHT.exe
  2⤵
  PID:892
- C:\Windows\System\ZdjuKnV.exe
  C:\Windows\System\ZdjuKnV.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\ohLTATe.exe
  C:\Windows\System\ohLTATe.exe
  2⤵
  PID:2252
- C:\Windows\System\isGVRfD.exe
  C:\Windows\System\isGVRfD.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\cuOgvtj.exe
  C:\Windows\System\cuOgvtj.exe
  2⤵
  PID:320
- C:\Windows\System\QrzFEhQ.exe
  C:\Windows\System\QrzFEhQ.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\dlkNnTt.exe
  C:\Windows\System\dlkNnTt.exe
  2⤵
  PID:2372
- C:\Windows\System\YxnEXOF.exe
  C:\Windows\System\YxnEXOF.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ULhOAuS.exe
  C:\Windows\System\ULhOAuS.exe
  2⤵
  PID:1724
- C:\Windows\System\hwcyYLj.exe
  C:\Windows\System\hwcyYLj.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\EBpfBsi.exe
  C:\Windows\System\EBpfBsi.exe
  2⤵
  PID:2236
- C:\Windows\System\ysUyShk.exe
  C:\Windows\System\ysUyShk.exe
  2⤵
  - Executes dropped EXE
  PID:2112
- C:\Windows\System\yGoEKAo.exe
  C:\Windows\System\yGoEKAo.exe
  2⤵
  PID:2480
- C:\Windows\System\nhfrAce.exe
  C:\Windows\System\nhfrAce.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\LepMYat.exe
  C:\Windows\System\LepMYat.exe
  2⤵
  PID:1056
- C:\Windows\System\IzEyvQe.exe
  C:\Windows\System\IzEyvQe.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\GAGibDe.exe
  C:\Windows\System\GAGibDe.exe
  2⤵
  PID:2728
- C:\Windows\System\IEzFsaC.exe
  C:\Windows\System\IEzFsaC.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\zdeiWVm.exe
  C:\Windows\System\zdeiWVm.exe
  2⤵
  PID:2336
- C:\Windows\System\ZqLElkj.exe
  C:\Windows\System\ZqLElkj.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\OhsYrjN.exe
  C:\Windows\System\OhsYrjN.exe
  2⤵
  PID:2884
- C:\Windows\System\JxGLETO.exe
  C:\Windows\System\JxGLETO.exe
  2⤵
  - Executes dropped EXE
  PID:2284
- C:\Windows\System\YCyTTds.exe
  C:\Windows\System\YCyTTds.exe
  2⤵
  PID:2720
- C:\Windows\System\CYcjucL.exe
  C:\Windows\System\CYcjucL.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\fdbAWCC.exe
  C:\Windows\System\fdbAWCC.exe
  2⤵
  PID:916
- C:\Windows\System\pAYNmCP.exe
  C:\Windows\System\pAYNmCP.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\bXaHIPY.exe
  C:\Windows\System\bXaHIPY.exe
  2⤵
  PID:2904
- C:\Windows\System\vQfPTkm.exe
  C:\Windows\System\vQfPTkm.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\GKHRQfN.exe
  C:\Windows\System\GKHRQfN.exe
  2⤵
  PID:2384
- C:\Windows\System\leBIYuR.exe
  C:\Windows\System\leBIYuR.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\OSfFXwJ.exe
  C:\Windows\System\OSfFXwJ.exe
  2⤵
  PID:2528
- C:\Windows\System\PvEYdxj.exe
  C:\Windows\System\PvEYdxj.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\sFPiOVy.exe
  C:\Windows\System\sFPiOVy.exe
  2⤵
  PID:3088
- C:\Windows\System\XMaqSXk.exe
  C:\Windows\System\XMaqSXk.exe
  2⤵
  - Executes dropped EXE
  PID:3104
- C:\Windows\System\WOLkRpS.exe
  C:\Windows\System\WOLkRpS.exe
  2⤵
  PID:3120
- C:\Windows\System\AQADosI.exe
  C:\Windows\System\AQADosI.exe
  2⤵
  - Executes dropped EXE
  PID:3136
- C:\Windows\System\bDRcMLQ.exe
  C:\Windows\System\bDRcMLQ.exe
  2⤵
  PID:3152
- C:\Windows\System\EsTGUqB.exe
  C:\Windows\System\EsTGUqB.exe
  2⤵
  - Executes dropped EXE
  PID:3168
- C:\Windows\System\QqducYU.exe
  C:\Windows\System\QqducYU.exe
  2⤵
  PID:3184
- C:\Windows\System\ncYwVeW.exe
  C:\Windows\System\ncYwVeW.exe
  2⤵
  - Executes dropped EXE
  PID:3200
- C:\Windows\System\aWbZXec.exe
  C:\Windows\System\aWbZXec.exe
  2⤵
  PID:3216
- C:\Windows\System\sBeDvkJ.exe
  C:\Windows\System\sBeDvkJ.exe
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Windows\System\wGZPbIW.exe
  C:\Windows\System\wGZPbIW.exe
  2⤵
  PID:3248
- C:\Windows\System\hvForUt.exe
  C:\Windows\System\hvForUt.exe
  2⤵
  - Executes dropped EXE
  PID:3264
- C:\Windows\System\aAXaAUa.exe
  C:\Windows\System\aAXaAUa.exe
  2⤵
  PID:3280
- C:\Windows\System\YkXcUVX.exe
  C:\Windows\System\YkXcUVX.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- C:\Windows\System\OXEyzbN.exe
  C:\Windows\System\OXEyzbN.exe
  2⤵
  PID:3312
- C:\Windows\System\bHKnsnx.exe
  C:\Windows\System\bHKnsnx.exe
  2⤵
  - Executes dropped EXE
  PID:3328
- C:\Windows\System\fxabiwc.exe
  C:\Windows\System\fxabiwc.exe
  2⤵
  PID:3344
- C:\Windows\System\vTmvtML.exe
  C:\Windows\System\vTmvtML.exe
  2⤵
  - Executes dropped EXE
  PID:3360
- C:\Windows\System\YDOpgPj.exe
  C:\Windows\System\YDOpgPj.exe
  2⤵
  PID:3376
- C:\Windows\System\dQCMhaZ.exe
  C:\Windows\System\dQCMhaZ.exe
  2⤵
  PID:3392
- C:\Windows\System\gQjgTGT.exe
  C:\Windows\System\gQjgTGT.exe
  2⤵
  PID:3408
- C:\Windows\System\LwsodeC.exe
  C:\Windows\System\LwsodeC.exe
  2⤵
  PID:3424
- C:\Windows\System\zNiNMvs.exe
  C:\Windows\System\zNiNMvs.exe
  2⤵
  PID:3440
- C:\Windows\System\buIHBKb.exe
  C:\Windows\System\buIHBKb.exe
  2⤵
  PID:3456
- C:\Windows\System\xiNGQZJ.exe
  C:\Windows\System\xiNGQZJ.exe
  2⤵
  PID:3472
- C:\Windows\System\KsUwrtI.exe
  C:\Windows\System\KsUwrtI.exe
  2⤵
  PID:3488
- C:\Windows\System\fMWpFGN.exe
  C:\Windows\System\fMWpFGN.exe
  2⤵
  PID:3504
- C:\Windows\System\VnRkiWf.exe
  C:\Windows\System\VnRkiWf.exe
  2⤵
  PID:3520
- C:\Windows\System\KgfBdXR.exe
  C:\Windows\System\KgfBdXR.exe
  2⤵
  PID:3536
- C:\Windows\System\uJDeNiS.exe
  C:\Windows\System\uJDeNiS.exe
  2⤵
  PID:3552
- C:\Windows\System\NTFxprZ.exe
  C:\Windows\System\NTFxprZ.exe
  2⤵
  PID:3568
- C:\Windows\System\yuERGqA.exe
  C:\Windows\System\yuERGqA.exe
  2⤵
  PID:3584
- C:\Windows\System\boGLAaI.exe
  C:\Windows\System\boGLAaI.exe
  2⤵
  PID:3600
- C:\Windows\System\TaFhzzH.exe
  C:\Windows\System\TaFhzzH.exe
  2⤵
  PID:3616
- C:\Windows\System\QANcENW.exe
  C:\Windows\System\QANcENW.exe
  2⤵
  PID:3632
- C:\Windows\System\TWBVzbt.exe
  C:\Windows\System\TWBVzbt.exe
  2⤵
  PID:3648
- C:\Windows\System\uhxQUEM.exe
  C:\Windows\System\uhxQUEM.exe
  2⤵
  PID:3664
- C:\Windows\System\TxThsFQ.exe
  C:\Windows\System\TxThsFQ.exe
  2⤵
  PID:3680
- C:\Windows\System\DDIwACQ.exe
  C:\Windows\System\DDIwACQ.exe
  2⤵
  PID:3700
- C:\Windows\System\GKIeKDM.exe
  C:\Windows\System\GKIeKDM.exe
  2⤵
  PID:3716
- C:\Windows\System\SlyojBl.exe
  C:\Windows\System\SlyojBl.exe
  2⤵
  PID:3732
- C:\Windows\System\jjjvVzZ.exe
  C:\Windows\System\jjjvVzZ.exe
  2⤵
  PID:3752
- C:\Windows\System\nYICGRt.exe
  C:\Windows\System\nYICGRt.exe
  2⤵
  PID:3768
- C:\Windows\System\FBuHluS.exe
  C:\Windows\System\FBuHluS.exe
  2⤵
  PID:3784
- C:\Windows\System\fkVVtlk.exe
  C:\Windows\System\fkVVtlk.exe
  2⤵
  PID:3800
- C:\Windows\System\GXWusXe.exe
  C:\Windows\System\GXWusXe.exe
  2⤵
  PID:3816
- C:\Windows\System\TXwAXbY.exe
  C:\Windows\System\TXwAXbY.exe
  2⤵
  PID:3832
- C:\Windows\System\CHtFWGB.exe
  C:\Windows\System\CHtFWGB.exe
  2⤵
  PID:3848
- C:\Windows\System\XTMtgFX.exe
  C:\Windows\System\XTMtgFX.exe
  2⤵
  PID:3864
- C:\Windows\System\ubLOYsu.exe
  C:\Windows\System\ubLOYsu.exe
  2⤵
  PID:3880
- C:\Windows\System\aFVKjZF.exe
  C:\Windows\System\aFVKjZF.exe
  2⤵
  PID:3904
- C:\Windows\System\MymMbXP.exe
  C:\Windows\System\MymMbXP.exe
  2⤵
  PID:3920
- C:\Windows\System\QraQGGf.exe
  C:\Windows\System\QraQGGf.exe
  2⤵
  PID:3936
- C:\Windows\System\leBtMEM.exe
  C:\Windows\System\leBtMEM.exe
  2⤵
  PID:3952
- C:\Windows\System\UPrvxge.exe
  C:\Windows\System\UPrvxge.exe
  2⤵
  PID:3968
- C:\Windows\System\xeNmBKn.exe
  C:\Windows\System\xeNmBKn.exe
  2⤵
  PID:3984
- C:\Windows\System\coycOyZ.exe
  C:\Windows\System\coycOyZ.exe
  2⤵
  PID:4000
- C:\Windows\System\HbJcBDt.exe
  C:\Windows\System\HbJcBDt.exe
  2⤵
  PID:4016
- C:\Windows\System\vtMQlEg.exe
  C:\Windows\System\vtMQlEg.exe
  2⤵
  PID:4032
- C:\Windows\System\NcycztU.exe
  C:\Windows\System\NcycztU.exe
  2⤵
  PID:4048
- C:\Windows\System\EUAYeRP.exe
  C:\Windows\System\EUAYeRP.exe
  2⤵
  PID:4064
- C:\Windows\System\srSPPUq.exe
  C:\Windows\System\srSPPUq.exe
  2⤵
  PID:4080
- C:\Windows\System\wSiJCoP.exe
  C:\Windows\System\wSiJCoP.exe
  2⤵
  PID:1980
- C:\Windows\System\AktaEVB.exe
  C:\Windows\System\AktaEVB.exe
  2⤵
  PID:1664
- C:\Windows\System\dhYUfJF.exe
  C:\Windows\System\dhYUfJF.exe
  2⤵
  PID:1800
- C:\Windows\System\BuskUFr.exe
  C:\Windows\System\BuskUFr.exe
  2⤵
  PID:3080
- C:\Windows\System\CRJwYkr.exe
  C:\Windows\System\CRJwYkr.exe
  2⤵
  PID:3144
- C:\Windows\System\zRSedYp.exe
  C:\Windows\System\zRSedYp.exe
  2⤵
  PID:3208
- C:\Windows\System\garHdQN.exe
  C:\Windows\System\garHdQN.exe
  2⤵
  PID:3276
- C:\Windows\System\YEXeGGT.exe
  C:\Windows\System\YEXeGGT.exe
  2⤵
  PID:3340
- C:\Windows\System\hIAduFA.exe
  C:\Windows\System\hIAduFA.exe
  2⤵
  PID:3404
- C:\Windows\System\JjvXaLe.exe
  C:\Windows\System\JjvXaLe.exe
  2⤵
  PID:3468
- C:\Windows\System\UYSAYRi.exe
  C:\Windows\System\UYSAYRi.exe
  2⤵
  PID:3532
- C:\Windows\System\kLTeTYx.exe
  C:\Windows\System\kLTeTYx.exe
  2⤵
  PID:3596
- C:\Windows\System\DLxsNjy.exe
  C:\Windows\System\DLxsNjy.exe
  2⤵
  PID:3660
- C:\Windows\System\MtndvjJ.exe
  C:\Windows\System\MtndvjJ.exe
  2⤵
  PID:2424
- C:\Windows\System\cEKFwpw.exe
  C:\Windows\System\cEKFwpw.exe
  2⤵
  PID:2924
- C:\Windows\System\JzMlktf.exe
  C:\Windows\System\JzMlktf.exe
  2⤵
  PID:3692
- C:\Windows\System\oQRcQQo.exe
  C:\Windows\System\oQRcQQo.exe
  2⤵
  PID:4100
- C:\Windows\System\XTbxfus.exe
  C:\Windows\System\XTbxfus.exe
  2⤵
  PID:4116
- C:\Windows\System\zuEOEQK.exe
  C:\Windows\System\zuEOEQK.exe
  2⤵
  PID:4132
- C:\Windows\System\dfWYKgU.exe
  C:\Windows\System\dfWYKgU.exe
  2⤵
  PID:4148
- C:\Windows\System\iTMcwse.exe
  C:\Windows\System\iTMcwse.exe
  2⤵
  PID:4164
- C:\Windows\System\KgruLhx.exe
  C:\Windows\System\KgruLhx.exe
  2⤵
  PID:4180
- C:\Windows\System\NCMzGHx.exe
  C:\Windows\System\NCMzGHx.exe
  2⤵
  PID:4196
- C:\Windows\System\AUgujWq.exe
  C:\Windows\System\AUgujWq.exe
  2⤵
  PID:4212
- C:\Windows\System\HrPxzsb.exe
  C:\Windows\System\HrPxzsb.exe
  2⤵
  PID:4228
- C:\Windows\System\OybHNzF.exe
  C:\Windows\System\OybHNzF.exe
  2⤵
  PID:4244
- C:\Windows\System\TAuEfdT.exe
  C:\Windows\System\TAuEfdT.exe
  2⤵
  PID:4264
- C:\Windows\System\KbHJpql.exe
  C:\Windows\System\KbHJpql.exe
  2⤵
  PID:4280
- C:\Windows\System\vKmPvao.exe
  C:\Windows\System\vKmPvao.exe
  2⤵
  PID:4296
- C:\Windows\System\aBgpDda.exe
  C:\Windows\System\aBgpDda.exe
  2⤵
  PID:4312
- C:\Windows\System\lldFFkt.exe
  C:\Windows\System\lldFFkt.exe
  2⤵
  PID:4328
- C:\Windows\System\ALLoPGT.exe
  C:\Windows\System\ALLoPGT.exe
  2⤵
  PID:4344
- C:\Windows\System\UTOzaXD.exe
  C:\Windows\System\UTOzaXD.exe
  2⤵
  PID:4360
- C:\Windows\System\dvEytHW.exe
  C:\Windows\System\dvEytHW.exe
  2⤵
  PID:4376
- C:\Windows\System\RKztBMj.exe
  C:\Windows\System\RKztBMj.exe
  2⤵
  PID:4392
- C:\Windows\System\MqqbJbD.exe
  C:\Windows\System\MqqbJbD.exe
  2⤵
  PID:4408
- C:\Windows\System\CMKLHST.exe
  C:\Windows\System\CMKLHST.exe
  2⤵
  PID:4424
- C:\Windows\System\oSNWWnm.exe
  C:\Windows\System\oSNWWnm.exe
  2⤵
  PID:4440
- C:\Windows\System\WwSNjqi.exe
  C:\Windows\System\WwSNjqi.exe
  2⤵
  PID:4456
- C:\Windows\System\bLBOQks.exe
  C:\Windows\System\bLBOQks.exe
  2⤵
  PID:4472
- C:\Windows\System\PLvgaZx.exe
  C:\Windows\System\PLvgaZx.exe
  2⤵
  PID:4488
- C:\Windows\System\tUclAWe.exe
  C:\Windows\System\tUclAWe.exe
  2⤵
  PID:4504
- C:\Windows\System\qGjxeZi.exe
  C:\Windows\System\qGjxeZi.exe
  2⤵
  PID:4520
- C:\Windows\System\ZZecjns.exe
  C:\Windows\System\ZZecjns.exe
  2⤵
  PID:4536
- C:\Windows\System\yjKgBEj.exe
  C:\Windows\System\yjKgBEj.exe
  2⤵
  PID:4552
- C:\Windows\System\ooorxre.exe
  C:\Windows\System\ooorxre.exe
  2⤵
  PID:4568
- C:\Windows\System\ZnVMTsl.exe
  C:\Windows\System\ZnVMTsl.exe
  2⤵
  PID:4584
- C:\Windows\System\uWSCrwX.exe
  C:\Windows\System\uWSCrwX.exe
  2⤵
  PID:4600
- C:\Windows\System\vsPUOdm.exe
  C:\Windows\System\vsPUOdm.exe
  2⤵
  PID:4616
- C:\Windows\System\qzoqIOM.exe
  C:\Windows\System\qzoqIOM.exe
  2⤵
  PID:4632
- C:\Windows\System\PxWFyQy.exe
  C:\Windows\System\PxWFyQy.exe
  2⤵
  PID:4648
- C:\Windows\System\IkLXpKz.exe
  C:\Windows\System\IkLXpKz.exe
  2⤵
  PID:4664
- C:\Windows\System\HhnXGUJ.exe
  C:\Windows\System\HhnXGUJ.exe
  2⤵
  PID:4680
- C:\Windows\System\TpJxPmy.exe
  C:\Windows\System\TpJxPmy.exe
  2⤵
  PID:4696
- C:\Windows\System\kBeuxkN.exe
  C:\Windows\System\kBeuxkN.exe
  2⤵
  PID:4712
- C:\Windows\System\HdmQAoy.exe
  C:\Windows\System\HdmQAoy.exe
  2⤵
  PID:4728
- C:\Windows\System\XqbPAwX.exe
  C:\Windows\System\XqbPAwX.exe
  2⤵
  PID:4744
- C:\Windows\System\arwrLOn.exe
  C:\Windows\System\arwrLOn.exe
  2⤵
  PID:4760
- C:\Windows\System\EhSrgWL.exe
  C:\Windows\System\EhSrgWL.exe
  2⤵
  PID:4776
- C:\Windows\System\MuHWKdJ.exe
  C:\Windows\System\MuHWKdJ.exe
  2⤵
  PID:4792
- C:\Windows\System\kBpPgsg.exe
  C:\Windows\System\kBpPgsg.exe
  2⤵
  PID:4808
- C:\Windows\System\LrVRVDE.exe
  C:\Windows\System\LrVRVDE.exe
  2⤵
  PID:4824
- C:\Windows\System\bDHggFO.exe
  C:\Windows\System\bDHggFO.exe
  2⤵
  PID:4840
- C:\Windows\System\ExBYNZE.exe
  C:\Windows\System\ExBYNZE.exe
  2⤵
  PID:4856
- C:\Windows\System\lptJqRQ.exe
  C:\Windows\System\lptJqRQ.exe
  2⤵
  PID:4872
- C:\Windows\System\SRhxPXH.exe
  C:\Windows\System\SRhxPXH.exe
  2⤵
  PID:4892
- C:\Windows\System\uVlOgqZ.exe
  C:\Windows\System\uVlOgqZ.exe
  2⤵
  PID:4912
- C:\Windows\System\FTxKiTR.exe
  C:\Windows\System\FTxKiTR.exe
  2⤵
  PID:4928
- C:\Windows\System\WZBBTrs.exe
  C:\Windows\System\WZBBTrs.exe
  2⤵
  PID:4944
- C:\Windows\System\iZLILgQ.exe
  C:\Windows\System\iZLILgQ.exe
  2⤵
  PID:4960
- C:\Windows\System\OZbjsDq.exe
  C:\Windows\System\OZbjsDq.exe
  2⤵
  PID:4976
- C:\Windows\System\wseFjYt.exe
  C:\Windows\System\wseFjYt.exe
  2⤵
  PID:4992
- C:\Windows\System\xKgosnq.exe
  C:\Windows\System\xKgosnq.exe
  2⤵
  PID:5008
- C:\Windows\System\lDgPFxa.exe
  C:\Windows\System\lDgPFxa.exe
  2⤵
  PID:5024
- C:\Windows\System\eIuLJxO.exe
  C:\Windows\System\eIuLJxO.exe
  2⤵
  PID:5040
- C:\Windows\System\rEIBbRY.exe
  C:\Windows\System\rEIBbRY.exe
  2⤵
  PID:860
- C:\Windows\System\DpDGmaH.exe
  C:\Windows\System\DpDGmaH.exe
  2⤵
  PID:1516
- C:\Windows\System\eGtcUHC.exe
  C:\Windows\System\eGtcUHC.exe
  2⤵
  PID:2900
- C:\Windows\System\rtqwEUr.exe
  C:\Windows\System\rtqwEUr.exe
  2⤵
  PID:2912
- C:\Windows\System\UeYlqIE.exe
  C:\Windows\System\UeYlqIE.exe
  2⤵
  PID:2620
- C:\Windows\System\ALmdOuJ.exe
  C:\Windows\System\ALmdOuJ.exe
  2⤵
  PID:2832
- C:\Windows\System\JwRRMYT.exe
  C:\Windows\System\JwRRMYT.exe
  2⤵
  PID:2360
- C:\Windows\System\mdixPZi.exe
  C:\Windows\System\mdixPZi.exe
  2⤵
  PID:2608
- C:\Windows\System\jSbxjNX.exe
  C:\Windows\System\jSbxjNX.exe
  2⤵
  PID:3100
- C:\Windows\System\xEhkkUa.exe
  C:\Windows\System\xEhkkUa.exe
  2⤵
  PID:3164
- C:\Windows\System\SulUtwH.exe
  C:\Windows\System\SulUtwH.exe
  2⤵
  PID:3288
- C:\Windows\System\AFTroKr.exe
  C:\Windows\System\AFTroKr.exe
  2⤵
  PID:4128
- C:\Windows\System\CxiSoJb.exe
  C:\Windows\System\CxiSoJb.exe
  2⤵
  PID:3320
- C:\Windows\System\SkTdSOd.exe
  C:\Windows\System\SkTdSOd.exe
  2⤵
  PID:5124
- C:\Windows\System\TCblJWk.exe
  C:\Windows\System\TCblJWk.exe
  2⤵
  PID:5140
- C:\Windows\System\xIEJfWo.exe
  C:\Windows\System\xIEJfWo.exe
  2⤵
  PID:5156
- C:\Windows\System\RpfNkwM.exe
  C:\Windows\System\RpfNkwM.exe
  2⤵
  PID:5172
- C:\Windows\System\cAgHMJu.exe
  C:\Windows\System\cAgHMJu.exe
  2⤵
  PID:5188
- C:\Windows\System\vmoCRNu.exe
  C:\Windows\System\vmoCRNu.exe
  2⤵
  PID:5204
- C:\Windows\System\ByVuUcK.exe
  C:\Windows\System\ByVuUcK.exe
  2⤵
  PID:5224
- C:\Windows\System\XhhcgEg.exe
  C:\Windows\System\XhhcgEg.exe
  2⤵
  PID:5240
- C:\Windows\System\yhUxJta.exe
  C:\Windows\System\yhUxJta.exe
  2⤵
  PID:5256
- C:\Windows\System\dRnAPKM.exe
  C:\Windows\System\dRnAPKM.exe
  2⤵
  PID:5272
- C:\Windows\System\BfEzPYt.exe
  C:\Windows\System\BfEzPYt.exe
  2⤵
  PID:5288
- C:\Windows\System\Acohcrh.exe
  C:\Windows\System\Acohcrh.exe
  2⤵
  PID:5308
- C:\Windows\System\eshzZeY.exe
  C:\Windows\System\eshzZeY.exe
  2⤵
  PID:5324
- C:\Windows\System\sxgOLnM.exe
  C:\Windows\System\sxgOLnM.exe
  2⤵
  PID:5340
- C:\Windows\System\ykOICbj.exe
  C:\Windows\System\ykOICbj.exe
  2⤵
  PID:5356
- C:\Windows\System\Mecmnix.exe
  C:\Windows\System\Mecmnix.exe
  2⤵
  PID:5372
- C:\Windows\System\DFjCdZA.exe
  C:\Windows\System\DFjCdZA.exe
  2⤵
  PID:5388
- C:\Windows\System\heyGqwg.exe
  C:\Windows\System\heyGqwg.exe
  2⤵
  PID:5404
- C:\Windows\System\hJhmaRh.exe
  C:\Windows\System\hJhmaRh.exe
  2⤵
  PID:5420
- C:\Windows\System\SdmBqwN.exe
  C:\Windows\System\SdmBqwN.exe
  2⤵
  PID:5436
- C:\Windows\System\vvFrklu.exe
  C:\Windows\System\vvFrklu.exe
  2⤵
  PID:5452
- C:\Windows\System\JOzifOk.exe
  C:\Windows\System\JOzifOk.exe
  2⤵
  PID:5472
- C:\Windows\System\AyqdkHW.exe
  C:\Windows\System\AyqdkHW.exe
  2⤵
  PID:5492
- C:\Windows\System\LtxwRUD.exe
  C:\Windows\System\LtxwRUD.exe
  2⤵
  PID:5512
- C:\Windows\System\BiTzrEG.exe
  C:\Windows\System\BiTzrEG.exe
  2⤵
  PID:5536
- C:\Windows\System\GwdFdiH.exe
  C:\Windows\System\GwdFdiH.exe
  2⤵
  PID:5556
- C:\Windows\System\GJEbqMj.exe
  C:\Windows\System\GJEbqMj.exe
  2⤵
  PID:5576
- C:\Windows\System\NkgsUdz.exe
  C:\Windows\System\NkgsUdz.exe
  2⤵
  PID:5620
- C:\Windows\System\kHOKJNZ.exe
  C:\Windows\System\kHOKJNZ.exe
  2⤵
  PID:5652
- C:\Windows\System\xvJlQuD.exe
  C:\Windows\System\xvJlQuD.exe
  2⤵
  PID:5676
- C:\Windows\System\FkIFeQM.exe
  C:\Windows\System\FkIFeQM.exe
  2⤵
  PID:5692
- C:\Windows\System\twhELuQ.exe
  C:\Windows\System\twhELuQ.exe
  2⤵
  PID:5708
- C:\Windows\System\CFMfJoZ.exe
  C:\Windows\System\CFMfJoZ.exe
  2⤵
  PID:5724
- C:\Windows\System\PSSBgJD.exe
  C:\Windows\System\PSSBgJD.exe
  2⤵
  PID:5740
- C:\Windows\System\rZtSqou.exe
  C:\Windows\System\rZtSqou.exe
  2⤵
  PID:5756
- C:\Windows\System\BbYRvbX.exe
  C:\Windows\System\BbYRvbX.exe
  2⤵
  PID:5772
- C:\Windows\System\RpUbKKB.exe
  C:\Windows\System\RpUbKKB.exe
  2⤵
  PID:5788
- C:\Windows\System\fJYJoVW.exe
  C:\Windows\System\fJYJoVW.exe
  2⤵
  PID:5804
- C:\Windows\System\keQKFsx.exe
  C:\Windows\System\keQKFsx.exe
  2⤵
  PID:5820
- C:\Windows\System\xXCDyBV.exe
  C:\Windows\System\xXCDyBV.exe
  2⤵
  PID:5836
- C:\Windows\System\pORYTDy.exe
  C:\Windows\System\pORYTDy.exe
  2⤵
  PID:5852
- C:\Windows\System\MPLyxsV.exe
  C:\Windows\System\MPLyxsV.exe
  2⤵
  PID:5868
- C:\Windows\System\qbzUbcD.exe
  C:\Windows\System\qbzUbcD.exe
  2⤵
  PID:5884
- C:\Windows\System\RbjrWXM.exe
  C:\Windows\System\RbjrWXM.exe
  2⤵
  PID:5900
- C:\Windows\System\MFfJcfY.exe
  C:\Windows\System\MFfJcfY.exe
  2⤵
  PID:5916
- C:\Windows\System\bXVKKVJ.exe
  C:\Windows\System\bXVKKVJ.exe
  2⤵
  PID:5932
- C:\Windows\System\pquYvVw.exe
  C:\Windows\System\pquYvVw.exe
  2⤵
  PID:5948
- C:\Windows\System\mdrRUZv.exe
  C:\Windows\System\mdrRUZv.exe
  2⤵
  PID:5964
- C:\Windows\System\AOMrIla.exe
  C:\Windows\System\AOMrIla.exe
  2⤵
  PID:5980
- C:\Windows\System\ikXVtzv.exe
  C:\Windows\System\ikXVtzv.exe
  2⤵
  PID:5996
- C:\Windows\System\jeFeENM.exe
  C:\Windows\System\jeFeENM.exe
  2⤵
  PID:6012
- C:\Windows\System\JkmvpeU.exe
  C:\Windows\System\JkmvpeU.exe
  2⤵
  PID:6028
- C:\Windows\System\YzkOCvo.exe
  C:\Windows\System\YzkOCvo.exe
  2⤵
  PID:6044
- C:\Windows\System\DtMkSDl.exe
  C:\Windows\System\DtMkSDl.exe
  2⤵
  PID:6060
- C:\Windows\System\rTBeuxZ.exe
  C:\Windows\System\rTBeuxZ.exe
  2⤵
  PID:6076
- C:\Windows\System\LJaCsZE.exe
  C:\Windows\System\LJaCsZE.exe
  2⤵
  PID:6092
- C:\Windows\System\QZcTSJo.exe
  C:\Windows\System\QZcTSJo.exe
  2⤵
  PID:6108
- C:\Windows\System\UJFWdUm.exe
  C:\Windows\System\UJFWdUm.exe
  2⤵
  PID:6132
- C:\Windows\System\BKMUPbg.exe
  C:\Windows\System\BKMUPbg.exe
  2⤵
  PID:3452
- C:\Windows\System\LfztjOI.exe
  C:\Windows\System\LfztjOI.exe
  2⤵
  PID:3516
- C:\Windows\System\BOjJmXy.exe
  C:\Windows\System\BOjJmXy.exe
  2⤵
  PID:3580
- C:\Windows\System\qXaSUAz.exe
  C:\Windows\System\qXaSUAz.exe
  2⤵
  PID:3644
- C:\Windows\System\rQkdljq.exe
  C:\Windows\System\rQkdljq.exe
  2⤵
  PID:3712
- C:\Windows\System\tGXDAqz.exe
  C:\Windows\System\tGXDAqz.exe
  2⤵
  PID:3840
- C:\Windows\System\YMERDRw.exe
  C:\Windows\System\YMERDRw.exe
  2⤵
  PID:2492
- C:\Windows\System\ZHdkoxi.exe
  C:\Windows\System\ZHdkoxi.exe
  2⤵
  PID:4008
- C:\Windows\System\CQJyVQe.exe
  C:\Windows\System\CQJyVQe.exe
  2⤵
  PID:2944
- C:\Windows\System\PFCNEeR.exe
  C:\Windows\System\PFCNEeR.exe
  2⤵
  PID:4252
- C:\Windows\System\vqQMkPt.exe
  C:\Windows\System\vqQMkPt.exe
  2⤵
  PID:2576
- C:\Windows\System\LZXzIKJ.exe
  C:\Windows\System\LZXzIKJ.exe
  2⤵
  PID:4384
- C:\Windows\System\uMLxzWL.exe
  C:\Windows\System\uMLxzWL.exe
  2⤵
  PID:4516
- C:\Windows\System\vDJRFlS.exe
  C:\Windows\System\vDJRFlS.exe
  2⤵
  PID:4640
- C:\Windows\System\sitelzY.exe
  C:\Windows\System\sitelzY.exe
  2⤵
  PID:4704
- C:\Windows\System\TMYndIO.exe
  C:\Windows\System\TMYndIO.exe
  2⤵
  PID:4768
- C:\Windows\System\kSdVmwF.exe
  C:\Windows\System\kSdVmwF.exe
  2⤵
  PID:4832
- C:\Windows\System\zhaGFFO.exe
  C:\Windows\System\zhaGFFO.exe
  2⤵
  PID:4900
- C:\Windows\System\CNqlWQx.exe
  C:\Windows\System\CNqlWQx.exe
  2⤵
  PID:4940
- C:\Windows\System\TXIVNds.exe
  C:\Windows\System\TXIVNds.exe
  2⤵
  PID:5004
- C:\Windows\System\gxsUAmt.exe
  C:\Windows\System\gxsUAmt.exe
  2⤵
  PID:2060
- C:\Windows\System\HCyGpWh.exe
  C:\Windows\System\HCyGpWh.exe
  2⤵
  PID:2560
- C:\Windows\System\NnGBdqN.exe
  C:\Windows\System\NnGBdqN.exe
  2⤵
  PID:3132
- C:\Windows\System\SJWZClu.exe
  C:\Windows\System\SJWZClu.exe
  2⤵
  PID:3728
- C:\Windows\System\Ejyrwyu.exe
  C:\Windows\System\Ejyrwyu.exe
  2⤵
  PID:5152
- C:\Windows\System\ykJFDuB.exe
  C:\Windows\System\ykJFDuB.exe
  2⤵
  PID:5216
- C:\Windows\System\IETnKCc.exe
  C:\Windows\System\IETnKCc.exe
  2⤵
  PID:5280
- C:\Windows\System\aDdmdkB.exe
  C:\Windows\System\aDdmdkB.exe
  2⤵
  PID:5352
- C:\Windows\System\BqeMQYq.exe
  C:\Windows\System\BqeMQYq.exe
  2⤵
  PID:5416
- C:\Windows\System\VVWQSbQ.exe
  C:\Windows\System\VVWQSbQ.exe
  2⤵
  PID:5632
- C:\Windows\System\eYGLmDg.exe
  C:\Windows\System\eYGLmDg.exe
  2⤵
  PID:5780
- C:\Windows\System\kKhJRLO.exe
  C:\Windows\System\kKhJRLO.exe
  2⤵
  PID:2192
- C:\Windows\System\wUziCUO.exe
  C:\Windows\System\wUziCUO.exe
  2⤵
  PID:5876
- C:\Windows\System\JXFIsYR.exe
  C:\Windows\System\JXFIsYR.exe
  2⤵
  PID:5912
- C:\Windows\System\vZYeDlJ.exe
  C:\Windows\System\vZYeDlJ.exe
  2⤵
  PID:1776
- C:\Windows\System\VzxgyXS.exe
  C:\Windows\System\VzxgyXS.exe
  2⤵
  PID:3180
- C:\Windows\System\yosGjPa.exe
  C:\Windows\System\yosGjPa.exe
  2⤵
  PID:4276
- C:\Windows\System\dEreByP.exe
  C:\Windows\System\dEreByP.exe
  2⤵
  PID:2844
- C:\Windows\System\HOUSyBS.exe
  C:\Windows\System\HOUSyBS.exe
  2⤵
  PID:4368
- C:\Windows\System\eZZNMmY.exe
  C:\Windows\System\eZZNMmY.exe
  2⤵
  PID:4436
- C:\Windows\System\hINAaik.exe
  C:\Windows\System\hINAaik.exe
  2⤵
  PID:4528
- C:\Windows\System\UvqTuGL.exe
  C:\Windows\System\UvqTuGL.exe
  2⤵
  PID:4596
- C:\Windows\System\sWBdUHW.exe
  C:\Windows\System\sWBdUHW.exe
  2⤵
  PID:4660
- C:\Windows\System\KNkassO.exe
  C:\Windows\System\KNkassO.exe
  2⤵
  PID:4724
- C:\Windows\System\mOfmJWD.exe
  C:\Windows\System\mOfmJWD.exe
  2⤵
  PID:4788
- C:\Windows\System\YaqDqnr.exe
  C:\Windows\System\YaqDqnr.exe
  2⤵
  PID:4852
- C:\Windows\System\kGcbyhD.exe
  C:\Windows\System\kGcbyhD.exe
  2⤵
  PID:4924
- C:\Windows\System\oibcGrX.exe
  C:\Windows\System\oibcGrX.exe
  2⤵
  PID:5072
- C:\Windows\System\dgYtOqc.exe
  C:\Windows\System\dgYtOqc.exe
  2⤵
  PID:2936
- C:\Windows\System\rtgFHmi.exe
  C:\Windows\System\rtgFHmi.exe
  2⤵
  PID:4160
- C:\Windows\System\XDjKxrt.exe
  C:\Windows\System\XDjKxrt.exe
  2⤵
  PID:5200
- C:\Windows\System\wQqDWPt.exe
  C:\Windows\System\wQqDWPt.exe
  2⤵
  PID:5296
- C:\Windows\System\VbvIASJ.exe
  C:\Windows\System\VbvIASJ.exe
  2⤵
  PID:5368
- C:\Windows\System\BjGOIse.exe
  C:\Windows\System\BjGOIse.exe
  2⤵
  PID:5464
- C:\Windows\System\qITNVQM.exe
  C:\Windows\System\qITNVQM.exe
  2⤵
  PID:5592
- C:\Windows\System\bJcUbfz.exe
  C:\Windows\System\bJcUbfz.exe
  2⤵
  PID:5608
- C:\Windows\System\TEJZZWk.exe
  C:\Windows\System\TEJZZWk.exe
  2⤵
  PID:5700
- C:\Windows\System\DyHlgEX.exe
  C:\Windows\System\DyHlgEX.exe
  2⤵
  PID:5764
- C:\Windows\System\SOnHWOo.exe
  C:\Windows\System\SOnHWOo.exe
  2⤵
  PID:5828
- C:\Windows\System\PPCLxsf.exe
  C:\Windows\System\PPCLxsf.exe
  2⤵
  PID:1440
- C:\Windows\System\gZatspo.exe
  C:\Windows\System\gZatspo.exe
  2⤵
  PID:5896
- C:\Windows\System\IFGUtRN.exe
  C:\Windows\System\IFGUtRN.exe
  2⤵
  PID:6104
- C:\Windows\System\LaNDXxd.exe
  C:\Windows\System\LaNDXxd.exe
  2⤵
  PID:5992
- C:\Windows\System\RrYZhvN.exe
  C:\Windows\System\RrYZhvN.exe
  2⤵
  PID:3708
- C:\Windows\System\TDHioqM.exe
  C:\Windows\System\TDHioqM.exe
  2⤵
  PID:1152
- C:\Windows\System\WLgVbUH.exe
  C:\Windows\System\WLgVbUH.exe
  2⤵
  PID:3512
- C:\Windows\System\eAMtLcC.exe
  C:\Windows\System\eAMtLcC.exe
  2⤵
  PID:4072
- C:\Windows\System\EbEDhZd.exe
  C:\Windows\System\EbEDhZd.exe
  2⤵
  PID:4452
- C:\Windows\System\bIjlxcJ.exe
  C:\Windows\System\bIjlxcJ.exe
  2⤵
  PID:4804
- C:\Windows\System\ZoReUGP.exe
  C:\Windows\System\ZoReUGP.exe
  2⤵
  PID:3040
- C:\Windows\System\xulwJUa.exe
  C:\Windows\System\xulwJUa.exe
  2⤵
  PID:5148
- C:\Windows\System\gsGJKhR.exe
  C:\Windows\System\gsGJKhR.exe
  2⤵
  PID:5412
- C:\Windows\System\OWvSXGv.exe
  C:\Windows\System\OWvSXGv.exe
  2⤵
  PID:1816
- C:\Windows\System\gwedtdo.exe
  C:\Windows\System\gwedtdo.exe
  2⤵
  PID:4224
- C:\Windows\System\CFWTnfs.exe
  C:\Windows\System\CFWTnfs.exe
  2⤵
  PID:1120
- C:\Windows\System\amnXlHe.exe
  C:\Windows\System\amnXlHe.exe
  2⤵
  PID:4740
- C:\Windows\System\UqISQfD.exe
  C:\Windows\System\UqISQfD.exe
  2⤵
  PID:1388
- C:\Windows\System\kDwwsNA.exe
  C:\Windows\System\kDwwsNA.exe
  2⤵
  PID:4968
- C:\Windows\System\ZdnXqdk.exe
  C:\Windows\System\ZdnXqdk.exe
  2⤵
  PID:4124
- C:\Windows\System\drLZhBo.exe
  C:\Windows\System\drLZhBo.exe
  2⤵
  PID:5316
- C:\Windows\System\nsnercu.exe
  C:\Windows\System\nsnercu.exe
  2⤵
  PID:5448
- C:\Windows\System\BkjvmXQ.exe
  C:\Windows\System\BkjvmXQ.exe
  2⤵
  PID:2756
- C:\Windows\System\HOKxylm.exe
  C:\Windows\System\HOKxylm.exe
  2⤵
  PID:5528
- C:\Windows\System\JXUoELv.exe
  C:\Windows\System\JXUoELv.exe
  2⤵
  PID:5572
- C:\Windows\System\HWoKWoW.exe
  C:\Windows\System\HWoKWoW.exe
  2⤵
  PID:3436
- C:\Windows\System\GaytTwd.exe
  C:\Windows\System\GaytTwd.exe
  2⤵
  PID:5688
- C:\Windows\System\TjynSsQ.exe
  C:\Windows\System\TjynSsQ.exe
  2⤵
  PID:4140
- C:\Windows\System\hcstSUB.exe
  C:\Windows\System\hcstSUB.exe
  2⤵
  PID:4176
- C:\Windows\System\dEkHTrZ.exe
  C:\Windows\System\dEkHTrZ.exe
  2⤵
  PID:1864
- C:\Windows\System\UyJwMMu.exe
  C:\Windows\System\UyJwMMu.exe
  2⤵
  PID:2120
- C:\Windows\System\ntTdeUH.exe
  C:\Windows\System\ntTdeUH.exe
  2⤵
  PID:2348
- C:\Windows\System\pSXVVsr.exe
  C:\Windows\System\pSXVVsr.exe
  2⤵
  PID:3044
- C:\Windows\System\jTkEHvP.exe
  C:\Windows\System\jTkEHvP.exe
  2⤵
  PID:3420
- C:\Windows\System\EKFqbUc.exe
  C:\Windows\System\EKFqbUc.exe
  2⤵
  PID:2604
- C:\Windows\System\roCNpvd.exe
  C:\Windows\System\roCNpvd.exe
  2⤵
  PID:5848
- C:\Windows\System\fweqYYm.exe
  C:\Windows\System\fweqYYm.exe
  2⤵
  PID:2708
- C:\Windows\System\xWpkIBL.exe
  C:\Windows\System\xWpkIBL.exe
  2⤵
  PID:2836
- C:\Windows\System\kcSsYoF.exe
  C:\Windows\System\kcSsYoF.exe
  2⤵
  PID:5976
- C:\Windows\System\OTshcbp.exe
  C:\Windows\System\OTshcbp.exe
  2⤵
  PID:6040
- C:\Windows\System\VywrtYf.exe
  C:\Windows\System\VywrtYf.exe
  2⤵
  PID:2792
- C:\Windows\System\xdSNHdt.exe
  C:\Windows\System\xdSNHdt.exe
  2⤵
  PID:4756
- C:\Windows\System\VoWeKSZ.exe
  C:\Windows\System\VoWeKSZ.exe
  2⤵
  PID:3464
- C:\Windows\System\cVldlmx.exe
  C:\Windows\System\cVldlmx.exe
  2⤵
  PID:4920
- C:\Windows\System\pwrLEqg.exe
  C:\Windows\System\pwrLEqg.exe
  2⤵
  PID:4308
- C:\Windows\System\DxRzrML.exe
  C:\Windows\System\DxRzrML.exe
  2⤵
  PID:4432
- C:\Windows\System\vZvwVZp.exe
  C:\Windows\System\vZvwVZp.exe
  2⤵
  PID:4592
- C:\Windows\System\knhxIfL.exe
  C:\Windows\System\knhxIfL.exe
  2⤵
  PID:4848
- C:\Windows\System\BAPVRHM.exe
  C:\Windows\System\BAPVRHM.exe
  2⤵
  PID:4956
- C:\Windows\System\pvNAIeK.exe
  C:\Windows\System\pvNAIeK.exe
  2⤵
  PID:5048
- C:\Windows\System\nuDdJMU.exe
  C:\Windows\System\nuDdJMU.exe
  2⤵
  PID:5092
- C:\Windows\System\OBYyBYK.exe
  C:\Windows\System\OBYyBYK.exe
  2⤵
  PID:5100
- C:\Windows\System\lGNQeGh.exe
  C:\Windows\System\lGNQeGh.exe
  2⤵
  PID:5108
- C:\Windows\System\fTCqzVn.exe
  C:\Windows\System\fTCqzVn.exe
  2⤵
  PID:5060
- C:\Windows\System\BeeZhGV.exe
  C:\Windows\System\BeeZhGV.exe
  2⤵
  PID:3792
- C:\Windows\System\vIFshNy.exe
  C:\Windows\System\vIFshNy.exe
  2⤵
  PID:3856
- C:\Windows\System\vcMwEFb.exe
  C:\Windows\System\vcMwEFb.exe
  2⤵
  PID:3888
- C:\Windows\System\DEitdRX.exe
  C:\Windows\System\DEitdRX.exe
  2⤵
  PID:5064
- C:\Windows\System\pmfaCSI.exe
  C:\Windows\System\pmfaCSI.exe
  2⤵
  PID:3992
- C:\Windows\System\kCfHOoN.exe
  C:\Windows\System\kCfHOoN.exe
  2⤵
  PID:4056
- C:\Windows\System\KXfGUVY.exe
  C:\Windows\System\KXfGUVY.exe
  2⤵
  PID:3112
- C:\Windows\System\mElDeAO.exe
  C:\Windows\System\mElDeAO.exe
  2⤵
  PID:3400
- C:\Windows\System\PjxbAyX.exe
  C:\Windows\System\PjxbAyX.exe
  2⤵
  PID:3528
- C:\Windows\System\qVniQst.exe
  C:\Windows\System\qVniQst.exe
  2⤵
  PID:1352
- C:\Windows\System\qMpqNem.exe
  C:\Windows\System\qMpqNem.exe
  2⤵
  PID:964
- C:\Windows\System\ewBiJAf.exe
  C:\Windows\System\ewBiJAf.exe
  2⤵
  PID:2000
- C:\Windows\System\GegQdMe.exe
  C:\Windows\System\GegQdMe.exe
  2⤵
  PID:1588
- C:\Windows\System\RZjIkJk.exe
  C:\Windows\System\RZjIkJk.exe
  2⤵
  PID:1540
- C:\Windows\System\SmUhElA.exe
  C:\Windows\System\SmUhElA.exe
  2⤵
  PID:2040
- C:\Windows\System\ASNPady.exe
  C:\Windows\System\ASNPady.exe
  2⤵
  PID:1564
- C:\Windows\System\NlRZAyo.exe
  C:\Windows\System\NlRZAyo.exe
  2⤵
  PID:1168
- C:\Windows\System\sPLGIIO.exe
  C:\Windows\System\sPLGIIO.exe
  2⤵
  PID:2888
- C:\Windows\System\ZtqwbDR.exe
  C:\Windows\System\ZtqwbDR.exe
  2⤵
  PID:592
- C:\Windows\System\lRtSZzn.exe
  C:\Windows\System\lRtSZzn.exe
  2⤵
  PID:1044
- C:\Windows\System\KzWrGFM.exe
  C:\Windows\System\KzWrGFM.exe
  2⤵
  PID:2532
- C:\Windows\System\BzGbVEa.exe
  C:\Windows\System\BzGbVEa.exe
  2⤵
  PID:2100
- C:\Windows\System\YWELPlX.exe
  C:\Windows\System\YWELPlX.exe
  2⤵
  PID:3096
- C:\Windows\System\halWHZe.exe
  C:\Windows\System\halWHZe.exe
  2⤵
  PID:5136
- C:\Windows\System\ZeFwbxh.exe
  C:\Windows\System\ZeFwbxh.exe
  2⤵
  PID:2732
- C:\Windows\System\LhKTlCX.exe
  C:\Windows\System\LhKTlCX.exe
  2⤵
  PID:1284
- C:\Windows\System\EDCmSdS.exe
  C:\Windows\System\EDCmSdS.exe
  2⤵
  PID:3256
- C:\Windows\System\ENmItTA.exe
  C:\Windows\System\ENmItTA.exe
  2⤵
  PID:5264
- C:\Windows\System\GLZhrbV.exe
  C:\Windows\System\GLZhrbV.exe
  2⤵
  PID:5304
- C:\Windows\System\dXIMMRZ.exe
  C:\Windows\System\dXIMMRZ.exe
  2⤵
  PID:5428
- C:\Windows\System\FrNwFlX.exe
  C:\Windows\System\FrNwFlX.exe
  2⤵
  PID:5500
- C:\Windows\System\QttuUpm.exe
  C:\Windows\System\QttuUpm.exe
  2⤵
  PID:5544
- C:\Windows\System\LbJcNJh.exe
  C:\Windows\System\LbJcNJh.exe
  2⤵
  PID:3048
- C:\Windows\System\KUbHxov.exe
  C:\Windows\System\KUbHxov.exe
  2⤵
  PID:5732
- C:\Windows\System\uWIXHZc.exe
  C:\Windows\System\uWIXHZc.exe
  2⤵
  PID:6024
- C:\Windows\System\CApGeds.exe
  C:\Windows\System\CApGeds.exe
  2⤵
  PID:5800
- C:\Windows\System\fjIhjSu.exe
  C:\Windows\System\fjIhjSu.exe
  2⤵
  PID:1048
- C:\Windows\System\QheMtqy.exe
  C:\Windows\System\QheMtqy.exe
  2⤵
  PID:280
- C:\Windows\System\UIMvBuw.exe
  C:\Windows\System\UIMvBuw.exe
  2⤵
  PID:3548
- C:\Windows\System\qjCTClX.exe
  C:\Windows\System\qjCTClX.exe
  2⤵
  PID:3576
- C:\Windows\System\zykQbTW.exe
  C:\Windows\System\zykQbTW.exe
  2⤵
  PID:6084
- C:\Windows\System\jPxNiSe.exe
  C:\Windows\System\jPxNiSe.exe
  2⤵
  PID:3384
- C:\Windows\System\wYGrezI.exe
  C:\Windows\System\wYGrezI.exe
  2⤵
  PID:4416
- C:\Windows\System\lEkZWVw.exe
  C:\Windows\System\lEkZWVw.exe
  2⤵
  PID:4548
- C:\Windows\System\ZrylOcl.exe
  C:\Windows\System\ZrylOcl.exe
  2⤵
  PID:4864
- C:\Windows\System\OCFAJDn.exe
  C:\Windows\System\OCFAJDn.exe
  2⤵
  PID:4220
- C:\Windows\System\SzaKjPd.exe
  C:\Windows\System\SzaKjPd.exe
  2⤵
  PID:5720
- C:\Windows\System\qmchauO.exe
  C:\Windows\System\qmchauO.exe
  2⤵
  PID:4204
- C:\Windows\System\WgbYits.exe
  C:\Windows\System\WgbYits.exe
  2⤵
  PID:5564
- C:\Windows\System\DilEkEJ.exe
  C:\Windows\System\DilEkEJ.exe
  2⤵
  PID:2688
- C:\Windows\System\oYgaxmW.exe
  C:\Windows\System\oYgaxmW.exe
  2⤵
  PID:2096
- C:\Windows\System\yqDxaFg.exe
  C:\Windows\System\yqDxaFg.exe
  2⤵
  PID:1748
- C:\Windows\System\zNQYSMU.exe
  C:\Windows\System\zNQYSMU.exe
  2⤵
  PID:5520
- C:\Windows\System\EPSURVl.exe
  C:\Windows\System\EPSURVl.exe
  2⤵
  PID:2824
- C:\Windows\System\mBDWyJJ.exe
  C:\Windows\System\mBDWyJJ.exe
  2⤵
  PID:1788
- C:\Windows\System\bdkAJwN.exe
  C:\Windows\System\bdkAJwN.exe
  2⤵
  PID:2804
- C:\Windows\System\xWRmiRR.exe
  C:\Windows\System\xWRmiRR.exe
  2⤵
  PID:3192
- C:\Windows\System\dpKyIFA.exe
  C:\Windows\System\dpKyIFA.exe
  2⤵
  PID:3776
- C:\Windows\System\SWbdPPA.exe
  C:\Windows\System\SWbdPPA.exe
  2⤵
  PID:3948
- C:\Windows\System\pgMbqBd.exe
  C:\Windows\System\pgMbqBd.exe
  2⤵
  PID:2512
- C:\Windows\System\ouHMnwu.exe
  C:\Windows\System\ouHMnwu.exe
  2⤵
  PID:2700
- C:\Windows\System\ouAcajj.exe
  C:\Windows\System\ouAcajj.exe
  2⤵
  PID:2996
- C:\Windows\System\rKtKGSI.exe
  C:\Windows\System\rKtKGSI.exe
  2⤵
  PID:4496
- C:\Windows\System\MFjvxFs.exe
  C:\Windows\System\MFjvxFs.exe
  2⤵
  PID:2516
- C:\Windows\System\aCwCgnj.exe
  C:\Windows\System\aCwCgnj.exe
  2⤵
  PID:1768
- C:\Windows\System\gDKocOY.exe
  C:\Windows\System\gDKocOY.exe
  2⤵
  PID:5080
- C:\Windows\System\qqyFKUW.exe
  C:\Windows\System\qqyFKUW.exe
  2⤵
  PID:3760
- C:\Windows\System\dennpLp.exe
  C:\Windows\System\dennpLp.exe
  2⤵
  PID:3960
- C:\Windows\System\qdqSgLT.exe
  C:\Windows\System\qdqSgLT.exe
  2⤵
  PID:4656
- C:\Windows\System\QVHoyIL.exe
  C:\Windows\System\QVHoyIL.exe
  2⤵
  PID:4820
- C:\Windows\System\SdgoobM.exe
  C:\Windows\System\SdgoobM.exe
  2⤵
  PID:5052
- C:\Windows\System\dKhMQqv.exe
  C:\Windows\System\dKhMQqv.exe
  2⤵
  PID:4028
- C:\Windows\System\zXPwhGC.exe
  C:\Windows\System\zXPwhGC.exe
  2⤵
  PID:2748
- C:\Windows\System\mSSXqZa.exe
  C:\Windows\System\mSSXqZa.exe
  2⤵
  PID:2436
- C:\Windows\System\onTgPUw.exe
  C:\Windows\System\onTgPUw.exe
  2⤵
  PID:2776
- C:\Windows\System\dPWRFGe.exe
  C:\Windows\System\dPWRFGe.exe
  2⤵
  PID:3176
- C:\Windows\System\RvcCgRm.exe
  C:\Windows\System\RvcCgRm.exe
  2⤵
  PID:5504
- C:\Windows\System\eXtAvNC.exe
  C:\Windows\System\eXtAvNC.exe
  2⤵
  PID:3224
- C:\Windows\System\sZjnixA.exe
  C:\Windows\System\sZjnixA.exe
  2⤵
  PID:644
- C:\Windows\System\vjcpxkn.exe
  C:\Windows\System\vjcpxkn.exe
  2⤵
  PID:2452
- C:\Windows\System\jqSEPdn.exe
  C:\Windows\System\jqSEPdn.exe
  2⤵
  PID:868
- C:\Windows\System\DyYkcWO.exe
  C:\Windows\System\DyYkcWO.exe
  2⤵
  PID:5332
- C:\Windows\System\WicRdxL.exe
  C:\Windows\System\WicRdxL.exe
  2⤵
  PID:6052
- C:\Windows\System\gyAloYa.exe
  C:\Windows\System\gyAloYa.exe
  2⤵
  PID:4288
- C:\Windows\System\xmBlsSo.exe
  C:\Windows\System\xmBlsSo.exe
  2⤵
  PID:4708
- C:\Windows\System\AeHVRso.exe
  C:\Windows\System\AeHVRso.exe
  2⤵
  PID:2520
- C:\Windows\System\WoRjnmS.exe
  C:\Windows\System\WoRjnmS.exe
  2⤵
  PID:1792
- C:\Windows\System\bVvazIX.exe
  C:\Windows\System\bVvazIX.exe
  2⤵
  PID:5236
- C:\Windows\System\ACBoeah.exe
  C:\Windows\System\ACBoeah.exe
  2⤵
  PID:5036
- C:\Windows\System\AxNRmAq.exe
  C:\Windows\System\AxNRmAq.exe
  2⤵
  PID:3000
- C:\Windows\System\tSeZFzD.exe
  C:\Windows\System\tSeZFzD.exe
  2⤵
  PID:1636
- C:\Windows\System\wBDglhG.exe
  C:\Windows\System\wBDglhG.exe
  2⤵
  PID:1404
- C:\Windows\System\FvrvpoH.exe
  C:\Windows\System\FvrvpoH.exe
  2⤵
  PID:2036
- C:\Windows\System\cLGMjYR.exe
  C:\Windows\System\cLGMjYR.exe
  2⤵
  PID:1600
- C:\Windows\System\lvUMgPt.exe
  C:\Windows\System\lvUMgPt.exe
  2⤵
  PID:5596
- C:\Windows\System\FQqrbHo.exe
  C:\Windows\System\FQqrbHo.exe
  2⤵
  PID:5672
- C:\Windows\System\HjfEwtU.exe
  C:\Windows\System\HjfEwtU.exe
  2⤵
  PID:4676
- C:\Windows\System\dLyWEGo.exe
  C:\Windows\System\dLyWEGo.exe
  2⤵
  PID:5716
- C:\Windows\System\ugkGlND.exe
  C:\Windows\System\ugkGlND.exe
  2⤵
  PID:3640
- C:\Windows\System\THNvFMG.exe
  C:\Windows\System\THNvFMG.exe
  2⤵
  PID:5480
- C:\Windows\System\cQlqnWq.exe
  C:\Windows\System\cQlqnWq.exe
  2⤵
  PID:2632
- C:\Windows\System\EySKMQh.exe
  C:\Windows\System\EySKMQh.exe
  2⤵
  PID:3024
- C:\Windows\System\xBDeTXC.exe
  C:\Windows\System\xBDeTXC.exe
  2⤵
  PID:636
- C:\Windows\System\KxozXcu.exe
  C:\Windows\System\KxozXcu.exe
  2⤵
  PID:4560
- C:\Windows\System\kZgninI.exe
  C:\Windows\System\kZgninI.exe
  2⤵
  PID:4272
- C:\Windows\System\gZBnuCB.exe
  C:\Windows\System\gZBnuCB.exe
  2⤵
  PID:5016
- C:\Windows\System\SNRtQQz.exe
  C:\Windows\System\SNRtQQz.exe
  2⤵
  PID:3240
- C:\Windows\System\FmSBbme.exe
  C:\Windows\System\FmSBbme.exe
  2⤵
  PID:1920
- C:\Windows\System\zsWRBvq.exe
  C:\Windows\System\zsWRBvq.exe
  2⤵
  PID:5068
- C:\Windows\System\dXBuXsw.exe
  C:\Windows\System\dXBuXsw.exe
  2⤵
  PID:292
- C:\Windows\System\vPkrYgV.exe
  C:\Windows\System\vPkrYgV.exe
  2⤵
  PID:4692
- C:\Windows\System\htimKUU.exe
  C:\Windows\System\htimKUU.exe
  2⤵
  PID:3032
- C:\Windows\System\LWMXJHM.exe
  C:\Windows\System\LWMXJHM.exe
  2⤵
  PID:2140
- C:\Windows\System\ZiSWPwN.exe
  C:\Windows\System\ZiSWPwN.exe
  2⤵
  PID:5168
- C:\Windows\System\WQoUTgX.exe
  C:\Windows\System\WQoUTgX.exe
  2⤵
  PID:5552
- C:\Windows\System\TTdDZcf.exe
  C:\Windows\System\TTdDZcf.exe
  2⤵
  PID:3656
- C:\Windows\System\OGMzBoa.exe
  C:\Windows\System\OGMzBoa.exe
  2⤵
  PID:2524
- C:\Windows\System\TEzeGjJ.exe
  C:\Windows\System\TEzeGjJ.exe
  2⤵
  PID:2320
- C:\Windows\System\kBYjoeK.exe
  C:\Windows\System\kBYjoeK.exe
  2⤵
  PID:3744
- C:\Windows\System\LrsqRbt.exe
  C:\Windows\System\LrsqRbt.exe
  2⤵
  PID:3912
- C:\Windows\System\GlniIiY.exe
  C:\Windows\System\GlniIiY.exe
  2⤵
  PID:3996
- C:\Windows\System\QACpLul.exe
  C:\Windows\System\QACpLul.exe
  2⤵
  PID:5748
- C:\Windows\System\nSPcqkm.exe
  C:\Windows\System\nSPcqkm.exe
  2⤵
  PID:5892
- C:\Windows\System\qCmvUCh.exe
  C:\Windows\System\qCmvUCh.exe
  2⤵
  PID:2952
- C:\Windows\System\WHdRtKQ.exe
  C:\Windows\System\WHdRtKQ.exe
  2⤵
  PID:5212
- C:\Windows\System\sKUikgq.exe
  C:\Windows\System\sKUikgq.exe
  2⤵
  PID:2316
- C:\Windows\System\fToeQuC.exe
  C:\Windows\System\fToeQuC.exe
  2⤵
  PID:5944
- C:\Windows\System\kZlDIRn.exe
  C:\Windows\System\kZlDIRn.exe
  2⤵
  PID:3116
- C:\Windows\System\uYTyVRX.exe
  C:\Windows\System\uYTyVRX.exe
  2⤵
  PID:2768
- C:\Windows\System\GigiWlV.exe
  C:\Windows\System\GigiWlV.exe
  2⤵
  PID:4076
- C:\Windows\System\UTYRKfY.exe
  C:\Windows\System\UTYRKfY.exe
  2⤵
  PID:4868
- C:\Windows\System\ptKHkQr.exe
  C:\Windows\System\ptKHkQr.exe
  2⤵
  PID:2332
- C:\Windows\System\AVcVmmx.exe
  C:\Windows\System\AVcVmmx.exe
  2⤵
  PID:3980
- C:\Windows\System\IMTBqhk.exe
  C:\Windows\System\IMTBqhk.exe
  2⤵
  PID:2984
- C:\Windows\System\LUABkel.exe
  C:\Windows\System\LUABkel.exe
  2⤵
  PID:6148
- C:\Windows\System\aXZKcVp.exe
  C:\Windows\System\aXZKcVp.exe
  2⤵
  PID:6164
- C:\Windows\System\eBRkrCH.exe
  C:\Windows\System\eBRkrCH.exe
  2⤵
  PID:6180
- C:\Windows\System\EunJKRT.exe
  C:\Windows\System\EunJKRT.exe
  2⤵
  PID:6196
- C:\Windows\System\WZOyhPU.exe
  C:\Windows\System\WZOyhPU.exe
  2⤵
  PID:6212
- C:\Windows\System\uHdVQCm.exe
  C:\Windows\System\uHdVQCm.exe
  2⤵
  PID:6228
- C:\Windows\System\pCjyaVT.exe
  C:\Windows\System\pCjyaVT.exe
  2⤵
  PID:6244
- C:\Windows\System\HUvknrV.exe
  C:\Windows\System\HUvknrV.exe
  2⤵
  PID:6260
- C:\Windows\System\gtsLror.exe
  C:\Windows\System\gtsLror.exe
  2⤵
  PID:6276
- C:\Windows\System\HIriqRp.exe
  C:\Windows\System\HIriqRp.exe
  2⤵
  PID:6292
- C:\Windows\System\UujzClx.exe
  C:\Windows\System\UujzClx.exe
  2⤵
  PID:6308
- C:\Windows\System\oifhnPX.exe
  C:\Windows\System\oifhnPX.exe
  2⤵
  PID:6324
- C:\Windows\System\CdaFVfT.exe
  C:\Windows\System\CdaFVfT.exe
  2⤵
  PID:6340
- C:\Windows\System\wQeuBEl.exe
  C:\Windows\System\wQeuBEl.exe
  2⤵
  PID:6356
- C:\Windows\System\YiqJVOJ.exe
  C:\Windows\System\YiqJVOJ.exe
  2⤵
  PID:6372
- C:\Windows\System\rhgjSyk.exe
  C:\Windows\System\rhgjSyk.exe
  2⤵
  PID:6388
- C:\Windows\System\sEwFWzZ.exe
  C:\Windows\System\sEwFWzZ.exe
  2⤵
  PID:6404
- C:\Windows\System\krlxRhy.exe
  C:\Windows\System\krlxRhy.exe
  2⤵
  PID:6420
- C:\Windows\System\eZhKXzm.exe
  C:\Windows\System\eZhKXzm.exe
  2⤵
  PID:6436
- C:\Windows\System\beRBzQN.exe
  C:\Windows\System\beRBzQN.exe
  2⤵
  PID:6452
- C:\Windows\System\lvOotiq.exe
  C:\Windows\System\lvOotiq.exe
  2⤵
  PID:6468
- C:\Windows\System\GJVZMdT.exe
  C:\Windows\System\GJVZMdT.exe
  2⤵
  PID:6484
- C:\Windows\System\CYwnWbp.exe
  C:\Windows\System\CYwnWbp.exe
  2⤵
  PID:6500
- C:\Windows\System\qnQnfhc.exe
  C:\Windows\System\qnQnfhc.exe
  2⤵
  PID:6516
- C:\Windows\System\nslqmXg.exe
  C:\Windows\System\nslqmXg.exe
  2⤵
  PID:6532
- C:\Windows\System\BOQPqSw.exe
  C:\Windows\System\BOQPqSw.exe
  2⤵
  PID:6548
- C:\Windows\System\TLmgtgR.exe
  C:\Windows\System\TLmgtgR.exe
  2⤵
  PID:6564
- C:\Windows\System\OiYSRbm.exe
  C:\Windows\System\OiYSRbm.exe
  2⤵
  PID:6580
- C:\Windows\System\iwkYLkA.exe
  C:\Windows\System\iwkYLkA.exe
  2⤵
  PID:6600
- C:\Windows\System\ySsyEuQ.exe
  C:\Windows\System\ySsyEuQ.exe
  2⤵
  PID:6616
- C:\Windows\System\HiPiNAz.exe
  C:\Windows\System\HiPiNAz.exe
  2⤵
  PID:6632
- C:\Windows\System\QKKLxMb.exe
  C:\Windows\System\QKKLxMb.exe
  2⤵
  PID:6648
- C:\Windows\System\mSHHUmZ.exe
  C:\Windows\System\mSHHUmZ.exe
  2⤵
  PID:6664
- C:\Windows\System\RtmKNfI.exe
  C:\Windows\System\RtmKNfI.exe
  2⤵
  PID:6680
- C:\Windows\System\QqclXzE.exe
  C:\Windows\System\QqclXzE.exe
  2⤵
  PID:6696
- C:\Windows\System\edfisZU.exe
  C:\Windows\System\edfisZU.exe
  2⤵
  PID:6712
- C:\Windows\System\DwkXvJA.exe
  C:\Windows\System\DwkXvJA.exe
  2⤵
  PID:6728
- C:\Windows\System\KYyCgRD.exe
  C:\Windows\System\KYyCgRD.exe
  2⤵
  PID:6744
- C:\Windows\System\VvfzHkT.exe
  C:\Windows\System\VvfzHkT.exe
  2⤵
  PID:6760
- C:\Windows\System\bbxLViC.exe
  C:\Windows\System\bbxLViC.exe
  2⤵
  PID:6776
- C:\Windows\System\ZnMRVRg.exe
  C:\Windows\System\ZnMRVRg.exe
  2⤵
  PID:6792
- C:\Windows\System\kjhrjHw.exe
  C:\Windows\System\kjhrjHw.exe
  2⤵
  PID:6808
- C:\Windows\System\QzNKZFe.exe
  C:\Windows\System\QzNKZFe.exe
  2⤵
  PID:6824
- C:\Windows\System\ozkZySK.exe
  C:\Windows\System\ozkZySK.exe
  2⤵
  PID:6840
- C:\Windows\System\wekOBjP.exe
  C:\Windows\System\wekOBjP.exe
  2⤵
  PID:6856
- C:\Windows\System\JuumCVu.exe
  C:\Windows\System\JuumCVu.exe
  2⤵
  PID:6872
- C:\Windows\System\ORqngEN.exe
  C:\Windows\System\ORqngEN.exe
  2⤵
  PID:6888
- C:\Windows\System\xIQwsHW.exe
  C:\Windows\System\xIQwsHW.exe
  2⤵
  PID:6904
- C:\Windows\System\PDYOtOH.exe
  C:\Windows\System\PDYOtOH.exe
  2⤵
  PID:6920
- C:\Windows\System\qZJHdQo.exe
  C:\Windows\System\qZJHdQo.exe
  2⤵
  PID:6936
- C:\Windows\System\ecJfbrc.exe
  C:\Windows\System\ecJfbrc.exe
  2⤵
  PID:6952
- C:\Windows\System\vHHpRFa.exe
  C:\Windows\System\vHHpRFa.exe
  2⤵
  PID:6968
- C:\Windows\System\bljfixz.exe
  C:\Windows\System\bljfixz.exe
  2⤵
  PID:6984
- C:\Windows\System\ElRGcCU.exe
  C:\Windows\System\ElRGcCU.exe
  2⤵
  PID:7000
- C:\Windows\System\NQNwFTu.exe
  C:\Windows\System\NQNwFTu.exe
  2⤵
  PID:7016
- C:\Windows\System\QhLITIn.exe
  C:\Windows\System\QhLITIn.exe
  2⤵
  PID:7032
- C:\Windows\System\nEErZfZ.exe
  C:\Windows\System\nEErZfZ.exe
  2⤵
  PID:7048
- C:\Windows\System\gNDitGM.exe
  C:\Windows\System\gNDitGM.exe
  2⤵
  PID:7064
- C:\Windows\System\WdtGWrx.exe
  C:\Windows\System\WdtGWrx.exe
  2⤵
  PID:7080
- C:\Windows\System\xJVenvD.exe
  C:\Windows\System\xJVenvD.exe
  2⤵
  PID:7096
- C:\Windows\System\RqKlHwo.exe
  C:\Windows\System\RqKlHwo.exe
  2⤵
  PID:7112
- C:\Windows\System\KIblOHd.exe
  C:\Windows\System\KIblOHd.exe
  2⤵
  PID:7128
- C:\Windows\System\oNvtiQc.exe
  C:\Windows\System\oNvtiQc.exe
  2⤵
  PID:7144
- C:\Windows\System\Hxcizfu.exe
  C:\Windows\System\Hxcizfu.exe
  2⤵
  PID:7160
- C:\Windows\System\KgVrXRi.exe
  C:\Windows\System\KgVrXRi.exe
  2⤵
  PID:1764
- C:\Windows\System\zrpjEJq.exe
  C:\Windows\System\zrpjEJq.exe
  2⤵
  PID:5812
- C:\Windows\System\vmjBCeq.exe
  C:\Windows\System\vmjBCeq.exe
  2⤵
  PID:5184
- C:\Windows\System\WwXxGzR.exe
  C:\Windows\System\WwXxGzR.exe
  2⤵
  PID:3796
- C:\Windows\System\vGhgtKm.exe
  C:\Windows\System\vGhgtKm.exe
  2⤵
  PID:4092
- C:\Windows\System\roSzzRx.exe
  C:\Windows\System\roSzzRx.exe
  2⤵
  PID:5396
- C:\Windows\System\DwXzznx.exe
  C:\Windows\System\DwXzznx.exe
  2⤵
  PID:6304
- C:\Windows\System\CTNLJJT.exe
  C:\Windows\System\CTNLJJT.exe
  2⤵
  PID:4608
- C:\Windows\System\kxbJDyb.exe
  C:\Windows\System\kxbJDyb.exe
  2⤵
  PID:6300
- C:\Windows\System\daiTHKi.exe
  C:\Windows\System\daiTHKi.exe
  2⤵
  PID:2544
- C:\Windows\System\QRJCvRw.exe
  C:\Windows\System\QRJCvRw.exe
  2⤵
  PID:6188
- C:\Windows\System\lzIOgzD.exe
  C:\Windows\System\lzIOgzD.exe
  2⤵
  PID:4324
- C:\Windows\System\MTwVGnW.exe
  C:\Windows\System\MTwVGnW.exe
  2⤵
  PID:3260
- C:\Windows\System\YbOoSrU.exe
  C:\Windows\System\YbOoSrU.exe
  2⤵
  PID:6464
- C:\Windows\System\ZWtyhZS.exe
  C:\Windows\System\ZWtyhZS.exe
  2⤵
  PID:6284
- C:\Windows\System\YFxdFXS.exe
  C:\Windows\System\YFxdFXS.exe
  2⤵
  PID:6160
- C:\Windows\System\QzdNdqs.exe
  C:\Windows\System\QzdNdqs.exe
  2⤵
  PID:6224
- C:\Windows\System\YIDgARD.exe
  C:\Windows\System\YIDgARD.exe
  2⤵
  PID:6320
- C:\Windows\System\smpYMAy.exe
  C:\Windows\System\smpYMAy.exe
  2⤵
  PID:6412
- C:\Windows\System\LUgeWPY.exe
  C:\Windows\System\LUgeWPY.exe
  2⤵
  PID:6476
- C:\Windows\System\VXurquM.exe
  C:\Windows\System\VXurquM.exe
  2⤵
  PID:6572
- C:\Windows\System\Nuqdyhg.exe
  C:\Windows\System\Nuqdyhg.exe
  2⤵
  PID:6528
- C:\Windows\System\XijYOVL.exe
  C:\Windows\System\XijYOVL.exe
  2⤵
  PID:6492
- C:\Windows\System\TcenNiE.exe
  C:\Windows\System\TcenNiE.exe
  2⤵
  PID:6612
- C:\Windows\System\qOhmrmH.exe
  C:\Windows\System\qOhmrmH.exe
  2⤵
  PID:6624
- C:\Windows\System\kCaOHNO.exe
  C:\Windows\System\kCaOHNO.exe
  2⤵
  PID:6720
- C:\Windows\System\etovrBM.exe
  C:\Windows\System\etovrBM.exe
  2⤵
  PID:6756
- C:\Windows\System\kOkdGiX.exe
  C:\Windows\System\kOkdGiX.exe
  2⤵
  PID:6644
- C:\Windows\System\Vqwyepb.exe
  C:\Windows\System\Vqwyepb.exe
  2⤵
  PID:6864
- C:\Windows\System\dpgvuCK.exe
  C:\Windows\System\dpgvuCK.exe
  2⤵
  PID:6676
- C:\Windows\System\rJsbzlk.exe
  C:\Windows\System\rJsbzlk.exe
  2⤵
  PID:6768
- C:\Windows\System\qUbDjou.exe
  C:\Windows\System\qUbDjou.exe
  2⤵
  PID:6880
- C:\Windows\System\xwiSEgw.exe
  C:\Windows\System\xwiSEgw.exe
  2⤵
  PID:6896
- C:\Windows\System\DggZtLH.exe
  C:\Windows\System\DggZtLH.exe
  2⤵
  PID:6928
- C:\Windows\System\oeMfNsi.exe
  C:\Windows\System\oeMfNsi.exe
  2⤵
  PID:6992
- C:\Windows\System\NMXiJuM.exe
  C:\Windows\System\NMXiJuM.exe
  2⤵
  PID:6976
- C:\Windows\System\MGLQPTv.exe
  C:\Windows\System\MGLQPTv.exe
  2⤵
  PID:7072
- C:\Windows\System\cDEoAHI.exe
  C:\Windows\System\cDEoAHI.exe
  2⤵
  PID:7040
- C:\Windows\System\xCzbYUQ.exe
  C:\Windows\System\xCzbYUQ.exe
  2⤵
  PID:7136
- C:\Windows\System\IeNNhEb.exe
  C:\Windows\System\IeNNhEb.exe
  2⤵
  PID:7088
- C:\Windows\System\lgGBtME.exe
  C:\Windows\System\lgGBtME.exe
  2⤵
  PID:6056
- C:\Windows\System\urschul.exe
  C:\Windows\System\urschul.exe
  2⤵
  PID:4888
- C:\Windows\System\QfGczbb.exe
  C:\Windows\System\QfGczbb.exe
  2⤵
  PID:6272
- C:\Windows\System\sckRHjf.exe
  C:\Windows\System\sckRHjf.exe
  2⤵
  PID:6364
- C:\Windows\System\cMNspLx.exe
  C:\Windows\System\cMNspLx.exe
  2⤵
  PID:6432
- C:\Windows\System\VsVjqhx.exe
  C:\Windows\System\VsVjqhx.exe
  2⤵
  PID:6352
- C:\Windows\System\wHmuVpo.exe
  C:\Windows\System\wHmuVpo.exe
  2⤵
  PID:6540
- C:\Windows\System\OOmFbDx.exe
  C:\Windows\System\OOmFbDx.exe
  2⤵
  PID:5752
- C:\Windows\System\jRDOpwM.exe
  C:\Windows\System\jRDOpwM.exe
  2⤵
  PID:6656
- C:\Windows\System\okBMGpw.exe
  C:\Windows\System\okBMGpw.exe
  2⤵
  PID:6444
- C:\Windows\System\VcDHDVz.exe
  C:\Windows\System\VcDHDVz.exe
  2⤵
  PID:6316
- C:\Windows\System\gXbXiDX.exe
  C:\Windows\System\gXbXiDX.exe
  2⤵
  PID:6192
- C:\Windows\System\uyXNETe.exe
  C:\Windows\System\uyXNETe.exe
  2⤵
  PID:1660
- C:\Windows\System\oUruAZE.exe
  C:\Windows\System\oUruAZE.exe
  2⤵
  PID:6288
- C:\Windows\System\pCjwVSV.exe
  C:\Windows\System\pCjwVSV.exe
  2⤵
  PID:6788
- C:\Windows\System\zOItTOi.exe
  C:\Windows\System\zOItTOi.exe
  2⤵
  PID:6736
- C:\Windows\System\ZODdyQM.exe
  C:\Windows\System\ZODdyQM.exe
  2⤵
  PID:6820
- C:\Windows\System\ODpKavr.exe
  C:\Windows\System\ODpKavr.exe
  2⤵
  PID:6932
- C:\Windows\System\AUfdxiF.exe
  C:\Windows\System\AUfdxiF.exe
  2⤵
  PID:7108
- C:\Windows\System\yJwzzIs.exe
  C:\Windows\System\yJwzzIs.exe
  2⤵
  PID:6236
- C:\Windows\System\dIRpNkm.exe
  C:\Windows\System\dIRpNkm.exe
  2⤵
  PID:6384
- C:\Windows\System\bAKQXlT.exe
  C:\Windows\System\bAKQXlT.exe
  2⤵
  PID:6448
- C:\Windows\System\wepjJoz.exe
  C:\Windows\System\wepjJoz.exe
  2⤵
  PID:6400
- C:\Windows\System\dxcmdxv.exe
  C:\Windows\System\dxcmdxv.exe
  2⤵
  PID:6944
- C:\Windows\System\ZsFeAuH.exe
  C:\Windows\System\ZsFeAuH.exe
  2⤵
  PID:7008
- C:\Windows\System\milTeZF.exe
  C:\Windows\System\milTeZF.exe
  2⤵
  PID:4112
- C:\Windows\System\MlVZjHn.exe
  C:\Windows\System\MlVZjHn.exe
  2⤵
  PID:2664
- C:\Windows\System\WeYSBbC.exe
  C:\Windows\System\WeYSBbC.exe
  2⤵
  PID:6832
- C:\Windows\System\ytEpmfe.exe
  C:\Windows\System\ytEpmfe.exe
  2⤵
  PID:5816
- C:\Windows\System\aWpWsWR.exe
  C:\Windows\System\aWpWsWR.exe
  2⤵
  PID:6852
- C:\Windows\System\tMWJIti.exe
  C:\Windows\System\tMWJIti.exe
  2⤵
  PID:7156
- C:\Windows\System\JcjnTbX.exe
  C:\Windows\System\JcjnTbX.exe
  2⤵
  PID:7060
- C:\Windows\System\COworub.exe
  C:\Windows\System\COworub.exe
  2⤵
  PID:7120
- C:\Windows\System\qEhrOnR.exe
  C:\Windows\System\qEhrOnR.exe
  2⤵
  PID:6688
- C:\Windows\System\XKWkhiS.exe
  C:\Windows\System\XKWkhiS.exe
  2⤵
  PID:7176
- C:\Windows\System\sZPmeRM.exe
  C:\Windows\System\sZPmeRM.exe
  2⤵
  PID:7192
- C:\Windows\System\CUCAJvb.exe
  C:\Windows\System\CUCAJvb.exe
  2⤵
  PID:7208
- C:\Windows\System\niHAewg.exe
  C:\Windows\System\niHAewg.exe
  2⤵
  PID:7224
- C:\Windows\System\bkqdcCX.exe
  C:\Windows\System\bkqdcCX.exe
  2⤵
  PID:7240
- C:\Windows\System\tljOZiq.exe
  C:\Windows\System\tljOZiq.exe
  2⤵
  PID:7256
- C:\Windows\System\sQkNqwn.exe
  C:\Windows\System\sQkNqwn.exe
  2⤵
  PID:7272
- C:\Windows\System\EvGeEni.exe
  C:\Windows\System\EvGeEni.exe
  2⤵
  PID:7288
- C:\Windows\System\xiWmzvL.exe
  C:\Windows\System\xiWmzvL.exe
  2⤵
  PID:7304
- C:\Windows\System\kqtNpMn.exe
  C:\Windows\System\kqtNpMn.exe
  2⤵
  PID:7320
- C:\Windows\System\nKKZUaE.exe
  C:\Windows\System\nKKZUaE.exe
  2⤵
  PID:7336
- C:\Windows\System\dMBNTri.exe
  C:\Windows\System\dMBNTri.exe
  2⤵
  PID:7352
- C:\Windows\System\KxwviGy.exe
  C:\Windows\System\KxwviGy.exe
  2⤵
  PID:7368
- C:\Windows\System\PVYevwy.exe
  C:\Windows\System\PVYevwy.exe
  2⤵
  PID:7384
- C:\Windows\System\uUDAHYp.exe
  C:\Windows\System\uUDAHYp.exe
  2⤵
  PID:7400
- C:\Windows\System\ydcBtJj.exe
  C:\Windows\System\ydcBtJj.exe
  2⤵
  PID:7416
- C:\Windows\System\ESOCOeh.exe
  C:\Windows\System\ESOCOeh.exe
  2⤵
  PID:7432
- C:\Windows\System\DvGQqwB.exe
  C:\Windows\System\DvGQqwB.exe
  2⤵
  PID:7448
- C:\Windows\System\GkwLriQ.exe
  C:\Windows\System\GkwLriQ.exe
  2⤵
  PID:7464
- C:\Windows\System\FuCZShg.exe
  C:\Windows\System\FuCZShg.exe
  2⤵
  PID:7480
- C:\Windows\System\cMiZcFR.exe
  C:\Windows\System\cMiZcFR.exe
  2⤵
  PID:7496
- C:\Windows\System\MlDrmcw.exe
  C:\Windows\System\MlDrmcw.exe
  2⤵
  PID:7512
- C:\Windows\System\BnyCXsH.exe
  C:\Windows\System\BnyCXsH.exe
  2⤵
  PID:7528
- C:\Windows\System\ECvvlkN.exe
  C:\Windows\System\ECvvlkN.exe
  2⤵
  PID:7544
- C:\Windows\System\uxMtghi.exe
  C:\Windows\System\uxMtghi.exe
  2⤵
  PID:7560
- C:\Windows\System\uNxRuCP.exe
  C:\Windows\System\uNxRuCP.exe
  2⤵
  PID:7576
- C:\Windows\System\TaSthJU.exe
  C:\Windows\System\TaSthJU.exe
  2⤵
  PID:7592
- C:\Windows\System\YDhQHAS.exe
  C:\Windows\System\YDhQHAS.exe
  2⤵
  PID:7608
- C:\Windows\System\SdgxQKy.exe
  C:\Windows\System\SdgxQKy.exe
  2⤵
  PID:7624
- C:\Windows\System\ILhJifu.exe
  C:\Windows\System\ILhJifu.exe
  2⤵
  PID:7640
- C:\Windows\System\ZlyfEhA.exe
  C:\Windows\System\ZlyfEhA.exe
  2⤵
  PID:7656
- C:\Windows\System\SmUcIOF.exe
  C:\Windows\System\SmUcIOF.exe
  2⤵
  PID:7672
- C:\Windows\System\CdMetiq.exe
  C:\Windows\System\CdMetiq.exe
  2⤵
  PID:7688
- C:\Windows\System\huKgQjr.exe
  C:\Windows\System\huKgQjr.exe
  2⤵
  PID:7704
- C:\Windows\System\rotpOLk.exe
  C:\Windows\System\rotpOLk.exe
  2⤵
  PID:7720
- C:\Windows\System\aoCmmIg.exe
  C:\Windows\System\aoCmmIg.exe
  2⤵
  PID:7736
- C:\Windows\System\yTMSumv.exe
  C:\Windows\System\yTMSumv.exe
  2⤵
  PID:7752
- C:\Windows\System\WmvqXge.exe
  C:\Windows\System\WmvqXge.exe
  2⤵
  PID:7768
- C:\Windows\System\skPEoVJ.exe
  C:\Windows\System\skPEoVJ.exe
  2⤵
  PID:7784
- C:\Windows\System\dDNkVLi.exe
  C:\Windows\System\dDNkVLi.exe
  2⤵
  PID:7800
- C:\Windows\System\kYRjQwf.exe
  C:\Windows\System\kYRjQwf.exe
  2⤵
  PID:7816
- C:\Windows\System\NgtvmcV.exe
  C:\Windows\System\NgtvmcV.exe
  2⤵
  PID:7832
- C:\Windows\System\syLjDKu.exe
  C:\Windows\System\syLjDKu.exe
  2⤵
  PID:7848
- C:\Windows\System\kQnjDOP.exe
  C:\Windows\System\kQnjDOP.exe
  2⤵
  PID:7868
- C:\Windows\System\ilbWIAr.exe
  C:\Windows\System\ilbWIAr.exe
  2⤵
  PID:7884
- C:\Windows\System\JmgNIgM.exe
  C:\Windows\System\JmgNIgM.exe
  2⤵
  PID:7900
- C:\Windows\System\vIshCbz.exe
  C:\Windows\System\vIshCbz.exe
  2⤵
  PID:7916
- C:\Windows\System\EXfJEtN.exe
  C:\Windows\System\EXfJEtN.exe
  2⤵
  PID:7932
- C:\Windows\System\GCikkZY.exe
  C:\Windows\System\GCikkZY.exe
  2⤵
  PID:7948
- C:\Windows\System\DqBlnTK.exe
  C:\Windows\System\DqBlnTK.exe
  2⤵
  PID:7964
- C:\Windows\System\ghjMAeL.exe
  C:\Windows\System\ghjMAeL.exe
  2⤵
  PID:7980
- C:\Windows\System\uBcpANm.exe
  C:\Windows\System\uBcpANm.exe
  2⤵
  PID:7996
- C:\Windows\System\STECvUK.exe
  C:\Windows\System\STECvUK.exe
  2⤵
  PID:8012
- C:\Windows\System\SXIaNQi.exe
  C:\Windows\System\SXIaNQi.exe
  2⤵
  PID:8028
- C:\Windows\System\SlevpuY.exe
  C:\Windows\System\SlevpuY.exe
  2⤵
  PID:8044
- C:\Windows\System\hXlnhep.exe
  C:\Windows\System\hXlnhep.exe
  2⤵
  PID:8060
- C:\Windows\System\BfDEgFr.exe
  C:\Windows\System\BfDEgFr.exe
  2⤵
  PID:8076
- C:\Windows\System\TZrWDDD.exe
  C:\Windows\System\TZrWDDD.exe
  2⤵
  PID:8092
- C:\Windows\System\ZbgCYPN.exe
  C:\Windows\System\ZbgCYPN.exe
  2⤵
  PID:8108
- C:\Windows\System\GMnjceU.exe
  C:\Windows\System\GMnjceU.exe
  2⤵
  PID:8124
- C:\Windows\System\sfiaLkn.exe
  C:\Windows\System\sfiaLkn.exe
  2⤵
  PID:8140
- C:\Windows\System\GFhtiGJ.exe
  C:\Windows\System\GFhtiGJ.exe
  2⤵
  PID:8156
- C:\Windows\System\NAUUxpL.exe
  C:\Windows\System\NAUUxpL.exe
  2⤵
  PID:8176
- C:\Windows\System\fgELJxO.exe
  C:\Windows\System\fgELJxO.exe
  2⤵
  PID:6708
- C:\Windows\System\pVMaYgO.exe
  C:\Windows\System\pVMaYgO.exe
  2⤵
  PID:3860
- C:\Windows\System\MTdHqCF.exe
  C:\Windows\System\MTdHqCF.exe
  2⤵
  PID:7204
- C:\Windows\System\DHpbobh.exe
  C:\Windows\System\DHpbobh.exe
  2⤵
  PID:6596
- C:\Windows\System\SWjRdpr.exe
  C:\Windows\System\SWjRdpr.exe
  2⤵
  PID:7264
- C:\Windows\System\KhJWmWs.exe
  C:\Windows\System\KhJWmWs.exe
  2⤵
  PID:7296
- C:\Windows\System\lTIHqFR.exe
  C:\Windows\System\lTIHqFR.exe
  2⤵
  PID:7360
- C:\Windows\System\WhuAPom.exe
  C:\Windows\System\WhuAPom.exe
  2⤵
  PID:5364
- C:\Windows\System\mYcchdY.exe
  C:\Windows\System\mYcchdY.exe
  2⤵
  PID:7280
- C:\Windows\System\FxWwDxX.exe
  C:\Windows\System\FxWwDxX.exe
  2⤵
  PID:7316
- C:\Windows\System\XhwqnEb.exe
  C:\Windows\System\XhwqnEb.exe
  2⤵
  PID:7284
- C:\Windows\System\FYyvPfh.exe
  C:\Windows\System\FYyvPfh.exe
  2⤵
  PID:7392
- C:\Windows\System\GmqUfXv.exe
  C:\Windows\System\GmqUfXv.exe
  2⤵
  PID:7460
- C:\Windows\System\uoMoAxw.exe
  C:\Windows\System\uoMoAxw.exe
  2⤵
  PID:7524
- C:\Windows\System\fgTojKD.exe
  C:\Windows\System\fgTojKD.exe
  2⤵
  PID:7588
- C:\Windows\System\fXKXmVg.exe
  C:\Windows\System\fXKXmVg.exe
  2⤵
  PID:7652
- C:\Windows\System\vrKwgNx.exe
  C:\Windows\System\vrKwgNx.exe
  2⤵
  PID:7684
- C:\Windows\System\txNRXcM.exe
  C:\Windows\System\txNRXcM.exe
  2⤵
  PID:7440
- C:\Windows\System\DkWKphz.exe
  C:\Windows\System\DkWKphz.exe
  2⤵
  PID:7444
- C:\Windows\System\LgZYkcn.exe
  C:\Windows\System\LgZYkcn.exe
  2⤵
  PID:7536
- C:\Windows\System\rXrRiDP.exe
  C:\Windows\System\rXrRiDP.exe
  2⤵
  PID:7668
- C:\Windows\System\acPJQYi.exe
  C:\Windows\System\acPJQYi.exe
  2⤵
  PID:7748
- C:\Windows\System\oJoTadg.exe
  C:\Windows\System\oJoTadg.exe
  2⤵
  PID:7812
- C:\Windows\System\iSdhKnz.exe
  C:\Windows\System\iSdhKnz.exe
  2⤵
  PID:7760
- C:\Windows\System\lzJhyRJ.exe
  C:\Windows\System\lzJhyRJ.exe
  2⤵
  PID:7764
- C:\Windows\System\ovpfAjJ.exe
  C:\Windows\System\ovpfAjJ.exe
  2⤵
  PID:7828
- C:\Windows\System\HOmxNhH.exe
  C:\Windows\System\HOmxNhH.exe
  2⤵
  PID:7732
- C:\Windows\System\hixqbss.exe
  C:\Windows\System\hixqbss.exe
  2⤵
  PID:7856
- C:\Windows\System\ULveVrz.exe
  C:\Windows\System\ULveVrz.exe
  2⤵
  PID:8008
- C:\Windows\System\cmYwPPr.exe
  C:\Windows\System\cmYwPPr.exe
  2⤵
  PID:7928
- C:\Windows\System\LramcWT.exe
  C:\Windows\System\LramcWT.exe
  2⤵
  PID:7896
- C:\Windows\System\XDYzyRU.exe
  C:\Windows\System\XDYzyRU.exe
  2⤵
  PID:7992
- C:\Windows\System\iDTQBub.exe
  C:\Windows\System\iDTQBub.exe
  2⤵
  PID:8052
- C:\Windows\System\wetQROz.exe
  C:\Windows\System\wetQROz.exe
  2⤵
  PID:8084
- C:\Windows\System\wkzIoVk.exe
  C:\Windows\System\wkzIoVk.exe
  2⤵
  PID:8136
- C:\Windows\System\yvOGzMW.exe
  C:\Windows\System\yvOGzMW.exe
  2⤵
  PID:6912
- C:\Windows\System\bshOtWQ.exe
  C:\Windows\System\bshOtWQ.exe
  2⤵
  PID:5860
- C:\Windows\System\xzwDiVC.exe
  C:\Windows\System\xzwDiVC.exe
  2⤵
  PID:6608
- C:\Windows\System\lGxLgJS.exe
  C:\Windows\System\lGxLgJS.exe
  2⤵
  PID:7364
- C:\Windows\System\zrRbLRK.exe
  C:\Windows\System\zrRbLRK.exe
  2⤵
  PID:7200
- C:\Windows\System\lwKYNZn.exe
  C:\Windows\System\lwKYNZn.exe
  2⤵
  PID:7328
- C:\Windows\System\NGMiDPe.exe
  C:\Windows\System\NGMiDPe.exe
  2⤵
  PID:7648
- C:\Windows\System\wJJtOXq.exe
  C:\Windows\System\wJJtOXq.exe
  2⤵
  PID:7508
- C:\Windows\System\hpntiZZ.exe
  C:\Windows\System\hpntiZZ.exe
  2⤵
  PID:8184
- C:\Windows\System\ixZzYWD.exe
  C:\Windows\System\ixZzYWD.exe
  2⤵
  PID:7556
- C:\Windows\System\JhmBKdB.exe
  C:\Windows\System\JhmBKdB.exe
  2⤵
  PID:7632
- C:\Windows\System\GkEWeCf.exe
  C:\Windows\System\GkEWeCf.exe
  2⤵
  PID:7780
- C:\Windows\System\ToLPtFa.exe
  C:\Windows\System\ToLPtFa.exe
  2⤵
  PID:7840
- C:\Windows\System\FiKfAkg.exe
  C:\Windows\System\FiKfAkg.exe
  2⤵
  PID:7876
- C:\Windows\System\OPoWJVA.exe
  C:\Windows\System\OPoWJVA.exe
  2⤵
  PID:7860
- C:\Windows\System\iMoKBpU.exe
  C:\Windows\System\iMoKBpU.exe
  2⤵
  PID:7976
- C:\Windows\System\jsWjoAt.exe
  C:\Windows\System\jsWjoAt.exe
  2⤵
  PID:8072
- C:\Windows\System\ievcPoE.exe
  C:\Windows\System\ievcPoE.exe
  2⤵
  PID:8168
- C:\Windows\System\hyOflhx.exe
  C:\Windows\System\hyOflhx.exe
  2⤵
  PID:7056
- C:\Windows\System\aoJqyMT.exe
  C:\Windows\System\aoJqyMT.exe
  2⤵
  PID:8116
- C:\Windows\System\jXayxcm.exe
  C:\Windows\System\jXayxcm.exe
  2⤵
  PID:7380
- C:\Windows\System\TumbZUt.exe
  C:\Windows\System\TumbZUt.exe
  2⤵
  PID:7492
- C:\Windows\System\cESIDbQ.exe
  C:\Windows\System\cESIDbQ.exe
  2⤵
  PID:7540
- C:\Windows\System\tsZSMNp.exe
  C:\Windows\System\tsZSMNp.exe
  2⤵
  PID:7944
- C:\Windows\System\DvTKTVR.exe
  C:\Windows\System\DvTKTVR.exe
  2⤵
  PID:8152
- C:\Windows\System\TGGaYMs.exe
  C:\Windows\System\TGGaYMs.exe
  2⤵
  PID:7312
- C:\Windows\System\NkpcCfd.exe
  C:\Windows\System\NkpcCfd.exe
  2⤵
  PID:7988
- C:\Windows\System\fMfMfyZ.exe
  C:\Windows\System\fMfMfyZ.exe
  2⤵
  PID:8040
- C:\Windows\System\pzxTfqv.exe
  C:\Windows\System\pzxTfqv.exe
  2⤵
  PID:7504
- C:\Windows\System\OHLWyoF.exe
  C:\Windows\System\OHLWyoF.exe
  2⤵
  PID:8132
- C:\Windows\System\HExfoyM.exe
  C:\Windows\System\HExfoyM.exe
  2⤵
  PID:8100
- C:\Windows\System\RpEulde.exe
  C:\Windows\System\RpEulde.exe
  2⤵
  PID:7716
- C:\Windows\System\IBDagoy.exe
  C:\Windows\System\IBDagoy.exe
  2⤵
  PID:7428
- C:\Windows\System\SeeMEXL.exe
  C:\Windows\System\SeeMEXL.exe
  2⤵
  PID:8208
- C:\Windows\System\qoiBgUR.exe
  C:\Windows\System\qoiBgUR.exe
  2⤵
  PID:8224
- C:\Windows\System\YDqXzAh.exe
  C:\Windows\System\YDqXzAh.exe
  2⤵
  PID:8240
- C:\Windows\System\FbdELjO.exe
  C:\Windows\System\FbdELjO.exe
  2⤵
  PID:8256
- C:\Windows\System\QFrGMLX.exe
  C:\Windows\System\QFrGMLX.exe
  2⤵
  PID:8272
- C:\Windows\System\UySloZR.exe
  C:\Windows\System\UySloZR.exe
  2⤵
  PID:8288
- C:\Windows\System\ewVUsSv.exe
  C:\Windows\System\ewVUsSv.exe
  2⤵
  PID:8304
- C:\Windows\System\qEbUAoN.exe
  C:\Windows\System\qEbUAoN.exe
  2⤵
  PID:8320
- C:\Windows\System\wJtMmLx.exe
  C:\Windows\System\wJtMmLx.exe
  2⤵
  PID:8336
- C:\Windows\System\HPJCVHH.exe
  C:\Windows\System\HPJCVHH.exe
  2⤵
  PID:8352
- C:\Windows\System\JWpKUZJ.exe
  C:\Windows\System\JWpKUZJ.exe
  2⤵
  PID:8368
- C:\Windows\System\amUrlQs.exe
  C:\Windows\System\amUrlQs.exe
  2⤵
  PID:8384
- C:\Windows\System\QYlvMCO.exe
  C:\Windows\System\QYlvMCO.exe
  2⤵
  PID:8400
- C:\Windows\System\ZbAcUeK.exe
  C:\Windows\System\ZbAcUeK.exe
  2⤵
  PID:8416
- C:\Windows\System\QGwFPEN.exe
  C:\Windows\System\QGwFPEN.exe
  2⤵
  PID:8432
- C:\Windows\System\DCaoLSV.exe
  C:\Windows\System\DCaoLSV.exe
  2⤵
  PID:8448
- C:\Windows\System\dcKvFgp.exe
  C:\Windows\System\dcKvFgp.exe
  2⤵
  PID:8464
- C:\Windows\System\eZyjrJA.exe
  C:\Windows\System\eZyjrJA.exe
  2⤵
  PID:8480
- C:\Windows\System\ojETPLi.exe
  C:\Windows\System\ojETPLi.exe
  2⤵
  PID:8496
- C:\Windows\System\tSKIktC.exe
  C:\Windows\System\tSKIktC.exe
  2⤵
  PID:8512
- C:\Windows\System\UpcPlrf.exe
  C:\Windows\System\UpcPlrf.exe
  2⤵
  PID:8528
- C:\Windows\System\RfJgNGl.exe
  C:\Windows\System\RfJgNGl.exe
  2⤵
  PID:8544
- C:\Windows\System\yfBaYSu.exe
  C:\Windows\System\yfBaYSu.exe
  2⤵
  PID:8560
- C:\Windows\System\PzRWzYZ.exe
  C:\Windows\System\PzRWzYZ.exe
  2⤵
  PID:8576
- C:\Windows\System\OooiKJZ.exe
  C:\Windows\System\OooiKJZ.exe
  2⤵
  PID:8592
- C:\Windows\System\nSaRZfI.exe
  C:\Windows\System\nSaRZfI.exe
  2⤵
  PID:8608
- C:\Windows\System\uJKKrqK.exe
  C:\Windows\System\uJKKrqK.exe
  2⤵
  PID:8624
- C:\Windows\System\BWVYnUk.exe
  C:\Windows\System\BWVYnUk.exe
  2⤵
  PID:8640
- C:\Windows\System\enqLmvv.exe
  C:\Windows\System\enqLmvv.exe
  2⤵
  PID:8656
- C:\Windows\System\dqLRJPe.exe
  C:\Windows\System\dqLRJPe.exe
  2⤵
  PID:8672
- C:\Windows\System\HzeRimV.exe
  C:\Windows\System\HzeRimV.exe
  2⤵
  PID:8688
- C:\Windows\System\AMOXWlW.exe
  C:\Windows\System\AMOXWlW.exe
  2⤵
  PID:8704
- C:\Windows\System\mNusvhP.exe
  C:\Windows\System\mNusvhP.exe
  2⤵
  PID:8720
- C:\Windows\System\eYTuxXa.exe
  C:\Windows\System\eYTuxXa.exe
  2⤵
  PID:8736
- C:\Windows\System\EYDnLLE.exe
  C:\Windows\System\EYDnLLE.exe
  2⤵
  PID:8752
- C:\Windows\System\mLigIHs.exe
  C:\Windows\System\mLigIHs.exe
  2⤵
  PID:8768
- C:\Windows\System\ILWzikV.exe
  C:\Windows\System\ILWzikV.exe
  2⤵
  PID:8784
- C:\Windows\System\ymOJeDr.exe
  C:\Windows\System\ymOJeDr.exe
  2⤵
  PID:8800
- C:\Windows\System\AvTogZc.exe
  C:\Windows\System\AvTogZc.exe
  2⤵
  PID:8816
- C:\Windows\System\ivUmDVe.exe
  C:\Windows\System\ivUmDVe.exe
  2⤵
  PID:8832
- C:\Windows\System\VCaDJtD.exe
  C:\Windows\System\VCaDJtD.exe
  2⤵
  PID:8848
- C:\Windows\System\MtmaTUY.exe
  C:\Windows\System\MtmaTUY.exe
  2⤵
  PID:8864
- C:\Windows\System\WdtOpCJ.exe
  C:\Windows\System\WdtOpCJ.exe
  2⤵
  PID:8880
- C:\Windows\System\kvAXzBJ.exe
  C:\Windows\System\kvAXzBJ.exe
  2⤵
  PID:8896
- C:\Windows\System\ZwImJLW.exe
  C:\Windows\System\ZwImJLW.exe
  2⤵
  PID:8912
- C:\Windows\System\mKrJvyC.exe
  C:\Windows\System\mKrJvyC.exe
  2⤵
  PID:8928
- C:\Windows\System\qKtAHGS.exe
  C:\Windows\System\qKtAHGS.exe
  2⤵
  PID:8944
- C:\Windows\System\UGENlKq.exe
  C:\Windows\System\UGENlKq.exe
  2⤵
  PID:8960
- C:\Windows\System\AYFwCCb.exe
  C:\Windows\System\AYFwCCb.exe
  2⤵
  PID:8976
- C:\Windows\System\ltuWGSx.exe
  C:\Windows\System\ltuWGSx.exe
  2⤵
  PID:8992
- C:\Windows\System\hnSpToa.exe
  C:\Windows\System\hnSpToa.exe
  2⤵
  PID:9008
- C:\Windows\System\GdcHkpv.exe
  C:\Windows\System\GdcHkpv.exe
  2⤵
  PID:9024
- C:\Windows\System\csrraqa.exe
  C:\Windows\System\csrraqa.exe
  2⤵
  PID:9040
- C:\Windows\System\uHcLraI.exe
  C:\Windows\System\uHcLraI.exe
  2⤵
  PID:9060
- C:\Windows\System\oENpdVv.exe
  C:\Windows\System\oENpdVv.exe
  2⤵
  PID:9076
- C:\Windows\System\VeCebrI.exe
  C:\Windows\System\VeCebrI.exe
  2⤵
  PID:9092
- C:\Windows\System\NFcyHKI.exe
  C:\Windows\System\NFcyHKI.exe
  2⤵
  PID:9108
- C:\Windows\System\XlSvwEe.exe
  C:\Windows\System\XlSvwEe.exe
  2⤵
  PID:9124
- C:\Windows\System\vOeRJnv.exe
  C:\Windows\System\vOeRJnv.exe
  2⤵
  PID:9140
- C:\Windows\System\OOorwyz.exe
  C:\Windows\System\OOorwyz.exe
  2⤵
  PID:9156
- C:\Windows\System\REfRMsC.exe
  C:\Windows\System\REfRMsC.exe
  2⤵
  PID:9172
- C:\Windows\System\DwzMtZM.exe
  C:\Windows\System\DwzMtZM.exe
  2⤵
  PID:9188
- C:\Windows\System\fEiKUkT.exe
  C:\Windows\System\fEiKUkT.exe
  2⤵
  PID:9204
- C:\Windows\System\nKioqmJ.exe
  C:\Windows\System\nKioqmJ.exe
  2⤵
  PID:7908
- C:\Windows\System\QjKJdYq.exe
  C:\Windows\System\QjKJdYq.exe
  2⤵
  PID:8164
- C:\Windows\System\PrWZEFb.exe
  C:\Windows\System\PrWZEFb.exe
  2⤵
  PID:8204
- C:\Windows\System\ibUjDlc.exe
  C:\Windows\System\ibUjDlc.exe
  2⤵
  PID:8236
- C:\Windows\System\pJryadV.exe
  C:\Windows\System\pJryadV.exe
  2⤵
  PID:8316
- C:\Windows\System\xcBzTXh.exe
  C:\Windows\System\xcBzTXh.exe
  2⤵
  PID:8376
- C:\Windows\System\qOnmWRN.exe
  C:\Windows\System\qOnmWRN.exe
  2⤵
  PID:8444
- C:\Windows\System\eUkcoQq.exe
  C:\Windows\System\eUkcoQq.exe
  2⤵
  PID:8252
- C:\Windows\System\KWXJtCT.exe
  C:\Windows\System\KWXJtCT.exe
  2⤵
  PID:8568
- C:\Windows\System\AUWxtEz.exe
  C:\Windows\System\AUWxtEz.exe
  2⤵
  PID:8424
- C:\Windows\System\BkEyqAN.exe
  C:\Windows\System\BkEyqAN.exe
  2⤵
  PID:8428
- C:\Windows\System\nCjgGRu.exe
  C:\Windows\System\nCjgGRu.exe
  2⤵
  PID:8332
- C:\Windows\System\tHAqzmP.exe
  C:\Windows\System\tHAqzmP.exe
  2⤵
  PID:8396
- C:\Windows\System\rffZWjl.exe
  C:\Windows\System\rffZWjl.exe
  2⤵
  PID:8492
- C:\Windows\System\dnHyHhq.exe
  C:\Windows\System\dnHyHhq.exe
  2⤵
  PID:8556
- C:\Windows\System\SMkaMKL.exe
  C:\Windows\System\SMkaMKL.exe
  2⤵
  PID:8616
- C:\Windows\System\mkeRbdg.exe
  C:\Windows\System\mkeRbdg.exe
  2⤵
  PID:8620
- C:\Windows\System\JDmiwiI.exe
  C:\Windows\System\JDmiwiI.exe
  2⤵
  PID:8652
- C:\Windows\System\mmHfxMl.exe
  C:\Windows\System\mmHfxMl.exe
  2⤵
  PID:8716
- C:\Windows\System\fkxGKVv.exe
  C:\Windows\System\fkxGKVv.exe
  2⤵
  PID:8764
- C:\Windows\System\YLtholW.exe
  C:\Windows\System\YLtholW.exe
  2⤵
  PID:8828
- C:\Windows\System\bTLklJI.exe
  C:\Windows\System\bTLklJI.exe
  2⤵
  PID:8892
- C:\Windows\System\dteAwpI.exe
  C:\Windows\System\dteAwpI.exe
  2⤵
  PID:8956
- C:\Windows\System\tuFeSiy.exe
  C:\Windows\System\tuFeSiy.exe
  2⤵
  PID:9020
- C:\Windows\System\IkICQId.exe
  C:\Windows\System\IkICQId.exe
  2⤵
  PID:9032
- C:\Windows\System\ICPzKiH.exe
  C:\Windows\System\ICPzKiH.exe
  2⤵
  PID:8812
- C:\Windows\System\sMGjHxG.exe
  C:\Windows\System\sMGjHxG.exe
  2⤵
  PID:8876
- C:\Windows\System\jmrmzvf.exe
  C:\Windows\System\jmrmzvf.exe
  2⤵
  PID:8940
- C:\Windows\System\dNAnEJo.exe
  C:\Windows\System\dNAnEJo.exe
  2⤵
  PID:9004
- C:\Windows\System\cCaelha.exe
  C:\Windows\System\cCaelha.exe
  2⤵
  PID:9088
- C:\Windows\System\NwRajQn.exe
  C:\Windows\System\NwRajQn.exe
  2⤵
  PID:9152
- C:\Windows\System\wiWgAKG.exe
  C:\Windows\System\wiWgAKG.exe
  2⤵
  PID:9100
- C:\Windows\System\pwvjHjM.exe
  C:\Windows\System\pwvjHjM.exe
  2⤵
  PID:9168
- C:\Windows\System\iClrskv.exe
  C:\Windows\System\iClrskv.exe
  2⤵
  PID:7412
- C:\Windows\System\IZLHPDN.exe
  C:\Windows\System\IZLHPDN.exe
  2⤵
  PID:7604
- C:\Windows\System\aoITXKX.exe
  C:\Windows\System\aoITXKX.exe
  2⤵
  PID:7864
- C:\Windows\System\zwEHUMl.exe
  C:\Windows\System\zwEHUMl.exe
  2⤵
  PID:8536
- C:\Windows\System\LuLCcfm.exe
  C:\Windows\System\LuLCcfm.exe
  2⤵
  PID:8268
- C:\Windows\System\NmZUnzz.exe
  C:\Windows\System\NmZUnzz.exe
  2⤵
  PID:8504
- C:\Windows\System\VFgEaSu.exe
  C:\Windows\System\VFgEaSu.exe
  2⤵
  PID:8588
- C:\Windows\System\xHMTlhN.exe
  C:\Windows\System\xHMTlhN.exe
  2⤵
  PID:8668
- C:\Windows\System\hDgOtWf.exe
  C:\Windows\System\hDgOtWf.exe
  2⤵
  PID:8696
- C:\Windows\System\NldJPGn.exe
  C:\Windows\System\NldJPGn.exe
  2⤵
  PID:8732
- C:\Windows\System\BpFaKmh.exe
  C:\Windows\System\BpFaKmh.exe
  2⤵
  PID:8952
- C:\Windows\System\uEjwkER.exe
  C:\Windows\System\uEjwkER.exe
  2⤵
  PID:8760
- C:\Windows\System\oYzUXXm.exe
  C:\Windows\System\oYzUXXm.exe
  2⤵
  PID:8860
- C:\Windows\System\hciCiDD.exe
  C:\Windows\System\hciCiDD.exe
  2⤵
  PID:8808
- C:\Windows\System\XpEzwZM.exe
  C:\Windows\System\XpEzwZM.exe
  2⤵
  PID:9120
- C:\Windows\System\pjbToOM.exe
  C:\Windows\System\pjbToOM.exe
  2⤵
  PID:8216
- C:\Windows\System\ufdSTux.exe
  C:\Windows\System\ufdSTux.exe
  2⤵
  PID:8280
- C:\Windows\System\iUIqORc.exe
  C:\Windows\System\iUIqORc.exe
  2⤵
  PID:9200
- C:\Windows\System\QizoyMA.exe
  C:\Windows\System\QizoyMA.exe
  2⤵
  PID:8232
- C:\Windows\System\WotZfhx.exe
  C:\Windows\System\WotZfhx.exe
  2⤵
  PID:8488
- C:\Windows\System\YlkusoV.exe
  C:\Windows\System\YlkusoV.exe
  2⤵
  PID:8748
- C:\Windows\System\spPdkON.exe
  C:\Windows\System\spPdkON.exe
  2⤵
  PID:8476
- C:\Windows\System\VsntAst.exe
  C:\Windows\System\VsntAst.exe
  2⤵
  PID:8312
- C:\Windows\System\pIaqEFc.exe
  C:\Windows\System\pIaqEFc.exe
  2⤵
  PID:8780
- C:\Windows\System\Mpckldo.exe
  C:\Windows\System\Mpckldo.exe
  2⤵
  PID:8936
- C:\Windows\System\ePdEZPE.exe
  C:\Windows\System\ePdEZPE.exe
  2⤵
  PID:8328
- C:\Windows\System\eSlvPUL.exe
  C:\Windows\System\eSlvPUL.exe
  2⤵
  PID:8924
- C:\Windows\System\tpaYQBY.exe
  C:\Windows\System\tpaYQBY.exe
  2⤵
  PID:9016
- C:\Windows\System\vYeksIh.exe
  C:\Windows\System\vYeksIh.exe
  2⤵
  PID:9000
- C:\Windows\System\HoZdYoW.exe
  C:\Windows\System\HoZdYoW.exe
  2⤵
  PID:9224
- C:\Windows\System\isOUlYE.exe
  C:\Windows\System\isOUlYE.exe
  2⤵
  PID:9240
- C:\Windows\System\NZJKBZH.exe
  C:\Windows\System\NZJKBZH.exe
  2⤵
  PID:9256
- C:\Windows\System\CZAXWAW.exe
  C:\Windows\System\CZAXWAW.exe
  2⤵
  PID:9272
- C:\Windows\System\JOfqABg.exe
  C:\Windows\System\JOfqABg.exe
  2⤵
  PID:9288
- C:\Windows\System\nwxLXCZ.exe
  C:\Windows\System\nwxLXCZ.exe
  2⤵
  PID:9308
- C:\Windows\System\qoqSMpR.exe
  C:\Windows\System\qoqSMpR.exe
  2⤵
  PID:9324
- C:\Windows\System\NBMYrCF.exe
  C:\Windows\System\NBMYrCF.exe
  2⤵
  PID:9340
- C:\Windows\System\DFwiFqr.exe
  C:\Windows\System\DFwiFqr.exe
  2⤵
  PID:9356
- C:\Windows\System\IdOJfUO.exe
  C:\Windows\System\IdOJfUO.exe
  2⤵
  PID:9376
- C:\Windows\System\RsoKEpk.exe
  C:\Windows\System\RsoKEpk.exe
  2⤵
  PID:9392
- C:\Windows\System\wkOtjZh.exe
  C:\Windows\System\wkOtjZh.exe
  2⤵
  PID:9408
- C:\Windows\System\MpSMKXM.exe
  C:\Windows\System\MpSMKXM.exe
  2⤵
  PID:9424
- C:\Windows\System\gpWadhl.exe
  C:\Windows\System\gpWadhl.exe
  2⤵
  PID:9440
- C:\Windows\System\WbDCHSm.exe
  C:\Windows\System\WbDCHSm.exe
  2⤵
  PID:9456
- C:\Windows\System\uEWqweB.exe
  C:\Windows\System\uEWqweB.exe
  2⤵
  PID:9472
- C:\Windows\System\LTmDipz.exe
  C:\Windows\System\LTmDipz.exe
  2⤵
  PID:9488
- C:\Windows\System\iHuolCR.exe
  C:\Windows\System\iHuolCR.exe
  2⤵
  PID:9504
- C:\Windows\System\ogbEYVi.exe
  C:\Windows\System\ogbEYVi.exe
  2⤵
  PID:9520
- C:\Windows\System\OlJuBcD.exe
  C:\Windows\System\OlJuBcD.exe
  2⤵
  PID:9536
- C:\Windows\System\QDaUznL.exe
  C:\Windows\System\QDaUznL.exe
  2⤵
  PID:9552
- C:\Windows\System\FMaUBAB.exe
  C:\Windows\System\FMaUBAB.exe
  2⤵
  PID:9568
- C:\Windows\System\IISocsd.exe
  C:\Windows\System\IISocsd.exe
  2⤵
  PID:9584
- C:\Windows\System\tDBhFMe.exe
  C:\Windows\System\tDBhFMe.exe
  2⤵
  PID:9600
- C:\Windows\System\kXvhXtE.exe
  C:\Windows\System\kXvhXtE.exe
  2⤵
  PID:9616
- C:\Windows\System\aswmXJa.exe
  C:\Windows\System\aswmXJa.exe
  2⤵
  PID:9632
- C:\Windows\System\AOAWBpG.exe
  C:\Windows\System\AOAWBpG.exe
  2⤵
  PID:9648
- C:\Windows\System\oUwReZp.exe
  C:\Windows\System\oUwReZp.exe
  2⤵
  PID:9664
- C:\Windows\System\pKULvOU.exe
  C:\Windows\System\pKULvOU.exe
  2⤵
  PID:9680
- C:\Windows\System\cBXVlcT.exe
  C:\Windows\System\cBXVlcT.exe
  2⤵
  PID:9696
- C:\Windows\System\axcvreF.exe
  C:\Windows\System\axcvreF.exe
  2⤵
  PID:9712
- C:\Windows\System\NHRZdLG.exe
  C:\Windows\System\NHRZdLG.exe
  2⤵
  PID:9728
- C:\Windows\System\URHyGiy.exe
  C:\Windows\System\URHyGiy.exe
  2⤵
  PID:9744
- C:\Windows\System\eLpRqUL.exe
  C:\Windows\System\eLpRqUL.exe
  2⤵
  PID:9760
- C:\Windows\System\VSULwyd.exe
  C:\Windows\System\VSULwyd.exe
  2⤵
  PID:9776
- C:\Windows\System\XEPYIZL.exe
  C:\Windows\System\XEPYIZL.exe
  2⤵
  PID:9792
- C:\Windows\System\zjyyket.exe
  C:\Windows\System\zjyyket.exe
  2⤵
  PID:9808
- C:\Windows\System\mDSPfRB.exe
  C:\Windows\System\mDSPfRB.exe
  2⤵
  PID:9824
- C:\Windows\System\MlFbAAT.exe
  C:\Windows\System\MlFbAAT.exe
  2⤵
  PID:9840
- C:\Windows\System\kyYhTAB.exe
  C:\Windows\System\kyYhTAB.exe
  2⤵
  PID:9856
- C:\Windows\System\oYzSRAk.exe
  C:\Windows\System\oYzSRAk.exe
  2⤵
  PID:9872
- C:\Windows\System\TIiSzRU.exe
  C:\Windows\System\TIiSzRU.exe
  2⤵
  PID:9888
- C:\Windows\System\wBpHgGn.exe
  C:\Windows\System\wBpHgGn.exe
  2⤵
  PID:9904
- C:\Windows\System\miUWFWP.exe
  C:\Windows\System\miUWFWP.exe
  2⤵
  PID:9920
- C:\Windows\System\vyVamXF.exe
  C:\Windows\System\vyVamXF.exe
  2⤵
  PID:9936
- C:\Windows\System\wbixwqT.exe
  C:\Windows\System\wbixwqT.exe
  2⤵
  PID:9952
- C:\Windows\System\RJwPUCI.exe
  C:\Windows\System\RJwPUCI.exe
  2⤵
  PID:9968
- C:\Windows\System\CLtZKng.exe
  C:\Windows\System\CLtZKng.exe
  2⤵
  PID:9984
- C:\Windows\System\HgNYvpW.exe
  C:\Windows\System\HgNYvpW.exe
  2⤵
  PID:10000
- C:\Windows\System\ZkqkTKa.exe
  C:\Windows\System\ZkqkTKa.exe
  2⤵
  PID:10016
- C:\Windows\System\pWOFnal.exe
  C:\Windows\System\pWOFnal.exe
  2⤵
  PID:10032
- C:\Windows\System\xOjughk.exe
  C:\Windows\System\xOjughk.exe
  2⤵
  PID:10048
- C:\Windows\System\QgkUpec.exe
  C:\Windows\System\QgkUpec.exe
  2⤵
  PID:10064
- C:\Windows\System\FukryqP.exe
  C:\Windows\System\FukryqP.exe
  2⤵
  PID:10080
- C:\Windows\System\TbzIsDT.exe
  C:\Windows\System\TbzIsDT.exe
  2⤵
  PID:10096
- C:\Windows\System\klQtUEO.exe
  C:\Windows\System\klQtUEO.exe
  2⤵
  PID:10112
- C:\Windows\System\kWKfOWJ.exe
  C:\Windows\System\kWKfOWJ.exe
  2⤵
  PID:10128
- C:\Windows\System\eSSyHKT.exe
  C:\Windows\System\eSSyHKT.exe
  2⤵
  PID:10144
- C:\Windows\System\Ygeyrxj.exe
  C:\Windows\System\Ygeyrxj.exe
  2⤵
  PID:10160
- C:\Windows\System\MuSzaIw.exe
  C:\Windows\System\MuSzaIw.exe
  2⤵
  PID:10176
- C:\Windows\System\qJDbZpa.exe
  C:\Windows\System\qJDbZpa.exe
  2⤵
  PID:10192
- C:\Windows\System\otPozRS.exe
  C:\Windows\System\otPozRS.exe
  2⤵
  PID:10208
- C:\Windows\System\sxyffDU.exe
  C:\Windows\System\sxyffDU.exe
  2⤵
  PID:10224
- C:\Windows\System\MHivQkX.exe
  C:\Windows\System\MHivQkX.exe
  2⤵
  PID:8844
- C:\Windows\System\eCnZvIW.exe
  C:\Windows\System\eCnZvIW.exe
  2⤵
  PID:8392
- C:\Windows\System\qRkAaYV.exe
  C:\Windows\System\qRkAaYV.exe
  2⤵
  PID:9248
- C:\Windows\System\HzMMAAa.exe
  C:\Windows\System\HzMMAAa.exe
  2⤵
  PID:9316
- C:\Windows\System\mvJDBfu.exe
  C:\Windows\System\mvJDBfu.exe
  2⤵
  PID:9264
- C:\Windows\System\BffJjHu.exe
  C:\Windows\System\BffJjHu.exe
  2⤵
  PID:9384
- C:\Windows\System\jZfPAvM.exe
  C:\Windows\System\jZfPAvM.exe
  2⤵
  PID:9332
- C:\Windows\System\FXYXBMg.exe
  C:\Windows\System\FXYXBMg.exe
  2⤵
  PID:9296
- C:\Windows\System\kJzxhnX.exe
  C:\Windows\System\kJzxhnX.exe
  2⤵
  PID:9364
- C:\Windows\System\waQyePM.exe
  C:\Windows\System\waQyePM.exe
  2⤵
  PID:9452
- C:\Windows\System\PCRYlmC.exe
  C:\Windows\System\PCRYlmC.exe
  2⤵
  PID:9512
- C:\Windows\System\TXgOrRa.exe
  C:\Windows\System\TXgOrRa.exe
  2⤵
  PID:9576
- C:\Windows\System\aRTiAUX.exe
  C:\Windows\System\aRTiAUX.exe
  2⤵
  PID:9640
- C:\Windows\System\guCDVRD.exe
  C:\Windows\System\guCDVRD.exe
  2⤵
  PID:9676
- C:\Windows\System\YLhvJWu.exe
  C:\Windows\System\YLhvJWu.exe
  2⤵
  PID:9500
- C:\Windows\System\ktXXzJu.exe
  C:\Windows\System\ktXXzJu.exe
  2⤵
  PID:9740
- C:\Windows\System\MEpYgMo.exe
  C:\Windows\System\MEpYgMo.exe
  2⤵
  PID:9496
- C:\Windows\System\BsRcvxz.exe
  C:\Windows\System\BsRcvxz.exe
  2⤵
  PID:9836
- C:\Windows\System\PjfQQRj.exe
  C:\Windows\System\PjfQQRj.exe
  2⤵
  PID:9692
- C:\Windows\System\iWocKFW.exe
  C:\Windows\System\iWocKFW.exe
  2⤵
  PID:9868
- C:\Windows\System\YpCZVIO.exe
  C:\Windows\System\YpCZVIO.exe
  2⤵
  PID:9756
- C:\Windows\System\KCParcY.exe
  C:\Windows\System\KCParcY.exe
  2⤵
  PID:9656
- C:\Windows\System\SSDHesO.exe
  C:\Windows\System\SSDHesO.exe
  2⤵
  PID:9964
- C:\Windows\System\KViJbut.exe
  C:\Windows\System\KViJbut.exe
  2⤵
  PID:9752
- C:\Windows\System\myQZPcq.exe
  C:\Windows\System\myQZPcq.exe
  2⤵
  PID:9788
- C:\Windows\System\iyDpIBj.exe
  C:\Windows\System\iyDpIBj.exe
  2⤵
  PID:9820
- C:\Windows\System\wMhRniW.exe
  C:\Windows\System\wMhRniW.exe
  2⤵
  PID:9884
- C:\Windows\System\rckxYPG.exe
  C:\Windows\System\rckxYPG.exe
  2⤵
  PID:10028
- C:\Windows\System\xbTCEzb.exe
  C:\Windows\System\xbTCEzb.exe
  2⤵
  PID:10012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AowzLpP.exe

Filesize
2.3MB

MD5
d9cca541f8d3d491a5548e50f00af7fe

SHA1
8a65c6bb4a3f7c83a0769ca9de1bc315c1f19278

SHA256
946498861cdad86237f54a15b910b42c0f362c11f7223a733d791fab6f7d4176

SHA512
ec85c04a51701e27442e442c2ad6027c0b56f50962b5a8a57763e75273c6c91bdbc15a361825f1422dcf461797093c0f728de6f32b044db420c3aec6cab48634

Download Submit
C:\Windows\system\BlRIJQW.exe

Filesize
2.3MB

MD5
9d4bce9f7e27e7e117e608d7929bc227

SHA1
d78765464533c4e3fd05f7b0dcfa887450e09300

SHA256
c5a6411e0c051663ddf09d7c645105ed00ee98dcbcac8e9d0cc02bd8304f306f

SHA512
44d35a6fd8dd34443f6c4d0a6e56abf08b2dacdcfa69673830644b24b5d301fbfe3a8c0205add4a77c8d13a00654d2c33e4b1f28c0fef87cc7cddddd45c95110

Download Submit
C:\Windows\system\BwxvWif.exe

Filesize
2.3MB

MD5
f420c1eacb2a7ff539429fbcb8c2cbf4

SHA1
ce90ee2679ad2f24370fa1ef9c49a2fcc3582ba8

SHA256
827d2ee8a2f6a8689c14834f3e1486af3e265aeccea73bdbb6588da6d447afd6

SHA512
54be77407a81adb401f6c2799eb5830e45902cf98e757d959c35ffcc62836ea8dbb18cda2945b0d4abcd186a57cb8298c1de17740298a3aa96ca448d7919f736

Download Submit
C:\Windows\system\DFsERsJ.exe

Filesize
2.3MB

MD5
d6c46f7fa3dcd33a95594779e10ba2e1

SHA1
664a9a6d3561037490bcca490dfca108761229fe

SHA256
dd96fb697379ec6c9a014151ca84350f20cd4409c89a0f284214a363d31c07a8

SHA512
7672bb4f56eb29472242540eaa4a29f5f24144ec79735b911251002b12ddc0e409a79016f10e787a866dca6434e1d51434991093babbdcd4ef0b7b581d63a8db

Download Submit
C:\Windows\system\FKgZPEj.exe

Filesize
2.3MB

MD5
a1597bc212a92bb2b422b608ebef2e4c

SHA1
a2ad70095a354635ab1b7063885b62114dd8817b

SHA256
7328afec4253bf4c2f9da17cc95181ba2bf0386382f129fb58506f69ec4ca45e

SHA512
76cc55dab79067e3f0f72f462e319685e18acf302dc5314573cf346a5e4e064d8f199aeb350e8b5008521216440745cef034dbb9d147a4f726174f0e9d944c4d

Download Submit
C:\Windows\system\FMNbvFD.exe

Filesize
2.3MB

MD5
e61c2003e2b58bb6edb442aee206f43f

SHA1
3fdd0556ffe8da32596a1fe4bbf66c540f58827c

SHA256
e947482e692b0d4984cd107b29a494e46ea16f5fac5b4cb91e6891ada83dbe7a

SHA512
557d34bb689f664b33545d546d050390896f183ae3f5e4ee32504349eaff71e469e2f5403561ebece7d90ae37a126d2e76d50fbc91dbf06294c3d312344c16e0

Download Submit
C:\Windows\system\GGWywHr.exe

Filesize
2.3MB

MD5
0503989cba80860459120ea30da48921

SHA1
0a02f405c642e1f39f41a5712113ec36a1040add

SHA256
f092ac8337d070cf0c70bdd28aa1cfed67c2758c8d657d9b43711f2f52c18ae6

SHA512
51da822a64163b7edde7a84fdefa7e83c817c88e8adac88245ebecad96fc427e0b829d8239662390dde5d23252108000475342e519d470fd9b63e40a4c9102de

Download Submit
C:\Windows\system\MQMjkoX.exe

Filesize
2.3MB

MD5
835c530b5855533d8b6e0bd877856ce1

SHA1
cbbb20e3105e212f119c96a880b03afac3190185

SHA256
e640fc90be7f40cf8b4c26455311f59e8ce9506439091c3046d3865602a86ddc

SHA512
7478df24e088fbb34168b94564a1a6132c59503b3145c7c2cddb7324e7fc3fb4d9607802eba8e8163aea8e8aa0ce7933bdb2f7d571c7853da12f1ec3a36050f9

Download Submit
C:\Windows\system\MohpSWL.exe

Filesize
2.3MB

MD5
3ab0fda2b2931969b2249754b69addc4

SHA1
fc9cffab6c815cf07050f478c63d707f1f1b9eaf

SHA256
9e805b8e26ed90bb6ecf02ff0bd8674977d036e32f22e25f0b484bd23ff30aea

SHA512
c5bbc0cb6f2148824a257814d7acd58490b653e6e5ab932abe87c6d264a03bbf44af848c92883ae89468d0141233d3503816caaff9db47483893a4cd57e6e809

Download Submit
C:\Windows\system\MyPlgpp.exe

Filesize
2.3MB

MD5
40550bcc9de1abe92d140f43d550d9e7

SHA1
15eee62c362fa18001afcc80e26216ca3438d511

SHA256
ac27068dde135d74f9e89c55d382d1a72fbb90d8e2b37d93d03ed9d7cabe2835

SHA512
4a4c86e013efaac7a939ea54e0b6d5e9fe2298aadd006cc5d14208bb5a093558b71789e8f7e8244100a922b356bb154436629ae7f5239bee900084f420da79d6

Download Submit
C:\Windows\system\NOmfnVK.exe

Filesize
2.3MB

MD5
c1330fee1c508844808aae91c7576897

SHA1
8790a0d44b06a9d6354096d7dc9eb23167112bdc

SHA256
d94f622a390d12b786af78eb059a44ddac0216c8acb721430bacc7816543ccce

SHA512
2cc3fdf066679da53a5949efabe667ac34b5056fea207e51fff2c42885a1ed64155876e944b7519265538df74e48e68dfd897a48b830818f1867750444c1e52f

Download Submit
C:\Windows\system\UPDIosP.exe

Filesize
2.3MB

MD5
eb01734f599beba3f827cce870504ce9

SHA1
3e19b4763d7c64a95ddc9af2cecce3c11ede1839

SHA256
b73656a712740e0b6d783196fb6ec61b5ff797155b6b051d3eaa8621619443a6

SHA512
45efb6c9395ce6a97e4ebeb1a0dc62ee5ec1fac8939ef56669e7b2ad09ec7e6916ac7b7e1d816d230ead1282d19db45d91fc574498a26c46475ed7a9a7ca8559

Download Submit
C:\Windows\system\ZTzFkmk.exe

Filesize
2.3MB

MD5
68847589f378e8f9f47992b090f58262

SHA1
07428b3cbf177b25a369c7698cccb2428c6a1150

SHA256
f441e0d41a8f0a950415e0bdec8300014ce8a356ca3501f48c65f71355c960f6

SHA512
cf5535372f1088c828d1010982793854f0897367eae081fdb14fe5454c1212d5ffae3c0b506c333a73ff7417e7ca5aa082cc9a384432bf2606e9f3941b3d7a83

Download Submit
C:\Windows\system\aftAOpI.exe

Filesize
2.3MB

MD5
5cef63cf3ef432ca3bbb5a606fa311c6

SHA1
edea24e2fd6991fca075495dfbe39221e6ddbc1a

SHA256
b183cc4bc3b497e0b010f20d7c5ebabe63f838414670a56a80d5de51f6ae448a

SHA512
78315a70d126dacee48be7b3bd85e8463c74f7f7c26581e336ecbe3a1c77d308323da75c6f6d6342d335e0c80f510f0e27a6e2102bde21669b9b2a55126915bc

Download Submit
C:\Windows\system\ecIjYNj.exe

Filesize
2.3MB

MD5
1dde58bafe14535a9f69a8c13e6bd4b3

SHA1
36f0364a015aa045fb163e910ee2321cf1c0cfe3

SHA256
344c98edcd9a3ae9ddd548be09f66991aa96e58cdb7c501d8a66f4bc77714344

SHA512
26ec7950be1ef20f11e80e606197848b46deff3a4e2edd8f6265310a4b2f546b784f3e7bbe65ba0b6807d78ba467768cf7ae36b2577bf43ae7dc554bc7289045

Download Submit
C:\Windows\system\epcEDla.exe

Filesize
2.3MB

MD5
46d9a39baaabcf6a17542470e374589c

SHA1
4336a2b1641dc88fab0b651e46817f5042a501cb

SHA256
5e58cd8cb563ec190c8a639bd817f5fbefa2e80d7c4ea09284917324e3ad9f1d

SHA512
3952c5bee20daa315eb96ce69b21255ff694d76fd639604115e082687ee95026be37c18c3d925151e28dcaaa3a2b133984d470ebfd3232df46abe6428a960d57

Download Submit
C:\Windows\system\fFJcRcj.exe

Filesize
2.3MB

MD5
1d3433192efbc13fe9503dfa3c713349

SHA1
528f87268c39277b0611b1bff7c0f52195edcfe8

SHA256
7c8e9ce1e06f7744e9453fa9f26f46f37470cb18f7f5ecbe8a369445555a7703

SHA512
92b6875bf90ec06753b22889e17a3befcdfabe987f698e120390abd3e4085002dce61941412d85655b6879f73e751b8d176a22ef2347a784c24c23e46d232a6d

Download Submit
C:\Windows\system\ftymZKM.exe

Filesize
2.3MB

MD5
43f7d90801e8ce553d2e36eee5d783c6

SHA1
c0636a7ce658292c7ebe6db189a7c23387138d90

SHA256
00ceb28bf835e0adf10d4b90a7ed4a412559a77fa17bdfb600b3ff764740e4d4

SHA512
2673c335a6631b5b6a238a86b7827c7302bd930b8c6bcd947b7cdd64ce8ed164fa7f8e052b0f84510e7facd524e0fb2049da5dbf5cf4bcc13615c1aa6663cae5

Download Submit
C:\Windows\system\hkTjrWQ.exe

Filesize
2.3MB

MD5
fbefa0cab6eebe5bbb37d2dab65e17c9

SHA1
ecb8e9b215b5f2d83cc96ab4c94e59de65baf6cb

SHA256
f798af677b172b26102348e987497017fcc6d18f86dd8c80b2d5442c0224acc4

SHA512
ed912a977e79fa9712782e6035320a6d1a83ebb1f8309d44be969436aabd7b78d54845400a4ccfdb3df2d68523214effd4b541217d618ed5da09f1918ed735fa

Download Submit
C:\Windows\system\jPIPZmK.exe

Filesize
2.3MB

MD5
e6ec2b6e9c35e4c4ccb4783fc3843411

SHA1
578dccda6f78910650ce7e7b43a4384307b2ac0e

SHA256
36e824a5b71fb782b71fec3b1670c42eee72931886e6f96003918b45dbab9d5e

SHA512
f9273e6f43a240c43af94e5c5261d2c4ceb3c6e5c5115ddbbbbf61827c497d7ae62f95dd8d9e417ca64f2fdf77b8929b80fd0971dd059094b7d224cc01d4e19d

Download Submit
C:\Windows\system\jrimuiI.exe

Filesize
2.3MB

MD5
fa723538e5c71a9bcb03977860c07f74

SHA1
a98699540ebba67bd62fdef37b92435eeeb825ff

SHA256
c6e2fea2bb864187f3311f234a2142c6b73b4813cb8517bdf97487af0d28c462

SHA512
b223a85b441d4ee6050348c448951f1003d603b8f353f23cc3cb9f687e5059cb5e6e4035a9c45ebb3507ce306c8be7ee14c8f7d92449a9a05ed399f571070135

Download Submit
C:\Windows\system\lkjglSY.exe

Filesize
2.3MB

MD5
48d458fb77931f72d894095107a7fcf7

SHA1
19b695112d5002d5d0be393e4ab3841cbc4fe717

SHA256
310b5fb7b943a3524ab192cc4ae1f54dfad6b376d33885e313ef24d9600d9255

SHA512
64adcc4fbe40ba712b32a964d1e56056dab06cff0cbbd98aab5cc856f7fe04c301774dfd7760d71e024819e7c87f3cfe248aec6656da3b037f5f1b5edac69487

Download Submit
C:\Windows\system\oTDdtUy.exe

Filesize
2.3MB

MD5
f58fcf8c6d1fcdf6b623e55a0fa85204

SHA1
84b7e855f8328b5b34b7297e2d8c4b14f4fe0852

SHA256
3a55e2c9bff5369b022cbf7300f5b046fe97afc346327373dee1d72c4d446f1b

SHA512
de60ed99c21f47e5a8dcccc019cf08a47d48945a7f5e7fcbddf5b9f941a1e7f7d0d8f950a8b333bc9c56f937e68c1860edf174869b0fbf62af01648ce38b0588

Download Submit
C:\Windows\system\sMomSfX.exe

Filesize
2.3MB

MD5
550547c93191475643465f1986f605f0

SHA1
2ceb60e6b69e01e09a030521cd844ff6b8198f5e

SHA256
829d23e57676f39b5e5711113cf12293d344bb0c957f55c7d36a268545fb22d8

SHA512
198a3df06dfa61fcf3be838350ae7e8608df79b2e72bc63c4a0b1382a2d74b35db8bc5e2d1c1f3418b65a32fb5a2e43b9d21bbe41fbdaa1637a04ec52aedd03f

Download Submit
C:\Windows\system\saYoQpJ.exe

Filesize
2.3MB

MD5
b22bd61d80bdd9f2ff06c74830a47e5a

SHA1
59d79480b6cc72d42866bf3ad3dbc23b6b1b6920

SHA256
5474a543accbea49df27ca4183542728f2200a7245e0962c66de527a4ddc5e6d

SHA512
d2bed962a851ec1a6b813453b76093578cf9bff03ddd7d3d4520c09a2c0f8c749a0bcd95cebe95c490107213745e474363ba0bec0a03b5382ad00f2c7eac88e5

Download Submit
C:\Windows\system\tdwIKah.exe

Filesize
2.3MB

MD5
73a5f36c3a20a47f4d00a0f414d64490

SHA1
6a50007c8e94802248c6b19ca7cb289d621ff148

SHA256
d5e517c287bad0a79f85f6e44a7b15e0c2976078a35fcb449b600965d45adc90

SHA512
a94badf757cce2267f41c929a622fbb07ec805c35f4549c17a9c3e472ca7831e86572b5cd5a2b5c6f6abfda7b256b4874bad8ba72cf34abf6f9375cadfbba3e3

Download Submit
\Windows\system\FcjlXXX.exe

Filesize
2.3MB

MD5
4a4a390153c8fd8e5194c84f00b046e2

SHA1
b305269b426d65d5fa0fb361999e0fb7e445501d

SHA256
c190d0297f9374365fde3ea2aea5f38591d7f86fcafde610decf50e71a6d24a8

SHA512
7d42dbdbe3a9f9b29ee15f3bd47250bd99198250d0439c23059ae0d86fa20dbc69db70276a1dd41e7fb2b4202979556f8bb554c029bc3f86e3472fa3fcdba680

Download Submit
\Windows\system\IYWTMJg.exe

Filesize
2.3MB

MD5
5c1cfec7e158788a3a0ea948f91e17bf

SHA1
caf1f745a2058426668a6c2564f2aecfe124b720

SHA256
5d59f79c0bcbec0cec55d0ea1977e9d47bdd3fe486c5c8c12c8a7333415b52e6

SHA512
0988a2099d74f55afc90a7cf2823a013044cef4992bdb8cf655fedbc53eb7bbfbd42436a8ff6bd90fe10d20148c2d24153840d55ec23bc0b8edcbdb3596ea6f0

Download Submit
\Windows\system\XFmcQGe.exe

Filesize
2.3MB

MD5
7ec9696a9378e50beaaf5312bd8b6544

SHA1
373863d8822c6b83e372b5a55add2d03756663a5

SHA256
9e01735a1713f7055dc010a43148ee2edb8a7ae646a3cd37abfcaad7adfa5f01

SHA512
9a4bfbe56c40d698bdc4ee70d51ec5afe6ef08e601679406255d80819919f5f9e1769af0579eb8de09a3f3eb545310e783cf4121affd938578ce4a81f0dd6f0d

Download Submit
\Windows\system\fElwnho.exe

Filesize
2.3MB

MD5
79e2c704ec5c7ff99a5666872716e368

SHA1
96427b3a1300506e7c9de16c66ad8fa8e5d5ac60

SHA256
8f1c6e27e69b50215724a1e086488ddd92c03697be394e51f91bed0ff258b340

SHA512
c3845962c7191c6a25dbd9ee84d4400a4ed58a590a599e9806631c980b82368555f52295ea8cf279f8487c38894e1c37c9865789016c99cee6efce2faedea39a

Download Submit
\Windows\system\klffCSQ.exe

Filesize
2.3MB

MD5
aebb06f4d9a9e513521edd800e76f52a

SHA1
066b3dde7f7a9a7a15cc3f03a005587ccd5000a8

SHA256
9dbabea140d561d7c8c418e9c663d70418201c14059eab441bdedb092bc73354

SHA512
54e2e859aea0bb9f7978ce29a9874c634ebd36f24ef6dcfbb3e0781927954562dc0ffbf5e44e95dda9538dd2c1eef015410ca21bee4853d09bde746ce1893d6a

Download Submit
\Windows\system\pLMnyQQ.exe

Filesize
2.3MB

MD5
74d16e1e2b5468c6a2f909fa548ad107

SHA1
c6f7f4052a6273c05232ad1b60e7e3feb23e87b7

SHA256
4bdf386b04f69aac8d3ebae78d7640c6fdfba6305e9d152e35c520bcc5be81de

SHA512
767e9b22b60df10d5fc27af0ba83a64bcdf1568522f92fbcdbc1bec4068c0d9d5c0dcd47bccbdc1c61cdd4f7e2d2b2524b2f07ec674573d127dc1cde705089a1

Download Submit
\Windows\system\qYIFvLc.exe

Filesize
2.3MB

MD5
bdfc1d4d5bcd1b3eff90d494d6687e1c

SHA1
d5a4ce8dccf8485b95ba1b42f64bf0b4ef264ee6

SHA256
5fa325637c680786d66bc77ebb9c30c88485d96c73ea8c125aa62126a3fa5594

SHA512
8906a32a5f29d79a83a43bf238c049355c430ddd400af82ea790d101a9f12c20f99d0d10ee9a6b368a661f26719aab19702c6a3178f05dee43da039048f1759c

Download Submit
\Windows\system\wTEaLpz.exe

Filesize
2.3MB

MD5
444c9649a2de11d69a44fab997c991d1

SHA1
20d1a05d6f00d60143a45c3a63fd8ce74c7feb65

SHA256
06673f2bcde2e48afb875015a1cebde973ccccc30997419f608fa7b63b34302b

SHA512
8be9c7015c7b91d7bb265e8b8e4c8093804ced9c8da1e781d18546b022abf5be9e8730262747ae60ea78162981529bdea6173955780fd9524f23d0c59303c006

Download Submit
memory/1164-17-0x000000013F4D0000-0x000000013F8C2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-112-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-116-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-7-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-2-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/1304-136-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/1304-114-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-118-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1304-120-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-139-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/1304-137-0x0000000003200000-0x00000000035F2000-memory.dmp

Filesize
3.9MB

Download
memory/1304-134-0x00000000036E0000-0x0000000003AD2000-memory.dmp

Filesize
3.9MB

Download
memory/1712-109-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/1712-122-0x0000000001F70000-0x0000000001F78000-memory.dmp

Filesize
32KB

Download
memory/1712-55-0x000000001B700000-0x000000001B9E2000-memory.dmp

Filesize
2.9MB

Download
memory/1712-108-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1712-110-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/1796-138-0x000000013F210000-0x000000013F602000-memory.dmp

Filesize
3.9MB

Download
memory/2556-115-0x000000013F580000-0x000000013F972000-memory.dmp

Filesize
3.9MB

Download
memory/2660-111-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2744-133-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2760-119-0x000000013F590000-0x000000013F982000-memory.dmp

Filesize
3.9MB

Download
memory/2868-135-0x000000013F280000-0x000000013F672000-memory.dmp

Filesize
3.9MB

Download
memory/2916-117-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2928-113-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download