xmrig | 9f2c6b6544598c44c00e4018e582ddcbd8825ae1697bfa994e496960b5bf324d

Analysis

max time kernel
30s
max time network
30s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 00:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Size

1.7MB
MD5

02006dc46a47991dbae87911266b5de2
SHA1

d6394af0cd355fa7956fdc3b831ad881207673cf
SHA256

9f2c6b6544598c44c00e4018e582ddcbd8825ae1697bfa994e496960b5bf324d
SHA512

76d8ae31837f3dbdd2666c7e077d1c04abf9943fc152178a314577aeef5c365d6014274f116026e5f32242451ae4e44a21829162216babb900dbbf1ce63e3247
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtG:Lz071uv4BPMkibTIA5I4TNrpDGgDQ6

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2708-139-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	xmrig
behavioral1/memory/2520-156-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/1028-135-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2728-142-0x000000013F290000-0x000000013F682000-memory.dmp	xmrig
behavioral1/memory/2504-131-0x000000013FD10000-0x0000000140102000-memory.dmp	xmrig
behavioral1/memory/2616-128-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2416-154-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/2632-150-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2492	zFouigH.exe
2616	oSNAJlf.exe
2504	CpXSYwg.exe
1028	ZzWIIhm.exe
2708	WuaeYOc.exe
2728	RxRJvBP.exe
2632	dPrSFkK.exe
2416	JdlPZew.exe
2520	NOkBWrX.exe
2464	QhMIVAv.exe
1588	NOZLxUb.exe
1064	XgbcOcd.exe
2676	lJmGvHj.exe
2740	JSWsaUF.exe
2780	ehsvWLW.exe
1540	klqgGPr.exe
1528	BDqCpkk.exe
1020	YiCxPLn.exe
832	JkbfwFp.exe
1636	ZZAKaHF.exe
2456	EZTnVPd.exe
828	WwCvJxd.exe
1348	xBBRDHR.exe
2040	MNQzlmI.exe
752	wEdZkuj.exe
2248	OLBjNWu.exe
2864	kitYrbO.exe
2768	NjCTmPe.exe
2748	fiqJyvC.exe
2092	giXVGtK.exe
908	jtSbaze.exe
2200	KiVpOGr.exe
2272	eWMKgtb.exe
672	WmSLSsE.exe
2144	AisVtCX.exe
1868	sBUGSdu.exe
1008	pRhrWLU.exe
1604	daPAenD.exe
2072	vEjEnho.exe
2192	oaVJbFm.exe
1576	BxNvKOD.exe
1284	ftLUrQJ.exe
1184	OIPMikp.exe
2484	bxfdOYq.exe
1420	QacOIqn.exe
820	NRzleLh.exe
952	NdOUNNq.exe
2160	UkxvSem.exe
572	pmaXSVa.exe
1696	fgHoILK.exe
876	YPopXAU.exe
1532	yxLfixO.exe
1516	SQUruzY.exe
2604	XSeUhEo.exe
2552	GNjyJCz.exe
860	HtPCieJ.exe
2516	fMjXYZI.exe
2324	yeMvLJz.exe
2888	itPbLpi.exe
2660	cPrIVXZ.exe
2476	WkjSnVU.exe
1252	uJueVgk.exe
2720	TylNeEx.exe
980	EyIciJG.exe

Loads dropped DLL 64 IoCs

pid	Process
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2860-0-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x000c000000012707-3.dat	upx
behavioral1/files/0x00070000000158d9-24.dat	upx
behavioral1/memory/2492-13-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/files/0x0008000000015662-21.dat	upx
behavioral1/files/0x002f000000014c2d-17.dat	upx
behavioral1/files/0x0016000000005586-27.dat	upx
behavioral1/files/0x000a000000015b50-42.dat	upx
behavioral1/files/0x0006000000015d85-48.dat	upx
behavioral1/files/0x0006000000015f23-57.dat	upx
behavioral1/files/0x0009000000015c9a-46.dat	upx
behavioral1/files/0x0006000000015d9c-55.dat	upx
behavioral1/files/0x0006000000016013-70.dat	upx
behavioral1/files/0x00060000000161ee-77.dat	upx
behavioral1/files/0x00060000000164ec-90.dat	upx
behavioral1/files/0x0006000000016c1f-105.dat	upx
behavioral1/files/0x0006000000016c38-115.dat	upx
behavioral1/files/0x0006000000016c30-121.dat	upx
behavioral1/files/0x0006000000016c84-123.dat	upx
behavioral1/files/0x0006000000016575-104.dat	upx
behavioral1/memory/2708-139-0x000000013F2D0000-0x000000013F6C2000-memory.dmp	upx
behavioral1/memory/2520-156-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/1028-135-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x0006000000016ce0-163.dat	upx
behavioral1/files/0x0006000000016d10-184.dat	upx
behavioral1/files/0x0006000000016d06-179.dat	upx
behavioral1/files/0x0006000000016cfd-175.dat	upx
behavioral1/files/0x0006000000016cf3-172.dat	upx
behavioral1/files/0x0006000000016cb5-144.dat	upx
behavioral1/memory/2728-142-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/memory/2504-131-0x000000013FD10000-0x0000000140102000-memory.dmp	upx
behavioral1/memory/2616-128-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/files/0x002f000000014f57-167.dat	upx
behavioral1/memory/2416-154-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/files/0x0006000000016ced-152.dat	upx
behavioral1/memory/2632-150-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0006000000016a28-99.dat	upx
behavioral1/files/0x00060000000163eb-85.dat	upx
behavioral1/files/0x00060000000167bf-97.dat	upx
behavioral1/files/0x0006000000016122-75.dat	upx
behavioral1/files/0x0006000000015fa6-66.dat	upx
behavioral1/files/0x0007000000015ae3-36.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yhzTjwr.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\jWQnxMP.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\oSNAJlf.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\LWwMRSj.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\GGvjQEO.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ogzxsay.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\yseElGq.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\STvYFPK.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\aLmZgpc.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\mCLHGAM.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\xFCAhsz.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\cjDMkJa.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\sihpwiA.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\QOYNzaS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\fwYmHKP.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\lOGzHkw.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\JdlPZew.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\lcxJSUe.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\DziZtBI.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\gEYXbub.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\GVxkECc.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\wEdZkuj.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\JVazfmD.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\GTVRPLo.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\MGTwoGr.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\tfxgYXI.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\lJmGvHj.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\qiGWtNh.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\OkQrnGt.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\RxKRVqw.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\yJYVOLm.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\YrKLgdu.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\yGoaHEC.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\atTfLSJ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\UpueOWa.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ITMMmXv.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\lxxzKpu.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\CPqRQLL.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\ByUxRlb.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\hpVNonb.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\VEjVgVm.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\JhOdsaZ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\QGwlOBs.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\uzCWTcK.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\yBdAEFB.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\xEoRPbf.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\chOKtGw.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\aGhoDeJ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\jeJbhCG.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\QLRcBvy.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\sRWpCrQ.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\LrumjUc.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\mPBHAve.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\JhFrDIU.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\HmyXsHq.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\uqzAiRs.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\CESJgYd.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\wPQSotB.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\WFZYGMt.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\AmAgsTP.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\eaMjTZp.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\SykyoaS.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\guuTDhO.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
File created	C:\Windows\System\edmrluI.exe	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
Token: SeDebugPrivilege	1624	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 1624	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	29
PID 2860 wrote to memory of 1624	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	29
PID 2860 wrote to memory of 1624	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	29
PID 2860 wrote to memory of 2492	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2492	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2492	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	30
PID 2860 wrote to memory of 2616	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2616	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2616	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	31
PID 2860 wrote to memory of 2504	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2504	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2504	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	32
PID 2860 wrote to memory of 2708	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2708	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	33
PID 2860 wrote to memory of 2708	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	33
PID 2860 wrote to memory of 1028	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	34
PID 2860 wrote to memory of 1028	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	34
PID 2860 wrote to memory of 1028	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	34
PID 2860 wrote to memory of 2728	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2728	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2728	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	35
PID 2860 wrote to memory of 2632	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2632	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2632	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	36
PID 2860 wrote to memory of 2416	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2416	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2416	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	37
PID 2860 wrote to memory of 2520	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2520	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2520	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	38
PID 2860 wrote to memory of 2464	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	39
PID 2860 wrote to memory of 2464	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	39
PID 2860 wrote to memory of 2464	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	39
PID 2860 wrote to memory of 1588	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1588	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1588	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	40
PID 2860 wrote to memory of 1064	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	41
PID 2860 wrote to memory of 1064	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	41
PID 2860 wrote to memory of 1064	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	41
PID 2860 wrote to memory of 2676	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2676	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2676	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	42
PID 2860 wrote to memory of 2740	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	43
PID 2860 wrote to memory of 2740	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	43
PID 2860 wrote to memory of 2740	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	43
PID 2860 wrote to memory of 2780	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	44
PID 2860 wrote to memory of 2780	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	44
PID 2860 wrote to memory of 2780	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	44
PID 2860 wrote to memory of 1540	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1540	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1540	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	45
PID 2860 wrote to memory of 1528	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1528	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	46
PID 2860 wrote to memory of 1528	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	46
PID 2860 wrote to memory of 832	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	47
PID 2860 wrote to memory of 832	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	47
PID 2860 wrote to memory of 832	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	47
PID 2860 wrote to memory of 1020	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	48
PID 2860 wrote to memory of 1020	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	48
PID 2860 wrote to memory of 1020	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	48
PID 2860 wrote to memory of 828	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	49
PID 2860 wrote to memory of 828	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	49
PID 2860 wrote to memory of 828	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	49
PID 2860 wrote to memory of 1636	2860	02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02006dc46a47991dbae87911266b5de2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1624
- C:\Windows\System\zFouigH.exe
  C:\Windows\System\zFouigH.exe
  2⤵
  - Executes dropped EXE
  PID:2492
- C:\Windows\System\oSNAJlf.exe
  C:\Windows\System\oSNAJlf.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\CpXSYwg.exe
  C:\Windows\System\CpXSYwg.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\WuaeYOc.exe
  C:\Windows\System\WuaeYOc.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\ZzWIIhm.exe
  C:\Windows\System\ZzWIIhm.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\RxRJvBP.exe
  C:\Windows\System\RxRJvBP.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\dPrSFkK.exe
  C:\Windows\System\dPrSFkK.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JdlPZew.exe
  C:\Windows\System\JdlPZew.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\NOkBWrX.exe
  C:\Windows\System\NOkBWrX.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\QhMIVAv.exe
  C:\Windows\System\QhMIVAv.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\NOZLxUb.exe
  C:\Windows\System\NOZLxUb.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\XgbcOcd.exe
  C:\Windows\System\XgbcOcd.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\lJmGvHj.exe
  C:\Windows\System\lJmGvHj.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\JSWsaUF.exe
  C:\Windows\System\JSWsaUF.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\ehsvWLW.exe
  C:\Windows\System\ehsvWLW.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\klqgGPr.exe
  C:\Windows\System\klqgGPr.exe
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Windows\System\BDqCpkk.exe
  C:\Windows\System\BDqCpkk.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\JkbfwFp.exe
  C:\Windows\System\JkbfwFp.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\YiCxPLn.exe
  C:\Windows\System\YiCxPLn.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\WwCvJxd.exe
  C:\Windows\System\WwCvJxd.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\ZZAKaHF.exe
  C:\Windows\System\ZZAKaHF.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\xBBRDHR.exe
  C:\Windows\System\xBBRDHR.exe
  2⤵
  - Executes dropped EXE
  PID:1348
- C:\Windows\System\EZTnVPd.exe
  C:\Windows\System\EZTnVPd.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\MNQzlmI.exe
  C:\Windows\System\MNQzlmI.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\wEdZkuj.exe
  C:\Windows\System\wEdZkuj.exe
  2⤵
  - Executes dropped EXE
  PID:752
- C:\Windows\System\kitYrbO.exe
  C:\Windows\System\kitYrbO.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\OLBjNWu.exe
  C:\Windows\System\OLBjNWu.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\fiqJyvC.exe
  C:\Windows\System\fiqJyvC.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\NjCTmPe.exe
  C:\Windows\System\NjCTmPe.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\giXVGtK.exe
  C:\Windows\System\giXVGtK.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\jtSbaze.exe
  C:\Windows\System\jtSbaze.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\KiVpOGr.exe
  C:\Windows\System\KiVpOGr.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\eWMKgtb.exe
  C:\Windows\System\eWMKgtb.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\AisVtCX.exe
  C:\Windows\System\AisVtCX.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\WmSLSsE.exe
  C:\Windows\System\WmSLSsE.exe
  2⤵
  - Executes dropped EXE
  PID:672
- C:\Windows\System\BxNvKOD.exe
  C:\Windows\System\BxNvKOD.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\sBUGSdu.exe
  C:\Windows\System\sBUGSdu.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\ftLUrQJ.exe
  C:\Windows\System\ftLUrQJ.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\pRhrWLU.exe
  C:\Windows\System\pRhrWLU.exe
  2⤵
  - Executes dropped EXE
  PID:1008
- C:\Windows\System\NRzleLh.exe
  C:\Windows\System\NRzleLh.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\daPAenD.exe
  C:\Windows\System\daPAenD.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\NdOUNNq.exe
  C:\Windows\System\NdOUNNq.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\vEjEnho.exe
  C:\Windows\System\vEjEnho.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\UkxvSem.exe
  C:\Windows\System\UkxvSem.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\oaVJbFm.exe
  C:\Windows\System\oaVJbFm.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\pmaXSVa.exe
  C:\Windows\System\pmaXSVa.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\OIPMikp.exe
  C:\Windows\System\OIPMikp.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\fgHoILK.exe
  C:\Windows\System\fgHoILK.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\bxfdOYq.exe
  C:\Windows\System\bxfdOYq.exe
  2⤵
  - Executes dropped EXE
  PID:2484
- C:\Windows\System\YPopXAU.exe
  C:\Windows\System\YPopXAU.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\QacOIqn.exe
  C:\Windows\System\QacOIqn.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\yxLfixO.exe
  C:\Windows\System\yxLfixO.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\SQUruzY.exe
  C:\Windows\System\SQUruzY.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\HtPCieJ.exe
  C:\Windows\System\HtPCieJ.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\XSeUhEo.exe
  C:\Windows\System\XSeUhEo.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\fMjXYZI.exe
  C:\Windows\System\fMjXYZI.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\GNjyJCz.exe
  C:\Windows\System\GNjyJCz.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\yeMvLJz.exe
  C:\Windows\System\yeMvLJz.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\itPbLpi.exe
  C:\Windows\System\itPbLpi.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\WkjSnVU.exe
  C:\Windows\System\WkjSnVU.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\cPrIVXZ.exe
  C:\Windows\System\cPrIVXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\TylNeEx.exe
  C:\Windows\System\TylNeEx.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\uJueVgk.exe
  C:\Windows\System\uJueVgk.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\EyIciJG.exe
  C:\Windows\System\EyIciJG.exe
  2⤵
  - Executes dropped EXE
  PID:980
- C:\Windows\System\saunJJc.exe
  C:\Windows\System\saunJJc.exe
  2⤵
  PID:2024
- C:\Windows\System\yGoaHEC.exe
  C:\Windows\System\yGoaHEC.exe
  2⤵
  PID:2188
- C:\Windows\System\NaHWpwk.exe
  C:\Windows\System\NaHWpwk.exe
  2⤵
  PID:1640
- C:\Windows\System\sYXkuWy.exe
  C:\Windows\System\sYXkuWy.exe
  2⤵
  PID:1692
- C:\Windows\System\grHgMZA.exe
  C:\Windows\System\grHgMZA.exe
  2⤵
  PID:1260
- C:\Windows\System\yzvIGnA.exe
  C:\Windows\System\yzvIGnA.exe
  2⤵
  PID:2500
- C:\Windows\System\gdZbsSR.exe
  C:\Windows\System\gdZbsSR.exe
  2⤵
  PID:1972
- C:\Windows\System\eTrXvbU.exe
  C:\Windows\System\eTrXvbU.exe
  2⤵
  PID:1988
- C:\Windows\System\quiIxlI.exe
  C:\Windows\System\quiIxlI.exe
  2⤵
  PID:1908
- C:\Windows\System\Rurbaet.exe
  C:\Windows\System\Rurbaet.exe
  2⤵
  PID:384
- C:\Windows\System\zMlKJxZ.exe
  C:\Windows\System\zMlKJxZ.exe
  2⤵
  PID:840
- C:\Windows\System\xukpTur.exe
  C:\Windows\System\xukpTur.exe
  2⤵
  PID:292
- C:\Windows\System\WXysVUN.exe
  C:\Windows\System\WXysVUN.exe
  2⤵
  PID:1608
- C:\Windows\System\qGWjHOi.exe
  C:\Windows\System\qGWjHOi.exe
  2⤵
  PID:2112
- C:\Windows\System\PoHnXAn.exe
  C:\Windows\System\PoHnXAn.exe
  2⤵
  PID:2088
- C:\Windows\System\CPqRQLL.exe
  C:\Windows\System\CPqRQLL.exe
  2⤵
  PID:1172
- C:\Windows\System\zIIhcqG.exe
  C:\Windows\System\zIIhcqG.exe
  2⤵
  PID:864
- C:\Windows\System\rtgeRBl.exe
  C:\Windows\System\rtgeRBl.exe
  2⤵
  PID:1776
- C:\Windows\System\xBBtYSG.exe
  C:\Windows\System\xBBtYSG.exe
  2⤵
  PID:2884
- C:\Windows\System\MctJJuW.exe
  C:\Windows\System\MctJJuW.exe
  2⤵
  PID:2796
- C:\Windows\System\nAKTwEH.exe
  C:\Windows\System\nAKTwEH.exe
  2⤵
  PID:1888
- C:\Windows\System\LjOhRWw.exe
  C:\Windows\System\LjOhRWw.exe
  2⤵
  PID:1524
- C:\Windows\System\xYFSlDC.exe
  C:\Windows\System\xYFSlDC.exe
  2⤵
  PID:1512
- C:\Windows\System\VccQJkZ.exe
  C:\Windows\System\VccQJkZ.exe
  2⤵
  PID:608
- C:\Windows\System\XFwavej.exe
  C:\Windows\System\XFwavej.exe
  2⤵
  PID:2928
- C:\Windows\System\SxvCbLG.exe
  C:\Windows\System\SxvCbLG.exe
  2⤵
  PID:1440
- C:\Windows\System\acMNrhK.exe
  C:\Windows\System\acMNrhK.exe
  2⤵
  PID:1560
- C:\Windows\System\rubkkzf.exe
  C:\Windows\System\rubkkzf.exe
  2⤵
  PID:352
- C:\Windows\System\DNYvqVN.exe
  C:\Windows\System\DNYvqVN.exe
  2⤵
  PID:2592
- C:\Windows\System\LfIDfRl.exe
  C:\Windows\System\LfIDfRl.exe
  2⤵
  PID:356
- C:\Windows\System\lcxJSUe.exe
  C:\Windows\System\lcxJSUe.exe
  2⤵
  PID:2952
- C:\Windows\System\UYXqhCv.exe
  C:\Windows\System\UYXqhCv.exe
  2⤵
  PID:1300
- C:\Windows\System\LxMZtpW.exe
  C:\Windows\System\LxMZtpW.exe
  2⤵
  PID:2016
- C:\Windows\System\TWQouhF.exe
  C:\Windows\System\TWQouhF.exe
  2⤵
  PID:1860
- C:\Windows\System\rZkZRgk.exe
  C:\Windows\System\rZkZRgk.exe
  2⤵
  PID:2976
- C:\Windows\System\sCgyxRX.exe
  C:\Windows\System\sCgyxRX.exe
  2⤵
  PID:2908
- C:\Windows\System\feZGzRZ.exe
  C:\Windows\System\feZGzRZ.exe
  2⤵
  PID:2004
- C:\Windows\System\FVyYPGo.exe
  C:\Windows\System\FVyYPGo.exe
  2⤵
  PID:2628
- C:\Windows\System\qrSmAze.exe
  C:\Windows\System\qrSmAze.exe
  2⤵
  PID:2692
- C:\Windows\System\wqTDmtg.exe
  C:\Windows\System\wqTDmtg.exe
  2⤵
  PID:2544
- C:\Windows\System\RJNWMXY.exe
  C:\Windows\System\RJNWMXY.exe
  2⤵
  PID:3012
- C:\Windows\System\OoOAeRl.exe
  C:\Windows\System\OoOAeRl.exe
  2⤵
  PID:1472
- C:\Windows\System\ZMrDvwQ.exe
  C:\Windows\System\ZMrDvwQ.exe
  2⤵
  PID:2808
- C:\Windows\System\xfoyGJk.exe
  C:\Windows\System\xfoyGJk.exe
  2⤵
  PID:1736
- C:\Windows\System\DrHlkiM.exe
  C:\Windows\System\DrHlkiM.exe
  2⤵
  PID:956
- C:\Windows\System\wyyRXdD.exe
  C:\Windows\System\wyyRXdD.exe
  2⤵
  PID:3024
- C:\Windows\System\flgxUJx.exe
  C:\Windows\System\flgxUJx.exe
  2⤵
  PID:2396
- C:\Windows\System\xobITpr.exe
  C:\Windows\System\xobITpr.exe
  2⤵
  PID:1424
- C:\Windows\System\lUGtiiK.exe
  C:\Windows\System\lUGtiiK.exe
  2⤵
  PID:2540
- C:\Windows\System\fIGyqAc.exe
  C:\Windows\System\fIGyqAc.exe
  2⤵
  PID:1468
- C:\Windows\System\XZurvJu.exe
  C:\Windows\System\XZurvJu.exe
  2⤵
  PID:1580
- C:\Windows\System\ogzxsay.exe
  C:\Windows\System\ogzxsay.exe
  2⤵
  PID:2108
- C:\Windows\System\UJCQIHq.exe
  C:\Windows\System\UJCQIHq.exe
  2⤵
  PID:472
- C:\Windows\System\alWDGka.exe
  C:\Windows\System\alWDGka.exe
  2⤵
  PID:1416
- C:\Windows\System\PekacFG.exe
  C:\Windows\System\PekacFG.exe
  2⤵
  PID:2896
- C:\Windows\System\JCBmGYw.exe
  C:\Windows\System\JCBmGYw.exe
  2⤵
  PID:1192
- C:\Windows\System\QaBCUgb.exe
  C:\Windows\System\QaBCUgb.exe
  2⤵
  PID:1508
- C:\Windows\System\cyfdgEH.exe
  C:\Windows\System\cyfdgEH.exe
  2⤵
  PID:2668
- C:\Windows\System\RPiJSyq.exe
  C:\Windows\System\RPiJSyq.exe
  2⤵
  PID:2404
- C:\Windows\System\OYegVqV.exe
  C:\Windows\System\OYegVqV.exe
  2⤵
  PID:2204
- C:\Windows\System\LlDybBj.exe
  C:\Windows\System\LlDybBj.exe
  2⤵
  PID:108
- C:\Windows\System\dfFFLlZ.exe
  C:\Windows\System\dfFFLlZ.exe
  2⤵
  PID:1124
- C:\Windows\System\hjuEmFF.exe
  C:\Windows\System\hjuEmFF.exe
  2⤵
  PID:2172
- C:\Windows\System\lpFZtvu.exe
  C:\Windows\System\lpFZtvu.exe
  2⤵
  PID:1944
- C:\Windows\System\SHPjrZI.exe
  C:\Windows\System\SHPjrZI.exe
  2⤵
  PID:1248
- C:\Windows\System\TlWzmjs.exe
  C:\Windows\System\TlWzmjs.exe
  2⤵
  PID:2280
- C:\Windows\System\MgaZvUX.exe
  C:\Windows\System\MgaZvUX.exe
  2⤵
  PID:1408
- C:\Windows\System\UnXrfrM.exe
  C:\Windows\System\UnXrfrM.exe
  2⤵
  PID:2020
- C:\Windows\System\bdUkSfs.exe
  C:\Windows\System\bdUkSfs.exe
  2⤵
  PID:2356
- C:\Windows\System\gZQUHwN.exe
  C:\Windows\System\gZQUHwN.exe
  2⤵
  PID:2688
- C:\Windows\System\okFFyug.exe
  C:\Windows\System\okFFyug.exe
  2⤵
  PID:348
- C:\Windows\System\evxexNS.exe
  C:\Windows\System\evxexNS.exe
  2⤵
  PID:544
- C:\Windows\System\suLFbWR.exe
  C:\Windows\System\suLFbWR.exe
  2⤵
  PID:3076
- C:\Windows\System\qiGWtNh.exe
  C:\Windows\System\qiGWtNh.exe
  2⤵
  PID:3100
- C:\Windows\System\tqdcFaN.exe
  C:\Windows\System\tqdcFaN.exe
  2⤵
  PID:3116
- C:\Windows\System\VRWXzHx.exe
  C:\Windows\System\VRWXzHx.exe
  2⤵
  PID:3132
- C:\Windows\System\DvSyIZy.exe
  C:\Windows\System\DvSyIZy.exe
  2⤵
  PID:3148
- C:\Windows\System\IWJgDjW.exe
  C:\Windows\System\IWJgDjW.exe
  2⤵
  PID:3168
- C:\Windows\System\GMNRaPl.exe
  C:\Windows\System\GMNRaPl.exe
  2⤵
  PID:3184
- C:\Windows\System\AIOpHYE.exe
  C:\Windows\System\AIOpHYE.exe
  2⤵
  PID:3200
- C:\Windows\System\OxhGVTV.exe
  C:\Windows\System\OxhGVTV.exe
  2⤵
  PID:3216
- C:\Windows\System\EIQqDtj.exe
  C:\Windows\System\EIQqDtj.exe
  2⤵
  PID:3232
- C:\Windows\System\FaVICWv.exe
  C:\Windows\System\FaVICWv.exe
  2⤵
  PID:3252
- C:\Windows\System\LFuXUbE.exe
  C:\Windows\System\LFuXUbE.exe
  2⤵
  PID:3268
- C:\Windows\System\lnkTvuW.exe
  C:\Windows\System\lnkTvuW.exe
  2⤵
  PID:3304
- C:\Windows\System\zZiEHXv.exe
  C:\Windows\System\zZiEHXv.exe
  2⤵
  PID:3320
- C:\Windows\System\DYuPfJQ.exe
  C:\Windows\System\DYuPfJQ.exe
  2⤵
  PID:3340
- C:\Windows\System\VlURBzX.exe
  C:\Windows\System\VlURBzX.exe
  2⤵
  PID:3356
- C:\Windows\System\HOFyKRb.exe
  C:\Windows\System\HOFyKRb.exe
  2⤵
  PID:3372
- C:\Windows\System\kGCUtLv.exe
  C:\Windows\System\kGCUtLv.exe
  2⤵
  PID:3388
- C:\Windows\System\YvfvTRj.exe
  C:\Windows\System\YvfvTRj.exe
  2⤵
  PID:3408
- C:\Windows\System\ZqOJhZc.exe
  C:\Windows\System\ZqOJhZc.exe
  2⤵
  PID:3424
- C:\Windows\System\HmyXsHq.exe
  C:\Windows\System\HmyXsHq.exe
  2⤵
  PID:3440
- C:\Windows\System\ztcHwwZ.exe
  C:\Windows\System\ztcHwwZ.exe
  2⤵
  PID:3456
- C:\Windows\System\dQmsKNx.exe
  C:\Windows\System\dQmsKNx.exe
  2⤵
  PID:3476
- C:\Windows\System\IJcDmLI.exe
  C:\Windows\System\IJcDmLI.exe
  2⤵
  PID:3492
- C:\Windows\System\hkWlVZQ.exe
  C:\Windows\System\hkWlVZQ.exe
  2⤵
  PID:3508
- C:\Windows\System\uUhXkZe.exe
  C:\Windows\System\uUhXkZe.exe
  2⤵
  PID:3528
- C:\Windows\System\DTKeZhl.exe
  C:\Windows\System\DTKeZhl.exe
  2⤵
  PID:3728
- C:\Windows\System\YHkewaS.exe
  C:\Windows\System\YHkewaS.exe
  2⤵
  PID:3748
- C:\Windows\System\tiiKpgO.exe
  C:\Windows\System\tiiKpgO.exe
  2⤵
  PID:3768
- C:\Windows\System\IFURGSr.exe
  C:\Windows\System\IFURGSr.exe
  2⤵
  PID:3784
- C:\Windows\System\RixTqAB.exe
  C:\Windows\System\RixTqAB.exe
  2⤵
  PID:3812
- C:\Windows\System\uufLYrm.exe
  C:\Windows\System\uufLYrm.exe
  2⤵
  PID:3828
- C:\Windows\System\JyEqdOt.exe
  C:\Windows\System\JyEqdOt.exe
  2⤵
  PID:3848
- C:\Windows\System\yBpiJGF.exe
  C:\Windows\System\yBpiJGF.exe
  2⤵
  PID:3864
- C:\Windows\System\SnvyEkZ.exe
  C:\Windows\System\SnvyEkZ.exe
  2⤵
  PID:3884
- C:\Windows\System\fCxbyTK.exe
  C:\Windows\System\fCxbyTK.exe
  2⤵
  PID:3908
- C:\Windows\System\qSWUloX.exe
  C:\Windows\System\qSWUloX.exe
  2⤵
  PID:3928
- C:\Windows\System\YnYJXLE.exe
  C:\Windows\System\YnYJXLE.exe
  2⤵
  PID:3948
- C:\Windows\System\eLGTpYM.exe
  C:\Windows\System\eLGTpYM.exe
  2⤵
  PID:3964
- C:\Windows\System\CCYcyEe.exe
  C:\Windows\System\CCYcyEe.exe
  2⤵
  PID:3992
- C:\Windows\System\RTIGuqf.exe
  C:\Windows\System\RTIGuqf.exe
  2⤵
  PID:4008
- C:\Windows\System\BzZcGBt.exe
  C:\Windows\System\BzZcGBt.exe
  2⤵
  PID:4032
- C:\Windows\System\tecpURa.exe
  C:\Windows\System\tecpURa.exe
  2⤵
  PID:4048
- C:\Windows\System\YvFMUSu.exe
  C:\Windows\System\YvFMUSu.exe
  2⤵
  PID:4068
- C:\Windows\System\JdgIErH.exe
  C:\Windows\System\JdgIErH.exe
  2⤵
  PID:4088
- C:\Windows\System\SiHuplf.exe
  C:\Windows\System\SiHuplf.exe
  2⤵
  PID:2436
- C:\Windows\System\QGwlOBs.exe
  C:\Windows\System\QGwlOBs.exe
  2⤵
  PID:564
- C:\Windows\System\LHUZyLe.exe
  C:\Windows\System\LHUZyLe.exe
  2⤵
  PID:2316
- C:\Windows\System\TsuUeEv.exe
  C:\Windows\System\TsuUeEv.exe
  2⤵
  PID:2124
- C:\Windows\System\tFVjSbR.exe
  C:\Windows\System\tFVjSbR.exe
  2⤵
  PID:844
- C:\Windows\System\vrBeWIx.exe
  C:\Windows\System\vrBeWIx.exe
  2⤵
  PID:1708
- C:\Windows\System\mkcwOly.exe
  C:\Windows\System\mkcwOly.exe
  2⤵
  PID:452
- C:\Windows\System\pVoffsr.exe
  C:\Windows\System\pVoffsr.exe
  2⤵
  PID:2828
- C:\Windows\System\sFIAcRh.exe
  C:\Windows\System\sFIAcRh.exe
  2⤵
  PID:2656
- C:\Windows\System\thEoHYD.exe
  C:\Windows\System\thEoHYD.exe
  2⤵
  PID:2744
- C:\Windows\System\VDfqqqR.exe
  C:\Windows\System\VDfqqqR.exe
  2⤵
  PID:2132
- C:\Windows\System\tVPQlQV.exe
  C:\Windows\System\tVPQlQV.exe
  2⤵
  PID:3016
- C:\Windows\System\rrVUjjM.exe
  C:\Windows\System\rrVUjjM.exe
  2⤵
  PID:3140
- C:\Windows\System\FuyUGdU.exe
  C:\Windows\System\FuyUGdU.exe
  2⤵
  PID:3208
- C:\Windows\System\JWEZwAC.exe
  C:\Windows\System\JWEZwAC.exe
  2⤵
  PID:3284
- C:\Windows\System\dCpbJdG.exe
  C:\Windows\System\dCpbJdG.exe
  2⤵
  PID:3336
- C:\Windows\System\ggefAUW.exe
  C:\Windows\System\ggefAUW.exe
  2⤵
  PID:1556
- C:\Windows\System\dDvtPZr.exe
  C:\Windows\System\dDvtPZr.exe
  2⤵
  PID:2036
- C:\Windows\System\mOwkZfv.exe
  C:\Windows\System\mOwkZfv.exe
  2⤵
  PID:3088
- C:\Windows\System\wiVEcKv.exe
  C:\Windows\System\wiVEcKv.exe
  2⤵
  PID:3160
- C:\Windows\System\JVulYUL.exe
  C:\Windows\System\JVulYUL.exe
  2⤵
  PID:3224
- C:\Windows\System\OiFTyUD.exe
  C:\Windows\System\OiFTyUD.exe
  2⤵
  PID:3468
- C:\Windows\System\JVazfmD.exe
  C:\Windows\System\JVazfmD.exe
  2⤵
  PID:3504
- C:\Windows\System\DBuMALY.exe
  C:\Windows\System\DBuMALY.exe
  2⤵
  PID:3420
- C:\Windows\System\zjenGLL.exe
  C:\Windows\System\zjenGLL.exe
  2⤵
  PID:3488
- C:\Windows\System\dEAAtGi.exe
  C:\Windows\System\dEAAtGi.exe
  2⤵
  PID:2596
- C:\Windows\System\wAzFnRk.exe
  C:\Windows\System\wAzFnRk.exe
  2⤵
  PID:3556
- C:\Windows\System\mXrdTGn.exe
  C:\Windows\System\mXrdTGn.exe
  2⤵
  PID:3568
- C:\Windows\System\bjNopmc.exe
  C:\Windows\System\bjNopmc.exe
  2⤵
  PID:3584
- C:\Windows\System\hilMNLi.exe
  C:\Windows\System\hilMNLi.exe
  2⤵
  PID:3592
- C:\Windows\System\vOxMaKi.exe
  C:\Windows\System\vOxMaKi.exe
  2⤵
  PID:3436
- C:\Windows\System\FrKnvAs.exe
  C:\Windows\System\FrKnvAs.exe
  2⤵
  PID:3652
- C:\Windows\System\cssbbQS.exe
  C:\Windows\System\cssbbQS.exe
  2⤵
  PID:3536
- C:\Windows\System\yJlBxSe.exe
  C:\Windows\System\yJlBxSe.exe
  2⤵
  PID:3704
- C:\Windows\System\AkUhfrs.exe
  C:\Windows\System\AkUhfrs.exe
  2⤵
  PID:3720
- C:\Windows\System\FYcrYCM.exe
  C:\Windows\System\FYcrYCM.exe
  2⤵
  PID:3604
- C:\Windows\System\MvkeQlS.exe
  C:\Windows\System\MvkeQlS.exe
  2⤵
  PID:3664
- C:\Windows\System\iNmoklb.exe
  C:\Windows\System\iNmoklb.exe
  2⤵
  PID:3716
- C:\Windows\System\onLIamO.exe
  C:\Windows\System\onLIamO.exe
  2⤵
  PID:2816
- C:\Windows\System\nFsiiqG.exe
  C:\Windows\System\nFsiiqG.exe
  2⤵
  PID:1428
- C:\Windows\System\kjNkxJl.exe
  C:\Windows\System\kjNkxJl.exe
  2⤵
  PID:3760
- C:\Windows\System\pltIgoN.exe
  C:\Windows\System\pltIgoN.exe
  2⤵
  PID:3876
- C:\Windows\System\rgmkfoQ.exe
  C:\Windows\System\rgmkfoQ.exe
  2⤵
  PID:3896
- C:\Windows\System\dVKPMDv.exe
  C:\Windows\System\dVKPMDv.exe
  2⤵
  PID:3936
- C:\Windows\System\TFuaDld.exe
  C:\Windows\System\TFuaDld.exe
  2⤵
  PID:3956
- C:\Windows\System\OkQrnGt.exe
  C:\Windows\System\OkQrnGt.exe
  2⤵
  PID:3984
- C:\Windows\System\eErgiaj.exe
  C:\Windows\System\eErgiaj.exe
  2⤵
  PID:1924
- C:\Windows\System\WhfNFdZ.exe
  C:\Windows\System\WhfNFdZ.exe
  2⤵
  PID:4028
- C:\Windows\System\cjDMkJa.exe
  C:\Windows\System\cjDMkJa.exe
  2⤵
  PID:588
- C:\Windows\System\EyOaGts.exe
  C:\Windows\System\EyOaGts.exe
  2⤵
  PID:4060
- C:\Windows\System\HMDUOZF.exe
  C:\Windows\System\HMDUOZF.exe
  2⤵
  PID:3036
- C:\Windows\System\XPSzWnf.exe
  C:\Windows\System\XPSzWnf.exe
  2⤵
  PID:3008
- C:\Windows\System\NpxxBnM.exe
  C:\Windows\System\NpxxBnM.exe
  2⤵
  PID:3004
- C:\Windows\System\bYPUCAY.exe
  C:\Windows\System\bYPUCAY.exe
  2⤵
  PID:2472
- C:\Windows\System\CmVqRDx.exe
  C:\Windows\System\CmVqRDx.exe
  2⤵
  PID:2940
- C:\Windows\System\LAEQket.exe
  C:\Windows\System\LAEQket.exe
  2⤵
  PID:2932
- C:\Windows\System\OUUjBEQ.exe
  C:\Windows\System\OUUjBEQ.exe
  2⤵
  PID:2608
- C:\Windows\System\uqzAiRs.exe
  C:\Windows\System\uqzAiRs.exe
  2⤵
  PID:1656
- C:\Windows\System\yrEULzj.exe
  C:\Windows\System\yrEULzj.exe
  2⤵
  PID:2400
- C:\Windows\System\BEbFwML.exe
  C:\Windows\System\BEbFwML.exe
  2⤵
  PID:2900
- C:\Windows\System\KgAIASA.exe
  C:\Windows\System\KgAIASA.exe
  2⤵
  PID:3108
- C:\Windows\System\SVFdWKQ.exe
  C:\Windows\System\SVFdWKQ.exe
  2⤵
  PID:1676
- C:\Windows\System\cbhygUi.exe
  C:\Windows\System\cbhygUi.exe
  2⤵
  PID:3248
- C:\Windows\System\tHeckPt.exe
  C:\Windows\System\tHeckPt.exe
  2⤵
  PID:3296
- C:\Windows\System\PQybzkQ.exe
  C:\Windows\System\PQybzkQ.exe
  2⤵
  PID:2364
- C:\Windows\System\OjdKknC.exe
  C:\Windows\System\OjdKknC.exe
  2⤵
  PID:3096
- C:\Windows\System\gmOXyjq.exe
  C:\Windows\System\gmOXyjq.exe
  2⤵
  PID:3192
- C:\Windows\System\vaAwzbM.exe
  C:\Windows\System\vaAwzbM.exe
  2⤵
  PID:3312
- C:\Windows\System\FrstlmC.exe
  C:\Windows\System\FrstlmC.exe
  2⤵
  PID:3348
- C:\Windows\System\YWIfsLW.exe
  C:\Windows\System\YWIfsLW.exe
  2⤵
  PID:3452
- C:\Windows\System\HVBVtfT.exe
  C:\Windows\System\HVBVtfT.exe
  2⤵
  PID:3564
- C:\Windows\System\izgYIvl.exe
  C:\Windows\System\izgYIvl.exe
  2⤵
  PID:3548
- C:\Windows\System\THYkLAt.exe
  C:\Windows\System\THYkLAt.exe
  2⤵
  PID:3368
- C:\Windows\System\aXEBzHc.exe
  C:\Windows\System\aXEBzHc.exe
  2⤵
  PID:3624
- C:\Windows\System\AYFuAix.exe
  C:\Windows\System\AYFuAix.exe
  2⤵
  PID:3644
- C:\Windows\System\NjgnVte.exe
  C:\Windows\System\NjgnVte.exe
  2⤵
  PID:3600
- C:\Windows\System\encxgwK.exe
  C:\Windows\System\encxgwK.exe
  2⤵
  PID:756
- C:\Windows\System\WqKDqri.exe
  C:\Windows\System\WqKDqri.exe
  2⤵
  PID:3676
- C:\Windows\System\DqgffTM.exe
  C:\Windows\System\DqgffTM.exe
  2⤵
  PID:1228
- C:\Windows\System\CaqeZcL.exe
  C:\Windows\System\CaqeZcL.exe
  2⤵
  PID:2344
- C:\Windows\System\AYbDsSP.exe
  C:\Windows\System\AYbDsSP.exe
  2⤵
  PID:3820
- C:\Windows\System\zPLGPjG.exe
  C:\Windows\System\zPLGPjG.exe
  2⤵
  PID:3856
- C:\Windows\System\hgaymap.exe
  C:\Windows\System\hgaymap.exe
  2⤵
  PID:3924
- C:\Windows\System\EryIkEU.exe
  C:\Windows\System\EryIkEU.exe
  2⤵
  PID:4004
- C:\Windows\System\QGKzBML.exe
  C:\Windows\System\QGKzBML.exe
  2⤵
  PID:4100
- C:\Windows\System\NRdRNvQ.exe
  C:\Windows\System\NRdRNvQ.exe
  2⤵
  PID:4120
- C:\Windows\System\LJBNSDG.exe
  C:\Windows\System\LJBNSDG.exe
  2⤵
  PID:4136
- C:\Windows\System\GvrBVuR.exe
  C:\Windows\System\GvrBVuR.exe
  2⤵
  PID:4152
- C:\Windows\System\jZhXpxI.exe
  C:\Windows\System\jZhXpxI.exe
  2⤵
  PID:4168
- C:\Windows\System\udOZLjk.exe
  C:\Windows\System\udOZLjk.exe
  2⤵
  PID:4184
- C:\Windows\System\AmAgsTP.exe
  C:\Windows\System\AmAgsTP.exe
  2⤵
  PID:4200
- C:\Windows\System\TqsVPYC.exe
  C:\Windows\System\TqsVPYC.exe
  2⤵
  PID:4220
- C:\Windows\System\uHirFgm.exe
  C:\Windows\System\uHirFgm.exe
  2⤵
  PID:4236
- C:\Windows\System\HtpqOYo.exe
  C:\Windows\System\HtpqOYo.exe
  2⤵
  PID:4252
- C:\Windows\System\cgiynYF.exe
  C:\Windows\System\cgiynYF.exe
  2⤵
  PID:4268
- C:\Windows\System\ZrxnQXc.exe
  C:\Windows\System\ZrxnQXc.exe
  2⤵
  PID:4284
- C:\Windows\System\KEExviB.exe
  C:\Windows\System\KEExviB.exe
  2⤵
  PID:4300
- C:\Windows\System\beGVGBQ.exe
  C:\Windows\System\beGVGBQ.exe
  2⤵
  PID:4316
- C:\Windows\System\GTVRPLo.exe
  C:\Windows\System\GTVRPLo.exe
  2⤵
  PID:4336
- C:\Windows\System\sihpwiA.exe
  C:\Windows\System\sihpwiA.exe
  2⤵
  PID:4352
- C:\Windows\System\oNbvrrk.exe
  C:\Windows\System\oNbvrrk.exe
  2⤵
  PID:4368
- C:\Windows\System\mhtFWuR.exe
  C:\Windows\System\mhtFWuR.exe
  2⤵
  PID:4384
- C:\Windows\System\YwWEFRD.exe
  C:\Windows\System\YwWEFRD.exe
  2⤵
  PID:4400
- C:\Windows\System\KXHxKqT.exe
  C:\Windows\System\KXHxKqT.exe
  2⤵
  PID:4416
- C:\Windows\System\WRdTIdt.exe
  C:\Windows\System\WRdTIdt.exe
  2⤵
  PID:4436
- C:\Windows\System\biafGRx.exe
  C:\Windows\System\biafGRx.exe
  2⤵
  PID:4452
- C:\Windows\System\OabIdyJ.exe
  C:\Windows\System\OabIdyJ.exe
  2⤵
  PID:4468
- C:\Windows\System\JdAzSrh.exe
  C:\Windows\System\JdAzSrh.exe
  2⤵
  PID:4596
- C:\Windows\System\YAPFrSK.exe
  C:\Windows\System\YAPFrSK.exe
  2⤵
  PID:4612
- C:\Windows\System\YjfnTsr.exe
  C:\Windows\System\YjfnTsr.exe
  2⤵
  PID:4768
- C:\Windows\System\PWlPpCH.exe
  C:\Windows\System\PWlPpCH.exe
  2⤵
  PID:4788
- C:\Windows\System\hdhxeeZ.exe
  C:\Windows\System\hdhxeeZ.exe
  2⤵
  PID:4812
- C:\Windows\System\JiWeOgD.exe
  C:\Windows\System\JiWeOgD.exe
  2⤵
  PID:4832
- C:\Windows\System\vhsIphX.exe
  C:\Windows\System\vhsIphX.exe
  2⤵
  PID:4856
- C:\Windows\System\GsCiBWk.exe
  C:\Windows\System\GsCiBWk.exe
  2⤵
  PID:4876
- C:\Windows\System\vUhjSWx.exe
  C:\Windows\System\vUhjSWx.exe
  2⤵
  PID:4896
- C:\Windows\System\aojNFNK.exe
  C:\Windows\System\aojNFNK.exe
  2⤵
  PID:4916
- C:\Windows\System\frrPjaD.exe
  C:\Windows\System\frrPjaD.exe
  2⤵
  PID:4936
- C:\Windows\System\Ipjzoxx.exe
  C:\Windows\System\Ipjzoxx.exe
  2⤵
  PID:4960
- C:\Windows\System\wiqezDZ.exe
  C:\Windows\System\wiqezDZ.exe
  2⤵
  PID:4976
- C:\Windows\System\vdGNlKY.exe
  C:\Windows\System\vdGNlKY.exe
  2⤵
  PID:5000
- C:\Windows\System\OupzFzS.exe
  C:\Windows\System\OupzFzS.exe
  2⤵
  PID:5016
- C:\Windows\System\rxtqaOc.exe
  C:\Windows\System\rxtqaOc.exe
  2⤵
  PID:5032
- C:\Windows\System\DwzxWoW.exe
  C:\Windows\System\DwzxWoW.exe
  2⤵
  PID:5052
- C:\Windows\System\qzriNbB.exe
  C:\Windows\System\qzriNbB.exe
  2⤵
  PID:5068
- C:\Windows\System\WXfxzNa.exe
  C:\Windows\System\WXfxzNa.exe
  2⤵
  PID:5100
- C:\Windows\System\NHVUmAC.exe
  C:\Windows\System\NHVUmAC.exe
  2⤵
  PID:5116
- C:\Windows\System\iaTpIqJ.exe
  C:\Windows\System\iaTpIqJ.exe
  2⤵
  PID:1120
- C:\Windows\System\NtxhgYc.exe
  C:\Windows\System\NtxhgYc.exe
  2⤵
  PID:2696
- C:\Windows\System\Ufdtgrg.exe
  C:\Windows\System\Ufdtgrg.exe
  2⤵
  PID:3464
- C:\Windows\System\wscyTsE.exe
  C:\Windows\System\wscyTsE.exe
  2⤵
  PID:3616
- C:\Windows\System\grziers.exe
  C:\Windows\System\grziers.exe
  2⤵
  PID:3276
- C:\Windows\System\IIQUuWx.exe
  C:\Windows\System\IIQUuWx.exe
  2⤵
  PID:3656
- C:\Windows\System\KfjQMUR.exe
  C:\Windows\System\KfjQMUR.exe
  2⤵
  PID:3792
- C:\Windows\System\vJFdKPa.exe
  C:\Windows\System\vJFdKPa.exe
  2⤵
  PID:3580
- C:\Windows\System\YavhOlh.exe
  C:\Windows\System\YavhOlh.exe
  2⤵
  PID:4212
- C:\Windows\System\wPzUPTy.exe
  C:\Windows\System\wPzUPTy.exe
  2⤵
  PID:3904
- C:\Windows\System\WDauLWg.exe
  C:\Windows\System\WDauLWg.exe
  2⤵
  PID:3976
- C:\Windows\System\WGXXBBm.exe
  C:\Windows\System\WGXXBBm.exe
  2⤵
  PID:4080
- C:\Windows\System\cKXNvdu.exe
  C:\Windows\System\cKXNvdu.exe
  2⤵
  PID:2804
- C:\Windows\System\GRSSDeY.exe
  C:\Windows\System\GRSSDeY.exe
  2⤵
  PID:1004
- C:\Windows\System\uTRIiBC.exe
  C:\Windows\System\uTRIiBC.exe
  2⤵
  PID:3124
- C:\Windows\System\CcDpavp.exe
  C:\Windows\System\CcDpavp.exe
  2⤵
  PID:2332
- C:\Windows\System\SAVQnyI.exe
  C:\Windows\System\SAVQnyI.exe
  2⤵
  PID:3808
- C:\Windows\System\uoCpXgB.exe
  C:\Windows\System\uoCpXgB.exe
  2⤵
  PID:4328
- C:\Windows\System\qYxIMWq.exe
  C:\Windows\System\qYxIMWq.exe
  2⤵
  PID:2224
- C:\Windows\System\eVZSTNW.exe
  C:\Windows\System\eVZSTNW.exe
  2⤵
  PID:4536
- C:\Windows\System\eOeNesV.exe
  C:\Windows\System\eOeNesV.exe
  2⤵
  PID:4560
- C:\Windows\System\sKxKFmq.exe
  C:\Windows\System\sKxKFmq.exe
  2⤵
  PID:4480
- C:\Windows\System\WeWoTMo.exe
  C:\Windows\System\WeWoTMo.exe
  2⤵
  PID:4496
- C:\Windows\System\cfsdElg.exe
  C:\Windows\System\cfsdElg.exe
  2⤵
  PID:4512
- C:\Windows\System\gbKpSKZ.exe
  C:\Windows\System\gbKpSKZ.exe
  2⤵
  PID:4520
- C:\Windows\System\vGisUay.exe
  C:\Windows\System\vGisUay.exe
  2⤵
  PID:4552
- C:\Windows\System\XrpbnRD.exe
  C:\Windows\System\XrpbnRD.exe
  2⤵
  PID:4608
- C:\Windows\System\KhjKqFB.exe
  C:\Windows\System\KhjKqFB.exe
  2⤵
  PID:4148
- C:\Windows\System\wjLtOOT.exe
  C:\Windows\System\wjLtOOT.exe
  2⤵
  PID:4460
- C:\Windows\System\FLhQwFT.exe
  C:\Windows\System\FLhQwFT.exe
  2⤵
  PID:4412
- C:\Windows\System\iXVKbgD.exe
  C:\Windows\System\iXVKbgD.exe
  2⤵
  PID:4344
- C:\Windows\System\AhfSOni.exe
  C:\Windows\System\AhfSOni.exe
  2⤵
  PID:4044
- C:\Windows\System\BNaLxQw.exe
  C:\Windows\System\BNaLxQw.exe
  2⤵
  PID:4376
- C:\Windows\System\IodOmfS.exe
  C:\Windows\System\IodOmfS.exe
  2⤵
  PID:4640
- C:\Windows\System\MUpZDIh.exe
  C:\Windows\System\MUpZDIh.exe
  2⤵
  PID:4408
- C:\Windows\System\YhtFMdV.exe
  C:\Windows\System\YhtFMdV.exe
  2⤵
  PID:4672
- C:\Windows\System\OfWAAVD.exe
  C:\Windows\System\OfWAAVD.exe
  2⤵
  PID:4692
- C:\Windows\System\iAEdBvt.exe
  C:\Windows\System\iAEdBvt.exe
  2⤵
  PID:4712
- C:\Windows\System\hWvVQLl.exe
  C:\Windows\System\hWvVQLl.exe
  2⤵
  PID:4724
- C:\Windows\System\UkygyDy.exe
  C:\Windows\System\UkygyDy.exe
  2⤵
  PID:4736
- C:\Windows\System\tNffufp.exe
  C:\Windows\System\tNffufp.exe
  2⤵
  PID:4756
- C:\Windows\System\GjmPCBZ.exe
  C:\Windows\System\GjmPCBZ.exe
  2⤵
  PID:4780
- C:\Windows\System\fPxkltR.exe
  C:\Windows\System\fPxkltR.exe
  2⤵
  PID:4840
- C:\Windows\System\DjFoPvM.exe
  C:\Windows\System\DjFoPvM.exe
  2⤵
  PID:4844
- C:\Windows\System\wDkzdDx.exe
  C:\Windows\System\wDkzdDx.exe
  2⤵
  PID:4872
- C:\Windows\System\uaUECfD.exe
  C:\Windows\System\uaUECfD.exe
  2⤵
  PID:4904
- C:\Windows\System\TSuwntT.exe
  C:\Windows\System\TSuwntT.exe
  2⤵
  PID:4928
- C:\Windows\System\mRSCDTO.exe
  C:\Windows\System\mRSCDTO.exe
  2⤵
  PID:4956
- C:\Windows\System\jPovOmU.exe
  C:\Windows\System\jPovOmU.exe
  2⤵
  PID:4972
- C:\Windows\System\znrwtiu.exe
  C:\Windows\System\znrwtiu.exe
  2⤵
  PID:5012
- C:\Windows\System\ulAXOFX.exe
  C:\Windows\System\ulAXOFX.exe
  2⤵
  PID:5060
- C:\Windows\System\iCUfoRS.exe
  C:\Windows\System\iCUfoRS.exe
  2⤵
  PID:5084
- C:\Windows\System\pxlNpwV.exe
  C:\Windows\System\pxlNpwV.exe
  2⤵
  PID:5092
- C:\Windows\System\NvwDpLN.exe
  C:\Windows\System\NvwDpLN.exe
  2⤵
  PID:2752
- C:\Windows\System\woGxtMi.exe
  C:\Windows\System\woGxtMi.exe
  2⤵
  PID:2672
- C:\Windows\System\kMVptVH.exe
  C:\Windows\System\kMVptVH.exe
  2⤵
  PID:3484
- C:\Windows\System\ocuXplj.exe
  C:\Windows\System\ocuXplj.exe
  2⤵
  PID:3400
- C:\Windows\System\yBHREII.exe
  C:\Windows\System\yBHREII.exe
  2⤵
  PID:3700
- C:\Windows\System\kNeuLYc.exe
  C:\Windows\System\kNeuLYc.exe
  2⤵
  PID:3576
- C:\Windows\System\emlpXxp.exe
  C:\Windows\System\emlpXxp.exe
  2⤵
  PID:2988
- C:\Windows\System\ivaFaXK.exe
  C:\Windows\System\ivaFaXK.exe
  2⤵
  PID:1984
- C:\Windows\System\xoyKBpv.exe
  C:\Windows\System\xoyKBpv.exe
  2⤵
  PID:4576
- C:\Windows\System\RIwNxRf.exe
  C:\Windows\System\RIwNxRf.exe
  2⤵
  PID:3860
- C:\Windows\System\HDLfpGJ.exe
  C:\Windows\System\HDLfpGJ.exe
  2⤵
  PID:1664
- C:\Windows\System\xBiNUXj.exe
  C:\Windows\System\xBiNUXj.exe
  2⤵
  PID:2620
- C:\Windows\System\pTQRcnK.exe
  C:\Windows\System\pTQRcnK.exe
  2⤵
  PID:3540
- C:\Windows\System\rEXyXEl.exe
  C:\Windows\System\rEXyXEl.exe
  2⤵
  PID:4488
- C:\Windows\System\eYHRjwV.exe
  C:\Windows\System\eYHRjwV.exe
  2⤵
  PID:4604
- C:\Windows\System\KquKrsJ.exe
  C:\Windows\System\KquKrsJ.exe
  2⤵
  PID:4476
- C:\Windows\System\khzYmqi.exe
  C:\Windows\System\khzYmqi.exe
  2⤵
  PID:4180
- C:\Windows\System\ulrceHP.exe
  C:\Windows\System\ulrceHP.exe
  2⤵
  PID:4556
- C:\Windows\System\uhBBGoY.exe
  C:\Windows\System\uhBBGoY.exe
  2⤵
  PID:4264
- C:\Windows\System\CBUgIUJ.exe
  C:\Windows\System\CBUgIUJ.exe
  2⤵
  PID:4228
- C:\Windows\System\cvrpZzE.exe
  C:\Windows\System\cvrpZzE.exe
  2⤵
  PID:4760
- C:\Windows\System\rRYazbt.exe
  C:\Windows\System\rRYazbt.exe
  2⤵
  PID:4884
- C:\Windows\System\oKNFzgf.exe
  C:\Windows\System\oKNFzgf.exe
  2⤵
  PID:4892
- C:\Windows\System\mrClrOE.exe
  C:\Windows\System\mrClrOE.exe
  2⤵
  PID:4996
- C:\Windows\System\ZymUClj.exe
  C:\Windows\System\ZymUClj.exe
  2⤵
  PID:4808
- C:\Windows\System\SIRBcRR.exe
  C:\Windows\System\SIRBcRR.exe
  2⤵
  PID:3648
- C:\Windows\System\dtdLknG.exe
  C:\Windows\System\dtdLknG.exe
  2⤵
  PID:4984
- C:\Windows\System\BBSDRme.exe
  C:\Windows\System\BBSDRme.exe
  2⤵
  PID:5080
- C:\Windows\System\LpWmpLI.exe
  C:\Windows\System\LpWmpLI.exe
  2⤵
  PID:4244
- C:\Windows\System\fDPSvKd.exe
  C:\Windows\System\fDPSvKd.exe
  2⤵
  PID:3060
- C:\Windows\System\gYSRplc.exe
  C:\Windows\System\gYSRplc.exe
  2⤵
  PID:3972
- C:\Windows\System\fsmzRBR.exe
  C:\Windows\System\fsmzRBR.exe
  2⤵
  PID:4232
- C:\Windows\System\niOTmSn.exe
  C:\Windows\System\niOTmSn.exe
  2⤵
  PID:4588
- C:\Windows\System\eYhtALr.exe
  C:\Windows\System\eYhtALr.exe
  2⤵
  PID:1548
- C:\Windows\System\eNYuHxl.exe
  C:\Windows\System\eNYuHxl.exe
  2⤵
  PID:4424
- C:\Windows\System\ipCtDBW.exe
  C:\Windows\System\ipCtDBW.exe
  2⤵
  PID:2176
- C:\Windows\System\GtgQAsI.exe
  C:\Windows\System\GtgQAsI.exe
  2⤵
  PID:3260
- C:\Windows\System\VHGqqsx.exe
  C:\Windows\System\VHGqqsx.exe
  2⤵
  PID:4360
- C:\Windows\System\dBUKdQU.exe
  C:\Windows\System\dBUKdQU.exe
  2⤵
  PID:4132
- C:\Windows\System\NdFDJlS.exe
  C:\Windows\System\NdFDJlS.exe
  2⤵
  PID:4364
- C:\Windows\System\CLJuegh.exe
  C:\Windows\System\CLJuegh.exe
  2⤵
  PID:4296
- C:\Windows\System\KSjjLrJ.exe
  C:\Windows\System\KSjjLrJ.exe
  2⤵
  PID:4668
- C:\Windows\System\KdFtCbu.exe
  C:\Windows\System\KdFtCbu.exe
  2⤵
  PID:4392
- C:\Windows\System\NiHkrgQ.exe
  C:\Windows\System\NiHkrgQ.exe
  2⤵
  PID:4684
- C:\Windows\System\TuKpyME.exe
  C:\Windows\System\TuKpyME.exe
  2⤵
  PID:4720
- C:\Windows\System\NTOxstU.exe
  C:\Windows\System\NTOxstU.exe
  2⤵
  PID:4944
- C:\Windows\System\tRWvXWK.exe
  C:\Windows\System\tRWvXWK.exe
  2⤵
  PID:4740
- C:\Windows\System\InxkGhx.exe
  C:\Windows\System\InxkGhx.exe
  2⤵
  PID:2580
- C:\Windows\System\ByUxRlb.exe
  C:\Windows\System\ByUxRlb.exe
  2⤵
  PID:3524
- C:\Windows\System\wNXVJwD.exe
  C:\Windows\System\wNXVJwD.exe
  2⤵
  PID:4524
- C:\Windows\System\ZjAGgsI.exe
  C:\Windows\System\ZjAGgsI.exe
  2⤵
  PID:4276
- C:\Windows\System\CESJgYd.exe
  C:\Windows\System\CESJgYd.exe
  2⤵
  PID:3064
- C:\Windows\System\eWQcqwN.exe
  C:\Windows\System\eWQcqwN.exe
  2⤵
  PID:3332
- C:\Windows\System\UOTcCYH.exe
  C:\Windows\System\UOTcCYH.exe
  2⤵
  PID:3640
- C:\Windows\System\yRnKvQH.exe
  C:\Windows\System\yRnKvQH.exe
  2⤵
  PID:4664
- C:\Windows\System\WrGkjuX.exe
  C:\Windows\System\WrGkjuX.exe
  2⤵
  PID:4968
- C:\Windows\System\LPOAbfa.exe
  C:\Windows\System\LPOAbfa.exe
  2⤵
  PID:4632
- C:\Windows\System\QRzPfBo.exe
  C:\Windows\System\QRzPfBo.exe
  2⤵
  PID:4532
- C:\Windows\System\RogMZyQ.exe
  C:\Windows\System\RogMZyQ.exe
  2⤵
  PID:4208
- C:\Windows\System\rCmDWtk.exe
  C:\Windows\System\rCmDWtk.exe
  2⤵
  PID:5108
- C:\Windows\System\KtjrPWy.exe
  C:\Windows\System\KtjrPWy.exe
  2⤵
  PID:4680
- C:\Windows\System\trZTAlp.exe
  C:\Windows\System\trZTAlp.exe
  2⤵
  PID:2136
- C:\Windows\System\oBENCuQ.exe
  C:\Windows\System\oBENCuQ.exe
  2⤵
  PID:4084
- C:\Windows\System\FRJigIC.exe
  C:\Windows\System\FRJigIC.exe
  2⤵
  PID:4128
- C:\Windows\System\CMQcLxT.exe
  C:\Windows\System\CMQcLxT.exe
  2⤵
  PID:5124
- C:\Windows\System\nSkQBMI.exe
  C:\Windows\System\nSkQBMI.exe
  2⤵
  PID:5140
- C:\Windows\System\KGkvbNP.exe
  C:\Windows\System\KGkvbNP.exe
  2⤵
  PID:5160
- C:\Windows\System\JzZlpaY.exe
  C:\Windows\System\JzZlpaY.exe
  2⤵
  PID:5176
- C:\Windows\System\RxKRVqw.exe
  C:\Windows\System\RxKRVqw.exe
  2⤵
  PID:5192
- C:\Windows\System\idjIQhX.exe
  C:\Windows\System\idjIQhX.exe
  2⤵
  PID:5212
- C:\Windows\System\qkbpHcG.exe
  C:\Windows\System\qkbpHcG.exe
  2⤵
  PID:5228
- C:\Windows\System\txSUrij.exe
  C:\Windows\System\txSUrij.exe
  2⤵
  PID:5244
- C:\Windows\System\HnIyfgI.exe
  C:\Windows\System\HnIyfgI.exe
  2⤵
  PID:5260
- C:\Windows\System\JGerKHz.exe
  C:\Windows\System\JGerKHz.exe
  2⤵
  PID:5276
- C:\Windows\System\RtSuVJW.exe
  C:\Windows\System\RtSuVJW.exe
  2⤵
  PID:5292
- C:\Windows\System\WMEevWo.exe
  C:\Windows\System\WMEevWo.exe
  2⤵
  PID:5308
- C:\Windows\System\eaMjTZp.exe
  C:\Windows\System\eaMjTZp.exe
  2⤵
  PID:5324
- C:\Windows\System\hjawvaP.exe
  C:\Windows\System\hjawvaP.exe
  2⤵
  PID:5340
- C:\Windows\System\ugPxaei.exe
  C:\Windows\System\ugPxaei.exe
  2⤵
  PID:5356
- C:\Windows\System\AHFvqVc.exe
  C:\Windows\System\AHFvqVc.exe
  2⤵
  PID:5372
- C:\Windows\System\WgDsuCB.exe
  C:\Windows\System\WgDsuCB.exe
  2⤵
  PID:5388
- C:\Windows\System\nsuGodg.exe
  C:\Windows\System\nsuGodg.exe
  2⤵
  PID:5404
- C:\Windows\System\FryqmJp.exe
  C:\Windows\System\FryqmJp.exe
  2⤵
  PID:5420
- C:\Windows\System\JujxZnV.exe
  C:\Windows\System\JujxZnV.exe
  2⤵
  PID:5436
- C:\Windows\System\hfGfCxS.exe
  C:\Windows\System\hfGfCxS.exe
  2⤵
  PID:5452
- C:\Windows\System\rFOipIo.exe
  C:\Windows\System\rFOipIo.exe
  2⤵
  PID:5468
- C:\Windows\System\MisoFxU.exe
  C:\Windows\System\MisoFxU.exe
  2⤵
  PID:5484
- C:\Windows\System\aLmZgpc.exe
  C:\Windows\System\aLmZgpc.exe
  2⤵
  PID:5500
- C:\Windows\System\DjXBVJc.exe
  C:\Windows\System\DjXBVJc.exe
  2⤵
  PID:5516
- C:\Windows\System\renFUAj.exe
  C:\Windows\System\renFUAj.exe
  2⤵
  PID:5532
- C:\Windows\System\jtmUXMc.exe
  C:\Windows\System\jtmUXMc.exe
  2⤵
  PID:5548
- C:\Windows\System\RbdsOYP.exe
  C:\Windows\System\RbdsOYP.exe
  2⤵
  PID:5564
- C:\Windows\System\cXJcfRH.exe
  C:\Windows\System\cXJcfRH.exe
  2⤵
  PID:5580
- C:\Windows\System\LtSLPva.exe
  C:\Windows\System\LtSLPva.exe
  2⤵
  PID:5596
- C:\Windows\System\ILtKLLB.exe
  C:\Windows\System\ILtKLLB.exe
  2⤵
  PID:5612
- C:\Windows\System\TlqUNbb.exe
  C:\Windows\System\TlqUNbb.exe
  2⤵
  PID:5820
- C:\Windows\System\kpGQEHe.exe
  C:\Windows\System\kpGQEHe.exe
  2⤵
  PID:5836
- C:\Windows\System\PiqjwIi.exe
  C:\Windows\System\PiqjwIi.exe
  2⤵
  PID:5852
- C:\Windows\System\aXhOAts.exe
  C:\Windows\System\aXhOAts.exe
  2⤵
  PID:5868
- C:\Windows\System\xtnWzXr.exe
  C:\Windows\System\xtnWzXr.exe
  2⤵
  PID:5884
- C:\Windows\System\yLtGrxS.exe
  C:\Windows\System\yLtGrxS.exe
  2⤵
  PID:5900
- C:\Windows\System\qtPMvYm.exe
  C:\Windows\System\qtPMvYm.exe
  2⤵
  PID:5916
- C:\Windows\System\KRjzOef.exe
  C:\Windows\System\KRjzOef.exe
  2⤵
  PID:5932
- C:\Windows\System\mmOQIVb.exe
  C:\Windows\System\mmOQIVb.exe
  2⤵
  PID:5948
- C:\Windows\System\uaBwWGZ.exe
  C:\Windows\System\uaBwWGZ.exe
  2⤵
  PID:5964
- C:\Windows\System\SGaueBI.exe
  C:\Windows\System\SGaueBI.exe
  2⤵
  PID:5980
- C:\Windows\System\DBkEOgo.exe
  C:\Windows\System\DBkEOgo.exe
  2⤵
  PID:5996
- C:\Windows\System\mDByIKv.exe
  C:\Windows\System\mDByIKv.exe
  2⤵
  PID:6020
- C:\Windows\System\LdVSIPr.exe
  C:\Windows\System\LdVSIPr.exe
  2⤵
  PID:6036
- C:\Windows\System\AqDkTjK.exe
  C:\Windows\System\AqDkTjK.exe
  2⤵
  PID:6128
- C:\Windows\System\HpSLmem.exe
  C:\Windows\System\HpSLmem.exe
  2⤵
  PID:1896
- C:\Windows\System\ZyohiJx.exe
  C:\Windows\System\ZyohiJx.exe
  2⤵
  PID:5088
- C:\Windows\System\TWnxGEs.exe
  C:\Windows\System\TWnxGEs.exe
  2⤵
  PID:1452
- C:\Windows\System\LUsxePA.exe
  C:\Windows\System\LUsxePA.exe
  2⤵
  PID:4864
- C:\Windows\System\NxzEjBA.exe
  C:\Windows\System\NxzEjBA.exe
  2⤵
  PID:5184
- C:\Windows\System\UFMFcch.exe
  C:\Windows\System\UFMFcch.exe
  2⤵
  PID:5224
- C:\Windows\System\LwvLVaB.exe
  C:\Windows\System\LwvLVaB.exe
  2⤵
  PID:4292
- C:\Windows\System\gAJLIQz.exe
  C:\Windows\System\gAJLIQz.exe
  2⤵
  PID:4324
- C:\Windows\System\GPEDOpX.exe
  C:\Windows\System\GPEDOpX.exe
  2⤵
  PID:5288
- C:\Windows\System\EzzSjIC.exe
  C:\Windows\System\EzzSjIC.exe
  2⤵
  PID:5320
- C:\Windows\System\POobRbO.exe
  C:\Windows\System\POobRbO.exe
  2⤵
  PID:5352
- C:\Windows\System\iJebxTE.exe
  C:\Windows\System\iJebxTE.exe
  2⤵
  PID:5384
- C:\Windows\System\bplRptX.exe
  C:\Windows\System\bplRptX.exe
  2⤵
  PID:5480
- C:\Windows\System\LuqdZGn.exe
  C:\Windows\System\LuqdZGn.exe
  2⤵
  PID:5540
- C:\Windows\System\yTBgMZx.exe
  C:\Windows\System\yTBgMZx.exe
  2⤵
  PID:5604
- C:\Windows\System\qMCeeyt.exe
  C:\Windows\System\qMCeeyt.exe
  2⤵
  PID:5268
- C:\Windows\System\WFCBflV.exe
  C:\Windows\System\WFCBflV.exe
  2⤵
  PID:5464
- C:\Windows\System\xTZbEwZ.exe
  C:\Windows\System\xTZbEwZ.exe
  2⤵
  PID:5336
- C:\Windows\System\fkhdxED.exe
  C:\Windows\System\fkhdxED.exe
  2⤵
  PID:5432
- C:\Windows\System\mgAuBrL.exe
  C:\Windows\System\mgAuBrL.exe
  2⤵
  PID:5560
- C:\Windows\System\QDnpqil.exe
  C:\Windows\System\QDnpqil.exe
  2⤵
  PID:5628
- C:\Windows\System\bTZhcpl.exe
  C:\Windows\System\bTZhcpl.exe
  2⤵
  PID:4192
- C:\Windows\System\pCUQeyw.exe
  C:\Windows\System\pCUQeyw.exe
  2⤵
  PID:5660
- C:\Windows\System\mhoiprl.exe
  C:\Windows\System\mhoiprl.exe
  2⤵
  PID:5676
- C:\Windows\System\wbUzylX.exe
  C:\Windows\System\wbUzylX.exe
  2⤵
  PID:5696
- C:\Windows\System\bVZvVOn.exe
  C:\Windows\System\bVZvVOn.exe
  2⤵
  PID:5720
- C:\Windows\System\BxmRZXz.exe
  C:\Windows\System\BxmRZXz.exe
  2⤵
  PID:5728
- C:\Windows\System\CkDTKAk.exe
  C:\Windows\System\CkDTKAk.exe
  2⤵
  PID:5828
- C:\Windows\System\RxwwuoS.exe
  C:\Windows\System\RxwwuoS.exe
  2⤵
  PID:5772
- C:\Windows\System\EYrJWcS.exe
  C:\Windows\System\EYrJWcS.exe
  2⤵
  PID:5800
- C:\Windows\System\EhKbtGX.exe
  C:\Windows\System\EhKbtGX.exe
  2⤵
  PID:5816
- C:\Windows\System\yIxsEEM.exe
  C:\Windows\System\yIxsEEM.exe
  2⤵
  PID:5912
- C:\Windows\System\boqXPIX.exe
  C:\Windows\System\boqXPIX.exe
  2⤵
  PID:6004
- C:\Windows\System\kLwmSXp.exe
  C:\Windows\System\kLwmSXp.exe
  2⤵
  PID:6044
- C:\Windows\System\clywszj.exe
  C:\Windows\System\clywszj.exe
  2⤵
  PID:6056
- C:\Windows\System\hMyuAaS.exe
  C:\Windows\System\hMyuAaS.exe
  2⤵
  PID:6076
- C:\Windows\System\mEnpAvY.exe
  C:\Windows\System\mEnpAvY.exe
  2⤵
  PID:6096
- C:\Windows\System\dmYEZEp.exe
  C:\Windows\System\dmYEZEp.exe
  2⤵
  PID:6116
- C:\Windows\System\atTfLSJ.exe
  C:\Windows\System\atTfLSJ.exe
  2⤵
  PID:6136
- C:\Windows\System\rocxbSB.exe
  C:\Windows\System\rocxbSB.exe
  2⤵
  PID:6140
- C:\Windows\System\AveGiFa.exe
  C:\Windows\System\AveGiFa.exe
  2⤵
  PID:4528
- C:\Windows\System\yutYSYr.exe
  C:\Windows\System\yutYSYr.exe
  2⤵
  PID:4108
- C:\Windows\System\FJjOWtP.exe
  C:\Windows\System\FJjOWtP.exe
  2⤵
  PID:5256
- C:\Windows\System\BATmwCG.exe
  C:\Windows\System\BATmwCG.exe
  2⤵
  PID:5448
- C:\Windows\System\wPQSotB.exe
  C:\Windows\System\wPQSotB.exe
  2⤵
  PID:5304
- C:\Windows\System\epuCWop.exe
  C:\Windows\System\epuCWop.exe
  2⤵
  PID:5652
- C:\Windows\System\fuGEbBL.exe
  C:\Windows\System\fuGEbBL.exe
  2⤵
  PID:5692
- C:\Windows\System\iNtHBIF.exe
  C:\Windows\System\iNtHBIF.exe
  2⤵
  PID:5896
- C:\Windows\System\hDXxTUz.exe
  C:\Windows\System\hDXxTUz.exe
  2⤵
  PID:5656
- C:\Windows\System\WtexOGA.exe
  C:\Windows\System\WtexOGA.exe
  2⤵
  PID:5848
- C:\Windows\System\AiXVzwT.exe
  C:\Windows\System\AiXVzwT.exe
  2⤵
  PID:5992
- C:\Windows\System\JploHcl.exe
  C:\Windows\System\JploHcl.exe
  2⤵
  PID:5300
- C:\Windows\System\GCeJiuq.exe
  C:\Windows\System\GCeJiuq.exe
  2⤵
  PID:5528
- C:\Windows\System\WdDVOEd.exe
  C:\Windows\System\WdDVOEd.exe
  2⤵
  PID:5592
- C:\Windows\System\jrHBydJ.exe
  C:\Windows\System\jrHBydJ.exe
  2⤵
  PID:5636
- C:\Windows\System\aaguFUI.exe
  C:\Windows\System\aaguFUI.exe
  2⤵
  PID:5704
- C:\Windows\System\QOYNzaS.exe
  C:\Windows\System\QOYNzaS.exe
  2⤵
  PID:5316
- C:\Windows\System\VRrZsBd.exe
  C:\Windows\System\VRrZsBd.exe
  2⤵
  PID:5940
- C:\Windows\System\NPeFfWz.exe
  C:\Windows\System\NPeFfWz.exe
  2⤵
  PID:5768
- C:\Windows\System\wHMajdH.exe
  C:\Windows\System\wHMajdH.exe
  2⤵
  PID:6052
- C:\Windows\System\bLPuMtI.exe
  C:\Windows\System\bLPuMtI.exe
  2⤵
  PID:6088
- C:\Windows\System\YKqasIL.exe
  C:\Windows\System\YKqasIL.exe
  2⤵
  PID:4504
- C:\Windows\System\MpHZWpl.exe
  C:\Windows\System\MpHZWpl.exe
  2⤵
  PID:4804
- C:\Windows\System\fKMKieZ.exe
  C:\Windows\System\fKMKieZ.exe
  2⤵
  PID:5688
- C:\Windows\System\CCcMzYb.exe
  C:\Windows\System\CCcMzYb.exe
  2⤵
  PID:5400
- C:\Windows\System\VXMQyVP.exe
  C:\Windows\System\VXMQyVP.exe
  2⤵
  PID:6032
- C:\Windows\System\EdbJInG.exe
  C:\Windows\System\EdbJInG.exe
  2⤵
  PID:5740
- C:\Windows\System\jIYMmJG.exe
  C:\Windows\System\jIYMmJG.exe
  2⤵
  PID:5780
- C:\Windows\System\VVmBXLN.exe
  C:\Windows\System\VVmBXLN.exe
  2⤵
  PID:5976
- C:\Windows\System\SykyoaS.exe
  C:\Windows\System\SykyoaS.exe
  2⤵
  PID:5956
- C:\Windows\System\ScNYsGN.exe
  C:\Windows\System\ScNYsGN.exe
  2⤵
  PID:5556
- C:\Windows\System\TMgKvQx.exe
  C:\Windows\System\TMgKvQx.exe
  2⤵
  PID:6156
- C:\Windows\System\PGvhNAO.exe
  C:\Windows\System\PGvhNAO.exe
  2⤵
  PID:6172
- C:\Windows\System\ihMzvYH.exe
  C:\Windows\System\ihMzvYH.exe
  2⤵
  PID:6188
- C:\Windows\System\tYLGQzw.exe
  C:\Windows\System\tYLGQzw.exe
  2⤵
  PID:6204
- C:\Windows\System\pmztuIZ.exe
  C:\Windows\System\pmztuIZ.exe
  2⤵
  PID:6220
- C:\Windows\System\UsfeWUp.exe
  C:\Windows\System\UsfeWUp.exe
  2⤵
  PID:6236
- C:\Windows\System\ZPAATWj.exe
  C:\Windows\System\ZPAATWj.exe
  2⤵
  PID:6252
- C:\Windows\System\vuhHNrN.exe
  C:\Windows\System\vuhHNrN.exe
  2⤵
  PID:6268
- C:\Windows\System\nMPMaQv.exe
  C:\Windows\System\nMPMaQv.exe
  2⤵
  PID:6284
- C:\Windows\System\RJyybvH.exe
  C:\Windows\System\RJyybvH.exe
  2⤵
  PID:6300
- C:\Windows\System\AEFsyoP.exe
  C:\Windows\System\AEFsyoP.exe
  2⤵
  PID:6316
- C:\Windows\System\jTpBlLZ.exe
  C:\Windows\System\jTpBlLZ.exe
  2⤵
  PID:6332
- C:\Windows\System\XXPpjwq.exe
  C:\Windows\System\XXPpjwq.exe
  2⤵
  PID:6348
- C:\Windows\System\mOqSrzG.exe
  C:\Windows\System\mOqSrzG.exe
  2⤵
  PID:6364
- C:\Windows\System\aXcjvvr.exe
  C:\Windows\System\aXcjvvr.exe
  2⤵
  PID:6380
- C:\Windows\System\fYfEKdE.exe
  C:\Windows\System\fYfEKdE.exe
  2⤵
  PID:6396
- C:\Windows\System\ufpsTuo.exe
  C:\Windows\System\ufpsTuo.exe
  2⤵
  PID:6412
- C:\Windows\System\OCeugZp.exe
  C:\Windows\System\OCeugZp.exe
  2⤵
  PID:6428
- C:\Windows\System\UrZygeN.exe
  C:\Windows\System\UrZygeN.exe
  2⤵
  PID:6444
- C:\Windows\System\mKBwBPg.exe
  C:\Windows\System\mKBwBPg.exe
  2⤵
  PID:6460
- C:\Windows\System\kPtcZwZ.exe
  C:\Windows\System\kPtcZwZ.exe
  2⤵
  PID:6476
- C:\Windows\System\ZFjKoDP.exe
  C:\Windows\System\ZFjKoDP.exe
  2⤵
  PID:6492
- C:\Windows\System\LFxWLhs.exe
  C:\Windows\System\LFxWLhs.exe
  2⤵
  PID:6508
- C:\Windows\System\opXMCJC.exe
  C:\Windows\System\opXMCJC.exe
  2⤵
  PID:6524
- C:\Windows\System\LAsNWTX.exe
  C:\Windows\System\LAsNWTX.exe
  2⤵
  PID:6540
- C:\Windows\System\QmvjkTw.exe
  C:\Windows\System\QmvjkTw.exe
  2⤵
  PID:6556
- C:\Windows\System\EOTijOM.exe
  C:\Windows\System\EOTijOM.exe
  2⤵
  PID:6572
- C:\Windows\System\JVKTDJG.exe
  C:\Windows\System\JVKTDJG.exe
  2⤵
  PID:6588
- C:\Windows\System\gcBfbNk.exe
  C:\Windows\System\gcBfbNk.exe
  2⤵
  PID:6604
- C:\Windows\System\zwoMmeR.exe
  C:\Windows\System\zwoMmeR.exe
  2⤵
  PID:6620
- C:\Windows\System\vgHscMm.exe
  C:\Windows\System\vgHscMm.exe
  2⤵
  PID:6636
- C:\Windows\System\xSilbVX.exe
  C:\Windows\System\xSilbVX.exe
  2⤵
  PID:6656
- C:\Windows\System\ViXnjhc.exe
  C:\Windows\System\ViXnjhc.exe
  2⤵
  PID:6676
- C:\Windows\System\eBqEqrj.exe
  C:\Windows\System\eBqEqrj.exe
  2⤵
  PID:6696
- C:\Windows\System\EDhiCzg.exe
  C:\Windows\System\EDhiCzg.exe
  2⤵
  PID:6712
- C:\Windows\System\lfrbMeF.exe
  C:\Windows\System\lfrbMeF.exe
  2⤵
  PID:6728
- C:\Windows\System\JvCdHCx.exe
  C:\Windows\System\JvCdHCx.exe
  2⤵
  PID:6744
- C:\Windows\System\NIObdvg.exe
  C:\Windows\System\NIObdvg.exe
  2⤵
  PID:6760
- C:\Windows\System\scBuqwX.exe
  C:\Windows\System\scBuqwX.exe
  2⤵
  PID:6776
- C:\Windows\System\vlhSvkm.exe
  C:\Windows\System\vlhSvkm.exe
  2⤵
  PID:6792
- C:\Windows\System\sgQoXqi.exe
  C:\Windows\System\sgQoXqi.exe
  2⤵
  PID:6808
- C:\Windows\System\HPCdbne.exe
  C:\Windows\System\HPCdbne.exe
  2⤵
  PID:6828
- C:\Windows\System\NsqtsNK.exe
  C:\Windows\System\NsqtsNK.exe
  2⤵
  PID:6844
- C:\Windows\System\kCYpzOS.exe
  C:\Windows\System\kCYpzOS.exe
  2⤵
  PID:6860
- C:\Windows\System\kQKlRHM.exe
  C:\Windows\System\kQKlRHM.exe
  2⤵
  PID:6876
- C:\Windows\System\UdbsJUR.exe
  C:\Windows\System\UdbsJUR.exe
  2⤵
  PID:6892
- C:\Windows\System\rxAWgfS.exe
  C:\Windows\System\rxAWgfS.exe
  2⤵
  PID:6908
- C:\Windows\System\RrwyvDH.exe
  C:\Windows\System\RrwyvDH.exe
  2⤵
  PID:6924
- C:\Windows\System\yBdAEFB.exe
  C:\Windows\System\yBdAEFB.exe
  2⤵
  PID:6940
- C:\Windows\System\XIQOPZi.exe
  C:\Windows\System\XIQOPZi.exe
  2⤵
  PID:6956
- C:\Windows\System\EjlCOWH.exe
  C:\Windows\System\EjlCOWH.exe
  2⤵
  PID:6972
- C:\Windows\System\bDiaJKb.exe
  C:\Windows\System\bDiaJKb.exe
  2⤵
  PID:6988
- C:\Windows\System\jwfZQAR.exe
  C:\Windows\System\jwfZQAR.exe
  2⤵
  PID:7008
- C:\Windows\System\ePysPDP.exe
  C:\Windows\System\ePysPDP.exe
  2⤵
  PID:7024
- C:\Windows\System\oFQXHgP.exe
  C:\Windows\System\oFQXHgP.exe
  2⤵
  PID:7040
- C:\Windows\System\GBSsWSA.exe
  C:\Windows\System\GBSsWSA.exe
  2⤵
  PID:7056
- C:\Windows\System\VitEzpf.exe
  C:\Windows\System\VitEzpf.exe
  2⤵
  PID:7072
- C:\Windows\System\CvkOLJF.exe
  C:\Windows\System\CvkOLJF.exe
  2⤵
  PID:7088
- C:\Windows\System\gXnEjKT.exe
  C:\Windows\System\gXnEjKT.exe
  2⤵
  PID:7104
- C:\Windows\System\hyvsADT.exe
  C:\Windows\System\hyvsADT.exe
  2⤵
  PID:7120
- C:\Windows\System\xhGEdJA.exe
  C:\Windows\System\xhGEdJA.exe
  2⤵
  PID:7136
- C:\Windows\System\jFRSBCl.exe
  C:\Windows\System\jFRSBCl.exe
  2⤵
  PID:7152
- C:\Windows\System\SYfhzfe.exe
  C:\Windows\System\SYfhzfe.exe
  2⤵
  PID:5788
- C:\Windows\System\BYpyBoa.exe
  C:\Windows\System\BYpyBoa.exe
  2⤵
  PID:6168
- C:\Windows\System\ZXCovxV.exe
  C:\Windows\System\ZXCovxV.exe
  2⤵
  PID:6228
- C:\Windows\System\NaAYeel.exe
  C:\Windows\System\NaAYeel.exe
  2⤵
  PID:5476
- C:\Windows\System\iVyLRQv.exe
  C:\Windows\System\iVyLRQv.exe
  2⤵
  PID:5348
- C:\Windows\System\PVRhVhZ.exe
  C:\Windows\System\PVRhVhZ.exe
  2⤵
  PID:6072
- C:\Windows\System\xQOZDwu.exe
  C:\Windows\System\xQOZDwu.exe
  2⤵
  PID:4312
- C:\Windows\System\MbtbMMN.exe
  C:\Windows\System\MbtbMMN.exe
  2⤵
  PID:5908
- C:\Windows\System\kklVfxn.exe
  C:\Windows\System\kklVfxn.exe
  2⤵
  PID:6296
- C:\Windows\System\qqTUojo.exe
  C:\Windows\System\qqTUojo.exe
  2⤵
  PID:6324
- C:\Windows\System\bqsiDWH.exe
  C:\Windows\System\bqsiDWH.exe
  2⤵
  PID:4308
- C:\Windows\System\KJRlmIC.exe
  C:\Windows\System\KJRlmIC.exe
  2⤵
  PID:5168
- C:\Windows\System\yseElGq.exe
  C:\Windows\System\yseElGq.exe
  2⤵
  PID:5864
- C:\Windows\System\mIiRezF.exe
  C:\Windows\System\mIiRezF.exe
  2⤵
  PID:5200
- C:\Windows\System\xTrVdRd.exe
  C:\Windows\System\xTrVdRd.exe
  2⤵
  PID:6216
- C:\Windows\System\eIZjYtY.exe
  C:\Windows\System\eIZjYtY.exe
  2⤵
  PID:5844
- C:\Windows\System\WQQWIoM.exe
  C:\Windows\System\WQQWIoM.exe
  2⤵
  PID:6180
- C:\Windows\System\Outilmt.exe
  C:\Windows\System\Outilmt.exe
  2⤵
  PID:6424
- C:\Windows\System\VIHBCle.exe
  C:\Windows\System\VIHBCle.exe
  2⤵
  PID:6276
- C:\Windows\System\GeKXuXm.exe
  C:\Windows\System\GeKXuXm.exe
  2⤵
  PID:6488
- C:\Windows\System\YYohEHF.exe
  C:\Windows\System\YYohEHF.exe
  2⤵
  PID:6552
- C:\Windows\System\pJDzJXn.exe
  C:\Windows\System\pJDzJXn.exe
  2⤵
  PID:6612
- C:\Windows\System\vnaroqB.exe
  C:\Windows\System\vnaroqB.exe
  2⤵
  PID:6344
- C:\Windows\System\QHWAwor.exe
  C:\Windows\System\QHWAwor.exe
  2⤵
  PID:6684
- C:\Windows\System\PGwUgIl.exe
  C:\Windows\System\PGwUgIl.exe
  2⤵
  PID:6568
- C:\Windows\System\lKtLOzg.exe
  C:\Windows\System\lKtLOzg.exe
  2⤵
  PID:6504
- C:\Windows\System\afHRlPH.exe
  C:\Windows\System\afHRlPH.exe
  2⤵
  PID:6436
- C:\Windows\System\rrmtsSl.exe
  C:\Windows\System\rrmtsSl.exe
  2⤵
  PID:6600
- C:\Windows\System\WLLZNap.exe
  C:\Windows\System\WLLZNap.exe
  2⤵
  PID:6596
- C:\Windows\System\UsGGnHo.exe
  C:\Windows\System\UsGGnHo.exe
  2⤵
  PID:6720
- C:\Windows\System\UpueOWa.exe
  C:\Windows\System\UpueOWa.exe
  2⤵
  PID:6736
- C:\Windows\System\vHdHeRE.exe
  C:\Windows\System\vHdHeRE.exe
  2⤵
  PID:6820
- C:\Windows\System\hmYdrSP.exe
  C:\Windows\System\hmYdrSP.exe
  2⤵
  PID:6884
- C:\Windows\System\JtXkaLh.exe
  C:\Windows\System\JtXkaLh.exe
  2⤵
  PID:6948
- C:\Windows\System\HnxyzNN.exe
  C:\Windows\System\HnxyzNN.exe
  2⤵
  PID:6984
- C:\Windows\System\tPsptAR.exe
  C:\Windows\System\tPsptAR.exe
  2⤵
  PID:7064
- C:\Windows\System\mzQtSgu.exe
  C:\Windows\System\mzQtSgu.exe
  2⤵
  PID:6936
- C:\Windows\System\wTEozgF.exe
  C:\Windows\System\wTEozgF.exe
  2⤵
  PID:6932
- C:\Windows\System\RfSlmxk.exe
  C:\Windows\System\RfSlmxk.exe
  2⤵
  PID:7000
- C:\Windows\System\BkQjsZN.exe
  C:\Windows\System\BkQjsZN.exe
  2⤵
  PID:7160
- C:\Windows\System\MvDgAag.exe
  C:\Windows\System\MvDgAag.exe
  2⤵
  PID:5860
- C:\Windows\System\YpSJKxC.exe
  C:\Windows\System\YpSJKxC.exe
  2⤵
  PID:6264
- C:\Windows\System\qVPcfNJ.exe
  C:\Windows\System\qVPcfNJ.exe
  2⤵
  PID:4708
- C:\Windows\System\ywnzOBk.exe
  C:\Windows\System\ywnzOBk.exe
  2⤵
  PID:5752
- C:\Windows\System\OJvBIUv.exe
  C:\Windows\System\OJvBIUv.exe
  2⤵
  PID:5620
- C:\Windows\System\bBldAkL.exe
  C:\Windows\System\bBldAkL.exe
  2⤵
  PID:5240
- C:\Windows\System\BgtdvZb.exe
  C:\Windows\System\BgtdvZb.exe
  2⤵
  PID:6308
- C:\Windows\System\OiwbNaT.exe
  C:\Windows\System\OiwbNaT.exe
  2⤵
  PID:6520
- C:\Windows\System\mvEohhk.exe
  C:\Windows\System\mvEohhk.exe
  2⤵
  PID:6584
- C:\Windows\System\prKdcfZ.exe
  C:\Windows\System\prKdcfZ.exe
  2⤵
  PID:6648
- C:\Windows\System\AjrNwHg.exe
  C:\Windows\System\AjrNwHg.exe
  2⤵
  PID:6472
- C:\Windows\System\jORnKLt.exe
  C:\Windows\System\jORnKLt.exe
  2⤵
  PID:6408
- C:\Windows\System\VEXiFni.exe
  C:\Windows\System\VEXiFni.exe
  2⤵
  PID:7020
- C:\Windows\System\EmHGFvx.exe
  C:\Windows\System\EmHGFvx.exe
  2⤵
  PID:6980
- C:\Windows\System\SqhdMCM.exe
  C:\Windows\System\SqhdMCM.exe
  2⤵
  PID:6372
- C:\Windows\System\tOJiDKj.exe
  C:\Windows\System\tOJiDKj.exe
  2⤵
  PID:6952
- C:\Windows\System\dAxreqT.exe
  C:\Windows\System\dAxreqT.exe
  2⤵
  PID:7084
- C:\Windows\System\BioeSpX.exe
  C:\Windows\System\BioeSpX.exe
  2⤵
  PID:6800
- C:\Windows\System\CICmxxb.exe
  C:\Windows\System\CICmxxb.exe
  2⤵
  PID:5812
- C:\Windows\System\guuTDhO.exe
  C:\Windows\System\guuTDhO.exe
  2⤵
  PID:6868
- C:\Windows\System\uuGXGgR.exe
  C:\Windows\System\uuGXGgR.exe
  2⤵
  PID:5880
- C:\Windows\System\srrWJga.exe
  C:\Windows\System\srrWJga.exe
  2⤵
  PID:1712
- C:\Windows\System\ICpOXMn.exe
  C:\Windows\System\ICpOXMn.exe
  2⤵
  PID:7100
- C:\Windows\System\ZaRLjSX.exe
  C:\Windows\System\ZaRLjSX.exe
  2⤵
  PID:5672
- C:\Windows\System\nyXFZLH.exe
  C:\Windows\System\nyXFZLH.exe
  2⤵
  PID:6968
- C:\Windows\System\qVrWdeq.exe
  C:\Windows\System\qVrWdeq.exe
  2⤵
  PID:5148
- C:\Windows\System\vJcnUvI.exe
  C:\Windows\System\vJcnUvI.exe
  2⤵
  PID:6212
- C:\Windows\System\oXDijyp.exe
  C:\Windows\System\oXDijyp.exe
  2⤵
  PID:7048
- C:\Windows\System\pJkHEgR.exe
  C:\Windows\System\pJkHEgR.exe
  2⤵
  PID:6440
- C:\Windows\System\ooccKLk.exe
  C:\Windows\System\ooccKLk.exe
  2⤵
  PID:6016
- C:\Windows\System\CagKLqH.exe
  C:\Windows\System\CagKLqH.exe
  2⤵
  PID:7004
- C:\Windows\System\jzXIEZX.exe
  C:\Windows\System\jzXIEZX.exe
  2⤵
  PID:5640
- C:\Windows\System\MGTwoGr.exe
  C:\Windows\System\MGTwoGr.exe
  2⤵
  PID:7176
- C:\Windows\System\tGvKeCU.exe
  C:\Windows\System\tGvKeCU.exe
  2⤵
  PID:7192
- C:\Windows\System\yCBoNGh.exe
  C:\Windows\System\yCBoNGh.exe
  2⤵
  PID:7208
- C:\Windows\System\UzaqtHc.exe
  C:\Windows\System\UzaqtHc.exe
  2⤵
  PID:7224
- C:\Windows\System\fSygVQM.exe
  C:\Windows\System\fSygVQM.exe
  2⤵
  PID:7240
- C:\Windows\System\pcnMHcz.exe
  C:\Windows\System\pcnMHcz.exe
  2⤵
  PID:7256
- C:\Windows\System\oIdjCjJ.exe
  C:\Windows\System\oIdjCjJ.exe
  2⤵
  PID:7272
- C:\Windows\System\xslQjYJ.exe
  C:\Windows\System\xslQjYJ.exe
  2⤵
  PID:7288
- C:\Windows\System\vdvLFjO.exe
  C:\Windows\System\vdvLFjO.exe
  2⤵
  PID:7304
- C:\Windows\System\qJcWTqN.exe
  C:\Windows\System\qJcWTqN.exe
  2⤵
  PID:7320
- C:\Windows\System\TTsWDNW.exe
  C:\Windows\System\TTsWDNW.exe
  2⤵
  PID:7336
- C:\Windows\System\inxGGEA.exe
  C:\Windows\System\inxGGEA.exe
  2⤵
  PID:7352
- C:\Windows\System\nUIDxhw.exe
  C:\Windows\System\nUIDxhw.exe
  2⤵
  PID:7368
- C:\Windows\System\sPGpToU.exe
  C:\Windows\System\sPGpToU.exe
  2⤵
  PID:7384
- C:\Windows\System\QLRcBvy.exe
  C:\Windows\System\QLRcBvy.exe
  2⤵
  PID:7400
- C:\Windows\System\qfBdchA.exe
  C:\Windows\System\qfBdchA.exe
  2⤵
  PID:7416
- C:\Windows\System\UouIciL.exe
  C:\Windows\System\UouIciL.exe
  2⤵
  PID:7432
- C:\Windows\System\ObqjJgT.exe
  C:\Windows\System\ObqjJgT.exe
  2⤵
  PID:7448
- C:\Windows\System\pQCRyPW.exe
  C:\Windows\System\pQCRyPW.exe
  2⤵
  PID:7464
- C:\Windows\System\fijgvfT.exe
  C:\Windows\System\fijgvfT.exe
  2⤵
  PID:7572
- C:\Windows\System\gPqAwOM.exe
  C:\Windows\System\gPqAwOM.exe
  2⤵
  PID:7588
- C:\Windows\System\jaysAGg.exe
  C:\Windows\System\jaysAGg.exe
  2⤵
  PID:7604
- C:\Windows\System\tPZTgPl.exe
  C:\Windows\System\tPZTgPl.exe
  2⤵
  PID:7620
- C:\Windows\System\TsTivdV.exe
  C:\Windows\System\TsTivdV.exe
  2⤵
  PID:7636
- C:\Windows\System\VxPxQbn.exe
  C:\Windows\System\VxPxQbn.exe
  2⤵
  PID:7652
- C:\Windows\System\eYWJYsY.exe
  C:\Windows\System\eYWJYsY.exe
  2⤵
  PID:7668
- C:\Windows\System\seMTZRN.exe
  C:\Windows\System\seMTZRN.exe
  2⤵
  PID:7684
- C:\Windows\System\ZuwzsQm.exe
  C:\Windows\System\ZuwzsQm.exe
  2⤵
  PID:7700
- C:\Windows\System\jmAvMNX.exe
  C:\Windows\System\jmAvMNX.exe
  2⤵
  PID:7716
- C:\Windows\System\jxdofmm.exe
  C:\Windows\System\jxdofmm.exe
  2⤵
  PID:7732
- C:\Windows\System\frkfLqb.exe
  C:\Windows\System\frkfLqb.exe
  2⤵
  PID:7748
- C:\Windows\System\bqOgcgU.exe
  C:\Windows\System\bqOgcgU.exe
  2⤵
  PID:7764
- C:\Windows\System\MHOHyej.exe
  C:\Windows\System\MHOHyej.exe
  2⤵
  PID:7780
- C:\Windows\System\mtdWISi.exe
  C:\Windows\System\mtdWISi.exe
  2⤵
  PID:7796
- C:\Windows\System\yhzTjwr.exe
  C:\Windows\System\yhzTjwr.exe
  2⤵
  PID:7812
- C:\Windows\System\fuPjMKK.exe
  C:\Windows\System\fuPjMKK.exe
  2⤵
  PID:7828
- C:\Windows\System\nMbZEsS.exe
  C:\Windows\System\nMbZEsS.exe
  2⤵
  PID:7844
- C:\Windows\System\EuScTXy.exe
  C:\Windows\System\EuScTXy.exe
  2⤵
  PID:7860
- C:\Windows\System\XNHGbFS.exe
  C:\Windows\System\XNHGbFS.exe
  2⤵
  PID:7876
- C:\Windows\System\HOCuqNa.exe
  C:\Windows\System\HOCuqNa.exe
  2⤵
  PID:7892
- C:\Windows\System\qAODVmO.exe
  C:\Windows\System\qAODVmO.exe
  2⤵
  PID:7908
- C:\Windows\System\RVvdQfk.exe
  C:\Windows\System\RVvdQfk.exe
  2⤵
  PID:7924
- C:\Windows\System\yUkGBJV.exe
  C:\Windows\System\yUkGBJV.exe
  2⤵
  PID:7940
- C:\Windows\System\wdNnkTB.exe
  C:\Windows\System\wdNnkTB.exe
  2⤵
  PID:7956
- C:\Windows\System\ybtihVT.exe
  C:\Windows\System\ybtihVT.exe
  2⤵
  PID:7972
- C:\Windows\System\VfoOBEd.exe
  C:\Windows\System\VfoOBEd.exe
  2⤵
  PID:7988
- C:\Windows\System\PxxGnOX.exe
  C:\Windows\System\PxxGnOX.exe
  2⤵
  PID:8004
- C:\Windows\System\CMcfMFO.exe
  C:\Windows\System\CMcfMFO.exe
  2⤵
  PID:8020
- C:\Windows\System\CUQvPff.exe
  C:\Windows\System\CUQvPff.exe
  2⤵
  PID:8036
- C:\Windows\System\lQXthvK.exe
  C:\Windows\System\lQXthvK.exe
  2⤵
  PID:8052
- C:\Windows\System\DtUkwBN.exe
  C:\Windows\System\DtUkwBN.exe
  2⤵
  PID:8068
- C:\Windows\System\asKBKjH.exe
  C:\Windows\System\asKBKjH.exe
  2⤵
  PID:8084
- C:\Windows\System\sruNGCC.exe
  C:\Windows\System\sruNGCC.exe
  2⤵
  PID:8104
- C:\Windows\System\HVHsqdu.exe
  C:\Windows\System\HVHsqdu.exe
  2⤵
  PID:8120
- C:\Windows\System\YovNAWp.exe
  C:\Windows\System\YovNAWp.exe
  2⤵
  PID:8140
- C:\Windows\System\NfEoKKg.exe
  C:\Windows\System\NfEoKKg.exe
  2⤵
  PID:8156
- C:\Windows\System\OFtLWVQ.exe
  C:\Windows\System\OFtLWVQ.exe
  2⤵
  PID:8172
- C:\Windows\System\LWwMRSj.exe
  C:\Windows\System\LWwMRSj.exe
  2⤵
  PID:8188
- C:\Windows\System\HZnYrxw.exe
  C:\Windows\System\HZnYrxw.exe
  2⤵
  PID:7116
- C:\Windows\System\JckRPVM.exe
  C:\Windows\System\JckRPVM.exe
  2⤵
  PID:7216
- C:\Windows\System\UCeDspJ.exe
  C:\Windows\System\UCeDspJ.exe
  2⤵
  PID:7280
- C:\Windows\System\NGDJdlB.exe
  C:\Windows\System\NGDJdlB.exe
  2⤵
  PID:7312
- C:\Windows\System\YMvNqPI.exe
  C:\Windows\System\YMvNqPI.exe
  2⤵
  PID:6664
- C:\Windows\System\tfxgYXI.exe
  C:\Windows\System\tfxgYXI.exe
  2⤵
  PID:7080
- C:\Windows\System\xAHcPqz.exe
  C:\Windows\System\xAHcPqz.exe
  2⤵
  PID:5784
- C:\Windows\System\yCtxosY.exe
  C:\Windows\System\yCtxosY.exe
  2⤵
  PID:7204
- C:\Windows\System\gmPalpa.exe
  C:\Windows\System\gmPalpa.exe
  2⤵
  PID:7376
- C:\Windows\System\PFoQaJu.exe
  C:\Windows\System\PFoQaJu.exe
  2⤵
  PID:7172
- C:\Windows\System\DrfEWmk.exe
  C:\Windows\System\DrfEWmk.exe
  2⤵
  PID:7332
- C:\Windows\System\eOMrOaE.exe
  C:\Windows\System\eOMrOaE.exe
  2⤵
  PID:6840
- C:\Windows\System\AEivqtE.exe
  C:\Windows\System\AEivqtE.exe
  2⤵
  PID:5512
- C:\Windows\System\ITMMmXv.exe
  C:\Windows\System\ITMMmXv.exe
  2⤵
  PID:7200
- C:\Windows\System\uQEhhFA.exe
  C:\Windows\System\uQEhhFA.exe
  2⤵
  PID:7428
- C:\Windows\System\bdevdpK.exe
  C:\Windows\System\bdevdpK.exe
  2⤵
  PID:7396
- C:\Windows\System\YdezVCY.exe
  C:\Windows\System\YdezVCY.exe
  2⤵
  PID:7444
- C:\Windows\System\kouWyot.exe
  C:\Windows\System\kouWyot.exe
  2⤵
  PID:7484
- C:\Windows\System\CjcsfvM.exe
  C:\Windows\System\CjcsfvM.exe
  2⤵
  PID:7508
- C:\Windows\System\CMlXSOA.exe
  C:\Windows\System\CMlXSOA.exe
  2⤵
  PID:7512
- C:\Windows\System\RYaKSms.exe
  C:\Windows\System\RYaKSms.exe
  2⤵
  PID:7536
- C:\Windows\System\DOsOiyM.exe
  C:\Windows\System\DOsOiyM.exe
  2⤵
  PID:7544
- C:\Windows\System\nmOZDel.exe
  C:\Windows\System\nmOZDel.exe
  2⤵
  PID:7564
- C:\Windows\System\BtxtUTO.exe
  C:\Windows\System\BtxtUTO.exe
  2⤵
  PID:7628
- C:\Windows\System\vZuwvEL.exe
  C:\Windows\System\vZuwvEL.exe
  2⤵
  PID:7692
- C:\Windows\System\sRWpCrQ.exe
  C:\Windows\System\sRWpCrQ.exe
  2⤵
  PID:7756
- C:\Windows\System\VGWewuO.exe
  C:\Windows\System\VGWewuO.exe
  2⤵
  PID:7788
- C:\Windows\System\KCWKzSy.exe
  C:\Windows\System\KCWKzSy.exe
  2⤵
  PID:7884
- C:\Windows\System\QxaJBKj.exe
  C:\Windows\System\QxaJBKj.exe
  2⤵
  PID:7952
- C:\Windows\System\NnUMJRs.exe
  C:\Windows\System\NnUMJRs.exe
  2⤵
  PID:8012
- C:\Windows\System\GYBypCA.exe
  C:\Windows\System\GYBypCA.exe
  2⤵
  PID:7872
- C:\Windows\System\RgsgBfr.exe
  C:\Windows\System\RgsgBfr.exe
  2⤵
  PID:8112
- C:\Windows\System\wfyZwtO.exe
  C:\Windows\System\wfyZwtO.exe
  2⤵
  PID:7932
- C:\Windows\System\edmrluI.exe
  C:\Windows\System\edmrluI.exe
  2⤵
  PID:8184
- C:\Windows\System\LTYMqOu.exe
  C:\Windows\System\LTYMqOu.exe
  2⤵
  PID:7936
- C:\Windows\System\lGSkkFW.exe
  C:\Windows\System\lGSkkFW.exe
  2⤵
  PID:6644
- C:\Windows\System\usdPHSq.exe
  C:\Windows\System\usdPHSq.exe
  2⤵
  PID:6920
- C:\Windows\System\JrcstMx.exe
  C:\Windows\System\JrcstMx.exe
  2⤵
  PID:7348
- C:\Windows\System\ucLcLRN.exe
  C:\Windows\System\ucLcLRN.exe
  2⤵
  PID:6904
- C:\Windows\System\hSbYCAq.exe
  C:\Windows\System\hSbYCAq.exe
  2⤵
  PID:7460
- C:\Windows\System\KUqjtIH.exe
  C:\Windows\System\KUqjtIH.exe
  2⤵
  PID:6164
- C:\Windows\System\YMVYBdt.exe
  C:\Windows\System\YMVYBdt.exe
  2⤵
  PID:7500
- C:\Windows\System\vekwNhv.exe
  C:\Windows\System\vekwNhv.exe
  2⤵
  PID:7496
- C:\Windows\System\FWrbWfM.exe
  C:\Windows\System\FWrbWfM.exe
  2⤵
  PID:7596
- C:\Windows\System\pmPAXHu.exe
  C:\Windows\System\pmPAXHu.exe
  2⤵
  PID:7408
- C:\Windows\System\fAzMUlE.exe
  C:\Windows\System\fAzMUlE.exe
  2⤵
  PID:7556
- C:\Windows\System\DziZtBI.exe
  C:\Windows\System\DziZtBI.exe
  2⤵
  PID:7552
- C:\Windows\System\HOaHilv.exe
  C:\Windows\System\HOaHilv.exe
  2⤵
  PID:7644
- C:\Windows\System\LrumjUc.exe
  C:\Windows\System\LrumjUc.exe
  2⤵
  PID:7824
- C:\Windows\System\GVLYhmB.exe
  C:\Windows\System\GVLYhmB.exe
  2⤵
  PID:7776
- C:\Windows\System\StPWZoj.exe
  C:\Windows\System\StPWZoj.exe
  2⤵
  PID:7708
- C:\Windows\System\IHBiiuA.exe
  C:\Windows\System\IHBiiuA.exe
  2⤵
  PID:7836
- C:\Windows\System\GMLliQH.exe
  C:\Windows\System\GMLliQH.exe
  2⤵
  PID:7984
- C:\Windows\System\nhrAGlX.exe
  C:\Windows\System\nhrAGlX.exe
  2⤵
  PID:7968
- C:\Windows\System\hpVNonb.exe
  C:\Windows\System\hpVNonb.exe
  2⤵
  PID:8136
- C:\Windows\System\yuVqLMp.exe
  C:\Windows\System\yuVqLMp.exe
  2⤵
  PID:7900
- C:\Windows\System\mcpxwWh.exe
  C:\Windows\System\mcpxwWh.exe
  2⤵
  PID:6312
- C:\Windows\System\mwccEYt.exe
  C:\Windows\System\mwccEYt.exe
  2⤵
  PID:8064
- C:\Windows\System\IDWfPdc.exe
  C:\Windows\System\IDWfPdc.exe
  2⤵
  PID:8132
- C:\Windows\System\wXrGFLp.exe
  C:\Windows\System\wXrGFLp.exe
  2⤵
  PID:6688
- C:\Windows\System\tqgmJeL.exe
  C:\Windows\System\tqgmJeL.exe
  2⤵
  PID:7480
- C:\Windows\System\xqUnXCq.exe
  C:\Windows\System\xqUnXCq.exe
  2⤵
  PID:7520
- C:\Windows\System\ZxujuOJ.exe
  C:\Windows\System\ZxujuOJ.exe
  2⤵
  PID:7852
- C:\Windows\System\WMaDjsg.exe
  C:\Windows\System\WMaDjsg.exe
  2⤵
  PID:7808
- C:\Windows\System\qkmaWsb.exe
  C:\Windows\System\qkmaWsb.exe
  2⤵
  PID:7916
- C:\Windows\System\DmPJaOY.exe
  C:\Windows\System\DmPJaOY.exe
  2⤵
  PID:7248
- C:\Windows\System\mnwvefj.exe
  C:\Windows\System\mnwvefj.exe
  2⤵
  PID:7744
- C:\Windows\System\AqundgA.exe
  C:\Windows\System\AqundgA.exe
  2⤵
  PID:8060
- C:\Windows\System\sLBOIOR.exe
  C:\Windows\System\sLBOIOR.exe
  2⤵
  PID:6752
- C:\Windows\System\XZbbNxy.exe
  C:\Windows\System\XZbbNxy.exe
  2⤵
  PID:6900
- C:\Windows\System\zLOxRYb.exe
  C:\Windows\System\zLOxRYb.exe
  2⤵
  PID:8100
- C:\Windows\System\nYWSdYE.exe
  C:\Windows\System\nYWSdYE.exe
  2⤵
  PID:7856
- C:\Windows\System\RcYTZJR.exe
  C:\Windows\System\RcYTZJR.exe
  2⤵
  PID:8200
- C:\Windows\System\PHVAHCV.exe
  C:\Windows\System\PHVAHCV.exe
  2⤵
  PID:8224
- C:\Windows\System\CbQboJG.exe
  C:\Windows\System\CbQboJG.exe
  2⤵
  PID:8240
- C:\Windows\System\uzCWTcK.exe
  C:\Windows\System\uzCWTcK.exe
  2⤵
  PID:8256
- C:\Windows\System\WelZxBc.exe
  C:\Windows\System\WelZxBc.exe
  2⤵
  PID:8272
- C:\Windows\System\FhkofPE.exe
  C:\Windows\System\FhkofPE.exe
  2⤵
  PID:8288
- C:\Windows\System\dSjmIKS.exe
  C:\Windows\System\dSjmIKS.exe
  2⤵
  PID:8308
- C:\Windows\System\JtGZNin.exe
  C:\Windows\System\JtGZNin.exe
  2⤵
  PID:8324
- C:\Windows\System\hWMjHXA.exe
  C:\Windows\System\hWMjHXA.exe
  2⤵
  PID:8340
- C:\Windows\System\HCNYhCD.exe
  C:\Windows\System\HCNYhCD.exe
  2⤵
  PID:8356
- C:\Windows\System\fwYmHKP.exe
  C:\Windows\System\fwYmHKP.exe
  2⤵
  PID:8372
- C:\Windows\System\DLswGZJ.exe
  C:\Windows\System\DLswGZJ.exe
  2⤵
  PID:8392
- C:\Windows\System\QVpeWAp.exe
  C:\Windows\System\QVpeWAp.exe
  2⤵
  PID:8408
- C:\Windows\System\DYQjlgO.exe
  C:\Windows\System\DYQjlgO.exe
  2⤵
  PID:8448
- C:\Windows\System\SpogtBM.exe
  C:\Windows\System\SpogtBM.exe
  2⤵
  PID:8464
- C:\Windows\System\NfKdptV.exe
  C:\Windows\System\NfKdptV.exe
  2⤵
  PID:8480
- C:\Windows\System\YfdXGlX.exe
  C:\Windows\System\YfdXGlX.exe
  2⤵
  PID:8496
- C:\Windows\System\rBMvDZy.exe
  C:\Windows\System\rBMvDZy.exe
  2⤵
  PID:8512
- C:\Windows\System\dXusBUd.exe
  C:\Windows\System\dXusBUd.exe
  2⤵
  PID:8532
- C:\Windows\System\PpycKCe.exe
  C:\Windows\System\PpycKCe.exe
  2⤵
  PID:8660
- C:\Windows\System\fANRMAK.exe
  C:\Windows\System\fANRMAK.exe
  2⤵
  PID:8676
- C:\Windows\System\Oyeqoah.exe
  C:\Windows\System\Oyeqoah.exe
  2⤵
  PID:8692
- C:\Windows\System\XcdIJsF.exe
  C:\Windows\System\XcdIJsF.exe
  2⤵
  PID:8708
- C:\Windows\System\UMHQxta.exe
  C:\Windows\System\UMHQxta.exe
  2⤵
  PID:8724
- C:\Windows\System\LHJKsqy.exe
  C:\Windows\System\LHJKsqy.exe
  2⤵
  PID:8740
- C:\Windows\System\oNTUJjm.exe
  C:\Windows\System\oNTUJjm.exe
  2⤵
  PID:8756
- C:\Windows\System\TjUOGQX.exe
  C:\Windows\System\TjUOGQX.exe
  2⤵
  PID:8772
- C:\Windows\System\mCLHGAM.exe
  C:\Windows\System\mCLHGAM.exe
  2⤵
  PID:8788
- C:\Windows\System\OKQovdN.exe
  C:\Windows\System\OKQovdN.exe
  2⤵
  PID:8804
- C:\Windows\System\GybbfwV.exe
  C:\Windows\System\GybbfwV.exe
  2⤵
  PID:8820
- C:\Windows\System\htzPHTf.exe
  C:\Windows\System\htzPHTf.exe
  2⤵
  PID:8836
- C:\Windows\System\VkOsaKy.exe
  C:\Windows\System\VkOsaKy.exe
  2⤵
  PID:8852
- C:\Windows\System\pNqFoRM.exe
  C:\Windows\System\pNqFoRM.exe
  2⤵
  PID:8868
- C:\Windows\System\fTpfxLD.exe
  C:\Windows\System\fTpfxLD.exe
  2⤵
  PID:8884
- C:\Windows\System\mPBHAve.exe
  C:\Windows\System\mPBHAve.exe
  2⤵
  PID:8900
- C:\Windows\System\xEoRPbf.exe
  C:\Windows\System\xEoRPbf.exe
  2⤵
  PID:8916
- C:\Windows\System\Ncslmpl.exe
  C:\Windows\System\Ncslmpl.exe
  2⤵
  PID:8932
- C:\Windows\System\KddBYZU.exe
  C:\Windows\System\KddBYZU.exe
  2⤵
  PID:8948
- C:\Windows\System\NGAAjfy.exe
  C:\Windows\System\NGAAjfy.exe
  2⤵
  PID:8964
- C:\Windows\System\VdHusJS.exe
  C:\Windows\System\VdHusJS.exe
  2⤵
  PID:8980
- C:\Windows\System\vdESevJ.exe
  C:\Windows\System\vdESevJ.exe
  2⤵
  PID:8996
- C:\Windows\System\SRHjlnc.exe
  C:\Windows\System\SRHjlnc.exe
  2⤵
  PID:9012
- C:\Windows\System\dxRxwbc.exe
  C:\Windows\System\dxRxwbc.exe
  2⤵
  PID:9028
- C:\Windows\System\vhWdptA.exe
  C:\Windows\System\vhWdptA.exe
  2⤵
  PID:9048
- C:\Windows\System\xvEivOC.exe
  C:\Windows\System\xvEivOC.exe
  2⤵
  PID:9068
- C:\Windows\System\DQCEiJy.exe
  C:\Windows\System\DQCEiJy.exe
  2⤵
  PID:9084
- C:\Windows\System\ZLglopL.exe
  C:\Windows\System\ZLglopL.exe
  2⤵
  PID:9100
- C:\Windows\System\BlhRAvs.exe
  C:\Windows\System\BlhRAvs.exe
  2⤵
  PID:9116
- C:\Windows\System\BqfaJwT.exe
  C:\Windows\System\BqfaJwT.exe
  2⤵
  PID:9132
- C:\Windows\System\XgtFFQu.exe
  C:\Windows\System\XgtFFQu.exe
  2⤵
  PID:9148
- C:\Windows\System\oCCRFNZ.exe
  C:\Windows\System\oCCRFNZ.exe
  2⤵
  PID:9164
- C:\Windows\System\lvDQVWK.exe
  C:\Windows\System\lvDQVWK.exe
  2⤵
  PID:9180
- C:\Windows\System\ThixclC.exe
  C:\Windows\System\ThixclC.exe
  2⤵
  PID:9196
- C:\Windows\System\ArXXBoS.exe
  C:\Windows\System\ArXXBoS.exe
  2⤵
  PID:9212
- C:\Windows\System\dpJJxeq.exe
  C:\Windows\System\dpJJxeq.exe
  2⤵
  PID:8216
- C:\Windows\System\mPTAxZt.exe
  C:\Windows\System\mPTAxZt.exe
  2⤵
  PID:8280
- C:\Windows\System\JhFrDIU.exe
  C:\Windows\System\JhFrDIU.exe
  2⤵
  PID:8348
- C:\Windows\System\VEJXoXM.exe
  C:\Windows\System\VEJXoXM.exe
  2⤵
  PID:6124
- C:\Windows\System\COKikyD.exe
  C:\Windows\System\COKikyD.exe
  2⤵
  PID:7424
- C:\Windows\System\WFZYGMt.exe
  C:\Windows\System\WFZYGMt.exe
  2⤵
  PID:7612
- C:\Windows\System\wrdwlcO.exe
  C:\Windows\System\wrdwlcO.exe
  2⤵
  PID:7868
- C:\Windows\System\oeyzUTK.exe
  C:\Windows\System\oeyzUTK.exe
  2⤵
  PID:7664
- C:\Windows\System\qCjBrRg.exe
  C:\Windows\System\qCjBrRg.exe
  2⤵
  PID:8416
- C:\Windows\System\COExpzM.exe
  C:\Windows\System\COExpzM.exe
  2⤵
  PID:7532
- C:\Windows\System\ttCbDSl.exe
  C:\Windows\System\ttCbDSl.exe
  2⤵
  PID:7996
- C:\Windows\System\YeceLZk.exe
  C:\Windows\System\YeceLZk.exe
  2⤵
  PID:8236
- C:\Windows\System\ZhAFXtW.exe
  C:\Windows\System\ZhAFXtW.exe
  2⤵
  PID:8300
- C:\Windows\System\ejnFAGT.exe
  C:\Windows\System\ejnFAGT.exe
  2⤵
  PID:8424
- C:\Windows\System\EkVQcfz.exe
  C:\Windows\System\EkVQcfz.exe
  2⤵
  PID:8440
- C:\Windows\System\aNLkVfv.exe
  C:\Windows\System\aNLkVfv.exe
  2⤵
  PID:8540
- C:\Windows\System\qiFfiNg.exe
  C:\Windows\System\qiFfiNg.exe
  2⤵
  PID:8520
- C:\Windows\System\kuseZOY.exe
  C:\Windows\System\kuseZOY.exe
  2⤵
  PID:8456
- C:\Windows\System\MJejrMD.exe
  C:\Windows\System\MJejrMD.exe
  2⤵
  PID:8552
- C:\Windows\System\nVykWvd.exe
  C:\Windows\System\nVykWvd.exe
  2⤵
  PID:8572
- C:\Windows\System\gEYXbub.exe
  C:\Windows\System\gEYXbub.exe
  2⤵
  PID:9080
- C:\Windows\System\jZzBLLR.exe
  C:\Windows\System\jZzBLLR.exe
  2⤵
  PID:9204
- C:\Windows\System\UXbARJK.exe
  C:\Windows\System\UXbARJK.exe
  2⤵
  PID:8384
- C:\Windows\System\nknvdTK.exe
  C:\Windows\System\nknvdTK.exe
  2⤵
  PID:6756
- C:\Windows\System\LhRlzPe.exe
  C:\Windows\System\LhRlzPe.exe
  2⤵
  PID:8332
- C:\Windows\System\OSlqqNM.exe
  C:\Windows\System\OSlqqNM.exe
  2⤵
  PID:8768
- C:\Windows\System\QMdJKbU.exe
  C:\Windows\System\QMdJKbU.exe
  2⤵
  PID:9064
- C:\Windows\System\eZXnAuf.exe
  C:\Windows\System\eZXnAuf.exe
  2⤵
  PID:8700
- C:\Windows\System\gDSKMeP.exe
  C:\Windows\System\gDSKMeP.exe
  2⤵
  PID:8732
- C:\Windows\System\fOvRDHk.exe
  C:\Windows\System\fOvRDHk.exe
  2⤵
  PID:8668
- C:\Windows\System\UjOqMko.exe
  C:\Windows\System\UjOqMko.exe
  2⤵
  PID:8508
- C:\Windows\System\vfsnkwJ.exe
  C:\Windows\System\vfsnkwJ.exe
  2⤵
  PID:8296
- C:\Windows\System\yNCEApa.exe
  C:\Windows\System\yNCEApa.exe
  2⤵
  PID:7680
- C:\Windows\System\cpZVwat.exe
  C:\Windows\System\cpZVwat.exe
  2⤵
  PID:8208
- C:\Windows\System\heEXugg.exe
  C:\Windows\System\heEXugg.exe
  2⤵
  PID:9160
- C:\Windows\System\LSZnpeU.exe
  C:\Windows\System\LSZnpeU.exe
  2⤵
  PID:9096
- C:\Windows\System\tFhWvXq.exe
  C:\Windows\System\tFhWvXq.exe
  2⤵
  PID:9020
- C:\Windows\System\GlsSWQB.exe
  C:\Windows\System\GlsSWQB.exe
  2⤵
  PID:8924
- C:\Windows\System\DAxfenF.exe
  C:\Windows\System\DAxfenF.exe
  2⤵
  PID:8436
- C:\Windows\System\XQVayVu.exe
  C:\Windows\System\XQVayVu.exe
  2⤵
  PID:8580
- C:\Windows\System\EHJPurR.exe
  C:\Windows\System\EHJPurR.exe
  2⤵
  PID:8548
- C:\Windows\System\fGsyVuG.exe
  C:\Windows\System\fGsyVuG.exe
  2⤵
  PID:8608
- C:\Windows\System\GVxkECc.exe
  C:\Windows\System\GVxkECc.exe
  2⤵
  PID:8684
- C:\Windows\System\GGvjQEO.exe
  C:\Windows\System\GGvjQEO.exe
  2⤵
  PID:8752
- C:\Windows\System\wPGaUZj.exe
  C:\Windows\System\wPGaUZj.exe
  2⤵
  PID:8784
- C:\Windows\System\wtWQVsR.exe
  C:\Windows\System\wtWQVsR.exe
  2⤵
  PID:8848
- C:\Windows\System\aXkmfxd.exe
  C:\Windows\System\aXkmfxd.exe
  2⤵
  PID:8912
- C:\Windows\System\xZDDUWm.exe
  C:\Windows\System\xZDDUWm.exe
  2⤵
  PID:9112
- C:\Windows\System\QqQwBnM.exe
  C:\Windows\System\QqQwBnM.exe
  2⤵
  PID:9172
- C:\Windows\System\NcurFch.exe
  C:\Windows\System\NcurFch.exe
  2⤵
  PID:8404
- C:\Windows\System\GhqufHR.exe
  C:\Windows\System\GhqufHR.exe
  2⤵
  PID:8860
- C:\Windows\System\maBjpcU.exe
  C:\Windows\System\maBjpcU.exe
  2⤵
  PID:8388
- C:\Windows\System\HgvYzfA.exe
  C:\Windows\System\HgvYzfA.exe
  2⤵
  PID:8988
- C:\Windows\System\xOLcNUP.exe
  C:\Windows\System\xOLcNUP.exe
  2⤵
  PID:8896
- C:\Windows\System\FceErad.exe
  C:\Windows\System\FceErad.exe
  2⤵
  PID:7980
- C:\Windows\System\ehiEOan.exe
  C:\Windows\System\ehiEOan.exe
  2⤵
  PID:9024
- C:\Windows\System\mtuHSaI.exe
  C:\Windows\System\mtuHSaI.exe
  2⤵
  PID:8232
- C:\Windows\System\dkvJsQr.exe
  C:\Windows\System\dkvJsQr.exe
  2⤵
  PID:5572
- C:\Windows\System\KjcWkiI.exe
  C:\Windows\System\KjcWkiI.exe
  2⤵
  PID:8832
- C:\Windows\System\pEXMVqE.exe
  C:\Windows\System\pEXMVqE.exe
  2⤵
  PID:8488
- C:\Windows\System\XbCTMtU.exe
  C:\Windows\System\XbCTMtU.exe
  2⤵
  PID:8604
- C:\Windows\System\VioNaRW.exe
  C:\Windows\System\VioNaRW.exe
  2⤵
  PID:8844
- C:\Windows\System\iBCJnHB.exe
  C:\Windows\System\iBCJnHB.exe
  2⤵
  PID:8000
- C:\Windows\System\SYvKnuV.exe
  C:\Windows\System\SYvKnuV.exe
  2⤵
  PID:8800
- C:\Windows\System\vmaMIUT.exe
  C:\Windows\System\vmaMIUT.exe
  2⤵
  PID:9124
- C:\Windows\System\LGlHeJC.exe
  C:\Windows\System\LGlHeJC.exe
  2⤵
  PID:8880
- C:\Windows\System\jWQnxMP.exe
  C:\Windows\System\jWQnxMP.exe
  2⤵
  PID:8368
- C:\Windows\System\dHUnBBw.exe
  C:\Windows\System\dHUnBBw.exe
  2⤵
  PID:8248
- C:\Windows\System\OQooDhR.exe
  C:\Windows\System\OQooDhR.exe
  2⤵
  PID:8704
- C:\Windows\System\gDYRENo.exe
  C:\Windows\System\gDYRENo.exe
  2⤵
  PID:8816
- C:\Windows\System\ScLfZFM.exe
  C:\Windows\System\ScLfZFM.exe
  2⤵
  PID:9056
- C:\Windows\System\nZwasLJ.exe
  C:\Windows\System\nZwasLJ.exe
  2⤵
  PID:8600
- C:\Windows\System\TfSWPlI.exe
  C:\Windows\System\TfSWPlI.exe
  2⤵
  PID:8544
- C:\Windows\System\WIpioYY.exe
  C:\Windows\System\WIpioYY.exe
  2⤵
  PID:9224
- C:\Windows\System\NYcIpog.exe
  C:\Windows\System\NYcIpog.exe
  2⤵
  PID:9240
- C:\Windows\System\eahNlvu.exe
  C:\Windows\System\eahNlvu.exe
  2⤵
  PID:9256
- C:\Windows\System\aGhoDeJ.exe
  C:\Windows\System\aGhoDeJ.exe
  2⤵
  PID:9272
- C:\Windows\System\lxxzKpu.exe
  C:\Windows\System\lxxzKpu.exe
  2⤵
  PID:9288
- C:\Windows\System\gfUBhtL.exe
  C:\Windows\System\gfUBhtL.exe
  2⤵
  PID:9304
- C:\Windows\System\GEXvoog.exe
  C:\Windows\System\GEXvoog.exe
  2⤵
  PID:9372
- C:\Windows\System\YKoHHzC.exe
  C:\Windows\System\YKoHHzC.exe
  2⤵
  PID:9388
- C:\Windows\System\YXcEzQB.exe
  C:\Windows\System\YXcEzQB.exe
  2⤵
  PID:9404
- C:\Windows\System\DPwGUPf.exe
  C:\Windows\System\DPwGUPf.exe
  2⤵
  PID:9544
- C:\Windows\System\IINxPSX.exe
  C:\Windows\System\IINxPSX.exe
  2⤵
  PID:9568
- C:\Windows\System\jeJbhCG.exe
  C:\Windows\System\jeJbhCG.exe
  2⤵
  PID:9588
- C:\Windows\System\bFmeWnr.exe
  C:\Windows\System\bFmeWnr.exe
  2⤵
  PID:9608
- C:\Windows\System\lOGzHkw.exe
  C:\Windows\System\lOGzHkw.exe
  2⤵
  PID:9624
- C:\Windows\System\ZvPfqjg.exe
  C:\Windows\System\ZvPfqjg.exe
  2⤵
  PID:9640
- C:\Windows\System\wlbjjzl.exe
  C:\Windows\System\wlbjjzl.exe
  2⤵
  PID:9660
- C:\Windows\System\IqiNGIo.exe
  C:\Windows\System\IqiNGIo.exe
  2⤵
  PID:9680
- C:\Windows\System\vkJEbSz.exe
  C:\Windows\System\vkJEbSz.exe
  2⤵
  PID:9696
- C:\Windows\System\DGBJLFR.exe
  C:\Windows\System\DGBJLFR.exe
  2⤵
  PID:9712
- C:\Windows\System\zNmfwgL.exe
  C:\Windows\System\zNmfwgL.exe
  2⤵
  PID:9728
- C:\Windows\System\PSPicUU.exe
  C:\Windows\System\PSPicUU.exe
  2⤵
  PID:9744
- C:\Windows\System\mHueGDf.exe
  C:\Windows\System\mHueGDf.exe
  2⤵
  PID:9764
- C:\Windows\System\aiFYCab.exe
  C:\Windows\System\aiFYCab.exe
  2⤵
  PID:9780
- C:\Windows\System\zquOyRM.exe
  C:\Windows\System\zquOyRM.exe
  2⤵
  PID:9796
- C:\Windows\System\unwNLdg.exe
  C:\Windows\System\unwNLdg.exe
  2⤵
  PID:9812
- C:\Windows\System\usTvMPs.exe
  C:\Windows\System\usTvMPs.exe
  2⤵
  PID:9832
- C:\Windows\System\vrmDUsq.exe
  C:\Windows\System\vrmDUsq.exe
  2⤵
  PID:9848
- C:\Windows\System\aehrpGI.exe
  C:\Windows\System\aehrpGI.exe
  2⤵
  PID:9864
- C:\Windows\System\ZOFNKRv.exe
  C:\Windows\System\ZOFNKRv.exe
  2⤵
  PID:9880
- C:\Windows\System\BXcAMjI.exe
  C:\Windows\System\BXcAMjI.exe
  2⤵
  PID:9896
- C:\Windows\System\yJYVOLm.exe
  C:\Windows\System\yJYVOLm.exe
  2⤵
  PID:9912
- C:\Windows\System\RyZBESQ.exe
  C:\Windows\System\RyZBESQ.exe
  2⤵
  PID:9928
- C:\Windows\System\JpEBMJb.exe
  C:\Windows\System\JpEBMJb.exe
  2⤵
  PID:9980
- C:\Windows\System\TMFCmYm.exe
  C:\Windows\System\TMFCmYm.exe
  2⤵
  PID:9996
- C:\Windows\System\vqzdHzB.exe
  C:\Windows\System\vqzdHzB.exe
  2⤵
  PID:10016
- C:\Windows\System\lpLgRLr.exe
  C:\Windows\System\lpLgRLr.exe
  2⤵
  PID:10032
- C:\Windows\System\LFHyYax.exe
  C:\Windows\System\LFHyYax.exe
  2⤵
  PID:10052
- C:\Windows\System\EKuCArt.exe
  C:\Windows\System\EKuCArt.exe
  2⤵
  PID:10068
- C:\Windows\System\CvocavO.exe
  C:\Windows\System\CvocavO.exe
  2⤵
  PID:10084
- C:\Windows\System\JSrrCWS.exe
  C:\Windows\System\JSrrCWS.exe
  2⤵
  PID:10100
- C:\Windows\System\SYTGWWo.exe
  C:\Windows\System\SYTGWWo.exe
  2⤵
  PID:10116
- C:\Windows\System\kxgJMky.exe
  C:\Windows\System\kxgJMky.exe
  2⤵
  PID:10140
- C:\Windows\System\UDxlDmN.exe
  C:\Windows\System\UDxlDmN.exe
  2⤵
  PID:10156
- C:\Windows\System\sGVqzci.exe
  C:\Windows\System\sGVqzci.exe
  2⤵
  PID:10176
- C:\Windows\System\WulfuIU.exe
  C:\Windows\System\WulfuIU.exe
  2⤵
  PID:10192
- C:\Windows\System\XpDEftZ.exe
  C:\Windows\System\XpDEftZ.exe
  2⤵
  PID:10208
- C:\Windows\System\EGpcggW.exe
  C:\Windows\System\EGpcggW.exe
  2⤵
  PID:10224
- C:\Windows\System\JXReEGA.exe
  C:\Windows\System\JXReEGA.exe
  2⤵
  PID:9220
- C:\Windows\System\ukAGgpH.exe
  C:\Windows\System\ukAGgpH.exe
  2⤵
  PID:8736
- C:\Windows\System\LCiaLRK.exe
  C:\Windows\System\LCiaLRK.exe
  2⤵
  PID:9176
- C:\Windows\System\YSclUTC.exe
  C:\Windows\System\YSclUTC.exe
  2⤵
  PID:8180
- C:\Windows\System\lrKUoSE.exe
  C:\Windows\System\lrKUoSE.exe
  2⤵
  PID:9312
- C:\Windows\System\MLtOFQD.exe
  C:\Windows\System\MLtOFQD.exe
  2⤵
  PID:9296
- C:\Windows\System\PtVPNXI.exe
  C:\Windows\System\PtVPNXI.exe
  2⤵
  PID:9320
- C:\Windows\System\jWjtzky.exe
  C:\Windows\System\jWjtzky.exe
  2⤵
  PID:9336
- C:\Windows\System\dosEhAM.exe
  C:\Windows\System\dosEhAM.exe
  2⤵
  PID:8616
- C:\Windows\System\FCirasH.exe
  C:\Windows\System\FCirasH.exe
  2⤵
  PID:9368
- C:\Windows\System\corvfdM.exe
  C:\Windows\System\corvfdM.exe
  2⤵
  PID:9380
- C:\Windows\System\SKOgWjk.exe
  C:\Windows\System\SKOgWjk.exe
  2⤵
  PID:9424
- C:\Windows\System\VEvzgMa.exe
  C:\Windows\System\VEvzgMa.exe
  2⤵
  PID:9440
- C:\Windows\System\tggGrqB.exe
  C:\Windows\System\tggGrqB.exe
  2⤵
  PID:9456
- C:\Windows\System\lhXFhYa.exe
  C:\Windows\System\lhXFhYa.exe
  2⤵
  PID:9472
- C:\Windows\System\STvYFPK.exe
  C:\Windows\System\STvYFPK.exe
  2⤵
  PID:9480
- C:\Windows\System\sQzUzzF.exe
  C:\Windows\System\sQzUzzF.exe
  2⤵
  PID:9500
- C:\Windows\System\zgAAyct.exe
  C:\Windows\System\zgAAyct.exe
  2⤵
  PID:9520
- C:\Windows\System\vSqjVWB.exe
  C:\Windows\System\vSqjVWB.exe
  2⤵
  PID:9540
- C:\Windows\System\lPAqrQp.exe
  C:\Windows\System\lPAqrQp.exe
  2⤵
  PID:9564
- C:\Windows\System\HtXSVDR.exe
  C:\Windows\System\HtXSVDR.exe
  2⤵
  PID:9632
- C:\Windows\System\LaGsaVS.exe
  C:\Windows\System\LaGsaVS.exe
  2⤵
  PID:9736
- C:\Windows\System\YPBzKAL.exe
  C:\Windows\System\YPBzKAL.exe
  2⤵
  PID:9688
- C:\Windows\System\ZRTFduQ.exe
  C:\Windows\System\ZRTFduQ.exe
  2⤵
  PID:9724
- C:\Windows\System\PPBQEjs.exe
  C:\Windows\System\PPBQEjs.exe
  2⤵
  PID:9720
- C:\Windows\System\aBjLlRu.exe
  C:\Windows\System\aBjLlRu.exe
  2⤵
  PID:9828
- C:\Windows\System\YXmyLGS.exe
  C:\Windows\System\YXmyLGS.exe
  2⤵
  PID:9920
- C:\Windows\System\igOYUQt.exe
  C:\Windows\System\igOYUQt.exe
  2⤵
  PID:10012
- C:\Windows\System\mDlzEDr.exe
  C:\Windows\System\mDlzEDr.exe
  2⤵
  PID:10076
- C:\Windows\System\xAaCtfj.exe
  C:\Windows\System\xAaCtfj.exe
  2⤵
  PID:9988
- C:\Windows\System\PBYgwqB.exe
  C:\Windows\System\PBYgwqB.exe
  2⤵
  PID:9416
- C:\Windows\System\DVGakbY.exe
  C:\Windows\System\DVGakbY.exe
  2⤵
  PID:9384
- C:\Windows\System\HWMreOT.exe
  C:\Windows\System\HWMreOT.exe
  2⤵
  PID:9300
- C:\Windows\System\IrxhByT.exe
  C:\Windows\System\IrxhByT.exe
  2⤵
  PID:9252
- C:\Windows\System\RzlZNVN.exe
  C:\Windows\System\RzlZNVN.exe
  2⤵
  PID:9452
- C:\Windows\System\IIRsecz.exe
  C:\Windows\System\IIRsecz.exe
  2⤵
  PID:9484
- C:\Windows\System\wTiQsnx.exe
  C:\Windows\System\wTiQsnx.exe
  2⤵
  PID:9492
- C:\Windows\System\tdUjbeq.exe
  C:\Windows\System\tdUjbeq.exe
  2⤵
  PID:9512
- C:\Windows\System\pcHKTAm.exe
  C:\Windows\System\pcHKTAm.exe
  2⤵
  PID:9556
- C:\Windows\System\VEjVgVm.exe
  C:\Windows\System\VEjVgVm.exe
  2⤵
  PID:9704
- C:\Windows\System\EcAqDPR.exe
  C:\Windows\System\EcAqDPR.exe
  2⤵
  PID:9820
- C:\Windows\System\pFOiEmv.exe
  C:\Windows\System\pFOiEmv.exe
  2⤵
  PID:9892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BDqCpkk.exe

Filesize
1.7MB

MD5
3b26bafbe5a1d2df55147ae79f42f3f5

SHA1
8169bd8f47abaf2acc6a68f999c1d2ec9336c157

SHA256
3107abc6e711d2dd725af4713d5c43df449b764ee4874190b5ac772a326d44d3

SHA512
5d53b56a05d0ea74ac8c6bee5e6fb65b96df0403b42333db87ea49cf0c060bf398265fadede6d1aa347ed1dc0df187fbe123835be13fbf7bcfffba88861f3b0d

Download Submit
C:\Windows\system\CpXSYwg.exe

Filesize
1.7MB

MD5
4b1da5353aaf705a313f8bc73d9c3723

SHA1
79d3be04bb306cb6f0ccca2c8da38ec6306e6e98

SHA256
64dc8a35804a28d6475d5acbe8e5b075f7a7dbf6ef70218849725ee26cfc12f9

SHA512
a088dc0b61b8df5d723e96efa45281cebb82c7754c0b23172e9ddc29d24f9f293f7aaf82c51d5dec45f980983aae5ccf705211f686a729323e3494e169e8a607

Download Submit
C:\Windows\system\EZTnVPd.exe

Filesize
1.7MB

MD5
d7e08670596a5d91c8de536c9def43da

SHA1
fe4d5d476617a2a743c1f88f995958d2e83a0bd3

SHA256
0ca10a77f557635fed64c78c16340e9986fa69f4b7a7144fb80b7bf3a5d23c3f

SHA512
ac02bfcee14967051c065db6930bbf7ba63a5e24647c66883bd46f1ebe68ac3b7f58ad0e025d8d7f4d0d4e24dccee15a62ce87573ba8e067e48473c6461128bf

Download Submit
C:\Windows\system\JSWsaUF.exe

Filesize
1.7MB

MD5
5df214b52dddc584a8e6d19cf0e22ef2

SHA1
2f6e681769c336721f5fcd7e829365dd113b380a

SHA256
928a0d7c9ebd329bc20b5909aab244ad6f1b705c28d2bc340cc19fad8c6853cd

SHA512
dcdca31c11c88cbba6aac2883d8d0ea499f2731e4848f2df1b321727522e4bb4cfde0f2c8461e51572d6d87cd9c95fa81ebcbe7dd02de144b90e0ddd78c2c688

Download Submit
C:\Windows\system\JdlPZew.exe

Filesize
1.7MB

MD5
85865116060ba50cfa50c1f0cd935dd6

SHA1
a16bb09a9bdf816a5689a9fede8f4653050fb1df

SHA256
bca46f3524e086b8cf5784b5f5d4f04aa86225b00b0cac367b44cb48639e8e3d

SHA512
e2d0867dcdeb4865bbd36624641ffc8b84ad29f7fd0dcaef2e4794eb79cc5ed60cd79e1d53209e43ba6ae67aa8520e060e0172c4f98967ef7867bf13fbd36714

Download Submit
C:\Windows\system\JkbfwFp.exe

Filesize
1.7MB

MD5
81322afade6ea8e5090e18da1895bfe9

SHA1
a07230d151e024619db7d615f8cddb9e038eeb53

SHA256
37faf07ed8b6ebba655a8e53765fe9ef2f8cac8327bac7bd670c3ffbc3ecbfa3

SHA512
641b87a28877d063b38bd478fd9466f560ed2f27189c9bf04c8c488605288c201126969857d6a77381a2e7f0c23cfdbfa4055ae5dcc5e157db0380b959ea1c2d

Download Submit
C:\Windows\system\KiVpOGr.exe

Filesize
1.7MB

MD5
2d063410df23d248319e4f326306a0f6

SHA1
83bef15da95feba99954b7d031c8d7c5d2da03bf

SHA256
c02e3d69cadc6139bc7573b5996cf31523ce1681b50a455a3666d40f6675f73d

SHA512
15c953871c47c89b4b01d5da88d0d06bae8221bc755f736e832b4d260413309d0dbd2a74d8c42e5edeed698377da3841cf3e66a992e6d91eef4699e4117adc32

Download Submit
C:\Windows\system\NjCTmPe.exe

Filesize
1.7MB

MD5
588791c15063b8b595a3145057d7443c

SHA1
de19c0f64616e2ae03253196133e9837901b15fd

SHA256
4fd0db4251ad757f76595e4b214241baeca0e5bc162928b2fe27e53edf74476a

SHA512
485a50218c9702d8ed7905eca5a3d3af8f24a5ddf97ee775d5a88a6d40fa3d9a07f1b292357c5fede759283dcc8291e0a93916991e7da6c95fa428d68366c1f6

Download Submit
C:\Windows\system\OLBjNWu.exe

Filesize
1.7MB

MD5
802a26cd611933dc9962471db0f169c2

SHA1
729005a0c043829c7b1ea99bab551211c979aca7

SHA256
6cfdd2c453f174eb2909c460443855c75c18b1ab4ee9b413cb495632fbddcf86

SHA512
4f386414a363a2c9fb06e40049d1a8a7ab4416c79a3a6a19066355612e9c0c40db3753b7f833825d2faab7e5e6d355f9440c7615b3992fec5f8de6c98db0140b

Download Submit
C:\Windows\system\QhMIVAv.exe

Filesize
1.7MB

MD5
da0f4a9a3b175c0818a856172f2208ff

SHA1
f1ebb8f5fd9d095254b08f2a209d11afee9ec541

SHA256
cde5f8849c3ba2b89e83928ad4f475f7294fb7dbe029c51fe0a403bb97d5b1b0

SHA512
721518f76d82efbd35022e78d7b77d2351c9c6f575e4a3d33d90f03e472deba5c2edbbf51368a40ee8d127ae0410d94a7f6fa7bfb72b2b2300abc128c060ede3

Download Submit
C:\Windows\system\RxRJvBP.exe

Filesize
1.7MB

MD5
d514615394ee3c7416dd91c47019a1ea

SHA1
291240623df7e82e232a00586705bca202622771

SHA256
3b4ab950766ca464dc9fff812d1ca95b4eb87f3e4b5cd9dda393e9c4f2756a60

SHA512
31bc5620917683dff000722cf89d796ee7f39c5365c5ab94b0fc3814cec43897deceea5b76932b508b81fed117cc29934ee41fbbb6594abbcbc45de2e933129b

Download Submit
C:\Windows\system\XgbcOcd.exe

Filesize
1.7MB

MD5
540662c4c53c6e19b68542eb6be0e93a

SHA1
2e6f0cf701490b62455fdb09b744ebaa134fdef0

SHA256
9b429d821861c9d3aa34ca7cc782d1e4ac5f6d74de483040bb416183637dd6dd

SHA512
a4c1816eabcfe743cbefdc9f26cabaf154e18d945ee7430a2b5f18e16cb5da314227f303c9773d4bdcfc4db4420e68d306dac65203e1ce447d90f24659039fda

Download Submit
C:\Windows\system\YiCxPLn.exe

Filesize
1.7MB

MD5
e1e9fa76c642fdf1c36883f20f3c1946

SHA1
39fb96c2b4793fd479a62b7ea565ab84e8776fa1

SHA256
fc3c73377f6161c983bee06936152d5e6f25367002cd3f76f3f766b1fa7bab98

SHA512
17c0ef027d65d2f0ef369ebb2982e3303ef332e2770d067f4d27f79ebb30e7375747c6064c29543fd45a22d9a21ca3bb73fe233fb9931b99fe0835887b9dd484

Download Submit
C:\Windows\system\dPrSFkK.exe

Filesize
1.7MB

MD5
72b055c58c738395c8961de21191fdc5

SHA1
6252c071115dc188b2297f63ae9910ae3cc11e50

SHA256
dbf27f53cd06e160b79da2075f145d3df590bbb01cb856f6fdbd3c04e1907eb0

SHA512
9d8626d2d561b358868ba73c94209f26974a5abe362c33b9a7d92462774b54a71b201010c5a37c605ce4fc96b72f755db0809429bcb1e1a0e7d9c4eac4b9e676

Download Submit
C:\Windows\system\fiqJyvC.exe

Filesize
1.7MB

MD5
73788ab2746db703dcf8ec777f3d7f77

SHA1
87b08ad6bbbc426750d0681e991d4be6d36b48bd

SHA256
4f0fd6d67b692f05557297a2db458a21a0c767c4fc13a654833cc8855cd3df0d

SHA512
3f5259177eb4a7ebc5ea591b9e93b8bcc62e8151e4541dcc0ea26bfce4ebc056b60a8ca7da4aca52c259317092d6e6386440f9a8f08d9b37b3aec769c2e4c820

Download Submit
C:\Windows\system\giXVGtK.exe

Filesize
1.7MB

MD5
63515067b6861e0a13efd4676d94dda2

SHA1
147bd6b93e1b03d8d935805ba5d61994902454f5

SHA256
dbcffb70b591c95cf52357ede35902f4ea6b6cef9d3b86ebbeb6a2eef9771196

SHA512
5f68169b582641bd1f69cd857332a7fb1cb37f3ed2d537672018ff0bd2dd49b4a85bb567242751fdf5c7d27f181ddcea0a445be694e1789d7cb04088ce339ac5

Download Submit
C:\Windows\system\jtSbaze.exe

Filesize
1.7MB

MD5
a39b14ba52eaf8e44a74cd43138c8853

SHA1
1677ab9fe31e12fae6c86b6e848083833df75777

SHA256
70fb1824134975ce2b1601526867174e424bf394846e871b31e9739b2f78d538

SHA512
cd482edf59d9cd9f383b466a29d4f2f5a98c89e3118cd1069e3b277d84408049e0d0e07b6919f9d7d26e8f0ae15075aac26481a04c84d24b66d51bc2a725306f

Download Submit
C:\Windows\system\kitYrbO.exe

Filesize
1.7MB

MD5
3c8c983fdaa401911c3077508cf3957a

SHA1
8f3374275b5df1d66256198950ab8afc7c16cad5

SHA256
a76d30b0460e01186e97075f7d84b5e074b1c602308fdcf31fa6a1d378442892

SHA512
1a7070f78b0ca9c46f16d496f26a5cae53db55d3173c36caef6e504bd652c7f2407c21f19902c63171c1fe9d41dcdd88c1d2ad3dc289a01187190de0f9ca424d

Download Submit
C:\Windows\system\klqgGPr.exe

Filesize
1.7MB

MD5
64c38c699eef3d270f6628ade74ef73d

SHA1
b70c1e9d6a41f8af57f1e9cfa4e21c8680f60acc

SHA256
257cd8f825fc787646865371f018c02d9a6b1af581ac05932cb4a5044607f7ba

SHA512
70df7d6316a3313d4bf480b146ef13497160ddb4d85e2fd61588efc93aa0779930c649a08307453d1a5f7a41b2cf579c787b35356ee6d8047c90bb91586b2d1d

Download Submit
C:\Windows\system\lJmGvHj.exe

Filesize
1.7MB

MD5
376f048d747027f8907aed470968d966

SHA1
ae394af237da0e5819b0489475da33c71a6acaab

SHA256
592d17c1615f883d1688d6ed3d2c72cc42d4dab59aea24f88cefd3f5f7eb94dd

SHA512
68e4dab66a122d2ac329b2e513df438c7ed0580cfb8b4e4310265f84b409644b698e5d579ed64ccc653e585685d1e6665db399deae8e6894ae8d32e8f4d21f06

Download Submit
C:\Windows\system\oSNAJlf.exe

Filesize
1.7MB

MD5
9c1d937595c2cab69796642ec1899f70

SHA1
e9ae3e3cfc43d5d219481b09cbc5eb02bac22872

SHA256
b752f6cd65d6f08ad80aba8ec4050f761b01ab61a9939ff03a1a4fa463ce89ce

SHA512
46d5dd92dc3796a84e376dfe3c568a2b36ba6b0f9a6223e12f5a9a38a891ed3647a29f8fe157bb6232ae99ad3869c2b72d5aaf00910c1d8cf9d894ee30728011

Download Submit
C:\Windows\system\wEdZkuj.exe

Filesize
1.7MB

MD5
fd0fe981bfa77ce181cfa4e6b422a935

SHA1
91c5d0afe2e0f625ffc84dddb60d54c5ea1b81c0

SHA256
c375921436bf549312bdc69b086eb932a77824e62f5e4172541998a5937c2e11

SHA512
fb42b90c319829a185fd9593ef5724b39ca1d7dceab42bc72751a325d50739fb1b7892593b17cbfe6555866ef67abee33159e7e3a5ee9b823f3a547849c3576c

Download Submit
C:\Windows\system\xBBRDHR.exe

Filesize
1.7MB

MD5
2d0c342ce1f9dd3a3c5e06833932dfea

SHA1
0faadab3f4216641c156e28bc6631b48bd8ca924

SHA256
0471a12ce9992ffd788815ed26ba77068fe923910fd1b3dc1e5c44ddc520bbb6

SHA512
19c3a8fc33b5dce8a0e349bc4ffe84b6c4ec3db1f927a7f9b525d62d6bc9c9a1eac5d29a26c40e3bc308ffef752987ea398dab316f8db07103bb0c0804a65d48

Download Submit
\Windows\system\MNQzlmI.exe

Filesize
1.7MB

MD5
ea83d893abc2639e0f93a9b00c825efe

SHA1
1d2e13139e49acae063fb1dbcccd1d984d33bbc0

SHA256
b926aa6b6e748ce27aa41501f5a6b294cbb3aa873aec40badad24faacc846891

SHA512
9b8491ee3960d81060aa56116f4eaf39f827962c4ab03ae210a5b050f0f5877686d77a901995a6d964dc4ee3846403dfbcbdecc20b9a3666d4918f0c77c5b4c1

Download Submit
\Windows\system\NOZLxUb.exe

Filesize
1.7MB

MD5
c133f31c8a6ed152d80a67fef9a68568

SHA1
fc82877bc0f623c915f2515b43d44712135f0d58

SHA256
56639c9be057b57e2136d9506156a3798194186567be57a4e1fd2a6f6d34303e

SHA512
487293f6f49009212771cb8c07d704724ab1a87d3f2f7c433a6d4d8d62e46c49fab05b7bdb9aafe8684f3651fb0b2004eca8cd121bb2154fa4664c0c40968319

Download Submit
\Windows\system\NOkBWrX.exe

Filesize
1.7MB

MD5
df4c65a221757baeb8e5a05e2a302302

SHA1
ac93900061c36edd4336780abf9306178f44d648

SHA256
34f6f8b167c6fc385c328bf9eaf55fe274b57c0923cd8c8e2388df2eeb0a5428

SHA512
0e89fa2f90c84f39aac681630d430f51e4739c6828a8f09ba36eae4f84fee78dbe85c2ccfda8d149b7a8eada63aa5c59e552fb49b9ac277c138f9c259c2908d7

Download Submit
\Windows\system\WuaeYOc.exe

Filesize
1.7MB

MD5
a0cbf0b1526d638bc91e57536c42579f

SHA1
d2a927bb15d9835e93d9bd0b48a04df2573a5571

SHA256
482c28a6744eb9cb061ac47236bbe6348ab6123c7dc3aed8e9cea61432c771dd

SHA512
982442aa28298ba20ecdb13b6d418fca6fc9a1a2e86d695af5f327f8f20fb05e7f7fa075904914f60c0e76b8f7b1bbcd25475fc31e78ec57a27695047e1fc482

Download Submit
\Windows\system\WwCvJxd.exe

Filesize
1.7MB

MD5
8ad512d2de25636b953eb2dcb1b7cfb0

SHA1
9b000b5ae7984ffdd3f83bf2a3722895d37490ca

SHA256
7212a17e42556237491c3c3b22eef65518dc062f55958b5c6c667cf1b5dc748a

SHA512
b751eff8b787d4abb2af2b2d22d6543c1e5a33aa51f11e913908939a615529e34559f31a0ad0d192ea2664f878c59c90ba3e75ff3693d2206e6ec1192b59be0a

Download Submit
\Windows\system\ZZAKaHF.exe

Filesize
1.7MB

MD5
d00e6b86e4c400efe2136f1b363cd5e1

SHA1
69cc6c327412d09b425ca17d94fe2d8fec4da1be

SHA256
c23c8cc83574f9ffc81ebc27433bdc3395e384a3e543291a6b9f33b06672a557

SHA512
0659aaedb34fcf9a955d6b88dc6da88a9b3341bb9fdf3a8abcc4b6fad571a85bb80892325e0c08a01048d45f8e54c88037b38d4ba59148acdfb79bbebe8319ec

Download Submit
\Windows\system\ZzWIIhm.exe

Filesize
1.7MB

MD5
e696882db3515aac58dc5b2bb2f0842d

SHA1
001c1a255621a05258cfb37115040916a80cfdc3

SHA256
ba08c7f85a057e9f2280174eb2d85971503031f7a4e0c103a3362438149f94f6

SHA512
3c7459b3f3fb41e814829f0f81ec103250c2dab576b62b1953c1c60b3e4819338cdd5d76bc46f6f5a7fa19cf07112c7a905a83e21c11db15b9339b12361045c4

Download Submit
\Windows\system\ehsvWLW.exe

Filesize
1.7MB

MD5
4073c812e8e88abc6fca8e371b9f70b1

SHA1
83e13490eddee4610f5f76627c6c2ba1d52facbb

SHA256
08f452910573c534e2a7eb3fcf48ab0170c820e2f3f21e83ae0a91814e1d2534

SHA512
f0f7729285ef82c91098b091b2e170e76973fe7fcbf8f9fd016936fa6443ab104d51e42627c3da63f6186f6a66c256de8db446c37aa1f7b761153ae2afdb1dbe

Download Submit
\Windows\system\zFouigH.exe

Filesize
1.7MB

MD5
5f586f1b3e6210834fa047649d06768d

SHA1
1feb1f5a41a7a0d8fa6b4c70116db14ef4d450ee

SHA256
232e496f18dc64a7dad8d1c4780b75ea593fd021ab4a5ba69970dbee1226c9b7

SHA512
30bc1134bb6048d04b0c3ef7bee78f1430c6ed6cc8fa270c86c558d4f5d874b01eea6807f9ba233e63e51d9e5402510130657f49b78e95a400cf5456c1b36c9e

Download Submit
memory/1028-135-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1624-193-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/1624-127-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/1624-202-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/1624-294-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/1624-130-0x0000000002AB0000-0x0000000002B30000-memory.dmp

Filesize
512KB

Download
memory/1624-126-0x000007FEF5960000-0x000007FEF62FD000-memory.dmp

Filesize
9.6MB

Download
memory/2416-154-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2492-13-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-131-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2520-156-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2616-128-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2632-150-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2708-139-0x000000013F2D0000-0x000000013F6C2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-142-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2860-158-0x000000013FD10000-0x0000000140102000-memory.dmp

Filesize
3.9MB

Download
memory/2860-155-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-141-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2860-159-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2860-157-0x0000000003550000-0x0000000003942000-memory.dmp

Filesize
3.9MB

Download
memory/2860-129-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2860-153-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download
memory/2860-0-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2860-146-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2860-7-0x0000000002F90000-0x0000000003382000-memory.dmp

Filesize
3.9MB

Download
memory/2860-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download