xmrig | edf05075511fa8aa7c2a67a050521bc879b1f4bbefd71d515a120fe76bc62eac

Analysis

max time kernel
12s
max time network
27s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
Size

2.3MB
MD5

039536860792d739ae27f15a568b9bd8
SHA1

a5cceca1d0f7fd86b69f53bc9b61f296ae187998
SHA256

edf05075511fa8aa7c2a67a050521bc879b1f4bbefd71d515a120fe76bc62eac
SHA512

454c1cd5dc0f629e8c5e792b7bddb5474db853e158778c915eef1fe0db9026a926ce2176ed70239a73fd6f5e7f03593e013a9b5a0d94219ab7a79254d761b54a
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ceP5:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/2520-133-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2376-128-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2780-125-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	xmrig
behavioral1/memory/2728-123-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	xmrig
behavioral1/memory/2752-121-0x000000013FEA0000-0x0000000140292000-memory.dmp	xmrig
behavioral1/memory/2460-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	xmrig
behavioral1/memory/2264-12-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2264	jlwUOzq.exe
2664	gyLxcoc.exe
2460	QBUASvH.exe
2752	rVAItph.exe
2728	mpZMgqI.exe
2780	dWCKmFa.exe
2376	ntDUtbm.exe
2520	GDwvGeK.exe
1596	NytdnrI.exe
2132	xBLbPIB.exe
2688	kdrbsSY.exe
2812	hjbFEOx.exe
468	ZEEfHXD.exe
2968	UkrxbmR.exe
2808	CbfFvYH.exe
2512	SELlNnt.exe
2380	xnwJxmU.exe
2632	aNvDMJI.exe
852	nXhdJkU.exe
1908	QTPmETk.exe
1244	MbByykH.exe
2852	HjabbNO.exe
1684	fiwvAuk.exe
1624	UObmYIO.exe
320	fzicrNi.exe
688	gAVDmbN.exe
1056	gVsdWCT.exe
1396	wWGKnjv.exe
1812	hPTGbbw.exe
1652	MZmkLBV.exe
2452	XnfBzAx.exe
832	kypPnPM.exe
1916	BUuXYwl.exe
408	wRQMcAz.exe
308	WsvhDqn.exe
2888	LJLkpmm.exe
2196	hAuBGxk.exe
1664	KfvPses.exe
2072	soKhEYM.exe
952	lzaMCNC.exe
1040	xWMSMjb.exe
792	fQGYMSF.exe
340	kXVfibr.exe
376	LtjzCrD.exe
744	CHIpWMS.exe
1984	sqVdJEU.exe
1564	YTeiNln.exe
1712	RVWsWgi.exe
1552	wRHClht.exe
2156	HnbvPCI.exe
936	lHPjIuL.exe
1656	aFnKeHN.exe
2136	gkYSZNb.exe
2216	mZevGrt.exe
1992	VLMBCdP.exe
1900	RJlGWwg.exe
1696	ZHmavHw.exe
1600	StKFhmI.exe
2008	VribGKx.exe
2912	hFWPtQv.exe
1532	LlLjknq.exe
1528	PQnTdLA.exe
3008	juEhncm.exe
2612	FthHrOe.exe

Loads dropped DLL 64 IoCs

pid	Process
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe

UPX packed file 41 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1732-0-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x003100000001313a-8.dat	upx
behavioral1/files/0x000700000001211e-6.dat	upx
behavioral1/files/0x0009000000013a15-30.dat	upx
behavioral1/files/0x0008000000013a65-37.dat	upx
behavioral1/files/0x00130000000054a8-26.dat	upx
behavioral1/files/0x0008000000013a85-38.dat	upx
behavioral1/memory/2664-17-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/files/0x000900000001344f-22.dat	upx
behavioral1/files/0x0006000000014525-50.dat	upx
behavioral1/files/0x00060000000145d4-60.dat	upx
behavioral1/files/0x0006000000014730-66.dat	upx
behavioral1/files/0x000600000001475f-76.dat	upx
behavioral1/files/0x0006000000014d0f-95.dat	upx
behavioral1/files/0x0006000000015077-106.dat	upx
behavioral1/files/0x00060000000148af-111.dat	upx
behavioral1/files/0x0006000000014c0b-113.dat	upx
behavioral1/files/0x000600000001474b-109.dat	upx
behavioral1/files/0x002d00000001325f-148.dat	upx
behavioral1/files/0x0006000000015bb5-168.dat	upx
behavioral1/files/0x0006000000015c9b-176.dat	upx
behavioral1/files/0x0006000000015c91-172.dat	upx
behavioral1/files/0x0006000000015b72-164.dat	upx
behavioral1/files/0x0006000000015b37-160.dat	upx
behavioral1/files/0x0006000000015a15-156.dat	upx
behavioral1/files/0x00060000000155e8-152.dat	upx
behavioral1/files/0x000600000001543a-145.dat	upx
behavioral1/files/0x0006000000014fac-136.dat	upx
behavioral1/memory/2520-133-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/memory/2376-128-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/memory/2780-125-0x000000013FBB0000-0x000000013FFA2000-memory.dmp	upx
behavioral1/memory/2728-123-0x000000013F0C0000-0x000000013F4B2000-memory.dmp	upx
behavioral1/memory/2752-121-0x000000013FEA0000-0x0000000140292000-memory.dmp	upx
behavioral1/memory/2460-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp	upx
behavioral1/files/0x00060000000150aa-115.dat	upx
behavioral1/files/0x00060000000146a7-101.dat	upx
behavioral1/files/0x000600000001523e-139.dat	upx
behavioral1/files/0x00060000000145c9-92.dat	upx
behavioral1/files/0x000800000001451d-65.dat	upx
behavioral1/files/0x0006000000014a29-83.dat	upx
behavioral1/memory/2264-12-0x000000013F370000-0x000000013F762000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\xMuCgWS.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\pJZRaZp.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\DSBdsWF.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\EqjOQiB.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\qCtyVDG.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\LJLkpmm.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\thotmuW.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\dSnpQyp.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ExujUkO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\lzlykLD.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\hdFxqsI.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\OCjGjiL.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\YTeiNln.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\FDkXjBk.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ecoIylq.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\vREHjDn.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gzfmGar.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gqhuzsA.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\WzuETrZ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\xaHLOgJ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\sTFgamv.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\JdRcTQr.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\uHSZoBo.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\APTuKcJ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\uXgCVJZ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\xBLbPIB.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\tOWSrbg.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\sxgnuwk.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\RHwjsdS.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\TDRWOye.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\lcZomWo.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\cBpndsF.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\BUuXYwl.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\FHiFDac.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\mQyZCJQ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\EsFJLAi.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gsdcIKb.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\yQDRGyj.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\rZTAVzP.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\QssXJbu.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\DqPlYkq.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\dUBYHzN.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\yblUdtT.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\bcZvHDR.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\yzjXdSA.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\XVVznDW.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\KfvPses.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\hSEQxkC.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\nycQqzQ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\KABmAGK.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\bYMJWXP.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\OYzlPAZ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\TmxSJac.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\bcSfJgL.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\gwDcgti.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\BaHjbRZ.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\rTEpqGt.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\girvXzu.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\qEjlXcO.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\tyCBFeN.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\ZmIQqrf.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\OIhUIei.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\WOihhRv.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
File created	C:\Windows\System\aNvDMJI.exe	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1732 wrote to memory of 2860	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2860	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2860	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	29
PID 1732 wrote to memory of 2264	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2264	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2264	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	30
PID 1732 wrote to memory of 2664	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	31
PID 1732 wrote to memory of 2664	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	31
PID 1732 wrote to memory of 2664	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	31
PID 1732 wrote to memory of 2460	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2460	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2460	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	32
PID 1732 wrote to memory of 2752	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	33
PID 1732 wrote to memory of 2752	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	33
PID 1732 wrote to memory of 2752	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	33
PID 1732 wrote to memory of 2728	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2728	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2728	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	34
PID 1732 wrote to memory of 2780	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2780	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2780	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	35
PID 1732 wrote to memory of 2376	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2376	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2376	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	36
PID 1732 wrote to memory of 2132	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	37
PID 1732 wrote to memory of 2132	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	37
PID 1732 wrote to memory of 2132	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	37
PID 1732 wrote to memory of 2520	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2520	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2520	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	38
PID 1732 wrote to memory of 2968	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	39
PID 1732 wrote to memory of 2968	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	39
PID 1732 wrote to memory of 2968	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	39
PID 1732 wrote to memory of 1596	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	40
PID 1732 wrote to memory of 1596	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	40
PID 1732 wrote to memory of 1596	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	40
PID 1732 wrote to memory of 2512	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	41
PID 1732 wrote to memory of 2512	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	41
PID 1732 wrote to memory of 2512	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	41
PID 1732 wrote to memory of 2688	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2688	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2688	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	42
PID 1732 wrote to memory of 2632	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	43
PID 1732 wrote to memory of 2632	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	43
PID 1732 wrote to memory of 2632	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	43
PID 1732 wrote to memory of 2812	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	44
PID 1732 wrote to memory of 2812	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	44
PID 1732 wrote to memory of 2812	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	44
PID 1732 wrote to memory of 852	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	45
PID 1732 wrote to memory of 852	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	45
PID 1732 wrote to memory of 852	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	45
PID 1732 wrote to memory of 468	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	46
PID 1732 wrote to memory of 468	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	46
PID 1732 wrote to memory of 468	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	46
PID 1732 wrote to memory of 1908	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	47
PID 1732 wrote to memory of 1908	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	47
PID 1732 wrote to memory of 1908	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	47
PID 1732 wrote to memory of 2808	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	48
PID 1732 wrote to memory of 2808	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	48
PID 1732 wrote to memory of 2808	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	48
PID 1732 wrote to memory of 1244	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	49
PID 1732 wrote to memory of 1244	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	49
PID 1732 wrote to memory of 1244	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	49
PID 1732 wrote to memory of 2380	1732	039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\039536860792d739ae27f15a568b9bd8_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\System\jlwUOzq.exe
  C:\Windows\System\jlwUOzq.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\gyLxcoc.exe
  C:\Windows\System\gyLxcoc.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\QBUASvH.exe
  C:\Windows\System\QBUASvH.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\rVAItph.exe
  C:\Windows\System\rVAItph.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\mpZMgqI.exe
  C:\Windows\System\mpZMgqI.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\dWCKmFa.exe
  C:\Windows\System\dWCKmFa.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ntDUtbm.exe
  C:\Windows\System\ntDUtbm.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\xBLbPIB.exe
  C:\Windows\System\xBLbPIB.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\GDwvGeK.exe
  C:\Windows\System\GDwvGeK.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\UkrxbmR.exe
  C:\Windows\System\UkrxbmR.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\NytdnrI.exe
  C:\Windows\System\NytdnrI.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\SELlNnt.exe
  C:\Windows\System\SELlNnt.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\kdrbsSY.exe
  C:\Windows\System\kdrbsSY.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\aNvDMJI.exe
  C:\Windows\System\aNvDMJI.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hjbFEOx.exe
  C:\Windows\System\hjbFEOx.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\nXhdJkU.exe
  C:\Windows\System\nXhdJkU.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\ZEEfHXD.exe
  C:\Windows\System\ZEEfHXD.exe
  2⤵
  - Executes dropped EXE
  PID:468
- C:\Windows\System\QTPmETk.exe
  C:\Windows\System\QTPmETk.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\CbfFvYH.exe
  C:\Windows\System\CbfFvYH.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\MbByykH.exe
  C:\Windows\System\MbByykH.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\xnwJxmU.exe
  C:\Windows\System\xnwJxmU.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\fiwvAuk.exe
  C:\Windows\System\fiwvAuk.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\HjabbNO.exe
  C:\Windows\System\HjabbNO.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\UObmYIO.exe
  C:\Windows\System\UObmYIO.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\fzicrNi.exe
  C:\Windows\System\fzicrNi.exe
  2⤵
  - Executes dropped EXE
  PID:320
- C:\Windows\System\gAVDmbN.exe
  C:\Windows\System\gAVDmbN.exe
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Windows\System\gVsdWCT.exe
  C:\Windows\System\gVsdWCT.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\wWGKnjv.exe
  C:\Windows\System\wWGKnjv.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\hPTGbbw.exe
  C:\Windows\System\hPTGbbw.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\MZmkLBV.exe
  C:\Windows\System\MZmkLBV.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\XnfBzAx.exe
  C:\Windows\System\XnfBzAx.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\kypPnPM.exe
  C:\Windows\System\kypPnPM.exe
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Windows\System\BUuXYwl.exe
  C:\Windows\System\BUuXYwl.exe
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Windows\System\wRQMcAz.exe
  C:\Windows\System\wRQMcAz.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\WsvhDqn.exe
  C:\Windows\System\WsvhDqn.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\LJLkpmm.exe
  C:\Windows\System\LJLkpmm.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\hAuBGxk.exe
  C:\Windows\System\hAuBGxk.exe
  2⤵
  - Executes dropped EXE
  PID:2196
- C:\Windows\System\KfvPses.exe
  C:\Windows\System\KfvPses.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\soKhEYM.exe
  C:\Windows\System\soKhEYM.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\lzaMCNC.exe
  C:\Windows\System\lzaMCNC.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\xWMSMjb.exe
  C:\Windows\System\xWMSMjb.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\fQGYMSF.exe
  C:\Windows\System\fQGYMSF.exe
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\System\kXVfibr.exe
  C:\Windows\System\kXVfibr.exe
  2⤵
  - Executes dropped EXE
  PID:340
- C:\Windows\System\LtjzCrD.exe
  C:\Windows\System\LtjzCrD.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\CHIpWMS.exe
  C:\Windows\System\CHIpWMS.exe
  2⤵
  - Executes dropped EXE
  PID:744
- C:\Windows\System\sqVdJEU.exe
  C:\Windows\System\sqVdJEU.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\YTeiNln.exe
  C:\Windows\System\YTeiNln.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\RVWsWgi.exe
  C:\Windows\System\RVWsWgi.exe
  2⤵
  - Executes dropped EXE
  PID:1712
- C:\Windows\System\wRHClht.exe
  C:\Windows\System\wRHClht.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\HnbvPCI.exe
  C:\Windows\System\HnbvPCI.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\lHPjIuL.exe
  C:\Windows\System\lHPjIuL.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\aFnKeHN.exe
  C:\Windows\System\aFnKeHN.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\gkYSZNb.exe
  C:\Windows\System\gkYSZNb.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\mZevGrt.exe
  C:\Windows\System\mZevGrt.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\VLMBCdP.exe
  C:\Windows\System\VLMBCdP.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\RJlGWwg.exe
  C:\Windows\System\RJlGWwg.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\ZHmavHw.exe
  C:\Windows\System\ZHmavHw.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\StKFhmI.exe
  C:\Windows\System\StKFhmI.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\VribGKx.exe
  C:\Windows\System\VribGKx.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\hFWPtQv.exe
  C:\Windows\System\hFWPtQv.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\LlLjknq.exe
  C:\Windows\System\LlLjknq.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\PQnTdLA.exe
  C:\Windows\System\PQnTdLA.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\juEhncm.exe
  C:\Windows\System\juEhncm.exe
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Windows\System\FthHrOe.exe
  C:\Windows\System\FthHrOe.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\bYMJWXP.exe
  C:\Windows\System\bYMJWXP.exe
  2⤵
  PID:2544
- C:\Windows\System\sqgRznP.exe
  C:\Windows\System\sqgRznP.exe
  2⤵
  PID:2608
- C:\Windows\System\NZRWLXg.exe
  C:\Windows\System\NZRWLXg.exe
  2⤵
  PID:2440
- C:\Windows\System\GZvyBem.exe
  C:\Windows\System\GZvyBem.exe
  2⤵
  PID:2568
- C:\Windows\System\gYmwtWQ.exe
  C:\Windows\System\gYmwtWQ.exe
  2⤵
  PID:2532
- C:\Windows\System\jlFKPgh.exe
  C:\Windows\System\jlFKPgh.exe
  2⤵
  PID:1260
- C:\Windows\System\CXlgbmI.exe
  C:\Windows\System\CXlgbmI.exe
  2⤵
  PID:1584
- C:\Windows\System\lxOXtzX.exe
  C:\Windows\System\lxOXtzX.exe
  2⤵
  PID:1784
- C:\Windows\System\YWRLjck.exe
  C:\Windows\System\YWRLjck.exe
  2⤵
  PID:836
- C:\Windows\System\oHCzpxL.exe
  C:\Windows\System\oHCzpxL.exe
  2⤵
  PID:2024
- C:\Windows\System\yRbbHYP.exe
  C:\Windows\System\yRbbHYP.exe
  2⤵
  PID:1620
- C:\Windows\System\mFKvinQ.exe
  C:\Windows\System\mFKvinQ.exe
  2⤵
  PID:884
- C:\Windows\System\NXcWzXy.exe
  C:\Windows\System\NXcWzXy.exe
  2⤵
  PID:2672
- C:\Windows\System\BKRGYJM.exe
  C:\Windows\System\BKRGYJM.exe
  2⤵
  PID:1588
- C:\Windows\System\DqPlYkq.exe
  C:\Windows\System\DqPlYkq.exe
  2⤵
  PID:1444
- C:\Windows\System\BJjkcvH.exe
  C:\Windows\System\BJjkcvH.exe
  2⤵
  PID:1556
- C:\Windows\System\QhZgRGj.exe
  C:\Windows\System\QhZgRGj.exe
  2⤵
  PID:2948
- C:\Windows\System\aewhjtG.exe
  C:\Windows\System\aewhjtG.exe
  2⤵
  PID:532
- C:\Windows\System\OHflKRU.exe
  C:\Windows\System\OHflKRU.exe
  2⤵
  PID:580
- C:\Windows\System\xXYqaZr.exe
  C:\Windows\System\xXYqaZr.exe
  2⤵
  PID:572
- C:\Windows\System\wTAkRYG.exe
  C:\Windows\System\wTAkRYG.exe
  2⤵
  PID:2444
- C:\Windows\System\ILozmbw.exe
  C:\Windows\System\ILozmbw.exe
  2⤵
  PID:1912
- C:\Windows\System\uVTTPHc.exe
  C:\Windows\System\uVTTPHc.exe
  2⤵
  PID:824
- C:\Windows\System\jFGWTij.exe
  C:\Windows\System\jFGWTij.exe
  2⤵
  PID:2348
- C:\Windows\System\dUBYHzN.exe
  C:\Windows\System\dUBYHzN.exe
  2⤵
  PID:1248
- C:\Windows\System\kzxZRPP.exe
  C:\Windows\System\kzxZRPP.exe
  2⤵
  PID:2748
- C:\Windows\System\ggcBTcx.exe
  C:\Windows\System\ggcBTcx.exe
  2⤵
  PID:284
- C:\Windows\System\NnAwurv.exe
  C:\Windows\System\NnAwurv.exe
  2⤵
  PID:752
- C:\Windows\System\fjMFbLU.exe
  C:\Windows\System\fjMFbLU.exe
  2⤵
  PID:684
- C:\Windows\System\PWHXKtK.exe
  C:\Windows\System\PWHXKtK.exe
  2⤵
  PID:3020
- C:\Windows\System\pxlIdJD.exe
  C:\Windows\System\pxlIdJD.exe
  2⤵
  PID:2220
- C:\Windows\System\rlqBiLl.exe
  C:\Windows\System\rlqBiLl.exe
  2⤵
  PID:1868
- C:\Windows\System\KJDFukj.exe
  C:\Windows\System\KJDFukj.exe
  2⤵
  PID:1924
- C:\Windows\System\thnEZnR.exe
  C:\Windows\System\thnEZnR.exe
  2⤵
  PID:2056
- C:\Windows\System\gzfmGar.exe
  C:\Windows\System\gzfmGar.exe
  2⤵
  PID:2372
- C:\Windows\System\bLoPHOu.exe
  C:\Windows\System\bLoPHOu.exe
  2⤵
  PID:1960
- C:\Windows\System\OYzlPAZ.exe
  C:\Windows\System\OYzlPAZ.exe
  2⤵
  PID:1496
- C:\Windows\System\hkHUfoR.exe
  C:\Windows\System\hkHUfoR.exe
  2⤵
  PID:1928
- C:\Windows\System\VqscNEV.exe
  C:\Windows\System\VqscNEV.exe
  2⤵
  PID:2880
- C:\Windows\System\DTffiwQ.exe
  C:\Windows\System\DTffiwQ.exe
  2⤵
  PID:3084
- C:\Windows\System\dhwklbG.exe
  C:\Windows\System\dhwklbG.exe
  2⤵
  PID:3100
- C:\Windows\System\IwZuSPo.exe
  C:\Windows\System\IwZuSPo.exe
  2⤵
  PID:3116
- C:\Windows\System\AUMeeTv.exe
  C:\Windows\System\AUMeeTv.exe
  2⤵
  PID:3132
- C:\Windows\System\KmGlGgq.exe
  C:\Windows\System\KmGlGgq.exe
  2⤵
  PID:3148
- C:\Windows\System\kYzyUpL.exe
  C:\Windows\System\kYzyUpL.exe
  2⤵
  PID:3164
- C:\Windows\System\lsaidNY.exe
  C:\Windows\System\lsaidNY.exe
  2⤵
  PID:3180
- C:\Windows\System\ihEHanm.exe
  C:\Windows\System\ihEHanm.exe
  2⤵
  PID:3196
- C:\Windows\System\PkIPOBa.exe
  C:\Windows\System\PkIPOBa.exe
  2⤵
  PID:3212
- C:\Windows\System\cIObtPD.exe
  C:\Windows\System\cIObtPD.exe
  2⤵
  PID:3228
- C:\Windows\System\PyywAAc.exe
  C:\Windows\System\PyywAAc.exe
  2⤵
  PID:3244
- C:\Windows\System\TTURKwM.exe
  C:\Windows\System\TTURKwM.exe
  2⤵
  PID:3260
- C:\Windows\System\nsvjwjW.exe
  C:\Windows\System\nsvjwjW.exe
  2⤵
  PID:3276
- C:\Windows\System\thotmuW.exe
  C:\Windows\System\thotmuW.exe
  2⤵
  PID:3292
- C:\Windows\System\gowoeLX.exe
  C:\Windows\System\gowoeLX.exe
  2⤵
  PID:3308
- C:\Windows\System\SsQsqkJ.exe
  C:\Windows\System\SsQsqkJ.exe
  2⤵
  PID:3324
- C:\Windows\System\FHiFDac.exe
  C:\Windows\System\FHiFDac.exe
  2⤵
  PID:3340
- C:\Windows\System\WVkJHbj.exe
  C:\Windows\System\WVkJHbj.exe
  2⤵
  PID:3356
- C:\Windows\System\JNWEAcv.exe
  C:\Windows\System\JNWEAcv.exe
  2⤵
  PID:3372
- C:\Windows\System\EXOfoKl.exe
  C:\Windows\System\EXOfoKl.exe
  2⤵
  PID:3388
- C:\Windows\System\kSzxwZD.exe
  C:\Windows\System\kSzxwZD.exe
  2⤵
  PID:3404
- C:\Windows\System\qZCHasq.exe
  C:\Windows\System\qZCHasq.exe
  2⤵
  PID:3420
- C:\Windows\System\UxzUAXt.exe
  C:\Windows\System\UxzUAXt.exe
  2⤵
  PID:3436
- C:\Windows\System\xSHmbke.exe
  C:\Windows\System\xSHmbke.exe
  2⤵
  PID:3452
- C:\Windows\System\gemRfmg.exe
  C:\Windows\System\gemRfmg.exe
  2⤵
  PID:3468
- C:\Windows\System\AHHUGmj.exe
  C:\Windows\System\AHHUGmj.exe
  2⤵
  PID:3484
- C:\Windows\System\fuVHuKp.exe
  C:\Windows\System\fuVHuKp.exe
  2⤵
  PID:3500
- C:\Windows\System\lHDcJvX.exe
  C:\Windows\System\lHDcJvX.exe
  2⤵
  PID:3516
- C:\Windows\System\qSJeBFs.exe
  C:\Windows\System\qSJeBFs.exe
  2⤵
  PID:3532
- C:\Windows\System\QBrIvvH.exe
  C:\Windows\System\QBrIvvH.exe
  2⤵
  PID:3548
- C:\Windows\System\OIyNnWM.exe
  C:\Windows\System\OIyNnWM.exe
  2⤵
  PID:3564
- C:\Windows\System\CuexjXF.exe
  C:\Windows\System\CuexjXF.exe
  2⤵
  PID:3580
- C:\Windows\System\tkVrpmQ.exe
  C:\Windows\System\tkVrpmQ.exe
  2⤵
  PID:3596
- C:\Windows\System\iNYswkT.exe
  C:\Windows\System\iNYswkT.exe
  2⤵
  PID:3612
- C:\Windows\System\kpwNYsE.exe
  C:\Windows\System\kpwNYsE.exe
  2⤵
  PID:3628
- C:\Windows\System\yLKmEzU.exe
  C:\Windows\System\yLKmEzU.exe
  2⤵
  PID:3644
- C:\Windows\System\PvgrJCX.exe
  C:\Windows\System\PvgrJCX.exe
  2⤵
  PID:3660
- C:\Windows\System\AWiRQFC.exe
  C:\Windows\System\AWiRQFC.exe
  2⤵
  PID:3676
- C:\Windows\System\IhxWIEU.exe
  C:\Windows\System\IhxWIEU.exe
  2⤵
  PID:3692
- C:\Windows\System\uzijrFX.exe
  C:\Windows\System\uzijrFX.exe
  2⤵
  PID:3708
- C:\Windows\System\TmxSJac.exe
  C:\Windows\System\TmxSJac.exe
  2⤵
  PID:3724
- C:\Windows\System\tOWSrbg.exe
  C:\Windows\System\tOWSrbg.exe
  2⤵
  PID:3740
- C:\Windows\System\zVtULPG.exe
  C:\Windows\System\zVtULPG.exe
  2⤵
  PID:3756
- C:\Windows\System\myGxPbP.exe
  C:\Windows\System\myGxPbP.exe
  2⤵
  PID:3772
- C:\Windows\System\yblUdtT.exe
  C:\Windows\System\yblUdtT.exe
  2⤵
  PID:3788
- C:\Windows\System\ZukqyTe.exe
  C:\Windows\System\ZukqyTe.exe
  2⤵
  PID:3804
- C:\Windows\System\DpSpAfH.exe
  C:\Windows\System\DpSpAfH.exe
  2⤵
  PID:3820
- C:\Windows\System\KemBfwj.exe
  C:\Windows\System\KemBfwj.exe
  2⤵
  PID:3836
- C:\Windows\System\oyVquYW.exe
  C:\Windows\System\oyVquYW.exe
  2⤵
  PID:3852
- C:\Windows\System\MXDCrvo.exe
  C:\Windows\System\MXDCrvo.exe
  2⤵
  PID:3868
- C:\Windows\System\eMBACKv.exe
  C:\Windows\System\eMBACKv.exe
  2⤵
  PID:3884
- C:\Windows\System\rmMsCny.exe
  C:\Windows\System\rmMsCny.exe
  2⤵
  PID:3900
- C:\Windows\System\qEclEpk.exe
  C:\Windows\System\qEclEpk.exe
  2⤵
  PID:3916
- C:\Windows\System\JWJDfYr.exe
  C:\Windows\System\JWJDfYr.exe
  2⤵
  PID:3932
- C:\Windows\System\LMSrxLf.exe
  C:\Windows\System\LMSrxLf.exe
  2⤵
  PID:3948
- C:\Windows\System\fsehaFM.exe
  C:\Windows\System\fsehaFM.exe
  2⤵
  PID:3964
- C:\Windows\System\drYGKJw.exe
  C:\Windows\System\drYGKJw.exe
  2⤵
  PID:3980
- C:\Windows\System\grPFcGO.exe
  C:\Windows\System\grPFcGO.exe
  2⤵
  PID:3996
- C:\Windows\System\GcCxrvK.exe
  C:\Windows\System\GcCxrvK.exe
  2⤵
  PID:4012
- C:\Windows\System\KJeGLzR.exe
  C:\Windows\System\KJeGLzR.exe
  2⤵
  PID:4028
- C:\Windows\System\AebgsBi.exe
  C:\Windows\System\AebgsBi.exe
  2⤵
  PID:4044
- C:\Windows\System\qaIIibt.exe
  C:\Windows\System\qaIIibt.exe
  2⤵
  PID:4060
- C:\Windows\System\VClIIty.exe
  C:\Windows\System\VClIIty.exe
  2⤵
  PID:4076
- C:\Windows\System\IRPgVir.exe
  C:\Windows\System\IRPgVir.exe
  2⤵
  PID:4092
- C:\Windows\System\lNQBIAk.exe
  C:\Windows\System\lNQBIAk.exe
  2⤵
  PID:2496
- C:\Windows\System\aQCElNk.exe
  C:\Windows\System\aQCElNk.exe
  2⤵
  PID:1120
- C:\Windows\System\TjkbKVq.exe
  C:\Windows\System\TjkbKVq.exe
  2⤵
  PID:1772
- C:\Windows\System\wHyoIIS.exe
  C:\Windows\System\wHyoIIS.exe
  2⤵
  PID:1228
- C:\Windows\System\NlGXBEV.exe
  C:\Windows\System\NlGXBEV.exe
  2⤵
  PID:2956
- C:\Windows\System\hrjDPPe.exe
  C:\Windows\System\hrjDPPe.exe
  2⤵
  PID:2800
- C:\Windows\System\XPCxhJQ.exe
  C:\Windows\System\XPCxhJQ.exe
  2⤵
  PID:2344
- C:\Windows\System\ewMObjJ.exe
  C:\Windows\System\ewMObjJ.exe
  2⤵
  PID:2140
- C:\Windows\System\dSnpQyp.exe
  C:\Windows\System\dSnpQyp.exe
  2⤵
  PID:1400
- C:\Windows\System\RoLCgrW.exe
  C:\Windows\System\RoLCgrW.exe
  2⤵
  PID:2476
- C:\Windows\System\uTNpiTD.exe
  C:\Windows\System\uTNpiTD.exe
  2⤵
  PID:1144
- C:\Windows\System\ERynFWK.exe
  C:\Windows\System\ERynFWK.exe
  2⤵
  PID:1892
- C:\Windows\System\qXGdJyw.exe
  C:\Windows\System\qXGdJyw.exe
  2⤵
  PID:1296
- C:\Windows\System\eOwLnnv.exe
  C:\Windows\System\eOwLnnv.exe
  2⤵
  PID:1572
- C:\Windows\System\TIoudPE.exe
  C:\Windows\System\TIoudPE.exe
  2⤵
  PID:940
- C:\Windows\System\NLmhVOM.exe
  C:\Windows\System\NLmhVOM.exe
  2⤵
  PID:1944
- C:\Windows\System\YXQKZJu.exe
  C:\Windows\System\YXQKZJu.exe
  2⤵
  PID:1428
- C:\Windows\System\zgZVqMX.exe
  C:\Windows\System\zgZVqMX.exe
  2⤵
  PID:1632
- C:\Windows\System\fUiaWyQ.exe
  C:\Windows\System\fUiaWyQ.exe
  2⤵
  PID:2872
- C:\Windows\System\LiOGIHH.exe
  C:\Windows\System\LiOGIHH.exe
  2⤵
  PID:3096
- C:\Windows\System\MTrIGZU.exe
  C:\Windows\System\MTrIGZU.exe
  2⤵
  PID:3140
- C:\Windows\System\FyRkVBv.exe
  C:\Windows\System\FyRkVBv.exe
  2⤵
  PID:3156
- C:\Windows\System\DzZfWzi.exe
  C:\Windows\System\DzZfWzi.exe
  2⤵
  PID:3176
- C:\Windows\System\MbdMRXl.exe
  C:\Windows\System\MbdMRXl.exe
  2⤵
  PID:3208
- C:\Windows\System\CpDGnaw.exe
  C:\Windows\System\CpDGnaw.exe
  2⤵
  PID:3240
- C:\Windows\System\ObPAJPc.exe
  C:\Windows\System\ObPAJPc.exe
  2⤵
  PID:3272
- C:\Windows\System\GcGiLic.exe
  C:\Windows\System\GcGiLic.exe
  2⤵
  PID:3304
- C:\Windows\System\UYMCoQg.exe
  C:\Windows\System\UYMCoQg.exe
  2⤵
  PID:3336
- C:\Windows\System\sPVAbfa.exe
  C:\Windows\System\sPVAbfa.exe
  2⤵
  PID:3368
- C:\Windows\System\sxgnuwk.exe
  C:\Windows\System\sxgnuwk.exe
  2⤵
  PID:3400
- C:\Windows\System\PtdJeuD.exe
  C:\Windows\System\PtdJeuD.exe
  2⤵
  PID:3432
- C:\Windows\System\nBcUHOn.exe
  C:\Windows\System\nBcUHOn.exe
  2⤵
  PID:3464
- C:\Windows\System\jBlnhOT.exe
  C:\Windows\System\jBlnhOT.exe
  2⤵
  PID:3496
- C:\Windows\System\ydBfTgV.exe
  C:\Windows\System\ydBfTgV.exe
  2⤵
  PID:3512
- C:\Windows\System\odDylJy.exe
  C:\Windows\System\odDylJy.exe
  2⤵
  PID:3544
- C:\Windows\System\GktkzKg.exe
  C:\Windows\System\GktkzKg.exe
  2⤵
  PID:3576
- C:\Windows\System\FiAdYfS.exe
  C:\Windows\System\FiAdYfS.exe
  2⤵
  PID:3620
- C:\Windows\System\jdHXVvI.exe
  C:\Windows\System\jdHXVvI.exe
  2⤵
  PID:3640
- C:\Windows\System\FDkXjBk.exe
  C:\Windows\System\FDkXjBk.exe
  2⤵
  PID:3684
- C:\Windows\System\nATqGll.exe
  C:\Windows\System\nATqGll.exe
  2⤵
  PID:3704
- C:\Windows\System\AlIoLug.exe
  C:\Windows\System\AlIoLug.exe
  2⤵
  PID:3748
- C:\Windows\System\uUACozF.exe
  C:\Windows\System\uUACozF.exe
  2⤵
  PID:3768
- C:\Windows\System\HVeSHrs.exe
  C:\Windows\System\HVeSHrs.exe
  2⤵
  PID:3800
- C:\Windows\System\BQeJQdN.exe
  C:\Windows\System\BQeJQdN.exe
  2⤵
  PID:3832
- C:\Windows\System\xhhznjf.exe
  C:\Windows\System\xhhznjf.exe
  2⤵
  PID:3864
- C:\Windows\System\NUwgpqI.exe
  C:\Windows\System\NUwgpqI.exe
  2⤵
  PID:3896
- C:\Windows\System\vTXEByi.exe
  C:\Windows\System\vTXEByi.exe
  2⤵
  PID:3928
- C:\Windows\System\TpPcVPF.exe
  C:\Windows\System\TpPcVPF.exe
  2⤵
  PID:3960
- C:\Windows\System\gqhuzsA.exe
  C:\Windows\System\gqhuzsA.exe
  2⤵
  PID:3992
- C:\Windows\System\sNPOxWr.exe
  C:\Windows\System\sNPOxWr.exe
  2⤵
  PID:4024
- C:\Windows\System\UUBKYfp.exe
  C:\Windows\System\UUBKYfp.exe
  2⤵
  PID:4056
- C:\Windows\System\BafzGmh.exe
  C:\Windows\System\BafzGmh.exe
  2⤵
  PID:2308
- C:\Windows\System\lNPjSek.exe
  C:\Windows\System\lNPjSek.exe
  2⤵
  PID:2528
- C:\Windows\System\pTiJBNL.exe
  C:\Windows\System\pTiJBNL.exe
  2⤵
  PID:1148
- C:\Windows\System\YObNKYs.exe
  C:\Windows\System\YObNKYs.exe
  2⤵
  PID:2804
- C:\Windows\System\DDcoifJ.exe
  C:\Windows\System\DDcoifJ.exe
  2⤵
  PID:948
- C:\Windows\System\bcZvHDR.exe
  C:\Windows\System\bcZvHDR.exe
  2⤵
  PID:984
- C:\Windows\System\mFxeQeB.exe
  C:\Windows\System\mFxeQeB.exe
  2⤵
  PID:2324
- C:\Windows\System\GaxRyrw.exe
  C:\Windows\System\GaxRyrw.exe
  2⤵
  PID:860
- C:\Windows\System\DZqxZcx.exe
  C:\Windows\System\DZqxZcx.exe
  2⤵
  PID:1816
- C:\Windows\System\CBobsqC.exe
  C:\Windows\System\CBobsqC.exe
  2⤵
  PID:1520
- C:\Windows\System\hfSXpGD.exe
  C:\Windows\System\hfSXpGD.exe
  2⤵
  PID:3112
- C:\Windows\System\mUFRFMP.exe
  C:\Windows\System\mUFRFMP.exe
  2⤵
  PID:3160
- C:\Windows\System\opNWATR.exe
  C:\Windows\System\opNWATR.exe
  2⤵
  PID:3192
- C:\Windows\System\lSmebJm.exe
  C:\Windows\System\lSmebJm.exe
  2⤵
  PID:3268
- C:\Windows\System\xMuCgWS.exe
  C:\Windows\System\xMuCgWS.exe
  2⤵
  PID:3332
- C:\Windows\System\SRXYXYJ.exe
  C:\Windows\System\SRXYXYJ.exe
  2⤵
  PID:4112
- C:\Windows\System\fVxGnxT.exe
  C:\Windows\System\fVxGnxT.exe
  2⤵
  PID:4128
- C:\Windows\System\WzuETrZ.exe
  C:\Windows\System\WzuETrZ.exe
  2⤵
  PID:4144
- C:\Windows\System\isKDDBU.exe
  C:\Windows\System\isKDDBU.exe
  2⤵
  PID:4160
- C:\Windows\System\WWAdfMc.exe
  C:\Windows\System\WWAdfMc.exe
  2⤵
  PID:4176
- C:\Windows\System\zfSiHKB.exe
  C:\Windows\System\zfSiHKB.exe
  2⤵
  PID:4192
- C:\Windows\System\liZbOJp.exe
  C:\Windows\System\liZbOJp.exe
  2⤵
  PID:4208
- C:\Windows\System\DcjTvzZ.exe
  C:\Windows\System\DcjTvzZ.exe
  2⤵
  PID:4224
- C:\Windows\System\rTEpqGt.exe
  C:\Windows\System\rTEpqGt.exe
  2⤵
  PID:4240
- C:\Windows\System\JqngZEb.exe
  C:\Windows\System\JqngZEb.exe
  2⤵
  PID:4256
- C:\Windows\System\NSWJJMD.exe
  C:\Windows\System\NSWJJMD.exe
  2⤵
  PID:4272
- C:\Windows\System\KAodatT.exe
  C:\Windows\System\KAodatT.exe
  2⤵
  PID:4288
- C:\Windows\System\PZtHcRt.exe
  C:\Windows\System\PZtHcRt.exe
  2⤵
  PID:4304
- C:\Windows\System\ZFafHbv.exe
  C:\Windows\System\ZFafHbv.exe
  2⤵
  PID:4320
- C:\Windows\System\GbJQAVD.exe
  C:\Windows\System\GbJQAVD.exe
  2⤵
  PID:4336
- C:\Windows\System\RHwjsdS.exe
  C:\Windows\System\RHwjsdS.exe
  2⤵
  PID:4352
- C:\Windows\System\hVObAVn.exe
  C:\Windows\System\hVObAVn.exe
  2⤵
  PID:4368
- C:\Windows\System\AURMYIb.exe
  C:\Windows\System\AURMYIb.exe
  2⤵
  PID:4384
- C:\Windows\System\dNoVXXc.exe
  C:\Windows\System\dNoVXXc.exe
  2⤵
  PID:4400
- C:\Windows\System\XbdgmyT.exe
  C:\Windows\System\XbdgmyT.exe
  2⤵
  PID:4416
- C:\Windows\System\HVBADBX.exe
  C:\Windows\System\HVBADBX.exe
  2⤵
  PID:4432
- C:\Windows\System\sdNjHFp.exe
  C:\Windows\System\sdNjHFp.exe
  2⤵
  PID:4448
- C:\Windows\System\UXJKleO.exe
  C:\Windows\System\UXJKleO.exe
  2⤵
  PID:4464
- C:\Windows\System\pkqegnd.exe
  C:\Windows\System\pkqegnd.exe
  2⤵
  PID:4480
- C:\Windows\System\TJvkEbG.exe
  C:\Windows\System\TJvkEbG.exe
  2⤵
  PID:4496
- C:\Windows\System\WImLQiz.exe
  C:\Windows\System\WImLQiz.exe
  2⤵
  PID:4512
- C:\Windows\System\WNHfFzA.exe
  C:\Windows\System\WNHfFzA.exe
  2⤵
  PID:4528
- C:\Windows\System\qTFSCeC.exe
  C:\Windows\System\qTFSCeC.exe
  2⤵
  PID:4544
- C:\Windows\System\ExujUkO.exe
  C:\Windows\System\ExujUkO.exe
  2⤵
  PID:4560
- C:\Windows\System\pJZRaZp.exe
  C:\Windows\System\pJZRaZp.exe
  2⤵
  PID:4576
- C:\Windows\System\VWEmHzE.exe
  C:\Windows\System\VWEmHzE.exe
  2⤵
  PID:4592
- C:\Windows\System\vxhoOyo.exe
  C:\Windows\System\vxhoOyo.exe
  2⤵
  PID:4608
- C:\Windows\System\aEWOuOP.exe
  C:\Windows\System\aEWOuOP.exe
  2⤵
  PID:4624
- C:\Windows\System\IzABexm.exe
  C:\Windows\System\IzABexm.exe
  2⤵
  PID:4640
- C:\Windows\System\NhycqUJ.exe
  C:\Windows\System\NhycqUJ.exe
  2⤵
  PID:4656
- C:\Windows\System\ZCAFolt.exe
  C:\Windows\System\ZCAFolt.exe
  2⤵
  PID:4672
- C:\Windows\System\PrRKNNo.exe
  C:\Windows\System\PrRKNNo.exe
  2⤵
  PID:4688
- C:\Windows\System\sifjbbW.exe
  C:\Windows\System\sifjbbW.exe
  2⤵
  PID:4704
- C:\Windows\System\oeapmjJ.exe
  C:\Windows\System\oeapmjJ.exe
  2⤵
  PID:4720
- C:\Windows\System\JbYgsGZ.exe
  C:\Windows\System\JbYgsGZ.exe
  2⤵
  PID:4736
- C:\Windows\System\PxXQxOg.exe
  C:\Windows\System\PxXQxOg.exe
  2⤵
  PID:4752
- C:\Windows\System\HIGUrsF.exe
  C:\Windows\System\HIGUrsF.exe
  2⤵
  PID:4768
- C:\Windows\System\ZLGflMn.exe
  C:\Windows\System\ZLGflMn.exe
  2⤵
  PID:4784
- C:\Windows\System\VQgSQmc.exe
  C:\Windows\System\VQgSQmc.exe
  2⤵
  PID:4800
- C:\Windows\System\gKahpTh.exe
  C:\Windows\System\gKahpTh.exe
  2⤵
  PID:4820
- C:\Windows\System\mQyZCJQ.exe
  C:\Windows\System\mQyZCJQ.exe
  2⤵
  PID:4836
- C:\Windows\System\MpIZhEr.exe
  C:\Windows\System\MpIZhEr.exe
  2⤵
  PID:4852
- C:\Windows\System\hhtKPof.exe
  C:\Windows\System\hhtKPof.exe
  2⤵
  PID:4868
- C:\Windows\System\lfJPOMt.exe
  C:\Windows\System\lfJPOMt.exe
  2⤵
  PID:4884
- C:\Windows\System\mdrqqOb.exe
  C:\Windows\System\mdrqqOb.exe
  2⤵
  PID:4900
- C:\Windows\System\JETLqaA.exe
  C:\Windows\System\JETLqaA.exe
  2⤵
  PID:4916
- C:\Windows\System\ZmQvEHW.exe
  C:\Windows\System\ZmQvEHW.exe
  2⤵
  PID:4932
- C:\Windows\System\StCdLLt.exe
  C:\Windows\System\StCdLLt.exe
  2⤵
  PID:4948
- C:\Windows\System\wfpZZYf.exe
  C:\Windows\System\wfpZZYf.exe
  2⤵
  PID:4964
- C:\Windows\System\YXbzRiU.exe
  C:\Windows\System\YXbzRiU.exe
  2⤵
  PID:4980
- C:\Windows\System\eEYJsNc.exe
  C:\Windows\System\eEYJsNc.exe
  2⤵
  PID:4996
- C:\Windows\System\tisVqod.exe
  C:\Windows\System\tisVqod.exe
  2⤵
  PID:5012
- C:\Windows\System\rIBBHuH.exe
  C:\Windows\System\rIBBHuH.exe
  2⤵
  PID:5028
- C:\Windows\System\laXLPGi.exe
  C:\Windows\System\laXLPGi.exe
  2⤵
  PID:5044
- C:\Windows\System\nXPOWLz.exe
  C:\Windows\System\nXPOWLz.exe
  2⤵
  PID:5060
- C:\Windows\System\IzzrVaF.exe
  C:\Windows\System\IzzrVaF.exe
  2⤵
  PID:5076
- C:\Windows\System\YxQxPjf.exe
  C:\Windows\System\YxQxPjf.exe
  2⤵
  PID:5092
- C:\Windows\System\glXHzKy.exe
  C:\Windows\System\glXHzKy.exe
  2⤵
  PID:5108
- C:\Windows\System\IdVZqJx.exe
  C:\Windows\System\IdVZqJx.exe
  2⤵
  PID:3396
- C:\Windows\System\chKNRnb.exe
  C:\Windows\System\chKNRnb.exe
  2⤵
  PID:3460
- C:\Windows\System\lyoXcbp.exe
  C:\Windows\System\lyoXcbp.exe
  2⤵
  PID:3524
- C:\Windows\System\kHPiohU.exe
  C:\Windows\System\kHPiohU.exe
  2⤵
  PID:3572
- C:\Windows\System\pVeHokb.exe
  C:\Windows\System\pVeHokb.exe
  2⤵
  PID:3652
- C:\Windows\System\TCgTQRY.exe
  C:\Windows\System\TCgTQRY.exe
  2⤵
  PID:3700
- C:\Windows\System\NkGgGwc.exe
  C:\Windows\System\NkGgGwc.exe
  2⤵
  PID:3796
- C:\Windows\System\BhIcmYE.exe
  C:\Windows\System\BhIcmYE.exe
  2⤵
  PID:3828
- C:\Windows\System\aRwNIdT.exe
  C:\Windows\System\aRwNIdT.exe
  2⤵
  PID:3892
- C:\Windows\System\gCvAKPU.exe
  C:\Windows\System\gCvAKPU.exe
  2⤵
  PID:3956
- C:\Windows\System\QCtViPC.exe
  C:\Windows\System\QCtViPC.exe
  2⤵
  PID:4020
- C:\Windows\System\NDBmQkR.exe
  C:\Windows\System\NDBmQkR.exe
  2⤵
  PID:4084
- C:\Windows\System\NKIaWnQ.exe
  C:\Windows\System\NKIaWnQ.exe
  2⤵
  PID:1416
- C:\Windows\System\xSdRVdf.exe
  C:\Windows\System\xSdRVdf.exe
  2⤵
  PID:2420
- C:\Windows\System\eRQroWC.exe
  C:\Windows\System\eRQroWC.exe
  2⤵
  PID:1484
- C:\Windows\System\LdalBpe.exe
  C:\Windows\System\LdalBpe.exe
  2⤵
  PID:1932
- C:\Windows\System\ZjpbBAq.exe
  C:\Windows\System\ZjpbBAq.exe
  2⤵
  PID:3092
- C:\Windows\System\ZRGhHcw.exe
  C:\Windows\System\ZRGhHcw.exe
  2⤵
  PID:2668
- C:\Windows\System\pExLhqx.exe
  C:\Windows\System\pExLhqx.exe
  2⤵
  PID:4104
- C:\Windows\System\rAYzfkR.exe
  C:\Windows\System\rAYzfkR.exe
  2⤵
  PID:4120
- C:\Windows\System\lyAkXEh.exe
  C:\Windows\System\lyAkXEh.exe
  2⤵
  PID:4168
- C:\Windows\System\zcfrHGk.exe
  C:\Windows\System\zcfrHGk.exe
  2⤵
  PID:4184
- C:\Windows\System\uHSZoBo.exe
  C:\Windows\System\uHSZoBo.exe
  2⤵
  PID:4216
- C:\Windows\System\wkfWgvi.exe
  C:\Windows\System\wkfWgvi.exe
  2⤵
  PID:4248
- C:\Windows\System\utLuhux.exe
  C:\Windows\System\utLuhux.exe
  2⤵
  PID:2576
- C:\Windows\System\EsFJLAi.exe
  C:\Windows\System\EsFJLAi.exe
  2⤵
  PID:4284
- C:\Windows\System\QKsQypR.exe
  C:\Windows\System\QKsQypR.exe
  2⤵
  PID:4332
- C:\Windows\System\aPkIWGP.exe
  C:\Windows\System\aPkIWGP.exe
  2⤵
  PID:4364
- C:\Windows\System\gkHUwIz.exe
  C:\Windows\System\gkHUwIz.exe
  2⤵
  PID:4424
- C:\Windows\System\TDRWOye.exe
  C:\Windows\System\TDRWOye.exe
  2⤵
  PID:4412
- C:\Windows\System\pCvnQhf.exe
  C:\Windows\System\pCvnQhf.exe
  2⤵
  PID:4488
- C:\Windows\System\KkHZdJv.exe
  C:\Windows\System\KkHZdJv.exe
  2⤵
  PID:4476
- C:\Windows\System\ESqmIuq.exe
  C:\Windows\System\ESqmIuq.exe
  2⤵
  PID:4524
- C:\Windows\System\PxZXFbm.exe
  C:\Windows\System\PxZXFbm.exe
  2⤵
  PID:4540
- C:\Windows\System\WJjzvGS.exe
  C:\Windows\System\WJjzvGS.exe
  2⤵
  PID:1756
- C:\Windows\System\FxvprOd.exe
  C:\Windows\System\FxvprOd.exe
  2⤵
  PID:4604
- C:\Windows\System\ypGXsNr.exe
  C:\Windows\System\ypGXsNr.exe
  2⤵
  PID:4652
- C:\Windows\System\iXArKvQ.exe
  C:\Windows\System\iXArKvQ.exe
  2⤵
  PID:4716
- C:\Windows\System\XIsqvoc.exe
  C:\Windows\System\XIsqvoc.exe
  2⤵
  PID:4748
- C:\Windows\System\XmdOmIx.exe
  C:\Windows\System\XmdOmIx.exe
  2⤵
  PID:4780
- C:\Windows\System\girvXzu.exe
  C:\Windows\System\girvXzu.exe
  2⤵
  PID:1356
- C:\Windows\System\lzlykLD.exe
  C:\Windows\System\lzlykLD.exe
  2⤵
  PID:4880
- C:\Windows\System\YLBrmnr.exe
  C:\Windows\System\YLBrmnr.exe
  2⤵
  PID:4944
- C:\Windows\System\uBeKlYb.exe
  C:\Windows\System\uBeKlYb.exe
  2⤵
  PID:5008
- C:\Windows\System\bSczZHz.exe
  C:\Windows\System\bSczZHz.exe
  2⤵
  PID:5072
- C:\Windows\System\eeTwQLZ.exe
  C:\Windows\System\eeTwQLZ.exe
  2⤵
  PID:3416
- C:\Windows\System\RcEgfpT.exe
  C:\Windows\System\RcEgfpT.exe
  2⤵
  PID:3672
- C:\Windows\System\TeMEQAd.exe
  C:\Windows\System\TeMEQAd.exe
  2⤵
  PID:3940
- C:\Windows\System\bRJBggb.exe
  C:\Windows\System\bRJBggb.exe
  2⤵
  PID:4732
- C:\Windows\System\lcZomWo.exe
  C:\Windows\System\lcZomWo.exe
  2⤵
  PID:4792
- C:\Windows\System\SSUERGe.exe
  C:\Windows\System\SSUERGe.exe
  2⤵
  PID:4796
- C:\Windows\System\OfuwCBx.exe
  C:\Windows\System\OfuwCBx.exe
  2⤵
  PID:5088
- C:\Windows\System\TBeRkeH.exe
  C:\Windows\System\TBeRkeH.exe
  2⤵
  PID:3352
- C:\Windows\System\GosGbly.exe
  C:\Windows\System\GosGbly.exe
  2⤵
  PID:3480
- C:\Windows\System\WMYDfkx.exe
  C:\Windows\System\WMYDfkx.exe
  2⤵
  PID:4928
- C:\Windows\System\kNdfdpF.exe
  C:\Windows\System\kNdfdpF.exe
  2⤵
  PID:4956
- C:\Windows\System\fnqqnHC.exe
  C:\Windows\System\fnqqnHC.exe
  2⤵
  PID:3000
- C:\Windows\System\gQQkjyU.exe
  C:\Windows\System\gQQkjyU.exe
  2⤵
  PID:3300
- C:\Windows\System\uyhzHtb.exe
  C:\Windows\System\uyhzHtb.exe
  2⤵
  PID:4204
- C:\Windows\System\hSEQxkC.exe
  C:\Windows\System\hSEQxkC.exe
  2⤵
  PID:4316
- C:\Windows\System\FFoIkrV.exe
  C:\Windows\System\FFoIkrV.exe
  2⤵
  PID:4440
- C:\Windows\System\cPYHwnq.exe
  C:\Windows\System\cPYHwnq.exe
  2⤵
  PID:3972
- C:\Windows\System\myqOglN.exe
  C:\Windows\System\myqOglN.exe
  2⤵
  PID:2772
- C:\Windows\System\vzNcNLg.exe
  C:\Windows\System\vzNcNLg.exe
  2⤵
  PID:396
- C:\Windows\System\AydeUrk.exe
  C:\Windows\System\AydeUrk.exe
  2⤵
  PID:2428
- C:\Windows\System\gwVRIfD.exe
  C:\Windows\System\gwVRIfD.exe
  2⤵
  PID:4892
- C:\Windows\System\SljkZRq.exe
  C:\Windows\System\SljkZRq.exe
  2⤵
  PID:5156
- C:\Windows\System\UfCFFcg.exe
  C:\Windows\System\UfCFFcg.exe
  2⤵
  PID:5192
- C:\Windows\System\cIhmCch.exe
  C:\Windows\System\cIhmCch.exe
  2⤵
  PID:5264
- C:\Windows\System\NrhTpAg.exe
  C:\Windows\System\NrhTpAg.exe
  2⤵
  PID:5312
- C:\Windows\System\FEEoEUQ.exe
  C:\Windows\System\FEEoEUQ.exe
  2⤵
  PID:5376
- C:\Windows\System\nSfxqPR.exe
  C:\Windows\System\nSfxqPR.exe
  2⤵
  PID:5392
- C:\Windows\System\HPcNRBK.exe
  C:\Windows\System\HPcNRBK.exe
  2⤵
  PID:5424
- C:\Windows\System\gfTQsTl.exe
  C:\Windows\System\gfTQsTl.exe
  2⤵
  PID:5444
- C:\Windows\System\noriIzT.exe
  C:\Windows\System\noriIzT.exe
  2⤵
  PID:5460
- C:\Windows\System\PnGKGcD.exe
  C:\Windows\System\PnGKGcD.exe
  2⤵
  PID:5476
- C:\Windows\System\fKxAXSs.exe
  C:\Windows\System\fKxAXSs.exe
  2⤵
  PID:5492
- C:\Windows\System\TILsWtU.exe
  C:\Windows\System\TILsWtU.exe
  2⤵
  PID:5508
- C:\Windows\System\slNUMEl.exe
  C:\Windows\System\slNUMEl.exe
  2⤵
  PID:5524
- C:\Windows\System\zeUBiei.exe
  C:\Windows\System\zeUBiei.exe
  2⤵
  PID:5540
- C:\Windows\System\ecoIylq.exe
  C:\Windows\System\ecoIylq.exe
  2⤵
  PID:5556
- C:\Windows\System\FHKqwgk.exe
  C:\Windows\System\FHKqwgk.exe
  2⤵
  PID:5572
- C:\Windows\System\dLutshi.exe
  C:\Windows\System\dLutshi.exe
  2⤵
  PID:5588
- C:\Windows\System\nnWPXAV.exe
  C:\Windows\System\nnWPXAV.exe
  2⤵
  PID:5604
- C:\Windows\System\prIHCTR.exe
  C:\Windows\System\prIHCTR.exe
  2⤵
  PID:5620
- C:\Windows\System\FEonSJO.exe
  C:\Windows\System\FEonSJO.exe
  2⤵
  PID:5644
- C:\Windows\System\kGWzDUU.exe
  C:\Windows\System\kGWzDUU.exe
  2⤵
  PID:5708
- C:\Windows\System\TDdGkVV.exe
  C:\Windows\System\TDdGkVV.exe
  2⤵
  PID:5728
- C:\Windows\System\bDWwNTe.exe
  C:\Windows\System\bDWwNTe.exe
  2⤵
  PID:5744
- C:\Windows\System\QiWabao.exe
  C:\Windows\System\QiWabao.exe
  2⤵
  PID:5760
- C:\Windows\System\MfupUUU.exe
  C:\Windows\System\MfupUUU.exe
  2⤵
  PID:5776
- C:\Windows\System\jOWPesh.exe
  C:\Windows\System\jOWPesh.exe
  2⤵
  PID:5792
- C:\Windows\System\lcEGWUO.exe
  C:\Windows\System\lcEGWUO.exe
  2⤵
  PID:5808
- C:\Windows\System\HtjHeCt.exe
  C:\Windows\System\HtjHeCt.exe
  2⤵
  PID:5824
- C:\Windows\System\xDwnxtZ.exe
  C:\Windows\System\xDwnxtZ.exe
  2⤵
  PID:5840
- C:\Windows\System\yxbYhjB.exe
  C:\Windows\System\yxbYhjB.exe
  2⤵
  PID:5856
- C:\Windows\System\nkmmxCl.exe
  C:\Windows\System\nkmmxCl.exe
  2⤵
  PID:5872
- C:\Windows\System\YhkzZRf.exe
  C:\Windows\System\YhkzZRf.exe
  2⤵
  PID:5888
- C:\Windows\System\eJqjRCs.exe
  C:\Windows\System\eJqjRCs.exe
  2⤵
  PID:5904
- C:\Windows\System\PhFbbbh.exe
  C:\Windows\System\PhFbbbh.exe
  2⤵
  PID:5920
- C:\Windows\System\msQUgFw.exe
  C:\Windows\System\msQUgFw.exe
  2⤵
  PID:5940
- C:\Windows\System\WwpCqoV.exe
  C:\Windows\System\WwpCqoV.exe
  2⤵
  PID:5956
- C:\Windows\System\rzvOHQC.exe
  C:\Windows\System\rzvOHQC.exe
  2⤵
  PID:5976
- C:\Windows\System\lFUjzmX.exe
  C:\Windows\System\lFUjzmX.exe
  2⤵
  PID:5992
- C:\Windows\System\VOjoNPb.exe
  C:\Windows\System\VOjoNPb.exe
  2⤵
  PID:6008
- C:\Windows\System\bcSfJgL.exe
  C:\Windows\System\bcSfJgL.exe
  2⤵
  PID:6024
- C:\Windows\System\pRpKTbv.exe
  C:\Windows\System\pRpKTbv.exe
  2⤵
  PID:6040
- C:\Windows\System\YZYSFPs.exe
  C:\Windows\System\YZYSFPs.exe
  2⤵
  PID:6056
- C:\Windows\System\JgJkasj.exe
  C:\Windows\System\JgJkasj.exe
  2⤵
  PID:6072
- C:\Windows\System\ZGOlLyx.exe
  C:\Windows\System\ZGOlLyx.exe
  2⤵
  PID:6096
- C:\Windows\System\eQHszha.exe
  C:\Windows\System\eQHszha.exe
  2⤵
  PID:6112
- C:\Windows\System\lGvesJB.exe
  C:\Windows\System\lGvesJB.exe
  2⤵
  PID:6128
- C:\Windows\System\WeDtjPO.exe
  C:\Windows\System\WeDtjPO.exe
  2⤵
  PID:4520
- C:\Windows\System\ZUNdXQs.exe
  C:\Windows\System\ZUNdXQs.exe
  2⤵
  PID:4568
- C:\Windows\System\KKICgnQ.exe
  C:\Windows\System\KKICgnQ.exe
  2⤵
  PID:4584
- C:\Windows\System\oujzlJW.exe
  C:\Windows\System\oujzlJW.exe
  2⤵
  PID:1780
- C:\Windows\System\tJPqJBu.exe
  C:\Windows\System\tJPqJBu.exe
  2⤵
  PID:2640
- C:\Windows\System\yQDRGyj.exe
  C:\Windows\System\yQDRGyj.exe
  2⤵
  PID:2500
- C:\Windows\System\hZZiMmi.exe
  C:\Windows\System\hZZiMmi.exe
  2⤵
  PID:3780
- C:\Windows\System\HJvPRtZ.exe
  C:\Windows\System\HJvPRtZ.exe
  2⤵
  PID:5052
- C:\Windows\System\ZsPAZsC.exe
  C:\Windows\System\ZsPAZsC.exe
  2⤵
  PID:5164
- C:\Windows\System\xaHLOgJ.exe
  C:\Windows\System\xaHLOgJ.exe
  2⤵
  PID:2644
- C:\Windows\System\YapqQIK.exe
  C:\Windows\System\YapqQIK.exe
  2⤵
  PID:5188
- C:\Windows\System\eYgUjpj.exe
  C:\Windows\System\eYgUjpj.exe
  2⤵
  PID:5284
- C:\Windows\System\hCWmjhx.exe
  C:\Windows\System\hCWmjhx.exe
  2⤵
  PID:5300
- C:\Windows\System\ILGdmGs.exe
  C:\Windows\System\ILGdmGs.exe
  2⤵
  PID:2208
- C:\Windows\System\dYGFtqf.exe
  C:\Windows\System\dYGFtqf.exe
  2⤵
  PID:4376
- C:\Windows\System\wkeULyx.exe
  C:\Windows\System\wkeULyx.exe
  2⤵
  PID:1880
- C:\Windows\System\SEAJVzy.exe
  C:\Windows\System\SEAJVzy.exe
  2⤵
  PID:2964
- C:\Windows\System\IpkENXl.exe
  C:\Windows\System\IpkENXl.exe
  2⤵
  PID:5384
- C:\Windows\System\ivvNbtl.exe
  C:\Windows\System\ivvNbtl.exe
  2⤵
  PID:5468
- C:\Windows\System\IUDzpXT.exe
  C:\Windows\System\IUDzpXT.exe
  2⤵
  PID:5532
- C:\Windows\System\hdFxqsI.exe
  C:\Windows\System\hdFxqsI.exe
  2⤵
  PID:2508
- C:\Windows\System\bcOUpXp.exe
  C:\Windows\System\bcOUpXp.exe
  2⤵
  PID:5600
- C:\Windows\System\halNNnU.exe
  C:\Windows\System\halNNnU.exe
  2⤵
  PID:4844
- C:\Windows\System\BnONErL.exe
  C:\Windows\System\BnONErL.exe
  2⤵
  PID:5068
- C:\Windows\System\cBpndsF.exe
  C:\Windows\System\cBpndsF.exe
  2⤵
  PID:4728
- C:\Windows\System\EHanHFx.exe
  C:\Windows\System\EHanHFx.exe
  2⤵
  PID:4860
- C:\Windows\System\hhhjDkq.exe
  C:\Windows\System\hhhjDkq.exe
  2⤵
  PID:4140
- C:\Windows\System\hVdybti.exe
  C:\Windows\System\hVdybti.exe
  2⤵
  PID:3016
- C:\Windows\System\YgRcWGJ.exe
  C:\Windows\System\YgRcWGJ.exe
  2⤵
  PID:3204
- C:\Windows\System\vLfFeHq.exe
  C:\Windows\System\vLfFeHq.exe
  2⤵
  PID:4172
- C:\Windows\System\fefDnIc.exe
  C:\Windows\System\fefDnIc.exe
  2⤵
  PID:4300
- C:\Windows\System\nVmKtzV.exe
  C:\Windows\System\nVmKtzV.exe
  2⤵
  PID:4408
- C:\Windows\System\PBJDVtV.exe
  C:\Windows\System\PBJDVtV.exe
  2⤵
  PID:4552
- C:\Windows\System\IkGaZlh.exe
  C:\Windows\System\IkGaZlh.exe
  2⤵
  PID:4680
- C:\Windows\System\UECyQQs.exe
  C:\Windows\System\UECyQQs.exe
  2⤵
  PID:3732
- C:\Windows\System\Hzyxhmy.exe
  C:\Windows\System\Hzyxhmy.exe
  2⤵
  PID:4252
- C:\Windows\System\cXASlzL.exe
  C:\Windows\System\cXASlzL.exe
  2⤵
  PID:4268
- C:\Windows\System\wQekJnT.exe
  C:\Windows\System\wQekJnT.exe
  2⤵
  PID:5132
- C:\Windows\System\sdcYKOM.exe
  C:\Windows\System\sdcYKOM.exe
  2⤵
  PID:5148
- C:\Windows\System\uhHuxvZ.exe
  C:\Windows\System\uhHuxvZ.exe
  2⤵
  PID:5208
- C:\Windows\System\eVjTdmw.exe
  C:\Windows\System\eVjTdmw.exe
  2⤵
  PID:5220
- C:\Windows\System\DjIfQwE.exe
  C:\Windows\System\DjIfQwE.exe
  2⤵
  PID:1708
- C:\Windows\System\AnMVEze.exe
  C:\Windows\System\AnMVEze.exe
  2⤵
  PID:5252
- C:\Windows\System\tuaDpYs.exe
  C:\Windows\System\tuaDpYs.exe
  2⤵
  PID:5720
- C:\Windows\System\ZSiwOXU.exe
  C:\Windows\System\ZSiwOXU.exe
  2⤵
  PID:5324
- C:\Windows\System\APTuKcJ.exe
  C:\Windows\System\APTuKcJ.exe
  2⤵
  PID:5340
- C:\Windows\System\rZTAVzP.exe
  C:\Windows\System\rZTAVzP.exe
  2⤵
  PID:5360
- C:\Windows\System\dpjGKBc.exe
  C:\Windows\System\dpjGKBc.exe
  2⤵
  PID:5404
- C:\Windows\System\jqnvmYk.exe
  C:\Windows\System\jqnvmYk.exe
  2⤵
  PID:5420
- C:\Windows\System\zQIGlwa.exe
  C:\Windows\System\zQIGlwa.exe
  2⤵
  PID:5488
- C:\Windows\System\modEEIM.exe
  C:\Windows\System\modEEIM.exe
  2⤵
  PID:5520
- C:\Windows\System\meZTuHs.exe
  C:\Windows\System\meZTuHs.exe
  2⤵
  PID:5584
- C:\Windows\System\ZcGBelS.exe
  C:\Windows\System\ZcGBelS.exe
  2⤵
  PID:5652
- C:\Windows\System\Qagilsx.exe
  C:\Windows\System\Qagilsx.exe
  2⤵
  PID:5716
- C:\Windows\System\sTFgamv.exe
  C:\Windows\System\sTFgamv.exe
  2⤵
  PID:1720
- C:\Windows\System\LHDoZAL.exe
  C:\Windows\System\LHDoZAL.exe
  2⤵
  PID:5740
- C:\Windows\System\PHmqjlB.exe
  C:\Windows\System\PHmqjlB.exe
  2⤵
  PID:2892
- C:\Windows\System\XnkPqlq.exe
  C:\Windows\System\XnkPqlq.exe
  2⤵
  PID:5800
- C:\Windows\System\ERqUNEV.exe
  C:\Windows\System\ERqUNEV.exe
  2⤵
  PID:5852
- C:\Windows\System\ToYLIEU.exe
  C:\Windows\System\ToYLIEU.exe
  2⤵
  PID:5836
- C:\Windows\System\GkGxtqm.exe
  C:\Windows\System\GkGxtqm.exe
  2⤵
  PID:5884
- C:\Windows\System\JqbHUrI.exe
  C:\Windows\System\JqbHUrI.exe
  2⤵
  PID:5896
- C:\Windows\System\stVOCul.exe
  C:\Windows\System\stVOCul.exe
  2⤵
  PID:5932
- C:\Windows\System\ulHEdDj.exe
  C:\Windows\System\ulHEdDj.exe
  2⤵
  PID:300
- C:\Windows\System\OTnbqUC.exe
  C:\Windows\System\OTnbqUC.exe
  2⤵
  PID:1560
- C:\Windows\System\DyNqWDr.exe
  C:\Windows\System\DyNqWDr.exe
  2⤵
  PID:6020
- C:\Windows\System\UVUzoZX.exe
  C:\Windows\System\UVUzoZX.exe
  2⤵
  PID:5968
- C:\Windows\System\XyiDTdG.exe
  C:\Windows\System\XyiDTdG.exe
  2⤵
  PID:6092
- C:\Windows\System\OhxDztE.exe
  C:\Windows\System\OhxDztE.exe
  2⤵
  PID:6004
- C:\Windows\System\gxNNQJh.exe
  C:\Windows\System\gxNNQJh.exe
  2⤵
  PID:1236
- C:\Windows\System\tzoYxHI.exe
  C:\Windows\System\tzoYxHI.exe
  2⤵
  PID:3908
- C:\Windows\System\ZIVmzSq.exe
  C:\Windows\System\ZIVmzSq.exe
  2⤵
  PID:5504
- C:\Windows\System\VopIaPd.exe
  C:\Windows\System\VopIaPd.exe
  2⤵
  PID:4992
- C:\Windows\System\CujuRrs.exe
  C:\Windows\System\CujuRrs.exe
  2⤵
  PID:4108
- C:\Windows\System\JdRcTQr.exe
  C:\Windows\System\JdRcTQr.exe
  2⤵
  PID:4600
- C:\Windows\System\RydFDxD.exe
  C:\Windows\System\RydFDxD.exe
  2⤵
  PID:5200
- C:\Windows\System\tOcfbXL.exe
  C:\Windows\System\tOcfbXL.exe
  2⤵
  PID:2572
- C:\Windows\System\qEjlXcO.exe
  C:\Windows\System\qEjlXcO.exe
  2⤵
  PID:5768
- C:\Windows\System\tWAhAZJ.exe
  C:\Windows\System\tWAhAZJ.exe
  2⤵
  PID:5372
- C:\Windows\System\tLwYfRz.exe
  C:\Windows\System\tLwYfRz.exe
  2⤵
  PID:4816
- C:\Windows\System\AbUJwCd.exe
  C:\Windows\System\AbUJwCd.exe
  2⤵
  PID:5772
- C:\Windows\System\QNXcaIZ.exe
  C:\Windows\System\QNXcaIZ.exe
  2⤵
  PID:5928
- C:\Windows\System\iretXke.exe
  C:\Windows\System\iretXke.exe
  2⤵
  PID:5972
- C:\Windows\System\dlfyrIb.exe
  C:\Windows\System\dlfyrIb.exe
  2⤵
  PID:5176
- C:\Windows\System\OFRIKhe.exe
  C:\Windows\System\OFRIKhe.exe
  2⤵
  PID:6104
- C:\Windows\System\PmkPLsN.exe
  C:\Windows\System\PmkPLsN.exe
  2⤵
  PID:5308
- C:\Windows\System\LkrLZcw.exe
  C:\Windows\System\LkrLZcw.exe
  2⤵
  PID:1544
- C:\Windows\System\yZBaboA.exe
  C:\Windows\System\yZBaboA.exe
  2⤵
  PID:5436
- C:\Windows\System\DYpKHGl.exe
  C:\Windows\System\DYpKHGl.exe
  2⤵
  PID:3636
- C:\Windows\System\OOulyqu.exe
  C:\Windows\System\OOulyqu.exe
  2⤵
  PID:3844
- C:\Windows\System\yMPjcBf.exe
  C:\Windows\System\yMPjcBf.exe
  2⤵
  PID:4236
- C:\Windows\System\ZHOZvZw.exe
  C:\Windows\System\ZHOZvZw.exe
  2⤵
  PID:4712
- C:\Windows\System\tyCBFeN.exe
  C:\Windows\System\tyCBFeN.exe
  2⤵
  PID:2044
- C:\Windows\System\UCBYtDY.exe
  C:\Windows\System\UCBYtDY.exe
  2⤵
  PID:5224
- C:\Windows\System\ofEYaXT.exe
  C:\Windows\System\ofEYaXT.exe
  2⤵
  PID:5320
- C:\Windows\System\VzgegBC.exe
  C:\Windows\System\VzgegBC.exe
  2⤵
  PID:5412
- C:\Windows\System\aCkEcEZ.exe
  C:\Windows\System\aCkEcEZ.exe
  2⤵
  PID:492
- C:\Windows\System\SsjPUul.exe
  C:\Windows\System\SsjPUul.exe
  2⤵
  PID:5788
- C:\Windows\System\CAyUNwB.exe
  C:\Windows\System\CAyUNwB.exe
  2⤵
  PID:5868
- C:\Windows\System\BggNfPb.exe
  C:\Windows\System\BggNfPb.exe
  2⤵
  PID:2540
- C:\Windows\System\nycQqzQ.exe
  C:\Windows\System\nycQqzQ.exe
  2⤵
  PID:6084
- C:\Windows\System\NZTMnIp.exe
  C:\Windows\System\NZTMnIp.exe
  2⤵
  PID:1076
- C:\Windows\System\RRkyEio.exe
  C:\Windows\System\RRkyEio.exe
  2⤵
  PID:2564
- C:\Windows\System\slFpPqg.exe
  C:\Windows\System\slFpPqg.exe
  2⤵
  PID:2700
- C:\Windows\System\uUXHERp.exe
  C:\Windows\System\uUXHERp.exe
  2⤵
  PID:2404
- C:\Windows\System\ZqhkGLG.exe
  C:\Windows\System\ZqhkGLG.exe
  2⤵
  PID:5104
- C:\Windows\System\fZqRZHN.exe
  C:\Windows\System\fZqRZHN.exe
  2⤵
  PID:5172
- C:\Windows\System\kWltXve.exe
  C:\Windows\System\kWltXve.exe
  2⤵
  PID:5596
- C:\Windows\System\wbLhmsD.exe
  C:\Windows\System\wbLhmsD.exe
  2⤵
  PID:2704
- C:\Windows\System\uXgCVJZ.exe
  C:\Windows\System\uXgCVJZ.exe
  2⤵
  PID:2172
- C:\Windows\System\lPNXIEd.exe
  C:\Windows\System\lPNXIEd.exe
  2⤵
  PID:1704
- C:\Windows\System\gwDcgti.exe
  C:\Windows\System\gwDcgti.exe
  2⤵
  PID:2032
- C:\Windows\System\RlDyVED.exe
  C:\Windows\System\RlDyVED.exe
  2⤵
  PID:2848
- C:\Windows\System\GVTNfED.exe
  C:\Windows\System\GVTNfED.exe
  2⤵
  PID:5736
- C:\Windows\System\ZeZQAqC.exe
  C:\Windows\System\ZeZQAqC.exe
  2⤵
  PID:6068
- C:\Windows\System\ugEREOg.exe
  C:\Windows\System\ugEREOg.exe
  2⤵
  PID:4744
- C:\Windows\System\csElVSb.exe
  C:\Windows\System\csElVSb.exe
  2⤵
  PID:4988
- C:\Windows\System\OIhUIei.exe
  C:\Windows\System\OIhUIei.exe
  2⤵
  PID:5640
- C:\Windows\System\WfMfEvx.exe
  C:\Windows\System\WfMfEvx.exe
  2⤵
  PID:5864
- C:\Windows\System\XLigVfh.exe
  C:\Windows\System\XLigVfh.exe
  2⤵
  PID:5184
- C:\Windows\System\OQvSDee.exe
  C:\Windows\System\OQvSDee.exe
  2⤵
  PID:2144
- C:\Windows\System\bZJcsET.exe
  C:\Windows\System\bZJcsET.exe
  2⤵
  PID:5988
- C:\Windows\System\vXOGgKN.exe
  C:\Windows\System\vXOGgKN.exe
  2⤵
  PID:3256
- C:\Windows\System\oFWuurZ.exe
  C:\Windows\System\oFWuurZ.exe
  2⤵
  PID:5820
- C:\Windows\System\WOihhRv.exe
  C:\Windows\System\WOihhRv.exe
  2⤵
  PID:5124
- C:\Windows\System\WYOaxHc.exe
  C:\Windows\System\WYOaxHc.exe
  2⤵
  PID:5724
- C:\Windows\System\XDISgnl.exe
  C:\Windows\System\XDISgnl.exe
  2⤵
  PID:5500
- C:\Windows\System\OCjGjiL.exe
  C:\Windows\System\OCjGjiL.exe
  2⤵
  PID:5568
- C:\Windows\System\UVpnZdK.exe
  C:\Windows\System\UVpnZdK.exe
  2⤵
  PID:6036
- C:\Windows\System\QrOWBrT.exe
  C:\Windows\System\QrOWBrT.exe
  2⤵
  PID:5432
- C:\Windows\System\KGhIdfN.exe
  C:\Windows\System\KGhIdfN.exe
  2⤵
  PID:5356
- C:\Windows\System\DjbpkbH.exe
  C:\Windows\System\DjbpkbH.exe
  2⤵
  PID:5484
- C:\Windows\System\qrTDzBD.exe
  C:\Windows\System\qrTDzBD.exe
  2⤵
  PID:2560
- C:\Windows\System\TShPtDf.exe
  C:\Windows\System\TShPtDf.exe
  2⤵
  PID:1016
- C:\Windows\System\zpJndSK.exe
  C:\Windows\System\zpJndSK.exe
  2⤵
  PID:616
- C:\Windows\System\SCTNJbi.exe
  C:\Windows\System\SCTNJbi.exe
  2⤵
  PID:2984
- C:\Windows\System\tKtlqlg.exe
  C:\Windows\System\tKtlqlg.exe
  2⤵
  PID:6152
- C:\Windows\System\FYrkaKp.exe
  C:\Windows\System\FYrkaKp.exe
  2⤵
  PID:6172
- C:\Windows\System\deuyCdx.exe
  C:\Windows\System\deuyCdx.exe
  2⤵
  PID:6188
- C:\Windows\System\RQVnrHM.exe
  C:\Windows\System\RQVnrHM.exe
  2⤵
  PID:6204
- C:\Windows\System\gsdcIKb.exe
  C:\Windows\System\gsdcIKb.exe
  2⤵
  PID:6228
- C:\Windows\System\MaienJc.exe
  C:\Windows\System\MaienJc.exe
  2⤵
  PID:6248
- C:\Windows\System\vREHjDn.exe
  C:\Windows\System\vREHjDn.exe
  2⤵
  PID:6268
- C:\Windows\System\FJekrok.exe
  C:\Windows\System\FJekrok.exe
  2⤵
  PID:6288
- C:\Windows\System\kaTnfMA.exe
  C:\Windows\System\kaTnfMA.exe
  2⤵
  PID:6308
- C:\Windows\System\SYTLtmb.exe
  C:\Windows\System\SYTLtmb.exe
  2⤵
  PID:6324
- C:\Windows\System\UWmhEta.exe
  C:\Windows\System\UWmhEta.exe
  2⤵
  PID:6344
- C:\Windows\System\gTNaxAX.exe
  C:\Windows\System\gTNaxAX.exe
  2⤵
  PID:6360
- C:\Windows\System\KABmAGK.exe
  C:\Windows\System\KABmAGK.exe
  2⤵
  PID:6376
- C:\Windows\System\QssXJbu.exe
  C:\Windows\System\QssXJbu.exe
  2⤵
  PID:6392
- C:\Windows\System\lKAsZZw.exe
  C:\Windows\System\lKAsZZw.exe
  2⤵
  PID:6412
- C:\Windows\System\KHsFLCE.exe
  C:\Windows\System\KHsFLCE.exe
  2⤵
  PID:6428
- C:\Windows\System\yzjXdSA.exe
  C:\Windows\System\yzjXdSA.exe
  2⤵
  PID:6444
- C:\Windows\System\vvCHjpW.exe
  C:\Windows\System\vvCHjpW.exe
  2⤵
  PID:6460
- C:\Windows\System\qCtyVDG.exe
  C:\Windows\System\qCtyVDG.exe
  2⤵
  PID:6476
- C:\Windows\System\ayhpLIr.exe
  C:\Windows\System\ayhpLIr.exe
  2⤵
  PID:6492
- C:\Windows\System\ceHFSrH.exe
  C:\Windows\System\ceHFSrH.exe
  2⤵
  PID:6508
- C:\Windows\System\lZKJfGi.exe
  C:\Windows\System\lZKJfGi.exe
  2⤵
  PID:6524
- C:\Windows\System\dpuaIZW.exe
  C:\Windows\System\dpuaIZW.exe
  2⤵
  PID:6544
- C:\Windows\System\rnqBdkJ.exe
  C:\Windows\System\rnqBdkJ.exe
  2⤵
  PID:6560
- C:\Windows\System\eBSOxmh.exe
  C:\Windows\System\eBSOxmh.exe
  2⤵
  PID:6580
- C:\Windows\System\XyvXsMr.exe
  C:\Windows\System\XyvXsMr.exe
  2⤵
  PID:6596
- C:\Windows\System\MrTcbtA.exe
  C:\Windows\System\MrTcbtA.exe
  2⤵
  PID:6616
- C:\Windows\System\gtMlbiE.exe
  C:\Windows\System\gtMlbiE.exe
  2⤵
  PID:6632
- C:\Windows\System\pgwTczK.exe
  C:\Windows\System\pgwTczK.exe
  2⤵
  PID:6652
- C:\Windows\System\enaEHvL.exe
  C:\Windows\System\enaEHvL.exe
  2⤵
  PID:6672
- C:\Windows\System\fSveqJM.exe
  C:\Windows\System\fSveqJM.exe
  2⤵
  PID:6688
- C:\Windows\System\MAbUWuo.exe
  C:\Windows\System\MAbUWuo.exe
  2⤵
  PID:6708
- C:\Windows\System\HwwNlWi.exe
  C:\Windows\System\HwwNlWi.exe
  2⤵
  PID:6724
- C:\Windows\System\ScvEJHO.exe
  C:\Windows\System\ScvEJHO.exe
  2⤵
  PID:6740
- C:\Windows\System\tBoJyMf.exe
  C:\Windows\System\tBoJyMf.exe
  2⤵
  PID:6756
- C:\Windows\System\QrKsIFp.exe
  C:\Windows\System\QrKsIFp.exe
  2⤵
  PID:6772
- C:\Windows\System\PqteMdY.exe
  C:\Windows\System\PqteMdY.exe
  2⤵
  PID:6788
- C:\Windows\System\lukAaFl.exe
  C:\Windows\System\lukAaFl.exe
  2⤵
  PID:6808
- C:\Windows\System\ZmIQqrf.exe
  C:\Windows\System\ZmIQqrf.exe
  2⤵
  PID:6824
- C:\Windows\System\ptjpvBt.exe
  C:\Windows\System\ptjpvBt.exe
  2⤵
  PID:6840
- C:\Windows\System\XVVznDW.exe
  C:\Windows\System\XVVznDW.exe
  2⤵
  PID:6860
- C:\Windows\System\ghLsnsq.exe
  C:\Windows\System\ghLsnsq.exe
  2⤵
  PID:6876
- C:\Windows\System\bKIApVK.exe
  C:\Windows\System\bKIApVK.exe
  2⤵
  PID:6892
- C:\Windows\System\jKxpqTk.exe
  C:\Windows\System\jKxpqTk.exe
  2⤵
  PID:6908
- C:\Windows\System\FCWZGwi.exe
  C:\Windows\System\FCWZGwi.exe
  2⤵
  PID:6924
- C:\Windows\System\iiNfZjC.exe
  C:\Windows\System\iiNfZjC.exe
  2⤵
  PID:6940
- C:\Windows\System\RQGRxOo.exe
  C:\Windows\System\RQGRxOo.exe
  2⤵
  PID:6960
- C:\Windows\System\fmyndnx.exe
  C:\Windows\System\fmyndnx.exe
  2⤵
  PID:6976
- C:\Windows\System\iSOwLab.exe
  C:\Windows\System\iSOwLab.exe
  2⤵
  PID:6992
- C:\Windows\System\GFvMUvJ.exe
  C:\Windows\System\GFvMUvJ.exe
  2⤵
  PID:7008
- C:\Windows\System\IVKrgEH.exe
  C:\Windows\System\IVKrgEH.exe
  2⤵
  PID:7024
- C:\Windows\System\RmePPda.exe
  C:\Windows\System\RmePPda.exe
  2⤵
  PID:7040
- C:\Windows\System\dvzJGEO.exe
  C:\Windows\System\dvzJGEO.exe
  2⤵
  PID:7056
- C:\Windows\System\tWossqI.exe
  C:\Windows\System\tWossqI.exe
  2⤵
  PID:7072
- C:\Windows\System\rRWjtOU.exe
  C:\Windows\System\rRWjtOU.exe
  2⤵
  PID:7088
- C:\Windows\System\BaHjbRZ.exe
  C:\Windows\System\BaHjbRZ.exe
  2⤵
  PID:7104
- C:\Windows\System\iQGcqPD.exe
  C:\Windows\System\iQGcqPD.exe
  2⤵
  PID:7124
- C:\Windows\System\xTyFlHO.exe
  C:\Windows\System\xTyFlHO.exe
  2⤵
  PID:7144
- C:\Windows\System\DSBdsWF.exe
  C:\Windows\System\DSBdsWF.exe
  2⤵
  PID:7160
- C:\Windows\System\woCZYcs.exe
  C:\Windows\System\woCZYcs.exe
  2⤵
  PID:6148
- C:\Windows\System\SwOffix.exe
  C:\Windows\System\SwOffix.exe
  2⤵
  PID:6212
- C:\Windows\System\TQLDlco.exe
  C:\Windows\System\TQLDlco.exe
  2⤵
  PID:6124
- C:\Windows\System\lMEDTZF.exe
  C:\Windows\System\lMEDTZF.exe
  2⤵
  PID:4648
- C:\Windows\System\OTRYhpr.exe
  C:\Windows\System\OTRYhpr.exe
  2⤵
  PID:2152
- C:\Windows\System\mQYkuFH.exe
  C:\Windows\System\mQYkuFH.exe
  2⤵
  PID:6260
- C:\Windows\System\EqjOQiB.exe
  C:\Windows\System\EqjOQiB.exe
  2⤵
  PID:5216
- C:\Windows\System\BmSHqWu.exe
  C:\Windows\System\BmSHqWu.exe
  2⤵
  PID:6052
- C:\Windows\System\BPbjycd.exe
  C:\Windows\System\BPbjycd.exe
  2⤵
  PID:5916
- C:\Windows\System\RVjFXpS.exe
  C:\Windows\System\RVjFXpS.exe
  2⤵
  PID:3384
- C:\Windows\System\AYjYLYC.exe
  C:\Windows\System\AYjYLYC.exe
  2⤵
  PID:5456
- C:\Windows\System\BUvSxwy.exe
  C:\Windows\System\BUvSxwy.exe
  2⤵
  PID:6080
- C:\Windows\System\gNcnZtr.exe
  C:\Windows\System\gNcnZtr.exe
  2⤵
  PID:6164
- C:\Windows\System\pWYDZdg.exe
  C:\Windows\System\pWYDZdg.exe
  2⤵
  PID:6236
- C:\Windows\System\bdXhRII.exe
  C:\Windows\System\bdXhRII.exe
  2⤵
  PID:6336
- C:\Windows\System\KsFBhiH.exe
  C:\Windows\System\KsFBhiH.exe
  2⤵
  PID:6276
- C:\Windows\System\TJUoynb.exe
  C:\Windows\System\TJUoynb.exe
  2⤵
  PID:6404
- C:\Windows\System\NSOATpA.exe
  C:\Windows\System\NSOATpA.exe
  2⤵
  PID:6320
- C:\Windows\System\frvWbWX.exe
  C:\Windows\System\frvWbWX.exe
  2⤵
  PID:6424
- C:\Windows\System\NZbijnQ.exe
  C:\Windows\System\NZbijnQ.exe
  2⤵
  PID:6536
- C:\Windows\System\lPfdIgh.exe
  C:\Windows\System\lPfdIgh.exe
  2⤵
  PID:6356
- C:\Windows\System\PQDBjVX.exe
  C:\Windows\System\PQDBjVX.exe
  2⤵
  PID:6452
- C:\Windows\System\EjWVqUA.exe
  C:\Windows\System\EjWVqUA.exe
  2⤵
  PID:6612
- C:\Windows\System\qTsJodM.exe
  C:\Windows\System\qTsJodM.exe
  2⤵
  PID:6668
- C:\Windows\System\kJOSSWS.exe
  C:\Windows\System\kJOSSWS.exe
  2⤵
  PID:6488
- C:\Windows\System\LcAkXIX.exe
  C:\Windows\System\LcAkXIX.exe
  2⤵
  PID:6556
- C:\Windows\System\tqsHkAw.exe
  C:\Windows\System\tqsHkAw.exe
  2⤵
  PID:6748
- C:\Windows\System\sTjagta.exe
  C:\Windows\System\sTjagta.exe
  2⤵
  PID:6696
- C:\Windows\System\gWgcTwv.exe
  C:\Windows\System\gWgcTwv.exe
  2⤵
  PID:6816
- C:\Windows\System\MYReaKe.exe
  C:\Windows\System\MYReaKe.exe
  2⤵
  PID:6732
- C:\Windows\System\XnkCJTr.exe
  C:\Windows\System\XnkCJTr.exe
  2⤵
  PID:6852
- C:\Windows\System\gkUBOSt.exe
  C:\Windows\System\gkUBOSt.exe
  2⤵
  PID:6920
- C:\Windows\System\geCQzIt.exe
  C:\Windows\System\geCQzIt.exe
  2⤵
  PID:6800
- C:\Windows\System\FQkMnBn.exe
  C:\Windows\System\FQkMnBn.exe
  2⤵
  PID:6872
- C:\Windows\System\YBLTfRQ.exe
  C:\Windows\System\YBLTfRQ.exe
  2⤵
  PID:6936
- C:\Windows\System\WPvDeis.exe
  C:\Windows\System\WPvDeis.exe
  2⤵
  PID:6988
- C:\Windows\System\IeJKzGj.exe
  C:\Windows\System\IeJKzGj.exe
  2⤵
  PID:7052
- C:\Windows\System\BMIlmGg.exe
  C:\Windows\System\BMIlmGg.exe
  2⤵
  PID:7112
- C:\Windows\System\OZNzqXk.exe
  C:\Windows\System\OZNzqXk.exe
  2⤵
  PID:7000
- C:\Windows\System\WpzoZKv.exe
  C:\Windows\System\WpzoZKv.exe
  2⤵
  PID:7064
- C:\Windows\System\BJcttds.exe
  C:\Windows\System\BJcttds.exe
  2⤵
  PID:7132
- C:\Windows\System\UtHCLiw.exe
  C:\Windows\System\UtHCLiw.exe
  2⤵
  PID:7156
- C:\Windows\System\JnmbgcR.exe
  C:\Windows\System\JnmbgcR.exe
  2⤵
  PID:784
- C:\Windows\System\KalagBe.exe
  C:\Windows\System\KalagBe.exe
  2⤵
  PID:6224
- C:\Windows\System\WxrmkJT.exe
  C:\Windows\System\WxrmkJT.exe
  2⤵
  PID:5236
- C:\Windows\System\axpVVFx.exe
  C:\Windows\System\axpVVFx.exe
  2⤵
  PID:5280
- C:\Windows\System\RQqmjAQ.exe
  C:\Windows\System\RQqmjAQ.exe
  2⤵
  PID:6200
- C:\Windows\System\ExczckJ.exe
  C:\Windows\System\ExczckJ.exe
  2⤵
  PID:6296
- C:\Windows\System\NFgauLA.exe
  C:\Windows\System\NFgauLA.exe
  2⤵
  PID:4380
- C:\Windows\System\STkhLDz.exe
  C:\Windows\System\STkhLDz.exe
  2⤵
  PID:6304
- C:\Windows\System\TeSseXf.exe
  C:\Windows\System\TeSseXf.exe
  2⤵
  PID:6316
- C:\Windows\System\NqSbZMK.exe
  C:\Windows\System\NqSbZMK.exe
  2⤵
  PID:6504
- C:\Windows\System\lrdCHcT.exe
  C:\Windows\System\lrdCHcT.exe
  2⤵
  PID:6644
- C:\Windows\System\gEXnZMh.exe
  C:\Windows\System\gEXnZMh.exe
  2⤵
  PID:6568
- C:\Windows\System\QRNLcOu.exe
  C:\Windows\System\QRNLcOu.exe
  2⤵
  PID:6592
- C:\Windows\System\JFfwFCE.exe
  C:\Windows\System\JFfwFCE.exe
  2⤵
  PID:6684
- C:\Windows\System\wIxODCv.exe
  C:\Windows\System\wIxODCv.exe
  2⤵
  PID:6624
- C:\Windows\System\XDMEFIX.exe
  C:\Windows\System\XDMEFIX.exe
  2⤵
  PID:6664
- C:\Windows\System\kRfXrjI.exe
  C:\Windows\System\kRfXrjI.exe
  2⤵
  PID:6916
- C:\Windows\System\YcOdtPE.exe
  C:\Windows\System\YcOdtPE.exe
  2⤵
  PID:6984
- C:\Windows\System\bMPEHta.exe
  C:\Windows\System\bMPEHta.exe
  2⤵
  PID:7036
- C:\Windows\System\GrEGyJb.exe
  C:\Windows\System\GrEGyJb.exe
  2⤵
  PID:1412
- C:\Windows\System\dNDZrIz.exe
  C:\Windows\System\dNDZrIz.exe
  2⤵
  PID:6136
- C:\Windows\System\Pxmxspr.exe
  C:\Windows\System\Pxmxspr.exe
  2⤵
  PID:6972
- C:\Windows\System\bvQiUDt.exe
  C:\Windows\System\bvQiUDt.exe
  2⤵
  PID:6784
- C:\Windows\System\gXYHdgw.exe
  C:\Windows\System\gXYHdgw.exe
  2⤵
  PID:6796
- C:\Windows\System\sKroVHm.exe
  C:\Windows\System\sKroVHm.exe
  2⤵
  PID:7100
- C:\Windows\System\JUOdthj.exe
  C:\Windows\System\JUOdthj.exe
  2⤵
  PID:5580
- C:\Windows\System\meAOmwv.exe
  C:\Windows\System\meAOmwv.exe
  2⤵
  PID:6400
- C:\Windows\System\NiwhUIr.exe
  C:\Windows\System\NiwhUIr.exe
  2⤵
  PID:6608
- C:\Windows\System\OVXQzja.exe
  C:\Windows\System\OVXQzja.exe
  2⤵
  PID:6716
- C:\Windows\System\IhHEEsF.exe
  C:\Windows\System\IhHEEsF.exe
  2⤵
  PID:6456
- C:\Windows\System\XPvNQvm.exe
  C:\Windows\System\XPvNQvm.exe
  2⤵
  PID:6868
- C:\Windows\System\GxtGGpj.exe
  C:\Windows\System\GxtGGpj.exe
  2⤵
  PID:7048
- C:\Windows\System\xfWFFNQ.exe
  C:\Windows\System\xfWFFNQ.exe
  2⤵
  PID:1096
- C:\Windows\System\MMLTuDQ.exe
  C:\Windows\System\MMLTuDQ.exe
  2⤵
  PID:6500
- C:\Windows\System\CIHakyH.exe
  C:\Windows\System\CIHakyH.exe
  2⤵
  PID:6420
- C:\Windows\System\bWjAuIn.exe
  C:\Windows\System\bWjAuIn.exe
  2⤵
  PID:6604
- C:\Windows\System\YVyDVzO.exe
  C:\Windows\System\YVyDVzO.exe
  2⤵
  PID:7184
- C:\Windows\System\LkZwwDb.exe
  C:\Windows\System\LkZwwDb.exe
  2⤵
  PID:7200
- C:\Windows\System\UBCQeYs.exe
  C:\Windows\System\UBCQeYs.exe
  2⤵
  PID:7216
- C:\Windows\System\nWWVfvI.exe
  C:\Windows\System\nWWVfvI.exe
  2⤵
  PID:7232
- C:\Windows\System\qPbVTKU.exe
  C:\Windows\System\qPbVTKU.exe
  2⤵
  PID:7248
- C:\Windows\System\axAhtNl.exe
  C:\Windows\System\axAhtNl.exe
  2⤵
  PID:7264
- C:\Windows\System\zGjEySo.exe
  C:\Windows\System\zGjEySo.exe
  2⤵
  PID:7280
- C:\Windows\System\tUxVXHf.exe
  C:\Windows\System\tUxVXHf.exe
  2⤵
  PID:7296
- C:\Windows\System\UCSjVkU.exe
  C:\Windows\System\UCSjVkU.exe
  2⤵
  PID:7312
- C:\Windows\System\oaCYwsD.exe
  C:\Windows\System\oaCYwsD.exe
  2⤵
  PID:7328
- C:\Windows\System\vtmtvGF.exe
  C:\Windows\System\vtmtvGF.exe
  2⤵
  PID:7344
- C:\Windows\System\RJdYyWx.exe
  C:\Windows\System\RJdYyWx.exe
  2⤵
  PID:7360
- C:\Windows\System\BrhPVBS.exe
  C:\Windows\System\BrhPVBS.exe
  2⤵
  PID:7376
- C:\Windows\System\Iayoccd.exe
  C:\Windows\System\Iayoccd.exe
  2⤵
  PID:7396
- C:\Windows\System\gUqnjIq.exe
  C:\Windows\System\gUqnjIq.exe
  2⤵
  PID:7412
- C:\Windows\System\iLjkaIm.exe
  C:\Windows\System\iLjkaIm.exe
  2⤵
  PID:7428
- C:\Windows\System\KPtNLKV.exe
  C:\Windows\System\KPtNLKV.exe
  2⤵
  PID:7444
- C:\Windows\System\rQoFGAc.exe
  C:\Windows\System\rQoFGAc.exe
  2⤵
  PID:7460
- C:\Windows\System\NhvImVm.exe
  C:\Windows\System\NhvImVm.exe
  2⤵
  PID:7476
- C:\Windows\System\FCdmbXx.exe
  C:\Windows\System\FCdmbXx.exe
  2⤵
  PID:7492
- C:\Windows\System\wQqriCm.exe
  C:\Windows\System\wQqriCm.exe
  2⤵
  PID:7508
- C:\Windows\System\uZRKOex.exe
  C:\Windows\System\uZRKOex.exe
  2⤵
  PID:7524
- C:\Windows\System\PuccYLc.exe
  C:\Windows\System\PuccYLc.exe
  2⤵
  PID:7540
- C:\Windows\System\wJRXvgF.exe
  C:\Windows\System\wJRXvgF.exe
  2⤵
  PID:7556
- C:\Windows\System\GMPXzgl.exe
  C:\Windows\System\GMPXzgl.exe
  2⤵
  PID:7572
- C:\Windows\System\mrtnSUF.exe
  C:\Windows\System\mrtnSUF.exe
  2⤵
  PID:7588
- C:\Windows\System\QjZsYQL.exe
  C:\Windows\System\QjZsYQL.exe
  2⤵
  PID:7604
- C:\Windows\System\tBhPfpW.exe
  C:\Windows\System\tBhPfpW.exe
  2⤵
  PID:7620
- C:\Windows\System\PQWdwZB.exe
  C:\Windows\System\PQWdwZB.exe
  2⤵
  PID:7636
- C:\Windows\System\gSZqwKl.exe
  C:\Windows\System\gSZqwKl.exe
  2⤵
  PID:7652
- C:\Windows\System\BPTbxyT.exe
  C:\Windows\System\BPTbxyT.exe
  2⤵
  PID:7668
- C:\Windows\System\jOzFypx.exe
  C:\Windows\System\jOzFypx.exe
  2⤵
  PID:7684
- C:\Windows\System\pxqogSb.exe
  C:\Windows\System\pxqogSb.exe
  2⤵
  PID:7700
- C:\Windows\System\hHceboJ.exe
  C:\Windows\System\hHceboJ.exe
  2⤵
  PID:7716
- C:\Windows\System\wMsgmZt.exe
  C:\Windows\System\wMsgmZt.exe
  2⤵
  PID:7732
- C:\Windows\System\RCrolGO.exe
  C:\Windows\System\RCrolGO.exe
  2⤵
  PID:7848
- C:\Windows\System\YqOKmVo.exe
  C:\Windows\System\YqOKmVo.exe
  2⤵
  PID:7928
- C:\Windows\System\fcYAkFI.exe
  C:\Windows\System\fcYAkFI.exe
  2⤵
  PID:7952
- C:\Windows\System\PjNpaNk.exe
  C:\Windows\System\PjNpaNk.exe
  2⤵
  PID:8004
- C:\Windows\System\qAaIbZC.exe
  C:\Windows\System\qAaIbZC.exe
  2⤵
  PID:8084
- C:\Windows\System\GavXKOV.exe
  C:\Windows\System\GavXKOV.exe
  2⤵
  PID:8144
- C:\Windows\System\RvLlQma.exe
  C:\Windows\System\RvLlQma.exe
  2⤵
  PID:7224
- C:\Windows\System\DeNSuKg.exe
  C:\Windows\System\DeNSuKg.exe
  2⤵
  PID:7288
- C:\Windows\System\UmdjUIC.exe
  C:\Windows\System\UmdjUIC.exe
  2⤵
  PID:7084
- C:\Windows\System\ZUprZqN.exe
  C:\Windows\System\ZUprZqN.exe
  2⤵
  PID:6888
- C:\Windows\System\vHQiVgX.exe
  C:\Windows\System\vHQiVgX.exe
  2⤵
  PID:7424
- C:\Windows\System\pNYxldg.exe
  C:\Windows\System\pNYxldg.exe
  2⤵
  PID:7308
- C:\Windows\System\TLRzyJX.exe
  C:\Windows\System\TLRzyJX.exe
  2⤵
  PID:6660
- C:\Windows\System\omkEmFu.exe
  C:\Windows\System\omkEmFu.exe
  2⤵
  PID:7152
- C:\Windows\System\GmbJQtD.exe
  C:\Windows\System\GmbJQtD.exe
  2⤵
  PID:7504
- C:\Windows\System\GNDdKmf.exe
  C:\Windows\System\GNDdKmf.exe
  2⤵
  PID:7468
- C:\Windows\System\hBiKrqq.exe
  C:\Windows\System\hBiKrqq.exe
  2⤵
  PID:7536
- C:\Windows\System\mJlvnZY.exe
  C:\Windows\System\mJlvnZY.exe
  2⤵
  PID:7644
- C:\Windows\System\dMlpGxt.exe
  C:\Windows\System\dMlpGxt.exe
  2⤵
  PID:7708
- C:\Windows\System\FHCEYvN.exe
  C:\Windows\System\FHCEYvN.exe
  2⤵
  PID:7712
- C:\Windows\System\FyvrKif.exe
  C:\Windows\System\FyvrKif.exe
  2⤵
  PID:7600
- C:\Windows\System\vcHNHku.exe
  C:\Windows\System\vcHNHku.exe
  2⤵
  PID:7692
- C:\Windows\System\pynBnmi.exe
  C:\Windows\System\pynBnmi.exe
  2⤵
  PID:6244
- C:\Windows\System\mIhFVKr.exe
  C:\Windows\System\mIhFVKr.exe
  2⤵
  PID:7760
- C:\Windows\System\XjIlfuh.exe
  C:\Windows\System\XjIlfuh.exe
  2⤵
  PID:7784
- C:\Windows\System\LWnXfua.exe
  C:\Windows\System\LWnXfua.exe
  2⤵
  PID:7816
- C:\Windows\System\lpyySdv.exe
  C:\Windows\System\lpyySdv.exe
  2⤵
  PID:7808
- C:\Windows\System\bKBFkLG.exe
  C:\Windows\System\bKBFkLG.exe
  2⤵
  PID:7832
- C:\Windows\System\OrVCXpW.exe
  C:\Windows\System\OrVCXpW.exe
  2⤵
  PID:7772
- C:\Windows\System\PcmtfDH.exe
  C:\Windows\System\PcmtfDH.exe
  2⤵
  PID:7868
- C:\Windows\System\jzNTpqw.exe
  C:\Windows\System\jzNTpqw.exe
  2⤵
  PID:7884
- C:\Windows\System\CQWmKjo.exe
  C:\Windows\System\CQWmKjo.exe
  2⤵
  PID:7904
- C:\Windows\System\UgWnMfi.exe
  C:\Windows\System\UgWnMfi.exe
  2⤵
  PID:7920
- C:\Windows\System\OrSruyl.exe
  C:\Windows\System\OrSruyl.exe
  2⤵
  PID:7960
- C:\Windows\System\IeTbGdp.exe
  C:\Windows\System\IeTbGdp.exe
  2⤵
  PID:7976
- C:\Windows\System\dPevaSO.exe
  C:\Windows\System\dPevaSO.exe
  2⤵
  PID:7984
- C:\Windows\System\smpvmXv.exe
  C:\Windows\System\smpvmXv.exe
  2⤵
  PID:2060
- C:\Windows\System\qHuQhZi.exe
  C:\Windows\System\qHuQhZi.exe
  2⤵
  PID:8032
- C:\Windows\System\NYBPBsF.exe
  C:\Windows\System\NYBPBsF.exe
  2⤵
  PID:8076
- C:\Windows\System\UOPWcNo.exe
  C:\Windows\System\UOPWcNo.exe
  2⤵
  PID:8048
- C:\Windows\System\OBmeCly.exe
  C:\Windows\System\OBmeCly.exe
  2⤵
  PID:8068
- C:\Windows\System\KIEcUUE.exe
  C:\Windows\System\KIEcUUE.exe
  2⤵
  PID:8156
- C:\Windows\System\NyPnPGt.exe
  C:\Windows\System\NyPnPGt.exe
  2⤵
  PID:8180
- C:\Windows\System\zEsWjMM.exe
  C:\Windows\System\zEsWjMM.exe
  2⤵
  PID:8188
- C:\Windows\System\xoPHhGb.exe
  C:\Windows\System\xoPHhGb.exe
  2⤵
  PID:2768
- C:\Windows\System\RxtACCJ.exe
  C:\Windows\System\RxtACCJ.exe
  2⤵
  PID:7320
- C:\Windows\System\uSRtbud.exe
  C:\Windows\System\uSRtbud.exe
  2⤵
  PID:7240
- C:\Windows\System\fYVOAhX.exe
  C:\Windows\System\fYVOAhX.exe
  2⤵
  PID:7180
- C:\Windows\System\wMBTlly.exe
  C:\Windows\System\wMBTlly.exe
  2⤵
  PID:7420
- C:\Windows\System\VLPFgZg.exe
  C:\Windows\System\VLPFgZg.exe
  2⤵
  PID:7384
- C:\Windows\System\jYCfIRB.exe
  C:\Windows\System\jYCfIRB.exe
  2⤵
  PID:2004
- C:\Windows\System\exLBLEv.exe
  C:\Windows\System\exLBLEv.exe
  2⤵
  PID:7244
- C:\Windows\System\EfJeGZD.exe
  C:\Windows\System\EfJeGZD.exe
  2⤵
  PID:7484
- C:\Windows\System\Fyxiqyw.exe
  C:\Windows\System\Fyxiqyw.exe
  2⤵
  PID:7404
- C:\Windows\System\ZTUZTnN.exe
  C:\Windows\System\ZTUZTnN.exe
  2⤵
  PID:7548
- C:\Windows\System\HSYUPRG.exe
  C:\Windows\System\HSYUPRG.exe
  2⤵
  PID:7372
- C:\Windows\System\UVYidEx.exe
  C:\Windows\System\UVYidEx.exe
  2⤵
  PID:7580
- C:\Windows\System\ZSBrPtC.exe
  C:\Windows\System\ZSBrPtC.exe
  2⤵
  PID:7756
- C:\Windows\System\XziIohv.exe
  C:\Windows\System\XziIohv.exe
  2⤵
  PID:7628
- C:\Windows\System\gQQfIcl.exe
  C:\Windows\System\gQQfIcl.exe
  2⤵
  PID:7744
- C:\Windows\System\FvcPlwU.exe
  C:\Windows\System\FvcPlwU.exe
  2⤵
  PID:7800
- C:\Windows\System\gVySDIF.exe
  C:\Windows\System\gVySDIF.exe
  2⤵
  PID:7820
- C:\Windows\System\IvkZYdE.exe
  C:\Windows\System\IvkZYdE.exe
  2⤵
  PID:7876
- C:\Windows\System\tZEslWJ.exe
  C:\Windows\System\tZEslWJ.exe
  2⤵
  PID:7916
- C:\Windows\System\wclrlSY.exe
  C:\Windows\System\wclrlSY.exe
  2⤵
  PID:8092
- C:\Windows\System\TecvcWh.exe
  C:\Windows\System\TecvcWh.exe
  2⤵
  PID:8080
- C:\Windows\System\hLsSDwX.exe
  C:\Windows\System\hLsSDwX.exe
  2⤵
  PID:8176
- C:\Windows\System\oCQgamq.exe
  C:\Windows\System\oCQgamq.exe
  2⤵
  PID:7992
- C:\Windows\System\GTXiEpc.exe
  C:\Windows\System\GTXiEpc.exe
  2⤵
  PID:8152
- C:\Windows\System\CvtNNrP.exe
  C:\Windows\System\CvtNNrP.exe
  2⤵
  PID:6780
- C:\Windows\System\spsVjmD.exe
  C:\Windows\System\spsVjmD.exe
  2⤵
  PID:4472
- C:\Windows\System\gVUPRUx.exe
  C:\Windows\System\gVUPRUx.exe
  2⤵
  PID:7120
- C:\Windows\System\BXbGopT.exe
  C:\Windows\System\BXbGopT.exe
  2⤵
  PID:7340
- C:\Windows\System\LoBtWZR.exe
  C:\Windows\System\LoBtWZR.exe
  2⤵
  PID:7304
- C:\Windows\System\aTUozvn.exe
  C:\Windows\System\aTUozvn.exe
  2⤵
  PID:7612
- C:\Windows\System\dhERkiN.exe
  C:\Windows\System\dhERkiN.exe
  2⤵
  PID:7564
- C:\Windows\System\VAwVgno.exe
  C:\Windows\System\VAwVgno.exe
  2⤵
  PID:7660
- C:\Windows\System\qlRKRrU.exe
  C:\Windows\System\qlRKRrU.exe
  2⤵
  PID:7788
- C:\Windows\System\YOosWKF.exe
  C:\Windows\System\YOosWKF.exe
  2⤵
  PID:7780
- C:\Windows\System\vcNKsCI.exe
  C:\Windows\System\vcNKsCI.exe
  2⤵
  PID:7896
- C:\Windows\System\myFJzda.exe
  C:\Windows\System\myFJzda.exe
  2⤵
  PID:7860
- C:\Windows\System\tZJExxH.exe
  C:\Windows\System\tZJExxH.exe
  2⤵
  PID:7944
- C:\Windows\System\XlzPbDA.exe
  C:\Windows\System\XlzPbDA.exe
  2⤵
  PID:7324
- C:\Windows\System\KgldQfN.exe
  C:\Windows\System\KgldQfN.exe
  2⤵
  PID:7068
- C:\Windows\System\KRgnGKa.exe
  C:\Windows\System\KRgnGKa.exe
  2⤵
  PID:7212
- C:\Windows\System\DlnhgSD.exe
  C:\Windows\System\DlnhgSD.exe
  2⤵
  PID:7488
- C:\Windows\System\SCMpeRy.exe
  C:\Windows\System\SCMpeRy.exe
  2⤵
  PID:7368
- C:\Windows\System\CdtapuU.exe
  C:\Windows\System\CdtapuU.exe
  2⤵
  PID:7900
- C:\Windows\System\KjaVRjG.exe
  C:\Windows\System\KjaVRjG.exe
  2⤵
  PID:8036
- C:\Windows\System\OWyKwth.exe
  C:\Windows\System\OWyKwth.exe
  2⤵
  PID:7968
- C:\Windows\System\DSSnSGC.exe
  C:\Windows\System\DSSnSGC.exe
  2⤵
  PID:7260
- C:\Windows\System\UiDXhhU.exe
  C:\Windows\System\UiDXhhU.exe
  2⤵
  PID:7996
- C:\Windows\System\OxYLOem.exe
  C:\Windows\System\OxYLOem.exe
  2⤵
  PID:8200
- C:\Windows\System\WpyzSfO.exe
  C:\Windows\System\WpyzSfO.exe
  2⤵
  PID:8216
- C:\Windows\System\CAFVutQ.exe
  C:\Windows\System\CAFVutQ.exe
  2⤵
  PID:8236
- C:\Windows\System\FdUZQGo.exe
  C:\Windows\System\FdUZQGo.exe
  2⤵
  PID:8252
- C:\Windows\System\RKTDCfD.exe
  C:\Windows\System\RKTDCfD.exe
  2⤵
  PID:8268
- C:\Windows\System\wgzWtwS.exe
  C:\Windows\System\wgzWtwS.exe
  2⤵
  PID:8284
- C:\Windows\System\zfshiLy.exe
  C:\Windows\System\zfshiLy.exe
  2⤵
  PID:8300
- C:\Windows\System\tXCJCuB.exe
  C:\Windows\System\tXCJCuB.exe
  2⤵
  PID:8316
- C:\Windows\System\gMYeFyP.exe
  C:\Windows\System\gMYeFyP.exe
  2⤵
  PID:8332
- C:\Windows\System\QWWQTia.exe
  C:\Windows\System\QWWQTia.exe
  2⤵
  PID:8348
- C:\Windows\System\eNwZzcN.exe
  C:\Windows\System\eNwZzcN.exe
  2⤵
  PID:8364
- C:\Windows\System\xnDhAeb.exe
  C:\Windows\System\xnDhAeb.exe
  2⤵
  PID:8380
- C:\Windows\System\iPPpvow.exe
  C:\Windows\System\iPPpvow.exe
  2⤵
  PID:8396
- C:\Windows\System\MiMbTxz.exe
  C:\Windows\System\MiMbTxz.exe
  2⤵
  PID:8416
- C:\Windows\System\fnPYdSZ.exe
  C:\Windows\System\fnPYdSZ.exe
  2⤵
  PID:8432
- C:\Windows\System\VLnosWn.exe
  C:\Windows\System\VLnosWn.exe
  2⤵
  PID:8448
- C:\Windows\System\SAtkDSD.exe
  C:\Windows\System\SAtkDSD.exe
  2⤵
  PID:8464
- C:\Windows\System\OySOHaX.exe
  C:\Windows\System\OySOHaX.exe
  2⤵
  PID:8484
- C:\Windows\System\QUOgSpo.exe
  C:\Windows\System\QUOgSpo.exe
  2⤵
  PID:8500
- C:\Windows\System\uzeNVLl.exe
  C:\Windows\System\uzeNVLl.exe
  2⤵
  PID:8516
- C:\Windows\System\bwiAfIJ.exe
  C:\Windows\System\bwiAfIJ.exe
  2⤵
  PID:8536
- C:\Windows\System\qPXgaOb.exe
  C:\Windows\System\qPXgaOb.exe
  2⤵
  PID:8552
- C:\Windows\System\ibxluSK.exe
  C:\Windows\System\ibxluSK.exe
  2⤵
  PID:8568
- C:\Windows\System\TjZXXeI.exe
  C:\Windows\System\TjZXXeI.exe
  2⤵
  PID:8584
- C:\Windows\System\tFXPssZ.exe
  C:\Windows\System\tFXPssZ.exe
  2⤵
  PID:8600
- C:\Windows\System\qygAtEk.exe
  C:\Windows\System\qygAtEk.exe
  2⤵
  PID:8616
- C:\Windows\System\YLvHZuo.exe
  C:\Windows\System\YLvHZuo.exe
  2⤵
  PID:8632
- C:\Windows\System\MRuKxdt.exe
  C:\Windows\System\MRuKxdt.exe
  2⤵
  PID:8648
- C:\Windows\System\nfSejvj.exe
  C:\Windows\System\nfSejvj.exe
  2⤵
  PID:8664
- C:\Windows\System\VsxIljq.exe
  C:\Windows\System\VsxIljq.exe
  2⤵
  PID:8704
- C:\Windows\System\cterPnS.exe
  C:\Windows\System\cterPnS.exe
  2⤵
  PID:8720
- C:\Windows\System\WwInjWZ.exe
  C:\Windows\System\WwInjWZ.exe
  2⤵
  PID:8736
- C:\Windows\System\vlmeAmQ.exe
  C:\Windows\System\vlmeAmQ.exe
  2⤵
  PID:8756
- C:\Windows\System\GDqfquh.exe
  C:\Windows\System\GDqfquh.exe
  2⤵
  PID:8772
- C:\Windows\System\DWIreaV.exe
  C:\Windows\System\DWIreaV.exe
  2⤵
  PID:8788
- C:\Windows\System\CRdqTKG.exe
  C:\Windows\System\CRdqTKG.exe
  2⤵
  PID:8804
- C:\Windows\System\mNYKmCP.exe
  C:\Windows\System\mNYKmCP.exe
  2⤵
  PID:8820
- C:\Windows\System\ELLAytX.exe
  C:\Windows\System\ELLAytX.exe
  2⤵
  PID:8836
- C:\Windows\System\tOjlsmu.exe
  C:\Windows\System\tOjlsmu.exe
  2⤵
  PID:8852
- C:\Windows\System\YjEeTwb.exe
  C:\Windows\System\YjEeTwb.exe
  2⤵
  PID:8868
- C:\Windows\System\LYTiEHq.exe
  C:\Windows\System\LYTiEHq.exe
  2⤵
  PID:8884
- C:\Windows\System\JuwYJcu.exe
  C:\Windows\System\JuwYJcu.exe
  2⤵
  PID:8900
- C:\Windows\System\vhttMCy.exe
  C:\Windows\System\vhttMCy.exe
  2⤵
  PID:8916
- C:\Windows\System\iZxPuBS.exe
  C:\Windows\System\iZxPuBS.exe
  2⤵
  PID:8932
- C:\Windows\System\AiEYyXv.exe
  C:\Windows\System\AiEYyXv.exe
  2⤵
  PID:8948
- C:\Windows\System\CcnNueC.exe
  C:\Windows\System\CcnNueC.exe
  2⤵
  PID:8964
- C:\Windows\System\HcuLhYX.exe
  C:\Windows\System\HcuLhYX.exe
  2⤵
  PID:8980
- C:\Windows\System\tPJpwDw.exe
  C:\Windows\System\tPJpwDw.exe
  2⤵
  PID:8996
- C:\Windows\System\MJRgidI.exe
  C:\Windows\System\MJRgidI.exe
  2⤵
  PID:9012
- C:\Windows\System\vXCUiWH.exe
  C:\Windows\System\vXCUiWH.exe
  2⤵
  PID:9028
- C:\Windows\System\ZElcdYK.exe
  C:\Windows\System\ZElcdYK.exe
  2⤵
  PID:9044
- C:\Windows\System\lgBcEei.exe
  C:\Windows\System\lgBcEei.exe
  2⤵
  PID:9060
- C:\Windows\System\WhPLssg.exe
  C:\Windows\System\WhPLssg.exe
  2⤵
  PID:9076
- C:\Windows\System\FNEuekh.exe
  C:\Windows\System\FNEuekh.exe
  2⤵
  PID:9092
- C:\Windows\System\OTzOuvn.exe
  C:\Windows\System\OTzOuvn.exe
  2⤵
  PID:9108
- C:\Windows\System\XeUuMvQ.exe
  C:\Windows\System\XeUuMvQ.exe
  2⤵
  PID:9124
- C:\Windows\System\wmDpmJS.exe
  C:\Windows\System\wmDpmJS.exe
  2⤵
  PID:9140
- C:\Windows\System\CtLaahP.exe
  C:\Windows\System\CtLaahP.exe
  2⤵
  PID:9160
- C:\Windows\System\mdJBrFb.exe
  C:\Windows\System\mdJBrFb.exe
  2⤵
  PID:9176
- C:\Windows\System\MzTtBuJ.exe
  C:\Windows\System\MzTtBuJ.exe
  2⤵
  PID:9192
- C:\Windows\System\cjQwjBx.exe
  C:\Windows\System\cjQwjBx.exe
  2⤵
  PID:9208
- C:\Windows\System\CrcvQTv.exe
  C:\Windows\System\CrcvQTv.exe
  2⤵
  PID:7840
- C:\Windows\System\akxRQZl.exe
  C:\Windows\System\akxRQZl.exe
  2⤵
  PID:8212
- C:\Windows\System\PxqYXgD.exe
  C:\Windows\System\PxqYXgD.exe
  2⤵
  PID:8248
- C:\Windows\System\QzGllda.exe
  C:\Windows\System\QzGllda.exe
  2⤵
  PID:8196
- C:\Windows\System\wlCoLsi.exe
  C:\Windows\System\wlCoLsi.exe
  2⤵
  PID:8232
- C:\Windows\System\QgJfsge.exe
  C:\Windows\System\QgJfsge.exe
  2⤵
  PID:8324
- C:\Windows\System\pqlFCLV.exe
  C:\Windows\System\pqlFCLV.exe
  2⤵
  PID:8308
- C:\Windows\System\oesMxLJ.exe
  C:\Windows\System\oesMxLJ.exe
  2⤵
  PID:7940
- C:\Windows\System\aNyOqtn.exe
  C:\Windows\System\aNyOqtn.exe
  2⤵
  PID:8360
- C:\Windows\System\HtfWplq.exe
  C:\Windows\System\HtfWplq.exe
  2⤵
  PID:8472
- C:\Windows\System\JtynQij.exe
  C:\Windows\System\JtynQij.exe
  2⤵
  PID:8544
- C:\Windows\System\JHwjTML.exe
  C:\Windows\System\JHwjTML.exe
  2⤵
  PID:8608
- C:\Windows\System\pFTphrp.exe
  C:\Windows\System\pFTphrp.exe
  2⤵
  PID:8672
- C:\Windows\System\KkLTeVn.exe
  C:\Windows\System\KkLTeVn.exe
  2⤵
  PID:8512
- C:\Windows\System\kZBJPeu.exe
  C:\Windows\System\kZBJPeu.exe
  2⤵
  PID:8424
- C:\Windows\System\VQBLlQQ.exe
  C:\Windows\System\VQBLlQQ.exe
  2⤵
  PID:8496
- C:\Windows\System\oZvrEGx.exe
  C:\Windows\System\oZvrEGx.exe
  2⤵
  PID:8524
- C:\Windows\System\WYouKVV.exe
  C:\Windows\System\WYouKVV.exe
  2⤵
  PID:8696
- C:\Windows\System\CZhZHHd.exe
  C:\Windows\System\CZhZHHd.exe
  2⤵
  PID:8624
- C:\Windows\System\nuBKBwg.exe
  C:\Windows\System\nuBKBwg.exe
  2⤵
  PID:8460
- C:\Windows\System\vxMcYvf.exe
  C:\Windows\System\vxMcYvf.exe
  2⤵
  PID:8744
- C:\Windows\System\tvYHhJK.exe
  C:\Windows\System\tvYHhJK.exe
  2⤵
  PID:8764
- C:\Windows\System\DIdDCrH.exe
  C:\Windows\System\DIdDCrH.exe
  2⤵
  PID:8784
- C:\Windows\System\sOaovIe.exe
  C:\Windows\System\sOaovIe.exe
  2⤵
  PID:8816
- C:\Windows\System\NIItSHJ.exe
  C:\Windows\System\NIItSHJ.exe
  2⤵
  PID:8880
- C:\Windows\System\FnqlLmK.exe
  C:\Windows\System\FnqlLmK.exe
  2⤵
  PID:8860
- C:\Windows\System\HrkIYlU.exe
  C:\Windows\System\HrkIYlU.exe
  2⤵
  PID:8988
- C:\Windows\System\EQjZtDP.exe
  C:\Windows\System\EQjZtDP.exe
  2⤵
  PID:8972
- C:\Windows\System\HNOWCrP.exe
  C:\Windows\System\HNOWCrP.exe
  2⤵
  PID:9036
- C:\Windows\System\NEiFJmg.exe
  C:\Windows\System\NEiFJmg.exe
  2⤵
  PID:8956
- C:\Windows\System\eNBhegV.exe
  C:\Windows\System\eNBhegV.exe
  2⤵
  PID:9024
- C:\Windows\System\BHpRyDr.exe
  C:\Windows\System\BHpRyDr.exe
  2⤵
  PID:9088
- C:\Windows\System\GPvqbcb.exe
  C:\Windows\System\GPvqbcb.exe
  2⤵
  PID:9132
- C:\Windows\System\tbMYFbN.exe
  C:\Windows\System\tbMYFbN.exe
  2⤵
  PID:9172
- C:\Windows\System\XyhLQmM.exe
  C:\Windows\System\XyhLQmM.exe
  2⤵
  PID:7824
- C:\Windows\System\HkPrreU.exe
  C:\Windows\System\HkPrreU.exe
  2⤵
  PID:6952
- C:\Windows\System\sguIHtT.exe
  C:\Windows\System\sguIHtT.exe
  2⤵
  PID:7828
- C:\Windows\System\ETolJMo.exe
  C:\Windows\System\ETolJMo.exe
  2⤵
  PID:9184
- C:\Windows\System\hHsqwUG.exe
  C:\Windows\System\hHsqwUG.exe
  2⤵
  PID:8228
- C:\Windows\System\fUicsLN.exe
  C:\Windows\System\fUicsLN.exe
  2⤵
  PID:8444
- C:\Windows\System\tFhQUXA.exe
  C:\Windows\System\tFhQUXA.exe
  2⤵
  PID:8508
- C:\Windows\System\KGLvRfs.exe
  C:\Windows\System\KGLvRfs.exe
  2⤵
  PID:8576
- C:\Windows\System\kfswpXe.exe
  C:\Windows\System\kfswpXe.exe
  2⤵
  PID:8456
- C:\Windows\System\ghEYkQQ.exe
  C:\Windows\System\ghEYkQQ.exe
  2⤵
  PID:8560
- C:\Windows\System\sUiWiSb.exe
  C:\Windows\System\sUiWiSb.exe
  2⤵
  PID:8688
- C:\Windows\System\YLyJCHX.exe
  C:\Windows\System\YLyJCHX.exe
  2⤵
  PID:8660
- C:\Windows\System\lpXArcA.exe
  C:\Windows\System\lpXArcA.exe
  2⤵
  PID:8732
- C:\Windows\System\PlqiNdp.exe
  C:\Windows\System\PlqiNdp.exe
  2⤵
  PID:8796
- C:\Windows\System\mlPSdRm.exe
  C:\Windows\System\mlPSdRm.exe
  2⤵
  PID:8876
- C:\Windows\System\MlXtKsL.exe
  C:\Windows\System\MlXtKsL.exe
  2⤵
  PID:8944
- C:\Windows\System\QwlAJOk.exe
  C:\Windows\System\QwlAJOk.exe
  2⤵
  PID:9056
- C:\Windows\System\kvYlvFx.exe
  C:\Windows\System\kvYlvFx.exe
  2⤵
  PID:9020
- C:\Windows\System\TkDacNo.exe
  C:\Windows\System\TkDacNo.exe
  2⤵
  PID:9168
- C:\Windows\System\eVSaaSc.exe
  C:\Windows\System\eVSaaSc.exe
  2⤵
  PID:9116
- C:\Windows\System\kxWkkHD.exe
  C:\Windows\System\kxWkkHD.exe
  2⤵
  PID:8440
- C:\Windows\System\RPShagg.exe
  C:\Windows\System\RPShagg.exe
  2⤵
  PID:8412
- C:\Windows\System\nWgaeyf.exe
  C:\Windows\System\nWgaeyf.exe
  2⤵
  PID:8780
- C:\Windows\System\KptPMKZ.exe
  C:\Windows\System\KptPMKZ.exe
  2⤵
  PID:8096
- C:\Windows\System\jkPjmsI.exe
  C:\Windows\System\jkPjmsI.exe
  2⤵
  PID:8716
- C:\Windows\System\LDgkdyS.exe
  C:\Windows\System\LDgkdyS.exe
  2⤵
  PID:8692
- C:\Windows\System\VDQKecV.exe
  C:\Windows\System\VDQKecV.exe
  2⤵
  PID:8832
- C:\Windows\System\hKKUBpb.exe
  C:\Windows\System\hKKUBpb.exe
  2⤵
  PID:9004
- C:\Windows\System\yRrNHQf.exe
  C:\Windows\System\yRrNHQf.exe
  2⤵
  PID:8580
- C:\Windows\System\ORXjrXq.exe
  C:\Windows\System\ORXjrXq.exe
  2⤵
  PID:8264
- C:\Windows\System\ogzyHXy.exe
  C:\Windows\System\ogzyHXy.exe
  2⤵
  PID:8656
- C:\Windows\System\OqKAuTA.exe
  C:\Windows\System\OqKAuTA.exe
  2⤵
  PID:8800
- C:\Windows\System\mzFejXQ.exe
  C:\Windows\System\mzFejXQ.exe
  2⤵
  PID:8908
- C:\Windows\System\OalIueh.exe
  C:\Windows\System\OalIueh.exe
  2⤵
  PID:9204
- C:\Windows\System\pTzVESp.exe
  C:\Windows\System\pTzVESp.exe
  2⤵
  PID:9072
- C:\Windows\System\JjxdroO.exe
  C:\Windows\System\JjxdroO.exe
  2⤵
  PID:8592
- C:\Windows\System\uoDUmWi.exe
  C:\Windows\System\uoDUmWi.exe
  2⤵
  PID:8928
- C:\Windows\System\vYgoVtW.exe
  C:\Windows\System\vYgoVtW.exe
  2⤵
  PID:9224
- C:\Windows\System\mXbRzIF.exe
  C:\Windows\System\mXbRzIF.exe
  2⤵
  PID:9240
- C:\Windows\System\JHtELdL.exe
  C:\Windows\System\JHtELdL.exe
  2⤵
  PID:9256
- C:\Windows\System\YPmcPEr.exe
  C:\Windows\System\YPmcPEr.exe
  2⤵
  PID:9276
- C:\Windows\System\gqvCnoX.exe
  C:\Windows\System\gqvCnoX.exe
  2⤵
  PID:9296
- C:\Windows\System\NqzUxqh.exe
  C:\Windows\System\NqzUxqh.exe
  2⤵
  PID:9312
- C:\Windows\System\JSyQjWX.exe
  C:\Windows\System\JSyQjWX.exe
  2⤵
  PID:9332
- C:\Windows\System\zwFXuxC.exe
  C:\Windows\System\zwFXuxC.exe
  2⤵
  PID:9348
- C:\Windows\System\jEStNlz.exe
  C:\Windows\System\jEStNlz.exe
  2⤵
  PID:9364
- C:\Windows\System\lRgytVg.exe
  C:\Windows\System\lRgytVg.exe
  2⤵
  PID:9380
- C:\Windows\System\GRHurCJ.exe
  C:\Windows\System\GRHurCJ.exe
  2⤵
  PID:9396
- C:\Windows\System\rJkXqWx.exe
  C:\Windows\System\rJkXqWx.exe
  2⤵
  PID:9412
- C:\Windows\System\GwXaZWt.exe
  C:\Windows\System\GwXaZWt.exe
  2⤵
  PID:9432
- C:\Windows\System\rARaPVC.exe
  C:\Windows\System\rARaPVC.exe
  2⤵
  PID:9448
- C:\Windows\System\BKtOChl.exe
  C:\Windows\System\BKtOChl.exe
  2⤵
  PID:9464
- C:\Windows\System\AgCBByM.exe
  C:\Windows\System\AgCBByM.exe
  2⤵
  PID:9480
- C:\Windows\System\ksrIDhV.exe
  C:\Windows\System\ksrIDhV.exe
  2⤵
  PID:9496
- C:\Windows\System\GJIQFio.exe
  C:\Windows\System\GJIQFio.exe
  2⤵
  PID:9512
- C:\Windows\System\iIRKbhX.exe
  C:\Windows\System\iIRKbhX.exe
  2⤵
  PID:9532
- C:\Windows\System\XOjkCVZ.exe
  C:\Windows\System\XOjkCVZ.exe
  2⤵
  PID:9556
- C:\Windows\System\wfhpajB.exe
  C:\Windows\System\wfhpajB.exe
  2⤵
  PID:9572
- C:\Windows\System\frpYsTk.exe
  C:\Windows\System\frpYsTk.exe
  2⤵
  PID:9588
- C:\Windows\System\WpxKFnH.exe
  C:\Windows\System\WpxKFnH.exe
  2⤵
  PID:9608
- C:\Windows\System\lCGLqBc.exe
  C:\Windows\System\lCGLqBc.exe
  2⤵
  PID:9624
- C:\Windows\System\iPbTDUW.exe
  C:\Windows\System\iPbTDUW.exe
  2⤵
  PID:9640
- C:\Windows\System\AbAVfrE.exe
  C:\Windows\System\AbAVfrE.exe
  2⤵
  PID:9656
- C:\Windows\System\MykaGTs.exe
  C:\Windows\System\MykaGTs.exe
  2⤵
  PID:9672
- C:\Windows\System\PHGaqds.exe
  C:\Windows\System\PHGaqds.exe
  2⤵
  PID:9692
- C:\Windows\System\ZnBNYhf.exe
  C:\Windows\System\ZnBNYhf.exe
  2⤵
  PID:9708
- C:\Windows\System\UITBpVj.exe
  C:\Windows\System\UITBpVj.exe
  2⤵
  PID:9724
- C:\Windows\System\FngONSh.exe
  C:\Windows\System\FngONSh.exe
  2⤵
  PID:9744
- C:\Windows\System\JpqjIhD.exe
  C:\Windows\System\JpqjIhD.exe
  2⤵
  PID:9760
- C:\Windows\System\zWxSfpw.exe
  C:\Windows\System\zWxSfpw.exe
  2⤵
  PID:9776
- C:\Windows\System\TEadgwK.exe
  C:\Windows\System\TEadgwK.exe
  2⤵
  PID:9792
- C:\Windows\System\sDdmsKr.exe
  C:\Windows\System\sDdmsKr.exe
  2⤵
  PID:9808
- C:\Windows\System\GBgZczH.exe
  C:\Windows\System\GBgZczH.exe
  2⤵
  PID:9824
- C:\Windows\System\neUESve.exe
  C:\Windows\System\neUESve.exe
  2⤵
  PID:9840
- C:\Windows\System\eIZQxVb.exe
  C:\Windows\System\eIZQxVb.exe
  2⤵
  PID:9856
- C:\Windows\System\YIPABta.exe
  C:\Windows\System\YIPABta.exe
  2⤵
  PID:9976
- C:\Windows\System\lGwSTOJ.exe
  C:\Windows\System\lGwSTOJ.exe
  2⤵
  PID:9992
- C:\Windows\System\FGDLJII.exe
  C:\Windows\System\FGDLJII.exe
  2⤵
  PID:10008
- C:\Windows\System\TDRdIEz.exe
  C:\Windows\System\TDRdIEz.exe
  2⤵
  PID:10024
- C:\Windows\System\XvJTeTX.exe
  C:\Windows\System\XvJTeTX.exe
  2⤵
  PID:10040
- C:\Windows\System\OwuIjpr.exe
  C:\Windows\System\OwuIjpr.exe
  2⤵
  PID:10056
- C:\Windows\System\qFRcffq.exe
  C:\Windows\System\qFRcffq.exe
  2⤵
  PID:10080
- C:\Windows\System\uUxgndg.exe
  C:\Windows\System\uUxgndg.exe
  2⤵
  PID:10096
- C:\Windows\System\qhsRTEB.exe
  C:\Windows\System\qhsRTEB.exe
  2⤵
  PID:10116
- C:\Windows\System\UOKGHUZ.exe
  C:\Windows\System\UOKGHUZ.exe
  2⤵
  PID:10132
- C:\Windows\System\TwZDqRO.exe
  C:\Windows\System\TwZDqRO.exe
  2⤵
  PID:10148
- C:\Windows\System\dcfURmK.exe
  C:\Windows\System\dcfURmK.exe
  2⤵
  PID:10164
- C:\Windows\System\QkJVKMc.exe
  C:\Windows\System\QkJVKMc.exe
  2⤵
  PID:10184
- C:\Windows\System\SQSbQWu.exe
  C:\Windows\System\SQSbQWu.exe
  2⤵
  PID:10200
- C:\Windows\System\zVrgrmT.exe
  C:\Windows\System\zVrgrmT.exe
  2⤵
  PID:10216
- C:\Windows\System\KEMWqUV.exe
  C:\Windows\System\KEMWqUV.exe
  2⤵
  PID:10232
- C:\Windows\System\nqbTZCM.exe
  C:\Windows\System\nqbTZCM.exe
  2⤵
  PID:9220
- C:\Windows\System\pcerVYE.exe
  C:\Windows\System\pcerVYE.exe
  2⤵
  PID:9264
- C:\Windows\System\uVGatCO.exe
  C:\Windows\System\uVGatCO.exe
  2⤵
  PID:9308
- C:\Windows\System\GKxvdWp.exe
  C:\Windows\System\GKxvdWp.exe
  2⤵
  PID:9320
- C:\Windows\System\LSxGWLb.exe
  C:\Windows\System\LSxGWLb.exe
  2⤵
  PID:9360
- C:\Windows\System\gnzXTXQ.exe
  C:\Windows\System\gnzXTXQ.exe
  2⤵
  PID:9424
- C:\Windows\System\yCLmjyd.exe
  C:\Windows\System\yCLmjyd.exe
  2⤵
  PID:9376
- C:\Windows\System\dQvVGAP.exe
  C:\Windows\System\dQvVGAP.exe
  2⤵
  PID:9440
- C:\Windows\System\FASqclU.exe
  C:\Windows\System\FASqclU.exe
  2⤵
  PID:9504
- C:\Windows\System\JyEnKle.exe
  C:\Windows\System\JyEnKle.exe
  2⤵
  PID:9544
- C:\Windows\System\hxRPTPR.exe
  C:\Windows\System\hxRPTPR.exe
  2⤵
  PID:9548
- C:\Windows\System\XqqJTqe.exe
  C:\Windows\System\XqqJTqe.exe
  2⤵
  PID:9568
- C:\Windows\System\HOBsBnc.exe
  C:\Windows\System\HOBsBnc.exe
  2⤵
  PID:9632
- C:\Windows\System\qeOSSVp.exe
  C:\Windows\System\qeOSSVp.exe
  2⤵
  PID:9704
- C:\Windows\System\XOESjfz.exe
  C:\Windows\System\XOESjfz.exe
  2⤵
  PID:9580
- C:\Windows\System\plgEGBk.exe
  C:\Windows\System\plgEGBk.exe
  2⤵
  PID:9648
- C:\Windows\System\fuNZggR.exe
  C:\Windows\System\fuNZggR.exe
  2⤵
  PID:9716
- C:\Windows\System\obPKnCB.exe
  C:\Windows\System\obPKnCB.exe
  2⤵
  PID:9816
- C:\Windows\System\VigqJmE.exe
  C:\Windows\System\VigqJmE.exe
  2⤵
  PID:9852
- C:\Windows\System\OZouxej.exe
  C:\Windows\System\OZouxej.exe
  2⤵
  PID:9804
- C:\Windows\System\sQRIuql.exe
  C:\Windows\System\sQRIuql.exe
  2⤵
  PID:9880
- C:\Windows\System\CYnLbZv.exe
  C:\Windows\System\CYnLbZv.exe
  2⤵
  PID:9896
- C:\Windows\System\CHHEdJu.exe
  C:\Windows\System\CHHEdJu.exe
  2⤵
  PID:10020
- C:\Windows\System\ykSfKzX.exe
  C:\Windows\System\ykSfKzX.exe
  2⤵
  PID:9940
- C:\Windows\System\IXqwMSH.exe
  C:\Windows\System\IXqwMSH.exe
  2⤵
  PID:9956
- C:\Windows\System\LGBePoC.exe
  C:\Windows\System\LGBePoC.exe
  2⤵
  PID:9972
- C:\Windows\System\orkLReD.exe
  C:\Windows\System\orkLReD.exe
  2⤵
  PID:9920
- C:\Windows\System\bbhoQLO.exe
  C:\Windows\System\bbhoQLO.exe
  2⤵
  PID:10004

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CbfFvYH.exe

Filesize
2.3MB

MD5
8043fecab43add230e6251bef7e84fa8

SHA1
ec230689998191a3ad04b0c21ea4b0b6a023c1b0

SHA256
dbd72fc258ebda251691f62ba2d4efb2296e3e59d0e0f7ed4780195777cd9268

SHA512
77088b03c690be3d9268c4c507fb7685e3b5b1e7327cbae26615980d5f271265b08dc33d0625bff1d45dcad475e4913b5a662df03d5584193f2cad0ea9ec4e71

Download Submit
C:\Windows\system\HjabbNO.exe

Filesize
2.3MB

MD5
35257798ff386a0877e908db36d05315

SHA1
4b3c6c850fe993b2abe2b36958557ad72305793f

SHA256
6806810006cda97c8d27c2078a288ccd03d96c34105f0b14f479179b2b111480

SHA512
78781c272f145f1ba06b567d33374dee52fb979f8d89fd7265abc6c64e91da55619b3bd9970e2a2f98f37aa82ea86d82017835848736cd8ff85e6ce5db92278e

Download Submit
C:\Windows\system\MZmkLBV.exe

Filesize
2.3MB

MD5
c3c59c9f151672be85953355373e1e16

SHA1
818c87ed38956eed8a37eab0bc967b3d6a3addbb

SHA256
19931ccbd590b87e181d4b4d93bf7bd1dc48320e1f2bddf39f736de4236037a6

SHA512
a86dbe19fed84dd546240b32dbdbb75308c090b4c85e40ad46a529592867f00335196613117e0f475e72b7ba20dc3484e21bb93779ecde94df40686be5bedb4d

Download Submit
C:\Windows\system\MbByykH.exe

Filesize
2.3MB

MD5
bbd4ff13a90f4fc6d832e2bff8528f08

SHA1
87b8e325b889694f47308f0df7323a59c5aae754

SHA256
5294ca95e1722f8f564132ffa075298fd84a8314dcf8b3ea95d907ccba4a67fb

SHA512
89f214a0f23d3bb9a903b099d7129d0ab0f183a059a5ecd50aee30223e5ab913806544d5704780caa006c7c7dec01abe237d27947941b1c32eff13fe77677a48

Download Submit
C:\Windows\system\NytdnrI.exe

Filesize
2.3MB

MD5
7f6b35a4604180bfc9ba8f48c3028b50

SHA1
4778f88c4c47d9d0e0094fecf19071b42c8c0ae2

SHA256
20dd7c567856017e31dd9db14f946dac143d910185ee8b766c23b49482cedde9

SHA512
fff9c7723ccd2ee5c91e3f995e8d95e4bc6b784564a2c63167857c8698a842354baffe01dd36214ffad5fb53a5c6f64b279224d323070c3ccee7d36cff1c5acc

Download Submit
C:\Windows\system\QBUASvH.exe

Filesize
2.3MB

MD5
989472ed0d45fe12c5eae81a23d96af8

SHA1
5b71772207c4b1b4285c57dd67127d0055cfcf76

SHA256
d270320decb8092aac84724770f961de15e7139113423620c8bda3a9b08e3c60

SHA512
9b1c4b021d2a44efe902a71e5b68b556d69e6c0d74bfbd2af649ab73d22d8ecf53c90b9a17bbd1f6f20332dab5e62319fef92f84ddb246d24e0a442b353f616a

Download Submit
C:\Windows\system\QTPmETk.exe

Filesize
2.3MB

MD5
426e75ecee8758face4849f3a4490b32

SHA1
ab5736f79b97cbe3e5383bb36f8ffcb774ccc883

SHA256
2848db27c5bc5e158f73ec77cd9fb027fc19a58cd1dfaf4e447fa371a3bcd9fe

SHA512
94156f4599a0016673e15c93a31fe8db62fb63e827a4cc64ef65347f0a674426e71efcf25fb09fddc2765f096dc9ddd7f32b4cdc02cfc8741d4c3269ee2ff97e

Download Submit
C:\Windows\system\SELlNnt.exe

Filesize
2.3MB

MD5
f6e2a1bf73e8924d938cf4e5b6bf2a1d

SHA1
4824cb4ef96434f2c220b32143261e61749a03c9

SHA256
4c10cc46af4b24c394158831ed477cee5241cb9583d535e6b64c3764eb6eb9d9

SHA512
95cc523f5e2f8e09393cad631caecf9743ca2085ca88e9b4b4cb14695c88b61c2c45cbb5fde7bc21ff18887ae730077dbc0c2e48a55f5d8653b915ab2e12b7dc

Download Submit
C:\Windows\system\UObmYIO.exe

Filesize
2.3MB

MD5
26c0f8869ed75293d5d5a6398afff8af

SHA1
d8428969aaf650145ebbff1e06e32752683ff929

SHA256
dbd5e9fb2a4fca853f303fb8272cfa4963501459b961493c32627195e44ec16b

SHA512
18b0ff3e6d0ebecc734457cf160b129ab27e0b48c51da5ec5ca0b712666f8de84e725c9f5be5ec9f0d7eeed7902264287b18a753c89ee4e732de36cd0713dba9

Download Submit
C:\Windows\system\UkrxbmR.exe

Filesize
2.3MB

MD5
9d31ca20caccf7a9a926854a538982d1

SHA1
11e157b5c3e6ab7114e8d90b9f0e766847bad0ad

SHA256
fe680787dde25312f282ec265609caa49924042687681a1efb38448878647387

SHA512
755c847ad34d1cec95bc8d9c4639328142f6137ce8a85e68973353489123da1f737c1098155ec59f130794d61ca2ec0bc632e609f8a2b21dceb0bb9cdbd7d46a

Download Submit
C:\Windows\system\XnfBzAx.exe

Filesize
2.3MB

MD5
7e2a65b8c7fcf98fb91a347f20bdb0bd

SHA1
e15fcec8e7d68ac7f9f464db9abd668bfd052969

SHA256
efdb071b08bdcae1f5b632be5c5af931852dcd38cd7a3671ed332d2dea074d7a

SHA512
2d2f5114a0aa59a301169a67f0262a38d14d5361d1604aac1301d45f84122a766a8c490cad3daa2d4a2c221e225b3bd60d85d02007769d0221d18768d4a84650

Download Submit
C:\Windows\system\ZEEfHXD.exe

Filesize
2.3MB

MD5
39fa81ea34bd3304f3296e454205de78

SHA1
71f3d250b6d6526d6b5ae9960702d749181e1ba3

SHA256
70a151199dd9f8da0dcc5ca208a3e91e27e92258e11b54c4e6def32f83e634d9

SHA512
3bf12e87208ca1f5adfa425377eabf9a27e304a89582f39fe4d5e0330a10326fdfdc3606888838244d2354e7a0107961abad084042d9f4a3f8066cb16cf348d6

Download Submit
C:\Windows\system\aNvDMJI.exe

Filesize
2.3MB

MD5
052ef60db31676a17358c0ec9c1faebe

SHA1
72649364a4389a070bd81334168655d2553e02cc

SHA256
82b47a1f894b78b7d30f86a0a2cbd9e443dcfbdeb2787ee068fbe0490aba3ebf

SHA512
1da68246cfa76b6a4e850a75e842695ac7c5b383d76b96fcd020b67f2c4179cced2800b07a40b21e365e622a83803c285eaba913ff473db6ff76ed9cf7f86a0e

Download Submit
C:\Windows\system\dWCKmFa.exe

Filesize
2.3MB

MD5
eeea9495862e1ac589be50bdebdb2af7

SHA1
cb6908c5ed0c896f48906418f580ba1761460037

SHA256
36f3d344062c21520d056977dffe6f288b9ab8d799024ad91774d528ff3cd277

SHA512
695d7e5e541fbe3d98255904e0ec71e8fbcb2cc0829fc79121868f22a4295cbd83d225b98b63ed6ee9645e08de3604e03b6d79aad326fb895c02075a8ee2b83c

Download Submit
C:\Windows\system\fzicrNi.exe

Filesize
2.3MB

MD5
f0f7a8e4069b4512f5897fe329089f99

SHA1
0bd59d135418d2c0fd6af5a8f0b1778da4bc7fa7

SHA256
792f5efdc4537ccf45842000ee7fa498b0649fcd540f893fe52e55c6d67794c5

SHA512
7f19162ec62edd577f4a2e97f9d42fa2c4e0837715bc2da5f8c3ffcc571e1fa6d3e217603b2a93031577cba17e8073d85c45df411139060ff913717256ad5c70

Download Submit
C:\Windows\system\gAVDmbN.exe

Filesize
2.3MB

MD5
b563d711f8a3c8f619d10097f78a7741

SHA1
1546a9558b27c2266e38c6da02a92cebb9af88b1

SHA256
70a46a95032a6fc158666d39aa3c50521be5d71a601164484dc80e7407b26200

SHA512
aa014996c942e7ff4433416c066d227c288af2b70b720c9a2aad48ba848fedb52d552a4c955b111846f9b997c6e6b6c47df9d95bcd22733316beceb1f0b8ca0f

Download Submit
C:\Windows\system\gVsdWCT.exe

Filesize
2.3MB

MD5
57eeca94de33c683b9a6747bec290ff4

SHA1
eff12fd9b4357ae0188ba3184ae1905a39ac3265

SHA256
5430504eebd4f3bc4caf37730ccc520229891a8213f9624beffe08f351c7d5c9

SHA512
7879d6d9f00dbaa33903cb68b75d61bd731e42f5d9e388c8c47e0ab5f9898ca48720f6cd566d598b296d3038f2681c36b5829fb1262096d1b044584ed72b52bf

Download Submit
C:\Windows\system\hPTGbbw.exe

Filesize
2.3MB

MD5
3b7abfd9df8f3100d73a210009972e0a

SHA1
b8630acbeafa3308284a01a1f70de7212cd6bdd9

SHA256
c698cb14d2c573b2bf75e60969494317a122b90d0de10b20609113a7359957af

SHA512
e096684efb5963baba3e76732979d38111db07de40c61f9631224b721fdb6c7f40d36ace6402f270875af991c5b4fc08d418327e225bfa2ab7c1d82360479fd9

Download Submit
C:\Windows\system\hjbFEOx.exe

Filesize
2.3MB

MD5
8f15d8aca958845ca7c60dfe17eb65ec

SHA1
fbd4d8f25e06582151a14e9396b51a1ca0adee63

SHA256
d17530c7104807a43e4430241017ff1b72ad5666fe8eef3ba682ad0b841d8575

SHA512
25afad912de615ff2053c4fc65e84e3c721c4e9bae8a1fbbe3a1025db4add75cee3035d02927e507830f4de4663b6bce12b6fec3b270d59b6a13cae2d4a7d5a2

Download Submit
C:\Windows\system\jlwUOzq.exe

Filesize
2.3MB

MD5
ea131af762ae5426a84810bcf9390610

SHA1
69b67c5cb107f0588bfe0662d263d539dda2e83c

SHA256
e4b1298cec53494cfbf2dd31b2e54c59b9ee5709a3d304f5dfd0603767389212

SHA512
9354d7955697d40338d2ea82f1499fc16596cec80afa77e3274d28710d4c11831f7c6027e253ed9cdf48e96bb891ba0d79d12ee684d4904f4e5f8d9608275fae

Download Submit
C:\Windows\system\kypPnPM.exe

Filesize
2.3MB

MD5
86d282eb9c0e7eb040688bb41ac1a6ab

SHA1
793dbcd3f47b6d2fafb41a45c4e39afe23c75846

SHA256
135c0250d13d2ec554550c753372c565f4e6f2769b93921ae76273a36388983b

SHA512
42d83c7ce0c0f44e8bd2df2c80734756c61cef7713a67bd136d766e7161d145ee5ac5419967c5d65d3bf9962f9cafd7ac584145fffaaecb78bf21afce656c8cc

Download Submit
C:\Windows\system\mpZMgqI.exe

Filesize
2.3MB

MD5
b4a56ec8c6a27b7bb6ffc2708132e02a

SHA1
d76294f84337a5a83246b3ecb341854bf55220ce

SHA256
c667e7160bdc7ecc7364e4d1f290fd78b7434a5d1a0043154fc525994389dee5

SHA512
7dbfd723c233415440bd27e271e033a5b5faec6a9d769b65e7872ddd92443e4665232eed09558083aa2cf24739a22b67e5d3f20556eff02f2ab66578e7a9ac5d

Download Submit
C:\Windows\system\nXhdJkU.exe

Filesize
2.3MB

MD5
ab107029a09f8d0806c1af9c079e9619

SHA1
0b0fd9cda8a56b0c385c1ae6d3a58f9338eb4db9

SHA256
86b197c8b7902c57cd4c42ed0b2f17e1eacfb6aad42904d995aefac1a3c29d8b

SHA512
a4f7963184443c4e1a4257eed812c8de106d61f4e79ff287bea839440d88ffdc742e667c9c298cd9ee81154bd47209100dcb8a8ec073115a73ddff7c1333ec2c

Download Submit
C:\Windows\system\rVAItph.exe

Filesize
2.3MB

MD5
3b75527a412cea5d725bd938415f5429

SHA1
4eb5379bf7a17c224f084db6313497aa05f522ad

SHA256
d6d4d0672507308f11eb542e0d476d4cd97ffa7c59757a3e0b54d1a7f4a6bd4a

SHA512
e86b30f12a841ea7318d54152a122db5a299dc4aac4ef6784dcd5c4273f9577db4be84c6a7fcd7ff69c9eae40618710c703fc5eb7026e1c18dd68865186c22be

Download Submit
C:\Windows\system\wWGKnjv.exe

Filesize
2.3MB

MD5
c1f12c3b083a7bcbaa76c65b2532a709

SHA1
18c074f6c943f5712d03d37aa7c0c5986f2c6751

SHA256
7d07a5962bf988652770b801436c39d2d5197cbb976b45675640e02fe527d358

SHA512
df4825ad0f6a4ed5b662c427915c973d83fabca0784beb7e862f183baa3df657539b7ec24be5f7356e1db314c8dd50bc0448132fa6f7cc5d0c03465de099f922

Download Submit
C:\Windows\system\xBLbPIB.exe

Filesize
2.3MB

MD5
cb892ec8e833a15af8fa7428f2fa5801

SHA1
03df99c23dbf8f320365f30c90491767ca1ec618

SHA256
fad590d75988c129191fac28152cf3b1b77f0d984d6da7d1c9cf2a96355bae83

SHA512
a19dbad7bcdf93653fb1ac6dcd3fa41aa5d6b9d3ab9816d21946ea06920f654e3ca78660488ced21c9f6e283de4f7e2d3b66508898eb442635a1fcfd2d6e7c18

Download Submit
C:\Windows\system\xnwJxmU.exe

Filesize
2.3MB

MD5
6a138ac31014a6bac84d9470cf66837c

SHA1
b4375ece875695fe4a94602c38e41fb32acd0f08

SHA256
5aa292c9b8454ab7b2562fd5404f9e2d62158d27efbb0a62fea0e62a680c1986

SHA512
d8513f85d7d7bbf39cad9d3ded845b6a5762e81f5bba8bb3eac3ca375bbca2b51d77b0bc4172753eb87441fba8b11b7a49c761137cf64a2b7b4756415fbbb43d

Download Submit
\Windows\system\GDwvGeK.exe

Filesize
2.3MB

MD5
0df183e1f0eca3234238a47cb1a01984

SHA1
5c96959875db85df7019b2639563f544a601760f

SHA256
a2e274a61154df92ef0dfd60e665723f639b6aa66210d6722bb51034e494f24e

SHA512
f11c8aa22676c4da5d339be6ae337f6a62d05f551c9d3eddd45da71c27049387c80ecceb7dd3a6ffdc222eeeab8b940cd38f88921e718722d74a21bec7ff16b9

Download Submit
\Windows\system\fiwvAuk.exe

Filesize
2.3MB

MD5
b4fe28d029188bfedc7adc6a1bc42afa

SHA1
aab71ca386926a56b8320c78abbffdee3fbf5cc6

SHA256
7f5257e932bade72ff82180894d3a6f0964f05b0052000bc4c3e326469e72bcd

SHA512
48541011a4713f323dac1e8f5ea76af31b8697ea64d7c7c6fe9206733501bc47a63a1504038ba69c9a2c63f1264ed60cf4d69bdb1d932342845ffbe80c24c8ef

Download Submit
\Windows\system\gyLxcoc.exe

Filesize
2.3MB

MD5
beeccf3b5e32a7bbef227bcfc8a440e1

SHA1
4391a7297692bea70db6bba8911d3157d8d0b569

SHA256
59ec6477e47fb134ac81bae7b6e565b64178f01ba2d15c3d8217ddf357c5dcbe

SHA512
7eb2eba54016c2d08b7db7118334cbacd0022d98b30eb1a2e72c9affb3aab46ad18a24ca681a26efc98e5f06cefb69225cf1535cd3ce5f0317eedb5902c70d36

Download Submit
\Windows\system\kdrbsSY.exe

Filesize
2.3MB

MD5
0649eef36da6829b523a551cdefd6687

SHA1
96fd87da5c2195e5e6a3750fe393fb2bc7efd765

SHA256
d154bbc658d077f39c041377434f600343de664757a048cbb3f602025de6931a

SHA512
9d1b8ff2d05435512c040885bf201e7fa5a58d362ef3c2ef3819cd8e7d3411babf7c2f67c7f71abfc44cce9581b562232ca914e17ff7d4a80bde9183ceb72c97

Download Submit
\Windows\system\ntDUtbm.exe

Filesize
2.3MB

MD5
8cda86f3fe43b26c7a02c5ee94ac588a

SHA1
e5653409e2ac2f7db0d2d1ef73e578699229d3d0

SHA256
7145306c57ac674eb241d77b71c965af0e82e6a0a18cc73c1e167f9a3d7d8d1e

SHA512
2af3b4ceb2e25b8de9639cedd9da0832e651a1e9556e6994e15660ae54e915652137998cda6165057b4d1f60fe7e50894d7457af78f967c6aa533d095924c733

Download Submit
memory/1732-130-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/1732-134-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/1732-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1732-132-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/1732-131-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-135-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-129-0x0000000003780000-0x0000000003B72000-memory.dmp

Filesize
3.9MB

Download
memory/1732-122-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-126-0x00000000034A0000-0x0000000003892000-memory.dmp

Filesize
3.9MB

Download
memory/1732-0-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/1732-124-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/1732-118-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2264-12-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2376-128-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2460-117-0x000000013F0B0000-0x000000013F4A2000-memory.dmp

Filesize
3.9MB

Download
memory/2520-133-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2664-17-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/2728-123-0x000000013F0C0000-0x000000013F4B2000-memory.dmp

Filesize
3.9MB

Download
memory/2752-121-0x000000013FEA0000-0x0000000140292000-memory.dmp

Filesize
3.9MB

Download
memory/2780-125-0x000000013FBB0000-0x000000013FFA2000-memory.dmp

Filesize
3.9MB

Download
memory/2860-116-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2860-114-0x000007FEF6110000-0x000007FEF6AAD000-memory.dmp

Filesize
9.6MB

Download
memory/2860-18-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2860-127-0x00000000026D0000-0x0000000002750000-memory.dmp

Filesize
512KB

Download
memory/2860-42-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2860-41-0x000000001B590000-0x000000001B872000-memory.dmp

Filesize
2.9MB

Download
memory/2860-1049-0x000007FEF6110000-0x000007FEF6AAD000-memory.dmp

Filesize
9.6MB

Download