xmrig | f92bf20602ad675de256af011a7b3cba3f3c9b1fbf03f73a232cafbcd66dcd1d

Analysis

max time kernel
30s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
Size

1.9MB
MD5

041d0a4b9b5a4145dc998535dcf008bc
SHA1

1f146070d614d4ab1ab1e62caa697ccb35ab4786
SHA256

f92bf20602ad675de256af011a7b3cba3f3c9b1fbf03f73a232cafbcd66dcd1d
SHA512

f5421294a8cec2f9065869596536bc1068d22dad16bfc6e8d5c3f74334d58b62e115941995591c9bebd84d5a43d991459b7262759e2973f7ef893d97d5cf2ae1
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlfRT:NABO

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2188-152-0x000000013FA30000-0x000000013FE22000-memory.dmp	xmrig
behavioral1/memory/2424-150-0x000000013FAE0000-0x000000013FED2000-memory.dmp	xmrig
behavioral1/memory/2320-149-0x0000000003350000-0x0000000003742000-memory.dmp	xmrig
behavioral1/memory/2800-148-0x000000013FFC0000-0x00000001403B2000-memory.dmp	xmrig
behavioral1/memory/2720-146-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2500-143-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2548-141-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig
behavioral1/memory/2508-156-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	xmrig
behavioral1/memory/2320-2093-0x000000013FE90000-0x0000000140282000-memory.dmp	xmrig
behavioral1/memory/2524-2095-0x000000013F670000-0x000000013FA62000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2952	wZAwjfp.exe
2524	sBpuAMV.exe
2548	PBSvnZs.exe
2500	bxlZbVZ.exe
2720	AuPMFCu.exe
2800	ewpFxXz.exe
2424	SdSXFbC.exe
2188	nlrGGtA.exe
2508	UxRMMXU.exe
2460	dHwHaPK.exe
2116	vabkPPi.exe
2392	gmsJHGR.exe
2748	oVZjJIW.exe
2860	HTEpQSP.exe
2904	TroKcRz.exe
2620	CZsbOwx.exe
1680	DBOHtOb.exe
2652	IilaZFa.exe
2876	sHtWLnR.exe
1020	UrRKRAS.exe
1648	LDHAtKJ.exe
628	ghGTRRO.exe
2632	bGVcIfm.exe
2612	hOVEwRs.exe
268	SakBrKx.exe
2008	tsKtSUO.exe
1644	ufjxaOR.exe
2832	YGzoxkz.exe
908	kxXutHN.exe
780	djyDPYL.exe
2924	RTjlmxh.exe
3060	SLzhnRR.exe
2352	IjHyxok.exe
1524	FwahsFy.exe
1696	uAKRFba.exe
332	AFUlAJS.exe
1592	asgRQpJ.exe
768	DzqNnBr.exe
1980	DbIAyqk.exe
876	fdFvMRh.exe
1856	WVdRDvE.exe
344	HXMFQXS.exe
3068	cfvlaXt.exe
568	WLSATPw.exe
1892	RImfRXq.exe
1872	ECFqwxM.exe
1900	mRDyqaU.exe
2076	uElVsyR.exe
1952	ckewOfb.exe
2420	TuxOzHc.exe
2752	ShAYpXC.exe
1544	kSgqaOB.exe
2448	bxlFHrn.exe
2780	LzHRglt.exe
1056	DpeyXop.exe
1664	wPQKIUa.exe
2044	fPhLBEK.exe
1308	LuQDQxg.exe
840	cxJwDsZ.exe
1776	IVCIrzr.exe
1508	RiOprqK.exe
1840	xOPeLTu.exe
1848	PFslwLX.exe
240	FXKAtuY.exe

Loads dropped DLL 64 IoCs

pid	Process
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2320-1-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/files/0x000b000000015ccd-6.dat	upx
behavioral1/memory/2952-12-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/files/0x0037000000015d4e-17.dat	upx
behavioral1/memory/2524-19-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-22.dat	upx
behavioral1/files/0x0008000000015d87-29.dat	upx
behavioral1/files/0x0007000000015d93-33.dat	upx
behavioral1/files/0x0006000000016cdc-50.dat	upx
behavioral1/files/0x0006000000016d18-57.dat	upx
behavioral1/files/0x0006000000016d34-66.dat	upx
behavioral1/files/0x0006000000016d5f-87.dat	upx
behavioral1/files/0x0006000000016d8e-95.dat	upx
behavioral1/files/0x0008000000016cb0-49.dat	upx
behavioral1/files/0x000600000001704a-133.dat	upx
behavioral1/files/0x0006000000016db1-119.dat	upx
behavioral1/files/0x0006000000016dbe-129.dat	upx
behavioral1/files/0x00060000000171df-154.dat	upx
behavioral1/files/0x0006000000017437-167.dat	upx
behavioral1/files/0x0036000000015d56-186.dat	upx
behavioral1/files/0x0015000000018644-185.dat	upx
behavioral1/files/0x0005000000018665-181.dat	upx
behavioral1/files/0x000600000001708b-164.dat	upx
behavioral1/files/0x00060000000173d0-161.dat	upx
behavioral1/memory/2188-152-0x000000013FA30000-0x000000013FE22000-memory.dmp	upx
behavioral1/memory/2424-150-0x000000013FAE0000-0x000000013FED2000-memory.dmp	upx
behavioral1/memory/2800-148-0x000000013FFC0000-0x00000001403B2000-memory.dmp	upx
behavioral1/memory/2720-146-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2500-143-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/memory/2548-141-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx
behavioral1/files/0x0031000000018649-177.dat	upx
behavioral1/memory/2508-156-0x000000013FAD0000-0x000000013FEC2000-memory.dmp	upx
behavioral1/files/0x0006000000016db9-124.dat	upx
behavioral1/files/0x0006000000016da5-114.dat	upx
behavioral1/files/0x0006000000016d9d-110.dat	upx
behavioral1/files/0x0006000000016d74-108.dat	upx
behavioral1/files/0x0006000000016d43-106.dat	upx
behavioral1/files/0x0006000000016d3a-104.dat	upx
behavioral1/files/0x0006000000016d20-94.dat	upx
behavioral1/files/0x0006000000016d07-76.dat	upx
behavioral1/files/0x0006000000016d3e-80.dat	upx
behavioral1/files/0x0007000000015e32-38.dat	upx
behavioral1/files/0x0009000000015ecc-43.dat	upx
behavioral1/memory/2320-2093-0x000000013FE90000-0x0000000140282000-memory.dmp	upx
behavioral1/memory/2524-2095-0x000000013F670000-0x000000013FA62000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\IVCIrzr.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\dUSWPSG.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\tYZeBvo.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\LoKAdGN.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\UdgRJeO.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\UtCDRyq.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\asgRQpJ.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\XDicLDY.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\EOUPseq.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\PdabSlF.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\olEyUrW.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\uCWaFLS.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\vpXDZtr.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\awApOXV.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\qimhmVF.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\BULWtPu.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\iOYYFrd.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\RNHDxZK.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\OlNRkgS.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\hJtmxVg.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\MPnberi.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\XzvphcB.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\jooQjau.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\TPNpTzk.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\WfLftRQ.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\YNOxGJJ.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\iijGtld.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\KFHZsDB.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\hCJOVZk.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\Nloykyp.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\ojQRvyx.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\mkVkzpm.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\iSlZLft.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\wqTtZpM.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\xKGLyFI.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\mdcfgSd.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\pyvVSXN.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\jQuXroa.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\ufjxaOR.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\vIrKejM.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\JpHTzaD.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\UdcuFwO.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\KYYHUrC.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\tLAIhFY.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\ShAYpXC.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\gNlUcCG.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\ypYLeMu.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\hifSxJA.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\DyCNsIB.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\xyXBoMn.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\ZjToviT.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\yYSDkNm.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\tewCbhH.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\SveLYEm.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\SpOxWOk.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\DvKWqal.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\wsUbTWA.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\SehcxwH.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\hdhnXwv.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\eSsAHvn.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\LoKeSlC.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\QBJePLd.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\WLSATPw.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
File created	C:\Windows\System\APUOgpS.exe	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1956	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
Token: SeDebugPrivilege	1956	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1956	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1956	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	29
PID 2320 wrote to memory of 1956	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	29
PID 2320 wrote to memory of 2952	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2952	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2952	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	30
PID 2320 wrote to memory of 2524	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2524	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2524	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	31
PID 2320 wrote to memory of 2548	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2548	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2548	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	32
PID 2320 wrote to memory of 2500	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2500	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2500	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	33
PID 2320 wrote to memory of 2720	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2720	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2720	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	34
PID 2320 wrote to memory of 2800	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2800	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2800	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	35
PID 2320 wrote to memory of 2424	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2424	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2424	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	36
PID 2320 wrote to memory of 2188	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2188	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2188	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	37
PID 2320 wrote to memory of 2508	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2508	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2508	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	38
PID 2320 wrote to memory of 2392	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2392	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2392	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	39
PID 2320 wrote to memory of 2460	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2460	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2460	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	40
PID 2320 wrote to memory of 2904	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2904	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2904	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	41
PID 2320 wrote to memory of 2116	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	42
PID 2320 wrote to memory of 2116	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	42
PID 2320 wrote to memory of 2116	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	42
PID 2320 wrote to memory of 1680	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	43
PID 2320 wrote to memory of 1680	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	43
PID 2320 wrote to memory of 1680	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	43
PID 2320 wrote to memory of 2748	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	44
PID 2320 wrote to memory of 2748	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	44
PID 2320 wrote to memory of 2748	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	44
PID 2320 wrote to memory of 2652	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	45
PID 2320 wrote to memory of 2652	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	45
PID 2320 wrote to memory of 2652	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	45
PID 2320 wrote to memory of 2860	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	46
PID 2320 wrote to memory of 2860	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	46
PID 2320 wrote to memory of 2860	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	46
PID 2320 wrote to memory of 2876	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	47
PID 2320 wrote to memory of 2876	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	47
PID 2320 wrote to memory of 2876	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	47
PID 2320 wrote to memory of 2620	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	48
PID 2320 wrote to memory of 2620	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	48
PID 2320 wrote to memory of 2620	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	48
PID 2320 wrote to memory of 1020	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	49
PID 2320 wrote to memory of 1020	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	49
PID 2320 wrote to memory of 1020	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	49
PID 2320 wrote to memory of 1648	2320	041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\041d0a4b9b5a4145dc998535dcf008bc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\System\wZAwjfp.exe
  C:\Windows\System\wZAwjfp.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\sBpuAMV.exe
  C:\Windows\System\sBpuAMV.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\PBSvnZs.exe
  C:\Windows\System\PBSvnZs.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\bxlZbVZ.exe
  C:\Windows\System\bxlZbVZ.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\AuPMFCu.exe
  C:\Windows\System\AuPMFCu.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\ewpFxXz.exe
  C:\Windows\System\ewpFxXz.exe
  2⤵
  - Executes dropped EXE
  PID:2800
- C:\Windows\System\SdSXFbC.exe
  C:\Windows\System\SdSXFbC.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\nlrGGtA.exe
  C:\Windows\System\nlrGGtA.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\UxRMMXU.exe
  C:\Windows\System\UxRMMXU.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\gmsJHGR.exe
  C:\Windows\System\gmsJHGR.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\dHwHaPK.exe
  C:\Windows\System\dHwHaPK.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\TroKcRz.exe
  C:\Windows\System\TroKcRz.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\vabkPPi.exe
  C:\Windows\System\vabkPPi.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\DBOHtOb.exe
  C:\Windows\System\DBOHtOb.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\oVZjJIW.exe
  C:\Windows\System\oVZjJIW.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\IilaZFa.exe
  C:\Windows\System\IilaZFa.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\HTEpQSP.exe
  C:\Windows\System\HTEpQSP.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\sHtWLnR.exe
  C:\Windows\System\sHtWLnR.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\CZsbOwx.exe
  C:\Windows\System\CZsbOwx.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\UrRKRAS.exe
  C:\Windows\System\UrRKRAS.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\LDHAtKJ.exe
  C:\Windows\System\LDHAtKJ.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\ghGTRRO.exe
  C:\Windows\System\ghGTRRO.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\bGVcIfm.exe
  C:\Windows\System\bGVcIfm.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\hOVEwRs.exe
  C:\Windows\System\hOVEwRs.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\SakBrKx.exe
  C:\Windows\System\SakBrKx.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\ufjxaOR.exe
  C:\Windows\System\ufjxaOR.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\tsKtSUO.exe
  C:\Windows\System\tsKtSUO.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\djyDPYL.exe
  C:\Windows\System\djyDPYL.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\YGzoxkz.exe
  C:\Windows\System\YGzoxkz.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\RTjlmxh.exe
  C:\Windows\System\RTjlmxh.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\kxXutHN.exe
  C:\Windows\System\kxXutHN.exe
  2⤵
  - Executes dropped EXE
  PID:908
- C:\Windows\System\IjHyxok.exe
  C:\Windows\System\IjHyxok.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\SLzhnRR.exe
  C:\Windows\System\SLzhnRR.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\uAKRFba.exe
  C:\Windows\System\uAKRFba.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\FwahsFy.exe
  C:\Windows\System\FwahsFy.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\AFUlAJS.exe
  C:\Windows\System\AFUlAJS.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\asgRQpJ.exe
  C:\Windows\System\asgRQpJ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\DbIAyqk.exe
  C:\Windows\System\DbIAyqk.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\DzqNnBr.exe
  C:\Windows\System\DzqNnBr.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\bhtnYUV.exe
  C:\Windows\System\bhtnYUV.exe
  2⤵
  PID:468
- C:\Windows\System\fdFvMRh.exe
  C:\Windows\System\fdFvMRh.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\XPyiSag.exe
  C:\Windows\System\XPyiSag.exe
  2⤵
  PID:2068
- C:\Windows\System\WVdRDvE.exe
  C:\Windows\System\WVdRDvE.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\oiwNcbd.exe
  C:\Windows\System\oiwNcbd.exe
  2⤵
  PID:1712
- C:\Windows\System\HXMFQXS.exe
  C:\Windows\System\HXMFQXS.exe
  2⤵
  - Executes dropped EXE
  PID:344
- C:\Windows\System\VjdNmBD.exe
  C:\Windows\System\VjdNmBD.exe
  2⤵
  PID:2128
- C:\Windows\System\cfvlaXt.exe
  C:\Windows\System\cfvlaXt.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\NWiwUVX.exe
  C:\Windows\System\NWiwUVX.exe
  2⤵
  PID:1692
- C:\Windows\System\WLSATPw.exe
  C:\Windows\System\WLSATPw.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\NQcNFVn.exe
  C:\Windows\System\NQcNFVn.exe
  2⤵
  PID:1588
- C:\Windows\System\RImfRXq.exe
  C:\Windows\System\RImfRXq.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\QKvgqed.exe
  C:\Windows\System\QKvgqed.exe
  2⤵
  PID:3064
- C:\Windows\System\ECFqwxM.exe
  C:\Windows\System\ECFqwxM.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\nxiDBKs.exe
  C:\Windows\System\nxiDBKs.exe
  2⤵
  PID:2856
- C:\Windows\System\mRDyqaU.exe
  C:\Windows\System\mRDyqaU.exe
  2⤵
  - Executes dropped EXE
  PID:1900
- C:\Windows\System\aQhEUaZ.exe
  C:\Windows\System\aQhEUaZ.exe
  2⤵
  PID:1572
- C:\Windows\System\uElVsyR.exe
  C:\Windows\System\uElVsyR.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\GbBTsdX.exe
  C:\Windows\System\GbBTsdX.exe
  2⤵
  PID:2540
- C:\Windows\System\ckewOfb.exe
  C:\Windows\System\ckewOfb.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\LgTQhcV.exe
  C:\Windows\System\LgTQhcV.exe
  2⤵
  PID:2608
- C:\Windows\System\TuxOzHc.exe
  C:\Windows\System\TuxOzHc.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\taQSWtj.exe
  C:\Windows\System\taQSWtj.exe
  2⤵
  PID:2896
- C:\Windows\System\ShAYpXC.exe
  C:\Windows\System\ShAYpXC.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\QLdVlUN.exe
  C:\Windows\System\QLdVlUN.exe
  2⤵
  PID:2912
- C:\Windows\System\kSgqaOB.exe
  C:\Windows\System\kSgqaOB.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\DIfdtER.exe
  C:\Windows\System\DIfdtER.exe
  2⤵
  PID:2564
- C:\Windows\System\bxlFHrn.exe
  C:\Windows\System\bxlFHrn.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\WfMtEib.exe
  C:\Windows\System\WfMtEib.exe
  2⤵
  PID:2640
- C:\Windows\System\LzHRglt.exe
  C:\Windows\System\LzHRglt.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\gOUeaeQ.exe
  C:\Windows\System\gOUeaeQ.exe
  2⤵
  PID:1216
- C:\Windows\System\DpeyXop.exe
  C:\Windows\System\DpeyXop.exe
  2⤵
  - Executes dropped EXE
  PID:1056
- C:\Windows\System\KpiHHym.exe
  C:\Windows\System\KpiHHym.exe
  2⤵
  PID:2216
- C:\Windows\System\wPQKIUa.exe
  C:\Windows\System\wPQKIUa.exe
  2⤵
  - Executes dropped EXE
  PID:1664
- C:\Windows\System\ubkmoNi.exe
  C:\Windows\System\ubkmoNi.exe
  2⤵
  PID:2616
- C:\Windows\System\fPhLBEK.exe
  C:\Windows\System\fPhLBEK.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mkVkzpm.exe
  C:\Windows\System\mkVkzpm.exe
  2⤵
  PID:2644
- C:\Windows\System\LuQDQxg.exe
  C:\Windows\System\LuQDQxg.exe
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\System\pLfvrSM.exe
  C:\Windows\System\pLfvrSM.exe
  2⤵
  PID:2384
- C:\Windows\System\cxJwDsZ.exe
  C:\Windows\System\cxJwDsZ.exe
  2⤵
  - Executes dropped EXE
  PID:840
- C:\Windows\System\DsEEnQD.exe
  C:\Windows\System\DsEEnQD.exe
  2⤵
  PID:3056
- C:\Windows\System\IVCIrzr.exe
  C:\Windows\System\IVCIrzr.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\wsUbTWA.exe
  C:\Windows\System\wsUbTWA.exe
  2⤵
  PID:1860
- C:\Windows\System\RiOprqK.exe
  C:\Windows\System\RiOprqK.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\iEBNdxy.exe
  C:\Windows\System\iEBNdxy.exe
  2⤵
  PID:3012
- C:\Windows\System\xOPeLTu.exe
  C:\Windows\System\xOPeLTu.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\JtrRPfb.exe
  C:\Windows\System\JtrRPfb.exe
  2⤵
  PID:2016
- C:\Windows\System\PFslwLX.exe
  C:\Windows\System\PFslwLX.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\JcZuZQN.exe
  C:\Windows\System\JcZuZQN.exe
  2⤵
  PID:2760
- C:\Windows\System\FXKAtuY.exe
  C:\Windows\System\FXKAtuY.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\VLVtrYy.exe
  C:\Windows\System\VLVtrYy.exe
  2⤵
  PID:2960
- C:\Windows\System\ZngIZiT.exe
  C:\Windows\System\ZngIZiT.exe
  2⤵
  PID:1104
- C:\Windows\System\fHSWgnf.exe
  C:\Windows\System\fHSWgnf.exe
  2⤵
  PID:1072
- C:\Windows\System\cdhSiRF.exe
  C:\Windows\System\cdhSiRF.exe
  2⤵
  PID:1428
- C:\Windows\System\asnXRVp.exe
  C:\Windows\System\asnXRVp.exe
  2⤵
  PID:1152
- C:\Windows\System\eWugURV.exe
  C:\Windows\System\eWugURV.exe
  2⤵
  PID:636
- C:\Windows\System\SehcxwH.exe
  C:\Windows\System\SehcxwH.exe
  2⤵
  PID:788
- C:\Windows\System\vROEQzQ.exe
  C:\Windows\System\vROEQzQ.exe
  2⤵
  PID:2968
- C:\Windows\System\MOEZXTC.exe
  C:\Windows\System\MOEZXTC.exe
  2⤵
  PID:1540
- C:\Windows\System\RAIcMjL.exe
  C:\Windows\System\RAIcMjL.exe
  2⤵
  PID:2088
- C:\Windows\System\VJhCssf.exe
  C:\Windows\System\VJhCssf.exe
  2⤵
  PID:2576
- C:\Windows\System\yLSCiyS.exe
  C:\Windows\System\yLSCiyS.exe
  2⤵
  PID:592
- C:\Windows\System\jOdxyQU.exe
  C:\Windows\System\jOdxyQU.exe
  2⤵
  PID:704
- C:\Windows\System\kXqHiOj.exe
  C:\Windows\System\kXqHiOj.exe
  2⤵
  PID:1440
- C:\Windows\System\xcsRmAL.exe
  C:\Windows\System\xcsRmAL.exe
  2⤵
  PID:880
- C:\Windows\System\HbxeGus.exe
  C:\Windows\System\HbxeGus.exe
  2⤵
  PID:1684
- C:\Windows\System\dRYKlCz.exe
  C:\Windows\System\dRYKlCz.exe
  2⤵
  PID:2416
- C:\Windows\System\yenxEeP.exe
  C:\Windows\System\yenxEeP.exe
  2⤵
  PID:1656
- C:\Windows\System\DyCNsIB.exe
  C:\Windows\System\DyCNsIB.exe
  2⤵
  PID:1492
- C:\Windows\System\KSJKKhR.exe
  C:\Windows\System\KSJKKhR.exe
  2⤵
  PID:2036
- C:\Windows\System\TFCmYCr.exe
  C:\Windows\System\TFCmYCr.exe
  2⤵
  PID:884
- C:\Windows\System\CxKKPyr.exe
  C:\Windows\System\CxKKPyr.exe
  2⤵
  PID:2928
- C:\Windows\System\VBSNJta.exe
  C:\Windows\System\VBSNJta.exe
  2⤵
  PID:3004
- C:\Windows\System\hXLXlPM.exe
  C:\Windows\System\hXLXlPM.exe
  2⤵
  PID:1208
- C:\Windows\System\QEKvSPK.exe
  C:\Windows\System\QEKvSPK.exe
  2⤵
  PID:1420
- C:\Windows\System\ngPVKuD.exe
  C:\Windows\System\ngPVKuD.exe
  2⤵
  PID:2628
- C:\Windows\System\MVtFtSB.exe
  C:\Windows\System\MVtFtSB.exe
  2⤵
  PID:1272
- C:\Windows\System\bFukYAn.exe
  C:\Windows\System\bFukYAn.exe
  2⤵
  PID:3008
- C:\Windows\System\iniSizh.exe
  C:\Windows\System\iniSizh.exe
  2⤵
  PID:1476
- C:\Windows\System\SAfuTSb.exe
  C:\Windows\System\SAfuTSb.exe
  2⤵
  PID:1276
- C:\Windows\System\oxAIQdr.exe
  C:\Windows\System\oxAIQdr.exe
  2⤵
  PID:1888
- C:\Windows\System\FBwncrC.exe
  C:\Windows\System\FBwncrC.exe
  2⤵
  PID:1504
- C:\Windows\System\fMAufli.exe
  C:\Windows\System\fMAufli.exe
  2⤵
  PID:2852
- C:\Windows\System\dUSWPSG.exe
  C:\Windows\System\dUSWPSG.exe
  2⤵
  PID:340
- C:\Windows\System\hUsefFn.exe
  C:\Windows\System\hUsefFn.exe
  2⤵
  PID:3020
- C:\Windows\System\GDGcgou.exe
  C:\Windows\System\GDGcgou.exe
  2⤵
  PID:2080
- C:\Windows\System\fbNuTax.exe
  C:\Windows\System\fbNuTax.exe
  2⤵
  PID:1808
- C:\Windows\System\yFxnqBl.exe
  C:\Windows\System\yFxnqBl.exe
  2⤵
  PID:2688
- C:\Windows\System\fOhLTSz.exe
  C:\Windows\System\fOhLTSz.exe
  2⤵
  PID:1688
- C:\Windows\System\vdVVbSA.exe
  C:\Windows\System\vdVVbSA.exe
  2⤵
  PID:2932
- C:\Windows\System\VNsvrXd.exe
  C:\Windows\System\VNsvrXd.exe
  2⤵
  PID:2996
- C:\Windows\System\OcHRIUM.exe
  C:\Windows\System\OcHRIUM.exe
  2⤵
  PID:1568
- C:\Windows\System\ZUoLYsb.exe
  C:\Windows\System\ZUoLYsb.exe
  2⤵
  PID:1040
- C:\Windows\System\AuTCksF.exe
  C:\Windows\System\AuTCksF.exe
  2⤵
  PID:1724
- C:\Windows\System\LzMMxzA.exe
  C:\Windows\System\LzMMxzA.exe
  2⤵
  PID:2056
- C:\Windows\System\cNHavqD.exe
  C:\Windows\System\cNHavqD.exe
  2⤵
  PID:2588
- C:\Windows\System\zrYOFWl.exe
  C:\Windows\System\zrYOFWl.exe
  2⤵
  PID:1068
- C:\Windows\System\cgkwfHP.exe
  C:\Windows\System\cgkwfHP.exe
  2⤵
  PID:3084
- C:\Windows\System\puoJJrM.exe
  C:\Windows\System\puoJJrM.exe
  2⤵
  PID:3100
- C:\Windows\System\fVlCodg.exe
  C:\Windows\System\fVlCodg.exe
  2⤵
  PID:3120
- C:\Windows\System\dMkmQPQ.exe
  C:\Windows\System\dMkmQPQ.exe
  2⤵
  PID:3136
- C:\Windows\System\sfoKGXc.exe
  C:\Windows\System\sfoKGXc.exe
  2⤵
  PID:3152
- C:\Windows\System\gpZnuNK.exe
  C:\Windows\System\gpZnuNK.exe
  2⤵
  PID:3168
- C:\Windows\System\PpfOUTk.exe
  C:\Windows\System\PpfOUTk.exe
  2⤵
  PID:3184
- C:\Windows\System\HLdEKtd.exe
  C:\Windows\System\HLdEKtd.exe
  2⤵
  PID:3204
- C:\Windows\System\OzuQBef.exe
  C:\Windows\System\OzuQBef.exe
  2⤵
  PID:3220
- C:\Windows\System\iPWyMpA.exe
  C:\Windows\System\iPWyMpA.exe
  2⤵
  PID:3236
- C:\Windows\System\ClHQxZB.exe
  C:\Windows\System\ClHQxZB.exe
  2⤵
  PID:3256
- C:\Windows\System\RBdKDjh.exe
  C:\Windows\System\RBdKDjh.exe
  2⤵
  PID:3332
- C:\Windows\System\KTWDdYY.exe
  C:\Windows\System\KTWDdYY.exe
  2⤵
  PID:3356
- C:\Windows\System\awdMSOA.exe
  C:\Windows\System\awdMSOA.exe
  2⤵
  PID:3372
- C:\Windows\System\PkEIywr.exe
  C:\Windows\System\PkEIywr.exe
  2⤵
  PID:3392
- C:\Windows\System\fAsjivn.exe
  C:\Windows\System\fAsjivn.exe
  2⤵
  PID:3408
- C:\Windows\System\NHqoZUX.exe
  C:\Windows\System\NHqoZUX.exe
  2⤵
  PID:3424
- C:\Windows\System\GxGXcaU.exe
  C:\Windows\System\GxGXcaU.exe
  2⤵
  PID:3440
- C:\Windows\System\aAKiUqZ.exe
  C:\Windows\System\aAKiUqZ.exe
  2⤵
  PID:3456
- C:\Windows\System\tewCbhH.exe
  C:\Windows\System\tewCbhH.exe
  2⤵
  PID:3472
- C:\Windows\System\CAqSCOQ.exe
  C:\Windows\System\CAqSCOQ.exe
  2⤵
  PID:3488
- C:\Windows\System\MlEZWng.exe
  C:\Windows\System\MlEZWng.exe
  2⤵
  PID:3504
- C:\Windows\System\HMiaYSA.exe
  C:\Windows\System\HMiaYSA.exe
  2⤵
  PID:3520
- C:\Windows\System\DLXdWcD.exe
  C:\Windows\System\DLXdWcD.exe
  2⤵
  PID:3536
- C:\Windows\System\NqqzAbT.exe
  C:\Windows\System\NqqzAbT.exe
  2⤵
  PID:3552
- C:\Windows\System\BKNFJCb.exe
  C:\Windows\System\BKNFJCb.exe
  2⤵
  PID:3568
- C:\Windows\System\rlGClks.exe
  C:\Windows\System\rlGClks.exe
  2⤵
  PID:3584
- C:\Windows\System\qMoEXer.exe
  C:\Windows\System\qMoEXer.exe
  2⤵
  PID:3600
- C:\Windows\System\UKnpEfA.exe
  C:\Windows\System\UKnpEfA.exe
  2⤵
  PID:3616
- C:\Windows\System\kFMzfkQ.exe
  C:\Windows\System\kFMzfkQ.exe
  2⤵
  PID:3632
- C:\Windows\System\VfAdHtz.exe
  C:\Windows\System\VfAdHtz.exe
  2⤵
  PID:3648
- C:\Windows\System\eJxqIoH.exe
  C:\Windows\System\eJxqIoH.exe
  2⤵
  PID:3664
- C:\Windows\System\zkumdRP.exe
  C:\Windows\System\zkumdRP.exe
  2⤵
  PID:3680
- C:\Windows\System\CVAtASw.exe
  C:\Windows\System\CVAtASw.exe
  2⤵
  PID:3696
- C:\Windows\System\foBrphT.exe
  C:\Windows\System\foBrphT.exe
  2⤵
  PID:3712
- C:\Windows\System\iSlZLft.exe
  C:\Windows\System\iSlZLft.exe
  2⤵
  PID:3728
- C:\Windows\System\qigmIqV.exe
  C:\Windows\System\qigmIqV.exe
  2⤵
  PID:3744
- C:\Windows\System\eLNQVdh.exe
  C:\Windows\System\eLNQVdh.exe
  2⤵
  PID:3760
- C:\Windows\System\YDvoePR.exe
  C:\Windows\System\YDvoePR.exe
  2⤵
  PID:3776
- C:\Windows\System\mtmphtX.exe
  C:\Windows\System\mtmphtX.exe
  2⤵
  PID:3792
- C:\Windows\System\ZCtjyVz.exe
  C:\Windows\System\ZCtjyVz.exe
  2⤵
  PID:3808
- C:\Windows\System\KekMHWm.exe
  C:\Windows\System\KekMHWm.exe
  2⤵
  PID:3824
- C:\Windows\System\ztsKMHK.exe
  C:\Windows\System\ztsKMHK.exe
  2⤵
  PID:3840
- C:\Windows\System\BcUhTwI.exe
  C:\Windows\System\BcUhTwI.exe
  2⤵
  PID:3856
- C:\Windows\System\NqTIIXc.exe
  C:\Windows\System\NqTIIXc.exe
  2⤵
  PID:3872
- C:\Windows\System\RcjFIRl.exe
  C:\Windows\System\RcjFIRl.exe
  2⤵
  PID:3888
- C:\Windows\System\mirTtNk.exe
  C:\Windows\System\mirTtNk.exe
  2⤵
  PID:3904
- C:\Windows\System\dRPmRoS.exe
  C:\Windows\System\dRPmRoS.exe
  2⤵
  PID:3920
- C:\Windows\System\FZAppGX.exe
  C:\Windows\System\FZAppGX.exe
  2⤵
  PID:3936
- C:\Windows\System\lHTHyMT.exe
  C:\Windows\System\lHTHyMT.exe
  2⤵
  PID:3952
- C:\Windows\System\EOaDhVX.exe
  C:\Windows\System\EOaDhVX.exe
  2⤵
  PID:3968
- C:\Windows\System\XDicLDY.exe
  C:\Windows\System\XDicLDY.exe
  2⤵
  PID:3984
- C:\Windows\System\ApHmRQO.exe
  C:\Windows\System\ApHmRQO.exe
  2⤵
  PID:4000
- C:\Windows\System\tPTiFMp.exe
  C:\Windows\System\tPTiFMp.exe
  2⤵
  PID:4016
- C:\Windows\System\iwfayoE.exe
  C:\Windows\System\iwfayoE.exe
  2⤵
  PID:4032
- C:\Windows\System\EwMHiTd.exe
  C:\Windows\System\EwMHiTd.exe
  2⤵
  PID:4048
- C:\Windows\System\jlEUNEe.exe
  C:\Windows\System\jlEUNEe.exe
  2⤵
  PID:4064
- C:\Windows\System\pLRHtLr.exe
  C:\Windows\System\pLRHtLr.exe
  2⤵
  PID:4080
- C:\Windows\System\bXIDUVe.exe
  C:\Windows\System\bXIDUVe.exe
  2⤵
  PID:2496
- C:\Windows\System\cEZJCwD.exe
  C:\Windows\System\cEZJCwD.exe
  2⤵
  PID:3092
- C:\Windows\System\vLJEALt.exe
  C:\Windows\System\vLJEALt.exe
  2⤵
  PID:3032
- C:\Windows\System\OghWeeH.exe
  C:\Windows\System\OghWeeH.exe
  2⤵
  PID:3192
- C:\Windows\System\tFVDmZp.exe
  C:\Windows\System\tFVDmZp.exe
  2⤵
  PID:3232
- C:\Windows\System\SKhEjKd.exe
  C:\Windows\System\SKhEjKd.exe
  2⤵
  PID:3276
- C:\Windows\System\VBNiwPf.exe
  C:\Windows\System\VBNiwPf.exe
  2⤵
  PID:3292
- C:\Windows\System\DmGPzsf.exe
  C:\Windows\System\DmGPzsf.exe
  2⤵
  PID:2892
- C:\Windows\System\NsIgndL.exe
  C:\Windows\System\NsIgndL.exe
  2⤵
  PID:3364
- C:\Windows\System\QMDIPWp.exe
  C:\Windows\System\QMDIPWp.exe
  2⤵
  PID:2648
- C:\Windows\System\gHgaAcV.exe
  C:\Windows\System\gHgaAcV.exe
  2⤵
  PID:3432
- C:\Windows\System\yrMzQYS.exe
  C:\Windows\System\yrMzQYS.exe
  2⤵
  PID:3468
- C:\Windows\System\ToCYOqd.exe
  C:\Windows\System\ToCYOqd.exe
  2⤵
  PID:3500
- C:\Windows\System\WMObcjw.exe
  C:\Windows\System\WMObcjw.exe
  2⤵
  PID:3516
- C:\Windows\System\vUbQwHa.exe
  C:\Windows\System\vUbQwHa.exe
  2⤵
  PID:3564
- C:\Windows\System\ecXAxfF.exe
  C:\Windows\System\ecXAxfF.exe
  2⤵
  PID:3608
- C:\Windows\System\KNjaeCc.exe
  C:\Windows\System\KNjaeCc.exe
  2⤵
  PID:3640
- C:\Windows\System\kOezEUE.exe
  C:\Windows\System\kOezEUE.exe
  2⤵
  PID:3672
- C:\Windows\System\hdhnXwv.exe
  C:\Windows\System\hdhnXwv.exe
  2⤵
  PID:3704
- C:\Windows\System\LKMgLrY.exe
  C:\Windows\System\LKMgLrY.exe
  2⤵
  PID:3752
- C:\Windows\System\nyVvZvy.exe
  C:\Windows\System\nyVvZvy.exe
  2⤵
  PID:3784
- C:\Windows\System\PKeOrub.exe
  C:\Windows\System\PKeOrub.exe
  2⤵
  PID:2776
- C:\Windows\System\ArSxrYh.exe
  C:\Windows\System\ArSxrYh.exe
  2⤵
  PID:2604
- C:\Windows\System\aZmLCUr.exe
  C:\Windows\System\aZmLCUr.exe
  2⤵
  PID:3864
- C:\Windows\System\mfmSsLo.exe
  C:\Windows\System\mfmSsLo.exe
  2⤵
  PID:3896
- C:\Windows\System\LxLrcTC.exe
  C:\Windows\System\LxLrcTC.exe
  2⤵
  PID:3928
- C:\Windows\System\KOKsrqU.exe
  C:\Windows\System\KOKsrqU.exe
  2⤵
  PID:3976
- C:\Windows\System\NFWDOqt.exe
  C:\Windows\System\NFWDOqt.exe
  2⤵
  PID:4012
- C:\Windows\System\FZjJbQv.exe
  C:\Windows\System\FZjJbQv.exe
  2⤵
  PID:4044
- C:\Windows\System\dZnVPPN.exe
  C:\Windows\System\dZnVPPN.exe
  2⤵
  PID:4076
- C:\Windows\System\vIrKejM.exe
  C:\Windows\System\vIrKejM.exe
  2⤵
  PID:3096
- C:\Windows\System\YDRekVd.exe
  C:\Windows\System\YDRekVd.exe
  2⤵
  PID:2412
- C:\Windows\System\LzPZWsr.exe
  C:\Windows\System\LzPZWsr.exe
  2⤵
  PID:2740
- C:\Windows\System\jSEiEoq.exe
  C:\Windows\System\jSEiEoq.exe
  2⤵
  PID:1960
- C:\Windows\System\lIPvabg.exe
  C:\Windows\System\lIPvabg.exe
  2⤵
  PID:3284
- C:\Windows\System\hUfdLiy.exe
  C:\Windows\System\hUfdLiy.exe
  2⤵
  PID:2716
- C:\Windows\System\qayASaa.exe
  C:\Windows\System\qayASaa.exe
  2⤵
  PID:3352
- C:\Windows\System\kXKBeEg.exe
  C:\Windows\System\kXKBeEg.exe
  2⤵
  PID:3308
- C:\Windows\System\stYPvCp.exe
  C:\Windows\System\stYPvCp.exe
  2⤵
  PID:2888
- C:\Windows\System\ZuQvIZp.exe
  C:\Windows\System\ZuQvIZp.exe
  2⤵
  PID:2808
- C:\Windows\System\GsNkKzo.exe
  C:\Windows\System\GsNkKzo.exe
  2⤵
  PID:2132
- C:\Windows\System\lyhDrfA.exe
  C:\Windows\System\lyhDrfA.exe
  2⤵
  PID:2580
- C:\Windows\System\tEnoRLy.exe
  C:\Windows\System\tEnoRLy.exe
  2⤵
  PID:2472
- C:\Windows\System\JQwncqj.exe
  C:\Windows\System\JQwncqj.exe
  2⤵
  PID:1280
- C:\Windows\System\dYgmDJO.exe
  C:\Windows\System\dYgmDJO.exe
  2⤵
  PID:1348
- C:\Windows\System\yuEfaIZ.exe
  C:\Windows\System\yuEfaIZ.exe
  2⤵
  PID:3108
- C:\Windows\System\BNUEEkK.exe
  C:\Windows\System\BNUEEkK.exe
  2⤵
  PID:3148
- C:\Windows\System\lutbksg.exe
  C:\Windows\System\lutbksg.exe
  2⤵
  PID:3244
- C:\Windows\System\KUwypNG.exe
  C:\Windows\System\KUwypNG.exe
  2⤵
  PID:1788
- C:\Windows\System\ejMvKXe.exe
  C:\Windows\System\ejMvKXe.exe
  2⤵
  PID:2428
- C:\Windows\System\FxHvgxK.exe
  C:\Windows\System\FxHvgxK.exe
  2⤵
  PID:1784
- C:\Windows\System\QIhwUZF.exe
  C:\Windows\System\QIhwUZF.exe
  2⤵
  PID:2028
- C:\Windows\System\WRJEihR.exe
  C:\Windows\System\WRJEihR.exe
  2⤵
  PID:3416
- C:\Windows\System\ARAXqmu.exe
  C:\Windows\System\ARAXqmu.exe
  2⤵
  PID:3036
- C:\Windows\System\gNlUcCG.exe
  C:\Windows\System\gNlUcCG.exe
  2⤵
  PID:3480
- C:\Windows\System\ZkZzKAR.exe
  C:\Windows\System\ZkZzKAR.exe
  2⤵
  PID:1864
- C:\Windows\System\xxYXmzQ.exe
  C:\Windows\System\xxYXmzQ.exe
  2⤵
  PID:3548
- C:\Windows\System\lVOkRap.exe
  C:\Windows\System\lVOkRap.exe
  2⤵
  PID:3624
- C:\Windows\System\PGqiFUW.exe
  C:\Windows\System\PGqiFUW.exe
  2⤵
  PID:3656
- C:\Windows\System\qDSDFEt.exe
  C:\Windows\System\qDSDFEt.exe
  2⤵
  PID:3676
- C:\Windows\System\mPDRAht.exe
  C:\Windows\System\mPDRAht.exe
  2⤵
  PID:3724
- C:\Windows\System\ETqGUMx.exe
  C:\Windows\System\ETqGUMx.exe
  2⤵
  PID:3756
- C:\Windows\System\TkzYKcf.exe
  C:\Windows\System\TkzYKcf.exe
  2⤵
  PID:3800
- C:\Windows\System\WEQaoKK.exe
  C:\Windows\System\WEQaoKK.exe
  2⤵
  PID:3836
- C:\Windows\System\utxoVSJ.exe
  C:\Windows\System\utxoVSJ.exe
  2⤵
  PID:2820
- C:\Windows\System\blDfaCh.exe
  C:\Windows\System\blDfaCh.exe
  2⤵
  PID:3964
- C:\Windows\System\tVXiUVf.exe
  C:\Windows\System\tVXiUVf.exe
  2⤵
  PID:2984
- C:\Windows\System\FwDBdTR.exe
  C:\Windows\System\FwDBdTR.exe
  2⤵
  PID:4072
- C:\Windows\System\qgwtyjt.exe
  C:\Windows\System\qgwtyjt.exe
  2⤵
  PID:2920
- C:\Windows\System\knpQdhH.exe
  C:\Windows\System\knpQdhH.exe
  2⤵
  PID:112
- C:\Windows\System\lGgODAX.exe
  C:\Windows\System\lGgODAX.exe
  2⤵
  PID:2140
- C:\Windows\System\rEoIENz.exe
  C:\Windows\System\rEoIENz.exe
  2⤵
  PID:3176
- C:\Windows\System\exSgPmH.exe
  C:\Windows\System\exSgPmH.exe
  2⤵
  PID:3216
- C:\Windows\System\bMIQJoN.exe
  C:\Windows\System\bMIQJoN.exe
  2⤵
  PID:3448
- C:\Windows\System\ujeKNJq.exe
  C:\Windows\System\ujeKNJq.exe
  2⤵
  PID:3512
- C:\Windows\System\VkAcQGt.exe
  C:\Windows\System\VkAcQGt.exe
  2⤵
  PID:3788
- C:\Windows\System\zXWKyMx.exe
  C:\Windows\System\zXWKyMx.exe
  2⤵
  PID:3852
- C:\Windows\System\PbWRHks.exe
  C:\Windows\System\PbWRHks.exe
  2⤵
  PID:3128
- C:\Windows\System\hJtmxVg.exe
  C:\Windows\System\hJtmxVg.exe
  2⤵
  PID:2360
- C:\Windows\System\dvAlPBP.exe
  C:\Windows\System\dvAlPBP.exe
  2⤵
  PID:2520
- C:\Windows\System\fzyfEII.exe
  C:\Windows\System\fzyfEII.exe
  2⤵
  PID:2380
- C:\Windows\System\PidNmep.exe
  C:\Windows\System\PidNmep.exe
  2⤵
  PID:1936
- C:\Windows\System\yoKltkP.exe
  C:\Windows\System\yoKltkP.exe
  2⤵
  PID:3076
- C:\Windows\System\YlFnHmH.exe
  C:\Windows\System\YlFnHmH.exe
  2⤵
  PID:2772
- C:\Windows\System\DQXqzYc.exe
  C:\Windows\System\DQXqzYc.exe
  2⤵
  PID:3228
- C:\Windows\System\pWHsgQn.exe
  C:\Windows\System\pWHsgQn.exe
  2⤵
  PID:3312
- C:\Windows\System\APUOgpS.exe
  C:\Windows\System\APUOgpS.exe
  2⤵
  PID:3384
- C:\Windows\System\nWWfrRg.exe
  C:\Windows\System\nWWfrRg.exe
  2⤵
  PID:3916
- C:\Windows\System\FPaBvPg.exe
  C:\Windows\System\FPaBvPg.exe
  2⤵
  PID:3816
- C:\Windows\System\GUvBjUs.exe
  C:\Windows\System\GUvBjUs.exe
  2⤵
  PID:2368
- C:\Windows\System\xdNqImh.exe
  C:\Windows\System\xdNqImh.exe
  2⤵
  PID:2096
- C:\Windows\System\XJhfvHT.exe
  C:\Windows\System\XJhfvHT.exe
  2⤵
  PID:2376
- C:\Windows\System\zSZZQEM.exe
  C:\Windows\System\zSZZQEM.exe
  2⤵
  PID:2592
- C:\Windows\System\JpHTzaD.exe
  C:\Windows\System\JpHTzaD.exe
  2⤵
  PID:3288
- C:\Windows\System\kkdeKyl.exe
  C:\Windows\System\kkdeKyl.exe
  2⤵
  PID:3324
- C:\Windows\System\FWQraMs.exe
  C:\Windows\System\FWQraMs.exe
  2⤵
  PID:3348
- C:\Windows\System\FrzAqZe.exe
  C:\Windows\System\FrzAqZe.exe
  2⤵
  PID:3768
- C:\Windows\System\oYVxXZk.exe
  C:\Windows\System\oYVxXZk.exe
  2⤵
  PID:1944
- C:\Windows\System\PHSUcfI.exe
  C:\Windows\System\PHSUcfI.exe
  2⤵
  PID:2280
- C:\Windows\System\WCYNCFs.exe
  C:\Windows\System\WCYNCFs.exe
  2⤵
  PID:1244
- C:\Windows\System\bVSAskn.exe
  C:\Windows\System\bVSAskn.exe
  2⤵
  PID:3200
- C:\Windows\System\xHabcXu.exe
  C:\Windows\System\xHabcXu.exe
  2⤵
  PID:2816
- C:\Windows\System\RtbtDhJ.exe
  C:\Windows\System\RtbtDhJ.exe
  2⤵
  PID:3080
- C:\Windows\System\WxQLTUM.exe
  C:\Windows\System\WxQLTUM.exe
  2⤵
  PID:3144
- C:\Windows\System\YWZkUxT.exe
  C:\Windows\System\YWZkUxT.exe
  2⤵
  PID:1332
- C:\Windows\System\BSbIeha.exe
  C:\Windows\System\BSbIeha.exe
  2⤵
  PID:1624
- C:\Windows\System\iopFvoB.exe
  C:\Windows\System\iopFvoB.exe
  2⤵
  PID:2668
- C:\Windows\System\MVhPdIs.exe
  C:\Windows\System\MVhPdIs.exe
  2⤵
  PID:4060
- C:\Windows\System\jAOBrBe.exe
  C:\Windows\System\jAOBrBe.exe
  2⤵
  PID:4100
- C:\Windows\System\omhoXHn.exe
  C:\Windows\System\omhoXHn.exe
  2⤵
  PID:4140
- C:\Windows\System\NUUJQVT.exe
  C:\Windows\System\NUUJQVT.exe
  2⤵
  PID:4160
- C:\Windows\System\CLFiJRm.exe
  C:\Windows\System\CLFiJRm.exe
  2⤵
  PID:4176
- C:\Windows\System\SxqAPuz.exe
  C:\Windows\System\SxqAPuz.exe
  2⤵
  PID:4192
- C:\Windows\System\vVdhosn.exe
  C:\Windows\System\vVdhosn.exe
  2⤵
  PID:4208
- C:\Windows\System\fuuIYjM.exe
  C:\Windows\System\fuuIYjM.exe
  2⤵
  PID:4224
- C:\Windows\System\TAEtzjv.exe
  C:\Windows\System\TAEtzjv.exe
  2⤵
  PID:4240
- C:\Windows\System\CGYKhac.exe
  C:\Windows\System\CGYKhac.exe
  2⤵
  PID:4256
- C:\Windows\System\dDpnbkn.exe
  C:\Windows\System\dDpnbkn.exe
  2⤵
  PID:4272
- C:\Windows\System\kETcaMl.exe
  C:\Windows\System\kETcaMl.exe
  2⤵
  PID:4288
- C:\Windows\System\DqWiNec.exe
  C:\Windows\System\DqWiNec.exe
  2⤵
  PID:4304
- C:\Windows\System\QaVdIVj.exe
  C:\Windows\System\QaVdIVj.exe
  2⤵
  PID:4320
- C:\Windows\System\YAGHdgF.exe
  C:\Windows\System\YAGHdgF.exe
  2⤵
  PID:4336
- C:\Windows\System\kYFAaog.exe
  C:\Windows\System\kYFAaog.exe
  2⤵
  PID:4352
- C:\Windows\System\QvNNYeb.exe
  C:\Windows\System\QvNNYeb.exe
  2⤵
  PID:4428
- C:\Windows\System\KaQJMkS.exe
  C:\Windows\System\KaQJMkS.exe
  2⤵
  PID:4448
- C:\Windows\System\eInPzZG.exe
  C:\Windows\System\eInPzZG.exe
  2⤵
  PID:4464
- C:\Windows\System\nyUxVdv.exe
  C:\Windows\System\nyUxVdv.exe
  2⤵
  PID:4484
- C:\Windows\System\Klbweod.exe
  C:\Windows\System\Klbweod.exe
  2⤵
  PID:4520
- C:\Windows\System\PYoIuqO.exe
  C:\Windows\System\PYoIuqO.exe
  2⤵
  PID:4548
- C:\Windows\System\ihrGolj.exe
  C:\Windows\System\ihrGolj.exe
  2⤵
  PID:4564
- C:\Windows\System\olEyUrW.exe
  C:\Windows\System\olEyUrW.exe
  2⤵
  PID:4580
- C:\Windows\System\MQfEyhH.exe
  C:\Windows\System\MQfEyhH.exe
  2⤵
  PID:4596
- C:\Windows\System\Tjkvgel.exe
  C:\Windows\System\Tjkvgel.exe
  2⤵
  PID:4616
- C:\Windows\System\bqJIzoJ.exe
  C:\Windows\System\bqJIzoJ.exe
  2⤵
  PID:4644
- C:\Windows\System\aWTBcch.exe
  C:\Windows\System\aWTBcch.exe
  2⤵
  PID:4660
- C:\Windows\System\dcsruuc.exe
  C:\Windows\System\dcsruuc.exe
  2⤵
  PID:4688
- C:\Windows\System\lXDDOdw.exe
  C:\Windows\System\lXDDOdw.exe
  2⤵
  PID:4704
- C:\Windows\System\aXmodKB.exe
  C:\Windows\System\aXmodKB.exe
  2⤵
  PID:4720
- C:\Windows\System\OiLQDth.exe
  C:\Windows\System\OiLQDth.exe
  2⤵
  PID:4740
- C:\Windows\System\kQdWvFz.exe
  C:\Windows\System\kQdWvFz.exe
  2⤵
  PID:4760
- C:\Windows\System\DRzqNfR.exe
  C:\Windows\System\DRzqNfR.exe
  2⤵
  PID:4876
- C:\Windows\System\eXpNuVy.exe
  C:\Windows\System\eXpNuVy.exe
  2⤵
  PID:4892
- C:\Windows\System\fmTLlBN.exe
  C:\Windows\System\fmTLlBN.exe
  2⤵
  PID:4912
- C:\Windows\System\BHzBQyO.exe
  C:\Windows\System\BHzBQyO.exe
  2⤵
  PID:4928
- C:\Windows\System\viQjSZq.exe
  C:\Windows\System\viQjSZq.exe
  2⤵
  PID:4944
- C:\Windows\System\OOpvHCK.exe
  C:\Windows\System\OOpvHCK.exe
  2⤵
  PID:4960
- C:\Windows\System\luDCDQp.exe
  C:\Windows\System\luDCDQp.exe
  2⤵
  PID:4976
- C:\Windows\System\hbqglrN.exe
  C:\Windows\System\hbqglrN.exe
  2⤵
  PID:4996
- C:\Windows\System\LaXafXd.exe
  C:\Windows\System\LaXafXd.exe
  2⤵
  PID:5012
- C:\Windows\System\RjHJFeB.exe
  C:\Windows\System\RjHJFeB.exe
  2⤵
  PID:5028
- C:\Windows\System\YifAqfu.exe
  C:\Windows\System\YifAqfu.exe
  2⤵
  PID:5044
- C:\Windows\System\eRkFxhV.exe
  C:\Windows\System\eRkFxhV.exe
  2⤵
  PID:5060
- C:\Windows\System\FxFbrDy.exe
  C:\Windows\System\FxFbrDy.exe
  2⤵
  PID:5080
- C:\Windows\System\EOUPseq.exe
  C:\Windows\System\EOUPseq.exe
  2⤵
  PID:5096
- C:\Windows\System\lWDRNFj.exe
  C:\Windows\System\lWDRNFj.exe
  2⤵
  PID:5112
- C:\Windows\System\JNGzLNn.exe
  C:\Windows\System\JNGzLNn.exe
  2⤵
  PID:2828
- C:\Windows\System\NGgKrpI.exe
  C:\Windows\System\NGgKrpI.exe
  2⤵
  PID:3900
- C:\Windows\System\wriQIZz.exe
  C:\Windows\System\wriQIZz.exe
  2⤵
  PID:4116
- C:\Windows\System\mdcfgSd.exe
  C:\Windows\System\mdcfgSd.exe
  2⤵
  PID:4128
- C:\Windows\System\oOeqEuF.exe
  C:\Windows\System\oOeqEuF.exe
  2⤵
  PID:4168
- C:\Windows\System\dBupzFr.exe
  C:\Windows\System\dBupzFr.exe
  2⤵
  PID:4200
- C:\Windows\System\NefUUfy.exe
  C:\Windows\System\NefUUfy.exe
  2⤵
  PID:4368
- C:\Windows\System\oUMIifO.exe
  C:\Windows\System\oUMIifO.exe
  2⤵
  PID:4252
- C:\Windows\System\bAKQWeN.exe
  C:\Windows\System\bAKQWeN.exe
  2⤵
  PID:4360
- C:\Windows\System\EwSsTsA.exe
  C:\Windows\System\EwSsTsA.exe
  2⤵
  PID:4264
- C:\Windows\System\PxNTGup.exe
  C:\Windows\System\PxNTGup.exe
  2⤵
  PID:4296
- C:\Windows\System\xVfHJVZ.exe
  C:\Windows\System\xVfHJVZ.exe
  2⤵
  PID:4396
- C:\Windows\System\FFOdLzc.exe
  C:\Windows\System\FFOdLzc.exe
  2⤵
  PID:4400
- C:\Windows\System\ItEKxXT.exe
  C:\Windows\System\ItEKxXT.exe
  2⤵
  PID:4424
- C:\Windows\System\MVViCcr.exe
  C:\Windows\System\MVViCcr.exe
  2⤵
  PID:4460
- C:\Windows\System\lpeURQw.exe
  C:\Windows\System\lpeURQw.exe
  2⤵
  PID:4528
- C:\Windows\System\iqbLcco.exe
  C:\Windows\System\iqbLcco.exe
  2⤵
  PID:4536
- C:\Windows\System\BFWZIHy.exe
  C:\Windows\System\BFWZIHy.exe
  2⤵
  PID:4508
- C:\Windows\System\lvyXsZT.exe
  C:\Windows\System\lvyXsZT.exe
  2⤵
  PID:4640
- C:\Windows\System\hGarjMc.exe
  C:\Windows\System\hGarjMc.exe
  2⤵
  PID:4516
- C:\Windows\System\iSHmnrW.exe
  C:\Windows\System\iSHmnrW.exe
  2⤵
  PID:4696
- C:\Windows\System\NrsJlDJ.exe
  C:\Windows\System\NrsJlDJ.exe
  2⤵
  PID:4732
- C:\Windows\System\hWsDjmr.exe
  C:\Windows\System\hWsDjmr.exe
  2⤵
  PID:4420
- C:\Windows\System\zoEMRMs.exe
  C:\Windows\System\zoEMRMs.exe
  2⤵
  PID:4856
- C:\Windows\System\qYkCUGx.exe
  C:\Windows\System\qYkCUGx.exe
  2⤵
  PID:4884
- C:\Windows\System\fEIgutT.exe
  C:\Windows\System\fEIgutT.exe
  2⤵
  PID:4936
- C:\Windows\System\UvtRNSR.exe
  C:\Windows\System\UvtRNSR.exe
  2⤵
  PID:5004
- C:\Windows\System\ojncdjD.exe
  C:\Windows\System\ojncdjD.exe
  2⤵
  PID:4988
- C:\Windows\System\MSKTRVc.exe
  C:\Windows\System\MSKTRVc.exe
  2⤵
  PID:5076
- C:\Windows\System\yNWmVvX.exe
  C:\Windows\System\yNWmVvX.exe
  2⤵
  PID:892
- C:\Windows\System\eSsAHvn.exe
  C:\Windows\System\eSsAHvn.exe
  2⤵
  PID:4392
- C:\Windows\System\EfrNMbX.exe
  C:\Windows\System\EfrNMbX.exe
  2⤵
  PID:4268
- C:\Windows\System\GvnXVFJ.exe
  C:\Windows\System\GvnXVFJ.exe
  2⤵
  PID:4416
- C:\Windows\System\eUuSikS.exe
  C:\Windows\System\eUuSikS.exe
  2⤵
  PID:4676
- C:\Windows\System\lOEwyqt.exe
  C:\Windows\System\lOEwyqt.exe
  2⤵
  PID:5020
- C:\Windows\System\LoKeSlC.exe
  C:\Windows\System\LoKeSlC.exe
  2⤵
  PID:4112
- C:\Windows\System\MctQMqq.exe
  C:\Windows\System\MctQMqq.exe
  2⤵
  PID:4284
- C:\Windows\System\rUnbjxH.exe
  C:\Windows\System\rUnbjxH.exe
  2⤵
  PID:4624
- C:\Windows\System\VYAKkuU.exe
  C:\Windows\System\VYAKkuU.exe
  2⤵
  PID:2300
- C:\Windows\System\mToFdIX.exe
  C:\Windows\System\mToFdIX.exe
  2⤵
  PID:4328
- C:\Windows\System\wUfQdcT.exe
  C:\Windows\System\wUfQdcT.exe
  2⤵
  PID:4440
- C:\Windows\System\xFJpVmH.exe
  C:\Windows\System\xFJpVmH.exe
  2⤵
  PID:4608
- C:\Windows\System\pyvVSXN.exe
  C:\Windows\System\pyvVSXN.exe
  2⤵
  PID:4628
- C:\Windows\System\jKQOjZD.exe
  C:\Windows\System\jKQOjZD.exe
  2⤵
  PID:4700
- C:\Windows\System\lxIpTiH.exe
  C:\Windows\System\lxIpTiH.exe
  2⤵
  PID:4848
- C:\Windows\System\WjfRGNa.exe
  C:\Windows\System\WjfRGNa.exe
  2⤵
  PID:4984
- C:\Windows\System\SapISbH.exe
  C:\Windows\System\SapISbH.exe
  2⤵
  PID:4772
- C:\Windows\System\cCIheRR.exe
  C:\Windows\System\cCIheRR.exe
  2⤵
  PID:5072
- C:\Windows\System\PFzFDiZ.exe
  C:\Windows\System\PFzFDiZ.exe
  2⤵
  PID:5036
- C:\Windows\System\fPNaxfY.exe
  C:\Windows\System\fPNaxfY.exe
  2⤵
  PID:4800
- C:\Windows\System\kdosxdE.exe
  C:\Windows\System\kdosxdE.exe
  2⤵
  PID:4816
- C:\Windows\System\JSAFfqR.exe
  C:\Windows\System\JSAFfqR.exe
  2⤵
  PID:4836
- C:\Windows\System\oUmzOHi.exe
  C:\Windows\System\oUmzOHi.exe
  2⤵
  PID:4412
- C:\Windows\System\BjehQpY.exe
  C:\Windows\System\BjehQpY.exe
  2⤵
  PID:4376
- C:\Windows\System\uCWaFLS.exe
  C:\Windows\System\uCWaFLS.exe
  2⤵
  PID:4236
- C:\Windows\System\ytKllXr.exe
  C:\Windows\System\ytKllXr.exe
  2⤵
  PID:4476
- C:\Windows\System\qINRENi.exe
  C:\Windows\System\qINRENi.exe
  2⤵
  PID:4512
- C:\Windows\System\MPnberi.exe
  C:\Windows\System\MPnberi.exe
  2⤵
  PID:4312
- C:\Windows\System\jtmdCMM.exe
  C:\Windows\System\jtmdCMM.exe
  2⤵
  PID:4456
- C:\Windows\System\cZbrrkW.exe
  C:\Windows\System\cZbrrkW.exe
  2⤵
  PID:4992
- C:\Windows\System\kSipjxQ.exe
  C:\Windows\System\kSipjxQ.exe
  2⤵
  PID:4652
- C:\Windows\System\PYbznyM.exe
  C:\Windows\System\PYbznyM.exe
  2⤵
  PID:4612
- C:\Windows\System\frCqLWy.exe
  C:\Windows\System\frCqLWy.exe
  2⤵
  PID:4680
- C:\Windows\System\gkwsyIb.exe
  C:\Windows\System\gkwsyIb.exe
  2⤵
  PID:5068
- C:\Windows\System\DIQXtle.exe
  C:\Windows\System\DIQXtle.exe
  2⤵
  PID:5128
- C:\Windows\System\DSdjYAo.exe
  C:\Windows\System\DSdjYAo.exe
  2⤵
  PID:5216
- C:\Windows\System\pusPxXM.exe
  C:\Windows\System\pusPxXM.exe
  2⤵
  PID:5232
- C:\Windows\System\BBUJEoM.exe
  C:\Windows\System\BBUJEoM.exe
  2⤵
  PID:5248
- C:\Windows\System\xAvbnse.exe
  C:\Windows\System\xAvbnse.exe
  2⤵
  PID:5268
- C:\Windows\System\rNEZsIZ.exe
  C:\Windows\System\rNEZsIZ.exe
  2⤵
  PID:5284
- C:\Windows\System\CEKMXuu.exe
  C:\Windows\System\CEKMXuu.exe
  2⤵
  PID:5300
- C:\Windows\System\COCyRyZ.exe
  C:\Windows\System\COCyRyZ.exe
  2⤵
  PID:5316
- C:\Windows\System\hBRBUkV.exe
  C:\Windows\System\hBRBUkV.exe
  2⤵
  PID:5336
- C:\Windows\System\eykFFhd.exe
  C:\Windows\System\eykFFhd.exe
  2⤵
  PID:5352
- C:\Windows\System\wcLmlkl.exe
  C:\Windows\System\wcLmlkl.exe
  2⤵
  PID:5368
- C:\Windows\System\uVEaBfF.exe
  C:\Windows\System\uVEaBfF.exe
  2⤵
  PID:5384
- C:\Windows\System\qDLmbdN.exe
  C:\Windows\System\qDLmbdN.exe
  2⤵
  PID:5404
- C:\Windows\System\SixnXIT.exe
  C:\Windows\System\SixnXIT.exe
  2⤵
  PID:5420
- C:\Windows\System\sHtlpVX.exe
  C:\Windows\System\sHtlpVX.exe
  2⤵
  PID:5436
- C:\Windows\System\foCSIkd.exe
  C:\Windows\System\foCSIkd.exe
  2⤵
  PID:5452
- C:\Windows\System\KKevilH.exe
  C:\Windows\System\KKevilH.exe
  2⤵
  PID:5468
- C:\Windows\System\cNftEnM.exe
  C:\Windows\System\cNftEnM.exe
  2⤵
  PID:5488
- C:\Windows\System\HFOBpwg.exe
  C:\Windows\System\HFOBpwg.exe
  2⤵
  PID:5508
- C:\Windows\System\BkZiwso.exe
  C:\Windows\System\BkZiwso.exe
  2⤵
  PID:5524
- C:\Windows\System\YKCSAov.exe
  C:\Windows\System\YKCSAov.exe
  2⤵
  PID:5540
- C:\Windows\System\yrFYTjg.exe
  C:\Windows\System\yrFYTjg.exe
  2⤵
  PID:5556
- C:\Windows\System\OQLeJHG.exe
  C:\Windows\System\OQLeJHG.exe
  2⤵
  PID:5572
- C:\Windows\System\hoFPRld.exe
  C:\Windows\System\hoFPRld.exe
  2⤵
  PID:5592
- C:\Windows\System\BvqPHXN.exe
  C:\Windows\System\BvqPHXN.exe
  2⤵
  PID:5608
- C:\Windows\System\XtBbNWV.exe
  C:\Windows\System\XtBbNWV.exe
  2⤵
  PID:5624
- C:\Windows\System\atsVuTx.exe
  C:\Windows\System\atsVuTx.exe
  2⤵
  PID:5640
- C:\Windows\System\sOPZPZY.exe
  C:\Windows\System\sOPZPZY.exe
  2⤵
  PID:5660
- C:\Windows\System\DDZblDx.exe
  C:\Windows\System\DDZblDx.exe
  2⤵
  PID:5764
- C:\Windows\System\pVNqjQQ.exe
  C:\Windows\System\pVNqjQQ.exe
  2⤵
  PID:5780
- C:\Windows\System\pnXRcPV.exe
  C:\Windows\System\pnXRcPV.exe
  2⤵
  PID:5796
- C:\Windows\System\yZYBhar.exe
  C:\Windows\System\yZYBhar.exe
  2⤵
  PID:5812
- C:\Windows\System\sqZKoKy.exe
  C:\Windows\System\sqZKoKy.exe
  2⤵
  PID:5828
- C:\Windows\System\SyVgCOd.exe
  C:\Windows\System\SyVgCOd.exe
  2⤵
  PID:5844
- C:\Windows\System\bCrSeKA.exe
  C:\Windows\System\bCrSeKA.exe
  2⤵
  PID:5860
- C:\Windows\System\LSoAyld.exe
  C:\Windows\System\LSoAyld.exe
  2⤵
  PID:5876
- C:\Windows\System\tJpXvUZ.exe
  C:\Windows\System\tJpXvUZ.exe
  2⤵
  PID:5892
- C:\Windows\System\QmpkUVZ.exe
  C:\Windows\System\QmpkUVZ.exe
  2⤵
  PID:5908
- C:\Windows\System\QclKekI.exe
  C:\Windows\System\QclKekI.exe
  2⤵
  PID:5924
- C:\Windows\System\SSHKFNg.exe
  C:\Windows\System\SSHKFNg.exe
  2⤵
  PID:5940
- C:\Windows\System\PvxRLGu.exe
  C:\Windows\System\PvxRLGu.exe
  2⤵
  PID:5956
- C:\Windows\System\GnAcwVZ.exe
  C:\Windows\System\GnAcwVZ.exe
  2⤵
  PID:5972
- C:\Windows\System\VQpesNh.exe
  C:\Windows\System\VQpesNh.exe
  2⤵
  PID:6048
- C:\Windows\System\ECWDsPD.exe
  C:\Windows\System\ECWDsPD.exe
  2⤵
  PID:6064
- C:\Windows\System\jgPxVGG.exe
  C:\Windows\System\jgPxVGG.exe
  2⤵
  PID:6080
- C:\Windows\System\gNLpKQK.exe
  C:\Windows\System\gNLpKQK.exe
  2⤵
  PID:6096
- C:\Windows\System\uMpKeUx.exe
  C:\Windows\System\uMpKeUx.exe
  2⤵
  PID:6112
- C:\Windows\System\QrYAoBP.exe
  C:\Windows\System\QrYAoBP.exe
  2⤵
  PID:6132
- C:\Windows\System\CZjcdcK.exe
  C:\Windows\System\CZjcdcK.exe
  2⤵
  PID:4828
- C:\Windows\System\PVEmwxO.exe
  C:\Windows\System\PVEmwxO.exe
  2⤵
  PID:4504
- C:\Windows\System\HkZZgNM.exe
  C:\Windows\System\HkZZgNM.exe
  2⤵
  PID:4188
- C:\Windows\System\MuJsmlA.exe
  C:\Windows\System\MuJsmlA.exe
  2⤵
  PID:4592
- C:\Windows\System\lYTvHso.exe
  C:\Windows\System\lYTvHso.exe
  2⤵
  PID:4900
- C:\Windows\System\BKaWiiI.exe
  C:\Windows\System\BKaWiiI.exe
  2⤵
  PID:5184
- C:\Windows\System\xZgleaY.exe
  C:\Windows\System\xZgleaY.exe
  2⤵
  PID:1672
- C:\Windows\System\xBVfEOH.exe
  C:\Windows\System\xBVfEOH.exe
  2⤵
  PID:5152
- C:\Windows\System\IuBrSJq.exe
  C:\Windows\System\IuBrSJq.exe
  2⤵
  PID:5196
- C:\Windows\System\AgdQyIF.exe
  C:\Windows\System\AgdQyIF.exe
  2⤵
  PID:5212
- C:\Windows\System\MGdHElE.exe
  C:\Windows\System\MGdHElE.exe
  2⤵
  PID:4752
- C:\Windows\System\QbcmamE.exe
  C:\Windows\System\QbcmamE.exe
  2⤵
  PID:5308
- C:\Windows\System\MAXooVE.exe
  C:\Windows\System\MAXooVE.exe
  2⤵
  PID:4796
- C:\Windows\System\IFAWaVs.exe
  C:\Windows\System\IFAWaVs.exe
  2⤵
  PID:5348
- C:\Windows\System\lxylUXN.exe
  C:\Windows\System\lxylUXN.exe
  2⤵
  PID:4808
- C:\Windows\System\FAxNjnn.exe
  C:\Windows\System\FAxNjnn.exe
  2⤵
  PID:5376
- C:\Windows\System\FfighvJ.exe
  C:\Windows\System\FfighvJ.exe
  2⤵
  PID:4968
- C:\Windows\System\iSedANG.exe
  C:\Windows\System\iSedANG.exe
  2⤵
  PID:5416
- C:\Windows\System\gPtNrRx.exe
  C:\Windows\System\gPtNrRx.exe
  2⤵
  PID:5480
- C:\Windows\System\PhaTbkC.exe
  C:\Windows\System\PhaTbkC.exe
  2⤵
  PID:5548
- C:\Windows\System\MQPkdih.exe
  C:\Windows\System\MQPkdih.exe
  2⤵
  PID:5620
- C:\Windows\System\EqlINfA.exe
  C:\Windows\System\EqlINfA.exe
  2⤵
  PID:5228
- C:\Windows\System\ktudRcS.exe
  C:\Windows\System\ktudRcS.exe
  2⤵
  PID:5296
- C:\Windows\System\vyvajNw.exe
  C:\Windows\System\vyvajNw.exe
  2⤵
  PID:5396
- C:\Windows\System\iulaxkU.exe
  C:\Windows\System\iulaxkU.exe
  2⤵
  PID:5460
- C:\Windows\System\PQLflsc.exe
  C:\Windows\System\PQLflsc.exe
  2⤵
  PID:5364
- C:\Windows\System\jExQTiS.exe
  C:\Windows\System\jExQTiS.exe
  2⤵
  PID:5568
- C:\Windows\System\rAKFQGb.exe
  C:\Windows\System\rAKFQGb.exe
  2⤵
  PID:5636
- C:\Windows\System\lDMKnLz.exe
  C:\Windows\System\lDMKnLz.exe
  2⤵
  PID:5672
- C:\Windows\System\uIOvllN.exe
  C:\Windows\System\uIOvllN.exe
  2⤵
  PID:5688
- C:\Windows\System\cWFpekG.exe
  C:\Windows\System\cWFpekG.exe
  2⤵
  PID:5700
- C:\Windows\System\yUBXiUj.exe
  C:\Windows\System\yUBXiUj.exe
  2⤵
  PID:5720
- C:\Windows\System\ZWedBhR.exe
  C:\Windows\System\ZWedBhR.exe
  2⤵
  PID:5736
- C:\Windows\System\asxuSAl.exe
  C:\Windows\System\asxuSAl.exe
  2⤵
  PID:5752
- C:\Windows\System\XRxmyJz.exe
  C:\Windows\System\XRxmyJz.exe
  2⤵
  PID:5808
- C:\Windows\System\lmYVnKn.exe
  C:\Windows\System\lmYVnKn.exe
  2⤵
  PID:5836
- C:\Windows\System\jMHHuMN.exe
  C:\Windows\System\jMHHuMN.exe
  2⤵
  PID:5900
- C:\Windows\System\tYZeBvo.exe
  C:\Windows\System\tYZeBvo.exe
  2⤵
  PID:5964
- C:\Windows\System\PhcKdUp.exe
  C:\Windows\System\PhcKdUp.exe
  2⤵
  PID:5820
- C:\Windows\System\iJWUyKD.exe
  C:\Windows\System\iJWUyKD.exe
  2⤵
  PID:6028
- C:\Windows\System\FWAhYCF.exe
  C:\Windows\System\FWAhYCF.exe
  2⤵
  PID:6000
- C:\Windows\System\UCrjPte.exe
  C:\Windows\System\UCrjPte.exe
  2⤵
  PID:5884
- C:\Windows\System\lUiRoUR.exe
  C:\Windows\System\lUiRoUR.exe
  2⤵
  PID:6024
- C:\Windows\System\EQJOzTw.exe
  C:\Windows\System\EQJOzTw.exe
  2⤵
  PID:4788
- C:\Windows\System\wqTtZpM.exe
  C:\Windows\System\wqTtZpM.exe
  2⤵
  PID:5244
- C:\Windows\System\vzwoxli.exe
  C:\Windows\System\vzwoxli.exe
  2⤵
  PID:5260
- C:\Windows\System\IMLqyVO.exe
  C:\Windows\System\IMLqyVO.exe
  2⤵
  PID:5996
- C:\Windows\System\uvcTGcw.exe
  C:\Windows\System\uvcTGcw.exe
  2⤵
  PID:5984
- C:\Windows\System\DVsmVpK.exe
  C:\Windows\System\DVsmVpK.exe
  2⤵
  PID:6036
- C:\Windows\System\qvZyJtf.exe
  C:\Windows\System\qvZyJtf.exe
  2⤵
  PID:5716
- C:\Windows\System\bMuYBNs.exe
  C:\Windows\System\bMuYBNs.exe
  2⤵
  PID:5868
- C:\Windows\System\sApuLvj.exe
  C:\Windows\System\sApuLvj.exe
  2⤵
  PID:6040
- C:\Windows\System\HIRFWBA.exe
  C:\Windows\System\HIRFWBA.exe
  2⤵
  PID:5088
- C:\Windows\System\fSmMhsV.exe
  C:\Windows\System\fSmMhsV.exe
  2⤵
  PID:5344
- C:\Windows\System\MLEjztn.exe
  C:\Windows\System\MLEjztn.exe
  2⤵
  PID:4852
- C:\Windows\System\LjdyOme.exe
  C:\Windows\System\LjdyOme.exe
  2⤵
  PID:6108
- C:\Windows\System\aanqWtZ.exe
  C:\Windows\System\aanqWtZ.exe
  2⤵
  PID:5168
- C:\Windows\System\MRbQhpC.exe
  C:\Windows\System\MRbQhpC.exe
  2⤵
  PID:5632
- C:\Windows\System\XwGVOPn.exe
  C:\Windows\System\XwGVOPn.exe
  2⤵
  PID:5748
- C:\Windows\System\ZxRhMUL.exe
  C:\Windows\System\ZxRhMUL.exe
  2⤵
  PID:5968
- C:\Windows\System\AEFhfmz.exe
  C:\Windows\System\AEFhfmz.exe
  2⤵
  PID:5948
- C:\Windows\System\uAxISea.exe
  C:\Windows\System\uAxISea.exe
  2⤵
  PID:6124
- C:\Windows\System\SveLYEm.exe
  C:\Windows\System\SveLYEm.exe
  2⤵
  PID:5712
- C:\Windows\System\DqfyKMp.exe
  C:\Windows\System\DqfyKMp.exe
  2⤵
  PID:5276
- C:\Windows\System\lMXLCMp.exe
  C:\Windows\System\lMXLCMp.exe
  2⤵
  PID:5580
- C:\Windows\System\EuxQhJP.exe
  C:\Windows\System\EuxQhJP.exe
  2⤵
  PID:5616
- C:\Windows\System\ABJpDRx.exe
  C:\Windows\System\ABJpDRx.exe
  2⤵
  PID:4576
- C:\Windows\System\idvcciv.exe
  C:\Windows\System\idvcciv.exe
  2⤵
  PID:5292
- C:\Windows\System\UdcuFwO.exe
  C:\Windows\System\UdcuFwO.exe
  2⤵
  PID:5264
- C:\Windows\System\feehMJZ.exe
  C:\Windows\System\feehMJZ.exe
  2⤵
  PID:4132
- C:\Windows\System\dQTdxyi.exe
  C:\Windows\System\dQTdxyi.exe
  2⤵
  PID:5332
- C:\Windows\System\DHbYKFX.exe
  C:\Windows\System\DHbYKFX.exe
  2⤵
  PID:6160
- C:\Windows\System\RmeqeGC.exe
  C:\Windows\System\RmeqeGC.exe
  2⤵
  PID:6176
- C:\Windows\System\BxkGYQg.exe
  C:\Windows\System\BxkGYQg.exe
  2⤵
  PID:6192
- C:\Windows\System\WgGjpKt.exe
  C:\Windows\System\WgGjpKt.exe
  2⤵
  PID:6208
- C:\Windows\System\gNeKvNe.exe
  C:\Windows\System\gNeKvNe.exe
  2⤵
  PID:6224
- C:\Windows\System\GQnyKZd.exe
  C:\Windows\System\GQnyKZd.exe
  2⤵
  PID:6240
- C:\Windows\System\yYZkurA.exe
  C:\Windows\System\yYZkurA.exe
  2⤵
  PID:6260
- C:\Windows\System\gWSxwmg.exe
  C:\Windows\System\gWSxwmg.exe
  2⤵
  PID:6276
- C:\Windows\System\YiwlhBp.exe
  C:\Windows\System\YiwlhBp.exe
  2⤵
  PID:6292
- C:\Windows\System\AOyezeq.exe
  C:\Windows\System\AOyezeq.exe
  2⤵
  PID:6308
- C:\Windows\System\wZpnlDw.exe
  C:\Windows\System\wZpnlDw.exe
  2⤵
  PID:6324
- C:\Windows\System\xFVmwzM.exe
  C:\Windows\System\xFVmwzM.exe
  2⤵
  PID:6340
- C:\Windows\System\FYQdzNX.exe
  C:\Windows\System\FYQdzNX.exe
  2⤵
  PID:6360
- C:\Windows\System\dFPbgHh.exe
  C:\Windows\System\dFPbgHh.exe
  2⤵
  PID:6376
- C:\Windows\System\PUiNDuM.exe
  C:\Windows\System\PUiNDuM.exe
  2⤵
  PID:6392
- C:\Windows\System\xxDSEXh.exe
  C:\Windows\System\xxDSEXh.exe
  2⤵
  PID:6408
- C:\Windows\System\iomJCsJ.exe
  C:\Windows\System\iomJCsJ.exe
  2⤵
  PID:6424
- C:\Windows\System\ULrrrCC.exe
  C:\Windows\System\ULrrrCC.exe
  2⤵
  PID:6440
- C:\Windows\System\NeTVPtm.exe
  C:\Windows\System\NeTVPtm.exe
  2⤵
  PID:6456
- C:\Windows\System\ULdAKkR.exe
  C:\Windows\System\ULdAKkR.exe
  2⤵
  PID:6472
- C:\Windows\System\ZnSlgHY.exe
  C:\Windows\System\ZnSlgHY.exe
  2⤵
  PID:6488
- C:\Windows\System\nwoVToC.exe
  C:\Windows\System\nwoVToC.exe
  2⤵
  PID:6504
- C:\Windows\System\cUnlvpc.exe
  C:\Windows\System\cUnlvpc.exe
  2⤵
  PID:6524
- C:\Windows\System\XzvphcB.exe
  C:\Windows\System\XzvphcB.exe
  2⤵
  PID:6540
- C:\Windows\System\TKIiUHF.exe
  C:\Windows\System\TKIiUHF.exe
  2⤵
  PID:6556
- C:\Windows\System\IRXnXlq.exe
  C:\Windows\System\IRXnXlq.exe
  2⤵
  PID:6572
- C:\Windows\System\YrMruau.exe
  C:\Windows\System\YrMruau.exe
  2⤵
  PID:6588
- C:\Windows\System\uLneAvO.exe
  C:\Windows\System\uLneAvO.exe
  2⤵
  PID:6604
- C:\Windows\System\OvxJoWl.exe
  C:\Windows\System\OvxJoWl.exe
  2⤵
  PID:6620
- C:\Windows\System\BcTAgoo.exe
  C:\Windows\System\BcTAgoo.exe
  2⤵
  PID:6636
- C:\Windows\System\qrJLnTK.exe
  C:\Windows\System\qrJLnTK.exe
  2⤵
  PID:6652
- C:\Windows\System\FNxLDAa.exe
  C:\Windows\System\FNxLDAa.exe
  2⤵
  PID:6668
- C:\Windows\System\EMpQCbn.exe
  C:\Windows\System\EMpQCbn.exe
  2⤵
  PID:6684
- C:\Windows\System\RxEYjKQ.exe
  C:\Windows\System\RxEYjKQ.exe
  2⤵
  PID:6704
- C:\Windows\System\kOHvelO.exe
  C:\Windows\System\kOHvelO.exe
  2⤵
  PID:6720
- C:\Windows\System\vpXDZtr.exe
  C:\Windows\System\vpXDZtr.exe
  2⤵
  PID:6736
- C:\Windows\System\AychBUP.exe
  C:\Windows\System\AychBUP.exe
  2⤵
  PID:6752
- C:\Windows\System\iDJTten.exe
  C:\Windows\System\iDJTten.exe
  2⤵
  PID:6768
- C:\Windows\System\OnqRPhW.exe
  C:\Windows\System\OnqRPhW.exe
  2⤵
  PID:6784
- C:\Windows\System\nRIZfxz.exe
  C:\Windows\System\nRIZfxz.exe
  2⤵
  PID:6800
- C:\Windows\System\EgTcwyq.exe
  C:\Windows\System\EgTcwyq.exe
  2⤵
  PID:6816
- C:\Windows\System\xXRWENR.exe
  C:\Windows\System\xXRWENR.exe
  2⤵
  PID:6832
- C:\Windows\System\LoKAdGN.exe
  C:\Windows\System\LoKAdGN.exe
  2⤵
  PID:6848
- C:\Windows\System\VnAEMxy.exe
  C:\Windows\System\VnAEMxy.exe
  2⤵
  PID:6864
- C:\Windows\System\Mdyxnro.exe
  C:\Windows\System\Mdyxnro.exe
  2⤵
  PID:6880
- C:\Windows\System\PgMdMas.exe
  C:\Windows\System\PgMdMas.exe
  2⤵
  PID:6896
- C:\Windows\System\BIWyimS.exe
  C:\Windows\System\BIWyimS.exe
  2⤵
  PID:6912
- C:\Windows\System\UdgRJeO.exe
  C:\Windows\System\UdgRJeO.exe
  2⤵
  PID:6928
- C:\Windows\System\rxSJzKK.exe
  C:\Windows\System\rxSJzKK.exe
  2⤵
  PID:6944
- C:\Windows\System\ahbEApv.exe
  C:\Windows\System\ahbEApv.exe
  2⤵
  PID:6960
- C:\Windows\System\iCIxMqC.exe
  C:\Windows\System\iCIxMqC.exe
  2⤵
  PID:6976
- C:\Windows\System\bxKWlhu.exe
  C:\Windows\System\bxKWlhu.exe
  2⤵
  PID:6992
- C:\Windows\System\WAlblZu.exe
  C:\Windows\System\WAlblZu.exe
  2⤵
  PID:7008
- C:\Windows\System\iijGtld.exe
  C:\Windows\System\iijGtld.exe
  2⤵
  PID:7024
- C:\Windows\System\BNzRSJk.exe
  C:\Windows\System\BNzRSJk.exe
  2⤵
  PID:7040
- C:\Windows\System\VUYecBy.exe
  C:\Windows\System\VUYecBy.exe
  2⤵
  PID:7056
- C:\Windows\System\vvYPtLM.exe
  C:\Windows\System\vvYPtLM.exe
  2⤵
  PID:7072
- C:\Windows\System\NIZUQZo.exe
  C:\Windows\System\NIZUQZo.exe
  2⤵
  PID:7088
- C:\Windows\System\MrWJUTT.exe
  C:\Windows\System\MrWJUTT.exe
  2⤵
  PID:7104
- C:\Windows\System\UYdoPgS.exe
  C:\Windows\System\UYdoPgS.exe
  2⤵
  PID:7120
- C:\Windows\System\ZArUsQs.exe
  C:\Windows\System\ZArUsQs.exe
  2⤵
  PID:7136
- C:\Windows\System\ZfIEfcy.exe
  C:\Windows\System\ZfIEfcy.exe
  2⤵
  PID:7152
- C:\Windows\System\fspvLhn.exe
  C:\Windows\System\fspvLhn.exe
  2⤵
  PID:5380
- C:\Windows\System\MybiGEk.exe
  C:\Windows\System\MybiGEk.exe
  2⤵
  PID:5696
- C:\Windows\System\ufAfJzB.exe
  C:\Windows\System\ufAfJzB.exe
  2⤵
  PID:6076
- C:\Windows\System\PjQlhxc.exe
  C:\Windows\System\PjQlhxc.exe
  2⤵
  PID:5504
- C:\Windows\System\GdwFxYO.exe
  C:\Windows\System\GdwFxYO.exe
  2⤵
  PID:5136
- C:\Windows\System\TbDHLeP.exe
  C:\Windows\System\TbDHLeP.exe
  2⤵
  PID:5588
- C:\Windows\System\UTCqWvD.exe
  C:\Windows\System\UTCqWvD.exe
  2⤵
  PID:4540
- C:\Windows\System\OKiPoAr.exe
  C:\Windows\System\OKiPoAr.exe
  2⤵
  PID:6188
- C:\Windows\System\jooQjau.exe
  C:\Windows\System\jooQjau.exe
  2⤵
  PID:6248
- C:\Windows\System\bSImemi.exe
  C:\Windows\System\bSImemi.exe
  2⤵
  PID:6288
- C:\Windows\System\JBrvuXD.exe
  C:\Windows\System\JBrvuXD.exe
  2⤵
  PID:6356
- C:\Windows\System\KsnZXHf.exe
  C:\Windows\System\KsnZXHf.exe
  2⤵
  PID:6420
- C:\Windows\System\uQNmJzt.exe
  C:\Windows\System\uQNmJzt.exe
  2⤵
  PID:5824
- C:\Windows\System\gVZVxch.exe
  C:\Windows\System\gVZVxch.exe
  2⤵
  PID:4716
- C:\Windows\System\wHoFybg.exe
  C:\Windows\System\wHoFybg.exe
  2⤵
  PID:5360
- C:\Windows\System\hMqsncS.exe
  C:\Windows\System\hMqsncS.exe
  2⤵
  PID:6200
- C:\Windows\System\DJNccYN.exe
  C:\Windows\System\DJNccYN.exe
  2⤵
  PID:6400
- C:\Windows\System\LKGQWjP.exe
  C:\Windows\System\LKGQWjP.exe
  2⤵
  PID:6580
- C:\Windows\System\vfNnNmE.exe
  C:\Windows\System\vfNnNmE.exe
  2⤵
  PID:4780
- C:\Windows\System\hHNekiL.exe
  C:\Windows\System\hHNekiL.exe
  2⤵
  PID:5992
- C:\Windows\System\jvhczXM.exe
  C:\Windows\System\jvhczXM.exe
  2⤵
  PID:5760
- C:\Windows\System\nrZPoZY.exe
  C:\Windows\System\nrZPoZY.exe
  2⤵
  PID:6676
- C:\Windows\System\CeWqbKt.exe
  C:\Windows\System\CeWqbKt.exe
  2⤵
  PID:6020
- C:\Windows\System\iHqinJO.exe
  C:\Windows\System\iHqinJO.exe
  2⤵
  PID:5744
- C:\Windows\System\UWGmZlB.exe
  C:\Windows\System\UWGmZlB.exe
  2⤵
  PID:5684
- C:\Windows\System\rZaqOuO.exe
  C:\Windows\System\rZaqOuO.exe
  2⤵
  PID:4908
- C:\Windows\System\nixsDKa.exe
  C:\Windows\System\nixsDKa.exe
  2⤵
  PID:6204
- C:\Windows\System\cIlhbYn.exe
  C:\Windows\System\cIlhbYn.exe
  2⤵
  PID:6332
- C:\Windows\System\TWwOMeG.exe
  C:\Windows\System\TWwOMeG.exe
  2⤵
  PID:6748
- C:\Windows\System\TjwMNAO.exe
  C:\Windows\System\TjwMNAO.exe
  2⤵
  PID:6812
- C:\Windows\System\qoDRTDe.exe
  C:\Windows\System\qoDRTDe.exe
  2⤵
  PID:6872
- C:\Windows\System\ZxCzSYI.exe
  C:\Windows\System\ZxCzSYI.exe
  2⤵
  PID:6936
- C:\Windows\System\xAbuymo.exe
  C:\Windows\System\xAbuymo.exe
  2⤵
  PID:7000
- C:\Windows\System\jmAMbMH.exe
  C:\Windows\System\jmAMbMH.exe
  2⤵
  PID:6600
- C:\Windows\System\tBUvvbH.exe
  C:\Windows\System\tBUvvbH.exe
  2⤵
  PID:6568
- C:\Windows\System\UjcwgkK.exe
  C:\Windows\System\UjcwgkK.exe
  2⤵
  PID:6828
- C:\Windows\System\pqvkgbK.exe
  C:\Windows\System\pqvkgbK.exe
  2⤵
  PID:6924
- C:\Windows\System\mPHjLtC.exe
  C:\Windows\System\mPHjLtC.exe
  2⤵
  PID:7004
- C:\Windows\System\gQUbdCV.exe
  C:\Windows\System\gQUbdCV.exe
  2⤵
  PID:6660
- C:\Windows\System\gRdCdTo.exe
  C:\Windows\System\gRdCdTo.exe
  2⤵
  PID:6988
- C:\Windows\System\wUrIpBO.exe
  C:\Windows\System\wUrIpBO.exe
  2⤵
  PID:7064
- C:\Windows\System\SaGYRiW.exe
  C:\Windows\System\SaGYRiW.exe
  2⤵
  PID:7096
- C:\Windows\System\wmRsFcJ.exe
  C:\Windows\System\wmRsFcJ.exe
  2⤵
  PID:6892
- C:\Windows\System\sVCvVSn.exe
  C:\Windows\System\sVCvVSn.exe
  2⤵
  PID:7048
- C:\Windows\System\XNFQwBd.exe
  C:\Windows\System\XNFQwBd.exe
  2⤵
  PID:3320
- C:\Windows\System\lIJGYIp.exe
  C:\Windows\System\lIJGYIp.exe
  2⤵
  PID:6012
- C:\Windows\System\RyEJcdn.exe
  C:\Windows\System\RyEJcdn.exe
  2⤵
  PID:5932
- C:\Windows\System\uiXQPLO.exe
  C:\Windows\System\uiXQPLO.exe
  2⤵
  PID:7052
- C:\Windows\System\hzRHIZY.exe
  C:\Windows\System\hzRHIZY.exe
  2⤵
  PID:7144
- C:\Windows\System\fXdfWKX.exe
  C:\Windows\System\fXdfWKX.exe
  2⤵
  PID:4868
- C:\Windows\System\aFvOXuv.exe
  C:\Windows\System\aFvOXuv.exe
  2⤵
  PID:6352
- C:\Windows\System\unQTvXU.exe
  C:\Windows\System\unQTvXU.exe
  2⤵
  PID:6448
- C:\Windows\System\PXuehdV.exe
  C:\Windows\System\PXuehdV.exe
  2⤵
  PID:5708
- C:\Windows\System\VMBewyq.exe
  C:\Windows\System\VMBewyq.exe
  2⤵
  PID:5188
- C:\Windows\System\TGuuRFI.exe
  C:\Windows\System\TGuuRFI.exe
  2⤵
  PID:6268
- C:\Windows\System\jOfvQcM.exe
  C:\Windows\System\jOfvQcM.exe
  2⤵
  PID:5536
- C:\Windows\System\KsAWaDD.exe
  C:\Windows\System\KsAWaDD.exe
  2⤵
  PID:6712
- C:\Windows\System\deIdeMh.exe
  C:\Windows\System\deIdeMh.exe
  2⤵
  PID:6168
- C:\Windows\System\aayGzuR.exe
  C:\Windows\System\aayGzuR.exe
  2⤵
  PID:6844
- C:\Windows\System\AbcYZom.exe
  C:\Windows\System\AbcYZom.exe
  2⤵
  PID:6300
- C:\Windows\System\ZYhQBKq.exe
  C:\Windows\System\ZYhQBKq.exe
  2⤵
  PID:6644
- C:\Windows\System\awApOXV.exe
  C:\Windows\System\awApOXV.exe
  2⤵
  PID:5204
- C:\Windows\System\PDnFnEJ.exe
  C:\Windows\System\PDnFnEJ.exe
  2⤵
  PID:5412
- C:\Windows\System\YjnxdEP.exe
  C:\Windows\System\YjnxdEP.exe
  2⤵
  PID:5156
- C:\Windows\System\hvLcJIy.exe
  C:\Windows\System\hvLcJIy.exe
  2⤵
  PID:6732
- C:\Windows\System\wogoScQ.exe
  C:\Windows\System\wogoScQ.exe
  2⤵
  PID:6796
- C:\Windows\System\UgMlwJI.exe
  C:\Windows\System\UgMlwJI.exe
  2⤵
  PID:6888
- C:\Windows\System\hXXVtKe.exe
  C:\Windows\System\hXXVtKe.exe
  2⤵
  PID:6032
- C:\Windows\System\jFRQHTD.exe
  C:\Windows\System\jFRQHTD.exe
  2⤵
  PID:6348
- C:\Windows\System\RsnAFOb.exe
  C:\Windows\System\RsnAFOb.exe
  2⤵
  PID:6512
- C:\Windows\System\Igijzym.exe
  C:\Windows\System\Igijzym.exe
  2⤵
  PID:6320
- C:\Windows\System\wZgaDHi.exe
  C:\Windows\System\wZgaDHi.exe
  2⤵
  PID:6984
- C:\Windows\System\aCfrTLR.exe
  C:\Windows\System\aCfrTLR.exe
  2⤵
  PID:6372
- C:\Windows\System\yDzXdRH.exe
  C:\Windows\System\yDzXdRH.exe
  2⤵
  PID:6120
- C:\Windows\System\UaBwcNz.exe
  C:\Windows\System\UaBwcNz.exe
  2⤵
  PID:5788
- C:\Windows\System\JudMFan.exe
  C:\Windows\System\JudMFan.exe
  2⤵
  PID:6272
- C:\Windows\System\NbqWGwV.exe
  C:\Windows\System\NbqWGwV.exe
  2⤵
  PID:6532
- C:\Windows\System\tDPvvQK.exe
  C:\Windows\System\tDPvvQK.exe
  2⤵
  PID:6496
- C:\Windows\System\WRRxSYb.exe
  C:\Windows\System\WRRxSYb.exe
  2⤵
  PID:7116
- C:\Windows\System\zBrwqsw.exe
  C:\Windows\System\zBrwqsw.exe
  2⤵
  PID:5564
- C:\Windows\System\aTsTZas.exe
  C:\Windows\System\aTsTZas.exe
  2⤵
  PID:7148
- C:\Windows\System\xKGLyFI.exe
  C:\Windows\System\xKGLyFI.exe
  2⤵
  PID:6956
- C:\Windows\System\rUDEPUr.exe
  C:\Windows\System\rUDEPUr.exe
  2⤵
  PID:6860
- C:\Windows\System\TPNpTzk.exe
  C:\Windows\System\TPNpTzk.exe
  2⤵
  PID:7132
- C:\Windows\System\svTnZjl.exe
  C:\Windows\System\svTnZjl.exe
  2⤵
  PID:5904
- C:\Windows\System\ZIjtDmx.exe
  C:\Windows\System\ZIjtDmx.exe
  2⤵
  PID:7164
- C:\Windows\System\TEUnQSE.exe
  C:\Windows\System\TEUnQSE.exe
  2⤵
  PID:6692
- C:\Windows\System\QUYGHqQ.exe
  C:\Windows\System\QUYGHqQ.exe
  2⤵
  PID:6744
- C:\Windows\System\qNkdLta.exe
  C:\Windows\System\qNkdLta.exe
  2⤵
  PID:6284
- C:\Windows\System\AWSjViD.exe
  C:\Windows\System\AWSjViD.exe
  2⤵
  PID:6236
- C:\Windows\System\ZDuZCwT.exe
  C:\Windows\System\ZDuZCwT.exe
  2⤵
  PID:6764
- C:\Windows\System\zXxtEYL.exe
  C:\Windows\System\zXxtEYL.exe
  2⤵
  PID:7184
- C:\Windows\System\qVdIwcg.exe
  C:\Windows\System\qVdIwcg.exe
  2⤵
  PID:7200
- C:\Windows\System\pgEELQE.exe
  C:\Windows\System\pgEELQE.exe
  2⤵
  PID:7216
- C:\Windows\System\XoiuARe.exe
  C:\Windows\System\XoiuARe.exe
  2⤵
  PID:7232
- C:\Windows\System\UEVhorS.exe
  C:\Windows\System\UEVhorS.exe
  2⤵
  PID:7248
- C:\Windows\System\neYAQZA.exe
  C:\Windows\System\neYAQZA.exe
  2⤵
  PID:7264
- C:\Windows\System\Vycambb.exe
  C:\Windows\System\Vycambb.exe
  2⤵
  PID:7280
- C:\Windows\System\gbGkEqB.exe
  C:\Windows\System\gbGkEqB.exe
  2⤵
  PID:7296
- C:\Windows\System\cxqgTHE.exe
  C:\Windows\System\cxqgTHE.exe
  2⤵
  PID:7312
- C:\Windows\System\eCBeoaQ.exe
  C:\Windows\System\eCBeoaQ.exe
  2⤵
  PID:7328
- C:\Windows\System\oPXyNxq.exe
  C:\Windows\System\oPXyNxq.exe
  2⤵
  PID:7344
- C:\Windows\System\RNlHrGj.exe
  C:\Windows\System\RNlHrGj.exe
  2⤵
  PID:7360
- C:\Windows\System\LhhNlQO.exe
  C:\Windows\System\LhhNlQO.exe
  2⤵
  PID:7376
- C:\Windows\System\QbzirNw.exe
  C:\Windows\System\QbzirNw.exe
  2⤵
  PID:7392
- C:\Windows\System\JuqjCZo.exe
  C:\Windows\System\JuqjCZo.exe
  2⤵
  PID:7408
- C:\Windows\System\iCWqfZi.exe
  C:\Windows\System\iCWqfZi.exe
  2⤵
  PID:7428
- C:\Windows\System\uWFcoKl.exe
  C:\Windows\System\uWFcoKl.exe
  2⤵
  PID:7444
- C:\Windows\System\klAYUBx.exe
  C:\Windows\System\klAYUBx.exe
  2⤵
  PID:7460
- C:\Windows\System\AGVMHmM.exe
  C:\Windows\System\AGVMHmM.exe
  2⤵
  PID:7476
- C:\Windows\System\xyXBoMn.exe
  C:\Windows\System\xyXBoMn.exe
  2⤵
  PID:7492
- C:\Windows\System\nVgZjfQ.exe
  C:\Windows\System\nVgZjfQ.exe
  2⤵
  PID:7508
- C:\Windows\System\TInPpKj.exe
  C:\Windows\System\TInPpKj.exe
  2⤵
  PID:7524
- C:\Windows\System\rtHytLo.exe
  C:\Windows\System\rtHytLo.exe
  2⤵
  PID:7540
- C:\Windows\System\ibKyQSU.exe
  C:\Windows\System\ibKyQSU.exe
  2⤵
  PID:7556
- C:\Windows\System\iJKylLY.exe
  C:\Windows\System\iJKylLY.exe
  2⤵
  PID:7572
- C:\Windows\System\ZolYQiH.exe
  C:\Windows\System\ZolYQiH.exe
  2⤵
  PID:7588
- C:\Windows\System\WUDhjWj.exe
  C:\Windows\System\WUDhjWj.exe
  2⤵
  PID:7604
- C:\Windows\System\dIkBreN.exe
  C:\Windows\System\dIkBreN.exe
  2⤵
  PID:7620
- C:\Windows\System\xDuymGo.exe
  C:\Windows\System\xDuymGo.exe
  2⤵
  PID:7636
- C:\Windows\System\BowgCsX.exe
  C:\Windows\System\BowgCsX.exe
  2⤵
  PID:7652
- C:\Windows\System\arJxHEn.exe
  C:\Windows\System\arJxHEn.exe
  2⤵
  PID:7668
- C:\Windows\System\bOGsWMH.exe
  C:\Windows\System\bOGsWMH.exe
  2⤵
  PID:7684
- C:\Windows\System\cxUWANo.exe
  C:\Windows\System\cxUWANo.exe
  2⤵
  PID:7700
- C:\Windows\System\mUxLIWE.exe
  C:\Windows\System\mUxLIWE.exe
  2⤵
  PID:7716
- C:\Windows\System\qimhmVF.exe
  C:\Windows\System\qimhmVF.exe
  2⤵
  PID:7732
- C:\Windows\System\iNtynmt.exe
  C:\Windows\System\iNtynmt.exe
  2⤵
  PID:7748
- C:\Windows\System\xNtoTTF.exe
  C:\Windows\System\xNtoTTF.exe
  2⤵
  PID:7764
- C:\Windows\System\KYYHUrC.exe
  C:\Windows\System\KYYHUrC.exe
  2⤵
  PID:7780
- C:\Windows\System\sybGndH.exe
  C:\Windows\System\sybGndH.exe
  2⤵
  PID:7796
- C:\Windows\System\IUkBLDw.exe
  C:\Windows\System\IUkBLDw.exe
  2⤵
  PID:7812
- C:\Windows\System\njIBbMr.exe
  C:\Windows\System\njIBbMr.exe
  2⤵
  PID:7828
- C:\Windows\System\IkHgMDX.exe
  C:\Windows\System\IkHgMDX.exe
  2⤵
  PID:7844
- C:\Windows\System\yLKtHyf.exe
  C:\Windows\System\yLKtHyf.exe
  2⤵
  PID:7860
- C:\Windows\System\VZMRGqh.exe
  C:\Windows\System\VZMRGqh.exe
  2⤵
  PID:7876
- C:\Windows\System\oyRMRNC.exe
  C:\Windows\System\oyRMRNC.exe
  2⤵
  PID:7892
- C:\Windows\System\PiswbNe.exe
  C:\Windows\System\PiswbNe.exe
  2⤵
  PID:7908
- C:\Windows\System\tLnFLdb.exe
  C:\Windows\System\tLnFLdb.exe
  2⤵
  PID:7924
- C:\Windows\System\GpWvSSU.exe
  C:\Windows\System\GpWvSSU.exe
  2⤵
  PID:7940
- C:\Windows\System\QXVjWGq.exe
  C:\Windows\System\QXVjWGq.exe
  2⤵
  PID:7956
- C:\Windows\System\oJQiCHQ.exe
  C:\Windows\System\oJQiCHQ.exe
  2⤵
  PID:7972
- C:\Windows\System\FutMhxY.exe
  C:\Windows\System\FutMhxY.exe
  2⤵
  PID:8048
- C:\Windows\System\hQXlJmK.exe
  C:\Windows\System\hQXlJmK.exe
  2⤵
  PID:8068
- C:\Windows\System\uPMrNsL.exe
  C:\Windows\System\uPMrNsL.exe
  2⤵
  PID:8084
- C:\Windows\System\jqWAHgj.exe
  C:\Windows\System\jqWAHgj.exe
  2⤵
  PID:8100
- C:\Windows\System\LVGiMVw.exe
  C:\Windows\System\LVGiMVw.exe
  2⤵
  PID:8116
- C:\Windows\System\kisjCNH.exe
  C:\Windows\System\kisjCNH.exe
  2⤵
  PID:8132
- C:\Windows\System\ZjJkwRw.exe
  C:\Windows\System\ZjJkwRw.exe
  2⤵
  PID:8148
- C:\Windows\System\zgyXBBs.exe
  C:\Windows\System\zgyXBBs.exe
  2⤵
  PID:8164
- C:\Windows\System\gwxxafX.exe
  C:\Windows\System\gwxxafX.exe
  2⤵
  PID:8180
- C:\Windows\System\NqHFLwD.exe
  C:\Windows\System\NqHFLwD.exe
  2⤵
  PID:7192
- C:\Windows\System\MOhwUev.exe
  C:\Windows\System\MOhwUev.exe
  2⤵
  PID:7256
- C:\Windows\System\TaSXiUs.exe
  C:\Windows\System\TaSXiUs.exe
  2⤵
  PID:6596
- C:\Windows\System\cDTNTbK.exe
  C:\Windows\System\cDTNTbK.exe
  2⤵
  PID:7180
- C:\Windows\System\hatskKt.exe
  C:\Windows\System\hatskKt.exe
  2⤵
  PID:7352
- C:\Windows\System\PdVwUlN.exe
  C:\Windows\System\PdVwUlN.exe
  2⤵
  PID:7384
- C:\Windows\System\JjrEWMO.exe
  C:\Windows\System\JjrEWMO.exe
  2⤵
  PID:7484
- C:\Windows\System\GCIPhdW.exe
  C:\Windows\System\GCIPhdW.exe
  2⤵
  PID:7548
- C:\Windows\System\IEvQneZ.exe
  C:\Windows\System\IEvQneZ.exe
  2⤵
  PID:7644
- C:\Windows\System\gxjuiao.exe
  C:\Windows\System\gxjuiao.exe
  2⤵
  PID:7680
- C:\Windows\System\GiJpPAl.exe
  C:\Windows\System\GiJpPAl.exe
  2⤵
  PID:7740
- C:\Windows\System\zppMaXJ.exe
  C:\Windows\System\zppMaXJ.exe
  2⤵
  PID:7804
- C:\Windows\System\xnjQVKD.exe
  C:\Windows\System\xnjQVKD.exe
  2⤵
  PID:7868
- C:\Windows\System\wjJklss.exe
  C:\Windows\System\wjJklss.exe
  2⤵
  PID:7932
- C:\Windows\System\TJMsFnO.exe
  C:\Windows\System\TJMsFnO.exe
  2⤵
  PID:7968
- C:\Windows\System\UhFwfof.exe
  C:\Windows\System\UhFwfof.exe
  2⤵
  PID:7600
- C:\Windows\System\pqLLcff.exe
  C:\Windows\System\pqLLcff.exe
  2⤵
  PID:7440
- C:\Windows\System\UTImaIE.exe
  C:\Windows\System\UTImaIE.exe
  2⤵
  PID:7468
- C:\Windows\System\KrzTOgH.exe
  C:\Windows\System\KrzTOgH.exe
  2⤵
  PID:7568
- C:\Windows\System\UtCDRyq.exe
  C:\Windows\System\UtCDRyq.exe
  2⤵
  PID:7724
- C:\Windows\System\DffjRCD.exe
  C:\Windows\System\DffjRCD.exe
  2⤵
  PID:7788
- C:\Windows\System\RAdyeLJ.exe
  C:\Windows\System\RAdyeLJ.exe
  2⤵
  PID:7856
- C:\Windows\System\hNNsPHU.exe
  C:\Windows\System\hNNsPHU.exe
  2⤵
  PID:7920
- C:\Windows\System\QGcwDkh.exe
  C:\Windows\System\QGcwDkh.exe
  2⤵
  PID:7996
- C:\Windows\System\uOkWOlh.exe
  C:\Windows\System\uOkWOlh.exe
  2⤵
  PID:8024
- C:\Windows\System\aqIeKnI.exe
  C:\Windows\System\aqIeKnI.exe
  2⤵
  PID:8036
- C:\Windows\System\naVhvQn.exe
  C:\Windows\System\naVhvQn.exe
  2⤵
  PID:8204
- C:\Windows\System\XmHiWJs.exe
  C:\Windows\System\XmHiWJs.exe
  2⤵
  PID:8220
- C:\Windows\System\AuRQSVb.exe
  C:\Windows\System\AuRQSVb.exe
  2⤵
  PID:8236
- C:\Windows\System\umuqZZX.exe
  C:\Windows\System\umuqZZX.exe
  2⤵
  PID:8256
- C:\Windows\System\gEdeFkE.exe
  C:\Windows\System\gEdeFkE.exe
  2⤵
  PID:8272
- C:\Windows\System\ACdzOLG.exe
  C:\Windows\System\ACdzOLG.exe
  2⤵
  PID:8488
- C:\Windows\System\PakuvRy.exe
  C:\Windows\System\PakuvRy.exe
  2⤵
  PID:8504
- C:\Windows\System\WyxQIht.exe
  C:\Windows\System\WyxQIht.exe
  2⤵
  PID:8520
- C:\Windows\System\PWTebFE.exe
  C:\Windows\System\PWTebFE.exe
  2⤵
  PID:8536
- C:\Windows\System\aDaFpSR.exe
  C:\Windows\System\aDaFpSR.exe
  2⤵
  PID:8560
- C:\Windows\System\GUZdFOZ.exe
  C:\Windows\System\GUZdFOZ.exe
  2⤵
  PID:8576
- C:\Windows\System\IPVUBMM.exe
  C:\Windows\System\IPVUBMM.exe
  2⤵
  PID:8592
- C:\Windows\System\WUKjORG.exe
  C:\Windows\System\WUKjORG.exe
  2⤵
  PID:8608
- C:\Windows\System\UprYKfD.exe
  C:\Windows\System\UprYKfD.exe
  2⤵
  PID:8624
- C:\Windows\System\tLAIhFY.exe
  C:\Windows\System\tLAIhFY.exe
  2⤵
  PID:8640
- C:\Windows\System\cUGmlaQ.exe
  C:\Windows\System\cUGmlaQ.exe
  2⤵
  PID:8656
- C:\Windows\System\YXUlCJY.exe
  C:\Windows\System\YXUlCJY.exe
  2⤵
  PID:8672
- C:\Windows\System\YfeUnYi.exe
  C:\Windows\System\YfeUnYi.exe
  2⤵
  PID:8688
- C:\Windows\System\ysOkqwa.exe
  C:\Windows\System\ysOkqwa.exe
  2⤵
  PID:8704
- C:\Windows\System\JOdygQP.exe
  C:\Windows\System\JOdygQP.exe
  2⤵
  PID:8720
- C:\Windows\System\VTDxDhu.exe
  C:\Windows\System\VTDxDhu.exe
  2⤵
  PID:8736
- C:\Windows\System\dkoQZRl.exe
  C:\Windows\System\dkoQZRl.exe
  2⤵
  PID:8752
- C:\Windows\System\hqioAMz.exe
  C:\Windows\System\hqioAMz.exe
  2⤵
  PID:8768
- C:\Windows\System\PQBoMjc.exe
  C:\Windows\System\PQBoMjc.exe
  2⤵
  PID:8784
- C:\Windows\System\uXdsIGD.exe
  C:\Windows\System\uXdsIGD.exe
  2⤵
  PID:8800
- C:\Windows\System\pKwznCy.exe
  C:\Windows\System\pKwznCy.exe
  2⤵
  PID:8816
- C:\Windows\System\JBGuUfa.exe
  C:\Windows\System\JBGuUfa.exe
  2⤵
  PID:8832
- C:\Windows\System\ioloEwo.exe
  C:\Windows\System\ioloEwo.exe
  2⤵
  PID:8848
- C:\Windows\System\fiTTYkj.exe
  C:\Windows\System\fiTTYkj.exe
  2⤵
  PID:8864
- C:\Windows\System\aLqnjxE.exe
  C:\Windows\System\aLqnjxE.exe
  2⤵
  PID:8880
- C:\Windows\System\wZeqStH.exe
  C:\Windows\System\wZeqStH.exe
  2⤵
  PID:8940
- C:\Windows\System\sDohsEs.exe
  C:\Windows\System\sDohsEs.exe
  2⤵
  PID:8960
- C:\Windows\System\WfLftRQ.exe
  C:\Windows\System\WfLftRQ.exe
  2⤵
  PID:8980
- C:\Windows\System\JkECcTr.exe
  C:\Windows\System\JkECcTr.exe
  2⤵
  PID:9000
- C:\Windows\System\bGxRump.exe
  C:\Windows\System\bGxRump.exe
  2⤵
  PID:9016
- C:\Windows\System\rOvMzuG.exe
  C:\Windows\System\rOvMzuG.exe
  2⤵
  PID:9032
- C:\Windows\System\VIzUEMz.exe
  C:\Windows\System\VIzUEMz.exe
  2⤵
  PID:9048
- C:\Windows\System\uNWslrF.exe
  C:\Windows\System\uNWslrF.exe
  2⤵
  PID:9064
- C:\Windows\System\KsHzUYl.exe
  C:\Windows\System\KsHzUYl.exe
  2⤵
  PID:8044
- C:\Windows\System\ttBFgeW.exe
  C:\Windows\System\ttBFgeW.exe
  2⤵
  PID:8140
- C:\Windows\System\alGsQLc.exe
  C:\Windows\System\alGsQLc.exe
  2⤵
  PID:7224
- C:\Windows\System\grCAeSl.exe
  C:\Windows\System\grCAeSl.exe
  2⤵
  PID:7368
- C:\Windows\System\zDUaXIU.exe
  C:\Windows\System\zDUaXIU.exe
  2⤵
  PID:7616
- C:\Windows\System\DffRKkn.exe
  C:\Windows\System\DffRKkn.exe
  2⤵
  PID:7900
- C:\Windows\System\zsXcnpD.exe
  C:\Windows\System\zsXcnpD.exe
  2⤵
  PID:7696
- C:\Windows\System\xjOdOBW.exe
  C:\Windows\System\xjOdOBW.exe
  2⤵
  PID:7820
- C:\Windows\System\BwYuxQE.exe
  C:\Windows\System\BwYuxQE.exe
  2⤵
  PID:8028
- C:\Windows\System\OzAxotI.exe
  C:\Windows\System\OzAxotI.exe
  2⤵
  PID:8244
- C:\Windows\System\YcRQSuz.exe
  C:\Windows\System\YcRQSuz.exe
  2⤵
  PID:7324
- C:\Windows\System\REXPZZT.exe
  C:\Windows\System\REXPZZT.exe
  2⤵
  PID:6612
- C:\Windows\System\gAjuetf.exe
  C:\Windows\System\gAjuetf.exe
  2⤵
  PID:7952
- C:\Windows\System\kYxiIrw.exe
  C:\Windows\System\kYxiIrw.exe
  2⤵
  PID:8296
- C:\Windows\System\tAQvphj.exe
  C:\Windows\System\tAQvphj.exe
  2⤵
  PID:8096
- C:\Windows\System\qQrhNkp.exe
  C:\Windows\System\qQrhNkp.exe
  2⤵
  PID:8156
- C:\Windows\System\GSejmKn.exe
  C:\Windows\System\GSejmKn.exe
  2⤵
  PID:7288
- C:\Windows\System\baahyQY.exe
  C:\Windows\System\baahyQY.exe
  2⤵
  PID:8308
- C:\Windows\System\qZdaUjC.exe
  C:\Windows\System\qZdaUjC.exe
  2⤵
  PID:8324
- C:\Windows\System\EdEQmgj.exe
  C:\Windows\System\EdEQmgj.exe
  2⤵
  PID:8340
- C:\Windows\System\JijfDLm.exe
  C:\Windows\System\JijfDLm.exe
  2⤵
  PID:7276
- C:\Windows\System\YNOxGJJ.exe
  C:\Windows\System\YNOxGJJ.exe
  2⤵
  PID:7424
- C:\Windows\System\KFHZsDB.exe
  C:\Windows\System\KFHZsDB.exe
  2⤵
  PID:7584
- C:\Windows\System\vYeWrKv.exe
  C:\Windows\System\vYeWrKv.exe
  2⤵
  PID:7836
- C:\Windows\System\bGqfCDC.exe
  C:\Windows\System\bGqfCDC.exe
  2⤵
  PID:8264
- C:\Windows\System\ndcMdzZ.exe
  C:\Windows\System\ndcMdzZ.exe
  2⤵
  PID:8196
- C:\Windows\System\hCJOVZk.exe
  C:\Windows\System\hCJOVZk.exe
  2⤵
  PID:7612
- C:\Windows\System\LTfuhVG.exe
  C:\Windows\System\LTfuhVG.exe
  2⤵
  PID:7500
- C:\Windows\System\BDrxHMr.exe
  C:\Windows\System\BDrxHMr.exe
  2⤵
  PID:7916
- C:\Windows\System\SnavLQR.exe
  C:\Windows\System\SnavLQR.exe
  2⤵
  PID:8352
- C:\Windows\System\CYKtFQl.exe
  C:\Windows\System\CYKtFQl.exe
  2⤵
  PID:8368
- C:\Windows\System\ZupPRTx.exe
  C:\Windows\System\ZupPRTx.exe
  2⤵
  PID:8384
- C:\Windows\System\YLkaJRR.exe
  C:\Windows\System\YLkaJRR.exe
  2⤵
  PID:8400
- C:\Windows\System\ZjToviT.exe
  C:\Windows\System\ZjToviT.exe
  2⤵
  PID:8416
- C:\Windows\System\TplCfOO.exe
  C:\Windows\System\TplCfOO.exe
  2⤵
  PID:8432
- C:\Windows\System\yXVWiut.exe
  C:\Windows\System\yXVWiut.exe
  2⤵
  PID:8448
- C:\Windows\System\HHjMUQB.exe
  C:\Windows\System\HHjMUQB.exe
  2⤵
  PID:8460
- C:\Windows\System\ItPPokr.exe
  C:\Windows\System\ItPPokr.exe
  2⤵
  PID:8480
- C:\Windows\System\XDcvBpf.exe
  C:\Windows\System\XDcvBpf.exe
  2⤵
  PID:8528
- C:\Windows\System\sSbZSlF.exe
  C:\Windows\System\sSbZSlF.exe
  2⤵
  PID:8572
- C:\Windows\System\Qwkfyuq.exe
  C:\Windows\System\Qwkfyuq.exe
  2⤵
  PID:8600
- C:\Windows\System\qyTafQc.exe
  C:\Windows\System\qyTafQc.exe
  2⤵
  PID:8632
- C:\Windows\System\BULWtPu.exe
  C:\Windows\System\BULWtPu.exe
  2⤵
  PID:8696
- C:\Windows\System\IAvgQFH.exe
  C:\Windows\System\IAvgQFH.exe
  2⤵
  PID:8760
- C:\Windows\System\OrQmJwo.exe
  C:\Windows\System\OrQmJwo.exe
  2⤵
  PID:8824
- C:\Windows\System\LdIDihe.exe
  C:\Windows\System\LdIDihe.exe
  2⤵
  PID:8888
- C:\Windows\System\yyTyUAQ.exe
  C:\Windows\System\yyTyUAQ.exe
  2⤵
  PID:8620
- C:\Windows\System\XaRaHAY.exe
  C:\Windows\System\XaRaHAY.exe
  2⤵
  PID:8684
- C:\Windows\System\KieHzcB.exe
  C:\Windows\System\KieHzcB.exe
  2⤵
  PID:8748
- C:\Windows\System\nsRfiZe.exe
  C:\Windows\System\nsRfiZe.exe
  2⤵
  PID:8812
- C:\Windows\System\nCVjkvh.exe
  C:\Windows\System\nCVjkvh.exe
  2⤵
  PID:8876
- C:\Windows\System\QJGmJhw.exe
  C:\Windows\System\QJGmJhw.exe
  2⤵
  PID:8904
- C:\Windows\System\nydeGzK.exe
  C:\Windows\System\nydeGzK.exe
  2⤵
  PID:8916
- C:\Windows\System\dFXBJbN.exe
  C:\Windows\System\dFXBJbN.exe
  2⤵
  PID:8932
- C:\Windows\System\ewnwgTk.exe
  C:\Windows\System\ewnwgTk.exe
  2⤵
  PID:8972
- C:\Windows\System\SFGldcE.exe
  C:\Windows\System\SFGldcE.exe
  2⤵
  PID:9012
- C:\Windows\System\zveQliM.exe
  C:\Windows\System\zveQliM.exe
  2⤵
  PID:9080
- C:\Windows\System\wkwVsPN.exe
  C:\Windows\System\wkwVsPN.exe
  2⤵
  PID:9112
- C:\Windows\System\nerJbGK.exe
  C:\Windows\System\nerJbGK.exe
  2⤵
  PID:9088
- C:\Windows\System\vrvuOGN.exe
  C:\Windows\System\vrvuOGN.exe
  2⤵
  PID:9152
- C:\Windows\System\RUcJRDf.exe
  C:\Windows\System\RUcJRDf.exe
  2⤵
  PID:9116
- C:\Windows\System\yNmRcDI.exe
  C:\Windows\System\yNmRcDI.exe
  2⤵
  PID:9160
- C:\Windows\System\fTBxYhl.exe
  C:\Windows\System\fTBxYhl.exe
  2⤵
  PID:9188
- C:\Windows\System\RfmltTB.exe
  C:\Windows\System\RfmltTB.exe
  2⤵
  PID:9176
- C:\Windows\System\ApIffJq.exe
  C:\Windows\System\ApIffJq.exe
  2⤵
  PID:8948
- C:\Windows\System\lbRJhWH.exe
  C:\Windows\System\lbRJhWH.exe
  2⤵
  PID:8996
- C:\Windows\System\KhSrLaB.exe
  C:\Windows\System\KhSrLaB.exe
  2⤵
  PID:8988
- C:\Windows\System\lXpbMXH.exe
  C:\Windows\System\lXpbMXH.exe
  2⤵
  PID:7516
- C:\Windows\System\PdabSlF.exe
  C:\Windows\System\PdabSlF.exe
  2⤵
  PID:8080
- C:\Windows\System\rZeWTFU.exe
  C:\Windows\System\rZeWTFU.exe
  2⤵
  PID:8176
- C:\Windows\System\PWAoVwg.exe
  C:\Windows\System\PWAoVwg.exe
  2⤵
  PID:8092
- C:\Windows\System\nxUWYQv.exe
  C:\Windows\System\nxUWYQv.exe
  2⤵
  PID:8320
- C:\Windows\System\WLClJvy.exe
  C:\Windows\System\WLClJvy.exe
  2⤵
  PID:6968
- C:\Windows\System\vfDmLDt.exe
  C:\Windows\System\vfDmLDt.exe
  2⤵
  PID:7708
- C:\Windows\System\YHAqVwO.exe
  C:\Windows\System\YHAqVwO.exe
  2⤵
  PID:7536
- C:\Windows\System\HXnrBAh.exe
  C:\Windows\System\HXnrBAh.exe
  2⤵
  PID:8392
- C:\Windows\System\pLizILI.exe
  C:\Windows\System\pLizILI.exe
  2⤵
  PID:8456
- C:\Windows\System\pZuIWby.exe
  C:\Windows\System\pZuIWby.exe
  2⤵
  PID:8064
- C:\Windows\System\Gmhebiu.exe
  C:\Windows\System\Gmhebiu.exe
  2⤵
  PID:8440
- C:\Windows\System\OxoIvGs.exe
  C:\Windows\System\OxoIvGs.exe
  2⤵
  PID:7532
- C:\Windows\System\zqLNzyS.exe
  C:\Windows\System\zqLNzyS.exe
  2⤵
  PID:6972
- C:\Windows\System\JGTgDTm.exe
  C:\Windows\System\JGTgDTm.exe
  2⤵
  PID:8336
- C:\Windows\System\slKAzFL.exe
  C:\Windows\System\slKAzFL.exe
  2⤵
  PID:8472
- C:\Windows\System\DoeGBoS.exe
  C:\Windows\System\DoeGBoS.exe
  2⤵
  PID:7664
- C:\Windows\System\iCddNHu.exe
  C:\Windows\System\iCddNHu.exe
  2⤵
  PID:7840
- C:\Windows\System\fJwoLeY.exe
  C:\Windows\System\fJwoLeY.exe
  2⤵
  PID:8376
- C:\Windows\System\jQuXroa.exe
  C:\Windows\System\jQuXroa.exe
  2⤵
  PID:8436
- C:\Windows\System\rLwTnIn.exe
  C:\Windows\System\rLwTnIn.exe
  2⤵
  PID:8744
- C:\Windows\System\gFEFQfW.exe
  C:\Windows\System\gFEFQfW.exe
  2⤵
  PID:8968
- C:\Windows\System\mVDaESL.exe
  C:\Windows\System\mVDaESL.exe
  2⤵
  PID:9040
- C:\Windows\System\RIVODqu.exe
  C:\Windows\System\RIVODqu.exe
  2⤵
  PID:9084
- C:\Windows\System\cYJbevw.exe
  C:\Windows\System\cYJbevw.exe
  2⤵
  PID:8000
- C:\Windows\System\MholAmR.exe
  C:\Windows\System\MholAmR.exe
  2⤵
  PID:8808
- C:\Windows\System\KoLsoED.exe
  C:\Windows\System\KoLsoED.exe
  2⤵
  PID:9148
- C:\Windows\System\ojQRvyx.exe
  C:\Windows\System\ojQRvyx.exe
  2⤵
  PID:9204
- C:\Windows\System\rHJmsii.exe
  C:\Windows\System\rHJmsii.exe
  2⤵
  PID:9060
- C:\Windows\System\OIyYlfA.exe
  C:\Windows\System\OIyYlfA.exe
  2⤵
  PID:8144
- C:\Windows\System\ypYLeMu.exe
  C:\Windows\System\ypYLeMu.exe
  2⤵
  PID:8312
- C:\Windows\System\xqaggDB.exe
  C:\Windows\System\xqaggDB.exe
  2⤵
  PID:7244
- C:\Windows\System\vbNwtTN.exe
  C:\Windows\System\vbNwtTN.exe
  2⤵
  PID:8424
- C:\Windows\System\OgFuLVO.exe
  C:\Windows\System\OgFuLVO.exe
  2⤵
  PID:8544
- C:\Windows\System\giLyupu.exe
  C:\Windows\System\giLyupu.exe
  2⤵
  PID:8444
- C:\Windows\System\BvnMbOm.exe
  C:\Windows\System\BvnMbOm.exe
  2⤵
  PID:7400
- C:\Windows\System\SpOxWOk.exe
  C:\Windows\System\SpOxWOk.exe
  2⤵
  PID:9172
- C:\Windows\System\PFhaBkf.exe
  C:\Windows\System\PFhaBkf.exe
  2⤵
  PID:7564
- C:\Windows\System\dsyNaWZ.exe
  C:\Windows\System\dsyNaWZ.exe
  2⤵
  PID:8516
- C:\Windows\System\cWuFIdu.exe
  C:\Windows\System\cWuFIdu.exe
  2⤵
  PID:9128
- C:\Windows\System\FVBwMzE.exe
  C:\Windows\System\FVBwMzE.exe
  2⤵
  PID:9092
- C:\Windows\System\MScSptX.exe
  C:\Windows\System\MScSptX.exe
  2⤵
  PID:8936
- C:\Windows\System\ljImvQg.exe
  C:\Windows\System\ljImvQg.exe
  2⤵
  PID:8552
- C:\Windows\System\ggdAjNV.exe
  C:\Windows\System\ggdAjNV.exe
  2⤵
  PID:8896
- C:\Windows\System\eSqahfz.exe
  C:\Windows\System\eSqahfz.exe
  2⤵
  PID:8412
- C:\Windows\System\HaHCNNx.exe
  C:\Windows\System\HaHCNNx.exe
  2⤵
  PID:9104
- C:\Windows\System\GyEkBai.exe
  C:\Windows\System\GyEkBai.exe
  2⤵
  PID:9196
- C:\Windows\System\iOYYFrd.exe
  C:\Windows\System\iOYYFrd.exe
  2⤵
  PID:8012
- C:\Windows\System\kYRWOeN.exe
  C:\Windows\System\kYRWOeN.exe
  2⤵
  PID:8280
- C:\Windows\System\CeAyIzK.exe
  C:\Windows\System\CeAyIzK.exe
  2⤵
  PID:7628
- C:\Windows\System\cRZuQEl.exe
  C:\Windows\System\cRZuQEl.exe
  2⤵
  PID:8380
- C:\Windows\System\hBVGinN.exe
  C:\Windows\System\hBVGinN.exe
  2⤵
  PID:8796
- C:\Windows\System\MSNpboG.exe
  C:\Windows\System\MSNpboG.exe
  2⤵
  PID:9072
- C:\Windows\System\uowLnVA.exe
  C:\Windows\System\uowLnVA.exe
  2⤵
  PID:8732
- C:\Windows\System\SLSvfuI.exe
  C:\Windows\System\SLSvfuI.exe
  2⤵
  PID:8016
- C:\Windows\System\PLOuNLZ.exe
  C:\Windows\System\PLOuNLZ.exe
  2⤵
  PID:8008
- C:\Windows\System\FWDDeSf.exe
  C:\Windows\System\FWDDeSf.exe
  2⤵
  PID:9240
- C:\Windows\System\hnqoEDn.exe
  C:\Windows\System\hnqoEDn.exe
  2⤵
  PID:9256
- C:\Windows\System\IIGWznl.exe
  C:\Windows\System\IIGWznl.exe
  2⤵
  PID:9272
- C:\Windows\System\lGUHPjr.exe
  C:\Windows\System\lGUHPjr.exe
  2⤵
  PID:9288
- C:\Windows\System\DfNhMWD.exe
  C:\Windows\System\DfNhMWD.exe
  2⤵
  PID:9304
- C:\Windows\System\maaaAcq.exe
  C:\Windows\System\maaaAcq.exe
  2⤵
  PID:9320
- C:\Windows\System\kOzzKBh.exe
  C:\Windows\System\kOzzKBh.exe
  2⤵
  PID:9336
- C:\Windows\System\tjtdqsq.exe
  C:\Windows\System\tjtdqsq.exe
  2⤵
  PID:9352
- C:\Windows\System\hXpLoNJ.exe
  C:\Windows\System\hXpLoNJ.exe
  2⤵
  PID:9368
- C:\Windows\System\RBoKSqu.exe
  C:\Windows\System\RBoKSqu.exe
  2⤵
  PID:9384
- C:\Windows\System\bWOUNwo.exe
  C:\Windows\System\bWOUNwo.exe
  2⤵
  PID:9400
- C:\Windows\System\SyFSKQr.exe
  C:\Windows\System\SyFSKQr.exe
  2⤵
  PID:9416
- C:\Windows\System\yYJJjTN.exe
  C:\Windows\System\yYJJjTN.exe
  2⤵
  PID:9432
- C:\Windows\System\PGCRelm.exe
  C:\Windows\System\PGCRelm.exe
  2⤵
  PID:9448
- C:\Windows\System\RNHDxZK.exe
  C:\Windows\System\RNHDxZK.exe
  2⤵
  PID:9464
- C:\Windows\System\yYSDkNm.exe
  C:\Windows\System\yYSDkNm.exe
  2⤵
  PID:9480
- C:\Windows\System\BZnfgGB.exe
  C:\Windows\System\BZnfgGB.exe
  2⤵
  PID:9496
- C:\Windows\System\ogwbJNm.exe
  C:\Windows\System\ogwbJNm.exe
  2⤵
  PID:9512
- C:\Windows\System\pJViqps.exe
  C:\Windows\System\pJViqps.exe
  2⤵
  PID:9532
- C:\Windows\System\PADGcAZ.exe
  C:\Windows\System\PADGcAZ.exe
  2⤵
  PID:9548
- C:\Windows\System\tQQReBB.exe
  C:\Windows\System\tQQReBB.exe
  2⤵
  PID:9564
- C:\Windows\System\sSgXmpP.exe
  C:\Windows\System\sSgXmpP.exe
  2⤵
  PID:9580
- C:\Windows\System\hpLZYuk.exe
  C:\Windows\System\hpLZYuk.exe
  2⤵
  PID:9596
- C:\Windows\System\JiXFiYl.exe
  C:\Windows\System\JiXFiYl.exe
  2⤵
  PID:9612
- C:\Windows\System\HaagPeJ.exe
  C:\Windows\System\HaagPeJ.exe
  2⤵
  PID:9628
- C:\Windows\System\MpjqTfr.exe
  C:\Windows\System\MpjqTfr.exe
  2⤵
  PID:9644
- C:\Windows\System\yZHMHkq.exe
  C:\Windows\System\yZHMHkq.exe
  2⤵
  PID:9660
- C:\Windows\System\ojmtNzD.exe
  C:\Windows\System\ojmtNzD.exe
  2⤵
  PID:9676
- C:\Windows\System\uoUXPhn.exe
  C:\Windows\System\uoUXPhn.exe
  2⤵
  PID:9692
- C:\Windows\System\NUcEMZe.exe
  C:\Windows\System\NUcEMZe.exe
  2⤵
  PID:9708
- C:\Windows\System\rnxKkVq.exe
  C:\Windows\System\rnxKkVq.exe
  2⤵
  PID:9724
- C:\Windows\System\YzwMVyy.exe
  C:\Windows\System\YzwMVyy.exe
  2⤵
  PID:9740
- C:\Windows\System\kMXcinN.exe
  C:\Windows\System\kMXcinN.exe
  2⤵
  PID:9760
- C:\Windows\System\YVcbekv.exe
  C:\Windows\System\YVcbekv.exe
  2⤵
  PID:9776
- C:\Windows\System\roGhCXr.exe
  C:\Windows\System\roGhCXr.exe
  2⤵
  PID:9792
- C:\Windows\System\riXdSpj.exe
  C:\Windows\System\riXdSpj.exe
  2⤵
  PID:9824
- C:\Windows\System\MyTXYGg.exe
  C:\Windows\System\MyTXYGg.exe
  2⤵
  PID:9840
- C:\Windows\System\QBJePLd.exe
  C:\Windows\System\QBJePLd.exe
  2⤵
  PID:9856
- C:\Windows\System\JtQIchf.exe
  C:\Windows\System\JtQIchf.exe
  2⤵
  PID:9872
- C:\Windows\System\AZupJPt.exe
  C:\Windows\System\AZupJPt.exe
  2⤵
  PID:9888
- C:\Windows\System\cLGuiez.exe
  C:\Windows\System\cLGuiez.exe
  2⤵
  PID:9904
- C:\Windows\System\DvKWqal.exe
  C:\Windows\System\DvKWqal.exe
  2⤵
  PID:9920
- C:\Windows\System\QbXmZEz.exe
  C:\Windows\System\QbXmZEz.exe
  2⤵
  PID:9940
- C:\Windows\System\WRXtLlJ.exe
  C:\Windows\System\WRXtLlJ.exe
  2⤵
  PID:9960
- C:\Windows\System\iCQrqfV.exe
  C:\Windows\System\iCQrqfV.exe
  2⤵
  PID:9976
- C:\Windows\System\eSTWKkL.exe
  C:\Windows\System\eSTWKkL.exe
  2⤵
  PID:9996
- C:\Windows\System\jElbIkc.exe
  C:\Windows\System\jElbIkc.exe
  2⤵
  PID:10012
- C:\Windows\System\ZNLnLev.exe
  C:\Windows\System\ZNLnLev.exe
  2⤵
  PID:10028
- C:\Windows\System\BBAUafY.exe
  C:\Windows\System\BBAUafY.exe
  2⤵
  PID:10044
- C:\Windows\System\IsAJwpI.exe
  C:\Windows\System\IsAJwpI.exe
  2⤵
  PID:10060
- C:\Windows\System\EGphSNR.exe
  C:\Windows\System\EGphSNR.exe
  2⤵
  PID:10076
- C:\Windows\System\RmLepIm.exe
  C:\Windows\System\RmLepIm.exe
  2⤵
  PID:10092
- C:\Windows\System\rbtVsRg.exe
  C:\Windows\System\rbtVsRg.exe
  2⤵
  PID:10108
- C:\Windows\System\gRxWtgt.exe
  C:\Windows\System\gRxWtgt.exe
  2⤵
  PID:10124
- C:\Windows\System\WxhdIjz.exe
  C:\Windows\System\WxhdIjz.exe
  2⤵
  PID:10140
- C:\Windows\System\kgvIWbV.exe
  C:\Windows\System\kgvIWbV.exe
  2⤵
  PID:10156
- C:\Windows\System\UyBPAoO.exe
  C:\Windows\System\UyBPAoO.exe
  2⤵
  PID:10176
- C:\Windows\System\EvVUqLL.exe
  C:\Windows\System\EvVUqLL.exe
  2⤵
  PID:10192
- C:\Windows\System\sFlgZDd.exe
  C:\Windows\System\sFlgZDd.exe
  2⤵
  PID:10208
- C:\Windows\System\MeHReog.exe
  C:\Windows\System\MeHReog.exe
  2⤵
  PID:10232
- C:\Windows\System\MnfAxDx.exe
  C:\Windows\System\MnfAxDx.exe
  2⤵
  PID:8912
- C:\Windows\System\aAOaGSr.exe
  C:\Windows\System\aAOaGSr.exe
  2⤵
  PID:8364
- C:\Windows\System\jkHpzBf.exe
  C:\Windows\System\jkHpzBf.exe
  2⤵
  PID:8332
- C:\Windows\System\gJNOrnd.exe
  C:\Windows\System\gJNOrnd.exe
  2⤵
  PID:9224
- C:\Windows\System\kQRtMBo.exe
  C:\Windows\System\kQRtMBo.exe
  2⤵
  PID:8172
- C:\Windows\System\WYAuELw.exe
  C:\Windows\System\WYAuELw.exe
  2⤵
  PID:7776
- C:\Windows\System\CqzgxwN.exe
  C:\Windows\System\CqzgxwN.exe
  2⤵
  PID:9252
- C:\Windows\System\IFAaQbz.exe
  C:\Windows\System\IFAaQbz.exe
  2⤵
  PID:9344
- C:\Windows\System\rhfMzlN.exe
  C:\Windows\System\rhfMzlN.exe
  2⤵
  PID:9412
- C:\Windows\System\kCaHDMh.exe
  C:\Windows\System\kCaHDMh.exe
  2⤵
  PID:9476
- C:\Windows\System\QHZMico.exe
  C:\Windows\System\QHZMico.exe
  2⤵
  PID:9572
- C:\Windows\System\WrDZlGt.exe
  C:\Windows\System\WrDZlGt.exe
  2⤵
  PID:9704
- C:\Windows\System\eOLYeIJ.exe
  C:\Windows\System\eOLYeIJ.exe
  2⤵
  PID:9360
- C:\Windows\System\dmMLJjZ.exe
  C:\Windows\System\dmMLJjZ.exe
  2⤵
  PID:9556
- C:\Windows\System\fvbWhsb.exe
  C:\Windows\System\fvbWhsb.exe
  2⤵
  PID:9456
- C:\Windows\System\FbIrFiF.exe
  C:\Windows\System\FbIrFiF.exe
  2⤵
  PID:9392
- C:\Windows\System\vZlztuA.exe
  C:\Windows\System\vZlztuA.exe
  2⤵
  PID:9492
- C:\Windows\System\sJzVqke.exe
  C:\Windows\System\sJzVqke.exe
  2⤵
  PID:9624
- C:\Windows\System\CshakrJ.exe
  C:\Windows\System\CshakrJ.exe
  2⤵
  PID:9748
- C:\Windows\System\WyTqDqY.exe
  C:\Windows\System\WyTqDqY.exe
  2⤵
  PID:9800
- C:\Windows\System\UXcMRwg.exe
  C:\Windows\System\UXcMRwg.exe
  2⤵
  PID:9752
- C:\Windows\System\tuthLPl.exe
  C:\Windows\System\tuthLPl.exe
  2⤵
  PID:9816
- C:\Windows\System\tdsNgYJ.exe
  C:\Windows\System\tdsNgYJ.exe
  2⤵
  PID:9820
- C:\Windows\System\dOOLOHX.exe
  C:\Windows\System\dOOLOHX.exe
  2⤵
  PID:9832
- C:\Windows\System\RwnmQfW.exe
  C:\Windows\System\RwnmQfW.exe
  2⤵
  PID:9896
- C:\Windows\System\NhDljok.exe
  C:\Windows\System\NhDljok.exe
  2⤵
  PID:9948
- C:\Windows\System\LFuUBtf.exe
  C:\Windows\System\LFuUBtf.exe
  2⤵
  PID:9988
- C:\Windows\System\LVTUNFt.exe
  C:\Windows\System\LVTUNFt.exe
  2⤵
  PID:10052
- C:\Windows\System\OULeqNz.exe
  C:\Windows\System\OULeqNz.exe
  2⤵
  PID:9936
- C:\Windows\System\FYoptTh.exe
  C:\Windows\System\FYoptTh.exe
  2⤵
  PID:10004
- C:\Windows\System\ZJTIZjf.exe
  C:\Windows\System\ZJTIZjf.exe
  2⤵
  PID:10068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AuPMFCu.exe

Filesize
1.9MB

MD5
ad19d7e6e6fa0c5a13d6976a2fe1148f

SHA1
cecd7473ffa460e0277f724bc273e26bf49f990e

SHA256
b5cd08bb8f2cd6d41ad946d44ae17b9cb2cfe1290c3fa99a2883070fe86f5e34

SHA512
d74770362d5214d1a1a4fcce1737d9c327c249936963e2ed8fa3d4f91529ab49c7c927bfea2588f805f31acadbb48ecf6c63e1a7d6a7924f3d5838d24928284e

Download Submit
C:\Windows\system\DBOHtOb.exe

Filesize
1.9MB

MD5
4cdc3fc130e6870743012986ccceeb7a

SHA1
0276fd67aa1092e01c061f239f6b9562a0f36d12

SHA256
478eaa681f28b43e2996796b0b6e2542b16b623a288b1ccf7cff5033ba4db019

SHA512
0ff4bcdfbca2d6e9e1f8bcc813b1957895e18d961a4b63a46bccf1e8a784d39b61fb944be27177a4343ea2386a868b034a08642878ecf7e359979f41cf0b6289

Download Submit
C:\Windows\system\HTEpQSP.exe

Filesize
1.9MB

MD5
d8ce0c651fd1265a35275e84ec6a0b72

SHA1
6b8838a522a4417ffa229098a4357b5470dd8f3d

SHA256
bc8b655f6af700f8b9a99c5d91acb7bae9544455b520d83751c71a959351419a

SHA512
d3a6230cd564c86b942d550c81cedab5fc03e8c4b2872c4fc5a1a4503b7c537a0d5fb000f1a1667d55edcdf40a9520d6213564ca44c2d86bc462f12b87db1933

Download Submit
C:\Windows\system\IilaZFa.exe

Filesize
1.9MB

MD5
c75ddac13c9fe293dd28c6978296f4fc

SHA1
74c68f9fa2da98df839094176a3efede28c6f8b6

SHA256
2c759c1e6e1fa859dc395ea4f0087c0e33fba8ffa3d01bc3bdeb131efcf6d005

SHA512
0571e7db4eab55588beb0df074aea75214f4887a6858cf50aaa2a25b342600082d26ca29a1147d5a6d5122c7f284b2a38a7c4ccd1fc172ac2ef41193636628e0

Download Submit
C:\Windows\system\LDHAtKJ.exe

Filesize
1.9MB

MD5
c8f755b686f3ea24556b468eb5fc274d

SHA1
13a8a9b52568aaaa4fd749b3be2ebb2a818711d2

SHA256
6b11f9f6773f4e983310e6637c2542d9f68f8710fcfa3d1fc26f92b1b49eb925

SHA512
4b3d16bc8d40b0136f364073fe405d2de215419fb00623ff41a0e590a8e8de76c9be8100bea3ceacbecc239a0e6999dc0c24f1d505cb2439fbc548bb79f3d312

Download Submit
C:\Windows\system\RTjlmxh.exe

Filesize
1.9MB

MD5
da7e885a468a85bde6f8b295e83167c7

SHA1
24d251641cf9b6945f3f2707645a89b92ae95934

SHA256
1828ce5d3edec136f8c98eea1a15895603f37beeefe25f720f7e1fdc57852242

SHA512
15e95c90415d2805684c4ffe8fc8170f7354d46cf01ca0ab5099deb29be96cc8ad9d64b3216200a7d567c195bd1316a9891ec4513db98d977d2d55cd0f4c4497

Download Submit
C:\Windows\system\SakBrKx.exe

Filesize
1.9MB

MD5
d2fa4982d3cbd4a41d8da7b55665d0de

SHA1
97caf833b5f1f26b4044e111f0f9f10fecc78fc0

SHA256
1b32cd78018aca7d756d1f94a9ce3b3010a34fa6454d0c2f6995bd207fef7c88

SHA512
c40f102d7b92dcf10f3401e20ac565464d8ef779fcb0a5f7583c3c4c5888eeaa480ba90039b77b248d5925f209a5abb72cb5af1982f6b6048afacbd968480afa

Download Submit
C:\Windows\system\SdSXFbC.exe

Filesize
1.9MB

MD5
8e6615c76cb7b7094ee9974c84fc329a

SHA1
f6d0c444bd88b9a5decf6f9be4c421dfcce23b76

SHA256
3bf2c8c927057a0fca7dfac95fbae247cdc5c284e2d228271ccf5271b1878ebc

SHA512
cc809ddeae3b4695d65482ef9dfafc7dc8d158b54c4265c258990c34430725979a925cc385764873d1877deed25ca09ca27c15859ffc2358aed7912a3a0e522e

Download Submit
C:\Windows\system\TroKcRz.exe

Filesize
1.9MB

MD5
5079614c38a26bd7adb97cb9cfc118d8

SHA1
49d0b541829c2b1b12546b60a2dd37a0c1d9b951

SHA256
011971bf1a6ce38d90d4785b61464a8d021dd7b3872956bc7c7aa8d7e606a74f

SHA512
47772560840c2014626a216d61415db6b43baf83c37082fdc1776b00d0e6dec4d5942764161488ccb7d7646e70c8b77004333a3cd476646eeb9f9f5601829f25

Download Submit
C:\Windows\system\UrRKRAS.exe

Filesize
1.9MB

MD5
d5492ae8e6d26958401f4809e43601d5

SHA1
9ebe333f7bc4ec7064e02367d9f2d25cd8e8177d

SHA256
becfd121e87ab83b218c526bfb3af72e6859067c6ba9d198431256f8a9b95ad9

SHA512
5263c2ac286bc85125b8f6d9cd9e4b215c06bfb44c9420bf4f7dd2ca5529e3b10dc429079897eeba85e8dd778f3b513ecf033eb43cddee38e22496ba31042ac8

Download Submit
C:\Windows\system\YGzoxkz.exe

Filesize
1.9MB

MD5
188a0ed8f297c73471f3d44519009464

SHA1
078e8906b469eec3a0880f5b08e7c63233efc530

SHA256
a6b7d85871b759093671718eae7085beb05c013db55cede8ee11151abc762449

SHA512
8c7c40d44c986bc45b9637a9916d7e322cd31c95d574e57e518b3c46509a6fff71f5aaf85babf970437cbe7bf1069244a2d4dbce004b63526b3d5dccef7e5990

Download Submit
C:\Windows\system\bGVcIfm.exe

Filesize
1.9MB

MD5
1be1944b37f13476499eff9560a316b7

SHA1
e109b9dbf4ad729faa41bba9937526b3344653e6

SHA256
8a881bafad2d34c81ae966ea6356087456c2b529d5cdef7900cef918d1f872f3

SHA512
64aec509c17edb3883df5074caa894fc1db8067ee8d441463a3a3126c312d22e7e71d799a86cf68cb19bc2f88b500c91f34f7b5ca2d4fcfad7c45c3083cd4be0

Download Submit
C:\Windows\system\bxlZbVZ.exe

Filesize
1.9MB

MD5
06964a5d105300a4a3c68cda506e7c1f

SHA1
c5d64227f555ce8e77a006335cb34fe0e678ebee

SHA256
5a587ba8981133210492a979b7936ad6d1ee35bf717348cfee3428b4cc8457fb

SHA512
e10b731c0eea12fcba45b63e59accbe923a62a966961dbc9010eba7757e2a1ec178b5b7df5af16c1ab1ea29ac2118d6a92904b482e24a8fadf40ebbb88b1839a

Download Submit
C:\Windows\system\ewpFxXz.exe

Filesize
1.9MB

MD5
8e40471c42e6cc48dffb1d2f7adb30d9

SHA1
d584d451990b789f4f669bebf7fdf60549cd0cf1

SHA256
513b5fd21990f727e16827e27087b4158bffe5add4ac2feeacfbc3949353c10d

SHA512
6fce461d8cbffcf91330b4d6fc69911d23e97f681ee0b48126f4384b3d2098139823006c2460e3ced6a4363645ad2288b88cc461ed577946af84953ec55051c2

Download Submit
C:\Windows\system\ghGTRRO.exe

Filesize
1.9MB

MD5
b41bcb2382c4ac2fdf5820a79bd86554

SHA1
bd88ed2b40778b6e140f78f6b2fc93f0b9bcf0d9

SHA256
99bb98380cdf95dd747845a76f9ada92e7265ecc06a6df71fd4659fa8ef171ce

SHA512
7cdbcbc6df0f166925bd42d31f45413710e97e7adae36a0e61242e9e3320d92d8b1e0c6dfd81c7473ac72f3a8f2243a3b587e020669593159254789344ea62cb

Download Submit
C:\Windows\system\gmsJHGR.exe

Filesize
1.9MB

MD5
f7b71e98ecd7ac7e690dcbc9771f1f1e

SHA1
48e9edcc0a905bf77084ee5536ecd56ce48a7996

SHA256
cfd32ae94e1b5e4c61dc936343bee89d3d4380009f345740b243dc10d8bfc18d

SHA512
44b87b9342aec6b38a9f39ae25e2af3317943c5ba2b74ed8b3c84351150c256dbf8dd9e2924e4301df4a4a815b9f547ea7462cddd8d35737999480c999b6254c

Download Submit
C:\Windows\system\hOVEwRs.exe

Filesize
1.9MB

MD5
087d7fae2616c33111301646f8bbc003

SHA1
514f705c37d54e97f6a696ed594bcf5bb3a31e10

SHA256
d76db9fbd2b8e740a2e9422d4261855e3e4d21bab67bd70505904dcb3d95d5c8

SHA512
dfeefb4328952a504651da2be7fdf6a2d1447a72bc1a723939b71036baea4307031e03bc2852436f8792f09575bf2c8381a9238b19d915d7090b83fedeb38ed6

Download Submit
C:\Windows\system\kxXutHN.exe

Filesize
1.9MB

MD5
866d4fed709456ed9533a7bda2d2ae0a

SHA1
b42a154e976e08b34a96fd6b1a548b4d658e508b

SHA256
0fb0c2ea956ad4b371b126c96596f2984c0c76f06f0d919316d606a65cd27a5d

SHA512
da765be6658606ae7103bd67a194cca02d59cebafe028a2027ca76ef3630c846682299159944df197876d5b2a3fe15fa48d19100e4ea84d17f69d0981f78eab7

Download Submit
C:\Windows\system\nlrGGtA.exe

Filesize
1.9MB

MD5
e7e9a88337e6b96e80feeee521b3df0c

SHA1
b5005b624850b5e5dffaf31f70d639b232324654

SHA256
e624da6b44bdf213585337672e81346acbfe9bf49743ba8cd23088a9e0bc097d

SHA512
0cb1cf536f2c60cfdb5501b82b9181cdecb86cbae5aad96ac105098b9279d290e703ff8240624577deea74db11e23ccef8257f3d00d261d8c2ee88b12938a2ac

Download Submit
C:\Windows\system\oVZjJIW.exe

Filesize
1.9MB

MD5
957c016b426abd0f192d0bbb90269e22

SHA1
448289f89cf213ce1cd8067528a85cb113c2aa73

SHA256
da3b1c0b7c21ea9fdab7c6a5a529b517014273b571041dd6b7236073f4855c61

SHA512
b4887830b3550644026b9fb1c9c0e99a3b1615abdd36e2968b4f1878e935b5e8646b2a1256314d963ae4e35e4688be162c200fbac35ffe5a1d9e357e7e28afa5

Download Submit
C:\Windows\system\sBpuAMV.exe

Filesize
1.9MB

MD5
843e96c7fe05f5c6a5534f220f26f2ef

SHA1
88401c13e59320a701c3a2d462be9e8aa2c7ded9

SHA256
40b5f8d0c6403349dc71caa25b2cec48e7793b31c93f703b9b574b7775763bf5

SHA512
58dddca9dc2a87030391bd05da01f54d67d692ec9d364b820b6fa6d35f8e254c363423bc1e550e6e70744f73b52815ba9a1df70c8d4c15a612e5b491e24dea75

Download Submit
C:\Windows\system\sHtWLnR.exe

Filesize
1.9MB

MD5
3f144978f9c49ab871ba0feb55c99c03

SHA1
6d26c2b350eddd00b9fd4f35d8c8ff08ab0aa68a

SHA256
d3e122b38edb0832bead9ea72cc56097717024675bca9c3a6d160add303a01cf

SHA512
cf26a36de539f9eec45c4c8742042a856b2a15c23cae3f08bfe944e962e59745230bed3e6279a383db26d8d67591d456b53ce14710e94cf6cf5f3a1dc8f5ae27

Download Submit
C:\Windows\system\ufjxaOR.exe

Filesize
1.9MB

MD5
cfc909f47953256cc01ef8debda2eca9

SHA1
9c4a191d104e01301d5a2816f8dd26b302556c96

SHA256
fb2c1ce5d479d05b4a01fc14dc7b47d8efd2e1aaf6e91bc3815ee243b6ce1345

SHA512
28744a179038888a34f5018e7f705a54c4a7211a516a4828f1f8503b6ac7717ba171019befe74490d537059b94090517c63698c3c794597697e2c0d280d25b69

Download Submit
C:\Windows\system\wZAwjfp.exe

Filesize
1.9MB

MD5
88183bbce54fa63060003cb08e43149e

SHA1
1588288037b2596deb9747bfbd7ea2c2774d3730

SHA256
2fefae4ec7c0b0fe652c3e03927922b213df79a4db5ced7117089239ca22362b

SHA512
f55d3a8cee42381ff7c9aaeb5c1e26ef0e078cbb3170dee9a79e7ade3d0cdeb5a2ee5d0395feea795a8840302770ef93b5531f2b2a1319267ff8f4e115e237ca

Download Submit
\Windows\system\CZsbOwx.exe

Filesize
1.9MB

MD5
5f988c92309f30644ad53e57c1a626c7

SHA1
0a9b6b98965beb5395af9b63246d3709f39435d8

SHA256
298a2412db9f0554dc6b4ca176148dba09df260156afc10109f6c7781e442f56

SHA512
f6b3a77312bbd175bd23d82202c4ace98e2bad82bc11dc1b5a7c971be6269e8016f22d925c4a5961391cfe6a99f34399e61c6be4d38c94348def2e7d60bbdc58

Download Submit
\Windows\system\IjHyxok.exe

Filesize
1.9MB

MD5
151c09ac6da8aaf6dc33e3b4742af5ba

SHA1
5cf37f3236c734471561e17e232fc78ee61e94be

SHA256
5fb01776ee601d327f0f2b3c492b543473d97a0e618d6c56cb99c2f77119061e

SHA512
8aa49fdb2eedcd1efdfd4fb5955a8451efdecd0016304039c6c00e0584d2694fae57a9a7bd4b0c0b0dda943285192fc49fdf27e6a47137dd329080192d4e82b8

Download Submit
\Windows\system\PBSvnZs.exe

Filesize
1.9MB

MD5
6c42a9a5ac97285e667dfef61f7ef895

SHA1
515da4bdab2e58f0bc7f8372f1cd9b1fc3582963

SHA256
028e464a9f59e37c78ff07725cb83a846398b1c11ed4c670dcb74e4de1193965

SHA512
1c3813cd4092268ba3139e4b7cb40049bc2b611a781c1004481e2448633a92ac438b431be79408501f5dd4e3569729d3863f9357c9c990f11702760fec153812

Download Submit
\Windows\system\SLzhnRR.exe

Filesize
1.9MB

MD5
98392bb85f77bf77841b3a768c3fe7fc

SHA1
e6d64ea08f7f75a3c10eb3a93af6e16a3aaa494f

SHA256
12e626cff38bb4071dd59b7ac79d98f5e63d1608e51c0dcf13c8b4c8541d3f8f

SHA512
3e85c7f5cb87f94bc933e908f1aa402d02bb9b4d16caaa2e378241e3c3a211043ef896af70e08f63055bd88ddaa8c1948d3fe41884112c15bfc4c5c4d1b9a0c1

Download Submit
\Windows\system\UxRMMXU.exe

Filesize
1.9MB

MD5
c675fe45cb51ffb6f5d448b967c30a2d

SHA1
caa328e18ba6a78335b91fabedc411005af8e456

SHA256
4cdd8c0704c06bd43ed14e9725fcd267cb313dc53e51925533910a657485e98d

SHA512
f9a583577861a17070c2959d64cac4d4b269d68954e81127f90cdca7314be1abca7604430f7f259857702727163fce1457f52c313ae3888b31ffeb1c1ccace75

Download Submit
\Windows\system\dHwHaPK.exe

Filesize
1.9MB

MD5
f18fb631caf6690a296f9866e22446a7

SHA1
3378cbd30bbd64c2e669983ce37dede23f41447d

SHA256
2b7af693270d3dbc80b13fcec3f8def42e79fac475416d2d694af8719b52f87f

SHA512
8eddede78eff9f794e0d40cc05811f2581746b2511242e3a6e90fccbbbecf7d1fb3a94bf9acc9a71bf8145b13ad56521e05af5c40cd92be3966dbbb0ace26704

Download Submit
\Windows\system\djyDPYL.exe

Filesize
1.9MB

MD5
e0051e9af2071095afba25a83b614fc0

SHA1
e7e37d49bc249680d0e873be98d05006ee2c1c40

SHA256
accfd7fa7c16be49d5ff64d0d35f3374eb0ad4add63195f00ebfcf10cb0f5c49

SHA512
2a31607d7715b164dbb63bc86efaacc678dfb2995c5d6cf39101a2699136dcf75bf539c8d2a2e38b2286c275b819b49d83ea43e05bb92eda0fc75e3a99b7f7ba

Download Submit
\Windows\system\tsKtSUO.exe

Filesize
1.9MB

MD5
d02c3080d33c43e1dfe93c592c07eb0e

SHA1
d5da88987cfab0756c423be68cfb819cca13cb83

SHA256
84e077752803f79105bbf936cbd85a1ea661266c743fedc42a813cf52d5c18bd

SHA512
707a890482101b0a4b951ebe0bb221194fb774384e1715e939e07af0e3e51a21fde1a2569797d92e972198deff792d0cb82416f587befef113e9acb3e5ae82ed

Download Submit
\Windows\system\vabkPPi.exe

Filesize
1.9MB

MD5
39e83b5f3d8ccfb7675fd37f0548efa6

SHA1
30f5aec307b01442206f7e343e20271015dbdc23

SHA256
46e926935decf50731fbb400ed63d38e69b6c57f56f08874f26e66d1bf2c028f

SHA512
8e14abdea03e4b23ecf884d5dbe8558108e78720c939b2a3579b3c2b605727639f425d2acaccf929bde776f9489b786a81c6c8701c4eaaa15d3c863f045f5d89

Download Submit
memory/1956-20-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/1956-204-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/1956-205-0x0000000001EC0000-0x0000000001EC8000-memory.dmp

Filesize
32KB

Download
memory/1956-140-0x0000000002B40000-0x0000000002BC0000-memory.dmp

Filesize
512KB

Download
memory/1956-384-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/1956-139-0x000007FEF5270000-0x000007FEF5C0D000-memory.dmp

Filesize
9.6MB

Download
memory/2188-152-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2320-149-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2320-155-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/2320-153-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2320-144-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2320-2093-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2320-160-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2320-142-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2320-18-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2320-147-0x0000000003350000-0x0000000003742000-memory.dmp

Filesize
3.9MB

Download
memory/2320-151-0x000000013FA30000-0x000000013FE22000-memory.dmp

Filesize
3.9MB

Download
memory/2320-1-0x000000013FE90000-0x0000000140282000-memory.dmp

Filesize
3.9MB

Download
memory/2320-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2320-11-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download
memory/2424-150-0x000000013FAE0000-0x000000013FED2000-memory.dmp

Filesize
3.9MB

Download
memory/2500-143-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2508-156-0x000000013FAD0000-0x000000013FEC2000-memory.dmp

Filesize
3.9MB

Download
memory/2524-19-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2524-2095-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2548-141-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2720-146-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/2800-148-0x000000013FFC0000-0x00000001403B2000-memory.dmp

Filesize
3.9MB

Download
memory/2952-12-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download