xmrig | e537c089fe705808306bc63a2a62ac4be5e9297a4124ccf80f3ea0e4dd46571e

Analysis

max time kernel
25s
max time network
29s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
Size

1.4MB
MD5

0454463fb51b881a49aa3bdf0232d0e6
SHA1

949a4a7ac79118435243687bc9a204b01f14f7f1
SHA256

e537c089fe705808306bc63a2a62ac4be5e9297a4124ccf80f3ea0e4dd46571e
SHA512

407de3a2574becaabc6fc65ad76ab2c8dd594584a79355ec7eb4538732802e65464d286d11e91be375dea19b7d0a2d30af7d06d3182557727ecbf8e8cb0c20d4
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWYKpGncHBN/VPwlZCJ:Lz071uv4BPMkibTIA5CJ/

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2860-59-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2588-57-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	xmrig
behavioral1/memory/2460-64-0x000000013F200000-0x000000013F5F2000-memory.dmp	xmrig
behavioral1/memory/2576-61-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/1720-1153-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2176-1152-0x000000013F530000-0x000000013F922000-memory.dmp	xmrig
behavioral1/memory/2956-74-0x000000013F600000-0x000000013F9F2000-memory.dmp	xmrig
behavioral1/memory/2176-55-0x0000000002F30000-0x0000000003322000-memory.dmp	xmrig
behavioral1/memory/2648-54-0x000000013FA20000-0x000000013FE12000-memory.dmp	xmrig
behavioral1/memory/2620-51-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2536-45-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1720	gMrcVQw.exe
2536	OgMQKMY.exe
2620	SJkDphy.exe
2648	bIjfpll.exe
2588	mbEZiUC.exe
2860	eQLozJq.exe
2576	PfHpJBq.exe
2460	bkeuQzP.exe
2956	vBwvvDr.exe
1256	DIgcSRP.exe
2844	nkGaKYx.exe
2528	HJzFFnd.exe
1636	hLFBxJf.exe
2964	jSkZPUV.exe
1912	GtcCowM.exe
2740	ZYsneWv.exe
1652	LAfHJCQ.exe
2408	qflaYiR.exe
2736	ezhjFya.exe
2756	LezLVUK.exe
384	wLGPXnL.exe
1448	ackGzNS.exe
312	beGWrlx.exe
1780	acdOOse.exe
2168	dTaAeAP.exe
2096	GezsFyT.exe
448	BnxZucz.exe
816	TjPPbeE.exe
2252	mqwovmR.exe
2404	kKVZgIp.exe
1160	sffZmiQ.exe
2128	nWeDvSL.exe
1548	iagziKH.exe
1336	PMTaiHV.exe
1864	IlpNuhA.exe
472	MBzQBip.exe
928	dybZmdy.exe
2308	uMKlWog.exe
552	cOgUcYL.exe
2916	cwbDFEV.exe
1508	XCqPUiq.exe
2032	YAtRlfP.exe
2968	FvkLEeG.exe
1616	LQSuCur.exe
3060	cYXmyHk.exe
2084	iqdHcLY.exe
2568	ESioKze.exe
2444	coRaBMp.exe
2932	hNmryDh.exe
2864	JlwTJGB.exe
1824	VPLkxoc.exe
1532	jLozYbc.exe
3056	QVTZyiI.exe
2080	opWaIxL.exe
780	obzQDKa.exe
1800	PhWwzuj.exe
2808	iSFlLtD.exe
2892	dYabVcL.exe
2632	hcbMbUu.exe
540	QWeUBQk.exe
1496	xuDoXcJ.exe
1852	HOKauoj.exe
2020	RCInpVP.exe
1016	vGXBbqJ.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-0-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x000b000000013417-6.dat	upx
behavioral1/files/0x0034000000013a53-15.dat	upx
behavioral1/files/0x0016000000005586-16.dat	upx
behavioral1/files/0x000800000001418c-23.dat	upx
behavioral1/files/0x000700000001431b-30.dat	upx
behavioral1/files/0x0008000000014367-35.dat	upx
behavioral1/files/0x0007000000014a60-36.dat	upx
behavioral1/files/0x0007000000014251-27.dat	upx
behavioral1/memory/2860-59-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2588-57-0x000000013F4F0000-0x000000013F8E2000-memory.dmp	upx
behavioral1/memory/2460-64-0x000000013F200000-0x000000013F5F2000-memory.dmp	upx
behavioral1/memory/2576-61-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/files/0x0006000000015083-103.dat	upx
behavioral1/files/0x0034000000013a88-114.dat	upx
behavioral1/files/0x0006000000015662-124.dat	upx
behavioral1/files/0x000600000001565a-119.dat	upx
behavioral1/files/0x00060000000158d9-130.dat	upx
behavioral1/files/0x0006000000015cf8-173.dat	upx
behavioral1/files/0x0006000000015d59-187.dat	upx
behavioral1/files/0x0006000000015b50-135.dat	upx
behavioral1/files/0x0006000000015d39-182.dat	upx
behavioral1/files/0x0006000000015d0a-175.dat	upx
behavioral1/files/0x0006000000015cee-168.dat	upx
behavioral1/files/0x0006000000015cd2-161.dat	upx
behavioral1/files/0x0006000000015cb1-154.dat	upx
behavioral1/files/0x0006000000015c9a-146.dat	upx
behavioral1/memory/1720-1153-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2176-1152-0x000000013F530000-0x000000013F922000-memory.dmp	upx
behavioral1/files/0x0006000000015d21-180.dat	upx
behavioral1/files/0x0006000000015ce3-166.dat	upx
behavioral1/files/0x0006000000015cc5-159.dat	upx
behavioral1/files/0x0006000000015ca8-152.dat	upx
behavioral1/files/0x0006000000015b85-144.dat	upx
behavioral1/files/0x0006000000015ae3-133.dat	upx
behavioral1/files/0x00060000000153ee-109.dat	upx
behavioral1/files/0x0006000000014f57-100.dat	upx
behavioral1/files/0x00060000000150d9-98.dat	upx
behavioral1/files/0x000600000001507a-97.dat	upx
behavioral1/memory/1256-77-0x000000013F1C0000-0x000000013F5B2000-memory.dmp	upx
behavioral1/memory/2844-90-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0006000000014c2d-81.dat	upx
behavioral1/files/0x0006000000014bd7-76.dat	upx
behavioral1/memory/2956-74-0x000000013F600000-0x000000013F9F2000-memory.dmp	upx
behavioral1/files/0x0006000000014b1c-67.dat	upx
behavioral1/memory/2648-54-0x000000013FA20000-0x000000013FE12000-memory.dmp	upx
behavioral1/memory/2620-51-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2536-45-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/1720-44-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\qhXzRzp.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\OSzkRuB.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jTmCzpO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\HmExiqF.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\wtvkeuu.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\WgeVIRv.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\OdJGeFM.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\hNufgUA.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\XzylwmX.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\xzixntl.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\UfiGrBV.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jvvxzrW.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\DNfdeul.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\PXERBTB.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\RKVOSIo.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\oCeClAt.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\gSgUizh.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\hSgNYpa.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\JBZpysy.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\OkKeHiW.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\ghQFnZt.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\xAtBwmq.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\rhXmeSV.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\wMRKpKn.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\iWobGjW.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\yuFBeNM.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\oSFxoJP.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\pjIjlQg.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\VzkgERD.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\uJFNiqg.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\XnYRjSS.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\rTcaJvm.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\MVfDISd.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\aSufPvD.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\dcLFTxi.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\daZKsqc.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\orUtWmL.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\cyOmTuM.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\HOwKgFO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\WEwMrSv.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\isomceZ.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\KLcFaZw.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\pJVNfXt.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\KAIIUtf.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\hLZRwHv.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\qkUIVEH.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\mYIGqGO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jiOBQfb.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\ATBjprX.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\NSVRLxL.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\kwbifoe.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\YgpQHgF.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\kXQZPhj.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\jEuDKrA.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\WoaGFWg.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\xtAapEW.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\cfvIkqx.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\CHOHFHf.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\urGvJIO.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\aDISqIU.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\LdpRaBb.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\MBzQBip.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\iRETqOp.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
File created	C:\Windows\System\ZLDpCcV.exe	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1700	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
Token: SeDebugPrivilege	1700	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1700	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	29
PID 2176 wrote to memory of 1700	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	29
PID 2176 wrote to memory of 1700	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	29
PID 2176 wrote to memory of 1720	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1720	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1720	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2536	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2536	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2536	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2620	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2620	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2620	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2648	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2648	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2648	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2588	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2588	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2588	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2860	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2860	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2860	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2576	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2576	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2576	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2460	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2460	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2460	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2956	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2956	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2956	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	38
PID 2176 wrote to memory of 1256	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	39
PID 2176 wrote to memory of 1256	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	39
PID 2176 wrote to memory of 1256	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2844	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2844	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2844	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2964	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2964	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2964	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2528	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	42
PID 2176 wrote to memory of 2528	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	42
PID 2176 wrote to memory of 2528	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1912	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1912	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1912	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	43
PID 2176 wrote to memory of 1636	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	44
PID 2176 wrote to memory of 1636	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	44
PID 2176 wrote to memory of 1636	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2740	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2740	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2740	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	45
PID 2176 wrote to memory of 1652	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1652	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1652	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	46
PID 2176 wrote to memory of 2408	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2408	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2408	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2736	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2736	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2736	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2756	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	49
PID 2176 wrote to memory of 2756	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	49
PID 2176 wrote to memory of 2756	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	49
PID 2176 wrote to memory of 384	2176	0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0454463fb51b881a49aa3bdf0232d0e6_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\System\gMrcVQw.exe
  C:\Windows\System\gMrcVQw.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\OgMQKMY.exe
  C:\Windows\System\OgMQKMY.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\SJkDphy.exe
  C:\Windows\System\SJkDphy.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\bIjfpll.exe
  C:\Windows\System\bIjfpll.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\mbEZiUC.exe
  C:\Windows\System\mbEZiUC.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\eQLozJq.exe
  C:\Windows\System\eQLozJq.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\PfHpJBq.exe
  C:\Windows\System\PfHpJBq.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\bkeuQzP.exe
  C:\Windows\System\bkeuQzP.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\vBwvvDr.exe
  C:\Windows\System\vBwvvDr.exe
  2⤵
  - Executes dropped EXE
  PID:2956
- C:\Windows\System\DIgcSRP.exe
  C:\Windows\System\DIgcSRP.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\nkGaKYx.exe
  C:\Windows\System\nkGaKYx.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\jSkZPUV.exe
  C:\Windows\System\jSkZPUV.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\HJzFFnd.exe
  C:\Windows\System\HJzFFnd.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\GtcCowM.exe
  C:\Windows\System\GtcCowM.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\hLFBxJf.exe
  C:\Windows\System\hLFBxJf.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\ZYsneWv.exe
  C:\Windows\System\ZYsneWv.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\LAfHJCQ.exe
  C:\Windows\System\LAfHJCQ.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\qflaYiR.exe
  C:\Windows\System\qflaYiR.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\ezhjFya.exe
  C:\Windows\System\ezhjFya.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\LezLVUK.exe
  C:\Windows\System\LezLVUK.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\wLGPXnL.exe
  C:\Windows\System\wLGPXnL.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\ackGzNS.exe
  C:\Windows\System\ackGzNS.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\beGWrlx.exe
  C:\Windows\System\beGWrlx.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\opWaIxL.exe
  C:\Windows\System\opWaIxL.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\acdOOse.exe
  C:\Windows\System\acdOOse.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\iSFlLtD.exe
  C:\Windows\System\iSFlLtD.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\dTaAeAP.exe
  C:\Windows\System\dTaAeAP.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\dYabVcL.exe
  C:\Windows\System\dYabVcL.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\GezsFyT.exe
  C:\Windows\System\GezsFyT.exe
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Windows\System\QWeUBQk.exe
  C:\Windows\System\QWeUBQk.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\BnxZucz.exe
  C:\Windows\System\BnxZucz.exe
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Windows\System\xuDoXcJ.exe
  C:\Windows\System\xuDoXcJ.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\TjPPbeE.exe
  C:\Windows\System\TjPPbeE.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\HOKauoj.exe
  C:\Windows\System\HOKauoj.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\mqwovmR.exe
  C:\Windows\System\mqwovmR.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\RCInpVP.exe
  C:\Windows\System\RCInpVP.exe
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Windows\System\kKVZgIp.exe
  C:\Windows\System\kKVZgIp.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\vGXBbqJ.exe
  C:\Windows\System\vGXBbqJ.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\sffZmiQ.exe
  C:\Windows\System\sffZmiQ.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\PuJJYmZ.exe
  C:\Windows\System\PuJJYmZ.exe
  2⤵
  PID:752
- C:\Windows\System\nWeDvSL.exe
  C:\Windows\System\nWeDvSL.exe
  2⤵
  - Executes dropped EXE
  PID:2128
- C:\Windows\System\PDbMpBY.exe
  C:\Windows\System\PDbMpBY.exe
  2⤵
  PID:3048
- C:\Windows\System\iagziKH.exe
  C:\Windows\System\iagziKH.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\loJVxNW.exe
  C:\Windows\System\loJVxNW.exe
  2⤵
  PID:1952
- C:\Windows\System\PMTaiHV.exe
  C:\Windows\System\PMTaiHV.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\FlExQyB.exe
  C:\Windows\System\FlExQyB.exe
  2⤵
  PID:612
- C:\Windows\System\IlpNuhA.exe
  C:\Windows\System\IlpNuhA.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\tAzCBQf.exe
  C:\Windows\System\tAzCBQf.exe
  2⤵
  PID:1328
- C:\Windows\System\MBzQBip.exe
  C:\Windows\System\MBzQBip.exe
  2⤵
  - Executes dropped EXE
  PID:472
- C:\Windows\System\Vzwszbz.exe
  C:\Windows\System\Vzwszbz.exe
  2⤵
  PID:1272
- C:\Windows\System\dybZmdy.exe
  C:\Windows\System\dybZmdy.exe
  2⤵
  - Executes dropped EXE
  PID:928
- C:\Windows\System\AfMWQTX.exe
  C:\Windows\System\AfMWQTX.exe
  2⤵
  PID:1880
- C:\Windows\System\uMKlWog.exe
  C:\Windows\System\uMKlWog.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\xtAapEW.exe
  C:\Windows\System\xtAapEW.exe
  2⤵
  PID:1804
- C:\Windows\System\cOgUcYL.exe
  C:\Windows\System\cOgUcYL.exe
  2⤵
  - Executes dropped EXE
  PID:552
- C:\Windows\System\DNfdeul.exe
  C:\Windows\System\DNfdeul.exe
  2⤵
  PID:1308
- C:\Windows\System\cwbDFEV.exe
  C:\Windows\System\cwbDFEV.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\gCSeptQ.exe
  C:\Windows\System\gCSeptQ.exe
  2⤵
  PID:2928
- C:\Windows\System\XCqPUiq.exe
  C:\Windows\System\XCqPUiq.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\hXSUKee.exe
  C:\Windows\System\hXSUKee.exe
  2⤵
  PID:892
- C:\Windows\System\YAtRlfP.exe
  C:\Windows\System\YAtRlfP.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\ACgqBZN.exe
  C:\Windows\System\ACgqBZN.exe
  2⤵
  PID:2976
- C:\Windows\System\FvkLEeG.exe
  C:\Windows\System\FvkLEeG.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\gMuTSzC.exe
  C:\Windows\System\gMuTSzC.exe
  2⤵
  PID:1612
- C:\Windows\System\LQSuCur.exe
  C:\Windows\System\LQSuCur.exe
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Windows\System\eJzJsoL.exe
  C:\Windows\System\eJzJsoL.exe
  2⤵
  PID:2708
- C:\Windows\System\cYXmyHk.exe
  C:\Windows\System\cYXmyHk.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\LGYDuFV.exe
  C:\Windows\System\LGYDuFV.exe
  2⤵
  PID:2640
- C:\Windows\System\iqdHcLY.exe
  C:\Windows\System\iqdHcLY.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\VzkgERD.exe
  C:\Windows\System\VzkgERD.exe
  2⤵
  PID:2688
- C:\Windows\System\ESioKze.exe
  C:\Windows\System\ESioKze.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\rDjiTvj.exe
  C:\Windows\System\rDjiTvj.exe
  2⤵
  PID:2488
- C:\Windows\System\coRaBMp.exe
  C:\Windows\System\coRaBMp.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\cwHTqKP.exe
  C:\Windows\System\cwHTqKP.exe
  2⤵
  PID:2552
- C:\Windows\System\hNmryDh.exe
  C:\Windows\System\hNmryDh.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\TXUGPnu.exe
  C:\Windows\System\TXUGPnu.exe
  2⤵
  PID:2044
- C:\Windows\System\JlwTJGB.exe
  C:\Windows\System\JlwTJGB.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\BOtRCjT.exe
  C:\Windows\System\BOtRCjT.exe
  2⤵
  PID:2324
- C:\Windows\System\VPLkxoc.exe
  C:\Windows\System\VPLkxoc.exe
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Windows\System\LfrzbmU.exe
  C:\Windows\System\LfrzbmU.exe
  2⤵
  PID:2752
- C:\Windows\System\jLozYbc.exe
  C:\Windows\System\jLozYbc.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\XeiMtep.exe
  C:\Windows\System\XeiMtep.exe
  2⤵
  PID:1732
- C:\Windows\System\QVTZyiI.exe
  C:\Windows\System\QVTZyiI.exe
  2⤵
  - Executes dropped EXE
  PID:3056
- C:\Windows\System\jhSjuZq.exe
  C:\Windows\System\jhSjuZq.exe
  2⤵
  PID:1340
- C:\Windows\System\obzQDKa.exe
  C:\Windows\System\obzQDKa.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\DDyViXQ.exe
  C:\Windows\System\DDyViXQ.exe
  2⤵
  PID:1784
- C:\Windows\System\PhWwzuj.exe
  C:\Windows\System\PhWwzuj.exe
  2⤵
  - Executes dropped EXE
  PID:1800
- C:\Windows\System\mmcjSXF.exe
  C:\Windows\System\mmcjSXF.exe
  2⤵
  PID:2972
- C:\Windows\System\hcbMbUu.exe
  C:\Windows\System\hcbMbUu.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\yFqlnxS.exe
  C:\Windows\System\yFqlnxS.exe
  2⤵
  PID:3304
- C:\Windows\System\OjsaxRv.exe
  C:\Windows\System\OjsaxRv.exe
  2⤵
  PID:3324
- C:\Windows\System\rivrIDq.exe
  C:\Windows\System\rivrIDq.exe
  2⤵
  PID:3340
- C:\Windows\System\FxpXgmB.exe
  C:\Windows\System\FxpXgmB.exe
  2⤵
  PID:3356
- C:\Windows\System\ycJbOCV.exe
  C:\Windows\System\ycJbOCV.exe
  2⤵
  PID:3372
- C:\Windows\System\CbUhMlZ.exe
  C:\Windows\System\CbUhMlZ.exe
  2⤵
  PID:3388
- C:\Windows\System\IHjwdwn.exe
  C:\Windows\System\IHjwdwn.exe
  2⤵
  PID:3404
- C:\Windows\System\DQFXmUq.exe
  C:\Windows\System\DQFXmUq.exe
  2⤵
  PID:3420
- C:\Windows\System\dNxvsLP.exe
  C:\Windows\System\dNxvsLP.exe
  2⤵
  PID:3436
- C:\Windows\System\mrrLfLk.exe
  C:\Windows\System\mrrLfLk.exe
  2⤵
  PID:3488
- C:\Windows\System\CJMNIIX.exe
  C:\Windows\System\CJMNIIX.exe
  2⤵
  PID:3504
- C:\Windows\System\rKUzTAu.exe
  C:\Windows\System\rKUzTAu.exe
  2⤵
  PID:3520
- C:\Windows\System\DHcnqZh.exe
  C:\Windows\System\DHcnqZh.exe
  2⤵
  PID:3552
- C:\Windows\System\LdoIXZr.exe
  C:\Windows\System\LdoIXZr.exe
  2⤵
  PID:3568
- C:\Windows\System\ZcGdSSP.exe
  C:\Windows\System\ZcGdSSP.exe
  2⤵
  PID:3584
- C:\Windows\System\ulIWRhT.exe
  C:\Windows\System\ulIWRhT.exe
  2⤵
  PID:3600
- C:\Windows\System\obEMCkP.exe
  C:\Windows\System\obEMCkP.exe
  2⤵
  PID:3616
- C:\Windows\System\LsitTDn.exe
  C:\Windows\System\LsitTDn.exe
  2⤵
  PID:3632
- C:\Windows\System\Pouaphm.exe
  C:\Windows\System\Pouaphm.exe
  2⤵
  PID:3648
- C:\Windows\System\PTcPiai.exe
  C:\Windows\System\PTcPiai.exe
  2⤵
  PID:3664
- C:\Windows\System\DCrMSNi.exe
  C:\Windows\System\DCrMSNi.exe
  2⤵
  PID:3688
- C:\Windows\System\RzqpEam.exe
  C:\Windows\System\RzqpEam.exe
  2⤵
  PID:3704
- C:\Windows\System\GUpkvGr.exe
  C:\Windows\System\GUpkvGr.exe
  2⤵
  PID:3720
- C:\Windows\System\xCaGSCF.exe
  C:\Windows\System\xCaGSCF.exe
  2⤵
  PID:3736
- C:\Windows\System\VdRlzbN.exe
  C:\Windows\System\VdRlzbN.exe
  2⤵
  PID:3752
- C:\Windows\System\VMReeJd.exe
  C:\Windows\System\VMReeJd.exe
  2⤵
  PID:3772
- C:\Windows\System\tgrAumP.exe
  C:\Windows\System\tgrAumP.exe
  2⤵
  PID:3788
- C:\Windows\System\dZxfOkC.exe
  C:\Windows\System\dZxfOkC.exe
  2⤵
  PID:3804
- C:\Windows\System\OdJGeFM.exe
  C:\Windows\System\OdJGeFM.exe
  2⤵
  PID:3820
- C:\Windows\System\mkGSEyQ.exe
  C:\Windows\System\mkGSEyQ.exe
  2⤵
  PID:3836
- C:\Windows\System\fpxNrbo.exe
  C:\Windows\System\fpxNrbo.exe
  2⤵
  PID:3852
- C:\Windows\System\SriBmRT.exe
  C:\Windows\System\SriBmRT.exe
  2⤵
  PID:3868
- C:\Windows\System\MlRfaHn.exe
  C:\Windows\System\MlRfaHn.exe
  2⤵
  PID:3884
- C:\Windows\System\XGzaxYJ.exe
  C:\Windows\System\XGzaxYJ.exe
  2⤵
  PID:3904
- C:\Windows\System\SMxzxVT.exe
  C:\Windows\System\SMxzxVT.exe
  2⤵
  PID:3920
- C:\Windows\System\FibCGPC.exe
  C:\Windows\System\FibCGPC.exe
  2⤵
  PID:3936
- C:\Windows\System\UEYFOHI.exe
  C:\Windows\System\UEYFOHI.exe
  2⤵
  PID:3952
- C:\Windows\System\AlSlJyp.exe
  C:\Windows\System\AlSlJyp.exe
  2⤵
  PID:3968
- C:\Windows\System\vpUEFUw.exe
  C:\Windows\System\vpUEFUw.exe
  2⤵
  PID:3992
- C:\Windows\System\zvYEKye.exe
  C:\Windows\System\zvYEKye.exe
  2⤵
  PID:4020
- C:\Windows\System\NScQAXw.exe
  C:\Windows\System\NScQAXw.exe
  2⤵
  PID:4036
- C:\Windows\System\BfHDBro.exe
  C:\Windows\System\BfHDBro.exe
  2⤵
  PID:4052
- C:\Windows\System\CqQEHTm.exe
  C:\Windows\System\CqQEHTm.exe
  2⤵
  PID:4068
- C:\Windows\System\sSfqzVR.exe
  C:\Windows\System\sSfqzVR.exe
  2⤵
  PID:4084
- C:\Windows\System\NlDQhrc.exe
  C:\Windows\System\NlDQhrc.exe
  2⤵
  PID:480
- C:\Windows\System\mLkMjnf.exe
  C:\Windows\System\mLkMjnf.exe
  2⤵
  PID:1092
- C:\Windows\System\PXERBTB.exe
  C:\Windows\System\PXERBTB.exe
  2⤵
  PID:1772
- C:\Windows\System\GaMEDbH.exe
  C:\Windows\System\GaMEDbH.exe
  2⤵
  PID:2748
- C:\Windows\System\xQHsBzO.exe
  C:\Windows\System\xQHsBzO.exe
  2⤵
  PID:1140
- C:\Windows\System\VfieQBZ.exe
  C:\Windows\System\VfieQBZ.exe
  2⤵
  PID:3164
- C:\Windows\System\wSmubfI.exe
  C:\Windows\System\wSmubfI.exe
  2⤵
  PID:3196
- C:\Windows\System\Vvlvnxg.exe
  C:\Windows\System\Vvlvnxg.exe
  2⤵
  PID:3212
- C:\Windows\System\eXhyXyb.exe
  C:\Windows\System\eXhyXyb.exe
  2⤵
  PID:3228
- C:\Windows\System\TfEOhgG.exe
  C:\Windows\System\TfEOhgG.exe
  2⤵
  PID:2436
- C:\Windows\System\wTERuyY.exe
  C:\Windows\System\wTERuyY.exe
  2⤵
  PID:3980
- C:\Windows\System\ROyraVw.exe
  C:\Windows\System\ROyraVw.exe
  2⤵
  PID:1684
- C:\Windows\System\diPQgeY.exe
  C:\Windows\System\diPQgeY.exe
  2⤵
  PID:3180
- C:\Windows\System\lJehdFA.exe
  C:\Windows\System\lJehdFA.exe
  2⤵
  PID:2560
- C:\Windows\System\VDNEaue.exe
  C:\Windows\System\VDNEaue.exe
  2⤵
  PID:1436
- C:\Windows\System\kRZjjAv.exe
  C:\Windows\System\kRZjjAv.exe
  2⤵
  PID:3716
- C:\Windows\System\JBCzgHi.exe
  C:\Windows\System\JBCzgHi.exe
  2⤵
  PID:2312
- C:\Windows\System\jzaaWha.exe
  C:\Windows\System\jzaaWha.exe
  2⤵
  PID:4012
- C:\Windows\System\UtPmOvx.exe
  C:\Windows\System\UtPmOvx.exe
  2⤵
  PID:2028
- C:\Windows\System\NwECkWH.exe
  C:\Windows\System\NwECkWH.exe
  2⤵
  PID:3784
- C:\Windows\System\SNDQFTv.exe
  C:\Windows\System\SNDQFTv.exe
  2⤵
  PID:3816
- C:\Windows\System\poPbvdd.exe
  C:\Windows\System\poPbvdd.exe
  2⤵
  PID:1908
- C:\Windows\System\mybanaK.exe
  C:\Windows\System\mybanaK.exe
  2⤵
  PID:1276
- C:\Windows\System\MVfDISd.exe
  C:\Windows\System\MVfDISd.exe
  2⤵
  PID:2036
- C:\Windows\System\ZtSyCUn.exe
  C:\Windows\System\ZtSyCUn.exe
  2⤵
  PID:2912
- C:\Windows\System\ReRtuDA.exe
  C:\Windows\System\ReRtuDA.exe
  2⤵
  PID:3912
- C:\Windows\System\WMQyFzU.exe
  C:\Windows\System\WMQyFzU.exe
  2⤵
  PID:1512
- C:\Windows\System\kkTjUKG.exe
  C:\Windows\System\kkTjUKG.exe
  2⤵
  PID:2248
- C:\Windows\System\SpapfCm.exe
  C:\Windows\System\SpapfCm.exe
  2⤵
  PID:2212
- C:\Windows\System\CZfPMDC.exe
  C:\Windows\System\CZfPMDC.exe
  2⤵
  PID:2000
- C:\Windows\System\dLbDOsM.exe
  C:\Windows\System\dLbDOsM.exe
  2⤵
  PID:3948
- C:\Windows\System\JPskPoi.exe
  C:\Windows\System\JPskPoi.exe
  2⤵
  PID:1984
- C:\Windows\System\kePOJVD.exe
  C:\Windows\System\kePOJVD.exe
  2⤵
  PID:3984
- C:\Windows\System\JbvTzlC.exe
  C:\Windows\System\JbvTzlC.exe
  2⤵
  PID:3764
- C:\Windows\System\DWAnydX.exe
  C:\Windows\System\DWAnydX.exe
  2⤵
  PID:4044
- C:\Windows\System\zLNFrYA.exe
  C:\Windows\System\zLNFrYA.exe
  2⤵
  PID:1564
- C:\Windows\System\lUOSNDO.exe
  C:\Windows\System\lUOSNDO.exe
  2⤵
  PID:3252
- C:\Windows\System\cahNqKG.exe
  C:\Windows\System\cahNqKG.exe
  2⤵
  PID:3268
- C:\Windows\System\IjGjBFe.exe
  C:\Windows\System\IjGjBFe.exe
  2⤵
  PID:1944
- C:\Windows\System\tQeqOEa.exe
  C:\Windows\System\tQeqOEa.exe
  2⤵
  PID:2896
- C:\Windows\System\vGwFvtE.exe
  C:\Windows\System\vGwFvtE.exe
  2⤵
  PID:2624
- C:\Windows\System\vbOFaNA.exe
  C:\Windows\System\vbOFaNA.exe
  2⤵
  PID:1620
- C:\Windows\System\rFgbDOC.exe
  C:\Windows\System\rFgbDOC.exe
  2⤵
  PID:2724
- C:\Windows\System\gSgUizh.exe
  C:\Windows\System\gSgUizh.exe
  2⤵
  PID:3892
- C:\Windows\System\cfvIkqx.exe
  C:\Windows\System\cfvIkqx.exe
  2⤵
  PID:3768
- C:\Windows\System\cKpRQYq.exe
  C:\Windows\System\cKpRQYq.exe
  2⤵
  PID:3728
- C:\Windows\System\wMRKpKn.exe
  C:\Windows\System\wMRKpKn.exe
  2⤵
  PID:3624
- C:\Windows\System\JPprswC.exe
  C:\Windows\System\JPprswC.exe
  2⤵
  PID:3516
- C:\Windows\System\ZNhPuUm.exe
  C:\Windows\System\ZNhPuUm.exe
  2⤵
  PID:3416
- C:\Windows\System\OqyQDlt.exe
  C:\Windows\System\OqyQDlt.exe
  2⤵
  PID:3348
- C:\Windows\System\iWobGjW.exe
  C:\Windows\System\iWobGjW.exe
  2⤵
  PID:820
- C:\Windows\System\ZyxPzgW.exe
  C:\Windows\System\ZyxPzgW.exe
  2⤵
  PID:1124
- C:\Windows\System\YWFfIvg.exe
  C:\Windows\System\YWFfIvg.exe
  2⤵
  PID:968
- C:\Windows\System\WEwMrSv.exe
  C:\Windows\System\WEwMrSv.exe
  2⤵
  PID:2840
- C:\Windows\System\EcGDTFp.exe
  C:\Windows\System\EcGDTFp.exe
  2⤵
  PID:2456
- C:\Windows\System\KEemCCc.exe
  C:\Windows\System\KEemCCc.exe
  2⤵
  PID:1860
- C:\Windows\System\utTgayc.exe
  C:\Windows\System\utTgayc.exe
  2⤵
  PID:776
- C:\Windows\System\LJDXczA.exe
  C:\Windows\System\LJDXczA.exe
  2⤵
  PID:944
- C:\Windows\System\gjDOKZf.exe
  C:\Windows\System\gjDOKZf.exe
  2⤵
  PID:3460
- C:\Windows\System\ShRDOnW.exe
  C:\Windows\System\ShRDOnW.exe
  2⤵
  PID:2788
- C:\Windows\System\YlchWIA.exe
  C:\Windows\System\YlchWIA.exe
  2⤵
  PID:1004
- C:\Windows\System\HMwShjs.exe
  C:\Windows\System\HMwShjs.exe
  2⤵
  PID:2448
- C:\Windows\System\JCOYPqj.exe
  C:\Windows\System\JCOYPqj.exe
  2⤵
  PID:2492
- C:\Windows\System\vMREQSw.exe
  C:\Windows\System\vMREQSw.exe
  2⤵
  PID:1744
- C:\Windows\System\suuoBhS.exe
  C:\Windows\System\suuoBhS.exe
  2⤵
  PID:1036
- C:\Windows\System\aMsLvTs.exe
  C:\Windows\System\aMsLvTs.exe
  2⤵
  PID:3264
- C:\Windows\System\KQOWwdv.exe
  C:\Windows\System\KQOWwdv.exe
  2⤵
  PID:3332
- C:\Windows\System\tAyzpjO.exe
  C:\Windows\System\tAyzpjO.exe
  2⤵
  PID:1868
- C:\Windows\System\iCjksfz.exe
  C:\Windows\System\iCjksfz.exe
  2⤵
  PID:2500
- C:\Windows\System\qeHXYqf.exe
  C:\Windows\System\qeHXYqf.exe
  2⤵
  PID:3496
- C:\Windows\System\PJjHHIC.exe
  C:\Windows\System\PJjHHIC.exe
  2⤵
  PID:3896
- C:\Windows\System\myTFfLp.exe
  C:\Windows\System\myTFfLp.exe
  2⤵
  PID:3928
- C:\Windows\System\BeAKEqb.exe
  C:\Windows\System\BeAKEqb.exe
  2⤵
  PID:1964
- C:\Windows\System\ixHotJE.exe
  C:\Windows\System\ixHotJE.exe
  2⤵
  PID:3832
- C:\Windows\System\JBZpysy.exe
  C:\Windows\System\JBZpysy.exe
  2⤵
  PID:3656
- C:\Windows\System\RgcAwgl.exe
  C:\Windows\System\RgcAwgl.exe
  2⤵
  PID:3564
- C:\Windows\System\tohNUoW.exe
  C:\Windows\System\tohNUoW.exe
  2⤵
  PID:3384
- C:\Windows\System\qixjikP.exe
  C:\Windows\System\qixjikP.exe
  2⤵
  PID:548
- C:\Windows\System\gtaICNa.exe
  C:\Windows\System\gtaICNa.exe
  2⤵
  PID:3848
- C:\Windows\System\HwfUWcP.exe
  C:\Windows\System\HwfUWcP.exe
  2⤵
  PID:3236
- C:\Windows\System\QJVpXMx.exe
  C:\Windows\System\QJVpXMx.exe
  2⤵
  PID:792
- C:\Windows\System\KhQtVER.exe
  C:\Windows\System\KhQtVER.exe
  2⤵
  PID:1568
- C:\Windows\System\ZwCcXuM.exe
  C:\Windows\System\ZwCcXuM.exe
  2⤵
  PID:3468
- C:\Windows\System\MycEBZE.exe
  C:\Windows\System\MycEBZE.exe
  2⤵
  PID:3320
- C:\Windows\System\dGeFohP.exe
  C:\Windows\System\dGeFohP.exe
  2⤵
  PID:2224
- C:\Windows\System\pqahGUm.exe
  C:\Windows\System\pqahGUm.exe
  2⤵
  PID:2780
- C:\Windows\System\AuOWxeW.exe
  C:\Windows\System\AuOWxeW.exe
  2⤵
  PID:4016
- C:\Windows\System\OSHyKgk.exe
  C:\Windows\System\OSHyKgk.exe
  2⤵
  PID:3244
- C:\Windows\System\LaCRiIp.exe
  C:\Windows\System\LaCRiIp.exe
  2⤵
  PID:1192
- C:\Windows\System\yIBCsrQ.exe
  C:\Windows\System\yIBCsrQ.exe
  2⤵
  PID:2880
- C:\Windows\System\TLdKjZX.exe
  C:\Windows\System\TLdKjZX.exe
  2⤵
  PID:1264
- C:\Windows\System\DwXbxda.exe
  C:\Windows\System\DwXbxda.exe
  2⤵
  PID:3828
- C:\Windows\System\HLLlnjP.exe
  C:\Windows\System\HLLlnjP.exe
  2⤵
  PID:3660
- C:\Windows\System\dIURvDe.exe
  C:\Windows\System\dIURvDe.exe
  2⤵
  PID:2056
- C:\Windows\System\iIBakpa.exe
  C:\Windows\System\iIBakpa.exe
  2⤵
  PID:2296
- C:\Windows\System\kJtzBmV.exe
  C:\Windows\System\kJtzBmV.exe
  2⤵
  PID:2652
- C:\Windows\System\fFcEzCB.exe
  C:\Windows\System\fFcEzCB.exe
  2⤵
  PID:2988
- C:\Windows\System\nDYvXqV.exe
  C:\Windows\System\nDYvXqV.exe
  2⤵
  PID:2344
- C:\Windows\System\YuzTwTN.exe
  C:\Windows\System\YuzTwTN.exe
  2⤵
  PID:3248
- C:\Windows\System\lIgwtsW.exe
  C:\Windows\System\lIgwtsW.exe
  2⤵
  PID:2272
- C:\Windows\System\lapiyon.exe
  C:\Windows\System\lapiyon.exe
  2⤵
  PID:1632
- C:\Windows\System\kulvrVM.exe
  C:\Windows\System\kulvrVM.exe
  2⤵
  PID:2876
- C:\Windows\System\FNUnoDu.exe
  C:\Windows\System\FNUnoDu.exe
  2⤵
  PID:1760
- C:\Windows\System\UpgEVRJ.exe
  C:\Windows\System\UpgEVRJ.exe
  2⤵
  PID:3960
- C:\Windows\System\MaYRIum.exe
  C:\Windows\System\MaYRIum.exe
  2⤵
  PID:3480
- C:\Windows\System\HXFyjZH.exe
  C:\Windows\System\HXFyjZH.exe
  2⤵
  PID:4112
- C:\Windows\System\oTzEcGo.exe
  C:\Windows\System\oTzEcGo.exe
  2⤵
  PID:4128
- C:\Windows\System\UilCtwj.exe
  C:\Windows\System\UilCtwj.exe
  2⤵
  PID:4144
- C:\Windows\System\SrhsDMM.exe
  C:\Windows\System\SrhsDMM.exe
  2⤵
  PID:4160
- C:\Windows\System\XKcevam.exe
  C:\Windows\System\XKcevam.exe
  2⤵
  PID:4180
- C:\Windows\System\cTRNLUQ.exe
  C:\Windows\System\cTRNLUQ.exe
  2⤵
  PID:4200
- C:\Windows\System\cyaGvKa.exe
  C:\Windows\System\cyaGvKa.exe
  2⤵
  PID:4216
- C:\Windows\System\FnPbWXC.exe
  C:\Windows\System\FnPbWXC.exe
  2⤵
  PID:4232
- C:\Windows\System\vvmbGVH.exe
  C:\Windows\System\vvmbGVH.exe
  2⤵
  PID:4248
- C:\Windows\System\aYAsSKf.exe
  C:\Windows\System\aYAsSKf.exe
  2⤵
  PID:4264
- C:\Windows\System\OYhhvjF.exe
  C:\Windows\System\OYhhvjF.exe
  2⤵
  PID:4280
- C:\Windows\System\XzylwmX.exe
  C:\Windows\System\XzylwmX.exe
  2⤵
  PID:4296
- C:\Windows\System\NnFPTnP.exe
  C:\Windows\System\NnFPTnP.exe
  2⤵
  PID:4312
- C:\Windows\System\RTqbFeA.exe
  C:\Windows\System\RTqbFeA.exe
  2⤵
  PID:4332
- C:\Windows\System\qUVUPAo.exe
  C:\Windows\System\qUVUPAo.exe
  2⤵
  PID:4348
- C:\Windows\System\iRETqOp.exe
  C:\Windows\System\iRETqOp.exe
  2⤵
  PID:4364
- C:\Windows\System\NRjBcBE.exe
  C:\Windows\System\NRjBcBE.exe
  2⤵
  PID:4380
- C:\Windows\System\qLyXlkm.exe
  C:\Windows\System\qLyXlkm.exe
  2⤵
  PID:4396
- C:\Windows\System\diARSpa.exe
  C:\Windows\System\diARSpa.exe
  2⤵
  PID:4412
- C:\Windows\System\OtmkyVT.exe
  C:\Windows\System\OtmkyVT.exe
  2⤵
  PID:4428
- C:\Windows\System\MiRoXWt.exe
  C:\Windows\System\MiRoXWt.exe
  2⤵
  PID:4444
- C:\Windows\System\ztPBTWF.exe
  C:\Windows\System\ztPBTWF.exe
  2⤵
  PID:4464
- C:\Windows\System\xeosHuW.exe
  C:\Windows\System\xeosHuW.exe
  2⤵
  PID:4656
- C:\Windows\System\TKnJJdg.exe
  C:\Windows\System\TKnJJdg.exe
  2⤵
  PID:4672
- C:\Windows\System\YQPTmVe.exe
  C:\Windows\System\YQPTmVe.exe
  2⤵
  PID:4688
- C:\Windows\System\hLZRwHv.exe
  C:\Windows\System\hLZRwHv.exe
  2⤵
  PID:4704
- C:\Windows\System\zZWXygu.exe
  C:\Windows\System\zZWXygu.exe
  2⤵
  PID:4720
- C:\Windows\System\GRLtSab.exe
  C:\Windows\System\GRLtSab.exe
  2⤵
  PID:4736
- C:\Windows\System\qGRWBTs.exe
  C:\Windows\System\qGRWBTs.exe
  2⤵
  PID:4752
- C:\Windows\System\Djncyel.exe
  C:\Windows\System\Djncyel.exe
  2⤵
  PID:4768
- C:\Windows\System\CCuuwbV.exe
  C:\Windows\System\CCuuwbV.exe
  2⤵
  PID:4784
- C:\Windows\System\pdlWJcf.exe
  C:\Windows\System\pdlWJcf.exe
  2⤵
  PID:4804
- C:\Windows\System\HbFmQEs.exe
  C:\Windows\System\HbFmQEs.exe
  2⤵
  PID:4824
- C:\Windows\System\xULocFz.exe
  C:\Windows\System\xULocFz.exe
  2⤵
  PID:4840
- C:\Windows\System\qkUIVEH.exe
  C:\Windows\System\qkUIVEH.exe
  2⤵
  PID:4880
- C:\Windows\System\zomnwaM.exe
  C:\Windows\System\zomnwaM.exe
  2⤵
  PID:4924
- C:\Windows\System\xCWRKKb.exe
  C:\Windows\System\xCWRKKb.exe
  2⤵
  PID:4940
- C:\Windows\System\SvCAaAK.exe
  C:\Windows\System\SvCAaAK.exe
  2⤵
  PID:4956
- C:\Windows\System\hRHAoGQ.exe
  C:\Windows\System\hRHAoGQ.exe
  2⤵
  PID:4972
- C:\Windows\System\mCovIJt.exe
  C:\Windows\System\mCovIJt.exe
  2⤵
  PID:4996
- C:\Windows\System\egmPuda.exe
  C:\Windows\System\egmPuda.exe
  2⤵
  PID:5012
- C:\Windows\System\fXCydWS.exe
  C:\Windows\System\fXCydWS.exe
  2⤵
  PID:5028
- C:\Windows\System\IEtXlSu.exe
  C:\Windows\System\IEtXlSu.exe
  2⤵
  PID:5044
- C:\Windows\System\wKKyrCl.exe
  C:\Windows\System\wKKyrCl.exe
  2⤵
  PID:5064
- C:\Windows\System\PlDuvkn.exe
  C:\Windows\System\PlDuvkn.exe
  2⤵
  PID:5080
- C:\Windows\System\ZNGDOmC.exe
  C:\Windows\System\ZNGDOmC.exe
  2⤵
  PID:5096
- C:\Windows\System\NhVRNlw.exe
  C:\Windows\System\NhVRNlw.exe
  2⤵
  PID:5112
- C:\Windows\System\tRoSdUF.exe
  C:\Windows\System\tRoSdUF.exe
  2⤵
  PID:3208
- C:\Windows\System\MrPEHWE.exe
  C:\Windows\System\MrPEHWE.exe
  2⤵
  PID:620
- C:\Windows\System\Yaasjuz.exe
  C:\Windows\System\Yaasjuz.exe
  2⤵
  PID:3260
- C:\Windows\System\PBpvmHz.exe
  C:\Windows\System\PBpvmHz.exe
  2⤵
  PID:4140
- C:\Windows\System\HRlGQRV.exe
  C:\Windows\System\HRlGQRV.exe
  2⤵
  PID:4208
- C:\Windows\System\IsBgCjU.exe
  C:\Windows\System\IsBgCjU.exe
  2⤵
  PID:4240
- C:\Windows\System\VgeoJQq.exe
  C:\Windows\System\VgeoJQq.exe
  2⤵
  PID:4304
- C:\Windows\System\wnlzIRD.exe
  C:\Windows\System\wnlzIRD.exe
  2⤵
  PID:4188
- C:\Windows\System\MOlTCkh.exe
  C:\Windows\System\MOlTCkh.exe
  2⤵
  PID:4288
- C:\Windows\System\pjydQVX.exe
  C:\Windows\System\pjydQVX.exe
  2⤵
  PID:2064
- C:\Windows\System\thaTmak.exe
  C:\Windows\System\thaTmak.exe
  2⤵
  PID:4476
- C:\Windows\System\hSgNYpa.exe
  C:\Windows\System\hSgNYpa.exe
  2⤵
  PID:4500
- C:\Windows\System\MnNvlrw.exe
  C:\Windows\System\MnNvlrw.exe
  2⤵
  PID:4388
- C:\Windows\System\xXFkXCv.exe
  C:\Windows\System\xXFkXCv.exe
  2⤵
  PID:4392
- C:\Windows\System\ubvLRSW.exe
  C:\Windows\System\ubvLRSW.exe
  2⤵
  PID:4528
- C:\Windows\System\rQuBUkR.exe
  C:\Windows\System\rQuBUkR.exe
  2⤵
  PID:4408
- C:\Windows\System\hGXahOu.exe
  C:\Windows\System\hGXahOu.exe
  2⤵
  PID:4424
- C:\Windows\System\QqbUrdw.exe
  C:\Windows\System\QqbUrdw.exe
  2⤵
  PID:4344
- C:\Windows\System\iswNYHl.exe
  C:\Windows\System\iswNYHl.exe
  2⤵
  PID:4572
- C:\Windows\System\AoszYKO.exe
  C:\Windows\System\AoszYKO.exe
  2⤵
  PID:4600
- C:\Windows\System\SmtZgvp.exe
  C:\Windows\System\SmtZgvp.exe
  2⤵
  PID:4592
- C:\Windows\System\CFcjYml.exe
  C:\Windows\System\CFcjYml.exe
  2⤵
  PID:2496
- C:\Windows\System\HvDyADQ.exe
  C:\Windows\System\HvDyADQ.exe
  2⤵
  PID:2948
- C:\Windows\System\bFAwmUZ.exe
  C:\Windows\System\bFAwmUZ.exe
  2⤵
  PID:4664
- C:\Windows\System\GQsuwvd.exe
  C:\Windows\System\GQsuwvd.exe
  2⤵
  PID:4712
- C:\Windows\System\gHUagkd.exe
  C:\Windows\System\gHUagkd.exe
  2⤵
  PID:4776
- C:\Windows\System\kFdLHIW.exe
  C:\Windows\System\kFdLHIW.exe
  2⤵
  PID:4696
- C:\Windows\System\yirNuNh.exe
  C:\Windows\System\yirNuNh.exe
  2⤵
  PID:4760
- C:\Windows\System\ATQtNbi.exe
  C:\Windows\System\ATQtNbi.exe
  2⤵
  PID:4800
- C:\Windows\System\mSNbzAP.exe
  C:\Windows\System\mSNbzAP.exe
  2⤵
  PID:4820
- C:\Windows\System\KVishFz.exe
  C:\Windows\System\KVishFz.exe
  2⤵
  PID:4868
- C:\Windows\System\sIAKVcu.exe
  C:\Windows\System\sIAKVcu.exe
  2⤵
  PID:2992
- C:\Windows\System\YgpQHgF.exe
  C:\Windows\System\YgpQHgF.exe
  2⤵
  PID:4920
- C:\Windows\System\vXvmBPf.exe
  C:\Windows\System\vXvmBPf.exe
  2⤵
  PID:4988
- C:\Windows\System\rOOjNQz.exe
  C:\Windows\System\rOOjNQz.exe
  2⤵
  PID:5004
- C:\Windows\System\kHIujlE.exe
  C:\Windows\System\kHIujlE.exe
  2⤵
  PID:5036
- C:\Windows\System\gFSUiEK.exe
  C:\Windows\System\gFSUiEK.exe
  2⤵
  PID:5092
- C:\Windows\System\yDnFmuY.exe
  C:\Windows\System\yDnFmuY.exe
  2⤵
  PID:4104
- C:\Windows\System\yibKjxa.exe
  C:\Windows\System\yibKjxa.exe
  2⤵
  PID:5060
- C:\Windows\System\NGKaRiH.exe
  C:\Windows\System\NGKaRiH.exe
  2⤵
  PID:4136
- C:\Windows\System\bbZiiHg.exe
  C:\Windows\System\bbZiiHg.exe
  2⤵
  PID:3780
- C:\Windows\System\cepOKQZ.exe
  C:\Windows\System\cepOKQZ.exe
  2⤵
  PID:3352
- C:\Windows\System\OkKeHiW.exe
  C:\Windows\System\OkKeHiW.exe
  2⤵
  PID:4224
- C:\Windows\System\WZFBFFq.exe
  C:\Windows\System\WZFBFFq.exe
  2⤵
  PID:1288
- C:\Windows\System\yzQjgfw.exe
  C:\Windows\System\yzQjgfw.exe
  2⤵
  PID:4120
- C:\Windows\System\xYxFVip.exe
  C:\Windows\System\xYxFVip.exe
  2⤵
  PID:4452
- C:\Windows\System\OLBAzXA.exe
  C:\Windows\System\OLBAzXA.exe
  2⤵
  PID:4496
- C:\Windows\System\bTQmFnh.exe
  C:\Windows\System\bTQmFnh.exe
  2⤵
  PID:4492
- C:\Windows\System\ivGxjjr.exe
  C:\Windows\System\ivGxjjr.exe
  2⤵
  PID:4460
- C:\Windows\System\lThNsKz.exe
  C:\Windows\System\lThNsKz.exe
  2⤵
  PID:2452
- C:\Windows\System\tkuQCOJ.exe
  C:\Windows\System\tkuQCOJ.exe
  2⤵
  PID:4588
- C:\Windows\System\qhXzRzp.exe
  C:\Windows\System\qhXzRzp.exe
  2⤵
  PID:4636
- C:\Windows\System\osyZsjE.exe
  C:\Windows\System\osyZsjE.exe
  2⤵
  PID:4796
- C:\Windows\System\kFgdKrV.exe
  C:\Windows\System\kFgdKrV.exe
  2⤵
  PID:4652
- C:\Windows\System\lAWlYfb.exe
  C:\Windows\System\lAWlYfb.exe
  2⤵
  PID:2944
- C:\Windows\System\YlbHKRt.exe
  C:\Windows\System\YlbHKRt.exe
  2⤵
  PID:4816
- C:\Windows\System\XhEGWzu.exe
  C:\Windows\System\XhEGWzu.exe
  2⤵
  PID:4852
- C:\Windows\System\jWbFnby.exe
  C:\Windows\System\jWbFnby.exe
  2⤵
  PID:4896
- C:\Windows\System\BUqwJnI.exe
  C:\Windows\System\BUqwJnI.exe
  2⤵
  PID:1688
- C:\Windows\System\XwgYAmw.exe
  C:\Windows\System\XwgYAmw.exe
  2⤵
  PID:4952
- C:\Windows\System\arnldQk.exe
  C:\Windows\System\arnldQk.exe
  2⤵
  PID:5076
- C:\Windows\System\nXXWJaB.exe
  C:\Windows\System\nXXWJaB.exe
  2⤵
  PID:4124
- C:\Windows\System\SITOfLm.exe
  C:\Windows\System\SITOfLm.exe
  2⤵
  PID:4108
- C:\Windows\System\pAKYBDD.exe
  C:\Windows\System\pAKYBDD.exe
  2⤵
  PID:3916
- C:\Windows\System\pipPCWO.exe
  C:\Windows\System\pipPCWO.exe
  2⤵
  PID:4484
- C:\Windows\System\VYlgsfJ.exe
  C:\Windows\System\VYlgsfJ.exe
  2⤵
  PID:4516
- C:\Windows\System\ekrkgMI.exe
  C:\Windows\System\ekrkgMI.exe
  2⤵
  PID:4260
- C:\Windows\System\PBXcqri.exe
  C:\Windows\System\PBXcqri.exe
  2⤵
  PID:4560
- C:\Windows\System\OWXlann.exe
  C:\Windows\System\OWXlann.exe
  2⤵
  PID:4916
- C:\Windows\System\oIQfPbb.exe
  C:\Windows\System\oIQfPbb.exe
  2⤵
  PID:4684
- C:\Windows\System\nskHGFO.exe
  C:\Windows\System\nskHGFO.exe
  2⤵
  PID:4836
- C:\Windows\System\yoQdiQT.exe
  C:\Windows\System\yoQdiQT.exe
  2⤵
  PID:4608
- C:\Windows\System\CFgGlXu.exe
  C:\Windows\System\CFgGlXu.exe
  2⤵
  PID:2952
- C:\Windows\System\ehmpZZf.exe
  C:\Windows\System\ehmpZZf.exe
  2⤵
  PID:4904
- C:\Windows\System\LMOyqwK.exe
  C:\Windows\System\LMOyqwK.exe
  2⤵
  PID:2476
- C:\Windows\System\xLjhIlQ.exe
  C:\Windows\System\xLjhIlQ.exe
  2⤵
  PID:5024
- C:\Windows\System\vMqpQlf.exe
  C:\Windows\System\vMqpQlf.exe
  2⤵
  PID:5088
- C:\Windows\System\NscJyWZ.exe
  C:\Windows\System\NscJyWZ.exe
  2⤵
  PID:5104
- C:\Windows\System\XjTpqxG.exe
  C:\Windows\System\XjTpqxG.exe
  2⤵
  PID:4152
- C:\Windows\System\QePOQQJ.exe
  C:\Windows\System\QePOQQJ.exe
  2⤵
  PID:4228
- C:\Windows\System\RFuPdsP.exe
  C:\Windows\System\RFuPdsP.exe
  2⤵
  PID:4320
- C:\Windows\System\sbkinnb.exe
  C:\Windows\System\sbkinnb.exe
  2⤵
  PID:4376
- C:\Windows\System\aSufPvD.exe
  C:\Windows\System\aSufPvD.exe
  2⤵
  PID:5124
- C:\Windows\System\mKvIKGC.exe
  C:\Windows\System\mKvIKGC.exe
  2⤵
  PID:5140
- C:\Windows\System\AwiyXkq.exe
  C:\Windows\System\AwiyXkq.exe
  2⤵
  PID:5156
- C:\Windows\System\xuZWueL.exe
  C:\Windows\System\xuZWueL.exe
  2⤵
  PID:5176
- C:\Windows\System\VMJpGAM.exe
  C:\Windows\System\VMJpGAM.exe
  2⤵
  PID:5192
- C:\Windows\System\jlMQJBC.exe
  C:\Windows\System\jlMQJBC.exe
  2⤵
  PID:5208
- C:\Windows\System\KLcFaZw.exe
  C:\Windows\System\KLcFaZw.exe
  2⤵
  PID:5224
- C:\Windows\System\TPpbfdL.exe
  C:\Windows\System\TPpbfdL.exe
  2⤵
  PID:5244
- C:\Windows\System\ktnRSiy.exe
  C:\Windows\System\ktnRSiy.exe
  2⤵
  PID:5264
- C:\Windows\System\AuBrtCm.exe
  C:\Windows\System\AuBrtCm.exe
  2⤵
  PID:5280
- C:\Windows\System\TMzdQSz.exe
  C:\Windows\System\TMzdQSz.exe
  2⤵
  PID:5296
- C:\Windows\System\CHOHFHf.exe
  C:\Windows\System\CHOHFHf.exe
  2⤵
  PID:5312
- C:\Windows\System\SfOyVmF.exe
  C:\Windows\System\SfOyVmF.exe
  2⤵
  PID:5328
- C:\Windows\System\XKPKcrD.exe
  C:\Windows\System\XKPKcrD.exe
  2⤵
  PID:5344
- C:\Windows\System\BqpqioS.exe
  C:\Windows\System\BqpqioS.exe
  2⤵
  PID:5360
- C:\Windows\System\TNrIXde.exe
  C:\Windows\System\TNrIXde.exe
  2⤵
  PID:5376
- C:\Windows\System\KxrazdR.exe
  C:\Windows\System\KxrazdR.exe
  2⤵
  PID:5392
- C:\Windows\System\aJahyJE.exe
  C:\Windows\System\aJahyJE.exe
  2⤵
  PID:5412
- C:\Windows\System\MZUVYlh.exe
  C:\Windows\System\MZUVYlh.exe
  2⤵
  PID:5432
- C:\Windows\System\TcpKBFT.exe
  C:\Windows\System\TcpKBFT.exe
  2⤵
  PID:5556
- C:\Windows\System\nzLuRMq.exe
  C:\Windows\System\nzLuRMq.exe
  2⤵
  PID:5576
- C:\Windows\System\cEdaEQv.exe
  C:\Windows\System\cEdaEQv.exe
  2⤵
  PID:5592
- C:\Windows\System\gVFaBnn.exe
  C:\Windows\System\gVFaBnn.exe
  2⤵
  PID:5608
- C:\Windows\System\maRZaMD.exe
  C:\Windows\System\maRZaMD.exe
  2⤵
  PID:5628
- C:\Windows\System\ifnJbdD.exe
  C:\Windows\System\ifnJbdD.exe
  2⤵
  PID:5644
- C:\Windows\System\daLequg.exe
  C:\Windows\System\daLequg.exe
  2⤵
  PID:5672
- C:\Windows\System\xuDyVia.exe
  C:\Windows\System\xuDyVia.exe
  2⤵
  PID:5688
- C:\Windows\System\BJWKviR.exe
  C:\Windows\System\BJWKviR.exe
  2⤵
  PID:5704
- C:\Windows\System\pJVNfXt.exe
  C:\Windows\System\pJVNfXt.exe
  2⤵
  PID:5720
- C:\Windows\System\ygfXZjL.exe
  C:\Windows\System\ygfXZjL.exe
  2⤵
  PID:5736
- C:\Windows\System\undjacg.exe
  C:\Windows\System\undjacg.exe
  2⤵
  PID:5752
- C:\Windows\System\MccfVSp.exe
  C:\Windows\System\MccfVSp.exe
  2⤵
  PID:5768
- C:\Windows\System\NoYtHEz.exe
  C:\Windows\System\NoYtHEz.exe
  2⤵
  PID:5784
- C:\Windows\System\VqerfTC.exe
  C:\Windows\System\VqerfTC.exe
  2⤵
  PID:5800
- C:\Windows\System\MUwhxCf.exe
  C:\Windows\System\MUwhxCf.exe
  2⤵
  PID:5816
- C:\Windows\System\wwtWZZk.exe
  C:\Windows\System\wwtWZZk.exe
  2⤵
  PID:5836
- C:\Windows\System\vqKFXCP.exe
  C:\Windows\System\vqKFXCP.exe
  2⤵
  PID:5852
- C:\Windows\System\xzixntl.exe
  C:\Windows\System\xzixntl.exe
  2⤵
  PID:5868
- C:\Windows\System\qkhJIuD.exe
  C:\Windows\System\qkhJIuD.exe
  2⤵
  PID:5884
- C:\Windows\System\nBMJpwx.exe
  C:\Windows\System\nBMJpwx.exe
  2⤵
  PID:5900
- C:\Windows\System\PUyHUJL.exe
  C:\Windows\System\PUyHUJL.exe
  2⤵
  PID:5916
- C:\Windows\System\iowYMlo.exe
  C:\Windows\System\iowYMlo.exe
  2⤵
  PID:5932
- C:\Windows\System\psslFsg.exe
  C:\Windows\System\psslFsg.exe
  2⤵
  PID:5948
- C:\Windows\System\dMWiiGv.exe
  C:\Windows\System\dMWiiGv.exe
  2⤵
  PID:5968
- C:\Windows\System\EMMEaKJ.exe
  C:\Windows\System\EMMEaKJ.exe
  2⤵
  PID:5988
- C:\Windows\System\jeGUnSf.exe
  C:\Windows\System\jeGUnSf.exe
  2⤵
  PID:6004
- C:\Windows\System\SNxHGFD.exe
  C:\Windows\System\SNxHGFD.exe
  2⤵
  PID:6020
- C:\Windows\System\eeYaGSE.exe
  C:\Windows\System\eeYaGSE.exe
  2⤵
  PID:6036
- C:\Windows\System\CdDNEji.exe
  C:\Windows\System\CdDNEji.exe
  2⤵
  PID:6052
- C:\Windows\System\aSWmnSX.exe
  C:\Windows\System\aSWmnSX.exe
  2⤵
  PID:6072
- C:\Windows\System\gtyaKLb.exe
  C:\Windows\System\gtyaKLb.exe
  2⤵
  PID:6088
- C:\Windows\System\ynqCssr.exe
  C:\Windows\System\ynqCssr.exe
  2⤵
  PID:6104
- C:\Windows\System\kKWkdtN.exe
  C:\Windows\System\kKWkdtN.exe
  2⤵
  PID:6136
- C:\Windows\System\eANcLtP.exe
  C:\Windows\System\eANcLtP.exe
  2⤵
  PID:4540
- C:\Windows\System\VbFWMwc.exe
  C:\Windows\System\VbFWMwc.exe
  2⤵
  PID:5188
- C:\Windows\System\aUOnXFB.exe
  C:\Windows\System\aUOnXFB.exe
  2⤵
  PID:4732
- C:\Windows\System\HnpKCcZ.exe
  C:\Windows\System\HnpKCcZ.exe
  2⤵
  PID:5020
- C:\Windows\System\YgrAuEx.exe
  C:\Windows\System\YgrAuEx.exe
  2⤵
  PID:2832
- C:\Windows\System\PvnWqFE.exe
  C:\Windows\System\PvnWqFE.exe
  2⤵
  PID:4748
- C:\Windows\System\wnCignv.exe
  C:\Windows\System\wnCignv.exe
  2⤵
  PID:4900
- C:\Windows\System\hwzZiUh.exe
  C:\Windows\System\hwzZiUh.exe
  2⤵
  PID:3760
- C:\Windows\System\GKTmMAR.exe
  C:\Windows\System\GKTmMAR.exe
  2⤵
  PID:5136
- C:\Windows\System\qaJDCLD.exe
  C:\Windows\System\qaJDCLD.exe
  2⤵
  PID:5200
- C:\Windows\System\LoldeRF.exe
  C:\Windows\System\LoldeRF.exe
  2⤵
  PID:5236
- C:\Windows\System\DKDieAu.exe
  C:\Windows\System\DKDieAu.exe
  2⤵
  PID:5304
- C:\Windows\System\MxsQqaN.exe
  C:\Windows\System\MxsQqaN.exe
  2⤵
  PID:5308
- C:\Windows\System\SvAyHDi.exe
  C:\Windows\System\SvAyHDi.exe
  2⤵
  PID:5272
- C:\Windows\System\iTatanK.exe
  C:\Windows\System\iTatanK.exe
  2⤵
  PID:5256
- C:\Windows\System\PngiPcH.exe
  C:\Windows\System\PngiPcH.exe
  2⤵
  PID:5260
- C:\Windows\System\oVSVAsn.exe
  C:\Windows\System\oVSVAsn.exe
  2⤵
  PID:5420
- C:\Windows\System\YdPskxc.exe
  C:\Windows\System\YdPskxc.exe
  2⤵
  PID:5440
- C:\Windows\System\lAfKsGf.exe
  C:\Windows\System\lAfKsGf.exe
  2⤵
  PID:5456
- C:\Windows\System\KMfAhRU.exe
  C:\Windows\System\KMfAhRU.exe
  2⤵
  PID:5472
- C:\Windows\System\LbjTyTZ.exe
  C:\Windows\System\LbjTyTZ.exe
  2⤵
  PID:5488
- C:\Windows\System\NbWPxUP.exe
  C:\Windows\System\NbWPxUP.exe
  2⤵
  PID:5504
- C:\Windows\System\jEuDKrA.exe
  C:\Windows\System\jEuDKrA.exe
  2⤵
  PID:5524
- C:\Windows\System\NaIWzxV.exe
  C:\Windows\System\NaIWzxV.exe
  2⤵
  PID:5540
- C:\Windows\System\XnYRjSS.exe
  C:\Windows\System\XnYRjSS.exe
  2⤵
  PID:5568
- C:\Windows\System\IHZJgqo.exe
  C:\Windows\System\IHZJgqo.exe
  2⤵
  PID:5636
- C:\Windows\System\IsBbGOp.exe
  C:\Windows\System\IsBbGOp.exe
  2⤵
  PID:5848
- C:\Windows\System\PUiFaOf.exe
  C:\Windows\System\PUiFaOf.exe
  2⤵
  PID:5912
- C:\Windows\System\MomPWLP.exe
  C:\Windows\System\MomPWLP.exe
  2⤵
  PID:5976
- C:\Windows\System\EyzdCVK.exe
  C:\Windows\System\EyzdCVK.exe
  2⤵
  PID:6016
- C:\Windows\System\poWjUkD.exe
  C:\Windows\System\poWjUkD.exe
  2⤵
  PID:5620
- C:\Windows\System\kRUkpRf.exe
  C:\Windows\System\kRUkpRf.exe
  2⤵
  PID:6080
- C:\Windows\System\QumrTTT.exe
  C:\Windows\System\QumrTTT.exe
  2⤵
  PID:6120
- C:\Windows\System\aiQirIr.exe
  C:\Windows\System\aiQirIr.exe
  2⤵
  PID:5656
- C:\Windows\System\EQxmwra.exe
  C:\Windows\System\EQxmwra.exe
  2⤵
  PID:5728
- C:\Windows\System\ghQFnZt.exe
  C:\Windows\System\ghQFnZt.exe
  2⤵
  PID:5792
- C:\Windows\System\YpVyEuc.exe
  C:\Windows\System\YpVyEuc.exe
  2⤵
  PID:5832
- C:\Windows\System\stKMPDq.exe
  C:\Windows\System\stKMPDq.exe
  2⤵
  PID:5924
- C:\Windows\System\mMFrRoN.exe
  C:\Windows\System\mMFrRoN.exe
  2⤵
  PID:5996
- C:\Windows\System\RkuEOlR.exe
  C:\Windows\System\RkuEOlR.exe
  2⤵
  PID:6060
- C:\Windows\System\XwoMVcR.exe
  C:\Windows\System\XwoMVcR.exe
  2⤵
  PID:5148
- C:\Windows\System\cenSsiB.exe
  C:\Windows\System\cenSsiB.exe
  2⤵
  PID:4984
- C:\Windows\System\XqLEEBq.exe
  C:\Windows\System\XqLEEBq.exe
  2⤵
  PID:1400
- C:\Windows\System\ruMqjsL.exe
  C:\Windows\System\ruMqjsL.exe
  2⤵
  PID:5468
- C:\Windows\System\twzlVmO.exe
  C:\Windows\System\twzlVmO.exe
  2⤵
  PID:5356
- C:\Windows\System\nhKYdmc.exe
  C:\Windows\System\nhKYdmc.exe
  2⤵
  PID:5204
- C:\Windows\System\uKcXLJv.exe
  C:\Windows\System\uKcXLJv.exe
  2⤵
  PID:3800
- C:\Windows\System\NunLoTJ.exe
  C:\Windows\System\NunLoTJ.exe
  2⤵
  PID:5600
- C:\Windows\System\LIUwALr.exe
  C:\Windows\System\LIUwALr.exe
  2⤵
  PID:4440
- C:\Windows\System\reSAxud.exe
  C:\Windows\System\reSAxud.exe
  2⤵
  PID:5716
- C:\Windows\System\PViXNcG.exe
  C:\Windows\System\PViXNcG.exe
  2⤵
  PID:4536
- C:\Windows\System\kXQZPhj.exe
  C:\Windows\System\kXQZPhj.exe
  2⤵
  PID:5984
- C:\Windows\System\DSRVZvb.exe
  C:\Windows\System\DSRVZvb.exe
  2⤵
  PID:6112
- C:\Windows\System\ujWQzUc.exe
  C:\Windows\System\ujWQzUc.exe
  2⤵
  PID:5864
- C:\Windows\System\NEzijnC.exe
  C:\Windows\System\NEzijnC.exe
  2⤵
  PID:4964
- C:\Windows\System\hWODzZP.exe
  C:\Windows\System\hWODzZP.exe
  2⤵
  PID:5760
- C:\Windows\System\DzFLSCA.exe
  C:\Windows\System\DzFLSCA.exe
  2⤵
  PID:5368
- C:\Windows\System\RYIIqtF.exe
  C:\Windows\System\RYIIqtF.exe
  2⤵
  PID:5288
- C:\Windows\System\SdAufZN.exe
  C:\Windows\System\SdAufZN.exe
  2⤵
  PID:5512
- C:\Windows\System\gBNyoHs.exe
  C:\Windows\System\gBNyoHs.exe
  2⤵
  PID:5552
- C:\Windows\System\qAqHuAv.exe
  C:\Windows\System\qAqHuAv.exe
  2⤵
  PID:4860
- C:\Windows\System\ZdpJcLa.exe
  C:\Windows\System\ZdpJcLa.exe
  2⤵
  PID:5828
- C:\Windows\System\BACppJj.exe
  C:\Windows\System\BACppJj.exe
  2⤵
  PID:5152
- C:\Windows\System\dsNDRom.exe
  C:\Windows\System\dsNDRom.exe
  2⤵
  PID:5532
- C:\Windows\System\vfNrfir.exe
  C:\Windows\System\vfNrfir.exe
  2⤵
  PID:5408
- C:\Windows\System\ibJmKpu.exe
  C:\Windows\System\ibJmKpu.exe
  2⤵
  PID:5680
- C:\Windows\System\egznLoW.exe
  C:\Windows\System\egznLoW.exe
  2⤵
  PID:5588
- C:\Windows\System\sobNelt.exe
  C:\Windows\System\sobNelt.exe
  2⤵
  PID:5780
- C:\Windows\System\DTAYdGA.exe
  C:\Windows\System\DTAYdGA.exe
  2⤵
  PID:5896
- C:\Windows\System\ZkRElBY.exe
  C:\Windows\System\ZkRElBY.exe
  2⤵
  PID:4436
- C:\Windows\System\IqjkqxS.exe
  C:\Windows\System\IqjkqxS.exe
  2⤵
  PID:6032
- C:\Windows\System\VGQybBe.exe
  C:\Windows\System\VGQybBe.exe
  2⤵
  PID:5776
- C:\Windows\System\WyZrjVG.exe
  C:\Windows\System\WyZrjVG.exe
  2⤵
  PID:6096
- C:\Windows\System\cyCAWMx.exe
  C:\Windows\System\cyCAWMx.exe
  2⤵
  PID:6124
- C:\Windows\System\CjjLtxl.exe
  C:\Windows\System\CjjLtxl.exe
  2⤵
  PID:5320
- C:\Windows\System\SSiBgny.exe
  C:\Windows\System\SSiBgny.exe
  2⤵
  PID:4892
- C:\Windows\System\dtIZYUW.exe
  C:\Windows\System\dtIZYUW.exe
  2⤵
  PID:5956
- C:\Windows\System\jbqrdGR.exe
  C:\Windows\System\jbqrdGR.exe
  2⤵
  PID:5172
- C:\Windows\System\ZOIgzlp.exe
  C:\Windows\System\ZOIgzlp.exe
  2⤵
  PID:6160
- C:\Windows\System\QfrxFjF.exe
  C:\Windows\System\QfrxFjF.exe
  2⤵
  PID:6176
- C:\Windows\System\nUzGWAN.exe
  C:\Windows\System\nUzGWAN.exe
  2⤵
  PID:6276
- C:\Windows\System\ELtnJSA.exe
  C:\Windows\System\ELtnJSA.exe
  2⤵
  PID:6292
- C:\Windows\System\frdDHNK.exe
  C:\Windows\System\frdDHNK.exe
  2⤵
  PID:6308
- C:\Windows\System\JDHawpC.exe
  C:\Windows\System\JDHawpC.exe
  2⤵
  PID:6324
- C:\Windows\System\MxGdVPH.exe
  C:\Windows\System\MxGdVPH.exe
  2⤵
  PID:6340
- C:\Windows\System\CGqXzFe.exe
  C:\Windows\System\CGqXzFe.exe
  2⤵
  PID:6356
- C:\Windows\System\hzcvGdR.exe
  C:\Windows\System\hzcvGdR.exe
  2⤵
  PID:6372
- C:\Windows\System\beeZusQ.exe
  C:\Windows\System\beeZusQ.exe
  2⤵
  PID:6388
- C:\Windows\System\eYUhtHJ.exe
  C:\Windows\System\eYUhtHJ.exe
  2⤵
  PID:6404
- C:\Windows\System\cPuUCZD.exe
  C:\Windows\System\cPuUCZD.exe
  2⤵
  PID:6424
- C:\Windows\System\EfLcjfS.exe
  C:\Windows\System\EfLcjfS.exe
  2⤵
  PID:6440
- C:\Windows\System\NlwkEdK.exe
  C:\Windows\System\NlwkEdK.exe
  2⤵
  PID:6456
- C:\Windows\System\hNufgUA.exe
  C:\Windows\System\hNufgUA.exe
  2⤵
  PID:6472
- C:\Windows\System\DwbrXtX.exe
  C:\Windows\System\DwbrXtX.exe
  2⤵
  PID:6488
- C:\Windows\System\pLVcbEL.exe
  C:\Windows\System\pLVcbEL.exe
  2⤵
  PID:6504
- C:\Windows\System\BcVNSig.exe
  C:\Windows\System\BcVNSig.exe
  2⤵
  PID:6520
- C:\Windows\System\TCJIprE.exe
  C:\Windows\System\TCJIprE.exe
  2⤵
  PID:6540
- C:\Windows\System\iehGpWP.exe
  C:\Windows\System\iehGpWP.exe
  2⤵
  PID:6556
- C:\Windows\System\CnfybyR.exe
  C:\Windows\System\CnfybyR.exe
  2⤵
  PID:6572
- C:\Windows\System\AfHErvL.exe
  C:\Windows\System\AfHErvL.exe
  2⤵
  PID:6588
- C:\Windows\System\zgtcIOK.exe
  C:\Windows\System\zgtcIOK.exe
  2⤵
  PID:6608
- C:\Windows\System\bunHroe.exe
  C:\Windows\System\bunHroe.exe
  2⤵
  PID:6624
- C:\Windows\System\NGogvyn.exe
  C:\Windows\System\NGogvyn.exe
  2⤵
  PID:6640
- C:\Windows\System\zZTFVmg.exe
  C:\Windows\System\zZTFVmg.exe
  2⤵
  PID:6656
- C:\Windows\System\GrHQgSI.exe
  C:\Windows\System\GrHQgSI.exe
  2⤵
  PID:6672
- C:\Windows\System\rEXlGBX.exe
  C:\Windows\System\rEXlGBX.exe
  2⤵
  PID:6692
- C:\Windows\System\KVMvJHa.exe
  C:\Windows\System\KVMvJHa.exe
  2⤵
  PID:6708
- C:\Windows\System\HDaDvtf.exe
  C:\Windows\System\HDaDvtf.exe
  2⤵
  PID:6724
- C:\Windows\System\MWkCSQN.exe
  C:\Windows\System\MWkCSQN.exe
  2⤵
  PID:6740
- C:\Windows\System\Hosglss.exe
  C:\Windows\System\Hosglss.exe
  2⤵
  PID:6756
- C:\Windows\System\WzSsitK.exe
  C:\Windows\System\WzSsitK.exe
  2⤵
  PID:6776
- C:\Windows\System\KaQHLzH.exe
  C:\Windows\System\KaQHLzH.exe
  2⤵
  PID:6792
- C:\Windows\System\qkYXkpl.exe
  C:\Windows\System\qkYXkpl.exe
  2⤵
  PID:6808
- C:\Windows\System\iHhLeIo.exe
  C:\Windows\System\iHhLeIo.exe
  2⤵
  PID:6828
- C:\Windows\System\bGUranv.exe
  C:\Windows\System\bGUranv.exe
  2⤵
  PID:6844
- C:\Windows\System\yVkIBqk.exe
  C:\Windows\System\yVkIBqk.exe
  2⤵
  PID:6860
- C:\Windows\System\ZdmwFlE.exe
  C:\Windows\System\ZdmwFlE.exe
  2⤵
  PID:6876
- C:\Windows\System\obspiLW.exe
  C:\Windows\System\obspiLW.exe
  2⤵
  PID:6892
- C:\Windows\System\PbCeopR.exe
  C:\Windows\System\PbCeopR.exe
  2⤵
  PID:6912
- C:\Windows\System\FdosxTT.exe
  C:\Windows\System\FdosxTT.exe
  2⤵
  PID:6928
- C:\Windows\System\QraLgEJ.exe
  C:\Windows\System\QraLgEJ.exe
  2⤵
  PID:6944
- C:\Windows\System\uJFNiqg.exe
  C:\Windows\System\uJFNiqg.exe
  2⤵
  PID:6960
- C:\Windows\System\BeNZtvu.exe
  C:\Windows\System\BeNZtvu.exe
  2⤵
  PID:6980
- C:\Windows\System\jsrjwcz.exe
  C:\Windows\System\jsrjwcz.exe
  2⤵
  PID:6996
- C:\Windows\System\UfiGrBV.exe
  C:\Windows\System\UfiGrBV.exe
  2⤵
  PID:7012
- C:\Windows\System\GaBKLWQ.exe
  C:\Windows\System\GaBKLWQ.exe
  2⤵
  PID:7028
- C:\Windows\System\iRlQFEo.exe
  C:\Windows\System\iRlQFEo.exe
  2⤵
  PID:7048
- C:\Windows\System\xAtBwmq.exe
  C:\Windows\System\xAtBwmq.exe
  2⤵
  PID:7064
- C:\Windows\System\qtgCQJM.exe
  C:\Windows\System\qtgCQJM.exe
  2⤵
  PID:7080
- C:\Windows\System\dPgnEck.exe
  C:\Windows\System\dPgnEck.exe
  2⤵
  PID:7100
- C:\Windows\System\dZZSNyu.exe
  C:\Windows\System\dZZSNyu.exe
  2⤵
  PID:7116
- C:\Windows\System\GxvJybq.exe
  C:\Windows\System\GxvJybq.exe
  2⤵
  PID:7132
- C:\Windows\System\VDOzSXq.exe
  C:\Windows\System\VDOzSXq.exe
  2⤵
  PID:5252
- C:\Windows\System\EBgNtPX.exe
  C:\Windows\System\EBgNtPX.exe
  2⤵
  PID:5424
- C:\Windows\System\WIbdnEu.exe
  C:\Windows\System\WIbdnEu.exe
  2⤵
  PID:6128
- C:\Windows\System\yRySxqG.exe
  C:\Windows\System\yRySxqG.exe
  2⤵
  PID:5492
- C:\Windows\System\cdugSYI.exe
  C:\Windows\System\cdugSYI.exe
  2⤵
  PID:5812
- C:\Windows\System\BGCppZD.exe
  C:\Windows\System\BGCppZD.exe
  2⤵
  PID:6188
- C:\Windows\System\xulrrVk.exe
  C:\Windows\System\xulrrVk.exe
  2⤵
  PID:6320
- C:\Windows\System\ylUwVWS.exe
  C:\Windows\System\ylUwVWS.exe
  2⤵
  PID:4912
- C:\Windows\System\NXGcDuX.exe
  C:\Windows\System\NXGcDuX.exe
  2⤵
  PID:6348
- C:\Windows\System\pAtPRkK.exe
  C:\Windows\System\pAtPRkK.exe
  2⤵
  PID:6412
- C:\Windows\System\VpGvPIR.exe
  C:\Windows\System\VpGvPIR.exe
  2⤵
  PID:6480
- C:\Windows\System\Kcbeopu.exe
  C:\Windows\System\Kcbeopu.exe
  2⤵
  PID:6548
- C:\Windows\System\USKvVlf.exe
  C:\Windows\System\USKvVlf.exe
  2⤵
  PID:6028
- C:\Windows\System\tAWySwR.exe
  C:\Windows\System\tAWySwR.exe
  2⤵
  PID:6616
- C:\Windows\System\EikOfYA.exe
  C:\Windows\System\EikOfYA.exe
  2⤵
  PID:6184
- C:\Windows\System\mYRFvDQ.exe
  C:\Windows\System\mYRFvDQ.exe
  2⤵
  PID:6652
- C:\Windows\System\WoaGFWg.exe
  C:\Windows\System\WoaGFWg.exe
  2⤵
  PID:6688
- C:\Windows\System\UzPlTdb.exe
  C:\Windows\System\UzPlTdb.exe
  2⤵
  PID:6416
- C:\Windows\System\ZWBMPHX.exe
  C:\Windows\System\ZWBMPHX.exe
  2⤵
  PID:6816
- C:\Windows\System\GLIpzBl.exe
  C:\Windows\System\GLIpzBl.exe
  2⤵
  PID:6856
- C:\Windows\System\iMHRnBc.exe
  C:\Windows\System\iMHRnBc.exe
  2⤵
  PID:6924
- C:\Windows\System\dzTrfsG.exe
  C:\Windows\System\dzTrfsG.exe
  2⤵
  PID:6992
- C:\Windows\System\bQlESGx.exe
  C:\Windows\System\bQlESGx.exe
  2⤵
  PID:6204
- C:\Windows\System\hiNPVAp.exe
  C:\Windows\System\hiNPVAp.exe
  2⤵
  PID:6224
- C:\Windows\System\FWCFcNz.exe
  C:\Windows\System\FWCFcNz.exe
  2⤵
  PID:7124
- C:\Windows\System\egDUVvK.exe
  C:\Windows\System\egDUVvK.exe
  2⤵
  PID:6240
- C:\Windows\System\nCcBJiU.exe
  C:\Windows\System\nCcBJiU.exe
  2⤵
  PID:6256
- C:\Windows\System\dEfzRif.exe
  C:\Windows\System\dEfzRif.exe
  2⤵
  PID:6168
- C:\Windows\System\nGjdjQh.exe
  C:\Windows\System\nGjdjQh.exe
  2⤵
  PID:6192
- C:\Windows\System\kqNnPxc.exe
  C:\Windows\System\kqNnPxc.exe
  2⤵
  PID:6384
- C:\Windows\System\DrlEHbK.exe
  C:\Windows\System\DrlEHbK.exe
  2⤵
  PID:6584
- C:\Windows\System\JfAcipa.exe
  C:\Windows\System\JfAcipa.exe
  2⤵
  PID:6748
- C:\Windows\System\tRsYSFg.exe
  C:\Windows\System\tRsYSFg.exe
  2⤵
  PID:6396
- C:\Windows\System\dgsNgxk.exe
  C:\Windows\System\dgsNgxk.exe
  2⤵
  PID:6496
- C:\Windows\System\isomceZ.exe
  C:\Windows\System\isomceZ.exe
  2⤵
  PID:6988
- C:\Windows\System\WypgHOZ.exe
  C:\Windows\System\WypgHOZ.exe
  2⤵
  PID:6304
- C:\Windows\System\yuFBeNM.exe
  C:\Windows\System\yuFBeNM.exe
  2⤵
  PID:6468
- C:\Windows\System\QFrccld.exe
  C:\Windows\System\QFrccld.exe
  2⤵
  PID:6564
- C:\Windows\System\JpYQXss.exe
  C:\Windows\System\JpYQXss.exe
  2⤵
  PID:6604
- C:\Windows\System\orDYXXs.exe
  C:\Windows\System\orDYXXs.exe
  2⤵
  PID:6668
- C:\Windows\System\qeeYsWP.exe
  C:\Windows\System\qeeYsWP.exe
  2⤵
  PID:6736
- C:\Windows\System\loczgdz.exe
  C:\Windows\System\loczgdz.exe
  2⤵
  PID:6800
- C:\Windows\System\TzXRbfD.exe
  C:\Windows\System\TzXRbfD.exe
  2⤵
  PID:6868
- C:\Windows\System\jvvxzrW.exe
  C:\Windows\System\jvvxzrW.exe
  2⤵
  PID:6908
- C:\Windows\System\oMffwJH.exe
  C:\Windows\System\oMffwJH.exe
  2⤵
  PID:6972
- C:\Windows\System\OkviTOr.exe
  C:\Windows\System\OkviTOr.exe
  2⤵
  PID:7036
- C:\Windows\System\aAzxVRd.exe
  C:\Windows\System\aAzxVRd.exe
  2⤵
  PID:7076
- C:\Windows\System\OOgmQQA.exe
  C:\Windows\System\OOgmQQA.exe
  2⤵
  PID:7144
- C:\Windows\System\CkUOqJU.exe
  C:\Windows\System\CkUOqJU.exe
  2⤵
  PID:6888
- C:\Windows\System\dcLFTxi.exe
  C:\Windows\System\dcLFTxi.exe
  2⤵
  PID:5824
- C:\Windows\System\qddTssd.exe
  C:\Windows\System\qddTssd.exe
  2⤵
  PID:6288
- C:\Windows\System\VVfgRRy.exe
  C:\Windows\System\VVfgRRy.exe
  2⤵
  PID:6448
- C:\Windows\System\HiqPqqf.exe
  C:\Windows\System\HiqPqqf.exe
  2⤵
  PID:5880
- C:\Windows\System\RKVOSIo.exe
  C:\Windows\System\RKVOSIo.exe
  2⤵
  PID:6788
- C:\Windows\System\dbVaYMA.exe
  C:\Windows\System\dbVaYMA.exe
  2⤵
  PID:7096
- C:\Windows\System\fymsciL.exe
  C:\Windows\System\fymsciL.exe
  2⤵
  PID:6236
- C:\Windows\System\znvnORi.exe
  C:\Windows\System\znvnORi.exe
  2⤵
  PID:6220
- C:\Windows\System\jctBcEc.exe
  C:\Windows\System\jctBcEc.exe
  2⤵
  PID:6336
- C:\Windows\System\ZFyPRwF.exe
  C:\Windows\System\ZFyPRwF.exe
  2⤵
  PID:5216
- C:\Windows\System\xdRADgE.exe
  C:\Windows\System\xdRADgE.exe
  2⤵
  PID:6464
- C:\Windows\System\ruuBoBC.exe
  C:\Windows\System\ruuBoBC.exe
  2⤵
  PID:6536
- C:\Windows\System\WCpjins.exe
  C:\Windows\System\WCpjins.exe
  2⤵
  PID:6772
- C:\Windows\System\MjvTpfd.exe
  C:\Windows\System\MjvTpfd.exe
  2⤵
  PID:7008
- C:\Windows\System\aNCJNKv.exe
  C:\Windows\System\aNCJNKv.exe
  2⤵
  PID:6528
- C:\Windows\System\TMkYcnr.exe
  C:\Windows\System\TMkYcnr.exe
  2⤵
  PID:6432
- C:\Windows\System\mPrIcdo.exe
  C:\Windows\System\mPrIcdo.exe
  2⤵
  PID:6836
- C:\Windows\System\uyFioFm.exe
  C:\Windows\System\uyFioFm.exe
  2⤵
  PID:7160
- C:\Windows\System\KdcRNyh.exe
  C:\Windows\System\KdcRNyh.exe
  2⤵
  PID:7152
- C:\Windows\System\fjaFxce.exe
  C:\Windows\System\fjaFxce.exe
  2⤵
  PID:6228
- C:\Windows\System\bZJaFwF.exe
  C:\Windows\System\bZJaFwF.exe
  2⤵
  PID:7092
- C:\Windows\System\rTcaJvm.exe
  C:\Windows\System\rTcaJvm.exe
  2⤵
  PID:4092
- C:\Windows\System\tnMjLLv.exe
  C:\Windows\System\tnMjLLv.exe
  2⤵
  PID:7060
- C:\Windows\System\GNMSgHR.exe
  C:\Windows\System\GNMSgHR.exe
  2⤵
  PID:6720
- C:\Windows\System\ZbZpyYy.exe
  C:\Windows\System\ZbZpyYy.exe
  2⤵
  PID:6436
- C:\Windows\System\jTmCzpO.exe
  C:\Windows\System\jTmCzpO.exe
  2⤵
  PID:6368
- C:\Windows\System\COXZNmR.exe
  C:\Windows\System\COXZNmR.exe
  2⤵
  PID:7004
- C:\Windows\System\OPJZyLq.exe
  C:\Windows\System\OPJZyLq.exe
  2⤵
  PID:6068
- C:\Windows\System\sbdJeji.exe
  C:\Windows\System\sbdJeji.exe
  2⤵
  PID:5164
- C:\Windows\System\lnTLhSw.exe
  C:\Windows\System\lnTLhSw.exe
  2⤵
  PID:6332
- C:\Windows\System\pBxMpxU.exe
  C:\Windows\System\pBxMpxU.exe
  2⤵
  PID:5652
- C:\Windows\System\HBiIHQj.exe
  C:\Windows\System\HBiIHQj.exe
  2⤵
  PID:7164
- C:\Windows\System\YwsNptr.exe
  C:\Windows\System\YwsNptr.exe
  2⤵
  PID:7176
- C:\Windows\System\zEdgXfh.exe
  C:\Windows\System\zEdgXfh.exe
  2⤵
  PID:7192
- C:\Windows\System\MNYQWex.exe
  C:\Windows\System\MNYQWex.exe
  2⤵
  PID:7208
- C:\Windows\System\veUlggx.exe
  C:\Windows\System\veUlggx.exe
  2⤵
  PID:7224
- C:\Windows\System\RhqedZS.exe
  C:\Windows\System\RhqedZS.exe
  2⤵
  PID:7240
- C:\Windows\System\qapaSkb.exe
  C:\Windows\System\qapaSkb.exe
  2⤵
  PID:7256
- C:\Windows\System\uucynVV.exe
  C:\Windows\System\uucynVV.exe
  2⤵
  PID:7272
- C:\Windows\System\xNjJdFe.exe
  C:\Windows\System\xNjJdFe.exe
  2⤵
  PID:7288
- C:\Windows\System\dIkWYJj.exe
  C:\Windows\System\dIkWYJj.exe
  2⤵
  PID:7308
- C:\Windows\System\OrQqagK.exe
  C:\Windows\System\OrQqagK.exe
  2⤵
  PID:7324
- C:\Windows\System\ZJyUyUJ.exe
  C:\Windows\System\ZJyUyUJ.exe
  2⤵
  PID:7340
- C:\Windows\System\oFwjhfH.exe
  C:\Windows\System\oFwjhfH.exe
  2⤵
  PID:7356
- C:\Windows\System\nUwzkuC.exe
  C:\Windows\System\nUwzkuC.exe
  2⤵
  PID:7372
- C:\Windows\System\UIHjGMK.exe
  C:\Windows\System\UIHjGMK.exe
  2⤵
  PID:7388
- C:\Windows\System\ZGQMRBB.exe
  C:\Windows\System\ZGQMRBB.exe
  2⤵
  PID:7404
- C:\Windows\System\byNmlHU.exe
  C:\Windows\System\byNmlHU.exe
  2⤵
  PID:7420
- C:\Windows\System\bfZtLMM.exe
  C:\Windows\System\bfZtLMM.exe
  2⤵
  PID:7436
- C:\Windows\System\cVQXFHD.exe
  C:\Windows\System\cVQXFHD.exe
  2⤵
  PID:7452
- C:\Windows\System\TdjxaaN.exe
  C:\Windows\System\TdjxaaN.exe
  2⤵
  PID:7468
- C:\Windows\System\QnaSpts.exe
  C:\Windows\System\QnaSpts.exe
  2⤵
  PID:7484
- C:\Windows\System\DNYDtaY.exe
  C:\Windows\System\DNYDtaY.exe
  2⤵
  PID:7500
- C:\Windows\System\jLWMjEV.exe
  C:\Windows\System\jLWMjEV.exe
  2⤵
  PID:7516
- C:\Windows\System\vDrhGmR.exe
  C:\Windows\System\vDrhGmR.exe
  2⤵
  PID:7532
- C:\Windows\System\cXkZXKr.exe
  C:\Windows\System\cXkZXKr.exe
  2⤵
  PID:7548
- C:\Windows\System\kdksQqc.exe
  C:\Windows\System\kdksQqc.exe
  2⤵
  PID:7564
- C:\Windows\System\RPXbBub.exe
  C:\Windows\System\RPXbBub.exe
  2⤵
  PID:7580
- C:\Windows\System\EGhNZyp.exe
  C:\Windows\System\EGhNZyp.exe
  2⤵
  PID:7596
- C:\Windows\System\fPMygei.exe
  C:\Windows\System\fPMygei.exe
  2⤵
  PID:7612
- C:\Windows\System\TjPenSr.exe
  C:\Windows\System\TjPenSr.exe
  2⤵
  PID:7628
- C:\Windows\System\xPjVGSP.exe
  C:\Windows\System\xPjVGSP.exe
  2⤵
  PID:7644
- C:\Windows\System\rmypubu.exe
  C:\Windows\System\rmypubu.exe
  2⤵
  PID:7660
- C:\Windows\System\LhnZoxC.exe
  C:\Windows\System\LhnZoxC.exe
  2⤵
  PID:7676
- C:\Windows\System\mfPeVay.exe
  C:\Windows\System\mfPeVay.exe
  2⤵
  PID:7692
- C:\Windows\System\aXmrbke.exe
  C:\Windows\System\aXmrbke.exe
  2⤵
  PID:7708
- C:\Windows\System\xSHaiRz.exe
  C:\Windows\System\xSHaiRz.exe
  2⤵
  PID:7724
- C:\Windows\System\DkFfniB.exe
  C:\Windows\System\DkFfniB.exe
  2⤵
  PID:7740
- C:\Windows\System\xSfvNgY.exe
  C:\Windows\System\xSfvNgY.exe
  2⤵
  PID:7756
- C:\Windows\System\YmbopUW.exe
  C:\Windows\System\YmbopUW.exe
  2⤵
  PID:7772
- C:\Windows\System\eAJtvps.exe
  C:\Windows\System\eAJtvps.exe
  2⤵
  PID:7792
- C:\Windows\System\ZJICGUu.exe
  C:\Windows\System\ZJICGUu.exe
  2⤵
  PID:7808
- C:\Windows\System\EnWeehb.exe
  C:\Windows\System\EnWeehb.exe
  2⤵
  PID:7824
- C:\Windows\System\xcWDchH.exe
  C:\Windows\System\xcWDchH.exe
  2⤵
  PID:7840
- C:\Windows\System\oCeClAt.exe
  C:\Windows\System\oCeClAt.exe
  2⤵
  PID:7860
- C:\Windows\System\pvKJXeA.exe
  C:\Windows\System\pvKJXeA.exe
  2⤵
  PID:7876
- C:\Windows\System\UcRHvcM.exe
  C:\Windows\System\UcRHvcM.exe
  2⤵
  PID:7892
- C:\Windows\System\zDqRCzW.exe
  C:\Windows\System\zDqRCzW.exe
  2⤵
  PID:7908
- C:\Windows\System\UIHFwSd.exe
  C:\Windows\System\UIHFwSd.exe
  2⤵
  PID:7924
- C:\Windows\System\BrDgAXK.exe
  C:\Windows\System\BrDgAXK.exe
  2⤵
  PID:7940
- C:\Windows\System\rnfAUOk.exe
  C:\Windows\System\rnfAUOk.exe
  2⤵
  PID:7956
- C:\Windows\System\fSdsduf.exe
  C:\Windows\System\fSdsduf.exe
  2⤵
  PID:8008
- C:\Windows\System\CefhDNC.exe
  C:\Windows\System\CefhDNC.exe
  2⤵
  PID:8060
- C:\Windows\System\YQsijhA.exe
  C:\Windows\System\YQsijhA.exe
  2⤵
  PID:8076
- C:\Windows\System\COyXUwN.exe
  C:\Windows\System\COyXUwN.exe
  2⤵
  PID:8092
- C:\Windows\System\NpMGaxm.exe
  C:\Windows\System\NpMGaxm.exe
  2⤵
  PID:8108
- C:\Windows\System\UMMSoMJ.exe
  C:\Windows\System\UMMSoMJ.exe
  2⤵
  PID:8124
- C:\Windows\System\admaCbj.exe
  C:\Windows\System\admaCbj.exe
  2⤵
  PID:8176
- C:\Windows\System\mCdhpMt.exe
  C:\Windows\System\mCdhpMt.exe
  2⤵
  PID:6512
- C:\Windows\System\uklqqOj.exe
  C:\Windows\System\uklqqOj.exe
  2⤵
  PID:5696
- C:\Windows\System\LFMWcWG.exe
  C:\Windows\System\LFMWcWG.exe
  2⤵
  PID:7200
- C:\Windows\System\CThmoLp.exe
  C:\Windows\System\CThmoLp.exe
  2⤵
  PID:7264
- C:\Windows\System\sWOJOfA.exe
  C:\Windows\System\sWOJOfA.exe
  2⤵
  PID:7332
- C:\Windows\System\RljeZvm.exe
  C:\Windows\System\RljeZvm.exe
  2⤵
  PID:2924
- C:\Windows\System\RdwrahM.exe
  C:\Windows\System\RdwrahM.exe
  2⤵
  PID:7432
- C:\Windows\System\bCXRGBp.exe
  C:\Windows\System\bCXRGBp.exe
  2⤵
  PID:7492
- C:\Windows\System\ZTSbszu.exe
  C:\Windows\System\ZTSbszu.exe
  2⤵
  PID:7044
- C:\Windows\System\PRjRWgk.exe
  C:\Windows\System\PRjRWgk.exe
  2⤵
  PID:7588
- C:\Windows\System\exMVqik.exe
  C:\Windows\System\exMVqik.exe
  2⤵
  PID:7652
- C:\Windows\System\CEEhxkm.exe
  C:\Windows\System\CEEhxkm.exe
  2⤵
  PID:7716
- C:\Windows\System\CvEpVDK.exe
  C:\Windows\System\CvEpVDK.exe
  2⤵
  PID:7784
- C:\Windows\System\daZKsqc.exe
  C:\Windows\System\daZKsqc.exe
  2⤵
  PID:7476
- C:\Windows\System\SxadbDq.exe
  C:\Windows\System\SxadbDq.exe
  2⤵
  PID:7248
- C:\Windows\System\NRtrkoD.exe
  C:\Windows\System\NRtrkoD.exe
  2⤵
  PID:7056
- C:\Windows\System\LOZeeqX.exe
  C:\Windows\System\LOZeeqX.exe
  2⤵
  PID:7280
- C:\Windows\System\TQYAUEF.exe
  C:\Windows\System\TQYAUEF.exe
  2⤵
  PID:7380
- C:\Windows\System\cIlXYvt.exe
  C:\Windows\System\cIlXYvt.exe
  2⤵
  PID:7444
- C:\Windows\System\DfrYiKm.exe
  C:\Windows\System\DfrYiKm.exe
  2⤵
  PID:7512
- C:\Windows\System\AexYFTA.exe
  C:\Windows\System\AexYFTA.exe
  2⤵
  PID:7576
- C:\Windows\System\cerFmUY.exe
  C:\Windows\System\cerFmUY.exe
  2⤵
  PID:7640
- C:\Windows\System\BRfMkmF.exe
  C:\Windows\System\BRfMkmF.exe
  2⤵
  PID:7704
- C:\Windows\System\NZeGewa.exe
  C:\Windows\System\NZeGewa.exe
  2⤵
  PID:7768
- C:\Windows\System\sXTXweY.exe
  C:\Windows\System\sXTXweY.exe
  2⤵
  PID:7836
- C:\Windows\System\ExBhxZW.exe
  C:\Windows\System\ExBhxZW.exe
  2⤵
  PID:7904
- C:\Windows\System\NNewaRH.exe
  C:\Windows\System\NNewaRH.exe
  2⤵
  PID:7856
- C:\Windows\System\AMWMbzF.exe
  C:\Windows\System\AMWMbzF.exe
  2⤵
  PID:7920
- C:\Windows\System\IIFaBEU.exe
  C:\Windows\System\IIFaBEU.exe
  2⤵
  PID:5548
- C:\Windows\System\QhgdkTg.exe
  C:\Windows\System\QhgdkTg.exe
  2⤵
  PID:8004
- C:\Windows\System\EGaGJeL.exe
  C:\Windows\System\EGaGJeL.exe
  2⤵
  PID:7984
- C:\Windows\System\OSzkRuB.exe
  C:\Windows\System\OSzkRuB.exe
  2⤵
  PID:8028
- C:\Windows\System\OvwHRJc.exe
  C:\Windows\System\OvwHRJc.exe
  2⤵
  PID:8040
- C:\Windows\System\yhpoaOl.exe
  C:\Windows\System\yhpoaOl.exe
  2⤵
  PID:8120
- C:\Windows\System\ESJHlsW.exe
  C:\Windows\System\ESJHlsW.exe
  2⤵
  PID:8100
- C:\Windows\System\jxwFTre.exe
  C:\Windows\System\jxwFTre.exe
  2⤵
  PID:8144
- C:\Windows\System\rBCVnef.exe
  C:\Windows\System\rBCVnef.exe
  2⤵
  PID:7968
- C:\Windows\System\zTDjUPH.exe
  C:\Windows\System\zTDjUPH.exe
  2⤵
  PID:8184
- C:\Windows\System\eRiEbvk.exe
  C:\Windows\System\eRiEbvk.exe
  2⤵
  PID:7300
- C:\Windows\System\sPCfRck.exe
  C:\Windows\System\sPCfRck.exe
  2⤵
  PID:7236
- C:\Windows\System\GezxlOr.exe
  C:\Windows\System\GezxlOr.exe
  2⤵
  PID:7464
- C:\Windows\System\BjVwbWM.exe
  C:\Windows\System\BjVwbWM.exe
  2⤵
  PID:7620
- C:\Windows\System\tszphdE.exe
  C:\Windows\System\tszphdE.exe
  2⤵
  PID:7688
- C:\Windows\System\ZyijUDZ.exe
  C:\Windows\System\ZyijUDZ.exe
  2⤵
  PID:7624
- C:\Windows\System\nSIMfIl.exe
  C:\Windows\System\nSIMfIl.exe
  2⤵
  PID:7816
- C:\Windows\System\WixdATO.exe
  C:\Windows\System\WixdATO.exe
  2⤵
  PID:7320
- C:\Windows\System\mEmupWR.exe
  C:\Windows\System\mEmupWR.exe
  2⤵
  PID:7480
- C:\Windows\System\XDCAXXQ.exe
  C:\Windows\System\XDCAXXQ.exe
  2⤵
  PID:7608
- C:\Windows\System\QPYGSGk.exe
  C:\Windows\System\QPYGSGk.exe
  2⤵
  PID:7252
- C:\Windows\System\eXBqwYq.exe
  C:\Windows\System\eXBqwYq.exe
  2⤵
  PID:7936
- C:\Windows\System\YdQWcYd.exe
  C:\Windows\System\YdQWcYd.exe
  2⤵
  PID:7976
- C:\Windows\System\xWooKwr.exe
  C:\Windows\System\xWooKwr.exe
  2⤵
  PID:7732
- C:\Windows\System\wigIIWc.exe
  C:\Windows\System\wigIIWc.exe
  2⤵
  PID:8000
- C:\Windows\System\JkxidCd.exe
  C:\Windows\System\JkxidCd.exe
  2⤵
  PID:7900
- C:\Windows\System\cqEdiEX.exe
  C:\Windows\System\cqEdiEX.exe
  2⤵
  PID:8140
- C:\Windows\System\CWGxCFo.exe
  C:\Windows\System\CWGxCFo.exe
  2⤵
  PID:8172
- C:\Windows\System\FsrbZGH.exe
  C:\Windows\System\FsrbZGH.exe
  2⤵
  PID:7748
- C:\Windows\System\RtESJFR.exe
  C:\Windows\System\RtESJFR.exe
  2⤵
  PID:8068
- C:\Windows\System\tEujHgZ.exe
  C:\Windows\System\tEujHgZ.exe
  2⤵
  PID:7140
- C:\Windows\System\yUETxfs.exe
  C:\Windows\System\yUETxfs.exe
  2⤵
  PID:7416
- C:\Windows\System\frNRWkd.exe
  C:\Windows\System\frNRWkd.exe
  2⤵
  PID:7560
- C:\Windows\System\CgFgQeJ.exe
  C:\Windows\System\CgFgQeJ.exe
  2⤵
  PID:7832
- C:\Windows\System\GYFFELX.exe
  C:\Windows\System\GYFFELX.exe
  2⤵
  PID:7952
- C:\Windows\System\ledXvGa.exe
  C:\Windows\System\ledXvGa.exe
  2⤵
  PID:8024
- C:\Windows\System\urGvJIO.exe
  C:\Windows\System\urGvJIO.exe
  2⤵
  PID:8088
- C:\Windows\System\DMCZxJF.exe
  C:\Windows\System\DMCZxJF.exe
  2⤵
  PID:8168
- C:\Windows\System\ndetgmn.exe
  C:\Windows\System\ndetgmn.exe
  2⤵
  PID:7684
- C:\Windows\System\HTpIVjd.exe
  C:\Windows\System\HTpIVjd.exe
  2⤵
  PID:7672
- C:\Windows\System\OwvMaQT.exe
  C:\Windows\System\OwvMaQT.exe
  2⤵
  PID:7216
- C:\Windows\System\GgYgyfY.exe
  C:\Windows\System\GgYgyfY.exe
  2⤵
  PID:8132
- C:\Windows\System\vYauMpo.exe
  C:\Windows\System\vYauMpo.exe
  2⤵
  PID:6968
- C:\Windows\System\kpdkHJm.exe
  C:\Windows\System\kpdkHJm.exe
  2⤵
  PID:8200
- C:\Windows\System\hLhIFZD.exe
  C:\Windows\System\hLhIFZD.exe
  2⤵
  PID:8216
- C:\Windows\System\wlMZxmc.exe
  C:\Windows\System\wlMZxmc.exe
  2⤵
  PID:8232
- C:\Windows\System\PyosMRK.exe
  C:\Windows\System\PyosMRK.exe
  2⤵
  PID:8248
- C:\Windows\System\PBeZCiL.exe
  C:\Windows\System\PBeZCiL.exe
  2⤵
  PID:8264
- C:\Windows\System\orUtWmL.exe
  C:\Windows\System\orUtWmL.exe
  2⤵
  PID:8280
- C:\Windows\System\japckjs.exe
  C:\Windows\System\japckjs.exe
  2⤵
  PID:8296
- C:\Windows\System\aLasgmg.exe
  C:\Windows\System\aLasgmg.exe
  2⤵
  PID:8312
- C:\Windows\System\JKnbkiW.exe
  C:\Windows\System\JKnbkiW.exe
  2⤵
  PID:8328
- C:\Windows\System\ttLlEam.exe
  C:\Windows\System\ttLlEam.exe
  2⤵
  PID:8344
- C:\Windows\System\GoGxcNI.exe
  C:\Windows\System\GoGxcNI.exe
  2⤵
  PID:8360
- C:\Windows\System\bLRYUco.exe
  C:\Windows\System\bLRYUco.exe
  2⤵
  PID:8376
- C:\Windows\System\MUpKDjh.exe
  C:\Windows\System\MUpKDjh.exe
  2⤵
  PID:8392
- C:\Windows\System\nTpcuuX.exe
  C:\Windows\System\nTpcuuX.exe
  2⤵
  PID:8408
- C:\Windows\System\MVixnSJ.exe
  C:\Windows\System\MVixnSJ.exe
  2⤵
  PID:8424
- C:\Windows\System\DvdsGQS.exe
  C:\Windows\System\DvdsGQS.exe
  2⤵
  PID:8440
- C:\Windows\System\mtssUQr.exe
  C:\Windows\System\mtssUQr.exe
  2⤵
  PID:8456
- C:\Windows\System\xQSLyYF.exe
  C:\Windows\System\xQSLyYF.exe
  2⤵
  PID:8472
- C:\Windows\System\aQmXJQa.exe
  C:\Windows\System\aQmXJQa.exe
  2⤵
  PID:8488
- C:\Windows\System\eWGmIHM.exe
  C:\Windows\System\eWGmIHM.exe
  2⤵
  PID:8516
- C:\Windows\System\docdMFz.exe
  C:\Windows\System\docdMFz.exe
  2⤵
  PID:8532
- C:\Windows\System\aDISqIU.exe
  C:\Windows\System\aDISqIU.exe
  2⤵
  PID:8548
- C:\Windows\System\CBWEvay.exe
  C:\Windows\System\CBWEvay.exe
  2⤵
  PID:8564
- C:\Windows\System\CUnbjzx.exe
  C:\Windows\System\CUnbjzx.exe
  2⤵
  PID:8580
- C:\Windows\System\vpqlcpC.exe
  C:\Windows\System\vpqlcpC.exe
  2⤵
  PID:8596
- C:\Windows\System\YaNwhsW.exe
  C:\Windows\System\YaNwhsW.exe
  2⤵
  PID:8612
- C:\Windows\System\oXtmvXH.exe
  C:\Windows\System\oXtmvXH.exe
  2⤵
  PID:8628
- C:\Windows\System\kzVoykZ.exe
  C:\Windows\System\kzVoykZ.exe
  2⤵
  PID:8644
- C:\Windows\System\dSzFyWH.exe
  C:\Windows\System\dSzFyWH.exe
  2⤵
  PID:8660
- C:\Windows\System\sPIRjkE.exe
  C:\Windows\System\sPIRjkE.exe
  2⤵
  PID:8676
- C:\Windows\System\FZAMsCl.exe
  C:\Windows\System\FZAMsCl.exe
  2⤵
  PID:8692
- C:\Windows\System\joVzoUX.exe
  C:\Windows\System\joVzoUX.exe
  2⤵
  PID:8708
- C:\Windows\System\UHenXSn.exe
  C:\Windows\System\UHenXSn.exe
  2⤵
  PID:8724
- C:\Windows\System\SzoLHFc.exe
  C:\Windows\System\SzoLHFc.exe
  2⤵
  PID:8740
- C:\Windows\System\ojoJCIh.exe
  C:\Windows\System\ojoJCIh.exe
  2⤵
  PID:8756
- C:\Windows\System\AXIDmjm.exe
  C:\Windows\System\AXIDmjm.exe
  2⤵
  PID:8772
- C:\Windows\System\hDVgMJc.exe
  C:\Windows\System\hDVgMJc.exe
  2⤵
  PID:8788
- C:\Windows\System\mYIGqGO.exe
  C:\Windows\System\mYIGqGO.exe
  2⤵
  PID:8860
- C:\Windows\System\gHwwUxF.exe
  C:\Windows\System\gHwwUxF.exe
  2⤵
  PID:8876
- C:\Windows\System\zAKPIHC.exe
  C:\Windows\System\zAKPIHC.exe
  2⤵
  PID:8892
- C:\Windows\System\QnBTvcB.exe
  C:\Windows\System\QnBTvcB.exe
  2⤵
  PID:8908
- C:\Windows\System\zAmfolE.exe
  C:\Windows\System\zAmfolE.exe
  2⤵
  PID:8924
- C:\Windows\System\aAGWOPR.exe
  C:\Windows\System\aAGWOPR.exe
  2⤵
  PID:8940
- C:\Windows\System\yRmQMOn.exe
  C:\Windows\System\yRmQMOn.exe
  2⤵
  PID:8956
- C:\Windows\System\rZaARLz.exe
  C:\Windows\System\rZaARLz.exe
  2⤵
  PID:8976
- C:\Windows\System\lKpocNF.exe
  C:\Windows\System\lKpocNF.exe
  2⤵
  PID:9000
- C:\Windows\System\HlalRYY.exe
  C:\Windows\System\HlalRYY.exe
  2⤵
  PID:9016
- C:\Windows\System\xnyNUyO.exe
  C:\Windows\System\xnyNUyO.exe
  2⤵
  PID:9032
- C:\Windows\System\buawBvk.exe
  C:\Windows\System\buawBvk.exe
  2⤵
  PID:9048
- C:\Windows\System\GFAtEJk.exe
  C:\Windows\System\GFAtEJk.exe
  2⤵
  PID:9064
- C:\Windows\System\WcekFAT.exe
  C:\Windows\System\WcekFAT.exe
  2⤵
  PID:9080
- C:\Windows\System\skuEkRk.exe
  C:\Windows\System\skuEkRk.exe
  2⤵
  PID:9096
- C:\Windows\System\qcYdqCs.exe
  C:\Windows\System\qcYdqCs.exe
  2⤵
  PID:9112
- C:\Windows\System\KHIKseJ.exe
  C:\Windows\System\KHIKseJ.exe
  2⤵
  PID:9128
- C:\Windows\System\TUxZQyu.exe
  C:\Windows\System\TUxZQyu.exe
  2⤵
  PID:9144
- C:\Windows\System\RwGdUHi.exe
  C:\Windows\System\RwGdUHi.exe
  2⤵
  PID:9160
- C:\Windows\System\AgpnoNF.exe
  C:\Windows\System\AgpnoNF.exe
  2⤵
  PID:9176
- C:\Windows\System\dYfjzuW.exe
  C:\Windows\System\dYfjzuW.exe
  2⤵
  PID:9192
- C:\Windows\System\ejKlwAT.exe
  C:\Windows\System\ejKlwAT.exe
  2⤵
  PID:9208
- C:\Windows\System\nykfywa.exe
  C:\Windows\System\nykfywa.exe
  2⤵
  PID:8152
- C:\Windows\System\uZLlZNm.exe
  C:\Windows\System\uZLlZNm.exe
  2⤵
  PID:7524
- C:\Windows\System\qeyEamG.exe
  C:\Windows\System\qeyEamG.exe
  2⤵
  PID:8324
- C:\Windows\System\poVrMOY.exe
  C:\Windows\System\poVrMOY.exe
  2⤵
  PID:6684
- C:\Windows\System\XWjRAHF.exe
  C:\Windows\System\XWjRAHF.exe
  2⤵
  PID:8228
- C:\Windows\System\oFbRCZp.exe
  C:\Windows\System\oFbRCZp.exe
  2⤵
  PID:8388
- C:\Windows\System\pYwjsOn.exe
  C:\Windows\System\pYwjsOn.exe
  2⤵
  PID:8480
- C:\Windows\System\rRkKghA.exe
  C:\Windows\System\rRkKghA.exe
  2⤵
  PID:8496
- C:\Windows\System\cTFtDPe.exe
  C:\Windows\System\cTFtDPe.exe
  2⤵
  PID:8404
- C:\Windows\System\mCTmCsh.exe
  C:\Windows\System\mCTmCsh.exe
  2⤵
  PID:8340
- C:\Windows\System\BzzsqXd.exe
  C:\Windows\System\BzzsqXd.exe
  2⤵
  PID:8272
- C:\Windows\System\NreYhmi.exe
  C:\Windows\System\NreYhmi.exe
  2⤵
  PID:7528
- C:\Windows\System\RwBMMOB.exe
  C:\Windows\System\RwBMMOB.exe
  2⤵
  PID:8544
- C:\Windows\System\YUGCXbB.exe
  C:\Windows\System\YUGCXbB.exe
  2⤵
  PID:8608
- C:\Windows\System\vdhhJRf.exe
  C:\Windows\System\vdhhJRf.exe
  2⤵
  PID:8528
- C:\Windows\System\enmXZnf.exe
  C:\Windows\System\enmXZnf.exe
  2⤵
  PID:8592
- C:\Windows\System\qMGXlka.exe
  C:\Windows\System\qMGXlka.exe
  2⤵
  PID:8620
- C:\Windows\System\OlWXkBl.exe
  C:\Windows\System\OlWXkBl.exe
  2⤵
  PID:8668
- C:\Windows\System\zXQJypP.exe
  C:\Windows\System\zXQJypP.exe
  2⤵
  PID:8736
- C:\Windows\System\oBLLmod.exe
  C:\Windows\System\oBLLmod.exe
  2⤵
  PID:8796
- C:\Windows\System\LHpAcnH.exe
  C:\Windows\System\LHpAcnH.exe
  2⤵
  PID:8848
- C:\Windows\System\jiOBQfb.exe
  C:\Windows\System\jiOBQfb.exe
  2⤵
  PID:8888
- C:\Windows\System\qfqFSdi.exe
  C:\Windows\System\qfqFSdi.exe
  2⤵
  PID:8948
- C:\Windows\System\lCRNhtz.exe
  C:\Windows\System\lCRNhtz.exe
  2⤵
  PID:8868
- C:\Windows\System\LwWJEjA.exe
  C:\Windows\System\LwWJEjA.exe
  2⤵
  PID:8972
- C:\Windows\System\kXgKqxd.exe
  C:\Windows\System\kXgKqxd.exe
  2⤵
  PID:8992
- C:\Windows\System\tZJNqkV.exe
  C:\Windows\System\tZJNqkV.exe
  2⤵
  PID:9012
- C:\Windows\System\TSCOgzj.exe
  C:\Windows\System\TSCOgzj.exe
  2⤵
  PID:9060
- C:\Windows\System\OMCpZaQ.exe
  C:\Windows\System\OMCpZaQ.exe
  2⤵
  PID:9092
- C:\Windows\System\IByMMTu.exe
  C:\Windows\System\IByMMTu.exe
  2⤵
  PID:9156
- C:\Windows\System\JuzXmmL.exe
  C:\Windows\System\JuzXmmL.exe
  2⤵
  PID:8208
- C:\Windows\System\rIUXLZq.exe
  C:\Windows\System\rIUXLZq.exe
  2⤵
  PID:8224
- C:\Windows\System\LNtmtds.exe
  C:\Windows\System\LNtmtds.exe
  2⤵
  PID:8436
- C:\Windows\System\ZqQlcjY.exe
  C:\Windows\System\ZqQlcjY.exe
  2⤵
  PID:9140
- C:\Windows\System\Oscdazq.exe
  C:\Windows\System\Oscdazq.exe
  2⤵
  PID:9204
- C:\Windows\System\vkeCKpT.exe
  C:\Windows\System\vkeCKpT.exe
  2⤵
  PID:8352
- C:\Windows\System\ZNDjteX.exe
  C:\Windows\System\ZNDjteX.exe
  2⤵
  PID:8304
- C:\Windows\System\LHzFWrm.exe
  C:\Windows\System\LHzFWrm.exe
  2⤵
  PID:8656
- C:\Windows\System\agObmkH.exe
  C:\Windows\System\agObmkH.exe
  2⤵
  PID:8540
- C:\Windows\System\SaMCUkg.exe
  C:\Windows\System\SaMCUkg.exe
  2⤵
  PID:8368
- C:\Windows\System\PHBXEBE.exe
  C:\Windows\System\PHBXEBE.exe
  2⤵
  PID:7636
- C:\Windows\System\WOUcEoF.exe
  C:\Windows\System\WOUcEoF.exe
  2⤵
  PID:8720
- C:\Windows\System\XRubnVs.exe
  C:\Windows\System\XRubnVs.exe
  2⤵
  PID:8768
- C:\Windows\System\SpgGvGi.exe
  C:\Windows\System\SpgGvGi.exe
  2⤵
  PID:8808
- C:\Windows\System\HmExiqF.exe
  C:\Windows\System\HmExiqF.exe
  2⤵
  PID:8824
- C:\Windows\System\ZLUwURx.exe
  C:\Windows\System\ZLUwURx.exe
  2⤵
  PID:9044
- C:\Windows\System\rzBnbEz.exe
  C:\Windows\System\rzBnbEz.exe
  2⤵
  PID:8288
- C:\Windows\System\PlONdvF.exe
  C:\Windows\System\PlONdvF.exe
  2⤵
  PID:8244
- C:\Windows\System\pzocOsg.exe
  C:\Windows\System\pzocOsg.exe
  2⤵
  PID:8512
- C:\Windows\System\SbWEjYr.exe
  C:\Windows\System\SbWEjYr.exe
  2⤵
  PID:8524
- C:\Windows\System\oSFxoJP.exe
  C:\Windows\System\oSFxoJP.exe
  2⤵
  PID:8560
- C:\Windows\System\IoOfzKF.exe
  C:\Windows\System\IoOfzKF.exe
  2⤵
  PID:8780
- C:\Windows\System\rPQhmai.exe
  C:\Windows\System\rPQhmai.exe
  2⤵
  PID:8820
- C:\Windows\System\kIjCGEs.exe
  C:\Windows\System\kIjCGEs.exe
  2⤵
  PID:8840
- C:\Windows\System\mwmYFvQ.exe
  C:\Windows\System\mwmYFvQ.exe
  2⤵
  PID:9028
- C:\Windows\System\EBziRVi.exe
  C:\Windows\System\EBziRVi.exe
  2⤵
  PID:9184
- C:\Windows\System\rhXmeSV.exe
  C:\Windows\System\rhXmeSV.exe
  2⤵
  PID:8416
- C:\Windows\System\cyOmTuM.exe
  C:\Windows\System\cyOmTuM.exe
  2⤵
  PID:8936
- C:\Windows\System\bPZkOCm.exe
  C:\Windows\System\bPZkOCm.exe
  2⤵
  PID:8700
- C:\Windows\System\sNDQOtG.exe
  C:\Windows\System\sNDQOtG.exe
  2⤵
  PID:8800
- C:\Windows\System\CeZcocV.exe
  C:\Windows\System\CeZcocV.exe
  2⤵
  PID:8968
- C:\Windows\System\bLKhEeC.exe
  C:\Windows\System\bLKhEeC.exe
  2⤵
  PID:8836
- C:\Windows\System\IrBpXTM.exe
  C:\Windows\System\IrBpXTM.exe
  2⤵
  PID:9136
- C:\Windows\System\LdpRaBb.exe
  C:\Windows\System\LdpRaBb.exe
  2⤵
  PID:8464
- C:\Windows\System\udLmSun.exe
  C:\Windows\System\udLmSun.exe
  2⤵
  PID:9088
- C:\Windows\System\PHXbaUs.exe
  C:\Windows\System\PHXbaUs.exe
  2⤵
  PID:8688
- C:\Windows\System\cCnglGO.exe
  C:\Windows\System\cCnglGO.exe
  2⤵
  PID:9200
- C:\Windows\System\ZFfRpES.exe
  C:\Windows\System\ZFfRpES.exe
  2⤵
  PID:9228
- C:\Windows\System\MbGsFCX.exe
  C:\Windows\System\MbGsFCX.exe
  2⤵
  PID:9244
- C:\Windows\System\LieECXP.exe
  C:\Windows\System\LieECXP.exe
  2⤵
  PID:9260
- C:\Windows\System\saEXYqt.exe
  C:\Windows\System\saEXYqt.exe
  2⤵
  PID:9276
- C:\Windows\System\XLiPndh.exe
  C:\Windows\System\XLiPndh.exe
  2⤵
  PID:9292
- C:\Windows\System\MWHoIQk.exe
  C:\Windows\System\MWHoIQk.exe
  2⤵
  PID:9308
- C:\Windows\System\elzayYA.exe
  C:\Windows\System\elzayYA.exe
  2⤵
  PID:9324
- C:\Windows\System\qKhMSwH.exe
  C:\Windows\System\qKhMSwH.exe
  2⤵
  PID:9340
- C:\Windows\System\HOwKgFO.exe
  C:\Windows\System\HOwKgFO.exe
  2⤵
  PID:9356
- C:\Windows\System\FQTHIzw.exe
  C:\Windows\System\FQTHIzw.exe
  2⤵
  PID:9372
- C:\Windows\System\PMyPiLR.exe
  C:\Windows\System\PMyPiLR.exe
  2⤵
  PID:9388
- C:\Windows\System\IKNcLXH.exe
  C:\Windows\System\IKNcLXH.exe
  2⤵
  PID:9404
- C:\Windows\System\oFFlBSX.exe
  C:\Windows\System\oFFlBSX.exe
  2⤵
  PID:9420
- C:\Windows\System\MGPEMXm.exe
  C:\Windows\System\MGPEMXm.exe
  2⤵
  PID:9436
- C:\Windows\System\awxVUkm.exe
  C:\Windows\System\awxVUkm.exe
  2⤵
  PID:9452
- C:\Windows\System\NeFGGKT.exe
  C:\Windows\System\NeFGGKT.exe
  2⤵
  PID:9468
- C:\Windows\System\nfALLVv.exe
  C:\Windows\System\nfALLVv.exe
  2⤵
  PID:9484
- C:\Windows\System\pfnsFPt.exe
  C:\Windows\System\pfnsFPt.exe
  2⤵
  PID:9500
- C:\Windows\System\foVfqFO.exe
  C:\Windows\System\foVfqFO.exe
  2⤵
  PID:9516
- C:\Windows\System\aSOxAEB.exe
  C:\Windows\System\aSOxAEB.exe
  2⤵
  PID:9532
- C:\Windows\System\mrDLIqs.exe
  C:\Windows\System\mrDLIqs.exe
  2⤵
  PID:9548
- C:\Windows\System\njnzuci.exe
  C:\Windows\System\njnzuci.exe
  2⤵
  PID:9564
- C:\Windows\System\FxEUTac.exe
  C:\Windows\System\FxEUTac.exe
  2⤵
  PID:9580
- C:\Windows\System\KNKZZiK.exe
  C:\Windows\System\KNKZZiK.exe
  2⤵
  PID:9616
- C:\Windows\System\zMWeWIq.exe
  C:\Windows\System\zMWeWIq.exe
  2⤵
  PID:9632
- C:\Windows\System\HhlaHpk.exe
  C:\Windows\System\HhlaHpk.exe
  2⤵
  PID:9648
- C:\Windows\System\ZLDpCcV.exe
  C:\Windows\System\ZLDpCcV.exe
  2⤵
  PID:9664
- C:\Windows\System\OTNswnv.exe
  C:\Windows\System\OTNswnv.exe
  2⤵
  PID:9680
- C:\Windows\System\gcCFXoR.exe
  C:\Windows\System\gcCFXoR.exe
  2⤵
  PID:9696
- C:\Windows\System\nUzbRYA.exe
  C:\Windows\System\nUzbRYA.exe
  2⤵
  PID:9712
- C:\Windows\System\SxMgewi.exe
  C:\Windows\System\SxMgewi.exe
  2⤵
  PID:9728
- C:\Windows\System\KIvBpvU.exe
  C:\Windows\System\KIvBpvU.exe
  2⤵
  PID:9744
- C:\Windows\System\ovkXxPX.exe
  C:\Windows\System\ovkXxPX.exe
  2⤵
  PID:9760
- C:\Windows\System\FCvaFqz.exe
  C:\Windows\System\FCvaFqz.exe
  2⤵
  PID:9776
- C:\Windows\System\jUcBbzf.exe
  C:\Windows\System\jUcBbzf.exe
  2⤵
  PID:9792
- C:\Windows\System\BnwxDNt.exe
  C:\Windows\System\BnwxDNt.exe
  2⤵
  PID:9816
- C:\Windows\System\ZMovXJL.exe
  C:\Windows\System\ZMovXJL.exe
  2⤵
  PID:9832
- C:\Windows\System\hJTaEik.exe
  C:\Windows\System\hJTaEik.exe
  2⤵
  PID:9848
- C:\Windows\System\xBRRIMO.exe
  C:\Windows\System\xBRRIMO.exe
  2⤵
  PID:9980
- C:\Windows\System\mCHVdFn.exe
  C:\Windows\System\mCHVdFn.exe
  2⤵
  PID:9996
- C:\Windows\System\ksstWDG.exe
  C:\Windows\System\ksstWDG.exe
  2⤵
  PID:10012
- C:\Windows\System\IQxvbuQ.exe
  C:\Windows\System\IQxvbuQ.exe
  2⤵
  PID:10028
- C:\Windows\System\NdgESJz.exe
  C:\Windows\System\NdgESJz.exe
  2⤵
  PID:10044
- C:\Windows\System\WjpJcKw.exe
  C:\Windows\System\WjpJcKw.exe
  2⤵
  PID:10060
- C:\Windows\System\RQZtLxO.exe
  C:\Windows\System\RQZtLxO.exe
  2⤵
  PID:10076
- C:\Windows\System\ztYqGRr.exe
  C:\Windows\System\ztYqGRr.exe
  2⤵
  PID:10092
- C:\Windows\System\vIMvFVc.exe
  C:\Windows\System\vIMvFVc.exe
  2⤵
  PID:10108
- C:\Windows\System\FsMisre.exe
  C:\Windows\System\FsMisre.exe
  2⤵
  PID:10124
- C:\Windows\System\BcwSXfc.exe
  C:\Windows\System\BcwSXfc.exe
  2⤵
  PID:10140
- C:\Windows\System\AzAObHC.exe
  C:\Windows\System\AzAObHC.exe
  2⤵
  PID:10156
- C:\Windows\System\QroRccd.exe
  C:\Windows\System\QroRccd.exe
  2⤵
  PID:10172
- C:\Windows\System\OoZNfIO.exe
  C:\Windows\System\OoZNfIO.exe
  2⤵
  PID:10188
- C:\Windows\System\LeiEEXx.exe
  C:\Windows\System\LeiEEXx.exe
  2⤵
  PID:10204
- C:\Windows\System\VKgHrhM.exe
  C:\Windows\System\VKgHrhM.exe
  2⤵
  PID:10220
- C:\Windows\System\bkOAcUB.exe
  C:\Windows\System\bkOAcUB.exe
  2⤵
  PID:10236
- C:\Windows\System\NJAhAaE.exe
  C:\Windows\System\NJAhAaE.exe
  2⤵
  PID:9224
- C:\Windows\System\UQlcZQR.exe
  C:\Windows\System\UQlcZQR.exe
  2⤵
  PID:9692
- C:\Windows\System\goCsEqV.exe
  C:\Windows\System\goCsEqV.exe
  2⤵
  PID:9756
- C:\Windows\System\KnbFNTO.exe
  C:\Windows\System\KnbFNTO.exe
  2⤵
  PID:9856
- C:\Windows\System\jPUNUMZ.exe
  C:\Windows\System\jPUNUMZ.exe
  2⤵
  PID:9824
- C:\Windows\System\xvuhAHG.exe
  C:\Windows\System\xvuhAHG.exe
  2⤵
  PID:9240
- C:\Windows\System\JJroznX.exe
  C:\Windows\System\JJroznX.exe
  2⤵
  PID:9660
- C:\Windows\System\hIyJefS.exe
  C:\Windows\System\hIyJefS.exe
  2⤵
  PID:9880
- C:\Windows\System\HpbYTXn.exe
  C:\Windows\System\HpbYTXn.exe
  2⤵
  PID:9896
- C:\Windows\System\MfKBbWX.exe
  C:\Windows\System\MfKBbWX.exe
  2⤵
  PID:9912
- C:\Windows\System\azfEZuq.exe
  C:\Windows\System\azfEZuq.exe
  2⤵
  PID:9928
- C:\Windows\System\CUVFsVT.exe
  C:\Windows\System\CUVFsVT.exe
  2⤵
  PID:9940
- C:\Windows\System\UeJapZi.exe
  C:\Windows\System\UeJapZi.exe
  2⤵
  PID:9268
- C:\Windows\System\JhTlBun.exe
  C:\Windows\System\JhTlBun.exe
  2⤵
  PID:9336
- C:\Windows\System\gCKZbNx.exe
  C:\Windows\System\gCKZbNx.exe
  2⤵
  PID:9400
- C:\Windows\System\XfVLaoT.exe
  C:\Windows\System\XfVLaoT.exe
  2⤵
  PID:9464
- C:\Windows\System\qYlTNXy.exe
  C:\Windows\System\qYlTNXy.exe
  2⤵
  PID:9528
- C:\Windows\System\Qqqitvl.exe
  C:\Windows\System\Qqqitvl.exe
  2⤵
  PID:9592
- C:\Windows\System\TXfHLuz.exe
  C:\Windows\System\TXfHLuz.exe
  2⤵
  PID:9608
- C:\Windows\System\FkmxoON.exe
  C:\Windows\System\FkmxoON.exe
  2⤵
  PID:9672
- C:\Windows\System\dsZBLky.exe
  C:\Windows\System\dsZBLky.exe
  2⤵
  PID:9736
- C:\Windows\System\DSfLFqk.exe
  C:\Windows\System\DSfLFqk.exe
  2⤵
  PID:9804
- C:\Windows\System\ilgLVKt.exe
  C:\Windows\System\ilgLVKt.exe
  2⤵
  PID:9840
- C:\Windows\System\oDTXIQL.exe
  C:\Windows\System\oDTXIQL.exe
  2⤵
  PID:9960
- C:\Windows\System\ccNnGwQ.exe
  C:\Windows\System\ccNnGwQ.exe
  2⤵
  PID:9976
- C:\Windows\System\yZiquWU.exe
  C:\Windows\System\yZiquWU.exe
  2⤵
  PID:10024
- C:\Windows\System\AydBKYc.exe
  C:\Windows\System\AydBKYc.exe
  2⤵
  PID:10088
- C:\Windows\System\vUZoNDX.exe
  C:\Windows\System\vUZoNDX.exe
  2⤵
  PID:10152
- C:\Windows\System\Cfywnjb.exe
  C:\Windows\System\Cfywnjb.exe
  2⤵
  PID:10216
- C:\Windows\System\MvfVTFO.exe
  C:\Windows\System\MvfVTFO.exe
  2⤵
  PID:10132
- C:\Windows\System\ATBjprX.exe
  C:\Windows\System\ATBjprX.exe
  2⤵
  PID:9316
- C:\Windows\System\rGaBnEU.exe
  C:\Windows\System\rGaBnEU.exe
  2⤵
  PID:10104
- C:\Windows\System\xllZJpk.exe
  C:\Windows\System\xllZJpk.exe
  2⤵
  PID:10072
- C:\Windows\System\DLigOUU.exe
  C:\Windows\System\DLigOUU.exe
  2⤵
  PID:10196
- C:\Windows\System\noyYUWZ.exe
  C:\Windows\System\noyYUWZ.exe
  2⤵
  PID:9348
- C:\Windows\System\NStUycO.exe
  C:\Windows\System\NStUycO.exe
  2⤵
  PID:9412
- C:\Windows\System\TGwIYDJ.exe
  C:\Windows\System\TGwIYDJ.exe
  2⤵
  PID:9476
- C:\Windows\System\zTXvLVJ.exe
  C:\Windows\System\zTXvLVJ.exe
  2⤵
  PID:9544
- C:\Windows\System\JsJGvyI.exe
  C:\Windows\System\JsJGvyI.exe
  2⤵
  PID:9628
- C:\Windows\System\ObaMUOc.exe
  C:\Windows\System\ObaMUOc.exe
  2⤵
  PID:9828
- C:\Windows\System\kTsVbEL.exe
  C:\Windows\System\kTsVbEL.exe
  2⤵
  PID:9868
- C:\Windows\System\FEDWOMd.exe
  C:\Windows\System\FEDWOMd.exe
  2⤵
  PID:9908
- C:\Windows\System\rSeKhSP.exe
  C:\Windows\System\rSeKhSP.exe
  2⤵
  PID:9304
- C:\Windows\System\qbdPKCj.exe
  C:\Windows\System\qbdPKCj.exe
  2⤵
  PID:9560
- C:\Windows\System\ArDVWqh.exe
  C:\Windows\System\ArDVWqh.exe
  2⤵
  PID:9992
- C:\Windows\System\qheEtur.exe
  C:\Windows\System\qheEtur.exe
  2⤵
  PID:9952
- C:\Windows\System\PTampeW.exe
  C:\Windows\System\PTampeW.exe
  2⤵
  PID:10036
- C:\Windows\System\FjotExo.exe
  C:\Windows\System\FjotExo.exe
  2⤵
  PID:10168
- C:\Windows\System\ypvDymi.exe
  C:\Windows\System\ypvDymi.exe
  2⤵
  PID:9540
- C:\Windows\System\loUOjfB.exe
  C:\Windows\System\loUOjfB.exe
  2⤵
  PID:9904
- C:\Windows\System\GtxksvH.exe
  C:\Windows\System\GtxksvH.exe
  2⤵
  PID:9924
- C:\Windows\System\mkdSeQg.exe
  C:\Windows\System\mkdSeQg.exe
  2⤵
  PID:9772
- C:\Windows\System\ADZpLWE.exe
  C:\Windows\System\ADZpLWE.exe
  2⤵
  PID:10068
- C:\Windows\System\KXSJMIz.exe
  C:\Windows\System\KXSJMIz.exe
  2⤵
  PID:10252
- C:\Windows\System\gBIzshK.exe
  C:\Windows\System\gBIzshK.exe
  2⤵
  PID:10268
- C:\Windows\System\OgdbPsS.exe
  C:\Windows\System\OgdbPsS.exe
  2⤵
  PID:10284
- C:\Windows\System\DyVPPFB.exe
  C:\Windows\System\DyVPPFB.exe
  2⤵
  PID:10316
- C:\Windows\System\yiKDYGW.exe
  C:\Windows\System\yiKDYGW.exe
  2⤵
  PID:10332
- C:\Windows\System\mKOOAQj.exe
  C:\Windows\System\mKOOAQj.exe
  2⤵
  PID:10348
- C:\Windows\System\gDOLBHu.exe
  C:\Windows\System\gDOLBHu.exe
  2⤵
  PID:10364
- C:\Windows\System\OhUhDBD.exe
  C:\Windows\System\OhUhDBD.exe
  2⤵
  PID:10380
- C:\Windows\System\suoOrHx.exe
  C:\Windows\System\suoOrHx.exe
  2⤵
  PID:10396
- C:\Windows\System\jpuKlAf.exe
  C:\Windows\System\jpuKlAf.exe
  2⤵
  PID:10416
- C:\Windows\System\QUihMKf.exe
  C:\Windows\System\QUihMKf.exe
  2⤵
  PID:10432
- C:\Windows\System\oKHHZLy.exe
  C:\Windows\System\oKHHZLy.exe
  2⤵
  PID:10448
- C:\Windows\System\MjEbRta.exe
  C:\Windows\System\MjEbRta.exe
  2⤵
  PID:10464
- C:\Windows\System\kJGkHpS.exe
  C:\Windows\System\kJGkHpS.exe
  2⤵
  PID:10480
- C:\Windows\System\kcNQTmd.exe
  C:\Windows\System\kcNQTmd.exe
  2⤵
  PID:10496
- C:\Windows\System\SYbUfzF.exe
  C:\Windows\System\SYbUfzF.exe
  2⤵
  PID:10516
- C:\Windows\System\QvSRNeP.exe
  C:\Windows\System\QvSRNeP.exe
  2⤵
  PID:10532
- C:\Windows\System\wtvkeuu.exe
  C:\Windows\System\wtvkeuu.exe
  2⤵
  PID:10548
- C:\Windows\System\pjIjlQg.exe
  C:\Windows\System\pjIjlQg.exe
  2⤵
  PID:10564
- C:\Windows\System\TYOIxMk.exe
  C:\Windows\System\TYOIxMk.exe
  2⤵
  PID:10580
- C:\Windows\System\vvBrjWz.exe
  C:\Windows\System\vvBrjWz.exe
  2⤵
  PID:10596
- C:\Windows\System\jCwblDJ.exe
  C:\Windows\System\jCwblDJ.exe
  2⤵
  PID:10612
- C:\Windows\System\tfxcwaC.exe
  C:\Windows\System\tfxcwaC.exe
  2⤵
  PID:10628
- C:\Windows\System\GieHxkm.exe
  C:\Windows\System\GieHxkm.exe
  2⤵
  PID:10648
- C:\Windows\System\MJuGSlx.exe
  C:\Windows\System\MJuGSlx.exe
  2⤵
  PID:10664
- C:\Windows\System\MXNQnMp.exe
  C:\Windows\System\MXNQnMp.exe
  2⤵
  PID:10680
- C:\Windows\System\PFuYheP.exe
  C:\Windows\System\PFuYheP.exe
  2⤵
  PID:10700
- C:\Windows\System\HVcjAyG.exe
  C:\Windows\System\HVcjAyG.exe
  2⤵
  PID:10716

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BnxZucz.exe

Filesize
1.4MB

MD5
80b921458e52706928c9cc36544741ac

SHA1
703c15b22bf37c0a2b62d80d6601d9e5893aa462

SHA256
2398c91dd6665faabd7eba89e0f7c681228fba08fc1658a7cfd4e9d1b4c62045

SHA512
e1afd9d0e22f9be8ed05ed2303ef8d5257d72d0f92e0d5ae772a4db47af51121aca5e667af01515e6f5d141e0991a0146d3fb9c200aa6b218747de92cd1767b9

Download Submit
C:\Windows\system\DIgcSRP.exe

Filesize
1.4MB

MD5
2320127ee1a54b4b4373957e71907c30

SHA1
55b0b4a5a79949e3e60fa4abd3ab419001c0637d

SHA256
518393086e41c37ad8602100ac78bc62fcb47dee7c1855d6bc3f0a65f85ae850

SHA512
5b1a06fb5d35536b372437902a92c6e46c6adfb4dc5c50b63b727fdb44134f2a6f79f9429ea7d2cc12618778a072983a6d2abb716f52c75d120108ec60a8b2e1

Download Submit
C:\Windows\system\GezsFyT.exe

Filesize
1.4MB

MD5
d077e05c12a77d9dfb3520898c9c6754

SHA1
ca6ae1d90fb8d4063b42ebbc89bf985ce95b67c3

SHA256
037cdd9d37b174fb2a6e0b8985f62d8da5bea22def78fbbdf445938b77d47f7a

SHA512
2c8bbd8b436a6c582967b58d32f094ab29c2aa9be1cfd0bba5e0a8bc7e7f683fd61939d2800bab8ef56041e6f881d7d81762a2e26192015a9e5cf2f924259786

Download Submit
C:\Windows\system\GtcCowM.exe

Filesize
1.4MB

MD5
3702e0bd28d0f226a509e082c173ed79

SHA1
e0356b25e04e6ee29ed217956c569b47aea53a4a

SHA256
e912c013c9e19d237f70854a2ea942537342756249d0f0a8faeba16804a177a1

SHA512
163e4da43d82e93a06b39bab9e2c8d97f0794c438aaf5235dafd3cde7def08a9ffb8938a5b66455744b00d9e9ccad1a86fbe6b9b55bb96c3f8c05dacbdd56eb8

Download Submit
C:\Windows\system\HJzFFnd.exe

Filesize
1.4MB

MD5
8f4ad929bece8e823156e4e2d56f5bd7

SHA1
b82366c19102c1565b1cfd53815a8b06715182c3

SHA256
72e02ca53c3f22cf5937c1884e5776e233493a4073bdb3678f9609ec456959b7

SHA512
1856a7b8e0e82c79e7b9fb098dd4b7d1bf015e3a6e70fa62d58918e346f12a8fa105936f5b2a3fdc7c0934e043ae206ec6aadbb9196fd80406fda7154dc08d52

Download Submit
C:\Windows\system\LAfHJCQ.exe

Filesize
1.4MB

MD5
baa6d788beded63cbbcb02903b3bff16

SHA1
f8ca06fd96cb664ca3bca543b384ae73138570d5

SHA256
3335ee5b03874217460d88c74d8d4bb34e38ebb371a2a85e25bc84c81d1bfb3f

SHA512
55d34cca2dbf2998f8811a9d8aaddabb2731e1c9407a97bfaf09d03033572bb0f5f73211db678c43bc6fe6042970c89bc99fbe4b32b5419716bc2c57563346e1

Download Submit
C:\Windows\system\LezLVUK.exe

Filesize
1.4MB

MD5
b6fdf75eef134a867cafb17a936f378e

SHA1
c5a95671e4bc4891baae62af5e38ec7a48a9d9a9

SHA256
e3fb5fdcf0e77309194598a5f068d5957bb21f31f76af9d1f73b22ae7c57b0c7

SHA512
0273288550a02d532067fb4cf3f71a2b286bfe4fdc601660bc4a98f21bc6877db0dd57374fd5bb8462195794cd99392fe383aa3c18d014a0ebc88244ee79c859

Download Submit
C:\Windows\system\OgMQKMY.exe

Filesize
1.4MB

MD5
c8bf1ae60dc9f8ae27907f8f4a00e53c

SHA1
d197084c78d3ddcc6c431e7b4dd313170436cc9f

SHA256
3a9e8215518391044ed678d8416282c0603dc2a35f86237e7b661cfbc6e0916f

SHA512
c60b096fff4480a79db5d8087d9d4f81182b787781d00eae0cf50255af38d73114e083f346d9511707f8d53b2446661a23d89c3502d63bb3169e9b8ceb9522bc

Download Submit
C:\Windows\system\PfHpJBq.exe

Filesize
1.4MB

MD5
f257f0372c0873f61f2b5e405d5861de

SHA1
d37426f5730a7b0b9bbe25864038e0dece64f50b

SHA256
8b6aa696c7783572960fa7cf00222f9d67e5ca1f4f358866d5dccc3508d2af7c

SHA512
9d5633f5c61008a3f5173b334be539ff8abc8d424b3f480d2de9f3a7cc4a896af32f6d7fc46cbfb033feb3e9138f56ada58aec81adefe3b143ece7f0efe08ef8

Download Submit
C:\Windows\system\TjPPbeE.exe

Filesize
1.4MB

MD5
a1c7c9bdf367d2a2ade30622f89ea1f4

SHA1
05db8e8c1192f5bbaa06eea69393bef461c56821

SHA256
1fd112212c6e5aa90989a2ce98d6667727ba51ab079edafbf62c38ea3d56aacd

SHA512
feeb87f48a294a3fb817b33a0cafc504ebe36abfc98754ff60196313b733b9171767373e1d263240355b841967a02749340128598f75606ea8738ae116145ec7

Download Submit
C:\Windows\system\ZYsneWv.exe

Filesize
1.4MB

MD5
8bacb334a981b02689617417e72f772b

SHA1
0b98fca2c08c6ac42161fa5f413db1974869386f

SHA256
6bf5fc091915a9c0a8f2000c9c01b70a619d94fca8d5c4ee8c630cb6d98fcf55

SHA512
1d7e2cbb871914a5162d16634aa45ce3675419a087cc4d3b5e85773e4923c21ffcf6a26914359d6781f087ea5d569ce2a3fc78bc213e0bba5466a5fc33745cb5

Download Submit
C:\Windows\system\acdOOse.exe

Filesize
1.4MB

MD5
3646d95a534d0404cc694ad0c09b485a

SHA1
96c4739e2546bab105c150132067fbdda4051462

SHA256
8b3b7dc65facb21b9e3877cd82b78728e81be9f3d0df92031885f4d729fb80e1

SHA512
f4bcfc87dcf8f3d4076c70e9cbc79136714d96f91e3e4d357eeb5f7f961cafc838ef3a9bbec174b88be2fa37b69ca2d755ffb5a984b26faa6b81e8e36c8953e9

Download Submit
C:\Windows\system\bIjfpll.exe

Filesize
1.4MB

MD5
b4943f865663a36ea2319d140d764a30

SHA1
12115a771d1a495d4804ad3b1368f116e77cd04f

SHA256
4e8f0cc5c98027bcabac12022d12a49925f66dae05478c13a183113aa0ca6ffd

SHA512
b0d63e3f3f6a15da481a52dcaee4d711551493279e09a27ce83238a04beec130faab2b146f59069cd1e1b4db8ed30617d2f87dd4d71568040edb588dae76b79b

Download Submit
C:\Windows\system\beGWrlx.exe

Filesize
1.4MB

MD5
08d1093eef45aaf73ed8e37217571171

SHA1
a577a4e1d33380bb586ec751ad180b977382cac6

SHA256
3232e24ed921739279729697be22846c0e54d1dc2feb6ac14e5e305615db1afa

SHA512
393b562cda825b71b57d7c99b979cca9fb798ed173ee512c0e0ea88c1f71f74ebbf826495c62c5454c7c17174f76487d3dce4ddde1ccc10bf3b376094b2f5afd

Download Submit
C:\Windows\system\dTaAeAP.exe

Filesize
1.4MB

MD5
5554e97c59a019ad93801ac53801de65

SHA1
05002a47c918907ad53530313c88d86335e2ee44

SHA256
819a409b2170b37b5ec0c740fc252689e610a3152325bee40fb778eb3965901c

SHA512
b95c483bb135cf31d2ba7097b1a700f4cfd02efb38d52feedf5ff446209600919f7ae4582e44e764fe01f5a1a592efe8a74364a4b4dfc9a5cfd01353128a749e

Download Submit
C:\Windows\system\eQLozJq.exe

Filesize
1.4MB

MD5
27a42a003a39fad13b0949d29764b3ca

SHA1
92d251e32362822d314fcb7353783fa0c9e9985e

SHA256
4ebb458ab3e21bae9a7f39c673fef6e191de06c1319805d9b7e39787e035709b

SHA512
dbc0326d10bd494ca67473db51c391f073ffe740375a5019dff9c6f1d7a865f0891b25c9565829a221d336147bab11bb0b672e4dc60338e8ae8332e0b81dc22e

Download Submit
C:\Windows\system\ezhjFya.exe

Filesize
1.4MB

MD5
3cbe642ebf1d721cf32b559a839e5b2b

SHA1
41b7e9724cb05ec02bc2ae034a841d3007741ffc

SHA256
bb04fdbddd650c35837c631ef33a314b397da88711cabc21b0acd66a92f1d2a5

SHA512
dec880997ec84609e8042655f2e6c65a91a96690e0c38b69af4ca6f846a63a39956af28db9a6b8c992b31197dc1459a61d596850d404f76a0711e5b479733a23

Download Submit
C:\Windows\system\gMrcVQw.exe

Filesize
1.4MB

MD5
d03ad8dea6403ed0f7b792fcf15aec53

SHA1
bdcfe01de55a81fbf10790db68e0d180a5d5310c

SHA256
d2220d993546d39f4157e2c66140ff1a7fb1645170841c0fbcdb6f6bd63f5e05

SHA512
5d6937e84f979e8dda543d2af40f78440b55f83627141e46be91377f7e09469991ade5ebe034d37be61afae068f5bcfb3adf77572bdc56b07ba02fbdd4067ec4

Download Submit
C:\Windows\system\hLFBxJf.exe

Filesize
1.4MB

MD5
b2a36ff25ba13ddc449602f9c1015b96

SHA1
d73a0d20eb5d48e52f36d6479eedae4365955e0d

SHA256
d5c871d2f41f54fc6b0810f25a29973e2fdfe490e90af3dcbebe7f05d0679e4e

SHA512
56768dc993579284fb23f7d856963ebe6889f0585b8a869d9b34fd8278d49994ad6508666076f1238c02ec762b82c520a28a334c75ebb4fa36f8d6670e6e55ec

Download Submit
C:\Windows\system\jSkZPUV.exe

Filesize
1.4MB

MD5
d48c6ecf53095f6d7e1178ff77493611

SHA1
7c05b4b5872fc5fb11bd0c34d728bef00d2aa088

SHA256
19ca770a94d6b3b4932a17da3f70ae94f9f08d97db99d08c2717f9200f0beb2b

SHA512
850f2a26bebea3c185255889d78e0ce4de42c574338bdfb5845b4d08ff3470d39cf6c307a2f43ce5a89fd886a226148e5ce71a21064ad51d04a891a4dd059acf

Download Submit
C:\Windows\system\mbEZiUC.exe

Filesize
1.4MB

MD5
de8909e81e0b1d574136bb0d1b9bb913

SHA1
e4419b06b8d8740782bfef8d7c17d270603bec7c

SHA256
bfe73220bae17d84115efc9c854c55b13747153d0303f15a2c190e5aac42caa8

SHA512
9c8b960edf8a5d642f02152009bd1584a18599726a22dbd265b267b4e89bc129ec6936f45a7320076c50d935e4cbdaa4b531603cd429836a6aff92dfed6db0ae

Download Submit
C:\Windows\system\mqwovmR.exe

Filesize
1.4MB

MD5
d829bb4cc348f28728f576f41008e78f

SHA1
2e8b903eb622071f8f0fd73a99f6dd4e6be90ce1

SHA256
72631d5ed49f3a54ae97140d08de660d877af2538af28b195a57a18d3a2af5af

SHA512
af1bb99347b8ac3aaba74cbad691a978c6eb40fe01710435b40df8fdc8eef3b52c96bb13435cef310b94455b51ba0abc6fde5c9486bd13f1868dfdc8e7b4e837

Download Submit
C:\Windows\system\nkGaKYx.exe

Filesize
1.4MB

MD5
ea60bec44f5000aee91f8420556e095e

SHA1
21ff7bcb26643be8f552719b34b576282ca17cc6

SHA256
c69cab75c00e980d73e3281a5aa16228afe61d90f2341eac1efe8075f42654dc

SHA512
9e146593c83ba335f63bec6b1b056bbd458003ee14eceaca90dd841bf913416e25fe33e03a4c6e06a515d3e76c6366509af8b59238da40520edeb4728a88ecb3

Download Submit
C:\Windows\system\qflaYiR.exe

Filesize
1.4MB

MD5
f30c3c627e63e77d0bee6cd28ff01a09

SHA1
1dcb70045e2151684f62b02523e9a0899949f34e

SHA256
158a9d17d288345070288bebef270a54e239482f1f31d4ed40ceb4d9d78be26c

SHA512
9f18c2c6fa0b059ee0d538e8e3192f3131e81467c0a98e86e936da261d00beff338ef4478f235007a93e1780347a9257889c1e20c4a6ea7ca5b6489ada92f5b0

Download Submit
C:\Windows\system\vBwvvDr.exe

Filesize
1.4MB

MD5
98e29426d108f2c6d0947503a591b6f0

SHA1
e54da1d7db44239024698269139835059b7c6ef9

SHA256
d09739211111cf566bd8fadbb40b30169c0a7b17084d9d7a15f5586172c923f6

SHA512
0b9057c36b7ba369f4f14a9d2a96b1bce735c6d3503707fe579f80698fcabda9dac6a78a14f08d219818dbdae181ff7d922880b3bd8aff8ee333a08294737b81

Download Submit
C:\Windows\system\wLGPXnL.exe

Filesize
1.4MB

MD5
0d64bce13598ef6d2344a5583ec34201

SHA1
7e9d50f61ae9e726c9559e5b11915bb9358007f2

SHA256
548072619a46dcbe1e840d5933e60679688d49d2454706e449efda619ee33204

SHA512
c03d78f410627bc2d049d9bc6142323b935a52080850bad6535a098e11536c0acfb315aed241f241825282fdcf9760c0443eabaa0e6088e5e08d5cdc0b2af0e4

Download Submit
\Windows\system\HOKauoj.exe

Filesize
1.4MB

MD5
9bb67cdb3a169391497b78bb02e0b2bf

SHA1
90c839f368e1de33124b5d292cf004317f6cb933

SHA256
e7c9e91f6bc0e2c7b49e89358539add7b706dd0b7a0af3f40e2ac9b042c60806

SHA512
0371b6d45e183d774e9116eb5b4ad3a02c923234485db716f754f883a34d37488de27869d2f5687e4fb44868be635eb30a1c5a54f9834685889992b744b29bb0

Download Submit
\Windows\system\QWeUBQk.exe

Filesize
1.4MB

MD5
e2a7525b6dded50d1c58d84adca09e20

SHA1
1597a939181f1b21f700c7822f3f4dd44e2d6d9f

SHA256
6ed8816079113558a96ce42de2e9184b5348e74fef0aced25c2bc63d072c65d8

SHA512
8a0e4e35dace0bfb02917941a726853b82439d786489a11166069b0bf5c7074b4cee03c0536586a5980158d0341729e3600bfd9384b1f7dc221f0f41063f3dac

Download Submit
\Windows\system\SJkDphy.exe

Filesize
1.4MB

MD5
c91cefef70f8196c9d2f564629bf9492

SHA1
4554ae6bfd1bda146d25a4517c7a1a36965d588a

SHA256
dcf5f1c96a30cb8c276ee28fb3e253a544302933083ab58c994d12d32da82762

SHA512
d09e038053b4032c557c764f2c71b688a25f551603075d0b004965dc212be4d97a2fa1b3e0d996d906e597b79b21820a453633dd73b94570a6d43de8acb0b676

Download Submit
\Windows\system\ackGzNS.exe

Filesize
1.4MB

MD5
86652c64dfa8d8bcd0a58aa81b71e32a

SHA1
f90a3f329523c9ef9051bbb7fa50f4f28c812c16

SHA256
8fd9294401e3551d74582caaf6ae8af3689cce91fe13d146ead4337089e3273b

SHA512
0562974fcad7c652735559f5549db3f842529c0312d39365fc8687229c3b1418f3e2389b1dfccd4de9e04c64ab93fd2c2b9feec589a2252be58ee99707374cd5

Download Submit
\Windows\system\bkeuQzP.exe

Filesize
1.4MB

MD5
246e0f01ba69a83362428bccaccb33e8

SHA1
cc153553a517602e48ac794cc508600a90878785

SHA256
0e86d3d5c337b48816842db7aacd34f892e867fb1b47cb762343ef1ba5c85b99

SHA512
f6a7da9b3fa7929bf38415c0c851464be8a3f19d6d51db3ad4195ac324ef2111f2e0c653649470607de72ae67a0cc552fbb9510b63652dae6c0972b5a8228059

Download Submit
\Windows\system\dYabVcL.exe

Filesize
1.4MB

MD5
d93e3162dafe90b79eafe014dd301f45

SHA1
608f6876a2006c59a028f1c4bcf88cd3b7cb8f58

SHA256
16abf56826959e827dc438f5c55c590ec3332d5f8ed0b94e148cc0bc0a325cff

SHA512
cd1e8b857faaeb6857cdaf769f3d047457f9f756aa7c9443e719e5776ff8a1079c5aca6bf2bce6be77ea3c7acd63ad2ac64055db482ca88abf42adaa80948111

Download Submit
\Windows\system\iSFlLtD.exe

Filesize
1.4MB

MD5
13d11945d31fcc09b2686bbcf6c922d9

SHA1
8c895addaea02fd3899b26ce15ccb6b60d81d582

SHA256
434d002ea07a77757d5d952f942694f5ab3eda9cadb5e556a871210e7f4a32c8

SHA512
caa3f86aadfd4c173c77585ccb5146770b84431058b6f41b7dde5976b93ea5b1cd5876f09645ab7c321ee42f66f0505a6f9ba43bcaf26f75a3c7b6308eb1e9e9

Download Submit
\Windows\system\opWaIxL.exe

Filesize
1.4MB

MD5
da8958c16e86a86203c8a40776aac19d

SHA1
83f201a91f89aa62fe2f93f6bc32bfdb53ffb255

SHA256
11741d8d2e5d228a080c188ae5e330897954f6c652bdc75db8db143a19844aca

SHA512
fab5c4da8f44f49ba7d65fac0529f14fa7252c7cf6fa14ff81383005fa68205a575fcef979c1f683f80e85f069b2e00e05ef7204390681b2b4457188e6a82571

Download Submit
\Windows\system\xuDoXcJ.exe

Filesize
1.4MB

MD5
2f57aafd4afed30a294a727d094262d6

SHA1
00572450a6574725c27e4ad7c451161547804217

SHA256
76f4574d83b886277319664ed3572f5063aec354d7dd773d7a501949ce3c171f

SHA512
09116f69f2d4bb3b59e21d9b5158d30da1debd691f50d8392a8bf011c841c0d7781aecc3879bc1a761378cc38c2ff1d2bcfdfc1dc24ca4e4546830ccee20c6d9

Download Submit
memory/1256-77-0x000000013F1C0000-0x000000013F5B2000-memory.dmp

Filesize
3.9MB

Download
memory/1700-56-0x0000000002860000-0x0000000002868000-memory.dmp

Filesize
32KB

Download
memory/1700-40-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/1720-1153-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/1720-44-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2176-62-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2176-53-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2176-86-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2176-0-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2176-60-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2176-58-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2176-50-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1152-0x000000013F530000-0x000000013F922000-memory.dmp

Filesize
3.9MB

Download
memory/2176-55-0x0000000002F30000-0x0000000003322000-memory.dmp

Filesize
3.9MB

Download
memory/2176-7-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2176-75-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2176-99-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download
memory/2176-73-0x0000000003190000-0x0000000003582000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2176-63-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2460-64-0x000000013F200000-0x000000013F5F2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-45-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2576-61-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2588-57-0x000000013F4F0000-0x000000013F8E2000-memory.dmp

Filesize
3.9MB

Download
memory/2620-51-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2648-54-0x000000013FA20000-0x000000013FE12000-memory.dmp

Filesize
3.9MB

Download
memory/2844-90-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2860-59-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2956-74-0x000000013F600000-0x000000013F9F2000-memory.dmp

Filesize
3.9MB

Download