xmrig | 9671cfa8131301234941c9f9018af16d3e934e50259df68254f934e5bc4f2f3a

Analysis

max time kernel
34s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
Size

1.8MB
MD5

049fe27e91ac667a315e9d07eb964d9b
SHA1

90d82739bbeef7d32412a6416ca2a48ccce8b747
SHA256

9671cfa8131301234941c9f9018af16d3e934e50259df68254f934e5bc4f2f3a
SHA512

56e231793ced760319629ba7f682408dd64db6a82c096918f2c1d15aa5c4d86030134ce843782d219fb864ee785a360b6704dbda4922c480d4fe427a4ace20cc
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrl8z:NABV

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2528-77-0x000000013FE50000-0x0000000140242000-memory.dmp	xmrig
behavioral1/memory/1784-129-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	xmrig
behavioral1/memory/2468-127-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/1964-125-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2768-123-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2620-121-0x000000013F690000-0x000000013FA82000-memory.dmp	xmrig
behavioral1/memory/2552-117-0x000000013F300000-0x000000013F6F2000-memory.dmp	xmrig
behavioral1/memory/2576-112-0x000000013FC90000-0x0000000140082000-memory.dmp	xmrig
behavioral1/memory/2672-92-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1784	TpjEpjv.exe
2528	gjDluUC.exe
2672	HJUavMq.exe
2576	HVsKgWG.exe
2552	MXYkNsQ.exe
2620	WOLGWzI.exe
2768	EVewdEI.exe
1964	WaNyCOA.exe
2468	oWUkwvg.exe
2424	SomNwuP.exe
2472	iomrWZc.exe
1192	pmYSHKH.exe
2520	iVFVvXj.exe
1776	pObYFtD.exe
1804	AUqQxSN.exe
1580	acbTLug.exe
2292	FubAhar.exe
1380	KFEBamY.exe
2936	nsnqAag.exe
3036	etSTxsF.exe
476	rBfMMlb.exe
2408	DoWKSal.exe
376	gLgzxAY.exe
2604	RNZqfUg.exe
2252	sDdDbei.exe
1980	UoFTJRg.exe
1532	cDKKWoS.exe
1848	ArtjmLO.exe
952	eTBZPad.exe
2396	DBHGcUJ.exe
836	PBhHWru.exe
2092	nKkggMQ.exe
1256	YwYhRXA.exe
2744	DnIERtH.exe
1504	hRHYhuL.exe
2108	OMcTZpd.exe
1844	DKGcXtR.exe
2236	ZYFTvCW.exe
1384	TbBPLxO.exe
1760	uIMSHGL.exe
804	ZIWJURO.exe
1072	JNkXPXv.exe
2152	fmaRqiU.exe
2224	NMSlBVn.exe
1496	JfNzpHT.exe
1736	kcrinhu.exe
2952	BJjYUWQ.exe
1564	rUwRRLW.exe
2820	vkehMEx.exe
992	woKocWK.exe
1276	sUIhDrL.exe
1796	xfPCXRW.exe
2816	eLbvonf.exe
2700	HdTLuNy.exe
2696	ZeWnXyn.exe
2760	tnKBjIs.exe
2420	zMwriSo.exe
2892	qsfJZQt.exe
1644	CFKTCLd.exe
2436	kJYdbHU.exe
2720	oaCcDGs.exe
2976	sgnSflA.exe
2148	kMipMDA.exe
2948	mvJNQHK.exe

Loads dropped DLL 64 IoCs

pid	Process
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe

UPX packed file 47 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2956-0-0x000000013F890000-0x000000013FC82000-memory.dmp	upx
behavioral1/files/0x000a000000015cb6-3.dat	upx
behavioral1/files/0x0035000000015d42-16.dat	upx
behavioral1/files/0x000e0000000054ab-21.dat	upx
behavioral1/files/0x0008000000015d7f-25.dat	upx
behavioral1/files/0x0007000000015d87-29.dat	upx
behavioral1/files/0x0008000000015ecc-42.dat	upx
behavioral1/files/0x0006000000016cdc-46.dat	upx
behavioral1/memory/2528-77-0x000000013FE50000-0x0000000140242000-memory.dmp	upx
behavioral1/files/0x0031000000018649-166.dat	upx
behavioral1/files/0x0015000000018644-163.dat	upx
behavioral1/files/0x000500000001876a-192.dat	upx
behavioral1/files/0x00050000000186fa-183.dat	upx
behavioral1/files/0x0005000000018665-173.dat	upx
behavioral1/files/0x00060000000173d0-152.dat	upx
behavioral1/files/0x000600000001708b-144.dat	upx
behavioral1/files/0x0006000000016dbe-137.dat	upx
behavioral1/files/0x0006000000016d20-131.dat	upx
behavioral1/memory/1784-129-0x000000013F8C0000-0x000000013FCB2000-memory.dmp	upx
behavioral1/memory/2468-127-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/1964-125-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/memory/2768-123-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/memory/2620-121-0x000000013F690000-0x000000013FA82000-memory.dmp	upx
behavioral1/memory/2552-117-0x000000013F300000-0x000000013F6F2000-memory.dmp	upx
behavioral1/files/0x0006000000016da5-115.dat	upx
behavioral1/files/0x0006000000016d8e-114.dat	upx
behavioral1/memory/2576-112-0x000000013FC90000-0x0000000140082000-memory.dmp	upx
behavioral1/files/0x0006000000016db1-109.dat	upx
behavioral1/files/0x0006000000016d9d-101.dat	upx
behavioral1/files/0x000500000001876e-195.dat	upx
behavioral1/files/0x000500000001875a-189.dat	upx
behavioral1/files/0x0006000000016d5f-95.dat	upx
behavioral1/files/0x0006000000016d3e-94.dat	upx
behavioral1/files/0x0006000000016d74-181.dat	upx
behavioral1/files/0x00050000000186f6-178.dat	upx
behavioral1/memory/2672-92-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/files/0x0006000000016d43-171.dat	upx
behavioral1/files/0x0006000000016d3a-161.dat	upx
behavioral1/files/0x0006000000016d34-76.dat	upx
behavioral1/files/0x0006000000017437-159.dat	upx
behavioral1/files/0x00060000000171df-150.dat	upx
behavioral1/files/0x000600000001704a-142.dat	upx
behavioral1/files/0x0006000000016db9-134.dat	upx
behavioral1/files/0x0006000000016d18-54.dat	upx
behavioral1/files/0x0006000000016d07-50.dat	upx
behavioral1/files/0x0007000000015e32-39.dat	upx
behavioral1/files/0x0007000000015d93-34.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XEVvHhk.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\JNkXPXv.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\rUwRRLW.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\bsTGdbN.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\sXhxSDo.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\aSggyUV.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\PStTgON.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\ESXrTeg.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\XUzTmQT.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\wHBPEAw.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\SmuEVFK.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\sgnSflA.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\RLEqajx.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\gNiVDMu.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\PtcJiyL.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\MHhwZIX.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\CFKTCLd.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\BuowjIR.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\sIazElZ.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\uqExRFw.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\yzdFmdv.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\vWeNjzK.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\klWdOPp.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\qDIdSCr.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\taKRPqh.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\ZDLlhtx.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\OUepiGL.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\slaxucU.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\yaOUKur.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\SfytNcE.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\UDQnpXM.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\IvYnpPC.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\UxbsJQs.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\YBzEafn.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\rzmcJbW.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\ZFxXghg.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\biihrFk.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\OqEGIwS.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\eyORiNU.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\iGQGyPe.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\EBSCFca.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\LHtrdeu.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\oTeMpmL.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\CdmsWSn.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\UoFTJRg.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\ABegMbL.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\uJlvuDB.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\reTWurc.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\XgtPnWB.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\nQqlGrc.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\iyZxNbx.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\qfCPhSo.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\EVaqNKm.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\NMAVYdU.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\gbFNCXZ.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\ArtjmLO.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\NWHGwtg.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\QctGUsY.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\YBhEWRr.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\lXGBMId.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\uBKhlkG.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\QbLZYhz.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\oltxQBn.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
File created	C:\Windows\System\iSLqxcc.exe	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3040	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
Token: SeDebugPrivilege	3040	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 3040	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3040	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	29
PID 2956 wrote to memory of 3040	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	29
PID 2956 wrote to memory of 1784	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	30
PID 2956 wrote to memory of 1784	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	30
PID 2956 wrote to memory of 1784	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	30
PID 2956 wrote to memory of 2528	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2528	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2528	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	31
PID 2956 wrote to memory of 2672	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2672	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2672	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	32
PID 2956 wrote to memory of 2576	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2576	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2576	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	33
PID 2956 wrote to memory of 2552	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2552	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2552	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	34
PID 2956 wrote to memory of 2620	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2620	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2620	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	35
PID 2956 wrote to memory of 2768	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2768	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	36
PID 2956 wrote to memory of 2768	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	36
PID 2956 wrote to memory of 1964	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	37
PID 2956 wrote to memory of 1964	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	37
PID 2956 wrote to memory of 1964	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	37
PID 2956 wrote to memory of 2468	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2468	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2468	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	38
PID 2956 wrote to memory of 2424	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2424	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2424	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	39
PID 2956 wrote to memory of 2472	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2472	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2472	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	40
PID 2956 wrote to memory of 2292	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2292	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	41
PID 2956 wrote to memory of 2292	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	41
PID 2956 wrote to memory of 1192	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	42
PID 2956 wrote to memory of 1192	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	42
PID 2956 wrote to memory of 1192	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	42
PID 2956 wrote to memory of 2408	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2408	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2408	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	43
PID 2956 wrote to memory of 2520	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	44
PID 2956 wrote to memory of 2520	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	44
PID 2956 wrote to memory of 2520	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	44
PID 2956 wrote to memory of 2604	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	45
PID 2956 wrote to memory of 2604	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	45
PID 2956 wrote to memory of 2604	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	45
PID 2956 wrote to memory of 1776	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1776	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1776	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	46
PID 2956 wrote to memory of 1980	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1980	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1980	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	47
PID 2956 wrote to memory of 1804	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1804	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1804	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	48
PID 2956 wrote to memory of 1848	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1848	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1848	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	49
PID 2956 wrote to memory of 1580	2956	049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\049fe27e91ac667a315e9d07eb964d9b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3040
- C:\Windows\System\TpjEpjv.exe
  C:\Windows\System\TpjEpjv.exe
  2⤵
  - Executes dropped EXE
  PID:1784
- C:\Windows\System\gjDluUC.exe
  C:\Windows\System\gjDluUC.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\HJUavMq.exe
  C:\Windows\System\HJUavMq.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\HVsKgWG.exe
  C:\Windows\System\HVsKgWG.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\MXYkNsQ.exe
  C:\Windows\System\MXYkNsQ.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\WOLGWzI.exe
  C:\Windows\System\WOLGWzI.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\EVewdEI.exe
  C:\Windows\System\EVewdEI.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\WaNyCOA.exe
  C:\Windows\System\WaNyCOA.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\oWUkwvg.exe
  C:\Windows\System\oWUkwvg.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\SomNwuP.exe
  C:\Windows\System\SomNwuP.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\iomrWZc.exe
  C:\Windows\System\iomrWZc.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\FubAhar.exe
  C:\Windows\System\FubAhar.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\pmYSHKH.exe
  C:\Windows\System\pmYSHKH.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\DoWKSal.exe
  C:\Windows\System\DoWKSal.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\iVFVvXj.exe
  C:\Windows\System\iVFVvXj.exe
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Windows\System\RNZqfUg.exe
  C:\Windows\System\RNZqfUg.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\pObYFtD.exe
  C:\Windows\System\pObYFtD.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\UoFTJRg.exe
  C:\Windows\System\UoFTJRg.exe
  2⤵
  - Executes dropped EXE
  PID:1980
- C:\Windows\System\AUqQxSN.exe
  C:\Windows\System\AUqQxSN.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\ArtjmLO.exe
  C:\Windows\System\ArtjmLO.exe
  2⤵
  - Executes dropped EXE
  PID:1848
- C:\Windows\System\acbTLug.exe
  C:\Windows\System\acbTLug.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\DBHGcUJ.exe
  C:\Windows\System\DBHGcUJ.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\KFEBamY.exe
  C:\Windows\System\KFEBamY.exe
  2⤵
  - Executes dropped EXE
  PID:1380
- C:\Windows\System\YwYhRXA.exe
  C:\Windows\System\YwYhRXA.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\nsnqAag.exe
  C:\Windows\System\nsnqAag.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\DnIERtH.exe
  C:\Windows\System\DnIERtH.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\etSTxsF.exe
  C:\Windows\System\etSTxsF.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\OMcTZpd.exe
  C:\Windows\System\OMcTZpd.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\rBfMMlb.exe
  C:\Windows\System\rBfMMlb.exe
  2⤵
  - Executes dropped EXE
  PID:476
- C:\Windows\System\DKGcXtR.exe
  C:\Windows\System\DKGcXtR.exe
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\System\gLgzxAY.exe
  C:\Windows\System\gLgzxAY.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\ZYFTvCW.exe
  C:\Windows\System\ZYFTvCW.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\sDdDbei.exe
  C:\Windows\System\sDdDbei.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\TbBPLxO.exe
  C:\Windows\System\TbBPLxO.exe
  2⤵
  - Executes dropped EXE
  PID:1384
- C:\Windows\System\cDKKWoS.exe
  C:\Windows\System\cDKKWoS.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\uIMSHGL.exe
  C:\Windows\System\uIMSHGL.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\eTBZPad.exe
  C:\Windows\System\eTBZPad.exe
  2⤵
  - Executes dropped EXE
  PID:952
- C:\Windows\System\ZIWJURO.exe
  C:\Windows\System\ZIWJURO.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\PBhHWru.exe
  C:\Windows\System\PBhHWru.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\JNkXPXv.exe
  C:\Windows\System\JNkXPXv.exe
  2⤵
  - Executes dropped EXE
  PID:1072
- C:\Windows\System\nKkggMQ.exe
  C:\Windows\System\nKkggMQ.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\fmaRqiU.exe
  C:\Windows\System\fmaRqiU.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\hRHYhuL.exe
  C:\Windows\System\hRHYhuL.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\NMSlBVn.exe
  C:\Windows\System\NMSlBVn.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\JfNzpHT.exe
  C:\Windows\System\JfNzpHT.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\kcrinhu.exe
  C:\Windows\System\kcrinhu.exe
  2⤵
  - Executes dropped EXE
  PID:1736
- C:\Windows\System\BJjYUWQ.exe
  C:\Windows\System\BJjYUWQ.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\rUwRRLW.exe
  C:\Windows\System\rUwRRLW.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\vkehMEx.exe
  C:\Windows\System\vkehMEx.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\woKocWK.exe
  C:\Windows\System\woKocWK.exe
  2⤵
  - Executes dropped EXE
  PID:992
- C:\Windows\System\sUIhDrL.exe
  C:\Windows\System\sUIhDrL.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\xfPCXRW.exe
  C:\Windows\System\xfPCXRW.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\eLbvonf.exe
  C:\Windows\System\eLbvonf.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\HdTLuNy.exe
  C:\Windows\System\HdTLuNy.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\ZeWnXyn.exe
  C:\Windows\System\ZeWnXyn.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\tnKBjIs.exe
  C:\Windows\System\tnKBjIs.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\zMwriSo.exe
  C:\Windows\System\zMwriSo.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\qsfJZQt.exe
  C:\Windows\System\qsfJZQt.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\CFKTCLd.exe
  C:\Windows\System\CFKTCLd.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\kJYdbHU.exe
  C:\Windows\System\kJYdbHU.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\oaCcDGs.exe
  C:\Windows\System\oaCcDGs.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\sgnSflA.exe
  C:\Windows\System\sgnSflA.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\kMipMDA.exe
  C:\Windows\System\kMipMDA.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\mvJNQHK.exe
  C:\Windows\System\mvJNQHK.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\IEyDMmX.exe
  C:\Windows\System\IEyDMmX.exe
  2⤵
  PID:2572
- C:\Windows\System\BdaIhyt.exe
  C:\Windows\System\BdaIhyt.exe
  2⤵
  PID:1928
- C:\Windows\System\VUymtNB.exe
  C:\Windows\System\VUymtNB.exe
  2⤵
  PID:1856
- C:\Windows\System\kebrtXq.exe
  C:\Windows\System\kebrtXq.exe
  2⤵
  PID:2656
- C:\Windows\System\CbbuQff.exe
  C:\Windows\System\CbbuQff.exe
  2⤵
  PID:1788
- C:\Windows\System\WyXZAAn.exe
  C:\Windows\System\WyXZAAn.exe
  2⤵
  PID:2476
- C:\Windows\System\FaxriWB.exe
  C:\Windows\System\FaxriWB.exe
  2⤵
  PID:2168
- C:\Windows\System\aQkyOWS.exe
  C:\Windows\System\aQkyOWS.exe
  2⤵
  PID:2920
- C:\Windows\System\RuCjIrs.exe
  C:\Windows\System\RuCjIrs.exe
  2⤵
  PID:3064
- C:\Windows\System\RfWKIcJ.exe
  C:\Windows\System\RfWKIcJ.exe
  2⤵
  PID:2352
- C:\Windows\System\GPFZPeA.exe
  C:\Windows\System\GPFZPeA.exe
  2⤵
  PID:2032
- C:\Windows\System\EkKawcq.exe
  C:\Windows\System\EkKawcq.exe
  2⤵
  PID:2536
- C:\Windows\System\oyMwvNy.exe
  C:\Windows\System\oyMwvNy.exe
  2⤵
  PID:1608
- C:\Windows\System\GVYAoXr.exe
  C:\Windows\System\GVYAoXr.exe
  2⤵
  PID:656
- C:\Windows\System\JiZPvAO.exe
  C:\Windows\System\JiZPvAO.exe
  2⤵
  PID:1236
- C:\Windows\System\NFQpYil.exe
  C:\Windows\System\NFQpYil.exe
  2⤵
  PID:644
- C:\Windows\System\lspdoPT.exe
  C:\Windows\System\lspdoPT.exe
  2⤵
  PID:2456
- C:\Windows\System\yJQGdVI.exe
  C:\Windows\System\yJQGdVI.exe
  2⤵
  PID:2864
- C:\Windows\System\tHiLXqm.exe
  C:\Windows\System\tHiLXqm.exe
  2⤵
  PID:2272
- C:\Windows\System\zuVhBSc.exe
  C:\Windows\System\zuVhBSc.exe
  2⤵
  PID:1244
- C:\Windows\System\XZcIKSK.exe
  C:\Windows\System\XZcIKSK.exe
  2⤵
  PID:628
- C:\Windows\System\bKPTuTf.exe
  C:\Windows\System\bKPTuTf.exe
  2⤵
  PID:2832
- C:\Windows\System\snHIBEN.exe
  C:\Windows\System\snHIBEN.exe
  2⤵
  PID:1364
- C:\Windows\System\gdSxCQa.exe
  C:\Windows\System\gdSxCQa.exe
  2⤵
  PID:1292
- C:\Windows\System\dCFNaXh.exe
  C:\Windows\System\dCFNaXh.exe
  2⤵
  PID:1768
- C:\Windows\System\vukqfyu.exe
  C:\Windows\System\vukqfyu.exe
  2⤵
  PID:2544
- C:\Windows\System\rMqvYrN.exe
  C:\Windows\System\rMqvYrN.exe
  2⤵
  PID:984
- C:\Windows\System\inXppPw.exe
  C:\Windows\System\inXppPw.exe
  2⤵
  PID:2040
- C:\Windows\System\aIOTBJi.exe
  C:\Windows\System\aIOTBJi.exe
  2⤵
  PID:1596
- C:\Windows\System\HpYVyVt.exe
  C:\Windows\System\HpYVyVt.exe
  2⤵
  PID:2172
- C:\Windows\System\cRaoGMn.exe
  C:\Windows\System\cRaoGMn.exe
  2⤵
  PID:2712
- C:\Windows\System\AbDaQIl.exe
  C:\Windows\System\AbDaQIl.exe
  2⤵
  PID:2812
- C:\Windows\System\WolMVlL.exe
  C:\Windows\System\WolMVlL.exe
  2⤵
  PID:2972
- C:\Windows\System\nQqlGrc.exe
  C:\Windows\System\nQqlGrc.exe
  2⤵
  PID:2452
- C:\Windows\System\pqEOdSj.exe
  C:\Windows\System\pqEOdSj.exe
  2⤵
  PID:2112
- C:\Windows\System\RLEqajx.exe
  C:\Windows\System\RLEqajx.exe
  2⤵
  PID:1528
- C:\Windows\System\kgnZIQw.exe
  C:\Windows\System\kgnZIQw.exe
  2⤵
  PID:1332
- C:\Windows\System\uvmypJL.exe
  C:\Windows\System\uvmypJL.exe
  2⤵
  PID:2360
- C:\Windows\System\kOLfQqC.exe
  C:\Windows\System\kOLfQqC.exe
  2⤵
  PID:2888
- C:\Windows\System\HbUGrHD.exe
  C:\Windows\System\HbUGrHD.exe
  2⤵
  PID:2600
- C:\Windows\System\UzAdBOI.exe
  C:\Windows\System\UzAdBOI.exe
  2⤵
  PID:1544
- C:\Windows\System\Tzlzorz.exe
  C:\Windows\System\Tzlzorz.exe
  2⤵
  PID:2608
- C:\Windows\System\KeKUkSz.exe
  C:\Windows\System\KeKUkSz.exe
  2⤵
  PID:356
- C:\Windows\System\weYIdIV.exe
  C:\Windows\System\weYIdIV.exe
  2⤵
  PID:2240
- C:\Windows\System\rCWtmGk.exe
  C:\Windows\System\rCWtmGk.exe
  2⤵
  PID:740
- C:\Windows\System\YKzhOjQ.exe
  C:\Windows\System\YKzhOjQ.exe
  2⤵
  PID:2560
- C:\Windows\System\vBfefzJ.exe
  C:\Windows\System\vBfefzJ.exe
  2⤵
  PID:536
- C:\Windows\System\vqnyrvf.exe
  C:\Windows\System\vqnyrvf.exe
  2⤵
  PID:2392
- C:\Windows\System\FKNlWuq.exe
  C:\Windows\System\FKNlWuq.exe
  2⤵
  PID:2924
- C:\Windows\System\FpOfIqw.exe
  C:\Windows\System\FpOfIqw.exe
  2⤵
  PID:1656
- C:\Windows\System\vfYoYki.exe
  C:\Windows\System\vfYoYki.exe
  2⤵
  PID:1708
- C:\Windows\System\ShsfFvS.exe
  C:\Windows\System\ShsfFvS.exe
  2⤵
  PID:2676
- C:\Windows\System\USwuMea.exe
  C:\Windows\System\USwuMea.exe
  2⤵
  PID:2588
- C:\Windows\System\EgPzUpa.exe
  C:\Windows\System\EgPzUpa.exe
  2⤵
  PID:2464
- C:\Windows\System\HRLPCNn.exe
  C:\Windows\System\HRLPCNn.exe
  2⤵
  PID:1936
- C:\Windows\System\TwyeURY.exe
  C:\Windows\System\TwyeURY.exe
  2⤵
  PID:1640
- C:\Windows\System\lWAHwcs.exe
  C:\Windows\System\lWAHwcs.exe
  2⤵
  PID:3020
- C:\Windows\System\bsTGdbN.exe
  C:\Windows\System\bsTGdbN.exe
  2⤵
  PID:1028
- C:\Windows\System\FaqorNi.exe
  C:\Windows\System\FaqorNi.exe
  2⤵
  PID:1672
- C:\Windows\System\ABegMbL.exe
  C:\Windows\System\ABegMbL.exe
  2⤵
  PID:1568
- C:\Windows\System\OsDjxzV.exe
  C:\Windows\System\OsDjxzV.exe
  2⤵
  PID:1484
- C:\Windows\System\oXrtEfv.exe
  C:\Windows\System\oXrtEfv.exe
  2⤵
  PID:3000
- C:\Windows\System\SQFdzaI.exe
  C:\Windows\System\SQFdzaI.exe
  2⤵
  PID:1588
- C:\Windows\System\FMWSmwC.exe
  C:\Windows\System\FMWSmwC.exe
  2⤵
  PID:2728
- C:\Windows\System\wnKXlZm.exe
  C:\Windows\System\wnKXlZm.exe
  2⤵
  PID:1376
- C:\Windows\System\tGgGYpa.exe
  C:\Windows\System\tGgGYpa.exe
  2⤵
  PID:2440
- C:\Windows\System\MCanMnw.exe
  C:\Windows\System\MCanMnw.exe
  2⤵
  PID:2332
- C:\Windows\System\ojzbXwi.exe
  C:\Windows\System\ojzbXwi.exe
  2⤵
  PID:2444
- C:\Windows\System\pegjTgH.exe
  C:\Windows\System\pegjTgH.exe
  2⤵
  PID:2752
- C:\Windows\System\tQIlQcd.exe
  C:\Windows\System\tQIlQcd.exe
  2⤵
  PID:1852
- C:\Windows\System\aFBkgHM.exe
  C:\Windows\System\aFBkgHM.exe
  2⤵
  PID:2984
- C:\Windows\System\iyZxNbx.exe
  C:\Windows\System\iyZxNbx.exe
  2⤵
  PID:2220
- C:\Windows\System\SgMlmzQ.exe
  C:\Windows\System\SgMlmzQ.exe
  2⤵
  PID:1724
- C:\Windows\System\xugmwjp.exe
  C:\Windows\System\xugmwjp.exe
  2⤵
  PID:344
- C:\Windows\System\QmfTQJI.exe
  C:\Windows\System\QmfTQJI.exe
  2⤵
  PID:840
- C:\Windows\System\PriXshD.exe
  C:\Windows\System\PriXshD.exe
  2⤵
  PID:2692
- C:\Windows\System\dpeaAop.exe
  C:\Windows\System\dpeaAop.exe
  2⤵
  PID:588
- C:\Windows\System\hLqJwfV.exe
  C:\Windows\System\hLqJwfV.exe
  2⤵
  PID:2808
- C:\Windows\System\pApsUFc.exe
  C:\Windows\System\pApsUFc.exe
  2⤵
  PID:3080
- C:\Windows\System\CBBggli.exe
  C:\Windows\System\CBBggli.exe
  2⤵
  PID:3096
- C:\Windows\System\SYkMJFp.exe
  C:\Windows\System\SYkMJFp.exe
  2⤵
  PID:3112
- C:\Windows\System\mBNmJJV.exe
  C:\Windows\System\mBNmJJV.exe
  2⤵
  PID:3128
- C:\Windows\System\qSfecUb.exe
  C:\Windows\System\qSfecUb.exe
  2⤵
  PID:3144
- C:\Windows\System\iGuByDh.exe
  C:\Windows\System\iGuByDh.exe
  2⤵
  PID:3160
- C:\Windows\System\lybZMbh.exe
  C:\Windows\System\lybZMbh.exe
  2⤵
  PID:3180
- C:\Windows\System\KIHCnWh.exe
  C:\Windows\System\KIHCnWh.exe
  2⤵
  PID:3196
- C:\Windows\System\ZDLlhtx.exe
  C:\Windows\System\ZDLlhtx.exe
  2⤵
  PID:3212
- C:\Windows\System\tpXSCeW.exe
  C:\Windows\System\tpXSCeW.exe
  2⤵
  PID:3228
- C:\Windows\System\HQMWFXJ.exe
  C:\Windows\System\HQMWFXJ.exe
  2⤵
  PID:3244
- C:\Windows\System\ZMPphUv.exe
  C:\Windows\System\ZMPphUv.exe
  2⤵
  PID:3260
- C:\Windows\System\vbBPfke.exe
  C:\Windows\System\vbBPfke.exe
  2⤵
  PID:3296
- C:\Windows\System\qwbpvBy.exe
  C:\Windows\System\qwbpvBy.exe
  2⤵
  PID:3316
- C:\Windows\System\HBcGiKl.exe
  C:\Windows\System\HBcGiKl.exe
  2⤵
  PID:3332
- C:\Windows\System\bgKiPFH.exe
  C:\Windows\System\bgKiPFH.exe
  2⤵
  PID:3348
- C:\Windows\System\PHdjvrY.exe
  C:\Windows\System\PHdjvrY.exe
  2⤵
  PID:3372
- C:\Windows\System\lhLVEzO.exe
  C:\Windows\System\lhLVEzO.exe
  2⤵
  PID:3404
- C:\Windows\System\sOlAULL.exe
  C:\Windows\System\sOlAULL.exe
  2⤵
  PID:3420
- C:\Windows\System\uRVHpTj.exe
  C:\Windows\System\uRVHpTj.exe
  2⤵
  PID:3436
- C:\Windows\System\zcynGxZ.exe
  C:\Windows\System\zcynGxZ.exe
  2⤵
  PID:3452
- C:\Windows\System\zfIBTPB.exe
  C:\Windows\System\zfIBTPB.exe
  2⤵
  PID:3468
- C:\Windows\System\UxbsJQs.exe
  C:\Windows\System\UxbsJQs.exe
  2⤵
  PID:3484
- C:\Windows\System\bDkiTxW.exe
  C:\Windows\System\bDkiTxW.exe
  2⤵
  PID:3500
- C:\Windows\System\BlpevdI.exe
  C:\Windows\System\BlpevdI.exe
  2⤵
  PID:3552
- C:\Windows\System\TYrOalV.exe
  C:\Windows\System\TYrOalV.exe
  2⤵
  PID:3568
- C:\Windows\System\tZgYLLT.exe
  C:\Windows\System\tZgYLLT.exe
  2⤵
  PID:3584
- C:\Windows\System\YjrCmtm.exe
  C:\Windows\System\YjrCmtm.exe
  2⤵
  PID:3600
- C:\Windows\System\djzQKvP.exe
  C:\Windows\System\djzQKvP.exe
  2⤵
  PID:3616
- C:\Windows\System\HSCmuXm.exe
  C:\Windows\System\HSCmuXm.exe
  2⤵
  PID:3632
- C:\Windows\System\uJlvuDB.exe
  C:\Windows\System\uJlvuDB.exe
  2⤵
  PID:3648
- C:\Windows\System\qFQnadZ.exe
  C:\Windows\System\qFQnadZ.exe
  2⤵
  PID:3668
- C:\Windows\System\YFHxDyY.exe
  C:\Windows\System\YFHxDyY.exe
  2⤵
  PID:3684
- C:\Windows\System\FsHjmMd.exe
  C:\Windows\System\FsHjmMd.exe
  2⤵
  PID:3700
- C:\Windows\System\vIEPSLR.exe
  C:\Windows\System\vIEPSLR.exe
  2⤵
  PID:3716
- C:\Windows\System\YItKPCb.exe
  C:\Windows\System\YItKPCb.exe
  2⤵
  PID:3732
- C:\Windows\System\XhHDROC.exe
  C:\Windows\System\XhHDROC.exe
  2⤵
  PID:3748
- C:\Windows\System\uIZvdEA.exe
  C:\Windows\System\uIZvdEA.exe
  2⤵
  PID:3764
- C:\Windows\System\ztfmRNV.exe
  C:\Windows\System\ztfmRNV.exe
  2⤵
  PID:3780
- C:\Windows\System\dJvdXDI.exe
  C:\Windows\System\dJvdXDI.exe
  2⤵
  PID:3796
- C:\Windows\System\gNiVDMu.exe
  C:\Windows\System\gNiVDMu.exe
  2⤵
  PID:3812
- C:\Windows\System\zEQqskq.exe
  C:\Windows\System\zEQqskq.exe
  2⤵
  PID:3828
- C:\Windows\System\bhpqEFP.exe
  C:\Windows\System\bhpqEFP.exe
  2⤵
  PID:3844
- C:\Windows\System\iMZCYgu.exe
  C:\Windows\System\iMZCYgu.exe
  2⤵
  PID:3860
- C:\Windows\System\VCkiAoP.exe
  C:\Windows\System\VCkiAoP.exe
  2⤵
  PID:3876
- C:\Windows\System\rekgTRF.exe
  C:\Windows\System\rekgTRF.exe
  2⤵
  PID:3892
- C:\Windows\System\umamqsW.exe
  C:\Windows\System\umamqsW.exe
  2⤵
  PID:3908
- C:\Windows\System\kQHOGYI.exe
  C:\Windows\System\kQHOGYI.exe
  2⤵
  PID:3924
- C:\Windows\System\HtEfflz.exe
  C:\Windows\System\HtEfflz.exe
  2⤵
  PID:3940
- C:\Windows\System\nDuIIqv.exe
  C:\Windows\System\nDuIIqv.exe
  2⤵
  PID:3956
- C:\Windows\System\gYTyPjj.exe
  C:\Windows\System\gYTyPjj.exe
  2⤵
  PID:3972
- C:\Windows\System\eaUwyFH.exe
  C:\Windows\System\eaUwyFH.exe
  2⤵
  PID:1604
- C:\Windows\System\xHtPJzA.exe
  C:\Windows\System\xHtPJzA.exe
  2⤵
  PID:2896
- C:\Windows\System\RaHJfQo.exe
  C:\Windows\System\RaHJfQo.exe
  2⤵
  PID:1924
- C:\Windows\System\qdoUBCo.exe
  C:\Windows\System\qdoUBCo.exe
  2⤵
  PID:3256
- C:\Windows\System\QGiwyLp.exe
  C:\Windows\System\QGiwyLp.exe
  2⤵
  PID:3236
- C:\Windows\System\KEZMELq.exe
  C:\Windows\System\KEZMELq.exe
  2⤵
  PID:3284
- C:\Windows\System\NKtwAJJ.exe
  C:\Windows\System\NKtwAJJ.exe
  2⤵
  PID:3364
- C:\Windows\System\LSLVBaR.exe
  C:\Windows\System\LSLVBaR.exe
  2⤵
  PID:3432
- C:\Windows\System\vbFfsss.exe
  C:\Windows\System\vbFfsss.exe
  2⤵
  PID:3532
- C:\Windows\System\QMkVksA.exe
  C:\Windows\System\QMkVksA.exe
  2⤵
  PID:3544
- C:\Windows\System\tnvJzer.exe
  C:\Windows\System\tnvJzer.exe
  2⤵
  PID:3596
- C:\Windows\System\zjzNndN.exe
  C:\Windows\System\zjzNndN.exe
  2⤵
  PID:3628
- C:\Windows\System\UrhfFCl.exe
  C:\Windows\System\UrhfFCl.exe
  2⤵
  PID:4000
- C:\Windows\System\QctGUsY.exe
  C:\Windows\System\QctGUsY.exe
  2⤵
  PID:4024
- C:\Windows\System\ZFxXghg.exe
  C:\Windows\System\ZFxXghg.exe
  2⤵
  PID:4048
- C:\Windows\System\ZFEFslu.exe
  C:\Windows\System\ZFEFslu.exe
  2⤵
  PID:4060
- C:\Windows\System\XApZwaq.exe
  C:\Windows\System\XApZwaq.exe
  2⤵
  PID:4076
- C:\Windows\System\OYYOUyC.exe
  C:\Windows\System\OYYOUyC.exe
  2⤵
  PID:3012
- C:\Windows\System\EvIMksB.exe
  C:\Windows\System\EvIMksB.exe
  2⤵
  PID:2932
- C:\Windows\System\FKubGFd.exe
  C:\Windows\System\FKubGFd.exe
  2⤵
  PID:3984
- C:\Windows\System\hLQwUsZ.exe
  C:\Windows\System\hLQwUsZ.exe
  2⤵
  PID:3808
- C:\Windows\System\XjTMOdj.exe
  C:\Windows\System\XjTMOdj.exe
  2⤵
  PID:3868
- C:\Windows\System\UMvKmaF.exe
  C:\Windows\System\UMvKmaF.exe
  2⤵
  PID:3936
- C:\Windows\System\gsfudxn.exe
  C:\Windows\System\gsfudxn.exe
  2⤵
  PID:3172
- C:\Windows\System\wVRXDLo.exe
  C:\Windows\System\wVRXDLo.exe
  2⤵
  PID:3104
- C:\Windows\System\Pkuvldw.exe
  C:\Windows\System\Pkuvldw.exe
  2⤵
  PID:1616
- C:\Windows\System\tNATLhb.exe
  C:\Windows\System\tNATLhb.exe
  2⤵
  PID:296
- C:\Windows\System\uGMJLYh.exe
  C:\Windows\System\uGMJLYh.exe
  2⤵
  PID:3272
- C:\Windows\System\PFOQKsH.exe
  C:\Windows\System\PFOQKsH.exe
  2⤵
  PID:1076
- C:\Windows\System\KvpgbNQ.exe
  C:\Windows\System\KvpgbNQ.exe
  2⤵
  PID:3388
- C:\Windows\System\jCmdMXH.exe
  C:\Windows\System\jCmdMXH.exe
  2⤵
  PID:3356
- C:\Windows\System\yJuONEZ.exe
  C:\Windows\System\yJuONEZ.exe
  2⤵
  PID:1764
- C:\Windows\System\mlvpfLm.exe
  C:\Windows\System\mlvpfLm.exe
  2⤵
  PID:3152
- C:\Windows\System\bFmXAFD.exe
  C:\Windows\System\bFmXAFD.exe
  2⤵
  PID:1744
- C:\Windows\System\lVdOiTJ.exe
  C:\Windows\System\lVdOiTJ.exe
  2⤵
  PID:3252
- C:\Windows\System\OhCIBEx.exe
  C:\Windows\System\OhCIBEx.exe
  2⤵
  PID:3496
- C:\Windows\System\opGXkHf.exe
  C:\Windows\System\opGXkHf.exe
  2⤵
  PID:3444
- C:\Windows\System\dRrqkaa.exe
  C:\Windows\System\dRrqkaa.exe
  2⤵
  PID:3508
- C:\Windows\System\kQIthrS.exe
  C:\Windows\System\kQIthrS.exe
  2⤵
  PID:3400
- C:\Windows\System\NAtUTEY.exe
  C:\Windows\System\NAtUTEY.exe
  2⤵
  PID:3512
- C:\Windows\System\DSfQrQS.exe
  C:\Windows\System\DSfQrQS.exe
  2⤵
  PID:2800
- C:\Windows\System\pKHYpkw.exe
  C:\Windows\System\pKHYpkw.exe
  2⤵
  PID:3756
- C:\Windows\System\FvYxaBd.exe
  C:\Windows\System\FvYxaBd.exe
  2⤵
  PID:3852
- C:\Windows\System\PuTGpMT.exe
  C:\Windows\System\PuTGpMT.exe
  2⤵
  PID:3916
- C:\Windows\System\Jxdyxuo.exe
  C:\Windows\System\Jxdyxuo.exe
  2⤵
  PID:3988
- C:\Windows\System\NDwjtRq.exe
  C:\Windows\System\NDwjtRq.exe
  2⤵
  PID:3624
- C:\Windows\System\BEftnDD.exe
  C:\Windows\System\BEftnDD.exe
  2⤵
  PID:2988
- C:\Windows\System\howjnjX.exe
  C:\Windows\System\howjnjX.exe
  2⤵
  PID:2944
- C:\Windows\System\QHeOKoW.exe
  C:\Windows\System\QHeOKoW.exe
  2⤵
  PID:4032
- C:\Windows\System\yblWldf.exe
  C:\Windows\System\yblWldf.exe
  2⤵
  PID:4036
- C:\Windows\System\ycTkyUN.exe
  C:\Windows\System\ycTkyUN.exe
  2⤵
  PID:2508
- C:\Windows\System\YvQptGl.exe
  C:\Windows\System\YvQptGl.exe
  2⤵
  PID:4092
- C:\Windows\System\OqEGIwS.exe
  C:\Windows\System\OqEGIwS.exe
  2⤵
  PID:1832
- C:\Windows\System\JOgVlhc.exe
  C:\Windows\System\JOgVlhc.exe
  2⤵
  PID:3680
- C:\Windows\System\wHBPEAw.exe
  C:\Windows\System\wHBPEAw.exe
  2⤵
  PID:3712
- C:\Windows\System\ohaqxiN.exe
  C:\Windows\System\ohaqxiN.exe
  2⤵
  PID:3740
- C:\Windows\System\ajCXUhP.exe
  C:\Windows\System\ajCXUhP.exe
  2⤵
  PID:3840
- C:\Windows\System\zRYBQYN.exe
  C:\Windows\System\zRYBQYN.exe
  2⤵
  PID:3900
- C:\Windows\System\mQPTwPR.exe
  C:\Windows\System\mQPTwPR.exe
  2⤵
  PID:892
- C:\Windows\System\reTWurc.exe
  C:\Windows\System\reTWurc.exe
  2⤵
  PID:2716
- C:\Windows\System\DFNGhBY.exe
  C:\Windows\System\DFNGhBY.exe
  2⤵
  PID:304
- C:\Windows\System\wPcDKDo.exe
  C:\Windows\System\wPcDKDo.exe
  2⤵
  PID:3204
- C:\Windows\System\eBUtiAg.exe
  C:\Windows\System\eBUtiAg.exe
  2⤵
  PID:3344
- C:\Windows\System\zpwLHMD.exe
  C:\Windows\System\zpwLHMD.exe
  2⤵
  PID:3328
- C:\Windows\System\lGTLQKc.exe
  C:\Windows\System\lGTLQKc.exe
  2⤵
  PID:3108
- C:\Windows\System\AUWXbLd.exe
  C:\Windows\System\AUWXbLd.exe
  2⤵
  PID:3124
- C:\Windows\System\gHVZpvE.exe
  C:\Windows\System\gHVZpvE.exe
  2⤵
  PID:3076
- C:\Windows\System\AqCSLht.exe
  C:\Windows\System\AqCSLht.exe
  2⤵
  PID:3464
- C:\Windows\System\rmstFJg.exe
  C:\Windows\System\rmstFJg.exe
  2⤵
  PID:3520
- C:\Windows\System\OUepiGL.exe
  C:\Windows\System\OUepiGL.exe
  2⤵
  PID:3480
- C:\Windows\System\BuowjIR.exe
  C:\Windows\System\BuowjIR.exe
  2⤵
  PID:3660
- C:\Windows\System\HCLvacy.exe
  C:\Windows\System\HCLvacy.exe
  2⤵
  PID:3728
- C:\Windows\System\jQhnnOl.exe
  C:\Windows\System\jQhnnOl.exe
  2⤵
  PID:3884
- C:\Windows\System\ZBkrYwd.exe
  C:\Windows\System\ZBkrYwd.exe
  2⤵
  PID:4108
- C:\Windows\System\nNkBjOq.exe
  C:\Windows\System\nNkBjOq.exe
  2⤵
  PID:4124
- C:\Windows\System\DseHrrJ.exe
  C:\Windows\System\DseHrrJ.exe
  2⤵
  PID:4140
- C:\Windows\System\aPBwocT.exe
  C:\Windows\System\aPBwocT.exe
  2⤵
  PID:4160
- C:\Windows\System\XQvvkmz.exe
  C:\Windows\System\XQvvkmz.exe
  2⤵
  PID:4176
- C:\Windows\System\tXcXfey.exe
  C:\Windows\System\tXcXfey.exe
  2⤵
  PID:4192
- C:\Windows\System\dvEBUtF.exe
  C:\Windows\System\dvEBUtF.exe
  2⤵
  PID:4208
- C:\Windows\System\ymgZLRj.exe
  C:\Windows\System\ymgZLRj.exe
  2⤵
  PID:4228
- C:\Windows\System\LKzlNmB.exe
  C:\Windows\System\LKzlNmB.exe
  2⤵
  PID:4376
- C:\Windows\System\VxCwUIn.exe
  C:\Windows\System\VxCwUIn.exe
  2⤵
  PID:4392
- C:\Windows\System\PmncolN.exe
  C:\Windows\System\PmncolN.exe
  2⤵
  PID:4408
- C:\Windows\System\kXBbYNj.exe
  C:\Windows\System\kXBbYNj.exe
  2⤵
  PID:4424
- C:\Windows\System\bpBpBMN.exe
  C:\Windows\System\bpBpBMN.exe
  2⤵
  PID:4440
- C:\Windows\System\MXFvGia.exe
  C:\Windows\System\MXFvGia.exe
  2⤵
  PID:4460
- C:\Windows\System\ORavkvI.exe
  C:\Windows\System\ORavkvI.exe
  2⤵
  PID:4476
- C:\Windows\System\ZuteADp.exe
  C:\Windows\System\ZuteADp.exe
  2⤵
  PID:4492
- C:\Windows\System\ClKDzcW.exe
  C:\Windows\System\ClKDzcW.exe
  2⤵
  PID:4508
- C:\Windows\System\UIdfgMC.exe
  C:\Windows\System\UIdfgMC.exe
  2⤵
  PID:4524
- C:\Windows\System\uazwjgd.exe
  C:\Windows\System\uazwjgd.exe
  2⤵
  PID:4544
- C:\Windows\System\GTZkPiq.exe
  C:\Windows\System\GTZkPiq.exe
  2⤵
  PID:4560
- C:\Windows\System\NfqXYiL.exe
  C:\Windows\System\NfqXYiL.exe
  2⤵
  PID:4576
- C:\Windows\System\zKjwfVo.exe
  C:\Windows\System\zKjwfVo.exe
  2⤵
  PID:4592
- C:\Windows\System\kpAKsJS.exe
  C:\Windows\System\kpAKsJS.exe
  2⤵
  PID:4608
- C:\Windows\System\bMnktha.exe
  C:\Windows\System\bMnktha.exe
  2⤵
  PID:4628
- C:\Windows\System\cklrNKK.exe
  C:\Windows\System\cklrNKK.exe
  2⤵
  PID:4644
- C:\Windows\System\XMypaFK.exe
  C:\Windows\System\XMypaFK.exe
  2⤵
  PID:4660
- C:\Windows\System\VgEnsCu.exe
  C:\Windows\System\VgEnsCu.exe
  2⤵
  PID:4676
- C:\Windows\System\djYLGhE.exe
  C:\Windows\System\djYLGhE.exe
  2⤵
  PID:4696
- C:\Windows\System\JyfBOzJ.exe
  C:\Windows\System\JyfBOzJ.exe
  2⤵
  PID:4712
- C:\Windows\System\HLoxUHV.exe
  C:\Windows\System\HLoxUHV.exe
  2⤵
  PID:4728
- C:\Windows\System\ZwTrdzf.exe
  C:\Windows\System\ZwTrdzf.exe
  2⤵
  PID:4744
- C:\Windows\System\DMqPIoT.exe
  C:\Windows\System\DMqPIoT.exe
  2⤵
  PID:4760
- C:\Windows\System\nBiNiXx.exe
  C:\Windows\System\nBiNiXx.exe
  2⤵
  PID:4776
- C:\Windows\System\npYvCjf.exe
  C:\Windows\System\npYvCjf.exe
  2⤵
  PID:4792
- C:\Windows\System\WvYQNHG.exe
  C:\Windows\System\WvYQNHG.exe
  2⤵
  PID:4840
- C:\Windows\System\nCXMAJa.exe
  C:\Windows\System\nCXMAJa.exe
  2⤵
  PID:4888
- C:\Windows\System\peNuZvm.exe
  C:\Windows\System\peNuZvm.exe
  2⤵
  PID:4924
- C:\Windows\System\WMhWBqO.exe
  C:\Windows\System\WMhWBqO.exe
  2⤵
  PID:4952
- C:\Windows\System\WsxyGbk.exe
  C:\Windows\System\WsxyGbk.exe
  2⤵
  PID:4972
- C:\Windows\System\uBKhlkG.exe
  C:\Windows\System\uBKhlkG.exe
  2⤵
  PID:5008
- C:\Windows\System\OoleCKE.exe
  C:\Windows\System\OoleCKE.exe
  2⤵
  PID:5024
- C:\Windows\System\iJiEADx.exe
  C:\Windows\System\iJiEADx.exe
  2⤵
  PID:5044
- C:\Windows\System\TrVJQMJ.exe
  C:\Windows\System\TrVJQMJ.exe
  2⤵
  PID:5068
- C:\Windows\System\mheQSxK.exe
  C:\Windows\System\mheQSxK.exe
  2⤵
  PID:5088
- C:\Windows\System\epYrFmR.exe
  C:\Windows\System\epYrFmR.exe
  2⤵
  PID:5104
- C:\Windows\System\jxUTwVO.exe
  C:\Windows\System\jxUTwVO.exe
  2⤵
  PID:3888
- C:\Windows\System\dLAEYpB.exe
  C:\Windows\System\dLAEYpB.exe
  2⤵
  PID:4008
- C:\Windows\System\ExyMjnt.exe
  C:\Windows\System\ExyMjnt.exe
  2⤵
  PID:3644
- C:\Windows\System\ewwjfOX.exe
  C:\Windows\System\ewwjfOX.exe
  2⤵
  PID:2340
- C:\Windows\System\NcGFWID.exe
  C:\Windows\System\NcGFWID.exe
  2⤵
  PID:4148
- C:\Windows\System\qxUpbLP.exe
  C:\Windows\System\qxUpbLP.exe
  2⤵
  PID:3176
- C:\Windows\System\KLHPWgy.exe
  C:\Windows\System\KLHPWgy.exe
  2⤵
  PID:3952
- C:\Windows\System\sXhxSDo.exe
  C:\Windows\System\sXhxSDo.exe
  2⤵
  PID:3904
- C:\Windows\System\GrsWHAO.exe
  C:\Windows\System\GrsWHAO.exe
  2⤵
  PID:2648
- C:\Windows\System\nEyeFUd.exe
  C:\Windows\System\nEyeFUd.exe
  2⤵
  PID:1652
- C:\Windows\System\lsVJOpa.exe
  C:\Windows\System\lsVJOpa.exe
  2⤵
  PID:3292
- C:\Windows\System\cLmwXZT.exe
  C:\Windows\System\cLmwXZT.exe
  2⤵
  PID:3308
- C:\Windows\System\cImTARj.exe
  C:\Windows\System\cImTARj.exe
  2⤵
  PID:4156
- C:\Windows\System\gHLAgem.exe
  C:\Windows\System\gHLAgem.exe
  2⤵
  PID:3724
- C:\Windows\System\hvDLSry.exe
  C:\Windows\System\hvDLSry.exe
  2⤵
  PID:4268
- C:\Windows\System\iWslhpO.exe
  C:\Windows\System\iWslhpO.exe
  2⤵
  PID:4256
- C:\Windows\System\SgBgCoW.exe
  C:\Windows\System\SgBgCoW.exe
  2⤵
  PID:4104
- C:\Windows\System\XfLjQxt.exe
  C:\Windows\System\XfLjQxt.exe
  2⤵
  PID:4200
- C:\Windows\System\gojsqkq.exe
  C:\Windows\System\gojsqkq.exe
  2⤵
  PID:4260
- C:\Windows\System\QdWRUaT.exe
  C:\Windows\System\QdWRUaT.exe
  2⤵
  PID:4280
- C:\Windows\System\lQpEEQP.exe
  C:\Windows\System\lQpEEQP.exe
  2⤵
  PID:4308
- C:\Windows\System\UgglaDS.exe
  C:\Windows\System\UgglaDS.exe
  2⤵
  PID:4328
- C:\Windows\System\ItNHxaM.exe
  C:\Windows\System\ItNHxaM.exe
  2⤵
  PID:4352
- C:\Windows\System\duNRKMx.exe
  C:\Windows\System\duNRKMx.exe
  2⤵
  PID:4360
- C:\Windows\System\XklOnoi.exe
  C:\Windows\System\XklOnoi.exe
  2⤵
  PID:4488
- C:\Windows\System\IeBeqMv.exe
  C:\Windows\System\IeBeqMv.exe
  2⤵
  PID:4420
- C:\Windows\System\DTdgadK.exe
  C:\Windows\System\DTdgadK.exe
  2⤵
  PID:4620
- C:\Windows\System\eCQNMjU.exe
  C:\Windows\System\eCQNMjU.exe
  2⤵
  PID:4552
- C:\Windows\System\LBtTOGw.exe
  C:\Windows\System\LBtTOGw.exe
  2⤵
  PID:4584
- C:\Windows\System\qQWutBq.exe
  C:\Windows\System\qQWutBq.exe
  2⤵
  PID:4472
- C:\Windows\System\uwXMFtR.exe
  C:\Windows\System\uwXMFtR.exe
  2⤵
  PID:4600
- C:\Windows\System\gsCsqOo.exe
  C:\Windows\System\gsCsqOo.exe
  2⤵
  PID:4536
- C:\Windows\System\isOsRIf.exe
  C:\Windows\System\isOsRIf.exe
  2⤵
  PID:4812
- C:\Windows\System\iXnCHYs.exe
  C:\Windows\System\iXnCHYs.exe
  2⤵
  PID:4784
- C:\Windows\System\YZkFFwX.exe
  C:\Windows\System\YZkFFwX.exe
  2⤵
  PID:4724
- C:\Windows\System\iBNfZcZ.exe
  C:\Windows\System\iBNfZcZ.exe
  2⤵
  PID:4736
- C:\Windows\System\OIThXvI.exe
  C:\Windows\System\OIThXvI.exe
  2⤵
  PID:4828
- C:\Windows\System\otNgLAm.exe
  C:\Windows\System\otNgLAm.exe
  2⤵
  PID:4856
- C:\Windows\System\FmqjZLY.exe
  C:\Windows\System\FmqjZLY.exe
  2⤵
  PID:4876
- C:\Windows\System\PNztnGU.exe
  C:\Windows\System\PNztnGU.exe
  2⤵
  PID:4920
- C:\Windows\System\YBzEafn.exe
  C:\Windows\System\YBzEafn.exe
  2⤵
  PID:4932
- C:\Windows\System\xfGUkIO.exe
  C:\Windows\System\xfGUkIO.exe
  2⤵
  PID:4944
- C:\Windows\System\qaePrwe.exe
  C:\Windows\System\qaePrwe.exe
  2⤵
  PID:4964
- C:\Windows\System\Qkacmcu.exe
  C:\Windows\System\Qkacmcu.exe
  2⤵
  PID:5036
- C:\Windows\System\gzMmonf.exe
  C:\Windows\System\gzMmonf.exe
  2⤵
  PID:5076
- C:\Windows\System\CmofPJE.exe
  C:\Windows\System\CmofPJE.exe
  2⤵
  PID:5100
- C:\Windows\System\NaXpBWj.exe
  C:\Windows\System\NaXpBWj.exe
  2⤵
  PID:3836
- C:\Windows\System\kcaWrDQ.exe
  C:\Windows\System\kcaWrDQ.exe
  2⤵
  PID:4216
- C:\Windows\System\rVPBqIw.exe
  C:\Windows\System\rVPBqIw.exe
  2⤵
  PID:4064
- C:\Windows\System\lNCccqy.exe
  C:\Windows\System\lNCccqy.exe
  2⤵
  PID:844
- C:\Windows\System\KyYedmt.exe
  C:\Windows\System\KyYedmt.exe
  2⤵
  PID:3188
- C:\Windows\System\bbbpQUj.exe
  C:\Windows\System\bbbpQUj.exe
  2⤵
  PID:3692
- C:\Windows\System\cUQyhzI.exe
  C:\Windows\System\cUQyhzI.exe
  2⤵
  PID:2612
- C:\Windows\System\GqjLrfJ.exe
  C:\Windows\System\GqjLrfJ.exe
  2⤵
  PID:3312
- C:\Windows\System\ptWYmtu.exe
  C:\Windows\System\ptWYmtu.exe
  2⤵
  PID:1304
- C:\Windows\System\aSggyUV.exe
  C:\Windows\System\aSggyUV.exe
  2⤵
  PID:3492
- C:\Windows\System\dXZABDt.exe
  C:\Windows\System\dXZABDt.exe
  2⤵
  PID:4100
- C:\Windows\System\jOmWHRY.exe
  C:\Windows\System\jOmWHRY.exe
  2⤵
  PID:3220
- C:\Windows\System\RaRpwQP.exe
  C:\Windows\System\RaRpwQP.exe
  2⤵
  PID:4248
- C:\Windows\System\TQkBlnO.exe
  C:\Windows\System\TQkBlnO.exe
  2⤵
  PID:4244
- C:\Windows\System\FzhhZKr.exe
  C:\Windows\System\FzhhZKr.exe
  2⤵
  PID:3280
- C:\Windows\System\rrMFPXr.exe
  C:\Windows\System\rrMFPXr.exe
  2⤵
  PID:4336
- C:\Windows\System\iBMEykw.exe
  C:\Windows\System\iBMEykw.exe
  2⤵
  PID:4364
- C:\Windows\System\eQEEruY.exe
  C:\Windows\System\eQEEruY.exe
  2⤵
  PID:4388
- C:\Windows\System\UWzQzTm.exe
  C:\Windows\System\UWzQzTm.exe
  2⤵
  PID:4520
- C:\Windows\System\aGPZVkk.exe
  C:\Windows\System\aGPZVkk.exe
  2⤵
  PID:4684
- C:\Windows\System\riQhhTs.exe
  C:\Windows\System\riQhhTs.exe
  2⤵
  PID:4692
- C:\Windows\System\nJaFLoL.exe
  C:\Windows\System\nJaFLoL.exe
  2⤵
  PID:4704
- C:\Windows\System\rkWEGIU.exe
  C:\Windows\System\rkWEGIU.exe
  2⤵
  PID:4636
- C:\Windows\System\TQPNqov.exe
  C:\Windows\System\TQPNqov.exe
  2⤵
  PID:4756
- C:\Windows\System\VDSfpvb.exe
  C:\Windows\System\VDSfpvb.exe
  2⤵
  PID:4808
- C:\Windows\System\oDPJrnj.exe
  C:\Windows\System\oDPJrnj.exe
  2⤵
  PID:4800
- C:\Windows\System\FwggYJJ.exe
  C:\Windows\System\FwggYJJ.exe
  2⤵
  PID:4868
- C:\Windows\System\NgkTMXC.exe
  C:\Windows\System\NgkTMXC.exe
  2⤵
  PID:4960
- C:\Windows\System\rutMLwh.exe
  C:\Windows\System\rutMLwh.exe
  2⤵
  PID:5116
- C:\Windows\System\uGJUYsd.exe
  C:\Windows\System\uGJUYsd.exe
  2⤵
  PID:5132
- C:\Windows\System\PStTgON.exe
  C:\Windows\System\PStTgON.exe
  2⤵
  PID:5148
- C:\Windows\System\CeyBhHd.exe
  C:\Windows\System\CeyBhHd.exe
  2⤵
  PID:5204
- C:\Windows\System\jVCVsTy.exe
  C:\Windows\System\jVCVsTy.exe
  2⤵
  PID:5320
- C:\Windows\System\FBSzKHQ.exe
  C:\Windows\System\FBSzKHQ.exe
  2⤵
  PID:5336
- C:\Windows\System\RyJrIyT.exe
  C:\Windows\System\RyJrIyT.exe
  2⤵
  PID:5352
- C:\Windows\System\HQENsly.exe
  C:\Windows\System\HQENsly.exe
  2⤵
  PID:5368
- C:\Windows\System\vXUpdsP.exe
  C:\Windows\System\vXUpdsP.exe
  2⤵
  PID:5472
- C:\Windows\System\ItCEPZF.exe
  C:\Windows\System\ItCEPZF.exe
  2⤵
  PID:5488
- C:\Windows\System\WLnhMKX.exe
  C:\Windows\System\WLnhMKX.exe
  2⤵
  PID:5504
- C:\Windows\System\LvJABPc.exe
  C:\Windows\System\LvJABPc.exe
  2⤵
  PID:5524
- C:\Windows\System\hMygvCo.exe
  C:\Windows\System\hMygvCo.exe
  2⤵
  PID:5544
- C:\Windows\System\vELyWdG.exe
  C:\Windows\System\vELyWdG.exe
  2⤵
  PID:5560
- C:\Windows\System\XldypDF.exe
  C:\Windows\System\XldypDF.exe
  2⤵
  PID:5576
- C:\Windows\System\fzrSZqE.exe
  C:\Windows\System\fzrSZqE.exe
  2⤵
  PID:5592
- C:\Windows\System\pYlgQtZ.exe
  C:\Windows\System\pYlgQtZ.exe
  2⤵
  PID:5612
- C:\Windows\System\CJpwYdw.exe
  C:\Windows\System\CJpwYdw.exe
  2⤵
  PID:5652
- C:\Windows\System\UidMpwL.exe
  C:\Windows\System\UidMpwL.exe
  2⤵
  PID:5668
- C:\Windows\System\zhJcOLH.exe
  C:\Windows\System\zhJcOLH.exe
  2⤵
  PID:5684
- C:\Windows\System\gSGkowg.exe
  C:\Windows\System\gSGkowg.exe
  2⤵
  PID:5700
- C:\Windows\System\UgdyMUn.exe
  C:\Windows\System\UgdyMUn.exe
  2⤵
  PID:5716
- C:\Windows\System\CdWEIGE.exe
  C:\Windows\System\CdWEIGE.exe
  2⤵
  PID:5736
- C:\Windows\System\PusgRwC.exe
  C:\Windows\System\PusgRwC.exe
  2⤵
  PID:5752
- C:\Windows\System\gAuctuu.exe
  C:\Windows\System\gAuctuu.exe
  2⤵
  PID:5768
- C:\Windows\System\sYigKtw.exe
  C:\Windows\System\sYigKtw.exe
  2⤵
  PID:5784
- C:\Windows\System\lRdpUkp.exe
  C:\Windows\System\lRdpUkp.exe
  2⤵
  PID:5800
- C:\Windows\System\vzVXPOE.exe
  C:\Windows\System\vzVXPOE.exe
  2⤵
  PID:5816
- C:\Windows\System\HGfXEAl.exe
  C:\Windows\System\HGfXEAl.exe
  2⤵
  PID:5836
- C:\Windows\System\RYpQnWg.exe
  C:\Windows\System\RYpQnWg.exe
  2⤵
  PID:5852
- C:\Windows\System\rTiHtmW.exe
  C:\Windows\System\rTiHtmW.exe
  2⤵
  PID:5868
- C:\Windows\System\dlZsWnZ.exe
  C:\Windows\System\dlZsWnZ.exe
  2⤵
  PID:5884
- C:\Windows\System\bMrBgwX.exe
  C:\Windows\System\bMrBgwX.exe
  2⤵
  PID:5900
- C:\Windows\System\oKGhKYe.exe
  C:\Windows\System\oKGhKYe.exe
  2⤵
  PID:5916
- C:\Windows\System\NsrCEUG.exe
  C:\Windows\System\NsrCEUG.exe
  2⤵
  PID:5964
- C:\Windows\System\AnHnOtz.exe
  C:\Windows\System\AnHnOtz.exe
  2⤵
  PID:5980
- C:\Windows\System\gbLpSOU.exe
  C:\Windows\System\gbLpSOU.exe
  2⤵
  PID:5996
- C:\Windows\System\rAbhoOt.exe
  C:\Windows\System\rAbhoOt.exe
  2⤵
  PID:6012
- C:\Windows\System\VnAoICA.exe
  C:\Windows\System\VnAoICA.exe
  2⤵
  PID:6028
- C:\Windows\System\IUNsZMH.exe
  C:\Windows\System\IUNsZMH.exe
  2⤵
  PID:6044
- C:\Windows\System\RSINxkD.exe
  C:\Windows\System\RSINxkD.exe
  2⤵
  PID:6060
- C:\Windows\System\oPnFxpC.exe
  C:\Windows\System\oPnFxpC.exe
  2⤵
  PID:6080
- C:\Windows\System\lhQotOz.exe
  C:\Windows\System\lhQotOz.exe
  2⤵
  PID:6096
- C:\Windows\System\cRdRiLl.exe
  C:\Windows\System\cRdRiLl.exe
  2⤵
  PID:6112
- C:\Windows\System\SIlaFvx.exe
  C:\Windows\System\SIlaFvx.exe
  2⤵
  PID:6136
- C:\Windows\System\dcjwgNv.exe
  C:\Windows\System\dcjwgNv.exe
  2⤵
  PID:4168
- C:\Windows\System\NpZRiNp.exe
  C:\Windows\System\NpZRiNp.exe
  2⤵
  PID:4340
- C:\Windows\System\HlctBmK.exe
  C:\Windows\System\HlctBmK.exe
  2⤵
  PID:5064
- C:\Windows\System\eyORiNU.exe
  C:\Windows\System\eyORiNU.exe
  2⤵
  PID:4640
- C:\Windows\System\iXmNYGE.exe
  C:\Windows\System\iXmNYGE.exe
  2⤵
  PID:4768
- C:\Windows\System\AKVhzrU.exe
  C:\Windows\System\AKVhzrU.exe
  2⤵
  PID:2764
- C:\Windows\System\BiJgukQ.exe
  C:\Windows\System\BiJgukQ.exe
  2⤵
  PID:3208
- C:\Windows\System\WhbXLbl.exe
  C:\Windows\System\WhbXLbl.exe
  2⤵
  PID:4540
- C:\Windows\System\qBRGaNy.exe
  C:\Windows\System\qBRGaNy.exe
  2⤵
  PID:5000
- C:\Windows\System\rGAtuWq.exe
  C:\Windows\System\rGAtuWq.exe
  2⤵
  PID:5032
- C:\Windows\System\Whiofha.exe
  C:\Windows\System\Whiofha.exe
  2⤵
  PID:4316
- C:\Windows\System\QatSEcX.exe
  C:\Windows\System\QatSEcX.exe
  2⤵
  PID:4624
- C:\Windows\System\yejcasW.exe
  C:\Windows\System\yejcasW.exe
  2⤵
  PID:4752
- C:\Windows\System\RqvlPLc.exe
  C:\Windows\System\RqvlPLc.exe
  2⤵
  PID:5160
- C:\Windows\System\FlksmKz.exe
  C:\Windows\System\FlksmKz.exe
  2⤵
  PID:3664
- C:\Windows\System\TgdkiJH.exe
  C:\Windows\System\TgdkiJH.exe
  2⤵
  PID:4884
- C:\Windows\System\cYRMGek.exe
  C:\Windows\System\cYRMGek.exe
  2⤵
  PID:5172
- C:\Windows\System\okiBgLQ.exe
  C:\Windows\System\okiBgLQ.exe
  2⤵
  PID:5188
- C:\Windows\System\AdbqARa.exe
  C:\Windows\System\AdbqARa.exe
  2⤵
  PID:5040
- C:\Windows\System\KfQDoNN.exe
  C:\Windows\System\KfQDoNN.exe
  2⤵
  PID:5212
- C:\Windows\System\WfyZQMH.exe
  C:\Windows\System\WfyZQMH.exe
  2⤵
  PID:5224
- C:\Windows\System\KCkqHLi.exe
  C:\Windows\System\KCkqHLi.exe
  2⤵
  PID:5244
- C:\Windows\System\NZtnmKc.exe
  C:\Windows\System\NZtnmKc.exe
  2⤵
  PID:5260
- C:\Windows\System\swisobF.exe
  C:\Windows\System\swisobF.exe
  2⤵
  PID:5276
- C:\Windows\System\ERRrhjk.exe
  C:\Windows\System\ERRrhjk.exe
  2⤵
  PID:5292
- C:\Windows\System\GTArNUF.exe
  C:\Windows\System\GTArNUF.exe
  2⤵
  PID:5308
- C:\Windows\System\yzdFmdv.exe
  C:\Windows\System\yzdFmdv.exe
  2⤵
  PID:5360
- C:\Windows\System\wZTqHFS.exe
  C:\Windows\System\wZTqHFS.exe
  2⤵
  PID:5348
- C:\Windows\System\KfeaiIY.exe
  C:\Windows\System\KfeaiIY.exe
  2⤵
  PID:5388
- C:\Windows\System\PQyQITR.exe
  C:\Windows\System\PQyQITR.exe
  2⤵
  PID:5404
- C:\Windows\System\gtETPcW.exe
  C:\Windows\System\gtETPcW.exe
  2⤵
  PID:5416
- C:\Windows\System\jcHrTCi.exe
  C:\Windows\System\jcHrTCi.exe
  2⤵
  PID:5432
- C:\Windows\System\tUmNENI.exe
  C:\Windows\System\tUmNENI.exe
  2⤵
  PID:5452
- C:\Windows\System\sMwusDm.exe
  C:\Windows\System\sMwusDm.exe
  2⤵
  PID:5480
- C:\Windows\System\FYloazI.exe
  C:\Windows\System\FYloazI.exe
  2⤵
  PID:5512
- C:\Windows\System\xooQqzc.exe
  C:\Windows\System\xooQqzc.exe
  2⤵
  PID:5568
- C:\Windows\System\coAQfJN.exe
  C:\Windows\System\coAQfJN.exe
  2⤵
  PID:5520
- C:\Windows\System\UXBHOep.exe
  C:\Windows\System\UXBHOep.exe
  2⤵
  PID:5660
- C:\Windows\System\GudSHid.exe
  C:\Windows\System\GudSHid.exe
  2⤵
  PID:5664
- C:\Windows\System\VeduIeL.exe
  C:\Windows\System\VeduIeL.exe
  2⤵
  PID:5732
- C:\Windows\System\cZsRMss.exe
  C:\Windows\System\cZsRMss.exe
  2⤵
  PID:5792
- C:\Windows\System\btUdTiu.exe
  C:\Windows\System\btUdTiu.exe
  2⤵
  PID:5860
- C:\Windows\System\bDJkcnH.exe
  C:\Windows\System\bDJkcnH.exe
  2⤵
  PID:5896
- C:\Windows\System\yCKvhlG.exe
  C:\Windows\System\yCKvhlG.exe
  2⤵
  PID:5628
- C:\Windows\System\jWmsvnJ.exe
  C:\Windows\System\jWmsvnJ.exe
  2⤵
  PID:5680
- C:\Windows\System\afEMSVg.exe
  C:\Windows\System\afEMSVg.exe
  2⤵
  PID:5948
- C:\Windows\System\cscTqhv.exe
  C:\Windows\System\cscTqhv.exe
  2⤵
  PID:5832
- C:\Windows\System\RoQSunU.exe
  C:\Windows\System\RoQSunU.exe
  2⤵
  PID:5880
- C:\Windows\System\uIfFJdz.exe
  C:\Windows\System\uIfFJdz.exe
  2⤵
  PID:5960
- C:\Windows\System\sZDTvPF.exe
  C:\Windows\System\sZDTvPF.exe
  2⤵
  PID:5988
- C:\Windows\System\hJwCShK.exe
  C:\Windows\System\hJwCShK.exe
  2⤵
  PID:6024
- C:\Windows\System\JwAsIml.exe
  C:\Windows\System\JwAsIml.exe
  2⤵
  PID:6124
- C:\Windows\System\vHIyuAP.exe
  C:\Windows\System\vHIyuAP.exe
  2⤵
  PID:1520
- C:\Windows\System\NmTjtDk.exe
  C:\Windows\System\NmTjtDk.exe
  2⤵
  PID:5976
- C:\Windows\System\QbEHRGu.exe
  C:\Windows\System\QbEHRGu.exe
  2⤵
  PID:6040
- C:\Windows\System\gFAARxY.exe
  C:\Windows\System\gFAARxY.exe
  2⤵
  PID:4120
- C:\Windows\System\GUoiAJh.exe
  C:\Windows\System\GUoiAJh.exe
  2⤵
  PID:6076
- C:\Windows\System\FHQgpRg.exe
  C:\Windows\System\FHQgpRg.exe
  2⤵
  PID:4836
- C:\Windows\System\vrdRoxS.exe
  C:\Windows\System\vrdRoxS.exe
  2⤵
  PID:5056
- C:\Windows\System\vaDstgB.exe
  C:\Windows\System\vaDstgB.exe
  2⤵
  PID:4988
- C:\Windows\System\HjCyWrR.exe
  C:\Windows\System\HjCyWrR.exe
  2⤵
  PID:5128
- C:\Windows\System\imVkWBJ.exe
  C:\Windows\System\imVkWBJ.exe
  2⤵
  PID:4452
- C:\Windows\System\PfKcMdO.exe
  C:\Windows\System\PfKcMdO.exe
  2⤵
  PID:5020
- C:\Windows\System\TJhnyoX.exe
  C:\Windows\System\TJhnyoX.exe
  2⤵
  PID:4652
- C:\Windows\System\VeuGFwL.exe
  C:\Windows\System\VeuGFwL.exe
  2⤵
  PID:1912
- C:\Windows\System\DeXDKQK.exe
  C:\Windows\System\DeXDKQK.exe
  2⤵
  PID:5240
- C:\Windows\System\IdfOVLC.exe
  C:\Windows\System\IdfOVLC.exe
  2⤵
  PID:5268
- C:\Windows\System\JBSZTUG.exe
  C:\Windows\System\JBSZTUG.exe
  2⤵
  PID:3540
- C:\Windows\System\XdKdXKj.exe
  C:\Windows\System\XdKdXKj.exe
  2⤵
  PID:5124
- C:\Windows\System\WeRDuEH.exe
  C:\Windows\System\WeRDuEH.exe
  2⤵
  PID:5376
- C:\Windows\System\kYVUYhP.exe
  C:\Windows\System\kYVUYhP.exe
  2⤵
  PID:5232
- C:\Windows\System\FzrUDhR.exe
  C:\Windows\System\FzrUDhR.exe
  2⤵
  PID:5448
- C:\Windows\System\CKyPvHu.exe
  C:\Windows\System\CKyPvHu.exe
  2⤵
  PID:5540
- C:\Windows\System\LpXOsKq.exe
  C:\Windows\System\LpXOsKq.exe
  2⤵
  PID:5696
- C:\Windows\System\OWKZPqy.exe
  C:\Windows\System\OWKZPqy.exe
  2⤵
  PID:5812
- C:\Windows\System\bWEbymX.exe
  C:\Windows\System\bWEbymX.exe
  2⤵
  PID:5912
- C:\Windows\System\myWuocP.exe
  C:\Windows\System\myWuocP.exe
  2⤵
  PID:5808
- C:\Windows\System\PtcJiyL.exe
  C:\Windows\System\PtcJiyL.exe
  2⤵
  PID:5956
- C:\Windows\System\RKBcBdM.exe
  C:\Windows\System\RKBcBdM.exe
  2⤵
  PID:4188
- C:\Windows\System\FSBsAiK.exe
  C:\Windows\System\FSBsAiK.exe
  2⤵
  PID:4184
- C:\Windows\System\bvjEjJM.exe
  C:\Windows\System\bvjEjJM.exe
  2⤵
  PID:4848
- C:\Windows\System\qfCPhSo.exe
  C:\Windows\System\qfCPhSo.exe
  2⤵
  PID:5304
- C:\Windows\System\ywXwHKk.exe
  C:\Windows\System\ywXwHKk.exe
  2⤵
  PID:5196
- C:\Windows\System\wvyGRfx.exe
  C:\Windows\System\wvyGRfx.exe
  2⤵
  PID:5256
- C:\Windows\System\vgKaYRH.exe
  C:\Windows\System\vgKaYRH.exe
  2⤵
  PID:5776
- C:\Windows\System\MizCbiJ.exe
  C:\Windows\System\MizCbiJ.exe
  2⤵
  PID:5760
- C:\Windows\System\evZtSBP.exe
  C:\Windows\System\evZtSBP.exe
  2⤵
  PID:6092
- C:\Windows\System\qAblqVC.exe
  C:\Windows\System\qAblqVC.exe
  2⤵
  PID:5640
- C:\Windows\System\KiUBxfv.exe
  C:\Windows\System\KiUBxfv.exe
  2⤵
  PID:5428
- C:\Windows\System\tvpHLkY.exe
  C:\Windows\System\tvpHLkY.exe
  2⤵
  PID:6108
- C:\Windows\System\tofXVzu.exe
  C:\Windows\System\tofXVzu.exe
  2⤵
  PID:6008
- C:\Windows\System\SSRghEp.exe
  C:\Windows\System\SSRghEp.exe
  2⤵
  PID:5328
- C:\Windows\System\iEUVIxc.exe
  C:\Windows\System\iEUVIxc.exe
  2⤵
  PID:3120
- C:\Windows\System\vWeNjzK.exe
  C:\Windows\System\vWeNjzK.exe
  2⤵
  PID:5600
- C:\Windows\System\eHCSRnd.exe
  C:\Windows\System\eHCSRnd.exe
  2⤵
  PID:5440
- C:\Windows\System\TFNFRFL.exe
  C:\Windows\System\TFNFRFL.exe
  2⤵
  PID:5516
- C:\Windows\System\adqqLzW.exe
  C:\Windows\System\adqqLzW.exe
  2⤵
  PID:2916
- C:\Windows\System\jjZtOZn.exe
  C:\Windows\System\jjZtOZn.exe
  2⤵
  PID:4324
- C:\Windows\System\fnEwlHa.exe
  C:\Windows\System\fnEwlHa.exe
  2⤵
  PID:5396
- C:\Windows\System\nmhIvTF.exe
  C:\Windows\System\nmhIvTF.exe
  2⤵
  PID:5400
- C:\Windows\System\YBhEWRr.exe
  C:\Windows\System\YBhEWRr.exe
  2⤵
  PID:4072
- C:\Windows\System\ESygouy.exe
  C:\Windows\System\ESygouy.exe
  2⤵
  PID:5928
- C:\Windows\System\WehADaY.exe
  C:\Windows\System\WehADaY.exe
  2⤵
  PID:5424
- C:\Windows\System\KKBCWsY.exe
  C:\Windows\System\KKBCWsY.exe
  2⤵
  PID:5500
- C:\Windows\System\fAPfyAU.exe
  C:\Windows\System\fAPfyAU.exe
  2⤵
  PID:5708
- C:\Windows\System\WUNKRnZ.exe
  C:\Windows\System\WUNKRnZ.exe
  2⤵
  PID:5620
- C:\Windows\System\HInOFiz.exe
  C:\Windows\System\HInOFiz.exe
  2⤵
  PID:6152
- C:\Windows\System\OOxKFOy.exe
  C:\Windows\System\OOxKFOy.exe
  2⤵
  PID:6172
- C:\Windows\System\BUhBXGV.exe
  C:\Windows\System\BUhBXGV.exe
  2⤵
  PID:6188
- C:\Windows\System\YKAEyxS.exe
  C:\Windows\System\YKAEyxS.exe
  2⤵
  PID:6204
- C:\Windows\System\ToyPJEm.exe
  C:\Windows\System\ToyPJEm.exe
  2⤵
  PID:6220
- C:\Windows\System\XCiblmp.exe
  C:\Windows\System\XCiblmp.exe
  2⤵
  PID:6240
- C:\Windows\System\jdexVKg.exe
  C:\Windows\System\jdexVKg.exe
  2⤵
  PID:6256
- C:\Windows\System\ylHXJhh.exe
  C:\Windows\System\ylHXJhh.exe
  2⤵
  PID:6272
- C:\Windows\System\FyobzCN.exe
  C:\Windows\System\FyobzCN.exe
  2⤵
  PID:6288
- C:\Windows\System\NwCXJEk.exe
  C:\Windows\System\NwCXJEk.exe
  2⤵
  PID:6308
- C:\Windows\System\bXSveqB.exe
  C:\Windows\System\bXSveqB.exe
  2⤵
  PID:6328
- C:\Windows\System\NZvXIfA.exe
  C:\Windows\System\NZvXIfA.exe
  2⤵
  PID:6380
- C:\Windows\System\eTobzku.exe
  C:\Windows\System\eTobzku.exe
  2⤵
  PID:6396
- C:\Windows\System\ibFotzL.exe
  C:\Windows\System\ibFotzL.exe
  2⤵
  PID:6412
- C:\Windows\System\weKlhuH.exe
  C:\Windows\System\weKlhuH.exe
  2⤵
  PID:6428
- C:\Windows\System\OPGxmBh.exe
  C:\Windows\System\OPGxmBh.exe
  2⤵
  PID:6448
- C:\Windows\System\GsNsQht.exe
  C:\Windows\System\GsNsQht.exe
  2⤵
  PID:6464
- C:\Windows\System\RQIwpxk.exe
  C:\Windows\System\RQIwpxk.exe
  2⤵
  PID:6480
- C:\Windows\System\PuvXiXt.exe
  C:\Windows\System\PuvXiXt.exe
  2⤵
  PID:6496
- C:\Windows\System\SZzuuSp.exe
  C:\Windows\System\SZzuuSp.exe
  2⤵
  PID:6516
- C:\Windows\System\IAdnWwf.exe
  C:\Windows\System\IAdnWwf.exe
  2⤵
  PID:6532
- C:\Windows\System\YmFFAEb.exe
  C:\Windows\System\YmFFAEb.exe
  2⤵
  PID:6548
- C:\Windows\System\oNqajbW.exe
  C:\Windows\System\oNqajbW.exe
  2⤵
  PID:6564
- C:\Windows\System\nXfhOcD.exe
  C:\Windows\System\nXfhOcD.exe
  2⤵
  PID:6580
- C:\Windows\System\vSeNrTF.exe
  C:\Windows\System\vSeNrTF.exe
  2⤵
  PID:6596
- C:\Windows\System\KblphLI.exe
  C:\Windows\System\KblphLI.exe
  2⤵
  PID:6612
- C:\Windows\System\SutBmnz.exe
  C:\Windows\System\SutBmnz.exe
  2⤵
  PID:6628
- C:\Windows\System\kEzzQkh.exe
  C:\Windows\System\kEzzQkh.exe
  2⤵
  PID:6644
- C:\Windows\System\FugRmvC.exe
  C:\Windows\System\FugRmvC.exe
  2⤵
  PID:6660
- C:\Windows\System\ESXrTeg.exe
  C:\Windows\System\ESXrTeg.exe
  2⤵
  PID:6812
- C:\Windows\System\VpURRIF.exe
  C:\Windows\System\VpURRIF.exe
  2⤵
  PID:6828
- C:\Windows\System\EkRHeEv.exe
  C:\Windows\System\EkRHeEv.exe
  2⤵
  PID:6844
- C:\Windows\System\xgqwNKV.exe
  C:\Windows\System\xgqwNKV.exe
  2⤵
  PID:6860
- C:\Windows\System\rImYDZD.exe
  C:\Windows\System\rImYDZD.exe
  2⤵
  PID:6876
- C:\Windows\System\EkMtPaE.exe
  C:\Windows\System\EkMtPaE.exe
  2⤵
  PID:6896
- C:\Windows\System\QsaCPPM.exe
  C:\Windows\System\QsaCPPM.exe
  2⤵
  PID:6912
- C:\Windows\System\PGQEcOB.exe
  C:\Windows\System\PGQEcOB.exe
  2⤵
  PID:6928
- C:\Windows\System\WtVaIOT.exe
  C:\Windows\System\WtVaIOT.exe
  2⤵
  PID:6968
- C:\Windows\System\evfrpmD.exe
  C:\Windows\System\evfrpmD.exe
  2⤵
  PID:6988
- C:\Windows\System\FdNlkPB.exe
  C:\Windows\System\FdNlkPB.exe
  2⤵
  PID:7004
- C:\Windows\System\kTvfHrV.exe
  C:\Windows\System\kTvfHrV.exe
  2⤵
  PID:7020
- C:\Windows\System\qOmtJKu.exe
  C:\Windows\System\qOmtJKu.exe
  2⤵
  PID:7036
- C:\Windows\System\GYErTji.exe
  C:\Windows\System\GYErTji.exe
  2⤵
  PID:7052
- C:\Windows\System\aUAVZhW.exe
  C:\Windows\System\aUAVZhW.exe
  2⤵
  PID:7068
- C:\Windows\System\osBwOCz.exe
  C:\Windows\System\osBwOCz.exe
  2⤵
  PID:7088
- C:\Windows\System\OyIUFbO.exe
  C:\Windows\System\OyIUFbO.exe
  2⤵
  PID:7104
- C:\Windows\System\oEpVHCl.exe
  C:\Windows\System\oEpVHCl.exe
  2⤵
  PID:7120
- C:\Windows\System\JvxIIlr.exe
  C:\Windows\System\JvxIIlr.exe
  2⤵
  PID:7136
- C:\Windows\System\jFOgyVn.exe
  C:\Windows\System\jFOgyVn.exe
  2⤵
  PID:7152
- C:\Windows\System\WymBKvY.exe
  C:\Windows\System\WymBKvY.exe
  2⤵
  PID:5300
- C:\Windows\System\LpIAyok.exe
  C:\Windows\System\LpIAyok.exe
  2⤵
  PID:5892
- C:\Windows\System\XVKoXLe.exe
  C:\Windows\System\XVKoXLe.exe
  2⤵
  PID:6160
- C:\Windows\System\yUqJHuE.exe
  C:\Windows\System\yUqJHuE.exe
  2⤵
  PID:6228
- C:\Windows\System\QssgQPj.exe
  C:\Windows\System\QssgQPj.exe
  2⤵
  PID:6296
- C:\Windows\System\nTKCUGO.exe
  C:\Windows\System\nTKCUGO.exe
  2⤵
  PID:5648
- C:\Windows\System\cRBBDEY.exe
  C:\Windows\System\cRBBDEY.exe
  2⤵
  PID:6360
- C:\Windows\System\VKEOyqO.exe
  C:\Windows\System\VKEOyqO.exe
  2⤵
  PID:6300
- C:\Windows\System\CotgoHy.exe
  C:\Windows\System\CotgoHy.exe
  2⤵
  PID:6356
- C:\Windows\System\NmlUYyx.exe
  C:\Windows\System\NmlUYyx.exe
  2⤵
  PID:4900
- C:\Windows\System\MODHElR.exe
  C:\Windows\System\MODHElR.exe
  2⤵
  PID:5316
- C:\Windows\System\ssDaHrn.exe
  C:\Windows\System\ssDaHrn.exe
  2⤵
  PID:5644
- C:\Windows\System\SsBvOYk.exe
  C:\Windows\System\SsBvOYk.exe
  2⤵
  PID:6180
- C:\Windows\System\aPoWtvm.exe
  C:\Windows\System\aPoWtvm.exe
  2⤵
  PID:6340
- C:\Windows\System\aWIovBN.exe
  C:\Windows\System\aWIovBN.exe
  2⤵
  PID:5184
- C:\Windows\System\enCOLnl.exe
  C:\Windows\System\enCOLnl.exe
  2⤵
  PID:6544
- C:\Windows\System\vGmSELe.exe
  C:\Windows\System\vGmSELe.exe
  2⤵
  PID:6608
- C:\Windows\System\XQaiHXD.exe
  C:\Windows\System\XQaiHXD.exe
  2⤵
  PID:6668
- C:\Windows\System\JnAnwgG.exe
  C:\Windows\System\JnAnwgG.exe
  2⤵
  PID:6392
- C:\Windows\System\sIazElZ.exe
  C:\Windows\System\sIazElZ.exe
  2⤵
  PID:6460
- C:\Windows\System\EyhKBYq.exe
  C:\Windows\System\EyhKBYq.exe
  2⤵
  PID:6652
- C:\Windows\System\EUZfSro.exe
  C:\Windows\System\EUZfSro.exe
  2⤵
  PID:6692
- C:\Windows\System\WlJnSEO.exe
  C:\Windows\System\WlJnSEO.exe
  2⤵
  PID:6712
- C:\Windows\System\xwRdGSr.exe
  C:\Windows\System\xwRdGSr.exe
  2⤵
  PID:6728
- C:\Windows\System\zKITVrT.exe
  C:\Windows\System\zKITVrT.exe
  2⤵
  PID:6756
- C:\Windows\System\MHhwZIX.exe
  C:\Windows\System\MHhwZIX.exe
  2⤵
  PID:6748
- C:\Windows\System\Vezscdn.exe
  C:\Windows\System\Vezscdn.exe
  2⤵
  PID:6784
- C:\Windows\System\dqTbMPv.exe
  C:\Windows\System\dqTbMPv.exe
  2⤵
  PID:6800
- C:\Windows\System\VzOKfpM.exe
  C:\Windows\System\VzOKfpM.exe
  2⤵
  PID:6836
- C:\Windows\System\ikYmbvA.exe
  C:\Windows\System\ikYmbvA.exe
  2⤵
  PID:6872
- C:\Windows\System\pioFXCP.exe
  C:\Windows\System\pioFXCP.exe
  2⤵
  PID:6884
- C:\Windows\System\YiiCFUh.exe
  C:\Windows\System\YiiCFUh.exe
  2⤵
  PID:6904
- C:\Windows\System\KqQvUSk.exe
  C:\Windows\System\KqQvUSk.exe
  2⤵
  PID:6952
- C:\Windows\System\VlLwiTx.exe
  C:\Windows\System\VlLwiTx.exe
  2⤵
  PID:6996
- C:\Windows\System\qoeWrPB.exe
  C:\Windows\System\qoeWrPB.exe
  2⤵
  PID:6236
- C:\Windows\System\TlLiblJ.exe
  C:\Windows\System\TlLiblJ.exe
  2⤵
  PID:6352
- C:\Windows\System\UlGWEwi.exe
  C:\Windows\System\UlGWEwi.exe
  2⤵
  PID:6980
- C:\Windows\System\uyXAScL.exe
  C:\Windows\System\uyXAScL.exe
  2⤵
  PID:6120
- C:\Windows\System\paWbpBR.exe
  C:\Windows\System\paWbpBR.exe
  2⤵
  PID:7100
- C:\Windows\System\jYpSiCf.exe
  C:\Windows\System\jYpSiCf.exe
  2⤵
  PID:5604
- C:\Windows\System\slaxucU.exe
  C:\Windows\System\slaxucU.exe
  2⤵
  PID:6252
- C:\Windows\System\imiBYZr.exe
  C:\Windows\System\imiBYZr.exe
  2⤵
  PID:5364
- C:\Windows\System\iGQGyPe.exe
  C:\Windows\System\iGQGyPe.exe
  2⤵
  PID:6232
- C:\Windows\System\YeCtIDF.exe
  C:\Windows\System\YeCtIDF.exe
  2⤵
  PID:6576
- C:\Windows\System\OroEymJ.exe
  C:\Windows\System\OroEymJ.exe
  2⤵
  PID:6200
- C:\Windows\System\EBSCFca.exe
  C:\Windows\System\EBSCFca.exe
  2⤵
  PID:6104
- C:\Windows\System\QFeMwuZ.exe
  C:\Windows\System\QFeMwuZ.exe
  2⤵
  PID:6512
- C:\Windows\System\QbLZYhz.exe
  C:\Windows\System\QbLZYhz.exe
  2⤵
  PID:6680
- C:\Windows\System\NWHGwtg.exe
  C:\Windows\System\NWHGwtg.exe
  2⤵
  PID:6588
- C:\Windows\System\LWwYslG.exe
  C:\Windows\System\LWwYslG.exe
  2⤵
  PID:6528
- C:\Windows\System\NZlahkE.exe
  C:\Windows\System\NZlahkE.exe
  2⤵
  PID:6736
- C:\Windows\System\KBBUyfH.exe
  C:\Windows\System\KBBUyfH.exe
  2⤵
  PID:6780
- C:\Windows\System\EVaqNKm.exe
  C:\Windows\System\EVaqNKm.exe
  2⤵
  PID:5408
- C:\Windows\System\xQqMhqs.exe
  C:\Windows\System\xQqMhqs.exe
  2⤵
  PID:6948
- C:\Windows\System\uuPvYgC.exe
  C:\Windows\System\uuPvYgC.exe
  2⤵
  PID:6688
- C:\Windows\System\pwklYDJ.exe
  C:\Windows\System\pwklYDJ.exe
  2⤵
  PID:6744
- C:\Windows\System\rMtMVqD.exe
  C:\Windows\System\rMtMVqD.exe
  2⤵
  PID:6824
- C:\Windows\System\SzFcvCP.exe
  C:\Windows\System\SzFcvCP.exe
  2⤵
  PID:6960
- C:\Windows\System\vbNqYij.exe
  C:\Windows\System\vbNqYij.exe
  2⤵
  PID:7032
- C:\Windows\System\oEHmuMI.exe
  C:\Windows\System\oEHmuMI.exe
  2⤵
  PID:6976
- C:\Windows\System\nMCiKoZ.exe
  C:\Windows\System\nMCiKoZ.exe
  2⤵
  PID:6436
- C:\Windows\System\yjpkmoN.exe
  C:\Windows\System\yjpkmoN.exe
  2⤵
  PID:6388
- C:\Windows\System\yNjwcWr.exe
  C:\Windows\System\yNjwcWr.exe
  2⤵
  PID:6440
- C:\Windows\System\hrVThKL.exe
  C:\Windows\System\hrVThKL.exe
  2⤵
  PID:7084
- C:\Windows\System\jFGafzM.exe
  C:\Windows\System\jFGafzM.exe
  2⤵
  PID:7116
- C:\Windows\System\qNYzYDJ.exe
  C:\Windows\System\qNYzYDJ.exe
  2⤵
  PID:6604
- C:\Windows\System\PyXlJJR.exe
  C:\Windows\System\PyXlJJR.exe
  2⤵
  PID:4400
- C:\Windows\System\MTuwAXQ.exe
  C:\Windows\System\MTuwAXQ.exe
  2⤵
  PID:5156
- C:\Windows\System\IzTSJkB.exe
  C:\Windows\System\IzTSJkB.exe
  2⤵
  PID:6472
- C:\Windows\System\TifraDB.exe
  C:\Windows\System\TifraDB.exe
  2⤵
  PID:6508
- C:\Windows\System\SerlFDm.exe
  C:\Windows\System\SerlFDm.exe
  2⤵
  PID:6620
- C:\Windows\System\unseAFF.exe
  C:\Windows\System\unseAFF.exe
  2⤵
  PID:6676
- C:\Windows\System\vFDoBkb.exe
  C:\Windows\System\vFDoBkb.exe
  2⤵
  PID:6964
- C:\Windows\System\QmMkStn.exe
  C:\Windows\System\QmMkStn.exe
  2⤵
  PID:7144
- C:\Windows\System\gbhwaYP.exe
  C:\Windows\System\gbhwaYP.exe
  2⤵
  PID:7132
- C:\Windows\System\MqYNehn.exe
  C:\Windows\System\MqYNehn.exe
  2⤵
  PID:5236
- C:\Windows\System\jnTsbMq.exe
  C:\Windows\System\jnTsbMq.exe
  2⤵
  PID:5496
- C:\Windows\System\xUQMOoL.exe
  C:\Windows\System\xUQMOoL.exe
  2⤵
  PID:6776
- C:\Windows\System\lXGBMId.exe
  C:\Windows\System\lXGBMId.exe
  2⤵
  PID:7080
- C:\Windows\System\NeqMjoG.exe
  C:\Windows\System\NeqMjoG.exe
  2⤵
  PID:6560
- C:\Windows\System\auCxrCM.exe
  C:\Windows\System\auCxrCM.exe
  2⤵
  PID:4432
- C:\Windows\System\kgKDjEJ.exe
  C:\Windows\System\kgKDjEJ.exe
  2⤵
  PID:6504
- C:\Windows\System\JApsfud.exe
  C:\Windows\System\JApsfud.exe
  2⤵
  PID:6804
- C:\Windows\System\VWNDKba.exe
  C:\Windows\System\VWNDKba.exe
  2⤵
  PID:7172
- C:\Windows\System\BqRrkgU.exe
  C:\Windows\System\BqRrkgU.exe
  2⤵
  PID:7192
- C:\Windows\System\QfabVDW.exe
  C:\Windows\System\QfabVDW.exe
  2⤵
  PID:7208
- C:\Windows\System\oIfbwcn.exe
  C:\Windows\System\oIfbwcn.exe
  2⤵
  PID:7332
- C:\Windows\System\knqWKpU.exe
  C:\Windows\System\knqWKpU.exe
  2⤵
  PID:7348
- C:\Windows\System\qQImNUm.exe
  C:\Windows\System\qQImNUm.exe
  2⤵
  PID:7364
- C:\Windows\System\gewhoQW.exe
  C:\Windows\System\gewhoQW.exe
  2⤵
  PID:7380
- C:\Windows\System\ozQUzmV.exe
  C:\Windows\System\ozQUzmV.exe
  2⤵
  PID:7400
- C:\Windows\System\izoomkE.exe
  C:\Windows\System\izoomkE.exe
  2⤵
  PID:7416
- C:\Windows\System\XEVvHhk.exe
  C:\Windows\System\XEVvHhk.exe
  2⤵
  PID:7432
- C:\Windows\System\UMLeMOo.exe
  C:\Windows\System\UMLeMOo.exe
  2⤵
  PID:7448
- C:\Windows\System\hgnBjNd.exe
  C:\Windows\System\hgnBjNd.exe
  2⤵
  PID:7464
- C:\Windows\System\uJkOtmt.exe
  C:\Windows\System\uJkOtmt.exe
  2⤵
  PID:7512
- C:\Windows\System\YDbXrGx.exe
  C:\Windows\System\YDbXrGx.exe
  2⤵
  PID:7532
- C:\Windows\System\leKNtZP.exe
  C:\Windows\System\leKNtZP.exe
  2⤵
  PID:7548
- C:\Windows\System\yNBhFzq.exe
  C:\Windows\System\yNBhFzq.exe
  2⤵
  PID:7564
- C:\Windows\System\ogLBImj.exe
  C:\Windows\System\ogLBImj.exe
  2⤵
  PID:7580
- C:\Windows\System\oloUeyM.exe
  C:\Windows\System\oloUeyM.exe
  2⤵
  PID:7604
- C:\Windows\System\NMAVYdU.exe
  C:\Windows\System\NMAVYdU.exe
  2⤵
  PID:7620
- C:\Windows\System\bNwlQPg.exe
  C:\Windows\System\bNwlQPg.exe
  2⤵
  PID:7636
- C:\Windows\System\ermBjkE.exe
  C:\Windows\System\ermBjkE.exe
  2⤵
  PID:7652
- C:\Windows\System\nRlVaaH.exe
  C:\Windows\System\nRlVaaH.exe
  2⤵
  PID:7716
- C:\Windows\System\riaFeoc.exe
  C:\Windows\System\riaFeoc.exe
  2⤵
  PID:7732
- C:\Windows\System\bSzSPZd.exe
  C:\Windows\System\bSzSPZd.exe
  2⤵
  PID:7748
- C:\Windows\System\gtOpBMe.exe
  C:\Windows\System\gtOpBMe.exe
  2⤵
  PID:7764
- C:\Windows\System\ggpHWek.exe
  C:\Windows\System\ggpHWek.exe
  2⤵
  PID:7780
- C:\Windows\System\iGONbjb.exe
  C:\Windows\System\iGONbjb.exe
  2⤵
  PID:7796
- C:\Windows\System\BOpKJKX.exe
  C:\Windows\System\BOpKJKX.exe
  2⤵
  PID:7812
- C:\Windows\System\XsNYZzf.exe
  C:\Windows\System\XsNYZzf.exe
  2⤵
  PID:7828
- C:\Windows\System\lOeURaK.exe
  C:\Windows\System\lOeURaK.exe
  2⤵
  PID:7848
- C:\Windows\System\IHUHmVM.exe
  C:\Windows\System\IHUHmVM.exe
  2⤵
  PID:7868
- C:\Windows\System\yQEIlfa.exe
  C:\Windows\System\yQEIlfa.exe
  2⤵
  PID:7884
- C:\Windows\System\vjJoYGN.exe
  C:\Windows\System\vjJoYGN.exe
  2⤵
  PID:7904
- C:\Windows\System\MSkIQEI.exe
  C:\Windows\System\MSkIQEI.exe
  2⤵
  PID:7956
- C:\Windows\System\rGfHTGg.exe
  C:\Windows\System\rGfHTGg.exe
  2⤵
  PID:7972
- C:\Windows\System\AKMlnDL.exe
  C:\Windows\System\AKMlnDL.exe
  2⤵
  PID:7988
- C:\Windows\System\WFussBb.exe
  C:\Windows\System\WFussBb.exe
  2⤵
  PID:8004
- C:\Windows\System\ZuGfsHZ.exe
  C:\Windows\System\ZuGfsHZ.exe
  2⤵
  PID:8024
- C:\Windows\System\cORhpXk.exe
  C:\Windows\System\cORhpXk.exe
  2⤵
  PID:8040
- C:\Windows\System\IDCMpPG.exe
  C:\Windows\System\IDCMpPG.exe
  2⤵
  PID:8056
- C:\Windows\System\yPQclrV.exe
  C:\Windows\System\yPQclrV.exe
  2⤵
  PID:8072
- C:\Windows\System\jwVagca.exe
  C:\Windows\System\jwVagca.exe
  2⤵
  PID:8120
- C:\Windows\System\MYTYglY.exe
  C:\Windows\System\MYTYglY.exe
  2⤵
  PID:8136
- C:\Windows\System\qrAUYdo.exe
  C:\Windows\System\qrAUYdo.exe
  2⤵
  PID:8152
- C:\Windows\System\LHtrdeu.exe
  C:\Windows\System\LHtrdeu.exe
  2⤵
  PID:6320
- C:\Windows\System\uEPskFh.exe
  C:\Windows\System\uEPskFh.exe
  2⤵
  PID:5712
- C:\Windows\System\PEhSqLu.exe
  C:\Windows\System\PEhSqLu.exe
  2⤵
  PID:7228
- C:\Windows\System\KncVIeC.exe
  C:\Windows\System\KncVIeC.exe
  2⤵
  PID:7244
- C:\Windows\System\Xanrtxh.exe
  C:\Windows\System\Xanrtxh.exe
  2⤵
  PID:7264
- C:\Windows\System\XDDVzAa.exe
  C:\Windows\System\XDDVzAa.exe
  2⤵
  PID:7280
- C:\Windows\System\XqhiqDf.exe
  C:\Windows\System\XqhiqDf.exe
  2⤵
  PID:7300
- C:\Windows\System\SegKNoh.exe
  C:\Windows\System\SegKNoh.exe
  2⤵
  PID:7112
- C:\Windows\System\PxQsHuX.exe
  C:\Windows\System\PxQsHuX.exe
  2⤵
  PID:6196
- C:\Windows\System\ZtIRhHZ.exe
  C:\Windows\System\ZtIRhHZ.exe
  2⤵
  PID:7308
- C:\Windows\System\oltxQBn.exe
  C:\Windows\System\oltxQBn.exe
  2⤵
  PID:6336
- C:\Windows\System\vmQPdpM.exe
  C:\Windows\System\vmQPdpM.exe
  2⤵
  PID:7324
- C:\Windows\System\lHHXVUA.exe
  C:\Windows\System\lHHXVUA.exe
  2⤵
  PID:7388
- C:\Windows\System\vPcCebr.exe
  C:\Windows\System\vPcCebr.exe
  2⤵
  PID:7424
- C:\Windows\System\jRiYRRm.exe
  C:\Windows\System\jRiYRRm.exe
  2⤵
  PID:7376
- C:\Windows\System\cHTHpol.exe
  C:\Windows\System\cHTHpol.exe
  2⤵
  PID:7480
- C:\Windows\System\TnGEhTx.exe
  C:\Windows\System\TnGEhTx.exe
  2⤵
  PID:7496
- C:\Windows\System\WcsVSKu.exe
  C:\Windows\System\WcsVSKu.exe
  2⤵
  PID:7444
- C:\Windows\System\tCdsSPj.exe
  C:\Windows\System\tCdsSPj.exe
  2⤵
  PID:7508
- C:\Windows\System\ufqPIbX.exe
  C:\Windows\System\ufqPIbX.exe
  2⤵
  PID:7592
- C:\Windows\System\BkqPYHe.exe
  C:\Windows\System\BkqPYHe.exe
  2⤵
  PID:7628
- C:\Windows\System\eEterky.exe
  C:\Windows\System\eEterky.exe
  2⤵
  PID:7596
- C:\Windows\System\okSFRqE.exe
  C:\Windows\System\okSFRqE.exe
  2⤵
  PID:7676
- C:\Windows\System\rKejgRF.exe
  C:\Windows\System\rKejgRF.exe
  2⤵
  PID:7696
- C:\Windows\System\zrQVoPk.exe
  C:\Windows\System\zrQVoPk.exe
  2⤵
  PID:7712
- C:\Windows\System\btLJYSz.exe
  C:\Windows\System\btLJYSz.exe
  2⤵
  PID:7772
- C:\Windows\System\xcByaBZ.exe
  C:\Windows\System\xcByaBZ.exe
  2⤵
  PID:7840
- C:\Windows\System\HmKeyeV.exe
  C:\Windows\System\HmKeyeV.exe
  2⤵
  PID:7876
- C:\Windows\System\NQgUTOx.exe
  C:\Windows\System\NQgUTOx.exe
  2⤵
  PID:7916
- C:\Windows\System\pLMeEtv.exe
  C:\Windows\System\pLMeEtv.exe
  2⤵
  PID:7932
- C:\Windows\System\JxzvOxW.exe
  C:\Windows\System\JxzvOxW.exe
  2⤵
  PID:7760
- C:\Windows\System\YpSiTUg.exe
  C:\Windows\System\YpSiTUg.exe
  2⤵
  PID:7864
- C:\Windows\System\jZeAioz.exe
  C:\Windows\System\jZeAioz.exe
  2⤵
  PID:7824
- C:\Windows\System\MHQGJae.exe
  C:\Windows\System\MHQGJae.exe
  2⤵
  PID:7952
- C:\Windows\System\iuLOJQQ.exe
  C:\Windows\System\iuLOJQQ.exe
  2⤵
  PID:7980
- C:\Windows\System\VbwxFyj.exe
  C:\Windows\System\VbwxFyj.exe
  2⤵
  PID:8000
- C:\Windows\System\SmuEVFK.exe
  C:\Windows\System\SmuEVFK.exe
  2⤵
  PID:8020
- C:\Windows\System\vKWptwA.exe
  C:\Windows\System\vKWptwA.exe
  2⤵
  PID:8092
- C:\Windows\System\mKarrBG.exe
  C:\Windows\System\mKarrBG.exe
  2⤵
  PID:8036
- C:\Windows\System\ESQTbXX.exe
  C:\Windows\System\ESQTbXX.exe
  2⤵
  PID:8144
- C:\Windows\System\JcPjlRb.exe
  C:\Windows\System\JcPjlRb.exe
  2⤵
  PID:8132
- C:\Windows\System\Qdoaahs.exe
  C:\Windows\System\Qdoaahs.exe
  2⤵
  PID:8176
- C:\Windows\System\fAtenMO.exe
  C:\Windows\System\fAtenMO.exe
  2⤵
  PID:6684
- C:\Windows\System\oTeMpmL.exe
  C:\Windows\System\oTeMpmL.exe
  2⤵
  PID:7316
- C:\Windows\System\uQAGOyu.exe
  C:\Windows\System\uQAGOyu.exe
  2⤵
  PID:7236
- C:\Windows\System\ufPEMkT.exe
  C:\Windows\System\ufPEMkT.exe
  2⤵
  PID:7276
- C:\Windows\System\kVxSWOm.exe
  C:\Windows\System\kVxSWOm.exe
  2⤵
  PID:7340
- C:\Windows\System\HSrXyja.exe
  C:\Windows\System\HSrXyja.exe
  2⤵
  PID:7660
- C:\Windows\System\WtUpvgR.exe
  C:\Windows\System\WtUpvgR.exe
  2⤵
  PID:7180
- C:\Windows\System\uqExRFw.exe
  C:\Windows\System\uqExRFw.exe
  2⤵
  PID:7268
- C:\Windows\System\rcNaPSX.exe
  C:\Windows\System\rcNaPSX.exe
  2⤵
  PID:5952
- C:\Windows\System\CrIcfCn.exe
  C:\Windows\System\CrIcfCn.exe
  2⤵
  PID:7200
- C:\Windows\System\VgkBhyF.exe
  C:\Windows\System\VgkBhyF.exe
  2⤵
  PID:7428
- C:\Windows\System\ZkXAJeF.exe
  C:\Windows\System\ZkXAJeF.exe
  2⤵
  PID:7504
- C:\Windows\System\RNEwiFu.exe
  C:\Windows\System\RNEwiFu.exe
  2⤵
  PID:7616
- C:\Windows\System\QarQNDK.exe
  C:\Windows\System\QarQNDK.exe
  2⤵
  PID:7612
- C:\Windows\System\HYseFvg.exe
  C:\Windows\System\HYseFvg.exe
  2⤵
  PID:8172
- C:\Windows\System\MaWjftI.exe
  C:\Windows\System\MaWjftI.exe
  2⤵
  PID:7672
- C:\Windows\System\kfLPgUe.exe
  C:\Windows\System\kfLPgUe.exe
  2⤵
  PID:7756
- C:\Windows\System\xcUZzDf.exe
  C:\Windows\System\xcUZzDf.exe
  2⤵
  PID:7900
- C:\Windows\System\SOzvwjM.exe
  C:\Windows\System\SOzvwjM.exe
  2⤵
  PID:8080
- C:\Windows\System\uxUfwLm.exe
  C:\Windows\System\uxUfwLm.exe
  2⤵
  PID:5180
- C:\Windows\System\FFhnGWt.exe
  C:\Windows\System\FFhnGWt.exe
  2⤵
  PID:7912
- C:\Windows\System\LjwhAxt.exe
  C:\Windows\System\LjwhAxt.exe
  2⤵
  PID:7372
- C:\Windows\System\srOqXhT.exe
  C:\Windows\System\srOqXhT.exe
  2⤵
  PID:7632
- C:\Windows\System\eFsGocD.exe
  C:\Windows\System\eFsGocD.exe
  2⤵
  PID:7492
- C:\Windows\System\FmyFnZp.exe
  C:\Windows\System\FmyFnZp.exe
  2⤵
  PID:7292
- C:\Windows\System\RJKClPJ.exe
  C:\Windows\System\RJKClPJ.exe
  2⤵
  PID:7684
- C:\Windows\System\kEUyFsi.exe
  C:\Windows\System\kEUyFsi.exe
  2⤵
  PID:7360
- C:\Windows\System\PFMbPTi.exe
  C:\Windows\System\PFMbPTi.exe
  2⤵
  PID:7740
- C:\Windows\System\PQjEwTz.exe
  C:\Windows\System\PQjEwTz.exe
  2⤵
  PID:7728
- C:\Windows\System\LNISSOh.exe
  C:\Windows\System\LNISSOh.exe
  2⤵
  PID:7856
- C:\Windows\System\fUWlNPk.exe
  C:\Windows\System\fUWlNPk.exe
  2⤵
  PID:8012
- C:\Windows\System\NFwpFew.exe
  C:\Windows\System\NFwpFew.exe
  2⤵
  PID:7572
- C:\Windows\System\mXBRhif.exe
  C:\Windows\System\mXBRhif.exe
  2⤵
  PID:7896
- C:\Windows\System\SBABuGz.exe
  C:\Windows\System\SBABuGz.exe
  2⤵
  PID:7272
- C:\Windows\System\QwZiYFt.exe
  C:\Windows\System\QwZiYFt.exe
  2⤵
  PID:7096
- C:\Windows\System\yQnWrJr.exe
  C:\Windows\System\yQnWrJr.exe
  2⤵
  PID:7216
- C:\Windows\System\xMUOBVQ.exe
  C:\Windows\System\xMUOBVQ.exe
  2⤵
  PID:8168
- C:\Windows\System\mqKkaGf.exe
  C:\Windows\System\mqKkaGf.exe
  2⤵
  PID:7776
- C:\Windows\System\OJaLQGn.exe
  C:\Windows\System\OJaLQGn.exe
  2⤵
  PID:6280
- C:\Windows\System\ARalMvg.exe
  C:\Windows\System\ARalMvg.exe
  2⤵
  PID:8064
- C:\Windows\System\VgOxNLT.exe
  C:\Windows\System\VgOxNLT.exe
  2⤵
  PID:8128
- C:\Windows\System\erkEmUX.exe
  C:\Windows\System\erkEmUX.exe
  2⤵
  PID:6404
- C:\Windows\System\CxmkJLk.exe
  C:\Windows\System\CxmkJLk.exe
  2⤵
  PID:7948
- C:\Windows\System\CHurBIa.exe
  C:\Windows\System\CHurBIa.exe
  2⤵
  PID:7940
- C:\Windows\System\UNYdLpj.exe
  C:\Windows\System\UNYdLpj.exe
  2⤵
  PID:7188
- C:\Windows\System\oLJPNDU.exe
  C:\Windows\System\oLJPNDU.exe
  2⤵
  PID:8116
- C:\Windows\System\xsaOwpO.exe
  C:\Windows\System\xsaOwpO.exe
  2⤵
  PID:7396
- C:\Windows\System\Vtkhzlo.exe
  C:\Windows\System\Vtkhzlo.exe
  2⤵
  PID:7556
- C:\Windows\System\fAJQdfC.exe
  C:\Windows\System\fAJQdfC.exe
  2⤵
  PID:8200
- C:\Windows\System\aRNmwOk.exe
  C:\Windows\System\aRNmwOk.exe
  2⤵
  PID:8224
- C:\Windows\System\hgntDYI.exe
  C:\Windows\System\hgntDYI.exe
  2⤵
  PID:8240
- C:\Windows\System\ueXfvLs.exe
  C:\Windows\System\ueXfvLs.exe
  2⤵
  PID:8256
- C:\Windows\System\yvDbRnb.exe
  C:\Windows\System\yvDbRnb.exe
  2⤵
  PID:8272
- C:\Windows\System\PNaCvJT.exe
  C:\Windows\System\PNaCvJT.exe
  2⤵
  PID:8288
- C:\Windows\System\lStQhVw.exe
  C:\Windows\System\lStQhVw.exe
  2⤵
  PID:8356
- C:\Windows\System\ZKUinbU.exe
  C:\Windows\System\ZKUinbU.exe
  2⤵
  PID:8372
- C:\Windows\System\BeKvbQX.exe
  C:\Windows\System\BeKvbQX.exe
  2⤵
  PID:8388
- C:\Windows\System\AmxUvEi.exe
  C:\Windows\System\AmxUvEi.exe
  2⤵
  PID:8404
- C:\Windows\System\VkwYhgC.exe
  C:\Windows\System\VkwYhgC.exe
  2⤵
  PID:8420
- C:\Windows\System\GUtwSFL.exe
  C:\Windows\System\GUtwSFL.exe
  2⤵
  PID:8436
- C:\Windows\System\kCtUPME.exe
  C:\Windows\System\kCtUPME.exe
  2⤵
  PID:8460
- C:\Windows\System\ePUSdjT.exe
  C:\Windows\System\ePUSdjT.exe
  2⤵
  PID:8476
- C:\Windows\System\jhdeRhN.exe
  C:\Windows\System\jhdeRhN.exe
  2⤵
  PID:8492
- C:\Windows\System\Tgpeytl.exe
  C:\Windows\System\Tgpeytl.exe
  2⤵
  PID:8508
- C:\Windows\System\UOaegtA.exe
  C:\Windows\System\UOaegtA.exe
  2⤵
  PID:8528
- C:\Windows\System\UBZNpKY.exe
  C:\Windows\System\UBZNpKY.exe
  2⤵
  PID:8544
- C:\Windows\System\uKZPXxY.exe
  C:\Windows\System\uKZPXxY.exe
  2⤵
  PID:8560
- C:\Windows\System\jeOUjmb.exe
  C:\Windows\System\jeOUjmb.exe
  2⤵
  PID:8580
- C:\Windows\System\SsyFzgj.exe
  C:\Windows\System\SsyFzgj.exe
  2⤵
  PID:8596
- C:\Windows\System\XFoRSFi.exe
  C:\Windows\System\XFoRSFi.exe
  2⤵
  PID:8616
- C:\Windows\System\EzLZvFn.exe
  C:\Windows\System\EzLZvFn.exe
  2⤵
  PID:8640
- C:\Windows\System\ldxjVsP.exe
  C:\Windows\System\ldxjVsP.exe
  2⤵
  PID:8656
- C:\Windows\System\nvOpQcf.exe
  C:\Windows\System\nvOpQcf.exe
  2⤵
  PID:8676
- C:\Windows\System\hfoOCYD.exe
  C:\Windows\System\hfoOCYD.exe
  2⤵
  PID:8692
- C:\Windows\System\ZhRNfKU.exe
  C:\Windows\System\ZhRNfKU.exe
  2⤵
  PID:8712
- C:\Windows\System\BgGjTeN.exe
  C:\Windows\System\BgGjTeN.exe
  2⤵
  PID:8728
- C:\Windows\System\iZSbbKj.exe
  C:\Windows\System\iZSbbKj.exe
  2⤵
  PID:8744
- C:\Windows\System\WUMaPjx.exe
  C:\Windows\System\WUMaPjx.exe
  2⤵
  PID:8760
- C:\Windows\System\jMfSTcn.exe
  C:\Windows\System\jMfSTcn.exe
  2⤵
  PID:8776
- C:\Windows\System\iGNXahf.exe
  C:\Windows\System\iGNXahf.exe
  2⤵
  PID:8792
- C:\Windows\System\NAMwZrA.exe
  C:\Windows\System\NAMwZrA.exe
  2⤵
  PID:8808
- C:\Windows\System\mGbVzCP.exe
  C:\Windows\System\mGbVzCP.exe
  2⤵
  PID:8832
- C:\Windows\System\vTluqlq.exe
  C:\Windows\System\vTluqlq.exe
  2⤵
  PID:8848
- C:\Windows\System\BPMnayB.exe
  C:\Windows\System\BPMnayB.exe
  2⤵
  PID:8864
- C:\Windows\System\tELTrdF.exe
  C:\Windows\System\tELTrdF.exe
  2⤵
  PID:8880
- C:\Windows\System\ZDSWAzL.exe
  C:\Windows\System\ZDSWAzL.exe
  2⤵
  PID:8896
- C:\Windows\System\phLrKPv.exe
  C:\Windows\System\phLrKPv.exe
  2⤵
  PID:8916
- C:\Windows\System\xOXscjB.exe
  C:\Windows\System\xOXscjB.exe
  2⤵
  PID:8932
- C:\Windows\System\pnRQPPX.exe
  C:\Windows\System\pnRQPPX.exe
  2⤵
  PID:8948
- C:\Windows\System\UhFGTzA.exe
  C:\Windows\System\UhFGTzA.exe
  2⤵
  PID:8964
- C:\Windows\System\iSLqxcc.exe
  C:\Windows\System\iSLqxcc.exe
  2⤵
  PID:8980
- C:\Windows\System\CMhXJOc.exe
  C:\Windows\System\CMhXJOc.exe
  2⤵
  PID:8996
- C:\Windows\System\SeuQvZF.exe
  C:\Windows\System\SeuQvZF.exe
  2⤵
  PID:9012
- C:\Windows\System\GQvymll.exe
  C:\Windows\System\GQvymll.exe
  2⤵
  PID:9028
- C:\Windows\System\zAkHMLT.exe
  C:\Windows\System\zAkHMLT.exe
  2⤵
  PID:9044
- C:\Windows\System\njGSxfL.exe
  C:\Windows\System\njGSxfL.exe
  2⤵
  PID:9064
- C:\Windows\System\CxMeOUH.exe
  C:\Windows\System\CxMeOUH.exe
  2⤵
  PID:9080
- C:\Windows\System\cuDNpiB.exe
  C:\Windows\System\cuDNpiB.exe
  2⤵
  PID:9096
- C:\Windows\System\ErmwKCT.exe
  C:\Windows\System\ErmwKCT.exe
  2⤵
  PID:9112
- C:\Windows\System\RGSRpKJ.exe
  C:\Windows\System\RGSRpKJ.exe
  2⤵
  PID:9128
- C:\Windows\System\TQLDCZl.exe
  C:\Windows\System\TQLDCZl.exe
  2⤵
  PID:9144
- C:\Windows\System\tJgCWQN.exe
  C:\Windows\System\tJgCWQN.exe
  2⤵
  PID:9160
- C:\Windows\System\nYsvpcE.exe
  C:\Windows\System\nYsvpcE.exe
  2⤵
  PID:9176
- C:\Windows\System\IKitaFA.exe
  C:\Windows\System\IKitaFA.exe
  2⤵
  PID:9192
- C:\Windows\System\ettfbsH.exe
  C:\Windows\System\ettfbsH.exe
  2⤵
  PID:8220
- C:\Windows\System\NIbHmfy.exe
  C:\Windows\System\NIbHmfy.exe
  2⤵
  PID:8232
- C:\Windows\System\BFdAuMW.exe
  C:\Windows\System\BFdAuMW.exe
  2⤵
  PID:8280
- C:\Windows\System\mLTbwKx.exe
  C:\Windows\System\mLTbwKx.exe
  2⤵
  PID:8304
- C:\Windows\System\LkmTbam.exe
  C:\Windows\System\LkmTbam.exe
  2⤵
  PID:8332
- C:\Windows\System\aDSYZfr.exe
  C:\Windows\System\aDSYZfr.exe
  2⤵
  PID:8340
- C:\Windows\System\XDeBxBj.exe
  C:\Windows\System\XDeBxBj.exe
  2⤵
  PID:8400
- C:\Windows\System\FsQQNJh.exe
  C:\Windows\System\FsQQNJh.exe
  2⤵
  PID:8472
- C:\Windows\System\nlvRqfe.exe
  C:\Windows\System\nlvRqfe.exe
  2⤵
  PID:8504
- C:\Windows\System\UqMoOFq.exe
  C:\Windows\System\UqMoOFq.exe
  2⤵
  PID:8444
- C:\Windows\System\rrcKcUH.exe
  C:\Windows\System\rrcKcUH.exe
  2⤵
  PID:8540
- C:\Windows\System\fCbOoFc.exe
  C:\Windows\System\fCbOoFc.exe
  2⤵
  PID:8552
- C:\Windows\System\iysdqcm.exe
  C:\Windows\System\iysdqcm.exe
  2⤵
  PID:8604
- C:\Windows\System\VIWjWDX.exe
  C:\Windows\System\VIWjWDX.exe
  2⤵
  PID:8588
- C:\Windows\System\tNcSZcD.exe
  C:\Windows\System\tNcSZcD.exe
  2⤵
  PID:8612
- C:\Windows\System\AhGWJNa.exe
  C:\Windows\System\AhGWJNa.exe
  2⤵
  PID:8672
- C:\Windows\System\qxVoixa.exe
  C:\Windows\System\qxVoixa.exe
  2⤵
  PID:8704
- C:\Windows\System\yaOUKur.exe
  C:\Windows\System\yaOUKur.exe
  2⤵
  PID:8648
- C:\Windows\System\vRULVNC.exe
  C:\Windows\System\vRULVNC.exe
  2⤵
  PID:8860
- C:\Windows\System\dAYRwFt.exe
  C:\Windows\System\dAYRwFt.exe
  2⤵
  PID:8820
- C:\Windows\System\lkgzdOY.exe
  C:\Windows\System\lkgzdOY.exe
  2⤵
  PID:8708
- C:\Windows\System\KHFoDpr.exe
  C:\Windows\System\KHFoDpr.exe
  2⤵
  PID:8752
- C:\Windows\System\VoTkzYB.exe
  C:\Windows\System\VoTkzYB.exe
  2⤵
  PID:8960
- C:\Windows\System\YeAntjz.exe
  C:\Windows\System\YeAntjz.exe
  2⤵
  PID:9024
- C:\Windows\System\mHeLtMP.exe
  C:\Windows\System\mHeLtMP.exe
  2⤵
  PID:9092
- C:\Windows\System\YoyoWCz.exe
  C:\Windows\System\YoyoWCz.exe
  2⤵
  PID:8872
- C:\Windows\System\bXhHDVi.exe
  C:\Windows\System\bXhHDVi.exe
  2⤵
  PID:8912
- C:\Windows\System\YDRBECb.exe
  C:\Windows\System\YDRBECb.exe
  2⤵
  PID:8976
- C:\Windows\System\XUzTmQT.exe
  C:\Windows\System\XUzTmQT.exe
  2⤵
  PID:9036
- C:\Windows\System\hLTruQa.exe
  C:\Windows\System\hLTruQa.exe
  2⤵
  PID:9104
- C:\Windows\System\xLqOJwj.exe
  C:\Windows\System\xLqOJwj.exe
  2⤵
  PID:9200
- C:\Windows\System\VLsthVe.exe
  C:\Windows\System\VLsthVe.exe
  2⤵
  PID:8804
- C:\Windows\System\luFVQcT.exe
  C:\Windows\System\luFVQcT.exe
  2⤵
  PID:9208
- C:\Windows\System\ZtNWutV.exe
  C:\Windows\System\ZtNWutV.exe
  2⤵
  PID:7648
- C:\Windows\System\nopibkJ.exe
  C:\Windows\System\nopibkJ.exe
  2⤵
  PID:9188
- C:\Windows\System\EctbnKv.exe
  C:\Windows\System\EctbnKv.exe
  2⤵
  PID:8188
- C:\Windows\System\XKcpSbD.exe
  C:\Windows\System\XKcpSbD.exe
  2⤵
  PID:8100
- C:\Windows\System\NOlRRVA.exe
  C:\Windows\System\NOlRRVA.exe
  2⤵
  PID:8264
- C:\Windows\System\TpOUPYB.exe
  C:\Windows\System\TpOUPYB.exe
  2⤵
  PID:8324
- C:\Windows\System\thSisdj.exe
  C:\Windows\System\thSisdj.exe
  2⤵
  PID:8412
- C:\Windows\System\wbsirvT.exe
  C:\Windows\System\wbsirvT.exe
  2⤵
  PID:8252
- C:\Windows\System\iKLWFZq.exe
  C:\Windows\System\iKLWFZq.exe
  2⤵
  PID:8608
- C:\Windows\System\NwdUQfV.exe
  C:\Windows\System\NwdUQfV.exe
  2⤵
  PID:8348
- C:\Windows\System\oqZNVvW.exe
  C:\Windows\System\oqZNVvW.exe
  2⤵
  PID:8740
- C:\Windows\System\xPyyxYs.exe
  C:\Windows\System\xPyyxYs.exe
  2⤵
  PID:8352
- C:\Windows\System\GmfSPJp.exe
  C:\Windows\System\GmfSPJp.exe
  2⤵
  PID:9052
- C:\Windows\System\iMFaIYC.exe
  C:\Windows\System\iMFaIYC.exe
  2⤵
  PID:8500
- C:\Windows\System\RWRCPYX.exe
  C:\Windows\System\RWRCPYX.exe
  2⤵
  PID:8576
- C:\Windows\System\iTrDMLb.exe
  C:\Windows\System\iTrDMLb.exe
  2⤵
  PID:9072
- C:\Windows\System\GasUgCs.exe
  C:\Windows\System\GasUgCs.exe
  2⤵
  PID:8840
- C:\Windows\System\KOENdKj.exe
  C:\Windows\System\KOENdKj.exe
  2⤵
  PID:8636
- C:\Windows\System\wUPZsPd.exe
  C:\Windows\System\wUPZsPd.exe
  2⤵
  PID:8684
- C:\Windows\System\FmqiEnb.exe
  C:\Windows\System\FmqiEnb.exe
  2⤵
  PID:9060
- C:\Windows\System\TpjHGuO.exe
  C:\Windows\System\TpjHGuO.exe
  2⤵
  PID:9008
- C:\Windows\System\LeqQUOY.exe
  C:\Windows\System\LeqQUOY.exe
  2⤵
  PID:9140
- C:\Windows\System\uNDnQFX.exe
  C:\Windows\System\uNDnQFX.exe
  2⤵
  PID:8216
- C:\Windows\System\oltiSjM.exe
  C:\Windows\System\oltiSjM.exe
  2⤵
  PID:8668
- C:\Windows\System\aPMmFRp.exe
  C:\Windows\System\aPMmFRp.exe
  2⤵
  PID:9020
- C:\Windows\System\GRtTkhZ.exe
  C:\Windows\System\GRtTkhZ.exe
  2⤵
  PID:9168
- C:\Windows\System\YRZVUCq.exe
  C:\Windows\System\YRZVUCq.exe
  2⤵
  PID:8624
- C:\Windows\System\klWdOPp.exe
  C:\Windows\System\klWdOPp.exe
  2⤵
  PID:8924
- C:\Windows\System\FLBAOwX.exe
  C:\Windows\System\FLBAOwX.exe
  2⤵
  PID:8212
- C:\Windows\System\xEOeTtD.exe
  C:\Windows\System\xEOeTtD.exe
  2⤵
  PID:8788
- C:\Windows\System\tyYJXMD.exe
  C:\Windows\System\tyYJXMD.exe
  2⤵
  PID:8772
- C:\Windows\System\ZdoYOOX.exe
  C:\Windows\System\ZdoYOOX.exe
  2⤵
  PID:8268
- C:\Windows\System\QmbQgSz.exe
  C:\Windows\System\QmbQgSz.exe
  2⤵
  PID:8972
- C:\Windows\System\OImxrnR.exe
  C:\Windows\System\OImxrnR.exe
  2⤵
  PID:8592
- C:\Windows\System\hIxgNDW.exe
  C:\Windows\System\hIxgNDW.exe
  2⤵
  PID:8308
- C:\Windows\System\CcNMIWX.exe
  C:\Windows\System\CcNMIWX.exe
  2⤵
  PID:8756
- C:\Windows\System\qqBhtbH.exe
  C:\Windows\System\qqBhtbH.exe
  2⤵
  PID:9224
- C:\Windows\System\FipWkpm.exe
  C:\Windows\System\FipWkpm.exe
  2⤵
  PID:9240
- C:\Windows\System\XnXoTKP.exe
  C:\Windows\System\XnXoTKP.exe
  2⤵
  PID:9256
- C:\Windows\System\ZcgDAvE.exe
  C:\Windows\System\ZcgDAvE.exe
  2⤵
  PID:9272
- C:\Windows\System\mcktDKO.exe
  C:\Windows\System\mcktDKO.exe
  2⤵
  PID:9288
- C:\Windows\System\uhginRe.exe
  C:\Windows\System\uhginRe.exe
  2⤵
  PID:9304
- C:\Windows\System\Ewcnqmj.exe
  C:\Windows\System\Ewcnqmj.exe
  2⤵
  PID:9320
- C:\Windows\System\urachoI.exe
  C:\Windows\System\urachoI.exe
  2⤵
  PID:9336
- C:\Windows\System\YPAIxOs.exe
  C:\Windows\System\YPAIxOs.exe
  2⤵
  PID:9352
- C:\Windows\System\qEwKPHN.exe
  C:\Windows\System\qEwKPHN.exe
  2⤵
  PID:9368
- C:\Windows\System\hSomWZx.exe
  C:\Windows\System\hSomWZx.exe
  2⤵
  PID:9384
- C:\Windows\System\gqmOcYK.exe
  C:\Windows\System\gqmOcYK.exe
  2⤵
  PID:9400
- C:\Windows\System\osPjrmD.exe
  C:\Windows\System\osPjrmD.exe
  2⤵
  PID:9416
- C:\Windows\System\tFnjBTX.exe
  C:\Windows\System\tFnjBTX.exe
  2⤵
  PID:9432
- C:\Windows\System\LkkElsJ.exe
  C:\Windows\System\LkkElsJ.exe
  2⤵
  PID:9448
- C:\Windows\System\GSkwJLe.exe
  C:\Windows\System\GSkwJLe.exe
  2⤵
  PID:9464
- C:\Windows\System\cSBDhsk.exe
  C:\Windows\System\cSBDhsk.exe
  2⤵
  PID:9480
- C:\Windows\System\CkezybE.exe
  C:\Windows\System\CkezybE.exe
  2⤵
  PID:9496
- C:\Windows\System\GXrksVd.exe
  C:\Windows\System\GXrksVd.exe
  2⤵
  PID:9512
- C:\Windows\System\qHVcpwz.exe
  C:\Windows\System\qHVcpwz.exe
  2⤵
  PID:9528
- C:\Windows\System\ogHxxcZ.exe
  C:\Windows\System\ogHxxcZ.exe
  2⤵
  PID:9544
- C:\Windows\System\KLIAyKp.exe
  C:\Windows\System\KLIAyKp.exe
  2⤵
  PID:9560
- C:\Windows\System\lFJNWSN.exe
  C:\Windows\System\lFJNWSN.exe
  2⤵
  PID:9576
- C:\Windows\System\UqxqiYC.exe
  C:\Windows\System\UqxqiYC.exe
  2⤵
  PID:9592
- C:\Windows\System\FgZFWwL.exe
  C:\Windows\System\FgZFWwL.exe
  2⤵
  PID:9612
- C:\Windows\System\ioeCYTd.exe
  C:\Windows\System\ioeCYTd.exe
  2⤵
  PID:9628
- C:\Windows\System\nNaPAnz.exe
  C:\Windows\System\nNaPAnz.exe
  2⤵
  PID:9644
- C:\Windows\System\FjqQoEA.exe
  C:\Windows\System\FjqQoEA.exe
  2⤵
  PID:9660
- C:\Windows\System\YbDYdGO.exe
  C:\Windows\System\YbDYdGO.exe
  2⤵
  PID:9676
- C:\Windows\System\ebYaQcy.exe
  C:\Windows\System\ebYaQcy.exe
  2⤵
  PID:9692
- C:\Windows\System\YmialxY.exe
  C:\Windows\System\YmialxY.exe
  2⤵
  PID:9712
- C:\Windows\System\gNPUyXl.exe
  C:\Windows\System\gNPUyXl.exe
  2⤵
  PID:9728
- C:\Windows\System\mnAPXQI.exe
  C:\Windows\System\mnAPXQI.exe
  2⤵
  PID:9744
- C:\Windows\System\uTaJxUS.exe
  C:\Windows\System\uTaJxUS.exe
  2⤵
  PID:9760
- C:\Windows\System\FimqKLf.exe
  C:\Windows\System\FimqKLf.exe
  2⤵
  PID:9776
- C:\Windows\System\RyKcoID.exe
  C:\Windows\System\RyKcoID.exe
  2⤵
  PID:9792
- C:\Windows\System\VGHxsWE.exe
  C:\Windows\System\VGHxsWE.exe
  2⤵
  PID:9808
- C:\Windows\System\RIljSiJ.exe
  C:\Windows\System\RIljSiJ.exe
  2⤵
  PID:9824
- C:\Windows\System\zySquIa.exe
  C:\Windows\System\zySquIa.exe
  2⤵
  PID:9844
- C:\Windows\System\JkaHkVO.exe
  C:\Windows\System\JkaHkVO.exe
  2⤵
  PID:9860
- C:\Windows\System\rEqvRpY.exe
  C:\Windows\System\rEqvRpY.exe
  2⤵
  PID:9876
- C:\Windows\System\uIzMOxX.exe
  C:\Windows\System\uIzMOxX.exe
  2⤵
  PID:9892
- C:\Windows\System\CdmsWSn.exe
  C:\Windows\System\CdmsWSn.exe
  2⤵
  PID:9908
- C:\Windows\System\pfTXDgn.exe
  C:\Windows\System\pfTXDgn.exe
  2⤵
  PID:9924
- C:\Windows\System\AcwrCsg.exe
  C:\Windows\System\AcwrCsg.exe
  2⤵
  PID:9940
- C:\Windows\System\opNhEkG.exe
  C:\Windows\System\opNhEkG.exe
  2⤵
  PID:9956
- C:\Windows\System\mZxRNkQ.exe
  C:\Windows\System\mZxRNkQ.exe
  2⤵
  PID:9972
- C:\Windows\System\krGGLgH.exe
  C:\Windows\System\krGGLgH.exe
  2⤵
  PID:9988
- C:\Windows\System\lOfIZnf.exe
  C:\Windows\System\lOfIZnf.exe
  2⤵
  PID:10004
- C:\Windows\System\ukGmuwB.exe
  C:\Windows\System\ukGmuwB.exe
  2⤵
  PID:10020
- C:\Windows\System\fhDnfcU.exe
  C:\Windows\System\fhDnfcU.exe
  2⤵
  PID:10040
- C:\Windows\System\PBJvife.exe
  C:\Windows\System\PBJvife.exe
  2⤵
  PID:10056
- C:\Windows\System\fOpKfTU.exe
  C:\Windows\System\fOpKfTU.exe
  2⤵
  PID:10072
- C:\Windows\System\yrvuKRQ.exe
  C:\Windows\System\yrvuKRQ.exe
  2⤵
  PID:10088
- C:\Windows\System\iCOYuax.exe
  C:\Windows\System\iCOYuax.exe
  2⤵
  PID:10104
- C:\Windows\System\VXWqTFz.exe
  C:\Windows\System\VXWqTFz.exe
  2⤵
  PID:10124
- C:\Windows\System\jHAuChK.exe
  C:\Windows\System\jHAuChK.exe
  2⤵
  PID:10140
- C:\Windows\System\OicTXRJ.exe
  C:\Windows\System\OicTXRJ.exe
  2⤵
  PID:10160
- C:\Windows\System\EIRdotw.exe
  C:\Windows\System\EIRdotw.exe
  2⤵
  PID:10176
- C:\Windows\System\qARezpg.exe
  C:\Windows\System\qARezpg.exe
  2⤵
  PID:10192
- C:\Windows\System\LdjLbQQ.exe
  C:\Windows\System\LdjLbQQ.exe
  2⤵
  PID:10208
- C:\Windows\System\wWWqHvw.exe
  C:\Windows\System\wWWqHvw.exe
  2⤵
  PID:10228
- C:\Windows\System\gGrkTYP.exe
  C:\Windows\System\gGrkTYP.exe
  2⤵
  PID:8768
- C:\Windows\System\ZZYaPCW.exe
  C:\Windows\System\ZZYaPCW.exe
  2⤵
  PID:9252
- C:\Windows\System\EZsdsVs.exe
  C:\Windows\System\EZsdsVs.exe
  2⤵
  PID:9220
- C:\Windows\System\SfytNcE.exe
  C:\Windows\System\SfytNcE.exe
  2⤵
  PID:9344
- C:\Windows\System\vsYIBUO.exe
  C:\Windows\System\vsYIBUO.exe
  2⤵
  PID:9268
- C:\Windows\System\YqTNltm.exe
  C:\Windows\System\YqTNltm.exe
  2⤵
  PID:9412
- C:\Windows\System\UDQnpXM.exe
  C:\Windows\System\UDQnpXM.exe
  2⤵
  PID:9504
- C:\Windows\System\fzHrLTP.exe
  C:\Windows\System\fzHrLTP.exe
  2⤵
  PID:9328
- C:\Windows\System\srGOKWM.exe
  C:\Windows\System\srGOKWM.exe
  2⤵
  PID:8236
- C:\Windows\System\OwwmCLh.exe
  C:\Windows\System\OwwmCLh.exe
  2⤵
  PID:8448
- C:\Windows\System\YYlFvGp.exe
  C:\Windows\System\YYlFvGp.exe
  2⤵
  PID:9332
- C:\Windows\System\aBpcihJ.exe
  C:\Windows\System\aBpcihJ.exe
  2⤵
  PID:9396
- C:\Windows\System\rjbuzJt.exe
  C:\Windows\System\rjbuzJt.exe
  2⤵
  PID:9456
- C:\Windows\System\QPqDOfm.exe
  C:\Windows\System\QPqDOfm.exe
  2⤵
  PID:9588
- C:\Windows\System\muBUmKS.exe
  C:\Windows\System\muBUmKS.exe
  2⤵
  PID:9584
- C:\Windows\System\uMtfEel.exe
  C:\Windows\System\uMtfEel.exe
  2⤵
  PID:9640
- C:\Windows\System\FqhhWfr.exe
  C:\Windows\System\FqhhWfr.exe
  2⤵
  PID:10036
- C:\Windows\System\uNQXiwE.exe
  C:\Windows\System\uNQXiwE.exe
  2⤵
  PID:9888
- C:\Windows\System\bsouiQa.exe
  C:\Windows\System\bsouiQa.exe
  2⤵
  PID:9980
- C:\Windows\System\rBpVrJi.exe
  C:\Windows\System\rBpVrJi.exe
  2⤵
  PID:9740
- C:\Windows\System\OvvlfIU.exe
  C:\Windows\System\OvvlfIU.exe
  2⤵
  PID:9832
- C:\Windows\System\keGEhMX.exe
  C:\Windows\System\keGEhMX.exe
  2⤵
  PID:9904
- C:\Windows\System\YNQrqeN.exe
  C:\Windows\System\YNQrqeN.exe
  2⤵
  PID:9996
- C:\Windows\System\WOdlyos.exe
  C:\Windows\System\WOdlyos.exe
  2⤵
  PID:10052
- C:\Windows\System\tYGqvhm.exe
  C:\Windows\System\tYGqvhm.exe
  2⤵
  PID:10064
- C:\Windows\System\BpbwAHr.exe
  C:\Windows\System\BpbwAHr.exe
  2⤵
  PID:8904
- C:\Windows\System\OshPqRp.exe
  C:\Windows\System\OshPqRp.exe
  2⤵
  PID:10172
- C:\Windows\System\rKTMNRD.exe
  C:\Windows\System\rKTMNRD.exe
  2⤵
  PID:10120
- C:\Windows\System\jxutXOX.exe
  C:\Windows\System\jxutXOX.exe
  2⤵
  PID:10156
- C:\Windows\System\ScrkwaJ.exe
  C:\Windows\System\ScrkwaJ.exe
  2⤵
  PID:10236
- C:\Windows\System\CrNRxBx.exe
  C:\Windows\System\CrNRxBx.exe
  2⤵
  PID:9280
- C:\Windows\System\jhFjwEs.exe
  C:\Windows\System\jhFjwEs.exe
  2⤵
  PID:9408
- C:\Windows\System\SNefgrn.exe
  C:\Windows\System\SNefgrn.exe
  2⤵
  PID:9392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AUqQxSN.exe

Filesize
1.8MB

MD5
bc412cd510d92bc8929f3c7ea9898693

SHA1
b1cab2faae7636406eafb369d391880f5f67f38a

SHA256
191df79590a75ce79d1bcf1c8070c84b75e1ab63d594a91cadf6c0fae3eaca4c

SHA512
195126325811b16dd75dc63d1d8e9ba2a9a8713ce7a4d21f0b4ab8706ede5115bdfcb6a6962e902f46b02b915b7a62efcb7e635928943a0b0024889446cc948b

Download Submit
C:\Windows\system\DoWKSal.exe

Filesize
1.8MB

MD5
ffc584cee6db9e5f911b17b7c74f45e3

SHA1
d424543cd3a829b0518623f88fe72d8531a1b51d

SHA256
164a756495d437ac78def090ba77bbd7fa973feae54d4fe61149c53e5714e05d

SHA512
2f7ccf7e86f7ac74b07233a9646dfc57dcd052140c16b921c126383446219d58dabc00ca6eb9b901789982a8d0f01924eae466825d1a88f3a15cd0c030cd3af5

Download Submit
C:\Windows\system\EVewdEI.exe

Filesize
1.8MB

MD5
891c223cb722f7c13d66678ee9cf3d91

SHA1
c4205d399b3a954b37f8ca7b3a6a06a49b42a383

SHA256
f10aa96a91a94a830dbd89ec75db92656a1ecf035b8ddb35ec59ed47e33aae13

SHA512
9357757a7560db5ccd6e4045a2172a5e7105e70fcf816371acd648dacf6a35931a942eeaa3a7f2763fe2359c80f9deff4064ec000576c354c78f2b337dbcdd76

Download Submit
C:\Windows\system\FubAhar.exe

Filesize
1.8MB

MD5
75cbedb14b60f3ac2349fef34a8a9207

SHA1
18256eacb526ae63c8a678ce86ec28889891f819

SHA256
6c75a2bf573abfcc01cec407e063c2e3a6c26c1f6e6801ed677a3bb46897a837

SHA512
fe7dae0ccd95b94e6b6022c88255595c1de7ac12eefe91546235ab7a353cd746fcffff7b18f8cea7bda737e88e7d754aebc9eccbd71814f5b9a95126e20ddcd0

Download Submit
C:\Windows\system\HJUavMq.exe

Filesize
1.8MB

MD5
ffd472c381768ba304d5ca32f153f6a7

SHA1
81021de38f04f777a1eefa673ae8368c5ddc672b

SHA256
446a5da0b8a6e60c107b80c489f427f5a325e4b7b6a9fb46fbc7a039b2c3adbd

SHA512
4e8ccf7c6940d94967378df2025c0e623a3d138f91f293db1670e74ee1f8f040849ae1511de16f4fbcc0aa5e727951aad6001841f3c51394fdd71e3b6597e51e

Download Submit
C:\Windows\system\HVsKgWG.exe

Filesize
1.8MB

MD5
3b0fbbb81c7027d666a4055c0eb9dd3f

SHA1
0ed431c4150812ea84404b1365ed5dfaae203ca9

SHA256
b74c3adbad7da50491e91f2e08e073ad8dcdc2079ce5c583176db99fd71ac8fe

SHA512
607a12af7106d36895bce38089e0c0d7285d7ca814c9395bd3c6dca66bd393cd8ca2f6edaa9eb6d64e5b9f0dbbd53714a332c699fc3d11098747e835bb86a00e

Download Submit
C:\Windows\system\KFEBamY.exe

Filesize
1.8MB

MD5
7c53800376f09ca3d8eaa560d121c6eb

SHA1
a67c20174ff097a9cfb002b4efd1ff461ae578e3

SHA256
a352fdbf2bc647df2a01e8dc4428ededa7e95625e976671f038f4513c2444c45

SHA512
feecd43ab6d25ba1291f0b3d669c498eb14f077c32557c311daaaf7a2798f97ac2d5b180aea50ac7b1c80b312db1c7906ab7e8516e9a4ca1bd2df48f7c151382

Download Submit
C:\Windows\system\MXYkNsQ.exe

Filesize
1.8MB

MD5
a472906856173855f180e13e455e530e

SHA1
e319f67ce6d0afe716f3d55125110631a66576ed

SHA256
f40c5720fffdf55aed9bf949e4547a849b57d735afab7e4f7978e39d1e4ecf57

SHA512
12cc767348631375e06fc3968aa6ad870fa79bf827ec64df81b591801cc8f007cbddde97cda4bd309393b1c99cebc2cd95a9b4303dda7bef82cb71e07e92aa76

Download Submit
C:\Windows\system\RNZqfUg.exe

Filesize
1.8MB

MD5
c85088f0aab23478cd3d390b7d663bf2

SHA1
3da6c8ca9bf73130ef82a69b727d3172e5950960

SHA256
770c9dbd241594b4ff860c6f8552ff2bfaa178d999eca96aecc7a25e9e9d0047

SHA512
f2b16aac40fbc630aca7d545bfd6e6ffd7ca11ee2ab434964cfefbcf4bf0957ea8d89c455959e128e46af9e9118e1eb6a02b02d8f226960c466a83c2df9f4858

Download Submit
C:\Windows\system\SomNwuP.exe

Filesize
1.8MB

MD5
ac8641dd4d00076544040b7952833ad2

SHA1
1946c844ab7e1b233dd4d090a2ce2e9af379ac9e

SHA256
c04ec81ba378658dd87f9b6412fdd545a054043a512ba6b8b6afc89375dea568

SHA512
48a52a8a1cdf49167046753128584a69c73069a23d5c5384af5ebba8b1462b83ae52300b76175b80845be0a2503d27bd79f2dfddb8b5bfcf8615cf3a8596e575

Download Submit
C:\Windows\system\UoFTJRg.exe

Filesize
1.8MB

MD5
0fe0348f41420bfdf820a5ed7808f2be

SHA1
89ddd75d10ba845bd62877158167a34de2ed6925

SHA256
aa6cb02286f20fd624e2fcfdfa728183f61b23bf5c28a122c6bd7b26af8f6692

SHA512
cb05f4f030a6319b8fc92704ec55b4397b8409a847bf4d9f7e16ee29e5a9b16db62fee130785dd0df7f8e740ce31b4acce29036a8e3e6aee3617a8f9e447cc21

Download Submit
C:\Windows\system\WOLGWzI.exe

Filesize
1.8MB

MD5
e494e2408585603d760eff100c54c879

SHA1
452954cabfad5f911ea81640094a55ce47262347

SHA256
ca571f9c86bbe96709bdbc5b486319aadba38334cbf1f453b8a2cef6f6803b82

SHA512
8e10cbfc3397f09cb6e5881b33db3821611b3aa2310793e931433e977b7a69ad5173c0661debdea8054a9f826c596482b15be18174d5e2359955928a4c6741ab

Download Submit
C:\Windows\system\WaNyCOA.exe

Filesize
1.8MB

MD5
2b6cd197008cb2d77c7a5c0e36c4e111

SHA1
70ac59d81f524f0a40505b2c848b395085b328eb

SHA256
ee7cc77076048e119cc773d29cb6ab79d0d7fc3e908874e6ac242b8400f59e21

SHA512
bd4b346882edf02441017da8452b47e50f4f8e77b9ad8d3950b606ab45bad3eee6f61c745a280bd5793a6540d5a62116e291e028fa36825de56794937ce8ea5f

Download Submit
C:\Windows\system\acbTLug.exe

Filesize
1.8MB

MD5
2e7d23f5cb5b9212edb42fe6d727e4dc

SHA1
185754595985bb46ec7679eda17e200881395f04

SHA256
d7155d8be319665c1634335f886912bcbe5ec5411f7f748ddcdfc3e265b20811

SHA512
f3f4ace4a404e6e9bd04e581d0bab9b3b190096dcc277ca67106a09f334034170d7921f20fcdb825e1dab591a353f519a79e8e8e1da682c9eb88dc9817405b20

Download Submit
C:\Windows\system\cDKKWoS.exe

Filesize
1.8MB

MD5
7aa1c5d68513aae92f36f88757df3d8a

SHA1
800d8ed5384974f8f6d66fefadfdea3804f9ff23

SHA256
27fab59434c04c62267b30afbed850fdc4a005df7d206f6bb6958b6eecb4fded

SHA512
0c6f7597f8f978cac03dbcf4dc99fe3bad52bc428dc20517be82d9b0026c24a776ceeb1e11fffd746504f4cd51998429203a6d04a98e45d36a1f457525a008f8

Download Submit
C:\Windows\system\etSTxsF.exe

Filesize
1.8MB

MD5
a0608c96d5b56554c71be53ff067a4f4

SHA1
6ac53bc53d2dc3e4f84984bee30e5600df01897f

SHA256
7ff13554e0a48092ba7f4945f0d1aa010bd0d345ed718066ec6314d558f9ea66

SHA512
3cbd3f96b909982b9d63dc2c92ff8ec51cb67d165ab4a52a75104ab2bbc02671b7a9561bb253376f162772bb50d3486975f9b770e0cc6e9a09cd3006629a810d

Download Submit
C:\Windows\system\gjDluUC.exe

Filesize
1.8MB

MD5
bf116e24647571effece4d82207fc32c

SHA1
162a4e73a581a29d99414d2412914120f98e6100

SHA256
f4bfc2649267996581e95769a477662f5151eff67b45565fcfc87ab37e194f0f

SHA512
bbf6f6ab8e9b8c1e79502258bd266336911d5950221d6260da17d22830d03256d31c4a377191162bfe4a0d7ad4264edc456b8409ef0f7bfe382287c778a57db8

Download Submit
C:\Windows\system\iVFVvXj.exe

Filesize
1.8MB

MD5
d4366576e28c24150a10a6f67f448d59

SHA1
5692cce976bbff9917ae2fc6cccd51a384b38513

SHA256
235bf185e44f800caa5c7be0362d50c8fea3a87a0709e23d2057905a33f8a3ad

SHA512
f25d68ebc8c137c75ded856c83e0ea634393667d5c1dd70a44d1aada8245b69a3a20267d243954f50fe70a8dfd25eba5f7f4bcfcb8012c563b8dd0e93076a41f

Download Submit
C:\Windows\system\iomrWZc.exe

Filesize
1.8MB

MD5
b854568a237c9360a798f5b6c212116f

SHA1
937676cceca04df6ea3e1438e65fe9f7851a3d32

SHA256
84b9b3b67c6838542293f36dc4b793772d9aecf7b403ddc9db380abf67bf31cb

SHA512
49676d78f14ee32ea69a55f9a6244b3284ec86f91825f37625f65dc6e3967e0976d78d861aebfb383243cd1ddc6e79c0d60124a345ef86f176f833f2b9321dde

Download Submit
C:\Windows\system\nsnqAag.exe

Filesize
1.8MB

MD5
09764eb034b062bdb2ff00db1212fc45

SHA1
8dc9b56478077ee2671564ca8f880b25ed1dffcd

SHA256
7e7814a95999b03212024b3503f41e86e9109d6a0f4d183c91d5a95062c8bda4

SHA512
ae57ece0a2a6e658bd22679d996925b1cb4cb65ea7c77c81d447d12c3d4aaa3b75ceb23bd56f9f2c61431ce1abc3cc63c1bfc7282f97984bdfc3ede1743cf1b8

Download Submit
C:\Windows\system\oWUkwvg.exe

Filesize
1.8MB

MD5
d5793588cce0a930b2b5d12a0aa82591

SHA1
df3a0c0c389ab093070f302c114139c35d92d6dd

SHA256
1f01f250c9f3f61847d478695a4f5c5f27a084a5f19773461e8555a4ee93b12e

SHA512
0e7e5db9d6b3c079dea41da88dad6a9a5e0b355b4e03e8807963c7f7e170fcc2418429bb62e018881652a4c210485cbb55c5961cee43fcdaca3770e832eb1d9b

Download Submit
C:\Windows\system\pObYFtD.exe

Filesize
1.8MB

MD5
1dee1291196356fd03babab1dfafb694

SHA1
a978f76037940a7cd72f54f5578cfd64c83626e7

SHA256
9f4ddbdf48ed7a53845b1ebeb6a6238077edde36f7c0c75d4058de7812f7019f

SHA512
7841ea8c593b5203e46878a64506a059a71a10109ad76e80432d394bac8ac8f76ba38a6ac2963b1028b50d474c9e1a71680e8e5a4b5ebf1fc104d4bf17ba908a

Download Submit
C:\Windows\system\pmYSHKH.exe

Filesize
1.8MB

MD5
5efbf355afbd33752c0d6f07b6ff864c

SHA1
62e2f824379901994a86001ba77e6270c945323d

SHA256
a02c411e064bd204bc5ef3f5a9db196dd5b418721429c4d18b47ad1885cd9717

SHA512
165d4d7a160bdfff06051b296973eef869d43ed9285665366d6371322d32481d15006a87ff5e35d366d38969b0ad58d07c41937cc272becc96e930ba41e49546

Download Submit
C:\Windows\system\rBfMMlb.exe

Filesize
1.8MB

MD5
0908062db49c406a59a5eaaa96de2952

SHA1
67aa8183052ac98df5013c896b1dbcbac4411db8

SHA256
75827faef7cba13b3163b974fc4a9d83164fb20bcbad907f95aaeaed9941cbe8

SHA512
52f1b2171a3dcb5d18dd6a28b60d1a596d60685067f560f1429bbfb0fcfb2a5f2b4c9854b7a32065fe14a42774105407d7269a83ae6b9997d4b1711d15945ca9

Download Submit
C:\Windows\system\sDdDbei.exe

Filesize
1.8MB

MD5
1f698e6169620c2ed55c97217ad0e1c4

SHA1
8e191b17d17bd3e91ff7c7d0edc7db0c9eba43f3

SHA256
3493baedbb9bb21c33712f3f3419b7b63e27f9afe156357e43bf3158a5ac436b

SHA512
550297e021079728e3b73a63772e8f64a1fa24503d26b3dd34e4fcd16bb6cf43f05474c0350c459af9a3a0f9714919e600a02c69cc5ae1f4536a0e20e5724718

Download Submit
\Windows\system\ArtjmLO.exe

Filesize
1.8MB

MD5
a9ba5a331bfaa4063b13e2aa7a81e845

SHA1
2652bde333696761398c7be0ae40d4272cc1fe2d

SHA256
cae44a634e6bbfa52f1f2c28951445ef7b39234cfbf656e68e3c3d43f65f6e7a

SHA512
b328e6c29b99c501e50e6dae9bc839c736613906d0c45628eb1d4b7de3e6335d89b50b6f4c67825ae2d05dd1c3dc119c3a4131d3b058b9ae059a6f0143883250

Download Submit
\Windows\system\DBHGcUJ.exe

Filesize
1.8MB

MD5
f73116e37197e999706af76e50ab6942

SHA1
ee3f3ec91258080365cd060747f75ff02cc70c1d

SHA256
0a2f64ce0a254b8356aed4198cbf129a5e4e6baa488b4b5b0c9a02805fc5141a

SHA512
514bf12ee6f8690a24b07ddcefd1c296c2caa9783c06a52966809988ed3f283c880556e06bae083b1ebd0c2d87b8a26412e110c8a6734a7d1d792c8e230ed1b9

Download Submit
\Windows\system\DKGcXtR.exe

Filesize
1.8MB

MD5
135a9470b3d2923019e1a7444a5e6011

SHA1
c02bfd1ad90662658e043a3805839890bff5b328

SHA256
d78b71ca000528033ed4494fb24c2800be8d99871ebd89ec12e3ee1fbd3ce503

SHA512
c0c996f4078c622e7e9141b6f33c5613c721dc2431248a3966acecd59115d40c607b5016802ec592a24a7289c1984ed7400861ed86497380c3fa7eaae3f19098

Download Submit
\Windows\system\DnIERtH.exe

Filesize
1.8MB

MD5
4ff5c68a76c8aa9660c67087c6393116

SHA1
4485fa4184fcf94621b48518425b5d8032890961

SHA256
16bcc5867c0480f8c2664fd8a50366e80439df8d57b100745191703bfcdd199b

SHA512
aeda8d190618fff86cf75f9582573e80a2e11f3b7b2ca870752dc68d95c707f6b73cfd423258ef773eb559fa40a162363b2ef232ea0fbb95cfbbf57c7701efd9

Download Submit
\Windows\system\OMcTZpd.exe

Filesize
1.8MB

MD5
c4d8ecb3416ded9d0a47e9f62d284b2b

SHA1
1315c60852b69f4235ca7e76e6368fb78c8711e6

SHA256
2f30172aa69722cfcb10fa8bae7b85d60c5d2c17bfd31ef966ad7b8d9ab04958

SHA512
86232a48565951bca3a216898f618c364ed10d134f7258a9b8574506a596f231e59a468af6e3967e592089eda4ec9096d0715d5f7dcc2c13828b985b7e7bba4f

Download Submit
\Windows\system\TbBPLxO.exe

Filesize
1.8MB

MD5
4057e1c7116b2dc73338fd486525427e

SHA1
5ecd25b79b545e7d1bb115aa7a8fd7e5203d1577

SHA256
e80c87705eae21d220b1d661a7be5bde456d1b3c6b0c82efcf4143311336242c

SHA512
79894a330e401fabd1d32bbbbcf085552c508c50013a80dc53c921375de982c5b69fe5f365e74506a3f4a587fbfd15b72968729a08e5a6830fadd376ec85dfea

Download Submit
\Windows\system\TpjEpjv.exe

Filesize
1.8MB

MD5
633d75575a49659e67a12896ec2a599b

SHA1
4d7740565826833ffdc1a40dcb19a9de04612132

SHA256
cdaa63b36f3aed8be746b354edcb26c1c7eb87056ddac3d69ee500e01214b6f1

SHA512
98383c34edf6dada2cc2642e6d62b81bb5deab407e893a6420208d74a156dce771ec3db0350ac5b726113cdc7e8745caf4ced639bf2b5d4019830eb14c499344

Download Submit
\Windows\system\YwYhRXA.exe

Filesize
1.8MB

MD5
8c5a465e2863a93461d5d9c57c2b8562

SHA1
61bc3f71c4eee89a5802bb06a0eef1fbda86b9ca

SHA256
92816ae66ef2be5bbca23d5ea049b9fc7453ce6f45c1008cbfb50dbcca386e06

SHA512
af9dfbde838d41b2c1026b4b6e67460f12c68f671bcce4ca3d59c3acc54389ddfbddff8381d88905f62ac15fb51739f2afdebfbf055e596f83e6c3b50a415c77

Download Submit
\Windows\system\ZYFTvCW.exe

Filesize
1.8MB

MD5
4d198d6abc2c5bcadcc85014167ad7e4

SHA1
053f06f5c28af81369654eafa451ceb109efff96

SHA256
66071f02c15306c3f8c5375718f426acb27e4ec1521388dd3176a906cb1c1014

SHA512
6136833b226e00756f89d46399e14d297a419ece2ffe4113165571b5e295f45de36e679750751e668230e9216b500bf70f54934e2fd693d4da50f6c3794c0848

Download Submit
\Windows\system\eTBZPad.exe

Filesize
1.8MB

MD5
9dcb0dd6014da48a9bc5a33e5a785772

SHA1
5bb691da4719a876c6621023b9f04d8e1505fc70

SHA256
ef050eb5b34c66728ecafb967f5f270d4f4cadc1b3cd50145ee53f09418ae553

SHA512
d5e84a6c87159edb37a95def0c6914dadba98789110776de21ba1be315a61c4eb712b9a5b8a0df3d11fffb74e78e862d5557d3fad466a87413c35960b6038951

Download Submit
\Windows\system\gLgzxAY.exe

Filesize
1.8MB

MD5
7428014133c59a18bfd79f9ec8aa5deb

SHA1
52126e70c7ecacac3ffe636ebd98ffc8f1670949

SHA256
8f0ff64e5a5030835c7420eae4a8751715596fece21fc0f761d00f34c7d4ecb4

SHA512
433b0ec76b0ad34baedeaecf5545e40809882d37e460e6e250da0c5966a71d2d990ba78620ce8ee6d75d6ce02bb5cb96bb9079d3bb9ffcadf454e313289a6520

Download Submit
\Windows\system\uIMSHGL.exe

Filesize
1.8MB

MD5
870f26942d76d8eee207001eb7170b45

SHA1
8579de7aad0a29b099b6c836f624eb8fd47a2a1e

SHA256
bfa06e1609b32d10fe5ae302d7cade73366b62f6eb28074a55ec0019921a7975

SHA512
df7e81490458f00041f48adf42994981c6256f993006e7886d2d9f5ac9f767a8bd47e0079210a49e38c96d7345f15b3a4820b1ca02a7b9a4e7e0687f9ae928a3

Download Submit
memory/1784-129-0x000000013F8C0000-0x000000013FCB2000-memory.dmp

Filesize
3.9MB

Download
memory/1964-125-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2468-127-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2528-77-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2552-117-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2576-112-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2620-121-0x000000013F690000-0x000000013FA82000-memory.dmp

Filesize
3.9MB

Download
memory/2672-92-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2768-123-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2956-120-0x0000000003760000-0x0000000003B52000-memory.dmp

Filesize
3.9MB

Download
memory/2956-126-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2956-113-0x000000013F300000-0x000000013F6F2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-87-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2956-0-0x000000013F890000-0x000000013FC82000-memory.dmp

Filesize
3.9MB

Download
memory/2956-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2956-122-0x0000000003760000-0x0000000003B52000-memory.dmp

Filesize
3.9MB

Download
memory/2956-12-0x00000000030E0000-0x00000000034D2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-124-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-93-0x000000013FC90000-0x0000000140082000-memory.dmp

Filesize
3.9MB

Download
memory/2956-128-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/2956-74-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/3040-130-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/3040-66-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download
memory/3040-65-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-56-0x00000000002C0000-0x00000000002C8000-memory.dmp

Filesize
32KB

Download
memory/3040-678-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-31-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/3040-70-0x000007FEF5CC0000-0x000007FEF665D000-memory.dmp

Filesize
9.6MB

Download
memory/3040-119-0x0000000002C20000-0x0000000002CA0000-memory.dmp

Filesize
512KB

Download