xmrig | e550c1a0b1d98284d2d501bc1bb1231aebafc7903c5b3b5d3ba7fc03a3fbe82f

Analysis

max time kernel
35s
max time network
32s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Size

2.0MB
MD5

059e8d5a37d3e7ef73efa0588f16b59a
SHA1

e8a7b3b01b756ce5bbc350a85d312c2f9c042f0d
SHA256

e550c1a0b1d98284d2d501bc1bb1231aebafc7903c5b3b5d3ba7fc03a3fbe82f
SHA512

49670df5f7f3944d9923bfc927d48d922c9a097a54a6cbe3667ba2639e19400f066c3f378b3160e63386f838ab7c604aaf2c52cfa7c28b9bdc21a621b157769d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDbD:NABK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2488-154-0x000000013F850000-0x000000013FC42000-memory.dmp	xmrig
behavioral1/memory/2340-146-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2660-144-0x000000013F700000-0x000000013FAF2000-memory.dmp	xmrig
behavioral1/memory/2444-142-0x000000013F330000-0x000000013F722000-memory.dmp	xmrig
behavioral1/memory/2716-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	xmrig
behavioral1/memory/2988-138-0x000000013FDC0000-0x00000001401B2000-memory.dmp	xmrig
behavioral1/memory/2524-120-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2780-115-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2140-13-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2140	SGspJlP.exe
2780	GUGuICx.exe
2524	JMmEDoA.exe
2988	jPxcjqM.exe
2716	BxxZwck.exe
2444	TuHsncS.exe
2660	FfHwvvK.exe
2340	vhQiabx.exe
2488	jsKziev.exe
2252	PECTmYf.exe
2676	Rqikiwv.exe
1644	awTLLHQ.exe
2644	jjWPmsT.exe
2728	aAFbBIW.exe
2748	njeWLpm.exe
2848	JtYUmfy.exe
2200	zARhjIY.exe
2316	quswHXN.exe
2204	AMurxQm.exe
1776	vbWCIva.exe
1852	TsseAwR.exe
1948	NSFCfDa.exe
1184	RWmTVUt.exe
312	KjzRphY.exe
2268	uaLHbLN.exe
1028	shmRveR.exe
2856	oHPATzn.exe
2352	uptmSqJ.exe
1764	ZxtQIzs.exe
324	XeDCHgT.exe
1748	xcVnkWd.exe
3016	RjMFXSm.exe
2072	QbylpgZ.exe
1320	QHpYCkI.exe
1732	sgrcvIs.exe
1340	oSMuhxK.exe
1300	EwYKjpD.exe
900	erdDvMf.exe
1020	ImsOFcp.exe
1396	gccSDpS.exe
2088	EsfkGBC.exe
1688	PtUUrno.exe
1684	WxqMFte.exe
876	WjDPwPM.exe
848	DTpSRoQ.exe
1808	iCHgdkI.exe
1280	SGifcak.exe
2924	rrehwjK.exe
1704	gbfKNCA.exe
1592	XVvBvHc.exe
3004	DWcQuRw.exe
2572	FvXeCgC.exe
2680	gUEucnk.exe
2736	ZZpOShp.exe
2040	jWSpThv.exe
2468	HCuqkzW.exe
2432	XZtgmnv.exe
2904	xmQsHVN.exe
2740	OCbjKnX.exe
2884	kzHVJPD.exe
2164	eGXXOgu.exe
2980	zeycorQ.exe
2544	hAhTLWO.exe
2596	YEeXMIu.exe

Loads dropped DLL 64 IoCs

pid	Process
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1244-1-0x000000013FC10000-0x0000000140002000-memory.dmp	upx
behavioral1/files/0x000b000000014319-10.dat	upx
behavioral1/files/0x0037000000016c26-15.dat	upx
behavioral1/files/0x001400000000549e-22.dat	upx
behavioral1/files/0x0007000000016cf5-30.dat	upx
behavioral1/files/0x0007000000016cfe-34.dat	upx
behavioral1/files/0x0008000000016d1f-42.dat	upx
behavioral1/files/0x0009000000018648-62.dat	upx
behavioral1/files/0x00050000000186cf-83.dat	upx
behavioral1/files/0x00050000000186dd-87.dat	upx
behavioral1/files/0x0006000000018ffa-107.dat	upx
behavioral1/files/0x00050000000193a1-175.dat	upx
behavioral1/files/0x0037000000016c2e-172.dat	upx
behavioral1/memory/2488-154-0x000000013F850000-0x000000013FC42000-memory.dmp	upx
behavioral1/files/0x0005000000019383-148.dat	upx
behavioral1/memory/2340-146-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/1244-132-0x0000000003590000-0x0000000003982000-memory.dmp	upx
behavioral1/files/0x0005000000019250-131.dat	upx
behavioral1/files/0x0005000000019260-130.dat	upx
behavioral1/files/0x0005000000019233-121.dat	upx
behavioral1/files/0x00050000000193eb-176.dat	upx
behavioral1/files/0x00050000000193e7-168.dat	upx
behavioral1/files/0x000500000001938d-160.dat	upx
behavioral1/memory/2660-144-0x000000013F700000-0x000000013FAF2000-memory.dmp	upx
behavioral1/memory/2444-142-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/memory/2716-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp	upx
behavioral1/files/0x0005000000019316-139.dat	upx
behavioral1/memory/2988-138-0x000000013FDC0000-0x00000001401B2000-memory.dmp	upx
behavioral1/memory/2524-120-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/memory/2780-115-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x000500000001922d-111.dat	upx
behavioral1/files/0x000500000001876e-103.dat	upx
behavioral1/files/0x0005000000018765-99.dat	upx
behavioral1/files/0x0005000000018756-95.dat	upx
behavioral1/files/0x0005000000018717-91.dat	upx
behavioral1/files/0x00050000000186c4-79.dat	upx
behavioral1/files/0x0005000000018664-75.dat	upx
behavioral1/files/0x000500000001865b-71.dat	upx
behavioral1/files/0x0031000000018649-68.dat	upx
behavioral1/files/0x0006000000017474-66.dat	upx
behavioral1/files/0x0006000000017465-54.dat	upx
behavioral1/files/0x0007000000016d06-39.dat	upx
behavioral1/files/0x0008000000016ced-23.dat	upx
behavioral1/memory/2140-13-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\NDScKmm.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\nmhSzpf.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ZVWVyao.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\TSWWgiu.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\TruqTIy.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\jXilzMO.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\HRGGzEe.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\YTWrfEN.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\DKmHhTn.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\RWmTVUt.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\GKxywhT.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\UHYtLDJ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\wgOKaHu.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\umSeyum.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VlHwlab.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ErXzqBk.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\IGhDVxZ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ZntoZlQ.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kdCBMkj.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\gVRzLLH.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\TAyIJcw.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\bJdpxTM.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\DbGsLxw.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\NqvzpER.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xmQsHVN.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\BZTcKBP.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\cmzZgGG.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\UYzFYqe.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xMnVCWL.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\WezRrgF.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VEPItmp.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\bdjxVoY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\geiPZwr.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\giIAyPR.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\BHdlrJr.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kpndXXY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kYNBJLa.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\MkNXthm.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ZVMutRY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\pdhESLp.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\Uygzoqd.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\iGhZxcp.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\dwgFBMU.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\xxTxDbS.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\QhRvwOz.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\VmGDfnh.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\kbQxJrs.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\lTBoBFB.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\ZUdaSop.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\sPmyFQd.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\wHbKfJF.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\EsfkGBC.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\FeUUbkN.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\NLCXgKB.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\yUAuaPp.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\GDqxcAY.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\SkMthTB.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\qTUTMRK.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\WjDPwPM.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\NlBplWV.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\alrSOKW.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\zKKcBYw.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\nQCjSjB.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
File created	C:\Windows\System\vqGiQle.exe	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
Token: SeDebugPrivilege	2184	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2184	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	29
PID 1244 wrote to memory of 2184	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	29
PID 1244 wrote to memory of 2184	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	29
PID 1244 wrote to memory of 2140	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	30
PID 1244 wrote to memory of 2140	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	30
PID 1244 wrote to memory of 2140	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	30
PID 1244 wrote to memory of 2780	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	31
PID 1244 wrote to memory of 2780	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	31
PID 1244 wrote to memory of 2780	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	31
PID 1244 wrote to memory of 2524	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	32
PID 1244 wrote to memory of 2524	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	32
PID 1244 wrote to memory of 2524	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	32
PID 1244 wrote to memory of 2716	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	33
PID 1244 wrote to memory of 2716	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	33
PID 1244 wrote to memory of 2716	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	33
PID 1244 wrote to memory of 2988	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	34
PID 1244 wrote to memory of 2988	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	34
PID 1244 wrote to memory of 2988	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	34
PID 1244 wrote to memory of 2444	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	35
PID 1244 wrote to memory of 2444	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	35
PID 1244 wrote to memory of 2444	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	35
PID 1244 wrote to memory of 2660	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	36
PID 1244 wrote to memory of 2660	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	36
PID 1244 wrote to memory of 2660	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	36
PID 1244 wrote to memory of 2340	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	37
PID 1244 wrote to memory of 2340	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	37
PID 1244 wrote to memory of 2340	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	37
PID 1244 wrote to memory of 2488	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	38
PID 1244 wrote to memory of 2488	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	38
PID 1244 wrote to memory of 2488	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	38
PID 1244 wrote to memory of 2676	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	39
PID 1244 wrote to memory of 2676	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	39
PID 1244 wrote to memory of 2676	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	39
PID 1244 wrote to memory of 2252	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	40
PID 1244 wrote to memory of 2252	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	40
PID 1244 wrote to memory of 2252	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	40
PID 1244 wrote to memory of 1644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	41
PID 1244 wrote to memory of 1644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	41
PID 1244 wrote to memory of 1644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	41
PID 1244 wrote to memory of 2644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	42
PID 1244 wrote to memory of 2644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	42
PID 1244 wrote to memory of 2644	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	42
PID 1244 wrote to memory of 2728	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	43
PID 1244 wrote to memory of 2728	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	43
PID 1244 wrote to memory of 2728	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	43
PID 1244 wrote to memory of 2748	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	44
PID 1244 wrote to memory of 2748	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	44
PID 1244 wrote to memory of 2748	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	44
PID 1244 wrote to memory of 2848	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	45
PID 1244 wrote to memory of 2848	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	45
PID 1244 wrote to memory of 2848	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	45
PID 1244 wrote to memory of 2200	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	46
PID 1244 wrote to memory of 2200	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	46
PID 1244 wrote to memory of 2200	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	46
PID 1244 wrote to memory of 2316	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	47
PID 1244 wrote to memory of 2316	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	47
PID 1244 wrote to memory of 2316	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	47
PID 1244 wrote to memory of 2204	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	48
PID 1244 wrote to memory of 2204	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	48
PID 1244 wrote to memory of 2204	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	48
PID 1244 wrote to memory of 1776	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	49
PID 1244 wrote to memory of 1776	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	49
PID 1244 wrote to memory of 1776	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	49
PID 1244 wrote to memory of 1852	1244	059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\059e8d5a37d3e7ef73efa0588f16b59a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\System\SGspJlP.exe
  C:\Windows\System\SGspJlP.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\GUGuICx.exe
  C:\Windows\System\GUGuICx.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\JMmEDoA.exe
  C:\Windows\System\JMmEDoA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\BxxZwck.exe
  C:\Windows\System\BxxZwck.exe
  2⤵
  - Executes dropped EXE
  PID:2716
- C:\Windows\System\jPxcjqM.exe
  C:\Windows\System\jPxcjqM.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\TuHsncS.exe
  C:\Windows\System\TuHsncS.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\FfHwvvK.exe
  C:\Windows\System\FfHwvvK.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\vhQiabx.exe
  C:\Windows\System\vhQiabx.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\jsKziev.exe
  C:\Windows\System\jsKziev.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\Rqikiwv.exe
  C:\Windows\System\Rqikiwv.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\PECTmYf.exe
  C:\Windows\System\PECTmYf.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\awTLLHQ.exe
  C:\Windows\System\awTLLHQ.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\jjWPmsT.exe
  C:\Windows\System\jjWPmsT.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\aAFbBIW.exe
  C:\Windows\System\aAFbBIW.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\njeWLpm.exe
  C:\Windows\System\njeWLpm.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\JtYUmfy.exe
  C:\Windows\System\JtYUmfy.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\zARhjIY.exe
  C:\Windows\System\zARhjIY.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\quswHXN.exe
  C:\Windows\System\quswHXN.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\AMurxQm.exe
  C:\Windows\System\AMurxQm.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\vbWCIva.exe
  C:\Windows\System\vbWCIva.exe
  2⤵
  - Executes dropped EXE
  PID:1776
- C:\Windows\System\TsseAwR.exe
  C:\Windows\System\TsseAwR.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\NSFCfDa.exe
  C:\Windows\System\NSFCfDa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\RWmTVUt.exe
  C:\Windows\System\RWmTVUt.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\uptmSqJ.exe
  C:\Windows\System\uptmSqJ.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\KjzRphY.exe
  C:\Windows\System\KjzRphY.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\ZxtQIzs.exe
  C:\Windows\System\ZxtQIzs.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\uaLHbLN.exe
  C:\Windows\System\uaLHbLN.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\XeDCHgT.exe
  C:\Windows\System\XeDCHgT.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\shmRveR.exe
  C:\Windows\System\shmRveR.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\xcVnkWd.exe
  C:\Windows\System\xcVnkWd.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\oHPATzn.exe
  C:\Windows\System\oHPATzn.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\QbylpgZ.exe
  C:\Windows\System\QbylpgZ.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\RjMFXSm.exe
  C:\Windows\System\RjMFXSm.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\sgrcvIs.exe
  C:\Windows\System\sgrcvIs.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\QHpYCkI.exe
  C:\Windows\System\QHpYCkI.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\oSMuhxK.exe
  C:\Windows\System\oSMuhxK.exe
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\System\EwYKjpD.exe
  C:\Windows\System\EwYKjpD.exe
  2⤵
  - Executes dropped EXE
  PID:1300
- C:\Windows\System\erdDvMf.exe
  C:\Windows\System\erdDvMf.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\ImsOFcp.exe
  C:\Windows\System\ImsOFcp.exe
  2⤵
  - Executes dropped EXE
  PID:1020
- C:\Windows\System\gccSDpS.exe
  C:\Windows\System\gccSDpS.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\EsfkGBC.exe
  C:\Windows\System\EsfkGBC.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\PtUUrno.exe
  C:\Windows\System\PtUUrno.exe
  2⤵
  - Executes dropped EXE
  PID:1688
- C:\Windows\System\WxqMFte.exe
  C:\Windows\System\WxqMFte.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\WjDPwPM.exe
  C:\Windows\System\WjDPwPM.exe
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Windows\System\DTpSRoQ.exe
  C:\Windows\System\DTpSRoQ.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\iCHgdkI.exe
  C:\Windows\System\iCHgdkI.exe
  2⤵
  - Executes dropped EXE
  PID:1808
- C:\Windows\System\SGifcak.exe
  C:\Windows\System\SGifcak.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\rrehwjK.exe
  C:\Windows\System\rrehwjK.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\gbfKNCA.exe
  C:\Windows\System\gbfKNCA.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\XVvBvHc.exe
  C:\Windows\System\XVvBvHc.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\DWcQuRw.exe
  C:\Windows\System\DWcQuRw.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\FvXeCgC.exe
  C:\Windows\System\FvXeCgC.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\gUEucnk.exe
  C:\Windows\System\gUEucnk.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ZZpOShp.exe
  C:\Windows\System\ZZpOShp.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\jWSpThv.exe
  C:\Windows\System\jWSpThv.exe
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\System\HCuqkzW.exe
  C:\Windows\System\HCuqkzW.exe
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\System\XZtgmnv.exe
  C:\Windows\System\XZtgmnv.exe
  2⤵
  - Executes dropped EXE
  PID:2432
- C:\Windows\System\xmQsHVN.exe
  C:\Windows\System\xmQsHVN.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\OCbjKnX.exe
  C:\Windows\System\OCbjKnX.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\kzHVJPD.exe
  C:\Windows\System\kzHVJPD.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\eGXXOgu.exe
  C:\Windows\System\eGXXOgu.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\zeycorQ.exe
  C:\Windows\System\zeycorQ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\hAhTLWO.exe
  C:\Windows\System\hAhTLWO.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\YEeXMIu.exe
  C:\Windows\System\YEeXMIu.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\kahdegY.exe
  C:\Windows\System\kahdegY.exe
  2⤵
  PID:1260
- C:\Windows\System\NmFqNAS.exe
  C:\Windows\System\NmFqNAS.exe
  2⤵
  PID:1628
- C:\Windows\System\iyMVoDm.exe
  C:\Windows\System\iyMVoDm.exe
  2⤵
  PID:2112
- C:\Windows\System\lfcgDNF.exe
  C:\Windows\System\lfcgDNF.exe
  2⤵
  PID:868
- C:\Windows\System\owqDpRE.exe
  C:\Windows\System\owqDpRE.exe
  2⤵
  PID:2708
- C:\Windows\System\ttkhXmc.exe
  C:\Windows\System\ttkhXmc.exe
  2⤵
  PID:2560
- C:\Windows\System\nFVjGFg.exe
  C:\Windows\System\nFVjGFg.exe
  2⤵
  PID:944
- C:\Windows\System\HWeslQz.exe
  C:\Windows\System\HWeslQz.exe
  2⤵
  PID:1528
- C:\Windows\System\umSeyum.exe
  C:\Windows\System\umSeyum.exe
  2⤵
  PID:2956
- C:\Windows\System\etYZOYt.exe
  C:\Windows\System\etYZOYt.exe
  2⤵
  PID:1976
- C:\Windows\System\ySVnZDC.exe
  C:\Windows\System\ySVnZDC.exe
  2⤵
  PID:1872
- C:\Windows\System\WpTbrjD.exe
  C:\Windows\System\WpTbrjD.exe
  2⤵
  PID:1988
- C:\Windows\System\yzPZiim.exe
  C:\Windows\System\yzPZiim.exe
  2⤵
  PID:872
- C:\Windows\System\cRzOiHG.exe
  C:\Windows\System\cRzOiHG.exe
  2⤵
  PID:2668
- C:\Windows\System\zshzmfo.exe
  C:\Windows\System\zshzmfo.exe
  2⤵
  PID:1552
- C:\Windows\System\NDScKmm.exe
  C:\Windows\System\NDScKmm.exe
  2⤵
  PID:2812
- C:\Windows\System\zCASZVC.exe
  C:\Windows\System\zCASZVC.exe
  2⤵
  PID:1696
- C:\Windows\System\FawdrQl.exe
  C:\Windows\System\FawdrQl.exe
  2⤵
  PID:2948
- C:\Windows\System\QjzkLpC.exe
  C:\Windows\System\QjzkLpC.exe
  2⤵
  PID:1812
- C:\Windows\System\DxgcWQN.exe
  C:\Windows\System\DxgcWQN.exe
  2⤵
  PID:1652
- C:\Windows\System\BiJqIhv.exe
  C:\Windows\System\BiJqIhv.exe
  2⤵
  PID:2556
- C:\Windows\System\FEQBrHt.exe
  C:\Windows\System\FEQBrHt.exe
  2⤵
  PID:2124
- C:\Windows\System\eHwAhpN.exe
  C:\Windows\System\eHwAhpN.exe
  2⤵
  PID:2656
- C:\Windows\System\XsobIiB.exe
  C:\Windows\System\XsobIiB.exe
  2⤵
  PID:1804
- C:\Windows\System\BnbSaVV.exe
  C:\Windows\System\BnbSaVV.exe
  2⤵
  PID:2704
- C:\Windows\System\TgRoIDO.exe
  C:\Windows\System\TgRoIDO.exe
  2⤵
  PID:2832
- C:\Windows\System\iAQqXNt.exe
  C:\Windows\System\iAQqXNt.exe
  2⤵
  PID:2720
- C:\Windows\System\vCucMUj.exe
  C:\Windows\System\vCucMUj.exe
  2⤵
  PID:1796
- C:\Windows\System\jvRMabX.exe
  C:\Windows\System\jvRMabX.exe
  2⤵
  PID:1952
- C:\Windows\System\SfToqYq.exe
  C:\Windows\System\SfToqYq.exe
  2⤵
  PID:2964
- C:\Windows\System\iKcCKze.exe
  C:\Windows\System\iKcCKze.exe
  2⤵
  PID:3020
- C:\Windows\System\LuYVXRo.exe
  C:\Windows\System\LuYVXRo.exe
  2⤵
  PID:636
- C:\Windows\System\tRktcHi.exe
  C:\Windows\System\tRktcHi.exe
  2⤵
  PID:2296
- C:\Windows\System\ypiAwKO.exe
  C:\Windows\System\ypiAwKO.exe
  2⤵
  PID:1344
- C:\Windows\System\EErGMbv.exe
  C:\Windows\System\EErGMbv.exe
  2⤵
  PID:1360
- C:\Windows\System\ipdafFz.exe
  C:\Windows\System\ipdafFz.exe
  2⤵
  PID:1956
- C:\Windows\System\zSLgcSh.exe
  C:\Windows\System\zSLgcSh.exe
  2⤵
  PID:2380
- C:\Windows\System\mBQUqRs.exe
  C:\Windows\System\mBQUqRs.exe
  2⤵
  PID:1516
- C:\Windows\System\lYvEpXd.exe
  C:\Windows\System\lYvEpXd.exe
  2⤵
  PID:1436
- C:\Windows\System\MjSGSmI.exe
  C:\Windows\System\MjSGSmI.exe
  2⤵
  PID:2152
- C:\Windows\System\zxbxyqy.exe
  C:\Windows\System\zxbxyqy.exe
  2⤵
  PID:2928
- C:\Windows\System\BRrsJtJ.exe
  C:\Windows\System\BRrsJtJ.exe
  2⤵
  PID:2920
- C:\Windows\System\uQHHnuM.exe
  C:\Windows\System\uQHHnuM.exe
  2⤵
  PID:2840
- C:\Windows\System\qcEalUQ.exe
  C:\Windows\System\qcEalUQ.exe
  2⤵
  PID:2776
- C:\Windows\System\YJGohCX.exe
  C:\Windows\System\YJGohCX.exe
  2⤵
  PID:2448
- C:\Windows\System\oCWKnos.exe
  C:\Windows\System\oCWKnos.exe
  2⤵
  PID:1128
- C:\Windows\System\giIAyPR.exe
  C:\Windows\System\giIAyPR.exe
  2⤵
  PID:292
- C:\Windows\System\odqsmLt.exe
  C:\Windows\System\odqsmLt.exe
  2⤵
  PID:2412
- C:\Windows\System\uzgXiap.exe
  C:\Windows\System\uzgXiap.exe
  2⤵
  PID:272
- C:\Windows\System\VrjfcMp.exe
  C:\Windows\System\VrjfcMp.exe
  2⤵
  PID:1744
- C:\Windows\System\OzMScVQ.exe
  C:\Windows\System\OzMScVQ.exe
  2⤵
  PID:2712
- C:\Windows\System\neQlrgR.exe
  C:\Windows\System\neQlrgR.exe
  2⤵
  PID:1840
- C:\Windows\System\iPzRrWl.exe
  C:\Windows\System\iPzRrWl.exe
  2⤵
  PID:1388
- C:\Windows\System\fFCNKYf.exe
  C:\Windows\System\fFCNKYf.exe
  2⤵
  PID:1248
- C:\Windows\System\TDoZwEY.exe
  C:\Windows\System\TDoZwEY.exe
  2⤵
  PID:3028
- C:\Windows\System\vbZYaLn.exe
  C:\Windows\System\vbZYaLn.exe
  2⤵
  PID:2992
- C:\Windows\System\KBtPQkd.exe
  C:\Windows\System\KBtPQkd.exe
  2⤵
  PID:2932
- C:\Windows\System\AikzCfS.exe
  C:\Windows\System\AikzCfS.exe
  2⤵
  PID:1768
- C:\Windows\System\HMuZwbK.exe
  C:\Windows\System\HMuZwbK.exe
  2⤵
  PID:2996
- C:\Windows\System\XHwhYUc.exe
  C:\Windows\System\XHwhYUc.exe
  2⤵
  PID:2256
- C:\Windows\System\cntHmNB.exe
  C:\Windows\System\cntHmNB.exe
  2⤵
  PID:3068
- C:\Windows\System\sFAIviz.exe
  C:\Windows\System\sFAIviz.exe
  2⤵
  PID:2528
- C:\Windows\System\NlBplWV.exe
  C:\Windows\System\NlBplWV.exe
  2⤵
  PID:2372
- C:\Windows\System\xodncOv.exe
  C:\Windows\System\xodncOv.exe
  2⤵
  PID:2520
- C:\Windows\System\bdjxVoY.exe
  C:\Windows\System\bdjxVoY.exe
  2⤵
  PID:2024
- C:\Windows\System\mdXAeiM.exe
  C:\Windows\System\mdXAeiM.exe
  2⤵
  PID:2476
- C:\Windows\System\CuBdxWK.exe
  C:\Windows\System\CuBdxWK.exe
  2⤵
  PID:1168
- C:\Windows\System\VtDXkfU.exe
  C:\Windows\System\VtDXkfU.exe
  2⤵
  PID:1044
- C:\Windows\System\AjSJYgM.exe
  C:\Windows\System\AjSJYgM.exe
  2⤵
  PID:2232
- C:\Windows\System\LJtzthp.exe
  C:\Windows\System\LJtzthp.exe
  2⤵
  PID:1772
- C:\Windows\System\kftXrNk.exe
  C:\Windows\System\kftXrNk.exe
  2⤵
  PID:2376
- C:\Windows\System\SsPGMgZ.exe
  C:\Windows\System\SsPGMgZ.exe
  2⤵
  PID:1820
- C:\Windows\System\prHODRH.exe
  C:\Windows\System\prHODRH.exe
  2⤵
  PID:2820
- C:\Windows\System\xqkJvwM.exe
  C:\Windows\System\xqkJvwM.exe
  2⤵
  PID:1308
- C:\Windows\System\zdAmJyq.exe
  C:\Windows\System\zdAmJyq.exe
  2⤵
  PID:1708
- C:\Windows\System\iOtjlVo.exe
  C:\Windows\System\iOtjlVo.exe
  2⤵
  PID:2176
- C:\Windows\System\icYdesn.exe
  C:\Windows\System\icYdesn.exe
  2⤵
  PID:2404
- C:\Windows\System\yBvjxXQ.exe
  C:\Windows\System\yBvjxXQ.exe
  2⤵
  PID:1832
- C:\Windows\System\cuhojHJ.exe
  C:\Windows\System\cuhojHJ.exe
  2⤵
  PID:3076
- C:\Windows\System\XSDKRQL.exe
  C:\Windows\System\XSDKRQL.exe
  2⤵
  PID:3092
- C:\Windows\System\YLsDlfG.exe
  C:\Windows\System\YLsDlfG.exe
  2⤵
  PID:3108
- C:\Windows\System\jsIYQtu.exe
  C:\Windows\System\jsIYQtu.exe
  2⤵
  PID:3124
- C:\Windows\System\aLKXykr.exe
  C:\Windows\System\aLKXykr.exe
  2⤵
  PID:3144
- C:\Windows\System\DSULFDD.exe
  C:\Windows\System\DSULFDD.exe
  2⤵
  PID:3160
- C:\Windows\System\smZJRhm.exe
  C:\Windows\System\smZJRhm.exe
  2⤵
  PID:3176
- C:\Windows\System\BZTcKBP.exe
  C:\Windows\System\BZTcKBP.exe
  2⤵
  PID:3192
- C:\Windows\System\WseGDxs.exe
  C:\Windows\System\WseGDxs.exe
  2⤵
  PID:3208
- C:\Windows\System\SkGiiJD.exe
  C:\Windows\System\SkGiiJD.exe
  2⤵
  PID:3224
- C:\Windows\System\LjXwZfV.exe
  C:\Windows\System\LjXwZfV.exe
  2⤵
  PID:3244
- C:\Windows\System\HALasXu.exe
  C:\Windows\System\HALasXu.exe
  2⤵
  PID:3260
- C:\Windows\System\BSJLnUS.exe
  C:\Windows\System\BSJLnUS.exe
  2⤵
  PID:3276
- C:\Windows\System\CGTPEWu.exe
  C:\Windows\System\CGTPEWu.exe
  2⤵
  PID:3292
- C:\Windows\System\QiSxhbT.exe
  C:\Windows\System\QiSxhbT.exe
  2⤵
  PID:3308
- C:\Windows\System\fHtDHAS.exe
  C:\Windows\System\fHtDHAS.exe
  2⤵
  PID:3324
- C:\Windows\System\xmLkQaD.exe
  C:\Windows\System\xmLkQaD.exe
  2⤵
  PID:3340
- C:\Windows\System\VLpNNRP.exe
  C:\Windows\System\VLpNNRP.exe
  2⤵
  PID:3444
- C:\Windows\System\ZOoZeqJ.exe
  C:\Windows\System\ZOoZeqJ.exe
  2⤵
  PID:3464
- C:\Windows\System\heQQxUU.exe
  C:\Windows\System\heQQxUU.exe
  2⤵
  PID:3480
- C:\Windows\System\LefcBCn.exe
  C:\Windows\System\LefcBCn.exe
  2⤵
  PID:3496
- C:\Windows\System\xxTxDbS.exe
  C:\Windows\System\xxTxDbS.exe
  2⤵
  PID:3512
- C:\Windows\System\ktFewGw.exe
  C:\Windows\System\ktFewGw.exe
  2⤵
  PID:3528
- C:\Windows\System\CiXizLR.exe
  C:\Windows\System\CiXizLR.exe
  2⤵
  PID:3544
- C:\Windows\System\XJbyzLH.exe
  C:\Windows\System\XJbyzLH.exe
  2⤵
  PID:3560
- C:\Windows\System\RwGFdiy.exe
  C:\Windows\System\RwGFdiy.exe
  2⤵
  PID:3576
- C:\Windows\System\miFvRVh.exe
  C:\Windows\System\miFvRVh.exe
  2⤵
  PID:3596
- C:\Windows\System\BWCbQjv.exe
  C:\Windows\System\BWCbQjv.exe
  2⤵
  PID:3612
- C:\Windows\System\UMLlZrT.exe
  C:\Windows\System\UMLlZrT.exe
  2⤵
  PID:3628
- C:\Windows\System\ugKgZTP.exe
  C:\Windows\System\ugKgZTP.exe
  2⤵
  PID:3644
- C:\Windows\System\zpCOtfk.exe
  C:\Windows\System\zpCOtfk.exe
  2⤵
  PID:3660
- C:\Windows\System\uCuszBU.exe
  C:\Windows\System\uCuszBU.exe
  2⤵
  PID:3676
- C:\Windows\System\alrSOKW.exe
  C:\Windows\System\alrSOKW.exe
  2⤵
  PID:3696
- C:\Windows\System\TuwOYnl.exe
  C:\Windows\System\TuwOYnl.exe
  2⤵
  PID:3712
- C:\Windows\System\YubJJUx.exe
  C:\Windows\System\YubJJUx.exe
  2⤵
  PID:3728
- C:\Windows\System\efKEUBH.exe
  C:\Windows\System\efKEUBH.exe
  2⤵
  PID:3744
- C:\Windows\System\AOXDjMC.exe
  C:\Windows\System\AOXDjMC.exe
  2⤵
  PID:3764
- C:\Windows\System\VlHwlab.exe
  C:\Windows\System\VlHwlab.exe
  2⤵
  PID:3780
- C:\Windows\System\PUILuYq.exe
  C:\Windows\System\PUILuYq.exe
  2⤵
  PID:3796
- C:\Windows\System\tQgojdB.exe
  C:\Windows\System\tQgojdB.exe
  2⤵
  PID:3812
- C:\Windows\System\EfrJLIY.exe
  C:\Windows\System\EfrJLIY.exe
  2⤵
  PID:3828
- C:\Windows\System\tnTVAmB.exe
  C:\Windows\System\tnTVAmB.exe
  2⤵
  PID:3848
- C:\Windows\System\QhRvwOz.exe
  C:\Windows\System\QhRvwOz.exe
  2⤵
  PID:3864
- C:\Windows\System\JrUFgVw.exe
  C:\Windows\System\JrUFgVw.exe
  2⤵
  PID:3880
- C:\Windows\System\DroiGIB.exe
  C:\Windows\System\DroiGIB.exe
  2⤵
  PID:3900
- C:\Windows\System\XKBWNGV.exe
  C:\Windows\System\XKBWNGV.exe
  2⤵
  PID:3916
- C:\Windows\System\YlamVJh.exe
  C:\Windows\System\YlamVJh.exe
  2⤵
  PID:3932
- C:\Windows\System\JErURrA.exe
  C:\Windows\System\JErURrA.exe
  2⤵
  PID:3948
- C:\Windows\System\SjeIGbi.exe
  C:\Windows\System\SjeIGbi.exe
  2⤵
  PID:3968
- C:\Windows\System\DGHOTkx.exe
  C:\Windows\System\DGHOTkx.exe
  2⤵
  PID:3984
- C:\Windows\System\ZwemXKL.exe
  C:\Windows\System\ZwemXKL.exe
  2⤵
  PID:4000
- C:\Windows\System\lBJpvXK.exe
  C:\Windows\System\lBJpvXK.exe
  2⤵
  PID:4016
- C:\Windows\System\coNDfYm.exe
  C:\Windows\System\coNDfYm.exe
  2⤵
  PID:4036
- C:\Windows\System\ROnojfT.exe
  C:\Windows\System\ROnojfT.exe
  2⤵
  PID:4052
- C:\Windows\System\agOeOax.exe
  C:\Windows\System\agOeOax.exe
  2⤵
  PID:4068
- C:\Windows\System\VwvKdip.exe
  C:\Windows\System\VwvKdip.exe
  2⤵
  PID:3184
- C:\Windows\System\WApgayI.exe
  C:\Windows\System\WApgayI.exe
  2⤵
  PID:2060
- C:\Windows\System\rkwurQQ.exe
  C:\Windows\System\rkwurQQ.exe
  2⤵
  PID:640
- C:\Windows\System\FsFavMc.exe
  C:\Windows\System\FsFavMc.exe
  2⤵
  PID:2672
- C:\Windows\System\ShUvDUp.exe
  C:\Windows\System\ShUvDUp.exe
  2⤵
  PID:3320
- C:\Windows\System\zKKcBYw.exe
  C:\Windows\System\zKKcBYw.exe
  2⤵
  PID:3368
- C:\Windows\System\nmcgelQ.exe
  C:\Windows\System\nmcgelQ.exe
  2⤵
  PID:3380
- C:\Windows\System\ZLkDLpI.exe
  C:\Windows\System\ZLkDLpI.exe
  2⤵
  PID:3400
- C:\Windows\System\kFnvKFh.exe
  C:\Windows\System\kFnvKFh.exe
  2⤵
  PID:3420
- C:\Windows\System\Qbzaigd.exe
  C:\Windows\System\Qbzaigd.exe
  2⤵
  PID:3436
- C:\Windows\System\rznrByO.exe
  C:\Windows\System\rznrByO.exe
  2⤵
  PID:3472
- C:\Windows\System\YomhLcu.exe
  C:\Windows\System\YomhLcu.exe
  2⤵
  PID:3536
- C:\Windows\System\GnWrwNg.exe
  C:\Windows\System\GnWrwNg.exe
  2⤵
  PID:3804
- C:\Windows\System\CtJNoIR.exe
  C:\Windows\System\CtJNoIR.exe
  2⤵
  PID:3640
- C:\Windows\System\fzVOTEd.exe
  C:\Windows\System\fzVOTEd.exe
  2⤵
  PID:1580
- C:\Windows\System\awMuVht.exe
  C:\Windows\System\awMuVht.exe
  2⤵
  PID:2240
- C:\Windows\System\JSIDnEo.exe
  C:\Windows\System\JSIDnEo.exe
  2⤵
  PID:760
- C:\Windows\System\TsyVISF.exe
  C:\Windows\System\TsyVISF.exe
  2⤵
  PID:1788
- C:\Windows\System\DGLcswi.exe
  C:\Windows\System\DGLcswi.exe
  2⤵
  PID:3136
- C:\Windows\System\dvkeOmz.exe
  C:\Windows\System\dvkeOmz.exe
  2⤵
  PID:3272
- C:\Windows\System\aedztjG.exe
  C:\Windows\System\aedztjG.exe
  2⤵
  PID:4008
- C:\Windows\System\arsvPio.exe
  C:\Windows\System\arsvPio.exe
  2⤵
  PID:4076
- C:\Windows\System\pZWyzFQ.exe
  C:\Windows\System\pZWyzFQ.exe
  2⤵
  PID:1648
- C:\Windows\System\fXXqFrM.exe
  C:\Windows\System\fXXqFrM.exe
  2⤵
  PID:2440
- C:\Windows\System\URFVNil.exe
  C:\Windows\System\URFVNil.exe
  2⤵
  PID:2692
- C:\Windows\System\jEzPrdA.exe
  C:\Windows\System\jEzPrdA.exe
  2⤵
  PID:580
- C:\Windows\System\UpFKnUY.exe
  C:\Windows\System\UpFKnUY.exe
  2⤵
  PID:1240
- C:\Windows\System\qnyfnTA.exe
  C:\Windows\System\qnyfnTA.exe
  2⤵
  PID:3584
- C:\Windows\System\nmhSzpf.exe
  C:\Windows\System\nmhSzpf.exe
  2⤵
  PID:4084
- C:\Windows\System\ErXzqBk.exe
  C:\Windows\System\ErXzqBk.exe
  2⤵
  PID:2880
- C:\Windows\System\rEuades.exe
  C:\Windows\System\rEuades.exe
  2⤵
  PID:412
- C:\Windows\System\TuZddDw.exe
  C:\Windows\System\TuZddDw.exe
  2⤵
  PID:1868
- C:\Windows\System\GDUVSvp.exe
  C:\Windows\System\GDUVSvp.exe
  2⤵
  PID:1640
- C:\Windows\System\RfMhfad.exe
  C:\Windows\System\RfMhfad.exe
  2⤵
  PID:3188
- C:\Windows\System\JGzahmK.exe
  C:\Windows\System\JGzahmK.exe
  2⤵
  PID:3316
- C:\Windows\System\pjLylyI.exe
  C:\Windows\System\pjLylyI.exe
  2⤵
  PID:3688
- C:\Windows\System\PqfNmgW.exe
  C:\Windows\System\PqfNmgW.exe
  2⤵
  PID:3724
- C:\Windows\System\YZfCbHT.exe
  C:\Windows\System\YZfCbHT.exe
  2⤵
  PID:3792
- C:\Windows\System\nQCjSjB.exe
  C:\Windows\System\nQCjSjB.exe
  2⤵
  PID:3860
- C:\Windows\System\dHqyWAi.exe
  C:\Windows\System\dHqyWAi.exe
  2⤵
  PID:3924
- C:\Windows\System\geiPZwr.exe
  C:\Windows\System\geiPZwr.exe
  2⤵
  PID:3964
- C:\Windows\System\lLLcwKi.exe
  C:\Windows\System\lLLcwKi.exe
  2⤵
  PID:4064
- C:\Windows\System\cYSamHC.exe
  C:\Windows\System\cYSamHC.exe
  2⤵
  PID:3416
- C:\Windows\System\TVrcmHU.exe
  C:\Windows\System\TVrcmHU.exe
  2⤵
  PID:3736
- C:\Windows\System\UVMAEFl.exe
  C:\Windows\System\UVMAEFl.exe
  2⤵
  PID:3432
- C:\Windows\System\XbRqVUw.exe
  C:\Windows\System\XbRqVUw.exe
  2⤵
  PID:3672
- C:\Windows\System\EQeDeCY.exe
  C:\Windows\System\EQeDeCY.exe
  2⤵
  PID:2008
- C:\Windows\System\xjZHUik.exe
  C:\Windows\System\xjZHUik.exe
  2⤵
  PID:3708
- C:\Windows\System\QnbcXLF.exe
  C:\Windows\System\QnbcXLF.exe
  2⤵
  PID:3232
- C:\Windows\System\FHIiBqT.exe
  C:\Windows\System\FHIiBqT.exe
  2⤵
  PID:3168
- C:\Windows\System\drXgKdA.exe
  C:\Windows\System\drXgKdA.exe
  2⤵
  PID:3608
- C:\Windows\System\yZPMOSr.exe
  C:\Windows\System\yZPMOSr.exe
  2⤵
  PID:1784
- C:\Windows\System\FaAhvmr.exe
  C:\Windows\System\FaAhvmr.exe
  2⤵
  PID:3456
- C:\Windows\System\xUBuQoV.exe
  C:\Windows\System\xUBuQoV.exe
  2⤵
  PID:4044
- C:\Windows\System\ytIjsaN.exe
  C:\Windows\System\ytIjsaN.exe
  2⤵
  PID:4092
- C:\Windows\System\WNGAdhP.exe
  C:\Windows\System\WNGAdhP.exe
  2⤵
  PID:2044
- C:\Windows\System\CirONxV.exe
  C:\Windows\System\CirONxV.exe
  2⤵
  PID:2392
- C:\Windows\System\GvhjcCK.exe
  C:\Windows\System\GvhjcCK.exe
  2⤵
  PID:3284
- C:\Windows\System\wNdzbVk.exe
  C:\Windows\System\wNdzbVk.exe
  2⤵
  PID:3220
- C:\Windows\System\cXrTCuY.exe
  C:\Windows\System\cXrTCuY.exe
  2⤵
  PID:3720
- C:\Windows\System\aEiQNhe.exe
  C:\Windows\System\aEiQNhe.exe
  2⤵
  PID:3252
- C:\Windows\System\bzgssHk.exe
  C:\Windows\System\bzgssHk.exe
  2⤵
  PID:3856
- C:\Windows\System\ludQEJZ.exe
  C:\Windows\System\ludQEJZ.exe
  2⤵
  PID:3524
- C:\Windows\System\WWghBUk.exe
  C:\Windows\System\WWghBUk.exe
  2⤵
  PID:3492
- C:\Windows\System\kfjRXJk.exe
  C:\Windows\System\kfjRXJk.exe
  2⤵
  PID:3684
- C:\Windows\System\gtzRjJs.exe
  C:\Windows\System\gtzRjJs.exe
  2⤵
  PID:3384
- C:\Windows\System\JdjBqIV.exe
  C:\Windows\System\JdjBqIV.exe
  2⤵
  PID:4032
- C:\Windows\System\oYEDICk.exe
  C:\Windows\System\oYEDICk.exe
  2⤵
  PID:2636
- C:\Windows\System\lFnsoAa.exe
  C:\Windows\System\lFnsoAa.exe
  2⤵
  PID:908
- C:\Windows\System\sRyoWeP.exe
  C:\Windows\System\sRyoWeP.exe
  2⤵
  PID:4108
- C:\Windows\System\zqoWtKk.exe
  C:\Windows\System\zqoWtKk.exe
  2⤵
  PID:4124
- C:\Windows\System\lsjFnxz.exe
  C:\Windows\System\lsjFnxz.exe
  2⤵
  PID:4152
- C:\Windows\System\SAgtddy.exe
  C:\Windows\System\SAgtddy.exe
  2⤵
  PID:4168
- C:\Windows\System\xbiwHzA.exe
  C:\Windows\System\xbiwHzA.exe
  2⤵
  PID:4196
- C:\Windows\System\BqenhDh.exe
  C:\Windows\System\BqenhDh.exe
  2⤵
  PID:4308
- C:\Windows\System\pRgcnKB.exe
  C:\Windows\System\pRgcnKB.exe
  2⤵
  PID:4324
- C:\Windows\System\UnboVdz.exe
  C:\Windows\System\UnboVdz.exe
  2⤵
  PID:4340
- C:\Windows\System\JEnWSrk.exe
  C:\Windows\System\JEnWSrk.exe
  2⤵
  PID:4356
- C:\Windows\System\roKefyC.exe
  C:\Windows\System\roKefyC.exe
  2⤵
  PID:4372
- C:\Windows\System\lkaWChK.exe
  C:\Windows\System\lkaWChK.exe
  2⤵
  PID:4396
- C:\Windows\System\RXGzZtA.exe
  C:\Windows\System\RXGzZtA.exe
  2⤵
  PID:4416
- C:\Windows\System\cAnwPwa.exe
  C:\Windows\System\cAnwPwa.exe
  2⤵
  PID:4440
- C:\Windows\System\vCzwCLh.exe
  C:\Windows\System\vCzwCLh.exe
  2⤵
  PID:4460
- C:\Windows\System\PzDJJfd.exe
  C:\Windows\System\PzDJJfd.exe
  2⤵
  PID:4480
- C:\Windows\System\eKdaauM.exe
  C:\Windows\System\eKdaauM.exe
  2⤵
  PID:4500
- C:\Windows\System\VNTGEwn.exe
  C:\Windows\System\VNTGEwn.exe
  2⤵
  PID:4520
- C:\Windows\System\dURJHtW.exe
  C:\Windows\System\dURJHtW.exe
  2⤵
  PID:4540
- C:\Windows\System\cmzZgGG.exe
  C:\Windows\System\cmzZgGG.exe
  2⤵
  PID:4556
- C:\Windows\System\pfZhmBw.exe
  C:\Windows\System\pfZhmBw.exe
  2⤵
  PID:4580
- C:\Windows\System\KToPhPQ.exe
  C:\Windows\System\KToPhPQ.exe
  2⤵
  PID:4600
- C:\Windows\System\GyAzZfC.exe
  C:\Windows\System\GyAzZfC.exe
  2⤵
  PID:4620
- C:\Windows\System\nUdViJN.exe
  C:\Windows\System\nUdViJN.exe
  2⤵
  PID:4640
- C:\Windows\System\MLebMGs.exe
  C:\Windows\System\MLebMGs.exe
  2⤵
  PID:4664
- C:\Windows\System\bsOqkzz.exe
  C:\Windows\System\bsOqkzz.exe
  2⤵
  PID:4688
- C:\Windows\System\hCuvmCC.exe
  C:\Windows\System\hCuvmCC.exe
  2⤵
  PID:4704
- C:\Windows\System\sVBUOCV.exe
  C:\Windows\System\sVBUOCV.exe
  2⤵
  PID:4724
- C:\Windows\System\GDqxcAY.exe
  C:\Windows\System\GDqxcAY.exe
  2⤵
  PID:4740
- C:\Windows\System\nHukVuF.exe
  C:\Windows\System\nHukVuF.exe
  2⤵
  PID:4760
- C:\Windows\System\PPeasdQ.exe
  C:\Windows\System\PPeasdQ.exe
  2⤵
  PID:4776
- C:\Windows\System\JLTNIIW.exe
  C:\Windows\System\JLTNIIW.exe
  2⤵
  PID:4792
- C:\Windows\System\zbjBxOW.exe
  C:\Windows\System\zbjBxOW.exe
  2⤵
  PID:4808
- C:\Windows\System\GphtVvI.exe
  C:\Windows\System\GphtVvI.exe
  2⤵
  PID:4824
- C:\Windows\System\voCPydi.exe
  C:\Windows\System\voCPydi.exe
  2⤵
  PID:4844
- C:\Windows\System\FeUUbkN.exe
  C:\Windows\System\FeUUbkN.exe
  2⤵
  PID:4860
- C:\Windows\System\edErKgJ.exe
  C:\Windows\System\edErKgJ.exe
  2⤵
  PID:4876
- C:\Windows\System\YyYfEQI.exe
  C:\Windows\System\YyYfEQI.exe
  2⤵
  PID:4900
- C:\Windows\System\nPvOAyw.exe
  C:\Windows\System\nPvOAyw.exe
  2⤵
  PID:4916
- C:\Windows\System\avVHiQv.exe
  C:\Windows\System\avVHiQv.exe
  2⤵
  PID:4932
- C:\Windows\System\NlNONld.exe
  C:\Windows\System\NlNONld.exe
  2⤵
  PID:4992
- C:\Windows\System\ctfkczM.exe
  C:\Windows\System\ctfkczM.exe
  2⤵
  PID:5008
- C:\Windows\System\aKmktbd.exe
  C:\Windows\System\aKmktbd.exe
  2⤵
  PID:5024
- C:\Windows\System\OfcXDMc.exe
  C:\Windows\System\OfcXDMc.exe
  2⤵
  PID:5040
- C:\Windows\System\KJLJRvx.exe
  C:\Windows\System\KJLJRvx.exe
  2⤵
  PID:5056
- C:\Windows\System\yvpsxNq.exe
  C:\Windows\System\yvpsxNq.exe
  2⤵
  PID:5072
- C:\Windows\System\UaHpUzF.exe
  C:\Windows\System\UaHpUzF.exe
  2⤵
  PID:5092
- C:\Windows\System\hwWROoK.exe
  C:\Windows\System\hwWROoK.exe
  2⤵
  PID:5108
- C:\Windows\System\PqKEqPz.exe
  C:\Windows\System\PqKEqPz.exe
  2⤵
  PID:3704
- C:\Windows\System\BLNEqDz.exe
  C:\Windows\System\BLNEqDz.exe
  2⤵
  PID:3572
- C:\Windows\System\ywApOvM.exe
  C:\Windows\System\ywApOvM.exe
  2⤵
  PID:3452
- C:\Windows\System\LnuUYYd.exe
  C:\Windows\System\LnuUYYd.exe
  2⤵
  PID:1992
- C:\Windows\System\DAUQqhJ.exe
  C:\Windows\System\DAUQqhJ.exe
  2⤵
  PID:4088
- C:\Windows\System\rsorFqC.exe
  C:\Windows\System\rsorFqC.exe
  2⤵
  PID:3116
- C:\Windows\System\fqVjYeV.exe
  C:\Windows\System\fqVjYeV.exe
  2⤵
  PID:3408
- C:\Windows\System\DZcOknJ.exe
  C:\Windows\System\DZcOknJ.exe
  2⤵
  PID:4100
- C:\Windows\System\tMKeORE.exe
  C:\Windows\System\tMKeORE.exe
  2⤵
  PID:4140
- C:\Windows\System\tsvQhUL.exe
  C:\Windows\System\tsvQhUL.exe
  2⤵
  PID:3152
- C:\Windows\System\KLUqvxK.exe
  C:\Windows\System\KLUqvxK.exe
  2⤵
  PID:3892
- C:\Windows\System\pVObQCc.exe
  C:\Windows\System\pVObQCc.exe
  2⤵
  PID:4204
- C:\Windows\System\qtHEsFr.exe
  C:\Windows\System\qtHEsFr.exe
  2⤵
  PID:4212
- C:\Windows\System\CxaLeKa.exe
  C:\Windows\System\CxaLeKa.exe
  2⤵
  PID:4216
- C:\Windows\System\WkCmifP.exe
  C:\Windows\System\WkCmifP.exe
  2⤵
  PID:4236
- C:\Windows\System\DIoRItU.exe
  C:\Windows\System\DIoRItU.exe
  2⤵
  PID:4248
- C:\Windows\System\WDdkRSp.exe
  C:\Windows\System\WDdkRSp.exe
  2⤵
  PID:4264
- C:\Windows\System\rxSbCgj.exe
  C:\Windows\System\rxSbCgj.exe
  2⤵
  PID:4280
- C:\Windows\System\gxNYitX.exe
  C:\Windows\System\gxNYitX.exe
  2⤵
  PID:4300
- C:\Windows\System\EKBhYhq.exe
  C:\Windows\System\EKBhYhq.exe
  2⤵
  PID:4336
- C:\Windows\System\EnjfHix.exe
  C:\Windows\System\EnjfHix.exe
  2⤵
  PID:4368
- C:\Windows\System\FTpPyAf.exe
  C:\Windows\System\FTpPyAf.exe
  2⤵
  PID:4388
- C:\Windows\System\qrcaCsK.exe
  C:\Windows\System\qrcaCsK.exe
  2⤵
  PID:4408
- C:\Windows\System\aJEseFK.exe
  C:\Windows\System\aJEseFK.exe
  2⤵
  PID:4436
- C:\Windows\System\AegQlZQ.exe
  C:\Windows\System\AegQlZQ.exe
  2⤵
  PID:4468
- C:\Windows\System\VdIxVaE.exe
  C:\Windows\System\VdIxVaE.exe
  2⤵
  PID:4516
- C:\Windows\System\QABroeG.exe
  C:\Windows\System\QABroeG.exe
  2⤵
  PID:4536
- C:\Windows\System\jZQZjxo.exe
  C:\Windows\System\jZQZjxo.exe
  2⤵
  PID:4548
- C:\Windows\System\ODUQGQo.exe
  C:\Windows\System\ODUQGQo.exe
  2⤵
  PID:4572
- C:\Windows\System\JfOEjgO.exe
  C:\Windows\System\JfOEjgO.exe
  2⤵
  PID:4596
- C:\Windows\System\IjXjpJy.exe
  C:\Windows\System\IjXjpJy.exe
  2⤵
  PID:2076
- C:\Windows\System\mNGteaS.exe
  C:\Windows\System\mNGteaS.exe
  2⤵
  PID:4276
- C:\Windows\System\BHdlrJr.exe
  C:\Windows\System\BHdlrJr.exe
  2⤵
  PID:4648
- C:\Windows\System\uUcDUqr.exe
  C:\Windows\System\uUcDUqr.exe
  2⤵
  PID:4700
- C:\Windows\System\xOtWdgK.exe
  C:\Windows\System\xOtWdgK.exe
  2⤵
  PID:4756
- C:\Windows\System\zzOuAVt.exe
  C:\Windows\System\zzOuAVt.exe
  2⤵
  PID:4712
- C:\Windows\System\qljNptN.exe
  C:\Windows\System\qljNptN.exe
  2⤵
  PID:4924
- C:\Windows\System\BpuTZWc.exe
  C:\Windows\System\BpuTZWc.exe
  2⤵
  PID:4852
- C:\Windows\System\yPaCzaF.exe
  C:\Windows\System\yPaCzaF.exe
  2⤵
  PID:4960
- C:\Windows\System\PIlHWBS.exe
  C:\Windows\System\PIlHWBS.exe
  2⤵
  PID:4980
- C:\Windows\System\ieNmaje.exe
  C:\Windows\System\ieNmaje.exe
  2⤵
  PID:5020
- C:\Windows\System\MMzrpca.exe
  C:\Windows\System\MMzrpca.exe
  2⤵
  PID:3240
- C:\Windows\System\IoXJYNG.exe
  C:\Windows\System\IoXJYNG.exe
  2⤵
  PID:5036
- C:\Windows\System\QexBfaw.exe
  C:\Windows\System\QexBfaw.exe
  2⤵
  PID:3620
- C:\Windows\System\HjJxjbC.exe
  C:\Windows\System\HjJxjbC.exe
  2⤵
  PID:5080
- C:\Windows\System\JkqUyrN.exe
  C:\Windows\System\JkqUyrN.exe
  2⤵
  PID:3552
- C:\Windows\System\fkkNjFC.exe
  C:\Windows\System\fkkNjFC.exe
  2⤵
  PID:3980
- C:\Windows\System\AfQxdMC.exe
  C:\Windows\System\AfQxdMC.exe
  2⤵
  PID:2540
- C:\Windows\System\dCjkUmH.exe
  C:\Windows\System\dCjkUmH.exe
  2⤵
  PID:4104
- C:\Windows\System\PWbrQqn.exe
  C:\Windows\System\PWbrQqn.exe
  2⤵
  PID:3656
- C:\Windows\System\QHcwQpW.exe
  C:\Windows\System\QHcwQpW.exe
  2⤵
  PID:3364
- C:\Windows\System\TruqTIy.exe
  C:\Windows\System\TruqTIy.exe
  2⤵
  PID:2292
- C:\Windows\System\QMLroyy.exe
  C:\Windows\System\QMLroyy.exe
  2⤵
  PID:4208
- C:\Windows\System\CcmWGTe.exe
  C:\Windows\System\CcmWGTe.exe
  2⤵
  PID:4224
- C:\Windows\System\pcrnuVb.exe
  C:\Windows\System\pcrnuVb.exe
  2⤵
  PID:4316
- C:\Windows\System\cJDDrOw.exe
  C:\Windows\System\cJDDrOw.exe
  2⤵
  PID:4272
- C:\Windows\System\cCxrFRm.exe
  C:\Windows\System\cCxrFRm.exe
  2⤵
  PID:4348
- C:\Windows\System\IVHhqVN.exe
  C:\Windows\System\IVHhqVN.exe
  2⤵
  PID:4380
- C:\Windows\System\dsIEORs.exe
  C:\Windows\System\dsIEORs.exe
  2⤵
  PID:4456
- C:\Windows\System\lNnQGlA.exe
  C:\Windows\System\lNnQGlA.exe
  2⤵
  PID:4512
- C:\Windows\System\YnRatgc.exe
  C:\Windows\System\YnRatgc.exe
  2⤵
  PID:4564
- C:\Windows\System\vaAujWI.exe
  C:\Windows\System\vaAujWI.exe
  2⤵
  PID:4592
- C:\Windows\System\UqCOHRW.exe
  C:\Windows\System\UqCOHRW.exe
  2⤵
  PID:4696
- C:\Windows\System\PvGohXZ.exe
  C:\Windows\System\PvGohXZ.exe
  2⤵
  PID:4768
- C:\Windows\System\OcLllcs.exe
  C:\Windows\System\OcLllcs.exe
  2⤵
  PID:4800
- C:\Windows\System\rcohdny.exe
  C:\Windows\System\rcohdny.exe
  2⤵
  PID:4656
- C:\Windows\System\WShghii.exe
  C:\Windows\System\WShghii.exe
  2⤵
  PID:4912
- C:\Windows\System\dmMvEHl.exe
  C:\Windows\System\dmMvEHl.exe
  2⤵
  PID:4820
- C:\Windows\System\MGiaKaM.exe
  C:\Windows\System\MGiaKaM.exe
  2⤵
  PID:4788
- C:\Windows\System\oMFUckp.exe
  C:\Windows\System\oMFUckp.exe
  2⤵
  PID:4720
- C:\Windows\System\QdZFgPm.exe
  C:\Windows\System\QdZFgPm.exe
  2⤵
  PID:4952
- C:\Windows\System\hTvFQVy.exe
  C:\Windows\System\hTvFQVy.exe
  2⤵
  PID:4892
- C:\Windows\System\CVNWYam.exe
  C:\Windows\System\CVNWYam.exe
  2⤵
  PID:2420
- C:\Windows\System\BmkKvKr.exe
  C:\Windows\System\BmkKvKr.exe
  2⤵
  PID:4888
- C:\Windows\System\WmswZmq.exe
  C:\Windows\System\WmswZmq.exe
  2⤵
  PID:3504
- C:\Windows\System\VmGDfnh.exe
  C:\Windows\System\VmGDfnh.exe
  2⤵
  PID:2484
- C:\Windows\System\pfpVOzx.exe
  C:\Windows\System\pfpVOzx.exe
  2⤵
  PID:3652
- C:\Windows\System\IKWVAYn.exe
  C:\Windows\System\IKWVAYn.exe
  2⤵
  PID:4180
- C:\Windows\System\Bwwahud.exe
  C:\Windows\System\Bwwahud.exe
  2⤵
  PID:4292
- C:\Windows\System\jcmbeea.exe
  C:\Windows\System\jcmbeea.exe
  2⤵
  PID:4452
- C:\Windows\System\ZyGOiZc.exe
  C:\Windows\System\ZyGOiZc.exe
  2⤵
  PID:1596
- C:\Windows\System\pPVESpo.exe
  C:\Windows\System\pPVESpo.exe
  2⤵
  PID:348
- C:\Windows\System\xdTDVNc.exe
  C:\Windows\System\xdTDVNc.exe
  2⤵
  PID:4176
- C:\Windows\System\NBzbVZL.exe
  C:\Windows\System\NBzbVZL.exe
  2⤵
  PID:3012
- C:\Windows\System\OKepqdg.exe
  C:\Windows\System\OKepqdg.exe
  2⤵
  PID:4836
- C:\Windows\System\CjuvEmQ.exe
  C:\Windows\System\CjuvEmQ.exe
  2⤵
  PID:4680
- C:\Windows\System\YpirWJT.exe
  C:\Windows\System\YpirWJT.exe
  2⤵
  PID:5088
- C:\Windows\System\mlxgWuz.exe
  C:\Windows\System\mlxgWuz.exe
  2⤵
  PID:4816
- C:\Windows\System\SOwOagd.exe
  C:\Windows\System\SOwOagd.exe
  2⤵
  PID:4632
- C:\Windows\System\ggQrwse.exe
  C:\Windows\System\ggQrwse.exe
  2⤵
  PID:4944
- C:\Windows\System\sMGgkIp.exe
  C:\Windows\System\sMGgkIp.exe
  2⤵
  PID:5064
- C:\Windows\System\rTkOwQQ.exe
  C:\Windows\System\rTkOwQQ.exe
  2⤵
  PID:3508
- C:\Windows\System\qTcylYi.exe
  C:\Windows\System\qTcylYi.exe
  2⤵
  PID:4384
- C:\Windows\System\KSphaaZ.exe
  C:\Windows\System\KSphaaZ.exe
  2⤵
  PID:3396
- C:\Windows\System\smaRDXZ.exe
  C:\Windows\System\smaRDXZ.exe
  2⤵
  PID:3428
- C:\Windows\System\EEDVSGm.exe
  C:\Windows\System\EEDVSGm.exe
  2⤵
  PID:2860
- C:\Windows\System\eykdMUL.exe
  C:\Windows\System\eykdMUL.exe
  2⤵
  PID:4136
- C:\Windows\System\lFRjIzk.exe
  C:\Windows\System\lFRjIzk.exe
  2⤵
  PID:4260
- C:\Windows\System\RALvCkG.exe
  C:\Windows\System\RALvCkG.exe
  2⤵
  PID:3256
- C:\Windows\System\pFcykIN.exe
  C:\Windows\System\pFcykIN.exe
  2⤵
  PID:3520
- C:\Windows\System\PDmmCcq.exe
  C:\Windows\System\PDmmCcq.exe
  2⤵
  PID:4988
- C:\Windows\System\MPtQzfa.exe
  C:\Windows\System\MPtQzfa.exe
  2⤵
  PID:4968
- C:\Windows\System\cDDAixx.exe
  C:\Windows\System\cDDAixx.exe
  2⤵
  PID:2968
- C:\Windows\System\cIWiNLx.exe
  C:\Windows\System\cIWiNLx.exe
  2⤵
  PID:4232
- C:\Windows\System\WikgYzQ.exe
  C:\Windows\System\WikgYzQ.exe
  2⤵
  PID:3172
- C:\Windows\System\HlQCHqz.exe
  C:\Windows\System\HlQCHqz.exe
  2⤵
  PID:4024
- C:\Windows\System\KmtrNla.exe
  C:\Windows\System\KmtrNla.exe
  2⤵
  PID:4244
- C:\Windows\System\NALJgVD.exe
  C:\Windows\System\NALJgVD.exe
  2⤵
  PID:576
- C:\Windows\System\DnqNtgL.exe
  C:\Windows\System\DnqNtgL.exe
  2⤵
  PID:5124
- C:\Windows\System\nEOBoqE.exe
  C:\Windows\System\nEOBoqE.exe
  2⤵
  PID:5144
- C:\Windows\System\ZQtyPrd.exe
  C:\Windows\System\ZQtyPrd.exe
  2⤵
  PID:5160
- C:\Windows\System\AqKqgay.exe
  C:\Windows\System\AqKqgay.exe
  2⤵
  PID:5176
- C:\Windows\System\OGSyzHl.exe
  C:\Windows\System\OGSyzHl.exe
  2⤵
  PID:5192
- C:\Windows\System\VEDUapy.exe
  C:\Windows\System\VEDUapy.exe
  2⤵
  PID:5208
- C:\Windows\System\haHhsSS.exe
  C:\Windows\System\haHhsSS.exe
  2⤵
  PID:5228
- C:\Windows\System\HlXJogb.exe
  C:\Windows\System\HlXJogb.exe
  2⤵
  PID:5244
- C:\Windows\System\mSYghyr.exe
  C:\Windows\System\mSYghyr.exe
  2⤵
  PID:5260
- C:\Windows\System\ZyGujFr.exe
  C:\Windows\System\ZyGujFr.exe
  2⤵
  PID:5276
- C:\Windows\System\wHqgtrn.exe
  C:\Windows\System\wHqgtrn.exe
  2⤵
  PID:5336
- C:\Windows\System\PLKjHSE.exe
  C:\Windows\System\PLKjHSE.exe
  2⤵
  PID:5352
- C:\Windows\System\NlMPask.exe
  C:\Windows\System\NlMPask.exe
  2⤵
  PID:5368
- C:\Windows\System\FrfchjH.exe
  C:\Windows\System\FrfchjH.exe
  2⤵
  PID:5384
- C:\Windows\System\jCvmFen.exe
  C:\Windows\System\jCvmFen.exe
  2⤵
  PID:5400
- C:\Windows\System\WcdBOGG.exe
  C:\Windows\System\WcdBOGG.exe
  2⤵
  PID:5416
- C:\Windows\System\npTsTUe.exe
  C:\Windows\System\npTsTUe.exe
  2⤵
  PID:5432
- C:\Windows\System\EBQBzxE.exe
  C:\Windows\System\EBQBzxE.exe
  2⤵
  PID:5448
- C:\Windows\System\jMFZGjV.exe
  C:\Windows\System\jMFZGjV.exe
  2⤵
  PID:5464
- C:\Windows\System\edwCxUu.exe
  C:\Windows\System\edwCxUu.exe
  2⤵
  PID:5480
- C:\Windows\System\UkzlskX.exe
  C:\Windows\System\UkzlskX.exe
  2⤵
  PID:5496
- C:\Windows\System\TSXYHBW.exe
  C:\Windows\System\TSXYHBW.exe
  2⤵
  PID:5512
- C:\Windows\System\xAXfbvj.exe
  C:\Windows\System\xAXfbvj.exe
  2⤵
  PID:5528
- C:\Windows\System\GbChcGB.exe
  C:\Windows\System\GbChcGB.exe
  2⤵
  PID:5544
- C:\Windows\System\GAyhhlK.exe
  C:\Windows\System\GAyhhlK.exe
  2⤵
  PID:5560
- C:\Windows\System\hHihJLj.exe
  C:\Windows\System\hHihJLj.exe
  2⤵
  PID:5576
- C:\Windows\System\zBEGYXR.exe
  C:\Windows\System\zBEGYXR.exe
  2⤵
  PID:5592
- C:\Windows\System\kVukCeF.exe
  C:\Windows\System\kVukCeF.exe
  2⤵
  PID:5608
- C:\Windows\System\OADueql.exe
  C:\Windows\System\OADueql.exe
  2⤵
  PID:5624
- C:\Windows\System\XaVXtLB.exe
  C:\Windows\System\XaVXtLB.exe
  2⤵
  PID:5640
- C:\Windows\System\Xmlioxa.exe
  C:\Windows\System\Xmlioxa.exe
  2⤵
  PID:5656
- C:\Windows\System\ARWiLgn.exe
  C:\Windows\System\ARWiLgn.exe
  2⤵
  PID:5672
- C:\Windows\System\zoMyrXF.exe
  C:\Windows\System\zoMyrXF.exe
  2⤵
  PID:5688
- C:\Windows\System\yJvcXIk.exe
  C:\Windows\System\yJvcXIk.exe
  2⤵
  PID:5704
- C:\Windows\System\iGhZxcp.exe
  C:\Windows\System\iGhZxcp.exe
  2⤵
  PID:5724
- C:\Windows\System\jjIiWMb.exe
  C:\Windows\System\jjIiWMb.exe
  2⤵
  PID:5740
- C:\Windows\System\vkaPjjx.exe
  C:\Windows\System\vkaPjjx.exe
  2⤵
  PID:5756
- C:\Windows\System\lCowzmG.exe
  C:\Windows\System\lCowzmG.exe
  2⤵
  PID:5772
- C:\Windows\System\tbLSuQN.exe
  C:\Windows\System\tbLSuQN.exe
  2⤵
  PID:5788
- C:\Windows\System\oXPkSBh.exe
  C:\Windows\System\oXPkSBh.exe
  2⤵
  PID:5804
- C:\Windows\System\UYzFYqe.exe
  C:\Windows\System\UYzFYqe.exe
  2⤵
  PID:5820
- C:\Windows\System\LnAzDaB.exe
  C:\Windows\System\LnAzDaB.exe
  2⤵
  PID:5836
- C:\Windows\System\ZgPuCJe.exe
  C:\Windows\System\ZgPuCJe.exe
  2⤵
  PID:5852
- C:\Windows\System\ncfUFtv.exe
  C:\Windows\System\ncfUFtv.exe
  2⤵
  PID:5972
- C:\Windows\System\mTLLTrA.exe
  C:\Windows\System\mTLLTrA.exe
  2⤵
  PID:5988
- C:\Windows\System\wpEoiSo.exe
  C:\Windows\System\wpEoiSo.exe
  2⤵
  PID:4116
- C:\Windows\System\dTbeTPT.exe
  C:\Windows\System\dTbeTPT.exe
  2⤵
  PID:5188
- C:\Windows\System\Roceyzc.exe
  C:\Windows\System\Roceyzc.exe
  2⤵
  PID:5252
- C:\Windows\System\DyaweWM.exe
  C:\Windows\System\DyaweWM.exe
  2⤵
  PID:5292
- C:\Windows\System\QxNynJI.exe
  C:\Windows\System\QxNynJI.exe
  2⤵
  PID:4492
- C:\Windows\System\FbzhWUg.exe
  C:\Windows\System\FbzhWUg.exe
  2⤵
  PID:5140
- C:\Windows\System\TeZurLh.exe
  C:\Windows\System\TeZurLh.exe
  2⤵
  PID:5328
- C:\Windows\System\ZjKVVWw.exe
  C:\Windows\System\ZjKVVWw.exe
  2⤵
  PID:5320
- C:\Windows\System\GktKpnq.exe
  C:\Windows\System\GktKpnq.exe
  2⤵
  PID:5236
- C:\Windows\System\syZkUlt.exe
  C:\Windows\System\syZkUlt.exe
  2⤵
  PID:5392
- C:\Windows\System\IZhFAPy.exe
  C:\Windows\System\IZhFAPy.exe
  2⤵
  PID:5456
- C:\Windows\System\JEafRPR.exe
  C:\Windows\System\JEafRPR.exe
  2⤵
  PID:5520
- C:\Windows\System\HYxJrdT.exe
  C:\Windows\System\HYxJrdT.exe
  2⤵
  PID:5552
- C:\Windows\System\EwLMsTy.exe
  C:\Windows\System\EwLMsTy.exe
  2⤵
  PID:5344
- C:\Windows\System\BPsOqyY.exe
  C:\Windows\System\BPsOqyY.exe
  2⤵
  PID:5680
- C:\Windows\System\NkhwGbQ.exe
  C:\Windows\System\NkhwGbQ.exe
  2⤵
  PID:5376
- C:\Windows\System\csEQZCF.exe
  C:\Windows\System\csEQZCF.exe
  2⤵
  PID:5568
- C:\Windows\System\lnxaraF.exe
  C:\Windows\System\lnxaraF.exe
  2⤵
  PID:5664
- C:\Windows\System\dnEnCvE.exe
  C:\Windows\System\dnEnCvE.exe
  2⤵
  PID:5472
- C:\Windows\System\EGvOAzX.exe
  C:\Windows\System\EGvOAzX.exe
  2⤵
  PID:5508
- C:\Windows\System\BrUiJjq.exe
  C:\Windows\System\BrUiJjq.exe
  2⤵
  PID:5748
- C:\Windows\System\lZeGjKi.exe
  C:\Windows\System\lZeGjKi.exe
  2⤵
  PID:5828
- C:\Windows\System\IGhDVxZ.exe
  C:\Windows\System\IGhDVxZ.exe
  2⤵
  PID:5868
- C:\Windows\System\IEbKynY.exe
  C:\Windows\System\IEbKynY.exe
  2⤵
  PID:5884
- C:\Windows\System\upjzpcn.exe
  C:\Windows\System\upjzpcn.exe
  2⤵
  PID:5896
- C:\Windows\System\CYrPGFY.exe
  C:\Windows\System\CYrPGFY.exe
  2⤵
  PID:5912
- C:\Windows\System\lmTchPq.exe
  C:\Windows\System\lmTchPq.exe
  2⤵
  PID:5928
- C:\Windows\System\RsBGkXa.exe
  C:\Windows\System\RsBGkXa.exe
  2⤵
  PID:5952
- C:\Windows\System\IzaXBrI.exe
  C:\Windows\System\IzaXBrI.exe
  2⤵
  PID:5968
- C:\Windows\System\aIYjnZh.exe
  C:\Windows\System\aIYjnZh.exe
  2⤵
  PID:6008
- C:\Windows\System\ysLsQUs.exe
  C:\Windows\System\ysLsQUs.exe
  2⤵
  PID:6016
- C:\Windows\System\kpndXXY.exe
  C:\Windows\System\kpndXXY.exe
  2⤵
  PID:6028
- C:\Windows\System\JuSKcVy.exe
  C:\Windows\System\JuSKcVy.exe
  2⤵
  PID:6048
- C:\Windows\System\OHCcWUQ.exe
  C:\Windows\System\OHCcWUQ.exe
  2⤵
  PID:6072
- C:\Windows\System\dJLUVeF.exe
  C:\Windows\System\dJLUVeF.exe
  2⤵
  PID:6096
- C:\Windows\System\uefeHAb.exe
  C:\Windows\System\uefeHAb.exe
  2⤵
  PID:6104
- C:\Windows\System\ZntoZlQ.exe
  C:\Windows\System\ZntoZlQ.exe
  2⤵
  PID:5492
- C:\Windows\System\zHmiAUB.exe
  C:\Windows\System\zHmiAUB.exe
  2⤵
  PID:5132
- C:\Windows\System\BPuZgfT.exe
  C:\Windows\System\BPuZgfT.exe
  2⤵
  PID:5324
- C:\Windows\System\wlDELMq.exe
  C:\Windows\System\wlDELMq.exe
  2⤵
  PID:5360
- C:\Windows\System\xtISGor.exe
  C:\Windows\System\xtISGor.exe
  2⤵
  PID:5616
- C:\Windows\System\dhaDuCr.exe
  C:\Windows\System\dhaDuCr.exe
  2⤵
  PID:5684
- C:\Windows\System\YefBYIX.exe
  C:\Windows\System\YefBYIX.exe
  2⤵
  PID:5816
- C:\Windows\System\HIudVmX.exe
  C:\Windows\System\HIudVmX.exe
  2⤵
  PID:5696
- C:\Windows\System\SKZKUwo.exe
  C:\Windows\System\SKZKUwo.exe
  2⤵
  PID:5444
- C:\Windows\System\MvyGtfs.exe
  C:\Windows\System\MvyGtfs.exe
  2⤵
  PID:5812
- C:\Windows\System\LyTcqgv.exe
  C:\Windows\System\LyTcqgv.exe
  2⤵
  PID:5936
- C:\Windows\System\bZMIcZC.exe
  C:\Windows\System\bZMIcZC.exe
  2⤵
  PID:5732
- C:\Windows\System\MUUybMv.exe
  C:\Windows\System\MUUybMv.exe
  2⤵
  PID:6024
- C:\Windows\System\YpXiyBM.exe
  C:\Windows\System\YpXiyBM.exe
  2⤵
  PID:5948
- C:\Windows\System\EOxwOAC.exe
  C:\Windows\System\EOxwOAC.exe
  2⤵
  PID:2836
- C:\Windows\System\ShcLqUl.exe
  C:\Windows\System\ShcLqUl.exe
  2⤵
  PID:5996
- C:\Windows\System\NlpIZmz.exe
  C:\Windows\System\NlpIZmz.exe
  2⤵
  PID:6076
- C:\Windows\System\RexulfG.exe
  C:\Windows\System\RexulfG.exe
  2⤵
  PID:6112
- C:\Windows\System\fyQBEQw.exe
  C:\Windows\System\fyQBEQw.exe
  2⤵
  PID:6120
- C:\Windows\System\GKxywhT.exe
  C:\Windows\System\GKxywhT.exe
  2⤵
  PID:4872
- C:\Windows\System\CrxjcKJ.exe
  C:\Windows\System\CrxjcKJ.exe
  2⤵
  PID:5220
- C:\Windows\System\PKzqNzF.exe
  C:\Windows\System\PKzqNzF.exe
  2⤵
  PID:5300
- C:\Windows\System\RGngLYI.exe
  C:\Windows\System\RGngLYI.exe
  2⤵
  PID:5308
- C:\Windows\System\fGpBoUv.exe
  C:\Windows\System\fGpBoUv.exe
  2⤵
  PID:5424
- C:\Windows\System\YuMcZwY.exe
  C:\Windows\System\YuMcZwY.exe
  2⤵
  PID:5632
- C:\Windows\System\AVeVHhG.exe
  C:\Windows\System\AVeVHhG.exe
  2⤵
  PID:6160
- C:\Windows\System\VPOCJeL.exe
  C:\Windows\System\VPOCJeL.exe
  2⤵
  PID:6176
- C:\Windows\System\YihGcWM.exe
  C:\Windows\System\YihGcWM.exe
  2⤵
  PID:6192
- C:\Windows\System\zDqfNMk.exe
  C:\Windows\System\zDqfNMk.exe
  2⤵
  PID:6208
- C:\Windows\System\WmRwLAs.exe
  C:\Windows\System\WmRwLAs.exe
  2⤵
  PID:6228
- C:\Windows\System\RaOwvRu.exe
  C:\Windows\System\RaOwvRu.exe
  2⤵
  PID:6288
- C:\Windows\System\wdUHWqk.exe
  C:\Windows\System\wdUHWqk.exe
  2⤵
  PID:6304
- C:\Windows\System\ZvvETXN.exe
  C:\Windows\System\ZvvETXN.exe
  2⤵
  PID:6320
- C:\Windows\System\hRUoVVM.exe
  C:\Windows\System\hRUoVVM.exe
  2⤵
  PID:6336
- C:\Windows\System\ascUfPA.exe
  C:\Windows\System\ascUfPA.exe
  2⤵
  PID:6352
- C:\Windows\System\WhjvSsu.exe
  C:\Windows\System\WhjvSsu.exe
  2⤵
  PID:6368
- C:\Windows\System\hlADSUC.exe
  C:\Windows\System\hlADSUC.exe
  2⤵
  PID:6384
- C:\Windows\System\pntrVsP.exe
  C:\Windows\System\pntrVsP.exe
  2⤵
  PID:6400
- C:\Windows\System\qqizMlQ.exe
  C:\Windows\System\qqizMlQ.exe
  2⤵
  PID:6416
- C:\Windows\System\KlrCvJc.exe
  C:\Windows\System\KlrCvJc.exe
  2⤵
  PID:6432
- C:\Windows\System\eVHgNhg.exe
  C:\Windows\System\eVHgNhg.exe
  2⤵
  PID:6448
- C:\Windows\System\CXHjTVA.exe
  C:\Windows\System\CXHjTVA.exe
  2⤵
  PID:6464
- C:\Windows\System\aWjOebG.exe
  C:\Windows\System\aWjOebG.exe
  2⤵
  PID:6480
- C:\Windows\System\NLCXgKB.exe
  C:\Windows\System\NLCXgKB.exe
  2⤵
  PID:6496
- C:\Windows\System\HEgZvTf.exe
  C:\Windows\System\HEgZvTf.exe
  2⤵
  PID:6512
- C:\Windows\System\EwGpMxH.exe
  C:\Windows\System\EwGpMxH.exe
  2⤵
  PID:6528
- C:\Windows\System\mNNwfiO.exe
  C:\Windows\System\mNNwfiO.exe
  2⤵
  PID:6544
- C:\Windows\System\VBusGXT.exe
  C:\Windows\System\VBusGXT.exe
  2⤵
  PID:6560
- C:\Windows\System\oaTYPuX.exe
  C:\Windows\System\oaTYPuX.exe
  2⤵
  PID:6576
- C:\Windows\System\DPCBrgH.exe
  C:\Windows\System\DPCBrgH.exe
  2⤵
  PID:6592
- C:\Windows\System\swhwIaD.exe
  C:\Windows\System\swhwIaD.exe
  2⤵
  PID:6608
- C:\Windows\System\NbMxRSJ.exe
  C:\Windows\System\NbMxRSJ.exe
  2⤵
  PID:6624
- C:\Windows\System\VnqxUad.exe
  C:\Windows\System\VnqxUad.exe
  2⤵
  PID:6640
- C:\Windows\System\DDgVeia.exe
  C:\Windows\System\DDgVeia.exe
  2⤵
  PID:6656
- C:\Windows\System\lvipvud.exe
  C:\Windows\System\lvipvud.exe
  2⤵
  PID:6672
- C:\Windows\System\vSTQEqx.exe
  C:\Windows\System\vSTQEqx.exe
  2⤵
  PID:6688
- C:\Windows\System\UYQgeQD.exe
  C:\Windows\System\UYQgeQD.exe
  2⤵
  PID:6704
- C:\Windows\System\qyRQuDn.exe
  C:\Windows\System\qyRQuDn.exe
  2⤵
  PID:6720
- C:\Windows\System\ClgdonT.exe
  C:\Windows\System\ClgdonT.exe
  2⤵
  PID:6736
- C:\Windows\System\RXQywJM.exe
  C:\Windows\System\RXQywJM.exe
  2⤵
  PID:6752
- C:\Windows\System\rXgTzna.exe
  C:\Windows\System\rXgTzna.exe
  2⤵
  PID:6768
- C:\Windows\System\pEbvVfR.exe
  C:\Windows\System\pEbvVfR.exe
  2⤵
  PID:6784
- C:\Windows\System\GIrWoCp.exe
  C:\Windows\System\GIrWoCp.exe
  2⤵
  PID:6800
- C:\Windows\System\dzIleLP.exe
  C:\Windows\System\dzIleLP.exe
  2⤵
  PID:6816
- C:\Windows\System\LhPwBDP.exe
  C:\Windows\System\LhPwBDP.exe
  2⤵
  PID:6832
- C:\Windows\System\OMuvLBK.exe
  C:\Windows\System\OMuvLBK.exe
  2⤵
  PID:6848
- C:\Windows\System\gROlxrj.exe
  C:\Windows\System\gROlxrj.exe
  2⤵
  PID:6864
- C:\Windows\System\bIGiGMf.exe
  C:\Windows\System\bIGiGMf.exe
  2⤵
  PID:6880
- C:\Windows\System\KrVKJud.exe
  C:\Windows\System\KrVKJud.exe
  2⤵
  PID:6896
- C:\Windows\System\emuMAiP.exe
  C:\Windows\System\emuMAiP.exe
  2⤵
  PID:6912
- C:\Windows\System\xqODAGG.exe
  C:\Windows\System\xqODAGG.exe
  2⤵
  PID:6928
- C:\Windows\System\hZktjUA.exe
  C:\Windows\System\hZktjUA.exe
  2⤵
  PID:6944
- C:\Windows\System\bJdpxTM.exe
  C:\Windows\System\bJdpxTM.exe
  2⤵
  PID:6960
- C:\Windows\System\jCzUFXp.exe
  C:\Windows\System\jCzUFXp.exe
  2⤵
  PID:6976
- C:\Windows\System\PbJNhAt.exe
  C:\Windows\System\PbJNhAt.exe
  2⤵
  PID:6992
- C:\Windows\System\zLMMuhf.exe
  C:\Windows\System\zLMMuhf.exe
  2⤵
  PID:7008
- C:\Windows\System\eDzNBYK.exe
  C:\Windows\System\eDzNBYK.exe
  2⤵
  PID:7024
- C:\Windows\System\hgSqWPm.exe
  C:\Windows\System\hgSqWPm.exe
  2⤵
  PID:7040
- C:\Windows\System\TUvspwq.exe
  C:\Windows\System\TUvspwq.exe
  2⤵
  PID:7056
- C:\Windows\System\tKdeCfw.exe
  C:\Windows\System\tKdeCfw.exe
  2⤵
  PID:7072
- C:\Windows\System\fUlclta.exe
  C:\Windows\System\fUlclta.exe
  2⤵
  PID:7088
- C:\Windows\System\vMcKhIh.exe
  C:\Windows\System\vMcKhIh.exe
  2⤵
  PID:7104
- C:\Windows\System\LNVNdqA.exe
  C:\Windows\System\LNVNdqA.exe
  2⤵
  PID:7120
- C:\Windows\System\MLQAVju.exe
  C:\Windows\System\MLQAVju.exe
  2⤵
  PID:7136
- C:\Windows\System\WShQkSF.exe
  C:\Windows\System\WShQkSF.exe
  2⤵
  PID:7152
- C:\Windows\System\MMZzOJJ.exe
  C:\Windows\System\MMZzOJJ.exe
  2⤵
  PID:5848
- C:\Windows\System\AChHgHN.exe
  C:\Windows\System\AChHgHN.exe
  2⤵
  PID:6064
- C:\Windows\System\ejwtKsj.exe
  C:\Windows\System\ejwtKsj.exe
  2⤵
  PID:5904
- C:\Windows\System\SFUilXP.exe
  C:\Windows\System\SFUilXP.exe
  2⤵
  PID:5440
- C:\Windows\System\IAZWfIv.exe
  C:\Windows\System\IAZWfIv.exe
  2⤵
  PID:5736
- C:\Windows\System\eKKHYEN.exe
  C:\Windows\System\eKKHYEN.exe
  2⤵
  PID:6056
- C:\Windows\System\YjmEdoF.exe
  C:\Windows\System\YjmEdoF.exe
  2⤵
  PID:6156
- C:\Windows\System\sigtEpc.exe
  C:\Windows\System\sigtEpc.exe
  2⤵
  PID:6140
- C:\Windows\System\DRRvxqw.exe
  C:\Windows\System\DRRvxqw.exe
  2⤵
  PID:6220
- C:\Windows\System\sdoBpLw.exe
  C:\Windows\System\sdoBpLw.exe
  2⤵
  PID:6248
- C:\Windows\System\FYvqPbM.exe
  C:\Windows\System\FYvqPbM.exe
  2⤵
  PID:5764
- C:\Windows\System\CpOawdW.exe
  C:\Windows\System\CpOawdW.exe
  2⤵
  PID:5944
- C:\Windows\System\HFMOUSS.exe
  C:\Windows\System\HFMOUSS.exe
  2⤵
  PID:5984
- C:\Windows\System\RaUmdIl.exe
  C:\Windows\System\RaUmdIl.exe
  2⤵
  PID:6268
- C:\Windows\System\VcHMjdN.exe
  C:\Windows\System\VcHMjdN.exe
  2⤵
  PID:6264
- C:\Windows\System\PfyLHYv.exe
  C:\Windows\System\PfyLHYv.exe
  2⤵
  PID:6444
- C:\Windows\System\FMSWYRL.exe
  C:\Windows\System\FMSWYRL.exe
  2⤵
  PID:6556
- C:\Windows\System\yFNnlGA.exe
  C:\Windows\System\yFNnlGA.exe
  2⤵
  PID:6568
- C:\Windows\System\wNtEaYW.exe
  C:\Windows\System\wNtEaYW.exe
  2⤵
  PID:6684
- C:\Windows\System\hOtStXP.exe
  C:\Windows\System\hOtStXP.exe
  2⤵
  PID:6540
- C:\Windows\System\vLKpdyr.exe
  C:\Windows\System\vLKpdyr.exe
  2⤵
  PID:6716
- C:\Windows\System\cNgwntz.exe
  C:\Windows\System\cNgwntz.exe
  2⤵
  PID:6636
- C:\Windows\System\oJOZWRA.exe
  C:\Windows\System\oJOZWRA.exe
  2⤵
  PID:6696
- C:\Windows\System\JaahZfc.exe
  C:\Windows\System\JaahZfc.exe
  2⤵
  PID:6760
- C:\Windows\System\DBjqLeE.exe
  C:\Windows\System\DBjqLeE.exe
  2⤵
  PID:6840
- C:\Windows\System\KAoUdbt.exe
  C:\Windows\System\KAoUdbt.exe
  2⤵
  PID:6872
- C:\Windows\System\OAFvesB.exe
  C:\Windows\System\OAFvesB.exe
  2⤵
  PID:6908
- C:\Windows\System\GhLLUOs.exe
  C:\Windows\System\GhLLUOs.exe
  2⤵
  PID:6924
- C:\Windows\System\QMkmnNi.exe
  C:\Windows\System\QMkmnNi.exe
  2⤵
  PID:6972
- C:\Windows\System\oXLfiEB.exe
  C:\Windows\System\oXLfiEB.exe
  2⤵
  PID:7016
- C:\Windows\System\cIEepqu.exe
  C:\Windows\System\cIEepqu.exe
  2⤵
  PID:6988
- C:\Windows\System\qGQWqMo.exe
  C:\Windows\System\qGQWqMo.exe
  2⤵
  PID:7068
- C:\Windows\System\sgaYRQK.exe
  C:\Windows\System\sgaYRQK.exe
  2⤵
  PID:7128
- C:\Windows\System\PDgVIlS.exe
  C:\Windows\System\PDgVIlS.exe
  2⤵
  PID:5720
- C:\Windows\System\ePjHDnr.exe
  C:\Windows\System\ePjHDnr.exe
  2⤵
  PID:6108
- C:\Windows\System\HcjmVml.exe
  C:\Windows\System\HcjmVml.exe
  2⤵
  PID:7048
- C:\Windows\System\kdCBMkj.exe
  C:\Windows\System\kdCBMkj.exe
  2⤵
  PID:5880
- C:\Windows\System\tOLQGEh.exe
  C:\Windows\System\tOLQGEh.exe
  2⤵
  PID:6392
- C:\Windows\System\MftFJXp.exe
  C:\Windows\System\MftFJXp.exe
  2⤵
  PID:6364
- C:\Windows\System\XpBSyIf.exe
  C:\Windows\System\XpBSyIf.exe
  2⤵
  PID:7144
- C:\Windows\System\QhxSHIt.exe
  C:\Windows\System\QhxSHIt.exe
  2⤵
  PID:6380
- C:\Windows\System\OoSCYGy.exe
  C:\Windows\System\OoSCYGy.exe
  2⤵
  PID:6456
- C:\Windows\System\EsKZOjz.exe
  C:\Windows\System\EsKZOjz.exe
  2⤵
  PID:5784
- C:\Windows\System\kjCRrmh.exe
  C:\Windows\System\kjCRrmh.exe
  2⤵
  PID:5172
- C:\Windows\System\HbmJydw.exe
  C:\Windows\System\HbmJydw.exe
  2⤵
  PID:6116
- C:\Windows\System\vqGiQle.exe
  C:\Windows\System\vqGiQle.exe
  2⤵
  PID:6000
- C:\Windows\System\jhoGKjh.exe
  C:\Windows\System\jhoGKjh.exe
  2⤵
  PID:6280
- C:\Windows\System\QxtigoA.exe
  C:\Windows\System\QxtigoA.exe
  2⤵
  PID:6668
- C:\Windows\System\ircJsDd.exe
  C:\Windows\System\ircJsDd.exe
  2⤵
  PID:6860
- C:\Windows\System\kYNBJLa.exe
  C:\Windows\System\kYNBJLa.exe
  2⤵
  PID:6984
- C:\Windows\System\HRvOssb.exe
  C:\Windows\System\HRvOssb.exe
  2⤵
  PID:6060
- C:\Windows\System\sUTARon.exe
  C:\Windows\System\sUTARon.exe
  2⤵
  PID:6796
- C:\Windows\System\xMnVCWL.exe
  C:\Windows\System\xMnVCWL.exe
  2⤵
  PID:7080
- C:\Windows\System\CUsKplq.exe
  C:\Windows\System\CUsKplq.exe
  2⤵
  PID:6396
- C:\Windows\System\VDYDQIC.exe
  C:\Windows\System\VDYDQIC.exe
  2⤵
  PID:6216
- C:\Windows\System\bIJlzkj.exe
  C:\Windows\System\bIJlzkj.exe
  2⤵
  PID:6036
- C:\Windows\System\memSYHG.exe
  C:\Windows\System\memSYHG.exe
  2⤵
  PID:6040
- C:\Windows\System\EMYbFUw.exe
  C:\Windows\System\EMYbFUw.exe
  2⤵
  PID:6428
- C:\Windows\System\ETzQijm.exe
  C:\Windows\System\ETzQijm.exe
  2⤵
  PID:5956
- C:\Windows\System\CKdVGek.exe
  C:\Windows\System\CKdVGek.exe
  2⤵
  PID:6296
- C:\Windows\System\mzKsdug.exe
  C:\Windows\System\mzKsdug.exe
  2⤵
  PID:6572
- C:\Windows\System\fbLWnFC.exe
  C:\Windows\System\fbLWnFC.exe
  2⤵
  PID:7000
- C:\Windows\System\QVORXAq.exe
  C:\Windows\System\QVORXAq.exe
  2⤵
  PID:6552
- C:\Windows\System\MuJsByX.exe
  C:\Windows\System\MuJsByX.exe
  2⤵
  PID:1560
- C:\Windows\System\xlvoigj.exe
  C:\Windows\System\xlvoigj.exe
  2⤵
  PID:5288
- C:\Windows\System\KdvISBq.exe
  C:\Windows\System\KdvISBq.exe
  2⤵
  PID:6616
- C:\Windows\System\wtMKKNn.exe
  C:\Windows\System\wtMKKNn.exe
  2⤵
  PID:6236
- C:\Windows\System\XThASUl.exe
  C:\Windows\System\XThASUl.exe
  2⤵
  PID:5152
- C:\Windows\System\rNzNUXV.exe
  C:\Windows\System\rNzNUXV.exe
  2⤵
  PID:6956
- C:\Windows\System\rZfKxTq.exe
  C:\Windows\System\rZfKxTq.exe
  2⤵
  PID:6748
- C:\Windows\System\ymOpOCH.exe
  C:\Windows\System\ymOpOCH.exe
  2⤵
  PID:6888
- C:\Windows\System\nPYFsGG.exe
  C:\Windows\System\nPYFsGG.exe
  2⤵
  PID:7064
- C:\Windows\System\QvFjuKg.exe
  C:\Windows\System\QvFjuKg.exe
  2⤵
  PID:6172
- C:\Windows\System\ceJRmpg.exe
  C:\Windows\System\ceJRmpg.exe
  2⤵
  PID:6892
- C:\Windows\System\OKsuruH.exe
  C:\Windows\System\OKsuruH.exe
  2⤵
  PID:6476
- C:\Windows\System\gzZFHtd.exe
  C:\Windows\System\gzZFHtd.exe
  2⤵
  PID:6360
- C:\Windows\System\PujCfaY.exe
  C:\Windows\System\PujCfaY.exe
  2⤵
  PID:6520
- C:\Windows\System\YblNNmO.exe
  C:\Windows\System\YblNNmO.exe
  2⤵
  PID:5412
- C:\Windows\System\vaPnJqm.exe
  C:\Windows\System\vaPnJqm.exe
  2⤵
  PID:7172
- C:\Windows\System\CHEOYfI.exe
  C:\Windows\System\CHEOYfI.exe
  2⤵
  PID:7188
- C:\Windows\System\dwgFBMU.exe
  C:\Windows\System\dwgFBMU.exe
  2⤵
  PID:7204
- C:\Windows\System\kqUuNMA.exe
  C:\Windows\System\kqUuNMA.exe
  2⤵
  PID:7220
- C:\Windows\System\eRVoItH.exe
  C:\Windows\System\eRVoItH.exe
  2⤵
  PID:7236
- C:\Windows\System\xihmcyi.exe
  C:\Windows\System\xihmcyi.exe
  2⤵
  PID:7252
- C:\Windows\System\VdTNwfQ.exe
  C:\Windows\System\VdTNwfQ.exe
  2⤵
  PID:7268
- C:\Windows\System\dTKFKCQ.exe
  C:\Windows\System\dTKFKCQ.exe
  2⤵
  PID:7284
- C:\Windows\System\dDtSwkf.exe
  C:\Windows\System\dDtSwkf.exe
  2⤵
  PID:7312
- C:\Windows\System\oerfDjl.exe
  C:\Windows\System\oerfDjl.exe
  2⤵
  PID:7404
- C:\Windows\System\eliDQos.exe
  C:\Windows\System\eliDQos.exe
  2⤵
  PID:7420
- C:\Windows\System\IQDSipl.exe
  C:\Windows\System\IQDSipl.exe
  2⤵
  PID:7436
- C:\Windows\System\bWCGIYr.exe
  C:\Windows\System\bWCGIYr.exe
  2⤵
  PID:7452
- C:\Windows\System\hgomLjf.exe
  C:\Windows\System\hgomLjf.exe
  2⤵
  PID:7468
- C:\Windows\System\CFaRzCe.exe
  C:\Windows\System\CFaRzCe.exe
  2⤵
  PID:7488
- C:\Windows\System\ABRCNUR.exe
  C:\Windows\System\ABRCNUR.exe
  2⤵
  PID:7504
- C:\Windows\System\RfMSElJ.exe
  C:\Windows\System\RfMSElJ.exe
  2⤵
  PID:7520
- C:\Windows\System\djdVpto.exe
  C:\Windows\System\djdVpto.exe
  2⤵
  PID:7536
- C:\Windows\System\aqJwZoG.exe
  C:\Windows\System\aqJwZoG.exe
  2⤵
  PID:7552
- C:\Windows\System\gsqLdDo.exe
  C:\Windows\System\gsqLdDo.exe
  2⤵
  PID:7568
- C:\Windows\System\xIjHkZr.exe
  C:\Windows\System\xIjHkZr.exe
  2⤵
  PID:7584
- C:\Windows\System\GNfIiRn.exe
  C:\Windows\System\GNfIiRn.exe
  2⤵
  PID:7600
- C:\Windows\System\IzhDbJA.exe
  C:\Windows\System\IzhDbJA.exe
  2⤵
  PID:7616
- C:\Windows\System\QKTGmKy.exe
  C:\Windows\System\QKTGmKy.exe
  2⤵
  PID:7632
- C:\Windows\System\yEJPzRI.exe
  C:\Windows\System\yEJPzRI.exe
  2⤵
  PID:7648
- C:\Windows\System\VRVndIq.exe
  C:\Windows\System\VRVndIq.exe
  2⤵
  PID:7664
- C:\Windows\System\HJFCWjM.exe
  C:\Windows\System\HJFCWjM.exe
  2⤵
  PID:7680
- C:\Windows\System\TipVMih.exe
  C:\Windows\System\TipVMih.exe
  2⤵
  PID:7700
- C:\Windows\System\nIhtloF.exe
  C:\Windows\System\nIhtloF.exe
  2⤵
  PID:7716
- C:\Windows\System\qYbGMne.exe
  C:\Windows\System\qYbGMne.exe
  2⤵
  PID:7732
- C:\Windows\System\KflLZhr.exe
  C:\Windows\System\KflLZhr.exe
  2⤵
  PID:7748
- C:\Windows\System\ufMbVws.exe
  C:\Windows\System\ufMbVws.exe
  2⤵
  PID:7764
- C:\Windows\System\xLRYhSY.exe
  C:\Windows\System\xLRYhSY.exe
  2⤵
  PID:7780
- C:\Windows\System\lqozfJY.exe
  C:\Windows\System\lqozfJY.exe
  2⤵
  PID:7796
- C:\Windows\System\qHCvKbD.exe
  C:\Windows\System\qHCvKbD.exe
  2⤵
  PID:7812
- C:\Windows\System\BLwhpon.exe
  C:\Windows\System\BLwhpon.exe
  2⤵
  PID:7828
- C:\Windows\System\NFLMayi.exe
  C:\Windows\System\NFLMayi.exe
  2⤵
  PID:7844
- C:\Windows\System\mWhcuKF.exe
  C:\Windows\System\mWhcuKF.exe
  2⤵
  PID:7860
- C:\Windows\System\YuyMTBe.exe
  C:\Windows\System\YuyMTBe.exe
  2⤵
  PID:7876
- C:\Windows\System\NEwYIAt.exe
  C:\Windows\System\NEwYIAt.exe
  2⤵
  PID:7892
- C:\Windows\System\lNqJOGS.exe
  C:\Windows\System\lNqJOGS.exe
  2⤵
  PID:7908
- C:\Windows\System\BaulBsZ.exe
  C:\Windows\System\BaulBsZ.exe
  2⤵
  PID:7924
- C:\Windows\System\nIgrAAq.exe
  C:\Windows\System\nIgrAAq.exe
  2⤵
  PID:7944
- C:\Windows\System\XNtBdja.exe
  C:\Windows\System\XNtBdja.exe
  2⤵
  PID:7960
- C:\Windows\System\DbGsLxw.exe
  C:\Windows\System\DbGsLxw.exe
  2⤵
  PID:7976
- C:\Windows\System\ghnWGlB.exe
  C:\Windows\System\ghnWGlB.exe
  2⤵
  PID:7996
- C:\Windows\System\kbQxJrs.exe
  C:\Windows\System\kbQxJrs.exe
  2⤵
  PID:8012
- C:\Windows\System\TlyvMaE.exe
  C:\Windows\System\TlyvMaE.exe
  2⤵
  PID:8028
- C:\Windows\System\SIuQRhr.exe
  C:\Windows\System\SIuQRhr.exe
  2⤵
  PID:8044
- C:\Windows\System\BAkejli.exe
  C:\Windows\System\BAkejli.exe
  2⤵
  PID:8060
- C:\Windows\System\KGfarht.exe
  C:\Windows\System\KGfarht.exe
  2⤵
  PID:8076
- C:\Windows\System\xcMPbvk.exe
  C:\Windows\System\xcMPbvk.exe
  2⤵
  PID:8100
- C:\Windows\System\rldsQYF.exe
  C:\Windows\System\rldsQYF.exe
  2⤵
  PID:8116
- C:\Windows\System\hdQLWme.exe
  C:\Windows\System\hdQLWme.exe
  2⤵
  PID:8132
- C:\Windows\System\JnknVuN.exe
  C:\Windows\System\JnknVuN.exe
  2⤵
  PID:8148
- C:\Windows\System\hXWNUZz.exe
  C:\Windows\System\hXWNUZz.exe
  2⤵
  PID:8164
- C:\Windows\System\jCdIHXq.exe
  C:\Windows\System\jCdIHXq.exe
  2⤵
  PID:8180
- C:\Windows\System\dCwcbKV.exe
  C:\Windows\System\dCwcbKV.exe
  2⤵
  PID:6508
- C:\Windows\System\ZFXLUYO.exe
  C:\Windows\System\ZFXLUYO.exe
  2⤵
  PID:5556
- C:\Windows\System\PZBHQqd.exe
  C:\Windows\System\PZBHQqd.exe
  2⤵
  PID:6524
- C:\Windows\System\DgFWkaJ.exe
  C:\Windows\System\DgFWkaJ.exe
  2⤵
  PID:7232
- C:\Windows\System\ecmxdrw.exe
  C:\Windows\System\ecmxdrw.exe
  2⤵
  PID:7296
- C:\Windows\System\ZVWVyao.exe
  C:\Windows\System\ZVWVyao.exe
  2⤵
  PID:5332
- C:\Windows\System\PXjMXjW.exe
  C:\Windows\System\PXjMXjW.exe
  2⤵
  PID:6348
- C:\Windows\System\aJlRDvM.exe
  C:\Windows\System\aJlRDvM.exe
  2⤵
  PID:6200
- C:\Windows\System\soQTpGz.exe
  C:\Windows\System\soQTpGz.exe
  2⤵
  PID:6792
- C:\Windows\System\CoThQUH.exe
  C:\Windows\System\CoThQUH.exe
  2⤵
  PID:7308
- C:\Windows\System\MkNXthm.exe
  C:\Windows\System\MkNXthm.exe
  2⤵
  PID:7244
- C:\Windows\System\gVRzLLH.exe
  C:\Windows\System\gVRzLLH.exe
  2⤵
  PID:7324
- C:\Windows\System\ICaiYTU.exe
  C:\Windows\System\ICaiYTU.exe
  2⤵
  PID:7340
- C:\Windows\System\esoATIB.exe
  C:\Windows\System\esoATIB.exe
  2⤵
  PID:7364
- C:\Windows\System\jxwsIfr.exe
  C:\Windows\System\jxwsIfr.exe
  2⤵
  PID:7372
- C:\Windows\System\AUPJKOX.exe
  C:\Windows\System\AUPJKOX.exe
  2⤵
  PID:7392
- C:\Windows\System\GDsfqOv.exe
  C:\Windows\System\GDsfqOv.exe
  2⤵
  PID:7416
- C:\Windows\System\NdSMzsM.exe
  C:\Windows\System\NdSMzsM.exe
  2⤵
  PID:7480
- C:\Windows\System\AjlzkOu.exe
  C:\Windows\System\AjlzkOu.exe
  2⤵
  PID:7576
- C:\Windows\System\AUsyRgo.exe
  C:\Windows\System\AUsyRgo.exe
  2⤵
  PID:7548
- C:\Windows\System\Maaiora.exe
  C:\Windows\System\Maaiora.exe
  2⤵
  PID:7672
- C:\Windows\System\ftPkLTL.exe
  C:\Windows\System\ftPkLTL.exe
  2⤵
  PID:7560
- C:\Windows\System\UGtlrqJ.exe
  C:\Windows\System\UGtlrqJ.exe
  2⤵
  PID:7624
- C:\Windows\System\kUiJsnt.exe
  C:\Windows\System\kUiJsnt.exe
  2⤵
  PID:7688
- C:\Windows\System\WGZvxqB.exe
  C:\Windows\System\WGZvxqB.exe
  2⤵
  PID:7464
- C:\Windows\System\zvSsIGt.exe
  C:\Windows\System\zvSsIGt.exe
  2⤵
  PID:7528
- C:\Windows\System\iOSYvBL.exe
  C:\Windows\System\iOSYvBL.exe
  2⤵
  PID:7776
- C:\Windows\System\kFhDIVP.exe
  C:\Windows\System\kFhDIVP.exe
  2⤵
  PID:7792
- C:\Windows\System\qEAEBDY.exe
  C:\Windows\System\qEAEBDY.exe
  2⤵
  PID:7724
- C:\Windows\System\uGgteyF.exe
  C:\Windows\System\uGgteyF.exe
  2⤵
  PID:7868
- C:\Windows\System\gOsGgiC.exe
  C:\Windows\System\gOsGgiC.exe
  2⤵
  PID:7932
- C:\Windows\System\JbMcsCk.exe
  C:\Windows\System\JbMcsCk.exe
  2⤵
  PID:8004
- C:\Windows\System\lTBoBFB.exe
  C:\Windows\System\lTBoBFB.exe
  2⤵
  PID:8008
- C:\Windows\System\uMVXwsS.exe
  C:\Windows\System\uMVXwsS.exe
  2⤵
  PID:8172
- C:\Windows\System\PCmarRM.exe
  C:\Windows\System\PCmarRM.exe
  2⤵
  PID:7304
- C:\Windows\System\yXNaGEb.exe
  C:\Windows\System\yXNaGEb.exe
  2⤵
  PID:6504
- C:\Windows\System\EtEAaWT.exe
  C:\Windows\System\EtEAaWT.exe
  2⤵
  PID:7180
- C:\Windows\System\npiDtBX.exe
  C:\Windows\System\npiDtBX.exe
  2⤵
  PID:7388
- C:\Windows\System\hgbJYli.exe
  C:\Windows\System\hgbJYli.exe
  2⤵
  PID:7448
- C:\Windows\System\CLtxlUk.exe
  C:\Windows\System\CLtxlUk.exe
  2⤵
  PID:7496
- C:\Windows\System\UAmsSKq.exe
  C:\Windows\System\UAmsSKq.exe
  2⤵
  PID:7804
- C:\Windows\System\XHSNnDY.exe
  C:\Windows\System\XHSNnDY.exe
  2⤵
  PID:8040
- C:\Windows\System\owxECVB.exe
  C:\Windows\System\owxECVB.exe
  2⤵
  PID:8140
- C:\Windows\System\fBEqrNI.exe
  C:\Windows\System\fBEqrNI.exe
  2⤵
  PID:8084
- C:\Windows\System\fPgUmtD.exe
  C:\Windows\System\fPgUmtD.exe
  2⤵
  PID:8160
- C:\Windows\System\OfprwHq.exe
  C:\Windows\System\OfprwHq.exe
  2⤵
  PID:7332
- C:\Windows\System\hTqLAow.exe
  C:\Windows\System\hTqLAow.exe
  2⤵
  PID:7592
- C:\Windows\System\PoghNAX.exe
  C:\Windows\System\PoghNAX.exe
  2⤵
  PID:7972
- C:\Windows\System\mWubkLQ.exe
  C:\Windows\System\mWubkLQ.exe
  2⤵
  PID:8052
- C:\Windows\System\IaGVKbZ.exe
  C:\Windows\System\IaGVKbZ.exe
  2⤵
  PID:7728
- C:\Windows\System\cMwJJCG.exe
  C:\Windows\System\cMwJJCG.exe
  2⤵
  PID:7920
- C:\Windows\System\ymfsWlU.exe
  C:\Windows\System\ymfsWlU.exe
  2⤵
  PID:7992
- C:\Windows\System\PziIhxd.exe
  C:\Windows\System\PziIhxd.exe
  2⤵
  PID:8124
- C:\Windows\System\kmQlJbK.exe
  C:\Windows\System\kmQlJbK.exe
  2⤵
  PID:7292
- C:\Windows\System\nGydCQx.exe
  C:\Windows\System\nGydCQx.exe
  2⤵
  PID:7276
- C:\Windows\System\CJauWhu.exe
  C:\Windows\System\CJauWhu.exe
  2⤵
  PID:7512
- C:\Windows\System\fkdDEcB.exe
  C:\Windows\System\fkdDEcB.exe
  2⤵
  PID:7460
- C:\Windows\System\UHYtLDJ.exe
  C:\Windows\System\UHYtLDJ.exe
  2⤵
  PID:7904
- C:\Windows\System\Lqcepts.exe
  C:\Windows\System\Lqcepts.exe
  2⤵
  PID:6440
- C:\Windows\System\GqMKYND.exe
  C:\Windows\System\GqMKYND.exe
  2⤵
  PID:7640
- C:\Windows\System\WTQGBaX.exe
  C:\Windows\System\WTQGBaX.exe
  2⤵
  PID:7656
- C:\Windows\System\sPQsGoF.exe
  C:\Windows\System\sPQsGoF.exe
  2⤵
  PID:8024
- C:\Windows\System\agdtRPj.exe
  C:\Windows\System\agdtRPj.exe
  2⤵
  PID:7900
- C:\Windows\System\NnYepse.exe
  C:\Windows\System\NnYepse.exe
  2⤵
  PID:7756
- C:\Windows\System\MXvWOrF.exe
  C:\Windows\System\MXvWOrF.exe
  2⤵
  PID:7264
- C:\Windows\System\GniQZHY.exe
  C:\Windows\System\GniQZHY.exe
  2⤵
  PID:7212
- C:\Windows\System\XZQcSTT.exe
  C:\Windows\System\XZQcSTT.exe
  2⤵
  PID:7396
- C:\Windows\System\gWowIdO.exe
  C:\Windows\System\gWowIdO.exe
  2⤵
  PID:7824
- C:\Windows\System\AlwdgXC.exe
  C:\Windows\System\AlwdgXC.exe
  2⤵
  PID:8088
- C:\Windows\System\FaHutGB.exe
  C:\Windows\System\FaHutGB.exe
  2⤵
  PID:7840
- C:\Windows\System\XwroLhY.exe
  C:\Windows\System\XwroLhY.exe
  2⤵
  PID:7788
- C:\Windows\System\YBXSsvS.exe
  C:\Windows\System\YBXSsvS.exe
  2⤵
  PID:7184
- C:\Windows\System\gHoHSpv.exe
  C:\Windows\System\gHoHSpv.exe
  2⤵
  PID:6272
- C:\Windows\System\GgPOhil.exe
  C:\Windows\System\GgPOhil.exe
  2⤵
  PID:7544
- C:\Windows\System\SAaLWpB.exe
  C:\Windows\System\SAaLWpB.exe
  2⤵
  PID:7368
- C:\Windows\System\KQTQZMj.exe
  C:\Windows\System\KQTQZMj.exe
  2⤵
  PID:6240
- C:\Windows\System\sWsifph.exe
  C:\Windows\System\sWsifph.exe
  2⤵
  PID:8196
- C:\Windows\System\tBMhigc.exe
  C:\Windows\System\tBMhigc.exe
  2⤵
  PID:8216
- C:\Windows\System\IrEyYLZ.exe
  C:\Windows\System\IrEyYLZ.exe
  2⤵
  PID:8232
- C:\Windows\System\RakONcV.exe
  C:\Windows\System\RakONcV.exe
  2⤵
  PID:8248
- C:\Windows\System\yGknAtW.exe
  C:\Windows\System\yGknAtW.exe
  2⤵
  PID:8268
- C:\Windows\System\AAXawiK.exe
  C:\Windows\System\AAXawiK.exe
  2⤵
  PID:8284
- C:\Windows\System\bqGPWzo.exe
  C:\Windows\System\bqGPWzo.exe
  2⤵
  PID:8300
- C:\Windows\System\iyfGPvs.exe
  C:\Windows\System\iyfGPvs.exe
  2⤵
  PID:8316
- C:\Windows\System\TTSSnMv.exe
  C:\Windows\System\TTSSnMv.exe
  2⤵
  PID:8348
- C:\Windows\System\WezRrgF.exe
  C:\Windows\System\WezRrgF.exe
  2⤵
  PID:8368
- C:\Windows\System\UMaCmxb.exe
  C:\Windows\System\UMaCmxb.exe
  2⤵
  PID:8384
- C:\Windows\System\liHyQFO.exe
  C:\Windows\System\liHyQFO.exe
  2⤵
  PID:8400
- C:\Windows\System\aKofcvT.exe
  C:\Windows\System\aKofcvT.exe
  2⤵
  PID:8416
- C:\Windows\System\FQjpRZU.exe
  C:\Windows\System\FQjpRZU.exe
  2⤵
  PID:8432
- C:\Windows\System\fbaoRqj.exe
  C:\Windows\System\fbaoRqj.exe
  2⤵
  PID:8448
- C:\Windows\System\TdwPNfr.exe
  C:\Windows\System\TdwPNfr.exe
  2⤵
  PID:8464
- C:\Windows\System\SEaLWGc.exe
  C:\Windows\System\SEaLWGc.exe
  2⤵
  PID:8484
- C:\Windows\System\ueuJpmA.exe
  C:\Windows\System\ueuJpmA.exe
  2⤵
  PID:8500
- C:\Windows\System\YFWGAEl.exe
  C:\Windows\System\YFWGAEl.exe
  2⤵
  PID:8516
- C:\Windows\System\DfOziDJ.exe
  C:\Windows\System\DfOziDJ.exe
  2⤵
  PID:8532
- C:\Windows\System\cyPbkZG.exe
  C:\Windows\System\cyPbkZG.exe
  2⤵
  PID:8548
- C:\Windows\System\eISIQuU.exe
  C:\Windows\System\eISIQuU.exe
  2⤵
  PID:8564
- C:\Windows\System\UPvXvHJ.exe
  C:\Windows\System\UPvXvHJ.exe
  2⤵
  PID:8580
- C:\Windows\System\ZHeMkpc.exe
  C:\Windows\System\ZHeMkpc.exe
  2⤵
  PID:8696
- C:\Windows\System\GKvrfmG.exe
  C:\Windows\System\GKvrfmG.exe
  2⤵
  PID:8756
- C:\Windows\System\HpLuIgN.exe
  C:\Windows\System\HpLuIgN.exe
  2⤵
  PID:8772
- C:\Windows\System\tYffRcm.exe
  C:\Windows\System\tYffRcm.exe
  2⤵
  PID:8788
- C:\Windows\System\VkgFNzR.exe
  C:\Windows\System\VkgFNzR.exe
  2⤵
  PID:8804
- C:\Windows\System\RwnTpXE.exe
  C:\Windows\System\RwnTpXE.exe
  2⤵
  PID:8820
- C:\Windows\System\TbfsFus.exe
  C:\Windows\System\TbfsFus.exe
  2⤵
  PID:8840
- C:\Windows\System\xDVdflJ.exe
  C:\Windows\System\xDVdflJ.exe
  2⤵
  PID:8860
- C:\Windows\System\dQqZSeV.exe
  C:\Windows\System\dQqZSeV.exe
  2⤵
  PID:8876
- C:\Windows\System\ZZBxIfz.exe
  C:\Windows\System\ZZBxIfz.exe
  2⤵
  PID:8892
- C:\Windows\System\qlmPNRw.exe
  C:\Windows\System\qlmPNRw.exe
  2⤵
  PID:8908
- C:\Windows\System\hXsefCa.exe
  C:\Windows\System\hXsefCa.exe
  2⤵
  PID:8924
- C:\Windows\System\rNdUHuV.exe
  C:\Windows\System\rNdUHuV.exe
  2⤵
  PID:8940
- C:\Windows\System\NQJXimE.exe
  C:\Windows\System\NQJXimE.exe
  2⤵
  PID:8956
- C:\Windows\System\azGbinT.exe
  C:\Windows\System\azGbinT.exe
  2⤵
  PID:8972
- C:\Windows\System\XNXcRdv.exe
  C:\Windows\System\XNXcRdv.exe
  2⤵
  PID:8988
- C:\Windows\System\iOhVrWc.exe
  C:\Windows\System\iOhVrWc.exe
  2⤵
  PID:9004
- C:\Windows\System\eoWPZjs.exe
  C:\Windows\System\eoWPZjs.exe
  2⤵
  PID:9020
- C:\Windows\System\VeYzhcN.exe
  C:\Windows\System\VeYzhcN.exe
  2⤵
  PID:9036
- C:\Windows\System\gnPUXoq.exe
  C:\Windows\System\gnPUXoq.exe
  2⤵
  PID:9056
- C:\Windows\System\AUpzABd.exe
  C:\Windows\System\AUpzABd.exe
  2⤵
  PID:9072
- C:\Windows\System\PReHBbO.exe
  C:\Windows\System\PReHBbO.exe
  2⤵
  PID:9088
- C:\Windows\System\qsioNrl.exe
  C:\Windows\System\qsioNrl.exe
  2⤵
  PID:9104
- C:\Windows\System\vtLCyWp.exe
  C:\Windows\System\vtLCyWp.exe
  2⤵
  PID:9120
- C:\Windows\System\muzhrrb.exe
  C:\Windows\System\muzhrrb.exe
  2⤵
  PID:9136
- C:\Windows\System\ogkmBcC.exe
  C:\Windows\System\ogkmBcC.exe
  2⤵
  PID:9152
- C:\Windows\System\NEQIzWD.exe
  C:\Windows\System\NEQIzWD.exe
  2⤵
  PID:9168
- C:\Windows\System\wNatdIa.exe
  C:\Windows\System\wNatdIa.exe
  2⤵
  PID:9184
- C:\Windows\System\KrerOJb.exe
  C:\Windows\System\KrerOJb.exe
  2⤵
  PID:9204
- C:\Windows\System\NFtiKqr.exe
  C:\Windows\System\NFtiKqr.exe
  2⤵
  PID:8020
- C:\Windows\System\UECucsl.exe
  C:\Windows\System\UECucsl.exe
  2⤵
  PID:6300
- C:\Windows\System\mIHnMbK.exe
  C:\Windows\System\mIHnMbK.exe
  2⤵
  PID:7744
- C:\Windows\System\arcOyIH.exe
  C:\Windows\System\arcOyIH.exe
  2⤵
  PID:7884
- C:\Windows\System\SVImSsD.exe
  C:\Windows\System\SVImSsD.exe
  2⤵
  PID:8244
- C:\Windows\System\cpDmxBT.exe
  C:\Windows\System\cpDmxBT.exe
  2⤵
  PID:8224
- C:\Windows\System\GMjptIm.exe
  C:\Windows\System\GMjptIm.exe
  2⤵
  PID:8280
- C:\Windows\System\IoYJmPq.exe
  C:\Windows\System\IoYJmPq.exe
  2⤵
  PID:8292
- C:\Windows\System\eTLdbIc.exe
  C:\Windows\System\eTLdbIc.exe
  2⤵
  PID:8296
- C:\Windows\System\LHpjppT.exe
  C:\Windows\System\LHpjppT.exe
  2⤵
  PID:8360
- C:\Windows\System\GVKRXph.exe
  C:\Windows\System\GVKRXph.exe
  2⤵
  PID:8428
- C:\Windows\System\cTChxVF.exe
  C:\Windows\System\cTChxVF.exe
  2⤵
  PID:8344
- C:\Windows\System\gFbcgpt.exe
  C:\Windows\System\gFbcgpt.exe
  2⤵
  PID:8524
- C:\Windows\System\WMTBFgI.exe
  C:\Windows\System\WMTBFgI.exe
  2⤵
  PID:8376
- C:\Windows\System\ygtyukn.exe
  C:\Windows\System\ygtyukn.exe
  2⤵
  PID:8440
- C:\Windows\System\sWJTEKs.exe
  C:\Windows\System\sWJTEKs.exe
  2⤵
  PID:8412
- C:\Windows\System\ULvxnAz.exe
  C:\Windows\System\ULvxnAz.exe
  2⤵
  PID:8512
- C:\Windows\System\sTypAdc.exe
  C:\Windows\System\sTypAdc.exe
  2⤵
  PID:8592
- C:\Windows\System\nAeRIbP.exe
  C:\Windows\System\nAeRIbP.exe
  2⤵
  PID:8608
- C:\Windows\System\nLLvXTr.exe
  C:\Windows\System\nLLvXTr.exe
  2⤵
  PID:8620
- C:\Windows\System\mBSXxWM.exe
  C:\Windows\System\mBSXxWM.exe
  2⤵
  PID:8644
- C:\Windows\System\bhXRUoF.exe
  C:\Windows\System\bhXRUoF.exe
  2⤵
  PID:8688
- C:\Windows\System\dcnvAGx.exe
  C:\Windows\System\dcnvAGx.exe
  2⤵
  PID:8764
- C:\Windows\System\whIiAPk.exe
  C:\Windows\System\whIiAPk.exe
  2⤵
  PID:8680
- C:\Windows\System\PQHKrLv.exe
  C:\Windows\System\PQHKrLv.exe
  2⤵
  PID:8796
- C:\Windows\System\jwWPQBN.exe
  C:\Windows\System\jwWPQBN.exe
  2⤵
  PID:8704
- C:\Windows\System\qRNyisc.exe
  C:\Windows\System\qRNyisc.exe
  2⤵
  PID:8872
- C:\Windows\System\eVcJhGJ.exe
  C:\Windows\System\eVcJhGJ.exe
  2⤵
  PID:8720
- C:\Windows\System\NfqgRGC.exe
  C:\Windows\System\NfqgRGC.exe
  2⤵
  PID:8732
- C:\Windows\System\VEPItmp.exe
  C:\Windows\System\VEPItmp.exe
  2⤵
  PID:8752
- C:\Windows\System\nUtzvnc.exe
  C:\Windows\System\nUtzvnc.exe
  2⤵
  PID:8932
- C:\Windows\System\DZvhrnn.exe
  C:\Windows\System\DZvhrnn.exe
  2⤵
  PID:8996
- C:\Windows\System\oPVAoYo.exe
  C:\Windows\System\oPVAoYo.exe
  2⤵
  PID:9064
- C:\Windows\System\pnFeCVo.exe
  C:\Windows\System\pnFeCVo.exe
  2⤵
  PID:8848
- C:\Windows\System\MOnhvCm.exe
  C:\Windows\System\MOnhvCm.exe
  2⤵
  PID:9100
- C:\Windows\System\huhahrn.exe
  C:\Windows\System\huhahrn.exe
  2⤵
  PID:9160
- C:\Windows\System\oGHGekt.exe
  C:\Windows\System\oGHGekt.exe
  2⤵
  PID:8920
- C:\Windows\System\YifbAXX.exe
  C:\Windows\System\YifbAXX.exe
  2⤵
  PID:9052
- C:\Windows\System\QsEGYUG.exe
  C:\Windows\System\QsEGYUG.exe
  2⤵
  PID:8984
- C:\Windows\System\hTmINwE.exe
  C:\Windows\System\hTmINwE.exe
  2⤵
  PID:9080
- C:\Windows\System\IlndorE.exe
  C:\Windows\System\IlndorE.exe
  2⤵
  PID:9144
- C:\Windows\System\siVYpiX.exe
  C:\Windows\System\siVYpiX.exe
  2⤵
  PID:9148
- C:\Windows\System\FTttjxJ.exe
  C:\Windows\System\FTttjxJ.exe
  2⤵
  PID:7412
- C:\Windows\System\LuhBjRh.exe
  C:\Windows\System\LuhBjRh.exe
  2⤵
  PID:8256
- C:\Windows\System\fqqSzOP.exe
  C:\Windows\System\fqqSzOP.exe
  2⤵
  PID:8460
- C:\Windows\System\wMrLfHi.exe
  C:\Windows\System\wMrLfHi.exe
  2⤵
  PID:8480
- C:\Windows\System\xOzKUKY.exe
  C:\Windows\System\xOzKUKY.exe
  2⤵
  PID:7400
- C:\Windows\System\ZUdaSop.exe
  C:\Windows\System\ZUdaSop.exe
  2⤵
  PID:8240
- C:\Windows\System\OXALpMV.exe
  C:\Windows\System\OXALpMV.exe
  2⤵
  PID:8324
- C:\Windows\System\LUPqFxs.exe
  C:\Windows\System\LUPqFxs.exe
  2⤵
  PID:8604
- C:\Windows\System\xbUBdDx.exe
  C:\Windows\System\xbUBdDx.exe
  2⤵
  PID:8572
- C:\Windows\System\BdPSvFC.exe
  C:\Windows\System\BdPSvFC.exe
  2⤵
  PID:8668
- C:\Windows\System\RRTmbWn.exe
  C:\Windows\System\RRTmbWn.exe
  2⤵
  PID:8672
- C:\Windows\System\pzDYGIl.exe
  C:\Windows\System\pzDYGIl.exe
  2⤵
  PID:8736
- C:\Windows\System\skyHuiB.exe
  C:\Windows\System\skyHuiB.exe
  2⤵
  PID:8884
- C:\Windows\System\AJjKmNe.exe
  C:\Windows\System\AJjKmNe.exe
  2⤵
  PID:9132
- C:\Windows\System\mYmRmNI.exe
  C:\Windows\System\mYmRmNI.exe
  2⤵
  PID:8632
- C:\Windows\System\TAyIJcw.exe
  C:\Windows\System\TAyIJcw.exe
  2⤵
  PID:8768
- C:\Windows\System\ZuuiUXO.exe
  C:\Windows\System\ZuuiUXO.exe
  2⤵
  PID:8952
- C:\Windows\System\pBoVLHf.exe
  C:\Windows\System\pBoVLHf.exe
  2⤵
  PID:8740
- C:\Windows\System\qVCnXst.exe
  C:\Windows\System\qVCnXst.exe
  2⤵
  PID:8868
- C:\Windows\System\xTKahgK.exe
  C:\Windows\System\xTKahgK.exe
  2⤵
  PID:9176
- C:\Windows\System\qiIeGCv.exe
  C:\Windows\System\qiIeGCv.exe
  2⤵
  PID:7500
- C:\Windows\System\NLaqAFu.exe
  C:\Windows\System\NLaqAFu.exe
  2⤵
  PID:8508
- C:\Windows\System\dVKhKat.exe
  C:\Windows\System\dVKhKat.exe
  2⤵
  PID:8228
- C:\Windows\System\RdDIFKF.exe
  C:\Windows\System\RdDIFKF.exe
  2⤵
  PID:8496
- C:\Windows\System\LnghaPq.exe
  C:\Windows\System\LnghaPq.exe
  2⤵
  PID:8812
- C:\Windows\System\fMdgGiW.exe
  C:\Windows\System\fMdgGiW.exe
  2⤵
  PID:9096
- C:\Windows\System\AVoIGfP.exe
  C:\Windows\System\AVoIGfP.exe
  2⤵
  PID:8664
- C:\Windows\System\ccvVwwW.exe
  C:\Windows\System\ccvVwwW.exe
  2⤵
  PID:8560
- C:\Windows\System\inpPidc.exe
  C:\Windows\System\inpPidc.exe
  2⤵
  PID:8332
- C:\Windows\System\ecLvAij.exe
  C:\Windows\System\ecLvAij.exe
  2⤵
  PID:8964
- C:\Windows\System\mqYqBqb.exe
  C:\Windows\System\mqYqBqb.exe
  2⤵
  PID:8472
- C:\Windows\System\gOLBmyX.exe
  C:\Windows\System\gOLBmyX.exe
  2⤵
  PID:8616
- C:\Windows\System\tppLYBe.exe
  C:\Windows\System\tppLYBe.exe
  2⤵
  PID:8356
- C:\Windows\System\OeaLXJH.exe
  C:\Windows\System\OeaLXJH.exe
  2⤵
  PID:8968
- C:\Windows\System\HnjpLTl.exe
  C:\Windows\System\HnjpLTl.exe
  2⤵
  PID:8424
- C:\Windows\System\pRuUBDF.exe
  C:\Windows\System\pRuUBDF.exe
  2⤵
  PID:8716
- C:\Windows\System\whTeqGU.exe
  C:\Windows\System\whTeqGU.exe
  2⤵
  PID:9232
- C:\Windows\System\ejYOWjU.exe
  C:\Windows\System\ejYOWjU.exe
  2⤵
  PID:9248
- C:\Windows\System\wRlVNqZ.exe
  C:\Windows\System\wRlVNqZ.exe
  2⤵
  PID:9264
- C:\Windows\System\juVkluN.exe
  C:\Windows\System\juVkluN.exe
  2⤵
  PID:9280
- C:\Windows\System\ZDJWabA.exe
  C:\Windows\System\ZDJWabA.exe
  2⤵
  PID:9296
- C:\Windows\System\JnlVixR.exe
  C:\Windows\System\JnlVixR.exe
  2⤵
  PID:9312
- C:\Windows\System\NaMtQio.exe
  C:\Windows\System\NaMtQio.exe
  2⤵
  PID:9328
- C:\Windows\System\KtFroHN.exe
  C:\Windows\System\KtFroHN.exe
  2⤵
  PID:9344
- C:\Windows\System\StuIUdO.exe
  C:\Windows\System\StuIUdO.exe
  2⤵
  PID:9360
- C:\Windows\System\hjTsERj.exe
  C:\Windows\System\hjTsERj.exe
  2⤵
  PID:9376
- C:\Windows\System\jEZMLXT.exe
  C:\Windows\System\jEZMLXT.exe
  2⤵
  PID:9392
- C:\Windows\System\IwqZNcN.exe
  C:\Windows\System\IwqZNcN.exe
  2⤵
  PID:9408
- C:\Windows\System\PgSXUUb.exe
  C:\Windows\System\PgSXUUb.exe
  2⤵
  PID:9424
- C:\Windows\System\SYpvumC.exe
  C:\Windows\System\SYpvumC.exe
  2⤵
  PID:9440
- C:\Windows\System\RtetXkJ.exe
  C:\Windows\System\RtetXkJ.exe
  2⤵
  PID:9456
- C:\Windows\System\xInZsNm.exe
  C:\Windows\System\xInZsNm.exe
  2⤵
  PID:9472
- C:\Windows\System\DLaIDEB.exe
  C:\Windows\System\DLaIDEB.exe
  2⤵
  PID:9492
- C:\Windows\System\FlXCtHy.exe
  C:\Windows\System\FlXCtHy.exe
  2⤵
  PID:9508
- C:\Windows\System\TymFUrv.exe
  C:\Windows\System\TymFUrv.exe
  2⤵
  PID:9528
- C:\Windows\System\NVwEaPc.exe
  C:\Windows\System\NVwEaPc.exe
  2⤵
  PID:9544
- C:\Windows\System\uPizIYR.exe
  C:\Windows\System\uPizIYR.exe
  2⤵
  PID:9560
- C:\Windows\System\wgMtYPW.exe
  C:\Windows\System\wgMtYPW.exe
  2⤵
  PID:9576
- C:\Windows\System\eiUWHIC.exe
  C:\Windows\System\eiUWHIC.exe
  2⤵
  PID:9592
- C:\Windows\System\odPLHCb.exe
  C:\Windows\System\odPLHCb.exe
  2⤵
  PID:9608
- C:\Windows\System\kzGaeiw.exe
  C:\Windows\System\kzGaeiw.exe
  2⤵
  PID:9628
- C:\Windows\System\AQoJZWT.exe
  C:\Windows\System\AQoJZWT.exe
  2⤵
  PID:9644
- C:\Windows\System\xYidIbh.exe
  C:\Windows\System\xYidIbh.exe
  2⤵
  PID:9660
- C:\Windows\System\dBwQIIZ.exe
  C:\Windows\System\dBwQIIZ.exe
  2⤵
  PID:9680
- C:\Windows\System\CFEXIpX.exe
  C:\Windows\System\CFEXIpX.exe
  2⤵
  PID:9696
- C:\Windows\System\tlqdGlI.exe
  C:\Windows\System\tlqdGlI.exe
  2⤵
  PID:9712
- C:\Windows\System\tyJVRSO.exe
  C:\Windows\System\tyJVRSO.exe
  2⤵
  PID:9732
- C:\Windows\System\YRzRYsu.exe
  C:\Windows\System\YRzRYsu.exe
  2⤵
  PID:9748
- C:\Windows\System\lYQyzQA.exe
  C:\Windows\System\lYQyzQA.exe
  2⤵
  PID:9764
- C:\Windows\System\moEedVN.exe
  C:\Windows\System\moEedVN.exe
  2⤵
  PID:9780
- C:\Windows\System\BoFhkaj.exe
  C:\Windows\System\BoFhkaj.exe
  2⤵
  PID:9796
- C:\Windows\System\tlRSFNB.exe
  C:\Windows\System\tlRSFNB.exe
  2⤵
  PID:9812
- C:\Windows\System\ovFiNNE.exe
  C:\Windows\System\ovFiNNE.exe
  2⤵
  PID:9828
- C:\Windows\System\VjfQgeM.exe
  C:\Windows\System\VjfQgeM.exe
  2⤵
  PID:9852
- C:\Windows\System\BKVKkPE.exe
  C:\Windows\System\BKVKkPE.exe
  2⤵
  PID:9868
- C:\Windows\System\omtEjrm.exe
  C:\Windows\System\omtEjrm.exe
  2⤵
  PID:9884
- C:\Windows\System\hclXnFX.exe
  C:\Windows\System\hclXnFX.exe
  2⤵
  PID:9900
- C:\Windows\System\HPwQoIA.exe
  C:\Windows\System\HPwQoIA.exe
  2⤵
  PID:9916
- C:\Windows\System\PImKwrz.exe
  C:\Windows\System\PImKwrz.exe
  2⤵
  PID:9932
- C:\Windows\System\VfKFrwe.exe
  C:\Windows\System\VfKFrwe.exe
  2⤵
  PID:9952
- C:\Windows\System\tknEuvV.exe
  C:\Windows\System\tknEuvV.exe
  2⤵
  PID:9968
- C:\Windows\System\IRNBeEq.exe
  C:\Windows\System\IRNBeEq.exe
  2⤵
  PID:9984
- C:\Windows\System\oVRIsoG.exe
  C:\Windows\System\oVRIsoG.exe
  2⤵
  PID:10004
- C:\Windows\System\WYAGKlF.exe
  C:\Windows\System\WYAGKlF.exe
  2⤵
  PID:10020
- C:\Windows\System\QzrQSKd.exe
  C:\Windows\System\QzrQSKd.exe
  2⤵
  PID:10036
- C:\Windows\System\SmGYqFi.exe
  C:\Windows\System\SmGYqFi.exe
  2⤵
  PID:10052
- C:\Windows\System\TqPjqlx.exe
  C:\Windows\System\TqPjqlx.exe
  2⤵
  PID:10068
- C:\Windows\System\HZdHEmk.exe
  C:\Windows\System\HZdHEmk.exe
  2⤵
  PID:10084
- C:\Windows\System\OZVCcjf.exe
  C:\Windows\System\OZVCcjf.exe
  2⤵
  PID:10100
- C:\Windows\System\FArnslZ.exe
  C:\Windows\System\FArnslZ.exe
  2⤵
  PID:10116
- C:\Windows\System\SRpykri.exe
  C:\Windows\System\SRpykri.exe
  2⤵
  PID:10132
- C:\Windows\System\TSWWgiu.exe
  C:\Windows\System\TSWWgiu.exe
  2⤵
  PID:10148
- C:\Windows\System\iXcxcsk.exe
  C:\Windows\System\iXcxcsk.exe
  2⤵
  PID:10168
- C:\Windows\System\ulanOCV.exe
  C:\Windows\System\ulanOCV.exe
  2⤵
  PID:10184
- C:\Windows\System\MGpuGPK.exe
  C:\Windows\System\MGpuGPK.exe
  2⤵
  PID:10200
- C:\Windows\System\tBjgOIn.exe
  C:\Windows\System\tBjgOIn.exe
  2⤵
  PID:10216
- C:\Windows\System\ZVMutRY.exe
  C:\Windows\System\ZVMutRY.exe
  2⤵
  PID:9180
- C:\Windows\System\dYbhftv.exe
  C:\Windows\System\dYbhftv.exe
  2⤵
  PID:9388
- C:\Windows\System\QOowIDb.exe
  C:\Windows\System\QOowIDb.exe
  2⤵
  PID:9468
- C:\Windows\System\ODDJkKj.exe
  C:\Windows\System\ODDJkKj.exe
  2⤵
  PID:9540
- C:\Windows\System\ytaDAyk.exe
  C:\Windows\System\ytaDAyk.exe
  2⤵
  PID:9524
- C:\Windows\System\NqvzpER.exe
  C:\Windows\System\NqvzpER.exe
  2⤵
  PID:9484
- C:\Windows\System\OpWpwkj.exe
  C:\Windows\System\OpWpwkj.exe
  2⤵
  PID:9600
- C:\Windows\System\LgagppR.exe
  C:\Windows\System\LgagppR.exe
  2⤵
  PID:9640
- C:\Windows\System\SkMthTB.exe
  C:\Windows\System\SkMthTB.exe
  2⤵
  PID:9704
- C:\Windows\System\qMnnDUv.exe
  C:\Windows\System\qMnnDUv.exe
  2⤵
  PID:9720
- C:\Windows\System\MWyDuQb.exe
  C:\Windows\System\MWyDuQb.exe
  2⤵
  PID:9744
- C:\Windows\System\HPTcVbW.exe
  C:\Windows\System\HPTcVbW.exe
  2⤵
  PID:9728
- C:\Windows\System\ypfGeJu.exe
  C:\Windows\System\ypfGeJu.exe
  2⤵
  PID:9808
- C:\Windows\System\tRKJcOI.exe
  C:\Windows\System\tRKJcOI.exe
  2⤵
  PID:9760
- C:\Windows\System\pdhESLp.exe
  C:\Windows\System\pdhESLp.exe
  2⤵
  PID:9908
- C:\Windows\System\GzKsIol.exe
  C:\Windows\System\GzKsIol.exe
  2⤵
  PID:9976
- C:\Windows\System\WxjGupq.exe
  C:\Windows\System\WxjGupq.exe
  2⤵
  PID:9792
- C:\Windows\System\tnIhuVz.exe
  C:\Windows\System\tnIhuVz.exe
  2⤵
  PID:10016
- C:\Windows\System\tYsqygC.exe
  C:\Windows\System\tYsqygC.exe
  2⤵
  PID:9996
- C:\Windows\System\oqGpHgQ.exe
  C:\Windows\System\oqGpHgQ.exe
  2⤵
  PID:9960
- C:\Windows\System\rSvWCre.exe
  C:\Windows\System\rSvWCre.exe
  2⤵
  PID:10076
- C:\Windows\System\dWzJjXu.exe
  C:\Windows\System\dWzJjXu.exe
  2⤵
  PID:10140
- C:\Windows\System\cyCoQej.exe
  C:\Windows\System\cyCoQej.exe
  2⤵
  PID:10124
- C:\Windows\System\Uwtrsmy.exe
  C:\Windows\System\Uwtrsmy.exe
  2⤵
  PID:10164
- C:\Windows\System\mhwjwFx.exe
  C:\Windows\System\mhwjwFx.exe
  2⤵
  PID:10212
- C:\Windows\System\QvJgWFp.exe
  C:\Windows\System\QvJgWFp.exe
  2⤵
  PID:10236
- C:\Windows\System\IKuzyhv.exe
  C:\Windows\System\IKuzyhv.exe
  2⤵
  PID:9032
- C:\Windows\System\thZGLAU.exe
  C:\Windows\System\thZGLAU.exe
  2⤵
  PID:8780
- C:\Windows\System\QSCOFqK.exe
  C:\Windows\System\QSCOFqK.exe
  2⤵
  PID:8540
- C:\Windows\System\lCgNtzs.exe
  C:\Windows\System\lCgNtzs.exe
  2⤵
  PID:9256
- C:\Windows\System\wJhMUHH.exe
  C:\Windows\System\wJhMUHH.exe
  2⤵
  PID:9260
- C:\Windows\System\yfQFNze.exe
  C:\Windows\System\yfQFNze.exe
  2⤵
  PID:9336
- C:\Windows\System\CZVcNUy.exe
  C:\Windows\System\CZVcNUy.exe
  2⤵
  PID:9404
- C:\Windows\System\MbHtTzG.exe
  C:\Windows\System\MbHtTzG.exe
  2⤵
  PID:9452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AMurxQm.exe

Filesize
2.0MB

MD5
cab6d8dbd9c588859509fb1fb194b867

SHA1
4a6e1dad8f7324e17daa80b4fff1e7bef4bf59b6

SHA256
e515967badbb45ca752671b3ffc2e7e2831cd3f0ef6aca8e3240e0cef40dfb80

SHA512
c554bc52d5d0e4fef45bf720d81d44e4b2d4f98d7c831a0e4d8eb2988a248e7ba0960f428c3c3f837a42bb771983426b07222a89196c189376bf41dc8603115f

Download Submit
C:\Windows\system\FfHwvvK.exe

Filesize
2.0MB

MD5
473335c65b5dc4495892821cc414c5a5

SHA1
7b69919b21f2ce2bad45c0f4bd65fb7230daeffb

SHA256
ed0ca596ba6827ddacf1f2b4910e82b993b4a964a79f14869649405a97aa6a55

SHA512
494cc9f93c131afd405850be96c3795fa6d41f673b24550328f89c0940b5627a6ee1a33dbd1e29916e0b9350883a0889a36e500e24d215cc7d81320cef3ccfee

Download Submit
C:\Windows\system\JMmEDoA.exe

Filesize
2.0MB

MD5
184b2a371cee8a2354d0c439b0b2c777

SHA1
b648944ef874e7c4ee2a578f47023f815ad71db1

SHA256
7ab1d90498b1a1892969ecca078d383ebc702390ddd76b4e5b91e9284eaa98bf

SHA512
bb2b848a345e63436e169e1c87422470140a09d275a2911e9055d3cb9e7bf1f968611b4291c4bbfa3f3a9bacf2eac8c076cba06ac2dfb30d9ffaa1b860512de4

Download Submit
C:\Windows\system\JtYUmfy.exe

Filesize
2.0MB

MD5
0a361ce46ba8f304d6c2c37524a4ac67

SHA1
aac3f76ef7362dafb0fe105f07cc232a8b0eb683

SHA256
c473d84e67f577b69aeeb66797f1e3beeb8d55f904e46cfaf32e1162c23fcc3c

SHA512
439448f99f405ea1450d38f10b6e3f399aff60244dc7979733b93e88b2890306e550b41b6e829b3072cf6bbacc1f4af0b6b3918bfa7eb08b9117b5c2afbf9dbf

Download Submit
C:\Windows\system\KjzRphY.exe

Filesize
2.0MB

MD5
4644a433594eb8bca2af512beaa2db32

SHA1
15f00f1e9fb1715318694fe28fb3a497557ddc41

SHA256
f17b8c9dd7b52cf6d1bafe45a0d21f68a64c133bc69f0bc642890a1c58a14d49

SHA512
6943c565368de86138f23c53d623e1cc56c05c8dd82ad952799c8ea6a48cd1304efbb3b080bccea66c921630a1977ded8d9222579a0a13a6443b9d575756002d

Download Submit
C:\Windows\system\NSFCfDa.exe

Filesize
2.0MB

MD5
e93d9438de9e0bd0cba32c2398f9f2db

SHA1
a0314f8a3d6df9ab4f3263f45fa9710074baa82c

SHA256
4d8c35685abb23128d57b149e9386190598a8cdf5b2d55fad04c987f05b715e7

SHA512
f7049650df2bdf6bd857c33eaebde9ccd7468b14a8cecc445b278914ce8022b557fd1499bdd5e593bdd06717d373f1ba24906a40c511111d1694b3cd87fb7b18

Download Submit
C:\Windows\system\PECTmYf.exe

Filesize
2.0MB

MD5
4faa0223ab757debf37478073a41dba4

SHA1
0b4a5c2858dc7325de6793f724ee456b6617a5af

SHA256
b0f2160161037adf8e0439c1c77fb0feab2585553a55401af43ee1ed1c40347a

SHA512
30957b728313e7bb120c998895ced060eed63ec4c75988841929faaf2f408429bc9caaaa6a1ff582255cb9f4f9b45cd5522803f9c3889c4aea0556706b1f6076

Download Submit
C:\Windows\system\RWmTVUt.exe

Filesize
2.0MB

MD5
72b2a0dd1b9d94754b10008d2712d9f1

SHA1
5f1d280ddeb8a4efdb9b7031151c0101376ee32a

SHA256
92c446d4fef43bf9251148d31b36bfe02f3d09c9af1defab2bff8c8733b89097

SHA512
931b51574a6e4c4d976695edd44838129879a8c524bde42dc2ee69801db19a9518ea581e0e6007f01e71264b2e827984423b668b812300d00945d055f18a468d

Download Submit
C:\Windows\system\Rqikiwv.exe

Filesize
2.0MB

MD5
954477510ceec43e1d70ac6dc0636d34

SHA1
d620e781a828d349920d6bfec783d4e71fe1e26a

SHA256
90d020db099942cd08274ee294ca2ab986731bbf917de40281c443dc9d655309

SHA512
2ea5ec5bc3aead7a3bb2c3962d3bc228ce79c771e192a42105ad795aaa12c28db7612b21542f70c9f525ccbd10a33947cd97bc7ade9ab994af1738087828ab4a

Download Submit
C:\Windows\system\SGspJlP.exe

Filesize
2.0MB

MD5
36ffe4bca2a9755bb6a3eb4a94dffa14

SHA1
6c8407b5e474835684c17aa6a0a429d76a76324e

SHA256
de5e4ac87473d1cea0e0d828a33e1d2df630c61488622bff5fd7363a5cb2e9cd

SHA512
2254a64c161cbf93258ae16741db8bc5faf6b797661bc0535465ebe30f9bd271a8ba040bbb1de1fa134eec743da516e28eca60d26cf21572fdd95e882fc9cbdf

Download Submit
C:\Windows\system\TsseAwR.exe

Filesize
2.0MB

MD5
42f2053b9f35f1b4fce41031beb010d0

SHA1
e939b10763e75c9e86f2542d0f46285f2ba51e3c

SHA256
9800d15d6b4340da80f35f7640a4c12819257e755ace477457ec57f191b5c864

SHA512
26ff137ad420d4c382d9ed18b9b8ae1f4c0cd25c82e1497279ccb6772efa2c40b3f65f59b1f7a441f26ef69353f81acc8c96e1181c16017f8188c7d4aa00be14

Download Submit
C:\Windows\system\TuHsncS.exe

Filesize
2.0MB

MD5
d6b04642bd9b7fddc96fac4021e5ac66

SHA1
eeea477d01c2161765c442b27a5fc35145a5330b

SHA256
173e2929f803fd50b4677a78b83be61c28daa1141bf733ba713aaf4276143249

SHA512
76d2497f3908ab96767cf7b05b53b800ef2acdd58098b4bb711c2c6663386e2812aefc47c1dc8a2b510a39c778adeda5a8e0e6030ee9baacff061d3a068d2634

Download Submit
C:\Windows\system\aAFbBIW.exe

Filesize
2.0MB

MD5
86bde2df1b9775287a17dbdfa93737dd

SHA1
2afaf0c116ed274e20466f325b857c908564a8cd

SHA256
723866d65dbc5d0bbc5053d3a2b720ac3436f17692c6a7af57c8dc667f37e61a

SHA512
74dbe4cf1082ecb7a520bb545ad4ab50a7c979e5ed969e7887bd33e9a2fb0c8e36f489b0f01b8c563df71520669eb657796c7b22575cde983367bfc292b0d903

Download Submit
C:\Windows\system\awTLLHQ.exe

Filesize
2.0MB

MD5
fdca242a6145df9d4ef20b2c747d61a2

SHA1
7579905747a3c9d2bc9e890c56d7c8d04750bf0d

SHA256
b84d8ad4c3c1231aae0f83acfce05fcfe0a5534ceaf323861fba3da2f27675f6

SHA512
adb5b34deed8ce7e8546dc012b1885d36f795455e1b5b1650ea3f5ce7074c2f4775782b4ef7cd7198c0c0de1281734dc5de6f7ce98cee82de3f0aa5662f29787

Download Submit
C:\Windows\system\jPxcjqM.exe

Filesize
2.0MB

MD5
70f4b916488696beb7387fc14598b6f4

SHA1
f543dc7f58e0c2a0743e896111f0a5c2f4ec4940

SHA256
05218be20a12daeb8b1d7146af87cbd14e75153aa839071af0715864430a66d8

SHA512
a60afb28d50c85a81b2e72827ad03a9cd36b96cf8218234cd85502f0c2f22940e69b49b34fab171d2bb304b55325f8a2294dfb03109cc656cba8d26ca47d4564

Download Submit
C:\Windows\system\jjWPmsT.exe

Filesize
2.0MB

MD5
499f60a977ce906a693b91cf2909e2f5

SHA1
cc462642158ab33d70c16fdbc2909d01a152f09b

SHA256
13fbd10cc96fa6b9370455eff31b2f86dca5d5b001ee5ce9650b9bc69cb836a9

SHA512
cd0855b05dc880439f76be57353e0f5256d6848a079e0912a117ee6a507813566fb8ac597d69336ffa9c63da0ab322ad7c4387df66d1278db6bcd31ffe4339e4

Download Submit
C:\Windows\system\jsKziev.exe

Filesize
2.0MB

MD5
ad6b05ef7784be1cd19ebb6012287983

SHA1
223d5498f89ab9e185384225879dd08a8571a70a

SHA256
aeaba6de84d954559fb4271f616ad7aacc0c5802ad066a7d27f5bfcd851d85a5

SHA512
fc1a896e0f80e1c5959f5387ab0f24c057f9d751e5977e4053dd0f05fb71eeda8ece439be9fc624fe8dd9eae059d8db312cdfd82532cb209ab3c3a023645d9ad

Download Submit
C:\Windows\system\njeWLpm.exe

Filesize
2.0MB

MD5
f6803bae95b3b755e57b040fcecd33a2

SHA1
50a369dba2e3328c234b1475da651da0ae083ac7

SHA256
308f7e5da89ade5ad7b041e95d58b84c0d190939a0e07fab97f0e446c33e7487

SHA512
bc88206521c4254dd0fe988572c2c9c41a1fcf7ac8a9b77f1a80339b6053695c908cb902ef210540736586144ac89ad0024ef36cbe8b89dc32371a0eb91b5033

Download Submit
C:\Windows\system\oHPATzn.exe

Filesize
2.0MB

MD5
abf889e1e4ad08e1a1064e2d35067296

SHA1
0e360d207f79ed200082caec228dfbdfb316ac78

SHA256
01bf106a8779730588178bd185ad98df85648a05a0125dfdd76a593d20f95d87

SHA512
425ad1d1c71fa683ea3d4e4b3fab0578cdcae69ac6ac42b12d81cde1f2191b6f428681f3dcb7f5dc6682069b7ec3f183ab57da2f8cfdadc89da4b283ae9203d9

Download Submit
C:\Windows\system\quswHXN.exe

Filesize
2.0MB

MD5
0b80107e77e2c8125a1fb11363373c64

SHA1
023c7f3019e506bdb1ae1f23907b5a4991942fee

SHA256
efc057f7d6e8cfad4866b19a1085df879ba41f25a0bd9e75ce1eb5ece90eb867

SHA512
d77826c9d566ac7056026b47ca1fae7bb43e9c263718fe76a93fb14c75b609f30a84194eed296b5d3e9f83246d6bcf1319c071ff4f82371a1aeb142443b57831

Download Submit
C:\Windows\system\shmRveR.exe

Filesize
2.0MB

MD5
b549b323fb35bc46eac56d842b0b025d

SHA1
2e8087a305f9b66fcf8ec99294e7a0301e83ead9

SHA256
050ec6f6ad851f5daf0c5c7af972f666f6e0747796f432442bf834c4e9043a3a

SHA512
31b1d9c659b378e01760046f10ff89fda094c7811b328dabad61e61e555b2ea08ca98c584bd5d582170a7998ec9563d15a3e0b7c242c73caf069f83c21329f07

Download Submit
C:\Windows\system\uaLHbLN.exe

Filesize
2.0MB

MD5
adc7a2ec0e8f8cf3a605b569478741aa

SHA1
33b4d57088399b3dff643a978cd80ef7445a3538

SHA256
b9770744ff659001218b2a9d98d659d2dd6b1b025375099a5a7de7755fd74617

SHA512
7f8859c8c30124df793cbff0c62d4c787ac2ec334488d717dc1b91afb6bffeac385d2c39d9cfe1cc7943b81dda2b36d3734f674b5e2e8e8a5a62e93bdfbc7e42

Download Submit
C:\Windows\system\vbWCIva.exe

Filesize
2.0MB

MD5
28e5998e5b3923343a49f108e9a5c388

SHA1
2f1e14a4bab3e749d89411cb18341b3db80e1789

SHA256
fa49322317c1aff1e6c7baea11af6e7f9ebb0bdf9bb5f147ee09c68871b3c088

SHA512
9112e7b76336c43c7c75c8f89fb068c86ae25de73485a283f238d4ec74585835a16f7b563eb99c44460e20bb5f70f8301ee629647905cc3880c7ddf7bb552e50

Download Submit
C:\Windows\system\vhQiabx.exe

Filesize
2.0MB

MD5
df2a460474adb4e69c51ba65e9cd0ee7

SHA1
0c5763a45eae44cd87d35d10985c11c7ae2d7025

SHA256
661545842adcef4d167e0627bc2a61087c378e0d4361a34c374626c3111f163c

SHA512
9626b2cdf304e482fe878d15894b12d526bf71932314fd3ab73b62be7b0186b521be98c11f2bfb9a6a2df76c9aac24964d335e9e8170bd52186ab3047bfbd006

Download Submit
C:\Windows\system\xcVnkWd.exe

Filesize
2.0MB

MD5
02b2c5b063e17e33c12eb836dc0083bf

SHA1
302683c7ca72c14c987eb5db6e1e7108bd56df68

SHA256
1ff52efa442ff253057904d51a06360430fc5945e9169166e6e0773ba61dc53a

SHA512
a5e22b3b4cb8f39aee807c0ef6630025d7e2f638fd262afb367ae04cde5f98c861fa3a49950256d9132ac53cd6b77c4d8ad087fa37ba0a243fe9d8b042708030

Download Submit
C:\Windows\system\zARhjIY.exe

Filesize
2.0MB

MD5
779f5828d9e79da174493adccbb14ef6

SHA1
8b2ddbc23b1451a1a8ec8b3ebe336ca9cca705ba

SHA256
427a9288022875200fd52892c45e930fd30296228aef1ee5a60927a07f4184f3

SHA512
9e7cad9cac3a4d0b972444c2550475f0ae47d03d8e2ac1daf9ae5953f3c3020fb7be4b6ad77c3ed3e3bc5344517cfc5bf31bdf8ffef851c7e9e81973e9f712ac

Download Submit
\Windows\system\BxxZwck.exe

Filesize
2.0MB

MD5
c4221f4e07d0539bec2142592b898992

SHA1
4e097a80368bc47076f5cc9fc56c1345b6d57460

SHA256
162c77ef8a70220ff76f7b239ad57f8d8fcc5ec1a0cdf6fe96c405bfa6248a2f

SHA512
83ac89d7525ff933c5212d434cafe917d4b605a64a3619d045518774558f3e765db411409cb00cc189088561142569e9fd9291d7977dc4e2f5a39502ae03b8b3

Download Submit
\Windows\system\GUGuICx.exe

Filesize
2.0MB

MD5
d0bd5a24980a142ecdc63f955af9449e

SHA1
807cf1349f7cc0ea14995e8e13174a2f19c576f7

SHA256
301ac0086871d0639f95e0e3fe125022a70e489ceafd5d3f10a5aefe15a467ec

SHA512
ff286393a28555abdef999aa1cfdd19dd4cb0ecfa0011275e0fca4dc9eb6870c57b4be62f260b720e192e612d1197f7ac712727617fdbf4c1eff2ce88fc811c0

Download Submit
\Windows\system\QbylpgZ.exe

Filesize
2.0MB

MD5
728ad6718519a7d74fcdd9038b59b37b

SHA1
dc0d5921b88e7167e2b2933076221660f1e58cd1

SHA256
cbca32a2aff1bb6ed454d527f0e2a12ea4b4be3323b9a1cbb380a3ca12a89f6c

SHA512
395b684ff2fde609641c8a5633a536feb1df7dc8445c0bbfc319f0631f3e9ea8547b73214030707f759b246ed057780e8e7bbf0571648b1861bde6446d04be9a

Download Submit
\Windows\system\RjMFXSm.exe

Filesize
2.0MB

MD5
4454dd411de296473cbead73b1f10064

SHA1
db5d0764c6af7e4af62b8bd15c28b2b1ac79e1dc

SHA256
b6319f4ec6051109125673fe88d26fed84367035adfbbfbaad13f902b22087c6

SHA512
5da1794a17c2debbf764cdde476c71c2c7e8331e511ead550cc04a54d9ed63370251d64714c1b4b1dc531d5c9629f592a8f425769fb4c0e9966249270a46a66e

Download Submit
\Windows\system\XeDCHgT.exe

Filesize
2.0MB

MD5
550e9cc096bcbb90eba96f2cd6771dc7

SHA1
4a09021628774257d2baa2b44c2b4135ae704aa3

SHA256
fc910855c81c7c8a8acc7161e47addc6b8afa4e2b24c88f3e66b223cdcb6e598

SHA512
3ffdc1b6432456e30097a27663d214ff622e0adf08fe4cbe0b1422dd57248d1fa109d6be3f2881a0ac1842623744b52005bfe26bf8dbacbf8995839ce8da1f7e

Download Submit
\Windows\system\ZxtQIzs.exe

Filesize
2.0MB

MD5
5286d100c27f2d678b2b519d95cdd48b

SHA1
4dd8a31dedc91dc762fb1eb4a79ecddd08d92d3d

SHA256
0f91066bf38129bf3770d91d5fb136ead9a893b87ba6fad6bfe24460e9146184

SHA512
5a58347f8f059d1f19b2ca2f849a6f7643aa3256fa55dc5d91d4f65e48e7148a13ec3e527e76cdd8ccb16e6a02035a5bc0947fbf114e967a81c7deeca1003075

Download Submit
\Windows\system\uptmSqJ.exe

Filesize
2.0MB

MD5
ca09b184183c569998adfb283e4359d3

SHA1
6012f6ad9e239cef5b0e897cb75cb57b85f48584

SHA256
9f75d1f3a904b0a712ea9087260b1d3583d5db1257682f42d0c51a2ccb445b33

SHA512
c696360a5c15e34b2c4b78a5438e4d21e29a2f4e49f7b14aaf5d8458da57a4f6c10a9193993c6c27b3859a4e8742b241f0c92c2d0d87bbb077a17e57242dbbd6

Download Submit
memory/1244-155-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/1244-161-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/1244-12-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1244-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1244-129-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/1244-1-0x000000013FC10000-0x0000000140002000-memory.dmp

Filesize
3.9MB

Download
memory/1244-119-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/1244-141-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1244-153-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/1244-145-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/1244-143-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/1244-132-0x0000000003590000-0x0000000003982000-memory.dmp

Filesize
3.9MB

Download
memory/2140-13-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2184-44-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2184-204-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-113-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-147-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/2184-114-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/2184-156-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2184-45-0x0000000001E10000-0x0000000001E18000-memory.dmp

Filesize
32KB

Download
memory/2184-14-0x0000000002E00000-0x0000000002E80000-memory.dmp

Filesize
512KB

Download
memory/2340-146-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2444-142-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/2488-154-0x000000013F850000-0x000000013FC42000-memory.dmp

Filesize
3.9MB

Download
memory/2524-120-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2660-144-0x000000013F700000-0x000000013FAF2000-memory.dmp

Filesize
3.9MB

Download
memory/2716-140-0x000000013F9B0000-0x000000013FDA2000-memory.dmp

Filesize
3.9MB

Download
memory/2780-115-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2988-138-0x000000013FDC0000-0x00000001401B2000-memory.dmp

Filesize
3.9MB

Download