xmrig | bf62bd4a306f9d93c9817bffbe49b326f576f4cb11397c4ec620db17ec8dfb53

Analysis

max time kernel
18s
max time network
31s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28/04/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
Size

1.8MB
MD5

05b0f6a0e57c3bbf14185a1f1415ae3e
SHA1

77a42eb142a76ff5f494f1412a1eb6e673f96864
SHA256

bf62bd4a306f9d93c9817bffbe49b326f576f4cb11397c4ec620db17ec8dfb53
SHA512

e81469b03d4f657de15d56e82b30df43f2d22f4e956c7618de06046d9ccc85b8a8b58eb7285ec0ffcabf379469fb7b2f88146286f5a45e48be00324960274312
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlT:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1448-151-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2744-122-0x000000013F500000-0x000000013F8F2000-memory.dmp	xmrig
behavioral1/memory/2108-75-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2176-69-0x0000000002F10000-0x0000000003302000-memory.dmp	xmrig
behavioral1/memory/2968-67-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	xmrig
behavioral1/memory/2736-59-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2648-38-0x000000013F870000-0x000000013FC62000-memory.dmp	xmrig
behavioral1/memory/2928-31-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1184-23-0x000000013F830000-0x000000013FC22000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1184	itpGbKe.exe
2928	FNFqwWZ.exe
2648	dEmntcO.exe
2632	eNzFliE.exe
2736	pdiImvK.exe
2108	UNErgnI.exe
2968	jLMFPrP.exe
1260	nIlPLzr.exe
2744	NgOgaex.exe
1448	TcdBQRE.exe
2704	auKcrdg.exe
2240	PwZTyvp.exe
2004	zJWYydc.exe
2400	WTjnIuj.exe
1804	puCAlHz.exe
2200	LhYumUZ.exe
316	JMYTwxa.exe
1796	uhDeJyO.exe
664	TULolqK.exe
2760	otfBIWH.exe
2100	lveCoBF.exe
2676	MTcatSB.exe
2576	oHvPiVJ.exe
2608	juwfOPt.exe
1864	RUQwenH.exe
1612	yathLhI.exe
1968	wnirXQx.exe
2352	robMugG.exe
1048	gqnTRbT.exe
828	vPdwFch.exe
296	jiIDEip.exe
1748	pUMcIKf.exe
1856	bxTpmQD.exe
1696	iYmhbAr.exe
1564	ygcSpRk.exe
1256	Zcbksjb.exe
772	ysCoXEw.exe
1976	PWSTujP.exe
796	KYNrKGK.exe
900	tLEOMFC.exe
268	bunICBp.exe
1504	OnkYhCC.exe
1160	hmnwWCI.exe
872	riGfeaE.exe
2904	vGePgwg.exe
1596	FsUwzsv.exe
2024	TgKwVDM.exe
2152	fHDVPjg.exe
1252	rzyLXcU.exe
2208	WuNmMqk.exe
1752	hEwXaYe.exe
1272	WUVDomO.exe
2832	HmwGyuf.exe
3040	UQRrYVC.exe
1672	ZIHhFMh.exe
1704	ealsNLi.exe
2032	RYUfEQj.exe
1992	trjywdU.exe
2392	vmXVbly.exe
1600	LsxaSji.exe
2412	npPovzW.exe
2656	bmGTKhs.exe
2696	AlPPNny.exe
3100	AVQlyGS.exe

Loads dropped DLL 64 IoCs

pid	Process
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2176-1-0x000000013F550000-0x000000013F942000-memory.dmp	upx
behavioral1/files/0x000b000000012279-3.dat	upx
behavioral1/files/0x0007000000015d02-22.dat	upx
behavioral1/files/0x002c000000015ca9-7.dat	upx
behavioral1/files/0x0006000000016c5b-43.dat	upx
behavioral1/files/0x0006000000016ccd-48.dat	upx
behavioral1/files/0x0007000000015d1e-42.dat	upx
behavioral1/files/0x0006000000016d01-81.dat	upx
behavioral1/files/0x0007000000016d19-85.dat	upx
behavioral1/files/0x0006000000016d79-123.dat	upx
behavioral1/files/0x0006000000016d5f-112.dat	upx
behavioral1/files/0x000600000001738f-156.dat	upx
behavioral1/files/0x000600000001708c-190.dat	upx
behavioral1/files/0x0006000000016d57-179.dat	upx
behavioral1/files/0x0006000000016d46-177.dat	upx
behavioral1/files/0x0006000000016d36-175.dat	upx
behavioral1/files/0x0006000000016d21-173.dat	upx
behavioral1/files/0x00130000000054a8-171.dat	upx
behavioral1/files/0x00060000000173e2-167.dat	upx
behavioral1/memory/1448-151-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/files/0x00060000000171ad-150.dat	upx
behavioral1/files/0x0006000000016fa9-149.dat	upx
behavioral1/files/0x000600000001738e-140.dat	upx
behavioral1/files/0x0006000000016d7d-127.dat	upx
behavioral1/memory/2744-122-0x000000013F500000-0x000000013F8F2000-memory.dmp	upx
behavioral1/files/0x0006000000016d73-119.dat	upx
behavioral1/memory/1260-90-0x000000013F020000-0x000000013F412000-memory.dmp	upx
behavioral1/files/0x0007000000015d13-77.dat	upx
behavioral1/files/0x0008000000015ced-76.dat	upx
behavioral1/memory/2108-75-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2968-67-0x000000013F5E0000-0x000000013F9D2000-memory.dmp	upx
behavioral1/memory/2736-59-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2632-56-0x000000013F670000-0x000000013FA62000-memory.dmp	upx
behavioral1/files/0x0006000000016cf2-51.dat	upx
behavioral1/files/0x0006000000016ca1-44.dat	upx
behavioral1/memory/2648-38-0x000000013F870000-0x000000013FC62000-memory.dmp	upx
behavioral1/files/0x0008000000016c57-35.dat	upx
behavioral1/memory/2928-31-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/files/0x00060000000173e5-183.dat	upx
behavioral1/files/0x0006000000016d4f-118.dat	upx
behavioral1/files/0x0006000000016d3e-117.dat	upx
behavioral1/files/0x0006000000016d2d-116.dat	upx
behavioral1/memory/1184-23-0x000000013F830000-0x000000013FC22000-memory.dmp	upx
behavioral1/files/0x0008000000015ce1-21.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\sEaGYhy.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\QdSjHHx.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\wXzSsXt.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\IPmeLZj.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\lklEBDo.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\peRbsBo.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\ROsBGVY.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\NrcxCRT.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\NTphCmm.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\knHaSim.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\veiXXEw.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\dmBUtIy.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\lkmIHQR.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\PkbdDXI.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\FYjKRbA.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\NwXuLHi.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\QhGpXCt.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\SPiNiaF.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\lbPzwJj.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\TfTVDyW.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\CHteCJn.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\xXIneIn.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\kuBxgCW.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\EVOIgjP.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\XeAKtpa.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\wGxXYXN.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\wVyVVYY.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\hEwXaYe.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\bmGTKhs.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\fddWbvY.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\jdkrsjQ.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\evbhHGM.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\nlpYrwo.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\xIxPkFU.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\puCAlHz.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\MpHhFrt.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\VTffvQw.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\EeCxNkY.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\PAlqFtv.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\oeIqPQt.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\RztiVmQ.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\zJWYydc.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\hmnwWCI.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\YrzKgIr.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\yUHVTdr.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\auKcrdg.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\psUpZHE.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\lZuJhcG.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\OEURoFO.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\yMNWCBa.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\jjcTCwN.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\ebFmBtJ.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\VNOdfTf.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\dJGClxk.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\bKgrOxS.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\BLBqKkB.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\eMeYNxK.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\EEAZBpG.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\QPJWxzt.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\hyRAHXy.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\reAUXxO.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\GKhOmwU.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\vbukBzp.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
File created	C:\Windows\System\ENnhiZo.exe	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2260	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
Token: SeDebugPrivilege	2260	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	29
PID 2176 wrote to memory of 2260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	29
PID 2176 wrote to memory of 1184	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1184	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	30
PID 2176 wrote to memory of 1184	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	30
PID 2176 wrote to memory of 2108	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2108	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2108	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	31
PID 2176 wrote to memory of 2928	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2928	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	32
PID 2176 wrote to memory of 2928	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	32
PID 2176 wrote to memory of 1260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	33
PID 2176 wrote to memory of 1260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	33
PID 2176 wrote to memory of 1260	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	33
PID 2176 wrote to memory of 2648	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2648	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2648	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	34
PID 2176 wrote to memory of 2744	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2744	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2744	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	35
PID 2176 wrote to memory of 2632	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2632	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2632	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	36
PID 2176 wrote to memory of 2760	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2760	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2760	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	37
PID 2176 wrote to memory of 2736	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2736	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2736	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	38
PID 2176 wrote to memory of 2100	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2100	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2100	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	39
PID 2176 wrote to memory of 2968	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2968	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2968	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	40
PID 2176 wrote to memory of 2676	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2676	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	41
PID 2176 wrote to memory of 2676	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	41
PID 2176 wrote to memory of 1448	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1448	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	42
PID 2176 wrote to memory of 1448	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	42
PID 2176 wrote to memory of 2576	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	43
PID 2176 wrote to memory of 2576	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	43
PID 2176 wrote to memory of 2576	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	43
PID 2176 wrote to memory of 2704	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2704	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2704	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	44
PID 2176 wrote to memory of 2608	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2608	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2608	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	45
PID 2176 wrote to memory of 2240	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	46
PID 2176 wrote to memory of 2240	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	46
PID 2176 wrote to memory of 2240	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	46
PID 2176 wrote to memory of 1864	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	47
PID 2176 wrote to memory of 1864	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	47
PID 2176 wrote to memory of 1864	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	47
PID 2176 wrote to memory of 2004	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2004	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	48
PID 2176 wrote to memory of 2004	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	48
PID 2176 wrote to memory of 1612	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1612	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	49
PID 2176 wrote to memory of 1612	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	49
PID 2176 wrote to memory of 2400	2176	05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\05b0f6a0e57c3bbf14185a1f1415ae3e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\System\itpGbKe.exe
  C:\Windows\System\itpGbKe.exe
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Windows\System\UNErgnI.exe
  C:\Windows\System\UNErgnI.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\FNFqwWZ.exe
  C:\Windows\System\FNFqwWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\nIlPLzr.exe
  C:\Windows\System\nIlPLzr.exe
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Windows\System\dEmntcO.exe
  C:\Windows\System\dEmntcO.exe
  2⤵
  - Executes dropped EXE
  PID:2648
- C:\Windows\System\NgOgaex.exe
  C:\Windows\System\NgOgaex.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\eNzFliE.exe
  C:\Windows\System\eNzFliE.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\otfBIWH.exe
  C:\Windows\System\otfBIWH.exe
  2⤵
  - Executes dropped EXE
  PID:2760
- C:\Windows\System\pdiImvK.exe
  C:\Windows\System\pdiImvK.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\lveCoBF.exe
  C:\Windows\System\lveCoBF.exe
  2⤵
  - Executes dropped EXE
  PID:2100
- C:\Windows\System\jLMFPrP.exe
  C:\Windows\System\jLMFPrP.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\MTcatSB.exe
  C:\Windows\System\MTcatSB.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\TcdBQRE.exe
  C:\Windows\System\TcdBQRE.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\oHvPiVJ.exe
  C:\Windows\System\oHvPiVJ.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\auKcrdg.exe
  C:\Windows\System\auKcrdg.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\juwfOPt.exe
  C:\Windows\System\juwfOPt.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\PwZTyvp.exe
  C:\Windows\System\PwZTyvp.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\RUQwenH.exe
  C:\Windows\System\RUQwenH.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\zJWYydc.exe
  C:\Windows\System\zJWYydc.exe
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Windows\System\yathLhI.exe
  C:\Windows\System\yathLhI.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\WTjnIuj.exe
  C:\Windows\System\WTjnIuj.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\wnirXQx.exe
  C:\Windows\System\wnirXQx.exe
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Windows\System\puCAlHz.exe
  C:\Windows\System\puCAlHz.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\gqnTRbT.exe
  C:\Windows\System\gqnTRbT.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\LhYumUZ.exe
  C:\Windows\System\LhYumUZ.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\vPdwFch.exe
  C:\Windows\System\vPdwFch.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\JMYTwxa.exe
  C:\Windows\System\JMYTwxa.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\jiIDEip.exe
  C:\Windows\System\jiIDEip.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\uhDeJyO.exe
  C:\Windows\System\uhDeJyO.exe
  2⤵
  - Executes dropped EXE
  PID:1796
- C:\Windows\System\pUMcIKf.exe
  C:\Windows\System\pUMcIKf.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\TULolqK.exe
  C:\Windows\System\TULolqK.exe
  2⤵
  - Executes dropped EXE
  PID:664
- C:\Windows\System\bxTpmQD.exe
  C:\Windows\System\bxTpmQD.exe
  2⤵
  - Executes dropped EXE
  PID:1856
- C:\Windows\System\robMugG.exe
  C:\Windows\System\robMugG.exe
  2⤵
  - Executes dropped EXE
  PID:2352
- C:\Windows\System\iYmhbAr.exe
  C:\Windows\System\iYmhbAr.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\ygcSpRk.exe
  C:\Windows\System\ygcSpRk.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\Zcbksjb.exe
  C:\Windows\System\Zcbksjb.exe
  2⤵
  - Executes dropped EXE
  PID:1256
- C:\Windows\System\ysCoXEw.exe
  C:\Windows\System\ysCoXEw.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\tLEOMFC.exe
  C:\Windows\System\tLEOMFC.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\PWSTujP.exe
  C:\Windows\System\PWSTujP.exe
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Windows\System\phVCsgz.exe
  C:\Windows\System\phVCsgz.exe
  2⤵
  PID:1980
- C:\Windows\System\KYNrKGK.exe
  C:\Windows\System\KYNrKGK.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\sMHeemq.exe
  C:\Windows\System\sMHeemq.exe
  2⤵
  PID:1744
- C:\Windows\System\bunICBp.exe
  C:\Windows\System\bunICBp.exe
  2⤵
  - Executes dropped EXE
  PID:268
- C:\Windows\System\zvOhQix.exe
  C:\Windows\System\zvOhQix.exe
  2⤵
  PID:2976
- C:\Windows\System\OnkYhCC.exe
  C:\Windows\System\OnkYhCC.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\NrcxCRT.exe
  C:\Windows\System\NrcxCRT.exe
  2⤵
  PID:2992
- C:\Windows\System\hmnwWCI.exe
  C:\Windows\System\hmnwWCI.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\wTmdQiV.exe
  C:\Windows\System\wTmdQiV.exe
  2⤵
  PID:2112
- C:\Windows\System\riGfeaE.exe
  C:\Windows\System\riGfeaE.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\fApLAfl.exe
  C:\Windows\System\fApLAfl.exe
  2⤵
  PID:1936
- C:\Windows\System\vGePgwg.exe
  C:\Windows\System\vGePgwg.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\LTHqmHR.exe
  C:\Windows\System\LTHqmHR.exe
  2⤵
  PID:2436
- C:\Windows\System\FsUwzsv.exe
  C:\Windows\System\FsUwzsv.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\jjcTCwN.exe
  C:\Windows\System\jjcTCwN.exe
  2⤵
  PID:1716
- C:\Windows\System\TgKwVDM.exe
  C:\Windows\System\TgKwVDM.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\LbIOIob.exe
  C:\Windows\System\LbIOIob.exe
  2⤵
  PID:2720
- C:\Windows\System\fHDVPjg.exe
  C:\Windows\System\fHDVPjg.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\XbCYTeP.exe
  C:\Windows\System\XbCYTeP.exe
  2⤵
  PID:2668
- C:\Windows\System\rzyLXcU.exe
  C:\Windows\System\rzyLXcU.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\qFmHxBN.exe
  C:\Windows\System\qFmHxBN.exe
  2⤵
  PID:824
- C:\Windows\System\WuNmMqk.exe
  C:\Windows\System\WuNmMqk.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\zAjpbEz.exe
  C:\Windows\System\zAjpbEz.exe
  2⤵
  PID:2212
- C:\Windows\System\hEwXaYe.exe
  C:\Windows\System\hEwXaYe.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\evmsBdZ.exe
  C:\Windows\System\evmsBdZ.exe
  2⤵
  PID:484
- C:\Windows\System\WUVDomO.exe
  C:\Windows\System\WUVDomO.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\bSTrQfx.exe
  C:\Windows\System\bSTrQfx.exe
  2⤵
  PID:536
- C:\Windows\System\HmwGyuf.exe
  C:\Windows\System\HmwGyuf.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\JuUTzaw.exe
  C:\Windows\System\JuUTzaw.exe
  2⤵
  PID:2616
- C:\Windows\System\UQRrYVC.exe
  C:\Windows\System\UQRrYVC.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\nQWCgLL.exe
  C:\Windows\System\nQWCgLL.exe
  2⤵
  PID:2516
- C:\Windows\System\ZIHhFMh.exe
  C:\Windows\System\ZIHhFMh.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\QPJWxzt.exe
  C:\Windows\System\QPJWxzt.exe
  2⤵
  PID:2168
- C:\Windows\System\ealsNLi.exe
  C:\Windows\System\ealsNLi.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\iJcbFel.exe
  C:\Windows\System\iJcbFel.exe
  2⤵
  PID:2792
- C:\Windows\System\RYUfEQj.exe
  C:\Windows\System\RYUfEQj.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\gvodNAH.exe
  C:\Windows\System\gvodNAH.exe
  2⤵
  PID:1916
- C:\Windows\System\trjywdU.exe
  C:\Windows\System\trjywdU.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\upByBmG.exe
  C:\Windows\System\upByBmG.exe
  2⤵
  PID:3068
- C:\Windows\System\vmXVbly.exe
  C:\Windows\System\vmXVbly.exe
  2⤵
  - Executes dropped EXE
  PID:2392
- C:\Windows\System\xSZorzy.exe
  C:\Windows\System\xSZorzy.exe
  2⤵
  PID:1652
- C:\Windows\System\LsxaSji.exe
  C:\Windows\System\LsxaSji.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nKLMqfZ.exe
  C:\Windows\System\nKLMqfZ.exe
  2⤵
  PID:2784
- C:\Windows\System\npPovzW.exe
  C:\Windows\System\npPovzW.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\FYjKRbA.exe
  C:\Windows\System\FYjKRbA.exe
  2⤵
  PID:1772
- C:\Windows\System\bmGTKhs.exe
  C:\Windows\System\bmGTKhs.exe
  2⤵
  - Executes dropped EXE
  PID:2656
- C:\Windows\System\aWInBiM.exe
  C:\Windows\System\aWInBiM.exe
  2⤵
  PID:2724
- C:\Windows\System\AlPPNny.exe
  C:\Windows\System\AlPPNny.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\sZWNSUX.exe
  C:\Windows\System\sZWNSUX.exe
  2⤵
  PID:3084
- C:\Windows\System\AVQlyGS.exe
  C:\Windows\System\AVQlyGS.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\IqxcXiY.exe
  C:\Windows\System\IqxcXiY.exe
  2⤵
  PID:3116
- C:\Windows\System\IrpoizU.exe
  C:\Windows\System\IrpoizU.exe
  2⤵
  PID:3132
- C:\Windows\System\jqVRZCN.exe
  C:\Windows\System\jqVRZCN.exe
  2⤵
  PID:3148
- C:\Windows\System\XlmExag.exe
  C:\Windows\System\XlmExag.exe
  2⤵
  PID:3164
- C:\Windows\System\PRYvIZF.exe
  C:\Windows\System\PRYvIZF.exe
  2⤵
  PID:3180
- C:\Windows\System\Ubwbxnh.exe
  C:\Windows\System\Ubwbxnh.exe
  2⤵
  PID:3196
- C:\Windows\System\cVHCWDe.exe
  C:\Windows\System\cVHCWDe.exe
  2⤵
  PID:3212
- C:\Windows\System\wliogHW.exe
  C:\Windows\System\wliogHW.exe
  2⤵
  PID:3228
- C:\Windows\System\WVYdxVw.exe
  C:\Windows\System\WVYdxVw.exe
  2⤵
  PID:3244
- C:\Windows\System\epjfXKP.exe
  C:\Windows\System\epjfXKP.exe
  2⤵
  PID:3260
- C:\Windows\System\rdRMJJg.exe
  C:\Windows\System\rdRMJJg.exe
  2⤵
  PID:3276
- C:\Windows\System\cWPGCTY.exe
  C:\Windows\System\cWPGCTY.exe
  2⤵
  PID:3292
- C:\Windows\System\vzkjLuw.exe
  C:\Windows\System\vzkjLuw.exe
  2⤵
  PID:3308
- C:\Windows\System\oTvklDi.exe
  C:\Windows\System\oTvklDi.exe
  2⤵
  PID:3324
- C:\Windows\System\TfTVDyW.exe
  C:\Windows\System\TfTVDyW.exe
  2⤵
  PID:3340
- C:\Windows\System\ZuZkIsn.exe
  C:\Windows\System\ZuZkIsn.exe
  2⤵
  PID:3356
- C:\Windows\System\kTLuHSd.exe
  C:\Windows\System\kTLuHSd.exe
  2⤵
  PID:3372
- C:\Windows\System\lBcBwBQ.exe
  C:\Windows\System\lBcBwBQ.exe
  2⤵
  PID:3388
- C:\Windows\System\VlzaoCJ.exe
  C:\Windows\System\VlzaoCJ.exe
  2⤵
  PID:3404
- C:\Windows\System\qiiBnET.exe
  C:\Windows\System\qiiBnET.exe
  2⤵
  PID:3420
- C:\Windows\System\aqDOJXV.exe
  C:\Windows\System\aqDOJXV.exe
  2⤵
  PID:3436
- C:\Windows\System\WaApYKy.exe
  C:\Windows\System\WaApYKy.exe
  2⤵
  PID:3452
- C:\Windows\System\CWFxyNx.exe
  C:\Windows\System\CWFxyNx.exe
  2⤵
  PID:3468
- C:\Windows\System\nihuXqF.exe
  C:\Windows\System\nihuXqF.exe
  2⤵
  PID:3484
- C:\Windows\System\jaQQqQg.exe
  C:\Windows\System\jaQQqQg.exe
  2⤵
  PID:3500
- C:\Windows\System\gKXLXqj.exe
  C:\Windows\System\gKXLXqj.exe
  2⤵
  PID:3516
- C:\Windows\System\apUDNNV.exe
  C:\Windows\System\apUDNNV.exe
  2⤵
  PID:3532
- C:\Windows\System\qaMrlGq.exe
  C:\Windows\System\qaMrlGq.exe
  2⤵
  PID:3548
- C:\Windows\System\xJQrJmg.exe
  C:\Windows\System\xJQrJmg.exe
  2⤵
  PID:3564
- C:\Windows\System\UkhNVNV.exe
  C:\Windows\System\UkhNVNV.exe
  2⤵
  PID:3580
- C:\Windows\System\cXztomT.exe
  C:\Windows\System\cXztomT.exe
  2⤵
  PID:3596
- C:\Windows\System\DREyOnz.exe
  C:\Windows\System\DREyOnz.exe
  2⤵
  PID:3612
- C:\Windows\System\EMjPFAE.exe
  C:\Windows\System\EMjPFAE.exe
  2⤵
  PID:3628
- C:\Windows\System\BcpepFp.exe
  C:\Windows\System\BcpepFp.exe
  2⤵
  PID:3644
- C:\Windows\System\USozRwH.exe
  C:\Windows\System\USozRwH.exe
  2⤵
  PID:3660
- C:\Windows\System\hyRAHXy.exe
  C:\Windows\System\hyRAHXy.exe
  2⤵
  PID:3676
- C:\Windows\System\jTsqHMv.exe
  C:\Windows\System\jTsqHMv.exe
  2⤵
  PID:3692
- C:\Windows\System\lioevZV.exe
  C:\Windows\System\lioevZV.exe
  2⤵
  PID:3708
- C:\Windows\System\feIkhSe.exe
  C:\Windows\System\feIkhSe.exe
  2⤵
  PID:3724
- C:\Windows\System\kEGDLFu.exe
  C:\Windows\System\kEGDLFu.exe
  2⤵
  PID:3740
- C:\Windows\System\PDhfBKg.exe
  C:\Windows\System\PDhfBKg.exe
  2⤵
  PID:3756
- C:\Windows\System\UgerCwb.exe
  C:\Windows\System\UgerCwb.exe
  2⤵
  PID:3772
- C:\Windows\System\YqSjeBZ.exe
  C:\Windows\System\YqSjeBZ.exe
  2⤵
  PID:3788
- C:\Windows\System\JwjozEw.exe
  C:\Windows\System\JwjozEw.exe
  2⤵
  PID:3804
- C:\Windows\System\ebFmBtJ.exe
  C:\Windows\System\ebFmBtJ.exe
  2⤵
  PID:3820
- C:\Windows\System\MCpInNm.exe
  C:\Windows\System\MCpInNm.exe
  2⤵
  PID:3836
- C:\Windows\System\fauBjmi.exe
  C:\Windows\System\fauBjmi.exe
  2⤵
  PID:3852
- C:\Windows\System\UJZrrfJ.exe
  C:\Windows\System\UJZrrfJ.exe
  2⤵
  PID:3868
- C:\Windows\System\taOOmmL.exe
  C:\Windows\System\taOOmmL.exe
  2⤵
  PID:3884
- C:\Windows\System\vdnCFbk.exe
  C:\Windows\System\vdnCFbk.exe
  2⤵
  PID:3900
- C:\Windows\System\AqSUgfF.exe
  C:\Windows\System\AqSUgfF.exe
  2⤵
  PID:3916
- C:\Windows\System\dmBUtIy.exe
  C:\Windows\System\dmBUtIy.exe
  2⤵
  PID:3932
- C:\Windows\System\sqadEWC.exe
  C:\Windows\System\sqadEWC.exe
  2⤵
  PID:3948
- C:\Windows\System\pJekGRQ.exe
  C:\Windows\System\pJekGRQ.exe
  2⤵
  PID:3964
- C:\Windows\System\yuBvhpG.exe
  C:\Windows\System\yuBvhpG.exe
  2⤵
  PID:3980
- C:\Windows\System\MfDFRsn.exe
  C:\Windows\System\MfDFRsn.exe
  2⤵
  PID:3996
- C:\Windows\System\DELyDBW.exe
  C:\Windows\System\DELyDBW.exe
  2⤵
  PID:4012
- C:\Windows\System\ytlkgie.exe
  C:\Windows\System\ytlkgie.exe
  2⤵
  PID:4028
- C:\Windows\System\EJHzKNg.exe
  C:\Windows\System\EJHzKNg.exe
  2⤵
  PID:4044
- C:\Windows\System\oWEgwyC.exe
  C:\Windows\System\oWEgwyC.exe
  2⤵
  PID:4060
- C:\Windows\System\QfmylAX.exe
  C:\Windows\System\QfmylAX.exe
  2⤵
  PID:4076
- C:\Windows\System\siHWszQ.exe
  C:\Windows\System\siHWszQ.exe
  2⤵
  PID:4092
- C:\Windows\System\jNIdcix.exe
  C:\Windows\System\jNIdcix.exe
  2⤵
  PID:1632
- C:\Windows\System\eAScsXn.exe
  C:\Windows\System\eAScsXn.exe
  2⤵
  PID:2788
- C:\Windows\System\sZdJByI.exe
  C:\Windows\System\sZdJByI.exe
  2⤵
  PID:1088
- C:\Windows\System\CmWdVer.exe
  C:\Windows\System\CmWdVer.exe
  2⤵
  PID:3008
- C:\Windows\System\cMsHhLJ.exe
  C:\Windows\System\cMsHhLJ.exe
  2⤵
  PID:3080
- C:\Windows\System\ThZfWlj.exe
  C:\Windows\System\ThZfWlj.exe
  2⤵
  PID:3140
- C:\Windows\System\VNOdfTf.exe
  C:\Windows\System\VNOdfTf.exe
  2⤵
  PID:3204
- C:\Windows\System\dAzyTMw.exe
  C:\Windows\System\dAzyTMw.exe
  2⤵
  PID:3268
- C:\Windows\System\ktIBfzx.exe
  C:\Windows\System\ktIBfzx.exe
  2⤵
  PID:3332
- C:\Windows\System\iYGgIXi.exe
  C:\Windows\System\iYGgIXi.exe
  2⤵
  PID:3396
- C:\Windows\System\ECTSbBQ.exe
  C:\Windows\System\ECTSbBQ.exe
  2⤵
  PID:3460
- C:\Windows\System\patwoRE.exe
  C:\Windows\System\patwoRE.exe
  2⤵
  PID:3492
- C:\Windows\System\OcFLpsp.exe
  C:\Windows\System\OcFLpsp.exe
  2⤵
  PID:3556
- C:\Windows\System\ZUvWWtk.exe
  C:\Windows\System\ZUvWWtk.exe
  2⤵
  PID:3624
- C:\Windows\System\XYBvNfa.exe
  C:\Windows\System\XYBvNfa.exe
  2⤵
  PID:3688
- C:\Windows\System\ixOQbzw.exe
  C:\Windows\System\ixOQbzw.exe
  2⤵
  PID:3752
- C:\Windows\System\naIYLWv.exe
  C:\Windows\System\naIYLWv.exe
  2⤵
  PID:2908
- C:\Windows\System\VryBZqc.exe
  C:\Windows\System\VryBZqc.exe
  2⤵
  PID:3816
- C:\Windows\System\TKmXphK.exe
  C:\Windows\System\TKmXphK.exe
  2⤵
  PID:2204
- C:\Windows\System\eMRimnw.exe
  C:\Windows\System\eMRimnw.exe
  2⤵
  PID:2232
- C:\Windows\System\cAGyejg.exe
  C:\Windows\System\cAGyejg.exe
  2⤵
  PID:764
- C:\Windows\System\sZYYaQi.exe
  C:\Windows\System\sZYYaQi.exe
  2⤵
  PID:2872
- C:\Windows\System\SEgumeL.exe
  C:\Windows\System\SEgumeL.exe
  2⤵
  PID:3056
- C:\Windows\System\NkdcgDo.exe
  C:\Windows\System\NkdcgDo.exe
  2⤵
  PID:3940
- C:\Windows\System\CkfGcav.exe
  C:\Windows\System\CkfGcav.exe
  2⤵
  PID:1532
- C:\Windows\System\MAasjfq.exe
  C:\Windows\System\MAasjfq.exe
  2⤵
  PID:1948
- C:\Windows\System\QQTStqV.exe
  C:\Windows\System\QQTStqV.exe
  2⤵
  PID:4004
- C:\Windows\System\xisjnnL.exe
  C:\Windows\System\xisjnnL.exe
  2⤵
  PID:4036
- C:\Windows\System\CYXzLvB.exe
  C:\Windows\System\CYXzLvB.exe
  2⤵
  PID:2356
- C:\Windows\System\RsFrIqn.exe
  C:\Windows\System\RsFrIqn.exe
  2⤵
  PID:3076
- C:\Windows\System\rRudKcz.exe
  C:\Windows\System\rRudKcz.exe
  2⤵
  PID:3300
- C:\Windows\System\muVlvfB.exe
  C:\Windows\System\muVlvfB.exe
  2⤵
  PID:3524
- C:\Windows\System\cDFOUGm.exe
  C:\Windows\System\cDFOUGm.exe
  2⤵
  PID:3784
- C:\Windows\System\LgPPwbi.exe
  C:\Windows\System\LgPPwbi.exe
  2⤵
  PID:2948
- C:\Windows\System\fddWbvY.exe
  C:\Windows\System\fddWbvY.exe
  2⤵
  PID:292
- C:\Windows\System\jZYZNgv.exe
  C:\Windows\System\jZYZNgv.exe
  2⤵
  PID:2804
- C:\Windows\System\jdkrsjQ.exe
  C:\Windows\System\jdkrsjQ.exe
  2⤵
  PID:4112
- C:\Windows\System\LaIICbW.exe
  C:\Windows\System\LaIICbW.exe
  2⤵
  PID:4128
- C:\Windows\System\oUCSdxG.exe
  C:\Windows\System\oUCSdxG.exe
  2⤵
  PID:4144
- C:\Windows\System\TaeYLLz.exe
  C:\Windows\System\TaeYLLz.exe
  2⤵
  PID:4160
- C:\Windows\System\CMqaPuQ.exe
  C:\Windows\System\CMqaPuQ.exe
  2⤵
  PID:4176
- C:\Windows\System\emRWodC.exe
  C:\Windows\System\emRWodC.exe
  2⤵
  PID:4192
- C:\Windows\System\vEPIGqc.exe
  C:\Windows\System\vEPIGqc.exe
  2⤵
  PID:4208
- C:\Windows\System\kdYhmQh.exe
  C:\Windows\System\kdYhmQh.exe
  2⤵
  PID:4224
- C:\Windows\System\LgBtHwB.exe
  C:\Windows\System\LgBtHwB.exe
  2⤵
  PID:4240
- C:\Windows\System\uUiuLIQ.exe
  C:\Windows\System\uUiuLIQ.exe
  2⤵
  PID:4256
- C:\Windows\System\evFJJie.exe
  C:\Windows\System\evFJJie.exe
  2⤵
  PID:4272
- C:\Windows\System\ZeZiInm.exe
  C:\Windows\System\ZeZiInm.exe
  2⤵
  PID:4288
- C:\Windows\System\psUpZHE.exe
  C:\Windows\System\psUpZHE.exe
  2⤵
  PID:4304
- C:\Windows\System\evbhHGM.exe
  C:\Windows\System\evbhHGM.exe
  2⤵
  PID:4320
- C:\Windows\System\YrzKgIr.exe
  C:\Windows\System\YrzKgIr.exe
  2⤵
  PID:4336
- C:\Windows\System\iKyqwMv.exe
  C:\Windows\System\iKyqwMv.exe
  2⤵
  PID:4352
- C:\Windows\System\NTphCmm.exe
  C:\Windows\System\NTphCmm.exe
  2⤵
  PID:4368
- C:\Windows\System\RkjnaRW.exe
  C:\Windows\System\RkjnaRW.exe
  2⤵
  PID:4384
- C:\Windows\System\LcAiBrB.exe
  C:\Windows\System\LcAiBrB.exe
  2⤵
  PID:4400
- C:\Windows\System\QWaATya.exe
  C:\Windows\System\QWaATya.exe
  2⤵
  PID:4416
- C:\Windows\System\yTlSvWH.exe
  C:\Windows\System\yTlSvWH.exe
  2⤵
  PID:4704
- C:\Windows\System\hQSTmcb.exe
  C:\Windows\System\hQSTmcb.exe
  2⤵
  PID:4720
- C:\Windows\System\yWStwJD.exe
  C:\Windows\System\yWStwJD.exe
  2⤵
  PID:4736
- C:\Windows\System\MuypTYz.exe
  C:\Windows\System\MuypTYz.exe
  2⤵
  PID:4752
- C:\Windows\System\ZgUSxLo.exe
  C:\Windows\System\ZgUSxLo.exe
  2⤵
  PID:4768
- C:\Windows\System\WnmjLKS.exe
  C:\Windows\System\WnmjLKS.exe
  2⤵
  PID:4784
- C:\Windows\System\vmHokfl.exe
  C:\Windows\System\vmHokfl.exe
  2⤵
  PID:4800
- C:\Windows\System\ApMzGTX.exe
  C:\Windows\System\ApMzGTX.exe
  2⤵
  PID:4816
- C:\Windows\System\YReSKXc.exe
  C:\Windows\System\YReSKXc.exe
  2⤵
  PID:4832
- C:\Windows\System\dJGClxk.exe
  C:\Windows\System\dJGClxk.exe
  2⤵
  PID:4848
- C:\Windows\System\jtQHoBP.exe
  C:\Windows\System\jtQHoBP.exe
  2⤵
  PID:4864
- C:\Windows\System\fFnrBUM.exe
  C:\Windows\System\fFnrBUM.exe
  2⤵
  PID:4880
- C:\Windows\System\ZBBILEE.exe
  C:\Windows\System\ZBBILEE.exe
  2⤵
  PID:4896
- C:\Windows\System\WMwYvlA.exe
  C:\Windows\System\WMwYvlA.exe
  2⤵
  PID:4912
- C:\Windows\System\obhLtWR.exe
  C:\Windows\System\obhLtWR.exe
  2⤵
  PID:4928
- C:\Windows\System\bPAwodj.exe
  C:\Windows\System\bPAwodj.exe
  2⤵
  PID:4944
- C:\Windows\System\OaAJUuu.exe
  C:\Windows\System\OaAJUuu.exe
  2⤵
  PID:4960
- C:\Windows\System\QKAGzLJ.exe
  C:\Windows\System\QKAGzLJ.exe
  2⤵
  PID:4976
- C:\Windows\System\lHEYbed.exe
  C:\Windows\System\lHEYbed.exe
  2⤵
  PID:4992
- C:\Windows\System\eUzrXqr.exe
  C:\Windows\System\eUzrXqr.exe
  2⤵
  PID:5008
- C:\Windows\System\munhwTS.exe
  C:\Windows\System\munhwTS.exe
  2⤵
  PID:5028
- C:\Windows\System\kPHPGJb.exe
  C:\Windows\System\kPHPGJb.exe
  2⤵
  PID:5044
- C:\Windows\System\TEshGZD.exe
  C:\Windows\System\TEshGZD.exe
  2⤵
  PID:5060
- C:\Windows\System\YSqUfPf.exe
  C:\Windows\System\YSqUfPf.exe
  2⤵
  PID:5076
- C:\Windows\System\WJloAcO.exe
  C:\Windows\System\WJloAcO.exe
  2⤵
  PID:5092
- C:\Windows\System\uVtJAgJ.exe
  C:\Windows\System\uVtJAgJ.exe
  2⤵
  PID:5108
- C:\Windows\System\wqJCLSt.exe
  C:\Windows\System\wqJCLSt.exe
  2⤵
  PID:840
- C:\Windows\System\xbeJwLF.exe
  C:\Windows\System\xbeJwLF.exe
  2⤵
  PID:1384
- C:\Windows\System\POqdPAz.exe
  C:\Windows\System\POqdPAz.exe
  2⤵
  PID:2836
- C:\Windows\System\IUKDFmO.exe
  C:\Windows\System\IUKDFmO.exe
  2⤵
  PID:1956
- C:\Windows\System\cnvlTtx.exe
  C:\Windows\System\cnvlTtx.exe
  2⤵
  PID:4136
- C:\Windows\System\vvkzHfp.exe
  C:\Windows\System\vvkzHfp.exe
  2⤵
  PID:4200
- C:\Windows\System\JHxwOZX.exe
  C:\Windows\System\JHxwOZX.exe
  2⤵
  PID:4264
- C:\Windows\System\mcExSAW.exe
  C:\Windows\System\mcExSAW.exe
  2⤵
  PID:4328
- C:\Windows\System\ZaKawzg.exe
  C:\Windows\System\ZaKawzg.exe
  2⤵
  PID:4392
- C:\Windows\System\DLNRQOS.exe
  C:\Windows\System\DLNRQOS.exe
  2⤵
  PID:4436
- C:\Windows\System\DyHuHZM.exe
  C:\Windows\System\DyHuHZM.exe
  2⤵
  PID:4452
- C:\Windows\System\reAUXxO.exe
  C:\Windows\System\reAUXxO.exe
  2⤵
  PID:4468
- C:\Windows\System\enlHDTJ.exe
  C:\Windows\System\enlHDTJ.exe
  2⤵
  PID:4484
- C:\Windows\System\VCboEBF.exe
  C:\Windows\System\VCboEBF.exe
  2⤵
  PID:4500
- C:\Windows\System\nfzjkDS.exe
  C:\Windows\System\nfzjkDS.exe
  2⤵
  PID:4516
- C:\Windows\System\wXzSsXt.exe
  C:\Windows\System\wXzSsXt.exe
  2⤵
  PID:4532
- C:\Windows\System\NvevLMF.exe
  C:\Windows\System\NvevLMF.exe
  2⤵
  PID:4548
- C:\Windows\System\CHvWlMX.exe
  C:\Windows\System\CHvWlMX.exe
  2⤵
  PID:4564
- C:\Windows\System\iOahSul.exe
  C:\Windows\System\iOahSul.exe
  2⤵
  PID:4580
- C:\Windows\System\zCilhMs.exe
  C:\Windows\System\zCilhMs.exe
  2⤵
  PID:4596
- C:\Windows\System\mvWFeOq.exe
  C:\Windows\System\mvWFeOq.exe
  2⤵
  PID:4612
- C:\Windows\System\lZuJhcG.exe
  C:\Windows\System\lZuJhcG.exe
  2⤵
  PID:4632
- C:\Windows\System\LTEQEgk.exe
  C:\Windows\System\LTEQEgk.exe
  2⤵
  PID:4648
- C:\Windows\System\ALiQAwV.exe
  C:\Windows\System\ALiQAwV.exe
  2⤵
  PID:4668
- C:\Windows\System\JOZLbNe.exe
  C:\Windows\System\JOZLbNe.exe
  2⤵
  PID:4684
- C:\Windows\System\GXuxLGV.exe
  C:\Windows\System\GXuxLGV.exe
  2⤵
  PID:4700
- C:\Windows\System\SpJvYjq.exe
  C:\Windows\System\SpJvYjq.exe
  2⤵
  PID:1688
- C:\Windows\System\wYjOvoR.exe
  C:\Windows\System\wYjOvoR.exe
  2⤵
  PID:4760
- C:\Windows\System\CGzQXon.exe
  C:\Windows\System\CGzQXon.exe
  2⤵
  PID:4828
- C:\Windows\System\JjWPkWu.exe
  C:\Windows\System\JjWPkWu.exe
  2⤵
  PID:4892
- C:\Windows\System\NTdiQaL.exe
  C:\Windows\System\NTdiQaL.exe
  2⤵
  PID:4956
- C:\Windows\System\lmfTKqq.exe
  C:\Windows\System\lmfTKqq.exe
  2⤵
  PID:5020
- C:\Windows\System\YlMnKkQ.exe
  C:\Windows\System\YlMnKkQ.exe
  2⤵
  PID:5084
- C:\Windows\System\ZbszTMD.exe
  C:\Windows\System\ZbszTMD.exe
  2⤵
  PID:996
- C:\Windows\System\riulCFX.exe
  C:\Windows\System\riulCFX.exe
  2⤵
  PID:4232
- C:\Windows\System\ioBwwsb.exe
  C:\Windows\System\ioBwwsb.exe
  2⤵
  PID:2900
- C:\Windows\System\PxnrAYJ.exe
  C:\Windows\System\PxnrAYJ.exe
  2⤵
  PID:2548
- C:\Windows\System\jokOzan.exe
  C:\Windows\System\jokOzan.exe
  2⤵
  PID:4480
- C:\Windows\System\AfRrioh.exe
  C:\Windows\System\AfRrioh.exe
  2⤵
  PID:4544
- C:\Windows\System\XDobSNr.exe
  C:\Windows\System\XDobSNr.exe
  2⤵
  PID:4608
- C:\Windows\System\odQdCLj.exe
  C:\Windows\System\odQdCLj.exe
  2⤵
  PID:4680
- C:\Windows\System\zCrImoO.exe
  C:\Windows\System\zCrImoO.exe
  2⤵
  PID:4796
- C:\Windows\System\yUHVTdr.exe
  C:\Windows\System\yUHVTdr.exe
  2⤵
  PID:5052
- C:\Windows\System\UXcWPYg.exe
  C:\Windows\System\UXcWPYg.exe
  2⤵
  PID:5132
- C:\Windows\System\CHteCJn.exe
  C:\Windows\System\CHteCJn.exe
  2⤵
  PID:5148
- C:\Windows\System\hCOomjV.exe
  C:\Windows\System\hCOomjV.exe
  2⤵
  PID:5180
- C:\Windows\System\EpAplOV.exe
  C:\Windows\System\EpAplOV.exe
  2⤵
  PID:5200
- C:\Windows\System\cwTTIfU.exe
  C:\Windows\System\cwTTIfU.exe
  2⤵
  PID:5216
- C:\Windows\System\sEaGYhy.exe
  C:\Windows\System\sEaGYhy.exe
  2⤵
  PID:5264
- C:\Windows\System\OlQeBoD.exe
  C:\Windows\System\OlQeBoD.exe
  2⤵
  PID:5424
- C:\Windows\System\fbTtUZP.exe
  C:\Windows\System\fbTtUZP.exe
  2⤵
  PID:5440
- C:\Windows\System\oNGdhcn.exe
  C:\Windows\System\oNGdhcn.exe
  2⤵
  PID:5456
- C:\Windows\System\AnmTVdS.exe
  C:\Windows\System\AnmTVdS.exe
  2⤵
  PID:5472
- C:\Windows\System\hMvVUXF.exe
  C:\Windows\System\hMvVUXF.exe
  2⤵
  PID:5500
- C:\Windows\System\njHKfTV.exe
  C:\Windows\System\njHKfTV.exe
  2⤵
  PID:5516
- C:\Windows\System\zOQcNmY.exe
  C:\Windows\System\zOQcNmY.exe
  2⤵
  PID:5532
- C:\Windows\System\UwObzmw.exe
  C:\Windows\System\UwObzmw.exe
  2⤵
  PID:5548
- C:\Windows\System\dhRPeJb.exe
  C:\Windows\System\dhRPeJb.exe
  2⤵
  PID:5568
- C:\Windows\System\WdyjOjp.exe
  C:\Windows\System\WdyjOjp.exe
  2⤵
  PID:5584
- C:\Windows\System\SpSUTLL.exe
  C:\Windows\System\SpSUTLL.exe
  2⤵
  PID:5600
- C:\Windows\System\TNgoZqM.exe
  C:\Windows\System\TNgoZqM.exe
  2⤵
  PID:5616
- C:\Windows\System\UNoSeLo.exe
  C:\Windows\System\UNoSeLo.exe
  2⤵
  PID:5664
- C:\Windows\System\sAGyZdz.exe
  C:\Windows\System\sAGyZdz.exe
  2⤵
  PID:5692
- C:\Windows\System\TatbuiB.exe
  C:\Windows\System\TatbuiB.exe
  2⤵
  PID:5708
- C:\Windows\System\IdopyVJ.exe
  C:\Windows\System\IdopyVJ.exe
  2⤵
  PID:5724
- C:\Windows\System\qLaIImx.exe
  C:\Windows\System\qLaIImx.exe
  2⤵
  PID:5740
- C:\Windows\System\bKgrOxS.exe
  C:\Windows\System\bKgrOxS.exe
  2⤵
  PID:5756
- C:\Windows\System\XbTgJaU.exe
  C:\Windows\System\XbTgJaU.exe
  2⤵
  PID:5772
- C:\Windows\System\FdQXlTe.exe
  C:\Windows\System\FdQXlTe.exe
  2⤵
  PID:5788
- C:\Windows\System\LJNgIbm.exe
  C:\Windows\System\LJNgIbm.exe
  2⤵
  PID:5812
- C:\Windows\System\vRybOOZ.exe
  C:\Windows\System\vRybOOZ.exe
  2⤵
  PID:5828
- C:\Windows\System\ceAKHVO.exe
  C:\Windows\System\ceAKHVO.exe
  2⤵
  PID:5844
- C:\Windows\System\ERMaQPs.exe
  C:\Windows\System\ERMaQPs.exe
  2⤵
  PID:5860
- C:\Windows\System\cYSstjJ.exe
  C:\Windows\System\cYSstjJ.exe
  2⤵
  PID:5876
- C:\Windows\System\kWtguvL.exe
  C:\Windows\System\kWtguvL.exe
  2⤵
  PID:5892
- C:\Windows\System\sNcuviv.exe
  C:\Windows\System\sNcuviv.exe
  2⤵
  PID:5912
- C:\Windows\System\SHWAGdL.exe
  C:\Windows\System\SHWAGdL.exe
  2⤵
  PID:5928
- C:\Windows\System\QdSjHHx.exe
  C:\Windows\System\QdSjHHx.exe
  2⤵
  PID:5944
- C:\Windows\System\MzdKFno.exe
  C:\Windows\System\MzdKFno.exe
  2⤵
  PID:5960
- C:\Windows\System\lvVtrTz.exe
  C:\Windows\System\lvVtrTz.exe
  2⤵
  PID:5976
- C:\Windows\System\WlyFjEf.exe
  C:\Windows\System\WlyFjEf.exe
  2⤵
  PID:5992
- C:\Windows\System\hkRERXZ.exe
  C:\Windows\System\hkRERXZ.exe
  2⤵
  PID:6008
- C:\Windows\System\GiVHGZa.exe
  C:\Windows\System\GiVHGZa.exe
  2⤵
  PID:6028
- C:\Windows\System\dGMruUg.exe
  C:\Windows\System\dGMruUg.exe
  2⤵
  PID:6044
- C:\Windows\System\MIALKHx.exe
  C:\Windows\System\MIALKHx.exe
  2⤵
  PID:6060
- C:\Windows\System\cVbqCik.exe
  C:\Windows\System\cVbqCik.exe
  2⤵
  PID:6076
- C:\Windows\System\AtFADIu.exe
  C:\Windows\System\AtFADIu.exe
  2⤵
  PID:6092
- C:\Windows\System\EGolPIU.exe
  C:\Windows\System\EGolPIU.exe
  2⤵
  PID:6108
- C:\Windows\System\GLGzRNi.exe
  C:\Windows\System\GLGzRNi.exe
  2⤵
  PID:6124
- C:\Windows\System\vcDJgDC.exe
  C:\Windows\System\vcDJgDC.exe
  2⤵
  PID:4104
- C:\Windows\System\nrDkGSh.exe
  C:\Windows\System\nrDkGSh.exe
  2⤵
  PID:3860
- C:\Windows\System\SZNugBQ.exe
  C:\Windows\System\SZNugBQ.exe
  2⤵
  PID:3992
- C:\Windows\System\LPWRzNA.exe
  C:\Windows\System\LPWRzNA.exe
  2⤵
  PID:3108
- C:\Windows\System\jTsbqIW.exe
  C:\Windows\System\jTsbqIW.exe
  2⤵
  PID:1280
- C:\Windows\System\EOxYvAg.exe
  C:\Windows\System\EOxYvAg.exe
  2⤵
  PID:1768
- C:\Windows\System\ocAbPfY.exe
  C:\Windows\System\ocAbPfY.exe
  2⤵
  PID:868
- C:\Windows\System\TjEpNSn.exe
  C:\Windows\System\TjEpNSn.exe
  2⤵
  PID:5580
- C:\Windows\System\CtCVzRl.exe
  C:\Windows\System\CtCVzRl.exe
  2⤵
  PID:5784
- C:\Windows\System\JbpRZQk.exe
  C:\Windows\System\JbpRZQk.exe
  2⤵
  PID:5856
- C:\Windows\System\DLCRWqi.exe
  C:\Windows\System\DLCRWqi.exe
  2⤵
  PID:5988
- C:\Windows\System\XIYnycU.exe
  C:\Windows\System\XIYnycU.exe
  2⤵
  PID:6052
- C:\Windows\System\vNoHePQ.exe
  C:\Windows\System\vNoHePQ.exe
  2⤵
  PID:2480
- C:\Windows\System\xIwFmEd.exe
  C:\Windows\System\xIwFmEd.exe
  2⤵
  PID:6084
- C:\Windows\System\ldWjYqf.exe
  C:\Windows\System\ldWjYqf.exe
  2⤵
  PID:4592
- C:\Windows\System\QfumcvT.exe
  C:\Windows\System\QfumcvT.exe
  2⤵
  PID:4664
- C:\Windows\System\GfPTJuj.exe
  C:\Windows\System\GfPTJuj.exe
  2⤵
  PID:2148
- C:\Windows\System\jbYKLDJ.exe
  C:\Windows\System\jbYKLDJ.exe
  2⤵
  PID:4184
- C:\Windows\System\szFXDvb.exe
  C:\Windows\System\szFXDvb.exe
  2⤵
  PID:4248
- C:\Windows\System\GKhOmwU.exe
  C:\Windows\System\GKhOmwU.exe
  2⤵
  PID:4312
- C:\Windows\System\PWGsYUW.exe
  C:\Windows\System\PWGsYUW.exe
  2⤵
  PID:4376
- C:\Windows\System\ilawRLH.exe
  C:\Windows\System\ilawRLH.exe
  2⤵
  PID:4712
- C:\Windows\System\geyvyao.exe
  C:\Windows\System\geyvyao.exe
  2⤵
  PID:4776
- C:\Windows\System\YYxbUQI.exe
  C:\Windows\System\YYxbUQI.exe
  2⤵
  PID:4840
- C:\Windows\System\DgPTqOU.exe
  C:\Windows\System\DgPTqOU.exe
  2⤵
  PID:2144
- C:\Windows\System\trMgoKx.exe
  C:\Windows\System\trMgoKx.exe
  2⤵
  PID:1608
- C:\Windows\System\oJgQMBD.exe
  C:\Windows\System\oJgQMBD.exe
  2⤵
  PID:1780
- C:\Windows\System\cydjYMP.exe
  C:\Windows\System\cydjYMP.exe
  2⤵
  PID:1972
- C:\Windows\System\UwrBiEi.exe
  C:\Windows\System\UwrBiEi.exe
  2⤵
  PID:4072
- C:\Windows\System\KLqkpuG.exe
  C:\Windows\System\KLqkpuG.exe
  2⤵
  PID:1852
- C:\Windows\System\vjBxBWj.exe
  C:\Windows\System\vjBxBWj.exe
  2⤵
  PID:4792
- C:\Windows\System\myHLjsk.exe
  C:\Windows\System\myHLjsk.exe
  2⤵
  PID:5172
- C:\Windows\System\vbukBzp.exe
  C:\Windows\System\vbukBzp.exe
  2⤵
  PID:5276
- C:\Windows\System\KTHPyeV.exe
  C:\Windows\System\KTHPyeV.exe
  2⤵
  PID:5292
- C:\Windows\System\zPWLgQF.exe
  C:\Windows\System\zPWLgQF.exe
  2⤵
  PID:5308
- C:\Windows\System\VdrtPoA.exe
  C:\Windows\System\VdrtPoA.exe
  2⤵
  PID:4644
- C:\Windows\System\IeDkXcq.exe
  C:\Windows\System\IeDkXcq.exe
  2⤵
  PID:5328
- C:\Windows\System\MrKoaTR.exe
  C:\Windows\System\MrKoaTR.exe
  2⤵
  PID:5344
- C:\Windows\System\VUwRnMJ.exe
  C:\Windows\System\VUwRnMJ.exe
  2⤵
  PID:5360
- C:\Windows\System\jhqGlTH.exe
  C:\Windows\System\jhqGlTH.exe
  2⤵
  PID:5376
- C:\Windows\System\vmGRAmO.exe
  C:\Windows\System\vmGRAmO.exe
  2⤵
  PID:5140
- C:\Windows\System\oEQItKk.exe
  C:\Windows\System\oEQItKk.exe
  2⤵
  PID:5224
- C:\Windows\System\NuQWCIg.exe
  C:\Windows\System\NuQWCIg.exe
  2⤵
  PID:5240
- C:\Windows\System\oNahzKq.exe
  C:\Windows\System\oNahzKq.exe
  2⤵
  PID:5256
- C:\Windows\System\TRolwgj.exe
  C:\Windows\System\TRolwgj.exe
  2⤵
  PID:1284
- C:\Windows\System\nwrIyyn.exe
  C:\Windows\System\nwrIyyn.exe
  2⤵
  PID:5400
- C:\Windows\System\fiOdvaS.exe
  C:\Windows\System\fiOdvaS.exe
  2⤵
  PID:5416
- C:\Windows\System\BPeIZoq.exe
  C:\Windows\System\BPeIZoq.exe
  2⤵
  PID:2528
- C:\Windows\System\QcOZnyj.exe
  C:\Windows\System\QcOZnyj.exe
  2⤵
  PID:6068
- C:\Windows\System\OEURoFO.exe
  C:\Windows\System\OEURoFO.exe
  2⤵
  PID:5704
- C:\Windows\System\HDbagwF.exe
  C:\Windows\System\HDbagwF.exe
  2⤵
  PID:5652
- C:\Windows\System\nlpYrwo.exe
  C:\Windows\System\nlpYrwo.exe
  2⤵
  PID:5636
- C:\Windows\System\ARngFFs.exe
  C:\Windows\System\ARngFFs.exe
  2⤵
  PID:5596
- C:\Windows\System\IPmeLZj.exe
  C:\Windows\System\IPmeLZj.exe
  2⤵
  PID:5528
- C:\Windows\System\DFZaofQ.exe
  C:\Windows\System\DFZaofQ.exe
  2⤵
  PID:5492
- C:\Windows\System\JWKEfqb.exe
  C:\Windows\System\JWKEfqb.exe
  2⤵
  PID:2216
- C:\Windows\System\eGvruAc.exe
  C:\Windows\System\eGvruAc.exe
  2⤵
  PID:4448
- C:\Windows\System\rvKYpoa.exe
  C:\Windows\System\rvKYpoa.exe
  2⤵
  PID:5764
- C:\Windows\System\zWWmDuF.exe
  C:\Windows\System\zWWmDuF.exe
  2⤵
  PID:5836
- C:\Windows\System\mEgAsUL.exe
  C:\Windows\System\mEgAsUL.exe
  2⤵
  PID:5900
- C:\Windows\System\boeSujR.exe
  C:\Windows\System\boeSujR.exe
  2⤵
  PID:5968
- C:\Windows\System\PEKpOGZ.exe
  C:\Windows\System\PEKpOGZ.exe
  2⤵
  PID:6036
- C:\Windows\System\AyVqFMm.exe
  C:\Windows\System\AyVqFMm.exe
  2⤵
  PID:2680
- C:\Windows\System\VcLgYcP.exe
  C:\Windows\System\VcLgYcP.exe
  2⤵
  PID:4460
- C:\Windows\System\OasayGd.exe
  C:\Windows\System\OasayGd.exe
  2⤵
  PID:2824
- C:\Windows\System\EEDQkGl.exe
  C:\Windows\System\EEDQkGl.exe
  2⤵
  PID:2944
- C:\Windows\System\KleAekJ.exe
  C:\Windows\System\KleAekJ.exe
  2⤵
  PID:1708
- C:\Windows\System\UxzyCng.exe
  C:\Windows\System\UxzyCng.exe
  2⤵
  PID:3896
- C:\Windows\System\ZhdGmOV.exe
  C:\Windows\System\ZhdGmOV.exe
  2⤵
  PID:5432
- C:\Windows\System\FNVrPnH.exe
  C:\Windows\System\FNVrPnH.exe
  2⤵
  PID:4052
- C:\Windows\System\NwXuLHi.exe
  C:\Windows\System\NwXuLHi.exe
  2⤵
  PID:5680
- C:\Windows\System\xIoUVDg.exe
  C:\Windows\System\xIoUVDg.exe
  2⤵
  PID:2292
- C:\Windows\System\ROwxrVJ.exe
  C:\Windows\System\ROwxrVJ.exe
  2⤵
  PID:3368
- C:\Windows\System\kmBUSPY.exe
  C:\Windows\System\kmBUSPY.exe
  2⤵
  PID:3588
- C:\Windows\System\immTBxa.exe
  C:\Windows\System\immTBxa.exe
  2⤵
  PID:6136
- C:\Windows\System\sdbGnNW.exe
  C:\Windows\System\sdbGnNW.exe
  2⤵
  PID:1484
- C:\Windows\System\vwJTbrc.exe
  C:\Windows\System\vwJTbrc.exe
  2⤵
  PID:3048
- C:\Windows\System\ZlvsKHz.exe
  C:\Windows\System\ZlvsKHz.exe
  2⤵
  PID:5464
- C:\Windows\System\MkLfijX.exe
  C:\Windows\System\MkLfijX.exe
  2⤵
  PID:5508
- C:\Windows\System\HigwLJy.exe
  C:\Windows\System\HigwLJy.exe
  2⤵
  PID:5852
- C:\Windows\System\vMHIZOp.exe
  C:\Windows\System\vMHIZOp.exe
  2⤵
  PID:4008
- C:\Windows\System\xQabSWQ.exe
  C:\Windows\System\xQabSWQ.exe
  2⤵
  PID:5752
- C:\Windows\System\WcahUNk.exe
  C:\Windows\System\WcahUNk.exe
  2⤵
  PID:5956
- C:\Windows\System\nkqudDS.exe
  C:\Windows\System\nkqudDS.exe
  2⤵
  PID:532
- C:\Windows\System\xXIneIn.exe
  C:\Windows\System\xXIneIn.exe
  2⤵
  PID:6020
- C:\Windows\System\stXgJSc.exe
  C:\Windows\System\stXgJSc.exe
  2⤵
  PID:6116
- C:\Windows\System\QxmKjwk.exe
  C:\Windows\System\QxmKjwk.exe
  2⤵
  PID:3020
- C:\Windows\System\vYfoRhj.exe
  C:\Windows\System\vYfoRhj.exe
  2⤵
  PID:3988
- C:\Windows\System\gEHpvua.exe
  C:\Windows\System\gEHpvua.exe
  2⤵
  PID:3224
- C:\Windows\System\QKpeqfP.exe
  C:\Windows\System\QKpeqfP.exe
  2⤵
  PID:3284
- C:\Windows\System\TVGfrsB.exe
  C:\Windows\System\TVGfrsB.exe
  2⤵
  PID:2540
- C:\Windows\System\BqpdtHL.exe
  C:\Windows\System\BqpdtHL.exe
  2⤵
  PID:2692
- C:\Windows\System\cxNkryQ.exe
  C:\Windows\System\cxNkryQ.exe
  2⤵
  PID:3444
- C:\Windows\System\lklEBDo.exe
  C:\Windows\System\lklEBDo.exe
  2⤵
  PID:3480
- C:\Windows\System\nbwEUeB.exe
  C:\Windows\System\nbwEUeB.exe
  2⤵
  PID:3544
- C:\Windows\System\jDQYdXG.exe
  C:\Windows\System\jDQYdXG.exe
  2⤵
  PID:2484
- C:\Windows\System\YJzaybR.exe
  C:\Windows\System\YJzaybR.exe
  2⤵
  PID:4280
- C:\Windows\System\EyCTgNQ.exe
  C:\Windows\System\EyCTgNQ.exe
  2⤵
  PID:1836
- C:\Windows\System\auYImmE.exe
  C:\Windows\System\auYImmE.exe
  2⤵
  PID:4220
- C:\Windows\System\GbKlEec.exe
  C:\Windows\System\GbKlEec.exe
  2⤵
  PID:4748
- C:\Windows\System\wppprMT.exe
  C:\Windows\System\wppprMT.exe
  2⤵
  PID:4908
- C:\Windows\System\jeisNUc.exe
  C:\Windows\System\jeisNUc.exe
  2⤵
  PID:4972
- C:\Windows\System\UJPSTnM.exe
  C:\Windows\System\UJPSTnM.exe
  2⤵
  PID:5040
- C:\Windows\System\MRMwtuS.exe
  C:\Windows\System\MRMwtuS.exe
  2⤵
  PID:5104
- C:\Windows\System\uSJvgZA.exe
  C:\Windows\System\uSJvgZA.exe
  2⤵
  PID:1848
- C:\Windows\System\hAJgJru.exe
  C:\Windows\System\hAJgJru.exe
  2⤵
  PID:2800
- C:\Windows\System\JSRNokt.exe
  C:\Windows\System\JSRNokt.exe
  2⤵
  PID:2584
- C:\Windows\System\rzVljJb.exe
  C:\Windows\System\rzVljJb.exe
  2⤵
  PID:4300
- C:\Windows\System\AzQlHZb.exe
  C:\Windows\System\AzQlHZb.exe
  2⤵
  PID:2960
- C:\Windows\System\GbIxuQA.exe
  C:\Windows\System\GbIxuQA.exe
  2⤵
  PID:5272
- C:\Windows\System\OhFMFbl.exe
  C:\Windows\System\OhFMFbl.exe
  2⤵
  PID:5324
- C:\Windows\System\yWMOnTh.exe
  C:\Windows\System\yWMOnTh.exe
  2⤵
  PID:4952
- C:\Windows\System\PdGadDZ.exe
  C:\Windows\System\PdGadDZ.exe
  2⤵
  PID:2164
- C:\Windows\System\MgtlEkQ.exe
  C:\Windows\System\MgtlEkQ.exe
  2⤵
  PID:3384
- C:\Windows\System\JGWWZZB.exe
  C:\Windows\System\JGWWZZB.exe
  2⤵
  PID:5408
- C:\Windows\System\wGxXYXN.exe
  C:\Windows\System\wGxXYXN.exe
  2⤵
  PID:1556
- C:\Windows\System\NcGJmAT.exe
  C:\Windows\System\NcGJmAT.exe
  2⤵
  PID:5628
- C:\Windows\System\aPLDuFE.exe
  C:\Windows\System\aPLDuFE.exe
  2⤵
  PID:888
- C:\Windows\System\mtSrUsW.exe
  C:\Windows\System\mtSrUsW.exe
  2⤵
  PID:5164
- C:\Windows\System\nAisMeR.exe
  C:\Windows\System\nAisMeR.exe
  2⤵
  PID:5288
- C:\Windows\System\JDszcAF.exe
  C:\Windows\System\JDszcAF.exe
  2⤵
  PID:5564
- C:\Windows\System\YnBIWri.exe
  C:\Windows\System\YnBIWri.exe
  2⤵
  PID:892
- C:\Windows\System\DCDfISP.exe
  C:\Windows\System\DCDfISP.exe
  2⤵
  PID:5940
- C:\Windows\System\ahFUFVa.exe
  C:\Windows\System\ahFUFVa.exe
  2⤵
  PID:1940
- C:\Windows\System\PInwAVq.exe
  C:\Windows\System\PInwAVq.exe
  2⤵
  PID:4024
- C:\Windows\System\knHaSim.exe
  C:\Windows\System\knHaSim.exe
  2⤵
  PID:3364
- C:\Windows\System\wVyVVYY.exe
  C:\Windows\System\wVyVVYY.exe
  2⤵
  PID:4512
- C:\Windows\System\nKUqcpO.exe
  C:\Windows\System\nKUqcpO.exe
  2⤵
  PID:3844
- C:\Windows\System\JcJJFWR.exe
  C:\Windows\System\JcJJFWR.exe
  2⤵
  PID:5252
- C:\Windows\System\peRbsBo.exe
  C:\Windows\System\peRbsBo.exe
  2⤵
  PID:5800
- C:\Windows\System\EiuPcqj.exe
  C:\Windows\System\EiuPcqj.exe
  2⤵
  PID:5452
- C:\Windows\System\TCtKoNY.exe
  C:\Windows\System\TCtKoNY.exe
  2⤵
  PID:2740
- C:\Windows\System\ENnhiZo.exe
  C:\Windows\System\ENnhiZo.exe
  2⤵
  PID:3016
- C:\Windows\System\JVpXrpg.exe
  C:\Windows\System\JVpXrpg.exe
  2⤵
  PID:2840
- C:\Windows\System\uusdCDj.exe
  C:\Windows\System\uusdCDj.exe
  2⤵
  PID:5684
- C:\Windows\System\iSEJhdi.exe
  C:\Windows\System\iSEJhdi.exe
  2⤵
  PID:3012
- C:\Windows\System\okxJYWq.exe
  C:\Windows\System\okxJYWq.exe
  2⤵
  PID:3188
- C:\Windows\System\fHrNeiH.exe
  C:\Windows\System\fHrNeiH.exe
  2⤵
  PID:3128
- C:\Windows\System\kRvbhCE.exe
  C:\Windows\System\kRvbhCE.exe
  2⤵
  PID:1604
- C:\Windows\System\WUskHfw.exe
  C:\Windows\System\WUskHfw.exe
  2⤵
  PID:6000
- C:\Windows\System\lewTPEM.exe
  C:\Windows\System\lewTPEM.exe
  2⤵
  PID:5732
- C:\Windows\System\LaNkLse.exe
  C:\Windows\System\LaNkLse.exe
  2⤵
  PID:2440
- C:\Windows\System\cJJRNwS.exe
  C:\Windows\System\cJJRNwS.exe
  2⤵
  PID:1736
- C:\Windows\System\FgGfvWO.exe
  C:\Windows\System\FgGfvWO.exe
  2⤵
  PID:3928
- C:\Windows\System\TNumiIt.exe
  C:\Windows\System\TNumiIt.exe
  2⤵
  PID:3464
- C:\Windows\System\kIOzAkC.exe
  C:\Windows\System\kIOzAkC.exe
  2⤵
  PID:5720
- C:\Windows\System\IVOUiJf.exe
  C:\Windows\System\IVOUiJf.exe
  2⤵
  PID:5780
- C:\Windows\System\svpcThH.exe
  C:\Windows\System\svpcThH.exe
  2⤵
  PID:3416
- C:\Windows\System\sDoRapA.exe
  C:\Windows\System\sDoRapA.exe
  2⤵
  PID:3316
- C:\Windows\System\LJjiyfq.exe
  C:\Windows\System\LJjiyfq.exe
  2⤵
  PID:1276
- C:\Windows\System\ZCQxzSj.exe
  C:\Windows\System\ZCQxzSj.exe
  2⤵
  PID:2296
- C:\Windows\System\wYEfOcf.exe
  C:\Windows\System\wYEfOcf.exe
  2⤵
  PID:4660
- C:\Windows\System\eMeYNxK.exe
  C:\Windows\System\eMeYNxK.exe
  2⤵
  PID:2956
- C:\Windows\System\jDBIuQx.exe
  C:\Windows\System\jDBIuQx.exe
  2⤵
  PID:3576
- C:\Windows\System\sBnArtU.exe
  C:\Windows\System\sBnArtU.exe
  2⤵
  PID:748
- C:\Windows\System\PhzHuSX.exe
  C:\Windows\System\PhzHuSX.exe
  2⤵
  PID:3736
- C:\Windows\System\cJYqngZ.exe
  C:\Windows\System\cJYqngZ.exe
  2⤵
  PID:3768
- C:\Windows\System\VJjQJug.exe
  C:\Windows\System\VJjQJug.exe
  2⤵
  PID:2812
- C:\Windows\System\chYnRHP.exe
  C:\Windows\System\chYnRHP.exe
  2⤵
  PID:2612
- C:\Windows\System\iVcnKlS.exe
  C:\Windows\System\iVcnKlS.exe
  2⤵
  PID:2020
- C:\Windows\System\MfjBDMe.exe
  C:\Windows\System\MfjBDMe.exe
  2⤵
  PID:4216
- C:\Windows\System\RIqdudT.exe
  C:\Windows\System\RIqdudT.exe
  2⤵
  PID:5036
- C:\Windows\System\MpHhFrt.exe
  C:\Windows\System\MpHhFrt.exe
  2⤵
  PID:3976
- C:\Windows\System\lXgcHss.exe
  C:\Windows\System\lXgcHss.exe
  2⤵
  PID:5100
- C:\Windows\System\ROsBGVY.exe
  C:\Windows\System\ROsBGVY.exe
  2⤵
  PID:4940
- C:\Windows\System\QhGpXCt.exe
  C:\Windows\System\QhGpXCt.exe
  2⤵
  PID:3912
- C:\Windows\System\PAlqFtv.exe
  C:\Windows\System\PAlqFtv.exe
  2⤵
  PID:3972
- C:\Windows\System\IFBTizL.exe
  C:\Windows\System\IFBTizL.exe
  2⤵
  PID:4556
- C:\Windows\System\XOkqSSk.exe
  C:\Windows\System\XOkqSSk.exe
  2⤵
  PID:4524
- C:\Windows\System\PODXJUA.exe
  C:\Windows\System\PODXJUA.exe
  2⤵
  PID:4860
- C:\Windows\System\MlBpWbE.exe
  C:\Windows\System\MlBpWbE.exe
  2⤵
  PID:5116
- C:\Windows\System\HXPRylT.exe
  C:\Windows\System\HXPRylT.exe
  2⤵
  PID:5356
- C:\Windows\System\JfGocab.exe
  C:\Windows\System\JfGocab.exe
  2⤵
  PID:5496
- C:\Windows\System\fGAsQLm.exe
  C:\Windows\System\fGAsQLm.exe
  2⤵
  PID:1296
- C:\Windows\System\ytWeSII.exe
  C:\Windows\System\ytWeSII.exe
  2⤵
  PID:4604
- C:\Windows\System\ZBFGNpm.exe
  C:\Windows\System\ZBFGNpm.exe
  2⤵
  PID:5236
- C:\Windows\System\kuBxgCW.exe
  C:\Windows\System\kuBxgCW.exe
  2⤵
  PID:5660
- C:\Windows\System\AHURDey.exe
  C:\Windows\System\AHURDey.exe
  2⤵
  PID:5656
- C:\Windows\System\awsUjIm.exe
  C:\Windows\System\awsUjIm.exe
  2⤵
  PID:5340
- C:\Windows\System\ZAKROqS.exe
  C:\Windows\System\ZAKROqS.exe
  2⤵
  PID:2828
- C:\Windows\System\Wtahtmq.exe
  C:\Windows\System\Wtahtmq.exe
  2⤵
  PID:5644
- C:\Windows\System\LfrxpQf.exe
  C:\Windows\System\LfrxpQf.exe
  2⤵
  PID:1656
- C:\Windows\System\pAVvbMj.exe
  C:\Windows\System\pAVvbMj.exe
  2⤵
  PID:5188
- C:\Windows\System\niSxqcx.exe
  C:\Windows\System\niSxqcx.exe
  2⤵
  PID:1808
- C:\Windows\System\XdRlOxs.exe
  C:\Windows\System\XdRlOxs.exe
  2⤵
  PID:3092
- C:\Windows\System\WNNfGKN.exe
  C:\Windows\System\WNNfGKN.exe
  2⤵
  PID:4360
- C:\Windows\System\eTYQGUc.exe
  C:\Windows\System\eTYQGUc.exe
  2⤵
  PID:5612
- C:\Windows\System\iNsfcOP.exe
  C:\Windows\System\iNsfcOP.exe
  2⤵
  PID:3060
- C:\Windows\System\UrputfP.exe
  C:\Windows\System\UrputfP.exe
  2⤵
  PID:2892
- C:\Windows\System\UmzZOEl.exe
  C:\Windows\System\UmzZOEl.exe
  2⤵
  PID:3732
- C:\Windows\System\BiqMYdG.exe
  C:\Windows\System\BiqMYdG.exe
  2⤵
  PID:2952
- C:\Windows\System\skIxQQy.exe
  C:\Windows\System\skIxQQy.exe
  2⤵
  PID:3064
- C:\Windows\System\ZmlxsxD.exe
  C:\Windows\System\ZmlxsxD.exe
  2⤵
  PID:560
- C:\Windows\System\UbkxWpO.exe
  C:\Windows\System\UbkxWpO.exe
  2⤵
  PID:4988
- C:\Windows\System\KHCKLhi.exe
  C:\Windows\System\KHCKLhi.exe
  2⤵
  PID:5480
- C:\Windows\System\NeJJpHc.exe
  C:\Windows\System\NeJJpHc.exe
  2⤵
  PID:3240
- C:\Windows\System\TsDmYkW.exe
  C:\Windows\System\TsDmYkW.exe
  2⤵
  PID:3684
- C:\Windows\System\EEAZBpG.exe
  C:\Windows\System\EEAZBpG.exe
  2⤵
  PID:2808
- C:\Windows\System\veiXXEw.exe
  C:\Windows\System\veiXXEw.exe
  2⤵
  PID:4904
- C:\Windows\System\xQUyWVK.exe
  C:\Windows\System\xQUyWVK.exe
  2⤵
  PID:5212
- C:\Windows\System\ByanxSh.exe
  C:\Windows\System\ByanxSh.exe
  2⤵
  PID:1228
- C:\Windows\System\nKKuxJb.exe
  C:\Windows\System\nKKuxJb.exe
  2⤵
  PID:1684
- C:\Windows\System\EdHslOk.exe
  C:\Windows\System\EdHslOk.exe
  2⤵
  PID:4168
- C:\Windows\System\IhqNpYi.exe
  C:\Windows\System\IhqNpYi.exe
  2⤵
  PID:5208
- C:\Windows\System\etZaFZY.exe
  C:\Windows\System\etZaFZY.exe
  2⤵
  PID:5560
- C:\Windows\System\gnrCpjU.exe
  C:\Windows\System\gnrCpjU.exe
  2⤵
  PID:5952
- C:\Windows\System\YZhaYKc.exe
  C:\Windows\System\YZhaYKc.exe
  2⤵
  PID:6120
- C:\Windows\System\VTffvQw.exe
  C:\Windows\System\VTffvQw.exe
  2⤵
  PID:6104
- C:\Windows\System\KGtlPRu.exe
  C:\Windows\System\KGtlPRu.exe
  2⤵
  PID:808
- C:\Windows\System\PZjaoHn.exe
  C:\Windows\System\PZjaoHn.exe
  2⤵
  PID:3476
- C:\Windows\System\EVOIgjP.exe
  C:\Windows\System\EVOIgjP.exe
  2⤵
  PID:2560
- C:\Windows\System\udhWfkH.exe
  C:\Windows\System\udhWfkH.exe
  2⤵
  PID:5736
- C:\Windows\System\kVJvQtE.exe
  C:\Windows\System\kVJvQtE.exe
  2⤵
  PID:1032
- C:\Windows\System\axMtnfp.exe
  C:\Windows\System\axMtnfp.exe
  2⤵
  PID:4348
- C:\Windows\System\XeAKtpa.exe
  C:\Windows\System\XeAKtpa.exe
  2⤵
  PID:2752
- C:\Windows\System\QAGbktS.exe
  C:\Windows\System\QAGbktS.exe
  2⤵
  PID:6140
- C:\Windows\System\IEtvMBf.exe
  C:\Windows\System\IEtvMBf.exe
  2⤵
  PID:5072
- C:\Windows\System\gqtledK.exe
  C:\Windows\System\gqtledK.exe
  2⤵
  PID:4496
- C:\Windows\System\oeIqPQt.exe
  C:\Windows\System\oeIqPQt.exe
  2⤵
  PID:3352
- C:\Windows\System\xBrgIZn.exe
  C:\Windows\System\xBrgIZn.exe
  2⤵
  PID:2896
- C:\Windows\System\BzZMheR.exe
  C:\Windows\System\BzZMheR.exe
  2⤵
  PID:5804
- C:\Windows\System\BLBqKkB.exe
  C:\Windows\System\BLBqKkB.exe
  2⤵
  PID:1080
- C:\Windows\System\lpamVDh.exe
  C:\Windows\System\lpamVDh.exe
  2⤵
  PID:2936
- C:\Windows\System\InQDNhz.exe
  C:\Windows\System\InQDNhz.exe
  2⤵
  PID:6004
- C:\Windows\System\CVXZIwp.exe
  C:\Windows\System\CVXZIwp.exe
  2⤵
  PID:6152
- C:\Windows\System\MYsfGYi.exe
  C:\Windows\System\MYsfGYi.exe
  2⤵
  PID:6168
- C:\Windows\System\lvZXQdj.exe
  C:\Windows\System\lvZXQdj.exe
  2⤵
  PID:6184
- C:\Windows\System\kZbvtmw.exe
  C:\Windows\System\kZbvtmw.exe
  2⤵
  PID:6204
- C:\Windows\System\vWsEDFw.exe
  C:\Windows\System\vWsEDFw.exe
  2⤵
  PID:6220
- C:\Windows\System\kNBfXXQ.exe
  C:\Windows\System\kNBfXXQ.exe
  2⤵
  PID:6236
- C:\Windows\System\WqMCpAO.exe
  C:\Windows\System\WqMCpAO.exe
  2⤵
  PID:6252
- C:\Windows\System\eRzHPfK.exe
  C:\Windows\System\eRzHPfK.exe
  2⤵
  PID:6276
- C:\Windows\System\rZPezAG.exe
  C:\Windows\System\rZPezAG.exe
  2⤵
  PID:6316
- C:\Windows\System\NroWvSR.exe
  C:\Windows\System\NroWvSR.exe
  2⤵
  PID:6332
- C:\Windows\System\GdYbIQE.exe
  C:\Windows\System\GdYbIQE.exe
  2⤵
  PID:6356
- C:\Windows\System\rlKMnAm.exe
  C:\Windows\System\rlKMnAm.exe
  2⤵
  PID:6372
- C:\Windows\System\DmVjsvX.exe
  C:\Windows\System\DmVjsvX.exe
  2⤵
  PID:6388
- C:\Windows\System\DJwkiBW.exe
  C:\Windows\System\DJwkiBW.exe
  2⤵
  PID:6404
- C:\Windows\System\yMNWCBa.exe
  C:\Windows\System\yMNWCBa.exe
  2⤵
  PID:6424
- C:\Windows\System\msCXzIN.exe
  C:\Windows\System\msCXzIN.exe
  2⤵
  PID:6440
- C:\Windows\System\IMoQwQI.exe
  C:\Windows\System\IMoQwQI.exe
  2⤵
  PID:6456
- C:\Windows\System\fPIAxxL.exe
  C:\Windows\System\fPIAxxL.exe
  2⤵
  PID:6472
- C:\Windows\System\BHuWVah.exe
  C:\Windows\System\BHuWVah.exe
  2⤵
  PID:6488
- C:\Windows\System\rpmrEpW.exe
  C:\Windows\System\rpmrEpW.exe
  2⤵
  PID:6504
- C:\Windows\System\AEQHHZc.exe
  C:\Windows\System\AEQHHZc.exe
  2⤵
  PID:6520
- C:\Windows\System\nAEJUEr.exe
  C:\Windows\System\nAEJUEr.exe
  2⤵
  PID:6540
- C:\Windows\System\ZZlOYBc.exe
  C:\Windows\System\ZZlOYBc.exe
  2⤵
  PID:6556
- C:\Windows\System\GwRXlQq.exe
  C:\Windows\System\GwRXlQq.exe
  2⤵
  PID:6572
- C:\Windows\System\EvyTVso.exe
  C:\Windows\System\EvyTVso.exe
  2⤵
  PID:6588
- C:\Windows\System\AFzZByI.exe
  C:\Windows\System\AFzZByI.exe
  2⤵
  PID:6604
- C:\Windows\System\rXdnlYe.exe
  C:\Windows\System\rXdnlYe.exe
  2⤵
  PID:6620
- C:\Windows\System\OqUKGrB.exe
  C:\Windows\System\OqUKGrB.exe
  2⤵
  PID:6636
- C:\Windows\System\xIxPkFU.exe
  C:\Windows\System\xIxPkFU.exe
  2⤵
  PID:6656
- C:\Windows\System\PiOmHdV.exe
  C:\Windows\System\PiOmHdV.exe
  2⤵
  PID:6672
- C:\Windows\System\nuGpJpP.exe
  C:\Windows\System\nuGpJpP.exe
  2⤵
  PID:6688
- C:\Windows\System\nuQRxVs.exe
  C:\Windows\System\nuQRxVs.exe
  2⤵
  PID:6704
- C:\Windows\System\BMNGweb.exe
  C:\Windows\System\BMNGweb.exe
  2⤵
  PID:6720
- C:\Windows\System\vyUDwQN.exe
  C:\Windows\System\vyUDwQN.exe
  2⤵
  PID:6736
- C:\Windows\System\dHCfHLk.exe
  C:\Windows\System\dHCfHLk.exe
  2⤵
  PID:6756
- C:\Windows\System\lbPzwJj.exe
  C:\Windows\System\lbPzwJj.exe
  2⤵
  PID:6772
- C:\Windows\System\jwEPAis.exe
  C:\Windows\System\jwEPAis.exe
  2⤵
  PID:6792
- C:\Windows\System\FEjXHOF.exe
  C:\Windows\System\FEjXHOF.exe
  2⤵
  PID:6808
- C:\Windows\System\lkmIHQR.exe
  C:\Windows\System\lkmIHQR.exe
  2⤵
  PID:6840
- C:\Windows\System\zPiJoIj.exe
  C:\Windows\System\zPiJoIj.exe
  2⤵
  PID:6868
- C:\Windows\System\QwPCMwu.exe
  C:\Windows\System\QwPCMwu.exe
  2⤵
  PID:6884
- C:\Windows\System\YYzKiJe.exe
  C:\Windows\System\YYzKiJe.exe
  2⤵
  PID:6908
- C:\Windows\System\rFGSGcN.exe
  C:\Windows\System\rFGSGcN.exe
  2⤵
  PID:6924
- C:\Windows\System\qIClBhn.exe
  C:\Windows\System\qIClBhn.exe
  2⤵
  PID:6940
- C:\Windows\System\VKbnyez.exe
  C:\Windows\System\VKbnyez.exe
  2⤵
  PID:6956
- C:\Windows\System\DtdAzTi.exe
  C:\Windows\System\DtdAzTi.exe
  2⤵
  PID:6972
- C:\Windows\System\RrWnFba.exe
  C:\Windows\System\RrWnFba.exe
  2⤵
  PID:6988
- C:\Windows\System\geTZEJn.exe
  C:\Windows\System\geTZEJn.exe
  2⤵
  PID:7004
- C:\Windows\System\DngFFvF.exe
  C:\Windows\System\DngFFvF.exe
  2⤵
  PID:7020
- C:\Windows\System\PNSVrSM.exe
  C:\Windows\System\PNSVrSM.exe
  2⤵
  PID:7036
- C:\Windows\System\ymqJezR.exe
  C:\Windows\System\ymqJezR.exe
  2⤵
  PID:7052
- C:\Windows\System\hdYfqwf.exe
  C:\Windows\System\hdYfqwf.exe
  2⤵
  PID:7068
- C:\Windows\System\cJXDKOh.exe
  C:\Windows\System\cJXDKOh.exe
  2⤵
  PID:7084
- C:\Windows\System\DybVtMa.exe
  C:\Windows\System\DybVtMa.exe
  2⤵
  PID:7100
- C:\Windows\System\hURLpcY.exe
  C:\Windows\System\hURLpcY.exe
  2⤵
  PID:7116
- C:\Windows\System\GgrIXAh.exe
  C:\Windows\System\GgrIXAh.exe
  2⤵
  PID:7132
- C:\Windows\System\IEgFnTK.exe
  C:\Windows\System\IEgFnTK.exe
  2⤵
  PID:7148
- C:\Windows\System\gfEpsTP.exe
  C:\Windows\System\gfEpsTP.exe
  2⤵
  PID:7164
- C:\Windows\System\DjEOElY.exe
  C:\Windows\System\DjEOElY.exe
  2⤵
  PID:5936
- C:\Windows\System\UMkAaUW.exe
  C:\Windows\System\UMkAaUW.exe
  2⤵
  PID:3640
- C:\Windows\System\jzQgCIS.exe
  C:\Windows\System\jzQgCIS.exe
  2⤵
  PID:2104
- C:\Windows\System\PkbdDXI.exe
  C:\Windows\System\PkbdDXI.exe
  2⤵
  PID:2572
- C:\Windows\System\LcGXUPe.exe
  C:\Windows\System\LcGXUPe.exe
  2⤵
  PID:4056
- C:\Windows\System\YJTQAQu.exe
  C:\Windows\System\YJTQAQu.exe
  2⤵
  PID:5160
- C:\Windows\System\fkTjqyF.exe
  C:\Windows\System\fkTjqyF.exe
  2⤵
  PID:5576
- C:\Windows\System\bKEkAEo.exe
  C:\Windows\System\bKEkAEo.exe
  2⤵
  PID:6180
- C:\Windows\System\ASmnUOs.exe
  C:\Windows\System\ASmnUOs.exe
  2⤵
  PID:6268
- C:\Windows\System\UmnhVgP.exe
  C:\Windows\System\UmnhVgP.exe
  2⤵
  PID:6264
- C:\Windows\System\VjWefSQ.exe
  C:\Windows\System\VjWefSQ.exe
  2⤵
  PID:6284
- C:\Windows\System\LIYCTud.exe
  C:\Windows\System\LIYCTud.exe
  2⤵
  PID:6216
- C:\Windows\System\fdRERaw.exe
  C:\Windows\System\fdRERaw.exe
  2⤵
  PID:6308
- C:\Windows\System\zNnQlJa.exe
  C:\Windows\System\zNnQlJa.exe
  2⤵
  PID:6364
- C:\Windows\System\WCaomyp.exe
  C:\Windows\System\WCaomyp.exe
  2⤵
  PID:6432
- C:\Windows\System\YZmQvDu.exe
  C:\Windows\System\YZmQvDu.exe
  2⤵
  PID:6496
- C:\Windows\System\WUcNbGn.exe
  C:\Windows\System\WUcNbGn.exe
  2⤵
  PID:6536
- C:\Windows\System\BFuxDnt.exe
  C:\Windows\System\BFuxDnt.exe
  2⤵
  PID:6600
- C:\Windows\System\eOyoiAC.exe
  C:\Windows\System\eOyoiAC.exe
  2⤵
  PID:6696
- C:\Windows\System\mlXVgZU.exe
  C:\Windows\System\mlXVgZU.exe
  2⤵
  PID:6732
- C:\Windows\System\YZNLUrI.exe
  C:\Windows\System\YZNLUrI.exe
  2⤵
  PID:6340
- C:\Windows\System\SPiNiaF.exe
  C:\Windows\System\SPiNiaF.exe
  2⤵
  PID:6380
- C:\Windows\System\OlSpors.exe
  C:\Windows\System\OlSpors.exe
  2⤵
  PID:6848
- C:\Windows\System\EeCxNkY.exe
  C:\Windows\System\EeCxNkY.exe
  2⤵
  PID:6892
- C:\Windows\System\LinOotG.exe
  C:\Windows\System\LinOotG.exe
  2⤵
  PID:6832
- C:\Windows\System\eMTnAkW.exe
  C:\Windows\System\eMTnAkW.exe
  2⤵
  PID:6816
- C:\Windows\System\DhfxEYO.exe
  C:\Windows\System\DhfxEYO.exe
  2⤵
  PID:6752
- C:\Windows\System\xgbltrJ.exe
  C:\Windows\System\xgbltrJ.exe
  2⤵
  PID:6712
- C:\Windows\System\qffAsJs.exe
  C:\Windows\System\qffAsJs.exe
  2⤵
  PID:6644
- C:\Windows\System\YHfjcqd.exe
  C:\Windows\System\YHfjcqd.exe
  2⤵
  PID:6580
- C:\Windows\System\wJmXhuN.exe
  C:\Windows\System\wJmXhuN.exe
  2⤵
  PID:6512
- C:\Windows\System\knKvyhf.exe
  C:\Windows\System\knKvyhf.exe
  2⤵
  PID:6416
- C:\Windows\System\bMVagmR.exe
  C:\Windows\System\bMVagmR.exe
  2⤵
  PID:6484
- C:\Windows\System\UiGHPxC.exe
  C:\Windows\System\UiGHPxC.exe
  2⤵
  PID:6916
- C:\Windows\System\THGLyHE.exe
  C:\Windows\System\THGLyHE.exe
  2⤵
  PID:6980
- C:\Windows\System\QRmTtnr.exe
  C:\Windows\System\QRmTtnr.exe
  2⤵
  PID:7044
- C:\Windows\System\RztiVmQ.exe
  C:\Windows\System\RztiVmQ.exe
  2⤵
  PID:7032
- C:\Windows\System\tEvyKJs.exe
  C:\Windows\System\tEvyKJs.exe
  2⤵
  PID:6996
- C:\Windows\System\LvJwslc.exe
  C:\Windows\System\LvJwslc.exe
  2⤵
  PID:7064
- C:\Windows\System\mXvPLIf.exe
  C:\Windows\System\mXvPLIf.exe
  2⤵
  PID:7140
- C:\Windows\System\QUiqvbL.exe
  C:\Windows\System\QUiqvbL.exe
  2⤵
  PID:6176
- C:\Windows\System\dqzcyLW.exe
  C:\Windows\System\dqzcyLW.exe
  2⤵
  PID:1912
- C:\Windows\System\wvXuvxi.exe
  C:\Windows\System\wvXuvxi.exe
  2⤵
  PID:6244
- C:\Windows\System\NXKblPH.exe
  C:\Windows\System\NXKblPH.exe
  2⤵
  PID:6300
- C:\Windows\System\QcIYWJB.exe
  C:\Windows\System\QcIYWJB.exe
  2⤵
  PID:7124
- C:\Windows\System\DxJdixH.exe
  C:\Windows\System\DxJdixH.exe
  2⤵
  PID:2288
- C:\Windows\System\mujFKcE.exe
  C:\Windows\System\mujFKcE.exe
  2⤵
  PID:4156
- C:\Windows\System\BDOqmFs.exe
  C:\Windows\System\BDOqmFs.exe
  2⤵
  PID:6288
- C:\Windows\System\gQNxMks.exe
  C:\Windows\System\gQNxMks.exe
  2⤵
  PID:6664
- C:\Windows\System\yBfwVzc.exe
  C:\Windows\System\yBfwVzc.exe
  2⤵
  PID:6292
- C:\Windows\System\YaDgqne.exe
  C:\Windows\System\YaDgqne.exe
  2⤵
  PID:6700
- C:\Windows\System\xeKsVXK.exe
  C:\Windows\System\xeKsVXK.exe
  2⤵
  PID:6348
- C:\Windows\System\XjxKMhk.exe
  C:\Windows\System\XjxKMhk.exe
  2⤵
  PID:6896
- C:\Windows\System\pdcsGYx.exe
  C:\Windows\System\pdcsGYx.exe
  2⤵
  PID:6784
- C:\Windows\System\iNPPcoC.exe
  C:\Windows\System\iNPPcoC.exe
  2⤵
  PID:6548
- C:\Windows\System\cmHGUcJ.exe
  C:\Windows\System\cmHGUcJ.exe
  2⤵
  PID:6716
- C:\Windows\System\HDSgGak.exe
  C:\Windows\System\HDSgGak.exe
  2⤵
  PID:6820
- C:\Windows\System\ELHHPLn.exe
  C:\Windows\System\ELHHPLn.exe
  2⤵
  PID:6880
- C:\Windows\System\pXkvBvE.exe
  C:\Windows\System\pXkvBvE.exe
  2⤵
  PID:6968
- C:\Windows\System\KjjyYsF.exe
  C:\Windows\System\KjjyYsF.exe
  2⤵
  PID:6964
- C:\Windows\System\QcUDkWG.exe
  C:\Windows\System\QcUDkWG.exe
  2⤵
  PID:7112
- C:\Windows\System\bgvKbWn.exe
  C:\Windows\System\bgvKbWn.exe
  2⤵
  PID:6400
- C:\Windows\System\zQuXXcq.exe
  C:\Windows\System\zQuXXcq.exe
  2⤵
  PID:6304
- C:\Windows\System\OScgAFQ.exe
  C:\Windows\System\OScgAFQ.exe
  2⤵
  PID:6232
- C:\Windows\System\QcwaCIJ.exe
  C:\Windows\System\QcwaCIJ.exe
  2⤵
  PID:6628
- C:\Windows\System\EJyPWIp.exe
  C:\Windows\System\EJyPWIp.exe
  2⤵
  PID:5920
- C:\Windows\System\VRoolaa.exe
  C:\Windows\System\VRoolaa.exe
  2⤵
  PID:6800
- C:\Windows\System\klwQtBR.exe
  C:\Windows\System\klwQtBR.exe
  2⤵
  PID:6680
- C:\Windows\System\yYvTBcv.exe
  C:\Windows\System\yYvTBcv.exe
  2⤵
  PID:6824
- C:\Windows\System\vDXNwoy.exe
  C:\Windows\System\vDXNwoy.exe
  2⤵
  PID:6612
- C:\Windows\System\OqOBdCv.exe
  C:\Windows\System\OqOBdCv.exe
  2⤵
  PID:6904
- C:\Windows\System\vehUNsV.exe
  C:\Windows\System\vehUNsV.exe
  2⤵
  PID:5004
- C:\Windows\System\etgXdRh.exe
  C:\Windows\System\etgXdRh.exe
  2⤵
  PID:7092
- C:\Windows\System\kMSCtOp.exe
  C:\Windows\System\kMSCtOp.exe
  2⤵
  PID:3956
- C:\Windows\System\EnukJjz.exe
  C:\Windows\System\EnukJjz.exe
  2⤵
  PID:6464
- C:\Windows\System\sYGiIPT.exe
  C:\Windows\System\sYGiIPT.exe
  2⤵
  PID:6876
- C:\Windows\System\AujOORm.exe
  C:\Windows\System\AujOORm.exe
  2⤵
  PID:4296
- C:\Windows\System\LmsCrVQ.exe
  C:\Windows\System\LmsCrVQ.exe
  2⤵
  PID:7172
- C:\Windows\System\QSoOVhm.exe
  C:\Windows\System\QSoOVhm.exe
  2⤵
  PID:7188
- C:\Windows\System\wCpATBe.exe
  C:\Windows\System\wCpATBe.exe
  2⤵
  PID:7204
- C:\Windows\System\hYnBPTS.exe
  C:\Windows\System\hYnBPTS.exe
  2⤵
  PID:7220
- C:\Windows\System\yYIKqzI.exe
  C:\Windows\System\yYIKqzI.exe
  2⤵
  PID:7236
- C:\Windows\System\lttYThp.exe
  C:\Windows\System\lttYThp.exe
  2⤵
  PID:7252
- C:\Windows\System\UcmLXvb.exe
  C:\Windows\System\UcmLXvb.exe
  2⤵
  PID:7268
- C:\Windows\System\SgDONsm.exe
  C:\Windows\System\SgDONsm.exe
  2⤵
  PID:7284
- C:\Windows\System\RWTwWmH.exe
  C:\Windows\System\RWTwWmH.exe
  2⤵
  PID:7300
- C:\Windows\System\baNrtpK.exe
  C:\Windows\System\baNrtpK.exe
  2⤵
  PID:7316
- C:\Windows\System\dimeYTR.exe
  C:\Windows\System\dimeYTR.exe
  2⤵
  PID:7332
- C:\Windows\System\nNhToiY.exe
  C:\Windows\System\nNhToiY.exe
  2⤵
  PID:7348
- C:\Windows\System\GJFfjMe.exe
  C:\Windows\System\GJFfjMe.exe
  2⤵
  PID:7364
- C:\Windows\System\uwJzznT.exe
  C:\Windows\System\uwJzznT.exe
  2⤵
  PID:7380
- C:\Windows\System\KxPaCLJ.exe
  C:\Windows\System\KxPaCLJ.exe
  2⤵
  PID:7396
- C:\Windows\System\vwnCuas.exe
  C:\Windows\System\vwnCuas.exe
  2⤵
  PID:7412
- C:\Windows\System\UdiYbXR.exe
  C:\Windows\System\UdiYbXR.exe
  2⤵
  PID:7428
- C:\Windows\System\izOMpiJ.exe
  C:\Windows\System\izOMpiJ.exe
  2⤵
  PID:7444
- C:\Windows\System\DnnDedt.exe
  C:\Windows\System\DnnDedt.exe
  2⤵
  PID:7460
- C:\Windows\System\thVHEba.exe
  C:\Windows\System\thVHEba.exe
  2⤵
  PID:7476
- C:\Windows\System\lIVgqaX.exe
  C:\Windows\System\lIVgqaX.exe
  2⤵
  PID:7492
- C:\Windows\System\ZoFTnZj.exe
  C:\Windows\System\ZoFTnZj.exe
  2⤵
  PID:7508
- C:\Windows\System\QhpxXsf.exe
  C:\Windows\System\QhpxXsf.exe
  2⤵
  PID:7524
- C:\Windows\System\AGRCkKt.exe
  C:\Windows\System\AGRCkKt.exe
  2⤵
  PID:7540
- C:\Windows\System\NmWFEqV.exe
  C:\Windows\System\NmWFEqV.exe
  2⤵
  PID:7556
- C:\Windows\System\kZwPtSP.exe
  C:\Windows\System\kZwPtSP.exe
  2⤵
  PID:7572
- C:\Windows\System\eCLzegE.exe
  C:\Windows\System\eCLzegE.exe
  2⤵
  PID:7588
- C:\Windows\System\FuZJcNr.exe
  C:\Windows\System\FuZJcNr.exe
  2⤵
  PID:7604
- C:\Windows\System\GgINOFg.exe
  C:\Windows\System\GgINOFg.exe
  2⤵
  PID:7620
- C:\Windows\System\pLfJBoY.exe
  C:\Windows\System\pLfJBoY.exe
  2⤵
  PID:7636
- C:\Windows\System\IzEgclm.exe
  C:\Windows\System\IzEgclm.exe
  2⤵
  PID:7652
- C:\Windows\System\zDLbvil.exe
  C:\Windows\System\zDLbvil.exe
  2⤵
  PID:7668
- C:\Windows\System\uHDGxEz.exe
  C:\Windows\System\uHDGxEz.exe
  2⤵
  PID:7684
- C:\Windows\System\bYTeiDQ.exe
  C:\Windows\System\bYTeiDQ.exe
  2⤵
  PID:7700
- C:\Windows\System\bNjYJwX.exe
  C:\Windows\System\bNjYJwX.exe
  2⤵
  PID:7716
- C:\Windows\System\NYsZiCB.exe
  C:\Windows\System\NYsZiCB.exe
  2⤵
  PID:7732
- C:\Windows\System\ClGfDcR.exe
  C:\Windows\System\ClGfDcR.exe
  2⤵
  PID:7748
- C:\Windows\System\PgxshZd.exe
  C:\Windows\System\PgxshZd.exe
  2⤵
  PID:7764
- C:\Windows\System\OsHcpAE.exe
  C:\Windows\System\OsHcpAE.exe
  2⤵
  PID:7780
- C:\Windows\System\BNahreC.exe
  C:\Windows\System\BNahreC.exe
  2⤵
  PID:7796
- C:\Windows\System\SEnrAFr.exe
  C:\Windows\System\SEnrAFr.exe
  2⤵
  PID:7812
- C:\Windows\System\VWFlHKo.exe
  C:\Windows\System\VWFlHKo.exe
  2⤵
  PID:7828
- C:\Windows\System\hmVqVLW.exe
  C:\Windows\System\hmVqVLW.exe
  2⤵
  PID:7844
- C:\Windows\System\jwFjyeN.exe
  C:\Windows\System\jwFjyeN.exe
  2⤵
  PID:7860
- C:\Windows\System\sLZmXuS.exe
  C:\Windows\System\sLZmXuS.exe
  2⤵
  PID:7876
- C:\Windows\System\CbipkcD.exe
  C:\Windows\System\CbipkcD.exe
  2⤵
  PID:7892
- C:\Windows\System\oDekXBh.exe
  C:\Windows\System\oDekXBh.exe
  2⤵
  PID:7908
- C:\Windows\System\juZhqhc.exe
  C:\Windows\System\juZhqhc.exe
  2⤵
  PID:7924
- C:\Windows\System\HpLZndG.exe
  C:\Windows\System\HpLZndG.exe
  2⤵
  PID:7940
- C:\Windows\System\gAsiUDh.exe
  C:\Windows\System\gAsiUDh.exe
  2⤵
  PID:7956
- C:\Windows\System\cveGceM.exe
  C:\Windows\System\cveGceM.exe
  2⤵
  PID:7972
- C:\Windows\System\woMXECn.exe
  C:\Windows\System\woMXECn.exe
  2⤵
  PID:7988
- C:\Windows\System\MQfyUks.exe
  C:\Windows\System\MQfyUks.exe
  2⤵
  PID:8004
- C:\Windows\System\oNePLBF.exe
  C:\Windows\System\oNePLBF.exe
  2⤵
  PID:8020
- C:\Windows\System\vDppkFz.exe
  C:\Windows\System\vDppkFz.exe
  2⤵
  PID:8036
- C:\Windows\System\himrFNv.exe
  C:\Windows\System\himrFNv.exe
  2⤵
  PID:8052
- C:\Windows\System\ZxVxAWY.exe
  C:\Windows\System\ZxVxAWY.exe
  2⤵
  PID:8068
- C:\Windows\System\oQpxYBD.exe
  C:\Windows\System\oQpxYBD.exe
  2⤵
  PID:8084
- C:\Windows\System\boMohMz.exe
  C:\Windows\System\boMohMz.exe
  2⤵
  PID:8104
- C:\Windows\System\OxFFmuB.exe
  C:\Windows\System\OxFFmuB.exe
  2⤵
  PID:8120
- C:\Windows\System\plxBKtj.exe
  C:\Windows\System\plxBKtj.exe
  2⤵
  PID:8136
- C:\Windows\System\EArofAj.exe
  C:\Windows\System\EArofAj.exe
  2⤵
  PID:8152
- C:\Windows\System\YgkENjj.exe
  C:\Windows\System\YgkENjj.exe
  2⤵
  PID:8168
- C:\Windows\System\uarCPIM.exe
  C:\Windows\System\uarCPIM.exe
  2⤵
  PID:8184
- C:\Windows\System\VCoSXrk.exe
  C:\Windows\System\VCoSXrk.exe
  2⤵
  PID:6352
- C:\Windows\System\caRqdqR.exe
  C:\Windows\System\caRqdqR.exe
  2⤵
  PID:7216
- C:\Windows\System\gBuAFHC.exe
  C:\Windows\System\gBuAFHC.exe
  2⤵
  PID:6836
- C:\Windows\System\zQdJwGs.exe
  C:\Windows\System\zQdJwGs.exe
  2⤵
  PID:6532
- C:\Windows\System\ZkoGTfj.exe
  C:\Windows\System\ZkoGTfj.exe
  2⤵
  PID:7232
- C:\Windows\System\NKdgHuX.exe
  C:\Windows\System\NKdgHuX.exe
  2⤵
  PID:7212
- C:\Windows\System\HkVuvQL.exe
  C:\Windows\System\HkVuvQL.exe
  2⤵
  PID:7308
- C:\Windows\System\kpyIxST.exe
  C:\Windows\System\kpyIxST.exe
  2⤵
  PID:7292
- C:\Windows\System\rNmNboO.exe
  C:\Windows\System\rNmNboO.exe
  2⤵
  PID:7372
- C:\Windows\System\TkyiDhB.exe
  C:\Windows\System\TkyiDhB.exe
  2⤵
  PID:7440
- C:\Windows\System\atPGemF.exe
  C:\Windows\System\atPGemF.exe
  2⤵
  PID:7356
- C:\Windows\System\ulRVMys.exe
  C:\Windows\System\ulRVMys.exe
  2⤵
  PID:7484
- C:\Windows\System\WQiNwHp.exe
  C:\Windows\System\WQiNwHp.exe
  2⤵
  PID:7500
- C:\Windows\System\OZvvNaU.exe
  C:\Windows\System\OZvvNaU.exe
  2⤵
  PID:7532
- C:\Windows\System\yOlNTSq.exe
  C:\Windows\System\yOlNTSq.exe
  2⤵
  PID:7596
- C:\Windows\System\NnwGkHP.exe
  C:\Windows\System\NnwGkHP.exe
  2⤵
  PID:7660
- C:\Windows\System\LAQdIBn.exe
  C:\Windows\System\LAQdIBn.exe
  2⤵
  PID:7552
- C:\Windows\System\jKyymMm.exe
  C:\Windows\System\jKyymMm.exe
  2⤵
  PID:7728
- C:\Windows\System\cVVvpVz.exe
  C:\Windows\System\cVVvpVz.exe
  2⤵
  PID:7548
- C:\Windows\System\vGVNtxZ.exe
  C:\Windows\System\vGVNtxZ.exe
  2⤵
  PID:7584
- C:\Windows\System\sUDcskP.exe
  C:\Windows\System\sUDcskP.exe
  2⤵
  PID:7712
- C:\Windows\System\kzatusn.exe
  C:\Windows\System\kzatusn.exe
  2⤵
  PID:7676
- C:\Windows\System\jUoRGTY.exe
  C:\Windows\System\jUoRGTY.exe
  2⤵
  PID:7772
- C:\Windows\System\YwDRpPd.exe
  C:\Windows\System\YwDRpPd.exe
  2⤵
  PID:7804
- C:\Windows\System\IwxIfBQ.exe
  C:\Windows\System\IwxIfBQ.exe
  2⤵
  PID:7868
- C:\Windows\System\nwejTif.exe
  C:\Windows\System\nwejTif.exe
  2⤵
  PID:7916
- C:\Windows\System\nAcOLMd.exe
  C:\Windows\System\nAcOLMd.exe
  2⤵
  PID:7936
- C:\Windows\System\hzDtVFa.exe
  C:\Windows\System\hzDtVFa.exe
  2⤵
  PID:7948
- C:\Windows\System\DvWMJga.exe
  C:\Windows\System\DvWMJga.exe
  2⤵
  PID:8012
- C:\Windows\System\DudbinV.exe
  C:\Windows\System\DudbinV.exe
  2⤵
  PID:7996
- C:\Windows\System\dPamwNK.exe
  C:\Windows\System\dPamwNK.exe
  2⤵
  PID:8060
- C:\Windows\System\TbDpbzI.exe
  C:\Windows\System\TbDpbzI.exe
  2⤵
  PID:8080
- C:\Windows\System\YSpEYpi.exe
  C:\Windows\System\YSpEYpi.exe
  2⤵
  PID:8176
- C:\Windows\System\eDGBCXN.exe
  C:\Windows\System\eDGBCXN.exe
  2⤵
  PID:8160
- C:\Windows\System\aBlhWII.exe
  C:\Windows\System\aBlhWII.exe
  2⤵
  PID:7156
- C:\Windows\System\zwLmNen.exe
  C:\Windows\System\zwLmNen.exe
  2⤵
  PID:7340
- C:\Windows\System\muLJDOF.exe
  C:\Windows\System\muLJDOF.exe
  2⤵
  PID:7280
- C:\Windows\System\oDsTuOT.exe
  C:\Windows\System\oDsTuOT.exe
  2⤵
  PID:7424
- C:\Windows\System\tdECZLs.exe
  C:\Windows\System\tdECZLs.exe
  2⤵
  PID:7644
- C:\Windows\System\QVEnEMf.exe
  C:\Windows\System\QVEnEMf.exe
  2⤵
  PID:7792
- C:\Windows\System\sMPsHQg.exe
  C:\Windows\System\sMPsHQg.exe
  2⤵
  PID:6860
- C:\Windows\System\iImtnHs.exe
  C:\Windows\System\iImtnHs.exe
  2⤵
  PID:7228
- C:\Windows\System\DEZajzO.exe
  C:\Windows\System\DEZajzO.exe
  2⤵
  PID:7920
- C:\Windows\System\pKPwWRw.exe
  C:\Windows\System\pKPwWRw.exe
  2⤵
  PID:8076
- C:\Windows\System\opUUGih.exe
  C:\Windows\System\opUUGih.exe
  2⤵
  PID:7328
- C:\Windows\System\kNFXpBe.exe
  C:\Windows\System\kNFXpBe.exe
  2⤵
  PID:7200
- C:\Windows\System\ZQNjfpL.exe
  C:\Windows\System\ZQNjfpL.exe
  2⤵
  PID:7452
- C:\Windows\System\fKPnjUl.exe
  C:\Windows\System\fKPnjUl.exe
  2⤵
  PID:7788
- C:\Windows\System\VBHZjTr.exe
  C:\Windows\System\VBHZjTr.exe
  2⤵
  PID:7468
- C:\Windows\System\IANytUQ.exe
  C:\Windows\System\IANytUQ.exe
  2⤵
  PID:8028
- C:\Windows\System\vKlTqYn.exe
  C:\Windows\System\vKlTqYn.exe
  2⤵
  PID:7580
- C:\Windows\System\OKHObGG.exe
  C:\Windows\System\OKHObGG.exe
  2⤵
  PID:7824
- C:\Windows\System\tJpDqre.exe
  C:\Windows\System\tJpDqre.exe
  2⤵
  PID:7932
- C:\Windows\System\vjWVAHk.exe
  C:\Windows\System\vjWVAHk.exe
  2⤵
  PID:8032
- C:\Windows\System\BYxoTab.exe
  C:\Windows\System\BYxoTab.exe
  2⤵
  PID:7808
- C:\Windows\System\FnrxXxP.exe
  C:\Windows\System\FnrxXxP.exe
  2⤵
  PID:6384
- C:\Windows\System\CQkVVHs.exe
  C:\Windows\System\CQkVVHs.exe
  2⤵
  PID:7564
- C:\Windows\System\JbESwRQ.exe
  C:\Windows\System\JbESwRQ.exe
  2⤵
  PID:7456
- C:\Windows\System\ktoCYUE.exe
  C:\Windows\System\ktoCYUE.exe
  2⤵
  PID:7776
- C:\Windows\System\JIpgvJC.exe
  C:\Windows\System\JIpgvJC.exe
  2⤵
  PID:7184
- C:\Windows\System\PrXVTvZ.exe
  C:\Windows\System\PrXVTvZ.exe
  2⤵
  PID:7248
- C:\Windows\System\owOwyaN.exe
  C:\Windows\System\owOwyaN.exe
  2⤵
  PID:7344
- C:\Windows\System\WUSSrYc.exe
  C:\Windows\System\WUSSrYc.exe
  2⤵
  PID:7516
- C:\Windows\System\MjEmeHl.exe
  C:\Windows\System\MjEmeHl.exe
  2⤵
  PID:7628
- C:\Windows\System\GjjGOPZ.exe
  C:\Windows\System\GjjGOPZ.exe
  2⤵
  PID:8096
- C:\Windows\System\CeTLltl.exe
  C:\Windows\System\CeTLltl.exe
  2⤵
  PID:8208
- C:\Windows\System\RBpnJdO.exe
  C:\Windows\System\RBpnJdO.exe
  2⤵
  PID:8224
- C:\Windows\System\jsYvFQP.exe
  C:\Windows\System\jsYvFQP.exe
  2⤵
  PID:8240
- C:\Windows\System\bPCKjmR.exe
  C:\Windows\System\bPCKjmR.exe
  2⤵
  PID:8256
- C:\Windows\System\mRbbBcB.exe
  C:\Windows\System\mRbbBcB.exe
  2⤵
  PID:8272
- C:\Windows\System\OsTbrGC.exe
  C:\Windows\System\OsTbrGC.exe
  2⤵
  PID:8288
- C:\Windows\System\vsrhLog.exe
  C:\Windows\System\vsrhLog.exe
  2⤵
  PID:8304
- C:\Windows\System\bMCaoQv.exe
  C:\Windows\System\bMCaoQv.exe
  2⤵
  PID:8320
- C:\Windows\System\xSACJfd.exe
  C:\Windows\System\xSACJfd.exe
  2⤵
  PID:8336
- C:\Windows\System\AOuZqRB.exe
  C:\Windows\System\AOuZqRB.exe
  2⤵
  PID:8352
- C:\Windows\System\EIiUxAJ.exe
  C:\Windows\System\EIiUxAJ.exe
  2⤵
  PID:8368
- C:\Windows\System\nNcjMLz.exe
  C:\Windows\System\nNcjMLz.exe
  2⤵
  PID:8384
- C:\Windows\System\CQgetGV.exe
  C:\Windows\System\CQgetGV.exe
  2⤵
  PID:8400
- C:\Windows\System\UXkNRnV.exe
  C:\Windows\System\UXkNRnV.exe
  2⤵
  PID:8416
- C:\Windows\System\vRvKLMC.exe
  C:\Windows\System\vRvKLMC.exe
  2⤵
  PID:8432
- C:\Windows\System\NiJoJma.exe
  C:\Windows\System\NiJoJma.exe
  2⤵
  PID:8448
- C:\Windows\System\agVlkHR.exe
  C:\Windows\System\agVlkHR.exe
  2⤵
  PID:8464
- C:\Windows\System\pyaiiJR.exe
  C:\Windows\System\pyaiiJR.exe
  2⤵
  PID:8480
- C:\Windows\System\ufkMymu.exe
  C:\Windows\System\ufkMymu.exe
  2⤵
  PID:8496
- C:\Windows\System\brNrtKj.exe
  C:\Windows\System\brNrtKj.exe
  2⤵
  PID:8512
- C:\Windows\System\UVwuQue.exe
  C:\Windows\System\UVwuQue.exe
  2⤵
  PID:8528
- C:\Windows\System\QYuCyki.exe
  C:\Windows\System\QYuCyki.exe
  2⤵
  PID:8544
- C:\Windows\System\kMGfJAB.exe
  C:\Windows\System\kMGfJAB.exe
  2⤵
  PID:8560
- C:\Windows\System\KnXZCHU.exe
  C:\Windows\System\KnXZCHU.exe
  2⤵
  PID:8576
- C:\Windows\System\lOhZVDZ.exe
  C:\Windows\System\lOhZVDZ.exe
  2⤵
  PID:8592
- C:\Windows\System\cvTAXJW.exe
  C:\Windows\System\cvTAXJW.exe
  2⤵
  PID:8608
- C:\Windows\System\rEyrgfe.exe
  C:\Windows\System\rEyrgfe.exe
  2⤵
  PID:8624
- C:\Windows\System\dpXjDmQ.exe
  C:\Windows\System\dpXjDmQ.exe
  2⤵
  PID:8640
- C:\Windows\System\OzpRJnh.exe
  C:\Windows\System\OzpRJnh.exe
  2⤵
  PID:8656
- C:\Windows\System\RrvhMzk.exe
  C:\Windows\System\RrvhMzk.exe
  2⤵
  PID:8672
- C:\Windows\System\cmyepsH.exe
  C:\Windows\System\cmyepsH.exe
  2⤵
  PID:8688
- C:\Windows\System\gRTbZAW.exe
  C:\Windows\System\gRTbZAW.exe
  2⤵
  PID:8704
- C:\Windows\System\ABaoHRE.exe
  C:\Windows\System\ABaoHRE.exe
  2⤵
  PID:8720
- C:\Windows\System\JXgiOQu.exe
  C:\Windows\System\JXgiOQu.exe
  2⤵
  PID:8736
- C:\Windows\System\VYNwUQT.exe
  C:\Windows\System\VYNwUQT.exe
  2⤵
  PID:8752
- C:\Windows\System\EyJFfAd.exe
  C:\Windows\System\EyJFfAd.exe
  2⤵
  PID:8768
- C:\Windows\System\EhAeVsZ.exe
  C:\Windows\System\EhAeVsZ.exe
  2⤵
  PID:8784
- C:\Windows\System\zLAJGNJ.exe
  C:\Windows\System\zLAJGNJ.exe
  2⤵
  PID:8800
- C:\Windows\System\rDEAHuc.exe
  C:\Windows\System\rDEAHuc.exe
  2⤵
  PID:8816
- C:\Windows\System\eTiqupZ.exe
  C:\Windows\System\eTiqupZ.exe
  2⤵
  PID:8832
- C:\Windows\System\htQpwid.exe
  C:\Windows\System\htQpwid.exe
  2⤵
  PID:8848
- C:\Windows\System\KUjZNGR.exe
  C:\Windows\System\KUjZNGR.exe
  2⤵
  PID:8864
- C:\Windows\System\TvhWMiY.exe
  C:\Windows\System\TvhWMiY.exe
  2⤵
  PID:8880
- C:\Windows\System\JVBObdM.exe
  C:\Windows\System\JVBObdM.exe
  2⤵
  PID:8896
- C:\Windows\System\LeiABXx.exe
  C:\Windows\System\LeiABXx.exe
  2⤵
  PID:8912
- C:\Windows\System\hdTDnfL.exe
  C:\Windows\System\hdTDnfL.exe
  2⤵
  PID:8928
- C:\Windows\System\EICJOji.exe
  C:\Windows\System\EICJOji.exe
  2⤵
  PID:8944
- C:\Windows\System\aeSaISt.exe
  C:\Windows\System\aeSaISt.exe
  2⤵
  PID:8964
- C:\Windows\System\HBysTzC.exe
  C:\Windows\System\HBysTzC.exe
  2⤵
  PID:8980
- C:\Windows\System\OoCPCej.exe
  C:\Windows\System\OoCPCej.exe
  2⤵
  PID:8996
- C:\Windows\System\rLGdvXr.exe
  C:\Windows\System\rLGdvXr.exe
  2⤵
  PID:9012
- C:\Windows\System\ClZkprA.exe
  C:\Windows\System\ClZkprA.exe
  2⤵
  PID:9028
- C:\Windows\System\LorqPCH.exe
  C:\Windows\System\LorqPCH.exe
  2⤵
  PID:9044
- C:\Windows\System\ZmdnfiR.exe
  C:\Windows\System\ZmdnfiR.exe
  2⤵
  PID:9060
- C:\Windows\System\iixnxGz.exe
  C:\Windows\System\iixnxGz.exe
  2⤵
  PID:9076
- C:\Windows\System\dWuWzKZ.exe
  C:\Windows\System\dWuWzKZ.exe
  2⤵
  PID:9092
- C:\Windows\System\suOcBwT.exe
  C:\Windows\System\suOcBwT.exe
  2⤵
  PID:9108
- C:\Windows\System\ujWHNpc.exe
  C:\Windows\System\ujWHNpc.exe
  2⤵
  PID:9124
- C:\Windows\System\vrZUqCN.exe
  C:\Windows\System\vrZUqCN.exe
  2⤵
  PID:9140
- C:\Windows\System\JUujlSP.exe
  C:\Windows\System\JUujlSP.exe
  2⤵
  PID:9156
- C:\Windows\System\BiTyxjs.exe
  C:\Windows\System\BiTyxjs.exe
  2⤵
  PID:9172
- C:\Windows\System\wErGGkj.exe
  C:\Windows\System\wErGGkj.exe
  2⤵
  PID:9188
- C:\Windows\System\LzYRsqa.exe
  C:\Windows\System\LzYRsqa.exe
  2⤵
  PID:9204
- C:\Windows\System\KbrsjVY.exe
  C:\Windows\System\KbrsjVY.exe
  2⤵
  PID:7180
- C:\Windows\System\gXDMWbr.exe
  C:\Windows\System\gXDMWbr.exe
  2⤵
  PID:8232
- C:\Windows\System\aYSdULh.exe
  C:\Windows\System\aYSdULh.exe
  2⤵
  PID:8296
- C:\Windows\System\CAZGnrv.exe
  C:\Windows\System\CAZGnrv.exe
  2⤵
  PID:8328
- C:\Windows\System\nUdIqOD.exe
  C:\Windows\System\nUdIqOD.exe
  2⤵
  PID:8132
- C:\Windows\System\flbxSOz.exe
  C:\Windows\System\flbxSOz.exe
  2⤵
  PID:8280
- C:\Windows\System\jblcYDG.exe
  C:\Windows\System\jblcYDG.exe
  2⤵
  PID:7984
- C:\Windows\System\HpWqkCN.exe
  C:\Windows\System\HpWqkCN.exe
  2⤵
  PID:8316
- C:\Windows\System\VkVFOCi.exe
  C:\Windows\System\VkVFOCi.exe
  2⤵
  PID:8392
- C:\Windows\System\mHlHgDk.exe
  C:\Windows\System\mHlHgDk.exe
  2⤵
  PID:8424
- C:\Windows\System\PBKoEZI.exe
  C:\Windows\System\PBKoEZI.exe
  2⤵
  PID:8488
- C:\Windows\System\JTSsTjc.exe
  C:\Windows\System\JTSsTjc.exe
  2⤵
  PID:8552
- C:\Windows\System\wJPczyq.exe
  C:\Windows\System\wJPczyq.exe
  2⤵
  PID:8616
- C:\Windows\System\HWeZEpS.exe
  C:\Windows\System\HWeZEpS.exe
  2⤵
  PID:8680
- C:\Windows\System\dYSSgKd.exe
  C:\Windows\System\dYSSgKd.exe
  2⤵
  PID:8684
- C:\Windows\System\GYUkiqh.exe
  C:\Windows\System\GYUkiqh.exe
  2⤵
  PID:8444
- C:\Windows\System\hxSgCAw.exe
  C:\Windows\System\hxSgCAw.exe
  2⤵
  PID:8508
- C:\Windows\System\MPkZKGB.exe
  C:\Windows\System\MPkZKGB.exe
  2⤵
  PID:8600
- C:\Windows\System\iUAouxS.exe
  C:\Windows\System\iUAouxS.exe
  2⤵
  PID:8696
- C:\Windows\System\hUvxwtI.exe
  C:\Windows\System\hUvxwtI.exe
  2⤵
  PID:8776
- C:\Windows\System\zziBkMT.exe
  C:\Windows\System\zziBkMT.exe
  2⤵
  PID:8844
- C:\Windows\System\gssLtVU.exe
  C:\Windows\System\gssLtVU.exe
  2⤵
  PID:8908
- C:\Windows\System\UMUfyjD.exe
  C:\Windows\System\UMUfyjD.exe
  2⤵
  PID:8728
- C:\Windows\System\ZajhvFp.exe
  C:\Windows\System\ZajhvFp.exe
  2⤵
  PID:8732
- C:\Windows\System\OJlHyHO.exe
  C:\Windows\System\OJlHyHO.exe
  2⤵
  PID:8828
- C:\Windows\System\dVjfEbR.exe
  C:\Windows\System\dVjfEbR.exe
  2⤵
  PID:8796
- C:\Windows\System\CBIRNhW.exe
  C:\Windows\System\CBIRNhW.exe
  2⤵
  PID:8920
- C:\Windows\System\kmAJGPn.exe
  C:\Windows\System\kmAJGPn.exe
  2⤵
  PID:8960
- C:\Windows\System\btpAvRN.exe
  C:\Windows\System\btpAvRN.exe
  2⤵
  PID:9024
- C:\Windows\System\BGHVuOR.exe
  C:\Windows\System\BGHVuOR.exe
  2⤵
  PID:9052
- C:\Windows\System\TDxJlAI.exe
  C:\Windows\System\TDxJlAI.exe
  2⤵
  PID:9100
- C:\Windows\System\lTSnOKC.exe
  C:\Windows\System\lTSnOKC.exe
  2⤵
  PID:9120
- C:\Windows\System\nPUXpVj.exe
  C:\Windows\System\nPUXpVj.exe
  2⤵
  PID:9164
- C:\Windows\System\FwEQEiZ.exe
  C:\Windows\System\FwEQEiZ.exe
  2⤵
  PID:8204
- C:\Windows\System\BLKxwcj.exe
  C:\Windows\System\BLKxwcj.exe
  2⤵
  PID:8216
- C:\Windows\System\lRCsswQ.exe
  C:\Windows\System\lRCsswQ.exe
  2⤵
  PID:8408
- C:\Windows\System\WMZhUOt.exe
  C:\Windows\System\WMZhUOt.exe
  2⤵
  PID:8348
- C:\Windows\System\GhHfcZD.exe
  C:\Windows\System\GhHfcZD.exe
  2⤵
  PID:8360
- C:\Windows\System\vdUlrwU.exe
  C:\Windows\System\vdUlrwU.exe
  2⤵
  PID:8376
- C:\Windows\System\vDFMtMM.exe
  C:\Windows\System\vDFMtMM.exe
  2⤵
  PID:8524
- C:\Windows\System\yLZBqcJ.exe
  C:\Windows\System\yLZBqcJ.exe
  2⤵
  PID:8536
- C:\Windows\System\PTQfJXg.exe
  C:\Windows\System\PTQfJXg.exe
  2⤵
  PID:8412
- C:\Windows\System\NSKWdVl.exe
  C:\Windows\System\NSKWdVl.exe
  2⤵
  PID:8572
- C:\Windows\System\ChPdehO.exe
  C:\Windows\System\ChPdehO.exe
  2⤵
  PID:8668
- C:\Windows\System\fnHOTNm.exe
  C:\Windows\System\fnHOTNm.exe
  2⤵
  PID:8904
- C:\Windows\System\aExEjkP.exe
  C:\Windows\System\aExEjkP.exe
  2⤵
  PID:8956
- C:\Windows\System\TjNhIPg.exe
  C:\Windows\System\TjNhIPg.exe
  2⤵
  PID:9068
- C:\Windows\System\dEEJwfP.exe
  C:\Windows\System\dEEJwfP.exe
  2⤵
  PID:8940
- C:\Windows\System\ePxxWwR.exe
  C:\Windows\System\ePxxWwR.exe
  2⤵
  PID:8892
- C:\Windows\System\oquHZwt.exe
  C:\Windows\System\oquHZwt.exe
  2⤵
  PID:9020
- C:\Windows\System\eLJjFVe.exe
  C:\Windows\System\eLJjFVe.exe
  2⤵
  PID:9200
- C:\Windows\System\PIxufje.exe
  C:\Windows\System\PIxufje.exe
  2⤵
  PID:8264
- C:\Windows\System\oaObYfp.exe
  C:\Windows\System\oaObYfp.exe
  2⤵
  PID:8520
- C:\Windows\System\sKBKVMF.exe
  C:\Windows\System\sKBKVMF.exe
  2⤵
  PID:8312
- C:\Windows\System\JIFvHwE.exe
  C:\Windows\System\JIFvHwE.exe
  2⤵
  PID:7028
- C:\Windows\System\DLFMkrO.exe
  C:\Windows\System\DLFMkrO.exe
  2⤵
  PID:8812
- C:\Windows\System\mVEIdLU.exe
  C:\Windows\System\mVEIdLU.exe
  2⤵
  PID:9180
- C:\Windows\System\mBwLqcz.exe
  C:\Windows\System\mBwLqcz.exe
  2⤵
  PID:9184
- C:\Windows\System\QAKsExF.exe
  C:\Windows\System\QAKsExF.exe
  2⤵
  PID:8888
- C:\Windows\System\PXdlBmh.exe
  C:\Windows\System\PXdlBmh.exe
  2⤵
  PID:9224
- C:\Windows\System\wbHkDZY.exe
  C:\Windows\System\wbHkDZY.exe
  2⤵
  PID:9240
- C:\Windows\System\eOFESoq.exe
  C:\Windows\System\eOFESoq.exe
  2⤵
  PID:9256
- C:\Windows\System\DQwGdRE.exe
  C:\Windows\System\DQwGdRE.exe
  2⤵
  PID:9272
- C:\Windows\System\WdIzwSz.exe
  C:\Windows\System\WdIzwSz.exe
  2⤵
  PID:9288
- C:\Windows\System\QASbUpI.exe
  C:\Windows\System\QASbUpI.exe
  2⤵
  PID:9304
- C:\Windows\System\swIvEvS.exe
  C:\Windows\System\swIvEvS.exe
  2⤵
  PID:9320
- C:\Windows\System\kaofGpg.exe
  C:\Windows\System\kaofGpg.exe
  2⤵
  PID:9336
- C:\Windows\System\ftLqRQm.exe
  C:\Windows\System\ftLqRQm.exe
  2⤵
  PID:9352
- C:\Windows\System\rDZVTGY.exe
  C:\Windows\System\rDZVTGY.exe
  2⤵
  PID:9368
- C:\Windows\System\VVsqufI.exe
  C:\Windows\System\VVsqufI.exe
  2⤵
  PID:9384
- C:\Windows\System\bPHDmNv.exe
  C:\Windows\System\bPHDmNv.exe
  2⤵
  PID:9400
- C:\Windows\System\bJKmDAd.exe
  C:\Windows\System\bJKmDAd.exe
  2⤵
  PID:9416
- C:\Windows\System\LsnwcHu.exe
  C:\Windows\System\LsnwcHu.exe
  2⤵
  PID:9436
- C:\Windows\System\WxGZnVQ.exe
  C:\Windows\System\WxGZnVQ.exe
  2⤵
  PID:9452
- C:\Windows\System\vSQdGcb.exe
  C:\Windows\System\vSQdGcb.exe
  2⤵
  PID:9468
- C:\Windows\System\bLqqRxZ.exe
  C:\Windows\System\bLqqRxZ.exe
  2⤵
  PID:9484
- C:\Windows\System\mmYkQaA.exe
  C:\Windows\System\mmYkQaA.exe
  2⤵
  PID:9500
- C:\Windows\System\FBdKWse.exe
  C:\Windows\System\FBdKWse.exe
  2⤵
  PID:9516
- C:\Windows\System\UJIkInb.exe
  C:\Windows\System\UJIkInb.exe
  2⤵
  PID:9532
- C:\Windows\System\eVOOXzj.exe
  C:\Windows\System\eVOOXzj.exe
  2⤵
  PID:9548
- C:\Windows\System\UsPhNha.exe
  C:\Windows\System\UsPhNha.exe
  2⤵
  PID:9564
- C:\Windows\System\FFqqhGL.exe
  C:\Windows\System\FFqqhGL.exe
  2⤵
  PID:9580
- C:\Windows\System\hxzBgBD.exe
  C:\Windows\System\hxzBgBD.exe
  2⤵
  PID:9596
- C:\Windows\System\uypuLuD.exe
  C:\Windows\System\uypuLuD.exe
  2⤵
  PID:9620
- C:\Windows\System\rxQqyGy.exe
  C:\Windows\System\rxQqyGy.exe
  2⤵
  PID:9636
- C:\Windows\System\heWLIUK.exe
  C:\Windows\System\heWLIUK.exe
  2⤵
  PID:9652
- C:\Windows\System\PExyrUZ.exe
  C:\Windows\System\PExyrUZ.exe
  2⤵
  PID:9668
- C:\Windows\System\XFWhcGw.exe
  C:\Windows\System\XFWhcGw.exe
  2⤵
  PID:9684
- C:\Windows\System\BEeCLFq.exe
  C:\Windows\System\BEeCLFq.exe
  2⤵
  PID:9700
- C:\Windows\System\RQsrIcq.exe
  C:\Windows\System\RQsrIcq.exe
  2⤵
  PID:9716
- C:\Windows\System\hgzxeRX.exe
  C:\Windows\System\hgzxeRX.exe
  2⤵
  PID:9732
- C:\Windows\System\EzxdaWC.exe
  C:\Windows\System\EzxdaWC.exe
  2⤵
  PID:9748
- C:\Windows\System\WrYZyQe.exe
  C:\Windows\System\WrYZyQe.exe
  2⤵
  PID:9764
- C:\Windows\System\VfWUnqR.exe
  C:\Windows\System\VfWUnqR.exe
  2⤵
  PID:9780
- C:\Windows\System\gXpibLq.exe
  C:\Windows\System\gXpibLq.exe
  2⤵
  PID:9796
- C:\Windows\System\vKbeOTw.exe
  C:\Windows\System\vKbeOTw.exe
  2⤵
  PID:9812
- C:\Windows\System\laUUbBO.exe
  C:\Windows\System\laUUbBO.exe
  2⤵
  PID:9828
- C:\Windows\System\oSPaSZf.exe
  C:\Windows\System\oSPaSZf.exe
  2⤵
  PID:9844
- C:\Windows\System\JxUcFVk.exe
  C:\Windows\System\JxUcFVk.exe
  2⤵
  PID:9860
- C:\Windows\System\MFQcxPr.exe
  C:\Windows\System\MFQcxPr.exe
  2⤵
  PID:9876
- C:\Windows\System\YkGIJsU.exe
  C:\Windows\System\YkGIJsU.exe
  2⤵
  PID:9892
- C:\Windows\System\ofPYhLw.exe
  C:\Windows\System\ofPYhLw.exe
  2⤵
  PID:9908
- C:\Windows\System\jnHutGE.exe
  C:\Windows\System\jnHutGE.exe
  2⤵
  PID:9924
- C:\Windows\System\ACIPCmg.exe
  C:\Windows\System\ACIPCmg.exe
  2⤵
  PID:9940
- C:\Windows\System\gCHuzum.exe
  C:\Windows\System\gCHuzum.exe
  2⤵
  PID:9956
- C:\Windows\System\kldWuLB.exe
  C:\Windows\System\kldWuLB.exe
  2⤵
  PID:9972
- C:\Windows\System\NGrDLVo.exe
  C:\Windows\System\NGrDLVo.exe
  2⤵
  PID:9988
- C:\Windows\System\oWtNYtB.exe
  C:\Windows\System\oWtNYtB.exe
  2⤵
  PID:10004
- C:\Windows\System\BUnaVNo.exe
  C:\Windows\System\BUnaVNo.exe
  2⤵
  PID:10020
- C:\Windows\System\uhOXQqJ.exe
  C:\Windows\System\uhOXQqJ.exe
  2⤵
  PID:10036
- C:\Windows\System\EQzLeln.exe
  C:\Windows\System\EQzLeln.exe
  2⤵
  PID:10052
- C:\Windows\System\HjTcMGD.exe
  C:\Windows\System\HjTcMGD.exe
  2⤵
  PID:10068
- C:\Windows\System\YQYllMv.exe
  C:\Windows\System\YQYllMv.exe
  2⤵
  PID:10084
- C:\Windows\System\sGfCMXi.exe
  C:\Windows\System\sGfCMXi.exe
  2⤵
  PID:10100
- C:\Windows\System\TpppPXs.exe
  C:\Windows\System\TpppPXs.exe
  2⤵
  PID:10116
- C:\Windows\System\BRjswNT.exe
  C:\Windows\System\BRjswNT.exe
  2⤵
  PID:10132
- C:\Windows\System\bFxmpPi.exe
  C:\Windows\System\bFxmpPi.exe
  2⤵
  PID:10148
- C:\Windows\System\tfOJWbH.exe
  C:\Windows\System\tfOJWbH.exe
  2⤵
  PID:10180
- C:\Windows\System\GCgpIlx.exe
  C:\Windows\System\GCgpIlx.exe
  2⤵
  PID:10196
- C:\Windows\System\NijETFB.exe
  C:\Windows\System\NijETFB.exe
  2⤵
  PID:10212
- C:\Windows\System\yPdIkGp.exe
  C:\Windows\System\yPdIkGp.exe
  2⤵
  PID:10228
- C:\Windows\System\eYZPoDe.exe
  C:\Windows\System\eYZPoDe.exe
  2⤵
  PID:9248
- C:\Windows\System\TSzwHSI.exe
  C:\Windows\System\TSzwHSI.exe
  2⤵
  PID:8504
- C:\Windows\System\erNAJPb.exe
  C:\Windows\System\erNAJPb.exe
  2⤵
  PID:8584
- C:\Windows\System\vwNgvAp.exe
  C:\Windows\System\vwNgvAp.exe
  2⤵
  PID:8876
- C:\Windows\System\YlRlZyg.exe
  C:\Windows\System\YlRlZyg.exe
  2⤵
  PID:9196
- C:\Windows\System\yEAcZVK.exe
  C:\Windows\System\yEAcZVK.exe
  2⤵
  PID:8100
- C:\Windows\System\qZHkHhv.exe
  C:\Windows\System\qZHkHhv.exe
  2⤵
  PID:9268
- C:\Windows\System\dpATOsS.exe
  C:\Windows\System\dpATOsS.exe
  2⤵
  PID:9312
- C:\Windows\System\SYcLeQM.exe
  C:\Windows\System\SYcLeQM.exe
  2⤵
  PID:9300
- C:\Windows\System\XRkzSvS.exe
  C:\Windows\System\XRkzSvS.exe
  2⤵
  PID:9296
- C:\Windows\System\fBIXsUC.exe
  C:\Windows\System\fBIXsUC.exe
  2⤵
  PID:9508
- C:\Windows\System\EEsSPDJ.exe
  C:\Windows\System\EEsSPDJ.exe
  2⤵
  PID:9544
- C:\Windows\System\HmTaYtB.exe
  C:\Windows\System\HmTaYtB.exe
  2⤵
  PID:9396
- C:\Windows\System\SLovgGK.exe
  C:\Windows\System\SLovgGK.exe
  2⤵
  PID:9364
- C:\Windows\System\cqsABWx.exe
  C:\Windows\System\cqsABWx.exe
  2⤵
  PID:9424
- C:\Windows\System\OvFRbJo.exe
  C:\Windows\System\OvFRbJo.exe
  2⤵
  PID:9616
- C:\Windows\System\ADWBzxF.exe
  C:\Windows\System\ADWBzxF.exe
  2⤵
  PID:9556
- C:\Windows\System\HpspuUq.exe
  C:\Windows\System\HpspuUq.exe
  2⤵
  PID:8744
- C:\Windows\System\ZzlIgNz.exe
  C:\Windows\System\ZzlIgNz.exe
  2⤵
  PID:9628
- C:\Windows\System\BmzXoem.exe
  C:\Windows\System\BmzXoem.exe
  2⤵
  PID:9664
- C:\Windows\System\TnXryAd.exe
  C:\Windows\System\TnXryAd.exe
  2⤵
  PID:9692
- C:\Windows\System\uPKTUSj.exe
  C:\Windows\System\uPKTUSj.exe
  2⤵
  PID:9804
- C:\Windows\System\OBaLbJS.exe
  C:\Windows\System\OBaLbJS.exe
  2⤵
  PID:9868
- C:\Windows\System\abLHvIX.exe
  C:\Windows\System\abLHvIX.exe
  2⤵
  PID:9904
- C:\Windows\System\AsIowoK.exe
  C:\Windows\System\AsIowoK.exe
  2⤵
  PID:9968
- C:\Windows\System\IIoBJtH.exe
  C:\Windows\System\IIoBJtH.exe
  2⤵
  PID:9884
- C:\Windows\System\hPvgGhJ.exe
  C:\Windows\System\hPvgGhJ.exe
  2⤵
  PID:9824
- C:\Windows\System\sScjukF.exe
  C:\Windows\System\sScjukF.exe
  2⤵
  PID:10032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\FNFqwWZ.exe

Filesize
1.8MB

MD5
a9e475fc7284d492c8c1cc486780446b

SHA1
171ae12114b46f72673f1e14d3e5126f52662448

SHA256
4e8241309e7352ea3bd6225b9b9301b01263b402fbbd9825a2c6f1a0d6821e12

SHA512
5e3a0e7983ebae4266285f647807153688013eba18094cf03d072a762b344fc6d70f5f7c9bb7d00130cf84c1bcb047c8db46a549d87c96f7447a7db5e1260721

Download Submit
C:\Windows\system\JMYTwxa.exe

Filesize
1.8MB

MD5
e8e60f9a5c3c4697eebdf3f47838a749

SHA1
1a184a61ae22ce7b092df8f21e2fee270f650956

SHA256
6a66d4e8365a1a548fba0f5f64c2a8fd556f7401b8e40cc622a0ecb29953e609

SHA512
2acbb3e4a7dbe9b7ec928f729af8f3232a15dd58af0babfcaa6ee8617760c51b71bdd37dc94b42d2df7b80f2037600fd7d0aee9cfed0523310df864e47802e9e

Download Submit
C:\Windows\system\NgOgaex.exe

Filesize
1.8MB

MD5
122e76cd8ca3d1eccf659ea7e05a8baa

SHA1
02976fed1f725b3693ba4cd0a59bca7767b51330

SHA256
844bb1cecb98edddd5c1bfdf2ed5bbc56f1107b453560d23c3b8583c0ef0b274

SHA512
f5e794158919ba2dd8690963aa80db06f27fafeb49f91663f8fbde56ff81f1f233c1e7777a0d508f118562cdb53cd31e1d7ebe3712146402165b3d794be20b67

Download Submit
C:\Windows\system\PwZTyvp.exe

Filesize
1.8MB

MD5
62ec41aa4208e7f159f8eacdefb038dc

SHA1
ccf3c9e523c2b8c21a700a3f0f177947042c880f

SHA256
920a1a178db1239a4c4f2dd9e627ffb3c3032a9de8840f865cd4c99532374a60

SHA512
5ebda205b2d736f72b7bc8f796ca6e20c76e61d8c93f8d3db32ba7b425f2600f23ab2015a1aa8f1e91b869db3d2e50c81f7c7fc8f979f4d05135813942f71c00

Download Submit
C:\Windows\system\RUQwenH.exe

Filesize
1.8MB

MD5
7f1f5390bf156016ec2ada703c4242b5

SHA1
e30f21d3f9fabd401f33e4ad4271cb64028cf2f4

SHA256
27719deca9999ab0e346440ad76bc0195b940ea14dbf42b53f9531f1d668854c

SHA512
1100a1abcc116581ce01959a7941c2467e9a82669e58e22f609d2605a0461c134e0edd9e302a717cfa71ffb49ca99fcb268bc09311c45be9f1fc6f23a016b9cd

Download Submit
C:\Windows\system\TULolqK.exe

Filesize
1.9MB

MD5
a39ddd6f856dab49782963ae46106230

SHA1
714a47a08a6bc3c9b069e826d26d4d10460f9c74

SHA256
892cc6d50d9848e28f966afa2a54ae013d18f7a41282363f027c67e453fa2c17

SHA512
93c5ec89eb2c036b06026b6c9999933b0e44b0f6ae121557b89c8bdeda57d292287f1aa8a28a2314bf19de5e288dfc1422794521d095f0cc5d920523f1ffc73c

Download Submit
C:\Windows\system\TcdBQRE.exe

Filesize
1.8MB

MD5
a70c7dff20f5baf683d61eb91da7aecb

SHA1
9458ce06265068eb75ee4d8bed7fd51938fa2fb4

SHA256
00104957727c4633bf3bea4fdf5e3055a92440717a603836aed8a5edb9bce696

SHA512
5403e43a8ed59be31f0ca0ed9294b3c0d9e23bffe64282024cad9f4eeb1e364c8c38fe419cd60dec0368beb99a7734c0d5ae4b19cb404f2be2bf878d40f2c5af

Download Submit
C:\Windows\system\WTjnIuj.exe

Filesize
1.8MB

MD5
7e004836f711fda36aa404f31df1d861

SHA1
4bf663257158b821331a05e669c48f483b52b8dd

SHA256
724fae74c0970956da8b0d9e7254d07b4aa2b34c12633a0061c71bbc675e9419

SHA512
533457fa0ac278fbf21cab2db636c5b550f15b40762efa81f19ba913d9f8ea272489d3cd0c78b89935f7cbcfafdc62dd1198aa539ff1fb996eb6b4d6d1e3b746

Download Submit
C:\Windows\system\dEmntcO.exe

Filesize
1.8MB

MD5
3b3b024432a47349c30bfba02127e76e

SHA1
b3741931c14941d015c0518c6bc230a30dcfbfcc

SHA256
081c8103f2c0b21af1e9d67038ff2daae9e39ad87121de2794e36d82f4d0766c

SHA512
7248c2495265ffbc630f26f1b12ef204f5cee65a48cd6d8c739fb5d079ba3bf12ea649b51635e7979fb3194027d3d1e1fe73f28f9fe209817106b8546779bac4

Download Submit
C:\Windows\system\eNzFliE.exe

Filesize
1.8MB

MD5
eb109c06b0ce1113db3a8c102d199751

SHA1
ee4211a0b6fd2e66f949a69d8b7d4ec6cc189db7

SHA256
2fafdfc0b94256437a22e7be55bb2ca5766db399ad3a2b6b57461d57c9a237de

SHA512
6a6d54d1cc7863d8dc96d2fa78aea85a4acb4ca74015b4d36ee0d47906b4cdd947840a56153c393f8520bcbd8466ec5a94f15bb5749a5de7be5fc8b621cd8f72

Download Submit
C:\Windows\system\jiIDEip.exe

Filesize
1.9MB

MD5
7e2bee221875a38f7b9b514420712390

SHA1
5364c82b4fcfe8bb7dfa4d10c72e5ffda7448d65

SHA256
e136006372742453d806f8a4b25a089040c4ed105056e0a9640e67c7434dd105

SHA512
fc81f1abb6f622380fe6465b8cb977bd620227a9c6c81071e62240de150edbbea498af4f6fb49d68142446db7d2edf56959c9dfcb379d83935328d545711c1d3

Download Submit
C:\Windows\system\juwfOPt.exe

Filesize
1.8MB

MD5
002d4707aee99ceec4da1d5433e23165

SHA1
5b37f8ac7ba77208fca2ed8403f79be110b1c7a3

SHA256
980d60c09b41758e76fb35cb22671330a4b1be14aa2f18d8f067b42df23ee241

SHA512
cde52e35d563f949cbcbbf7e7ad79312d68d6e5131a4b84e65a4260bff9c7f8d5e615283c952486e3dae41d8b0b132321d17a152fd1d2c7290959a61fef68262

Download Submit
C:\Windows\system\nIlPLzr.exe

Filesize
1.8MB

MD5
dbd70fbd01601a874d4127ef653f527e

SHA1
a67240faa5a8055576737e3f6c4f1effacb91cdb

SHA256
3b9b548c018a9b9564cc2079faff43ee450253bdd2468e7a73397137ec2e6982

SHA512
160a6f67bf5aac1ae89822676cb7cc44a578b619f4732eec38b486169cf35ea76d5dc0567808d2db9e131de0ffabf7f746a0b8bb3b26de8d26c9d69e1154df44

Download Submit
C:\Windows\system\oHvPiVJ.exe

Filesize
1.8MB

MD5
3b96bbdc8544ed6425348fd02216fa6b

SHA1
16f5a7cad2efe966e6651c6c7f5f137cbea87661

SHA256
c6bac8caa204f4dcf6f21840a57ea45f7a4830b9233cdc88cfa2150dfa1956b0

SHA512
f986aad2f089e45bb86c71a6e9eeb70d7977094b59051a464ecc3e118e4fb490eb8b9f436cd523ea955712f07dcded1ffa95ecd23dbdd1f6598c83d7ac48f801

Download Submit
C:\Windows\system\pdiImvK.exe

Filesize
1.8MB

MD5
b3b4b8419a9b3326c37731c4d5f8080e

SHA1
83b0b52a78641957e40e0938ab2d076cb0478d47

SHA256
6b0216b7944f858fee1bf52527fde4189065745eec9c8cd68b09162fb3bb1b46

SHA512
808d5727fda550683e66c1ecbae09d31831bcdd46c7f46b7765a9a6f1f8e04198df20831306f07b3864ce87e72596f2d7a137b236e0053d823b8749c0d01297c

Download Submit
C:\Windows\system\robMugG.exe

Filesize
1.9MB

MD5
027345328f65f695ca32acbfeec16468

SHA1
b1558b48dd1a255f6707cd4c81f0d1b38a9cecee

SHA256
f19e4de8c71d381d419ef1e628655af91dbfe891025368dda013e324b7851457

SHA512
097ef09cee6a7d516d81e7c398aec01e1a8eba5c27352ab804d3b9269496c8d31940b6da8887b19021fada3b3edee51fdfa8f79b58ec380663e2287a3d74a898

Download Submit
C:\Windows\system\uhDeJyO.exe

Filesize
1.9MB

MD5
b6b257464b2e05fee8e0ac77c464d7b6

SHA1
8af4f138d6f8abc77a85eb2cbd77a80e697187a0

SHA256
c6ae8eced0f530e0653c63a36037297b4f458e156f00d9f4e6d2d3ca795900db

SHA512
cc4aa456bd9ffd97ccee56ffec68a9af0c684a4753a4671e2f5c1c8c00c8773baa2a748e2c19b6e3624e70e374a03610c8930a9ece2b06bb277ee4bfe69c6d1d

Download Submit
C:\Windows\system\wnirXQx.exe

Filesize
1.8MB

MD5
c1bfcb4eb97d68bd377eb48cbb88ed05

SHA1
5ceca43ad1a42c88b1a9cf2f63247b779f17f0a4

SHA256
22445f7eca13ff90116f14387322f7b28699de3c126983e701d6d57de62ddfd7

SHA512
80794ac32646618cb7b5067a15bc348d9f1aa1273c97da1a8057696c832cd5f7561191d1e2a9f9f376a1e35e06f79016bda219aa904c6362c2d97aa1da9e10ca

Download Submit
C:\Windows\system\yathLhI.exe

Filesize
1.8MB

MD5
5a5449c8bb6867df230486d76a9ca876

SHA1
04dde38540bd53427264f1fe02b82d5b0c3a9d41

SHA256
4ba1ed0c7e3003d99d2976c06cbfb919fbac061e85e5ca30789eb51bde474d63

SHA512
5ba8d013ee205d35ae9b9af07029bb0b61586fbbd46b9317b312a8af2d4aa9101ceecd9ef25cd647feeac8d424d3e5a7fb96b68067fbc17b628f5f42e83c72ff

Download Submit
C:\Windows\system\zJWYydc.exe

Filesize
1.8MB

MD5
ae1e431fe24bc780211c1e0f72af216a

SHA1
7347bfff37393ed5bc3339d314996bd49a432d08

SHA256
bb88a0f963783cce0a3c09dfba43ffee8375db2a4d17fbf9ef1a11c7b04bd30c

SHA512
0feb207a0dae72fc0ad6b56dd1f09567040168ea21da5359379dd3c220101b59b02df9297247b8e60de4561a62b3bf26a49a6e27246a906ce2660d3d5c0cd0cc

Download Submit
\Windows\system\LhYumUZ.exe

Filesize
1.8MB

MD5
cbedfe47543308ecdf72e3709b36bb47

SHA1
838168a754c4c5b202b749f2bcfc077f2c82470a

SHA256
de70b63a773625e9f9646729fe039b4a08b6dc54b7c7d9afb96df775a838447c

SHA512
9aa2d5cbca25c9aae9b6c964571a03fe2399ac81755d8f556ac06c718e1a3eaa26b2aa857d78fb3d0d4bccba480fe86a11e9ee77af61af59c87846b3bd297c58

Download Submit
\Windows\system\MTcatSB.exe

Filesize
1.8MB

MD5
1d4bfbe42344443486381d1a3a731e67

SHA1
f101af8122a67236956cd1be8da23303d69dff07

SHA256
cdff067ff446d65de68125aefdfde27d8f75f8158b5f807cc8734db413608e60

SHA512
2422ee1a3740ce3d53cc90bd90353902fb4991ba8559c939105580f4aba0b966711c9d722170ed8f5c8c3ca068ddef63b0b2f424ef9af70fd2364ceb7d06ee9a

Download Submit
\Windows\system\UNErgnI.exe

Filesize
1.8MB

MD5
5d1eb74b23651154759410d62b7c7d92

SHA1
71decfda0ebf9658450f978482be9f7e54007863

SHA256
a2b2e34af95bab0beb4f783a3d6da5ee6c83afa9a68c68fa7fdfe444e06dc323

SHA512
e670909bebbf4bba27d2f70bd952701ff34e980bffb342670c6eefc3041cec0f9957169c0adf30fa993c3e1a4485ed1cd340c6c2fcf4023790f72448711ccc7a

Download Submit
\Windows\system\auKcrdg.exe

Filesize
1.8MB

MD5
7df36fdecddb481accdffafbd2ccc02d

SHA1
2528aa919fcf445227e0a42f650852b84cdb8901

SHA256
9795bd4a3eea3875ff1456152f34db322fd2bcd04516e9acc3030ae14dde1771

SHA512
65289fa084555d625289011ce645d691a4808a262f477d2e97057bcceae3c158e7aa30b2f2d57258b4c9487b502567c1aeacb0afc66215a58fe7b36b7e5e7050

Download Submit
\Windows\system\bxTpmQD.exe

Filesize
1.9MB

MD5
133aa9145b83571aab17f23587c97a74

SHA1
022823aab84e782a28dec8279b778f8dda7c4377

SHA256
77198f130a8485880f17756d5be53ee0fde596cc25c81f746bef45356362a20d

SHA512
3b5f2beaf2179e2757af91d0e0c62318ac3f124754900f57fdaac32b079be40e1040f5bede38bfc79fc9fc2e35a951840951ee7576220032bdec3c8f88f4461b

Download Submit
\Windows\system\gqnTRbT.exe

Filesize
1.8MB

MD5
134379810ee569cb51fa0358a7eba9a3

SHA1
fc667c20c5b98592597483b934ab5f1331264cf8

SHA256
c356a4c2658e878631817777ebeaea0d3f1ab0b7c98f3ce7511dd8eaf26c56ca

SHA512
1b1e4a79e3c6d18c153bfd988252ee2dea61f4ebadf47dab1c6ce6a33c84d7eeb2f8abb6f01bc2de0391a4e468e84b761db7b118f060a795f55ea75b8e34d03c

Download Submit
\Windows\system\itpGbKe.exe

Filesize
1.8MB

MD5
dc196fe9cc0e6791ca91b9681f61228c

SHA1
921377fd4af4b492d12bf2c0d0b9c9cbd43f894c

SHA256
b4fa4c7e4e7ca6d8e06819c08b7a88ae6562577b1e51fab4d8582d2f5a304774

SHA512
b915e448f8dec0eb031c5eaea550ebe7f9fa15c623a3b81f02451d5bd059598a7e4528c12162bed5a970cd9c81103f65d9a80efbc86ca1befe18252dce83c0d0

Download Submit
\Windows\system\jLMFPrP.exe

Filesize
1.8MB

MD5
01b37c26c48831cb41df26510405bee8

SHA1
f7124ef4fd2a887af280a289a7652543c4e41597

SHA256
6747baac94769a12e99d676d1e5122669c950e0811414de06c98f977eec6a54d

SHA512
9ee2d5c8f030c342dfcdba7123a0e1112f08035099edb3b624c6d5c0740b3b4d866cf820c68dc1d6584f0062b7ca11d7a51585e145cdd57e49ec216dcab8b4bb

Download Submit
\Windows\system\lveCoBF.exe

Filesize
1.8MB

MD5
91861e393ac4d01cf02f51299a07827f

SHA1
a6baf32ded41528cf0de4db8fe949f5d669d0476

SHA256
ba1f74d814b2a880cb29e091923460052ba5392b692f91308d2e52723b098674

SHA512
e2cf7ad2ce1970dac214eccdbc5b4fa3e0937058cd1be3bdda8c9fb32eeab26d77227f5897ab4424afb3bffd4ab66fa407f3d9e9e086f149b3b6bd8c66779b08

Download Submit
\Windows\system\otfBIWH.exe

Filesize
1.8MB

MD5
2fdb8cdb5f66f9ae44cba70367c313d6

SHA1
bd73e2235ac023e2aa6eb2bf17de416c8bf44bb5

SHA256
99f30a04b3c90a361eb4a9264a32f85989382f606d1b36c354b4c0d943540c5d

SHA512
0da2b2c52969e812f7ab27a58bffc3608c5e08f5bee93b962d3a54dc3d275552057474d8b410ad5218e1a13ff85f24d3bdf3019b66fb67710f82bf294286fee0

Download Submit
\Windows\system\pUMcIKf.exe

Filesize
1.9MB

MD5
37a792956022bb67d16fd6df5d859ed2

SHA1
036de99c721c70789f3fa0566727cf2792d86068

SHA256
7fc35ad092b24566ae5a0bf7e87161b33a21a44005a2990f69d4cef632deec88

SHA512
5146be687655a8c0f1824d750eed8a0507e139e378f6d65d220cfec17014e283a411ee866db7d2a1ffdfdbd4ee7fb1218b785a2b55dbc525bbdfd4496039c4cf

Download Submit
\Windows\system\puCAlHz.exe

Filesize
1.8MB

MD5
ba23c3708ee9dcb5739f05a582749db6

SHA1
bcb064ec41d8b5048204580c564db62d974e515b

SHA256
edf404ef7a981eaab3cbacdf414b7a8c0d7053545aed39ad12720b70d5ba9d38

SHA512
38c3c3e219025858258a5ed1f0aa7de70902b965e6afb290d31e9dbb6a9d42a55e52c6bd109d8a751d8dc93cc7a9496e5e2565bd8d3c8b855ff4222bbc0b2017

Download Submit
\Windows\system\vPdwFch.exe

Filesize
1.8MB

MD5
9866a57654694a01c0076843b6d2648d

SHA1
5f8a21e0fdd38039af230b3268d1b397f5619212

SHA256
052d603cdf93540fc74619839fd3952e167128f90326a58020bcf7eb51249913

SHA512
f6be6f361ea041b82ed3879834e54edc0da6808e966af88fb63ee218eb7359b1bbf5482b10442a48ac83e9b62203936cf4f7ab17a77dc8b7a423db0ec5d7ddf2

Download Submit
memory/1184-23-0x000000013F830000-0x000000013FC22000-memory.dmp

Filesize
3.9MB

Download
memory/1260-90-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/1448-151-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2108-75-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2176-46-0x000000013FD60000-0x0000000140152000-memory.dmp

Filesize
3.9MB

Download
memory/2176-60-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-70-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-69-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2176-66-0x000000013FD20000-0x0000000140112000-memory.dmp

Filesize
3.9MB

Download
memory/2176-1-0x000000013F550000-0x000000013F942000-memory.dmp

Filesize
3.9MB

Download
memory/2176-16-0x0000000002A10000-0x0000000002E02000-memory.dmp

Filesize
3.9MB

Download
memory/2176-24-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2176-72-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-71-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-74-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-73-0x0000000002F10000-0x0000000003302000-memory.dmp

Filesize
3.9MB

Download
memory/2176-152-0x00000000034B0000-0x00000000038A2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-126-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2176-28-0x000000013F020000-0x000000013F412000-memory.dmp

Filesize
3.9MB

Download
memory/2260-208-0x0000000001D80000-0x0000000001D88000-memory.dmp

Filesize
32KB

Download
memory/2260-202-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2632-56-0x000000013F670000-0x000000013FA62000-memory.dmp

Filesize
3.9MB

Download
memory/2648-38-0x000000013F870000-0x000000013FC62000-memory.dmp

Filesize
3.9MB

Download
memory/2736-59-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2744-122-0x000000013F500000-0x000000013F8F2000-memory.dmp

Filesize
3.9MB

Download
memory/2928-31-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2968-67-0x000000013F5E0000-0x000000013F9D2000-memory.dmp

Filesize
3.9MB

Download