xmrig | 40e92ff476f2aa5366d99d8ac9b9e29096b026cb32b7ca206ab5a5b79153cc86

Analysis

max time kernel
28s
max time network
28s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
Size

2.2MB
MD5

0769f92d0921d14432889205f3ee4240
SHA1

9adc33bf5197d68444554fe4ad0f071d1eacd8cb
SHA256

40e92ff476f2aa5366d99d8ac9b9e29096b026cb32b7ca206ab5a5b79153cc86
SHA512

b44fb3359beb36de5b6ea2102687b6469af3ff94aafeff3b9028dc34b623b91d365abf7b84b859dc0159148831288b49208626b2810bb8dea46eed0aead7b060
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrfq:NABH

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral1/memory/2684-44-0x000000013FEB0000-0x00000001402A2000-memory.dmp	xmrig
behavioral1/memory/2104-43-0x000000013FF80000-0x0000000140372000-memory.dmp	xmrig
behavioral1/memory/3064-41-0x000000013F760000-0x000000013FB52000-memory.dmp	xmrig
behavioral1/memory/2596-40-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	xmrig
behavioral1/memory/2156-37-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/3024-34-0x0000000003060000-0x0000000003452000-memory.dmp	xmrig
behavioral1/memory/3040-31-0x000000013F150000-0x000000013F542000-memory.dmp	xmrig
behavioral1/memory/3024-5-0x000000013FFB0000-0x00000001403A2000-memory.dmp	xmrig
behavioral1/memory/2528-117-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2180-92-0x000000013F460000-0x000000013F852000-memory.dmp	xmrig
behavioral1/memory/2480-83-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/3000-127-0x000000013F1A0000-0x000000013F592000-memory.dmp	xmrig
behavioral1/memory/2632-72-0x000000013F8A0000-0x000000013FC92000-memory.dmp	xmrig
behavioral1/memory/2540-86-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
3040	VYFqBLi.exe
2156	rJGCwlR.exe
2104	OOjmGCQ.exe
2596	AICAYWW.exe
3064	faXdorj.exe
2684	eCchTVr.exe
2632	azbPXFg.exe
2480	xhiWQIe.exe
2528	NXmDhrQ.exe
2540	pqMRZmo.exe
2180	rcTTVzL.exe
3000	BdXaQYz.exe
2364	qUbaeXW.exe
2824	PDdyBxy.exe
2788	ggJlwgh.exe
2924	vzBpoks.exe
1832	prHEimS.exe
1564	zwZryLT.exe
2084	huDrGbV.exe
852	aYcUgQO.exe
2224	LTtphqD.exe
2724	lQsYZBI.exe
848	zrjnroI.exe
1912	YJfSrVU.exe
1448	gXmEiSL.exe
2144	flOCATA.exe
944	WkMelmK.exe
2456	QtGoCNi.exe
2756	XHJzLOq.exe
1604	uIcFVja.exe
1316	WtjrXCN.exe
1136	lonklaJ.exe
1932	zfuwzjj.exe
1200	vHnodTk.exe
856	rCSCgyg.exe
1092	hbCdeXj.exe
2172	qrOqIKK.exe
1088	uSdRSwd.exe
2036	JcmSJkp.exe
920	pEYFgbo.exe
2880	aZjgDUf.exe
2336	nwCIpiW.exe
1988	VWHVbIU.exe
1252	CxlYDzY.exe
3028	uNogHDl.exe
2244	rHYQClI.exe
2032	hnwlQqp.exe
904	VaDMmOK.exe
1028	OESIhRb.exe
2972	hZMMoXP.exe
1692	puSeYnc.exe
2680	lhhQSVh.exe
2476	FZzqXwU.exe
2516	rdoFyrU.exe
2804	mvoVkbq.exe
1164	sokASQe.exe
2108	CEjkpbP.exe
1684	cFsVzpI.exe
1016	ujmwOhs.exe
296	OJxDxJh.exe
2672	gpJqASj.exe
1888	ymHkVqk.exe
2384	GNlqwiE.exe
1744	OBpDLvY.exe

Loads dropped DLL 64 IoCs

pid	Process
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe

UPX packed file 51 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000c000000013113-9.dat	upx
behavioral1/files/0x00090000000139e0-10.dat	upx
behavioral1/files/0x0008000000013a21-17.dat	upx
behavioral1/files/0x0008000000013a71-20.dat	upx
behavioral1/files/0x0008000000013a11-28.dat	upx
behavioral1/files/0x000b000000014120-45.dat	upx
behavioral1/memory/3024-46-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2684-44-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/memory/2104-43-0x000000013FF80000-0x0000000140372000-memory.dmp	upx
behavioral1/memory/3064-41-0x000000013F760000-0x000000013FB52000-memory.dmp	upx
behavioral1/memory/2596-40-0x000000013F0F0000-0x000000013F4E2000-memory.dmp	upx
behavioral1/memory/2156-37-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/3040-31-0x000000013F150000-0x000000013F542000-memory.dmp	upx
behavioral1/files/0x000a00000001342b-16.dat	upx
behavioral1/memory/3024-5-0x000000013FFB0000-0x00000001403A2000-memory.dmp	upx
behavioral1/files/0x000a000000013928-54.dat	upx
behavioral1/files/0x000f000000005578-57.dat	upx
behavioral1/files/0x0007000000014316-68.dat	upx
behavioral1/files/0x0006000000014390-95.dat	upx
behavioral1/files/0x000600000001447e-111.dat	upx
behavioral1/files/0x0006000000014ef8-149.dat	upx
behavioral1/files/0x00060000000155ed-167.dat	upx
behavioral1/files/0x00060000000155f7-171.dat	upx
behavioral1/files/0x0006000000015616-192.dat	upx
behavioral1/files/0x000600000001448a-195.dat	upx
behavioral1/files/0x0006000000014de9-146.dat	upx
behavioral1/files/0x00060000000143ec-187.dat	upx
behavioral1/files/0x0006000000015605-181.dat	upx
behavioral1/files/0x00060000000155f3-168.dat	upx
behavioral1/files/0x0006000000014b70-162.dat	upx
behavioral1/files/0x0006000000014af6-161.dat	upx
behavioral1/files/0x00060000000149f5-160.dat	upx
behavioral1/files/0x00060000000147ea-159.dat	upx
behavioral1/files/0x00060000000146b8-158.dat	upx
behavioral1/files/0x0006000000015018-155.dat	upx
behavioral1/files/0x0006000000014b31-140.dat	upx
behavioral1/files/0x0006000000014abe-134.dat	upx
behavioral1/files/0x0006000000014825-128.dat	upx
behavioral1/files/0x00060000000146c0-121.dat	upx
behavioral1/memory/2528-117-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/files/0x0006000000014667-116.dat	upx
behavioral1/files/0x00060000000144ac-114.dat	upx
behavioral1/files/0x00060000000146a2-112.dat	upx
behavioral1/files/0x0006000000014539-104.dat	upx
behavioral1/memory/2180-92-0x000000013F460000-0x000000013F852000-memory.dmp	upx
behavioral1/memory/2480-83-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x00070000000142c4-75.dat	upx
behavioral1/files/0x00080000000142b0-73.dat	upx
behavioral1/memory/3000-127-0x000000013F1A0000-0x000000013F592000-memory.dmp	upx
behavioral1/memory/2632-72-0x000000013F8A0000-0x000000013FC92000-memory.dmp	upx
behavioral1/memory/2540-86-0x000000013FBE0000-0x000000013FFD2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pJIirdQ.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\fueevjC.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\huDrGbV.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\WLYSTGv.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\XbMNIDL.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\LwCuowy.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\xnWPrtF.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\SepFcie.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\tWHUyjd.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\rQDvsph.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\AqxEVmE.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\kKBRTCE.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\wveXzGm.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\UbETTqz.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\vExAWJA.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\OAUMUgp.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\MhkcuYe.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\qTxXddU.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\sMESagI.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\ERkquIU.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\OlTuswZ.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\vHnodTk.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\NTdviWY.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\EHJLmcO.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\rbCNVGp.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\iEJyusq.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\QcIREBu.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\BuxLcUe.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\pmDzxnV.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\pCJCHRt.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\TjGMZzl.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\stRolqa.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\byIGhyZ.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\kBtKHbU.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\nRyQgpG.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\mTwMviA.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\TZcwSoK.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\cZWClhY.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\JkbZWoC.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\ZxjuaES.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\sqtmdRG.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\YOpTlPt.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\tHuXpEB.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\XaeatjT.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\MBzGPES.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\mvoVkbq.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\xjOqkuK.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\BKnFBeY.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\wljXEzq.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\IFalTkG.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\qiytzeZ.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\UdRaEFL.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\FYKQvEz.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\SdoVNHN.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\HnHaWeC.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\GqBZlLn.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\lNNHBVw.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\XQIRyHs.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\etRUrhf.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\pEYFgbo.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\SBKVciY.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\vQtUucC.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\ACGHzjb.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
File created	C:\Windows\System\PyJnKIs.exe	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2428	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
Token: SeDebugPrivilege	2428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2428	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2428	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	29
PID 3024 wrote to memory of 2428	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	29
PID 3024 wrote to memory of 3040	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	30
PID 3024 wrote to memory of 3040	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	30
PID 3024 wrote to memory of 3040	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	30
PID 3024 wrote to memory of 2156	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2156	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2156	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	31
PID 3024 wrote to memory of 2104	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	32
PID 3024 wrote to memory of 2104	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	32
PID 3024 wrote to memory of 2104	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	32
PID 3024 wrote to memory of 3064	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	33
PID 3024 wrote to memory of 3064	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	33
PID 3024 wrote to memory of 3064	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	33
PID 3024 wrote to memory of 2596	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	34
PID 3024 wrote to memory of 2596	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	34
PID 3024 wrote to memory of 2596	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	34
PID 3024 wrote to memory of 2684	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	35
PID 3024 wrote to memory of 2684	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	35
PID 3024 wrote to memory of 2684	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	35
PID 3024 wrote to memory of 2632	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	36
PID 3024 wrote to memory of 2632	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	36
PID 3024 wrote to memory of 2632	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	36
PID 3024 wrote to memory of 2480	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	37
PID 3024 wrote to memory of 2480	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	37
PID 3024 wrote to memory of 2480	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	37
PID 3024 wrote to memory of 2540	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	38
PID 3024 wrote to memory of 2540	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	38
PID 3024 wrote to memory of 2540	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	38
PID 3024 wrote to memory of 2528	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	39
PID 3024 wrote to memory of 2528	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	39
PID 3024 wrote to memory of 2528	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	39
PID 3024 wrote to memory of 2180	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	40
PID 3024 wrote to memory of 2180	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	40
PID 3024 wrote to memory of 2180	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	40
PID 3024 wrote to memory of 3000	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	41
PID 3024 wrote to memory of 3000	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	41
PID 3024 wrote to memory of 3000	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	41
PID 3024 wrote to memory of 2364	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	42
PID 3024 wrote to memory of 2364	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	42
PID 3024 wrote to memory of 2364	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	42
PID 3024 wrote to memory of 1448	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	43
PID 3024 wrote to memory of 1448	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	43
PID 3024 wrote to memory of 1448	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	43
PID 3024 wrote to memory of 2824	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	44
PID 3024 wrote to memory of 2824	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	44
PID 3024 wrote to memory of 2824	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	44
PID 3024 wrote to memory of 944	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	45
PID 3024 wrote to memory of 944	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	45
PID 3024 wrote to memory of 944	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	45
PID 3024 wrote to memory of 2788	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	46
PID 3024 wrote to memory of 2788	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	46
PID 3024 wrote to memory of 2788	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	46
PID 3024 wrote to memory of 2456	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	47
PID 3024 wrote to memory of 2456	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	47
PID 3024 wrote to memory of 2456	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	47
PID 3024 wrote to memory of 2924	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	48
PID 3024 wrote to memory of 2924	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	48
PID 3024 wrote to memory of 2924	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	48
PID 3024 wrote to memory of 2756	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	49
PID 3024 wrote to memory of 2756	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	49
PID 3024 wrote to memory of 2756	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	49
PID 3024 wrote to memory of 1832	3024	0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0769f92d0921d14432889205f3ee4240_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2428
- C:\Windows\System\VYFqBLi.exe
  C:\Windows\System\VYFqBLi.exe
  2⤵
  - Executes dropped EXE
  PID:3040
- C:\Windows\System\rJGCwlR.exe
  C:\Windows\System\rJGCwlR.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\OOjmGCQ.exe
  C:\Windows\System\OOjmGCQ.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\faXdorj.exe
  C:\Windows\System\faXdorj.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\AICAYWW.exe
  C:\Windows\System\AICAYWW.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\eCchTVr.exe
  C:\Windows\System\eCchTVr.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\azbPXFg.exe
  C:\Windows\System\azbPXFg.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\xhiWQIe.exe
  C:\Windows\System\xhiWQIe.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\pqMRZmo.exe
  C:\Windows\System\pqMRZmo.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\NXmDhrQ.exe
  C:\Windows\System\NXmDhrQ.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\rcTTVzL.exe
  C:\Windows\System\rcTTVzL.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\BdXaQYz.exe
  C:\Windows\System\BdXaQYz.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\qUbaeXW.exe
  C:\Windows\System\qUbaeXW.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\gXmEiSL.exe
  C:\Windows\System\gXmEiSL.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\PDdyBxy.exe
  C:\Windows\System\PDdyBxy.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\WkMelmK.exe
  C:\Windows\System\WkMelmK.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\ggJlwgh.exe
  C:\Windows\System\ggJlwgh.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\QtGoCNi.exe
  C:\Windows\System\QtGoCNi.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\vzBpoks.exe
  C:\Windows\System\vzBpoks.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\XHJzLOq.exe
  C:\Windows\System\XHJzLOq.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\prHEimS.exe
  C:\Windows\System\prHEimS.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\uIcFVja.exe
  C:\Windows\System\uIcFVja.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\zwZryLT.exe
  C:\Windows\System\zwZryLT.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\WtjrXCN.exe
  C:\Windows\System\WtjrXCN.exe
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Windows\System\huDrGbV.exe
  C:\Windows\System\huDrGbV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\lonklaJ.exe
  C:\Windows\System\lonklaJ.exe
  2⤵
  - Executes dropped EXE
  PID:1136
- C:\Windows\System\aYcUgQO.exe
  C:\Windows\System\aYcUgQO.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\vHnodTk.exe
  C:\Windows\System\vHnodTk.exe
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\System\LTtphqD.exe
  C:\Windows\System\LTtphqD.exe
  2⤵
  - Executes dropped EXE
  PID:2224
- C:\Windows\System\rCSCgyg.exe
  C:\Windows\System\rCSCgyg.exe
  2⤵
  - Executes dropped EXE
  PID:856
- C:\Windows\System\lQsYZBI.exe
  C:\Windows\System\lQsYZBI.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\hbCdeXj.exe
  C:\Windows\System\hbCdeXj.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\zrjnroI.exe
  C:\Windows\System\zrjnroI.exe
  2⤵
  - Executes dropped EXE
  PID:848
- C:\Windows\System\qrOqIKK.exe
  C:\Windows\System\qrOqIKK.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\YJfSrVU.exe
  C:\Windows\System\YJfSrVU.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\uSdRSwd.exe
  C:\Windows\System\uSdRSwd.exe
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Windows\System\flOCATA.exe
  C:\Windows\System\flOCATA.exe
  2⤵
  - Executes dropped EXE
  PID:2144
- C:\Windows\System\JcmSJkp.exe
  C:\Windows\System\JcmSJkp.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\zfuwzjj.exe
  C:\Windows\System\zfuwzjj.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\nwCIpiW.exe
  C:\Windows\System\nwCIpiW.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\pEYFgbo.exe
  C:\Windows\System\pEYFgbo.exe
  2⤵
  - Executes dropped EXE
  PID:920
- C:\Windows\System\VWHVbIU.exe
  C:\Windows\System\VWHVbIU.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\aZjgDUf.exe
  C:\Windows\System\aZjgDUf.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\CxlYDzY.exe
  C:\Windows\System\CxlYDzY.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\uNogHDl.exe
  C:\Windows\System\uNogHDl.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\rHYQClI.exe
  C:\Windows\System\rHYQClI.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\hnwlQqp.exe
  C:\Windows\System\hnwlQqp.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\GNlqwiE.exe
  C:\Windows\System\GNlqwiE.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\VaDMmOK.exe
  C:\Windows\System\VaDMmOK.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\OBpDLvY.exe
  C:\Windows\System\OBpDLvY.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\OESIhRb.exe
  C:\Windows\System\OESIhRb.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\CSVZCiY.exe
  C:\Windows\System\CSVZCiY.exe
  2⤵
  PID:940
- C:\Windows\System\hZMMoXP.exe
  C:\Windows\System\hZMMoXP.exe
  2⤵
  - Executes dropped EXE
  PID:2972
- C:\Windows\System\AIHbioH.exe
  C:\Windows\System\AIHbioH.exe
  2⤵
  PID:1556
- C:\Windows\System\puSeYnc.exe
  C:\Windows\System\puSeYnc.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\nRyQgpG.exe
  C:\Windows\System\nRyQgpG.exe
  2⤵
  PID:2576
- C:\Windows\System\lhhQSVh.exe
  C:\Windows\System\lhhQSVh.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\ADpLiaX.exe
  C:\Windows\System\ADpLiaX.exe
  2⤵
  PID:2608
- C:\Windows\System\FZzqXwU.exe
  C:\Windows\System\FZzqXwU.exe
  2⤵
  - Executes dropped EXE
  PID:2476
- C:\Windows\System\QrTfQaZ.exe
  C:\Windows\System\QrTfQaZ.exe
  2⤵
  PID:1508
- C:\Windows\System\rdoFyrU.exe
  C:\Windows\System\rdoFyrU.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\MhkcuYe.exe
  C:\Windows\System\MhkcuYe.exe
  2⤵
  PID:2472
- C:\Windows\System\mvoVkbq.exe
  C:\Windows\System\mvoVkbq.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\RpsvKrb.exe
  C:\Windows\System\RpsvKrb.exe
  2⤵
  PID:2352
- C:\Windows\System\sokASQe.exe
  C:\Windows\System\sokASQe.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\QmZdZlz.exe
  C:\Windows\System\QmZdZlz.exe
  2⤵
  PID:1404
- C:\Windows\System\CEjkpbP.exe
  C:\Windows\System\CEjkpbP.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\QjqSgpq.exe
  C:\Windows\System\QjqSgpq.exe
  2⤵
  PID:1628
- C:\Windows\System\cFsVzpI.exe
  C:\Windows\System\cFsVzpI.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\bvLbAfV.exe
  C:\Windows\System\bvLbAfV.exe
  2⤵
  PID:688
- C:\Windows\System\ujmwOhs.exe
  C:\Windows\System\ujmwOhs.exe
  2⤵
  - Executes dropped EXE
  PID:1016
- C:\Windows\System\GFbrkMo.exe
  C:\Windows\System\GFbrkMo.exe
  2⤵
  PID:2716
- C:\Windows\System\OJxDxJh.exe
  C:\Windows\System\OJxDxJh.exe
  2⤵
  - Executes dropped EXE
  PID:296
- C:\Windows\System\SDRfmVZ.exe
  C:\Windows\System\SDRfmVZ.exe
  2⤵
  PID:2340
- C:\Windows\System\gpJqASj.exe
  C:\Windows\System\gpJqASj.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\ulSqpEg.exe
  C:\Windows\System\ulSqpEg.exe
  2⤵
  PID:952
- C:\Windows\System\ymHkVqk.exe
  C:\Windows\System\ymHkVqk.exe
  2⤵
  - Executes dropped EXE
  PID:1888
- C:\Windows\System\HuzBAyZ.exe
  C:\Windows\System\HuzBAyZ.exe
  2⤵
  PID:2252
- C:\Windows\System\gkwRhpR.exe
  C:\Windows\System\gkwRhpR.exe
  2⤵
  PID:2652
- C:\Windows\System\Gomlkde.exe
  C:\Windows\System\Gomlkde.exe
  2⤵
  PID:2808
- C:\Windows\System\HTjgauh.exe
  C:\Windows\System\HTjgauh.exe
  2⤵
  PID:2168
- C:\Windows\System\qTxXddU.exe
  C:\Windows\System\qTxXddU.exe
  2⤵
  PID:1240
- C:\Windows\System\DQTYCmi.exe
  C:\Windows\System\DQTYCmi.exe
  2⤵
  PID:2256
- C:\Windows\System\yJtWuAn.exe
  C:\Windows\System\yJtWuAn.exe
  2⤵
  PID:964
- C:\Windows\System\ZApEinw.exe
  C:\Windows\System\ZApEinw.exe
  2⤵
  PID:2176
- C:\Windows\System\rwHMmTk.exe
  C:\Windows\System\rwHMmTk.exe
  2⤵
  PID:1632
- C:\Windows\System\kXMqfJt.exe
  C:\Windows\System\kXMqfJt.exe
  2⤵
  PID:2404
- C:\Windows\System\ICQrsKD.exe
  C:\Windows\System\ICQrsKD.exe
  2⤵
  PID:1096
- C:\Windows\System\wVxLQxn.exe
  C:\Windows\System\wVxLQxn.exe
  2⤵
  PID:1584
- C:\Windows\System\LWMlIJT.exe
  C:\Windows\System\LWMlIJT.exe
  2⤵
  PID:2292
- C:\Windows\System\ljHfSTn.exe
  C:\Windows\System\ljHfSTn.exe
  2⤵
  PID:2468
- C:\Windows\System\OmmmEyi.exe
  C:\Windows\System\OmmmEyi.exe
  2⤵
  PID:1444
- C:\Windows\System\sqtmdRG.exe
  C:\Windows\System\sqtmdRG.exe
  2⤵
  PID:320
- C:\Windows\System\zsgdYBr.exe
  C:\Windows\System\zsgdYBr.exe
  2⤵
  PID:2092
- C:\Windows\System\WAflCSf.exe
  C:\Windows\System\WAflCSf.exe
  2⤵
  PID:616
- C:\Windows\System\wHvrBxj.exe
  C:\Windows\System\wHvrBxj.exe
  2⤵
  PID:1368
- C:\Windows\System\wjPtMpC.exe
  C:\Windows\System\wjPtMpC.exe
  2⤵
  PID:2444
- C:\Windows\System\ntXmiXn.exe
  C:\Windows\System\ntXmiXn.exe
  2⤵
  PID:1344
- C:\Windows\System\RYhoKrm.exe
  C:\Windows\System\RYhoKrm.exe
  2⤵
  PID:332
- C:\Windows\System\JSlGGDa.exe
  C:\Windows\System\JSlGGDa.exe
  2⤵
  PID:1072
- C:\Windows\System\UhNuuZz.exe
  C:\Windows\System\UhNuuZz.exe
  2⤵
  PID:2388
- C:\Windows\System\scKAKvB.exe
  C:\Windows\System\scKAKvB.exe
  2⤵
  PID:3084
- C:\Windows\System\UAEnMxI.exe
  C:\Windows\System\UAEnMxI.exe
  2⤵
  PID:3100
- C:\Windows\System\kVKepMv.exe
  C:\Windows\System\kVKepMv.exe
  2⤵
  PID:3116
- C:\Windows\System\sdpBTNd.exe
  C:\Windows\System\sdpBTNd.exe
  2⤵
  PID:3132
- C:\Windows\System\rwjQKlG.exe
  C:\Windows\System\rwjQKlG.exe
  2⤵
  PID:3152
- C:\Windows\System\NMyxNld.exe
  C:\Windows\System\NMyxNld.exe
  2⤵
  PID:3168
- C:\Windows\System\piPnCRN.exe
  C:\Windows\System\piPnCRN.exe
  2⤵
  PID:3184
- C:\Windows\System\pMyWrDW.exe
  C:\Windows\System\pMyWrDW.exe
  2⤵
  PID:3200
- C:\Windows\System\vTdnvTu.exe
  C:\Windows\System\vTdnvTu.exe
  2⤵
  PID:3216
- C:\Windows\System\NskEEWe.exe
  C:\Windows\System\NskEEWe.exe
  2⤵
  PID:3232
- C:\Windows\System\vcDElxx.exe
  C:\Windows\System\vcDElxx.exe
  2⤵
  PID:3248
- C:\Windows\System\rQDvsph.exe
  C:\Windows\System\rQDvsph.exe
  2⤵
  PID:3264
- C:\Windows\System\QQaPuwS.exe
  C:\Windows\System\QQaPuwS.exe
  2⤵
  PID:3280
- C:\Windows\System\uXmMUJE.exe
  C:\Windows\System\uXmMUJE.exe
  2⤵
  PID:3296
- C:\Windows\System\UjuxBAD.exe
  C:\Windows\System\UjuxBAD.exe
  2⤵
  PID:3312
- C:\Windows\System\idyXaAi.exe
  C:\Windows\System\idyXaAi.exe
  2⤵
  PID:3328
- C:\Windows\System\sjjWDsv.exe
  C:\Windows\System\sjjWDsv.exe
  2⤵
  PID:3344
- C:\Windows\System\crBkDwB.exe
  C:\Windows\System\crBkDwB.exe
  2⤵
  PID:3368
- C:\Windows\System\NXxpuyv.exe
  C:\Windows\System\NXxpuyv.exe
  2⤵
  PID:3388
- C:\Windows\System\JGKuCND.exe
  C:\Windows\System\JGKuCND.exe
  2⤵
  PID:3444
- C:\Windows\System\cTaTAYC.exe
  C:\Windows\System\cTaTAYC.exe
  2⤵
  PID:3476
- C:\Windows\System\WOPEbTX.exe
  C:\Windows\System\WOPEbTX.exe
  2⤵
  PID:3492
- C:\Windows\System\UYBjFTL.exe
  C:\Windows\System\UYBjFTL.exe
  2⤵
  PID:3508
- C:\Windows\System\bZbzTgO.exe
  C:\Windows\System\bZbzTgO.exe
  2⤵
  PID:3524
- C:\Windows\System\VhtxNtC.exe
  C:\Windows\System\VhtxNtC.exe
  2⤵
  PID:3540
- C:\Windows\System\OasJpVs.exe
  C:\Windows\System\OasJpVs.exe
  2⤵
  PID:3556
- C:\Windows\System\OMgwUxk.exe
  C:\Windows\System\OMgwUxk.exe
  2⤵
  PID:3572
- C:\Windows\System\YDVWfKC.exe
  C:\Windows\System\YDVWfKC.exe
  2⤵
  PID:3588
- C:\Windows\System\tQAaLsr.exe
  C:\Windows\System\tQAaLsr.exe
  2⤵
  PID:3604
- C:\Windows\System\jofzZTp.exe
  C:\Windows\System\jofzZTp.exe
  2⤵
  PID:3620
- C:\Windows\System\GLzWkcZ.exe
  C:\Windows\System\GLzWkcZ.exe
  2⤵
  PID:3636
- C:\Windows\System\fEkpcfR.exe
  C:\Windows\System\fEkpcfR.exe
  2⤵
  PID:3652
- C:\Windows\System\FPRpbDk.exe
  C:\Windows\System\FPRpbDk.exe
  2⤵
  PID:3668
- C:\Windows\System\cSLtFJx.exe
  C:\Windows\System\cSLtFJx.exe
  2⤵
  PID:3684
- C:\Windows\System\XnhpZog.exe
  C:\Windows\System\XnhpZog.exe
  2⤵
  PID:3700
- C:\Windows\System\WcEJxNK.exe
  C:\Windows\System\WcEJxNK.exe
  2⤵
  PID:3716
- C:\Windows\System\xnmpgiU.exe
  C:\Windows\System\xnmpgiU.exe
  2⤵
  PID:3732
- C:\Windows\System\NWgOJzF.exe
  C:\Windows\System\NWgOJzF.exe
  2⤵
  PID:3748
- C:\Windows\System\toTCuip.exe
  C:\Windows\System\toTCuip.exe
  2⤵
  PID:3764
- C:\Windows\System\xWozigY.exe
  C:\Windows\System\xWozigY.exe
  2⤵
  PID:3780
- C:\Windows\System\DUmOeDr.exe
  C:\Windows\System\DUmOeDr.exe
  2⤵
  PID:3796
- C:\Windows\System\fgltxKY.exe
  C:\Windows\System\fgltxKY.exe
  2⤵
  PID:3812
- C:\Windows\System\tBMPooU.exe
  C:\Windows\System\tBMPooU.exe
  2⤵
  PID:3828
- C:\Windows\System\UJfvYFC.exe
  C:\Windows\System\UJfvYFC.exe
  2⤵
  PID:3844
- C:\Windows\System\QCsXFwp.exe
  C:\Windows\System\QCsXFwp.exe
  2⤵
  PID:3860
- C:\Windows\System\mnatpof.exe
  C:\Windows\System\mnatpof.exe
  2⤵
  PID:3876
- C:\Windows\System\rCMmFTp.exe
  C:\Windows\System\rCMmFTp.exe
  2⤵
  PID:3892
- C:\Windows\System\EHDKTAZ.exe
  C:\Windows\System\EHDKTAZ.exe
  2⤵
  PID:3908
- C:\Windows\System\aScHjQb.exe
  C:\Windows\System\aScHjQb.exe
  2⤵
  PID:3924
- C:\Windows\System\wmOGbQq.exe
  C:\Windows\System\wmOGbQq.exe
  2⤵
  PID:3940
- C:\Windows\System\eNhZTJH.exe
  C:\Windows\System\eNhZTJH.exe
  2⤵
  PID:3956
- C:\Windows\System\lLtTmQF.exe
  C:\Windows\System\lLtTmQF.exe
  2⤵
  PID:3984
- C:\Windows\System\gUeToeI.exe
  C:\Windows\System\gUeToeI.exe
  2⤵
  PID:4004
- C:\Windows\System\oyzASaw.exe
  C:\Windows\System\oyzASaw.exe
  2⤵
  PID:4040
- C:\Windows\System\SFgofJt.exe
  C:\Windows\System\SFgofJt.exe
  2⤵
  PID:2860
- C:\Windows\System\kjRMvjL.exe
  C:\Windows\System\kjRMvjL.exe
  2⤵
  PID:2536
- C:\Windows\System\ZSggEcm.exe
  C:\Windows\System\ZSggEcm.exe
  2⤵
  PID:1724
- C:\Windows\System\aTcxLwv.exe
  C:\Windows\System\aTcxLwv.exe
  2⤵
  PID:1720
- C:\Windows\System\ocQTyGp.exe
  C:\Windows\System\ocQTyGp.exe
  2⤵
  PID:2560
- C:\Windows\System\YOpTlPt.exe
  C:\Windows\System\YOpTlPt.exe
  2⤵
  PID:768
- C:\Windows\System\vvFUBoG.exe
  C:\Windows\System\vvFUBoG.exe
  2⤵
  PID:1856
- C:\Windows\System\hwQJjJv.exe
  C:\Windows\System\hwQJjJv.exe
  2⤵
  PID:3076
- C:\Windows\System\PWbGerL.exe
  C:\Windows\System\PWbGerL.exe
  2⤵
  PID:3144
- C:\Windows\System\VqYdpWF.exe
  C:\Windows\System\VqYdpWF.exe
  2⤵
  PID:3208
- C:\Windows\System\anyeRDK.exe
  C:\Windows\System\anyeRDK.exe
  2⤵
  PID:3272
- C:\Windows\System\GlQqhVx.exe
  C:\Windows\System\GlQqhVx.exe
  2⤵
  PID:3336
- C:\Windows\System\MPaSHsW.exe
  C:\Windows\System\MPaSHsW.exe
  2⤵
  PID:3384
- C:\Windows\System\MVruUkf.exe
  C:\Windows\System\MVruUkf.exe
  2⤵
  PID:3464
- C:\Windows\System\ovwKzqO.exe
  C:\Windows\System\ovwKzqO.exe
  2⤵
  PID:3504
- C:\Windows\System\gjxNZeE.exe
  C:\Windows\System\gjxNZeE.exe
  2⤵
  PID:3564
- C:\Windows\System\cuEBltz.exe
  C:\Windows\System\cuEBltz.exe
  2⤵
  PID:3628
- C:\Windows\System\cMtSdHW.exe
  C:\Windows\System\cMtSdHW.exe
  2⤵
  PID:3692
- C:\Windows\System\oDzerHg.exe
  C:\Windows\System\oDzerHg.exe
  2⤵
  PID:3728
- C:\Windows\System\OsnMzAM.exe
  C:\Windows\System\OsnMzAM.exe
  2⤵
  PID:3820
- C:\Windows\System\dsdBwet.exe
  C:\Windows\System\dsdBwet.exe
  2⤵
  PID:3884
- C:\Windows\System\GqcOxdM.exe
  C:\Windows\System\GqcOxdM.exe
  2⤵
  PID:3948
- C:\Windows\System\FrIsDdq.exe
  C:\Windows\System\FrIsDdq.exe
  2⤵
  PID:4048
- C:\Windows\System\lCHOcxk.exe
  C:\Windows\System\lCHOcxk.exe
  2⤵
  PID:2668
- C:\Windows\System\LweUrzT.exe
  C:\Windows\System\LweUrzT.exe
  2⤵
  PID:2464
- C:\Windows\System\HSMoSss.exe
  C:\Windows\System\HSMoSss.exe
  2⤵
  PID:4112
- C:\Windows\System\SBKVciY.exe
  C:\Windows\System\SBKVciY.exe
  2⤵
  PID:4128
- C:\Windows\System\QcSJhxs.exe
  C:\Windows\System\QcSJhxs.exe
  2⤵
  PID:4144
- C:\Windows\System\OGxgNbX.exe
  C:\Windows\System\OGxgNbX.exe
  2⤵
  PID:4160
- C:\Windows\System\PCOMmqu.exe
  C:\Windows\System\PCOMmqu.exe
  2⤵
  PID:4180
- C:\Windows\System\Ylctcuc.exe
  C:\Windows\System\Ylctcuc.exe
  2⤵
  PID:4196
- C:\Windows\System\HEfABwF.exe
  C:\Windows\System\HEfABwF.exe
  2⤵
  PID:4212
- C:\Windows\System\dMbbWZG.exe
  C:\Windows\System\dMbbWZG.exe
  2⤵
  PID:4228
- C:\Windows\System\ijyTuvC.exe
  C:\Windows\System\ijyTuvC.exe
  2⤵
  PID:4304
- C:\Windows\System\okVyvKR.exe
  C:\Windows\System\okVyvKR.exe
  2⤵
  PID:4324
- C:\Windows\System\UdnaRMu.exe
  C:\Windows\System\UdnaRMu.exe
  2⤵
  PID:4372
- C:\Windows\System\UMqXnKs.exe
  C:\Windows\System\UMqXnKs.exe
  2⤵
  PID:4392
- C:\Windows\System\GGgobZv.exe
  C:\Windows\System\GGgobZv.exe
  2⤵
  PID:4424
- C:\Windows\System\BbUxAaB.exe
  C:\Windows\System\BbUxAaB.exe
  2⤵
  PID:4440
- C:\Windows\System\DMoxGit.exe
  C:\Windows\System\DMoxGit.exe
  2⤵
  PID:4456
- C:\Windows\System\SDanMtV.exe
  C:\Windows\System\SDanMtV.exe
  2⤵
  PID:4472
- C:\Windows\System\SzDiGsl.exe
  C:\Windows\System\SzDiGsl.exe
  2⤵
  PID:4488
- C:\Windows\System\aOpjDcn.exe
  C:\Windows\System\aOpjDcn.exe
  2⤵
  PID:4504
- C:\Windows\System\LdrbrHi.exe
  C:\Windows\System\LdrbrHi.exe
  2⤵
  PID:4520
- C:\Windows\System\LFTaAWG.exe
  C:\Windows\System\LFTaAWG.exe
  2⤵
  PID:4536
- C:\Windows\System\vdaTtfQ.exe
  C:\Windows\System\vdaTtfQ.exe
  2⤵
  PID:4552
- C:\Windows\System\hxHiYOx.exe
  C:\Windows\System\hxHiYOx.exe
  2⤵
  PID:4568
- C:\Windows\System\uMfFAfu.exe
  C:\Windows\System\uMfFAfu.exe
  2⤵
  PID:4588
- C:\Windows\System\uiGDjAj.exe
  C:\Windows\System\uiGDjAj.exe
  2⤵
  PID:4604
- C:\Windows\System\XqdwMhY.exe
  C:\Windows\System\XqdwMhY.exe
  2⤵
  PID:4620
- C:\Windows\System\tBUXwNC.exe
  C:\Windows\System\tBUXwNC.exe
  2⤵
  PID:4636
- C:\Windows\System\TUGZAww.exe
  C:\Windows\System\TUGZAww.exe
  2⤵
  PID:4652
- C:\Windows\System\ELKTqde.exe
  C:\Windows\System\ELKTqde.exe
  2⤵
  PID:4668
- C:\Windows\System\SmmKVKr.exe
  C:\Windows\System\SmmKVKr.exe
  2⤵
  PID:4684
- C:\Windows\System\ZXFyPKE.exe
  C:\Windows\System\ZXFyPKE.exe
  2⤵
  PID:4700
- C:\Windows\System\ZjBoeVm.exe
  C:\Windows\System\ZjBoeVm.exe
  2⤵
  PID:4716
- C:\Windows\System\BShRATr.exe
  C:\Windows\System\BShRATr.exe
  2⤵
  PID:4732
- C:\Windows\System\DzOCSUM.exe
  C:\Windows\System\DzOCSUM.exe
  2⤵
  PID:4748
- C:\Windows\System\TUUazGW.exe
  C:\Windows\System\TUUazGW.exe
  2⤵
  PID:4768
- C:\Windows\System\AoChbcl.exe
  C:\Windows\System\AoChbcl.exe
  2⤵
  PID:4784
- C:\Windows\System\TMUmMPv.exe
  C:\Windows\System\TMUmMPv.exe
  2⤵
  PID:4800
- C:\Windows\System\TZYAIbo.exe
  C:\Windows\System\TZYAIbo.exe
  2⤵
  PID:4816
- C:\Windows\System\aoItXbr.exe
  C:\Windows\System\aoItXbr.exe
  2⤵
  PID:4832
- C:\Windows\System\PzHDjfi.exe
  C:\Windows\System\PzHDjfi.exe
  2⤵
  PID:4848
- C:\Windows\System\MmZDBmg.exe
  C:\Windows\System\MmZDBmg.exe
  2⤵
  PID:5040
- C:\Windows\System\HVXpjMX.exe
  C:\Windows\System\HVXpjMX.exe
  2⤵
  PID:5076
- C:\Windows\System\FTLTIoq.exe
  C:\Windows\System\FTLTIoq.exe
  2⤵
  PID:5092
- C:\Windows\System\ChkuPTs.exe
  C:\Windows\System\ChkuPTs.exe
  2⤵
  PID:5112
- C:\Windows\System\HfihoXq.exe
  C:\Windows\System\HfihoXq.exe
  2⤵
  PID:2888
- C:\Windows\System\FXyVxbR.exe
  C:\Windows\System\FXyVxbR.exe
  2⤵
  PID:2088
- C:\Windows\System\fjvMDoA.exe
  C:\Windows\System\fjvMDoA.exe
  2⤵
  PID:4072
- C:\Windows\System\FdfPmKD.exe
  C:\Windows\System\FdfPmKD.exe
  2⤵
  PID:1984
- C:\Windows\System\SVEflIe.exe
  C:\Windows\System\SVEflIe.exe
  2⤵
  PID:2312
- C:\Windows\System\SgENDre.exe
  C:\Windows\System\SgENDre.exe
  2⤵
  PID:3108
- C:\Windows\System\hiTYNML.exe
  C:\Windows\System\hiTYNML.exe
  2⤵
  PID:3380
- C:\Windows\System\zxzKRpi.exe
  C:\Windows\System\zxzKRpi.exe
  2⤵
  PID:3600
- C:\Windows\System\sqejDcQ.exe
  C:\Windows\System\sqejDcQ.exe
  2⤵
  PID:3992
- C:\Windows\System\eYxuiUN.exe
  C:\Windows\System\eYxuiUN.exe
  2⤵
  PID:2580
- C:\Windows\System\CXtyqdp.exe
  C:\Windows\System\CXtyqdp.exe
  2⤵
  PID:4152
- C:\Windows\System\HgwmXuf.exe
  C:\Windows\System\HgwmXuf.exe
  2⤵
  PID:4220
- C:\Windows\System\eWHrzSC.exe
  C:\Windows\System\eWHrzSC.exe
  2⤵
  PID:4388
- C:\Windows\System\bJItgql.exe
  C:\Windows\System\bJItgql.exe
  2⤵
  PID:4464
- C:\Windows\System\HuBFmAg.exe
  C:\Windows\System\HuBFmAg.exe
  2⤵
  PID:4528
- C:\Windows\System\FvBAzfS.exe
  C:\Windows\System\FvBAzfS.exe
  2⤵
  PID:540
- C:\Windows\System\NxIEVbr.exe
  C:\Windows\System\NxIEVbr.exe
  2⤵
  PID:4632
- C:\Windows\System\AmFFnFf.exe
  C:\Windows\System\AmFFnFf.exe
  2⤵
  PID:4696
- C:\Windows\System\aETUBsA.exe
  C:\Windows\System\aETUBsA.exe
  2⤵
  PID:4764
- C:\Windows\System\neAieXS.exe
  C:\Windows\System\neAieXS.exe
  2⤵
  PID:1788
- C:\Windows\System\pgFwOwX.exe
  C:\Windows\System\pgFwOwX.exe
  2⤵
  PID:2488
- C:\Windows\System\gpzrsXg.exe
  C:\Windows\System\gpzrsXg.exe
  2⤵
  PID:640
- C:\Windows\System\tbDwURO.exe
  C:\Windows\System\tbDwURO.exe
  2⤵
  PID:2548
- C:\Windows\System\pICiDQO.exe
  C:\Windows\System\pICiDQO.exe
  2⤵
  PID:3228
- C:\Windows\System\bjahDKm.exe
  C:\Windows\System\bjahDKm.exe
  2⤵
  PID:3288
- C:\Windows\System\ScYmtYJ.exe
  C:\Windows\System\ScYmtYJ.exe
  2⤵
  PID:3352
- C:\Windows\System\rbCNVGp.exe
  C:\Windows\System\rbCNVGp.exe
  2⤵
  PID:3404
- C:\Windows\System\DfEGBpN.exe
  C:\Windows\System\DfEGBpN.exe
  2⤵
  PID:3424
- C:\Windows\System\UTKAegu.exe
  C:\Windows\System\UTKAegu.exe
  2⤵
  PID:3548
- C:\Windows\System\aFFxntd.exe
  C:\Windows\System\aFFxntd.exe
  2⤵
  PID:4792
- C:\Windows\System\Ezjfgae.exe
  C:\Windows\System\Ezjfgae.exe
  2⤵
  PID:2832
- C:\Windows\System\gjoHaoo.exe
  C:\Windows\System\gjoHaoo.exe
  2⤵
  PID:2992
- C:\Windows\System\sVcZlNO.exe
  C:\Windows\System\sVcZlNO.exe
  2⤵
  PID:4868
- C:\Windows\System\mrSafNt.exe
  C:\Windows\System\mrSafNt.exe
  2⤵
  PID:4888
- C:\Windows\System\djRGOQv.exe
  C:\Windows\System\djRGOQv.exe
  2⤵
  PID:4904
- C:\Windows\System\memZmdE.exe
  C:\Windows\System\memZmdE.exe
  2⤵
  PID:4924
- C:\Windows\System\spcPjbe.exe
  C:\Windows\System\spcPjbe.exe
  2⤵
  PID:4940
- C:\Windows\System\lcwNSsn.exe
  C:\Windows\System\lcwNSsn.exe
  2⤵
  PID:4956
- C:\Windows\System\PMYJaFT.exe
  C:\Windows\System\PMYJaFT.exe
  2⤵
  PID:4968
- C:\Windows\System\AqxEVmE.exe
  C:\Windows\System\AqxEVmE.exe
  2⤵
  PID:4988
- C:\Windows\System\fRapdLD.exe
  C:\Windows\System\fRapdLD.exe
  2⤵
  PID:5028
- C:\Windows\System\VWrGIxf.exe
  C:\Windows\System\VWrGIxf.exe
  2⤵
  PID:2408
- C:\Windows\System\jrghJZS.exe
  C:\Windows\System\jrghJZS.exe
  2⤵
  PID:4012
- C:\Windows\System\mcTewLO.exe
  C:\Windows\System\mcTewLO.exe
  2⤵
  PID:4028
- C:\Windows\System\EXVDvAu.exe
  C:\Windows\System\EXVDvAu.exe
  2⤵
  PID:3532
- C:\Windows\System\Swuwclx.exe
  C:\Windows\System\Swuwclx.exe
  2⤵
  PID:5084
- C:\Windows\System\VptAdMF.exe
  C:\Windows\System\VptAdMF.exe
  2⤵
  PID:1504
- C:\Windows\System\FSZYXTt.exe
  C:\Windows\System\FSZYXTt.exe
  2⤵
  PID:1772
- C:\Windows\System\LXRNqqZ.exe
  C:\Windows\System\LXRNqqZ.exe
  2⤵
  PID:3044
- C:\Windows\System\WukdybZ.exe
  C:\Windows\System\WukdybZ.exe
  2⤵
  PID:3212
- C:\Windows\System\ZYeCqHa.exe
  C:\Windows\System\ZYeCqHa.exe
  2⤵
  PID:3852
- C:\Windows\System\gcxlFuI.exe
  C:\Windows\System\gcxlFuI.exe
  2⤵
  PID:4316
- C:\Windows\System\ZlVFiPd.exe
  C:\Windows\System\ZlVFiPd.exe
  2⤵
  PID:4176
- C:\Windows\System\SoNbvny.exe
  C:\Windows\System\SoNbvny.exe
  2⤵
  PID:4244
- C:\Windows\System\dlTlrVG.exe
  C:\Windows\System\dlTlrVG.exe
  2⤵
  PID:4248
- C:\Windows\System\LlhBTBQ.exe
  C:\Windows\System\LlhBTBQ.exe
  2⤵
  PID:4256
- C:\Windows\System\ktnQOYw.exe
  C:\Windows\System\ktnQOYw.exe
  2⤵
  PID:4264
- C:\Windows\System\fhpANww.exe
  C:\Windows\System\fhpANww.exe
  2⤵
  PID:1908
- C:\Windows\System\ntugurV.exe
  C:\Windows\System\ntugurV.exe
  2⤵
  PID:4284
- C:\Windows\System\pxkURzg.exe
  C:\Windows\System\pxkURzg.exe
  2⤵
  PID:2196
- C:\Windows\System\ELkNLQA.exe
  C:\Windows\System\ELkNLQA.exe
  2⤵
  PID:4728
- C:\Windows\System\mURsZwV.exe
  C:\Windows\System\mURsZwV.exe
  2⤵
  PID:4600
- C:\Windows\System\WLYSTGv.exe
  C:\Windows\System\WLYSTGv.exe
  2⤵
  PID:2116
- C:\Windows\System\NaynvYg.exe
  C:\Windows\System\NaynvYg.exe
  2⤵
  PID:3256
- C:\Windows\System\RbUSIOd.exe
  C:\Windows\System\RbUSIOd.exe
  2⤵
  PID:3488
- C:\Windows\System\fhtnJgd.exe
  C:\Windows\System\fhtnJgd.exe
  2⤵
  PID:4860
- C:\Windows\System\moWGuDJ.exe
  C:\Windows\System\moWGuDJ.exe
  2⤵
  PID:4932
- C:\Windows\System\cnvgmei.exe
  C:\Windows\System\cnvgmei.exe
  2⤵
  PID:4972
- C:\Windows\System\mrYAQat.exe
  C:\Windows\System\mrYAQat.exe
  2⤵
  PID:5008
- C:\Windows\System\KLhDOyG.exe
  C:\Windows\System\KLhDOyG.exe
  2⤵
  PID:1544
- C:\Windows\System\RcwuIzp.exe
  C:\Windows\System\RcwuIzp.exe
  2⤵
  PID:4344
- C:\Windows\System\csdylet.exe
  C:\Windows\System\csdylet.exe
  2⤵
  PID:4364
- C:\Windows\System\IaLDVDM.exe
  C:\Windows\System\IaLDVDM.exe
  2⤵
  PID:4416
- C:\Windows\System\BeBezJw.exe
  C:\Windows\System\BeBezJw.exe
  2⤵
  PID:4480
- C:\Windows\System\WQzXeAH.exe
  C:\Windows\System\WQzXeAH.exe
  2⤵
  PID:5136
- C:\Windows\System\duwWepY.exe
  C:\Windows\System\duwWepY.exe
  2⤵
  PID:5152
- C:\Windows\System\NYMqZcF.exe
  C:\Windows\System\NYMqZcF.exe
  2⤵
  PID:5168
- C:\Windows\System\BfEVZTa.exe
  C:\Windows\System\BfEVZTa.exe
  2⤵
  PID:5188
- C:\Windows\System\XrZQqmz.exe
  C:\Windows\System\XrZQqmz.exe
  2⤵
  PID:5204
- C:\Windows\System\axJXGeh.exe
  C:\Windows\System\axJXGeh.exe
  2⤵
  PID:5220
- C:\Windows\System\OjPtYIU.exe
  C:\Windows\System\OjPtYIU.exe
  2⤵
  PID:5236
- C:\Windows\System\SmIwzME.exe
  C:\Windows\System\SmIwzME.exe
  2⤵
  PID:5256
- C:\Windows\System\Ofiqevx.exe
  C:\Windows\System\Ofiqevx.exe
  2⤵
  PID:5272
- C:\Windows\System\qgSpKFL.exe
  C:\Windows\System\qgSpKFL.exe
  2⤵
  PID:5288
- C:\Windows\System\AeycQpI.exe
  C:\Windows\System\AeycQpI.exe
  2⤵
  PID:5304
- C:\Windows\System\EszEfug.exe
  C:\Windows\System\EszEfug.exe
  2⤵
  PID:5320
- C:\Windows\System\anHjMUM.exe
  C:\Windows\System\anHjMUM.exe
  2⤵
  PID:5336
- C:\Windows\System\pGsYBnu.exe
  C:\Windows\System\pGsYBnu.exe
  2⤵
  PID:5352
- C:\Windows\System\gITlCNf.exe
  C:\Windows\System\gITlCNf.exe
  2⤵
  PID:5368
- C:\Windows\System\TGQVswh.exe
  C:\Windows\System\TGQVswh.exe
  2⤵
  PID:5384
- C:\Windows\System\xyJwbhw.exe
  C:\Windows\System\xyJwbhw.exe
  2⤵
  PID:5400
- C:\Windows\System\PUtGHlb.exe
  C:\Windows\System\PUtGHlb.exe
  2⤵
  PID:5416
- C:\Windows\System\omwAVVS.exe
  C:\Windows\System\omwAVVS.exe
  2⤵
  PID:5432
- C:\Windows\System\tchxxHL.exe
  C:\Windows\System\tchxxHL.exe
  2⤵
  PID:5448
- C:\Windows\System\iEzxtan.exe
  C:\Windows\System\iEzxtan.exe
  2⤵
  PID:5464
- C:\Windows\System\dgIntFY.exe
  C:\Windows\System\dgIntFY.exe
  2⤵
  PID:5480
- C:\Windows\System\FYKQvEz.exe
  C:\Windows\System\FYKQvEz.exe
  2⤵
  PID:5496
- C:\Windows\System\nkfsrrM.exe
  C:\Windows\System\nkfsrrM.exe
  2⤵
  PID:5512
- C:\Windows\System\AJDNGMf.exe
  C:\Windows\System\AJDNGMf.exe
  2⤵
  PID:5528
- C:\Windows\System\apISvmK.exe
  C:\Windows\System\apISvmK.exe
  2⤵
  PID:5548
- C:\Windows\System\jvVkuxH.exe
  C:\Windows\System\jvVkuxH.exe
  2⤵
  PID:5564
- C:\Windows\System\nKlTIHY.exe
  C:\Windows\System\nKlTIHY.exe
  2⤵
  PID:5580
- C:\Windows\System\TtOPphX.exe
  C:\Windows\System\TtOPphX.exe
  2⤵
  PID:5664
- C:\Windows\System\TyyKfOL.exe
  C:\Windows\System\TyyKfOL.exe
  2⤵
  PID:5704
- C:\Windows\System\eaywTha.exe
  C:\Windows\System\eaywTha.exe
  2⤵
  PID:5812
- C:\Windows\System\aXWRZnR.exe
  C:\Windows\System\aXWRZnR.exe
  2⤵
  PID:5860
- C:\Windows\System\yAswmmY.exe
  C:\Windows\System\yAswmmY.exe
  2⤵
  PID:5912
- C:\Windows\System\YDeEuQi.exe
  C:\Windows\System\YDeEuQi.exe
  2⤵
  PID:5932
- C:\Windows\System\oylZWhW.exe
  C:\Windows\System\oylZWhW.exe
  2⤵
  PID:5948
- C:\Windows\System\akUSDda.exe
  C:\Windows\System\akUSDda.exe
  2⤵
  PID:5972
- C:\Windows\System\xUikaMb.exe
  C:\Windows\System\xUikaMb.exe
  2⤵
  PID:6000
- C:\Windows\System\tHttnlk.exe
  C:\Windows\System\tHttnlk.exe
  2⤵
  PID:6048
- C:\Windows\System\kKBRTCE.exe
  C:\Windows\System\kKBRTCE.exe
  2⤵
  PID:6092
- C:\Windows\System\mnThPUz.exe
  C:\Windows\System\mnThPUz.exe
  2⤵
  PID:6116
- C:\Windows\System\iSdFldE.exe
  C:\Windows\System\iSdFldE.exe
  2⤵
  PID:6132
- C:\Windows\System\rfHJsSB.exe
  C:\Windows\System\rfHJsSB.exe
  2⤵
  PID:4544
- C:\Windows\System\AyxIJdq.exe
  C:\Windows\System\AyxIJdq.exe
  2⤵
  PID:1996
- C:\Windows\System\FBwEjev.exe
  C:\Windows\System\FBwEjev.exe
  2⤵
  PID:5020
- C:\Windows\System\faKwzPg.exe
  C:\Windows\System\faKwzPg.exe
  2⤵
  PID:4320
- C:\Windows\System\sXCtStt.exe
  C:\Windows\System\sXCtStt.exe
  2⤵
  PID:5004
- C:\Windows\System\dkdxGyh.exe
  C:\Windows\System\dkdxGyh.exe
  2⤵
  PID:4808
- C:\Windows\System\fLKVcuu.exe
  C:\Windows\System\fLKVcuu.exe
  2⤵
  PID:3436
- C:\Windows\System\Pwuwyrc.exe
  C:\Windows\System\Pwuwyrc.exe
  2⤵
  PID:5064
- C:\Windows\System\NvdMtnp.exe
  C:\Windows\System\NvdMtnp.exe
  2⤵
  PID:2416
- C:\Windows\System\JEvtEjG.exe
  C:\Windows\System\JEvtEjG.exe
  2⤵
  PID:4872
- C:\Windows\System\hywSydQ.exe
  C:\Windows\System\hywSydQ.exe
  2⤵
  PID:5268
- C:\Windows\System\FHUILeu.exe
  C:\Windows\System\FHUILeu.exe
  2⤵
  PID:5360
- C:\Windows\System\zYjwign.exe
  C:\Windows\System\zYjwign.exe
  2⤵
  PID:5396
- C:\Windows\System\zZvdBaC.exe
  C:\Windows\System\zZvdBaC.exe
  2⤵
  PID:5492
- C:\Windows\System\SiCWOJs.exe
  C:\Windows\System\SiCWOJs.exe
  2⤵
  PID:3776
- C:\Windows\System\LWErsBT.exe
  C:\Windows\System\LWErsBT.exe
  2⤵
  PID:3872
- C:\Windows\System\UwSdHZM.exe
  C:\Windows\System\UwSdHZM.exe
  2⤵
  PID:3964
- C:\Windows\System\HcKEahU.exe
  C:\Windows\System\HcKEahU.exe
  2⤵
  PID:2324
- C:\Windows\System\cRbQiyk.exe
  C:\Windows\System\cRbQiyk.exe
  2⤵
  PID:812
- C:\Windows\System\YWNxoJY.exe
  C:\Windows\System\YWNxoJY.exe
  2⤵
  PID:3460
- C:\Windows\System\MXFGIxQ.exe
  C:\Windows\System\MXFGIxQ.exe
  2⤵
  PID:4060
- C:\Windows\System\GYrLMHg.exe
  C:\Windows\System\GYrLMHg.exe
  2⤵
  PID:4136
- C:\Windows\System\nTGTwKX.exe
  C:\Windows\System\nTGTwKX.exe
  2⤵
  PID:5716
- C:\Windows\System\XCxIeAX.exe
  C:\Windows\System\XCxIeAX.exe
  2⤵
  PID:2612
- C:\Windows\System\liFRCEZ.exe
  C:\Windows\System\liFRCEZ.exe
  2⤵
  PID:5108
- C:\Windows\System\aqFgDgl.exe
  C:\Windows\System\aqFgDgl.exe
  2⤵
  PID:3500
- C:\Windows\System\OMXQoxI.exe
  C:\Windows\System\OMXQoxI.exe
  2⤵
  PID:4188
- C:\Windows\System\lCcvArl.exe
  C:\Windows\System\lCcvArl.exe
  2⤵
  PID:4692
- C:\Windows\System\WyzIcvY.exe
  C:\Windows\System\WyzIcvY.exe
  2⤵
  PID:3192
- C:\Windows\System\zVuTQPJ.exe
  C:\Windows\System\zVuTQPJ.exe
  2⤵
  PID:3416
- C:\Windows\System\HOahANx.exe
  C:\Windows\System\HOahANx.exe
  2⤵
  PID:3616
- C:\Windows\System\cWZZzaP.exe
  C:\Windows\System\cWZZzaP.exe
  2⤵
  PID:4192
- C:\Windows\System\IwuQBYi.exe
  C:\Windows\System\IwuQBYi.exe
  2⤵
  PID:4880
- C:\Windows\System\IBEHwHZ.exe
  C:\Windows\System\IBEHwHZ.exe
  2⤵
  PID:4948
- C:\Windows\System\JzSDwpL.exe
  C:\Windows\System\JzSDwpL.exe
  2⤵
  PID:1668
- C:\Windows\System\iEJyusq.exe
  C:\Windows\System\iEJyusq.exe
  2⤵
  PID:3772
- C:\Windows\System\AWlTeHj.exe
  C:\Windows\System\AWlTeHj.exe
  2⤵
  PID:3536
- C:\Windows\System\lnMXfMW.exe
  C:\Windows\System\lnMXfMW.exe
  2⤵
  PID:3244
- C:\Windows\System\YPxsMoi.exe
  C:\Windows\System\YPxsMoi.exe
  2⤵
  PID:4236
- C:\Windows\System\TJjROQd.exe
  C:\Windows\System\TJjROQd.exe
  2⤵
  PID:4276
- C:\Windows\System\mLdFJWj.exe
  C:\Windows\System\mLdFJWj.exe
  2⤵
  PID:4496
- C:\Windows\System\vtSvJkf.exe
  C:\Windows\System\vtSvJkf.exe
  2⤵
  PID:4936
- C:\Windows\System\yxXWyXw.exe
  C:\Windows\System\yxXWyXw.exe
  2⤵
  PID:4360
- C:\Windows\System\YoSoRXo.exe
  C:\Windows\System\YoSoRXo.exe
  2⤵
  PID:5144
- C:\Windows\System\xjOqkuK.exe
  C:\Windows\System\xjOqkuK.exe
  2⤵
  PID:5184
- C:\Windows\System\KPyPOhn.exe
  C:\Windows\System\KPyPOhn.exe
  2⤵
  PID:5248
- C:\Windows\System\rvFaHcp.exe
  C:\Windows\System\rvFaHcp.exe
  2⤵
  PID:5284
- C:\Windows\System\tNfOZPP.exe
  C:\Windows\System\tNfOZPP.exe
  2⤵
  PID:5348
- C:\Windows\System\YrBhEhs.exe
  C:\Windows\System\YrBhEhs.exe
  2⤵
  PID:5412
- C:\Windows\System\BRyLYln.exe
  C:\Windows\System\BRyLYln.exe
  2⤵
  PID:5476
- C:\Windows\System\kafGTxQ.exe
  C:\Windows\System\kafGTxQ.exe
  2⤵
  PID:5540
- C:\Windows\System\nqFUkDO.exe
  C:\Windows\System\nqFUkDO.exe
  2⤵
  PID:5672
- C:\Windows\System\yPKVbTa.exe
  C:\Windows\System\yPKVbTa.exe
  2⤵
  PID:5696
- C:\Windows\System\cgAzByO.exe
  C:\Windows\System\cgAzByO.exe
  2⤵
  PID:5728
- C:\Windows\System\wYhsNwu.exe
  C:\Windows\System\wYhsNwu.exe
  2⤵
  PID:5744
- C:\Windows\System\aeFdOIV.exe
  C:\Windows\System\aeFdOIV.exe
  2⤵
  PID:5760
- C:\Windows\System\pORtBaC.exe
  C:\Windows\System\pORtBaC.exe
  2⤵
  PID:5776
- C:\Windows\System\pqQtBfN.exe
  C:\Windows\System\pqQtBfN.exe
  2⤵
  PID:5784
- C:\Windows\System\RbeTfaC.exe
  C:\Windows\System\RbeTfaC.exe
  2⤵
  PID:2504
- C:\Windows\System\WNuEgJl.exe
  C:\Windows\System\WNuEgJl.exe
  2⤵
  PID:5924
- C:\Windows\System\jdObukZ.exe
  C:\Windows\System\jdObukZ.exe
  2⤵
  PID:2492
- C:\Windows\System\zAMMHqj.exe
  C:\Windows\System\zAMMHqj.exe
  2⤵
  PID:6036
- C:\Windows\System\JrFOGHe.exe
  C:\Windows\System\JrFOGHe.exe
  2⤵
  PID:5984
- C:\Windows\System\oZmKHYX.exe
  C:\Windows\System\oZmKHYX.exe
  2⤵
  PID:6108
- C:\Windows\System\uhZFlJZ.exe
  C:\Windows\System\uhZFlJZ.exe
  2⤵
  PID:6068
- C:\Windows\System\lZOCFSR.exe
  C:\Windows\System\lZOCFSR.exe
  2⤵
  PID:6084
- C:\Windows\System\ygZnazQ.exe
  C:\Windows\System\ygZnazQ.exe
  2⤵
  PID:4484
- C:\Windows\System\NljQaPM.exe
  C:\Windows\System\NljQaPM.exe
  2⤵
  PID:6124
- C:\Windows\System\EaHHDwE.exe
  C:\Windows\System\EaHHDwE.exe
  2⤵
  PID:2736
- C:\Windows\System\czYNapq.exe
  C:\Windows\System\czYNapq.exe
  2⤵
  PID:1052
- C:\Windows\System\TuiRzYp.exe
  C:\Windows\System\TuiRzYp.exe
  2⤵
  PID:4584
- C:\Windows\System\QcIREBu.exe
  C:\Windows\System\QcIREBu.exe
  2⤵
  PID:816
- C:\Windows\System\kmFTePa.exe
  C:\Windows\System\kmFTePa.exe
  2⤵
  PID:2064
- C:\Windows\System\wVyJtxq.exe
  C:\Windows\System\wVyJtxq.exe
  2⤵
  PID:2708
- C:\Windows\System\RdLiRFO.exe
  C:\Windows\System\RdLiRFO.exe
  2⤵
  PID:1268
- C:\Windows\System\OqTNSEk.exe
  C:\Windows\System\OqTNSEk.exe
  2⤵
  PID:4760
- C:\Windows\System\BKnFBeY.exe
  C:\Windows\System\BKnFBeY.exe
  2⤵
  PID:4776
- C:\Windows\System\xcoIAJj.exe
  C:\Windows\System\xcoIAJj.exe
  2⤵
  PID:2068
- C:\Windows\System\IdGZwCy.exe
  C:\Windows\System\IdGZwCy.exe
  2⤵
  PID:4404
- C:\Windows\System\yfRQPzS.exe
  C:\Windows\System\yfRQPzS.exe
  2⤵
  PID:5128
- C:\Windows\System\gUnOtOw.exe
  C:\Windows\System\gUnOtOw.exe
  2⤵
  PID:5164
- C:\Windows\System\uVMLQTJ.exe
  C:\Windows\System\uVMLQTJ.exe
  2⤵
  PID:2348
- C:\Windows\System\IUZXVTX.exe
  C:\Windows\System\IUZXVTX.exe
  2⤵
  PID:5196
- C:\Windows\System\RPMtvwj.exe
  C:\Windows\System\RPMtvwj.exe
  2⤵
  PID:5604
- C:\Windows\System\fBYexqq.exe
  C:\Windows\System\fBYexqq.exe
  2⤵
  PID:5596
- C:\Windows\System\hYxQQig.exe
  C:\Windows\System\hYxQQig.exe
  2⤵
  PID:5680
- C:\Windows\System\TyNJovK.exe
  C:\Windows\System\TyNJovK.exe
  2⤵
  PID:5624
- C:\Windows\System\Uijkpdq.exe
  C:\Windows\System\Uijkpdq.exe
  2⤵
  PID:2020
- C:\Windows\System\rnjjnUh.exe
  C:\Windows\System\rnjjnUh.exe
  2⤵
  PID:5640
- C:\Windows\System\wbKREkU.exe
  C:\Windows\System\wbKREkU.exe
  2⤵
  PID:5652
- C:\Windows\System\dspcbRx.exe
  C:\Windows\System\dspcbRx.exe
  2⤵
  PID:2616
- C:\Windows\System\RnpEGZy.exe
  C:\Windows\System\RnpEGZy.exe
  2⤵
  PID:3160
- C:\Windows\System\mKYxetT.exe
  C:\Windows\System\mKYxetT.exe
  2⤵
  PID:2988
- C:\Windows\System\lDSrMnG.exe
  C:\Windows\System\lDSrMnG.exe
  2⤵
  PID:3584
- C:\Windows\System\aeqfDek.exe
  C:\Windows\System\aeqfDek.exe
  2⤵
  PID:3644
- C:\Windows\System\BSwwCaN.exe
  C:\Windows\System\BSwwCaN.exe
  2⤵
  PID:3680
- C:\Windows\System\iRAgTEM.exe
  C:\Windows\System\iRAgTEM.exe
  2⤵
  PID:5264
- C:\Windows\System\YPJQDQa.exe
  C:\Windows\System\YPJQDQa.exe
  2⤵
  PID:3400
- C:\Windows\System\pNUifTy.exe
  C:\Windows\System\pNUifTy.exe
  2⤵
  PID:772
- C:\Windows\System\IVQwbyP.exe
  C:\Windows\System\IVQwbyP.exe
  2⤵
  PID:5588
- C:\Windows\System\wWEyMMV.exe
  C:\Windows\System\wWEyMMV.exe
  2⤵
  PID:1288
- C:\Windows\System\BQReVys.exe
  C:\Windows\System\BQReVys.exe
  2⤵
  PID:4252
- C:\Windows\System\CNJjylz.exe
  C:\Windows\System\CNJjylz.exe
  2⤵
  PID:4336
- C:\Windows\System\KkaZnWh.exe
  C:\Windows\System\KkaZnWh.exe
  2⤵
  PID:5056
- C:\Windows\System\yEtuIRh.exe
  C:\Windows\System\yEtuIRh.exe
  2⤵
  PID:3808
- C:\Windows\System\qbTnLPW.exe
  C:\Windows\System\qbTnLPW.exe
  2⤵
  PID:3972
- C:\Windows\System\PpJMudb.exe
  C:\Windows\System\PpJMudb.exe
  2⤵
  PID:1936
- C:\Windows\System\wjXqQqQ.exe
  C:\Windows\System\wjXqQqQ.exe
  2⤵
  PID:3308
- C:\Windows\System\tguqafc.exe
  C:\Windows\System\tguqafc.exe
  2⤵
  PID:3364
- C:\Windows\System\HqcBdJT.exe
  C:\Windows\System\HqcBdJT.exe
  2⤵
  PID:2496
- C:\Windows\System\yDjKGza.exe
  C:\Windows\System\yDjKGza.exe
  2⤵
  PID:4560
- C:\Windows\System\zuOExbG.exe
  C:\Windows\System\zuOExbG.exe
  2⤵
  PID:3580
- C:\Windows\System\LvfWeCz.exe
  C:\Windows\System\LvfWeCz.exe
  2⤵
  PID:5036
- C:\Windows\System\SdoVNHN.exe
  C:\Windows\System\SdoVNHN.exe
  2⤵
  PID:4124
- C:\Windows\System\HVKECSl.exe
  C:\Windows\System\HVKECSl.exe
  2⤵
  PID:4452
- C:\Windows\System\ppYuJdG.exe
  C:\Windows\System\ppYuJdG.exe
  2⤵
  PID:5536
- C:\Windows\System\lOSrtqv.exe
  C:\Windows\System\lOSrtqv.exe
  2⤵
  PID:5576
- C:\Windows\System\rKpSoEO.exe
  C:\Windows\System\rKpSoEO.exe
  2⤵
  PID:5344
- C:\Windows\System\CGtlwNa.exe
  C:\Windows\System\CGtlwNa.exe
  2⤵
  PID:5736
- C:\Windows\System\JtfAXYB.exe
  C:\Windows\System\JtfAXYB.exe
  2⤵
  PID:5756
- C:\Windows\System\klzNEpv.exe
  C:\Windows\System\klzNEpv.exe
  2⤵
  PID:5844
- C:\Windows\System\KDDPyNC.exe
  C:\Windows\System\KDDPyNC.exe
  2⤵
  PID:5848
- C:\Windows\System\OBbNPVE.exe
  C:\Windows\System\OBbNPVE.exe
  2⤵
  PID:5808
- C:\Windows\System\dNtNOAT.exe
  C:\Windows\System\dNtNOAT.exe
  2⤵
  PID:5840
- C:\Windows\System\RkTbqyB.exe
  C:\Windows\System\RkTbqyB.exe
  2⤵
  PID:5964
- C:\Windows\System\AmZIPXz.exe
  C:\Windows\System\AmZIPXz.exe
  2⤵
  PID:6008
- C:\Windows\System\posFeyv.exe
  C:\Windows\System\posFeyv.exe
  2⤵
  PID:6016
- C:\Windows\System\BlYSPVt.exe
  C:\Windows\System\BlYSPVt.exe
  2⤵
  PID:5980
- C:\Windows\System\vpwtShV.exe
  C:\Windows\System\vpwtShV.exe
  2⤵
  PID:6032
- C:\Windows\System\jaoiCWP.exe
  C:\Windows\System\jaoiCWP.exe
  2⤵
  PID:6104
- C:\Windows\System\tyHHZia.exe
  C:\Windows\System\tyHHZia.exe
  2⤵
  PID:6140
- C:\Windows\System\EMmEcPl.exe
  C:\Windows\System\EMmEcPl.exe
  2⤵
  PID:632
- C:\Windows\System\QKEQuja.exe
  C:\Windows\System\QKEQuja.exe
  2⤵
  PID:4708
- C:\Windows\System\pRpKOmH.exe
  C:\Windows\System\pRpKOmH.exe
  2⤵
  PID:2052
- C:\Windows\System\PSLKYtz.exe
  C:\Windows\System\PSLKYtz.exe
  2⤵
  PID:2976
- C:\Windows\System\tRfRPDA.exe
  C:\Windows\System\tRfRPDA.exe
  2⤵
  PID:4576
- C:\Windows\System\sMESagI.exe
  C:\Windows\System\sMESagI.exe
  2⤵
  PID:6064
- C:\Windows\System\ebSmbrE.exe
  C:\Windows\System\ebSmbrE.exe
  2⤵
  PID:1864
- C:\Windows\System\bSkpTaF.exe
  C:\Windows\System\bSkpTaF.exe
  2⤵
  PID:4740
- C:\Windows\System\yhiyRAL.exe
  C:\Windows\System\yhiyRAL.exe
  2⤵
  PID:5228
- C:\Windows\System\zVbcezj.exe
  C:\Windows\System\zVbcezj.exe
  2⤵
  PID:5636
- C:\Windows\System\MufajNd.exe
  C:\Windows\System\MufajNd.exe
  2⤵
  PID:5608
- C:\Windows\System\DlnmIOy.exe
  C:\Windows\System\DlnmIOy.exe
  2⤵
  PID:2780
- C:\Windows\System\kELDwpB.exe
  C:\Windows\System\kELDwpB.exe
  2⤵
  PID:2812
- C:\Windows\System\pQyvvXB.exe
  C:\Windows\System\pQyvvXB.exe
  2⤵
  PID:3516
- C:\Windows\System\doPwUEg.exe
  C:\Windows\System\doPwUEg.exe
  2⤵
  PID:3360
- C:\Windows\System\FYlRihT.exe
  C:\Windows\System\FYlRihT.exe
  2⤵
  PID:3484
- C:\Windows\System\IbdZRlz.exe
  C:\Windows\System\IbdZRlz.exe
  2⤵
  PID:3868
- C:\Windows\System\FtfYbDm.exe
  C:\Windows\System\FtfYbDm.exe
  2⤵
  PID:4340
- C:\Windows\System\eIJQMjd.exe
  C:\Windows\System\eIJQMjd.exe
  2⤵
  PID:5460
- C:\Windows\System\mDFRFzc.exe
  C:\Windows\System\mDFRFzc.exe
  2⤵
  PID:3744
- C:\Windows\System\RnFyNiP.exe
  C:\Windows\System\RnFyNiP.exe
  2⤵
  PID:924
- C:\Windows\System\rTRyEya.exe
  C:\Windows\System\rTRyEya.exe
  2⤵
  PID:4296
- C:\Windows\System\ZkortUJ.exe
  C:\Windows\System\ZkortUJ.exe
  2⤵
  PID:4088
- C:\Windows\System\vwFQJWX.exe
  C:\Windows\System\vwFQJWX.exe
  2⤵
  PID:4108
- C:\Windows\System\OKxQERj.exe
  C:\Windows\System\OKxQERj.exe
  2⤵
  PID:1928
- C:\Windows\System\pzBlpLY.exe
  C:\Windows\System\pzBlpLY.exe
  2⤵
  PID:4312
- C:\Windows\System\hshmsUg.exe
  C:\Windows\System\hshmsUg.exe
  2⤵
  PID:1740
- C:\Windows\System\GcLcgil.exe
  C:\Windows\System\GcLcgil.exe
  2⤵
  PID:3996
- C:\Windows\System\Sfskixy.exe
  C:\Windows\System\Sfskixy.exe
  2⤵
  PID:564
- C:\Windows\System\edZUQJz.exe
  C:\Windows\System\edZUQJz.exe
  2⤵
  PID:3420
- C:\Windows\System\LiKoTEN.exe
  C:\Windows\System\LiKoTEN.exe
  2⤵
  PID:2228
- C:\Windows\System\HnHaWeC.exe
  C:\Windows\System\HnHaWeC.exe
  2⤵
  PID:4448
- C:\Windows\System\EhqizNQ.exe
  C:\Windows\System\EhqizNQ.exe
  2⤵
  PID:5724
- C:\Windows\System\grLEsUa.exe
  C:\Windows\System\grLEsUa.exe
  2⤵
  PID:5804
- C:\Windows\System\HvGljta.exe
  C:\Windows\System\HvGljta.exe
  2⤵
  PID:5280
- C:\Windows\System\fserlWO.exe
  C:\Windows\System\fserlWO.exe
  2⤵
  PID:5800
- C:\Windows\System\BotkRQL.exe
  C:\Windows\System\BotkRQL.exe
  2⤵
  PID:5772
- C:\Windows\System\jcfXaNH.exe
  C:\Windows\System\jcfXaNH.exe
  2⤵
  PID:6024
- C:\Windows\System\oulmaKU.exe
  C:\Windows\System\oulmaKU.exe
  2⤵
  PID:5796
- C:\Windows\System\iYxWGlW.exe
  C:\Windows\System\iYxWGlW.exe
  2⤵
  PID:5960
- C:\Windows\System\mRPrbLh.exe
  C:\Windows\System\mRPrbLh.exe
  2⤵
  PID:5996
- C:\Windows\System\IFWAyQt.exe
  C:\Windows\System\IFWAyQt.exe
  2⤵
  PID:6044
- C:\Windows\System\JcdocVf.exe
  C:\Windows\System\JcdocVf.exe
  2⤵
  PID:2864
- C:\Windows\System\sYvwKdW.exe
  C:\Windows\System\sYvwKdW.exe
  2⤵
  PID:2152
- C:\Windows\System\VAmpjOP.exe
  C:\Windows\System\VAmpjOP.exe
  2⤵
  PID:1528
- C:\Windows\System\zGUgcIm.exe
  C:\Windows\System\zGUgcIm.exe
  2⤵
  PID:5048
- C:\Windows\System\DindTDy.exe
  C:\Windows\System\DindTDy.exe
  2⤵
  PID:4400
- C:\Windows\System\TUHvvYk.exe
  C:\Windows\System\TUHvvYk.exe
  2⤵
  PID:4644
- C:\Windows\System\ZXxQZBT.exe
  C:\Windows\System\ZXxQZBT.exe
  2⤵
  PID:1804
- C:\Windows\System\DeUiUkX.exe
  C:\Windows\System\DeUiUkX.exe
  2⤵
  PID:4172
- C:\Windows\System\MfQINHc.exe
  C:\Windows\System\MfQINHc.exe
  2⤵
  PID:5160
- C:\Windows\System\sttpEgJ.exe
  C:\Windows\System\sttpEgJ.exe
  2⤵
  PID:3936
- C:\Windows\System\wdNmypL.exe
  C:\Windows\System\wdNmypL.exe
  2⤵
  PID:5616
- C:\Windows\System\BqsmTlc.exe
  C:\Windows\System\BqsmTlc.exe
  2⤵
  PID:1300
- C:\Windows\System\blLjtpH.exe
  C:\Windows\System\blLjtpH.exe
  2⤵
  PID:1644
- C:\Windows\System\AdKrTRG.exe
  C:\Windows\System\AdKrTRG.exe
  2⤵
  PID:2960
- C:\Windows\System\BgStwIL.exe
  C:\Windows\System\BgStwIL.exe
  2⤵
  PID:552
- C:\Windows\System\SQkuVfT.exe
  C:\Windows\System\SQkuVfT.exe
  2⤵
  PID:4000
- C:\Windows\System\rfGzilH.exe
  C:\Windows\System\rfGzilH.exe
  2⤵
  PID:5684
- C:\Windows\System\cCwGEzw.exe
  C:\Windows\System\cCwGEzw.exe
  2⤵
  PID:3804
- C:\Windows\System\WDOYUix.exe
  C:\Windows\System\WDOYUix.exe
  2⤵
  PID:6076
- C:\Windows\System\iNDlrWu.exe
  C:\Windows\System\iNDlrWu.exe
  2⤵
  PID:5620
- C:\Windows\System\ADyBVRH.exe
  C:\Windows\System\ADyBVRH.exe
  2⤵
  PID:2148
- C:\Windows\System\iIAjYBU.exe
  C:\Windows\System\iIAjYBU.exe
  2⤵
  PID:2892
- C:\Windows\System\lVPwXBr.exe
  C:\Windows\System\lVPwXBr.exe
  2⤵
  PID:4092
- C:\Windows\System\MghrLUm.exe
  C:\Windows\System\MghrLUm.exe
  2⤵
  PID:5508
- C:\Windows\System\MWtLini.exe
  C:\Windows\System\MWtLini.exe
  2⤵
  PID:2868
- C:\Windows\System\aQguyJA.exe
  C:\Windows\System\aQguyJA.exe
  2⤵
  PID:1408
- C:\Windows\System\ubjLsEP.exe
  C:\Windows\System\ubjLsEP.exe
  2⤵
  PID:5364
- C:\Windows\System\GKexjqm.exe
  C:\Windows\System\GKexjqm.exe
  2⤵
  PID:1924
- C:\Windows\System\LCWenHF.exe
  C:\Windows\System\LCWenHF.exe
  2⤵
  PID:5956
- C:\Windows\System\LbsBJkc.exe
  C:\Windows\System\LbsBJkc.exe
  2⤵
  PID:5688
- C:\Windows\System\LbjUApL.exe
  C:\Windows\System\LbjUApL.exe
  2⤵
  PID:3196
- C:\Windows\System\ktAFlmF.exe
  C:\Windows\System\ktAFlmF.exe
  2⤵
  PID:5524
- C:\Windows\System\RwtxZeM.exe
  C:\Windows\System\RwtxZeM.exe
  2⤵
  PID:4436
- C:\Windows\System\RWBwZWx.exe
  C:\Windows\System\RWBwZWx.exe
  2⤵
  PID:5252
- C:\Windows\System\GjpdjhC.exe
  C:\Windows\System\GjpdjhC.exe
  2⤵
  PID:5472
- C:\Windows\System\ImoQtmK.exe
  C:\Windows\System\ImoQtmK.exe
  2⤵
  PID:5216
- C:\Windows\System\kAmzmse.exe
  C:\Windows\System\kAmzmse.exe
  2⤵
  PID:5828
- C:\Windows\System\kiwoEkr.exe
  C:\Windows\System\kiwoEkr.exe
  2⤵
  PID:5408
- C:\Windows\System\cbNFQzY.exe
  C:\Windows\System\cbNFQzY.exe
  2⤵
  PID:3128
- C:\Windows\System\wRiVPqR.exe
  C:\Windows\System\wRiVPqR.exe
  2⤵
  PID:2688
- C:\Windows\System\nebpAVS.exe
  C:\Windows\System\nebpAVS.exe
  2⤵
  PID:6060
- C:\Windows\System\OZRDAiI.exe
  C:\Windows\System\OZRDAiI.exe
  2⤵
  PID:1292
- C:\Windows\System\uCQTGNi.exe
  C:\Windows\System\uCQTGNi.exe
  2⤵
  PID:6156
- C:\Windows\System\ByRRAog.exe
  C:\Windows\System\ByRRAog.exe
  2⤵
  PID:6172
- C:\Windows\System\tfOAhas.exe
  C:\Windows\System\tfOAhas.exe
  2⤵
  PID:6188
- C:\Windows\System\iavjDUJ.exe
  C:\Windows\System\iavjDUJ.exe
  2⤵
  PID:6212
- C:\Windows\System\uNUESxE.exe
  C:\Windows\System\uNUESxE.exe
  2⤵
  PID:6228
- C:\Windows\System\cereuHz.exe
  C:\Windows\System\cereuHz.exe
  2⤵
  PID:6244
- C:\Windows\System\aFXKfHz.exe
  C:\Windows\System\aFXKfHz.exe
  2⤵
  PID:6260
- C:\Windows\System\pCJCHRt.exe
  C:\Windows\System\pCJCHRt.exe
  2⤵
  PID:6276
- C:\Windows\System\HxxvxXq.exe
  C:\Windows\System\HxxvxXq.exe
  2⤵
  PID:6292
- C:\Windows\System\LBVIcPz.exe
  C:\Windows\System\LBVIcPz.exe
  2⤵
  PID:6308
- C:\Windows\System\GqBZlLn.exe
  C:\Windows\System\GqBZlLn.exe
  2⤵
  PID:6324
- C:\Windows\System\qQCFMXD.exe
  C:\Windows\System\qQCFMXD.exe
  2⤵
  PID:6344
- C:\Windows\System\Kgbkbtq.exe
  C:\Windows\System\Kgbkbtq.exe
  2⤵
  PID:6360
- C:\Windows\System\DNXgtru.exe
  C:\Windows\System\DNXgtru.exe
  2⤵
  PID:6376
- C:\Windows\System\mNJcoJg.exe
  C:\Windows\System\mNJcoJg.exe
  2⤵
  PID:6392
- C:\Windows\System\cfsmHuw.exe
  C:\Windows\System\cfsmHuw.exe
  2⤵
  PID:6408
- C:\Windows\System\QBRJtUQ.exe
  C:\Windows\System\QBRJtUQ.exe
  2⤵
  PID:6424
- C:\Windows\System\uTIUISm.exe
  C:\Windows\System\uTIUISm.exe
  2⤵
  PID:6440
- C:\Windows\System\lVImfBE.exe
  C:\Windows\System\lVImfBE.exe
  2⤵
  PID:6456
- C:\Windows\System\uygoKKt.exe
  C:\Windows\System\uygoKKt.exe
  2⤵
  PID:6472
- C:\Windows\System\SKxMxML.exe
  C:\Windows\System\SKxMxML.exe
  2⤵
  PID:6488
- C:\Windows\System\vczwnPc.exe
  C:\Windows\System\vczwnPc.exe
  2⤵
  PID:6504
- C:\Windows\System\RpknejI.exe
  C:\Windows\System\RpknejI.exe
  2⤵
  PID:6524
- C:\Windows\System\OBinIyE.exe
  C:\Windows\System\OBinIyE.exe
  2⤵
  PID:6544
- C:\Windows\System\HPDzzoY.exe
  C:\Windows\System\HPDzzoY.exe
  2⤵
  PID:6560
- C:\Windows\System\dgjRKAG.exe
  C:\Windows\System\dgjRKAG.exe
  2⤵
  PID:6576
- C:\Windows\System\wEfXHnF.exe
  C:\Windows\System\wEfXHnF.exe
  2⤵
  PID:6592
- C:\Windows\System\xxDFhky.exe
  C:\Windows\System\xxDFhky.exe
  2⤵
  PID:6608
- C:\Windows\System\GAoqppk.exe
  C:\Windows\System\GAoqppk.exe
  2⤵
  PID:6624
- C:\Windows\System\iPyQVZN.exe
  C:\Windows\System\iPyQVZN.exe
  2⤵
  PID:6644
- C:\Windows\System\LomLLzB.exe
  C:\Windows\System\LomLLzB.exe
  2⤵
  PID:6660
- C:\Windows\System\xNWKpnn.exe
  C:\Windows\System\xNWKpnn.exe
  2⤵
  PID:6676
- C:\Windows\System\GuUtGMg.exe
  C:\Windows\System\GuUtGMg.exe
  2⤵
  PID:6696
- C:\Windows\System\zLssdaO.exe
  C:\Windows\System\zLssdaO.exe
  2⤵
  PID:6712
- C:\Windows\System\fFExVNK.exe
  C:\Windows\System\fFExVNK.exe
  2⤵
  PID:6728
- C:\Windows\System\wlABfiA.exe
  C:\Windows\System\wlABfiA.exe
  2⤵
  PID:6744
- C:\Windows\System\LuuZtAz.exe
  C:\Windows\System\LuuZtAz.exe
  2⤵
  PID:6764
- C:\Windows\System\vNfuQTQ.exe
  C:\Windows\System\vNfuQTQ.exe
  2⤵
  PID:6780
- C:\Windows\System\fasPhEQ.exe
  C:\Windows\System\fasPhEQ.exe
  2⤵
  PID:6796
- C:\Windows\System\vhoGQEv.exe
  C:\Windows\System\vhoGQEv.exe
  2⤵
  PID:6812
- C:\Windows\System\vtBPTaQ.exe
  C:\Windows\System\vtBPTaQ.exe
  2⤵
  PID:6828
- C:\Windows\System\qAAiHxg.exe
  C:\Windows\System\qAAiHxg.exe
  2⤵
  PID:6844
- C:\Windows\System\YeYVSoO.exe
  C:\Windows\System\YeYVSoO.exe
  2⤵
  PID:6864
- C:\Windows\System\kcMiGeH.exe
  C:\Windows\System\kcMiGeH.exe
  2⤵
  PID:6880
- C:\Windows\System\nmnEJbh.exe
  C:\Windows\System\nmnEJbh.exe
  2⤵
  PID:6896
- C:\Windows\System\zCrkdpJ.exe
  C:\Windows\System\zCrkdpJ.exe
  2⤵
  PID:6912
- C:\Windows\System\cyDMdmZ.exe
  C:\Windows\System\cyDMdmZ.exe
  2⤵
  PID:6928
- C:\Windows\System\xqakmhD.exe
  C:\Windows\System\xqakmhD.exe
  2⤵
  PID:6944
- C:\Windows\System\LfjXDIi.exe
  C:\Windows\System\LfjXDIi.exe
  2⤵
  PID:6972
- C:\Windows\System\CSGAbGC.exe
  C:\Windows\System\CSGAbGC.exe
  2⤵
  PID:6988
- C:\Windows\System\NHzjJzN.exe
  C:\Windows\System\NHzjJzN.exe
  2⤵
  PID:7004
- C:\Windows\System\UKuZqDw.exe
  C:\Windows\System\UKuZqDw.exe
  2⤵
  PID:7020
- C:\Windows\System\tIjJKDj.exe
  C:\Windows\System\tIjJKDj.exe
  2⤵
  PID:7036
- C:\Windows\System\JGlIhVy.exe
  C:\Windows\System\JGlIhVy.exe
  2⤵
  PID:7052
- C:\Windows\System\gUicfRz.exe
  C:\Windows\System\gUicfRz.exe
  2⤵
  PID:7116
- C:\Windows\System\jFrZMBv.exe
  C:\Windows\System\jFrZMBv.exe
  2⤵
  PID:7132
- C:\Windows\System\kbIcDZF.exe
  C:\Windows\System\kbIcDZF.exe
  2⤵
  PID:7148
- C:\Windows\System\lgNOmWY.exe
  C:\Windows\System\lgNOmWY.exe
  2⤵
  PID:7164
- C:\Windows\System\HtCsNQr.exe
  C:\Windows\System\HtCsNQr.exe
  2⤵
  PID:6148
- C:\Windows\System\tHuXpEB.exe
  C:\Windows\System\tHuXpEB.exe
  2⤵
  PID:6180
- C:\Windows\System\SxwNJKG.exe
  C:\Windows\System\SxwNJKG.exe
  2⤵
  PID:6252
- C:\Windows\System\aXvLhZD.exe
  C:\Windows\System\aXvLhZD.exe
  2⤵
  PID:6320
- C:\Windows\System\HIwCbfd.exe
  C:\Windows\System\HIwCbfd.exe
  2⤵
  PID:6384
- C:\Windows\System\FvSoIAS.exe
  C:\Windows\System\FvSoIAS.exe
  2⤵
  PID:6416
- C:\Windows\System\qOPNSYU.exe
  C:\Windows\System\qOPNSYU.exe
  2⤵
  PID:6484
- C:\Windows\System\ckMdwQa.exe
  C:\Windows\System\ckMdwQa.exe
  2⤵
  PID:6236
- C:\Windows\System\yDBsyTm.exe
  C:\Windows\System\yDBsyTm.exe
  2⤵
  PID:6300
- C:\Windows\System\Tvkgccw.exe
  C:\Windows\System\Tvkgccw.exe
  2⤵
  PID:6340
- C:\Windows\System\fqxVvuS.exe
  C:\Windows\System\fqxVvuS.exe
  2⤵
  PID:6432
- C:\Windows\System\DVOWsTF.exe
  C:\Windows\System\DVOWsTF.exe
  2⤵
  PID:6496
- C:\Windows\System\RovSaHz.exe
  C:\Windows\System\RovSaHz.exe
  2⤵
  PID:6512
- C:\Windows\System\DePCHYj.exe
  C:\Windows\System\DePCHYj.exe
  2⤵
  PID:6516
- C:\Windows\System\okWokBY.exe
  C:\Windows\System\okWokBY.exe
  2⤵
  PID:6656
- C:\Windows\System\GXzFkyD.exe
  C:\Windows\System\GXzFkyD.exe
  2⤵
  PID:6720
- C:\Windows\System\snsZEND.exe
  C:\Windows\System\snsZEND.exe
  2⤵
  PID:6788
- C:\Windows\System\PcTxWIM.exe
  C:\Windows\System\PcTxWIM.exe
  2⤵
  PID:6852
- C:\Windows\System\FzjyLfh.exe
  C:\Windows\System\FzjyLfh.exe
  2⤵
  PID:6568
- C:\Windows\System\WEXzEOA.exe
  C:\Windows\System\WEXzEOA.exe
  2⤵
  PID:6924
- C:\Windows\System\fnvbuaf.exe
  C:\Windows\System\fnvbuaf.exe
  2⤵
  PID:6960
- C:\Windows\System\JRandxY.exe
  C:\Windows\System\JRandxY.exe
  2⤵
  PID:6668
- C:\Windows\System\WnVorAM.exe
  C:\Windows\System\WnVorAM.exe
  2⤵
  PID:6736
- C:\Windows\System\WRvZKoF.exe
  C:\Windows\System\WRvZKoF.exe
  2⤵
  PID:6804
- C:\Windows\System\aTzdtyj.exe
  C:\Windows\System\aTzdtyj.exe
  2⤵
  PID:6872
- C:\Windows\System\AnqeFHZ.exe
  C:\Windows\System\AnqeFHZ.exe
  2⤵
  PID:6940
- C:\Windows\System\DnyqHrF.exe
  C:\Windows\System\DnyqHrF.exe
  2⤵
  PID:6968
- C:\Windows\System\ZoVGGiS.exe
  C:\Windows\System\ZoVGGiS.exe
  2⤵
  PID:7028
- C:\Windows\System\yFGZQiR.exe
  C:\Windows\System\yFGZQiR.exe
  2⤵
  PID:7044
- C:\Windows\System\LEvFkqB.exe
  C:\Windows\System\LEvFkqB.exe
  2⤵
  PID:2740
- C:\Windows\System\MbAnERC.exe
  C:\Windows\System\MbAnERC.exe
  2⤵
  PID:7064
- C:\Windows\System\wVZjXkG.exe
  C:\Windows\System\wVZjXkG.exe
  2⤵
  PID:7080
- C:\Windows\System\lYTLJeP.exe
  C:\Windows\System\lYTLJeP.exe
  2⤵
  PID:7096
- C:\Windows\System\UamAJFy.exe
  C:\Windows\System\UamAJFy.exe
  2⤵
  PID:3180
- C:\Windows\System\tgyQFvm.exe
  C:\Windows\System\tgyQFvm.exe
  2⤵
  PID:4952
- C:\Windows\System\vxIjrBe.exe
  C:\Windows\System\vxIjrBe.exe
  2⤵
  PID:6356
- C:\Windows\System\HDqLMZc.exe
  C:\Windows\System\HDqLMZc.exe
  2⤵
  PID:6268
- C:\Windows\System\BjrlkRD.exe
  C:\Windows\System\BjrlkRD.exe
  2⤵
  PID:6400
- C:\Windows\System\URYbgyj.exe
  C:\Windows\System\URYbgyj.exe
  2⤵
  PID:7156
- C:\Windows\System\DnCtfpt.exe
  C:\Windows\System\DnCtfpt.exe
  2⤵
  PID:6200
- C:\Windows\System\odKtzkH.exe
  C:\Windows\System\odKtzkH.exe
  2⤵
  PID:6204
- C:\Windows\System\dYYPmgQ.exe
  C:\Windows\System\dYYPmgQ.exe
  2⤵
  PID:6464
- C:\Windows\System\bvxeWqv.exe
  C:\Windows\System\bvxeWqv.exe
  2⤵
  PID:6532
- C:\Windows\System\PHSNuTs.exe
  C:\Windows\System\PHSNuTs.exe
  2⤵
  PID:6616
- C:\Windows\System\tdGbcAW.exe
  C:\Windows\System\tdGbcAW.exe
  2⤵
  PID:6888
- C:\Windows\System\lhszZYY.exe
  C:\Windows\System\lhszZYY.exe
  2⤵
  PID:6708
- C:\Windows\System\zFwtYFO.exe
  C:\Windows\System\zFwtYFO.exe
  2⤵
  PID:6980
- C:\Windows\System\ECnOrlH.exe
  C:\Windows\System\ECnOrlH.exe
  2⤵
  PID:6588
- C:\Windows\System\RGHUAGo.exe
  C:\Windows\System\RGHUAGo.exe
  2⤵
  PID:6688
- C:\Windows\System\UkXSIUT.exe
  C:\Windows\System\UkXSIUT.exe
  2⤵
  PID:6604
- C:\Windows\System\saeRuzY.exe
  C:\Windows\System\saeRuzY.exe
  2⤵
  PID:6740
- C:\Windows\System\lGmvhtL.exe
  C:\Windows\System\lGmvhtL.exe
  2⤵
  PID:6964
- C:\Windows\System\ehQVARc.exe
  C:\Windows\System\ehQVARc.exe
  2⤵
  PID:7088
- C:\Windows\System\YaAEgLc.exe
  C:\Windows\System\YaAEgLc.exe
  2⤵
  PID:6288
- C:\Windows\System\XbMNIDL.exe
  C:\Windows\System\XbMNIDL.exe
  2⤵
  PID:6536
- C:\Windows\System\XiVzjXx.exe
  C:\Windows\System\XiVzjXx.exe
  2⤵
  PID:6908
- C:\Windows\System\aMBfcBP.exe
  C:\Windows\System\aMBfcBP.exe
  2⤵
  PID:2588
- C:\Windows\System\nBrCvPs.exe
  C:\Windows\System\nBrCvPs.exe
  2⤵
  PID:6520
- C:\Windows\System\JUpLgDT.exe
  C:\Windows\System\JUpLgDT.exe
  2⤵
  PID:6640
- C:\Windows\System\BRXFTgV.exe
  C:\Windows\System\BRXFTgV.exe
  2⤵
  PID:7184
- C:\Windows\System\YUBvNQz.exe
  C:\Windows\System\YUBvNQz.exe
  2⤵
  PID:7200
- C:\Windows\System\EEywZKn.exe
  C:\Windows\System\EEywZKn.exe
  2⤵
  PID:7220
- C:\Windows\System\pgUFBYX.exe
  C:\Windows\System\pgUFBYX.exe
  2⤵
  PID:7236
- C:\Windows\System\XswHvTP.exe
  C:\Windows\System\XswHvTP.exe
  2⤵
  PID:7252
- C:\Windows\System\Bfurlii.exe
  C:\Windows\System\Bfurlii.exe
  2⤵
  PID:7268
- C:\Windows\System\nHGuqBq.exe
  C:\Windows\System\nHGuqBq.exe
  2⤵
  PID:7284
- C:\Windows\System\ezWCfWA.exe
  C:\Windows\System\ezWCfWA.exe
  2⤵
  PID:7300
- C:\Windows\System\DWvMknn.exe
  C:\Windows\System\DWvMknn.exe
  2⤵
  PID:7316
- C:\Windows\System\spAQODr.exe
  C:\Windows\System\spAQODr.exe
  2⤵
  PID:7332
- C:\Windows\System\PHsyClc.exe
  C:\Windows\System\PHsyClc.exe
  2⤵
  PID:7348
- C:\Windows\System\yfrGmmF.exe
  C:\Windows\System\yfrGmmF.exe
  2⤵
  PID:7364
- C:\Windows\System\QCxQQFJ.exe
  C:\Windows\System\QCxQQFJ.exe
  2⤵
  PID:7380
- C:\Windows\System\RANBgkb.exe
  C:\Windows\System\RANBgkb.exe
  2⤵
  PID:7396
- C:\Windows\System\NIswhpM.exe
  C:\Windows\System\NIswhpM.exe
  2⤵
  PID:7416
- C:\Windows\System\BzdZvtF.exe
  C:\Windows\System\BzdZvtF.exe
  2⤵
  PID:7432
- C:\Windows\System\ROxERaq.exe
  C:\Windows\System\ROxERaq.exe
  2⤵
  PID:7448
- C:\Windows\System\SnCqgsL.exe
  C:\Windows\System\SnCqgsL.exe
  2⤵
  PID:7464
- C:\Windows\System\hXmZFhM.exe
  C:\Windows\System\hXmZFhM.exe
  2⤵
  PID:7480
- C:\Windows\System\MMsHuZJ.exe
  C:\Windows\System\MMsHuZJ.exe
  2⤵
  PID:7500
- C:\Windows\System\bgodEWw.exe
  C:\Windows\System\bgodEWw.exe
  2⤵
  PID:7516
- C:\Windows\System\ulffxaO.exe
  C:\Windows\System\ulffxaO.exe
  2⤵
  PID:7536
- C:\Windows\System\CTjZsrK.exe
  C:\Windows\System\CTjZsrK.exe
  2⤵
  PID:7552
- C:\Windows\System\GIxwGhc.exe
  C:\Windows\System\GIxwGhc.exe
  2⤵
  PID:7568
- C:\Windows\System\AgIDdfl.exe
  C:\Windows\System\AgIDdfl.exe
  2⤵
  PID:7584
- C:\Windows\System\uEjCioX.exe
  C:\Windows\System\uEjCioX.exe
  2⤵
  PID:7600
- C:\Windows\System\uHxmSTH.exe
  C:\Windows\System\uHxmSTH.exe
  2⤵
  PID:7616
- C:\Windows\System\cSLhKCr.exe
  C:\Windows\System\cSLhKCr.exe
  2⤵
  PID:7632
- C:\Windows\System\kSBuITd.exe
  C:\Windows\System\kSBuITd.exe
  2⤵
  PID:7648
- C:\Windows\System\rlLyRSd.exe
  C:\Windows\System\rlLyRSd.exe
  2⤵
  PID:7668
- C:\Windows\System\sguwkyS.exe
  C:\Windows\System\sguwkyS.exe
  2⤵
  PID:7684
- C:\Windows\System\abGjoLh.exe
  C:\Windows\System\abGjoLh.exe
  2⤵
  PID:7700
- C:\Windows\System\ndUyTLH.exe
  C:\Windows\System\ndUyTLH.exe
  2⤵
  PID:7716
- C:\Windows\System\lpHwtSg.exe
  C:\Windows\System\lpHwtSg.exe
  2⤵
  PID:7732
- C:\Windows\System\QRUpWdR.exe
  C:\Windows\System\QRUpWdR.exe
  2⤵
  PID:7748
- C:\Windows\System\VRqKzxM.exe
  C:\Windows\System\VRqKzxM.exe
  2⤵
  PID:7768
- C:\Windows\System\ZBmgzyj.exe
  C:\Windows\System\ZBmgzyj.exe
  2⤵
  PID:7784
- C:\Windows\System\EpsRBgc.exe
  C:\Windows\System\EpsRBgc.exe
  2⤵
  PID:7800
- C:\Windows\System\xKQneyO.exe
  C:\Windows\System\xKQneyO.exe
  2⤵
  PID:7816
- C:\Windows\System\VPvmURk.exe
  C:\Windows\System\VPvmURk.exe
  2⤵
  PID:7836
- C:\Windows\System\NJQtvhu.exe
  C:\Windows\System\NJQtvhu.exe
  2⤵
  PID:7856
- C:\Windows\System\VWxCRPz.exe
  C:\Windows\System\VWxCRPz.exe
  2⤵
  PID:7872
- C:\Windows\System\WdVHVqx.exe
  C:\Windows\System\WdVHVqx.exe
  2⤵
  PID:7888
- C:\Windows\System\GkomYwt.exe
  C:\Windows\System\GkomYwt.exe
  2⤵
  PID:7908
- C:\Windows\System\MuGuows.exe
  C:\Windows\System\MuGuows.exe
  2⤵
  PID:7924
- C:\Windows\System\HmwLmGH.exe
  C:\Windows\System\HmwLmGH.exe
  2⤵
  PID:7940
- C:\Windows\System\leTRVjc.exe
  C:\Windows\System\leTRVjc.exe
  2⤵
  PID:7956
- C:\Windows\System\JjuzOeo.exe
  C:\Windows\System\JjuzOeo.exe
  2⤵
  PID:7976
- C:\Windows\System\XiJqdBi.exe
  C:\Windows\System\XiJqdBi.exe
  2⤵
  PID:7992
- C:\Windows\System\IkGLTpc.exe
  C:\Windows\System\IkGLTpc.exe
  2⤵
  PID:8008
- C:\Windows\System\HjSPQnp.exe
  C:\Windows\System\HjSPQnp.exe
  2⤵
  PID:8024
- C:\Windows\System\PCcuqTO.exe
  C:\Windows\System\PCcuqTO.exe
  2⤵
  PID:8040
- C:\Windows\System\wveXzGm.exe
  C:\Windows\System\wveXzGm.exe
  2⤵
  PID:8056
- C:\Windows\System\xvjpICM.exe
  C:\Windows\System\xvjpICM.exe
  2⤵
  PID:8072
- C:\Windows\System\OnYqFzv.exe
  C:\Windows\System\OnYqFzv.exe
  2⤵
  PID:8092
- C:\Windows\System\FZPhXkU.exe
  C:\Windows\System\FZPhXkU.exe
  2⤵
  PID:8108
- C:\Windows\System\LiFhusH.exe
  C:\Windows\System\LiFhusH.exe
  2⤵
  PID:8124
- C:\Windows\System\FjoLTWh.exe
  C:\Windows\System\FjoLTWh.exe
  2⤵
  PID:6636
- C:\Windows\System\iLnWbhl.exe
  C:\Windows\System\iLnWbhl.exe
  2⤵
  PID:6752
- C:\Windows\System\OVRlyxz.exe
  C:\Windows\System\OVRlyxz.exe
  2⤵
  PID:7104
- C:\Windows\System\idmXqkm.exe
  C:\Windows\System\idmXqkm.exe
  2⤵
  PID:7108
- C:\Windows\System\ynDJxnc.exe
  C:\Windows\System\ynDJxnc.exe
  2⤵
  PID:4208
- C:\Windows\System\zDnmwlC.exe
  C:\Windows\System\zDnmwlC.exe
  2⤵
  PID:6836
- C:\Windows\System\TjGMZzl.exe
  C:\Windows\System\TjGMZzl.exe
  2⤵
  PID:7016
- C:\Windows\System\RsiJulP.exe
  C:\Windows\System\RsiJulP.exe
  2⤵
  PID:6480
- C:\Windows\System\urryKVs.exe
  C:\Windows\System\urryKVs.exe
  2⤵
  PID:6164
- C:\Windows\System\FlBFLzS.exe
  C:\Windows\System\FlBFLzS.exe
  2⤵
  PID:7216
- C:\Windows\System\CmEppWQ.exe
  C:\Windows\System\CmEppWQ.exe
  2⤵
  PID:7264
- C:\Windows\System\XMadIFO.exe
  C:\Windows\System\XMadIFO.exe
  2⤵
  PID:7360
- C:\Windows\System\zSjVMwE.exe
  C:\Windows\System\zSjVMwE.exe
  2⤵
  PID:7428
- C:\Windows\System\jXFdWsN.exe
  C:\Windows\System\jXFdWsN.exe
  2⤵
  PID:7460
- C:\Windows\System\LwCuowy.exe
  C:\Windows\System\LwCuowy.exe
  2⤵
  PID:7408
- C:\Windows\System\kWlzxry.exe
  C:\Windows\System\kWlzxry.exe
  2⤵
  PID:7376
- C:\Windows\System\nNGdwMb.exe
  C:\Windows\System\nNGdwMb.exe
  2⤵
  PID:7444
- C:\Windows\System\dYuHaSc.exe
  C:\Windows\System\dYuHaSc.exe
  2⤵
  PID:7496
- C:\Windows\System\VlYExvE.exe
  C:\Windows\System\VlYExvE.exe
  2⤵
  PID:7592
- C:\Windows\System\XqhbXXF.exe
  C:\Windows\System\XqhbXXF.exe
  2⤵
  PID:7628
- C:\Windows\System\ZOtwtgH.exe
  C:\Windows\System\ZOtwtgH.exe
  2⤵
  PID:7660
- C:\Windows\System\VsKIBSU.exe
  C:\Windows\System\VsKIBSU.exe
  2⤵
  PID:7608
- C:\Windows\System\BHEyblR.exe
  C:\Windows\System\BHEyblR.exe
  2⤵
  PID:7728
- C:\Windows\System\vQtUucC.exe
  C:\Windows\System\vQtUucC.exe
  2⤵
  PID:7792
- C:\Windows\System\YknmnVT.exe
  C:\Windows\System\YknmnVT.exe
  2⤵
  PID:7832
- C:\Windows\System\ndaJNSD.exe
  C:\Windows\System\ndaJNSD.exe
  2⤵
  PID:7744
- C:\Windows\System\ghmAAhI.exe
  C:\Windows\System\ghmAAhI.exe
  2⤵
  PID:7676
- C:\Windows\System\tRgmLDB.exe
  C:\Windows\System\tRgmLDB.exe
  2⤵
  PID:7740
- C:\Windows\System\slPjUaD.exe
  C:\Windows\System\slPjUaD.exe
  2⤵
  PID:7812
- C:\Windows\System\DKqFBGl.exe
  C:\Windows\System\DKqFBGl.exe
  2⤵
  PID:7880
- C:\Windows\System\lNNHBVw.exe
  C:\Windows\System\lNNHBVw.exe
  2⤵
  PID:7932
- C:\Windows\System\CFKhbMF.exe
  C:\Windows\System\CFKhbMF.exe
  2⤵
  PID:8004
- C:\Windows\System\yfSebPY.exe
  C:\Windows\System\yfSebPY.exe
  2⤵
  PID:8068
- C:\Windows\System\iuMzsZl.exe
  C:\Windows\System\iuMzsZl.exe
  2⤵
  PID:7948
- C:\Windows\System\VCwUzgo.exe
  C:\Windows\System\VCwUzgo.exe
  2⤵
  PID:8020
- C:\Windows\System\keqctHe.exe
  C:\Windows\System\keqctHe.exe
  2⤵
  PID:8084
- C:\Windows\System\PUwNPGp.exe
  C:\Windows\System\PUwNPGp.exe
  2⤵
  PID:8132
- C:\Windows\System\pvimKmf.exe
  C:\Windows\System\pvimKmf.exe
  2⤵
  PID:6540
- C:\Windows\System\blwVGEs.exe
  C:\Windows\System\blwVGEs.exe
  2⤵
  PID:8156
- C:\Windows\System\dfjVpEm.exe
  C:\Windows\System\dfjVpEm.exe
  2⤵
  PID:8172
- C:\Windows\System\mLqQbQn.exe
  C:\Windows\System\mLqQbQn.exe
  2⤵
  PID:7192
- C:\Windows\System\VGmItob.exe
  C:\Windows\System\VGmItob.exe
  2⤵
  PID:7000
- C:\Windows\System\eLFPXBQ.exe
  C:\Windows\System\eLFPXBQ.exe
  2⤵
  PID:6556
- C:\Windows\System\IRRycYU.exe
  C:\Windows\System\IRRycYU.exe
  2⤵
  PID:7244
- C:\Windows\System\YatymFb.exe
  C:\Windows\System\YatymFb.exe
  2⤵
  PID:7372
- C:\Windows\System\ARseqJP.exe
  C:\Windows\System\ARseqJP.exe
  2⤵
  PID:7532
- C:\Windows\System\fGeFTtD.exe
  C:\Windows\System\fGeFTtD.exe
  2⤵
  PID:7564
- C:\Windows\System\CRDZJrQ.exe
  C:\Windows\System\CRDZJrQ.exe
  2⤵
  PID:7580
- C:\Windows\System\BfTpBrn.exe
  C:\Windows\System\BfTpBrn.exe
  2⤵
  PID:7764
- C:\Windows\System\ipYzMij.exe
  C:\Windows\System\ipYzMij.exe
  2⤵
  PID:6224
- C:\Windows\System\XURUlsS.exe
  C:\Windows\System\XURUlsS.exe
  2⤵
  PID:7644
- C:\Windows\System\wgGMpVo.exe
  C:\Windows\System\wgGMpVo.exe
  2⤵
  PID:7828
- C:\Windows\System\HVmYIIK.exe
  C:\Windows\System\HVmYIIK.exe
  2⤵
  PID:7808
- C:\Windows\System\tUVUTro.exe
  C:\Windows\System\tUVUTro.exe
  2⤵
  PID:7508
- C:\Windows\System\THuTmWa.exe
  C:\Windows\System\THuTmWa.exe
  2⤵
  PID:7328
- C:\Windows\System\XHBVdHL.exe
  C:\Windows\System\XHBVdHL.exe
  2⤵
  PID:7596
- C:\Windows\System\SJBTRgL.exe
  C:\Windows\System\SJBTRgL.exe
  2⤵
  PID:7848
- C:\Windows\System\tlMkUxI.exe
  C:\Windows\System\tlMkUxI.exe
  2⤵
  PID:8000
- C:\Windows\System\SEFgqMJ.exe
  C:\Windows\System\SEFgqMJ.exe
  2⤵
  PID:7920
- C:\Windows\System\pXTomDt.exe
  C:\Windows\System\pXTomDt.exe
  2⤵
  PID:8120
- C:\Windows\System\QVkYuSD.exe
  C:\Windows\System\QVkYuSD.exe
  2⤵
  PID:1748
- C:\Windows\System\VRwCSME.exe
  C:\Windows\System\VRwCSME.exe
  2⤵
  PID:6760
- C:\Windows\System\BTvecOc.exe
  C:\Windows\System\BTvecOc.exe
  2⤵
  PID:7276
- C:\Windows\System\lQNcxCq.exe
  C:\Windows\System\lQNcxCq.exe
  2⤵
  PID:7472
- C:\Windows\System\OhGodUV.exe
  C:\Windows\System\OhGodUV.exe
  2⤵
  PID:8080
- C:\Windows\System\ERnGsyY.exe
  C:\Windows\System\ERnGsyY.exe
  2⤵
  PID:8216
- C:\Windows\System\BAQbODR.exe
  C:\Windows\System\BAQbODR.exe
  2⤵
  PID:8232
- C:\Windows\System\XaeatjT.exe
  C:\Windows\System\XaeatjT.exe
  2⤵
  PID:8248
- C:\Windows\System\PHmpvkT.exe
  C:\Windows\System\PHmpvkT.exe
  2⤵
  PID:8268
- C:\Windows\System\ikSCgXv.exe
  C:\Windows\System\ikSCgXv.exe
  2⤵
  PID:8284
- C:\Windows\System\ahZGaAX.exe
  C:\Windows\System\ahZGaAX.exe
  2⤵
  PID:8300
- C:\Windows\System\AllmztA.exe
  C:\Windows\System\AllmztA.exe
  2⤵
  PID:8324
- C:\Windows\System\BBndnzx.exe
  C:\Windows\System\BBndnzx.exe
  2⤵
  PID:8340
- C:\Windows\System\dzqobvA.exe
  C:\Windows\System\dzqobvA.exe
  2⤵
  PID:8356
- C:\Windows\System\SZJXizo.exe
  C:\Windows\System\SZJXizo.exe
  2⤵
  PID:8372
- C:\Windows\System\BDfnYYq.exe
  C:\Windows\System\BDfnYYq.exe
  2⤵
  PID:8388
- C:\Windows\System\wSBMoAs.exe
  C:\Windows\System\wSBMoAs.exe
  2⤵
  PID:8448
- C:\Windows\System\pmKgKzE.exe
  C:\Windows\System\pmKgKzE.exe
  2⤵
  PID:8464
- C:\Windows\System\iAYbRqi.exe
  C:\Windows\System\iAYbRqi.exe
  2⤵
  PID:8480
- C:\Windows\System\VLrQrPQ.exe
  C:\Windows\System\VLrQrPQ.exe
  2⤵
  PID:8496
- C:\Windows\System\vYHvmnv.exe
  C:\Windows\System\vYHvmnv.exe
  2⤵
  PID:8512
- C:\Windows\System\zXlmbpm.exe
  C:\Windows\System\zXlmbpm.exe
  2⤵
  PID:8528
- C:\Windows\System\kcNxhTa.exe
  C:\Windows\System\kcNxhTa.exe
  2⤵
  PID:8544
- C:\Windows\System\fCQXeeJ.exe
  C:\Windows\System\fCQXeeJ.exe
  2⤵
  PID:8560
- C:\Windows\System\oRCOLaB.exe
  C:\Windows\System\oRCOLaB.exe
  2⤵
  PID:8576
- C:\Windows\System\uCPUqpp.exe
  C:\Windows\System\uCPUqpp.exe
  2⤵
  PID:8592
- C:\Windows\System\vqFzXBp.exe
  C:\Windows\System\vqFzXBp.exe
  2⤵
  PID:8608
- C:\Windows\System\cPmuihM.exe
  C:\Windows\System\cPmuihM.exe
  2⤵
  PID:8624
- C:\Windows\System\kRHecAt.exe
  C:\Windows\System\kRHecAt.exe
  2⤵
  PID:8640
- C:\Windows\System\xkeAeyG.exe
  C:\Windows\System\xkeAeyG.exe
  2⤵
  PID:8656
- C:\Windows\System\nwBAtoT.exe
  C:\Windows\System\nwBAtoT.exe
  2⤵
  PID:8672
- C:\Windows\System\lJqjCqP.exe
  C:\Windows\System\lJqjCqP.exe
  2⤵
  PID:8688
- C:\Windows\System\pZYxZOz.exe
  C:\Windows\System\pZYxZOz.exe
  2⤵
  PID:8704
- C:\Windows\System\hbHlCDo.exe
  C:\Windows\System\hbHlCDo.exe
  2⤵
  PID:8720
- C:\Windows\System\tpJyctE.exe
  C:\Windows\System\tpJyctE.exe
  2⤵
  PID:8736
- C:\Windows\System\okwSHon.exe
  C:\Windows\System\okwSHon.exe
  2⤵
  PID:8752
- C:\Windows\System\oWUBvkF.exe
  C:\Windows\System\oWUBvkF.exe
  2⤵
  PID:8768
- C:\Windows\System\lLgGEpd.exe
  C:\Windows\System\lLgGEpd.exe
  2⤵
  PID:8784
- C:\Windows\System\Krrpdlv.exe
  C:\Windows\System\Krrpdlv.exe
  2⤵
  PID:8800
- C:\Windows\System\lhJGpov.exe
  C:\Windows\System\lhJGpov.exe
  2⤵
  PID:8816
- C:\Windows\System\bNdKaMT.exe
  C:\Windows\System\bNdKaMT.exe
  2⤵
  PID:8832
- C:\Windows\System\UCzRRzR.exe
  C:\Windows\System\UCzRRzR.exe
  2⤵
  PID:8848
- C:\Windows\System\NTdviWY.exe
  C:\Windows\System\NTdviWY.exe
  2⤵
  PID:8864
- C:\Windows\System\baupBoo.exe
  C:\Windows\System\baupBoo.exe
  2⤵
  PID:8880
- C:\Windows\System\UFDDPSO.exe
  C:\Windows\System\UFDDPSO.exe
  2⤵
  PID:8896
- C:\Windows\System\qoMQJJc.exe
  C:\Windows\System\qoMQJJc.exe
  2⤵
  PID:8912
- C:\Windows\System\OXQuRzH.exe
  C:\Windows\System\OXQuRzH.exe
  2⤵
  PID:8928
- C:\Windows\System\wjjckoi.exe
  C:\Windows\System\wjjckoi.exe
  2⤵
  PID:8944
- C:\Windows\System\XZrwRZl.exe
  C:\Windows\System\XZrwRZl.exe
  2⤵
  PID:8960
- C:\Windows\System\ZknWmZI.exe
  C:\Windows\System\ZknWmZI.exe
  2⤵
  PID:8976
- C:\Windows\System\HrgwtOm.exe
  C:\Windows\System\HrgwtOm.exe
  2⤵
  PID:8992
- C:\Windows\System\OncPYZN.exe
  C:\Windows\System\OncPYZN.exe
  2⤵
  PID:9008
- C:\Windows\System\yMLNNgT.exe
  C:\Windows\System\yMLNNgT.exe
  2⤵
  PID:9024
- C:\Windows\System\tuHooFv.exe
  C:\Windows\System\tuHooFv.exe
  2⤵
  PID:9040
- C:\Windows\System\YKHIkoV.exe
  C:\Windows\System\YKHIkoV.exe
  2⤵
  PID:9056
- C:\Windows\System\khQpBGg.exe
  C:\Windows\System\khQpBGg.exe
  2⤵
  PID:9072
- C:\Windows\System\xtSCqgL.exe
  C:\Windows\System\xtSCqgL.exe
  2⤵
  PID:9088
- C:\Windows\System\kcBuxJd.exe
  C:\Windows\System\kcBuxJd.exe
  2⤵
  PID:9104
- C:\Windows\System\ECJESHN.exe
  C:\Windows\System\ECJESHN.exe
  2⤵
  PID:9120
- C:\Windows\System\ywueArq.exe
  C:\Windows\System\ywueArq.exe
  2⤵
  PID:9136
- C:\Windows\System\kxGDCXP.exe
  C:\Windows\System\kxGDCXP.exe
  2⤵
  PID:9152
- C:\Windows\System\CJSMWHV.exe
  C:\Windows\System\CJSMWHV.exe
  2⤵
  PID:9168
- C:\Windows\System\hXjkHUO.exe
  C:\Windows\System\hXjkHUO.exe
  2⤵
  PID:9184
- C:\Windows\System\vuiYhji.exe
  C:\Windows\System\vuiYhji.exe
  2⤵
  PID:9200
- C:\Windows\System\XsZhllh.exe
  C:\Windows\System\XsZhllh.exe
  2⤵
  PID:8116
- C:\Windows\System\mKKnHNl.exe
  C:\Windows\System\mKKnHNl.exe
  2⤵
  PID:7612
- C:\Windows\System\mVaeBqc.exe
  C:\Windows\System\mVaeBqc.exe
  2⤵
  PID:8276
- C:\Windows\System\nnOKmEg.exe
  C:\Windows\System\nnOKmEg.exe
  2⤵
  PID:8208
- C:\Windows\System\pVHenfX.exe
  C:\Windows\System\pVHenfX.exe
  2⤵
  PID:8348
- C:\Windows\System\RYHsbal.exe
  C:\Windows\System\RYHsbal.exe
  2⤵
  PID:8308
- C:\Windows\System\MQyzDHO.exe
  C:\Windows\System\MQyzDHO.exe
  2⤵
  PID:8016
- C:\Windows\System\lztWXzc.exe
  C:\Windows\System\lztWXzc.exe
  2⤵
  PID:8160
- C:\Windows\System\aoZrPRt.exe
  C:\Windows\System\aoZrPRt.exe
  2⤵
  PID:8188
- C:\Windows\System\NgLrQfC.exe
  C:\Windows\System\NgLrQfC.exe
  2⤵
  PID:7140
- C:\Windows\System\jLAsnHZ.exe
  C:\Windows\System\jLAsnHZ.exe
  2⤵
  PID:7696
- C:\Windows\System\EHlWWZj.exe
  C:\Windows\System\EHlWWZj.exe
  2⤵
  PID:7640
- C:\Windows\System\rmWhIuj.exe
  C:\Windows\System\rmWhIuj.exe
  2⤵
  PID:7972
- C:\Windows\System\eqeOEOs.exe
  C:\Windows\System\eqeOEOs.exe
  2⤵
  PID:1536
- C:\Windows\System\meGTBfu.exe
  C:\Windows\System\meGTBfu.exe
  2⤵
  PID:8260
- C:\Windows\System\IFalTkG.exe
  C:\Windows\System\IFalTkG.exe
  2⤵
  PID:8364
- C:\Windows\System\FnvqRoo.exe
  C:\Windows\System\FnvqRoo.exe
  2⤵
  PID:8408
- C:\Windows\System\EIeXywz.exe
  C:\Windows\System\EIeXywz.exe
  2⤵
  PID:8148
- C:\Windows\System\mzlAtym.exe
  C:\Windows\System\mzlAtym.exe
  2⤵
  PID:7712
- C:\Windows\System\BRCvono.exe
  C:\Windows\System\BRCvono.exe
  2⤵
  PID:8292
- C:\Windows\System\iCvAICD.exe
  C:\Windows\System\iCvAICD.exe
  2⤵
  PID:8440
- C:\Windows\System\wyVjqUk.exe
  C:\Windows\System\wyVjqUk.exe
  2⤵
  PID:8472
- C:\Windows\System\XUzEPeb.exe
  C:\Windows\System\XUzEPeb.exe
  2⤵
  PID:8536
- C:\Windows\System\QdVrgaa.exe
  C:\Windows\System\QdVrgaa.exe
  2⤵
  PID:8568
- C:\Windows\System\flIWqMu.exe
  C:\Windows\System\flIWqMu.exe
  2⤵
  PID:8600
- C:\Windows\System\iAjZqxe.exe
  C:\Windows\System\iAjZqxe.exe
  2⤵
  PID:8636
- C:\Windows\System\bZRwbnu.exe
  C:\Windows\System\bZRwbnu.exe
  2⤵
  PID:8696
- C:\Windows\System\lvPGXRd.exe
  C:\Windows\System\lvPGXRd.exe
  2⤵
  PID:8760
- C:\Windows\System\eBmDepr.exe
  C:\Windows\System\eBmDepr.exe
  2⤵
  PID:8824
- C:\Windows\System\ysHVJlO.exe
  C:\Windows\System\ysHVJlO.exe
  2⤵
  PID:8888
- C:\Windows\System\eEpljmz.exe
  C:\Windows\System\eEpljmz.exe
  2⤵
  PID:8924
- C:\Windows\System\fgPEJla.exe
  C:\Windows\System\fgPEJla.exe
  2⤵
  PID:8988
- C:\Windows\System\GfuNDAG.exe
  C:\Windows\System\GfuNDAG.exe
  2⤵
  PID:8712
- C:\Windows\System\oUSaOxg.exe
  C:\Windows\System\oUSaOxg.exe
  2⤵
  PID:8616
- C:\Windows\System\fgHkWDd.exe
  C:\Windows\System\fgHkWDd.exe
  2⤵
  PID:8652
- C:\Windows\System\lHnwVfc.exe
  C:\Windows\System\lHnwVfc.exe
  2⤵
  PID:8908
- C:\Windows\System\woMlaNX.exe
  C:\Windows\System\woMlaNX.exe
  2⤵
  PID:9004
- C:\Windows\System\pkJMFlQ.exe
  C:\Windows\System\pkJMFlQ.exe
  2⤵
  PID:8872
- C:\Windows\System\jmaFOti.exe
  C:\Windows\System\jmaFOti.exe
  2⤵
  PID:8972
- C:\Windows\System\ssDLGjx.exe
  C:\Windows\System\ssDLGjx.exe
  2⤵
  PID:9084
- C:\Windows\System\nuHxvSB.exe
  C:\Windows\System\nuHxvSB.exe
  2⤵
  PID:9068
- C:\Windows\System\BzMEWCM.exe
  C:\Windows\System\BzMEWCM.exe
  2⤵
  PID:9144
- C:\Windows\System\lgVRjlV.exe
  C:\Windows\System\lgVRjlV.exe
  2⤵
  PID:9096
- C:\Windows\System\cjeEOvU.exe
  C:\Windows\System\cjeEOvU.exe
  2⤵
  PID:9212
- C:\Windows\System\oGgeMdm.exe
  C:\Windows\System\oGgeMdm.exe
  2⤵
  PID:9164
- C:\Windows\System\uIbiwOP.exe
  C:\Windows\System\uIbiwOP.exe
  2⤵
  PID:8064
- C:\Windows\System\GYUfVBA.exe
  C:\Windows\System\GYUfVBA.exe
  2⤵
  PID:7524
- C:\Windows\System\ShXyvNR.exe
  C:\Windows\System\ShXyvNR.exe
  2⤵
  PID:8228
- C:\Windows\System\KJRdFJN.exe
  C:\Windows\System\KJRdFJN.exe
  2⤵
  PID:8432
- C:\Windows\System\XRwNBrG.exe
  C:\Windows\System\XRwNBrG.exe
  2⤵
  PID:8460
- C:\Windows\System\UslyPwv.exe
  C:\Windows\System\UslyPwv.exe
  2⤵
  PID:8664
- C:\Windows\System\PiJnFxY.exe
  C:\Windows\System\PiJnFxY.exe
  2⤵
  PID:8920
- C:\Windows\System\RESQIBA.exe
  C:\Windows\System\RESQIBA.exe
  2⤵
  PID:7292
- C:\Windows\System\IXHsuLt.exe
  C:\Windows\System\IXHsuLt.exe
  2⤵
  PID:8420
- C:\Windows\System\RxJqJnL.exe
  C:\Windows\System\RxJqJnL.exe
  2⤵
  PID:8144
- C:\Windows\System\npYPiVd.exe
  C:\Windows\System\npYPiVd.exe
  2⤵
  PID:8588
- C:\Windows\System\ACGHzjb.exe
  C:\Windows\System\ACGHzjb.exe
  2⤵
  PID:8280
- C:\Windows\System\EIotPfj.exe
  C:\Windows\System\EIotPfj.exe
  2⤵
  PID:6220
- C:\Windows\System\SnWdyqE.exe
  C:\Windows\System\SnWdyqE.exe
  2⤵
  PID:8224
- C:\Windows\System\BDQVkvI.exe
  C:\Windows\System\BDQVkvI.exe
  2⤵
  PID:8556
- C:\Windows\System\JRCgjID.exe
  C:\Windows\System\JRCgjID.exe
  2⤵
  PID:8860
- C:\Windows\System\fptquLd.exe
  C:\Windows\System\fptquLd.exe
  2⤵
  PID:8620
- C:\Windows\System\EHJLmcO.exe
  C:\Windows\System\EHJLmcO.exe
  2⤵
  PID:8936
- C:\Windows\System\MxQCvrH.exe
  C:\Windows\System\MxQCvrH.exe
  2⤵
  PID:8748
- C:\Windows\System\OkPASXV.exe
  C:\Windows\System\OkPASXV.exe
  2⤵
  PID:9064
- C:\Windows\System\QWnrsbr.exe
  C:\Windows\System\QWnrsbr.exe
  2⤵
  PID:9116
- C:\Windows\System\xlDHNqO.exe
  C:\Windows\System\xlDHNqO.exe
  2⤵
  PID:6704
- C:\Windows\System\AHLGowA.exe
  C:\Windows\System\AHLGowA.exe
  2⤵
  PID:8572
- C:\Windows\System\dNXzZXJ.exe
  C:\Windows\System\dNXzZXJ.exe
  2⤵
  PID:7208
- C:\Windows\System\jYoxfxW.exe
  C:\Windows\System\jYoxfxW.exe
  2⤵
  PID:8412
- C:\Windows\System\DlCWqbK.exe
  C:\Windows\System\DlCWqbK.exe
  2⤵
  PID:8100
- C:\Windows\System\BHySNED.exe
  C:\Windows\System\BHySNED.exe
  2⤵
  PID:8316
- C:\Windows\System\mqtjVkS.exe
  C:\Windows\System\mqtjVkS.exe
  2⤵
  PID:7968
- C:\Windows\System\vzKfIUl.exe
  C:\Windows\System\vzKfIUl.exe
  2⤵
  PID:8808
- C:\Windows\System\iDAKXzZ.exe
  C:\Windows\System\iDAKXzZ.exe
  2⤵
  PID:7076
- C:\Windows\System\ayyXmTY.exe
  C:\Windows\System\ayyXmTY.exe
  2⤵
  PID:8968
- C:\Windows\System\tXgsQKl.exe
  C:\Windows\System\tXgsQKl.exe
  2⤵
  PID:8840
- C:\Windows\System\hqcpjUX.exe
  C:\Windows\System\hqcpjUX.exe
  2⤵
  PID:9160
- C:\Windows\System\WLdJBGW.exe
  C:\Windows\System\WLdJBGW.exe
  2⤵
  PID:8380
- C:\Windows\System\wTIjraT.exe
  C:\Windows\System\wTIjraT.exe
  2⤵
  PID:9192
- C:\Windows\System\aCmiMHR.exe
  C:\Windows\System\aCmiMHR.exe
  2⤵
  PID:8684
- C:\Windows\System\dkJrNCg.exe
  C:\Windows\System\dkJrNCg.exe
  2⤵
  PID:8520
- C:\Windows\System\stRolqa.exe
  C:\Windows\System\stRolqa.exe
  2⤵
  PID:9228
- C:\Windows\System\JlZQFtv.exe
  C:\Windows\System\JlZQFtv.exe
  2⤵
  PID:9244
- C:\Windows\System\xYBaJGF.exe
  C:\Windows\System\xYBaJGF.exe
  2⤵
  PID:9260
- C:\Windows\System\RilKDaQ.exe
  C:\Windows\System\RilKDaQ.exe
  2⤵
  PID:9276
- C:\Windows\System\uNVBOtG.exe
  C:\Windows\System\uNVBOtG.exe
  2⤵
  PID:9292
- C:\Windows\System\LCBXmff.exe
  C:\Windows\System\LCBXmff.exe
  2⤵
  PID:9308
- C:\Windows\System\xnWPrtF.exe
  C:\Windows\System\xnWPrtF.exe
  2⤵
  PID:9324
- C:\Windows\System\GdNOpOk.exe
  C:\Windows\System\GdNOpOk.exe
  2⤵
  PID:9352
- C:\Windows\System\sendOqL.exe
  C:\Windows\System\sendOqL.exe
  2⤵
  PID:9368
- C:\Windows\System\qwdQqpw.exe
  C:\Windows\System\qwdQqpw.exe
  2⤵
  PID:9384
- C:\Windows\System\BYTfXOt.exe
  C:\Windows\System\BYTfXOt.exe
  2⤵
  PID:9400
- C:\Windows\System\Tdlsuvi.exe
  C:\Windows\System\Tdlsuvi.exe
  2⤵
  PID:9416
- C:\Windows\System\gkxlvPj.exe
  C:\Windows\System\gkxlvPj.exe
  2⤵
  PID:9432
- C:\Windows\System\qiytzeZ.exe
  C:\Windows\System\qiytzeZ.exe
  2⤵
  PID:9452
- C:\Windows\System\jysbGWQ.exe
  C:\Windows\System\jysbGWQ.exe
  2⤵
  PID:9468
- C:\Windows\System\RMNGjcg.exe
  C:\Windows\System\RMNGjcg.exe
  2⤵
  PID:9484
- C:\Windows\System\LujLIub.exe
  C:\Windows\System\LujLIub.exe
  2⤵
  PID:9500
- C:\Windows\System\CgHtwts.exe
  C:\Windows\System\CgHtwts.exe
  2⤵
  PID:9516
- C:\Windows\System\pezNmQt.exe
  C:\Windows\System\pezNmQt.exe
  2⤵
  PID:9532
- C:\Windows\System\nvijgLm.exe
  C:\Windows\System\nvijgLm.exe
  2⤵
  PID:9548
- C:\Windows\System\LZtyHkj.exe
  C:\Windows\System\LZtyHkj.exe
  2⤵
  PID:9564
- C:\Windows\System\dKAVaTU.exe
  C:\Windows\System\dKAVaTU.exe
  2⤵
  PID:9580
- C:\Windows\System\KJtiCPp.exe
  C:\Windows\System\KJtiCPp.exe
  2⤵
  PID:9596
- C:\Windows\System\nEOCYJL.exe
  C:\Windows\System\nEOCYJL.exe
  2⤵
  PID:9612
- C:\Windows\System\eMfTDlT.exe
  C:\Windows\System\eMfTDlT.exe
  2⤵
  PID:9628
- C:\Windows\System\kUrtFBX.exe
  C:\Windows\System\kUrtFBX.exe
  2⤵
  PID:9644
- C:\Windows\System\mJPuAaP.exe
  C:\Windows\System\mJPuAaP.exe
  2⤵
  PID:9660
- C:\Windows\System\FgfPnue.exe
  C:\Windows\System\FgfPnue.exe
  2⤵
  PID:9676
- C:\Windows\System\SGQKKaQ.exe
  C:\Windows\System\SGQKKaQ.exe
  2⤵
  PID:9692
- C:\Windows\System\aOGoWPd.exe
  C:\Windows\System\aOGoWPd.exe
  2⤵
  PID:9708
- C:\Windows\System\paVUbHA.exe
  C:\Windows\System\paVUbHA.exe
  2⤵
  PID:9724
- C:\Windows\System\iqoYFVt.exe
  C:\Windows\System\iqoYFVt.exe
  2⤵
  PID:9740
- C:\Windows\System\vHoNBjY.exe
  C:\Windows\System\vHoNBjY.exe
  2⤵
  PID:9756
- C:\Windows\System\auzisxy.exe
  C:\Windows\System\auzisxy.exe
  2⤵
  PID:9772
- C:\Windows\System\eXkYXQN.exe
  C:\Windows\System\eXkYXQN.exe
  2⤵
  PID:9788
- C:\Windows\System\bSfaBRq.exe
  C:\Windows\System\bSfaBRq.exe
  2⤵
  PID:9804
- C:\Windows\System\pJIirdQ.exe
  C:\Windows\System\pJIirdQ.exe
  2⤵
  PID:9828
- C:\Windows\System\Xpchqtj.exe
  C:\Windows\System\Xpchqtj.exe
  2⤵
  PID:9844
- C:\Windows\System\mYiCRCO.exe
  C:\Windows\System\mYiCRCO.exe
  2⤵
  PID:9860
- C:\Windows\System\pSaccra.exe
  C:\Windows\System\pSaccra.exe
  2⤵
  PID:9876
- C:\Windows\System\iImLxZs.exe
  C:\Windows\System\iImLxZs.exe
  2⤵
  PID:9892
- C:\Windows\System\ofKehuB.exe
  C:\Windows\System\ofKehuB.exe
  2⤵
  PID:9908
- C:\Windows\System\TflggeI.exe
  C:\Windows\System\TflggeI.exe
  2⤵
  PID:9924
- C:\Windows\System\cfJuzLY.exe
  C:\Windows\System\cfJuzLY.exe
  2⤵
  PID:9940
- C:\Windows\System\HIbjfHB.exe
  C:\Windows\System\HIbjfHB.exe
  2⤵
  PID:9960
- C:\Windows\System\CahjBQI.exe
  C:\Windows\System\CahjBQI.exe
  2⤵
  PID:9980
- C:\Windows\System\UdRaEFL.exe
  C:\Windows\System\UdRaEFL.exe
  2⤵
  PID:9996
- C:\Windows\System\wljXEzq.exe
  C:\Windows\System\wljXEzq.exe
  2⤵
  PID:10012
- C:\Windows\System\xpTggsI.exe
  C:\Windows\System\xpTggsI.exe
  2⤵
  PID:10028
- C:\Windows\System\xtNroEH.exe
  C:\Windows\System\xtNroEH.exe
  2⤵
  PID:10044
- C:\Windows\System\vDVRiAw.exe
  C:\Windows\System\vDVRiAw.exe
  2⤵
  PID:10060
- C:\Windows\System\TtarcbA.exe
  C:\Windows\System\TtarcbA.exe
  2⤵
  PID:10076
- C:\Windows\System\VrZfumQ.exe
  C:\Windows\System\VrZfumQ.exe
  2⤵
  PID:10092
- C:\Windows\System\uHWCjWh.exe
  C:\Windows\System\uHWCjWh.exe
  2⤵
  PID:10108
- C:\Windows\System\hCqGlGJ.exe
  C:\Windows\System\hCqGlGJ.exe
  2⤵
  PID:10124
- C:\Windows\System\yOgkXKI.exe
  C:\Windows\System\yOgkXKI.exe
  2⤵
  PID:10140
- C:\Windows\System\KvQgbgQ.exe
  C:\Windows\System\KvQgbgQ.exe
  2⤵
  PID:10156
- C:\Windows\System\hiXfYhZ.exe
  C:\Windows\System\hiXfYhZ.exe
  2⤵
  PID:10172
- C:\Windows\System\COUsbPU.exe
  C:\Windows\System\COUsbPU.exe
  2⤵
  PID:10188
- C:\Windows\System\lHyDcao.exe
  C:\Windows\System\lHyDcao.exe
  2⤵
  PID:10204
- C:\Windows\System\FCXxPYS.exe
  C:\Windows\System\FCXxPYS.exe
  2⤵
  PID:10220
- C:\Windows\System\HXEZGxl.exe
  C:\Windows\System\HXEZGxl.exe
  2⤵
  PID:10236
- C:\Windows\System\qSOfVRG.exe
  C:\Windows\System\qSOfVRG.exe
  2⤵
  PID:8792
- C:\Windows\System\vRGuotJ.exe
  C:\Windows\System\vRGuotJ.exe
  2⤵
  PID:8812
- C:\Windows\System\UTAtYgT.exe
  C:\Windows\System\UTAtYgT.exe
  2⤵
  PID:9080
- C:\Windows\System\ZddwlqY.exe
  C:\Windows\System\ZddwlqY.exe
  2⤵
  PID:9252
- C:\Windows\System\DIGEKQy.exe
  C:\Windows\System\DIGEKQy.exe
  2⤵
  PID:9272
- C:\Windows\System\OEerhDy.exe
  C:\Windows\System\OEerhDy.exe
  2⤵
  PID:9336
- C:\Windows\System\YwYgfGA.exe
  C:\Windows\System\YwYgfGA.exe
  2⤵
  PID:9392
- C:\Windows\System\oLMuQOh.exe
  C:\Windows\System\oLMuQOh.exe
  2⤵
  PID:9380
- C:\Windows\System\rhBPCWz.exe
  C:\Windows\System\rhBPCWz.exe
  2⤵
  PID:9376
- C:\Windows\System\VuuiIVH.exe
  C:\Windows\System\VuuiIVH.exe
  2⤵
  PID:9492
- C:\Windows\System\OuFCFCt.exe
  C:\Windows\System\OuFCFCt.exe
  2⤵
  PID:9440
- C:\Windows\System\LnTASTG.exe
  C:\Windows\System\LnTASTG.exe
  2⤵
  PID:9512
- C:\Windows\System\KeLQIQg.exe
  C:\Windows\System\KeLQIQg.exe
  2⤵
  PID:9560
- C:\Windows\System\XYzlgMs.exe
  C:\Windows\System\XYzlgMs.exe
  2⤵
  PID:9624
- C:\Windows\System\beWSoLJ.exe
  C:\Windows\System\beWSoLJ.exe
  2⤵
  PID:9688
- C:\Windows\System\TnUmtIp.exe
  C:\Windows\System\TnUmtIp.exe
  2⤵
  PID:9780
- C:\Windows\System\nqmQzfM.exe
  C:\Windows\System\nqmQzfM.exe
  2⤵
  PID:9852
- C:\Windows\System\sqibOEl.exe
  C:\Windows\System\sqibOEl.exe
  2⤵
  PID:9764
- C:\Windows\System\ELyetyl.exe
  C:\Windows\System\ELyetyl.exe
  2⤵
  PID:9608
- C:\Windows\System\TWvYhiO.exe
  C:\Windows\System\TWvYhiO.exe
  2⤵
  PID:9800
- C:\Windows\System\XmJhQsE.exe
  C:\Windows\System\XmJhQsE.exe
  2⤵
  PID:9856
- C:\Windows\System\CDsJchW.exe
  C:\Windows\System\CDsJchW.exe
  2⤵
  PID:9916
- C:\Windows\System\fueevjC.exe
  C:\Windows\System\fueevjC.exe
  2⤵
  PID:9904
- C:\Windows\System\zyrztLL.exe
  C:\Windows\System\zyrztLL.exe
  2⤵
  PID:9956
- C:\Windows\System\lNMaejz.exe
  C:\Windows\System\lNMaejz.exe
  2⤵
  PID:9976
- C:\Windows\System\zEIdhKr.exe
  C:\Windows\System\zEIdhKr.exe
  2⤵
  PID:10008
- C:\Windows\System\eIEGmbh.exe
  C:\Windows\System\eIEGmbh.exe
  2⤵
  PID:9332

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\LTtphqD.exe

Filesize
2.2MB

MD5
45b9e8e959a52bc92e0b0617d8df6edc

SHA1
a72f5cd6fc1418887dfcb21db02b67364c374f20

SHA256
e43db7140f0855753bf94f84e4980119d600e6b0003a943874eea193d3b4bde5

SHA512
142143261c8239899fb2fb8693504a8adec4260ed95aca62d337f84197c8939aeb6698ccd3276ab613ebbe79a8c8141869c6bb036cc429b92b035776518e9198

Download Submit
C:\Windows\system\NXmDhrQ.exe

Filesize
2.2MB

MD5
2d5c4572cd62a15869265cdd61bc8bce

SHA1
9aaa61892d33119dde0914a977617a5e93e925c1

SHA256
36813702ab14402e8fa7ac049283b95289dabeb60b355e5aa5d0d6a8e9f1b231

SHA512
020049f133903980306b3db4f22e1291628e28b0f5523ce353cde8e6252012735b71a6d838e9913a39cd0c383b96ab7dc0ff5aed04a18cf2e0467ff0b50f5bba

Download Submit
C:\Windows\system\PDdyBxy.exe

Filesize
2.2MB

MD5
9f842bde6fe6cba05d6e3b910857ce02

SHA1
b8b0840abc211b5ad8e1c688152d54a7c008778c

SHA256
a1a377914087d053990c1791836883c88ff864d732c36d3727197c69255e6933

SHA512
7aceb7869ca38d1462fa2bc01702a20f5ea6458a59a3151babdf31d79ad2f61bf169767ab557dd4e1d0f230750333a5a656ca8181ed2d38e5ffdbedca9f5f2ed

Download Submit
C:\Windows\system\PHYCtAh.exe

Filesize
8B

MD5
0b02220145771e90ebe4310a5742c9eb

SHA1
9bd568d96b03bd5446f96a7b59c08196eb5a57c3

SHA256
6135f164d0697be47c97ab606a7a1adcbc1eb3846ae4debecafb1a6ccfd23e4e

SHA512
cb08dee7f4e4dd1bb8de836a2364c078d9de5aef5dcb329e7e0b8e1cc2bfaa06c42f8b8ddf04bdb30392074759beef091a761854b0812b9a726b3c820c99a5a8

Download Submit
C:\Windows\system\VYFqBLi.exe

Filesize
2.2MB

MD5
ff557709cd4f250df68adb661699f559

SHA1
ce2be590c4c781c9bbd504977a2994cc74b0e1d3

SHA256
998aa34f351c00daeb4b9d0f0ecd42882efba7912768da6fa791f886f2c07815

SHA512
3a055e705656368d0adb8dd96a662eccfdf15c724227d8019f7637b533c7821d24049cfa9b848c4d36681c62fbcbc2c6cf545f74923d3e13dca4dc14e9d7b73a

Download Submit
C:\Windows\system\WkMelmK.exe

Filesize
2.2MB

MD5
a06f6d1493217625bc60bb8c219f955e

SHA1
a6ad26f358efda4e9c5f742105788ebc0f1fed0f

SHA256
51e807220d47f2fe20ac666c7792ec90dd9a5b3c992aab2b6b42b65f9aee1e3f

SHA512
3352b6672bb6bb4331978c488f59af33e9002dbd2d2dc1b8e393048db7fbb07471338a3f795164e6f9a8110f42247075bea663dc6a1fc51d7f9c5a630ddfaebb

Download Submit
C:\Windows\system\aYcUgQO.exe

Filesize
2.2MB

MD5
1a91b4c322c5512b7461227bc5f21791

SHA1
e37deb5950d1f611a82586203ecaa41808fd5854

SHA256
86d368f96365104157795c0659c9b740d9b3ea8c1e5966640e059822ce328acf

SHA512
44ed093feb72f160917441a5602e80e2ba52dcdf9a5f06b30ba45c555fc1ee149caa047fef98fdd31925f37948e84433606c0834e0867576e811c38964c8dc87

Download Submit
C:\Windows\system\faXdorj.exe

Filesize
2.2MB

MD5
dc2673ae0a24ad24f3c8803be4dda6ba

SHA1
11fc9339829d75c52000db55bb0b446174b90868

SHA256
f634dcc5df90316b82ba7e227189d9f79e4b2700b27b6908ede5430b30a2561f

SHA512
3aba7f5dd9ad7c6c027bc9c8173fd40a47045b3f3cbbfb1cace16240aba226fc09944b37447e2fc96622694ece4b142ef8480d3bdb6938c7817af752d75a2ee0

Download Submit
C:\Windows\system\flOCATA.exe

Filesize
2.2MB

MD5
08a64f26b597f5100b2d69e8112f422b

SHA1
f4d9f12f1844f804d23decf996fa46e9e939e1ed

SHA256
f43c52362fa8d7e8b3bda1022b031c00f5b19f4700a323f1104443b1b13ea616

SHA512
884e01b86acaf8e0cf7d1ede06a753ba0644b0e01f418f2d26a26f1a61fd8f878f11fc752794f6c1e2262d8f3101ba7ff103a0ea8d5de28fe89d21ab494c9d79

Download Submit
C:\Windows\system\gXmEiSL.exe

Filesize
2.2MB

MD5
f5a0fbad289a5bffd769aeeb5776c476

SHA1
d5586fe8854ed0a9707f3d4fe89d041a94079d78

SHA256
55a20e8b1dd70b5dc4abfa0a9e97863765d9d83645d486257cb2b9f37be38b61

SHA512
da7af4fb42acc9d876362b70c737767dd0be513568114040da11ccd074c2adfd934616b4175fe2ad08ac57c1442d328c1d98bfc6c53902aa2fce1d5541beebe2

Download Submit
C:\Windows\system\ggJlwgh.exe

Filesize
2.2MB

MD5
793e496dac8f5da859d3b3dc2eea97c4

SHA1
57dffcb4f8b57a6a8939e140cc43a02a13a04260

SHA256
4d3388f2567df7cd72d33f4e341c797954500286c5f6a9b0737e8dd442a23365

SHA512
cff7508194abfb7513690ca295841ad67a2cb6a37813c4a07438d8fcd353f7a9ef33016a1429a4c0b62530cd7a6482720e334549c538e72a388e07156d263c5b

Download Submit
C:\Windows\system\huDrGbV.exe

Filesize
2.2MB

MD5
5aab75a6434bd072e815db5610f5d01c

SHA1
e0f6ced3890d9fe6a938c7baee33887f417b4e10

SHA256
4369d5fb63d50c1a2fe2c180ccdf2fc1a8286c83d6a8e5394aeeb970c4a45af9

SHA512
b45caded27e248956fcfe05e18ea5b21ff7d55d8e91ab784fa8aed8bf2c2461c88414bda8f11173c783f7c2be4bab0001de4a111628955d1f8016e1a1957d62b

Download Submit
C:\Windows\system\prHEimS.exe

Filesize
2.2MB

MD5
a8ce7b6c78c9edc6d05a92b32a4a687f

SHA1
6db1851e5e76cffe78a68e8ba2c75ffc9f840d68

SHA256
db66125807e6a6c51dc27b127b95ee366d76209634aa6d936de73f91aa174a92

SHA512
d5f4d676b9972afa03a2de5b5605a67352bc52ac4ea495877abc838e7c332dd8808de301848b2f2621dc2dba3ee81c8e9037dc1e82dd48556a2af9582c0e65ed

Download Submit
C:\Windows\system\qUbaeXW.exe

Filesize
2.2MB

MD5
28dbdb2d5a70960b2b4baf94fbfafc47

SHA1
fc5684fe2c73e21d007b1ca77acea7b1f08baba0

SHA256
36dff807127ec0104ab858822829a215a96d94528f48cca9a9ab2b1a5c25e81c

SHA512
6acf31613c43efe5351821a80dd8fc62b72f7ddd0a99d4932750daccf5428132dd468bb6b323443cb7f42b300b51ac5cc922880ea83648c46c19bedd99ed4fc9

Download Submit
C:\Windows\system\rJGCwlR.exe

Filesize
2.2MB

MD5
a14f3df0e1f0441a71388fbb4543c31f

SHA1
4f85bc5bed5d5dce8a71ff11edf3953aaf6b1ceb

SHA256
cfdc413f9d9198acab8f72a60d40486c7e3777ad085ab1fa17433cbc99f4d410

SHA512
7326c5ec0f18575390263acc1a25f5543b771b60b01b2de2fda793f4a5666b776634401bea233989364575f7cb5750cf988a1b4330f7745d59388aad45aed6a3

Download Submit
C:\Windows\system\rcTTVzL.exe

Filesize
2.2MB

MD5
bfdafe34059962cd89d5a8c2a319f2b9

SHA1
3f62ae5f482f6c1ad7bab828572a84b2a033fcfa

SHA256
a82ade529d7619ef0cd7a1114343d13c2ababa0a4e2804b5d9796fddb8957560

SHA512
c219e29e3b8a77059b207b924dfae78947af271412cec783e7a47226e6750bbd5f479c3bcd0cc442b57aa4024c629367d6561330b430c56571c81488ad96e961

Download Submit
C:\Windows\system\vzBpoks.exe

Filesize
2.2MB

MD5
1ce2e9d8c90b7abde00eaa230d502105

SHA1
9b725310c66b7cdec14749619d8a9b4368edd046

SHA256
914345c2ba1eef654da840f21c299def134345cedb225ce6d5bde9753fed0b0e

SHA512
73e19adba21a50f3b8d586b8a0d906fb79b4458a9cd2e64f2f7c97cdf23aa809e7f5de165429de5455102f1fd8d1fc3ca2df6462bf354282920f3d3515b30e8d

Download Submit
C:\Windows\system\zrjnroI.exe

Filesize
2.2MB

MD5
a87b4da5a440ae3e7cf1c761154e599c

SHA1
3bf1e8972e61bbd034f831da9df4558852216cff

SHA256
890e49efca72cd2098aef4140f634e7ee05c9291dbc362cb4e07537b224c3e3d

SHA512
84e7ed133ce47c1eac99343401d0502d543c435b1fdf7b4c707106caf48c339183e5980be4dab96eb134da8c48b2ff57c2d78619273017536b852170326deea3

Download Submit
C:\Windows\system\zwZryLT.exe

Filesize
2.2MB

MD5
0592895513f5a4dcd3620c33a2e0420f

SHA1
d25c445d5809c006edbe04fce169ae46af9f1232

SHA256
0b7a9bede3537f2d7608a3fd0df2d2296831a9c9ec668b53fba05354589461d1

SHA512
57905848c90bab81c23b32c059471deb3d1e58937d1bbf16242e28f665987da66b4c58d8805eef0b4916f5b76b42b5ce8beb7abcb7a1c8a5bec34c72c4c59e81

Download Submit
\Windows\system\AICAYWW.exe

Filesize
2.2MB

MD5
dcfa56d2b2012a69d8546ab92f65f89c

SHA1
ed4226f53e99b5f7b83a5a92db9615f47a17aef1

SHA256
b4620ac2919bb8ea63d49ba7ef82878754dcc1f34ea787b67151d6692a0e24af

SHA512
a601a16c62c6e07bed1ba5a638160eb46c4cf9d732dd8ab82c1d91127a2d28b260d7a979859a546d442858ec83e8d786bdc21ed570a164d63bc9331c616e0f5c

Download Submit
\Windows\system\BdXaQYz.exe

Filesize
2.2MB

MD5
395ba3454b47b88fbd6e5ee5971e6c18

SHA1
4c05c6fa3186bcee7646198bee47737335509f04

SHA256
08c584d12ee22ff0fb76fd6b522c85c4768d382275428c3e25fc749ecca22b99

SHA512
7c4ddad74b9280bf9f8b386fddf1bf571c4e48e2bacaf7d50c7fc3a2d63616ccf66b7b65aaca78bf63ba7939c79bf502b1bf361f569ce24f849b7518de941b9b

Download Submit
\Windows\system\OOjmGCQ.exe

Filesize
2.2MB

MD5
38073a4e2ae97ec036804798297f8e34

SHA1
fa5e5d00a2c70ae69486bda9fa66c8897673ebaa

SHA256
f15d182139ff18ed6eec279858d4a6bb3c9da405c4b5fe74718a47c3e07605a6

SHA512
8d9ebf1e027572b2769c58de16f16cc4d4ee38789aeda7fd4e0ab6f495f6d9184081e4a3f6b57eb40c54ba7616369d5d7efe42d870874ea6f77d4bd610203e79

Download Submit
\Windows\system\QtGoCNi.exe

Filesize
2.2MB

MD5
16305caa9620af7075e8efe3e16464d4

SHA1
e38656dc903b5ad3feaa8c9747b0a21c2ca9461d

SHA256
52981dec6c52ce5464c53ee940b4a80b4b47229293c4bfbfad6f384c469a0a5f

SHA512
e1bdf4cbc3b3b911192053da5a1c88a19ad2560af201489d59c68acbca28f4d9a4d7e570aa6881d81bc71b5dc74a57dfb3880c23f0483afdcb8d5d989b9dfe60

Download Submit
\Windows\system\WtjrXCN.exe

Filesize
2.2MB

MD5
5258febcf0893e840ed946e433cb1cb2

SHA1
9fa3fb5e4802d6879c67910b20b23b38ff2c611c

SHA256
555ba140587f1ad1c20d929579b8f55d801b9f6f75b2e39994fc996ca822a710

SHA512
93cc3daf61dcbe0b99aadcec082d1950023fa09de3502f8f0022de7374e21dc0a60a05ca80a2c43c58d7686f867c69549332b55941eb9fe6fb72961fdfe4a08c

Download Submit
\Windows\system\XHJzLOq.exe

Filesize
2.2MB

MD5
0d3902431ccf43ec118520bc34387727

SHA1
07e5437c1cb0b9af9555a535a0157ca42de2213c

SHA256
c7c6f47667c7e4831700790e90dcf61f928d43af8c9f3c47a11c8420bb8d00be

SHA512
df96a53171a2d3e43c5189b0c93c1c5afc4eed842e0147385f8dedcbcf4a6979509e9613a1edee24916557418b2758d4a72b9569978aa62f4037d68e5438d25e

Download Submit
\Windows\system\YJfSrVU.exe

Filesize
2.2MB

MD5
61b103519925b51ceca3fdd39fc20b07

SHA1
6f50b26b56ec7afe09ae5cfee5a3e8c071e23c2a

SHA256
4df5be45220cec9ad657e6fbe1ddf09abec581d7b8167c3e3b1731fb40f6c574

SHA512
288237b7215c66209a0d805d2d67aecd6732ff67dd8780daf882b9c5492b15f8c7508fa32e208b398438ac2dcd1724d06db23c0a416793d1af14ffee16899a8a

Download Submit
\Windows\system\azbPXFg.exe

Filesize
2.2MB

MD5
f605816dac07e5f0eb574f23424b9527

SHA1
2b342f32a4d5dad67c8e636a2f5f27d417e93e95

SHA256
e2a1d2618f3e316771cb6db5fe9c948de3eae61483eb2f3734062d05181122e3

SHA512
432971c301b808783dc10cafa4c4fe98106e745c591eb98d62600f45d0316688db603f526d5c0a0d0ea9e10c1b2502b2f4dc615a408fc7229626e4e6404a94ab

Download Submit
\Windows\system\eCchTVr.exe

Filesize
2.2MB

MD5
3c9be192cad827e3bf3ac01055bc28ac

SHA1
54158bdbe75ff7032129809bee5c2ddea9746e9d

SHA256
a79fb0d1bc8ae9cd0ad71863d8489e190710ccf3503fe8970d1ef361189c0fcf

SHA512
9c9eb54de900fad0e52d4777fddd9d4f00c2ece74735214f4585485b776babb97d957bc81bd024c1096560a9927ee73a56016c80d44208a44f870c04320a8ee8

Download Submit
\Windows\system\hbCdeXj.exe

Filesize
2.2MB

MD5
e318099a418c3eeded5e0dfd1e711737

SHA1
e4f3e8a89147039af9b79298f39a8eac19e6c099

SHA256
ddcd3f521ebbe05b9af59340deba63e6fe9af9c1f47d28d21909a3cb8dab07ba

SHA512
6631848486e3368faa9d0c8c1ba35d26a1b7e87159b53d9ae459d1d811412c9003065d041fe229b950e2cbcc2fcb5dcd269f6408002befb5871347f904b0cb01

Download Submit
\Windows\system\lQsYZBI.exe

Filesize
2.2MB

MD5
2925b5a118ffc5b8b444218d3fc3abf8

SHA1
2c5b49379ca5a40d3d0e19096e282952a6215cd0

SHA256
8c412b98818e2b0c123175e978c8f356f216d1af54b2ec404aa1c1350f3658fc

SHA512
68b754776ce4a2ab159ef0e8f941deeb6f3df58b5a130a14fde066b5564246163f17c8dc8ee68991c67677f8dc53b8eda01b347f515a36d3537abe5047286449

Download Submit
\Windows\system\lonklaJ.exe

Filesize
2.2MB

MD5
e6c569d0f1e0312621bf163f9f043e48

SHA1
8c71f67bbb6e276b024497d1b9b6195353cf65ee

SHA256
af74fd5c8443cde61309f3cbc1357b8473f515b67dbaa4639ea84789a6c10d0b

SHA512
625b3d0e399e4d2a63d0275c25ea36f8b9431be8d5a98d0099ef4e1e2a7d2392fee23473c33b554c40893cfc13c83d3c9e7fda7ca573a4ee910b62292eb9c513

Download Submit
\Windows\system\pqMRZmo.exe

Filesize
2.2MB

MD5
0ececce4e525cdfdd3fc2ab4c7c3cb68

SHA1
8a39e54e88e957de9763bf8c496fd99025ae913b

SHA256
edfb9c4929354cf5e2ebce48ce330b1a64d60dbd44bdb188ef21612fd15bb0e6

SHA512
a0d4e4ac0bcd95a092b4cd17011feda7eaa5d52edab692546aff883a45b8e6d44a2b36f32167af7392b45a81acc59ff0fe929d3ca27e6637b528984fb0dc26ae

Download Submit
\Windows\system\qrOqIKK.exe

Filesize
2.2MB

MD5
827b683e0ad87d5fce7ca4cc6411ca7a

SHA1
f4a4721bd0b5a297bf3de6f831fde296dd8a2189

SHA256
24231ed35f042d46d1e8a985d6aab24bc2404d5feb07ee93346de607af4ad02f

SHA512
eff1d6b29cc962806906d6bae3aa3dd8035b7c4191797f64c791262d1c34b22f841e4d25caeb42169e60b9dbe9c61401271e9b4bc3a1053821d8f5e84c1209b6

Download Submit
\Windows\system\rCSCgyg.exe

Filesize
2.2MB

MD5
a49b418e851e9e802ca966d103816f22

SHA1
28ec4b04e03c6b7ab182e1c33c92c79e1fdc7d02

SHA256
27a793ba53ac79387b292f7e60e1b40347e37775e6b60ae92672909d93ec5770

SHA512
476be44d3b47c6fa078454c37a0375c8cef7453b7c0b99fab4c116a11ec299168f48bfc7d9106b51410e0bd42f85da74e856d35574faa26caa51702c461f5bfd

Download Submit
\Windows\system\uIcFVja.exe

Filesize
2.2MB

MD5
b200039f2c7cba21dcf9ba8908f9ec7f

SHA1
7c34db0154dc047567c4f961cc999c45f4fc6bad

SHA256
5a009554eca8d05c7b30931acc155d16d8cf265b0b5ff4bd64882451871dd353

SHA512
53041637abda421028cf88300e4398f60af3b955bbe81dec568ead11a78f7cbca56f0179ebdf8ac46b1108cae985b289967e718beb78fc3c13c917b25ae74610

Download Submit
\Windows\system\uSdRSwd.exe

Filesize
2.2MB

MD5
d1e7ef463b20379491c0ed7970675610

SHA1
c60b2685858ca3dec8bc993113fecff07512f9c7

SHA256
7bc6e6b91b96cbe489819c1832a3d28e0932741218cd1a0d72cb169988ae386f

SHA512
f6bb586a7a0b5bb97177fd02030db2d972ed05d13b9f633dbbdb20e39cda474d29dc745d7bc9fd1556836ce9279a25898644ebf9aac874e4516999896b98c91c

Download Submit
\Windows\system\vHnodTk.exe

Filesize
2.2MB

MD5
7ed993cc71ca52b28cfd4408bc1a179f

SHA1
87be898fb3af95da6fa46adbcd63641a59212839

SHA256
1a4a1eb3e6ac7ff027a87f0d98cc4c1f9110635e67117f7adfc2573efdc498bc

SHA512
36580857e265d8af7ce7c8762709029280e6794cae046a56cf61c9d339dff4434c17df21e4c6f56cb996c2cdb991e067250360632c4fdf81910c851b529018a4

Download Submit
\Windows\system\xhiWQIe.exe

Filesize
2.2MB

MD5
8bbc0bb5629bd1cd8635fbc51a2663cd

SHA1
74fa52f26c9e820b48191d8e191ec0e6bf48ca4c

SHA256
fb744c9695fa8722839df89e8990f4d4945e01adce0c4a30655496c5b55398d3

SHA512
2081564f9e636d6ccfb48835ec81eb3677d50dd5f96a9523260ea0fb5fafb30902fcc2c28bf154f5d6ba46bf949b78ec8b7d2c3f7a96dd8c428daeb01184fdce

Download Submit
memory/2104-43-0x000000013FF80000-0x0000000140372000-memory.dmp

Filesize
3.9MB

Download
memory/2156-37-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2180-92-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/2428-186-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2428-188-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2480-83-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/2528-117-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2540-86-0x000000013FBE0000-0x000000013FFD2000-memory.dmp

Filesize
3.9MB

Download
memory/2596-40-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/2632-72-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/2684-44-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/3000-127-0x000000013F1A0000-0x000000013F592000-memory.dmp

Filesize
3.9MB

Download
memory/3024-84-0x000000013F460000-0x000000013F852000-memory.dmp

Filesize
3.9MB

Download
memory/3024-81-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-42-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/3024-25-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/3024-5-0x000000013FFB0000-0x00000001403A2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-35-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download
memory/3024-78-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download
memory/3024-38-0x000000013F0F0000-0x000000013F4E2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-80-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/3024-34-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3024-46-0x000000013F8A0000-0x000000013FC92000-memory.dmp

Filesize
3.9MB

Download
memory/3024-0-0x0000000000180000-0x0000000000190000-memory.dmp

Filesize
64KB

Download
memory/3024-39-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/3040-31-0x000000013F150000-0x000000013F542000-memory.dmp

Filesize
3.9MB

Download
memory/3064-41-0x000000013F760000-0x000000013FB52000-memory.dmp

Filesize
3.9MB

Download