xmrig | 762cc3d88513276a56dd306ccbfba748e93ab69012045acd56d42ce0ee7f0bd9

Analysis

max time kernel
18s
max time network
29s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-04-2024 23:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
Size

1.7MB
MD5

0aaf955d9dbcc49c01e9abeb00c81e7a
SHA1

1dcfc7b9fe63b206bcd2a6c2327a6410c5899735
SHA256

762cc3d88513276a56dd306ccbfba748e93ab69012045acd56d42ce0ee7f0bd9
SHA512

e033d68f71f933c1be157b4291ada996b8a1611b6cf3197b31b2fdf306f3581ddf2ae9d0e321a9f8dbf3f2139c2584319c58efc2d7f156bd910e3a2467997b4b
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SGkMKO:NAB3

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/1680-226-0x000000013FD80000-0x0000000140172000-memory.dmp	xmrig
behavioral1/memory/1636-227-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2640-230-0x000000013FD30000-0x0000000140122000-memory.dmp	xmrig
behavioral1/memory/2612-231-0x000000013FB70000-0x000000013FF62000-memory.dmp	xmrig
behavioral1/memory/2528-233-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	xmrig
behavioral1/memory/2532-234-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	xmrig
behavioral1/memory/2724-235-0x000000013F440000-0x000000013F832000-memory.dmp	xmrig
behavioral1/memory/2740-237-0x000000013F360000-0x000000013F752000-memory.dmp	xmrig
behavioral1/memory/3004-244-0x000000013FDF0000-0x00000001401E2000-memory.dmp	xmrig
behavioral1/memory/2660-242-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	xmrig
behavioral1/memory/2424-240-0x000000013FFA0000-0x0000000140392000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1680	bpPGeTh.exe
1636	SIoGFPe.exe
2640	gnQRAgS.exe
2612	adVclhC.exe
2528	TlGPnJU.exe
2532	TBeUNuC.exe
2724	zULnbJB.exe
2740	SNVstWd.exe
2424	tkqSZnI.exe
2660	tVhhzWE.exe
3004	GXQnLfk.exe
1952	OYxgOID.exe
2672	zBoSDNn.exe
2744	umvUWkb.exe
2456	kJoPpxO.exe
2268	dRDbJjj.exe
2412	pvIgSVS.exe
1280	DjBYTIm.exe
1240	hQwdKkt.exe
884	lzBybqy.exe
1956	PWsAxAD.exe
1940	lddpPXq.exe
1628	OgznKJk.exe
2880	lBLnFVH.exe
2336	tZFtnfc.exe
1744	izerFVj.exe
2928	RfLGiOR.exe
2768	jWEqehO.exe
2824	jlMIbSE.exe
316	yraliBt.exe
2308	idFyPFg.exe
1496	yXNIFGn.exe
1852	NMRceSx.exe
1816	XnwnXzf.exe
780	SpjrlSe.exe
852	vcdpuya.exe
1092	jCANBhb.exe
1756	uFJMoUE.exe
1504	INrmoDG.exe
1780	kYjymAz.exe
2276	ErHxucn.exe
1528	oRQbvTG.exe
960	johTlhC.exe
1608	quPOyvO.exe
2272	UZKnRLI.exe
2016	tRWWbfN.exe
924	uTGGKCD.exe
1568	ApELmHE.exe
2220	APfARlU.exe
2052	BbBDgtj.exe
2964	sykETZE.exe
2840	TCDwlrk.exe
1596	qPVxCTS.exe
796	FOYcftX.exe
2208	hOaBBRu.exe
1584	RyWQwXG.exe
2668	cVMOIAM.exe
2748	LThCkPj.exe
2868	nDlcCwM.exe
2884	ZdMuOXx.exe
2448	dhteayK.exe
2488	TLjGKvo.exe
2544	ZEwButg.exe
1932	iBIZFkk.exe

Loads dropped DLL 64 IoCs

pid	Process
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-0-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x000a0000000122b8-6.dat	upx
behavioral1/files/0x0008000000014594-13.dat	upx
behavioral1/files/0x00080000000146e6-21.dat	upx
behavioral1/files/0x00300000000143fd-24.dat	upx
behavioral1/files/0x0007000000014726-35.dat	upx
behavioral1/files/0x000800000001568c-40.dat	upx
behavioral1/files/0x0006000000015cd5-65.dat	upx
behavioral1/files/0x0006000000015d56-84.dat	upx
behavioral1/files/0x0006000000015d5e-105.dat	upx
behavioral1/files/0x0006000000015d9b-136.dat	upx
behavioral1/files/0x0006000000015eaf-145.dat	upx
behavioral1/files/0x0006000000015fe9-164.dat	upx
behavioral1/files/0x00060000000161e7-159.dat	upx
behavioral1/files/0x0006000000015d87-126.dat	upx
behavioral1/files/0x000600000001630b-165.dat	upx
behavioral1/files/0x0006000000016117-158.dat	upx
behavioral1/files/0x0006000000015f6d-149.dat	upx
behavioral1/files/0x0006000000015e3a-139.dat	upx
behavioral1/files/0x0006000000015d6f-116.dat	upx
behavioral1/files/0x0006000000015d8f-130.dat	upx
behavioral1/files/0x0006000000015d79-120.dat	upx
behavioral1/files/0x0007000000004e76-96.dat	upx
behavioral1/files/0x0006000000015d67-109.dat	upx
behavioral1/files/0x0006000000015be6-80.dat	upx
behavioral1/files/0x0006000000015d4a-74.dat	upx
behavioral1/files/0x0007000000015ceb-100.dat	upx
behavioral1/files/0x0006000000015d07-66.dat	upx
behavioral1/files/0x0007000000014857-58.dat	upx
behavioral1/files/0x0006000000015cba-54.dat	upx
behavioral1/files/0x000700000001471d-31.dat	upx
behavioral1/files/0x0006000000015d28-71.dat	upx
behavioral1/files/0x0006000000015ca6-52.dat	upx
behavioral1/files/0x00110000000144f0-14.dat	upx
behavioral1/memory/1680-226-0x000000013FD80000-0x0000000140172000-memory.dmp	upx
behavioral1/memory/1636-227-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/memory/2640-230-0x000000013FD30000-0x0000000140122000-memory.dmp	upx
behavioral1/memory/2612-231-0x000000013FB70000-0x000000013FF62000-memory.dmp	upx
behavioral1/memory/2528-233-0x000000013F7B0000-0x000000013FBA2000-memory.dmp	upx
behavioral1/memory/2532-234-0x000000013F8E0000-0x000000013FCD2000-memory.dmp	upx
behavioral1/memory/2724-235-0x000000013F440000-0x000000013F832000-memory.dmp	upx
behavioral1/memory/2740-237-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/memory/3004-244-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2660-242-0x000000013F1B0000-0x000000013F5A2000-memory.dmp	upx
behavioral1/memory/2424-240-0x000000013FFA0000-0x0000000140392000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\dyfpAeh.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\uyNTePO.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\tkbHujz.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\fsEybts.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\GepNINP.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\VxSMlCQ.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\UTVFygw.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\CcZRLxa.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ZVziOIx.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\FUbvgOy.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\mlCPyPz.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\DZjbIkc.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ILstcpK.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\hfrlims.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ezXBKpo.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\jMJMFRn.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\WBVqheS.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\pGYVMkS.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\kSPZByY.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\hQwdKkt.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\RyWQwXG.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\QquwRzH.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\bWKQPed.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\LPQWARJ.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\fyxxHyr.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\WEqVKeP.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\cftQvFC.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\YhIQIkm.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\VrrvzBq.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\zEVpCxj.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\iAZCxlF.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\vBFuvmh.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ssJYeQM.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\aUlLvIZ.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ihCyraL.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\TPMDeCU.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\Oxebogh.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\jPRnNnA.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\KeAgCsx.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\hQghOzC.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\pMtUMDy.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\uUZyooZ.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\bCyifhB.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\MqawkNZ.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\qbkioHc.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\iJwOCvT.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\ZyHeGvl.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\GptxffX.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\NgAhEch.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\qPVxCTS.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\dwfechM.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\MHMhBll.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\NKwfSDj.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\VWiJWwy.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\hdtdAxp.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\fFOwrdM.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\qvwPLCq.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\quPOyvO.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\OVNbbuf.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\QAvRXjp.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\WkcfdDd.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\GJeetHB.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\TRyfkpX.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
File created	C:\Windows\System\AEfXBoL.exe	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1512	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeLockMemoryPrivilege	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1512	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	29
PID 1632 wrote to memory of 1512	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	29
PID 1632 wrote to memory of 1512	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	29
PID 1632 wrote to memory of 1680	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	30
PID 1632 wrote to memory of 1680	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	30
PID 1632 wrote to memory of 1680	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	30
PID 1632 wrote to memory of 2612	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2612	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	31
PID 1632 wrote to memory of 2612	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	31
PID 1632 wrote to memory of 1636	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	32
PID 1632 wrote to memory of 1636	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	32
PID 1632 wrote to memory of 1636	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	32
PID 1632 wrote to memory of 2528	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2528	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2528	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	33
PID 1632 wrote to memory of 2640	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2640	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2640	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	34
PID 1632 wrote to memory of 2532	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2532	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2532	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	35
PID 1632 wrote to memory of 2724	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2724	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2724	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	36
PID 1632 wrote to memory of 2660	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2660	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2660	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	37
PID 1632 wrote to memory of 2740	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2740	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2740	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	38
PID 1632 wrote to memory of 2672	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2672	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2672	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	39
PID 1632 wrote to memory of 2424	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2424	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2424	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	40
PID 1632 wrote to memory of 2456	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2456	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	41
PID 1632 wrote to memory of 2456	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	41
PID 1632 wrote to memory of 3004	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	42
PID 1632 wrote to memory of 3004	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	42
PID 1632 wrote to memory of 3004	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	42
PID 1632 wrote to memory of 2268	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2268	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	43
PID 1632 wrote to memory of 2268	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	43
PID 1632 wrote to memory of 1952	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	44
PID 1632 wrote to memory of 1952	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	44
PID 1632 wrote to memory of 1952	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	44
PID 1632 wrote to memory of 2412	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2412	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2412	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	45
PID 1632 wrote to memory of 2744	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	46
PID 1632 wrote to memory of 2744	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	46
PID 1632 wrote to memory of 2744	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	46
PID 1632 wrote to memory of 1280	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1280	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1280	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	47
PID 1632 wrote to memory of 1240	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1240	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	48
PID 1632 wrote to memory of 1240	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	48
PID 1632 wrote to memory of 884	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	49
PID 1632 wrote to memory of 884	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	49
PID 1632 wrote to memory of 884	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	49
PID 1632 wrote to memory of 1956	1632	0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0aaf955d9dbcc49c01e9abeb00c81e7a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1512
- C:\Windows\System\bpPGeTh.exe
  C:\Windows\System\bpPGeTh.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\adVclhC.exe
  C:\Windows\System\adVclhC.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\SIoGFPe.exe
  C:\Windows\System\SIoGFPe.exe
  2⤵
  - Executes dropped EXE
  PID:1636
- C:\Windows\System\TlGPnJU.exe
  C:\Windows\System\TlGPnJU.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\gnQRAgS.exe
  C:\Windows\System\gnQRAgS.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\TBeUNuC.exe
  C:\Windows\System\TBeUNuC.exe
  2⤵
  - Executes dropped EXE
  PID:2532
- C:\Windows\System\zULnbJB.exe
  C:\Windows\System\zULnbJB.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\tVhhzWE.exe
  C:\Windows\System\tVhhzWE.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\SNVstWd.exe
  C:\Windows\System\SNVstWd.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\zBoSDNn.exe
  C:\Windows\System\zBoSDNn.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\tkqSZnI.exe
  C:\Windows\System\tkqSZnI.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\kJoPpxO.exe
  C:\Windows\System\kJoPpxO.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\GXQnLfk.exe
  C:\Windows\System\GXQnLfk.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\dRDbJjj.exe
  C:\Windows\System\dRDbJjj.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\OYxgOID.exe
  C:\Windows\System\OYxgOID.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\pvIgSVS.exe
  C:\Windows\System\pvIgSVS.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\umvUWkb.exe
  C:\Windows\System\umvUWkb.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DjBYTIm.exe
  C:\Windows\System\DjBYTIm.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\hQwdKkt.exe
  C:\Windows\System\hQwdKkt.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\lzBybqy.exe
  C:\Windows\System\lzBybqy.exe
  2⤵
  - Executes dropped EXE
  PID:884
- C:\Windows\System\PWsAxAD.exe
  C:\Windows\System\PWsAxAD.exe
  2⤵
  - Executes dropped EXE
  PID:1956
- C:\Windows\System\lddpPXq.exe
  C:\Windows\System\lddpPXq.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\OgznKJk.exe
  C:\Windows\System\OgznKJk.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\lBLnFVH.exe
  C:\Windows\System\lBLnFVH.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\tZFtnfc.exe
  C:\Windows\System\tZFtnfc.exe
  2⤵
  - Executes dropped EXE
  PID:2336
- C:\Windows\System\izerFVj.exe
  C:\Windows\System\izerFVj.exe
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Windows\System\RfLGiOR.exe
  C:\Windows\System\RfLGiOR.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\jWEqehO.exe
  C:\Windows\System\jWEqehO.exe
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Windows\System\jlMIbSE.exe
  C:\Windows\System\jlMIbSE.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\idFyPFg.exe
  C:\Windows\System\idFyPFg.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\yraliBt.exe
  C:\Windows\System\yraliBt.exe
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Windows\System\SpjrlSe.exe
  C:\Windows\System\SpjrlSe.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\yXNIFGn.exe
  C:\Windows\System\yXNIFGn.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\jCANBhb.exe
  C:\Windows\System\jCANBhb.exe
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Windows\System\NMRceSx.exe
  C:\Windows\System\NMRceSx.exe
  2⤵
  - Executes dropped EXE
  PID:1852
- C:\Windows\System\INrmoDG.exe
  C:\Windows\System\INrmoDG.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\XnwnXzf.exe
  C:\Windows\System\XnwnXzf.exe
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Windows\System\kYjymAz.exe
  C:\Windows\System\kYjymAz.exe
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Windows\System\vcdpuya.exe
  C:\Windows\System\vcdpuya.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\ErHxucn.exe
  C:\Windows\System\ErHxucn.exe
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Windows\System\uFJMoUE.exe
  C:\Windows\System\uFJMoUE.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- C:\Windows\System\oRQbvTG.exe
  C:\Windows\System\oRQbvTG.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\johTlhC.exe
  C:\Windows\System\johTlhC.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\quPOyvO.exe
  C:\Windows\System\quPOyvO.exe
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Windows\System\UZKnRLI.exe
  C:\Windows\System\UZKnRLI.exe
  2⤵
  - Executes dropped EXE
  PID:2272
- C:\Windows\System\tRWWbfN.exe
  C:\Windows\System\tRWWbfN.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\uTGGKCD.exe
  C:\Windows\System\uTGGKCD.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\ApELmHE.exe
  C:\Windows\System\ApELmHE.exe
  2⤵
  - Executes dropped EXE
  PID:1568
- C:\Windows\System\APfARlU.exe
  C:\Windows\System\APfARlU.exe
  2⤵
  - Executes dropped EXE
  PID:2220
- C:\Windows\System\sykETZE.exe
  C:\Windows\System\sykETZE.exe
  2⤵
  - Executes dropped EXE
  PID:2964
- C:\Windows\System\BbBDgtj.exe
  C:\Windows\System\BbBDgtj.exe
  2⤵
  - Executes dropped EXE
  PID:2052
- C:\Windows\System\TCDwlrk.exe
  C:\Windows\System\TCDwlrk.exe
  2⤵
  - Executes dropped EXE
  PID:2840
- C:\Windows\System\qPVxCTS.exe
  C:\Windows\System\qPVxCTS.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\RyWQwXG.exe
  C:\Windows\System\RyWQwXG.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\FOYcftX.exe
  C:\Windows\System\FOYcftX.exe
  2⤵
  - Executes dropped EXE
  PID:796
- C:\Windows\System\cVMOIAM.exe
  C:\Windows\System\cVMOIAM.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\hOaBBRu.exe
  C:\Windows\System\hOaBBRu.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\LThCkPj.exe
  C:\Windows\System\LThCkPj.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\nDlcCwM.exe
  C:\Windows\System\nDlcCwM.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\ZdMuOXx.exe
  C:\Windows\System\ZdMuOXx.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\dhteayK.exe
  C:\Windows\System\dhteayK.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\TLjGKvo.exe
  C:\Windows\System\TLjGKvo.exe
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\System\ZEwButg.exe
  C:\Windows\System\ZEwButg.exe
  2⤵
  - Executes dropped EXE
  PID:2544
- C:\Windows\System\iBIZFkk.exe
  C:\Windows\System\iBIZFkk.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\dwfechM.exe
  C:\Windows\System\dwfechM.exe
  2⤵
  PID:2700
- C:\Windows\System\dwvtyMY.exe
  C:\Windows\System\dwvtyMY.exe
  2⤵
  PID:1944
- C:\Windows\System\RJNFgFk.exe
  C:\Windows\System\RJNFgFk.exe
  2⤵
  PID:1292
- C:\Windows\System\tunpimT.exe
  C:\Windows\System\tunpimT.exe
  2⤵
  PID:2408
- C:\Windows\System\xWiruqK.exe
  C:\Windows\System\xWiruqK.exe
  2⤵
  PID:1976
- C:\Windows\System\khTPfCb.exe
  C:\Windows\System\khTPfCb.exe
  2⤵
  PID:268
- C:\Windows\System\XZdHMfK.exe
  C:\Windows\System\XZdHMfK.exe
  2⤵
  PID:1032
- C:\Windows\System\dsmhMzA.exe
  C:\Windows\System\dsmhMzA.exe
  2⤵
  PID:1820
- C:\Windows\System\nIwELLe.exe
  C:\Windows\System\nIwELLe.exe
  2⤵
  PID:640
- C:\Windows\System\dyfpAeh.exe
  C:\Windows\System\dyfpAeh.exe
  2⤵
  PID:1160
- C:\Windows\System\APNNURK.exe
  C:\Windows\System\APNNURK.exe
  2⤵
  PID:1996
- C:\Windows\System\yhMsdMv.exe
  C:\Windows\System\yhMsdMv.exe
  2⤵
  PID:576
- C:\Windows\System\efgBVOL.exe
  C:\Windows\System\efgBVOL.exe
  2⤵
  PID:1020
- C:\Windows\System\UTVFygw.exe
  C:\Windows\System\UTVFygw.exe
  2⤵
  PID:2264
- C:\Windows\System\XpfvAbX.exe
  C:\Windows\System\XpfvAbX.exe
  2⤵
  PID:2140
- C:\Windows\System\wpVvyks.exe
  C:\Windows\System\wpVvyks.exe
  2⤵
  PID:1768
- C:\Windows\System\IYnJVIf.exe
  C:\Windows\System\IYnJVIf.exe
  2⤵
  PID:820
- C:\Windows\System\LDUFtjJ.exe
  C:\Windows\System\LDUFtjJ.exe
  2⤵
  PID:2012
- C:\Windows\System\TICGsnS.exe
  C:\Windows\System\TICGsnS.exe
  2⤵
  PID:3040
- C:\Windows\System\tNDrVer.exe
  C:\Windows\System\tNDrVer.exe
  2⤵
  PID:1000
- C:\Windows\System\TpqUgty.exe
  C:\Windows\System\TpqUgty.exe
  2⤵
  PID:2684
- C:\Windows\System\zEVpCxj.exe
  C:\Windows\System\zEVpCxj.exe
  2⤵
  PID:1304
- C:\Windows\System\wghRZRi.exe
  C:\Windows\System\wghRZRi.exe
  2⤵
  PID:1104
- C:\Windows\System\OVNbbuf.exe
  C:\Windows\System\OVNbbuf.exe
  2⤵
  PID:1624
- C:\Windows\System\zsYrami.exe
  C:\Windows\System\zsYrami.exe
  2⤵
  PID:2944
- C:\Windows\System\meWnkTe.exe
  C:\Windows\System\meWnkTe.exe
  2⤵
  PID:2404
- C:\Windows\System\KEPeQBJ.exe
  C:\Windows\System\KEPeQBJ.exe
  2⤵
  PID:2756
- C:\Windows\System\TmVaQOc.exe
  C:\Windows\System\TmVaQOc.exe
  2⤵
  PID:2136
- C:\Windows\System\dGERbkV.exe
  C:\Windows\System\dGERbkV.exe
  2⤵
  PID:2808
- C:\Windows\System\WrDNlZW.exe
  C:\Windows\System\WrDNlZW.exe
  2⤵
  PID:2732
- C:\Windows\System\MHMhBll.exe
  C:\Windows\System\MHMhBll.exe
  2⤵
  PID:2064
- C:\Windows\System\hgnpFss.exe
  C:\Windows\System\hgnpFss.exe
  2⤵
  PID:1736
- C:\Windows\System\nyncDBR.exe
  C:\Windows\System\nyncDBR.exe
  2⤵
  PID:1480
- C:\Windows\System\ixlwPOp.exe
  C:\Windows\System\ixlwPOp.exe
  2⤵
  PID:2104
- C:\Windows\System\UpEABmL.exe
  C:\Windows\System\UpEABmL.exe
  2⤵
  PID:3020
- C:\Windows\System\FyFYYZX.exe
  C:\Windows\System\FyFYYZX.exe
  2⤵
  PID:1968
- C:\Windows\System\JcPckYg.exe
  C:\Windows\System\JcPckYg.exe
  2⤵
  PID:2624
- C:\Windows\System\YcxgJhS.exe
  C:\Windows\System\YcxgJhS.exe
  2⤵
  PID:1040
- C:\Windows\System\QquwRzH.exe
  C:\Windows\System\QquwRzH.exe
  2⤵
  PID:2616
- C:\Windows\System\kDzyIqK.exe
  C:\Windows\System\kDzyIqK.exe
  2⤵
  PID:2764
- C:\Windows\System\UWHmTbB.exe
  C:\Windows\System\UWHmTbB.exe
  2⤵
  PID:1308
- C:\Windows\System\oIHJGkp.exe
  C:\Windows\System\oIHJGkp.exe
  2⤵
  PID:2704
- C:\Windows\System\gZAWvvW.exe
  C:\Windows\System\gZAWvvW.exe
  2⤵
  PID:3032
- C:\Windows\System\hMvCIhn.exe
  C:\Windows\System\hMvCIhn.exe
  2⤵
  PID:2356
- C:\Windows\System\gxgxMfr.exe
  C:\Windows\System\gxgxMfr.exe
  2⤵
  PID:2256
- C:\Windows\System\AVThlnC.exe
  C:\Windows\System\AVThlnC.exe
  2⤵
  PID:816
- C:\Windows\System\mMBBUZh.exe
  C:\Windows\System\mMBBUZh.exe
  2⤵
  PID:2396
- C:\Windows\System\Fqaewik.exe
  C:\Windows\System\Fqaewik.exe
  2⤵
  PID:2280
- C:\Windows\System\VZstzlG.exe
  C:\Windows\System\VZstzlG.exe
  2⤵
  PID:592
- C:\Windows\System\MPIWyCb.exe
  C:\Windows\System\MPIWyCb.exe
  2⤵
  PID:448
- C:\Windows\System\WEqVKeP.exe
  C:\Windows\System\WEqVKeP.exe
  2⤵
  PID:2772
- C:\Windows\System\yULZfMQ.exe
  C:\Windows\System\yULZfMQ.exe
  2⤵
  PID:1532
- C:\Windows\System\lFuwjzH.exe
  C:\Windows\System\lFuwjzH.exe
  2⤵
  PID:1388
- C:\Windows\System\RhsXjFZ.exe
  C:\Windows\System\RhsXjFZ.exe
  2⤵
  PID:1928
- C:\Windows\System\fgioYfR.exe
  C:\Windows\System\fgioYfR.exe
  2⤵
  PID:2788
- C:\Windows\System\FOcbzOX.exe
  C:\Windows\System\FOcbzOX.exe
  2⤵
  PID:2976
- C:\Windows\System\vCptqKM.exe
  C:\Windows\System\vCptqKM.exe
  2⤵
  PID:1148
- C:\Windows\System\xBppqlX.exe
  C:\Windows\System\xBppqlX.exe
  2⤵
  PID:2340
- C:\Windows\System\aiFQPXm.exe
  C:\Windows\System\aiFQPXm.exe
  2⤵
  PID:580
- C:\Windows\System\FehHqrj.exe
  C:\Windows\System\FehHqrj.exe
  2⤵
  PID:2992
- C:\Windows\System\GmDIieB.exe
  C:\Windows\System\GmDIieB.exe
  2⤵
  PID:708
- C:\Windows\System\cftQvFC.exe
  C:\Windows\System\cftQvFC.exe
  2⤵
  PID:2580
- C:\Windows\System\hISlkFy.exe
  C:\Windows\System\hISlkFy.exe
  2⤵
  PID:2876
- C:\Windows\System\PaVWoeX.exe
  C:\Windows\System\PaVWoeX.exe
  2⤵
  PID:2400
- C:\Windows\System\QDqyhld.exe
  C:\Windows\System\QDqyhld.exe
  2⤵
  PID:2184
- C:\Windows\System\rTaBZHV.exe
  C:\Windows\System\rTaBZHV.exe
  2⤵
  PID:2560
- C:\Windows\System\beqmrBt.exe
  C:\Windows\System\beqmrBt.exe
  2⤵
  PID:1516
- C:\Windows\System\xDuLNAy.exe
  C:\Windows\System\xDuLNAy.exe
  2⤵
  PID:1600
- C:\Windows\System\hxBGKYN.exe
  C:\Windows\System\hxBGKYN.exe
  2⤵
  PID:804
- C:\Windows\System\fpedioo.exe
  C:\Windows\System\fpedioo.exe
  2⤵
  PID:2536
- C:\Windows\System\MIAkFCj.exe
  C:\Windows\System\MIAkFCj.exe
  2⤵
  PID:2760
- C:\Windows\System\xsQHvWS.exe
  C:\Windows\System\xsQHvWS.exe
  2⤵
  PID:1576
- C:\Windows\System\tKpRUZb.exe
  C:\Windows\System\tKpRUZb.exe
  2⤵
  PID:2604
- C:\Windows\System\jUPKWGN.exe
  C:\Windows\System\jUPKWGN.exe
  2⤵
  PID:428
- C:\Windows\System\jPRnNnA.exe
  C:\Windows\System\jPRnNnA.exe
  2⤵
  PID:848
- C:\Windows\System\WgsKpQN.exe
  C:\Windows\System\WgsKpQN.exe
  2⤵
  PID:2156
- C:\Windows\System\KgkEQzC.exe
  C:\Windows\System\KgkEQzC.exe
  2⤵
  PID:2804
- C:\Windows\System\hFhDmvx.exe
  C:\Windows\System\hFhDmvx.exe
  2⤵
  PID:2436
- C:\Windows\System\KSwuaiM.exe
  C:\Windows\System\KSwuaiM.exe
  2⤵
  PID:1684
- C:\Windows\System\OhTQkrM.exe
  C:\Windows\System\OhTQkrM.exe
  2⤵
  PID:2572
- C:\Windows\System\jZCbQxz.exe
  C:\Windows\System\jZCbQxz.exe
  2⤵
  PID:2680
- C:\Windows\System\rEyoCqz.exe
  C:\Windows\System\rEyoCqz.exe
  2⤵
  PID:2556
- C:\Windows\System\kluojCO.exe
  C:\Windows\System\kluojCO.exe
  2⤵
  PID:2484
- C:\Windows\System\bPMNHUh.exe
  C:\Windows\System\bPMNHUh.exe
  2⤵
  PID:1056
- C:\Windows\System\zNMSAhR.exe
  C:\Windows\System\zNMSAhR.exe
  2⤵
  PID:1860
- C:\Windows\System\aWvQhHx.exe
  C:\Windows\System\aWvQhHx.exe
  2⤵
  PID:3088
- C:\Windows\System\XvGEbPx.exe
  C:\Windows\System\XvGEbPx.exe
  2⤵
  PID:3104
- C:\Windows\System\TXXlTdS.exe
  C:\Windows\System\TXXlTdS.exe
  2⤵
  PID:3120
- C:\Windows\System\eFOmtOR.exe
  C:\Windows\System\eFOmtOR.exe
  2⤵
  PID:3136
- C:\Windows\System\GqaQMFM.exe
  C:\Windows\System\GqaQMFM.exe
  2⤵
  PID:3152
- C:\Windows\System\rugETwY.exe
  C:\Windows\System\rugETwY.exe
  2⤵
  PID:3168
- C:\Windows\System\EhJeGgT.exe
  C:\Windows\System\EhJeGgT.exe
  2⤵
  PID:3184
- C:\Windows\System\RcYEodc.exe
  C:\Windows\System\RcYEodc.exe
  2⤵
  PID:3200
- C:\Windows\System\wgFRLWM.exe
  C:\Windows\System\wgFRLWM.exe
  2⤵
  PID:3216
- C:\Windows\System\PnsBIda.exe
  C:\Windows\System\PnsBIda.exe
  2⤵
  PID:3232
- C:\Windows\System\PkMRLac.exe
  C:\Windows\System\PkMRLac.exe
  2⤵
  PID:3248
- C:\Windows\System\hJbEoxA.exe
  C:\Windows\System\hJbEoxA.exe
  2⤵
  PID:3264
- C:\Windows\System\hRGYLvF.exe
  C:\Windows\System\hRGYLvF.exe
  2⤵
  PID:3280
- C:\Windows\System\SIHaOcr.exe
  C:\Windows\System\SIHaOcr.exe
  2⤵
  PID:3296
- C:\Windows\System\sGmazTZ.exe
  C:\Windows\System\sGmazTZ.exe
  2⤵
  PID:3312
- C:\Windows\System\TCGyXZM.exe
  C:\Windows\System\TCGyXZM.exe
  2⤵
  PID:3328
- C:\Windows\System\SPlKWrG.exe
  C:\Windows\System\SPlKWrG.exe
  2⤵
  PID:3344
- C:\Windows\System\vblrrId.exe
  C:\Windows\System\vblrrId.exe
  2⤵
  PID:3360
- C:\Windows\System\wDbFLXL.exe
  C:\Windows\System\wDbFLXL.exe
  2⤵
  PID:3376
- C:\Windows\System\fhTBlPm.exe
  C:\Windows\System\fhTBlPm.exe
  2⤵
  PID:3392
- C:\Windows\System\YFDKYAS.exe
  C:\Windows\System\YFDKYAS.exe
  2⤵
  PID:3412
- C:\Windows\System\trEfLJA.exe
  C:\Windows\System\trEfLJA.exe
  2⤵
  PID:3428
- C:\Windows\System\GJeetHB.exe
  C:\Windows\System\GJeetHB.exe
  2⤵
  PID:3444
- C:\Windows\System\oXfGtyQ.exe
  C:\Windows\System\oXfGtyQ.exe
  2⤵
  PID:3460
- C:\Windows\System\mAfZzAw.exe
  C:\Windows\System\mAfZzAw.exe
  2⤵
  PID:3476
- C:\Windows\System\jYbUVhQ.exe
  C:\Windows\System\jYbUVhQ.exe
  2⤵
  PID:3528
- C:\Windows\System\NREiJAG.exe
  C:\Windows\System\NREiJAG.exe
  2⤵
  PID:3544
- C:\Windows\System\Tqoiaud.exe
  C:\Windows\System\Tqoiaud.exe
  2⤵
  PID:3560
- C:\Windows\System\zcWCzyc.exe
  C:\Windows\System\zcWCzyc.exe
  2⤵
  PID:3576
- C:\Windows\System\rxDIOKy.exe
  C:\Windows\System\rxDIOKy.exe
  2⤵
  PID:3592
- C:\Windows\System\DZtqJWH.exe
  C:\Windows\System\DZtqJWH.exe
  2⤵
  PID:3608
- C:\Windows\System\DnBhaLP.exe
  C:\Windows\System\DnBhaLP.exe
  2⤵
  PID:3624
- C:\Windows\System\fnQnioF.exe
  C:\Windows\System\fnQnioF.exe
  2⤵
  PID:3640
- C:\Windows\System\nxaxUrc.exe
  C:\Windows\System\nxaxUrc.exe
  2⤵
  PID:3656
- C:\Windows\System\psMWszJ.exe
  C:\Windows\System\psMWszJ.exe
  2⤵
  PID:3672
- C:\Windows\System\QVyCPJb.exe
  C:\Windows\System\QVyCPJb.exe
  2⤵
  PID:3688
- C:\Windows\System\mDyymqX.exe
  C:\Windows\System\mDyymqX.exe
  2⤵
  PID:3704
- C:\Windows\System\xHSJxFG.exe
  C:\Windows\System\xHSJxFG.exe
  2⤵
  PID:3720
- C:\Windows\System\cbUNiPe.exe
  C:\Windows\System\cbUNiPe.exe
  2⤵
  PID:3736
- C:\Windows\System\vJmcIVw.exe
  C:\Windows\System\vJmcIVw.exe
  2⤵
  PID:3752
- C:\Windows\System\bCyifhB.exe
  C:\Windows\System\bCyifhB.exe
  2⤵
  PID:3768
- C:\Windows\System\nPwVvCB.exe
  C:\Windows\System\nPwVvCB.exe
  2⤵
  PID:3784
- C:\Windows\System\jtqlZoU.exe
  C:\Windows\System\jtqlZoU.exe
  2⤵
  PID:3800
- C:\Windows\System\pEDGPxW.exe
  C:\Windows\System\pEDGPxW.exe
  2⤵
  PID:3816
- C:\Windows\System\iAZCxlF.exe
  C:\Windows\System\iAZCxlF.exe
  2⤵
  PID:3832
- C:\Windows\System\NhslNdA.exe
  C:\Windows\System\NhslNdA.exe
  2⤵
  PID:3848
- C:\Windows\System\OroBIPO.exe
  C:\Windows\System\OroBIPO.exe
  2⤵
  PID:3864
- C:\Windows\System\hulobcu.exe
  C:\Windows\System\hulobcu.exe
  2⤵
  PID:3880
- C:\Windows\System\bAngnGr.exe
  C:\Windows\System\bAngnGr.exe
  2⤵
  PID:3896
- C:\Windows\System\sbPhVGJ.exe
  C:\Windows\System\sbPhVGJ.exe
  2⤵
  PID:3912
- C:\Windows\System\cpycTlj.exe
  C:\Windows\System\cpycTlj.exe
  2⤵
  PID:3928
- C:\Windows\System\Rrpuwzt.exe
  C:\Windows\System\Rrpuwzt.exe
  2⤵
  PID:3944
- C:\Windows\System\hfrlims.exe
  C:\Windows\System\hfrlims.exe
  2⤵
  PID:3960
- C:\Windows\System\CrhbksQ.exe
  C:\Windows\System\CrhbksQ.exe
  2⤵
  PID:3976
- C:\Windows\System\cndsVdA.exe
  C:\Windows\System\cndsVdA.exe
  2⤵
  PID:3992
- C:\Windows\System\qiBGqsj.exe
  C:\Windows\System\qiBGqsj.exe
  2⤵
  PID:4008
- C:\Windows\System\nSFpKLP.exe
  C:\Windows\System\nSFpKLP.exe
  2⤵
  PID:4024
- C:\Windows\System\SuvBDmZ.exe
  C:\Windows\System\SuvBDmZ.exe
  2⤵
  PID:4040
- C:\Windows\System\NemsXlU.exe
  C:\Windows\System\NemsXlU.exe
  2⤵
  PID:4056
- C:\Windows\System\xOzYCuR.exe
  C:\Windows\System\xOzYCuR.exe
  2⤵
  PID:4072
- C:\Windows\System\KKSNUbz.exe
  C:\Windows\System\KKSNUbz.exe
  2⤵
  PID:4088
- C:\Windows\System\kgWAYTc.exe
  C:\Windows\System\kgWAYTc.exe
  2⤵
  PID:3048
- C:\Windows\System\TbniFmr.exe
  C:\Windows\System\TbniFmr.exe
  2⤵
  PID:772
- C:\Windows\System\DCmXGAq.exe
  C:\Windows\System\DCmXGAq.exe
  2⤵
  PID:3132
- C:\Windows\System\uABsIzj.exe
  C:\Windows\System\uABsIzj.exe
  2⤵
  PID:2600
- C:\Windows\System\wCxfZxE.exe
  C:\Windows\System\wCxfZxE.exe
  2⤵
  PID:1920
- C:\Windows\System\MVBZdAQ.exe
  C:\Windows\System\MVBZdAQ.exe
  2⤵
  PID:3052
- C:\Windows\System\ISXtwHI.exe
  C:\Windows\System\ISXtwHI.exe
  2⤵
  PID:2312
- C:\Windows\System\xMcsDpU.exe
  C:\Windows\System\xMcsDpU.exe
  2⤵
  PID:1784
- C:\Windows\System\TJpZodZ.exe
  C:\Windows\System\TJpZodZ.exe
  2⤵
  PID:2420
- C:\Windows\System\rcXuzMO.exe
  C:\Windows\System\rcXuzMO.exe
  2⤵
  PID:596
- C:\Windows\System\CcZRLxa.exe
  C:\Windows\System\CcZRLxa.exe
  2⤵
  PID:1564
- C:\Windows\System\UVYpFwQ.exe
  C:\Windows\System\UVYpFwQ.exe
  2⤵
  PID:1740
- C:\Windows\System\rVLVKvL.exe
  C:\Windows\System\rVLVKvL.exe
  2⤵
  PID:1724
- C:\Windows\System\mlCPyPz.exe
  C:\Windows\System\mlCPyPz.exe
  2⤵
  PID:2332
- C:\Windows\System\xKaVVyD.exe
  C:\Windows\System\xKaVVyD.exe
  2⤵
  PID:1980
- C:\Windows\System\DDTHQCA.exe
  C:\Windows\System\DDTHQCA.exe
  2⤵
  PID:2972
- C:\Windows\System\oHnmAFR.exe
  C:\Windows\System\oHnmAFR.exe
  2⤵
  PID:3116
- C:\Windows\System\UOBEdDH.exe
  C:\Windows\System\UOBEdDH.exe
  2⤵
  PID:3180
- C:\Windows\System\RqKfnlb.exe
  C:\Windows\System\RqKfnlb.exe
  2⤵
  PID:3244
- C:\Windows\System\tKAlwyq.exe
  C:\Windows\System\tKAlwyq.exe
  2⤵
  PID:3308
- C:\Windows\System\zvPdpTc.exe
  C:\Windows\System\zvPdpTc.exe
  2⤵
  PID:3372
- C:\Windows\System\DZjbIkc.exe
  C:\Windows\System\DZjbIkc.exe
  2⤵
  PID:3436
- C:\Windows\System\vDaoElN.exe
  C:\Windows\System\vDaoElN.exe
  2⤵
  PID:2848
- C:\Windows\System\bGzwyLu.exe
  C:\Windows\System\bGzwyLu.exe
  2⤵
  PID:3160
- C:\Windows\System\irciAtm.exe
  C:\Windows\System\irciAtm.exe
  2⤵
  PID:2000
- C:\Windows\System\YhfyfvA.exe
  C:\Windows\System\YhfyfvA.exe
  2⤵
  PID:3228
- C:\Windows\System\HRehHQF.exe
  C:\Windows\System\HRehHQF.exe
  2⤵
  PID:3292
- C:\Windows\System\pOqtlOX.exe
  C:\Windows\System\pOqtlOX.exe
  2⤵
  PID:3356
- C:\Windows\System\ivvHnGL.exe
  C:\Windows\System\ivvHnGL.exe
  2⤵
  PID:3424
- C:\Windows\System\FonZjSK.exe
  C:\Windows\System\FonZjSK.exe
  2⤵
  PID:912
- C:\Windows\System\MqawkNZ.exe
  C:\Windows\System\MqawkNZ.exe
  2⤵
  PID:3504
- C:\Windows\System\ezXBKpo.exe
  C:\Windows\System\ezXBKpo.exe
  2⤵
  PID:3536
- C:\Windows\System\ocyxYxb.exe
  C:\Windows\System\ocyxYxb.exe
  2⤵
  PID:3556
- C:\Windows\System\VdaLvFs.exe
  C:\Windows\System\VdaLvFs.exe
  2⤵
  PID:3600
- C:\Windows\System\cHQgzZK.exe
  C:\Windows\System\cHQgzZK.exe
  2⤵
  PID:3616
- C:\Windows\System\zoSHMsO.exe
  C:\Windows\System\zoSHMsO.exe
  2⤵
  PID:4104
- C:\Windows\System\BxUaoUU.exe
  C:\Windows\System\BxUaoUU.exe
  2⤵
  PID:4120
- C:\Windows\System\uyNTePO.exe
  C:\Windows\System\uyNTePO.exe
  2⤵
  PID:4136
- C:\Windows\System\mHWTDVe.exe
  C:\Windows\System\mHWTDVe.exe
  2⤵
  PID:4152
- C:\Windows\System\zfnUTWE.exe
  C:\Windows\System\zfnUTWE.exe
  2⤵
  PID:4168
- C:\Windows\System\vIAVhOB.exe
  C:\Windows\System\vIAVhOB.exe
  2⤵
  PID:4184
- C:\Windows\System\rPegZZW.exe
  C:\Windows\System\rPegZZW.exe
  2⤵
  PID:4200
- C:\Windows\System\DdJnAKZ.exe
  C:\Windows\System\DdJnAKZ.exe
  2⤵
  PID:4216
- C:\Windows\System\bYpgSGw.exe
  C:\Windows\System\bYpgSGw.exe
  2⤵
  PID:4232
- C:\Windows\System\PRoFhBA.exe
  C:\Windows\System\PRoFhBA.exe
  2⤵
  PID:4248
- C:\Windows\System\PdoSHgd.exe
  C:\Windows\System\PdoSHgd.exe
  2⤵
  PID:4264
- C:\Windows\System\kdTHUXg.exe
  C:\Windows\System\kdTHUXg.exe
  2⤵
  PID:4280
- C:\Windows\System\TWlioKz.exe
  C:\Windows\System\TWlioKz.exe
  2⤵
  PID:4296
- C:\Windows\System\eZmKMkm.exe
  C:\Windows\System\eZmKMkm.exe
  2⤵
  PID:4312
- C:\Windows\System\NKwfSDj.exe
  C:\Windows\System\NKwfSDj.exe
  2⤵
  PID:4328
- C:\Windows\System\QVFgqQK.exe
  C:\Windows\System\QVFgqQK.exe
  2⤵
  PID:4344
- C:\Windows\System\dFMLRyV.exe
  C:\Windows\System\dFMLRyV.exe
  2⤵
  PID:4360
- C:\Windows\System\cYsVZDY.exe
  C:\Windows\System\cYsVZDY.exe
  2⤵
  PID:4376
- C:\Windows\System\TTBKFrG.exe
  C:\Windows\System\TTBKFrG.exe
  2⤵
  PID:4392
- C:\Windows\System\qbkioHc.exe
  C:\Windows\System\qbkioHc.exe
  2⤵
  PID:4408
- C:\Windows\System\KrveUNR.exe
  C:\Windows\System\KrveUNR.exe
  2⤵
  PID:4424
- C:\Windows\System\cpydcUK.exe
  C:\Windows\System\cpydcUK.exe
  2⤵
  PID:4440
- C:\Windows\System\HRmecbP.exe
  C:\Windows\System\HRmecbP.exe
  2⤵
  PID:4456
- C:\Windows\System\tRfGVXS.exe
  C:\Windows\System\tRfGVXS.exe
  2⤵
  PID:4472
- C:\Windows\System\bWqnpEG.exe
  C:\Windows\System\bWqnpEG.exe
  2⤵
  PID:4488
- C:\Windows\System\YhIQIkm.exe
  C:\Windows\System\YhIQIkm.exe
  2⤵
  PID:4504
- C:\Windows\System\Sclpwfq.exe
  C:\Windows\System\Sclpwfq.exe
  2⤵
  PID:4520
- C:\Windows\System\Eximsdq.exe
  C:\Windows\System\Eximsdq.exe
  2⤵
  PID:4536
- C:\Windows\System\phKFvcu.exe
  C:\Windows\System\phKFvcu.exe
  2⤵
  PID:4552
- C:\Windows\System\drSfvsg.exe
  C:\Windows\System\drSfvsg.exe
  2⤵
  PID:4568
- C:\Windows\System\srRzCSi.exe
  C:\Windows\System\srRzCSi.exe
  2⤵
  PID:4584
- C:\Windows\System\GlqltGq.exe
  C:\Windows\System\GlqltGq.exe
  2⤵
  PID:4600
- C:\Windows\System\xwsDisC.exe
  C:\Windows\System\xwsDisC.exe
  2⤵
  PID:4616
- C:\Windows\System\yjLmrVU.exe
  C:\Windows\System\yjLmrVU.exe
  2⤵
  PID:4632
- C:\Windows\System\UMgHsGw.exe
  C:\Windows\System\UMgHsGw.exe
  2⤵
  PID:4648
- C:\Windows\System\baigyNn.exe
  C:\Windows\System\baigyNn.exe
  2⤵
  PID:4692
- C:\Windows\System\IORWToT.exe
  C:\Windows\System\IORWToT.exe
  2⤵
  PID:4740
- C:\Windows\System\ftXEniW.exe
  C:\Windows\System\ftXEniW.exe
  2⤵
  PID:4756
- C:\Windows\System\gJASoQe.exe
  C:\Windows\System\gJASoQe.exe
  2⤵
  PID:4772
- C:\Windows\System\SYfBvpK.exe
  C:\Windows\System\SYfBvpK.exe
  2⤵
  PID:4788
- C:\Windows\System\txfpLbf.exe
  C:\Windows\System\txfpLbf.exe
  2⤵
  PID:4804
- C:\Windows\System\WjYFIux.exe
  C:\Windows\System\WjYFIux.exe
  2⤵
  PID:4820
- C:\Windows\System\nYRDQzB.exe
  C:\Windows\System\nYRDQzB.exe
  2⤵
  PID:4836
- C:\Windows\System\eaLBaQH.exe
  C:\Windows\System\eaLBaQH.exe
  2⤵
  PID:4852
- C:\Windows\System\ghZETJS.exe
  C:\Windows\System\ghZETJS.exe
  2⤵
  PID:4868
- C:\Windows\System\ZUYQJpf.exe
  C:\Windows\System\ZUYQJpf.exe
  2⤵
  PID:4884
- C:\Windows\System\RIuvrcW.exe
  C:\Windows\System\RIuvrcW.exe
  2⤵
  PID:4900
- C:\Windows\System\SeqOlgw.exe
  C:\Windows\System\SeqOlgw.exe
  2⤵
  PID:4916
- C:\Windows\System\BXmkJKY.exe
  C:\Windows\System\BXmkJKY.exe
  2⤵
  PID:4932
- C:\Windows\System\dLXIXnz.exe
  C:\Windows\System\dLXIXnz.exe
  2⤵
  PID:4948
- C:\Windows\System\yktSvsS.exe
  C:\Windows\System\yktSvsS.exe
  2⤵
  PID:4964
- C:\Windows\System\iJwOCvT.exe
  C:\Windows\System\iJwOCvT.exe
  2⤵
  PID:4980
- C:\Windows\System\GBUsTiR.exe
  C:\Windows\System\GBUsTiR.exe
  2⤵
  PID:4996
- C:\Windows\System\GzFHPcJ.exe
  C:\Windows\System\GzFHPcJ.exe
  2⤵
  PID:5012
- C:\Windows\System\IpfKQLv.exe
  C:\Windows\System\IpfKQLv.exe
  2⤵
  PID:5028
- C:\Windows\System\SpGWzFI.exe
  C:\Windows\System\SpGWzFI.exe
  2⤵
  PID:5048
- C:\Windows\System\akXNaia.exe
  C:\Windows\System\akXNaia.exe
  2⤵
  PID:5064
- C:\Windows\System\zuOvrAn.exe
  C:\Windows\System\zuOvrAn.exe
  2⤵
  PID:5080
- C:\Windows\System\NVLROnm.exe
  C:\Windows\System\NVLROnm.exe
  2⤵
  PID:5096
- C:\Windows\System\ZVziOIx.exe
  C:\Windows\System\ZVziOIx.exe
  2⤵
  PID:5112
- C:\Windows\System\VWiJWwy.exe
  C:\Windows\System\VWiJWwy.exe
  2⤵
  PID:3648
- C:\Windows\System\sYtdUfj.exe
  C:\Windows\System\sYtdUfj.exe
  2⤵
  PID:5124
- C:\Windows\System\hdtdAxp.exe
  C:\Windows\System\hdtdAxp.exe
  2⤵
  PID:5140
- C:\Windows\System\NMkhtrD.exe
  C:\Windows\System\NMkhtrD.exe
  2⤵
  PID:5156
- C:\Windows\System\AwfCCer.exe
  C:\Windows\System\AwfCCer.exe
  2⤵
  PID:5172
- C:\Windows\System\IgZjruY.exe
  C:\Windows\System\IgZjruY.exe
  2⤵
  PID:5192
- C:\Windows\System\KXmeiHh.exe
  C:\Windows\System\KXmeiHh.exe
  2⤵
  PID:5208
- C:\Windows\System\qtsPPme.exe
  C:\Windows\System\qtsPPme.exe
  2⤵
  PID:5224
- C:\Windows\System\QNqNWht.exe
  C:\Windows\System\QNqNWht.exe
  2⤵
  PID:5240
- C:\Windows\System\lTeKaWX.exe
  C:\Windows\System\lTeKaWX.exe
  2⤵
  PID:5260
- C:\Windows\System\ZqOqcUn.exe
  C:\Windows\System\ZqOqcUn.exe
  2⤵
  PID:5276
- C:\Windows\System\fNVfRbM.exe
  C:\Windows\System\fNVfRbM.exe
  2⤵
  PID:5292
- C:\Windows\System\ZyHeGvl.exe
  C:\Windows\System\ZyHeGvl.exe
  2⤵
  PID:5308
- C:\Windows\System\AmjJPYl.exe
  C:\Windows\System\AmjJPYl.exe
  2⤵
  PID:5324
- C:\Windows\System\SaTdHQY.exe
  C:\Windows\System\SaTdHQY.exe
  2⤵
  PID:5344
- C:\Windows\System\ENiHcOe.exe
  C:\Windows\System\ENiHcOe.exe
  2⤵
  PID:5360
- C:\Windows\System\lpZIfuk.exe
  C:\Windows\System\lpZIfuk.exe
  2⤵
  PID:5376
- C:\Windows\System\rbdhNSb.exe
  C:\Windows\System\rbdhNSb.exe
  2⤵
  PID:5392
- C:\Windows\System\hQTyEJI.exe
  C:\Windows\System\hQTyEJI.exe
  2⤵
  PID:5408
- C:\Windows\System\DcyCfOJ.exe
  C:\Windows\System\DcyCfOJ.exe
  2⤵
  PID:5428
- C:\Windows\System\tWSplWN.exe
  C:\Windows\System\tWSplWN.exe
  2⤵
  PID:5444
- C:\Windows\System\blMCgNU.exe
  C:\Windows\System\blMCgNU.exe
  2⤵
  PID:5460
- C:\Windows\System\uaJLMNs.exe
  C:\Windows\System\uaJLMNs.exe
  2⤵
  PID:5476
- C:\Windows\System\lOBbcdv.exe
  C:\Windows\System\lOBbcdv.exe
  2⤵
  PID:5492
- C:\Windows\System\vBFuvmh.exe
  C:\Windows\System\vBFuvmh.exe
  2⤵
  PID:5508
- C:\Windows\System\uUfaOrH.exe
  C:\Windows\System\uUfaOrH.exe
  2⤵
  PID:5528
- C:\Windows\System\QxVpuPe.exe
  C:\Windows\System\QxVpuPe.exe
  2⤵
  PID:5544
- C:\Windows\System\IBxEVml.exe
  C:\Windows\System\IBxEVml.exe
  2⤵
  PID:5560
- C:\Windows\System\FFrNUGh.exe
  C:\Windows\System\FFrNUGh.exe
  2⤵
  PID:5576
- C:\Windows\System\DrVrFnp.exe
  C:\Windows\System\DrVrFnp.exe
  2⤵
  PID:5592
- C:\Windows\System\oTNRyLy.exe
  C:\Windows\System\oTNRyLy.exe
  2⤵
  PID:5608
- C:\Windows\System\IcFvlpd.exe
  C:\Windows\System\IcFvlpd.exe
  2⤵
  PID:5628
- C:\Windows\System\XKvikgM.exe
  C:\Windows\System\XKvikgM.exe
  2⤵
  PID:5644
- C:\Windows\System\tvEoPEI.exe
  C:\Windows\System\tvEoPEI.exe
  2⤵
  PID:5660
- C:\Windows\System\rSyFPuR.exe
  C:\Windows\System\rSyFPuR.exe
  2⤵
  PID:5676
- C:\Windows\System\lQyGuEo.exe
  C:\Windows\System\lQyGuEo.exe
  2⤵
  PID:5692
- C:\Windows\System\FUbvgOy.exe
  C:\Windows\System\FUbvgOy.exe
  2⤵
  PID:5708
- C:\Windows\System\KAHdkJd.exe
  C:\Windows\System\KAHdkJd.exe
  2⤵
  PID:5724
- C:\Windows\System\rFMHFru.exe
  C:\Windows\System\rFMHFru.exe
  2⤵
  PID:5744
- C:\Windows\System\fsEybts.exe
  C:\Windows\System\fsEybts.exe
  2⤵
  PID:5760
- C:\Windows\System\neYOALp.exe
  C:\Windows\System\neYOALp.exe
  2⤵
  PID:5776
- C:\Windows\System\bWKQPed.exe
  C:\Windows\System\bWKQPed.exe
  2⤵
  PID:5792
- C:\Windows\System\KacaNyD.exe
  C:\Windows\System\KacaNyD.exe
  2⤵
  PID:5808
- C:\Windows\System\CdRKxLF.exe
  C:\Windows\System\CdRKxLF.exe
  2⤵
  PID:5824
- C:\Windows\System\QnodczM.exe
  C:\Windows\System\QnodczM.exe
  2⤵
  PID:5840
- C:\Windows\System\doIWVOb.exe
  C:\Windows\System\doIWVOb.exe
  2⤵
  PID:5860
- C:\Windows\System\VPYReGd.exe
  C:\Windows\System\VPYReGd.exe
  2⤵
  PID:5876
- C:\Windows\System\RqbOPDI.exe
  C:\Windows\System\RqbOPDI.exe
  2⤵
  PID:5892
- C:\Windows\System\idYXQuS.exe
  C:\Windows\System\idYXQuS.exe
  2⤵
  PID:5908
- C:\Windows\System\qSCtWVr.exe
  C:\Windows\System\qSCtWVr.exe
  2⤵
  PID:5924
- C:\Windows\System\QCHdxyK.exe
  C:\Windows\System\QCHdxyK.exe
  2⤵
  PID:5940
- C:\Windows\System\LoMLAWo.exe
  C:\Windows\System\LoMLAWo.exe
  2⤵
  PID:5960
- C:\Windows\System\EPWLOjV.exe
  C:\Windows\System\EPWLOjV.exe
  2⤵
  PID:5976
- C:\Windows\System\wFGYsvL.exe
  C:\Windows\System\wFGYsvL.exe
  2⤵
  PID:5992
- C:\Windows\System\csvEPOY.exe
  C:\Windows\System\csvEPOY.exe
  2⤵
  PID:6008
- C:\Windows\System\GptxffX.exe
  C:\Windows\System\GptxffX.exe
  2⤵
  PID:6024
- C:\Windows\System\YduHVze.exe
  C:\Windows\System\YduHVze.exe
  2⤵
  PID:6044
- C:\Windows\System\RxreAfA.exe
  C:\Windows\System\RxreAfA.exe
  2⤵
  PID:6060
- C:\Windows\System\KLhKMpf.exe
  C:\Windows\System\KLhKMpf.exe
  2⤵
  PID:6076
- C:\Windows\System\RlHNoBl.exe
  C:\Windows\System\RlHNoBl.exe
  2⤵
  PID:6092
- C:\Windows\System\QAvRXjp.exe
  C:\Windows\System\QAvRXjp.exe
  2⤵
  PID:6108
- C:\Windows\System\VHgiAkw.exe
  C:\Windows\System\VHgiAkw.exe
  2⤵
  PID:6128
- C:\Windows\System\MjzMALQ.exe
  C:\Windows\System\MjzMALQ.exe
  2⤵
  PID:3712
- C:\Windows\System\VrrvzBq.exe
  C:\Windows\System\VrrvzBq.exe
  2⤵
  PID:3808
- C:\Windows\System\XXVvAhX.exe
  C:\Windows\System\XXVvAhX.exe
  2⤵
  PID:3876
- C:\Windows\System\IJgTRZi.exe
  C:\Windows\System\IJgTRZi.exe
  2⤵
  PID:3940
- C:\Windows\System\HTDycSb.exe
  C:\Windows\System\HTDycSb.exe
  2⤵
  PID:4004
- C:\Windows\System\ieoxNkC.exe
  C:\Windows\System\ieoxNkC.exe
  2⤵
  PID:6152
- C:\Windows\System\LnPSkEx.exe
  C:\Windows\System\LnPSkEx.exe
  2⤵
  PID:6172
- C:\Windows\System\wGlkipp.exe
  C:\Windows\System\wGlkipp.exe
  2⤵
  PID:6188
- C:\Windows\System\BQVPkRf.exe
  C:\Windows\System\BQVPkRf.exe
  2⤵
  PID:6204
- C:\Windows\System\TZWkLzz.exe
  C:\Windows\System\TZWkLzz.exe
  2⤵
  PID:6220
- C:\Windows\System\NjcsKLM.exe
  C:\Windows\System\NjcsKLM.exe
  2⤵
  PID:6236
- C:\Windows\System\evhWBeb.exe
  C:\Windows\System\evhWBeb.exe
  2⤵
  PID:6252
- C:\Windows\System\ssJYeQM.exe
  C:\Windows\System\ssJYeQM.exe
  2⤵
  PID:6268
- C:\Windows\System\GPGyoTX.exe
  C:\Windows\System\GPGyoTX.exe
  2⤵
  PID:6288
- C:\Windows\System\RmjwgWN.exe
  C:\Windows\System\RmjwgWN.exe
  2⤵
  PID:6304
- C:\Windows\System\LPQWARJ.exe
  C:\Windows\System\LPQWARJ.exe
  2⤵
  PID:6320
- C:\Windows\System\GcfDBud.exe
  C:\Windows\System\GcfDBud.exe
  2⤵
  PID:6336
- C:\Windows\System\OcrgJRd.exe
  C:\Windows\System\OcrgJRd.exe
  2⤵
  PID:6352
- C:\Windows\System\eZasxxk.exe
  C:\Windows\System\eZasxxk.exe
  2⤵
  PID:6368
- C:\Windows\System\EFVPMHq.exe
  C:\Windows\System\EFVPMHq.exe
  2⤵
  PID:6384
- C:\Windows\System\PuNYGXe.exe
  C:\Windows\System\PuNYGXe.exe
  2⤵
  PID:6404
- C:\Windows\System\KIfmdkq.exe
  C:\Windows\System\KIfmdkq.exe
  2⤵
  PID:6420
- C:\Windows\System\KeAgCsx.exe
  C:\Windows\System\KeAgCsx.exe
  2⤵
  PID:6436
- C:\Windows\System\fFOwrdM.exe
  C:\Windows\System\fFOwrdM.exe
  2⤵
  PID:6452
- C:\Windows\System\lnRqlpp.exe
  C:\Windows\System\lnRqlpp.exe
  2⤵
  PID:6468
- C:\Windows\System\iMZMoPL.exe
  C:\Windows\System\iMZMoPL.exe
  2⤵
  PID:6484
- C:\Windows\System\jHnHQbs.exe
  C:\Windows\System\jHnHQbs.exe
  2⤵
  PID:6500
- C:\Windows\System\jMJMFRn.exe
  C:\Windows\System\jMJMFRn.exe
  2⤵
  PID:6520
- C:\Windows\System\aprvNnq.exe
  C:\Windows\System\aprvNnq.exe
  2⤵
  PID:6536
- C:\Windows\System\CSkcnku.exe
  C:\Windows\System\CSkcnku.exe
  2⤵
  PID:6552
- C:\Windows\System\wXCbjhB.exe
  C:\Windows\System\wXCbjhB.exe
  2⤵
  PID:6568
- C:\Windows\System\lgwTBzA.exe
  C:\Windows\System\lgwTBzA.exe
  2⤵
  PID:6584
- C:\Windows\System\xkJHeqB.exe
  C:\Windows\System\xkJHeqB.exe
  2⤵
  PID:6600
- C:\Windows\System\yKWdCik.exe
  C:\Windows\System\yKWdCik.exe
  2⤵
  PID:6616
- C:\Windows\System\xPkyfnM.exe
  C:\Windows\System\xPkyfnM.exe
  2⤵
  PID:6632
- C:\Windows\System\ZhWDJnd.exe
  C:\Windows\System\ZhWDJnd.exe
  2⤵
  PID:6652
- C:\Windows\System\AEFuMot.exe
  C:\Windows\System\AEFuMot.exe
  2⤵
  PID:6668
- C:\Windows\System\IdWclst.exe
  C:\Windows\System\IdWclst.exe
  2⤵
  PID:6684
- C:\Windows\System\qPsHpVO.exe
  C:\Windows\System\qPsHpVO.exe
  2⤵
  PID:6700
- C:\Windows\System\LgSAxPW.exe
  C:\Windows\System\LgSAxPW.exe
  2⤵
  PID:6716
- C:\Windows\System\vDECzvQ.exe
  C:\Windows\System\vDECzvQ.exe
  2⤵
  PID:6732
- C:\Windows\System\BatCldx.exe
  C:\Windows\System\BatCldx.exe
  2⤵
  PID:6748
- C:\Windows\System\hLPMEBx.exe
  C:\Windows\System\hLPMEBx.exe
  2⤵
  PID:6768
- C:\Windows\System\mlRPpFm.exe
  C:\Windows\System\mlRPpFm.exe
  2⤵
  PID:6784
- C:\Windows\System\COeHlEZ.exe
  C:\Windows\System\COeHlEZ.exe
  2⤵
  PID:6800
- C:\Windows\System\dEoiJlC.exe
  C:\Windows\System\dEoiJlC.exe
  2⤵
  PID:6816
- C:\Windows\System\YNEtopl.exe
  C:\Windows\System\YNEtopl.exe
  2⤵
  PID:6836
- C:\Windows\System\bsPuyHe.exe
  C:\Windows\System\bsPuyHe.exe
  2⤵
  PID:6852
- C:\Windows\System\OcTajYE.exe
  C:\Windows\System\OcTajYE.exe
  2⤵
  PID:6868
- C:\Windows\System\aUlLvIZ.exe
  C:\Windows\System\aUlLvIZ.exe
  2⤵
  PID:6884
- C:\Windows\System\bpIsWPl.exe
  C:\Windows\System\bpIsWPl.exe
  2⤵
  PID:6900
- C:\Windows\System\WkcfdDd.exe
  C:\Windows\System\WkcfdDd.exe
  2⤵
  PID:6920
- C:\Windows\System\tbegHBu.exe
  C:\Windows\System\tbegHBu.exe
  2⤵
  PID:6936
- C:\Windows\System\QjZGRXH.exe
  C:\Windows\System\QjZGRXH.exe
  2⤵
  PID:6952
- C:\Windows\System\UnleWJk.exe
  C:\Windows\System\UnleWJk.exe
  2⤵
  PID:6968
- C:\Windows\System\FnsTxFr.exe
  C:\Windows\System\FnsTxFr.exe
  2⤵
  PID:6984
- C:\Windows\System\XJxURkT.exe
  C:\Windows\System\XJxURkT.exe
  2⤵
  PID:7000
- C:\Windows\System\TVgwZoL.exe
  C:\Windows\System\TVgwZoL.exe
  2⤵
  PID:7016
- C:\Windows\System\eeojwXW.exe
  C:\Windows\System\eeojwXW.exe
  2⤵
  PID:7032
- C:\Windows\System\RHVzyZh.exe
  C:\Windows\System\RHVzyZh.exe
  2⤵
  PID:7052
- C:\Windows\System\hwyjAEE.exe
  C:\Windows\System\hwyjAEE.exe
  2⤵
  PID:7068
- C:\Windows\System\frUmjdW.exe
  C:\Windows\System\frUmjdW.exe
  2⤵
  PID:7084
- C:\Windows\System\UoZKIsx.exe
  C:\Windows\System\UoZKIsx.exe
  2⤵
  PID:7104
- C:\Windows\System\NgAhEch.exe
  C:\Windows\System\NgAhEch.exe
  2⤵
  PID:7120
- C:\Windows\System\faktGKY.exe
  C:\Windows\System\faktGKY.exe
  2⤵
  PID:1256
- C:\Windows\System\ysVlAan.exe
  C:\Windows\System\ysVlAan.exe
  2⤵
  PID:1992
- C:\Windows\System\pFEkYyi.exe
  C:\Windows\System\pFEkYyi.exe
  2⤵
  PID:2072
- C:\Windows\System\rvYTDFj.exe
  C:\Windows\System\rvYTDFj.exe
  2⤵
  PID:3240
- C:\Windows\System\OxwsdcB.exe
  C:\Windows\System\OxwsdcB.exe
  2⤵
  PID:3496
- C:\Windows\System\PBxHiYt.exe
  C:\Windows\System\PBxHiYt.exe
  2⤵
  PID:3604
- C:\Windows\System\rGCGxUs.exe
  C:\Windows\System\rGCGxUs.exe
  2⤵
  PID:4532
- C:\Windows\System\bMDtBaz.exe
  C:\Windows\System\bMDtBaz.exe
  2⤵
  PID:4564
- C:\Windows\System\AKPXvbQ.exe
  C:\Windows\System\AKPXvbQ.exe
  2⤵
  PID:4660
- C:\Windows\System\SRlemDc.exe
  C:\Windows\System\SRlemDc.exe
  2⤵
  PID:4672
- C:\Windows\System\pGYVMkS.exe
  C:\Windows\System\pGYVMkS.exe
  2⤵
  PID:4688
- C:\Windows\System\jgdMmEG.exe
  C:\Windows\System\jgdMmEG.exe
  2⤵
  PID:4784
- C:\Windows\System\ZKPvoqJ.exe
  C:\Windows\System\ZKPvoqJ.exe
  2⤵
  PID:4844
- C:\Windows\System\mmniMHc.exe
  C:\Windows\System\mmniMHc.exe
  2⤵
  PID:4908
- C:\Windows\System\ihCyraL.exe
  C:\Windows\System\ihCyraL.exe
  2⤵
  PID:4972
- C:\Windows\System\LCYGBqf.exe
  C:\Windows\System\LCYGBqf.exe
  2⤵
  PID:5036
- C:\Windows\System\MfzuocB.exe
  C:\Windows\System\MfzuocB.exe
  2⤵
  PID:5076
- C:\Windows\System\pCfVYeN.exe
  C:\Windows\System\pCfVYeN.exe
  2⤵
  PID:2844
- C:\Windows\System\rGYSoYW.exe
  C:\Windows\System\rGYSoYW.exe
  2⤵
  PID:5184
- C:\Windows\System\BMBKYvE.exe
  C:\Windows\System\BMBKYvE.exe
  2⤵
  PID:5220
- C:\Windows\System\nmRzPvt.exe
  C:\Windows\System\nmRzPvt.exe
  2⤵
  PID:5284
- C:\Windows\System\sCWodpu.exe
  C:\Windows\System\sCWodpu.exe
  2⤵
  PID:5352
- C:\Windows\System\lZcDaPK.exe
  C:\Windows\System\lZcDaPK.exe
  2⤵
  PID:3812
- C:\Windows\System\pxUhyFd.exe
  C:\Windows\System\pxUhyFd.exe
  2⤵
  PID:5484
- C:\Windows\System\TkinggA.exe
  C:\Windows\System\TkinggA.exe
  2⤵
  PID:5584
- C:\Windows\System\pdTajqf.exe
  C:\Windows\System\pdTajqf.exe
  2⤵
  PID:5684
- C:\Windows\System\fDNTmXN.exe
  C:\Windows\System\fDNTmXN.exe
  2⤵
  PID:5788
- C:\Windows\System\JCkAiiS.exe
  C:\Windows\System\JCkAiiS.exe
  2⤵
  PID:5856
- C:\Windows\System\CAbuLtL.exe
  C:\Windows\System\CAbuLtL.exe
  2⤵
  PID:5948
- C:\Windows\System\wUzaTNx.exe
  C:\Windows\System\wUzaTNx.exe
  2⤵
  PID:6016
- C:\Windows\System\IkIRKtS.exe
  C:\Windows\System\IkIRKtS.exe
  2⤵
  PID:6116
- C:\Windows\System\PsOuFkr.exe
  C:\Windows\System\PsOuFkr.exe
  2⤵
  PID:3748
- C:\Windows\System\qtDLkVT.exe
  C:\Windows\System\qtDLkVT.exe
  2⤵
  PID:6180
- C:\Windows\System\ifNzvdw.exe
  C:\Windows\System\ifNzvdw.exe
  2⤵
  PID:6248
- C:\Windows\System\TRyfkpX.exe
  C:\Windows\System\TRyfkpX.exe
  2⤵
  PID:6312
- C:\Windows\System\sPYQsNC.exe
  C:\Windows\System\sPYQsNC.exe
  2⤵
  PID:6380
- C:\Windows\System\qVTEwDW.exe
  C:\Windows\System\qVTEwDW.exe
  2⤵
  PID:6448
- C:\Windows\System\mnUxBUR.exe
  C:\Windows\System\mnUxBUR.exe
  2⤵
  PID:6548
- C:\Windows\System\VkYPyln.exe
  C:\Windows\System\VkYPyln.exe
  2⤵
  PID:6612
- C:\Windows\System\TPMDeCU.exe
  C:\Windows\System\TPMDeCU.exe
  2⤵
  PID:6676
- C:\Windows\System\ZZpGrGg.exe
  C:\Windows\System\ZZpGrGg.exe
  2⤵
  PID:4276
- C:\Windows\System\hQghOzC.exe
  C:\Windows\System\hQghOzC.exe
  2⤵
  PID:5488
- C:\Windows\System\TVLQNyk.exe
  C:\Windows\System\TVLQNyk.exe
  2⤵
  PID:5656
- C:\Windows\System\pMtUMDy.exe
  C:\Windows\System\pMtUMDy.exe
  2⤵
  PID:1948
- C:\Windows\System\AEfXBoL.exe
  C:\Windows\System\AEfXBoL.exe
  2⤵
  PID:6020
- C:\Windows\System\Incjupz.exe
  C:\Windows\System\Incjupz.exe
  2⤵
  PID:4068
- C:\Windows\System\zeamhHz.exe
  C:\Windows\System\zeamhHz.exe
  2⤵
  PID:6708
- C:\Windows\System\qvwPLCq.exe
  C:\Windows\System\qvwPLCq.exe
  2⤵
  PID:3856
- C:\Windows\System\WlUotOF.exe
  C:\Windows\System\WlUotOF.exe
  2⤵
  PID:3668
- C:\Windows\System\AifIKJj.exe
  C:\Windows\System\AifIKJj.exe
  2⤵
  PID:3732
- C:\Windows\System\bDELqfT.exe
  C:\Windows\System\bDELqfT.exe
  2⤵
  PID:3796
- C:\Windows\System\jUmwqZC.exe
  C:\Windows\System\jUmwqZC.exe
  2⤵
  PID:3888
- C:\Windows\System\MbvTAVP.exe
  C:\Windows\System\MbvTAVP.exe
  2⤵
  PID:3952
- C:\Windows\System\ArwvIgo.exe
  C:\Windows\System\ArwvIgo.exe
  2⤵
  PID:4020
- C:\Windows\System\ZqyReZD.exe
  C:\Windows\System\ZqyReZD.exe
  2⤵
  PID:4084
- C:\Windows\System\fnFKpVA.exe
  C:\Windows\System\fnFKpVA.exe
  2⤵
  PID:2908
- C:\Windows\System\IbQWRJq.exe
  C:\Windows\System\IbQWRJq.exe
  2⤵
  PID:2592
- C:\Windows\System\KcSQNqE.exe
  C:\Windows\System\KcSQNqE.exe
  2⤵
  PID:2924
- C:\Windows\System\UQbWOLZ.exe
  C:\Windows\System\UQbWOLZ.exe
  2⤵
  PID:2728
- C:\Windows\System\jHozyud.exe
  C:\Windows\System\jHozyud.exe
  2⤵
  PID:3304
- C:\Windows\System\Oxebogh.exe
  C:\Windows\System\Oxebogh.exe
  2⤵
  PID:3100
- C:\Windows\System\tKWhkDM.exe
  C:\Windows\System\tKWhkDM.exe
  2⤵
  PID:4716
- C:\Windows\System\JLeOMjC.exe
  C:\Windows\System\JLeOMjC.exe
  2⤵
  PID:4480
- C:\Windows\System\TkHhLmf.exe
  C:\Windows\System\TkHhLmf.exe
  2⤵
  PID:4224
- C:\Windows\System\ZCZEfcP.exe
  C:\Windows\System\ZCZEfcP.exe
  2⤵
  PID:4160
- C:\Windows\System\INmrAdN.exe
  C:\Windows\System\INmrAdN.exe
  2⤵
  PID:3584
- C:\Windows\System\WkZzpGp.exe
  C:\Windows\System\WkZzpGp.exe
  2⤵
  PID:3456
- C:\Windows\System\GepNINP.exe
  C:\Windows\System\GepNINP.exe
  2⤵
  PID:4796
- C:\Windows\System\LuPSdEo.exe
  C:\Windows\System\LuPSdEo.exe
  2⤵
  PID:4924
- C:\Windows\System\raXzGXW.exe
  C:\Windows\System\raXzGXW.exe
  2⤵
  PID:4992
- C:\Windows\System\NXnjGFr.exe
  C:\Windows\System\NXnjGFr.exe
  2⤵
  PID:5060
- C:\Windows\System\TAIvHLV.exe
  C:\Windows\System\TAIvHLV.exe
  2⤵
  PID:3620
- C:\Windows\System\nRnockb.exe
  C:\Windows\System\nRnockb.exe
  2⤵
  PID:5168
- C:\Windows\System\bjkfsPa.exe
  C:\Windows\System\bjkfsPa.exe
  2⤵
  PID:5236
- C:\Windows\System\ILstcpK.exe
  C:\Windows\System\ILstcpK.exe
  2⤵
  PID:5304
- C:\Windows\System\EOFMMmD.exe
  C:\Windows\System\EOFMMmD.exe
  2⤵
  PID:5372
- C:\Windows\System\bODBKAw.exe
  C:\Windows\System\bODBKAw.exe
  2⤵
  PID:5440
- C:\Windows\System\gnhFyhT.exe
  C:\Windows\System\gnhFyhT.exe
  2⤵
  PID:5504
- C:\Windows\System\FIQdBnZ.exe
  C:\Windows\System\FIQdBnZ.exe
  2⤵
  PID:5568
- C:\Windows\System\BdbTBht.exe
  C:\Windows\System\BdbTBht.exe
  2⤵
  PID:5700
- C:\Windows\System\vTfgttU.exe
  C:\Windows\System\vTfgttU.exe
  2⤵
  PID:5736
- C:\Windows\System\uUZyooZ.exe
  C:\Windows\System\uUZyooZ.exe
  2⤵
  PID:5800
- C:\Windows\System\vtDLUtn.exe
  C:\Windows\System\vtDLUtn.exe
  2⤵
  PID:5868
- C:\Windows\System\VxSMlCQ.exe
  C:\Windows\System\VxSMlCQ.exe
  2⤵
  PID:5932
- C:\Windows\System\oekOQEw.exe
  C:\Windows\System\oekOQEw.exe
  2⤵
  PID:6000
- C:\Windows\System\yAQUaRB.exe
  C:\Windows\System\yAQUaRB.exe
  2⤵
  PID:6068
- C:\Windows\System\tkbHujz.exe
  C:\Windows\System\tkbHujz.exe
  2⤵
  PID:6136
- C:\Windows\System\wzTKsbS.exe
  C:\Windows\System\wzTKsbS.exe
  2⤵
  PID:3972
- C:\Windows\System\wvIyYPC.exe
  C:\Windows\System\wvIyYPC.exe
  2⤵
  PID:6196
- C:\Windows\System\Jqsnlvc.exe
  C:\Windows\System\Jqsnlvc.exe
  2⤵
  PID:6260
- C:\Windows\System\WTBBGfh.exe
  C:\Windows\System\WTBBGfh.exe
  2⤵
  PID:6328
- C:\Windows\System\hIXLtnL.exe
  C:\Windows\System\hIXLtnL.exe
  2⤵
  PID:6396
- C:\Windows\System\AnSAYbZ.exe
  C:\Windows\System\AnSAYbZ.exe
  2⤵
  PID:6432
- C:\Windows\System\qYTKhVj.exe
  C:\Windows\System\qYTKhVj.exe
  2⤵
  PID:6516
- C:\Windows\System\HkwsgLH.exe
  C:\Windows\System\HkwsgLH.exe
  2⤵
  PID:6560
- C:\Windows\System\UXWaIuT.exe
  C:\Windows\System\UXWaIuT.exe
  2⤵
  PID:6624
- C:\Windows\System\OUQNDLo.exe
  C:\Windows\System\OUQNDLo.exe
  2⤵
  PID:6692
- C:\Windows\System\YPTVXsI.exe
  C:\Windows\System\YPTVXsI.exe
  2⤵
  PID:6756
- C:\Windows\System\YdoDabw.exe
  C:\Windows\System\YdoDabw.exe
  2⤵
  PID:6796
- C:\Windows\System\jXfzNCl.exe
  C:\Windows\System\jXfzNCl.exe
  2⤵
  PID:6932
- C:\Windows\System\dSIOczP.exe
  C:\Windows\System\dSIOczP.exe
  2⤵
  PID:7128
- C:\Windows\System\UWyorTD.exe
  C:\Windows\System\UWyorTD.exe
  2⤵
  PID:7144
- C:\Windows\System\KtCgHGo.exe
  C:\Windows\System\KtCgHGo.exe
  2⤵
  PID:7160
- C:\Windows\System\nVoHOCW.exe
  C:\Windows\System\nVoHOCW.exe
  2⤵
  PID:2132
- C:\Windows\System\cZjFdwi.exe
  C:\Windows\System\cZjFdwi.exe
  2⤵
  PID:2028
- C:\Windows\System\bAlMmmo.exe
  C:\Windows\System\bAlMmmo.exe
  2⤵
  PID:3112
- C:\Windows\System\lIPrPBa.exe
  C:\Windows\System\lIPrPBa.exe
  2⤵
  PID:4176
- C:\Windows\System\QRFHNAx.exe
  C:\Windows\System\QRFHNAx.exe
  2⤵
  PID:3192
- C:\Windows\System\POvwEpF.exe
  C:\Windows\System\POvwEpF.exe
  2⤵
  PID:3388
- C:\Windows\System\bAQDVNp.exe
  C:\Windows\System\bAQDVNp.exe
  2⤵
  PID:4560
- C:\Windows\System\OCjyYfV.exe
  C:\Windows\System\OCjyYfV.exe
  2⤵
  PID:4144
- C:\Windows\System\LBEfbhi.exe
  C:\Windows\System\LBEfbhi.exe
  2⤵
  PID:4240
- C:\Windows\System\yktVpqJ.exe
  C:\Windows\System\yktVpqJ.exe
  2⤵
  PID:4336
- C:\Windows\System\EfCtOoK.exe
  C:\Windows\System\EfCtOoK.exe
  2⤵
  PID:4944
- C:\Windows\System\fyxxHyr.exe
  C:\Windows\System\fyxxHyr.exe
  2⤵
  PID:4876
- C:\Windows\System\WBVqheS.exe
  C:\Windows\System\WBVqheS.exe
  2⤵
  PID:5216
- C:\Windows\System\kSPZByY.exe
  C:\Windows\System\kSPZByY.exe
  2⤵
  PID:4880
- C:\Windows\System\YEvrEDA.exe
  C:\Windows\System\YEvrEDA.exe
  2⤵
  PID:5420
- C:\Windows\System\RLicaNS.exe
  C:\Windows\System\RLicaNS.exe
  2⤵
  PID:5008
- C:\Windows\System\YvUqBxK.exe
  C:\Windows\System\YvUqBxK.exe
  2⤵
  PID:5852
- C:\Windows\System\WqcmuVT.exe
  C:\Windows\System\WqcmuVT.exe
  2⤵
  PID:4032
- C:\Windows\System\nKivGNV.exe
  C:\Windows\System\nKivGNV.exe
  2⤵
  PID:6544
- C:\Windows\System\mMOLpWK.exe
  C:\Windows\System\mMOLpWK.exe
  2⤵
  PID:6376
- C:\Windows\System\OAIRbKn.exe
  C:\Windows\System\OAIRbKn.exe
  2⤵
  PID:6056
- C:\Windows\System\FVgADWL.exe
  C:\Windows\System\FVgADWL.exe
  2⤵
  PID:5044
- C:\Windows\System\PCYOWdm.exe
  C:\Windows\System\PCYOWdm.exe
  2⤵
  PID:5556
- C:\Windows\System\VhCXIfc.exe
  C:\Windows\System\VhCXIfc.exe
  2⤵
  PID:6148
- C:\Windows\System\KLZhPsd.exe
  C:\Windows\System\KLZhPsd.exe
  2⤵
  PID:6608
- C:\Windows\System\vvoVZdd.exe
  C:\Windows\System\vvoVZdd.exe
  2⤵
  PID:6776
- C:\Windows\System\FZpppVE.exe
  C:\Windows\System\FZpppVE.exe
  2⤵
  PID:6812
- C:\Windows\System\AoFsMlG.exe
  C:\Windows\System\AoFsMlG.exe
  2⤵
  PID:6908
- C:\Windows\System\ljrpKbV.exe
  C:\Windows\System\ljrpKbV.exe
  2⤵
  PID:6916
- C:\Windows\System\pqZUodc.exe
  C:\Windows\System\pqZUodc.exe
  2⤵
  PID:7040
- C:\Windows\System\OHtEmuZ.exe
  C:\Windows\System\OHtEmuZ.exe
  2⤵
  PID:7080
- C:\Windows\System\dMfPiWr.exe
  C:\Windows\System\dMfPiWr.exe
  2⤵
  PID:5384
- C:\Windows\System\gAssRys.exe
  C:\Windows\System\gAssRys.exe
  2⤵
  PID:3776
- C:\Windows\System\peXweAB.exe
  C:\Windows\System\peXweAB.exe
  2⤵
  PID:3728
- C:\Windows\System\ltVgPMl.exe
  C:\Windows\System\ltVgPMl.exe
  2⤵
  PID:3988
- C:\Windows\System\cwluSwx.exe
  C:\Windows\System\cwluSwx.exe
  2⤵
  PID:2076
- C:\Windows\System\hJhKgbL.exe
  C:\Windows\System\hJhKgbL.exe
  2⤵
  PID:4704
- C:\Windows\System\reGUngj.exe
  C:\Windows\System\reGUngj.exe
  2⤵
  PID:4640
- C:\Windows\System\jwQqqGJ.exe
  C:\Windows\System\jwQqqGJ.exe
  2⤵
  PID:4388
- C:\Windows\System\OeEnjaD.exe
  C:\Windows\System\OeEnjaD.exe
  2⤵
  PID:4732
- C:\Windows\System\ErocGxH.exe
  C:\Windows\System\ErocGxH.exe
  2⤵
  PID:4768
- C:\Windows\System\VZgHwlW.exe
  C:\Windows\System\VZgHwlW.exe
  2⤵
  PID:4892
- C:\Windows\System\BQyjvMe.exe
  C:\Windows\System\BQyjvMe.exe
  2⤵
  PID:5272
- C:\Windows\System\bUihDSH.exe
  C:\Windows\System\bUihDSH.exe
  2⤵
  PID:5024
- C:\Windows\System\wGsTlBk.exe
  C:\Windows\System\wGsTlBk.exe
  2⤵
  PID:5300
- C:\Windows\System\bwdRphs.exe
  C:\Windows\System\bwdRphs.exe
  2⤵
  PID:5540
- C:\Windows\System\gkwbCsm.exe
  C:\Windows\System\gkwbCsm.exe
  2⤵
  PID:5204
- C:\Windows\System\TlAqxst.exe
  C:\Windows\System\TlAqxst.exe
  2⤵
  PID:6976
- C:\Windows\System\lQSQSuA.exe
  C:\Windows\System\lQSQSuA.exe
  2⤵
  PID:5836
- C:\Windows\System\dbuDWwm.exe
  C:\Windows\System\dbuDWwm.exe
  2⤵
  PID:5904
- C:\Windows\System\upAMgsa.exe
  C:\Windows\System\upAMgsa.exe
  2⤵
  PID:3872
- C:\Windows\System\GlwdIVg.exe
  C:\Windows\System\GlwdIVg.exe
  2⤵
  PID:5704
- C:\Windows\System\KUXIlPi.exe
  C:\Windows\System\KUXIlPi.exe
  2⤵
  PID:6232
- C:\Windows\System\QcoLGTX.exe
  C:\Windows\System\QcoLGTX.exe
  2⤵
  PID:6464
- C:\Windows\System\zggJUYM.exe
  C:\Windows\System\zggJUYM.exe
  2⤵
  PID:6724
- C:\Windows\System\TgfeZJR.exe
  C:\Windows\System\TgfeZJR.exe
  2⤵
  PID:6168
- C:\Windows\System\eShOvRw.exe
  C:\Windows\System\eShOvRw.exe
  2⤵
  PID:6364
- C:\Windows\System\KnXhELb.exe
  C:\Windows\System\KnXhELb.exe
  2⤵
  PID:6792
- C:\Windows\System\PGAzbQB.exe
  C:\Windows\System\PGAzbQB.exe
  2⤵
  PID:6896
- C:\Windows\System\JywtZLo.exe
  C:\Windows\System\JywtZLo.exe
  2⤵
  PID:7100
- C:\Windows\System\FInccOn.exe
  C:\Windows\System\FInccOn.exe
  2⤵
  PID:6996
- C:\Windows\System\rFjAnol.exe
  C:\Windows\System\rFjAnol.exe
  2⤵
  PID:7140
- C:\Windows\System\auwZnUM.exe
  C:\Windows\System\auwZnUM.exe
  2⤵
  PID:7112
- C:\Windows\System\BqDswdq.exe
  C:\Windows\System\BqDswdq.exe
  2⤵
  PID:964
- C:\Windows\System\eaTyuTK.exe
  C:\Windows\System\eaTyuTK.exe
  2⤵
  PID:3196
- C:\Windows\System\mHxhoqr.exe
  C:\Windows\System\mHxhoqr.exe
  2⤵
  PID:3288
- C:\Windows\System\WfWjSyf.exe
  C:\Windows\System\WfWjSyf.exe
  2⤵
  PID:4116
- C:\Windows\System\CQgrfhu.exe
  C:\Windows\System\CQgrfhu.exe
  2⤵
  PID:4468
- C:\Windows\System\SPulstS.exe
  C:\Windows\System\SPulstS.exe
  2⤵
  PID:4244
- C:\Windows\System\cXlZTXI.exe
  C:\Windows\System\cXlZTXI.exe
  2⤵
  PID:5256
- C:\Windows\System\ZyJFhQL.exe
  C:\Windows\System\ZyJFhQL.exe
  2⤵
  PID:4400
- C:\Windows\System\AWXDssg.exe
  C:\Windows\System\AWXDssg.exe
  2⤵
  PID:4724
- C:\Windows\System\pGjkzNT.exe
  C:\Windows\System\pGjkzNT.exe
  2⤵
  PID:5108
- C:\Windows\System\ecCPKSY.exe
  C:\Windows\System\ecCPKSY.exe
  2⤵
  PID:5452
- C:\Windows\System\VXRSccR.exe
  C:\Windows\System\VXRSccR.exe
  2⤵
  PID:5616
- C:\Windows\System\fyysaNm.exe
  C:\Windows\System\fyysaNm.exe
  2⤵
  PID:4052
- C:\Windows\System\CQJfNqV.exe
  C:\Windows\System\CQJfNqV.exe
  2⤵
  PID:4036
- C:\Windows\System\OoalVNy.exe
  C:\Windows\System\OoalVNy.exe
  2⤵
  PID:3744
- C:\Windows\System\zbjoCmv.exe
  C:\Windows\System\zbjoCmv.exe
  2⤵
  PID:5316
- C:\Windows\System\xoBkNDb.exe
  C:\Windows\System\xoBkNDb.exe
  2⤵
  PID:7008
- C:\Windows\System\KOBFNeE.exe
  C:\Windows\System\KOBFNeE.exe
  2⤵
  PID:2836
- C:\Windows\System\LmFAVAD.exe
  C:\Windows\System\LmFAVAD.exe
  2⤵
  PID:6512
- C:\Windows\System\WnpqmZD.exe
  C:\Windows\System\WnpqmZD.exe
  2⤵
  PID:3664
- C:\Windows\System\DYvmxQu.exe
  C:\Windows\System\DYvmxQu.exe
  2⤵
  PID:6084
- C:\Windows\System\cuYEGJc.exe
  C:\Windows\System\cuYEGJc.exe
  2⤵
  PID:3148
- C:\Windows\System\RAVlTkt.exe
  C:\Windows\System\RAVlTkt.exe
  2⤵
  PID:7048
- C:\Windows\System\QHHGqWa.exe
  C:\Windows\System\QHHGqWa.exe
  2⤵
  PID:6444
- C:\Windows\System\BCovTci.exe
  C:\Windows\System\BCovTci.exe
  2⤵
  PID:5920
- C:\Windows\System\XRlBykE.exe
  C:\Windows\System\XRlBykE.exe
  2⤵
  PID:4544
- C:\Windows\System\FpOURpx.exe
  C:\Windows\System\FpOURpx.exe
  2⤵
  PID:4100
- C:\Windows\System\LQvTwyH.exe
  C:\Windows\System\LQvTwyH.exe
  2⤵
  PID:4164
- C:\Windows\System\IWXjxnZ.exe
  C:\Windows\System\IWXjxnZ.exe
  2⤵
  PID:4580
- C:\Windows\System\bkRvdRy.exe
  C:\Windows\System\bkRvdRy.exe
  2⤵
  PID:4128
- C:\Windows\System\WBFycSM.exe
  C:\Windows\System\WBFycSM.exe
  2⤵
  PID:5900
- C:\Windows\System\GWwoRnn.exe
  C:\Windows\System\GWwoRnn.exe
  2⤵
  PID:6828
- C:\Windows\System\qjRnnij.exe
  C:\Windows\System\qjRnnij.exe
  2⤵
  PID:6164
- C:\Windows\System\QDWKTtL.exe
  C:\Windows\System\QDWKTtL.exe
  2⤵
  PID:616
- C:\Windows\System\rHnpLrh.exe
  C:\Windows\System\rHnpLrh.exe
  2⤵
  PID:5916
- C:\Windows\System\BCkuhPA.exe
  C:\Windows\System\BCkuhPA.exe
  2⤵
  PID:3936
- C:\Windows\System\jbCqoPG.exe
  C:\Windows\System\jbCqoPG.exe
  2⤵
  PID:5164
- C:\Windows\System\FKHTJzq.exe
  C:\Windows\System\FKHTJzq.exe
  2⤵
  PID:5500
- C:\Windows\System\xUcfgAS.exe
  C:\Windows\System\xUcfgAS.exe
  2⤵
  PID:6036
- C:\Windows\System\tGjBnze.exe
  C:\Windows\System\tGjBnze.exe
  2⤵
  PID:5552
- C:\Windows\System\QzXKMxn.exe
  C:\Windows\System\QzXKMxn.exe
  2⤵
  PID:4464
- C:\Windows\System\qsghhuL.exe
  C:\Windows\System\qsghhuL.exe
  2⤵
  PID:7116
- C:\Windows\System\yPmVIcO.exe
  C:\Windows\System\yPmVIcO.exe
  2⤵
  PID:6860
- C:\Windows\System\BQalOkP.exe
  C:\Windows\System\BQalOkP.exe
  2⤵
  PID:5416
- C:\Windows\System\zRpiDON.exe
  C:\Windows\System\zRpiDON.exe
  2⤵
  PID:7156
- C:\Windows\System\DVOFKyt.exe
  C:\Windows\System\DVOFKyt.exe
  2⤵
  PID:1028
- C:\Windows\System\cKGYJAg.exe
  C:\Windows\System\cKGYJAg.exe
  2⤵
  PID:4080
- C:\Windows\System\RJgTSKW.exe
  C:\Windows\System\RJgTSKW.exe
  2⤵
  PID:3408
- C:\Windows\System\btUKhik.exe
  C:\Windows\System\btUKhik.exe
  2⤵
  PID:5436
- C:\Windows\System\UBjejOb.exe
  C:\Windows\System\UBjejOb.exe
  2⤵
  PID:3324
- C:\Windows\System\eoIaapd.exe
  C:\Windows\System\eoIaapd.exe
  2⤵
  PID:4828
- C:\Windows\System\pMCelzk.exe
  C:\Windows\System\pMCelzk.exe
  2⤵
  PID:1340
- C:\Windows\System\wYxTwuB.exe
  C:\Windows\System\wYxTwuB.exe
  2⤵
  PID:2860
- C:\Windows\System\qkczHpd.exe
  C:\Windows\System\qkczHpd.exe
  2⤵
  PID:5072
- C:\Windows\System\pccSWAe.exe
  C:\Windows\System\pccSWAe.exe
  2⤵
  PID:5252
- C:\Windows\System\MmthhGz.exe
  C:\Windows\System\MmthhGz.exe
  2⤵
  PID:4728
- C:\Windows\System\AKhhvNf.exe
  C:\Windows\System\AKhhvNf.exe
  2⤵
  PID:6228
- C:\Windows\System\FguKCxW.exe
  C:\Windows\System\FguKCxW.exe
  2⤵
  PID:6596
- C:\Windows\System\dsqvfDB.exe
  C:\Windows\System\dsqvfDB.exe
  2⤵
  PID:6876
- C:\Windows\System\YRHivuv.exe
  C:\Windows\System\YRHivuv.exe
  2⤵
  PID:6508
- C:\Windows\System\pcXNLfn.exe
  C:\Windows\System\pcXNLfn.exe
  2⤵
  PID:6592
- C:\Windows\System\bePDZRr.exe
  C:\Windows\System\bePDZRr.exe
  2⤵
  PID:5732
- C:\Windows\System\KMwOaDo.exe
  C:\Windows\System\KMwOaDo.exe
  2⤵
  PID:4644
- C:\Windows\System\XDDkUJD.exe
  C:\Windows\System\XDDkUJD.exe
  2⤵
  PID:4356
- C:\Windows\System\BpnlIkV.exe
  C:\Windows\System\BpnlIkV.exe
  2⤵
  PID:4484
- C:\Windows\System\qedexVZ.exe
  C:\Windows\System\qedexVZ.exe
  2⤵
  PID:4416
- C:\Windows\System\wJUAJuX.exe
  C:\Windows\System\wJUAJuX.exe
  2⤵
  PID:3484
- C:\Windows\System\SGlXmPD.exe
  C:\Windows\System\SGlXmPD.exe
  2⤵
  PID:6808
- C:\Windows\System\ipGOxTl.exe
  C:\Windows\System\ipGOxTl.exe
  2⤵
  PID:2172
- C:\Windows\System\USMkYYe.exe
  C:\Windows\System\USMkYYe.exe
  2⤵
  PID:5772
- C:\Windows\System\WgGeujs.exe
  C:\Windows\System\WgGeujs.exe
  2⤵
  PID:4780
- C:\Windows\System\LlCFzHX.exe
  C:\Windows\System\LlCFzHX.exe
  2⤵
  PID:6964
- C:\Windows\System\PwVgzKk.exe
  C:\Windows\System\PwVgzKk.exe
  2⤵
  PID:3420
- C:\Windows\System\hXEZHjN.exe
  C:\Windows\System\hXEZHjN.exe
  2⤵
  PID:3792
- C:\Windows\System\WFNURkG.exe
  C:\Windows\System\WFNURkG.exe
  2⤵
  PID:3276
- C:\Windows\System\AuWDDpt.exe
  C:\Windows\System\AuWDDpt.exe
  2⤵
  PID:6892
- C:\Windows\System\XPkyPKP.exe
  C:\Windows\System\XPkyPKP.exe
  2⤵
  PID:6992
- C:\Windows\System\VXamrlO.exe
  C:\Windows\System\VXamrlO.exe
  2⤵
  PID:4260
- C:\Windows\System\ByYUNQh.exe
  C:\Windows\System\ByYUNQh.exe
  2⤵
  PID:4720
- C:\Windows\System\KGTkuIk.exe
  C:\Windows\System\KGTkuIk.exe
  2⤵
  PID:5848
- C:\Windows\System\QsuXIKg.exe
  C:\Windows\System\QsuXIKg.exe
  2⤵
  PID:2692
- C:\Windows\System\JkFBExH.exe
  C:\Windows\System\JkFBExH.exe
  2⤵
  PID:7076
- C:\Windows\System\IEOhFbN.exe
  C:\Windows\System\IEOhFbN.exe
  2⤵
  PID:4292
- C:\Windows\System\ywzWmma.exe
  C:\Windows\System\ywzWmma.exe
  2⤵
  PID:4516
- C:\Windows\System\LOTXjBB.exe
  C:\Windows\System\LOTXjBB.exe
  2⤵
  PID:4896
- C:\Windows\System\uiZyHjw.exe
  C:\Windows\System\uiZyHjw.exe
  2⤵
  PID:4960
- C:\Windows\System\DWImFPY.exe
  C:\Windows\System\DWImFPY.exe
  2⤵
  PID:2508
- C:\Windows\System\klOQUKl.exe
  C:\Windows\System\klOQUKl.exe
  2⤵
  PID:3512
- C:\Windows\System\oahIDDN.exe
  C:\Windows\System\oahIDDN.exe
  2⤵
  PID:2212
- C:\Windows\System\FiQdwJo.exe
  C:\Windows\System\FiQdwJo.exe
  2⤵
  PID:5752
- C:\Windows\System\rgaeGdk.exe
  C:\Windows\System\rgaeGdk.exe
  2⤵
  PID:7180
- C:\Windows\System\aBIyIIz.exe
  C:\Windows\System\aBIyIIz.exe
  2⤵
  PID:7196
- C:\Windows\System\dwVsjgf.exe
  C:\Windows\System\dwVsjgf.exe
  2⤵
  PID:7212
- C:\Windows\System\Nfbcmuu.exe
  C:\Windows\System\Nfbcmuu.exe
  2⤵
  PID:7228
- C:\Windows\System\bzUkTFV.exe
  C:\Windows\System\bzUkTFV.exe
  2⤵
  PID:7244
- C:\Windows\System\FBrjhIQ.exe
  C:\Windows\System\FBrjhIQ.exe
  2⤵
  PID:7260
- C:\Windows\System\hCyIaWI.exe
  C:\Windows\System\hCyIaWI.exe
  2⤵
  PID:7276
- C:\Windows\System\VIPvsmr.exe
  C:\Windows\System\VIPvsmr.exe
  2⤵
  PID:7292
- C:\Windows\System\tesdAZg.exe
  C:\Windows\System\tesdAZg.exe
  2⤵
  PID:7308
- C:\Windows\System\aKnLTas.exe
  C:\Windows\System\aKnLTas.exe
  2⤵
  PID:7324
- C:\Windows\System\NnkfZNu.exe
  C:\Windows\System\NnkfZNu.exe
  2⤵
  PID:7340
- C:\Windows\System\ILBVtuj.exe
  C:\Windows\System\ILBVtuj.exe
  2⤵
  PID:7356
- C:\Windows\System\QmASRmy.exe
  C:\Windows\System\QmASRmy.exe
  2⤵
  PID:7372
- C:\Windows\System\iqnyGPl.exe
  C:\Windows\System\iqnyGPl.exe
  2⤵
  PID:7388
- C:\Windows\System\cnNttib.exe
  C:\Windows\System\cnNttib.exe
  2⤵
  PID:7404
- C:\Windows\System\YUCSlcX.exe
  C:\Windows\System\YUCSlcX.exe
  2⤵
  PID:7420
- C:\Windows\System\UHJJFCg.exe
  C:\Windows\System\UHJJFCg.exe
  2⤵
  PID:7436
- C:\Windows\System\zrsWAKV.exe
  C:\Windows\System\zrsWAKV.exe
  2⤵
  PID:7452
- C:\Windows\System\aGekYFF.exe
  C:\Windows\System\aGekYFF.exe
  2⤵
  PID:7468
- C:\Windows\System\SppRkPC.exe
  C:\Windows\System\SppRkPC.exe
  2⤵
  PID:7484
- C:\Windows\System\efILlVF.exe
  C:\Windows\System\efILlVF.exe
  2⤵
  PID:7500
- C:\Windows\System\GDgWBvc.exe
  C:\Windows\System\GDgWBvc.exe
  2⤵
  PID:7516
- C:\Windows\System\AhHdDWj.exe
  C:\Windows\System\AhHdDWj.exe
  2⤵
  PID:7532
- C:\Windows\System\oUOHkbi.exe
  C:\Windows\System\oUOHkbi.exe
  2⤵
  PID:7548
- C:\Windows\System\XiAEfdj.exe
  C:\Windows\System\XiAEfdj.exe
  2⤵
  PID:7564
- C:\Windows\System\mSjbbXb.exe
  C:\Windows\System\mSjbbXb.exe
  2⤵
  PID:7580
- C:\Windows\System\rsGrhXZ.exe
  C:\Windows\System\rsGrhXZ.exe
  2⤵
  PID:7596
- C:\Windows\System\NaVYrvu.exe
  C:\Windows\System\NaVYrvu.exe
  2⤵
  PID:7612
- C:\Windows\System\zInJfeh.exe
  C:\Windows\System\zInJfeh.exe
  2⤵
  PID:7628
- C:\Windows\System\ZdzAHkl.exe
  C:\Windows\System\ZdzAHkl.exe
  2⤵
  PID:7644
- C:\Windows\System\gENADmG.exe
  C:\Windows\System\gENADmG.exe
  2⤵
  PID:7660
- C:\Windows\System\fMqqMHk.exe
  C:\Windows\System\fMqqMHk.exe
  2⤵
  PID:7676
- C:\Windows\System\VmSQXeR.exe
  C:\Windows\System\VmSQXeR.exe
  2⤵
  PID:7692
- C:\Windows\System\SOZUKhR.exe
  C:\Windows\System\SOZUKhR.exe
  2⤵
  PID:7708
- C:\Windows\System\GTsLxup.exe
  C:\Windows\System\GTsLxup.exe
  2⤵
  PID:7724
- C:\Windows\System\pVkxvsy.exe
  C:\Windows\System\pVkxvsy.exe
  2⤵
  PID:7740
- C:\Windows\System\GqVgVmP.exe
  C:\Windows\System\GqVgVmP.exe
  2⤵
  PID:7756
- C:\Windows\System\TVDVHuh.exe
  C:\Windows\System\TVDVHuh.exe
  2⤵
  PID:7772
- C:\Windows\System\mHdlzVc.exe
  C:\Windows\System\mHdlzVc.exe
  2⤵
  PID:7788
- C:\Windows\System\YGVqcBy.exe
  C:\Windows\System\YGVqcBy.exe
  2⤵
  PID:7804
- C:\Windows\System\FcYBYqp.exe
  C:\Windows\System\FcYBYqp.exe
  2⤵
  PID:7820
- C:\Windows\System\dbevudj.exe
  C:\Windows\System\dbevudj.exe
  2⤵
  PID:7836
- C:\Windows\System\rEkyMUr.exe
  C:\Windows\System\rEkyMUr.exe
  2⤵
  PID:7852
- C:\Windows\System\SGqmajB.exe
  C:\Windows\System\SGqmajB.exe
  2⤵
  PID:7868
- C:\Windows\System\SDqrtfx.exe
  C:\Windows\System\SDqrtfx.exe
  2⤵
  PID:7884
- C:\Windows\System\YVoEzwW.exe
  C:\Windows\System\YVoEzwW.exe
  2⤵
  PID:7900
- C:\Windows\System\PGGtqFw.exe
  C:\Windows\System\PGGtqFw.exe
  2⤵
  PID:7916
- C:\Windows\System\DGEGeiL.exe
  C:\Windows\System\DGEGeiL.exe
  2⤵
  PID:7932
- C:\Windows\System\pIHXJGK.exe
  C:\Windows\System\pIHXJGK.exe
  2⤵
  PID:7948
- C:\Windows\System\ZBStBrJ.exe
  C:\Windows\System\ZBStBrJ.exe
  2⤵
  PID:7964
- C:\Windows\System\yCClFOH.exe
  C:\Windows\System\yCClFOH.exe
  2⤵
  PID:7980
- C:\Windows\System\UvbXGUV.exe
  C:\Windows\System\UvbXGUV.exe
  2⤵
  PID:7996
- C:\Windows\System\mKcLcdw.exe
  C:\Windows\System\mKcLcdw.exe
  2⤵
  PID:8012
- C:\Windows\System\JTASzxU.exe
  C:\Windows\System\JTASzxU.exe
  2⤵
  PID:8028
- C:\Windows\System\AIKLiGV.exe
  C:\Windows\System\AIKLiGV.exe
  2⤵
  PID:8044
- C:\Windows\System\qJgxjwf.exe
  C:\Windows\System\qJgxjwf.exe
  2⤵
  PID:8060
- C:\Windows\System\ACnPHcv.exe
  C:\Windows\System\ACnPHcv.exe
  2⤵
  PID:8076
- C:\Windows\System\bLLalFJ.exe
  C:\Windows\System\bLLalFJ.exe
  2⤵
  PID:8092
- C:\Windows\System\ccVqHBW.exe
  C:\Windows\System\ccVqHBW.exe
  2⤵
  PID:8108
- C:\Windows\System\nSzidFW.exe
  C:\Windows\System\nSzidFW.exe
  2⤵
  PID:8124
- C:\Windows\System\OLqTjQc.exe
  C:\Windows\System\OLqTjQc.exe
  2⤵
  PID:8140
- C:\Windows\System\tFPHjFu.exe
  C:\Windows\System\tFPHjFu.exe
  2⤵
  PID:8156
- C:\Windows\System\QxURJaU.exe
  C:\Windows\System\QxURJaU.exe
  2⤵
  PID:8172
- C:\Windows\System\lyZdWPl.exe
  C:\Windows\System\lyZdWPl.exe
  2⤵
  PID:8188
- C:\Windows\System\gZqtBoW.exe
  C:\Windows\System\gZqtBoW.exe
  2⤵
  PID:7220
- C:\Windows\System\DrfkLgY.exe
  C:\Windows\System\DrfkLgY.exe
  2⤵
  PID:7284
- C:\Windows\System\dQgrHEY.exe
  C:\Windows\System\dQgrHEY.exe
  2⤵
  PID:7028
- C:\Windows\System\LyLapao.exe
  C:\Windows\System\LyLapao.exe
  2⤵
  PID:7348
- C:\Windows\System\zsuPRlu.exe
  C:\Windows\System\zsuPRlu.exe
  2⤵
  PID:7412
- C:\Windows\System\POLnSnn.exe
  C:\Windows\System\POLnSnn.exe
  2⤵
  PID:7236
- C:\Windows\System\xIyJqDy.exe
  C:\Windows\System\xIyJqDy.exe
  2⤵
  PID:7512
- C:\Windows\System\fxnxpQo.exe
  C:\Windows\System\fxnxpQo.exe
  2⤵
  PID:7172
- C:\Windows\System\KqujEKm.exe
  C:\Windows\System\KqujEKm.exe
  2⤵
  PID:7204
- C:\Windows\System\tJcdAHk.exe
  C:\Windows\System\tJcdAHk.exe
  2⤵
  PID:7640
- C:\Windows\System\DgaLHdZ.exe
  C:\Windows\System\DgaLHdZ.exe
  2⤵
  PID:7208
- C:\Windows\System\QmMapkv.exe
  C:\Windows\System\QmMapkv.exe
  2⤵
  PID:7272
- C:\Windows\System\pvLxpJL.exe
  C:\Windows\System\pvLxpJL.exe
  2⤵
  PID:7336
- C:\Windows\System\AbbeqWr.exe
  C:\Windows\System\AbbeqWr.exe
  2⤵
  PID:7460
- C:\Windows\System\FWVAmHr.exe
  C:\Windows\System\FWVAmHr.exe
  2⤵
  PID:7524
- C:\Windows\System\RTHfEsX.exe
  C:\Windows\System\RTHfEsX.exe
  2⤵
  PID:7588
- C:\Windows\System\hMMThUW.exe
  C:\Windows\System\hMMThUW.exe
  2⤵
  PID:7704
- C:\Windows\System\rkljWAY.exe
  C:\Windows\System\rkljWAY.exe
  2⤵
  PID:7736
- C:\Windows\System\NJCNXHN.exe
  C:\Windows\System\NJCNXHN.exe
  2⤵
  PID:7688
- C:\Windows\System\pKkzdvl.exe
  C:\Windows\System\pKkzdvl.exe
  2⤵
  PID:7720
- C:\Windows\System\GTSDYCD.exe
  C:\Windows\System\GTSDYCD.exe
  2⤵
  PID:7832
- C:\Windows\System\zeVfRsF.exe
  C:\Windows\System\zeVfRsF.exe
  2⤵
  PID:7864
- C:\Windows\System\bowxKuT.exe
  C:\Windows\System\bowxKuT.exe
  2⤵
  PID:7928
- C:\Windows\System\qHUdRpO.exe
  C:\Windows\System\qHUdRpO.exe
  2⤵
  PID:7992
- C:\Windows\System\LFgnqIg.exe
  C:\Windows\System\LFgnqIg.exe
  2⤵
  PID:7976
- C:\Windows\System\RjnNIUz.exe
  C:\Windows\System\RjnNIUz.exe
  2⤵
  PID:7848
- C:\Windows\System\ZKwpnTr.exe
  C:\Windows\System\ZKwpnTr.exe
  2⤵
  PID:7908
- C:\Windows\System\UdnrcgZ.exe
  C:\Windows\System\UdnrcgZ.exe
  2⤵
  PID:7972
- C:\Windows\System\kvgEjlt.exe
  C:\Windows\System\kvgEjlt.exe
  2⤵
  PID:8084
- C:\Windows\System\Vputjdu.exe
  C:\Windows\System\Vputjdu.exe
  2⤵
  PID:8120
- C:\Windows\System\lhobwcW.exe
  C:\Windows\System\lhobwcW.exe
  2⤵
  PID:8184
- C:\Windows\System\ZMVmmla.exe
  C:\Windows\System\ZMVmmla.exe
  2⤵
  PID:7352
- C:\Windows\System\fdSCUNo.exe
  C:\Windows\System\fdSCUNo.exe
  2⤵
  PID:7544
- C:\Windows\System\uLirFtY.exe
  C:\Windows\System\uLirFtY.exe
  2⤵
  PID:7608
- C:\Windows\System\FnlEyLh.exe
  C:\Windows\System\FnlEyLh.exe
  2⤵
  PID:8104
- C:\Windows\System\HumJOxc.exe
  C:\Windows\System\HumJOxc.exe
  2⤵
  PID:7176
- C:\Windows\System\RCUvzXH.exe
  C:\Windows\System\RCUvzXH.exe
  2⤵
  PID:7432
- C:\Windows\System\gUfEblO.exe
  C:\Windows\System\gUfEblO.exe
  2⤵
  PID:7732
- C:\Windows\System\CNWaWPQ.exe
  C:\Windows\System\CNWaWPQ.exe
  2⤵
  PID:7576
- C:\Windows\System\DsgOLRz.exe
  C:\Windows\System\DsgOLRz.exe
  2⤵
  PID:7800
- C:\Windows\System\Klkgoxy.exe
  C:\Windows\System\Klkgoxy.exe
  2⤵
  PID:7844
- C:\Windows\System\okrCJEI.exe
  C:\Windows\System\okrCJEI.exe
  2⤵
  PID:7944
- C:\Windows\System\TrzhpNf.exe
  C:\Windows\System\TrzhpNf.exe
  2⤵
  PID:7604
- C:\Windows\System\LDBBeFu.exe
  C:\Windows\System\LDBBeFu.exe
  2⤵
  PID:7668
- C:\Windows\System\EZwEfcq.exe
  C:\Windows\System\EZwEfcq.exe
  2⤵
  PID:7700
- C:\Windows\System\ZyfAgkz.exe
  C:\Windows\System\ZyfAgkz.exe
  2⤵
  PID:7784
- C:\Windows\System\CilKkxV.exe
  C:\Windows\System\CilKkxV.exe
  2⤵
  PID:8052
- C:\Windows\System\GJCXVWW.exe
  C:\Windows\System\GJCXVWW.exe
  2⤵
  PID:8040
- C:\Windows\System\fTzEozY.exe
  C:\Windows\System\fTzEozY.exe
  2⤵
  PID:7320
- C:\Windows\System\IKkCvqq.exe
  C:\Windows\System\IKkCvqq.exe
  2⤵
  PID:7464
- C:\Windows\System\YhGDZam.exe
  C:\Windows\System\YhGDZam.exe
  2⤵
  PID:7716
- C:\Windows\System\WtlqHdY.exe
  C:\Windows\System\WtlqHdY.exe
  2⤵
  PID:7940
- C:\Windows\System\VaOGIDQ.exe
  C:\Windows\System\VaOGIDQ.exe
  2⤵
  PID:8168
- C:\Windows\System\fMhSiZq.exe
  C:\Windows\System\fMhSiZq.exe
  2⤵
  PID:8100
- C:\Windows\System\yiFPVnH.exe
  C:\Windows\System\yiFPVnH.exe
  2⤵
  PID:7816
- C:\Windows\System\RuqdSxn.exe
  C:\Windows\System\RuqdSxn.exe
  2⤵
  PID:7896
- C:\Windows\System\AOSwbBG.exe
  C:\Windows\System\AOSwbBG.exe
  2⤵
  PID:7924
- C:\Windows\System\zeaWMoJ.exe
  C:\Windows\System\zeaWMoJ.exe
  2⤵
  PID:8204
- C:\Windows\System\LQrENUW.exe
  C:\Windows\System\LQrENUW.exe
  2⤵
  PID:8220
- C:\Windows\System\EfNppJD.exe
  C:\Windows\System\EfNppJD.exe
  2⤵
  PID:8236
- C:\Windows\System\TDTcJGs.exe
  C:\Windows\System\TDTcJGs.exe
  2⤵
  PID:8252
- C:\Windows\System\ZJoJrjG.exe
  C:\Windows\System\ZJoJrjG.exe
  2⤵
  PID:8268
- C:\Windows\System\CEXiwSg.exe
  C:\Windows\System\CEXiwSg.exe
  2⤵
  PID:8284
- C:\Windows\System\zaOVIeC.exe
  C:\Windows\System\zaOVIeC.exe
  2⤵
  PID:8300
- C:\Windows\System\gyGbpdG.exe
  C:\Windows\System\gyGbpdG.exe
  2⤵
  PID:8316
- C:\Windows\System\azxzuEd.exe
  C:\Windows\System\azxzuEd.exe
  2⤵
  PID:8332
- C:\Windows\System\QYbwwHf.exe
  C:\Windows\System\QYbwwHf.exe
  2⤵
  PID:8348
- C:\Windows\System\EbrjuJN.exe
  C:\Windows\System\EbrjuJN.exe
  2⤵
  PID:8364
- C:\Windows\System\QYGJLaA.exe
  C:\Windows\System\QYGJLaA.exe
  2⤵
  PID:8380
- C:\Windows\System\dkEBJKN.exe
  C:\Windows\System\dkEBJKN.exe
  2⤵
  PID:8396
- C:\Windows\System\UBsZZtU.exe
  C:\Windows\System\UBsZZtU.exe
  2⤵
  PID:8412
- C:\Windows\System\viBLqHt.exe
  C:\Windows\System\viBLqHt.exe
  2⤵
  PID:8428
- C:\Windows\System\vTFYZiy.exe
  C:\Windows\System\vTFYZiy.exe
  2⤵
  PID:8448
- C:\Windows\System\qcPPhFF.exe
  C:\Windows\System\qcPPhFF.exe
  2⤵
  PID:8464
- C:\Windows\System\hqKtbeX.exe
  C:\Windows\System\hqKtbeX.exe
  2⤵
  PID:8480
- C:\Windows\System\veLwgpe.exe
  C:\Windows\System\veLwgpe.exe
  2⤵
  PID:8496
- C:\Windows\System\vfgYBVl.exe
  C:\Windows\System\vfgYBVl.exe
  2⤵
  PID:8512
- C:\Windows\System\xcoDNkc.exe
  C:\Windows\System\xcoDNkc.exe
  2⤵
  PID:8528
- C:\Windows\System\sIwLamM.exe
  C:\Windows\System\sIwLamM.exe
  2⤵
  PID:8544
- C:\Windows\System\LJnArYo.exe
  C:\Windows\System\LJnArYo.exe
  2⤵
  PID:8560
- C:\Windows\System\ddgXCwx.exe
  C:\Windows\System\ddgXCwx.exe
  2⤵
  PID:8576
- C:\Windows\System\EVZVoQX.exe
  C:\Windows\System\EVZVoQX.exe
  2⤵
  PID:8592
- C:\Windows\System\ItQcYwT.exe
  C:\Windows\System\ItQcYwT.exe
  2⤵
  PID:8608
- C:\Windows\System\ncIvGiO.exe
  C:\Windows\System\ncIvGiO.exe
  2⤵
  PID:8624
- C:\Windows\System\reeKvAx.exe
  C:\Windows\System\reeKvAx.exe
  2⤵
  PID:8640
- C:\Windows\System\rejKODJ.exe
  C:\Windows\System\rejKODJ.exe
  2⤵
  PID:8656
- C:\Windows\System\oagdsQr.exe
  C:\Windows\System\oagdsQr.exe
  2⤵
  PID:8672
- C:\Windows\System\mJhDydy.exe
  C:\Windows\System\mJhDydy.exe
  2⤵
  PID:8688
- C:\Windows\System\XxYtSOP.exe
  C:\Windows\System\XxYtSOP.exe
  2⤵
  PID:8704
- C:\Windows\System\tPljBiL.exe
  C:\Windows\System\tPljBiL.exe
  2⤵
  PID:8724
- C:\Windows\System\zQGWrxE.exe
  C:\Windows\System\zQGWrxE.exe
  2⤵
  PID:8740
- C:\Windows\System\rBFYqQw.exe
  C:\Windows\System\rBFYqQw.exe
  2⤵
  PID:8756
- C:\Windows\System\RQQrPOZ.exe
  C:\Windows\System\RQQrPOZ.exe
  2⤵
  PID:8772
- C:\Windows\System\dClYYkt.exe
  C:\Windows\System\dClYYkt.exe
  2⤵
  PID:8788
- C:\Windows\System\rlpGkDi.exe
  C:\Windows\System\rlpGkDi.exe
  2⤵
  PID:8804
- C:\Windows\System\eDzWEle.exe
  C:\Windows\System\eDzWEle.exe
  2⤵
  PID:8820
- C:\Windows\System\GpbLEeB.exe
  C:\Windows\System\GpbLEeB.exe
  2⤵
  PID:8836
- C:\Windows\System\bKVhsKn.exe
  C:\Windows\System\bKVhsKn.exe
  2⤵
  PID:8852
- C:\Windows\System\NkjOMof.exe
  C:\Windows\System\NkjOMof.exe
  2⤵
  PID:8868
- C:\Windows\System\MXQeXCM.exe
  C:\Windows\System\MXQeXCM.exe
  2⤵
  PID:8884
- C:\Windows\System\cCOBhgv.exe
  C:\Windows\System\cCOBhgv.exe
  2⤵
  PID:8900
- C:\Windows\System\wBsWVzZ.exe
  C:\Windows\System\wBsWVzZ.exe
  2⤵
  PID:8916
- C:\Windows\System\XBSDJil.exe
  C:\Windows\System\XBSDJil.exe
  2⤵
  PID:8932
- C:\Windows\System\YuiWJrI.exe
  C:\Windows\System\YuiWJrI.exe
  2⤵
  PID:8956
- C:\Windows\System\zWlJevm.exe
  C:\Windows\System\zWlJevm.exe
  2⤵
  PID:8972
- C:\Windows\System\KIZOEUx.exe
  C:\Windows\System\KIZOEUx.exe
  2⤵
  PID:8988
- C:\Windows\System\iQfmksV.exe
  C:\Windows\System\iQfmksV.exe
  2⤵
  PID:9008
- C:\Windows\System\nVdXvSe.exe
  C:\Windows\System\nVdXvSe.exe
  2⤵
  PID:9024
- C:\Windows\System\XDwNEjA.exe
  C:\Windows\System\XDwNEjA.exe
  2⤵
  PID:9044
- C:\Windows\System\SFGvLEj.exe
  C:\Windows\System\SFGvLEj.exe
  2⤵
  PID:9060
- C:\Windows\System\iuYnGiG.exe
  C:\Windows\System\iuYnGiG.exe
  2⤵
  PID:9076
- C:\Windows\System\rLHdUzq.exe
  C:\Windows\System\rLHdUzq.exe
  2⤵
  PID:9096
- C:\Windows\System\yTDwTTF.exe
  C:\Windows\System\yTDwTTF.exe
  2⤵
  PID:9112
- C:\Windows\System\sKNIseo.exe
  C:\Windows\System\sKNIseo.exe
  2⤵
  PID:9128
- C:\Windows\System\biFTXpz.exe
  C:\Windows\System\biFTXpz.exe
  2⤵
  PID:9148
- C:\Windows\System\UMvzahJ.exe
  C:\Windows\System\UMvzahJ.exe
  2⤵
  PID:9164
- C:\Windows\System\FsIiHul.exe
  C:\Windows\System\FsIiHul.exe
  2⤵
  PID:9180
- C:\Windows\System\tvnAaUf.exe
  C:\Windows\System\tvnAaUf.exe
  2⤵
  PID:9200
- C:\Windows\System\hzuraRq.exe
  C:\Windows\System\hzuraRq.exe
  2⤵
  PID:8088
- C:\Windows\System\hdCJULc.exe
  C:\Windows\System\hdCJULc.exe
  2⤵
  PID:7256
- C:\Windows\System\jrQvsNh.exe
  C:\Windows\System\jrQvsNh.exe
  2⤵
  PID:8196
- C:\Windows\System\wTfaLNt.exe
  C:\Windows\System\wTfaLNt.exe
  2⤵
  PID:7496
- C:\Windows\System\XxKXkmk.exe
  C:\Windows\System\XxKXkmk.exe
  2⤵
  PID:8324
- C:\Windows\System\JyDpbFT.exe
  C:\Windows\System\JyDpbFT.exe
  2⤵
  PID:7880
- C:\Windows\System\WCbNnpl.exe
  C:\Windows\System\WCbNnpl.exe
  2⤵
  PID:8216
- C:\Windows\System\cHtlaUV.exe
  C:\Windows\System\cHtlaUV.exe
  2⤵
  PID:7620
- C:\Windows\System\hVTvygt.exe
  C:\Windows\System\hVTvygt.exe
  2⤵
  PID:8308
- C:\Windows\System\OFsBCaz.exe
  C:\Windows\System\OFsBCaz.exe
  2⤵
  PID:8344
- C:\Windows\System\ARwfcmR.exe
  C:\Windows\System\ARwfcmR.exe
  2⤵
  PID:8420
- C:\Windows\System\ySCqAuL.exe
  C:\Windows\System\ySCqAuL.exe
  2⤵
  PID:8488
- C:\Windows\System\LKnwfaV.exe
  C:\Windows\System\LKnwfaV.exe
  2⤵
  PID:8404
- C:\Windows\System\BRzSoAh.exe
  C:\Windows\System\BRzSoAh.exe
  2⤵
  PID:8556
- C:\Windows\System\yIVwdFT.exe
  C:\Windows\System\yIVwdFT.exe
  2⤵
  PID:8376
- C:\Windows\System\XfpiGIm.exe
  C:\Windows\System\XfpiGIm.exe
  2⤵
  PID:8540
- C:\Windows\System\LdNeTpH.exe
  C:\Windows\System\LdNeTpH.exe
  2⤵
  PID:8536
- C:\Windows\System\VRyWevD.exe
  C:\Windows\System\VRyWevD.exe
  2⤵
  PID:8604
- C:\Windows\System\vdEmDGl.exe
  C:\Windows\System\vdEmDGl.exe
  2⤵
  PID:8632
- C:\Windows\System\wNpBlIP.exe
  C:\Windows\System\wNpBlIP.exe
  2⤵
  PID:8712
- C:\Windows\System\HxypJhP.exe
  C:\Windows\System\HxypJhP.exe
  2⤵
  PID:8780
- C:\Windows\System\FqPRAOD.exe
  C:\Windows\System\FqPRAOD.exe
  2⤵
  PID:8812
- C:\Windows\System\XikDAiT.exe
  C:\Windows\System\XikDAiT.exe
  2⤵
  PID:8800
- C:\Windows\System\RHGDgZH.exe
  C:\Windows\System\RHGDgZH.exe
  2⤵
  PID:8700
- C:\Windows\System\xVNqCuC.exe
  C:\Windows\System\xVNqCuC.exe
  2⤵
  PID:8876
- C:\Windows\System\TqiFVOm.exe
  C:\Windows\System\TqiFVOm.exe
  2⤵
  PID:8908
- C:\Windows\System\REklocE.exe
  C:\Windows\System\REklocE.exe
  2⤵
  PID:8912
- C:\Windows\System\XpXXZxL.exe
  C:\Windows\System\XpXXZxL.exe
  2⤵
  PID:8924
- C:\Windows\System\CKOpaMz.exe
  C:\Windows\System\CKOpaMz.exe
  2⤵
  PID:8944
- C:\Windows\System\xjRyeMP.exe
  C:\Windows\System\xjRyeMP.exe
  2⤵
  PID:9020
- C:\Windows\System\asUieEI.exe
  C:\Windows\System\asUieEI.exe
  2⤵
  PID:9052
- C:\Windows\System\eHqryGb.exe
  C:\Windows\System\eHqryGb.exe
  2⤵
  PID:9124
- C:\Windows\System\GjmBZvQ.exe
  C:\Windows\System\GjmBZvQ.exe
  2⤵
  PID:7448
- C:\Windows\System\fOxhaVH.exe
  C:\Windows\System\fOxhaVH.exe
  2⤵
  PID:8264
- C:\Windows\System\qzedEcA.exe
  C:\Windows\System\qzedEcA.exe
  2⤵
  PID:7656
- C:\Windows\System\LOSZlxs.exe
  C:\Windows\System\LOSZlxs.exe
  2⤵
  PID:9136
- C:\Windows\System\cgBQBfw.exe
  C:\Windows\System\cgBQBfw.exe
  2⤵
  PID:8968
- C:\Windows\System\GWkTzDk.exe
  C:\Windows\System\GWkTzDk.exe
  2⤵
  PID:8964
- C:\Windows\System\JZzbWbj.exe
  C:\Windows\System\JZzbWbj.exe
  2⤵
  PID:9040
- C:\Windows\System\MkhVMLn.exe
  C:\Windows\System\MkhVMLn.exe
  2⤵
  PID:9144
- C:\Windows\System\LIhNsjv.exe
  C:\Windows\System\LIhNsjv.exe
  2⤵
  PID:9208
- C:\Windows\System\IhLfJeK.exe
  C:\Windows\System\IhLfJeK.exe
  2⤵
  PID:8260
- C:\Windows\System\YXoetuC.exe
  C:\Windows\System\YXoetuC.exe
  2⤵
  PID:7988
- C:\Windows\System\zJrIuMk.exe
  C:\Windows\System\zJrIuMk.exe
  2⤵
  PID:8436
- C:\Windows\System\cXtDkYR.exe
  C:\Windows\System\cXtDkYR.exe
  2⤵
  PID:8636
- C:\Windows\System\syfGWKP.exe
  C:\Windows\System\syfGWKP.exe
  2⤵
  PID:8668
- C:\Windows\System\OVGIrvU.exe
  C:\Windows\System\OVGIrvU.exe
  2⤵
  PID:8768
- C:\Windows\System\TuOWVhT.exe
  C:\Windows\System\TuOWVhT.exe
  2⤵
  PID:8984
- C:\Windows\System\RZEwoma.exe
  C:\Windows\System\RZEwoma.exe
  2⤵
  PID:8228
- C:\Windows\System\uvCqLdX.exe
  C:\Windows\System\uvCqLdX.exe
  2⤵
  PID:8456
- C:\Windows\System\ztOhpoU.exe
  C:\Windows\System\ztOhpoU.exe
  2⤵
  PID:8864
- C:\Windows\System\JfjWuij.exe
  C:\Windows\System\JfjWuij.exe
  2⤵
  PID:8572
- C:\Windows\System\GyrtoTj.exe
  C:\Windows\System\GyrtoTj.exe
  2⤵
  PID:8948
- C:\Windows\System\sFhjSql.exe
  C:\Windows\System\sFhjSql.exe
  2⤵
  PID:9172
- C:\Windows\System\IYgfurS.exe
  C:\Windows\System\IYgfurS.exe
  2⤵
  PID:8372
- C:\Windows\System\uUiXkCN.exe
  C:\Windows\System\uUiXkCN.exe
  2⤵
  PID:8408
- C:\Windows\System\jdYUINc.exe
  C:\Windows\System\jdYUINc.exe
  2⤵
  PID:8784
- C:\Windows\System\yAvuGRm.exe
  C:\Windows\System\yAvuGRm.exe
  2⤵
  PID:8148
- C:\Windows\System\MNUFpaJ.exe
  C:\Windows\System\MNUFpaJ.exe
  2⤵
  PID:8460
- C:\Windows\System\RGUCNQS.exe
  C:\Windows\System\RGUCNQS.exe
  2⤵
  PID:8680
- C:\Windows\System\NHSBSnv.exe
  C:\Windows\System\NHSBSnv.exe
  2⤵
  PID:8444
- C:\Windows\System\VDGrCJk.exe
  C:\Windows\System\VDGrCJk.exe
  2⤵
  PID:8696
- C:\Windows\System\nGYeZqq.exe
  C:\Windows\System\nGYeZqq.exe
  2⤵
  PID:8504
- C:\Windows\System\fvCwQeT.exe
  C:\Windows\System\fvCwQeT.exe
  2⤵
  PID:8248
- C:\Windows\System\KgWvAdi.exe
  C:\Windows\System\KgWvAdi.exe
  2⤵
  PID:8860
- C:\Windows\System\zgNpiKF.exe
  C:\Windows\System\zgNpiKF.exe
  2⤵
  PID:9032
- C:\Windows\System\ClMzTHJ.exe
  C:\Windows\System\ClMzTHJ.exe
  2⤵
  PID:9072
- C:\Windows\System\ykQyNfO.exe
  C:\Windows\System\ykQyNfO.exe
  2⤵
  PID:8892
- C:\Windows\System\WbdxEcx.exe
  C:\Windows\System\WbdxEcx.exe
  2⤵
  PID:8844
- C:\Windows\System\pyfniUt.exe
  C:\Windows\System\pyfniUt.exe
  2⤵
  PID:8356
- C:\Windows\System\mVBHEVT.exe
  C:\Windows\System\mVBHEVT.exe
  2⤵
  PID:9176
- C:\Windows\System\UuzHOxe.exe
  C:\Windows\System\UuzHOxe.exe
  2⤵
  PID:8616
- C:\Windows\System\COXFHTa.exe
  C:\Windows\System\COXFHTa.exe
  2⤵
  PID:7268
- C:\Windows\System\zeyCPsV.exe
  C:\Windows\System\zeyCPsV.exe
  2⤵
  PID:8588
- C:\Windows\System\MVtsYGb.exe
  C:\Windows\System\MVtsYGb.exe
  2⤵
  PID:9236
- C:\Windows\System\koZwiQB.exe
  C:\Windows\System\koZwiQB.exe
  2⤵
  PID:9252
- C:\Windows\System\GRQCgEO.exe
  C:\Windows\System\GRQCgEO.exe
  2⤵
  PID:9268
- C:\Windows\System\FAQXXVb.exe
  C:\Windows\System\FAQXXVb.exe
  2⤵
  PID:9288
- C:\Windows\System\zPbimgD.exe
  C:\Windows\System\zPbimgD.exe
  2⤵
  PID:9304
- C:\Windows\System\dnzRpFN.exe
  C:\Windows\System\dnzRpFN.exe
  2⤵
  PID:9320
- C:\Windows\System\NNMnuJL.exe
  C:\Windows\System\NNMnuJL.exe
  2⤵
  PID:9340
- C:\Windows\System\wjhENpu.exe
  C:\Windows\System\wjhENpu.exe
  2⤵
  PID:9356
- C:\Windows\System\vxrqAwv.exe
  C:\Windows\System\vxrqAwv.exe
  2⤵
  PID:9372
- C:\Windows\System\UemXpEN.exe
  C:\Windows\System\UemXpEN.exe
  2⤵
  PID:9396
- C:\Windows\System\ERaHMjx.exe
  C:\Windows\System\ERaHMjx.exe
  2⤵
  PID:9412
- C:\Windows\System\PUvMdVz.exe
  C:\Windows\System\PUvMdVz.exe
  2⤵
  PID:9428
- C:\Windows\System\Nobzbky.exe
  C:\Windows\System\Nobzbky.exe
  2⤵
  PID:9448
- C:\Windows\System\BPEQGxB.exe
  C:\Windows\System\BPEQGxB.exe
  2⤵
  PID:9464
- C:\Windows\System\gGpBRbY.exe
  C:\Windows\System\gGpBRbY.exe
  2⤵
  PID:9484
- C:\Windows\System\IHTPfUM.exe
  C:\Windows\System\IHTPfUM.exe
  2⤵
  PID:9500
- C:\Windows\System\BhxqFXl.exe
  C:\Windows\System\BhxqFXl.exe
  2⤵
  PID:9516
- C:\Windows\System\btoVunc.exe
  C:\Windows\System\btoVunc.exe
  2⤵
  PID:9536
- C:\Windows\System\rJVACML.exe
  C:\Windows\System\rJVACML.exe
  2⤵
  PID:9552
- C:\Windows\System\WsDWrdG.exe
  C:\Windows\System\WsDWrdG.exe
  2⤵
  PID:9568
- C:\Windows\System\nOKacQL.exe
  C:\Windows\System\nOKacQL.exe
  2⤵
  PID:9588
- C:\Windows\System\iyFiPoQ.exe
  C:\Windows\System\iyFiPoQ.exe
  2⤵
  PID:9604
- C:\Windows\System\qHIJGbe.exe
  C:\Windows\System\qHIJGbe.exe
  2⤵
  PID:9620
- C:\Windows\System\SifIBnV.exe
  C:\Windows\System\SifIBnV.exe
  2⤵
  PID:9636
- C:\Windows\System\ZdXjQYQ.exe
  C:\Windows\System\ZdXjQYQ.exe
  2⤵
  PID:9652
- C:\Windows\System\GllPVFh.exe
  C:\Windows\System\GllPVFh.exe
  2⤵
  PID:9672
- C:\Windows\System\xMFVNwK.exe
  C:\Windows\System\xMFVNwK.exe
  2⤵
  PID:9688
- C:\Windows\System\UsodVuM.exe
  C:\Windows\System\UsodVuM.exe
  2⤵
  PID:9704
- C:\Windows\System\WZMOhRV.exe
  C:\Windows\System\WZMOhRV.exe
  2⤵
  PID:9724
- C:\Windows\System\vENYExk.exe
  C:\Windows\System\vENYExk.exe
  2⤵
  PID:9740
- C:\Windows\System\FfgpHkJ.exe
  C:\Windows\System\FfgpHkJ.exe
  2⤵
  PID:9760
- C:\Windows\System\cDVzGUu.exe
  C:\Windows\System\cDVzGUu.exe
  2⤵
  PID:9780
- C:\Windows\System\ihXDQOM.exe
  C:\Windows\System\ihXDQOM.exe
  2⤵
  PID:9796
- C:\Windows\System\IvgDEHY.exe
  C:\Windows\System\IvgDEHY.exe
  2⤵
  PID:9812
- C:\Windows\System\zWgpJEE.exe
  C:\Windows\System\zWgpJEE.exe
  2⤵
  PID:9828
- C:\Windows\System\lZLUnlN.exe
  C:\Windows\System\lZLUnlN.exe
  2⤵
  PID:9852
- C:\Windows\System\REpfUPi.exe
  C:\Windows\System\REpfUPi.exe
  2⤵
  PID:9868
- C:\Windows\System\bdEvqZM.exe
  C:\Windows\System\bdEvqZM.exe
  2⤵
  PID:9884
- C:\Windows\System\yghBmvU.exe
  C:\Windows\System\yghBmvU.exe
  2⤵
  PID:9900
- C:\Windows\System\DeEiNpG.exe
  C:\Windows\System\DeEiNpG.exe
  2⤵
  PID:9916
- C:\Windows\System\nZoCiAR.exe
  C:\Windows\System\nZoCiAR.exe
  2⤵
  PID:9932
- C:\Windows\System\qVLPAFd.exe
  C:\Windows\System\qVLPAFd.exe
  2⤵
  PID:9948
- C:\Windows\System\pgzGyZX.exe
  C:\Windows\System\pgzGyZX.exe
  2⤵
  PID:9964
- C:\Windows\System\wdaJyla.exe
  C:\Windows\System\wdaJyla.exe
  2⤵
  PID:9984
- C:\Windows\System\rECkeHZ.exe
  C:\Windows\System\rECkeHZ.exe
  2⤵
  PID:10000
- C:\Windows\System\WVnKGEC.exe
  C:\Windows\System\WVnKGEC.exe
  2⤵
  PID:10020
- C:\Windows\System\qfkKNlj.exe
  C:\Windows\System\qfkKNlj.exe
  2⤵
  PID:10036
- C:\Windows\System\aEBIEoG.exe
  C:\Windows\System\aEBIEoG.exe
  2⤵
  PID:10052
- C:\Windows\System\lQRMcto.exe
  C:\Windows\System\lQRMcto.exe
  2⤵
  PID:10068
- C:\Windows\System\MlbEuSZ.exe
  C:\Windows\System\MlbEuSZ.exe
  2⤵
  PID:10084
- C:\Windows\System\KevBLUy.exe
  C:\Windows\System\KevBLUy.exe
  2⤵
  PID:10100
- C:\Windows\System\DMSowgS.exe
  C:\Windows\System\DMSowgS.exe
  2⤵
  PID:10116
- C:\Windows\System\SHyxTnI.exe
  C:\Windows\System\SHyxTnI.exe
  2⤵
  PID:10132
- C:\Windows\System\McCGgUp.exe
  C:\Windows\System\McCGgUp.exe
  2⤵
  PID:10148
- C:\Windows\System\FDAPtda.exe
  C:\Windows\System\FDAPtda.exe
  2⤵
  PID:10164
- C:\Windows\System\HFqFzCD.exe
  C:\Windows\System\HFqFzCD.exe
  2⤵
  PID:10180
- C:\Windows\System\NQYGHtN.exe
  C:\Windows\System\NQYGHtN.exe
  2⤵
  PID:10196
- C:\Windows\System\iQyqLWM.exe
  C:\Windows\System\iQyqLWM.exe
  2⤵
  PID:10212
- C:\Windows\System\tLhcrlt.exe
  C:\Windows\System\tLhcrlt.exe
  2⤵
  PID:10228
- C:\Windows\System\pDzMvyi.exe
  C:\Windows\System\pDzMvyi.exe
  2⤵
  PID:8716
- C:\Windows\System\kTRANeR.exe
  C:\Windows\System\kTRANeR.exe
  2⤵
  PID:9284
- C:\Windows\System\fqmIkQW.exe
  C:\Windows\System\fqmIkQW.exe
  2⤵
  PID:9348
- C:\Windows\System\YWhuArs.exe
  C:\Windows\System\YWhuArs.exe
  2⤵
  PID:9392
- C:\Windows\System\KfiiziM.exe
  C:\Windows\System\KfiiziM.exe
  2⤵
  PID:8896
- C:\Windows\System\UWMElJH.exe
  C:\Windows\System\UWMElJH.exe
  2⤵
  PID:9260
- C:\Windows\System\gGnLXsc.exe
  C:\Windows\System\gGnLXsc.exe
  2⤵
  PID:9424
- C:\Windows\System\xxZxCsd.exe
  C:\Windows\System\xxZxCsd.exe
  2⤵
  PID:9496
- C:\Windows\System\SVyCdWw.exe
  C:\Windows\System\SVyCdWw.exe
  2⤵
  PID:9532
- C:\Windows\System\JsLZLkH.exe
  C:\Windows\System\JsLZLkH.exe
  2⤵
  PID:9408
- C:\Windows\System\SRqlFNj.exe
  C:\Windows\System\SRqlFNj.exe
  2⤵
  PID:9560
- C:\Windows\System\QfGVcXr.exe
  C:\Windows\System\QfGVcXr.exe
  2⤵
  PID:9628
- C:\Windows\System\lBnqlDp.exe
  C:\Windows\System\lBnqlDp.exe
  2⤵
  PID:9668
- C:\Windows\System\vhgVmub.exe
  C:\Windows\System\vhgVmub.exe
  2⤵
  PID:9700
- C:\Windows\System\utGdNZI.exe
  C:\Windows\System\utGdNZI.exe
  2⤵
  PID:9772
- C:\Windows\System\YTnvEIj.exe
  C:\Windows\System\YTnvEIj.exe
  2⤵
  PID:9808
- C:\Windows\System\RsMldwV.exe
  C:\Windows\System\RsMldwV.exe
  2⤵
  PID:9848
- C:\Windows\System\BaQuKYR.exe
  C:\Windows\System\BaQuKYR.exe
  2⤵
  PID:9576
- C:\Windows\System\RxvIBIG.exe
  C:\Windows\System\RxvIBIG.exe
  2⤵
  PID:9792
- C:\Windows\System\sJQhoJj.exe
  C:\Windows\System\sJQhoJj.exe
  2⤵
  PID:9944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DjBYTIm.exe

Filesize
1.7MB

MD5
39884640e802521985664a18c0d38983

SHA1
41c6e1ad6f01e01624675753bd2ec848c4124807

SHA256
6c19623659b662174bb3a0f65e2d36871b3fa98d26f991dc387fd58bf984d44d

SHA512
853fe3b8a25e046654a65604d6722c37baa5a035d683e10b7ce05296f45639d898bd5336391075ef6eb44c456d8a067012da2c4f88ca2bbda9046889fdac19ea

Download Submit
C:\Windows\system\GXQnLfk.exe

Filesize
1.7MB

MD5
4c891078c5b6a50479fc0ca3fb5ffda3

SHA1
eb7c58c64775198ab553cc60008ab402ca8a3562

SHA256
75dbec30b8946ac32842adb14c3b98c5df6d86de47deb21a2c491d96d84a8124

SHA512
b161c3bf1e293a3bbd022131180b9717e960ad3a0ef794dc317493718b3aa6ee1af4e6ac1d13733497a581377dd3c6a9d90b16f59f50fcfc59bfe2f542421852

Download Submit
C:\Windows\system\OYxgOID.exe

Filesize
1.7MB

MD5
8e4e91e23dd41dd6592a38a2ae2ae9c9

SHA1
64799f95117a1378d4bb359daf56cd05c75549af

SHA256
c598a9496ac1bc94b3a1937d135f0178383275b164a42a48fa75b17f3f91a5bb

SHA512
6a27a090faf4d86194d09c3ae2eee6c6fab5608e2cbac74b8f74c2ec452a3392f32a2dd4213e0b8fca28498bf50f181b27a7da25aec35224833238e70b77e9ef

Download Submit
C:\Windows\system\OgznKJk.exe

Filesize
1.7MB

MD5
8fc06b05f382bea1f55c3b2ab970221b

SHA1
da9792a069be34287548a2e5c7115c275154066f

SHA256
1ac7397d70ba3bfc32c478f5c7b5c9076ac0c0a04c58166e833a33b13ea92ce4

SHA512
781d28815c5ee227646f4b54ae7c864517b5c7ad5729f5c1187edcbbe3210c6cc4beb51701039557b46d6edb2def08dadc8497ed678366acef777d7b63e52e0b

Download Submit
C:\Windows\system\PWsAxAD.exe

Filesize
1.7MB

MD5
6c52e325ece4f45ea66b0f0229c9a988

SHA1
37a299ad6aaffd8e5a3bfc5e84aa4876ca9915b7

SHA256
c0b891cfb748726ed39634ae429cbfe50a108403b313f7726e885f02bf890f4a

SHA512
e0801829e20dfae9a5731c29d81faaa5d7fb23e02adc3600bfdc63b84b1818db58a675713482315082626229ab21062a22d25037ca7902a3e38f0b3aa996574e

Download Submit
C:\Windows\system\RfLGiOR.exe

Filesize
1.7MB

MD5
e9ee85dd665f17ea5c1b8ba625243dd4

SHA1
9548a5dea2140cbe3f1fceff5d375cd106cd0b4f

SHA256
3b129f7c4b4e76f9500f712982688ed2a57c18c2b1f17fcd41d258cf86c8fab6

SHA512
67d3531f7257b6fe8adbf1a92fd83b36935fa90b5585f05457a7faa551c7c4c817d70b2deddc866b7b5e02ec2fe2d09ec18ae8f93d2fab61b0fa7c1666c8c0e8

Download Submit
C:\Windows\system\SIoGFPe.exe

Filesize
1.7MB

MD5
5bf067a70a79d7a5a2ea84991bb68d0c

SHA1
33dca9c6da15e703c7af2bf849392978a3dd3dd5

SHA256
dc02e42e8008e96606dd34173182d20a2713f3bc5ae9246f4c1c71908dd166fa

SHA512
fd638a20c40658d6c7b48b6b83a8687f9c2ecb7233f5d74e51159d85a72415de353933b8c3fef40f7a664cd593e28dde2a150a5f73361af61ad8c5f5098406b1

Download Submit
C:\Windows\system\TBeUNuC.exe

Filesize
1.7MB

MD5
62a9f1dbf5510cd9accb0b1441c5c038

SHA1
7212184e308bad386ad41ac8652dc4f2c93217d9

SHA256
ca71553795884416b75f63816ea6fcaf94f69b08e8a74a51925f0fd92bbc80fd

SHA512
3ac30ed31aca9559a4f8c1e2f25afdad4d29012657464d48e411008a2e7df15b42295a8d56b58a88003e14f4a6ca78331e3bb2f58de484da0a0458bb100e1808

Download Submit
C:\Windows\system\TlGPnJU.exe

Filesize
1.7MB

MD5
f922838ff779f11c1e3c31b48deb1274

SHA1
015fad703979bcba1c294b7f04cdd22b2e141004

SHA256
d582bf2aca6e0e61195ed663bc4223c38bd0ae155228c43be095bd7f4174d685

SHA512
a552f8d006c9286714072138380fdad0a406e930984dea7323d0fe57068f21c4836245218a37deb067d74221e3a7d607f1937a4bf5c471769e36cce231a61766

Download Submit
C:\Windows\system\adVclhC.exe

Filesize
1.7MB

MD5
25ade23ba5b4a8b36192d9505d416ff4

SHA1
3e45e90a370cbb7cb3bb678dfb140666713e2241

SHA256
9fd5a76004227d9bcbafaec5216c15658fe7b7cbb0c8eabf42b3a506751ce12d

SHA512
de450ce53f530a2ccd8d3a0b46e2b912a8cc9b1d47f60f742ebd855d4bc0e2774c8d11cde3fef362ef29c310478e5e9fd093904b45646ce52abfccaeffba40c1

Download Submit
C:\Windows\system\bpPGeTh.exe

Filesize
1.7MB

MD5
226463355e497511975b2573dd8b1b82

SHA1
9b9aa66d9ec7258212b3c3ffe0987dd337c9055d

SHA256
73c7c631cba32d7e16acc05c7af13a720561dfe05c0bb434136bcddff806c290

SHA512
91af6d33f856572f8e10d600751ffa87c62bc2e7550aa8824863d7b4cc05eed5fffe3c7b1eefd7ece8ffeaa4c2622f9eef52e2181ed6d5f90c0d4e37ff7962fe

Download Submit
C:\Windows\system\gnQRAgS.exe

Filesize
1.7MB

MD5
bfbfaa247a9ae9a80a2048270ac1a380

SHA1
1e340fd6a5ec430277db74173151e4fd05b6e253

SHA256
17ec85edc3f91d9e9f48ddb90bac0f476103f49c85f67eb465d281a96de3c9f9

SHA512
bff98364cf785c34c49dd6af1074d0e854eb67c2e669102491bc080d02f4da68cab2a9e938f9ccc7e647e954ae05241875a0ae8bdaffd40b82fc08cfc5cd04b6

Download Submit
C:\Windows\system\hQwdKkt.exe

Filesize
1.7MB

MD5
e9de44abfbeb9c324dfd78e102a50755

SHA1
2caf9bea71b5838f66e3660e3c38c19d84fb881f

SHA256
341b9e26c98301eda2198736f5e610ce3a40ebac3cd2032275e43fdc17f1aa32

SHA512
a9d0ce7b0a27778974858bf4733bae08a08967cd27220daa157d485d8c5f97be0c25bdb40c3b0615ca29040f097bfee15071fb2ad05a56ed6973e1a581ab1ea1

Download Submit
C:\Windows\system\idFyPFg.exe

Filesize
1.7MB

MD5
ed51513bc671a7a4fda5f6f6e12870c5

SHA1
cb694a89e4661173226c57c2e7ef690ea3b310f7

SHA256
1ffc2f18e6129dc93be527afe09fd3f072a10a9cd967720ec14b0d5c1d407cf3

SHA512
4ee98413f3ef8481da4430a839d1e9c9bdf983bf500fd1929dbc2640ef4ebeeb1d78f952778c1018e91814e3ec237c7e3768ed807b8f55c6bada9f349987a831

Download Submit
C:\Windows\system\izerFVj.exe

Filesize
1.7MB

MD5
ab07873418c9d8ae42e8ef38f61d55e7

SHA1
0756ba99dce52991bb766e4be152e18df420cacc

SHA256
26479609176f270f5132e3956a01c77e6cef2cb546d34c1561f04dabdb9d37a0

SHA512
c158f2b2c3a56c5f6b4a9582a56a93adcf066a7bc17c15095962240d9f2274402026fe2e10e3a383b8d0abe152da2570e728f1bf8d7bfd3d7c0e202afe423997

Download Submit
C:\Windows\system\jWEqehO.exe

Filesize
1.7MB

MD5
e877b3efb47ba3d86c4c7543dbffe0bc

SHA1
944a05090411e3603e667968d1491f7a4a439c6e

SHA256
97d057d00fb2cf11ac2b07d619dc75f5ce2904adff1e21efd248e40b63e7d23f

SHA512
c48825eeede442675e3ec3be3297481ab1d187bc2ed2743974ad40c44cc6b44cd6b50e107f151b50f1d7e00d05dd90412fa782e72a8191b153323ed53cade668

Download Submit
C:\Windows\system\jlMIbSE.exe

Filesize
1.7MB

MD5
ecae9846154647b487d045ff2d82273b

SHA1
b5df6e1e1d79e98ade18a97591f80ffffbe46e51

SHA256
52ab6aa186129bfe1d943df6409d03c03315943282178aabf0d44b0967fe308f

SHA512
16c033a22992b8b8d260e37adc6257923b61f86db86aad31330f2a8f76f8876216225a4c5d7529b7e1f355e5ae12d63aae5af8211440c07c4e865ce282399283

Download Submit
C:\Windows\system\lBLnFVH.exe

Filesize
1.7MB

MD5
ae333546aae17eeb3596044a43c946ce

SHA1
052eb5cbd52747f100bb5f631487ba07edc48e8f

SHA256
1dd83b2a0b436a72e7d3d96291b731af7cf96703696c69c0f4a20260be634ba2

SHA512
3ae23e87cec687b93fc963de2fb66c5d0cc9e3dced254f552bab40357e34f91ed3a727f45e10550fbf66b9d60bd42afbed7de7f9a58730f6419974591e39c748

Download Submit
C:\Windows\system\lddpPXq.exe

Filesize
1.7MB

MD5
11b18e036b2a61e8f657b46741b4065f

SHA1
26bed676b993df0a487bfe79506aa4ce3d00d753

SHA256
b27f656702f8c9a12d9e27f5d08695977087478d68f858bf00bccc882b3eba90

SHA512
e87deb83acaa66a87d76ca44a06bbbcc93feb872863d496252223b493d6bf585e059173a7fcf5f44dbd38e2d147cdf02c7bfbe64212514261517f447fb87cd06

Download Submit
C:\Windows\system\lzBybqy.exe

Filesize
1.7MB

MD5
b24134448b964ec7a2a293357c4c1155

SHA1
b62920a9ae1167a0d9dd7d8b1c04b3c29b0f211f

SHA256
2ea3d9831ed599f5a6b529bfaac6aea4fb66a105b3bf30acea4413febb9d3199

SHA512
459fd194046fee3a1d8d152f5af4ca34b59a8c484d4425681d9298a3b485e12ba5aa9a6d70c0abe8e24193dc51a5e88cc54c361d3ef5eae7987c74294eb6f305

Download Submit
C:\Windows\system\tVhhzWE.exe

Filesize
1.7MB

MD5
eea2f59ecca3487ab64bc7cc4d17ea10

SHA1
1a2676ce8d1a154dbfb14a0088f394278ab0d135

SHA256
0e1a4c4190375985221d294003876a8c1b6be436336e1c3970c420ade2ec9dd6

SHA512
5ee890e81fbf391c6ef34d6519a544b7f4ccea25775b1b687f504263bd9d0b324f848e465f12a80640575d0c8ace2e2a6106e617d2864e13e462a54edd1bec35

Download Submit
C:\Windows\system\tZFtnfc.exe

Filesize
1.7MB

MD5
42380d74fd1cda3f4fb31f2fdae364ca

SHA1
ae3daea68c91e1bf8329b313ea7ba09c48f7db1d

SHA256
80f6fe1ab4e0b4438f0de67a51328068d1b26dfc96f0c96bedc325f8233e99bb

SHA512
208349a5856260849cf15aa278c9b3f60b47c84919c7821cd25801f8441bea9b7b2c9364a371d20535bc0810cb20f0500f2ef659afaa2a799aa43e530acac7db

Download Submit
C:\Windows\system\tkqSZnI.exe

Filesize
1.7MB

MD5
d23b65d294a4cdd0b71fed07d3c57b80

SHA1
2967e91dec93d5644af5a592c67f28d769421052

SHA256
3b0daa30561d59b2f8a4b40a45f089a7716a5270edceb703d056db55aa27ad8f

SHA512
acaa45e834c71c3386efa1905e002405700ca72c9be976c13d05e0c7a4548471eb47beff686ec1905b97608e54441a9d22ca2c997a04b16d173e30b3b1bcad85

Download Submit
C:\Windows\system\umvUWkb.exe

Filesize
1.7MB

MD5
c907a267e13476dcd5b04774d396e18c

SHA1
ae41aeb8865bf420d918d9753baca4dad13c7db6

SHA256
bc4f096cfac6fc020d3f840b121b620617cdcdb0fdb2474962d8b972611820e5

SHA512
5b3f6f58bd1e1f6901db98dc363345d9708b20b2c62a5ec44b4971de433036acb8f809542336e16d2432c0a7ff90839d3f02548a1a14602b47a3291549a3a030

Download Submit
C:\Windows\system\yraliBt.exe

Filesize
1.7MB

MD5
afaefdc6c635be02fbdfd6fde95b8eac

SHA1
4246ff4654b9849c848209fec5eeae75a5dc5888

SHA256
8bc7f1805260f1cf7e59a96190152e91cd8754a0230c7e1ca11090fb6afc7424

SHA512
26d14a2fedfd8eff5b65149afabe3a85f9a0c39dd3a9c668e8c36e3e10610f537dca4811682f7c3927f128e7dacedd42f7e0fa4cb07b574aa97f470f3863c39f

Download Submit
C:\Windows\system\zBoSDNn.exe

Filesize
1.7MB

MD5
70ad9cd29c8d3740515fe9d320f819db

SHA1
ddac3c04ab8852698f301f55507f2462f8dec816

SHA256
698898cb28adaf482416d80b8d1b294167470e6e398c33b46c348c1819649a5c

SHA512
f701bbb878d951a4ed3cae5e2aae6fb55b78d9ee3277d30a28894737181c28c38b243fda0094cd9b0a7c95a3fd37f2d305fea45100e5f6e11c9aa33802c3cb13

Download Submit
C:\Windows\system\zULnbJB.exe

Filesize
1.7MB

MD5
a524cd372542898fa6d3c3724928d4d5

SHA1
ae3a0e69fc58957a39ecbcb22ba703a80c62ddde

SHA256
d4e6a4f8774196baf5aab591c389b725a231b754f8c3d7f2b2823b14129f53d1

SHA512
0644ff65f2d793eadaae2eb49f463da45e6cd90001868a66fcdc26f9f36fc223548417c732645f85f79f07e9d829b82f60d5c9a6738f7b4efc28aabe1f4426ae

Download Submit
\Windows\system\SNVstWd.exe

Filesize
1.7MB

MD5
60b196fb99cc9c332fc29ae8e4395932

SHA1
8ce9a629c1bd12a5b85f3cbc272f54393e1a41a3

SHA256
61f95030084f1a9ece66be48300c58934e20856a303df77027b7a22fd05295fe

SHA512
fcb6b266f6119b7b075b234fe89edad34b846663f70d2f840fd785f8f8a2f41001a39aadc03c8c61a5cc655d90fe6031c21e8c1b5eee7dd706c3f9a13f2a20eb

Download Submit
\Windows\system\SpjrlSe.exe

Filesize
1.7MB

MD5
ec6d1fe8fdd618dff98c0d536893d7b8

SHA1
0b62d7ac0429b11c6b14794a67f67a16fc6207e9

SHA256
d0687693b1993b01983e7968d0abe3b8fcad5eecbb1a741e4e8d5dc0d0fa84e4

SHA512
ea808b912f35a0a421a0f5416dfde41be0fb517bda09daa0de6cbc08344ce890ca11647ea336b31b5a11e4a33b0adfd7c9f08961c28d0afde8a2baffbdbff084

Download Submit
\Windows\system\dRDbJjj.exe

Filesize
1.7MB

MD5
b96121d9086a4f7ad290018e1f62c087

SHA1
8ff406417137b0a5877e78eca0c590d1e0b199d4

SHA256
2196dc5693b1963be36ed29af4389c629559d2b85cf8b0fd39ea21ba94bc86ea

SHA512
bbbe056552e97b5c3b78ef64c07eeee991ab5d68f590d2dfc9d03d71fe8d94e6dad1c16b8c840fa7168c4cd204d5d66a224a6ae6bfe06223e5a2d855cabd48a0

Download Submit
\Windows\system\kJoPpxO.exe

Filesize
1.7MB

MD5
63c974b1cd4e69dfba08cfddfe8e6634

SHA1
0b027a1914e37bc7c75fea6a066ae890a23f9a0c

SHA256
9475353f4e6539ce7fd2a7311460ca3e27c9c9bb6ec389e8222f2c44a589820d

SHA512
b7fb7e1e75b16b80c5ab85bfdddae9980570093d66f77db13d31c6728b97e3fd21a772498c87e1bd72ad3d02c77c92aa141cea815ae917338ab6610be287b10d

Download Submit
\Windows\system\pvIgSVS.exe

Filesize
1.7MB

MD5
469fa2506af4315facd83924e9c7e969

SHA1
c527feba0ff424af70c1a0c1c824b3ab5b190ca7

SHA256
825a3ac008095e391ef036427a2ffc6ddae138f83d85779b4428a65aac70ba61

SHA512
2c97c7fdc7c7eca87a45ada0023eecb57154cf6625db03fd342d6461f7bca5fe52accbc70e63e3263f03679f05510fd6a85012016431de22704184376ec64806

Download Submit
\Windows\system\yXNIFGn.exe

Filesize
1.7MB

MD5
54960675a1de4f08c3642c013672f44e

SHA1
cf9c473de64dd469f2b427a135b991e5db360138

SHA256
6628a14212a92f9ced6637d36bce1fdb65df1d270834193ad49ee259e99ba61b

SHA512
a7774f4c1267b6a7ada67b46419f7d207f99cd88df0f7603eaed79317e0a5dc2cf13e559b0867bb5bb963e9b89d4ab43053cfbe68dcc81bed5199e86e9ece8fd

Download Submit
memory/1512-225-0x00000000027A0000-0x00000000027A8000-memory.dmp

Filesize
32KB

Download
memory/1512-224-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/1632-236-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-0-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/1632-7-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/1632-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1632-241-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1632-228-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1632-243-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1632-245-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1632-232-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1632-239-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1632-238-0x0000000003060000-0x0000000003452000-memory.dmp

Filesize
3.9MB

Download
memory/1636-227-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/1680-226-0x000000013FD80000-0x0000000140172000-memory.dmp

Filesize
3.9MB

Download
memory/2424-240-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/2528-233-0x000000013F7B0000-0x000000013FBA2000-memory.dmp

Filesize
3.9MB

Download
memory/2532-234-0x000000013F8E0000-0x000000013FCD2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-231-0x000000013FB70000-0x000000013FF62000-memory.dmp

Filesize
3.9MB

Download
memory/2640-230-0x000000013FD30000-0x0000000140122000-memory.dmp

Filesize
3.9MB

Download
memory/2660-242-0x000000013F1B0000-0x000000013F5A2000-memory.dmp

Filesize
3.9MB

Download
memory/2724-235-0x000000013F440000-0x000000013F832000-memory.dmp

Filesize
3.9MB

Download
memory/2740-237-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/3004-244-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download