xmrig | ed56447c13bac856991552bf1f5277fb4f7ba18fdfd5bae2205b9d11a8ce0c8f

Analysis

max time kernel
42s
max time network
40s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 02:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
Size

2.2MB
MD5

08cd1f8ff0bc00cc65678ddd71f1e6ee
SHA1

191d0626c61012d979d178aff42b13b5b10bf039
SHA256

ed56447c13bac856991552bf1f5277fb4f7ba18fdfd5bae2205b9d11a8ce0c8f
SHA512

e54b05e68051c625313561f522967c3d4400d4cc522f3e477318789ae473ff1869c112016f5d0665937af0183707b4d7d1363553c3339ef7829dfd104157f8e4
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTl//aD3W:NABB

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/1884-16-0x000000013FB90000-0x000000013FF82000-memory.dmp	xmrig
behavioral1/memory/2692-108-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2664-106-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2708-104-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2036-103-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig
behavioral1/memory/2704-102-0x000000013FFD0000-0x00000001403C2000-memory.dmp	xmrig
behavioral1/memory/2472-98-0x000000013FD70000-0x0000000140162000-memory.dmp	xmrig
behavioral1/memory/2616-86-0x000000013FED0000-0x00000001402C2000-memory.dmp	xmrig
behavioral1/memory/2700-84-0x000000013F070000-0x000000013F462000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2936	DFWYTBL.exe
1884	yUGwPES.exe
2700	vmwiJKq.exe
2616	hSWixHF.exe
2472	fkLUaEs.exe
2704	vvMEkwD.exe
2708	MBKMoju.exe
2664	vLRcTZi.exe
2692	HsdPDhB.exe
2576	snMAlxb.exe
2516	ldNtDzS.exe
1812	FkPADgK.exe
2852	FWajFke.exe
2920	HHbfnnt.exe
2216	aFFMGkX.exe
2824	WopVsob.exe
2864	YZnVWiJ.exe
1988	dLpbYim.exe
768	pBIKZlN.exe
1032	naXlmeq.exe
1592	pdciiwQ.exe
1280	uvIEMvA.exe
324	mPUpiAo.exe
2560	JZokxzU.exe
2316	uOaFBfy.exe
2068	VWmsdQh.exe
2008	ZjZMefa.exe
2056	VKtlFDs.exe
2976	XENpseN.exe
2796	pYjqaWt.exe
2204	pLkICjy.exe
540	QKRLaRE.exe
1576	dmcmTvi.exe
1500	JIKzvMt.exe
408	aXWgIau.exe
1132	ZUvzLWN.exe
2408	sFGDznq.exe
2348	KqnHeSX.exe
984	gfsOIfv.exe
1244	rBEWFld.exe
1880	DarPdTt.exe
852	ArFJLmu.exe
1368	UhUCiOU.exe
1940	SaiQLuk.exe
820	uCnxtsj.exe
2116	EQOCdxZ.exe
1708	pPKxETZ.exe
936	gLzPxOY.exe
696	MZIaVHX.exe
1040	mFAqIJJ.exe
1860	olTJelZ.exe
1508	zJDHAJC.exe
860	yfHJVla.exe
2280	AnVkgjj.exe
1892	EOSIyDG.exe
556	fhSmfKG.exe
1760	XnLlRJh.exe
880	DSqYxCI.exe
2104	DvHLGYg.exe
2088	imxgVNI.exe
1240	jQcBiJJ.exe
1552	ylxjLVc.exe
1680	ckabTEj.exe
1324	nxmAfnH.exe

Loads dropped DLL 64 IoCs

pid	Process
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2036-0-0x000000013F6F0000-0x000000013FAE2000-memory.dmp	upx
behavioral1/files/0x000b000000012301-5.dat	upx
behavioral1/files/0x00360000000167e8-9.dat	upx
behavioral1/memory/1884-16-0x000000013FB90000-0x000000013FF82000-memory.dmp	upx
behavioral1/memory/2936-12-0x000000013FEE0000-0x00000001402D2000-memory.dmp	upx
behavioral1/files/0x0008000000016c5b-23.dat	upx
behavioral1/files/0x0008000000016cf2-32.dat	upx
behavioral1/files/0x0009000000016d19-40.dat	upx
behavioral1/files/0x000600000001738e-52.dat	upx
behavioral1/files/0x000600000001738f-53.dat	upx
behavioral1/files/0x00060000000171ad-47.dat	upx
behavioral1/files/0x0006000000017577-112.dat	upx
behavioral1/files/0x0005000000019276-164.dat	upx
behavioral1/files/0x000500000001928e-172.dat	upx
behavioral1/files/0x000500000001927b-168.dat	upx
behavioral1/files/0x000500000001925a-160.dat	upx
behavioral1/files/0x0005000000019254-156.dat	upx
behavioral1/files/0x000600000001902f-152.dat	upx
behavioral1/files/0x000500000001878f-148.dat	upx
behavioral1/files/0x0005000000018749-144.dat	upx
behavioral1/files/0x000500000001871c-140.dat	upx
behavioral1/files/0x000500000001870e-136.dat	upx
behavioral1/files/0x00050000000186a2-132.dat	upx
behavioral1/files/0x000d000000018689-128.dat	upx
behavioral1/files/0x0006000000017603-124.dat	upx
behavioral1/files/0x0036000000016a3a-120.dat	upx
behavioral1/files/0x00060000000175fd-117.dat	upx
behavioral1/files/0x0006000000017436-69.dat	upx
behavioral1/files/0x00060000000173e2-62.dat	upx
behavioral1/memory/2692-108-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/memory/2664-106-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2708-104-0x000000013FF60000-0x0000000140352000-memory.dmp	upx
behavioral1/memory/2704-102-0x000000013FFD0000-0x00000001403C2000-memory.dmp	upx
behavioral1/memory/2472-98-0x000000013FD70000-0x0000000140162000-memory.dmp	upx
behavioral1/files/0x00060000000175f7-95.dat	upx
behavioral1/files/0x00060000000174ef-94.dat	upx
behavioral1/files/0x00060000000173e5-89.dat	upx
behavioral1/memory/2616-86-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/memory/2700-84-0x000000013F070000-0x000000013F462000-memory.dmp	upx
behavioral1/files/0x000700000001708c-43.dat	upx
behavioral1/files/0x0007000000016d01-35.dat	upx
behavioral1/files/0x00130000000054a8-28.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\THoVEpg.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\SJXmhzO.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\WchDQty.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\KxCpqsN.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ldVGzaZ.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\JgperTH.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\kybmGsy.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\YopGXTc.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\KfoIZmE.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\pYjqaWt.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ArFJLmu.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\qMWmyOo.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\waSfmpq.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\WFbahrH.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\Jpnovvv.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\kcNfzMf.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\tYyRNGF.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\zNlqFsA.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\DxRGasz.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ISSTbut.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\RcSxVue.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\FuDLotn.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\QKRLaRE.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\vSRcmcl.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ZBVnOXd.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\IOXGHyN.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\DfzQZsi.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\rcefipF.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\apHOsFv.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\LrbyUQc.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ZyOffum.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\rNpJsMk.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\YaLzKCr.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\KcObwvV.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\byQiQSP.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\kfCovrK.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\kuGmqfk.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\tKhSflw.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\XUzwatK.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\gbQXonJ.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\WslgvCo.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\ozYJpGl.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\VmJfMff.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\HuNEvGn.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\QiJzQPb.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\eaPqsMo.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\lLSHxQC.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\BruuvLt.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\SSdjLsZ.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\JANmrac.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\RfdFlDB.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\avxtXOw.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\wFlJWKM.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\TMPrSiB.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\sFGDznq.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\vWXRhUD.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\CHSaHsZ.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\DvtIwXZ.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\DuAFQtI.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\bClhHGH.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\fKjCnbn.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\weZqwTT.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\aDpARqm.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
File created	C:\Windows\System\Kboqpdb.exe	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2200	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
Token: SeDebugPrivilege	2200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2200	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2200	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	29
PID 2036 wrote to memory of 2936	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2936	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	30
PID 2036 wrote to memory of 2936	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	30
PID 2036 wrote to memory of 1884	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	31
PID 2036 wrote to memory of 1884	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	31
PID 2036 wrote to memory of 1884	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	31
PID 2036 wrote to memory of 2700	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2700	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2700	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	32
PID 2036 wrote to memory of 2616	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2616	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2616	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	33
PID 2036 wrote to memory of 2472	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2472	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2472	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	34
PID 2036 wrote to memory of 2704	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2704	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2704	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	35
PID 2036 wrote to memory of 2708	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2708	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2708	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	36
PID 2036 wrote to memory of 2664	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2664	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2664	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	37
PID 2036 wrote to memory of 2692	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2692	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2692	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	38
PID 2036 wrote to memory of 2576	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2576	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2576	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	39
PID 2036 wrote to memory of 2516	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	40
PID 2036 wrote to memory of 2516	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	40
PID 2036 wrote to memory of 2516	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	40
PID 2036 wrote to memory of 2216	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	41
PID 2036 wrote to memory of 2216	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	41
PID 2036 wrote to memory of 2216	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	41
PID 2036 wrote to memory of 1812	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1812	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	42
PID 2036 wrote to memory of 1812	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	42
PID 2036 wrote to memory of 2824	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2824	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2824	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	43
PID 2036 wrote to memory of 2852	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2852	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2852	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	44
PID 2036 wrote to memory of 2864	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2864	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2864	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	45
PID 2036 wrote to memory of 2920	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2920	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	46
PID 2036 wrote to memory of 2920	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	46
PID 2036 wrote to memory of 1988	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	47
PID 2036 wrote to memory of 1988	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	47
PID 2036 wrote to memory of 1988	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	47
PID 2036 wrote to memory of 768	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	48
PID 2036 wrote to memory of 768	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	48
PID 2036 wrote to memory of 768	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	48
PID 2036 wrote to memory of 1032	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1032	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1032	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	49
PID 2036 wrote to memory of 1592	2036	08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\08cd1f8ff0bc00cc65678ddd71f1e6ee_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\System\DFWYTBL.exe
  C:\Windows\System\DFWYTBL.exe
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Windows\System\yUGwPES.exe
  C:\Windows\System\yUGwPES.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\vmwiJKq.exe
  C:\Windows\System\vmwiJKq.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\hSWixHF.exe
  C:\Windows\System\hSWixHF.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\fkLUaEs.exe
  C:\Windows\System\fkLUaEs.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\vvMEkwD.exe
  C:\Windows\System\vvMEkwD.exe
  2⤵
  - Executes dropped EXE
  PID:2704
- C:\Windows\System\MBKMoju.exe
  C:\Windows\System\MBKMoju.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\vLRcTZi.exe
  C:\Windows\System\vLRcTZi.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\HsdPDhB.exe
  C:\Windows\System\HsdPDhB.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\snMAlxb.exe
  C:\Windows\System\snMAlxb.exe
  2⤵
  - Executes dropped EXE
  PID:2576
- C:\Windows\System\ldNtDzS.exe
  C:\Windows\System\ldNtDzS.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\aFFMGkX.exe
  C:\Windows\System\aFFMGkX.exe
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\System\FkPADgK.exe
  C:\Windows\System\FkPADgK.exe
  2⤵
  - Executes dropped EXE
  PID:1812
- C:\Windows\System\WopVsob.exe
  C:\Windows\System\WopVsob.exe
  2⤵
  - Executes dropped EXE
  PID:2824
- C:\Windows\System\FWajFke.exe
  C:\Windows\System\FWajFke.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\YZnVWiJ.exe
  C:\Windows\System\YZnVWiJ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\HHbfnnt.exe
  C:\Windows\System\HHbfnnt.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\dLpbYim.exe
  C:\Windows\System\dLpbYim.exe
  2⤵
  - Executes dropped EXE
  PID:1988
- C:\Windows\System\pBIKZlN.exe
  C:\Windows\System\pBIKZlN.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\naXlmeq.exe
  C:\Windows\System\naXlmeq.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\pdciiwQ.exe
  C:\Windows\System\pdciiwQ.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\uvIEMvA.exe
  C:\Windows\System\uvIEMvA.exe
  2⤵
  - Executes dropped EXE
  PID:1280
- C:\Windows\System\mPUpiAo.exe
  C:\Windows\System\mPUpiAo.exe
  2⤵
  - Executes dropped EXE
  PID:324
- C:\Windows\System\JZokxzU.exe
  C:\Windows\System\JZokxzU.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\uOaFBfy.exe
  C:\Windows\System\uOaFBfy.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\VWmsdQh.exe
  C:\Windows\System\VWmsdQh.exe
  2⤵
  - Executes dropped EXE
  PID:2068
- C:\Windows\System\ZjZMefa.exe
  C:\Windows\System\ZjZMefa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\VKtlFDs.exe
  C:\Windows\System\VKtlFDs.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\XENpseN.exe
  C:\Windows\System\XENpseN.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\pYjqaWt.exe
  C:\Windows\System\pYjqaWt.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\pLkICjy.exe
  C:\Windows\System\pLkICjy.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\QKRLaRE.exe
  C:\Windows\System\QKRLaRE.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\dmcmTvi.exe
  C:\Windows\System\dmcmTvi.exe
  2⤵
  - Executes dropped EXE
  PID:1576
- C:\Windows\System\JIKzvMt.exe
  C:\Windows\System\JIKzvMt.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\aXWgIau.exe
  C:\Windows\System\aXWgIau.exe
  2⤵
  - Executes dropped EXE
  PID:408
- C:\Windows\System\ZUvzLWN.exe
  C:\Windows\System\ZUvzLWN.exe
  2⤵
  - Executes dropped EXE
  PID:1132
- C:\Windows\System\sFGDznq.exe
  C:\Windows\System\sFGDznq.exe
  2⤵
  - Executes dropped EXE
  PID:2408
- C:\Windows\System\KqnHeSX.exe
  C:\Windows\System\KqnHeSX.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\gfsOIfv.exe
  C:\Windows\System\gfsOIfv.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\rBEWFld.exe
  C:\Windows\System\rBEWFld.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\DarPdTt.exe
  C:\Windows\System\DarPdTt.exe
  2⤵
  - Executes dropped EXE
  PID:1880
- C:\Windows\System\ArFJLmu.exe
  C:\Windows\System\ArFJLmu.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\UhUCiOU.exe
  C:\Windows\System\UhUCiOU.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\SaiQLuk.exe
  C:\Windows\System\SaiQLuk.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\uCnxtsj.exe
  C:\Windows\System\uCnxtsj.exe
  2⤵
  - Executes dropped EXE
  PID:820
- C:\Windows\System\EQOCdxZ.exe
  C:\Windows\System\EQOCdxZ.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\pPKxETZ.exe
  C:\Windows\System\pPKxETZ.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\gLzPxOY.exe
  C:\Windows\System\gLzPxOY.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\MZIaVHX.exe
  C:\Windows\System\MZIaVHX.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\mFAqIJJ.exe
  C:\Windows\System\mFAqIJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\olTJelZ.exe
  C:\Windows\System\olTJelZ.exe
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Windows\System\zJDHAJC.exe
  C:\Windows\System\zJDHAJC.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\yfHJVla.exe
  C:\Windows\System\yfHJVla.exe
  2⤵
  - Executes dropped EXE
  PID:860
- C:\Windows\System\AnVkgjj.exe
  C:\Windows\System\AnVkgjj.exe
  2⤵
  - Executes dropped EXE
  PID:2280
- C:\Windows\System\EOSIyDG.exe
  C:\Windows\System\EOSIyDG.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\fhSmfKG.exe
  C:\Windows\System\fhSmfKG.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\XnLlRJh.exe
  C:\Windows\System\XnLlRJh.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\DSqYxCI.exe
  C:\Windows\System\DSqYxCI.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\DvHLGYg.exe
  C:\Windows\System\DvHLGYg.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\imxgVNI.exe
  C:\Windows\System\imxgVNI.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\jQcBiJJ.exe
  C:\Windows\System\jQcBiJJ.exe
  2⤵
  - Executes dropped EXE
  PID:1240
- C:\Windows\System\ylxjLVc.exe
  C:\Windows\System\ylxjLVc.exe
  2⤵
  - Executes dropped EXE
  PID:1552
- C:\Windows\System\ckabTEj.exe
  C:\Windows\System\ckabTEj.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\nxmAfnH.exe
  C:\Windows\System\nxmAfnH.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\HVUrwpj.exe
  C:\Windows\System\HVUrwpj.exe
  2⤵
  PID:2324
- C:\Windows\System\QcFkQnQ.exe
  C:\Windows\System\QcFkQnQ.exe
  2⤵
  PID:2668
- C:\Windows\System\PJjLEBd.exe
  C:\Windows\System\PJjLEBd.exe
  2⤵
  PID:2588
- C:\Windows\System\qMWmyOo.exe
  C:\Windows\System\qMWmyOo.exe
  2⤵
  PID:1844
- C:\Windows\System\mJyCJze.exe
  C:\Windows\System\mJyCJze.exe
  2⤵
  PID:1600
- C:\Windows\System\REvkuMV.exe
  C:\Windows\System\REvkuMV.exe
  2⤵
  PID:2468
- C:\Windows\System\jeytkYk.exe
  C:\Windows\System\jeytkYk.exe
  2⤵
  PID:1164
- C:\Windows\System\uywLXKI.exe
  C:\Windows\System\uywLXKI.exe
  2⤵
  PID:2856
- C:\Windows\System\cnBflud.exe
  C:\Windows\System\cnBflud.exe
  2⤵
  PID:2908
- C:\Windows\System\qAaAEXl.exe
  C:\Windows\System\qAaAEXl.exe
  2⤵
  PID:2712
- C:\Windows\System\HUESeHd.exe
  C:\Windows\System\HUESeHd.exe
  2⤵
  PID:1824
- C:\Windows\System\qVglIHS.exe
  C:\Windows\System\qVglIHS.exe
  2⤵
  PID:1036
- C:\Windows\System\lshCBLz.exe
  C:\Windows\System\lshCBLz.exe
  2⤵
  PID:2888
- C:\Windows\System\VrdaAQL.exe
  C:\Windows\System\VrdaAQL.exe
  2⤵
  PID:2544
- C:\Windows\System\joKDXct.exe
  C:\Windows\System\joKDXct.exe
  2⤵
  PID:1372
- C:\Windows\System\iCzXvmK.exe
  C:\Windows\System\iCzXvmK.exe
  2⤵
  PID:2548
- C:\Windows\System\lucJOdt.exe
  C:\Windows\System\lucJOdt.exe
  2⤵
  PID:1780
- C:\Windows\System\qOktbWl.exe
  C:\Windows\System\qOktbWl.exe
  2⤵
  PID:2504
- C:\Windows\System\ioGHRFu.exe
  C:\Windows\System\ioGHRFu.exe
  2⤵
  PID:1220
- C:\Windows\System\TEnKISL.exe
  C:\Windows\System\TEnKISL.exe
  2⤵
  PID:2964
- C:\Windows\System\yOFxrGl.exe
  C:\Windows\System\yOFxrGl.exe
  2⤵
  PID:1652
- C:\Windows\System\GbxXjla.exe
  C:\Windows\System\GbxXjla.exe
  2⤵
  PID:1852
- C:\Windows\System\jEPCJkj.exe
  C:\Windows\System\jEPCJkj.exe
  2⤵
  PID:1136
- C:\Windows\System\CyaRTUL.exe
  C:\Windows\System\CyaRTUL.exe
  2⤵
  PID:2252
- C:\Windows\System\DeyWOXa.exe
  C:\Windows\System\DeyWOXa.exe
  2⤵
  PID:1504
- C:\Windows\System\iCknQqc.exe
  C:\Windows\System\iCknQqc.exe
  2⤵
  PID:1512
- C:\Windows\System\GJpokUy.exe
  C:\Windows\System\GJpokUy.exe
  2⤵
  PID:684
- C:\Windows\System\kqtyHJL.exe
  C:\Windows\System\kqtyHJL.exe
  2⤵
  PID:1716
- C:\Windows\System\pOXAMNe.exe
  C:\Windows\System\pOXAMNe.exe
  2⤵
  PID:884
- C:\Windows\System\SzHKVkx.exe
  C:\Windows\System\SzHKVkx.exe
  2⤵
  PID:1312
- C:\Windows\System\xAfompc.exe
  C:\Windows\System\xAfompc.exe
  2⤵
  PID:2168
- C:\Windows\System\LEERlEM.exe
  C:\Windows\System\LEERlEM.exe
  2⤵
  PID:2980
- C:\Windows\System\KOaaPAE.exe
  C:\Windows\System\KOaaPAE.exe
  2⤵
  PID:708
- C:\Windows\System\lZPxTOa.exe
  C:\Windows\System\lZPxTOa.exe
  2⤵
  PID:892
- C:\Windows\System\pILGmqL.exe
  C:\Windows\System\pILGmqL.exe
  2⤵
  PID:2300
- C:\Windows\System\fCiTLHd.exe
  C:\Windows\System\fCiTLHd.exe
  2⤵
  PID:2164
- C:\Windows\System\ZRglryL.exe
  C:\Windows\System\ZRglryL.exe
  2⤵
  PID:1684
- C:\Windows\System\mDRcqLG.exe
  C:\Windows\System\mDRcqLG.exe
  2⤵
  PID:2568
- C:\Windows\System\aiNdMMU.exe
  C:\Windows\System\aiNdMMU.exe
  2⤵
  PID:2732
- C:\Windows\System\YCsbQwZ.exe
  C:\Windows\System\YCsbQwZ.exe
  2⤵
  PID:2488
- C:\Windows\System\kbNuGTs.exe
  C:\Windows\System\kbNuGTs.exe
  2⤵
  PID:3320
- C:\Windows\System\efzlkcv.exe
  C:\Windows\System\efzlkcv.exe
  2⤵
  PID:3340
- C:\Windows\System\ynajayw.exe
  C:\Windows\System\ynajayw.exe
  2⤵
  PID:3356
- C:\Windows\System\hNYYOkN.exe
  C:\Windows\System\hNYYOkN.exe
  2⤵
  PID:3380
- C:\Windows\System\lnOAqlK.exe
  C:\Windows\System\lnOAqlK.exe
  2⤵
  PID:3400
- C:\Windows\System\qKLVakA.exe
  C:\Windows\System\qKLVakA.exe
  2⤵
  PID:3420
- C:\Windows\System\cxGqMwt.exe
  C:\Windows\System\cxGqMwt.exe
  2⤵
  PID:3440
- C:\Windows\System\mbPYsGR.exe
  C:\Windows\System\mbPYsGR.exe
  2⤵
  PID:3460
- C:\Windows\System\rgAlfuo.exe
  C:\Windows\System\rgAlfuo.exe
  2⤵
  PID:3476
- C:\Windows\System\lkEOjXF.exe
  C:\Windows\System\lkEOjXF.exe
  2⤵
  PID:3496
- C:\Windows\System\rxBIxbY.exe
  C:\Windows\System\rxBIxbY.exe
  2⤵
  PID:3516
- C:\Windows\System\NIcpnRT.exe
  C:\Windows\System\NIcpnRT.exe
  2⤵
  PID:3536
- C:\Windows\System\zkfQXnr.exe
  C:\Windows\System\zkfQXnr.exe
  2⤵
  PID:3564
- C:\Windows\System\WPmwCBm.exe
  C:\Windows\System\WPmwCBm.exe
  2⤵
  PID:3596
- C:\Windows\System\pdMQtGL.exe
  C:\Windows\System\pdMQtGL.exe
  2⤵
  PID:3616
- C:\Windows\System\KLdVRdP.exe
  C:\Windows\System\KLdVRdP.exe
  2⤵
  PID:3636
- C:\Windows\System\KBZQyEo.exe
  C:\Windows\System\KBZQyEo.exe
  2⤵
  PID:3656
- C:\Windows\System\JpEvtQV.exe
  C:\Windows\System\JpEvtQV.exe
  2⤵
  PID:3676
- C:\Windows\System\YQGeuww.exe
  C:\Windows\System\YQGeuww.exe
  2⤵
  PID:3696
- C:\Windows\System\nFTEnye.exe
  C:\Windows\System\nFTEnye.exe
  2⤵
  PID:3716
- C:\Windows\System\TzmOaqM.exe
  C:\Windows\System\TzmOaqM.exe
  2⤵
  PID:3736
- C:\Windows\System\qCeTLeH.exe
  C:\Windows\System\qCeTLeH.exe
  2⤵
  PID:3756
- C:\Windows\System\RiFztqK.exe
  C:\Windows\System\RiFztqK.exe
  2⤵
  PID:3772
- C:\Windows\System\fKjCnbn.exe
  C:\Windows\System\fKjCnbn.exe
  2⤵
  PID:3796
- C:\Windows\System\mVifGEK.exe
  C:\Windows\System\mVifGEK.exe
  2⤵
  PID:3816
- C:\Windows\System\XfjjMPK.exe
  C:\Windows\System\XfjjMPK.exe
  2⤵
  PID:3836
- C:\Windows\System\QXJDGPk.exe
  C:\Windows\System\QXJDGPk.exe
  2⤵
  PID:3856
- C:\Windows\System\xexDUog.exe
  C:\Windows\System\xexDUog.exe
  2⤵
  PID:3876
- C:\Windows\System\LAbQfuv.exe
  C:\Windows\System\LAbQfuv.exe
  2⤵
  PID:3892
- C:\Windows\System\WpZJfaF.exe
  C:\Windows\System\WpZJfaF.exe
  2⤵
  PID:3916
- C:\Windows\System\YbhDAjk.exe
  C:\Windows\System\YbhDAjk.exe
  2⤵
  PID:3936
- C:\Windows\System\ZEAmVXD.exe
  C:\Windows\System\ZEAmVXD.exe
  2⤵
  PID:3956
- C:\Windows\System\FjUpylm.exe
  C:\Windows\System\FjUpylm.exe
  2⤵
  PID:3976
- C:\Windows\System\lXeIysd.exe
  C:\Windows\System\lXeIysd.exe
  2⤵
  PID:3996
- C:\Windows\System\NOSDHPM.exe
  C:\Windows\System\NOSDHPM.exe
  2⤵
  PID:4016
- C:\Windows\System\syELjxC.exe
  C:\Windows\System\syELjxC.exe
  2⤵
  PID:4036
- C:\Windows\System\eHhjJyX.exe
  C:\Windows\System\eHhjJyX.exe
  2⤵
  PID:4056
- C:\Windows\System\CTkfJNQ.exe
  C:\Windows\System\CTkfJNQ.exe
  2⤵
  PID:4080
- C:\Windows\System\EqWpNex.exe
  C:\Windows\System\EqWpNex.exe
  2⤵
  PID:2760
- C:\Windows\System\hqOzHrz.exe
  C:\Windows\System\hqOzHrz.exe
  2⤵
  PID:1432
- C:\Windows\System\dWcxDuf.exe
  C:\Windows\System\dWcxDuf.exe
  2⤵
  PID:1248
- C:\Windows\System\rSttieT.exe
  C:\Windows\System\rSttieT.exe
  2⤵
  PID:372
- C:\Windows\System\bhsvsaH.exe
  C:\Windows\System\bhsvsaH.exe
  2⤵
  PID:3020
- C:\Windows\System\iMkAmPQ.exe
  C:\Windows\System\iMkAmPQ.exe
  2⤵
  PID:1516
- C:\Windows\System\vSRcmcl.exe
  C:\Windows\System\vSRcmcl.exe
  2⤵
  PID:832
- C:\Windows\System\kDiETMx.exe
  C:\Windows\System\kDiETMx.exe
  2⤵
  PID:2292
- C:\Windows\System\jRzcwmf.exe
  C:\Windows\System\jRzcwmf.exe
  2⤵
  PID:2948
- C:\Windows\System\nVCZQNx.exe
  C:\Windows\System\nVCZQNx.exe
  2⤵
  PID:2720
- C:\Windows\System\uFlMqgn.exe
  C:\Windows\System\uFlMqgn.exe
  2⤵
  PID:3068
- C:\Windows\System\UbFuKFV.exe
  C:\Windows\System\UbFuKFV.exe
  2⤵
  PID:2968
- C:\Windows\System\HVvjJpm.exe
  C:\Windows\System\HVvjJpm.exe
  2⤵
  PID:376
- C:\Windows\System\xLklJBc.exe
  C:\Windows\System\xLklJBc.exe
  2⤵
  PID:2080
- C:\Windows\System\IWurrQO.exe
  C:\Windows\System\IWurrQO.exe
  2⤵
  PID:2400
- C:\Windows\System\CSSYpUL.exe
  C:\Windows\System\CSSYpUL.exe
  2⤵
  PID:3084
- C:\Windows\System\vVdcWwA.exe
  C:\Windows\System\vVdcWwA.exe
  2⤵
  PID:3104
- C:\Windows\System\LwAyiTE.exe
  C:\Windows\System\LwAyiTE.exe
  2⤵
  PID:3124
- C:\Windows\System\aifzLET.exe
  C:\Windows\System\aifzLET.exe
  2⤵
  PID:3144
- C:\Windows\System\jxNOLQK.exe
  C:\Windows\System\jxNOLQK.exe
  2⤵
  PID:3164
- C:\Windows\System\oDJocXn.exe
  C:\Windows\System\oDJocXn.exe
  2⤵
  PID:3184
- C:\Windows\System\QweFThS.exe
  C:\Windows\System\QweFThS.exe
  2⤵
  PID:3204
- C:\Windows\System\VvIqGJA.exe
  C:\Windows\System\VvIqGJA.exe
  2⤵
  PID:3224
- C:\Windows\System\UdrdSCX.exe
  C:\Windows\System\UdrdSCX.exe
  2⤵
  PID:3244
- C:\Windows\System\SJXmhzO.exe
  C:\Windows\System\SJXmhzO.exe
  2⤵
  PID:3264
- C:\Windows\System\ZBVnOXd.exe
  C:\Windows\System\ZBVnOXd.exe
  2⤵
  PID:3332
- C:\Windows\System\vdbjhZL.exe
  C:\Windows\System\vdbjhZL.exe
  2⤵
  PID:3300
- C:\Windows\System\pVRNTNc.exe
  C:\Windows\System\pVRNTNc.exe
  2⤵
  PID:3312
- C:\Windows\System\wcLjlKy.exe
  C:\Windows\System\wcLjlKy.exe
  2⤵
  PID:3368
- C:\Windows\System\rwBsJRI.exe
  C:\Windows\System\rwBsJRI.exe
  2⤵
  PID:3588
- C:\Windows\System\crCymzA.exe
  C:\Windows\System\crCymzA.exe
  2⤵
  PID:3448
- C:\Windows\System\PLUxTsU.exe
  C:\Windows\System\PLUxTsU.exe
  2⤵
  PID:3488
- C:\Windows\System\mkKcJza.exe
  C:\Windows\System\mkKcJza.exe
  2⤵
  PID:3428
- C:\Windows\System\FWgYZzh.exe
  C:\Windows\System\FWgYZzh.exe
  2⤵
  PID:2160
- C:\Windows\System\FnldRHf.exe
  C:\Windows\System\FnldRHf.exe
  2⤵
  PID:3508
- C:\Windows\System\MimMZZR.exe
  C:\Windows\System\MimMZZR.exe
  2⤵
  PID:2368
- C:\Windows\System\ebcFfWP.exe
  C:\Windows\System\ebcFfWP.exe
  2⤵
  PID:3604
- C:\Windows\System\VvIMEva.exe
  C:\Windows\System\VvIMEva.exe
  2⤵
  PID:3032
- C:\Windows\System\dKOqcKq.exe
  C:\Windows\System\dKOqcKq.exe
  2⤵
  PID:3664
- C:\Windows\System\tHHVYNq.exe
  C:\Windows\System\tHHVYNq.exe
  2⤵
  PID:2536
- C:\Windows\System\AgtJVPi.exe
  C:\Windows\System\AgtJVPi.exe
  2⤵
  PID:3692
- C:\Windows\System\CkluBwr.exe
  C:\Windows\System\CkluBwr.exe
  2⤵
  PID:3752
- C:\Windows\System\tvTRrII.exe
  C:\Windows\System\tvTRrII.exe
  2⤵
  PID:3784
- C:\Windows\System\vNLJAbb.exe
  C:\Windows\System\vNLJAbb.exe
  2⤵
  PID:3828
- C:\Windows\System\VbjVMVk.exe
  C:\Windows\System\VbjVMVk.exe
  2⤵
  PID:3808
- C:\Windows\System\vYklGRV.exe
  C:\Windows\System\vYklGRV.exe
  2⤵
  PID:3872
- C:\Windows\System\QbayYsm.exe
  C:\Windows\System\QbayYsm.exe
  2⤵
  PID:3908
- C:\Windows\System\eIrTvdg.exe
  C:\Windows\System\eIrTvdg.exe
  2⤵
  PID:3948
- C:\Windows\System\pfjcAfj.exe
  C:\Windows\System\pfjcAfj.exe
  2⤵
  PID:3984
- C:\Windows\System\DSHOyim.exe
  C:\Windows\System\DSHOyim.exe
  2⤵
  PID:3968
- C:\Windows\System\zibgNdO.exe
  C:\Windows\System\zibgNdO.exe
  2⤵
  PID:4028
- C:\Windows\System\jouJHvw.exe
  C:\Windows\System\jouJHvw.exe
  2⤵
  PID:4064
- C:\Windows\System\STEeDCC.exe
  C:\Windows\System\STEeDCC.exe
  2⤵
  PID:4044
- C:\Windows\System\HQUtzAO.exe
  C:\Windows\System\HQUtzAO.exe
  2⤵
  PID:4088
- C:\Windows\System\wKCcnRU.exe
  C:\Windows\System\wKCcnRU.exe
  2⤵
  PID:2744
- C:\Windows\System\auDISmT.exe
  C:\Windows\System\auDISmT.exe
  2⤵
  PID:732
- C:\Windows\System\gAFmBNS.exe
  C:\Windows\System\gAFmBNS.exe
  2⤵
  PID:2336
- C:\Windows\System\pkqcyot.exe
  C:\Windows\System\pkqcyot.exe
  2⤵
  PID:2096
- C:\Windows\System\oKEgNLI.exe
  C:\Windows\System\oKEgNLI.exe
  2⤵
  PID:3336
- C:\Windows\System\YRMfrOu.exe
  C:\Windows\System\YRMfrOu.exe
  2⤵
  PID:1560
- C:\Windows\System\weZqwTT.exe
  C:\Windows\System\weZqwTT.exe
  2⤵
  PID:1464
- C:\Windows\System\dHKmPNE.exe
  C:\Windows\System\dHKmPNE.exe
  2⤵
  PID:2740
- C:\Windows\System\HLWeEOT.exe
  C:\Windows\System\HLWeEOT.exe
  2⤵
  PID:3076
- C:\Windows\System\uizeOVb.exe
  C:\Windows\System\uizeOVb.exe
  2⤵
  PID:3116
- C:\Windows\System\jlFLACH.exe
  C:\Windows\System\jlFLACH.exe
  2⤵
  PID:3152
- C:\Windows\System\goFfZTT.exe
  C:\Windows\System\goFfZTT.exe
  2⤵
  PID:2608
- C:\Windows\System\wBYZjcj.exe
  C:\Windows\System\wBYZjcj.exe
  2⤵
  PID:3192
- C:\Windows\System\JwnKjeg.exe
  C:\Windows\System\JwnKjeg.exe
  2⤵
  PID:3196
- C:\Windows\System\EcFWpLz.exe
  C:\Windows\System\EcFWpLz.exe
  2⤵
  PID:3100
- C:\Windows\System\jbUMFmU.exe
  C:\Windows\System\jbUMFmU.exe
  2⤵
  PID:3280
- C:\Windows\System\aAKJsro.exe
  C:\Windows\System\aAKJsro.exe
  2⤵
  PID:3132
- C:\Windows\System\RsnOkNa.exe
  C:\Windows\System\RsnOkNa.exe
  2⤵
  PID:3172
- C:\Windows\System\KGGEEqN.exe
  C:\Windows\System\KGGEEqN.exe
  2⤵
  PID:1692
- C:\Windows\System\tLbAAuf.exe
  C:\Windows\System\tLbAAuf.exe
  2⤵
  PID:1272
- C:\Windows\System\jpBXEMy.exe
  C:\Windows\System\jpBXEMy.exe
  2⤵
  PID:1672
- C:\Windows\System\KzqsCnH.exe
  C:\Windows\System\KzqsCnH.exe
  2⤵
  PID:3416
- C:\Windows\System\OvGlNqt.exe
  C:\Windows\System\OvGlNqt.exe
  2⤵
  PID:2724
- C:\Windows\System\MYCgInG.exe
  C:\Windows\System\MYCgInG.exe
  2⤵
  PID:3396
- C:\Windows\System\AsrVJYK.exe
  C:\Windows\System\AsrVJYK.exe
  2⤵
  PID:3504
- C:\Windows\System\BOFPVSC.exe
  C:\Windows\System\BOFPVSC.exe
  2⤵
  PID:3532
- C:\Windows\System\YjvWriV.exe
  C:\Windows\System\YjvWriV.exe
  2⤵
  PID:2448
- C:\Windows\System\fPDLmzT.exe
  C:\Windows\System\fPDLmzT.exe
  2⤵
  PID:1320
- C:\Windows\System\tLUIgKg.exe
  C:\Windows\System\tLUIgKg.exe
  2⤵
  PID:2556
- C:\Windows\System\YPlGFyJ.exe
  C:\Windows\System\YPlGFyJ.exe
  2⤵
  PID:2264
- C:\Windows\System\kYNxMIs.exe
  C:\Windows\System\kYNxMIs.exe
  2⤵
  PID:2512
- C:\Windows\System\vWYswOF.exe
  C:\Windows\System\vWYswOF.exe
  2⤵
  PID:2688
- C:\Windows\System\fstyUAN.exe
  C:\Windows\System\fstyUAN.exe
  2⤵
  PID:340
- C:\Windows\System\omYAbrl.exe
  C:\Windows\System\omYAbrl.exe
  2⤵
  PID:2600
- C:\Windows\System\dAAQWrv.exe
  C:\Windows\System\dAAQWrv.exe
  2⤵
  PID:3712
- C:\Windows\System\baECeiZ.exe
  C:\Windows\System\baECeiZ.exe
  2⤵
  PID:3724
- C:\Windows\System\mvsIzOp.exe
  C:\Windows\System\mvsIzOp.exe
  2⤵
  PID:380
- C:\Windows\System\hWWTdzE.exe
  C:\Windows\System\hWWTdzE.exe
  2⤵
  PID:1596
- C:\Windows\System\wzcyjeF.exe
  C:\Windows\System\wzcyjeF.exe
  2⤵
  PID:316
- C:\Windows\System\XPpGyMt.exe
  C:\Windows\System\XPpGyMt.exe
  2⤵
  PID:3060
- C:\Windows\System\TUBrgIq.exe
  C:\Windows\System\TUBrgIq.exe
  2⤵
  PID:2212
- C:\Windows\System\edJecHB.exe
  C:\Windows\System\edJecHB.exe
  2⤵
  PID:2656
- C:\Windows\System\DetreIZ.exe
  C:\Windows\System\DetreIZ.exe
  2⤵
  PID:1648
- C:\Windows\System\dTHTYnR.exe
  C:\Windows\System\dTHTYnR.exe
  2⤵
  PID:3728
- C:\Windows\System\JbYKUHj.exe
  C:\Windows\System\JbYKUHj.exe
  2⤵
  PID:3788
- C:\Windows\System\IVpKRrB.exe
  C:\Windows\System\IVpKRrB.exe
  2⤵
  PID:3804
- C:\Windows\System\CcuiLFd.exe
  C:\Windows\System\CcuiLFd.exe
  2⤵
  PID:3852
- C:\Windows\System\wSkcloK.exe
  C:\Windows\System\wSkcloK.exe
  2⤵
  PID:3912
- C:\Windows\System\AbFjzMu.exe
  C:\Windows\System\AbFjzMu.exe
  2⤵
  PID:3944
- C:\Windows\System\kUbXPMf.exe
  C:\Windows\System\kUbXPMf.exe
  2⤵
  PID:1808
- C:\Windows\System\NTCvCCH.exe
  C:\Windows\System\NTCvCCH.exe
  2⤵
  PID:4012
- C:\Windows\System\SKMLkPL.exe
  C:\Windows\System\SKMLkPL.exe
  2⤵
  PID:2208
- C:\Windows\System\lIYGlri.exe
  C:\Windows\System\lIYGlri.exe
  2⤵
  PID:3112
- C:\Windows\System\yMsilWQ.exe
  C:\Windows\System\yMsilWQ.exe
  2⤵
  PID:1736
- C:\Windows\System\MtNbNKb.exe
  C:\Windows\System\MtNbNKb.exe
  2⤵
  PID:3952
- C:\Windows\System\qfYHhjC.exe
  C:\Windows\System\qfYHhjC.exe
  2⤵
  PID:3140
- C:\Windows\System\qKQutxb.exe
  C:\Windows\System\qKQutxb.exe
  2⤵
  PID:3352
- C:\Windows\System\odkhcSS.exe
  C:\Windows\System\odkhcSS.exe
  2⤵
  PID:3288
- C:\Windows\System\PUVHbSV.exe
  C:\Windows\System\PUVHbSV.exe
  2⤵
  PID:3492
- C:\Windows\System\EnYLXux.exe
  C:\Windows\System\EnYLXux.exe
  2⤵
  PID:3436
- C:\Windows\System\DuHfgUk.exe
  C:\Windows\System\DuHfgUk.exe
  2⤵
  PID:3120
- C:\Windows\System\PHLvozV.exe
  C:\Windows\System\PHLvozV.exe
  2⤵
  PID:3236
- C:\Windows\System\QldJKdc.exe
  C:\Windows\System\QldJKdc.exe
  2⤵
  PID:3560
- C:\Windows\System\XybJGqe.exe
  C:\Windows\System\XybJGqe.exe
  2⤵
  PID:3552
- C:\Windows\System\uVWwStk.exe
  C:\Windows\System\uVWwStk.exe
  2⤵
  PID:3064
- C:\Windows\System\YQcbpge.exe
  C:\Windows\System\YQcbpge.exe
  2⤵
  PID:812
- C:\Windows\System\mNzizxh.exe
  C:\Windows\System\mNzizxh.exe
  2⤵
  PID:2100
- C:\Windows\System\dyegddn.exe
  C:\Windows\System\dyegddn.exe
  2⤵
  PID:2684
- C:\Windows\System\dCfrkiU.exe
  C:\Windows\System\dCfrkiU.exe
  2⤵
  PID:2288
- C:\Windows\System\IszNiEK.exe
  C:\Windows\System\IszNiEK.exe
  2⤵
  PID:3648
- C:\Windows\System\bkJRWPt.exe
  C:\Windows\System\bkJRWPt.exe
  2⤵
  PID:2004
- C:\Windows\System\IotrEHk.exe
  C:\Windows\System\IotrEHk.exe
  2⤵
  PID:1664
- C:\Windows\System\xBqNaqf.exe
  C:\Windows\System\xBqNaqf.exe
  2⤵
  PID:3748
- C:\Windows\System\lWCOYmT.exe
  C:\Windows\System\lWCOYmT.exe
  2⤵
  PID:1232
- C:\Windows\System\hXsDfUX.exe
  C:\Windows\System\hXsDfUX.exe
  2⤵
  PID:3844
- C:\Windows\System\EMLWeET.exe
  C:\Windows\System\EMLWeET.exe
  2⤵
  PID:2352
- C:\Windows\System\SNAHNIU.exe
  C:\Windows\System\SNAHNIU.exe
  2⤵
  PID:1264
- C:\Windows\System\rxXxHCq.exe
  C:\Windows\System\rxXxHCq.exe
  2⤵
  PID:1556
- C:\Windows\System\vWXRhUD.exe
  C:\Windows\System\vWXRhUD.exe
  2⤵
  PID:1308
- C:\Windows\System\zSjpQwV.exe
  C:\Windows\System\zSjpQwV.exe
  2⤵
  PID:1992
- C:\Windows\System\YYkOJNk.exe
  C:\Windows\System\YYkOJNk.exe
  2⤵
  PID:2500
- C:\Windows\System\xcHIlZR.exe
  C:\Windows\System\xcHIlZR.exe
  2⤵
  PID:4024
- C:\Windows\System\zcMlVgZ.exe
  C:\Windows\System\zcMlVgZ.exe
  2⤵
  PID:2960
- C:\Windows\System\IOWLKjx.exe
  C:\Windows\System\IOWLKjx.exe
  2⤵
  PID:3212
- C:\Windows\System\LhPbCyf.exe
  C:\Windows\System\LhPbCyf.exe
  2⤵
  PID:3292
- C:\Windows\System\Kxixden.exe
  C:\Windows\System\Kxixden.exe
  2⤵
  PID:3452
- C:\Windows\System\sErKQvU.exe
  C:\Windows\System\sErKQvU.exe
  2⤵
  PID:3092
- C:\Windows\System\uBhNIsy.exe
  C:\Windows\System\uBhNIsy.exe
  2⤵
  PID:3592
- C:\Windows\System\YkyplAZ.exe
  C:\Windows\System\YkyplAZ.exe
  2⤵
  PID:3048
- C:\Windows\System\CykjqSb.exe
  C:\Windows\System\CykjqSb.exe
  2⤵
  PID:1292
- C:\Windows\System\oENRFCc.exe
  C:\Windows\System\oENRFCc.exe
  2⤵
  PID:3672
- C:\Windows\System\wrveBGS.exe
  C:\Windows\System\wrveBGS.exe
  2⤵
  PID:1784
- C:\Windows\System\qAhnVme.exe
  C:\Windows\System\qAhnVme.exe
  2⤵
  PID:3764
- C:\Windows\System\HTLltkQ.exe
  C:\Windows\System\HTLltkQ.exe
  2⤵
  PID:1724
- C:\Windows\System\hHPVSxA.exe
  C:\Windows\System\hHPVSxA.exe
  2⤵
  PID:3964
- C:\Windows\System\tlLQVlR.exe
  C:\Windows\System\tlLQVlR.exe
  2⤵
  PID:4008
- C:\Windows\System\NakCJnd.exe
  C:\Windows\System\NakCJnd.exe
  2⤵
  PID:3780
- C:\Windows\System\gHBoEqV.exe
  C:\Windows\System\gHBoEqV.exe
  2⤵
  PID:2584
- C:\Windows\System\XMcesCN.exe
  C:\Windows\System\XMcesCN.exe
  2⤵
  PID:2196
- C:\Windows\System\KVQlhyV.exe
  C:\Windows\System\KVQlhyV.exe
  2⤵
  PID:3096
- C:\Windows\System\WRICPQI.exe
  C:\Windows\System\WRICPQI.exe
  2⤵
  PID:1704
- C:\Windows\System\xMEFOdg.exe
  C:\Windows\System\xMEFOdg.exe
  2⤵
  PID:3216
- C:\Windows\System\TsUcTaf.exe
  C:\Windows\System\TsUcTaf.exe
  2⤵
  PID:1868
- C:\Windows\System\mehBmFE.exe
  C:\Windows\System\mehBmFE.exe
  2⤵
  PID:3888
- C:\Windows\System\YPBEtiH.exe
  C:\Windows\System\YPBEtiH.exe
  2⤵
  PID:2476
- C:\Windows\System\sWVNiHp.exe
  C:\Windows\System\sWVNiHp.exe
  2⤵
  PID:1468
- C:\Windows\System\GFMTLDt.exe
  C:\Windows\System\GFMTLDt.exe
  2⤵
  PID:2924
- C:\Windows\System\RCTuXch.exe
  C:\Windows\System\RCTuXch.exe
  2⤵
  PID:2188
- C:\Windows\System\AvowIsl.exe
  C:\Windows\System\AvowIsl.exe
  2⤵
  PID:3684
- C:\Windows\System\JLCzsJY.exe
  C:\Windows\System\JLCzsJY.exe
  2⤵
  PID:3864
- C:\Windows\System\XSJyLwL.exe
  C:\Windows\System\XSJyLwL.exe
  2⤵
  PID:3276
- C:\Windows\System\VanqeaI.exe
  C:\Windows\System\VanqeaI.exe
  2⤵
  PID:1192
- C:\Windows\System\zuXbJOR.exe
  C:\Windows\System\zuXbJOR.exe
  2⤵
  PID:1540
- C:\Windows\System\FoDibpD.exe
  C:\Windows\System\FoDibpD.exe
  2⤵
  PID:2140
- C:\Windows\System\CHSaHsZ.exe
  C:\Windows\System\CHSaHsZ.exe
  2⤵
  PID:2848
- C:\Windows\System\nvvPdSC.exe
  C:\Windows\System\nvvPdSC.exe
  2⤵
  PID:4108
- C:\Windows\System\tCwVrcR.exe
  C:\Windows\System\tCwVrcR.exe
  2⤵
  PID:4128
- C:\Windows\System\JZyPuVx.exe
  C:\Windows\System\JZyPuVx.exe
  2⤵
  PID:4144
- C:\Windows\System\jElkBTy.exe
  C:\Windows\System\jElkBTy.exe
  2⤵
  PID:4160
- C:\Windows\System\YuoihCp.exe
  C:\Windows\System\YuoihCp.exe
  2⤵
  PID:4176
- C:\Windows\System\lvDcFXp.exe
  C:\Windows\System\lvDcFXp.exe
  2⤵
  PID:4192
- C:\Windows\System\cvcjFxG.exe
  C:\Windows\System\cvcjFxG.exe
  2⤵
  PID:4208
- C:\Windows\System\IOXGHyN.exe
  C:\Windows\System\IOXGHyN.exe
  2⤵
  PID:4224
- C:\Windows\System\hzTWrJs.exe
  C:\Windows\System\hzTWrJs.exe
  2⤵
  PID:4240
- C:\Windows\System\KjEaIpv.exe
  C:\Windows\System\KjEaIpv.exe
  2⤵
  PID:4256
- C:\Windows\System\QcNnoTW.exe
  C:\Windows\System\QcNnoTW.exe
  2⤵
  PID:4272
- C:\Windows\System\PNzWIgK.exe
  C:\Windows\System\PNzWIgK.exe
  2⤵
  PID:4288
- C:\Windows\System\CRZJiGL.exe
  C:\Windows\System\CRZJiGL.exe
  2⤵
  PID:4304
- C:\Windows\System\QTQTIcI.exe
  C:\Windows\System\QTQTIcI.exe
  2⤵
  PID:4324
- C:\Windows\System\QJJUNwr.exe
  C:\Windows\System\QJJUNwr.exe
  2⤵
  PID:4340
- C:\Windows\System\rLCMtfC.exe
  C:\Windows\System\rLCMtfC.exe
  2⤵
  PID:4356
- C:\Windows\System\iCPgzvs.exe
  C:\Windows\System\iCPgzvs.exe
  2⤵
  PID:4372
- C:\Windows\System\FqFEfAa.exe
  C:\Windows\System\FqFEfAa.exe
  2⤵
  PID:4388
- C:\Windows\System\NKQugGF.exe
  C:\Windows\System\NKQugGF.exe
  2⤵
  PID:4404
- C:\Windows\System\YYoKMXX.exe
  C:\Windows\System\YYoKMXX.exe
  2⤵
  PID:4420
- C:\Windows\System\ahvAFPt.exe
  C:\Windows\System\ahvAFPt.exe
  2⤵
  PID:4436
- C:\Windows\System\waSfmpq.exe
  C:\Windows\System\waSfmpq.exe
  2⤵
  PID:4452
- C:\Windows\System\SCYHTqe.exe
  C:\Windows\System\SCYHTqe.exe
  2⤵
  PID:4468
- C:\Windows\System\uyfILxs.exe
  C:\Windows\System\uyfILxs.exe
  2⤵
  PID:4484
- C:\Windows\System\QuCQWof.exe
  C:\Windows\System\QuCQWof.exe
  2⤵
  PID:4500
- C:\Windows\System\iNbuXzX.exe
  C:\Windows\System\iNbuXzX.exe
  2⤵
  PID:4516
- C:\Windows\System\KfVjBmH.exe
  C:\Windows\System\KfVjBmH.exe
  2⤵
  PID:4532
- C:\Windows\System\apHOsFv.exe
  C:\Windows\System\apHOsFv.exe
  2⤵
  PID:4548
- C:\Windows\System\eJbngrE.exe
  C:\Windows\System\eJbngrE.exe
  2⤵
  PID:4564
- C:\Windows\System\IGhqwAy.exe
  C:\Windows\System\IGhqwAy.exe
  2⤵
  PID:4580
- C:\Windows\System\nlrkrPt.exe
  C:\Windows\System\nlrkrPt.exe
  2⤵
  PID:4596
- C:\Windows\System\SdDiexi.exe
  C:\Windows\System\SdDiexi.exe
  2⤵
  PID:4612
- C:\Windows\System\LAbIuZu.exe
  C:\Windows\System\LAbIuZu.exe
  2⤵
  PID:4628
- C:\Windows\System\eNOMZWh.exe
  C:\Windows\System\eNOMZWh.exe
  2⤵
  PID:4644
- C:\Windows\System\pVLdzNA.exe
  C:\Windows\System\pVLdzNA.exe
  2⤵
  PID:4660
- C:\Windows\System\PmurxYj.exe
  C:\Windows\System\PmurxYj.exe
  2⤵
  PID:4676
- C:\Windows\System\DiLPUqQ.exe
  C:\Windows\System\DiLPUqQ.exe
  2⤵
  PID:4692
- C:\Windows\System\pqOBofh.exe
  C:\Windows\System\pqOBofh.exe
  2⤵
  PID:4708
- C:\Windows\System\OluNgse.exe
  C:\Windows\System\OluNgse.exe
  2⤵
  PID:4728
- C:\Windows\System\GyPFXMp.exe
  C:\Windows\System\GyPFXMp.exe
  2⤵
  PID:4748
- C:\Windows\System\yqMdyOk.exe
  C:\Windows\System\yqMdyOk.exe
  2⤵
  PID:4764
- C:\Windows\System\akRYbwG.exe
  C:\Windows\System\akRYbwG.exe
  2⤵
  PID:4780
- C:\Windows\System\ytCrMmL.exe
  C:\Windows\System\ytCrMmL.exe
  2⤵
  PID:4796
- C:\Windows\System\iQeYzSb.exe
  C:\Windows\System\iQeYzSb.exe
  2⤵
  PID:4812
- C:\Windows\System\NrNdrOH.exe
  C:\Windows\System\NrNdrOH.exe
  2⤵
  PID:4828
- C:\Windows\System\DvtIwXZ.exe
  C:\Windows\System\DvtIwXZ.exe
  2⤵
  PID:4844
- C:\Windows\System\uteOuXT.exe
  C:\Windows\System\uteOuXT.exe
  2⤵
  PID:4884
- C:\Windows\System\DPcCaLg.exe
  C:\Windows\System\DPcCaLg.exe
  2⤵
  PID:4900
- C:\Windows\System\uqKySVw.exe
  C:\Windows\System\uqKySVw.exe
  2⤵
  PID:5024
- C:\Windows\System\irhuLBA.exe
  C:\Windows\System\irhuLBA.exe
  2⤵
  PID:5040
- C:\Windows\System\WFbahrH.exe
  C:\Windows\System\WFbahrH.exe
  2⤵
  PID:4104
- C:\Windows\System\YTpFual.exe
  C:\Windows\System\YTpFual.exe
  2⤵
  PID:4368
- C:\Windows\System\rNpJsMk.exe
  C:\Windows\System\rNpJsMk.exe
  2⤵
  PID:4428
- C:\Windows\System\ltSslkA.exe
  C:\Windows\System\ltSslkA.exe
  2⤵
  PID:4464
- C:\Windows\System\JEZghKC.exe
  C:\Windows\System\JEZghKC.exe
  2⤵
  PID:4412
- C:\Windows\System\IvmYSNX.exe
  C:\Windows\System\IvmYSNX.exe
  2⤵
  PID:4528
- C:\Windows\System\aXFDwxM.exe
  C:\Windows\System\aXFDwxM.exe
  2⤵
  PID:4588
- C:\Windows\System\ijnwYEN.exe
  C:\Windows\System\ijnwYEN.exe
  2⤵
  PID:4604
- C:\Windows\System\aWJbiAC.exe
  C:\Windows\System\aWJbiAC.exe
  2⤵
  PID:4652
- C:\Windows\System\QrBtwDE.exe
  C:\Windows\System\QrBtwDE.exe
  2⤵
  PID:4608
- C:\Windows\System\xFmwNjL.exe
  C:\Windows\System\xFmwNjL.exe
  2⤵
  PID:4668
- C:\Windows\System\HLuSSVg.exe
  C:\Windows\System\HLuSSVg.exe
  2⤵
  PID:4736
- C:\Windows\System\wBLGTkM.exe
  C:\Windows\System\wBLGTkM.exe
  2⤵
  PID:4788
- C:\Windows\System\lCGesDG.exe
  C:\Windows\System\lCGesDG.exe
  2⤵
  PID:4824
- C:\Windows\System\FxhiliV.exe
  C:\Windows\System\FxhiliV.exe
  2⤵
  PID:4836
- C:\Windows\System\jcYlvMq.exe
  C:\Windows\System\jcYlvMq.exe
  2⤵
  PID:4896
- C:\Windows\System\GFuKsAh.exe
  C:\Windows\System\GFuKsAh.exe
  2⤵
  PID:4920
- C:\Windows\System\mOaMftY.exe
  C:\Windows\System\mOaMftY.exe
  2⤵
  PID:4960
- C:\Windows\System\gGUCegi.exe
  C:\Windows\System\gGUCegi.exe
  2⤵
  PID:4948
- C:\Windows\System\oftNftO.exe
  C:\Windows\System\oftNftO.exe
  2⤵
  PID:4976
- C:\Windows\System\XRwnjzz.exe
  C:\Windows\System\XRwnjzz.exe
  2⤵
  PID:5000
- C:\Windows\System\YIwTgZD.exe
  C:\Windows\System\YIwTgZD.exe
  2⤵
  PID:1636
- C:\Windows\System\PMrMWNS.exe
  C:\Windows\System\PMrMWNS.exe
  2⤵
  PID:5076
- C:\Windows\System\PYEfUEY.exe
  C:\Windows\System\PYEfUEY.exe
  2⤵
  PID:5088
- C:\Windows\System\tzBbucD.exe
  C:\Windows\System\tzBbucD.exe
  2⤵
  PID:5104
- C:\Windows\System\KbDDEPX.exe
  C:\Windows\System\KbDDEPX.exe
  2⤵
  PID:1728
- C:\Windows\System\wnHPeoi.exe
  C:\Windows\System\wnHPeoi.exe
  2⤵
  PID:5036
- C:\Windows\System\PmUtggM.exe
  C:\Windows\System\PmUtggM.exe
  2⤵
  PID:2632
- C:\Windows\System\kbdOpPJ.exe
  C:\Windows\System\kbdOpPJ.exe
  2⤵
  PID:4200
- C:\Windows\System\TAYGYfE.exe
  C:\Windows\System\TAYGYfE.exe
  2⤵
  PID:4232
- C:\Windows\System\gwyfYAp.exe
  C:\Windows\System\gwyfYAp.exe
  2⤵
  PID:4184
- C:\Windows\System\Imfigvy.exe
  C:\Windows\System\Imfigvy.exe
  2⤵
  PID:4300
- C:\Windows\System\aRWjckJ.exe
  C:\Windows\System\aRWjckJ.exe
  2⤵
  PID:4116
- C:\Windows\System\EKYvkbk.exe
  C:\Windows\System\EKYvkbk.exe
  2⤵
  PID:4364
- C:\Windows\System\XewrTho.exe
  C:\Windows\System\XewrTho.exe
  2⤵
  PID:4348
- C:\Windows\System\TthFJhR.exe
  C:\Windows\System\TthFJhR.exe
  2⤵
  PID:4188
- C:\Windows\System\GyepycZ.exe
  C:\Windows\System\GyepycZ.exe
  2⤵
  PID:4352
- C:\Windows\System\FlpGgnL.exe
  C:\Windows\System\FlpGgnL.exe
  2⤵
  PID:4480
- C:\Windows\System\dmDxkJy.exe
  C:\Windows\System\dmDxkJy.exe
  2⤵
  PID:4524
- C:\Windows\System\JNamFQn.exe
  C:\Windows\System\JNamFQn.exe
  2⤵
  PID:4572
- C:\Windows\System\qglBmKH.exe
  C:\Windows\System\qglBmKH.exe
  2⤵
  PID:4684
- C:\Windows\System\NrQqdWy.exe
  C:\Windows\System\NrQqdWy.exe
  2⤵
  PID:4640
- C:\Windows\System\fFRmVdg.exe
  C:\Windows\System\fFRmVdg.exe
  2⤵
  PID:4772
- C:\Windows\System\MmvAmKJ.exe
  C:\Windows\System\MmvAmKJ.exe
  2⤵
  PID:4704
- C:\Windows\System\cpPxaPr.exe
  C:\Windows\System\cpPxaPr.exe
  2⤵
  PID:4880
- C:\Windows\System\pvoxUvJ.exe
  C:\Windows\System\pvoxUvJ.exe
  2⤵
  PID:4916
- C:\Windows\System\fzRRqyb.exe
  C:\Windows\System\fzRRqyb.exe
  2⤵
  PID:4972
- C:\Windows\System\QJInsYZ.exe
  C:\Windows\System\QJInsYZ.exe
  2⤵
  PID:4992
- C:\Windows\System\qcOYzYQ.exe
  C:\Windows\System\qcOYzYQ.exe
  2⤵
  PID:4968
- C:\Windows\System\rbajNdO.exe
  C:\Windows\System\rbajNdO.exe
  2⤵
  PID:5068
- C:\Windows\System\SUwyBPn.exe
  C:\Windows\System\SUwyBPn.exe
  2⤵
  PID:4100
- C:\Windows\System\eCMAmzb.exe
  C:\Windows\System\eCMAmzb.exe
  2⤵
  PID:3232
- C:\Windows\System\IdznKVO.exe
  C:\Windows\System\IdznKVO.exe
  2⤵
  PID:5084
- C:\Windows\System\bUQeKMf.exe
  C:\Windows\System\bUQeKMf.exe
  2⤵
  PID:4120
- C:\Windows\System\sfMjOSW.exe
  C:\Windows\System\sfMjOSW.exe
  2⤵
  PID:4400
- C:\Windows\System\FVthSsg.exe
  C:\Windows\System\FVthSsg.exe
  2⤵
  PID:4236
- C:\Windows\System\axeweQl.exe
  C:\Windows\System\axeweQl.exe
  2⤵
  PID:4220
- C:\Windows\System\TTyibrS.exe
  C:\Windows\System\TTyibrS.exe
  2⤵
  PID:4460
- C:\Windows\System\YaLzKCr.exe
  C:\Windows\System\YaLzKCr.exe
  2⤵
  PID:4576
- C:\Windows\System\vNvuhTk.exe
  C:\Windows\System\vNvuhTk.exe
  2⤵
  PID:4808
- C:\Windows\System\yLnYdDe.exe
  C:\Windows\System\yLnYdDe.exe
  2⤵
  PID:4936
- C:\Windows\System\evYgham.exe
  C:\Windows\System\evYgham.exe
  2⤵
  PID:4956
- C:\Windows\System\qpGTKFz.exe
  C:\Windows\System\qpGTKFz.exe
  2⤵
  PID:5048
- C:\Windows\System\YZpCXjP.exe
  C:\Windows\System\YZpCXjP.exe
  2⤵
  PID:4380
- C:\Windows\System\QUIiTVW.exe
  C:\Windows\System\QUIiTVW.exe
  2⤵
  PID:4592
- C:\Windows\System\ZoIVvfW.exe
  C:\Windows\System\ZoIVvfW.exe
  2⤵
  PID:4152
- C:\Windows\System\nVleaeR.exe
  C:\Windows\System\nVleaeR.exe
  2⤵
  PID:2372
- C:\Windows\System\qpKeziB.exe
  C:\Windows\System\qpKeziB.exe
  2⤵
  PID:4512
- C:\Windows\System\UahlxrA.exe
  C:\Windows\System\UahlxrA.exe
  2⤵
  PID:4172
- C:\Windows\System\ZWsfNoH.exe
  C:\Windows\System\ZWsfNoH.exe
  2⤵
  PID:4964
- C:\Windows\System\nPxQPdP.exe
  C:\Windows\System\nPxQPdP.exe
  2⤵
  PID:5124
- C:\Windows\System\aDpARqm.exe
  C:\Windows\System\aDpARqm.exe
  2⤵
  PID:5140
- C:\Windows\System\swhWTWV.exe
  C:\Windows\System\swhWTWV.exe
  2⤵
  PID:5160
- C:\Windows\System\uqPzRqN.exe
  C:\Windows\System\uqPzRqN.exe
  2⤵
  PID:5176
- C:\Windows\System\wlBUkml.exe
  C:\Windows\System\wlBUkml.exe
  2⤵
  PID:5192
- C:\Windows\System\DfzQZsi.exe
  C:\Windows\System\DfzQZsi.exe
  2⤵
  PID:5208
- C:\Windows\System\PaOEcdK.exe
  C:\Windows\System\PaOEcdK.exe
  2⤵
  PID:5224
- C:\Windows\System\eKqLHZT.exe
  C:\Windows\System\eKqLHZT.exe
  2⤵
  PID:5240
- C:\Windows\System\DuAFQtI.exe
  C:\Windows\System\DuAFQtI.exe
  2⤵
  PID:5256
- C:\Windows\System\cnkWmtN.exe
  C:\Windows\System\cnkWmtN.exe
  2⤵
  PID:5272
- C:\Windows\System\WWPFCDV.exe
  C:\Windows\System\WWPFCDV.exe
  2⤵
  PID:5292
- C:\Windows\System\nGJHgSf.exe
  C:\Windows\System\nGJHgSf.exe
  2⤵
  PID:5308
- C:\Windows\System\nZzgbIs.exe
  C:\Windows\System\nZzgbIs.exe
  2⤵
  PID:5324
- C:\Windows\System\gILesvC.exe
  C:\Windows\System\gILesvC.exe
  2⤵
  PID:5340
- C:\Windows\System\ZjEIOKe.exe
  C:\Windows\System\ZjEIOKe.exe
  2⤵
  PID:5360
- C:\Windows\System\CmlBZXi.exe
  C:\Windows\System\CmlBZXi.exe
  2⤵
  PID:5376
- C:\Windows\System\NwJdfpc.exe
  C:\Windows\System\NwJdfpc.exe
  2⤵
  PID:5392
- C:\Windows\System\vZPdlJX.exe
  C:\Windows\System\vZPdlJX.exe
  2⤵
  PID:5408
- C:\Windows\System\roGufEH.exe
  C:\Windows\System\roGufEH.exe
  2⤵
  PID:5424
- C:\Windows\System\qDsXPGA.exe
  C:\Windows\System\qDsXPGA.exe
  2⤵
  PID:5440
- C:\Windows\System\ceFeLUu.exe
  C:\Windows\System\ceFeLUu.exe
  2⤵
  PID:5456
- C:\Windows\System\yoBKHIz.exe
  C:\Windows\System\yoBKHIz.exe
  2⤵
  PID:5476
- C:\Windows\System\ONaQeDd.exe
  C:\Windows\System\ONaQeDd.exe
  2⤵
  PID:5492
- C:\Windows\System\tKhSflw.exe
  C:\Windows\System\tKhSflw.exe
  2⤵
  PID:5508
- C:\Windows\System\uISRLix.exe
  C:\Windows\System\uISRLix.exe
  2⤵
  PID:5524
- C:\Windows\System\yHJCpRf.exe
  C:\Windows\System\yHJCpRf.exe
  2⤵
  PID:5540
- C:\Windows\System\UviqPGc.exe
  C:\Windows\System\UviqPGc.exe
  2⤵
  PID:5560
- C:\Windows\System\SSdjLsZ.exe
  C:\Windows\System\SSdjLsZ.exe
  2⤵
  PID:5576
- C:\Windows\System\mEOTtlQ.exe
  C:\Windows\System\mEOTtlQ.exe
  2⤵
  PID:5592
- C:\Windows\System\PdJZCNo.exe
  C:\Windows\System\PdJZCNo.exe
  2⤵
  PID:5608
- C:\Windows\System\cCzgWEL.exe
  C:\Windows\System\cCzgWEL.exe
  2⤵
  PID:5624
- C:\Windows\System\LknVhwD.exe
  C:\Windows\System\LknVhwD.exe
  2⤵
  PID:5640
- C:\Windows\System\XJRlByd.exe
  C:\Windows\System\XJRlByd.exe
  2⤵
  PID:5656
- C:\Windows\System\aFNrUip.exe
  C:\Windows\System\aFNrUip.exe
  2⤵
  PID:5672
- C:\Windows\System\mzBFqPn.exe
  C:\Windows\System\mzBFqPn.exe
  2⤵
  PID:5688
- C:\Windows\System\OjTWxDR.exe
  C:\Windows\System\OjTWxDR.exe
  2⤵
  PID:5704
- C:\Windows\System\rNsaGFa.exe
  C:\Windows\System\rNsaGFa.exe
  2⤵
  PID:5720
- C:\Windows\System\pNmuXlX.exe
  C:\Windows\System\pNmuXlX.exe
  2⤵
  PID:5736
- C:\Windows\System\kainFZK.exe
  C:\Windows\System\kainFZK.exe
  2⤵
  PID:5752
- C:\Windows\System\GIqlDMd.exe
  C:\Windows\System\GIqlDMd.exe
  2⤵
  PID:5768
- C:\Windows\System\cJNpcUr.exe
  C:\Windows\System\cJNpcUr.exe
  2⤵
  PID:5784
- C:\Windows\System\EBeacVe.exe
  C:\Windows\System\EBeacVe.exe
  2⤵
  PID:5800
- C:\Windows\System\bUqyqUc.exe
  C:\Windows\System\bUqyqUc.exe
  2⤵
  PID:5816
- C:\Windows\System\cCcBzDE.exe
  C:\Windows\System\cCcBzDE.exe
  2⤵
  PID:5836
- C:\Windows\System\IFZaDiQ.exe
  C:\Windows\System\IFZaDiQ.exe
  2⤵
  PID:5852
- C:\Windows\System\IUXOKjO.exe
  C:\Windows\System\IUXOKjO.exe
  2⤵
  PID:5868
- C:\Windows\System\WlRfBLw.exe
  C:\Windows\System\WlRfBLw.exe
  2⤵
  PID:5888
- C:\Windows\System\yOJNFyf.exe
  C:\Windows\System\yOJNFyf.exe
  2⤵
  PID:5904
- C:\Windows\System\XNQMIqk.exe
  C:\Windows\System\XNQMIqk.exe
  2⤵
  PID:5920
- C:\Windows\System\iqQrBGs.exe
  C:\Windows\System\iqQrBGs.exe
  2⤵
  PID:5936
- C:\Windows\System\uUBMOfz.exe
  C:\Windows\System\uUBMOfz.exe
  2⤵
  PID:5952
- C:\Windows\System\mIZEKIZ.exe
  C:\Windows\System\mIZEKIZ.exe
  2⤵
  PID:5968
- C:\Windows\System\JggjNzU.exe
  C:\Windows\System\JggjNzU.exe
  2⤵
  PID:5984
- C:\Windows\System\aGjbdTj.exe
  C:\Windows\System\aGjbdTj.exe
  2⤵
  PID:6000
- C:\Windows\System\uIPLgkv.exe
  C:\Windows\System\uIPLgkv.exe
  2⤵
  PID:6016
- C:\Windows\System\wmfilPV.exe
  C:\Windows\System\wmfilPV.exe
  2⤵
  PID:6032
- C:\Windows\System\Oinqkop.exe
  C:\Windows\System\Oinqkop.exe
  2⤵
  PID:6048
- C:\Windows\System\VjUoQcu.exe
  C:\Windows\System\VjUoQcu.exe
  2⤵
  PID:6064
- C:\Windows\System\WovNXnR.exe
  C:\Windows\System\WovNXnR.exe
  2⤵
  PID:6080
- C:\Windows\System\XwUhTvz.exe
  C:\Windows\System\XwUhTvz.exe
  2⤵
  PID:6096
- C:\Windows\System\OsMkxNl.exe
  C:\Windows\System\OsMkxNl.exe
  2⤵
  PID:6112
- C:\Windows\System\Rneckgx.exe
  C:\Windows\System\Rneckgx.exe
  2⤵
  PID:6128
- C:\Windows\System\eMMrZyF.exe
  C:\Windows\System\eMMrZyF.exe
  2⤵
  PID:4700
- C:\Windows\System\YxCrQOU.exe
  C:\Windows\System\YxCrQOU.exe
  2⤵
  PID:4988
- C:\Windows\System\pEGMlCG.exe
  C:\Windows\System\pEGMlCG.exe
  2⤵
  PID:5152
- C:\Windows\System\VjUKDaZ.exe
  C:\Windows\System\VjUKDaZ.exe
  2⤵
  PID:4248
- C:\Windows\System\PArcOlf.exe
  C:\Windows\System\PArcOlf.exe
  2⤵
  PID:5016
- C:\Windows\System\UvXowxO.exe
  C:\Windows\System\UvXowxO.exe
  2⤵
  PID:4336
- C:\Windows\System\Jpnovvv.exe
  C:\Windows\System\Jpnovvv.exe
  2⤵
  PID:5216
- C:\Windows\System\YopGXTc.exe
  C:\Windows\System\YopGXTc.exe
  2⤵
  PID:5280
- C:\Windows\System\sqFLpwe.exe
  C:\Windows\System\sqFLpwe.exe
  2⤵
  PID:5548
- C:\Windows\System\nClyGVS.exe
  C:\Windows\System\nClyGVS.exe
  2⤵
  PID:5432
- C:\Windows\System\GlxGlFi.exe
  C:\Windows\System\GlxGlFi.exe
  2⤵
  PID:5680
- C:\Windows\System\npEYzcl.exe
  C:\Windows\System\npEYzcl.exe
  2⤵
  PID:5468
- C:\Windows\System\UZbfaCR.exe
  C:\Windows\System\UZbfaCR.exe
  2⤵
  PID:5716
- C:\Windows\System\bQuJskQ.exe
  C:\Windows\System\bQuJskQ.exe
  2⤵
  PID:5696
- C:\Windows\System\cIqKBaQ.exe
  C:\Windows\System\cIqKBaQ.exe
  2⤵
  PID:5848
- C:\Windows\System\wTPRExS.exe
  C:\Windows\System\wTPRExS.exe
  2⤵
  PID:5832
- C:\Windows\System\udTSRIr.exe
  C:\Windows\System\udTSRIr.exe
  2⤵
  PID:5884
- C:\Windows\System\zcqbKWn.exe
  C:\Windows\System\zcqbKWn.exe
  2⤵
  PID:5136
- C:\Windows\System\dGRqHBy.exe
  C:\Windows\System\dGRqHBy.exe
  2⤵
  PID:4296
- C:\Windows\System\KmOYXoH.exe
  C:\Windows\System\KmOYXoH.exe
  2⤵
  PID:5348
- C:\Windows\System\mkOMDxn.exe
  C:\Windows\System\mkOMDxn.exe
  2⤵
  PID:5320
- C:\Windows\System\nCECxpZ.exe
  C:\Windows\System\nCECxpZ.exe
  2⤵
  PID:5168
- C:\Windows\System\HJqGhTp.exe
  C:\Windows\System\HJqGhTp.exe
  2⤵
  PID:5236
- C:\Windows\System\nsjDxvq.exe
  C:\Windows\System\nsjDxvq.exe
  2⤵
  PID:5488
- C:\Windows\System\ayWskif.exe
  C:\Windows\System\ayWskif.exe
  2⤵
  PID:5916
- C:\Windows\System\qszbvFG.exe
  C:\Windows\System\qszbvFG.exe
  2⤵
  PID:5944
- C:\Windows\System\pnNmdwe.exe
  C:\Windows\System\pnNmdwe.exe
  2⤵
  PID:5812
- C:\Windows\System\CDeCqph.exe
  C:\Windows\System\CDeCqph.exe
  2⤵
  PID:5976
- C:\Windows\System\CrwFlhO.exe
  C:\Windows\System\CrwFlhO.exe
  2⤵
  PID:5996
- C:\Windows\System\QJsekkG.exe
  C:\Windows\System\QJsekkG.exe
  2⤵
  PID:6044
- C:\Windows\System\IhfrUIG.exe
  C:\Windows\System\IhfrUIG.exe
  2⤵
  PID:6076
- C:\Windows\System\XUzwatK.exe
  C:\Windows\System\XUzwatK.exe
  2⤵
  PID:6136
- C:\Windows\System\haUAeyy.exe
  C:\Windows\System\haUAeyy.exe
  2⤵
  PID:6120
- C:\Windows\System\fHoVvXO.exe
  C:\Windows\System\fHoVvXO.exe
  2⤵
  PID:6124
- C:\Windows\System\VBFQcbL.exe
  C:\Windows\System\VBFQcbL.exe
  2⤵
  PID:6008
- C:\Windows\System\mlzlEvN.exe
  C:\Windows\System\mlzlEvN.exe
  2⤵
  PID:4620
- C:\Windows\System\jIQpQrj.exe
  C:\Windows\System\jIQpQrj.exe
  2⤵
  PID:5420
- C:\Windows\System\uxQFzkX.exe
  C:\Windows\System\uxQFzkX.exe
  2⤵
  PID:5204
- C:\Windows\System\KcObwvV.exe
  C:\Windows\System\KcObwvV.exe
  2⤵
  PID:5268
- C:\Windows\System\GdzbmkN.exe
  C:\Windows\System\GdzbmkN.exe
  2⤵
  PID:5264
- C:\Windows\System\Kboqpdb.exe
  C:\Windows\System\Kboqpdb.exe
  2⤵
  PID:5572
- C:\Windows\System\xyLWCjn.exe
  C:\Windows\System\xyLWCjn.exe
  2⤵
  PID:5712
- C:\Windows\System\JBfEcGj.exe
  C:\Windows\System\JBfEcGj.exe
  2⤵
  PID:5728
- C:\Windows\System\SCTbFXx.exe
  C:\Windows\System\SCTbFXx.exe
  2⤵
  PID:5636
- C:\Windows\System\NeonbXr.exe
  C:\Windows\System\NeonbXr.exe
  2⤵
  PID:5452
- C:\Windows\System\RTYnoFp.exe
  C:\Windows\System\RTYnoFp.exe
  2⤵
  PID:5764
- C:\Windows\System\dbqHFvS.exe
  C:\Windows\System\dbqHFvS.exe
  2⤵
  PID:5928
- C:\Windows\System\nNAfhUU.exe
  C:\Windows\System\nNAfhUU.exe
  2⤵
  PID:5964
- C:\Windows\System\ZquHJwX.exe
  C:\Windows\System\ZquHJwX.exe
  2⤵
  PID:5948
- C:\Windows\System\AYdcJul.exe
  C:\Windows\System\AYdcJul.exe
  2⤵
  PID:5552
- C:\Windows\System\iunIGGN.exe
  C:\Windows\System\iunIGGN.exe
  2⤵
  PID:5532
- C:\Windows\System\ybzHdHp.exe
  C:\Windows\System\ybzHdHp.exe
  2⤵
  PID:5356
- C:\Windows\System\jENsldl.exe
  C:\Windows\System\jENsldl.exe
  2⤵
  PID:5760
- C:\Windows\System\JIZsvGz.exe
  C:\Windows\System\JIZsvGz.exe
  2⤵
  PID:6092
- C:\Windows\System\evNbxTv.exe
  C:\Windows\System\evNbxTv.exe
  2⤵
  PID:5876
- C:\Windows\System\DVZrgWe.exe
  C:\Windows\System\DVZrgWe.exe
  2⤵
  PID:6104
- C:\Windows\System\jqaQcQJ.exe
  C:\Windows\System\jqaQcQJ.exe
  2⤵
  PID:5056
- C:\Windows\System\oGqdaTR.exe
  C:\Windows\System\oGqdaTR.exe
  2⤵
  PID:5900
- C:\Windows\System\QaWtyUD.exe
  C:\Windows\System\QaWtyUD.exe
  2⤵
  PID:5304
- C:\Windows\System\IKvHeXU.exe
  C:\Windows\System\IKvHeXU.exe
  2⤵
  PID:5388
- C:\Windows\System\lfAHOOX.exe
  C:\Windows\System\lfAHOOX.exe
  2⤵
  PID:6160
- C:\Windows\System\RxefZUL.exe
  C:\Windows\System\RxefZUL.exe
  2⤵
  PID:6176
- C:\Windows\System\XsmkkSJ.exe
  C:\Windows\System\XsmkkSJ.exe
  2⤵
  PID:6192
- C:\Windows\System\HXpJfKt.exe
  C:\Windows\System\HXpJfKt.exe
  2⤵
  PID:6208
- C:\Windows\System\ObTlGvD.exe
  C:\Windows\System\ObTlGvD.exe
  2⤵
  PID:6224
- C:\Windows\System\qgPLVOz.exe
  C:\Windows\System\qgPLVOz.exe
  2⤵
  PID:6240
- C:\Windows\System\McJLaro.exe
  C:\Windows\System\McJLaro.exe
  2⤵
  PID:6256
- C:\Windows\System\iviBdkl.exe
  C:\Windows\System\iviBdkl.exe
  2⤵
  PID:6272
- C:\Windows\System\uGCFbDo.exe
  C:\Windows\System\uGCFbDo.exe
  2⤵
  PID:6288
- C:\Windows\System\EuBwScm.exe
  C:\Windows\System\EuBwScm.exe
  2⤵
  PID:6304
- C:\Windows\System\JANmrac.exe
  C:\Windows\System\JANmrac.exe
  2⤵
  PID:6320
- C:\Windows\System\WchDQty.exe
  C:\Windows\System\WchDQty.exe
  2⤵
  PID:6336
- C:\Windows\System\TrAzrBI.exe
  C:\Windows\System\TrAzrBI.exe
  2⤵
  PID:6352
- C:\Windows\System\StkKNiP.exe
  C:\Windows\System\StkKNiP.exe
  2⤵
  PID:6368
- C:\Windows\System\dqTvltc.exe
  C:\Windows\System\dqTvltc.exe
  2⤵
  PID:6384
- C:\Windows\System\ZHHLEqP.exe
  C:\Windows\System\ZHHLEqP.exe
  2⤵
  PID:6420
- C:\Windows\System\KfoIZmE.exe
  C:\Windows\System\KfoIZmE.exe
  2⤵
  PID:6436
- C:\Windows\System\NItHuJu.exe
  C:\Windows\System\NItHuJu.exe
  2⤵
  PID:6452
- C:\Windows\System\McpOfOt.exe
  C:\Windows\System\McpOfOt.exe
  2⤵
  PID:6468
- C:\Windows\System\xdNwKjK.exe
  C:\Windows\System\xdNwKjK.exe
  2⤵
  PID:6484
- C:\Windows\System\RfdFlDB.exe
  C:\Windows\System\RfdFlDB.exe
  2⤵
  PID:6500
- C:\Windows\System\zSmrtnd.exe
  C:\Windows\System\zSmrtnd.exe
  2⤵
  PID:6516
- C:\Windows\System\seKmJhX.exe
  C:\Windows\System\seKmJhX.exe
  2⤵
  PID:6532
- C:\Windows\System\PPFslqV.exe
  C:\Windows\System\PPFslqV.exe
  2⤵
  PID:6548
- C:\Windows\System\VNutdZu.exe
  C:\Windows\System\VNutdZu.exe
  2⤵
  PID:6564
- C:\Windows\System\YugIepp.exe
  C:\Windows\System\YugIepp.exe
  2⤵
  PID:6580
- C:\Windows\System\pkrzvPo.exe
  C:\Windows\System\pkrzvPo.exe
  2⤵
  PID:6596
- C:\Windows\System\rCkmZjM.exe
  C:\Windows\System\rCkmZjM.exe
  2⤵
  PID:6612
- C:\Windows\System\xUpRyLC.exe
  C:\Windows\System\xUpRyLC.exe
  2⤵
  PID:6628
- C:\Windows\System\GGDVwIK.exe
  C:\Windows\System\GGDVwIK.exe
  2⤵
  PID:6644
- C:\Windows\System\lLszKWh.exe
  C:\Windows\System\lLszKWh.exe
  2⤵
  PID:6660
- C:\Windows\System\kjrHUnm.exe
  C:\Windows\System\kjrHUnm.exe
  2⤵
  PID:6676
- C:\Windows\System\xhTrJPs.exe
  C:\Windows\System\xhTrJPs.exe
  2⤵
  PID:6692
- C:\Windows\System\mBZEcRq.exe
  C:\Windows\System\mBZEcRq.exe
  2⤵
  PID:6708
- C:\Windows\System\pfrZUBC.exe
  C:\Windows\System\pfrZUBC.exe
  2⤵
  PID:6724
- C:\Windows\System\pxavVGr.exe
  C:\Windows\System\pxavVGr.exe
  2⤵
  PID:6740
- C:\Windows\System\hGNqfWr.exe
  C:\Windows\System\hGNqfWr.exe
  2⤵
  PID:6756
- C:\Windows\System\vaJapkt.exe
  C:\Windows\System\vaJapkt.exe
  2⤵
  PID:6772
- C:\Windows\System\scDrqMp.exe
  C:\Windows\System\scDrqMp.exe
  2⤵
  PID:6788
- C:\Windows\System\VpYNFyK.exe
  C:\Windows\System\VpYNFyK.exe
  2⤵
  PID:6804
- C:\Windows\System\MnUshYa.exe
  C:\Windows\System\MnUshYa.exe
  2⤵
  PID:6820
- C:\Windows\System\wtmKkyF.exe
  C:\Windows\System\wtmKkyF.exe
  2⤵
  PID:6836
- C:\Windows\System\vsEVujX.exe
  C:\Windows\System\vsEVujX.exe
  2⤵
  PID:6852
- C:\Windows\System\wIiQEjK.exe
  C:\Windows\System\wIiQEjK.exe
  2⤵
  PID:6868
- C:\Windows\System\PQrXZzq.exe
  C:\Windows\System\PQrXZzq.exe
  2⤵
  PID:6884
- C:\Windows\System\kkEAecH.exe
  C:\Windows\System\kkEAecH.exe
  2⤵
  PID:6900
- C:\Windows\System\bXaWLcb.exe
  C:\Windows\System\bXaWLcb.exe
  2⤵
  PID:6916
- C:\Windows\System\gaExSwO.exe
  C:\Windows\System\gaExSwO.exe
  2⤵
  PID:6932
- C:\Windows\System\HrcoLmf.exe
  C:\Windows\System\HrcoLmf.exe
  2⤵
  PID:6948
- C:\Windows\System\HuNEvGn.exe
  C:\Windows\System\HuNEvGn.exe
  2⤵
  PID:6964
- C:\Windows\System\UECpMOb.exe
  C:\Windows\System\UECpMOb.exe
  2⤵
  PID:6980
- C:\Windows\System\OPfcOIB.exe
  C:\Windows\System\OPfcOIB.exe
  2⤵
  PID:6996
- C:\Windows\System\gqqVhDQ.exe
  C:\Windows\System\gqqVhDQ.exe
  2⤵
  PID:7012
- C:\Windows\System\piJBuJw.exe
  C:\Windows\System\piJBuJw.exe
  2⤵
  PID:7028
- C:\Windows\System\jOnnxea.exe
  C:\Windows\System\jOnnxea.exe
  2⤵
  PID:7044
- C:\Windows\System\sxOneuz.exe
  C:\Windows\System\sxOneuz.exe
  2⤵
  PID:7060
- C:\Windows\System\VXOvzAC.exe
  C:\Windows\System\VXOvzAC.exe
  2⤵
  PID:7076
- C:\Windows\System\IpysOTd.exe
  C:\Windows\System\IpysOTd.exe
  2⤵
  PID:7092
- C:\Windows\System\Eyuhqks.exe
  C:\Windows\System\Eyuhqks.exe
  2⤵
  PID:7108
- C:\Windows\System\UiEGqzQ.exe
  C:\Windows\System\UiEGqzQ.exe
  2⤵
  PID:7124
- C:\Windows\System\womRVCp.exe
  C:\Windows\System\womRVCp.exe
  2⤵
  PID:7140
- C:\Windows\System\vCVSzkv.exe
  C:\Windows\System\vCVSzkv.exe
  2⤵
  PID:7156
- C:\Windows\System\igXPdkh.exe
  C:\Windows\System\igXPdkh.exe
  2⤵
  PID:5844
- C:\Windows\System\uMuDJYH.exe
  C:\Windows\System\uMuDJYH.exe
  2⤵
  PID:5776
- C:\Windows\System\UJKoUQJ.exe
  C:\Windows\System\UJKoUQJ.exe
  2⤵
  PID:6024
- C:\Windows\System\AhSNLFg.exe
  C:\Windows\System\AhSNLFg.exe
  2⤵
  PID:6220
- C:\Windows\System\rvtUEWE.exe
  C:\Windows\System\rvtUEWE.exe
  2⤵
  PID:5648
- C:\Windows\System\XNJtRgh.exe
  C:\Windows\System\XNJtRgh.exe
  2⤵
  PID:5896
- C:\Windows\System\xRyRfLG.exe
  C:\Windows\System\xRyRfLG.exe
  2⤵
  PID:6284
- C:\Windows\System\ebEhVQw.exe
  C:\Windows\System\ebEhVQw.exe
  2⤵
  PID:6316
- C:\Windows\System\jlxVVFK.exe
  C:\Windows\System\jlxVVFK.exe
  2⤵
  PID:6344
- C:\Windows\System\uvHREsT.exe
  C:\Windows\System\uvHREsT.exe
  2⤵
  PID:6204
- C:\Windows\System\uKLtXCl.exe
  C:\Windows\System\uKLtXCl.exe
  2⤵
  PID:6232
- C:\Windows\System\bHIUaQS.exe
  C:\Windows\System\bHIUaQS.exe
  2⤵
  PID:6300
- C:\Windows\System\DMOdEXC.exe
  C:\Windows\System\DMOdEXC.exe
  2⤵
  PID:6332
- C:\Windows\System\URaSbtv.exe
  C:\Windows\System\URaSbtv.exe
  2⤵
  PID:6404
- C:\Windows\System\NNSbGIc.exe
  C:\Windows\System\NNSbGIc.exe
  2⤵
  PID:6428
- C:\Windows\System\HhvKduO.exe
  C:\Windows\System\HhvKduO.exe
  2⤵
  PID:6492
- C:\Windows\System\xlHqDNV.exe
  C:\Windows\System\xlHqDNV.exe
  2⤵
  PID:6556
- C:\Windows\System\aiyXNVr.exe
  C:\Windows\System\aiyXNVr.exe
  2⤵
  PID:6620
- C:\Windows\System\ELCYuJX.exe
  C:\Windows\System\ELCYuJX.exe
  2⤵
  PID:6444
- C:\Windows\System\XeFjLfz.exe
  C:\Windows\System\XeFjLfz.exe
  2⤵
  PID:6480
- C:\Windows\System\GYfjmAw.exe
  C:\Windows\System\GYfjmAw.exe
  2⤵
  PID:6684
- C:\Windows\System\zQlCSJe.exe
  C:\Windows\System\zQlCSJe.exe
  2⤵
  PID:6572
- C:\Windows\System\eKwaudp.exe
  C:\Windows\System\eKwaudp.exe
  2⤵
  PID:6700
- C:\Windows\System\hICRorZ.exe
  C:\Windows\System\hICRorZ.exe
  2⤵
  PID:6540
- C:\Windows\System\VURtWlP.exe
  C:\Windows\System\VURtWlP.exe
  2⤵
  PID:6752
- C:\Windows\System\GQwRYyY.exe
  C:\Windows\System\GQwRYyY.exe
  2⤵
  PID:6812
- C:\Windows\System\NdVFGet.exe
  C:\Windows\System\NdVFGet.exe
  2⤵
  PID:6796
- C:\Windows\System\eVnBRUV.exe
  C:\Windows\System\eVnBRUV.exe
  2⤵
  PID:6848
- C:\Windows\System\BvbpmGS.exe
  C:\Windows\System\BvbpmGS.exe
  2⤵
  PID:6880
- C:\Windows\System\NeyxXMW.exe
  C:\Windows\System\NeyxXMW.exe
  2⤵
  PID:6912
- C:\Windows\System\fvoIBlb.exe
  C:\Windows\System\fvoIBlb.exe
  2⤵
  PID:6976
- C:\Windows\System\EsQMxgq.exe
  C:\Windows\System\EsQMxgq.exe
  2⤵
  PID:7036
- C:\Windows\System\dqKGRoJ.exe
  C:\Windows\System\dqKGRoJ.exe
  2⤵
  PID:7040
- C:\Windows\System\GgQCjfc.exe
  C:\Windows\System\GgQCjfc.exe
  2⤵
  PID:6956
- C:\Windows\System\FBgTMym.exe
  C:\Windows\System\FBgTMym.exe
  2⤵
  PID:6988
- C:\Windows\System\mQvuKim.exe
  C:\Windows\System\mQvuKim.exe
  2⤵
  PID:7084
- C:\Windows\System\QJPwUvX.exe
  C:\Windows\System\QJPwUvX.exe
  2⤵
  PID:5860
- C:\Windows\System\idjVjul.exe
  C:\Windows\System\idjVjul.exe
  2⤵
  PID:5372
- C:\Windows\System\bvFYtpV.exe
  C:\Windows\System\bvFYtpV.exe
  2⤵
  PID:7148
- C:\Windows\System\Yxylpnf.exe
  C:\Windows\System\Yxylpnf.exe
  2⤵
  PID:6172
- C:\Windows\System\kMaovRn.exe
  C:\Windows\System\kMaovRn.exe
  2⤵
  PID:7120
- C:\Windows\System\KxCpqsN.exe
  C:\Windows\System\KxCpqsN.exe
  2⤵
  PID:6360
- C:\Windows\System\aAeelFZ.exe
  C:\Windows\System\aAeelFZ.exe
  2⤵
  PID:5652
- C:\Windows\System\ObiboXP.exe
  C:\Windows\System\ObiboXP.exe
  2⤵
  PID:6216
- C:\Windows\System\HoVBptR.exe
  C:\Windows\System\HoVBptR.exe
  2⤵
  PID:7152
- C:\Windows\System\fgKHoKb.exe
  C:\Windows\System\fgKHoKb.exe
  2⤵
  PID:6652
- C:\Windows\System\yBRUSMG.exe
  C:\Windows\System\yBRUSMG.exe
  2⤵
  PID:6476
- C:\Windows\System\geQsrbI.exe
  C:\Windows\System\geQsrbI.exe
  2⤵
  PID:6608
- C:\Windows\System\pYuLhWH.exe
  C:\Windows\System\pYuLhWH.exe
  2⤵
  PID:6672
- C:\Windows\System\gbQXonJ.exe
  C:\Windows\System\gbQXonJ.exe
  2⤵
  PID:6972
- C:\Windows\System\aytYqap.exe
  C:\Windows\System\aytYqap.exe
  2⤵
  PID:6960
- C:\Windows\System\dXMYKwf.exe
  C:\Windows\System\dXMYKwf.exe
  2⤵
  PID:6784
- C:\Windows\System\GKDcjnE.exe
  C:\Windows\System\GKDcjnE.exe
  2⤵
  PID:6892
- C:\Windows\System\CgDLSUb.exe
  C:\Windows\System\CgDLSUb.exe
  2⤵
  PID:6464
- C:\Windows\System\NGyASzj.exe
  C:\Windows\System\NGyASzj.exe
  2⤵
  PID:6908
- C:\Windows\System\VYUnvll.exe
  C:\Windows\System\VYUnvll.exe
  2⤵
  PID:7088
- C:\Windows\System\fPtqEKj.exe
  C:\Windows\System\fPtqEKj.exe
  2⤵
  PID:7024
- C:\Windows\System\BSMpHeM.exe
  C:\Windows\System\BSMpHeM.exe
  2⤵
  PID:7136
- C:\Windows\System\PIuMHbD.exe
  C:\Windows\System\PIuMHbD.exe
  2⤵
  PID:6748
- C:\Windows\System\JRKHVhj.exe
  C:\Windows\System\JRKHVhj.exe
  2⤵
  PID:6768
- C:\Windows\System\aBugjwC.exe
  C:\Windows\System\aBugjwC.exe
  2⤵
  PID:6328
- C:\Windows\System\OadAijW.exe
  C:\Windows\System\OadAijW.exe
  2⤵
  PID:6828
- C:\Windows\System\jnUAqWP.exe
  C:\Windows\System\jnUAqWP.exe
  2⤵
  PID:6864
- C:\Windows\System\sCDnEIb.exe
  C:\Windows\System\sCDnEIb.exe
  2⤵
  PID:6736
- C:\Windows\System\MPdQMAG.exe
  C:\Windows\System\MPdQMAG.exe
  2⤵
  PID:6668
- C:\Windows\System\TXdYgQo.exe
  C:\Windows\System\TXdYgQo.exe
  2⤵
  PID:7164
- C:\Windows\System\ccVpQvz.exe
  C:\Windows\System\ccVpQvz.exe
  2⤵
  PID:6168
- C:\Windows\System\AfnCXVz.exe
  C:\Windows\System\AfnCXVz.exe
  2⤵
  PID:6460
- C:\Windows\System\xjniUck.exe
  C:\Windows\System\xjniUck.exe
  2⤵
  PID:6592
- C:\Windows\System\nVvZeLo.exe
  C:\Windows\System\nVvZeLo.exe
  2⤵
  PID:5600
- C:\Windows\System\zbwLhMv.exe
  C:\Windows\System\zbwLhMv.exe
  2⤵
  PID:6732
- C:\Windows\System\ZXEMTsq.exe
  C:\Windows\System\ZXEMTsq.exe
  2⤵
  PID:7172
- C:\Windows\System\LJvCUqL.exe
  C:\Windows\System\LJvCUqL.exe
  2⤵
  PID:7192
- C:\Windows\System\BYoSHKX.exe
  C:\Windows\System\BYoSHKX.exe
  2⤵
  PID:7208
- C:\Windows\System\Coalmpe.exe
  C:\Windows\System\Coalmpe.exe
  2⤵
  PID:7224
- C:\Windows\System\kCEmJwF.exe
  C:\Windows\System\kCEmJwF.exe
  2⤵
  PID:7244
- C:\Windows\System\EBodSeB.exe
  C:\Windows\System\EBodSeB.exe
  2⤵
  PID:7260
- C:\Windows\System\LpKtpEs.exe
  C:\Windows\System\LpKtpEs.exe
  2⤵
  PID:7276
- C:\Windows\System\yaIxBaB.exe
  C:\Windows\System\yaIxBaB.exe
  2⤵
  PID:7292
- C:\Windows\System\rWJYKsK.exe
  C:\Windows\System\rWJYKsK.exe
  2⤵
  PID:7308
- C:\Windows\System\CrEtBJv.exe
  C:\Windows\System\CrEtBJv.exe
  2⤵
  PID:7324
- C:\Windows\System\JxsFMns.exe
  C:\Windows\System\JxsFMns.exe
  2⤵
  PID:7340
- C:\Windows\System\rcefipF.exe
  C:\Windows\System\rcefipF.exe
  2⤵
  PID:7356
- C:\Windows\System\GSiDHBk.exe
  C:\Windows\System\GSiDHBk.exe
  2⤵
  PID:7372
- C:\Windows\System\ckxFmIU.exe
  C:\Windows\System\ckxFmIU.exe
  2⤵
  PID:7388
- C:\Windows\System\ByuXWkF.exe
  C:\Windows\System\ByuXWkF.exe
  2⤵
  PID:7404
- C:\Windows\System\TkCDDRO.exe
  C:\Windows\System\TkCDDRO.exe
  2⤵
  PID:7420
- C:\Windows\System\RqVbzkD.exe
  C:\Windows\System\RqVbzkD.exe
  2⤵
  PID:7436
- C:\Windows\System\aBmaySQ.exe
  C:\Windows\System\aBmaySQ.exe
  2⤵
  PID:7452
- C:\Windows\System\ZOWPEUh.exe
  C:\Windows\System\ZOWPEUh.exe
  2⤵
  PID:7468
- C:\Windows\System\avpAlLc.exe
  C:\Windows\System\avpAlLc.exe
  2⤵
  PID:7488
- C:\Windows\System\NqDdmsM.exe
  C:\Windows\System\NqDdmsM.exe
  2⤵
  PID:7504
- C:\Windows\System\IiDQqPt.exe
  C:\Windows\System\IiDQqPt.exe
  2⤵
  PID:7520
- C:\Windows\System\zNlqFsA.exe
  C:\Windows\System\zNlqFsA.exe
  2⤵
  PID:7536
- C:\Windows\System\rFrjcWJ.exe
  C:\Windows\System\rFrjcWJ.exe
  2⤵
  PID:7552
- C:\Windows\System\pyIcLrN.exe
  C:\Windows\System\pyIcLrN.exe
  2⤵
  PID:7568
- C:\Windows\System\avxtXOw.exe
  C:\Windows\System\avxtXOw.exe
  2⤵
  PID:7584
- C:\Windows\System\uBYWWan.exe
  C:\Windows\System\uBYWWan.exe
  2⤵
  PID:7612
- C:\Windows\System\SAijyYw.exe
  C:\Windows\System\SAijyYw.exe
  2⤵
  PID:7628
- C:\Windows\System\ehHmwby.exe
  C:\Windows\System\ehHmwby.exe
  2⤵
  PID:7644
- C:\Windows\System\mTjNFgi.exe
  C:\Windows\System\mTjNFgi.exe
  2⤵
  PID:7660
- C:\Windows\System\paVevqi.exe
  C:\Windows\System\paVevqi.exe
  2⤵
  PID:7676
- C:\Windows\System\MLxQLlp.exe
  C:\Windows\System\MLxQLlp.exe
  2⤵
  PID:7692
- C:\Windows\System\RcyAEwS.exe
  C:\Windows\System\RcyAEwS.exe
  2⤵
  PID:7708
- C:\Windows\System\MvvpHns.exe
  C:\Windows\System\MvvpHns.exe
  2⤵
  PID:7724
- C:\Windows\System\WuDvEHN.exe
  C:\Windows\System\WuDvEHN.exe
  2⤵
  PID:7740
- C:\Windows\System\dXWjfyE.exe
  C:\Windows\System\dXWjfyE.exe
  2⤵
  PID:7756
- C:\Windows\System\lEbDuFo.exe
  C:\Windows\System\lEbDuFo.exe
  2⤵
  PID:7772
- C:\Windows\System\lBKpZCG.exe
  C:\Windows\System\lBKpZCG.exe
  2⤵
  PID:7788
- C:\Windows\System\mPUVLxw.exe
  C:\Windows\System\mPUVLxw.exe
  2⤵
  PID:7804
- C:\Windows\System\sKGnIaI.exe
  C:\Windows\System\sKGnIaI.exe
  2⤵
  PID:7820
- C:\Windows\System\IwkYksD.exe
  C:\Windows\System\IwkYksD.exe
  2⤵
  PID:7836
- C:\Windows\System\gilMGsl.exe
  C:\Windows\System\gilMGsl.exe
  2⤵
  PID:7852
- C:\Windows\System\CEEDrDw.exe
  C:\Windows\System\CEEDrDw.exe
  2⤵
  PID:7868
- C:\Windows\System\tHISDOc.exe
  C:\Windows\System\tHISDOc.exe
  2⤵
  PID:7884
- C:\Windows\System\MTgnWuU.exe
  C:\Windows\System\MTgnWuU.exe
  2⤵
  PID:7900
- C:\Windows\System\DICBHHQ.exe
  C:\Windows\System\DICBHHQ.exe
  2⤵
  PID:7916
- C:\Windows\System\fvdCtJf.exe
  C:\Windows\System\fvdCtJf.exe
  2⤵
  PID:7932
- C:\Windows\System\IbCUQTz.exe
  C:\Windows\System\IbCUQTz.exe
  2⤵
  PID:7948
- C:\Windows\System\jLoltIT.exe
  C:\Windows\System\jLoltIT.exe
  2⤵
  PID:7964
- C:\Windows\System\NeMHNPf.exe
  C:\Windows\System\NeMHNPf.exe
  2⤵
  PID:7980
- C:\Windows\System\pASIhFq.exe
  C:\Windows\System\pASIhFq.exe
  2⤵
  PID:7996
- C:\Windows\System\CTmhyqg.exe
  C:\Windows\System\CTmhyqg.exe
  2⤵
  PID:8012
- C:\Windows\System\KrjIluA.exe
  C:\Windows\System\KrjIluA.exe
  2⤵
  PID:8028
- C:\Windows\System\KciDVWC.exe
  C:\Windows\System\KciDVWC.exe
  2⤵
  PID:8044
- C:\Windows\System\IrPRxLQ.exe
  C:\Windows\System\IrPRxLQ.exe
  2⤵
  PID:8060
- C:\Windows\System\JNjkUUC.exe
  C:\Windows\System\JNjkUUC.exe
  2⤵
  PID:8076
- C:\Windows\System\wehGTRk.exe
  C:\Windows\System\wehGTRk.exe
  2⤵
  PID:8092
- C:\Windows\System\ntRMBoH.exe
  C:\Windows\System\ntRMBoH.exe
  2⤵
  PID:8108
- C:\Windows\System\KuLOflO.exe
  C:\Windows\System\KuLOflO.exe
  2⤵
  PID:8124
- C:\Windows\System\FxzUHCw.exe
  C:\Windows\System\FxzUHCw.exe
  2⤵
  PID:8140
- C:\Windows\System\ATyaxCr.exe
  C:\Windows\System\ATyaxCr.exe
  2⤵
  PID:8156
- C:\Windows\System\zroReoG.exe
  C:\Windows\System\zroReoG.exe
  2⤵
  PID:8172
- C:\Windows\System\APOvVtv.exe
  C:\Windows\System\APOvVtv.exe
  2⤵
  PID:8188
- C:\Windows\System\rSCJsIK.exe
  C:\Windows\System\rSCJsIK.exe
  2⤵
  PID:6268
- C:\Windows\System\PSIQtma.exe
  C:\Windows\System\PSIQtma.exe
  2⤵
  PID:7216
- C:\Windows\System\LrbyUQc.exe
  C:\Windows\System\LrbyUQc.exe
  2⤵
  PID:7220
- C:\Windows\System\WslgvCo.exe
  C:\Windows\System\WslgvCo.exe
  2⤵
  PID:7256
- C:\Windows\System\PVqIUoq.exe
  C:\Windows\System\PVqIUoq.exe
  2⤵
  PID:7232
- C:\Windows\System\Rwzcqjc.exe
  C:\Windows\System\Rwzcqjc.exe
  2⤵
  PID:7320
- C:\Windows\System\gBUWQrD.exe
  C:\Windows\System\gBUWQrD.exe
  2⤵
  PID:7380
- C:\Windows\System\HDejZrU.exe
  C:\Windows\System\HDejZrU.exe
  2⤵
  PID:7304
- C:\Windows\System\BvFRlxE.exe
  C:\Windows\System\BvFRlxE.exe
  2⤵
  PID:7396
- C:\Windows\System\KCDnzxc.exe
  C:\Windows\System\KCDnzxc.exe
  2⤵
  PID:7444
- C:\Windows\System\HKkPodr.exe
  C:\Windows\System\HKkPodr.exe
  2⤵
  PID:7480
- C:\Windows\System\vEaniXX.exe
  C:\Windows\System\vEaniXX.exe
  2⤵
  PID:7544
- C:\Windows\System\jswtMdM.exe
  C:\Windows\System\jswtMdM.exe
  2⤵
  PID:7464
- C:\Windows\System\RtVChjk.exe
  C:\Windows\System\RtVChjk.exe
  2⤵
  PID:7576
- C:\Windows\System\DEOUirX.exe
  C:\Windows\System\DEOUirX.exe
  2⤵
  PID:7592
- C:\Windows\System\QiJzQPb.exe
  C:\Windows\System\QiJzQPb.exe
  2⤵
  PID:7604
- C:\Windows\System\GPkqdvi.exe
  C:\Windows\System\GPkqdvi.exe
  2⤵
  PID:7652
- C:\Windows\System\dpweMku.exe
  C:\Windows\System\dpweMku.exe
  2⤵
  PID:7716
- C:\Windows\System\ILcvwWc.exe
  C:\Windows\System\ILcvwWc.exe
  2⤵
  PID:7780
- C:\Windows\System\CsrTgnE.exe
  C:\Windows\System\CsrTgnE.exe
  2⤵
  PID:7636
- C:\Windows\System\jXXTMIS.exe
  C:\Windows\System\jXXTMIS.exe
  2⤵
  PID:7764
- C:\Windows\System\YhhpScP.exe
  C:\Windows\System\YhhpScP.exe
  2⤵
  PID:7672
- C:\Windows\System\htPBmed.exe
  C:\Windows\System\htPBmed.exe
  2⤵
  PID:7732
- C:\Windows\System\qpbXtIe.exe
  C:\Windows\System\qpbXtIe.exe
  2⤵
  PID:7800
- C:\Windows\System\brxntqZ.exe
  C:\Windows\System\brxntqZ.exe
  2⤵
  PID:7944
- C:\Windows\System\oEcJCXd.exe
  C:\Windows\System\oEcJCXd.exe
  2⤵
  PID:7976
- C:\Windows\System\Mmlqbcr.exe
  C:\Windows\System\Mmlqbcr.exe
  2⤵
  PID:8040
- C:\Windows\System\cKoOWas.exe
  C:\Windows\System\cKoOWas.exe
  2⤵
  PID:7896
- C:\Windows\System\jAiDufB.exe
  C:\Windows\System\jAiDufB.exe
  2⤵
  PID:8104
- C:\Windows\System\uARWzwR.exe
  C:\Windows\System\uARWzwR.exe
  2⤵
  PID:8168
- C:\Windows\System\bVKuKXH.exe
  C:\Windows\System\bVKuKXH.exe
  2⤵
  PID:7924
- C:\Windows\System\YxVFpbO.exe
  C:\Windows\System\YxVFpbO.exe
  2⤵
  PID:8052
- C:\Windows\System\QsZdmYW.exe
  C:\Windows\System\QsZdmYW.exe
  2⤵
  PID:7992
- C:\Windows\System\kcuJtfS.exe
  C:\Windows\System\kcuJtfS.exe
  2⤵
  PID:8084
- C:\Windows\System\BwuNBcR.exe
  C:\Windows\System\BwuNBcR.exe
  2⤵
  PID:8152
- C:\Windows\System\VeXpuUQ.exe
  C:\Windows\System\VeXpuUQ.exe
  2⤵
  PID:6264
- C:\Windows\System\kFLLwfK.exe
  C:\Windows\System\kFLLwfK.exe
  2⤵
  PID:7252
- C:\Windows\System\saCTfXN.exe
  C:\Windows\System\saCTfXN.exe
  2⤵
  PID:7412
- C:\Windows\System\GlTnpIs.exe
  C:\Windows\System\GlTnpIs.exe
  2⤵
  PID:7484
- C:\Windows\System\uYgXZBE.exe
  C:\Windows\System\uYgXZBE.exe
  2⤵
  PID:7460
- C:\Windows\System\FYgDeDA.exe
  C:\Windows\System\FYgDeDA.exe
  2⤵
  PID:7564
- C:\Windows\System\GesCJzY.exe
  C:\Windows\System\GesCJzY.exe
  2⤵
  PID:6412
- C:\Windows\System\kDpjZeA.exe
  C:\Windows\System\kDpjZeA.exe
  2⤵
  PID:7752
- C:\Windows\System\YpwQmay.exe
  C:\Windows\System\YpwQmay.exe
  2⤵
  PID:7812
- C:\Windows\System\VqlsfKp.exe
  C:\Windows\System\VqlsfKp.exe
  2⤵
  PID:7668
- C:\Windows\System\oMuaycY.exe
  C:\Windows\System\oMuaycY.exe
  2⤵
  PID:7940
- C:\Windows\System\OSKqwEN.exe
  C:\Windows\System\OSKqwEN.exe
  2⤵
  PID:7860
- C:\Windows\System\kotIqVM.exe
  C:\Windows\System\kotIqVM.exe
  2⤵
  PID:7928
- C:\Windows\System\bAmpyAN.exe
  C:\Windows\System\bAmpyAN.exe
  2⤵
  PID:7956
- C:\Windows\System\TVbFspf.exe
  C:\Windows\System\TVbFspf.exe
  2⤵
  PID:7892
- C:\Windows\System\LYZMQbf.exe
  C:\Windows\System\LYZMQbf.exe
  2⤵
  PID:8116
- C:\Windows\System\vtPQoKN.exe
  C:\Windows\System\vtPQoKN.exe
  2⤵
  PID:8056
- C:\Windows\System\dcRtLVw.exe
  C:\Windows\System\dcRtLVw.exe
  2⤵
  PID:8184
- C:\Windows\System\THJhtwt.exe
  C:\Windows\System\THJhtwt.exe
  2⤵
  PID:7528
- C:\Windows\System\lgZYoqH.exe
  C:\Windows\System\lgZYoqH.exe
  2⤵
  PID:7864
- C:\Windows\System\vezlybF.exe
  C:\Windows\System\vezlybF.exe
  2⤵
  PID:8100
- C:\Windows\System\BvNVGwH.exe
  C:\Windows\System\BvNVGwH.exe
  2⤵
  PID:7684
- C:\Windows\System\bPjydlT.exe
  C:\Windows\System\bPjydlT.exe
  2⤵
  PID:8072
- C:\Windows\System\fZGztRD.exe
  C:\Windows\System\fZGztRD.exe
  2⤵
  PID:8136
- C:\Windows\System\EVlqQNC.exe
  C:\Windows\System\EVlqQNC.exe
  2⤵
  PID:6088
- C:\Windows\System\yFqjEZR.exe
  C:\Windows\System\yFqjEZR.exe
  2⤵
  PID:7364
- C:\Windows\System\VZuBKga.exe
  C:\Windows\System\VZuBKga.exe
  2⤵
  PID:7532
- C:\Windows\System\ijtpbCF.exe
  C:\Windows\System\ijtpbCF.exe
  2⤵
  PID:7500
- C:\Windows\System\RIDJXoh.exe
  C:\Windows\System\RIDJXoh.exe
  2⤵
  PID:7700
- C:\Windows\System\mFfUXpe.exe
  C:\Windows\System\mFfUXpe.exe
  2⤵
  PID:8204
- C:\Windows\System\byQiQSP.exe
  C:\Windows\System\byQiQSP.exe
  2⤵
  PID:8220
- C:\Windows\System\snANkVZ.exe
  C:\Windows\System\snANkVZ.exe
  2⤵
  PID:8236
- C:\Windows\System\ylZLUJH.exe
  C:\Windows\System\ylZLUJH.exe
  2⤵
  PID:8256
- C:\Windows\System\xLspMvH.exe
  C:\Windows\System\xLspMvH.exe
  2⤵
  PID:8272
- C:\Windows\System\mnuQDTb.exe
  C:\Windows\System\mnuQDTb.exe
  2⤵
  PID:8288
- C:\Windows\System\LJlgqvB.exe
  C:\Windows\System\LJlgqvB.exe
  2⤵
  PID:8304
- C:\Windows\System\nXNZEfg.exe
  C:\Windows\System\nXNZEfg.exe
  2⤵
  PID:8320
- C:\Windows\System\HtOZePk.exe
  C:\Windows\System\HtOZePk.exe
  2⤵
  PID:8336
- C:\Windows\System\nKMXybD.exe
  C:\Windows\System\nKMXybD.exe
  2⤵
  PID:8352
- C:\Windows\System\xMcgjKg.exe
  C:\Windows\System\xMcgjKg.exe
  2⤵
  PID:8368
- C:\Windows\System\kjYLmVX.exe
  C:\Windows\System\kjYLmVX.exe
  2⤵
  PID:8384
- C:\Windows\System\EyzPeZZ.exe
  C:\Windows\System\EyzPeZZ.exe
  2⤵
  PID:8400
- C:\Windows\System\xxiQCdY.exe
  C:\Windows\System\xxiQCdY.exe
  2⤵
  PID:8416
- C:\Windows\System\yMwEfXe.exe
  C:\Windows\System\yMwEfXe.exe
  2⤵
  PID:8432
- C:\Windows\System\fUVzIlW.exe
  C:\Windows\System\fUVzIlW.exe
  2⤵
  PID:8448
- C:\Windows\System\TpZBXou.exe
  C:\Windows\System\TpZBXou.exe
  2⤵
  PID:8464
- C:\Windows\System\jjrrNST.exe
  C:\Windows\System\jjrrNST.exe
  2⤵
  PID:8480
- C:\Windows\System\GQcEJDL.exe
  C:\Windows\System\GQcEJDL.exe
  2⤵
  PID:8496
- C:\Windows\System\hhRHVNA.exe
  C:\Windows\System\hhRHVNA.exe
  2⤵
  PID:8512
- C:\Windows\System\dpCYIJU.exe
  C:\Windows\System\dpCYIJU.exe
  2⤵
  PID:8528
- C:\Windows\System\UuoLlAa.exe
  C:\Windows\System\UuoLlAa.exe
  2⤵
  PID:8544
- C:\Windows\System\xFeazzg.exe
  C:\Windows\System\xFeazzg.exe
  2⤵
  PID:8560
- C:\Windows\System\RIZzoRT.exe
  C:\Windows\System\RIZzoRT.exe
  2⤵
  PID:8576
- C:\Windows\System\cardhrf.exe
  C:\Windows\System\cardhrf.exe
  2⤵
  PID:8592
- C:\Windows\System\GmnoROH.exe
  C:\Windows\System\GmnoROH.exe
  2⤵
  PID:8608
- C:\Windows\System\iTPrinN.exe
  C:\Windows\System\iTPrinN.exe
  2⤵
  PID:8624
- C:\Windows\System\JjYADhr.exe
  C:\Windows\System\JjYADhr.exe
  2⤵
  PID:8640
- C:\Windows\System\ozYJpGl.exe
  C:\Windows\System\ozYJpGl.exe
  2⤵
  PID:8656
- C:\Windows\System\zhIgKRw.exe
  C:\Windows\System\zhIgKRw.exe
  2⤵
  PID:8672
- C:\Windows\System\yrZYRAx.exe
  C:\Windows\System\yrZYRAx.exe
  2⤵
  PID:8688
- C:\Windows\System\jvbBeAa.exe
  C:\Windows\System\jvbBeAa.exe
  2⤵
  PID:8704
- C:\Windows\System\ixMfORy.exe
  C:\Windows\System\ixMfORy.exe
  2⤵
  PID:8720
- C:\Windows\System\VYmPuAd.exe
  C:\Windows\System\VYmPuAd.exe
  2⤵
  PID:8736
- C:\Windows\System\GLqYhaV.exe
  C:\Windows\System\GLqYhaV.exe
  2⤵
  PID:8752
- C:\Windows\System\CncdtEP.exe
  C:\Windows\System\CncdtEP.exe
  2⤵
  PID:8768
- C:\Windows\System\swRrPAA.exe
  C:\Windows\System\swRrPAA.exe
  2⤵
  PID:8784
- C:\Windows\System\IPTRGRS.exe
  C:\Windows\System\IPTRGRS.exe
  2⤵
  PID:8800
- C:\Windows\System\ednmCRP.exe
  C:\Windows\System\ednmCRP.exe
  2⤵
  PID:8816
- C:\Windows\System\ePNgdwg.exe
  C:\Windows\System\ePNgdwg.exe
  2⤵
  PID:8832
- C:\Windows\System\sNRsFCl.exe
  C:\Windows\System\sNRsFCl.exe
  2⤵
  PID:8848
- C:\Windows\System\XhLAoZi.exe
  C:\Windows\System\XhLAoZi.exe
  2⤵
  PID:8864
- C:\Windows\System\cZyCqVi.exe
  C:\Windows\System\cZyCqVi.exe
  2⤵
  PID:8880
- C:\Windows\System\rqgnCwJ.exe
  C:\Windows\System\rqgnCwJ.exe
  2⤵
  PID:8896
- C:\Windows\System\ivfFBeL.exe
  C:\Windows\System\ivfFBeL.exe
  2⤵
  PID:8912
- C:\Windows\System\YAyHwDc.exe
  C:\Windows\System\YAyHwDc.exe
  2⤵
  PID:8928
- C:\Windows\System\AgYVRMv.exe
  C:\Windows\System\AgYVRMv.exe
  2⤵
  PID:8944
- C:\Windows\System\yfmZyCE.exe
  C:\Windows\System\yfmZyCE.exe
  2⤵
  PID:8960
- C:\Windows\System\wMVfAPR.exe
  C:\Windows\System\wMVfAPR.exe
  2⤵
  PID:8976
- C:\Windows\System\TIljPcl.exe
  C:\Windows\System\TIljPcl.exe
  2⤵
  PID:8992
- C:\Windows\System\RbMvjwG.exe
  C:\Windows\System\RbMvjwG.exe
  2⤵
  PID:9008
- C:\Windows\System\ILIJbda.exe
  C:\Windows\System\ILIJbda.exe
  2⤵
  PID:9040
- C:\Windows\System\qfBQjYc.exe
  C:\Windows\System\qfBQjYc.exe
  2⤵
  PID:9056
- C:\Windows\System\ldVGzaZ.exe
  C:\Windows\System\ldVGzaZ.exe
  2⤵
  PID:9072
- C:\Windows\System\CLVPbQq.exe
  C:\Windows\System\CLVPbQq.exe
  2⤵
  PID:9088
- C:\Windows\System\fMxVGIG.exe
  C:\Windows\System\fMxVGIG.exe
  2⤵
  PID:9104
- C:\Windows\System\YmHfxuq.exe
  C:\Windows\System\YmHfxuq.exe
  2⤵
  PID:9120
- C:\Windows\System\hLkbFrg.exe
  C:\Windows\System\hLkbFrg.exe
  2⤵
  PID:9136
- C:\Windows\System\cPFCXpH.exe
  C:\Windows\System\cPFCXpH.exe
  2⤵
  PID:9152
- C:\Windows\System\UMyiJKA.exe
  C:\Windows\System\UMyiJKA.exe
  2⤵
  PID:9168
- C:\Windows\System\YyuxFQF.exe
  C:\Windows\System\YyuxFQF.exe
  2⤵
  PID:9184
- C:\Windows\System\eFUDiNB.exe
  C:\Windows\System\eFUDiNB.exe
  2⤵
  PID:9200
- C:\Windows\System\hguuGOi.exe
  C:\Windows\System\hguuGOi.exe
  2⤵
  PID:7908
- C:\Windows\System\ffStcLv.exe
  C:\Windows\System\ffStcLv.exe
  2⤵
  PID:8196
- C:\Windows\System\cnUZndc.exe
  C:\Windows\System\cnUZndc.exe
  2⤵
  PID:8264
- C:\Windows\System\aeoYPRu.exe
  C:\Windows\System\aeoYPRu.exe
  2⤵
  PID:7352
- C:\Windows\System\qlfYBjx.exe
  C:\Windows\System\qlfYBjx.exe
  2⤵
  PID:8328
- C:\Windows\System\hmBLRes.exe
  C:\Windows\System\hmBLRes.exe
  2⤵
  PID:8364
- C:\Windows\System\nkDqrGy.exe
  C:\Windows\System\nkDqrGy.exe
  2⤵
  PID:8248
- C:\Windows\System\lZMUBnG.exe
  C:\Windows\System\lZMUBnG.exe
  2⤵
  PID:8396
- C:\Windows\System\AaZkhFW.exe
  C:\Windows\System\AaZkhFW.exe
  2⤵
  PID:8344
- C:\Windows\System\wFlJWKM.exe
  C:\Windows\System\wFlJWKM.exe
  2⤵
  PID:8460
- C:\Windows\System\sWTOXTC.exe
  C:\Windows\System\sWTOXTC.exe
  2⤵
  PID:8488
- C:\Windows\System\jbNFQEU.exe
  C:\Windows\System\jbNFQEU.exe
  2⤵
  PID:8552
- C:\Windows\System\Ubfwkac.exe
  C:\Windows\System\Ubfwkac.exe
  2⤵
  PID:8440
- C:\Windows\System\jqloKFl.exe
  C:\Windows\System\jqloKFl.exe
  2⤵
  PID:8504
- C:\Windows\System\pvYnpZn.exe
  C:\Windows\System\pvYnpZn.exe
  2⤵
  PID:8568
- C:\Windows\System\uoNdBsc.exe
  C:\Windows\System\uoNdBsc.exe
  2⤵
  PID:8616
- C:\Windows\System\nkcdVqg.exe
  C:\Windows\System\nkcdVqg.exe
  2⤵
  PID:8680
- C:\Windows\System\vQfFzwQ.exe
  C:\Windows\System\vQfFzwQ.exe
  2⤵
  PID:8696
- C:\Windows\System\QgmKuCB.exe
  C:\Windows\System\QgmKuCB.exe
  2⤵
  PID:8668
- C:\Windows\System\bCJBCmN.exe
  C:\Windows\System\bCJBCmN.exe
  2⤵
  PID:8744
- C:\Windows\System\RfhvhsL.exe
  C:\Windows\System\RfhvhsL.exe
  2⤵
  PID:8780
- C:\Windows\System\PDCVeyC.exe
  C:\Windows\System\PDCVeyC.exe
  2⤵
  PID:8796
- C:\Windows\System\LJjdUby.exe
  C:\Windows\System\LJjdUby.exe
  2⤵
  PID:8844
- C:\Windows\System\sldpvUU.exe
  C:\Windows\System\sldpvUU.exe
  2⤵
  PID:8860
- C:\Windows\System\ggNxoOk.exe
  C:\Windows\System\ggNxoOk.exe
  2⤵
  PID:8936
- C:\Windows\System\dYqStRL.exe
  C:\Windows\System\dYqStRL.exe
  2⤵
  PID:9000
- C:\Windows\System\oAZknuS.exe
  C:\Windows\System\oAZknuS.exe
  2⤵
  PID:8988
- C:\Windows\System\LRefxnf.exe
  C:\Windows\System\LRefxnf.exe
  2⤵
  PID:9016
- C:\Windows\System\FuDLotn.exe
  C:\Windows\System\FuDLotn.exe
  2⤵
  PID:9024
- C:\Windows\System\pEXAIxU.exe
  C:\Windows\System\pEXAIxU.exe
  2⤵
  PID:9048
- C:\Windows\System\DIMyvxJ.exe
  C:\Windows\System\DIMyvxJ.exe
  2⤵
  PID:9084
- C:\Windows\System\JgperTH.exe
  C:\Windows\System\JgperTH.exe
  2⤵
  PID:9116
- C:\Windows\System\gVEYDPB.exe
  C:\Windows\System\gVEYDPB.exe
  2⤵
  PID:9148
- C:\Windows\System\ALDbutm.exe
  C:\Windows\System\ALDbutm.exe
  2⤵
  PID:9164
- C:\Windows\System\bBXOWQj.exe
  C:\Windows\System\bBXOWQj.exe
  2⤵
  PID:9212
- C:\Windows\System\ePlePgl.exe
  C:\Windows\System\ePlePgl.exe
  2⤵
  PID:8296
- C:\Windows\System\AVUiYUN.exe
  C:\Windows\System\AVUiYUN.exe
  2⤵
  PID:7748
- C:\Windows\System\uEzWwmx.exe
  C:\Windows\System\uEzWwmx.exe
  2⤵
  PID:8216
- C:\Windows\System\JuaBZhV.exe
  C:\Windows\System\JuaBZhV.exe
  2⤵
  PID:8316
- C:\Windows\System\xZtOsvG.exe
  C:\Windows\System\xZtOsvG.exe
  2⤵
  PID:8584
- C:\Windows\System\AmveArp.exe
  C:\Windows\System\AmveArp.exe
  2⤵
  PID:8536
- C:\Windows\System\fwYwQgA.exe
  C:\Windows\System\fwYwQgA.exe
  2⤵
  PID:8652
- C:\Windows\System\yzRWMzT.exe
  C:\Windows\System\yzRWMzT.exe
  2⤵
  PID:8840
- C:\Windows\System\GjOIHkO.exe
  C:\Windows\System\GjOIHkO.exe
  2⤵
  PID:8376
- C:\Windows\System\xOOMXnI.exe
  C:\Windows\System\xOOMXnI.exe
  2⤵
  PID:8908
- C:\Windows\System\qPXmOvC.exe
  C:\Windows\System\qPXmOvC.exe
  2⤵
  PID:8604
- C:\Windows\System\IyzNiaY.exe
  C:\Windows\System\IyzNiaY.exe
  2⤵
  PID:8808
- C:\Windows\System\Rtzktdr.exe
  C:\Windows\System\Rtzktdr.exe
  2⤵
  PID:8888
- C:\Windows\System\EDHNPyI.exe
  C:\Windows\System\EDHNPyI.exe
  2⤵
  PID:8956
- C:\Windows\System\oItlxjs.exe
  C:\Windows\System\oItlxjs.exe
  2⤵
  PID:9080
- C:\Windows\System\TBgroAK.exe
  C:\Windows\System\TBgroAK.exe
  2⤵
  PID:9036
- C:\Windows\System\MfXJHZM.exe
  C:\Windows\System\MfXJHZM.exe
  2⤵
  PID:8020
- C:\Windows\System\tFkSEBV.exe
  C:\Windows\System\tFkSEBV.exe
  2⤵
  PID:8428
- C:\Windows\System\EddDbjt.exe
  C:\Windows\System\EddDbjt.exe
  2⤵
  PID:7624
- C:\Windows\System\yoPbqQD.exe
  C:\Windows\System\yoPbqQD.exe
  2⤵
  PID:8232
- C:\Windows\System\EVzlUAC.exe
  C:\Windows\System\EVzlUAC.exe
  2⤵
  PID:9160
- C:\Windows\System\iXnqCEz.exe
  C:\Windows\System\iXnqCEz.exe
  2⤵
  PID:8728
- C:\Windows\System\jMgzhBO.exe
  C:\Windows\System\jMgzhBO.exe
  2⤵
  PID:8924
- C:\Windows\System\iFIKVTy.exe
  C:\Windows\System\iFIKVTy.exe
  2⤵
  PID:7272
- C:\Windows\System\YQxxNnS.exe
  C:\Windows\System\YQxxNnS.exe
  2⤵
  PID:8456
- C:\Windows\System\NserAKT.exe
  C:\Windows\System\NserAKT.exe
  2⤵
  PID:8828
- C:\Windows\System\PLvQGqH.exe
  C:\Windows\System\PLvQGqH.exe
  2⤵
  PID:8760
- C:\Windows\System\TusBDvF.exe
  C:\Windows\System\TusBDvF.exe
  2⤵
  PID:8280
- C:\Windows\System\ojMRoKn.exe
  C:\Windows\System\ojMRoKn.exe
  2⤵
  PID:9100
- C:\Windows\System\WgjcJoR.exe
  C:\Windows\System\WgjcJoR.exe
  2⤵
  PID:8776
- C:\Windows\System\tbadviV.exe
  C:\Windows\System\tbadviV.exe
  2⤵
  PID:9224
- C:\Windows\System\QOkTAvM.exe
  C:\Windows\System\QOkTAvM.exe
  2⤵
  PID:9240
- C:\Windows\System\QpTYDGz.exe
  C:\Windows\System\QpTYDGz.exe
  2⤵
  PID:9256
- C:\Windows\System\RaISmxB.exe
  C:\Windows\System\RaISmxB.exe
  2⤵
  PID:9272
- C:\Windows\System\mbptzIe.exe
  C:\Windows\System\mbptzIe.exe
  2⤵
  PID:9292
- C:\Windows\System\CXJuUym.exe
  C:\Windows\System\CXJuUym.exe
  2⤵
  PID:9308
- C:\Windows\System\MJDnDcI.exe
  C:\Windows\System\MJDnDcI.exe
  2⤵
  PID:9324
- C:\Windows\System\POcQdEo.exe
  C:\Windows\System\POcQdEo.exe
  2⤵
  PID:9340
- C:\Windows\System\RlXICyw.exe
  C:\Windows\System\RlXICyw.exe
  2⤵
  PID:9356
- C:\Windows\System\joXBNtx.exe
  C:\Windows\System\joXBNtx.exe
  2⤵
  PID:9372
- C:\Windows\System\aXSjLOj.exe
  C:\Windows\System\aXSjLOj.exe
  2⤵
  PID:9388
- C:\Windows\System\nRjgnPD.exe
  C:\Windows\System\nRjgnPD.exe
  2⤵
  PID:9404
- C:\Windows\System\gZemHQJ.exe
  C:\Windows\System\gZemHQJ.exe
  2⤵
  PID:9424
- C:\Windows\System\PFjDcJU.exe
  C:\Windows\System\PFjDcJU.exe
  2⤵
  PID:9440
- C:\Windows\System\bxhNnyL.exe
  C:\Windows\System\bxhNnyL.exe
  2⤵
  PID:9504
- C:\Windows\System\PghMDvH.exe
  C:\Windows\System\PghMDvH.exe
  2⤵
  PID:9524
- C:\Windows\System\grjbtTR.exe
  C:\Windows\System\grjbtTR.exe
  2⤵
  PID:9540
- C:\Windows\System\GDukiyt.exe
  C:\Windows\System\GDukiyt.exe
  2⤵
  PID:9556
- C:\Windows\System\KxDboYB.exe
  C:\Windows\System\KxDboYB.exe
  2⤵
  PID:9572
- C:\Windows\System\gbEdnUq.exe
  C:\Windows\System\gbEdnUq.exe
  2⤵
  PID:9588
- C:\Windows\System\gVmQosK.exe
  C:\Windows\System\gVmQosK.exe
  2⤵
  PID:9604
- C:\Windows\System\mrtlOAH.exe
  C:\Windows\System\mrtlOAH.exe
  2⤵
  PID:9620
- C:\Windows\System\lKrqPIe.exe
  C:\Windows\System\lKrqPIe.exe
  2⤵
  PID:9636
- C:\Windows\System\BAYhiHJ.exe
  C:\Windows\System\BAYhiHJ.exe
  2⤵
  PID:9660
- C:\Windows\System\NbUMFak.exe
  C:\Windows\System\NbUMFak.exe
  2⤵
  PID:9676
- C:\Windows\System\jLeMVgn.exe
  C:\Windows\System\jLeMVgn.exe
  2⤵
  PID:9692
- C:\Windows\System\iXBMhfA.exe
  C:\Windows\System\iXBMhfA.exe
  2⤵
  PID:9708
- C:\Windows\System\UoNKUwg.exe
  C:\Windows\System\UoNKUwg.exe
  2⤵
  PID:9724
- C:\Windows\System\rRuYmsO.exe
  C:\Windows\System\rRuYmsO.exe
  2⤵
  PID:9740
- C:\Windows\System\RCJvjox.exe
  C:\Windows\System\RCJvjox.exe
  2⤵
  PID:9756
- C:\Windows\System\niQnKUd.exe
  C:\Windows\System\niQnKUd.exe
  2⤵
  PID:9772
- C:\Windows\System\ksSBjhT.exe
  C:\Windows\System\ksSBjhT.exe
  2⤵
  PID:9788
- C:\Windows\System\AtgolyK.exe
  C:\Windows\System\AtgolyK.exe
  2⤵
  PID:9804
- C:\Windows\System\TChWvZl.exe
  C:\Windows\System\TChWvZl.exe
  2⤵
  PID:9820
- C:\Windows\System\kbMumye.exe
  C:\Windows\System\kbMumye.exe
  2⤵
  PID:9836
- C:\Windows\System\TMPrSiB.exe
  C:\Windows\System\TMPrSiB.exe
  2⤵
  PID:9852
- C:\Windows\System\ZpnIRKo.exe
  C:\Windows\System\ZpnIRKo.exe
  2⤵
  PID:9868
- C:\Windows\System\OmoLqHP.exe
  C:\Windows\System\OmoLqHP.exe
  2⤵
  PID:9884
- C:\Windows\System\aSdftpS.exe
  C:\Windows\System\aSdftpS.exe
  2⤵
  PID:9900
- C:\Windows\System\NzerWIU.exe
  C:\Windows\System\NzerWIU.exe
  2⤵
  PID:9916
- C:\Windows\System\hwdXiIP.exe
  C:\Windows\System\hwdXiIP.exe
  2⤵
  PID:9932
- C:\Windows\System\fdtVRGo.exe
  C:\Windows\System\fdtVRGo.exe
  2⤵
  PID:9948
- C:\Windows\System\oeZduGg.exe
  C:\Windows\System\oeZduGg.exe
  2⤵
  PID:9964
- C:\Windows\System\nxfcSOG.exe
  C:\Windows\System\nxfcSOG.exe
  2⤵
  PID:9980
- C:\Windows\System\HEpbnkF.exe
  C:\Windows\System\HEpbnkF.exe
  2⤵
  PID:9996
- C:\Windows\System\WbgVqmB.exe
  C:\Windows\System\WbgVqmB.exe
  2⤵
  PID:10056
- C:\Windows\System\rdejoru.exe
  C:\Windows\System\rdejoru.exe
  2⤵
  PID:10072
- C:\Windows\System\TRhiBlC.exe
  C:\Windows\System\TRhiBlC.exe
  2⤵
  PID:10088
- C:\Windows\System\jEpoWwj.exe
  C:\Windows\System\jEpoWwj.exe
  2⤵
  PID:10144
- C:\Windows\System\RaefgQd.exe
  C:\Windows\System\RaefgQd.exe
  2⤵
  PID:10160
- C:\Windows\System\FeZATgt.exe
  C:\Windows\System\FeZATgt.exe
  2⤵
  PID:10176
- C:\Windows\System\UBewrSk.exe
  C:\Windows\System\UBewrSk.exe
  2⤵
  PID:10192
- C:\Windows\System\SrJXbKR.exe
  C:\Windows\System\SrJXbKR.exe
  2⤵
  PID:10208
- C:\Windows\System\kfCovrK.exe
  C:\Windows\System\kfCovrK.exe
  2⤵
  PID:10224
- C:\Windows\System\HoqnLHd.exe
  C:\Windows\System\HoqnLHd.exe
  2⤵
  PID:8392
- C:\Windows\System\BruuvLt.exe
  C:\Windows\System\BruuvLt.exe
  2⤵
  PID:9236
- C:\Windows\System\ACFdqJj.exe
  C:\Windows\System\ACFdqJj.exe
  2⤵
  PID:9300
- C:\Windows\System\qotHFhT.exe
  C:\Windows\System\qotHFhT.exe
  2⤵
  PID:8984
- C:\Windows\System\DAxMOFS.exe
  C:\Windows\System\DAxMOFS.exe
  2⤵
  PID:9280
- C:\Windows\System\fGQUYbL.exe
  C:\Windows\System\fGQUYbL.exe
  2⤵
  PID:9432
- C:\Windows\System\FiLvkUA.exe
  C:\Windows\System\FiLvkUA.exe
  2⤵
  PID:9252
- C:\Windows\System\ywUthyx.exe
  C:\Windows\System\ywUthyx.exe
  2⤵
  PID:9448
- C:\Windows\System\vrpJlsl.exe
  C:\Windows\System\vrpJlsl.exe
  2⤵
  PID:9420
- C:\Windows\System\eozPBhB.exe
  C:\Windows\System\eozPBhB.exe
  2⤵
  PID:9384
- C:\Windows\System\ZuckIxq.exe
  C:\Windows\System\ZuckIxq.exe
  2⤵
  PID:9464
- C:\Windows\System\nelNBbF.exe
  C:\Windows\System\nelNBbF.exe
  2⤵
  PID:9476
- C:\Windows\System\cBJYogW.exe
  C:\Windows\System\cBJYogW.exe
  2⤵
  PID:9512
- C:\Windows\System\kkyWtnx.exe
  C:\Windows\System\kkyWtnx.exe
  2⤵
  PID:9580
- C:\Windows\System\aQYgmRe.exe
  C:\Windows\System\aQYgmRe.exe
  2⤵
  PID:9656
- C:\Windows\System\FAXiodU.exe
  C:\Windows\System\FAXiodU.exe
  2⤵
  PID:9652
- C:\Windows\System\fSoqHEV.exe
  C:\Windows\System\fSoqHEV.exe
  2⤵
  PID:9720
- C:\Windows\System\KTgKqCY.exe
  C:\Windows\System\KTgKqCY.exe
  2⤵
  PID:9596
- C:\Windows\System\PYmvVmz.exe
  C:\Windows\System\PYmvVmz.exe
  2⤵
  PID:9500
- C:\Windows\System\deXhjFX.exe
  C:\Windows\System\deXhjFX.exe
  2⤵
  PID:9732
- C:\Windows\System\LUmjXjT.exe
  C:\Windows\System\LUmjXjT.exe
  2⤵
  PID:9668
- C:\Windows\System\DxRGasz.exe
  C:\Windows\System\DxRGasz.exe
  2⤵
  PID:9764
- C:\Windows\System\ZgyVgAO.exe
  C:\Windows\System\ZgyVgAO.exe
  2⤵
  PID:9796
- C:\Windows\System\lpzCxFE.exe
  C:\Windows\System\lpzCxFE.exe
  2⤵
  PID:9800
- C:\Windows\System\xEvcgBm.exe
  C:\Windows\System\xEvcgBm.exe
  2⤵
  PID:9876
- C:\Windows\System\ldpPuSc.exe
  C:\Windows\System\ldpPuSc.exe
  2⤵
  PID:9908
- C:\Windows\System\RDUXGqi.exe
  C:\Windows\System\RDUXGqi.exe
  2⤵
  PID:9940
- C:\Windows\System\sOGnOhq.exe
  C:\Windows\System\sOGnOhq.exe
  2⤵
  PID:9956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\DFWYTBL.exe

Filesize
2.2MB

MD5
52e4824bd1b8d33dc802f9a4a17612f9

SHA1
7f01ae4b7eeddb049ae7cdce6194fc9afd2328af

SHA256
72a54dcb3ff2031a8f78cb325edc404c6ad1b87da0dcf80148c8c2ba9b9591a3

SHA512
6da46bea91310fdc65f22cf288650e4e9723265e45e5b634944c049ca6274a5f6ddc5f9f4bfb526d8172164d993c94c5324e7b183aefead6395727712e1d18aa

Download Submit
C:\Windows\system\FWajFke.exe

Filesize
2.2MB

MD5
cf735379650fbe151ab7d95be283124f

SHA1
84ba3fee026610ecfddd63d32351364be68723c1

SHA256
2568c99e4eaedf1462adc3a3eee9630c5d0d86b2ccdf7071b971a1d41809c78d

SHA512
a4481d8aab5285f90a39b0a259043fb3957dfbc4e053d69900528a57466b117fbe8286a59898d5f70bc4cb5ec75ec07ebe3b54d36a00ce327f84e2e222d88c59

Download Submit
C:\Windows\system\FkPADgK.exe

Filesize
2.2MB

MD5
b4b184b857b95427bc2b798a3aa3e492

SHA1
69e0d09a43b450b7a5072a27ca0c34ff413477d0

SHA256
941e05728119bbce68449b72d215cbebeacf124a139056461774f09566c6ff9a

SHA512
dd8047df39ef29ee11785f0041ff2145095667067b077d3d8f97b12eaaf8d7d4c60c66fe20a40c69d02947c6347cd174788be1a4830a04e324d3269bbd178833

Download Submit
C:\Windows\system\HHbfnnt.exe

Filesize
2.2MB

MD5
47aaceb9dec2f9e26d6fb251c2ec0ec7

SHA1
30571442e7c59b40cdc55530f54ba97144b3d490

SHA256
b5c5e8c998847616cf791727a1fbeb954925754e033c2235c8e7974ba600bfa0

SHA512
16241211b944ae9f94fbb767f51e4b5c5912f3c4078afcc1fb822d6c9659dc4d31ba6abd5192c5fd30260112fa15e0330eede8fc7f3b35783409ffe38bc0ad89

Download Submit
C:\Windows\system\HsdPDhB.exe

Filesize
2.2MB

MD5
434243dc1c5091e8a718528dd88b665f

SHA1
e94214c405f2e22d3e233d81215382c7cd1280b6

SHA256
46161f43c819f821eca7d3533aa01cf23f5174b8aa18972795df22e96732af1c

SHA512
11707d1604d592b782ee437676b6f95b2f746eac6c8496a488b26c6f55280103ffc32ebcbe573cac4a6f060f654a021f93202f4f9ef95993d2cb4f1e9e9e5cd3

Download Submit
C:\Windows\system\JZokxzU.exe

Filesize
2.2MB

MD5
d413a72175e7161bc8b41207c67f2deb

SHA1
9ee69946cf992fa82de01d59b8067a436a1f9072

SHA256
f8c6f463b9ad31cad6f1523477db7b8dc06ed8f92d2c219af3cf457d3e86a14b

SHA512
6cd2d9cafa88180993e4bd0a38941dc657452804470b4c7ac08b98b901a925f3b6c8d53cb6f7b4aac6f62f53de6923efb2cc2fd51e33ad1e514fe53fff2eaf76

Download Submit
C:\Windows\system\MBKMoju.exe

Filesize
2.2MB

MD5
f05e9d8beb618d526abc5031bd821bfb

SHA1
f4cda954d7fbd881b29f8c4f668c062db79bbf1a

SHA256
4115f4b451b094da14a588bdec6f48efabf9a36c7c6415ecb064569752b8136d

SHA512
2d88862cbcbbc0efb929afdde812b645c90769ec71dafd5cb5036bdd6a5d148002df8ea157a064491b8b036e737a4b3b68569ad33f1f926b4e16a38a6720ce6c

Download Submit
C:\Windows\system\QKRLaRE.exe

Filesize
2.2MB

MD5
2e51314bdce645ddf0cd3bae60ffe3e6

SHA1
92f2d98fc96cdd104f06a4f34b950558a983e835

SHA256
09d867f6f10c6b7b79ab838c3767d578241100bbdbb6930c9be68d8b4a93e555

SHA512
3040c81541845b64de598797c9a78dc9c6663d8c45535c88363a70f399525aaea9152794bf355b8b76903b8c70ab4a7a8c484239917717ad175c7e94bfb3912d

Download Submit
C:\Windows\system\VKtlFDs.exe

Filesize
2.2MB

MD5
09d13fc48563ade83a195f8316cac307

SHA1
448e5af34860a42ba593299245934a398b467fb3

SHA256
f4fa5fae7457d2277f013786e713af1ccf056d96e0a2b20f5660721ca9b4efc7

SHA512
ffc7ce7bcd7ed5771ee4f682f6f21ed295966400d8cbb4cb8df7e3364a02f1338f9ea8b44720a15131207c04abf79877f090115db0d9812aa63695ae17ce7f9e

Download Submit
C:\Windows\system\VWmsdQh.exe

Filesize
2.2MB

MD5
0ff3e4f4e81c23e3eb0494f67d160e5c

SHA1
0b9aef2e67542a45bba8eec6bfd5cbc65c407602

SHA256
48c206e52ee8a25b168d2fdda7130f6dfff4d50cf62773eb7557ffd4725144c1

SHA512
3ef432a16ae938c2d04d36ea8a4450557516416d69c8f41d28076a94b048311a8347efb15c3952049f95d3b244c5a40760b2520357e7c85d7dcb6b398641a42d

Download Submit
C:\Windows\system\XENpseN.exe

Filesize
2.2MB

MD5
93a5ebf77400872ff26a996d216ce01c

SHA1
1fbe3dcf6215cba3e10c4f2b806c21e385fcc07f

SHA256
48cf1fd7f51eb2ec5a725452e8811478aeddd32be5cf0be1654171d6154b6175

SHA512
2349c120fe2a9ffdea7b80c12b727f10f6b74e2f2771102265c1637abb3ef03fb751c7c970e9feee676a6abf52a9d64316699666a8e5ac2218496f1d0ac9e9c7

Download Submit
C:\Windows\system\YZnVWiJ.exe

Filesize
2.2MB

MD5
93fc910371f55b101727804bdb46043a

SHA1
8edfe746042012f733a43b1dab4fad2826720d42

SHA256
0e37029b08a39ff603182d07f3209980822fbd71ee7160d33ded65cd823bbe0f

SHA512
f76a08dcfe6e0487e9349727bd980db36ab8748a32a928f2d21c0504bffee17fbed782da694f8b1c811d514a7afc5dad931facd9d82e18a4125e3cfa9f1053f7

Download Submit
C:\Windows\system\ZjZMefa.exe

Filesize
2.2MB

MD5
8f53a6764a64cc259bf5cdbf180bd200

SHA1
344ec5bde0652c24f67b979234c5d5b146da0671

SHA256
b72e7b46500e0a4a35d323835ae107a982055d83b81b52692df5fd174c5abc6d

SHA512
86c253475ae6f8140f270bb3fd8661cd6927a6a03725f653c83703e6457fc11daf68a207050e8b813997dcbe812e11ce990cbde975964a70823f3df1c7dcd6ff

Download Submit
C:\Windows\system\dLpbYim.exe

Filesize
2.2MB

MD5
8e7735b8173134f5050e4a6dde0cff99

SHA1
496b8d574ec8aef5bbfcb7ab5e4275a40b23d9b2

SHA256
3ce95655d5d80ca92dcbae8dfd67f457cfc942eaa19aa8894183538644621f88

SHA512
08c3c9ed29855eaef3ee756a4288e8fe6dc8329e1a302c4ff70cc9544c409721e88fa2e1b433139b92ee27a28f92806208c7eca467da9ff90ba89639643cf822

Download Submit
C:\Windows\system\fkLUaEs.exe

Filesize
2.2MB

MD5
c0d789ce75583d61c78bb3fce7274903

SHA1
fbe1ce60558745576205f197ad11618ff4ade780

SHA256
9aa638a00f5272800f1dd2487c42df6c34ae848e9aa219512c53c20eda4c16c0

SHA512
23a398e7ad416a31e3bf94bc73dc4088dd4d0b235c73a081961b8a139135433dd0ff6d1ea5197d353b870651bc1eb5ffee2fcd798d44a6d817670052b50fa220

Download Submit
C:\Windows\system\hSWixHF.exe

Filesize
2.2MB

MD5
71bf0c2db49db730aaad73c77fc999a7

SHA1
808ff1e05124c57c586081442b1b62bb5eb54f42

SHA256
5b627999674b3c81fb7455c77dc8e7d11c4f4a4d144e64ebf05b814b3236a2e7

SHA512
d0991703f6251e39f98b2f9e7a28054f1f6bc9bb96c089d911e1725caa1b489bd9e81d5972698ab1a093a2294608e2dfe9314b05dad1b62c3763bcab7d3db226

Download Submit
C:\Windows\system\mPUpiAo.exe

Filesize
2.2MB

MD5
3ab9c7a1999d5d29aba5c37798e5cb85

SHA1
606095826f9a2c15010945dec239efac554eaad1

SHA256
e34b7fd1356bfcef10afb261c2f115f13d208e8198274462652602de992ce9f4

SHA512
436c4c1607ac0fe75058afcfa4cf89d0e14aa93b53e5cb04a303b021b6d4f7aaafa2302d1098998a912f04c1d6c1731eea0cc510f50904e9a55b681658ca1144

Download Submit
C:\Windows\system\naXlmeq.exe

Filesize
2.2MB

MD5
fd12d7aee9367382e7abae8709c7d832

SHA1
00bbc35ba0cdf365da28ae4f027fe3eb4ba7fb7a

SHA256
5f296d614aeaa872ed3fd36ba39feb55a6eb8a232c9bb9680536f600cb2e5f90

SHA512
8f409fcd4cb29aed40eaf1682acf1c2553b83facfcc93be44d1b525c5220eb77136a25307e5a1d49fd6c84eeba733a9fff256242991352f5303e6ff72ac22e1d

Download Submit
C:\Windows\system\pBIKZlN.exe

Filesize
2.2MB

MD5
1dda83216abcd96d38adcb505118c04a

SHA1
4d7566e4402a8bb6117cecdf19620c1c6a543127

SHA256
bb9c76b9132f7633620817d02e6d3cb9ea768733b32a0e73a8f223186133fdf2

SHA512
89983ce0bf42e74d12360a1d811256da18bb393bd1a9fb5fa0ff2f6c5ac531f3e103e95fbea502cb8055b25a2cefd66d7fff771aa53d561f3c32cfb90215e21b

Download Submit
C:\Windows\system\pLkICjy.exe

Filesize
2.2MB

MD5
136e1078addd05c490f94fda18236f1c

SHA1
91f535111f890118156df6cc0f8aacd061e04fc2

SHA256
0e7abea35105af5ed9e264be2d97a224c9db596da7244d5ae8615e9b20d22ff0

SHA512
ec40145351b522a7b9a6bec9c49a0af53c6008b0467165af77a77a31e703d7a052977e7e77ba6ea8a77db40085c0e3f25e361dc34ff17eadcf2d6a962217d8ff

Download Submit
C:\Windows\system\pYjqaWt.exe

Filesize
2.2MB

MD5
4e8900952312fe170df571d6af6fe444

SHA1
5a086de92cce292de36c3337ff6af716a8ff8454

SHA256
34a7162c9a0a0b2533abd502696595d39333cb21b0a03698c17997e0fb4d1253

SHA512
079ffb1780cbe6a414c80b3f157e5cba80e9b792ea6db877d569a11fb318f318b84f440206d11e5238200e2630e9866fa70c0213ae788508eefc0c1b36d3297e

Download Submit
C:\Windows\system\pdciiwQ.exe

Filesize
2.2MB

MD5
1576176c046a01db5d7460dc617bf0e1

SHA1
b8d0868efe21cdd8aedeea4ecc2886685f42e25d

SHA256
9baaa25094190b82f5a89b13637dedba3d500e6be3eb2a23d0cf5157a3141011

SHA512
64b408f214c8a49d860f1d1c739ce1ff6b3aa691766013f8407fb119bee326730be1ea10ecb753f8afe30fbb623c6d66a3f21e88a8325522acc9153fcfecb689

Download Submit
C:\Windows\system\snMAlxb.exe

Filesize
2.2MB

MD5
309aac18ce8a666b6269d64f96c70313

SHA1
5d2ceda56cf0ee657a75a2a070e279fe963a5144

SHA256
5c2caab64d26f9741e6d37d592e19148679517b16636eeec2e40e936aae151d6

SHA512
6b44aa1817f58f57821861a6b55057b2a24015d2567e1be81ac6f72625a8eeb305ab4a785be19350f4088637a666955f58eb56a2a6445e4b5fdc6d95cc56fa5b

Download Submit
C:\Windows\system\uOaFBfy.exe

Filesize
2.2MB

MD5
885a1285ea7f83bcfd339667796ed98b

SHA1
2d1eced0ae1407f4d4ab3fd9428d143073dbbffb

SHA256
76a2ca0be6f4b52c96607632189a0275efac39b6652ddc1acb7e62ff0a524530

SHA512
1311ab0bf352ebe94ddfbd8f3c017950e3ebd143ba3702c5fd08d47e3e7f8bfe98c27a41337c66bb7bdaa6c4e3ffa468a93c9677185c38aebe05b85c16a7cb90

Download Submit
C:\Windows\system\uvIEMvA.exe

Filesize
2.2MB

MD5
52e872a740eeddba15330aae082d6c1e

SHA1
36b94bb561232a45661dcd281595fc26a0a2ada4

SHA256
cc00a75bc260ad0f36430b5fc87041ca0da540931215a78ab6265cf42e3175bb

SHA512
a85ef19456eef88468fb79c1b1c28c8ea86acc058950a76c7197660a9d94291faa8e06c15b5b93ff1a68682a7e6a2352bec4637c3a2035bc84e762702be9e56e

Download Submit
C:\Windows\system\vLRcTZi.exe

Filesize
2.2MB

MD5
4c68ca74e9bb080b7ad736325f83122b

SHA1
8af9ea18ba784c6dda7e7e82f66594f9f5dedc3b

SHA256
1aa87f934a8ac7f3a4ec16f5edb4ee8bcc67e2855ca4a74d51deb38db7dbd50b

SHA512
bfd9d857aeb75dc0a373b4fd26ecdbb5b60b0c970f5b4e7694892a612480be0c5377b188284e945599ece925919d0322124507150ac6bb1b163443ebdd041c08

Download Submit
C:\Windows\system\vmwiJKq.exe

Filesize
2.2MB

MD5
780450118018d616c9b8dd06d0134d05

SHA1
2855f4c70eb7a1df19863adb11d6a0fb11995672

SHA256
b1eb74f1f849c79e08e62e6674f0f007daee8c409d7a8db63b38da1a00c77ffc

SHA512
04665200c162c528a55a59e8c0766604b4a63f6a943563be6a40ba703a26d9af2ff033ca34e761732dbaf906791577c8de4dba04a0ecde30860c023ff72708d1

Download Submit
C:\Windows\system\vvMEkwD.exe

Filesize
2.2MB

MD5
1a08e7c145f41568e30210c8f98967fe

SHA1
63f0139fbf73152fb0727d01314ad3e45340c903

SHA256
35a3cc59fcad8a217ed54cc13ae8587fa4a75396aacb692ee133244f67a72014

SHA512
44991001c79fda98890591924d4e80f0e388bf9563ff26bb4a3bebc53177e100b930016a7462ee220123129e23f25e6cab7b3d05a79b7401784bd06494dc3bdf

Download Submit
C:\Windows\system\yUGwPES.exe

Filesize
2.2MB

MD5
37fa46e3d6e4c66fa87e630471915184

SHA1
73cee1ee31959a4c137a018376d1fc2acc30b8b5

SHA256
90b9e74a3f8379407ef690e1e8fa8fa069da232cc5f684bc5367dd6128394255

SHA512
22c58fb1b27bf3b85814e7f91e5f812811447fded7ce235bda2ef3778a612f992740654e7886bbe83de8d42436228ca6f6a6f9cf0809f779facdcda8298ca53c

Download Submit
\Windows\system\WopVsob.exe

Filesize
2.2MB

MD5
f22e39b908068d194c5a3647822628fa

SHA1
20e65e0c76e384c30e2b57d945e203c598ee1536

SHA256
5ffccc1e0d314d250fbbb05e982b07a54d7845fa7a959a5201863519da73086b

SHA512
7c9698bd1f6b25c022a3fee783e79a0707ced0a54914eb299dd349395e98e71f9ba012c1d29e60c7043a6b00ef6b86d7e09424a1f846537f45706ecb36f253d0

Download Submit
\Windows\system\aFFMGkX.exe

Filesize
2.2MB

MD5
abb18b4685beb0bb9927832a20d03018

SHA1
ff59a14369076f34aa494f1bd1d6be716237f900

SHA256
f7cd09b891c2ae4f24f56a0f7564a24cb5277fd207ad7ffa21cc28fce5d8f200

SHA512
6b4a84ca098a1fba0e0223831a493e7b255929c97481969a01af0113b887365227346da37c1790ab5eed57f7c7e5e27aa71064c1298a0f144271c3a646ebf644

Download Submit
\Windows\system\ldNtDzS.exe

Filesize
2.2MB

MD5
067621cb86cd64a4f71f265c0bb996e1

SHA1
dc41f2d9d584212126b613005374d53c433e3410

SHA256
af22685bb42472e26aeb1143140b8c11783b0c3ea198208231f0d9244d777c25

SHA512
422c876bc09e1cfabada2d869dea8d29ab647262c452f47be5ad984653639475e75d6c94ec83429cd18d86a7b4973feca700ab9e160d4dae0ea55855931297f2

Download Submit
memory/1884-16-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2036-85-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-0-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-109-0x000000013F130000-0x000000013F522000-memory.dmp

Filesize
3.9MB

Download
memory/2036-1-0x00000000002F0000-0x0000000000300000-memory.dmp

Filesize
64KB

Download
memory/2036-107-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2036-105-0x0000000003110000-0x0000000003502000-memory.dmp

Filesize
3.9MB

Download
memory/2036-58-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2036-103-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2036-11-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-101-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2036-15-0x000000013FB90000-0x000000013FF82000-memory.dmp

Filesize
3.9MB

Download
memory/2036-97-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2200-56-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2200-55-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-113-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-54-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2200-446-0x000007FEF52B0000-0x000007FEF5C4D000-memory.dmp

Filesize
9.6MB

Download
memory/2200-68-0x0000000002240000-0x0000000002248000-memory.dmp

Filesize
32KB

Download
memory/2200-57-0x0000000002BF0000-0x0000000002C70000-memory.dmp

Filesize
512KB

Download
memory/2472-98-0x000000013FD70000-0x0000000140162000-memory.dmp

Filesize
3.9MB

Download
memory/2616-86-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2664-106-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2692-108-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2700-84-0x000000013F070000-0x000000013F462000-memory.dmp

Filesize
3.9MB

Download
memory/2704-102-0x000000013FFD0000-0x00000001403C2000-memory.dmp

Filesize
3.9MB

Download
memory/2708-104-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2936-12-0x000000013FEE0000-0x00000001402D2000-memory.dmp

Filesize
3.9MB

Download