xmrig | 1ff17cb4eaf247a53a485383156ab08b1709d5704f6a2ca638be00654cbdaa28

Analysis

max time kernel
18s
max time network
20s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
Size

2.2MB
MD5

0906b325223b86adf9ad51a3065d02ba
SHA1

80e184e592f3041f4003327cda595716a48e92a7
SHA256

1ff17cb4eaf247a53a485383156ab08b1709d5704f6a2ca638be00654cbdaa28
SHA512

b238d6084a0e58c049b35cb34cfffaa676c8fe1dd2483912349b2d4eb1b66b79b4738f1d3c421e804266feb32bbe76ba7a761ea43a1324de77c0a5c8d4b74692
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1Vr5s1PTWsuT9ceb:NAB4

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2944-161-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig
behavioral1/memory/2600-160-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2668-159-0x000000013F9A0000-0x000000013FD92000-memory.dmp	xmrig
behavioral1/memory/2632-157-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	xmrig
behavioral1/memory/2584-188-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2728-187-0x000000013F040000-0x000000013F432000-memory.dmp	xmrig
behavioral1/memory/2804-184-0x000000013F810000-0x000000013FC02000-memory.dmp	xmrig
behavioral1/memory/2608-181-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	xmrig
behavioral1/memory/2456-179-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2624	thvWNPg.exe
2632	sYOkIVw.exe
2668	DfXwANb.exe
2600	smcgIjE.exe
2456	BPsopgI.exe
2608	rBPDTXf.exe
2804	AOnbSVx.exe
2728	gSMmRxA.exe
2584	BnNHoRL.exe
2908	SLKfMbz.exe
2504	zFVPorl.exe
640	uOPgyFb.exe
2152	JvJLZFl.exe
2516	iVPSfaT.exe
2776	eQGWFEj.exe
2808	TGJqjrt.exe
2360	YyhVpYD.exe
1296	ebGPuai.exe
2036	tgbcRgN.exe
544	athdQoN.exe
2164	blFCBPy.exe
1984	FTSsNKi.exe
1048	kJsgWhH.exe
1504	gDrCsTA.exe
2024	jkQhlYz.exe
1992	qkpBXfA.exe
1112	SHMpiCx.exe
2916	UHjluTz.exe
956	KwsHIgX.exe
2424	YeGaHkl.exe
1672	oGMeOYx.exe
2244	yIWrlux.exe
972	IeLwWrk.exe
596	ziyjlkJ.exe
1500	SDqCSmG.exe
1096	bTYNhix.exe
1556	KTQsKFs.exe
1164	OqJgLYC.exe
2032	NmKTvKp.exe
384	TPjxElF.exe
1040	hJGVjJI.exe
2324	zdUNXcJ.exe
2960	IeUlUNS.exe
3060	shHwujH.exe
332	nSPkujJ.exe
2316	KcuhPFb.exe
900	YfpfMnu.exe
2772	hUVLOag.exe
1580	vxeolGU.exe
112	hJmQeoy.exe
2896	ytiLsmo.exe
2056	gKrSzRr.exe
1716	SsfdrBj.exe
3004	skyZDLC.exe
2832	AmMfutN.exe
2452	yizEdTR.exe
1624	HCVKdej.exe
2512	PlARpFt.exe
1276	SrjfmXH.exe
2744	lcSRGSH.exe
2700	uFmQtEb.exe
2240	DzQzXhw.exe
1920	TIyBCxy.exe
1820	EqlCkya.exe

Loads dropped DLL 64 IoCs

pid	Process
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2944-2-0x000000013F990000-0x000000013FD82000-memory.dmp	upx
behavioral1/files/0x000c00000001450b-3.dat	upx
behavioral1/files/0x0033000000014983-17.dat	upx
behavioral1/memory/2624-12-0x000000013F290000-0x000000013F682000-memory.dmp	upx
behavioral1/files/0x001400000000549e-18.dat	upx
behavioral1/files/0x0008000000015023-26.dat	upx
behavioral1/files/0x0007000000015136-27.dat	upx
behavioral1/files/0x00090000000155e3-37.dat	upx
behavioral1/files/0x0006000000015cca-45.dat	upx
behavioral1/files/0x0006000000015cec-58.dat	upx
behavioral1/files/0x0007000000015362-35.dat	upx
behavioral1/files/0x0006000000015d6e-81.dat	upx
behavioral1/files/0x0006000000015f9e-90.dat	upx
behavioral1/files/0x00060000000160f8-95.dat	upx
behavioral1/files/0x0006000000016597-113.dat	upx
behavioral1/files/0x0006000000016c7a-140.dat	upx
behavioral1/files/0x0006000000016cc9-150.dat	upx
behavioral1/files/0x0006000000016525-109.dat	upx
behavioral1/files/0x0006000000015f1b-86.dat	upx
behavioral1/files/0x0006000000016056-92.dat	upx
behavioral1/files/0x0006000000016411-111.dat	upx
behavioral1/files/0x0006000000016ced-167.dat	upx
behavioral1/memory/2600-160-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2668-159-0x000000013F9A0000-0x000000013FD92000-memory.dmp	upx
behavioral1/memory/2632-157-0x000000013FAC0000-0x000000013FEB2000-memory.dmp	upx
behavioral1/files/0x0006000000016ce1-153.dat	upx
behavioral1/files/0x0006000000016cab-144.dat	upx
behavioral1/files/0x0006000000016277-139.dat	upx
behavioral1/files/0x0006000000016c2e-134.dat	upx
behavioral1/files/0x0006000000016c17-125.dat	upx
behavioral1/files/0x00060000000167ef-116.dat	upx
behavioral1/memory/2584-188-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/memory/2728-187-0x000000013F040000-0x000000013F432000-memory.dmp	upx
behavioral1/memory/2804-184-0x000000013F810000-0x000000013FC02000-memory.dmp	upx
behavioral1/memory/2608-181-0x000000013F5F0000-0x000000013F9E2000-memory.dmp	upx
behavioral1/memory/2456-179-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x0006000000016cf5-178.dat	upx
behavioral1/files/0x00310000000149ea-177.dat	upx
behavioral1/files/0x0006000000016c26-130.dat	upx
behavioral1/files/0x0006000000016a45-122.dat	upx
behavioral1/files/0x0006000000015d5d-77.dat	upx
behavioral1/files/0x0006000000015cf7-75.dat	upx
behavioral1/files/0x0006000000015cdb-63.dat	upx
behavioral1/files/0x0007000000015cc1-54.dat	upx
behavioral1/files/0x0006000000015d06-68.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\XpxiwrW.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\DqDnzbQ.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\XavidIO.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\FbmXWWE.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\eiJYagr.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\qImRxar.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\akyoopc.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\WdiVJlh.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\cTVSUjk.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\fTUozbP.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\opimYOx.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\vWVUDDn.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\mhaqCdt.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\AqkTNKG.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\wHiZeun.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\GUqWpaS.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\JRwpOsx.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\vuXvsTL.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\EQRyrNV.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\sOclocN.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\GoRBPGV.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\tLUrajZ.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\hJGVjJI.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\MLBBHgT.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\FKISVZS.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\fSveMYg.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\KcuhPFb.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\dqpDXxG.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\dGDHPvw.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\rBinxkt.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\EWaFMhg.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\bTYNhix.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\ahBTGdN.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\lrgTHvl.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\KjaKFDZ.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\jrysWdk.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\SsfdrBj.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\nUkJBxR.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\HTQDAaM.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\SrjfmXH.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\RSloFtk.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\GzBeJJg.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\mHpKmvc.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\yIoPVaQ.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\oGYgLBC.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\KwsHIgX.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\BioGOQW.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\treVqpb.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\mpkmArh.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\zAKVcHD.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\gZKrlTC.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\JIpwnoy.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\AoPhdcv.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\hBMhMgO.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\ekYnGJb.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\BqMDhzV.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\sEtlkxE.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\ZhgHULR.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\kjnDLkH.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\VuCNERa.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\euTxCLA.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\VjbojXf.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\ZtLJPyj.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
File created	C:\Windows\System\lszxQei.exe	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1732	powershell.exe
1732	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
Token: SeDebugPrivilege	1732	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1732	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	29
PID 2944 wrote to memory of 1732	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	29
PID 2944 wrote to memory of 1732	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	29
PID 2944 wrote to memory of 2624	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2624	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2624	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	30
PID 2944 wrote to memory of 2632	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2632	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2632	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	31
PID 2944 wrote to memory of 2668	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2668	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2668	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	32
PID 2944 wrote to memory of 2600	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2600	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2600	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	33
PID 2944 wrote to memory of 2456	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2456	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2456	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	34
PID 2944 wrote to memory of 2608	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2608	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2608	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	35
PID 2944 wrote to memory of 2804	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2804	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2804	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	36
PID 2944 wrote to memory of 2584	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2584	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2584	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	37
PID 2944 wrote to memory of 2728	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	38
PID 2944 wrote to memory of 2728	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	38
PID 2944 wrote to memory of 2728	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	38
PID 2944 wrote to memory of 2504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	39
PID 2944 wrote to memory of 2504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	39
PID 2944 wrote to memory of 2504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	39
PID 2944 wrote to memory of 2908	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2908	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2908	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	40
PID 2944 wrote to memory of 2152	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	41
PID 2944 wrote to memory of 2152	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	41
PID 2944 wrote to memory of 2152	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	41
PID 2944 wrote to memory of 640	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	42
PID 2944 wrote to memory of 640	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	42
PID 2944 wrote to memory of 640	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	42
PID 2944 wrote to memory of 2516	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2516	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2516	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	43
PID 2944 wrote to memory of 2776	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	44
PID 2944 wrote to memory of 2776	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	44
PID 2944 wrote to memory of 2776	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	44
PID 2944 wrote to memory of 2808	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	45
PID 2944 wrote to memory of 2808	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	45
PID 2944 wrote to memory of 2808	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	45
PID 2944 wrote to memory of 2360	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	46
PID 2944 wrote to memory of 2360	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	46
PID 2944 wrote to memory of 2360	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	46
PID 2944 wrote to memory of 2036	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	47
PID 2944 wrote to memory of 2036	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	47
PID 2944 wrote to memory of 2036	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	47
PID 2944 wrote to memory of 1296	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	48
PID 2944 wrote to memory of 1296	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	48
PID 2944 wrote to memory of 1296	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	48
PID 2944 wrote to memory of 1504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	49
PID 2944 wrote to memory of 1504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	49
PID 2944 wrote to memory of 1504	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	49
PID 2944 wrote to memory of 544	2944	0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0906b325223b86adf9ad51a3065d02ba_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\System\thvWNPg.exe
  C:\Windows\System\thvWNPg.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\sYOkIVw.exe
  C:\Windows\System\sYOkIVw.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\DfXwANb.exe
  C:\Windows\System\DfXwANb.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\smcgIjE.exe
  C:\Windows\System\smcgIjE.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\BPsopgI.exe
  C:\Windows\System\BPsopgI.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\rBPDTXf.exe
  C:\Windows\System\rBPDTXf.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\AOnbSVx.exe
  C:\Windows\System\AOnbSVx.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\BnNHoRL.exe
  C:\Windows\System\BnNHoRL.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\gSMmRxA.exe
  C:\Windows\System\gSMmRxA.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\zFVPorl.exe
  C:\Windows\System\zFVPorl.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\SLKfMbz.exe
  C:\Windows\System\SLKfMbz.exe
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Windows\System\JvJLZFl.exe
  C:\Windows\System\JvJLZFl.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\uOPgyFb.exe
  C:\Windows\System\uOPgyFb.exe
  2⤵
  - Executes dropped EXE
  PID:640
- C:\Windows\System\iVPSfaT.exe
  C:\Windows\System\iVPSfaT.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\eQGWFEj.exe
  C:\Windows\System\eQGWFEj.exe
  2⤵
  - Executes dropped EXE
  PID:2776
- C:\Windows\System\TGJqjrt.exe
  C:\Windows\System\TGJqjrt.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\YyhVpYD.exe
  C:\Windows\System\YyhVpYD.exe
  2⤵
  - Executes dropped EXE
  PID:2360
- C:\Windows\System\tgbcRgN.exe
  C:\Windows\System\tgbcRgN.exe
  2⤵
  - Executes dropped EXE
  PID:2036
- C:\Windows\System\ebGPuai.exe
  C:\Windows\System\ebGPuai.exe
  2⤵
  - Executes dropped EXE
  PID:1296
- C:\Windows\System\gDrCsTA.exe
  C:\Windows\System\gDrCsTA.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\athdQoN.exe
  C:\Windows\System\athdQoN.exe
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Windows\System\qkpBXfA.exe
  C:\Windows\System\qkpBXfA.exe
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Windows\System\blFCBPy.exe
  C:\Windows\System\blFCBPy.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\YeGaHkl.exe
  C:\Windows\System\YeGaHkl.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\FTSsNKi.exe
  C:\Windows\System\FTSsNKi.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\oGMeOYx.exe
  C:\Windows\System\oGMeOYx.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\kJsgWhH.exe
  C:\Windows\System\kJsgWhH.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\yIWrlux.exe
  C:\Windows\System\yIWrlux.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\jkQhlYz.exe
  C:\Windows\System\jkQhlYz.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\ziyjlkJ.exe
  C:\Windows\System\ziyjlkJ.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\SHMpiCx.exe
  C:\Windows\System\SHMpiCx.exe
  2⤵
  - Executes dropped EXE
  PID:1112
- C:\Windows\System\SDqCSmG.exe
  C:\Windows\System\SDqCSmG.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\UHjluTz.exe
  C:\Windows\System\UHjluTz.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\bTYNhix.exe
  C:\Windows\System\bTYNhix.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\KwsHIgX.exe
  C:\Windows\System\KwsHIgX.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\KTQsKFs.exe
  C:\Windows\System\KTQsKFs.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\IeLwWrk.exe
  C:\Windows\System\IeLwWrk.exe
  2⤵
  - Executes dropped EXE
  PID:972
- C:\Windows\System\OqJgLYC.exe
  C:\Windows\System\OqJgLYC.exe
  2⤵
  - Executes dropped EXE
  PID:1164
- C:\Windows\System\NmKTvKp.exe
  C:\Windows\System\NmKTvKp.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\TPjxElF.exe
  C:\Windows\System\TPjxElF.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\hJGVjJI.exe
  C:\Windows\System\hJGVjJI.exe
  2⤵
  - Executes dropped EXE
  PID:1040
- C:\Windows\System\zdUNXcJ.exe
  C:\Windows\System\zdUNXcJ.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\IeUlUNS.exe
  C:\Windows\System\IeUlUNS.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\shHwujH.exe
  C:\Windows\System\shHwujH.exe
  2⤵
  - Executes dropped EXE
  PID:3060
- C:\Windows\System\nSPkujJ.exe
  C:\Windows\System\nSPkujJ.exe
  2⤵
  - Executes dropped EXE
  PID:332
- C:\Windows\System\KcuhPFb.exe
  C:\Windows\System\KcuhPFb.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\YfpfMnu.exe
  C:\Windows\System\YfpfMnu.exe
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Windows\System\ytiLsmo.exe
  C:\Windows\System\ytiLsmo.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\hUVLOag.exe
  C:\Windows\System\hUVLOag.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\gKrSzRr.exe
  C:\Windows\System\gKrSzRr.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\vxeolGU.exe
  C:\Windows\System\vxeolGU.exe
  2⤵
  - Executes dropped EXE
  PID:1580
- C:\Windows\System\SsfdrBj.exe
  C:\Windows\System\SsfdrBj.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\hJmQeoy.exe
  C:\Windows\System\hJmQeoy.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\skyZDLC.exe
  C:\Windows\System\skyZDLC.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\AmMfutN.exe
  C:\Windows\System\AmMfutN.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\yizEdTR.exe
  C:\Windows\System\yizEdTR.exe
  2⤵
  - Executes dropped EXE
  PID:2452
- C:\Windows\System\HCVKdej.exe
  C:\Windows\System\HCVKdej.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\PlARpFt.exe
  C:\Windows\System\PlARpFt.exe
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Windows\System\SrjfmXH.exe
  C:\Windows\System\SrjfmXH.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\uFmQtEb.exe
  C:\Windows\System\uFmQtEb.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\lcSRGSH.exe
  C:\Windows\System\lcSRGSH.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\DzQzXhw.exe
  C:\Windows\System\DzQzXhw.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\TIyBCxy.exe
  C:\Windows\System\TIyBCxy.exe
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\System\EqlCkya.exe
  C:\Windows\System\EqlCkya.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\BhKPQdI.exe
  C:\Windows\System\BhKPQdI.exe
  2⤵
  PID:588
- C:\Windows\System\YxQxqEr.exe
  C:\Windows\System\YxQxqEr.exe
  2⤵
  PID:360
- C:\Windows\System\vabAQok.exe
  C:\Windows\System\vabAQok.exe
  2⤵
  PID:2812
- C:\Windows\System\GzguBNe.exe
  C:\Windows\System\GzguBNe.exe
  2⤵
  PID:1380
- C:\Windows\System\ALkjmwX.exe
  C:\Windows\System\ALkjmwX.exe
  2⤵
  PID:796
- C:\Windows\System\TTaUFAL.exe
  C:\Windows\System\TTaUFAL.exe
  2⤵
  PID:2188
- C:\Windows\System\sEEsshJ.exe
  C:\Windows\System\sEEsshJ.exe
  2⤵
  PID:2248
- C:\Windows\System\slNQCqu.exe
  C:\Windows\System\slNQCqu.exe
  2⤵
  PID:1628
- C:\Windows\System\ppADfqO.exe
  C:\Windows\System\ppADfqO.exe
  2⤵
  PID:704
- C:\Windows\System\Wduemha.exe
  C:\Windows\System\Wduemha.exe
  2⤵
  PID:2028
- C:\Windows\System\YXkQUCl.exe
  C:\Windows\System\YXkQUCl.exe
  2⤵
  PID:1236
- C:\Windows\System\ZhgHULR.exe
  C:\Windows\System\ZhgHULR.exe
  2⤵
  PID:1084
- C:\Windows\System\HWMOmhL.exe
  C:\Windows\System\HWMOmhL.exe
  2⤵
  PID:1824
- C:\Windows\System\XIJqetq.exe
  C:\Windows\System\XIJqetq.exe
  2⤵
  PID:884
- C:\Windows\System\aeJBcNZ.exe
  C:\Windows\System\aeJBcNZ.exe
  2⤵
  PID:1748
- C:\Windows\System\LrKoSmA.exe
  C:\Windows\System\LrKoSmA.exe
  2⤵
  PID:824
- C:\Windows\System\feVNKup.exe
  C:\Windows\System\feVNKup.exe
  2⤵
  PID:1728
- C:\Windows\System\gtXIkEU.exe
  C:\Windows\System\gtXIkEU.exe
  2⤵
  PID:1292
- C:\Windows\System\XYWtxHK.exe
  C:\Windows\System\XYWtxHK.exe
  2⤵
  PID:3068
- C:\Windows\System\FWtheUb.exe
  C:\Windows\System\FWtheUb.exe
  2⤵
  PID:2156
- C:\Windows\System\btratRk.exe
  C:\Windows\System\btratRk.exe
  2⤵
  PID:2124
- C:\Windows\System\KSUxbIg.exe
  C:\Windows\System\KSUxbIg.exe
  2⤵
  PID:2448
- C:\Windows\System\kjnDLkH.exe
  C:\Windows\System\kjnDLkH.exe
  2⤵
  PID:904
- C:\Windows\System\mhaqCdt.exe
  C:\Windows\System\mhaqCdt.exe
  2⤵
  PID:2784
- C:\Windows\System\jzilGoM.exe
  C:\Windows\System\jzilGoM.exe
  2⤵
  PID:2984
- C:\Windows\System\nTRuzUs.exe
  C:\Windows\System\nTRuzUs.exe
  2⤵
  PID:2688
- C:\Windows\System\GWKlYaE.exe
  C:\Windows\System\GWKlYaE.exe
  2⤵
  PID:2768
- C:\Windows\System\nyCPEeN.exe
  C:\Windows\System\nyCPEeN.exe
  2⤵
  PID:784
- C:\Windows\System\XlYqOpY.exe
  C:\Windows\System\XlYqOpY.exe
  2⤵
  PID:2320
- C:\Windows\System\RSloFtk.exe
  C:\Windows\System\RSloFtk.exe
  2⤵
  PID:872
- C:\Windows\System\nprHUTh.exe
  C:\Windows\System\nprHUTh.exe
  2⤵
  PID:1812
- C:\Windows\System\rnNnFNh.exe
  C:\Windows\System\rnNnFNh.exe
  2⤵
  PID:2544
- C:\Windows\System\tWJCELe.exe
  C:\Windows\System\tWJCELe.exe
  2⤵
  PID:1776
- C:\Windows\System\HWFLYZJ.exe
  C:\Windows\System\HWFLYZJ.exe
  2⤵
  PID:2132
- C:\Windows\System\FCHcoTF.exe
  C:\Windows\System\FCHcoTF.exe
  2⤵
  PID:1508
- C:\Windows\System\OujWCxl.exe
  C:\Windows\System\OujWCxl.exe
  2⤵
  PID:2976
- C:\Windows\System\pbNWlZJ.exe
  C:\Windows\System\pbNWlZJ.exe
  2⤵
  PID:3028
- C:\Windows\System\wmedcYG.exe
  C:\Windows\System\wmedcYG.exe
  2⤵
  PID:920
- C:\Windows\System\VrMCKbv.exe
  C:\Windows\System\VrMCKbv.exe
  2⤵
  PID:1240
- C:\Windows\System\GxPTKBZ.exe
  C:\Windows\System\GxPTKBZ.exe
  2⤵
  PID:2288
- C:\Windows\System\ycaYOHc.exe
  C:\Windows\System\ycaYOHc.exe
  2⤵
  PID:2904
- C:\Windows\System\AFyDnkg.exe
  C:\Windows\System\AFyDnkg.exe
  2⤵
  PID:2756
- C:\Windows\System\YqwgKqH.exe
  C:\Windows\System\YqwgKqH.exe
  2⤵
  PID:3088
- C:\Windows\System\AyzTbSR.exe
  C:\Windows\System\AyzTbSR.exe
  2⤵
  PID:3104
- C:\Windows\System\rVEDhnF.exe
  C:\Windows\System\rVEDhnF.exe
  2⤵
  PID:3120
- C:\Windows\System\vftnQpj.exe
  C:\Windows\System\vftnQpj.exe
  2⤵
  PID:3136
- C:\Windows\System\mnCzPfv.exe
  C:\Windows\System\mnCzPfv.exe
  2⤵
  PID:3152
- C:\Windows\System\biMZGap.exe
  C:\Windows\System\biMZGap.exe
  2⤵
  PID:3168
- C:\Windows\System\amzPuLi.exe
  C:\Windows\System\amzPuLi.exe
  2⤵
  PID:3184
- C:\Windows\System\SGrvixk.exe
  C:\Windows\System\SGrvixk.exe
  2⤵
  PID:3200
- C:\Windows\System\iVirwbV.exe
  C:\Windows\System\iVirwbV.exe
  2⤵
  PID:3216
- C:\Windows\System\hBMhMgO.exe
  C:\Windows\System\hBMhMgO.exe
  2⤵
  PID:3244
- C:\Windows\System\fFicZKf.exe
  C:\Windows\System\fFicZKf.exe
  2⤵
  PID:3260
- C:\Windows\System\yMHdObh.exe
  C:\Windows\System\yMHdObh.exe
  2⤵
  PID:3276
- C:\Windows\System\lsjmxYf.exe
  C:\Windows\System\lsjmxYf.exe
  2⤵
  PID:3292
- C:\Windows\System\EHeGIQm.exe
  C:\Windows\System\EHeGIQm.exe
  2⤵
  PID:3308
- C:\Windows\System\VuCNERa.exe
  C:\Windows\System\VuCNERa.exe
  2⤵
  PID:3324
- C:\Windows\System\DzOoknf.exe
  C:\Windows\System\DzOoknf.exe
  2⤵
  PID:3340
- C:\Windows\System\dpPfyGy.exe
  C:\Windows\System\dpPfyGy.exe
  2⤵
  PID:3356
- C:\Windows\System\DXzqxkd.exe
  C:\Windows\System\DXzqxkd.exe
  2⤵
  PID:3376
- C:\Windows\System\EXOILPM.exe
  C:\Windows\System\EXOILPM.exe
  2⤵
  PID:3392
- C:\Windows\System\JfodDKM.exe
  C:\Windows\System\JfodDKM.exe
  2⤵
  PID:3408
- C:\Windows\System\VUfXbRO.exe
  C:\Windows\System\VUfXbRO.exe
  2⤵
  PID:3424
- C:\Windows\System\PnJqmuX.exe
  C:\Windows\System\PnJqmuX.exe
  2⤵
  PID:3440
- C:\Windows\System\sJTEBUu.exe
  C:\Windows\System\sJTEBUu.exe
  2⤵
  PID:3456
- C:\Windows\System\jnlYxOK.exe
  C:\Windows\System\jnlYxOK.exe
  2⤵
  PID:3472
- C:\Windows\System\xmxLkay.exe
  C:\Windows\System\xmxLkay.exe
  2⤵
  PID:3488
- C:\Windows\System\BcJZUVv.exe
  C:\Windows\System\BcJZUVv.exe
  2⤵
  PID:3504
- C:\Windows\System\utnoLpW.exe
  C:\Windows\System\utnoLpW.exe
  2⤵
  PID:3520
- C:\Windows\System\zAKVcHD.exe
  C:\Windows\System\zAKVcHD.exe
  2⤵
  PID:3536
- C:\Windows\System\VQChlTl.exe
  C:\Windows\System\VQChlTl.exe
  2⤵
  PID:3552
- C:\Windows\System\SNgXcyy.exe
  C:\Windows\System\SNgXcyy.exe
  2⤵
  PID:3568
- C:\Windows\System\DPQhTUM.exe
  C:\Windows\System\DPQhTUM.exe
  2⤵
  PID:3584
- C:\Windows\System\IySkZHY.exe
  C:\Windows\System\IySkZHY.exe
  2⤵
  PID:3600
- C:\Windows\System\EQRyrNV.exe
  C:\Windows\System\EQRyrNV.exe
  2⤵
  PID:3616
- C:\Windows\System\pmQrCjB.exe
  C:\Windows\System\pmQrCjB.exe
  2⤵
  PID:3632
- C:\Windows\System\GzBeJJg.exe
  C:\Windows\System\GzBeJJg.exe
  2⤵
  PID:3648
- C:\Windows\System\UfMPohY.exe
  C:\Windows\System\UfMPohY.exe
  2⤵
  PID:3664
- C:\Windows\System\mMMpZHC.exe
  C:\Windows\System\mMMpZHC.exe
  2⤵
  PID:3684
- C:\Windows\System\JiySGsw.exe
  C:\Windows\System\JiySGsw.exe
  2⤵
  PID:3700
- C:\Windows\System\nKKFOeb.exe
  C:\Windows\System\nKKFOeb.exe
  2⤵
  PID:3716
- C:\Windows\System\AMrffIB.exe
  C:\Windows\System\AMrffIB.exe
  2⤵
  PID:3732
- C:\Windows\System\Bjdipdr.exe
  C:\Windows\System\Bjdipdr.exe
  2⤵
  PID:3748
- C:\Windows\System\qtQdOSg.exe
  C:\Windows\System\qtQdOSg.exe
  2⤵
  PID:3764
- C:\Windows\System\WyfCKVw.exe
  C:\Windows\System\WyfCKVw.exe
  2⤵
  PID:3780
- C:\Windows\System\HfQNJre.exe
  C:\Windows\System\HfQNJre.exe
  2⤵
  PID:3796
- C:\Windows\System\iFeMWHO.exe
  C:\Windows\System\iFeMWHO.exe
  2⤵
  PID:3816
- C:\Windows\System\DhklhyT.exe
  C:\Windows\System\DhklhyT.exe
  2⤵
  PID:3832
- C:\Windows\System\Sbsmase.exe
  C:\Windows\System\Sbsmase.exe
  2⤵
  PID:3848
- C:\Windows\System\TFxQngF.exe
  C:\Windows\System\TFxQngF.exe
  2⤵
  PID:3864
- C:\Windows\System\OofgtPK.exe
  C:\Windows\System\OofgtPK.exe
  2⤵
  PID:3880
- C:\Windows\System\cAUUtHs.exe
  C:\Windows\System\cAUUtHs.exe
  2⤵
  PID:3896
- C:\Windows\System\UuEuuKi.exe
  C:\Windows\System\UuEuuKi.exe
  2⤵
  PID:3912
- C:\Windows\System\PudAWvN.exe
  C:\Windows\System\PudAWvN.exe
  2⤵
  PID:3928
- C:\Windows\System\rWDOnaI.exe
  C:\Windows\System\rWDOnaI.exe
  2⤵
  PID:3948
- C:\Windows\System\ftfLlPF.exe
  C:\Windows\System\ftfLlPF.exe
  2⤵
  PID:3964
- C:\Windows\System\erwoAZM.exe
  C:\Windows\System\erwoAZM.exe
  2⤵
  PID:3980
- C:\Windows\System\ELyXyPV.exe
  C:\Windows\System\ELyXyPV.exe
  2⤵
  PID:3996
- C:\Windows\System\GyBcspD.exe
  C:\Windows\System\GyBcspD.exe
  2⤵
  PID:4012
- C:\Windows\System\nNCGAEu.exe
  C:\Windows\System\nNCGAEu.exe
  2⤵
  PID:4028
- C:\Windows\System\blCHQnn.exe
  C:\Windows\System\blCHQnn.exe
  2⤵
  PID:4044
- C:\Windows\System\ahBTGdN.exe
  C:\Windows\System\ahBTGdN.exe
  2⤵
  PID:4060
- C:\Windows\System\ywmuwBY.exe
  C:\Windows\System\ywmuwBY.exe
  2⤵
  PID:4076
- C:\Windows\System\CPeDkMR.exe
  C:\Windows\System\CPeDkMR.exe
  2⤵
  PID:4092
- C:\Windows\System\TLPIHqb.exe
  C:\Windows\System\TLPIHqb.exe
  2⤵
  PID:2500
- C:\Windows\System\azgsosB.exe
  C:\Windows\System\azgsosB.exe
  2⤵
  PID:856
- C:\Windows\System\ZwPqEjy.exe
  C:\Windows\System\ZwPqEjy.exe
  2⤵
  PID:860
- C:\Windows\System\QHwpWry.exe
  C:\Windows\System\QHwpWry.exe
  2⤵
  PID:1260
- C:\Windows\System\OhYkBDn.exe
  C:\Windows\System\OhYkBDn.exe
  2⤵
  PID:2684
- C:\Windows\System\gSYyvCD.exe
  C:\Windows\System\gSYyvCD.exe
  2⤵
  PID:776
- C:\Windows\System\QSUfvlA.exe
  C:\Windows\System\QSUfvlA.exe
  2⤵
  PID:3128
- C:\Windows\System\GWaSXjI.exe
  C:\Windows\System\GWaSXjI.exe
  2⤵
  PID:3196
- C:\Windows\System\cXCXJab.exe
  C:\Windows\System\cXCXJab.exe
  2⤵
  PID:3232
- C:\Windows\System\GEafuER.exe
  C:\Windows\System\GEafuER.exe
  2⤵
  PID:3272
- C:\Windows\System\AXhZbEO.exe
  C:\Windows\System\AXhZbEO.exe
  2⤵
  PID:3336
- C:\Windows\System\gxehrtH.exe
  C:\Windows\System\gxehrtH.exe
  2⤵
  PID:3404
- C:\Windows\System\QrAbYEy.exe
  C:\Windows\System\QrAbYEy.exe
  2⤵
  PID:3464
- C:\Windows\System\cDGCzND.exe
  C:\Windows\System\cDGCzND.exe
  2⤵
  PID:2752
- C:\Windows\System\zVOWeUg.exe
  C:\Windows\System\zVOWeUg.exe
  2⤵
  PID:2276
- C:\Windows\System\fXbCXUc.exe
  C:\Windows\System\fXbCXUc.exe
  2⤵
  PID:800
- C:\Windows\System\sJEBIRi.exe
  C:\Windows\System\sJEBIRi.exe
  2⤵
  PID:3500
- C:\Windows\System\BioGOQW.exe
  C:\Windows\System\BioGOQW.exe
  2⤵
  PID:3560
- C:\Windows\System\uwxKSob.exe
  C:\Windows\System\uwxKSob.exe
  2⤵
  PID:4108
- C:\Windows\System\RVpJsHu.exe
  C:\Windows\System\RVpJsHu.exe
  2⤵
  PID:4124
- C:\Windows\System\YrxpYvL.exe
  C:\Windows\System\YrxpYvL.exe
  2⤵
  PID:4140
- C:\Windows\System\LLwMptX.exe
  C:\Windows\System\LLwMptX.exe
  2⤵
  PID:4156
- C:\Windows\System\MbCfGjB.exe
  C:\Windows\System\MbCfGjB.exe
  2⤵
  PID:4172
- C:\Windows\System\QqFBzfy.exe
  C:\Windows\System\QqFBzfy.exe
  2⤵
  PID:4188
- C:\Windows\System\gVICENc.exe
  C:\Windows\System\gVICENc.exe
  2⤵
  PID:4204
- C:\Windows\System\zDghjBf.exe
  C:\Windows\System\zDghjBf.exe
  2⤵
  PID:4220
- C:\Windows\System\RMfJgod.exe
  C:\Windows\System\RMfJgod.exe
  2⤵
  PID:4236
- C:\Windows\System\EUPwKyT.exe
  C:\Windows\System\EUPwKyT.exe
  2⤵
  PID:4252
- C:\Windows\System\BktoMxT.exe
  C:\Windows\System\BktoMxT.exe
  2⤵
  PID:4268
- C:\Windows\System\YZfPCfh.exe
  C:\Windows\System\YZfPCfh.exe
  2⤵
  PID:4284
- C:\Windows\System\hhADbCX.exe
  C:\Windows\System\hhADbCX.exe
  2⤵
  PID:4300
- C:\Windows\System\qjvRKZb.exe
  C:\Windows\System\qjvRKZb.exe
  2⤵
  PID:4316
- C:\Windows\System\EqVfmQh.exe
  C:\Windows\System\EqVfmQh.exe
  2⤵
  PID:4332
- C:\Windows\System\TVRoAhn.exe
  C:\Windows\System\TVRoAhn.exe
  2⤵
  PID:4348
- C:\Windows\System\LLhADQS.exe
  C:\Windows\System\LLhADQS.exe
  2⤵
  PID:4364
- C:\Windows\System\treVqpb.exe
  C:\Windows\System\treVqpb.exe
  2⤵
  PID:4380
- C:\Windows\System\jqRRlBe.exe
  C:\Windows\System\jqRRlBe.exe
  2⤵
  PID:4396
- C:\Windows\System\lRAMIYI.exe
  C:\Windows\System\lRAMIYI.exe
  2⤵
  PID:4412
- C:\Windows\System\XhdxxgV.exe
  C:\Windows\System\XhdxxgV.exe
  2⤵
  PID:4432
- C:\Windows\System\GuZGCmR.exe
  C:\Windows\System\GuZGCmR.exe
  2⤵
  PID:4448
- C:\Windows\System\yuACvPj.exe
  C:\Windows\System\yuACvPj.exe
  2⤵
  PID:4464
- C:\Windows\System\wshoHrH.exe
  C:\Windows\System\wshoHrH.exe
  2⤵
  PID:4800
- C:\Windows\System\WskBEpZ.exe
  C:\Windows\System\WskBEpZ.exe
  2⤵
  PID:4824
- C:\Windows\System\DDcxAZR.exe
  C:\Windows\System\DDcxAZR.exe
  2⤵
  PID:4840
- C:\Windows\System\LNzcyNB.exe
  C:\Windows\System\LNzcyNB.exe
  2⤵
  PID:4856
- C:\Windows\System\LneeNkX.exe
  C:\Windows\System\LneeNkX.exe
  2⤵
  PID:4872
- C:\Windows\System\QGKSsko.exe
  C:\Windows\System\QGKSsko.exe
  2⤵
  PID:4888
- C:\Windows\System\JfFCEOJ.exe
  C:\Windows\System\JfFCEOJ.exe
  2⤵
  PID:4904
- C:\Windows\System\kKDZcJO.exe
  C:\Windows\System\kKDZcJO.exe
  2⤵
  PID:4924
- C:\Windows\System\zlYZUXu.exe
  C:\Windows\System\zlYZUXu.exe
  2⤵
  PID:4940
- C:\Windows\System\UcPDDHJ.exe
  C:\Windows\System\UcPDDHJ.exe
  2⤵
  PID:4956
- C:\Windows\System\hiSFFCy.exe
  C:\Windows\System\hiSFFCy.exe
  2⤵
  PID:4972
- C:\Windows\System\wdqljbx.exe
  C:\Windows\System\wdqljbx.exe
  2⤵
  PID:4988
- C:\Windows\System\VpWitCa.exe
  C:\Windows\System\VpWitCa.exe
  2⤵
  PID:5004
- C:\Windows\System\XvolhPf.exe
  C:\Windows\System\XvolhPf.exe
  2⤵
  PID:5024
- C:\Windows\System\ptAyVNC.exe
  C:\Windows\System\ptAyVNC.exe
  2⤵
  PID:5040
- C:\Windows\System\MRseuBl.exe
  C:\Windows\System\MRseuBl.exe
  2⤵
  PID:5056
- C:\Windows\System\wydGAmi.exe
  C:\Windows\System\wydGAmi.exe
  2⤵
  PID:5072
- C:\Windows\System\NzTjFzS.exe
  C:\Windows\System\NzTjFzS.exe
  2⤵
  PID:5088
- C:\Windows\System\QnLlFsV.exe
  C:\Windows\System\QnLlFsV.exe
  2⤵
  PID:5104
- C:\Windows\System\YFxurxP.exe
  C:\Windows\System\YFxurxP.exe
  2⤵
  PID:3592
- C:\Windows\System\MLBBHgT.exe
  C:\Windows\System\MLBBHgT.exe
  2⤵
  PID:3656
- C:\Windows\System\nsRmXBE.exe
  C:\Windows\System\nsRmXBE.exe
  2⤵
  PID:2284
- C:\Windows\System\dwMnCUH.exe
  C:\Windows\System\dwMnCUH.exe
  2⤵
  PID:4088
- C:\Windows\System\xZptHmW.exe
  C:\Windows\System\xZptHmW.exe
  2⤵
  PID:4024
- C:\Windows\System\zfIYgbv.exe
  C:\Windows\System\zfIYgbv.exe
  2⤵
  PID:3960
- C:\Windows\System\hYhLyEN.exe
  C:\Windows\System\hYhLyEN.exe
  2⤵
  PID:3892
- C:\Windows\System\EYSVPJa.exe
  C:\Windows\System\EYSVPJa.exe
  2⤵
  PID:3828
- C:\Windows\System\OyXRxmR.exe
  C:\Windows\System\OyXRxmR.exe
  2⤵
  PID:3756
- C:\Windows\System\pghKzhp.exe
  C:\Windows\System\pghKzhp.exe
  2⤵
  PID:1436
- C:\Windows\System\rFbbqAz.exe
  C:\Windows\System\rFbbqAz.exe
  2⤵
  PID:3268
- C:\Windows\System\gmzhVTr.exe
  C:\Windows\System\gmzhVTr.exe
  2⤵
  PID:1860
- C:\Windows\System\idDguqn.exe
  C:\Windows\System\idDguqn.exe
  2⤵
  PID:3532
- C:\Windows\System\wXwWxTc.exe
  C:\Windows\System\wXwWxTc.exe
  2⤵
  PID:4148
- C:\Windows\System\nebBGRV.exe
  C:\Windows\System\nebBGRV.exe
  2⤵
  PID:3148
- C:\Windows\System\DqtCwjb.exe
  C:\Windows\System\DqtCwjb.exe
  2⤵
  PID:3212
- C:\Windows\System\eXqRqeW.exe
  C:\Windows\System\eXqRqeW.exe
  2⤵
  PID:3256
- C:\Windows\System\HJuDmEE.exe
  C:\Windows\System\HJuDmEE.exe
  2⤵
  PID:3320
- C:\Windows\System\ovvetls.exe
  C:\Windows\System\ovvetls.exe
  2⤵
  PID:1480
- C:\Windows\System\pokhmAe.exe
  C:\Windows\System\pokhmAe.exe
  2⤵
  PID:3484
- C:\Windows\System\eJDxzbk.exe
  C:\Windows\System\eJDxzbk.exe
  2⤵
  PID:3580
- C:\Windows\System\FDQyhpO.exe
  C:\Windows\System\FDQyhpO.exe
  2⤵
  PID:3672
- C:\Windows\System\hlrLyzJ.exe
  C:\Windows\System\hlrLyzJ.exe
  2⤵
  PID:4180
- C:\Windows\System\qWIZkfm.exe
  C:\Windows\System\qWIZkfm.exe
  2⤵
  PID:4244
- C:\Windows\System\zFDVgoq.exe
  C:\Windows\System\zFDVgoq.exe
  2⤵
  PID:1924
- C:\Windows\System\NOykNeJ.exe
  C:\Windows\System\NOykNeJ.exe
  2⤵
  PID:4344
- C:\Windows\System\mWFKDeb.exe
  C:\Windows\System\mWFKDeb.exe
  2⤵
  PID:4404
- C:\Windows\System\fmPLRzS.exe
  C:\Windows\System\fmPLRzS.exe
  2⤵
  PID:4472
- C:\Windows\System\YYTAekt.exe
  C:\Windows\System\YYTAekt.exe
  2⤵
  PID:4480
- C:\Windows\System\yQgWWqR.exe
  C:\Windows\System\yQgWWqR.exe
  2⤵
  PID:4500
- C:\Windows\System\nUkJBxR.exe
  C:\Windows\System\nUkJBxR.exe
  2⤵
  PID:4516
- C:\Windows\System\foWcpZy.exe
  C:\Windows\System\foWcpZy.exe
  2⤵
  PID:4532
- C:\Windows\System\TpyiJwV.exe
  C:\Windows\System\TpyiJwV.exe
  2⤵
  PID:4548
- C:\Windows\System\ERNlWBj.exe
  C:\Windows\System\ERNlWBj.exe
  2⤵
  PID:4564
- C:\Windows\System\mpkmArh.exe
  C:\Windows\System\mpkmArh.exe
  2⤵
  PID:4580
- C:\Windows\System\sOclocN.exe
  C:\Windows\System\sOclocN.exe
  2⤵
  PID:4596
- C:\Windows\System\ZgceilZ.exe
  C:\Windows\System\ZgceilZ.exe
  2⤵
  PID:4612
- C:\Windows\System\ZdPbemn.exe
  C:\Windows\System\ZdPbemn.exe
  2⤵
  PID:4628
- C:\Windows\System\YXdQfiU.exe
  C:\Windows\System\YXdQfiU.exe
  2⤵
  PID:4644
- C:\Windows\System\CvkCkcJ.exe
  C:\Windows\System\CvkCkcJ.exe
  2⤵
  PID:4660
- C:\Windows\System\qaozdQt.exe
  C:\Windows\System\qaozdQt.exe
  2⤵
  PID:4676
- C:\Windows\System\mHpKmvc.exe
  C:\Windows\System\mHpKmvc.exe
  2⤵
  PID:4692
- C:\Windows\System\HKXaOBU.exe
  C:\Windows\System\HKXaOBU.exe
  2⤵
  PID:1752
- C:\Windows\System\AkLguEf.exe
  C:\Windows\System\AkLguEf.exe
  2⤵
  PID:276
- C:\Windows\System\qNXPHuP.exe
  C:\Windows\System\qNXPHuP.exe
  2⤵
  PID:4716
- C:\Windows\System\hqjwuCO.exe
  C:\Windows\System\hqjwuCO.exe
  2⤵
  PID:4732
- C:\Windows\System\guRLbCI.exe
  C:\Windows\System\guRLbCI.exe
  2⤵
  PID:4744
- C:\Windows\System\opimYOx.exe
  C:\Windows\System\opimYOx.exe
  2⤵
  PID:3084
- C:\Windows\System\zVCqwMk.exe
  C:\Windows\System\zVCqwMk.exe
  2⤵
  PID:4764
- C:\Windows\System\PkIobKM.exe
  C:\Windows\System\PkIobKM.exe
  2⤵
  PID:4772
- C:\Windows\System\hHUpgqS.exe
  C:\Windows\System\hHUpgqS.exe
  2⤵
  PID:4264
- C:\Windows\System\WXCaTCk.exe
  C:\Windows\System\WXCaTCk.exe
  2⤵
  PID:324
- C:\Windows\System\vpHfjIe.exe
  C:\Windows\System\vpHfjIe.exe
  2⤵
  PID:4792
- C:\Windows\System\sratZiR.exe
  C:\Windows\System\sratZiR.exe
  2⤵
  PID:4324
- C:\Windows\System\IaajejN.exe
  C:\Windows\System\IaajejN.exe
  2⤵
  PID:4424
- C:\Windows\System\PvafKrc.exe
  C:\Windows\System\PvafKrc.exe
  2⤵
  PID:4996
- C:\Windows\System\SCsSEnu.exe
  C:\Windows\System\SCsSEnu.exe
  2⤵
  PID:4832
- C:\Windows\System\XwdsGTJ.exe
  C:\Windows\System\XwdsGTJ.exe
  2⤵
  PID:4896
- C:\Windows\System\AwmyZVt.exe
  C:\Windows\System\AwmyZVt.exe
  2⤵
  PID:5036
- C:\Windows\System\BqMDhzV.exe
  C:\Windows\System\BqMDhzV.exe
  2⤵
  PID:380
- C:\Windows\System\GKVZDSm.exe
  C:\Windows\System\GKVZDSm.exe
  2⤵
  PID:3388
- C:\Windows\System\aiYwvPQ.exe
  C:\Windows\System\aiYwvPQ.exe
  2⤵
  PID:3740
- C:\Windows\System\zJDJpgX.exe
  C:\Windows\System\zJDJpgX.exe
  2⤵
  PID:3808
- C:\Windows\System\mNodbRc.exe
  C:\Windows\System\mNodbRc.exe
  2⤵
  PID:3904
- C:\Windows\System\bDQgmST.exe
  C:\Windows\System\bDQgmST.exe
  2⤵
  PID:4004
- C:\Windows\System\TuOYOJV.exe
  C:\Windows\System\TuOYOJV.exe
  2⤵
  PID:4072
- C:\Windows\System\YQyHNrH.exe
  C:\Windows\System\YQyHNrH.exe
  2⤵
  PID:1532
- C:\Windows\System\DaZYIXW.exe
  C:\Windows\System\DaZYIXW.exe
  2⤵
  PID:3080
- C:\Windows\System\ijAOcVb.exe
  C:\Windows\System\ijAOcVb.exe
  2⤵
  PID:4260
- C:\Windows\System\uMQexmZ.exe
  C:\Windows\System\uMQexmZ.exe
  2⤵
  PID:3860
- C:\Windows\System\XRinEYF.exe
  C:\Windows\System\XRinEYF.exe
  2⤵
  PID:1308
- C:\Windows\System\BQRpWJd.exe
  C:\Windows\System\BQRpWJd.exe
  2⤵
  PID:3640
- C:\Windows\System\QWWzgNI.exe
  C:\Windows\System\QWWzgNI.exe
  2⤵
  PID:3644
- C:\Windows\System\uqDeKKK.exe
  C:\Windows\System\uqDeKKK.exe
  2⤵
  PID:4932
- C:\Windows\System\dwoBKwJ.exe
  C:\Windows\System\dwoBKwJ.exe
  2⤵
  PID:4460
- C:\Windows\System\rFrvzqc.exe
  C:\Windows\System\rFrvzqc.exe
  2⤵
  PID:3936
- C:\Windows\System\QGIaUjG.exe
  C:\Windows\System\QGIaUjG.exe
  2⤵
  PID:3304
- C:\Windows\System\djmTlmf.exe
  C:\Windows\System\djmTlmf.exe
  2⤵
  PID:3724
- C:\Windows\System\hHUwqll.exe
  C:\Windows\System\hHUwqll.exe
  2⤵
  PID:2736
- C:\Windows\System\SNlfnTa.exe
  C:\Windows\System\SNlfnTa.exe
  2⤵
  PID:1540
- C:\Windows\System\awamKzX.exe
  C:\Windows\System\awamKzX.exe
  2⤵
  PID:2496
- C:\Windows\System\RfglIlw.exe
  C:\Windows\System\RfglIlw.exe
  2⤵
  PID:4524
- C:\Windows\System\OMNDGMH.exe
  C:\Windows\System\OMNDGMH.exe
  2⤵
  PID:4584
- C:\Windows\System\AysmtIS.exe
  C:\Windows\System\AysmtIS.exe
  2⤵
  PID:4656
- C:\Windows\System\BzozwbV.exe
  C:\Windows\System\BzozwbV.exe
  2⤵
  PID:4724
- C:\Windows\System\PGIZsSv.exe
  C:\Windows\System\PGIZsSv.exe
  2⤵
  PID:3252
- C:\Windows\System\ekYnGJb.exe
  C:\Windows\System\ekYnGJb.exe
  2⤵
  PID:1956
- C:\Windows\System\rbVNvUB.exe
  C:\Windows\System\rbVNvUB.exe
  2⤵
  PID:536
- C:\Windows\System\UxUsBQH.exe
  C:\Windows\System\UxUsBQH.exe
  2⤵
  PID:4280
- C:\Windows\System\DVZcwUa.exe
  C:\Windows\System\DVZcwUa.exe
  2⤵
  PID:3032
- C:\Windows\System\xxuXqjw.exe
  C:\Windows\System\xxuXqjw.exe
  2⤵
  PID:4544
- C:\Windows\System\YgFAXij.exe
  C:\Windows\System\YgFAXij.exe
  2⤵
  PID:2112
- C:\Windows\System\HznzBgV.exe
  C:\Windows\System\HznzBgV.exe
  2⤵
  PID:4740
- C:\Windows\System\vculMMk.exe
  C:\Windows\System\vculMMk.exe
  2⤵
  PID:4784
- C:\Windows\System\AqkTNKG.exe
  C:\Windows\System\AqkTNKG.exe
  2⤵
  PID:4356
- C:\Windows\System\jsKpjNA.exe
  C:\Windows\System\jsKpjNA.exe
  2⤵
  PID:4936
- C:\Windows\System\bknnWHp.exe
  C:\Windows\System\bknnWHp.exe
  2⤵
  PID:3384
- C:\Windows\System\UpJtoAg.exe
  C:\Windows\System\UpJtoAg.exe
  2⤵
  PID:772
- C:\Windows\System\XdVBqta.exe
  C:\Windows\System\XdVBqta.exe
  2⤵
  PID:4816
- C:\Windows\System\wzFYmHM.exe
  C:\Windows\System\wzFYmHM.exe
  2⤵
  PID:4884
- C:\Windows\System\jdgpEVE.exe
  C:\Windows\System\jdgpEVE.exe
  2⤵
  PID:4952
- C:\Windows\System\JLUpJGN.exe
  C:\Windows\System\JLUpJGN.exe
  2⤵
  PID:4948
- C:\Windows\System\fNjjcAf.exe
  C:\Windows\System\fNjjcAf.exe
  2⤵
  PID:1488
- C:\Windows\System\CDkZYtW.exe
  C:\Windows\System\CDkZYtW.exe
  2⤵
  PID:2016
- C:\Windows\System\UtmvoGl.exe
  C:\Windows\System\UtmvoGl.exe
  2⤵
  PID:5116
- C:\Windows\System\XRMJmRD.exe
  C:\Windows\System\XRMJmRD.exe
  2⤵
  PID:1032
- C:\Windows\System\ozusWNa.exe
  C:\Windows\System\ozusWNa.exe
  2⤵
  PID:3180
- C:\Windows\System\NzBFOmG.exe
  C:\Windows\System\NzBFOmG.exe
  2⤵
  PID:3452
- C:\Windows\System\SYbVJeh.exe
  C:\Windows\System\SYbVJeh.exe
  2⤵
  PID:848
- C:\Windows\System\EqMreYT.exe
  C:\Windows\System\EqMreYT.exe
  2⤵
  PID:1544
- C:\Windows\System\hSefnmU.exe
  C:\Windows\System\hSefnmU.exe
  2⤵
  PID:4216
- C:\Windows\System\ybdsOBQ.exe
  C:\Windows\System\ybdsOBQ.exe
  2⤵
  PID:1796
- C:\Windows\System\MXpxNnz.exe
  C:\Windows\System\MXpxNnz.exe
  2⤵
  PID:3760
- C:\Windows\System\oMcGwGL.exe
  C:\Windows\System\oMcGwGL.exe
  2⤵
  PID:2328
- C:\Windows\System\LsaljWX.exe
  C:\Windows\System\LsaljWX.exe
  2⤵
  PID:1916
- C:\Windows\System\UwVNiOx.exe
  C:\Windows\System\UwVNiOx.exe
  2⤵
  PID:4040
- C:\Windows\System\VHUPxIx.exe
  C:\Windows\System\VHUPxIx.exe
  2⤵
  PID:2616
- C:\Windows\System\LrvPmdM.exe
  C:\Windows\System\LrvPmdM.exe
  2⤵
  PID:4964
- C:\Windows\System\fyEXkDv.exe
  C:\Windows\System\fyEXkDv.exe
  2⤵
  PID:3512
- C:\Windows\System\gYfyKlY.exe
  C:\Windows\System\gYfyKlY.exe
  2⤵
  PID:3944
- C:\Windows\System\CdNOdSb.exe
  C:\Windows\System\CdNOdSb.exe
  2⤵
  PID:4036
- C:\Windows\System\lboiWic.exe
  C:\Windows\System\lboiWic.exe
  2⤵
  PID:2268
- C:\Windows\System\VZtCgFp.exe
  C:\Windows\System\VZtCgFp.exe
  2⤵
  PID:4820
- C:\Windows\System\QxXzJQU.exe
  C:\Windows\System\QxXzJQU.exe
  2⤵
  PID:3100
- C:\Windows\System\wXUYdpl.exe
  C:\Windows\System\wXUYdpl.exe
  2⤵
  PID:3432
- C:\Windows\System\FcdAyhs.exe
  C:\Windows\System\FcdAyhs.exe
  2⤵
  PID:1848
- C:\Windows\System\mWGVOBx.exe
  C:\Windows\System\mWGVOBx.exe
  2⤵
  PID:4556
- C:\Windows\System\jqveItC.exe
  C:\Windows\System\jqveItC.exe
  2⤵
  PID:3372
- C:\Windows\System\YHSEZnl.exe
  C:\Windows\System\YHSEZnl.exe
  2⤵
  PID:3016
- C:\Windows\System\lrgTHvl.exe
  C:\Windows\System\lrgTHvl.exe
  2⤵
  PID:844
- C:\Windows\System\lszxQei.exe
  C:\Windows\System\lszxQei.exe
  2⤵
  PID:4572
- C:\Windows\System\uuBBLJJ.exe
  C:\Windows\System\uuBBLJJ.exe
  2⤵
  PID:4604
- C:\Windows\System\YswrvpA.exe
  C:\Windows\System\YswrvpA.exe
  2⤵
  PID:4696
- C:\Windows\System\zzbDisN.exe
  C:\Windows\System\zzbDisN.exe
  2⤵
  PID:4780
- C:\Windows\System\LTeRGnf.exe
  C:\Windows\System\LTeRGnf.exe
  2⤵
  PID:3972
- C:\Windows\System\NoxmbbP.exe
  C:\Windows\System\NoxmbbP.exe
  2⤵
  PID:4796
- C:\Windows\System\RrwtIsB.exe
  C:\Windows\System\RrwtIsB.exe
  2⤵
  PID:5000
- C:\Windows\System\QYFXTAL.exe
  C:\Windows\System\QYFXTAL.exe
  2⤵
  PID:5020
- C:\Windows\System\USdrVzL.exe
  C:\Windows\System\USdrVzL.exe
  2⤵
  PID:3624
- C:\Windows\System\ZVyvlGW.exe
  C:\Windows\System\ZVyvlGW.exe
  2⤵
  PID:5012
- C:\Windows\System\euTxCLA.exe
  C:\Windows\System\euTxCLA.exe
  2⤵
  PID:2660
- C:\Windows\System\nCSHFgo.exe
  C:\Windows\System\nCSHFgo.exe
  2⤵
  PID:4360
- C:\Windows\System\FKISVZS.exe
  C:\Windows\System\FKISVZS.exe
  2⤵
  PID:2796
- C:\Windows\System\idaBRhB.exe
  C:\Windows\System\idaBRhB.exe
  2⤵
  PID:4768
- C:\Windows\System\ZXKVBcF.exe
  C:\Windows\System\ZXKVBcF.exe
  2⤵
  PID:3844
- C:\Windows\System\QBKAbcH.exe
  C:\Windows\System\QBKAbcH.exe
  2⤵
  PID:2392
- C:\Windows\System\ccDZJNF.exe
  C:\Windows\System\ccDZJNF.exe
  2⤵
  PID:2704
- C:\Windows\System\ySMeAkU.exe
  C:\Windows\System\ySMeAkU.exe
  2⤵
  PID:3116
- C:\Windows\System\IaFYrAm.exe
  C:\Windows\System\IaFYrAm.exe
  2⤵
  PID:3792
- C:\Windows\System\oSmjPTt.exe
  C:\Windows\System\oSmjPTt.exe
  2⤵
  PID:4292
- C:\Windows\System\OQoKzmD.exe
  C:\Windows\System\OQoKzmD.exe
  2⤵
  PID:4728
- C:\Windows\System\VEaiYLT.exe
  C:\Windows\System\VEaiYLT.exe
  2⤵
  PID:1948
- C:\Windows\System\zahZWrh.exe
  C:\Windows\System\zahZWrh.exe
  2⤵
  PID:2068
- C:\Windows\System\RDGRYLr.exe
  C:\Windows\System\RDGRYLr.exe
  2⤵
  PID:1196
- C:\Windows\System\MfQoDeI.exe
  C:\Windows\System\MfQoDeI.exe
  2⤵
  PID:2420
- C:\Windows\System\DYmjlJp.exe
  C:\Windows\System\DYmjlJp.exe
  2⤵
  PID:4528
- C:\Windows\System\jtgXDaw.exe
  C:\Windows\System\jtgXDaw.exe
  2⤵
  PID:4560
- C:\Windows\System\GAnGzZo.exe
  C:\Windows\System\GAnGzZo.exe
  2⤵
  PID:2548
- C:\Windows\System\qlfxuXA.exe
  C:\Windows\System\qlfxuXA.exe
  2⤵
  PID:1856
- C:\Windows\System\OwoWTfJ.exe
  C:\Windows\System\OwoWTfJ.exe
  2⤵
  PID:3420
- C:\Windows\System\dEijbmJ.exe
  C:\Windows\System\dEijbmJ.exe
  2⤵
  PID:4640
- C:\Windows\System\JNawcBE.exe
  C:\Windows\System\JNawcBE.exe
  2⤵
  PID:2348
- C:\Windows\System\UUYdPaS.exe
  C:\Windows\System\UUYdPaS.exe
  2⤵
  PID:2764
- C:\Windows\System\LCdaVZB.exe
  C:\Windows\System\LCdaVZB.exe
  2⤵
  PID:4508
- C:\Windows\System\pfdZBVm.exe
  C:\Windows\System\pfdZBVm.exe
  2⤵
  PID:5136
- C:\Windows\System\XnBFkfb.exe
  C:\Windows\System\XnBFkfb.exe
  2⤵
  PID:5152
- C:\Windows\System\Polsspf.exe
  C:\Windows\System\Polsspf.exe
  2⤵
  PID:5168
- C:\Windows\System\nCdszje.exe
  C:\Windows\System\nCdszje.exe
  2⤵
  PID:5188
- C:\Windows\System\fEjSAdm.exe
  C:\Windows\System\fEjSAdm.exe
  2⤵
  PID:5208
- C:\Windows\System\wSLkoIh.exe
  C:\Windows\System\wSLkoIh.exe
  2⤵
  PID:5224
- C:\Windows\System\hLqqcan.exe
  C:\Windows\System\hLqqcan.exe
  2⤵
  PID:5240
- C:\Windows\System\ssRtqPq.exe
  C:\Windows\System\ssRtqPq.exe
  2⤵
  PID:5324
- C:\Windows\System\imEsVJX.exe
  C:\Windows\System\imEsVJX.exe
  2⤵
  PID:5340
- C:\Windows\System\KnQMCmU.exe
  C:\Windows\System\KnQMCmU.exe
  2⤵
  PID:5356
- C:\Windows\System\wIeGaty.exe
  C:\Windows\System\wIeGaty.exe
  2⤵
  PID:5372
- C:\Windows\System\DEAyHqW.exe
  C:\Windows\System\DEAyHqW.exe
  2⤵
  PID:5388
- C:\Windows\System\EzycSOY.exe
  C:\Windows\System\EzycSOY.exe
  2⤵
  PID:5404
- C:\Windows\System\kDhJzgS.exe
  C:\Windows\System\kDhJzgS.exe
  2⤵
  PID:5420
- C:\Windows\System\xoxRXsK.exe
  C:\Windows\System\xoxRXsK.exe
  2⤵
  PID:5436
- C:\Windows\System\FXMnqNj.exe
  C:\Windows\System\FXMnqNj.exe
  2⤵
  PID:5452
- C:\Windows\System\oiSrhjr.exe
  C:\Windows\System\oiSrhjr.exe
  2⤵
  PID:5468
- C:\Windows\System\BsvMjnR.exe
  C:\Windows\System\BsvMjnR.exe
  2⤵
  PID:5492
- C:\Windows\System\HTudeux.exe
  C:\Windows\System\HTudeux.exe
  2⤵
  PID:5512
- C:\Windows\System\eMtFUJU.exe
  C:\Windows\System\eMtFUJU.exe
  2⤵
  PID:5528
- C:\Windows\System\kJJQmyO.exe
  C:\Windows\System\kJJQmyO.exe
  2⤵
  PID:5544
- C:\Windows\System\XpxiwrW.exe
  C:\Windows\System\XpxiwrW.exe
  2⤵
  PID:5560
- C:\Windows\System\ZxNQkmN.exe
  C:\Windows\System\ZxNQkmN.exe
  2⤵
  PID:5576
- C:\Windows\System\wVNdZJZ.exe
  C:\Windows\System\wVNdZJZ.exe
  2⤵
  PID:5592
- C:\Windows\System\iHDYeiM.exe
  C:\Windows\System\iHDYeiM.exe
  2⤵
  PID:5608
- C:\Windows\System\boenFxd.exe
  C:\Windows\System\boenFxd.exe
  2⤵
  PID:5628
- C:\Windows\System\oYVHOlU.exe
  C:\Windows\System\oYVHOlU.exe
  2⤵
  PID:5644
- C:\Windows\System\gMLcfGy.exe
  C:\Windows\System\gMLcfGy.exe
  2⤵
  PID:5660
- C:\Windows\System\vIvzUUQ.exe
  C:\Windows\System\vIvzUUQ.exe
  2⤵
  PID:5676
- C:\Windows\System\QJrTCLJ.exe
  C:\Windows\System\QJrTCLJ.exe
  2⤵
  PID:5692
- C:\Windows\System\irGvCHf.exe
  C:\Windows\System\irGvCHf.exe
  2⤵
  PID:5708
- C:\Windows\System\PjhEpbq.exe
  C:\Windows\System\PjhEpbq.exe
  2⤵
  PID:5880
- C:\Windows\System\KxVuNGs.exe
  C:\Windows\System\KxVuNGs.exe
  2⤵
  PID:5896
- C:\Windows\System\yjFOHuC.exe
  C:\Windows\System\yjFOHuC.exe
  2⤵
  PID:5912
- C:\Windows\System\Vwddxqu.exe
  C:\Windows\System\Vwddxqu.exe
  2⤵
  PID:5928
- C:\Windows\System\KHPXfWB.exe
  C:\Windows\System\KHPXfWB.exe
  2⤵
  PID:5944
- C:\Windows\System\fhkhRmv.exe
  C:\Windows\System\fhkhRmv.exe
  2⤵
  PID:5960
- C:\Windows\System\ppFgnMD.exe
  C:\Windows\System\ppFgnMD.exe
  2⤵
  PID:5976
- C:\Windows\System\vAkJePA.exe
  C:\Windows\System\vAkJePA.exe
  2⤵
  PID:5992
- C:\Windows\System\FDcqsxd.exe
  C:\Windows\System\FDcqsxd.exe
  2⤵
  PID:6008
- C:\Windows\System\YDbEtkC.exe
  C:\Windows\System\YDbEtkC.exe
  2⤵
  PID:6028
- C:\Windows\System\oquWtqO.exe
  C:\Windows\System\oquWtqO.exe
  2⤵
  PID:6044
- C:\Windows\System\nfkGpwc.exe
  C:\Windows\System\nfkGpwc.exe
  2⤵
  PID:6060
- C:\Windows\System\RkcckUq.exe
  C:\Windows\System\RkcckUq.exe
  2⤵
  PID:6076
- C:\Windows\System\mfZeYQc.exe
  C:\Windows\System\mfZeYQc.exe
  2⤵
  PID:6092
- C:\Windows\System\OyVbNFd.exe
  C:\Windows\System\OyVbNFd.exe
  2⤵
  PID:6108
- C:\Windows\System\ugAbXTS.exe
  C:\Windows\System\ugAbXTS.exe
  2⤵
  PID:6124
- C:\Windows\System\OMeFAby.exe
  C:\Windows\System\OMeFAby.exe
  2⤵
  PID:6140
- C:\Windows\System\CfAHoDh.exe
  C:\Windows\System\CfAHoDh.exe
  2⤵
  PID:4880
- C:\Windows\System\icMryXc.exe
  C:\Windows\System\icMryXc.exe
  2⤵
  PID:4116
- C:\Windows\System\DqDnzbQ.exe
  C:\Windows\System\DqDnzbQ.exe
  2⤵
  PID:2272
- C:\Windows\System\jcRsXQk.exe
  C:\Windows\System\jcRsXQk.exe
  2⤵
  PID:4052
- C:\Windows\System\kNMhHeM.exe
  C:\Windows\System\kNMhHeM.exe
  2⤵
  PID:1036
- C:\Windows\System\INTLHly.exe
  C:\Windows\System\INTLHly.exe
  2⤵
  PID:1736
- C:\Windows\System\axDCKOI.exe
  C:\Windows\System\axDCKOI.exe
  2⤵
  PID:4276
- C:\Windows\System\NpSprMg.exe
  C:\Windows\System\NpSprMg.exe
  2⤵
  PID:4672
- C:\Windows\System\kseXCtS.exe
  C:\Windows\System\kseXCtS.exe
  2⤵
  PID:5144
- C:\Windows\System\jPLWiGh.exe
  C:\Windows\System\jPLWiGh.exe
  2⤵
  PID:5216
- C:\Windows\System\fWhsDbH.exe
  C:\Windows\System\fWhsDbH.exe
  2⤵
  PID:2340
- C:\Windows\System\avestvJ.exe
  C:\Windows\System\avestvJ.exe
  2⤵
  PID:5100
- C:\Windows\System\qONxcIi.exe
  C:\Windows\System\qONxcIi.exe
  2⤵
  PID:2912
- C:\Windows\System\mgzxecr.exe
  C:\Windows\System\mgzxecr.exe
  2⤵
  PID:3224
- C:\Windows\System\dgvmmLJ.exe
  C:\Windows\System\dgvmmLJ.exe
  2⤵
  PID:4652
- C:\Windows\System\jyQeDbC.exe
  C:\Windows\System\jyQeDbC.exe
  2⤵
  PID:5196
- C:\Windows\System\TzHZwgA.exe
  C:\Windows\System\TzHZwgA.exe
  2⤵
  PID:5256
- C:\Windows\System\LgMzkjz.exe
  C:\Windows\System\LgMzkjz.exe
  2⤵
  PID:5272
- C:\Windows\System\zqmYkeU.exe
  C:\Windows\System\zqmYkeU.exe
  2⤵
  PID:5332
- C:\Windows\System\fCHYzkh.exe
  C:\Windows\System\fCHYzkh.exe
  2⤵
  PID:5668
- C:\Windows\System\JukXZHQ.exe
  C:\Windows\System\JukXZHQ.exe
  2⤵
  PID:5600
- C:\Windows\System\qbIXclz.exe
  C:\Windows\System\qbIXclz.exe
  2⤵
  PID:5536
- C:\Windows\System\OzPBPtQ.exe
  C:\Windows\System\OzPBPtQ.exe
  2⤵
  PID:5464
- C:\Windows\System\JyVvibE.exe
  C:\Windows\System\JyVvibE.exe
  2⤵
  PID:5400
- C:\Windows\System\akyoopc.exe
  C:\Windows\System\akyoopc.exe
  2⤵
  PID:5336
- C:\Windows\System\RSrgOMD.exe
  C:\Windows\System\RSrgOMD.exe
  2⤵
  PID:5384
- C:\Windows\System\VLBrmFt.exe
  C:\Windows\System\VLBrmFt.exe
  2⤵
  PID:5620
- C:\Windows\System\FNpxJUz.exe
  C:\Windows\System\FNpxJUz.exe
  2⤵
  PID:5292
- C:\Windows\System\eQPpPEe.exe
  C:\Windows\System\eQPpPEe.exe
  2⤵
  PID:5308
- C:\Windows\System\pujNvHU.exe
  C:\Windows\System\pujNvHU.exe
  2⤵
  PID:5720
- C:\Windows\System\sQmhxTt.exe
  C:\Windows\System\sQmhxTt.exe
  2⤵
  PID:5444
- C:\Windows\System\skeKhol.exe
  C:\Windows\System\skeKhol.exe
  2⤵
  PID:5484
- C:\Windows\System\XLBQASk.exe
  C:\Windows\System\XLBQASk.exe
  2⤵
  PID:5556
- C:\Windows\System\wzWTYFb.exe
  C:\Windows\System\wzWTYFb.exe
  2⤵
  PID:5688
- C:\Windows\System\WdiVJlh.exe
  C:\Windows\System\WdiVJlh.exe
  2⤵
  PID:5736
- C:\Windows\System\IkxlQnv.exe
  C:\Windows\System\IkxlQnv.exe
  2⤵
  PID:5752
- C:\Windows\System\cnctnxl.exe
  C:\Windows\System\cnctnxl.exe
  2⤵
  PID:5768
- C:\Windows\System\uPjuXZj.exe
  C:\Windows\System\uPjuXZj.exe
  2⤵
  PID:5784
- C:\Windows\System\GknqSmc.exe
  C:\Windows\System\GknqSmc.exe
  2⤵
  PID:5800
- C:\Windows\System\evLClKC.exe
  C:\Windows\System\evLClKC.exe
  2⤵
  PID:5816
- C:\Windows\System\cvwUtIW.exe
  C:\Windows\System\cvwUtIW.exe
  2⤵
  PID:5832
- C:\Windows\System\jpKAkWq.exe
  C:\Windows\System\jpKAkWq.exe
  2⤵
  PID:5852
- C:\Windows\System\XrrYTCr.exe
  C:\Windows\System\XrrYTCr.exe
  2⤵
  PID:5868
- C:\Windows\System\qQsGkIq.exe
  C:\Windows\System\qQsGkIq.exe
  2⤵
  PID:5908
- C:\Windows\System\YnwtYwk.exe
  C:\Windows\System\YnwtYwk.exe
  2⤵
  PID:5920
- C:\Windows\System\nObsTJv.exe
  C:\Windows\System\nObsTJv.exe
  2⤵
  PID:5984
- C:\Windows\System\HaSuCSQ.exe
  C:\Windows\System\HaSuCSQ.exe
  2⤵
  PID:6052
- C:\Windows\System\LijtwtB.exe
  C:\Windows\System\LijtwtB.exe
  2⤵
  PID:6088
- C:\Windows\System\QyshpKD.exe
  C:\Windows\System\QyshpKD.exe
  2⤵
  PID:3776
- C:\Windows\System\TNewxgF.exe
  C:\Windows\System\TNewxgF.exe
  2⤵
  PID:5940
- C:\Windows\System\pSoxPVi.exe
  C:\Windows\System\pSoxPVi.exe
  2⤵
  PID:5972
- C:\Windows\System\rOxZkju.exe
  C:\Windows\System\rOxZkju.exe
  2⤵
  PID:6072
- C:\Windows\System\ghgUtoW.exe
  C:\Windows\System\ghgUtoW.exe
  2⤵
  PID:6132
- C:\Windows\System\rubWEKV.exe
  C:\Windows\System\rubWEKV.exe
  2⤵
  PID:1192
- C:\Windows\System\mOUcpYE.exe
  C:\Windows\System\mOUcpYE.exe
  2⤵
  PID:3144
- C:\Windows\System\DmJIuPp.exe
  C:\Windows\System\DmJIuPp.exe
  2⤵
  PID:2064
- C:\Windows\System\ujXkSry.exe
  C:\Windows\System\ujXkSry.exe
  2⤵
  PID:4920
- C:\Windows\System\WvVvVXN.exe
  C:\Windows\System\WvVvVXN.exe
  2⤵
  PID:2948
- C:\Windows\System\bVKFNzb.exe
  C:\Windows\System\bVKFNzb.exe
  2⤵
  PID:1604
- C:\Windows\System\dzvfeNj.exe
  C:\Windows\System\dzvfeNj.exe
  2⤵
  PID:5252
- C:\Windows\System\ISPDcIs.exe
  C:\Windows\System\ISPDcIs.exe
  2⤵
  PID:5160
- C:\Windows\System\RPyPVfT.exe
  C:\Windows\System\RPyPVfT.exe
  2⤵
  PID:1928
- C:\Windows\System\ZgFiKnr.exe
  C:\Windows\System\ZgFiKnr.exe
  2⤵
  PID:2720
- C:\Windows\System\YbHWLVR.exe
  C:\Windows\System\YbHWLVR.exe
  2⤵
  PID:5280
- C:\Windows\System\dpwyYYw.exe
  C:\Windows\System\dpwyYYw.exe
  2⤵
  PID:5604
- C:\Windows\System\DUtpJSd.exe
  C:\Windows\System\DUtpJSd.exe
  2⤵
  PID:5500
- C:\Windows\System\rBtLMgC.exe
  C:\Windows\System\rBtLMgC.exe
  2⤵
  PID:5568
- C:\Windows\System\tMlecyY.exe
  C:\Windows\System\tMlecyY.exe
  2⤵
  PID:5368
- C:\Windows\System\cOfPRpp.exe
  C:\Windows\System\cOfPRpp.exe
  2⤵
  PID:5284
- C:\Windows\System\WPZVMQF.exe
  C:\Windows\System\WPZVMQF.exe
  2⤵
  PID:5552
- C:\Windows\System\pTjUkEf.exe
  C:\Windows\System\pTjUkEf.exe
  2⤵
  PID:5380
- C:\Windows\System\IwBNmyk.exe
  C:\Windows\System\IwBNmyk.exe
  2⤵
  PID:5524
- C:\Windows\System\sNhEIyP.exe
  C:\Windows\System\sNhEIyP.exe
  2⤵
  PID:5760
- C:\Windows\System\qbDFluQ.exe
  C:\Windows\System\qbDFluQ.exe
  2⤵
  PID:5796
- C:\Windows\System\tIuzDLU.exe
  C:\Windows\System\tIuzDLU.exe
  2⤵
  PID:5864
- C:\Windows\System\BdimNot.exe
  C:\Windows\System\BdimNot.exe
  2⤵
  PID:5892
- C:\Windows\System\AezSeCh.exe
  C:\Windows\System\AezSeCh.exe
  2⤵
  PID:5780
- C:\Windows\System\vHeqOdV.exe
  C:\Windows\System\vHeqOdV.exe
  2⤵
  PID:5840
- C:\Windows\System\LSrbLvo.exe
  C:\Windows\System\LSrbLvo.exe
  2⤵
  PID:6056
- C:\Windows\System\ivSduhB.exe
  C:\Windows\System\ivSduhB.exe
  2⤵
  PID:5080
- C:\Windows\System\NgqzRMI.exe
  C:\Windows\System\NgqzRMI.exe
  2⤵
  PID:5968
- C:\Windows\System\FDvtPac.exe
  C:\Windows\System\FDvtPac.exe
  2⤵
  PID:2592
- C:\Windows\System\gZKrlTC.exe
  C:\Windows\System\gZKrlTC.exe
  2⤵
  PID:4296
- C:\Windows\System\YUOUCVn.exe
  C:\Windows\System\YUOUCVn.exe
  2⤵
  PID:5176
- C:\Windows\System\ZNvThtY.exe
  C:\Windows\System\ZNvThtY.exe
  2⤵
  PID:2376
- C:\Windows\System\LkeUerf.exe
  C:\Windows\System\LkeUerf.exe
  2⤵
  PID:1988
- C:\Windows\System\vCdQaln.exe
  C:\Windows\System\vCdQaln.exe
  2⤵
  PID:5236
- C:\Windows\System\YDkgXkS.exe
  C:\Windows\System\YDkgXkS.exe
  2⤵
  PID:1976
- C:\Windows\System\HiKEgao.exe
  C:\Windows\System\HiKEgao.exe
  2⤵
  PID:5128
- C:\Windows\System\buWeuVW.exe
  C:\Windows\System\buWeuVW.exe
  2⤵
  PID:5320
- C:\Windows\System\JQHcOoE.exe
  C:\Windows\System\JQHcOoE.exe
  2⤵
  PID:5656
- C:\Windows\System\SpTpGEb.exe
  C:\Windows\System\SpTpGEb.exe
  2⤵
  PID:5476
- C:\Windows\System\pzSkJGl.exe
  C:\Windows\System\pzSkJGl.exe
  2⤵
  PID:5844
- C:\Windows\System\CNSFaAt.exe
  C:\Windows\System\CNSFaAt.exe
  2⤵
  PID:5876
- C:\Windows\System\ecYnOYT.exe
  C:\Windows\System\ecYnOYT.exe
  2⤵
  PID:5888
- C:\Windows\System\RqzVdDl.exe
  C:\Windows\System\RqzVdDl.exe
  2⤵
  PID:5096
- C:\Windows\System\ithpgYI.exe
  C:\Windows\System\ithpgYI.exe
  2⤵
  PID:1756
- C:\Windows\System\GTRleDG.exe
  C:\Windows\System\GTRleDG.exe
  2⤵
  PID:2040
- C:\Windows\System\jCChbAl.exe
  C:\Windows\System\jCChbAl.exe
  2⤵
  PID:5828
- C:\Windows\System\yslpGih.exe
  C:\Windows\System\yslpGih.exe
  2⤵
  PID:2052
- C:\Windows\System\PGCNgbW.exe
  C:\Windows\System\PGCNgbW.exe
  2⤵
  PID:3416
- C:\Windows\System\RhmuVNn.exe
  C:\Windows\System\RhmuVNn.exe
  2⤵
  PID:5288
- C:\Windows\System\DQSMDGX.exe
  C:\Windows\System\DQSMDGX.exe
  2⤵
  PID:5776
- C:\Windows\System\PTnCauF.exe
  C:\Windows\System\PTnCauF.exe
  2⤵
  PID:5432
- C:\Windows\System\enGqFEj.exe
  C:\Windows\System\enGqFEj.exe
  2⤵
  PID:4916
- C:\Windows\System\GoRBPGV.exe
  C:\Windows\System\GoRBPGV.exe
  2⤵
  PID:6160
- C:\Windows\System\hRsIwRx.exe
  C:\Windows\System\hRsIwRx.exe
  2⤵
  PID:6176
- C:\Windows\System\cJjJfgZ.exe
  C:\Windows\System\cJjJfgZ.exe
  2⤵
  PID:6192
- C:\Windows\System\YbTRrLt.exe
  C:\Windows\System\YbTRrLt.exe
  2⤵
  PID:6208
- C:\Windows\System\inEOTId.exe
  C:\Windows\System\inEOTId.exe
  2⤵
  PID:6224
- C:\Windows\System\oEPhgus.exe
  C:\Windows\System\oEPhgus.exe
  2⤵
  PID:6240
- C:\Windows\System\suxKmms.exe
  C:\Windows\System\suxKmms.exe
  2⤵
  PID:6256
- C:\Windows\System\SOEQbyJ.exe
  C:\Windows\System\SOEQbyJ.exe
  2⤵
  PID:6272
- C:\Windows\System\SVvFSCI.exe
  C:\Windows\System\SVvFSCI.exe
  2⤵
  PID:6288
- C:\Windows\System\fyNniUq.exe
  C:\Windows\System\fyNniUq.exe
  2⤵
  PID:6304
- C:\Windows\System\MNdAAGd.exe
  C:\Windows\System\MNdAAGd.exe
  2⤵
  PID:6320
- C:\Windows\System\jvHtVxG.exe
  C:\Windows\System\jvHtVxG.exe
  2⤵
  PID:6336
- C:\Windows\System\EyNNLlP.exe
  C:\Windows\System\EyNNLlP.exe
  2⤵
  PID:6352
- C:\Windows\System\dXZkqDO.exe
  C:\Windows\System\dXZkqDO.exe
  2⤵
  PID:6368
- C:\Windows\System\nfdAwZK.exe
  C:\Windows\System\nfdAwZK.exe
  2⤵
  PID:6388
- C:\Windows\System\cyukxre.exe
  C:\Windows\System\cyukxre.exe
  2⤵
  PID:6404
- C:\Windows\System\XavidIO.exe
  C:\Windows\System\XavidIO.exe
  2⤵
  PID:6420
- C:\Windows\System\yIoPVaQ.exe
  C:\Windows\System\yIoPVaQ.exe
  2⤵
  PID:6436
- C:\Windows\System\xBwLBwD.exe
  C:\Windows\System\xBwLBwD.exe
  2⤵
  PID:6452
- C:\Windows\System\dJgiLwm.exe
  C:\Windows\System\dJgiLwm.exe
  2⤵
  PID:6468
- C:\Windows\System\YEbnPyX.exe
  C:\Windows\System\YEbnPyX.exe
  2⤵
  PID:6484
- C:\Windows\System\TjLOglL.exe
  C:\Windows\System\TjLOglL.exe
  2⤵
  PID:6500
- C:\Windows\System\Iowqbgi.exe
  C:\Windows\System\Iowqbgi.exe
  2⤵
  PID:6516
- C:\Windows\System\RCZWpum.exe
  C:\Windows\System\RCZWpum.exe
  2⤵
  PID:6532
- C:\Windows\System\uJVPlWm.exe
  C:\Windows\System\uJVPlWm.exe
  2⤵
  PID:6548
- C:\Windows\System\JSWiwJm.exe
  C:\Windows\System\JSWiwJm.exe
  2⤵
  PID:6564
- C:\Windows\System\XkCEbKA.exe
  C:\Windows\System\XkCEbKA.exe
  2⤵
  PID:6580
- C:\Windows\System\xglsyHK.exe
  C:\Windows\System\xglsyHK.exe
  2⤵
  PID:6596
- C:\Windows\System\JIpwnoy.exe
  C:\Windows\System\JIpwnoy.exe
  2⤵
  PID:6612
- C:\Windows\System\FEYTkAQ.exe
  C:\Windows\System\FEYTkAQ.exe
  2⤵
  PID:6632
- C:\Windows\System\SwfEwti.exe
  C:\Windows\System\SwfEwti.exe
  2⤵
  PID:6648
- C:\Windows\System\YXGtoNc.exe
  C:\Windows\System\YXGtoNc.exe
  2⤵
  PID:6664
- C:\Windows\System\voKfEKH.exe
  C:\Windows\System\voKfEKH.exe
  2⤵
  PID:6680
- C:\Windows\System\igDIsLq.exe
  C:\Windows\System\igDIsLq.exe
  2⤵
  PID:6696
- C:\Windows\System\ZnzGbbg.exe
  C:\Windows\System\ZnzGbbg.exe
  2⤵
  PID:6712
- C:\Windows\System\QLwScgB.exe
  C:\Windows\System\QLwScgB.exe
  2⤵
  PID:6728
- C:\Windows\System\gdqTNLj.exe
  C:\Windows\System\gdqTNLj.exe
  2⤵
  PID:6744
- C:\Windows\System\oxFJqUR.exe
  C:\Windows\System\oxFJqUR.exe
  2⤵
  PID:6760
- C:\Windows\System\iLYzBGx.exe
  C:\Windows\System\iLYzBGx.exe
  2⤵
  PID:6776
- C:\Windows\System\TsKdrRY.exe
  C:\Windows\System\TsKdrRY.exe
  2⤵
  PID:6792
- C:\Windows\System\ZMBxSSq.exe
  C:\Windows\System\ZMBxSSq.exe
  2⤵
  PID:6808
- C:\Windows\System\rFFcyUa.exe
  C:\Windows\System\rFFcyUa.exe
  2⤵
  PID:6824
- C:\Windows\System\ZvSVeRo.exe
  C:\Windows\System\ZvSVeRo.exe
  2⤵
  PID:6840
- C:\Windows\System\fJOuFuM.exe
  C:\Windows\System\fJOuFuM.exe
  2⤵
  PID:6856
- C:\Windows\System\NIoRbbz.exe
  C:\Windows\System\NIoRbbz.exe
  2⤵
  PID:6872
- C:\Windows\System\sBZQWHu.exe
  C:\Windows\System\sBZQWHu.exe
  2⤵
  PID:6888
- C:\Windows\System\xdOYrQu.exe
  C:\Windows\System\xdOYrQu.exe
  2⤵
  PID:6904
- C:\Windows\System\jrysWdk.exe
  C:\Windows\System\jrysWdk.exe
  2⤵
  PID:6920
- C:\Windows\System\vovXySj.exe
  C:\Windows\System\vovXySj.exe
  2⤵
  PID:6936
- C:\Windows\System\uSMqiKN.exe
  C:\Windows\System\uSMqiKN.exe
  2⤵
  PID:6952
- C:\Windows\System\MdaNgNf.exe
  C:\Windows\System\MdaNgNf.exe
  2⤵
  PID:6980
- C:\Windows\System\bcdHvfR.exe
  C:\Windows\System\bcdHvfR.exe
  2⤵
  PID:6996
- C:\Windows\System\vEaKfCx.exe
  C:\Windows\System\vEaKfCx.exe
  2⤵
  PID:7012
- C:\Windows\System\MjfJRGc.exe
  C:\Windows\System\MjfJRGc.exe
  2⤵
  PID:7028
- C:\Windows\System\dOLaNZK.exe
  C:\Windows\System\dOLaNZK.exe
  2⤵
  PID:7044
- C:\Windows\System\dGDHPvw.exe
  C:\Windows\System\dGDHPvw.exe
  2⤵
  PID:7060
- C:\Windows\System\uhyyvIa.exe
  C:\Windows\System\uhyyvIa.exe
  2⤵
  PID:7076
- C:\Windows\System\WHlHaGL.exe
  C:\Windows\System\WHlHaGL.exe
  2⤵
  PID:7092
- C:\Windows\System\kXaTujm.exe
  C:\Windows\System\kXaTujm.exe
  2⤵
  PID:7108
- C:\Windows\System\jDYoiBU.exe
  C:\Windows\System\jDYoiBU.exe
  2⤵
  PID:7124
- C:\Windows\System\PKCzxOW.exe
  C:\Windows\System\PKCzxOW.exe
  2⤵
  PID:7140
- C:\Windows\System\ZrZcats.exe
  C:\Windows\System\ZrZcats.exe
  2⤵
  PID:7156
- C:\Windows\System\eMXcaql.exe
  C:\Windows\System\eMXcaql.exe
  2⤵
  PID:5748
- C:\Windows\System\tmZTolb.exe
  C:\Windows\System\tmZTolb.exe
  2⤵
  PID:6172
- C:\Windows\System\isIPCuZ.exe
  C:\Windows\System\isIPCuZ.exe
  2⤵
  PID:6084
- C:\Windows\System\ZPQrpZL.exe
  C:\Windows\System\ZPQrpZL.exe
  2⤵
  PID:5808
- C:\Windows\System\ttqkISA.exe
  C:\Windows\System\ttqkISA.exe
  2⤵
  PID:6152
- C:\Windows\System\RdeMbnw.exe
  C:\Windows\System\RdeMbnw.exe
  2⤵
  PID:6204
- C:\Windows\System\dbDsIxC.exe
  C:\Windows\System\dbDsIxC.exe
  2⤵
  PID:6268
- C:\Windows\System\CrdVBQP.exe
  C:\Windows\System\CrdVBQP.exe
  2⤵
  PID:6360
- C:\Windows\System\kNiBVYA.exe
  C:\Windows\System\kNiBVYA.exe
  2⤵
  PID:6428
- C:\Windows\System\oGYgLBC.exe
  C:\Windows\System\oGYgLBC.exe
  2⤵
  PID:6464
- C:\Windows\System\TfCIknE.exe
  C:\Windows\System\TfCIknE.exe
  2⤵
  PID:6524
- C:\Windows\System\kzifNKd.exe
  C:\Windows\System\kzifNKd.exe
  2⤵
  PID:6380
- C:\Windows\System\FbmXWWE.exe
  C:\Windows\System\FbmXWWE.exe
  2⤵
  PID:6248
- C:\Windows\System\wHiZeun.exe
  C:\Windows\System\wHiZeun.exe
  2⤵
  PID:6316
- C:\Windows\System\aqkUdqs.exe
  C:\Windows\System\aqkUdqs.exe
  2⤵
  PID:6444
- C:\Windows\System\YgrxZch.exe
  C:\Windows\System\YgrxZch.exe
  2⤵
  PID:6512
- C:\Windows\System\OGZbLPQ.exe
  C:\Windows\System\OGZbLPQ.exe
  2⤵
  PID:6588
- C:\Windows\System\vhRZzJR.exe
  C:\Windows\System\vhRZzJR.exe
  2⤵
  PID:3044
- C:\Windows\System\eDwVZhb.exe
  C:\Windows\System\eDwVZhb.exe
  2⤵
  PID:6624
- C:\Windows\System\mpFLZUl.exe
  C:\Windows\System\mpFLZUl.exe
  2⤵
  PID:6604
- C:\Windows\System\gnugPge.exe
  C:\Windows\System\gnugPge.exe
  2⤵
  PID:6676
- C:\Windows\System\AbcvbLw.exe
  C:\Windows\System\AbcvbLw.exe
  2⤵
  PID:6720
- C:\Windows\System\bkORPPf.exe
  C:\Windows\System\bkORPPf.exe
  2⤵
  PID:6704
- C:\Windows\System\ajCiwMB.exe
  C:\Windows\System\ajCiwMB.exe
  2⤵
  PID:6740
- C:\Windows\System\HTzRPyj.exe
  C:\Windows\System\HTzRPyj.exe
  2⤵
  PID:6784
- C:\Windows\System\APHWJmv.exe
  C:\Windows\System\APHWJmv.exe
  2⤵
  PID:6804
- C:\Windows\System\yPIrQNR.exe
  C:\Windows\System\yPIrQNR.exe
  2⤵
  PID:6900
- C:\Windows\System\dRDrFhC.exe
  C:\Windows\System\dRDrFhC.exe
  2⤵
  PID:6944
- C:\Windows\System\RbIgEEf.exe
  C:\Windows\System\RbIgEEf.exe
  2⤵
  PID:6884
- C:\Windows\System\FIGwDpQ.exe
  C:\Windows\System\FIGwDpQ.exe
  2⤵
  PID:6816
- C:\Windows\System\YlesgXT.exe
  C:\Windows\System\YlesgXT.exe
  2⤵
  PID:6976
- C:\Windows\System\sQKGdBZ.exe
  C:\Windows\System\sQKGdBZ.exe
  2⤵
  PID:7024
- C:\Windows\System\aWsOTiA.exe
  C:\Windows\System\aWsOTiA.exe
  2⤵
  PID:7088
- C:\Windows\System\xkrAuVT.exe
  C:\Windows\System\xkrAuVT.exe
  2⤵
  PID:7152
- C:\Windows\System\HTQDAaM.exe
  C:\Windows\System\HTQDAaM.exe
  2⤵
  PID:6036
- C:\Windows\System\VmqoRys.exe
  C:\Windows\System\VmqoRys.exe
  2⤵
  PID:6332
- C:\Windows\System\VJcNXkx.exe
  C:\Windows\System\VJcNXkx.exe
  2⤵
  PID:6348
- C:\Windows\System\vWMoRVu.exe
  C:\Windows\System\vWMoRVu.exe
  2⤵
  PID:6364
- C:\Windows\System\RbLGaiX.exe
  C:\Windows\System\RbLGaiX.exe
  2⤵
  PID:7036
- C:\Windows\System\VKkjbCx.exe
  C:\Windows\System\VKkjbCx.exe
  2⤵
  PID:7100
- C:\Windows\System\lgYPQrK.exe
  C:\Windows\System\lgYPQrK.exe
  2⤵
  PID:6200
- C:\Windows\System\lsfrVpv.exe
  C:\Windows\System\lsfrVpv.exe
  2⤵
  PID:6264
- C:\Windows\System\ECKYqYB.exe
  C:\Windows\System\ECKYqYB.exe
  2⤵
  PID:6528
- C:\Windows\System\VjbojXf.exe
  C:\Windows\System\VjbojXf.exe
  2⤵
  PID:6416
- C:\Windows\System\DlEatmd.exe
  C:\Windows\System\DlEatmd.exe
  2⤵
  PID:6660
- C:\Windows\System\nwXnKPi.exe
  C:\Windows\System\nwXnKPi.exe
  2⤵
  PID:6832
- C:\Windows\System\rQwCRhV.exe
  C:\Windows\System\rQwCRhV.exe
  2⤵
  PID:6820
- C:\Windows\System\FkZNEnT.exe
  C:\Windows\System\FkZNEnT.exe
  2⤵
  PID:7120
- C:\Windows\System\AEzOQbz.exe
  C:\Windows\System\AEzOQbz.exe
  2⤵
  PID:7004
- C:\Windows\System\DIAqXyi.exe
  C:\Windows\System\DIAqXyi.exe
  2⤵
  PID:6620
- C:\Windows\System\FQkTeKp.exe
  C:\Windows\System\FQkTeKp.exe
  2⤵
  PID:6692
- C:\Windows\System\eiJYagr.exe
  C:\Windows\System\eiJYagr.exe
  2⤵
  PID:6848
- C:\Windows\System\CZSWFsl.exe
  C:\Windows\System\CZSWFsl.exe
  2⤵
  PID:7056
- C:\Windows\System\caLIUMS.exe
  C:\Windows\System\caLIUMS.exe
  2⤵
  PID:6460
- C:\Windows\System\sCoHmGZ.exe
  C:\Windows\System\sCoHmGZ.exe
  2⤵
  PID:5636
- C:\Windows\System\zabrpSd.exe
  C:\Windows\System\zabrpSd.exe
  2⤵
  PID:6068
- C:\Windows\System\KjaKFDZ.exe
  C:\Windows\System\KjaKFDZ.exe
  2⤵
  PID:7132
- C:\Windows\System\UCJKPLW.exe
  C:\Windows\System\UCJKPLW.exe
  2⤵
  PID:6736
- C:\Windows\System\AoPhdcv.exe
  C:\Windows\System\AoPhdcv.exe
  2⤵
  PID:6640
- C:\Windows\System\bTXjpMS.exe
  C:\Windows\System\bTXjpMS.exe
  2⤵
  PID:6756
- C:\Windows\System\qOpIxZi.exe
  C:\Windows\System\qOpIxZi.exe
  2⤵
  PID:2168
- C:\Windows\System\GKQhjPz.exe
  C:\Windows\System\GKQhjPz.exe
  2⤵
  PID:6752
- C:\Windows\System\uXXtLJp.exe
  C:\Windows\System\uXXtLJp.exe
  2⤵
  PID:6168
- C:\Windows\System\CRqMflI.exe
  C:\Windows\System\CRqMflI.exe
  2⤵
  PID:6400
- C:\Windows\System\PLGpLFe.exe
  C:\Windows\System\PLGpLFe.exe
  2⤵
  PID:6932
- C:\Windows\System\vpROmhi.exe
  C:\Windows\System\vpROmhi.exe
  2⤵
  PID:6992
- C:\Windows\System\ZuJpFhn.exe
  C:\Windows\System\ZuJpFhn.exe
  2⤵
  PID:6556
- C:\Windows\System\fwPEeUu.exe
  C:\Windows\System\fwPEeUu.exe
  2⤵
  PID:6672
- C:\Windows\System\rVyYMVF.exe
  C:\Windows\System\rVyYMVF.exe
  2⤵
  PID:7164
- C:\Windows\System\FVTGvyb.exe
  C:\Windows\System\FVTGvyb.exe
  2⤵
  PID:6412
- C:\Windows\System\kLWeYfm.exe
  C:\Windows\System\kLWeYfm.exe
  2⤵
  PID:6864
- C:\Windows\System\fYcqPPZ.exe
  C:\Windows\System\fYcqPPZ.exe
  2⤵
  PID:7184
- C:\Windows\System\aNyeYIG.exe
  C:\Windows\System\aNyeYIG.exe
  2⤵
  PID:7200
- C:\Windows\System\yROddFC.exe
  C:\Windows\System\yROddFC.exe
  2⤵
  PID:7216
- C:\Windows\System\TSAClPO.exe
  C:\Windows\System\TSAClPO.exe
  2⤵
  PID:7232
- C:\Windows\System\uOpSgMA.exe
  C:\Windows\System\uOpSgMA.exe
  2⤵
  PID:7248
- C:\Windows\System\CxEPaEG.exe
  C:\Windows\System\CxEPaEG.exe
  2⤵
  PID:7264
- C:\Windows\System\TQHoibV.exe
  C:\Windows\System\TQHoibV.exe
  2⤵
  PID:7280
- C:\Windows\System\cKNoBIJ.exe
  C:\Windows\System\cKNoBIJ.exe
  2⤵
  PID:7296
- C:\Windows\System\vEmCaPm.exe
  C:\Windows\System\vEmCaPm.exe
  2⤵
  PID:7312
- C:\Windows\System\iKHVawn.exe
  C:\Windows\System\iKHVawn.exe
  2⤵
  PID:7328
- C:\Windows\System\hcBvvkb.exe
  C:\Windows\System\hcBvvkb.exe
  2⤵
  PID:7344
- C:\Windows\System\PmcCZaR.exe
  C:\Windows\System\PmcCZaR.exe
  2⤵
  PID:7360
- C:\Windows\System\JcBWtKk.exe
  C:\Windows\System\JcBWtKk.exe
  2⤵
  PID:7376
- C:\Windows\System\MBUdHyM.exe
  C:\Windows\System\MBUdHyM.exe
  2⤵
  PID:7392
- C:\Windows\System\paYYHqI.exe
  C:\Windows\System\paYYHqI.exe
  2⤵
  PID:7408
- C:\Windows\System\GUqWpaS.exe
  C:\Windows\System\GUqWpaS.exe
  2⤵
  PID:7424
- C:\Windows\System\klDnmRn.exe
  C:\Windows\System\klDnmRn.exe
  2⤵
  PID:7440
- C:\Windows\System\HPaGfXO.exe
  C:\Windows\System\HPaGfXO.exe
  2⤵
  PID:7456
- C:\Windows\System\DXCvKnn.exe
  C:\Windows\System\DXCvKnn.exe
  2⤵
  PID:7472
- C:\Windows\System\CoTNcrV.exe
  C:\Windows\System\CoTNcrV.exe
  2⤵
  PID:7488
- C:\Windows\System\TlWLusv.exe
  C:\Windows\System\TlWLusv.exe
  2⤵
  PID:7504
- C:\Windows\System\TuHQcTU.exe
  C:\Windows\System\TuHQcTU.exe
  2⤵
  PID:7520
- C:\Windows\System\qdSahTg.exe
  C:\Windows\System\qdSahTg.exe
  2⤵
  PID:7536
- C:\Windows\System\LiPsnOr.exe
  C:\Windows\System\LiPsnOr.exe
  2⤵
  PID:7552
- C:\Windows\System\rBinxkt.exe
  C:\Windows\System\rBinxkt.exe
  2⤵
  PID:7568
- C:\Windows\System\QOheqfw.exe
  C:\Windows\System\QOheqfw.exe
  2⤵
  PID:7584
- C:\Windows\System\VMqeWrG.exe
  C:\Windows\System\VMqeWrG.exe
  2⤵
  PID:7600
- C:\Windows\System\oEoprte.exe
  C:\Windows\System\oEoprte.exe
  2⤵
  PID:7616
- C:\Windows\System\uRxaTtk.exe
  C:\Windows\System\uRxaTtk.exe
  2⤵
  PID:7632
- C:\Windows\System\VPwGuCG.exe
  C:\Windows\System\VPwGuCG.exe
  2⤵
  PID:7648
- C:\Windows\System\EerlfOs.exe
  C:\Windows\System\EerlfOs.exe
  2⤵
  PID:7664
- C:\Windows\System\uxFlcgb.exe
  C:\Windows\System\uxFlcgb.exe
  2⤵
  PID:7680
- C:\Windows\System\bIniDXp.exe
  C:\Windows\System\bIniDXp.exe
  2⤵
  PID:7696
- C:\Windows\System\SLAafjg.exe
  C:\Windows\System\SLAafjg.exe
  2⤵
  PID:7712
- C:\Windows\System\nvKSYNk.exe
  C:\Windows\System\nvKSYNk.exe
  2⤵
  PID:7728
- C:\Windows\System\sauJdrd.exe
  C:\Windows\System\sauJdrd.exe
  2⤵
  PID:7744
- C:\Windows\System\cTVSUjk.exe
  C:\Windows\System\cTVSUjk.exe
  2⤵
  PID:7760
- C:\Windows\System\QTiVKAY.exe
  C:\Windows\System\QTiVKAY.exe
  2⤵
  PID:7776
- C:\Windows\System\tLUrajZ.exe
  C:\Windows\System\tLUrajZ.exe
  2⤵
  PID:7792
- C:\Windows\System\xPNxWsr.exe
  C:\Windows\System\xPNxWsr.exe
  2⤵
  PID:7808
- C:\Windows\System\fSveMYg.exe
  C:\Windows\System\fSveMYg.exe
  2⤵
  PID:7824
- C:\Windows\System\OlvncSd.exe
  C:\Windows\System\OlvncSd.exe
  2⤵
  PID:7840
- C:\Windows\System\YxjEqMw.exe
  C:\Windows\System\YxjEqMw.exe
  2⤵
  PID:7856
- C:\Windows\System\tlEhXDc.exe
  C:\Windows\System\tlEhXDc.exe
  2⤵
  PID:7872
- C:\Windows\System\jsAoGKj.exe
  C:\Windows\System\jsAoGKj.exe
  2⤵
  PID:7888
- C:\Windows\System\AZEcUJr.exe
  C:\Windows\System\AZEcUJr.exe
  2⤵
  PID:7904
- C:\Windows\System\GaUDOtw.exe
  C:\Windows\System\GaUDOtw.exe
  2⤵
  PID:7920
- C:\Windows\System\WvepcUL.exe
  C:\Windows\System\WvepcUL.exe
  2⤵
  PID:7936
- C:\Windows\System\iwYGMAU.exe
  C:\Windows\System\iwYGMAU.exe
  2⤵
  PID:7952
- C:\Windows\System\xeYNJoE.exe
  C:\Windows\System\xeYNJoE.exe
  2⤵
  PID:7968
- C:\Windows\System\kjdVOGU.exe
  C:\Windows\System\kjdVOGU.exe
  2⤵
  PID:7984
- C:\Windows\System\cGXPKhi.exe
  C:\Windows\System\cGXPKhi.exe
  2⤵
  PID:8000
- C:\Windows\System\WoImkNC.exe
  C:\Windows\System\WoImkNC.exe
  2⤵
  PID:8016
- C:\Windows\System\kBJPtZN.exe
  C:\Windows\System\kBJPtZN.exe
  2⤵
  PID:8032
- C:\Windows\System\SmEgVVD.exe
  C:\Windows\System\SmEgVVD.exe
  2⤵
  PID:8048
- C:\Windows\System\lPqTQqS.exe
  C:\Windows\System\lPqTQqS.exe
  2⤵
  PID:8064
- C:\Windows\System\zncExeU.exe
  C:\Windows\System\zncExeU.exe
  2⤵
  PID:8080
- C:\Windows\System\ibQdAwg.exe
  C:\Windows\System\ibQdAwg.exe
  2⤵
  PID:8096
- C:\Windows\System\avKFFdA.exe
  C:\Windows\System\avKFFdA.exe
  2⤵
  PID:8112
- C:\Windows\System\BuStVFF.exe
  C:\Windows\System\BuStVFF.exe
  2⤵
  PID:8128
- C:\Windows\System\vWVUDDn.exe
  C:\Windows\System\vWVUDDn.exe
  2⤵
  PID:8144
- C:\Windows\System\JAkNRWp.exe
  C:\Windows\System\JAkNRWp.exe
  2⤵
  PID:8160
- C:\Windows\System\vuEmzNo.exe
  C:\Windows\System\vuEmzNo.exe
  2⤵
  PID:8176
- C:\Windows\System\bWTVSnJ.exe
  C:\Windows\System\bWTVSnJ.exe
  2⤵
  PID:7176
- C:\Windows\System\dqpDXxG.exe
  C:\Windows\System\dqpDXxG.exe
  2⤵
  PID:7240
- C:\Windows\System\CaxqvEc.exe
  C:\Windows\System\CaxqvEc.exe
  2⤵
  PID:7304
- C:\Windows\System\hhdmRbl.exe
  C:\Windows\System\hhdmRbl.exe
  2⤵
  PID:6236
- C:\Windows\System\MymjrHZ.exe
  C:\Windows\System\MymjrHZ.exe
  2⤵
  PID:7196
- C:\Windows\System\buEIfpw.exe
  C:\Windows\System\buEIfpw.exe
  2⤵
  PID:7324
- C:\Windows\System\vuXvsTL.exe
  C:\Windows\System\vuXvsTL.exe
  2⤵
  PID:7256
- C:\Windows\System\BXHJrEV.exe
  C:\Windows\System\BXHJrEV.exe
  2⤵
  PID:7372
- C:\Windows\System\utCVWYA.exe
  C:\Windows\System\utCVWYA.exe
  2⤵
  PID:7432
- C:\Windows\System\nQGjSPa.exe
  C:\Windows\System\nQGjSPa.exe
  2⤵
  PID:7496
- C:\Windows\System\sEtlkxE.exe
  C:\Windows\System\sEtlkxE.exe
  2⤵
  PID:7560
- C:\Windows\System\EWaFMhg.exe
  C:\Windows\System\EWaFMhg.exe
  2⤵
  PID:7624
- C:\Windows\System\qiLiiyd.exe
  C:\Windows\System\qiLiiyd.exe
  2⤵
  PID:7688
- C:\Windows\System\lBIPNcs.exe
  C:\Windows\System\lBIPNcs.exe
  2⤵
  PID:7752
- C:\Windows\System\JCIvppZ.exe
  C:\Windows\System\JCIvppZ.exe
  2⤵
  PID:7816
- C:\Windows\System\luOefxl.exe
  C:\Windows\System\luOefxl.exe
  2⤵
  PID:7420
- C:\Windows\System\mDDBGTc.exe
  C:\Windows\System\mDDBGTc.exe
  2⤵
  PID:7452
- C:\Windows\System\TbldKss.exe
  C:\Windows\System\TbldKss.exe
  2⤵
  PID:7544
- C:\Windows\System\hJEmzVS.exe
  C:\Windows\System\hJEmzVS.exe
  2⤵
  PID:7644
- C:\Windows\System\nMSkyyG.exe
  C:\Windows\System\nMSkyyG.exe
  2⤵
  PID:7832
- C:\Windows\System\jqErUpi.exe
  C:\Windows\System\jqErUpi.exe
  2⤵
  PID:7384
- C:\Windows\System\jTFNXQG.exe
  C:\Windows\System\jTFNXQG.exe
  2⤵
  PID:7548
- C:\Windows\System\RgbJNEl.exe
  C:\Windows\System\RgbJNEl.exe
  2⤵
  PID:7708
- C:\Windows\System\yRZHLYZ.exe
  C:\Windows\System\yRZHLYZ.exe
  2⤵
  PID:7804
- C:\Windows\System\eqScBgm.exe
  C:\Windows\System\eqScBgm.exe
  2⤵
  PID:7896
- C:\Windows\System\XFSMzAM.exe
  C:\Windows\System\XFSMzAM.exe
  2⤵
  PID:7932
- C:\Windows\System\szMZJUo.exe
  C:\Windows\System\szMZJUo.exe
  2⤵
  PID:7960
- C:\Windows\System\OBteNzM.exe
  C:\Windows\System\OBteNzM.exe
  2⤵
  PID:8012
- C:\Windows\System\gfFjngA.exe
  C:\Windows\System\gfFjngA.exe
  2⤵
  PID:8076
- C:\Windows\System\JufogMF.exe
  C:\Windows\System\JufogMF.exe
  2⤵
  PID:8140
- C:\Windows\System\dMwfGCK.exe
  C:\Windows\System\dMwfGCK.exe
  2⤵
  PID:8056
- C:\Windows\System\qImRxar.exe
  C:\Windows\System\qImRxar.exe
  2⤵
  PID:8092
- C:\Windows\System\TzFgtfh.exe
  C:\Windows\System\TzFgtfh.exe
  2⤵
  PID:7208
- C:\Windows\System\lZUqAZk.exe
  C:\Windows\System\lZUqAZk.exe
  2⤵
  PID:6188
- C:\Windows\System\FTePOfX.exe
  C:\Windows\System\FTePOfX.exe
  2⤵
  PID:7272
- C:\Windows\System\SGNixkN.exe
  C:\Windows\System\SGNixkN.exe
  2⤵
  PID:7468
- C:\Windows\System\PTpJBFm.exe
  C:\Windows\System\PTpJBFm.exe
  2⤵
  PID:8188
- C:\Windows\System\icdgdmn.exe
  C:\Windows\System\icdgdmn.exe
  2⤵
  PID:7528
- C:\Windows\System\JoSTZxT.exe
  C:\Windows\System\JoSTZxT.exe
  2⤵
  PID:7192
- C:\Windows\System\lhgKvwN.exe
  C:\Windows\System\lhgKvwN.exe
  2⤵
  PID:7388
- C:\Windows\System\HicYtlg.exe
  C:\Windows\System\HicYtlg.exe
  2⤵
  PID:7736
- C:\Windows\System\wYiUbnw.exe
  C:\Windows\System\wYiUbnw.exe
  2⤵
  PID:7660
- C:\Windows\System\qsmbNdY.exe
  C:\Windows\System\qsmbNdY.exe
  2⤵
  PID:7580
- C:\Windows\System\htvafQs.exe
  C:\Windows\System\htvafQs.exe
  2⤵
  PID:7912
- C:\Windows\System\vsaGjek.exe
  C:\Windows\System\vsaGjek.exe
  2⤵
  PID:7944
- C:\Windows\System\jvTDnsj.exe
  C:\Windows\System\jvTDnsj.exe
  2⤵
  PID:8108
- C:\Windows\System\qUqOFnQ.exe
  C:\Windows\System\qUqOFnQ.exe
  2⤵
  PID:8088
- C:\Windows\System\CzUtAxz.exe
  C:\Windows\System\CzUtAxz.exe
  2⤵
  PID:7916
- C:\Windows\System\rpSgzLF.exe
  C:\Windows\System\rpSgzLF.exe
  2⤵
  PID:7996
- C:\Windows\System\QmOaNnH.exe
  C:\Windows\System\QmOaNnH.exe
  2⤵
  PID:8156
- C:\Windows\System\LTSytVk.exe
  C:\Windows\System\LTSytVk.exe
  2⤵
  PID:7464
- C:\Windows\System\jiOdDKh.exe
  C:\Windows\System\jiOdDKh.exe
  2⤵
  PID:7724
- C:\Windows\System\CYyIkVd.exe
  C:\Windows\System\CYyIkVd.exe
  2⤵
  PID:7640
- C:\Windows\System\fTUozbP.exe
  C:\Windows\System\fTUozbP.exe
  2⤵
  PID:7868
- C:\Windows\System\jDaOkXs.exe
  C:\Windows\System\jDaOkXs.exe
  2⤵
  PID:7512
- C:\Windows\System\JUyubGc.exe
  C:\Windows\System\JUyubGc.exe
  2⤵
  PID:8136
- C:\Windows\System\RLNuGYz.exe
  C:\Windows\System\RLNuGYz.exe
  2⤵
  PID:7288
- C:\Windows\System\ZtLJPyj.exe
  C:\Windows\System\ZtLJPyj.exe
  2⤵
  PID:7928
- C:\Windows\System\DadztTc.exe
  C:\Windows\System\DadztTc.exe
  2⤵
  PID:7404
- C:\Windows\System\JRwpOsx.exe
  C:\Windows\System\JRwpOsx.exe
  2⤵
  PID:7852
- C:\Windows\System\MTNPIjk.exe
  C:\Windows\System\MTNPIjk.exe
  2⤵
  PID:7720
- C:\Windows\System\hqSuBFY.exe
  C:\Windows\System\hqSuBFY.exe
  2⤵
  PID:7596
- C:\Windows\System\wXreJVN.exe
  C:\Windows\System\wXreJVN.exe
  2⤵
  PID:8168
- C:\Windows\System\nRwVzzt.exe
  C:\Windows\System\nRwVzzt.exe
  2⤵
  PID:7336
- C:\Windows\System\vipRWRU.exe
  C:\Windows\System\vipRWRU.exe
  2⤵
  PID:8200
- C:\Windows\System\LfORKfi.exe
  C:\Windows\System\LfORKfi.exe
  2⤵
  PID:8216
- C:\Windows\System\gZXlGIo.exe
  C:\Windows\System\gZXlGIo.exe
  2⤵
  PID:8232
- C:\Windows\System\PDlEoiQ.exe
  C:\Windows\System\PDlEoiQ.exe
  2⤵
  PID:8248
- C:\Windows\System\AkbyNTk.exe
  C:\Windows\System\AkbyNTk.exe
  2⤵
  PID:8264
- C:\Windows\System\ScGtiGy.exe
  C:\Windows\System\ScGtiGy.exe
  2⤵
  PID:8280
- C:\Windows\System\BjXlQkw.exe
  C:\Windows\System\BjXlQkw.exe
  2⤵
  PID:8296
- C:\Windows\System\cPTdUEx.exe
  C:\Windows\System\cPTdUEx.exe
  2⤵
  PID:8312
- C:\Windows\System\oQdKaGu.exe
  C:\Windows\System\oQdKaGu.exe
  2⤵
  PID:8328
- C:\Windows\System\TovaQwK.exe
  C:\Windows\System\TovaQwK.exe
  2⤵
  PID:8344
- C:\Windows\System\pICEfCd.exe
  C:\Windows\System\pICEfCd.exe
  2⤵
  PID:8360
- C:\Windows\System\XgtcYoY.exe
  C:\Windows\System\XgtcYoY.exe
  2⤵
  PID:8376
- C:\Windows\System\rTRIvZW.exe
  C:\Windows\System\rTRIvZW.exe
  2⤵
  PID:8392
- C:\Windows\System\QPyvGpc.exe
  C:\Windows\System\QPyvGpc.exe
  2⤵
  PID:8408
- C:\Windows\System\BPhZVaK.exe
  C:\Windows\System\BPhZVaK.exe
  2⤵
  PID:8424
- C:\Windows\System\CJUcPzz.exe
  C:\Windows\System\CJUcPzz.exe
  2⤵
  PID:8440
- C:\Windows\System\JbNUwRJ.exe
  C:\Windows\System\JbNUwRJ.exe
  2⤵
  PID:8456
- C:\Windows\System\WpLHkIU.exe
  C:\Windows\System\WpLHkIU.exe
  2⤵
  PID:8472
- C:\Windows\System\OgNMTlP.exe
  C:\Windows\System\OgNMTlP.exe
  2⤵
  PID:8488
- C:\Windows\System\azMbofc.exe
  C:\Windows\System\azMbofc.exe
  2⤵
  PID:8504
- C:\Windows\System\SGZekTo.exe
  C:\Windows\System\SGZekTo.exe
  2⤵
  PID:8520
- C:\Windows\System\hXLfsLK.exe
  C:\Windows\System\hXLfsLK.exe
  2⤵
  PID:8536
- C:\Windows\System\MaMiVWF.exe
  C:\Windows\System\MaMiVWF.exe
  2⤵
  PID:8552
- C:\Windows\System\URUeZRK.exe
  C:\Windows\System\URUeZRK.exe
  2⤵
  PID:8568
- C:\Windows\System\FWGigPV.exe
  C:\Windows\System\FWGigPV.exe
  2⤵
  PID:8584
- C:\Windows\System\uQsRLSH.exe
  C:\Windows\System\uQsRLSH.exe
  2⤵
  PID:8600
- C:\Windows\System\iuLqMtW.exe
  C:\Windows\System\iuLqMtW.exe
  2⤵
  PID:8616
- C:\Windows\System\DtWCxAd.exe
  C:\Windows\System\DtWCxAd.exe
  2⤵
  PID:8632
- C:\Windows\System\mjkbuqg.exe
  C:\Windows\System\mjkbuqg.exe
  2⤵
  PID:8648
- C:\Windows\System\jxYXdyH.exe
  C:\Windows\System\jxYXdyH.exe
  2⤵
  PID:8664
- C:\Windows\System\BlpMBDO.exe
  C:\Windows\System\BlpMBDO.exe
  2⤵
  PID:8680
- C:\Windows\System\rYTvrmH.exe
  C:\Windows\System\rYTvrmH.exe
  2⤵
  PID:8696
- C:\Windows\System\NExEoXD.exe
  C:\Windows\System\NExEoXD.exe
  2⤵
  PID:8712
- C:\Windows\System\HmbCAkW.exe
  C:\Windows\System\HmbCAkW.exe
  2⤵
  PID:8728
- C:\Windows\System\TNkXJzD.exe
  C:\Windows\System\TNkXJzD.exe
  2⤵
  PID:8744
- C:\Windows\System\hNqutEp.exe
  C:\Windows\System\hNqutEp.exe
  2⤵
  PID:8760
- C:\Windows\System\AKHDtLM.exe
  C:\Windows\System\AKHDtLM.exe
  2⤵
  PID:8776
- C:\Windows\System\mTNDSFv.exe
  C:\Windows\System\mTNDSFv.exe
  2⤵
  PID:8792
- C:\Windows\System\jNKLfjR.exe
  C:\Windows\System\jNKLfjR.exe
  2⤵
  PID:8808
- C:\Windows\System\EAXnkTm.exe
  C:\Windows\System\EAXnkTm.exe
  2⤵
  PID:8824
- C:\Windows\System\BhfjanY.exe
  C:\Windows\System\BhfjanY.exe
  2⤵
  PID:8840
- C:\Windows\System\GROroTn.exe
  C:\Windows\System\GROroTn.exe
  2⤵
  PID:8856
- C:\Windows\System\TQFdGUY.exe
  C:\Windows\System\TQFdGUY.exe
  2⤵
  PID:8872
- C:\Windows\System\ydMRhiU.exe
  C:\Windows\System\ydMRhiU.exe
  2⤵
  PID:8888
- C:\Windows\System\fgwiwex.exe
  C:\Windows\System\fgwiwex.exe
  2⤵
  PID:8904
- C:\Windows\System\xgMofVQ.exe
  C:\Windows\System\xgMofVQ.exe
  2⤵
  PID:8920
- C:\Windows\System\kWexEbE.exe
  C:\Windows\System\kWexEbE.exe
  2⤵
  PID:8936
- C:\Windows\System\ZKzivFM.exe
  C:\Windows\System\ZKzivFM.exe
  2⤵
  PID:8952
- C:\Windows\System\MVOQpIR.exe
  C:\Windows\System\MVOQpIR.exe
  2⤵
  PID:8968
- C:\Windows\System\fUVTJYs.exe
  C:\Windows\System\fUVTJYs.exe
  2⤵
  PID:8984
- C:\Windows\System\TJyCxuu.exe
  C:\Windows\System\TJyCxuu.exe
  2⤵
  PID:9000
- C:\Windows\System\fGweWXA.exe
  C:\Windows\System\fGweWXA.exe
  2⤵
  PID:9016
- C:\Windows\System\Stofiou.exe
  C:\Windows\System\Stofiou.exe
  2⤵
  PID:9032
- C:\Windows\System\yLcNefq.exe
  C:\Windows\System\yLcNefq.exe
  2⤵
  PID:9048
- C:\Windows\System\hJEhsKy.exe
  C:\Windows\System\hJEhsKy.exe
  2⤵
  PID:9064
- C:\Windows\System\asIrdyP.exe
  C:\Windows\System\asIrdyP.exe
  2⤵
  PID:9080
- C:\Windows\System\EreWbAz.exe
  C:\Windows\System\EreWbAz.exe
  2⤵
  PID:9096
- C:\Windows\System\LfszqXY.exe
  C:\Windows\System\LfszqXY.exe
  2⤵
  PID:9112
- C:\Windows\System\mNFQaag.exe
  C:\Windows\System\mNFQaag.exe
  2⤵
  PID:9128
- C:\Windows\System\MHDdGAe.exe
  C:\Windows\System\MHDdGAe.exe
  2⤵
  PID:9144
- C:\Windows\System\ZKYtoyV.exe
  C:\Windows\System\ZKYtoyV.exe
  2⤵
  PID:9160
- C:\Windows\System\irbDOvX.exe
  C:\Windows\System\irbDOvX.exe
  2⤵
  PID:9176
- C:\Windows\System\SJnAjlY.exe
  C:\Windows\System\SJnAjlY.exe
  2⤵
  PID:9192
- C:\Windows\System\JJDSXtg.exe
  C:\Windows\System\JJDSXtg.exe
  2⤵
  PID:9208
- C:\Windows\System\KBgGUhF.exe
  C:\Windows\System\KBgGUhF.exe
  2⤵
  PID:8240
- C:\Windows\System\dXJUXUC.exe
  C:\Windows\System\dXJUXUC.exe
  2⤵
  PID:8272
- C:\Windows\System\cWdqqEt.exe
  C:\Windows\System\cWdqqEt.exe
  2⤵
  PID:8368
- C:\Windows\System\SGTbYfm.exe
  C:\Windows\System\SGTbYfm.exe
  2⤵
  PID:7772
- C:\Windows\System\ScDUPXh.exe
  C:\Windows\System\ScDUPXh.exe
  2⤵
  PID:7576
- C:\Windows\System\ekEYNLo.exe
  C:\Windows\System\ekEYNLo.exe
  2⤵
  PID:8228
- C:\Windows\System\mgwimHP.exe
  C:\Windows\System\mgwimHP.exe
  2⤵
  PID:8432
- C:\Windows\System\hxBYJbv.exe
  C:\Windows\System\hxBYJbv.exe
  2⤵
  PID:8496
- C:\Windows\System\jydsAZs.exe
  C:\Windows\System\jydsAZs.exe
  2⤵
  PID:8560
- C:\Windows\System\KPqAnwg.exe
  C:\Windows\System\KPqAnwg.exe
  2⤵
  PID:8352
- C:\Windows\System\wliCiiY.exe
  C:\Windows\System\wliCiiY.exe
  2⤵
  PID:8384
- C:\Windows\System\uiBzGxL.exe
  C:\Windows\System\uiBzGxL.exe
  2⤵
  PID:8628
- C:\Windows\System\DTzZLIL.exe
  C:\Windows\System\DTzZLIL.exe
  2⤵
  PID:8656
- C:\Windows\System\RbzqmGS.exe
  C:\Windows\System\RbzqmGS.exe
  2⤵
  PID:8420
- C:\Windows\System\BDTYDlZ.exe
  C:\Windows\System\BDTYDlZ.exe
  2⤵
  PID:8688
- C:\Windows\System\ylNUvxG.exe
  C:\Windows\System\ylNUvxG.exe
  2⤵
  PID:8720
- C:\Windows\System\NpNPhBB.exe
  C:\Windows\System\NpNPhBB.exe
  2⤵
  PID:8752
- C:\Windows\System\BvruAFX.exe
  C:\Windows\System\BvruAFX.exe
  2⤵
  PID:8788
- C:\Windows\System\Buxxjil.exe
  C:\Windows\System\Buxxjil.exe
  2⤵
  PID:8772
- C:\Windows\System\ObSpkmu.exe
  C:\Windows\System\ObSpkmu.exe
  2⤵
  PID:8736
- C:\Windows\System\HnEFERb.exe
  C:\Windows\System\HnEFERb.exe
  2⤵
  PID:8832
- C:\Windows\System\OgoSSBT.exe
  C:\Windows\System\OgoSSBT.exe
  2⤵
  PID:8880
- C:\Windows\System\KATILLc.exe
  C:\Windows\System\KATILLc.exe
  2⤵
  PID:8944
- C:\Windows\System\okRtrqJ.exe
  C:\Windows\System\okRtrqJ.exe
  2⤵
  PID:8864
- C:\Windows\System\dBfYSIG.exe
  C:\Windows\System\dBfYSIG.exe
  2⤵
  PID:8868
- C:\Windows\System\iQPvWGU.exe
  C:\Windows\System\iQPvWGU.exe
  2⤵
  PID:8960
- C:\Windows\System\qftqXhF.exe
  C:\Windows\System\qftqXhF.exe
  2⤵
  PID:9040
- C:\Windows\System\AYISEHN.exe
  C:\Windows\System\AYISEHN.exe
  2⤵
  PID:9072
- C:\Windows\System\ptaRKBe.exe
  C:\Windows\System\ptaRKBe.exe
  2⤵
  PID:9104
- C:\Windows\System\axQGjUb.exe
  C:\Windows\System\axQGjUb.exe
  2⤵
  PID:9168
- C:\Windows\System\CZDKWaM.exe
  C:\Windows\System\CZDKWaM.exe
  2⤵
  PID:8304
- C:\Windows\System\yFYUeCU.exe
  C:\Windows\System\yFYUeCU.exe
  2⤵
  PID:9188
- C:\Windows\System\bcDNhVY.exe
  C:\Windows\System\bcDNhVY.exe
  2⤵
  PID:8400
- C:\Windows\System\ZWiXeBn.exe
  C:\Windows\System\ZWiXeBn.exe
  2⤵
  PID:8208
- C:\Windows\System\SsVGcjd.exe
  C:\Windows\System\SsVGcjd.exe
  2⤵
  PID:8340
- C:\Windows\System\zHcTqWV.exe
  C:\Windows\System\zHcTqWV.exe
  2⤵
  PID:8464
- C:\Windows\System\TfFgNkY.exe
  C:\Windows\System\TfFgNkY.exe
  2⤵
  PID:8528
- C:\Windows\System\MMbmrPk.exe
  C:\Windows\System\MMbmrPk.exe
  2⤵
  PID:8596
- C:\Windows\System\UZYreCm.exe
  C:\Windows\System\UZYreCm.exe
  2⤵
  PID:8448
- C:\Windows\System\VhVbljI.exe
  C:\Windows\System\VhVbljI.exe
  2⤵
  PID:8576
- C:\Windows\System\EnXDJMT.exe
  C:\Windows\System\EnXDJMT.exe
  2⤵
  PID:8644
- C:\Windows\System\UzHqKht.exe
  C:\Windows\System\UzHqKht.exe
  2⤵
  PID:8708
- C:\Windows\System\fOSWsKV.exe
  C:\Windows\System\fOSWsKV.exe
  2⤵
  PID:8852
- C:\Windows\System\TgOJfpf.exe
  C:\Windows\System\TgOJfpf.exe
  2⤵
  PID:9008
- C:\Windows\System\GmNEZdk.exe
  C:\Windows\System\GmNEZdk.exe
  2⤵
  PID:8912
- C:\Windows\System\lTtoUhX.exe
  C:\Windows\System\lTtoUhX.exe
  2⤵
  PID:8916
- C:\Windows\System\TdKsywD.exe
  C:\Windows\System\TdKsywD.exe
  2⤵
  PID:8980
- C:\Windows\System\lLCtdlV.exe
  C:\Windows\System\lLCtdlV.exe
  2⤵
  PID:9076
- C:\Windows\System\aecPkvx.exe
  C:\Windows\System\aecPkvx.exe
  2⤵
  PID:9120
- C:\Windows\System\CZakSTF.exe
  C:\Windows\System\CZakSTF.exe
  2⤵
  PID:8320
- C:\Windows\System\ZBecSmB.exe
  C:\Windows\System\ZBecSmB.exe
  2⤵
  PID:8324
- C:\Windows\System\TRnznen.exe
  C:\Windows\System\TRnznen.exe
  2⤵
  PID:8516
- C:\Windows\System\pjJdcow.exe
  C:\Windows\System\pjJdcow.exe
  2⤵
  PID:8800
- C:\Windows\System\MBKACMJ.exe
  C:\Windows\System\MBKACMJ.exe
  2⤵
  PID:8196
- C:\Windows\System\wKndDPW.exe
  C:\Windows\System\wKndDPW.exe
  2⤵
  PID:8416
- C:\Windows\System\hddLvjm.exe
  C:\Windows\System\hddLvjm.exe
  2⤵
  PID:8836
- C:\Windows\System\XGrmBGy.exe
  C:\Windows\System\XGrmBGy.exe
  2⤵
  PID:9044
- C:\Windows\System\dMdlzJt.exe
  C:\Windows\System\dMdlzJt.exe
  2⤵
  PID:9152
- C:\Windows\System\vvRfHjO.exe
  C:\Windows\System\vvRfHjO.exe
  2⤵
  PID:7484
- C:\Windows\System\DYAGrVi.exe
  C:\Windows\System\DYAGrVi.exe
  2⤵
  PID:8932
- C:\Windows\System\QfCQMMP.exe
  C:\Windows\System\QfCQMMP.exe
  2⤵
  PID:9012
- C:\Windows\System\EijfUEP.exe
  C:\Windows\System\EijfUEP.exe
  2⤵
  PID:9204
- C:\Windows\System\AncjjHG.exe
  C:\Windows\System\AncjjHG.exe
  2⤵
  PID:8784
- C:\Windows\System\JjdinKU.exe
  C:\Windows\System\JjdinKU.exe
  2⤵
  PID:9228
- C:\Windows\System\mrcHQGq.exe
  C:\Windows\System\mrcHQGq.exe
  2⤵
  PID:9244
- C:\Windows\System\rkVThKI.exe
  C:\Windows\System\rkVThKI.exe
  2⤵
  PID:9260
- C:\Windows\System\zcpCBrP.exe
  C:\Windows\System\zcpCBrP.exe
  2⤵
  PID:9276
- C:\Windows\System\tQNubhS.exe
  C:\Windows\System\tQNubhS.exe
  2⤵
  PID:9292
- C:\Windows\System\uemsFOE.exe
  C:\Windows\System\uemsFOE.exe
  2⤵
  PID:9308
- C:\Windows\System\hKQRZzo.exe
  C:\Windows\System\hKQRZzo.exe
  2⤵
  PID:9324
- C:\Windows\System\Upmpqsl.exe
  C:\Windows\System\Upmpqsl.exe
  2⤵
  PID:9340
- C:\Windows\System\lwbZCuK.exe
  C:\Windows\System\lwbZCuK.exe
  2⤵
  PID:9356
- C:\Windows\System\VJyqNGB.exe
  C:\Windows\System\VJyqNGB.exe
  2⤵
  PID:9372
- C:\Windows\System\OKicpRa.exe
  C:\Windows\System\OKicpRa.exe
  2⤵
  PID:9388
- C:\Windows\System\twhyaOw.exe
  C:\Windows\System\twhyaOw.exe
  2⤵
  PID:9404
- C:\Windows\System\RnBzKbm.exe
  C:\Windows\System\RnBzKbm.exe
  2⤵
  PID:9420
- C:\Windows\System\okwEQrG.exe
  C:\Windows\System\okwEQrG.exe
  2⤵
  PID:9436
- C:\Windows\System\IgHfLud.exe
  C:\Windows\System\IgHfLud.exe
  2⤵
  PID:9452
- C:\Windows\System\anboEdw.exe
  C:\Windows\System\anboEdw.exe
  2⤵
  PID:9468
- C:\Windows\System\fCxXUGS.exe
  C:\Windows\System\fCxXUGS.exe
  2⤵
  PID:9484
- C:\Windows\System\kUBobmd.exe
  C:\Windows\System\kUBobmd.exe
  2⤵
  PID:9504
- C:\Windows\System\cUclWFu.exe
  C:\Windows\System\cUclWFu.exe
  2⤵
  PID:9520
- C:\Windows\System\CYNdkek.exe
  C:\Windows\System\CYNdkek.exe
  2⤵
  PID:9536
- C:\Windows\System\CpmRmSS.exe
  C:\Windows\System\CpmRmSS.exe
  2⤵
  PID:9552
- C:\Windows\System\fGzGgmE.exe
  C:\Windows\System\fGzGgmE.exe
  2⤵
  PID:9568
- C:\Windows\System\QDIdfzV.exe
  C:\Windows\System\QDIdfzV.exe
  2⤵
  PID:9584
- C:\Windows\System\xhreikn.exe
  C:\Windows\System\xhreikn.exe
  2⤵
  PID:9600
- C:\Windows\System\aoKpheV.exe
  C:\Windows\System\aoKpheV.exe
  2⤵
  PID:9616
- C:\Windows\System\MAqSZKy.exe
  C:\Windows\System\MAqSZKy.exe
  2⤵
  PID:9632
- C:\Windows\System\eaPWmjA.exe
  C:\Windows\System\eaPWmjA.exe
  2⤵
  PID:9648
- C:\Windows\System\NBOpGJK.exe
  C:\Windows\System\NBOpGJK.exe
  2⤵
  PID:9664
- C:\Windows\System\ZfPUEzI.exe
  C:\Windows\System\ZfPUEzI.exe
  2⤵
  PID:9680
- C:\Windows\System\UYfaeOk.exe
  C:\Windows\System\UYfaeOk.exe
  2⤵
  PID:9696
- C:\Windows\System\kqnSJFn.exe
  C:\Windows\System\kqnSJFn.exe
  2⤵
  PID:9712
- C:\Windows\System\OlzZtbl.exe
  C:\Windows\System\OlzZtbl.exe
  2⤵
  PID:9728
- C:\Windows\System\oQfbQpn.exe
  C:\Windows\System\oQfbQpn.exe
  2⤵
  PID:9744
- C:\Windows\System\cdxDkJk.exe
  C:\Windows\System\cdxDkJk.exe
  2⤵
  PID:9760
- C:\Windows\System\TzqZiML.exe
  C:\Windows\System\TzqZiML.exe
  2⤵
  PID:9776
- C:\Windows\System\HxBroqP.exe
  C:\Windows\System\HxBroqP.exe
  2⤵
  PID:9792
- C:\Windows\System\mZPtiZz.exe
  C:\Windows\System\mZPtiZz.exe
  2⤵
  PID:9808
- C:\Windows\System\oxpIpBs.exe
  C:\Windows\System\oxpIpBs.exe
  2⤵
  PID:9824
- C:\Windows\System\giNHxqv.exe
  C:\Windows\System\giNHxqv.exe
  2⤵
  PID:9840
- C:\Windows\System\Kmfwzrq.exe
  C:\Windows\System\Kmfwzrq.exe
  2⤵
  PID:9856
- C:\Windows\System\XzbliGA.exe
  C:\Windows\System\XzbliGA.exe
  2⤵
  PID:9872
- C:\Windows\System\qNFUqRp.exe
  C:\Windows\System\qNFUqRp.exe
  2⤵
  PID:9888
- C:\Windows\System\SLdCHla.exe
  C:\Windows\System\SLdCHla.exe
  2⤵
  PID:9904
- C:\Windows\System\pCHJZjo.exe
  C:\Windows\System\pCHJZjo.exe
  2⤵
  PID:9920
- C:\Windows\System\EfGmWqN.exe
  C:\Windows\System\EfGmWqN.exe
  2⤵
  PID:9936
- C:\Windows\System\CyqxCHL.exe
  C:\Windows\System\CyqxCHL.exe
  2⤵
  PID:9952
- C:\Windows\System\zntvcFW.exe
  C:\Windows\System\zntvcFW.exe
  2⤵
  PID:9968
- C:\Windows\System\NmUwprt.exe
  C:\Windows\System\NmUwprt.exe
  2⤵
  PID:9984
- C:\Windows\System\gCPsrAw.exe
  C:\Windows\System\gCPsrAw.exe
  2⤵
  PID:10000
- C:\Windows\System\suPkubo.exe
  C:\Windows\System\suPkubo.exe
  2⤵
  PID:10016
- C:\Windows\System\BSHdlzd.exe
  C:\Windows\System\BSHdlzd.exe
  2⤵
  PID:10032
- C:\Windows\System\pzBpyiR.exe
  C:\Windows\System\pzBpyiR.exe
  2⤵
  PID:10048
- C:\Windows\System\DQLwSTe.exe
  C:\Windows\System\DQLwSTe.exe
  2⤵
  PID:10064
- C:\Windows\System\xLuFmqj.exe
  C:\Windows\System\xLuFmqj.exe
  2⤵
  PID:10080
- C:\Windows\System\DVMZJIu.exe
  C:\Windows\System\DVMZJIu.exe
  2⤵
  PID:10096
- C:\Windows\System\zcTqgiq.exe
  C:\Windows\System\zcTqgiq.exe
  2⤵
  PID:10112
- C:\Windows\System\DQahpTf.exe
  C:\Windows\System\DQahpTf.exe
  2⤵
  PID:10128
- C:\Windows\System\XdWbOZA.exe
  C:\Windows\System\XdWbOZA.exe
  2⤵
  PID:10144
- C:\Windows\System\yUHMrZx.exe
  C:\Windows\System\yUHMrZx.exe
  2⤵
  PID:10160
- C:\Windows\System\LKzBIFx.exe
  C:\Windows\System\LKzBIFx.exe
  2⤵
  PID:10176
- C:\Windows\System\itGYHFw.exe
  C:\Windows\System\itGYHFw.exe
  2⤵
  PID:10192
- C:\Windows\System\BFXXkdp.exe
  C:\Windows\System\BFXXkdp.exe
  2⤵
  PID:10208
- C:\Windows\System\FehZqCQ.exe
  C:\Windows\System\FehZqCQ.exe
  2⤵
  PID:10224
- C:\Windows\System\TxeCpbD.exe
  C:\Windows\System\TxeCpbD.exe
  2⤵
  PID:9220
- C:\Windows\System\zDOpsXJ.exe
  C:\Windows\System\zDOpsXJ.exe
  2⤵
  PID:9252
- C:\Windows\System\iFOBGwt.exe
  C:\Windows\System\iFOBGwt.exe
  2⤵
  PID:8224
- C:\Windows\System\RfuDape.exe
  C:\Windows\System\RfuDape.exe
  2⤵
  PID:9284
- C:\Windows\System\DsplJmi.exe
  C:\Windows\System\DsplJmi.exe
  2⤵
  PID:9268
- C:\Windows\System\UlZKwaq.exe
  C:\Windows\System\UlZKwaq.exe
  2⤵
  PID:9352
- C:\Windows\System\wZAUPlH.exe
  C:\Windows\System\wZAUPlH.exe
  2⤵
  PID:9332
- C:\Windows\System\TJnKsPl.exe
  C:\Windows\System\TJnKsPl.exe
  2⤵
  PID:9444
- C:\Windows\System\uFmsVZP.exe
  C:\Windows\System\uFmsVZP.exe
  2⤵
  PID:9400
- C:\Windows\System\Xqgprxa.exe
  C:\Windows\System\Xqgprxa.exe
  2⤵
  PID:9432
- C:\Windows\System\cuYhvpB.exe
  C:\Windows\System\cuYhvpB.exe
  2⤵
  PID:9512
- C:\Windows\System\yJeYdTX.exe
  C:\Windows\System\yJeYdTX.exe
  2⤵
  PID:9576
- C:\Windows\System\EUkINGl.exe
  C:\Windows\System\EUkINGl.exe
  2⤵
  PID:9592
- C:\Windows\System\gMbwxOr.exe
  C:\Windows\System\gMbwxOr.exe
  2⤵
  PID:9640
- C:\Windows\System\oSjmpmK.exe
  C:\Windows\System\oSjmpmK.exe
  2⤵
  PID:9676
- C:\Windows\System\FfvToyC.exe
  C:\Windows\System\FfvToyC.exe
  2⤵
  PID:9708
- C:\Windows\System\azPIufa.exe
  C:\Windows\System\azPIufa.exe
  2⤵
  PID:9624
- C:\Windows\System\HJgMoPj.exe
  C:\Windows\System\HJgMoPj.exe
  2⤵
  PID:9800
- C:\Windows\System\MmDNopX.exe
  C:\Windows\System\MmDNopX.exe
  2⤵
  PID:9656
- C:\Windows\System\vRbBbSr.exe
  C:\Windows\System\vRbBbSr.exe
  2⤵
  PID:9900
- C:\Windows\System\hNnHRal.exe
  C:\Windows\System\hNnHRal.exe
  2⤵
  PID:9688
- C:\Windows\System\eMntjza.exe
  C:\Windows\System\eMntjza.exe
  2⤵
  PID:9692
- C:\Windows\System\VyZmUeF.exe
  C:\Windows\System\VyZmUeF.exe
  2⤵
  PID:9720
- C:\Windows\System\djzSZpA.exe
  C:\Windows\System\djzSZpA.exe
  2⤵
  PID:9784
- C:\Windows\System\oiTFVIE.exe
  C:\Windows\System\oiTFVIE.exe
  2⤵
  PID:9960
- C:\Windows\System\HdxJHGj.exe
  C:\Windows\System\HdxJHGj.exe
  2⤵
  PID:10024
- C:\Windows\System\kHZaHiu.exe
  C:\Windows\System\kHZaHiu.exe
  2⤵
  PID:10088

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BnNHoRL.exe

Filesize
2.2MB

MD5
4ac184ccb403a8bb540725cea246f4e0

SHA1
dfb72f3aae087985017928fe229f42063886a01a

SHA256
ee1580f4d84158ce410b73e7c4d3ec7626e73b1049341df79e5a1913eef7863e

SHA512
c7b773505d53a558b6cedac7613487dbd1bb0747ad112bfbdc174b9a3167f6c36bba660aaab7a9a9119e8c00dc027afec9b8aed591eedb3596547997866588e2

Download Submit
C:\Windows\system\FTSsNKi.exe

Filesize
2.2MB

MD5
12c63f9f2396b2f7a3eb5a65fc8823c8

SHA1
b2a66cda97e8a535747108d827d9737b15570398

SHA256
5a1c727c1f46f4d43da15f33974e33553d611ec21d35cce03c04e3e5790018a3

SHA512
d2ae4aba4029704173652a3e6c919268c2538c1c4938fd8a1d3339eb7a16e0d83f7a4e53588908e342d5728e6304eabd58e7d5d2e9734786b13f77d251152de1

Download Submit
C:\Windows\system\JvJLZFl.exe

Filesize
2.2MB

MD5
43e0c1634acbe6e09bfabd443d995c27

SHA1
ad858460628cf65d1c3b49470847d809be1d8a10

SHA256
8a652507058a9ef399715277accbf14988a6891bbcb6c98143db704288933534

SHA512
69474fe5833d363f6be5e29655deb654c817cfd98b6154f683b01e5f8eadbf968e442f7561bc8484574afe8f333b19db68755a5b98821c140af026f7d4763b28

Download Submit
C:\Windows\system\KwsHIgX.exe

Filesize
2.3MB

MD5
2f9c6bde2d810a06fb3eeda75faa50d6

SHA1
71bd6949a1ad5e5996e435e654351dfeebe44a22

SHA256
9324cf677ee4a42cc0894a084aa19769676016657aaf9f332ecbd0b7ad8d9ee9

SHA512
f102a9e8ea513799057e4e6d9ebd349368774f268211306d7b3c272613e661f0839c08d1d66ab6cc71d7e4d3333fba590b8dcf53747f53527174534924182e31

Download Submit
C:\Windows\system\SLKfMbz.exe

Filesize
2.2MB

MD5
dd5379e9f2b99e04d924d95098844abf

SHA1
48d6dfe2a54f387771af10c1a6ca4884488db7be

SHA256
cc182f2f7c3346238468703ba3daadabc36c0b9cb8b91185c0ef1541d6f7444f

SHA512
90c8c8d4e650882d51280a3758ce93cbc9d4b5fce6f8cea4139360bbf9cfd1184af91bf78c05df009863910830095b79cb90c33c2c4673628c2b661bc6a9cd7d

Download Submit
C:\Windows\system\TGJqjrt.exe

Filesize
2.2MB

MD5
3d4c3d351a1750ae4160692b21c4f4f6

SHA1
0429a062124fc9613414f6504f091a7fcfd50830

SHA256
817092bab901c1394769b69946e4fce07cc68e6f8b749cb9e37492e312c9f413

SHA512
6efbbf553b3ef001ede8f2dddaf66d63edab02c9b08adf410d035f623eedfa2a7814c4f86173c006d982d9ca471a18f0a55b5cd980183b46843ee20aa196649f

Download Submit
C:\Windows\system\UHjluTz.exe

Filesize
2.3MB

MD5
5c02ef9f7825df8718bdddc7af965057

SHA1
45ba92ddf89dde4700a0817c1a1cfe6b473f40ec

SHA256
2863f7dec1865cfdeba79cf77b3457121a6e4a1af90ce580d973c907c5017c4a

SHA512
61caa9f5d8d8d879dbfd5d2bfea71d2ff16ac5f5e6e2eb668722d0195383dcbda7ce73e603cc06f783e698ee5f643cfd0b97d1e8a6b86c62b5a5180fb5c578fc

Download Submit
C:\Windows\system\YyhVpYD.exe

Filesize
2.2MB

MD5
c1f9004fc7c41af40f9e5f91952efcf4

SHA1
b525f1821191feab0ac83e42d135530c76a506ef

SHA256
a79dd5547f53cac316aa60b74380b2161bd66c7bfc3a608a758c17f9f656e095

SHA512
ff332720c53724a99cc6ebbee4810c0331a4fcb79b860a422da4c78d2a138d7da3e2fca939ee79c47411efe34e648709fe180b084f481e46cfe4bbcebee7fabb

Download Submit
C:\Windows\system\athdQoN.exe

Filesize
2.2MB

MD5
a3696d81b0d636920292ff19439fe5d5

SHA1
0b9f4763bcb3f37927e0bec3d6479d9ac25a7d06

SHA256
c6b0c60b6042513853702f694c2e03bd7c8d8a8f28e2d6d866632dbb185d11a5

SHA512
da3548789b963e6b7aad425645c5711de511441363ffce9612750b6954c3981ad9235cf30bc7a7962ff9c4259dab8ab4d8a01b2f7a4f6081ad8f9e0972c2077c

Download Submit
C:\Windows\system\eQGWFEj.exe

Filesize
2.2MB

MD5
ccd9ae72d7a5668cc171c555e609f8ce

SHA1
cc157bf4dd171d708243fe7ef734f1f6b845419f

SHA256
ff1b06f81722cb6c27216bbd2ae4d0552bb9ad0f580eb0b5ac9f93a6f08c03be

SHA512
6151f8f3c93f03f326b9ee6538f1dae94cf38862371cafd644b906b37bc15d8633d4ad9b75bcbdcb723fc351b394e2056c29869e484d1eb97ccbc20d98904692

Download Submit
C:\Windows\system\gDrCsTA.exe

Filesize
2.2MB

MD5
a981477d590aa6aa526a3b67459a50e9

SHA1
aa2d40457d239f88ef5e3c6de1201e517f715be8

SHA256
8c27e3d2af929048db35ca4056bac246d08128708d7b00ed52e5e9ef81e42ad6

SHA512
4f46c4f16d314cf96f0faf8d7128380f457e74a625f1f1827b1b9cb7ab411c57b5d8c92e71a654c97f0be892e6b22e3aa1bb093a50717a167d0d70004ab1afe6

Download Submit
C:\Windows\system\iVPSfaT.exe

Filesize
2.2MB

MD5
fdb91fd0dd254420539ba23e6fd543b6

SHA1
40b02249d9d109499cb9f9b76d56b4cd8b13af70

SHA256
1e21f7a1615ecc1bff60295b94c7dd596e6a228483e4d941a27c94e4a16116b0

SHA512
6079bccb12abf9fec4f279e31bd796b96e49f5ce270c0d9f559a5ebe35b9bfee056cf099f238a2b0ac5b21a015133c629f300f737d24ac4bd568a86f19f7af2d

Download Submit
C:\Windows\system\kJsgWhH.exe

Filesize
2.2MB

MD5
59b078a91840a9f8d2ae7bcf875f9605

SHA1
487b9288e386d41ec514cab2c8ad20ae116f10a4

SHA256
9a25cd5097892734deacd1e51af8f6e0fa225f9f20adcb7389b516fd82bcf338

SHA512
e7f708b82e266b6d1d80a6a4964c5a7d15128472868a0a0faf1ff8a07a8f1e08cb411b1e589924cbf67443999de44413efd82cbe2e4da1cf7b55865c27a3e10a

Download Submit
C:\Windows\system\rBPDTXf.exe

Filesize
2.2MB

MD5
0e176c598ebbb8412154cf4f8bd0b123

SHA1
483c0dd355f805fafeca9ba21772201910331ab0

SHA256
5da2532f26fde4f09debf4f1d677250a6d249d67031187939164bd5ee22e46fb

SHA512
b41a5b311be77842d0cd5d1cf2ebf353e86419650092504358c19d3751a89d635b8e6c427c457e6ce647282211299d0bb20e3c0503c96dced9175a0ceac8fce8

Download Submit
C:\Windows\system\sYOkIVw.exe

Filesize
2.2MB

MD5
4a5ad18f626593bb8141671f22c11909

SHA1
6b5f6810704a75527397db26d18e4db1cb014095

SHA256
6348b0849a4be4c09f8d1b151408608e398b65c0a0535247bb9b6c690298fdfd

SHA512
ab3f336697f988746547b2e7dc00aed7d3ebd6c1989bfb9dfcbfdccafca7c4c13c366b6a5f3b29423d5362899f1f803b2d029bb2ade7a2591f64c0b19a3fda56

Download Submit
C:\Windows\system\smcgIjE.exe

Filesize
2.2MB

MD5
a3a03120e4029c5b74413bf3950ca3f2

SHA1
5ec332a920d9ca2dbb0d893ccc329297e4b7bb71

SHA256
957695c6f81657dfa738af867bc4afed529b580075113ccd4b337924f2d2b725

SHA512
6186c641d69945af7413823f36ff1cdf494d5275f703c61cf763379d208238f39d65ada9a3605ebfef85383961524ba2b2064497c839c42fe783facf9052a06d

Download Submit
C:\Windows\system\uOPgyFb.exe

Filesize
2.2MB

MD5
cc5c9e288d2c2c44cda9c8f055461d6a

SHA1
32c3c7ff794dfb871d16c2b92da37ceaa2a35baa

SHA256
4288e1744781876976588be912a2eb5812d18f9d217b0380584b1dd77aa8f114

SHA512
fb1fe1257dfde88bae79dbc759d21e167bd8760dd1924aa93c30275149ef5cdc03c10f99049100c23dffda4e81ac226728e27398065172abf51472d22a4f4e96

Download Submit
C:\Windows\system\zFVPorl.exe

Filesize
2.2MB

MD5
cc84fd7f4a993a2c2ac8b008efed09da

SHA1
e5187b471e156927bba7d689f25530fb9f794f08

SHA256
4d45308b027b6546ec97ae6f1604e1aa63d8cc85bfcb2b6c9328c3a743f4f220

SHA512
1732d87789737bfefad7c1815f24c51e7ffc50efa1de5b3afb84de86de64a5926a996ae774c281f411e5da70760cf5d82d7986c5e53def79b9128866a47b532e

Download Submit
\Windows\system\AOnbSVx.exe

Filesize
2.2MB

MD5
e1121e46137880cc339d94b9b48f3f14

SHA1
9ced17b1a3e03a85b5603331ca09756538b82cd2

SHA256
d12f54e1a3443d99a57a824d066fa49fbfa1a6554b679a6d33aa55b6911017f0

SHA512
daf811709e5b9fc2b612ca8a10edaaf2395c6f3a2dc7cb4e01c9f11d57ed4589670a9319f84b7a9e6fa1d0318d56bb58091c8972822cea84bc4297789824d4a3

Download Submit
\Windows\system\BPsopgI.exe

Filesize
2.2MB

MD5
91ad4d055897a366d41fbca3159e5361

SHA1
105cf0b3611c15d3b8cc042c7fb2ab90ff39fd90

SHA256
240f636198086fd80da496b8bd98a2d27a61d0d6583f30d1db71b13ba6656799

SHA512
60f3b9f4fe6d206f332da42bd550379776c2a0f169c1f95d19d3a71261c1714c19eef9d4529fa160cc1d4a33efbd81197915b8de9e049e404f4e4f1abde4735b

Download Submit
\Windows\system\DfXwANb.exe

Filesize
2.2MB

MD5
9ebf879ef5d5374f8f0b4cb87969b3d4

SHA1
fc8452b9ddff96dd036d269f8373dc1bce3d7ced

SHA256
52af9e0634529af2db2ac85c9c3f97020d918023315284903ff1f460d22c904a

SHA512
57b333d18f3ab1698979c0be47f1e0afae6e6be3fb28d81b7c955bef5f768f6915785ef1343ac3083b04ada26680db45ef01d57b7bd4e59159167acf6b689088

Download Submit
\Windows\system\SDqCSmG.exe

Filesize
2.3MB

MD5
39f2238316d987210a68ab21d558b58c

SHA1
3139f82ce5ed89645db37e573228189c25656d56

SHA256
5306988fec3e75f63bd3d496e4f6f2f3f479c2125a096bdb0199f8d187d651f5

SHA512
c70d52a6e0890eeac8a0308a1d7a0728e55e94d55c2918b5feb01584bbbc9801355be58150fb7a2567001cba5b2e4c83e57cc0fffb5aaeb50eba207b56e7e77f

Download Submit
\Windows\system\SHMpiCx.exe

Filesize
2.3MB

MD5
6494e8072829b876911adbd48b923b2d

SHA1
06bfb0bd044c890e03bc1b3f14ad8657d5fe4a08

SHA256
52399c34fc62ba6b989860af36ed40d0f561a8a420855e7db152eb4170be372a

SHA512
aec0106b376f92704de8df6c462992dd1d362d2686774019ab6928c6578d18cc47794e88c55f7f74638b867b993ea566c77c84995d03c5d090b412377876fe4a

Download Submit
\Windows\system\YeGaHkl.exe

Filesize
2.2MB

MD5
2abdded43a8ddc6532835cc60842d696

SHA1
c54dfe20b5e92f0d3f80cfb740639a8ccdb7d27c

SHA256
9b00e9547da647bb0d3768ee006b67b23d7a1852e80ab0fc454fa204daf26434

SHA512
6d6920e7325697fab5bb70c1e800adb66e7f56aaef72af2e836f4dc989245317123688041ee7f520495e0e6bf9b123a57670d503fd35bfe4559c1d34012f9378

Download Submit
\Windows\system\bTYNhix.exe

Filesize
2.3MB

MD5
40bf74ddf6363e95e281e9fdae78325b

SHA1
971110fc0ba68a01311c6565a7f61193c1d1bf8c

SHA256
9736b316ac9638fecfe58fe1ceafb24baf751b8c00a9220651aa54aea8a6c103

SHA512
d0f78fbbb359899110ed8be864d41227db5a9a17438391b1bb4ed6a1ee18a4b174a3ac9274d43a1b555cde6b8e56f16c6aeb3e8b81921b942ca6bda6476f8fcf

Download Submit
\Windows\system\blFCBPy.exe

Filesize
2.2MB

MD5
d49b784cf89d80e5789f7666a2ffd33d

SHA1
0bedf3194fe879ae0d075981b14937d6ca6ab3aa

SHA256
b52ead3bf1a18b4c247f38fdbc7840558b08f3accf5def30f4a0c4c19f78e2be

SHA512
68d599c391895939c83e01f68b5e5d54126f8465099762c5ebd341549e27690683731a015384fcd11ca432740f0cc83fd950e69b53df6fb21b8c01c6b6746b6c

Download Submit
\Windows\system\ebGPuai.exe

Filesize
2.2MB

MD5
36b19f76d001b7bb86fff8dbdef72459

SHA1
74d53e08931cbe2607ac68ecda6d9268cffd9f15

SHA256
07060da84218a0280c2a5305dff9f82daad24d07efac4d317049f5d8ff27509b

SHA512
e0f5ec5556cd2d6311ab6126126e3db1f0009caad201eb7010113d56125b18614421063c35b54a4e0f7d3e833b03b12f3ec17938b5d2f57fc43d652e74bb8538

Download Submit
\Windows\system\gSMmRxA.exe

Filesize
2.2MB

MD5
a8a754af8da7cbbd286dcd6b996701c8

SHA1
4215b05ca465fec11561e835f1671b94899a2718

SHA256
375b71d0fd71d9babc6dbafc19989fc298dc389d72f193f6a9447e5462ebb28b

SHA512
d6e75bec51105b17c067ad9c606f593ce2569d1c371cbc3ca43f3d1bfe19487c629f20809fe94dd12c691a48276d6c0c29e600afa759581f19cf0566ab8cfb75

Download Submit
\Windows\system\jkQhlYz.exe

Filesize
2.3MB

MD5
b4c439a3863b6ddf77a9dcaf9c55d607

SHA1
2a2a69c6dbcaf972d1d29d07ad3ddbb6c16689df

SHA256
937197a527552dbd4c1ebabd53fe31291bfe8a3e8aa277c7b62cb27f7796f1e6

SHA512
8b186d11c96b87d3dde2d77298c43901ec4d222393b571f3d91eb9f597e2fa5cd04bbf2ae2c1bb2a6a92a595a539fb454ce3843eb31a9098063d2962e305012e

Download Submit
\Windows\system\oGMeOYx.exe

Filesize
2.2MB

MD5
49fea60ba196d451f854f21d5f6a7a47

SHA1
8ec550a3e08f266162a919a0795a2936139451d4

SHA256
8429af6025d9ffff9e5148ab4b66d1f191af759d63b5d96ea022b774ae893032

SHA512
edf5e99e6bfec7d404599b42c4d0a3a650cc9864f9199d4cba58a59cccea7093956cf7b14c4c576efde855da3d02674219d71fa2e4382503503939aefbc3b63d

Download Submit
\Windows\system\qkpBXfA.exe

Filesize
2.2MB

MD5
841ab93b2697bb9b998bcd58c6895c04

SHA1
ea2fe62d3089a09b15ef8035fdd317bbeb30ddb3

SHA256
09624f30b7337c5a43387f0371dc047910220498333a4ec2dc3b8cc9b522d39d

SHA512
f4f2f174014c9587bd30ccfd67bea736a8ee7fc7b1ee346016b4c3c142ec872871651b30d8f70bd47b739462b3ee4c55e4363a48199a0ab68c33f0704582c3f9

Download Submit
\Windows\system\tgbcRgN.exe

Filesize
2.2MB

MD5
40030c98c248bdb98c56ebfa707aeeb5

SHA1
92859b04f6e9f04bfe11f82f3502318804dffa35

SHA256
aa3e3a11d9ac6f1f914a94b52fd97546ce7c71a370d19e9677e8679716b72b07

SHA512
61ffab96b9daeeab1a0a1170e9bc0c19fe90b7d9bf11fd811e202d318f71e2184343567588136cc55a5fb0c321516fd9e7e9682ac0bb68bc03e0f30504930e1e

Download Submit
\Windows\system\thvWNPg.exe

Filesize
2.2MB

MD5
8a5f45fa356a1dcd6708b23a34c562c0

SHA1
87d94a01b2c41e39c1159eb2c2e72c77ac22bf92

SHA256
1eefae0ffb127ebbbd0c6e847c408277def19f7c604b3bf3d57ec8c74893ee5a

SHA512
04075cf65a1748a645af32ff66550b9a40e820e39581bc0102b08a8cbce3b28c2435744c55b78f4f4d4fc36ff6e2804d25c9c452a36a8b2b04c5cecc16600e10

Download Submit
\Windows\system\yIWrlux.exe

Filesize
2.3MB

MD5
abc7a0692fd163be755f3c0c74e4d75c

SHA1
9800ff56a8676e6e30bd94508a5070bdbf40c198

SHA256
bee10e0e30ee76bb983400e18da7a7b564eb2910bfcc4cdab6e1aa08fe2c3b4a

SHA512
275a2230d5d606781f5db87b4673f15586ec4f0d0fcd7479661f0bcf6a6701502985ea8620a06e74cd57ec3dce152de9cc9329b20035d4a66089eeee6f1453b0

Download Submit
\Windows\system\ziyjlkJ.exe

Filesize
2.3MB

MD5
1f2c21cdb9cd48b5d03f4c1f637164b4

SHA1
c9d9359d097d3ae52a890587ec5b1d0c3570c52b

SHA256
a2672c2ce4fedc0ff36cbe435d49235b495ddc5189b242d2108c5c0895d4dfa7

SHA512
fe7ddb1c3d352a6177306555c9515a3118caddc2898b70413fe0de54080c9877a9f6efad767267f72b27199f16cccdccdaab2e7bbdec8ba31c6dfdfc9ee9823d

Download Submit
memory/1732-155-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/1732-1149-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/1732-156-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/1732-176-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/1732-13-0x0000000002980000-0x0000000002A00000-memory.dmp

Filesize
512KB

Download
memory/1732-189-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmp

Filesize
9.6MB

Download
memory/2456-179-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2584-188-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2600-160-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2608-181-0x000000013F5F0000-0x000000013F9E2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-12-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2632-157-0x000000013FAC0000-0x000000013FEB2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-159-0x000000013F9A0000-0x000000013FD92000-memory.dmp

Filesize
3.9MB

Download
memory/2728-187-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2804-184-0x000000013F810000-0x000000013FC02000-memory.dmp

Filesize
3.9MB

Download
memory/2944-158-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2944-185-0x000000013F040000-0x000000013F432000-memory.dmp

Filesize
3.9MB

Download
memory/2944-180-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2944-190-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2944-183-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2944-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2944-161-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2944-186-0x000000013F490000-0x000000013F882000-memory.dmp

Filesize
3.9MB

Download
memory/2944-182-0x0000000002F40000-0x0000000003332000-memory.dmp

Filesize
3.9MB

Download
memory/2944-7-0x000000013F290000-0x000000013F682000-memory.dmp

Filesize
3.9MB

Download
memory/2944-2-0x000000013F990000-0x000000013FD82000-memory.dmp

Filesize
3.9MB

Download