xmrig | df5ad6baa0928d859e7e766dba478bab8df1afd637226277d2c2b675adb6c0e2

Analysis

max time kernel
29s
max time network
31s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 09:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
Size

2.0MB
MD5

0b6f2f6ba2833313528da548a4186b74
SHA1

4d529a205dd78154169bb35174eeba53a7a0ce53
SHA256

df5ad6baa0928d859e7e766dba478bab8df1afd637226277d2c2b675adb6c0e2
SHA512

7796914034768170b9608b2f1f4f5a14964a4ce2ef057e222824fb12613090a84168d5c9e5ba28a469f87d2a0325bacbb3d21bbddbbe8da6165eef8fe24902af
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafWJM:NABW

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 11 IoCs

miner

resource	yara_rule
behavioral1/memory/2916-17-0x000000013FC30000-0x0000000140022000-memory.dmp	xmrig
behavioral1/memory/2588-35-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	xmrig
behavioral1/memory/2464-60-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig
behavioral1/memory/2868-79-0x000000013FB50000-0x000000013FF42000-memory.dmp	xmrig
behavioral1/memory/2896-81-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2728-91-0x000000013FAA0000-0x000000013FE92000-memory.dmp	xmrig
behavioral1/memory/2172-69-0x000000013F4A0000-0x000000013F892000-memory.dmp	xmrig
behavioral1/memory/2536-68-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2700-30-0x000000013FDB0000-0x00000001401A2000-memory.dmp	xmrig
behavioral1/memory/2660-27-0x000000013FDA0000-0x0000000140192000-memory.dmp	xmrig
behavioral1/memory/2464-618-0x000000013F820000-0x000000013FC12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2916	qjNTJHz.exe
2660	mmUniwA.exe
2700	HYLDxPW.exe
2588	IzoWuiI.exe
2728	hexYqEN.exe
2464	inLageF.exe
2536	buNmGPt.exe
2172	ntkTJsM.exe
2756	pmSFFoj.exe
2896	GoluTcc.exe
2528	ZCPTYeX.exe
2872	IXDDtLj.exe
1048	hkrImJU.exe
2340	NGBfTtc.exe
1832	cdUCBii.exe
2556	BvArQPa.exe
2212	TTizbbA.exe
1644	zVlTfon.exe
2076	ZwfpdYn.exe
2440	MnGtgRR.exe
2156	WUxfNNI.exe
540	oXrgDUg.exe
648	uXzGLeE.exe
3068	UecEXEq.exe
632	aGtpMIv.exe
1128	IPmRvfS.exe
2176	CHMfCNw.exe
1364	hPxqtcj.exe
888	qdQciMW.exe
764	vDrytwO.exe
1872	sySFDMd.exe
1876	UuEnUPb.exe
2108	ripeTyw.exe
1748	qTNwCoI.exe
2540	VhfFfbG.exe
604	dGTTcCv.exe
1516	gAsGWDX.exe
2952	mMsAlTc.exe
1584	rRyQyJa.exe
2600	atuqHCA.exe
2812	sNrTMGV.exe
2632	MdDrMKy.exe
1456	XfSMGmH.exe
240	GXrIZWs.exe
1588	kiFyBle.exe
2244	kXPHGGL.exe
1788	fpmnMNj.exe
1684	FHHjPHk.exe
2008	oetQzsa.exe
2032	xBSTtVy.exe
2240	pHrysMd.exe
2412	qeACufe.exe
816	GjLQpzr.exe
1700	WDHszeR.exe
2308	nFTyWXK.exe
2300	JswUhrv.exe
2388	EDaBMhh.exe
1728	yjHYtUj.exe
984	vxsSfLZ.exe
1080	rcMevfO.exe
556	uhigfMU.exe
696	ruTuBfc.exe
1376	BIxwrhU.exe
692	KWnbTpj.exe

Loads dropped DLL 64 IoCs

pid	Process
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe

UPX packed file 55 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000d000000013413-2.dat	upx
behavioral1/memory/2868-7-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/files/0x0008000000013acb-14.dat	upx
behavioral1/files/0x000700000001415f-16.dat	upx
behavioral1/memory/2916-17-0x000000013FC30000-0x0000000140022000-memory.dmp	upx
behavioral1/memory/2588-35-0x000000013F9E0000-0x000000013FDD2000-memory.dmp	upx
behavioral1/files/0x0007000000014175-39.dat	upx
behavioral1/files/0x000e0000000054ab-43.dat	upx
behavioral1/memory/2728-42-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x000a000000014228-50.dat	upx
behavioral1/memory/2464-60-0x000000013F820000-0x000000013FC12000-memory.dmp	upx
behavioral1/files/0x000600000001471a-64.dat	upx
behavioral1/files/0x000600000001487f-73.dat	upx
behavioral1/files/0x0008000000014246-78.dat	upx
behavioral1/memory/2868-79-0x000000013FB50000-0x000000013FF42000-memory.dmp	upx
behavioral1/memory/2756-80-0x000000013F520000-0x000000013F912000-memory.dmp	upx
behavioral1/memory/2896-81-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0006000000014bbc-105.dat	upx
behavioral1/files/0x000600000001565d-125.dat	upx
behavioral1/files/0x0006000000015cd9-153.dat	upx
behavioral1/files/0x0006000000015d87-186.dat	upx
behavioral1/files/0x0006000000015d6b-181.dat	upx
behavioral1/files/0x0006000000015d56-174.dat	upx
behavioral1/files/0x0006000000015d42-167.dat	upx
behavioral1/files/0x0006000000015cff-160.dat	upx
behavioral1/files/0x0006000000015cb6-146.dat	upx
behavioral1/files/0x0006000000015c9e-139.dat	upx
behavioral1/files/0x0006000000015684-132.dat	upx
behavioral1/files/0x0006000000015d7f-183.dat	upx
behavioral1/files/0x0006000000015d5f-176.dat	upx
behavioral1/files/0x0006000000015d4e-169.dat	upx
behavioral1/files/0x0006000000015d20-162.dat	upx
behavioral1/files/0x0006000000015ce3-155.dat	upx
behavioral1/files/0x0006000000015ccd-148.dat	upx
behavioral1/files/0x0006000000015cae-141.dat	upx
behavioral1/files/0x0006000000015c87-134.dat	upx
behavioral1/files/0x0006000000015677-127.dat	upx
behavioral1/files/0x0006000000015653-120.dat	upx
behavioral1/files/0x000600000001535e-113.dat	upx
behavioral1/files/0x0006000000014e71-106.dat	upx
behavioral1/files/0x0006000000014b4c-98.dat	upx
behavioral1/memory/2872-93-0x000000013F940000-0x000000013FD32000-memory.dmp	upx
behavioral1/memory/2528-92-0x000000013F110000-0x000000013F502000-memory.dmp	upx
behavioral1/files/0x0006000000014826-70.dat	upx
behavioral1/memory/2728-91-0x000000013FAA0000-0x000000013FE92000-memory.dmp	upx
behavioral1/files/0x0006000000014a9a-90.dat	upx
behavioral1/files/0x000600000001564f-118.dat	upx
behavioral1/files/0x0006000000014fa2-111.dat	upx
behavioral1/files/0x0006000000014b18-97.dat	upx
behavioral1/memory/2172-69-0x000000013F4A0000-0x000000013F892000-memory.dmp	upx
behavioral1/memory/2536-68-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/memory/2700-30-0x000000013FDB0000-0x00000001401A2000-memory.dmp	upx
behavioral1/memory/2660-27-0x000000013FDA0000-0x0000000140192000-memory.dmp	upx
behavioral1/files/0x0036000000013a3a-11.dat	upx
behavioral1/memory/2464-618-0x000000013F820000-0x000000013FC12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\WQHPeyi.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\pPDPTMJ.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\MMwTybR.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\SLsSqVI.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ynAbAis.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\RFuUnwb.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\KMTbsdf.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\CNDTNCM.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ozbeKph.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\kugCtaL.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\SpMjlGH.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\mTZizrF.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\tyeRkKq.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\sjdUiif.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\MKWFxuF.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\cdUCBii.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\tLbLqXZ.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\jMYGpEw.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\PNLzXtA.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\DpLFAPR.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\SaHSoiI.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\FVOjKCx.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\zCgOwEd.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ubamZZu.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\PFkujFm.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\RxbEvcJ.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\vDrytwO.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\NSNRngi.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\TnXUylH.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\FPmkfUI.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\nauyVpD.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\hfSFFuO.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\WDyKoOD.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\NZYLLYp.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\QJZodQm.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\EaAAprx.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\EYHgBQB.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ufIddzc.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\FAnnaLR.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\GjLQpzr.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\hRehAkG.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\uJAAvmC.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\MZNgeNZ.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\YiVEshr.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\PlxTCgA.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\giOVwxv.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ADlAdPM.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\VNVNhhZ.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\plJpAvK.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\gAoPUQd.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\OWMUbbd.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\pbmeJef.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\JDCxDMO.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\vbguWBl.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\wwJMtwP.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\BXEpfpW.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\pdmaQQx.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\tKLSKML.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\pMqsiQK.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\uLkERgj.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\LEmoFEh.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\WbMMhJn.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\hgUTaLE.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
File created	C:\Windows\System\ZCPTYeX.exe	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1652	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
Token: SeDebugPrivilege	1652	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 1652	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	29
PID 2868 wrote to memory of 1652	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	29
PID 2868 wrote to memory of 1652	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	29
PID 2868 wrote to memory of 2916	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2916	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2916	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	30
PID 2868 wrote to memory of 2660	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2660	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2660	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	31
PID 2868 wrote to memory of 2700	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2700	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2700	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	32
PID 2868 wrote to memory of 2588	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	33
PID 2868 wrote to memory of 2588	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	33
PID 2868 wrote to memory of 2588	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	33
PID 2868 wrote to memory of 2728	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	34
PID 2868 wrote to memory of 2728	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	34
PID 2868 wrote to memory of 2728	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	34
PID 2868 wrote to memory of 2464	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2464	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2464	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	35
PID 2868 wrote to memory of 2536	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2536	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2536	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	36
PID 2868 wrote to memory of 2896	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	37
PID 2868 wrote to memory of 2896	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	37
PID 2868 wrote to memory of 2896	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	37
PID 2868 wrote to memory of 2172	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	38
PID 2868 wrote to memory of 2172	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	38
PID 2868 wrote to memory of 2172	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	38
PID 2868 wrote to memory of 2528	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2528	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2528	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	39
PID 2868 wrote to memory of 2756	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	40
PID 2868 wrote to memory of 2756	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	40
PID 2868 wrote to memory of 2756	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	40
PID 2868 wrote to memory of 2872	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	41
PID 2868 wrote to memory of 2872	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	41
PID 2868 wrote to memory of 2872	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	41
PID 2868 wrote to memory of 1048	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	42
PID 2868 wrote to memory of 1048	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	42
PID 2868 wrote to memory of 1048	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	42
PID 2868 wrote to memory of 2032	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	43
PID 2868 wrote to memory of 2032	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	43
PID 2868 wrote to memory of 2032	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	43
PID 2868 wrote to memory of 2340	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	44
PID 2868 wrote to memory of 2340	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	44
PID 2868 wrote to memory of 2340	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	44
PID 2868 wrote to memory of 2240	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	45
PID 2868 wrote to memory of 2240	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	45
PID 2868 wrote to memory of 2240	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	45
PID 2868 wrote to memory of 1832	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	46
PID 2868 wrote to memory of 1832	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	46
PID 2868 wrote to memory of 1832	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	46
PID 2868 wrote to memory of 2412	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2412	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2412	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	47
PID 2868 wrote to memory of 2556	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	48
PID 2868 wrote to memory of 2556	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	48
PID 2868 wrote to memory of 2556	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	48
PID 2868 wrote to memory of 816	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	49
PID 2868 wrote to memory of 816	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	49
PID 2868 wrote to memory of 816	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	49
PID 2868 wrote to memory of 2212	2868	0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b6f2f6ba2833313528da548a4186b74_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- C:\Windows\System\qjNTJHz.exe
  C:\Windows\System\qjNTJHz.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\mmUniwA.exe
  C:\Windows\System\mmUniwA.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\HYLDxPW.exe
  C:\Windows\System\HYLDxPW.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\IzoWuiI.exe
  C:\Windows\System\IzoWuiI.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\hexYqEN.exe
  C:\Windows\System\hexYqEN.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\inLageF.exe
  C:\Windows\System\inLageF.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\buNmGPt.exe
  C:\Windows\System\buNmGPt.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\GoluTcc.exe
  C:\Windows\System\GoluTcc.exe
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Windows\System\ntkTJsM.exe
  C:\Windows\System\ntkTJsM.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\ZCPTYeX.exe
  C:\Windows\System\ZCPTYeX.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\pmSFFoj.exe
  C:\Windows\System\pmSFFoj.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\IXDDtLj.exe
  C:\Windows\System\IXDDtLj.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\hkrImJU.exe
  C:\Windows\System\hkrImJU.exe
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Windows\System\xBSTtVy.exe
  C:\Windows\System\xBSTtVy.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\NGBfTtc.exe
  C:\Windows\System\NGBfTtc.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\pHrysMd.exe
  C:\Windows\System\pHrysMd.exe
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Windows\System\cdUCBii.exe
  C:\Windows\System\cdUCBii.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\qeACufe.exe
  C:\Windows\System\qeACufe.exe
  2⤵
  - Executes dropped EXE
  PID:2412
- C:\Windows\System\BvArQPa.exe
  C:\Windows\System\BvArQPa.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\GjLQpzr.exe
  C:\Windows\System\GjLQpzr.exe
  2⤵
  - Executes dropped EXE
  PID:816
- C:\Windows\System\TTizbbA.exe
  C:\Windows\System\TTizbbA.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\WDHszeR.exe
  C:\Windows\System\WDHszeR.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\zVlTfon.exe
  C:\Windows\System\zVlTfon.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\nFTyWXK.exe
  C:\Windows\System\nFTyWXK.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\ZwfpdYn.exe
  C:\Windows\System\ZwfpdYn.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JswUhrv.exe
  C:\Windows\System\JswUhrv.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\MnGtgRR.exe
  C:\Windows\System\MnGtgRR.exe
  2⤵
  - Executes dropped EXE
  PID:2440
- C:\Windows\System\EDaBMhh.exe
  C:\Windows\System\EDaBMhh.exe
  2⤵
  - Executes dropped EXE
  PID:2388
- C:\Windows\System\WUxfNNI.exe
  C:\Windows\System\WUxfNNI.exe
  2⤵
  - Executes dropped EXE
  PID:2156
- C:\Windows\System\yjHYtUj.exe
  C:\Windows\System\yjHYtUj.exe
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Windows\System\oXrgDUg.exe
  C:\Windows\System\oXrgDUg.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\vxsSfLZ.exe
  C:\Windows\System\vxsSfLZ.exe
  2⤵
  - Executes dropped EXE
  PID:984
- C:\Windows\System\uXzGLeE.exe
  C:\Windows\System\uXzGLeE.exe
  2⤵
  - Executes dropped EXE
  PID:648
- C:\Windows\System\rcMevfO.exe
  C:\Windows\System\rcMevfO.exe
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\System\UecEXEq.exe
  C:\Windows\System\UecEXEq.exe
  2⤵
  - Executes dropped EXE
  PID:3068
- C:\Windows\System\uhigfMU.exe
  C:\Windows\System\uhigfMU.exe
  2⤵
  - Executes dropped EXE
  PID:556
- C:\Windows\System\aGtpMIv.exe
  C:\Windows\System\aGtpMIv.exe
  2⤵
  - Executes dropped EXE
  PID:632
- C:\Windows\System\ruTuBfc.exe
  C:\Windows\System\ruTuBfc.exe
  2⤵
  - Executes dropped EXE
  PID:696
- C:\Windows\System\IPmRvfS.exe
  C:\Windows\System\IPmRvfS.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- C:\Windows\System\BIxwrhU.exe
  C:\Windows\System\BIxwrhU.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\CHMfCNw.exe
  C:\Windows\System\CHMfCNw.exe
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\System\KWnbTpj.exe
  C:\Windows\System\KWnbTpj.exe
  2⤵
  - Executes dropped EXE
  PID:692
- C:\Windows\System\hPxqtcj.exe
  C:\Windows\System\hPxqtcj.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\pAhelLV.exe
  C:\Windows\System\pAhelLV.exe
  2⤵
  PID:1564
- C:\Windows\System\qdQciMW.exe
  C:\Windows\System\qdQciMW.exe
  2⤵
  - Executes dropped EXE
  PID:888
- C:\Windows\System\LJqobMd.exe
  C:\Windows\System\LJqobMd.exe
  2⤵
  PID:1340
- C:\Windows\System\vDrytwO.exe
  C:\Windows\System\vDrytwO.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\PblWCli.exe
  C:\Windows\System\PblWCli.exe
  2⤵
  PID:1280
- C:\Windows\System\sySFDMd.exe
  C:\Windows\System\sySFDMd.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\zArPMdk.exe
  C:\Windows\System\zArPMdk.exe
  2⤵
  PID:1868
- C:\Windows\System\UuEnUPb.exe
  C:\Windows\System\UuEnUPb.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\ZirkDxi.exe
  C:\Windows\System\ZirkDxi.exe
  2⤵
  PID:848
- C:\Windows\System\ripeTyw.exe
  C:\Windows\System\ripeTyw.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\DpLFAPR.exe
  C:\Windows\System\DpLFAPR.exe
  2⤵
  PID:2184
- C:\Windows\System\qTNwCoI.exe
  C:\Windows\System\qTNwCoI.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\KMljbSu.exe
  C:\Windows\System\KMljbSu.exe
  2⤵
  PID:1524
- C:\Windows\System\VhfFfbG.exe
  C:\Windows\System\VhfFfbG.exe
  2⤵
  - Executes dropped EXE
  PID:2540
- C:\Windows\System\GlOCMDw.exe
  C:\Windows\System\GlOCMDw.exe
  2⤵
  PID:2408
- C:\Windows\System\dGTTcCv.exe
  C:\Windows\System\dGTTcCv.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\OeRnhXw.exe
  C:\Windows\System\OeRnhXw.exe
  2⤵
  PID:2136
- C:\Windows\System\gAsGWDX.exe
  C:\Windows\System\gAsGWDX.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\LUoqufi.exe
  C:\Windows\System\LUoqufi.exe
  2⤵
  PID:872
- C:\Windows\System\mMsAlTc.exe
  C:\Windows\System\mMsAlTc.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\XcxYbio.exe
  C:\Windows\System\XcxYbio.exe
  2⤵
  PID:2252
- C:\Windows\System\rRyQyJa.exe
  C:\Windows\System\rRyQyJa.exe
  2⤵
  - Executes dropped EXE
  PID:1584
- C:\Windows\System\qmxeaMk.exe
  C:\Windows\System\qmxeaMk.exe
  2⤵
  PID:2648
- C:\Windows\System\atuqHCA.exe
  C:\Windows\System\atuqHCA.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\VNVNhhZ.exe
  C:\Windows\System\VNVNhhZ.exe
  2⤵
  PID:2592
- C:\Windows\System\sNrTMGV.exe
  C:\Windows\System\sNrTMGV.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\FVLSUtH.exe
  C:\Windows\System\FVLSUtH.exe
  2⤵
  PID:1964
- C:\Windows\System\MdDrMKy.exe
  C:\Windows\System\MdDrMKy.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\mSbPGpk.exe
  C:\Windows\System\mSbPGpk.exe
  2⤵
  PID:2628
- C:\Windows\System\XfSMGmH.exe
  C:\Windows\System\XfSMGmH.exe
  2⤵
  - Executes dropped EXE
  PID:1456
- C:\Windows\System\tGUbAqt.exe
  C:\Windows\System\tGUbAqt.exe
  2⤵
  PID:2788
- C:\Windows\System\GXrIZWs.exe
  C:\Windows\System\GXrIZWs.exe
  2⤵
  - Executes dropped EXE
  PID:240
- C:\Windows\System\SxbiuNm.exe
  C:\Windows\System\SxbiuNm.exe
  2⤵
  PID:804
- C:\Windows\System\kiFyBle.exe
  C:\Windows\System\kiFyBle.exe
  2⤵
  - Executes dropped EXE
  PID:1588
- C:\Windows\System\PDzNoPO.exe
  C:\Windows\System\PDzNoPO.exe
  2⤵
  PID:2056
- C:\Windows\System\kXPHGGL.exe
  C:\Windows\System\kXPHGGL.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\BXEpfpW.exe
  C:\Windows\System\BXEpfpW.exe
  2⤵
  PID:1160
- C:\Windows\System\fpmnMNj.exe
  C:\Windows\System\fpmnMNj.exe
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\System\ITXkxWh.exe
  C:\Windows\System\ITXkxWh.exe
  2⤵
  PID:1972
- C:\Windows\System\FHHjPHk.exe
  C:\Windows\System\FHHjPHk.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\fNoaIsY.exe
  C:\Windows\System\fNoaIsY.exe
  2⤵
  PID:2624
- C:\Windows\System\oetQzsa.exe
  C:\Windows\System\oetQzsa.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\LjRPBmQ.exe
  C:\Windows\System\LjRPBmQ.exe
  2⤵
  PID:896
- C:\Windows\System\SXViElP.exe
  C:\Windows\System\SXViElP.exe
  2⤵
  PID:3260
- C:\Windows\System\Osnipfk.exe
  C:\Windows\System\Osnipfk.exe
  2⤵
  PID:3388
- C:\Windows\System\IqzjlIx.exe
  C:\Windows\System\IqzjlIx.exe
  2⤵
  PID:3416
- C:\Windows\System\EaAAprx.exe
  C:\Windows\System\EaAAprx.exe
  2⤵
  PID:3448
- C:\Windows\System\plJpAvK.exe
  C:\Windows\System\plJpAvK.exe
  2⤵
  PID:3508
- C:\Windows\System\NIsuMhC.exe
  C:\Windows\System\NIsuMhC.exe
  2⤵
  PID:3524
- C:\Windows\System\MeVJjFx.exe
  C:\Windows\System\MeVJjFx.exe
  2⤵
  PID:3544
- C:\Windows\System\PAFzcQS.exe
  C:\Windows\System\PAFzcQS.exe
  2⤵
  PID:3560
- C:\Windows\System\kiekFul.exe
  C:\Windows\System\kiekFul.exe
  2⤵
  PID:3584
- C:\Windows\System\YhGDxmU.exe
  C:\Windows\System\YhGDxmU.exe
  2⤵
  PID:3612
- C:\Windows\System\tMlmuYV.exe
  C:\Windows\System\tMlmuYV.exe
  2⤵
  PID:3636
- C:\Windows\System\CsjxTMQ.exe
  C:\Windows\System\CsjxTMQ.exe
  2⤵
  PID:3652
- C:\Windows\System\WLcrxfS.exe
  C:\Windows\System\WLcrxfS.exe
  2⤵
  PID:3672
- C:\Windows\System\ddUyFKn.exe
  C:\Windows\System\ddUyFKn.exe
  2⤵
  PID:3688
- C:\Windows\System\GnuyAVD.exe
  C:\Windows\System\GnuyAVD.exe
  2⤵
  PID:3708
- C:\Windows\System\YWkYMKe.exe
  C:\Windows\System\YWkYMKe.exe
  2⤵
  PID:3724
- C:\Windows\System\gGXwqre.exe
  C:\Windows\System\gGXwqre.exe
  2⤵
  PID:3740
- C:\Windows\System\oCcVSuv.exe
  C:\Windows\System\oCcVSuv.exe
  2⤵
  PID:3760
- C:\Windows\System\CKZhHBT.exe
  C:\Windows\System\CKZhHBT.exe
  2⤵
  PID:3804
- C:\Windows\System\ybDqkfq.exe
  C:\Windows\System\ybDqkfq.exe
  2⤵
  PID:3824
- C:\Windows\System\TlYQOYF.exe
  C:\Windows\System\TlYQOYF.exe
  2⤵
  PID:3844
- C:\Windows\System\uiPiurG.exe
  C:\Windows\System\uiPiurG.exe
  2⤵
  PID:3860
- C:\Windows\System\ganHFBn.exe
  C:\Windows\System\ganHFBn.exe
  2⤵
  PID:3880
- C:\Windows\System\sbdTPXJ.exe
  C:\Windows\System\sbdTPXJ.exe
  2⤵
  PID:3900
- C:\Windows\System\PDVtPxO.exe
  C:\Windows\System\PDVtPxO.exe
  2⤵
  PID:3924
- C:\Windows\System\gMiczsE.exe
  C:\Windows\System\gMiczsE.exe
  2⤵
  PID:3940
- C:\Windows\System\hAduxbX.exe
  C:\Windows\System\hAduxbX.exe
  2⤵
  PID:3960
- C:\Windows\System\oQbpudh.exe
  C:\Windows\System\oQbpudh.exe
  2⤵
  PID:3984
- C:\Windows\System\bpsrikQ.exe
  C:\Windows\System\bpsrikQ.exe
  2⤵
  PID:4000
- C:\Windows\System\AeXFZuI.exe
  C:\Windows\System\AeXFZuI.exe
  2⤵
  PID:4016
- C:\Windows\System\gCvxRFm.exe
  C:\Windows\System\gCvxRFm.exe
  2⤵
  PID:4040
- C:\Windows\System\GMhXOeK.exe
  C:\Windows\System\GMhXOeK.exe
  2⤵
  PID:4056
- C:\Windows\System\NlbtAjQ.exe
  C:\Windows\System\NlbtAjQ.exe
  2⤵
  PID:4072
- C:\Windows\System\nbymtCL.exe
  C:\Windows\System\nbymtCL.exe
  2⤵
  PID:4092
- C:\Windows\System\YErwcpb.exe
  C:\Windows\System\YErwcpb.exe
  2⤵
  PID:1984
- C:\Windows\System\GlFAGdS.exe
  C:\Windows\System\GlFAGdS.exe
  2⤵
  PID:1628
- C:\Windows\System\PyFlKHk.exe
  C:\Windows\System\PyFlKHk.exe
  2⤵
  PID:3276
- C:\Windows\System\rUhpiZd.exe
  C:\Windows\System\rUhpiZd.exe
  2⤵
  PID:3340
- C:\Windows\System\QaxTEzq.exe
  C:\Windows\System\QaxTEzq.exe
  2⤵
  PID:336
- C:\Windows\System\PlxTCgA.exe
  C:\Windows\System\PlxTCgA.exe
  2⤵
  PID:3432
- C:\Windows\System\kOHPKda.exe
  C:\Windows\System\kOHPKda.exe
  2⤵
  PID:2844
- C:\Windows\System\RVPkjAH.exe
  C:\Windows\System\RVPkjAH.exe
  2⤵
  PID:2428
- C:\Windows\System\rUgHAbo.exe
  C:\Windows\System\rUgHAbo.exe
  2⤵
  PID:2020
- C:\Windows\System\zRpWZmK.exe
  C:\Windows\System\zRpWZmK.exe
  2⤵
  PID:1844
- C:\Windows\System\IxAVRyi.exe
  C:\Windows\System\IxAVRyi.exe
  2⤵
  PID:1400
- C:\Windows\System\tLbLqXZ.exe
  C:\Windows\System\tLbLqXZ.exe
  2⤵
  PID:3484
- C:\Windows\System\BDwelZC.exe
  C:\Windows\System\BDwelZC.exe
  2⤵
  PID:1712
- C:\Windows\System\goQDSeD.exe
  C:\Windows\System\goQDSeD.exe
  2⤵
  PID:2392
- C:\Windows\System\gcqnQci.exe
  C:\Windows\System\gcqnQci.exe
  2⤵
  PID:824
- C:\Windows\System\gQwfiet.exe
  C:\Windows\System\gQwfiet.exe
  2⤵
  PID:2988
- C:\Windows\System\PjqWoow.exe
  C:\Windows\System\PjqWoow.exe
  2⤵
  PID:2512
- C:\Windows\System\iOMkEbg.exe
  C:\Windows\System\iOMkEbg.exe
  2⤵
  PID:2544
- C:\Windows\System\dOqEItm.exe
  C:\Windows\System\dOqEItm.exe
  2⤵
  PID:2832
- C:\Windows\System\nkjvIzq.exe
  C:\Windows\System\nkjvIzq.exe
  2⤵
  PID:2532
- C:\Windows\System\qbaZzWp.exe
  C:\Windows\System\qbaZzWp.exe
  2⤵
  PID:2348
- C:\Windows\System\cakBFgF.exe
  C:\Windows\System\cakBFgF.exe
  2⤵
  PID:2612
- C:\Windows\System\yGJlUCc.exe
  C:\Windows\System\yGJlUCc.exe
  2⤵
  PID:944
- C:\Windows\System\miAlWPd.exe
  C:\Windows\System\miAlWPd.exe
  2⤵
  PID:2708
- C:\Windows\System\eGxSFbS.exe
  C:\Windows\System\eGxSFbS.exe
  2⤵
  PID:1284
- C:\Windows\System\UvFWffU.exe
  C:\Windows\System\UvFWffU.exe
  2⤵
  PID:1592
- C:\Windows\System\LWgvNVD.exe
  C:\Windows\System\LWgvNVD.exe
  2⤵
  PID:2836
- C:\Windows\System\XfJqtxT.exe
  C:\Windows\System\XfJqtxT.exe
  2⤵
  PID:784
- C:\Windows\System\uDipWBs.exe
  C:\Windows\System\uDipWBs.exe
  2⤵
  PID:1232
- C:\Windows\System\XofFeoa.exe
  C:\Windows\System\XofFeoa.exe
  2⤵
  PID:3412
- C:\Windows\System\muPArxq.exe
  C:\Windows\System\muPArxq.exe
  2⤵
  PID:3468
- C:\Windows\System\iKyBPQH.exe
  C:\Windows\System\iKyBPQH.exe
  2⤵
  PID:3496
- C:\Windows\System\vFREjcx.exe
  C:\Windows\System\vFREjcx.exe
  2⤵
  PID:3552
- C:\Windows\System\JPSNANz.exe
  C:\Windows\System\JPSNANz.exe
  2⤵
  PID:908
- C:\Windows\System\XHHNDSj.exe
  C:\Windows\System\XHHNDSj.exe
  2⤵
  PID:3504
- C:\Windows\System\yqfBqBt.exe
  C:\Windows\System\yqfBqBt.exe
  2⤵
  PID:3748
- C:\Windows\System\snzGUVi.exe
  C:\Windows\System\snzGUVi.exe
  2⤵
  PID:2644
- C:\Windows\System\gTJdcfv.exe
  C:\Windows\System\gTJdcfv.exe
  2⤵
  PID:3540
- C:\Windows\System\EzFmRDc.exe
  C:\Windows\System\EzFmRDc.exe
  2⤵
  PID:3632
- C:\Windows\System\TkXVpPD.exe
  C:\Windows\System\TkXVpPD.exe
  2⤵
  PID:3812
- C:\Windows\System\PNLzXtA.exe
  C:\Windows\System\PNLzXtA.exe
  2⤵
  PID:3736
- C:\Windows\System\aasQWuI.exe
  C:\Windows\System\aasQWuI.exe
  2⤵
  PID:3780
- C:\Windows\System\XrzSKTc.exe
  C:\Windows\System\XrzSKTc.exe
  2⤵
  PID:3892
- C:\Windows\System\zWyLgMI.exe
  C:\Windows\System\zWyLgMI.exe
  2⤵
  PID:3836
- C:\Windows\System\UOajcjA.exe
  C:\Windows\System\UOajcjA.exe
  2⤵
  PID:3840
- C:\Windows\System\dXpxxLo.exe
  C:\Windows\System\dXpxxLo.exe
  2⤵
  PID:3972
- C:\Windows\System\IfoYODK.exe
  C:\Windows\System\IfoYODK.exe
  2⤵
  PID:2620
- C:\Windows\System\xLbuxga.exe
  C:\Windows\System\xLbuxga.exe
  2⤵
  PID:4048
- C:\Windows\System\qyHIPgQ.exe
  C:\Windows\System\qyHIPgQ.exe
  2⤵
  PID:4052
- C:\Windows\System\sUyJGKF.exe
  C:\Windows\System\sUyJGKF.exe
  2⤵
  PID:1792
- C:\Windows\System\vPfaPqY.exe
  C:\Windows\System\vPfaPqY.exe
  2⤵
  PID:3916
- C:\Windows\System\EGvgVqm.exe
  C:\Windows\System\EGvgVqm.exe
  2⤵
  PID:4068
- C:\Windows\System\QedBfac.exe
  C:\Windows\System\QedBfac.exe
  2⤵
  PID:3428
- C:\Windows\System\qacwFab.exe
  C:\Windows\System\qacwFab.exe
  2⤵
  PID:2688
- C:\Windows\System\zYjaUBZ.exe
  C:\Windows\System\zYjaUBZ.exe
  2⤵
  PID:1304
- C:\Windows\System\apxJAdH.exe
  C:\Windows\System\apxJAdH.exe
  2⤵
  PID:548
- C:\Windows\System\ZAIQhpo.exe
  C:\Windows\System\ZAIQhpo.exe
  2⤵
  PID:1612
- C:\Windows\System\vIywIWf.exe
  C:\Windows\System\vIywIWf.exe
  2⤵
  PID:4032
- C:\Windows\System\PczLMCl.exe
  C:\Windows\System\PczLMCl.exe
  2⤵
  PID:1044
- C:\Windows\System\KEVpFup.exe
  C:\Windows\System\KEVpFup.exe
  2⤵
  PID:1496
- C:\Windows\System\PBDkWpo.exe
  C:\Windows\System\PBDkWpo.exe
  2⤵
  PID:1536
- C:\Windows\System\EYHgBQB.exe
  C:\Windows\System\EYHgBQB.exe
  2⤵
  PID:1848
- C:\Windows\System\IBPbUsC.exe
  C:\Windows\System\IBPbUsC.exe
  2⤵
  PID:2596
- C:\Windows\System\jZWqHAt.exe
  C:\Windows\System\jZWqHAt.exe
  2⤵
  PID:1632
- C:\Windows\System\XTKJGGH.exe
  C:\Windows\System\XTKJGGH.exe
  2⤵
  PID:1736
- C:\Windows\System\wLmfHJk.exe
  C:\Windows\System\wLmfHJk.exe
  2⤵
  PID:2548
- C:\Windows\System\ehiTDox.exe
  C:\Windows\System\ehiTDox.exe
  2⤵
  PID:1228
- C:\Windows\System\HDrNkWb.exe
  C:\Windows\System\HDrNkWb.exe
  2⤵
  PID:1916
- C:\Windows\System\PjYtVsZ.exe
  C:\Windows\System\PjYtVsZ.exe
  2⤵
  PID:3088
- C:\Windows\System\kMjmzQt.exe
  C:\Windows\System\kMjmzQt.exe
  2⤵
  PID:308
- C:\Windows\System\JanVVJH.exe
  C:\Windows\System\JanVVJH.exe
  2⤵
  PID:2752
- C:\Windows\System\tOXHFzv.exe
  C:\Windows\System\tOXHFzv.exe
  2⤵
  PID:2404
- C:\Windows\System\HUaMYrd.exe
  C:\Windows\System\HUaMYrd.exe
  2⤵
  PID:1636
- C:\Windows\System\OrExgEb.exe
  C:\Windows\System\OrExgEb.exe
  2⤵
  PID:2472
- C:\Windows\System\PMMMGju.exe
  C:\Windows\System\PMMMGju.exe
  2⤵
  PID:3488
- C:\Windows\System\dTCrMUP.exe
  C:\Windows\System\dTCrMUP.exe
  2⤵
  PID:3520
- C:\Windows\System\YsrlfmX.exe
  C:\Windows\System\YsrlfmX.exe
  2⤵
  PID:3600
- C:\Windows\System\yMlCqHt.exe
  C:\Windows\System\yMlCqHt.exe
  2⤵
  PID:2508
- C:\Windows\System\sROFRRN.exe
  C:\Windows\System\sROFRRN.exe
  2⤵
  PID:3568
- C:\Windows\System\glggJNm.exe
  C:\Windows\System\glggJNm.exe
  2⤵
  PID:452
- C:\Windows\System\zUZbMxx.exe
  C:\Windows\System\zUZbMxx.exe
  2⤵
  PID:2468
- C:\Windows\System\VwSRnxE.exe
  C:\Windows\System\VwSRnxE.exe
  2⤵
  PID:3772
- C:\Windows\System\dVbILAN.exe
  C:\Windows\System\dVbILAN.exe
  2⤵
  PID:3856
- C:\Windows\System\wwhnLoG.exe
  C:\Windows\System\wwhnLoG.exe
  2⤵
  PID:2908
- C:\Windows\System\VuRoNxt.exe
  C:\Windows\System\VuRoNxt.exe
  2⤵
  PID:2064
- C:\Windows\System\xGakvYO.exe
  C:\Windows\System\xGakvYO.exe
  2⤵
  PID:4008
- C:\Windows\System\vioMnlw.exe
  C:\Windows\System\vioMnlw.exe
  2⤵
  PID:4084
- C:\Windows\System\NovsRDX.exe
  C:\Windows\System\NovsRDX.exe
  2⤵
  PID:1960
- C:\Windows\System\MJJXEUl.exe
  C:\Windows\System\MJJXEUl.exe
  2⤵
  PID:3956
- C:\Windows\System\CuxFdtY.exe
  C:\Windows\System\CuxFdtY.exe
  2⤵
  PID:748
- C:\Windows\System\TQMsPTj.exe
  C:\Windows\System\TQMsPTj.exe
  2⤵
  PID:2696
- C:\Windows\System\DTHgYVB.exe
  C:\Windows\System\DTHgYVB.exe
  2⤵
  PID:2336
- C:\Windows\System\CsueBsO.exe
  C:\Windows\System\CsueBsO.exe
  2⤵
  PID:1028
- C:\Windows\System\kvttwGm.exe
  C:\Windows\System\kvttwGm.exe
  2⤵
  PID:4064
- C:\Windows\System\YeMzQgn.exe
  C:\Windows\System\YeMzQgn.exe
  2⤵
  PID:3268
- C:\Windows\System\goXlJyL.exe
  C:\Windows\System\goXlJyL.exe
  2⤵
  PID:2480
- C:\Windows\System\WZjOqus.exe
  C:\Windows\System\WZjOqus.exe
  2⤵
  PID:2424
- C:\Windows\System\nzHKLHm.exe
  C:\Windows\System\nzHKLHm.exe
  2⤵
  PID:3060
- C:\Windows\System\fIzYmGl.exe
  C:\Windows\System\fIzYmGl.exe
  2⤵
  PID:2492
- C:\Windows\System\mBTFJfv.exe
  C:\Windows\System\mBTFJfv.exe
  2⤵
  PID:2436
- C:\Windows\System\tUgENvY.exe
  C:\Windows\System\tUgENvY.exe
  2⤵
  PID:2880
- C:\Windows\System\wWhRWhD.exe
  C:\Windows\System\wWhRWhD.exe
  2⤵
  PID:3028
- C:\Windows\System\EeJLCrC.exe
  C:\Windows\System\EeJLCrC.exe
  2⤵
  PID:2496
- C:\Windows\System\zOCCSlz.exe
  C:\Windows\System\zOCCSlz.exe
  2⤵
  PID:3460
- C:\Windows\System\FoOjuNK.exe
  C:\Windows\System\FoOjuNK.exe
  2⤵
  PID:3752
- C:\Windows\System\YscElds.exe
  C:\Windows\System\YscElds.exe
  2⤵
  PID:2912
- C:\Windows\System\kqRxHZx.exe
  C:\Windows\System\kqRxHZx.exe
  2⤵
  PID:3700
- C:\Windows\System\ZdZOtcA.exe
  C:\Windows\System\ZdZOtcA.exe
  2⤵
  PID:2460
- C:\Windows\System\PpsIjSy.exe
  C:\Windows\System\PpsIjSy.exe
  2⤵
  PID:3580
- C:\Windows\System\JuGjLHk.exe
  C:\Windows\System\JuGjLHk.exe
  2⤵
  PID:3000
- C:\Windows\System\IkiLIGs.exe
  C:\Windows\System\IkiLIGs.exe
  2⤵
  PID:1688
- C:\Windows\System\fozzkLG.exe
  C:\Windows\System\fozzkLG.exe
  2⤵
  PID:3516
- C:\Windows\System\eIVKfWT.exe
  C:\Windows\System\eIVKfWT.exe
  2⤵
  PID:2488
- C:\Windows\System\AEHMDbR.exe
  C:\Windows\System\AEHMDbR.exe
  2⤵
  PID:3620
- C:\Windows\System\InTcMIf.exe
  C:\Windows\System\InTcMIf.exe
  2⤵
  PID:2784
- C:\Windows\System\tCuseEB.exe
  C:\Windows\System\tCuseEB.exe
  2⤵
  PID:3912
- C:\Windows\System\umyYhta.exe
  C:\Windows\System\umyYhta.exe
  2⤵
  PID:2684
- C:\Windows\System\DroAAXT.exe
  C:\Windows\System\DroAAXT.exe
  2⤵
  PID:4088
- C:\Windows\System\yPOhSsC.exe
  C:\Windows\System\yPOhSsC.exe
  2⤵
  PID:3952
- C:\Windows\System\ulXHYXG.exe
  C:\Windows\System\ulXHYXG.exe
  2⤵
  PID:4108
- C:\Windows\System\VdQkWmY.exe
  C:\Windows\System\VdQkWmY.exe
  2⤵
  PID:4124
- C:\Windows\System\niUCucJ.exe
  C:\Windows\System\niUCucJ.exe
  2⤵
  PID:4140
- C:\Windows\System\GiIIyNr.exe
  C:\Windows\System\GiIIyNr.exe
  2⤵
  PID:4156
- C:\Windows\System\rKLyGtM.exe
  C:\Windows\System\rKLyGtM.exe
  2⤵
  PID:4172
- C:\Windows\System\gkyTTeD.exe
  C:\Windows\System\gkyTTeD.exe
  2⤵
  PID:4188
- C:\Windows\System\SJafKGq.exe
  C:\Windows\System\SJafKGq.exe
  2⤵
  PID:4204
- C:\Windows\System\zKTHhFC.exe
  C:\Windows\System\zKTHhFC.exe
  2⤵
  PID:4224
- C:\Windows\System\zChSxGj.exe
  C:\Windows\System\zChSxGj.exe
  2⤵
  PID:4240
- C:\Windows\System\SQDhiSZ.exe
  C:\Windows\System\SQDhiSZ.exe
  2⤵
  PID:4256
- C:\Windows\System\PJbuwCH.exe
  C:\Windows\System\PJbuwCH.exe
  2⤵
  PID:4272
- C:\Windows\System\PvmNnPL.exe
  C:\Windows\System\PvmNnPL.exe
  2⤵
  PID:4288
- C:\Windows\System\LaUPwih.exe
  C:\Windows\System\LaUPwih.exe
  2⤵
  PID:4304
- C:\Windows\System\THHLmuR.exe
  C:\Windows\System\THHLmuR.exe
  2⤵
  PID:4320
- C:\Windows\System\YsJrxwY.exe
  C:\Windows\System\YsJrxwY.exe
  2⤵
  PID:4340
- C:\Windows\System\jTHgVFy.exe
  C:\Windows\System\jTHgVFy.exe
  2⤵
  PID:4356
- C:\Windows\System\GxRvEMA.exe
  C:\Windows\System\GxRvEMA.exe
  2⤵
  PID:4372
- C:\Windows\System\XVOnmjM.exe
  C:\Windows\System\XVOnmjM.exe
  2⤵
  PID:4388
- C:\Windows\System\PdhxzUa.exe
  C:\Windows\System\PdhxzUa.exe
  2⤵
  PID:4404
- C:\Windows\System\Xbrbuly.exe
  C:\Windows\System\Xbrbuly.exe
  2⤵
  PID:4420
- C:\Windows\System\dsREgss.exe
  C:\Windows\System\dsREgss.exe
  2⤵
  PID:4436
- C:\Windows\System\YUVMYbR.exe
  C:\Windows\System\YUVMYbR.exe
  2⤵
  PID:4456
- C:\Windows\System\FtAonbS.exe
  C:\Windows\System\FtAonbS.exe
  2⤵
  PID:4472
- C:\Windows\System\ksSlPmq.exe
  C:\Windows\System\ksSlPmq.exe
  2⤵
  PID:4488
- C:\Windows\System\twiFbtF.exe
  C:\Windows\System\twiFbtF.exe
  2⤵
  PID:4508
- C:\Windows\System\nauyVpD.exe
  C:\Windows\System\nauyVpD.exe
  2⤵
  PID:4524
- C:\Windows\System\uNnteIw.exe
  C:\Windows\System\uNnteIw.exe
  2⤵
  PID:4540
- C:\Windows\System\rkDQaSI.exe
  C:\Windows\System\rkDQaSI.exe
  2⤵
  PID:4556
- C:\Windows\System\FVvcITE.exe
  C:\Windows\System\FVvcITE.exe
  2⤵
  PID:4572
- C:\Windows\System\VBPLfwB.exe
  C:\Windows\System\VBPLfwB.exe
  2⤵
  PID:4588
- C:\Windows\System\WrQMPoO.exe
  C:\Windows\System\WrQMPoO.exe
  2⤵
  PID:4604
- C:\Windows\System\cDviUUz.exe
  C:\Windows\System\cDviUUz.exe
  2⤵
  PID:4624
- C:\Windows\System\yeIEfzv.exe
  C:\Windows\System\yeIEfzv.exe
  2⤵
  PID:4640
- C:\Windows\System\JkdXsRC.exe
  C:\Windows\System\JkdXsRC.exe
  2⤵
  PID:4656
- C:\Windows\System\RIsIeoJ.exe
  C:\Windows\System\RIsIeoJ.exe
  2⤵
  PID:4672
- C:\Windows\System\QJzMdeH.exe
  C:\Windows\System\QJzMdeH.exe
  2⤵
  PID:4688
- C:\Windows\System\rghNcgu.exe
  C:\Windows\System\rghNcgu.exe
  2⤵
  PID:4704
- C:\Windows\System\gAoPUQd.exe
  C:\Windows\System\gAoPUQd.exe
  2⤵
  PID:4724
- C:\Windows\System\YCQXvnJ.exe
  C:\Windows\System\YCQXvnJ.exe
  2⤵
  PID:4740
- C:\Windows\System\HLfYqyj.exe
  C:\Windows\System\HLfYqyj.exe
  2⤵
  PID:4756
- C:\Windows\System\YoDtTtX.exe
  C:\Windows\System\YoDtTtX.exe
  2⤵
  PID:4772
- C:\Windows\System\lLeKnUJ.exe
  C:\Windows\System\lLeKnUJ.exe
  2⤵
  PID:4788
- C:\Windows\System\DOqDmat.exe
  C:\Windows\System\DOqDmat.exe
  2⤵
  PID:4804
- C:\Windows\System\MIycAvw.exe
  C:\Windows\System\MIycAvw.exe
  2⤵
  PID:4820
- C:\Windows\System\ViXYNpM.exe
  C:\Windows\System\ViXYNpM.exe
  2⤵
  PID:4840
- C:\Windows\System\UTEimRa.exe
  C:\Windows\System\UTEimRa.exe
  2⤵
  PID:4856
- C:\Windows\System\TiRjdGl.exe
  C:\Windows\System\TiRjdGl.exe
  2⤵
  PID:4872
- C:\Windows\System\PJGFdfa.exe
  C:\Windows\System\PJGFdfa.exe
  2⤵
  PID:4888
- C:\Windows\System\lXcIuok.exe
  C:\Windows\System\lXcIuok.exe
  2⤵
  PID:4904
- C:\Windows\System\mrZRyMz.exe
  C:\Windows\System\mrZRyMz.exe
  2⤵
  PID:3500
- C:\Windows\System\DdjYPNJ.exe
  C:\Windows\System\DdjYPNJ.exe
  2⤵
  PID:296
- C:\Windows\System\YYSMgkE.exe
  C:\Windows\System\YYSMgkE.exe
  2⤵
  PID:2720
- C:\Windows\System\KEZjoYG.exe
  C:\Windows\System\KEZjoYG.exe
  2⤵
  PID:3680
- C:\Windows\System\gfhFqSc.exe
  C:\Windows\System\gfhFqSc.exe
  2⤵
  PID:4116
- C:\Windows\System\xWpsXDO.exe
  C:\Windows\System\xWpsXDO.exe
  2⤵
  PID:4184
- C:\Windows\System\rPxwXoA.exe
  C:\Windows\System\rPxwXoA.exe
  2⤵
  PID:4220
- C:\Windows\System\rzrYmXb.exe
  C:\Windows\System\rzrYmXb.exe
  2⤵
  PID:4312
- C:\Windows\System\NyAaaYh.exe
  C:\Windows\System\NyAaaYh.exe
  2⤵
  PID:4296
- C:\Windows\System\ajYCnJx.exe
  C:\Windows\System\ajYCnJx.exe
  2⤵
  PID:4380
- C:\Windows\System\HnDiQkK.exe
  C:\Windows\System\HnDiQkK.exe
  2⤵
  PID:4416
- C:\Windows\System\lYfTwJP.exe
  C:\Windows\System\lYfTwJP.exe
  2⤵
  PID:3992
- C:\Windows\System\BoNLHBd.exe
  C:\Windows\System\BoNLHBd.exe
  2⤵
  PID:4548
- C:\Windows\System\fhhdhkC.exe
  C:\Windows\System\fhhdhkC.exe
  2⤵
  PID:4500
- C:\Windows\System\NiWWVKf.exe
  C:\Windows\System\NiWWVKf.exe
  2⤵
  PID:4584
- C:\Windows\System\sYLRxnm.exe
  C:\Windows\System\sYLRxnm.exe
  2⤵
  PID:3440
- C:\Windows\System\JXRjleS.exe
  C:\Windows\System\JXRjleS.exe
  2⤵
  PID:4696
- C:\Windows\System\pYUdPUc.exe
  C:\Windows\System\pYUdPUc.exe
  2⤵
  PID:4680
- C:\Windows\System\VCgwIZG.exe
  C:\Windows\System\VCgwIZG.exe
  2⤵
  PID:2220
- C:\Windows\System\ZOCRlIK.exe
  C:\Windows\System\ZOCRlIK.exe
  2⤵
  PID:1512
- C:\Windows\System\qqUaAZy.exe
  C:\Windows\System\qqUaAZy.exe
  2⤵
  PID:3668
- C:\Windows\System\IbxUACi.exe
  C:\Windows\System\IbxUACi.exe
  2⤵
  PID:3776
- C:\Windows\System\BQEKMYx.exe
  C:\Windows\System\BQEKMYx.exe
  2⤵
  PID:3696
- C:\Windows\System\OKuSGOF.exe
  C:\Windows\System\OKuSGOF.exe
  2⤵
  PID:2900
- C:\Windows\System\UuYqMpG.exe
  C:\Windows\System\UuYqMpG.exe
  2⤵
  PID:4328
- C:\Windows\System\EaldBYf.exe
  C:\Windows\System\EaldBYf.exe
  2⤵
  PID:1604
- C:\Windows\System\BFsnknS.exe
  C:\Windows\System\BFsnknS.exe
  2⤵
  PID:4100
- C:\Windows\System\qbDjltN.exe
  C:\Windows\System\qbDjltN.exe
  2⤵
  PID:4164
- C:\Windows\System\leXtaVu.exe
  C:\Windows\System\leXtaVu.exe
  2⤵
  PID:4264
- C:\Windows\System\LpQyaeq.exe
  C:\Windows\System\LpQyaeq.exe
  2⤵
  PID:4564
- C:\Windows\System\FwOfGpB.exe
  C:\Windows\System\FwOfGpB.exe
  2⤵
  PID:4800
- C:\Windows\System\bbhYdmS.exe
  C:\Windows\System\bbhYdmS.exe
  2⤵
  PID:2236
- C:\Windows\System\VtRkNFJ.exe
  C:\Windows\System\VtRkNFJ.exe
  2⤵
  PID:5044
- C:\Windows\System\GMJXzhK.exe
  C:\Windows\System\GMJXzhK.exe
  2⤵
  PID:5028
- C:\Windows\System\oqpFdjw.exe
  C:\Windows\System\oqpFdjw.exe
  2⤵
  PID:5012
- C:\Windows\System\hMtXUyM.exe
  C:\Windows\System\hMtXUyM.exe
  2⤵
  PID:4448
- C:\Windows\System\ubuTBnu.exe
  C:\Windows\System\ubuTBnu.exe
  2⤵
  PID:5076
- C:\Windows\System\zXjPERS.exe
  C:\Windows\System\zXjPERS.exe
  2⤵
  PID:4464
- C:\Windows\System\sfbqeGE.exe
  C:\Windows\System\sfbqeGE.exe
  2⤵
  PID:5108
- C:\Windows\System\KJvzYAd.exe
  C:\Windows\System\KJvzYAd.exe
  2⤵
  PID:2216
- C:\Windows\System\gqGvIAd.exe
  C:\Windows\System\gqGvIAd.exe
  2⤵
  PID:4880
- C:\Windows\System\TBSYocE.exe
  C:\Windows\System\TBSYocE.exe
  2⤵
  PID:4864
- C:\Windows\System\dnKMzCp.exe
  C:\Windows\System\dnKMzCp.exe
  2⤵
  PID:4816
- C:\Windows\System\LTIWEsS.exe
  C:\Windows\System\LTIWEsS.exe
  2⤵
  PID:4884
- C:\Windows\System\nRjftCY.exe
  C:\Windows\System\nRjftCY.exe
  2⤵
  PID:2724
- C:\Windows\System\BpLrOWh.exe
  C:\Windows\System\BpLrOWh.exe
  2⤵
  PID:2796
- C:\Windows\System\EmMMtFD.exe
  C:\Windows\System\EmMMtFD.exe
  2⤵
  PID:2964
- C:\Windows\System\HJeghhx.exe
  C:\Windows\System\HJeghhx.exe
  2⤵
  PID:3996
- C:\Windows\System\xBaaMkG.exe
  C:\Windows\System\xBaaMkG.exe
  2⤵
  PID:2248
- C:\Windows\System\CZgAyPM.exe
  C:\Windows\System\CZgAyPM.exe
  2⤵
  PID:2224
- C:\Windows\System\ubkTWWZ.exe
  C:\Windows\System\ubkTWWZ.exe
  2⤵
  PID:4212
- C:\Windows\System\bDxMvtd.exe
  C:\Windows\System\bDxMvtd.exe
  2⤵
  PID:4268
- C:\Windows\System\rbcLkza.exe
  C:\Windows\System\rbcLkza.exe
  2⤵
  PID:4452
- C:\Windows\System\pOGspEV.exe
  C:\Windows\System\pOGspEV.exe
  2⤵
  PID:4712
- C:\Windows\System\pcJZcFI.exe
  C:\Windows\System\pcJZcFI.exe
  2⤵
  PID:4948
- C:\Windows\System\LhRtRBq.exe
  C:\Windows\System\LhRtRBq.exe
  2⤵
  PID:4976
- C:\Windows\System\ldMkAvp.exe
  C:\Windows\System\ldMkAvp.exe
  2⤵
  PID:3476
- C:\Windows\System\gvnRGqD.exe
  C:\Windows\System\gvnRGqD.exe
  2⤵
  PID:1896
- C:\Windows\System\ZToZTFc.exe
  C:\Windows\System\ZToZTFc.exe
  2⤵
  PID:4136
- C:\Windows\System\ZuuImdV.exe
  C:\Windows\System\ZuuImdV.exe
  2⤵
  PID:4152
- C:\Windows\System\jMWbTSO.exe
  C:\Windows\System\jMWbTSO.exe
  2⤵
  PID:4812
- C:\Windows\System\Jtbimtl.exe
  C:\Windows\System\Jtbimtl.exe
  2⤵
  PID:4648
- C:\Windows\System\lMEOSIV.exe
  C:\Windows\System\lMEOSIV.exe
  2⤵
  PID:5116
- C:\Windows\System\oUGeYPW.exe
  C:\Windows\System\oUGeYPW.exe
  2⤵
  PID:4896
- C:\Windows\System\ElsfpDC.exe
  C:\Windows\System\ElsfpDC.exe
  2⤵
  PID:2280
- C:\Windows\System\lhtYMku.exe
  C:\Windows\System\lhtYMku.exe
  2⤵
  PID:2744
- C:\Windows\System\LIhCwnr.exe
  C:\Windows\System\LIhCwnr.exe
  2⤵
  PID:5104
- C:\Windows\System\XYhXcfX.exe
  C:\Windows\System\XYhXcfX.exe
  2⤵
  PID:4828
- C:\Windows\System\gDEyFSj.exe
  C:\Windows\System\gDEyFSj.exe
  2⤵
  PID:1696
- C:\Windows\System\mzEnlhL.exe
  C:\Windows\System\mzEnlhL.exe
  2⤵
  PID:4912
- C:\Windows\System\ZpNpENU.exe
  C:\Windows\System\ZpNpENU.exe
  2⤵
  PID:4516
- C:\Windows\System\IqvFuEi.exe
  C:\Windows\System\IqvFuEi.exe
  2⤵
  PID:4496
- C:\Windows\System\RKWmwzW.exe
  C:\Windows\System\RKWmwzW.exe
  2⤵
  PID:4936
- C:\Windows\System\YiVEshr.exe
  C:\Windows\System\YiVEshr.exe
  2⤵
  PID:4568
- C:\Windows\System\yvMDbev.exe
  C:\Windows\System\yvMDbev.exe
  2⤵
  PID:2196
- C:\Windows\System\SaHSoiI.exe
  C:\Windows\System\SaHSoiI.exe
  2⤵
  PID:4984
- C:\Windows\System\QrOZDwI.exe
  C:\Windows\System\QrOZDwI.exe
  2⤵
  PID:5092
- C:\Windows\System\ULztarh.exe
  C:\Windows\System\ULztarh.exe
  2⤵
  PID:1352
- C:\Windows\System\LGfTEDu.exe
  C:\Windows\System\LGfTEDu.exe
  2⤵
  PID:2372
- C:\Windows\System\ciqwVlz.exe
  C:\Windows\System\ciqwVlz.exe
  2⤵
  PID:5096
- C:\Windows\System\xJvgkpH.exe
  C:\Windows\System\xJvgkpH.exe
  2⤵
  PID:4600
- C:\Windows\System\XCfMZuh.exe
  C:\Windows\System\XCfMZuh.exe
  2⤵
  PID:4632
- C:\Windows\System\KDRruZP.exe
  C:\Windows\System\KDRruZP.exe
  2⤵
  PID:5036
- C:\Windows\System\WWYBZsG.exe
  C:\Windows\System\WWYBZsG.exe
  2⤵
  PID:4868
- C:\Windows\System\eOxnESN.exe
  C:\Windows\System\eOxnESN.exe
  2⤵
  PID:5032
- C:\Windows\System\PvhjRbf.exe
  C:\Windows\System\PvhjRbf.exe
  2⤵
  PID:2312
- C:\Windows\System\KdRGLmp.exe
  C:\Windows\System\KdRGLmp.exe
  2⤵
  PID:4764
- C:\Windows\System\ulRKXXB.exe
  C:\Windows\System\ulRKXXB.exe
  2⤵
  PID:4252
- C:\Windows\System\uuTYVLD.exe
  C:\Windows\System\uuTYVLD.exe
  2⤵
  PID:752
- C:\Windows\System\RdUtfUl.exe
  C:\Windows\System\RdUtfUl.exe
  2⤵
  PID:4732
- C:\Windows\System\deiFIPU.exe
  C:\Windows\System\deiFIPU.exe
  2⤵
  PID:4348
- C:\Windows\System\oQfHiao.exe
  C:\Windows\System\oQfHiao.exe
  2⤵
  PID:4368
- C:\Windows\System\CDzbcgy.exe
  C:\Windows\System\CDzbcgy.exe
  2⤵
  PID:5132
- C:\Windows\System\IrapmCA.exe
  C:\Windows\System\IrapmCA.exe
  2⤵
  PID:5148
- C:\Windows\System\xeGrTka.exe
  C:\Windows\System\xeGrTka.exe
  2⤵
  PID:5164
- C:\Windows\System\ySCjWEe.exe
  C:\Windows\System\ySCjWEe.exe
  2⤵
  PID:5180
- C:\Windows\System\FVcYbnI.exe
  C:\Windows\System\FVcYbnI.exe
  2⤵
  PID:5196
- C:\Windows\System\yhpGPBo.exe
  C:\Windows\System\yhpGPBo.exe
  2⤵
  PID:5212
- C:\Windows\System\LNdrMWL.exe
  C:\Windows\System\LNdrMWL.exe
  2⤵
  PID:5228
- C:\Windows\System\dykjhCP.exe
  C:\Windows\System\dykjhCP.exe
  2⤵
  PID:5244
- C:\Windows\System\sTxNiFN.exe
  C:\Windows\System\sTxNiFN.exe
  2⤵
  PID:5260
- C:\Windows\System\JjAXCcY.exe
  C:\Windows\System\JjAXCcY.exe
  2⤵
  PID:5276
- C:\Windows\System\RFuUnwb.exe
  C:\Windows\System\RFuUnwb.exe
  2⤵
  PID:5292
- C:\Windows\System\BlpuxyF.exe
  C:\Windows\System\BlpuxyF.exe
  2⤵
  PID:5308
- C:\Windows\System\EakYKKa.exe
  C:\Windows\System\EakYKKa.exe
  2⤵
  PID:5324
- C:\Windows\System\llHIdrZ.exe
  C:\Windows\System\llHIdrZ.exe
  2⤵
  PID:5340
- C:\Windows\System\KvptssY.exe
  C:\Windows\System\KvptssY.exe
  2⤵
  PID:5356
- C:\Windows\System\DIbRNqk.exe
  C:\Windows\System\DIbRNqk.exe
  2⤵
  PID:5372
- C:\Windows\System\zQvDUXJ.exe
  C:\Windows\System\zQvDUXJ.exe
  2⤵
  PID:5388
- C:\Windows\System\moMxezJ.exe
  C:\Windows\System\moMxezJ.exe
  2⤵
  PID:5404
- C:\Windows\System\YCXkLAw.exe
  C:\Windows\System\YCXkLAw.exe
  2⤵
  PID:5420
- C:\Windows\System\gmIEwvb.exe
  C:\Windows\System\gmIEwvb.exe
  2⤵
  PID:5436
- C:\Windows\System\UyeFENQ.exe
  C:\Windows\System\UyeFENQ.exe
  2⤵
  PID:5452
- C:\Windows\System\DNIVbpt.exe
  C:\Windows\System\DNIVbpt.exe
  2⤵
  PID:5468
- C:\Windows\System\MywkZLD.exe
  C:\Windows\System\MywkZLD.exe
  2⤵
  PID:5484
- C:\Windows\System\EyNWxDq.exe
  C:\Windows\System\EyNWxDq.exe
  2⤵
  PID:5500
- C:\Windows\System\vUlFHGv.exe
  C:\Windows\System\vUlFHGv.exe
  2⤵
  PID:5516
- C:\Windows\System\aiheHgT.exe
  C:\Windows\System\aiheHgT.exe
  2⤵
  PID:5532
- C:\Windows\System\kzeusiS.exe
  C:\Windows\System\kzeusiS.exe
  2⤵
  PID:5548
- C:\Windows\System\cJFSGpA.exe
  C:\Windows\System\cJFSGpA.exe
  2⤵
  PID:5564
- C:\Windows\System\YedNCEu.exe
  C:\Windows\System\YedNCEu.exe
  2⤵
  PID:5580
- C:\Windows\System\kBXhgVW.exe
  C:\Windows\System\kBXhgVW.exe
  2⤵
  PID:5596
- C:\Windows\System\EmlRvxi.exe
  C:\Windows\System\EmlRvxi.exe
  2⤵
  PID:5612
- C:\Windows\System\zAfuSux.exe
  C:\Windows\System\zAfuSux.exe
  2⤵
  PID:5628
- C:\Windows\System\SSQJthS.exe
  C:\Windows\System\SSQJthS.exe
  2⤵
  PID:5644
- C:\Windows\System\ovdgsrb.exe
  C:\Windows\System\ovdgsrb.exe
  2⤵
  PID:5660
- C:\Windows\System\WbMMhJn.exe
  C:\Windows\System\WbMMhJn.exe
  2⤵
  PID:5676
- C:\Windows\System\NKioMkY.exe
  C:\Windows\System\NKioMkY.exe
  2⤵
  PID:5696
- C:\Windows\System\bwsjXNM.exe
  C:\Windows\System\bwsjXNM.exe
  2⤵
  PID:5712
- C:\Windows\System\UtSHkBW.exe
  C:\Windows\System\UtSHkBW.exe
  2⤵
  PID:5728
- C:\Windows\System\QqWnStn.exe
  C:\Windows\System\QqWnStn.exe
  2⤵
  PID:5744
- C:\Windows\System\rcPcKdD.exe
  C:\Windows\System\rcPcKdD.exe
  2⤵
  PID:5760
- C:\Windows\System\kFnXMcz.exe
  C:\Windows\System\kFnXMcz.exe
  2⤵
  PID:5840
- C:\Windows\System\ZUoFXxh.exe
  C:\Windows\System\ZUoFXxh.exe
  2⤵
  PID:5856
- C:\Windows\System\cvmmaTF.exe
  C:\Windows\System\cvmmaTF.exe
  2⤵
  PID:5872
- C:\Windows\System\jvvNncG.exe
  C:\Windows\System\jvvNncG.exe
  2⤵
  PID:5892
- C:\Windows\System\NPQFvLw.exe
  C:\Windows\System\NPQFvLw.exe
  2⤵
  PID:5908
- C:\Windows\System\qrKKoDr.exe
  C:\Windows\System\qrKKoDr.exe
  2⤵
  PID:5940
- C:\Windows\System\xvJGtZe.exe
  C:\Windows\System\xvJGtZe.exe
  2⤵
  PID:5956
- C:\Windows\System\hfraxsQ.exe
  C:\Windows\System\hfraxsQ.exe
  2⤵
  PID:5972
- C:\Windows\System\sTYrfPU.exe
  C:\Windows\System\sTYrfPU.exe
  2⤵
  PID:5988
- C:\Windows\System\KJIelcz.exe
  C:\Windows\System\KJIelcz.exe
  2⤵
  PID:6004
- C:\Windows\System\ArMBMZn.exe
  C:\Windows\System\ArMBMZn.exe
  2⤵
  PID:6020
- C:\Windows\System\TqIKjji.exe
  C:\Windows\System\TqIKjji.exe
  2⤵
  PID:6036
- C:\Windows\System\SpMjlGH.exe
  C:\Windows\System\SpMjlGH.exe
  2⤵
  PID:6052
- C:\Windows\System\KBYBGUk.exe
  C:\Windows\System\KBYBGUk.exe
  2⤵
  PID:6068
- C:\Windows\System\uslrkSG.exe
  C:\Windows\System\uslrkSG.exe
  2⤵
  PID:6084
- C:\Windows\System\YmvJlVr.exe
  C:\Windows\System\YmvJlVr.exe
  2⤵
  PID:6100
- C:\Windows\System\jKeRSsT.exe
  C:\Windows\System\jKeRSsT.exe
  2⤵
  PID:6116
- C:\Windows\System\wrbxnpY.exe
  C:\Windows\System\wrbxnpY.exe
  2⤵
  PID:6132
- C:\Windows\System\wcMLkMF.exe
  C:\Windows\System\wcMLkMF.exe
  2⤵
  PID:3888
- C:\Windows\System\zxTAgJr.exe
  C:\Windows\System\zxTAgJr.exe
  2⤵
  PID:3628
- C:\Windows\System\OtHnJLI.exe
  C:\Windows\System\OtHnJLI.exe
  2⤵
  PID:4396
- C:\Windows\System\aNYwXKt.exe
  C:\Windows\System\aNYwXKt.exe
  2⤵
  PID:360
- C:\Windows\System\QVyJNgt.exe
  C:\Windows\System\QVyJNgt.exe
  2⤵
  PID:4924
- C:\Windows\System\ZmdKmHG.exe
  C:\Windows\System\ZmdKmHG.exe
  2⤵
  PID:5160
- C:\Windows\System\VanWXhx.exe
  C:\Windows\System\VanWXhx.exe
  2⤵
  PID:5224
- C:\Windows\System\YLsHvDv.exe
  C:\Windows\System\YLsHvDv.exe
  2⤵
  PID:4668
- C:\Windows\System\QDFTBAk.exe
  C:\Windows\System\QDFTBAk.exe
  2⤵
  PID:3800
- C:\Windows\System\YzXIkNe.exe
  C:\Windows\System\YzXIkNe.exe
  2⤵
  PID:5252
- C:\Windows\System\nYFoIeN.exe
  C:\Windows\System\nYFoIeN.exe
  2⤵
  PID:5352
- C:\Windows\System\HxYSHmi.exe
  C:\Windows\System\HxYSHmi.exe
  2⤵
  PID:5444
- C:\Windows\System\xBGLRPU.exe
  C:\Windows\System\xBGLRPU.exe
  2⤵
  PID:5140
- C:\Windows\System\WsKeJDr.exe
  C:\Windows\System\WsKeJDr.exe
  2⤵
  PID:5304
- C:\Windows\System\VzZBIqi.exe
  C:\Windows\System\VzZBIqi.exe
  2⤵
  PID:5476
- C:\Windows\System\IVSRtOS.exe
  C:\Windows\System\IVSRtOS.exe
  2⤵
  PID:5572
- C:\Windows\System\juIxtHD.exe
  C:\Windows\System\juIxtHD.exe
  2⤵
  PID:5528
- C:\Windows\System\vPLggDs.exe
  C:\Windows\System\vPLggDs.exe
  2⤵
  PID:5640
- C:\Windows\System\RRBtkos.exe
  C:\Windows\System\RRBtkos.exe
  2⤵
  PID:5492
- C:\Windows\System\khMFTrq.exe
  C:\Windows\System\khMFTrq.exe
  2⤵
  PID:5624
- C:\Windows\System\BzJFaNG.exe
  C:\Windows\System\BzJFaNG.exe
  2⤵
  PID:5688
- C:\Windows\System\MVEcONe.exe
  C:\Windows\System\MVEcONe.exe
  2⤵
  PID:5736
- C:\Windows\System\OxrqRAR.exe
  C:\Windows\System\OxrqRAR.exe
  2⤵
  PID:5752
- C:\Windows\System\SFOhPKT.exe
  C:\Windows\System\SFOhPKT.exe
  2⤵
  PID:5772
- C:\Windows\System\OBQQIkN.exe
  C:\Windows\System\OBQQIkN.exe
  2⤵
  PID:5792
- C:\Windows\System\wlqqtJQ.exe
  C:\Windows\System\wlqqtJQ.exe
  2⤵
  PID:5796
- C:\Windows\System\QJZodQm.exe
  C:\Windows\System\QJZodQm.exe
  2⤵
  PID:4848
- C:\Windows\System\JkndkEL.exe
  C:\Windows\System\JkndkEL.exe
  2⤵
  PID:5820
- C:\Windows\System\PycfaTg.exe
  C:\Windows\System\PycfaTg.exe
  2⤵
  PID:5932
- C:\Windows\System\yLDHTSL.exe
  C:\Windows\System\yLDHTSL.exe
  2⤵
  PID:5836
- C:\Windows\System\eXGygMN.exe
  C:\Windows\System\eXGygMN.exe
  2⤵
  PID:5868
- C:\Windows\System\UGxhygK.exe
  C:\Windows\System\UGxhygK.exe
  2⤵
  PID:5952
- C:\Windows\System\NVymhRU.exe
  C:\Windows\System\NVymhRU.exe
  2⤵
  PID:5984
- C:\Windows\System\GlpRccO.exe
  C:\Windows\System\GlpRccO.exe
  2⤵
  PID:6080
- C:\Windows\System\RThuIbL.exe
  C:\Windows\System\RThuIbL.exe
  2⤵
  PID:6112
- C:\Windows\System\zmeNdWT.exe
  C:\Windows\System\zmeNdWT.exe
  2⤵
  PID:3908
- C:\Windows\System\uGrupcu.exe
  C:\Windows\System\uGrupcu.exe
  2⤵
  PID:5192
- C:\Windows\System\vNiJFkp.exe
  C:\Windows\System\vNiJFkp.exe
  2⤵
  PID:5348
- C:\Windows\System\MGySKvI.exe
  C:\Windows\System\MGySKvI.exe
  2⤵
  PID:3436
- C:\Windows\System\KNjJgDb.exe
  C:\Windows\System\KNjJgDb.exe
  2⤵
  PID:6092
- C:\Windows\System\ZulOhTW.exe
  C:\Windows\System\ZulOhTW.exe
  2⤵
  PID:6000
- C:\Windows\System\htIwZho.exe
  C:\Windows\System\htIwZho.exe
  2⤵
  PID:4900
- C:\Windows\System\IDzPwlu.exe
  C:\Windows\System\IDzPwlu.exe
  2⤵
  PID:5256
- C:\Windows\System\QhrrPPq.exe
  C:\Windows\System\QhrrPPq.exe
  2⤵
  PID:4780
- C:\Windows\System\gdHyxOx.exe
  C:\Windows\System\gdHyxOx.exe
  2⤵
  PID:3684
- C:\Windows\System\xfAKsZz.exe
  C:\Windows\System\xfAKsZz.exe
  2⤵
  PID:5480
- C:\Windows\System\mQrWRpt.exe
  C:\Windows\System\mQrWRpt.exe
  2⤵
  PID:5300
- C:\Windows\System\PuQsUdi.exe
  C:\Windows\System\PuQsUdi.exe
  2⤵
  PID:5496
- C:\Windows\System\RMFYvXY.exe
  C:\Windows\System\RMFYvXY.exe
  2⤵
  PID:5400
- C:\Windows\System\BJgjyTI.exe
  C:\Windows\System\BJgjyTI.exe
  2⤵
  PID:5540
- C:\Windows\System\AfgIPQf.exe
  C:\Windows\System\AfgIPQf.exe
  2⤵
  PID:5004
- C:\Windows\System\yhBRvOh.exe
  C:\Windows\System\yhBRvOh.exe
  2⤵
  PID:5176
- C:\Windows\System\hAHzoMr.exe
  C:\Windows\System\hAHzoMr.exe
  2⤵
  PID:5268
- C:\Windows\System\FaaNxsx.exe
  C:\Windows\System\FaaNxsx.exe
  2⤵
  PID:5428
- C:\Windows\System\XgLKBNL.exe
  C:\Windows\System\XgLKBNL.exe
  2⤵
  PID:5740
- C:\Windows\System\MgpKxPr.exe
  C:\Windows\System\MgpKxPr.exe
  2⤵
  PID:5788
- C:\Windows\System\KTlfHHR.exe
  C:\Windows\System\KTlfHHR.exe
  2⤵
  PID:5724
- C:\Windows\System\BDevLdA.exe
  C:\Windows\System\BDevLdA.exe
  2⤵
  PID:1756
- C:\Windows\System\xMsKJBU.exe
  C:\Windows\System\xMsKJBU.exe
  2⤵
  PID:5928
- C:\Windows\System\vMAKGfh.exe
  C:\Windows\System\vMAKGfh.exe
  2⤵
  PID:4216
- C:\Windows\System\yzVpoCo.exe
  C:\Windows\System\yzVpoCo.exe
  2⤵
  PID:6060
- C:\Windows\System\DpxAgCg.exe
  C:\Windows\System\DpxAgCg.exe
  2⤵
  PID:5832
- C:\Windows\System\TbzgNmT.exe
  C:\Windows\System\TbzgNmT.exe
  2⤵
  PID:5884
- C:\Windows\System\xkpijnv.exe
  C:\Windows\System\xkpijnv.exe
  2⤵
  PID:4532
- C:\Windows\System\DlRvkvF.exe
  C:\Windows\System\DlRvkvF.exe
  2⤵
  PID:5320
- C:\Windows\System\wWeUrhA.exe
  C:\Windows\System\wWeUrhA.exe
  2⤵
  PID:4996
- C:\Windows\System\sDCToIm.exe
  C:\Windows\System\sDCToIm.exe
  2⤵
  PID:5172
- C:\Windows\System\iYWaSlC.exe
  C:\Windows\System\iYWaSlC.exe
  2⤵
  PID:5124
- C:\Windows\System\GJmXjhJ.exe
  C:\Windows\System\GJmXjhJ.exe
  2⤵
  PID:404
- C:\Windows\System\EOuIVGY.exe
  C:\Windows\System\EOuIVGY.exe
  2⤵
  PID:5784
- C:\Windows\System\nmMQAtT.exe
  C:\Windows\System\nmMQAtT.exe
  2⤵
  PID:5396
- C:\Windows\System\spLLurF.exe
  C:\Windows\System\spLLurF.exe
  2⤵
  PID:5980
- C:\Windows\System\LnajxVT.exe
  C:\Windows\System\LnajxVT.exe
  2⤵
  PID:3716
- C:\Windows\System\HslQYJv.exe
  C:\Windows\System\HslQYJv.exe
  2⤵
  PID:4972
- C:\Windows\System\SeFQiKl.exe
  C:\Windows\System\SeFQiKl.exe
  2⤵
  PID:5464
- C:\Windows\System\CYWCGJs.exe
  C:\Windows\System\CYWCGJs.exe
  2⤵
  PID:5240
- C:\Windows\System\vyEhXsf.exe
  C:\Windows\System\vyEhXsf.exe
  2⤵
  PID:5720
- C:\Windows\System\MBOiAtv.exe
  C:\Windows\System\MBOiAtv.exe
  2⤵
  PID:4520
- C:\Windows\System\BRCzMre.exe
  C:\Windows\System\BRCzMre.exe
  2⤵
  PID:2584
- C:\Windows\System\mTZizrF.exe
  C:\Windows\System\mTZizrF.exe
  2⤵
  PID:5776
- C:\Windows\System\enpyyDQ.exe
  C:\Windows\System\enpyyDQ.exe
  2⤵
  PID:5524
- C:\Windows\System\JtKzobp.exe
  C:\Windows\System\JtKzobp.exe
  2⤵
  PID:3396
- C:\Windows\System\drQGJwr.exe
  C:\Windows\System\drQGJwr.exe
  2⤵
  PID:5852
- C:\Windows\System\UrSlcNM.exe
  C:\Windows\System\UrSlcNM.exe
  2⤵
  PID:6148
- C:\Windows\System\sZVrWuf.exe
  C:\Windows\System\sZVrWuf.exe
  2⤵
  PID:6164
- C:\Windows\System\vAFsOxx.exe
  C:\Windows\System\vAFsOxx.exe
  2⤵
  PID:6180
- C:\Windows\System\WqQfQgv.exe
  C:\Windows\System\WqQfQgv.exe
  2⤵
  PID:6196
- C:\Windows\System\VWsUqCF.exe
  C:\Windows\System\VWsUqCF.exe
  2⤵
  PID:6212
- C:\Windows\System\xzgQURT.exe
  C:\Windows\System\xzgQURT.exe
  2⤵
  PID:6228
- C:\Windows\System\NNFmcWA.exe
  C:\Windows\System\NNFmcWA.exe
  2⤵
  PID:6244
- C:\Windows\System\tomUZLd.exe
  C:\Windows\System\tomUZLd.exe
  2⤵
  PID:6260
- C:\Windows\System\cVMKQUm.exe
  C:\Windows\System\cVMKQUm.exe
  2⤵
  PID:6276
- C:\Windows\System\RshwxPP.exe
  C:\Windows\System\RshwxPP.exe
  2⤵
  PID:6292
- C:\Windows\System\yIsFYyg.exe
  C:\Windows\System\yIsFYyg.exe
  2⤵
  PID:6308
- C:\Windows\System\gLXYyun.exe
  C:\Windows\System\gLXYyun.exe
  2⤵
  PID:6324
- C:\Windows\System\IcWfGaB.exe
  C:\Windows\System\IcWfGaB.exe
  2⤵
  PID:6340
- C:\Windows\System\PWImZEn.exe
  C:\Windows\System\PWImZEn.exe
  2⤵
  PID:6356
- C:\Windows\System\zLSOvya.exe
  C:\Windows\System\zLSOvya.exe
  2⤵
  PID:6372
- C:\Windows\System\UXzstnt.exe
  C:\Windows\System\UXzstnt.exe
  2⤵
  PID:6388
- C:\Windows\System\XGviKUQ.exe
  C:\Windows\System\XGviKUQ.exe
  2⤵
  PID:6404
- C:\Windows\System\kDOBQyu.exe
  C:\Windows\System\kDOBQyu.exe
  2⤵
  PID:6420
- C:\Windows\System\kVEjBXK.exe
  C:\Windows\System\kVEjBXK.exe
  2⤵
  PID:6436
- C:\Windows\System\eLZEEdt.exe
  C:\Windows\System\eLZEEdt.exe
  2⤵
  PID:6452
- C:\Windows\System\XxPUmDO.exe
  C:\Windows\System\XxPUmDO.exe
  2⤵
  PID:6468
- C:\Windows\System\GEuxzvh.exe
  C:\Windows\System\GEuxzvh.exe
  2⤵
  PID:6484
- C:\Windows\System\pJmfAFL.exe
  C:\Windows\System\pJmfAFL.exe
  2⤵
  PID:6500
- C:\Windows\System\SIkkhiy.exe
  C:\Windows\System\SIkkhiy.exe
  2⤵
  PID:6516
- C:\Windows\System\yvFHWav.exe
  C:\Windows\System\yvFHWav.exe
  2⤵
  PID:6536
- C:\Windows\System\cNtoaya.exe
  C:\Windows\System\cNtoaya.exe
  2⤵
  PID:6552
- C:\Windows\System\YBAflJM.exe
  C:\Windows\System\YBAflJM.exe
  2⤵
  PID:6568
- C:\Windows\System\pgwDHVG.exe
  C:\Windows\System\pgwDHVG.exe
  2⤵
  PID:6584
- C:\Windows\System\xJxCmHF.exe
  C:\Windows\System\xJxCmHF.exe
  2⤵
  PID:6600
- C:\Windows\System\vHnFcoP.exe
  C:\Windows\System\vHnFcoP.exe
  2⤵
  PID:6616
- C:\Windows\System\bkNcPZc.exe
  C:\Windows\System\bkNcPZc.exe
  2⤵
  PID:6632
- C:\Windows\System\QXXciee.exe
  C:\Windows\System\QXXciee.exe
  2⤵
  PID:6648
- C:\Windows\System\zljnSiX.exe
  C:\Windows\System\zljnSiX.exe
  2⤵
  PID:6664
- C:\Windows\System\QOGaImP.exe
  C:\Windows\System\QOGaImP.exe
  2⤵
  PID:6684
- C:\Windows\System\zhINVUq.exe
  C:\Windows\System\zhINVUq.exe
  2⤵
  PID:6700
- C:\Windows\System\qGGZZXJ.exe
  C:\Windows\System\qGGZZXJ.exe
  2⤵
  PID:6716
- C:\Windows\System\BUkbjqZ.exe
  C:\Windows\System\BUkbjqZ.exe
  2⤵
  PID:6732
- C:\Windows\System\ufIddzc.exe
  C:\Windows\System\ufIddzc.exe
  2⤵
  PID:6748
- C:\Windows\System\zOVSEFF.exe
  C:\Windows\System\zOVSEFF.exe
  2⤵
  PID:6764
- C:\Windows\System\dODdlZt.exe
  C:\Windows\System\dODdlZt.exe
  2⤵
  PID:6780
- C:\Windows\System\NxHraMC.exe
  C:\Windows\System\NxHraMC.exe
  2⤵
  PID:6796
- C:\Windows\System\GYGNNdh.exe
  C:\Windows\System\GYGNNdh.exe
  2⤵
  PID:6812
- C:\Windows\System\PPdYnZy.exe
  C:\Windows\System\PPdYnZy.exe
  2⤵
  PID:6828
- C:\Windows\System\YGFKWfl.exe
  C:\Windows\System\YGFKWfl.exe
  2⤵
  PID:6844
- C:\Windows\System\urQpwzM.exe
  C:\Windows\System\urQpwzM.exe
  2⤵
  PID:6860
- C:\Windows\System\MSxYYHO.exe
  C:\Windows\System\MSxYYHO.exe
  2⤵
  PID:6876
- C:\Windows\System\hAGezdv.exe
  C:\Windows\System\hAGezdv.exe
  2⤵
  PID:6892
- C:\Windows\System\chfKjfw.exe
  C:\Windows\System\chfKjfw.exe
  2⤵
  PID:6912
- C:\Windows\System\KuDVduX.exe
  C:\Windows\System\KuDVduX.exe
  2⤵
  PID:6928
- C:\Windows\System\oLDEbUc.exe
  C:\Windows\System\oLDEbUc.exe
  2⤵
  PID:6944
- C:\Windows\System\EuBCkFo.exe
  C:\Windows\System\EuBCkFo.exe
  2⤵
  PID:6960
- C:\Windows\System\djxjPkD.exe
  C:\Windows\System\djxjPkD.exe
  2⤵
  PID:6976
- C:\Windows\System\jzaFOTt.exe
  C:\Windows\System\jzaFOTt.exe
  2⤵
  PID:6992
- C:\Windows\System\hjanGjL.exe
  C:\Windows\System\hjanGjL.exe
  2⤵
  PID:7012
- C:\Windows\System\VXXtCok.exe
  C:\Windows\System\VXXtCok.exe
  2⤵
  PID:7028
- C:\Windows\System\HjDVaPv.exe
  C:\Windows\System\HjDVaPv.exe
  2⤵
  PID:7136
- C:\Windows\System\jmOmFNv.exe
  C:\Windows\System\jmOmFNv.exe
  2⤵
  PID:7152
- C:\Windows\System\NYiKDAR.exe
  C:\Windows\System\NYiKDAR.exe
  2⤵
  PID:5384
- C:\Windows\System\YkBOnwY.exe
  C:\Windows\System\YkBOnwY.exe
  2⤵
  PID:6160
- C:\Windows\System\BYXjVzo.exe
  C:\Windows\System\BYXjVzo.exe
  2⤵
  PID:6284
- C:\Windows\System\nDUIdDg.exe
  C:\Windows\System\nDUIdDg.exe
  2⤵
  PID:5560
- C:\Windows\System\wyognFx.exe
  C:\Windows\System\wyognFx.exe
  2⤵
  PID:6316
- C:\Windows\System\zRKxFXt.exe
  C:\Windows\System\zRKxFXt.exe
  2⤵
  PID:6176
- C:\Windows\System\pMqsiQK.exe
  C:\Windows\System\pMqsiQK.exe
  2⤵
  PID:6380
- C:\Windows\System\axraUgu.exe
  C:\Windows\System\axraUgu.exe
  2⤵
  PID:5512
- C:\Windows\System\TkeTfZS.exe
  C:\Windows\System\TkeTfZS.exe
  2⤵
  PID:6268
- C:\Windows\System\AyATCuw.exe
  C:\Windows\System\AyATCuw.exe
  2⤵
  PID:6332
- C:\Windows\System\dtlSgLA.exe
  C:\Windows\System\dtlSgLA.exe
  2⤵
  PID:6396
- C:\Windows\System\RZGMHUN.exe
  C:\Windows\System\RZGMHUN.exe
  2⤵
  PID:6412
- C:\Windows\System\eIixNgW.exe
  C:\Windows\System\eIixNgW.exe
  2⤵
  PID:6480
- C:\Windows\System\gSAcsqe.exe
  C:\Windows\System\gSAcsqe.exe
  2⤵
  PID:6580
- C:\Windows\System\huODUwZ.exe
  C:\Windows\System\huODUwZ.exe
  2⤵
  PID:6640
- C:\Windows\System\mmYDkJl.exe
  C:\Windows\System\mmYDkJl.exe
  2⤵
  PID:6428
- C:\Windows\System\SnKPRtt.exe
  C:\Windows\System\SnKPRtt.exe
  2⤵
  PID:6460
- C:\Windows\System\sHEHlMn.exe
  C:\Windows\System\sHEHlMn.exe
  2⤵
  PID:6492
- C:\Windows\System\ysCVVWH.exe
  C:\Windows\System\ysCVVWH.exe
  2⤵
  PID:6532
- C:\Windows\System\ZXcEZwS.exe
  C:\Windows\System\ZXcEZwS.exe
  2⤵
  PID:6592
- C:\Windows\System\ruhfodv.exe
  C:\Windows\System\ruhfodv.exe
  2⤵
  PID:6656
- C:\Windows\System\XeQBofE.exe
  C:\Windows\System\XeQBofE.exe
  2⤵
  PID:6724
- C:\Windows\System\QOPJikn.exe
  C:\Windows\System\QOPJikn.exe
  2⤵
  PID:6788
- C:\Windows\System\ViTLGnF.exe
  C:\Windows\System\ViTLGnF.exe
  2⤵
  PID:6804
- C:\Windows\System\qZRjJHA.exe
  C:\Windows\System\qZRjJHA.exe
  2⤵
  PID:6856
- C:\Windows\System\PJNeDEg.exe
  C:\Windows\System\PJNeDEg.exe
  2⤵
  PID:6872
- C:\Windows\System\oxddfNl.exe
  C:\Windows\System\oxddfNl.exe
  2⤵
  PID:6952
- C:\Windows\System\UeyRtSU.exe
  C:\Windows\System\UeyRtSU.exe
  2⤵
  PID:7020
- C:\Windows\System\kYFPCzJ.exe
  C:\Windows\System\kYFPCzJ.exe
  2⤵
  PID:6936
- C:\Windows\System\xXAPpwx.exe
  C:\Windows\System\xXAPpwx.exe
  2⤵
  PID:7000
- C:\Windows\System\ltrwFbN.exe
  C:\Windows\System\ltrwFbN.exe
  2⤵
  PID:7036
- C:\Windows\System\CNDTNCM.exe
  C:\Windows\System\CNDTNCM.exe
  2⤵
  PID:7052
- C:\Windows\System\zWsPtFd.exe
  C:\Windows\System\zWsPtFd.exe
  2⤵
  PID:7068
- C:\Windows\System\JeeVqXJ.exe
  C:\Windows\System\JeeVqXJ.exe
  2⤵
  PID:7084
- C:\Windows\System\PluGkQO.exe
  C:\Windows\System\PluGkQO.exe
  2⤵
  PID:7100
- C:\Windows\System\CxrhlRu.exe
  C:\Windows\System\CxrhlRu.exe
  2⤵
  PID:7116
- C:\Windows\System\MGIzFyO.exe
  C:\Windows\System\MGIzFyO.exe
  2⤵
  PID:7128
- C:\Windows\System\sMTLKGw.exe
  C:\Windows\System\sMTLKGw.exe
  2⤵
  PID:6352
- C:\Windows\System\ViAjlGl.exe
  C:\Windows\System\ViAjlGl.exe
  2⤵
  PID:6048
- C:\Windows\System\KYQWgPK.exe
  C:\Windows\System\KYQWgPK.exe
  2⤵
  PID:6416
- C:\Windows\System\TGmzaPe.exe
  C:\Windows\System\TGmzaPe.exe
  2⤵
  PID:6192
- C:\Windows\System\fHAoFmg.exe
  C:\Windows\System\fHAoFmg.exe
  2⤵
  PID:6740
- C:\Windows\System\JSutWbd.exe
  C:\Windows\System\JSutWbd.exe
  2⤵
  PID:6696
- C:\Windows\System\jpTbjMK.exe
  C:\Windows\System\jpTbjMK.exe
  2⤵
  PID:6220
- C:\Windows\System\IWuvLsr.exe
  C:\Windows\System\IWuvLsr.exe
  2⤵
  PID:6076
- C:\Windows\System\VVZgfVR.exe
  C:\Windows\System\VVZgfVR.exe
  2⤵
  PID:7160
- C:\Windows\System\zoABADX.exe
  C:\Windows\System\zoABADX.exe
  2⤵
  PID:6760
- C:\Windows\System\Btowaqv.exe
  C:\Windows\System\Btowaqv.exe
  2⤵
  PID:6908
- C:\Windows\System\ydkTELc.exe
  C:\Windows\System\ydkTELc.exe
  2⤵
  PID:6984
- C:\Windows\System\yAosiRR.exe
  C:\Windows\System\yAosiRR.exe
  2⤵
  PID:6448
- C:\Windows\System\cyoRQTr.exe
  C:\Windows\System\cyoRQTr.exe
  2⤵
  PID:6904
- C:\Windows\System\WWAuvOV.exe
  C:\Windows\System\WWAuvOV.exe
  2⤵
  PID:7048
- C:\Windows\System\HeHkLxY.exe
  C:\Windows\System\HeHkLxY.exe
  2⤵
  PID:7112
- C:\Windows\System\pkueVQx.exe
  C:\Windows\System\pkueVQx.exe
  2⤵
  PID:6808
- C:\Windows\System\xNTimGf.exe
  C:\Windows\System\xNTimGf.exe
  2⤵
  PID:5812
- C:\Windows\System\pfWPnHt.exe
  C:\Windows\System\pfWPnHt.exe
  2⤵
  PID:7060
- C:\Windows\System\GhpXFHt.exe
  C:\Windows\System\GhpXFHt.exe
  2⤵
  PID:7124
- C:\Windows\System\iVHlLmQ.exe
  C:\Windows\System\iVHlLmQ.exe
  2⤵
  PID:5588
- C:\Windows\System\PWvhwqS.exe
  C:\Windows\System\PWvhwqS.exe
  2⤵
  PID:6156
- C:\Windows\System\GffVsxs.exe
  C:\Windows\System\GffVsxs.exe
  2⤵
  PID:6628
- C:\Windows\System\kdAwKSn.exe
  C:\Windows\System\kdAwKSn.exe
  2⤵
  PID:6544
- C:\Windows\System\GLWVFzP.exe
  C:\Windows\System\GLWVFzP.exe
  2⤵
  PID:6852
- C:\Windows\System\pvwZvON.exe
  C:\Windows\System\pvwZvON.exe
  2⤵
  PID:7108
- C:\Windows\System\yHxGjqj.exe
  C:\Windows\System\yHxGjqj.exe
  2⤵
  PID:6920
- C:\Windows\System\TUNptri.exe
  C:\Windows\System\TUNptri.exe
  2⤵
  PID:7092
- C:\Windows\System\evPWKQK.exe
  C:\Windows\System\evPWKQK.exe
  2⤵
  PID:6988
- C:\Windows\System\NUFtwOd.exe
  C:\Windows\System\NUFtwOd.exe
  2⤵
  PID:7008
- C:\Windows\System\pkMJueB.exe
  C:\Windows\System\pkMJueB.exe
  2⤵
  PID:5904
- C:\Windows\System\zRSuvrD.exe
  C:\Windows\System\zRSuvrD.exe
  2⤵
  PID:6824
- C:\Windows\System\kSyBdmQ.exe
  C:\Windows\System\kSyBdmQ.exe
  2⤵
  PID:6576
- C:\Windows\System\EsPGLCm.exe
  C:\Windows\System\EsPGLCm.exe
  2⤵
  PID:6692
- C:\Windows\System\yqzTtTp.exe
  C:\Windows\System\yqzTtTp.exe
  2⤵
  PID:6624
- C:\Windows\System\ygkZGMY.exe
  C:\Windows\System\ygkZGMY.exe
  2⤵
  PID:7180
- C:\Windows\System\WohfhsM.exe
  C:\Windows\System\WohfhsM.exe
  2⤵
  PID:7220
- C:\Windows\System\HhDoWRQ.exe
  C:\Windows\System\HhDoWRQ.exe
  2⤵
  PID:7236
- C:\Windows\System\HsBPixT.exe
  C:\Windows\System\HsBPixT.exe
  2⤵
  PID:7252
- C:\Windows\System\UczVRjJ.exe
  C:\Windows\System\UczVRjJ.exe
  2⤵
  PID:7268
- C:\Windows\System\IsIIqCy.exe
  C:\Windows\System\IsIIqCy.exe
  2⤵
  PID:7284
- C:\Windows\System\VLZmsOJ.exe
  C:\Windows\System\VLZmsOJ.exe
  2⤵
  PID:7300
- C:\Windows\System\suPELXJ.exe
  C:\Windows\System\suPELXJ.exe
  2⤵
  PID:7316
- C:\Windows\System\wiEcfLW.exe
  C:\Windows\System\wiEcfLW.exe
  2⤵
  PID:7332
- C:\Windows\System\zSqFKuh.exe
  C:\Windows\System\zSqFKuh.exe
  2⤵
  PID:7348
- C:\Windows\System\EKNvTSF.exe
  C:\Windows\System\EKNvTSF.exe
  2⤵
  PID:7364
- C:\Windows\System\FPaSUFh.exe
  C:\Windows\System\FPaSUFh.exe
  2⤵
  PID:7384
- C:\Windows\System\YVlsgHD.exe
  C:\Windows\System\YVlsgHD.exe
  2⤵
  PID:7400
- C:\Windows\System\bebevku.exe
  C:\Windows\System\bebevku.exe
  2⤵
  PID:7416
- C:\Windows\System\WQHPeyi.exe
  C:\Windows\System\WQHPeyi.exe
  2⤵
  PID:7432
- C:\Windows\System\ctCXebo.exe
  C:\Windows\System\ctCXebo.exe
  2⤵
  PID:7452
- C:\Windows\System\wopbXIQ.exe
  C:\Windows\System\wopbXIQ.exe
  2⤵
  PID:7468
- C:\Windows\System\ojwcKlS.exe
  C:\Windows\System\ojwcKlS.exe
  2⤵
  PID:7484
- C:\Windows\System\CYFvFtj.exe
  C:\Windows\System\CYFvFtj.exe
  2⤵
  PID:7500
- C:\Windows\System\VEzJWQE.exe
  C:\Windows\System\VEzJWQE.exe
  2⤵
  PID:7516
- C:\Windows\System\McfdjhB.exe
  C:\Windows\System\McfdjhB.exe
  2⤵
  PID:7532
- C:\Windows\System\cFLGLyd.exe
  C:\Windows\System\cFLGLyd.exe
  2⤵
  PID:7548
- C:\Windows\System\jJuAyaO.exe
  C:\Windows\System\jJuAyaO.exe
  2⤵
  PID:7564
- C:\Windows\System\rWTnjsb.exe
  C:\Windows\System\rWTnjsb.exe
  2⤵
  PID:7580
- C:\Windows\System\rYDZecs.exe
  C:\Windows\System\rYDZecs.exe
  2⤵
  PID:7596
- C:\Windows\System\sjnDrOf.exe
  C:\Windows\System\sjnDrOf.exe
  2⤵
  PID:7612
- C:\Windows\System\FYsblfg.exe
  C:\Windows\System\FYsblfg.exe
  2⤵
  PID:7628
- C:\Windows\System\DbBPXmD.exe
  C:\Windows\System\DbBPXmD.exe
  2⤵
  PID:7644
- C:\Windows\System\FdPptBv.exe
  C:\Windows\System\FdPptBv.exe
  2⤵
  PID:7660
- C:\Windows\System\FVOjKCx.exe
  C:\Windows\System\FVOjKCx.exe
  2⤵
  PID:7676
- C:\Windows\System\hIwHnqt.exe
  C:\Windows\System\hIwHnqt.exe
  2⤵
  PID:7692
- C:\Windows\System\rSTFSZx.exe
  C:\Windows\System\rSTFSZx.exe
  2⤵
  PID:7708
- C:\Windows\System\tOuqGLX.exe
  C:\Windows\System\tOuqGLX.exe
  2⤵
  PID:7724
- C:\Windows\System\wVbAMIu.exe
  C:\Windows\System\wVbAMIu.exe
  2⤵
  PID:7740
- C:\Windows\System\fmqrsng.exe
  C:\Windows\System\fmqrsng.exe
  2⤵
  PID:7756
- C:\Windows\System\TzOoUYy.exe
  C:\Windows\System\TzOoUYy.exe
  2⤵
  PID:7772
- C:\Windows\System\LLyyhiC.exe
  C:\Windows\System\LLyyhiC.exe
  2⤵
  PID:7788
- C:\Windows\System\iKmzYML.exe
  C:\Windows\System\iKmzYML.exe
  2⤵
  PID:7804
- C:\Windows\System\nwskTRa.exe
  C:\Windows\System\nwskTRa.exe
  2⤵
  PID:7820
- C:\Windows\System\vNURZwO.exe
  C:\Windows\System\vNURZwO.exe
  2⤵
  PID:7836
- C:\Windows\System\JrXLJsi.exe
  C:\Windows\System\JrXLJsi.exe
  2⤵
  PID:7852
- C:\Windows\System\mpiMpGU.exe
  C:\Windows\System\mpiMpGU.exe
  2⤵
  PID:7868
- C:\Windows\System\DSfvwGj.exe
  C:\Windows\System\DSfvwGj.exe
  2⤵
  PID:7884
- C:\Windows\System\OvdmYBk.exe
  C:\Windows\System\OvdmYBk.exe
  2⤵
  PID:7900
- C:\Windows\System\zYIBaLX.exe
  C:\Windows\System\zYIBaLX.exe
  2⤵
  PID:7916
- C:\Windows\System\NsjBZWO.exe
  C:\Windows\System\NsjBZWO.exe
  2⤵
  PID:7932
- C:\Windows\System\jVmVkvO.exe
  C:\Windows\System\jVmVkvO.exe
  2⤵
  PID:7948
- C:\Windows\System\dvQetCc.exe
  C:\Windows\System\dvQetCc.exe
  2⤵
  PID:7964
- C:\Windows\System\ThfbwRt.exe
  C:\Windows\System\ThfbwRt.exe
  2⤵
  PID:7980
- C:\Windows\System\ODfkdUg.exe
  C:\Windows\System\ODfkdUg.exe
  2⤵
  PID:7996
- C:\Windows\System\giipSjo.exe
  C:\Windows\System\giipSjo.exe
  2⤵
  PID:8012
- C:\Windows\System\lbLsgTB.exe
  C:\Windows\System\lbLsgTB.exe
  2⤵
  PID:8028
- C:\Windows\System\EOFQmuY.exe
  C:\Windows\System\EOFQmuY.exe
  2⤵
  PID:8044
- C:\Windows\System\jYBvmdd.exe
  C:\Windows\System\jYBvmdd.exe
  2⤵
  PID:8060
- C:\Windows\System\NywqDlg.exe
  C:\Windows\System\NywqDlg.exe
  2⤵
  PID:8076
- C:\Windows\System\usCSVcj.exe
  C:\Windows\System\usCSVcj.exe
  2⤵
  PID:8092
- C:\Windows\System\PpBBwNq.exe
  C:\Windows\System\PpBBwNq.exe
  2⤵
  PID:8108
- C:\Windows\System\qNfikRx.exe
  C:\Windows\System\qNfikRx.exe
  2⤵
  PID:8124
- C:\Windows\System\BhblAsl.exe
  C:\Windows\System\BhblAsl.exe
  2⤵
  PID:8140
- C:\Windows\System\RqtMAQk.exe
  C:\Windows\System\RqtMAQk.exe
  2⤵
  PID:8156
- C:\Windows\System\biPgvDG.exe
  C:\Windows\System\biPgvDG.exe
  2⤵
  PID:8176
- C:\Windows\System\NffreHZ.exe
  C:\Windows\System\NffreHZ.exe
  2⤵
  PID:6888
- C:\Windows\System\sEiPTVb.exe
  C:\Windows\System\sEiPTVb.exe
  2⤵
  PID:6968
- C:\Windows\System\IaGkMsp.exe
  C:\Windows\System\IaGkMsp.exe
  2⤵
  PID:5968
- C:\Windows\System\UNfufdt.exe
  C:\Windows\System\UNfufdt.exe
  2⤵
  PID:7212
- C:\Windows\System\eFWjYjp.exe
  C:\Windows\System\eFWjYjp.exe
  2⤵
  PID:7244
- C:\Windows\System\BZGLlaO.exe
  C:\Windows\System\BZGLlaO.exe
  2⤵
  PID:7308
- C:\Windows\System\OJdcmWo.exe
  C:\Windows\System\OJdcmWo.exe
  2⤵
  PID:7372
- C:\Windows\System\EbjiVgV.exe
  C:\Windows\System\EbjiVgV.exe
  2⤵
  PID:7412
- C:\Windows\System\jPRrhoq.exe
  C:\Windows\System\jPRrhoq.exe
  2⤵
  PID:7476
- C:\Windows\System\QrOKCoS.exe
  C:\Windows\System\QrOKCoS.exe
  2⤵
  PID:7544
- C:\Windows\System\tpMRCWN.exe
  C:\Windows\System\tpMRCWN.exe
  2⤵
  PID:7460
- C:\Windows\System\pPDPTMJ.exe
  C:\Windows\System\pPDPTMJ.exe
  2⤵
  PID:7492
- C:\Windows\System\wAHLOGR.exe
  C:\Windows\System\wAHLOGR.exe
  2⤵
  PID:7604
- C:\Windows\System\dKwktpX.exe
  C:\Windows\System\dKwktpX.exe
  2⤵
  PID:7652
- C:\Windows\System\RlZielg.exe
  C:\Windows\System\RlZielg.exe
  2⤵
  PID:7560
- C:\Windows\System\zUvlPOz.exe
  C:\Windows\System\zUvlPOz.exe
  2⤵
  PID:7496
- C:\Windows\System\PrWaXnu.exe
  C:\Windows\System\PrWaXnu.exe
  2⤵
  PID:7324
- C:\Windows\System\dFkhiNa.exe
  C:\Windows\System\dFkhiNa.exe
  2⤵
  PID:7656
- C:\Windows\System\tyTUuMO.exe
  C:\Windows\System\tyTUuMO.exe
  2⤵
  PID:7700
- C:\Windows\System\xcuBffs.exe
  C:\Windows\System\xcuBffs.exe
  2⤵
  PID:7764
- C:\Windows\System\qZGXYIZ.exe
  C:\Windows\System\qZGXYIZ.exe
  2⤵
  PID:7800
- C:\Windows\System\PkiEPkU.exe
  C:\Windows\System\PkiEPkU.exe
  2⤵
  PID:7832
- C:\Windows\System\ajQOwpb.exe
  C:\Windows\System\ajQOwpb.exe
  2⤵
  PID:7892
- C:\Windows\System\BTbkdgW.exe
  C:\Windows\System\BTbkdgW.exe
  2⤵
  PID:7956
- C:\Windows\System\XInvvvQ.exe
  C:\Windows\System\XInvvvQ.exe
  2⤵
  PID:8020
- C:\Windows\System\RfjxBjr.exe
  C:\Windows\System\RfjxBjr.exe
  2⤵
  PID:8084
- C:\Windows\System\mVeTBCN.exe
  C:\Windows\System\mVeTBCN.exe
  2⤵
  PID:7812
- C:\Windows\System\BnLtMVE.exe
  C:\Windows\System\BnLtMVE.exe
  2⤵
  PID:7844
- C:\Windows\System\cfWRbGa.exe
  C:\Windows\System\cfWRbGa.exe
  2⤵
  PID:8120
- C:\Windows\System\SrLPxwl.exe
  C:\Windows\System\SrLPxwl.exe
  2⤵
  PID:7940
- C:\Windows\System\gxMXpdt.exe
  C:\Windows\System\gxMXpdt.exe
  2⤵
  PID:7876
- C:\Windows\System\FeliBVg.exe
  C:\Windows\System\FeliBVg.exe
  2⤵
  PID:8008
- C:\Windows\System\mspuUtC.exe
  C:\Windows\System\mspuUtC.exe
  2⤵
  PID:8104
- C:\Windows\System\RVOPJse.exe
  C:\Windows\System\RVOPJse.exe
  2⤵
  PID:8164
- C:\Windows\System\tctgoFZ.exe
  C:\Windows\System\tctgoFZ.exe
  2⤵
  PID:8188
- C:\Windows\System\XAqYnif.exe
  C:\Windows\System\XAqYnif.exe
  2⤵
  PID:7228
- C:\Windows\System\mVtMboN.exe
  C:\Windows\System\mVtMboN.exe
  2⤵
  PID:7340
- C:\Windows\System\JvPjpNK.exe
  C:\Windows\System\JvPjpNK.exe
  2⤵
  PID:7448
- C:\Windows\System\MLzQrYl.exe
  C:\Windows\System\MLzQrYl.exe
  2⤵
  PID:7636
- C:\Windows\System\MQBdzhW.exe
  C:\Windows\System\MQBdzhW.exe
  2⤵
  PID:7508
- C:\Windows\System\bgvUuCD.exe
  C:\Windows\System\bgvUuCD.exe
  2⤵
  PID:7464
- C:\Windows\System\IkXgCgt.exe
  C:\Windows\System\IkXgCgt.exe
  2⤵
  PID:7376
- C:\Windows\System\SUeaUYE.exe
  C:\Windows\System\SUeaUYE.exe
  2⤵
  PID:7524
- C:\Windows\System\fXypcJm.exe
  C:\Windows\System\fXypcJm.exe
  2⤵
  PID:7592
- C:\Windows\System\IwiwfIE.exe
  C:\Windows\System\IwiwfIE.exe
  2⤵
  PID:7864
- C:\Windows\System\bUHXWlR.exe
  C:\Windows\System\bUHXWlR.exe
  2⤵
  PID:7732
- C:\Windows\System\pFmXqCl.exe
  C:\Windows\System\pFmXqCl.exe
  2⤵
  PID:7976
- C:\Windows\System\FuzihqG.exe
  C:\Windows\System\FuzihqG.exe
  2⤵
  PID:7928
- C:\Windows\System\ZSAdGzt.exe
  C:\Windows\System\ZSAdGzt.exe
  2⤵
  PID:7780
- C:\Windows\System\vkDpGJy.exe
  C:\Windows\System\vkDpGJy.exe
  2⤵
  PID:8056
- C:\Windows\System\HqAlWqD.exe
  C:\Windows\System\HqAlWqD.exe
  2⤵
  PID:8184
- C:\Windows\System\YmGWVmk.exe
  C:\Windows\System\YmGWVmk.exe
  2⤵
  PID:7280
- C:\Windows\System\TMLrGTx.exe
  C:\Windows\System\TMLrGTx.exe
  2⤵
  PID:7572
- C:\Windows\System\tSBrJgY.exe
  C:\Windows\System\tSBrJgY.exe
  2⤵
  PID:7512
- C:\Windows\System\rRxgJsl.exe
  C:\Windows\System\rRxgJsl.exe
  2⤵
  PID:7528
- C:\Windows\System\fXYhJbZ.exe
  C:\Windows\System\fXYhJbZ.exe
  2⤵
  PID:7264
- C:\Windows\System\kKhnVxp.exe
  C:\Windows\System\kKhnVxp.exe
  2⤵
  PID:7688
- C:\Windows\System\DwiWqiH.exe
  C:\Windows\System\DwiWqiH.exe
  2⤵
  PID:7988
- C:\Windows\System\DjCKnLI.exe
  C:\Windows\System\DjCKnLI.exe
  2⤵
  PID:7880
- C:\Windows\System\ECFIVCY.exe
  C:\Windows\System\ECFIVCY.exe
  2⤵
  PID:7216
- C:\Windows\System\TfBSyMQ.exe
  C:\Windows\System\TfBSyMQ.exe
  2⤵
  PID:7396
- C:\Windows\System\sHqEmhD.exe
  C:\Windows\System\sHqEmhD.exe
  2⤵
  PID:7204
- C:\Windows\System\iVOlcia.exe
  C:\Windows\System\iVOlcia.exe
  2⤵
  PID:5336
- C:\Windows\System\yfehSLF.exe
  C:\Windows\System\yfehSLF.exe
  2⤵
  PID:7576
- C:\Windows\System\pagmAgV.exe
  C:\Windows\System\pagmAgV.exe
  2⤵
  PID:8068
- C:\Windows\System\FOsNLVs.exe
  C:\Windows\System\FOsNLVs.exe
  2⤵
  PID:7624
- C:\Windows\System\bxTJIGl.exe
  C:\Windows\System\bxTJIGl.exe
  2⤵
  PID:8132
- C:\Windows\System\aXmYBaU.exe
  C:\Windows\System\aXmYBaU.exe
  2⤵
  PID:8040
- C:\Windows\System\gdwnTsK.exe
  C:\Windows\System\gdwnTsK.exe
  2⤵
  PID:8204
- C:\Windows\System\TotYiKX.exe
  C:\Windows\System\TotYiKX.exe
  2⤵
  PID:8220
- C:\Windows\System\QLijfxs.exe
  C:\Windows\System\QLijfxs.exe
  2⤵
  PID:8236
- C:\Windows\System\iaBnsdy.exe
  C:\Windows\System\iaBnsdy.exe
  2⤵
  PID:8252
- C:\Windows\System\mcmzWeQ.exe
  C:\Windows\System\mcmzWeQ.exe
  2⤵
  PID:8268
- C:\Windows\System\QuOxdUT.exe
  C:\Windows\System\QuOxdUT.exe
  2⤵
  PID:8284
- C:\Windows\System\vYjadLb.exe
  C:\Windows\System\vYjadLb.exe
  2⤵
  PID:8300
- C:\Windows\System\hRehAkG.exe
  C:\Windows\System\hRehAkG.exe
  2⤵
  PID:8316
- C:\Windows\System\qpKJqah.exe
  C:\Windows\System\qpKJqah.exe
  2⤵
  PID:8332
- C:\Windows\System\XuQrKjS.exe
  C:\Windows\System\XuQrKjS.exe
  2⤵
  PID:8348
- C:\Windows\System\YXkxNQd.exe
  C:\Windows\System\YXkxNQd.exe
  2⤵
  PID:8364
- C:\Windows\System\YNAmpKB.exe
  C:\Windows\System\YNAmpKB.exe
  2⤵
  PID:8380
- C:\Windows\System\CZZnFuc.exe
  C:\Windows\System\CZZnFuc.exe
  2⤵
  PID:8400
- C:\Windows\System\udVDGie.exe
  C:\Windows\System\udVDGie.exe
  2⤵
  PID:8416
- C:\Windows\System\nfzBGTS.exe
  C:\Windows\System\nfzBGTS.exe
  2⤵
  PID:8432
- C:\Windows\System\RuHURyl.exe
  C:\Windows\System\RuHURyl.exe
  2⤵
  PID:8448
- C:\Windows\System\GdaaFLh.exe
  C:\Windows\System\GdaaFLh.exe
  2⤵
  PID:8464
- C:\Windows\System\olsbkqj.exe
  C:\Windows\System\olsbkqj.exe
  2⤵
  PID:8480
- C:\Windows\System\uwKmQOg.exe
  C:\Windows\System\uwKmQOg.exe
  2⤵
  PID:8496
- C:\Windows\System\cGefaoI.exe
  C:\Windows\System\cGefaoI.exe
  2⤵
  PID:8512
- C:\Windows\System\KpQGQHW.exe
  C:\Windows\System\KpQGQHW.exe
  2⤵
  PID:8528
- C:\Windows\System\ihCSZoF.exe
  C:\Windows\System\ihCSZoF.exe
  2⤵
  PID:8544
- C:\Windows\System\uwLLnCd.exe
  C:\Windows\System\uwLLnCd.exe
  2⤵
  PID:8560
- C:\Windows\System\MbDTrGw.exe
  C:\Windows\System\MbDTrGw.exe
  2⤵
  PID:8576
- C:\Windows\System\OWMUbbd.exe
  C:\Windows\System\OWMUbbd.exe
  2⤵
  PID:8592
- C:\Windows\System\ngWQZJl.exe
  C:\Windows\System\ngWQZJl.exe
  2⤵
  PID:8608
- C:\Windows\System\sBTpeEL.exe
  C:\Windows\System\sBTpeEL.exe
  2⤵
  PID:8624
- C:\Windows\System\qWJJgip.exe
  C:\Windows\System\qWJJgip.exe
  2⤵
  PID:8640
- C:\Windows\System\erBzTkR.exe
  C:\Windows\System\erBzTkR.exe
  2⤵
  PID:8656
- C:\Windows\System\UxkPHWc.exe
  C:\Windows\System\UxkPHWc.exe
  2⤵
  PID:8672
- C:\Windows\System\NxxrRJe.exe
  C:\Windows\System\NxxrRJe.exe
  2⤵
  PID:8688
- C:\Windows\System\ZuMjbpl.exe
  C:\Windows\System\ZuMjbpl.exe
  2⤵
  PID:8704
- C:\Windows\System\HoFQpVl.exe
  C:\Windows\System\HoFQpVl.exe
  2⤵
  PID:8720
- C:\Windows\System\zeZiLTS.exe
  C:\Windows\System\zeZiLTS.exe
  2⤵
  PID:8736
- C:\Windows\System\AbXKfgy.exe
  C:\Windows\System\AbXKfgy.exe
  2⤵
  PID:8752
- C:\Windows\System\KMTbsdf.exe
  C:\Windows\System\KMTbsdf.exe
  2⤵
  PID:8768
- C:\Windows\System\HnccKfK.exe
  C:\Windows\System\HnccKfK.exe
  2⤵
  PID:8784
- C:\Windows\System\fugbIRh.exe
  C:\Windows\System\fugbIRh.exe
  2⤵
  PID:8800
- C:\Windows\System\vVrbexM.exe
  C:\Windows\System\vVrbexM.exe
  2⤵
  PID:8816
- C:\Windows\System\mnRukAl.exe
  C:\Windows\System\mnRukAl.exe
  2⤵
  PID:8832
- C:\Windows\System\jroNAkc.exe
  C:\Windows\System\jroNAkc.exe
  2⤵
  PID:8848
- C:\Windows\System\JHAVxGq.exe
  C:\Windows\System\JHAVxGq.exe
  2⤵
  PID:8864
- C:\Windows\System\FAnnaLR.exe
  C:\Windows\System\FAnnaLR.exe
  2⤵
  PID:8880
- C:\Windows\System\ooRzvTJ.exe
  C:\Windows\System\ooRzvTJ.exe
  2⤵
  PID:8896
- C:\Windows\System\ENmApLb.exe
  C:\Windows\System\ENmApLb.exe
  2⤵
  PID:8912
- C:\Windows\System\diXVHIn.exe
  C:\Windows\System\diXVHIn.exe
  2⤵
  PID:8928
- C:\Windows\System\CNPAwvL.exe
  C:\Windows\System\CNPAwvL.exe
  2⤵
  PID:8944
- C:\Windows\System\NEprzyh.exe
  C:\Windows\System\NEprzyh.exe
  2⤵
  PID:8960
- C:\Windows\System\RkMagwX.exe
  C:\Windows\System\RkMagwX.exe
  2⤵
  PID:8976
- C:\Windows\System\usxznri.exe
  C:\Windows\System\usxznri.exe
  2⤵
  PID:8992
- C:\Windows\System\tALbkwg.exe
  C:\Windows\System\tALbkwg.exe
  2⤵
  PID:9008
- C:\Windows\System\rnrCIeL.exe
  C:\Windows\System\rnrCIeL.exe
  2⤵
  PID:9024
- C:\Windows\System\BVWxxpg.exe
  C:\Windows\System\BVWxxpg.exe
  2⤵
  PID:9040
- C:\Windows\System\qWLDFQr.exe
  C:\Windows\System\qWLDFQr.exe
  2⤵
  PID:9056
- C:\Windows\System\LKNOpPa.exe
  C:\Windows\System\LKNOpPa.exe
  2⤵
  PID:9072
- C:\Windows\System\cNGBPyo.exe
  C:\Windows\System\cNGBPyo.exe
  2⤵
  PID:9088
- C:\Windows\System\ObXmsbX.exe
  C:\Windows\System\ObXmsbX.exe
  2⤵
  PID:9104
- C:\Windows\System\vKSAClE.exe
  C:\Windows\System\vKSAClE.exe
  2⤵
  PID:9120
- C:\Windows\System\OhsgdOj.exe
  C:\Windows\System\OhsgdOj.exe
  2⤵
  PID:9136
- C:\Windows\System\abokKxx.exe
  C:\Windows\System\abokKxx.exe
  2⤵
  PID:9152
- C:\Windows\System\lXDNoYD.exe
  C:\Windows\System\lXDNoYD.exe
  2⤵
  PID:9168
- C:\Windows\System\JwRzOHS.exe
  C:\Windows\System\JwRzOHS.exe
  2⤵
  PID:9184
- C:\Windows\System\gzXqXOO.exe
  C:\Windows\System\gzXqXOO.exe
  2⤵
  PID:9200
- C:\Windows\System\zutphCu.exe
  C:\Windows\System\zutphCu.exe
  2⤵
  PID:8196
- C:\Windows\System\bMCjZds.exe
  C:\Windows\System\bMCjZds.exe
  2⤵
  PID:8260
- C:\Windows\System\tnpUplO.exe
  C:\Windows\System\tnpUplO.exe
  2⤵
  PID:8292
- C:\Windows\System\SqjoaQv.exe
  C:\Windows\System\SqjoaQv.exe
  2⤵
  PID:8216
- C:\Windows\System\VjuPbYD.exe
  C:\Windows\System\VjuPbYD.exe
  2⤵
  PID:8360
- C:\Windows\System\ExwCJyY.exe
  C:\Windows\System\ExwCJyY.exe
  2⤵
  PID:8372
- C:\Windows\System\uUdBzOa.exe
  C:\Windows\System\uUdBzOa.exe
  2⤵
  PID:8396
- C:\Windows\System\fdugXYE.exe
  C:\Windows\System\fdugXYE.exe
  2⤵
  PID:8428
- C:\Windows\System\RgSIDvH.exe
  C:\Windows\System\RgSIDvH.exe
  2⤵
  PID:8408
- C:\Windows\System\qhULiwa.exe
  C:\Windows\System\qhULiwa.exe
  2⤵
  PID:8476
- C:\Windows\System\HMNYMUR.exe
  C:\Windows\System\HMNYMUR.exe
  2⤵
  PID:8520
- C:\Windows\System\zDAhqbU.exe
  C:\Windows\System\zDAhqbU.exe
  2⤵
  PID:8584
- C:\Windows\System\mOfjnLb.exe
  C:\Windows\System\mOfjnLb.exe
  2⤵
  PID:8504
- C:\Windows\System\pRqPpIh.exe
  C:\Windows\System\pRqPpIh.exe
  2⤵
  PID:8616
- C:\Windows\System\ptAhZnT.exe
  C:\Windows\System\ptAhZnT.exe
  2⤵
  PID:8648
- C:\Windows\System\DPRWFSa.exe
  C:\Windows\System\DPRWFSa.exe
  2⤵
  PID:8680
- C:\Windows\System\qUVHsrW.exe
  C:\Windows\System\qUVHsrW.exe
  2⤵
  PID:8664
- C:\Windows\System\QBlNykF.exe
  C:\Windows\System\QBlNykF.exe
  2⤵
  PID:8744
- C:\Windows\System\EEmMWzB.exe
  C:\Windows\System\EEmMWzB.exe
  2⤵
  PID:8760
- C:\Windows\System\pFQryZd.exe
  C:\Windows\System\pFQryZd.exe
  2⤵
  PID:8812
- C:\Windows\System\BrruDdS.exe
  C:\Windows\System\BrruDdS.exe
  2⤵
  PID:8840
- C:\Windows\System\MzJPjTm.exe
  C:\Windows\System\MzJPjTm.exe
  2⤵
  PID:8828
- C:\Windows\System\wedGsGn.exe
  C:\Windows\System\wedGsGn.exe
  2⤵
  PID:8824
- C:\Windows\System\MnTIsDp.exe
  C:\Windows\System\MnTIsDp.exe
  2⤵
  PID:8856
- C:\Windows\System\ulNLEau.exe
  C:\Windows\System\ulNLEau.exe
  2⤵
  PID:9000
- C:\Windows\System\mHBiCxd.exe
  C:\Windows\System\mHBiCxd.exe
  2⤵
  PID:8952
- C:\Windows\System\rmWkchb.exe
  C:\Windows\System\rmWkchb.exe
  2⤵
  PID:9032
- C:\Windows\System\MGHdkXT.exe
  C:\Windows\System\MGHdkXT.exe
  2⤵
  PID:9068
- C:\Windows\System\tycrvFT.exe
  C:\Windows\System\tycrvFT.exe
  2⤵
  PID:9048
- C:\Windows\System\CstOshX.exe
  C:\Windows\System\CstOshX.exe
  2⤵
  PID:9132
- C:\Windows\System\AIfHciq.exe
  C:\Windows\System\AIfHciq.exe
  2⤵
  PID:9164
- C:\Windows\System\rgYuGDb.exe
  C:\Windows\System\rgYuGDb.exe
  2⤵
  PID:9144
- C:\Windows\System\KmypDWy.exe
  C:\Windows\System\KmypDWy.exe
  2⤵
  PID:8212
- C:\Windows\System\ZbQMjHh.exe
  C:\Windows\System\ZbQMjHh.exe
  2⤵
  PID:8276
- C:\Windows\System\gyfTiso.exe
  C:\Windows\System\gyfTiso.exe
  2⤵
  PID:9212
- C:\Windows\System\nZxCdei.exe
  C:\Windows\System\nZxCdei.exe
  2⤵
  PID:7208
- C:\Windows\System\mHLWBid.exe
  C:\Windows\System\mHLWBid.exe
  2⤵
  PID:8356
- C:\Windows\System\DXbKbvc.exe
  C:\Windows\System\DXbKbvc.exe
  2⤵
  PID:8472
- C:\Windows\System\MMwTybR.exe
  C:\Windows\System\MMwTybR.exe
  2⤵
  PID:8568
- C:\Windows\System\eOPJcHM.exe
  C:\Windows\System\eOPJcHM.exe
  2⤵
  PID:8700
- C:\Windows\System\AZyRVnj.exe
  C:\Windows\System\AZyRVnj.exe
  2⤵
  PID:8780
- C:\Windows\System\wgGZOki.exe
  C:\Windows\System\wgGZOki.exe
  2⤵
  PID:8940
- C:\Windows\System\MzVxSju.exe
  C:\Windows\System\MzVxSju.exe
  2⤵
  PID:9036
- C:\Windows\System\bUGUYHQ.exe
  C:\Windows\System\bUGUYHQ.exe
  2⤵
  PID:9100
- C:\Windows\System\pgOoFlu.exe
  C:\Windows\System\pgOoFlu.exe
  2⤵
  PID:9192
- C:\Windows\System\PFAcBvH.exe
  C:\Windows\System\PFAcBvH.exe
  2⤵
  PID:9148
- C:\Windows\System\BDxtQkY.exe
  C:\Windows\System\BDxtQkY.exe
  2⤵
  PID:8764
- C:\Windows\System\vqhUstX.exe
  C:\Windows\System\vqhUstX.exe
  2⤵
  PID:8488
- C:\Windows\System\VDuaTRR.exe
  C:\Windows\System\VDuaTRR.exe
  2⤵
  PID:8908
- C:\Windows\System\eAFxlRx.exe
  C:\Windows\System\eAFxlRx.exe
  2⤵
  PID:8248
- C:\Windows\System\SvNBSWU.exe
  C:\Windows\System\SvNBSWU.exe
  2⤵
  PID:8324
- C:\Windows\System\TcNTBHC.exe
  C:\Windows\System\TcNTBHC.exe
  2⤵
  PID:8872
- C:\Windows\System\AagnXxe.exe
  C:\Windows\System\AagnXxe.exe
  2⤵
  PID:8876
- C:\Windows\System\JGkVnUh.exe
  C:\Windows\System\JGkVnUh.exe
  2⤵
  PID:8924
- C:\Windows\System\nrvAonE.exe
  C:\Windows\System\nrvAonE.exe
  2⤵
  PID:8712
- C:\Windows\System\gjyziBg.exe
  C:\Windows\System\gjyziBg.exe
  2⤵
  PID:8968
- C:\Windows\System\gRzsrRw.exe
  C:\Windows\System\gRzsrRw.exe
  2⤵
  PID:8344
- C:\Windows\System\ifrLpYD.exe
  C:\Windows\System\ifrLpYD.exe
  2⤵
  PID:8796
- C:\Windows\System\VTCjrgX.exe
  C:\Windows\System\VTCjrgX.exe
  2⤵
  PID:8588
- C:\Windows\System\yyexkCD.exe
  C:\Windows\System\yyexkCD.exe
  2⤵
  PID:8984
- C:\Windows\System\zCgOwEd.exe
  C:\Windows\System\zCgOwEd.exe
  2⤵
  PID:9020
- C:\Windows\System\FoBFaPM.exe
  C:\Windows\System\FoBFaPM.exe
  2⤵
  PID:8424
- C:\Windows\System\WlkxtJQ.exe
  C:\Windows\System\WlkxtJQ.exe
  2⤵
  PID:9220
- C:\Windows\System\WBhLeOk.exe
  C:\Windows\System\WBhLeOk.exe
  2⤵
  PID:9236
- C:\Windows\System\YXWHSBi.exe
  C:\Windows\System\YXWHSBi.exe
  2⤵
  PID:9252
- C:\Windows\System\wWWHfYz.exe
  C:\Windows\System\wWWHfYz.exe
  2⤵
  PID:9268
- C:\Windows\System\aTOixIs.exe
  C:\Windows\System\aTOixIs.exe
  2⤵
  PID:9284
- C:\Windows\System\HjdrTWs.exe
  C:\Windows\System\HjdrTWs.exe
  2⤵
  PID:9300
- C:\Windows\System\OQJwVIR.exe
  C:\Windows\System\OQJwVIR.exe
  2⤵
  PID:9316
- C:\Windows\System\CovzVSH.exe
  C:\Windows\System\CovzVSH.exe
  2⤵
  PID:9336
- C:\Windows\System\BWeNlwE.exe
  C:\Windows\System\BWeNlwE.exe
  2⤵
  PID:9352
- C:\Windows\System\oJLFZvT.exe
  C:\Windows\System\oJLFZvT.exe
  2⤵
  PID:9368
- C:\Windows\System\hVnyjpq.exe
  C:\Windows\System\hVnyjpq.exe
  2⤵
  PID:9384
- C:\Windows\System\AEpWdbb.exe
  C:\Windows\System\AEpWdbb.exe
  2⤵
  PID:9400
- C:\Windows\System\jSSYgQe.exe
  C:\Windows\System\jSSYgQe.exe
  2⤵
  PID:9416
- C:\Windows\System\mLAQQge.exe
  C:\Windows\System\mLAQQge.exe
  2⤵
  PID:9432
- C:\Windows\System\iWGwNFl.exe
  C:\Windows\System\iWGwNFl.exe
  2⤵
  PID:9448
- C:\Windows\System\wJfMyYd.exe
  C:\Windows\System\wJfMyYd.exe
  2⤵
  PID:9464
- C:\Windows\System\NrmHcWR.exe
  C:\Windows\System\NrmHcWR.exe
  2⤵
  PID:9480
- C:\Windows\System\BWmUnfH.exe
  C:\Windows\System\BWmUnfH.exe
  2⤵
  PID:9496
- C:\Windows\System\WczXhcJ.exe
  C:\Windows\System\WczXhcJ.exe
  2⤵
  PID:9512
- C:\Windows\System\rsLxTqN.exe
  C:\Windows\System\rsLxTqN.exe
  2⤵
  PID:9528
- C:\Windows\System\snogiEy.exe
  C:\Windows\System\snogiEy.exe
  2⤵
  PID:9544
- C:\Windows\System\hcnHpUD.exe
  C:\Windows\System\hcnHpUD.exe
  2⤵
  PID:9560
- C:\Windows\System\cDvZTrd.exe
  C:\Windows\System\cDvZTrd.exe
  2⤵
  PID:9576
- C:\Windows\System\uWjnMhN.exe
  C:\Windows\System\uWjnMhN.exe
  2⤵
  PID:9592
- C:\Windows\System\gjtbGqS.exe
  C:\Windows\System\gjtbGqS.exe
  2⤵
  PID:9608
- C:\Windows\System\wIOwZNB.exe
  C:\Windows\System\wIOwZNB.exe
  2⤵
  PID:9624
- C:\Windows\System\jLyBfxS.exe
  C:\Windows\System\jLyBfxS.exe
  2⤵
  PID:9640
- C:\Windows\System\TkIQxYq.exe
  C:\Windows\System\TkIQxYq.exe
  2⤵
  PID:9656
- C:\Windows\System\QdKWYEI.exe
  C:\Windows\System\QdKWYEI.exe
  2⤵
  PID:9672
- C:\Windows\System\XUsDggm.exe
  C:\Windows\System\XUsDggm.exe
  2⤵
  PID:9688
- C:\Windows\System\RwiROwi.exe
  C:\Windows\System\RwiROwi.exe
  2⤵
  PID:9704
- C:\Windows\System\muugLKr.exe
  C:\Windows\System\muugLKr.exe
  2⤵
  PID:9720
- C:\Windows\System\uaindjF.exe
  C:\Windows\System\uaindjF.exe
  2⤵
  PID:9736
- C:\Windows\System\uXOlOuF.exe
  C:\Windows\System\uXOlOuF.exe
  2⤵
  PID:9752
- C:\Windows\System\DzYUyfq.exe
  C:\Windows\System\DzYUyfq.exe
  2⤵
  PID:9768
- C:\Windows\System\gFJcpay.exe
  C:\Windows\System\gFJcpay.exe
  2⤵
  PID:9784
- C:\Windows\System\lLaFHoW.exe
  C:\Windows\System\lLaFHoW.exe
  2⤵
  PID:9800
- C:\Windows\System\yUfJlrQ.exe
  C:\Windows\System\yUfJlrQ.exe
  2⤵
  PID:9816
- C:\Windows\System\wFaFtFb.exe
  C:\Windows\System\wFaFtFb.exe
  2⤵
  PID:9832
- C:\Windows\System\LgpBqfR.exe
  C:\Windows\System\LgpBqfR.exe
  2⤵
  PID:9848
- C:\Windows\System\GJvbARv.exe
  C:\Windows\System\GJvbARv.exe
  2⤵
  PID:9864
- C:\Windows\System\emFWaLp.exe
  C:\Windows\System\emFWaLp.exe
  2⤵
  PID:9880
- C:\Windows\System\hsrllxf.exe
  C:\Windows\System\hsrllxf.exe
  2⤵
  PID:9896
- C:\Windows\System\ilWpDOf.exe
  C:\Windows\System\ilWpDOf.exe
  2⤵
  PID:9912
- C:\Windows\System\aFaXJGN.exe
  C:\Windows\System\aFaXJGN.exe
  2⤵
  PID:9928
- C:\Windows\System\uJAAvmC.exe
  C:\Windows\System\uJAAvmC.exe
  2⤵
  PID:9944
- C:\Windows\System\ULyOXAq.exe
  C:\Windows\System\ULyOXAq.exe
  2⤵
  PID:9960
- C:\Windows\System\JqYjvNW.exe
  C:\Windows\System\JqYjvNW.exe
  2⤵
  PID:9976
- C:\Windows\System\ubamZZu.exe
  C:\Windows\System\ubamZZu.exe
  2⤵
  PID:9992
- C:\Windows\System\GbBDdME.exe
  C:\Windows\System\GbBDdME.exe
  2⤵
  PID:10008
- C:\Windows\System\dTuAxIz.exe
  C:\Windows\System\dTuAxIz.exe
  2⤵
  PID:10024
- C:\Windows\System\wOscCDl.exe
  C:\Windows\System\wOscCDl.exe
  2⤵
  PID:10040
- C:\Windows\System\yfehyEc.exe
  C:\Windows\System\yfehyEc.exe
  2⤵
  PID:10056
- C:\Windows\System\EddmHNK.exe
  C:\Windows\System\EddmHNK.exe
  2⤵
  PID:10072
- C:\Windows\System\jwHolid.exe
  C:\Windows\System\jwHolid.exe
  2⤵
  PID:10088
- C:\Windows\System\oHCsOCd.exe
  C:\Windows\System\oHCsOCd.exe
  2⤵
  PID:10104
- C:\Windows\System\aiZVPrl.exe
  C:\Windows\System\aiZVPrl.exe
  2⤵
  PID:10120
- C:\Windows\System\qIKHWnv.exe
  C:\Windows\System\qIKHWnv.exe
  2⤵
  PID:10136
- C:\Windows\System\gKVKJoy.exe
  C:\Windows\System\gKVKJoy.exe
  2⤵
  PID:10152
- C:\Windows\System\AxqjmWE.exe
  C:\Windows\System\AxqjmWE.exe
  2⤵
  PID:10168
- C:\Windows\System\vAzwmDR.exe
  C:\Windows\System\vAzwmDR.exe
  2⤵
  PID:10184
- C:\Windows\System\xpVwMdF.exe
  C:\Windows\System\xpVwMdF.exe
  2⤵
  PID:10200
- C:\Windows\System\uMXoPVi.exe
  C:\Windows\System\uMXoPVi.exe
  2⤵
  PID:10216
- C:\Windows\System\FWRnJWA.exe
  C:\Windows\System\FWRnJWA.exe
  2⤵
  PID:10232
- C:\Windows\System\QtOEkUn.exe
  C:\Windows\System\QtOEkUn.exe
  2⤵
  PID:9260
- C:\Windows\System\CpKQEja.exe
  C:\Windows\System\CpKQEja.exe
  2⤵
  PID:9324
- C:\Windows\System\FIuwtXh.exe
  C:\Windows\System\FIuwtXh.exe
  2⤵
  PID:9392
- C:\Windows\System\uDdzRPK.exe
  C:\Windows\System\uDdzRPK.exe
  2⤵
  PID:9456
- C:\Windows\System\akDCjlZ.exe
  C:\Windows\System\akDCjlZ.exe
  2⤵
  PID:8232
- C:\Windows\System\IoTAybr.exe
  C:\Windows\System\IoTAybr.exe
  2⤵
  PID:8604
- C:\Windows\System\ZIjGrFv.exe
  C:\Windows\System\ZIjGrFv.exe
  2⤵
  PID:8716
- C:\Windows\System\HUqCThp.exe
  C:\Windows\System\HUqCThp.exe
  2⤵
  PID:9312
- C:\Windows\System\COqVKfM.exe
  C:\Windows\System\COqVKfM.exe
  2⤵
  PID:9572
- C:\Windows\System\vRmnjHm.exe
  C:\Windows\System\vRmnjHm.exe
  2⤵
  PID:9276
- C:\Windows\System\kugCtaL.exe
  C:\Windows\System\kugCtaL.exe
  2⤵
  PID:9348
- C:\Windows\System\XDssIIN.exe
  C:\Windows\System\XDssIIN.exe
  2⤵
  PID:9412
- C:\Windows\System\DOYBFXO.exe
  C:\Windows\System\DOYBFXO.exe
  2⤵
  PID:9540
- C:\Windows\System\sFmlkBn.exe
  C:\Windows\System\sFmlkBn.exe
  2⤵
  PID:9600
- C:\Windows\System\bweyasp.exe
  C:\Windows\System\bweyasp.exe
  2⤵
  PID:9652
- C:\Windows\System\uLkERgj.exe
  C:\Windows\System\uLkERgj.exe
  2⤵
  PID:9588
- C:\Windows\System\LdaVzCX.exe
  C:\Windows\System\LdaVzCX.exe
  2⤵
  PID:9668
- C:\Windows\System\JhaVpsg.exe
  C:\Windows\System\JhaVpsg.exe
  2⤵
  PID:1580
- C:\Windows\System\xxaBsMv.exe
  C:\Windows\System\xxaBsMv.exe
  2⤵
  PID:9780
- C:\Windows\System\wqcwgJD.exe
  C:\Windows\System\wqcwgJD.exe
  2⤵
  PID:9844
- C:\Windows\System\sEMNTnx.exe
  C:\Windows\System\sEMNTnx.exe
  2⤵
  PID:9908
- C:\Windows\System\YruleSl.exe
  C:\Windows\System\YruleSl.exe
  2⤵
  PID:9972
- C:\Windows\System\MviUEfd.exe
  C:\Windows\System\MviUEfd.exe
  2⤵
  PID:10004
- C:\Windows\System\TyBkqLm.exe
  C:\Windows\System\TyBkqLm.exe
  2⤵
  PID:10068
- C:\Windows\System\tyVEdud.exe
  C:\Windows\System\tyVEdud.exe
  2⤵
  PID:9828
- C:\Windows\System\WszJZQK.exe
  C:\Windows\System\WszJZQK.exe
  2⤵
  PID:9760
- C:\Windows\System\lzxCsjS.exe
  C:\Windows\System\lzxCsjS.exe
  2⤵
  PID:10160
- C:\Windows\System\xxWLwVr.exe
  C:\Windows\System\xxWLwVr.exe
  2⤵
  PID:10112
- C:\Windows\System\jhktOeb.exe
  C:\Windows\System\jhktOeb.exe
  2⤵
  PID:10192
- C:\Windows\System\ajBQpMP.exe
  C:\Windows\System\ajBQpMP.exe
  2⤵
  PID:9956
- C:\Windows\System\XKPnsRJ.exe
  C:\Windows\System\XKPnsRJ.exe
  2⤵
  PID:9860
- C:\Windows\System\RNwXniu.exe
  C:\Windows\System\RNwXniu.exe
  2⤵
  PID:9988
- C:\Windows\System\hszDhJQ.exe
  C:\Windows\System\hszDhJQ.exe
  2⤵
  PID:10208
- C:\Windows\System\XFuxneQ.exe
  C:\Windows\System\XFuxneQ.exe
  2⤵
  PID:9424
- C:\Windows\System\DxUaxqI.exe
  C:\Windows\System\DxUaxqI.exe
  2⤵
  PID:9232
- C:\Windows\System\eJVFLPj.exe
  C:\Windows\System\eJVFLPj.exe
  2⤵
  PID:8652
- C:\Windows\System\upFOmja.exe
  C:\Windows\System\upFOmja.exe
  2⤵
  PID:9556
- C:\Windows\System\FMChucF.exe
  C:\Windows\System\FMChucF.exe
  2⤵
  PID:9584
- C:\Windows\System\IrLxxEF.exe
  C:\Windows\System\IrLxxEF.exe
  2⤵
  PID:9408
- C:\Windows\System\nitTzhM.exe
  C:\Windows\System\nitTzhM.exe
  2⤵
  PID:9684
- C:\Windows\System\OJMrRZU.exe
  C:\Windows\System\OJMrRZU.exe
  2⤵
  PID:9812
- C:\Windows\System\wqOAnjO.exe
  C:\Windows\System\wqOAnjO.exe
  2⤵
  PID:9472
- C:\Windows\System\mMoYVxS.exe
  C:\Windows\System\mMoYVxS.exe
  2⤵
  PID:10064
- C:\Windows\System\PFkujFm.exe
  C:\Windows\System\PFkujFm.exe
  2⤵
  PID:9344
- C:\Windows\System\InVsNtK.exe
  C:\Windows\System\InVsNtK.exe
  2⤵
  PID:10224
- C:\Windows\System\Mfgqowy.exe
  C:\Windows\System\Mfgqowy.exe
  2⤵
  PID:9664
- C:\Windows\System\wiEDgoI.exe
  C:\Windows\System\wiEDgoI.exe
  2⤵
  PID:9776
- C:\Windows\System\DYAYnno.exe
  C:\Windows\System\DYAYnno.exe
  2⤵
  PID:9824
- C:\Windows\System\lmmaCfd.exe
  C:\Windows\System\lmmaCfd.exe
  2⤵
  PID:9892
- C:\Windows\System\ifoexQe.exe
  C:\Windows\System\ifoexQe.exe
  2⤵
  PID:10228
- C:\Windows\System\ANcvIlI.exe
  C:\Windows\System\ANcvIlI.exe
  2⤵
  PID:9488
- C:\Windows\System\jEiMKXI.exe
  C:\Windows\System\jEiMKXI.exe
  2⤵
  PID:9632
- C:\Windows\System\NZgUoFr.exe
  C:\Windows\System\NZgUoFr.exe
  2⤵
  PID:9968
- C:\Windows\System\VPsDuWM.exe
  C:\Windows\System\VPsDuWM.exe
  2⤵
  PID:9248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BvArQPa.exe

Filesize
2.0MB

MD5
612a35fb477ba08387ed43c8416933a4

SHA1
fbe2f84c3a5371e2e6892abe7c52a9cb07015e8c

SHA256
92934330ad5fd6c792fcc7eb15fb81205e2290f07f688d2d447af640e0a259e3

SHA512
7eab061e308772a88a16bd980b582ef047fd423a315cf3cf82c9455b26d477cbf7ad2bd2c0a09666bf7eb3ee06cfca3238eeb77782acea1128ee94604c8e3db1

Download Submit
C:\Windows\system\GoluTcc.exe

Filesize
2.0MB

MD5
5cc15e874bd7adc99d027c4dc38b3cdb

SHA1
906eb3966e62da075d7372cd50e979e86905e850

SHA256
640bfaf46e3cd02220cb2be76bb53e12fe5b763a41290abb3dadb5421a3f0b2e

SHA512
798e2228e9c3c6af6dc45ef4bdfcf3a0469b4d710e2d4026f630cfe4c1706996b581eb2c4b02ba5b48ec14245d8ef16f073118e5021d9618298e11da606257a9

Download Submit
C:\Windows\system\HYLDxPW.exe

Filesize
2.0MB

MD5
0832c3699e19a365fd7c8bf550250cf0

SHA1
1cba936bdf42a50e1a5ddc71aa0aa819d225a878

SHA256
0da38ab60d0e1f0f3eac5055ab02fd028b6de7587b745c3983655e96a5cd53c8

SHA512
2a31275911906567e15108babb81462d91a5c27705a21baf1f1419dbdcfa49a8ea328cfbe8faf39dd8703e21081165e7a66c0d319dcb8da266412374ea9bd556

Download Submit
C:\Windows\system\IXDDtLj.exe

Filesize
2.0MB

MD5
8d7ab939d5bb4d28308eace89c9727a3

SHA1
f37b1562ef9c0ba70f4febe3736a01a24b9ea0f8

SHA256
5174abd6922dd8d0d51ef0d76703f5c1a0e01b03d0caeee12fbd8b0769107279

SHA512
7d7a0560ee59f29aa0781623ae8406fc6bec221f9153f3bbf7019777fa847cf8a7b8cb2ecc864cfb64028db8595b0c39f015bdcea275eaa93e009719ea3b4cb6

Download Submit
C:\Windows\system\MnGtgRR.exe

Filesize
2.0MB

MD5
88f9ae222d1ae40926b979da54f80a65

SHA1
ce6648f33171f21cb40237a71ed76348fa38892a

SHA256
2594323393894daa82a33677252aad878f48f49642dbbbb0f5ba2dc006c3d162

SHA512
1ab550ab59f02337628962bc87acb864958d902d8f30c921d16aec292997d492c0a4ee4f71d70027cf7330db34b64937b7cdce6254fb23b548e96e832c8b7029

Download Submit
C:\Windows\system\NGBfTtc.exe

Filesize
2.0MB

MD5
3b876fc2aabcd44f42835e9de64e97c3

SHA1
a4effaefc753015e4b7e35abacc4cd1711a15918

SHA256
4354f9870eb9a62fcf93a592c3cbbcb8eb25675bc25e31409e58455b5c7a2583

SHA512
4486c926cf2188d2eac490179dfa8791219748bf7651288636b9ed38d4a443ba0ae340dd8701f2d0641c169f05d4d9abd1e5b791f145a8b46c6acfbfb46ecd2b

Download Submit
C:\Windows\system\TTizbbA.exe

Filesize
2.0MB

MD5
7453e3f83c4ea9201aef294b6894ed20

SHA1
7e3623e6eb64bedd2217f9152a58e5f06bdc140e

SHA256
cb82006258c040308f8fc741044ca16b6a0a10bbd2c8d64914ec6dec7a4be747

SHA512
88967b085d9021eb593587b44a5e30d85a19f2c94232089943e5fdf14434ad7fd2e8ca2f73a26aa61a0459da9a1ba7691243cdcc9e68c0ceab5a0620901d7db1

Download Submit
C:\Windows\system\UecEXEq.exe

Filesize
2.0MB

MD5
5cf1fd88b5345c02d263af5e1bd90224

SHA1
3858004db195a41d6459bd088e9eeee80e4cafcd

SHA256
c1f0a95d5627ace8810322219a5f1069fcb1a1c021859e0ca489ecbd8f88c552

SHA512
f1f523399f16991f87467b9142eee820e0b227f899fc74fda2f6f3641d29552314a23fa74a0f0bb447453e6d1a31782e2805059c879fbfd5d38d5fa4c34ff636

Download Submit
C:\Windows\system\WUxfNNI.exe

Filesize
2.0MB

MD5
ca5c089893a7f0375319a463986a01ec

SHA1
0937349b9f70c5620a8604c2ec5068e08ccbf62a

SHA256
1204ca32ada7fba27883f3cf640abab4176e9cabd8012b09ed1f591a3b01004b

SHA512
2cdc14aa2a0d07cf9c7f35f983d9456d75f16f7d4e3282c30fb226e83d39aeefb34c8d7c9ddf3a84ca4e007d0553d77e9c1d0c040e5d1d5c138f7932bf09d3d3

Download Submit
C:\Windows\system\ZwfpdYn.exe

Filesize
2.0MB

MD5
18706024dc449af7bde644d29573cc0b

SHA1
e6a95db7ebd99a578c7bac386b41a37b71827a6b

SHA256
f59e2ccfd0ee927f9a6d547d6ad0f4a5e603f59994d0c656b3dd005da0620945

SHA512
6e03bf340def8e85a788d8efb76d58e04bc580d8dd6cf6cf6d4db8ab613b9732a95c75e328b48dfb2e120e4c0a31f09fdb4295bd052a7b2d306a26433e03097a

Download Submit
C:\Windows\system\aGtpMIv.exe

Filesize
2.0MB

MD5
3d65b7bc7ba71924b127aabfd71daba9

SHA1
be42b3c44e107daecfc6229aa54223238f04ad9f

SHA256
ae3f569b54bab7f7560c85d931612eed73bc12acfa9a8aae4048ff9b9415d667

SHA512
f610258aa6c9029ad530490243ef5d972bd88521fd1a344ced47f90b495d971be01a0d65218eebb0ffe4adf3c51673354d2a43fcd3bd8df97cb786bedd3e199a

Download Submit
C:\Windows\system\cdUCBii.exe

Filesize
2.0MB

MD5
dad266015fb71e2ac46854ddf57d4b54

SHA1
9573b5c71f4479431af00e918962f11157054ad9

SHA256
dca0100dbab22b1b6e6f8c266d5c45f0ee3f3cd1d7feb462bc8ea9c39de2bb6a

SHA512
9d71ae770d1bcb9b41ad4788ec8a37f122439104f378b269ac4b75a2f1db2ec75ceeeee3595549b38db1d6111d9eb4baa3b579e4b048dcb0befba919c0d8c491

Download Submit
C:\Windows\system\hexYqEN.exe

Filesize
2.0MB

MD5
84bcb6ee3d298eaf46a0085f3c7ed677

SHA1
de3e4f96946b372e5f1055cf8b87c8277137647f

SHA256
79434e1e4bb8648e45c4b447d68777f6ca4c8332c91d50a69453a4f61b41bc61

SHA512
1d48d6b8fac059984ae75c0be3b029a3d2742d6512681e3180945ae01018641d3b54014af626ffbe8074aea008c24f9e4b50a2db6606c9261b3505248e9f4718

Download Submit
C:\Windows\system\hkrImJU.exe

Filesize
2.0MB

MD5
7762e0a8827682101e4962d7abd47360

SHA1
49f57288baaae36404aad4cb94e0ea692e2120e6

SHA256
eadc21eda9edd0db425be2bb4469d3d34f2054adb0de870e623b9bbd19a592aa

SHA512
d0ac203a31994194d3a3982d6cd4472eab30385fe1119cc89d20aaf8315a5833f892f97c5d584df81ffc5769b7e500c25883f32fe147ba6dd205467151e3062c

Download Submit
C:\Windows\system\mmUniwA.exe

Filesize
2.0MB

MD5
0d963efc4aa0d5d91dd99ab953c00d22

SHA1
5c4197a962d7c03d4b79994f562453bd764335c5

SHA256
38eeca66fa9b12367452475e10aebe0165c75136b76be0e574ca29cde0e956fe

SHA512
fdc32c14e0d2eee054a2738109d5ddb9b95a922a6f6b9d4431f2bc09a380dd7a07ceb5d6f74c307f6440e36baf4fc63650362eee0ce34c73a1aec2d5929093cd

Download Submit
C:\Windows\system\ntkTJsM.exe

Filesize
2.0MB

MD5
697ee216c16466f7fa466f94d8bd4fc3

SHA1
46f0e37b4a20cb33aec52455291893aea9af254f

SHA256
32044816a134caec3d311759e9babecdb7905007db9ac6754de466c211ddf013

SHA512
ace6f361419d3587ead82eacccae9578f35c67b14452c2d167a79dd297d3e7cf4ec4529935c92bac35ce90dce67e2040649828dfe1fd67af35fd18228cd95b6f

Download Submit
C:\Windows\system\oXrgDUg.exe

Filesize
2.0MB

MD5
815c2bd84d0d600b93e8da17eaa558d1

SHA1
f7ec6747ba2be4390f8c7e52450a1ba158da7340

SHA256
5ee6032f35b23b0db49413a91ec653a62be7a142d9394bb28821013bdb42f4de

SHA512
8f25a8173b0212ea811675df87de0683242b65a1c06a20b756a3452f3c01547b8ca9468edfa4cbf687dc763a2816766e4246ed5c15ad07bd621c4ce828e1ff2a

Download Submit
C:\Windows\system\uXzGLeE.exe

Filesize
2.0MB

MD5
1d6b2f7bfc901d941250409a821145b2

SHA1
ae556e5edd599f68abb035f632727abeeaf9c329

SHA256
0c7c613bb3e9540585bb370baf29dbe23bafce7dfc30f88ab5c1a62884f64b3f

SHA512
54474d6e9b8a6a6a0009f67a61e64af7a2b507909b221968bec46858c5d8429fde193feab17b999aefdf0ab20adf60f722ce999edaf53cee97d631173f8fdd0a

Download Submit
C:\Windows\system\zVlTfon.exe

Filesize
2.0MB

MD5
8c80733c6c7a5f48a603743f87e1fc60

SHA1
00d7ec257baae437b315b970c36458ec13361556

SHA256
1f77106aab53a078565ae1b324bfa36eba4090d926eb8bb4dc6e067c3a326bf8

SHA512
b2bf2798c57acd2f8e08efaebe8f10579fc31573f76f84a8ceb23731f9339c77fe436a9cdb9c8cd8b9bdf3155b781c6cde9122cc9d46bdc57e5efc80288aa9b9

Download Submit
\Windows\system\EDaBMhh.exe

Filesize
2.0MB

MD5
3614aafce20e8acf134b700b3cf746bf

SHA1
3d1f0332cfd037adbced959b8dd560329165519f

SHA256
2a11e1c10924be57b0b612b3a181e6d521bb29a1f23f669f774be964ab5a1b59

SHA512
6e013121e9a682d705932c1844339e94df3cdd6ebbddcceef4c36a1902bcb753ea70a8941084ef52d70c90c005bc6c90bdd74b4f1e197187a24d6c51288cec36

Download Submit
\Windows\system\GjLQpzr.exe

Filesize
2.0MB

MD5
c014e3641d24270505b0471b14bec8c3

SHA1
1374d3e0321d41e87adef0a48d25e1dc1c52801d

SHA256
5cdf4a0b40dc346dc1ba1b039d4ff662bcb61123363df919f9445f36543f8008

SHA512
80361885ab8e6ac21bcb1eb2e86c10efbd8050e155a0258be2b5dd44716a169e0368f02b5af27ed494f64812c415bbfb45d8e70bd61bde5a95091b999a318bbc

Download Submit
\Windows\system\IPmRvfS.exe

Filesize
2.0MB

MD5
6afeccd4170690be2d5128556036c341

SHA1
d332e2fd565906db3c33c7d6ff485685ecf8bbc7

SHA256
ab611006dd20d7072eb6e7fc3b80e903a59819ce1cc0c6f46b28a16eb0d0d48d

SHA512
2e69e6bf111c8f6be43ca0821e9e88e74f2879b8b60d61df70aea1f7597cb25ae7965502a0698e060a0133bcdb9000538a075290131371828f9b3cc53e50eed1

Download Submit
\Windows\system\IzoWuiI.exe

Filesize
2.0MB

MD5
71e84a234388cc773132abf22e0ad344

SHA1
4edd4044ecf9302e4f829eb58ef9b2e034e7d5e3

SHA256
d3aa2a2c3e644d65beafba7dab61bdabc6536d49878b1b0f88a075a585d1f2bf

SHA512
8a74f25566d2c78ab9729c612ba7a40aedb22cdddc8d1d2fac26eed846bdb7feff1e8b95252448765daea26563fc61a3845be824c1f04a004af0d70e42d0d068

Download Submit
\Windows\system\JswUhrv.exe

Filesize
2.0MB

MD5
1f594b1964a7e21c1915e7934fcc5289

SHA1
588f2a61367712ad9a8eee3df5ddfb335c37d8ef

SHA256
3f694e527ae67eece70e72c5b4cc6550aeac0173da33f3478d13b5ad2c45143d

SHA512
798343d7d52d18a5fb5317ec5c0e37d441933694eafdbb48b2df9e382eb2c8a41ae30b2cbecbc2da833f94bab7ae201842198d43f6cfb43787c9749dfdc32413

Download Submit
\Windows\system\WDHszeR.exe

Filesize
2.0MB

MD5
b76cc7d3c910d854b387295ceb40e83c

SHA1
5b194851f6d478b2c236a16534efee9263531cbe

SHA256
8f66ef877d58595058289070c277676ed90395011d5b2eb9479b191a790798ec

SHA512
eccbe49ff3b7056495864d58c5e48ecfade76f6c2229cb52ec4fa9728ac9ea41ebd90af3a69a7d830378a873914e386698ae6789bcdddfd17e2740e2bd0b6e4f

Download Submit
\Windows\system\ZCPTYeX.exe

Filesize
2.0MB

MD5
84bc97b124b6cea3de2274eab437da56

SHA1
73d9d2bcbd2814b4d8e3e4385084e6b67fdd216b

SHA256
327bc5393818b5622614b0c2dbf10553fcb08fb47ff8334a6dcdcc84b45dc2ce

SHA512
2098524aa10b8b5b8a5ac6f8bba48a602647b5da168ae6cc637042c715d52d4f23daa92c085d1376f11055441b07258069e1da53f3bc24e4cf2c6b6b8900b4fa

Download Submit
\Windows\system\buNmGPt.exe

Filesize
2.0MB

MD5
c39e41f7e791dc1a05e7b01e59e5e2fa

SHA1
edc08bf866b1ac272c6fefae30d5abdb7d98c69b

SHA256
edb0b7a58f3baab76eec367905ecdfc94ce381a8076f6c628c7d0bca2305aaaf

SHA512
c462c415bf122d10f7fea540a94bf19bc64839017a8081aceb49fa4d18bf1c73fbfe6cbe622a4439498bdf03d41341985e600f51aef699f7ba1c692e3d84b6bc

Download Submit
\Windows\system\inLageF.exe

Filesize
2.0MB

MD5
e81ceca324f09a150b7cd372c5df47de

SHA1
dd42a07340423c498f33343f0aa6dc40a86f393c

SHA256
9e1acdd3752635e49cff16b75fd8fdcecb7ff3d65e787abfe17046d161f592ed

SHA512
e6f10f329091f5d3e2a9dc23bdc1cd159f948259bc35934bad61f0d6669e456f46459440c1585cb0203dc0f56d3a3cc697acada4a835dda147a37eeaecbb7791

Download Submit
\Windows\system\nFTyWXK.exe

Filesize
2.0MB

MD5
47342cc317f6074bd7e2f3b8289dd417

SHA1
5328e7a7b518f0e510c64282f8be6ae546775279

SHA256
abddb8631e1f83695c7d038255b0afa56d66b644e5bb717cd2a375b37b93041f

SHA512
d0f699b1af2030e46d3a1a79970d337fc03f95bfddae9857287d8f624d9d52dacd63b3aadcc8bf440f5ad29d6cf6dc8a9381902fa0bcd9176c374494160b88fa

Download Submit
\Windows\system\pHrysMd.exe

Filesize
2.0MB

MD5
869e16c40ba52d293a3ecc1142b05ef8

SHA1
08c8320fb8768912ba64c1d8f77a6419aa08ab08

SHA256
168781d9752324fd24fb2bb8464f7f18d8f04a76241ad7e565d677d48ad0eca3

SHA512
3b6db44395e511d1ac1a74df884e6a65560b2a270b76f6520db702245998199a1e0ea3a278d35282527ac7e50bf59c59e3c129b88b1c5107b4c34e9f6f6bec42

Download Submit
\Windows\system\pmSFFoj.exe

Filesize
2.0MB

MD5
79ec198850a410dfae08d9ae1da4db0e

SHA1
deddf7e855bfcdac038dc768c4359cc2f0be0146

SHA256
91d67f4c823caf6a9464924213ff7b7009c49ab6cd1847215e5954e649d3fc64

SHA512
9804b099b7eec35e510f05e762988561e71380036d0d05b0e4c74bc31aead661559212171db0a670cb2d2c81aeea19bd43b9bb3e1c18cee9c1be70e2ae4b99cd

Download Submit
\Windows\system\qeACufe.exe

Filesize
2.0MB

MD5
2580d540fd26532bd52ac0515bbd881c

SHA1
f0a7e6a5d129097847db2c1898d90cc286fc493c

SHA256
53df33f1e8d089a5b17bb9946b409695e0e82f615a50298cf51e4aeca8dce002

SHA512
37ea5f6f8ff255bf343f425591f3ab3acfc9c5cb319a3b7f42367aec2f0c9ed29b61672c226c2ab614a19b8e47df14bb5b93708a1b5b400d1ebc64c8fa084af3

Download Submit
\Windows\system\qjNTJHz.exe

Filesize
2.0MB

MD5
e890ba458d3bbba2fa735a0d0ef2853a

SHA1
d078eba1b953891ee8bf599247d3322a2876553b

SHA256
0bc480c223fbb9457e61fd1b0d5dc4c2b4356526b21d417e2603f93e8be752f4

SHA512
6d43ee8712a8dd66483fb67209490bbf895e1fa74f6f377041d56e98c02729ed766b70e69b8f1f68026b355be886e17bc817045414cfbede220e25c63b249851

Download Submit
\Windows\system\rcMevfO.exe

Filesize
2.0MB

MD5
a900f0f70fe20c3ce8e75b9022a3c358

SHA1
168cf81c647f71f60c28c9e2451a3723d300f843

SHA256
eb4c7a69ebaf87829da2ca452f819b2236d134c868e05891e1fe01f96de9aa2c

SHA512
20381f19ae3b136770339b30f70e69615969fe763fd1685cb7e258f66e6f2870a52af9178c5e4c0bcf6c41d7d869e1043b116ababa476051ee96f412942e038b

Download Submit
\Windows\system\ruTuBfc.exe

Filesize
2.0MB

MD5
e34ebe989ede3d7c9423fc1bf53f2811

SHA1
a2ef7a57a6fcbab2f2e1e3aaf519a80f37489892

SHA256
9d3a1ec26db840932880e64b04818f2142e60da259785466ce5415e808054891

SHA512
723d23809918ffa5cc60a36161f6ae8546ab0c30a4626de00373bcf3d8b53d401b6b07e1877505ef180f071c0742b8c6fa7fce9873a2a4fbcb3f79d664387acf

Download Submit
\Windows\system\uhigfMU.exe

Filesize
2.0MB

MD5
af2f3e61cabf81e4468f5c6c9979f642

SHA1
796cc58dc33ccb2f10adc8be3ba14f580f7fef3f

SHA256
e0ff456d843dc00123de06679333ce4a1ac7d26b11f21136cc5969184c4a869d

SHA512
1f5a784b6ef6c48ba2155be5f4ac4eae3a4fd0558f78c2134b18a7261eb92fba012ad33e5c9be4177c5818580d2f3b34b79de48c6968d7f4cbf412983f68c3a9

Download Submit
\Windows\system\vxsSfLZ.exe

Filesize
2.0MB

MD5
d952253d6e8390142df000ed338f6e73

SHA1
453a548b3e181d74fa3fe87f258b5d20fe1a5ddc

SHA256
f338ec67e39c4ea6a4af1ceeb05ba0fd68c1667d8935fdfc851fda6fb727be5e

SHA512
43f33131048397b92523fc65a1985731b540a245f221ec8f82fbe84d8ff368978550b394cc8cc16cdebebee108bb0e97739f3393012df883d546eae409297076

Download Submit
\Windows\system\xBSTtVy.exe

Filesize
2.0MB

MD5
f8c9a2175030abce512b2c6b74e83b14

SHA1
1dcd1550fbaba3aac58a5d18bdab08f435ba86ed

SHA256
d92ac3173a1cf5964edd7736e54dd2ee5e2d3f67620fc6af2c40945043b46356

SHA512
6c8dbf164466f22de56f7f6f3c6ea5abcb2a2ca7c2ea0001d5b242563900430055e2acd173bf9eef1e6ff301ec5bbc1a9981123ee7e0cedd3502e5d3e1fe33c8

Download Submit
\Windows\system\yjHYtUj.exe

Filesize
2.0MB

MD5
3498ea01b821629e6a2185c7d1f870cd

SHA1
4a893219e243d24b168a82f587437f586f7eee5c

SHA256
f47194623e7e9892bed909bf638eadae8b0f3f386ebd4813c63b3ac5095689ad

SHA512
6202574707f180bc65f1d4f6e56b30687d2acdeb14ca9ca11ddc07937f09bc08d7135d67c719f05b84fe6af370401124ca7e25d888f78ee36d6b0fe060fff91b

Download Submit
memory/1652-83-0x0000000002620000-0x00000000026A0000-memory.dmp

Filesize
512KB

Download
memory/1652-45-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/1652-46-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/1652-32-0x0000000002620000-0x00000000026A0000-memory.dmp

Filesize
512KB

Download
memory/2172-69-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2464-60-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2464-618-0x000000013F820000-0x000000013FC12000-memory.dmp

Filesize
3.9MB

Download
memory/2528-92-0x000000013F110000-0x000000013F502000-memory.dmp

Filesize
3.9MB

Download
memory/2536-68-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-35-0x000000013F9E0000-0x000000013FDD2000-memory.dmp

Filesize
3.9MB

Download
memory/2660-27-0x000000013FDA0000-0x0000000140192000-memory.dmp

Filesize
3.9MB

Download
memory/2700-30-0x000000013FDB0000-0x00000001401A2000-memory.dmp

Filesize
3.9MB

Download
memory/2728-42-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2728-91-0x000000013FAA0000-0x000000013FE92000-memory.dmp

Filesize
3.9MB

Download
memory/2756-80-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2868-34-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-33-0x0000000002D50000-0x0000000003142000-memory.dmp

Filesize
3.9MB

Download
memory/2868-7-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2868-76-0x000000013F520000-0x000000013F912000-memory.dmp

Filesize
3.9MB

Download
memory/2868-88-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2868-44-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2868-65-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2868-63-0x000000013F4A0000-0x000000013F892000-memory.dmp

Filesize
3.9MB

Download
memory/2868-61-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2868-1158-0x0000000003430000-0x0000000003822000-memory.dmp

Filesize
3.9MB

Download
memory/2868-79-0x000000013FB50000-0x000000013FF42000-memory.dmp

Filesize
3.9MB

Download
memory/2868-31-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-40-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-28-0x0000000002D00000-0x00000000030F2000-memory.dmp

Filesize
3.9MB

Download
memory/2868-0-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/2872-93-0x000000013F940000-0x000000013FD32000-memory.dmp

Filesize
3.9MB

Download
memory/2896-81-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2916-17-0x000000013FC30000-0x0000000140022000-memory.dmp

Filesize
3.9MB

Download