xmrig | 97f1e6601b4433c239b6b3c8121fd045d4a0fecd5a42b1c96a27e9d3fb77546c

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
Size

1.7MB
MD5

103710c3aa58bb82a2e3c93390dc2d13
SHA1

6cfa4e99ed09f69c991ef727d1a30d8ec13d17e9
SHA256

97f1e6601b4433c239b6b3c8121fd045d4a0fecd5a42b1c96a27e9d3fb77546c
SHA512

32cef3413358ce3c5079d41ab92bead74eaa692ed08b3a84c2ea9ab27dd2474219b4e4eec2959428bbc50e25ceabe9251ebda90ee5197f8b35e84dd8b4dac6d8
SSDEEP

49152:Lz071uv4BPMkibTIA5I4TNrpDGgDQvyyo5:NABs

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2472-64-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	xmrig
behavioral1/memory/2464-74-0x000000013F050000-0x000000013F442000-memory.dmp	xmrig
behavioral1/memory/2536-76-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2644-81-0x000000013F800000-0x000000013FBF2000-memory.dmp	xmrig
behavioral1/memory/2428-83-0x000000013FC70000-0x0000000140062000-memory.dmp	xmrig
behavioral1/memory/1032-99-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	xmrig
behavioral1/memory/2888-78-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/2740-68-0x000000013F710000-0x000000013FB02000-memory.dmp	xmrig
behavioral1/memory/2668-61-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	xmrig
behavioral1/memory/2684-59-0x000000013FF60000-0x0000000140352000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2920	hAMEkyQ.exe
2684	outwTjS.exe
2668	PqiJRVv.exe
2472	iJBNThe.exe
2740	JTeWXBQ.exe
2644	UGAtBVM.exe
2464	rnGHpAm.exe
2536	iUrbusu.exe
2888	CzZevqG.exe
2428	CCHPZQV.exe
1032	nDCQVLM.exe
1684	qdmfGwR.exe
2180	hJKtKCX.exe
2772	qVLzYbS.exe
768	ZfTvpmQ.exe
2376	VPCtKBT.exe
2396	gvgMzmf.exe
2852	BoJTuBo.exe
1448	krDjRDZ.exe
2016	sQHbNfG.exe
2088	zumZsXT.exe
2640	iDheDUl.exe
2820	JAsemLV.exe
2808	mMdyjLD.exe
596	jENKyHg.exe
576	lonmafP.exe
1504	ZFadvJG.exe
1496	ggzrEpu.exe
1876	PfHGcoH.exe
2436	PchduXK.exe
1152	mjBuJJu.exe
2160	QJBuCFK.exe
348	TsKcwYv.exe
1832	dxoAGjE.exe
2208	ATaJCYW.exe
1388	aHnniHX.exe
2124	bcVCFWz.exe
2044	qXmJbdY.exe
1828	bOiffGu.exe
964	ReihAQW.exe
2832	TYEknpJ.exe
2008	vbGfiET.exe
2256	WQmCaIe.exe
1680	ucyctkR.exe
1248	RNBchmn.exe
2056	LoTbVeh.exe
1004	uCReJsh.exe
1524	RPfcCBk.exe
2228	oBFZTii.exe
1276	oAZIxGD.exe
1412	EpSdAVZ.exe
1592	ReXETrh.exe
2944	tEnWQGc.exe
2592	TFmYvNS.exe
2588	hqYgGYc.exe
2752	CUNxOts.exe
2688	sPpNgyw.exe
2508	ZwIOUvf.exe
2480	WiAqRzG.exe
2708	BDjLgZH.exe
2620	loTBKbN.exe
2712	bpheftf.exe
312	TotNawV.exe
1820	htXnUKB.exe

Loads dropped DLL 64 IoCs

pid	Process
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2784-1-0x000000013F360000-0x000000013F752000-memory.dmp	upx
behavioral1/files/0x000d000000012324-3.dat	upx
behavioral1/files/0x003100000001341c-16.dat	upx
behavioral1/memory/2920-12-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-20.dat	upx
behavioral1/files/0x0009000000013a3a-24.dat	upx
behavioral1/files/0x0008000000013a46-25.dat	upx
behavioral1/files/0x0008000000013a6e-29.dat	upx
behavioral1/files/0x0008000000013a84-44.dat	upx
behavioral1/files/0x0008000000014597-51.dat	upx
behavioral1/files/0x000600000001469d-54.dat	upx
behavioral1/memory/2472-64-0x000000013F5D0000-0x000000013F9C2000-memory.dmp	upx
behavioral1/files/0x00060000000146f4-70.dat	upx
behavioral1/memory/2464-74-0x000000013F050000-0x000000013F442000-memory.dmp	upx
behavioral1/memory/2536-76-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/files/0x0033000000013420-86.dat	upx
behavioral1/files/0x0006000000014712-91.dat	upx
behavioral1/files/0x0006000000014826-100.dat	upx
behavioral1/memory/2644-81-0x000000013F800000-0x000000013FBF2000-memory.dmp	upx
behavioral1/files/0x00060000000146fc-112.dat	upx
behavioral1/memory/2428-83-0x000000013FC70000-0x0000000140062000-memory.dmp	upx
behavioral1/files/0x000600000001487f-103.dat	upx
behavioral1/files/0x0006000000014b18-117.dat	upx
behavioral1/files/0x0006000000014bbc-134.dat	upx
behavioral1/files/0x000600000001565d-161.dat	upx
behavioral1/files/0x0006000000015c87-179.dat	upx
behavioral1/files/0x0006000000015cae-189.dat	upx
behavioral1/files/0x0006000000015cb6-194.dat	upx
behavioral1/files/0x0006000000015c9e-184.dat	upx
behavioral1/files/0x0006000000015684-175.dat	upx
behavioral1/files/0x0006000000015677-168.dat	upx
behavioral1/files/0x000600000001564f-155.dat	upx
behavioral1/files/0x0006000000014fa2-152.dat	upx
behavioral1/files/0x0006000000015653-159.dat	upx
behavioral1/files/0x0006000000014e71-140.dat	upx
behavioral1/files/0x000600000001535e-145.dat	upx
behavioral1/files/0x000600000001471a-121.dat	upx
behavioral1/files/0x0006000000014b4c-129.dat	upx
behavioral1/memory/1032-99-0x000000013F7E0000-0x000000013FBD2000-memory.dmp	upx
behavioral1/files/0x0006000000014a9a-110.dat	upx
behavioral1/memory/2888-78-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/memory/2740-68-0x000000013F710000-0x000000013FB02000-memory.dmp	upx
behavioral1/memory/2668-61-0x000000013F2E0000-0x000000013F6D2000-memory.dmp	upx
behavioral1/memory/2684-59-0x000000013FF60000-0x0000000140352000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wTSJfDa.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\iGZUNva.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\zZloEBI.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\JbLhedw.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\egWXyVk.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\VFcylUB.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\PHUZSel.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\sOpXJEp.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\xSphDmL.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\VGGgTlD.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\gwUABsX.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\keGPuGy.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\ZsYeFZy.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\iUrDpus.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\bDdFXYO.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\onCAKcy.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\VrCmMWP.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\zzHJjpg.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\kDAwvdr.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\YgEWYSb.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\oPBSsvA.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\LOKQaCS.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\TEItitj.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\wtZaOTx.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\alhpoLR.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\TUvASyv.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\GIUakEf.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\mdQclau.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\HJwDqth.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\sJkbcfx.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\gHmuOpa.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\euPwFPL.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\igbOyYr.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\IYQlgkh.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\KXEvisT.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\wabplNa.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\gPtiGid.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\UqGmFTz.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\PekuYtA.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\wKhIkrD.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\yMbWguR.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\OYYdRrY.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\VIqVdSJ.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\wmamNed.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\CGgQzLY.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\aCmzjOt.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\eQpklYA.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\VwLvRUC.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\JqASsya.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\RcMaxhC.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\MPCDKmP.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\WIlHghT.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\yYkKXNu.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\SZkcXID.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\PGftACX.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\gNewXnY.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\JnefZCp.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\CCHPZQV.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\ENSudQN.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\uUQYdTU.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\GZJCJRF.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\cmWkPan.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\bDuEhol.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
File created	C:\Windows\System\FEAVLnT.exe	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3068	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
Token: SeDebugPrivilege	3068	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 3068	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	29
PID 2784 wrote to memory of 3068	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	29
PID 2784 wrote to memory of 3068	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	29
PID 2784 wrote to memory of 2920	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2920	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2920	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	30
PID 2784 wrote to memory of 2684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	31
PID 2784 wrote to memory of 2668	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2668	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2668	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	32
PID 2784 wrote to memory of 2472	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2472	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2472	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	33
PID 2784 wrote to memory of 2740	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2740	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2740	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	34
PID 2784 wrote to memory of 2644	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2644	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2644	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	35
PID 2784 wrote to memory of 2464	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2464	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2464	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	36
PID 2784 wrote to memory of 2536	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2536	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2536	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	37
PID 2784 wrote to memory of 2888	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2888	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2888	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	38
PID 2784 wrote to memory of 2428	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2428	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	39
PID 2784 wrote to memory of 2428	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	39
PID 2784 wrote to memory of 1032	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	40
PID 2784 wrote to memory of 1032	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	40
PID 2784 wrote to memory of 1032	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	40
PID 2784 wrote to memory of 768	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	41
PID 2784 wrote to memory of 768	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	41
PID 2784 wrote to memory of 768	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	41
PID 2784 wrote to memory of 1684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	42
PID 2784 wrote to memory of 1684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	42
PID 2784 wrote to memory of 1684	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	42
PID 2784 wrote to memory of 2376	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	43
PID 2784 wrote to memory of 2376	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	43
PID 2784 wrote to memory of 2376	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	43
PID 2784 wrote to memory of 2180	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2180	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2180	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	44
PID 2784 wrote to memory of 2396	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2396	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2396	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	45
PID 2784 wrote to memory of 2772	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2772	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2772	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	46
PID 2784 wrote to memory of 2852	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2852	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	47
PID 2784 wrote to memory of 2852	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	47
PID 2784 wrote to memory of 1448	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	48
PID 2784 wrote to memory of 1448	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	48
PID 2784 wrote to memory of 1448	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	48
PID 2784 wrote to memory of 2016	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	49
PID 2784 wrote to memory of 2016	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	49
PID 2784 wrote to memory of 2016	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	49
PID 2784 wrote to memory of 2088	2784	103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\103710c3aa58bb82a2e3c93390dc2d13_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\System\hAMEkyQ.exe
  C:\Windows\System\hAMEkyQ.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\outwTjS.exe
  C:\Windows\System\outwTjS.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\PqiJRVv.exe
  C:\Windows\System\PqiJRVv.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\iJBNThe.exe
  C:\Windows\System\iJBNThe.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\JTeWXBQ.exe
  C:\Windows\System\JTeWXBQ.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\UGAtBVM.exe
  C:\Windows\System\UGAtBVM.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\rnGHpAm.exe
  C:\Windows\System\rnGHpAm.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\iUrbusu.exe
  C:\Windows\System\iUrbusu.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\CzZevqG.exe
  C:\Windows\System\CzZevqG.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\CCHPZQV.exe
  C:\Windows\System\CCHPZQV.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\nDCQVLM.exe
  C:\Windows\System\nDCQVLM.exe
  2⤵
  - Executes dropped EXE
  PID:1032
- C:\Windows\System\ZfTvpmQ.exe
  C:\Windows\System\ZfTvpmQ.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\qdmfGwR.exe
  C:\Windows\System\qdmfGwR.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\VPCtKBT.exe
  C:\Windows\System\VPCtKBT.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\hJKtKCX.exe
  C:\Windows\System\hJKtKCX.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\gvgMzmf.exe
  C:\Windows\System\gvgMzmf.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\qVLzYbS.exe
  C:\Windows\System\qVLzYbS.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\BoJTuBo.exe
  C:\Windows\System\BoJTuBo.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\krDjRDZ.exe
  C:\Windows\System\krDjRDZ.exe
  2⤵
  - Executes dropped EXE
  PID:1448
- C:\Windows\System\sQHbNfG.exe
  C:\Windows\System\sQHbNfG.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\zumZsXT.exe
  C:\Windows\System\zumZsXT.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\JAsemLV.exe
  C:\Windows\System\JAsemLV.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\iDheDUl.exe
  C:\Windows\System\iDheDUl.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\mMdyjLD.exe
  C:\Windows\System\mMdyjLD.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\jENKyHg.exe
  C:\Windows\System\jENKyHg.exe
  2⤵
  - Executes dropped EXE
  PID:596
- C:\Windows\System\lonmafP.exe
  C:\Windows\System\lonmafP.exe
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Windows\System\ZFadvJG.exe
  C:\Windows\System\ZFadvJG.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\ggzrEpu.exe
  C:\Windows\System\ggzrEpu.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\PfHGcoH.exe
  C:\Windows\System\PfHGcoH.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\PchduXK.exe
  C:\Windows\System\PchduXK.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\mjBuJJu.exe
  C:\Windows\System\mjBuJJu.exe
  2⤵
  - Executes dropped EXE
  PID:1152
- C:\Windows\System\QJBuCFK.exe
  C:\Windows\System\QJBuCFK.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\TsKcwYv.exe
  C:\Windows\System\TsKcwYv.exe
  2⤵
  - Executes dropped EXE
  PID:348
- C:\Windows\System\dxoAGjE.exe
  C:\Windows\System\dxoAGjE.exe
  2⤵
  - Executes dropped EXE
  PID:1832
- C:\Windows\System\ATaJCYW.exe
  C:\Windows\System\ATaJCYW.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\aHnniHX.exe
  C:\Windows\System\aHnniHX.exe
  2⤵
  - Executes dropped EXE
  PID:1388
- C:\Windows\System\bcVCFWz.exe
  C:\Windows\System\bcVCFWz.exe
  2⤵
  - Executes dropped EXE
  PID:2124
- C:\Windows\System\qXmJbdY.exe
  C:\Windows\System\qXmJbdY.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\bOiffGu.exe
  C:\Windows\System\bOiffGu.exe
  2⤵
  - Executes dropped EXE
  PID:1828
- C:\Windows\System\ReihAQW.exe
  C:\Windows\System\ReihAQW.exe
  2⤵
  - Executes dropped EXE
  PID:964
- C:\Windows\System\TYEknpJ.exe
  C:\Windows\System\TYEknpJ.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\vbGfiET.exe
  C:\Windows\System\vbGfiET.exe
  2⤵
  - Executes dropped EXE
  PID:2008
- C:\Windows\System\WQmCaIe.exe
  C:\Windows\System\WQmCaIe.exe
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Windows\System\ucyctkR.exe
  C:\Windows\System\ucyctkR.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\RNBchmn.exe
  C:\Windows\System\RNBchmn.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\LoTbVeh.exe
  C:\Windows\System\LoTbVeh.exe
  2⤵
  - Executes dropped EXE
  PID:2056
- C:\Windows\System\uCReJsh.exe
  C:\Windows\System\uCReJsh.exe
  2⤵
  - Executes dropped EXE
  PID:1004
- C:\Windows\System\RPfcCBk.exe
  C:\Windows\System\RPfcCBk.exe
  2⤵
  - Executes dropped EXE
  PID:1524
- C:\Windows\System\oBFZTii.exe
  C:\Windows\System\oBFZTii.exe
  2⤵
  - Executes dropped EXE
  PID:2228
- C:\Windows\System\oAZIxGD.exe
  C:\Windows\System\oAZIxGD.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\EpSdAVZ.exe
  C:\Windows\System\EpSdAVZ.exe
  2⤵
  - Executes dropped EXE
  PID:1412
- C:\Windows\System\ReXETrh.exe
  C:\Windows\System\ReXETrh.exe
  2⤵
  - Executes dropped EXE
  PID:1592
- C:\Windows\System\tEnWQGc.exe
  C:\Windows\System\tEnWQGc.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\TFmYvNS.exe
  C:\Windows\System\TFmYvNS.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\hqYgGYc.exe
  C:\Windows\System\hqYgGYc.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\CUNxOts.exe
  C:\Windows\System\CUNxOts.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\sPpNgyw.exe
  C:\Windows\System\sPpNgyw.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\ZwIOUvf.exe
  C:\Windows\System\ZwIOUvf.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\WiAqRzG.exe
  C:\Windows\System\WiAqRzG.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\loTBKbN.exe
  C:\Windows\System\loTBKbN.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\BDjLgZH.exe
  C:\Windows\System\BDjLgZH.exe
  2⤵
  - Executes dropped EXE
  PID:2708
- C:\Windows\System\bpheftf.exe
  C:\Windows\System\bpheftf.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\TotNawV.exe
  C:\Windows\System\TotNawV.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\htXnUKB.exe
  C:\Windows\System\htXnUKB.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\CNmxKVl.exe
  C:\Windows\System\CNmxKVl.exe
  2⤵
  PID:2604
- C:\Windows\System\IseAzMJ.exe
  C:\Windows\System\IseAzMJ.exe
  2⤵
  PID:1800
- C:\Windows\System\yHmZgVs.exe
  C:\Windows\System\yHmZgVs.exe
  2⤵
  PID:2364
- C:\Windows\System\XpkmKQf.exe
  C:\Windows\System\XpkmKQf.exe
  2⤵
  PID:2216
- C:\Windows\System\iPJREzv.exe
  C:\Windows\System\iPJREzv.exe
  2⤵
  PID:1544
- C:\Windows\System\edeOjAn.exe
  C:\Windows\System\edeOjAn.exe
  2⤵
  PID:2816
- C:\Windows\System\gsXDtvw.exe
  C:\Windows\System\gsXDtvw.exe
  2⤵
  PID:1540
- C:\Windows\System\jSupHvH.exe
  C:\Windows\System\jSupHvH.exe
  2⤵
  PID:2112
- C:\Windows\System\iKbVFpg.exe
  C:\Windows\System\iKbVFpg.exe
  2⤵
  PID:2284
- C:\Windows\System\fTpEDed.exe
  C:\Windows\System\fTpEDed.exe
  2⤵
  PID:2276
- C:\Windows\System\tDUKYyf.exe
  C:\Windows\System\tDUKYyf.exe
  2⤵
  PID:1272
- C:\Windows\System\igbOyYr.exe
  C:\Windows\System\igbOyYr.exe
  2⤵
  PID:820
- C:\Windows\System\jraTuuy.exe
  C:\Windows\System\jraTuuy.exe
  2⤵
  PID:452
- C:\Windows\System\XfQoXPi.exe
  C:\Windows\System\XfQoXPi.exe
  2⤵
  PID:544
- C:\Windows\System\eqpxgjA.exe
  C:\Windows\System\eqpxgjA.exe
  2⤵
  PID:1788
- C:\Windows\System\kOLVJjF.exe
  C:\Windows\System\kOLVJjF.exe
  2⤵
  PID:1560
- C:\Windows\System\RTEFhGe.exe
  C:\Windows\System\RTEFhGe.exe
  2⤵
  PID:1044
- C:\Windows\System\oRKHJIA.exe
  C:\Windows\System\oRKHJIA.exe
  2⤵
  PID:2516
- C:\Windows\System\MhVFWzo.exe
  C:\Windows\System\MhVFWzo.exe
  2⤵
  PID:1008
- C:\Windows\System\KDHAlkt.exe
  C:\Windows\System\KDHAlkt.exe
  2⤵
  PID:688
- C:\Windows\System\BBgTTbG.exe
  C:\Windows\System\BBgTTbG.exe
  2⤵
  PID:2060
- C:\Windows\System\xsxtEzE.exe
  C:\Windows\System\xsxtEzE.exe
  2⤵
  PID:2288
- C:\Windows\System\zWqIIgE.exe
  C:\Windows\System\zWqIIgE.exe
  2⤵
  PID:2544
- C:\Windows\System\VyYUusZ.exe
  C:\Windows\System\VyYUusZ.exe
  2⤵
  PID:904
- C:\Windows\System\VlbcXvy.exe
  C:\Windows\System\VlbcXvy.exe
  2⤵
  PID:2900
- C:\Windows\System\OOudssJ.exe
  C:\Windows\System\OOudssJ.exe
  2⤵
  PID:880
- C:\Windows\System\iORUzAK.exe
  C:\Windows\System\iORUzAK.exe
  2⤵
  PID:1620
- C:\Windows\System\EpjBgYP.exe
  C:\Windows\System\EpjBgYP.exe
  2⤵
  PID:1728
- C:\Windows\System\PNbuXJQ.exe
  C:\Windows\System\PNbuXJQ.exe
  2⤵
  PID:2504
- C:\Windows\System\QGrrgqG.exe
  C:\Windows\System\QGrrgqG.exe
  2⤵
  PID:2600
- C:\Windows\System\yawUOqr.exe
  C:\Windows\System\yawUOqr.exe
  2⤵
  PID:2880
- C:\Windows\System\yrjzGsD.exe
  C:\Windows\System\yrjzGsD.exe
  2⤵
  PID:2400
- C:\Windows\System\TGEKlex.exe
  C:\Windows\System\TGEKlex.exe
  2⤵
  PID:1972
- C:\Windows\System\JpnKmva.exe
  C:\Windows\System\JpnKmva.exe
  2⤵
  PID:2380
- C:\Windows\System\LJUMlzy.exe
  C:\Windows\System\LJUMlzy.exe
  2⤵
  PID:2572
- C:\Windows\System\qUaNgom.exe
  C:\Windows\System\qUaNgom.exe
  2⤵
  PID:2568
- C:\Windows\System\tMAaYdX.exe
  C:\Windows\System\tMAaYdX.exe
  2⤵
  PID:1808
- C:\Windows\System\azxfdbx.exe
  C:\Windows\System\azxfdbx.exe
  2⤵
  PID:1716
- C:\Windows\System\NGxCRJI.exe
  C:\Windows\System\NGxCRJI.exe
  2⤵
  PID:2952
- C:\Windows\System\EeDFxqK.exe
  C:\Windows\System\EeDFxqK.exe
  2⤵
  PID:1856
- C:\Windows\System\uZhrmMy.exe
  C:\Windows\System\uZhrmMy.exe
  2⤵
  PID:2432
- C:\Windows\System\FwcdrfQ.exe
  C:\Windows\System\FwcdrfQ.exe
  2⤵
  PID:1104
- C:\Windows\System\YggAHty.exe
  C:\Windows\System\YggAHty.exe
  2⤵
  PID:2420
- C:\Windows\System\TEdjfeY.exe
  C:\Windows\System\TEdjfeY.exe
  2⤵
  PID:2108
- C:\Windows\System\yRTuNLz.exe
  C:\Windows\System\yRTuNLz.exe
  2⤵
  PID:2680
- C:\Windows\System\eXwVUkf.exe
  C:\Windows\System\eXwVUkf.exe
  2⤵
  PID:1848
- C:\Windows\System\hEhLDjQ.exe
  C:\Windows\System\hEhLDjQ.exe
  2⤵
  PID:1284
- C:\Windows\System\CmTqLjP.exe
  C:\Windows\System\CmTqLjP.exe
  2⤵
  PID:664
- C:\Windows\System\WwrAWUs.exe
  C:\Windows\System\WwrAWUs.exe
  2⤵
  PID:1064
- C:\Windows\System\LXUvIJO.exe
  C:\Windows\System\LXUvIJO.exe
  2⤵
  PID:1356
- C:\Windows\System\kiNmgcv.exe
  C:\Windows\System\kiNmgcv.exe
  2⤵
  PID:2972
- C:\Windows\System\pqLSWhB.exe
  C:\Windows\System\pqLSWhB.exe
  2⤵
  PID:2332
- C:\Windows\System\gDpJRbk.exe
  C:\Windows\System\gDpJRbk.exe
  2⤵
  PID:1908
- C:\Windows\System\mCZUIie.exe
  C:\Windows\System\mCZUIie.exe
  2⤵
  PID:1616
- C:\Windows\System\GIUakEf.exe
  C:\Windows\System\GIUakEf.exe
  2⤵
  PID:2608
- C:\Windows\System\lEuqppN.exe
  C:\Windows\System\lEuqppN.exe
  2⤵
  PID:1812
- C:\Windows\System\zDWKDCe.exe
  C:\Windows\System\zDWKDCe.exe
  2⤵
  PID:2792
- C:\Windows\System\LWmBVKV.exe
  C:\Windows\System\LWmBVKV.exe
  2⤵
  PID:2736
- C:\Windows\System\FTfRjAT.exe
  C:\Windows\System\FTfRjAT.exe
  2⤵
  PID:2344
- C:\Windows\System\xjLCgeR.exe
  C:\Windows\System\xjLCgeR.exe
  2⤵
  PID:2596
- C:\Windows\System\sDpSDMb.exe
  C:\Windows\System\sDpSDMb.exe
  2⤵
  PID:2460
- C:\Windows\System\JLOTxFi.exe
  C:\Windows\System\JLOTxFi.exe
  2⤵
  PID:2172
- C:\Windows\System\VEEMrvz.exe
  C:\Windows\System\VEEMrvz.exe
  2⤵
  PID:2268
- C:\Windows\System\AQNEyqr.exe
  C:\Windows\System\AQNEyqr.exe
  2⤵
  PID:2552
- C:\Windows\System\kbBkGRF.exe
  C:\Windows\System\kbBkGRF.exe
  2⤵
  PID:2656
- C:\Windows\System\gFDQnby.exe
  C:\Windows\System\gFDQnby.exe
  2⤵
  PID:2272
- C:\Windows\System\VrCmMWP.exe
  C:\Windows\System\VrCmMWP.exe
  2⤵
  PID:2348
- C:\Windows\System\lnvGEDE.exe
  C:\Windows\System\lnvGEDE.exe
  2⤵
  PID:1752
- C:\Windows\System\wDMSlMQ.exe
  C:\Windows\System\wDMSlMQ.exe
  2⤵
  PID:2660
- C:\Windows\System\ENSudQN.exe
  C:\Windows\System\ENSudQN.exe
  2⤵
  PID:2584
- C:\Windows\System\SzlBcKh.exe
  C:\Windows\System\SzlBcKh.exe
  2⤵
  PID:1396
- C:\Windows\System\qcZLLkS.exe
  C:\Windows\System\qcZLLkS.exe
  2⤵
  PID:3020
- C:\Windows\System\lbGXNEx.exe
  C:\Windows\System\lbGXNEx.exe
  2⤵
  PID:2148
- C:\Windows\System\KxrmJCX.exe
  C:\Windows\System\KxrmJCX.exe
  2⤵
  PID:2192
- C:\Windows\System\dDmwbIA.exe
  C:\Windows\System\dDmwbIA.exe
  2⤵
  PID:1824
- C:\Windows\System\fkJENzC.exe
  C:\Windows\System\fkJENzC.exe
  2⤵
  PID:1040
- C:\Windows\System\KGmUGeo.exe
  C:\Windows\System\KGmUGeo.exe
  2⤵
  PID:2960
- C:\Windows\System\rVbtkaU.exe
  C:\Windows\System\rVbtkaU.exe
  2⤵
  PID:336
- C:\Windows\System\MtFMGwc.exe
  C:\Windows\System\MtFMGwc.exe
  2⤵
  PID:2836
- C:\Windows\System\veCLcaI.exe
  C:\Windows\System\veCLcaI.exe
  2⤵
  PID:800
- C:\Windows\System\pDDOoOm.exe
  C:\Windows\System\pDDOoOm.exe
  2⤵
  PID:2220
- C:\Windows\System\uTPQohZ.exe
  C:\Windows\System\uTPQohZ.exe
  2⤵
  PID:3060
- C:\Windows\System\bsnUPVA.exe
  C:\Windows\System\bsnUPVA.exe
  2⤵
  PID:2560
- C:\Windows\System\IEMnvoX.exe
  C:\Windows\System\IEMnvoX.exe
  2⤵
  PID:2368
- C:\Windows\System\GUeLDhe.exe
  C:\Windows\System\GUeLDhe.exe
  2⤵
  PID:1552
- C:\Windows\System\pSZCgbm.exe
  C:\Windows\System\pSZCgbm.exe
  2⤵
  PID:1700
- C:\Windows\System\IngheMO.exe
  C:\Windows\System\IngheMO.exe
  2⤵
  PID:324
- C:\Windows\System\CAHfmUM.exe
  C:\Windows\System\CAHfmUM.exe
  2⤵
  PID:2448
- C:\Windows\System\wZvZfTo.exe
  C:\Windows\System\wZvZfTo.exe
  2⤵
  PID:2080
- C:\Windows\System\RsVcTks.exe
  C:\Windows\System\RsVcTks.exe
  2⤵
  PID:1960
- C:\Windows\System\WHgfeqF.exe
  C:\Windows\System\WHgfeqF.exe
  2⤵
  PID:2212
- C:\Windows\System\EXWCnsm.exe
  C:\Windows\System\EXWCnsm.exe
  2⤵
  PID:1632
- C:\Windows\System\lPjrezn.exe
  C:\Windows\System\lPjrezn.exe
  2⤵
  PID:2732
- C:\Windows\System\CbvHcpp.exe
  C:\Windows\System\CbvHcpp.exe
  2⤵
  PID:2040
- C:\Windows\System\RGrFCLj.exe
  C:\Windows\System\RGrFCLj.exe
  2⤵
  PID:3076
- C:\Windows\System\SSBkbtq.exe
  C:\Windows\System\SSBkbtq.exe
  2⤵
  PID:3096
- C:\Windows\System\zJcbVrX.exe
  C:\Windows\System\zJcbVrX.exe
  2⤵
  PID:3112
- C:\Windows\System\AkeRCZp.exe
  C:\Windows\System\AkeRCZp.exe
  2⤵
  PID:3128
- C:\Windows\System\VomTxHv.exe
  C:\Windows\System\VomTxHv.exe
  2⤵
  PID:3144
- C:\Windows\System\arDzBxR.exe
  C:\Windows\System\arDzBxR.exe
  2⤵
  PID:3160
- C:\Windows\System\FYOPbjl.exe
  C:\Windows\System\FYOPbjl.exe
  2⤵
  PID:3176
- C:\Windows\System\zwFdKQN.exe
  C:\Windows\System\zwFdKQN.exe
  2⤵
  PID:3192
- C:\Windows\System\bDuEhol.exe
  C:\Windows\System\bDuEhol.exe
  2⤵
  PID:3208
- C:\Windows\System\jbUjSuH.exe
  C:\Windows\System\jbUjSuH.exe
  2⤵
  PID:3228
- C:\Windows\System\XWDsvUz.exe
  C:\Windows\System\XWDsvUz.exe
  2⤵
  PID:3244
- C:\Windows\System\qxOkzgy.exe
  C:\Windows\System\qxOkzgy.exe
  2⤵
  PID:3264
- C:\Windows\System\uoCCZYk.exe
  C:\Windows\System\uoCCZYk.exe
  2⤵
  PID:3280
- C:\Windows\System\UvaEXJz.exe
  C:\Windows\System\UvaEXJz.exe
  2⤵
  PID:3296
- C:\Windows\System\ItYRBmU.exe
  C:\Windows\System\ItYRBmU.exe
  2⤵
  PID:3312
- C:\Windows\System\pkOvKHd.exe
  C:\Windows\System\pkOvKHd.exe
  2⤵
  PID:3328
- C:\Windows\System\BBiAkBK.exe
  C:\Windows\System\BBiAkBK.exe
  2⤵
  PID:3348
- C:\Windows\System\KNuFIcP.exe
  C:\Windows\System\KNuFIcP.exe
  2⤵
  PID:3364
- C:\Windows\System\QlazVRu.exe
  C:\Windows\System\QlazVRu.exe
  2⤵
  PID:3380
- C:\Windows\System\MTLWwxB.exe
  C:\Windows\System\MTLWwxB.exe
  2⤵
  PID:3396
- C:\Windows\System\zrhPdRT.exe
  C:\Windows\System\zrhPdRT.exe
  2⤵
  PID:3412
- C:\Windows\System\dVFjfpO.exe
  C:\Windows\System\dVFjfpO.exe
  2⤵
  PID:3428
- C:\Windows\System\yWGprWN.exe
  C:\Windows\System\yWGprWN.exe
  2⤵
  PID:3444
- C:\Windows\System\YRZwvca.exe
  C:\Windows\System\YRZwvca.exe
  2⤵
  PID:3464
- C:\Windows\System\kQtzAsF.exe
  C:\Windows\System\kQtzAsF.exe
  2⤵
  PID:3480
- C:\Windows\System\acTIeIf.exe
  C:\Windows\System\acTIeIf.exe
  2⤵
  PID:3496
- C:\Windows\System\CCNbciA.exe
  C:\Windows\System\CCNbciA.exe
  2⤵
  PID:3512
- C:\Windows\System\XsdmmaB.exe
  C:\Windows\System\XsdmmaB.exe
  2⤵
  PID:3528
- C:\Windows\System\aMGxVye.exe
  C:\Windows\System\aMGxVye.exe
  2⤵
  PID:3548
- C:\Windows\System\xZAroho.exe
  C:\Windows\System\xZAroho.exe
  2⤵
  PID:3564
- C:\Windows\System\ZMixeyV.exe
  C:\Windows\System\ZMixeyV.exe
  2⤵
  PID:3580
- C:\Windows\System\EXBLXol.exe
  C:\Windows\System\EXBLXol.exe
  2⤵
  PID:3596
- C:\Windows\System\bSVfeWV.exe
  C:\Windows\System\bSVfeWV.exe
  2⤵
  PID:3612
- C:\Windows\System\RWrPVwT.exe
  C:\Windows\System\RWrPVwT.exe
  2⤵
  PID:3792
- C:\Windows\System\XABrBMJ.exe
  C:\Windows\System\XABrBMJ.exe
  2⤵
  PID:3808
- C:\Windows\System\CbgaQME.exe
  C:\Windows\System\CbgaQME.exe
  2⤵
  PID:3824
- C:\Windows\System\aIJIgum.exe
  C:\Windows\System\aIJIgum.exe
  2⤵
  PID:3840
- C:\Windows\System\UbJhUqg.exe
  C:\Windows\System\UbJhUqg.exe
  2⤵
  PID:3856
- C:\Windows\System\yvurLCf.exe
  C:\Windows\System\yvurLCf.exe
  2⤵
  PID:3872
- C:\Windows\System\XwXNtIn.exe
  C:\Windows\System\XwXNtIn.exe
  2⤵
  PID:3888
- C:\Windows\System\UcgHyFj.exe
  C:\Windows\System\UcgHyFj.exe
  2⤵
  PID:3904
- C:\Windows\System\raTTtPa.exe
  C:\Windows\System\raTTtPa.exe
  2⤵
  PID:3920
- C:\Windows\System\aqXMIzF.exe
  C:\Windows\System\aqXMIzF.exe
  2⤵
  PID:3936
- C:\Windows\System\AmAeowS.exe
  C:\Windows\System\AmAeowS.exe
  2⤵
  PID:3952
- C:\Windows\System\cnsnMEe.exe
  C:\Windows\System\cnsnMEe.exe
  2⤵
  PID:3968
- C:\Windows\System\VSQpmJR.exe
  C:\Windows\System\VSQpmJR.exe
  2⤵
  PID:3984
- C:\Windows\System\UwGyvUU.exe
  C:\Windows\System\UwGyvUU.exe
  2⤵
  PID:4000
- C:\Windows\System\iJIaTwi.exe
  C:\Windows\System\iJIaTwi.exe
  2⤵
  PID:4076
- C:\Windows\System\ODbfdMI.exe
  C:\Windows\System\ODbfdMI.exe
  2⤵
  PID:4092
- C:\Windows\System\sNZfzsR.exe
  C:\Windows\System\sNZfzsR.exe
  2⤵
  PID:1172
- C:\Windows\System\GxnSVBO.exe
  C:\Windows\System\GxnSVBO.exe
  2⤵
  PID:776
- C:\Windows\System\TMbpEhP.exe
  C:\Windows\System\TMbpEhP.exe
  2⤵
  PID:3108
- C:\Windows\System\xjEMElj.exe
  C:\Windows\System\xjEMElj.exe
  2⤵
  PID:3204
- C:\Windows\System\yMbWguR.exe
  C:\Windows\System\yMbWguR.exe
  2⤵
  PID:3236
- C:\Windows\System\RfrAnmg.exe
  C:\Windows\System\RfrAnmg.exe
  2⤵
  PID:3344
- C:\Windows\System\KrpvSik.exe
  C:\Windows\System\KrpvSik.exe
  2⤵
  PID:3408
- C:\Windows\System\lLtqoos.exe
  C:\Windows\System\lLtqoos.exe
  2⤵
  PID:3536
- C:\Windows\System\HTFYHZJ.exe
  C:\Windows\System\HTFYHZJ.exe
  2⤵
  PID:3604
- C:\Windows\System\oCAwWPZ.exe
  C:\Windows\System\oCAwWPZ.exe
  2⤵
  PID:3308
- C:\Windows\System\fLjRKWM.exe
  C:\Windows\System\fLjRKWM.exe
  2⤵
  PID:1748
- C:\Windows\System\AlvonZV.exe
  C:\Windows\System\AlvonZV.exe
  2⤵
  PID:2696
- C:\Windows\System\lcNeELq.exe
  C:\Windows\System\lcNeELq.exe
  2⤵
  PID:2372
- C:\Windows\System\VNfdyIw.exe
  C:\Windows\System\VNfdyIw.exe
  2⤵
  PID:2884
- C:\Windows\System\tiArSJL.exe
  C:\Windows\System\tiArSJL.exe
  2⤵
  PID:3092
- C:\Windows\System\ilxpIPX.exe
  C:\Windows\System\ilxpIPX.exe
  2⤵
  PID:3184
- C:\Windows\System\VwLvRUC.exe
  C:\Windows\System\VwLvRUC.exe
  2⤵
  PID:3188
- C:\Windows\System\EnJvfFN.exe
  C:\Windows\System\EnJvfFN.exe
  2⤵
  PID:3256
- C:\Windows\System\tYsFcdW.exe
  C:\Windows\System\tYsFcdW.exe
  2⤵
  PID:3356
- C:\Windows\System\VfHAaiK.exe
  C:\Windows\System\VfHAaiK.exe
  2⤵
  PID:3452
- C:\Windows\System\rYBTgKP.exe
  C:\Windows\System\rYBTgKP.exe
  2⤵
  PID:3524
- C:\Windows\System\csgxECA.exe
  C:\Windows\System\csgxECA.exe
  2⤵
  PID:3620
- C:\Windows\System\scYqNmV.exe
  C:\Windows\System\scYqNmV.exe
  2⤵
  PID:3644
- C:\Windows\System\SQQFkrG.exe
  C:\Windows\System\SQQFkrG.exe
  2⤵
  PID:3664
- C:\Windows\System\QTcNQkT.exe
  C:\Windows\System\QTcNQkT.exe
  2⤵
  PID:3900
- C:\Windows\System\HUHZUXb.exe
  C:\Windows\System\HUHZUXb.exe
  2⤵
  PID:3960
- C:\Windows\System\RnHslfy.exe
  C:\Windows\System\RnHslfy.exe
  2⤵
  PID:3680
- C:\Windows\System\qokyvtb.exe
  C:\Windows\System\qokyvtb.exe
  2⤵
  PID:3696
- C:\Windows\System\qdUxivx.exe
  C:\Windows\System\qdUxivx.exe
  2⤵
  PID:3716
- C:\Windows\System\eyamWfT.exe
  C:\Windows\System\eyamWfT.exe
  2⤵
  PID:3736
- C:\Windows\System\JnWDqlL.exe
  C:\Windows\System\JnWDqlL.exe
  2⤵
  PID:3752
- C:\Windows\System\GvlInoE.exe
  C:\Windows\System\GvlInoE.exe
  2⤵
  PID:3764
- C:\Windows\System\EpIxtSk.exe
  C:\Windows\System\EpIxtSk.exe
  2⤵
  PID:2408
- C:\Windows\System\LkXJCbz.exe
  C:\Windows\System\LkXJCbz.exe
  2⤵
  PID:3880
- C:\Windows\System\gfhWYwr.exe
  C:\Windows\System\gfhWYwr.exe
  2⤵
  PID:3948
- C:\Windows\System\ogwuzIk.exe
  C:\Windows\System\ogwuzIk.exe
  2⤵
  PID:356
- C:\Windows\System\OWBIDkW.exe
  C:\Windows\System\OWBIDkW.exe
  2⤵
  PID:4028
- C:\Windows\System\GFTmOfM.exe
  C:\Windows\System\GFTmOfM.exe
  2⤵
  PID:4044
- C:\Windows\System\ozuWhSW.exe
  C:\Windows\System\ozuWhSW.exe
  2⤵
  PID:4060
- C:\Windows\System\CbAXzIb.exe
  C:\Windows\System\CbAXzIb.exe
  2⤵
  PID:1100
- C:\Windows\System\iEbvDUG.exe
  C:\Windows\System\iEbvDUG.exe
  2⤵
  PID:4084
- C:\Windows\System\aSxecnJ.exe
  C:\Windows\System\aSxecnJ.exe
  2⤵
  PID:1304
- C:\Windows\System\XnjrXVa.exe
  C:\Windows\System\XnjrXVa.exe
  2⤵
  PID:2232
- C:\Windows\System\CxgDzTP.exe
  C:\Windows\System\CxgDzTP.exe
  2⤵
  PID:1464
- C:\Windows\System\vkGDnNz.exe
  C:\Windows\System\vkGDnNz.exe
  2⤵
  PID:2704
- C:\Windows\System\dMoSnFg.exe
  C:\Windows\System\dMoSnFg.exe
  2⤵
  PID:1912
- C:\Windows\System\TIlWXcc.exe
  C:\Windows\System\TIlWXcc.exe
  2⤵
  PID:3336
- C:\Windows\System\COnQEAT.exe
  C:\Windows\System\COnQEAT.exe
  2⤵
  PID:1868
- C:\Windows\System\yVkixYM.exe
  C:\Windows\System\yVkixYM.exe
  2⤵
  PID:3544
- C:\Windows\System\WCjsnQI.exe
  C:\Windows\System\WCjsnQI.exe
  2⤵
  PID:2024
- C:\Windows\System\uUQYdTU.exe
  C:\Windows\System\uUQYdTU.exe
  2⤵
  PID:1724
- C:\Windows\System\KiMLdnc.exe
  C:\Windows\System\KiMLdnc.exe
  2⤵
  PID:1660
- C:\Windows\System\HZwrPtM.exe
  C:\Windows\System\HZwrPtM.exe
  2⤵
  PID:3660
- C:\Windows\System\mvoOxnz.exe
  C:\Windows\System\mvoOxnz.exe
  2⤵
  PID:1600
- C:\Windows\System\ixCDnEh.exe
  C:\Windows\System\ixCDnEh.exe
  2⤵
  PID:2356
- C:\Windows\System\MXeLTEP.exe
  C:\Windows\System\MXeLTEP.exe
  2⤵
  PID:3152
- C:\Windows\System\oFxlzUw.exe
  C:\Windows\System\oFxlzUw.exe
  2⤵
  PID:3252
- C:\Windows\System\jreYmHx.exe
  C:\Windows\System\jreYmHx.exe
  2⤵
  PID:3320
- C:\Windows\System\toNWowD.exe
  C:\Windows\System\toNWowD.exe
  2⤵
  PID:3424
- C:\Windows\System\xYZsImW.exe
  C:\Windows\System\xYZsImW.exe
  2⤵
  PID:3560
- C:\Windows\System\IeJdjfP.exe
  C:\Windows\System\IeJdjfP.exe
  2⤵
  PID:3640
- C:\Windows\System\xSxZMEG.exe
  C:\Windows\System\xSxZMEG.exe
  2⤵
  PID:3656
- C:\Windows\System\fvbesPT.exe
  C:\Windows\System\fvbesPT.exe
  2⤵
  PID:3928
- C:\Windows\System\BGXAsNE.exe
  C:\Windows\System\BGXAsNE.exe
  2⤵
  PID:3676
- C:\Windows\System\cRfbrfE.exe
  C:\Windows\System\cRfbrfE.exe
  2⤵
  PID:3692
- C:\Windows\System\oOIqmNu.exe
  C:\Windows\System\oOIqmNu.exe
  2⤵
  PID:3728
- C:\Windows\System\WCwERno.exe
  C:\Windows\System\WCwERno.exe
  2⤵
  PID:3760
- C:\Windows\System\qyRuGHn.exe
  C:\Windows\System\qyRuGHn.exe
  2⤵
  PID:3768
- C:\Windows\System\eqXQnfD.exe
  C:\Windows\System\eqXQnfD.exe
  2⤵
  PID:1360
- C:\Windows\System\fbEqUco.exe
  C:\Windows\System\fbEqUco.exe
  2⤵
  PID:3848
- C:\Windows\System\shcMTaW.exe
  C:\Windows\System\shcMTaW.exe
  2⤵
  PID:3980
- C:\Windows\System\kpmBQIa.exe
  C:\Windows\System\kpmBQIa.exe
  2⤵
  PID:4032
- C:\Windows\System\aRDdcFn.exe
  C:\Windows\System\aRDdcFn.exe
  2⤵
  PID:1840
- C:\Windows\System\omHAjAz.exe
  C:\Windows\System\omHAjAz.exe
  2⤵
  PID:2940
- C:\Windows\System\XtZDmFK.exe
  C:\Windows\System\XtZDmFK.exe
  2⤵
  PID:4112
- C:\Windows\System\NShqjXG.exe
  C:\Windows\System\NShqjXG.exe
  2⤵
  PID:4316
- C:\Windows\System\SKLhcad.exe
  C:\Windows\System\SKLhcad.exe
  2⤵
  PID:4332
- C:\Windows\System\FAaYfnW.exe
  C:\Windows\System\FAaYfnW.exe
  2⤵
  PID:4360
- C:\Windows\System\dnrJkFy.exe
  C:\Windows\System\dnrJkFy.exe
  2⤵
  PID:4376
- C:\Windows\System\XTkkOMS.exe
  C:\Windows\System\XTkkOMS.exe
  2⤵
  PID:4392
- C:\Windows\System\XjUvrZU.exe
  C:\Windows\System\XjUvrZU.exe
  2⤵
  PID:4408
- C:\Windows\System\WPYGkGa.exe
  C:\Windows\System\WPYGkGa.exe
  2⤵
  PID:4424
- C:\Windows\System\JoOnpHx.exe
  C:\Windows\System\JoOnpHx.exe
  2⤵
  PID:4440
- C:\Windows\System\MHYarii.exe
  C:\Windows\System\MHYarii.exe
  2⤵
  PID:4456
- C:\Windows\System\ovNniAE.exe
  C:\Windows\System\ovNniAE.exe
  2⤵
  PID:4472
- C:\Windows\System\ZFCcxst.exe
  C:\Windows\System\ZFCcxst.exe
  2⤵
  PID:4520
- C:\Windows\System\GCveTwo.exe
  C:\Windows\System\GCveTwo.exe
  2⤵
  PID:4536
- C:\Windows\System\RCYxqTf.exe
  C:\Windows\System\RCYxqTf.exe
  2⤵
  PID:4552
- C:\Windows\System\DTwtWsT.exe
  C:\Windows\System\DTwtWsT.exe
  2⤵
  PID:4568
- C:\Windows\System\FEAVLnT.exe
  C:\Windows\System\FEAVLnT.exe
  2⤵
  PID:4584
- C:\Windows\System\LgUljQj.exe
  C:\Windows\System\LgUljQj.exe
  2⤵
  PID:4600
- C:\Windows\System\pNJgGgA.exe
  C:\Windows\System\pNJgGgA.exe
  2⤵
  PID:4616
- C:\Windows\System\VEENoCj.exe
  C:\Windows\System\VEENoCj.exe
  2⤵
  PID:4632
- C:\Windows\System\qqfjYjw.exe
  C:\Windows\System\qqfjYjw.exe
  2⤵
  PID:4648
- C:\Windows\System\qNHbBAM.exe
  C:\Windows\System\qNHbBAM.exe
  2⤵
  PID:4664
- C:\Windows\System\fcyfVjZ.exe
  C:\Windows\System\fcyfVjZ.exe
  2⤵
  PID:4680
- C:\Windows\System\elySQnk.exe
  C:\Windows\System\elySQnk.exe
  2⤵
  PID:4696
- C:\Windows\System\LSaqlEp.exe
  C:\Windows\System\LSaqlEp.exe
  2⤵
  PID:4712
- C:\Windows\System\rCjctBi.exe
  C:\Windows\System\rCjctBi.exe
  2⤵
  PID:4728
- C:\Windows\System\nGbiJlz.exe
  C:\Windows\System\nGbiJlz.exe
  2⤵
  PID:4744
- C:\Windows\System\okOzGfp.exe
  C:\Windows\System\okOzGfp.exe
  2⤵
  PID:4764
- C:\Windows\System\OYYdRrY.exe
  C:\Windows\System\OYYdRrY.exe
  2⤵
  PID:4780
- C:\Windows\System\cKekCMa.exe
  C:\Windows\System\cKekCMa.exe
  2⤵
  PID:4820
- C:\Windows\System\gwcGYYJ.exe
  C:\Windows\System\gwcGYYJ.exe
  2⤵
  PID:4880
- C:\Windows\System\glLLUbM.exe
  C:\Windows\System\glLLUbM.exe
  2⤵
  PID:4896
- C:\Windows\System\PFXRHbq.exe
  C:\Windows\System\PFXRHbq.exe
  2⤵
  PID:4920
- C:\Windows\System\kGNJKmJ.exe
  C:\Windows\System\kGNJKmJ.exe
  2⤵
  PID:4936
- C:\Windows\System\MbqFvaZ.exe
  C:\Windows\System\MbqFvaZ.exe
  2⤵
  PID:4952
- C:\Windows\System\NiTVYse.exe
  C:\Windows\System\NiTVYse.exe
  2⤵
  PID:4968
- C:\Windows\System\MpYILLJ.exe
  C:\Windows\System\MpYILLJ.exe
  2⤵
  PID:4984
- C:\Windows\System\rEDopEC.exe
  C:\Windows\System\rEDopEC.exe
  2⤵
  PID:5004
- C:\Windows\System\tYbVFQU.exe
  C:\Windows\System\tYbVFQU.exe
  2⤵
  PID:5020
- C:\Windows\System\AUNGyTL.exe
  C:\Windows\System\AUNGyTL.exe
  2⤵
  PID:5036
- C:\Windows\System\eLrNfwD.exe
  C:\Windows\System\eLrNfwD.exe
  2⤵
  PID:5052
- C:\Windows\System\iSQgzNx.exe
  C:\Windows\System\iSQgzNx.exe
  2⤵
  PID:5068
- C:\Windows\System\EXLfjLv.exe
  C:\Windows\System\EXLfjLv.exe
  2⤵
  PID:5084
- C:\Windows\System\zZloEBI.exe
  C:\Windows\System\zZloEBI.exe
  2⤵
  PID:5100
- C:\Windows\System\VIqVdSJ.exe
  C:\Windows\System\VIqVdSJ.exe
  2⤵
  PID:5116
- C:\Windows\System\HMzxIkm.exe
  C:\Windows\System\HMzxIkm.exe
  2⤵
  PID:3576
- C:\Windows\System\LkxHurI.exe
  C:\Windows\System\LkxHurI.exe
  2⤵
  PID:2156
- C:\Windows\System\zjXPufE.exe
  C:\Windows\System\zjXPufE.exe
  2⤵
  PID:3124
- C:\Windows\System\VWmjaSx.exe
  C:\Windows\System\VWmjaSx.exe
  2⤵
  PID:3324
- C:\Windows\System\gpSEhDd.exe
  C:\Windows\System\gpSEhDd.exe
  2⤵
  PID:4008
- C:\Windows\System\RwySivU.exe
  C:\Windows\System\RwySivU.exe
  2⤵
  PID:3240
- C:\Windows\System\TxMVCCF.exe
  C:\Windows\System\TxMVCCF.exe
  2⤵
  PID:4056
- C:\Windows\System\whrxynR.exe
  C:\Windows\System\whrxynR.exe
  2⤵
  PID:4140
- C:\Windows\System\QsnJZqA.exe
  C:\Windows\System\QsnJZqA.exe
  2⤵
  PID:3632
- C:\Windows\System\lUFgBaL.exe
  C:\Windows\System\lUFgBaL.exe
  2⤵
  PID:3220
- C:\Windows\System\KFVhMxs.exe
  C:\Windows\System\KFVhMxs.exe
  2⤵
  PID:1776
- C:\Windows\System\GQkItJx.exe
  C:\Windows\System\GQkItJx.exe
  2⤵
  PID:2720
- C:\Windows\System\wgvdevN.exe
  C:\Windows\System\wgvdevN.exe
  2⤵
  PID:4164
- C:\Windows\System\BmaMNrM.exe
  C:\Windows\System\BmaMNrM.exe
  2⤵
  PID:4136
- C:\Windows\System\ZJCVtot.exe
  C:\Windows\System\ZJCVtot.exe
  2⤵
  PID:3992
- C:\Windows\System\nOYRtch.exe
  C:\Windows\System\nOYRtch.exe
  2⤵
  PID:3820
- C:\Windows\System\DJwbLrf.exe
  C:\Windows\System\DJwbLrf.exe
  2⤵
  PID:4104
- C:\Windows\System\zUCsPdI.exe
  C:\Windows\System\zUCsPdI.exe
  2⤵
  PID:3724
- C:\Windows\System\roRHSfo.exe
  C:\Windows\System\roRHSfo.exe
  2⤵
  PID:1532
- C:\Windows\System\FMIuXMX.exe
  C:\Windows\System\FMIuXMX.exe
  2⤵
  PID:4252
- C:\Windows\System\GISyqbC.exe
  C:\Windows\System\GISyqbC.exe
  2⤵
  PID:4496
- C:\Windows\System\xkDdxTB.exe
  C:\Windows\System\xkDdxTB.exe
  2⤵
  PID:4512
- C:\Windows\System\dDqXjWQ.exe
  C:\Windows\System\dDqXjWQ.exe
  2⤵
  PID:4544
- C:\Windows\System\TCYtMsp.exe
  C:\Windows\System\TCYtMsp.exe
  2⤵
  PID:4576
- C:\Windows\System\BaUzwpI.exe
  C:\Windows\System\BaUzwpI.exe
  2⤵
  PID:4580
- C:\Windows\System\BiFCtWx.exe
  C:\Windows\System\BiFCtWx.exe
  2⤵
  PID:4796
- C:\Windows\System\HihUdwE.exe
  C:\Windows\System\HihUdwE.exe
  2⤵
  PID:4812
- C:\Windows\System\oJNMogr.exe
  C:\Windows\System\oJNMogr.exe
  2⤵
  PID:4816
- C:\Windows\System\IYQlgkh.exe
  C:\Windows\System\IYQlgkh.exe
  2⤵
  PID:4828
- C:\Windows\System\GuJQlho.exe
  C:\Windows\System\GuJQlho.exe
  2⤵
  PID:4788
- C:\Windows\System\SszWjlu.exe
  C:\Windows\System\SszWjlu.exe
  2⤵
  PID:4832
- C:\Windows\System\JJURaEs.exe
  C:\Windows\System\JJURaEs.exe
  2⤵
  PID:4720
- C:\Windows\System\wmVVDWD.exe
  C:\Windows\System\wmVVDWD.exe
  2⤵
  PID:4852
- C:\Windows\System\SiepiCb.exe
  C:\Windows\System\SiepiCb.exe
  2⤵
  PID:4872
- C:\Windows\System\yETqlum.exe
  C:\Windows\System\yETqlum.exe
  2⤵
  PID:4904
- C:\Windows\System\jaMAEiX.exe
  C:\Windows\System\jaMAEiX.exe
  2⤵
  PID:4948
- C:\Windows\System\YKUnmIX.exe
  C:\Windows\System\YKUnmIX.exe
  2⤵
  PID:5016
- C:\Windows\System\qpCySmW.exe
  C:\Windows\System\qpCySmW.exe
  2⤵
  PID:5080
- C:\Windows\System\otyQgcA.exe
  C:\Windows\System\otyQgcA.exe
  2⤵
  PID:1804
- C:\Windows\System\Ubrmawa.exe
  C:\Windows\System\Ubrmawa.exe
  2⤵
  PID:3052
- C:\Windows\System\jAOFjfh.exe
  C:\Windows\System\jAOFjfh.exe
  2⤵
  PID:4144
- C:\Windows\System\FfsBtTC.exe
  C:\Windows\System\FfsBtTC.exe
  2⤵
  PID:1644
- C:\Windows\System\WxEkDCJ.exe
  C:\Windows\System\WxEkDCJ.exe
  2⤵
  PID:4996
- C:\Windows\System\jReasWx.exe
  C:\Windows\System\jReasWx.exe
  2⤵
  PID:3156
- C:\Windows\System\AatTLQq.exe
  C:\Windows\System\AatTLQq.exe
  2⤵
  PID:4928
- C:\Windows\System\iTekBtT.exe
  C:\Windows\System\iTekBtT.exe
  2⤵
  PID:5064
- C:\Windows\System\WBVeESN.exe
  C:\Windows\System\WBVeESN.exe
  2⤵
  PID:3780
- C:\Windows\System\DQYVEUm.exe
  C:\Windows\System\DQYVEUm.exe
  2⤵
  PID:2196
- C:\Windows\System\gvTtxOl.exe
  C:\Windows\System\gvTtxOl.exe
  2⤵
  PID:3684
- C:\Windows\System\raWkMha.exe
  C:\Windows\System\raWkMha.exe
  2⤵
  PID:4120
- C:\Windows\System\dGmAikv.exe
  C:\Windows\System\dGmAikv.exe
  2⤵
  PID:1212
- C:\Windows\System\wGDqMYy.exe
  C:\Windows\System\wGDqMYy.exe
  2⤵
  PID:4184
- C:\Windows\System\QMSlUxx.exe
  C:\Windows\System\QMSlUxx.exe
  2⤵
  PID:4200
- C:\Windows\System\JVQxffd.exe
  C:\Windows\System\JVQxffd.exe
  2⤵
  PID:4212
- C:\Windows\System\veBPgkl.exe
  C:\Windows\System\veBPgkl.exe
  2⤵
  PID:4232
- C:\Windows\System\BdtTZfb.exe
  C:\Windows\System\BdtTZfb.exe
  2⤵
  PID:4292
- C:\Windows\System\PymSWYs.exe
  C:\Windows\System\PymSWYs.exe
  2⤵
  PID:4356
- C:\Windows\System\tcxxgnl.exe
  C:\Windows\System\tcxxgnl.exe
  2⤵
  PID:4480
- C:\Windows\System\mTqcfrj.exe
  C:\Windows\System\mTqcfrj.exe
  2⤵
  PID:4432
- C:\Windows\System\juBVCMm.exe
  C:\Windows\System\juBVCMm.exe
  2⤵
  PID:4484
- C:\Windows\System\fYbZugQ.exe
  C:\Windows\System\fYbZugQ.exe
  2⤵
  PID:4504
- C:\Windows\System\hkBVdBA.exe
  C:\Windows\System\hkBVdBA.exe
  2⤵
  PID:4564
- C:\Windows\System\LwXlcwz.exe
  C:\Windows\System\LwXlcwz.exe
  2⤵
  PID:2860
- C:\Windows\System\WUTeBzR.exe
  C:\Windows\System\WUTeBzR.exe
  2⤵
  PID:4756
- C:\Windows\System\bpxJUQX.exe
  C:\Windows\System\bpxJUQX.exe
  2⤵
  PID:4628
- C:\Windows\System\MHxSPvU.exe
  C:\Windows\System\MHxSPvU.exe
  2⤵
  PID:4672
- C:\Windows\System\kiJWNZB.exe
  C:\Windows\System\kiJWNZB.exe
  2⤵
  PID:4868
- C:\Windows\System\PEwORyk.exe
  C:\Windows\System\PEwORyk.exe
  2⤵
  PID:4248
- C:\Windows\System\qfKXynh.exe
  C:\Windows\System\qfKXynh.exe
  2⤵
  PID:3704
- C:\Windows\System\kFvQIhT.exe
  C:\Windows\System\kFvQIhT.exe
  2⤵
  PID:4108
- C:\Windows\System\SxoPzJG.exe
  C:\Windows\System\SxoPzJG.exe
  2⤵
  PID:4844
- C:\Windows\System\asuOJXW.exe
  C:\Windows\System\asuOJXW.exe
  2⤵
  PID:5060
- C:\Windows\System\xeIHXpZ.exe
  C:\Windows\System\xeIHXpZ.exe
  2⤵
  PID:4760
- C:\Windows\System\RcTcRMa.exe
  C:\Windows\System\RcTcRMa.exe
  2⤵
  PID:4692
- C:\Windows\System\YNvYNZW.exe
  C:\Windows\System\YNvYNZW.exe
  2⤵
  PID:4836
- C:\Windows\System\AJNGmZD.exe
  C:\Windows\System\AJNGmZD.exe
  2⤵
  PID:4352
- C:\Windows\System\gybWYRZ.exe
  C:\Windows\System\gybWYRZ.exe
  2⤵
  PID:3420
- C:\Windows\System\CNuAYyk.exe
  C:\Windows\System\CNuAYyk.exe
  2⤵
  PID:4856
- C:\Windows\System\ejhuqmK.exe
  C:\Windows\System\ejhuqmK.exe
  2⤵
  PID:5076
- C:\Windows\System\SdIZfDc.exe
  C:\Windows\System\SdIZfDc.exe
  2⤵
  PID:5096
- C:\Windows\System\loWhqfk.exe
  C:\Windows\System\loWhqfk.exe
  2⤵
  PID:3276
- C:\Windows\System\eaKGshZ.exe
  C:\Windows\System\eaKGshZ.exe
  2⤵
  PID:4964
- C:\Windows\System\gTSjhex.exe
  C:\Windows\System\gTSjhex.exe
  2⤵
  PID:3708
- C:\Windows\System\LkHTGtc.exe
  C:\Windows\System\LkHTGtc.exe
  2⤵
  PID:4208
- C:\Windows\System\sjfGAbf.exe
  C:\Windows\System\sjfGAbf.exe
  2⤵
  PID:4020
- C:\Windows\System\fBYtndS.exe
  C:\Windows\System\fBYtndS.exe
  2⤵
  PID:4024
- C:\Windows\System\YyjVICu.exe
  C:\Windows\System\YyjVICu.exe
  2⤵
  PID:5000
- C:\Windows\System\bxDGSLX.exe
  C:\Windows\System\bxDGSLX.exe
  2⤵
  PID:4736
- C:\Windows\System\mfugqRt.exe
  C:\Windows\System\mfugqRt.exe
  2⤵
  PID:5032
- C:\Windows\System\vXPIYng.exe
  C:\Windows\System\vXPIYng.exe
  2⤵
  PID:4052
- C:\Windows\System\OxJihiZ.exe
  C:\Windows\System\OxJihiZ.exe
  2⤵
  PID:3732
- C:\Windows\System\TBPmiKA.exe
  C:\Windows\System\TBPmiKA.exe
  2⤵
  PID:4960
- C:\Windows\System\ZcZtzWn.exe
  C:\Windows\System\ZcZtzWn.exe
  2⤵
  PID:3944
- C:\Windows\System\mNZIPKU.exe
  C:\Windows\System\mNZIPKU.exe
  2⤵
  PID:4592
- C:\Windows\System\JYyMaav.exe
  C:\Windows\System\JYyMaav.exe
  2⤵
  PID:4348
- C:\Windows\System\MFVmUmU.exe
  C:\Windows\System\MFVmUmU.exe
  2⤵
  PID:3896
- C:\Windows\System\zgkritq.exe
  C:\Windows\System\zgkritq.exe
  2⤵
  PID:4468
- C:\Windows\System\GACDdpH.exe
  C:\Windows\System\GACDdpH.exe
  2⤵
  PID:4980
- C:\Windows\System\jlLwdPm.exe
  C:\Windows\System\jlLwdPm.exe
  2⤵
  PID:3624
- C:\Windows\System\NfkiJmm.exe
  C:\Windows\System\NfkiJmm.exe
  2⤵
  PID:5124
- C:\Windows\System\fsoXNhf.exe
  C:\Windows\System\fsoXNhf.exe
  2⤵
  PID:5140
- C:\Windows\System\WiehyRK.exe
  C:\Windows\System\WiehyRK.exe
  2⤵
  PID:5156
- C:\Windows\System\INhqrbC.exe
  C:\Windows\System\INhqrbC.exe
  2⤵
  PID:5172
- C:\Windows\System\GIPKJMW.exe
  C:\Windows\System\GIPKJMW.exe
  2⤵
  PID:5188
- C:\Windows\System\tWGLTqZ.exe
  C:\Windows\System\tWGLTqZ.exe
  2⤵
  PID:5208
- C:\Windows\System\YgEWYSb.exe
  C:\Windows\System\YgEWYSb.exe
  2⤵
  PID:5224
- C:\Windows\System\wVtIGjD.exe
  C:\Windows\System\wVtIGjD.exe
  2⤵
  PID:5240
- C:\Windows\System\gHIJUAC.exe
  C:\Windows\System\gHIJUAC.exe
  2⤵
  PID:5256
- C:\Windows\System\YSKeFJB.exe
  C:\Windows\System\YSKeFJB.exe
  2⤵
  PID:5272
- C:\Windows\System\jMAuYCJ.exe
  C:\Windows\System\jMAuYCJ.exe
  2⤵
  PID:5288
- C:\Windows\System\VMakQKI.exe
  C:\Windows\System\VMakQKI.exe
  2⤵
  PID:5312
- C:\Windows\System\gLwZRoa.exe
  C:\Windows\System\gLwZRoa.exe
  2⤵
  PID:5328
- C:\Windows\System\SzxJeUD.exe
  C:\Windows\System\SzxJeUD.exe
  2⤵
  PID:5348
- C:\Windows\System\HLyZrBj.exe
  C:\Windows\System\HLyZrBj.exe
  2⤵
  PID:5364
- C:\Windows\System\AGBqpfX.exe
  C:\Windows\System\AGBqpfX.exe
  2⤵
  PID:5380
- C:\Windows\System\GJYrcpr.exe
  C:\Windows\System\GJYrcpr.exe
  2⤵
  PID:5396
- C:\Windows\System\TvbKcis.exe
  C:\Windows\System\TvbKcis.exe
  2⤵
  PID:5412
- C:\Windows\System\xSphDmL.exe
  C:\Windows\System\xSphDmL.exe
  2⤵
  PID:5428
- C:\Windows\System\WogEKEv.exe
  C:\Windows\System\WogEKEv.exe
  2⤵
  PID:5444
- C:\Windows\System\dipXjpH.exe
  C:\Windows\System\dipXjpH.exe
  2⤵
  PID:5460
- C:\Windows\System\NrPKaQV.exe
  C:\Windows\System\NrPKaQV.exe
  2⤵
  PID:5476
- C:\Windows\System\yvokdmu.exe
  C:\Windows\System\yvokdmu.exe
  2⤵
  PID:5492
- C:\Windows\System\uKaicRR.exe
  C:\Windows\System\uKaicRR.exe
  2⤵
  PID:5508
- C:\Windows\System\MPAIQAc.exe
  C:\Windows\System\MPAIQAc.exe
  2⤵
  PID:5524
- C:\Windows\System\EyqTlmV.exe
  C:\Windows\System\EyqTlmV.exe
  2⤵
  PID:5540
- C:\Windows\System\ZSjTUFn.exe
  C:\Windows\System\ZSjTUFn.exe
  2⤵
  PID:5556
- C:\Windows\System\gYfcnce.exe
  C:\Windows\System\gYfcnce.exe
  2⤵
  PID:5572
- C:\Windows\System\mdQclau.exe
  C:\Windows\System\mdQclau.exe
  2⤵
  PID:5592
- C:\Windows\System\xspRuYI.exe
  C:\Windows\System\xspRuYI.exe
  2⤵
  PID:5608
- C:\Windows\System\hljYgeA.exe
  C:\Windows\System\hljYgeA.exe
  2⤵
  PID:5640
- C:\Windows\System\xFOvBYI.exe
  C:\Windows\System\xFOvBYI.exe
  2⤵
  PID:5656
- C:\Windows\System\yYsYTiw.exe
  C:\Windows\System\yYsYTiw.exe
  2⤵
  PID:5676
- C:\Windows\System\PlyDLqz.exe
  C:\Windows\System\PlyDLqz.exe
  2⤵
  PID:5704
- C:\Windows\System\FRXcqSE.exe
  C:\Windows\System\FRXcqSE.exe
  2⤵
  PID:5720
- C:\Windows\System\PsCxsHz.exe
  C:\Windows\System\PsCxsHz.exe
  2⤵
  PID:5736
- C:\Windows\System\bfQhQaV.exe
  C:\Windows\System\bfQhQaV.exe
  2⤵
  PID:5752
- C:\Windows\System\MzgZxMF.exe
  C:\Windows\System\MzgZxMF.exe
  2⤵
  PID:5768
- C:\Windows\System\GSMrbdk.exe
  C:\Windows\System\GSMrbdk.exe
  2⤵
  PID:5784
- C:\Windows\System\XxkoTTR.exe
  C:\Windows\System\XxkoTTR.exe
  2⤵
  PID:5800
- C:\Windows\System\IrjjOpx.exe
  C:\Windows\System\IrjjOpx.exe
  2⤵
  PID:5816
- C:\Windows\System\LkCAutS.exe
  C:\Windows\System\LkCAutS.exe
  2⤵
  PID:5836
- C:\Windows\System\ThSlgqN.exe
  C:\Windows\System\ThSlgqN.exe
  2⤵
  PID:5852
- C:\Windows\System\XTDllzm.exe
  C:\Windows\System\XTDllzm.exe
  2⤵
  PID:5868
- C:\Windows\System\sNMqyjk.exe
  C:\Windows\System\sNMqyjk.exe
  2⤵
  PID:5884
- C:\Windows\System\JxhfbTE.exe
  C:\Windows\System\JxhfbTE.exe
  2⤵
  PID:5900
- C:\Windows\System\GqJGMSF.exe
  C:\Windows\System\GqJGMSF.exe
  2⤵
  PID:5916
- C:\Windows\System\zxvMsJJ.exe
  C:\Windows\System\zxvMsJJ.exe
  2⤵
  PID:5936
- C:\Windows\System\JaLLTiT.exe
  C:\Windows\System\JaLLTiT.exe
  2⤵
  PID:5952
- C:\Windows\System\UKgjhhu.exe
  C:\Windows\System\UKgjhhu.exe
  2⤵
  PID:5968
- C:\Windows\System\AnZaSZs.exe
  C:\Windows\System\AnZaSZs.exe
  2⤵
  PID:5984
- C:\Windows\System\bTVBIec.exe
  C:\Windows\System\bTVBIec.exe
  2⤵
  PID:6004
- C:\Windows\System\HENNoQK.exe
  C:\Windows\System\HENNoQK.exe
  2⤵
  PID:6020
- C:\Windows\System\fqCgPdy.exe
  C:\Windows\System\fqCgPdy.exe
  2⤵
  PID:6036
- C:\Windows\System\OXPsFce.exe
  C:\Windows\System\OXPsFce.exe
  2⤵
  PID:6052
- C:\Windows\System\fAdphVo.exe
  C:\Windows\System\fAdphVo.exe
  2⤵
  PID:6068
- C:\Windows\System\mnTKrwk.exe
  C:\Windows\System\mnTKrwk.exe
  2⤵
  PID:6084
- C:\Windows\System\pwqVSXW.exe
  C:\Windows\System\pwqVSXW.exe
  2⤵
  PID:6100
- C:\Windows\System\ZFleDlZ.exe
  C:\Windows\System\ZFleDlZ.exe
  2⤵
  PID:6116
- C:\Windows\System\INSBgYn.exe
  C:\Windows\System\INSBgYn.exe
  2⤵
  PID:6132
- C:\Windows\System\petRniO.exe
  C:\Windows\System\petRniO.exe
  2⤵
  PID:3392
- C:\Windows\System\XYFYUjN.exe
  C:\Windows\System\XYFYUjN.exe
  2⤵
  PID:4892
- C:\Windows\System\oxeBfxb.exe
  C:\Windows\System\oxeBfxb.exe
  2⤵
  PID:5148
- C:\Windows\System\GSdjlVA.exe
  C:\Windows\System\GSdjlVA.exe
  2⤵
  PID:5248
- C:\Windows\System\BaXfYSR.exe
  C:\Windows\System\BaXfYSR.exe
  2⤵
  PID:5264
- C:\Windows\System\ByMPZpC.exe
  C:\Windows\System\ByMPZpC.exe
  2⤵
  PID:4448
- C:\Windows\System\AbCyvvI.exe
  C:\Windows\System\AbCyvvI.exe
  2⤵
  PID:5132
- C:\Windows\System\FmVYtiK.exe
  C:\Windows\System\FmVYtiK.exe
  2⤵
  PID:5200
- C:\Windows\System\lJbXpOD.exe
  C:\Windows\System\lJbXpOD.exe
  2⤵
  PID:5284
- C:\Windows\System\wydQaBh.exe
  C:\Windows\System\wydQaBh.exe
  2⤵
  PID:5360
- C:\Windows\System\rThOylj.exe
  C:\Windows\System\rThOylj.exe
  2⤵
  PID:5304
- C:\Windows\System\FtCQeiw.exe
  C:\Windows\System\FtCQeiw.exe
  2⤵
  PID:5488
- C:\Windows\System\CWDHkna.exe
  C:\Windows\System\CWDHkna.exe
  2⤵
  PID:5548
- C:\Windows\System\aHfPYoU.exe
  C:\Windows\System\aHfPYoU.exe
  2⤵
  PID:5588
- C:\Windows\System\SeFFEKV.exe
  C:\Windows\System\SeFFEKV.exe
  2⤵
  PID:5628
- C:\Windows\System\YhsNuii.exe
  C:\Windows\System\YhsNuii.exe
  2⤵
  PID:5672
- C:\Windows\System\bHIruWH.exe
  C:\Windows\System\bHIruWH.exe
  2⤵
  PID:5748
- C:\Windows\System\UxtkHnO.exe
  C:\Windows\System\UxtkHnO.exe
  2⤵
  PID:5812
- C:\Windows\System\gqDqcWb.exe
  C:\Windows\System\gqDqcWb.exe
  2⤵
  PID:5880
- C:\Windows\System\XXIdpMZ.exe
  C:\Windows\System\XXIdpMZ.exe
  2⤵
  PID:5948
- C:\Windows\System\ArDrLaK.exe
  C:\Windows\System\ArDrLaK.exe
  2⤵
  PID:6016
- C:\Windows\System\FSbXEFg.exe
  C:\Windows\System\FSbXEFg.exe
  2⤵
  PID:2788
- C:\Windows\System\XgmHgva.exe
  C:\Windows\System\XgmHgva.exe
  2⤵
  PID:3636
- C:\Windows\System\KIFAUop.exe
  C:\Windows\System\KIFAUop.exe
  2⤵
  PID:6108
- C:\Windows\System\YfdEKaV.exe
  C:\Windows\System\YfdEKaV.exe
  2⤵
  PID:5632
- C:\Windows\System\SJGSRQC.exe
  C:\Windows\System\SJGSRQC.exe
  2⤵
  PID:5516
- C:\Windows\System\jnxSiai.exe
  C:\Windows\System\jnxSiai.exe
  2⤵
  PID:5624
- C:\Windows\System\ZlOCDqR.exe
  C:\Windows\System\ZlOCDqR.exe
  2⤵
  PID:5876
- C:\Windows\System\ObxuoMi.exe
  C:\Windows\System\ObxuoMi.exe
  2⤵
  PID:5280
- C:\Windows\System\DtpWZpf.exe
  C:\Windows\System\DtpWZpf.exe
  2⤵
  PID:5520
- C:\Windows\System\nPhbPjz.exe
  C:\Windows\System\nPhbPjz.exe
  2⤵
  PID:6148
- C:\Windows\System\OvkDMLY.exe
  C:\Windows\System\OvkDMLY.exe
  2⤵
  PID:6164
- C:\Windows\System\tNYAOXZ.exe
  C:\Windows\System\tNYAOXZ.exe
  2⤵
  PID:6180
- C:\Windows\System\DZnYbFM.exe
  C:\Windows\System\DZnYbFM.exe
  2⤵
  PID:6196
- C:\Windows\System\ykLdPKH.exe
  C:\Windows\System\ykLdPKH.exe
  2⤵
  PID:6216
- C:\Windows\System\TEikiaB.exe
  C:\Windows\System\TEikiaB.exe
  2⤵
  PID:6232
- C:\Windows\System\ilNgDma.exe
  C:\Windows\System\ilNgDma.exe
  2⤵
  PID:6248
- C:\Windows\System\ObeYdPC.exe
  C:\Windows\System\ObeYdPC.exe
  2⤵
  PID:6264
- C:\Windows\System\VaDlisz.exe
  C:\Windows\System\VaDlisz.exe
  2⤵
  PID:6280
- C:\Windows\System\wIqSiSI.exe
  C:\Windows\System\wIqSiSI.exe
  2⤵
  PID:6296
- C:\Windows\System\uyGQEzN.exe
  C:\Windows\System\uyGQEzN.exe
  2⤵
  PID:6312
- C:\Windows\System\HeFJdTJ.exe
  C:\Windows\System\HeFJdTJ.exe
  2⤵
  PID:6352
- C:\Windows\System\femAAbP.exe
  C:\Windows\System\femAAbP.exe
  2⤵
  PID:6368
- C:\Windows\System\mddZlny.exe
  C:\Windows\System\mddZlny.exe
  2⤵
  PID:6400
- C:\Windows\System\IwbDJhP.exe
  C:\Windows\System\IwbDJhP.exe
  2⤵
  PID:6416
- C:\Windows\System\RmAARjt.exe
  C:\Windows\System\RmAARjt.exe
  2⤵
  PID:6440
- C:\Windows\System\yoCHVpr.exe
  C:\Windows\System\yoCHVpr.exe
  2⤵
  PID:6456
- C:\Windows\System\VGGgTlD.exe
  C:\Windows\System\VGGgTlD.exe
  2⤵
  PID:6472
- C:\Windows\System\ktwgdei.exe
  C:\Windows\System\ktwgdei.exe
  2⤵
  PID:6488
- C:\Windows\System\RMKHiog.exe
  C:\Windows\System\RMKHiog.exe
  2⤵
  PID:6504
- C:\Windows\System\PkxqzyW.exe
  C:\Windows\System\PkxqzyW.exe
  2⤵
  PID:6524
- C:\Windows\System\YEkGkFG.exe
  C:\Windows\System\YEkGkFG.exe
  2⤵
  PID:6540
- C:\Windows\System\UbUvjrL.exe
  C:\Windows\System\UbUvjrL.exe
  2⤵
  PID:6556
- C:\Windows\System\zxVKkSP.exe
  C:\Windows\System\zxVKkSP.exe
  2⤵
  PID:6572
- C:\Windows\System\EpWEhDg.exe
  C:\Windows\System\EpWEhDg.exe
  2⤵
  PID:6588
- C:\Windows\System\jyNVyql.exe
  C:\Windows\System\jyNVyql.exe
  2⤵
  PID:6604
- C:\Windows\System\wTSJfDa.exe
  C:\Windows\System\wTSJfDa.exe
  2⤵
  PID:6620
- C:\Windows\System\hPDkjRb.exe
  C:\Windows\System\hPDkjRb.exe
  2⤵
  PID:6636
- C:\Windows\System\SwpwwSw.exe
  C:\Windows\System\SwpwwSw.exe
  2⤵
  PID:6652
- C:\Windows\System\jvppNrw.exe
  C:\Windows\System\jvppNrw.exe
  2⤵
  PID:6668
- C:\Windows\System\uTRWmXA.exe
  C:\Windows\System\uTRWmXA.exe
  2⤵
  PID:6684
- C:\Windows\System\XMbzuWf.exe
  C:\Windows\System\XMbzuWf.exe
  2⤵
  PID:6700
- C:\Windows\System\ftEsyeo.exe
  C:\Windows\System\ftEsyeo.exe
  2⤵
  PID:6716
- C:\Windows\System\UVNihmg.exe
  C:\Windows\System\UVNihmg.exe
  2⤵
  PID:6732
- C:\Windows\System\VrKEyVG.exe
  C:\Windows\System\VrKEyVG.exe
  2⤵
  PID:6748
- C:\Windows\System\cDLwUWX.exe
  C:\Windows\System\cDLwUWX.exe
  2⤵
  PID:6764
- C:\Windows\System\tjRmvBe.exe
  C:\Windows\System\tjRmvBe.exe
  2⤵
  PID:6780
- C:\Windows\System\gTkHKOX.exe
  C:\Windows\System\gTkHKOX.exe
  2⤵
  PID:6796
- C:\Windows\System\NjXvBuH.exe
  C:\Windows\System\NjXvBuH.exe
  2⤵
  PID:6812
- C:\Windows\System\FMDxpnq.exe
  C:\Windows\System\FMDxpnq.exe
  2⤵
  PID:6828
- C:\Windows\System\GUWfVij.exe
  C:\Windows\System\GUWfVij.exe
  2⤵
  PID:6844
- C:\Windows\System\WScExlb.exe
  C:\Windows\System\WScExlb.exe
  2⤵
  PID:6860
- C:\Windows\System\wabplNa.exe
  C:\Windows\System\wabplNa.exe
  2⤵
  PID:6876
- C:\Windows\System\fEUsTQJ.exe
  C:\Windows\System\fEUsTQJ.exe
  2⤵
  PID:6892
- C:\Windows\System\fkUBKFH.exe
  C:\Windows\System\fkUBKFH.exe
  2⤵
  PID:6908
- C:\Windows\System\txnCTzd.exe
  C:\Windows\System\txnCTzd.exe
  2⤵
  PID:6924
- C:\Windows\System\cEctSha.exe
  C:\Windows\System\cEctSha.exe
  2⤵
  PID:6940
- C:\Windows\System\rrvpfGS.exe
  C:\Windows\System\rrvpfGS.exe
  2⤵
  PID:6956
- C:\Windows\System\psbCdbS.exe
  C:\Windows\System\psbCdbS.exe
  2⤵
  PID:6972
- C:\Windows\System\FoIJzhw.exe
  C:\Windows\System\FoIJzhw.exe
  2⤵
  PID:6988
- C:\Windows\System\QjPKrJS.exe
  C:\Windows\System\QjPKrJS.exe
  2⤵
  PID:7004
- C:\Windows\System\KtbeKVA.exe
  C:\Windows\System\KtbeKVA.exe
  2⤵
  PID:7020
- C:\Windows\System\NselobE.exe
  C:\Windows\System\NselobE.exe
  2⤵
  PID:7036
- C:\Windows\System\XgiaBPx.exe
  C:\Windows\System\XgiaBPx.exe
  2⤵
  PID:7052
- C:\Windows\System\DizeMjC.exe
  C:\Windows\System\DizeMjC.exe
  2⤵
  PID:7068
- C:\Windows\System\xpMmBbF.exe
  C:\Windows\System\xpMmBbF.exe
  2⤵
  PID:7084
- C:\Windows\System\guaOOyz.exe
  C:\Windows\System\guaOOyz.exe
  2⤵
  PID:7100
- C:\Windows\System\KegPDEq.exe
  C:\Windows\System\KegPDEq.exe
  2⤵
  PID:7116
- C:\Windows\System\FYgXFEl.exe
  C:\Windows\System\FYgXFEl.exe
  2⤵
  PID:7132
- C:\Windows\System\pxexmkD.exe
  C:\Windows\System\pxexmkD.exe
  2⤵
  PID:7148
- C:\Windows\System\hWTXRBW.exe
  C:\Windows\System\hWTXRBW.exe
  2⤵
  PID:7164
- C:\Windows\System\CQSPlVG.exe
  C:\Windows\System\CQSPlVG.exe
  2⤵
  PID:6172
- C:\Windows\System\YgLHGUM.exe
  C:\Windows\System\YgLHGUM.exe
  2⤵
  PID:6240
- C:\Windows\System\VPAvSzT.exe
  C:\Windows\System\VPAvSzT.exe
  2⤵
  PID:5372
- C:\Windows\System\gNewXnY.exe
  C:\Windows\System\gNewXnY.exe
  2⤵
  PID:5300
- C:\Windows\System\UosBkXO.exe
  C:\Windows\System\UosBkXO.exe
  2⤵
  PID:6412
- C:\Windows\System\uyZcAbR.exe
  C:\Windows\System\uyZcAbR.exe
  2⤵
  PID:6484
- C:\Windows\System\SlSWvRg.exe
  C:\Windows\System\SlSWvRg.exe
  2⤵
  PID:6308
- C:\Windows\System\JqASsya.exe
  C:\Windows\System\JqASsya.exe
  2⤵
  PID:6552
- C:\Windows\System\FrGfzKD.exe
  C:\Windows\System\FrGfzKD.exe
  2⤵
  PID:6156
- C:\Windows\System\CFoUaGo.exe
  C:\Windows\System\CFoUaGo.exe
  2⤵
  PID:6648
- C:\Windows\System\IRlyImL.exe
  C:\Windows\System\IRlyImL.exe
  2⤵
  PID:5404
- C:\Windows\System\jvWUiZn.exe
  C:\Windows\System\jvWUiZn.exe
  2⤵
  PID:5648
- C:\Windows\System\RbLmkyA.exe
  C:\Windows\System\RbLmkyA.exe
  2⤵
  PID:5892
- C:\Windows\System\MNHJcuf.exe
  C:\Windows\System\MNHJcuf.exe
  2⤵
  PID:5336
- C:\Windows\System\mHXZYaJ.exe
  C:\Windows\System\mHXZYaJ.exe
  2⤵
  PID:6112
- C:\Windows\System\toSxEAs.exe
  C:\Windows\System\toSxEAs.exe
  2⤵
  PID:6428
- C:\Windows\System\vxtLcaZ.exe
  C:\Windows\System\vxtLcaZ.exe
  2⤵
  PID:6340
- C:\Windows\System\gPtiGid.exe
  C:\Windows\System\gPtiGid.exe
  2⤵
  PID:6536
- C:\Windows\System\JRfwlER.exe
  C:\Windows\System\JRfwlER.exe
  2⤵
  PID:6664
- C:\Windows\System\PcReSyn.exe
  C:\Windows\System\PcReSyn.exe
  2⤵
  PID:5408
- C:\Windows\System\rySNcHX.exe
  C:\Windows\System\rySNcHX.exe
  2⤵
  PID:5468
- C:\Windows\System\HoXYdfq.exe
  C:\Windows\System\HoXYdfq.exe
  2⤵
  PID:5536
- C:\Windows\System\uFdvpoA.exe
  C:\Windows\System\uFdvpoA.exe
  2⤵
  PID:5688
- C:\Windows\System\VgPFILB.exe
  C:\Windows\System\VgPFILB.exe
  2⤵
  PID:6696
- C:\Windows\System\sQEFMjo.exe
  C:\Windows\System\sQEFMjo.exe
  2⤵
  PID:5828
- C:\Windows\System\TpoKBIy.exe
  C:\Windows\System\TpoKBIy.exe
  2⤵
  PID:5924
- C:\Windows\System\MoJljMx.exe
  C:\Windows\System\MoJljMx.exe
  2⤵
  PID:5992
- C:\Windows\System\ePvAeTq.exe
  C:\Windows\System\ePvAeTq.exe
  2⤵
  PID:6032
- C:\Windows\System\IoegrGG.exe
  C:\Windows\System\IoegrGG.exe
  2⤵
  PID:6096
- C:\Windows\System\NSPmPhB.exe
  C:\Windows\System\NSPmPhB.exe
  2⤵
  PID:4500
- C:\Windows\System\gnSWBVo.exe
  C:\Windows\System\gnSWBVo.exe
  2⤵
  PID:5220
- C:\Windows\System\qcQXDTW.exe
  C:\Windows\System\qcQXDTW.exe
  2⤵
  PID:5356
- C:\Windows\System\ezIvfLe.exe
  C:\Windows\System\ezIvfLe.exe
  2⤵
  PID:5584
- C:\Windows\System\PyEVQhj.exe
  C:\Windows\System\PyEVQhj.exe
  2⤵
  PID:5912
- C:\Windows\System\MtfeXTy.exe
  C:\Windows\System\MtfeXTy.exe
  2⤵
  PID:6140
- C:\Windows\System\HBXHLGE.exe
  C:\Windows\System\HBXHLGE.exe
  2⤵
  PID:6392
- C:\Windows\System\lzlpYEr.exe
  C:\Windows\System\lzlpYEr.exe
  2⤵
  PID:6596
- C:\Windows\System\sslFiZf.exe
  C:\Windows\System\sslFiZf.exe
  2⤵
  PID:6192
- C:\Windows\System\NLbsnAY.exe
  C:\Windows\System\NLbsnAY.exe
  2⤵
  PID:6632
- C:\Windows\System\UMtmeNF.exe
  C:\Windows\System\UMtmeNF.exe
  2⤵
  PID:6324
- C:\Windows\System\tMqYUNY.exe
  C:\Windows\System\tMqYUNY.exe
  2⤵
  PID:5744
- C:\Windows\System\BFYTxyR.exe
  C:\Windows\System\BFYTxyR.exe
  2⤵
  PID:6380
- C:\Windows\System\MOaAHfg.exe
  C:\Windows\System\MOaAHfg.exe
  2⤵
  PID:6728
- C:\Windows\System\hVxqDsY.exe
  C:\Windows\System\hVxqDsY.exe
  2⤵
  PID:6760
- C:\Windows\System\gIoEgUv.exe
  C:\Windows\System\gIoEgUv.exe
  2⤵
  PID:6840
- C:\Windows\System\hneIuDv.exe
  C:\Windows\System\hneIuDv.exe
  2⤵
  PID:6740
- C:\Windows\System\XsSnbkI.exe
  C:\Windows\System\XsSnbkI.exe
  2⤵
  PID:6936
- C:\Windows\System\vHtwFYC.exe
  C:\Windows\System\vHtwFYC.exe
  2⤵
  PID:7000
- C:\Windows\System\jGPEIqR.exe
  C:\Windows\System\jGPEIqR.exe
  2⤵
  PID:6884
- C:\Windows\System\DgvxPfV.exe
  C:\Windows\System\DgvxPfV.exe
  2⤵
  PID:6820
- C:\Windows\System\XLvMPxd.exe
  C:\Windows\System\XLvMPxd.exe
  2⤵
  PID:7092
- C:\Windows\System\KqEXXPV.exe
  C:\Windows\System\KqEXXPV.exe
  2⤵
  PID:7124
- C:\Windows\System\hypoPlK.exe
  C:\Windows\System\hypoPlK.exe
  2⤵
  PID:6916
- C:\Windows\System\UqGmFTz.exe
  C:\Windows\System\UqGmFTz.exe
  2⤵
  PID:7012
- C:\Windows\System\BnGTXgh.exe
  C:\Windows\System\BnGTXgh.exe
  2⤵
  PID:7108
- C:\Windows\System\zrPYyAH.exe
  C:\Windows\System\zrPYyAH.exe
  2⤵
  PID:6012
- C:\Windows\System\HmMTOAT.exe
  C:\Windows\System\HmMTOAT.exe
  2⤵
  PID:6212
- C:\Windows\System\LDNdkIx.exe
  C:\Windows\System\LDNdkIx.exe
  2⤵
  PID:6452
- C:\Windows\System\sMniSmY.exe
  C:\Windows\System\sMniSmY.exe
  2⤵
  PID:6616
- C:\Windows\System\vsPWcTd.exe
  C:\Windows\System\vsPWcTd.exe
  2⤵
  PID:5204
- C:\Windows\System\DzsmCgT.exe
  C:\Windows\System\DzsmCgT.exe
  2⤵
  PID:6500
- C:\Windows\System\dRvCVxC.exe
  C:\Windows\System\dRvCVxC.exe
  2⤵
  PID:5504
- C:\Windows\System\oYoPKMf.exe
  C:\Windows\System\oYoPKMf.exe
  2⤵
  PID:5732
- C:\Windows\System\MnTXGRp.exe
  C:\Windows\System\MnTXGRp.exe
  2⤵
  PID:5600
- C:\Windows\System\SkFpNuR.exe
  C:\Windows\System\SkFpNuR.exe
  2⤵
  PID:6408
- C:\Windows\System\vUvQcRJ.exe
  C:\Windows\System\vUvQcRJ.exe
  2⤵
  PID:6076
- C:\Windows\System\FdCUHPx.exe
  C:\Windows\System\FdCUHPx.exe
  2⤵
  PID:5324
- C:\Windows\System\MnzKsSo.exe
  C:\Windows\System\MnzKsSo.exe
  2⤵
  PID:6288
- C:\Windows\System\zipCefY.exe
  C:\Windows\System\zipCefY.exe
  2⤵
  PID:5864
- C:\Windows\System\eHwtOMz.exe
  C:\Windows\System\eHwtOMz.exe
  2⤵
  PID:6000
- C:\Windows\System\ZKzbVKT.exe
  C:\Windows\System\ZKzbVKT.exe
  2⤵
  PID:6092
- C:\Windows\System\wOQhoix.exe
  C:\Windows\System\wOQhoix.exe
  2⤵
  PID:5184
- C:\Windows\System\VySHNzf.exe
  C:\Windows\System\VySHNzf.exe
  2⤵
  PID:5580
- C:\Windows\System\HvozvOu.exe
  C:\Windows\System\HvozvOu.exe
  2⤵
  PID:5848
- C:\Windows\System\IXzlIPp.exe
  C:\Windows\System\IXzlIPp.exe
  2⤵
  PID:6048
- C:\Windows\System\IltPicd.exe
  C:\Windows\System\IltPicd.exe
  2⤵
  PID:6348
- C:\Windows\System\LgqpgtY.exe
  C:\Windows\System\LgqpgtY.exe
  2⤵
  PID:6228
- C:\Windows\System\MMIjiri.exe
  C:\Windows\System\MMIjiri.exe
  2⤵
  PID:6388
- C:\Windows\System\CiEzFyw.exe
  C:\Windows\System\CiEzFyw.exe
  2⤵
  PID:6872
- C:\Windows\System\QAsxiye.exe
  C:\Windows\System\QAsxiye.exe
  2⤵
  PID:6904
- C:\Windows\System\OSJmYeR.exe
  C:\Windows\System\OSJmYeR.exe
  2⤵
  PID:7032
- C:\Windows\System\pclkOuu.exe
  C:\Windows\System\pclkOuu.exe
  2⤵
  PID:7016
- C:\Windows\System\UrJyBqX.exe
  C:\Windows\System\UrJyBqX.exe
  2⤵
  PID:6792
- C:\Windows\System\LoTOkIZ.exe
  C:\Windows\System\LoTOkIZ.exe
  2⤵
  PID:6984
- C:\Windows\System\yYkKXNu.exe
  C:\Windows\System\yYkKXNu.exe
  2⤵
  PID:5860
- C:\Windows\System\EkxRtug.exe
  C:\Windows\System\EkxRtug.exe
  2⤵
  PID:5376
- C:\Windows\System\gMlOuNf.exe
  C:\Windows\System\gMlOuNf.exe
  2⤵
  PID:7160
- C:\Windows\System\zXuUIQl.exe
  C:\Windows\System\zXuUIQl.exe
  2⤵
  PID:6584
- C:\Windows\System\XjMJFjE.exe
  C:\Windows\System\XjMJFjE.exe
  2⤵
  PID:7080
- C:\Windows\System\HJwDqth.exe
  C:\Windows\System\HJwDqth.exe
  2⤵
  PID:6272
- C:\Windows\System\ojgOSNp.exe
  C:\Windows\System\ojgOSNp.exe
  2⤵
  PID:5760
- C:\Windows\System\HFWQCWh.exe
  C:\Windows\System\HFWQCWh.exe
  2⤵
  PID:4640
- C:\Windows\System\RPWWjaP.exe
  C:\Windows\System\RPWWjaP.exe
  2⤵
  PID:6260
- C:\Windows\System\EhAcrYw.exe
  C:\Windows\System\EhAcrYw.exe
  2⤵
  PID:6064
- C:\Windows\System\DEzfKGw.exe
  C:\Windows\System\DEzfKGw.exe
  2⤵
  PID:6968
- C:\Windows\System\fSdoQpH.exe
  C:\Windows\System\fSdoQpH.exe
  2⤵
  PID:7096
- C:\Windows\System\DqfZMBy.exe
  C:\Windows\System\DqfZMBy.exe
  2⤵
  PID:6564
- C:\Windows\System\cKdfxbe.exe
  C:\Windows\System\cKdfxbe.exe
  2⤵
  PID:5604
- C:\Windows\System\wpHmtuW.exe
  C:\Windows\System\wpHmtuW.exe
  2⤵
  PID:6396
- C:\Windows\System\CousgPi.exe
  C:\Windows\System\CousgPi.exe
  2⤵
  PID:5896
- C:\Windows\System\yrnAiCT.exe
  C:\Windows\System\yrnAiCT.exe
  2⤵
  PID:5684
- C:\Windows\System\VVpTXQO.exe
  C:\Windows\System\VVpTXQO.exe
  2⤵
  PID:6568
- C:\Windows\System\aKtDJvV.exe
  C:\Windows\System\aKtDJvV.exe
  2⤵
  PID:6808
- C:\Windows\System\fnzRXFj.exe
  C:\Windows\System\fnzRXFj.exe
  2⤵
  PID:7156
- C:\Windows\System\oBYvamX.exe
  C:\Windows\System\oBYvamX.exe
  2⤵
  PID:6836
- C:\Windows\System\OHACgWH.exe
  C:\Windows\System\OHACgWH.exe
  2⤵
  PID:5792
- C:\Windows\System\aUVIUFT.exe
  C:\Windows\System\aUVIUFT.exe
  2⤵
  PID:6464
- C:\Windows\System\AaYmyQX.exe
  C:\Windows\System\AaYmyQX.exe
  2⤵
  PID:5424
- C:\Windows\System\XIlilzP.exe
  C:\Windows\System\XIlilzP.exe
  2⤵
  PID:6304
- C:\Windows\System\ZMZUXXF.exe
  C:\Windows\System\ZMZUXXF.exe
  2⤵
  PID:7064
- C:\Windows\System\oKpNqHr.exe
  C:\Windows\System\oKpNqHr.exe
  2⤵
  PID:5808
- C:\Windows\System\sofavgC.exe
  C:\Windows\System\sofavgC.exe
  2⤵
  PID:7176
- C:\Windows\System\kyfAisq.exe
  C:\Windows\System\kyfAisq.exe
  2⤵
  PID:7192
- C:\Windows\System\HuXNKas.exe
  C:\Windows\System\HuXNKas.exe
  2⤵
  PID:7208
- C:\Windows\System\JoHdkLO.exe
  C:\Windows\System\JoHdkLO.exe
  2⤵
  PID:7224
- C:\Windows\System\RcMaxhC.exe
  C:\Windows\System\RcMaxhC.exe
  2⤵
  PID:7240
- C:\Windows\System\zNEjeRv.exe
  C:\Windows\System\zNEjeRv.exe
  2⤵
  PID:7256
- C:\Windows\System\LSkfkcR.exe
  C:\Windows\System\LSkfkcR.exe
  2⤵
  PID:7272
- C:\Windows\System\tXLzsLm.exe
  C:\Windows\System\tXLzsLm.exe
  2⤵
  PID:7288
- C:\Windows\System\hEtdoZP.exe
  C:\Windows\System\hEtdoZP.exe
  2⤵
  PID:7304
- C:\Windows\System\lXKyzEe.exe
  C:\Windows\System\lXKyzEe.exe
  2⤵
  PID:7320
- C:\Windows\System\bTFuSlf.exe
  C:\Windows\System\bTFuSlf.exe
  2⤵
  PID:7336
- C:\Windows\System\VsbLMMd.exe
  C:\Windows\System\VsbLMMd.exe
  2⤵
  PID:7352
- C:\Windows\System\FqybfLR.exe
  C:\Windows\System\FqybfLR.exe
  2⤵
  PID:7368
- C:\Windows\System\dBCTzET.exe
  C:\Windows\System\dBCTzET.exe
  2⤵
  PID:7384
- C:\Windows\System\HGiniXc.exe
  C:\Windows\System\HGiniXc.exe
  2⤵
  PID:7400
- C:\Windows\System\fdfYwxj.exe
  C:\Windows\System\fdfYwxj.exe
  2⤵
  PID:7416
- C:\Windows\System\fydjLJk.exe
  C:\Windows\System\fydjLJk.exe
  2⤵
  PID:7432
- C:\Windows\System\lLcktNR.exe
  C:\Windows\System\lLcktNR.exe
  2⤵
  PID:7448
- C:\Windows\System\DdRPYRW.exe
  C:\Windows\System\DdRPYRW.exe
  2⤵
  PID:7464
- C:\Windows\System\kgzLtRQ.exe
  C:\Windows\System\kgzLtRQ.exe
  2⤵
  PID:7480
- C:\Windows\System\WVEpSCZ.exe
  C:\Windows\System\WVEpSCZ.exe
  2⤵
  PID:7496
- C:\Windows\System\SHDWTbF.exe
  C:\Windows\System\SHDWTbF.exe
  2⤵
  PID:7512
- C:\Windows\System\gwUABsX.exe
  C:\Windows\System\gwUABsX.exe
  2⤵
  PID:7528
- C:\Windows\System\ZCdTSPW.exe
  C:\Windows\System\ZCdTSPW.exe
  2⤵
  PID:7544
- C:\Windows\System\jMMYXOH.exe
  C:\Windows\System\jMMYXOH.exe
  2⤵
  PID:7560
- C:\Windows\System\ANConTU.exe
  C:\Windows\System\ANConTU.exe
  2⤵
  PID:7576
- C:\Windows\System\EnbJzqg.exe
  C:\Windows\System\EnbJzqg.exe
  2⤵
  PID:7592
- C:\Windows\System\LiGGUyt.exe
  C:\Windows\System\LiGGUyt.exe
  2⤵
  PID:7608
- C:\Windows\System\oyoXLFg.exe
  C:\Windows\System\oyoXLFg.exe
  2⤵
  PID:7624
- C:\Windows\System\OfanXMz.exe
  C:\Windows\System\OfanXMz.exe
  2⤵
  PID:7640
- C:\Windows\System\PDwKvyb.exe
  C:\Windows\System\PDwKvyb.exe
  2⤵
  PID:7656
- C:\Windows\System\zjidBpX.exe
  C:\Windows\System\zjidBpX.exe
  2⤵
  PID:7672
- C:\Windows\System\jDbpDEv.exe
  C:\Windows\System\jDbpDEv.exe
  2⤵
  PID:7688
- C:\Windows\System\NPZSocX.exe
  C:\Windows\System\NPZSocX.exe
  2⤵
  PID:7704
- C:\Windows\System\LLudVjr.exe
  C:\Windows\System\LLudVjr.exe
  2⤵
  PID:7720
- C:\Windows\System\eWWFmPa.exe
  C:\Windows\System\eWWFmPa.exe
  2⤵
  PID:7736
- C:\Windows\System\egWXyVk.exe
  C:\Windows\System\egWXyVk.exe
  2⤵
  PID:7752
- C:\Windows\System\aVIyFrp.exe
  C:\Windows\System\aVIyFrp.exe
  2⤵
  PID:7768
- C:\Windows\System\BdnemPT.exe
  C:\Windows\System\BdnemPT.exe
  2⤵
  PID:7784
- C:\Windows\System\CJzEtqq.exe
  C:\Windows\System\CJzEtqq.exe
  2⤵
  PID:7800
- C:\Windows\System\JbLhedw.exe
  C:\Windows\System\JbLhedw.exe
  2⤵
  PID:7816
- C:\Windows\System\wWXqHWq.exe
  C:\Windows\System\wWXqHWq.exe
  2⤵
  PID:7832
- C:\Windows\System\QIvIGrn.exe
  C:\Windows\System\QIvIGrn.exe
  2⤵
  PID:7848
- C:\Windows\System\Lzczjnr.exe
  C:\Windows\System\Lzczjnr.exe
  2⤵
  PID:7864
- C:\Windows\System\KkiqkCy.exe
  C:\Windows\System\KkiqkCy.exe
  2⤵
  PID:7880
- C:\Windows\System\bdmfRSk.exe
  C:\Windows\System\bdmfRSk.exe
  2⤵
  PID:7896
- C:\Windows\System\KJBPYma.exe
  C:\Windows\System\KJBPYma.exe
  2⤵
  PID:7912
- C:\Windows\System\nglAqOf.exe
  C:\Windows\System\nglAqOf.exe
  2⤵
  PID:7928
- C:\Windows\System\dODZPfk.exe
  C:\Windows\System\dODZPfk.exe
  2⤵
  PID:7944
- C:\Windows\System\zWuhLVP.exe
  C:\Windows\System\zWuhLVP.exe
  2⤵
  PID:7960
- C:\Windows\System\mtXAISx.exe
  C:\Windows\System\mtXAISx.exe
  2⤵
  PID:7976
- C:\Windows\System\OmaLrnc.exe
  C:\Windows\System\OmaLrnc.exe
  2⤵
  PID:7992
- C:\Windows\System\MdwltvS.exe
  C:\Windows\System\MdwltvS.exe
  2⤵
  PID:8008
- C:\Windows\System\oBuhCcK.exe
  C:\Windows\System\oBuhCcK.exe
  2⤵
  PID:8024
- C:\Windows\System\gKkicUO.exe
  C:\Windows\System\gKkicUO.exe
  2⤵
  PID:8040
- C:\Windows\System\AfkwlqC.exe
  C:\Windows\System\AfkwlqC.exe
  2⤵
  PID:8056
- C:\Windows\System\XIPrIVF.exe
  C:\Windows\System\XIPrIVF.exe
  2⤵
  PID:8072
- C:\Windows\System\HThOVNj.exe
  C:\Windows\System\HThOVNj.exe
  2⤵
  PID:8088
- C:\Windows\System\UOtbtXp.exe
  C:\Windows\System\UOtbtXp.exe
  2⤵
  PID:8104
- C:\Windows\System\zzHJjpg.exe
  C:\Windows\System\zzHJjpg.exe
  2⤵
  PID:8120
- C:\Windows\System\xfWLWCz.exe
  C:\Windows\System\xfWLWCz.exe
  2⤵
  PID:8136
- C:\Windows\System\iGZUNva.exe
  C:\Windows\System\iGZUNva.exe
  2⤵
  PID:8152
- C:\Windows\System\fNHWFyt.exe
  C:\Windows\System\fNHWFyt.exe
  2⤵
  PID:8168
- C:\Windows\System\xWeDPXy.exe
  C:\Windows\System\xWeDPXy.exe
  2⤵
  PID:8184
- C:\Windows\System\WYzWTgw.exe
  C:\Windows\System\WYzWTgw.exe
  2⤵
  PID:7200
- C:\Windows\System\sbnFZgx.exe
  C:\Windows\System\sbnFZgx.exe
  2⤵
  PID:7236
- C:\Windows\System\HiNEggO.exe
  C:\Windows\System\HiNEggO.exe
  2⤵
  PID:7264
- C:\Windows\System\WtKixWI.exe
  C:\Windows\System\WtKixWI.exe
  2⤵
  PID:7216
- C:\Windows\System\PekuYtA.exe
  C:\Windows\System\PekuYtA.exe
  2⤵
  PID:7280
- C:\Windows\System\prBQndc.exe
  C:\Windows\System\prBQndc.exe
  2⤵
  PID:7332
- C:\Windows\System\pHeqsiB.exe
  C:\Windows\System\pHeqsiB.exe
  2⤵
  PID:7344
- C:\Windows\System\pdWLWCb.exe
  C:\Windows\System\pdWLWCb.exe
  2⤵
  PID:7348
- C:\Windows\System\swhKXOC.exe
  C:\Windows\System\swhKXOC.exe
  2⤵
  PID:7424
- C:\Windows\System\acPudmW.exe
  C:\Windows\System\acPudmW.exe
  2⤵
  PID:7456
- C:\Windows\System\sZyvvmO.exe
  C:\Windows\System\sZyvvmO.exe
  2⤵
  PID:7520
- C:\Windows\System\FLqybHT.exe
  C:\Windows\System\FLqybHT.exe
  2⤵
  PID:7584
- C:\Windows\System\admdjUD.exe
  C:\Windows\System\admdjUD.exe
  2⤵
  PID:7648
- C:\Windows\System\fuakfxY.exe
  C:\Windows\System\fuakfxY.exe
  2⤵
  PID:7712
- C:\Windows\System\cYcpDkt.exe
  C:\Windows\System\cYcpDkt.exe
  2⤵
  PID:7444
- C:\Windows\System\LrQkFCG.exe
  C:\Windows\System\LrQkFCG.exe
  2⤵
  PID:7600
- C:\Windows\System\zjMRpRf.exe
  C:\Windows\System\zjMRpRf.exe
  2⤵
  PID:7776
- C:\Windows\System\iryESqj.exe
  C:\Windows\System\iryESqj.exe
  2⤵
  PID:7504
- C:\Windows\System\fpASqyy.exe
  C:\Windows\System\fpASqyy.exe
  2⤵
  PID:7568
- C:\Windows\System\uzJXvSt.exe
  C:\Windows\System\uzJXvSt.exe
  2⤵
  PID:7668
- C:\Windows\System\DTAhfhj.exe
  C:\Windows\System\DTAhfhj.exe
  2⤵
  PID:7840
- C:\Windows\System\yDDpzfO.exe
  C:\Windows\System\yDDpzfO.exe
  2⤵
  PID:7764
- C:\Windows\System\dZLfdmA.exe
  C:\Windows\System\dZLfdmA.exe
  2⤵
  PID:7828
- C:\Windows\System\tURmyUV.exe
  C:\Windows\System\tURmyUV.exe
  2⤵
  PID:7904
- C:\Windows\System\jAWdBiZ.exe
  C:\Windows\System\jAWdBiZ.exe
  2⤵
  PID:7968
- C:\Windows\System\NZhuiaz.exe
  C:\Windows\System\NZhuiaz.exe
  2⤵
  PID:8032
- C:\Windows\System\qyWXmnl.exe
  C:\Windows\System\qyWXmnl.exe
  2⤵
  PID:8096
- C:\Windows\System\VQcodbX.exe
  C:\Windows\System\VQcodbX.exe
  2⤵
  PID:8128
- C:\Windows\System\WDGVBUF.exe
  C:\Windows\System\WDGVBUF.exe
  2⤵
  PID:8048
- C:\Windows\System\ykgtgcy.exe
  C:\Windows\System\ykgtgcy.exe
  2⤵
  PID:8112
- C:\Windows\System\tDkuuPC.exe
  C:\Windows\System\tDkuuPC.exe
  2⤵
  PID:8016
- C:\Windows\System\EGdCkxd.exe
  C:\Windows\System\EGdCkxd.exe
  2⤵
  PID:8164
- C:\Windows\System\DgjTCer.exe
  C:\Windows\System\DgjTCer.exe
  2⤵
  PID:7172
- C:\Windows\System\urMctVn.exe
  C:\Windows\System\urMctVn.exe
  2⤵
  PID:7252
- C:\Windows\System\lYQCevH.exe
  C:\Windows\System\lYQCevH.exe
  2⤵
  PID:7396
- C:\Windows\System\adflsBo.exe
  C:\Windows\System\adflsBo.exe
  2⤵
  PID:7588
- C:\Windows\System\UAAGWRJ.exe
  C:\Windows\System\UAAGWRJ.exe
  2⤵
  PID:7744
- C:\Windows\System\uHWpRlE.exe
  C:\Windows\System\uHWpRlE.exe
  2⤵
  PID:5484
- C:\Windows\System\XdZxsTP.exe
  C:\Windows\System\XdZxsTP.exe
  2⤵
  PID:7536
- C:\Windows\System\ocKBDvl.exe
  C:\Windows\System\ocKBDvl.exe
  2⤵
  PID:7812
- C:\Windows\System\FiGuzzP.exe
  C:\Windows\System\FiGuzzP.exe
  2⤵
  PID:7872
- C:\Windows\System\EqqtlDa.exe
  C:\Windows\System\EqqtlDa.exe
  2⤵
  PID:7664
- C:\Windows\System\ZlnQhUW.exe
  C:\Windows\System\ZlnQhUW.exe
  2⤵
  PID:7440
- C:\Windows\System\sWmiUga.exe
  C:\Windows\System\sWmiUga.exe
  2⤵
  PID:7760
- C:\Windows\System\MGxBpdc.exe
  C:\Windows\System\MGxBpdc.exe
  2⤵
  PID:7844
- C:\Windows\System\mYZDibY.exe
  C:\Windows\System\mYZDibY.exe
  2⤵
  PID:7876
- C:\Windows\System\CkBPqWd.exe
  C:\Windows\System\CkBPqWd.exe
  2⤵
  PID:7892
- C:\Windows\System\wKhIkrD.exe
  C:\Windows\System\wKhIkrD.exe
  2⤵
  PID:7988
- C:\Windows\System\HowCtlV.exe
  C:\Windows\System\HowCtlV.exe
  2⤵
  PID:7392
- C:\Windows\System\WGsmuTW.exe
  C:\Windows\System\WGsmuTW.exe
  2⤵
  PID:7248
- C:\Windows\System\daQgOZb.exe
  C:\Windows\System\daQgOZb.exe
  2⤵
  PID:7492
- C:\Windows\System\XXatKug.exe
  C:\Windows\System\XXatKug.exe
  2⤵
  PID:7748
- C:\Windows\System\YBSokAw.exe
  C:\Windows\System\YBSokAw.exe
  2⤵
  PID:7428
- C:\Windows\System\mxLyiyB.exe
  C:\Windows\System\mxLyiyB.exe
  2⤵
  PID:7940
- C:\Windows\System\frLjKjM.exe
  C:\Windows\System\frLjKjM.exe
  2⤵
  PID:8132
- C:\Windows\System\bVtpghr.exe
  C:\Windows\System\bVtpghr.exe
  2⤵
  PID:7476
- C:\Windows\System\gDwAaFb.exe
  C:\Windows\System\gDwAaFb.exe
  2⤵
  PID:7412
- C:\Windows\System\fkqbouh.exe
  C:\Windows\System\fkqbouh.exe
  2⤵
  PID:7680
- C:\Windows\System\ijzQBLO.exe
  C:\Windows\System\ijzQBLO.exe
  2⤵
  PID:7924
- C:\Windows\System\OxNreja.exe
  C:\Windows\System\OxNreja.exe
  2⤵
  PID:7380
- C:\Windows\System\VNkZKjt.exe
  C:\Windows\System\VNkZKjt.exe
  2⤵
  PID:7888
- C:\Windows\System\ymNRAOx.exe
  C:\Windows\System\ymNRAOx.exe
  2⤵
  PID:7572
- C:\Windows\System\wHFowaq.exe
  C:\Windows\System\wHFowaq.exe
  2⤵
  PID:7620
- C:\Windows\System\GwgPrLY.exe
  C:\Windows\System\GwgPrLY.exe
  2⤵
  PID:8208
- C:\Windows\System\cuMCeQD.exe
  C:\Windows\System\cuMCeQD.exe
  2⤵
  PID:8224
- C:\Windows\System\uwWfoxx.exe
  C:\Windows\System\uwWfoxx.exe
  2⤵
  PID:8240
- C:\Windows\System\TxEGArx.exe
  C:\Windows\System\TxEGArx.exe
  2⤵
  PID:8256
- C:\Windows\System\muJNLYA.exe
  C:\Windows\System\muJNLYA.exe
  2⤵
  PID:8272
- C:\Windows\System\UogbDYg.exe
  C:\Windows\System\UogbDYg.exe
  2⤵
  PID:8288
- C:\Windows\System\bfjtDuJ.exe
  C:\Windows\System\bfjtDuJ.exe
  2⤵
  PID:8304
- C:\Windows\System\ZXgZgWW.exe
  C:\Windows\System\ZXgZgWW.exe
  2⤵
  PID:8320
- C:\Windows\System\ruqystE.exe
  C:\Windows\System\ruqystE.exe
  2⤵
  PID:8336
- C:\Windows\System\QlHiqno.exe
  C:\Windows\System\QlHiqno.exe
  2⤵
  PID:8352
- C:\Windows\System\tGQvvBt.exe
  C:\Windows\System\tGQvvBt.exe
  2⤵
  PID:8368
- C:\Windows\System\CdJWDAb.exe
  C:\Windows\System\CdJWDAb.exe
  2⤵
  PID:8384
- C:\Windows\System\MXlhelH.exe
  C:\Windows\System\MXlhelH.exe
  2⤵
  PID:8400
- C:\Windows\System\VPZxPgi.exe
  C:\Windows\System\VPZxPgi.exe
  2⤵
  PID:8416
- C:\Windows\System\CUvgBlz.exe
  C:\Windows\System\CUvgBlz.exe
  2⤵
  PID:8432
- C:\Windows\System\AFmzhfD.exe
  C:\Windows\System\AFmzhfD.exe
  2⤵
  PID:8448
- C:\Windows\System\QETjwWp.exe
  C:\Windows\System\QETjwWp.exe
  2⤵
  PID:8464
- C:\Windows\System\TelbDRN.exe
  C:\Windows\System\TelbDRN.exe
  2⤵
  PID:8480
- C:\Windows\System\GvAObdT.exe
  C:\Windows\System\GvAObdT.exe
  2⤵
  PID:8496
- C:\Windows\System\wjBLADu.exe
  C:\Windows\System\wjBLADu.exe
  2⤵
  PID:8512
- C:\Windows\System\CChHycP.exe
  C:\Windows\System\CChHycP.exe
  2⤵
  PID:8528
- C:\Windows\System\qBzyKaj.exe
  C:\Windows\System\qBzyKaj.exe
  2⤵
  PID:8544
- C:\Windows\System\nwVIGkP.exe
  C:\Windows\System\nwVIGkP.exe
  2⤵
  PID:8560
- C:\Windows\System\tzVUVxP.exe
  C:\Windows\System\tzVUVxP.exe
  2⤵
  PID:8576
- C:\Windows\System\iwDtMBw.exe
  C:\Windows\System\iwDtMBw.exe
  2⤵
  PID:8596
- C:\Windows\System\cSSuNOa.exe
  C:\Windows\System\cSSuNOa.exe
  2⤵
  PID:8612
- C:\Windows\System\ZoYhKio.exe
  C:\Windows\System\ZoYhKio.exe
  2⤵
  PID:8628
- C:\Windows\System\NqMLnjK.exe
  C:\Windows\System\NqMLnjK.exe
  2⤵
  PID:8644
- C:\Windows\System\RzZyaCW.exe
  C:\Windows\System\RzZyaCW.exe
  2⤵
  PID:8660
- C:\Windows\System\DdIwfFw.exe
  C:\Windows\System\DdIwfFw.exe
  2⤵
  PID:8676
- C:\Windows\System\eLcBwfh.exe
  C:\Windows\System\eLcBwfh.exe
  2⤵
  PID:8692
- C:\Windows\System\xaArJyK.exe
  C:\Windows\System\xaArJyK.exe
  2⤵
  PID:8708
- C:\Windows\System\GQuWhVP.exe
  C:\Windows\System\GQuWhVP.exe
  2⤵
  PID:8724
- C:\Windows\System\oCawZUT.exe
  C:\Windows\System\oCawZUT.exe
  2⤵
  PID:8740
- C:\Windows\System\ZEDPbMo.exe
  C:\Windows\System\ZEDPbMo.exe
  2⤵
  PID:8756
- C:\Windows\System\gkRBuoH.exe
  C:\Windows\System\gkRBuoH.exe
  2⤵
  PID:8772
- C:\Windows\System\ZsMWaCK.exe
  C:\Windows\System\ZsMWaCK.exe
  2⤵
  PID:8788
- C:\Windows\System\ABJypqQ.exe
  C:\Windows\System\ABJypqQ.exe
  2⤵
  PID:8804
- C:\Windows\System\XAVvobf.exe
  C:\Windows\System\XAVvobf.exe
  2⤵
  PID:8820
- C:\Windows\System\RhDRmoK.exe
  C:\Windows\System\RhDRmoK.exe
  2⤵
  PID:8836
- C:\Windows\System\wSLtowb.exe
  C:\Windows\System\wSLtowb.exe
  2⤵
  PID:8852
- C:\Windows\System\lzGBTgF.exe
  C:\Windows\System\lzGBTgF.exe
  2⤵
  PID:8868
- C:\Windows\System\LlNgQdb.exe
  C:\Windows\System\LlNgQdb.exe
  2⤵
  PID:8884
- C:\Windows\System\DsNkROf.exe
  C:\Windows\System\DsNkROf.exe
  2⤵
  PID:8900
- C:\Windows\System\IWduFzj.exe
  C:\Windows\System\IWduFzj.exe
  2⤵
  PID:8916
- C:\Windows\System\dhYJIuw.exe
  C:\Windows\System\dhYJIuw.exe
  2⤵
  PID:8932
- C:\Windows\System\tmNGGnr.exe
  C:\Windows\System\tmNGGnr.exe
  2⤵
  PID:8948
- C:\Windows\System\ZsgFsbW.exe
  C:\Windows\System\ZsgFsbW.exe
  2⤵
  PID:8964
- C:\Windows\System\BmSDRUe.exe
  C:\Windows\System\BmSDRUe.exe
  2⤵
  PID:8980
- C:\Windows\System\tMRdSnJ.exe
  C:\Windows\System\tMRdSnJ.exe
  2⤵
  PID:8996
- C:\Windows\System\PCCUmvT.exe
  C:\Windows\System\PCCUmvT.exe
  2⤵
  PID:9012
- C:\Windows\System\kUtHfkZ.exe
  C:\Windows\System\kUtHfkZ.exe
  2⤵
  PID:9140
- C:\Windows\System\KcoVJIJ.exe
  C:\Windows\System\KcoVJIJ.exe
  2⤵
  PID:9156
- C:\Windows\System\SZkcXID.exe
  C:\Windows\System\SZkcXID.exe
  2⤵
  PID:9172
- C:\Windows\System\xblCLYn.exe
  C:\Windows\System\xblCLYn.exe
  2⤵
  PID:9188
- C:\Windows\System\YkVsVMw.exe
  C:\Windows\System\YkVsVMw.exe
  2⤵
  PID:9204
- C:\Windows\System\fKLFpIb.exe
  C:\Windows\System\fKLFpIb.exe
  2⤵
  PID:8216
- C:\Windows\System\tRSMkGc.exe
  C:\Windows\System\tRSMkGc.exe
  2⤵
  PID:8280
- C:\Windows\System\OamBkdx.exe
  C:\Windows\System\OamBkdx.exe
  2⤵
  PID:8232
- C:\Windows\System\FmHIswG.exe
  C:\Windows\System\FmHIswG.exe
  2⤵
  PID:8160
- C:\Windows\System\PQiiewn.exe
  C:\Windows\System\PQiiewn.exe
  2⤵
  PID:8380
- C:\Windows\System\zPmIexR.exe
  C:\Windows\System\zPmIexR.exe
  2⤵
  PID:6856
- C:\Windows\System\CgcVtSL.exe
  C:\Windows\System\CgcVtSL.exe
  2⤵
  PID:8408
- C:\Windows\System\MsKMvAh.exe
  C:\Windows\System\MsKMvAh.exe
  2⤵
  PID:8300
- C:\Windows\System\FpQPJzq.exe
  C:\Windows\System\FpQPJzq.exe
  2⤵
  PID:8360
- C:\Windows\System\XFgxzwN.exe
  C:\Windows\System\XFgxzwN.exe
  2⤵
  PID:8396
- C:\Windows\System\jZhyExr.exe
  C:\Windows\System\jZhyExr.exe
  2⤵
  PID:8504
- C:\Windows\System\RJxbcOu.exe
  C:\Windows\System\RJxbcOu.exe
  2⤵
  PID:8540
- C:\Windows\System\grUsZIS.exe
  C:\Windows\System\grUsZIS.exe
  2⤵
  PID:8524
- C:\Windows\System\jWElrgZ.exe
  C:\Windows\System\jWElrgZ.exe
  2⤵
  PID:8572
- C:\Windows\System\qEjgBSd.exe
  C:\Windows\System\qEjgBSd.exe
  2⤵
  PID:8620
- C:\Windows\System\vrxusNp.exe
  C:\Windows\System\vrxusNp.exe
  2⤵
  PID:8636
- C:\Windows\System\UoQDQIg.exe
  C:\Windows\System\UoQDQIg.exe
  2⤵
  PID:8704
- C:\Windows\System\IxamTtu.exe
  C:\Windows\System\IxamTtu.exe
  2⤵
  PID:8736
- C:\Windows\System\DMotTDZ.exe
  C:\Windows\System\DMotTDZ.exe
  2⤵
  PID:8828
- C:\Windows\System\cTqhFeN.exe
  C:\Windows\System\cTqhFeN.exe
  2⤵
  PID:8892
- C:\Windows\System\xfvGGJB.exe
  C:\Windows\System\xfvGGJB.exe
  2⤵
  PID:8652
- C:\Windows\System\PGftACX.exe
  C:\Windows\System\PGftACX.exe
  2⤵
  PID:8960
- C:\Windows\System\WdiOCuL.exe
  C:\Windows\System\WdiOCuL.exe
  2⤵
  PID:8688
- C:\Windows\System\ybTHTEa.exe
  C:\Windows\System\ybTHTEa.exe
  2⤵
  PID:8844
- C:\Windows\System\yrjOXHM.exe
  C:\Windows\System\yrjOXHM.exe
  2⤵
  PID:8752
- C:\Windows\System\kDAwvdr.exe
  C:\Windows\System\kDAwvdr.exe
  2⤵
  PID:8848
- C:\Windows\System\VTmspSd.exe
  C:\Windows\System\VTmspSd.exe
  2⤵
  PID:9124
- C:\Windows\System\JTksTAO.exe
  C:\Windows\System\JTksTAO.exe
  2⤵
  PID:8252
- C:\Windows\System\lpWZehT.exe
  C:\Windows\System\lpWZehT.exe
  2⤵
  PID:7540
- C:\Windows\System\MgvpZIl.exe
  C:\Windows\System\MgvpZIl.exe
  2⤵
  PID:8456
- C:\Windows\System\wfwhHUj.exe
  C:\Windows\System\wfwhHUj.exe
  2⤵
  PID:8332
- C:\Windows\System\bEPmiXT.exe
  C:\Windows\System\bEPmiXT.exe
  2⤵
  PID:8312
- C:\Windows\System\wmamNed.exe
  C:\Windows\System\wmamNed.exe
  2⤵
  PID:9180
- C:\Windows\System\BKIyXnI.exe
  C:\Windows\System\BKIyXnI.exe
  2⤵
  PID:8472
- C:\Windows\System\coeWzcm.exe
  C:\Windows\System\coeWzcm.exe
  2⤵
  PID:1588
- C:\Windows\System\wBXHrIG.exe
  C:\Windows\System\wBXHrIG.exe
  2⤵
  PID:8800
- C:\Windows\System\wazygwj.exe
  C:\Windows\System\wazygwj.exe
  2⤵
  PID:8992
- C:\Windows\System\PWmYCdw.exe
  C:\Windows\System\PWmYCdw.exe
  2⤵
  PID:8812
- C:\Windows\System\aFZZfDY.exe
  C:\Windows\System\aFZZfDY.exe
  2⤵
  PID:8860
- C:\Windows\System\oGIJokg.exe
  C:\Windows\System\oGIJokg.exe
  2⤵
  PID:8656
- C:\Windows\System\ZgtSldt.exe
  C:\Windows\System\ZgtSldt.exe
  2⤵
  PID:8944
- C:\Windows\System\BrOhxST.exe
  C:\Windows\System\BrOhxST.exe
  2⤵
  PID:9032
- C:\Windows\System\nxSCBdb.exe
  C:\Windows\System\nxSCBdb.exe
  2⤵
  PID:9048
- C:\Windows\System\clnQRtT.exe
  C:\Windows\System\clnQRtT.exe
  2⤵
  PID:9064
- C:\Windows\System\jTFMdZL.exe
  C:\Windows\System\jTFMdZL.exe
  2⤵
  PID:9080
- C:\Windows\System\HtbCKpU.exe
  C:\Windows\System\HtbCKpU.exe
  2⤵
  PID:9100
- C:\Windows\System\FLWMKql.exe
  C:\Windows\System\FLWMKql.exe
  2⤵
  PID:9116
- C:\Windows\System\xuIfZEK.exe
  C:\Windows\System\xuIfZEK.exe
  2⤵
  PID:9168
- C:\Windows\System\oxCFAFB.exe
  C:\Windows\System\oxCFAFB.exe
  2⤵
  PID:7808
- C:\Windows\System\pdMcxGb.exe
  C:\Windows\System\pdMcxGb.exe
  2⤵
  PID:8236
- C:\Windows\System\QxXZwyK.exe
  C:\Windows\System\QxXZwyK.exe
  2⤵
  PID:8316
- C:\Windows\System\VFcylUB.exe
  C:\Windows\System\VFcylUB.exe
  2⤵
  PID:7796
- C:\Windows\System\HKTTHQh.exe
  C:\Windows\System\HKTTHQh.exe
  2⤵
  PID:8668
- C:\Windows\System\AffunFC.exe
  C:\Windows\System\AffunFC.exe
  2⤵
  PID:9060
- C:\Windows\System\BWnNYEn.exe
  C:\Windows\System\BWnNYEn.exe
  2⤵
  PID:9128
- C:\Windows\System\fvAjHwk.exe
  C:\Windows\System\fvAjHwk.exe
  2⤵
  PID:8444
- C:\Windows\System\HsilxZE.exe
  C:\Windows\System\HsilxZE.exe
  2⤵
  PID:8568
- C:\Windows\System\FnNHGds.exe
  C:\Windows\System\FnNHGds.exe
  2⤵
  PID:8720
- C:\Windows\System\PCwbuCl.exe
  C:\Windows\System\PCwbuCl.exe
  2⤵
  PID:9040
- C:\Windows\System\YFBeubC.exe
  C:\Windows\System\YFBeubC.exe
  2⤵
  PID:9108
- C:\Windows\System\kVTlJTc.exe
  C:\Windows\System\kVTlJTc.exe
  2⤵
  PID:8204
- C:\Windows\System\MNFxqKL.exe
  C:\Windows\System\MNFxqKL.exe
  2⤵
  PID:8684
- C:\Windows\System\xsNFcft.exe
  C:\Windows\System\xsNFcft.exe
  2⤵
  PID:9228
- C:\Windows\System\EOruAHd.exe
  C:\Windows\System\EOruAHd.exe
  2⤵
  PID:9244
- C:\Windows\System\beQgSLX.exe
  C:\Windows\System\beQgSLX.exe
  2⤵
  PID:9260
- C:\Windows\System\uYfoMGB.exe
  C:\Windows\System\uYfoMGB.exe
  2⤵
  PID:9276
- C:\Windows\System\wwjcZby.exe
  C:\Windows\System\wwjcZby.exe
  2⤵
  PID:9292
- C:\Windows\System\RIBDFgW.exe
  C:\Windows\System\RIBDFgW.exe
  2⤵
  PID:9396
- C:\Windows\System\rLvCOGY.exe
  C:\Windows\System\rLvCOGY.exe
  2⤵
  PID:9412
- C:\Windows\System\YAnxgFi.exe
  C:\Windows\System\YAnxgFi.exe
  2⤵
  PID:9428
- C:\Windows\System\LJkdNGi.exe
  C:\Windows\System\LJkdNGi.exe
  2⤵
  PID:9448
- C:\Windows\System\aOYtLFm.exe
  C:\Windows\System\aOYtLFm.exe
  2⤵
  PID:9468
- C:\Windows\System\AIeqDzn.exe
  C:\Windows\System\AIeqDzn.exe
  2⤵
  PID:9484
- C:\Windows\System\LPsLbNK.exe
  C:\Windows\System\LPsLbNK.exe
  2⤵
  PID:9500
- C:\Windows\System\umbrZHX.exe
  C:\Windows\System\umbrZHX.exe
  2⤵
  PID:9516
- C:\Windows\System\fEUjVJQ.exe
  C:\Windows\System\fEUjVJQ.exe
  2⤵
  PID:9532
- C:\Windows\System\JICFZWh.exe
  C:\Windows\System\JICFZWh.exe
  2⤵
  PID:9548
- C:\Windows\System\JRbIUmg.exe
  C:\Windows\System\JRbIUmg.exe
  2⤵
  PID:9564
- C:\Windows\System\CURPqrB.exe
  C:\Windows\System\CURPqrB.exe
  2⤵
  PID:9580
- C:\Windows\System\FYaQORy.exe
  C:\Windows\System\FYaQORy.exe
  2⤵
  PID:9596
- C:\Windows\System\ahccjfn.exe
  C:\Windows\System\ahccjfn.exe
  2⤵
  PID:9612
- C:\Windows\System\pDGgmCY.exe
  C:\Windows\System\pDGgmCY.exe
  2⤵
  PID:9628
- C:\Windows\System\bRcsnna.exe
  C:\Windows\System\bRcsnna.exe
  2⤵
  PID:9644
- C:\Windows\System\HvoTivy.exe
  C:\Windows\System\HvoTivy.exe
  2⤵
  PID:9660
- C:\Windows\System\VqhLqLo.exe
  C:\Windows\System\VqhLqLo.exe
  2⤵
  PID:9676
- C:\Windows\System\sJuLuqJ.exe
  C:\Windows\System\sJuLuqJ.exe
  2⤵
  PID:9692
- C:\Windows\System\SgLINTe.exe
  C:\Windows\System\SgLINTe.exe
  2⤵
  PID:9708
- C:\Windows\System\PRdpLvv.exe
  C:\Windows\System\PRdpLvv.exe
  2⤵
  PID:9724
- C:\Windows\System\cYdvLky.exe
  C:\Windows\System\cYdvLky.exe
  2⤵
  PID:9740
- C:\Windows\System\qvMjChh.exe
  C:\Windows\System\qvMjChh.exe
  2⤵
  PID:9756
- C:\Windows\System\SHbcwuA.exe
  C:\Windows\System\SHbcwuA.exe
  2⤵
  PID:9772
- C:\Windows\System\jRskOpx.exe
  C:\Windows\System\jRskOpx.exe
  2⤵
  PID:9788
- C:\Windows\System\isGAinp.exe
  C:\Windows\System\isGAinp.exe
  2⤵
  PID:9804
- C:\Windows\System\dqagthh.exe
  C:\Windows\System\dqagthh.exe
  2⤵
  PID:9820
- C:\Windows\System\aBBGKVS.exe
  C:\Windows\System\aBBGKVS.exe
  2⤵
  PID:9836
- C:\Windows\System\EihJnIp.exe
  C:\Windows\System\EihJnIp.exe
  2⤵
  PID:9852
- C:\Windows\System\LWXLkbr.exe
  C:\Windows\System\LWXLkbr.exe
  2⤵
  PID:9868
- C:\Windows\System\HNrJNPo.exe
  C:\Windows\System\HNrJNPo.exe
  2⤵
  PID:9888
- C:\Windows\System\pgUvARS.exe
  C:\Windows\System\pgUvARS.exe
  2⤵
  PID:9904
- C:\Windows\System\sRLZupO.exe
  C:\Windows\System\sRLZupO.exe
  2⤵
  PID:9920
- C:\Windows\System\hITzPzi.exe
  C:\Windows\System\hITzPzi.exe
  2⤵
  PID:9936
- C:\Windows\System\dIfMemm.exe
  C:\Windows\System\dIfMemm.exe
  2⤵
  PID:9952
- C:\Windows\System\kAwsszG.exe
  C:\Windows\System\kAwsszG.exe
  2⤵
  PID:9984
- C:\Windows\System\OCHkNIM.exe
  C:\Windows\System\OCHkNIM.exe
  2⤵
  PID:10000
- C:\Windows\System\YNdAzZy.exe
  C:\Windows\System\YNdAzZy.exe
  2⤵
  PID:10016
- C:\Windows\System\jGjRtAb.exe
  C:\Windows\System\jGjRtAb.exe
  2⤵
  PID:10032
- C:\Windows\System\oSQTwgX.exe
  C:\Windows\System\oSQTwgX.exe
  2⤵
  PID:10048
- C:\Windows\System\Upaamum.exe
  C:\Windows\System\Upaamum.exe
  2⤵
  PID:10064
- C:\Windows\System\biljkPR.exe
  C:\Windows\System\biljkPR.exe
  2⤵
  PID:10084
- C:\Windows\System\AeYsTHa.exe
  C:\Windows\System\AeYsTHa.exe
  2⤵
  PID:10112
- C:\Windows\System\TEItitj.exe
  C:\Windows\System\TEItitj.exe
  2⤵
  PID:10128
- C:\Windows\System\PeZJFRz.exe
  C:\Windows\System\PeZJFRz.exe
  2⤵
  PID:10144
- C:\Windows\System\MPCDKmP.exe
  C:\Windows\System\MPCDKmP.exe
  2⤵
  PID:10160
- C:\Windows\System\SaAOufl.exe
  C:\Windows\System\SaAOufl.exe
  2⤵
  PID:10180
- C:\Windows\System\YxNXwVy.exe
  C:\Windows\System\YxNXwVy.exe
  2⤵
  PID:10196
- C:\Windows\System\kgtzTVl.exe
  C:\Windows\System\kgtzTVl.exe
  2⤵
  PID:10212
- C:\Windows\System\wtZaOTx.exe
  C:\Windows\System\wtZaOTx.exe
  2⤵
  PID:10228
- C:\Windows\System\uSJIvmp.exe
  C:\Windows\System\uSJIvmp.exe
  2⤵
  PID:9184
- C:\Windows\System\loauxxJ.exe
  C:\Windows\System\loauxxJ.exe
  2⤵
  PID:8732
- C:\Windows\System\HbTPWGI.exe
  C:\Windows\System\HbTPWGI.exe
  2⤵
  PID:9056
- C:\Windows\System\VUiuHan.exe
  C:\Windows\System\VUiuHan.exe
  2⤵
  PID:8348
- C:\Windows\System\tnuBYcE.exe
  C:\Windows\System\tnuBYcE.exe
  2⤵
  PID:9284
- C:\Windows\System\NyxnvGV.exe
  C:\Windows\System\NyxnvGV.exe
  2⤵
  PID:8488
- C:\Windows\System\QhOYcWz.exe
  C:\Windows\System\QhOYcWz.exe
  2⤵
  PID:9300
- C:\Windows\System\xepzetZ.exe
  C:\Windows\System\xepzetZ.exe
  2⤵
  PID:9320
- C:\Windows\System\keGPuGy.exe
  C:\Windows\System\keGPuGy.exe
  2⤵
  PID:9752
- C:\Windows\System\lSvvzKn.exe
  C:\Windows\System\lSvvzKn.exe
  2⤵
  PID:9960
- C:\Windows\System\iYZqEIs.exe
  C:\Windows\System\iYZqEIs.exe
  2⤵
  PID:9408
- C:\Windows\System\sjpvcmC.exe
  C:\Windows\System\sjpvcmC.exe
  2⤵
  PID:9544
- C:\Windows\System\tppfOTO.exe
  C:\Windows\System\tppfOTO.exe
  2⤵
  PID:9668
- C:\Windows\System\NNyYySF.exe
  C:\Windows\System\NNyYySF.exe
  2⤵
  PID:9704
- C:\Windows\System\dIBRRJi.exe
  C:\Windows\System\dIBRRJi.exe
  2⤵
  PID:9768
- C:\Windows\System\CGgQzLY.exe
  C:\Windows\System\CGgQzLY.exe
  2⤵
  PID:9992
- C:\Windows\System\PmMSmsw.exe
  C:\Windows\System\PmMSmsw.exe
  2⤵
  PID:9900
- C:\Windows\System\xjybrKf.exe
  C:\Windows\System\xjybrKf.exe
  2⤵
  PID:9972
- C:\Windows\System\PMhPokF.exe
  C:\Windows\System\PMhPokF.exe
  2⤵
  PID:10168
- C:\Windows\System\fshEmzg.exe
  C:\Windows\System\fshEmzg.exe
  2⤵
  PID:9236
- C:\Windows\System\vPLxKdg.exe
  C:\Windows\System\vPLxKdg.exe
  2⤵
  PID:10192
- C:\Windows\System\tjtYynU.exe
  C:\Windows\System\tjtYynU.exe
  2⤵
  PID:10152
- C:\Windows\System\dxBPust.exe
  C:\Windows\System\dxBPust.exe
  2⤵
  PID:9096
- C:\Windows\System\YRAzAmy.exe
  C:\Windows\System\YRAzAmy.exe
  2⤵
  PID:9076
- C:\Windows\System\aLlFhbh.exe
  C:\Windows\System\aLlFhbh.exe
  2⤵
  PID:9332
- C:\Windows\System\XnktmDF.exe
  C:\Windows\System\XnktmDF.exe
  2⤵
  PID:8608
- C:\Windows\System\dsvioUM.exe
  C:\Windows\System\dsvioUM.exe
  2⤵
  PID:9272
- C:\Windows\System\RoxcIOX.exe
  C:\Windows\System\RoxcIOX.exe
  2⤵
  PID:9560
- C:\Windows\System\aPVlZse.exe
  C:\Windows\System\aPVlZse.exe
  2⤵
  PID:9348
- C:\Windows\System\zTQEztx.exe
  C:\Windows\System\zTQEztx.exe
  2⤵
  PID:9364
- C:\Windows\System\uhEAhxH.exe
  C:\Windows\System\uhEAhxH.exe
  2⤵
  PID:9388
- C:\Windows\System\fqPmfsV.exe
  C:\Windows\System\fqPmfsV.exe
  2⤵
  PID:9624
- C:\Windows\System\LQkyAcB.exe
  C:\Windows\System\LQkyAcB.exe
  2⤵
  PID:9380
- C:\Windows\System\XlVmUQp.exe
  C:\Windows\System\XlVmUQp.exe
  2⤵
  PID:9608
- C:\Windows\System\KbJbekW.exe
  C:\Windows\System\KbJbekW.exe
  2⤵
  PID:10188
- C:\Windows\System\bQhcPCU.exe
  C:\Windows\System\bQhcPCU.exe
  2⤵
  PID:10224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\CCHPZQV.exe

Filesize
1.7MB

MD5
2cb48ab237dd3f78bbcbce34ec16c1ff

SHA1
f0887d916d6528ee0885625babf99854d11e6c5c

SHA256
5a9869078767c4381417c4a8aefc086be0a6d6544033c64b54195b0249024b10

SHA512
29b983bf444efd195fae0832e6635ebce7ec49af6c24f4b9eef37b0b2b4537fc87f6ad70c24f81f38890cf031a88df647eaf9932749324e0c5217ea8008b8899

Download Submit
C:\Windows\system\CzZevqG.exe

Filesize
1.7MB

MD5
e1198cd72a4ffbb74f828dfd643a0669

SHA1
f6dcd876c084b988e62b621f568b879f2c982588

SHA256
f2d66b82f09dbc3a44020d1c3b90f4be236ea43020f363e868e4cc3d96500a4c

SHA512
247a31578ee088f122fd1bec9fe71b263d1a719184295659861dfaff67a4e23b1c4ede880196e449ef2da0f68c3908c49037aa25a764cbb8e5440c047e55c70c

Download Submit
C:\Windows\system\JAsemLV.exe

Filesize
1.7MB

MD5
d4560408828b3b23b1a10a71fe742f85

SHA1
ac8292752d3508782ad97d1145dd1a57836b8b99

SHA256
99cdd5ad255c181452cfed591a8ea051b682d56f680e581e8d2486d8f2d4a848

SHA512
102bd5e1fc55e7a5f19bf64b64eda169c2831cdda8e0b7a6081fe0ca19c85003794245063e7c9189f9a0f63d287e43d8ca4c4089562e4180ab8f1e08e90d1fb8

Download Submit
C:\Windows\system\PchduXK.exe

Filesize
1.7MB

MD5
9cdd74016882e416183aae66704843ba

SHA1
da16926f2c50ae134e670d0203609d810be4ad26

SHA256
a2ca31c5238aac49980e88e5fcedfaf8851c7abe19ef8f76ad8ec1d8c19022a1

SHA512
2ff94a67e49a4b77f2f8f61868416330c90e8b0e046e8e910b487338655644aefdcb0487f396984ee4ff60c5a52d89710d5943599c46b5559ad5343336e4b876

Download Submit
C:\Windows\system\PfHGcoH.exe

Filesize
1.7MB

MD5
24973d56a5833b1d8586d90991b6a1de

SHA1
ab995b47824d7465dbc1f947b4fb6541f26b2bc0

SHA256
7440832b7a98e20ceb5a9adde8a9f72c0ba199067a7ef8efc3bb72bc4e52f72d

SHA512
36e67844dbb2f799b775b75a6350d4aec970fe3112286503c564a77aff30a8438e70992bb0f6820c3b96e657417fdace702c1e707e5cfd80885be57b19fe0a63

Download Submit
C:\Windows\system\PqiJRVv.exe

Filesize
1.7MB

MD5
d1ef15db457fccafd5c136c5963ee934

SHA1
abf7aba95da00f79a3b5c10dcc2053659746f56f

SHA256
88913505794a57fe8b502474f20f7bd7abfeb1d98d7dddd530a9b767364e9fc2

SHA512
3bf1e6b06cf9abe9c435db68ccff8ba285b08af28d44da186ddcb0dc8856fb90adfb5fd24cf1fae97c35e2eb2986e2e3688593494407dc7ed9f16ee81e9e4f4c

Download Submit
C:\Windows\system\QJBuCFK.exe

Filesize
1.7MB

MD5
bb721032238345ea8b96cc5d998d457f

SHA1
51c41626e0f23a9e02f9221a94e5004068e7af93

SHA256
cab667f8e1db3e7a83615cdfc649485541c9fd09d8e92c35b63a20f32b1f98fa

SHA512
d55e0b04a94b2adf267609d621791bb8e6278fe698e8bce249438f94b32558b7c7403bebc1ca50e391ff6f08debe3ef93b32c960516646b2a003103edef89e81

Download Submit
C:\Windows\system\VPCtKBT.exe

Filesize
1.7MB

MD5
bd8c3c20d401234427c24cc6cfc489d4

SHA1
1236f153c7787925f9b33617e32e5608ff06294d

SHA256
36865d98ce588a4a432326bcea844296943b3e3e18dd6bb0a2375445dabe3dcb

SHA512
97ca130fc96013762e91bc1b09386a3321d9a257a97ec252e82148dcec92c4502f4eee3b950cc9e1c6e8450a1aa3de0c1551aafd25bc916e96a411cc9ad665ce

Download Submit
C:\Windows\system\ZFadvJG.exe

Filesize
1.7MB

MD5
dfeb28d6ff8ea737196f10d4434c98b4

SHA1
2be8a96856dd3a0995793d135c4d9c88a7b0d96f

SHA256
3d297998c9bb0caa31cb3e5b0979dfc45ace42459609715c4f65dfc5c4b80e19

SHA512
38909c3cf48b864cb3e6fc0d6c766e3a83674c65145b6e414224dc0065903a49429a399a5704d66006fecf31385376f5421bf7592159c9801e094956ba843552

Download Submit
C:\Windows\system\ZfTvpmQ.exe

Filesize
1.7MB

MD5
8e6800c6c1ba1b1d01badf72be067214

SHA1
6167fae49a0993826b827d7b43017081045784bf

SHA256
e80e5549b244cbe4692e6a9a9533f1a8cb313b8c081d6f63e0a1823945a44d1f

SHA512
6c85e62dbe26f01aab82250567bc8f52bd87f2bdaba3c1ca2741a8ae84f4fb97606c057a375b3ffabd409b30cb20f719f048fd8878c4102642dc78253b2bca7d

Download Submit
C:\Windows\system\ggzrEpu.exe

Filesize
1.7MB

MD5
5cc6e99d2a497806aef595d6403a085d

SHA1
e3645c24cc6817f676ff810eb9db9672718138a5

SHA256
8b7d31495405cd2e4bc64e6384f53b9f8965f8eeba7d435eb766eb6fc76fce42

SHA512
cbbde57233f5c5141fff1939a62a3ca3e6e9e656cdb827b3dd857bb6ee23adc1c0bb8b8bccaaca79c34b96aa43ce8d82ccb4a6862eeb464debf1df69e8d80e7c

Download Submit
C:\Windows\system\iDheDUl.exe

Filesize
1.7MB

MD5
982b969dc7a412d3718efc8b23adcb70

SHA1
86d8380056a6724cebaefd43b77586375ed334ec

SHA256
af1149d669dbccd59f6e574fd64421399990b470f10c79f816ff6c0682c371fd

SHA512
909057d09078736ceb76e5b98089c3852a5731a1507f17f581ce183c233a5266a75cfcbd49bfbb3f395797458b82e96a20e53ac8ecf35b1e378a31662c8c19b2

Download Submit
C:\Windows\system\iJBNThe.exe

Filesize
1.7MB

MD5
4038c57777282c8c6b64aa6b010f4be3

SHA1
7036410908e6ab8172aeb456564574a87fbab4f9

SHA256
5f9aa9cd1bb2a743dc57d38f6066719fb35783c31f057c0b815721bbe9eb74cf

SHA512
7ffd2ad52eee38598a7c0bdf7701bcee6920b9b35d58c7783f8428575fd254b3ec09200af194033d7fa03014a25e65b5f87b3c75c91cac34a79aa674fc0c8c73

Download Submit
C:\Windows\system\iUrbusu.exe

Filesize
1.7MB

MD5
de628f70e7b3888c6b258cebde1ee69f

SHA1
1a46c4ab82620b6b56e505760a8b4ae82f54a830

SHA256
35ba98774d9aaa3802cc55fbdb35677e848b4d42b246a28cda94664e068b6932

SHA512
29a30b40223604048d89fa6737621d5f360bd7c329f2018f749661e21bae5e774c20009f6c23b7bd57dcf92680d0316a421af4fef00d66391f8626d15c1ed41f

Download Submit
C:\Windows\system\jENKyHg.exe

Filesize
1.7MB

MD5
41475a80fbb849c029ce7b53e515ceba

SHA1
42527d104dd65f77fa6b358cce8687397a6d2923

SHA256
2775ad5957c6ee07049390b3165f6390d940d3bdadc002aeaae5e73ec78ffe0a

SHA512
93c90d4538385119eb30ddf8bd628d5b53cbc436111e5314284294b9e21a585ae3dc99e2b0b1538f86db20546288fcbd063dafcd8859364c230eb917410ea4f9

Download Submit
C:\Windows\system\krDjRDZ.exe

Filesize
1.7MB

MD5
3dc02e9df098a9d62cde531a3cd57c7e

SHA1
07ab1eab3de888548af1ffa4916fc976b5cd9a8c

SHA256
dc7564f35b9d48b1e9a4873c6bddc535f2b709f5206cea6367f618fbe578da2c

SHA512
53dbeb29ef447c371c0c4dac7b5539e7a2c0200ed35c8252c59b87c3e0f6736240e097dd2a4c7550e5fcc24f3fd85a66f4a14301cb8cb4457ef6b9b762c64373

Download Submit
C:\Windows\system\mMdyjLD.exe

Filesize
1.7MB

MD5
2bad1acc3832e5c1a8f9f132e73accdb

SHA1
d3ef1236a52672e4a2f7e2b3eb6593df6b803456

SHA256
38117a28d4b24eae5d5588baf7b6be668892d5229d27ebec99d1639ba5168705

SHA512
f9008d3468753ed114bcdc23457899906b4250ce4c3c9d3a6f59eda46fec7e93124a20e17fc2fa90eded50108e72000fee60af799b72d9e9f076d9b7e7197345

Download Submit
C:\Windows\system\mjBuJJu.exe

Filesize
1.7MB

MD5
3ff6bdc1af32a80d1bdffab85d150db8

SHA1
361fb7a71395bd688cec9c883672d34b1de5b380

SHA256
e49062833e072dd06cf487719b99810ad8f9f7395524df67a0ad55026d1f5eed

SHA512
a9bb4d05ce2eee9b8d23cbdc374ad44feacaa0f4032501f7dd7d4f9d8485b8cf9ccadc97b86cad6d0a4ba65201dfc3e2fefc4e238d872a10e46b7e7f946c6977

Download Submit
C:\Windows\system\nDCQVLM.exe

Filesize
1.7MB

MD5
933c9569e14f441d676b61bd805cfce5

SHA1
e56e92e2ce9ac2e18e893a24a9c151863c2b1750

SHA256
d85b38c3183b7ea752a88fdacb97feef4a991cc7ff6e0b3beb0a9648c66ea44a

SHA512
29729d464cb2991f0ac0139e5ee624896f91650ab6dd88feeabfb555dde3bc84d22e7ba4f1272b1980ba3e275afff537b7cecd3d8e29c3979a0487d55d479bfd

Download Submit
C:\Windows\system\outwTjS.exe

Filesize
1.7MB

MD5
4803de94ff411581ef2239818b2d9f8f

SHA1
d2975bf777800cfeb186ec1218436772730afa3c

SHA256
00f9d8e8500991ea6eec9deb535722974be2af66bad8c896cc0bb95f97051220

SHA512
f28e9cfa323d8197356a01c67f201480cd2685a07f24be1c096984b05f44d3c08003a7b6adc4d6dde8be355c1c1b31c6b6931cdd0c03b00898e78c0d76b276ce

Download Submit
C:\Windows\system\qVLzYbS.exe

Filesize
1.7MB

MD5
3d94537d184ae4d3b8d8faf1881e684c

SHA1
91154fee3d77fcbacae5c37c755de8597b27f89c

SHA256
6e2a82374f37c4dc2f391dd64296a807eca19395656783abe72cf51c564596ca

SHA512
d9f77284091c0616f8fd71183795ead617e120bf8aac783072ff9c3318b294fff0d9d1929f0344d1683b2a77c842ab246b64f6520039ddca73789b57bda4d694

Download Submit
C:\Windows\system\rnGHpAm.exe

Filesize
1.7MB

MD5
b01e0673f4c5229616a1e12e6880ab3b

SHA1
9217d0c63f165b5953e962f5ca336f10e71d585c

SHA256
b4d8b4a648decee90dd264c1120d4b0609ecf667bd2dcc33ae933b0602630373

SHA512
d54d9288dda2701c5e45734206510fd1391dfae4b252c290e7b56b46f2f253d560f5f5e6d2d73aa67508def94d5b8d47d7f414603d383797d465ff3498441ce2

Download Submit
C:\Windows\system\sQHbNfG.exe

Filesize
1.7MB

MD5
43d345c822e0f9917d826a2bf800bab7

SHA1
d3dcf78bd6c9c69c81c277107087f3a453b3bfe0

SHA256
ecefd64afbec78986b0d75884872d6a69210687ce50c97b4dcda7b18cbea4979

SHA512
d6143313df27932fcf4d41666d4f8758518895adb761d7fb8909de5929f142ae5bed26a237807169d4209196c65a4f8140fac1c0c51a81d8cf9965277e8d27c5

Download Submit
C:\Windows\system\zumZsXT.exe

Filesize
1.7MB

MD5
f7dec2e0a43b4fcf9f636e71e0148b5c

SHA1
bde65dd5247ffd24934daf5754cb2d932a98cc6a

SHA256
d9348f00335fd5eb0cdbe12fbfb1e9f04f6ca8b4ecd99cb7fab4c5f0a4d04ac1

SHA512
21ffb37eb6da8275fddb0ba0e5e7783b52c61491d70723627108029740154200c352ff36f513cbc326a604d2b19e534fd959665a41003697b6cacc9673138054

Download Submit
\Windows\system\BoJTuBo.exe

Filesize
1.7MB

MD5
78f4519d0cbf6329cc70c4f70ab8e039

SHA1
b21e7addf332ee9a8052b56cacd487f66170f8b1

SHA256
4dfa7ea6012e7906ef2ec8852955a85f09b043cb26d0acf3a66931df9859de29

SHA512
134010710ec6d04da02dca0f49c248ba94dfdd41331b37dc210a31b7b7cd51992397821e262539a450c7a6e4c3c45c63bf29caf2c2d95dc258dc6f6fb437493a

Download Submit
\Windows\system\JTeWXBQ.exe

Filesize
1.7MB

MD5
bc49b1bd09d5d837ab6e59b6965c7fd9

SHA1
21a88396a500b36f116b089f49a98a198fefbde4

SHA256
2224df429c0ee445a602cadfaf8962a66b02ccda10eabdd346cffb7ecccb513a

SHA512
0d9a782b933ab0e2b764f5db1045fb138dccc7bff283c20cd0a1f13a101c6e9820f6c6146ec694b50f8b9c26dc0469d5d15d71ca01e0148399c1e2a59f31a2b1

Download Submit
\Windows\system\UGAtBVM.exe

Filesize
1.7MB

MD5
e0c1bc71a43d02ea02ccbcbc85508f8d

SHA1
07b8904f85c95d0048116a21748e6c62ab20fb9a

SHA256
3cd8caca6deeaac15ea5bb04f8f2c618377ea44f8765ce241d5eb005526c80b5

SHA512
4c897f6e48fcee9a8c391e52d2984bf4b18d78143a3ae032a3b07143f146e3326df6a762b517f045343b1e7d3cc6307bede99ee51fa5e385ae51315826d20d3a

Download Submit
\Windows\system\gvgMzmf.exe

Filesize
1.7MB

MD5
2659b1baef91dcf0b747061f165878fb

SHA1
fd0d445856a1d714557341c9d61dd97dda2c03bc

SHA256
a76f68d9984993921c19e761a14b70e055d2a727133377e96924276d19bac3e8

SHA512
839989b4d444b9fc1740c6ade422503a751c1ecae88b82e24cc3cd6748ef1db461279f23d02a1bec0a553ff79b500ef1beda4fbcb764dfe33b1cdb61761a96bb

Download Submit
\Windows\system\hAMEkyQ.exe

Filesize
1.7MB

MD5
50fba913271f2e4f746a56ec42bd8b47

SHA1
3268f5d50bb26cc9b4d3ae5e11a785b10f1b803c

SHA256
511100ba4c0459c63ddb8975e0e7077079174b52968e088f07fc99e9d6651451

SHA512
4de49743ea575f46295683734d8e1186c3c1af1633430f10ef2fba54afad44070ab1c4ae2ca1f283041547c96a440c7166b6d50e7244a5401117731f0c2d825f

Download Submit
\Windows\system\hJKtKCX.exe

Filesize
1.7MB

MD5
dcc492765362db60f0a84f48ff215b0a

SHA1
a234dc0c61d3bd7e969f953eca78f2f3607dd93c

SHA256
2a964bbb868a03a353f14a89d32ce2212175e0f8002c7173f7a746b43d8f6abb

SHA512
326f57e1c3849545c8ae7e7bcd3a9142c33d925c16b9e808e06b449d0d3194f668917e30dbcb3939aefd4b88dabd4a67e998676e8611dc529115af57b4095f3d

Download Submit
\Windows\system\lonmafP.exe

Filesize
1.7MB

MD5
72fcdbee856522c8003403bb8a91e4b9

SHA1
e4552bb81229f81cd90b2e844f45e018576e0dbe

SHA256
1d07896dd2984e7d9367bdce01086d9b4732d5154fba9a1dda687ad7dd3a68c0

SHA512
9bbd49e074f3525b4be7f6e9c9aba378a52051be4fba4e49cd3d320624cc1e341d759f3c99cbefd33b0c523d56ed145c1c10c4830abf0eb74560fae4f54d04fc

Download Submit
\Windows\system\qdmfGwR.exe

Filesize
1.7MB

MD5
a8cd56d9545d77af9e787d997c007c4a

SHA1
0f7c7feebfb2beda77fcdb4de65f90894cd6d200

SHA256
3e2a56be5215b3b02276d87e98328c9aa13aa337143bf3c7440a52c90892e036

SHA512
c23f932a4aba1ed35a024032b24a1878f11bb637156ffbaaf98defe1480c0a89e1ae80a99a05e36063f07a11412fd71efe847804ef69766b16d071fcb337f723

Download Submit
memory/1032-99-0x000000013F7E0000-0x000000013FBD2000-memory.dmp

Filesize
3.9MB

Download
memory/2428-83-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2464-74-0x000000013F050000-0x000000013F442000-memory.dmp

Filesize
3.9MB

Download
memory/2472-64-0x000000013F5D0000-0x000000013F9C2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-76-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2644-81-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2668-61-0x000000013F2E0000-0x000000013F6D2000-memory.dmp

Filesize
3.9MB

Download
memory/2684-59-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2740-68-0x000000013F710000-0x000000013FB02000-memory.dmp

Filesize
3.9MB

Download
memory/2784-72-0x0000000003600000-0x00000000039F2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-1-0x000000013F360000-0x000000013F752000-memory.dmp

Filesize
3.9MB

Download
memory/2784-75-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-0-0x0000000000100000-0x0000000000110000-memory.dmp

Filesize
64KB

Download
memory/2784-62-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2784-60-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2784-111-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-77-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2784-67-0x0000000003170000-0x0000000003562000-memory.dmp

Filesize
3.9MB

Download
memory/2784-82-0x000000013FC70000-0x0000000140062000-memory.dmp

Filesize
3.9MB

Download
memory/2784-69-0x000000013F800000-0x000000013FBF2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-80-0x000000013FF60000-0x0000000140352000-memory.dmp

Filesize
3.9MB

Download
memory/2784-7-0x0000000002AC0000-0x0000000002EB2000-memory.dmp

Filesize
3.9MB

Download
memory/2888-78-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2920-12-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/3068-34-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/3068-79-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download
memory/3068-71-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download
memory/3068-30-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/3068-37-0x000007FEF4FCE000-0x000007FEF4FCF000-memory.dmp

Filesize
4KB

Download
memory/3068-36-0x0000000002C10000-0x0000000002C90000-memory.dmp

Filesize
512KB

Download
memory/3068-116-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download
memory/3068-58-0x000007FEF4D10000-0x000007FEF56AD000-memory.dmp

Filesize
9.6MB

Download