xmrig | b8e5ffeb576cb4decfb7e31d7d5a01a6b0767ddeaa8d84daf63672526da9629f

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
Size

1.9MB
MD5

141fdc4fb7552bb3fe7edf414215a5b4
SHA1

fd2cbe224bffec71e4759ed5351e262d7cd60e32
SHA256

b8e5ffeb576cb4decfb7e31d7d5a01a6b0767ddeaa8d84daf63672526da9629f
SHA512

51bea71315a87c69443064fbbb33fca8ef962e87fa00e844dc5c5237d87d689755861f8aba9a17c76732b8b6752f6a1356ce1863f8210ee6f6f5e6b58781bc75
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrljU9:NABB

Score

10^/10

xmrig execution miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/2796-388-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2812-397-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/2720-403-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/1376-402-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/1504-400-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/2416-385-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2364-383-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2536-379-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2688-377-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2060-375-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2064-371-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2868-4397-0x000000013FB30000-0x000000013FF22000-memory.dmp	xmrig
behavioral1/memory/2720-4399-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2064-4402-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2060-4403-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2688-4405-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/2364-4409-0x000000013F2A0000-0x000000013F692000-memory.dmp	xmrig
behavioral1/memory/2536-4408-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	xmrig
behavioral1/memory/2416-4411-0x000000013FF90000-0x0000000140382000-memory.dmp	xmrig
behavioral1/memory/2796-4413-0x000000013FEF0000-0x00000001402E2000-memory.dmp	xmrig
behavioral1/memory/2812-4416-0x000000013FE70000-0x0000000140262000-memory.dmp	xmrig
behavioral1/memory/1504-4417-0x000000013F930000-0x000000013FD22000-memory.dmp	xmrig
behavioral1/memory/1376-4423-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe

Executes dropped EXE 64 IoCs

pid	Process
2868	TgKmMtL.exe
2720	xjSkMvm.exe
2064	GDgfdhA.exe
2060	sYsruDi.exe
2688	kOzLNwZ.exe
2536	sPlTwOU.exe
2364	NBKIlVi.exe
2416	GzzWXcf.exe
2796	gEibcvw.exe
2812	JrVwAzC.exe
1504	GeeOGgU.exe
1376	eDVIfjc.exe
2624	FioKmcC.exe
2668	SZsQPqY.exe
2680	gdNIwZa.exe
2108	zTxyboK.exe
1612	aYhfNvq.exe
2248	ZjXxCxW.exe
404	bxNktOj.exe
2116	Xjegenp.exe
2808	bmIWJlZ.exe
1324	vMRBmNb.exe
1204	wLzYTnR.exe
1548	PVZXmyG.exe
2044	aYQYuyY.exe
1244	jsjLpMh.exe
2180	yOoFMKd.exe
812	LzsWAEi.exe
1144	XpoSlSP.exe
1752	oFJUhRZ.exe
1564	xaptdWI.exe
960	utoVIxu.exe
2736	mGaDvTc.exe
1096	KXzSDET.exe
2928	ahQZzoP.exe
1604	pqkXhEc.exe
1836	IbeOoCk.exe
540	FOUWHhc.exe
1672	WVusZRX.exe
612	YojzSbf.exe
2136	HuGwMqf.exe
2712	TNtIkcS.exe
2264	kCoECiR.exe
2236	Uqnnyrz.exe
2140	SGZIkqI.exe
1996	ljySVTC.exe
580	obOUJxh.exe
2268	dSBHRLc.exe
2496	BteCSSl.exe
608	YTLqLDB.exe
1076	wzDhTun.exe
2860	QHkehMv.exe
2888	yDqnSKQ.exe
1676	mUnzMzX.exe
956	JirgQup.exe
3012	bhIEgPv.exe
904	AzOTWKg.exe
572	rQfXebZ.exe
1892	izAFXkC.exe
1284	YQDbmko.exe
2148	awZlevZ.exe
1960	dZBNoin.exe
2016	wfaPYVI.exe
1528	vChDaVu.exe

Loads dropped DLL 64 IoCs

pid	Process
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe

UPX packed file 59 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1740-0-0x000000013FB20000-0x000000013FF12000-memory.dmp	upx
behavioral1/files/0x000d00000001449a-3.dat	upx
behavioral1/files/0x0034000000014701-12.dat	upx
behavioral1/memory/2868-11-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/files/0x00070000000149ea-10.dat	upx
behavioral1/files/0x0008000000014c25-34.dat	upx
behavioral1/files/0x001400000000549e-29.dat	upx
behavioral1/files/0x0007000000015023-44.dat	upx
behavioral1/files/0x0007000000015cb9-53.dat	upx
behavioral1/files/0x0006000000015cca-62.dat	upx
behavioral1/files/0x0006000000015cec-70.dat	upx
behavioral1/files/0x0006000000015d06-80.dat	upx
behavioral1/files/0x0006000000015cc1-58.dat	upx
behavioral1/files/0x0006000000015cf7-74.dat	upx
behavioral1/files/0x0006000000015cdb-69.dat	upx
behavioral1/files/0x0006000000015d6e-92.dat	upx
behavioral1/files/0x0006000000016056-111.dat	upx
behavioral1/files/0x0006000000016525-127.dat	upx
behavioral1/files/0x00060000000167ef-139.dat	upx
behavioral1/files/0x0006000000016cab-165.dat	upx
behavioral1/files/0x00060000000160f8-136.dat	upx
behavioral1/files/0x0006000000016a45-141.dat	upx
behavioral1/files/0x0006000000016411-146.dat	upx
behavioral1/files/0x0006000000016c17-151.dat	upx
behavioral1/files/0x0006000000016c26-150.dat	upx
behavioral1/files/0x0006000000016597-131.dat	upx
behavioral1/memory/2796-388-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2812-397-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/2720-403-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/1376-402-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/1504-400-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/2416-385-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2364-383-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2536-379-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2688-377-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2060-375-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2064-371-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/files/0x0006000000016cc9-168.dat	upx
behavioral1/files/0x0006000000016c7a-159.dat	upx
behavioral1/files/0x0006000000015f9e-109.dat	upx
behavioral1/files/0x0006000000016c2e-156.dat	upx
behavioral1/files/0x0006000000016277-120.dat	upx
behavioral1/files/0x0006000000015f1b-104.dat	upx
behavioral1/files/0x003400000001470b-99.dat	upx
behavioral1/files/0x0006000000015d5d-89.dat	upx
behavioral1/files/0x000a0000000155e3-49.dat	upx
behavioral1/files/0x0007000000014e5a-38.dat	upx
behavioral1/memory/2868-4397-0x000000013FB30000-0x000000013FF22000-memory.dmp	upx
behavioral1/memory/2720-4399-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2064-4402-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2060-4403-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/memory/2688-4405-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/memory/2364-4409-0x000000013F2A0000-0x000000013F692000-memory.dmp	upx
behavioral1/memory/2536-4408-0x000000013F3D0000-0x000000013F7C2000-memory.dmp	upx
behavioral1/memory/2416-4411-0x000000013FF90000-0x0000000140382000-memory.dmp	upx
behavioral1/memory/2796-4413-0x000000013FEF0000-0x00000001402E2000-memory.dmp	upx
behavioral1/memory/2812-4416-0x000000013FE70000-0x0000000140262000-memory.dmp	upx
behavioral1/memory/1504-4417-0x000000013F930000-0x000000013FD22000-memory.dmp	upx
behavioral1/memory/1376-4423-0x000000013F370000-0x000000013F762000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\MBcCtxW.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\LBKhqpj.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\aetWftS.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\HQJqVPo.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\FLjgyen.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\PIcvpsa.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\XFuyftV.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\rfwmrjI.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\qqVvnCx.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\kNuDuKN.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\Qzlbdpr.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\mUnzMzX.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\xLqBfwu.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\EoFviDR.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\XvJfiiO.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\XpoSlSP.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\HtjcqUT.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\KHGwKSI.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\XkoJdzH.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\sYsruDi.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\IjGxAlB.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\rFkMozW.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\dzChUdS.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\kCsmIzj.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BOTcjcR.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\aNgXzON.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\UqrkodM.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\SgtUsCc.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\JhjAPmm.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\liPOnOt.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\EWJyjBj.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\GmyXeSr.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\byyXctc.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\lhpCNBf.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\QzqUBaK.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\lcoVFfK.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\hvoABjx.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\bOWiMuF.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\fvLMFnQ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\Trlfozv.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\oRwPWui.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\ewAYgoS.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\MyxcLpM.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BhXmPRv.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\uCnFHNA.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\kLaqbSJ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\LzsWAEi.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\QWZvuDk.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\KXZgecs.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\kVfdoLt.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\yyJclRT.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\FftuxrJ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\svcuxFK.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\TenMvfj.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\OmSiHPG.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\nDNoUaH.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\KiEjPCT.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BRPjsIm.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\UOKCPKD.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\gowwjLQ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\qNlJvxe.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\BJpAfMB.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\ZaZsOYJ.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
File created	C:\Windows\System\iblpiDN.exe	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2648	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
Token: SeDebugPrivilege	2648	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2648	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2648	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2648	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	29
PID 1740 wrote to memory of 2868	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2868	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2868	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	30
PID 1740 wrote to memory of 2720	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2720	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2720	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	31
PID 1740 wrote to memory of 2064	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2064	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2064	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	32
PID 1740 wrote to memory of 2060	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	33
PID 1740 wrote to memory of 2060	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	33
PID 1740 wrote to memory of 2060	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	33
PID 1740 wrote to memory of 2688	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2688	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2688	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	34
PID 1740 wrote to memory of 2536	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2536	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2536	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	35
PID 1740 wrote to memory of 2364	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2364	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2364	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	36
PID 1740 wrote to memory of 2416	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2416	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2416	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	37
PID 1740 wrote to memory of 2796	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2796	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2796	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	38
PID 1740 wrote to memory of 2812	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	39
PID 1740 wrote to memory of 2812	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	39
PID 1740 wrote to memory of 2812	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	39
PID 1740 wrote to memory of 1504	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	40
PID 1740 wrote to memory of 1504	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	40
PID 1740 wrote to memory of 1504	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	40
PID 1740 wrote to memory of 1376	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	41
PID 1740 wrote to memory of 1376	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	41
PID 1740 wrote to memory of 1376	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	41
PID 1740 wrote to memory of 2624	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	42
PID 1740 wrote to memory of 2624	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	42
PID 1740 wrote to memory of 2624	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	42
PID 1740 wrote to memory of 2680	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	43
PID 1740 wrote to memory of 2680	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	43
PID 1740 wrote to memory of 2680	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	43
PID 1740 wrote to memory of 2668	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2668	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2668	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	44
PID 1740 wrote to memory of 2108	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	45
PID 1740 wrote to memory of 2108	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	45
PID 1740 wrote to memory of 2108	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	45
PID 1740 wrote to memory of 1612	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	46
PID 1740 wrote to memory of 1612	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	46
PID 1740 wrote to memory of 1612	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	46
PID 1740 wrote to memory of 2248	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	47
PID 1740 wrote to memory of 2248	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	47
PID 1740 wrote to memory of 2248	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	47
PID 1740 wrote to memory of 404	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	48
PID 1740 wrote to memory of 404	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	48
PID 1740 wrote to memory of 404	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	48
PID 1740 wrote to memory of 2116	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	49
PID 1740 wrote to memory of 2116	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	49
PID 1740 wrote to memory of 2116	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	49
PID 1740 wrote to memory of 2808	1740	141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\141fdc4fb7552bb3fe7edf414215a5b4_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2648
- C:\Windows\System\TgKmMtL.exe
  C:\Windows\System\TgKmMtL.exe
  2⤵
  - Executes dropped EXE
  PID:2868
- C:\Windows\System\xjSkMvm.exe
  C:\Windows\System\xjSkMvm.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\GDgfdhA.exe
  C:\Windows\System\GDgfdhA.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\sYsruDi.exe
  C:\Windows\System\sYsruDi.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\kOzLNwZ.exe
  C:\Windows\System\kOzLNwZ.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\sPlTwOU.exe
  C:\Windows\System\sPlTwOU.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\NBKIlVi.exe
  C:\Windows\System\NBKIlVi.exe
  2⤵
  - Executes dropped EXE
  PID:2364
- C:\Windows\System\GzzWXcf.exe
  C:\Windows\System\GzzWXcf.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\gEibcvw.exe
  C:\Windows\System\gEibcvw.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\JrVwAzC.exe
  C:\Windows\System\JrVwAzC.exe
  2⤵
  - Executes dropped EXE
  PID:2812
- C:\Windows\System\GeeOGgU.exe
  C:\Windows\System\GeeOGgU.exe
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Windows\System\eDVIfjc.exe
  C:\Windows\System\eDVIfjc.exe
  2⤵
  - Executes dropped EXE
  PID:1376
- C:\Windows\System\FioKmcC.exe
  C:\Windows\System\FioKmcC.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\gdNIwZa.exe
  C:\Windows\System\gdNIwZa.exe
  2⤵
  - Executes dropped EXE
  PID:2680
- C:\Windows\System\SZsQPqY.exe
  C:\Windows\System\SZsQPqY.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\zTxyboK.exe
  C:\Windows\System\zTxyboK.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\aYhfNvq.exe
  C:\Windows\System\aYhfNvq.exe
  2⤵
  - Executes dropped EXE
  PID:1612
- C:\Windows\System\ZjXxCxW.exe
  C:\Windows\System\ZjXxCxW.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\bxNktOj.exe
  C:\Windows\System\bxNktOj.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\Xjegenp.exe
  C:\Windows\System\Xjegenp.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\bmIWJlZ.exe
  C:\Windows\System\bmIWJlZ.exe
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Windows\System\PVZXmyG.exe
  C:\Windows\System\PVZXmyG.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\vMRBmNb.exe
  C:\Windows\System\vMRBmNb.exe
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Windows\System\jsjLpMh.exe
  C:\Windows\System\jsjLpMh.exe
  2⤵
  - Executes dropped EXE
  PID:1244
- C:\Windows\System\wLzYTnR.exe
  C:\Windows\System\wLzYTnR.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\XpoSlSP.exe
  C:\Windows\System\XpoSlSP.exe
  2⤵
  - Executes dropped EXE
  PID:1144
- C:\Windows\System\aYQYuyY.exe
  C:\Windows\System\aYQYuyY.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mGaDvTc.exe
  C:\Windows\System\mGaDvTc.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\yOoFMKd.exe
  C:\Windows\System\yOoFMKd.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\FOUWHhc.exe
  C:\Windows\System\FOUWHhc.exe
  2⤵
  - Executes dropped EXE
  PID:540
- C:\Windows\System\LzsWAEi.exe
  C:\Windows\System\LzsWAEi.exe
  2⤵
  - Executes dropped EXE
  PID:812
- C:\Windows\System\obOUJxh.exe
  C:\Windows\System\obOUJxh.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\oFJUhRZ.exe
  C:\Windows\System\oFJUhRZ.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\YTLqLDB.exe
  C:\Windows\System\YTLqLDB.exe
  2⤵
  - Executes dropped EXE
  PID:608
- C:\Windows\System\xaptdWI.exe
  C:\Windows\System\xaptdWI.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\wzDhTun.exe
  C:\Windows\System\wzDhTun.exe
  2⤵
  - Executes dropped EXE
  PID:1076
- C:\Windows\System\utoVIxu.exe
  C:\Windows\System\utoVIxu.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\QHkehMv.exe
  C:\Windows\System\QHkehMv.exe
  2⤵
  - Executes dropped EXE
  PID:2860
- C:\Windows\System\KXzSDET.exe
  C:\Windows\System\KXzSDET.exe
  2⤵
  - Executes dropped EXE
  PID:1096
- C:\Windows\System\yDqnSKQ.exe
  C:\Windows\System\yDqnSKQ.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\ahQZzoP.exe
  C:\Windows\System\ahQZzoP.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\mUnzMzX.exe
  C:\Windows\System\mUnzMzX.exe
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Windows\System\pqkXhEc.exe
  C:\Windows\System\pqkXhEc.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\JirgQup.exe
  C:\Windows\System\JirgQup.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\IbeOoCk.exe
  C:\Windows\System\IbeOoCk.exe
  2⤵
  - Executes dropped EXE
  PID:1836
- C:\Windows\System\bhIEgPv.exe
  C:\Windows\System\bhIEgPv.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\WVusZRX.exe
  C:\Windows\System\WVusZRX.exe
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Windows\System\AzOTWKg.exe
  C:\Windows\System\AzOTWKg.exe
  2⤵
  - Executes dropped EXE
  PID:904
- C:\Windows\System\YojzSbf.exe
  C:\Windows\System\YojzSbf.exe
  2⤵
  - Executes dropped EXE
  PID:612
- C:\Windows\System\rQfXebZ.exe
  C:\Windows\System\rQfXebZ.exe
  2⤵
  - Executes dropped EXE
  PID:572
- C:\Windows\System\HuGwMqf.exe
  C:\Windows\System\HuGwMqf.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\izAFXkC.exe
  C:\Windows\System\izAFXkC.exe
  2⤵
  - Executes dropped EXE
  PID:1892
- C:\Windows\System\TNtIkcS.exe
  C:\Windows\System\TNtIkcS.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\YQDbmko.exe
  C:\Windows\System\YQDbmko.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\kCoECiR.exe
  C:\Windows\System\kCoECiR.exe
  2⤵
  - Executes dropped EXE
  PID:2264
- C:\Windows\System\awZlevZ.exe
  C:\Windows\System\awZlevZ.exe
  2⤵
  - Executes dropped EXE
  PID:2148
- C:\Windows\System\Uqnnyrz.exe
  C:\Windows\System\Uqnnyrz.exe
  2⤵
  - Executes dropped EXE
  PID:2236
- C:\Windows\System\dZBNoin.exe
  C:\Windows\System\dZBNoin.exe
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\System\SGZIkqI.exe
  C:\Windows\System\SGZIkqI.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\wfaPYVI.exe
  C:\Windows\System\wfaPYVI.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\ljySVTC.exe
  C:\Windows\System\ljySVTC.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\vChDaVu.exe
  C:\Windows\System\vChDaVu.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\dSBHRLc.exe
  C:\Windows\System\dSBHRLc.exe
  2⤵
  - Executes dropped EXE
  PID:2268
- C:\Windows\System\qUHljkA.exe
  C:\Windows\System\qUHljkA.exe
  2⤵
  PID:2864
- C:\Windows\System\BteCSSl.exe
  C:\Windows\System\BteCSSl.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\DNblmUv.exe
  C:\Windows\System\DNblmUv.exe
  2⤵
  PID:2628
- C:\Windows\System\tHRJSsy.exe
  C:\Windows\System\tHRJSsy.exe
  2⤵
  PID:1476
- C:\Windows\System\lvYgkHy.exe
  C:\Windows\System\lvYgkHy.exe
  2⤵
  PID:2256
- C:\Windows\System\RAfxPmp.exe
  C:\Windows\System\RAfxPmp.exe
  2⤵
  PID:2576
- C:\Windows\System\UzhJyEw.exe
  C:\Windows\System\UzhJyEw.exe
  2⤵
  PID:2548
- C:\Windows\System\uztygBk.exe
  C:\Windows\System\uztygBk.exe
  2⤵
  PID:2080
- C:\Windows\System\IfeMsWi.exe
  C:\Windows\System\IfeMsWi.exe
  2⤵
  PID:1820
- C:\Windows\System\YjIhEsw.exe
  C:\Windows\System\YjIhEsw.exe
  2⤵
  PID:2112
- C:\Windows\System\NwMmGlO.exe
  C:\Windows\System\NwMmGlO.exe
  2⤵
  PID:832
- C:\Windows\System\jKexsTe.exe
  C:\Windows\System\jKexsTe.exe
  2⤵
  PID:2100
- C:\Windows\System\cQcXNaz.exe
  C:\Windows\System\cQcXNaz.exe
  2⤵
  PID:324
- C:\Windows\System\PivkEtE.exe
  C:\Windows\System\PivkEtE.exe
  2⤵
  PID:2616
- C:\Windows\System\euycWtf.exe
  C:\Windows\System\euycWtf.exe
  2⤵
  PID:2240
- C:\Windows\System\MXcJlQS.exe
  C:\Windows\System\MXcJlQS.exe
  2⤵
  PID:2916
- C:\Windows\System\qDeTfxm.exe
  C:\Windows\System\qDeTfxm.exe
  2⤵
  PID:2280
- C:\Windows\System\oJgotDX.exe
  C:\Windows\System\oJgotDX.exe
  2⤵
  PID:500
- C:\Windows\System\lAWFWID.exe
  C:\Windows\System\lAWFWID.exe
  2⤵
  PID:2820
- C:\Windows\System\BTrXeAf.exe
  C:\Windows\System\BTrXeAf.exe
  2⤵
  PID:1916
- C:\Windows\System\DZCETMG.exe
  C:\Windows\System\DZCETMG.exe
  2⤵
  PID:3000
- C:\Windows\System\omGnZAr.exe
  C:\Windows\System\omGnZAr.exe
  2⤵
  PID:1524
- C:\Windows\System\IKkiZPp.exe
  C:\Windows\System\IKkiZPp.exe
  2⤵
  PID:2492
- C:\Windows\System\qMQMYWR.exe
  C:\Windows\System\qMQMYWR.exe
  2⤵
  PID:2592
- C:\Windows\System\KzFsXoz.exe
  C:\Windows\System\KzFsXoz.exe
  2⤵
  PID:2880
- C:\Windows\System\fjAIFMp.exe
  C:\Windows\System\fjAIFMp.exe
  2⤵
  PID:2028
- C:\Windows\System\GqLdKOo.exe
  C:\Windows\System\GqLdKOo.exe
  2⤵
  PID:2452
- C:\Windows\System\fItvXLH.exe
  C:\Windows\System\fItvXLH.exe
  2⤵
  PID:1056
- C:\Windows\System\PUMfLiT.exe
  C:\Windows\System\PUMfLiT.exe
  2⤵
  PID:1768
- C:\Windows\System\fAXDpFv.exe
  C:\Windows\System\fAXDpFv.exe
  2⤵
  PID:2800
- C:\Windows\System\ZFBTZVG.exe
  C:\Windows\System\ZFBTZVG.exe
  2⤵
  PID:344
- C:\Windows\System\qxbgYMk.exe
  C:\Windows\System\qxbgYMk.exe
  2⤵
  PID:1736
- C:\Windows\System\PyJXuGA.exe
  C:\Windows\System\PyJXuGA.exe
  2⤵
  PID:448
- C:\Windows\System\SFUkcSj.exe
  C:\Windows\System\SFUkcSj.exe
  2⤵
  PID:2420
- C:\Windows\System\PdwXDCU.exe
  C:\Windows\System\PdwXDCU.exe
  2⤵
  PID:2380
- C:\Windows\System\Zbqbkmy.exe
  C:\Windows\System\Zbqbkmy.exe
  2⤵
  PID:2408
- C:\Windows\System\qiZqyfP.exe
  C:\Windows\System\qiZqyfP.exe
  2⤵
  PID:2372
- C:\Windows\System\XZjnaXR.exe
  C:\Windows\System\XZjnaXR.exe
  2⤵
  PID:1964
- C:\Windows\System\IjrMUeH.exe
  C:\Windows\System\IjrMUeH.exe
  2⤵
  PID:996
- C:\Windows\System\FeckRmD.exe
  C:\Windows\System\FeckRmD.exe
  2⤵
  PID:556
- C:\Windows\System\YOqpgNg.exe
  C:\Windows\System\YOqpgNg.exe
  2⤵
  PID:660
- C:\Windows\System\UVXdWbh.exe
  C:\Windows\System\UVXdWbh.exe
  2⤵
  PID:2732
- C:\Windows\System\pfsZyEu.exe
  C:\Windows\System\pfsZyEu.exe
  2⤵
  PID:2084
- C:\Windows\System\WHmAbWl.exe
  C:\Windows\System\WHmAbWl.exe
  2⤵
  PID:756
- C:\Windows\System\SIeUJAi.exe
  C:\Windows\System\SIeUJAi.exe
  2⤵
  PID:1408
- C:\Windows\System\ESNhBJr.exe
  C:\Windows\System\ESNhBJr.exe
  2⤵
  PID:1616
- C:\Windows\System\bIqJWBe.exe
  C:\Windows\System\bIqJWBe.exe
  2⤵
  PID:2644
- C:\Windows\System\wyJZIKt.exe
  C:\Windows\System\wyJZIKt.exe
  2⤵
  PID:2904
- C:\Windows\System\tWACWpr.exe
  C:\Windows\System\tWACWpr.exe
  2⤵
  PID:488
- C:\Windows\System\XYALDkr.exe
  C:\Windows\System\XYALDkr.exe
  2⤵
  PID:2632
- C:\Windows\System\EsaQVDG.exe
  C:\Windows\System\EsaQVDG.exe
  2⤵
  PID:2572
- C:\Windows\System\DjAbDdP.exe
  C:\Windows\System\DjAbDdP.exe
  2⤵
  PID:912
- C:\Windows\System\LcDZKFC.exe
  C:\Windows\System\LcDZKFC.exe
  2⤵
  PID:1940
- C:\Windows\System\AvKAvGX.exe
  C:\Windows\System\AvKAvGX.exe
  2⤵
  PID:2396
- C:\Windows\System\FcgKbFK.exe
  C:\Windows\System\FcgKbFK.exe
  2⤵
  PID:1896
- C:\Windows\System\dHwZzwU.exe
  C:\Windows\System\dHwZzwU.exe
  2⤵
  PID:300
- C:\Windows\System\SbDCmcA.exe
  C:\Windows\System\SbDCmcA.exe
  2⤵
  PID:684
- C:\Windows\System\BDSQoCZ.exe
  C:\Windows\System\BDSQoCZ.exe
  2⤵
  PID:1184
- C:\Windows\System\GMSiBiG.exe
  C:\Windows\System\GMSiBiG.exe
  2⤵
  PID:1344
- C:\Windows\System\eAPpxmR.exe
  C:\Windows\System\eAPpxmR.exe
  2⤵
  PID:876
- C:\Windows\System\fqVlEul.exe
  C:\Windows\System\fqVlEul.exe
  2⤵
  PID:2744
- C:\Windows\System\DichQmV.exe
  C:\Windows\System\DichQmV.exe
  2⤵
  PID:992
- C:\Windows\System\OmSiHPG.exe
  C:\Windows\System\OmSiHPG.exe
  2⤵
  PID:836
- C:\Windows\System\IgGVPoV.exe
  C:\Windows\System\IgGVPoV.exe
  2⤵
  PID:2040
- C:\Windows\System\wgcaEwl.exe
  C:\Windows\System\wgcaEwl.exe
  2⤵
  PID:3064
- C:\Windows\System\vQcNPYX.exe
  C:\Windows\System\vQcNPYX.exe
  2⤵
  PID:1228
- C:\Windows\System\MDnolIS.exe
  C:\Windows\System\MDnolIS.exe
  2⤵
  PID:1644
- C:\Windows\System\KsZQPxZ.exe
  C:\Windows\System\KsZQPxZ.exe
  2⤵
  PID:276
- C:\Windows\System\nIBkhol.exe
  C:\Windows\System\nIBkhol.exe
  2⤵
  PID:1692
- C:\Windows\System\AKLhxfO.exe
  C:\Windows\System\AKLhxfO.exe
  2⤵
  PID:2988
- C:\Windows\System\IGTLrCk.exe
  C:\Windows\System\IGTLrCk.exe
  2⤵
  PID:332
- C:\Windows\System\rcTWpNW.exe
  C:\Windows\System\rcTWpNW.exe
  2⤵
  PID:2500
- C:\Windows\System\QOlqFjm.exe
  C:\Windows\System\QOlqFjm.exe
  2⤵
  PID:1332
- C:\Windows\System\SDMqihI.exe
  C:\Windows\System\SDMqihI.exe
  2⤵
  PID:3080
- C:\Windows\System\HVruBFU.exe
  C:\Windows\System\HVruBFU.exe
  2⤵
  PID:3096
- C:\Windows\System\YhjdeAd.exe
  C:\Windows\System\YhjdeAd.exe
  2⤵
  PID:3112
- C:\Windows\System\jLtddiy.exe
  C:\Windows\System\jLtddiy.exe
  2⤵
  PID:3128
- C:\Windows\System\xBmgrRF.exe
  C:\Windows\System\xBmgrRF.exe
  2⤵
  PID:3144
- C:\Windows\System\FmRXzZY.exe
  C:\Windows\System\FmRXzZY.exe
  2⤵
  PID:3160
- C:\Windows\System\OvlOKxg.exe
  C:\Windows\System\OvlOKxg.exe
  2⤵
  PID:3176
- C:\Windows\System\rneZkHw.exe
  C:\Windows\System\rneZkHw.exe
  2⤵
  PID:3192
- C:\Windows\System\rVQQokQ.exe
  C:\Windows\System\rVQQokQ.exe
  2⤵
  PID:3208
- C:\Windows\System\HByXrVS.exe
  C:\Windows\System\HByXrVS.exe
  2⤵
  PID:3224
- C:\Windows\System\WwwEIhY.exe
  C:\Windows\System\WwwEIhY.exe
  2⤵
  PID:3240
- C:\Windows\System\BlUDYeG.exe
  C:\Windows\System\BlUDYeG.exe
  2⤵
  PID:3256
- C:\Windows\System\FWwFYBH.exe
  C:\Windows\System\FWwFYBH.exe
  2⤵
  PID:3272
- C:\Windows\System\lNccDbY.exe
  C:\Windows\System\lNccDbY.exe
  2⤵
  PID:3288
- C:\Windows\System\malKUGv.exe
  C:\Windows\System\malKUGv.exe
  2⤵
  PID:3304
- C:\Windows\System\sNfiXev.exe
  C:\Windows\System\sNfiXev.exe
  2⤵
  PID:3320
- C:\Windows\System\Cmjjqdl.exe
  C:\Windows\System\Cmjjqdl.exe
  2⤵
  PID:3336
- C:\Windows\System\PbFhkJm.exe
  C:\Windows\System\PbFhkJm.exe
  2⤵
  PID:3352
- C:\Windows\System\GjNvlzP.exe
  C:\Windows\System\GjNvlzP.exe
  2⤵
  PID:3368
- C:\Windows\System\oRwPWui.exe
  C:\Windows\System\oRwPWui.exe
  2⤵
  PID:3384
- C:\Windows\System\CrEKGqX.exe
  C:\Windows\System\CrEKGqX.exe
  2⤵
  PID:3400
- C:\Windows\System\SeDcUaX.exe
  C:\Windows\System\SeDcUaX.exe
  2⤵
  PID:3416
- C:\Windows\System\iqGlSxt.exe
  C:\Windows\System\iqGlSxt.exe
  2⤵
  PID:3432
- C:\Windows\System\JUTzXFU.exe
  C:\Windows\System\JUTzXFU.exe
  2⤵
  PID:3448
- C:\Windows\System\QnlvHcg.exe
  C:\Windows\System\QnlvHcg.exe
  2⤵
  PID:3464
- C:\Windows\System\ZzMWMCk.exe
  C:\Windows\System\ZzMWMCk.exe
  2⤵
  PID:3480
- C:\Windows\System\YLGLjMH.exe
  C:\Windows\System\YLGLjMH.exe
  2⤵
  PID:3496
- C:\Windows\System\ESVeFDK.exe
  C:\Windows\System\ESVeFDK.exe
  2⤵
  PID:3512
- C:\Windows\System\thFhVaV.exe
  C:\Windows\System\thFhVaV.exe
  2⤵
  PID:3528
- C:\Windows\System\FwoZiIP.exe
  C:\Windows\System\FwoZiIP.exe
  2⤵
  PID:3544
- C:\Windows\System\gcCyydW.exe
  C:\Windows\System\gcCyydW.exe
  2⤵
  PID:3560
- C:\Windows\System\KOsMsvl.exe
  C:\Windows\System\KOsMsvl.exe
  2⤵
  PID:3576
- C:\Windows\System\Uvnwgai.exe
  C:\Windows\System\Uvnwgai.exe
  2⤵
  PID:3592
- C:\Windows\System\nuUPlvW.exe
  C:\Windows\System\nuUPlvW.exe
  2⤵
  PID:3608
- C:\Windows\System\NMAXWWH.exe
  C:\Windows\System\NMAXWWH.exe
  2⤵
  PID:3624
- C:\Windows\System\jogAglb.exe
  C:\Windows\System\jogAglb.exe
  2⤵
  PID:3640
- C:\Windows\System\bWYxqto.exe
  C:\Windows\System\bWYxqto.exe
  2⤵
  PID:3696
- C:\Windows\System\YgShCMN.exe
  C:\Windows\System\YgShCMN.exe
  2⤵
  PID:3712
- C:\Windows\System\DeNRrUf.exe
  C:\Windows\System\DeNRrUf.exe
  2⤵
  PID:3728
- C:\Windows\System\CQXrbXY.exe
  C:\Windows\System\CQXrbXY.exe
  2⤵
  PID:3744
- C:\Windows\System\uHXOzoM.exe
  C:\Windows\System\uHXOzoM.exe
  2⤵
  PID:3760
- C:\Windows\System\kRBacRO.exe
  C:\Windows\System\kRBacRO.exe
  2⤵
  PID:3776
- C:\Windows\System\lthwnDJ.exe
  C:\Windows\System\lthwnDJ.exe
  2⤵
  PID:3792
- C:\Windows\System\EPnfwDm.exe
  C:\Windows\System\EPnfwDm.exe
  2⤵
  PID:3808
- C:\Windows\System\vpqFIuN.exe
  C:\Windows\System\vpqFIuN.exe
  2⤵
  PID:3824
- C:\Windows\System\TSTIaih.exe
  C:\Windows\System\TSTIaih.exe
  2⤵
  PID:3840
- C:\Windows\System\TqBoCjk.exe
  C:\Windows\System\TqBoCjk.exe
  2⤵
  PID:3856
- C:\Windows\System\JClNwzs.exe
  C:\Windows\System\JClNwzs.exe
  2⤵
  PID:3872
- C:\Windows\System\ufeZJRO.exe
  C:\Windows\System\ufeZJRO.exe
  2⤵
  PID:3888
- C:\Windows\System\GPaJrPj.exe
  C:\Windows\System\GPaJrPj.exe
  2⤵
  PID:3904
- C:\Windows\System\MthYjlw.exe
  C:\Windows\System\MthYjlw.exe
  2⤵
  PID:3920
- C:\Windows\System\OEuGNQW.exe
  C:\Windows\System\OEuGNQW.exe
  2⤵
  PID:3936
- C:\Windows\System\EpVsnMx.exe
  C:\Windows\System\EpVsnMx.exe
  2⤵
  PID:2228
- C:\Windows\System\NMNYaFo.exe
  C:\Windows\System\NMNYaFo.exe
  2⤵
  PID:752
- C:\Windows\System\MQkyjsi.exe
  C:\Windows\System\MQkyjsi.exe
  2⤵
  PID:2604
- C:\Windows\System\dRYhaic.exe
  C:\Windows\System\dRYhaic.exe
  2⤵
  PID:3124
- C:\Windows\System\RVDQPyw.exe
  C:\Windows\System\RVDQPyw.exe
  2⤵
  PID:3188
- C:\Windows\System\XRbnUZT.exe
  C:\Windows\System\XRbnUZT.exe
  2⤵
  PID:3252
- C:\Windows\System\KRlEdQL.exe
  C:\Windows\System\KRlEdQL.exe
  2⤵
  PID:3316
- C:\Windows\System\mkTjtZc.exe
  C:\Windows\System\mkTjtZc.exe
  2⤵
  PID:3380
- C:\Windows\System\OZTSpNR.exe
  C:\Windows\System\OZTSpNR.exe
  2⤵
  PID:3444
- C:\Windows\System\JCXQWoz.exe
  C:\Windows\System\JCXQWoz.exe
  2⤵
  PID:3508
- C:\Windows\System\RWeGJBn.exe
  C:\Windows\System\RWeGJBn.exe
  2⤵
  PID:3572
- C:\Windows\System\KaTCahA.exe
  C:\Windows\System\KaTCahA.exe
  2⤵
  PID:3636
- C:\Windows\System\TDVGDyU.exe
  C:\Windows\System\TDVGDyU.exe
  2⤵
  PID:2464
- C:\Windows\System\siFPkzL.exe
  C:\Windows\System\siFPkzL.exe
  2⤵
  PID:3740
- C:\Windows\System\LJuyxTu.exe
  C:\Windows\System\LJuyxTu.exe
  2⤵
  PID:3832
- C:\Windows\System\eYnSTeR.exe
  C:\Windows\System\eYnSTeR.exe
  2⤵
  PID:3868
- C:\Windows\System\dRElLSO.exe
  C:\Windows\System\dRElLSO.exe
  2⤵
  PID:3932
- C:\Windows\System\ETiMjtx.exe
  C:\Windows\System\ETiMjtx.exe
  2⤵
  PID:2560
- C:\Windows\System\KagtCXF.exe
  C:\Windows\System\KagtCXF.exe
  2⤵
  PID:2024
- C:\Windows\System\rYOQMQU.exe
  C:\Windows\System\rYOQMQU.exe
  2⤵
  PID:2120
- C:\Windows\System\zyaDNJg.exe
  C:\Windows\System\zyaDNJg.exe
  2⤵
  PID:3360
- C:\Windows\System\MqRSscy.exe
  C:\Windows\System\MqRSscy.exe
  2⤵
  PID:3424
- C:\Windows\System\CORZJju.exe
  C:\Windows\System\CORZJju.exe
  2⤵
  PID:3488
- C:\Windows\System\SrzRrQa.exe
  C:\Windows\System\SrzRrQa.exe
  2⤵
  PID:3552
- C:\Windows\System\bPesxwA.exe
  C:\Windows\System\bPesxwA.exe
  2⤵
  PID:3236
- C:\Windows\System\PSeyUUG.exe
  C:\Windows\System\PSeyUUG.exe
  2⤵
  PID:3588
- C:\Windows\System\iCgDCGk.exe
  C:\Windows\System\iCgDCGk.exe
  2⤵
  PID:3076
- C:\Windows\System\kUAeaOY.exe
  C:\Windows\System\kUAeaOY.exe
  2⤵
  PID:3652
- C:\Windows\System\qmMlCmV.exe
  C:\Windows\System\qmMlCmV.exe
  2⤵
  PID:3672
- C:\Windows\System\WUHeCCe.exe
  C:\Windows\System\WUHeCCe.exe
  2⤵
  PID:3688
- C:\Windows\System\vnVAXlI.exe
  C:\Windows\System\vnVAXlI.exe
  2⤵
  PID:3788
- C:\Windows\System\JEqeHZh.exe
  C:\Windows\System\JEqeHZh.exe
  2⤵
  PID:588
- C:\Windows\System\oiySwNY.exe
  C:\Windows\System\oiySwNY.exe
  2⤵
  PID:3952
- C:\Windows\System\btXQHiT.exe
  C:\Windows\System\btXQHiT.exe
  2⤵
  PID:4008
- C:\Windows\System\vlgKMSl.exe
  C:\Windows\System\vlgKMSl.exe
  2⤵
  PID:4032
- C:\Windows\System\lShsFqq.exe
  C:\Windows\System\lShsFqq.exe
  2⤵
  PID:3296
- C:\Windows\System\HDPdbOi.exe
  C:\Windows\System\HDPdbOi.exe
  2⤵
  PID:3200
- C:\Windows\System\FpwOOxp.exe
  C:\Windows\System\FpwOOxp.exe
  2⤵
  PID:1544
- C:\Windows\System\JISgjIp.exe
  C:\Windows\System\JISgjIp.exe
  2⤵
  PID:2456
- C:\Windows\System\jxLppgA.exe
  C:\Windows\System\jxLppgA.exe
  2⤵
  PID:2188
- C:\Windows\System\fBqhhoq.exe
  C:\Windows\System\fBqhhoq.exe
  2⤵
  PID:1656
- C:\Windows\System\GAHiGKi.exe
  C:\Windows\System\GAHiGKi.exe
  2⤵
  PID:1480
- C:\Windows\System\BTyrVzZ.exe
  C:\Windows\System\BTyrVzZ.exe
  2⤵
  PID:1664
- C:\Windows\System\SirRAmr.exe
  C:\Windows\System\SirRAmr.exe
  2⤵
  PID:2176
- C:\Windows\System\YvdSgFs.exe
  C:\Windows\System\YvdSgFs.exe
  2⤵
  PID:2740
- C:\Windows\System\fFkmdsU.exe
  C:\Windows\System\fFkmdsU.exe
  2⤵
  PID:2152
- C:\Windows\System\EiiHBIH.exe
  C:\Windows\System\EiiHBIH.exe
  2⤵
  PID:3156
- C:\Windows\System\JqnOifn.exe
  C:\Windows\System\JqnOifn.exe
  2⤵
  PID:3376
- C:\Windows\System\wqKbEcr.exe
  C:\Windows\System\wqKbEcr.exe
  2⤵
  PID:3604
- C:\Windows\System\mPDVZGk.exe
  C:\Windows\System\mPDVZGk.exe
  2⤵
  PID:3704
- C:\Windows\System\TbXoMCY.exe
  C:\Windows\System\TbXoMCY.exe
  2⤵
  PID:3864
- C:\Windows\System\hydIgSH.exe
  C:\Windows\System\hydIgSH.exe
  2⤵
  PID:3800
- C:\Windows\System\GzgNZFw.exe
  C:\Windows\System\GzgNZFw.exe
  2⤵
  PID:3928
- C:\Windows\System\eCgRwRz.exe
  C:\Windows\System\eCgRwRz.exe
  2⤵
  PID:3392
- C:\Windows\System\aPeqTGc.exe
  C:\Windows\System\aPeqTGc.exe
  2⤵
  PID:3328
- C:\Windows\System\iNtBBVV.exe
  C:\Windows\System\iNtBBVV.exe
  2⤵
  PID:3520
- C:\Windows\System\tXBrgIu.exe
  C:\Windows\System\tXBrgIu.exe
  2⤵
  PID:3300
- C:\Windows\System\yjgRpLf.exe
  C:\Windows\System\yjgRpLf.exe
  2⤵
  PID:1428
- C:\Windows\System\WrYHstv.exe
  C:\Windows\System\WrYHstv.exe
  2⤵
  PID:3648
- C:\Windows\System\HgypmZK.exe
  C:\Windows\System\HgypmZK.exe
  2⤵
  PID:2244
- C:\Windows\System\hEXxsww.exe
  C:\Windows\System\hEXxsww.exe
  2⤵
  PID:2556
- C:\Windows\System\tOWQWrN.exe
  C:\Windows\System\tOWQWrN.exe
  2⤵
  PID:3668
- C:\Windows\System\lHjwNGo.exe
  C:\Windows\System\lHjwNGo.exe
  2⤵
  PID:3848
- C:\Windows\System\CQQqyKC.exe
  C:\Windows\System\CQQqyKC.exe
  2⤵
  PID:3880
- C:\Windows\System\zsiNItv.exe
  C:\Windows\System\zsiNItv.exe
  2⤵
  PID:3756
- C:\Windows\System\YQWaLIb.exe
  C:\Windows\System\YQWaLIb.exe
  2⤵
  PID:3916
- C:\Windows\System\BWwqxVa.exe
  C:\Windows\System\BWwqxVa.exe
  2⤵
  PID:3964
- C:\Windows\System\dNoNRKZ.exe
  C:\Windows\System\dNoNRKZ.exe
  2⤵
  PID:3980
- C:\Windows\System\MkINVUN.exe
  C:\Windows\System\MkINVUN.exe
  2⤵
  PID:3996
- C:\Windows\System\BfDAAVu.exe
  C:\Windows\System\BfDAAVu.exe
  2⤵
  PID:2660
- C:\Windows\System\VmxNXZK.exe
  C:\Windows\System\VmxNXZK.exe
  2⤵
  PID:3104
- C:\Windows\System\dGgmrSG.exe
  C:\Windows\System\dGgmrSG.exe
  2⤵
  PID:1744
- C:\Windows\System\TnvdBaJ.exe
  C:\Windows\System\TnvdBaJ.exe
  2⤵
  PID:3092
- C:\Windows\System\blUQgOy.exe
  C:\Windows\System\blUQgOy.exe
  2⤵
  PID:3568
- C:\Windows\System\cLOAoiI.exe
  C:\Windows\System\cLOAoiI.exe
  2⤵
  PID:2124
- C:\Windows\System\cCmrgen.exe
  C:\Windows\System\cCmrgen.exe
  2⤵
  PID:1728
- C:\Windows\System\iIwqLXf.exe
  C:\Windows\System\iIwqLXf.exe
  2⤵
  PID:3684
- C:\Windows\System\jzDpIHM.exe
  C:\Windows\System\jzDpIHM.exe
  2⤵
  PID:4028
- C:\Windows\System\sIiMVEB.exe
  C:\Windows\System\sIiMVEB.exe
  2⤵
  PID:3852
- C:\Windows\System\iLzqJBz.exe
  C:\Windows\System\iLzqJBz.exe
  2⤵
  PID:2656
- C:\Windows\System\UiqzryK.exe
  C:\Windows\System\UiqzryK.exe
  2⤵
  PID:2312
- C:\Windows\System\czURJil.exe
  C:\Windows\System\czURJil.exe
  2⤵
  PID:3412
- C:\Windows\System\mjJMIVb.exe
  C:\Windows\System\mjJMIVb.exe
  2⤵
  PID:3028
- C:\Windows\System\xkCgijt.exe
  C:\Windows\System\xkCgijt.exe
  2⤵
  PID:3332
- C:\Windows\System\TiJlxyY.exe
  C:\Windows\System\TiJlxyY.exe
  2⤵
  PID:336
- C:\Windows\System\zDPJOFw.exe
  C:\Windows\System\zDPJOFw.exe
  2⤵
  PID:2600
- C:\Windows\System\AEuIIYP.exe
  C:\Windows\System\AEuIIYP.exe
  2⤵
  PID:3720
- C:\Windows\System\xozTNud.exe
  C:\Windows\System\xozTNud.exe
  2⤵
  PID:2316
- C:\Windows\System\lDnBmBr.exe
  C:\Windows\System\lDnBmBr.exe
  2⤵
  PID:2996
- C:\Windows\System\OxuDIiI.exe
  C:\Windows\System\OxuDIiI.exe
  2⤵
  PID:3456
- C:\Windows\System\bcUYQrZ.exe
  C:\Windows\System\bcUYQrZ.exe
  2⤵
  PID:4016
- C:\Windows\System\jbBmLkK.exe
  C:\Windows\System\jbBmLkK.exe
  2⤵
  PID:1624
- C:\Windows\System\eRfjZjE.exe
  C:\Windows\System\eRfjZjE.exe
  2⤵
  PID:3220
- C:\Windows\System\ItJwFYf.exe
  C:\Windows\System\ItJwFYf.exe
  2⤵
  PID:3960
- C:\Windows\System\waAbGAw.exe
  C:\Windows\System\waAbGAw.exe
  2⤵
  PID:4040
- C:\Windows\System\ksJwPdn.exe
  C:\Windows\System\ksJwPdn.exe
  2⤵
  PID:3836
- C:\Windows\System\QWvwyrn.exe
  C:\Windows\System\QWvwyrn.exe
  2⤵
  PID:848
- C:\Windows\System\hGhyUKX.exe
  C:\Windows\System\hGhyUKX.exe
  2⤵
  PID:1296
- C:\Windows\System\AKnNAGR.exe
  C:\Windows\System\AKnNAGR.exe
  2⤵
  PID:3708
- C:\Windows\System\IlTaQlm.exe
  C:\Windows\System\IlTaQlm.exe
  2⤵
  PID:916
- C:\Windows\System\KpbaTkm.exe
  C:\Windows\System\KpbaTkm.exe
  2⤵
  PID:3912
- C:\Windows\System\UnAvUSR.exe
  C:\Windows\System\UnAvUSR.exe
  2⤵
  PID:3584
- C:\Windows\System\pVuNkKV.exe
  C:\Windows\System\pVuNkKV.exe
  2⤵
  PID:1248
- C:\Windows\System\rWyrxZu.exe
  C:\Windows\System\rWyrxZu.exe
  2⤵
  PID:3724
- C:\Windows\System\bagilAG.exe
  C:\Windows\System\bagilAG.exe
  2⤵
  PID:3476
- C:\Windows\System\ciLVNgF.exe
  C:\Windows\System\ciLVNgF.exe
  2⤵
  PID:1552
- C:\Windows\System\udDgvig.exe
  C:\Windows\System\udDgvig.exe
  2⤵
  PID:2608
- C:\Windows\System\UChKQgj.exe
  C:\Windows\System\UChKQgj.exe
  2⤵
  PID:4112
- C:\Windows\System\RtdDjIl.exe
  C:\Windows\System\RtdDjIl.exe
  2⤵
  PID:4128
- C:\Windows\System\aUIrNXc.exe
  C:\Windows\System\aUIrNXc.exe
  2⤵
  PID:4144
- C:\Windows\System\hwvPlYZ.exe
  C:\Windows\System\hwvPlYZ.exe
  2⤵
  PID:4160
- C:\Windows\System\PDbEvNP.exe
  C:\Windows\System\PDbEvNP.exe
  2⤵
  PID:4176
- C:\Windows\System\sDYuPFn.exe
  C:\Windows\System\sDYuPFn.exe
  2⤵
  PID:4192
- C:\Windows\System\woyPPAS.exe
  C:\Windows\System\woyPPAS.exe
  2⤵
  PID:4208
- C:\Windows\System\THWWvUJ.exe
  C:\Windows\System\THWWvUJ.exe
  2⤵
  PID:4224
- C:\Windows\System\qRayCIv.exe
  C:\Windows\System\qRayCIv.exe
  2⤵
  PID:4240
- C:\Windows\System\XSCvHGn.exe
  C:\Windows\System\XSCvHGn.exe
  2⤵
  PID:4256
- C:\Windows\System\rLqiAwq.exe
  C:\Windows\System\rLqiAwq.exe
  2⤵
  PID:4272
- C:\Windows\System\ZlqGMER.exe
  C:\Windows\System\ZlqGMER.exe
  2⤵
  PID:4288
- C:\Windows\System\pclyILQ.exe
  C:\Windows\System\pclyILQ.exe
  2⤵
  PID:4304
- C:\Windows\System\umUiyMj.exe
  C:\Windows\System\umUiyMj.exe
  2⤵
  PID:4320
- C:\Windows\System\RJbypoh.exe
  C:\Windows\System\RJbypoh.exe
  2⤵
  PID:4336
- C:\Windows\System\FqBhxMm.exe
  C:\Windows\System\FqBhxMm.exe
  2⤵
  PID:4352
- C:\Windows\System\XHHClEx.exe
  C:\Windows\System\XHHClEx.exe
  2⤵
  PID:4368
- C:\Windows\System\YoawpHg.exe
  C:\Windows\System\YoawpHg.exe
  2⤵
  PID:4384
- C:\Windows\System\zphRNFa.exe
  C:\Windows\System\zphRNFa.exe
  2⤵
  PID:4400
- C:\Windows\System\wNwJNgi.exe
  C:\Windows\System\wNwJNgi.exe
  2⤵
  PID:4416
- C:\Windows\System\eCUGNIu.exe
  C:\Windows\System\eCUGNIu.exe
  2⤵
  PID:4436
- C:\Windows\System\NfPfEnX.exe
  C:\Windows\System\NfPfEnX.exe
  2⤵
  PID:4452
- C:\Windows\System\tfAukOF.exe
  C:\Windows\System\tfAukOF.exe
  2⤵
  PID:4468
- C:\Windows\System\jSiNTWS.exe
  C:\Windows\System\jSiNTWS.exe
  2⤵
  PID:4484
- C:\Windows\System\zCvFwIQ.exe
  C:\Windows\System\zCvFwIQ.exe
  2⤵
  PID:4500
- C:\Windows\System\AavmySu.exe
  C:\Windows\System\AavmySu.exe
  2⤵
  PID:4516
- C:\Windows\System\xtaBZjK.exe
  C:\Windows\System\xtaBZjK.exe
  2⤵
  PID:4532
- C:\Windows\System\ejQkyQm.exe
  C:\Windows\System\ejQkyQm.exe
  2⤵
  PID:4548
- C:\Windows\System\hOanInk.exe
  C:\Windows\System\hOanInk.exe
  2⤵
  PID:4568
- C:\Windows\System\uaOYxFQ.exe
  C:\Windows\System\uaOYxFQ.exe
  2⤵
  PID:4584
- C:\Windows\System\JWHjgoZ.exe
  C:\Windows\System\JWHjgoZ.exe
  2⤵
  PID:4600
- C:\Windows\System\LFpeJGN.exe
  C:\Windows\System\LFpeJGN.exe
  2⤵
  PID:4616
- C:\Windows\System\bBrmLVw.exe
  C:\Windows\System\bBrmLVw.exe
  2⤵
  PID:4632
- C:\Windows\System\FrFRpgR.exe
  C:\Windows\System\FrFRpgR.exe
  2⤵
  PID:4648
- C:\Windows\System\JkYwEBr.exe
  C:\Windows\System\JkYwEBr.exe
  2⤵
  PID:4664
- C:\Windows\System\RYdsWES.exe
  C:\Windows\System\RYdsWES.exe
  2⤵
  PID:4680
- C:\Windows\System\PBUhUtd.exe
  C:\Windows\System\PBUhUtd.exe
  2⤵
  PID:4700
- C:\Windows\System\NKcukYj.exe
  C:\Windows\System\NKcukYj.exe
  2⤵
  PID:4716
- C:\Windows\System\VhTOGyJ.exe
  C:\Windows\System\VhTOGyJ.exe
  2⤵
  PID:4744
- C:\Windows\System\ONPWlrj.exe
  C:\Windows\System\ONPWlrj.exe
  2⤵
  PID:4764
- C:\Windows\System\mtGxQHY.exe
  C:\Windows\System\mtGxQHY.exe
  2⤵
  PID:4784
- C:\Windows\System\EkuOXPz.exe
  C:\Windows\System\EkuOXPz.exe
  2⤵
  PID:4800
- C:\Windows\System\VEtWtcg.exe
  C:\Windows\System\VEtWtcg.exe
  2⤵
  PID:4816
- C:\Windows\System\RCaErfx.exe
  C:\Windows\System\RCaErfx.exe
  2⤵
  PID:4832
- C:\Windows\System\YqmfRkY.exe
  C:\Windows\System\YqmfRkY.exe
  2⤵
  PID:4848
- C:\Windows\System\JUwKMQH.exe
  C:\Windows\System\JUwKMQH.exe
  2⤵
  PID:4864
- C:\Windows\System\ZXjGyPy.exe
  C:\Windows\System\ZXjGyPy.exe
  2⤵
  PID:4884
- C:\Windows\System\kwpXEft.exe
  C:\Windows\System\kwpXEft.exe
  2⤵
  PID:4900
- C:\Windows\System\oiGEMAz.exe
  C:\Windows\System\oiGEMAz.exe
  2⤵
  PID:4916
- C:\Windows\System\AeDnOwi.exe
  C:\Windows\System\AeDnOwi.exe
  2⤵
  PID:4932
- C:\Windows\System\puXXdVK.exe
  C:\Windows\System\puXXdVK.exe
  2⤵
  PID:4948
- C:\Windows\System\jWzXuix.exe
  C:\Windows\System\jWzXuix.exe
  2⤵
  PID:4964
- C:\Windows\System\ujCZFFs.exe
  C:\Windows\System\ujCZFFs.exe
  2⤵
  PID:4980
- C:\Windows\System\vdgedWD.exe
  C:\Windows\System\vdgedWD.exe
  2⤵
  PID:4996
- C:\Windows\System\cOMkTjT.exe
  C:\Windows\System\cOMkTjT.exe
  2⤵
  PID:5012
- C:\Windows\System\qanQSLp.exe
  C:\Windows\System\qanQSLp.exe
  2⤵
  PID:5028
- C:\Windows\System\ekxSnzD.exe
  C:\Windows\System\ekxSnzD.exe
  2⤵
  PID:5044
- C:\Windows\System\mhsmdmj.exe
  C:\Windows\System\mhsmdmj.exe
  2⤵
  PID:5060
- C:\Windows\System\OFvxbBR.exe
  C:\Windows\System\OFvxbBR.exe
  2⤵
  PID:5076
- C:\Windows\System\IyRgljq.exe
  C:\Windows\System\IyRgljq.exe
  2⤵
  PID:5092
- C:\Windows\System\DRbwLTA.exe
  C:\Windows\System\DRbwLTA.exe
  2⤵
  PID:5108
- C:\Windows\System\hORDuqf.exe
  C:\Windows\System\hORDuqf.exe
  2⤵
  PID:4004
- C:\Windows\System\messPPX.exe
  C:\Windows\System\messPPX.exe
  2⤵
  PID:2804
- C:\Windows\System\nFqvnga.exe
  C:\Windows\System\nFqvnga.exe
  2⤵
  PID:804
- C:\Windows\System\JdCNmsN.exe
  C:\Windows\System\JdCNmsN.exe
  2⤵
  PID:3504
- C:\Windows\System\WdzbZnp.exe
  C:\Windows\System\WdzbZnp.exe
  2⤵
  PID:544
- C:\Windows\System\zULYetB.exe
  C:\Windows\System\zULYetB.exe
  2⤵
  PID:2580
- C:\Windows\System\kKgpmLQ.exe
  C:\Windows\System\kKgpmLQ.exe
  2⤵
  PID:2468
- C:\Windows\System\qJmNWnP.exe
  C:\Windows\System\qJmNWnP.exe
  2⤵
  PID:4140
- C:\Windows\System\DLulygh.exe
  C:\Windows\System\DLulygh.exe
  2⤵
  PID:4204
- C:\Windows\System\PDDJXvr.exe
  C:\Windows\System\PDDJXvr.exe
  2⤵
  PID:4364
- C:\Windows\System\IhDYJaW.exe
  C:\Windows\System\IhDYJaW.exe
  2⤵
  PID:1556
- C:\Windows\System\bkwehEB.exe
  C:\Windows\System\bkwehEB.exe
  2⤵
  PID:1652
- C:\Windows\System\EzqsKbT.exe
  C:\Windows\System\EzqsKbT.exe
  2⤵
  PID:4184
- C:\Windows\System\aooTVca.exe
  C:\Windows\System\aooTVca.exe
  2⤵
  PID:4248
- C:\Windows\System\fvueysE.exe
  C:\Windows\System\fvueysE.exe
  2⤵
  PID:4312
- C:\Windows\System\hJiGSJv.exe
  C:\Windows\System\hJiGSJv.exe
  2⤵
  PID:4348
- C:\Windows\System\ZAXGAOL.exe
  C:\Windows\System\ZAXGAOL.exe
  2⤵
  PID:4412
- C:\Windows\System\QGLtZqH.exe
  C:\Windows\System\QGLtZqH.exe
  2⤵
  PID:4464
- C:\Windows\System\MHwSoSU.exe
  C:\Windows\System\MHwSoSU.exe
  2⤵
  PID:4524
- C:\Windows\System\mejYgtD.exe
  C:\Windows\System\mejYgtD.exe
  2⤵
  PID:4508
- C:\Windows\System\fCziSKB.exe
  C:\Windows\System\fCziSKB.exe
  2⤵
  PID:4560
- C:\Windows\System\fxpjxNv.exe
  C:\Windows\System\fxpjxNv.exe
  2⤵
  PID:4592
- C:\Windows\System\XrVLtdy.exe
  C:\Windows\System\XrVLtdy.exe
  2⤵
  PID:1568
- C:\Windows\System\gdOITuK.exe
  C:\Windows\System\gdOITuK.exe
  2⤵
  PID:4656
- C:\Windows\System\dbgGmvU.exe
  C:\Windows\System\dbgGmvU.exe
  2⤵
  PID:4724
- C:\Windows\System\eDwWDtq.exe
  C:\Windows\System\eDwWDtq.exe
  2⤵
  PID:4728
- C:\Windows\System\VtmnCvN.exe
  C:\Windows\System\VtmnCvN.exe
  2⤵
  PID:4808
- C:\Windows\System\YzjDvtM.exe
  C:\Windows\System\YzjDvtM.exe
  2⤵
  PID:2716
- C:\Windows\System\AtXJhMi.exe
  C:\Windows\System\AtXJhMi.exe
  2⤵
  PID:4712
- C:\Windows\System\MXpwCTn.exe
  C:\Windows\System\MXpwCTn.exe
  2⤵
  PID:4756
- C:\Windows\System\yMfvqOo.exe
  C:\Windows\System\yMfvqOo.exe
  2⤵
  PID:4824
- C:\Windows\System\pDdgLQm.exe
  C:\Windows\System\pDdgLQm.exe
  2⤵
  PID:4672
- C:\Windows\System\UAwEeij.exe
  C:\Windows\System\UAwEeij.exe
  2⤵
  PID:4928
- C:\Windows\System\otvJzLU.exe
  C:\Windows\System\otvJzLU.exe
  2⤵
  PID:1628
- C:\Windows\System\bednxbZ.exe
  C:\Windows\System\bednxbZ.exe
  2⤵
  PID:5024
- C:\Windows\System\iyhJDKf.exe
  C:\Windows\System\iyhJDKf.exe
  2⤵
  PID:5084
- C:\Windows\System\Noffiqc.exe
  C:\Windows\System\Noffiqc.exe
  2⤵
  PID:2096
- C:\Windows\System\SWJYtKX.exe
  C:\Windows\System\SWJYtKX.exe
  2⤵
  PID:4172
- C:\Windows\System\vMzwzdQ.exe
  C:\Windows\System\vMzwzdQ.exe
  2⤵
  PID:4912
- C:\Windows\System\YAbjftu.exe
  C:\Windows\System\YAbjftu.exe
  2⤵
  PID:5040
- C:\Windows\System\JKuHJcu.exe
  C:\Windows\System\JKuHJcu.exe
  2⤵
  PID:3060
- C:\Windows\System\aFZZuTt.exe
  C:\Windows\System\aFZZuTt.exe
  2⤵
  PID:4972
- C:\Windows\System\HKnPQNI.exe
  C:\Windows\System\HKnPQNI.exe
  2⤵
  PID:4236
- C:\Windows\System\piRnLaB.exe
  C:\Windows\System\piRnLaB.exe
  2⤵
  PID:4880
- C:\Windows\System\SkNzYQC.exe
  C:\Windows\System\SkNzYQC.exe
  2⤵
  PID:4124
- C:\Windows\System\KBjowaB.exe
  C:\Windows\System\KBjowaB.exe
  2⤵
  PID:4296
- C:\Windows\System\QQeRLAU.exe
  C:\Windows\System\QQeRLAU.exe
  2⤵
  PID:4392
- C:\Windows\System\TmGChnm.exe
  C:\Windows\System\TmGChnm.exe
  2⤵
  PID:4280
- C:\Windows\System\PktduGp.exe
  C:\Windows\System\PktduGp.exe
  2⤵
  PID:4220
- C:\Windows\System\JuCFCIn.exe
  C:\Windows\System\JuCFCIn.exe
  2⤵
  PID:4492
- C:\Windows\System\yrxeSwJ.exe
  C:\Windows\System\yrxeSwJ.exe
  2⤵
  PID:4596
- C:\Windows\System\MZKGBDF.exe
  C:\Windows\System\MZKGBDF.exe
  2⤵
  PID:4780
- C:\Windows\System\KpILuFZ.exe
  C:\Windows\System\KpILuFZ.exe
  2⤵
  PID:4796
- C:\Windows\System\gAoQxEC.exe
  C:\Windows\System\gAoQxEC.exe
  2⤵
  PID:5020
- C:\Windows\System\wOtrSCv.exe
  C:\Windows\System\wOtrSCv.exe
  2⤵
  PID:4480
- C:\Windows\System\CYoVXRu.exe
  C:\Windows\System\CYoVXRu.exe
  2⤵
  PID:4740
- C:\Windows\System\BksGdrF.exe
  C:\Windows\System\BksGdrF.exe
  2⤵
  PID:4628
- C:\Windows\System\bvlOSkT.exe
  C:\Windows\System\bvlOSkT.exe
  2⤵
  PID:4676
- C:\Windows\System\ovGSnwQ.exe
  C:\Windows\System\ovGSnwQ.exe
  2⤵
  PID:4988
- C:\Windows\System\yrSazKu.exe
  C:\Windows\System\yrSazKu.exe
  2⤵
  PID:2352
- C:\Windows\System\fUvRqML.exe
  C:\Windows\System\fUvRqML.exe
  2⤵
  PID:2284
- C:\Windows\System\bTthWSQ.exe
  C:\Windows\System\bTthWSQ.exe
  2⤵
  PID:4556
- C:\Windows\System\dIEtnBR.exe
  C:\Windows\System\dIEtnBR.exe
  2⤵
  PID:5100
- C:\Windows\System\UilYEgO.exe
  C:\Windows\System\UilYEgO.exe
  2⤵
  PID:776
- C:\Windows\System\jDZqXpt.exe
  C:\Windows\System\jDZqXpt.exe
  2⤵
  PID:3736
- C:\Windows\System\uQLNUle.exe
  C:\Windows\System\uQLNUle.exe
  2⤵
  PID:2612
- C:\Windows\System\pvbpvrd.exe
  C:\Windows\System\pvbpvrd.exe
  2⤵
  PID:5036
- C:\Windows\System\xeXRvGl.exe
  C:\Windows\System\xeXRvGl.exe
  2⤵
  PID:4840
- C:\Windows\System\csGbJfV.exe
  C:\Windows\System\csGbJfV.exe
  2⤵
  PID:4872
- C:\Windows\System\vzGPjUQ.exe
  C:\Windows\System\vzGPjUQ.exe
  2⤵
  PID:4156
- C:\Windows\System\mgUQPzx.exe
  C:\Windows\System\mgUQPzx.exe
  2⤵
  PID:4696
- C:\Windows\System\iyZJQNG.exe
  C:\Windows\System\iyZJQNG.exe
  2⤵
  PID:2036
- C:\Windows\System\ADjOKtk.exe
  C:\Windows\System\ADjOKtk.exe
  2⤵
  PID:4752
- C:\Windows\System\GUZamCR.exe
  C:\Windows\System\GUZamCR.exe
  2⤵
  PID:4360
- C:\Windows\System\VpKoWMe.exe
  C:\Windows\System\VpKoWMe.exe
  2⤵
  PID:5136
- C:\Windows\System\STtvQmg.exe
  C:\Windows\System\STtvQmg.exe
  2⤵
  PID:5152
- C:\Windows\System\OukcJEK.exe
  C:\Windows\System\OukcJEK.exe
  2⤵
  PID:5168
- C:\Windows\System\UeeWPOg.exe
  C:\Windows\System\UeeWPOg.exe
  2⤵
  PID:5184
- C:\Windows\System\weaDcSt.exe
  C:\Windows\System\weaDcSt.exe
  2⤵
  PID:5200
- C:\Windows\System\gBpNKwi.exe
  C:\Windows\System\gBpNKwi.exe
  2⤵
  PID:5216
- C:\Windows\System\fjtLGzv.exe
  C:\Windows\System\fjtLGzv.exe
  2⤵
  PID:5232
- C:\Windows\System\VUkwjnQ.exe
  C:\Windows\System\VUkwjnQ.exe
  2⤵
  PID:5248
- C:\Windows\System\NLoyWde.exe
  C:\Windows\System\NLoyWde.exe
  2⤵
  PID:5264
- C:\Windows\System\QRjPEZB.exe
  C:\Windows\System\QRjPEZB.exe
  2⤵
  PID:5280
- C:\Windows\System\DamTxOp.exe
  C:\Windows\System\DamTxOp.exe
  2⤵
  PID:5300
- C:\Windows\System\lcvKFnP.exe
  C:\Windows\System\lcvKFnP.exe
  2⤵
  PID:5316
- C:\Windows\System\HxBbJMI.exe
  C:\Windows\System\HxBbJMI.exe
  2⤵
  PID:5332
- C:\Windows\System\VQNGgkB.exe
  C:\Windows\System\VQNGgkB.exe
  2⤵
  PID:5348
- C:\Windows\System\IKEqICb.exe
  C:\Windows\System\IKEqICb.exe
  2⤵
  PID:5364
- C:\Windows\System\TiKkkLI.exe
  C:\Windows\System\TiKkkLI.exe
  2⤵
  PID:5388
- C:\Windows\System\LFrUxgB.exe
  C:\Windows\System\LFrUxgB.exe
  2⤵
  PID:5404
- C:\Windows\System\AUxuIPS.exe
  C:\Windows\System\AUxuIPS.exe
  2⤵
  PID:5420
- C:\Windows\System\NGxMbKq.exe
  C:\Windows\System\NGxMbKq.exe
  2⤵
  PID:5436
- C:\Windows\System\WFwIYBf.exe
  C:\Windows\System\WFwIYBf.exe
  2⤵
  PID:5452
- C:\Windows\System\YpaUyxQ.exe
  C:\Windows\System\YpaUyxQ.exe
  2⤵
  PID:5472
- C:\Windows\System\LETgdWL.exe
  C:\Windows\System\LETgdWL.exe
  2⤵
  PID:5488
- C:\Windows\System\NvrKARN.exe
  C:\Windows\System\NvrKARN.exe
  2⤵
  PID:5508
- C:\Windows\System\zqpuZdS.exe
  C:\Windows\System\zqpuZdS.exe
  2⤵
  PID:5524
- C:\Windows\System\nhuXkgR.exe
  C:\Windows\System\nhuXkgR.exe
  2⤵
  PID:5540
- C:\Windows\System\DqqlbdP.exe
  C:\Windows\System\DqqlbdP.exe
  2⤵
  PID:5556
- C:\Windows\System\FAjLyTK.exe
  C:\Windows\System\FAjLyTK.exe
  2⤵
  PID:5572
- C:\Windows\System\lbqdLAR.exe
  C:\Windows\System\lbqdLAR.exe
  2⤵
  PID:5588
- C:\Windows\System\NMyecNA.exe
  C:\Windows\System\NMyecNA.exe
  2⤵
  PID:5608
- C:\Windows\System\iGQJsVT.exe
  C:\Windows\System\iGQJsVT.exe
  2⤵
  PID:5624
- C:\Windows\System\wfLIvum.exe
  C:\Windows\System\wfLIvum.exe
  2⤵
  PID:5640
- C:\Windows\System\gTkPwwI.exe
  C:\Windows\System\gTkPwwI.exe
  2⤵
  PID:5656
- C:\Windows\System\NpIrzfI.exe
  C:\Windows\System\NpIrzfI.exe
  2⤵
  PID:5672
- C:\Windows\System\gHHmbUT.exe
  C:\Windows\System\gHHmbUT.exe
  2⤵
  PID:5688
- C:\Windows\System\UmlSMxV.exe
  C:\Windows\System\UmlSMxV.exe
  2⤵
  PID:5704
- C:\Windows\System\RqVgguD.exe
  C:\Windows\System\RqVgguD.exe
  2⤵
  PID:5720
- C:\Windows\System\STlbwnZ.exe
  C:\Windows\System\STlbwnZ.exe
  2⤵
  PID:5736
- C:\Windows\System\gNnBaNB.exe
  C:\Windows\System\gNnBaNB.exe
  2⤵
  PID:5752
- C:\Windows\System\lRhVBGN.exe
  C:\Windows\System\lRhVBGN.exe
  2⤵
  PID:5848
- C:\Windows\System\CouDKCo.exe
  C:\Windows\System\CouDKCo.exe
  2⤵
  PID:5876
- C:\Windows\System\lnWUfhd.exe
  C:\Windows\System\lnWUfhd.exe
  2⤵
  PID:5892
- C:\Windows\System\zcKqwkI.exe
  C:\Windows\System\zcKqwkI.exe
  2⤵
  PID:5908
- C:\Windows\System\cmrFEnC.exe
  C:\Windows\System\cmrFEnC.exe
  2⤵
  PID:5924
- C:\Windows\System\atMtqZU.exe
  C:\Windows\System\atMtqZU.exe
  2⤵
  PID:5944
- C:\Windows\System\oGIhLAD.exe
  C:\Windows\System\oGIhLAD.exe
  2⤵
  PID:5960
- C:\Windows\System\SDIcOhn.exe
  C:\Windows\System\SDIcOhn.exe
  2⤵
  PID:5976
- C:\Windows\System\ZIMLBrN.exe
  C:\Windows\System\ZIMLBrN.exe
  2⤵
  PID:5992
- C:\Windows\System\HvLuLci.exe
  C:\Windows\System\HvLuLci.exe
  2⤵
  PID:6008
- C:\Windows\System\PXdLvFr.exe
  C:\Windows\System\PXdLvFr.exe
  2⤵
  PID:6024
- C:\Windows\System\BKmEQUv.exe
  C:\Windows\System\BKmEQUv.exe
  2⤵
  PID:6040
- C:\Windows\System\oVwHhqK.exe
  C:\Windows\System\oVwHhqK.exe
  2⤵
  PID:6056
- C:\Windows\System\uVcRLtQ.exe
  C:\Windows\System\uVcRLtQ.exe
  2⤵
  PID:6072
- C:\Windows\System\UdOaKCS.exe
  C:\Windows\System\UdOaKCS.exe
  2⤵
  PID:5196
- C:\Windows\System\NZZTXpf.exe
  C:\Windows\System\NZZTXpf.exe
  2⤵
  PID:5328
- C:\Windows\System\ToVrdIl.exe
  C:\Windows\System\ToVrdIl.exe
  2⤵
  PID:5288
- C:\Windows\System\JYQqncr.exe
  C:\Windows\System\JYQqncr.exe
  2⤵
  PID:1828
- C:\Windows\System\EnRjRmq.exe
  C:\Windows\System\EnRjRmq.exe
  2⤵
  PID:5272
- C:\Windows\System\YCcSeGy.exe
  C:\Windows\System\YCcSeGy.exe
  2⤵
  PID:5428
- C:\Windows\System\fhyZEeV.exe
  C:\Windows\System\fhyZEeV.exe
  2⤵
  PID:5568
- C:\Windows\System\qflzRqV.exe
  C:\Windows\System\qflzRqV.exe
  2⤵
  PID:3056
- C:\Windows\System\TGMFheM.exe
  C:\Windows\System\TGMFheM.exe
  2⤵
  PID:5276
- C:\Windows\System\ioLUMrt.exe
  C:\Windows\System\ioLUMrt.exe
  2⤵
  PID:5384
- C:\Windows\System\UkMUOgO.exe
  C:\Windows\System\UkMUOgO.exe
  2⤵
  PID:5604
- C:\Windows\System\SrpCIkO.exe
  C:\Windows\System\SrpCIkO.exe
  2⤵
  PID:5744
- C:\Windows\System\vnKwqWK.exe
  C:\Windows\System\vnKwqWK.exe
  2⤵
  PID:5796
- C:\Windows\System\Palpcmd.exe
  C:\Windows\System\Palpcmd.exe
  2⤵
  PID:5824
- C:\Windows\System\AjTPqCw.exe
  C:\Windows\System\AjTPqCw.exe
  2⤵
  PID:5856
- C:\Windows\System\xXbSNDP.exe
  C:\Windows\System\xXbSNDP.exe
  2⤵
  PID:3348
- C:\Windows\System\DwlqXGv.exe
  C:\Windows\System\DwlqXGv.exe
  2⤵
  PID:5916
- C:\Windows\System\tnVnZyw.exe
  C:\Windows\System\tnVnZyw.exe
  2⤵
  PID:5884
- C:\Windows\System\UyHCGSG.exe
  C:\Windows\System\UyHCGSG.exe
  2⤵
  PID:6020
- C:\Windows\System\itAlHRE.exe
  C:\Windows\System\itAlHRE.exe
  2⤵
  PID:6036
- C:\Windows\System\iIKSDUL.exe
  C:\Windows\System\iIKSDUL.exe
  2⤵
  PID:5936
- C:\Windows\System\cNTTxrm.exe
  C:\Windows\System\cNTTxrm.exe
  2⤵
  PID:6000
- C:\Windows\System\skmzjxZ.exe
  C:\Windows\System\skmzjxZ.exe
  2⤵
  PID:6088
- C:\Windows\System\jQiqCjs.exe
  C:\Windows\System\jQiqCjs.exe
  2⤵
  PID:6080
- C:\Windows\System\jrxrWmn.exe
  C:\Windows\System\jrxrWmn.exe
  2⤵
  PID:6116
- C:\Windows\System\Ycmrzib.exe
  C:\Windows\System\Ycmrzib.exe
  2⤵
  PID:6104
- C:\Windows\System\iqoDWro.exe
  C:\Windows\System\iqoDWro.exe
  2⤵
  PID:4328
- C:\Windows\System\WyNOZSF.exe
  C:\Windows\System\WyNOZSF.exe
  2⤵
  PID:4940
- C:\Windows\System\nQZdCBT.exe
  C:\Windows\System\nQZdCBT.exe
  2⤵
  PID:5124
- C:\Windows\System\iVQHBoR.exe
  C:\Windows\System\iVQHBoR.exe
  2⤵
  PID:5160
- C:\Windows\System\TuYKEYp.exe
  C:\Windows\System\TuYKEYp.exe
  2⤵
  PID:5296
- C:\Windows\System\KoaNaJQ.exe
  C:\Windows\System\KoaNaJQ.exe
  2⤵
  PID:5324
- C:\Windows\System\dToezXG.exe
  C:\Windows\System\dToezXG.exe
  2⤵
  PID:4476
- C:\Windows\System\QWZvuDk.exe
  C:\Windows\System\QWZvuDk.exe
  2⤵
  PID:5344
- C:\Windows\System\EKhxreE.exe
  C:\Windows\System\EKhxreE.exe
  2⤵
  PID:4924
- C:\Windows\System\XtNKZMv.exe
  C:\Windows\System\XtNKZMv.exe
  2⤵
  PID:5808
- C:\Windows\System\waxahFg.exe
  C:\Windows\System\waxahFg.exe
  2⤵
  PID:5244
- C:\Windows\System\zmCjkWB.exe
  C:\Windows\System\zmCjkWB.exe
  2⤵
  PID:5468
- C:\Windows\System\ymokYZQ.exe
  C:\Windows\System\ymokYZQ.exe
  2⤵
  PID:5516
- C:\Windows\System\jNuwRhQ.exe
  C:\Windows\System\jNuwRhQ.exe
  2⤵
  PID:5648
- C:\Windows\System\pVsdzrN.exe
  C:\Windows\System\pVsdzrN.exe
  2⤵
  PID:5520
- C:\Windows\System\ZZChIOQ.exe
  C:\Windows\System\ZZChIOQ.exe
  2⤵
  PID:5652
- C:\Windows\System\xzDLKSI.exe
  C:\Windows\System\xzDLKSI.exe
  2⤵
  PID:5716
- C:\Windows\System\qHlxZoz.exe
  C:\Windows\System\qHlxZoz.exe
  2⤵
  PID:5768
- C:\Windows\System\EKzizBM.exe
  C:\Windows\System\EKzizBM.exe
  2⤵
  PID:5780
- C:\Windows\System\kUmvHTr.exe
  C:\Windows\System\kUmvHTr.exe
  2⤵
  PID:5784
- C:\Windows\System\bOjxKCj.exe
  C:\Windows\System\bOjxKCj.exe
  2⤵
  PID:5828
- C:\Windows\System\TcaUdTg.exe
  C:\Windows\System\TcaUdTg.exe
  2⤵
  PID:5832
- C:\Windows\System\XxJipkQ.exe
  C:\Windows\System\XxJipkQ.exe
  2⤵
  PID:5956
- C:\Windows\System\xOzbPMf.exe
  C:\Windows\System\xOzbPMf.exe
  2⤵
  PID:5932
- C:\Windows\System\EOpelHO.exe
  C:\Windows\System\EOpelHO.exe
  2⤵
  PID:6032
- C:\Windows\System\zgAtQMw.exe
  C:\Windows\System\zgAtQMw.exe
  2⤵
  PID:6100
- C:\Windows\System\MyAJjGZ.exe
  C:\Windows\System\MyAJjGZ.exe
  2⤵
  PID:6140
- C:\Windows\System\JTqbzeO.exe
  C:\Windows\System\JTqbzeO.exe
  2⤵
  PID:4688
- C:\Windows\System\PVcTFJI.exe
  C:\Windows\System\PVcTFJI.exe
  2⤵
  PID:4376
- C:\Windows\System\fTMMLQw.exe
  C:\Windows\System\fTMMLQw.exe
  2⤵
  PID:5700
- C:\Windows\System\HiBcgcp.exe
  C:\Windows\System\HiBcgcp.exe
  2⤵
  PID:5072
- C:\Windows\System\jxCuFGP.exe
  C:\Windows\System\jxCuFGP.exe
  2⤵
  PID:5504
- C:\Windows\System\kTrROJz.exe
  C:\Windows\System\kTrROJz.exe
  2⤵
  PID:1976
- C:\Windows\System\UZvFSxY.exe
  C:\Windows\System\UZvFSxY.exe
  2⤵
  PID:5176
- C:\Windows\System\iAXrpbq.exe
  C:\Windows\System\iAXrpbq.exe
  2⤵
  PID:5580
- C:\Windows\System\qJuTBUF.exe
  C:\Windows\System\qJuTBUF.exe
  2⤵
  PID:5480
- C:\Windows\System\CHyFLJu.exe
  C:\Windows\System\CHyFLJu.exe
  2⤵
  PID:5732
- C:\Windows\System\rUqTXea.exe
  C:\Windows\System\rUqTXea.exe
  2⤵
  PID:5860
- C:\Windows\System\jzkQtFA.exe
  C:\Windows\System\jzkQtFA.exe
  2⤵
  PID:5972
- C:\Windows\System\ziHeNbA.exe
  C:\Windows\System\ziHeNbA.exe
  2⤵
  PID:5132
- C:\Windows\System\JpdkQIb.exe
  C:\Windows\System\JpdkQIb.exe
  2⤵
  PID:5460
- C:\Windows\System\aKrOMCF.exe
  C:\Windows\System\aKrOMCF.exe
  2⤵
  PID:5748
- C:\Windows\System\oZVEptc.exe
  C:\Windows\System\oZVEptc.exe
  2⤵
  PID:4268
- C:\Windows\System\lGRsZdE.exe
  C:\Windows\System\lGRsZdE.exe
  2⤵
  PID:5888
- C:\Windows\System\GPZDGGR.exe
  C:\Windows\System\GPZDGGR.exe
  2⤵
  PID:5984
- C:\Windows\System\DmvwbSX.exe
  C:\Windows\System\DmvwbSX.exe
  2⤵
  PID:4152
- C:\Windows\System\WwYGULY.exe
  C:\Windows\System\WwYGULY.exe
  2⤵
  PID:6160
- C:\Windows\System\TxqGLZj.exe
  C:\Windows\System\TxqGLZj.exe
  2⤵
  PID:6176
- C:\Windows\System\XtEjTRI.exe
  C:\Windows\System\XtEjTRI.exe
  2⤵
  PID:6192
- C:\Windows\System\HMalILi.exe
  C:\Windows\System\HMalILi.exe
  2⤵
  PID:6208
- C:\Windows\System\uLgXMsJ.exe
  C:\Windows\System\uLgXMsJ.exe
  2⤵
  PID:6224
- C:\Windows\System\nVRAQdY.exe
  C:\Windows\System\nVRAQdY.exe
  2⤵
  PID:6240
- C:\Windows\System\PmDdSjq.exe
  C:\Windows\System\PmDdSjq.exe
  2⤵
  PID:6256
- C:\Windows\System\wkMiQmE.exe
  C:\Windows\System\wkMiQmE.exe
  2⤵
  PID:6272
- C:\Windows\System\pWMWiAq.exe
  C:\Windows\System\pWMWiAq.exe
  2⤵
  PID:6288
- C:\Windows\System\eCLUXpR.exe
  C:\Windows\System\eCLUXpR.exe
  2⤵
  PID:6304
- C:\Windows\System\bxtlGCm.exe
  C:\Windows\System\bxtlGCm.exe
  2⤵
  PID:6320
- C:\Windows\System\bEZmfWl.exe
  C:\Windows\System\bEZmfWl.exe
  2⤵
  PID:6336
- C:\Windows\System\LAFouvV.exe
  C:\Windows\System\LAFouvV.exe
  2⤵
  PID:6352
- C:\Windows\System\SkWxyaQ.exe
  C:\Windows\System\SkWxyaQ.exe
  2⤵
  PID:6368
- C:\Windows\System\dxvWDNU.exe
  C:\Windows\System\dxvWDNU.exe
  2⤵
  PID:6384
- C:\Windows\System\GkEXExm.exe
  C:\Windows\System\GkEXExm.exe
  2⤵
  PID:6400
- C:\Windows\System\xJhdMNf.exe
  C:\Windows\System\xJhdMNf.exe
  2⤵
  PID:6416
- C:\Windows\System\rKIzEEe.exe
  C:\Windows\System\rKIzEEe.exe
  2⤵
  PID:6432
- C:\Windows\System\upDmexS.exe
  C:\Windows\System\upDmexS.exe
  2⤵
  PID:6460
- C:\Windows\System\BJGjPZp.exe
  C:\Windows\System\BJGjPZp.exe
  2⤵
  PID:6476
- C:\Windows\System\zlyEyqW.exe
  C:\Windows\System\zlyEyqW.exe
  2⤵
  PID:6496
- C:\Windows\System\LKmMGPi.exe
  C:\Windows\System\LKmMGPi.exe
  2⤵
  PID:6512
- C:\Windows\System\pAhLzLY.exe
  C:\Windows\System\pAhLzLY.exe
  2⤵
  PID:6620
- C:\Windows\System\NGMXpPy.exe
  C:\Windows\System\NGMXpPy.exe
  2⤵
  PID:6636
- C:\Windows\System\BoqlVHl.exe
  C:\Windows\System\BoqlVHl.exe
  2⤵
  PID:6652
- C:\Windows\System\DqyJhZZ.exe
  C:\Windows\System\DqyJhZZ.exe
  2⤵
  PID:6668
- C:\Windows\System\utuwulc.exe
  C:\Windows\System\utuwulc.exe
  2⤵
  PID:6684
- C:\Windows\System\cnSGQPQ.exe
  C:\Windows\System\cnSGQPQ.exe
  2⤵
  PID:6872
- C:\Windows\System\CqmgNSs.exe
  C:\Windows\System\CqmgNSs.exe
  2⤵
  PID:6888
- C:\Windows\System\BerORFM.exe
  C:\Windows\System\BerORFM.exe
  2⤵
  PID:6904
- C:\Windows\System\XNnHxuZ.exe
  C:\Windows\System\XNnHxuZ.exe
  2⤵
  PID:6920
- C:\Windows\System\ofePgUh.exe
  C:\Windows\System\ofePgUh.exe
  2⤵
  PID:6936
- C:\Windows\System\cphsFCI.exe
  C:\Windows\System\cphsFCI.exe
  2⤵
  PID:6952
- C:\Windows\System\AnyJqas.exe
  C:\Windows\System\AnyJqas.exe
  2⤵
  PID:6968
- C:\Windows\System\FIPeWYb.exe
  C:\Windows\System\FIPeWYb.exe
  2⤵
  PID:6984
- C:\Windows\System\BuvSlZd.exe
  C:\Windows\System\BuvSlZd.exe
  2⤵
  PID:7000
- C:\Windows\System\LakdvTP.exe
  C:\Windows\System\LakdvTP.exe
  2⤵
  PID:7016
- C:\Windows\System\IhQgboI.exe
  C:\Windows\System\IhQgboI.exe
  2⤵
  PID:7032
- C:\Windows\System\uEDjbUd.exe
  C:\Windows\System\uEDjbUd.exe
  2⤵
  PID:7048
- C:\Windows\System\ktKFWTO.exe
  C:\Windows\System\ktKFWTO.exe
  2⤵
  PID:7064
- C:\Windows\System\GgLGyrt.exe
  C:\Windows\System\GgLGyrt.exe
  2⤵
  PID:7080
- C:\Windows\System\CBsUFOs.exe
  C:\Windows\System\CBsUFOs.exe
  2⤵
  PID:7096
- C:\Windows\System\zjIMBnp.exe
  C:\Windows\System\zjIMBnp.exe
  2⤵
  PID:7112
- C:\Windows\System\lhQRcdJ.exe
  C:\Windows\System\lhQRcdJ.exe
  2⤵
  PID:7128
- C:\Windows\System\gvsNuHg.exe
  C:\Windows\System\gvsNuHg.exe
  2⤵
  PID:7144
- C:\Windows\System\JTllWPp.exe
  C:\Windows\System\JTllWPp.exe
  2⤵
  PID:7160
- C:\Windows\System\HmHoYmN.exe
  C:\Windows\System\HmHoYmN.exe
  2⤵
  PID:5148
- C:\Windows\System\mNcUdSO.exe
  C:\Windows\System\mNcUdSO.exe
  2⤵
  PID:5788
- C:\Windows\System\YnrEWHl.exe
  C:\Windows\System\YnrEWHl.exe
  2⤵
  PID:6108
- C:\Windows\System\IoxIiGn.exe
  C:\Windows\System\IoxIiGn.exe
  2⤵
  PID:5260
- C:\Windows\System\GTSAYQl.exe
  C:\Windows\System\GTSAYQl.exe
  2⤵
  PID:6168
- C:\Windows\System\hVFfEyn.exe
  C:\Windows\System\hVFfEyn.exe
  2⤵
  PID:5764
- C:\Windows\System\HMKyqoA.exe
  C:\Windows\System\HMKyqoA.exe
  2⤵
  PID:6248
- C:\Windows\System\ScurLSZ.exe
  C:\Windows\System\ScurLSZ.exe
  2⤵
  PID:5008
- C:\Windows\System\IkCdIns.exe
  C:\Windows\System\IkCdIns.exe
  2⤵
  PID:4424
- C:\Windows\System\AKreZxp.exe
  C:\Windows\System\AKreZxp.exe
  2⤵
  PID:6236
- C:\Windows\System\owiQJmc.exe
  C:\Windows\System\owiQJmc.exe
  2⤵
  PID:6264
- C:\Windows\System\GyaICZc.exe
  C:\Windows\System\GyaICZc.exe
  2⤵
  PID:6316
- C:\Windows\System\aKIKPyz.exe
  C:\Windows\System\aKIKPyz.exe
  2⤵
  PID:6408
- C:\Windows\System\fvXdgxe.exe
  C:\Windows\System\fvXdgxe.exe
  2⤵
  PID:6328
- C:\Windows\System\ghnHAIo.exe
  C:\Windows\System\ghnHAIo.exe
  2⤵
  PID:6392
- C:\Windows\System\wbdnhxh.exe
  C:\Windows\System\wbdnhxh.exe
  2⤵
  PID:6452
- C:\Windows\System\yYcMSqo.exe
  C:\Windows\System\yYcMSqo.exe
  2⤵
  PID:6472
- C:\Windows\System\DelefkH.exe
  C:\Windows\System\DelefkH.exe
  2⤵
  PID:6484
- C:\Windows\System\dPfMXOK.exe
  C:\Windows\System\dPfMXOK.exe
  2⤵
  PID:6536
- C:\Windows\System\Fsnntsd.exe
  C:\Windows\System\Fsnntsd.exe
  2⤵
  PID:6692
- C:\Windows\System\QBcsNoJ.exe
  C:\Windows\System\QBcsNoJ.exe
  2⤵
  PID:6676
- C:\Windows\System\EQaDXrb.exe
  C:\Windows\System\EQaDXrb.exe
  2⤵
  PID:6720
- C:\Windows\System\yqrRczo.exe
  C:\Windows\System\yqrRczo.exe
  2⤵
  PID:6736
- C:\Windows\System\CwdwlhU.exe
  C:\Windows\System\CwdwlhU.exe
  2⤵
  PID:6756
- C:\Windows\System\nsWLQVQ.exe
  C:\Windows\System\nsWLQVQ.exe
  2⤵
  PID:6780
- C:\Windows\System\iOlAPzr.exe
  C:\Windows\System\iOlAPzr.exe
  2⤵
  PID:6800
- C:\Windows\System\WNqCCJA.exe
  C:\Windows\System\WNqCCJA.exe
  2⤵
  PID:6812
- C:\Windows\System\YQHFfYT.exe
  C:\Windows\System\YQHFfYT.exe
  2⤵
  PID:6828
- C:\Windows\System\FcOCapI.exe
  C:\Windows\System\FcOCapI.exe
  2⤵
  PID:6852
- C:\Windows\System\xpHShch.exe
  C:\Windows\System\xpHShch.exe
  2⤵
  PID:6848
- C:\Windows\System\ZqaCffR.exe
  C:\Windows\System\ZqaCffR.exe
  2⤵
  PID:6944
- C:\Windows\System\ooBrEsU.exe
  C:\Windows\System\ooBrEsU.exe
  2⤵
  PID:7008
- C:\Windows\System\PPnRqpr.exe
  C:\Windows\System\PPnRqpr.exe
  2⤵
  PID:7072
- C:\Windows\System\FACyKWC.exe
  C:\Windows\System\FACyKWC.exe
  2⤵
  PID:7136
- C:\Windows\System\mQwviSx.exe
  C:\Windows\System\mQwviSx.exe
  2⤵
  PID:6188
- C:\Windows\System\vXsWJvw.exe
  C:\Windows\System\vXsWJvw.exe
  2⤵
  PID:5584
- C:\Windows\System\NJadFqy.exe
  C:\Windows\System\NJadFqy.exe
  2⤵
  PID:6268
- C:\Windows\System\AipLBcF.exe
  C:\Windows\System\AipLBcF.exe
  2⤵
  PID:5668
- C:\Windows\System\LHorUMQ.exe
  C:\Windows\System\LHorUMQ.exe
  2⤵
  PID:5900
- C:\Windows\System\iXUWYUp.exe
  C:\Windows\System\iXUWYUp.exe
  2⤵
  PID:7124
- C:\Windows\System\oUYfxJT.exe
  C:\Windows\System\oUYfxJT.exe
  2⤵
  PID:6964
- C:\Windows\System\rldKhkS.exe
  C:\Windows\System\rldKhkS.exe
  2⤵
  PID:6068
- C:\Windows\System\PqDtfBt.exe
  C:\Windows\System\PqDtfBt.exe
  2⤵
  PID:7120
- C:\Windows\System\aFIWfrt.exe
  C:\Windows\System\aFIWfrt.exe
  2⤵
  PID:7024
- C:\Windows\System\CMvVdXi.exe
  C:\Windows\System\CMvVdXi.exe
  2⤵
  PID:6428
- C:\Windows\System\didxRuN.exe
  C:\Windows\System\didxRuN.exe
  2⤵
  PID:6532
- C:\Windows\System\prMFPza.exe
  C:\Windows\System\prMFPza.exe
  2⤵
  PID:6492
- C:\Windows\System\aLnZHTV.exe
  C:\Windows\System\aLnZHTV.exe
  2⤵
  PID:6560
- C:\Windows\System\aDAtFgK.exe
  C:\Windows\System\aDAtFgK.exe
  2⤵
  PID:6568
- C:\Windows\System\LtOArtA.exe
  C:\Windows\System\LtOArtA.exe
  2⤵
  PID:6584
- C:\Windows\System\hdythUN.exe
  C:\Windows\System\hdythUN.exe
  2⤵
  PID:6600
- C:\Windows\System\YfQQPfM.exe
  C:\Windows\System\YfQQPfM.exe
  2⤵
  PID:6616
- C:\Windows\System\gtLvSZc.exe
  C:\Windows\System\gtLvSZc.exe
  2⤵
  PID:6700
- C:\Windows\System\JCzRTPr.exe
  C:\Windows\System\JCzRTPr.exe
  2⤵
  PID:6644
- C:\Windows\System\jPWmJOe.exe
  C:\Windows\System\jPWmJOe.exe
  2⤵
  PID:6444
- C:\Windows\System\OiNvlEf.exe
  C:\Windows\System\OiNvlEf.exe
  2⤵
  PID:6884
- C:\Windows\System\OBIgHiP.exe
  C:\Windows\System\OBIgHiP.exe
  2⤵
  PID:6868
- C:\Windows\System\jjrIURd.exe
  C:\Windows\System\jjrIURd.exe
  2⤵
  PID:6232
- C:\Windows\System\omybRhv.exe
  C:\Windows\System\omybRhv.exe
  2⤵
  PID:6204
- C:\Windows\System\wOOInNl.exe
  C:\Windows\System\wOOInNl.exe
  2⤵
  PID:5340
- C:\Windows\System\IUDnyZK.exe
  C:\Windows\System\IUDnyZK.exe
  2⤵
  PID:7152
- C:\Windows\System\cKyozzM.exe
  C:\Windows\System\cKyozzM.exe
  2⤵
  PID:6508
- C:\Windows\System\semkfVG.exe
  C:\Windows\System\semkfVG.exe
  2⤵
  PID:6592
- C:\Windows\System\LmEYOKV.exe
  C:\Windows\System\LmEYOKV.exe
  2⤵
  PID:6664
- C:\Windows\System\TyTETYC.exe
  C:\Windows\System\TyTETYC.exe
  2⤵
  PID:7044
- C:\Windows\System\gPkRoJx.exe
  C:\Windows\System\gPkRoJx.exe
  2⤵
  PID:5240
- C:\Windows\System\UjYCRji.exe
  C:\Windows\System\UjYCRji.exe
  2⤵
  PID:6764
- C:\Windows\System\WuatJzv.exe
  C:\Windows\System\WuatJzv.exe
  2⤵
  PID:7180
- C:\Windows\System\mPZMSWO.exe
  C:\Windows\System\mPZMSWO.exe
  2⤵
  PID:7196
- C:\Windows\System\fjYBhod.exe
  C:\Windows\System\fjYBhod.exe
  2⤵
  PID:7212
- C:\Windows\System\UOHsymC.exe
  C:\Windows\System\UOHsymC.exe
  2⤵
  PID:7228
- C:\Windows\System\pDygyyy.exe
  C:\Windows\System\pDygyyy.exe
  2⤵
  PID:7248
- C:\Windows\System\kTIZLqz.exe
  C:\Windows\System\kTIZLqz.exe
  2⤵
  PID:7264
- C:\Windows\System\jhcJDXm.exe
  C:\Windows\System\jhcJDXm.exe
  2⤵
  PID:7280
- C:\Windows\System\DyvRSFx.exe
  C:\Windows\System\DyvRSFx.exe
  2⤵
  PID:7300
- C:\Windows\System\tvbcZzQ.exe
  C:\Windows\System\tvbcZzQ.exe
  2⤵
  PID:7320
- C:\Windows\System\mfXijfM.exe
  C:\Windows\System\mfXijfM.exe
  2⤵
  PID:7336
- C:\Windows\System\YJdMfsS.exe
  C:\Windows\System\YJdMfsS.exe
  2⤵
  PID:7352
- C:\Windows\System\QACaOMJ.exe
  C:\Windows\System\QACaOMJ.exe
  2⤵
  PID:7368
- C:\Windows\System\DDkIdjW.exe
  C:\Windows\System\DDkIdjW.exe
  2⤵
  PID:7384
- C:\Windows\System\XTuPRme.exe
  C:\Windows\System\XTuPRme.exe
  2⤵
  PID:7400
- C:\Windows\System\teeFiUY.exe
  C:\Windows\System\teeFiUY.exe
  2⤵
  PID:7416
- C:\Windows\System\VZqknvN.exe
  C:\Windows\System\VZqknvN.exe
  2⤵
  PID:7432
- C:\Windows\System\fhVLpeH.exe
  C:\Windows\System\fhVLpeH.exe
  2⤵
  PID:7448
- C:\Windows\System\AqERjyL.exe
  C:\Windows\System\AqERjyL.exe
  2⤵
  PID:7464
- C:\Windows\System\KhiEYGb.exe
  C:\Windows\System\KhiEYGb.exe
  2⤵
  PID:7564
- C:\Windows\System\KqFCkJD.exe
  C:\Windows\System\KqFCkJD.exe
  2⤵
  PID:7608
- C:\Windows\System\fvJRTAW.exe
  C:\Windows\System\fvJRTAW.exe
  2⤵
  PID:7624
- C:\Windows\System\HLebBCG.exe
  C:\Windows\System\HLebBCG.exe
  2⤵
  PID:7780
- C:\Windows\System\fMdMUWo.exe
  C:\Windows\System\fMdMUWo.exe
  2⤵
  PID:7796
- C:\Windows\System\lYtwXTX.exe
  C:\Windows\System\lYtwXTX.exe
  2⤵
  PID:7812
- C:\Windows\System\bwoQqHb.exe
  C:\Windows\System\bwoQqHb.exe
  2⤵
  PID:7832
- C:\Windows\System\VjXkDqw.exe
  C:\Windows\System\VjXkDqw.exe
  2⤵
  PID:7848
- C:\Windows\System\oITxhKw.exe
  C:\Windows\System\oITxhKw.exe
  2⤵
  PID:7864
- C:\Windows\System\MKALAqi.exe
  C:\Windows\System\MKALAqi.exe
  2⤵
  PID:7880
- C:\Windows\System\gzQbqQB.exe
  C:\Windows\System\gzQbqQB.exe
  2⤵
  PID:7896
- C:\Windows\System\OvwPDxC.exe
  C:\Windows\System\OvwPDxC.exe
  2⤵
  PID:7912
- C:\Windows\System\GgXldEw.exe
  C:\Windows\System\GgXldEw.exe
  2⤵
  PID:7928
- C:\Windows\System\RaPTJKh.exe
  C:\Windows\System\RaPTJKh.exe
  2⤵
  PID:7944
- C:\Windows\System\LBScQyJ.exe
  C:\Windows\System\LBScQyJ.exe
  2⤵
  PID:7960
- C:\Windows\System\KpVOypv.exe
  C:\Windows\System\KpVOypv.exe
  2⤵
  PID:7984
- C:\Windows\System\ctxKFcB.exe
  C:\Windows\System\ctxKFcB.exe
  2⤵
  PID:8000
- C:\Windows\System\Igzdpuq.exe
  C:\Windows\System\Igzdpuq.exe
  2⤵
  PID:8020
- C:\Windows\System\UQlCfDR.exe
  C:\Windows\System\UQlCfDR.exe
  2⤵
  PID:8036
- C:\Windows\System\rWRDqEx.exe
  C:\Windows\System\rWRDqEx.exe
  2⤵
  PID:8052
- C:\Windows\System\PAubhec.exe
  C:\Windows\System\PAubhec.exe
  2⤵
  PID:8068
- C:\Windows\System\sUoCqFs.exe
  C:\Windows\System\sUoCqFs.exe
  2⤵
  PID:8084
- C:\Windows\System\hhsCjlN.exe
  C:\Windows\System\hhsCjlN.exe
  2⤵
  PID:8100
- C:\Windows\System\BrAHiCm.exe
  C:\Windows\System\BrAHiCm.exe
  2⤵
  PID:8116
- C:\Windows\System\fwSGmda.exe
  C:\Windows\System\fwSGmda.exe
  2⤵
  PID:8132
- C:\Windows\System\IjImERh.exe
  C:\Windows\System\IjImERh.exe
  2⤵
  PID:8148
- C:\Windows\System\aIuGSLg.exe
  C:\Windows\System\aIuGSLg.exe
  2⤵
  PID:8164
- C:\Windows\System\gPyDPeO.exe
  C:\Windows\System\gPyDPeO.exe
  2⤵
  PID:8180
- C:\Windows\System\xjxuMQA.exe
  C:\Windows\System\xjxuMQA.exe
  2⤵
  PID:6564
- C:\Windows\System\FWjcVwX.exe
  C:\Windows\System\FWjcVwX.exe
  2⤵
  PID:7224
- C:\Windows\System\AhTijPT.exe
  C:\Windows\System\AhTijPT.exe
  2⤵
  PID:7292
- C:\Windows\System\pGnhWnb.exe
  C:\Windows\System\pGnhWnb.exe
  2⤵
  PID:7360
- C:\Windows\System\VJIEfYV.exe
  C:\Windows\System\VJIEfYV.exe
  2⤵
  PID:7424
- C:\Windows\System\vXavBRs.exe
  C:\Windows\System\vXavBRs.exe
  2⤵
  PID:6776
- C:\Windows\System\vMzbDVU.exe
  C:\Windows\System\vMzbDVU.exe
  2⤵
  PID:6900
- C:\Windows\System\nzrAFPI.exe
  C:\Windows\System\nzrAFPI.exe
  2⤵
  PID:6708
- C:\Windows\System\lNXPGdG.exe
  C:\Windows\System\lNXPGdG.exe
  2⤵
  PID:6632
- C:\Windows\System\pZUuUkr.exe
  C:\Windows\System\pZUuUkr.exe
  2⤵
  PID:7236
- C:\Windows\System\XxOrXoa.exe
  C:\Windows\System\XxOrXoa.exe
  2⤵
  PID:7408
- C:\Windows\System\QVyPDlg.exe
  C:\Windows\System\QVyPDlg.exe
  2⤵
  PID:7500
- C:\Windows\System\zUlrRFw.exe
  C:\Windows\System\zUlrRFw.exe
  2⤵
  PID:6284
- C:\Windows\System\BDhmqek.exe
  C:\Windows\System\BDhmqek.exe
  2⤵
  PID:6744
- C:\Windows\System\ReqMDbX.exe
  C:\Windows\System\ReqMDbX.exe
  2⤵
  PID:6792
- C:\Windows\System\IABovGe.exe
  C:\Windows\System\IABovGe.exe
  2⤵
  PID:6980
- C:\Windows\System\odrrDDV.exe
  C:\Windows\System\odrrDDV.exe
  2⤵
  PID:5616
- C:\Windows\System\TMFcsOg.exe
  C:\Windows\System\TMFcsOg.exe
  2⤵
  PID:6412
- C:\Windows\System\NhJcEDu.exe
  C:\Windows\System\NhJcEDu.exe
  2⤵
  PID:6580
- C:\Windows\System\xzsNtzs.exe
  C:\Windows\System\xzsNtzs.exe
  2⤵
  PID:6840
- C:\Windows\System\RjliARS.exe
  C:\Windows\System\RjliARS.exe
  2⤵
  PID:6312
- C:\Windows\System\pCNSInL.exe
  C:\Windows\System\pCNSInL.exe
  2⤵
  PID:7276
- C:\Windows\System\urFCxop.exe
  C:\Windows\System\urFCxop.exe
  2⤵
  PID:7344
- C:\Windows\System\zELwhhp.exe
  C:\Windows\System\zELwhhp.exe
  2⤵
  PID:7412
- C:\Windows\System\sEpqJWN.exe
  C:\Windows\System\sEpqJWN.exe
  2⤵
  PID:7480
- C:\Windows\System\FUsyfat.exe
  C:\Windows\System\FUsyfat.exe
  2⤵
  PID:7512
- C:\Windows\System\xHqcLVQ.exe
  C:\Windows\System\xHqcLVQ.exe
  2⤵
  PID:7528
- C:\Windows\System\AwyqklW.exe
  C:\Windows\System\AwyqklW.exe
  2⤵
  PID:7544
- C:\Windows\System\XisxxLj.exe
  C:\Windows\System\XisxxLj.exe
  2⤵
  PID:7632
- C:\Windows\System\qMPwOXh.exe
  C:\Windows\System\qMPwOXh.exe
  2⤵
  PID:7592
- C:\Windows\System\EIQpaAi.exe
  C:\Windows\System\EIQpaAi.exe
  2⤵
  PID:7616
- C:\Windows\System\AQtOLKR.exe
  C:\Windows\System\AQtOLKR.exe
  2⤵
  PID:7664
- C:\Windows\System\ejDlXCr.exe
  C:\Windows\System\ejDlXCr.exe
  2⤵
  PID:7648
- C:\Windows\System\IcZpfOK.exe
  C:\Windows\System\IcZpfOK.exe
  2⤵
  PID:7640
- C:\Windows\System\pEtXEJI.exe
  C:\Windows\System\pEtXEJI.exe
  2⤵
  PID:7676
- C:\Windows\System\vjYcaRa.exe
  C:\Windows\System\vjYcaRa.exe
  2⤵
  PID:7688
- C:\Windows\System\pllpQNa.exe
  C:\Windows\System\pllpQNa.exe
  2⤵
  PID:7720
- C:\Windows\System\mFHKSkq.exe
  C:\Windows\System\mFHKSkq.exe
  2⤵
  PID:7736
- C:\Windows\System\jvwQNwV.exe
  C:\Windows\System\jvwQNwV.exe
  2⤵
  PID:7748
- C:\Windows\System\kJnTYcX.exe
  C:\Windows\System\kJnTYcX.exe
  2⤵
  PID:7764
- C:\Windows\System\eyIAEbe.exe
  C:\Windows\System\eyIAEbe.exe
  2⤵
  PID:7824
- C:\Windows\System\bzyzUcL.exe
  C:\Windows\System\bzyzUcL.exe
  2⤵
  PID:7804
- C:\Windows\System\KHzrbug.exe
  C:\Windows\System\KHzrbug.exe
  2⤵
  PID:7840
- C:\Windows\System\QGcHNZJ.exe
  C:\Windows\System\QGcHNZJ.exe
  2⤵
  PID:7956
- C:\Windows\System\ElVjwwv.exe
  C:\Windows\System\ElVjwwv.exe
  2⤵
  PID:7892
- C:\Windows\System\cIhqfpG.exe
  C:\Windows\System\cIhqfpG.exe
  2⤵
  PID:7992
- C:\Windows\System\qHSklDQ.exe
  C:\Windows\System\qHSklDQ.exe
  2⤵
  PID:8124
- C:\Windows\System\JmqvPZw.exe
  C:\Windows\System\JmqvPZw.exe
  2⤵
  PID:7904
- C:\Windows\System\ewISBVI.exe
  C:\Windows\System\ewISBVI.exe
  2⤵
  PID:7936
- C:\Windows\System\LtFgdLX.exe
  C:\Windows\System\LtFgdLX.exe
  2⤵
  PID:7976
- C:\Windows\System\EiOlRAv.exe
  C:\Windows\System\EiOlRAv.exe
  2⤵
  PID:8044
- C:\Windows\System\ChDYPqS.exe
  C:\Windows\System\ChDYPqS.exe
  2⤵
  PID:8108
- C:\Windows\System\JzecMjM.exe
  C:\Windows\System\JzecMjM.exe
  2⤵
  PID:8176
- C:\Windows\System\GnkCUXD.exe
  C:\Windows\System\GnkCUXD.exe
  2⤵
  PID:7392
- C:\Windows\System\JKyzPkr.exe
  C:\Windows\System\JKyzPkr.exe
  2⤵
  PID:6128
- C:\Windows\System\kWrlBjb.exe
  C:\Windows\System\kWrlBjb.exe
  2⤵
  PID:7308
- C:\Windows\System\efbgqvc.exe
  C:\Windows\System\efbgqvc.exe
  2⤵
  PID:7456
- C:\Windows\System\seFFNHw.exe
  C:\Windows\System\seFFNHw.exe
  2⤵
  PID:6648
- C:\Windows\System\KQRmPrU.exe
  C:\Windows\System\KQRmPrU.exe
  2⤵
  PID:7380
- C:\Windows\System\HSNTHEM.exe
  C:\Windows\System\HSNTHEM.exe
  2⤵
  PID:7396
- C:\Windows\System\qkAncMW.exe
  C:\Windows\System\qkAncMW.exe
  2⤵
  PID:7536
- C:\Windows\System\LEKWMev.exe
  C:\Windows\System\LEKWMev.exe
  2⤵
  PID:3992
- C:\Windows\System\EEZJdwM.exe
  C:\Windows\System\EEZJdwM.exe
  2⤵
  PID:7584
- C:\Windows\System\keqbAIq.exe
  C:\Windows\System\keqbAIq.exe
  2⤵
  PID:6820
- C:\Windows\System\JxkscFS.exe
  C:\Windows\System\JxkscFS.exe
  2⤵
  PID:7552
- C:\Windows\System\ozUzqbH.exe
  C:\Windows\System\ozUzqbH.exe
  2⤵
  PID:6844
- C:\Windows\System\aOkPJwW.exe
  C:\Windows\System\aOkPJwW.exe
  2⤵
  PID:7520
- C:\Windows\System\ZjiMLcE.exe
  C:\Windows\System\ZjiMLcE.exe
  2⤵
  PID:7684
- C:\Windows\System\yubuDlC.exe
  C:\Windows\System\yubuDlC.exe
  2⤵
  PID:6824
- C:\Windows\System\oQonRLv.exe
  C:\Windows\System\oQonRLv.exe
  2⤵
  PID:7696
- C:\Windows\System\yxvQBpi.exe
  C:\Windows\System\yxvQBpi.exe
  2⤵
  PID:6976
- C:\Windows\System\kkzPydR.exe
  C:\Windows\System\kkzPydR.exe
  2⤵
  PID:7672
- C:\Windows\System\eTucazJ.exe
  C:\Windows\System\eTucazJ.exe
  2⤵
  PID:7856
- C:\Windows\System\MANtzWM.exe
  C:\Windows\System\MANtzWM.exe
  2⤵
  PID:7872
- C:\Windows\System\jachmDC.exe
  C:\Windows\System\jachmDC.exe
  2⤵
  PID:7788
- C:\Windows\System\OPwxVrw.exe
  C:\Windows\System\OPwxVrw.exe
  2⤵
  PID:7792
- C:\Windows\System\KQdtafj.exe
  C:\Windows\System\KQdtafj.exe
  2⤵
  PID:8032
- C:\Windows\System\rymvpYu.exe
  C:\Windows\System\rymvpYu.exe
  2⤵
  PID:6556
- C:\Windows\System\YGkptbT.exe
  C:\Windows\System\YGkptbT.exe
  2⤵
  PID:7972
- C:\Windows\System\mvwOvta.exe
  C:\Windows\System\mvwOvta.exe
  2⤵
  PID:8172
- C:\Windows\System\nvCSvbE.exe
  C:\Windows\System\nvCSvbE.exe
  2⤵
  PID:6864
- C:\Windows\System\sZRIkXB.exe
  C:\Windows\System\sZRIkXB.exe
  2⤵
  PID:7492
- C:\Windows\System\ADRXhky.exe
  C:\Windows\System\ADRXhky.exe
  2⤵
  PID:7484
- C:\Windows\System\aHuLsFA.exe
  C:\Windows\System\aHuLsFA.exe
  2⤵
  PID:6380
- C:\Windows\System\kBseOev.exe
  C:\Windows\System\kBseOev.exe
  2⤵
  PID:6752
- C:\Windows\System\nYVWNBs.exe
  C:\Windows\System\nYVWNBs.exe
  2⤵
  PID:6540
- C:\Windows\System\GGYpBQC.exe
  C:\Windows\System\GGYpBQC.exe
  2⤵
  PID:6896
- C:\Windows\System\EjUSOHD.exe
  C:\Windows\System\EjUSOHD.exe
  2⤵
  PID:7724
- C:\Windows\System\sbKQRYl.exe
  C:\Windows\System\sbKQRYl.exe
  2⤵
  PID:7888
- C:\Windows\System\qiUtIdF.exe
  C:\Windows\System\qiUtIdF.exe
  2⤵
  PID:8096
- C:\Windows\System\qJCfbnD.exe
  C:\Windows\System\qJCfbnD.exe
  2⤵
  PID:7204
- C:\Windows\System\KqAUFKj.exe
  C:\Windows\System\KqAUFKj.exe
  2⤵
  PID:6608
- C:\Windows\System\JlNBteX.exe
  C:\Windows\System\JlNBteX.exe
  2⤵
  PID:7656
- C:\Windows\System\QTliRLx.exe
  C:\Windows\System\QTliRLx.exe
  2⤵
  PID:1496
- C:\Windows\System\jZnoPHD.exe
  C:\Windows\System\jZnoPHD.exe
  2⤵
  PID:8196
- C:\Windows\System\dTGBHOv.exe
  C:\Windows\System\dTGBHOv.exe
  2⤵
  PID:8212
- C:\Windows\System\OnoToOE.exe
  C:\Windows\System\OnoToOE.exe
  2⤵
  PID:8228
- C:\Windows\System\aCXagHd.exe
  C:\Windows\System\aCXagHd.exe
  2⤵
  PID:8244
- C:\Windows\System\FJfSWIJ.exe
  C:\Windows\System\FJfSWIJ.exe
  2⤵
  PID:8260
- C:\Windows\System\QhCfGvE.exe
  C:\Windows\System\QhCfGvE.exe
  2⤵
  PID:8276
- C:\Windows\System\ULdxXpJ.exe
  C:\Windows\System\ULdxXpJ.exe
  2⤵
  PID:8292
- C:\Windows\System\kdUJqzn.exe
  C:\Windows\System\kdUJqzn.exe
  2⤵
  PID:8308
- C:\Windows\System\KnKPgXK.exe
  C:\Windows\System\KnKPgXK.exe
  2⤵
  PID:8324
- C:\Windows\System\OZnOfuv.exe
  C:\Windows\System\OZnOfuv.exe
  2⤵
  PID:8340
- C:\Windows\System\EQAxGSB.exe
  C:\Windows\System\EQAxGSB.exe
  2⤵
  PID:8356
- C:\Windows\System\IiUUevZ.exe
  C:\Windows\System\IiUUevZ.exe
  2⤵
  PID:8372
- C:\Windows\System\FHkFblU.exe
  C:\Windows\System\FHkFblU.exe
  2⤵
  PID:8388
- C:\Windows\System\macDYDL.exe
  C:\Windows\System\macDYDL.exe
  2⤵
  PID:8404
- C:\Windows\System\MMZcevC.exe
  C:\Windows\System\MMZcevC.exe
  2⤵
  PID:8420
- C:\Windows\System\koTVIJS.exe
  C:\Windows\System\koTVIJS.exe
  2⤵
  PID:8436
- C:\Windows\System\jXMqFLM.exe
  C:\Windows\System\jXMqFLM.exe
  2⤵
  PID:8452
- C:\Windows\System\tnmjeRS.exe
  C:\Windows\System\tnmjeRS.exe
  2⤵
  PID:8468
- C:\Windows\System\AYxANsV.exe
  C:\Windows\System\AYxANsV.exe
  2⤵
  PID:8484
- C:\Windows\System\bYkupDK.exe
  C:\Windows\System\bYkupDK.exe
  2⤵
  PID:8500
- C:\Windows\System\xxDaVnX.exe
  C:\Windows\System\xxDaVnX.exe
  2⤵
  PID:8516
- C:\Windows\System\JVVjxGL.exe
  C:\Windows\System\JVVjxGL.exe
  2⤵
  PID:8532
- C:\Windows\System\CiGStvH.exe
  C:\Windows\System\CiGStvH.exe
  2⤵
  PID:8548
- C:\Windows\System\IJjarRM.exe
  C:\Windows\System\IJjarRM.exe
  2⤵
  PID:8564
- C:\Windows\System\IoKUjrj.exe
  C:\Windows\System\IoKUjrj.exe
  2⤵
  PID:8580
- C:\Windows\System\gwGHjaJ.exe
  C:\Windows\System\gwGHjaJ.exe
  2⤵
  PID:8596
- C:\Windows\System\vOTHQaN.exe
  C:\Windows\System\vOTHQaN.exe
  2⤵
  PID:8612
- C:\Windows\System\OMxwtvR.exe
  C:\Windows\System\OMxwtvR.exe
  2⤵
  PID:8628
- C:\Windows\System\ntAsMxf.exe
  C:\Windows\System\ntAsMxf.exe
  2⤵
  PID:8644
- C:\Windows\System\watLUMD.exe
  C:\Windows\System\watLUMD.exe
  2⤵
  PID:8660
- C:\Windows\System\xtsLSTh.exe
  C:\Windows\System\xtsLSTh.exe
  2⤵
  PID:8676
- C:\Windows\System\rclsWks.exe
  C:\Windows\System\rclsWks.exe
  2⤵
  PID:8692
- C:\Windows\System\dVcMpkO.exe
  C:\Windows\System\dVcMpkO.exe
  2⤵
  PID:8716
- C:\Windows\System\cGwHbzG.exe
  C:\Windows\System\cGwHbzG.exe
  2⤵
  PID:8732
- C:\Windows\System\sESNeEZ.exe
  C:\Windows\System\sESNeEZ.exe
  2⤵
  PID:8748
- C:\Windows\System\RHgXLjp.exe
  C:\Windows\System\RHgXLjp.exe
  2⤵
  PID:8764
- C:\Windows\System\roiraFh.exe
  C:\Windows\System\roiraFh.exe
  2⤵
  PID:8780
- C:\Windows\System\LUhUhfy.exe
  C:\Windows\System\LUhUhfy.exe
  2⤵
  PID:8796
- C:\Windows\System\jxIUVXL.exe
  C:\Windows\System\jxIUVXL.exe
  2⤵
  PID:8816
- C:\Windows\System\dcLuGCg.exe
  C:\Windows\System\dcLuGCg.exe
  2⤵
  PID:8832
- C:\Windows\System\EPEupDW.exe
  C:\Windows\System\EPEupDW.exe
  2⤵
  PID:8848
- C:\Windows\System\yfFWmnB.exe
  C:\Windows\System\yfFWmnB.exe
  2⤵
  PID:8864
- C:\Windows\System\hxNeBAu.exe
  C:\Windows\System\hxNeBAu.exe
  2⤵
  PID:8880
- C:\Windows\System\STOGcKj.exe
  C:\Windows\System\STOGcKj.exe
  2⤵
  PID:8896
- C:\Windows\System\LtjyPmG.exe
  C:\Windows\System\LtjyPmG.exe
  2⤵
  PID:8912
- C:\Windows\System\jUScAwC.exe
  C:\Windows\System\jUScAwC.exe
  2⤵
  PID:8928
- C:\Windows\System\PWzFtmp.exe
  C:\Windows\System\PWzFtmp.exe
  2⤵
  PID:8944
- C:\Windows\System\uXBcaBU.exe
  C:\Windows\System\uXBcaBU.exe
  2⤵
  PID:8960
- C:\Windows\System\PyGAzEw.exe
  C:\Windows\System\PyGAzEw.exe
  2⤵
  PID:8976
- C:\Windows\System\IJJnVPS.exe
  C:\Windows\System\IJJnVPS.exe
  2⤵
  PID:8992
- C:\Windows\System\pCoeEcw.exe
  C:\Windows\System\pCoeEcw.exe
  2⤵
  PID:9008
- C:\Windows\System\AhJgwRz.exe
  C:\Windows\System\AhJgwRz.exe
  2⤵
  PID:9024
- C:\Windows\System\MLvxsxI.exe
  C:\Windows\System\MLvxsxI.exe
  2⤵
  PID:9044
- C:\Windows\System\WYjvkhC.exe
  C:\Windows\System\WYjvkhC.exe
  2⤵
  PID:9060
- C:\Windows\System\AKERPIk.exe
  C:\Windows\System\AKERPIk.exe
  2⤵
  PID:9076
- C:\Windows\System\CdnWtrx.exe
  C:\Windows\System\CdnWtrx.exe
  2⤵
  PID:9092
- C:\Windows\System\ZeSJxGs.exe
  C:\Windows\System\ZeSJxGs.exe
  2⤵
  PID:9108
- C:\Windows\System\lpqrxbw.exe
  C:\Windows\System\lpqrxbw.exe
  2⤵
  PID:9124
- C:\Windows\System\TyWwIEf.exe
  C:\Windows\System\TyWwIEf.exe
  2⤵
  PID:9140
- C:\Windows\System\OcoVriQ.exe
  C:\Windows\System\OcoVriQ.exe
  2⤵
  PID:9156
- C:\Windows\System\vsgtSNS.exe
  C:\Windows\System\vsgtSNS.exe
  2⤵
  PID:9172
- C:\Windows\System\RruzLlt.exe
  C:\Windows\System\RruzLlt.exe
  2⤵
  PID:9188
- C:\Windows\System\BGAFjKm.exe
  C:\Windows\System\BGAFjKm.exe
  2⤵
  PID:9204
- C:\Windows\System\OkCSTyM.exe
  C:\Windows\System\OkCSTyM.exe
  2⤵
  PID:7312
- C:\Windows\System\ZOBEyse.exe
  C:\Windows\System\ZOBEyse.exe
  2⤵
  PID:7600
- C:\Windows\System\kVwSlyQ.exe
  C:\Windows\System\kVwSlyQ.exe
  2⤵
  PID:7772
- C:\Windows\System\kjwtSAO.exe
  C:\Windows\System\kjwtSAO.exe
  2⤵
  PID:6716
- C:\Windows\System\HNpxyWV.exe
  C:\Windows\System\HNpxyWV.exe
  2⤵
  PID:6468
- C:\Windows\System\RlWbije.exe
  C:\Windows\System\RlWbije.exe
  2⤵
  PID:7560
- C:\Windows\System\LyVoOju.exe
  C:\Windows\System\LyVoOju.exe
  2⤵
  PID:8236
- C:\Windows\System\YvGfogw.exe
  C:\Windows\System\YvGfogw.exe
  2⤵
  PID:8300
- C:\Windows\System\lcOUpmd.exe
  C:\Windows\System\lcOUpmd.exe
  2⤵
  PID:8364
- C:\Windows\System\HicMTMN.exe
  C:\Windows\System\HicMTMN.exe
  2⤵
  PID:8224
- C:\Windows\System\cXjvPck.exe
  C:\Windows\System\cXjvPck.exe
  2⤵
  PID:8400
- C:\Windows\System\gmXUIgr.exe
  C:\Windows\System\gmXUIgr.exe
  2⤵
  PID:8464
- C:\Windows\System\nJFZcYt.exe
  C:\Windows\System\nJFZcYt.exe
  2⤵
  PID:8556
- C:\Windows\System\qdiGmMM.exe
  C:\Windows\System\qdiGmMM.exe
  2⤵
  PID:8620
- C:\Windows\System\WFEonek.exe
  C:\Windows\System\WFEonek.exe
  2⤵
  PID:8684
- C:\Windows\System\ISyQeFx.exe
  C:\Windows\System\ISyQeFx.exe
  2⤵
  PID:8320
- C:\Windows\System\pHafxph.exe
  C:\Windows\System\pHafxph.exe
  2⤵
  PID:8640
- C:\Windows\System\vbaNVhj.exe
  C:\Windows\System\vbaNVhj.exe
  2⤵
  PID:8416
- C:\Windows\System\GOkWzxH.exe
  C:\Windows\System\GOkWzxH.exe
  2⤵
  PID:8512
- C:\Windows\System\pcBCqpY.exe
  C:\Windows\System\pcBCqpY.exe
  2⤵
  PID:8576
- C:\Windows\System\XyFqipL.exe
  C:\Windows\System\XyFqipL.exe
  2⤵
  PID:8668
- C:\Windows\System\YONpIaI.exe
  C:\Windows\System\YONpIaI.exe
  2⤵
  PID:8708
- C:\Windows\System\LaiDrfl.exe
  C:\Windows\System\LaiDrfl.exe
  2⤵
  PID:8792
- C:\Windows\System\wUDOFaO.exe
  C:\Windows\System\wUDOFaO.exe
  2⤵
  PID:8812
- C:\Windows\System\XcshsHY.exe
  C:\Windows\System\XcshsHY.exe
  2⤵
  PID:8856
- C:\Windows\System\CVXnPtA.exe
  C:\Windows\System\CVXnPtA.exe
  2⤵
  PID:8920
- C:\Windows\System\OxgrrtG.exe
  C:\Windows\System\OxgrrtG.exe
  2⤵
  PID:8808
- C:\Windows\System\DVnvObr.exe
  C:\Windows\System\DVnvObr.exe
  2⤵
  PID:8872
- C:\Windows\System\OSRteyw.exe
  C:\Windows\System\OSRteyw.exe
  2⤵
  PID:8972
- C:\Windows\System\wspilfO.exe
  C:\Windows\System\wspilfO.exe
  2⤵
  PID:8984
- C:\Windows\System\GhcoSCw.exe
  C:\Windows\System\GhcoSCw.exe
  2⤵
  PID:9116
- C:\Windows\System\tWlKKqN.exe
  C:\Windows\System\tWlKKqN.exe
  2⤵
  PID:9152
- C:\Windows\System\MWOefqt.exe
  C:\Windows\System\MWOefqt.exe
  2⤵
  PID:7316
- C:\Windows\System\ISusVSu.exe
  C:\Windows\System\ISusVSu.exe
  2⤵
  PID:9036
- C:\Windows\System\FkDmpdR.exe
  C:\Windows\System\FkDmpdR.exe
  2⤵
  PID:9104
- C:\Windows\System\WulCoei.exe
  C:\Windows\System\WulCoei.exe
  2⤵
  PID:9168
- C:\Windows\System\ZsjRllg.exe
  C:\Windows\System\ZsjRllg.exe
  2⤵
  PID:7708
- C:\Windows\System\iUOCxiE.exe
  C:\Windows\System\iUOCxiE.exe
  2⤵
  PID:7652
- C:\Windows\System\YeLmIId.exe
  C:\Windows\System\YeLmIId.exe
  2⤵
  PID:7088
- C:\Windows\System\KmPExwc.exe
  C:\Windows\System\KmPExwc.exe
  2⤵
  PID:8028
- C:\Windows\System\cWcwXNS.exe
  C:\Windows\System\cWcwXNS.exe
  2⤵
  PID:7328
- C:\Windows\System\EtkxkLY.exe
  C:\Windows\System\EtkxkLY.exe
  2⤵
  PID:8336
- C:\Windows\System\kwBrkxu.exe
  C:\Windows\System\kwBrkxu.exe
  2⤵
  PID:8524
- C:\Windows\System\bTEtGGI.exe
  C:\Windows\System\bTEtGGI.exe
  2⤵
  PID:8348
- C:\Windows\System\CjLEMAI.exe
  C:\Windows\System\CjLEMAI.exe
  2⤵
  PID:8480
- C:\Windows\System\fvIDomK.exe
  C:\Windows\System\fvIDomK.exe
  2⤵
  PID:8788
- C:\Windows\System\jWwrrul.exe
  C:\Windows\System\jWwrrul.exe
  2⤵
  PID:8268
- C:\Windows\System\cDrVDEg.exe
  C:\Windows\System\cDrVDEg.exe
  2⤵
  PID:8592
- C:\Windows\System\tnZglzd.exe
  C:\Windows\System\tnZglzd.exe
  2⤵
  PID:8412
- C:\Windows\System\cCDwxHj.exe
  C:\Windows\System\cCDwxHj.exe
  2⤵
  PID:8704
- C:\Windows\System\HtUkyxR.exe
  C:\Windows\System\HtUkyxR.exe
  2⤵
  PID:8888
- C:\Windows\System\NciwJYB.exe
  C:\Windows\System\NciwJYB.exe
  2⤵
  PID:8804
- C:\Windows\System\jmxOyOO.exe
  C:\Windows\System\jmxOyOO.exe
  2⤵
  PID:9084
- C:\Windows\System\MFSGaai.exe
  C:\Windows\System\MFSGaai.exe
  2⤵
  PID:8968
- C:\Windows\System\VghHBgN.exe
  C:\Windows\System\VghHBgN.exe
  2⤵
  PID:9000
- C:\Windows\System\wcqfauR.exe
  C:\Windows\System\wcqfauR.exe
  2⤵
  PID:9072
- C:\Windows\System\RjqUbVZ.exe
  C:\Windows\System\RjqUbVZ.exe
  2⤵
  PID:9196
- C:\Windows\System\KaAXuXE.exe
  C:\Windows\System\KaAXuXE.exe
  2⤵
  PID:7444
- C:\Windows\System\bMWbHah.exe
  C:\Windows\System\bMWbHah.exe
  2⤵
  PID:8476
- C:\Windows\System\dCqctuG.exe
  C:\Windows\System\dCqctuG.exe
  2⤵
  PID:8220
- C:\Windows\System\cOYyaKA.exe
  C:\Windows\System\cOYyaKA.exe
  2⤵
  PID:8728
- C:\Windows\System\RmzjUnY.exe
  C:\Windows\System\RmzjUnY.exe
  2⤵
  PID:6548
- C:\Windows\System\LJcHWis.exe
  C:\Windows\System\LJcHWis.exe
  2⤵
  PID:8332
- C:\Windows\System\JZQwhZJ.exe
  C:\Windows\System\JZQwhZJ.exe
  2⤵
  PID:8460
- C:\Windows\System\xzXtbez.exe
  C:\Windows\System\xzXtbez.exe
  2⤵
  PID:9056
- C:\Windows\System\yvXpUDW.exe
  C:\Windows\System\yvXpUDW.exe
  2⤵
  PID:8824
- C:\Windows\System\DYcqDDO.exe
  C:\Windows\System\DYcqDDO.exe
  2⤵
  PID:8952
- C:\Windows\System\RIcxchq.exe
  C:\Windows\System\RIcxchq.exe
  2⤵
  PID:8956
- C:\Windows\System\WULtpkX.exe
  C:\Windows\System\WULtpkX.exe
  2⤵
  PID:8160
- C:\Windows\System\SSXgEyq.exe
  C:\Windows\System\SSXgEyq.exe
  2⤵
  PID:8828
- C:\Windows\System\CjjCrZP.exe
  C:\Windows\System\CjjCrZP.exe
  2⤵
  PID:9164
- C:\Windows\System\ENZtIgy.exe
  C:\Windows\System\ENZtIgy.exe
  2⤵
  PID:9004
- C:\Windows\System\wllpPJi.exe
  C:\Windows\System\wllpPJi.exe
  2⤵
  PID:8432
- C:\Windows\System\LCqGUPZ.exe
  C:\Windows\System\LCqGUPZ.exe
  2⤵
  PID:9136
- C:\Windows\System\PjyAXLr.exe
  C:\Windows\System\PjyAXLr.exe
  2⤵
  PID:8396
- C:\Windows\System\MchjXzd.exe
  C:\Windows\System\MchjXzd.exe
  2⤵
  PID:8844
- C:\Windows\System\AIKLUvC.exe
  C:\Windows\System\AIKLUvC.exe
  2⤵
  PID:9180
- C:\Windows\System\jqmaszL.exe
  C:\Windows\System\jqmaszL.exe
  2⤵
  PID:8284
- C:\Windows\System\xdvSeAy.exe
  C:\Windows\System\xdvSeAy.exe
  2⤵
  PID:9228
- C:\Windows\System\yWYEBnf.exe
  C:\Windows\System\yWYEBnf.exe
  2⤵
  PID:9244
- C:\Windows\System\yvXlMdg.exe
  C:\Windows\System\yvXlMdg.exe
  2⤵
  PID:9260
- C:\Windows\System\mzHJeaK.exe
  C:\Windows\System\mzHJeaK.exe
  2⤵
  PID:9280
- C:\Windows\System\bHwhTGw.exe
  C:\Windows\System\bHwhTGw.exe
  2⤵
  PID:9304
- C:\Windows\System\tptWUgc.exe
  C:\Windows\System\tptWUgc.exe
  2⤵
  PID:9320
- C:\Windows\System\EVTSrNJ.exe
  C:\Windows\System\EVTSrNJ.exe
  2⤵
  PID:9336
- C:\Windows\System\yFysSpA.exe
  C:\Windows\System\yFysSpA.exe
  2⤵
  PID:9352
- C:\Windows\System\XebsWLV.exe
  C:\Windows\System\XebsWLV.exe
  2⤵
  PID:9368
- C:\Windows\System\HnxKDuA.exe
  C:\Windows\System\HnxKDuA.exe
  2⤵
  PID:9384
- C:\Windows\System\vyyYXto.exe
  C:\Windows\System\vyyYXto.exe
  2⤵
  PID:9400
- C:\Windows\System\WbaLNtO.exe
  C:\Windows\System\WbaLNtO.exe
  2⤵
  PID:9416
- C:\Windows\System\cjKbvIL.exe
  C:\Windows\System\cjKbvIL.exe
  2⤵
  PID:9432
- C:\Windows\System\qkOgdWg.exe
  C:\Windows\System\qkOgdWg.exe
  2⤵
  PID:9448
- C:\Windows\System\mUleHix.exe
  C:\Windows\System\mUleHix.exe
  2⤵
  PID:9464
- C:\Windows\System\yJzLYxY.exe
  C:\Windows\System\yJzLYxY.exe
  2⤵
  PID:9480
- C:\Windows\System\wJIvBKK.exe
  C:\Windows\System\wJIvBKK.exe
  2⤵
  PID:9496
- C:\Windows\System\RQoBgas.exe
  C:\Windows\System\RQoBgas.exe
  2⤵
  PID:9512
- C:\Windows\System\iaFvzYS.exe
  C:\Windows\System\iaFvzYS.exe
  2⤵
  PID:9528
- C:\Windows\System\GzQaDmT.exe
  C:\Windows\System\GzQaDmT.exe
  2⤵
  PID:9544
- C:\Windows\System\ydMkCvV.exe
  C:\Windows\System\ydMkCvV.exe
  2⤵
  PID:9564
- C:\Windows\System\idOYmJJ.exe
  C:\Windows\System\idOYmJJ.exe
  2⤵
  PID:9580
- C:\Windows\System\fFzXkWg.exe
  C:\Windows\System\fFzXkWg.exe
  2⤵
  PID:9596
- C:\Windows\System\ZPsVrDu.exe
  C:\Windows\System\ZPsVrDu.exe
  2⤵
  PID:9612
- C:\Windows\System\UDtoPrP.exe
  C:\Windows\System\UDtoPrP.exe
  2⤵
  PID:9628
- C:\Windows\System\IRTTNKA.exe
  C:\Windows\System\IRTTNKA.exe
  2⤵
  PID:9644
- C:\Windows\System\qKWFmsb.exe
  C:\Windows\System\qKWFmsb.exe
  2⤵
  PID:9660
- C:\Windows\System\Mrsidhb.exe
  C:\Windows\System\Mrsidhb.exe
  2⤵
  PID:9676
- C:\Windows\System\kHqAYQl.exe
  C:\Windows\System\kHqAYQl.exe
  2⤵
  PID:9692
- C:\Windows\System\zizBzbQ.exe
  C:\Windows\System\zizBzbQ.exe
  2⤵
  PID:9708
- C:\Windows\System\NGYHiIC.exe
  C:\Windows\System\NGYHiIC.exe
  2⤵
  PID:9724
- C:\Windows\System\dbbOWRF.exe
  C:\Windows\System\dbbOWRF.exe
  2⤵
  PID:9740
- C:\Windows\System\FYpcjrK.exe
  C:\Windows\System\FYpcjrK.exe
  2⤵
  PID:9756
- C:\Windows\System\VONEXbN.exe
  C:\Windows\System\VONEXbN.exe
  2⤵
  PID:9772
- C:\Windows\System\EgjKIFi.exe
  C:\Windows\System\EgjKIFi.exe
  2⤵
  PID:9788
- C:\Windows\System\oyMwthA.exe
  C:\Windows\System\oyMwthA.exe
  2⤵
  PID:9804
- C:\Windows\System\irkwVYM.exe
  C:\Windows\System\irkwVYM.exe
  2⤵
  PID:9820
- C:\Windows\System\EDkijDc.exe
  C:\Windows\System\EDkijDc.exe
  2⤵
  PID:9836
- C:\Windows\System\soQpruD.exe
  C:\Windows\System\soQpruD.exe
  2⤵
  PID:9852
- C:\Windows\System\CRDujPA.exe
  C:\Windows\System\CRDujPA.exe
  2⤵
  PID:9868
- C:\Windows\System\LsWVykN.exe
  C:\Windows\System\LsWVykN.exe
  2⤵
  PID:9888
- C:\Windows\System\pBdUozh.exe
  C:\Windows\System\pBdUozh.exe
  2⤵
  PID:9904
- C:\Windows\System\poHWkbh.exe
  C:\Windows\System\poHWkbh.exe
  2⤵
  PID:9920
- C:\Windows\System\eCalcKi.exe
  C:\Windows\System\eCalcKi.exe
  2⤵
  PID:9936
- C:\Windows\System\VSsDfpO.exe
  C:\Windows\System\VSsDfpO.exe
  2⤵
  PID:9952
- C:\Windows\System\xZlJGKX.exe
  C:\Windows\System\xZlJGKX.exe
  2⤵
  PID:9968
- C:\Windows\System\VcclxzR.exe
  C:\Windows\System\VcclxzR.exe
  2⤵
  PID:9984
- C:\Windows\System\HjIHICy.exe
  C:\Windows\System\HjIHICy.exe
  2⤵
  PID:10000
- C:\Windows\System\kXBQZVR.exe
  C:\Windows\System\kXBQZVR.exe
  2⤵
  PID:10016
- C:\Windows\System\iSyutBM.exe
  C:\Windows\System\iSyutBM.exe
  2⤵
  PID:10032
- C:\Windows\System\ZQLsuOi.exe
  C:\Windows\System\ZQLsuOi.exe
  2⤵
  PID:10048
- C:\Windows\System\hIpvwkg.exe
  C:\Windows\System\hIpvwkg.exe
  2⤵
  PID:10064
- C:\Windows\System\aOCyrLa.exe
  C:\Windows\System\aOCyrLa.exe
  2⤵
  PID:10080
- C:\Windows\System\FosaDAo.exe
  C:\Windows\System\FosaDAo.exe
  2⤵
  PID:10128
- C:\Windows\System\wPYHToH.exe
  C:\Windows\System\wPYHToH.exe
  2⤵
  PID:10144
- C:\Windows\System\DWxESJm.exe
  C:\Windows\System\DWxESJm.exe
  2⤵
  PID:10160
- C:\Windows\System\bZJBItR.exe
  C:\Windows\System\bZJBItR.exe
  2⤵
  PID:10176
- C:\Windows\System\VxOmbok.exe
  C:\Windows\System\VxOmbok.exe
  2⤵
  PID:10196
- C:\Windows\System\bYDmcwL.exe
  C:\Windows\System\bYDmcwL.exe
  2⤵
  PID:10212
- C:\Windows\System\SOotIsH.exe
  C:\Windows\System\SOotIsH.exe
  2⤵
  PID:10228
- C:\Windows\System\ytihVJH.exe
  C:\Windows\System\ytihVJH.exe
  2⤵
  PID:9224
- C:\Windows\System\VzUoKpS.exe
  C:\Windows\System\VzUoKpS.exe
  2⤵
  PID:8656
- C:\Windows\System\pEiDPIh.exe
  C:\Windows\System\pEiDPIh.exe
  2⤵
  PID:9268
- C:\Windows\System\UtPxMnG.exe
  C:\Windows\System\UtPxMnG.exe
  2⤵
  PID:7952
- C:\Windows\System\zteFTLd.exe
  C:\Windows\System\zteFTLd.exe
  2⤵
  PID:9332
- C:\Windows\System\LjNLfiA.exe
  C:\Windows\System\LjNLfiA.exe
  2⤵
  PID:9392
- C:\Windows\System\sqChFUP.exe
  C:\Windows\System\sqChFUP.exe
  2⤵
  PID:9344
- C:\Windows\System\XfPikBg.exe
  C:\Windows\System\XfPikBg.exe
  2⤵
  PID:9424
- C:\Windows\System\ZqRGmrJ.exe
  C:\Windows\System\ZqRGmrJ.exe
  2⤵
  PID:9488
- C:\Windows\System\XGsQKRG.exe
  C:\Windows\System\XGsQKRG.exe
  2⤵
  PID:9556
- C:\Windows\System\RFUnqHN.exe
  C:\Windows\System\RFUnqHN.exe
  2⤵
  PID:9620
- C:\Windows\System\KaPWKxU.exe
  C:\Windows\System\KaPWKxU.exe
  2⤵
  PID:9656
- C:\Windows\System\dDkSOUO.exe
  C:\Windows\System\dDkSOUO.exe
  2⤵
  PID:9472
- C:\Windows\System\OJmVBGW.exe
  C:\Windows\System\OJmVBGW.exe
  2⤵
  PID:9700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\GDgfdhA.exe

Filesize
1.9MB

MD5
3b91e0de586da31651b37d697689a09d

SHA1
1932889ca7e26df1fb0ff9d3e1484d4081147b34

SHA256
901539d446e85f5a56025c68c26104bb477d2961d8d47b7f8b704a5d7ab936db

SHA512
21627942f6213cb64f49fb1a3cabd8d818d98709c3c18ae2850573a5a30942152f6608bbf4f35c1f92efb59b52c451e986089fe8883cb43eb30ea1a565d01c27

Download Submit
C:\Windows\system\GeeOGgU.exe

Filesize
1.9MB

MD5
f10c185fb785982954a0d5b4ab3e3bbf

SHA1
60e29ec04c1c85d545b3562551c10d9500f2ed1e

SHA256
2206ff5b7c37dc5f470371359d7f250114eefa8d416c3cc04756c5ad33d6fa61

SHA512
0d02bb1a81371e07c893165a50ef9426cec3a45f12261ba46e656c61bd4373c71d2b2f7bae26979a8843cb9ec2577cb3b4a09ec0a387e1849150db04bfc1e939

Download Submit
C:\Windows\system\GzzWXcf.exe

Filesize
1.9MB

MD5
314142ffc621453a1313f24a20d0b9d4

SHA1
1982d13936d50f5d6d25671b8a5b56fb427be805

SHA256
2f9cf6742f690562893f87eedc63108357c33c02cb23e482018012f0513a203f

SHA512
8af4d6a9cdddffca3e2db08aa2ecc4e78f4dc49ffe26aace08aa82b77ad428f2f8fefacbf12cf6d4f6277471c596d97912efb5d01287043444bf4ffb5db7cb27

Download Submit
C:\Windows\system\JrVwAzC.exe

Filesize
1.9MB

MD5
c2f7a93b4f014a2d407b3c4293e7d6df

SHA1
2352042a250466f560ba54a673502cc58de995a2

SHA256
e26aa8d3b65bc202eb99c8888be811c311c221c40dd3677b00087510411b2533

SHA512
595f635d3260626d404ae59d85dabb8e27f7428d6d9660be0eb9325e4f5b6ee2d5cf5babca0678248631e5769b89b6fa50a3af192818c8655c0e483e93fcceda

Download Submit
C:\Windows\system\LzsWAEi.exe

Filesize
1.9MB

MD5
60aff45a0a825075217aaf82d4cdd250

SHA1
262313936b445caeb76d9e15ca4ef97ea7daf7cc

SHA256
536d075fdadf3d9f41bcf6ec4dffaa3373990c3e53a672997c1191abacd1bd30

SHA512
69c6883d5cc55ef12f62d761d5755c83c85b629485a6f5e707fb2e855b3d505d08c16a8e44a51a141511f6a51262e1ddae3d0af655722db1d66335b67feece8d

Download Submit
C:\Windows\system\NBKIlVi.exe

Filesize
1.9MB

MD5
e3c7f49a9fae62555d2c7f485f9eb0e5

SHA1
add2ecf14ee1dbefeee50f6de89e81fd7c1bf322

SHA256
0fcace114fe39475972df89cc585b25108cfef3c0620c33d204074edc118c7e6

SHA512
013ce2b7791800489f43859f58a9e299016a8a9090f7cceff360a191fb70bcb7c82c40adc64a9150ce37b07eae170d878c50824a153ba449c13756c3c522b483

Download Submit
C:\Windows\system\PVZXmyG.exe

Filesize
1.9MB

MD5
dd08ec9bcfc1bc08b2fb91c6fbe6e083

SHA1
6762209d1ec65d85f1ced874e217d33d0058a2c8

SHA256
273e2582004efaaab26118a1441cefde77f03beb72590d2a238908be1de10623

SHA512
1dadcbfde013e06c637228e411e9918a0bbdd3e1489e9e4bcc1f69e0444ac95fb3ecdd8adfc010cb4db29f3cba2d7ad8c657a3c84f6546f28f0c216409816ceb

Download Submit
C:\Windows\system\SZsQPqY.exe

Filesize
1.9MB

MD5
7feaa7a6c46454a04095158b7d7fdf6d

SHA1
9c8ebc7c7f861a35d1e9a36a7b4db0e996481562

SHA256
260b064d41184d91d3ccdf8f25ad6369da59dad71426abfe99561234381edf2b

SHA512
7adf282dcc56921d5d2726b3fee3d559f6690717459ec4f905a3e41797509acdc53036d26c85a8a04dd5189fc4183e6b56c0109358bb82b1171ad7a0c6293ab7

Download Submit
C:\Windows\system\Xjegenp.exe

Filesize
1.9MB

MD5
25741d9bdb79b8ecad6516f41b766e8a

SHA1
5b0475c540c765273e24e5542be84bd1682969a2

SHA256
c063d8ce60bf3de8cc4932f5580fc96663240125aa93fb86c607f8a172a6c5da

SHA512
22c0e1ea722bc3bfe7b22944ab94a087818ee28401688c0da89c2265567cc0234b2afe09c68cc5fac83693cffa07553953a22f6ea2b3ea4792524b0823df20f8

Download Submit
C:\Windows\system\ZjXxCxW.exe

Filesize
1.9MB

MD5
376b0eb27b952a42d7edcfec4c882333

SHA1
b394210d22a2d2058d9009737a7d2a8dd0ccdc90

SHA256
c14914fd048ba397adb7fb5112aa3ec1bcc46463ee416428788b97bae4aa9b2e

SHA512
9dc1ce96c6027ba2b7ef6d43136fbc132a36c08c6ef12cdeec130c516469fe6f001052aeb7fcc27267f54c912bbb909cfdba2b504e9d7ecd9f14c2af137b6288

Download Submit
C:\Windows\system\aYQYuyY.exe

Filesize
1.9MB

MD5
7b91abb23db406f21017e32a66200a47

SHA1
fc41b0ec386200ae349f132460bbb68c9b82dfa7

SHA256
6c25de057897c24b736c30b6ac330ec9e1ab4243e0feea6f2a1f46bc620dfa35

SHA512
bdf86e33fdaf956aef83f36347a82e9f64ff3c76dbb74b3ffd6a0a491393c39578f286c2a6ac6ece270958fb3aaa194c5d623245721445faf70b6cd185b6f45d

Download Submit
C:\Windows\system\bxNktOj.exe

Filesize
1.9MB

MD5
a8633412c588692378d0423b3fbb8ce4

SHA1
8c05e46c1c0bec5996aae9ada08bfdcb4af81324

SHA256
3d72665aee821a613abf1cd6a31ebafbd3bb13af57c0ec2ee10187818c906569

SHA512
06c80283588f4417a07941ae841f73cafb1c3fa3cc59b21822dbdb188a0d230dfa5182feb0fe37e643307489432242eae33b0a34696e7c0e1b0b4a8e53813f28

Download Submit
C:\Windows\system\eDVIfjc.exe

Filesize
1.9MB

MD5
bfb5c348313d281882097abaebc97b71

SHA1
761abf2b6673199f006babaf292c849bbd6e0737

SHA256
fdf14ae9ad703728b9606a8760f89e10a1513773a077b401162503b5267ff78e

SHA512
97394d28a67b8b71d8837dd0d74d58f7da418b1663a06a9e3a5b82b94270f01fc4465d6bc46f9bfdbec4d4c52f7adfd842b8f38d497f7345704c00892ebe0c72

Download Submit
C:\Windows\system\gEibcvw.exe

Filesize
1.9MB

MD5
ebea4213757e8b1a75dcb316a8b2a610

SHA1
ef8180715b6db61550c8bb5acec0418cc8ef5c10

SHA256
cf4b0a776faa07a98e663de6280a00d652b659e543b52661c6d29a675acf00b4

SHA512
0920162bf7f9613412ebe042e558568fe0dca49f8b3fb9dd584ad5ffabb4e2909dabc62840c081a3b3ef4a2cedc65e54f85260cb874ade467f990d39499e3ba7

Download Submit
C:\Windows\system\jsjLpMh.exe

Filesize
1.9MB

MD5
fa74dc66f97c9a91287ef2920ccd870d

SHA1
234b8dcb1776bb49e0694a3e51461641c10a4e15

SHA256
46d3fd39b0aa18757a547fbfb23991b69a95b6c16c0ea5ffda1ef5fca5d93872

SHA512
d9db915d41484e3f8186382d0ee03b53a9cd8f3aa3ee0490990f0b7881f5a04891f63b5e7df71c40fad42fa8309a9d398bd5a727fe05269e211bde28485c3195

Download Submit
C:\Windows\system\kOzLNwZ.exe

Filesize
1.9MB

MD5
5968a3330bd841a787aa3c502e644d5a

SHA1
85802ff68f9a8e42fc0c96519c122b44deb28d7d

SHA256
d95588db2153b7eac9df90e8810cbc835abf88ca2d03e9948fab3f6b207f51f2

SHA512
33c8a03ee6c79f666ef29f56cf13c9c9d8cc3f595e3681ff3ed8c1182443e5b72446a51871d6c6e3f47f88f055a580926e9c7eb75f53c065c3b0188600821de1

Download Submit
C:\Windows\system\sPlTwOU.exe

Filesize
1.9MB

MD5
5d6e17802ce81c8c41040d03c7cb2b4f

SHA1
358bd6ea052c975138d488cee7f4407a4acb5e1b

SHA256
541db755abbffd312ef7ffc756374b98d422b247e907533240f95a121023174d

SHA512
b623db7e4fd247aca7f5557a1edec7e4a0781d8d9a72d1f821ff860b981a89913cddf74ff37a6f65b5020e74bae40d2819ba6306c5abed7189da4879685070f2

Download Submit
C:\Windows\system\sYsruDi.exe

Filesize
1.9MB

MD5
4561701587a4bb632a2a0c44423d5425

SHA1
65789bc30dc77035db65ba3d81cd3af4bebd42ee

SHA256
49dd1c1a2a640f53fd2c711bcea5c816a09fbcda8b85b825267c16428fa31dfe

SHA512
6f2708baf1ae3629965e45e7ec7522f02ac8ecdfab1f65b2988bd0aec5a41c99f0df829fce5ae9bf79dbc29dd5a281efafbcbf3250695f74756c35c0fe5aa9c0

Download Submit
C:\Windows\system\vMRBmNb.exe

Filesize
1.9MB

MD5
d1df752e98feea43ffdba4cea0f114fe

SHA1
e5fcda1ae0269c9328fb0a7738f340d881450d02

SHA256
5e4d12721e566ff2d0342be8c2ce35971c73f94ea8e460937508873073691cb5

SHA512
bacba91292165e94b15dda6a1c16290d2f066b2ae4c1e9c8d57a055900b0c7cc989fbd0ffa28bfdcf95308f4b36a3dbf049004f12571a6ed439ab9ccf8d45195

Download Submit
C:\Windows\system\wLzYTnR.exe

Filesize
1.9MB

MD5
66d0097a59a769bdba3140f8ca3924fb

SHA1
ea50903b924cc9952d3c07af94707448f78eb490

SHA256
32fb26538b321b2b1606c7270457915de0b18de0c636eb232bc720858f996f1f

SHA512
89c6f47d35a9a766ee7502f2fbf5c344d8d4c3ce0813e106f41f57bcdca1141d0a2bf33c2ed66c6d38447655408a5a7a4bca85609d201a0bb63d2fd1f46129bc

Download Submit
C:\Windows\system\xjSkMvm.exe

Filesize
1.9MB

MD5
c5557eef3f88a368730340b4ba9fbb37

SHA1
71c86a214ccec4343323f369c1e8e36b6438b69e

SHA256
16e0bdca1f68a7c6e5f422f7147cafc1044557b3576dca13ee8c7f94b8d60cf9

SHA512
aa4e211cf408c7e734ce1bdbd30ff824d40055839da8310a93728e4752e4618825b70186f1a5ce68ebcb9a819b61a6c852829fbd8bf2356aceafdac40cbb66f0

Download Submit
C:\Windows\system\yOoFMKd.exe

Filesize
1.9MB

MD5
5b25356986b5318dc83ecf698b76c7e8

SHA1
87e0f9b0db41911336b8393dd47173519be121b4

SHA256
2a2583ff4ecaf3cbdfe437ddd366ebdd10a42d5ed6486429e429d58947aedcc9

SHA512
20dfdd43f8fccf0e38d8ec9ee7cfd5c429f27a74a87d0b327fe9c133da0d55ee5e59af96aa99073cb459b83ad67940c8ef837caa869f97154f94754f21e7f991

Download Submit
C:\Windows\system\zTxyboK.exe

Filesize
1.9MB

MD5
7b05a5f5bf830f50ec3a7d79a597fd46

SHA1
0440d08ae256e3aba74ca30e58d3834de6cb3dce

SHA256
54d12fe64d4eb7c1744f12bac996cc12523589e7932d0f1c6a48bbcf9f1195df

SHA512
46cfc01f428eded3c3f82125878389bf671a56f4be6a39ecd7a2e99ecc681505c00ae35d60d37e3d2790f46e1b3a5e8a4987876bafd4de89464485e0c0b6d4d4

Download Submit
\Windows\system\FOUWHhc.exe

Filesize
1.9MB

MD5
82366fb4c52784a12d387390896c115c

SHA1
5248aa44d8bad4a989bd03a031ffcd380c45429b

SHA256
2c8243fbcc3fe2d62b4db200f4c2a8f78ece555d61666e07bf6bd325bea91563

SHA512
11e95996ae0767429170a179e631beb12bcc7b4ca97b17028927a02cbf40f9de112e2c7d91a607b672c246c4521652b596335dc9065a4a76dbb2527a4c3de3d4

Download Submit
\Windows\system\FioKmcC.exe

Filesize
1.9MB

MD5
383a49eba392ad631dfafa393dd77bcf

SHA1
eda0484ef807e3b480c90fb74a6266919de14073

SHA256
9234b0cb5f8fd2cd9612eb02ef823371145f46c7deb46194d408af32ebb0e6da

SHA512
c53d7e80e9149fd8733d74ae61d2a395c5d71c10ab65a30af98595810d745f1781d0a963da88d4a05823b41deb924342ee956b3b38e920c872f08fc2ae1025db

Download Submit
\Windows\system\TgKmMtL.exe

Filesize
1.9MB

MD5
dc78115131b2bcb095d5a07f2acd0ed6

SHA1
f6786daee753da3919f4d26f8ad1cd658890ec64

SHA256
0e60ec6a788a0861d1224c70cd636f954d204f3bda37295631ce002f83ec8721

SHA512
ee6699840cc20248b47903d6b47da494640c57c2335753def9dca3e51ba296af1e99452ebbda719cd8993a0cdbbe200eecf019707edcf1d42b2269786d7d8976

Download Submit
\Windows\system\XpoSlSP.exe

Filesize
1.9MB

MD5
d7500f74726201b36c42c211599f7a87

SHA1
5f6b1f383602d52f4499f0473ea70ff300ed2c25

SHA256
46d14a9bb4cc7ab2f17717f4421a6ec48ac7034d14cd2253043a7271fa764e48

SHA512
751f78a78fb7e50afb8b611eecbc2a6a5789ac318aeefbb46a24b1b05bc89f9ef761d7290b5eccc3f2fad622410f6b75b23660c7a5459466cb9408e9e98b46dc

Download Submit
\Windows\system\YTLqLDB.exe

Filesize
1.9MB

MD5
db1f912b419fc3fbe750a0bf4030549d

SHA1
7ee141374ae4c92f317b0cb3d18b5bc3d96c6258

SHA256
cb9cb09956db5a48e69707451ee4c9141a613bfa5ca4cbf7272cadcf307f5495

SHA512
60e977665ac4564af38b067b3bc83d67b101714675f8145f8b4feb3a6999ac4e02fde9c73e017af2e1d8c6abfe28cb02dfad4887938b84e00de97f97802a5e2b

Download Submit
\Windows\system\aYhfNvq.exe

Filesize
1.9MB

MD5
c0da6e009435cce676f6342d2d8000ef

SHA1
7d2cf45b3e40e923953b2a9ae2f133715cdd8366

SHA256
993ac3bd0c62823a74fe586ec048cae4756ee2c2ba859fff57843e2a6058a44b

SHA512
662e6140144bd3a6637104b75e6783fffb6e0dd8f2c7f02da3463c548c893fffeda91704d2157217a223396b0bb918e4b057eabfb6712a062f893e3021a978d4

Download Submit
\Windows\system\bmIWJlZ.exe

Filesize
1.9MB

MD5
335edd6d5e9cc460660cfb2e1cd5ea9b

SHA1
fd167be1bb29fd7a6c3729ecfc0a35e8dae04274

SHA256
e78649389183ade1b77a1e45983cfa809c977a782de2b77cdc18aaefd5ea3ef5

SHA512
46a83d96956ea53708ed6b729be2c2725d0ac836ba456abf133c65991ff5c2e915ae71ab242642963ed54f87c0595c7a689ca0704b6a87f27623c341b677cc11

Download Submit
\Windows\system\gdNIwZa.exe

Filesize
1.9MB

MD5
76be073071196117c945b98e412ae66f

SHA1
d61c64fc03d7ec037f08bd5f9153913221663993

SHA256
c20631d276091a00abf21b371cc05bade73d85f1bb19c069654262d271413f99

SHA512
2febc15da16f89c3c2c429df0e5ea5d268c239eec6533c35f59bf5ef2f38c7431803eaff835e5dbc2d300e823cf099fadefe4d9182426936dc4c4ac3dd7585e3

Download Submit
\Windows\system\mGaDvTc.exe

Filesize
1.9MB

MD5
11df0cad826e789ed6baeb64d303ddf3

SHA1
50b99ed5a3944fedac4adeb0ea33c3a49955e5d5

SHA256
e61d8b61e084e3ad9c61e5f7c4be841c3f90ef71b8e89594080b2efab44d8309

SHA512
75875c284eeb7e418870544015d29d90f4f4275cdda27da5a03cebe2b8ac1b5442d90fd10b9e65f89cb50b84e279143ef1a3ae685e0f08ca29457db4cd7acd06

Download Submit
\Windows\system\oFJUhRZ.exe

Filesize
1.9MB

MD5
b8746e142c1500a573be0d4dea8eb897

SHA1
c465a42675b9ed902eefe7e8f0ab6b30d9d59379

SHA256
e7623a650e92b6b72215e45313144295b9db29c234ee1d36211c36eccf6d9903

SHA512
eaa4645ce947d4720572a2ff15f68a10c55711996ce6c0264cf129463598d8fd05ae9b1aa2363cf23d24365eab426bff9320849f779b536aaf5e235e70db229d

Download Submit
\Windows\system\obOUJxh.exe

Filesize
1.9MB

MD5
43c27d56e715c77a47d89e157589d848

SHA1
c736b5ee909206d21a18550e519c55158148912c

SHA256
7f04533a5758d67b6aa4e2a7907e417e0d53fc77a0df5ec210211ddbfbece423

SHA512
57d9a0bb8c3757d5d59e10f2688c2f7af8474fd17e81323e73b7363fe511129343796cf18b40cff82a23e69ff70961e0efb8255701290dc41fed07f47c7d5b45

Download Submit
memory/1376-402-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1376-4423-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1504-4417-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1504-400-0x000000013F930000-0x000000013FD22000-memory.dmp

Filesize
3.9MB

Download
memory/1740-401-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/1740-391-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/1740-0-0x000000013FB20000-0x000000013FF12000-memory.dmp

Filesize
3.9MB

Download
memory/1740-404-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/1740-384-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/1740-387-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/1740-381-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/1740-18-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/1740-378-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/1740-372-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/1740-1-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/1740-376-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/1740-398-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/1740-7-0x0000000002D90000-0x0000000003182000-memory.dmp

Filesize
3.9MB

Download
memory/2060-375-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2060-4403-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download
memory/2064-4402-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2064-371-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2364-383-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2364-4409-0x000000013F2A0000-0x000000013F692000-memory.dmp

Filesize
3.9MB

Download
memory/2416-385-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2416-4411-0x000000013FF90000-0x0000000140382000-memory.dmp

Filesize
3.9MB

Download
memory/2536-379-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2536-4408-0x000000013F3D0000-0x000000013F7C2000-memory.dmp

Filesize
3.9MB

Download
memory/2648-374-0x0000000001D90000-0x0000000001D98000-memory.dmp

Filesize
32KB

Download
memory/2648-91-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2648-889-0x000007FEF5B50000-0x000007FEF64ED000-memory.dmp

Filesize
9.6MB

Download
memory/2648-373-0x000000001B6E0000-0x000000001B9C2000-memory.dmp

Filesize
2.9MB

Download
memory/2648-20-0x000007FEF5E0E000-0x000007FEF5E0F000-memory.dmp

Filesize
4KB

Download
memory/2688-4405-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2688-377-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2720-403-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2720-4399-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2796-4413-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2796-388-0x000000013FEF0000-0x00000001402E2000-memory.dmp

Filesize
3.9MB

Download
memory/2812-4416-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2812-397-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2868-11-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download
memory/2868-4397-0x000000013FB30000-0x000000013FF22000-memory.dmp

Filesize
3.9MB

Download