xmrig | 764eceabe8c3f10cee79941066e217f5948da65783ca9bcb2b1f0793d54cf705

Analysis

max time kernel
31s
max time network
31s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
Size

2.1MB
MD5

01ce2ce7f73002278fa46fef14c64444
SHA1

9c4de40b305c774ad1645352a27459c10e819383
SHA256

764eceabe8c3f10cee79941066e217f5948da65783ca9bcb2b1f0793d54cf705
SHA512

006c68a41c4f853300a817c141e7d3c25909aa8599fa5deed6e2b22d6d8f600117875065b04b2a28ae6b94d644a19cd95301255a3e8518b94e43d198331cddff
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHafws1PQ:NABd

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 10 IoCs

miner

resource	yara_rule
behavioral1/memory/2016-37-0x000000013FA40000-0x000000013FE32000-memory.dmp	xmrig
behavioral1/memory/2136-47-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	xmrig
behavioral1/memory/2500-103-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2928-139-0x000000013F780000-0x000000013FB72000-memory.dmp	xmrig
behavioral1/memory/2456-118-0x000000013F190000-0x000000013F582000-memory.dmp	xmrig
behavioral1/memory/2632-100-0x000000013FF30000-0x0000000140322000-memory.dmp	xmrig
behavioral1/memory/2460-99-0x000000013FF70000-0x0000000140362000-memory.dmp	xmrig
behavioral1/memory/2556-96-0x000000013F230000-0x000000013F622000-memory.dmp	xmrig
behavioral1/memory/2600-91-0x000000013FE40000-0x0000000140232000-memory.dmp	xmrig
behavioral1/memory/1820-46-0x000000013FCD0000-0x00000001400C2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2016	JjHjKyx.exe
1820	VZQssOz.exe
2136	MWSdVzi.exe
2600	qLRttjs.exe
2556	VcJwNox.exe
2928	mapCbcY.exe
2460	RGemKby.exe
2632	mwqGZut.exe
2500	KCOKYRo.exe
2456	GJrOaMG.exe
2504	ZBwAMOK.exe
2724	AQGHyRU.exe
2852	ZjpLrMW.exe
2496	wyrZakT.exe
3064	yuUnezR.exe
2428	LlxyUAI.exe
2728	EiEbLDt.exe
3048	NmNSgba.exe
1628	fyOIIyv.exe
1044	YAmUqHM.exe
2324	LATQMWd.exe
924	OBDIroj.exe
2884	CvpvDnR.exe
828	OpjpVcp.exe
1620	yfqtyqS.exe
2152	rVqubKv.exe
1352	JsvsLrS.exe
1368	pztRJOA.exe
944	vOQQoYb.exe
2044	nQhNayk.exe
916	eLQaUbj.exe
2088	ENpcXhY.exe
1632	HOWLhle.exe
2920	qCOQjko.exe
2296	aOTHlOq.exe
1516	OYrNzwh.exe
2188	TOtdNsL.exe
1604	ZWpWbWW.exe
548	XsVkCAC.exe
2912	AZwLiXX.exe
2916	fdmNhtW.exe
2616	LVVMmze.exe
2472	AugclIg.exe
2844	CaDMNrV.exe
1444	KjsBtIN.exe
2548	XNbGMkT.exe
852	DIwPElw.exe
1624	EemRESF.exe
2624	ejRjjwW.exe
2120	TdnVtJF.exe
1272	FaZGCao.exe
2756	NmRBqcE.exe
3100	qKKOUrK.exe
3132	EhzeFXG.exe
3164	FvHKYnk.exe
3196	CyNFOUM.exe
3228	oJmrbre.exe
3260	dHXgKzv.exe
3292	AtDyMUH.exe
3324	dyUPXRO.exe
3356	avpYLYv.exe
3388	LOnMlvd.exe
3420	zBUnZKn.exe
3452	rOZwpaX.exe

Loads dropped DLL 64 IoCs

pid	Process
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2212-1-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x000a000000015cbd-3.dat	upx
behavioral1/files/0x0009000000015d24-9.dat	upx
behavioral1/files/0x0007000000015f3c-8.dat	upx
behavioral1/files/0x001800000000558a-31.dat	upx
behavioral1/memory/2016-37-0x000000013FA40000-0x000000013FE32000-memory.dmp	upx
behavioral1/files/0x000a000000016476-34.dat	upx
behavioral1/files/0x00070000000160cc-25.dat	upx
behavioral1/files/0x0007000000015fa7-30.dat	upx
behavioral1/files/0x0007000000016d05-51.dat	upx
behavioral1/files/0x0006000000016d0e-55.dat	upx
behavioral1/memory/2136-47-0x000000013FBC0000-0x000000013FFB2000-memory.dmp	upx
behavioral1/files/0x0006000000016d16-66.dat	upx
behavioral1/files/0x0006000000016d32-85.dat	upx
behavioral1/files/0x0006000000016e78-110.dat	upx
behavioral1/files/0x00060000000175b2-137.dat	upx
behavioral1/files/0x0005000000019227-186.dat	upx
behavioral1/files/0x00060000000175ac-126.dat	upx
behavioral1/files/0x0005000000019223-183.dat	upx
behavioral1/files/0x00050000000191eb-176.dat	upx
behavioral1/files/0x000500000001874c-169.dat	upx
behavioral1/files/0x0005000000018700-162.dat	upx
behavioral1/files/0x00050000000186c1-155.dat	upx
behavioral1/files/0x0009000000018640-148.dat	upx
behavioral1/files/0x00060000000175b8-141.dat	upx
behavioral1/files/0x0006000000016d9f-122.dat	upx
behavioral1/files/0x00060000000173e5-119.dat	upx
behavioral1/files/0x0006000000016fe8-111.dat	upx
behavioral1/memory/2500-103-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0006000000016db3-101.dat	upx
behavioral1/files/0x00050000000191ed-181.dat	upx
behavioral1/files/0x0006000000018bba-174.dat	upx
behavioral1/files/0x000500000001874a-167.dat	upx
behavioral1/files/0x00050000000186d3-160.dat	upx
behavioral1/files/0x000500000001865a-153.dat	upx
behavioral1/files/0x001500000001863c-146.dat	upx
behavioral1/memory/2928-139-0x000000013F780000-0x000000013FB72000-memory.dmp	upx
behavioral1/files/0x000600000001744c-136.dat	upx
behavioral1/files/0x000600000001739d-135.dat	upx
behavioral1/memory/2456-118-0x000000013F190000-0x000000013F582000-memory.dmp	upx
behavioral1/memory/2632-100-0x000000013FF30000-0x0000000140322000-memory.dmp	upx
behavioral1/memory/2460-99-0x000000013FF70000-0x0000000140362000-memory.dmp	upx
behavioral1/memory/2556-96-0x000000013F230000-0x000000013F622000-memory.dmp	upx
behavioral1/files/0x0006000000016d36-93.dat	upx
behavioral1/memory/2600-91-0x000000013FE40000-0x0000000140232000-memory.dmp	upx
behavioral1/files/0x0006000000016d1f-89.dat	upx
behavioral1/files/0x0006000000016da4-87.dat	upx
behavioral1/files/0x0006000000016d3a-86.dat	upx
behavioral1/memory/1820-46-0x000000013FCD0000-0x00000001400C2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\yZXVRGS.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\FVBOIDH.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\bzygESg.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\vAjjTRw.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\TKpRKGl.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\uLVdEMg.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\MuegAcI.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\XpyTXDn.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\brccmqo.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ENpcXhY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\UOukXQi.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\xWTkmuJ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\mydabsi.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ywaPZCR.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\nukdWip.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ebsqSMi.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\euhZyAk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\UPcBPLF.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\VcJwNox.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\QcZPFIY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\AixqYon.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\KENokHZ.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\AZwLiXX.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\Soysieb.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ZfkPHDX.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\dqrBHBE.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\wNeltrM.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\BgcquAp.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\PKnCIrp.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ibKNHaf.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\xZnPEez.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\SAWpwRv.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\UHTEGFn.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\qUmtuLH.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\WYyajyx.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\GbMxxJg.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\enrKHzv.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\lRFeYMb.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\ZREAFtb.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\TygDwAV.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\oGnstVT.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\qQQqfyE.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\CLUkOrs.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\vLbyREy.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\DqBNFDw.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\NxsczST.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\sTiitVT.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\iEXYvvl.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\oUQBFtk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\SWmdXxj.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\BDyqnEt.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\JKnPBxr.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\JvnuTZk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\lbrNSyY.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\DXeUXIk.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\JjQmEnR.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\uSGoIWH.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\jzCKfDz.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\Ecniiwl.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\pfkiiHN.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\xbPFuVw.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\gHsSwHu.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\Wlmywvp.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
File created	C:\Windows\System\JsvsLrS.exe	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
320	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
Token: SeDebugPrivilege	320	powershell.exe
Token: SeLockMemoryPrivilege	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 320	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	29
PID 2212 wrote to memory of 320	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	29
PID 2212 wrote to memory of 320	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	29
PID 2212 wrote to memory of 1820	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	30
PID 2212 wrote to memory of 1820	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	30
PID 2212 wrote to memory of 1820	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	30
PID 2212 wrote to memory of 2016	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2016	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2016	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	31
PID 2212 wrote to memory of 2136	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2136	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2136	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	32
PID 2212 wrote to memory of 2600	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2600	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2600	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	33
PID 2212 wrote to memory of 2928	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2928	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2928	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	34
PID 2212 wrote to memory of 2556	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2556	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2556	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	35
PID 2212 wrote to memory of 2460	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2460	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2460	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	36
PID 2212 wrote to memory of 2632	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2632	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2632	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	37
PID 2212 wrote to memory of 2500	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2500	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2500	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	38
PID 2212 wrote to memory of 2456	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2456	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2456	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	39
PID 2212 wrote to memory of 2496	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2496	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2496	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	40
PID 2212 wrote to memory of 2504	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	41
PID 2212 wrote to memory of 2504	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	41
PID 2212 wrote to memory of 2504	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	41
PID 2212 wrote to memory of 3064	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	42
PID 2212 wrote to memory of 3064	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	42
PID 2212 wrote to memory of 3064	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	42
PID 2212 wrote to memory of 2724	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	43
PID 2212 wrote to memory of 2724	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	43
PID 2212 wrote to memory of 2724	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	43
PID 2212 wrote to memory of 2728	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	44
PID 2212 wrote to memory of 2728	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	44
PID 2212 wrote to memory of 2728	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	44
PID 2212 wrote to memory of 2852	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	45
PID 2212 wrote to memory of 2852	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	45
PID 2212 wrote to memory of 2852	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	45
PID 2212 wrote to memory of 2984	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	46
PID 2212 wrote to memory of 2984	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	46
PID 2212 wrote to memory of 2984	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	46
PID 2212 wrote to memory of 2428	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	47
PID 2212 wrote to memory of 2428	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	47
PID 2212 wrote to memory of 2428	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	47
PID 2212 wrote to memory of 2864	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	48
PID 2212 wrote to memory of 2864	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	48
PID 2212 wrote to memory of 2864	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	48
PID 2212 wrote to memory of 3048	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	49
PID 2212 wrote to memory of 3048	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	49
PID 2212 wrote to memory of 3048	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	49
PID 2212 wrote to memory of 2180	2212	01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\01ce2ce7f73002278fa46fef14c64444_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Windows\System\VZQssOz.exe
  C:\Windows\System\VZQssOz.exe
  2⤵
  - Executes dropped EXE
  PID:1820
- C:\Windows\System\JjHjKyx.exe
  C:\Windows\System\JjHjKyx.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\MWSdVzi.exe
  C:\Windows\System\MWSdVzi.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\qLRttjs.exe
  C:\Windows\System\qLRttjs.exe
  2⤵
  - Executes dropped EXE
  PID:2600
- C:\Windows\System\mapCbcY.exe
  C:\Windows\System\mapCbcY.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\VcJwNox.exe
  C:\Windows\System\VcJwNox.exe
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Windows\System\RGemKby.exe
  C:\Windows\System\RGemKby.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\mwqGZut.exe
  C:\Windows\System\mwqGZut.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\KCOKYRo.exe
  C:\Windows\System\KCOKYRo.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\GJrOaMG.exe
  C:\Windows\System\GJrOaMG.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\wyrZakT.exe
  C:\Windows\System\wyrZakT.exe
  2⤵
  - Executes dropped EXE
  PID:2496
- C:\Windows\System\ZBwAMOK.exe
  C:\Windows\System\ZBwAMOK.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\yuUnezR.exe
  C:\Windows\System\yuUnezR.exe
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Windows\System\AQGHyRU.exe
  C:\Windows\System\AQGHyRU.exe
  2⤵
  - Executes dropped EXE
  PID:2724
- C:\Windows\System\EiEbLDt.exe
  C:\Windows\System\EiEbLDt.exe
  2⤵
  - Executes dropped EXE
  PID:2728
- C:\Windows\System\ZjpLrMW.exe
  C:\Windows\System\ZjpLrMW.exe
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Windows\System\Wlmywvp.exe
  C:\Windows\System\Wlmywvp.exe
  2⤵
  PID:2984
- C:\Windows\System\LlxyUAI.exe
  C:\Windows\System\LlxyUAI.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\bpNouiL.exe
  C:\Windows\System\bpNouiL.exe
  2⤵
  PID:2864
- C:\Windows\System\NmNSgba.exe
  C:\Windows\System\NmNSgba.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\ZhJJJOy.exe
  C:\Windows\System\ZhJJJOy.exe
  2⤵
  PID:2180
- C:\Windows\System\fyOIIyv.exe
  C:\Windows\System\fyOIIyv.exe
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\System\qkTvhjU.exe
  C:\Windows\System\qkTvhjU.exe
  2⤵
  PID:1536
- C:\Windows\System\YAmUqHM.exe
  C:\Windows\System\YAmUqHM.exe
  2⤵
  - Executes dropped EXE
  PID:1044
- C:\Windows\System\HQRsUvg.exe
  C:\Windows\System\HQRsUvg.exe
  2⤵
  PID:1732
- C:\Windows\System\LATQMWd.exe
  C:\Windows\System\LATQMWd.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\iSssAxX.exe
  C:\Windows\System\iSssAxX.exe
  2⤵
  PID:712
- C:\Windows\System\OBDIroj.exe
  C:\Windows\System\OBDIroj.exe
  2⤵
  - Executes dropped EXE
  PID:924
- C:\Windows\System\lxjqbFT.exe
  C:\Windows\System\lxjqbFT.exe
  2⤵
  PID:1496
- C:\Windows\System\CvpvDnR.exe
  C:\Windows\System\CvpvDnR.exe
  2⤵
  - Executes dropped EXE
  PID:2884
- C:\Windows\System\JvGuRMu.exe
  C:\Windows\System\JvGuRMu.exe
  2⤵
  PID:1008
- C:\Windows\System\OpjpVcp.exe
  C:\Windows\System\OpjpVcp.exe
  2⤵
  - Executes dropped EXE
  PID:828
- C:\Windows\System\rlORjCS.exe
  C:\Windows\System\rlORjCS.exe
  2⤵
  PID:2424
- C:\Windows\System\yfqtyqS.exe
  C:\Windows\System\yfqtyqS.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\SOhppfN.exe
  C:\Windows\System\SOhppfN.exe
  2⤵
  PID:1152
- C:\Windows\System\rVqubKv.exe
  C:\Windows\System\rVqubKv.exe
  2⤵
  - Executes dropped EXE
  PID:2152
- C:\Windows\System\QCdOHWT.exe
  C:\Windows\System\QCdOHWT.exe
  2⤵
  PID:2340
- C:\Windows\System\JsvsLrS.exe
  C:\Windows\System\JsvsLrS.exe
  2⤵
  - Executes dropped EXE
  PID:1352
- C:\Windows\System\LTxevBl.exe
  C:\Windows\System\LTxevBl.exe
  2⤵
  PID:1548
- C:\Windows\System\pztRJOA.exe
  C:\Windows\System\pztRJOA.exe
  2⤵
  - Executes dropped EXE
  PID:1368
- C:\Windows\System\GYfGMzW.exe
  C:\Windows\System\GYfGMzW.exe
  2⤵
  PID:808
- C:\Windows\System\vOQQoYb.exe
  C:\Windows\System\vOQQoYb.exe
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Windows\System\hvhiCDL.exe
  C:\Windows\System\hvhiCDL.exe
  2⤵
  PID:1068
- C:\Windows\System\nQhNayk.exe
  C:\Windows\System\nQhNayk.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\mQGJlQs.exe
  C:\Windows\System\mQGJlQs.exe
  2⤵
  PID:1676
- C:\Windows\System\eLQaUbj.exe
  C:\Windows\System\eLQaUbj.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\fDFTDuN.exe
  C:\Windows\System\fDFTDuN.exe
  2⤵
  PID:1828
- C:\Windows\System\ENpcXhY.exe
  C:\Windows\System\ENpcXhY.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\WGXjDky.exe
  C:\Windows\System\WGXjDky.exe
  2⤵
  PID:2380
- C:\Windows\System\HOWLhle.exe
  C:\Windows\System\HOWLhle.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\hqLDUfU.exe
  C:\Windows\System\hqLDUfU.exe
  2⤵
  PID:2320
- C:\Windows\System\qCOQjko.exe
  C:\Windows\System\qCOQjko.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\eLWaKSS.exe
  C:\Windows\System\eLWaKSS.exe
  2⤵
  PID:2304
- C:\Windows\System\aOTHlOq.exe
  C:\Windows\System\aOTHlOq.exe
  2⤵
  - Executes dropped EXE
  PID:2296
- C:\Windows\System\scJhXxl.exe
  C:\Windows\System\scJhXxl.exe
  2⤵
  PID:2348
- C:\Windows\System\OYrNzwh.exe
  C:\Windows\System\OYrNzwh.exe
  2⤵
  - Executes dropped EXE
  PID:1516
- C:\Windows\System\DcHkKeq.exe
  C:\Windows\System\DcHkKeq.exe
  2⤵
  PID:1932
- C:\Windows\System\TOtdNsL.exe
  C:\Windows\System\TOtdNsL.exe
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\System\QVvcsin.exe
  C:\Windows\System\QVvcsin.exe
  2⤵
  PID:1800
- C:\Windows\System\ZWpWbWW.exe
  C:\Windows\System\ZWpWbWW.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\ccDbDQL.exe
  C:\Windows\System\ccDbDQL.exe
  2⤵
  PID:1724
- C:\Windows\System\XsVkCAC.exe
  C:\Windows\System\XsVkCAC.exe
  2⤵
  - Executes dropped EXE
  PID:548
- C:\Windows\System\msNCBXo.exe
  C:\Windows\System\msNCBXo.exe
  2⤵
  PID:2328
- C:\Windows\System\AZwLiXX.exe
  C:\Windows\System\AZwLiXX.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\yIWHexZ.exe
  C:\Windows\System\yIWHexZ.exe
  2⤵
  PID:2672
- C:\Windows\System\fdmNhtW.exe
  C:\Windows\System\fdmNhtW.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\fYNrgBv.exe
  C:\Windows\System\fYNrgBv.exe
  2⤵
  PID:2748
- C:\Windows\System\LVVMmze.exe
  C:\Windows\System\LVVMmze.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\BEgcheR.exe
  C:\Windows\System\BEgcheR.exe
  2⤵
  PID:2688
- C:\Windows\System\AugclIg.exe
  C:\Windows\System\AugclIg.exe
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Windows\System\GpRtslT.exe
  C:\Windows\System\GpRtslT.exe
  2⤵
  PID:3020
- C:\Windows\System\CaDMNrV.exe
  C:\Windows\System\CaDMNrV.exe
  2⤵
  - Executes dropped EXE
  PID:2844
- C:\Windows\System\oNAjBtB.exe
  C:\Windows\System\oNAjBtB.exe
  2⤵
  PID:3044
- C:\Windows\System\KjsBtIN.exe
  C:\Windows\System\KjsBtIN.exe
  2⤵
  - Executes dropped EXE
  PID:1444
- C:\Windows\System\JlEAEUK.exe
  C:\Windows\System\JlEAEUK.exe
  2⤵
  PID:1532
- C:\Windows\System\XNbGMkT.exe
  C:\Windows\System\XNbGMkT.exe
  2⤵
  - Executes dropped EXE
  PID:2548
- C:\Windows\System\WVIuDVr.exe
  C:\Windows\System\WVIuDVr.exe
  2⤵
  PID:592
- C:\Windows\System\DIwPElw.exe
  C:\Windows\System\DIwPElw.exe
  2⤵
  - Executes dropped EXE
  PID:852
- C:\Windows\System\Vzhaicn.exe
  C:\Windows\System\Vzhaicn.exe
  2⤵
  PID:2316
- C:\Windows\System\EemRESF.exe
  C:\Windows\System\EemRESF.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\WvwAMVB.exe
  C:\Windows\System\WvwAMVB.exe
  2⤵
  PID:1404
- C:\Windows\System\ejRjjwW.exe
  C:\Windows\System\ejRjjwW.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\pogLaKT.exe
  C:\Windows\System\pogLaKT.exe
  2⤵
  PID:2360
- C:\Windows\System\TdnVtJF.exe
  C:\Windows\System\TdnVtJF.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\gptpWum.exe
  C:\Windows\System\gptpWum.exe
  2⤵
  PID:2060
- C:\Windows\System\FaZGCao.exe
  C:\Windows\System\FaZGCao.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\YfrZiSI.exe
  C:\Windows\System\YfrZiSI.exe
  2⤵
  PID:2368
- C:\Windows\System\NmRBqcE.exe
  C:\Windows\System\NmRBqcE.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\RoXVYfE.exe
  C:\Windows\System\RoXVYfE.exe
  2⤵
  PID:3084
- C:\Windows\System\qKKOUrK.exe
  C:\Windows\System\qKKOUrK.exe
  2⤵
  - Executes dropped EXE
  PID:3100
- C:\Windows\System\ZfkPHDX.exe
  C:\Windows\System\ZfkPHDX.exe
  2⤵
  PID:3116
- C:\Windows\System\EhzeFXG.exe
  C:\Windows\System\EhzeFXG.exe
  2⤵
  - Executes dropped EXE
  PID:3132
- C:\Windows\System\GndzDkp.exe
  C:\Windows\System\GndzDkp.exe
  2⤵
  PID:3148
- C:\Windows\System\FvHKYnk.exe
  C:\Windows\System\FvHKYnk.exe
  2⤵
  - Executes dropped EXE
  PID:3164
- C:\Windows\System\hbDrtcW.exe
  C:\Windows\System\hbDrtcW.exe
  2⤵
  PID:3180
- C:\Windows\System\CyNFOUM.exe
  C:\Windows\System\CyNFOUM.exe
  2⤵
  - Executes dropped EXE
  PID:3196
- C:\Windows\System\sVJDeru.exe
  C:\Windows\System\sVJDeru.exe
  2⤵
  PID:3212
- C:\Windows\System\oJmrbre.exe
  C:\Windows\System\oJmrbre.exe
  2⤵
  - Executes dropped EXE
  PID:3228
- C:\Windows\System\WZevCPB.exe
  C:\Windows\System\WZevCPB.exe
  2⤵
  PID:3244
- C:\Windows\System\dHXgKzv.exe
  C:\Windows\System\dHXgKzv.exe
  2⤵
  - Executes dropped EXE
  PID:3260
- C:\Windows\System\SnfSxjx.exe
  C:\Windows\System\SnfSxjx.exe
  2⤵
  PID:3276
- C:\Windows\System\AtDyMUH.exe
  C:\Windows\System\AtDyMUH.exe
  2⤵
  - Executes dropped EXE
  PID:3292
- C:\Windows\System\akTJBHV.exe
  C:\Windows\System\akTJBHV.exe
  2⤵
  PID:3308
- C:\Windows\System\dyUPXRO.exe
  C:\Windows\System\dyUPXRO.exe
  2⤵
  - Executes dropped EXE
  PID:3324
- C:\Windows\System\GmwHMKi.exe
  C:\Windows\System\GmwHMKi.exe
  2⤵
  PID:3340
- C:\Windows\System\avpYLYv.exe
  C:\Windows\System\avpYLYv.exe
  2⤵
  - Executes dropped EXE
  PID:3356
- C:\Windows\System\lJOjkjP.exe
  C:\Windows\System\lJOjkjP.exe
  2⤵
  PID:3372
- C:\Windows\System\LOnMlvd.exe
  C:\Windows\System\LOnMlvd.exe
  2⤵
  - Executes dropped EXE
  PID:3388
- C:\Windows\System\DEzMjAU.exe
  C:\Windows\System\DEzMjAU.exe
  2⤵
  PID:3404
- C:\Windows\System\zBUnZKn.exe
  C:\Windows\System\zBUnZKn.exe
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\System\fEOEIbk.exe
  C:\Windows\System\fEOEIbk.exe
  2⤵
  PID:3436
- C:\Windows\System\rOZwpaX.exe
  C:\Windows\System\rOZwpaX.exe
  2⤵
  - Executes dropped EXE
  PID:3452
- C:\Windows\System\ugdvUjv.exe
  C:\Windows\System\ugdvUjv.exe
  2⤵
  PID:3468
- C:\Windows\System\TsMrWPT.exe
  C:\Windows\System\TsMrWPT.exe
  2⤵
  PID:3484
- C:\Windows\System\oXPxaZj.exe
  C:\Windows\System\oXPxaZj.exe
  2⤵
  PID:3500
- C:\Windows\System\gxJVheg.exe
  C:\Windows\System\gxJVheg.exe
  2⤵
  PID:3516
- C:\Windows\System\QOVXXWD.exe
  C:\Windows\System\QOVXXWD.exe
  2⤵
  PID:3532
- C:\Windows\System\QeOfoCg.exe
  C:\Windows\System\QeOfoCg.exe
  2⤵
  PID:3548
- C:\Windows\System\zNcIvjh.exe
  C:\Windows\System\zNcIvjh.exe
  2⤵
  PID:3564
- C:\Windows\System\gqjKRvT.exe
  C:\Windows\System\gqjKRvT.exe
  2⤵
  PID:3580
- C:\Windows\System\oNYRxlR.exe
  C:\Windows\System\oNYRxlR.exe
  2⤵
  PID:3596
- C:\Windows\System\oQMVZog.exe
  C:\Windows\System\oQMVZog.exe
  2⤵
  PID:3612
- C:\Windows\System\fIuFbzc.exe
  C:\Windows\System\fIuFbzc.exe
  2⤵
  PID:3628
- C:\Windows\System\VkYwITd.exe
  C:\Windows\System\VkYwITd.exe
  2⤵
  PID:3644
- C:\Windows\System\jTSnVUU.exe
  C:\Windows\System\jTSnVUU.exe
  2⤵
  PID:3660
- C:\Windows\System\sbWIxrl.exe
  C:\Windows\System\sbWIxrl.exe
  2⤵
  PID:3676
- C:\Windows\System\hYWpKoB.exe
  C:\Windows\System\hYWpKoB.exe
  2⤵
  PID:3692
- C:\Windows\System\gQNwLjO.exe
  C:\Windows\System\gQNwLjO.exe
  2⤵
  PID:3708
- C:\Windows\System\gXZbjSj.exe
  C:\Windows\System\gXZbjSj.exe
  2⤵
  PID:3724
- C:\Windows\System\SYbTBEF.exe
  C:\Windows\System\SYbTBEF.exe
  2⤵
  PID:3740
- C:\Windows\System\MInYzHS.exe
  C:\Windows\System\MInYzHS.exe
  2⤵
  PID:3756
- C:\Windows\System\EvXwGxk.exe
  C:\Windows\System\EvXwGxk.exe
  2⤵
  PID:3772
- C:\Windows\System\ibKNHaf.exe
  C:\Windows\System\ibKNHaf.exe
  2⤵
  PID:3788
- C:\Windows\System\fzRgoyy.exe
  C:\Windows\System\fzRgoyy.exe
  2⤵
  PID:3804
- C:\Windows\System\bfaBxBU.exe
  C:\Windows\System\bfaBxBU.exe
  2⤵
  PID:3820
- C:\Windows\System\sOjpBsR.exe
  C:\Windows\System\sOjpBsR.exe
  2⤵
  PID:3836
- C:\Windows\System\XNTdwOt.exe
  C:\Windows\System\XNTdwOt.exe
  2⤵
  PID:3852
- C:\Windows\System\IzUSREV.exe
  C:\Windows\System\IzUSREV.exe
  2⤵
  PID:3868
- C:\Windows\System\gjkKKAu.exe
  C:\Windows\System\gjkKKAu.exe
  2⤵
  PID:3884
- C:\Windows\System\Ncwxiwb.exe
  C:\Windows\System\Ncwxiwb.exe
  2⤵
  PID:3900
- C:\Windows\System\IFPzfjZ.exe
  C:\Windows\System\IFPzfjZ.exe
  2⤵
  PID:3916
- C:\Windows\System\KZTIwKE.exe
  C:\Windows\System\KZTIwKE.exe
  2⤵
  PID:3932
- C:\Windows\System\dckKHrQ.exe
  C:\Windows\System\dckKHrQ.exe
  2⤵
  PID:3948
- C:\Windows\System\uVyxFnm.exe
  C:\Windows\System\uVyxFnm.exe
  2⤵
  PID:3964
- C:\Windows\System\SlOGeGo.exe
  C:\Windows\System\SlOGeGo.exe
  2⤵
  PID:3980
- C:\Windows\System\qNhLbWJ.exe
  C:\Windows\System\qNhLbWJ.exe
  2⤵
  PID:3996
- C:\Windows\System\KhGIPNI.exe
  C:\Windows\System\KhGIPNI.exe
  2⤵
  PID:4012
- C:\Windows\System\ZIaFssn.exe
  C:\Windows\System\ZIaFssn.exe
  2⤵
  PID:4028
- C:\Windows\System\aTDsDRY.exe
  C:\Windows\System\aTDsDRY.exe
  2⤵
  PID:4044
- C:\Windows\System\TiMImrI.exe
  C:\Windows\System\TiMImrI.exe
  2⤵
  PID:4060
- C:\Windows\System\tGoItzT.exe
  C:\Windows\System\tGoItzT.exe
  2⤵
  PID:4076
- C:\Windows\System\UtyouVq.exe
  C:\Windows\System\UtyouVq.exe
  2⤵
  PID:4092
- C:\Windows\System\sTiitVT.exe
  C:\Windows\System\sTiitVT.exe
  2⤵
  PID:2824
- C:\Windows\System\KeNIhws.exe
  C:\Windows\System\KeNIhws.exe
  2⤵
  PID:3028
- C:\Windows\System\zwWlyUt.exe
  C:\Windows\System\zwWlyUt.exe
  2⤵
  PID:1064
- C:\Windows\System\idQYFfF.exe
  C:\Windows\System\idQYFfF.exe
  2⤵
  PID:2264
- C:\Windows\System\WXyvfdQ.exe
  C:\Windows\System\WXyvfdQ.exe
  2⤵
  PID:1608
- C:\Windows\System\kjOHnwq.exe
  C:\Windows\System\kjOHnwq.exe
  2⤵
  PID:3108
- C:\Windows\System\gTMxkqp.exe
  C:\Windows\System\gTMxkqp.exe
  2⤵
  PID:3144
- C:\Windows\System\dUSbicX.exe
  C:\Windows\System\dUSbicX.exe
  2⤵
  PID:3208
- C:\Windows\System\dnlVgwt.exe
  C:\Windows\System\dnlVgwt.exe
  2⤵
  PID:3272
- C:\Windows\System\JmdYxEj.exe
  C:\Windows\System\JmdYxEj.exe
  2⤵
  PID:3336
- C:\Windows\System\AtlXjGj.exe
  C:\Windows\System\AtlXjGj.exe
  2⤵
  PID:3400
- C:\Windows\System\StKebqn.exe
  C:\Windows\System\StKebqn.exe
  2⤵
  PID:3464
- C:\Windows\System\mlIczLs.exe
  C:\Windows\System\mlIczLs.exe
  2⤵
  PID:3528
- C:\Windows\System\TGQscOL.exe
  C:\Windows\System\TGQscOL.exe
  2⤵
  PID:3592
- C:\Windows\System\VYKNZKN.exe
  C:\Windows\System\VYKNZKN.exe
  2⤵
  PID:3656
- C:\Windows\System\AumTVsu.exe
  C:\Windows\System\AumTVsu.exe
  2⤵
  PID:3720
- C:\Windows\System\PjZpSWS.exe
  C:\Windows\System\PjZpSWS.exe
  2⤵
  PID:3784
- C:\Windows\System\DmEjyLY.exe
  C:\Windows\System\DmEjyLY.exe
  2⤵
  PID:3848
- C:\Windows\System\vOGWufQ.exe
  C:\Windows\System\vOGWufQ.exe
  2⤵
  PID:3912
- C:\Windows\System\bXObWaw.exe
  C:\Windows\System\bXObWaw.exe
  2⤵
  PID:3976
- C:\Windows\System\adMIlIG.exe
  C:\Windows\System\adMIlIG.exe
  2⤵
  PID:4040
- C:\Windows\System\MLpocqP.exe
  C:\Windows\System\MLpocqP.exe
  2⤵
  PID:1508
- C:\Windows\System\YQlWWyD.exe
  C:\Windows\System\YQlWWyD.exe
  2⤵
  PID:1440
- C:\Windows\System\ggtGmnY.exe
  C:\Windows\System\ggtGmnY.exe
  2⤵
  PID:3268
- C:\Windows\System\qaEUDlo.exe
  C:\Windows\System\qaEUDlo.exe
  2⤵
  PID:4104
- C:\Windows\System\NzIbIXA.exe
  C:\Windows\System\NzIbIXA.exe
  2⤵
  PID:4120
- C:\Windows\System\OoHydbO.exe
  C:\Windows\System\OoHydbO.exe
  2⤵
  PID:4136
- C:\Windows\System\CLUkOrs.exe
  C:\Windows\System\CLUkOrs.exe
  2⤵
  PID:4152
- C:\Windows\System\tPnjgdZ.exe
  C:\Windows\System\tPnjgdZ.exe
  2⤵
  PID:4168
- C:\Windows\System\OGjYZIS.exe
  C:\Windows\System\OGjYZIS.exe
  2⤵
  PID:4184
- C:\Windows\System\GJzblyk.exe
  C:\Windows\System\GJzblyk.exe
  2⤵
  PID:4200
- C:\Windows\System\ZKnVTVj.exe
  C:\Windows\System\ZKnVTVj.exe
  2⤵
  PID:4216
- C:\Windows\System\sqhaNKE.exe
  C:\Windows\System\sqhaNKE.exe
  2⤵
  PID:4232
- C:\Windows\System\kLmHKly.exe
  C:\Windows\System\kLmHKly.exe
  2⤵
  PID:4248
- C:\Windows\System\wodwKsW.exe
  C:\Windows\System\wodwKsW.exe
  2⤵
  PID:4264
- C:\Windows\System\xZnPEez.exe
  C:\Windows\System\xZnPEez.exe
  2⤵
  PID:4280
- C:\Windows\System\LgIHbwN.exe
  C:\Windows\System\LgIHbwN.exe
  2⤵
  PID:4296
- C:\Windows\System\hRjpnfz.exe
  C:\Windows\System\hRjpnfz.exe
  2⤵
  PID:4312
- C:\Windows\System\pfkiiHN.exe
  C:\Windows\System\pfkiiHN.exe
  2⤵
  PID:4328
- C:\Windows\System\dleAzXG.exe
  C:\Windows\System\dleAzXG.exe
  2⤵
  PID:4344
- C:\Windows\System\xqyANtT.exe
  C:\Windows\System\xqyANtT.exe
  2⤵
  PID:4360
- C:\Windows\System\IBonYDA.exe
  C:\Windows\System\IBonYDA.exe
  2⤵
  PID:4376
- C:\Windows\System\rRMLmYC.exe
  C:\Windows\System\rRMLmYC.exe
  2⤵
  PID:4392
- C:\Windows\System\VlitoBe.exe
  C:\Windows\System\VlitoBe.exe
  2⤵
  PID:4408
- C:\Windows\System\RhfElrT.exe
  C:\Windows\System\RhfElrT.exe
  2⤵
  PID:4424
- C:\Windows\System\WbmNNRc.exe
  C:\Windows\System\WbmNNRc.exe
  2⤵
  PID:4440
- C:\Windows\System\tZkWczL.exe
  C:\Windows\System\tZkWczL.exe
  2⤵
  PID:4456
- C:\Windows\System\EjvdaBv.exe
  C:\Windows\System\EjvdaBv.exe
  2⤵
  PID:4472
- C:\Windows\System\NjvDJWI.exe
  C:\Windows\System\NjvDJWI.exe
  2⤵
  PID:4488
- C:\Windows\System\sUDOsff.exe
  C:\Windows\System\sUDOsff.exe
  2⤵
  PID:4504
- C:\Windows\System\lmvLskk.exe
  C:\Windows\System\lmvLskk.exe
  2⤵
  PID:4520
- C:\Windows\System\vrudmpG.exe
  C:\Windows\System\vrudmpG.exe
  2⤵
  PID:4536
- C:\Windows\System\EnJLPox.exe
  C:\Windows\System\EnJLPox.exe
  2⤵
  PID:4552
- C:\Windows\System\lQrGGNP.exe
  C:\Windows\System\lQrGGNP.exe
  2⤵
  PID:4568
- C:\Windows\System\aQfGnXV.exe
  C:\Windows\System\aQfGnXV.exe
  2⤵
  PID:4584
- C:\Windows\System\SjSlLDn.exe
  C:\Windows\System\SjSlLDn.exe
  2⤵
  PID:4600
- C:\Windows\System\WWmpOoL.exe
  C:\Windows\System\WWmpOoL.exe
  2⤵
  PID:4616
- C:\Windows\System\KSbeipI.exe
  C:\Windows\System\KSbeipI.exe
  2⤵
  PID:4632
- C:\Windows\System\sEKUgJm.exe
  C:\Windows\System\sEKUgJm.exe
  2⤵
  PID:4648
- C:\Windows\System\HyjaGxg.exe
  C:\Windows\System\HyjaGxg.exe
  2⤵
  PID:4664
- C:\Windows\System\JrNlEdH.exe
  C:\Windows\System\JrNlEdH.exe
  2⤵
  PID:4680
- C:\Windows\System\Vidvkmb.exe
  C:\Windows\System\Vidvkmb.exe
  2⤵
  PID:4696
- C:\Windows\System\WQGAnJq.exe
  C:\Windows\System\WQGAnJq.exe
  2⤵
  PID:4712
- C:\Windows\System\mibfLNE.exe
  C:\Windows\System\mibfLNE.exe
  2⤵
  PID:4728
- C:\Windows\System\aeaPRMt.exe
  C:\Windows\System\aeaPRMt.exe
  2⤵
  PID:4744
- C:\Windows\System\FALfJcO.exe
  C:\Windows\System\FALfJcO.exe
  2⤵
  PID:4760
- C:\Windows\System\mQxiKQU.exe
  C:\Windows\System\mQxiKQU.exe
  2⤵
  PID:4776
- C:\Windows\System\YEivwtP.exe
  C:\Windows\System\YEivwtP.exe
  2⤵
  PID:4792
- C:\Windows\System\XtKeADs.exe
  C:\Windows\System\XtKeADs.exe
  2⤵
  PID:4808
- C:\Windows\System\DXeUXIk.exe
  C:\Windows\System\DXeUXIk.exe
  2⤵
  PID:4824
- C:\Windows\System\kyfrZif.exe
  C:\Windows\System\kyfrZif.exe
  2⤵
  PID:4840
- C:\Windows\System\ZUuArAA.exe
  C:\Windows\System\ZUuArAA.exe
  2⤵
  PID:4856
- C:\Windows\System\CmaMPgL.exe
  C:\Windows\System\CmaMPgL.exe
  2⤵
  PID:4872
- C:\Windows\System\zjLXHoZ.exe
  C:\Windows\System\zjLXHoZ.exe
  2⤵
  PID:4888
- C:\Windows\System\gbIVImB.exe
  C:\Windows\System\gbIVImB.exe
  2⤵
  PID:4904
- C:\Windows\System\TKpRKGl.exe
  C:\Windows\System\TKpRKGl.exe
  2⤵
  PID:4920
- C:\Windows\System\sBlhtgo.exe
  C:\Windows\System\sBlhtgo.exe
  2⤵
  PID:4936
- C:\Windows\System\WWqHGWB.exe
  C:\Windows\System\WWqHGWB.exe
  2⤵
  PID:4952
- C:\Windows\System\VcfqPup.exe
  C:\Windows\System\VcfqPup.exe
  2⤵
  PID:4968
- C:\Windows\System\hhWGvCW.exe
  C:\Windows\System\hhWGvCW.exe
  2⤵
  PID:4984
- C:\Windows\System\rbosCYR.exe
  C:\Windows\System\rbosCYR.exe
  2⤵
  PID:5000
- C:\Windows\System\qiXwSCK.exe
  C:\Windows\System\qiXwSCK.exe
  2⤵
  PID:5016
- C:\Windows\System\nMIFpLC.exe
  C:\Windows\System\nMIFpLC.exe
  2⤵
  PID:5032
- C:\Windows\System\jITPRKX.exe
  C:\Windows\System\jITPRKX.exe
  2⤵
  PID:5048
- C:\Windows\System\vwcwEok.exe
  C:\Windows\System\vwcwEok.exe
  2⤵
  PID:5064
- C:\Windows\System\CFYmZcl.exe
  C:\Windows\System\CFYmZcl.exe
  2⤵
  PID:5080
- C:\Windows\System\MwxRyjN.exe
  C:\Windows\System\MwxRyjN.exe
  2⤵
  PID:5096
- C:\Windows\System\fkYmkUC.exe
  C:\Windows\System\fkYmkUC.exe
  2⤵
  PID:5112
- C:\Windows\System\uLVdEMg.exe
  C:\Windows\System\uLVdEMg.exe
  2⤵
  PID:3652
- C:\Windows\System\tdotWou.exe
  C:\Windows\System\tdotWou.exe
  2⤵
  PID:3880
- C:\Windows\System\xMBxIIH.exe
  C:\Windows\System\xMBxIIH.exe
  2⤵
  PID:452
- C:\Windows\System\VqNDYIq.exe
  C:\Windows\System\VqNDYIq.exe
  2⤵
  PID:4128
- C:\Windows\System\PJBxNMV.exe
  C:\Windows\System\PJBxNMV.exe
  2⤵
  PID:4192
- C:\Windows\System\AFcutwy.exe
  C:\Windows\System\AFcutwy.exe
  2⤵
  PID:4256
- C:\Windows\System\qZkfqDF.exe
  C:\Windows\System\qZkfqDF.exe
  2⤵
  PID:4320
- C:\Windows\System\QcZPFIY.exe
  C:\Windows\System\QcZPFIY.exe
  2⤵
  PID:4384
- C:\Windows\System\VyYIIcx.exe
  C:\Windows\System\VyYIIcx.exe
  2⤵
  PID:4448
- C:\Windows\System\BfkASdt.exe
  C:\Windows\System\BfkASdt.exe
  2⤵
  PID:4512
- C:\Windows\System\ybiWVQp.exe
  C:\Windows\System\ybiWVQp.exe
  2⤵
  PID:4576
- C:\Windows\System\NyUSZPd.exe
  C:\Windows\System\NyUSZPd.exe
  2⤵
  PID:4640
- C:\Windows\System\OiGNOTs.exe
  C:\Windows\System\OiGNOTs.exe
  2⤵
  PID:4704
- C:\Windows\System\vmqmfhQ.exe
  C:\Windows\System\vmqmfhQ.exe
  2⤵
  PID:4768
- C:\Windows\System\JjQmEnR.exe
  C:\Windows\System\JjQmEnR.exe
  2⤵
  PID:4804
- C:\Windows\System\BsamYGz.exe
  C:\Windows\System\BsamYGz.exe
  2⤵
  PID:4868
- C:\Windows\System\KogdeFv.exe
  C:\Windows\System\KogdeFv.exe
  2⤵
  PID:4932
- C:\Windows\System\rUvtAtR.exe
  C:\Windows\System\rUvtAtR.exe
  2⤵
  PID:4996
- C:\Windows\System\xPltVeI.exe
  C:\Windows\System\xPltVeI.exe
  2⤵
  PID:5056
- C:\Windows\System\PmiCwqm.exe
  C:\Windows\System\PmiCwqm.exe
  2⤵
  PID:3496
- C:\Windows\System\enrKHzv.exe
  C:\Windows\System\enrKHzv.exe
  2⤵
  PID:4160
- C:\Windows\System\dkRvTWI.exe
  C:\Windows\System\dkRvTWI.exe
  2⤵
  PID:4416
- C:\Windows\System\yjXbtOW.exe
  C:\Windows\System\yjXbtOW.exe
  2⤵
  PID:4900
- C:\Windows\System\mSdjKNn.exe
  C:\Windows\System\mSdjKNn.exe
  2⤵
  PID:4544
- C:\Windows\System\ASIDUiP.exe
  C:\Windows\System\ASIDUiP.exe
  2⤵
  PID:5132
- C:\Windows\System\eHtZPGp.exe
  C:\Windows\System\eHtZPGp.exe
  2⤵
  PID:5176
- C:\Windows\System\EvZDTjm.exe
  C:\Windows\System\EvZDTjm.exe
  2⤵
  PID:5192
- C:\Windows\System\xWhuwUI.exe
  C:\Windows\System\xWhuwUI.exe
  2⤵
  PID:5208
- C:\Windows\System\GnHWcCO.exe
  C:\Windows\System\GnHWcCO.exe
  2⤵
  PID:5232
- C:\Windows\System\BUAESCZ.exe
  C:\Windows\System\BUAESCZ.exe
  2⤵
  PID:5268
- C:\Windows\System\DYUfdgA.exe
  C:\Windows\System\DYUfdgA.exe
  2⤵
  PID:5304
- C:\Windows\System\heIfdAZ.exe
  C:\Windows\System\heIfdAZ.exe
  2⤵
  PID:5332
- C:\Windows\System\rnTolUQ.exe
  C:\Windows\System\rnTolUQ.exe
  2⤵
  PID:5348
- C:\Windows\System\bIYzirt.exe
  C:\Windows\System\bIYzirt.exe
  2⤵
  PID:5364
- C:\Windows\System\FseiCkK.exe
  C:\Windows\System\FseiCkK.exe
  2⤵
  PID:5380
- C:\Windows\System\OscbGwI.exe
  C:\Windows\System\OscbGwI.exe
  2⤵
  PID:5396
- C:\Windows\System\nEKkhbz.exe
  C:\Windows\System\nEKkhbz.exe
  2⤵
  PID:5412
- C:\Windows\System\nlXXYWx.exe
  C:\Windows\System\nlXXYWx.exe
  2⤵
  PID:5428
- C:\Windows\System\UxGIrIr.exe
  C:\Windows\System\UxGIrIr.exe
  2⤵
  PID:5444
- C:\Windows\System\awYInhb.exe
  C:\Windows\System\awYInhb.exe
  2⤵
  PID:5460
- C:\Windows\System\pkEtXNi.exe
  C:\Windows\System\pkEtXNi.exe
  2⤵
  PID:5476
- C:\Windows\System\pkcCCYi.exe
  C:\Windows\System\pkcCCYi.exe
  2⤵
  PID:5492
- C:\Windows\System\cFuRRQX.exe
  C:\Windows\System\cFuRRQX.exe
  2⤵
  PID:5508
- C:\Windows\System\CvVHVcN.exe
  C:\Windows\System\CvVHVcN.exe
  2⤵
  PID:5524
- C:\Windows\System\DotbwEZ.exe
  C:\Windows\System\DotbwEZ.exe
  2⤵
  PID:5540
- C:\Windows\System\XuDxKVx.exe
  C:\Windows\System\XuDxKVx.exe
  2⤵
  PID:5556
- C:\Windows\System\YlrDoLM.exe
  C:\Windows\System\YlrDoLM.exe
  2⤵
  PID:5572
- C:\Windows\System\cltsATi.exe
  C:\Windows\System\cltsATi.exe
  2⤵
  PID:5588
- C:\Windows\System\AwQAVJA.exe
  C:\Windows\System\AwQAVJA.exe
  2⤵
  PID:5604
- C:\Windows\System\UPcRgBE.exe
  C:\Windows\System\UPcRgBE.exe
  2⤵
  PID:5620
- C:\Windows\System\WWeKVwJ.exe
  C:\Windows\System\WWeKVwJ.exe
  2⤵
  PID:5636
- C:\Windows\System\RjCUrwX.exe
  C:\Windows\System\RjCUrwX.exe
  2⤵
  PID:5652
- C:\Windows\System\UTZYXjZ.exe
  C:\Windows\System\UTZYXjZ.exe
  2⤵
  PID:5668
- C:\Windows\System\Vbajmwr.exe
  C:\Windows\System\Vbajmwr.exe
  2⤵
  PID:5684
- C:\Windows\System\lDlgPYb.exe
  C:\Windows\System\lDlgPYb.exe
  2⤵
  PID:5700
- C:\Windows\System\ttGQaAw.exe
  C:\Windows\System\ttGQaAw.exe
  2⤵
  PID:5716
- C:\Windows\System\YnDvcYy.exe
  C:\Windows\System\YnDvcYy.exe
  2⤵
  PID:5732
- C:\Windows\System\AkhEZdR.exe
  C:\Windows\System\AkhEZdR.exe
  2⤵
  PID:5748
- C:\Windows\System\NLyRrWp.exe
  C:\Windows\System\NLyRrWp.exe
  2⤵
  PID:5764
- C:\Windows\System\QtcASkx.exe
  C:\Windows\System\QtcASkx.exe
  2⤵
  PID:5780
- C:\Windows\System\yprqGHw.exe
  C:\Windows\System\yprqGHw.exe
  2⤵
  PID:5796
- C:\Windows\System\nyzBNrP.exe
  C:\Windows\System\nyzBNrP.exe
  2⤵
  PID:5816
- C:\Windows\System\dEGYVyK.exe
  C:\Windows\System\dEGYVyK.exe
  2⤵
  PID:5832
- C:\Windows\System\EeyBmIR.exe
  C:\Windows\System\EeyBmIR.exe
  2⤵
  PID:5848
- C:\Windows\System\fcWqwwL.exe
  C:\Windows\System\fcWqwwL.exe
  2⤵
  PID:5864
- C:\Windows\System\bzDZTcG.exe
  C:\Windows\System\bzDZTcG.exe
  2⤵
  PID:5880
- C:\Windows\System\nxTXMhF.exe
  C:\Windows\System\nxTXMhF.exe
  2⤵
  PID:5912
- C:\Windows\System\vXDuVwo.exe
  C:\Windows\System\vXDuVwo.exe
  2⤵
  PID:5928
- C:\Windows\System\cBxeyTJ.exe
  C:\Windows\System\cBxeyTJ.exe
  2⤵
  PID:5944
- C:\Windows\System\yoTgyBa.exe
  C:\Windows\System\yoTgyBa.exe
  2⤵
  PID:5960
- C:\Windows\System\ZBGsZtX.exe
  C:\Windows\System\ZBGsZtX.exe
  2⤵
  PID:5976
- C:\Windows\System\UXzfkFm.exe
  C:\Windows\System\UXzfkFm.exe
  2⤵
  PID:5992
- C:\Windows\System\ePEDtAK.exe
  C:\Windows\System\ePEDtAK.exe
  2⤵
  PID:6012
- C:\Windows\System\JKocjhu.exe
  C:\Windows\System\JKocjhu.exe
  2⤵
  PID:6036
- C:\Windows\System\vLbyREy.exe
  C:\Windows\System\vLbyREy.exe
  2⤵
  PID:6052
- C:\Windows\System\ySSuBNi.exe
  C:\Windows\System\ySSuBNi.exe
  2⤵
  PID:6068
- C:\Windows\System\nKOVYqE.exe
  C:\Windows\System\nKOVYqE.exe
  2⤵
  PID:6092
- C:\Windows\System\ELuotRR.exe
  C:\Windows\System\ELuotRR.exe
  2⤵
  PID:6108
- C:\Windows\System\ZREAFtb.exe
  C:\Windows\System\ZREAFtb.exe
  2⤵
  PID:6124
- C:\Windows\System\igVPpGy.exe
  C:\Windows\System\igVPpGy.exe
  2⤵
  PID:296
- C:\Windows\System\sunHZDG.exe
  C:\Windows\System\sunHZDG.exe
  2⤵
  PID:5184
- C:\Windows\System\BAiacjL.exe
  C:\Windows\System\BAiacjL.exe
  2⤵
  PID:2792
- C:\Windows\System\sgIBIGq.exe
  C:\Windows\System\sgIBIGq.exe
  2⤵
  PID:2716
- C:\Windows\System\lWMzXkF.exe
  C:\Windows\System\lWMzXkF.exe
  2⤵
  PID:1200
- C:\Windows\System\ywaPZCR.exe
  C:\Windows\System\ywaPZCR.exe
  2⤵
  PID:5292
- C:\Windows\System\ArJZwpP.exe
  C:\Windows\System\ArJZwpP.exe
  2⤵
  PID:5340
- C:\Windows\System\opzdwHI.exe
  C:\Windows\System\opzdwHI.exe
  2⤵
  PID:5376
- C:\Windows\System\eTnkrNn.exe
  C:\Windows\System\eTnkrNn.exe
  2⤵
  PID:5440
- C:\Windows\System\vUSSWxE.exe
  C:\Windows\System\vUSSWxE.exe
  2⤵
  PID:5504
- C:\Windows\System\qkbGXwF.exe
  C:\Windows\System\qkbGXwF.exe
  2⤵
  PID:5596
- C:\Windows\System\yZXVRGS.exe
  C:\Windows\System\yZXVRGS.exe
  2⤵
  PID:5660
- C:\Windows\System\LJhvQZy.exe
  C:\Windows\System\LJhvQZy.exe
  2⤵
  PID:5724
- C:\Windows\System\vxnLMKY.exe
  C:\Windows\System\vxnLMKY.exe
  2⤵
  PID:5792
- C:\Windows\System\AvCnJIu.exe
  C:\Windows\System\AvCnJIu.exe
  2⤵
  PID:4052
- C:\Windows\System\gAJtsge.exe
  C:\Windows\System\gAJtsge.exe
  2⤵
  PID:3076
- C:\Windows\System\JaWrPEV.exe
  C:\Windows\System\JaWrPEV.exe
  2⤵
  PID:3304
- C:\Windows\System\XgGQRRp.exe
  C:\Windows\System\XgGQRRp.exe
  2⤵
  PID:3688
- C:\Windows\System\ajxzKRA.exe
  C:\Windows\System\ajxzKRA.exe
  2⤵
  PID:3896
- C:\Windows\System\kiSfjbG.exe
  C:\Windows\System\kiSfjbG.exe
  2⤵
  PID:3240
- C:\Windows\System\UCXtToj.exe
  C:\Windows\System\UCXtToj.exe
  2⤵
  PID:4144
- C:\Windows\System\zjCHnOc.exe
  C:\Windows\System\zjCHnOc.exe
  2⤵
  PID:4208
- C:\Windows\System\ZwibHsG.exe
  C:\Windows\System\ZwibHsG.exe
  2⤵
  PID:4692
- C:\Windows\System\KzWlIeA.exe
  C:\Windows\System\KzWlIeA.exe
  2⤵
  PID:4756
- C:\Windows\System\vkfrcBk.exe
  C:\Windows\System\vkfrcBk.exe
  2⤵
  PID:4852
- C:\Windows\System\UOukXQi.exe
  C:\Windows\System\UOukXQi.exe
  2⤵
  PID:4916
- C:\Windows\System\MZkiKvT.exe
  C:\Windows\System\MZkiKvT.exe
  2⤵
  PID:4980
- C:\Windows\System\YgKGtoc.exe
  C:\Windows\System\YgKGtoc.exe
  2⤵
  PID:5044
- C:\Windows\System\kNurXlh.exe
  C:\Windows\System\kNurXlh.exe
  2⤵
  PID:5108
- C:\Windows\System\FZrbxls.exe
  C:\Windows\System\FZrbxls.exe
  2⤵
  PID:4100
- C:\Windows\System\yFmbrTJ.exe
  C:\Windows\System\yFmbrTJ.exe
  2⤵
  PID:4356
- C:\Windows\System\cIYKtaw.exe
  C:\Windows\System\cIYKtaw.exe
  2⤵
  PID:4612
- C:\Windows\System\lIEeMWo.exe
  C:\Windows\System\lIEeMWo.exe
  2⤵
  PID:4864
- C:\Windows\System\KKIoJII.exe
  C:\Windows\System\KKIoJII.exe
  2⤵
  PID:5092
- C:\Windows\System\PkMROkF.exe
  C:\Windows\System\PkMROkF.exe
  2⤵
  PID:4036
- C:\Windows\System\vUbibDm.exe
  C:\Windows\System\vUbibDm.exe
  2⤵
  PID:5204
- C:\Windows\System\SkkMPXg.exe
  C:\Windows\System\SkkMPXg.exe
  2⤵
  PID:5312
- C:\Windows\System\fewelPb.exe
  C:\Windows\System\fewelPb.exe
  2⤵
  PID:5392
- C:\Windows\System\MuegAcI.exe
  C:\Windows\System\MuegAcI.exe
  2⤵
  PID:5456
- C:\Windows\System\ofYKFIw.exe
  C:\Windows\System\ofYKFIw.exe
  2⤵
  PID:5548
- C:\Windows\System\umuEduz.exe
  C:\Windows\System\umuEduz.exe
  2⤵
  PID:6000
- C:\Windows\System\pLcTBxr.exe
  C:\Windows\System\pLcTBxr.exe
  2⤵
  PID:6076
- C:\Windows\System\XHarJoF.exe
  C:\Windows\System\XHarJoF.exe
  2⤵
  PID:2128
- C:\Windows\System\egHtqgF.exe
  C:\Windows\System\egHtqgF.exe
  2⤵
  PID:2372
- C:\Windows\System\opzVuke.exe
  C:\Windows\System\opzVuke.exe
  2⤵
  PID:3036
- C:\Windows\System\knJSpRI.exe
  C:\Windows\System\knJSpRI.exe
  2⤵
  PID:796
- C:\Windows\System\tHwQasL.exe
  C:\Windows\System\tHwQasL.exe
  2⤵
  PID:1880
- C:\Windows\System\mQcomqu.exe
  C:\Windows\System\mQcomqu.exe
  2⤵
  PID:2988
- C:\Windows\System\TygDwAV.exe
  C:\Windows\System\TygDwAV.exe
  2⤵
  PID:2772
- C:\Windows\System\PAxdduR.exe
  C:\Windows\System\PAxdduR.exe
  2⤵
  PID:1816
- C:\Windows\System\DcRcNzy.exe
  C:\Windows\System\DcRcNzy.exe
  2⤵
  PID:4176
- C:\Windows\System\PHvHrNU.exe
  C:\Windows\System\PHvHrNU.exe
  2⤵
  PID:1804
- C:\Windows\System\eBqvkww.exe
  C:\Windows\System\eBqvkww.exe
  2⤵
  PID:6140
- C:\Windows\System\TbxOHBH.exe
  C:\Windows\System\TbxOHBH.exe
  2⤵
  PID:5888
- C:\Windows\System\sLuauYl.exe
  C:\Windows\System\sLuauYl.exe
  2⤵
  PID:5892
- C:\Windows\System\ZQBhVBD.exe
  C:\Windows\System\ZQBhVBD.exe
  2⤵
  PID:5972
- C:\Windows\System\LYESzfV.exe
  C:\Windows\System\LYESzfV.exe
  2⤵
  PID:2244
- C:\Windows\System\POhmEmW.exe
  C:\Windows\System\POhmEmW.exe
  2⤵
  PID:1788
- C:\Windows\System\PFoqgcT.exe
  C:\Windows\System\PFoqgcT.exe
  2⤵
  PID:960
- C:\Windows\System\CgjZUoD.exe
  C:\Windows\System\CgjZUoD.exe
  2⤵
  PID:1664
- C:\Windows\System\CXZjnpq.exe
  C:\Windows\System\CXZjnpq.exe
  2⤵
  PID:2176
- C:\Windows\System\ywyJboZ.exe
  C:\Windows\System\ywyJboZ.exe
  2⤵
  PID:3320
- C:\Windows\System\SoHfRjw.exe
  C:\Windows\System\SoHfRjw.exe
  2⤵
  PID:3608
- C:\Windows\System\RkBWztZ.exe
  C:\Windows\System\RkBWztZ.exe
  2⤵
  PID:772
- C:\Windows\System\uWfuykt.exe
  C:\Windows\System\uWfuykt.exe
  2⤵
  PID:2608
- C:\Windows\System\pXjiuHk.exe
  C:\Windows\System\pXjiuHk.exe
  2⤵
  PID:2628
- C:\Windows\System\ZmUiAUe.exe
  C:\Windows\System\ZmUiAUe.exe
  2⤵
  PID:860
- C:\Windows\System\KWiYQTx.exe
  C:\Windows\System\KWiYQTx.exe
  2⤵
  PID:2308
- C:\Windows\System\GbqSbpw.exe
  C:\Windows\System\GbqSbpw.exe
  2⤵
  PID:2664
- C:\Windows\System\byZerNo.exe
  C:\Windows\System\byZerNo.exe
  2⤵
  PID:3128
- C:\Windows\System\zjZAvVe.exe
  C:\Windows\System\zjZAvVe.exe
  2⤵
  PID:3288
- C:\Windows\System\mWZjWqd.exe
  C:\Windows\System\mWZjWqd.exe
  2⤵
  PID:3384
- C:\Windows\System\QNrUYIU.exe
  C:\Windows\System\QNrUYIU.exe
  2⤵
  PID:3540
- C:\Windows\System\qaeftdp.exe
  C:\Windows\System\qaeftdp.exe
  2⤵
  PID:4024
- C:\Windows\System\pyXmTPy.exe
  C:\Windows\System\pyXmTPy.exe
  2⤵
  PID:5644
- C:\Windows\System\lJIxkxX.exe
  C:\Windows\System\lJIxkxX.exe
  2⤵
  PID:3928
- C:\Windows\System\qHqQvLK.exe
  C:\Windows\System\qHqQvLK.exe
  2⤵
  PID:3816
- C:\Windows\System\ZALDhvo.exe
  C:\Windows\System\ZALDhvo.exe
  2⤵
  PID:5828
- C:\Windows\System\AGdXBPK.exe
  C:\Windows\System\AGdXBPK.exe
  2⤵
  PID:5436
- C:\Windows\System\pnoLSZw.exe
  C:\Windows\System\pnoLSZw.exe
  2⤵
  PID:2132
- C:\Windows\System\rgPKNfK.exe
  C:\Windows\System\rgPKNfK.exe
  2⤵
  PID:6136
- C:\Windows\System\IhtNoEo.exe
  C:\Windows\System\IhtNoEo.exe
  2⤵
  PID:6100
- C:\Windows\System\vlZpWyX.exe
  C:\Windows\System\vlZpWyX.exe
  2⤵
  PID:6024
- C:\Windows\System\BxwrAVk.exe
  C:\Windows\System\BxwrAVk.exe
  2⤵
  PID:5924
- C:\Windows\System\zPKLnut.exe
  C:\Windows\System\zPKLnut.exe
  2⤵
  PID:5844
- C:\Windows\System\pPtMMEm.exe
  C:\Windows\System\pPtMMEm.exe
  2⤵
  PID:5776
- C:\Windows\System\viyEzYW.exe
  C:\Windows\System\viyEzYW.exe
  2⤵
  PID:5712
- C:\Windows\System\csELUQH.exe
  C:\Windows\System\csELUQH.exe
  2⤵
  PID:540
- C:\Windows\System\LmFeVkm.exe
  C:\Windows\System\LmFeVkm.exe
  2⤵
  PID:1752
- C:\Windows\System\XcCUpRp.exe
  C:\Windows\System\XcCUpRp.exe
  2⤵
  PID:4368
- C:\Windows\System\RAUmXiR.exe
  C:\Windows\System\RAUmXiR.exe
  2⤵
  PID:4528
- C:\Windows\System\SMJyMcL.exe
  C:\Windows\System\SMJyMcL.exe
  2⤵
  PID:4592
- C:\Windows\System\bXzIogk.exe
  C:\Windows\System\bXzIogk.exe
  2⤵
  PID:4432
- C:\Windows\System\Fbkmehz.exe
  C:\Windows\System\Fbkmehz.exe
  2⤵
  PID:4468
- C:\Windows\System\CQRGKfg.exe
  C:\Windows\System\CQRGKfg.exe
  2⤵
  PID:4740
- C:\Windows\System\IayTxyb.exe
  C:\Windows\System\IayTxyb.exe
  2⤵
  PID:5256
- C:\Windows\System\EVJXRUd.exe
  C:\Windows\System\EVJXRUd.exe
  2⤵
  PID:5488
- C:\Windows\System\PvYpvoQ.exe
  C:\Windows\System\PvYpvoQ.exe
  2⤵
  PID:5124
- C:\Windows\System\QzUtEES.exe
  C:\Windows\System\QzUtEES.exe
  2⤵
  PID:1648
- C:\Windows\System\ZKvQAZU.exe
  C:\Windows\System\ZKvQAZU.exe
  2⤵
  PID:1656
- C:\Windows\System\scLBkYc.exe
  C:\Windows\System\scLBkYc.exe
  2⤵
  PID:3588
- C:\Windows\System\rrqPcSL.exe
  C:\Windows\System\rrqPcSL.exe
  2⤵
  PID:1868
- C:\Windows\System\EOPpYts.exe
  C:\Windows\System\EOPpYts.exe
  2⤵
  PID:5904
- C:\Windows\System\MqvQKJR.exe
  C:\Windows\System\MqvQKJR.exe
  2⤵
  PID:5516
- C:\Windows\System\xBkzXbH.exe
  C:\Windows\System\xBkzXbH.exe
  2⤵
  PID:964
- C:\Windows\System\SXaobkP.exe
  C:\Windows\System\SXaobkP.exe
  2⤵
  PID:2536
- C:\Windows\System\QsmshyK.exe
  C:\Windows\System\QsmshyK.exe
  2⤵
  PID:3544
- C:\Windows\System\gHsSwHu.exe
  C:\Windows\System\gHsSwHu.exe
  2⤵
  PID:5372
- C:\Windows\System\llvfThS.exe
  C:\Windows\System\llvfThS.exe
  2⤵
  PID:5632
- C:\Windows\System\PTKiAPC.exe
  C:\Windows\System\PTKiAPC.exe
  2⤵
  PID:3736
- C:\Windows\System\Soysieb.exe
  C:\Windows\System\Soysieb.exe
  2⤵
  PID:3460
- C:\Windows\System\AXIZRMt.exe
  C:\Windows\System\AXIZRMt.exe
  2⤵
  PID:4072
- C:\Windows\System\JzMYCHf.exe
  C:\Windows\System\JzMYCHf.exe
  2⤵
  PID:384
- C:\Windows\System\YllYReC.exe
  C:\Windows\System\YllYReC.exe
  2⤵
  PID:5860
- C:\Windows\System\GibKIHQ.exe
  C:\Windows\System\GibKIHQ.exe
  2⤵
  PID:1592
- C:\Windows\System\NjzerFp.exe
  C:\Windows\System\NjzerFp.exe
  2⤵
  PID:3160
- C:\Windows\System\JCSLtrE.exe
  C:\Windows\System\JCSLtrE.exe
  2⤵
  PID:2168
- C:\Windows\System\cSIMNvJ.exe
  C:\Windows\System\cSIMNvJ.exe
  2⤵
  PID:2764
- C:\Windows\System\fZLCXwb.exe
  C:\Windows\System\fZLCXwb.exe
  2⤵
  PID:2452
- C:\Windows\System\JLpXsHW.exe
  C:\Windows\System\JLpXsHW.exe
  2⤵
  PID:3416
- C:\Windows\System\YOknacR.exe
  C:\Windows\System\YOknacR.exe
  2⤵
  PID:3204
- C:\Windows\System\UWYmdVs.exe
  C:\Windows\System\UWYmdVs.exe
  2⤵
  PID:1764
- C:\Windows\System\bfzDxXi.exe
  C:\Windows\System\bfzDxXi.exe
  2⤵
  PID:5876
- C:\Windows\System\PXKTMLK.exe
  C:\Windows\System\PXKTMLK.exe
  2⤵
  PID:1276
- C:\Windows\System\zaBwHXd.exe
  C:\Windows\System\zaBwHXd.exe
  2⤵
  PID:6032
- C:\Windows\System\zPFHqGz.exe
  C:\Windows\System\zPFHqGz.exe
  2⤵
  PID:4352
- C:\Windows\System\vddqztT.exe
  C:\Windows\System\vddqztT.exe
  2⤵
  PID:3348
- C:\Windows\System\JyYpnSO.exe
  C:\Windows\System\JyYpnSO.exe
  2⤵
  PID:3992
- C:\Windows\System\EpAQjKi.exe
  C:\Windows\System\EpAQjKi.exe
  2⤵
  PID:5584
- C:\Windows\System\TYkhhMR.exe
  C:\Windows\System\TYkhhMR.exe
  2⤵
  PID:2740
- C:\Windows\System\PudhgmK.exe
  C:\Windows\System\PudhgmK.exe
  2⤵
  PID:5812
- C:\Windows\System\lFsaXrK.exe
  C:\Windows\System\lFsaXrK.exe
  2⤵
  PID:4336
- C:\Windows\System\MTBlCTN.exe
  C:\Windows\System\MTBlCTN.exe
  2⤵
  PID:4464
- C:\Windows\System\raCMqQA.exe
  C:\Windows\System\raCMqQA.exe
  2⤵
  PID:4788
- C:\Windows\System\neAbtzw.exe
  C:\Windows\System\neAbtzw.exe
  2⤵
  PID:812
- C:\Windows\System\kKLyNSV.exe
  C:\Windows\System\kKLyNSV.exe
  2⤵
  PID:4228
- C:\Windows\System\VdfCQzX.exe
  C:\Windows\System\VdfCQzX.exe
  2⤵
  PID:5900
- C:\Windows\System\xfCcPug.exe
  C:\Windows\System\xfCcPug.exe
  2⤵
  PID:1796
- C:\Windows\System\dqrBHBE.exe
  C:\Windows\System\dqrBHBE.exe
  2⤵
  PID:2732
- C:\Windows\System\TXbMHrh.exe
  C:\Windows\System\TXbMHrh.exe
  2⤵
  PID:6132
- C:\Windows\System\cohfXju.exe
  C:\Windows\System\cohfXju.exe
  2⤵
  PID:3220
- C:\Windows\System\CUNiirk.exe
  C:\Windows\System\CUNiirk.exe
  2⤵
  PID:5612
- C:\Windows\System\coaTwxG.exe
  C:\Windows\System\coaTwxG.exe
  2⤵
  PID:5104
- C:\Windows\System\CGwWyHF.exe
  C:\Windows\System\CGwWyHF.exe
  2⤵
  PID:4752
- C:\Windows\System\goHkXCI.exe
  C:\Windows\System\goHkXCI.exe
  2⤵
  PID:3560
- C:\Windows\System\lRFeYMb.exe
  C:\Windows\System\lRFeYMb.exe
  2⤵
  PID:6120
- C:\Windows\System\TorjiTj.exe
  C:\Windows\System\TorjiTj.exe
  2⤵
  PID:648
- C:\Windows\System\QGRZqvH.exe
  C:\Windows\System\QGRZqvH.exe
  2⤵
  PID:1636
- C:\Windows\System\OYrLplC.exe
  C:\Windows\System\OYrLplC.exe
  2⤵
  PID:1920
- C:\Windows\System\ppEvqux.exe
  C:\Windows\System\ppEvqux.exe
  2⤵
  PID:5500
- C:\Windows\System\uUoOuJK.exe
  C:\Windows\System\uUoOuJK.exe
  2⤵
  PID:3844
- C:\Windows\System\aQblCle.exe
  C:\Windows\System\aQblCle.exe
  2⤵
  PID:4276
- C:\Windows\System\RhbLBvs.exe
  C:\Windows\System\RhbLBvs.exe
  2⤵
  PID:2480
- C:\Windows\System\KZfkdnr.exe
  C:\Windows\System\KZfkdnr.exe
  2⤵
  PID:2488
- C:\Windows\System\gMSIUhl.exe
  C:\Windows\System\gMSIUhl.exe
  2⤵
  PID:5216
- C:\Windows\System\uqcNkzS.exe
  C:\Windows\System\uqcNkzS.exe
  2⤵
  PID:5956
- C:\Windows\System\iZKmzUz.exe
  C:\Windows\System\iZKmzUz.exe
  2⤵
  PID:1584
- C:\Windows\System\fHtrKBw.exe
  C:\Windows\System\fHtrKBw.exe
  2⤵
  PID:5200
- C:\Windows\System\uWqpvZy.exe
  C:\Windows\System\uWqpvZy.exe
  2⤵
  PID:704
- C:\Windows\System\UrpAKIi.exe
  C:\Windows\System\UrpAKIi.exe
  2⤵
  PID:2768
- C:\Windows\System\RPimTqS.exe
  C:\Windows\System\RPimTqS.exe
  2⤵
  PID:3432
- C:\Windows\System\hUWWzaK.exe
  C:\Windows\System\hUWWzaK.exe
  2⤵
  PID:5472
- C:\Windows\System\HzzGrXF.exe
  C:\Windows\System\HzzGrXF.exe
  2⤵
  PID:2692
- C:\Windows\System\mbCdubb.exe
  C:\Windows\System\mbCdubb.exe
  2⤵
  PID:2568
- C:\Windows\System\iMnqgjL.exe
  C:\Windows\System\iMnqgjL.exe
  2⤵
  PID:1984
- C:\Windows\System\CCPCeQD.exe
  C:\Windows\System\CCPCeQD.exe
  2⤵
  PID:1292
- C:\Windows\System\PtqLSkE.exe
  C:\Windows\System\PtqLSkE.exe
  2⤵
  PID:5760
- C:\Windows\System\IMpcEgg.exe
  C:\Windows\System\IMpcEgg.exe
  2⤵
  PID:2408
- C:\Windows\System\rqxFGcs.exe
  C:\Windows\System\rqxFGcs.exe
  2⤵
  PID:6048
- C:\Windows\System\nuxVEIf.exe
  C:\Windows\System\nuxVEIf.exe
  2⤵
  PID:3944
- C:\Windows\System\MzFkVzh.exe
  C:\Windows\System\MzFkVzh.exe
  2⤵
  PID:3092
- C:\Windows\System\JjfTnJR.exe
  C:\Windows\System\JjfTnJR.exe
  2⤵
  PID:2800
- C:\Windows\System\JpsWDjq.exe
  C:\Windows\System\JpsWDjq.exe
  2⤵
  PID:3016
- C:\Windows\System\hsyHbtp.exe
  C:\Windows\System\hsyHbtp.exe
  2⤵
  PID:3032
- C:\Windows\System\YkFJYLC.exe
  C:\Windows\System\YkFJYLC.exe
  2⤵
  PID:3284
- C:\Windows\System\FJASiDn.exe
  C:\Windows\System\FJASiDn.exe
  2⤵
  PID:5536
- C:\Windows\System\YpnnsOh.exe
  C:\Windows\System\YpnnsOh.exe
  2⤵
  PID:584
- C:\Windows\System\BFSrejb.exe
  C:\Windows\System\BFSrejb.exe
  2⤵
  PID:5040
- C:\Windows\System\mGbvuJD.exe
  C:\Windows\System\mGbvuJD.exe
  2⤵
  PID:1692
- C:\Windows\System\SRqACJW.exe
  C:\Windows\System\SRqACJW.exe
  2⤵
  PID:4948
- C:\Windows\System\cHkRsTP.exe
  C:\Windows\System\cHkRsTP.exe
  2⤵
  PID:1100
- C:\Windows\System\jzxpDIh.exe
  C:\Windows\System\jzxpDIh.exe
  2⤵
  PID:2776
- C:\Windows\System\hLluTjI.exe
  C:\Windows\System\hLluTjI.exe
  2⤵
  PID:2924
- C:\Windows\System\RFzRVqA.exe
  C:\Windows\System\RFzRVqA.exe
  2⤵
  PID:5648
- C:\Windows\System\XDboMtH.exe
  C:\Windows\System\XDboMtH.exe
  2⤵
  PID:3768
- C:\Windows\System\RtLaAOq.exe
  C:\Windows\System\RtLaAOq.exe
  2⤵
  PID:2652
- C:\Windows\System\hqFKdxm.exe
  C:\Windows\System\hqFKdxm.exe
  2⤵
  PID:4340
- C:\Windows\System\eQMTMuG.exe
  C:\Windows\System\eQMTMuG.exe
  2⤵
  PID:5744
- C:\Windows\System\Pyiaxyr.exe
  C:\Windows\System\Pyiaxyr.exe
  2⤵
  PID:5520
- C:\Windows\System\qwjnkky.exe
  C:\Windows\System\qwjnkky.exe
  2⤵
  PID:1388
- C:\Windows\System\VdQFbio.exe
  C:\Windows\System\VdQFbio.exe
  2⤵
  PID:2524
- C:\Windows\System\dTIoKVW.exe
  C:\Windows\System\dTIoKVW.exe
  2⤵
  PID:6160
- C:\Windows\System\xugloUk.exe
  C:\Windows\System\xugloUk.exe
  2⤵
  PID:6180
- C:\Windows\System\JZqoKTd.exe
  C:\Windows\System\JZqoKTd.exe
  2⤵
  PID:6196
- C:\Windows\System\HjReUWv.exe
  C:\Windows\System\HjReUWv.exe
  2⤵
  PID:6212
- C:\Windows\System\zbVOrWc.exe
  C:\Windows\System\zbVOrWc.exe
  2⤵
  PID:6240
- C:\Windows\System\iOuAeym.exe
  C:\Windows\System\iOuAeym.exe
  2⤵
  PID:6268
- C:\Windows\System\YPvNBbl.exe
  C:\Windows\System\YPvNBbl.exe
  2⤵
  PID:6284
- C:\Windows\System\GxrXkDA.exe
  C:\Windows\System\GxrXkDA.exe
  2⤵
  PID:6300
- C:\Windows\System\mnrOnkw.exe
  C:\Windows\System\mnrOnkw.exe
  2⤵
  PID:6316
- C:\Windows\System\knWTpqu.exe
  C:\Windows\System\knWTpqu.exe
  2⤵
  PID:6336
- C:\Windows\System\QIcdrKj.exe
  C:\Windows\System\QIcdrKj.exe
  2⤵
  PID:6352
- C:\Windows\System\IQRCXSz.exe
  C:\Windows\System\IQRCXSz.exe
  2⤵
  PID:6368
- C:\Windows\System\DamaKVw.exe
  C:\Windows\System\DamaKVw.exe
  2⤵
  PID:6384
- C:\Windows\System\DGcaixl.exe
  C:\Windows\System\DGcaixl.exe
  2⤵
  PID:6404
- C:\Windows\System\JKXLniS.exe
  C:\Windows\System\JKXLniS.exe
  2⤵
  PID:6420
- C:\Windows\System\rGnANgM.exe
  C:\Windows\System\rGnANgM.exe
  2⤵
  PID:6436
- C:\Windows\System\XpRRAch.exe
  C:\Windows\System\XpRRAch.exe
  2⤵
  PID:6452
- C:\Windows\System\LmOkdRz.exe
  C:\Windows\System\LmOkdRz.exe
  2⤵
  PID:6468
- C:\Windows\System\iEXYvvl.exe
  C:\Windows\System\iEXYvvl.exe
  2⤵
  PID:6484
- C:\Windows\System\xghqGgV.exe
  C:\Windows\System\xghqGgV.exe
  2⤵
  PID:6504
- C:\Windows\System\lRqKPQb.exe
  C:\Windows\System\lRqKPQb.exe
  2⤵
  PID:6520
- C:\Windows\System\dNBWJWn.exe
  C:\Windows\System\dNBWJWn.exe
  2⤵
  PID:6536
- C:\Windows\System\XpdKPny.exe
  C:\Windows\System\XpdKPny.exe
  2⤵
  PID:6552
- C:\Windows\System\JCmALQs.exe
  C:\Windows\System\JCmALQs.exe
  2⤵
  PID:6568
- C:\Windows\System\kligaTE.exe
  C:\Windows\System\kligaTE.exe
  2⤵
  PID:6584
- C:\Windows\System\SysWqlU.exe
  C:\Windows\System\SysWqlU.exe
  2⤵
  PID:6600
- C:\Windows\System\xqQBDWN.exe
  C:\Windows\System\xqQBDWN.exe
  2⤵
  PID:6616
- C:\Windows\System\paEtVIB.exe
  C:\Windows\System\paEtVIB.exe
  2⤵
  PID:6640
- C:\Windows\System\keKXQqG.exe
  C:\Windows\System\keKXQqG.exe
  2⤵
  PID:6656
- C:\Windows\System\AWqIhec.exe
  C:\Windows\System\AWqIhec.exe
  2⤵
  PID:6672
- C:\Windows\System\HRofvsm.exe
  C:\Windows\System\HRofvsm.exe
  2⤵
  PID:6688
- C:\Windows\System\qUcWPkD.exe
  C:\Windows\System\qUcWPkD.exe
  2⤵
  PID:6704
- C:\Windows\System\VNBBeEf.exe
  C:\Windows\System\VNBBeEf.exe
  2⤵
  PID:6720
- C:\Windows\System\kruQosA.exe
  C:\Windows\System\kruQosA.exe
  2⤵
  PID:6736
- C:\Windows\System\fEBkNKA.exe
  C:\Windows\System\fEBkNKA.exe
  2⤵
  PID:6752
- C:\Windows\System\IZsvVlo.exe
  C:\Windows\System\IZsvVlo.exe
  2⤵
  PID:6768
- C:\Windows\System\ldQRPMn.exe
  C:\Windows\System\ldQRPMn.exe
  2⤵
  PID:6784
- C:\Windows\System\kroAJwC.exe
  C:\Windows\System\kroAJwC.exe
  2⤵
  PID:6800
- C:\Windows\System\HGHMVvN.exe
  C:\Windows\System\HGHMVvN.exe
  2⤵
  PID:6816
- C:\Windows\System\HvWFGYe.exe
  C:\Windows\System\HvWFGYe.exe
  2⤵
  PID:6832
- C:\Windows\System\oGnstVT.exe
  C:\Windows\System\oGnstVT.exe
  2⤵
  PID:6852
- C:\Windows\System\fQRdhAS.exe
  C:\Windows\System\fQRdhAS.exe
  2⤵
  PID:6868
- C:\Windows\System\MldXPuh.exe
  C:\Windows\System\MldXPuh.exe
  2⤵
  PID:6888
- C:\Windows\System\GwomJtB.exe
  C:\Windows\System\GwomJtB.exe
  2⤵
  PID:6904
- C:\Windows\System\wpZOWCN.exe
  C:\Windows\System\wpZOWCN.exe
  2⤵
  PID:6920
- C:\Windows\System\SkSdNUg.exe
  C:\Windows\System\SkSdNUg.exe
  2⤵
  PID:6936
- C:\Windows\System\pTZcGnd.exe
  C:\Windows\System\pTZcGnd.exe
  2⤵
  PID:6952
- C:\Windows\System\OoxCoMk.exe
  C:\Windows\System\OoxCoMk.exe
  2⤵
  PID:6968
- C:\Windows\System\SwqYJQR.exe
  C:\Windows\System\SwqYJQR.exe
  2⤵
  PID:6984
- C:\Windows\System\GaWBOlV.exe
  C:\Windows\System\GaWBOlV.exe
  2⤵
  PID:7000
- C:\Windows\System\OAQQqWa.exe
  C:\Windows\System\OAQQqWa.exe
  2⤵
  PID:7016
- C:\Windows\System\RTKSQkr.exe
  C:\Windows\System\RTKSQkr.exe
  2⤵
  PID:7032
- C:\Windows\System\UhogyMl.exe
  C:\Windows\System\UhogyMl.exe
  2⤵
  PID:7048
- C:\Windows\System\PXazlFR.exe
  C:\Windows\System\PXazlFR.exe
  2⤵
  PID:7064
- C:\Windows\System\FuKpAyG.exe
  C:\Windows\System\FuKpAyG.exe
  2⤵
  PID:7080
- C:\Windows\System\cRUSVaY.exe
  C:\Windows\System\cRUSVaY.exe
  2⤵
  PID:7096
- C:\Windows\System\NLVJhLe.exe
  C:\Windows\System\NLVJhLe.exe
  2⤵
  PID:7112
- C:\Windows\System\BERaXNJ.exe
  C:\Windows\System\BERaXNJ.exe
  2⤵
  PID:7128
- C:\Windows\System\isnLuoL.exe
  C:\Windows\System\isnLuoL.exe
  2⤵
  PID:7144
- C:\Windows\System\NrSALYq.exe
  C:\Windows\System\NrSALYq.exe
  2⤵
  PID:7160
- C:\Windows\System\gfpWotj.exe
  C:\Windows\System\gfpWotj.exe
  2⤵
  PID:2816
- C:\Windows\System\YlZUBqA.exe
  C:\Windows\System\YlZUBqA.exe
  2⤵
  PID:1824
- C:\Windows\System\vCgWHWn.exe
  C:\Windows\System\vCgWHWn.exe
  2⤵
  PID:2788
- C:\Windows\System\zZlimEB.exe
  C:\Windows\System\zZlimEB.exe
  2⤵
  PID:2200
- C:\Windows\System\esZknph.exe
  C:\Windows\System\esZknph.exe
  2⤵
  PID:6156
- C:\Windows\System\TtTZxaf.exe
  C:\Windows\System\TtTZxaf.exe
  2⤵
  PID:1612
- C:\Windows\System\DqBNFDw.exe
  C:\Windows\System\DqBNFDw.exe
  2⤵
  PID:6176
- C:\Windows\System\tdwRZDx.exe
  C:\Windows\System\tdwRZDx.exe
  2⤵
  PID:6220
- C:\Windows\System\bmtNrlK.exe
  C:\Windows\System\bmtNrlK.exe
  2⤵
  PID:6260
- C:\Windows\System\YesFBHO.exe
  C:\Windows\System\YesFBHO.exe
  2⤵
  PID:6236
- C:\Windows\System\cmDcEBj.exe
  C:\Windows\System\cmDcEBj.exe
  2⤵
  PID:6312
- C:\Windows\System\GjXcNsc.exe
  C:\Windows\System\GjXcNsc.exe
  2⤵
  PID:6360
- C:\Windows\System\YDUKnna.exe
  C:\Windows\System\YDUKnna.exe
  2⤵
  PID:6344
- C:\Windows\System\sGoOaUT.exe
  C:\Windows\System\sGoOaUT.exe
  2⤵
  PID:6416
- C:\Windows\System\TlzLsOJ.exe
  C:\Windows\System\TlzLsOJ.exe
  2⤵
  PID:6432
- C:\Windows\System\NznaXrH.exe
  C:\Windows\System\NznaXrH.exe
  2⤵
  PID:6496
- C:\Windows\System\cTYPJSs.exe
  C:\Windows\System\cTYPJSs.exe
  2⤵
  PID:6332
- C:\Windows\System\CDlNPAL.exe
  C:\Windows\System\CDlNPAL.exe
  2⤵
  PID:6564
- C:\Windows\System\tSUDkeM.exe
  C:\Windows\System\tSUDkeM.exe
  2⤵
  PID:6516
- C:\Windows\System\LwSOoRS.exe
  C:\Windows\System\LwSOoRS.exe
  2⤵
  PID:6400
- C:\Windows\System\NPTtQNb.exe
  C:\Windows\System\NPTtQNb.exe
  2⤵
  PID:6608
- C:\Windows\System\PdgIzcb.exe
  C:\Windows\System\PdgIzcb.exe
  2⤵
  PID:6612
- C:\Windows\System\fUZqoGm.exe
  C:\Windows\System\fUZqoGm.exe
  2⤵
  PID:6668
- C:\Windows\System\IaOtfYr.exe
  C:\Windows\System\IaOtfYr.exe
  2⤵
  PID:6652
- C:\Windows\System\VxpqJJk.exe
  C:\Windows\System\VxpqJJk.exe
  2⤵
  PID:6828
- C:\Windows\System\wNgrscr.exe
  C:\Windows\System\wNgrscr.exe
  2⤵
  PID:6932
- C:\Windows\System\EKmXpUr.exe
  C:\Windows\System\EKmXpUr.exe
  2⤵
  PID:7024
- C:\Windows\System\TTuHGJa.exe
  C:\Windows\System\TTuHGJa.exe
  2⤵
  PID:7088
- C:\Windows\System\GIXbMXt.exe
  C:\Windows\System\GIXbMXt.exe
  2⤵
  PID:7152
- C:\Windows\System\sFHAYsx.exe
  C:\Windows\System\sFHAYsx.exe
  2⤵
  PID:7008
- C:\Windows\System\YuIKwYq.exe
  C:\Windows\System\YuIKwYq.exe
  2⤵
  PID:2640
- C:\Windows\System\JRUpKOS.exe
  C:\Windows\System\JRUpKOS.exe
  2⤵
  PID:7040
- C:\Windows\System\NLefEoc.exe
  C:\Windows\System\NLefEoc.exe
  2⤵
  PID:7108
- C:\Windows\System\XnHisOR.exe
  C:\Windows\System\XnHisOR.exe
  2⤵
  PID:5676
- C:\Windows\System\iUrRpMF.exe
  C:\Windows\System\iUrRpMF.exe
  2⤵
  PID:5680
- C:\Windows\System\iyTukCL.exe
  C:\Windows\System\iyTukCL.exe
  2⤵
  PID:2580
- C:\Windows\System\JiugENY.exe
  C:\Windows\System\JiugENY.exe
  2⤵
  PID:6256
- C:\Windows\System\NpRFJin.exe
  C:\Windows\System\NpRFJin.exe
  2⤵
  PID:6328
- C:\Windows\System\RxFLiDR.exe
  C:\Windows\System\RxFLiDR.exe
  2⤵
  PID:6380
- C:\Windows\System\rQxWLDl.exe
  C:\Windows\System\rQxWLDl.exe
  2⤵
  PID:6548
- C:\Windows\System\exqHBpx.exe
  C:\Windows\System\exqHBpx.exe
  2⤵
  PID:6348
- C:\Windows\System\qGWzRiH.exe
  C:\Windows\System\qGWzRiH.exe
  2⤵
  PID:6512
- C:\Windows\System\JfKhcZk.exe
  C:\Windows\System\JfKhcZk.exe
  2⤵
  PID:6500
- C:\Windows\System\fhegxSQ.exe
  C:\Windows\System\fhegxSQ.exe
  2⤵
  PID:6712
- C:\Windows\System\FkGgAHF.exe
  C:\Windows\System\FkGgAHF.exe
  2⤵
  PID:6664
- C:\Windows\System\tMhUEsx.exe
  C:\Windows\System\tMhUEsx.exe
  2⤵
  PID:6744
- C:\Windows\System\FHLqsqa.exe
  C:\Windows\System\FHLqsqa.exe
  2⤵
  PID:6764
- C:\Windows\System\BqVEVxh.exe
  C:\Windows\System\BqVEVxh.exe
  2⤵
  PID:6812
- C:\Windows\System\dVTAxcV.exe
  C:\Windows\System\dVTAxcV.exe
  2⤵
  PID:2968
- C:\Windows\System\XKZZASS.exe
  C:\Windows\System\XKZZASS.exe
  2⤵
  PID:6884
- C:\Windows\System\HMsDVUP.exe
  C:\Windows\System\HMsDVUP.exe
  2⤵
  PID:6880
- C:\Windows\System\YzGAOcF.exe
  C:\Windows\System\YzGAOcF.exe
  2⤵
  PID:6948
- C:\Windows\System\QKdGyTZ.exe
  C:\Windows\System\QKdGyTZ.exe
  2⤵
  PID:6964
- C:\Windows\System\aAItZXR.exe
  C:\Windows\System\aAItZXR.exe
  2⤵
  PID:7060
- C:\Windows\System\zrDgEPJ.exe
  C:\Windows\System\zrDgEPJ.exe
  2⤵
  PID:2868
- C:\Windows\System\eupTLeY.exe
  C:\Windows\System\eupTLeY.exe
  2⤵
  PID:2836
- C:\Windows\System\IalbazU.exe
  C:\Windows\System\IalbazU.exe
  2⤵
  PID:6560
- C:\Windows\System\yTSmpEj.exe
  C:\Windows\System\yTSmpEj.exe
  2⤵
  PID:6324
- C:\Windows\System\MOzXmCo.exe
  C:\Windows\System\MOzXmCo.exe
  2⤵
  PID:6748
- C:\Windows\System\jOUblUX.exe
  C:\Windows\System\jOUblUX.exe
  2⤵
  PID:6308
- C:\Windows\System\iplIKqb.exe
  C:\Windows\System\iplIKqb.exe
  2⤵
  PID:6648
- C:\Windows\System\cQakjVF.exe
  C:\Windows\System\cQakjVF.exe
  2⤵
  PID:7104
- C:\Windows\System\zOFxdgE.exe
  C:\Windows\System\zOFxdgE.exe
  2⤵
  PID:2468
- C:\Windows\System\ERuNcll.exe
  C:\Windows\System\ERuNcll.exe
  2⤵
  PID:6248
- C:\Windows\System\TfpzAXN.exe
  C:\Windows\System\TfpzAXN.exe
  2⤵
  PID:6792
- C:\Windows\System\dEAvYds.exe
  C:\Windows\System\dEAvYds.exe
  2⤵
  PID:6900
- C:\Windows\System\XuQUbvs.exe
  C:\Windows\System\XuQUbvs.exe
  2⤵
  PID:6928
- C:\Windows\System\BAyrCcd.exe
  C:\Windows\System\BAyrCcd.exe
  2⤵
  PID:2596
- C:\Windows\System\iBjMNzM.exe
  C:\Windows\System\iBjMNzM.exe
  2⤵
  PID:6280
- C:\Windows\System\XpyTXDn.exe
  C:\Windows\System\XpyTXDn.exe
  2⤵
  PID:4816
- C:\Windows\System\pmCirNa.exe
  C:\Windows\System\pmCirNa.exe
  2⤵
  PID:6264
- C:\Windows\System\qizoJDN.exe
  C:\Windows\System\qizoJDN.exe
  2⤵
  PID:7120
- C:\Windows\System\hOkPPAy.exe
  C:\Windows\System\hOkPPAy.exe
  2⤵
  PID:7180
- C:\Windows\System\OJnSquR.exe
  C:\Windows\System\OJnSquR.exe
  2⤵
  PID:7196
- C:\Windows\System\yStuWuP.exe
  C:\Windows\System\yStuWuP.exe
  2⤵
  PID:7216
- C:\Windows\System\SJoRdnb.exe
  C:\Windows\System\SJoRdnb.exe
  2⤵
  PID:7232
- C:\Windows\System\ueefIIA.exe
  C:\Windows\System\ueefIIA.exe
  2⤵
  PID:7248
- C:\Windows\System\nvlMkOd.exe
  C:\Windows\System\nvlMkOd.exe
  2⤵
  PID:7264
- C:\Windows\System\rhyKURC.exe
  C:\Windows\System\rhyKURC.exe
  2⤵
  PID:7280
- C:\Windows\System\oYcQnUk.exe
  C:\Windows\System\oYcQnUk.exe
  2⤵
  PID:7296
- C:\Windows\System\gFRiUHt.exe
  C:\Windows\System\gFRiUHt.exe
  2⤵
  PID:7312
- C:\Windows\System\xbPFuVw.exe
  C:\Windows\System\xbPFuVw.exe
  2⤵
  PID:7328
- C:\Windows\System\oUQBFtk.exe
  C:\Windows\System\oUQBFtk.exe
  2⤵
  PID:7344
- C:\Windows\System\ThGIhXS.exe
  C:\Windows\System\ThGIhXS.exe
  2⤵
  PID:7360
- C:\Windows\System\PkaeHxG.exe
  C:\Windows\System\PkaeHxG.exe
  2⤵
  PID:7376
- C:\Windows\System\eaJJOaA.exe
  C:\Windows\System\eaJJOaA.exe
  2⤵
  PID:7392
- C:\Windows\System\wuFuzEi.exe
  C:\Windows\System\wuFuzEi.exe
  2⤵
  PID:7408
- C:\Windows\System\CuyeDcf.exe
  C:\Windows\System\CuyeDcf.exe
  2⤵
  PID:7424
- C:\Windows\System\GjYYHSS.exe
  C:\Windows\System\GjYYHSS.exe
  2⤵
  PID:7440
- C:\Windows\System\LhsoYtp.exe
  C:\Windows\System\LhsoYtp.exe
  2⤵
  PID:7456
- C:\Windows\System\yFBmzhu.exe
  C:\Windows\System\yFBmzhu.exe
  2⤵
  PID:7472
- C:\Windows\System\SsiPvLT.exe
  C:\Windows\System\SsiPvLT.exe
  2⤵
  PID:7488
- C:\Windows\System\ssejVMK.exe
  C:\Windows\System\ssejVMK.exe
  2⤵
  PID:7504
- C:\Windows\System\gRWFJNj.exe
  C:\Windows\System\gRWFJNj.exe
  2⤵
  PID:7520
- C:\Windows\System\oucwOWa.exe
  C:\Windows\System\oucwOWa.exe
  2⤵
  PID:7536
- C:\Windows\System\KDUTvjB.exe
  C:\Windows\System\KDUTvjB.exe
  2⤵
  PID:7552
- C:\Windows\System\naeKAeS.exe
  C:\Windows\System\naeKAeS.exe
  2⤵
  PID:7568
- C:\Windows\System\WfJyBnN.exe
  C:\Windows\System\WfJyBnN.exe
  2⤵
  PID:7584
- C:\Windows\System\apluCux.exe
  C:\Windows\System\apluCux.exe
  2⤵
  PID:7600
- C:\Windows\System\SnHwUsT.exe
  C:\Windows\System\SnHwUsT.exe
  2⤵
  PID:7616
- C:\Windows\System\ijNSMMg.exe
  C:\Windows\System\ijNSMMg.exe
  2⤵
  PID:7632
- C:\Windows\System\xEvtDHI.exe
  C:\Windows\System\xEvtDHI.exe
  2⤵
  PID:7648
- C:\Windows\System\DsSWIeJ.exe
  C:\Windows\System\DsSWIeJ.exe
  2⤵
  PID:7664
- C:\Windows\System\ZqtHqVH.exe
  C:\Windows\System\ZqtHqVH.exe
  2⤵
  PID:7680
- C:\Windows\System\hmqgHyX.exe
  C:\Windows\System\hmqgHyX.exe
  2⤵
  PID:7696
- C:\Windows\System\gFWuLJg.exe
  C:\Windows\System\gFWuLJg.exe
  2⤵
  PID:7712
- C:\Windows\System\zDxcLCM.exe
  C:\Windows\System\zDxcLCM.exe
  2⤵
  PID:7728
- C:\Windows\System\brccmqo.exe
  C:\Windows\System\brccmqo.exe
  2⤵
  PID:7744
- C:\Windows\System\pJiBRfq.exe
  C:\Windows\System\pJiBRfq.exe
  2⤵
  PID:7760
- C:\Windows\System\VmUJMEe.exe
  C:\Windows\System\VmUJMEe.exe
  2⤵
  PID:7776
- C:\Windows\System\HNddTTH.exe
  C:\Windows\System\HNddTTH.exe
  2⤵
  PID:7792
- C:\Windows\System\rdqvdOT.exe
  C:\Windows\System\rdqvdOT.exe
  2⤵
  PID:7808
- C:\Windows\System\EmMwVhf.exe
  C:\Windows\System\EmMwVhf.exe
  2⤵
  PID:7824
- C:\Windows\System\QpaiKBT.exe
  C:\Windows\System\QpaiKBT.exe
  2⤵
  PID:7840
- C:\Windows\System\fKlBkUx.exe
  C:\Windows\System\fKlBkUx.exe
  2⤵
  PID:7856
- C:\Windows\System\mesKehp.exe
  C:\Windows\System\mesKehp.exe
  2⤵
  PID:7872
- C:\Windows\System\tvUNGvp.exe
  C:\Windows\System\tvUNGvp.exe
  2⤵
  PID:7888
- C:\Windows\System\QzAIDlP.exe
  C:\Windows\System\QzAIDlP.exe
  2⤵
  PID:7904
- C:\Windows\System\BugSMdi.exe
  C:\Windows\System\BugSMdi.exe
  2⤵
  PID:7920
- C:\Windows\System\RjTABUD.exe
  C:\Windows\System\RjTABUD.exe
  2⤵
  PID:7936
- C:\Windows\System\PJioWCx.exe
  C:\Windows\System\PJioWCx.exe
  2⤵
  PID:7952
- C:\Windows\System\trnpWxn.exe
  C:\Windows\System\trnpWxn.exe
  2⤵
  PID:7968
- C:\Windows\System\OUOMcbw.exe
  C:\Windows\System\OUOMcbw.exe
  2⤵
  PID:7984
- C:\Windows\System\abZtrrm.exe
  C:\Windows\System\abZtrrm.exe
  2⤵
  PID:8000
- C:\Windows\System\OuatVea.exe
  C:\Windows\System\OuatVea.exe
  2⤵
  PID:8016
- C:\Windows\System\tpTwyhx.exe
  C:\Windows\System\tpTwyhx.exe
  2⤵
  PID:8032
- C:\Windows\System\dIgnTSz.exe
  C:\Windows\System\dIgnTSz.exe
  2⤵
  PID:8048
- C:\Windows\System\wNeltrM.exe
  C:\Windows\System\wNeltrM.exe
  2⤵
  PID:8064
- C:\Windows\System\lUtrElo.exe
  C:\Windows\System\lUtrElo.exe
  2⤵
  PID:8080
- C:\Windows\System\meBrgVY.exe
  C:\Windows\System\meBrgVY.exe
  2⤵
  PID:8096
- C:\Windows\System\cQcxWbz.exe
  C:\Windows\System\cQcxWbz.exe
  2⤵
  PID:8112
- C:\Windows\System\PrRgBqg.exe
  C:\Windows\System\PrRgBqg.exe
  2⤵
  PID:8128
- C:\Windows\System\TquWyXh.exe
  C:\Windows\System\TquWyXh.exe
  2⤵
  PID:8144
- C:\Windows\System\OXAbwoQ.exe
  C:\Windows\System\OXAbwoQ.exe
  2⤵
  PID:8160
- C:\Windows\System\oZknXVc.exe
  C:\Windows\System\oZknXVc.exe
  2⤵
  PID:8176
- C:\Windows\System\cooleqh.exe
  C:\Windows\System\cooleqh.exe
  2⤵
  PID:7076
- C:\Windows\System\ZECLbbr.exe
  C:\Windows\System\ZECLbbr.exe
  2⤵
  PID:6944
- C:\Windows\System\tznLRTT.exe
  C:\Windows\System\tznLRTT.exe
  2⤵
  PID:6428
- C:\Windows\System\SILyGMz.exe
  C:\Windows\System\SILyGMz.exe
  2⤵
  PID:7260
- C:\Windows\System\WTvHTru.exe
  C:\Windows\System\WTvHTru.exe
  2⤵
  PID:6760
- C:\Windows\System\VJxwgbs.exe
  C:\Windows\System\VJxwgbs.exe
  2⤵
  PID:6636
- C:\Windows\System\oBNFhXo.exe
  C:\Windows\System\oBNFhXo.exe
  2⤵
  PID:7212
- C:\Windows\System\OFHObNm.exe
  C:\Windows\System\OFHObNm.exe
  2⤵
  PID:7308
- C:\Windows\System\ROFlsMn.exe
  C:\Windows\System\ROFlsMn.exe
  2⤵
  PID:7240
- C:\Windows\System\jlGcvAQ.exe
  C:\Windows\System\jlGcvAQ.exe
  2⤵
  PID:7384
- C:\Windows\System\ATeSnvx.exe
  C:\Windows\System\ATeSnvx.exe
  2⤵
  PID:7372
- C:\Windows\System\WPjKGfF.exe
  C:\Windows\System\WPjKGfF.exe
  2⤵
  PID:7416
- C:\Windows\System\kmbXMjq.exe
  C:\Windows\System\kmbXMjq.exe
  2⤵
  PID:7480
- C:\Windows\System\cODDvur.exe
  C:\Windows\System\cODDvur.exe
  2⤵
  PID:7468
- C:\Windows\System\XUmKwEf.exe
  C:\Windows\System\XUmKwEf.exe
  2⤵
  PID:7512
- C:\Windows\System\hJutoXB.exe
  C:\Windows\System\hJutoXB.exe
  2⤵
  PID:7576
- C:\Windows\System\msCBUQc.exe
  C:\Windows\System\msCBUQc.exe
  2⤵
  PID:7500
- C:\Windows\System\qeKBhCV.exe
  C:\Windows\System\qeKBhCV.exe
  2⤵
  PID:7672
- C:\Windows\System\TwVNrbD.exe
  C:\Windows\System\TwVNrbD.exe
  2⤵
  PID:7708
- C:\Windows\System\XCcUxhS.exe
  C:\Windows\System\XCcUxhS.exe
  2⤵
  PID:7532
- C:\Windows\System\JpAHiXz.exe
  C:\Windows\System\JpAHiXz.exe
  2⤵
  PID:7656
- C:\Windows\System\rvBUvnt.exe
  C:\Windows\System\rvBUvnt.exe
  2⤵
  PID:7772
- C:\Windows\System\PzYUKnD.exe
  C:\Windows\System\PzYUKnD.exe
  2⤵
  PID:7804
- C:\Windows\System\PqNHfLo.exe
  C:\Windows\System\PqNHfLo.exe
  2⤵
  PID:7868
- C:\Windows\System\ymbLlQd.exe
  C:\Windows\System\ymbLlQd.exe
  2⤵
  PID:7724
- C:\Windows\System\gGVjkjS.exe
  C:\Windows\System\gGVjkjS.exe
  2⤵
  PID:7928
- C:\Windows\System\pTMKBmM.exe
  C:\Windows\System\pTMKBmM.exe
  2⤵
  PID:7852
- C:\Windows\System\hnqKHli.exe
  C:\Windows\System\hnqKHli.exe
  2⤵
  PID:7960
- C:\Windows\System\aMgxiMN.exe
  C:\Windows\System\aMgxiMN.exe
  2⤵
  PID:7992
- C:\Windows\System\WDFGqcn.exe
  C:\Windows\System\WDFGqcn.exe
  2⤵
  PID:8056
- C:\Windows\System\qxwWcLG.exe
  C:\Windows\System\qxwWcLG.exe
  2⤵
  PID:8040
- C:\Windows\System\iIYeNmA.exe
  C:\Windows\System\iIYeNmA.exe
  2⤵
  PID:8012
- C:\Windows\System\AYQkZPi.exe
  C:\Windows\System\AYQkZPi.exe
  2⤵
  PID:8088
- C:\Windows\System\SFCrtWL.exe
  C:\Windows\System\SFCrtWL.exe
  2⤵
  PID:8156
- C:\Windows\System\jzCKfDz.exe
  C:\Windows\System\jzCKfDz.exe
  2⤵
  PID:8172
- C:\Windows\System\qwuiiLx.exe
  C:\Windows\System\qwuiiLx.exe
  2⤵
  PID:8168
- C:\Windows\System\zdccMjU.exe
  C:\Windows\System\zdccMjU.exe
  2⤵
  PID:6728
- C:\Windows\System\qiQroUy.exe
  C:\Windows\System\qiQroUy.exe
  2⤵
  PID:7292
- C:\Windows\System\jVStbbD.exe
  C:\Windows\System\jVStbbD.exe
  2⤵
  PID:7320
- C:\Windows\System\hvtNUWz.exe
  C:\Windows\System\hvtNUWz.exe
  2⤵
  PID:7368
- C:\Windows\System\bCVSmCO.exe
  C:\Windows\System\bCVSmCO.exe
  2⤵
  PID:7272
- C:\Windows\System\VFzrkxS.exe
  C:\Windows\System\VFzrkxS.exe
  2⤵
  PID:7452
- C:\Windows\System\dHHXmyC.exe
  C:\Windows\System\dHHXmyC.exe
  2⤵
  PID:7612
- C:\Windows\System\NSCdPBY.exe
  C:\Windows\System\NSCdPBY.exe
  2⤵
  PID:7640
- C:\Windows\System\sNsRAER.exe
  C:\Windows\System\sNsRAER.exe
  2⤵
  PID:7692
- C:\Windows\System\LQFtnRE.exe
  C:\Windows\System\LQFtnRE.exe
  2⤵
  PID:7644
- C:\Windows\System\oYQGKeO.exe
  C:\Windows\System\oYQGKeO.exe
  2⤵
  PID:7800
- C:\Windows\System\GQNASJH.exe
  C:\Windows\System\GQNASJH.exe
  2⤵
  PID:7820
- C:\Windows\System\SJwXIdS.exe
  C:\Windows\System\SJwXIdS.exe
  2⤵
  PID:7900
- C:\Windows\System\IxZsWEn.exe
  C:\Windows\System\IxZsWEn.exe
  2⤵
  PID:7756
- C:\Windows\System\UywRaUK.exe
  C:\Windows\System\UywRaUK.exe
  2⤵
  PID:8044
- C:\Windows\System\RvUPODM.exe
  C:\Windows\System\RvUPODM.exe
  2⤵
  PID:7976
- C:\Windows\System\BTXHAfD.exe
  C:\Windows\System\BTXHAfD.exe
  2⤵
  PID:8120
- C:\Windows\System\nnzKPcV.exe
  C:\Windows\System\nnzKPcV.exe
  2⤵
  PID:7188
- C:\Windows\System\dTPrdkD.exe
  C:\Windows\System\dTPrdkD.exe
  2⤵
  PID:7256
- C:\Windows\System\bBkaSVG.exe
  C:\Windows\System\bBkaSVG.exe
  2⤵
  PID:6876
- C:\Windows\System\jzgTjEw.exe
  C:\Windows\System\jzgTjEw.exe
  2⤵
  PID:7608
- C:\Windows\System\lQjOhqM.exe
  C:\Windows\System\lQjOhqM.exe
  2⤵
  PID:7356
- C:\Windows\System\DQmTHaO.exe
  C:\Windows\System\DQmTHaO.exe
  2⤵
  PID:7660
- C:\Windows\System\Eniopzi.exe
  C:\Windows\System\Eniopzi.exe
  2⤵
  PID:7464
- C:\Windows\System\GRRzmxG.exe
  C:\Windows\System\GRRzmxG.exe
  2⤵
  PID:7836
- C:\Windows\System\MiOfRoy.exe
  C:\Windows\System\MiOfRoy.exe
  2⤵
  PID:6532
- C:\Windows\System\ebsqSMi.exe
  C:\Windows\System\ebsqSMi.exe
  2⤵
  PID:7496
- C:\Windows\System\WIaGMuE.exe
  C:\Windows\System\WIaGMuE.exe
  2⤵
  PID:8320
- C:\Windows\System\Rjlcmaj.exe
  C:\Windows\System\Rjlcmaj.exe
  2⤵
  PID:8336
- C:\Windows\System\zUHKHtS.exe
  C:\Windows\System\zUHKHtS.exe
  2⤵
  PID:8352
- C:\Windows\System\LBcRmhs.exe
  C:\Windows\System\LBcRmhs.exe
  2⤵
  PID:8368
- C:\Windows\System\JYBSVdt.exe
  C:\Windows\System\JYBSVdt.exe
  2⤵
  PID:8384
- C:\Windows\System\CkaCqJL.exe
  C:\Windows\System\CkaCqJL.exe
  2⤵
  PID:8400
- C:\Windows\System\XspWyXU.exe
  C:\Windows\System\XspWyXU.exe
  2⤵
  PID:8416
- C:\Windows\System\fZhhGEk.exe
  C:\Windows\System\fZhhGEk.exe
  2⤵
  PID:8432
- C:\Windows\System\GMyuDbJ.exe
  C:\Windows\System\GMyuDbJ.exe
  2⤵
  PID:8448
- C:\Windows\System\AeghMAC.exe
  C:\Windows\System\AeghMAC.exe
  2⤵
  PID:8464
- C:\Windows\System\jzJAzwb.exe
  C:\Windows\System\jzJAzwb.exe
  2⤵
  PID:8480
- C:\Windows\System\bzOsyzg.exe
  C:\Windows\System\bzOsyzg.exe
  2⤵
  PID:8496
- C:\Windows\System\xMdaMJv.exe
  C:\Windows\System\xMdaMJv.exe
  2⤵
  PID:8512
- C:\Windows\System\YyRyhMd.exe
  C:\Windows\System\YyRyhMd.exe
  2⤵
  PID:8528
- C:\Windows\System\qDwVadv.exe
  C:\Windows\System\qDwVadv.exe
  2⤵
  PID:8544
- C:\Windows\System\GExUvlu.exe
  C:\Windows\System\GExUvlu.exe
  2⤵
  PID:8560
- C:\Windows\System\HrcyXQY.exe
  C:\Windows\System\HrcyXQY.exe
  2⤵
  PID:8576
- C:\Windows\System\sjgUBbC.exe
  C:\Windows\System\sjgUBbC.exe
  2⤵
  PID:8592
- C:\Windows\System\AMfQXyu.exe
  C:\Windows\System\AMfQXyu.exe
  2⤵
  PID:8608
- C:\Windows\System\CDUQPCs.exe
  C:\Windows\System\CDUQPCs.exe
  2⤵
  PID:8624
- C:\Windows\System\SAWpwRv.exe
  C:\Windows\System\SAWpwRv.exe
  2⤵
  PID:8640
- C:\Windows\System\gZzHHsa.exe
  C:\Windows\System\gZzHHsa.exe
  2⤵
  PID:8656
- C:\Windows\System\lSxtsAT.exe
  C:\Windows\System\lSxtsAT.exe
  2⤵
  PID:8672
- C:\Windows\System\AixqYon.exe
  C:\Windows\System\AixqYon.exe
  2⤵
  PID:8688
- C:\Windows\System\DlXOeJq.exe
  C:\Windows\System\DlXOeJq.exe
  2⤵
  PID:8704
- C:\Windows\System\jaZrilS.exe
  C:\Windows\System\jaZrilS.exe
  2⤵
  PID:8720
- C:\Windows\System\jcTbpZD.exe
  C:\Windows\System\jcTbpZD.exe
  2⤵
  PID:8736
- C:\Windows\System\tbASDOC.exe
  C:\Windows\System\tbASDOC.exe
  2⤵
  PID:8752
- C:\Windows\System\yUqdJLk.exe
  C:\Windows\System\yUqdJLk.exe
  2⤵
  PID:8768
- C:\Windows\System\GsWcKiX.exe
  C:\Windows\System\GsWcKiX.exe
  2⤵
  PID:8784
- C:\Windows\System\DPtaGWJ.exe
  C:\Windows\System\DPtaGWJ.exe
  2⤵
  PID:8804
- C:\Windows\System\iDAvyXs.exe
  C:\Windows\System\iDAvyXs.exe
  2⤵
  PID:8820
- C:\Windows\System\ADzLgES.exe
  C:\Windows\System\ADzLgES.exe
  2⤵
  PID:8836
- C:\Windows\System\aZKrbYn.exe
  C:\Windows\System\aZKrbYn.exe
  2⤵
  PID:8852
- C:\Windows\System\hxddLqM.exe
  C:\Windows\System\hxddLqM.exe
  2⤵
  PID:8868
- C:\Windows\System\VtkiJJq.exe
  C:\Windows\System\VtkiJJq.exe
  2⤵
  PID:8884
- C:\Windows\System\XiTmxgb.exe
  C:\Windows\System\XiTmxgb.exe
  2⤵
  PID:8900
- C:\Windows\System\PeUdZyf.exe
  C:\Windows\System\PeUdZyf.exe
  2⤵
  PID:8916
- C:\Windows\System\mnPuxjR.exe
  C:\Windows\System\mnPuxjR.exe
  2⤵
  PID:8932
- C:\Windows\System\zunAnia.exe
  C:\Windows\System\zunAnia.exe
  2⤵
  PID:8948
- C:\Windows\System\CwqlvDq.exe
  C:\Windows\System\CwqlvDq.exe
  2⤵
  PID:8964
- C:\Windows\System\eJEHOya.exe
  C:\Windows\System\eJEHOya.exe
  2⤵
  PID:8980
- C:\Windows\System\QmqhLJC.exe
  C:\Windows\System\QmqhLJC.exe
  2⤵
  PID:8996
- C:\Windows\System\uBaFBxR.exe
  C:\Windows\System\uBaFBxR.exe
  2⤵
  PID:9012
- C:\Windows\System\BEKobZV.exe
  C:\Windows\System\BEKobZV.exe
  2⤵
  PID:9028
- C:\Windows\System\zTxNEEj.exe
  C:\Windows\System\zTxNEEj.exe
  2⤵
  PID:9044
- C:\Windows\System\JZftPdZ.exe
  C:\Windows\System\JZftPdZ.exe
  2⤵
  PID:9060
- C:\Windows\System\GXQKBfy.exe
  C:\Windows\System\GXQKBfy.exe
  2⤵
  PID:9076
- C:\Windows\System\rSkvHvX.exe
  C:\Windows\System\rSkvHvX.exe
  2⤵
  PID:9092
- C:\Windows\System\NxsczST.exe
  C:\Windows\System\NxsczST.exe
  2⤵
  PID:9108
- C:\Windows\System\PDszaGu.exe
  C:\Windows\System\PDszaGu.exe
  2⤵
  PID:9124
- C:\Windows\System\cZPqEwB.exe
  C:\Windows\System\cZPqEwB.exe
  2⤵
  PID:9140
- C:\Windows\System\PIClNbB.exe
  C:\Windows\System\PIClNbB.exe
  2⤵
  PID:9156
- C:\Windows\System\IHzKaqc.exe
  C:\Windows\System\IHzKaqc.exe
  2⤵
  PID:9172
- C:\Windows\System\XrWTacj.exe
  C:\Windows\System\XrWTacj.exe
  2⤵
  PID:9188
- C:\Windows\System\roFodLS.exe
  C:\Windows\System\roFodLS.exe
  2⤵
  PID:9204
- C:\Windows\System\oytCkiP.exe
  C:\Windows\System\oytCkiP.exe
  2⤵
  PID:6464
- C:\Windows\System\vGqzIdV.exe
  C:\Windows\System\vGqzIdV.exe
  2⤵
  PID:8028
- C:\Windows\System\PxhvtLS.exe
  C:\Windows\System\PxhvtLS.exe
  2⤵
  PID:8204
- C:\Windows\System\VlhEUCM.exe
  C:\Windows\System\VlhEUCM.exe
  2⤵
  PID:8220
- C:\Windows\System\uUsxNPP.exe
  C:\Windows\System\uUsxNPP.exe
  2⤵
  PID:8252
- C:\Windows\System\AwGBZlw.exe
  C:\Windows\System\AwGBZlw.exe
  2⤵
  PID:8244
- C:\Windows\System\NCXqLrN.exe
  C:\Windows\System\NCXqLrN.exe
  2⤵
  PID:8264
- C:\Windows\System\JAAIEEZ.exe
  C:\Windows\System\JAAIEEZ.exe
  2⤵
  PID:8280
- C:\Windows\System\BvuFApM.exe
  C:\Windows\System\BvuFApM.exe
  2⤵
  PID:8292
- C:\Windows\System\TNlrbBO.exe
  C:\Windows\System\TNlrbBO.exe
  2⤵
  PID:7628
- C:\Windows\System\UxvXDjF.exe
  C:\Windows\System\UxvXDjF.exe
  2⤵
  PID:8300
- C:\Windows\System\WrigNRp.exe
  C:\Windows\System\WrigNRp.exe
  2⤵
  PID:7752
- C:\Windows\System\tCFfIBM.exe
  C:\Windows\System\tCFfIBM.exe
  2⤵
  PID:8344
- C:\Windows\System\GFXRwdD.exe
  C:\Windows\System\GFXRwdD.exe
  2⤵
  PID:8408
- C:\Windows\System\SWmdXxj.exe
  C:\Windows\System\SWmdXxj.exe
  2⤵
  PID:8472
- C:\Windows\System\RPTmohJ.exe
  C:\Windows\System\RPTmohJ.exe
  2⤵
  PID:8540
- C:\Windows\System\aHVGhqs.exe
  C:\Windows\System\aHVGhqs.exe
  2⤵
  PID:8604
- C:\Windows\System\pgOrRwD.exe
  C:\Windows\System\pgOrRwD.exe
  2⤵
  PID:8664
- C:\Windows\System\ZWfjOQQ.exe
  C:\Windows\System\ZWfjOQQ.exe
  2⤵
  PID:8728
- C:\Windows\System\nHLSrRC.exe
  C:\Windows\System\nHLSrRC.exe
  2⤵
  PID:8792
- C:\Windows\System\KGroNru.exe
  C:\Windows\System\KGroNru.exe
  2⤵
  PID:8364
- C:\Windows\System\kbgKtjv.exe
  C:\Windows\System\kbgKtjv.exe
  2⤵
  PID:8428
- C:\Windows\System\UHTEGFn.exe
  C:\Windows\System\UHTEGFn.exe
  2⤵
  PID:8492
- C:\Windows\System\kSYqWSf.exe
  C:\Windows\System\kSYqWSf.exe
  2⤵
  PID:8556
- C:\Windows\System\MtLPNqt.exe
  C:\Windows\System\MtLPNqt.exe
  2⤵
  PID:8620
- C:\Windows\System\hzaMWud.exe
  C:\Windows\System\hzaMWud.exe
  2⤵
  PID:8684
- C:\Windows\System\UarCiKn.exe
  C:\Windows\System\UarCiKn.exe
  2⤵
  PID:8748
- C:\Windows\System\mKzbCTc.exe
  C:\Windows\System\mKzbCTc.exe
  2⤵
  PID:9008
- C:\Windows\System\iYnIigh.exe
  C:\Windows\System\iYnIigh.exe
  2⤵
  PID:8944
- C:\Windows\System\bFHVLPM.exe
  C:\Windows\System\bFHVLPM.exe
  2⤵
  PID:8880
- C:\Windows\System\UkHrDat.exe
  C:\Windows\System\UkHrDat.exe
  2⤵
  PID:8860
- C:\Windows\System\SnSrBdN.exe
  C:\Windows\System\SnSrBdN.exe
  2⤵
  PID:8892
- C:\Windows\System\LMXeaxg.exe
  C:\Windows\System\LMXeaxg.exe
  2⤵
  PID:9052
- C:\Windows\System\DIqRkac.exe
  C:\Windows\System\DIqRkac.exe
  2⤵
  PID:8992
- C:\Windows\System\MIZuhOl.exe
  C:\Windows\System\MIZuhOl.exe
  2⤵
  PID:9088
- C:\Windows\System\ASKMyAs.exe
  C:\Windows\System\ASKMyAs.exe
  2⤵
  PID:9148
- C:\Windows\System\xhRxWlY.exe
  C:\Windows\System\xhRxWlY.exe
  2⤵
  PID:8196
- C:\Windows\System\HoyrvKw.exe
  C:\Windows\System\HoyrvKw.exe
  2⤵
  PID:8288
- C:\Windows\System\wibvkGK.exe
  C:\Windows\System\wibvkGK.exe
  2⤵
  PID:8260
- C:\Windows\System\wfIKQjQ.exe
  C:\Windows\System\wfIKQjQ.exe
  2⤵
  PID:9132
- C:\Windows\System\jaQAdEb.exe
  C:\Windows\System\jaQAdEb.exe
  2⤵
  PID:9200
- C:\Windows\System\qDYsugg.exe
  C:\Windows\System\qDYsugg.exe
  2⤵
  PID:8228
- C:\Windows\System\LIrGKqB.exe
  C:\Windows\System\LIrGKqB.exe
  2⤵
  PID:7884
- C:\Windows\System\MXDLWms.exe
  C:\Windows\System\MXDLWms.exe
  2⤵
  PID:9068
- C:\Windows\System\CKfNJQP.exe
  C:\Windows\System\CKfNJQP.exe
  2⤵
  PID:8376
- C:\Windows\System\HTNGsal.exe
  C:\Windows\System\HTNGsal.exe
  2⤵
  PID:8600
- C:\Windows\System\HbmFswI.exe
  C:\Windows\System\HbmFswI.exe
  2⤵
  PID:8828
- C:\Windows\System\hknpCFO.exe
  C:\Windows\System\hknpCFO.exe
  2⤵
  PID:8696
- C:\Windows\System\UFPWJlE.exe
  C:\Windows\System\UFPWJlE.exe
  2⤵
  PID:8812
- C:\Windows\System\mamCDhM.exe
  C:\Windows\System\mamCDhM.exe
  2⤵
  PID:8632
- C:\Windows\System\uosNzps.exe
  C:\Windows\System\uosNzps.exe
  2⤵
  PID:8316
- C:\Windows\System\wCJfxWP.exe
  C:\Windows\System\wCJfxWP.exe
  2⤵
  PID:8652
- C:\Windows\System\UTheSoT.exe
  C:\Windows\System\UTheSoT.exe
  2⤵
  PID:8460
- C:\Windows\System\pBWtfuR.exe
  C:\Windows\System\pBWtfuR.exe
  2⤵
  PID:8832
- C:\Windows\System\jKfqxGq.exe
  C:\Windows\System\jKfqxGq.exe
  2⤵
  PID:9120
- C:\Windows\System\XsyljgU.exe
  C:\Windows\System\XsyljgU.exe
  2⤵
  PID:8488
- C:\Windows\System\RoDKRue.exe
  C:\Windows\System\RoDKRue.exe
  2⤵
  PID:8716
- C:\Windows\System\XeDUiLQ.exe
  C:\Windows\System\XeDUiLQ.exe
  2⤵
  PID:8924
- C:\Windows\System\jiNRqba.exe
  C:\Windows\System\jiNRqba.exe
  2⤵
  PID:9184
- C:\Windows\System\UHnjrCT.exe
  C:\Windows\System\UHnjrCT.exe
  2⤵
  PID:8312
- C:\Windows\System\HnqOPuk.exe
  C:\Windows\System\HnqOPuk.exe
  2⤵
  PID:8240
- C:\Windows\System\rzYyuKs.exe
  C:\Windows\System\rzYyuKs.exe
  2⤵
  PID:8276
- C:\Windows\System\oDqBUVE.exe
  C:\Windows\System\oDqBUVE.exe
  2⤵
  PID:8444
- C:\Windows\System\vdDAdBi.exe
  C:\Windows\System\vdDAdBi.exe
  2⤵
  PID:7948
- C:\Windows\System\SzDqApk.exe
  C:\Windows\System\SzDqApk.exe
  2⤵
  PID:8636
- C:\Windows\System\eDinWFA.exe
  C:\Windows\System\eDinWFA.exe
  2⤵
  PID:8908
- C:\Windows\System\rHKXKwk.exe
  C:\Windows\System\rHKXKwk.exe
  2⤵
  PID:9040
- C:\Windows\System\aappjvZ.exe
  C:\Windows\System\aappjvZ.exe
  2⤵
  PID:8216
- C:\Windows\System\qfZFVvx.exe
  C:\Windows\System\qfZFVvx.exe
  2⤵
  PID:9152
- C:\Windows\System\nZANGws.exe
  C:\Windows\System\nZANGws.exe
  2⤵
  PID:7528
- C:\Windows\System\mVapywU.exe
  C:\Windows\System\mVapywU.exe
  2⤵
  PID:8848
- C:\Windows\System\iDbluEu.exe
  C:\Windows\System\iDbluEu.exe
  2⤵
  PID:8508
- C:\Windows\System\jyDAmlX.exe
  C:\Windows\System\jyDAmlX.exe
  2⤵
  PID:8800
- C:\Windows\System\kDvnwTW.exe
  C:\Windows\System\kDvnwTW.exe
  2⤵
  PID:8524
- C:\Windows\System\KsbrbEV.exe
  C:\Windows\System\KsbrbEV.exe
  2⤵
  PID:8780
- C:\Windows\System\AAxHvWY.exe
  C:\Windows\System\AAxHvWY.exe
  2⤵
  PID:9168
- C:\Windows\System\vFMgbhA.exe
  C:\Windows\System\vFMgbhA.exe
  2⤵
  PID:9220
- C:\Windows\System\WKJpgCz.exe
  C:\Windows\System\WKJpgCz.exe
  2⤵
  PID:9236
- C:\Windows\System\RZsVZgF.exe
  C:\Windows\System\RZsVZgF.exe
  2⤵
  PID:9252
- C:\Windows\System\IuNHmBg.exe
  C:\Windows\System\IuNHmBg.exe
  2⤵
  PID:9268
- C:\Windows\System\iWFcybB.exe
  C:\Windows\System\iWFcybB.exe
  2⤵
  PID:9284
- C:\Windows\System\UbEwxHt.exe
  C:\Windows\System\UbEwxHt.exe
  2⤵
  PID:9300
- C:\Windows\System\mbBRqsG.exe
  C:\Windows\System\mbBRqsG.exe
  2⤵
  PID:9316
- C:\Windows\System\KqFwOkI.exe
  C:\Windows\System\KqFwOkI.exe
  2⤵
  PID:9332
- C:\Windows\System\mmbFbtS.exe
  C:\Windows\System\mmbFbtS.exe
  2⤵
  PID:9348
- C:\Windows\System\hSwjeoQ.exe
  C:\Windows\System\hSwjeoQ.exe
  2⤵
  PID:9364
- C:\Windows\System\GAvHdjB.exe
  C:\Windows\System\GAvHdjB.exe
  2⤵
  PID:9380
- C:\Windows\System\bxhWVmZ.exe
  C:\Windows\System\bxhWVmZ.exe
  2⤵
  PID:9396
- C:\Windows\System\uaYgQqK.exe
  C:\Windows\System\uaYgQqK.exe
  2⤵
  PID:9412
- C:\Windows\System\PhWozAN.exe
  C:\Windows\System\PhWozAN.exe
  2⤵
  PID:9428
- C:\Windows\System\OreXYNy.exe
  C:\Windows\System\OreXYNy.exe
  2⤵
  PID:9444
- C:\Windows\System\qQQqfyE.exe
  C:\Windows\System\qQQqfyE.exe
  2⤵
  PID:9460
- C:\Windows\System\yBTiMDE.exe
  C:\Windows\System\yBTiMDE.exe
  2⤵
  PID:9476
- C:\Windows\System\PgQTdYy.exe
  C:\Windows\System\PgQTdYy.exe
  2⤵
  PID:9492
- C:\Windows\System\HihKDWm.exe
  C:\Windows\System\HihKDWm.exe
  2⤵
  PID:9508
- C:\Windows\System\LaJGbpv.exe
  C:\Windows\System\LaJGbpv.exe
  2⤵
  PID:9524
- C:\Windows\System\Hbceqas.exe
  C:\Windows\System\Hbceqas.exe
  2⤵
  PID:9540
- C:\Windows\System\FczBSuH.exe
  C:\Windows\System\FczBSuH.exe
  2⤵
  PID:9556
- C:\Windows\System\vFNDyOE.exe
  C:\Windows\System\vFNDyOE.exe
  2⤵
  PID:9572
- C:\Windows\System\LFYJMoU.exe
  C:\Windows\System\LFYJMoU.exe
  2⤵
  PID:9588
- C:\Windows\System\ilDZkqM.exe
  C:\Windows\System\ilDZkqM.exe
  2⤵
  PID:9604
- C:\Windows\System\XImDYPs.exe
  C:\Windows\System\XImDYPs.exe
  2⤵
  PID:9620
- C:\Windows\System\ZhOgocn.exe
  C:\Windows\System\ZhOgocn.exe
  2⤵
  PID:9636
- C:\Windows\System\MtqIeLV.exe
  C:\Windows\System\MtqIeLV.exe
  2⤵
  PID:9652
- C:\Windows\System\WoZWYBo.exe
  C:\Windows\System\WoZWYBo.exe
  2⤵
  PID:9668
- C:\Windows\System\wLowhpL.exe
  C:\Windows\System\wLowhpL.exe
  2⤵
  PID:9688
- C:\Windows\System\eXsWclc.exe
  C:\Windows\System\eXsWclc.exe
  2⤵
  PID:9704
- C:\Windows\System\HcjdsUR.exe
  C:\Windows\System\HcjdsUR.exe
  2⤵
  PID:9724
- C:\Windows\System\EoenwAn.exe
  C:\Windows\System\EoenwAn.exe
  2⤵
  PID:9740
- C:\Windows\System\vboUFIq.exe
  C:\Windows\System\vboUFIq.exe
  2⤵
  PID:9756
- C:\Windows\System\MPTltGx.exe
  C:\Windows\System\MPTltGx.exe
  2⤵
  PID:9772
- C:\Windows\System\qUmtuLH.exe
  C:\Windows\System\qUmtuLH.exe
  2⤵
  PID:9788
- C:\Windows\System\GumsQVF.exe
  C:\Windows\System\GumsQVF.exe
  2⤵
  PID:9804
- C:\Windows\System\EgjsEwK.exe
  C:\Windows\System\EgjsEwK.exe
  2⤵
  PID:9820
- C:\Windows\System\FIuszIC.exe
  C:\Windows\System\FIuszIC.exe
  2⤵
  PID:9836
- C:\Windows\System\BDyqnEt.exe
  C:\Windows\System\BDyqnEt.exe
  2⤵
  PID:9852
- C:\Windows\System\Ecniiwl.exe
  C:\Windows\System\Ecniiwl.exe
  2⤵
  PID:9868
- C:\Windows\System\UONaIWK.exe
  C:\Windows\System\UONaIWK.exe
  2⤵
  PID:9884
- C:\Windows\System\JKnPBxr.exe
  C:\Windows\System\JKnPBxr.exe
  2⤵
  PID:9900
- C:\Windows\System\xeDmuFW.exe
  C:\Windows\System\xeDmuFW.exe
  2⤵
  PID:9916
- C:\Windows\System\PlEqKaF.exe
  C:\Windows\System\PlEqKaF.exe
  2⤵
  PID:9932
- C:\Windows\System\OBBTRvr.exe
  C:\Windows\System\OBBTRvr.exe
  2⤵
  PID:9948
- C:\Windows\System\rcyZzgX.exe
  C:\Windows\System\rcyZzgX.exe
  2⤵
  PID:9964
- C:\Windows\System\odNZVuT.exe
  C:\Windows\System\odNZVuT.exe
  2⤵
  PID:9980
- C:\Windows\System\NPqFOxU.exe
  C:\Windows\System\NPqFOxU.exe
  2⤵
  PID:9996
- C:\Windows\System\veRGdTG.exe
  C:\Windows\System\veRGdTG.exe
  2⤵
  PID:10012
- C:\Windows\System\tvQUUrl.exe
  C:\Windows\System\tvQUUrl.exe
  2⤵
  PID:10028
- C:\Windows\System\tNAqgbo.exe
  C:\Windows\System\tNAqgbo.exe
  2⤵
  PID:10044
- C:\Windows\System\AoiXGFA.exe
  C:\Windows\System\AoiXGFA.exe
  2⤵
  PID:10060
- C:\Windows\System\vymgQpE.exe
  C:\Windows\System\vymgQpE.exe
  2⤵
  PID:10076
- C:\Windows\System\trSSPUg.exe
  C:\Windows\System\trSSPUg.exe
  2⤵
  PID:10092
- C:\Windows\System\wnaAEdZ.exe
  C:\Windows\System\wnaAEdZ.exe
  2⤵
  PID:10108
- C:\Windows\System\EPVEUeI.exe
  C:\Windows\System\EPVEUeI.exe
  2⤵
  PID:10124
- C:\Windows\System\pXvRtsU.exe
  C:\Windows\System\pXvRtsU.exe
  2⤵
  PID:10140
- C:\Windows\System\vgxVTCa.exe
  C:\Windows\System\vgxVTCa.exe
  2⤵
  PID:10156
- C:\Windows\System\JIdIkvb.exe
  C:\Windows\System\JIdIkvb.exe
  2⤵
  PID:10172
- C:\Windows\System\akVIKMZ.exe
  C:\Windows\System\akVIKMZ.exe
  2⤵
  PID:10188
- C:\Windows\System\PktnVRr.exe
  C:\Windows\System\PktnVRr.exe
  2⤵
  PID:10204
- C:\Windows\System\XFZmctr.exe
  C:\Windows\System\XFZmctr.exe
  2⤵
  PID:10220
- C:\Windows\System\nBivWJn.exe
  C:\Windows\System\nBivWJn.exe
  2⤵
  PID:10236
- C:\Windows\System\IBjvLZJ.exe
  C:\Windows\System\IBjvLZJ.exe
  2⤵
  PID:9264
- C:\Windows\System\jGQVTFG.exe
  C:\Windows\System\jGQVTFG.exe
  2⤵
  PID:8700
- C:\Windows\System\QqEpFSa.exe
  C:\Windows\System\QqEpFSa.exe
  2⤵
  PID:8396
- C:\Windows\System\KvGKQxz.exe
  C:\Windows\System\KvGKQxz.exe
  2⤵
  PID:9324
- C:\Windows\System\eEnGYGK.exe
  C:\Windows\System\eEnGYGK.exe
  2⤵
  PID:9388
- C:\Windows\System\GMMcmuk.exe
  C:\Windows\System\GMMcmuk.exe
  2⤵
  PID:9452
- C:\Windows\System\IqOdtPR.exe
  C:\Windows\System\IqOdtPR.exe
  2⤵
  PID:9280
- C:\Windows\System\GkQsQdl.exe
  C:\Windows\System\GkQsQdl.exe
  2⤵
  PID:9436
- C:\Windows\System\DgTdlew.exe
  C:\Windows\System\DgTdlew.exe
  2⤵
  PID:9404
- C:\Windows\System\CiFkCmB.exe
  C:\Windows\System\CiFkCmB.exe
  2⤵
  PID:9516
- C:\Windows\System\McrfqHv.exe
  C:\Windows\System\McrfqHv.exe
  2⤵
  PID:9552
- C:\Windows\System\FyqBgnD.exe
  C:\Windows\System\FyqBgnD.exe
  2⤵
  PID:9532
- C:\Windows\System\wrNnebC.exe
  C:\Windows\System\wrNnebC.exe
  2⤵
  PID:9500
- C:\Windows\System\kdWOEea.exe
  C:\Windows\System\kdWOEea.exe
  2⤵
  PID:9568
- C:\Windows\System\yZRKvgq.exe
  C:\Windows\System\yZRKvgq.exe
  2⤵
  PID:9632
- C:\Windows\System\tKGWyaK.exe
  C:\Windows\System\tKGWyaK.exe
  2⤵
  PID:9660
- C:\Windows\System\DoCPPKA.exe
  C:\Windows\System\DoCPPKA.exe
  2⤵
  PID:9712
- C:\Windows\System\aDHxoCu.exe
  C:\Windows\System\aDHxoCu.exe
  2⤵
  PID:9752
- C:\Windows\System\WnlxisC.exe
  C:\Windows\System\WnlxisC.exe
  2⤵
  PID:9812
- C:\Windows\System\mKggBRn.exe
  C:\Windows\System\mKggBRn.exe
  2⤵
  PID:9876
- C:\Windows\System\HZdXnVT.exe
  C:\Windows\System\HZdXnVT.exe
  2⤵
  PID:9732
- C:\Windows\System\VVyooSL.exe
  C:\Windows\System\VVyooSL.exe
  2⤵
  PID:9800
- C:\Windows\System\YYBvnSA.exe
  C:\Windows\System\YYBvnSA.exe
  2⤵
  PID:9908
- C:\Windows\System\fsUQcps.exe
  C:\Windows\System\fsUQcps.exe
  2⤵
  PID:9972
- C:\Windows\System\NuhnyXy.exe
  C:\Windows\System\NuhnyXy.exe
  2⤵
  PID:9896
- C:\Windows\System\wHoTiWb.exe
  C:\Windows\System\wHoTiWb.exe
  2⤵
  PID:9924
- C:\Windows\System\vEbCTfK.exe
  C:\Windows\System\vEbCTfK.exe
  2⤵
  PID:9988
- C:\Windows\System\CwsRYaY.exe
  C:\Windows\System\CwsRYaY.exe
  2⤵
  PID:10040
- C:\Windows\System\gewohID.exe
  C:\Windows\System\gewohID.exe
  2⤵
  PID:10104
- C:\Windows\System\AsULhRq.exe
  C:\Windows\System\AsULhRq.exe
  2⤵
  PID:10164
- C:\Windows\System\EVkYvgp.exe
  C:\Windows\System\EVkYvgp.exe
  2⤵
  PID:10088
- C:\Windows\System\KxEbpUB.exe
  C:\Windows\System\KxEbpUB.exe
  2⤵
  PID:10228
- C:\Windows\System\UMcfAcN.exe
  C:\Windows\System\UMcfAcN.exe
  2⤵
  PID:10148
- C:\Windows\System\ELjndYq.exe
  C:\Windows\System\ELjndYq.exe
  2⤵
  PID:9024
- C:\Windows\System\ZiFZRWm.exe
  C:\Windows\System\ZiFZRWm.exe
  2⤵
  PID:9424
- C:\Windows\System\QqcDWVZ.exe
  C:\Windows\System\QqcDWVZ.exe
  2⤵
  PID:9260
- C:\Windows\System\giCCOKB.exe
  C:\Windows\System\giCCOKB.exe
  2⤵
  PID:9356
- C:\Windows\System\RoDlxPa.exe
  C:\Windows\System\RoDlxPa.exe
  2⤵
  PID:9456
- C:\Windows\System\zliSyXu.exe
  C:\Windows\System\zliSyXu.exe
  2⤵
  PID:9612
- C:\Windows\System\THAioAp.exe
  C:\Windows\System\THAioAp.exe
  2⤵
  PID:9676
- C:\Windows\System\nukdWip.exe
  C:\Windows\System\nukdWip.exe
  2⤵
  PID:9768
- C:\Windows\System\nMJYGnK.exe
  C:\Windows\System\nMJYGnK.exe
  2⤵
  PID:9376
- C:\Windows\System\bFMmDpC.exe
  C:\Windows\System\bFMmDpC.exe
  2⤵
  PID:9944
- C:\Windows\System\OJYSapF.exe
  C:\Windows\System\OJYSapF.exe
  2⤵
  PID:9860
- C:\Windows\System\leGHYla.exe
  C:\Windows\System\leGHYla.exe
  2⤵
  PID:9548
- C:\Windows\System\wWGlgnL.exe
  C:\Windows\System\wWGlgnL.exe
  2⤵
  PID:9736
- C:\Windows\System\Qbmnvtq.exe
  C:\Windows\System\Qbmnvtq.exe
  2⤵
  PID:9680
- C:\Windows\System\XPjPZbv.exe
  C:\Windows\System\XPjPZbv.exe
  2⤵
  PID:10100
- C:\Windows\System\aRRfsfJ.exe
  C:\Windows\System\aRRfsfJ.exe
  2⤵
  PID:10008
- C:\Windows\System\uFwriyV.exe
  C:\Windows\System\uFwriyV.exe
  2⤵
  PID:10184
- C:\Windows\System\uzqouEM.exe
  C:\Windows\System\uzqouEM.exe
  2⤵
  PID:9344
- C:\Windows\System\hCcwMtS.exe
  C:\Windows\System\hCcwMtS.exe
  2⤵
  PID:7448
- C:\Windows\System\XcWQrDv.exe
  C:\Windows\System\XcWQrDv.exe
  2⤵
  PID:10116
- C:\Windows\System\euhZyAk.exe
  C:\Windows\System\euhZyAk.exe
  2⤵
  PID:9848
- C:\Windows\System\BNZXXIx.exe
  C:\Windows\System\BNZXXIx.exe
  2⤵
  PID:9892
- C:\Windows\System\FMNGnJc.exe
  C:\Windows\System\FMNGnJc.exe
  2⤵
  PID:9780
- C:\Windows\System\URkysVd.exe
  C:\Windows\System\URkysVd.exe
  2⤵
  PID:10180
- C:\Windows\System\skvmCxO.exe
  C:\Windows\System\skvmCxO.exe
  2⤵
  PID:9248

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AQGHyRU.exe

Filesize
2.1MB

MD5
827eaebf07a4e78a82e2c5dea8b614e9

SHA1
303adb4849005ffe1781eb9146602525e9bff092

SHA256
22bdcd61df90f0786668401262f3cd6367850038e394206e244caf4571c94fe0

SHA512
395251a0f04f7d664c523cedeec9f2e152c924024fa26d058443a9f40923087257d17b4e39e031513bb5509ea07d88dcc8e83debd64d3e4c1a523820ccad678b

Download Submit
C:\Windows\system\CvpvDnR.exe

Filesize
2.1MB

MD5
bf4a535dbab57f7d1dab2207b3f9b46c

SHA1
0090082b537e1154ea4cf79535fe283245cfdcf9

SHA256
42c01ebcc4a6aea7256fe9aeab1cf05c8028568a3082a742ebf01381affbdd45

SHA512
25ddb2e23dab56c97985e5c0272ba72926a91643617dc910dea1cceb8f5a7d2cf6c45e7c06e1db610f0f7894b59de50d9cffa7fa18f4ee92f6f98caa3a1f324a

Download Submit
C:\Windows\system\EiEbLDt.exe

Filesize
2.1MB

MD5
f90e3fb86ceff52838abe83f00cc29d6

SHA1
16bef7c7d1f886336d8d878a1c33ad87962430fd

SHA256
9edae7f7d07e1c1289d31e2df7f89088d1765256478876274104366e829a8f5a

SHA512
fe44a84075eefac2a741832d7aed94ba98a82f40c1ebbc9f11e39663b2c9acd70506f16e85c739629f69a7614101fa5f218d7e48c95aa15c095b59668df0f66d

Download Submit
C:\Windows\system\GJrOaMG.exe

Filesize
2.1MB

MD5
36d85d9bcc9965e36a34b29c9491361e

SHA1
b7845ba6d136ff8e23902555c70583965ab123de

SHA256
9d88a7cecaa4c7a6f7e50e2615e69ac626b95fb1ec4eef6c60cb156de2788220

SHA512
f81bb099433a2c7e9ef410b2fc90fddda035effa2d4a8dd0abd76d366c5c7609005b143c544fff256568abd80c81c4e2501af48e224dc20552cf7c5182deead0

Download Submit
C:\Windows\system\JjHjKyx.exe

Filesize
2.1MB

MD5
6eaa2ff8d9f089053e95446e3999318a

SHA1
e6c3f427d2b65b359ad4dc578cfca722c4324721

SHA256
1decdc7e87c388fcfd3db5c24848b094cfbc1bcf0ef29900b0f3bfa15c43b2ee

SHA512
463e2340cda7583db7f3fe5fc48ed31b27d6c8f1dae89a9a3ba68dee33d312bdf3da4167055a5ffa21a62a5b4066f335fb356278839bdb75cc900358b59bdf92

Download Submit
C:\Windows\system\KCOKYRo.exe

Filesize
2.1MB

MD5
ba9da829de9dccb6cfa2c22d5855cc66

SHA1
666ab6b0812834d22dffe5f0bc6deba5719bf2df

SHA256
f76ae94e54bb77d341b5a021a211871180bede06590f1efeda54cf22414ae8a1

SHA512
bcb27e3e141f986b3543e46d1238cb05c3d4793eecdd7a038a7ea9cebee4a8a53378aade9790387c32d4f751954970d9adb72f1ce2bd7955756f9f15c5ee9090

Download Submit
C:\Windows\system\LATQMWd.exe

Filesize
2.1MB

MD5
f9ea493750848111c36033695be22a78

SHA1
027ef70e94bcd57f3a40dfae19ba95f59308eb49

SHA256
10cda971685e7d85b7749632574665fcc513e1958e4fff78ec9fc2b7d93402f1

SHA512
6e49459c27481bdf871684d154b850f633604902d21b9d0325d321adb0769ceef11c65605ccac94e962f8bf2849dc8c42eea31b79a7e761a5987d0679160d03b

Download Submit
C:\Windows\system\LlxyUAI.exe

Filesize
2.1MB

MD5
fee515746376b43ab0252b7592ae4399

SHA1
5cd14ebb36d21730e2405ccc7252355b17fb9f8b

SHA256
4c42de693b8dc9734753d2085d0c9817fb89e665eb8dadeb7e2f1059802e6b61

SHA512
831a10516db6cf6717d9deb547f288b1da1ed131ac0cafbc25faab31cc8afe0a5231aa025045a847aaa34b5142d346feb9aafecb1d8d9cea2d8dce75667ec409

Download Submit
C:\Windows\system\MWSdVzi.exe

Filesize
2.1MB

MD5
6241a1a0ca565548647c0058c377d291

SHA1
36428ab8636c64e756349b8d5e71859a873a2bb0

SHA256
2d5d27854d4bddb5f91f376fa4d5f7163dd4f445f83977381e7202d555f95ca9

SHA512
417f74297e9e7c8ed33410358d2faa3e1a5e89e395051bc7d47d4db31da9b1caa22d035ea05cacb51ed19cc61394671b87d5863ff2d62143c5b1605c2a8bdb6e

Download Submit
C:\Windows\system\NmNSgba.exe

Filesize
2.1MB

MD5
2f4e1c28b7c52a0def1f80c84ecda267

SHA1
b27df473463232defcf95d98e22db5c918179708

SHA256
61902e1dc1aeff6a0c229a95ee2f0189ba767b69c3b1182449c81f6d20ee15ed

SHA512
8ce10ccf97cf439d98d1d02906c99583e0211b918aa23c0a1f11851cda3bf1f54d189e1f6077dfce7c53df03d4dfcc674919c73ce0e16fa9722ac912dfa9c44a

Download Submit
C:\Windows\system\OBDIroj.exe

Filesize
2.1MB

MD5
33bbb9282700e57f4a23d29eb04bf514

SHA1
349afb6094951e2ada0f32b8e2a8187f1973d4c0

SHA256
c75e6d4bc5eeca3657fb81b17de54b6f156d5486733becea36bb1de19a6efa5a

SHA512
bc11d5eaa776ffb0a338091ceaef99cae4bac9709f01e798c9e562e03a6d4c86d1f4d8fe817000deec67030cbbbc94c4791de2b1d070564cb940738d047c36c8

Download Submit
C:\Windows\system\OpjpVcp.exe

Filesize
2.1MB

MD5
c8b8386a3416b44d7e8773d0466edebc

SHA1
977e22f029b3e50c92fae6681e29a9097bac80a3

SHA256
91f7d0d97e73a4996c46565344451af1646cfc7608a1b3a6d1ca73f70da326b5

SHA512
7728085affa361a9d7130849556fc87f735ff222febebc23c6c2e66e5a36469bbae804ab88291fd2d29131e800a62cf19975cb94c0f0c48e313fdeff611405cb

Download Submit
C:\Windows\system\VcJwNox.exe

Filesize
2.1MB

MD5
38265546f5d4dfd16ea566cefa513617

SHA1
a8c840d0097d602557e4be479588e8c1466ada32

SHA256
244beaf3f88f2e7ac08ca3f3761c04e80fb2561e27119b3b4b39cbbf38a7f04d

SHA512
4528d2b10b70bdd6b2e10e1ad6b67dceb3ed660a931655473f46077164f29cb5460b0f289ec71f9dabe200a4f00fd15e9fe1a9af498f91136eb1dd259cde7a7f

Download Submit
C:\Windows\system\YAmUqHM.exe

Filesize
2.1MB

MD5
fd2314c3f11a57412b355ae6727750d6

SHA1
193c368690b78474853eafa8707ef7a8c3ec142a

SHA256
c30765545e4ba4b341e4270821fe7c14753f70c34226e59bf01bb30230d88bb6

SHA512
13e36d953b8297538de7eb8545eacf5f3db4eeba3286aeb64715a42e54f87f17d7d8a60dbd58791257ebad89550d9f1a577db73f3363e59f7b5390e0aebdbf81

Download Submit
C:\Windows\system\ZBwAMOK.exe

Filesize
2.1MB

MD5
b877aa3086d16754452b470a56f6b4f9

SHA1
cd37e8889e096c846291bbe984cb71a771a42ee0

SHA256
92ef31dda0e190ca1521d94f8fae038dc383155f9eabe1e9f7ad8c765192e234

SHA512
b1a8bf0e8f4d6354bc8c3171af8269e9ebbdede588b6a4ebaf6e2c99576efb0d21eb72448280baf9ea9557e6228c07f884a450af716312ff2ee79a41650dd12e

Download Submit
C:\Windows\system\ZjpLrMW.exe

Filesize
2.1MB

MD5
997bc454a1a7edc682fad65a6a310dd5

SHA1
e6b760a5ba482e8280f3409376db5cd66e76821a

SHA256
ccdadbc2772c9e7d85a2907023830eb3984178025667f98801ef12ced3a8e827

SHA512
b31c3a8f08d740f24418041f46c4b07ce174d6574846c0346f6268d6384fdfe051e81c0ccd36809dbaac79310dbe53c98cae5376e7f7330cc855a65122a119d9

Download Submit
C:\Windows\system\fyOIIyv.exe

Filesize
2.1MB

MD5
fdf6331498d00713128600e0247ee60a

SHA1
92824ee7fc9fb146bdcd5be3b6b5462751b8ad86

SHA256
a2088bb19ff8bf87906c114d4b9feee0bd1a361d720e3230928e74d560dabef4

SHA512
18edb16d0354aca903a39afec210a4f86be78b53f5ba44be8c35bfff7b10abbbcce54627c6eb8cf7ebdda370444300c47f88194875f1e4a19c09c99f8c7f34f0

Download Submit
C:\Windows\system\mwqGZut.exe

Filesize
2.1MB

MD5
7e239501847ae4f2c44a1584210e4883

SHA1
330925fb09f5c2fb976b827dd27404b4670500f5

SHA256
4dc16479d61f9b8f4decc2e37ce021f4c4c215272ce2192da69c8ddf8afa38bb

SHA512
7f54e9dd4409426def8c70c31b8c549fc0c4788105847c8ffd183c030eb3c78a8616e4e15de3184255fe626b9f00997db3ad813199176f43618c73be7dbff547

Download Submit
C:\Windows\system\qLRttjs.exe

Filesize
2.1MB

MD5
9b358a2b1c38beae63327ba7e4a0ec37

SHA1
8ad112ef983f2e113e583c17a811c674377ebc21

SHA256
c8e392ee6932b7bb02bfa6b3cc9fd20e629eb97f372c4164c67cbf0a840cbd79

SHA512
2ec5c4bd45b5917b20d757f1e4152c054eb4298f1da14e59ad8cc86f6bdae03465b7c3368148cf5839d6f6f6e90f842611f59eb9c6ad1e46953d6d9133901388

Download Submit
C:\Windows\system\rVqubKv.exe

Filesize
2.1MB

MD5
bd56511a86c5d0be486e62d93287cfad

SHA1
cec658ce84e9e08b269bc5baccecf3a37ec64751

SHA256
60b7a1d66108b8fb4d0afe86c50bb8c05c8721ab4c042152fd8d392a5d4b8bea

SHA512
4e26f9939bf201981fccb22ba894f5e57344da862a03f83c532fd120d99c942981ac50e6acfa65cb1fdc532e1ee44199bf9031af8b472ad7de48fd2255c45d98

Download Submit
C:\Windows\system\wyrZakT.exe

Filesize
2.1MB

MD5
42a2ca5717051aa5ac9588c1b5876e3a

SHA1
72969a28515031abb37806b4603f296ed889cbd7

SHA256
899dd4d49bb96cf7dbcb7d15b12bdf7fb013d263a0b400b06c46484b9a04b092

SHA512
6329c9128bdd86d8d8458ca2095499d50694d40181f105ee3d9952caebf52d8e7f6be33b25e2159898d446bb8db3782c8393b1124d374838a92d76a6aebaaad9

Download Submit
C:\Windows\system\yfqtyqS.exe

Filesize
2.1MB

MD5
e61561773f0b9e7e705d4b0387a89e85

SHA1
e9346b42128a2217845059c26faa67ee72577d4d

SHA256
37c491012753233bf38c89d097559145d5745504cfa8746e76983bea1dc45767

SHA512
d1cb69ea2ea92249dbcdae750e2ae9518db8fd0f1346c19e433b6077d00adbdbdc579cf1a762b67ea7a160719a87115f91135014d934a54514392318941c770c

Download Submit
C:\Windows\system\yuUnezR.exe

Filesize
2.1MB

MD5
c4783461eaef9523d531079a8b420e59

SHA1
020d0ff41e3cd204875d3eed99961daaa7f2e0f1

SHA256
6a9ae8d0b107365edba70ea8807435d55b6a28cfef061111796c0c7695dc278b

SHA512
779a4cb9e6683e43304589f3e5eab1ab920ef9541265036aaf05b02fcfe4cec0afe980afd30330f6c7f9b6e38701ddab179a91350bc5e85cebc8f037d6f3bd55

Download Submit
\Windows\system\HQRsUvg.exe

Filesize
2.1MB

MD5
a4a00cca2701b318c14cbcf4f95225dc

SHA1
c6692f5dbb4add6e94b2a8723a74c0462edb4f6f

SHA256
e63064f2b271cc5396913d64436878154c321b79b3ba4a9b056b09258a073cc7

SHA512
66a6f3d08c4053327db4c1603a7c6f458beb02bb399e2756b6a7f3fcfdf38c646fae9ecac64a2c144465933fbb046ca8c66f0ad4fe5a152faacbfa2058b70007

Download Submit
\Windows\system\JsvsLrS.exe

Filesize
2.1MB

MD5
313eaa2d75592c2c0def6e3bd2ab4bd9

SHA1
71d5c95d1e25dd05be36bde3df4556c39c4067ef

SHA256
5ea52ee00041c0717e21f95baa6fced5813e16772599b57f42518aea74a68ecf

SHA512
ad17e2826fe4c368699094478c99db83ee132fd6d6a54dfe5184c6e793a529af99e34de0d74e7eb92d968a092926aa25267fa7907861e3384218f6c65f49364f

Download Submit
\Windows\system\JvGuRMu.exe

Filesize
2.1MB

MD5
74b66e82cfbd58d8715d476f101cd1fd

SHA1
18790fb8399ffd200942940232698589cd6876f6

SHA256
e1ac51a1b328d7ae01538d17ac66b7a15689831a87e1ff62d8a6cc42865fac45

SHA512
039f0b3a832f612d1eec40893f857c4f4bd0e159149bedcab7596d2255c662e4172c36181cb4bde63c13c6a2f4dd4d7a523b9c7bf35ab25abfa4012906d3f91a

Download Submit
\Windows\system\QCdOHWT.exe

Filesize
2.1MB

MD5
af22034025267b475ab8b759e08a80c6

SHA1
e3ce9fc9e02b7ed4b31c5765b13a3f0d98c9a34c

SHA256
7ca856cc70f09624ca538ce4a3f012ccfeab025b5180bbb1584d733b42bfce8d

SHA512
50fb7b0e8d287a5995a95526c18bee2bf33db9746bde78174de63617160ad3eaa99ce3aba17c50d6a570422c6b48eb49139ef3735dcb93506c648f7cfa65d04b

Download Submit
\Windows\system\RGemKby.exe

Filesize
2.1MB

MD5
47c51cf98a32d841d650a507dbe8af70

SHA1
aa18e9c9c4a6ecf7cff6989f44506506aa2e8299

SHA256
3a84778516765d67c9efbb182a77a6e75ba1348c6923b46ba629650346f54999

SHA512
6ddcb54f35c8e8ce4214bac5592d42822073ba5ba6dfe19cc2244e1c4d4d14fa1cd105cc6d503572580ad6380e8b0a61c4bf76db60835e95a43ff0b21089867a

Download Submit
\Windows\system\SOhppfN.exe

Filesize
2.1MB

MD5
b6227ace9051000603bfedb97ceee0fa

SHA1
36d0bc5378f43d244ecf48324a0d42d7593bdce7

SHA256
14bc9633fd3a7e72f2f43821044906edbdbce76f19327345e355199a3b73b701

SHA512
cd3919028a13b927ed165f13b684e46eb702981c7f4b0278afbb4c37abea9b0ddf953eb377d784b62a9475c898c994bc7012aa53678d26aec5cc32358f6c9054

Download Submit
\Windows\system\VZQssOz.exe

Filesize
2.1MB

MD5
b981ccb5034a9a1eaa17ef725a985780

SHA1
dd2d1b4bd4b9329ccb2a2318ca94486043cc112f

SHA256
20d70dca4500d7685b198906863a6c7964906ba5fbdc2195de878faabfafa78b

SHA512
332d156c2768baca12dbf75a605403e09efe4368dd9ec20bc1b97f67b528d380c18e12f4e236bc2fda05d5f53922c51382465651a2e56080555b3c0b44612aa5

Download Submit
\Windows\system\Wlmywvp.exe

Filesize
2.1MB

MD5
64cb406ddfe5588fe35a8bba9a0beec1

SHA1
f53fb92e6bb2c6bf8382793ad8c2edbb9bad10b2

SHA256
9158afa868fc6faa25e0bbf0ae6cb9189e578f6f3f53409a5f6c53b1807b57fe

SHA512
80aecff65fa12ee2ef3a8fc8fee55b9b50ef5846ec2356f9844c3b9573ee127717dab1cb58f6f1a003e6c64d990b2fcfb3e765f439989aa4c8661b8ae8ab74f6

Download Submit
\Windows\system\ZhJJJOy.exe

Filesize
2.1MB

MD5
c800a4ace461fa8dfca4c73bee364749

SHA1
518823a62dc347294db22e6a6a01e2a496929480

SHA256
14b758cee8cbc5bfd0b40ce08ec44055d26d4a21a5e005101e708ec821a530fb

SHA512
00674c49982388fd1ac0d1cbcca954ad92002fa2544165ea421143e4092bcd827af18a65dc7ea43165cdf674568ea7f4d47fdee4118b25d706cf4694394e6656

Download Submit
\Windows\system\bpNouiL.exe

Filesize
2.1MB

MD5
a587d7eec55fef9c4783ba5d4ed6ea50

SHA1
fa0a9ef711695f1511f5d12e4297e632a63177a7

SHA256
1a379a87335b847bfd7f2f2ba710392b5cecb36c5ba60f667264bd9f615f9184

SHA512
faa43105a4bba343c61fe9cc83d80553d3bfac376eee7468994e991e42b3c12620b20eaf71ccd5ebe41de4ba52bfe03992f2a5915d9ad8f78b8bc8c5f786f01e

Download Submit
\Windows\system\iSssAxX.exe

Filesize
2.1MB

MD5
934d0160a54dd7c3d6f0798a7ebaae22

SHA1
bfc953cb1f3daa78457496a79ceb2e4b792448df

SHA256
f4529f8bc7b2ae9ac12a74eb097f4250119184354853b2865321c3a51bbe844e

SHA512
54e102e53c7b9d8fcc95268e4d96c3af7ef08b161683df985b273dbf382aac1f9ec069edcaf8e4d7fe0a91847e9a82c595227e9baf15fd8cab480475f190f9e2

Download Submit
\Windows\system\lxjqbFT.exe

Filesize
2.1MB

MD5
e46a3793689d378d213835b1c74202da

SHA1
66f9b1f6b9b3a335df0889dabccb68ef9f563da8

SHA256
b9c6518f65428a608b77d3b99833a921cffb6f565da27f88fb379647b9c2dc66

SHA512
09183f21b84e59abd469db3a7ddad9f72c893256ef74f065f8a36ad57a081f60303f199d3795eb8bea3750cbdf82e6f2554c690643f7116a85002bed85f43ccc

Download Submit
\Windows\system\mapCbcY.exe

Filesize
2.1MB

MD5
cbf00cc3b25a6d46e7716fb4a9c4d68d

SHA1
13861e0e93918cab2c67446af36e6c1337cc919d

SHA256
fdc7a1c033ec4303219a1d5ef2cd372528e9cf0aec7889f4f85c9e22b289af89

SHA512
bd8153276981c196a4d6bbda2dc1b494b69758a875d9d52059ea9a5c302f9b4a3304d4af994257f21018306b54a16214e85824b4a4bbe0020253625f98704e24

Download Submit
\Windows\system\qkTvhjU.exe

Filesize
2.1MB

MD5
a2934f14e73f81f5a776f508eaf76a10

SHA1
72e1e3ea5ab9a1c7dc2b8dd34cc654ba68eb4e06

SHA256
ff32d181e9df34770e09df2833316af5c5e7679b9acace5348136b9fe5499506

SHA512
1799b0fde5fd868203b4eed15aeca61802086cdd698adb3c813864378ad967e8d5e65da11f479d3ddd86f8abb10326548acc013388161091712ce43b14ab616e

Download Submit
\Windows\system\rlORjCS.exe

Filesize
2.1MB

MD5
8233b812a51a1191dee5a0fa7149ecc5

SHA1
1c3278892f71b7b0fd29d7c0a97139a16f870ef3

SHA256
7409473963a09fac71c360867636569fbbab8d6bb9bf4daa564ea0d2b7b710a2

SHA512
65fbc1f2140465ec48155a8d489f960c945fc1ff1018aaeb5e2c5a88375b043b73df89afeec7a9f2e71d853c35b51b3faceb07efa492a68b9a9616e45f5fb8b7

Download Submit
memory/320-65-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/320-42-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/320-40-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/320-68-0x0000000002D40000-0x0000000002DC0000-memory.dmp

Filesize
512KB

Download
memory/320-1468-0x000007FEF5BC0000-0x000007FEF655D000-memory.dmp

Filesize
9.6MB

Download
memory/1820-46-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2016-37-0x000000013FA40000-0x000000013FE32000-memory.dmp

Filesize
3.9MB

Download
memory/2136-47-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-114-0x000000013F6F0000-0x000000013FAE2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-13-0x000000013FCD0000-0x00000001400C2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-134-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2212-106-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/2212-1-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2212-138-0x000000013FBC0000-0x000000013FFB2000-memory.dmp

Filesize
3.9MB

Download
memory/2212-97-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2212-0-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/2212-48-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2212-81-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download
memory/2212-140-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2212-88-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/2212-102-0x0000000002EA0000-0x0000000003292000-memory.dmp

Filesize
3.9MB

Download
memory/2456-118-0x000000013F190000-0x000000013F582000-memory.dmp

Filesize
3.9MB

Download
memory/2460-99-0x000000013FF70000-0x0000000140362000-memory.dmp

Filesize
3.9MB

Download
memory/2500-103-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2556-96-0x000000013F230000-0x000000013F622000-memory.dmp

Filesize
3.9MB

Download
memory/2600-91-0x000000013FE40000-0x0000000140232000-memory.dmp

Filesize
3.9MB

Download
memory/2632-100-0x000000013FF30000-0x0000000140322000-memory.dmp

Filesize
3.9MB

Download
memory/2928-139-0x000000013F780000-0x000000013FB72000-memory.dmp

Filesize
3.9MB

Download