xmrig | e0ab871f2dad8cfde88b431a84b7ed8606d6a536a8dd4f6416a3645a6f0c07a5

Analysis

max time kernel
27s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Size

1.9MB
MD5

00ee4a2c347162b043d32f07620e57dc
SHA1

2fec5354f69d2af7151d7710a2db1c1d3f21db12
SHA256

e0ab871f2dad8cfde88b431a84b7ed8606d6a536a8dd4f6416a3645a6f0c07a5
SHA512

b7dfc77e640f683ae8c521f12ffd305712150a24d093375186508db6f67956d1cda7643481e011e09157b2c674dd30926a3604027f01e95165711cdd7c8f9bdd
SSDEEP

49152:Lz071uv4BPMkibTIA5KIP7nTrmBhihM5xC+U1B:NABi

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2112-2-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2984-9-0x000000013F220000-0x000000013F612000-memory.dmp	xmrig
behavioral1/memory/2676-20-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2652-38-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	xmrig
behavioral1/memory/2624-47-0x000000013F720000-0x000000013FB12000-memory.dmp	xmrig
behavioral1/memory/2996-36-0x000000013FE30000-0x0000000140222000-memory.dmp	xmrig
behavioral1/memory/2632-69-0x000000013F510000-0x000000013F902000-memory.dmp	xmrig
behavioral1/memory/2676-74-0x000000013FF10000-0x0000000140302000-memory.dmp	xmrig
behavioral1/memory/2112-67-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2984	pQhHuyl.exe
2676	PIvgCZK.exe
2996	ctYwjgR.exe
2652	UsUWZtM.exe
2624	BPJWvah.exe
2480	IJMNmWc.exe
2912	gODaloS.exe
2632	Prtrgcd.exe
1720	JaLNGAI.exe
2784	aTBcAiT.exe
2752	GZoUCDh.exe
2920	PabmZYH.exe
1948	xlZXKXi.exe
2044	thCLPJC.exe
2172	tyUyqCk.exe
404	GnewdnS.exe
1680	kIPnlFm.exe
2140	KCRtGCz.exe
1564	TzZvTyy.exe
2308	eMLxvbS.exe
2084	CpTvsWB.exe
2136	lddKGlV.exe
2636	JVFmshR.exe
604	MunioHj.exe
560	YEgYLiy.exe
580	ZTXyqHV.exe
1488	GZkkHKI.exe
2428	gJGEfYO.exe
2916	OIQmWlP.exe
412	wwPoqWu.exe
2168	wBLTNrd.exe
2988	uPIKnQA.exe
988	eXBibNd.exe
2160	hnVPaDu.exe
1572	jaPNCsG.exe
1876	mosBpTb.exe
1872	tlYAgks.exe
1632	POEGkvf.exe
956	SYLqFKR.exe
1264	GuzfAOz.exe
2116	SZHVxpD.exe
1964	wuyHixn.exe
1364	lkMZlgK.exe
1928	kVNLLNg.exe
2384	Rrdkczm.exe
1520	NFIsnaS.exe
2212	XAkymnC.exe
2880	LPGCaYO.exe
1624	VGlegZG.exe
872	TTmlFrA.exe
1652	PRTPEKj.exe
1620	UqzzlBg.exe
3004	BYgrhHR.exe
2732	eGbnJzS.exe
2560	mVdJPDm.exe
2456	qWGxOmP.exe
2536	uwxspxJ.exe
2376	NuxHRSG.exe
2528	PPnUpKb.exe
308	IPXcWRT.exe
2712	IYjPSTc.exe
2348	TldBNMI.exe
2104	VMVWFcD.exe
2604	RRuBWfo.exe

Loads dropped DLL 64 IoCs

pid	Process
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe

UPX packed file 45 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-2-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/files/0x000d00000001231a-3.dat	upx
behavioral1/memory/2984-9-0x000000013F220000-0x000000013F612000-memory.dmp	upx
behavioral1/files/0x0033000000013a3d-10.dat	upx
behavioral1/memory/2676-20-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/files/0x000f000000013f21-22.dat	upx
behavioral1/files/0x001400000000549e-31.dat	upx
behavioral1/memory/2652-38-0x000000013FAB0000-0x000000013FEA2000-memory.dmp	upx
behavioral1/memory/2624-47-0x000000013F720000-0x000000013FB12000-memory.dmp	upx
behavioral1/files/0x0008000000014183-43.dat	upx
behavioral1/files/0x000700000001418d-48.dat	upx
behavioral1/memory/2996-36-0x000000013FE30000-0x0000000140222000-memory.dmp	upx
behavioral1/memory/2480-53-0x000000013FED0000-0x00000001402C2000-memory.dmp	upx
behavioral1/files/0x00070000000141b5-58.dat	upx
behavioral1/memory/2912-61-0x000000013FB80000-0x000000013FF72000-memory.dmp	upx
behavioral1/files/0x0007000000014216-62.dat	upx
behavioral1/memory/2632-69-0x000000013F510000-0x000000013F902000-memory.dmp	upx
behavioral1/files/0x0033000000013a7c-70.dat	upx
behavioral1/memory/1720-76-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/files/0x00060000000149ea-84.dat	upx
behavioral1/files/0x0008000000014983-88.dat	upx
behavioral1/files/0x0006000000015362-112.dat	upx
behavioral1/files/0x0006000000015642-124.dat	upx
behavioral1/files/0x0006000000015136-108.dat	upx
behavioral1/files/0x00060000000153cf-118.dat	upx
behavioral1/files/0x0006000000015b13-142.dat	upx
behavioral1/files/0x0006000000015c9c-168.dat	upx
behavioral1/files/0x0006000000015ca5-170.dat	upx
behavioral1/files/0x0006000000015cc1-191.dat	upx
behavioral1/files/0x0006000000015cca-189.dat	upx
behavioral1/files/0x0006000000015cb9-185.dat	upx
behavioral1/files/0x0006000000015cdb-193.dat	upx
behavioral1/files/0x0006000000015c86-164.dat	upx
behavioral1/files/0x0006000000015cad-177.dat	upx
behavioral1/files/0x0006000000015c7c-159.dat	upx
behavioral1/files/0x0006000000015c6d-154.dat	upx
behavioral1/files/0x0006000000015bb9-139.dat	upx
behavioral1/files/0x0006000000015c51-147.dat	upx
behavioral1/files/0x0006000000015b77-137.dat	upx
behavioral1/files/0x0006000000015023-104.dat	upx
behavioral1/files/0x0006000000014e5a-100.dat	upx
behavioral1/files/0x0006000000014c25-96.dat	upx
behavioral1/files/0x0006000000014b12-92.dat	upx
behavioral1/memory/2676-74-0x000000013FF10000-0x0000000140302000-memory.dmp	upx
behavioral1/memory/2112-67-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\cubpgXp.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\lddKGlV.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\FFHVwTr.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\mUIhPwg.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\bHpZasZ.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\MiflrEE.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\BGbNIUz.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\VbPvKqW.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\BqkUNyT.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\WmfGEmC.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\BuBIPWM.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\GLtEcOQ.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\kuctjCV.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\NiVAncL.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\bYPIoBv.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\NChGKdP.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\kpSsayD.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\nuBAwPU.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\sfvGMrf.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\PqsLmFs.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\iwmesxZ.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\YEQkioj.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\dCsVGnx.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\LCzoYjv.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\GHVXcKf.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\gitTtpx.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\OjKPqsk.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\iKyAkYA.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\FuvdfQu.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\PdgQvdr.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ehhUMni.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\wfYfYdO.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\XNCPOWR.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\gKFexRS.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\WHmayAO.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\aoUKDZR.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\xyBYCqo.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\DgwdONY.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\xativkD.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\wXXkMyD.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\SBxHonC.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\UJfDtsA.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ENYDonK.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\ttCFZpX.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\mSeRSnN.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\dbvrodU.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\clSKMBF.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\EFAKrgn.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\sKbRCvF.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\CdpXTjw.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\FvRfgIp.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\UxWbtyG.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\vUpRrOz.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\LYySZyC.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\bnEfLoA.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\BWrpXMU.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\cRsXohR.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\rfFMIxa.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\pFCeEyj.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\KfBnTJP.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\aaGHZTR.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\AquCwpt.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\XZCRUqO.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
File created	C:\Windows\System\SnozsEe.exe	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
Token: SeDebugPrivilege	1460	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1460	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	29
PID 2112 wrote to memory of 1460	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	29
PID 2112 wrote to memory of 1460	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	29
PID 2112 wrote to memory of 2984	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2984	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2984	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	30
PID 2112 wrote to memory of 2676	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2676	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2676	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	31
PID 2112 wrote to memory of 2996	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2996	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2996	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	32
PID 2112 wrote to memory of 2652	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2652	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2652	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	33
PID 2112 wrote to memory of 2624	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2624	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2624	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	34
PID 2112 wrote to memory of 2480	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2480	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2480	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	35
PID 2112 wrote to memory of 2912	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2912	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2912	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	36
PID 2112 wrote to memory of 2632	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2632	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	37
PID 2112 wrote to memory of 2632	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	37
PID 2112 wrote to memory of 1720	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	38
PID 2112 wrote to memory of 1720	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	38
PID 2112 wrote to memory of 1720	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	38
PID 2112 wrote to memory of 2752	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2752	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2752	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	39
PID 2112 wrote to memory of 2784	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2784	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2784	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	40
PID 2112 wrote to memory of 2920	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2920	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	41
PID 2112 wrote to memory of 2920	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	41
PID 2112 wrote to memory of 1948	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	42
PID 2112 wrote to memory of 1948	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	42
PID 2112 wrote to memory of 1948	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	42
PID 2112 wrote to memory of 2044	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	43
PID 2112 wrote to memory of 2044	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	43
PID 2112 wrote to memory of 2044	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	43
PID 2112 wrote to memory of 2172	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	44
PID 2112 wrote to memory of 2172	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	44
PID 2112 wrote to memory of 2172	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	44
PID 2112 wrote to memory of 404	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	45
PID 2112 wrote to memory of 404	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	45
PID 2112 wrote to memory of 404	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	45
PID 2112 wrote to memory of 1680	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	46
PID 2112 wrote to memory of 1680	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	46
PID 2112 wrote to memory of 1680	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	46
PID 2112 wrote to memory of 1564	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	47
PID 2112 wrote to memory of 1564	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	47
PID 2112 wrote to memory of 1564	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	47
PID 2112 wrote to memory of 2140	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	48
PID 2112 wrote to memory of 2140	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	48
PID 2112 wrote to memory of 2140	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	48
PID 2112 wrote to memory of 2084	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	49
PID 2112 wrote to memory of 2084	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	49
PID 2112 wrote to memory of 2084	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	49
PID 2112 wrote to memory of 2308	2112	00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00ee4a2c347162b043d32f07620e57dc_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- C:\Windows\System\pQhHuyl.exe
  C:\Windows\System\pQhHuyl.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\PIvgCZK.exe
  C:\Windows\System\PIvgCZK.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\ctYwjgR.exe
  C:\Windows\System\ctYwjgR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\UsUWZtM.exe
  C:\Windows\System\UsUWZtM.exe
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\System\BPJWvah.exe
  C:\Windows\System\BPJWvah.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\IJMNmWc.exe
  C:\Windows\System\IJMNmWc.exe
  2⤵
  - Executes dropped EXE
  PID:2480
- C:\Windows\System\gODaloS.exe
  C:\Windows\System\gODaloS.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\Prtrgcd.exe
  C:\Windows\System\Prtrgcd.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\JaLNGAI.exe
  C:\Windows\System\JaLNGAI.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\GZoUCDh.exe
  C:\Windows\System\GZoUCDh.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\aTBcAiT.exe
  C:\Windows\System\aTBcAiT.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\PabmZYH.exe
  C:\Windows\System\PabmZYH.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\xlZXKXi.exe
  C:\Windows\System\xlZXKXi.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\thCLPJC.exe
  C:\Windows\System\thCLPJC.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\tyUyqCk.exe
  C:\Windows\System\tyUyqCk.exe
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\System\GnewdnS.exe
  C:\Windows\System\GnewdnS.exe
  2⤵
  - Executes dropped EXE
  PID:404
- C:\Windows\System\kIPnlFm.exe
  C:\Windows\System\kIPnlFm.exe
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Windows\System\TzZvTyy.exe
  C:\Windows\System\TzZvTyy.exe
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\System\KCRtGCz.exe
  C:\Windows\System\KCRtGCz.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\CpTvsWB.exe
  C:\Windows\System\CpTvsWB.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\eMLxvbS.exe
  C:\Windows\System\eMLxvbS.exe
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Windows\System\JVFmshR.exe
  C:\Windows\System\JVFmshR.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\lddKGlV.exe
  C:\Windows\System\lddKGlV.exe
  2⤵
  - Executes dropped EXE
  PID:2136
- C:\Windows\System\MunioHj.exe
  C:\Windows\System\MunioHj.exe
  2⤵
  - Executes dropped EXE
  PID:604
- C:\Windows\System\YEgYLiy.exe
  C:\Windows\System\YEgYLiy.exe
  2⤵
  - Executes dropped EXE
  PID:560
- C:\Windows\System\ZTXyqHV.exe
  C:\Windows\System\ZTXyqHV.exe
  2⤵
  - Executes dropped EXE
  PID:580
- C:\Windows\System\GZkkHKI.exe
  C:\Windows\System\GZkkHKI.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\OIQmWlP.exe
  C:\Windows\System\OIQmWlP.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\gJGEfYO.exe
  C:\Windows\System\gJGEfYO.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wwPoqWu.exe
  C:\Windows\System\wwPoqWu.exe
  2⤵
  - Executes dropped EXE
  PID:412
- C:\Windows\System\wBLTNrd.exe
  C:\Windows\System\wBLTNrd.exe
  2⤵
  - Executes dropped EXE
  PID:2168
- C:\Windows\System\hnVPaDu.exe
  C:\Windows\System\hnVPaDu.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\uPIKnQA.exe
  C:\Windows\System\uPIKnQA.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- C:\Windows\System\jaPNCsG.exe
  C:\Windows\System\jaPNCsG.exe
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\System\eXBibNd.exe
  C:\Windows\System\eXBibNd.exe
  2⤵
  - Executes dropped EXE
  PID:988
- C:\Windows\System\mosBpTb.exe
  C:\Windows\System\mosBpTb.exe
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Windows\System\tlYAgks.exe
  C:\Windows\System\tlYAgks.exe
  2⤵
  - Executes dropped EXE
  PID:1872
- C:\Windows\System\POEGkvf.exe
  C:\Windows\System\POEGkvf.exe
  2⤵
  - Executes dropped EXE
  PID:1632
- C:\Windows\System\SYLqFKR.exe
  C:\Windows\System\SYLqFKR.exe
  2⤵
  - Executes dropped EXE
  PID:956
- C:\Windows\System\GuzfAOz.exe
  C:\Windows\System\GuzfAOz.exe
  2⤵
  - Executes dropped EXE
  PID:1264
- C:\Windows\System\SZHVxpD.exe
  C:\Windows\System\SZHVxpD.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\System\wuyHixn.exe
  C:\Windows\System\wuyHixn.exe
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Windows\System\lkMZlgK.exe
  C:\Windows\System\lkMZlgK.exe
  2⤵
  - Executes dropped EXE
  PID:1364
- C:\Windows\System\kVNLLNg.exe
  C:\Windows\System\kVNLLNg.exe
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\System\Rrdkczm.exe
  C:\Windows\System\Rrdkczm.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\LPGCaYO.exe
  C:\Windows\System\LPGCaYO.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\NFIsnaS.exe
  C:\Windows\System\NFIsnaS.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\TTmlFrA.exe
  C:\Windows\System\TTmlFrA.exe
  2⤵
  - Executes dropped EXE
  PID:872
- C:\Windows\System\XAkymnC.exe
  C:\Windows\System\XAkymnC.exe
  2⤵
  - Executes dropped EXE
  PID:2212
- C:\Windows\System\PRTPEKj.exe
  C:\Windows\System\PRTPEKj.exe
  2⤵
  - Executes dropped EXE
  PID:1652
- C:\Windows\System\VGlegZG.exe
  C:\Windows\System\VGlegZG.exe
  2⤵
  - Executes dropped EXE
  PID:1624
- C:\Windows\System\UqzzlBg.exe
  C:\Windows\System\UqzzlBg.exe
  2⤵
  - Executes dropped EXE
  PID:1620
- C:\Windows\System\BYgrhHR.exe
  C:\Windows\System\BYgrhHR.exe
  2⤵
  - Executes dropped EXE
  PID:3004
- C:\Windows\System\eGbnJzS.exe
  C:\Windows\System\eGbnJzS.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\mVdJPDm.exe
  C:\Windows\System\mVdJPDm.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\qWGxOmP.exe
  C:\Windows\System\qWGxOmP.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\uwxspxJ.exe
  C:\Windows\System\uwxspxJ.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\NuxHRSG.exe
  C:\Windows\System\NuxHRSG.exe
  2⤵
  - Executes dropped EXE
  PID:2376
- C:\Windows\System\PPnUpKb.exe
  C:\Windows\System\PPnUpKb.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\IYjPSTc.exe
  C:\Windows\System\IYjPSTc.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\IPXcWRT.exe
  C:\Windows\System\IPXcWRT.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\RRuBWfo.exe
  C:\Windows\System\RRuBWfo.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\TldBNMI.exe
  C:\Windows\System\TldBNMI.exe
  2⤵
  - Executes dropped EXE
  PID:2348
- C:\Windows\System\RhSguaa.exe
  C:\Windows\System\RhSguaa.exe
  2⤵
  PID:1696
- C:\Windows\System\VMVWFcD.exe
  C:\Windows\System\VMVWFcD.exe
  2⤵
  - Executes dropped EXE
  PID:2104
- C:\Windows\System\HWhXCzl.exe
  C:\Windows\System\HWhXCzl.exe
  2⤵
  PID:2352
- C:\Windows\System\tzrFtsF.exe
  C:\Windows\System\tzrFtsF.exe
  2⤵
  PID:2300
- C:\Windows\System\mSLxCrz.exe
  C:\Windows\System\mSLxCrz.exe
  2⤵
  PID:2440
- C:\Windows\System\kkXnTwM.exe
  C:\Windows\System\kkXnTwM.exe
  2⤵
  PID:596
- C:\Windows\System\URNMdrW.exe
  C:\Windows\System\URNMdrW.exe
  2⤵
  PID:2856
- C:\Windows\System\RXRONGT.exe
  C:\Windows\System\RXRONGT.exe
  2⤵
  PID:716
- C:\Windows\System\TKjoSVf.exe
  C:\Windows\System\TKjoSVf.exe
  2⤵
  PID:2052
- C:\Windows\System\qjbSPiI.exe
  C:\Windows\System\qjbSPiI.exe
  2⤵
  PID:1108
- C:\Windows\System\ozFIuiK.exe
  C:\Windows\System\ozFIuiK.exe
  2⤵
  PID:848
- C:\Windows\System\ovrOBEk.exe
  C:\Windows\System\ovrOBEk.exe
  2⤵
  PID:668
- C:\Windows\System\CZNMwXl.exe
  C:\Windows\System\CZNMwXl.exe
  2⤵
  PID:1308
- C:\Windows\System\FzVbgeF.exe
  C:\Windows\System\FzVbgeF.exe
  2⤵
  PID:1936
- C:\Windows\System\IIxjzJP.exe
  C:\Windows\System\IIxjzJP.exe
  2⤵
  PID:1688
- C:\Windows\System\ZVomiDK.exe
  C:\Windows\System\ZVomiDK.exe
  2⤵
  PID:1944
- C:\Windows\System\taPYEDw.exe
  C:\Windows\System\taPYEDw.exe
  2⤵
  PID:780
- C:\Windows\System\nbSktih.exe
  C:\Windows\System\nbSktih.exe
  2⤵
  PID:2888
- C:\Windows\System\poEGPHZ.exe
  C:\Windows\System\poEGPHZ.exe
  2⤵
  PID:2324
- C:\Windows\System\aRcijYu.exe
  C:\Windows\System\aRcijYu.exe
  2⤵
  PID:1012
- C:\Windows\System\yPkyldl.exe
  C:\Windows\System\yPkyldl.exe
  2⤵
  PID:2892
- C:\Windows\System\OjKPqsk.exe
  C:\Windows\System\OjKPqsk.exe
  2⤵
  PID:1732
- C:\Windows\System\LnFjcFW.exe
  C:\Windows\System\LnFjcFW.exe
  2⤵
  PID:2396
- C:\Windows\System\xZkVhYx.exe
  C:\Windows\System\xZkVhYx.exe
  2⤵
  PID:2552
- C:\Windows\System\VBjCWLm.exe
  C:\Windows\System\VBjCWLm.exe
  2⤵
  PID:2960
- C:\Windows\System\QxcdfJV.exe
  C:\Windows\System\QxcdfJV.exe
  2⤵
  PID:2568
- C:\Windows\System\mySNDyP.exe
  C:\Windows\System\mySNDyP.exe
  2⤵
  PID:2256
- C:\Windows\System\bJouCBi.exe
  C:\Windows\System\bJouCBi.exe
  2⤵
  PID:2248
- C:\Windows\System\CDeHYFX.exe
  C:\Windows\System\CDeHYFX.exe
  2⤵
  PID:3064
- C:\Windows\System\amXnCPN.exe
  C:\Windows\System\amXnCPN.exe
  2⤵
  PID:1692
- C:\Windows\System\DLmHhOt.exe
  C:\Windows\System\DLmHhOt.exe
  2⤵
  PID:2448
- C:\Windows\System\zfKZzbp.exe
  C:\Windows\System\zfKZzbp.exe
  2⤵
  PID:2460
- C:\Windows\System\FFHVwTr.exe
  C:\Windows\System\FFHVwTr.exe
  2⤵
  PID:2720
- C:\Windows\System\ZjETTDf.exe
  C:\Windows\System\ZjETTDf.exe
  2⤵
  PID:2900
- C:\Windows\System\kFPEIIT.exe
  C:\Windows\System\kFPEIIT.exe
  2⤵
  PID:2792
- C:\Windows\System\QGSabXA.exe
  C:\Windows\System\QGSabXA.exe
  2⤵
  PID:1736
- C:\Windows\System\JBoDYhw.exe
  C:\Windows\System\JBoDYhw.exe
  2⤵
  PID:536
- C:\Windows\System\DJdOtmL.exe
  C:\Windows\System\DJdOtmL.exe
  2⤵
  PID:1704
- C:\Windows\System\GBVfsJv.exe
  C:\Windows\System\GBVfsJv.exe
  2⤵
  PID:2260
- C:\Windows\System\dDwaYcy.exe
  C:\Windows\System\dDwaYcy.exe
  2⤵
  PID:1540
- C:\Windows\System\immjwIY.exe
  C:\Windows\System\immjwIY.exe
  2⤵
  PID:1636
- C:\Windows\System\pHlmObL.exe
  C:\Windows\System\pHlmObL.exe
  2⤵
  PID:2688
- C:\Windows\System\mAGkmfJ.exe
  C:\Windows\System\mAGkmfJ.exe
  2⤵
  PID:2800
- C:\Windows\System\qjJsfCJ.exe
  C:\Windows\System\qjJsfCJ.exe
  2⤵
  PID:276
- C:\Windows\System\aayixXu.exe
  C:\Windows\System\aayixXu.exe
  2⤵
  PID:1996
- C:\Windows\System\iKyAkYA.exe
  C:\Windows\System\iKyAkYA.exe
  2⤵
  PID:2700
- C:\Windows\System\ZzEKGaN.exe
  C:\Windows\System\ZzEKGaN.exe
  2⤵
  PID:2056
- C:\Windows\System\RwAmQES.exe
  C:\Windows\System\RwAmQES.exe
  2⤵
  PID:1144
- C:\Windows\System\FpLGwrf.exe
  C:\Windows\System\FpLGwrf.exe
  2⤵
  PID:2836
- C:\Windows\System\qbsGbCn.exe
  C:\Windows\System\qbsGbCn.exe
  2⤵
  PID:2600
- C:\Windows\System\dbIYaqh.exe
  C:\Windows\System\dbIYaqh.exe
  2⤵
  PID:2512
- C:\Windows\System\NChGKdP.exe
  C:\Windows\System\NChGKdP.exe
  2⤵
  PID:2780
- C:\Windows\System\MYNpPBI.exe
  C:\Windows\System\MYNpPBI.exe
  2⤵
  PID:1800
- C:\Windows\System\gibeEgv.exe
  C:\Windows\System\gibeEgv.exe
  2⤵
  PID:2024
- C:\Windows\System\AMsuebo.exe
  C:\Windows\System\AMsuebo.exe
  2⤵
  PID:1504
- C:\Windows\System\YwuQlkC.exe
  C:\Windows\System\YwuQlkC.exe
  2⤵
  PID:2432
- C:\Windows\System\cWLgRck.exe
  C:\Windows\System\cWLgRck.exe
  2⤵
  PID:2504
- C:\Windows\System\cCzlUvQ.exe
  C:\Windows\System\cCzlUvQ.exe
  2⤵
  PID:572
- C:\Windows\System\xLgMmVF.exe
  C:\Windows\System\xLgMmVF.exe
  2⤵
  PID:2820
- C:\Windows\System\PienDpG.exe
  C:\Windows\System\PienDpG.exe
  2⤵
  PID:2484
- C:\Windows\System\yIwKzGw.exe
  C:\Windows\System\yIwKzGw.exe
  2⤵
  PID:2124
- C:\Windows\System\DdKKyCU.exe
  C:\Windows\System\DdKKyCU.exe
  2⤵
  PID:1840
- C:\Windows\System\faMhgii.exe
  C:\Windows\System\faMhgii.exe
  2⤵
  PID:1716
- C:\Windows\System\xfRKNBq.exe
  C:\Windows\System\xfRKNBq.exe
  2⤵
  PID:1780
- C:\Windows\System\gGAvhxf.exe
  C:\Windows\System\gGAvhxf.exe
  2⤵
  PID:2668
- C:\Windows\System\soiuqUI.exe
  C:\Windows\System\soiuqUI.exe
  2⤵
  PID:2540
- C:\Windows\System\VCuuSUB.exe
  C:\Windows\System\VCuuSUB.exe
  2⤵
  PID:2656
- C:\Windows\System\fXRRccm.exe
  C:\Windows\System\fXRRccm.exe
  2⤵
  PID:2196
- C:\Windows\System\NbgxSuW.exe
  C:\Windows\System\NbgxSuW.exe
  2⤵
  PID:1532
- C:\Windows\System\OKoZIeg.exe
  C:\Windows\System\OKoZIeg.exe
  2⤵
  PID:2776
- C:\Windows\System\bYbzzVk.exe
  C:\Windows\System\bYbzzVk.exe
  2⤵
  PID:380
- C:\Windows\System\lkUPnqQ.exe
  C:\Windows\System\lkUPnqQ.exe
  2⤵
  PID:2092
- C:\Windows\System\sXELstH.exe
  C:\Windows\System\sXELstH.exe
  2⤵
  PID:1976
- C:\Windows\System\DjbQyHo.exe
  C:\Windows\System\DjbQyHo.exe
  2⤵
  PID:2968
- C:\Windows\System\ZbobCck.exe
  C:\Windows\System\ZbobCck.exe
  2⤵
  PID:2716
- C:\Windows\System\wAHvTOP.exe
  C:\Windows\System\wAHvTOP.exe
  2⤵
  PID:1196
- C:\Windows\System\WQIsSYe.exe
  C:\Windows\System\WQIsSYe.exe
  2⤵
  PID:1448
- C:\Windows\System\LmvDrBV.exe
  C:\Windows\System\LmvDrBV.exe
  2⤵
  PID:2028
- C:\Windows\System\kKKfKze.exe
  C:\Windows\System\kKKfKze.exe
  2⤵
  PID:2340
- C:\Windows\System\tnNKVFA.exe
  C:\Windows\System\tnNKVFA.exe
  2⤵
  PID:2236
- C:\Windows\System\LnMzkze.exe
  C:\Windows\System\LnMzkze.exe
  2⤵
  PID:3084
- C:\Windows\System\xqiCzGs.exe
  C:\Windows\System\xqiCzGs.exe
  2⤵
  PID:3100
- C:\Windows\System\orfPXlp.exe
  C:\Windows\System\orfPXlp.exe
  2⤵
  PID:3116
- C:\Windows\System\YmemDyN.exe
  C:\Windows\System\YmemDyN.exe
  2⤵
  PID:3132
- C:\Windows\System\iZuuoJD.exe
  C:\Windows\System\iZuuoJD.exe
  2⤵
  PID:3152
- C:\Windows\System\YEQkioj.exe
  C:\Windows\System\YEQkioj.exe
  2⤵
  PID:3168
- C:\Windows\System\BVztXWl.exe
  C:\Windows\System\BVztXWl.exe
  2⤵
  PID:3192
- C:\Windows\System\uGfRmcB.exe
  C:\Windows\System\uGfRmcB.exe
  2⤵
  PID:3212
- C:\Windows\System\clRAwny.exe
  C:\Windows\System\clRAwny.exe
  2⤵
  PID:3228
- C:\Windows\System\lxEFBGH.exe
  C:\Windows\System\lxEFBGH.exe
  2⤵
  PID:3244
- C:\Windows\System\RCFDAtK.exe
  C:\Windows\System\RCFDAtK.exe
  2⤵
  PID:3260
- C:\Windows\System\lPHzkIq.exe
  C:\Windows\System\lPHzkIq.exe
  2⤵
  PID:3280
- C:\Windows\System\pFCeEyj.exe
  C:\Windows\System\pFCeEyj.exe
  2⤵
  PID:3296
- C:\Windows\System\GJflYGF.exe
  C:\Windows\System\GJflYGF.exe
  2⤵
  PID:3312
- C:\Windows\System\DRfyOkH.exe
  C:\Windows\System\DRfyOkH.exe
  2⤵
  PID:3328
- C:\Windows\System\WZmovxA.exe
  C:\Windows\System\WZmovxA.exe
  2⤵
  PID:3344
- C:\Windows\System\PohWPiC.exe
  C:\Windows\System\PohWPiC.exe
  2⤵
  PID:3364
- C:\Windows\System\pvdeZIN.exe
  C:\Windows\System\pvdeZIN.exe
  2⤵
  PID:3380
- C:\Windows\System\fVliWfK.exe
  C:\Windows\System\fVliWfK.exe
  2⤵
  PID:3396
- C:\Windows\System\XSKZzsg.exe
  C:\Windows\System\XSKZzsg.exe
  2⤵
  PID:3412
- C:\Windows\System\sKBZoFU.exe
  C:\Windows\System\sKBZoFU.exe
  2⤵
  PID:3428
- C:\Windows\System\YSqydfn.exe
  C:\Windows\System\YSqydfn.exe
  2⤵
  PID:3444
- C:\Windows\System\mgkUCXK.exe
  C:\Windows\System\mgkUCXK.exe
  2⤵
  PID:3460
- C:\Windows\System\XhNrWim.exe
  C:\Windows\System\XhNrWim.exe
  2⤵
  PID:3476
- C:\Windows\System\RAEuYyC.exe
  C:\Windows\System\RAEuYyC.exe
  2⤵
  PID:3492
- C:\Windows\System\YlsYMqK.exe
  C:\Windows\System\YlsYMqK.exe
  2⤵
  PID:3512
- C:\Windows\System\JGBwmgL.exe
  C:\Windows\System\JGBwmgL.exe
  2⤵
  PID:3528
- C:\Windows\System\aLNvcYU.exe
  C:\Windows\System\aLNvcYU.exe
  2⤵
  PID:3544
- C:\Windows\System\POcqaKm.exe
  C:\Windows\System\POcqaKm.exe
  2⤵
  PID:3560
- C:\Windows\System\NyNTFhG.exe
  C:\Windows\System\NyNTFhG.exe
  2⤵
  PID:3576
- C:\Windows\System\vkTXYOI.exe
  C:\Windows\System\vkTXYOI.exe
  2⤵
  PID:3592
- C:\Windows\System\VedlwXV.exe
  C:\Windows\System\VedlwXV.exe
  2⤵
  PID:3608
- C:\Windows\System\yJPejfS.exe
  C:\Windows\System\yJPejfS.exe
  2⤵
  PID:3628
- C:\Windows\System\wdAOiSb.exe
  C:\Windows\System\wdAOiSb.exe
  2⤵
  PID:3644
- C:\Windows\System\WLRBFos.exe
  C:\Windows\System\WLRBFos.exe
  2⤵
  PID:3660
- C:\Windows\System\YDFWJAl.exe
  C:\Windows\System\YDFWJAl.exe
  2⤵
  PID:3676
- C:\Windows\System\cyjbviY.exe
  C:\Windows\System\cyjbviY.exe
  2⤵
  PID:3696
- C:\Windows\System\xBcYoIL.exe
  C:\Windows\System\xBcYoIL.exe
  2⤵
  PID:3712
- C:\Windows\System\fiyyaBx.exe
  C:\Windows\System\fiyyaBx.exe
  2⤵
  PID:3728
- C:\Windows\System\ziQBccV.exe
  C:\Windows\System\ziQBccV.exe
  2⤵
  PID:3840
- C:\Windows\System\wbMpVhK.exe
  C:\Windows\System\wbMpVhK.exe
  2⤵
  PID:3960
- C:\Windows\System\LYySZyC.exe
  C:\Windows\System\LYySZyC.exe
  2⤵
  PID:3976
- C:\Windows\System\DSWcnzF.exe
  C:\Windows\System\DSWcnzF.exe
  2⤵
  PID:3992
- C:\Windows\System\NnNJCjj.exe
  C:\Windows\System\NnNJCjj.exe
  2⤵
  PID:4008
- C:\Windows\System\kpSsayD.exe
  C:\Windows\System\kpSsayD.exe
  2⤵
  PID:4024
- C:\Windows\System\sZEgfXv.exe
  C:\Windows\System\sZEgfXv.exe
  2⤵
  PID:4040
- C:\Windows\System\dGvQwXA.exe
  C:\Windows\System\dGvQwXA.exe
  2⤵
  PID:4056
- C:\Windows\System\BAhbWDX.exe
  C:\Windows\System\BAhbWDX.exe
  2⤵
  PID:4072
- C:\Windows\System\dcVFzUu.exe
  C:\Windows\System\dcVFzUu.exe
  2⤵
  PID:4088
- C:\Windows\System\EAYGgSv.exe
  C:\Windows\System\EAYGgSv.exe
  2⤵
  PID:868
- C:\Windows\System\NbazOYa.exe
  C:\Windows\System\NbazOYa.exe
  2⤵
  PID:2064
- C:\Windows\System\jIXLGjd.exe
  C:\Windows\System\jIXLGjd.exe
  2⤵
  PID:2088
- C:\Windows\System\QXJKbKX.exe
  C:\Windows\System\QXJKbKX.exe
  2⤵
  PID:2372
- C:\Windows\System\BKkvoTh.exe
  C:\Windows\System\BKkvoTh.exe
  2⤵
  PID:2312
- C:\Windows\System\XLrbuoB.exe
  C:\Windows\System\XLrbuoB.exe
  2⤵
  PID:1880
- C:\Windows\System\qQkgIww.exe
  C:\Windows\System\qQkgIww.exe
  2⤵
  PID:2884
- C:\Windows\System\oVURKUL.exe
  C:\Windows\System\oVURKUL.exe
  2⤵
  PID:1060
- C:\Windows\System\oTMGgZG.exe
  C:\Windows\System\oTMGgZG.exe
  2⤵
  PID:1980
- C:\Windows\System\bJLMqhD.exe
  C:\Windows\System\bJLMqhD.exe
  2⤵
  PID:2388
- C:\Windows\System\jznzUcD.exe
  C:\Windows\System\jznzUcD.exe
  2⤵
  PID:3128
- C:\Windows\System\WWtAhmm.exe
  C:\Windows\System\WWtAhmm.exe
  2⤵
  PID:3208
- C:\Windows\System\ALtFiwD.exe
  C:\Windows\System\ALtFiwD.exe
  2⤵
  PID:3304
- C:\Windows\System\MwfYzqs.exe
  C:\Windows\System\MwfYzqs.exe
  2⤵
  PID:3112
- C:\Windows\System\JuuPWFQ.exe
  C:\Windows\System\JuuPWFQ.exe
  2⤵
  PID:3148
- C:\Windows\System\OhwgTHy.exe
  C:\Windows\System\OhwgTHy.exe
  2⤵
  PID:2012
- C:\Windows\System\AontkjO.exe
  C:\Windows\System\AontkjO.exe
  2⤵
  PID:1772
- C:\Windows\System\KfBnTJP.exe
  C:\Windows\System\KfBnTJP.exe
  2⤵
  PID:3220
- C:\Windows\System\gpXNvvy.exe
  C:\Windows\System\gpXNvvy.exe
  2⤵
  PID:3276
- C:\Windows\System\iTwzNvx.exe
  C:\Windows\System\iTwzNvx.exe
  2⤵
  PID:3324
- C:\Windows\System\kyCHJsv.exe
  C:\Windows\System\kyCHJsv.exe
  2⤵
  PID:3408
- C:\Windows\System\EbdLgZQ.exe
  C:\Windows\System\EbdLgZQ.exe
  2⤵
  PID:3756
- C:\Windows\System\XKwmdeM.exe
  C:\Windows\System\XKwmdeM.exe
  2⤵
  PID:3424
- C:\Windows\System\BXPkqjO.exe
  C:\Windows\System\BXPkqjO.exe
  2⤵
  PID:3520
- C:\Windows\System\GIWHhAI.exe
  C:\Windows\System\GIWHhAI.exe
  2⤵
  PID:3584
- C:\Windows\System\CMSUxIS.exe
  C:\Windows\System\CMSUxIS.exe
  2⤵
  PID:3624
- C:\Windows\System\eyhKDTM.exe
  C:\Windows\System\eyhKDTM.exe
  2⤵
  PID:3688
- C:\Windows\System\tzHJuhR.exe
  C:\Windows\System\tzHJuhR.exe
  2⤵
  PID:3604
- C:\Windows\System\EpDGTsn.exe
  C:\Windows\System\EpDGTsn.exe
  2⤵
  PID:3748
- C:\Windows\System\nHBGePA.exe
  C:\Windows\System\nHBGePA.exe
  2⤵
  PID:3860
- C:\Windows\System\tunrloa.exe
  C:\Windows\System\tunrloa.exe
  2⤵
  PID:3876
- C:\Windows\System\vRCxRwV.exe
  C:\Windows\System\vRCxRwV.exe
  2⤵
  PID:3888
- C:\Windows\System\BqkUNyT.exe
  C:\Windows\System\BqkUNyT.exe
  2⤵
  PID:3904
- C:\Windows\System\kTzOVVS.exe
  C:\Windows\System\kTzOVVS.exe
  2⤵
  PID:3924
- C:\Windows\System\Nglywxx.exe
  C:\Windows\System\Nglywxx.exe
  2⤵
  PID:3940
- C:\Windows\System\nOMErCf.exe
  C:\Windows\System\nOMErCf.exe
  2⤵
  PID:3956
- C:\Windows\System\uxyYRIp.exe
  C:\Windows\System\uxyYRIp.exe
  2⤵
  PID:3988
- C:\Windows\System\eTsDmok.exe
  C:\Windows\System\eTsDmok.exe
  2⤵
  PID:4052
- C:\Windows\System\enwRxre.exe
  C:\Windows\System\enwRxre.exe
  2⤵
  PID:1868
- C:\Windows\System\KDGrUQS.exe
  C:\Windows\System\KDGrUQS.exe
  2⤵
  PID:1740
- C:\Windows\System\nvgzhLs.exe
  C:\Windows\System\nvgzhLs.exe
  2⤵
  PID:1972
- C:\Windows\System\bbrHOiT.exe
  C:\Windows\System\bbrHOiT.exe
  2⤵
  PID:3080
- C:\Windows\System\jNQIyFQ.exe
  C:\Windows\System\jNQIyFQ.exe
  2⤵
  PID:3372
- C:\Windows\System\BvLKMcJ.exe
  C:\Windows\System\BvLKMcJ.exe
  2⤵
  PID:3824
- C:\Windows\System\PYhseFG.exe
  C:\Windows\System\PYhseFG.exe
  2⤵
  PID:2368
- C:\Windows\System\oPDcUsS.exe
  C:\Windows\System\oPDcUsS.exe
  2⤵
  PID:3504
- C:\Windows\System\dhwdagH.exe
  C:\Windows\System\dhwdagH.exe
  2⤵
  PID:3568
- C:\Windows\System\pynFGbT.exe
  C:\Windows\System\pynFGbT.exe
  2⤵
  PID:3636
- C:\Windows\System\PrmTggD.exe
  C:\Windows\System\PrmTggD.exe
  2⤵
  PID:608
- C:\Windows\System\tkkIfXY.exe
  C:\Windows\System\tkkIfXY.exe
  2⤵
  PID:3272
- C:\Windows\System\uqYkTTc.exe
  C:\Windows\System\uqYkTTc.exe
  2⤵
  PID:268
- C:\Windows\System\ATqqtFg.exe
  C:\Windows\System\ATqqtFg.exe
  2⤵
  PID:3360
- C:\Windows\System\kylADkY.exe
  C:\Windows\System\kylADkY.exe
  2⤵
  PID:2772
- C:\Windows\System\BcJXMNZ.exe
  C:\Windows\System\BcJXMNZ.exe
  2⤵
  PID:2832
- C:\Windows\System\CQjZOAg.exe
  C:\Windows\System\CQjZOAg.exe
  2⤵
  PID:3164
- C:\Windows\System\PerNJPm.exe
  C:\Windows\System\PerNJPm.exe
  2⤵
  PID:3000
- C:\Windows\System\WFzksPb.exe
  C:\Windows\System\WFzksPb.exe
  2⤵
  PID:2380
- C:\Windows\System\QTzSkiC.exe
  C:\Windows\System\QTzSkiC.exe
  2⤵
  PID:1336
- C:\Windows\System\NRbWpap.exe
  C:\Windows\System\NRbWpap.exe
  2⤵
  PID:2020
- C:\Windows\System\ltaAjcJ.exe
  C:\Windows\System\ltaAjcJ.exe
  2⤵
  PID:4036
- C:\Windows\System\nuBAwPU.exe
  C:\Windows\System\nuBAwPU.exe
  2⤵
  PID:3972
- C:\Windows\System\DVstrdl.exe
  C:\Windows\System\DVstrdl.exe
  2⤵
  PID:2952
- C:\Windows\System\MlPclXX.exe
  C:\Windows\System\MlPclXX.exe
  2⤵
  PID:3780
- C:\Windows\System\cMuJhvm.exe
  C:\Windows\System\cMuJhvm.exe
  2⤵
  PID:1664
- C:\Windows\System\wLnwOZi.exe
  C:\Windows\System\wLnwOZi.exe
  2⤵
  PID:3452
- C:\Windows\System\QSNzepN.exe
  C:\Windows\System\QSNzepN.exe
  2⤵
  PID:3868
- C:\Windows\System\iWzvBmk.exe
  C:\Windows\System\iWzvBmk.exe
  2⤵
  PID:2596
- C:\Windows\System\bnEfLoA.exe
  C:\Windows\System\bnEfLoA.exe
  2⤵
  PID:3572
- C:\Windows\System\HksnxwD.exe
  C:\Windows\System\HksnxwD.exe
  2⤵
  PID:3356
- C:\Windows\System\StLYrdR.exe
  C:\Windows\System\StLYrdR.exe
  2⤵
  PID:2284
- C:\Windows\System\TvuGejH.exe
  C:\Windows\System\TvuGejH.exe
  2⤵
  PID:4064
- C:\Windows\System\GVPxogl.exe
  C:\Windows\System\GVPxogl.exe
  2⤵
  PID:2148
- C:\Windows\System\BWrpXMU.exe
  C:\Windows\System\BWrpXMU.exe
  2⤵
  PID:3720
- C:\Windows\System\AgloGGn.exe
  C:\Windows\System\AgloGGn.exe
  2⤵
  PID:3684
- C:\Windows\System\QMGByBs.exe
  C:\Windows\System\QMGByBs.exe
  2⤵
  PID:3884
- C:\Windows\System\hkigjDl.exe
  C:\Windows\System\hkigjDl.exe
  2⤵
  PID:3948
- C:\Windows\System\qWlhoCJ.exe
  C:\Windows\System\qWlhoCJ.exe
  2⤵
  PID:2464
- C:\Windows\System\wSSaiOa.exe
  C:\Windows\System\wSSaiOa.exe
  2⤵
  PID:3672
- C:\Windows\System\xzxllrk.exe
  C:\Windows\System\xzxllrk.exe
  2⤵
  PID:1956
- C:\Windows\System\gqTwyHQ.exe
  C:\Windows\System\gqTwyHQ.exe
  2⤵
  PID:3184
- C:\Windows\System\bmKUqxS.exe
  C:\Windows\System\bmKUqxS.exe
  2⤵
  PID:3536
- C:\Windows\System\SqmRwme.exe
  C:\Windows\System\SqmRwme.exe
  2⤵
  PID:3124
- C:\Windows\System\yZTqQog.exe
  C:\Windows\System\yZTqQog.exe
  2⤵
  PID:3420
- C:\Windows\System\GYtAALJ.exe
  C:\Windows\System\GYtAALJ.exe
  2⤵
  PID:3900
- C:\Windows\System\SWKkBUw.exe
  C:\Windows\System\SWKkBUw.exe
  2⤵
  PID:2768
- C:\Windows\System\jgpmDpe.exe
  C:\Windows\System\jgpmDpe.exe
  2⤵
  PID:876
- C:\Windows\System\UBGXCuB.exe
  C:\Windows\System\UBGXCuB.exe
  2⤵
  PID:3932
- C:\Windows\System\gnkjgKB.exe
  C:\Windows\System\gnkjgKB.exe
  2⤵
  PID:3556
- C:\Windows\System\fbdxroB.exe
  C:\Windows\System\fbdxroB.exe
  2⤵
  PID:3820
- C:\Windows\System\ZMzwuKE.exe
  C:\Windows\System\ZMzwuKE.exe
  2⤵
  PID:3472
- C:\Windows\System\OHLIahS.exe
  C:\Windows\System\OHLIahS.exe
  2⤵
  PID:3792
- C:\Windows\System\JxQBOib.exe
  C:\Windows\System\JxQBOib.exe
  2⤵
  PID:3656
- C:\Windows\System\kjZNmCB.exe
  C:\Windows\System\kjZNmCB.exe
  2⤵
  PID:4104
- C:\Windows\System\jhIbnMt.exe
  C:\Windows\System\jhIbnMt.exe
  2⤵
  PID:4120
- C:\Windows\System\oftPutM.exe
  C:\Windows\System\oftPutM.exe
  2⤵
  PID:4136
- C:\Windows\System\JMuijnF.exe
  C:\Windows\System\JMuijnF.exe
  2⤵
  PID:4152
- C:\Windows\System\pZUonWf.exe
  C:\Windows\System\pZUonWf.exe
  2⤵
  PID:4176
- C:\Windows\System\EzcxLnD.exe
  C:\Windows\System\EzcxLnD.exe
  2⤵
  PID:4192
- C:\Windows\System\EPXKQaP.exe
  C:\Windows\System\EPXKQaP.exe
  2⤵
  PID:4208
- C:\Windows\System\yaTLolW.exe
  C:\Windows\System\yaTLolW.exe
  2⤵
  PID:4224
- C:\Windows\System\jxtGidL.exe
  C:\Windows\System\jxtGidL.exe
  2⤵
  PID:4240
- C:\Windows\System\ZdUeBaG.exe
  C:\Windows\System\ZdUeBaG.exe
  2⤵
  PID:4256
- C:\Windows\System\lpgPjxs.exe
  C:\Windows\System\lpgPjxs.exe
  2⤵
  PID:4272
- C:\Windows\System\Isizwpe.exe
  C:\Windows\System\Isizwpe.exe
  2⤵
  PID:4288
- C:\Windows\System\GgpSXBZ.exe
  C:\Windows\System\GgpSXBZ.exe
  2⤵
  PID:4304
- C:\Windows\System\vRRgGDg.exe
  C:\Windows\System\vRRgGDg.exe
  2⤵
  PID:4320
- C:\Windows\System\nQHrsOi.exe
  C:\Windows\System\nQHrsOi.exe
  2⤵
  PID:4336
- C:\Windows\System\zCTbRjo.exe
  C:\Windows\System\zCTbRjo.exe
  2⤵
  PID:4352
- C:\Windows\System\TDHUqFb.exe
  C:\Windows\System\TDHUqFb.exe
  2⤵
  PID:4368
- C:\Windows\System\GnkCyIM.exe
  C:\Windows\System\GnkCyIM.exe
  2⤵
  PID:4384
- C:\Windows\System\yeXJuys.exe
  C:\Windows\System\yeXJuys.exe
  2⤵
  PID:4400
- C:\Windows\System\NxWmumR.exe
  C:\Windows\System\NxWmumR.exe
  2⤵
  PID:4416
- C:\Windows\System\iFdxgrd.exe
  C:\Windows\System\iFdxgrd.exe
  2⤵
  PID:4580
- C:\Windows\System\BvDixNt.exe
  C:\Windows\System\BvDixNt.exe
  2⤵
  PID:4600
- C:\Windows\System\ZHqIWuJ.exe
  C:\Windows\System\ZHqIWuJ.exe
  2⤵
  PID:4616
- C:\Windows\System\UUbemJK.exe
  C:\Windows\System\UUbemJK.exe
  2⤵
  PID:4636
- C:\Windows\System\FtNrjga.exe
  C:\Windows\System\FtNrjga.exe
  2⤵
  PID:4652
- C:\Windows\System\oNVcgiB.exe
  C:\Windows\System\oNVcgiB.exe
  2⤵
  PID:4668
- C:\Windows\System\xxsnmXd.exe
  C:\Windows\System\xxsnmXd.exe
  2⤵
  PID:4684
- C:\Windows\System\XKxPKsa.exe
  C:\Windows\System\XKxPKsa.exe
  2⤵
  PID:4700
- C:\Windows\System\pOoOtOr.exe
  C:\Windows\System\pOoOtOr.exe
  2⤵
  PID:4720
- C:\Windows\System\ayPSCHU.exe
  C:\Windows\System\ayPSCHU.exe
  2⤵
  PID:4736
- C:\Windows\System\sooVHQf.exe
  C:\Windows\System\sooVHQf.exe
  2⤵
  PID:4752
- C:\Windows\System\TZWgrXT.exe
  C:\Windows\System\TZWgrXT.exe
  2⤵
  PID:4772
- C:\Windows\System\QxdqpPJ.exe
  C:\Windows\System\QxdqpPJ.exe
  2⤵
  PID:4788
- C:\Windows\System\JtlSzJl.exe
  C:\Windows\System\JtlSzJl.exe
  2⤵
  PID:4808
- C:\Windows\System\bqJvfZi.exe
  C:\Windows\System\bqJvfZi.exe
  2⤵
  PID:4824
- C:\Windows\System\aJJcHdn.exe
  C:\Windows\System\aJJcHdn.exe
  2⤵
  PID:4840
- C:\Windows\System\IxvZRWB.exe
  C:\Windows\System\IxvZRWB.exe
  2⤵
  PID:4864
- C:\Windows\System\QefhbFU.exe
  C:\Windows\System\QefhbFU.exe
  2⤵
  PID:4880
- C:\Windows\System\DCTfXNN.exe
  C:\Windows\System\DCTfXNN.exe
  2⤵
  PID:4896
- C:\Windows\System\XXgtFUk.exe
  C:\Windows\System\XXgtFUk.exe
  2⤵
  PID:5004
- C:\Windows\System\PbHRRMW.exe
  C:\Windows\System\PbHRRMW.exe
  2⤵
  PID:5024
- C:\Windows\System\uXwZDEE.exe
  C:\Windows\System\uXwZDEE.exe
  2⤵
  PID:5040
- C:\Windows\System\Qrsdvch.exe
  C:\Windows\System\Qrsdvch.exe
  2⤵
  PID:5056
- C:\Windows\System\mvxASuU.exe
  C:\Windows\System\mvxASuU.exe
  2⤵
  PID:5072
- C:\Windows\System\aJyFxql.exe
  C:\Windows\System\aJyFxql.exe
  2⤵
  PID:5096
- C:\Windows\System\jZOOenB.exe
  C:\Windows\System\jZOOenB.exe
  2⤵
  PID:5112
- C:\Windows\System\WmfGEmC.exe
  C:\Windows\System\WmfGEmC.exe
  2⤵
  PID:3852
- C:\Windows\System\xativkD.exe
  C:\Windows\System\xativkD.exe
  2⤵
  PID:4048
- C:\Windows\System\vaBELnF.exe
  C:\Windows\System\vaBELnF.exe
  2⤵
  PID:3836
- C:\Windows\System\sHCkvQT.exe
  C:\Windows\System\sHCkvQT.exe
  2⤵
  PID:3096
- C:\Windows\System\ypVcWCr.exe
  C:\Windows\System\ypVcWCr.exe
  2⤵
  PID:3292
- C:\Windows\System\EHqjuau.exe
  C:\Windows\System\EHqjuau.exe
  2⤵
  PID:4132
- C:\Windows\System\CEhYPZW.exe
  C:\Windows\System\CEhYPZW.exe
  2⤵
  PID:3704
- C:\Windows\System\iKrONxL.exe
  C:\Windows\System\iKrONxL.exe
  2⤵
  PID:2640
- C:\Windows\System\yNCuqIZ.exe
  C:\Windows\System\yNCuqIZ.exe
  2⤵
  PID:3204
- C:\Windows\System\GgFlhzv.exe
  C:\Windows\System\GgFlhzv.exe
  2⤵
  PID:2848
- C:\Windows\System\CdtRYgq.exe
  C:\Windows\System\CdtRYgq.exe
  2⤵
  PID:3440
- C:\Windows\System\dodphna.exe
  C:\Windows\System\dodphna.exe
  2⤵
  PID:4148
- C:\Windows\System\yIPtuBw.exe
  C:\Windows\System\yIPtuBw.exe
  2⤵
  PID:4316
- C:\Windows\System\BuBIPWM.exe
  C:\Windows\System\BuBIPWM.exe
  2⤵
  PID:4252
- C:\Windows\System\vJPifji.exe
  C:\Windows\System\vJPifji.exe
  2⤵
  PID:4432
- C:\Windows\System\raQglmt.exe
  C:\Windows\System\raQglmt.exe
  2⤵
  PID:4456
- C:\Windows\System\VfgJtEI.exe
  C:\Windows\System\VfgJtEI.exe
  2⤵
  PID:4360
- C:\Windows\System\GDvDtMB.exe
  C:\Windows\System\GDvDtMB.exe
  2⤵
  PID:4460
- C:\Windows\System\XawAPro.exe
  C:\Windows\System\XawAPro.exe
  2⤵
  PID:4488
- C:\Windows\System\AbogkEp.exe
  C:\Windows\System\AbogkEp.exe
  2⤵
  PID:4496
- C:\Windows\System\CohrylD.exe
  C:\Windows\System\CohrylD.exe
  2⤵
  PID:4528
- C:\Windows\System\JwkErkL.exe
  C:\Windows\System\JwkErkL.exe
  2⤵
  PID:4364
- C:\Windows\System\ZckjudV.exe
  C:\Windows\System\ZckjudV.exe
  2⤵
  PID:4588
- C:\Windows\System\qAYNFzy.exe
  C:\Windows\System\qAYNFzy.exe
  2⤵
  PID:4560
- C:\Windows\System\JifYrub.exe
  C:\Windows\System\JifYrub.exe
  2⤵
  PID:2516
- C:\Windows\System\SjYlHlT.exe
  C:\Windows\System\SjYlHlT.exe
  2⤵
  PID:4564
- C:\Windows\System\tTetFtP.exe
  C:\Windows\System\tTetFtP.exe
  2⤵
  PID:4680
- C:\Windows\System\IqqqCoG.exe
  C:\Windows\System\IqqqCoG.exe
  2⤵
  PID:4744
- C:\Windows\System\BbaJApn.exe
  C:\Windows\System\BbaJApn.exe
  2⤵
  PID:4624
- C:\Windows\System\hRHWAVy.exe
  C:\Windows\System\hRHWAVy.exe
  2⤵
  PID:4632
- C:\Windows\System\hwVrazC.exe
  C:\Windows\System\hwVrazC.exe
  2⤵
  PID:4732
- C:\Windows\System\dJsRanI.exe
  C:\Windows\System\dJsRanI.exe
  2⤵
  PID:4800
- C:\Windows\System\NSVUsrC.exe
  C:\Windows\System\NSVUsrC.exe
  2⤵
  PID:4848
- C:\Windows\System\gsoGTkB.exe
  C:\Windows\System\gsoGTkB.exe
  2⤵
  PID:1760
- C:\Windows\System\laGkapo.exe
  C:\Windows\System\laGkapo.exe
  2⤵
  PID:4860
- C:\Windows\System\ykYKoao.exe
  C:\Windows\System\ykYKoao.exe
  2⤵
  PID:4888
- C:\Windows\System\MRXqVlr.exe
  C:\Windows\System\MRXqVlr.exe
  2⤵
  PID:4912
- C:\Windows\System\JTBPpsW.exe
  C:\Windows\System\JTBPpsW.exe
  2⤵
  PID:4928
- C:\Windows\System\ksIWkDz.exe
  C:\Windows\System\ksIWkDz.exe
  2⤵
  PID:4944
- C:\Windows\System\maPwowa.exe
  C:\Windows\System\maPwowa.exe
  2⤵
  PID:4964
- C:\Windows\System\wtZuozz.exe
  C:\Windows\System\wtZuozz.exe
  2⤵
  PID:4984
- C:\Windows\System\dCsVGnx.exe
  C:\Windows\System\dCsVGnx.exe
  2⤵
  PID:4980
- C:\Windows\System\HhKmudf.exe
  C:\Windows\System\HhKmudf.exe
  2⤵
  PID:5032
- C:\Windows\System\UGNlRHS.exe
  C:\Windows\System\UGNlRHS.exe
  2⤵
  PID:5080
- C:\Windows\System\xQjQqQQ.exe
  C:\Windows\System\xQjQqQQ.exe
  2⤵
  PID:5088
- C:\Windows\System\lzGFJjq.exe
  C:\Windows\System\lzGFJjq.exe
  2⤵
  PID:2468
- C:\Windows\System\HSuWbtj.exe
  C:\Windows\System\HSuWbtj.exe
  2⤵
  PID:3552
- C:\Windows\System\sOVviVT.exe
  C:\Windows\System\sOVviVT.exe
  2⤵
  PID:3188
- C:\Windows\System\JwcBUMb.exe
  C:\Windows\System\JwcBUMb.exe
  2⤵
  PID:3388
- C:\Windows\System\fqoLSWf.exe
  C:\Windows\System\fqoLSWf.exe
  2⤵
  PID:4128
- C:\Windows\System\TMULGek.exe
  C:\Windows\System\TMULGek.exe
  2⤵
  PID:4280
- C:\Windows\System\aCByDNM.exe
  C:\Windows\System\aCByDNM.exe
  2⤵
  PID:4472
- C:\Windows\System\pQsOCnJ.exe
  C:\Windows\System\pQsOCnJ.exe
  2⤵
  PID:4508
- C:\Windows\System\YYUMCIy.exe
  C:\Windows\System\YYUMCIy.exe
  2⤵
  PID:4596
- C:\Windows\System\qMNuYhx.exe
  C:\Windows\System\qMNuYhx.exe
  2⤵
  PID:4728
- C:\Windows\System\usKUerH.exe
  C:\Windows\System\usKUerH.exe
  2⤵
  PID:1700
- C:\Windows\System\ufxrhqP.exe
  C:\Windows\System\ufxrhqP.exe
  2⤵
  PID:5068
- C:\Windows\System\RoACKkS.exe
  C:\Windows\System\RoACKkS.exe
  2⤵
  PID:2964
- C:\Windows\System\CFzDJpa.exe
  C:\Windows\System\CFzDJpa.exe
  2⤵
  PID:4540
- C:\Windows\System\aKYYJeH.exe
  C:\Windows\System\aKYYJeH.exe
  2⤵
  PID:4780
- C:\Windows\System\IrmqsRo.exe
  C:\Windows\System\IrmqsRo.exe
  2⤵
  PID:4796
- C:\Windows\System\rDbpBEp.exe
  C:\Windows\System\rDbpBEp.exe
  2⤵
  PID:4164
- C:\Windows\System\MfODCDD.exe
  C:\Windows\System\MfODCDD.exe
  2⤵
  PID:4924
- C:\Windows\System\PeIaSqN.exe
  C:\Windows\System\PeIaSqN.exe
  2⤵
  PID:4204
- C:\Windows\System\RPhntEQ.exe
  C:\Windows\System\RPhntEQ.exe
  2⤵
  PID:4100
- C:\Windows\System\aoUKDZR.exe
  C:\Windows\System\aoUKDZR.exe
  2⤵
  PID:5048
- C:\Windows\System\wAuyGUP.exe
  C:\Windows\System\wAuyGUP.exe
  2⤵
  PID:4296
- C:\Windows\System\aaGHZTR.exe
  C:\Windows\System\aaGHZTR.exe
  2⤵
  PID:3200
- C:\Windows\System\KDLAZph.exe
  C:\Windows\System\KDLAZph.exe
  2⤵
  PID:3752
- C:\Windows\System\tdCNirh.exe
  C:\Windows\System\tdCNirh.exe
  2⤵
  PID:4144
- C:\Windows\System\svBtFxG.exe
  C:\Windows\System\svBtFxG.exe
  2⤵
  PID:4284
- C:\Windows\System\hqxpNdX.exe
  C:\Windows\System\hqxpNdX.exe
  2⤵
  PID:4476
- C:\Windows\System\KJIJZjc.exe
  C:\Windows\System\KJIJZjc.exe
  2⤵
  PID:4712
- C:\Windows\System\wjQPYWC.exe
  C:\Windows\System\wjQPYWC.exe
  2⤵
  PID:4836
- C:\Windows\System\FuvdfQu.exe
  C:\Windows\System\FuvdfQu.exe
  2⤵
  PID:4972
- C:\Windows\System\CfpziaL.exe
  C:\Windows\System\CfpziaL.exe
  2⤵
  PID:4876
- C:\Windows\System\prWVtPA.exe
  C:\Windows\System\prWVtPA.exe
  2⤵
  PID:4516
- C:\Windows\System\OpizyZv.exe
  C:\Windows\System\OpizyZv.exe
  2⤵
  PID:3920
- C:\Windows\System\qYezBkK.exe
  C:\Windows\System\qYezBkK.exe
  2⤵
  PID:4960
- C:\Windows\System\CGnUAcu.exe
  C:\Windows\System\CGnUAcu.exe
  2⤵
  PID:3176
- C:\Windows\System\RoYSlEQ.exe
  C:\Windows\System\RoYSlEQ.exe
  2⤵
  PID:4264
- C:\Windows\System\jYTfYdW.exe
  C:\Windows\System\jYTfYdW.exe
  2⤵
  PID:4392
- C:\Windows\System\LXVKJLX.exe
  C:\Windows\System\LXVKJLX.exe
  2⤵
  PID:336
- C:\Windows\System\PXBNdgs.exe
  C:\Windows\System\PXBNdgs.exe
  2⤵
  PID:4376
- C:\Windows\System\sJLugWx.exe
  C:\Windows\System\sJLugWx.exe
  2⤵
  PID:4820
- C:\Windows\System\JOOBWXW.exe
  C:\Windows\System\JOOBWXW.exe
  2⤵
  PID:4200
- C:\Windows\System\pvrrQrA.exe
  C:\Windows\System\pvrrQrA.exe
  2⤵
  PID:3724
- C:\Windows\System\mrpCKzL.exe
  C:\Windows\System\mrpCKzL.exe
  2⤵
  PID:4716
- C:\Windows\System\BVxoAkQ.exe
  C:\Windows\System\BVxoAkQ.exe
  2⤵
  PID:4188
- C:\Windows\System\vLFcwVI.exe
  C:\Windows\System\vLFcwVI.exe
  2⤵
  PID:5128
- C:\Windows\System\RhtGAzi.exe
  C:\Windows\System\RhtGAzi.exe
  2⤵
  PID:5148
- C:\Windows\System\gKoCEpb.exe
  C:\Windows\System\gKoCEpb.exe
  2⤵
  PID:5164
- C:\Windows\System\UvZSVCG.exe
  C:\Windows\System\UvZSVCG.exe
  2⤵
  PID:5180
- C:\Windows\System\ZtOaPnN.exe
  C:\Windows\System\ZtOaPnN.exe
  2⤵
  PID:5196
- C:\Windows\System\JSFqPbd.exe
  C:\Windows\System\JSFqPbd.exe
  2⤵
  PID:5212
- C:\Windows\System\VMJmkbY.exe
  C:\Windows\System\VMJmkbY.exe
  2⤵
  PID:5228
- C:\Windows\System\bVLOZuS.exe
  C:\Windows\System\bVLOZuS.exe
  2⤵
  PID:5244
- C:\Windows\System\EjJghgt.exe
  C:\Windows\System\EjJghgt.exe
  2⤵
  PID:5260
- C:\Windows\System\HZavATH.exe
  C:\Windows\System\HZavATH.exe
  2⤵
  PID:5280
- C:\Windows\System\bQxTwYg.exe
  C:\Windows\System\bQxTwYg.exe
  2⤵
  PID:5296
- C:\Windows\System\GcUZRUf.exe
  C:\Windows\System\GcUZRUf.exe
  2⤵
  PID:5312
- C:\Windows\System\YYDeFXv.exe
  C:\Windows\System\YYDeFXv.exe
  2⤵
  PID:5328
- C:\Windows\System\GyVNbgy.exe
  C:\Windows\System\GyVNbgy.exe
  2⤵
  PID:5344
- C:\Windows\System\mOfurWl.exe
  C:\Windows\System\mOfurWl.exe
  2⤵
  PID:5360
- C:\Windows\System\UVwPFzQ.exe
  C:\Windows\System\UVwPFzQ.exe
  2⤵
  PID:5376
- C:\Windows\System\WoWFaGh.exe
  C:\Windows\System\WoWFaGh.exe
  2⤵
  PID:5396
- C:\Windows\System\iyowqyp.exe
  C:\Windows\System\iyowqyp.exe
  2⤵
  PID:5416
- C:\Windows\System\zfkEpEh.exe
  C:\Windows\System\zfkEpEh.exe
  2⤵
  PID:5472
- C:\Windows\System\isXcGkD.exe
  C:\Windows\System\isXcGkD.exe
  2⤵
  PID:5488
- C:\Windows\System\gHiZqxc.exe
  C:\Windows\System\gHiZqxc.exe
  2⤵
  PID:5504
- C:\Windows\System\FDdwcyr.exe
  C:\Windows\System\FDdwcyr.exe
  2⤵
  PID:5520
- C:\Windows\System\WJkLpCs.exe
  C:\Windows\System\WJkLpCs.exe
  2⤵
  PID:5536
- C:\Windows\System\sfvGMrf.exe
  C:\Windows\System\sfvGMrf.exe
  2⤵
  PID:5552
- C:\Windows\System\lcufXln.exe
  C:\Windows\System\lcufXln.exe
  2⤵
  PID:5572
- C:\Windows\System\ZOIdbpS.exe
  C:\Windows\System\ZOIdbpS.exe
  2⤵
  PID:5588
- C:\Windows\System\mSqBsmx.exe
  C:\Windows\System\mSqBsmx.exe
  2⤵
  PID:5608
- C:\Windows\System\TAaSlgg.exe
  C:\Windows\System\TAaSlgg.exe
  2⤵
  PID:5624
- C:\Windows\System\QCzHewy.exe
  C:\Windows\System\QCzHewy.exe
  2⤵
  PID:5640
- C:\Windows\System\TcGSUAq.exe
  C:\Windows\System\TcGSUAq.exe
  2⤵
  PID:5656
- C:\Windows\System\nYYJVtK.exe
  C:\Windows\System\nYYJVtK.exe
  2⤵
  PID:5672
- C:\Windows\System\NGfbLlG.exe
  C:\Windows\System\NGfbLlG.exe
  2⤵
  PID:5688
- C:\Windows\System\xDVqnoE.exe
  C:\Windows\System\xDVqnoE.exe
  2⤵
  PID:5704
- C:\Windows\System\KiiWIbP.exe
  C:\Windows\System\KiiWIbP.exe
  2⤵
  PID:5720
- C:\Windows\System\HAFgCOv.exe
  C:\Windows\System\HAFgCOv.exe
  2⤵
  PID:5740
- C:\Windows\System\EcbCDDR.exe
  C:\Windows\System\EcbCDDR.exe
  2⤵
  PID:5756
- C:\Windows\System\lSlWjFQ.exe
  C:\Windows\System\lSlWjFQ.exe
  2⤵
  PID:5772
- C:\Windows\System\THCzLbL.exe
  C:\Windows\System\THCzLbL.exe
  2⤵
  PID:5788
- C:\Windows\System\yfNMcip.exe
  C:\Windows\System\yfNMcip.exe
  2⤵
  PID:5804
- C:\Windows\System\iEGitFk.exe
  C:\Windows\System\iEGitFk.exe
  2⤵
  PID:5820
- C:\Windows\System\bQmPqtL.exe
  C:\Windows\System\bQmPqtL.exe
  2⤵
  PID:5840
- C:\Windows\System\RQJKXGC.exe
  C:\Windows\System\RQJKXGC.exe
  2⤵
  PID:5860
- C:\Windows\System\zLtHSFa.exe
  C:\Windows\System\zLtHSFa.exe
  2⤵
  PID:5876
- C:\Windows\System\SUEYRrm.exe
  C:\Windows\System\SUEYRrm.exe
  2⤵
  PID:5892
- C:\Windows\System\UqwSTXY.exe
  C:\Windows\System\UqwSTXY.exe
  2⤵
  PID:5908
- C:\Windows\System\SKAUOck.exe
  C:\Windows\System\SKAUOck.exe
  2⤵
  PID:5936
- C:\Windows\System\hKHKyVM.exe
  C:\Windows\System\hKHKyVM.exe
  2⤵
  PID:5952
- C:\Windows\System\nhfcjvW.exe
  C:\Windows\System\nhfcjvW.exe
  2⤵
  PID:5968
- C:\Windows\System\Rwxdcxj.exe
  C:\Windows\System\Rwxdcxj.exe
  2⤵
  PID:5984
- C:\Windows\System\AquCwpt.exe
  C:\Windows\System\AquCwpt.exe
  2⤵
  PID:6000
- C:\Windows\System\oqqaJyy.exe
  C:\Windows\System\oqqaJyy.exe
  2⤵
  PID:6016
- C:\Windows\System\nDlAnRt.exe
  C:\Windows\System\nDlAnRt.exe
  2⤵
  PID:6032
- C:\Windows\System\DHsjSCl.exe
  C:\Windows\System\DHsjSCl.exe
  2⤵
  PID:6048
- C:\Windows\System\EUUmiFX.exe
  C:\Windows\System\EUUmiFX.exe
  2⤵
  PID:6064
- C:\Windows\System\gcilbJj.exe
  C:\Windows\System\gcilbJj.exe
  2⤵
  PID:6080
- C:\Windows\System\Zttcshf.exe
  C:\Windows\System\Zttcshf.exe
  2⤵
  PID:6096
- C:\Windows\System\RDvnjSc.exe
  C:\Windows\System\RDvnjSc.exe
  2⤵
  PID:6112
- C:\Windows\System\crzpoVB.exe
  C:\Windows\System\crzpoVB.exe
  2⤵
  PID:6128
- C:\Windows\System\XPeDUCz.exe
  C:\Windows\System\XPeDUCz.exe
  2⤵
  PID:4648
- C:\Windows\System\FdgjrIl.exe
  C:\Windows\System\FdgjrIl.exe
  2⤵
  PID:4644
- C:\Windows\System\tQlmCYY.exe
  C:\Windows\System\tQlmCYY.exe
  2⤵
  PID:4676
- C:\Windows\System\aLdefIU.exe
  C:\Windows\System\aLdefIU.exe
  2⤵
  PID:3268
- C:\Windows\System\YnciHKo.exe
  C:\Windows\System\YnciHKo.exe
  2⤵
  PID:5268
- C:\Windows\System\IYMivsY.exe
  C:\Windows\System\IYMivsY.exe
  2⤵
  PID:4660
- C:\Windows\System\mYVJZRO.exe
  C:\Windows\System\mYVJZRO.exe
  2⤵
  PID:5160
- C:\Windows\System\tSWDlJB.exe
  C:\Windows\System\tSWDlJB.exe
  2⤵
  PID:5016
- C:\Windows\System\znDCsoj.exe
  C:\Windows\System\znDCsoj.exe
  2⤵
  PID:4424
- C:\Windows\System\eZnytaa.exe
  C:\Windows\System\eZnytaa.exe
  2⤵
  PID:5340
- C:\Windows\System\cZjwQqw.exe
  C:\Windows\System\cZjwQqw.exe
  2⤵
  PID:5408
- C:\Windows\System\fRYjHrJ.exe
  C:\Windows\System\fRYjHrJ.exe
  2⤵
  PID:5324
- C:\Windows\System\foAyiTN.exe
  C:\Windows\System\foAyiTN.exe
  2⤵
  PID:2244
- C:\Windows\System\tfDdYhy.exe
  C:\Windows\System\tfDdYhy.exe
  2⤵
  PID:5432
- C:\Windows\System\mbQXyyd.exe
  C:\Windows\System\mbQXyyd.exe
  2⤵
  PID:5452
- C:\Windows\System\NzWjcMG.exe
  C:\Windows\System\NzWjcMG.exe
  2⤵
  PID:5464
- C:\Windows\System\DdkdTTv.exe
  C:\Windows\System\DdkdTTv.exe
  2⤵
  PID:5140
- C:\Windows\System\Fjdihyw.exe
  C:\Windows\System\Fjdihyw.exe
  2⤵
  PID:5204
- C:\Windows\System\TRBNbvD.exe
  C:\Windows\System\TRBNbvD.exe
  2⤵
  PID:5544
- C:\Windows\System\ZGJmuJb.exe
  C:\Windows\System\ZGJmuJb.exe
  2⤵
  PID:5620
- C:\Windows\System\TvyqygR.exe
  C:\Windows\System\TvyqygR.exe
  2⤵
  PID:5712
- C:\Windows\System\lJUxrIX.exe
  C:\Windows\System\lJUxrIX.exe
  2⤵
  PID:5684
- C:\Windows\System\ikjsKIK.exe
  C:\Windows\System\ikjsKIK.exe
  2⤵
  PID:5816
- C:\Windows\System\FeYXNAN.exe
  C:\Windows\System\FeYXNAN.exe
  2⤵
  PID:5884
- C:\Windows\System\bfvfrYg.exe
  C:\Windows\System\bfvfrYg.exe
  2⤵
  PID:5924
- C:\Windows\System\pZrqjoD.exe
  C:\Windows\System\pZrqjoD.exe
  2⤵
  PID:5932
- C:\Windows\System\QTjlGgN.exe
  C:\Windows\System\QTjlGgN.exe
  2⤵
  PID:5920
- C:\Windows\System\KfWUirZ.exe
  C:\Windows\System\KfWUirZ.exe
  2⤵
  PID:5496
- C:\Windows\System\bSayZDS.exe
  C:\Windows\System\bSayZDS.exe
  2⤵
  PID:5560
- C:\Windows\System\mdXIirJ.exe
  C:\Windows\System\mdXIirJ.exe
  2⤵
  PID:5600
- C:\Windows\System\cLTewMf.exe
  C:\Windows\System\cLTewMf.exe
  2⤵
  PID:5664
- C:\Windows\System\gJoMSiH.exe
  C:\Windows\System\gJoMSiH.exe
  2⤵
  PID:5728
- C:\Windows\System\WtsBwkW.exe
  C:\Windows\System\WtsBwkW.exe
  2⤵
  PID:5768
- C:\Windows\System\zTqZURt.exe
  C:\Windows\System\zTqZURt.exe
  2⤵
  PID:5832
- C:\Windows\System\EbGiHKu.exe
  C:\Windows\System\EbGiHKu.exe
  2⤵
  PID:5900
- C:\Windows\System\GBxohzR.exe
  C:\Windows\System\GBxohzR.exe
  2⤵
  PID:5960
- C:\Windows\System\WVdwcSy.exe
  C:\Windows\System\WVdwcSy.exe
  2⤵
  PID:6008
- C:\Windows\System\VBmaHaf.exe
  C:\Windows\System\VBmaHaf.exe
  2⤵
  PID:6104
- C:\Windows\System\jDJFUvC.exe
  C:\Windows\System\jDJFUvC.exe
  2⤵
  PID:5052
- C:\Windows\System\yHXtWeQ.exe
  C:\Windows\System\yHXtWeQ.exe
  2⤵
  PID:5156
- C:\Windows\System\IOTFBwf.exe
  C:\Windows\System\IOTFBwf.exe
  2⤵
  PID:6108
- C:\Windows\System\CeaFVNX.exe
  C:\Windows\System\CeaFVNX.exe
  2⤵
  PID:6028
- C:\Windows\System\GEEjjDO.exe
  C:\Windows\System\GEEjjDO.exe
  2⤵
  PID:6092
- C:\Windows\System\NhsRLzP.exe
  C:\Windows\System\NhsRLzP.exe
  2⤵
  PID:4408
- C:\Windows\System\PmUUCWD.exe
  C:\Windows\System\PmUUCWD.exe
  2⤵
  PID:5256
- C:\Windows\System\mUIhPwg.exe
  C:\Windows\System\mUIhPwg.exe
  2⤵
  PID:5404
- C:\Windows\System\CRTuleG.exe
  C:\Windows\System\CRTuleG.exe
  2⤵
  PID:5436
- C:\Windows\System\lokGvxM.exe
  C:\Windows\System\lokGvxM.exe
  2⤵
  PID:5512
- C:\Windows\System\orMnCtm.exe
  C:\Windows\System\orMnCtm.exe
  2⤵
  PID:5384
- C:\Windows\System\pGTzZNn.exe
  C:\Windows\System\pGTzZNn.exe
  2⤵
  PID:5632
- C:\Windows\System\XDucaYd.exe
  C:\Windows\System\XDucaYd.exe
  2⤵
  PID:5868
- C:\Windows\System\uGRpWrH.exe
  C:\Windows\System\uGRpWrH.exe
  2⤵
  PID:6140
- C:\Windows\System\EFAKrgn.exe
  C:\Windows\System\EFAKrgn.exe
  2⤵
  PID:5812
- C:\Windows\System\PdgQvdr.exe
  C:\Windows\System\PdgQvdr.exe
  2⤵
  PID:5292
- C:\Windows\System\wfONIbd.exe
  C:\Windows\System\wfONIbd.exe
  2⤵
  PID:5700
- C:\Windows\System\XmyQAIU.exe
  C:\Windows\System\XmyQAIU.exe
  2⤵
  PID:6060
- C:\Windows\System\lwgOrQw.exe
  C:\Windows\System\lwgOrQw.exe
  2⤵
  PID:5856
- C:\Windows\System\HZqWivE.exe
  C:\Windows\System\HZqWivE.exe
  2⤵
  PID:6044
- C:\Windows\System\JFHENMW.exe
  C:\Windows\System\JFHENMW.exe
  2⤵
  PID:5456
- C:\Windows\System\QuZIMSd.exe
  C:\Windows\System\QuZIMSd.exe
  2⤵
  PID:5888
- C:\Windows\System\MvYOaRW.exe
  C:\Windows\System\MvYOaRW.exe
  2⤵
  PID:5596
- C:\Windows\System\ShTuJkx.exe
  C:\Windows\System\ShTuJkx.exe
  2⤵
  PID:6076
- C:\Windows\System\qIWsLqD.exe
  C:\Windows\System\qIWsLqD.exe
  2⤵
  PID:6088
- C:\Windows\System\QLbEuNy.exe
  C:\Windows\System\QLbEuNy.exe
  2⤵
  PID:5388
- C:\Windows\System\HCNhZlZ.exe
  C:\Windows\System\HCNhZlZ.exe
  2⤵
  PID:796
- C:\Windows\System\smFfuMu.exe
  C:\Windows\System\smFfuMu.exe
  2⤵
  PID:5412
- C:\Windows\System\FpikRKF.exe
  C:\Windows\System\FpikRKF.exe
  2⤵
  PID:5480
- C:\Windows\System\yBKzGMp.exe
  C:\Windows\System\yBKzGMp.exe
  2⤵
  PID:4768
- C:\Windows\System\EBbcgWr.exe
  C:\Windows\System\EBbcgWr.exe
  2⤵
  PID:6040
- C:\Windows\System\wXXkMyD.exe
  C:\Windows\System\wXXkMyD.exe
  2⤵
  PID:5976
- C:\Windows\System\bHpZasZ.exe
  C:\Windows\System\bHpZasZ.exe
  2⤵
  PID:5992
- C:\Windows\System\CCzEsOX.exe
  C:\Windows\System\CCzEsOX.exe
  2⤵
  PID:5748
- C:\Windows\System\fbgbqBu.exe
  C:\Windows\System\fbgbqBu.exe
  2⤵
  PID:6024
- C:\Windows\System\JQAkeZq.exe
  C:\Windows\System\JQAkeZq.exe
  2⤵
  PID:4996
- C:\Windows\System\cZolfvh.exe
  C:\Windows\System\cZolfvh.exe
  2⤵
  PID:4448
- C:\Windows\System\XdOGkaG.exe
  C:\Windows\System\XdOGkaG.exe
  2⤵
  PID:4976
- C:\Windows\System\LCzoYjv.exe
  C:\Windows\System\LCzoYjv.exe
  2⤵
  PID:5372
- C:\Windows\System\sKbRCvF.exe
  C:\Windows\System\sKbRCvF.exe
  2⤵
  PID:5568
- C:\Windows\System\XtbWXNu.exe
  C:\Windows\System\XtbWXNu.exe
  2⤵
  PID:5980
- C:\Windows\System\IZkTfif.exe
  C:\Windows\System\IZkTfif.exe
  2⤵
  PID:5680
- C:\Windows\System\IRwAvYE.exe
  C:\Windows\System\IRwAvYE.exe
  2⤵
  PID:5084
- C:\Windows\System\epsOhsL.exe
  C:\Windows\System\epsOhsL.exe
  2⤵
  PID:6152
- C:\Windows\System\LNktAxq.exe
  C:\Windows\System\LNktAxq.exe
  2⤵
  PID:6168
- C:\Windows\System\qnobwKd.exe
  C:\Windows\System\qnobwKd.exe
  2⤵
  PID:6184
- C:\Windows\System\bbdhBpO.exe
  C:\Windows\System\bbdhBpO.exe
  2⤵
  PID:6200
- C:\Windows\System\SBxHonC.exe
  C:\Windows\System\SBxHonC.exe
  2⤵
  PID:6216
- C:\Windows\System\PJLFHqk.exe
  C:\Windows\System\PJLFHqk.exe
  2⤵
  PID:6232
- C:\Windows\System\xmMnVkZ.exe
  C:\Windows\System\xmMnVkZ.exe
  2⤵
  PID:6248
- C:\Windows\System\SnozsEe.exe
  C:\Windows\System\SnozsEe.exe
  2⤵
  PID:6264
- C:\Windows\System\mUaHwgU.exe
  C:\Windows\System\mUaHwgU.exe
  2⤵
  PID:6280
- C:\Windows\System\LjhCriu.exe
  C:\Windows\System\LjhCriu.exe
  2⤵
  PID:6300
- C:\Windows\System\NoDMkXH.exe
  C:\Windows\System\NoDMkXH.exe
  2⤵
  PID:6316
- C:\Windows\System\CkMgQLG.exe
  C:\Windows\System\CkMgQLG.exe
  2⤵
  PID:6332
- C:\Windows\System\cQwSKxD.exe
  C:\Windows\System\cQwSKxD.exe
  2⤵
  PID:6348
- C:\Windows\System\uVgPSeF.exe
  C:\Windows\System\uVgPSeF.exe
  2⤵
  PID:6368
- C:\Windows\System\KaKIzBk.exe
  C:\Windows\System\KaKIzBk.exe
  2⤵
  PID:6384
- C:\Windows\System\JUXOyJJ.exe
  C:\Windows\System\JUXOyJJ.exe
  2⤵
  PID:6524
- C:\Windows\System\NaymHaK.exe
  C:\Windows\System\NaymHaK.exe
  2⤵
  PID:6548
- C:\Windows\System\ERfHnFk.exe
  C:\Windows\System\ERfHnFk.exe
  2⤵
  PID:6564
- C:\Windows\System\ToYZqBZ.exe
  C:\Windows\System\ToYZqBZ.exe
  2⤵
  PID:6580
- C:\Windows\System\HANCDUL.exe
  C:\Windows\System\HANCDUL.exe
  2⤵
  PID:6596
- C:\Windows\System\NrDvaYv.exe
  C:\Windows\System\NrDvaYv.exe
  2⤵
  PID:6624
- C:\Windows\System\DJMOlKK.exe
  C:\Windows\System\DJMOlKK.exe
  2⤵
  PID:6640
- C:\Windows\System\bwVZWkr.exe
  C:\Windows\System\bwVZWkr.exe
  2⤵
  PID:6656
- C:\Windows\System\OsWSizF.exe
  C:\Windows\System\OsWSizF.exe
  2⤵
  PID:6680
- C:\Windows\System\GHVXcKf.exe
  C:\Windows\System\GHVXcKf.exe
  2⤵
  PID:6696
- C:\Windows\System\gNIdBDv.exe
  C:\Windows\System\gNIdBDv.exe
  2⤵
  PID:6712
- C:\Windows\System\oMGakOV.exe
  C:\Windows\System\oMGakOV.exe
  2⤵
  PID:6732
- C:\Windows\System\PTqQdJp.exe
  C:\Windows\System\PTqQdJp.exe
  2⤵
  PID:6748
- C:\Windows\System\rkYZIUr.exe
  C:\Windows\System\rkYZIUr.exe
  2⤵
  PID:6764
- C:\Windows\System\jjTDsuK.exe
  C:\Windows\System\jjTDsuK.exe
  2⤵
  PID:6780
- C:\Windows\System\mgYPsCV.exe
  C:\Windows\System\mgYPsCV.exe
  2⤵
  PID:6796
- C:\Windows\System\sfoQvbN.exe
  C:\Windows\System\sfoQvbN.exe
  2⤵
  PID:6812
- C:\Windows\System\lnmsBqm.exe
  C:\Windows\System\lnmsBqm.exe
  2⤵
  PID:6832
- C:\Windows\System\PrLukGp.exe
  C:\Windows\System\PrLukGp.exe
  2⤵
  PID:6848
- C:\Windows\System\RNCwAdH.exe
  C:\Windows\System\RNCwAdH.exe
  2⤵
  PID:6864
- C:\Windows\System\ENkgwzi.exe
  C:\Windows\System\ENkgwzi.exe
  2⤵
  PID:6880
- C:\Windows\System\QMOxRdr.exe
  C:\Windows\System\QMOxRdr.exe
  2⤵
  PID:6896
- C:\Windows\System\wvGMJBk.exe
  C:\Windows\System\wvGMJBk.exe
  2⤵
  PID:6912
- C:\Windows\System\KlfitRF.exe
  C:\Windows\System\KlfitRF.exe
  2⤵
  PID:6928
- C:\Windows\System\HFPWmUm.exe
  C:\Windows\System\HFPWmUm.exe
  2⤵
  PID:6944
- C:\Windows\System\NhKGYUE.exe
  C:\Windows\System\NhKGYUE.exe
  2⤵
  PID:6960
- C:\Windows\System\rKgZCxG.exe
  C:\Windows\System\rKgZCxG.exe
  2⤵
  PID:6980
- C:\Windows\System\xyBYCqo.exe
  C:\Windows\System\xyBYCqo.exe
  2⤵
  PID:6996
- C:\Windows\System\JERBCKu.exe
  C:\Windows\System\JERBCKu.exe
  2⤵
  PID:7012
- C:\Windows\System\yNHRstj.exe
  C:\Windows\System\yNHRstj.exe
  2⤵
  PID:7028
- C:\Windows\System\FSgtWuQ.exe
  C:\Windows\System\FSgtWuQ.exe
  2⤵
  PID:7052
- C:\Windows\System\ljPYbOC.exe
  C:\Windows\System\ljPYbOC.exe
  2⤵
  PID:7068
- C:\Windows\System\ehhUMni.exe
  C:\Windows\System\ehhUMni.exe
  2⤵
  PID:7084
- C:\Windows\System\dkAOpdg.exe
  C:\Windows\System\dkAOpdg.exe
  2⤵
  PID:7100
- C:\Windows\System\aeTrqbN.exe
  C:\Windows\System\aeTrqbN.exe
  2⤵
  PID:7116
- C:\Windows\System\wJHotdk.exe
  C:\Windows\System\wJHotdk.exe
  2⤵
  PID:7132
- C:\Windows\System\rJRZhAm.exe
  C:\Windows\System\rJRZhAm.exe
  2⤵
  PID:7148
- C:\Windows\System\cRsXohR.exe
  C:\Windows\System\cRsXohR.exe
  2⤵
  PID:5944
- C:\Windows\System\aMEHPXJ.exe
  C:\Windows\System\aMEHPXJ.exe
  2⤵
  PID:6160
- C:\Windows\System\efpGBIY.exe
  C:\Windows\System\efpGBIY.exe
  2⤵
  PID:5852
- C:\Windows\System\WyWEyrs.exe
  C:\Windows\System\WyWEyrs.exe
  2⤵
  PID:6196
- C:\Windows\System\ahUFPEg.exe
  C:\Windows\System\ahUFPEg.exe
  2⤵
  PID:6288
- C:\Windows\System\MAfAROq.exe
  C:\Windows\System\MAfAROq.exe
  2⤵
  PID:6324
- C:\Windows\System\WrjtdVZ.exe
  C:\Windows\System\WrjtdVZ.exe
  2⤵
  PID:6360
- C:\Windows\System\iBhwXCm.exe
  C:\Windows\System\iBhwXCm.exe
  2⤵
  PID:6240
- C:\Windows\System\mgVdFyc.exe
  C:\Windows\System\mgVdFyc.exe
  2⤵
  PID:6308
- C:\Windows\System\toZnRDd.exe
  C:\Windows\System\toZnRDd.exe
  2⤵
  PID:6380
- C:\Windows\System\mGrsIFQ.exe
  C:\Windows\System\mGrsIFQ.exe
  2⤵
  PID:6456
- C:\Windows\System\BdtvSzh.exe
  C:\Windows\System\BdtvSzh.exe
  2⤵
  PID:6468
- C:\Windows\System\ioeJRBO.exe
  C:\Windows\System\ioeJRBO.exe
  2⤵
  PID:6484
- C:\Windows\System\ixBamgw.exe
  C:\Windows\System\ixBamgw.exe
  2⤵
  PID:6412
- C:\Windows\System\OOLdwmT.exe
  C:\Windows\System\OOLdwmT.exe
  2⤵
  PID:6428
- C:\Windows\System\BMarZaI.exe
  C:\Windows\System\BMarZaI.exe
  2⤵
  PID:6508
- C:\Windows\System\DsjivUw.exe
  C:\Windows\System\DsjivUw.exe
  2⤵
  PID:6560
- C:\Windows\System\zgXdDYo.exe
  C:\Windows\System\zgXdDYo.exe
  2⤵
  PID:6636
- C:\Windows\System\chSzUmw.exe
  C:\Windows\System\chSzUmw.exe
  2⤵
  PID:6496
- C:\Windows\System\urGUvbP.exe
  C:\Windows\System\urGUvbP.exe
  2⤵
  PID:6708
- C:\Windows\System\lkkXMPm.exe
  C:\Windows\System\lkkXMPm.exe
  2⤵
  PID:6544
- C:\Windows\System\zyksrRh.exe
  C:\Windows\System\zyksrRh.exe
  2⤵
  PID:6616
- C:\Windows\System\GeTiGvD.exe
  C:\Windows\System\GeTiGvD.exe
  2⤵
  PID:6572
- C:\Windows\System\LMRAALS.exe
  C:\Windows\System\LMRAALS.exe
  2⤵
  PID:6648
- C:\Windows\System\DhyBIMc.exe
  C:\Windows\System\DhyBIMc.exe
  2⤵
  PID:6724
- C:\Windows\System\aMfObYw.exe
  C:\Windows\System\aMfObYw.exe
  2⤵
  PID:6824
- C:\Windows\System\VQqIKUv.exe
  C:\Windows\System\VQqIKUv.exe
  2⤵
  PID:6776
- C:\Windows\System\lDAcbPo.exe
  C:\Windows\System\lDAcbPo.exe
  2⤵
  PID:6876
- C:\Windows\System\poKHCKN.exe
  C:\Windows\System\poKHCKN.exe
  2⤵
  PID:6892
- C:\Windows\System\deVwRKG.exe
  C:\Windows\System\deVwRKG.exe
  2⤵
  PID:6956
- C:\Windows\System\CAuorvS.exe
  C:\Windows\System\CAuorvS.exe
  2⤵
  PID:7024
- C:\Windows\System\OgtKKwN.exe
  C:\Windows\System\OgtKKwN.exe
  2⤵
  PID:6940
- C:\Windows\System\gJwwOwD.exe
  C:\Windows\System\gJwwOwD.exe
  2⤵
  PID:7004
- C:\Windows\System\JsHeztb.exe
  C:\Windows\System\JsHeztb.exe
  2⤵
  PID:7048
- C:\Windows\System\LsoVRra.exe
  C:\Windows\System\LsoVRra.exe
  2⤵
  PID:7092
- C:\Windows\System\IOiXVoz.exe
  C:\Windows\System\IOiXVoz.exe
  2⤵
  PID:7076
- C:\Windows\System\lpqnnPb.exe
  C:\Windows\System\lpqnnPb.exe
  2⤵
  PID:7156
- C:\Windows\System\KetcCMn.exe
  C:\Windows\System\KetcCMn.exe
  2⤵
  PID:4552
- C:\Windows\System\dtWadps.exe
  C:\Windows\System\dtWadps.exe
  2⤵
  PID:6224
- C:\Windows\System\kNsKDwZ.exe
  C:\Windows\System\kNsKDwZ.exe
  2⤵
  PID:5308
- C:\Windows\System\nQsxaWc.exe
  C:\Windows\System\nQsxaWc.exe
  2⤵
  PID:6256
- C:\Windows\System\DEXIQuL.exe
  C:\Windows\System\DEXIQuL.exe
  2⤵
  PID:6444
- C:\Windows\System\qnFIocp.exe
  C:\Windows\System\qnFIocp.exe
  2⤵
  PID:6476
- C:\Windows\System\FHuCPKo.exe
  C:\Windows\System\FHuCPKo.exe
  2⤵
  PID:6520
- C:\Windows\System\UAMoBYG.exe
  C:\Windows\System\UAMoBYG.exe
  2⤵
  PID:6436
- C:\Windows\System\mHYVjLR.exe
  C:\Windows\System\mHYVjLR.exe
  2⤵
  PID:6704
- C:\Windows\System\FZqCVXZ.exe
  C:\Windows\System\FZqCVXZ.exe
  2⤵
  PID:6788
- C:\Windows\System\bvntyKD.exe
  C:\Windows\System\bvntyKD.exe
  2⤵
  PID:6464
- C:\Windows\System\RToSZDL.exe
  C:\Windows\System\RToSZDL.exe
  2⤵
  PID:6340
- C:\Windows\System\rldBluc.exe
  C:\Windows\System\rldBluc.exe
  2⤵
  PID:6536
- C:\Windows\System\mABIBve.exe
  C:\Windows\System\mABIBve.exe
  2⤵
  PID:6720
- C:\Windows\System\wfYfYdO.exe
  C:\Windows\System\wfYfYdO.exe
  2⤵
  PID:6856
- C:\Windows\System\NeWpzJU.exe
  C:\Windows\System\NeWpzJU.exe
  2⤵
  PID:6872
- C:\Windows\System\ZTZTAul.exe
  C:\Windows\System\ZTZTAul.exe
  2⤵
  PID:4512
- C:\Windows\System\GLtEcOQ.exe
  C:\Windows\System\GLtEcOQ.exe
  2⤵
  PID:7112
- C:\Windows\System\xvaWhpz.exe
  C:\Windows\System\xvaWhpz.exe
  2⤵
  PID:5460
- C:\Windows\System\rpcoJzT.exe
  C:\Windows\System\rpcoJzT.exe
  2⤵
  PID:6356
- C:\Windows\System\WuFouOR.exe
  C:\Windows\System\WuFouOR.exe
  2⤵
  PID:6272
- C:\Windows\System\OeFwJRZ.exe
  C:\Windows\System\OeFwJRZ.exe
  2⤵
  PID:7124
- C:\Windows\System\OvxolJe.exe
  C:\Windows\System\OvxolJe.exe
  2⤵
  PID:6448
- C:\Windows\System\sxXkcNf.exe
  C:\Windows\System\sxXkcNf.exe
  2⤵
  PID:6592
- C:\Windows\System\mnJSZQk.exe
  C:\Windows\System\mnJSZQk.exe
  2⤵
  PID:6604
- C:\Windows\System\QuWqsZE.exe
  C:\Windows\System\QuWqsZE.exe
  2⤵
  PID:6740
- C:\Windows\System\jGqFGXX.exe
  C:\Windows\System\jGqFGXX.exe
  2⤵
  PID:6820
- C:\Windows\System\PrOytNK.exe
  C:\Windows\System\PrOytNK.exe
  2⤵
  PID:6404
- C:\Windows\System\wupYUVG.exe
  C:\Windows\System\wupYUVG.exe
  2⤵
  PID:6908
- C:\Windows\System\iTVNoYx.exe
  C:\Windows\System\iTVNoYx.exe
  2⤵
  PID:7144
- C:\Windows\System\WCYXcSq.exe
  C:\Windows\System\WCYXcSq.exe
  2⤵
  PID:6192
- C:\Windows\System\WsAZQDb.exe
  C:\Windows\System\WsAZQDb.exe
  2⤵
  PID:7060
- C:\Windows\System\PPffUqq.exe
  C:\Windows\System\PPffUqq.exe
  2⤵
  PID:6296
- C:\Windows\System\qjLlyQU.exe
  C:\Windows\System\qjLlyQU.exe
  2⤵
  PID:6844
- C:\Windows\System\WrKEWBm.exe
  C:\Windows\System\WrKEWBm.exe
  2⤵
  PID:6212
- C:\Windows\System\NdQVDrR.exe
  C:\Windows\System\NdQVDrR.exe
  2⤵
  PID:6376
- C:\Windows\System\lSSaSwl.exe
  C:\Windows\System\lSSaSwl.exe
  2⤵
  PID:7140
- C:\Windows\System\dwbKeWo.exe
  C:\Windows\System\dwbKeWo.exe
  2⤵
  PID:7172
- C:\Windows\System\qsTDHrZ.exe
  C:\Windows\System\qsTDHrZ.exe
  2⤵
  PID:7188
- C:\Windows\System\Lccedqa.exe
  C:\Windows\System\Lccedqa.exe
  2⤵
  PID:7204
- C:\Windows\System\CgnziVR.exe
  C:\Windows\System\CgnziVR.exe
  2⤵
  PID:7220
- C:\Windows\System\XzkbvGj.exe
  C:\Windows\System\XzkbvGj.exe
  2⤵
  PID:7236
- C:\Windows\System\Rqnroeb.exe
  C:\Windows\System\Rqnroeb.exe
  2⤵
  PID:7252
- C:\Windows\System\jqqdkCx.exe
  C:\Windows\System\jqqdkCx.exe
  2⤵
  PID:7268
- C:\Windows\System\ZthADZQ.exe
  C:\Windows\System\ZthADZQ.exe
  2⤵
  PID:7284
- C:\Windows\System\IEdgtpS.exe
  C:\Windows\System\IEdgtpS.exe
  2⤵
  PID:7300
- C:\Windows\System\OexJrfr.exe
  C:\Windows\System\OexJrfr.exe
  2⤵
  PID:7316
- C:\Windows\System\ySNJFyC.exe
  C:\Windows\System\ySNJFyC.exe
  2⤵
  PID:7332
- C:\Windows\System\fRAqJZA.exe
  C:\Windows\System\fRAqJZA.exe
  2⤵
  PID:7348
- C:\Windows\System\peimcus.exe
  C:\Windows\System\peimcus.exe
  2⤵
  PID:7368
- C:\Windows\System\CdpXTjw.exe
  C:\Windows\System\CdpXTjw.exe
  2⤵
  PID:7384
- C:\Windows\System\qjRBoiM.exe
  C:\Windows\System\qjRBoiM.exe
  2⤵
  PID:7404
- C:\Windows\System\AkmQVds.exe
  C:\Windows\System\AkmQVds.exe
  2⤵
  PID:7420
- C:\Windows\System\YdetPiK.exe
  C:\Windows\System\YdetPiK.exe
  2⤵
  PID:7440
- C:\Windows\System\VStaBCa.exe
  C:\Windows\System\VStaBCa.exe
  2⤵
  PID:7456
- C:\Windows\System\LXohlys.exe
  C:\Windows\System\LXohlys.exe
  2⤵
  PID:7472
- C:\Windows\System\SesNVFz.exe
  C:\Windows\System\SesNVFz.exe
  2⤵
  PID:7488
- C:\Windows\System\DSzqERc.exe
  C:\Windows\System\DSzqERc.exe
  2⤵
  PID:7504
- C:\Windows\System\AenxqpZ.exe
  C:\Windows\System\AenxqpZ.exe
  2⤵
  PID:7520
- C:\Windows\System\sLnNVxC.exe
  C:\Windows\System\sLnNVxC.exe
  2⤵
  PID:7536
- C:\Windows\System\OVQYonE.exe
  C:\Windows\System\OVQYonE.exe
  2⤵
  PID:7556
- C:\Windows\System\QIUGhTc.exe
  C:\Windows\System\QIUGhTc.exe
  2⤵
  PID:7572
- C:\Windows\System\dLIWHGo.exe
  C:\Windows\System\dLIWHGo.exe
  2⤵
  PID:7592
- C:\Windows\System\uAXWKYV.exe
  C:\Windows\System\uAXWKYV.exe
  2⤵
  PID:7608
- C:\Windows\System\wHQbUHD.exe
  C:\Windows\System\wHQbUHD.exe
  2⤵
  PID:7624
- C:\Windows\System\RkysCTg.exe
  C:\Windows\System\RkysCTg.exe
  2⤵
  PID:7640
- C:\Windows\System\IhQCuPa.exe
  C:\Windows\System\IhQCuPa.exe
  2⤵
  PID:7656
- C:\Windows\System\gfleDRV.exe
  C:\Windows\System\gfleDRV.exe
  2⤵
  PID:7672
- C:\Windows\System\wOhjAFB.exe
  C:\Windows\System\wOhjAFB.exe
  2⤵
  PID:7688
- C:\Windows\System\jecGiQd.exe
  C:\Windows\System\jecGiQd.exe
  2⤵
  PID:7704
- C:\Windows\System\mKlohDd.exe
  C:\Windows\System\mKlohDd.exe
  2⤵
  PID:7724
- C:\Windows\System\UQhqNsX.exe
  C:\Windows\System\UQhqNsX.exe
  2⤵
  PID:7740
- C:\Windows\System\WqWxgtT.exe
  C:\Windows\System\WqWxgtT.exe
  2⤵
  PID:7756
- C:\Windows\System\AaVDqpv.exe
  C:\Windows\System\AaVDqpv.exe
  2⤵
  PID:7776
- C:\Windows\System\AqGRXkM.exe
  C:\Windows\System\AqGRXkM.exe
  2⤵
  PID:7792
- C:\Windows\System\iCwwDuR.exe
  C:\Windows\System\iCwwDuR.exe
  2⤵
  PID:7808
- C:\Windows\System\UszNJvF.exe
  C:\Windows\System\UszNJvF.exe
  2⤵
  PID:7824
- C:\Windows\System\lDJzHjN.exe
  C:\Windows\System\lDJzHjN.exe
  2⤵
  PID:7844
- C:\Windows\System\OMypoky.exe
  C:\Windows\System\OMypoky.exe
  2⤵
  PID:7860
- C:\Windows\System\PhpjyNu.exe
  C:\Windows\System\PhpjyNu.exe
  2⤵
  PID:7876
- C:\Windows\System\TwshOmr.exe
  C:\Windows\System\TwshOmr.exe
  2⤵
  PID:7896
- C:\Windows\System\QavlipC.exe
  C:\Windows\System\QavlipC.exe
  2⤵
  PID:7920
- C:\Windows\System\fnVDZRV.exe
  C:\Windows\System\fnVDZRV.exe
  2⤵
  PID:7936
- C:\Windows\System\zYNwAHL.exe
  C:\Windows\System\zYNwAHL.exe
  2⤵
  PID:7956
- C:\Windows\System\pPWNxxI.exe
  C:\Windows\System\pPWNxxI.exe
  2⤵
  PID:7972
- C:\Windows\System\Ldctphr.exe
  C:\Windows\System\Ldctphr.exe
  2⤵
  PID:7988
- C:\Windows\System\TKntVyS.exe
  C:\Windows\System\TKntVyS.exe
  2⤵
  PID:8004
- C:\Windows\System\JTZMzNs.exe
  C:\Windows\System\JTZMzNs.exe
  2⤵
  PID:8020
- C:\Windows\System\HDFquED.exe
  C:\Windows\System\HDFquED.exe
  2⤵
  PID:8036
- C:\Windows\System\SBNkkQs.exe
  C:\Windows\System\SBNkkQs.exe
  2⤵
  PID:8052
- C:\Windows\System\iVCTkxF.exe
  C:\Windows\System\iVCTkxF.exe
  2⤵
  PID:8072
- C:\Windows\System\HsqWtEe.exe
  C:\Windows\System\HsqWtEe.exe
  2⤵
  PID:8088
- C:\Windows\System\ruqwqrV.exe
  C:\Windows\System\ruqwqrV.exe
  2⤵
  PID:8104
- C:\Windows\System\ruiwixI.exe
  C:\Windows\System\ruiwixI.exe
  2⤵
  PID:8120
- C:\Windows\System\CAUBJYm.exe
  C:\Windows\System\CAUBJYm.exe
  2⤵
  PID:8136
- C:\Windows\System\EFyrZOo.exe
  C:\Windows\System\EFyrZOo.exe
  2⤵
  PID:8152
- C:\Windows\System\DxgaqAt.exe
  C:\Windows\System\DxgaqAt.exe
  2⤵
  PID:8168
- C:\Windows\System\xcbFPWN.exe
  C:\Windows\System\xcbFPWN.exe
  2⤵
  PID:8184
- C:\Windows\System\lNOqAXI.exe
  C:\Windows\System\lNOqAXI.exe
  2⤵
  PID:6692
- C:\Windows\System\cOsTvFN.exe
  C:\Windows\System\cOsTvFN.exe
  2⤵
  PID:7184
- C:\Windows\System\UwSRYFt.exe
  C:\Windows\System\UwSRYFt.exe
  2⤵
  PID:7244
- C:\Windows\System\QAoEjhP.exe
  C:\Windows\System\QAoEjhP.exe
  2⤵
  PID:6972
- C:\Windows\System\bsnsqpA.exe
  C:\Windows\System\bsnsqpA.exe
  2⤵
  PID:7232
- C:\Windows\System\LbMdBzg.exe
  C:\Windows\System\LbMdBzg.exe
  2⤵
  PID:7308
- C:\Windows\System\OYSpBIJ.exe
  C:\Windows\System\OYSpBIJ.exe
  2⤵
  PID:7260
- C:\Windows\System\PqsLmFs.exe
  C:\Windows\System\PqsLmFs.exe
  2⤵
  PID:7324
- C:\Windows\System\vXvyryP.exe
  C:\Windows\System\vXvyryP.exe
  2⤵
  PID:7364
- C:\Windows\System\JprVkyV.exe
  C:\Windows\System\JprVkyV.exe
  2⤵
  PID:7428
- C:\Windows\System\dTvRgCS.exe
  C:\Windows\System\dTvRgCS.exe
  2⤵
  PID:7376
- C:\Windows\System\DydKkeX.exe
  C:\Windows\System\DydKkeX.exe
  2⤵
  PID:7448
- C:\Windows\System\iIJbKtm.exe
  C:\Windows\System\iIJbKtm.exe
  2⤵
  PID:7496
- C:\Windows\System\VGxCGYy.exe
  C:\Windows\System\VGxCGYy.exe
  2⤵
  PID:7452
- C:\Windows\System\bXVFNMu.exe
  C:\Windows\System\bXVFNMu.exe
  2⤵
  PID:7548
- C:\Windows\System\CggVKCS.exe
  C:\Windows\System\CggVKCS.exe
  2⤵
  PID:7584
- C:\Windows\System\jFzpfGq.exe
  C:\Windows\System\jFzpfGq.exe
  2⤵
  PID:7604
- C:\Windows\System\UsRWmkA.exe
  C:\Windows\System\UsRWmkA.exe
  2⤵
  PID:7684
- C:\Windows\System\kuctjCV.exe
  C:\Windows\System\kuctjCV.exe
  2⤵
  PID:7720
- C:\Windows\System\zWbijtM.exe
  C:\Windows\System\zWbijtM.exe
  2⤵
  PID:7632
- C:\Windows\System\uvgwZPb.exe
  C:\Windows\System\uvgwZPb.exe
  2⤵
  PID:7636
- C:\Windows\System\jwRLMah.exe
  C:\Windows\System\jwRLMah.exe
  2⤵
  PID:7696
- C:\Windows\System\aWEznxj.exe
  C:\Windows\System\aWEznxj.exe
  2⤵
  PID:7768
- C:\Windows\System\OKYveDE.exe
  C:\Windows\System\OKYveDE.exe
  2⤵
  PID:7820
- C:\Windows\System\gitTtpx.exe
  C:\Windows\System\gitTtpx.exe
  2⤵
  PID:7884
- C:\Windows\System\hoDEmRs.exe
  C:\Windows\System\hoDEmRs.exe
  2⤵
  PID:7836
- C:\Windows\System\coYZulP.exe
  C:\Windows\System\coYZulP.exe
  2⤵
  PID:7932
- C:\Windows\System\gLFoPtR.exe
  C:\Windows\System\gLFoPtR.exe
  2⤵
  PID:7996
- C:\Windows\System\rDeJSLg.exe
  C:\Windows\System\rDeJSLg.exe
  2⤵
  PID:8064
- C:\Windows\System\UJfDtsA.exe
  C:\Windows\System\UJfDtsA.exe
  2⤵
  PID:8100
- C:\Windows\System\qLbnNku.exe
  C:\Windows\System\qLbnNku.exe
  2⤵
  PID:1744
- C:\Windows\System\XYVxzNx.exe
  C:\Windows\System\XYVxzNx.exe
  2⤵
  PID:7216
- C:\Windows\System\BrYixxo.exe
  C:\Windows\System\BrYixxo.exe
  2⤵
  PID:7344
- C:\Windows\System\xagDuGR.exe
  C:\Windows\System\xagDuGR.exe
  2⤵
  PID:7464
- C:\Windows\System\YtTscEd.exe
  C:\Windows\System\YtTscEd.exe
  2⤵
  PID:7544
- C:\Windows\System\MlAQCaH.exe
  C:\Windows\System\MlAQCaH.exe
  2⤵
  PID:7616
- C:\Windows\System\EFVXtiG.exe
  C:\Windows\System\EFVXtiG.exe
  2⤵
  PID:7764
- C:\Windows\System\jJlPRtB.exe
  C:\Windows\System\jJlPRtB.exe
  2⤵
  PID:7928
- C:\Windows\System\CFdpIgh.exe
  C:\Windows\System\CFdpIgh.exe
  2⤵
  PID:8132
- C:\Windows\System\NpXKPGz.exe
  C:\Windows\System\NpXKPGz.exe
  2⤵
  PID:7296
- C:\Windows\System\YvvTtmD.exe
  C:\Windows\System\YvvTtmD.exe
  2⤵
  PID:7944
- C:\Windows\System\bURKXyj.exe
  C:\Windows\System\bURKXyj.exe
  2⤵
  PID:7280
- C:\Windows\System\LxZMOQT.exe
  C:\Windows\System\LxZMOQT.exe
  2⤵
  PID:8044
- C:\Windows\System\FFBDfFY.exe
  C:\Windows\System\FFBDfFY.exe
  2⤵
  PID:8112
- C:\Windows\System\cMQXqBZ.exe
  C:\Windows\System\cMQXqBZ.exe
  2⤵
  PID:8176
- C:\Windows\System\DqSLBFx.exe
  C:\Windows\System\DqSLBFx.exe
  2⤵
  PID:7200
- C:\Windows\System\ZkgkFPN.exe
  C:\Windows\System\ZkgkFPN.exe
  2⤵
  PID:7412
- C:\Windows\System\MXRSgUo.exe
  C:\Windows\System\MXRSgUo.exe
  2⤵
  PID:7580
- C:\Windows\System\URUKtck.exe
  C:\Windows\System\URUKtck.exe
  2⤵
  PID:7748
- C:\Windows\System\IXcZpFS.exe
  C:\Windows\System\IXcZpFS.exe
  2⤵
  PID:7804
- C:\Windows\System\GetVtMH.exe
  C:\Windows\System\GetVtMH.exe
  2⤵
  PID:7968
- C:\Windows\System\kzQrUvE.exe
  C:\Windows\System\kzQrUvE.exe
  2⤵
  PID:7340
- C:\Windows\System\DXTqysg.exe
  C:\Windows\System\DXTqysg.exe
  2⤵
  PID:7600
- C:\Windows\System\lCuqbIN.exe
  C:\Windows\System\lCuqbIN.exe
  2⤵
  PID:8000
- C:\Windows\System\MTOCthg.exe
  C:\Windows\System\MTOCthg.exe
  2⤵
  PID:7276
- C:\Windows\System\vSXIXIG.exe
  C:\Windows\System\vSXIXIG.exe
  2⤵
  PID:8164
- C:\Windows\System\KZhwljc.exe
  C:\Windows\System\KZhwljc.exe
  2⤵
  PID:7892
- C:\Windows\System\EVqyrUW.exe
  C:\Windows\System\EVqyrUW.exe
  2⤵
  PID:7516
- C:\Windows\System\RHmmvpQ.exe
  C:\Windows\System\RHmmvpQ.exe
  2⤵
  PID:8200
- C:\Windows\System\AGsMpon.exe
  C:\Windows\System\AGsMpon.exe
  2⤵
  PID:8220
- C:\Windows\System\WLFFrPy.exe
  C:\Windows\System\WLFFrPy.exe
  2⤵
  PID:8240
- C:\Windows\System\QqEcGUx.exe
  C:\Windows\System\QqEcGUx.exe
  2⤵
  PID:8256
- C:\Windows\System\oISLJLE.exe
  C:\Windows\System\oISLJLE.exe
  2⤵
  PID:8272
- C:\Windows\System\uTBTcMy.exe
  C:\Windows\System\uTBTcMy.exe
  2⤵
  PID:8292
- C:\Windows\System\xqeGXtm.exe
  C:\Windows\System\xqeGXtm.exe
  2⤵
  PID:8308
- C:\Windows\System\rLJgIlx.exe
  C:\Windows\System\rLJgIlx.exe
  2⤵
  PID:8324
- C:\Windows\System\NthtWmv.exe
  C:\Windows\System\NthtWmv.exe
  2⤵
  PID:8340
- C:\Windows\System\XNCPOWR.exe
  C:\Windows\System\XNCPOWR.exe
  2⤵
  PID:8356
- C:\Windows\System\UGXdnoD.exe
  C:\Windows\System\UGXdnoD.exe
  2⤵
  PID:8372
- C:\Windows\System\VjYAefb.exe
  C:\Windows\System\VjYAefb.exe
  2⤵
  PID:8392
- C:\Windows\System\ieVMGxU.exe
  C:\Windows\System\ieVMGxU.exe
  2⤵
  PID:8408
- C:\Windows\System\Btspekv.exe
  C:\Windows\System\Btspekv.exe
  2⤵
  PID:8424
- C:\Windows\System\PUyUTiN.exe
  C:\Windows\System\PUyUTiN.exe
  2⤵
  PID:8444
- C:\Windows\System\CrguZDk.exe
  C:\Windows\System\CrguZDk.exe
  2⤵
  PID:8468
- C:\Windows\System\TfcxYWF.exe
  C:\Windows\System\TfcxYWF.exe
  2⤵
  PID:8484
- C:\Windows\System\zwCAhQn.exe
  C:\Windows\System\zwCAhQn.exe
  2⤵
  PID:8500
- C:\Windows\System\yLXZvUB.exe
  C:\Windows\System\yLXZvUB.exe
  2⤵
  PID:8516
- C:\Windows\System\qbINwOs.exe
  C:\Windows\System\qbINwOs.exe
  2⤵
  PID:8532
- C:\Windows\System\XlnIkzn.exe
  C:\Windows\System\XlnIkzn.exe
  2⤵
  PID:8552
- C:\Windows\System\FvRfgIp.exe
  C:\Windows\System\FvRfgIp.exe
  2⤵
  PID:8576
- C:\Windows\System\WNmtzty.exe
  C:\Windows\System\WNmtzty.exe
  2⤵
  PID:8592
- C:\Windows\System\DAXzOpO.exe
  C:\Windows\System\DAXzOpO.exe
  2⤵
  PID:8608
- C:\Windows\System\uWFJVbn.exe
  C:\Windows\System\uWFJVbn.exe
  2⤵
  PID:8624
- C:\Windows\System\GeGsEWZ.exe
  C:\Windows\System\GeGsEWZ.exe
  2⤵
  PID:8644
- C:\Windows\System\GxkUgmn.exe
  C:\Windows\System\GxkUgmn.exe
  2⤵
  PID:8664
- C:\Windows\System\ZWCXExH.exe
  C:\Windows\System\ZWCXExH.exe
  2⤵
  PID:8680
- C:\Windows\System\nuxOvPe.exe
  C:\Windows\System\nuxOvPe.exe
  2⤵
  PID:8700
- C:\Windows\System\bjjmPoI.exe
  C:\Windows\System\bjjmPoI.exe
  2⤵
  PID:8716
- C:\Windows\System\drSjBMr.exe
  C:\Windows\System\drSjBMr.exe
  2⤵
  PID:8732
- C:\Windows\System\NhwilJB.exe
  C:\Windows\System\NhwilJB.exe
  2⤵
  PID:8752
- C:\Windows\System\pIYBfaM.exe
  C:\Windows\System\pIYBfaM.exe
  2⤵
  PID:8768
- C:\Windows\System\tGkiQBd.exe
  C:\Windows\System\tGkiQBd.exe
  2⤵
  PID:8784
- C:\Windows\System\JEGUksH.exe
  C:\Windows\System\JEGUksH.exe
  2⤵
  PID:8804
- C:\Windows\System\BkqjEIH.exe
  C:\Windows\System\BkqjEIH.exe
  2⤵
  PID:8820
- C:\Windows\System\QjIoASP.exe
  C:\Windows\System\QjIoASP.exe
  2⤵
  PID:8840
- C:\Windows\System\LubsVHY.exe
  C:\Windows\System\LubsVHY.exe
  2⤵
  PID:8856
- C:\Windows\System\BCvPQjv.exe
  C:\Windows\System\BCvPQjv.exe
  2⤵
  PID:8872
- C:\Windows\System\SRoWLlg.exe
  C:\Windows\System\SRoWLlg.exe
  2⤵
  PID:8892
- C:\Windows\System\GzEIkHR.exe
  C:\Windows\System\GzEIkHR.exe
  2⤵
  PID:8908
- C:\Windows\System\xDAzcpJ.exe
  C:\Windows\System\xDAzcpJ.exe
  2⤵
  PID:8932
- C:\Windows\System\FXCuDqa.exe
  C:\Windows\System\FXCuDqa.exe
  2⤵
  PID:8952
- C:\Windows\System\AooTupw.exe
  C:\Windows\System\AooTupw.exe
  2⤵
  PID:8968
- C:\Windows\System\CgSuONS.exe
  C:\Windows\System\CgSuONS.exe
  2⤵
  PID:8984
- C:\Windows\System\TCQMFvE.exe
  C:\Windows\System\TCQMFvE.exe
  2⤵
  PID:9000
- C:\Windows\System\FakEivn.exe
  C:\Windows\System\FakEivn.exe
  2⤵
  PID:9016
- C:\Windows\System\oVvRJwI.exe
  C:\Windows\System\oVvRJwI.exe
  2⤵
  PID:9032
- C:\Windows\System\ZwFJbZD.exe
  C:\Windows\System\ZwFJbZD.exe
  2⤵
  PID:9048
- C:\Windows\System\hXfMlQG.exe
  C:\Windows\System\hXfMlQG.exe
  2⤵
  PID:9064
- C:\Windows\System\yAkyyvr.exe
  C:\Windows\System\yAkyyvr.exe
  2⤵
  PID:9084
- C:\Windows\System\WsPGZBV.exe
  C:\Windows\System\WsPGZBV.exe
  2⤵
  PID:9100
- C:\Windows\System\vgUMOZV.exe
  C:\Windows\System\vgUMOZV.exe
  2⤵
  PID:9120
- C:\Windows\System\SNGtyPQ.exe
  C:\Windows\System\SNGtyPQ.exe
  2⤵
  PID:9136
- C:\Windows\System\GlhTdPY.exe
  C:\Windows\System\GlhTdPY.exe
  2⤵
  PID:9152
- C:\Windows\System\NFgmpsw.exe
  C:\Windows\System\NFgmpsw.exe
  2⤵
  PID:9168
- C:\Windows\System\xnkMlnk.exe
  C:\Windows\System\xnkMlnk.exe
  2⤵
  PID:9184
- C:\Windows\System\dJxtgvd.exe
  C:\Windows\System\dJxtgvd.exe
  2⤵
  PID:9200
- C:\Windows\System\zdnjafW.exe
  C:\Windows\System\zdnjafW.exe
  2⤵
  PID:7872
- C:\Windows\System\ebuQyTI.exe
  C:\Windows\System\ebuQyTI.exe
  2⤵
  PID:7980
- C:\Windows\System\BTbjSTB.exe
  C:\Windows\System\BTbjSTB.exe
  2⤵
  PID:8084
- C:\Windows\System\FcwGbyV.exe
  C:\Windows\System\FcwGbyV.exe
  2⤵
  PID:7700
- C:\Windows\System\Nnngvcd.exe
  C:\Windows\System\Nnngvcd.exe
  2⤵
  PID:7788
- C:\Windows\System\ASTMDBI.exe
  C:\Windows\System\ASTMDBI.exe
  2⤵
  PID:7484
- C:\Windows\System\RLWzFGp.exe
  C:\Windows\System\RLWzFGp.exe
  2⤵
  PID:7652
- C:\Windows\System\ZMmRLdY.exe
  C:\Windows\System\ZMmRLdY.exe
  2⤵
  PID:8284
- C:\Windows\System\aFApETF.exe
  C:\Windows\System\aFApETF.exe
  2⤵
  PID:8228
- C:\Windows\System\yiILvtz.exe
  C:\Windows\System\yiILvtz.exe
  2⤵
  PID:8332
- C:\Windows\System\sFpQTsR.exe
  C:\Windows\System\sFpQTsR.exe
  2⤵
  PID:8236
- C:\Windows\System\toHoBqB.exe
  C:\Windows\System\toHoBqB.exe
  2⤵
  PID:8300
- C:\Windows\System\oQQhqra.exe
  C:\Windows\System\oQQhqra.exe
  2⤵
  PID:8384
- C:\Windows\System\ybgPkLs.exe
  C:\Windows\System\ybgPkLs.exe
  2⤵
  PID:8380
- C:\Windows\System\TXzFcHL.exe
  C:\Windows\System\TXzFcHL.exe
  2⤵
  PID:8452
- C:\Windows\System\OJGCvgr.exe
  C:\Windows\System\OJGCvgr.exe
  2⤵
  PID:8492
- C:\Windows\System\mtVXGVg.exe
  C:\Windows\System\mtVXGVg.exe
  2⤵
  PID:8548
- C:\Windows\System\NsvdeDv.exe
  C:\Windows\System\NsvdeDv.exe
  2⤵
  PID:8508
- C:\Windows\System\yFHbBTr.exe
  C:\Windows\System\yFHbBTr.exe
  2⤵
  PID:8780
- C:\Windows\System\hznzdbG.exe
  C:\Windows\System\hznzdbG.exe
  2⤵
  PID:8800
- C:\Windows\System\dcIMvNv.exe
  C:\Windows\System\dcIMvNv.exe
  2⤵
  PID:8868
- C:\Windows\System\vcrXIaa.exe
  C:\Windows\System\vcrXIaa.exe
  2⤵
  PID:8940
- C:\Windows\System\cgIMpPx.exe
  C:\Windows\System\cgIMpPx.exe
  2⤵
  PID:8916
- C:\Windows\System\HeQPkcP.exe
  C:\Windows\System\HeQPkcP.exe
  2⤵
  PID:9008
- C:\Windows\System\GlVEGlq.exe
  C:\Windows\System\GlVEGlq.exe
  2⤵
  PID:9072
- C:\Windows\System\qfjXpYK.exe
  C:\Windows\System\qfjXpYK.exe
  2⤵
  PID:9056
- C:\Windows\System\jDvospD.exe
  C:\Windows\System\jDvospD.exe
  2⤵
  PID:9208
- C:\Windows\System\DBOvaXp.exe
  C:\Windows\System\DBOvaXp.exe
  2⤵
  PID:8080
- C:\Windows\System\TgzMvIb.exe
  C:\Windows\System\TgzMvIb.exe
  2⤵
  PID:9196
- C:\Windows\System\OlpMFjn.exe
  C:\Windows\System\OlpMFjn.exe
  2⤵
  PID:8280
- C:\Windows\System\nIxfTvX.exe
  C:\Windows\System\nIxfTvX.exe
  2⤵
  PID:8320
- C:\Windows\System\NmdrIdF.exe
  C:\Windows\System\NmdrIdF.exe
  2⤵
  PID:7680
- C:\Windows\System\iOVQtDW.exe
  C:\Windows\System\iOVQtDW.exe
  2⤵
  PID:8496
- C:\Windows\System\iqZBjni.exe
  C:\Windows\System\iqZBjni.exe
  2⤵
  PID:8560
- C:\Windows\System\cFQdCKM.exe
  C:\Windows\System\cFQdCKM.exe
  2⤵
  PID:8252
- C:\Windows\System\HCdQlgW.exe
  C:\Windows\System\HCdQlgW.exe
  2⤵
  PID:8440
- C:\Windows\System\NCByBjq.exe
  C:\Windows\System\NCByBjq.exe
  2⤵
  PID:8432
- C:\Windows\System\pFOGCEN.exe
  C:\Windows\System\pFOGCEN.exe
  2⤵
  PID:8540
- C:\Windows\System\oGrjVfF.exe
  C:\Windows\System\oGrjVfF.exe
  2⤵
  PID:8600
- C:\Windows\System\GFnRLnc.exe
  C:\Windows\System\GFnRLnc.exe
  2⤵
  PID:8588
- C:\Windows\System\sfLlPoy.exe
  C:\Windows\System\sfLlPoy.exe
  2⤵
  PID:8656
- C:\Windows\System\stNqTzY.exe
  C:\Windows\System\stNqTzY.exe
  2⤵
  PID:8676
- C:\Windows\System\OPyVgiM.exe
  C:\Windows\System\OPyVgiM.exe
  2⤵
  PID:8712
- C:\Windows\System\FdgGmYP.exe
  C:\Windows\System\FdgGmYP.exe
  2⤵
  PID:8748
- C:\Windows\System\rHZsbkX.exe
  C:\Windows\System\rHZsbkX.exe
  2⤵
  PID:8764
- C:\Windows\System\LfVUyeD.exe
  C:\Windows\System\LfVUyeD.exe
  2⤵
  PID:8796
- C:\Windows\System\uOYXolz.exe
  C:\Windows\System\uOYXolz.exe
  2⤵
  PID:8836
- C:\Windows\System\aNmrIem.exe
  C:\Windows\System\aNmrIem.exe
  2⤵
  PID:8864
- C:\Windows\System\CWcWTMh.exe
  C:\Windows\System\CWcWTMh.exe
  2⤵
  PID:9040
- C:\Windows\System\rEnpTFZ.exe
  C:\Windows\System\rEnpTFZ.exe
  2⤵
  PID:8976
- C:\Windows\System\qCEQOMC.exe
  C:\Windows\System\qCEQOMC.exe
  2⤵
  PID:9108
- C:\Windows\System\EUMNnEZ.exe
  C:\Windows\System\EUMNnEZ.exe
  2⤵
  PID:8996
- C:\Windows\System\oSjUgIg.exe
  C:\Windows\System\oSjUgIg.exe
  2⤵
  PID:8568
- C:\Windows\System\iTHhCYE.exe
  C:\Windows\System\iTHhCYE.exe
  2⤵
  PID:8616
- C:\Windows\System\okhJQlH.exe
  C:\Windows\System\okhJQlH.exe
  2⤵
  PID:7840
- C:\Windows\System\ttCFZpX.exe
  C:\Windows\System\ttCFZpX.exe
  2⤵
  PID:7528
- C:\Windows\System\dglxYfg.exe
  C:\Windows\System\dglxYfg.exe
  2⤵
  PID:8416
- C:\Windows\System\KsTngVD.exe
  C:\Windows\System\KsTngVD.exe
  2⤵
  PID:8404
- C:\Windows\System\hHyNhGh.exe
  C:\Windows\System\hHyNhGh.exe
  2⤵
  PID:7196
- C:\Windows\System\rNSvJJE.exe
  C:\Windows\System\rNSvJJE.exe
  2⤵
  PID:8792
- C:\Windows\System\ymyPZJm.exe
  C:\Windows\System\ymyPZJm.exe
  2⤵
  PID:8696
- C:\Windows\System\ybuIOph.exe
  C:\Windows\System\ybuIOph.exe
  2⤵
  PID:8948
- C:\Windows\System\LdtWVte.exe
  C:\Windows\System\LdtWVte.exe
  2⤵
  PID:8900
- C:\Windows\System\uvfkfIs.exe
  C:\Windows\System\uvfkfIs.exe
  2⤵
  PID:9080
- C:\Windows\System\YKkBYdL.exe
  C:\Windows\System\YKkBYdL.exe
  2⤵
  PID:9128
- C:\Windows\System\qqRceuz.exe
  C:\Windows\System\qqRceuz.exe
  2⤵
  PID:9164
- C:\Windows\System\mSeRSnN.exe
  C:\Windows\System\mSeRSnN.exe
  2⤵
  PID:8368
- C:\Windows\System\WMAcOld.exe
  C:\Windows\System\WMAcOld.exe
  2⤵
  PID:8212
- C:\Windows\System\KTheNde.exe
  C:\Windows\System\KTheNde.exe
  2⤵
  PID:8728
- C:\Windows\System\QeeVRFW.exe
  C:\Windows\System\QeeVRFW.exe
  2⤵
  PID:8216
- C:\Windows\System\Pngbvjr.exe
  C:\Windows\System\Pngbvjr.exe
  2⤵
  PID:9116
- C:\Windows\System\qbHyPPB.exe
  C:\Windows\System\qbHyPPB.exe
  2⤵
  PID:8268
- C:\Windows\System\CjPZjeK.exe
  C:\Windows\System\CjPZjeK.exe
  2⤵
  PID:8148
- C:\Windows\System\ejsBtDD.exe
  C:\Windows\System\ejsBtDD.exe
  2⤵
  PID:9220
- C:\Windows\System\EvaBzvV.exe
  C:\Windows\System\EvaBzvV.exe
  2⤵
  PID:9236
- C:\Windows\System\eSvTLfx.exe
  C:\Windows\System\eSvTLfx.exe
  2⤵
  PID:9252
- C:\Windows\System\dDODxkr.exe
  C:\Windows\System\dDODxkr.exe
  2⤵
  PID:9268
- C:\Windows\System\BHPCWqV.exe
  C:\Windows\System\BHPCWqV.exe
  2⤵
  PID:9284
- C:\Windows\System\AHdnWnf.exe
  C:\Windows\System\AHdnWnf.exe
  2⤵
  PID:9300
- C:\Windows\System\KYKyTvH.exe
  C:\Windows\System\KYKyTvH.exe
  2⤵
  PID:9324
- C:\Windows\System\baHhnAJ.exe
  C:\Windows\System\baHhnAJ.exe
  2⤵
  PID:9340
- C:\Windows\System\TrlsfKD.exe
  C:\Windows\System\TrlsfKD.exe
  2⤵
  PID:9356
- C:\Windows\System\CfxnmOE.exe
  C:\Windows\System\CfxnmOE.exe
  2⤵
  PID:9372
- C:\Windows\System\rGZfhOe.exe
  C:\Windows\System\rGZfhOe.exe
  2⤵
  PID:9388
- C:\Windows\System\mBFTfYr.exe
  C:\Windows\System\mBFTfYr.exe
  2⤵
  PID:9404
- C:\Windows\System\AZvdCjU.exe
  C:\Windows\System\AZvdCjU.exe
  2⤵
  PID:9420
- C:\Windows\System\CsvpCyq.exe
  C:\Windows\System\CsvpCyq.exe
  2⤵
  PID:9436
- C:\Windows\System\zbISlKh.exe
  C:\Windows\System\zbISlKh.exe
  2⤵
  PID:9452
- C:\Windows\System\qzhwkwv.exe
  C:\Windows\System\qzhwkwv.exe
  2⤵
  PID:9468
- C:\Windows\System\QXkYCFS.exe
  C:\Windows\System\QXkYCFS.exe
  2⤵
  PID:9484
- C:\Windows\System\ggTZucy.exe
  C:\Windows\System\ggTZucy.exe
  2⤵
  PID:9500
- C:\Windows\System\nzFGBVS.exe
  C:\Windows\System\nzFGBVS.exe
  2⤵
  PID:9516
- C:\Windows\System\nAPlPqZ.exe
  C:\Windows\System\nAPlPqZ.exe
  2⤵
  PID:9532
- C:\Windows\System\yNNvhSg.exe
  C:\Windows\System\yNNvhSg.exe
  2⤵
  PID:9548
- C:\Windows\System\dfkQpPP.exe
  C:\Windows\System\dfkQpPP.exe
  2⤵
  PID:9564
- C:\Windows\System\QdqmORI.exe
  C:\Windows\System\QdqmORI.exe
  2⤵
  PID:9580
- C:\Windows\System\HfiojhM.exe
  C:\Windows\System\HfiojhM.exe
  2⤵
  PID:9596
- C:\Windows\System\JwMLTCX.exe
  C:\Windows\System\JwMLTCX.exe
  2⤵
  PID:9612
- C:\Windows\System\mQjFajW.exe
  C:\Windows\System\mQjFajW.exe
  2⤵
  PID:9628
- C:\Windows\System\lzHRnQI.exe
  C:\Windows\System\lzHRnQI.exe
  2⤵
  PID:9644
- C:\Windows\System\DisIEeG.exe
  C:\Windows\System\DisIEeG.exe
  2⤵
  PID:9660
- C:\Windows\System\mtJaBgw.exe
  C:\Windows\System\mtJaBgw.exe
  2⤵
  PID:9676
- C:\Windows\System\NiVAncL.exe
  C:\Windows\System\NiVAncL.exe
  2⤵
  PID:9692
- C:\Windows\System\jvkNLWv.exe
  C:\Windows\System\jvkNLWv.exe
  2⤵
  PID:9708
- C:\Windows\System\GXgqlRf.exe
  C:\Windows\System\GXgqlRf.exe
  2⤵
  PID:9732
- C:\Windows\System\CbywfPT.exe
  C:\Windows\System\CbywfPT.exe
  2⤵
  PID:9748
- C:\Windows\System\JqdPDjY.exe
  C:\Windows\System\JqdPDjY.exe
  2⤵
  PID:9764
- C:\Windows\System\tmUjnFc.exe
  C:\Windows\System\tmUjnFc.exe
  2⤵
  PID:9780
- C:\Windows\System\DJefWRZ.exe
  C:\Windows\System\DJefWRZ.exe
  2⤵
  PID:9796
- C:\Windows\System\IFXoDsg.exe
  C:\Windows\System\IFXoDsg.exe
  2⤵
  PID:9812
- C:\Windows\System\weTpMfW.exe
  C:\Windows\System\weTpMfW.exe
  2⤵
  PID:9828
- C:\Windows\System\AvZonka.exe
  C:\Windows\System\AvZonka.exe
  2⤵
  PID:9844
- C:\Windows\System\UXXvKIb.exe
  C:\Windows\System\UXXvKIb.exe
  2⤵
  PID:9860
- C:\Windows\System\gKYSLsW.exe
  C:\Windows\System\gKYSLsW.exe
  2⤵
  PID:9876
- C:\Windows\System\iwmesxZ.exe
  C:\Windows\System\iwmesxZ.exe
  2⤵
  PID:9892
- C:\Windows\System\swckMgM.exe
  C:\Windows\System\swckMgM.exe
  2⤵
  PID:9908
- C:\Windows\System\SgCKOhq.exe
  C:\Windows\System\SgCKOhq.exe
  2⤵
  PID:9924
- C:\Windows\System\zcPBtiD.exe
  C:\Windows\System\zcPBtiD.exe
  2⤵
  PID:9940
- C:\Windows\System\yGzclst.exe
  C:\Windows\System\yGzclst.exe
  2⤵
  PID:9956
- C:\Windows\System\BieKQjP.exe
  C:\Windows\System\BieKQjP.exe
  2⤵
  PID:9972
- C:\Windows\System\zIXRhIY.exe
  C:\Windows\System\zIXRhIY.exe
  2⤵
  PID:9988
- C:\Windows\System\hBefoYd.exe
  C:\Windows\System\hBefoYd.exe
  2⤵
  PID:10004
- C:\Windows\System\AOqCrAE.exe
  C:\Windows\System\AOqCrAE.exe
  2⤵
  PID:10020
- C:\Windows\System\ujRDLzi.exe
  C:\Windows\System\ujRDLzi.exe
  2⤵
  PID:10036
- C:\Windows\System\FlqaZnt.exe
  C:\Windows\System\FlqaZnt.exe
  2⤵
  PID:10052
- C:\Windows\System\wBErKTZ.exe
  C:\Windows\System\wBErKTZ.exe
  2⤵
  PID:10068
- C:\Windows\System\GFiStrh.exe
  C:\Windows\System\GFiStrh.exe
  2⤵
  PID:10084
- C:\Windows\System\PpmgYPL.exe
  C:\Windows\System\PpmgYPL.exe
  2⤵
  PID:10100
- C:\Windows\System\kKXwsPf.exe
  C:\Windows\System\kKXwsPf.exe
  2⤵
  PID:10116
- C:\Windows\System\TTnOmcg.exe
  C:\Windows\System\TTnOmcg.exe
  2⤵
  PID:10132
- C:\Windows\System\LpGLPhY.exe
  C:\Windows\System\LpGLPhY.exe
  2⤵
  PID:10148
- C:\Windows\System\ohbkKDD.exe
  C:\Windows\System\ohbkKDD.exe
  2⤵
  PID:10164
- C:\Windows\System\VctbDSZ.exe
  C:\Windows\System\VctbDSZ.exe
  2⤵
  PID:10180
- C:\Windows\System\hWKgZCb.exe
  C:\Windows\System\hWKgZCb.exe
  2⤵
  PID:10196
- C:\Windows\System\zOdRVDK.exe
  C:\Windows\System\zOdRVDK.exe
  2⤵
  PID:10212
- C:\Windows\System\LVkIZPF.exe
  C:\Windows\System\LVkIZPF.exe
  2⤵
  PID:10228
- C:\Windows\System\DwXmoNr.exe
  C:\Windows\System\DwXmoNr.exe
  2⤵
  PID:9232
- C:\Windows\System\kejSaQM.exe
  C:\Windows\System\kejSaQM.exe
  2⤵
  PID:8980
- C:\Windows\System\hUrvFLF.exe
  C:\Windows\System\hUrvFLF.exe
  2⤵
  PID:9148
- C:\Windows\System\BGbNIUz.exe
  C:\Windows\System\BGbNIUz.exe
  2⤵
  PID:8812
- C:\Windows\System\kZWkAlh.exe
  C:\Windows\System\kZWkAlh.exe
  2⤵
  PID:8572
- C:\Windows\System\kzMCTPq.exe
  C:\Windows\System\kzMCTPq.exe
  2⤵
  PID:8888
- C:\Windows\System\LQhkUzk.exe
  C:\Windows\System\LQhkUzk.exe
  2⤵
  PID:9248
- C:\Windows\System\xkAPoVy.exe
  C:\Windows\System\xkAPoVy.exe
  2⤵
  PID:9276
- C:\Windows\System\JwDoDQg.exe
  C:\Windows\System\JwDoDQg.exe
  2⤵
  PID:9320
- C:\Windows\System\DUGTcRe.exe
  C:\Windows\System\DUGTcRe.exe
  2⤵
  PID:9368
- C:\Windows\System\aFAgRLB.exe
  C:\Windows\System\aFAgRLB.exe
  2⤵
  PID:9432
- C:\Windows\System\TfKJtMo.exe
  C:\Windows\System\TfKJtMo.exe
  2⤵
  PID:9380
- C:\Windows\System\EcxxvfP.exe
  C:\Windows\System\EcxxvfP.exe
  2⤵
  PID:9384
- C:\Windows\System\iCAQCZs.exe
  C:\Windows\System\iCAQCZs.exe
  2⤵
  PID:9416
- C:\Windows\System\DMNhTmM.exe
  C:\Windows\System\DMNhTmM.exe
  2⤵
  PID:9508
- C:\Windows\System\bwQGhRn.exe
  C:\Windows\System\bwQGhRn.exe
  2⤵
  PID:9544
- C:\Windows\System\fsNkboL.exe
  C:\Windows\System\fsNkboL.exe
  2⤵
  PID:9588
- C:\Windows\System\XlVbsuT.exe
  C:\Windows\System\XlVbsuT.exe
  2⤵
  PID:9620
- C:\Windows\System\MpdivJp.exe
  C:\Windows\System\MpdivJp.exe
  2⤵
  PID:9688
- C:\Windows\System\QLEUDTB.exe
  C:\Windows\System\QLEUDTB.exe
  2⤵
  PID:9604
- C:\Windows\System\MiflrEE.exe
  C:\Windows\System\MiflrEE.exe
  2⤵
  PID:9672
- C:\Windows\System\NoGGoUM.exe
  C:\Windows\System\NoGGoUM.exe
  2⤵
  PID:9744
- C:\Windows\System\uEfHHbl.exe
  C:\Windows\System\uEfHHbl.exe
  2⤵
  PID:9820
- C:\Windows\System\PRsaabu.exe
  C:\Windows\System\PRsaabu.exe
  2⤵
  PID:9852
- C:\Windows\System\cYuxgtu.exe
  C:\Windows\System\cYuxgtu.exe
  2⤵
  PID:9772

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\BPJWvah.exe

Filesize
1.9MB

MD5
e544b1c1b8aa9f259ff3600621b5bbaa

SHA1
ab35f2fa508833417a4b2173364e70694891f916

SHA256
11c571bd55275cc24530c1dca5bac7f18c2dc4ee626973bca567c8c1ef008f70

SHA512
b94c4d3eb305b88182c4b2e65053ae114c15a4f8b68f4695f168e0ab3bf78d8a5bce4718a0ae1ed88ecbd66241dc744263a3d8f19a66d225793fc34e1b702729

Download Submit
C:\Windows\system\CpTvsWB.exe

Filesize
1.9MB

MD5
a08105cf4562f725b3cc4613aa48d63c

SHA1
9ebd6cab4f1fc638274b2da7acc20bb62ef225c9

SHA256
70aaa73b5d3b136112a72676a6658308d8010a85013ac3d71db7986385c057a3

SHA512
ca49d6852b83625f1c684b3079683a44319dfb821fb8863e135a9e9cd23fc959eb6aaa89bbb6f1eae30b2f39ad87288c56ef12c713761f7c424b6e89cc62326b

Download Submit
C:\Windows\system\GZkkHKI.exe

Filesize
1.9MB

MD5
58a3dc9b16488be4058bfb4b038f9788

SHA1
d7e3211977d97acc463638091a8712941503534b

SHA256
6d73a15d6c51c651c9587a8b1aa047e2303e7a30ec7cacecdc968fec6e7085cc

SHA512
f840a889e2922a372b9e296cb358325791465cc056084296ff2bafc1486ef44c7c841708e773f379fe42ee9fae693d31fc691c25ccb9b144d3ff0c1ff0e91402

Download Submit
C:\Windows\system\GZoUCDh.exe

Filesize
1.9MB

MD5
027a8580b7c02da73b092a511d3e8750

SHA1
537950cc020c994d8fc2ad64183ab06b84d71520

SHA256
688d441bad9cd6e75922716823764d5ddb622e50b170cd0227ea902829e62a9d

SHA512
1f62ad071a93e5a104939485fae1b3dcbb726eda6a907c9e49dd7f72a221e7129552f5bdf6f2d4fb0613a6db35c543cffab581d2f1c1a96254ba4be1af8cc93f

Download Submit
C:\Windows\system\GnewdnS.exe

Filesize
1.9MB

MD5
d00c8e420039a67bff45576c819bc737

SHA1
e1094386bf7e43c960e1736a59889b91e146b515

SHA256
e26dbb04ba81e2f64b807f704c8d84beebaa28f99e7c3bee24219894eca14864

SHA512
60a7b48c16f4e1bbb14de37f354592413ba96866423980a3c652092d35957ce7d899632844aa0ed0abb95fc6688d1102c264d0cda6b00309483e7701167cf5da

Download Submit
C:\Windows\system\KCRtGCz.exe

Filesize
1.9MB

MD5
544b713a7cd9d3a513e188a2d4f61ae8

SHA1
e05af86f110f5f40fb78a12376a12a65e4a8592c

SHA256
949c0948d578efca3635cbfada56fb9bb0c020ef1a8ecf7d3f95ac52155c881b

SHA512
9babd9e35ee4e587c88c4ac00c66aa62735d48361530830d8d0d99cae842f0d648d815ccea506fafc12b2b8055cf36fa7b7af080166edd437c7a8174031fdb3b

Download Submit
C:\Windows\system\MunioHj.exe

Filesize
1.9MB

MD5
ecd2e8315a7a31b4d599f97e0cb3cd52

SHA1
4448ecbe8b4990cf2d205399bed88b5a37ad1298

SHA256
cce8eb78975ed7f87e5d96b1f4dfbecac74d8fd571bd75d76b0be23020846f78

SHA512
908fd1f1f6b11d50445c28df1c13a90c44c009f686968fb270ab3e5e138815deb2494b07d54d0e608b73421b2f64720d3c720a4025d4c39c30b9e2cbc793f618

Download Submit
C:\Windows\system\PabmZYH.exe

Filesize
1.9MB

MD5
773dc1a000975c7d46b0593947b880fb

SHA1
b3d02099039352b94f45e1341817556784c01d77

SHA256
ba2e6c0669f383e8d3cb6682712cc5dd335edc757118550414118cabde4048b9

SHA512
78d4df2681cc3d64aec1f013504dd2e9957cd3e38a193efa0fb3bdd05c8aab80c1cda450c89e87b3191962afbe27c1d36519f187aee02fb6ffba7b12e8fb3326

Download Submit
C:\Windows\system\UsUWZtM.exe

Filesize
1.9MB

MD5
d9a4c7cd4d751e484a00b195ba0f5980

SHA1
209f7db58bef6429a66d5c711d33f420fc50a990

SHA256
fc58f0d8f4c53d99c474ed632741148ab0f2baca59f0f8dbcb6cb112314f10b3

SHA512
9242a4e10b0d6acb57d0f15e6a7b8e20606967e59f765ee7132abdcfdbd65f76aa2a8fe25a5c02f5c1d407aeac39b130a26efe9a9be99d376c774d90d375ee61

Download Submit
C:\Windows\system\YEgYLiy.exe

Filesize
1.9MB

MD5
9c35c03625454ae5f3967561ee176d48

SHA1
f1dcd46ca79afcfdce6f56e057f61f3c30b16094

SHA256
0313f0394888db37a176254e824132051a7e21a7bf855509549c31ec79594e8c

SHA512
9e428aa5894091e694f194d3b83a2c3853984722394a0d7ef872ec3999aadca6adb232859343bd06369a3885aae40e56e2f25d7609ddeece8fa43c9f67ef7b65

Download Submit
C:\Windows\system\ZTXyqHV.exe

Filesize
1.9MB

MD5
aeb794844bdc8cdec5ea2e4cd21f8419

SHA1
ba79cc56a47c1d22f792220a73476132619206cf

SHA256
6978880de10d7d7ccdcdc9eb2ff421d877724fa33a558fd005a8b0dcf43e6cd2

SHA512
8f75cdbca141de2996e6736d9e249bc7307169f9ae4628cc888fb6ad20f0fbe3aa0220d0a1f96806706ae2135c40e53f96f62d61809a5ff7798e8698abc0d41e

Download Submit
C:\Windows\system\aTBcAiT.exe

Filesize
1.9MB

MD5
68a5ba61998de60de35512af7f48cbe0

SHA1
31e3a3452b6ebd9965b41ae716130c582bb2bd31

SHA256
7bc151c425c1a3b3590f6972a23c8ad13615eb49c8d59fc9aa590caacdd5d709

SHA512
3244ac07c1e979d365cd705d30b2703d37c475c9f9c86672234ca2bb0852c776facb9c8e82747cb2a1cf8328e8abd7b992e311f5408f117404774673924165f9

Download Submit
C:\Windows\system\eMLxvbS.exe

Filesize
1.9MB

MD5
1fbbfc769d7469f6670716eff7eda0e7

SHA1
5b5619f05c6444b3dce2ab9a18fcfafd81bef79d

SHA256
7229ce386bf230184e26ccd4f0dd3260bdf05c7bb9797488fafebd77172a5103

SHA512
d66c1b6dea1e56f41ccf9bf38bc52940f870c09f45497fe06fec70f394efeceed6f9faa8a89ecb80d12fbb5110e61b5bf18521e38da96710f8aeeea905206caf

Download Submit
C:\Windows\system\gJGEfYO.exe

Filesize
1.9MB

MD5
a3ecf4535e958e6bb83906d9d11fa98e

SHA1
cba63f1edb5f475b64c9838bf240a111838acf58

SHA256
51ddc8b833d65a9643129ae904277fc73a96e0597a133e3ea53f616de53dc7a4

SHA512
e40b44108eb5e85b0fd0dc2299a1d2c1d7e9ad0f37c3b747678fdbb98985260f51fb8afa7dd4e3873032d4e86f48d0acd3f17be40657c00033672206ea9c054f

Download Submit
C:\Windows\system\gODaloS.exe

Filesize
1.9MB

MD5
0db8d8f3d73caafb142ed6a7e33b5b54

SHA1
77db1a4a0baf5e4c5285981a7aaf5b97c6338367

SHA256
fd204fb177b2a12181611147c7c865f0ddaad9e7c9bfef24228f7cef37a6c3b7

SHA512
00c0737bb62715f438c55721220b4b725e5772ce34a94eb192cd825445a92cb8f72207824e32dd9ed563ba4ec5bfc137d5e0836c341ef0f24a5a8ffd89fb194a

Download Submit
C:\Windows\system\kIPnlFm.exe

Filesize
1.9MB

MD5
dabe2ae363605d96002fa129323e64f2

SHA1
5fd864bdf50efcd314c41741858db576e8a3fcf2

SHA256
8e792f90598d612206fd68b9aeeac2c9b30709029dbd2b468f55f0406f13090b

SHA512
588d1296c5aeb69503159bf8bb63dd13074a5bab15fca9ce7c57390981a9c84ff0ec2c8d9ffe202e9c80d7d77855e7d6d8a45809009411a84112501538eac6aa

Download Submit
C:\Windows\system\lddKGlV.exe

Filesize
1.9MB

MD5
7e1d20bd23eee719a759acb25a62d618

SHA1
80656bd968d1850cb13e0c4ca51273182fc25ffd

SHA256
a3fcdfa8d0b9f3b14f559f4f7125ce6149710b55bd0874af96845c0578e112dd

SHA512
671e1200079f29e70e407dbc6bf6d3016d128a490bef26b92f9d4f644ae6bd4e43f37fa390d00839f3d623a1003424c5b67b0a64184b13332ae08cda871ecc37

Download Submit
C:\Windows\system\thCLPJC.exe

Filesize
1.9MB

MD5
ece0061127f898bfe74f0e1084d49604

SHA1
36fc5b892b91d59d989cbaa92670b1e1c4ee1f8d

SHA256
db30c8efa55bcb2d796bf170c73bf6cee79c9ff11997eca11b1605256b36cd34

SHA512
7d60b7aefcf4a04056b3efe2fb51e0d22b421f9d450ae6fcc0970545e66b1a1cfac567a3a3e1ea2e7ef92518e8396b53d5bdffc3fd42530a567445d2deb33cbe

Download Submit
C:\Windows\system\tyUyqCk.exe

Filesize
1.9MB

MD5
d11d98fac57972396697a2bd7516c236

SHA1
2a418f3a7cbd054629c9db147f02a44f8604a31f

SHA256
17fa4b50040b12c66e6954e39c4240bbc847f0c1f6934215c4cec05b1be6eb69

SHA512
ed6f88aa284d05f83588e1f89095f0e3b89cf541d1ff83d4391488750967d002ade9c1f839b87e5147235b4f9c6f01f13ee361ca5e786f49893fb01c62c516c8

Download Submit
C:\Windows\system\wBLTNrd.exe

Filesize
1.9MB

MD5
97081ba8b82e5e3121bc56eec2fb438a

SHA1
a5248e8f3b1a3896dd47aa1014b7357c7c7a3b50

SHA256
471546a7f4c47b1746144fcede7696b714b57967616f3cb77623f3a247e7f509

SHA512
511fa35acfa9014ce8610a6996db75433f656b94ba16b80979eaed8d56cd349362d91bf66f72b7795ca328036baacf8a9dee5f5595cf22ad151ba030bf6688d1

Download Submit
C:\Windows\system\wwPoqWu.exe

Filesize
1.9MB

MD5
a2c16ab5bf480c26a10718c9317169a5

SHA1
230ed7cdcad4b271ebc625739a37b98057166f19

SHA256
dc8b6363accd0131911263eb64fa963ab0f81a58ee38b77e9e526941e8b6a4bf

SHA512
aeef3f169f9ad83d0216af7f05ca1bf0da4bcf5d45deb782f663a7e213991e1db0784f8cbf060ab40cec62ef02b4658685f566efe4efe9114fe14925b9dc484e

Download Submit
C:\Windows\system\xlZXKXi.exe

Filesize
1.9MB

MD5
67eff12382a21f8892a0b7aae9e9ddfc

SHA1
8b700663ac91da379835814518d8ec8ba9f9b1d9

SHA256
298e7c69b4f955b04564f47e04ced94b61a346c540eba762373787485604d593

SHA512
77dc05e8b1ef5e856951fa88726f4cfa5b5c28c20fac1cf1673ab94b0342ab60b16ba5e2726ddac7dc19fbf0c4caae614412dfa18d74263fd8986f077e3bb2a9

Download Submit
\Windows\system\IJMNmWc.exe

Filesize
1.9MB

MD5
0b9542f7d5b3fbe1cdbdb146a179728f

SHA1
be2d5fde8ae0b40ece5353adccf41f03ec6f168c

SHA256
65c8fe37e13b0d31340b3dd2a4f4e7ccec40dd0fb13d088a60052bc69d803a8c

SHA512
e8e6c5258a7cf540b29063adf93370ee27665992e2b473d56740dcbcd099a72d4ba4cfb481c1d4c2d27780306382a1fbcf4ded7e7850fe87ba90990fbdb44afd

Download Submit
\Windows\system\JVFmshR.exe

Filesize
1.9MB

MD5
6ea8580f90c4ecfc9ba67ca7a1f79d75

SHA1
ec4e9ed7441832d8324f204e8583367733686063

SHA256
e27e8890a1771e74cd7608b844a060afbc2f0dfd7610e783eb878a0be4c2ad61

SHA512
c0229cd407dcb9dd48afd2fa679dc473bf81211f00b7ecb617892e708f727f4a229d2b6fab089f601d4d0e74d1f2054a4318ab625289a8d1265c67319b7ac3ee

Download Submit
\Windows\system\JaLNGAI.exe

Filesize
1.9MB

MD5
64e5dc7031ba47d4bbbec948ef9742b3

SHA1
40af206ce18dc8c410853bda7f8d88ace65229d4

SHA256
9bfbcd0976f71497aa94cc10f20f906071ec2ee9754990298aca6ef84e3579d5

SHA512
3ed0ab90fe4ec1aded150134e8e6271c4069200618f83567f63665001306f68e54230d4171445ca9993a7bd7e3d93020b443482bed763aeeb77abd8df7f53f06

Download Submit
\Windows\system\OIQmWlP.exe

Filesize
1.9MB

MD5
3fec8293e20256c700192b5c515df648

SHA1
f5b677ac81e058115b1846293fe2e4a086cb28a6

SHA256
05f9df222ba8652aafad8dbe908839322db21cdae7174332bcb1568560a06236

SHA512
e0f0a5bbdc4b83cecb0dcdd5a5d17980eda05214c4baf24e1b6ea5451c50c96a66aa5c59a815eb1458b6014933e66d36edbf26a389d84d81590c74ea2a159391

Download Submit
\Windows\system\PIvgCZK.exe

Filesize
1.9MB

MD5
5e190e801c00c7a6438ff79aea730fb9

SHA1
133f6ea47aa2fa4210ab0cb98dab7543b5ac1d5b

SHA256
8aa38b661b272b83a8604c93087d3a75c90ed221ed6d34cbfc3118401807699b

SHA512
00dd3791dab9a313b50315979218a3662303a14984ec47531964461046c26caeb269d9d3220c4cdf847e9a9eea6f55fb05691690812a3a2bbc22aea52ff42d5f

Download Submit
\Windows\system\Prtrgcd.exe

Filesize
1.9MB

MD5
ba026ac90861ebacd8ca62ec9cb752ff

SHA1
b51142b287c08bab1393872e2c95d451a65b19f3

SHA256
a0602ab07f0c41d4b49598ab2ab809489d5dc67bb66e823e2a5701ca13ec2bac

SHA512
89cd83bb817f93a3c63213a818757285b195a30793315042c5ec4c0cb82f7742f97017571399a6d625dfd7de4f34df66b037b2d0a1a6db828e171283e3a830d5

Download Submit
\Windows\system\TzZvTyy.exe

Filesize
1.9MB

MD5
e5cb0ba78f301531e06e8e909a48c3dc

SHA1
f9c8c64fbf65021d7496cb0d27463e4738c78fe6

SHA256
a9a8fce7defa6a7c3749e914c19348f12242831013115517e3f1733068400752

SHA512
175fd173357f17493789b11ed61fe791672e7f8164f837da83a3dc0e320f455b416dac75e4e2cb69f58947dbead336a744d9e9742a7a2ad4845051912249491e

Download Submit
\Windows\system\ctYwjgR.exe

Filesize
1.9MB

MD5
bd8dc4239fd684bd4e43ca4909749ea4

SHA1
3b049120b9e91393bedd7859f83812bd54709b51

SHA256
2f3a651941ca5f5541596f18e1ea44159a3b85cafadeb2883b434289be8e9f7e

SHA512
0a26c7d062f2ffb84f50c6cf588dddbec50821d63752d892198baa8bb448414e4718a84316f903e397c5f10687e19e6d687038fda6da3e18e975799aca4a05d5

Download Submit
\Windows\system\hnVPaDu.exe

Filesize
1.9MB

MD5
fe39942bb5efef15eb1cdb383ed0f1cb

SHA1
b22c5982f6bdac8c3d7c3c5820f73bf488012eb5

SHA256
9e6c5812415f546f9756eff099a06adc7b088c5e4c6c51a8de8a6a5c63379fe9

SHA512
9b0b20d6bbebca894a3a63e45c9461a3b418080ba1aaaec5233dd2c69beeb7d7b5fbeab5a26258a7a7f4c1dd1772f8cda9c909988ec761f48c1213ba9427f9c4

Download Submit
\Windows\system\pQhHuyl.exe

Filesize
1.9MB

MD5
c17443b9b5ed16b43832f1188ef5cbc3

SHA1
4c9bfe03349750eac52aac95b16589473acb5c37

SHA256
1ad33af2d54435e022422e591b74b3becc05bc10970e0239d5962d7fe164eb80

SHA512
096db66eee8c3c7efc99a25f2bbc5d510dac6ce68a50a7be1611ba624dff75509fec9cc648aff2a0548782aa138a9f7189161c37b01d2d0d08c3715e6037e33b

Download Submit
\Windows\system\uPIKnQA.exe

Filesize
1.9MB

MD5
0ad5a7e7dabe76c10f318113f70c16ad

SHA1
01610e10d14dd6d90ae3501cb2badec0540251d7

SHA256
271865d8848931032562d41403a89971da648f25f32d8216095680eb1cc9385d

SHA512
a6c944a58d32e6674570d1651246acf21d6423fe37a52eb63a1cad02c4c1d1ee2900e816d0d262abb60741e35fa40d61ceb6e4b79a00c13214babbaec3721ff2

Download Submit
memory/1460-83-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Filesize
512KB

Download
memory/1460-42-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/1460-75-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/1460-114-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/1460-87-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/1460-21-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Filesize
512KB

Download
memory/1460-25-0x000000001B830000-0x000000001BB12000-memory.dmp

Filesize
2.9MB

Download
memory/1460-27-0x0000000002410000-0x0000000002418000-memory.dmp

Filesize
32KB

Download
memory/1460-34-0x000007FEF5A30000-0x000007FEF63CD000-memory.dmp

Filesize
9.6MB

Download
memory/1460-35-0x0000000002AC0000-0x0000000002B40000-memory.dmp

Filesize
512KB

Download
memory/1720-76-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2112-44-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download
memory/2112-89-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2112-46-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2112-49-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-0-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/2112-37-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2112-66-0x0000000003410000-0x0000000003802000-memory.dmp

Filesize
3.9MB

Download
memory/2112-67-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-2-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2112-13-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2112-8-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2112-59-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2480-53-0x000000013FED0000-0x00000001402C2000-memory.dmp

Filesize
3.9MB

Download
memory/2624-47-0x000000013F720000-0x000000013FB12000-memory.dmp

Filesize
3.9MB

Download
memory/2632-69-0x000000013F510000-0x000000013F902000-memory.dmp

Filesize
3.9MB

Download
memory/2652-38-0x000000013FAB0000-0x000000013FEA2000-memory.dmp

Filesize
3.9MB

Download
memory/2676-20-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2676-74-0x000000013FF10000-0x0000000140302000-memory.dmp

Filesize
3.9MB

Download
memory/2912-61-0x000000013FB80000-0x000000013FF72000-memory.dmp

Filesize
3.9MB

Download
memory/2984-9-0x000000013F220000-0x000000013F612000-memory.dmp

Filesize
3.9MB

Download
memory/2996-36-0x000000013FE30000-0x0000000140222000-memory.dmp

Filesize
3.9MB

Download