xmrig | a0bd43312358934713cc78f9b51c7bb4b792bab7f2e167e5270f6a07f41aa953

Analysis

max time kernel
15s
max time network
37s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
Size

2.1MB
MD5

00f511d9dab28497dff9df8aa461a55b
SHA1

74fe11ec5b9e9ea6933ca00601b0d233309a896e
SHA256

a0bd43312358934713cc78f9b51c7bb4b792bab7f2e167e5270f6a07f41aa953
SHA512

79a6af1f1159e10cd0d42454735a4b8d64b689e80e4c5b6643ff017726f2681443838495614a67254cf85b9825908506f46619d275bb8d535affbda10c2507da
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82g1VQx7Va4qrE:NABz

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral1/memory/1508-229-0x000000013FE60000-0x0000000140252000-memory.dmp	xmrig
behavioral1/memory/2560-198-0x000000013FA80000-0x000000013FE72000-memory.dmp	xmrig
behavioral1/memory/2828-403-0x000000013F560000-0x000000013F952000-memory.dmp	xmrig
behavioral1/memory/2572-259-0x000000013FE10000-0x0000000140202000-memory.dmp	xmrig
behavioral1/memory/2464-248-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	xmrig
behavioral1/memory/2640-195-0x000000013F880000-0x000000013FC72000-memory.dmp	xmrig
behavioral1/memory/1028-9-0x000000013F750000-0x000000013FB42000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
1028	grZqgEA.exe
2828	GEpigif.exe
2640	fbxnfvQ.exe
2560	WefLStX.exe
1508	pMYwECz.exe
2464	uVkGsti.exe
2572	bMLOcMv.exe
2460	wcbhyHQ.exe
2580	hbUyYJw.exe
1704	AcGkeYf.exe
2632	jkwOrWZ.exe
2816	WgfQMle.exe
2616	wKApimQ.exe
2608	PbITPCz.exe
2428	Momqnkw.exe
1656	FLOySdi.exe
1556	mydsaQD.exe
2740	uaBNLbj.exe
2676	CiEFlkK.exe
2320	wnWjIcT.exe
2928	JeBWhbG.exe
2976	FXUZXhW.exe
2744	efNgbaT.exe
1228	pJqZhck.exe
1284	feONgYs.exe
2252	tqKDFKd.exe
1760	ZKhWWil.exe
2076	VOixthJ.exe
1052	eCscGOv.exe
1740	jqHjaBm.exe
788	iJYBgoj.exe
2380	kvzphSL.exe
1684	fyFrnLE.exe
1336	klJKERw.exe
1748	ADsOFJX.exe
768	EkMUzFq.exe
772	aboWNrV.exe
764	IhrkmBw.exe
2888	vWRnICK.exe
844	dDznleA.exe
2304	jApiqds.exe
1752	XcHZQDF.exe
3032	lcxCOCf.exe
2736	yRMiAOv.exe
1604	azwRGHC.exe
2232	qZMCuPC.exe
384	JYuteEd.exe
2720	OzpQlgF.exe
1272	bEehhtL.exe
2636	BxjSfLW.exe
1400	LmeuCql.exe
2536	rfThAzs.exe
628	mHdCBfb.exe
2084	DBccJdV.exe
3088	JFJughA.exe
3120	oqkfMIy.exe
3152	YLSMKIh.exe
3184	gSYOOto.exe
3216	QEyZfjA.exe
3248	FTuGVWv.exe
3280	kFMeRRr.exe
3312	zziuBHY.exe
3344	zhEwHWg.exe
3376	AVTdDhf.exe

Loads dropped DLL 64 IoCs

pid	Process
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2512-0-0x000000013F2B0000-0x000000013F6A2000-memory.dmp	upx
behavioral1/files/0x0008000000014aa2-35.dat	upx
behavioral1/files/0x0008000000014f71-37.dat	upx
behavioral1/files/0x0006000000015d07-46.dat	upx
behavioral1/files/0x0006000000015d4a-53.dat	upx
behavioral1/files/0x0006000000015d6f-72.dat	upx
behavioral1/files/0x0006000000015d87-83.dat	upx
behavioral1/files/0x0007000000014b63-21.dat	upx
behavioral1/files/0x0006000000015d28-91.dat	upx
behavioral1/files/0x0006000000015e3a-108.dat	upx
behavioral1/files/0x0006000000015eaf-113.dat	upx
behavioral1/files/0x0006000000015f6d-118.dat	upx
behavioral1/files/0x0006000000016843-155.dat	upx
behavioral1/memory/1508-229-0x000000013FE60000-0x0000000140252000-memory.dmp	upx
behavioral1/memory/2560-198-0x000000013FA80000-0x000000013FE72000-memory.dmp	upx
behavioral1/files/0x0006000000016cb7-174.dat	upx
behavioral1/memory/2828-403-0x000000013F560000-0x000000013F952000-memory.dmp	upx
behavioral1/files/0x0006000000016c63-166.dat	upx
behavioral1/files/0x0006000000016a9a-158.dat	upx
behavioral1/memory/2572-259-0x000000013FE10000-0x0000000140202000-memory.dmp	upx
behavioral1/memory/2464-248-0x000000013F2F0000-0x000000013F6E2000-memory.dmp	upx
behavioral1/memory/2640-195-0x000000013F880000-0x000000013FC72000-memory.dmp	upx
behavioral1/files/0x0006000000016c6b-169.dat	upx
behavioral1/files/0x0006000000016c4a-161.dat	upx
behavioral1/files/0x000600000001661c-152.dat	upx
behavioral1/files/0x0015000000014726-147.dat	upx
behavioral1/files/0x00060000000164b2-143.dat	upx
behavioral1/files/0x0006000000016117-128.dat	upx
behavioral1/files/0x0006000000016572-150.dat	upx
behavioral1/files/0x000600000001630b-141.dat	upx
behavioral1/files/0x001500000001471d-10.dat	upx
behavioral1/files/0x00060000000161e7-134.dat	upx
behavioral1/files/0x0006000000015fe9-123.dat	upx
behavioral1/files/0x0006000000015d8f-99.dat	upx
behavioral1/files/0x0006000000015d79-97.dat	upx
behavioral1/files/0x0006000000015d67-95.dat	upx
behavioral1/files/0x0006000000015d56-93.dat	upx
behavioral1/files/0x0007000000015ceb-88.dat	upx
behavioral1/files/0x0006000000015d9b-103.dat	upx
behavioral1/files/0x0008000000014bea-79.dat	upx
behavioral1/files/0x0006000000015d5e-63.dat	upx
behavioral1/files/0x0007000000004e76-36.dat	upx
behavioral1/memory/1028-9-0x000000013F750000-0x000000013FB42000-memory.dmp	upx
behavioral1/files/0x000b0000000144e4-6.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\TpmtOjZ.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\GXlQmYX.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\WrJFhlP.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\jkwOrWZ.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ALPXmhR.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\zJwRIaq.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\WgfQMle.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\hqyCaog.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\SSyshNt.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\BmNJAwT.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ehIPzgB.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\AcGkeYf.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\emnuUBU.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ffYiNzv.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\NNVfpZS.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\hzhCwJz.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\OOKEbDR.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\KNWAEaK.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\XggCdBs.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\imkqauR.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\qptrYaT.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\jGrvVQr.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\efNgbaT.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\DArlDMK.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\DPUkbiv.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\cbdHJTc.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\gbDVvtZ.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\kzUWaQM.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ZLHavXj.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\GQZrsXX.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\GFImLND.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\CPJYNyu.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\NEzvCBr.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\dLyihqu.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\eXOPcHe.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\QxaxDwx.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\kBqqjGp.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ItPDUMD.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\Qjfimrc.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\TXXwfjq.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\hPKuOFh.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\lotZlwV.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ajyUwaa.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\TKengbF.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\LEjlxqF.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\CgpwvLx.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ydnXRAK.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\VFmTyiD.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ifiywSO.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\pMYwECz.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\QEyZfjA.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\skBtghV.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\NbRWTlr.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\SzfVmIq.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\VSUEmTF.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\qFfWHRH.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\nVOiTcc.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\ftjjvtC.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\MSbQoRf.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\PbITPCz.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\iiBNYiS.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\VIwptEe.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\FroKCOy.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
File created	C:\Windows\System\UUsnJtn.exe	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2516	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
Token: SeDebugPrivilege	2516	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2516	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2516	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	29
PID 2512 wrote to memory of 2516	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	29
PID 2512 wrote to memory of 1028	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	30
PID 2512 wrote to memory of 1028	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	30
PID 2512 wrote to memory of 1028	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	30
PID 2512 wrote to memory of 1508	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1508	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	31
PID 2512 wrote to memory of 1508	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	31
PID 2512 wrote to memory of 2828	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	32
PID 2512 wrote to memory of 2828	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	32
PID 2512 wrote to memory of 2828	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	32
PID 2512 wrote to memory of 2580	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2580	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2580	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	33
PID 2512 wrote to memory of 2640	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2640	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2640	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	34
PID 2512 wrote to memory of 2632	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2632	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2632	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	35
PID 2512 wrote to memory of 2560	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2560	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2560	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	36
PID 2512 wrote to memory of 2616	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2616	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2616	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	37
PID 2512 wrote to memory of 2464	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2464	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2464	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	38
PID 2512 wrote to memory of 2608	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	39
PID 2512 wrote to memory of 2608	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	39
PID 2512 wrote to memory of 2608	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	39
PID 2512 wrote to memory of 2572	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	40
PID 2512 wrote to memory of 2572	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	40
PID 2512 wrote to memory of 2572	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	40
PID 2512 wrote to memory of 2428	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2428	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2428	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	41
PID 2512 wrote to memory of 2460	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	42
PID 2512 wrote to memory of 2460	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	42
PID 2512 wrote to memory of 2460	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	42
PID 2512 wrote to memory of 1656	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1656	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1656	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	43
PID 2512 wrote to memory of 1704	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	44
PID 2512 wrote to memory of 1704	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	44
PID 2512 wrote to memory of 1704	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	44
PID 2512 wrote to memory of 1556	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	45
PID 2512 wrote to memory of 1556	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	45
PID 2512 wrote to memory of 1556	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	45
PID 2512 wrote to memory of 2816	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	46
PID 2512 wrote to memory of 2816	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	46
PID 2512 wrote to memory of 2816	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	46
PID 2512 wrote to memory of 2740	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2740	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2740	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	47
PID 2512 wrote to memory of 2676	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	48
PID 2512 wrote to memory of 2676	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	48
PID 2512 wrote to memory of 2676	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	48
PID 2512 wrote to memory of 2320	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	49
PID 2512 wrote to memory of 2320	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	49
PID 2512 wrote to memory of 2320	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	49
PID 2512 wrote to memory of 2928	2512	00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\00f511d9dab28497dff9df8aa461a55b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System\grZqgEA.exe
  C:\Windows\System\grZqgEA.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\pMYwECz.exe
  C:\Windows\System\pMYwECz.exe
  2⤵
  - Executes dropped EXE
  PID:1508
- C:\Windows\System\GEpigif.exe
  C:\Windows\System\GEpigif.exe
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\System\hbUyYJw.exe
  C:\Windows\System\hbUyYJw.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\fbxnfvQ.exe
  C:\Windows\System\fbxnfvQ.exe
  2⤵
  - Executes dropped EXE
  PID:2640
- C:\Windows\System\jkwOrWZ.exe
  C:\Windows\System\jkwOrWZ.exe
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Windows\System\WefLStX.exe
  C:\Windows\System\WefLStX.exe
  2⤵
  - Executes dropped EXE
  PID:2560
- C:\Windows\System\wKApimQ.exe
  C:\Windows\System\wKApimQ.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\uVkGsti.exe
  C:\Windows\System\uVkGsti.exe
  2⤵
  - Executes dropped EXE
  PID:2464
- C:\Windows\System\PbITPCz.exe
  C:\Windows\System\PbITPCz.exe
  2⤵
  - Executes dropped EXE
  PID:2608
- C:\Windows\System\bMLOcMv.exe
  C:\Windows\System\bMLOcMv.exe
  2⤵
  - Executes dropped EXE
  PID:2572
- C:\Windows\System\Momqnkw.exe
  C:\Windows\System\Momqnkw.exe
  2⤵
  - Executes dropped EXE
  PID:2428
- C:\Windows\System\wcbhyHQ.exe
  C:\Windows\System\wcbhyHQ.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\FLOySdi.exe
  C:\Windows\System\FLOySdi.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\AcGkeYf.exe
  C:\Windows\System\AcGkeYf.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\mydsaQD.exe
  C:\Windows\System\mydsaQD.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\WgfQMle.exe
  C:\Windows\System\WgfQMle.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\uaBNLbj.exe
  C:\Windows\System\uaBNLbj.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\CiEFlkK.exe
  C:\Windows\System\CiEFlkK.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\wnWjIcT.exe
  C:\Windows\System\wnWjIcT.exe
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Windows\System\JeBWhbG.exe
  C:\Windows\System\JeBWhbG.exe
  2⤵
  - Executes dropped EXE
  PID:2928
- C:\Windows\System\FXUZXhW.exe
  C:\Windows\System\FXUZXhW.exe
  2⤵
  - Executes dropped EXE
  PID:2976
- C:\Windows\System\efNgbaT.exe
  C:\Windows\System\efNgbaT.exe
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Windows\System\pJqZhck.exe
  C:\Windows\System\pJqZhck.exe
  2⤵
  - Executes dropped EXE
  PID:1228
- C:\Windows\System\feONgYs.exe
  C:\Windows\System\feONgYs.exe
  2⤵
  - Executes dropped EXE
  PID:1284
- C:\Windows\System\ZKhWWil.exe
  C:\Windows\System\ZKhWWil.exe
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Windows\System\tqKDFKd.exe
  C:\Windows\System\tqKDFKd.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- C:\Windows\System\qZMCuPC.exe
  C:\Windows\System\qZMCuPC.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\VOixthJ.exe
  C:\Windows\System\VOixthJ.exe
  2⤵
  - Executes dropped EXE
  PID:2076
- C:\Windows\System\JYuteEd.exe
  C:\Windows\System\JYuteEd.exe
  2⤵
  - Executes dropped EXE
  PID:384
- C:\Windows\System\eCscGOv.exe
  C:\Windows\System\eCscGOv.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\JJWvVLZ.exe
  C:\Windows\System\JJWvVLZ.exe
  2⤵
  PID:2748
- C:\Windows\System\jqHjaBm.exe
  C:\Windows\System\jqHjaBm.exe
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Windows\System\ZqQbhbS.exe
  C:\Windows\System\ZqQbhbS.exe
  2⤵
  PID:1720
- C:\Windows\System\iJYBgoj.exe
  C:\Windows\System\iJYBgoj.exe
  2⤵
  - Executes dropped EXE
  PID:788
- C:\Windows\System\GfGkWne.exe
  C:\Windows\System\GfGkWne.exe
  2⤵
  PID:1520
- C:\Windows\System\kvzphSL.exe
  C:\Windows\System\kvzphSL.exe
  2⤵
  - Executes dropped EXE
  PID:2380
- C:\Windows\System\yrpHYFA.exe
  C:\Windows\System\yrpHYFA.exe
  2⤵
  PID:1128
- C:\Windows\System\fyFrnLE.exe
  C:\Windows\System\fyFrnLE.exe
  2⤵
  - Executes dropped EXE
  PID:1684
- C:\Windows\System\QtPPpHE.exe
  C:\Windows\System\QtPPpHE.exe
  2⤵
  PID:2272
- C:\Windows\System\klJKERw.exe
  C:\Windows\System\klJKERw.exe
  2⤵
  - Executes dropped EXE
  PID:1336
- C:\Windows\System\eIceOqp.exe
  C:\Windows\System\eIceOqp.exe
  2⤵
  PID:1768
- C:\Windows\System\ADsOFJX.exe
  C:\Windows\System\ADsOFJX.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\DQnRmEP.exe
  C:\Windows\System\DQnRmEP.exe
  2⤵
  PID:1864
- C:\Windows\System\EkMUzFq.exe
  C:\Windows\System\EkMUzFq.exe
  2⤵
  - Executes dropped EXE
  PID:768
- C:\Windows\System\ucEsWZZ.exe
  C:\Windows\System\ucEsWZZ.exe
  2⤵
  PID:800
- C:\Windows\System\aboWNrV.exe
  C:\Windows\System\aboWNrV.exe
  2⤵
  - Executes dropped EXE
  PID:772
- C:\Windows\System\tkucncZ.exe
  C:\Windows\System\tkucncZ.exe
  2⤵
  PID:908
- C:\Windows\System\IhrkmBw.exe
  C:\Windows\System\IhrkmBw.exe
  2⤵
  - Executes dropped EXE
  PID:764
- C:\Windows\System\mbFquKl.exe
  C:\Windows\System\mbFquKl.exe
  2⤵
  PID:1776
- C:\Windows\System\vWRnICK.exe
  C:\Windows\System\vWRnICK.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\qFfWHRH.exe
  C:\Windows\System\qFfWHRH.exe
  2⤵
  PID:2896
- C:\Windows\System\dDznleA.exe
  C:\Windows\System\dDznleA.exe
  2⤵
  - Executes dropped EXE
  PID:844
- C:\Windows\System\coKxlnF.exe
  C:\Windows\System\coKxlnF.exe
  2⤵
  PID:548
- C:\Windows\System\jApiqds.exe
  C:\Windows\System\jApiqds.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\hqyCaog.exe
  C:\Windows\System\hqyCaog.exe
  2⤵
  PID:3064
- C:\Windows\System\XcHZQDF.exe
  C:\Windows\System\XcHZQDF.exe
  2⤵
  - Executes dropped EXE
  PID:1752
- C:\Windows\System\TeYoWxl.exe
  C:\Windows\System\TeYoWxl.exe
  2⤵
  PID:884
- C:\Windows\System\lcxCOCf.exe
  C:\Windows\System\lcxCOCf.exe
  2⤵
  - Executes dropped EXE
  PID:3032
- C:\Windows\System\uLSJkeI.exe
  C:\Windows\System\uLSJkeI.exe
  2⤵
  PID:1992
- C:\Windows\System\yRMiAOv.exe
  C:\Windows\System\yRMiAOv.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\emnuUBU.exe
  C:\Windows\System\emnuUBU.exe
  2⤵
  PID:1552
- C:\Windows\System\azwRGHC.exe
  C:\Windows\System\azwRGHC.exe
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Windows\System\QzTjvkX.exe
  C:\Windows\System\QzTjvkX.exe
  2⤵
  PID:2352
- C:\Windows\System\OzpQlgF.exe
  C:\Windows\System\OzpQlgF.exe
  2⤵
  - Executes dropped EXE
  PID:2720
- C:\Windows\System\OOKEbDR.exe
  C:\Windows\System\OOKEbDR.exe
  2⤵
  PID:2692
- C:\Windows\System\bEehhtL.exe
  C:\Windows\System\bEehhtL.exe
  2⤵
  - Executes dropped EXE
  PID:1272
- C:\Windows\System\ffYiNzv.exe
  C:\Windows\System\ffYiNzv.exe
  2⤵
  PID:2244
- C:\Windows\System\BxjSfLW.exe
  C:\Windows\System\BxjSfLW.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\RXRQsbR.exe
  C:\Windows\System\RXRQsbR.exe
  2⤵
  PID:2708
- C:\Windows\System\LmeuCql.exe
  C:\Windows\System\LmeuCql.exe
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Windows\System\RXbcSgA.exe
  C:\Windows\System\RXbcSgA.exe
  2⤵
  PID:2496
- C:\Windows\System\rfThAzs.exe
  C:\Windows\System\rfThAzs.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\ALPXmhR.exe
  C:\Windows\System\ALPXmhR.exe
  2⤵
  PID:2672
- C:\Windows\System\mHdCBfb.exe
  C:\Windows\System\mHdCBfb.exe
  2⤵
  - Executes dropped EXE
  PID:628
- C:\Windows\System\EcIcDNA.exe
  C:\Windows\System\EcIcDNA.exe
  2⤵
  PID:2488
- C:\Windows\System\DBccJdV.exe
  C:\Windows\System\DBccJdV.exe
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\System\YTssasq.exe
  C:\Windows\System\YTssasq.exe
  2⤵
  PID:1188
- C:\Windows\System\JFJughA.exe
  C:\Windows\System\JFJughA.exe
  2⤵
  - Executes dropped EXE
  PID:3088
- C:\Windows\System\PpnzlMx.exe
  C:\Windows\System\PpnzlMx.exe
  2⤵
  PID:3104
- C:\Windows\System\oqkfMIy.exe
  C:\Windows\System\oqkfMIy.exe
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Windows\System\eXOPcHe.exe
  C:\Windows\System\eXOPcHe.exe
  2⤵
  PID:3136
- C:\Windows\System\YLSMKIh.exe
  C:\Windows\System\YLSMKIh.exe
  2⤵
  - Executes dropped EXE
  PID:3152
- C:\Windows\System\NHGWvSv.exe
  C:\Windows\System\NHGWvSv.exe
  2⤵
  PID:3168
- C:\Windows\System\gSYOOto.exe
  C:\Windows\System\gSYOOto.exe
  2⤵
  - Executes dropped EXE
  PID:3184
- C:\Windows\System\UxKRURt.exe
  C:\Windows\System\UxKRURt.exe
  2⤵
  PID:3200
- C:\Windows\System\QEyZfjA.exe
  C:\Windows\System\QEyZfjA.exe
  2⤵
  - Executes dropped EXE
  PID:3216
- C:\Windows\System\klYvQqZ.exe
  C:\Windows\System\klYvQqZ.exe
  2⤵
  PID:3232
- C:\Windows\System\FTuGVWv.exe
  C:\Windows\System\FTuGVWv.exe
  2⤵
  - Executes dropped EXE
  PID:3248
- C:\Windows\System\dOttYxC.exe
  C:\Windows\System\dOttYxC.exe
  2⤵
  PID:3264
- C:\Windows\System\kFMeRRr.exe
  C:\Windows\System\kFMeRRr.exe
  2⤵
  - Executes dropped EXE
  PID:3280
- C:\Windows\System\bnwLicC.exe
  C:\Windows\System\bnwLicC.exe
  2⤵
  PID:3296
- C:\Windows\System\zziuBHY.exe
  C:\Windows\System\zziuBHY.exe
  2⤵
  - Executes dropped EXE
  PID:3312
- C:\Windows\System\aomfuPp.exe
  C:\Windows\System\aomfuPp.exe
  2⤵
  PID:3328
- C:\Windows\System\zhEwHWg.exe
  C:\Windows\System\zhEwHWg.exe
  2⤵
  - Executes dropped EXE
  PID:3344
- C:\Windows\System\MuevVaI.exe
  C:\Windows\System\MuevVaI.exe
  2⤵
  PID:3360
- C:\Windows\System\AVTdDhf.exe
  C:\Windows\System\AVTdDhf.exe
  2⤵
  - Executes dropped EXE
  PID:3376
- C:\Windows\System\SYaWBlV.exe
  C:\Windows\System\SYaWBlV.exe
  2⤵
  PID:3392
- C:\Windows\System\nVOiTcc.exe
  C:\Windows\System\nVOiTcc.exe
  2⤵
  PID:3408
- C:\Windows\System\DFWdDtB.exe
  C:\Windows\System\DFWdDtB.exe
  2⤵
  PID:3424
- C:\Windows\System\LcfkwJx.exe
  C:\Windows\System\LcfkwJx.exe
  2⤵
  PID:3440
- C:\Windows\System\HFyiCqA.exe
  C:\Windows\System\HFyiCqA.exe
  2⤵
  PID:3456
- C:\Windows\System\pjaNWis.exe
  C:\Windows\System\pjaNWis.exe
  2⤵
  PID:3476
- C:\Windows\System\dWvlbSi.exe
  C:\Windows\System\dWvlbSi.exe
  2⤵
  PID:3492
- C:\Windows\System\xQNQyxs.exe
  C:\Windows\System\xQNQyxs.exe
  2⤵
  PID:3508
- C:\Windows\System\UKuSEUP.exe
  C:\Windows\System\UKuSEUP.exe
  2⤵
  PID:3524
- C:\Windows\System\asgCNrP.exe
  C:\Windows\System\asgCNrP.exe
  2⤵
  PID:3540
- C:\Windows\System\vITPErt.exe
  C:\Windows\System\vITPErt.exe
  2⤵
  PID:3556
- C:\Windows\System\QxaxDwx.exe
  C:\Windows\System\QxaxDwx.exe
  2⤵
  PID:3572
- C:\Windows\System\SZwGwdX.exe
  C:\Windows\System\SZwGwdX.exe
  2⤵
  PID:3588
- C:\Windows\System\aKLZXgn.exe
  C:\Windows\System\aKLZXgn.exe
  2⤵
  PID:3604
- C:\Windows\System\MprfZAu.exe
  C:\Windows\System\MprfZAu.exe
  2⤵
  PID:3620
- C:\Windows\System\CarsiEI.exe
  C:\Windows\System\CarsiEI.exe
  2⤵
  PID:3636
- C:\Windows\System\yDTvgbC.exe
  C:\Windows\System\yDTvgbC.exe
  2⤵
  PID:3668
- C:\Windows\System\tLQAOTX.exe
  C:\Windows\System\tLQAOTX.exe
  2⤵
  PID:3684
- C:\Windows\System\xwCOGbL.exe
  C:\Windows\System\xwCOGbL.exe
  2⤵
  PID:3700
- C:\Windows\System\DFlIAHn.exe
  C:\Windows\System\DFlIAHn.exe
  2⤵
  PID:3764
- C:\Windows\System\pZjuqvV.exe
  C:\Windows\System\pZjuqvV.exe
  2⤵
  PID:3808
- C:\Windows\System\yBXbUgM.exe
  C:\Windows\System\yBXbUgM.exe
  2⤵
  PID:3828
- C:\Windows\System\gOFyuvn.exe
  C:\Windows\System\gOFyuvn.exe
  2⤵
  PID:3844
- C:\Windows\System\FroKCOy.exe
  C:\Windows\System\FroKCOy.exe
  2⤵
  PID:3860
- C:\Windows\System\ZsCXnDS.exe
  C:\Windows\System\ZsCXnDS.exe
  2⤵
  PID:3876
- C:\Windows\System\XtOlBAZ.exe
  C:\Windows\System\XtOlBAZ.exe
  2⤵
  PID:3892
- C:\Windows\System\EGoKOVO.exe
  C:\Windows\System\EGoKOVO.exe
  2⤵
  PID:3912
- C:\Windows\System\gYJaFZv.exe
  C:\Windows\System\gYJaFZv.exe
  2⤵
  PID:3928
- C:\Windows\System\QGVfJRz.exe
  C:\Windows\System\QGVfJRz.exe
  2⤵
  PID:3944
- C:\Windows\System\PVTbDXf.exe
  C:\Windows\System\PVTbDXf.exe
  2⤵
  PID:3964
- C:\Windows\System\xiGDOVN.exe
  C:\Windows\System\xiGDOVN.exe
  2⤵
  PID:3980
- C:\Windows\System\ONNvSXb.exe
  C:\Windows\System\ONNvSXb.exe
  2⤵
  PID:3996
- C:\Windows\System\skBtghV.exe
  C:\Windows\System\skBtghV.exe
  2⤵
  PID:4016
- C:\Windows\System\gDEAsBW.exe
  C:\Windows\System\gDEAsBW.exe
  2⤵
  PID:4032
- C:\Windows\System\fUAAPcG.exe
  C:\Windows\System\fUAAPcG.exe
  2⤵
  PID:4048
- C:\Windows\System\erpWhEL.exe
  C:\Windows\System\erpWhEL.exe
  2⤵
  PID:4068
- C:\Windows\System\tEidOYp.exe
  C:\Windows\System\tEidOYp.exe
  2⤵
  PID:4084
- C:\Windows\System\tVszDvY.exe
  C:\Windows\System\tVszDvY.exe
  2⤵
  PID:2316
- C:\Windows\System\NUfVOAT.exe
  C:\Windows\System\NUfVOAT.exe
  2⤵
  PID:2004
- C:\Windows\System\FHYKctw.exe
  C:\Windows\System\FHYKctw.exe
  2⤵
  PID:4108
- C:\Windows\System\YDPfUuP.exe
  C:\Windows\System\YDPfUuP.exe
  2⤵
  PID:4124
- C:\Windows\System\auZicIO.exe
  C:\Windows\System\auZicIO.exe
  2⤵
  PID:4140
- C:\Windows\System\lQBxjys.exe
  C:\Windows\System\lQBxjys.exe
  2⤵
  PID:4160
- C:\Windows\System\SSyshNt.exe
  C:\Windows\System\SSyshNt.exe
  2⤵
  PID:4176
- C:\Windows\System\RlxlBCj.exe
  C:\Windows\System\RlxlBCj.exe
  2⤵
  PID:4196
- C:\Windows\System\wfTzFmy.exe
  C:\Windows\System\wfTzFmy.exe
  2⤵
  PID:4212
- C:\Windows\System\gcOWmed.exe
  C:\Windows\System\gcOWmed.exe
  2⤵
  PID:4228
- C:\Windows\System\hakpIzH.exe
  C:\Windows\System\hakpIzH.exe
  2⤵
  PID:4244
- C:\Windows\System\SQcqqEE.exe
  C:\Windows\System\SQcqqEE.exe
  2⤵
  PID:4260
- C:\Windows\System\WHKPBmA.exe
  C:\Windows\System\WHKPBmA.exe
  2⤵
  PID:4276
- C:\Windows\System\bwAkhMT.exe
  C:\Windows\System\bwAkhMT.exe
  2⤵
  PID:4292
- C:\Windows\System\gOhXgcC.exe
  C:\Windows\System\gOhXgcC.exe
  2⤵
  PID:4308
- C:\Windows\System\UUPzgRd.exe
  C:\Windows\System\UUPzgRd.exe
  2⤵
  PID:4324
- C:\Windows\System\EJtJIPj.exe
  C:\Windows\System\EJtJIPj.exe
  2⤵
  PID:4340
- C:\Windows\System\zJwRIaq.exe
  C:\Windows\System\zJwRIaq.exe
  2⤵
  PID:4356
- C:\Windows\System\YeOaJkm.exe
  C:\Windows\System\YeOaJkm.exe
  2⤵
  PID:4372
- C:\Windows\System\iiBNYiS.exe
  C:\Windows\System\iiBNYiS.exe
  2⤵
  PID:4388
- C:\Windows\System\gkMevSx.exe
  C:\Windows\System\gkMevSx.exe
  2⤵
  PID:4404
- C:\Windows\System\ObkLmlq.exe
  C:\Windows\System\ObkLmlq.exe
  2⤵
  PID:4420
- C:\Windows\System\RGIQvnq.exe
  C:\Windows\System\RGIQvnq.exe
  2⤵
  PID:4436
- C:\Windows\System\lRaLeBG.exe
  C:\Windows\System\lRaLeBG.exe
  2⤵
  PID:4452
- C:\Windows\System\SaSqcBR.exe
  C:\Windows\System\SaSqcBR.exe
  2⤵
  PID:4468
- C:\Windows\System\nDwQXKq.exe
  C:\Windows\System\nDwQXKq.exe
  2⤵
  PID:4484
- C:\Windows\System\LGieMct.exe
  C:\Windows\System\LGieMct.exe
  2⤵
  PID:4500
- C:\Windows\System\LRSVfgH.exe
  C:\Windows\System\LRSVfgH.exe
  2⤵
  PID:4516
- C:\Windows\System\UsBvDBV.exe
  C:\Windows\System\UsBvDBV.exe
  2⤵
  PID:4532
- C:\Windows\System\KNWAEaK.exe
  C:\Windows\System\KNWAEaK.exe
  2⤵
  PID:4548
- C:\Windows\System\WUckpcC.exe
  C:\Windows\System\WUckpcC.exe
  2⤵
  PID:4564
- C:\Windows\System\qROoTXN.exe
  C:\Windows\System\qROoTXN.exe
  2⤵
  PID:4580
- C:\Windows\System\gqFphJN.exe
  C:\Windows\System\gqFphJN.exe
  2⤵
  PID:4596
- C:\Windows\System\BzcTbnS.exe
  C:\Windows\System\BzcTbnS.exe
  2⤵
  PID:4612
- C:\Windows\System\VIwptEe.exe
  C:\Windows\System\VIwptEe.exe
  2⤵
  PID:4628
- C:\Windows\System\DbJndHA.exe
  C:\Windows\System\DbJndHA.exe
  2⤵
  PID:4644
- C:\Windows\System\kBqqjGp.exe
  C:\Windows\System\kBqqjGp.exe
  2⤵
  PID:4660
- C:\Windows\System\qpKjiuk.exe
  C:\Windows\System\qpKjiuk.exe
  2⤵
  PID:4676
- C:\Windows\System\jxJPtxX.exe
  C:\Windows\System\jxJPtxX.exe
  2⤵
  PID:4692
- C:\Windows\System\NEzvCBr.exe
  C:\Windows\System\NEzvCBr.exe
  2⤵
  PID:4708
- C:\Windows\System\PngYgYa.exe
  C:\Windows\System\PngYgYa.exe
  2⤵
  PID:4724
- C:\Windows\System\TKBjtNr.exe
  C:\Windows\System\TKBjtNr.exe
  2⤵
  PID:4740
- C:\Windows\System\ydvrSuy.exe
  C:\Windows\System\ydvrSuy.exe
  2⤵
  PID:4756
- C:\Windows\System\DouMLSW.exe
  C:\Windows\System\DouMLSW.exe
  2⤵
  PID:4772
- C:\Windows\System\vnMJSBH.exe
  C:\Windows\System\vnMJSBH.exe
  2⤵
  PID:4788
- C:\Windows\System\ngUJcZE.exe
  C:\Windows\System\ngUJcZE.exe
  2⤵
  PID:4804
- C:\Windows\System\wbcNxtc.exe
  C:\Windows\System\wbcNxtc.exe
  2⤵
  PID:4820
- C:\Windows\System\dDMeWfZ.exe
  C:\Windows\System\dDMeWfZ.exe
  2⤵
  PID:4836
- C:\Windows\System\XIQeDaW.exe
  C:\Windows\System\XIQeDaW.exe
  2⤵
  PID:4852
- C:\Windows\System\oOliTzJ.exe
  C:\Windows\System\oOliTzJ.exe
  2⤵
  PID:4868
- C:\Windows\System\WqJCEqI.exe
  C:\Windows\System\WqJCEqI.exe
  2⤵
  PID:4884
- C:\Windows\System\QFCLGXR.exe
  C:\Windows\System\QFCLGXR.exe
  2⤵
  PID:4900
- C:\Windows\System\lmQZyYz.exe
  C:\Windows\System\lmQZyYz.exe
  2⤵
  PID:4916
- C:\Windows\System\hjlVYUq.exe
  C:\Windows\System\hjlVYUq.exe
  2⤵
  PID:4932
- C:\Windows\System\WYTqctr.exe
  C:\Windows\System\WYTqctr.exe
  2⤵
  PID:4948
- C:\Windows\System\UFlmPNH.exe
  C:\Windows\System\UFlmPNH.exe
  2⤵
  PID:4964
- C:\Windows\System\VkNPMKN.exe
  C:\Windows\System\VkNPMKN.exe
  2⤵
  PID:4980
- C:\Windows\System\SgfgXNu.exe
  C:\Windows\System\SgfgXNu.exe
  2⤵
  PID:4996
- C:\Windows\System\cMUSfvy.exe
  C:\Windows\System\cMUSfvy.exe
  2⤵
  PID:5012
- C:\Windows\System\JdpGjlx.exe
  C:\Windows\System\JdpGjlx.exe
  2⤵
  PID:5028
- C:\Windows\System\qmEYCQc.exe
  C:\Windows\System\qmEYCQc.exe
  2⤵
  PID:5044
- C:\Windows\System\JzzVElX.exe
  C:\Windows\System\JzzVElX.exe
  2⤵
  PID:5060
- C:\Windows\System\kJIGEjg.exe
  C:\Windows\System\kJIGEjg.exe
  2⤵
  PID:5076
- C:\Windows\System\HPBcHAD.exe
  C:\Windows\System\HPBcHAD.exe
  2⤵
  PID:5092
- C:\Windows\System\GQZrsXX.exe
  C:\Windows\System\GQZrsXX.exe
  2⤵
  PID:5108
- C:\Windows\System\tlpZHmY.exe
  C:\Windows\System\tlpZHmY.exe
  2⤵
  PID:2104
- C:\Windows\System\FQdKgnQ.exe
  C:\Windows\System\FQdKgnQ.exe
  2⤵
  PID:1712
- C:\Windows\System\BmNJAwT.exe
  C:\Windows\System\BmNJAwT.exe
  2⤵
  PID:1116
- C:\Windows\System\uZRPSOo.exe
  C:\Windows\System\uZRPSOo.exe
  2⤵
  PID:1124
- C:\Windows\System\FuudPvi.exe
  C:\Windows\System\FuudPvi.exe
  2⤵
  PID:1772
- C:\Windows\System\aSKUIfx.exe
  C:\Windows\System\aSKUIfx.exe
  2⤵
  PID:1592
- C:\Windows\System\xBGhhYR.exe
  C:\Windows\System\xBGhhYR.exe
  2⤵
  PID:900
- C:\Windows\System\lTIzkeJ.exe
  C:\Windows\System\lTIzkeJ.exe
  2⤵
  PID:2044
- C:\Windows\System\NibChiq.exe
  C:\Windows\System\NibChiq.exe
  2⤵
  PID:2148
- C:\Windows\System\AwUZIJx.exe
  C:\Windows\System\AwUZIJx.exe
  2⤵
  PID:2876
- C:\Windows\System\DArlDMK.exe
  C:\Windows\System\DArlDMK.exe
  2⤵
  PID:1572
- C:\Windows\System\wDvPedy.exe
  C:\Windows\System\wDvPedy.exe
  2⤵
  PID:2476
- C:\Windows\System\gvWIgqZ.exe
  C:\Windows\System\gvWIgqZ.exe
  2⤵
  PID:2448
- C:\Windows\System\MSbQoRf.exe
  C:\Windows\System\MSbQoRf.exe
  2⤵
  PID:1288
- C:\Windows\System\bFrIJpe.exe
  C:\Windows\System\bFrIJpe.exe
  2⤵
  PID:3100
- C:\Windows\System\nckYtcn.exe
  C:\Windows\System\nckYtcn.exe
  2⤵
  PID:3164
- C:\Windows\System\CgpwvLx.exe
  C:\Windows\System\CgpwvLx.exe
  2⤵
  PID:3228
- C:\Windows\System\mTkNNlz.exe
  C:\Windows\System\mTkNNlz.exe
  2⤵
  PID:3292
- C:\Windows\System\TJXabhF.exe
  C:\Windows\System\TJXabhF.exe
  2⤵
  PID:3356
- C:\Windows\System\sngaLBW.exe
  C:\Windows\System\sngaLBW.exe
  2⤵
  PID:3420
- C:\Windows\System\vlqJqVU.exe
  C:\Windows\System\vlqJqVU.exe
  2⤵
  PID:3488
- C:\Windows\System\ItPDUMD.exe
  C:\Windows\System\ItPDUMD.exe
  2⤵
  PID:3552
- C:\Windows\System\lsYVCWx.exe
  C:\Windows\System\lsYVCWx.exe
  2⤵
  PID:3616
- C:\Windows\System\UUsnJtn.exe
  C:\Windows\System\UUsnJtn.exe
  2⤵
  PID:3696
- C:\Windows\System\yHTBStq.exe
  C:\Windows\System\yHTBStq.exe
  2⤵
  PID:3784
- C:\Windows\System\pMhidjN.exe
  C:\Windows\System\pMhidjN.exe
  2⤵
  PID:3800
- C:\Windows\System\RiGBQcE.exe
  C:\Windows\System\RiGBQcE.exe
  2⤵
  PID:3868
- C:\Windows\System\JjxphYE.exe
  C:\Windows\System\JjxphYE.exe
  2⤵
  PID:3936
- C:\Windows\System\PHIiaWL.exe
  C:\Windows\System\PHIiaWL.exe
  2⤵
  PID:4004
- C:\Windows\System\ajyUwaa.exe
  C:\Windows\System\ajyUwaa.exe
  2⤵
  PID:4076
- C:\Windows\System\TXoRJQD.exe
  C:\Windows\System\TXoRJQD.exe
  2⤵
  PID:4116
- C:\Windows\System\ejPYszf.exe
  C:\Windows\System\ejPYszf.exe
  2⤵
  PID:4156
- C:\Windows\System\dLyihqu.exe
  C:\Windows\System\dLyihqu.exe
  2⤵
  PID:4224
- C:\Windows\System\KKDBXkR.exe
  C:\Windows\System\KKDBXkR.exe
  2⤵
  PID:4288
- C:\Windows\System\mwItkcw.exe
  C:\Windows\System\mwItkcw.exe
  2⤵
  PID:4352
- C:\Windows\System\CeRMQnb.exe
  C:\Windows\System\CeRMQnb.exe
  2⤵
  PID:4416
- C:\Windows\System\XggCdBs.exe
  C:\Windows\System\XggCdBs.exe
  2⤵
  PID:4480
- C:\Windows\System\uBtyVwk.exe
  C:\Windows\System\uBtyVwk.exe
  2⤵
  PID:4544
- C:\Windows\System\NExOgFv.exe
  C:\Windows\System\NExOgFv.exe
  2⤵
  PID:4608
- C:\Windows\System\LmdQbYR.exe
  C:\Windows\System\LmdQbYR.exe
  2⤵
  PID:4636
- C:\Windows\System\OOgUrva.exe
  C:\Windows\System\OOgUrva.exe
  2⤵
  PID:4736
- C:\Windows\System\omWpWMR.exe
  C:\Windows\System\omWpWMR.exe
  2⤵
  PID:4796
- C:\Windows\System\nkeeBmB.exe
  C:\Windows\System\nkeeBmB.exe
  2⤵
  PID:4864
- C:\Windows\System\BjaYweL.exe
  C:\Windows\System\BjaYweL.exe
  2⤵
  PID:4928
- C:\Windows\System\HatvHfX.exe
  C:\Windows\System\HatvHfX.exe
  2⤵
  PID:4992
- C:\Windows\System\akpChJx.exe
  C:\Windows\System\akpChJx.exe
  2⤵
  PID:5056
- C:\Windows\System\DPUkbiv.exe
  C:\Windows\System\DPUkbiv.exe
  2⤵
  PID:1048
- C:\Windows\System\nkEIKYs.exe
  C:\Windows\System\nkEIKYs.exe
  2⤵
  PID:1716
- C:\Windows\System\ftjjvtC.exe
  C:\Windows\System\ftjjvtC.exe
  2⤵
  PID:2836
- C:\Windows\System\BYiQXhD.exe
  C:\Windows\System\BYiQXhD.exe
  2⤵
  PID:2444
- C:\Windows\System\vWOYrVo.exe
  C:\Windows\System\vWOYrVo.exe
  2⤵
  PID:3224
- C:\Windows\System\DHUFBFD.exe
  C:\Windows\System\DHUFBFD.exe
  2⤵
  PID:3484
- C:\Windows\System\jWYXrqO.exe
  C:\Windows\System\jWYXrqO.exe
  2⤵
  PID:3780
- C:\Windows\System\hXqPyXq.exe
  C:\Windows\System\hXqPyXq.exe
  2⤵
  PID:3976
- C:\Windows\System\KAlMhdQ.exe
  C:\Windows\System\KAlMhdQ.exe
  2⤵
  PID:4220
- C:\Windows\System\OdrZpJA.exe
  C:\Windows\System\OdrZpJA.exe
  2⤵
  PID:4476
- C:\Windows\System\zesmuuH.exe
  C:\Windows\System\zesmuuH.exe
  2⤵
  PID:5136
- C:\Windows\System\NNVfpZS.exe
  C:\Windows\System\NNVfpZS.exe
  2⤵
  PID:5152
- C:\Windows\System\fOqcoqQ.exe
  C:\Windows\System\fOqcoqQ.exe
  2⤵
  PID:5168
- C:\Windows\System\nldkNXN.exe
  C:\Windows\System\nldkNXN.exe
  2⤵
  PID:5184
- C:\Windows\System\FIVsqCR.exe
  C:\Windows\System\FIVsqCR.exe
  2⤵
  PID:5200
- C:\Windows\System\eWtHbrP.exe
  C:\Windows\System\eWtHbrP.exe
  2⤵
  PID:5216
- C:\Windows\System\bLgCxhe.exe
  C:\Windows\System\bLgCxhe.exe
  2⤵
  PID:5232
- C:\Windows\System\ZKBpdXc.exe
  C:\Windows\System\ZKBpdXc.exe
  2⤵
  PID:5248
- C:\Windows\System\JFEXeaq.exe
  C:\Windows\System\JFEXeaq.exe
  2⤵
  PID:5264
- C:\Windows\System\AjBRJMB.exe
  C:\Windows\System\AjBRJMB.exe
  2⤵
  PID:5280
- C:\Windows\System\ydnXRAK.exe
  C:\Windows\System\ydnXRAK.exe
  2⤵
  PID:5296
- C:\Windows\System\aHnFtpB.exe
  C:\Windows\System\aHnFtpB.exe
  2⤵
  PID:5312
- C:\Windows\System\LeGvMbc.exe
  C:\Windows\System\LeGvMbc.exe
  2⤵
  PID:5328
- C:\Windows\System\ZyaFJmQ.exe
  C:\Windows\System\ZyaFJmQ.exe
  2⤵
  PID:5344
- C:\Windows\System\WCKElFR.exe
  C:\Windows\System\WCKElFR.exe
  2⤵
  PID:5360
- C:\Windows\System\UAsRqOa.exe
  C:\Windows\System\UAsRqOa.exe
  2⤵
  PID:5376
- C:\Windows\System\yYgDXol.exe
  C:\Windows\System\yYgDXol.exe
  2⤵
  PID:5392
- C:\Windows\System\xbvnsXF.exe
  C:\Windows\System\xbvnsXF.exe
  2⤵
  PID:5408
- C:\Windows\System\zfsmmZm.exe
  C:\Windows\System\zfsmmZm.exe
  2⤵
  PID:5424
- C:\Windows\System\KSZjNnO.exe
  C:\Windows\System\KSZjNnO.exe
  2⤵
  PID:5440
- C:\Windows\System\HwDjiUh.exe
  C:\Windows\System\HwDjiUh.exe
  2⤵
  PID:5460
- C:\Windows\System\rJeuTUc.exe
  C:\Windows\System\rJeuTUc.exe
  2⤵
  PID:5488
- C:\Windows\System\cYmzWkM.exe
  C:\Windows\System\cYmzWkM.exe
  2⤵
  PID:5512
- C:\Windows\System\TpmtOjZ.exe
  C:\Windows\System\TpmtOjZ.exe
  2⤵
  PID:5540
- C:\Windows\System\mffEMCk.exe
  C:\Windows\System\mffEMCk.exe
  2⤵
  PID:5556
- C:\Windows\System\rxmSKaR.exe
  C:\Windows\System\rxmSKaR.exe
  2⤵
  PID:5572
- C:\Windows\System\ogOXbib.exe
  C:\Windows\System\ogOXbib.exe
  2⤵
  PID:5588
- C:\Windows\System\whmDlJK.exe
  C:\Windows\System\whmDlJK.exe
  2⤵
  PID:5604
- C:\Windows\System\DAsWjSD.exe
  C:\Windows\System\DAsWjSD.exe
  2⤵
  PID:5620
- C:\Windows\System\awuyqbr.exe
  C:\Windows\System\awuyqbr.exe
  2⤵
  PID:5636
- C:\Windows\System\sFFaCko.exe
  C:\Windows\System\sFFaCko.exe
  2⤵
  PID:5652
- C:\Windows\System\HoJvGkX.exe
  C:\Windows\System\HoJvGkX.exe
  2⤵
  PID:5668
- C:\Windows\System\FnCvIQS.exe
  C:\Windows\System\FnCvIQS.exe
  2⤵
  PID:5684
- C:\Windows\System\VvWkiKp.exe
  C:\Windows\System\VvWkiKp.exe
  2⤵
  PID:5700
- C:\Windows\System\unUNuPB.exe
  C:\Windows\System\unUNuPB.exe
  2⤵
  PID:5724
- C:\Windows\System\LxHkaJr.exe
  C:\Windows\System\LxHkaJr.exe
  2⤵
  PID:5740
- C:\Windows\System\TKengbF.exe
  C:\Windows\System\TKengbF.exe
  2⤵
  PID:5756
- C:\Windows\System\eqVNdJl.exe
  C:\Windows\System\eqVNdJl.exe
  2⤵
  PID:5772
- C:\Windows\System\DKbUbIf.exe
  C:\Windows\System\DKbUbIf.exe
  2⤵
  PID:5788
- C:\Windows\System\iFpCnAb.exe
  C:\Windows\System\iFpCnAb.exe
  2⤵
  PID:5804
- C:\Windows\System\SPBSeuA.exe
  C:\Windows\System\SPBSeuA.exe
  2⤵
  PID:5820
- C:\Windows\System\imkqauR.exe
  C:\Windows\System\imkqauR.exe
  2⤵
  PID:5836
- C:\Windows\System\RNKDZXX.exe
  C:\Windows\System\RNKDZXX.exe
  2⤵
  PID:5864
- C:\Windows\System\EiaaTJE.exe
  C:\Windows\System\EiaaTJE.exe
  2⤵
  PID:5896
- C:\Windows\System\ydCUnbW.exe
  C:\Windows\System\ydCUnbW.exe
  2⤵
  PID:5924
- C:\Windows\System\qFOmvMQ.exe
  C:\Windows\System\qFOmvMQ.exe
  2⤵
  PID:5960
- C:\Windows\System\fqzoekR.exe
  C:\Windows\System\fqzoekR.exe
  2⤵
  PID:5980
- C:\Windows\System\hacQBse.exe
  C:\Windows\System\hacQBse.exe
  2⤵
  PID:6004
- C:\Windows\System\VmEdkXV.exe
  C:\Windows\System\VmEdkXV.exe
  2⤵
  PID:6032
- C:\Windows\System\wIodzFx.exe
  C:\Windows\System\wIodzFx.exe
  2⤵
  PID:6056
- C:\Windows\System\YrvZZQD.exe
  C:\Windows\System\YrvZZQD.exe
  2⤵
  PID:6084
- C:\Windows\System\DGlGkgd.exe
  C:\Windows\System\DGlGkgd.exe
  2⤵
  PID:6116
- C:\Windows\System\VOOjKoi.exe
  C:\Windows\System\VOOjKoi.exe
  2⤵
  PID:6136
- C:\Windows\System\oJKRbLF.exe
  C:\Windows\System\oJKRbLF.exe
  2⤵
  PID:4704
- C:\Windows\System\XxrloFF.exe
  C:\Windows\System\XxrloFF.exe
  2⤵
  PID:4960
- C:\Windows\System\UVEIlWI.exe
  C:\Windows\System\UVEIlWI.exe
  2⤵
  PID:1816
- C:\Windows\System\jwtdFlv.exe
  C:\Windows\System\jwtdFlv.exe
  2⤵
  PID:3096
- C:\Windows\System\GXlQmYX.exe
  C:\Windows\System\GXlQmYX.exe
  2⤵
  PID:4192
- C:\Windows\System\SzfVmIq.exe
  C:\Windows\System\SzfVmIq.exe
  2⤵
  PID:5164
- C:\Windows\System\JbQqeoP.exe
  C:\Windows\System\JbQqeoP.exe
  2⤵
  PID:5228
- C:\Windows\System\XGYfRcY.exe
  C:\Windows\System\XGYfRcY.exe
  2⤵
  PID:5292
- C:\Windows\System\fmPQFTE.exe
  C:\Windows\System\fmPQFTE.exe
  2⤵
  PID:5356
- C:\Windows\System\qqQETgG.exe
  C:\Windows\System\qqQETgG.exe
  2⤵
  PID:5416
- C:\Windows\System\wMnCuAU.exe
  C:\Windows\System\wMnCuAU.exe
  2⤵
  PID:5452
- C:\Windows\System\kUqAHYS.exe
  C:\Windows\System\kUqAHYS.exe
  2⤵
  PID:5500
- C:\Windows\System\AzmjyAD.exe
  C:\Windows\System\AzmjyAD.exe
  2⤵
  PID:5584
- C:\Windows\System\UmUrsWy.exe
  C:\Windows\System\UmUrsWy.exe
  2⤵
  PID:6020
- C:\Windows\System\gbDVvtZ.exe
  C:\Windows\System\gbDVvtZ.exe
  2⤵
  PID:6168
- C:\Windows\System\QuWikGY.exe
  C:\Windows\System\QuWikGY.exe
  2⤵
  PID:6272
- C:\Windows\System\PLPcjBe.exe
  C:\Windows\System\PLPcjBe.exe
  2⤵
  PID:6288
- C:\Windows\System\yVhXTpq.exe
  C:\Windows\System\yVhXTpq.exe
  2⤵
  PID:6332
- C:\Windows\System\eRQLWKO.exe
  C:\Windows\System\eRQLWKO.exe
  2⤵
  PID:6372
- C:\Windows\System\KJzBcfO.exe
  C:\Windows\System\KJzBcfO.exe
  2⤵
  PID:6464
- C:\Windows\System\kzUWaQM.exe
  C:\Windows\System\kzUWaQM.exe
  2⤵
  PID:6564
- C:\Windows\System\LEjlxqF.exe
  C:\Windows\System\LEjlxqF.exe
  2⤵
  PID:6580
- C:\Windows\System\nlmnHjW.exe
  C:\Windows\System\nlmnHjW.exe
  2⤵
  PID:6656
- C:\Windows\System\ropgAHs.exe
  C:\Windows\System\ropgAHs.exe
  2⤵
  PID:6684
- C:\Windows\System\ByInZHB.exe
  C:\Windows\System\ByInZHB.exe
  2⤵
  PID:6704
- C:\Windows\System\qFgFlGR.exe
  C:\Windows\System\qFgFlGR.exe
  2⤵
  PID:6720
- C:\Windows\System\BATWAKj.exe
  C:\Windows\System\BATWAKj.exe
  2⤵
  PID:6748
- C:\Windows\System\HuzoCjP.exe
  C:\Windows\System\HuzoCjP.exe
  2⤵
  PID:6796
- C:\Windows\System\wYUBNEV.exe
  C:\Windows\System\wYUBNEV.exe
  2⤵
  PID:6840
- C:\Windows\System\QfZXfTi.exe
  C:\Windows\System\QfZXfTi.exe
  2⤵
  PID:6876
- C:\Windows\System\ZJYJaGW.exe
  C:\Windows\System\ZJYJaGW.exe
  2⤵
  PID:7020
- C:\Windows\System\obvtlZR.exe
  C:\Windows\System\obvtlZR.exe
  2⤵
  PID:7052
- C:\Windows\System\bcCRAkb.exe
  C:\Windows\System\bcCRAkb.exe
  2⤵
  PID:7120
- C:\Windows\System\fRpeyCr.exe
  C:\Windows\System\fRpeyCr.exe
  2⤵
  PID:7144
- C:\Windows\System\OUXlzfz.exe
  C:\Windows\System\OUXlzfz.exe
  2⤵
  PID:7164
- C:\Windows\System\NyysbTu.exe
  C:\Windows\System\NyysbTu.exe
  2⤵
  PID:5680
- C:\Windows\System\VNTmGWL.exe
  C:\Windows\System\VNTmGWL.exe
  2⤵
  PID:5752
- C:\Windows\System\dTmcBUt.exe
  C:\Windows\System\dTmcBUt.exe
  2⤵
  PID:5852
- C:\Windows\System\AjZMdXN.exe
  C:\Windows\System\AjZMdXN.exe
  2⤵
  PID:5920
- C:\Windows\System\EFgCrJj.exe
  C:\Windows\System\EFgCrJj.exe
  2⤵
  PID:5976
- C:\Windows\System\ZLHavXj.exe
  C:\Windows\System\ZLHavXj.exe
  2⤵
  PID:2652
- C:\Windows\System\hPKuOFh.exe
  C:\Windows\System\hPKuOFh.exe
  2⤵
  PID:6180
- C:\Windows\System\VpFakWU.exe
  C:\Windows\System\VpFakWU.exe
  2⤵
  PID:6196
- C:\Windows\System\EqnZACS.exe
  C:\Windows\System\EqnZACS.exe
  2⤵
  PID:6208
- C:\Windows\System\CNTWEgn.exe
  C:\Windows\System\CNTWEgn.exe
  2⤵
  PID:6232
- C:\Windows\System\Qjfimrc.exe
  C:\Windows\System\Qjfimrc.exe
  2⤵
  PID:4348
- C:\Windows\System\cbdHJTc.exe
  C:\Windows\System\cbdHJTc.exe
  2⤵
  PID:5596
- C:\Windows\System\IHfiNPl.exe
  C:\Windows\System\IHfiNPl.exe
  2⤵
  PID:5736
- C:\Windows\System\qptrYaT.exe
  C:\Windows\System\qptrYaT.exe
  2⤵
  PID:5932
- C:\Windows\System\ITQiJzD.exe
  C:\Windows\System\ITQiJzD.exe
  2⤵
  PID:5116
- C:\Windows\System\VFmTyiD.exe
  C:\Windows\System\VFmTyiD.exe
  2⤵
  PID:5456
- C:\Windows\System\CjCekcG.exe
  C:\Windows\System\CjCekcG.exe
  2⤵
  PID:1916
- C:\Windows\System\YPNDEVa.exe
  C:\Windows\System\YPNDEVa.exe
  2⤵
  PID:3028
- C:\Windows\System\oewmcsp.exe
  C:\Windows\System\oewmcsp.exe
  2⤵
  PID:2800
- C:\Windows\System\upzMTiI.exe
  C:\Windows\System\upzMTiI.exe
  2⤵
  PID:2500
- C:\Windows\System\vviQuMY.exe
  C:\Windows\System\vviQuMY.exe
  2⤵
  PID:3176
- C:\Windows\System\GFImLND.exe
  C:\Windows\System\GFImLND.exe
  2⤵
  PID:2668
- C:\Windows\System\gCjAEvQ.exe
  C:\Windows\System\gCjAEvQ.exe
  2⤵
  PID:6296
- C:\Windows\System\aYfyXAI.exe
  C:\Windows\System\aYfyXAI.exe
  2⤵
  PID:2080
- C:\Windows\System\gtxOmZv.exe
  C:\Windows\System\gtxOmZv.exe
  2⤵
  PID:3728
- C:\Windows\System\qcuvXCi.exe
  C:\Windows\System\qcuvXCi.exe
  2⤵
  PID:3756
- C:\Windows\System\ByVkjrA.exe
  C:\Windows\System\ByVkjrA.exe
  2⤵
  PID:3240
- C:\Windows\System\adsmzMT.exe
  C:\Windows\System\adsmzMT.exe
  2⤵
  PID:3340
- C:\Windows\System\hzhCwJz.exe
  C:\Windows\System\hzhCwJz.exe
  2⤵
  PID:3464
- C:\Windows\System\uygrKyT.exe
  C:\Windows\System\uygrKyT.exe
  2⤵
  PID:3532
- C:\Windows\System\lotZlwV.exe
  C:\Windows\System\lotZlwV.exe
  2⤵
  PID:3628
- C:\Windows\System\wpKXMfd.exe
  C:\Windows\System\wpKXMfd.exe
  2⤵
  PID:3816
- C:\Windows\System\CPJYNyu.exe
  C:\Windows\System\CPJYNyu.exe
  2⤵
  PID:3884
- C:\Windows\System\CgLsoaV.exe
  C:\Windows\System\CgLsoaV.exe
  2⤵
  PID:4028
- C:\Windows\System\ZjyXotP.exe
  C:\Windows\System\ZjyXotP.exe
  2⤵
  PID:2056
- C:\Windows\System\LmCMRlV.exe
  C:\Windows\System\LmCMRlV.exe
  2⤵
  PID:4204
- C:\Windows\System\ifiywSO.exe
  C:\Windows\System\ifiywSO.exe
  2⤵
  PID:4240
- C:\Windows\System\OwwTHUR.exe
  C:\Windows\System\OwwTHUR.exe
  2⤵
  PID:4304
- C:\Windows\System\cVevSSp.exe
  C:\Windows\System\cVevSSp.exe
  2⤵
  PID:4364
- C:\Windows\System\VETaHOm.exe
  C:\Windows\System\VETaHOm.exe
  2⤵
  PID:4432
- C:\Windows\System\RBefKhR.exe
  C:\Windows\System\RBefKhR.exe
  2⤵
  PID:4492
- C:\Windows\System\YUWhzCR.exe
  C:\Windows\System\YUWhzCR.exe
  2⤵
  PID:4592
- C:\Windows\System\SKMKluv.exe
  C:\Windows\System\SKMKluv.exe
  2⤵
  PID:4656
- C:\Windows\System\KZiqjQs.exe
  C:\Windows\System\KZiqjQs.exe
  2⤵
  PID:4720
- C:\Windows\System\UdfeVyk.exe
  C:\Windows\System\UdfeVyk.exe
  2⤵
  PID:4780
- C:\Windows\System\hwJSxQI.exe
  C:\Windows\System\hwJSxQI.exe
  2⤵
  PID:4880
- C:\Windows\System\PVCmxwH.exe
  C:\Windows\System\PVCmxwH.exe
  2⤵
  PID:4940
- C:\Windows\System\OeqyDeG.exe
  C:\Windows\System\OeqyDeG.exe
  2⤵
  PID:5004
- C:\Windows\System\XVcDHiB.exe
  C:\Windows\System\XVcDHiB.exe
  2⤵
  PID:5036
- C:\Windows\System\LlmySUw.exe
  C:\Windows\System\LlmySUw.exe
  2⤵
  PID:452
- C:\Windows\System\AWMITVf.exe
  C:\Windows\System\AWMITVf.exe
  2⤵
  PID:1432
- C:\Windows\System\XXqGDmd.exe
  C:\Windows\System\XXqGDmd.exe
  2⤵
  PID:1560
- C:\Windows\System\hbGAhzN.exe
  C:\Windows\System\hbGAhzN.exe
  2⤵
  PID:3132
- C:\Windows\System\ZlyuKeS.exe
  C:\Windows\System\ZlyuKeS.exe
  2⤵
  PID:3388
- C:\Windows\System\PpClyTq.exe
  C:\Windows\System\PpClyTq.exe
  2⤵
  PID:3692
- C:\Windows\System\UYplSFi.exe
  C:\Windows\System\UYplSFi.exe
  2⤵
  PID:3904
- C:\Windows\System\VXXaYHt.exe
  C:\Windows\System\VXXaYHt.exe
  2⤵
  PID:5024
- C:\Windows\System\WrJFhlP.exe
  C:\Windows\System\WrJFhlP.exe
  2⤵
  PID:2540
- C:\Windows\System\VSUEmTF.exe
  C:\Windows\System\VSUEmTF.exe
  2⤵
  PID:5144
- C:\Windows\System\HoYmSON.exe
  C:\Windows\System\HoYmSON.exe
  2⤵
  PID:5208
- C:\Windows\System\jHiJQCq.exe
  C:\Windows\System\jHiJQCq.exe
  2⤵
  PID:5272
- C:\Windows\System\DjTcPeK.exe
  C:\Windows\System\DjTcPeK.exe
  2⤵
  PID:5368
- C:\Windows\System\ELKurdr.exe
  C:\Windows\System\ELKurdr.exe
  2⤵
  PID:5476
- C:\Windows\System\fwXTsOe.exe
  C:\Windows\System\fwXTsOe.exe
  2⤵
  PID:5528
- C:\Windows\System\ltqFQlP.exe
  C:\Windows\System\ltqFQlP.exe
  2⤵
  PID:5732
- C:\Windows\System\FGXBHPT.exe
  C:\Windows\System\FGXBHPT.exe
  2⤵
  PID:5892
- C:\Windows\System\OtPreXd.exe
  C:\Windows\System\OtPreXd.exe
  2⤵
  PID:5952
- C:\Windows\System\FwGmjSP.exe
  C:\Windows\System\FwGmjSP.exe
  2⤵
  PID:6000
- C:\Windows\System\ggkogNV.exe
  C:\Windows\System\ggkogNV.exe
  2⤵
  PID:6092
- C:\Windows\System\XZVHudm.exe
  C:\Windows\System\XZVHudm.exe
  2⤵
  PID:6112
- C:\Windows\System\RbGkOBq.exe
  C:\Windows\System\RbGkOBq.exe
  2⤵
  PID:3612
- C:\Windows\System\twIblMK.exe
  C:\Windows\System\twIblMK.exe
  2⤵
  PID:2924
- C:\Windows\System\sBSMeZo.exe
  C:\Windows\System\sBSMeZo.exe
  2⤵
  PID:2916
- C:\Windows\System\qsOhxKK.exe
  C:\Windows\System\qsOhxKK.exe
  2⤵
  PID:6080
- C:\Windows\System\uHLQdwD.exe
  C:\Windows\System\uHLQdwD.exe
  2⤵
  PID:2288
- C:\Windows\System\KRwbanF.exe
  C:\Windows\System\KRwbanF.exe
  2⤵
  PID:4828
- C:\Windows\System\UByUfSl.exe
  C:\Windows\System\UByUfSl.exe
  2⤵
  PID:2864
- C:\Windows\System\CLPKtUU.exe
  C:\Windows\System\CLPKtUU.exe
  2⤵
  PID:5260
- C:\Windows\System\sVgvzXl.exe
  C:\Windows\System\sVgvzXl.exe
  2⤵
  PID:2712
- C:\Windows\System\VjleNbZ.exe
  C:\Windows\System\VjleNbZ.exe
  2⤵
  PID:2436
- C:\Windows\System\jGrvVQr.exe
  C:\Windows\System\jGrvVQr.exe
  2⤵
  PID:2852
- C:\Windows\System\nqpqrXo.exe
  C:\Windows\System\nqpqrXo.exe
  2⤵
  PID:2868
- C:\Windows\System\fWPhpOq.exe
  C:\Windows\System\fWPhpOq.exe
  2⤵
  PID:292
- C:\Windows\System\hZBTKgf.exe
  C:\Windows\System\hZBTKgf.exe
  2⤵
  PID:3004
- C:\Windows\System\GTWPhyw.exe
  C:\Windows\System\GTWPhyw.exe
  2⤵
  PID:2680
- C:\Windows\System\BkDaNJW.exe
  C:\Windows\System\BkDaNJW.exe
  2⤵
  PID:1700
- C:\Windows\System\PLjbyaM.exe
  C:\Windows\System\PLjbyaM.exe
  2⤵
  PID:1088
- C:\Windows\System\EkBTajz.exe
  C:\Windows\System\EkBTajz.exe
  2⤵
  PID:6164
- C:\Windows\System\YAARPlA.exe
  C:\Windows\System\YAARPlA.exe
  2⤵
  PID:6380
- C:\Windows\System\Dpqxgzc.exe
  C:\Windows\System\Dpqxgzc.exe
  2⤵
  PID:6344
- C:\Windows\System\ehIPzgB.exe
  C:\Windows\System\ehIPzgB.exe
  2⤵
  PID:6364
- C:\Windows\System\NbRWTlr.exe
  C:\Windows\System\NbRWTlr.exe
  2⤵
  PID:6448
- C:\Windows\System\TGgzTah.exe
  C:\Windows\System\TGgzTah.exe
  2⤵
  PID:6456
- C:\Windows\System\UisPQTh.exe
  C:\Windows\System\UisPQTh.exe
  2⤵
  PID:6476
- C:\Windows\System\xxyPOqe.exe
  C:\Windows\System\xxyPOqe.exe
  2⤵
  PID:6492
- C:\Windows\System\iGcpHYf.exe
  C:\Windows\System\iGcpHYf.exe
  2⤵
  PID:6508
- C:\Windows\System\GlSTrtN.exe
  C:\Windows\System\GlSTrtN.exe
  2⤵
  PID:6516
- C:\Windows\System\rWlFvwr.exe
  C:\Windows\System\rWlFvwr.exe
  2⤵
  PID:6532
- C:\Windows\System\IjZKsXP.exe
  C:\Windows\System\IjZKsXP.exe
  2⤵
  PID:6548
- C:\Windows\System\qNJrznf.exe
  C:\Windows\System\qNJrznf.exe
  2⤵
  PID:6572
- C:\Windows\System\TXXwfjq.exe
  C:\Windows\System\TXXwfjq.exe
  2⤵
  PID:2576
- C:\Windows\System\tOLOjWR.exe
  C:\Windows\System\tOLOjWR.exe
  2⤵
  PID:6588
- C:\Windows\System\wuoVYVt.exe
  C:\Windows\System\wuoVYVt.exe
  2⤵
  PID:6604
- C:\Windows\System\cKGQhgw.exe
  C:\Windows\System\cKGQhgw.exe
  2⤵
  PID:6624
- C:\Windows\System\vOPCvHP.exe
  C:\Windows\System\vOPCvHP.exe
  2⤵
  PID:6640
- C:\Windows\System\PdOWZAp.exe
  C:\Windows\System\PdOWZAp.exe
  2⤵
  PID:6668
- C:\Windows\System\sOwSxVb.exe
  C:\Windows\System\sOwSxVb.exe
  2⤵
  PID:6712
- C:\Windows\System\MqSJBJv.exe
  C:\Windows\System\MqSJBJv.exe
  2⤵
  PID:6696
- C:\Windows\System\zzeVDxl.exe
  C:\Windows\System\zzeVDxl.exe
  2⤵
  PID:6764
- C:\Windows\System\jwxdFqA.exe
  C:\Windows\System\jwxdFqA.exe
  2⤵
  PID:6736
- C:\Windows\System\BmqIzvh.exe
  C:\Windows\System\BmqIzvh.exe
  2⤵
  PID:6732
- C:\Windows\System\LgzVoUS.exe
  C:\Windows\System\LgzVoUS.exe
  2⤵
  PID:6856
- C:\Windows\System\nkSjlCj.exe
  C:\Windows\System\nkSjlCj.exe
  2⤵
  PID:6816
- C:\Windows\System\YNIcfEh.exe
  C:\Windows\System\YNIcfEh.exe
  2⤵
  PID:2388
- C:\Windows\System\BkKgwaQ.exe
  C:\Windows\System\BkKgwaQ.exe
  2⤵
  PID:6872
- C:\Windows\System\ncnllfY.exe
  C:\Windows\System\ncnllfY.exe
  2⤵
  PID:6892
- C:\Windows\System\VIMOSif.exe
  C:\Windows\System\VIMOSif.exe
  2⤵
  PID:6904
- C:\Windows\System\coCtpOC.exe
  C:\Windows\System\coCtpOC.exe
  2⤵
  PID:6912
- C:\Windows\System\LgTjijV.exe
  C:\Windows\System\LgTjijV.exe
  2⤵
  PID:780
- C:\Windows\System\JnrXJwZ.exe
  C:\Windows\System\JnrXJwZ.exe
  2⤵
  PID:6940
- C:\Windows\System\icEBsCN.exe
  C:\Windows\System\icEBsCN.exe
  2⤵
  PID:6952
- C:\Windows\System\NTpHudV.exe
  C:\Windows\System\NTpHudV.exe
  2⤵
  PID:6964
- C:\Windows\System\KswerJn.exe
  C:\Windows\System\KswerJn.exe
  2⤵
  PID:6984
- C:\Windows\System\azSFrEs.exe
  C:\Windows\System\azSFrEs.exe
  2⤵
  PID:6996
- C:\Windows\System\UNAALKR.exe
  C:\Windows\System\UNAALKR.exe
  2⤵
  PID:7036
- C:\Windows\System\TVhIbyD.exe
  C:\Windows\System\TVhIbyD.exe
  2⤵
  PID:7016
- C:\Windows\System\wirudnR.exe
  C:\Windows\System\wirudnR.exe
  2⤵
  PID:7072
- C:\Windows\System\WWWAdUn.exe
  C:\Windows\System\WWWAdUn.exe
  2⤵
  PID:7080
- C:\Windows\System\ZDXizlY.exe
  C:\Windows\System\ZDXizlY.exe
  2⤵
  PID:7128
- C:\Windows\System\gGKuMuh.exe
  C:\Windows\System\gGKuMuh.exe
  2⤵
  PID:7096
- C:\Windows\System\TjxOhNB.exe
  C:\Windows\System\TjxOhNB.exe
  2⤵
  PID:7112
- C:\Windows\System\xVXFQDF.exe
  C:\Windows\System\xVXFQDF.exe
  2⤵
  PID:7152
- C:\Windows\System\msfhdAf.exe
  C:\Windows\System\msfhdAf.exe
  2⤵
  PID:5676
- C:\Windows\System\uHAUHQb.exe
  C:\Windows\System\uHAUHQb.exe
  2⤵
  PID:5716
- C:\Windows\System\KNURrhF.exe
  C:\Windows\System\KNURrhF.exe
  2⤵
  PID:5848
- C:\Windows\System\CJDCfmh.exe
  C:\Windows\System\CJDCfmh.exe
  2⤵
  PID:5912
- C:\Windows\System\roVgXCV.exe
  C:\Windows\System\roVgXCV.exe
  2⤵
  PID:2492
- C:\Windows\System\ssBbrLm.exe
  C:\Windows\System\ssBbrLm.exe
  2⤵
  PID:6200
- C:\Windows\System\wTwuiYo.exe
  C:\Windows\System\wTwuiYo.exe
  2⤵
  PID:6204
- C:\Windows\System\HCJvFNJ.exe
  C:\Windows\System\HCJvFNJ.exe
  2⤵
  PID:1996
- C:\Windows\System\SKSEKuz.exe
  C:\Windows\System\SKSEKuz.exe
  2⤵
  PID:2532
- C:\Windows\System\qVhhlMg.exe
  C:\Windows\System\qVhhlMg.exe
  2⤵
  PID:2952
- C:\Windows\System\uhUqJZE.exe
  C:\Windows\System\uhUqJZE.exe
  2⤵
  PID:1428
- C:\Windows\System\bSUUQTg.exe
  C:\Windows\System\bSUUQTg.exe
  2⤵
  PID:5468
- C:\Windows\System\YteNEhD.exe
  C:\Windows\System\YteNEhD.exe
  2⤵
  PID:5524
- C:\Windows\System\pWccqJo.exe
  C:\Windows\System\pWccqJo.exe
  2⤵
  PID:5828
- C:\Windows\System\iVotYlL.exe
  C:\Windows\System\iVotYlL.exe
  2⤵
  PID:1008
- C:\Windows\System\foFLPzl.exe
  C:\Windows\System\foFLPzl.exe
  2⤵
  PID:5196
- C:\Windows\System\jtUlfXU.exe
  C:\Windows\System\jtUlfXU.exe
  2⤵
  PID:1580
- C:\Windows\System\FnzImGH.exe
  C:\Windows\System\FnzImGH.exe
  2⤵
  PID:5968
- C:\Windows\System\sSZRZMx.exe
  C:\Windows\System\sSZRZMx.exe
  2⤵
  PID:2384
- C:\Windows\System\wduCEqY.exe
  C:\Windows\System\wduCEqY.exe
  2⤵
  PID:2612
- C:\Windows\System\wDPbSag.exe
  C:\Windows\System\wDPbSag.exe
  2⤵
  PID:2724
- C:\Windows\System\dUatgoH.exe
  C:\Windows\System\dUatgoH.exe
  2⤵
  PID:2176
- C:\Windows\System\XPYwyPY.exe
  C:\Windows\System\XPYwyPY.exe
  2⤵
  PID:3724
- C:\Windows\System\bSveyIv.exe
  C:\Windows\System\bSveyIv.exe
  2⤵
  PID:1324
- C:\Windows\System\jTarnis.exe
  C:\Windows\System\jTarnis.exe
  2⤵
  PID:4208
- C:\Windows\System\OCVvIRr.exe
  C:\Windows\System\OCVvIRr.exe
  2⤵
  PID:3336
- C:\Windows\System\fDucPII.exe
  C:\Windows\System\fDucPII.exe
  2⤵
  PID:3404
- C:\Windows\System\WcQtqEG.exe
  C:\Windows\System\WcQtqEG.exe
  2⤵
  PID:3468
- C:\Windows\System\yrwbAiz.exe
  C:\Windows\System\yrwbAiz.exe
  2⤵
  PID:3596
- C:\Windows\System\TKuiqWb.exe
  C:\Windows\System\TKuiqWb.exe
  2⤵
  PID:3888
- C:\Windows\System\zfKtKny.exe
  C:\Windows\System\zfKtKny.exe
  2⤵
  PID:3676
- C:\Windows\System\cYUaOrk.exe
  C:\Windows\System\cYUaOrk.exe
  2⤵
  PID:3852
- C:\Windows\System\NkDQyMj.exe
  C:\Windows\System\NkDQyMj.exe
  2⤵
  PID:3920
- C:\Windows\System\sQqNlLw.exe
  C:\Windows\System\sQqNlLw.exe
  2⤵
  PID:4100
- C:\Windows\System\SsAJLjT.exe
  C:\Windows\System\SsAJLjT.exe
  2⤵
  PID:4460
- C:\Windows\System\FqnlnCo.exe
  C:\Windows\System\FqnlnCo.exe
  2⤵
  PID:4784
- C:\Windows\System\xDIqiSU.exe
  C:\Windows\System\xDIqiSU.exe
  2⤵
  PID:5072
- C:\Windows\System\AVQWXFZ.exe
  C:\Windows\System\AVQWXFZ.exe
  2⤵
  PID:3160
- C:\Windows\System\OJqLHBf.exe
  C:\Windows\System\OJqLHBf.exe
  2⤵
  PID:4368
- C:\Windows\System\xrrjVfs.exe
  C:\Windows\System\xrrjVfs.exe
  2⤵
  PID:4148
- C:\Windows\System\UOxrSIL.exe
  C:\Windows\System\UOxrSIL.exe
  2⤵
  PID:4104
- C:\Windows\System\CwuwwJU.exe
  C:\Windows\System\CwuwwJU.exe
  2⤵
  PID:4268
- C:\Windows\System\WhhkhKg.exe
  C:\Windows\System\WhhkhKg.exe
  2⤵
  PID:4560
- C:\Windows\System\uIMGhLL.exe
  C:\Windows\System\uIMGhLL.exe
  2⤵
  PID:4816
- C:\Windows\System\sfeXVsx.exe
  C:\Windows\System\sfeXVsx.exe
  2⤵
  PID:5008
- C:\Windows\System\rqcekcK.exe
  C:\Windows\System\rqcekcK.exe
  2⤵
  PID:2728
- C:\Windows\System\OulwuUs.exe
  C:\Windows\System\OulwuUs.exe
  2⤵
  PID:5948
- C:\Windows\System\sFdNhhi.exe
  C:\Windows\System\sFdNhhi.exe
  2⤵
  PID:5996
- C:\Windows\System\MSAbGQf.exe
  C:\Windows\System\MSAbGQf.exe
  2⤵
  PID:5180
- C:\Windows\System\IXLQXgZ.exe
  C:\Windows\System\IXLQXgZ.exe
  2⤵
  PID:5404
- C:\Windows\System\lTIsfnB.exe
  C:\Windows\System\lTIsfnB.exe
  2⤵
  PID:4448
- C:\Windows\System\FbXfznm.exe
  C:\Windows\System\FbXfznm.exe
  2⤵
  PID:2144
- C:\Windows\System\cgeUZCx.exe
  C:\Windows\System\cgeUZCx.exe
  2⤵
  PID:656
- C:\Windows\System\LFchHml.exe
  C:\Windows\System\LFchHml.exe
  2⤵
  PID:944
- C:\Windows\System\bCRNXFs.exe
  C:\Windows\System\bCRNXFs.exe
  2⤵
  PID:5088
- C:\Windows\System\llwwDAh.exe
  C:\Windows\System\llwwDAh.exe
  2⤵
  PID:6284
- C:\Windows\System\wMRtqio.exe
  C:\Windows\System\wMRtqio.exe
  2⤵
  PID:5632
- C:\Windows\System\EWsIDvY.exe
  C:\Windows\System\EWsIDvY.exe
  2⤵
  PID:4512
- C:\Windows\System\NvjwCYz.exe
  C:\Windows\System\NvjwCYz.exe
  2⤵
  PID:5552
- C:\Windows\System\bBosfrl.exe
  C:\Windows\System\bBosfrl.exe
  2⤵
  PID:2568
- C:\Windows\System\RYqQZaj.exe
  C:\Windows\System\RYqQZaj.exe
  2⤵
  PID:992
- C:\Windows\System\EOQmJyb.exe
  C:\Windows\System\EOQmJyb.exe
  2⤵
  PID:3080
- C:\Windows\System\QoUVivn.exe
  C:\Windows\System\QoUVivn.exe
  2⤵
  PID:1160
- C:\Windows\System\imBkGGx.exe
  C:\Windows\System\imBkGGx.exe
  2⤵
  PID:6432
- C:\Windows\System\mSlQiiO.exe
  C:\Windows\System\mSlQiiO.exe
  2⤵
  PID:6396
- C:\Windows\System\BccCeSw.exe
  C:\Windows\System\BccCeSw.exe
  2⤵
  PID:6328
- C:\Windows\System\xMKRDZd.exe
  C:\Windows\System\xMKRDZd.exe
  2⤵
  PID:6408
- C:\Windows\System\XbgpoEx.exe
  C:\Windows\System\XbgpoEx.exe
  2⤵
  PID:2408
- C:\Windows\System\HjRtNEy.exe
  C:\Windows\System\HjRtNEy.exe
  2⤵
  PID:1244
- C:\Windows\System\wjfsdUP.exe
  C:\Windows\System\wjfsdUP.exe
  2⤵
  PID:6484
- C:\Windows\System\CeSJRdB.exe
  C:\Windows\System\CeSJRdB.exe
  2⤵
  PID:6540
- C:\Windows\System\tPXVekU.exe
  C:\Windows\System\tPXVekU.exe
  2⤵
  PID:6632
- C:\Windows\System\enATIVm.exe
  C:\Windows\System\enATIVm.exe
  2⤵
  PID:6756
- C:\Windows\System\GndAfuc.exe
  C:\Windows\System\GndAfuc.exe
  2⤵
  PID:6808
- C:\Windows\System\KTibUAI.exe
  C:\Windows\System\KTibUAI.exe
  2⤵
  PID:6472
- C:\Windows\System\gzGEEjo.exe
  C:\Windows\System\gzGEEjo.exe
  2⤵
  PID:6556
- C:\Windows\System\FgivoQO.exe
  C:\Windows\System\FgivoQO.exe
  2⤵
  PID:2820
- C:\Windows\System\uJGxJeE.exe
  C:\Windows\System\uJGxJeE.exe
  2⤵
  PID:6976
- C:\Windows\System\yptCNPu.exe
  C:\Windows\System\yptCNPu.exe
  2⤵
  PID:7064
- C:\Windows\System\WiucGgy.exe
  C:\Windows\System\WiucGgy.exe
  2⤵
  PID:7104
- C:\Windows\System\fsSFKDa.exe
  C:\Windows\System\fsSFKDa.exe
  2⤵
  PID:7028
- C:\Windows\System\dVhqVAE.exe
  C:\Windows\System\dVhqVAE.exe
  2⤵
  PID:2752
- C:\Windows\System\vfThnmf.exe
  C:\Windows\System\vfThnmf.exe
  2⤵
  PID:2424
- C:\Windows\System\HkGgrIV.exe
  C:\Windows\System\HkGgrIV.exe
  2⤵
  PID:6504
- C:\Windows\System\bVQPDBn.exe
  C:\Windows\System\bVQPDBn.exe
  2⤵
  PID:6616
- C:\Windows\System\iBkbFUk.exe
  C:\Windows\System\iBkbFUk.exe
  2⤵
  PID:6716
- C:\Windows\System\chSJmrz.exe
  C:\Windows\System\chSJmrz.exe
  2⤵
  PID:5904
- C:\Windows\System\mbuEyce.exe
  C:\Windows\System\mbuEyce.exe
  2⤵
  PID:6888
- C:\Windows\System\yxvKuGc.exe
  C:\Windows\System\yxvKuGc.exe
  2⤵
  PID:6928
- C:\Windows\System\MKnImFv.exe
  C:\Windows\System\MKnImFv.exe
  2⤵
  PID:6188
- C:\Windows\System\sXJDRhb.exe
  C:\Windows\System\sXJDRhb.exe
  2⤵
  PID:6992
- C:\Windows\System\wNUImwH.exe
  C:\Windows\System\wNUImwH.exe
  2⤵
  PID:5816
- C:\Windows\System\akTbuAs.exe
  C:\Windows\System\akTbuAs.exe
  2⤵
  PID:1308
- C:\Windows\System\UXxRZTo.exe
  C:\Windows\System\UXxRZTo.exe
  2⤵
  PID:5884
- C:\Windows\System\nysxpdY.exe
  C:\Windows\System\nysxpdY.exe
  2⤵
  PID:6216
- C:\Windows\System\zjxVkYg.exe
  C:\Windows\System\zjxVkYg.exe
  2⤵
  PID:1868
- C:\Windows\System\qTLzlUR.exe
  C:\Windows\System\qTLzlUR.exe
  2⤵
  PID:2604
- C:\Windows\System\PdLxNVf.exe
  C:\Windows\System\PdLxNVf.exe
  2⤵
  PID:3744
- C:\Windows\System\HwQYVhd.exe
  C:\Windows\System\HwQYVhd.exe
  2⤵
  PID:3272
- C:\Windows\System\cjkJIzo.exe
  C:\Windows\System\cjkJIzo.exe
  2⤵
  PID:4056
- C:\Windows\System\GnDTsrk.exe
  C:\Windows\System\GnDTsrk.exe
  2⤵
  PID:2276
- C:\Windows\System\oGJYBqv.exe
  C:\Windows\System\oGJYBqv.exe
  2⤵
  PID:672
- C:\Windows\System\oolInvF.exe
  C:\Windows\System\oolInvF.exe
  2⤵
  PID:4944
- C:\Windows\System\DQBPfrJ.exe
  C:\Windows\System\DQBPfrJ.exe
  2⤵
  PID:3536
- C:\Windows\System\TyCUkXP.exe
  C:\Windows\System\TyCUkXP.exe
  2⤵
  PID:4332
- C:\Windows\System\QbFMJVX.exe
  C:\Windows\System\QbFMJVX.exe
  2⤵
  PID:4428
- C:\Windows\System\ZZzPQQx.exe
  C:\Windows\System\ZZzPQQx.exe
  2⤵
  PID:2984
- C:\Windows\System\omfqndq.exe
  C:\Windows\System\omfqndq.exe
  2⤵
  PID:4524
- C:\Windows\System\pxibbEe.exe
  C:\Windows\System\pxibbEe.exe
  2⤵
  PID:5988
- C:\Windows\System\wdsVJXS.exe
  C:\Windows\System\wdsVJXS.exe
  2⤵
  PID:5876
- C:\Windows\System\MnBxSxf.exe
  C:\Windows\System\MnBxSxf.exe
  2⤵
  PID:1504
- C:\Windows\System\pRwybRC.exe
  C:\Windows\System\pRwybRC.exe
  2⤵
  PID:3180
- C:\Windows\System\cKDfnbn.exe
  C:\Windows\System\cKDfnbn.exe
  2⤵
  PID:6132
- C:\Windows\System\BBxUHfz.exe
  C:\Windows\System\BBxUHfz.exe
  2⤵
  PID:5400
- C:\Windows\System\JVDsDHK.exe
  C:\Windows\System\JVDsDHK.exe
  2⤵
  PID:324
- C:\Windows\System\fwzHKtk.exe
  C:\Windows\System\fwzHKtk.exe
  2⤵
  PID:6440
- C:\Windows\System\atdYxXA.exe
  C:\Windows\System\atdYxXA.exe
  2⤵
  PID:6600
- C:\Windows\System\qciggKe.exe
  C:\Windows\System\qciggKe.exe
  2⤵
  PID:6424
- C:\Windows\System\coDAQCk.exe
  C:\Windows\System\coDAQCk.exe
  2⤵
  PID:7088
- C:\Windows\System\kasfUNZ.exe
  C:\Windows\System\kasfUNZ.exe
  2⤵
  PID:5812
- C:\Windows\System\RtKZNaF.exe
  C:\Windows\System\RtKZNaF.exe
  2⤵
  PID:6648
- C:\Windows\System\oMxisOg.exe
  C:\Windows\System\oMxisOg.exe
  2⤵
  PID:6824
- C:\Windows\System\oCSFPqT.exe
  C:\Windows\System\oCSFPqT.exe
  2⤵
  PID:7012
- C:\Windows\System\mmhmUws.exe
  C:\Windows\System\mmhmUws.exe
  2⤵
  PID:1624
- C:\Windows\System\RaubABR.exe
  C:\Windows\System\RaubABR.exe
  2⤵
  PID:2260
- C:\Windows\System\vhtsqFe.exe
  C:\Windows\System\vhtsqFe.exe
  2⤵
  PID:3472
- C:\Windows\System\KVNNdAx.exe
  C:\Windows\System\KVNNdAx.exe
  2⤵
  PID:3900
- C:\Windows\System\nuxEzSl.exe
  C:\Windows\System\nuxEzSl.exe
  2⤵
  PID:4152
- C:\Windows\System\cBOHzJr.exe
  C:\Windows\System\cBOHzJr.exe
  2⤵
  PID:4508
- C:\Windows\System\JBKcXcA.exe
  C:\Windows\System\JBKcXcA.exe
  2⤵
  PID:4896
- C:\Windows\System\zNrnUxn.exe
  C:\Windows\System\zNrnUxn.exe
  2⤵
  PID:3796
- C:\Windows\System\JrYZOVq.exe
  C:\Windows\System\JrYZOVq.exe
  2⤵
  PID:6044
- C:\Windows\System\nBfuOIt.exe
  C:\Windows\System\nBfuOIt.exe
  2⤵
  PID:1668
- C:\Windows\System\mCkcDph.exe
  C:\Windows\System\mCkcDph.exe
  2⤵
  PID:6104
- C:\Windows\System\gkxkavZ.exe
  C:\Windows\System\gkxkavZ.exe
  2⤵
  PID:5616
- C:\Windows\System\PXeKJdD.exe
  C:\Windows\System\PXeKJdD.exe
  2⤵
  PID:304
- C:\Windows\System\UrNJOjS.exe
  C:\Windows\System\UrNJOjS.exe
  2⤵
  PID:1616
- C:\Windows\System\DYuUyZj.exe
  C:\Windows\System\DYuUyZj.exe
  2⤵
  PID:4012
- C:\Windows\System\guIouGd.exe
  C:\Windows\System\guIouGd.exe
  2⤵
  PID:6340
- C:\Windows\System\XhXnPTF.exe
  C:\Windows\System\XhXnPTF.exe
  2⤵
  PID:6868
- C:\Windows\System\yKDWgwU.exe
  C:\Windows\System\yKDWgwU.exe
  2⤵
  PID:7032
- C:\Windows\System\owfUsnS.exe
  C:\Windows\System\owfUsnS.exe
  2⤵
  PID:6612
- C:\Windows\System\NAsvJyR.exe
  C:\Windows\System\NAsvJyR.exe
  2⤵
  PID:2932
- C:\Windows\System\AFnJwXe.exe
  C:\Windows\System\AFnJwXe.exe
  2⤵
  PID:2404
- C:\Windows\System\gBvIeTt.exe
  C:\Windows\System\gBvIeTt.exe
  2⤵
  PID:2776
- C:\Windows\System\aPkIJxA.exe
  C:\Windows\System\aPkIJxA.exe
  2⤵
  PID:1744
- C:\Windows\System\YNgoyXr.exe
  C:\Windows\System\YNgoyXr.exe
  2⤵
  PID:3308
- C:\Windows\System\IAWYWKH.exe
  C:\Windows\System\IAWYWKH.exe
  2⤵
  PID:3372
- C:\Windows\System\rXyLOlC.exe
  C:\Windows\System\rXyLOlC.exe
  2⤵
  PID:4236
- C:\Windows\System\EnCwufV.exe
  C:\Windows\System\EnCwufV.exe
  2⤵
  PID:3952
- C:\Windows\System\Njsjxdt.exe
  C:\Windows\System\Njsjxdt.exe
  2⤵
  PID:5068
- C:\Windows\System\BxiGFak.exe
  C:\Windows\System\BxiGFak.exe
  2⤵
  PID:2340
- C:\Windows\System\qZPXVNa.exe
  C:\Windows\System\qZPXVNa.exe
  2⤵
  PID:2220
- C:\Windows\System\ThWRLja.exe
  C:\Windows\System\ThWRLja.exe
  2⤵
  PID:6776
- C:\Windows\System\nxMNWSj.exe
  C:\Windows\System\nxMNWSj.exe
  2⤵
  PID:1732
- C:\Windows\System\YuLCVQU.exe
  C:\Windows\System\YuLCVQU.exe
  2⤵
  PID:4908
- C:\Windows\System\SBDcbwc.exe
  C:\Windows\System\SBDcbwc.exe
  2⤵
  PID:2020
- C:\Windows\System\oHIPQES.exe
  C:\Windows\System\oHIPQES.exe
  2⤵
  PID:6596
- C:\Windows\System\SVDKjUm.exe
  C:\Windows\System\SVDKjUm.exe
  2⤵
  PID:6524
- C:\Windows\System\SFXtoQb.exe
  C:\Windows\System\SFXtoQb.exe
  2⤵
  PID:6852
- C:\Windows\System\lPisQgM.exe
  C:\Windows\System\lPisQgM.exe
  2⤵
  PID:2900
- C:\Windows\System\aahaQRs.exe
  C:\Windows\System\aahaQRs.exe
  2⤵
  PID:4064
- C:\Windows\System\GeGmQmx.exe
  C:\Windows\System\GeGmQmx.exe
  2⤵
  PID:1852
- C:\Windows\System\leYnSYi.exe
  C:\Windows\System\leYnSYi.exe
  2⤵
  PID:5276
- C:\Windows\System\kLnMHeT.exe
  C:\Windows\System\kLnMHeT.exe
  2⤵
  PID:5660
- C:\Windows\System\hAatnqq.exe
  C:\Windows\System\hAatnqq.exe
  2⤵
  PID:6836
- C:\Windows\System\bXMyBif.exe
  C:\Windows\System\bXMyBif.exe
  2⤵
  PID:3840
- C:\Windows\System\lMdDHtt.exe
  C:\Windows\System\lMdDHtt.exe
  2⤵
  PID:3208
- C:\Windows\System\YJXbqhf.exe
  C:\Windows\System\YJXbqhf.exe
  2⤵
  PID:5240
- C:\Windows\System\rSkBPry.exe
  C:\Windows\System\rSkBPry.exe
  2⤵
  PID:6828
- C:\Windows\System\mUgpeOK.exe
  C:\Windows\System\mUgpeOK.exe
  2⤵
  PID:5568
- C:\Windows\System\MtGMEGG.exe
  C:\Windows\System\MtGMEGG.exe
  2⤵
  PID:4284
- C:\Windows\System\yfPIvtq.exe
  C:\Windows\System\yfPIvtq.exe
  2⤵
  PID:1344
- C:\Windows\System\YiqojOG.exe
  C:\Windows\System\YiqojOG.exe
  2⤵
  PID:1548
- C:\Windows\System\RPCDNGp.exe
  C:\Windows\System\RPCDNGp.exe
  2⤵
  PID:3960
- C:\Windows\System\hloEsCi.exe
  C:\Windows\System\hloEsCi.exe
  2⤵
  PID:7092
- C:\Windows\System\fQKhxJY.exe
  C:\Windows\System\fQKhxJY.exe
  2⤵
  PID:1804
- C:\Windows\System\lXwJkcZ.exe
  C:\Windows\System\lXwJkcZ.exe
  2⤵
  PID:5508
- C:\Windows\System\vkVCYKX.exe
  C:\Windows\System\vkVCYKX.exe
  2⤵
  PID:6392
- C:\Windows\System\qjKtFLb.exe
  C:\Windows\System\qjKtFLb.exe
  2⤵
  PID:6444
- C:\Windows\System\AIdgUuu.exe
  C:\Windows\System\AIdgUuu.exe
  2⤵
  PID:5448
- C:\Windows\System\UZALZxw.exe
  C:\Windows\System\UZALZxw.exe
  2⤵
  PID:3820
- C:\Windows\System\eiGIgRI.exe
  C:\Windows\System\eiGIgRI.exe
  2⤵
  PID:6676
- C:\Windows\System\bHVbAIp.exe
  C:\Windows\System\bHVbAIp.exe
  2⤵
  PID:7180
- C:\Windows\System\hYqIxJD.exe
  C:\Windows\System\hYqIxJD.exe
  2⤵
  PID:7196
- C:\Windows\System\pdmbLnr.exe
  C:\Windows\System\pdmbLnr.exe
  2⤵
  PID:7212
- C:\Windows\System\eHgYBHo.exe
  C:\Windows\System\eHgYBHo.exe
  2⤵
  PID:7228
- C:\Windows\System\XdKXKys.exe
  C:\Windows\System\XdKXKys.exe
  2⤵
  PID:7244
- C:\Windows\System\FzWySqX.exe
  C:\Windows\System\FzWySqX.exe
  2⤵
  PID:7260
- C:\Windows\System\EBOlfoL.exe
  C:\Windows\System\EBOlfoL.exe
  2⤵
  PID:7276
- C:\Windows\System\LOiKmKe.exe
  C:\Windows\System\LOiKmKe.exe
  2⤵
  PID:7296
- C:\Windows\System\vKJZKsH.exe
  C:\Windows\System\vKJZKsH.exe
  2⤵
  PID:7312
- C:\Windows\System\IDSrUjZ.exe
  C:\Windows\System\IDSrUjZ.exe
  2⤵
  PID:7348
- C:\Windows\System\wuknaZf.exe
  C:\Windows\System\wuknaZf.exe
  2⤵
  PID:7364
- C:\Windows\System\fPEQlcZ.exe
  C:\Windows\System\fPEQlcZ.exe
  2⤵
  PID:7380
- C:\Windows\System\hxUlQmM.exe
  C:\Windows\System\hxUlQmM.exe
  2⤵
  PID:7404
- C:\Windows\System\PeVzkuk.exe
  C:\Windows\System\PeVzkuk.exe
  2⤵
  PID:7420
- C:\Windows\System\DIkyRCF.exe
  C:\Windows\System\DIkyRCF.exe
  2⤵
  PID:7436
- C:\Windows\System\DzWwVrc.exe
  C:\Windows\System\DzWwVrc.exe
  2⤵
  PID:7452
- C:\Windows\System\ZjapWTs.exe
  C:\Windows\System\ZjapWTs.exe
  2⤵
  PID:7468
- C:\Windows\System\ksVtlJL.exe
  C:\Windows\System\ksVtlJL.exe
  2⤵
  PID:7484
- C:\Windows\System\XlnNgiQ.exe
  C:\Windows\System\XlnNgiQ.exe
  2⤵
  PID:7500
- C:\Windows\System\UvdTpMv.exe
  C:\Windows\System\UvdTpMv.exe
  2⤵
  PID:7516
- C:\Windows\System\zBUcbWr.exe
  C:\Windows\System\zBUcbWr.exe
  2⤵
  PID:7532
- C:\Windows\System\HElBJKO.exe
  C:\Windows\System\HElBJKO.exe
  2⤵
  PID:7548
- C:\Windows\System\YCPCcQt.exe
  C:\Windows\System\YCPCcQt.exe
  2⤵
  PID:7564
- C:\Windows\System\ZOQxjKD.exe
  C:\Windows\System\ZOQxjKD.exe
  2⤵
  PID:7580
- C:\Windows\System\vnSmLPq.exe
  C:\Windows\System\vnSmLPq.exe
  2⤵
  PID:7596
- C:\Windows\System\AgrZxjh.exe
  C:\Windows\System\AgrZxjh.exe
  2⤵
  PID:7612
- C:\Windows\System\ygbQIPW.exe
  C:\Windows\System\ygbQIPW.exe
  2⤵
  PID:7628
- C:\Windows\System\vtUaBsb.exe
  C:\Windows\System\vtUaBsb.exe
  2⤵
  PID:7644
- C:\Windows\System\jWYgxUz.exe
  C:\Windows\System\jWYgxUz.exe
  2⤵
  PID:7660
- C:\Windows\System\vYFYbTP.exe
  C:\Windows\System\vYFYbTP.exe
  2⤵
  PID:7680
- C:\Windows\System\tLzcPvw.exe
  C:\Windows\System\tLzcPvw.exe
  2⤵
  PID:7696
- C:\Windows\System\GoYtBQa.exe
  C:\Windows\System\GoYtBQa.exe
  2⤵
  PID:7712
- C:\Windows\System\cyAwaut.exe
  C:\Windows\System\cyAwaut.exe
  2⤵
  PID:7728
- C:\Windows\System\ZqajBgQ.exe
  C:\Windows\System\ZqajBgQ.exe
  2⤵
  PID:7744
- C:\Windows\System\ZUWbdCJ.exe
  C:\Windows\System\ZUWbdCJ.exe
  2⤵
  PID:7760
- C:\Windows\System\DkSqorN.exe
  C:\Windows\System\DkSqorN.exe
  2⤵
  PID:7776
- C:\Windows\System\baFqVry.exe
  C:\Windows\System\baFqVry.exe
  2⤵
  PID:7792
- C:\Windows\System\WqIqdBr.exe
  C:\Windows\System\WqIqdBr.exe
  2⤵
  PID:7808
- C:\Windows\System\qbeXQkN.exe
  C:\Windows\System\qbeXQkN.exe
  2⤵
  PID:7824
- C:\Windows\System\aPjDYtS.exe
  C:\Windows\System\aPjDYtS.exe
  2⤵
  PID:7840
- C:\Windows\System\EffCekV.exe
  C:\Windows\System\EffCekV.exe
  2⤵
  PID:7856
- C:\Windows\System\zNnUPgl.exe
  C:\Windows\System\zNnUPgl.exe
  2⤵
  PID:7872
- C:\Windows\System\OmUPsOt.exe
  C:\Windows\System\OmUPsOt.exe
  2⤵
  PID:7888
- C:\Windows\System\aFkCbPm.exe
  C:\Windows\System\aFkCbPm.exe
  2⤵
  PID:7904
- C:\Windows\System\cOEYIZl.exe
  C:\Windows\System\cOEYIZl.exe
  2⤵
  PID:7920
- C:\Windows\System\KOxSRuB.exe
  C:\Windows\System\KOxSRuB.exe
  2⤵
  PID:7936
- C:\Windows\System\wxmMpTi.exe
  C:\Windows\System\wxmMpTi.exe
  2⤵
  PID:7952
- C:\Windows\System\NlJkRHz.exe
  C:\Windows\System\NlJkRHz.exe
  2⤵
  PID:7968
- C:\Windows\System\LUxYmoI.exe
  C:\Windows\System\LUxYmoI.exe
  2⤵
  PID:7984
- C:\Windows\System\PsvkBbN.exe
  C:\Windows\System\PsvkBbN.exe
  2⤵
  PID:8000
- C:\Windows\System\BJgioLv.exe
  C:\Windows\System\BJgioLv.exe
  2⤵
  PID:8016
- C:\Windows\System\WDhhhoh.exe
  C:\Windows\System\WDhhhoh.exe
  2⤵
  PID:8032
- C:\Windows\System\KawhSAq.exe
  C:\Windows\System\KawhSAq.exe
  2⤵
  PID:8048
- C:\Windows\System\gZqGNsF.exe
  C:\Windows\System\gZqGNsF.exe
  2⤵
  PID:8064
- C:\Windows\System\NsoNEgD.exe
  C:\Windows\System\NsoNEgD.exe
  2⤵
  PID:8080
- C:\Windows\System\HAxpOKe.exe
  C:\Windows\System\HAxpOKe.exe
  2⤵
  PID:8096
- C:\Windows\System\GRWqCpB.exe
  C:\Windows\System\GRWqCpB.exe
  2⤵
  PID:8112
- C:\Windows\System\cLrFOXH.exe
  C:\Windows\System\cLrFOXH.exe
  2⤵
  PID:8128
- C:\Windows\System\ZghXAvF.exe
  C:\Windows\System\ZghXAvF.exe
  2⤵
  PID:8144
- C:\Windows\System\TwbvlJH.exe
  C:\Windows\System\TwbvlJH.exe
  2⤵
  PID:8160
- C:\Windows\System\IYAlkoH.exe
  C:\Windows\System\IYAlkoH.exe
  2⤵
  PID:8176
- C:\Windows\System\SoviQHT.exe
  C:\Windows\System\SoviQHT.exe
  2⤵
  PID:3040
- C:\Windows\System\IMwMiwr.exe
  C:\Windows\System\IMwMiwr.exe
  2⤵
  PID:6356
- C:\Windows\System\TbeJllW.exe
  C:\Windows\System\TbeJllW.exe
  2⤵
  PID:5800
- C:\Windows\System\mIHwKxA.exe
  C:\Windows\System\mIHwKxA.exe
  2⤵
  PID:7204
- C:\Windows\System\XkEpAUO.exe
  C:\Windows\System\XkEpAUO.exe
  2⤵
  PID:7268
- C:\Windows\System\VZBitxt.exe
  C:\Windows\System\VZBitxt.exe
  2⤵
  PID:7308
- C:\Windows\System\qNliHbq.exe
  C:\Windows\System\qNliHbq.exe
  2⤵
  PID:4752
- C:\Windows\System\eBarMfB.exe
  C:\Windows\System\eBarMfB.exe
  2⤵
  PID:7360
- C:\Windows\System\VnAeVMU.exe
  C:\Windows\System\VnAeVMU.exe
  2⤵
  PID:2132
- C:\Windows\System\rCVFFKw.exe
  C:\Windows\System\rCVFFKw.exe
  2⤵
  PID:5692
- C:\Windows\System\VeBntWC.exe
  C:\Windows\System\VeBntWC.exe
  2⤵
  PID:7136
- C:\Windows\System\YSXqbYl.exe
  C:\Windows\System\YSXqbYl.exe
  2⤵
  PID:6012
- C:\Windows\System\KNuTxko.exe
  C:\Windows\System\KNuTxko.exe
  2⤵
  PID:2240
- C:\Windows\System\nuofcjZ.exe
  C:\Windows\System\nuofcjZ.exe
  2⤵
  PID:6728
- C:\Windows\System\pzzgSTw.exe
  C:\Windows\System\pzzgSTw.exe
  2⤵
  PID:7188
- C:\Windows\System\nMXniCM.exe
  C:\Windows\System\nMXniCM.exe
  2⤵
  PID:7252
- C:\Windows\System\DvxlpVe.exe
  C:\Windows\System\DvxlpVe.exe
  2⤵
  PID:7292
- C:\Windows\System\NbzHzqx.exe
  C:\Windows\System\NbzHzqx.exe
  2⤵
  PID:7336
- C:\Windows\System\RlrxmNb.exe
  C:\Windows\System\RlrxmNb.exe
  2⤵
  PID:7460
- C:\Windows\System\ITjECXk.exe
  C:\Windows\System\ITjECXk.exe
  2⤵
  PID:7524
- C:\Windows\System\iyhQDPd.exe
  C:\Windows\System\iyhQDPd.exe
  2⤵
  PID:7560
- C:\Windows\System\MSuXsJl.exe
  C:\Windows\System\MSuXsJl.exe
  2⤵
  PID:7652
- C:\Windows\System\XlRcHJW.exe
  C:\Windows\System\XlRcHJW.exe
  2⤵
  PID:7724
- C:\Windows\System\GLTFPJD.exe
  C:\Windows\System\GLTFPJD.exe
  2⤵
  PID:7788
- C:\Windows\System\stgCUqa.exe
  C:\Windows\System\stgCUqa.exe
  2⤵
  PID:7852
- C:\Windows\System\fhyazEx.exe
  C:\Windows\System\fhyazEx.exe
  2⤵
  PID:7692
- C:\Windows\System\tYxgiBQ.exe
  C:\Windows\System\tYxgiBQ.exe
  2⤵
  PID:7444
- C:\Windows\System\qkiNcZZ.exe
  C:\Windows\System\qkiNcZZ.exe
  2⤵
  PID:7576
- C:\Windows\System\iEWVQzG.exe
  C:\Windows\System\iEWVQzG.exe
  2⤵
  PID:7832
- C:\Windows\System\uakjxul.exe
  C:\Windows\System\uakjxul.exe
  2⤵
  PID:7480
- C:\Windows\System\AOfiswF.exe
  C:\Windows\System\AOfiswF.exe
  2⤵
  PID:7640
- C:\Windows\System\vGmdIRI.exe
  C:\Windows\System\vGmdIRI.exe
  2⤵
  PID:7768
- C:\Windows\System\Hqxdivs.exe
  C:\Windows\System\Hqxdivs.exe
  2⤵
  PID:7836
- C:\Windows\System\YMzPApX.exe
  C:\Windows\System\YMzPApX.exe
  2⤵
  PID:7944
- C:\Windows\System\ApBwcOq.exe
  C:\Windows\System\ApBwcOq.exe
  2⤵
  PID:8008
- C:\Windows\System\EPavhQl.exe
  C:\Windows\System\EPavhQl.exe
  2⤵
  PID:8076
- C:\Windows\System\OZsCQLo.exe
  C:\Windows\System\OZsCQLo.exe
  2⤵
  PID:8136
- C:\Windows\System\cmriirT.exe
  C:\Windows\System\cmriirT.exe
  2⤵
  PID:4768
- C:\Windows\System\ydahBrj.exe
  C:\Windows\System\ydahBrj.exe
  2⤵
  PID:2456
- C:\Windows\System\zfPdJSG.exe
  C:\Windows\System\zfPdJSG.exe
  2⤵
  PID:7960
- C:\Windows\System\TKmMuFx.exe
  C:\Windows\System\TKmMuFx.exe
  2⤵
  PID:8060
- C:\Windows\System\SKXeTIx.exe
  C:\Windows\System\SKXeTIx.exe
  2⤵
  PID:8156
- C:\Windows\System\KxwsmMS.exe
  C:\Windows\System\KxwsmMS.exe
  2⤵
  PID:7964
- C:\Windows\System\LEDEWzL.exe
  C:\Windows\System\LEDEWzL.exe
  2⤵
  PID:8092
- C:\Windows\System\ykIHafK.exe
  C:\Windows\System\ykIHafK.exe
  2⤵
  PID:8188
- C:\Windows\System\dCcxOZl.exe
  C:\Windows\System\dCcxOZl.exe
  2⤵
  PID:7240
- C:\Windows\System\xqNVmXQ.exe
  C:\Windows\System\xqNVmXQ.exe
  2⤵
  PID:2524
- C:\Windows\System\iMqDOlV.exe
  C:\Windows\System\iMqDOlV.exe
  2⤵
  PID:4412
- C:\Windows\System\cdTtxkj.exe
  C:\Windows\System\cdTtxkj.exe
  2⤵
  PID:7284
- C:\Windows\System\WPISbCf.exe
  C:\Windows\System\WPISbCf.exe
  2⤵
  PID:7432
- C:\Windows\System\MaEzcpP.exe
  C:\Windows\System\MaEzcpP.exe
  2⤵
  PID:7556
- C:\Windows\System\aYPVSNq.exe
  C:\Windows\System\aYPVSNq.exe
  2⤵
  PID:7848
- C:\Windows\System\VualbVI.exe
  C:\Windows\System\VualbVI.exe
  2⤵
  PID:7620
- C:\Windows\System\Ebegngf.exe
  C:\Windows\System\Ebegngf.exe
  2⤵
  PID:7884
- C:\Windows\System\zZkUARR.exe
  C:\Windows\System\zZkUARR.exe
  2⤵
  PID:7736
- C:\Windows\System\qJZgYck.exe
  C:\Windows\System\qJZgYck.exe
  2⤵
  PID:7544
- C:\Windows\System\pKecNoj.exe
  C:\Windows\System\pKecNoj.exe
  2⤵
  PID:7604
- C:\Windows\System\toZBluW.exe
  C:\Windows\System\toZBluW.exe
  2⤵
  PID:7708
- C:\Windows\System\tMUkcPH.exe
  C:\Windows\System\tMUkcPH.exe
  2⤵
  PID:7916
- C:\Windows\System\LYUMTiU.exe
  C:\Windows\System\LYUMTiU.exe
  2⤵
  PID:5944
- C:\Windows\System\yQQhPAr.exe
  C:\Windows\System\yQQhPAr.exe
  2⤵
  PID:5600
- C:\Windows\System\yVOZmDp.exe
  C:\Windows\System\yVOZmDp.exe
  2⤵
  PID:5176
- C:\Windows\System\qrgiOHj.exe
  C:\Windows\System\qrgiOHj.exe
  2⤵
  PID:8028
- C:\Windows\System\cjFELJZ.exe
  C:\Windows\System\cjFELJZ.exe
  2⤵
  PID:8124
- C:\Windows\System\ULGrOuf.exe
  C:\Windows\System\ULGrOuf.exe
  2⤵
  PID:6128
- C:\Windows\System\WAksHXo.exe
  C:\Windows\System\WAksHXo.exe
  2⤵
  PID:7896
- C:\Windows\System\RjwCtLA.exe
  C:\Windows\System\RjwCtLA.exe
  2⤵
  PID:7932
- C:\Windows\System\JlyuOXG.exe
  C:\Windows\System\JlyuOXG.exe
  2⤵
  PID:7928
- C:\Windows\System\eiGBESS.exe
  C:\Windows\System\eiGBESS.exe
  2⤵
  PID:8056
- C:\Windows\System\qmBVYRe.exe
  C:\Windows\System\qmBVYRe.exe
  2⤵
  PID:7040
- C:\Windows\System\QBJmwLN.exe
  C:\Windows\System\QBJmwLN.exe
  2⤵
  PID:7820
- C:\Windows\System\IzYRZgr.exe
  C:\Windows\System\IzYRZgr.exe
  2⤵
  PID:7800
- C:\Windows\System\mfTzjYs.exe
  C:\Windows\System\mfTzjYs.exe
  2⤵
  PID:8072
- C:\Windows\System\saMLmob.exe
  C:\Windows\System\saMLmob.exe
  2⤵
  PID:7392
- C:\Windows\System\XmVSyji.exe
  C:\Windows\System\XmVSyji.exe
  2⤵
  PID:7900
- C:\Windows\System\mRyICxW.exe
  C:\Windows\System\mRyICxW.exe
  2⤵
  PID:7224
- C:\Windows\System\amoVLRY.exe
  C:\Windows\System\amoVLRY.exe
  2⤵
  PID:8208
- C:\Windows\System\zOlbIPL.exe
  C:\Windows\System\zOlbIPL.exe
  2⤵
  PID:8224
- C:\Windows\System\gZNCrhl.exe
  C:\Windows\System\gZNCrhl.exe
  2⤵
  PID:8244
- C:\Windows\System\cNZIYuA.exe
  C:\Windows\System\cNZIYuA.exe
  2⤵
  PID:8260
- C:\Windows\System\DkGIgGf.exe
  C:\Windows\System\DkGIgGf.exe
  2⤵
  PID:8276
- C:\Windows\System\iExmdhr.exe
  C:\Windows\System\iExmdhr.exe
  2⤵
  PID:8296
- C:\Windows\System\YOqKZQU.exe
  C:\Windows\System\YOqKZQU.exe
  2⤵
  PID:8312
- C:\Windows\System\WbFjYBo.exe
  C:\Windows\System\WbFjYBo.exe
  2⤵
  PID:8332
- C:\Windows\System\LXviSMB.exe
  C:\Windows\System\LXviSMB.exe
  2⤵
  PID:8352
- C:\Windows\System\pGPRidt.exe
  C:\Windows\System\pGPRidt.exe
  2⤵
  PID:8372
- C:\Windows\System\flMRySa.exe
  C:\Windows\System\flMRySa.exe
  2⤵
  PID:8388
- C:\Windows\System\fGCcLoX.exe
  C:\Windows\System\fGCcLoX.exe
  2⤵
  PID:8404
- C:\Windows\System\uiUWtnG.exe
  C:\Windows\System\uiUWtnG.exe
  2⤵
  PID:8420
- C:\Windows\System\rhxVnQe.exe
  C:\Windows\System\rhxVnQe.exe
  2⤵
  PID:8436
- C:\Windows\System\EazLEcU.exe
  C:\Windows\System\EazLEcU.exe
  2⤵
  PID:8452
- C:\Windows\System\lBoUMle.exe
  C:\Windows\System\lBoUMle.exe
  2⤵
  PID:8468
- C:\Windows\System\qNIQoiQ.exe
  C:\Windows\System\qNIQoiQ.exe
  2⤵
  PID:8484
- C:\Windows\System\vuyAIDS.exe
  C:\Windows\System\vuyAIDS.exe
  2⤵
  PID:8504
- C:\Windows\System\oRJtHBM.exe
  C:\Windows\System\oRJtHBM.exe
  2⤵
  PID:8520
- C:\Windows\System\LrqKnCu.exe
  C:\Windows\System\LrqKnCu.exe
  2⤵
  PID:8536
- C:\Windows\System\XCuPEQM.exe
  C:\Windows\System\XCuPEQM.exe
  2⤵
  PID:8552
- C:\Windows\System\tvKUScg.exe
  C:\Windows\System\tvKUScg.exe
  2⤵
  PID:8568
- C:\Windows\System\aiDrBgF.exe
  C:\Windows\System\aiDrBgF.exe
  2⤵
  PID:8584
- C:\Windows\System\jjezWzp.exe
  C:\Windows\System\jjezWzp.exe
  2⤵
  PID:8600
- C:\Windows\System\NyKbcRQ.exe
  C:\Windows\System\NyKbcRQ.exe
  2⤵
  PID:8616
- C:\Windows\System\fQidAqP.exe
  C:\Windows\System\fQidAqP.exe
  2⤵
  PID:8632
- C:\Windows\System\bLyPHfL.exe
  C:\Windows\System\bLyPHfL.exe
  2⤵
  PID:8648
- C:\Windows\System\OurXlRj.exe
  C:\Windows\System\OurXlRj.exe
  2⤵
  PID:8664
- C:\Windows\System\PqirJRb.exe
  C:\Windows\System\PqirJRb.exe
  2⤵
  PID:8680
- C:\Windows\System\USMMDUe.exe
  C:\Windows\System\USMMDUe.exe
  2⤵
  PID:8696
- C:\Windows\System\eXPvCwx.exe
  C:\Windows\System\eXPvCwx.exe
  2⤵
  PID:8712
- C:\Windows\System\jNYiQTT.exe
  C:\Windows\System\jNYiQTT.exe
  2⤵
  PID:8728
- C:\Windows\System\zRwgaiU.exe
  C:\Windows\System\zRwgaiU.exe
  2⤵
  PID:8744
- C:\Windows\System\tGpwPJk.exe
  C:\Windows\System\tGpwPJk.exe
  2⤵
  PID:8760
- C:\Windows\System\WkReZTT.exe
  C:\Windows\System\WkReZTT.exe
  2⤵
  PID:8776
- C:\Windows\System\mEfVRta.exe
  C:\Windows\System\mEfVRta.exe
  2⤵
  PID:8792
- C:\Windows\System\rsGYXMf.exe
  C:\Windows\System\rsGYXMf.exe
  2⤵
  PID:8808
- C:\Windows\System\pSOfxux.exe
  C:\Windows\System\pSOfxux.exe
  2⤵
  PID:8824
- C:\Windows\System\icHPYKS.exe
  C:\Windows\System\icHPYKS.exe
  2⤵
  PID:8840
- C:\Windows\System\YnKTZnj.exe
  C:\Windows\System\YnKTZnj.exe
  2⤵
  PID:8856
- C:\Windows\System\wRQwKGM.exe
  C:\Windows\System\wRQwKGM.exe
  2⤵
  PID:8876
- C:\Windows\System\zNZulfn.exe
  C:\Windows\System\zNZulfn.exe
  2⤵
  PID:8896
- C:\Windows\System\rMTaXSG.exe
  C:\Windows\System\rMTaXSG.exe
  2⤵
  PID:8916
- C:\Windows\System\EhlWudb.exe
  C:\Windows\System\EhlWudb.exe
  2⤵
  PID:8932
- C:\Windows\System\PHfjgCc.exe
  C:\Windows\System\PHfjgCc.exe
  2⤵
  PID:8948
- C:\Windows\System\GNFXbIF.exe
  C:\Windows\System\GNFXbIF.exe
  2⤵
  PID:8964
- C:\Windows\System\TPBsNZK.exe
  C:\Windows\System\TPBsNZK.exe
  2⤵
  PID:8980
- C:\Windows\System\FvortZl.exe
  C:\Windows\System\FvortZl.exe
  2⤵
  PID:8996
- C:\Windows\System\vLwnJpX.exe
  C:\Windows\System\vLwnJpX.exe
  2⤵
  PID:9020
- C:\Windows\System\uiBsPNL.exe
  C:\Windows\System\uiBsPNL.exe
  2⤵
  PID:9036
- C:\Windows\System\GDvYbZA.exe
  C:\Windows\System\GDvYbZA.exe
  2⤵
  PID:9052
- C:\Windows\System\GjJWHeD.exe
  C:\Windows\System\GjJWHeD.exe
  2⤵
  PID:9096
- C:\Windows\System\eZRWraS.exe
  C:\Windows\System\eZRWraS.exe
  2⤵
  PID:9116
- C:\Windows\System\GCiKkJp.exe
  C:\Windows\System\GCiKkJp.exe
  2⤵
  PID:9132
- C:\Windows\System\jcWwnOA.exe
  C:\Windows\System\jcWwnOA.exe
  2⤵
  PID:9148
- C:\Windows\System\BJKYonb.exe
  C:\Windows\System\BJKYonb.exe
  2⤵
  PID:9164
- C:\Windows\System\cZzcQcf.exe
  C:\Windows\System\cZzcQcf.exe
  2⤵
  PID:9180
- C:\Windows\System\HpKkuyC.exe
  C:\Windows\System\HpKkuyC.exe
  2⤵
  PID:9196
- C:\Windows\System\ASJuOrZ.exe
  C:\Windows\System\ASJuOrZ.exe
  2⤵
  PID:9212
- C:\Windows\System\kriSrMS.exe
  C:\Windows\System\kriSrMS.exe
  2⤵
  PID:876
- C:\Windows\System\KPfsvpf.exe
  C:\Windows\System\KPfsvpf.exe
  2⤵
  PID:8204
- C:\Windows\System\vnaggRL.exe
  C:\Windows\System\vnaggRL.exe
  2⤵
  PID:7416
- C:\Windows\System\FRysiec.exe
  C:\Windows\System\FRysiec.exe
  2⤵
  PID:7332
- C:\Windows\System\vkuWHAS.exe
  C:\Windows\System\vkuWHAS.exe
  2⤵
  PID:8272
- C:\Windows\System\dgihgux.exe
  C:\Windows\System\dgihgux.exe
  2⤵
  PID:5388
- C:\Windows\System\eeuUpET.exe
  C:\Windows\System\eeuUpET.exe
  2⤵
  PID:5940
- C:\Windows\System\LgfvMXC.exe
  C:\Windows\System\LgfvMXC.exe
  2⤵
  PID:8256
- C:\Windows\System\bUKvzFK.exe
  C:\Windows\System\bUKvzFK.exe
  2⤵
  PID:8324
- C:\Windows\System\PpwgxwD.exe
  C:\Windows\System\PpwgxwD.exe
  2⤵
  PID:8348
- C:\Windows\System\hGrkbsW.exe
  C:\Windows\System\hGrkbsW.exe
  2⤵
  PID:8400
- C:\Windows\System\bbmYrxd.exe
  C:\Windows\System\bbmYrxd.exe
  2⤵
  PID:8492
- C:\Windows\System\QKlwPMv.exe
  C:\Windows\System\QKlwPMv.exe
  2⤵
  PID:8528
- C:\Windows\System\BBpClJp.exe
  C:\Windows\System\BBpClJp.exe
  2⤵
  PID:8384
- C:\Windows\System\CxQcSTA.exe
  C:\Windows\System\CxQcSTA.exe
  2⤵
  PID:8448
- C:\Windows\System\OnKPpPQ.exe
  C:\Windows\System\OnKPpPQ.exe
  2⤵
  PID:8512
- C:\Windows\System\vzXRHSJ.exe
  C:\Windows\System\vzXRHSJ.exe
  2⤵
  PID:8640
- C:\Windows\System\QrlANaV.exe
  C:\Windows\System\QrlANaV.exe
  2⤵
  PID:8644
- C:\Windows\System\isayOvo.exe
  C:\Windows\System\isayOvo.exe
  2⤵
  PID:8676
- C:\Windows\System\QUCnYaP.exe
  C:\Windows\System\QUCnYaP.exe
  2⤵
  PID:8660
- C:\Windows\System\damHmGD.exe
  C:\Windows\System\damHmGD.exe
  2⤵
  PID:8704
- C:\Windows\System\gdCNjQU.exe
  C:\Windows\System\gdCNjQU.exe
  2⤵
  PID:8720
- C:\Windows\System\grBhOWa.exe
  C:\Windows\System\grBhOWa.exe
  2⤵
  PID:8768
- C:\Windows\System\lOiiOxo.exe
  C:\Windows\System\lOiiOxo.exe
  2⤵
  PID:8836
- C:\Windows\System\kuqVOil.exe
  C:\Windows\System\kuqVOil.exe
  2⤵
  PID:8904
- C:\Windows\System\EfkyHHf.exe
  C:\Windows\System\EfkyHHf.exe
  2⤵
  PID:8756
- C:\Windows\System\FIwTLem.exe
  C:\Windows\System\FIwTLem.exe
  2⤵
  PID:8820
- C:\Windows\System\DKCvQdv.exe
  C:\Windows\System\DKCvQdv.exe
  2⤵
  PID:8888
- C:\Windows\System\nrOEFTz.exe
  C:\Windows\System\nrOEFTz.exe
  2⤵
  PID:8956
- C:\Windows\System\OMSnIvO.exe
  C:\Windows\System\OMSnIvO.exe
  2⤵
  PID:8960
- C:\Windows\System\uKxxZSP.exe
  C:\Windows\System\uKxxZSP.exe
  2⤵
  PID:9008
- C:\Windows\System\qUhTdnU.exe
  C:\Windows\System\qUhTdnU.exe
  2⤵
  PID:9060
- C:\Windows\System\CmWLVfh.exe
  C:\Windows\System\CmWLVfh.exe
  2⤵
  PID:9068
- C:\Windows\System\sCzyiQn.exe
  C:\Windows\System\sCzyiQn.exe
  2⤵
  PID:9084
- C:\Windows\System\IQzMWLt.exe
  C:\Windows\System\IQzMWLt.exe
  2⤵
  PID:9092
- C:\Windows\System\Wwmapmn.exe
  C:\Windows\System\Wwmapmn.exe
  2⤵
  PID:9160
- C:\Windows\System\aCjxAsn.exe
  C:\Windows\System\aCjxAsn.exe
  2⤵
  PID:6152
- C:\Windows\System\jUcsFRY.exe
  C:\Windows\System\jUcsFRY.exe
  2⤵
  PID:8240
- C:\Windows\System\IRUPWve.exe
  C:\Windows\System\IRUPWve.exe
  2⤵
  PID:8288
- C:\Windows\System\JpMfMDT.exe
  C:\Windows\System\JpMfMDT.exe
  2⤵
  PID:9104
- C:\Windows\System\PpcyXgc.exe
  C:\Windows\System\PpcyXgc.exe
  2⤵
  PID:9108
- C:\Windows\System\FarcDlT.exe
  C:\Windows\System\FarcDlT.exe
  2⤵
  PID:3368
- C:\Windows\System\HPnikxk.exe
  C:\Windows\System\HPnikxk.exe
  2⤵
  PID:7720
- C:\Windows\System\dFjLLnE.exe
  C:\Windows\System\dFjLLnE.exe
  2⤵
  PID:8432
- C:\Windows\System\rqSpuHH.exe
  C:\Windows\System\rqSpuHH.exe
  2⤵
  PID:8444
- C:\Windows\System\WSGJVfV.exe
  C:\Windows\System\WSGJVfV.exe
  2⤵
  PID:8576
- C:\Windows\System\uTslYAq.exe
  C:\Windows\System\uTslYAq.exe
  2⤵
  PID:8480
- C:\Windows\System\YMNKOCI.exe
  C:\Windows\System\YMNKOCI.exe
  2⤵
  PID:8368
- C:\Windows\System\gqAvANU.exe
  C:\Windows\System\gqAvANU.exe
  2⤵
  PID:8412
- C:\Windows\System\ArFfkSo.exe
  C:\Windows\System\ArFfkSo.exe
  2⤵
  PID:8624
- C:\Windows\System\ylwoZlK.exe
  C:\Windows\System\ylwoZlK.exe
  2⤵
  PID:8872
- C:\Windows\System\FnPIJaV.exe
  C:\Windows\System\FnPIJaV.exe
  2⤵
  PID:8816
- C:\Windows\System\iqBrWJB.exe
  C:\Windows\System\iqBrWJB.exe
  2⤵
  PID:8804
- C:\Windows\System\GnrrPFF.exe
  C:\Windows\System\GnrrPFF.exe
  2⤵
  PID:8892
- C:\Windows\System\nqoHJJB.exe
  C:\Windows\System\nqoHJJB.exe
  2⤵
  PID:8988
- C:\Windows\System\RsyNcrT.exe
  C:\Windows\System\RsyNcrT.exe
  2⤵
  PID:9192
- C:\Windows\System\XsdGeqv.exe
  C:\Windows\System\XsdGeqv.exe
  2⤵
  PID:9156
- C:\Windows\System\ZnShBPR.exe
  C:\Windows\System\ZnShBPR.exe
  2⤵
  PID:9172
- C:\Windows\System\FioLujM.exe
  C:\Windows\System\FioLujM.exe
  2⤵
  PID:9208
- C:\Windows\System\cMKqrgk.exe
  C:\Windows\System\cMKqrgk.exe
  2⤵
  PID:8220
- C:\Windows\System\IVrWpUz.exe
  C:\Windows\System\IVrWpUz.exe
  2⤵
  PID:9204
- C:\Windows\System\tDHBQqZ.exe
  C:\Windows\System\tDHBQqZ.exe
  2⤵
  PID:8592
- C:\Windows\System\MJEcada.exe
  C:\Windows\System\MJEcada.exe
  2⤵
  PID:8460
- C:\Windows\System\idjzEWL.exe
  C:\Windows\System\idjzEWL.exe
  2⤵
  PID:8832
- C:\Windows\System\xoLZKMj.exe
  C:\Windows\System\xoLZKMj.exe
  2⤵
  PID:8564
- C:\Windows\System\XDAWVAR.exe
  C:\Windows\System\XDAWVAR.exe
  2⤵
  PID:8364
- C:\Windows\System\sBHYuuo.exe
  C:\Windows\System\sBHYuuo.exe
  2⤵
  PID:8852
- C:\Windows\System\zxcbbjG.exe
  C:\Windows\System\zxcbbjG.exe
  2⤵
  PID:9048
- C:\Windows\System\EWDFrwx.exe
  C:\Windows\System\EWDFrwx.exe
  2⤵
  PID:9176
- C:\Windows\System\eDONmvr.exe
  C:\Windows\System\eDONmvr.exe
  2⤵
  PID:8012
- C:\Windows\System\mhpVxjD.exe
  C:\Windows\System\mhpVxjD.exe
  2⤵
  PID:8740
- C:\Windows\System\LVYWlct.exe
  C:\Windows\System\LVYWlct.exe
  2⤵
  PID:8656
- C:\Windows\System\vAuFVFh.exe
  C:\Windows\System\vAuFVFh.exe
  2⤵
  PID:7784
- C:\Windows\System\ghzwkkm.exe
  C:\Windows\System\ghzwkkm.exe
  2⤵
  PID:9004
- C:\Windows\System\RCUpWfB.exe
  C:\Windows\System\RCUpWfB.exe
  2⤵
  PID:9012
- C:\Windows\System\GcPDjAY.exe
  C:\Windows\System\GcPDjAY.exe
  2⤵
  PID:8560
- C:\Windows\System\vwFEZBR.exe
  C:\Windows\System\vwFEZBR.exe
  2⤵
  PID:9228
- C:\Windows\System\msOlkyT.exe
  C:\Windows\System\msOlkyT.exe
  2⤵
  PID:9244
- C:\Windows\System\nNqDxmj.exe
  C:\Windows\System\nNqDxmj.exe
  2⤵
  PID:9260
- C:\Windows\System\iSfRkDz.exe
  C:\Windows\System\iSfRkDz.exe
  2⤵
  PID:9276
- C:\Windows\System\keQJXYU.exe
  C:\Windows\System\keQJXYU.exe
  2⤵
  PID:9292
- C:\Windows\System\lTMijGm.exe
  C:\Windows\System\lTMijGm.exe
  2⤵
  PID:9308
- C:\Windows\System\PErnGeb.exe
  C:\Windows\System\PErnGeb.exe
  2⤵
  PID:9324
- C:\Windows\System\BdOTytF.exe
  C:\Windows\System\BdOTytF.exe
  2⤵
  PID:9340
- C:\Windows\System\oKdMGFL.exe
  C:\Windows\System\oKdMGFL.exe
  2⤵
  PID:9356
- C:\Windows\System\QWKNHzI.exe
  C:\Windows\System\QWKNHzI.exe
  2⤵
  PID:9372
- C:\Windows\System\gvavVmN.exe
  C:\Windows\System\gvavVmN.exe
  2⤵
  PID:9388
- C:\Windows\System\xgviKcZ.exe
  C:\Windows\System\xgviKcZ.exe
  2⤵
  PID:9404
- C:\Windows\System\POxCKKp.exe
  C:\Windows\System\POxCKKp.exe
  2⤵
  PID:9420
- C:\Windows\System\YjnxFjB.exe
  C:\Windows\System\YjnxFjB.exe
  2⤵
  PID:9436
- C:\Windows\System\qjuWxom.exe
  C:\Windows\System\qjuWxom.exe
  2⤵
  PID:9452
- C:\Windows\System\FBystHI.exe
  C:\Windows\System\FBystHI.exe
  2⤵
  PID:9468
- C:\Windows\System\OSExDmF.exe
  C:\Windows\System\OSExDmF.exe
  2⤵
  PID:9488
- C:\Windows\System\VIuiEdp.exe
  C:\Windows\System\VIuiEdp.exe
  2⤵
  PID:9504
- C:\Windows\System\BvGeQIO.exe
  C:\Windows\System\BvGeQIO.exe
  2⤵
  PID:9520
- C:\Windows\System\zdDOHCC.exe
  C:\Windows\System\zdDOHCC.exe
  2⤵
  PID:9536
- C:\Windows\System\JUVettg.exe
  C:\Windows\System\JUVettg.exe
  2⤵
  PID:9552
- C:\Windows\System\sxNutzj.exe
  C:\Windows\System\sxNutzj.exe
  2⤵
  PID:9568
- C:\Windows\System\zvSfmCo.exe
  C:\Windows\System\zvSfmCo.exe
  2⤵
  PID:9584
- C:\Windows\System\iBjROqw.exe
  C:\Windows\System\iBjROqw.exe
  2⤵
  PID:9600
- C:\Windows\System\NiLIXUm.exe
  C:\Windows\System\NiLIXUm.exe
  2⤵
  PID:9616
- C:\Windows\System\BJWPFPN.exe
  C:\Windows\System\BJWPFPN.exe
  2⤵
  PID:9632
- C:\Windows\System\YAjPvrD.exe
  C:\Windows\System\YAjPvrD.exe
  2⤵
  PID:9648
- C:\Windows\System\zCOBQLY.exe
  C:\Windows\System\zCOBQLY.exe
  2⤵
  PID:9664
- C:\Windows\System\jkIVJbE.exe
  C:\Windows\System\jkIVJbE.exe
  2⤵
  PID:9680
- C:\Windows\System\IEdENIW.exe
  C:\Windows\System\IEdENIW.exe
  2⤵
  PID:9696
- C:\Windows\System\baEkuAt.exe
  C:\Windows\System\baEkuAt.exe
  2⤵
  PID:9712
- C:\Windows\System\EetMLfh.exe
  C:\Windows\System\EetMLfh.exe
  2⤵
  PID:9728
- C:\Windows\System\dpPlxdP.exe
  C:\Windows\System\dpPlxdP.exe
  2⤵
  PID:9744
- C:\Windows\System\dwaRkPX.exe
  C:\Windows\System\dwaRkPX.exe
  2⤵
  PID:9760
- C:\Windows\System\ZYttBGz.exe
  C:\Windows\System\ZYttBGz.exe
  2⤵
  PID:9776
- C:\Windows\System\MaiZBqn.exe
  C:\Windows\System\MaiZBqn.exe
  2⤵
  PID:9792
- C:\Windows\System\KiDPCFx.exe
  C:\Windows\System\KiDPCFx.exe
  2⤵
  PID:9808
- C:\Windows\System\WfEfnrE.exe
  C:\Windows\System\WfEfnrE.exe
  2⤵
  PID:9824
- C:\Windows\System\ElzrLOQ.exe
  C:\Windows\System\ElzrLOQ.exe
  2⤵
  PID:9840
- C:\Windows\System\bVCtawn.exe
  C:\Windows\System\bVCtawn.exe
  2⤵
  PID:9856
- C:\Windows\System\rgzkRON.exe
  C:\Windows\System\rgzkRON.exe
  2⤵
  PID:9872
- C:\Windows\System\ARBDghc.exe
  C:\Windows\System\ARBDghc.exe
  2⤵
  PID:9888
- C:\Windows\System\IKljZGm.exe
  C:\Windows\System\IKljZGm.exe
  2⤵
  PID:9904
- C:\Windows\System\OnosqwW.exe
  C:\Windows\System\OnosqwW.exe
  2⤵
  PID:9920
- C:\Windows\System\VQrZquH.exe
  C:\Windows\System\VQrZquH.exe
  2⤵
  PID:9936
- C:\Windows\System\DpQYGny.exe
  C:\Windows\System\DpQYGny.exe
  2⤵
  PID:9952
- C:\Windows\System\NTxzzFc.exe
  C:\Windows\System\NTxzzFc.exe
  2⤵
  PID:9968
- C:\Windows\System\OzzVNib.exe
  C:\Windows\System\OzzVNib.exe
  2⤵
  PID:9984
- C:\Windows\System\UgZmHHi.exe
  C:\Windows\System\UgZmHHi.exe
  2⤵
  PID:10000
- C:\Windows\System\jVKhYjt.exe
  C:\Windows\System\jVKhYjt.exe
  2⤵
  PID:10016
- C:\Windows\System\xQbpkqk.exe
  C:\Windows\System\xQbpkqk.exe
  2⤵
  PID:10032
- C:\Windows\System\yFhEqZd.exe
  C:\Windows\System\yFhEqZd.exe
  2⤵
  PID:10048
- C:\Windows\System\VLzcAcg.exe
  C:\Windows\System\VLzcAcg.exe
  2⤵
  PID:10064
- C:\Windows\System\QWzQSZq.exe
  C:\Windows\System\QWzQSZq.exe
  2⤵
  PID:10080
- C:\Windows\System\sxXugbG.exe
  C:\Windows\System\sxXugbG.exe
  2⤵
  PID:10096
- C:\Windows\System\hjvHrNG.exe
  C:\Windows\System\hjvHrNG.exe
  2⤵
  PID:10112
- C:\Windows\System\yZeFMGM.exe
  C:\Windows\System\yZeFMGM.exe
  2⤵
  PID:10128
- C:\Windows\System\AAyjsfC.exe
  C:\Windows\System\AAyjsfC.exe
  2⤵
  PID:10144
- C:\Windows\System\OoaMfQu.exe
  C:\Windows\System\OoaMfQu.exe
  2⤵
  PID:10160
- C:\Windows\System\BkIoPuR.exe
  C:\Windows\System\BkIoPuR.exe
  2⤵
  PID:10176
- C:\Windows\System\eBZeYMt.exe
  C:\Windows\System\eBZeYMt.exe
  2⤵
  PID:10192
- C:\Windows\System\kJHJReJ.exe
  C:\Windows\System\kJHJReJ.exe
  2⤵
  PID:10208
- C:\Windows\System\cLrMNWa.exe
  C:\Windows\System\cLrMNWa.exe
  2⤵
  PID:10224
- C:\Windows\System\pBhOEwX.exe
  C:\Windows\System\pBhOEwX.exe
  2⤵
  PID:9220
- C:\Windows\System\GjXaVLS.exe
  C:\Windows\System\GjXaVLS.exe
  2⤵
  PID:9284
- C:\Windows\System\tRumnqi.exe
  C:\Windows\System\tRumnqi.exe
  2⤵
  PID:9348
- C:\Windows\System\kkeHFrg.exe
  C:\Windows\System\kkeHFrg.exe
  2⤵
  PID:9412
- C:\Windows\System\ZvYBrny.exe
  C:\Windows\System\ZvYBrny.exe
  2⤵
  PID:9448
- C:\Windows\System\DaQMDGz.exe
  C:\Windows\System\DaQMDGz.exe
  2⤵
  PID:9128
- C:\Windows\System\ffAwWlX.exe
  C:\Windows\System\ffAwWlX.exe
  2⤵
  PID:9464
- C:\Windows\System\ClvmGBT.exe
  C:\Windows\System\ClvmGBT.exe
  2⤵
  PID:8608
- C:\Windows\System\plwEfCW.exe
  C:\Windows\System\plwEfCW.exe
  2⤵
  PID:9236
- C:\Windows\System\EOiAohm.exe
  C:\Windows\System\EOiAohm.exe
  2⤵
  PID:9332
- C:\Windows\System\mIiQTJS.exe
  C:\Windows\System\mIiQTJS.exe
  2⤵
  PID:9368
- C:\Windows\System\NvXxCkY.exe
  C:\Windows\System\NvXxCkY.exe
  2⤵
  PID:9608
- C:\Windows\System\XYKpljH.exe
  C:\Windows\System\XYKpljH.exe
  2⤵
  PID:9612
- C:\Windows\System\FJLfham.exe
  C:\Windows\System\FJLfham.exe
  2⤵
  PID:9672
- C:\Windows\System\lOURBti.exe
  C:\Windows\System\lOURBti.exe
  2⤵
  PID:9736
- C:\Windows\System\uzKjOJm.exe
  C:\Windows\System\uzKjOJm.exe
  2⤵
  PID:9528
- C:\Windows\System\rtcaQLZ.exe
  C:\Windows\System\rtcaQLZ.exe
  2⤵
  PID:9832
- C:\Windows\System\OajSeCa.exe
  C:\Windows\System\OajSeCa.exe
  2⤵
  PID:9564
- C:\Windows\System\SChfYWt.exe
  C:\Windows\System\SChfYWt.exe
  2⤵
  PID:9868
- C:\Windows\System\wIwntDM.exe
  C:\Windows\System\wIwntDM.exe
  2⤵
  PID:9928
- C:\Windows\System\fBFQqFZ.exe
  C:\Windows\System\fBFQqFZ.exe
  2⤵
  PID:9692
- C:\Windows\System\eMDHOyU.exe
  C:\Windows\System\eMDHOyU.exe
  2⤵
  PID:9624
- C:\Windows\System\pcDfvlK.exe
  C:\Windows\System\pcDfvlK.exe
  2⤵
  PID:9964
- C:\Windows\System\XUfxWpB.exe
  C:\Windows\System\XUfxWpB.exe
  2⤵
  PID:9848
- C:\Windows\System\qmtWgDA.exe
  C:\Windows\System\qmtWgDA.exe
  2⤵
  PID:9816
- C:\Windows\System\hmIAHow.exe
  C:\Windows\System\hmIAHow.exe
  2⤵
  PID:9880
- C:\Windows\System\hjTURJP.exe
  C:\Windows\System\hjTURJP.exe
  2⤵
  PID:10092
- C:\Windows\System\YXYLqdD.exe
  C:\Windows\System\YXYLqdD.exe
  2⤵
  PID:9976
- C:\Windows\System\yCUPvSv.exe
  C:\Windows\System\yCUPvSv.exe
  2⤵
  PID:10120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AcGkeYf.exe

Filesize
2.1MB

MD5
8ca4388d96dc1f11d9beb8ec5bb0f3b8

SHA1
333cffd7f0e663726e301c952ca147153d2a22d4

SHA256
e6ca91ff98ba97e7051c45f64f9789e9cea31806b44610bc26cfce6a617e85b4

SHA512
cfd2c38d84a82713d7bf40faee02d5bdd56be55547f5a135fee48d3676d28ba1ab908d0e64378255c16d59c572754df7ba75e6aca5350b86f4d5d8b02bad6d17

Download Submit
C:\Windows\system\CiEFlkK.exe

Filesize
2.1MB

MD5
8747b7dcf943f028b7b68bfa900352fd

SHA1
bf81579fabe1bee7a750ce83bfed99e2cb59582b

SHA256
cc59d74896ec43ad76afdb235225f18089b33c3c3053156555675ef29812a403

SHA512
dacacd4a629af7d9066da686a8c694a592f3b259573ddf03be2d9c0ed37f0c921a4569438ea9be50a41cfd22b4b1903f162a0da8dac426d56e41163a718621ba

Download Submit
C:\Windows\system\FLOySdi.exe

Filesize
2.1MB

MD5
ad08729f0e2cb53f8cbf2436f507c6ed

SHA1
a6527313e5938a7e4c9e8f636eac6ed53c7b7498

SHA256
7558fcf3384fe7ec3e8e3b4098bb4eccb29c36813da9c666602c9b131e0376a0

SHA512
b67e3702430af7bf0d449777c633e252069f32c99ec8c8b121dc48f509cc3f0c2ee61d4060ac76f7042c1110dccf528e94b780bfc2ac0de660bfeac7974c40af

Download Submit
C:\Windows\system\FXUZXhW.exe

Filesize
2.2MB

MD5
b3c5ad7c1f72de366b3f7993e8a809bf

SHA1
d1b349ae9ef16aedc2336931fcb1f4b9c3c90640

SHA256
9e1ee09e3bffa04b0c4825c1ae44e816158239792e8bafea10a91f7a71553d49

SHA512
646931eb67b6a6c60018616dadc5f471ba2faaf1b800c78031727260616ecb7e2640929a8aff72ca1d7e03f2b086123ce0eaf7e391d608cfc864f56fa4d283a7

Download Submit
C:\Windows\system\GEpigif.exe

Filesize
2.1MB

MD5
07d7ae0388d976e8add3204a82bd7cdf

SHA1
910fd5ee62e5dc178224ef53d6b8f8fee58d5714

SHA256
5f8899e7b1cc4eebf07b071d05c7ad047e352213b5861a06d5e271ef40f83d19

SHA512
b4d3a68917d1b1773b1c5c0afe5fcf330b2bbe55a392957c66a1eb89ef8043ff2c4b2ee22dc5bd40b2a5f0bf30cc73aa1cc384f9e7c6394cbb578ceded4f62cb

Download Submit
C:\Windows\system\JeBWhbG.exe

Filesize
2.2MB

MD5
1876cd96690141ca230f5fb8da1c4a66

SHA1
6ae0c29f37acc3f2182e599374347cc72d76ef89

SHA256
b7cc1887804ebd373d89be024075f8e9c8b4080ee15eb28af226375d5d47228c

SHA512
fc6bc2804f70333b88c33a208c8c1d7238d8b72040686e39d4fc81686678e061515de6657ad1c886ed18eb4864d8e5f0f40d8f4c1dc36ed4bb47918d4897d763

Download Submit
C:\Windows\system\Momqnkw.exe

Filesize
2.1MB

MD5
042144b5189b9993ae8845b88028213c

SHA1
3277c4b80824c42a4658b2f275b94df6cb8eee89

SHA256
1beed7415a2f3d77eccb095bebbbe0de64c835a64b765b6bba4f87206dcf8c4c

SHA512
27256924284cf8eaab28505850f81f6ff130774ecd87fc36125911eb003aef534eca965529d513f407075d9a306486682bcacb1271a5542f9b64b27cfd7173fc

Download Submit
C:\Windows\system\PbITPCz.exe

Filesize
2.1MB

MD5
9eabe733038c7f0b9ddbe8d068bf5a62

SHA1
3967417b33d07c26dbf4d19f7b5b741c98e80f84

SHA256
9ad900fcf2794660646a15f8e690d48ef09a99ee5df3aed70abb61cfd8f7e905

SHA512
2364b4ad4aa55c5d34cc9e78ed171ed694fb21b471d80032df2962377650228863f13f33f4fc5fb344c1c3cb8112550383f0715dfadd548439cb065df4f707b9

Download Submit
C:\Windows\system\VOixthJ.exe

Filesize
2.2MB

MD5
f3657874165413022b482402fac5f921

SHA1
e5d26eec4780d55613f30ee29b5dbf3e8912c1c0

SHA256
4fb1738f832f708cec2dcb8658019fe28ae77f54210ad7b637082390900eddf9

SHA512
bdd2d83a5826bddd93adcb2973d214848e3f7aa590a1ecac959f9cc6b869ba013a23ba3c00062c34aa141b18c110c2c36e95c62d91acb89ee6396ad544884acc

Download Submit
C:\Windows\system\WefLStX.exe

Filesize
2.1MB

MD5
db0e4c380bb19326c5fba7b63916b7b5

SHA1
02c6f92a79c272e5313b47a87c3645232d6d295b

SHA256
e7e3f1f8af9a07af09754d6480b178a07dd387d04f30d7791c0b0ffe7b8df60a

SHA512
45f402c610e9008a6de03585a5355e21b6f4ac75c2024f887bcd3dfd9b493b50c39b362c0b7d01c363f79a11006f00059d39585090b5a07aafd2a181824ae3f7

Download Submit
C:\Windows\system\WgfQMle.exe

Filesize
2.1MB

MD5
ed271309a1b413f285537d1076e01f07

SHA1
51a6cd57f8459dba4b4a1f3fa815ed9813717b0b

SHA256
8b68c1c2cefb949df68a735ef7fd59795e64fa01180a8ab6578b02c586382cbc

SHA512
d7200b5d97a3122d63a976d8519578005ba2da4c2cd9f92666e01565d814bd6509b93e8a9ee657f336b0838dcb5fa74378750a2f6d68f3a65b0dcfd2cec4c2b2

Download Submit
C:\Windows\system\YmUhnpI.exe

Filesize
8B

MD5
408407fe49e2a1bd1de2fb4f4e1c1e4e

SHA1
6781f0ed16b9f9a0e8a861848782ae1a9b183885

SHA256
413c20c52ba69478c63daee39bcd70926f09cbc71ce3aa1577802440938b324a

SHA512
51204da6f17b6725f4e9b8b9381f34a7ed365926b3780a3bfe9e8d70ab81ec8caad96b3f0838e87a0f0c0c6baeed1ea2ea2f5c7ee1fa6a13b720a1ec69c3f3fd

Download Submit
C:\Windows\system\ZKhWWil.exe

Filesize
2.2MB

MD5
3c90db69cd741edd627173f6222c5f4c

SHA1
bd159f0ac735e809416d2ff09c537163e62dd9b4

SHA256
d3ea53536c6f7c6ae9d98ba92016c7e2d5139e2d472901491ece252058d275de

SHA512
4e20e33aa60a3f6cb0c270f6b0890c372f142484ff7d66c6dfd74640d8ac22fb0fc2abbbbc62bbaf61539339d2fff9f0924243459f4b22dc7133b4057bcb7b07

Download Submit
C:\Windows\system\bMLOcMv.exe

Filesize
2.1MB

MD5
5de15c9fd79e836146f8a0a5157e6267

SHA1
6c009942abd302a1e86cc763c8075159bbc44bf9

SHA256
9873981177cb594a86900f234c9d425f25e6ba63cc505e27f60d95991b01b878

SHA512
aacd42e9d546c84fc4e2e9b35d8cd77fd8a388cbced7fbf8b81c7c292df4e95f346b09eadb726906880498a1d68f2b0f376bba8de33824bc4753894d9da33d08

Download Submit
C:\Windows\system\efNgbaT.exe

Filesize
2.2MB

MD5
989855124b28af384e4fc9f4ef3bf4c4

SHA1
0f73e46fa9eacea73fbfbd3d0ce44992b5df787f

SHA256
9f3518f6d9b1bb019a6fc1bec2df3f2be3fe9e1b1136001ab1f77e6c4a6fad9c

SHA512
d8af7b8fc04de17dc97e268d66b2a85713913d9af78fbc4e3ce31ca1fb4a63438e4c2fc8e6e735839f1d6206e09cd25a6a5458f5ac47d8396775e44ad474860d

Download Submit
C:\Windows\system\fbxnfvQ.exe

Filesize
2.1MB

MD5
00765ac346ac9e91c325af10d217be0d

SHA1
a64316e724a64f56545b6d79c0a6edc8f2f54d69

SHA256
6e2da5be2a83df64eaa5d5ed2be7c7e1dd74b3b22f1c2c525628ac507e910add

SHA512
99fe4eaa601856a95baf7d188c1fd6632430c08ec659c2cba92ae6fb3658f5bda5f82961294a284f7eb73f860f3bef948aa9f62ae4e60f8b161377087176fdb7

Download Submit
C:\Windows\system\feONgYs.exe

Filesize
2.2MB

MD5
d60be5a5f842abd64282f92cd5dabcf7

SHA1
b28ec95ffda0bdb23e0a76c6a5a70df4e433030c

SHA256
ce1bfa174aa53ee4185f61812b900a06e274e076d6e34781f2c557854cdbc824

SHA512
e0675e8bd1c32176f720f492867fda59f12b9296a48dcc6a8845911fd4e3d91659191752b07f0bc0df568dac7ffd8b87bb46138325c0cc4198ea0f5a3c58eedd

Download Submit
C:\Windows\system\grZqgEA.exe

Filesize
2.1MB

MD5
5585048d9da8b768bb20a6e59eb37a35

SHA1
7a93318df40a06a34b286454328780a51e96a53b

SHA256
1d8ac2395e04d3146275469823bc776e57d36a2befbe2af1206a668892c26a55

SHA512
75287793092d6334295547982fbb939cedf501848cb7f81b998cb86ed2a4f48d0cb4f516b115a9a523f243b789e41eec4b124fe52703808fdeb0eed3e36efd60

Download Submit
C:\Windows\system\jkwOrWZ.exe

Filesize
2.1MB

MD5
7115849724007cf7265879f9b2e947eb

SHA1
30b39976bc8ff6a6f1159e91dfac1783f33d4ce4

SHA256
81ea9ca41eba5f65bfdc8681ce75b583295db916a9acea2bda3778d297b86f11

SHA512
5cd07ff4cc2e4e495f6e39909bfb8ae5a2f064c4be6036b0d8f8bd756811bb7059aceb67da632c7907a5e1347cf7cdb41eeb9af602c8ace1e71587fe79aceaf5

Download Submit
C:\Windows\system\mydsaQD.exe

Filesize
2.1MB

MD5
57e9cadae41640d10c3d59d1b83b6fcf

SHA1
f7a4eb3cdf8eb924050cb07ff1e87dc5d88ea55d

SHA256
289f28519581f4ad721cf2c262873ff6659a4def66445439a2c22bac54c3cbc6

SHA512
67fb79b0e5ad13024164e37a8ea72777a3c8c1a27037ae8b1f6d272ab6feec107f53fb915ceb849482b99d0ed4709bf8f4d2161ab6448ac3559d6f4fb2872861

Download Submit
C:\Windows\system\pJqZhck.exe

Filesize
2.2MB

MD5
f244502787fbe2a69299f57f8fcaa8ad

SHA1
b2b082acd85900887aa67107d729fe5f4b16c0d8

SHA256
b1c42ffe4336258470d8d7eaa3799e4a93c98b3f0ef8e9dafee4735f3d2e4b4b

SHA512
417dde2a18ea65a4e67688f752a04105eb73f33fbc445f88bba390ad2d2fde087c69107f5ddea4704394fc535defea79fafc04ca58f67b0e6cc18932d71c6937

Download Submit
C:\Windows\system\tqKDFKd.exe

Filesize
2.2MB

MD5
f85a37766ce0655e1ace4fa4ac02aaf4

SHA1
524a1c85487a8fe1f2be0e60e1cda30af5bc09dc

SHA256
3df71f407d020adff57b2a1df0f277bf5a03dccac5aacf7f7249fca39a4c6aad

SHA512
0eda388b7a0baabea667525888d04e7748bb686c7bfeae19e3532ec512e9dc624c05fd9cfad1786d050fbd7e9aaf71ac65ddbde15630e40ef3be6ddadc4dc091

Download Submit
C:\Windows\system\uVkGsti.exe

Filesize
2.1MB

MD5
979ae675f7fc26993836e2d5a6c454b3

SHA1
62e8966d09599c3d3b5526113fe5451aaf8d0088

SHA256
36c53fe61668327e263474b4981c78a105b3d98e9ee31dc67083fb1754017b8c

SHA512
c7fb060ee3a53c7e981afaed4f49a4e21fc3ad60aeaedf863721aecdf2ca9fe0bb386c5135da48792e3abf54b84833260267432658aef55b51a55150ec723020

Download Submit
C:\Windows\system\uaBNLbj.exe

Filesize
2.1MB

MD5
0b1d600b306f3ff6ecd4ad18f01539a3

SHA1
d981db1a07a2e05c90d3597f292221163868d8cd

SHA256
68504a750a12ed2492517eec24f4b8c25674e52783dda783520c960d9a2a9d05

SHA512
32c6195bda5d95dab6c7802b099515ad6b77b3836f93498286f6efc7fe0fef5a9871795ee12dacb112c4034707c3e57a3e559db051bc68a23869af1d1cbf52a4

Download Submit
C:\Windows\system\wKApimQ.exe

Filesize
2.1MB

MD5
174c7c8de86fc44765d2baed33dd647f

SHA1
377df78fb5ae5c060d4c27b574d3047959a71f25

SHA256
f566d7bbc47efbe483fcc20203dfb175ee29e0996566170f5cd1ac95993f1a15

SHA512
f727069e0ae655cb4335b90a84515bff3ff5171f2d62cd742115b8dcc66f255cb15fe3e95febead2585c68217efb6991f06247dc38f53bd20580886c8cf86e6b

Download Submit
C:\Windows\system\wcbhyHQ.exe

Filesize
2.1MB

MD5
f50c015ea81d6d950e72d0502e632e8f

SHA1
4c2fdcd06a2c68c2cce03f79e7be5a9a94351986

SHA256
880c1a3687e791ee7ec3baa6ef2fee6a98b5638e48f137e598fc566934f4d86f

SHA512
1e540186d4c51c5432bcf0dffed3f0ffc1f54f9e2bf89111189c59dc0d24cd7c8a67d9d02e72dfcd3e58c1e163ea4d317f1d782bc87a6cb95a6f3becba30686f

Download Submit
C:\Windows\system\wnWjIcT.exe

Filesize
2.1MB

MD5
dce5a1e892c4bc1506db78b540bd1914

SHA1
1b2664c41d91cb3662f46a9b67a69f12cb43aedf

SHA256
c240961f24633eb03916bf54c658bb15a8de0bf3aaef3d4d6ecfec7eac73f017

SHA512
c6111717d1dfa4df5fde83b6c70736a6717f8b0dfe3e7327cba978c6cb54005a0e8a8f63f8ead305a534779e6993272783d522caa6b79709b3c4def3f6d9ca30

Download Submit
\Windows\system\GfGkWne.exe

Filesize
2.2MB

MD5
a3c1168ac394d78a2f88b54ac66f5597

SHA1
a6f844ab3cfbe0b8083f8d6dc7d2306de9be4120

SHA256
dac52ea4e721bd16858fa1c8be2546061c2578fc19bd3229b9da6847be3f4301

SHA512
718cb38ed8dc57c644c52cd21e81ff38fabc35f529c4eced1cec16d5601abf38797e401a59dc3be30b41b837cdb95f921960f35995282c3aec3c12796645ba84

Download Submit
\Windows\system\JJWvVLZ.exe

Filesize
2.2MB

MD5
c628a19e62e10439f977f4d63b65bbca

SHA1
dbd4d976cf897aa5d2d5b859f57cc10a37d137ff

SHA256
b7fd78cf7ebe1f6f564eb910149bcd6bba06bee75647383eb6c8fcb301183fc2

SHA512
52f0916383348fcafefbf1ad797cb4de438220038db3517504b9ac66908e32f6240e0809497b0a0f86053ebb53ab57f3843a98bfa84c3c1bf6f762bacb0c73fe

Download Submit
\Windows\system\JYuteEd.exe

Filesize
2.2MB

MD5
19fecc31e01b0999e24c45813e1c4828

SHA1
0b701f64b2ac89c04356cbbd74aee565d1eee55b

SHA256
30cd553d1cc560fa58dca4c8821d57d52876e87c3a289331762f362a230baa90

SHA512
e4df49ff4d0bbff230928cec8f1d7b43666bf29bd6a81c766c601525c8a8c6d64c832b6d645459ca27cfc23e1cdeb3fb9335b9a2dde551b57a29c290f65b32e3

Download Submit
\Windows\system\ZqQbhbS.exe

Filesize
2.2MB

MD5
506798579b834dd0e0499f68d315eef0

SHA1
81378b43ffa74bdf7c6588482f961e31f43e4044

SHA256
fdca96465e76b4e98432460c173bfb174456e4faa4261bd17a8288a3190304f6

SHA512
79eaf30c8947e2e4b4c7cb948bb065723caf5efb2bdcc2790201aab7df0ede67cd88f0db26b2723772e912601f94d2b208a186aba6d15a81bc74425330f8c3cd

Download Submit
\Windows\system\eCscGOv.exe

Filesize
2.2MB

MD5
5b9cd7f85565f5cce2da5713a4b809d5

SHA1
54bba160a1a82947bc28f8a77bfb049df5fb942a

SHA256
eff2015c681766671c1e343a9665f0b3963936b3d9dacdf41c455efb63229a9c

SHA512
2c43c2ece921a1a820c2b0449b284699237079dc2d772160227a1a36266a44632ff8c5b1c7f01bbfe6ceef0601b5e791d8b818b4e09b2a8246d20520be07b459

Download Submit
\Windows\system\hbUyYJw.exe

Filesize
2.1MB

MD5
25f8177c8fd6360231384020ed0e79b3

SHA1
36849a9005c22a1b03cec52f6a3d7221d92b686d

SHA256
ea6691900d4d679116dfbe75c5c200d10db1215db3bca99e64db967be809bc3f

SHA512
707e20f52a9d77394ddef2398059cdcd07a05a845f561ad17200df97e15ed140782b4fcc77ad8b5d77c5e646c0526f67b2185929f2a3a67116fb8ac3c9598e76

Download Submit
\Windows\system\iJYBgoj.exe

Filesize
2.2MB

MD5
411ee5d21821aecba459f59733ccb516

SHA1
016d837aee7a5314bdc19a7b5384e98b3af0ba48

SHA256
dc65edda8099897f2d13315ee99f5bd7bc6f5a22fab8112d930428b05d65ce79

SHA512
e1f91ecb510ce24719f5ddec9f8f1860a16c4098f5ab6db3e373678906c036b0fef97c5d16331630b1265938596a0f8b17a5ad4287bbf880a92f811c2d8143a7

Download Submit
\Windows\system\jqHjaBm.exe

Filesize
2.2MB

MD5
db5376b9b5095409cd6604b5e688de74

SHA1
0f2444e79963b1130d1cbca10ddc857bd12825b4

SHA256
303a9bbcde993fd7b14a33671ceb025e88014c99f63241a13a541bf93649c1b6

SHA512
b38616db59a9c88936cf3d68de7f0a005696d847153dd0f64aa56f2826f21e7940c6a931ea88237de3b949c688117eb7de2412f7f9526f1963ec5eae613bf2ce

Download Submit
\Windows\system\pMYwECz.exe

Filesize
2.1MB

MD5
3691422bb8c619ad8da7f0eb58526847

SHA1
e92e12731751299c5e963e95087c110d48fea1d0

SHA256
0caf61d95697c93947e18660c2d2fb97e490f6cb47474732c80f594a996169e3

SHA512
6de1f2b8625097233223073c55a48b44fbf22f0c155746362e17169168cbf60a21efd5a5981aa3260002433c4d339ea022a3bc7dc7b745a4d3fdfc0a120a14f9

Download Submit
\Windows\system\qZMCuPC.exe

Filesize
2.2MB

MD5
2dae6aa78322e2588c1f99a63ee9c307

SHA1
711ef721c803bc38de5bb6452c577aeddba9dbcc

SHA256
755c0c6868318d45476aee6dcb1d3757d51ca5997da30aa0620320376039a1ad

SHA512
0be3b425628d75564d6ac3cc6a7ef907208e2a58db7628d9cfc6cb331ea05731df265e70b9cec677d96b2834bd8171ce7cceb29808cf89d7a356bf4916a7a496

Download Submit
memory/1028-9-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/1508-229-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2464-248-0x000000013F2F0000-0x000000013F6E2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-252-0x000000013FE50000-0x0000000140242000-memory.dmp

Filesize
3.9MB

Download
memory/2512-200-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-27-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-171-0x000000013F910000-0x000000013FD02000-memory.dmp

Filesize
3.9MB

Download
memory/2512-34-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2512-0-0x000000013F2B0000-0x000000013F6A2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-8-0x000000013F750000-0x000000013FB42000-memory.dmp

Filesize
3.9MB

Download
memory/2512-383-0x000000013F790000-0x000000013FB82000-memory.dmp

Filesize
3.9MB

Download
memory/2512-372-0x000000013FE70000-0x0000000140262000-memory.dmp

Filesize
3.9MB

Download
memory/2512-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2512-241-0x0000000002FB0000-0x00000000033A2000-memory.dmp

Filesize
3.9MB

Download
memory/2512-20-0x000000013FE60000-0x0000000140252000-memory.dmp

Filesize
3.9MB

Download
memory/2516-199-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

Filesize
32KB

Download
memory/2516-164-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-191-0x000000001B600000-0x000000001B8E2000-memory.dmp

Filesize
2.9MB

Download
memory/2516-396-0x000007FEF5DC0000-0x000007FEF675D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-173-0x0000000002EB0000-0x0000000002F30000-memory.dmp

Filesize
512KB

Download
memory/2516-165-0x0000000002EB0000-0x0000000002F30000-memory.dmp

Filesize
512KB

Download
memory/2560-198-0x000000013FA80000-0x000000013FE72000-memory.dmp

Filesize
3.9MB

Download
memory/2572-259-0x000000013FE10000-0x0000000140202000-memory.dmp

Filesize
3.9MB

Download
memory/2640-195-0x000000013F880000-0x000000013FC72000-memory.dmp

Filesize
3.9MB

Download
memory/2828-403-0x000000013F560000-0x000000013F952000-memory.dmp

Filesize
3.9MB

Download