xmrig | 12bede5be696d90f1c88b05d3f43b9c63e5fb38e7fd6c3877bf92176c8bb896e

Analysis

max time kernel
21s
max time network
17s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
Size

1.9MB
MD5

015cd7f00ae2f46d43429bcb683f99be
SHA1

08d99c19739f38cc3325a3594106a849efc9a247
SHA256

12bede5be696d90f1c88b05d3f43b9c63e5fb38e7fd6c3877bf92176c8bb896e
SHA512

288fc223aa86051c02ff1dc00bda611eec2d8874566739ac17f4dee20266a07f2908b54b3e74489f4137f15eb1098aa8579882ee9b8272b2d508f657f4ccc3f7
SSDEEP

49152:Lz071uv4BPMkibTIA5lCx7kvRWa4pXHaf9I:NABv

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 8 IoCs

miner

resource	yara_rule
behavioral1/memory/2740-203-0x000000013F370000-0x000000013F762000-memory.dmp	xmrig
behavioral1/memory/2552-202-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	xmrig
behavioral1/memory/2696-200-0x000000013F030000-0x000000013F422000-memory.dmp	xmrig
behavioral1/memory/2748-198-0x000000013FF00000-0x00000001402F2000-memory.dmp	xmrig
behavioral1/memory/2788-197-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	xmrig
behavioral1/memory/2536-192-0x000000013FF50000-0x0000000140342000-memory.dmp	xmrig
behavioral1/memory/3036-28-0x000000013FA50000-0x000000013FE42000-memory.dmp	xmrig
behavioral1/memory/2612-12-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2612	AKfIaaN.exe
2740	vAMuLUp.exe
3036	CfJLJKq.exe
2536	OVxDIJs.exe
2672	SLggBxc.exe
2788	AskcBcM.exe
2748	gtsUDWB.exe
2696	rRBFnDa.exe
2552	XqAlaAU.exe
2592	sjPUzXZ.exe
2528	aSPgMGD.exe
2460	NVHNaXU.exe
2516	ZqiIVEy.exe
2960	KlOVuyJ.exe
2952	pLnfooC.exe
1952	vNXtwlg.exe
1724	clRKUWL.exe
2820	CTrKkuq.exe
2164	LYGnzWr.exe
1656	aKkMqbj.exe
1700	UWlOkFg.exe
836	KubOoRK.exe
2200	OMsRMsH.exe
1868	MWCCfKn.exe
1192	rLWuRBz.exe
1396	QUgmHXU.exe
1488	QjMeSXN.exe
1804	IkpprDE.exe
532	sgXylHT.exe
1052	pEeSUGV.exe
1484	ZDWZlcL.exe
2856	lYBCLKH.exe
1884	XdrRmHn.exe
2424	TWLXYui.exe
1984	ldyugCl.exe
444	ZJsxjsO.exe
3052	wqeFahk.exe
1372	HgDfNgx.exe
2384	MIexjpw.exe
3028	JZZekAF.exe
588	YlvEKer.exe
2092	pquCvVU.exe
2108	pqYcKeg.exe
568	SPDdyJL.exe
2924	wwwutEF.exe
2944	rBEcyMt.exe
1716	cEuoLHg.exe
1492	zAUlPKw.exe
2436	cCEmbvU.exe
3012	lPuhMvh.exe
1556	TpbLhpc.exe
1704	cxCpylx.exe
2804	InXDKZH.exe
2732	ywigeks.exe
2780	ECyLtmB.exe
2752	ZlRkZVf.exe
2032	ZQJGqIK.exe
2876	aKJjWyw.exe
2688	DMYOtoE.exe
1840	FgrttmY.exe
2404	OghkoHZ.exe
2580	UYeTyvJ.exe
2416	ARavdYa.exe
2192	hkJCkII.exe

Loads dropped DLL 64 IoCs

pid	Process
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe

UPX packed file 42 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1764-0-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/files/0x000d00000001227f-6.dat	upx
behavioral1/files/0x0008000000013a15-15.dat	upx
behavioral1/files/0x0006000000014525-49.dat	upx
behavioral1/files/0x0006000000014a29-88.dat	upx
behavioral1/files/0x00060000000146a7-85.dat	upx
behavioral1/files/0x0006000000014c0b-106.dat	upx
behavioral1/files/0x0006000000015b72-140.dat	upx
behavioral1/memory/2740-203-0x000000013F370000-0x000000013F762000-memory.dmp	upx
behavioral1/memory/2552-202-0x000000013F1E0000-0x000000013F5D2000-memory.dmp	upx
behavioral1/files/0x003900000001340e-168.dat	upx
behavioral1/memory/2696-200-0x000000013F030000-0x000000013F422000-memory.dmp	upx
behavioral1/memory/2748-198-0x000000013FF00000-0x00000001402F2000-memory.dmp	upx
behavioral1/memory/2788-197-0x000000013F2C0000-0x000000013F6B2000-memory.dmp	upx
behavioral1/memory/2672-193-0x000000013F740000-0x000000013FB32000-memory.dmp	upx
behavioral1/memory/2536-192-0x000000013FF50000-0x0000000140342000-memory.dmp	upx
behavioral1/files/0x0006000000015c9b-164.dat	upx
behavioral1/files/0x0006000000015c91-158.dat	upx
behavioral1/files/0x0006000000015bb5-153.dat	upx
behavioral1/files/0x0006000000015a15-147.dat	upx
behavioral1/files/0x000600000001543a-145.dat	upx
behavioral1/files/0x00060000000150aa-127.dat	upx
behavioral1/files/0x0006000000014fac-116.dat	upx
behavioral1/files/0x0006000000015b37-137.dat	upx
behavioral1/files/0x000600000001474b-95.dat	upx
behavioral1/files/0x00060000000155e8-131.dat	upx
behavioral1/files/0x00060000000148af-80.dat	upx
behavioral1/files/0x000600000001523e-120.dat	upx
behavioral1/files/0x0006000000015077-111.dat	upx
behavioral1/files/0x00060000000145c9-65.dat	upx
behavioral1/files/0x000800000001451d-56.dat	upx
behavioral1/files/0x0006000000014d0f-99.dat	upx
behavioral1/files/0x0009000000013a85-45.dat	upx
behavioral1/files/0x0008000000013f4b-43.dat	upx
behavioral1/files/0x000600000001475f-79.dat	upx
behavioral1/files/0x0006000000014730-69.dat	upx
behavioral1/files/0x00060000000145d4-60.dat	upx
behavioral1/memory/3036-28-0x000000013FA50000-0x000000013FE42000-memory.dmp	upx
behavioral1/memory/2612-12-0x000000013F1F0000-0x000000013F5E2000-memory.dmp	upx
behavioral1/files/0x0038000000013362-11.dat	upx
behavioral1/files/0x00130000000054a8-33.dat	upx
behavioral1/files/0x00090000000134f5-16.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\caJDEoA.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\Pjygafi.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ZZRYTEO.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\yWZsDWF.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\kWaesNr.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\wAtsYhH.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\hAXqAms.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\QejPUEq.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\QEYMNxB.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\EsZGNrO.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\lgzFlbd.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\OMPBjZY.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\OMmtFBX.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\GlvCirl.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\PBPJmEc.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\EEArSFu.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\pMruZql.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\KGmwrgf.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\CyJJovY.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\EfPzqhj.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\KBsjmSC.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\LhJlUgp.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\TUDAVix.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\eimQEEX.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\tICwOGB.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\rBEcyMt.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\tkizUuJ.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\rPAxbhj.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\uYnbxCP.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ZQJGqIK.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\gVnSRnE.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ZCJEIkj.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\NSQWLIb.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\oLVkvgt.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ekdRJcl.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\FvpCNLo.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\QVeZQht.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\LeeEvvJ.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\pPACbiS.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\lEiOItY.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\NDTnOMI.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\gtsUDWB.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\CaVmUVm.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\oKMqmTH.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ZPrlnOS.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\OGqThlw.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bQsdxFZ.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bjJxVRm.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\RSBYOnZ.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\ktgwPtg.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bIltWPP.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\oZHjmrW.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\MxBZnhh.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\oJOuTTQ.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bisOTOo.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bzskeVL.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\BATpDqy.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\pEeSUGV.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\kqFZRNn.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\bXGOwlB.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\pJaIVoe.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\FRKIJkN.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\CfJLJKq.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
File created	C:\Windows\System\XejJeYE.exe	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2132	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeLockMemoryPrivilege	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2132	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2132	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2132	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	29
PID 1764 wrote to memory of 2612	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	30
PID 1764 wrote to memory of 2612	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	30
PID 1764 wrote to memory of 2612	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	30
PID 1764 wrote to memory of 2740	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	31
PID 1764 wrote to memory of 2740	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	31
PID 1764 wrote to memory of 2740	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	31
PID 1764 wrote to memory of 3036	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	32
PID 1764 wrote to memory of 3036	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	32
PID 1764 wrote to memory of 3036	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	32
PID 1764 wrote to memory of 2672	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	33
PID 1764 wrote to memory of 2672	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	33
PID 1764 wrote to memory of 2672	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	33
PID 1764 wrote to memory of 2536	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	34
PID 1764 wrote to memory of 2536	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	34
PID 1764 wrote to memory of 2536	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	34
PID 1764 wrote to memory of 2748	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	35
PID 1764 wrote to memory of 2748	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	35
PID 1764 wrote to memory of 2748	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	35
PID 1764 wrote to memory of 2788	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	36
PID 1764 wrote to memory of 2788	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	36
PID 1764 wrote to memory of 2788	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	36
PID 1764 wrote to memory of 2552	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	37
PID 1764 wrote to memory of 2552	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	37
PID 1764 wrote to memory of 2552	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	37
PID 1764 wrote to memory of 2696	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	38
PID 1764 wrote to memory of 2696	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	38
PID 1764 wrote to memory of 2696	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	38
PID 1764 wrote to memory of 2528	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	39
PID 1764 wrote to memory of 2528	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	39
PID 1764 wrote to memory of 2528	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	39
PID 1764 wrote to memory of 2592	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	40
PID 1764 wrote to memory of 2592	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	40
PID 1764 wrote to memory of 2592	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	40
PID 1764 wrote to memory of 2960	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	41
PID 1764 wrote to memory of 2960	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	41
PID 1764 wrote to memory of 2960	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	41
PID 1764 wrote to memory of 2460	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	42
PID 1764 wrote to memory of 2460	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	42
PID 1764 wrote to memory of 2460	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	42
PID 1764 wrote to memory of 1952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	43
PID 1764 wrote to memory of 1952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	43
PID 1764 wrote to memory of 1952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	43
PID 1764 wrote to memory of 2516	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	44
PID 1764 wrote to memory of 2516	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	44
PID 1764 wrote to memory of 2516	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	44
PID 1764 wrote to memory of 2820	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	45
PID 1764 wrote to memory of 2820	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	45
PID 1764 wrote to memory of 2820	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	45
PID 1764 wrote to memory of 2952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	46
PID 1764 wrote to memory of 2952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	46
PID 1764 wrote to memory of 2952	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	46
PID 1764 wrote to memory of 2164	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	47
PID 1764 wrote to memory of 2164	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	47
PID 1764 wrote to memory of 2164	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	47
PID 1764 wrote to memory of 1724	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	48
PID 1764 wrote to memory of 1724	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	48
PID 1764 wrote to memory of 1724	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	48
PID 1764 wrote to memory of 1700	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	49
PID 1764 wrote to memory of 1700	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	49
PID 1764 wrote to memory of 1700	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	49
PID 1764 wrote to memory of 1656	1764	015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\015cd7f00ae2f46d43429bcb683f99be_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2132
- C:\Windows\System\AKfIaaN.exe
  C:\Windows\System\AKfIaaN.exe
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Windows\System\vAMuLUp.exe
  C:\Windows\System\vAMuLUp.exe
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\System\CfJLJKq.exe
  C:\Windows\System\CfJLJKq.exe
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Windows\System\SLggBxc.exe
  C:\Windows\System\SLggBxc.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\OVxDIJs.exe
  C:\Windows\System\OVxDIJs.exe
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\System\gtsUDWB.exe
  C:\Windows\System\gtsUDWB.exe
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\System\AskcBcM.exe
  C:\Windows\System\AskcBcM.exe
  2⤵
  - Executes dropped EXE
  PID:2788
- C:\Windows\System\XqAlaAU.exe
  C:\Windows\System\XqAlaAU.exe
  2⤵
  - Executes dropped EXE
  PID:2552
- C:\Windows\System\rRBFnDa.exe
  C:\Windows\System\rRBFnDa.exe
  2⤵
  - Executes dropped EXE
  PID:2696
- C:\Windows\System\aSPgMGD.exe
  C:\Windows\System\aSPgMGD.exe
  2⤵
  - Executes dropped EXE
  PID:2528
- C:\Windows\System\sjPUzXZ.exe
  C:\Windows\System\sjPUzXZ.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\KlOVuyJ.exe
  C:\Windows\System\KlOVuyJ.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\NVHNaXU.exe
  C:\Windows\System\NVHNaXU.exe
  2⤵
  - Executes dropped EXE
  PID:2460
- C:\Windows\System\vNXtwlg.exe
  C:\Windows\System\vNXtwlg.exe
  2⤵
  - Executes dropped EXE
  PID:1952
- C:\Windows\System\ZqiIVEy.exe
  C:\Windows\System\ZqiIVEy.exe
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\System\CTrKkuq.exe
  C:\Windows\System\CTrKkuq.exe
  2⤵
  - Executes dropped EXE
  PID:2820
- C:\Windows\System\pLnfooC.exe
  C:\Windows\System\pLnfooC.exe
  2⤵
  - Executes dropped EXE
  PID:2952
- C:\Windows\System\LYGnzWr.exe
  C:\Windows\System\LYGnzWr.exe
  2⤵
  - Executes dropped EXE
  PID:2164
- C:\Windows\System\clRKUWL.exe
  C:\Windows\System\clRKUWL.exe
  2⤵
  - Executes dropped EXE
  PID:1724
- C:\Windows\System\UWlOkFg.exe
  C:\Windows\System\UWlOkFg.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\aKkMqbj.exe
  C:\Windows\System\aKkMqbj.exe
  2⤵
  - Executes dropped EXE
  PID:1656
- C:\Windows\System\OMsRMsH.exe
  C:\Windows\System\OMsRMsH.exe
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\System\KubOoRK.exe
  C:\Windows\System\KubOoRK.exe
  2⤵
  - Executes dropped EXE
  PID:836
- C:\Windows\System\QUgmHXU.exe
  C:\Windows\System\QUgmHXU.exe
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Windows\System\MWCCfKn.exe
  C:\Windows\System\MWCCfKn.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- C:\Windows\System\QjMeSXN.exe
  C:\Windows\System\QjMeSXN.exe
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Windows\System\rLWuRBz.exe
  C:\Windows\System\rLWuRBz.exe
  2⤵
  - Executes dropped EXE
  PID:1192
- C:\Windows\System\IkpprDE.exe
  C:\Windows\System\IkpprDE.exe
  2⤵
  - Executes dropped EXE
  PID:1804
- C:\Windows\System\sgXylHT.exe
  C:\Windows\System\sgXylHT.exe
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\System\pEeSUGV.exe
  C:\Windows\System\pEeSUGV.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\ZDWZlcL.exe
  C:\Windows\System\ZDWZlcL.exe
  2⤵
  - Executes dropped EXE
  PID:1484
- C:\Windows\System\lYBCLKH.exe
  C:\Windows\System\lYBCLKH.exe
  2⤵
  - Executes dropped EXE
  PID:2856
- C:\Windows\System\XdrRmHn.exe
  C:\Windows\System\XdrRmHn.exe
  2⤵
  - Executes dropped EXE
  PID:1884
- C:\Windows\System\TWLXYui.exe
  C:\Windows\System\TWLXYui.exe
  2⤵
  - Executes dropped EXE
  PID:2424
- C:\Windows\System\ldyugCl.exe
  C:\Windows\System\ldyugCl.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\ZJsxjsO.exe
  C:\Windows\System\ZJsxjsO.exe
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\System\wqeFahk.exe
  C:\Windows\System\wqeFahk.exe
  2⤵
  - Executes dropped EXE
  PID:3052
- C:\Windows\System\MIexjpw.exe
  C:\Windows\System\MIexjpw.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\HgDfNgx.exe
  C:\Windows\System\HgDfNgx.exe
  2⤵
  - Executes dropped EXE
  PID:1372
- C:\Windows\System\JZZekAF.exe
  C:\Windows\System\JZZekAF.exe
  2⤵
  - Executes dropped EXE
  PID:3028
- C:\Windows\System\YlvEKer.exe
  C:\Windows\System\YlvEKer.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\pquCvVU.exe
  C:\Windows\System\pquCvVU.exe
  2⤵
  - Executes dropped EXE
  PID:2092
- C:\Windows\System\pqYcKeg.exe
  C:\Windows\System\pqYcKeg.exe
  2⤵
  - Executes dropped EXE
  PID:2108
- C:\Windows\System\SPDdyJL.exe
  C:\Windows\System\SPDdyJL.exe
  2⤵
  - Executes dropped EXE
  PID:568
- C:\Windows\System\wwwutEF.exe
  C:\Windows\System\wwwutEF.exe
  2⤵
  - Executes dropped EXE
  PID:2924
- C:\Windows\System\rBEcyMt.exe
  C:\Windows\System\rBEcyMt.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\cEuoLHg.exe
  C:\Windows\System\cEuoLHg.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Windows\System\zAUlPKw.exe
  C:\Windows\System\zAUlPKw.exe
  2⤵
  - Executes dropped EXE
  PID:1492
- C:\Windows\System\cCEmbvU.exe
  C:\Windows\System\cCEmbvU.exe
  2⤵
  - Executes dropped EXE
  PID:2436
- C:\Windows\System\lPuhMvh.exe
  C:\Windows\System\lPuhMvh.exe
  2⤵
  - Executes dropped EXE
  PID:3012
- C:\Windows\System\TpbLhpc.exe
  C:\Windows\System\TpbLhpc.exe
  2⤵
  - Executes dropped EXE
  PID:1556
- C:\Windows\System\cxCpylx.exe
  C:\Windows\System\cxCpylx.exe
  2⤵
  - Executes dropped EXE
  PID:1704
- C:\Windows\System\InXDKZH.exe
  C:\Windows\System\InXDKZH.exe
  2⤵
  - Executes dropped EXE
  PID:2804
- C:\Windows\System\ywigeks.exe
  C:\Windows\System\ywigeks.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\ECyLtmB.exe
  C:\Windows\System\ECyLtmB.exe
  2⤵
  - Executes dropped EXE
  PID:2780
- C:\Windows\System\ZlRkZVf.exe
  C:\Windows\System\ZlRkZVf.exe
  2⤵
  - Executes dropped EXE
  PID:2752
- C:\Windows\System\ZQJGqIK.exe
  C:\Windows\System\ZQJGqIK.exe
  2⤵
  - Executes dropped EXE
  PID:2032
- C:\Windows\System\aKJjWyw.exe
  C:\Windows\System\aKJjWyw.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\DMYOtoE.exe
  C:\Windows\System\DMYOtoE.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\FgrttmY.exe
  C:\Windows\System\FgrttmY.exe
  2⤵
  - Executes dropped EXE
  PID:1840
- C:\Windows\System\OghkoHZ.exe
  C:\Windows\System\OghkoHZ.exe
  2⤵
  - Executes dropped EXE
  PID:2404
- C:\Windows\System\UYeTyvJ.exe
  C:\Windows\System\UYeTyvJ.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\ARavdYa.exe
  C:\Windows\System\ARavdYa.exe
  2⤵
  - Executes dropped EXE
  PID:2416
- C:\Windows\System\hkJCkII.exe
  C:\Windows\System\hkJCkII.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\GBZzgzv.exe
  C:\Windows\System\GBZzgzv.exe
  2⤵
  PID:2736
- C:\Windows\System\rLZfSiv.exe
  C:\Windows\System\rLZfSiv.exe
  2⤵
  PID:396
- C:\Windows\System\afytpEz.exe
  C:\Windows\System\afytpEz.exe
  2⤵
  PID:1944
- C:\Windows\System\aIGLjZU.exe
  C:\Windows\System\aIGLjZU.exe
  2⤵
  PID:1864
- C:\Windows\System\rAwJVuX.exe
  C:\Windows\System\rAwJVuX.exe
  2⤵
  PID:1132
- C:\Windows\System\JdaudjL.exe
  C:\Windows\System\JdaudjL.exe
  2⤵
  PID:2040
- C:\Windows\System\ODlByqz.exe
  C:\Windows\System\ODlByqz.exe
  2⤵
  PID:2912
- C:\Windows\System\PBPJmEc.exe
  C:\Windows\System\PBPJmEc.exe
  2⤵
  PID:484
- C:\Windows\System\HnHuhhM.exe
  C:\Windows\System\HnHuhhM.exe
  2⤵
  PID:1632
- C:\Windows\System\KBsjmSC.exe
  C:\Windows\System\KBsjmSC.exe
  2⤵
  PID:1644
- C:\Windows\System\OGqPzaR.exe
  C:\Windows\System\OGqPzaR.exe
  2⤵
  PID:1292
- C:\Windows\System\OlKNiuk.exe
  C:\Windows\System\OlKNiuk.exe
  2⤵
  PID:536
- C:\Windows\System\uKkPmTx.exe
  C:\Windows\System\uKkPmTx.exe
  2⤵
  PID:1736
- C:\Windows\System\lHZZWMK.exe
  C:\Windows\System\lHZZWMK.exe
  2⤵
  PID:1740
- C:\Windows\System\mGWzYzj.exe
  C:\Windows\System\mGWzYzj.exe
  2⤵
  PID:2576
- C:\Windows\System\useFSJv.exe
  C:\Windows\System\useFSJv.exe
  2⤵
  PID:2976
- C:\Windows\System\xblQtSb.exe
  C:\Windows\System\xblQtSb.exe
  2⤵
  PID:2504
- C:\Windows\System\mzXcxjy.exe
  C:\Windows\System\mzXcxjy.exe
  2⤵
  PID:1476
- C:\Windows\System\tCzWlYv.exe
  C:\Windows\System\tCzWlYv.exe
  2⤵
  PID:1988
- C:\Windows\System\oXocvju.exe
  C:\Windows\System\oXocvju.exe
  2⤵
  PID:608
- C:\Windows\System\dvCVlmz.exe
  C:\Windows\System\dvCVlmz.exe
  2⤵
  PID:944
- C:\Windows\System\CaVmUVm.exe
  C:\Windows\System\CaVmUVm.exe
  2⤵
  PID:796
- C:\Windows\System\LcwyVrl.exe
  C:\Windows\System\LcwyVrl.exe
  2⤵
  PID:1708
- C:\Windows\System\PEmuCZd.exe
  C:\Windows\System\PEmuCZd.exe
  2⤵
  PID:2584
- C:\Windows\System\vOxCRwy.exe
  C:\Windows\System\vOxCRwy.exe
  2⤵
  PID:2800
- C:\Windows\System\knDqAJJ.exe
  C:\Windows\System\knDqAJJ.exe
  2⤵
  PID:824
- C:\Windows\System\heyfRaV.exe
  C:\Windows\System\heyfRaV.exe
  2⤵
  PID:544
- C:\Windows\System\bxVkPkA.exe
  C:\Windows\System\bxVkPkA.exe
  2⤵
  PID:1044
- C:\Windows\System\cAEooOZ.exe
  C:\Windows\System\cAEooOZ.exe
  2⤵
  PID:1144
- C:\Windows\System\OoMxJLc.exe
  C:\Windows\System\OoMxJLc.exe
  2⤵
  PID:2792
- C:\Windows\System\RYlZHLc.exe
  C:\Windows\System\RYlZHLc.exe
  2⤵
  PID:2024
- C:\Windows\System\uDnkLmk.exe
  C:\Windows\System\uDnkLmk.exe
  2⤵
  PID:3016
- C:\Windows\System\HFlNwHp.exe
  C:\Windows\System\HFlNwHp.exe
  2⤵
  PID:1320
- C:\Windows\System\OSSOLXT.exe
  C:\Windows\System\OSSOLXT.exe
  2⤵
  PID:984
- C:\Windows\System\BPtrYfB.exe
  C:\Windows\System\BPtrYfB.exe
  2⤵
  PID:884
- C:\Windows\System\kQGVheB.exe
  C:\Windows\System\kQGVheB.exe
  2⤵
  PID:1848
- C:\Windows\System\mAtjWPt.exe
  C:\Windows\System\mAtjWPt.exe
  2⤵
  PID:1584
- C:\Windows\System\wNwVpcQ.exe
  C:\Windows\System\wNwVpcQ.exe
  2⤵
  PID:1588
- C:\Windows\System\hGnknVn.exe
  C:\Windows\System\hGnknVn.exe
  2⤵
  PID:2640
- C:\Windows\System\cbCYcbx.exe
  C:\Windows\System\cbCYcbx.exe
  2⤵
  PID:3068
- C:\Windows\System\USQVCXp.exe
  C:\Windows\System\USQVCXp.exe
  2⤵
  PID:1832
- C:\Windows\System\OMPBjZY.exe
  C:\Windows\System\OMPBjZY.exe
  2⤵
  PID:1600
- C:\Windows\System\sAfxIyQ.exe
  C:\Windows\System\sAfxIyQ.exe
  2⤵
  PID:1672
- C:\Windows\System\qWKRHcG.exe
  C:\Windows\System\qWKRHcG.exe
  2⤵
  PID:2548
- C:\Windows\System\ZDSvysh.exe
  C:\Windows\System\ZDSvysh.exe
  2⤵
  PID:2500
- C:\Windows\System\hGQMQYb.exe
  C:\Windows\System\hGQMQYb.exe
  2⤵
  PID:2824
- C:\Windows\System\spCodEX.exe
  C:\Windows\System\spCodEX.exe
  2⤵
  PID:1844
- C:\Windows\System\YMbZfyW.exe
  C:\Windows\System\YMbZfyW.exe
  2⤵
  PID:1512
- C:\Windows\System\qnKEzuH.exe
  C:\Windows\System\qnKEzuH.exe
  2⤵
  PID:1116
- C:\Windows\System\bIltWPP.exe
  C:\Windows\System\bIltWPP.exe
  2⤵
  PID:1560
- C:\Windows\System\LgUiifL.exe
  C:\Windows\System\LgUiifL.exe
  2⤵
  PID:2712
- C:\Windows\System\wDCFViR.exe
  C:\Windows\System\wDCFViR.exe
  2⤵
  PID:672
- C:\Windows\System\wAtsYhH.exe
  C:\Windows\System\wAtsYhH.exe
  2⤵
  PID:1092
- C:\Windows\System\cWkOanA.exe
  C:\Windows\System\cWkOanA.exe
  2⤵
  PID:1076
- C:\Windows\System\pLKXzZZ.exe
  C:\Windows\System\pLKXzZZ.exe
  2⤵
  PID:704
- C:\Windows\System\vmSidvz.exe
  C:\Windows\System\vmSidvz.exe
  2⤵
  PID:2936
- C:\Windows\System\wfudRTY.exe
  C:\Windows\System\wfudRTY.exe
  2⤵
  PID:1592
- C:\Windows\System\veLMOGx.exe
  C:\Windows\System\veLMOGx.exe
  2⤵
  PID:1608
- C:\Windows\System\asrQzDy.exe
  C:\Windows\System\asrQzDy.exe
  2⤵
  PID:3088
- C:\Windows\System\gRisaWI.exe
  C:\Windows\System\gRisaWI.exe
  2⤵
  PID:3104
- C:\Windows\System\uWwxQZy.exe
  C:\Windows\System\uWwxQZy.exe
  2⤵
  PID:3124
- C:\Windows\System\hbbWQMQ.exe
  C:\Windows\System\hbbWQMQ.exe
  2⤵
  PID:3140
- C:\Windows\System\OjCQepd.exe
  C:\Windows\System\OjCQepd.exe
  2⤵
  PID:3160
- C:\Windows\System\vwLsORa.exe
  C:\Windows\System\vwLsORa.exe
  2⤵
  PID:3264
- C:\Windows\System\tyYRFtX.exe
  C:\Windows\System\tyYRFtX.exe
  2⤵
  PID:3284
- C:\Windows\System\uhWhynb.exe
  C:\Windows\System\uhWhynb.exe
  2⤵
  PID:3324
- C:\Windows\System\quKstEC.exe
  C:\Windows\System\quKstEC.exe
  2⤵
  PID:3344
- C:\Windows\System\kkRAQCw.exe
  C:\Windows\System\kkRAQCw.exe
  2⤵
  PID:3380
- C:\Windows\System\aijvLxZ.exe
  C:\Windows\System\aijvLxZ.exe
  2⤵
  PID:3408
- C:\Windows\System\rbBAGgV.exe
  C:\Windows\System\rbBAGgV.exe
  2⤵
  PID:3436
- C:\Windows\System\MljKhrd.exe
  C:\Windows\System\MljKhrd.exe
  2⤵
  PID:3468
- C:\Windows\System\dpOVzKX.exe
  C:\Windows\System\dpOVzKX.exe
  2⤵
  PID:3504
- C:\Windows\System\TuDCKea.exe
  C:\Windows\System\TuDCKea.exe
  2⤵
  PID:3544
- C:\Windows\System\psibsTv.exe
  C:\Windows\System\psibsTv.exe
  2⤵
  PID:3568
- C:\Windows\System\PppYTKi.exe
  C:\Windows\System\PppYTKi.exe
  2⤵
  PID:3584
- C:\Windows\System\vOXRtpK.exe
  C:\Windows\System\vOXRtpK.exe
  2⤵
  PID:3600
- C:\Windows\System\KGcmrCA.exe
  C:\Windows\System\KGcmrCA.exe
  2⤵
  PID:3616
- C:\Windows\System\XejJeYE.exe
  C:\Windows\System\XejJeYE.exe
  2⤵
  PID:3632
- C:\Windows\System\wXDAKqs.exe
  C:\Windows\System\wXDAKqs.exe
  2⤵
  PID:3652
- C:\Windows\System\YFQhICi.exe
  C:\Windows\System\YFQhICi.exe
  2⤵
  PID:3672
- C:\Windows\System\WKwncoM.exe
  C:\Windows\System\WKwncoM.exe
  2⤵
  PID:3696
- C:\Windows\System\TeXSMey.exe
  C:\Windows\System\TeXSMey.exe
  2⤵
  PID:3724
- C:\Windows\System\hPBMfdU.exe
  C:\Windows\System\hPBMfdU.exe
  2⤵
  PID:3740
- C:\Windows\System\GVBJVxc.exe
  C:\Windows\System\GVBJVxc.exe
  2⤵
  PID:3756
- C:\Windows\System\axIXteI.exe
  C:\Windows\System\axIXteI.exe
  2⤵
  PID:3772
- C:\Windows\System\CFgpIGz.exe
  C:\Windows\System\CFgpIGz.exe
  2⤵
  PID:3812
- C:\Windows\System\hAXqAms.exe
  C:\Windows\System\hAXqAms.exe
  2⤵
  PID:3828
- C:\Windows\System\QQlCCaI.exe
  C:\Windows\System\QQlCCaI.exe
  2⤵
  PID:3844
- C:\Windows\System\acVtyTs.exe
  C:\Windows\System\acVtyTs.exe
  2⤵
  PID:3860
- C:\Windows\System\rLJjWqY.exe
  C:\Windows\System\rLJjWqY.exe
  2⤵
  PID:3876
- C:\Windows\System\hidlJij.exe
  C:\Windows\System\hidlJij.exe
  2⤵
  PID:3892
- C:\Windows\System\zVbaFBX.exe
  C:\Windows\System\zVbaFBX.exe
  2⤵
  PID:3932
- C:\Windows\System\DRkQADk.exe
  C:\Windows\System\DRkQADk.exe
  2⤵
  PID:3948
- C:\Windows\System\QejPUEq.exe
  C:\Windows\System\QejPUEq.exe
  2⤵
  PID:3972
- C:\Windows\System\BDRBHul.exe
  C:\Windows\System\BDRBHul.exe
  2⤵
  PID:3988
- C:\Windows\System\ujMXPly.exe
  C:\Windows\System\ujMXPly.exe
  2⤵
  PID:4012
- C:\Windows\System\wnedsPI.exe
  C:\Windows\System\wnedsPI.exe
  2⤵
  PID:4028
- C:\Windows\System\UMQCnbO.exe
  C:\Windows\System\UMQCnbO.exe
  2⤵
  PID:4052
- C:\Windows\System\IoDtMqu.exe
  C:\Windows\System\IoDtMqu.exe
  2⤵
  PID:4068
- C:\Windows\System\wougBsn.exe
  C:\Windows\System\wougBsn.exe
  2⤵
  PID:4084
- C:\Windows\System\jKMCqDT.exe
  C:\Windows\System\jKMCqDT.exe
  2⤵
  PID:2844
- C:\Windows\System\wlskdLY.exe
  C:\Windows\System\wlskdLY.exe
  2⤵
  PID:2052
- C:\Windows\System\TvJwMDx.exe
  C:\Windows\System\TvJwMDx.exe
  2⤵
  PID:1888
- C:\Windows\System\OQmzhtq.exe
  C:\Windows\System\OQmzhtq.exe
  2⤵
  PID:2392
- C:\Windows\System\UsDtslC.exe
  C:\Windows\System\UsDtslC.exe
  2⤵
  PID:1432
- C:\Windows\System\LHoBfgK.exe
  C:\Windows\System\LHoBfgK.exe
  2⤵
  PID:2072
- C:\Windows\System\iTRuWLC.exe
  C:\Windows\System\iTRuWLC.exe
  2⤵
  PID:3100
- C:\Windows\System\jGWwrEo.exe
  C:\Windows\System\jGWwrEo.exe
  2⤵
  PID:3132
- C:\Windows\System\cVRNbWf.exe
  C:\Windows\System\cVRNbWf.exe
  2⤵
  PID:3176
- C:\Windows\System\cgSvFcg.exe
  C:\Windows\System\cgSvFcg.exe
  2⤵
  PID:764
- C:\Windows\System\EEArSFu.exe
  C:\Windows\System\EEArSFu.exe
  2⤵
  PID:3200
- C:\Windows\System\DJyRwcS.exe
  C:\Windows\System\DJyRwcS.exe
  2⤵
  PID:3216
- C:\Windows\System\RLSZCqO.exe
  C:\Windows\System\RLSZCqO.exe
  2⤵
  PID:3232
- C:\Windows\System\gBrlyxK.exe
  C:\Windows\System\gBrlyxK.exe
  2⤵
  PID:3248
- C:\Windows\System\SMAPjaT.exe
  C:\Windows\System\SMAPjaT.exe
  2⤵
  PID:1152
- C:\Windows\System\jPQIVaB.exe
  C:\Windows\System\jPQIVaB.exe
  2⤵
  PID:3304
- C:\Windows\System\SabTKqp.exe
  C:\Windows\System\SabTKqp.exe
  2⤵
  PID:2080
- C:\Windows\System\mvILVuY.exe
  C:\Windows\System\mvILVuY.exe
  2⤵
  PID:2116
- C:\Windows\System\vOTfkHv.exe
  C:\Windows\System\vOTfkHv.exe
  2⤵
  PID:3352
- C:\Windows\System\PkKNVzg.exe
  C:\Windows\System\PkKNVzg.exe
  2⤵
  PID:3372
- C:\Windows\System\EgqAThi.exe
  C:\Windows\System\EgqAThi.exe
  2⤵
  PID:3356
- C:\Windows\System\zOhVHUE.exe
  C:\Windows\System\zOhVHUE.exe
  2⤵
  PID:3424
- C:\Windows\System\Lczaewx.exe
  C:\Windows\System\Lczaewx.exe
  2⤵
  PID:2980
- C:\Windows\System\MkjmeDn.exe
  C:\Windows\System\MkjmeDn.exe
  2⤵
  PID:3492
- C:\Windows\System\ftOXYNs.exe
  C:\Windows\System\ftOXYNs.exe
  2⤵
  PID:2828
- C:\Windows\System\DgFHFNm.exe
  C:\Windows\System\DgFHFNm.exe
  2⤵
  PID:2156
- C:\Windows\System\NILZuif.exe
  C:\Windows\System\NILZuif.exe
  2⤵
  PID:3500
- C:\Windows\System\QEYMNxB.exe
  C:\Windows\System\QEYMNxB.exe
  2⤵
  PID:3396
- C:\Windows\System\URyugzo.exe
  C:\Windows\System\URyugzo.exe
  2⤵
  PID:284
- C:\Windows\System\sRKEqBd.exe
  C:\Windows\System\sRKEqBd.exe
  2⤵
  PID:1828
- C:\Windows\System\jtuFKOa.exe
  C:\Windows\System\jtuFKOa.exe
  2⤵
  PID:2928
- C:\Windows\System\yNSVYiY.exe
  C:\Windows\System\yNSVYiY.exe
  2⤵
  PID:2872
- C:\Windows\System\wpCbeis.exe
  C:\Windows\System\wpCbeis.exe
  2⤵
  PID:2684
- C:\Windows\System\ifWxNyG.exe
  C:\Windows\System\ifWxNyG.exe
  2⤵
  PID:1424
- C:\Windows\System\fIHOcdX.exe
  C:\Windows\System\fIHOcdX.exe
  2⤵
  PID:2920
- C:\Windows\System\LFIPYnL.exe
  C:\Windows\System\LFIPYnL.exe
  2⤵
  PID:2280
- C:\Windows\System\gwxyJoP.exe
  C:\Windows\System\gwxyJoP.exe
  2⤵
  PID:2360
- C:\Windows\System\Pjygafi.exe
  C:\Windows\System\Pjygafi.exe
  2⤵
  PID:2676
- C:\Windows\System\CbbyDlh.exe
  C:\Windows\System\CbbyDlh.exe
  2⤵
  PID:2076
- C:\Windows\System\QqCgWhw.exe
  C:\Windows\System\QqCgWhw.exe
  2⤵
  PID:1796
- C:\Windows\System\IXcDkjB.exe
  C:\Windows\System\IXcDkjB.exe
  2⤵
  PID:1304
- C:\Windows\System\zwcjAkJ.exe
  C:\Windows\System\zwcjAkJ.exe
  2⤵
  PID:3460
- C:\Windows\System\fjppKad.exe
  C:\Windows\System\fjppKad.exe
  2⤵
  PID:3464
- C:\Windows\System\dWPmLNe.exe
  C:\Windows\System\dWPmLNe.exe
  2⤵
  PID:3152
- C:\Windows\System\bisOTOo.exe
  C:\Windows\System\bisOTOo.exe
  2⤵
  PID:844
- C:\Windows\System\rSvOLPM.exe
  C:\Windows\System\rSvOLPM.exe
  2⤵
  PID:2680
- C:\Windows\System\nlfPJvP.exe
  C:\Windows\System\nlfPJvP.exe
  2⤵
  PID:3332
- C:\Windows\System\ILTSpou.exe
  C:\Windows\System\ILTSpou.exe
  2⤵
  PID:2336
- C:\Windows\System\NOGTGJu.exe
  C:\Windows\System\NOGTGJu.exe
  2⤵
  PID:3516
- C:\Windows\System\mLcQizx.exe
  C:\Windows\System\mLcQizx.exe
  2⤵
  PID:2572
- C:\Windows\System\jejNOVz.exe
  C:\Windows\System\jejNOVz.exe
  2⤵
  PID:1508
- C:\Windows\System\komwutY.exe
  C:\Windows\System\komwutY.exe
  2⤵
  PID:3560
- C:\Windows\System\Gwjvhme.exe
  C:\Windows\System\Gwjvhme.exe
  2⤵
  PID:3596
- C:\Windows\System\UfXqhaI.exe
  C:\Windows\System\UfXqhaI.exe
  2⤵
  PID:3668
- C:\Windows\System\UywgWMY.exe
  C:\Windows\System\UywgWMY.exe
  2⤵
  PID:3684
- C:\Windows\System\IPCECuW.exe
  C:\Windows\System\IPCECuW.exe
  2⤵
  PID:3688
- C:\Windows\System\cGoYUmR.exe
  C:\Windows\System\cGoYUmR.exe
  2⤵
  PID:3736
- C:\Windows\System\PmoUnpo.exe
  C:\Windows\System\PmoUnpo.exe
  2⤵
  PID:3768
- C:\Windows\System\CdvzeJd.exe
  C:\Windows\System\CdvzeJd.exe
  2⤵
  PID:3716
- C:\Windows\System\wkZHUJO.exe
  C:\Windows\System\wkZHUJO.exe
  2⤵
  PID:3780
- C:\Windows\System\xvIzXXq.exe
  C:\Windows\System\xvIzXXq.exe
  2⤵
  PID:3796
- C:\Windows\System\dFeospr.exe
  C:\Windows\System\dFeospr.exe
  2⤵
  PID:3836
- C:\Windows\System\UaZkdTe.exe
  C:\Windows\System\UaZkdTe.exe
  2⤵
  PID:3852
- C:\Windows\System\cfYuoLk.exe
  C:\Windows\System\cfYuoLk.exe
  2⤵
  PID:3904
- C:\Windows\System\KdnvPNP.exe
  C:\Windows\System\KdnvPNP.exe
  2⤵
  PID:3928
- C:\Windows\System\JKeejfM.exe
  C:\Windows\System\JKeejfM.exe
  2⤵
  PID:3968
- C:\Windows\System\bVjsURC.exe
  C:\Windows\System\bVjsURC.exe
  2⤵
  PID:3996
- C:\Windows\System\fOqTKgh.exe
  C:\Windows\System\fOqTKgh.exe
  2⤵
  PID:4036
- C:\Windows\System\GVfBdnH.exe
  C:\Windows\System\GVfBdnH.exe
  2⤵
  PID:4080
- C:\Windows\System\ViJLEVZ.exe
  C:\Windows\System\ViJLEVZ.exe
  2⤵
  PID:2356
- C:\Windows\System\DmbAdfW.exe
  C:\Windows\System\DmbAdfW.exe
  2⤵
  PID:3208
- C:\Windows\System\FFMbywy.exe
  C:\Windows\System\FFMbywy.exe
  2⤵
  PID:2184
- C:\Windows\System\CMGgANa.exe
  C:\Windows\System\CMGgANa.exe
  2⤵
  PID:3292
- C:\Windows\System\AxpBhhB.exe
  C:\Windows\System\AxpBhhB.exe
  2⤵
  PID:3364
- C:\Windows\System\tBLByDs.exe
  C:\Windows\System\tBLByDs.exe
  2⤵
  PID:3480
- C:\Windows\System\VDAaFkj.exe
  C:\Windows\System\VDAaFkj.exe
  2⤵
  PID:2152
- C:\Windows\System\BMzKPLs.exe
  C:\Windows\System\BMzKPLs.exe
  2⤵
  PID:1084
- C:\Windows\System\XnxXRRP.exe
  C:\Windows\System\XnxXRRP.exe
  2⤵
  PID:352
- C:\Windows\System\gDAsKwY.exe
  C:\Windows\System\gDAsKwY.exe
  2⤵
  PID:1872
- C:\Windows\System\gVnSRnE.exe
  C:\Windows\System\gVnSRnE.exe
  2⤵
  PID:2468
- C:\Windows\System\DHlTByo.exe
  C:\Windows\System\DHlTByo.exe
  2⤵
  PID:2352
- C:\Windows\System\dStPCeL.exe
  C:\Windows\System\dStPCeL.exe
  2⤵
  PID:3984
- C:\Windows\System\FHXdvGy.exe
  C:\Windows\System\FHXdvGy.exe
  2⤵
  PID:4092
- C:\Windows\System\ueeeRhn.exe
  C:\Windows\System\ueeeRhn.exe
  2⤵
  PID:1316
- C:\Windows\System\dTOiEYw.exe
  C:\Windows\System\dTOiEYw.exe
  2⤵
  PID:3168
- C:\Windows\System\GibMwYt.exe
  C:\Windows\System\GibMwYt.exe
  2⤵
  PID:3228
- C:\Windows\System\EsZGNrO.exe
  C:\Windows\System\EsZGNrO.exe
  2⤵
  PID:1128
- C:\Windows\System\FVVLIsp.exe
  C:\Windows\System\FVVLIsp.exe
  2⤵
  PID:2664
- C:\Windows\System\UgXLVnk.exe
  C:\Windows\System\UgXLVnk.exe
  2⤵
  PID:2720
- C:\Windows\System\inYAVeE.exe
  C:\Windows\System\inYAVeE.exe
  2⤵
  PID:1340
- C:\Windows\System\MOyNogC.exe
  C:\Windows\System\MOyNogC.exe
  2⤵
  PID:768
- C:\Windows\System\IRtJISR.exe
  C:\Windows\System\IRtJISR.exe
  2⤵
  PID:2708
- C:\Windows\System\AKkGuKg.exe
  C:\Windows\System\AKkGuKg.exe
  2⤵
  PID:3084
- C:\Windows\System\QcJMjiI.exe
  C:\Windows\System\QcJMjiI.exe
  2⤵
  PID:3276
- C:\Windows\System\LNeLbqc.exe
  C:\Windows\System\LNeLbqc.exe
  2⤵
  PID:3512
- C:\Windows\System\AFRoGbA.exe
  C:\Windows\System\AFRoGbA.exe
  2⤵
  PID:1996
- C:\Windows\System\lPxZlZF.exe
  C:\Windows\System\lPxZlZF.exe
  2⤵
  PID:1748
- C:\Windows\System\NZtsrbc.exe
  C:\Windows\System\NZtsrbc.exe
  2⤵
  PID:3592
- C:\Windows\System\bSRqdmU.exe
  C:\Windows\System\bSRqdmU.exe
  2⤵
  PID:3732
- C:\Windows\System\KRBxVxs.exe
  C:\Windows\System\KRBxVxs.exe
  2⤵
  PID:3404
- C:\Windows\System\lgIZsyH.exe
  C:\Windows\System\lgIZsyH.exe
  2⤵
  PID:3792
- C:\Windows\System\baTSida.exe
  C:\Windows\System\baTSida.exe
  2⤵
  PID:3924
- C:\Windows\System\MaFVdBa.exe
  C:\Windows\System\MaFVdBa.exe
  2⤵
  PID:4044
- C:\Windows\System\WPDluFa.exe
  C:\Windows\System\WPDluFa.exe
  2⤵
  PID:3660
- C:\Windows\System\acAYaBn.exe
  C:\Windows\System\acAYaBn.exe
  2⤵
  PID:3764
- C:\Windows\System\vASYxpO.exe
  C:\Windows\System\vASYxpO.exe
  2⤵
  PID:3808
- C:\Windows\System\vNCRpJB.exe
  C:\Windows\System\vNCRpJB.exe
  2⤵
  PID:3964
- C:\Windows\System\IzkMqWA.exe
  C:\Windows\System\IzkMqWA.exe
  2⤵
  PID:1468
- C:\Windows\System\JJikHss.exe
  C:\Windows\System\JJikHss.exe
  2⤵
  PID:3196
- C:\Windows\System\ahzWrfE.exe
  C:\Windows\System\ahzWrfE.exe
  2⤵
  PID:4060
- C:\Windows\System\IzZrvwz.exe
  C:\Windows\System\IzZrvwz.exe
  2⤵
  PID:3312
- C:\Windows\System\HyXZQnf.exe
  C:\Windows\System\HyXZQnf.exe
  2⤵
  PID:892
- C:\Windows\System\oMvTjyu.exe
  C:\Windows\System\oMvTjyu.exe
  2⤵
  PID:3540
- C:\Windows\System\kbyRrFu.exe
  C:\Windows\System\kbyRrFu.exe
  2⤵
  PID:2996
- C:\Windows\System\aGuzbfp.exe
  C:\Windows\System\aGuzbfp.exe
  2⤵
  PID:3612
- C:\Windows\System\WwkPCja.exe
  C:\Windows\System\WwkPCja.exe
  2⤵
  PID:3184
- C:\Windows\System\nCvNzJY.exe
  C:\Windows\System\nCvNzJY.exe
  2⤵
  PID:3272
- C:\Windows\System\ofQRYHp.exe
  C:\Windows\System\ofQRYHp.exe
  2⤵
  PID:2620
- C:\Windows\System\OSTNnhd.exe
  C:\Windows\System\OSTNnhd.exe
  2⤵
  PID:2948
- C:\Windows\System\lgzFlbd.exe
  C:\Windows\System\lgzFlbd.exe
  2⤵
  PID:2768
- C:\Windows\System\ULMapLQ.exe
  C:\Windows\System\ULMapLQ.exe
  2⤵
  PID:3912
- C:\Windows\System\yAasrCW.exe
  C:\Windows\System\yAasrCW.exe
  2⤵
  PID:3296
- C:\Windows\System\UIXRwNh.exe
  C:\Windows\System\UIXRwNh.exe
  2⤵
  PID:1580
- C:\Windows\System\BIONiUL.exe
  C:\Windows\System\BIONiUL.exe
  2⤵
  PID:4024
- C:\Windows\System\rSDhoTo.exe
  C:\Windows\System\rSDhoTo.exe
  2⤵
  PID:1892
- C:\Windows\System\AaAjNdd.exe
  C:\Windows\System\AaAjNdd.exe
  2⤵
  PID:3148
- C:\Windows\System\IDacLOf.exe
  C:\Windows\System\IDacLOf.exe
  2⤵
  PID:1968
- C:\Windows\System\NLAUqGi.exe
  C:\Windows\System\NLAUqGi.exe
  2⤵
  PID:344
- C:\Windows\System\IMVBkuR.exe
  C:\Windows\System\IMVBkuR.exe
  2⤵
  PID:1684
- C:\Windows\System\KhBYpiP.exe
  C:\Windows\System\KhBYpiP.exe
  2⤵
  PID:3640
- C:\Windows\System\rCkPGag.exe
  C:\Windows\System\rCkPGag.exe
  2⤵
  PID:3960
- C:\Windows\System\WwZQsqF.exe
  C:\Windows\System\WwZQsqF.exe
  2⤵
  PID:3824
- C:\Windows\System\XUVbdtX.exe
  C:\Windows\System\XUVbdtX.exe
  2⤵
  PID:1972
- C:\Windows\System\vpVpGnf.exe
  C:\Windows\System\vpVpGnf.exe
  2⤵
  PID:3940
- C:\Windows\System\uthYxYz.exe
  C:\Windows\System\uthYxYz.exe
  2⤵
  PID:2636
- C:\Windows\System\LVnMLQH.exe
  C:\Windows\System\LVnMLQH.exe
  2⤵
  PID:4112
- C:\Windows\System\PDEoWTT.exe
  C:\Windows\System\PDEoWTT.exe
  2⤵
  PID:4128
- C:\Windows\System\EcyiUFm.exe
  C:\Windows\System\EcyiUFm.exe
  2⤵
  PID:4144
- C:\Windows\System\TUkXssm.exe
  C:\Windows\System\TUkXssm.exe
  2⤵
  PID:4160
- C:\Windows\System\uEFRDCm.exe
  C:\Windows\System\uEFRDCm.exe
  2⤵
  PID:4176
- C:\Windows\System\pgiFrjZ.exe
  C:\Windows\System\pgiFrjZ.exe
  2⤵
  PID:4192
- C:\Windows\System\ZMKOSwy.exe
  C:\Windows\System\ZMKOSwy.exe
  2⤵
  PID:4208
- C:\Windows\System\UDfDRMY.exe
  C:\Windows\System\UDfDRMY.exe
  2⤵
  PID:4224
- C:\Windows\System\NdUnzQr.exe
  C:\Windows\System\NdUnzQr.exe
  2⤵
  PID:4240
- C:\Windows\System\jBSwgsF.exe
  C:\Windows\System\jBSwgsF.exe
  2⤵
  PID:4256
- C:\Windows\System\FzAqahe.exe
  C:\Windows\System\FzAqahe.exe
  2⤵
  PID:4272
- C:\Windows\System\BOIvRtE.exe
  C:\Windows\System\BOIvRtE.exe
  2⤵
  PID:4288
- C:\Windows\System\YcZXSBw.exe
  C:\Windows\System\YcZXSBw.exe
  2⤵
  PID:4304
- C:\Windows\System\OxNnbTp.exe
  C:\Windows\System\OxNnbTp.exe
  2⤵
  PID:4320
- C:\Windows\System\jmIsNKQ.exe
  C:\Windows\System\jmIsNKQ.exe
  2⤵
  PID:4336
- C:\Windows\System\OgUXQEN.exe
  C:\Windows\System\OgUXQEN.exe
  2⤵
  PID:4352
- C:\Windows\System\yohsRVE.exe
  C:\Windows\System\yohsRVE.exe
  2⤵
  PID:4368
- C:\Windows\System\LjdXKrp.exe
  C:\Windows\System\LjdXKrp.exe
  2⤵
  PID:4384
- C:\Windows\System\ZZRYTEO.exe
  C:\Windows\System\ZZRYTEO.exe
  2⤵
  PID:4400
- C:\Windows\System\AzixRVT.exe
  C:\Windows\System\AzixRVT.exe
  2⤵
  PID:4416
- C:\Windows\System\nxNXESU.exe
  C:\Windows\System\nxNXESU.exe
  2⤵
  PID:4432
- C:\Windows\System\ImVtLAX.exe
  C:\Windows\System\ImVtLAX.exe
  2⤵
  PID:4448
- C:\Windows\System\fvVxBxN.exe
  C:\Windows\System\fvVxBxN.exe
  2⤵
  PID:4468
- C:\Windows\System\ulFlRsc.exe
  C:\Windows\System\ulFlRsc.exe
  2⤵
  PID:4484
- C:\Windows\System\jSxLfkf.exe
  C:\Windows\System\jSxLfkf.exe
  2⤵
  PID:4500
- C:\Windows\System\MOPrUXf.exe
  C:\Windows\System\MOPrUXf.exe
  2⤵
  PID:4516
- C:\Windows\System\caJDEoA.exe
  C:\Windows\System\caJDEoA.exe
  2⤵
  PID:4532
- C:\Windows\System\TVwoAwd.exe
  C:\Windows\System\TVwoAwd.exe
  2⤵
  PID:4548
- C:\Windows\System\FJWhzCH.exe
  C:\Windows\System\FJWhzCH.exe
  2⤵
  PID:4564
- C:\Windows\System\sqZzMAQ.exe
  C:\Windows\System\sqZzMAQ.exe
  2⤵
  PID:4580
- C:\Windows\System\SFHNlFI.exe
  C:\Windows\System\SFHNlFI.exe
  2⤵
  PID:4596
- C:\Windows\System\BZahXEE.exe
  C:\Windows\System\BZahXEE.exe
  2⤵
  PID:4612
- C:\Windows\System\EPNSxpL.exe
  C:\Windows\System\EPNSxpL.exe
  2⤵
  PID:4628
- C:\Windows\System\FhTzNSH.exe
  C:\Windows\System\FhTzNSH.exe
  2⤵
  PID:4644
- C:\Windows\System\vKdNlhG.exe
  C:\Windows\System\vKdNlhG.exe
  2⤵
  PID:4660
- C:\Windows\System\TqzMXlI.exe
  C:\Windows\System\TqzMXlI.exe
  2⤵
  PID:4676
- C:\Windows\System\apWDGtc.exe
  C:\Windows\System\apWDGtc.exe
  2⤵
  PID:4692
- C:\Windows\System\oCmtLfs.exe
  C:\Windows\System\oCmtLfs.exe
  2⤵
  PID:4708
- C:\Windows\System\oIGkIMd.exe
  C:\Windows\System\oIGkIMd.exe
  2⤵
  PID:4724
- C:\Windows\System\IMioiXN.exe
  C:\Windows\System\IMioiXN.exe
  2⤵
  PID:4740
- C:\Windows\System\mTVoSeg.exe
  C:\Windows\System\mTVoSeg.exe
  2⤵
  PID:4756
- C:\Windows\System\AiUJBdY.exe
  C:\Windows\System\AiUJBdY.exe
  2⤵
  PID:4772
- C:\Windows\System\RFyGaTz.exe
  C:\Windows\System\RFyGaTz.exe
  2⤵
  PID:4788
- C:\Windows\System\JcpMyib.exe
  C:\Windows\System\JcpMyib.exe
  2⤵
  PID:4804
- C:\Windows\System\EYtTEGS.exe
  C:\Windows\System\EYtTEGS.exe
  2⤵
  PID:4820
- C:\Windows\System\cPoyDYV.exe
  C:\Windows\System\cPoyDYV.exe
  2⤵
  PID:4836
- C:\Windows\System\KjZZQqB.exe
  C:\Windows\System\KjZZQqB.exe
  2⤵
  PID:4852
- C:\Windows\System\iGNmVrx.exe
  C:\Windows\System\iGNmVrx.exe
  2⤵
  PID:4868
- C:\Windows\System\KGmwrgf.exe
  C:\Windows\System\KGmwrgf.exe
  2⤵
  PID:4884
- C:\Windows\System\SIztHfs.exe
  C:\Windows\System\SIztHfs.exe
  2⤵
  PID:4900
- C:\Windows\System\VdeQLbY.exe
  C:\Windows\System\VdeQLbY.exe
  2⤵
  PID:4916
- C:\Windows\System\CiUlshZ.exe
  C:\Windows\System\CiUlshZ.exe
  2⤵
  PID:4932
- C:\Windows\System\BAKHoFu.exe
  C:\Windows\System\BAKHoFu.exe
  2⤵
  PID:4948
- C:\Windows\System\SOteEop.exe
  C:\Windows\System\SOteEop.exe
  2⤵
  PID:4964
- C:\Windows\System\WPBvXWh.exe
  C:\Windows\System\WPBvXWh.exe
  2⤵
  PID:4980
- C:\Windows\System\GlvCirl.exe
  C:\Windows\System\GlvCirl.exe
  2⤵
  PID:4996
- C:\Windows\System\TalUqFW.exe
  C:\Windows\System\TalUqFW.exe
  2⤵
  PID:5012
- C:\Windows\System\NDTnOMI.exe
  C:\Windows\System\NDTnOMI.exe
  2⤵
  PID:5028
- C:\Windows\System\YbyUVyJ.exe
  C:\Windows\System\YbyUVyJ.exe
  2⤵
  PID:5044
- C:\Windows\System\HlmFjAk.exe
  C:\Windows\System\HlmFjAk.exe
  2⤵
  PID:5060
- C:\Windows\System\wyoffmn.exe
  C:\Windows\System\wyoffmn.exe
  2⤵
  PID:5076
- C:\Windows\System\iFloLHY.exe
  C:\Windows\System\iFloLHY.exe
  2⤵
  PID:5092
- C:\Windows\System\LhJlUgp.exe
  C:\Windows\System\LhJlUgp.exe
  2⤵
  PID:5108
- C:\Windows\System\AMSxxkC.exe
  C:\Windows\System\AMSxxkC.exe
  2⤵
  PID:320
- C:\Windows\System\GIUFncI.exe
  C:\Windows\System\GIUFncI.exe
  2⤵
  PID:4124
- C:\Windows\System\qixNRXa.exe
  C:\Windows\System\qixNRXa.exe
  2⤵
  PID:4156
- C:\Windows\System\pNAaRlO.exe
  C:\Windows\System\pNAaRlO.exe
  2⤵
  PID:4220
- C:\Windows\System\CufnxiI.exe
  C:\Windows\System\CufnxiI.exe
  2⤵
  PID:4284
- C:\Windows\System\VJKJdDG.exe
  C:\Windows\System\VJKJdDG.exe
  2⤵
  PID:4348
- C:\Windows\System\KCPsaXD.exe
  C:\Windows\System\KCPsaXD.exe
  2⤵
  PID:4412
- C:\Windows\System\KNzbDMy.exe
  C:\Windows\System\KNzbDMy.exe
  2⤵
  PID:4476
- C:\Windows\System\bXGOwlB.exe
  C:\Windows\System\bXGOwlB.exe
  2⤵
  PID:4108
- C:\Windows\System\XTCfQRG.exe
  C:\Windows\System\XTCfQRG.exe
  2⤵
  PID:4540
- C:\Windows\System\dLbiNgT.exe
  C:\Windows\System\dLbiNgT.exe
  2⤵
  PID:4704
- C:\Windows\System\lmUEFhk.exe
  C:\Windows\System\lmUEFhk.exe
  2⤵
  PID:3096
- C:\Windows\System\AcWPeUW.exe
  C:\Windows\System\AcWPeUW.exe
  2⤵
  PID:4800
- C:\Windows\System\BWMGsYr.exe
  C:\Windows\System\BWMGsYr.exe
  2⤵
  PID:4864
- C:\Windows\System\fAREpjS.exe
  C:\Windows\System\fAREpjS.exe
  2⤵
  PID:2232
- C:\Windows\System\CyJJovY.exe
  C:\Windows\System\CyJJovY.exe
  2⤵
  PID:4960
- C:\Windows\System\ogWhNwF.exe
  C:\Windows\System\ogWhNwF.exe
  2⤵
  PID:4200
- C:\Windows\System\ZBaHgyW.exe
  C:\Windows\System\ZBaHgyW.exe
  2⤵
  PID:4264
- C:\Windows\System\hGqdwSQ.exe
  C:\Windows\System\hGqdwSQ.exe
  2⤵
  PID:4296
- C:\Windows\System\xUMfDhv.exe
  C:\Windows\System\xUMfDhv.exe
  2⤵
  PID:3564
- C:\Windows\System\tecHdLB.exe
  C:\Windows\System\tecHdLB.exe
  2⤵
  PID:5116
- C:\Windows\System\QppSJsb.exe
  C:\Windows\System\QppSJsb.exe
  2⤵
  PID:4280
- C:\Windows\System\xbnjLWG.exe
  C:\Windows\System\xbnjLWG.exe
  2⤵
  PID:4512
- C:\Windows\System\ATogXib.exe
  C:\Windows\System\ATogXib.exe
  2⤵
  PID:5004
- C:\Windows\System\QlUJMAZ.exe
  C:\Windows\System\QlUJMAZ.exe
  2⤵
  PID:4232
- C:\Windows\System\XyzxqdB.exe
  C:\Windows\System\XyzxqdB.exe
  2⤵
  PID:4328
- C:\Windows\System\ehJeZSb.exe
  C:\Windows\System\ehJeZSb.exe
  2⤵
  PID:4844
- C:\Windows\System\dwLSzCx.exe
  C:\Windows\System\dwLSzCx.exe
  2⤵
  PID:4496
- C:\Windows\System\QvtZaiG.exe
  C:\Windows\System\QvtZaiG.exe
  2⤵
  PID:4588
- C:\Windows\System\ytLaupA.exe
  C:\Windows\System\ytLaupA.exe
  2⤵
  PID:4652
- C:\Windows\System\OyMIUSf.exe
  C:\Windows\System\OyMIUSf.exe
  2⤵
  PID:5100
- C:\Windows\System\XMThazT.exe
  C:\Windows\System\XMThazT.exe
  2⤵
  PID:4748
- C:\Windows\System\gcrvlpI.exe
  C:\Windows\System\gcrvlpI.exe
  2⤵
  PID:4188
- C:\Windows\System\QZZreVI.exe
  C:\Windows\System\QZZreVI.exe
  2⤵
  PID:4316
- C:\Windows\System\YSuikdk.exe
  C:\Windows\System\YSuikdk.exe
  2⤵
  PID:4444
- C:\Windows\System\QGLNjla.exe
  C:\Windows\System\QGLNjla.exe
  2⤵
  PID:4140
- C:\Windows\System\ssnGrIo.exe
  C:\Windows\System\ssnGrIo.exe
  2⤵
  PID:4976
- C:\Windows\System\LGffDLx.exe
  C:\Windows\System\LGffDLx.exe
  2⤵
  PID:4604
- C:\Windows\System\rRcphRL.exe
  C:\Windows\System\rRcphRL.exe
  2⤵
  PID:4636
- C:\Windows\System\AMRzNgk.exe
  C:\Windows\System\AMRzNgk.exe
  2⤵
  PID:4700
- C:\Windows\System\aqfqOgJ.exe
  C:\Windows\System\aqfqOgJ.exe
  2⤵
  PID:4424
- C:\Windows\System\aWQKetl.exe
  C:\Windows\System\aWQKetl.exe
  2⤵
  PID:4832
- C:\Windows\System\McBTjeT.exe
  C:\Windows\System\McBTjeT.exe
  2⤵
  PID:4896
- C:\Windows\System\gNPaIYL.exe
  C:\Windows\System\gNPaIYL.exe
  2⤵
  PID:5020
- C:\Windows\System\NZvAwFU.exe
  C:\Windows\System\NZvAwFU.exe
  2⤵
  PID:5088
- C:\Windows\System\LUmguHn.exe
  C:\Windows\System\LUmguHn.exe
  2⤵
  PID:4508
- C:\Windows\System\GxDxPPS.exe
  C:\Windows\System\GxDxPPS.exe
  2⤵
  PID:4524
- C:\Windows\System\nzObtwK.exe
  C:\Windows\System\nzObtwK.exe
  2⤵
  PID:4528
- C:\Windows\System\hmfhozy.exe
  C:\Windows\System\hmfhozy.exe
  2⤵
  PID:1624
- C:\Windows\System\xSSHEFx.exe
  C:\Windows\System\xSSHEFx.exe
  2⤵
  PID:4720
- C:\Windows\System\fRuhtgS.exe
  C:\Windows\System\fRuhtgS.exe
  2⤵
  PID:5104
- C:\Windows\System\ynkGRBd.exe
  C:\Windows\System\ynkGRBd.exe
  2⤵
  PID:4624
- C:\Windows\System\lCntjMI.exe
  C:\Windows\System\lCntjMI.exe
  2⤵
  PID:4848
- C:\Windows\System\zZaOzUH.exe
  C:\Windows\System\zZaOzUH.exe
  2⤵
  PID:4912
- C:\Windows\System\dJnGbMa.exe
  C:\Windows\System\dJnGbMa.exe
  2⤵
  PID:3680
- C:\Windows\System\nZCglCe.exe
  C:\Windows\System\nZCglCe.exe
  2⤵
  PID:4764
- C:\Windows\System\jHwkRHZ.exe
  C:\Windows\System\jHwkRHZ.exe
  2⤵
  PID:5056
- C:\Windows\System\JfDvhAX.exe
  C:\Windows\System\JfDvhAX.exe
  2⤵
  PID:4392
- C:\Windows\System\wuEnxJF.exe
  C:\Windows\System\wuEnxJF.exe
  2⤵
  PID:4688
- C:\Windows\System\biBkzWX.exe
  C:\Windows\System\biBkzWX.exe
  2⤵
  PID:5072
- C:\Windows\System\pleKaul.exe
  C:\Windows\System\pleKaul.exe
  2⤵
  PID:4944
- C:\Windows\System\oRjeiwv.exe
  C:\Windows\System\oRjeiwv.exe
  2⤵
  PID:4492
- C:\Windows\System\NYeJjdX.exe
  C:\Windows\System\NYeJjdX.exe
  2⤵
  PID:4992
- C:\Windows\System\SMEGzrK.exe
  C:\Windows\System\SMEGzrK.exe
  2⤵
  PID:4780
- C:\Windows\System\wTrTqer.exe
  C:\Windows\System\wTrTqer.exe
  2⤵
  PID:4736
- C:\Windows\System\tFfEdUF.exe
  C:\Windows\System\tFfEdUF.exe
  2⤵
  PID:4360
- C:\Windows\System\cGGTRZS.exe
  C:\Windows\System\cGGTRZS.exe
  2⤵
  PID:5124
- C:\Windows\System\CYwxwqK.exe
  C:\Windows\System\CYwxwqK.exe
  2⤵
  PID:5140
- C:\Windows\System\VtLrdYB.exe
  C:\Windows\System\VtLrdYB.exe
  2⤵
  PID:5160
- C:\Windows\System\fPjmQtM.exe
  C:\Windows\System\fPjmQtM.exe
  2⤵
  PID:5176
- C:\Windows\System\LyhRHsw.exe
  C:\Windows\System\LyhRHsw.exe
  2⤵
  PID:5192
- C:\Windows\System\lLQsUbk.exe
  C:\Windows\System\lLQsUbk.exe
  2⤵
  PID:5208
- C:\Windows\System\dnhXslD.exe
  C:\Windows\System\dnhXslD.exe
  2⤵
  PID:5224
- C:\Windows\System\tkizUuJ.exe
  C:\Windows\System\tkizUuJ.exe
  2⤵
  PID:5240
- C:\Windows\System\GZDhRCU.exe
  C:\Windows\System\GZDhRCU.exe
  2⤵
  PID:5260
- C:\Windows\System\aXeSCJH.exe
  C:\Windows\System\aXeSCJH.exe
  2⤵
  PID:5276
- C:\Windows\System\VjvvZnP.exe
  C:\Windows\System\VjvvZnP.exe
  2⤵
  PID:5292
- C:\Windows\System\wFnGWgv.exe
  C:\Windows\System\wFnGWgv.exe
  2⤵
  PID:5308
- C:\Windows\System\WiDTden.exe
  C:\Windows\System\WiDTden.exe
  2⤵
  PID:5324
- C:\Windows\System\BylzvRK.exe
  C:\Windows\System\BylzvRK.exe
  2⤵
  PID:5340
- C:\Windows\System\wYIoKdj.exe
  C:\Windows\System\wYIoKdj.exe
  2⤵
  PID:5356
- C:\Windows\System\HRdZDsb.exe
  C:\Windows\System\HRdZDsb.exe
  2⤵
  PID:5372
- C:\Windows\System\VqCPPGJ.exe
  C:\Windows\System\VqCPPGJ.exe
  2⤵
  PID:5388
- C:\Windows\System\qqBpLnQ.exe
  C:\Windows\System\qqBpLnQ.exe
  2⤵
  PID:5404
- C:\Windows\System\GfcEDtS.exe
  C:\Windows\System\GfcEDtS.exe
  2⤵
  PID:5420
- C:\Windows\System\XmhSOoZ.exe
  C:\Windows\System\XmhSOoZ.exe
  2⤵
  PID:5440
- C:\Windows\System\nXSdFVl.exe
  C:\Windows\System\nXSdFVl.exe
  2⤵
  PID:5456
- C:\Windows\System\AWHTyto.exe
  C:\Windows\System\AWHTyto.exe
  2⤵
  PID:5472
- C:\Windows\System\oJOuTTQ.exe
  C:\Windows\System\oJOuTTQ.exe
  2⤵
  PID:5488
- C:\Windows\System\wwuClKQ.exe
  C:\Windows\System\wwuClKQ.exe
  2⤵
  PID:5504
- C:\Windows\System\SAeTSMR.exe
  C:\Windows\System\SAeTSMR.exe
  2⤵
  PID:5520
- C:\Windows\System\CBaXJsB.exe
  C:\Windows\System\CBaXJsB.exe
  2⤵
  PID:5536
- C:\Windows\System\VDMuLca.exe
  C:\Windows\System\VDMuLca.exe
  2⤵
  PID:5556
- C:\Windows\System\qZIYKOr.exe
  C:\Windows\System\qZIYKOr.exe
  2⤵
  PID:5572
- C:\Windows\System\qgwweVD.exe
  C:\Windows\System\qgwweVD.exe
  2⤵
  PID:5588
- C:\Windows\System\bQKLHzA.exe
  C:\Windows\System\bQKLHzA.exe
  2⤵
  PID:5604
- C:\Windows\System\twghskd.exe
  C:\Windows\System\twghskd.exe
  2⤵
  PID:5620
- C:\Windows\System\LpWadGM.exe
  C:\Windows\System\LpWadGM.exe
  2⤵
  PID:5636
- C:\Windows\System\FwoTYGP.exe
  C:\Windows\System\FwoTYGP.exe
  2⤵
  PID:5652
- C:\Windows\System\igNgkKe.exe
  C:\Windows\System\igNgkKe.exe
  2⤵
  PID:5668
- C:\Windows\System\dRMLmsn.exe
  C:\Windows\System\dRMLmsn.exe
  2⤵
  PID:5684
- C:\Windows\System\WUcQMWg.exe
  C:\Windows\System\WUcQMWg.exe
  2⤵
  PID:5700
- C:\Windows\System\TKbkJcx.exe
  C:\Windows\System\TKbkJcx.exe
  2⤵
  PID:5716
- C:\Windows\System\WHwmndV.exe
  C:\Windows\System\WHwmndV.exe
  2⤵
  PID:5732
- C:\Windows\System\jozhvTD.exe
  C:\Windows\System\jozhvTD.exe
  2⤵
  PID:5748
- C:\Windows\System\LUxmRAd.exe
  C:\Windows\System\LUxmRAd.exe
  2⤵
  PID:5764
- C:\Windows\System\SWljKJc.exe
  C:\Windows\System\SWljKJc.exe
  2⤵
  PID:5780
- C:\Windows\System\rrWhYGP.exe
  C:\Windows\System\rrWhYGP.exe
  2⤵
  PID:5796
- C:\Windows\System\qXyoIAR.exe
  C:\Windows\System\qXyoIAR.exe
  2⤵
  PID:5812
- C:\Windows\System\uMKOFbW.exe
  C:\Windows\System\uMKOFbW.exe
  2⤵
  PID:5828
- C:\Windows\System\VGkkQfy.exe
  C:\Windows\System\VGkkQfy.exe
  2⤵
  PID:5844
- C:\Windows\System\jouGSgw.exe
  C:\Windows\System\jouGSgw.exe
  2⤵
  PID:5860
- C:\Windows\System\yWZsDWF.exe
  C:\Windows\System\yWZsDWF.exe
  2⤵
  PID:5876
- C:\Windows\System\ENsFgSG.exe
  C:\Windows\System\ENsFgSG.exe
  2⤵
  PID:5892
- C:\Windows\System\jPwGkox.exe
  C:\Windows\System\jPwGkox.exe
  2⤵
  PID:5908
- C:\Windows\System\TUDAVix.exe
  C:\Windows\System\TUDAVix.exe
  2⤵
  PID:5924
- C:\Windows\System\cULMhMD.exe
  C:\Windows\System\cULMhMD.exe
  2⤵
  PID:5940
- C:\Windows\System\EJunmlZ.exe
  C:\Windows\System\EJunmlZ.exe
  2⤵
  PID:5956
- C:\Windows\System\RFwJwBn.exe
  C:\Windows\System\RFwJwBn.exe
  2⤵
  PID:5976
- C:\Windows\System\azKuMxN.exe
  C:\Windows\System\azKuMxN.exe
  2⤵
  PID:5992
- C:\Windows\System\bBsEUEL.exe
  C:\Windows\System\bBsEUEL.exe
  2⤵
  PID:6008
- C:\Windows\System\oKMqmTH.exe
  C:\Windows\System\oKMqmTH.exe
  2⤵
  PID:6024
- C:\Windows\System\aVRUcTn.exe
  C:\Windows\System\aVRUcTn.exe
  2⤵
  PID:6040
- C:\Windows\System\iAFSpBJ.exe
  C:\Windows\System\iAFSpBJ.exe
  2⤵
  PID:6056
- C:\Windows\System\OggSkQd.exe
  C:\Windows\System\OggSkQd.exe
  2⤵
  PID:6072
- C:\Windows\System\nTpnqcA.exe
  C:\Windows\System\nTpnqcA.exe
  2⤵
  PID:6088
- C:\Windows\System\VRJxXET.exe
  C:\Windows\System\VRJxXET.exe
  2⤵
  PID:6104
- C:\Windows\System\bzskeVL.exe
  C:\Windows\System\bzskeVL.exe
  2⤵
  PID:6120
- C:\Windows\System\Dqfuwmh.exe
  C:\Windows\System\Dqfuwmh.exe
  2⤵
  PID:6136
- C:\Windows\System\CYbvmlN.exe
  C:\Windows\System\CYbvmlN.exe
  2⤵
  PID:4880
- C:\Windows\System\EJqjdBA.exe
  C:\Windows\System\EJqjdBA.exe
  2⤵
  PID:5148
- C:\Windows\System\kxmYveu.exe
  C:\Windows\System\kxmYveu.exe
  2⤵
  PID:5188
- C:\Windows\System\EHFynSx.exe
  C:\Windows\System\EHFynSx.exe
  2⤵
  PID:5252
- C:\Windows\System\sBMMkqQ.exe
  C:\Windows\System\sBMMkqQ.exe
  2⤵
  PID:5320
- C:\Windows\System\lxVCnwk.exe
  C:\Windows\System\lxVCnwk.exe
  2⤵
  PID:5348
- C:\Windows\System\DZMKrnX.exe
  C:\Windows\System\DZMKrnX.exe
  2⤵
  PID:5412
- C:\Windows\System\dPHVFAH.exe
  C:\Windows\System\dPHVFAH.exe
  2⤵
  PID:5516
- C:\Windows\System\YzkZOjX.exe
  C:\Windows\System\YzkZOjX.exe
  2⤵
  PID:5452
- C:\Windows\System\ZPrlnOS.exe
  C:\Windows\System\ZPrlnOS.exe
  2⤵
  PID:5612
- C:\Windows\System\byGqKNA.exe
  C:\Windows\System\byGqKNA.exe
  2⤵
  PID:3340
- C:\Windows\System\GhBSTuc.exe
  C:\Windows\System\GhBSTuc.exe
  2⤵
  PID:5132
- C:\Windows\System\FvpCNLo.exe
  C:\Windows\System\FvpCNLo.exe
  2⤵
  PID:4796
- C:\Windows\System\kWaesNr.exe
  C:\Windows\System\kWaesNr.exe
  2⤵
  PID:5744
- C:\Windows\System\izVryWV.exe
  C:\Windows\System\izVryWV.exe
  2⤵
  PID:5808
- C:\Windows\System\jUthHlv.exe
  C:\Windows\System\jUthHlv.exe
  2⤵
  PID:5872
- C:\Windows\System\SnmzvxA.exe
  C:\Windows\System\SnmzvxA.exe
  2⤵
  PID:5168
- C:\Windows\System\shfLGtP.exe
  C:\Windows\System\shfLGtP.exe
  2⤵
  PID:5268
- C:\Windows\System\fGnudUN.exe
  C:\Windows\System\fGnudUN.exe
  2⤵
  PID:5568
- C:\Windows\System\oOVJkzW.exe
  C:\Windows\System\oOVJkzW.exe
  2⤵
  PID:5368
- C:\Windows\System\KftzgeM.exe
  C:\Windows\System\KftzgeM.exe
  2⤵
  PID:5436
- C:\Windows\System\dEclFwk.exe
  C:\Windows\System\dEclFwk.exe
  2⤵
  PID:5500
- C:\Windows\System\WiFklGZ.exe
  C:\Windows\System\WiFklGZ.exe
  2⤵
  PID:5900
- C:\Windows\System\vtlkLQB.exe
  C:\Windows\System\vtlkLQB.exe
  2⤵
  PID:5964
- C:\Windows\System\JlbHprp.exe
  C:\Windows\System\JlbHprp.exe
  2⤵
  PID:6000
- C:\Windows\System\NPbQnww.exe
  C:\Windows\System\NPbQnww.exe
  2⤵
  PID:6004
- C:\Windows\System\rsfviOJ.exe
  C:\Windows\System\rsfviOJ.exe
  2⤵
  PID:5884
- C:\Windows\System\TtMuXOW.exe
  C:\Windows\System\TtMuXOW.exe
  2⤵
  PID:5600
- C:\Windows\System\QWUTCFP.exe
  C:\Windows\System\QWUTCFP.exe
  2⤵
  PID:5692
- C:\Windows\System\yEhbGXe.exe
  C:\Windows\System\yEhbGXe.exe
  2⤵
  PID:5792
- C:\Windows\System\yzVaNtL.exe
  C:\Windows\System\yzVaNtL.exe
  2⤵
  PID:6036
- C:\Windows\System\CfwBkho.exe
  C:\Windows\System\CfwBkho.exe
  2⤵
  PID:6096
- C:\Windows\System\ovdcsWg.exe
  C:\Windows\System\ovdcsWg.exe
  2⤵
  PID:4812
- C:\Windows\System\NxntMiM.exe
  C:\Windows\System\NxntMiM.exe
  2⤵
  PID:1180
- C:\Windows\System\wMeisry.exe
  C:\Windows\System\wMeisry.exe
  2⤵
  PID:5480
- C:\Windows\System\TjTvMgd.exe
  C:\Windows\System\TjTvMgd.exe
  2⤵
  PID:5580
- C:\Windows\System\UlYfqsN.exe
  C:\Windows\System\UlYfqsN.exe
  2⤵
  PID:5708
- C:\Windows\System\zFDfVuQ.exe
  C:\Windows\System\zFDfVuQ.exe
  2⤵
  PID:5952
- C:\Windows\System\HjOjGFT.exe
  C:\Windows\System\HjOjGFT.exe
  2⤵
  PID:6116
- C:\Windows\System\iKzuoQq.exe
  C:\Windows\System\iKzuoQq.exe
  2⤵
  PID:5156
- C:\Windows\System\IEXOKzV.exe
  C:\Windows\System\IEXOKzV.exe
  2⤵
  PID:5316
- C:\Windows\System\TIVUCiT.exe
  C:\Windows\System\TIVUCiT.exe
  2⤵
  PID:5868
- C:\Windows\System\nEyzwwv.exe
  C:\Windows\System\nEyzwwv.exe
  2⤵
  PID:5364
- C:\Windows\System\LsXGkce.exe
  C:\Windows\System\LsXGkce.exe
  2⤵
  PID:5728
- C:\Windows\System\fdiKMIK.exe
  C:\Windows\System\fdiKMIK.exe
  2⤵
  PID:5400
- C:\Windows\System\oFCyZmy.exe
  C:\Windows\System\oFCyZmy.exe
  2⤵
  PID:5532
- C:\Windows\System\lEiOItY.exe
  C:\Windows\System\lEiOItY.exe
  2⤵
  PID:5432
- C:\Windows\System\uPmtLDe.exe
  C:\Windows\System\uPmtLDe.exe
  2⤵
  PID:5552
- C:\Windows\System\jCvmmAX.exe
  C:\Windows\System\jCvmmAX.exe
  2⤵
  PID:5200
- C:\Windows\System\hEOxsyq.exe
  C:\Windows\System\hEOxsyq.exe
  2⤵
  PID:5428
- C:\Windows\System\wvMYhsC.exe
  C:\Windows\System\wvMYhsC.exe
  2⤵
  PID:5916
- C:\Windows\System\ZopOlQN.exe
  C:\Windows\System\ZopOlQN.exe
  2⤵
  PID:5984
- C:\Windows\System\QuRlesV.exe
  C:\Windows\System\QuRlesV.exe
  2⤵
  PID:5220
- C:\Windows\System\aEiDEVf.exe
  C:\Windows\System\aEiDEVf.exe
  2⤵
  PID:6020
- C:\Windows\System\QVeZQht.exe
  C:\Windows\System\QVeZQht.exe
  2⤵
  PID:308
- C:\Windows\System\drogAcO.exe
  C:\Windows\System\drogAcO.exe
  2⤵
  PID:5932
- C:\Windows\System\THlwemr.exe
  C:\Windows\System\THlwemr.exe
  2⤵
  PID:5380
- C:\Windows\System\KQibgcL.exe
  C:\Windows\System\KQibgcL.exe
  2⤵
  PID:5300
- C:\Windows\System\GITAopn.exe
  C:\Windows\System\GITAopn.exe
  2⤵
  PID:5756
- C:\Windows\System\FiXpdHR.exe
  C:\Windows\System\FiXpdHR.exe
  2⤵
  PID:4076
- C:\Windows\System\ZKvYKGH.exe
  C:\Windows\System\ZKvYKGH.exe
  2⤵
  PID:4656
- C:\Windows\System\dYJAxSO.exe
  C:\Windows\System\dYJAxSO.exe
  2⤵
  PID:5172
- C:\Windows\System\HnWDOYb.exe
  C:\Windows\System\HnWDOYb.exe
  2⤵
  PID:6068
- C:\Windows\System\pWbKCFV.exe
  C:\Windows\System\pWbKCFV.exe
  2⤵
  PID:5596
- C:\Windows\System\eWlFCNh.exe
  C:\Windows\System\eWlFCNh.exe
  2⤵
  PID:6148
- C:\Windows\System\HgSzWgz.exe
  C:\Windows\System\HgSzWgz.exe
  2⤵
  PID:6168
- C:\Windows\System\TlNZUHd.exe
  C:\Windows\System\TlNZUHd.exe
  2⤵
  PID:6184
- C:\Windows\System\RqFEEYW.exe
  C:\Windows\System\RqFEEYW.exe
  2⤵
  PID:6200
- C:\Windows\System\jOALYsJ.exe
  C:\Windows\System\jOALYsJ.exe
  2⤵
  PID:6216
- C:\Windows\System\gFiWWtM.exe
  C:\Windows\System\gFiWWtM.exe
  2⤵
  PID:6232
- C:\Windows\System\TbYSGWY.exe
  C:\Windows\System\TbYSGWY.exe
  2⤵
  PID:6248
- C:\Windows\System\oLVkvgt.exe
  C:\Windows\System\oLVkvgt.exe
  2⤵
  PID:6264
- C:\Windows\System\sfrLzYo.exe
  C:\Windows\System\sfrLzYo.exe
  2⤵
  PID:6280
- C:\Windows\System\jVHrtRp.exe
  C:\Windows\System\jVHrtRp.exe
  2⤵
  PID:6296
- C:\Windows\System\VwTCRdm.exe
  C:\Windows\System\VwTCRdm.exe
  2⤵
  PID:6312
- C:\Windows\System\fwEMfZJ.exe
  C:\Windows\System\fwEMfZJ.exe
  2⤵
  PID:6332
- C:\Windows\System\WWLglMc.exe
  C:\Windows\System\WWLglMc.exe
  2⤵
  PID:6348
- C:\Windows\System\EfPzqhj.exe
  C:\Windows\System\EfPzqhj.exe
  2⤵
  PID:6364
- C:\Windows\System\BMhLztq.exe
  C:\Windows\System\BMhLztq.exe
  2⤵
  PID:6380
- C:\Windows\System\gxGCWbQ.exe
  C:\Windows\System\gxGCWbQ.exe
  2⤵
  PID:6396
- C:\Windows\System\WOQsrPJ.exe
  C:\Windows\System\WOQsrPJ.exe
  2⤵
  PID:6412
- C:\Windows\System\isnouqT.exe
  C:\Windows\System\isnouqT.exe
  2⤵
  PID:6428
- C:\Windows\System\pMruZql.exe
  C:\Windows\System\pMruZql.exe
  2⤵
  PID:6444
- C:\Windows\System\ODwNoJL.exe
  C:\Windows\System\ODwNoJL.exe
  2⤵
  PID:6460
- C:\Windows\System\KwUBamN.exe
  C:\Windows\System\KwUBamN.exe
  2⤵
  PID:6476
- C:\Windows\System\cAjlwWm.exe
  C:\Windows\System\cAjlwWm.exe
  2⤵
  PID:6492
- C:\Windows\System\QaTSJNB.exe
  C:\Windows\System\QaTSJNB.exe
  2⤵
  PID:6508
- C:\Windows\System\chuQgaL.exe
  C:\Windows\System\chuQgaL.exe
  2⤵
  PID:6524
- C:\Windows\System\nXqyFEP.exe
  C:\Windows\System\nXqyFEP.exe
  2⤵
  PID:6540
- C:\Windows\System\TzPnCpN.exe
  C:\Windows\System\TzPnCpN.exe
  2⤵
  PID:6556
- C:\Windows\System\ddumlQg.exe
  C:\Windows\System\ddumlQg.exe
  2⤵
  PID:6572
- C:\Windows\System\yRaAtlt.exe
  C:\Windows\System\yRaAtlt.exe
  2⤵
  PID:6588
- C:\Windows\System\lWYHfCc.exe
  C:\Windows\System\lWYHfCc.exe
  2⤵
  PID:6604
- C:\Windows\System\HmVKOuh.exe
  C:\Windows\System\HmVKOuh.exe
  2⤵
  PID:6620
- C:\Windows\System\rPAxbhj.exe
  C:\Windows\System\rPAxbhj.exe
  2⤵
  PID:6636
- C:\Windows\System\ZXANUgR.exe
  C:\Windows\System\ZXANUgR.exe
  2⤵
  PID:6652
- C:\Windows\System\BfKKZTA.exe
  C:\Windows\System\BfKKZTA.exe
  2⤵
  PID:6668
- C:\Windows\System\LDElNvy.exe
  C:\Windows\System\LDElNvy.exe
  2⤵
  PID:6684
- C:\Windows\System\bnAHqbh.exe
  C:\Windows\System\bnAHqbh.exe
  2⤵
  PID:6700
- C:\Windows\System\tofTocj.exe
  C:\Windows\System\tofTocj.exe
  2⤵
  PID:6716
- C:\Windows\System\RLQntIr.exe
  C:\Windows\System\RLQntIr.exe
  2⤵
  PID:6732
- C:\Windows\System\IvyUOlK.exe
  C:\Windows\System\IvyUOlK.exe
  2⤵
  PID:6748
- C:\Windows\System\nTkJNbL.exe
  C:\Windows\System\nTkJNbL.exe
  2⤵
  PID:6764
- C:\Windows\System\oZHjmrW.exe
  C:\Windows\System\oZHjmrW.exe
  2⤵
  PID:6780
- C:\Windows\System\eVLaGKk.exe
  C:\Windows\System\eVLaGKk.exe
  2⤵
  PID:6796
- C:\Windows\System\qGwKTBj.exe
  C:\Windows\System\qGwKTBj.exe
  2⤵
  PID:6812
- C:\Windows\System\LWEgdum.exe
  C:\Windows\System\LWEgdum.exe
  2⤵
  PID:6828
- C:\Windows\System\FOZINbv.exe
  C:\Windows\System\FOZINbv.exe
  2⤵
  PID:6844
- C:\Windows\System\WBqeccE.exe
  C:\Windows\System\WBqeccE.exe
  2⤵
  PID:6860
- C:\Windows\System\gqSUMCy.exe
  C:\Windows\System\gqSUMCy.exe
  2⤵
  PID:6876
- C:\Windows\System\ihRvKZi.exe
  C:\Windows\System\ihRvKZi.exe
  2⤵
  PID:6892
- C:\Windows\System\tPPTINc.exe
  C:\Windows\System\tPPTINc.exe
  2⤵
  PID:6908
- C:\Windows\System\AIoPado.exe
  C:\Windows\System\AIoPado.exe
  2⤵
  PID:6924
- C:\Windows\System\qysEgal.exe
  C:\Windows\System\qysEgal.exe
  2⤵
  PID:6940
- C:\Windows\System\GcXQuqC.exe
  C:\Windows\System\GcXQuqC.exe
  2⤵
  PID:6956
- C:\Windows\System\ZCJEIkj.exe
  C:\Windows\System\ZCJEIkj.exe
  2⤵
  PID:6972
- C:\Windows\System\eDIwnFb.exe
  C:\Windows\System\eDIwnFb.exe
  2⤵
  PID:6988
- C:\Windows\System\bJmMuij.exe
  C:\Windows\System\bJmMuij.exe
  2⤵
  PID:7004
- C:\Windows\System\VWaWgXA.exe
  C:\Windows\System\VWaWgXA.exe
  2⤵
  PID:7020
- C:\Windows\System\BKcaRSr.exe
  C:\Windows\System\BKcaRSr.exe
  2⤵
  PID:7036
- C:\Windows\System\bjJxVRm.exe
  C:\Windows\System\bjJxVRm.exe
  2⤵
  PID:7052
- C:\Windows\System\xzfSELd.exe
  C:\Windows\System\xzfSELd.exe
  2⤵
  PID:7068
- C:\Windows\System\eyHlDSM.exe
  C:\Windows\System\eyHlDSM.exe
  2⤵
  PID:7084
- C:\Windows\System\QxzTBVo.exe
  C:\Windows\System\QxzTBVo.exe
  2⤵
  PID:7100
- C:\Windows\System\JUVnTKb.exe
  C:\Windows\System\JUVnTKb.exe
  2⤵
  PID:7120
- C:\Windows\System\SmcedJI.exe
  C:\Windows\System\SmcedJI.exe
  2⤵
  PID:7136
- C:\Windows\System\eHNsHxw.exe
  C:\Windows\System\eHNsHxw.exe
  2⤵
  PID:7152
- C:\Windows\System\RZbTwBH.exe
  C:\Windows\System\RZbTwBH.exe
  2⤵
  PID:4408
- C:\Windows\System\kBwSIeZ.exe
  C:\Windows\System\kBwSIeZ.exe
  2⤵
  PID:5548
- C:\Windows\System\poulrgI.exe
  C:\Windows\System\poulrgI.exe
  2⤵
  PID:5304
- C:\Windows\System\WGKyngg.exe
  C:\Windows\System\WGKyngg.exe
  2⤵
  PID:6192
- C:\Windows\System\OQCFXGC.exe
  C:\Windows\System\OQCFXGC.exe
  2⤵
  PID:6160
- C:\Windows\System\NUQfZtQ.exe
  C:\Windows\System\NUQfZtQ.exe
  2⤵
  PID:6260
- C:\Windows\System\jbBxvOM.exe
  C:\Windows\System\jbBxvOM.exe
  2⤵
  PID:6320
- C:\Windows\System\TZoqlrn.exe
  C:\Windows\System\TZoqlrn.exe
  2⤵
  PID:6176
- C:\Windows\System\dPOMFWZ.exe
  C:\Windows\System\dPOMFWZ.exe
  2⤵
  PID:6360
- C:\Windows\System\UmIXixW.exe
  C:\Windows\System\UmIXixW.exe
  2⤵
  PID:6392
- C:\Windows\System\wQuxPJm.exe
  C:\Windows\System\wQuxPJm.exe
  2⤵
  PID:6212
- C:\Windows\System\cXuZWdr.exe
  C:\Windows\System\cXuZWdr.exe
  2⤵
  PID:6272
- C:\Windows\System\ZyVFKNt.exe
  C:\Windows\System\ZyVFKNt.exe
  2⤵
  PID:6456
- C:\Windows\System\tIkHlud.exe
  C:\Windows\System\tIkHlud.exe
  2⤵
  PID:6520
- C:\Windows\System\QnOEScf.exe
  C:\Windows\System\QnOEScf.exe
  2⤵
  PID:6584
- C:\Windows\System\YsApLKs.exe
  C:\Windows\System\YsApLKs.exe
  2⤵
  PID:6648
- C:\Windows\System\cFDddXr.exe
  C:\Windows\System\cFDddXr.exe
  2⤵
  PID:6712
- C:\Windows\System\bcAAsom.exe
  C:\Windows\System\bcAAsom.exe
  2⤵
  PID:6776
- C:\Windows\System\mkeCChN.exe
  C:\Windows\System\mkeCChN.exe
  2⤵
  PID:6840
- C:\Windows\System\YggOwgk.exe
  C:\Windows\System\YggOwgk.exe
  2⤵
  PID:6932
- C:\Windows\System\tidPGzf.exe
  C:\Windows\System\tidPGzf.exe
  2⤵
  PID:7028
- C:\Windows\System\OMmtFBX.exe
  C:\Windows\System\OMmtFBX.exe
  2⤵
  PID:6344
- C:\Windows\System\zijwuhT.exe
  C:\Windows\System\zijwuhT.exe
  2⤵
  PID:7064
- C:\Windows\System\XOMduXm.exe
  C:\Windows\System\XOMduXm.exe
  2⤵
  PID:6916
- C:\Windows\System\sBYAdHf.exe
  C:\Windows\System\sBYAdHf.exe
  2⤵
  PID:6600
- C:\Windows\System\RHKBfKo.exe
  C:\Windows\System\RHKBfKo.exe
  2⤵
  PID:6372
- C:\Windows\System\HKATUdz.exe
  C:\Windows\System\HKATUdz.exe
  2⤵
  PID:6440
- C:\Windows\System\YkexvqX.exe
  C:\Windows\System\YkexvqX.exe
  2⤵
  PID:6500
- C:\Windows\System\CUqGxHk.exe
  C:\Windows\System\CUqGxHk.exe
  2⤵
  PID:6568
- C:\Windows\System\BXfJoeM.exe
  C:\Windows\System\BXfJoeM.exe
  2⤵
  PID:6760
- C:\Windows\System\IfSbEkD.exe
  C:\Windows\System\IfSbEkD.exe
  2⤵
  PID:6824
- C:\Windows\System\jqWeWsl.exe
  C:\Windows\System\jqWeWsl.exe
  2⤵
  PID:6948
- C:\Windows\System\OKQPpOb.exe
  C:\Windows\System\OKQPpOb.exe
  2⤵
  PID:7080
- C:\Windows\System\bOsyQzI.exe
  C:\Windows\System\bOsyQzI.exe
  2⤵
  PID:7144
- C:\Windows\System\AkOZzve.exe
  C:\Windows\System\AkOZzve.exe
  2⤵
  PID:5948
- C:\Windows\System\zzEHLIv.exe
  C:\Windows\System\zzEHLIv.exe
  2⤵
  PID:6256
- C:\Windows\System\hjlleVd.exe
  C:\Windows\System\hjlleVd.exe
  2⤵
  PID:6240
- C:\Windows\System\wtvrQhr.exe
  C:\Windows\System\wtvrQhr.exe
  2⤵
  PID:6808
- C:\Windows\System\GSahzUf.exe
  C:\Windows\System\GSahzUf.exe
  2⤵
  PID:6968
- C:\Windows\System\SfdVJvQ.exe
  C:\Windows\System\SfdVJvQ.exe
  2⤵
  PID:6632
- C:\Windows\System\BvWmAxs.exe
  C:\Windows\System\BvWmAxs.exe
  2⤵
  PID:6888
- C:\Windows\System\tFJoRio.exe
  C:\Windows\System\tFJoRio.exe
  2⤵
  PID:6472
- C:\Windows\System\gdAFMPh.exe
  C:\Windows\System\gdAFMPh.exe
  2⤵
  PID:7044
- C:\Windows\System\AvUgukR.exe
  C:\Windows\System\AvUgukR.exe
  2⤵
  PID:6308
- C:\Windows\System\kXVUeun.exe
  C:\Windows\System\kXVUeun.exe
  2⤵
  PID:6696
- C:\Windows\System\NmZQYyk.exe
  C:\Windows\System\NmZQYyk.exe
  2⤵
  PID:7108
- C:\Windows\System\VpTEZBF.exe
  C:\Windows\System\VpTEZBF.exe
  2⤵
  PID:6288
- C:\Windows\System\GWFJmTd.exe
  C:\Windows\System\GWFJmTd.exe
  2⤵
  PID:6644
- C:\Windows\System\iQbOhmL.exe
  C:\Windows\System\iQbOhmL.exe
  2⤵
  PID:6452
- C:\Windows\System\UlXiJvY.exe
  C:\Windows\System\UlXiJvY.exe
  2⤵
  PID:6804
- C:\Windows\System\ekdRJcl.exe
  C:\Windows\System\ekdRJcl.exe
  2⤵
  PID:6756
- C:\Windows\System\xjfzLsB.exe
  C:\Windows\System\xjfzLsB.exe
  2⤵
  PID:6904
- C:\Windows\System\bvmshVF.exe
  C:\Windows\System\bvmshVF.exe
  2⤵
  PID:6772
- C:\Windows\System\jAHUBxm.exe
  C:\Windows\System\jAHUBxm.exe
  2⤵
  PID:6728
- C:\Windows\System\BMDBonr.exe
  C:\Windows\System\BMDBonr.exe
  2⤵
  PID:6532
- C:\Windows\System\UYVDRcU.exe
  C:\Windows\System\UYVDRcU.exe
  2⤵
  PID:7012
- C:\Windows\System\BATpDqy.exe
  C:\Windows\System\BATpDqy.exe
  2⤵
  PID:6856
- C:\Windows\System\MouNelp.exe
  C:\Windows\System\MouNelp.exe
  2⤵
  PID:5236
- C:\Windows\System\LjHCyww.exe
  C:\Windows\System\LjHCyww.exe
  2⤵
  PID:6208
- C:\Windows\System\PqsuYOV.exe
  C:\Windows\System\PqsuYOV.exe
  2⤵
  PID:6340
- C:\Windows\System\EiuxvYT.exe
  C:\Windows\System\EiuxvYT.exe
  2⤵
  PID:7160
- C:\Windows\System\UDyzFRu.exe
  C:\Windows\System\UDyzFRu.exe
  2⤵
  PID:6872
- C:\Windows\System\IdrPlwW.exe
  C:\Windows\System\IdrPlwW.exe
  2⤵
  PID:6680
- C:\Windows\System\nOXdExT.exe
  C:\Windows\System\nOXdExT.exe
  2⤵
  PID:6164
- C:\Windows\System\wxnmkTW.exe
  C:\Windows\System\wxnmkTW.exe
  2⤵
  PID:7256
- C:\Windows\System\OGZuxHM.exe
  C:\Windows\System\OGZuxHM.exe
  2⤵
  PID:7280
- C:\Windows\System\pUJUFXT.exe
  C:\Windows\System\pUJUFXT.exe
  2⤵
  PID:7300
- C:\Windows\System\SyFGBBz.exe
  C:\Windows\System\SyFGBBz.exe
  2⤵
  PID:7320
- C:\Windows\System\zUJdVMy.exe
  C:\Windows\System\zUJdVMy.exe
  2⤵
  PID:7344
- C:\Windows\System\myvgGsB.exe
  C:\Windows\System\myvgGsB.exe
  2⤵
  PID:7360
- C:\Windows\System\HUaYfHI.exe
  C:\Windows\System\HUaYfHI.exe
  2⤵
  PID:7376
- C:\Windows\System\AHjIxKL.exe
  C:\Windows\System\AHjIxKL.exe
  2⤵
  PID:7392
- C:\Windows\System\dgDBnzW.exe
  C:\Windows\System\dgDBnzW.exe
  2⤵
  PID:7412
- C:\Windows\System\hvPzoPO.exe
  C:\Windows\System\hvPzoPO.exe
  2⤵
  PID:7440
- C:\Windows\System\jyJdDAZ.exe
  C:\Windows\System\jyJdDAZ.exe
  2⤵
  PID:7456
- C:\Windows\System\nVeXqls.exe
  C:\Windows\System\nVeXqls.exe
  2⤵
  PID:7476
- C:\Windows\System\gSIRcwZ.exe
  C:\Windows\System\gSIRcwZ.exe
  2⤵
  PID:7492
- C:\Windows\System\uTdkOfT.exe
  C:\Windows\System\uTdkOfT.exe
  2⤵
  PID:7508
- C:\Windows\System\pJaIVoe.exe
  C:\Windows\System\pJaIVoe.exe
  2⤵
  PID:7560
- C:\Windows\System\ttvTVlx.exe
  C:\Windows\System\ttvTVlx.exe
  2⤵
  PID:7580
- C:\Windows\System\LCnoMNs.exe
  C:\Windows\System\LCnoMNs.exe
  2⤵
  PID:7600
- C:\Windows\System\cMtTlqW.exe
  C:\Windows\System\cMtTlqW.exe
  2⤵
  PID:7616
- C:\Windows\System\VwZRzOE.exe
  C:\Windows\System\VwZRzOE.exe
  2⤵
  PID:7632
- C:\Windows\System\fivEiqc.exe
  C:\Windows\System\fivEiqc.exe
  2⤵
  PID:7648
- C:\Windows\System\BIDFmZa.exe
  C:\Windows\System\BIDFmZa.exe
  2⤵
  PID:7856
- C:\Windows\System\kqFZRNn.exe
  C:\Windows\System\kqFZRNn.exe
  2⤵
  PID:7884
- C:\Windows\System\AyBOPAN.exe
  C:\Windows\System\AyBOPAN.exe
  2⤵
  PID:7900
- C:\Windows\System\WuxBjXh.exe
  C:\Windows\System\WuxBjXh.exe
  2⤵
  PID:7916
- C:\Windows\System\rahyvqg.exe
  C:\Windows\System\rahyvqg.exe
  2⤵
  PID:7932
- C:\Windows\System\MakCDPp.exe
  C:\Windows\System\MakCDPp.exe
  2⤵
  PID:7948
- C:\Windows\System\mOjYwQH.exe
  C:\Windows\System\mOjYwQH.exe
  2⤵
  PID:7964
- C:\Windows\System\IJwHjkW.exe
  C:\Windows\System\IJwHjkW.exe
  2⤵
  PID:7980
- C:\Windows\System\uYnbxCP.exe
  C:\Windows\System\uYnbxCP.exe
  2⤵
  PID:7996
- C:\Windows\System\TMqLKzF.exe
  C:\Windows\System\TMqLKzF.exe
  2⤵
  PID:8012
- C:\Windows\System\iVEYMrp.exe
  C:\Windows\System\iVEYMrp.exe
  2⤵
  PID:8028
- C:\Windows\System\OSUwiwN.exe
  C:\Windows\System\OSUwiwN.exe
  2⤵
  PID:8044
- C:\Windows\System\bqLyPhf.exe
  C:\Windows\System\bqLyPhf.exe
  2⤵
  PID:8060
- C:\Windows\System\NSQWLIb.exe
  C:\Windows\System\NSQWLIb.exe
  2⤵
  PID:8076
- C:\Windows\System\jSDOVEY.exe
  C:\Windows\System\jSDOVEY.exe
  2⤵
  PID:8092
- C:\Windows\System\bqRCuGi.exe
  C:\Windows\System\bqRCuGi.exe
  2⤵
  PID:8108
- C:\Windows\System\VsBfctT.exe
  C:\Windows\System\VsBfctT.exe
  2⤵
  PID:8128
- C:\Windows\System\CXPlQeA.exe
  C:\Windows\System\CXPlQeA.exe
  2⤵
  PID:8144
- C:\Windows\System\UkTVGLF.exe
  C:\Windows\System\UkTVGLF.exe
  2⤵
  PID:8160
- C:\Windows\System\bTehRRP.exe
  C:\Windows\System\bTehRRP.exe
  2⤵
  PID:8176
- C:\Windows\System\MaFiHYo.exe
  C:\Windows\System\MaFiHYo.exe
  2⤵
  PID:6744
- C:\Windows\System\knJhiFi.exe
  C:\Windows\System\knJhiFi.exe
  2⤵
  PID:7176
- C:\Windows\System\xsCKdHl.exe
  C:\Windows\System\xsCKdHl.exe
  2⤵
  PID:7192
- C:\Windows\System\ildshPn.exe
  C:\Windows\System\ildshPn.exe
  2⤵
  PID:6328
- C:\Windows\System\XuKkxWC.exe
  C:\Windows\System\XuKkxWC.exe
  2⤵
  PID:6984
- C:\Windows\System\tvQrtKG.exe
  C:\Windows\System\tvQrtKG.exe
  2⤵
  PID:7196
- C:\Windows\System\OGqThlw.exe
  C:\Windows\System\OGqThlw.exe
  2⤵
  PID:7272
- C:\Windows\System\kDToZDK.exe
  C:\Windows\System\kDToZDK.exe
  2⤵
  PID:7220
- C:\Windows\System\mFLLPZR.exe
  C:\Windows\System\mFLLPZR.exe
  2⤵
  PID:6964
- C:\Windows\System\CAnZPdA.exe
  C:\Windows\System\CAnZPdA.exe
  2⤵
  PID:7240
- C:\Windows\System\QRGKmUT.exe
  C:\Windows\System\QRGKmUT.exe
  2⤵
  PID:7268
- C:\Windows\System\lQxdSSw.exe
  C:\Windows\System\lQxdSSw.exe
  2⤵
  PID:7384
- C:\Windows\System\NFtfxdO.exe
  C:\Windows\System\NFtfxdO.exe
  2⤵
  PID:7316
- C:\Windows\System\WRJlKaf.exe
  C:\Windows\System\WRJlKaf.exe
  2⤵
  PID:7368
- C:\Windows\System\DlSMTYW.exe
  C:\Windows\System\DlSMTYW.exe
  2⤵
  PID:7352
- C:\Windows\System\mjQCzrl.exe
  C:\Windows\System\mjQCzrl.exe
  2⤵
  PID:7472
- C:\Windows\System\HzpdJcS.exe
  C:\Windows\System\HzpdJcS.exe
  2⤵
  PID:7504
- C:\Windows\System\FMFMyZQ.exe
  C:\Windows\System\FMFMyZQ.exe
  2⤵
  PID:7524
- C:\Windows\System\LeeEvvJ.exe
  C:\Windows\System\LeeEvvJ.exe
  2⤵
  PID:7404
- C:\Windows\System\FIbJwGB.exe
  C:\Windows\System\FIbJwGB.exe
  2⤵
  PID:7484
- C:\Windows\System\IemyrGB.exe
  C:\Windows\System\IemyrGB.exe
  2⤵
  PID:7540
- C:\Windows\System\NqXkbtJ.exe
  C:\Windows\System\NqXkbtJ.exe
  2⤵
  PID:7568
- C:\Windows\System\SThvLDI.exe
  C:\Windows\System\SThvLDI.exe
  2⤵
  PID:7588
- C:\Windows\System\newHKjL.exe
  C:\Windows\System\newHKjL.exe
  2⤵
  PID:7596
- C:\Windows\System\SdpNoQy.exe
  C:\Windows\System\SdpNoQy.exe
  2⤵
  PID:7656
- C:\Windows\System\MioGVQL.exe
  C:\Windows\System\MioGVQL.exe
  2⤵
  PID:7664
- C:\Windows\System\kYAEoHc.exe
  C:\Windows\System\kYAEoHc.exe
  2⤵
  PID:7684
- C:\Windows\System\bcRpOyV.exe
  C:\Windows\System\bcRpOyV.exe
  2⤵
  PID:7724
- C:\Windows\System\RSBYOnZ.exe
  C:\Windows\System\RSBYOnZ.exe
  2⤵
  PID:7696
- C:\Windows\System\BAKnQJb.exe
  C:\Windows\System\BAKnQJb.exe
  2⤵
  PID:7748
- C:\Windows\System\AfRVhwX.exe
  C:\Windows\System\AfRVhwX.exe
  2⤵
  PID:7768
- C:\Windows\System\lBqrynl.exe
  C:\Windows\System\lBqrynl.exe
  2⤵
  PID:7776
- C:\Windows\System\ktgwPtg.exe
  C:\Windows\System\ktgwPtg.exe
  2⤵
  PID:7792
- C:\Windows\System\WqDyNBL.exe
  C:\Windows\System\WqDyNBL.exe
  2⤵
  PID:7808
- C:\Windows\System\ptUSjQp.exe
  C:\Windows\System\ptUSjQp.exe
  2⤵
  PID:7824
- C:\Windows\System\HdckIVA.exe
  C:\Windows\System\HdckIVA.exe
  2⤵
  PID:7708
- C:\Windows\System\oMINIcU.exe
  C:\Windows\System\oMINIcU.exe
  2⤵
  PID:7864
- C:\Windows\System\GGWlLvX.exe
  C:\Windows\System\GGWlLvX.exe
  2⤵
  PID:7880
- C:\Windows\System\Cyobask.exe
  C:\Windows\System\Cyobask.exe
  2⤵
  PID:7924
- C:\Windows\System\kCSjjCT.exe
  C:\Windows\System\kCSjjCT.exe
  2⤵
  PID:7944
- C:\Windows\System\gbDtQJi.exe
  C:\Windows\System\gbDtQJi.exe
  2⤵
  PID:7992
- C:\Windows\System\eyMlwIm.exe
  C:\Windows\System\eyMlwIm.exe
  2⤵
  PID:7960
- C:\Windows\System\bQsdxFZ.exe
  C:\Windows\System\bQsdxFZ.exe
  2⤵
  PID:8040
- C:\Windows\System\eegePoD.exe
  C:\Windows\System\eegePoD.exe
  2⤵
  PID:8056
- C:\Windows\System\pHfWuIV.exe
  C:\Windows\System\pHfWuIV.exe
  2⤵
  PID:8124
- C:\Windows\System\tzfHxoJ.exe
  C:\Windows\System\tzfHxoJ.exe
  2⤵
  PID:8152
- C:\Windows\System\wNFzKoK.exe
  C:\Windows\System\wNFzKoK.exe
  2⤵
  PID:8188
- C:\Windows\System\LmyOVAp.exe
  C:\Windows\System\LmyOVAp.exe
  2⤵
  PID:7180
- C:\Windows\System\IbdkRPc.exe
  C:\Windows\System\IbdkRPc.exe
  2⤵
  PID:6564
- C:\Windows\System\wiULfRN.exe
  C:\Windows\System\wiULfRN.exe
  2⤵
  PID:7200
- C:\Windows\System\UhvOoct.exe
  C:\Windows\System\UhvOoct.exe
  2⤵
  PID:7236
- C:\Windows\System\kQAUyfQ.exe
  C:\Windows\System\kQAUyfQ.exe
  2⤵
  PID:7204
- C:\Windows\System\CfikyhK.exe
  C:\Windows\System\CfikyhK.exe
  2⤵
  PID:7288
- C:\Windows\System\cNFLtfL.exe
  C:\Windows\System\cNFLtfL.exe
  2⤵
  PID:7436
- C:\Windows\System\NSVgvyf.exe
  C:\Windows\System\NSVgvyf.exe
  2⤵
  PID:7340
- C:\Windows\System\ryJXujO.exe
  C:\Windows\System\ryJXujO.exe
  2⤵
  PID:7528
- C:\Windows\System\FSCqlrc.exe
  C:\Windows\System\FSCqlrc.exe
  2⤵
  PID:7548
- C:\Windows\System\MxBZnhh.exe
  C:\Windows\System\MxBZnhh.exe
  2⤵
  PID:7608
- C:\Windows\System\uQjdwQP.exe
  C:\Windows\System\uQjdwQP.exe
  2⤵
  PID:7500
- C:\Windows\System\crIBAHs.exe
  C:\Windows\System\crIBAHs.exe
  2⤵
  PID:7680
- C:\Windows\System\VHyEcRM.exe
  C:\Windows\System\VHyEcRM.exe
  2⤵
  PID:7692
- C:\Windows\System\eimQEEX.exe
  C:\Windows\System\eimQEEX.exe
  2⤵
  PID:7732
- C:\Windows\System\rUaggGN.exe
  C:\Windows\System\rUaggGN.exe
  2⤵
  PID:7804
- C:\Windows\System\vQryvZM.exe
  C:\Windows\System\vQryvZM.exe
  2⤵
  PID:7836
- C:\Windows\System\OArvDCa.exe
  C:\Windows\System\OArvDCa.exe
  2⤵
  PID:7816
- C:\Windows\System\UwCaOVJ.exe
  C:\Windows\System\UwCaOVJ.exe
  2⤵
  PID:7844
- C:\Windows\System\gCdXTci.exe
  C:\Windows\System\gCdXTci.exe
  2⤵
  PID:7912
- C:\Windows\System\giwPrpd.exe
  C:\Windows\System\giwPrpd.exe
  2⤵
  PID:8052
- C:\Windows\System\HDmDCqG.exe
  C:\Windows\System\HDmDCqG.exe
  2⤵
  PID:8140
- C:\Windows\System\VgDrHEl.exe
  C:\Windows\System\VgDrHEl.exe
  2⤵
  PID:8184
- C:\Windows\System\HBDWEBL.exe
  C:\Windows\System\HBDWEBL.exe
  2⤵
  PID:7184
- C:\Windows\System\tICwOGB.exe
  C:\Windows\System\tICwOGB.exe
  2⤵
  PID:7212
- C:\Windows\System\cVnktro.exe
  C:\Windows\System\cVnktro.exe
  2⤵
  PID:7424
- C:\Windows\System\MixisLj.exe
  C:\Windows\System\MixisLj.exe
  2⤵
  PID:7312
- C:\Windows\System\RTDBoKL.exe
  C:\Windows\System\RTDBoKL.exe
  2⤵
  PID:7332
- C:\Windows\System\pQMXAcb.exe
  C:\Windows\System\pQMXAcb.exe
  2⤵
  PID:7536
- C:\Windows\System\PqGKgxj.exe
  C:\Windows\System\PqGKgxj.exe
  2⤵
  PID:7624
- C:\Windows\System\wuyfdqh.exe
  C:\Windows\System\wuyfdqh.exe
  2⤵
  PID:7756
- C:\Windows\System\SQPveqN.exe
  C:\Windows\System\SQPveqN.exe
  2⤵
  PID:1552
- C:\Windows\System\KhrZVTg.exe
  C:\Windows\System\KhrZVTg.exe
  2⤵
  PID:7940
- C:\Windows\System\XZYjMow.exe
  C:\Windows\System\XZYjMow.exe
  2⤵
  PID:8088
- C:\Windows\System\ndJOdIi.exe
  C:\Windows\System\ndJOdIi.exe
  2⤵
  PID:8024
- C:\Windows\System\KytXuVo.exe
  C:\Windows\System\KytXuVo.exe
  2⤵
  PID:8072
- C:\Windows\System\QJzfqHB.exe
  C:\Windows\System\QJzfqHB.exe
  2⤵
  PID:7248
- C:\Windows\System\dXrRahw.exe
  C:\Windows\System\dXrRahw.exe
  2⤵
  PID:7576
- C:\Windows\System\qFXySoD.exe
  C:\Windows\System\qFXySoD.exe
  2⤵
  PID:7720
- C:\Windows\System\pPACbiS.exe
  C:\Windows\System\pPACbiS.exe
  2⤵
  PID:7800
- C:\Windows\System\hGmTxOx.exe
  C:\Windows\System\hGmTxOx.exe
  2⤵
  PID:8020
- C:\Windows\System\iJMCgHN.exe
  C:\Windows\System\iJMCgHN.exe
  2⤵
  PID:8008
- C:\Windows\System\IIsEXVZ.exe
  C:\Windows\System\IIsEXVZ.exe
  2⤵
  PID:7592
- C:\Windows\System\tYKZvqO.exe
  C:\Windows\System\tYKZvqO.exe
  2⤵
  PID:7908
- C:\Windows\System\ETXrRDq.exe
  C:\Windows\System\ETXrRDq.exe
  2⤵
  PID:8200
- C:\Windows\System\MmzidJY.exe
  C:\Windows\System\MmzidJY.exe
  2⤵
  PID:8216
- C:\Windows\System\CjlaLlD.exe
  C:\Windows\System\CjlaLlD.exe
  2⤵
  PID:8232
- C:\Windows\System\xrFRmCZ.exe
  C:\Windows\System\xrFRmCZ.exe
  2⤵
  PID:8248
- C:\Windows\System\sLVrnbA.exe
  C:\Windows\System\sLVrnbA.exe
  2⤵
  PID:8264
- C:\Windows\System\ltEjfeF.exe
  C:\Windows\System\ltEjfeF.exe
  2⤵
  PID:8280
- C:\Windows\System\UbdkIOf.exe
  C:\Windows\System\UbdkIOf.exe
  2⤵
  PID:8296
- C:\Windows\System\qsagnrf.exe
  C:\Windows\System\qsagnrf.exe
  2⤵
  PID:8312
- C:\Windows\System\kaAYhuM.exe
  C:\Windows\System\kaAYhuM.exe
  2⤵
  PID:8328
- C:\Windows\System\QkWHPgz.exe
  C:\Windows\System\QkWHPgz.exe
  2⤵
  PID:8344
- C:\Windows\System\FRKIJkN.exe
  C:\Windows\System\FRKIJkN.exe
  2⤵
  PID:8360
- C:\Windows\System\EwvBjUf.exe
  C:\Windows\System\EwvBjUf.exe
  2⤵
  PID:8376
- C:\Windows\System\yHcIWOa.exe
  C:\Windows\System\yHcIWOa.exe
  2⤵
  PID:8392
- C:\Windows\System\covbJna.exe
  C:\Windows\System\covbJna.exe
  2⤵
  PID:8408
- C:\Windows\System\QzFaiCR.exe
  C:\Windows\System\QzFaiCR.exe
  2⤵
  PID:8424
- C:\Windows\System\HYqnEDj.exe
  C:\Windows\System\HYqnEDj.exe
  2⤵
  PID:8440
- C:\Windows\System\rliPuOp.exe
  C:\Windows\System\rliPuOp.exe
  2⤵
  PID:8456
- C:\Windows\System\KpYrcqo.exe
  C:\Windows\System\KpYrcqo.exe
  2⤵
  PID:8472
- C:\Windows\System\ksAqylM.exe
  C:\Windows\System\ksAqylM.exe
  2⤵
  PID:8488
- C:\Windows\System\KdHzsTe.exe
  C:\Windows\System\KdHzsTe.exe
  2⤵
  PID:8504
- C:\Windows\System\vLCMQkL.exe
  C:\Windows\System\vLCMQkL.exe
  2⤵
  PID:8524
- C:\Windows\System\kzZAUrY.exe
  C:\Windows\System\kzZAUrY.exe
  2⤵
  PID:8540
- C:\Windows\System\YltrNXZ.exe
  C:\Windows\System\YltrNXZ.exe
  2⤵
  PID:8556
- C:\Windows\System\cBiphKp.exe
  C:\Windows\System\cBiphKp.exe
  2⤵
  PID:8572
- C:\Windows\System\UqdgwJe.exe
  C:\Windows\System\UqdgwJe.exe
  2⤵
  PID:8588
- C:\Windows\System\kAGrHzw.exe
  C:\Windows\System\kAGrHzw.exe
  2⤵
  PID:8604
- C:\Windows\System\XGDvAVg.exe
  C:\Windows\System\XGDvAVg.exe
  2⤵
  PID:8620
- C:\Windows\System\sBzedtQ.exe
  C:\Windows\System\sBzedtQ.exe
  2⤵
  PID:8636
- C:\Windows\System\qKKPzAt.exe
  C:\Windows\System\qKKPzAt.exe
  2⤵
  PID:8652
- C:\Windows\System\racnQjQ.exe
  C:\Windows\System\racnQjQ.exe
  2⤵
  PID:8668
- C:\Windows\System\MSVLfOX.exe
  C:\Windows\System\MSVLfOX.exe
  2⤵
  PID:8684
- C:\Windows\System\eWAUAmE.exe
  C:\Windows\System\eWAUAmE.exe
  2⤵
  PID:8700
- C:\Windows\System\ySxCxEB.exe
  C:\Windows\System\ySxCxEB.exe
  2⤵
  PID:8716
- C:\Windows\System\qwlcXeI.exe
  C:\Windows\System\qwlcXeI.exe
  2⤵
  PID:8732
- C:\Windows\System\tMAYdEk.exe
  C:\Windows\System\tMAYdEk.exe
  2⤵
  PID:8748
- C:\Windows\System\maTKAye.exe
  C:\Windows\System\maTKAye.exe
  2⤵
  PID:8764
- C:\Windows\System\hkHJkMW.exe
  C:\Windows\System\hkHJkMW.exe
  2⤵
  PID:8780
- C:\Windows\System\jjWJzWl.exe
  C:\Windows\System\jjWJzWl.exe
  2⤵
  PID:8796
- C:\Windows\System\cCkdRBX.exe
  C:\Windows\System\cCkdRBX.exe
  2⤵
  PID:8812
- C:\Windows\System\WFvhKwB.exe
  C:\Windows\System\WFvhKwB.exe
  2⤵
  PID:8828
- C:\Windows\System\HlRELwb.exe
  C:\Windows\System\HlRELwb.exe
  2⤵
  PID:8844
- C:\Windows\System\vXqNuOV.exe
  C:\Windows\System\vXqNuOV.exe
  2⤵
  PID:8860
- C:\Windows\System\rpxoupJ.exe
  C:\Windows\System\rpxoupJ.exe
  2⤵
  PID:8876
- C:\Windows\System\GGtMyFV.exe
  C:\Windows\System\GGtMyFV.exe
  2⤵
  PID:8892
- C:\Windows\System\wxcGjqt.exe
  C:\Windows\System\wxcGjqt.exe
  2⤵
  PID:8908
- C:\Windows\System\ObGOcaM.exe
  C:\Windows\System\ObGOcaM.exe
  2⤵
  PID:8924
- C:\Windows\System\npRbPxm.exe
  C:\Windows\System\npRbPxm.exe
  2⤵
  PID:8940
- C:\Windows\System\QdzRfrk.exe
  C:\Windows\System\QdzRfrk.exe
  2⤵
  PID:8956
- C:\Windows\System\ptxngDe.exe
  C:\Windows\System\ptxngDe.exe
  2⤵
  PID:8972
- C:\Windows\System\DlUUVaw.exe
  C:\Windows\System\DlUUVaw.exe
  2⤵
  PID:8988
- C:\Windows\System\FAMLsAJ.exe
  C:\Windows\System\FAMLsAJ.exe
  2⤵
  PID:9004
- C:\Windows\System\eaJBHLP.exe
  C:\Windows\System\eaJBHLP.exe
  2⤵
  PID:9020
- C:\Windows\System\NHRGkuB.exe
  C:\Windows\System\NHRGkuB.exe
  2⤵
  PID:9036
- C:\Windows\System\PIupfvc.exe
  C:\Windows\System\PIupfvc.exe
  2⤵
  PID:9052
- C:\Windows\System\WlzgyEo.exe
  C:\Windows\System\WlzgyEo.exe
  2⤵
  PID:9068
- C:\Windows\System\XewXJIg.exe
  C:\Windows\System\XewXJIg.exe
  2⤵
  PID:9084
- C:\Windows\System\nLFxvnl.exe
  C:\Windows\System\nLFxvnl.exe
  2⤵
  PID:9100
- C:\Windows\System\uHSQUgZ.exe
  C:\Windows\System\uHSQUgZ.exe
  2⤵
  PID:9116
- C:\Windows\System\EMfaiVG.exe
  C:\Windows\System\EMfaiVG.exe
  2⤵
  PID:9132
- C:\Windows\System\pllByJr.exe
  C:\Windows\System\pllByJr.exe
  2⤵
  PID:9148
- C:\Windows\System\uvPgEwF.exe
  C:\Windows\System\uvPgEwF.exe
  2⤵
  PID:9164
- C:\Windows\System\RRabenp.exe
  C:\Windows\System\RRabenp.exe
  2⤵
  PID:9180
- C:\Windows\System\kTKmkSr.exe
  C:\Windows\System\kTKmkSr.exe
  2⤵
  PID:9196
- C:\Windows\System\FMYDrLx.exe
  C:\Windows\System\FMYDrLx.exe
  2⤵
  PID:9212
- C:\Windows\System\qVSkzBA.exe
  C:\Windows\System\qVSkzBA.exe
  2⤵
  PID:8208
- C:\Windows\System\LQrEfUu.exe
  C:\Windows\System\LQrEfUu.exe
  2⤵
  PID:6016
- C:\Windows\System\jNPvDaR.exe
  C:\Windows\System\jNPvDaR.exe
  2⤵
  PID:8240
- C:\Windows\System\nmGVqDM.exe
  C:\Windows\System\nmGVqDM.exe
  2⤵
  PID:8276
- C:\Windows\System\GCnURgZ.exe
  C:\Windows\System\GCnURgZ.exe
  2⤵
  PID:8260
- C:\Windows\System\FqcoDJv.exe
  C:\Windows\System\FqcoDJv.exe
  2⤵
  PID:8340
- C:\Windows\System\HvkRaAL.exe
  C:\Windows\System\HvkRaAL.exe
  2⤵
  PID:8324
- C:\Windows\System\RvcXoEf.exe
  C:\Windows\System\RvcXoEf.exe
  2⤵
  PID:8388
- C:\Windows\System\BiWXhHv.exe
  C:\Windows\System\BiWXhHv.exe
  2⤵
  PID:8436
- C:\Windows\System\trihYMa.exe
  C:\Windows\System\trihYMa.exe
  2⤵
  PID:8468
- C:\Windows\System\nEOjoLd.exe
  C:\Windows\System\nEOjoLd.exe
  2⤵
  PID:8448
- C:\Windows\System\LIYqlYN.exe
  C:\Windows\System\LIYqlYN.exe
  2⤵
  PID:8512
- C:\Windows\System\PkaGJPD.exe
  C:\Windows\System\PkaGJPD.exe
  2⤵
  PID:8580
- C:\Windows\System\qtyaCHb.exe
  C:\Windows\System\qtyaCHb.exe
  2⤵
  PID:8648
- C:\Windows\System\fdTSiEQ.exe
  C:\Windows\System\fdTSiEQ.exe
  2⤵
  PID:8712
- C:\Windows\System\eAsZDCv.exe
  C:\Windows\System\eAsZDCv.exe
  2⤵
  PID:8744
- C:\Windows\System\UtqTHRY.exe
  C:\Windows\System\UtqTHRY.exe
  2⤵
  PID:8596
- C:\Windows\System\IBrqwlD.exe
  C:\Windows\System\IBrqwlD.exe
  2⤵
  PID:8692
- C:\Windows\System\qRFeood.exe
  C:\Windows\System\qRFeood.exe
  2⤵
  PID:8756
- C:\Windows\System\EfWDomK.exe
  C:\Windows\System\EfWDomK.exe
  2⤵
  PID:8776
- C:\Windows\System\tfTwLSi.exe
  C:\Windows\System\tfTwLSi.exe
  2⤵
  PID:8792
- C:\Windows\System\jYVtoEr.exe
  C:\Windows\System\jYVtoEr.exe
  2⤵
  PID:8856
- C:\Windows\System\NqQmtNB.exe
  C:\Windows\System\NqQmtNB.exe
  2⤵
  PID:8840
- C:\Windows\System\bNVOeLO.exe
  C:\Windows\System\bNVOeLO.exe
  2⤵
  PID:8900
- C:\Windows\System\Clczgcz.exe
  C:\Windows\System\Clczgcz.exe
  2⤵
  PID:8932
- C:\Windows\System\tyIJOOd.exe
  C:\Windows\System\tyIJOOd.exe
  2⤵
  PID:8968
- C:\Windows\System\ZzxxMdx.exe
  C:\Windows\System\ZzxxMdx.exe
  2⤵
  PID:8984
- C:\Windows\System\IyClyMR.exe
  C:\Windows\System\IyClyMR.exe
  2⤵
  PID:9048
- C:\Windows\System\JLfJYPe.exe
  C:\Windows\System\JLfJYPe.exe
  2⤵
  PID:9060
- C:\Windows\System\PWmGgJs.exe
  C:\Windows\System\PWmGgJs.exe
  2⤵
  PID:9108
- C:\Windows\System\IZhkxMl.exe
  C:\Windows\System\IZhkxMl.exe
  2⤵
  PID:9128
- C:\Windows\System\KBAhwKW.exe
  C:\Windows\System\KBAhwKW.exe
  2⤵
  PID:9156
- C:\Windows\System\ALfnshu.exe
  C:\Windows\System\ALfnshu.exe
  2⤵
  PID:9188
- C:\Windows\System\szVrAXt.exe
  C:\Windows\System\szVrAXt.exe
  2⤵
  PID:7852
- C:\Windows\System\XWKavWm.exe
  C:\Windows\System\XWKavWm.exe
  2⤵
  PID:8224
- C:\Windows\System\vSivjhW.exe
  C:\Windows\System\vSivjhW.exe
  2⤵
  PID:8292
- C:\Windows\System\SEzFvsi.exe
  C:\Windows\System\SEzFvsi.exe
  2⤵
  PID:8400
- C:\Windows\System\yujMssm.exe
  C:\Windows\System\yujMssm.exe
  2⤵
  PID:8356
- C:\Windows\System\xCYgCps.exe
  C:\Windows\System\xCYgCps.exe
  2⤵
  PID:8532
- C:\Windows\System\rwQhqiJ.exe
  C:\Windows\System\rwQhqiJ.exe
  2⤵
  PID:8660
- C:\Windows\System\aGPRamk.exe
  C:\Windows\System\aGPRamk.exe
  2⤵
  PID:8808
- C:\Windows\System\cERLdWv.exe
  C:\Windows\System\cERLdWv.exe
  2⤵
  PID:8868
- C:\Windows\System\ISbuxXT.exe
  C:\Windows\System\ISbuxXT.exe
  2⤵
  PID:8948
- C:\Windows\System\tiFgmmD.exe
  C:\Windows\System\tiFgmmD.exe
  2⤵
  PID:9044
- C:\Windows\System\mqNIIZL.exe
  C:\Windows\System\mqNIIZL.exe
  2⤵
  PID:9028
- C:\Windows\System\BwlWgnS.exe
  C:\Windows\System\BwlWgnS.exe
  2⤵
  PID:9144
- C:\Windows\System\aCubNPp.exe
  C:\Windows\System\aCubNPp.exe
  2⤵
  PID:7252
- C:\Windows\System\iMLGOxP.exe
  C:\Windows\System\iMLGOxP.exe
  2⤵
  PID:8372
- C:\Windows\System\jJITfNc.exe
  C:\Windows\System\jJITfNc.exe
  2⤵
  PID:7628
- C:\Windows\System\ytwxVnI.exe
  C:\Windows\System\ytwxVnI.exe
  2⤵
  PID:8564
- C:\Windows\System\oZVDEgj.exe
  C:\Windows\System\oZVDEgj.exe
  2⤵
  PID:9228
- C:\Windows\System\uZZWrFp.exe
  C:\Windows\System\uZZWrFp.exe
  2⤵
  PID:9248
- C:\Windows\System\nOPkcTb.exe
  C:\Windows\System\nOPkcTb.exe
  2⤵
  PID:9264
- C:\Windows\System\MHctrfR.exe
  C:\Windows\System\MHctrfR.exe
  2⤵
  PID:9280
- C:\Windows\System\ZnTAOgF.exe
  C:\Windows\System\ZnTAOgF.exe
  2⤵
  PID:9300
- C:\Windows\System\kSfXYWG.exe
  C:\Windows\System\kSfXYWG.exe
  2⤵
  PID:9316
- C:\Windows\System\mEdxPsc.exe
  C:\Windows\System\mEdxPsc.exe
  2⤵
  PID:9332
- C:\Windows\System\ttfGtvn.exe
  C:\Windows\System\ttfGtvn.exe
  2⤵
  PID:9356
- C:\Windows\System\mjHeeUe.exe
  C:\Windows\System\mjHeeUe.exe
  2⤵
  PID:9372
- C:\Windows\System\FhfWoMM.exe
  C:\Windows\System\FhfWoMM.exe
  2⤵
  PID:9392
- C:\Windows\System\OvXWwEa.exe
  C:\Windows\System\OvXWwEa.exe
  2⤵
  PID:9408
- C:\Windows\System\yRAuDWm.exe
  C:\Windows\System\yRAuDWm.exe
  2⤵
  PID:9424
- C:\Windows\System\IdKyrzd.exe
  C:\Windows\System\IdKyrzd.exe
  2⤵
  PID:9440
- C:\Windows\System\UoyDLOW.exe
  C:\Windows\System\UoyDLOW.exe
  2⤵
  PID:9456
- C:\Windows\System\sqPIoKN.exe
  C:\Windows\System\sqPIoKN.exe
  2⤵
  PID:9472
- C:\Windows\System\DtwhIjg.exe
  C:\Windows\System\DtwhIjg.exe
  2⤵
  PID:9488
- C:\Windows\System\OQNtDNg.exe
  C:\Windows\System\OQNtDNg.exe
  2⤵
  PID:9504
- C:\Windows\System\JrhQgFp.exe
  C:\Windows\System\JrhQgFp.exe
  2⤵
  PID:9588
- C:\Windows\System\eYoXkMg.exe
  C:\Windows\System\eYoXkMg.exe
  2⤵
  PID:9604
- C:\Windows\System\XXYuIKe.exe
  C:\Windows\System\XXYuIKe.exe
  2⤵
  PID:9620
- C:\Windows\System\mUJmyaS.exe
  C:\Windows\System\mUJmyaS.exe
  2⤵
  PID:9640
- C:\Windows\System\TCVXyXY.exe
  C:\Windows\System\TCVXyXY.exe
  2⤵
  PID:9656
- C:\Windows\System\rVdaPHj.exe
  C:\Windows\System\rVdaPHj.exe
  2⤵
  PID:9672
- C:\Windows\System\aXbGJkI.exe
  C:\Windows\System\aXbGJkI.exe
  2⤵
  PID:9688
- C:\Windows\System\rsSUjNm.exe
  C:\Windows\System\rsSUjNm.exe
  2⤵
  PID:9704
- C:\Windows\System\SbDeflm.exe
  C:\Windows\System\SbDeflm.exe
  2⤵
  PID:9720
- C:\Windows\System\iOrFhHO.exe
  C:\Windows\System\iOrFhHO.exe
  2⤵
  PID:9740
- C:\Windows\System\nytyIai.exe
  C:\Windows\System\nytyIai.exe
  2⤵
  PID:9756
- C:\Windows\System\fFrWmTy.exe
  C:\Windows\System\fFrWmTy.exe
  2⤵
  PID:9776
- C:\Windows\System\zMmZykt.exe
  C:\Windows\System\zMmZykt.exe
  2⤵
  PID:9792
- C:\Windows\System\pQLyAXm.exe
  C:\Windows\System\pQLyAXm.exe
  2⤵
  PID:9808
- C:\Windows\System\avcUYYd.exe
  C:\Windows\System\avcUYYd.exe
  2⤵
  PID:9824
- C:\Windows\System\nberypf.exe
  C:\Windows\System\nberypf.exe
  2⤵
  PID:9840
- C:\Windows\System\uIihHmK.exe
  C:\Windows\System\uIihHmK.exe
  2⤵
  PID:9856
- C:\Windows\System\SMiIDqj.exe
  C:\Windows\System\SMiIDqj.exe
  2⤵
  PID:9872
- C:\Windows\System\ohpHcMX.exe
  C:\Windows\System\ohpHcMX.exe
  2⤵
  PID:9888
- C:\Windows\System\qloMofo.exe
  C:\Windows\System\qloMofo.exe
  2⤵
  PID:9904
- C:\Windows\System\dZfbohU.exe
  C:\Windows\System\dZfbohU.exe
  2⤵
  PID:9920
- C:\Windows\System\YjUJfPs.exe
  C:\Windows\System\YjUJfPs.exe
  2⤵
  PID:9936
- C:\Windows\System\orwPQJK.exe
  C:\Windows\System\orwPQJK.exe
  2⤵
  PID:9952
- C:\Windows\System\SRqgcDl.exe
  C:\Windows\System\SRqgcDl.exe
  2⤵
  PID:9968
- C:\Windows\System\ApLGJUO.exe
  C:\Windows\System\ApLGJUO.exe
  2⤵
  PID:9984
- C:\Windows\System\aHXreMQ.exe
  C:\Windows\System\aHXreMQ.exe
  2⤵
  PID:10000
- C:\Windows\System\GWUVcpr.exe
  C:\Windows\System\GWUVcpr.exe
  2⤵
  PID:10016
- C:\Windows\System\VKEsSJz.exe
  C:\Windows\System\VKEsSJz.exe
  2⤵
  PID:10032
- C:\Windows\System\QvrTxMG.exe
  C:\Windows\System\QvrTxMG.exe
  2⤵
  PID:10048
- C:\Windows\System\zCLLqfr.exe
  C:\Windows\System\zCLLqfr.exe
  2⤵
  PID:10064
- C:\Windows\System\aBnFYgJ.exe
  C:\Windows\System\aBnFYgJ.exe
  2⤵
  PID:10080
- C:\Windows\System\TlAEpDu.exe
  C:\Windows\System\TlAEpDu.exe
  2⤵
  PID:10096
- C:\Windows\System\DkWTFtC.exe
  C:\Windows\System\DkWTFtC.exe
  2⤵
  PID:10112
- C:\Windows\System\ClvWCHw.exe
  C:\Windows\System\ClvWCHw.exe
  2⤵
  PID:10128
- C:\Windows\System\kRFtNAg.exe
  C:\Windows\System\kRFtNAg.exe
  2⤵
  PID:10144
- C:\Windows\System\rNumKtR.exe
  C:\Windows\System\rNumKtR.exe
  2⤵
  PID:10160
- C:\Windows\System\iPauaHX.exe
  C:\Windows\System\iPauaHX.exe
  2⤵
  PID:10176
- C:\Windows\System\ixbFPVB.exe
  C:\Windows\System\ixbFPVB.exe
  2⤵
  PID:10192
- C:\Windows\System\CvhHTGp.exe
  C:\Windows\System\CvhHTGp.exe
  2⤵
  PID:10208
- C:\Windows\System\XwghAoD.exe
  C:\Windows\System\XwghAoD.exe
  2⤵
  PID:10224
- C:\Windows\System\MEOYIWE.exe
  C:\Windows\System\MEOYIWE.exe
  2⤵
  PID:8728
- C:\Windows\System\nvbADRX.exe
  C:\Windows\System\nvbADRX.exe
  2⤵
  PID:8852
- C:\Windows\System\spcrUHS.exe
  C:\Windows\System\spcrUHS.exe
  2⤵
  PID:9016
- C:\Windows\System\KytGFCQ.exe
  C:\Windows\System\KytGFCQ.exe
  2⤵
  PID:8516
- C:\Windows\System\jqqouWw.exe
  C:\Windows\System\jqqouWw.exe
  2⤵
  PID:9244
- C:\Windows\System\cSsBFsB.exe
  C:\Windows\System\cSsBFsB.exe
  2⤵
  PID:9312
- C:\Windows\System\HYaFEMk.exe
  C:\Windows\System\HYaFEMk.exe
  2⤵
  PID:9352
- C:\Windows\System\aDpRhiu.exe
  C:\Windows\System\aDpRhiu.exe
  2⤵
  PID:9416
- C:\Windows\System\LXWSdKr.exe
  C:\Windows\System\LXWSdKr.exe
  2⤵
  PID:9480
- C:\Windows\System\PtwTArD.exe
  C:\Windows\System\PtwTArD.exe
  2⤵
  PID:9520
- C:\Windows\System\hiZlQSA.exe
  C:\Windows\System\hiZlQSA.exe
  2⤵
  PID:9536
- C:\Windows\System\pPUkcgS.exe
  C:\Windows\System\pPUkcgS.exe
  2⤵
  PID:9560
- C:\Windows\System\yudGlxh.exe
  C:\Windows\System\yudGlxh.exe
  2⤵
  PID:9552
- C:\Windows\System\anKtdhz.exe
  C:\Windows\System\anKtdhz.exe
  2⤵
  PID:9572
- C:\Windows\System\nVmDEuA.exe
  C:\Windows\System\nVmDEuA.exe
  2⤵
  PID:9468
- C:\Windows\System\efeozpB.exe
  C:\Windows\System\efeozpB.exe
  2⤵
  PID:9096
- C:\Windows\System\iznPIzQ.exe
  C:\Windows\System\iznPIzQ.exe
  2⤵
  PID:8308
- C:\Windows\System\MnjNwjd.exe
  C:\Windows\System\MnjNwjd.exe
  2⤵
  PID:9256
- C:\Windows\System\KqKCGAK.exe
  C:\Windows\System\KqKCGAK.exe
  2⤵
  PID:9648
- C:\Windows\System\BKLmNdC.exe
  C:\Windows\System\BKLmNdC.exe
  2⤵
  PID:9712
- C:\Windows\System\FxHDQfV.exe
  C:\Windows\System\FxHDQfV.exe
  2⤵
  PID:9400
- C:\Windows\System\rcCfHoB.exe
  C:\Windows\System\rcCfHoB.exe
  2⤵
  PID:9500
- C:\Windows\System\AfvUTaS.exe
  C:\Windows\System\AfvUTaS.exe
  2⤵
  PID:9896
- C:\Windows\System\XqaUTvE.exe
  C:\Windows\System\XqaUTvE.exe
  2⤵
  PID:9928
- C:\Windows\System\RfeWdOD.exe
  C:\Windows\System\RfeWdOD.exe
  2⤵
  PID:9980
- C:\Windows\System\JXiqLmp.exe
  C:\Windows\System\JXiqLmp.exe
  2⤵
  PID:9996
- C:\Windows\System\EcXFqRv.exe
  C:\Windows\System\EcXFqRv.exe
  2⤵
  PID:10024
- C:\Windows\System\mkcBBNd.exe
  C:\Windows\System\mkcBBNd.exe
  2⤵
  PID:10076
- C:\Windows\System\PZuNNIT.exe
  C:\Windows\System\PZuNNIT.exe
  2⤵
  PID:10136
- C:\Windows\System\lBBvMsV.exe
  C:\Windows\System\lBBvMsV.exe
  2⤵
  PID:10056
- C:\Windows\System\cOWqvUC.exe
  C:\Windows\System\cOWqvUC.exe
  2⤵
  PID:10092
- C:\Windows\System\lblijcQ.exe
  C:\Windows\System\lblijcQ.exe
  2⤵
  PID:10124
- C:\Windows\System\WQjCLlI.exe
  C:\Windows\System\WQjCLlI.exe
  2⤵
  PID:10156
- C:\Windows\System\oHcBCoi.exe
  C:\Windows\System\oHcBCoi.exe
  2⤵
  PID:8996
- C:\Windows\System\LwHfnen.exe
  C:\Windows\System\LwHfnen.exe
  2⤵
  PID:8936
- C:\Windows\System\DQJITlR.exe
  C:\Windows\System\DQJITlR.exe
  2⤵
  PID:9528
- C:\Windows\System\XZjJXfk.exe
  C:\Windows\System\XZjJXfk.exe
  2⤵
  PID:9404
- C:\Windows\System\cRiIPej.exe
  C:\Windows\System\cRiIPej.exe
  2⤵
  PID:9204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKfIaaN.exe

Filesize
1.9MB

MD5
0aaff4c6c7b7033c165d87ba09500eec

SHA1
690b59014a0804c7b989144275d4f9b98012a08e

SHA256
3fdcf3bb41211d708b2d1dc963fbbf6e6547c21b0578e44ec42bc46d585a9d40

SHA512
f872a642ccb2357945259a8725e67763b701d907044bc98e9ea47557d7ea6fc485f2dbc3458d5e82bab103e495eafd983222b3764773fd7677acc8355afa976a

Download Submit
C:\Windows\system\AskcBcM.exe

Filesize
1.9MB

MD5
bed4994a7dcbf5f91ec5189fd9a83175

SHA1
77a719c0921c53f1e4527fdd1f718361def1d959

SHA256
3cfb686b368bea95dc10607f9748c9f4ec02847b7e351b75b1fc6589cfe21ab1

SHA512
60c382de0344f631bdaca10fbd1d696bb884ded588f9f1cc581073c26c2e79a8675d3ef61a1ba68753822406547d3305dbc0c6752df449c88410ce8cff24daf0

Download Submit
C:\Windows\system\CfJLJKq.exe

Filesize
1.9MB

MD5
819c1c276ad18d96a1715662187c1e49

SHA1
e39bb14310bc84847c833f1d5a36ad227e2bbda0

SHA256
47b0b62e9e28cabbdec2b83506dd631d24ffe093bceeb41ab73dbfee6809cd77

SHA512
2e5e42b7d0fc9a7156995a257f5055e9f230395d22f2b0bbce1f480e5c788848d6f09f3384e7ccf50c41d45ebf8c7f7145feb87f8f463ceaa6c6ec15977c9102

Download Submit
C:\Windows\system\KlOVuyJ.exe

Filesize
1.9MB

MD5
37bfe6b2718c3c63198cb14d80737f82

SHA1
62e3e7192d899f097c2e55e468012c5d14f13bb8

SHA256
76e0688a15e7bc060ccbdb9f79819c155f11d3e7f1efe41f251d76d287daf26f

SHA512
55a9ef853aff9963da0aca4c2c7e548af7cb7dd4cbe43236e4db339e2af38ad2aa002af83aad05804552aaf570c833d67af2a4d4272b4f8f92fb02adbe04c012

Download Submit
C:\Windows\system\KubOoRK.exe

Filesize
1.9MB

MD5
fb3bd8be0e1ab6f2d6a0aeec6c089146

SHA1
44edab999076ccb2db1959033e07933ccda471a9

SHA256
f838cf24a3b8d22f941e46a3e7dea731386a92cca0d64a060c16facb73805c4e

SHA512
c27d2ada1fef15edaba80fbb9f234b39626dd3ec262515a8d50e2af7551d322134f8c263cd2e5e3507c1eb26aecfdf634d18d435cf0d5eb59311ee795c58b48e

Download Submit
C:\Windows\system\LYGnzWr.exe

Filesize
1.9MB

MD5
7ce03dfc4db96331c1429fc461cf7434

SHA1
c48ebf6476cb8df5009fc7c98985f8b9a597588b

SHA256
76251caa7f84e76de2b3bb068a81dfa3710a6a3b0fd4ab123d5f844b62528941

SHA512
4927016734e51978b88375715affba2f45795e07b98a3176a1a5b3e2031e603ae320c95c24ae2b5989fb4a61ae0e46f197f0d7fa30a53904d60b663c00aabfc7

Download Submit
C:\Windows\system\MWCCfKn.exe

Filesize
1.9MB

MD5
611077d6c9fffe4e20da2b35d4988dca

SHA1
99652222f1e38dd25b9fd2b34b72b199e4323a68

SHA256
28b1b92e81e8cbeb08b612066cd32c091e502e64c5105063045e8a7005b61424

SHA512
952c75d352f4197409087f59747f72543a42702a6e7f2c1c80182a1129814cec67ae6914e4b6a2d21d4803acceda761e0ebe2fbd5a4f1eec8550937c60d73a16

Download Submit
C:\Windows\system\NVHNaXU.exe

Filesize
1.9MB

MD5
10feb6606ca4d54a603c097ad53ef7be

SHA1
acb6e19391144a040afd33093c3fa5c7106e5fbe

SHA256
645803afab8f701268f33cc27ff02243872888e6f0df9061c79f50f38c55d92e

SHA512
6099ee93efbdf153483745971eb5bfb7a3900bc2a2f89b7c95830922f3408eb1b9470a61d8e49817a9b09fc555ed236326cd4e828d7197d973d797e4e3e38bd5

Download Submit
C:\Windows\system\OMsRMsH.exe

Filesize
1.9MB

MD5
66086d7546cd5be0954a2b2086ed2085

SHA1
cd49398cdf33382ea2e6f54410ea55cac286150e

SHA256
ccccf231fc7996c7249c79a4613399bb3730c08bc6f48587998c29bc582d4cc3

SHA512
25ddc28633996038d07dc2c0c2c3ca0a9f64c55163ae2a71f75a079edce1a0c7e5248bbeb69397460f384c4fe42829b2fc4c0122ac13e07e8286f2290dbe93cc

Download Submit
C:\Windows\system\OVxDIJs.exe

Filesize
1.9MB

MD5
d91c44dbcbb41c995afb8bc04ba96c11

SHA1
b7305c58740fb30fd9ec5710140f3781bada7e75

SHA256
84aa82205e2e0696057083df72ef6983d3c1bf305a5fd959864b1d15284523d8

SHA512
80e8b760cd87bda7a798d8c1b60ae06a44ec60b5f46acc0435d7e89aa1dd8e108e0eb31d4889217b54ccb311167294073594674abb936e3f8ad62fecc07ccf26

Download Submit
C:\Windows\system\QUgmHXU.exe

Filesize
1.9MB

MD5
adbc69cef0af406c366aabf4e1cb2c30

SHA1
e516a6ab83b0e945cb8a39de4aaf29f3bdce5a8a

SHA256
c0d2e33b809f55c7f53fca24d26e8a19b292497201257b31a7267902b7caaa5d

SHA512
9beae4e07a7d1950de4df3c78af1725094bc3f121bbe58e79dc0d015c55c5fb6109c0249973076dd2e463f31be6b533a62eea32cea9bffc6df534ab545b8c793

Download Submit
C:\Windows\system\QjMeSXN.exe

Filesize
1.9MB

MD5
1f66072958005ae6a85ef465161265c4

SHA1
ffe2fd72aea4cd5fdf018ca063db2ecdf846f299

SHA256
f308c0553fa3545274670d37dbd17be066a46e569220944840c3f79d9ade5a9c

SHA512
307fdabb58bd887b8ac12c990c68e040c7b9affb08aa99ac7c714a4429cb1005fe3fe96e0297598bf42032eac16de4c1dec99f00d7cf5f119560089d0ac69997

Download Submit
C:\Windows\system\SLggBxc.exe

Filesize
1.9MB

MD5
7baab846e76025a5159c5328cad81a55

SHA1
9c08ae186e8fc50404264d24b87dab87f1b55f28

SHA256
1af66d5cea6a43cc4a271a3801de2a181a6be5ef6ce9a1e3f4e0a0aea785b3b1

SHA512
69caefad7cfef2a5778e8f3809c6a8e75f6794a6bd49aa0c7ea2021cef2b348907748bcd79a42d6b4cff3cd0ea7a117953dc134468afe165a8fcd3c359f90ea3

Download Submit
C:\Windows\system\UWlOkFg.exe

Filesize
1.9MB

MD5
af98eab806f0803aa7f15a334a477bae

SHA1
26b27d52f8c35f955555a3eb0b1a2830cb59ae7f

SHA256
3e6045f4f2b13ee92b588aecfe2fa98b47824716eca80f9a552516951ad33937

SHA512
b4c822b7a2554feb1679898a0c7f7f703f93bcdf9bdd807cf80469d868f1976bc3470e5648ea03d05a661a165290351572a57490345c849f6a6d1c8ac30b88fb

Download Submit
C:\Windows\system\XqAlaAU.exe

Filesize
1.9MB

MD5
aa872b0171d8d152f37cd0122afb1493

SHA1
266bb85b2521b2cd71a8c5d003049626f3de820c

SHA256
d923ec9bfd90d56d257458d0737698f1c0da15924699fe3ba058f35adb550753

SHA512
916f3b9d83ccb7328f849edcad1a08f3b7c41bd378347c1dc08fdd96fbf54eb9347bed9e0cb549ae660ed36c39bbf37676b29b4629ec9b915ae4ea90fbe5a346

Download Submit
C:\Windows\system\ZDWZlcL.exe

Filesize
1.9MB

MD5
c3f4fca611610c017ad8e71152227beb

SHA1
f4826e07d1edc648aa7026b6e5394cf3769235c2

SHA256
e673b377393b56ea096ae5cb60f213cbda25a2f0368f6810d8cffb2b527bf9f7

SHA512
6b57d9f3f0eeee7deab1a4068a84338f244b1f025f4d04f642c80ba4bac2d12eebc93da18c2bc4d221de697dde41c9df5811e76831aca45a7c690deba5c3ad99

Download Submit
C:\Windows\system\ZqiIVEy.exe

Filesize
1.9MB

MD5
157e24c76261b295b7a84e009c3b9fa6

SHA1
d6fa9149df9bdefd274358104708449f8da12011

SHA256
6e544741ebcc21ca5ab498b6b4d8457020704d649b7a70ca87fa3e49e5b41c6b

SHA512
2ffc91d62d57ef238c497e544a228f2edf7eccb2934f0b2f92868a8462e33f7b31bc7296dce4a9457f16bdebe105668d38604636d7defa95d0e9996b165557af

Download Submit
C:\Windows\system\aKkMqbj.exe

Filesize
1.9MB

MD5
2731b86b87f9ae7d2abaf76c8769a3bc

SHA1
3af7c03bf896c4cf46fd8217e30c6ca0cc989b7d

SHA256
abd6a5e44a5b0790db7d0346893845504453a7ac14bc20903e652e41e2f6cafb

SHA512
e244089cc59a8418c487f5bc96e7286a0cb0fb84cd023cd92028d65e66b41c480610ca397b2234b1f04788c91ede53f067fbdee14c156c7068315f3240f3c9b7

Download Submit
C:\Windows\system\aSPgMGD.exe

Filesize
1.9MB

MD5
b7f4c609cf5f069b71db18c42e4ea3a3

SHA1
bfd092a0ae6da5d340f90df6acc7d6bc466512c2

SHA256
4867c330a97e5346f9e9d08b2fd7007ff6a51f178db6226bfa6a66a94bbe8d1c

SHA512
3481fd6dcaf36a41078650adc27989acc14e34e2c9d139e20edb7e21dc241a976e6b7b3b965b63c3efe4237aa9229a35d1ac5073705564e6035bc243b2a69197

Download Submit
C:\Windows\system\clRKUWL.exe

Filesize
1.9MB

MD5
ca472c0c8858a3c49d944a87b5f9fc90

SHA1
105c7ddb0896ef628d197f9c79cc6342bc3fc676

SHA256
6ca937f3420b39d71c724c6cc671f5075069edc955a2ccb55424d3c580807932

SHA512
7a94109b36e7e0bfec30ed4a500fcfc24da31bf08086d34ca3241531e75ea5f776967d9a1fa08083456d6706db6368e5a85088f7b2ec3a55947fb65587fe6d4c

Download Submit
C:\Windows\system\gtsUDWB.exe

Filesize
1.9MB

MD5
afe6cf68f10c9cf97637cd4faf73147f

SHA1
5cdf0f7ddbcf8189150745d2398b373606f5f4d9

SHA256
5a49f20cc8af5f74b010582df53b6d75944cf0ef77b99999fbb690afb227c450

SHA512
1a555357eca4cae4c70aa17c7faa03dd225e72ced4570b9105099289a4458bdb083249ae8f2427a108f4cd9fc6011d2e2c37aec78b49b780f99b3dfccf852786

Download Submit
C:\Windows\system\lYBCLKH.exe

Filesize
1.9MB

MD5
2a86834acd2372813f35b6b225757d1c

SHA1
d06a5988b5c53de51543de8d76f34036e752c230

SHA256
3d6ef49a781c43bd7df32c0943842167cab05682cbf107385a3da085b297ee50

SHA512
b9772259e6b5a982945fff3fadbce5beda9c011e4d113ee388a4f9ab8d4641e2c83a4737687e52d78a47d57d2a079a3ec10ffd3631429cede8bf3be188b7384c

Download Submit
C:\Windows\system\pEeSUGV.exe

Filesize
1.9MB

MD5
c137c98b83e334f68f751a303630e30c

SHA1
9ad04c9d6ed195d379f988b36baa00d9439ec485

SHA256
b162bba15143aa7bccf0c8b6f7415d7c24a8d2c4986b7975e86733cb10e4a127

SHA512
997949c4c7e385344a6f5335a5197b30fab10218a5454ccadcd6baa5d6da2929f0777c1f9fa015aff74a3140a0eb22b0aea593a9017c323ffca6bd03cb34bce3

Download Submit
C:\Windows\system\pLnfooC.exe

Filesize
1.9MB

MD5
93e3363c08308d018497f0833b5a806a

SHA1
1f2d660ce65c46d7fd964799bf5d69ebdef28de7

SHA256
638ba079cf5cb3c3ee2154d79558578600063369e6c4a685f70caf7c18b26434

SHA512
e683e777e109fe4f78ce7be0e0185987d7bde759a05ca77700e5016c4401a715fa5939e44c11e33a9b7eb11f1fc5df9acd27facdd047a1a16b8511860c8741da

Download Submit
C:\Windows\system\rLWuRBz.exe

Filesize
1.9MB

MD5
6532a624f8e58b9008496dfd13aab7c9

SHA1
463ac84265f346ea24a222b66c6d8a408d9ec92c

SHA256
6eba0284bbab79f588c90c376d54e7d56908f709896ef4e564bb12b053b28b9e

SHA512
d74317359e204fd4e92dfbaddc8f3345ab9574cb6d6244ee944f31d9d982ef6abed677ca18d2968ee96c5bb60c0fef11933c4217ce9455277f7b9cb7db6c912f

Download Submit
C:\Windows\system\rRBFnDa.exe

Filesize
1.9MB

MD5
7140aa2c688cc8d8aef53ee6ba043421

SHA1
a940854d16cc4fa405564277b5c8d652fa183902

SHA256
b77a30ea42be65f54c1fbaf16afa35d064818be8ff5e4552889dcc8866133d28

SHA512
4d80124adeb58af7eede856ad75a65110882aa0b46fbf71d8fdc26fa807a459d447f9e746b6b24f4e66639ac652e3c8b1638f94b02ed0f7ba1ea17af7dbc00c0

Download Submit
C:\Windows\system\sgXylHT.exe

Filesize
1.9MB

MD5
3b8756410288bf3a5e8ecab3d4e6ed56

SHA1
060a0d09a3eb87f1739f2d7fab23c987e2e91b19

SHA256
cf5f924064f93e167490cb0a83cb74629dd1685f0e729d8a3674271d6b3f5321

SHA512
c8393df660c81b71e69d5d2f1d2709228eff8a7960a806a2e8f4e051481b6fecb4cd6a055225357fc6a6209176997e5afeb0b999890d882f7a777a1f5d1fc9e6

Download Submit
C:\Windows\system\sjPUzXZ.exe

Filesize
1.9MB

MD5
0dcd40216976937f216fc54a9eaa1e9a

SHA1
3ef666dc5d416dab77e3ac5f67d2f631dd49d0e5

SHA256
c81d903890c516075f654cb7c4f90d8c40baa7e59a0081505006c5b8fe064f38

SHA512
c6d0fbf370b7ab139f133881933e9ec4ae2bcae7446a7070050d29c34f7d7d3e61345f36be971e76ef262e9f72fc3dbc82b362f4962dec6eccf63f479ca96ada

Download Submit
C:\Windows\system\vAMuLUp.exe

Filesize
1.9MB

MD5
5149e26267fa8bc1e8f8068f381d7f65

SHA1
76a4c929f1e6f9505bae243742415025f9f39276

SHA256
ca84ee909e058dbef0a90087f3a6a5a01285160c239a88bed723b6a533fffb39

SHA512
700e98c91965c800a763d7a51eefc26895ead6951454ebf83a305735314ff7c8046e4346369571e81730397d5189c528ede0a8c7e20cd4e411832af4021d60b6

Download Submit
C:\Windows\system\vNXtwlg.exe

Filesize
1.9MB

MD5
15fd1bc89f728bcefeabcd0a5d9824ba

SHA1
a4c44f765942dc19afc3c037517dca725a79a5ae

SHA256
80e92bda6f07178f6ebc53f8fb7480fcdef482d43d5ff5780410bc8147436eb6

SHA512
217bf1c9655bd566ef6154d2abda98814ec54870e1b06478210b29f82624e1c6b1833a12280f3684f6e9cf7d0bbbd16c8040cf565eccc2b6fdf57b167a150ea9

Download Submit
\Windows\system\CTrKkuq.exe

Filesize
1.9MB

MD5
95503bd42d3662cdb8540dcd68ab28e3

SHA1
69eb84c96684d130bc1e692277a63fc7401178d9

SHA256
a17503c58c6a5931a949f00f647ee40655236e511ec7e4235ce637319972fb96

SHA512
b9653405b67d9974a1907a68ac448fb8cee4a33dc9295ef375c43fac06038971e08e7b2c32521a12a9651ac6bec57b4bc0d4418d9250a6754b040e2c5b7069ad

Download Submit
\Windows\system\IkpprDE.exe

Filesize
1.9MB

MD5
da7e4780bcafc7abf0ff66ea48af517d

SHA1
1e923f74fe8d18b67005110e71b3c117cccb543a

SHA256
b52822f2f599cb2c4028d462bc2654056fd45bfa2a1dfa05cf1c7de167652e1b

SHA512
a3cae7c0b116eed6c2ac757a2e9c0f1b7980f7c930b78199c49ba150f11e42890a6912daae101fccfdd797c23ecd43cfab983698f711dc203532d09f47c5bc7e

Download Submit
memory/1764-199-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/1764-24-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-205-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-23-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-196-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1764-195-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-201-0x0000000003140000-0x0000000003532000-memory.dmp

Filesize
3.9MB

Download
memory/1764-0-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/1764-194-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2132-190-0x000007FEF48A0000-0x000007FEF523D000-memory.dmp

Filesize
9.6MB

Download
memory/2132-209-0x000000001B5A0000-0x000000001B882000-memory.dmp

Filesize
2.9MB

Download
memory/2132-210-0x0000000002790000-0x0000000002798000-memory.dmp

Filesize
32KB

Download
memory/2132-29-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2132-191-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/2132-498-0x000007FEF48A0000-0x000007FEF523D000-memory.dmp

Filesize
9.6MB

Download
memory/2536-192-0x000000013FF50000-0x0000000140342000-memory.dmp

Filesize
3.9MB

Download
memory/2552-202-0x000000013F1E0000-0x000000013F5D2000-memory.dmp

Filesize
3.9MB

Download
memory/2612-12-0x000000013F1F0000-0x000000013F5E2000-memory.dmp

Filesize
3.9MB

Download
memory/2672-193-0x000000013F740000-0x000000013FB32000-memory.dmp

Filesize
3.9MB

Download
memory/2696-200-0x000000013F030000-0x000000013F422000-memory.dmp

Filesize
3.9MB

Download
memory/2740-203-0x000000013F370000-0x000000013F762000-memory.dmp

Filesize
3.9MB

Download
memory/2748-198-0x000000013FF00000-0x00000001402F2000-memory.dmp

Filesize
3.9MB

Download
memory/2788-197-0x000000013F2C0000-0x000000013F6B2000-memory.dmp

Filesize
3.9MB

Download
memory/3036-28-0x000000013FA50000-0x000000013FE42000-memory.dmp

Filesize
3.9MB

Download