xmrig | e959f08487bccbf6938840ddd1dfbe836fc1c7a7de149029bb3cff06ff3affeb

Analysis

max time kernel
26s
max time network
18s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
Size

1.7MB
MD5

03ae0f71b6f3ae42c1a40f8005cebf64
SHA1

253f7c54177efd13469932f99f2f8bb39c451ebe
SHA256

e959f08487bccbf6938840ddd1dfbe836fc1c7a7de149029bb3cff06ff3affeb
SHA512

13e3e0aede61dfb9d009198847143523a9bcc45cd457f68ba9896ea3713a09f6d8f2e12e4a68859e6119fc2cf3dc415d16d59512c26f65e55eca64e97a8351f6
SSDEEP

24576:zv3/fTLF671TilQFG4P5PMkibTJH+2Q/ynKeWY1s38kQu12bPxvyuzaBgJ9pcFtB:Lz071uv4BPMkibTIA5I4TNrpDGKaNn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral1/memory/2692-192-0x000000013F340000-0x000000013F732000-memory.dmp	xmrig
behavioral1/memory/2448-185-0x000000013FF40000-0x0000000140332000-memory.dmp	xmrig
behavioral1/memory/2700-183-0x000000013FB00000-0x000000013FEF2000-memory.dmp	xmrig
behavioral1/memory/2592-182-0x000000013F080000-0x000000013F472000-memory.dmp	xmrig
behavioral1/memory/2784-169-0x000000013F470000-0x000000013F862000-memory.dmp	xmrig
behavioral1/memory/2184-49-0x000000013F570000-0x000000013F962000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2396	OOXjhBl.exe
2184	SYKKXAJ.exe
2784	kUUMLLm.exe
2592	pWNoXHi.exe
2700	SRGpqmx.exe
2448	mmVjLWv.exe
2692	dZtukbQ.exe
2756	BZNptkd.exe
2732	DKcDtob.exe
2736	AEmBPcy.exe
2508	WgsMGLh.exe
2916	pJHWXfA.exe
1924	XceuFEE.exe
2624	CecaILZ.exe
1908	EbznwSs.exe
1940	uwNRrML.exe
2616	vtfXYYb.exe
2456	sHfkmWq.exe
2796	jFITDoY.exe
2192	kdfJpQt.exe
2676	BJKdYOd.exe
1276	mYvYFnl.exe
3016	xBeVFgp.exe
2664	sioLcta.exe
1948	cRYoKAa.exe
1496	dQSjizG.exe
2644	vQmJVoo.exe
2356	lndfOyE.exe
1548	mJRtjXw.exe
1560	pONPHNu.exe
2324	qOJcUXM.exe
1500	awWIXja.exe
2684	JkhfxnV.exe
2816	PxuoePz.exe
2304	lbgdZCx.exe
2400	cUJYrVC.exe
588	QDTlNFH.exe
916	jIrKNKb.exe
2080	eQBOfjU.exe
2420	DqnZJxb.exe
2636	VAxbBTZ.exe
1764	ahalhNL.exe
1996	ksoBlmv.exe
1172	KgrLyva.exe
3048	KHFnWvF.exe
2872	KxqBCFu.exe
2028	Lwfavai.exe
1520	ZdCMmxm.exe
308	whrYDND.exe
2524	UUENuDA.exe
1472	ovqBGZx.exe
2568	iCtysAo.exe
2672	xUQkDsg.exe
2912	PBYYFCJ.exe
2832	IuokVFW.exe
1944	GjXcUgY.exe
2580	qZmGwZb.exe
2180	XQeZilv.exe
1700	vKlXYOM.exe
2564	trBTXiR.exe
1452	iAxKymd.exe
2120	dEZRJOr.exe
704	zcBgJOi.exe
1356	tYKXbTm.exe

Loads dropped DLL 64 IoCs

pid	Process
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe

UPX packed file 44 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1160-1-0x000000013F330000-0x000000013F722000-memory.dmp	upx
behavioral1/files/0x000b000000015d0f-7.dat	upx
behavioral1/memory/2396-9-0x000000013FC60000-0x0000000140052000-memory.dmp	upx
behavioral1/files/0x000800000001650c-23.dat	upx
behavioral1/files/0x000a0000000167d5-20.dat	upx
behavioral1/files/0x0008000000016c04-42.dat	upx
behavioral1/files/0x0006000000016e4a-89.dat	upx
behavioral1/files/0x0005000000018717-140.dat	upx
behavioral1/files/0x000d0000000185f4-134.dat	upx
behavioral1/files/0x0007000000016c51-130.dat	upx
behavioral1/files/0x00060000000174a5-127.dat	upx
behavioral1/memory/2692-192-0x000000013F340000-0x000000013F732000-memory.dmp	upx
behavioral1/memory/2448-185-0x000000013FF40000-0x0000000140332000-memory.dmp	upx
behavioral1/memory/2700-183-0x000000013FB00000-0x000000013FEF2000-memory.dmp	upx
behavioral1/memory/2592-182-0x000000013F080000-0x000000013F472000-memory.dmp	upx
behavioral1/files/0x0006000000016d57-174.dat	upx
behavioral1/files/0x0006000000016d3e-172.dat	upx
behavioral1/memory/2784-169-0x000000013F470000-0x000000013F862000-memory.dmp	upx
behavioral1/files/0x0006000000017407-165.dat	upx
behavioral1/files/0x000600000001737c-164.dat	upx
behavioral1/files/0x0006000000017371-163.dat	upx
behavioral1/files/0x0006000000016d16-152.dat	upx
behavioral1/files/0x0006000000016cbe-149.dat	upx
behavioral1/files/0x0006000000016ca5-147.dat	upx
behavioral1/files/0x0006000000018ba1-144.dat	upx
behavioral1/files/0x000500000001860c-137.dat	upx
behavioral1/files/0x00140000000185e9-131.dat	upx
behavioral1/files/0x0006000000017422-124.dat	upx
behavioral1/files/0x00060000000173f2-118.dat	upx
behavioral1/files/0x0006000000017374-111.dat	upx
behavioral1/files/0x0006000000016d51-104.dat	upx
behavioral1/files/0x0006000000016d1a-103.dat	upx
behavioral1/files/0x0006000000016cc6-102.dat	upx
behavioral1/files/0x0006000000016cb6-101.dat	upx
behavioral1/files/0x0007000000016c7c-100.dat	upx
behavioral1/files/0x000600000001735a-96.dat	upx
behavioral1/files/0x000f000000005578-92.dat	upx
behavioral1/files/0x0006000000016fed-108.dat	upx
behavioral1/files/0x0006000000016e24-107.dat	upx
behavioral1/files/0x0009000000016a29-72.dat	upx
behavioral1/files/0x0008000000016be2-45.dat	upx
behavioral1/memory/2184-49-0x000000013F570000-0x000000013F962000-memory.dmp	upx
behavioral1/files/0x00070000000165ae-40.dat	upx
behavioral1/files/0x0009000000016176-13.dat	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\pONPHNu.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\irsMojF.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\FUAVzur.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\xpFqdCn.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\mYEsceM.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\znSXsDU.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\aSCHWwC.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\FrCmGWl.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\SWrYbcC.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\Vmgxfcy.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\nKuDdpC.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\Ebrbvpm.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\FLCCeZz.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\hvTMFDP.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\UToYJMo.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\FCtiOhg.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\cpOLxiQ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\bsRYCwB.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\ZWEChvO.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\tLBFCQQ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\KCqIJqR.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\GZHJwgR.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\wDVWHNF.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\UltwhPj.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\uYCgcXg.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\oMPfoOO.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\mSmvWNx.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\UTxFSIP.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\EktpqlU.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\JjIeprx.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\BfTfFDR.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\ZWwnBbc.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\ksoBlmv.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\tmvyemy.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\aXxGUUJ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\oQSpogD.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\uAwWYyM.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\fGiwgNb.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\imVIRjZ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\LIKHDNB.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\yignaDm.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\RAqBAez.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\XkgNOAE.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\SXEzElY.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\QnDPqVI.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\NgMzOqE.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\xirIEJg.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\VAxbBTZ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\JRZbMgQ.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\GwqkBzs.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\CyAdXSl.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\irEcbeB.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\FPquXnm.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\krmXeDV.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\YwpSPzv.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\EMyvUUA.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\chrDVFg.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\gWEpruh.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\WtdzfVY.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\ECdcCTg.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\wHyLkHO.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\cXJGOkc.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\WdKLggc.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
File created	C:\Windows\System\PjbEbHe.exe	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1664	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeLockMemoryPrivilege	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1160 wrote to memory of 1664	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	29
PID 1160 wrote to memory of 1664	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	29
PID 1160 wrote to memory of 1664	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	29
PID 1160 wrote to memory of 2396	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	30
PID 1160 wrote to memory of 2396	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	30
PID 1160 wrote to memory of 2396	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	30
PID 1160 wrote to memory of 2184	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	31
PID 1160 wrote to memory of 2184	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	31
PID 1160 wrote to memory of 2184	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	31
PID 1160 wrote to memory of 2784	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	32
PID 1160 wrote to memory of 2784	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	32
PID 1160 wrote to memory of 2784	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	32
PID 1160 wrote to memory of 2592	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	33
PID 1160 wrote to memory of 2592	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	33
PID 1160 wrote to memory of 2592	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	33
PID 1160 wrote to memory of 2700	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	34
PID 1160 wrote to memory of 2700	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	34
PID 1160 wrote to memory of 2700	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	34
PID 1160 wrote to memory of 2692	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	35
PID 1160 wrote to memory of 2692	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	35
PID 1160 wrote to memory of 2692	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	35
PID 1160 wrote to memory of 2448	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	36
PID 1160 wrote to memory of 2448	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	36
PID 1160 wrote to memory of 2448	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	36
PID 1160 wrote to memory of 2756	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	37
PID 1160 wrote to memory of 2756	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	37
PID 1160 wrote to memory of 2756	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	37
PID 1160 wrote to memory of 2732	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	38
PID 1160 wrote to memory of 2732	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	38
PID 1160 wrote to memory of 2732	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	38
PID 1160 wrote to memory of 2616	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	39
PID 1160 wrote to memory of 2616	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	39
PID 1160 wrote to memory of 2616	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	39
PID 1160 wrote to memory of 2736	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	40
PID 1160 wrote to memory of 2736	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	40
PID 1160 wrote to memory of 2736	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	40
PID 1160 wrote to memory of 2456	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	41
PID 1160 wrote to memory of 2456	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	41
PID 1160 wrote to memory of 2456	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	41
PID 1160 wrote to memory of 2508	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	42
PID 1160 wrote to memory of 2508	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	42
PID 1160 wrote to memory of 2508	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	42
PID 1160 wrote to memory of 2796	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	43
PID 1160 wrote to memory of 2796	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	43
PID 1160 wrote to memory of 2796	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	43
PID 1160 wrote to memory of 2916	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	44
PID 1160 wrote to memory of 2916	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	44
PID 1160 wrote to memory of 2916	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	44
PID 1160 wrote to memory of 2192	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	45
PID 1160 wrote to memory of 2192	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	45
PID 1160 wrote to memory of 2192	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	45
PID 1160 wrote to memory of 1924	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	46
PID 1160 wrote to memory of 1924	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	46
PID 1160 wrote to memory of 1924	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	46
PID 1160 wrote to memory of 2644	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	47
PID 1160 wrote to memory of 2644	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	47
PID 1160 wrote to memory of 2644	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	47
PID 1160 wrote to memory of 2624	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	48
PID 1160 wrote to memory of 2624	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	48
PID 1160 wrote to memory of 2624	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	48
PID 1160 wrote to memory of 2356	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	49
PID 1160 wrote to memory of 2356	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	49
PID 1160 wrote to memory of 2356	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	49
PID 1160 wrote to memory of 1908	1160	03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\03ae0f71b6f3ae42c1a40f8005cebf64_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1664
- C:\Windows\System\OOXjhBl.exe
  C:\Windows\System\OOXjhBl.exe
  2⤵
  - Executes dropped EXE
  PID:2396
- C:\Windows\System\SYKKXAJ.exe
  C:\Windows\System\SYKKXAJ.exe
  2⤵
  - Executes dropped EXE
  PID:2184
- C:\Windows\System\kUUMLLm.exe
  C:\Windows\System\kUUMLLm.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\pWNoXHi.exe
  C:\Windows\System\pWNoXHi.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\SRGpqmx.exe
  C:\Windows\System\SRGpqmx.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\dZtukbQ.exe
  C:\Windows\System\dZtukbQ.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\mmVjLWv.exe
  C:\Windows\System\mmVjLWv.exe
  2⤵
  - Executes dropped EXE
  PID:2448
- C:\Windows\System\BZNptkd.exe
  C:\Windows\System\BZNptkd.exe
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Windows\System\DKcDtob.exe
  C:\Windows\System\DKcDtob.exe
  2⤵
  - Executes dropped EXE
  PID:2732
- C:\Windows\System\vtfXYYb.exe
  C:\Windows\System\vtfXYYb.exe
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Windows\System\AEmBPcy.exe
  C:\Windows\System\AEmBPcy.exe
  2⤵
  - Executes dropped EXE
  PID:2736
- C:\Windows\System\sHfkmWq.exe
  C:\Windows\System\sHfkmWq.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\WgsMGLh.exe
  C:\Windows\System\WgsMGLh.exe
  2⤵
  - Executes dropped EXE
  PID:2508
- C:\Windows\System\jFITDoY.exe
  C:\Windows\System\jFITDoY.exe
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Windows\System\pJHWXfA.exe
  C:\Windows\System\pJHWXfA.exe
  2⤵
  - Executes dropped EXE
  PID:2916
- C:\Windows\System\kdfJpQt.exe
  C:\Windows\System\kdfJpQt.exe
  2⤵
  - Executes dropped EXE
  PID:2192
- C:\Windows\System\XceuFEE.exe
  C:\Windows\System\XceuFEE.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\vQmJVoo.exe
  C:\Windows\System\vQmJVoo.exe
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Windows\System\CecaILZ.exe
  C:\Windows\System\CecaILZ.exe
  2⤵
  - Executes dropped EXE
  PID:2624
- C:\Windows\System\lndfOyE.exe
  C:\Windows\System\lndfOyE.exe
  2⤵
  - Executes dropped EXE
  PID:2356
- C:\Windows\System\EbznwSs.exe
  C:\Windows\System\EbznwSs.exe
  2⤵
  - Executes dropped EXE
  PID:1908
- C:\Windows\System\mJRtjXw.exe
  C:\Windows\System\mJRtjXw.exe
  2⤵
  - Executes dropped EXE
  PID:1548
- C:\Windows\System\uwNRrML.exe
  C:\Windows\System\uwNRrML.exe
  2⤵
  - Executes dropped EXE
  PID:1940
- C:\Windows\System\qOJcUXM.exe
  C:\Windows\System\qOJcUXM.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\BJKdYOd.exe
  C:\Windows\System\BJKdYOd.exe
  2⤵
  - Executes dropped EXE
  PID:2676
- C:\Windows\System\awWIXja.exe
  C:\Windows\System\awWIXja.exe
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Windows\System\mYvYFnl.exe
  C:\Windows\System\mYvYFnl.exe
  2⤵
  - Executes dropped EXE
  PID:1276
- C:\Windows\System\JkhfxnV.exe
  C:\Windows\System\JkhfxnV.exe
  2⤵
  - Executes dropped EXE
  PID:2684
- C:\Windows\System\xBeVFgp.exe
  C:\Windows\System\xBeVFgp.exe
  2⤵
  - Executes dropped EXE
  PID:3016
- C:\Windows\System\PxuoePz.exe
  C:\Windows\System\PxuoePz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\sioLcta.exe
  C:\Windows\System\sioLcta.exe
  2⤵
  - Executes dropped EXE
  PID:2664
- C:\Windows\System\lbgdZCx.exe
  C:\Windows\System\lbgdZCx.exe
  2⤵
  - Executes dropped EXE
  PID:2304
- C:\Windows\System\cRYoKAa.exe
  C:\Windows\System\cRYoKAa.exe
  2⤵
  - Executes dropped EXE
  PID:1948
- C:\Windows\System\cUJYrVC.exe
  C:\Windows\System\cUJYrVC.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\dQSjizG.exe
  C:\Windows\System\dQSjizG.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\QDTlNFH.exe
  C:\Windows\System\QDTlNFH.exe
  2⤵
  - Executes dropped EXE
  PID:588
- C:\Windows\System\pONPHNu.exe
  C:\Windows\System\pONPHNu.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\KgrLyva.exe
  C:\Windows\System\KgrLyva.exe
  2⤵
  - Executes dropped EXE
  PID:1172
- C:\Windows\System\jIrKNKb.exe
  C:\Windows\System\jIrKNKb.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\KHFnWvF.exe
  C:\Windows\System\KHFnWvF.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\eQBOfjU.exe
  C:\Windows\System\eQBOfjU.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Windows\System\KxqBCFu.exe
  C:\Windows\System\KxqBCFu.exe
  2⤵
  - Executes dropped EXE
  PID:2872
- C:\Windows\System\DqnZJxb.exe
  C:\Windows\System\DqnZJxb.exe
  2⤵
  - Executes dropped EXE
  PID:2420
- C:\Windows\System\Lwfavai.exe
  C:\Windows\System\Lwfavai.exe
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\System\VAxbBTZ.exe
  C:\Windows\System\VAxbBTZ.exe
  2⤵
  - Executes dropped EXE
  PID:2636
- C:\Windows\System\ZdCMmxm.exe
  C:\Windows\System\ZdCMmxm.exe
  2⤵
  - Executes dropped EXE
  PID:1520
- C:\Windows\System\ahalhNL.exe
  C:\Windows\System\ahalhNL.exe
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Windows\System\whrYDND.exe
  C:\Windows\System\whrYDND.exe
  2⤵
  - Executes dropped EXE
  PID:308
- C:\Windows\System\ksoBlmv.exe
  C:\Windows\System\ksoBlmv.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\UUENuDA.exe
  C:\Windows\System\UUENuDA.exe
  2⤵
  - Executes dropped EXE
  PID:2524
- C:\Windows\System\ovqBGZx.exe
  C:\Windows\System\ovqBGZx.exe
  2⤵
  - Executes dropped EXE
  PID:1472
- C:\Windows\System\iCtysAo.exe
  C:\Windows\System\iCtysAo.exe
  2⤵
  - Executes dropped EXE
  PID:2568
- C:\Windows\System\xUQkDsg.exe
  C:\Windows\System\xUQkDsg.exe
  2⤵
  - Executes dropped EXE
  PID:2672
- C:\Windows\System\PBYYFCJ.exe
  C:\Windows\System\PBYYFCJ.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\IuokVFW.exe
  C:\Windows\System\IuokVFW.exe
  2⤵
  - Executes dropped EXE
  PID:2832
- C:\Windows\System\GjXcUgY.exe
  C:\Windows\System\GjXcUgY.exe
  2⤵
  - Executes dropped EXE
  PID:1944
- C:\Windows\System\qZmGwZb.exe
  C:\Windows\System\qZmGwZb.exe
  2⤵
  - Executes dropped EXE
  PID:2580
- C:\Windows\System\XQeZilv.exe
  C:\Windows\System\XQeZilv.exe
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Windows\System\vKlXYOM.exe
  C:\Windows\System\vKlXYOM.exe
  2⤵
  - Executes dropped EXE
  PID:1700
- C:\Windows\System\trBTXiR.exe
  C:\Windows\System\trBTXiR.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\iAxKymd.exe
  C:\Windows\System\iAxKymd.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Windows\System\dEZRJOr.exe
  C:\Windows\System\dEZRJOr.exe
  2⤵
  - Executes dropped EXE
  PID:2120
- C:\Windows\System\cCILAzj.exe
  C:\Windows\System\cCILAzj.exe
  2⤵
  PID:1892
- C:\Windows\System\zcBgJOi.exe
  C:\Windows\System\zcBgJOi.exe
  2⤵
  - Executes dropped EXE
  PID:704
- C:\Windows\System\hDoeirA.exe
  C:\Windows\System\hDoeirA.exe
  2⤵
  PID:2500
- C:\Windows\System\tYKXbTm.exe
  C:\Windows\System\tYKXbTm.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\eUqUmLB.exe
  C:\Windows\System\eUqUmLB.exe
  2⤵
  PID:2876
- C:\Windows\System\tsYRieN.exe
  C:\Windows\System\tsYRieN.exe
  2⤵
  PID:3008
- C:\Windows\System\caJaVwV.exe
  C:\Windows\System\caJaVwV.exe
  2⤵
  PID:1836
- C:\Windows\System\HnhUUBC.exe
  C:\Windows\System\HnhUUBC.exe
  2⤵
  PID:1284
- C:\Windows\System\XZCwAhQ.exe
  C:\Windows\System\XZCwAhQ.exe
  2⤵
  PID:1312
- C:\Windows\System\wWMoolX.exe
  C:\Windows\System\wWMoolX.exe
  2⤵
  PID:2648
- C:\Windows\System\aGlzyfz.exe
  C:\Windows\System\aGlzyfz.exe
  2⤵
  PID:736
- C:\Windows\System\tmvyemy.exe
  C:\Windows\System\tmvyemy.exe
  2⤵
  PID:856
- C:\Windows\System\pnwoseO.exe
  C:\Windows\System\pnwoseO.exe
  2⤵
  PID:796
- C:\Windows\System\ghZodsC.exe
  C:\Windows\System\ghZodsC.exe
  2⤵
  PID:108
- C:\Windows\System\aSCHWwC.exe
  C:\Windows\System\aSCHWwC.exe
  2⤵
  PID:2828
- C:\Windows\System\ZtHiRuO.exe
  C:\Windows\System\ZtHiRuO.exe
  2⤵
  PID:1184
- C:\Windows\System\ZJdiqVQ.exe
  C:\Windows\System\ZJdiqVQ.exe
  2⤵
  PID:2344
- C:\Windows\System\AGtpkTi.exe
  C:\Windows\System\AGtpkTi.exe
  2⤵
  PID:1884
- C:\Windows\System\XOyGqvB.exe
  C:\Windows\System\XOyGqvB.exe
  2⤵
  PID:896
- C:\Windows\System\WFIQfjZ.exe
  C:\Windows\System\WFIQfjZ.exe
  2⤵
  PID:1880
- C:\Windows\System\uauicCy.exe
  C:\Windows\System\uauicCy.exe
  2⤵
  PID:2760
- C:\Windows\System\sOdcjUz.exe
  C:\Windows\System\sOdcjUz.exe
  2⤵
  PID:2012
- C:\Windows\System\JDvAIsk.exe
  C:\Windows\System\JDvAIsk.exe
  2⤵
  PID:1696
- C:\Windows\System\CyAdXSl.exe
  C:\Windows\System\CyAdXSl.exe
  2⤵
  PID:2588
- C:\Windows\System\SYelGgP.exe
  C:\Windows\System\SYelGgP.exe
  2⤵
  PID:2484
- C:\Windows\System\AYORKtr.exe
  C:\Windows\System\AYORKtr.exe
  2⤵
  PID:2928
- C:\Windows\System\bWcDKzg.exe
  C:\Windows\System\bWcDKzg.exe
  2⤵
  PID:2060
- C:\Windows\System\CuqShyb.exe
  C:\Windows\System\CuqShyb.exe
  2⤵
  PID:1540
- C:\Windows\System\gREDCqn.exe
  C:\Windows\System\gREDCqn.exe
  2⤵
  PID:1916
- C:\Windows\System\PHkVBmD.exe
  C:\Windows\System\PHkVBmD.exe
  2⤵
  PID:2504
- C:\Windows\System\IIDujma.exe
  C:\Windows\System\IIDujma.exe
  2⤵
  PID:1656
- C:\Windows\System\TOVluTY.exe
  C:\Windows\System\TOVluTY.exe
  2⤵
  PID:324
- C:\Windows\System\tFqxSsM.exe
  C:\Windows\System\tFqxSsM.exe
  2⤵
  PID:988
- C:\Windows\System\UkDKaBp.exe
  C:\Windows\System\UkDKaBp.exe
  2⤵
  PID:620
- C:\Windows\System\DonzJtD.exe
  C:\Windows\System\DonzJtD.exe
  2⤵
  PID:3040
- C:\Windows\System\pDfLNwW.exe
  C:\Windows\System\pDfLNwW.exe
  2⤵
  PID:900
- C:\Windows\System\doWKcUU.exe
  C:\Windows\System\doWKcUU.exe
  2⤵
  PID:384
- C:\Windows\System\tLXrers.exe
  C:\Windows\System\tLXrers.exe
  2⤵
  PID:2964
- C:\Windows\System\GsNonFr.exe
  C:\Windows\System\GsNonFr.exe
  2⤵
  PID:1328
- C:\Windows\System\ZcYCgoD.exe
  C:\Windows\System\ZcYCgoD.exe
  2⤵
  PID:1720
- C:\Windows\System\OnKGyeF.exe
  C:\Windows\System\OnKGyeF.exe
  2⤵
  PID:1612
- C:\Windows\System\yoLjQAa.exe
  C:\Windows\System\yoLjQAa.exe
  2⤵
  PID:1240
- C:\Windows\System\gYBpEXo.exe
  C:\Windows\System\gYBpEXo.exe
  2⤵
  PID:764
- C:\Windows\System\cnvoVUG.exe
  C:\Windows\System\cnvoVUG.exe
  2⤵
  PID:2052
- C:\Windows\System\kblwohs.exe
  C:\Windows\System\kblwohs.exe
  2⤵
  PID:2140
- C:\Windows\System\JvoVNIm.exe
  C:\Windows\System\JvoVNIm.exe
  2⤵
  PID:1828
- C:\Windows\System\rRhLsBF.exe
  C:\Windows\System\rRhLsBF.exe
  2⤵
  PID:960
- C:\Windows\System\KoPmsgo.exe
  C:\Windows\System\KoPmsgo.exe
  2⤵
  PID:2888
- C:\Windows\System\iGJyFiF.exe
  C:\Windows\System\iGJyFiF.exe
  2⤵
  PID:2492
- C:\Windows\System\QElwzTx.exe
  C:\Windows\System\QElwzTx.exe
  2⤵
  PID:2744
- C:\Windows\System\FQCdMIC.exe
  C:\Windows\System\FQCdMIC.exe
  2⤵
  PID:2128
- C:\Windows\System\UTkuHqZ.exe
  C:\Windows\System\UTkuHqZ.exe
  2⤵
  PID:2320
- C:\Windows\System\dymzJRt.exe
  C:\Windows\System\dymzJRt.exe
  2⤵
  PID:2416
- C:\Windows\System\ysigXVl.exe
  C:\Windows\System\ysigXVl.exe
  2⤵
  PID:488
- C:\Windows\System\JeENQwZ.exe
  C:\Windows\System\JeENQwZ.exe
  2⤵
  PID:2156
- C:\Windows\System\TxUBeHP.exe
  C:\Windows\System\TxUBeHP.exe
  2⤵
  PID:2300
- C:\Windows\System\yignaDm.exe
  C:\Windows\System\yignaDm.exe
  2⤵
  PID:2804
- C:\Windows\System\ipjPUax.exe
  C:\Windows\System\ipjPUax.exe
  2⤵
  PID:1456
- C:\Windows\System\yqrjZDd.exe
  C:\Windows\System\yqrjZDd.exe
  2⤵
  PID:3004
- C:\Windows\System\uMWXIHt.exe
  C:\Windows\System\uMWXIHt.exe
  2⤵
  PID:2388
- C:\Windows\System\gYexOkz.exe
  C:\Windows\System\gYexOkz.exe
  2⤵
  PID:2868
- C:\Windows\System\yqONaOA.exe
  C:\Windows\System\yqONaOA.exe
  2⤵
  PID:2312
- C:\Windows\System\UGEsAUx.exe
  C:\Windows\System\UGEsAUx.exe
  2⤵
  PID:1568
- C:\Windows\System\QlTdkXd.exe
  C:\Windows\System\QlTdkXd.exe
  2⤵
  PID:1936
- C:\Windows\System\GQyKQYD.exe
  C:\Windows\System\GQyKQYD.exe
  2⤵
  PID:1776
- C:\Windows\System\aHEVakM.exe
  C:\Windows\System\aHEVakM.exe
  2⤵
  PID:1608
- C:\Windows\System\GsEuzfH.exe
  C:\Windows\System\GsEuzfH.exe
  2⤵
  PID:892
- C:\Windows\System\wTyYERl.exe
  C:\Windows\System\wTyYERl.exe
  2⤵
  PID:2096
- C:\Windows\System\bMUQCMa.exe
  C:\Windows\System\bMUQCMa.exe
  2⤵
  PID:2280
- C:\Windows\System\imVIRjZ.exe
  C:\Windows\System\imVIRjZ.exe
  2⤵
  PID:1668
- C:\Windows\System\yJUiZGA.exe
  C:\Windows\System\yJUiZGA.exe
  2⤵
  PID:2740
- C:\Windows\System\zJiJPGs.exe
  C:\Windows\System\zJiJPGs.exe
  2⤵
  PID:596
- C:\Windows\System\tEYDhCZ.exe
  C:\Windows\System\tEYDhCZ.exe
  2⤵
  PID:792
- C:\Windows\System\xmUukme.exe
  C:\Windows\System\xmUukme.exe
  2⤵
  PID:2728
- C:\Windows\System\fqAcyMC.exe
  C:\Windows\System\fqAcyMC.exe
  2⤵
  PID:2084
- C:\Windows\System\PpMMqUP.exe
  C:\Windows\System\PpMMqUP.exe
  2⤵
  PID:2372
- C:\Windows\System\JRTwXTx.exe
  C:\Windows\System\JRTwXTx.exe
  2⤵
  PID:2488
- C:\Windows\System\FfxuDgt.exe
  C:\Windows\System\FfxuDgt.exe
  2⤵
  PID:1768
- C:\Windows\System\mfFxMyt.exe
  C:\Windows\System\mfFxMyt.exe
  2⤵
  PID:412
- C:\Windows\System\QcDvvbg.exe
  C:\Windows\System\QcDvvbg.exe
  2⤵
  PID:2520
- C:\Windows\System\NFBMxRM.exe
  C:\Windows\System\NFBMxRM.exe
  2⤵
  PID:1704
- C:\Windows\System\rDrgtHF.exe
  C:\Windows\System\rDrgtHF.exe
  2⤵
  PID:2208
- C:\Windows\System\hHmzboq.exe
  C:\Windows\System\hHmzboq.exe
  2⤵
  PID:2780
- C:\Windows\System\Uonrynt.exe
  C:\Windows\System\Uonrynt.exe
  2⤵
  PID:2632
- C:\Windows\System\RElOxru.exe
  C:\Windows\System\RElOxru.exe
  2⤵
  PID:3080
- C:\Windows\System\FHvCDQe.exe
  C:\Windows\System\FHvCDQe.exe
  2⤵
  PID:3096
- C:\Windows\System\xhQpqSu.exe
  C:\Windows\System\xhQpqSu.exe
  2⤵
  PID:3112
- C:\Windows\System\fIFLirp.exe
  C:\Windows\System\fIFLirp.exe
  2⤵
  PID:3128
- C:\Windows\System\HgVSDWT.exe
  C:\Windows\System\HgVSDWT.exe
  2⤵
  PID:3216
- C:\Windows\System\ipQVkPX.exe
  C:\Windows\System\ipQVkPX.exe
  2⤵
  PID:3232
- C:\Windows\System\eEfTTWb.exe
  C:\Windows\System\eEfTTWb.exe
  2⤵
  PID:3248
- C:\Windows\System\wHyLkHO.exe
  C:\Windows\System\wHyLkHO.exe
  2⤵
  PID:3268
- C:\Windows\System\RAqBAez.exe
  C:\Windows\System\RAqBAez.exe
  2⤵
  PID:3284
- C:\Windows\System\CmEODLa.exe
  C:\Windows\System\CmEODLa.exe
  2⤵
  PID:3304
- C:\Windows\System\QlkmbZG.exe
  C:\Windows\System\QlkmbZG.exe
  2⤵
  PID:3328
- C:\Windows\System\RraokFB.exe
  C:\Windows\System\RraokFB.exe
  2⤵
  PID:3344
- C:\Windows\System\rGWoYgy.exe
  C:\Windows\System\rGWoYgy.exe
  2⤵
  PID:3360
- C:\Windows\System\tIGzfxQ.exe
  C:\Windows\System\tIGzfxQ.exe
  2⤵
  PID:3376
- C:\Windows\System\wYjYrps.exe
  C:\Windows\System\wYjYrps.exe
  2⤵
  PID:3392
- C:\Windows\System\NVWqVPE.exe
  C:\Windows\System\NVWqVPE.exe
  2⤵
  PID:3412
- C:\Windows\System\nbDLjZU.exe
  C:\Windows\System\nbDLjZU.exe
  2⤵
  PID:3428
- C:\Windows\System\XEBSSra.exe
  C:\Windows\System\XEBSSra.exe
  2⤵
  PID:3444
- C:\Windows\System\TIIEEBX.exe
  C:\Windows\System\TIIEEBX.exe
  2⤵
  PID:3460
- C:\Windows\System\qMzDNHb.exe
  C:\Windows\System\qMzDNHb.exe
  2⤵
  PID:3476
- C:\Windows\System\DvMPWYO.exe
  C:\Windows\System\DvMPWYO.exe
  2⤵
  PID:3492
- C:\Windows\System\irEcbeB.exe
  C:\Windows\System\irEcbeB.exe
  2⤵
  PID:3508
- C:\Windows\System\rBbJQWb.exe
  C:\Windows\System\rBbJQWb.exe
  2⤵
  PID:3524
- C:\Windows\System\SkwCOht.exe
  C:\Windows\System\SkwCOht.exe
  2⤵
  PID:3544
- C:\Windows\System\IGgDXhY.exe
  C:\Windows\System\IGgDXhY.exe
  2⤵
  PID:3560
- C:\Windows\System\haTaDyJ.exe
  C:\Windows\System\haTaDyJ.exe
  2⤵
  PID:3576
- C:\Windows\System\Ixarkfr.exe
  C:\Windows\System\Ixarkfr.exe
  2⤵
  PID:3592
- C:\Windows\System\cIuVqmi.exe
  C:\Windows\System\cIuVqmi.exe
  2⤵
  PID:3692
- C:\Windows\System\TxSZRmD.exe
  C:\Windows\System\TxSZRmD.exe
  2⤵
  PID:3708
- C:\Windows\System\eaffYZC.exe
  C:\Windows\System\eaffYZC.exe
  2⤵
  PID:3756
- C:\Windows\System\rkynSVF.exe
  C:\Windows\System\rkynSVF.exe
  2⤵
  PID:3776
- C:\Windows\System\oKUHEfH.exe
  C:\Windows\System\oKUHEfH.exe
  2⤵
  PID:3792
- C:\Windows\System\JnGhgCU.exe
  C:\Windows\System\JnGhgCU.exe
  2⤵
  PID:3808
- C:\Windows\System\OnlzNIv.exe
  C:\Windows\System\OnlzNIv.exe
  2⤵
  PID:3824
- C:\Windows\System\FCtiOhg.exe
  C:\Windows\System\FCtiOhg.exe
  2⤵
  PID:3840
- C:\Windows\System\pxzHOYK.exe
  C:\Windows\System\pxzHOYK.exe
  2⤵
  PID:3856
- C:\Windows\System\FPquXnm.exe
  C:\Windows\System\FPquXnm.exe
  2⤵
  PID:3872
- C:\Windows\System\JIOJpxh.exe
  C:\Windows\System\JIOJpxh.exe
  2⤵
  PID:3892
- C:\Windows\System\gUNyqIo.exe
  C:\Windows\System\gUNyqIo.exe
  2⤵
  PID:3908
- C:\Windows\System\lSKkoBV.exe
  C:\Windows\System\lSKkoBV.exe
  2⤵
  PID:3924
- C:\Windows\System\NlgnAWo.exe
  C:\Windows\System\NlgnAWo.exe
  2⤵
  PID:3980
- C:\Windows\System\sqiIoVL.exe
  C:\Windows\System\sqiIoVL.exe
  2⤵
  PID:3996
- C:\Windows\System\cGTSikM.exe
  C:\Windows\System\cGTSikM.exe
  2⤵
  PID:4020
- C:\Windows\System\oKvPSKa.exe
  C:\Windows\System\oKvPSKa.exe
  2⤵
  PID:4036
- C:\Windows\System\cCnbnIL.exe
  C:\Windows\System\cCnbnIL.exe
  2⤵
  PID:4052
- C:\Windows\System\bgHVtKA.exe
  C:\Windows\System\bgHVtKA.exe
  2⤵
  PID:4068
- C:\Windows\System\DvRHjyS.exe
  C:\Windows\System\DvRHjyS.exe
  2⤵
  PID:4084
- C:\Windows\System\JIStWVj.exe
  C:\Windows\System\JIStWVj.exe
  2⤵
  PID:2776
- C:\Windows\System\rOakgaV.exe
  C:\Windows\System\rOakgaV.exe
  2⤵
  PID:2704
- C:\Windows\System\sxUtDXc.exe
  C:\Windows\System\sxUtDXc.exe
  2⤵
  PID:2980
- C:\Windows\System\Gucdmwd.exe
  C:\Windows\System\Gucdmwd.exe
  2⤵
  PID:2904
- C:\Windows\System\kvSaFhz.exe
  C:\Windows\System\kvSaFhz.exe
  2⤵
  PID:2512
- C:\Windows\System\dwpjMNL.exe
  C:\Windows\System\dwpjMNL.exe
  2⤵
  PID:2072
- C:\Windows\System\GhMspYM.exe
  C:\Windows\System\GhMspYM.exe
  2⤵
  PID:3104
- C:\Windows\System\lzKXdpi.exe
  C:\Windows\System\lzKXdpi.exe
  2⤵
  PID:3148
- C:\Windows\System\hsKOPzb.exe
  C:\Windows\System\hsKOPzb.exe
  2⤵
  PID:3160
- C:\Windows\System\siFKPGK.exe
  C:\Windows\System\siFKPGK.exe
  2⤵
  PID:3176
- C:\Windows\System\TKXRISZ.exe
  C:\Windows\System\TKXRISZ.exe
  2⤵
  PID:3200
- C:\Windows\System\caUnCMq.exe
  C:\Windows\System\caUnCMq.exe
  2⤵
  PID:328
- C:\Windows\System\pttRoGG.exe
  C:\Windows\System\pttRoGG.exe
  2⤵
  PID:972
- C:\Windows\System\beLkKcI.exe
  C:\Windows\System\beLkKcI.exe
  2⤵
  PID:2116
- C:\Windows\System\dmNguoP.exe
  C:\Windows\System\dmNguoP.exe
  2⤵
  PID:1600
- C:\Windows\System\Auzeqgj.exe
  C:\Windows\System\Auzeqgj.exe
  2⤵
  PID:2576
- C:\Windows\System\NNlOCgD.exe
  C:\Windows\System\NNlOCgD.exe
  2⤵
  PID:3276
- C:\Windows\System\nAbmfXY.exe
  C:\Windows\System\nAbmfXY.exe
  2⤵
  PID:2296
- C:\Windows\System\ykYCziK.exe
  C:\Windows\System\ykYCziK.exe
  2⤵
  PID:240
- C:\Windows\System\QfsuYZP.exe
  C:\Windows\System\QfsuYZP.exe
  2⤵
  PID:3324
- C:\Windows\System\lHBeEqO.exe
  C:\Windows\System\lHBeEqO.exe
  2⤵
  PID:3484
- C:\Windows\System\wxmkTMk.exe
  C:\Windows\System\wxmkTMk.exe
  2⤵
  PID:3452
- C:\Windows\System\vsGVMiC.exe
  C:\Windows\System\vsGVMiC.exe
  2⤵
  PID:3588
- C:\Windows\System\milgLEy.exe
  C:\Windows\System\milgLEy.exe
  2⤵
  PID:3264
- C:\Windows\System\WbSsUfz.exe
  C:\Windows\System\WbSsUfz.exe
  2⤵
  PID:3256
- C:\Windows\System\RnjrbXt.exe
  C:\Windows\System\RnjrbXt.exe
  2⤵
  PID:3688
- C:\Windows\System\bzzcNTx.exe
  C:\Windows\System\bzzcNTx.exe
  2⤵
  PID:2824
- C:\Windows\System\mtZKEQA.exe
  C:\Windows\System\mtZKEQA.exe
  2⤵
  PID:3608
- C:\Windows\System\nAtdWum.exe
  C:\Windows\System\nAtdWum.exe
  2⤵
  PID:3504
- C:\Windows\System\iyDhZIw.exe
  C:\Windows\System\iyDhZIw.exe
  2⤵
  PID:3672
- C:\Windows\System\GvFvCGZ.exe
  C:\Windows\System\GvFvCGZ.exe
  2⤵
  PID:3628
- C:\Windows\System\igqfBnl.exe
  C:\Windows\System\igqfBnl.exe
  2⤵
  PID:3652
- C:\Windows\System\wSkYRjl.exe
  C:\Windows\System\wSkYRjl.exe
  2⤵
  PID:3684
- C:\Windows\System\BArxHjy.exe
  C:\Windows\System\BArxHjy.exe
  2⤵
  PID:3720
- C:\Windows\System\JpFoOrE.exe
  C:\Windows\System\JpFoOrE.exe
  2⤵
  PID:3764
- C:\Windows\System\fDUPFeN.exe
  C:\Windows\System\fDUPFeN.exe
  2⤵
  PID:3904
- C:\Windows\System\vlgSoaM.exe
  C:\Windows\System\vlgSoaM.exe
  2⤵
  PID:3836
- C:\Windows\System\yfwaptr.exe
  C:\Windows\System\yfwaptr.exe
  2⤵
  PID:3944
- C:\Windows\System\klOgesa.exe
  C:\Windows\System\klOgesa.exe
  2⤵
  PID:3784
- C:\Windows\System\bmfPrsj.exe
  C:\Windows\System\bmfPrsj.exe
  2⤵
  PID:3964
- C:\Windows\System\zEZwzyZ.exe
  C:\Windows\System\zEZwzyZ.exe
  2⤵
  PID:3916
- C:\Windows\System\PQaiYKi.exe
  C:\Windows\System\PQaiYKi.exe
  2⤵
  PID:3968
- C:\Windows\System\ldscDiV.exe
  C:\Windows\System\ldscDiV.exe
  2⤵
  PID:3992
- C:\Windows\System\QnDPqVI.exe
  C:\Windows\System\QnDPqVI.exe
  2⤵
  PID:4044
- C:\Windows\System\TlUSWyB.exe
  C:\Windows\System\TlUSWyB.exe
  2⤵
  PID:4076
- C:\Windows\System\KEtCgEV.exe
  C:\Windows\System\KEtCgEV.exe
  2⤵
  PID:2996
- C:\Windows\System\cXJGOkc.exe
  C:\Windows\System\cXJGOkc.exe
  2⤵
  PID:3144
- C:\Windows\System\eJUbvQQ.exe
  C:\Windows\System\eJUbvQQ.exe
  2⤵
  PID:2204
- C:\Windows\System\TTJbTrI.exe
  C:\Windows\System\TTJbTrI.exe
  2⤵
  PID:788
- C:\Windows\System\tvPyIbl.exe
  C:\Windows\System\tvPyIbl.exe
  2⤵
  PID:3120
- C:\Windows\System\lOXMeew.exe
  C:\Windows\System\lOXMeew.exe
  2⤵
  PID:3516
- C:\Windows\System\sgOvlaJ.exe
  C:\Windows\System\sgOvlaJ.exe
  2⤵
  PID:3404
- C:\Windows\System\AOnrKjk.exe
  C:\Windows\System\AOnrKjk.exe
  2⤵
  PID:4092
- C:\Windows\System\JgqQLVL.exe
  C:\Windows\System\JgqQLVL.exe
  2⤵
  PID:3092
- C:\Windows\System\PTyrPcS.exe
  C:\Windows\System\PTyrPcS.exe
  2⤵
  PID:3204
- C:\Windows\System\TOqCibz.exe
  C:\Windows\System\TOqCibz.exe
  2⤵
  PID:3336
- C:\Windows\System\ubaBRhr.exe
  C:\Windows\System\ubaBRhr.exe
  2⤵
  PID:2224
- C:\Windows\System\tBlVoRz.exe
  C:\Windows\System\tBlVoRz.exe
  2⤵
  PID:1644
- C:\Windows\System\rrDNyad.exe
  C:\Windows\System\rrDNyad.exe
  2⤵
  PID:3532
- C:\Windows\System\AaGUSIB.exe
  C:\Windows\System\AaGUSIB.exe
  2⤵
  PID:2764
- C:\Windows\System\GUVGzYX.exe
  C:\Windows\System\GUVGzYX.exe
  2⤵
  PID:3388
- C:\Windows\System\oKikCHP.exe
  C:\Windows\System\oKikCHP.exe
  2⤵
  PID:3408
- C:\Windows\System\DkGJENi.exe
  C:\Windows\System\DkGJENi.exe
  2⤵
  PID:3648
- C:\Windows\System\BtheqQp.exe
  C:\Windows\System\BtheqQp.exe
  2⤵
  PID:3540
- C:\Windows\System\KjbJhNe.exe
  C:\Windows\System\KjbJhNe.exe
  2⤵
  PID:3880
- C:\Windows\System\mvtXrdv.exe
  C:\Windows\System\mvtXrdv.exe
  2⤵
  PID:3800
- C:\Windows\System\fgxHIiY.exe
  C:\Windows\System\fgxHIiY.exe
  2⤵
  PID:3704
- C:\Windows\System\JLEdpcn.exe
  C:\Windows\System\JLEdpcn.exe
  2⤵
  PID:3960
- C:\Windows\System\KSQGWyS.exe
  C:\Windows\System\KSQGWyS.exe
  2⤵
  PID:2332
- C:\Windows\System\RogdrMo.exe
  C:\Windows\System\RogdrMo.exe
  2⤵
  PID:3036
- C:\Windows\System\vGkOHit.exe
  C:\Windows\System\vGkOHit.exe
  2⤵
  PID:3076
- C:\Windows\System\UxFIQYa.exe
  C:\Windows\System\UxFIQYa.exe
  2⤵
  PID:3244
- C:\Windows\System\tszAdWM.exe
  C:\Windows\System\tszAdWM.exe
  2⤵
  PID:3620
- C:\Windows\System\XNkZINd.exe
  C:\Windows\System\XNkZINd.exe
  2⤵
  PID:2808
- C:\Windows\System\bSLzszh.exe
  C:\Windows\System\bSLzszh.exe
  2⤵
  PID:948
- C:\Windows\System\qYnYqvV.exe
  C:\Windows\System\qYnYqvV.exe
  2⤵
  PID:3572
- C:\Windows\System\OOuZEDx.exe
  C:\Windows\System\OOuZEDx.exe
  2⤵
  PID:4108
- C:\Windows\System\azslyxB.exe
  C:\Windows\System\azslyxB.exe
  2⤵
  PID:4124
- C:\Windows\System\aMDXRpf.exe
  C:\Windows\System\aMDXRpf.exe
  2⤵
  PID:4140
- C:\Windows\System\cpOLxiQ.exe
  C:\Windows\System\cpOLxiQ.exe
  2⤵
  PID:4156
- C:\Windows\System\maPoMlb.exe
  C:\Windows\System\maPoMlb.exe
  2⤵
  PID:4172
- C:\Windows\System\EktpqlU.exe
  C:\Windows\System\EktpqlU.exe
  2⤵
  PID:4188
- C:\Windows\System\lxjcyXe.exe
  C:\Windows\System\lxjcyXe.exe
  2⤵
  PID:4204
- C:\Windows\System\aXxGUUJ.exe
  C:\Windows\System\aXxGUUJ.exe
  2⤵
  PID:4220
- C:\Windows\System\BSynNtm.exe
  C:\Windows\System\BSynNtm.exe
  2⤵
  PID:4236
- C:\Windows\System\XXypnYk.exe
  C:\Windows\System\XXypnYk.exe
  2⤵
  PID:4252
- C:\Windows\System\HyMNsOK.exe
  C:\Windows\System\HyMNsOK.exe
  2⤵
  PID:4268
- C:\Windows\System\TZdjiIB.exe
  C:\Windows\System\TZdjiIB.exe
  2⤵
  PID:4284
- C:\Windows\System\PmXVdlK.exe
  C:\Windows\System\PmXVdlK.exe
  2⤵
  PID:4300
- C:\Windows\System\QgZMUQm.exe
  C:\Windows\System\QgZMUQm.exe
  2⤵
  PID:4316
- C:\Windows\System\gwfrGqc.exe
  C:\Windows\System\gwfrGqc.exe
  2⤵
  PID:4332
- C:\Windows\System\nsupqZr.exe
  C:\Windows\System\nsupqZr.exe
  2⤵
  PID:4348
- C:\Windows\System\vGWHCRE.exe
  C:\Windows\System\vGWHCRE.exe
  2⤵
  PID:4364
- C:\Windows\System\WAnstyv.exe
  C:\Windows\System\WAnstyv.exe
  2⤵
  PID:4380
- C:\Windows\System\aRcnqwt.exe
  C:\Windows\System\aRcnqwt.exe
  2⤵
  PID:4396
- C:\Windows\System\ZOnzlMW.exe
  C:\Windows\System\ZOnzlMW.exe
  2⤵
  PID:4412
- C:\Windows\System\mxbKvnH.exe
  C:\Windows\System\mxbKvnH.exe
  2⤵
  PID:4428
- C:\Windows\System\mckuEKP.exe
  C:\Windows\System\mckuEKP.exe
  2⤵
  PID:4444
- C:\Windows\System\prXXcZB.exe
  C:\Windows\System\prXXcZB.exe
  2⤵
  PID:4460
- C:\Windows\System\aBgWEUo.exe
  C:\Windows\System\aBgWEUo.exe
  2⤵
  PID:4476
- C:\Windows\System\uXjanSd.exe
  C:\Windows\System\uXjanSd.exe
  2⤵
  PID:4492
- C:\Windows\System\doKDbVZ.exe
  C:\Windows\System\doKDbVZ.exe
  2⤵
  PID:4508
- C:\Windows\System\mZcTzXx.exe
  C:\Windows\System\mZcTzXx.exe
  2⤵
  PID:4524
- C:\Windows\System\BQeyRcf.exe
  C:\Windows\System\BQeyRcf.exe
  2⤵
  PID:4540
- C:\Windows\System\nCyuObk.exe
  C:\Windows\System\nCyuObk.exe
  2⤵
  PID:4556
- C:\Windows\System\wZxoxUu.exe
  C:\Windows\System\wZxoxUu.exe
  2⤵
  PID:4572
- C:\Windows\System\XxTYXYl.exe
  C:\Windows\System\XxTYXYl.exe
  2⤵
  PID:4588
- C:\Windows\System\PpAqsZa.exe
  C:\Windows\System\PpAqsZa.exe
  2⤵
  PID:4604
- C:\Windows\System\zibFJNb.exe
  C:\Windows\System\zibFJNb.exe
  2⤵
  PID:4620
- C:\Windows\System\hgrwtwb.exe
  C:\Windows\System\hgrwtwb.exe
  2⤵
  PID:4636
- C:\Windows\System\BaHpmIl.exe
  C:\Windows\System\BaHpmIl.exe
  2⤵
  PID:4652
- C:\Windows\System\bColviQ.exe
  C:\Windows\System\bColviQ.exe
  2⤵
  PID:4668
- C:\Windows\System\dCZzjJX.exe
  C:\Windows\System\dCZzjJX.exe
  2⤵
  PID:4684
- C:\Windows\System\MmfvCVs.exe
  C:\Windows\System\MmfvCVs.exe
  2⤵
  PID:4708
- C:\Windows\System\wejiuXu.exe
  C:\Windows\System\wejiuXu.exe
  2⤵
  PID:4724
- C:\Windows\System\RemvZzB.exe
  C:\Windows\System\RemvZzB.exe
  2⤵
  PID:4740
- C:\Windows\System\oQSpogD.exe
  C:\Windows\System\oQSpogD.exe
  2⤵
  PID:4756
- C:\Windows\System\XyxjanX.exe
  C:\Windows\System\XyxjanX.exe
  2⤵
  PID:4772
- C:\Windows\System\tAOYqYy.exe
  C:\Windows\System\tAOYqYy.exe
  2⤵
  PID:4788
- C:\Windows\System\SuhwFNK.exe
  C:\Windows\System\SuhwFNK.exe
  2⤵
  PID:4804
- C:\Windows\System\rXHhqkL.exe
  C:\Windows\System\rXHhqkL.exe
  2⤵
  PID:4820
- C:\Windows\System\XPrSJlR.exe
  C:\Windows\System\XPrSJlR.exe
  2⤵
  PID:4840
- C:\Windows\System\fsDnmTx.exe
  C:\Windows\System\fsDnmTx.exe
  2⤵
  PID:4856
- C:\Windows\System\bTRhSAg.exe
  C:\Windows\System\bTRhSAg.exe
  2⤵
  PID:4872
- C:\Windows\System\wDtzXFV.exe
  C:\Windows\System\wDtzXFV.exe
  2⤵
  PID:4888
- C:\Windows\System\JJLAIsz.exe
  C:\Windows\System\JJLAIsz.exe
  2⤵
  PID:4908
- C:\Windows\System\DXidhBu.exe
  C:\Windows\System\DXidhBu.exe
  2⤵
  PID:4924
- C:\Windows\System\VxzLsQl.exe
  C:\Windows\System\VxzLsQl.exe
  2⤵
  PID:4940
- C:\Windows\System\eGvsaBY.exe
  C:\Windows\System\eGvsaBY.exe
  2⤵
  PID:4956
- C:\Windows\System\QifOnYW.exe
  C:\Windows\System\QifOnYW.exe
  2⤵
  PID:4972
- C:\Windows\System\oMMLEbY.exe
  C:\Windows\System\oMMLEbY.exe
  2⤵
  PID:4988
- C:\Windows\System\MOYUsfs.exe
  C:\Windows\System\MOYUsfs.exe
  2⤵
  PID:5004
- C:\Windows\System\uSkrvqE.exe
  C:\Windows\System\uSkrvqE.exe
  2⤵
  PID:5020
- C:\Windows\System\bCpIBVe.exe
  C:\Windows\System\bCpIBVe.exe
  2⤵
  PID:5036
- C:\Windows\System\iuAnfxb.exe
  C:\Windows\System\iuAnfxb.exe
  2⤵
  PID:5056
- C:\Windows\System\UIKOeNK.exe
  C:\Windows\System\UIKOeNK.exe
  2⤵
  PID:5072
- C:\Windows\System\EIAqkyU.exe
  C:\Windows\System\EIAqkyU.exe
  2⤵
  PID:5088
- C:\Windows\System\Ebrbvpm.exe
  C:\Windows\System\Ebrbvpm.exe
  2⤵
  PID:5104
- C:\Windows\System\XOlRfDJ.exe
  C:\Windows\System\XOlRfDJ.exe
  2⤵
  PID:4152
- C:\Windows\System\iVmivbv.exe
  C:\Windows\System\iVmivbv.exe
  2⤵
  PID:3312
- C:\Windows\System\BXhPXMX.exe
  C:\Windows\System\BXhPXMX.exe
  2⤵
  PID:4212
- C:\Windows\System\SpyMedF.exe
  C:\Windows\System\SpyMedF.exe
  2⤵
  PID:4248
- C:\Windows\System\vIBhZHM.exe
  C:\Windows\System\vIBhZHM.exe
  2⤵
  PID:3668
- C:\Windows\System\whXdbni.exe
  C:\Windows\System\whXdbni.exe
  2⤵
  PID:3172
- C:\Windows\System\lVuVqbB.exe
  C:\Windows\System\lVuVqbB.exe
  2⤵
  PID:4312
- C:\Windows\System\YSEAOLa.exe
  C:\Windows\System\YSEAOLa.exe
  2⤵
  PID:4440
- C:\Windows\System\lwvLUjW.exe
  C:\Windows\System\lwvLUjW.exe
  2⤵
  PID:4532
- C:\Windows\System\IpGatQN.exe
  C:\Windows\System\IpGatQN.exe
  2⤵
  PID:4564
- C:\Windows\System\NmORtub.exe
  C:\Windows\System\NmORtub.exe
  2⤵
  PID:4632
- C:\Windows\System\HZbXRSN.exe
  C:\Windows\System\HZbXRSN.exe
  2⤵
  PID:4696
- C:\Windows\System\aaSQeyt.exe
  C:\Windows\System\aaSQeyt.exe
  2⤵
  PID:4164
- C:\Windows\System\VAPQhoU.exe
  C:\Windows\System\VAPQhoU.exe
  2⤵
  PID:3616
- C:\Windows\System\sXfhoHL.exe
  C:\Windows\System\sXfhoHL.exe
  2⤵
  PID:4328
- C:\Windows\System\CLnNJWQ.exe
  C:\Windows\System\CLnNJWQ.exe
  2⤵
  PID:3436
- C:\Windows\System\XxiYSgL.exe
  C:\Windows\System\XxiYSgL.exe
  2⤵
  PID:4452
- C:\Windows\System\QNfAVCt.exe
  C:\Windows\System\QNfAVCt.exe
  2⤵
  PID:3976
- C:\Windows\System\gVhjmrt.exe
  C:\Windows\System\gVhjmrt.exe
  2⤵
  PID:4520
- C:\Windows\System\culctzB.exe
  C:\Windows\System\culctzB.exe
  2⤵
  PID:812
- C:\Windows\System\RJzWPyG.exe
  C:\Windows\System\RJzWPyG.exe
  2⤵
  PID:3884
- C:\Windows\System\pcWohIM.exe
  C:\Windows\System\pcWohIM.exe
  2⤵
  PID:4132
- C:\Windows\System\AitwSsA.exe
  C:\Windows\System\AitwSsA.exe
  2⤵
  PID:4200
- C:\Windows\System\CXkvKFx.exe
  C:\Windows\System\CXkvKFx.exe
  2⤵
  PID:4264
- C:\Windows\System\ypoXepn.exe
  C:\Windows\System\ypoXepn.exe
  2⤵
  PID:4360
- C:\Windows\System\cZwJtue.exe
  C:\Windows\System\cZwJtue.exe
  2⤵
  PID:4424
- C:\Windows\System\WhAQJSV.exe
  C:\Windows\System\WhAQJSV.exe
  2⤵
  PID:4516
- C:\Windows\System\dNiVVfW.exe
  C:\Windows\System\dNiVVfW.exe
  2⤵
  PID:4584
- C:\Windows\System\vYWexim.exe
  C:\Windows\System\vYWexim.exe
  2⤵
  PID:4648
- C:\Windows\System\PzaACTH.exe
  C:\Windows\System\PzaACTH.exe
  2⤵
  PID:3936
- C:\Windows\System\xuEzdao.exe
  C:\Windows\System\xuEzdao.exe
  2⤵
  PID:1492
- C:\Windows\System\uAwWYyM.exe
  C:\Windows\System\uAwWYyM.exe
  2⤵
  PID:4704
- C:\Windows\System\iOVGKxR.exe
  C:\Windows\System\iOVGKxR.exe
  2⤵
  PID:4764
- C:\Windows\System\BsdVMBL.exe
  C:\Windows\System\BsdVMBL.exe
  2⤵
  PID:1824
- C:\Windows\System\IspVIHO.exe
  C:\Windows\System\IspVIHO.exe
  2⤵
  PID:1796
- C:\Windows\System\CMiQLoq.exe
  C:\Windows\System\CMiQLoq.exe
  2⤵
  PID:4900
- C:\Windows\System\hzRzOUY.exe
  C:\Windows\System\hzRzOUY.exe
  2⤵
  PID:1132
- C:\Windows\System\IErAvSP.exe
  C:\Windows\System\IErAvSP.exe
  2⤵
  PID:4996
- C:\Windows\System\OxGKVvw.exe
  C:\Windows\System\OxGKVvw.exe
  2⤵
  PID:5068
- C:\Windows\System\xLIYlXp.exe
  C:\Windows\System\xLIYlXp.exe
  2⤵
  PID:4884
- C:\Windows\System\siZKKOE.exe
  C:\Windows\System\siZKKOE.exe
  2⤵
  PID:4720
- C:\Windows\System\eRXnKOO.exe
  C:\Windows\System\eRXnKOO.exe
  2⤵
  PID:4784
- C:\Windows\System\RymsOkK.exe
  C:\Windows\System\RymsOkK.exe
  2⤵
  PID:4916
- C:\Windows\System\VRNQors.exe
  C:\Windows\System\VRNQors.exe
  2⤵
  PID:5012
- C:\Windows\System\ZcmhfFI.exe
  C:\Windows\System\ZcmhfFI.exe
  2⤵
  PID:5052
- C:\Windows\System\flSnvBi.exe
  C:\Windows\System\flSnvBi.exe
  2⤵
  PID:3420
- C:\Windows\System\WpPCBhh.exe
  C:\Windows\System\WpPCBhh.exe
  2⤵
  PID:4216
- C:\Windows\System\JQxrTdx.exe
  C:\Windows\System\JQxrTdx.exe
  2⤵
  PID:3868
- C:\Windows\System\IapXiJQ.exe
  C:\Windows\System\IapXiJQ.exe
  2⤵
  PID:4344
- C:\Windows\System\hIkWgtB.exe
  C:\Windows\System\hIkWgtB.exe
  2⤵
  PID:4404
- C:\Windows\System\bmTSLIC.exe
  C:\Windows\System\bmTSLIC.exe
  2⤵
  PID:4468
- C:\Windows\System\PySpNMo.exe
  C:\Windows\System\PySpNMo.exe
  2⤵
  PID:4436
- C:\Windows\System\aJZcKKM.exe
  C:\Windows\System\aJZcKKM.exe
  2⤵
  PID:4692
- C:\Windows\System\OVzKlzw.exe
  C:\Windows\System\OVzKlzw.exe
  2⤵
  PID:3356
- C:\Windows\System\YrQIHPL.exe
  C:\Windows\System\YrQIHPL.exe
  2⤵
  PID:968
- C:\Windows\System\uYCgcXg.exe
  C:\Windows\System\uYCgcXg.exe
  2⤵
  PID:3952
- C:\Windows\System\tBakHzU.exe
  C:\Windows\System\tBakHzU.exe
  2⤵
  PID:4100
- C:\Windows\System\VLsOlgT.exe
  C:\Windows\System\VLsOlgT.exe
  2⤵
  PID:4392
- C:\Windows\System\WivJWNn.exe
  C:\Windows\System\WivJWNn.exe
  2⤵
  PID:4800
- C:\Windows\System\erUiCkb.exe
  C:\Windows\System\erUiCkb.exe
  2⤵
  PID:3224
- C:\Windows\System\kIEUnJr.exe
  C:\Windows\System\kIEUnJr.exe
  2⤵
  PID:4616
- C:\Windows\System\FLCCeZz.exe
  C:\Windows\System\FLCCeZz.exe
  2⤵
  PID:4196
- C:\Windows\System\LuyXBTJ.exe
  C:\Windows\System\LuyXBTJ.exe
  2⤵
  PID:4484
- C:\Windows\System\Zshtmlt.exe
  C:\Windows\System\Zshtmlt.exe
  2⤵
  PID:4984
- C:\Windows\System\FrCmGWl.exe
  C:\Windows\System\FrCmGWl.exe
  2⤵
  PID:4816
- C:\Windows\System\SYdOhza.exe
  C:\Windows\System\SYdOhza.exe
  2⤵
  PID:2444
- C:\Windows\System\BdBipHm.exe
  C:\Windows\System\BdBipHm.exe
  2⤵
  PID:4116
- C:\Windows\System\EEfpQIF.exe
  C:\Windows\System\EEfpQIF.exe
  2⤵
  PID:2104
- C:\Windows\System\uLgreWs.exe
  C:\Windows\System\uLgreWs.exe
  2⤵
  PID:4836
- C:\Windows\System\vJfBADT.exe
  C:\Windows\System\vJfBADT.exe
  2⤵
  PID:4952
- C:\Windows\System\sWZSqRx.exe
  C:\Windows\System\sWZSqRx.exe
  2⤵
  PID:5112
- C:\Windows\System\nKnKLeG.exe
  C:\Windows\System\nKnKLeG.exe
  2⤵
  PID:3240
- C:\Windows\System\KCqIJqR.exe
  C:\Windows\System\KCqIJqR.exe
  2⤵
  PID:1932
- C:\Windows\System\IOPBrtk.exe
  C:\Windows\System\IOPBrtk.exe
  2⤵
  PID:3260
- C:\Windows\System\zfwxMVs.exe
  C:\Windows\System\zfwxMVs.exe
  2⤵
  PID:4936
- C:\Windows\System\hoXance.exe
  C:\Windows\System\hoXance.exe
  2⤵
  PID:5080
- C:\Windows\System\EVsPhza.exe
  C:\Windows\System\EVsPhza.exe
  2⤵
  PID:4180
- C:\Windows\System\FJzGmBr.exe
  C:\Windows\System\FJzGmBr.exe
  2⤵
  PID:4660
- C:\Windows\System\PSvNXmK.exe
  C:\Windows\System\PSvNXmK.exe
  2⤵
  PID:4880
- C:\Windows\System\IZJaQlJ.exe
  C:\Windows\System\IZJaQlJ.exe
  2⤵
  PID:4628
- C:\Windows\System\XnLjhAy.exe
  C:\Windows\System\XnLjhAy.exe
  2⤵
  PID:4080
- C:\Windows\System\jMYziHJ.exe
  C:\Windows\System\jMYziHJ.exe
  2⤵
  PID:4768
- C:\Windows\System\esjFFcL.exe
  C:\Windows\System\esjFFcL.exe
  2⤵
  PID:4600
- C:\Windows\System\qNVvHWs.exe
  C:\Windows\System\qNVvHWs.exe
  2⤵
  PID:5124
- C:\Windows\System\InPJKkh.exe
  C:\Windows\System\InPJKkh.exe
  2⤵
  PID:5140
- C:\Windows\System\rCPUQWt.exe
  C:\Windows\System\rCPUQWt.exe
  2⤵
  PID:5156
- C:\Windows\System\cWgJeKD.exe
  C:\Windows\System\cWgJeKD.exe
  2⤵
  PID:5172
- C:\Windows\System\VklLWZu.exe
  C:\Windows\System\VklLWZu.exe
  2⤵
  PID:5188
- C:\Windows\System\coiqPkl.exe
  C:\Windows\System\coiqPkl.exe
  2⤵
  PID:5204
- C:\Windows\System\VAsAKZv.exe
  C:\Windows\System\VAsAKZv.exe
  2⤵
  PID:5220
- C:\Windows\System\TfcbCUy.exe
  C:\Windows\System\TfcbCUy.exe
  2⤵
  PID:5236
- C:\Windows\System\jjQtZEI.exe
  C:\Windows\System\jjQtZEI.exe
  2⤵
  PID:5252
- C:\Windows\System\yKUhhum.exe
  C:\Windows\System\yKUhhum.exe
  2⤵
  PID:5268
- C:\Windows\System\TCFaDgE.exe
  C:\Windows\System\TCFaDgE.exe
  2⤵
  PID:5284
- C:\Windows\System\kipMCVD.exe
  C:\Windows\System\kipMCVD.exe
  2⤵
  PID:5300
- C:\Windows\System\OGvjMIE.exe
  C:\Windows\System\OGvjMIE.exe
  2⤵
  PID:5316
- C:\Windows\System\CHglYNW.exe
  C:\Windows\System\CHglYNW.exe
  2⤵
  PID:5332
- C:\Windows\System\CfGoQhN.exe
  C:\Windows\System\CfGoQhN.exe
  2⤵
  PID:5348
- C:\Windows\System\qvtTODk.exe
  C:\Windows\System\qvtTODk.exe
  2⤵
  PID:5364
- C:\Windows\System\clkRPqM.exe
  C:\Windows\System\clkRPqM.exe
  2⤵
  PID:5380
- C:\Windows\System\wIIFghB.exe
  C:\Windows\System\wIIFghB.exe
  2⤵
  PID:5396
- C:\Windows\System\DrssdhH.exe
  C:\Windows\System\DrssdhH.exe
  2⤵
  PID:5412
- C:\Windows\System\aeHZzCA.exe
  C:\Windows\System\aeHZzCA.exe
  2⤵
  PID:5428
- C:\Windows\System\erwEsHI.exe
  C:\Windows\System\erwEsHI.exe
  2⤵
  PID:5444
- C:\Windows\System\tYdgwgW.exe
  C:\Windows\System\tYdgwgW.exe
  2⤵
  PID:5460
- C:\Windows\System\uEkyNda.exe
  C:\Windows\System\uEkyNda.exe
  2⤵
  PID:5476
- C:\Windows\System\vhZdnvF.exe
  C:\Windows\System\vhZdnvF.exe
  2⤵
  PID:5492
- C:\Windows\System\xkkeyBZ.exe
  C:\Windows\System\xkkeyBZ.exe
  2⤵
  PID:5508
- C:\Windows\System\lCvCEKQ.exe
  C:\Windows\System\lCvCEKQ.exe
  2⤵
  PID:5524
- C:\Windows\System\xOZRsAp.exe
  C:\Windows\System\xOZRsAp.exe
  2⤵
  PID:5540
- C:\Windows\System\lqcVWuh.exe
  C:\Windows\System\lqcVWuh.exe
  2⤵
  PID:5556
- C:\Windows\System\yjfHeeG.exe
  C:\Windows\System\yjfHeeG.exe
  2⤵
  PID:5572
- C:\Windows\System\ClphUTL.exe
  C:\Windows\System\ClphUTL.exe
  2⤵
  PID:5588
- C:\Windows\System\aXTbXvs.exe
  C:\Windows\System\aXTbXvs.exe
  2⤵
  PID:5604
- C:\Windows\System\gtUaBSA.exe
  C:\Windows\System\gtUaBSA.exe
  2⤵
  PID:5620
- C:\Windows\System\GbbIMHF.exe
  C:\Windows\System\GbbIMHF.exe
  2⤵
  PID:5636
- C:\Windows\System\rBpnxbF.exe
  C:\Windows\System\rBpnxbF.exe
  2⤵
  PID:5652
- C:\Windows\System\kCJetpU.exe
  C:\Windows\System\kCJetpU.exe
  2⤵
  PID:5668
- C:\Windows\System\WaNTqBh.exe
  C:\Windows\System\WaNTqBh.exe
  2⤵
  PID:5684
- C:\Windows\System\rcVCuHs.exe
  C:\Windows\System\rcVCuHs.exe
  2⤵
  PID:5700
- C:\Windows\System\gClnJBA.exe
  C:\Windows\System\gClnJBA.exe
  2⤵
  PID:5716
- C:\Windows\System\iPcFPJU.exe
  C:\Windows\System\iPcFPJU.exe
  2⤵
  PID:5732
- C:\Windows\System\AzjuVrO.exe
  C:\Windows\System\AzjuVrO.exe
  2⤵
  PID:5748
- C:\Windows\System\eOJQyzp.exe
  C:\Windows\System\eOJQyzp.exe
  2⤵
  PID:5764
- C:\Windows\System\WyAlZVG.exe
  C:\Windows\System\WyAlZVG.exe
  2⤵
  PID:5780
- C:\Windows\System\PavceQX.exe
  C:\Windows\System\PavceQX.exe
  2⤵
  PID:5796
- C:\Windows\System\EmHPKUR.exe
  C:\Windows\System\EmHPKUR.exe
  2⤵
  PID:5812
- C:\Windows\System\dHhqmne.exe
  C:\Windows\System\dHhqmne.exe
  2⤵
  PID:5828
- C:\Windows\System\vtAYrDq.exe
  C:\Windows\System\vtAYrDq.exe
  2⤵
  PID:5844
- C:\Windows\System\JRZbMgQ.exe
  C:\Windows\System\JRZbMgQ.exe
  2⤵
  PID:5860
- C:\Windows\System\dskiiQp.exe
  C:\Windows\System\dskiiQp.exe
  2⤵
  PID:5876
- C:\Windows\System\WPVPyVG.exe
  C:\Windows\System\WPVPyVG.exe
  2⤵
  PID:5892
- C:\Windows\System\NZOZoBi.exe
  C:\Windows\System\NZOZoBi.exe
  2⤵
  PID:5908
- C:\Windows\System\GydmQBx.exe
  C:\Windows\System\GydmQBx.exe
  2⤵
  PID:5924
- C:\Windows\System\pSkbfQs.exe
  C:\Windows\System\pSkbfQs.exe
  2⤵
  PID:5940
- C:\Windows\System\mCpwFNI.exe
  C:\Windows\System\mCpwFNI.exe
  2⤵
  PID:5956
- C:\Windows\System\EeXSdfC.exe
  C:\Windows\System\EeXSdfC.exe
  2⤵
  PID:5972
- C:\Windows\System\AOsYWSB.exe
  C:\Windows\System\AOsYWSB.exe
  2⤵
  PID:5988
- C:\Windows\System\mssLjfR.exe
  C:\Windows\System\mssLjfR.exe
  2⤵
  PID:6004
- C:\Windows\System\zcdkEvO.exe
  C:\Windows\System\zcdkEvO.exe
  2⤵
  PID:6020
- C:\Windows\System\trGClhl.exe
  C:\Windows\System\trGClhl.exe
  2⤵
  PID:6036
- C:\Windows\System\BRxynyv.exe
  C:\Windows\System\BRxynyv.exe
  2⤵
  PID:6052
- C:\Windows\System\dlUBohv.exe
  C:\Windows\System\dlUBohv.exe
  2⤵
  PID:6068
- C:\Windows\System\YCvqzos.exe
  C:\Windows\System\YCvqzos.exe
  2⤵
  PID:6084
- C:\Windows\System\USycTyW.exe
  C:\Windows\System\USycTyW.exe
  2⤵
  PID:6100
- C:\Windows\System\SDRpvZA.exe
  C:\Windows\System\SDRpvZA.exe
  2⤵
  PID:6116
- C:\Windows\System\FUWUvrl.exe
  C:\Windows\System\FUWUvrl.exe
  2⤵
  PID:6136
- C:\Windows\System\eQAKNwO.exe
  C:\Windows\System\eQAKNwO.exe
  2⤵
  PID:4408
- C:\Windows\System\xRqsVUr.exe
  C:\Windows\System\xRqsVUr.exe
  2⤵
  PID:4644
- C:\Windows\System\RtOkNvP.exe
  C:\Windows\System\RtOkNvP.exe
  2⤵
  PID:4680
- C:\Windows\System\olTunwc.exe
  C:\Windows\System\olTunwc.exe
  2⤵
  PID:5184
- C:\Windows\System\nYmjDOR.exe
  C:\Windows\System\nYmjDOR.exe
  2⤵
  PID:4596
- C:\Windows\System\EYjaDqH.exe
  C:\Windows\System\EYjaDqH.exe
  2⤵
  PID:5248
- C:\Windows\System\FZAqwMp.exe
  C:\Windows\System\FZAqwMp.exe
  2⤵
  PID:5372
- C:\Windows\System\BntQypn.exe
  C:\Windows\System\BntQypn.exe
  2⤵
  PID:5408
- C:\Windows\System\BuMfZMi.exe
  C:\Windows\System\BuMfZMi.exe
  2⤵
  PID:4232
- C:\Windows\System\hvTMFDP.exe
  C:\Windows\System\hvTMFDP.exe
  2⤵
  PID:5132
- C:\Windows\System\EiWTWMc.exe
  C:\Windows\System\EiWTWMc.exe
  2⤵
  PID:5232
- C:\Windows\System\tAXVMEQ.exe
  C:\Windows\System\tAXVMEQ.exe
  2⤵
  PID:5360
- C:\Windows\System\xmaVdgH.exe
  C:\Windows\System\xmaVdgH.exe
  2⤵
  PID:3316
- C:\Windows\System\PxSCFju.exe
  C:\Windows\System\PxSCFju.exe
  2⤵
  PID:5228
- C:\Windows\System\HQEiCTq.exe
  C:\Windows\System\HQEiCTq.exe
  2⤵
  PID:5356
- C:\Windows\System\iijvDWz.exe
  C:\Windows\System\iijvDWz.exe
  2⤵
  PID:5452
- C:\Windows\System\LWAIyCj.exe
  C:\Windows\System\LWAIyCj.exe
  2⤵
  PID:5536
- C:\Windows\System\CDHrSKA.exe
  C:\Windows\System\CDHrSKA.exe
  2⤵
  PID:5484
- C:\Windows\System\vaCnHLC.exe
  C:\Windows\System\vaCnHLC.exe
  2⤵
  PID:5628
- C:\Windows\System\hZUEWtR.exe
  C:\Windows\System\hZUEWtR.exe
  2⤵
  PID:5692
- C:\Windows\System\mGpgtmu.exe
  C:\Windows\System\mGpgtmu.exe
  2⤵
  PID:5728
- C:\Windows\System\gJbvyYM.exe
  C:\Windows\System\gJbvyYM.exe
  2⤵
  PID:5584
- C:\Windows\System\FBaNNoU.exe
  C:\Windows\System\FBaNNoU.exe
  2⤵
  PID:5644
- C:\Windows\System\bgaHLtA.exe
  C:\Windows\System\bgaHLtA.exe
  2⤵
  PID:5708
- C:\Windows\System\KoNKyOa.exe
  C:\Windows\System\KoNKyOa.exe
  2⤵
  PID:5760
- C:\Windows\System\AvrGbEq.exe
  C:\Windows\System\AvrGbEq.exe
  2⤵
  PID:5820
- C:\Windows\System\cziLMKE.exe
  C:\Windows\System\cziLMKE.exe
  2⤵
  PID:5920
- C:\Windows\System\TCApjUM.exe
  C:\Windows\System\TCApjUM.exe
  2⤵
  PID:5804
- C:\Windows\System\OJNLffy.exe
  C:\Windows\System\OJNLffy.exe
  2⤵
  PID:5840
- C:\Windows\System\GkDACLq.exe
  C:\Windows\System\GkDACLq.exe
  2⤵
  PID:5900
- C:\Windows\System\qVfzXJh.exe
  C:\Windows\System\qVfzXJh.exe
  2⤵
  PID:6000
- C:\Windows\System\WCmozym.exe
  C:\Windows\System\WCmozym.exe
  2⤵
  PID:6064
- C:\Windows\System\GZHJwgR.exe
  C:\Windows\System\GZHJwgR.exe
  2⤵
  PID:6124
- C:\Windows\System\wvQFNIj.exe
  C:\Windows\System\wvQFNIj.exe
  2⤵
  PID:4828
- C:\Windows\System\nDKjgRn.exe
  C:\Windows\System\nDKjgRn.exe
  2⤵
  PID:5884
- C:\Windows\System\EcGVdfF.exe
  C:\Windows\System\EcGVdfF.exe
  2⤵
  PID:5980
- C:\Windows\System\asYsBoS.exe
  C:\Windows\System\asYsBoS.exe
  2⤵
  PID:6044
- C:\Windows\System\MAjYbiA.exe
  C:\Windows\System\MAjYbiA.exe
  2⤵
  PID:6108
- C:\Windows\System\iGUSCrQ.exe
  C:\Windows\System\iGUSCrQ.exe
  2⤵
  PID:5312
- C:\Windows\System\CFSIzzx.exe
  C:\Windows\System\CFSIzzx.exe
  2⤵
  PID:4260
- C:\Windows\System\nRtRpHD.exe
  C:\Windows\System\nRtRpHD.exe
  2⤵
  PID:5196
- C:\Windows\System\iNFVwOy.exe
  C:\Windows\System\iNFVwOy.exe
  2⤵
  PID:5292
- C:\Windows\System\meLDZFj.exe
  C:\Windows\System\meLDZFj.exe
  2⤵
  PID:5600
- C:\Windows\System\FuJchyz.exe
  C:\Windows\System\FuJchyz.exe
  2⤵
  PID:5712
- C:\Windows\System\ohsngci.exe
  C:\Windows\System\ohsngci.exe
  2⤵
  PID:2604
- C:\Windows\System\jjdvIXm.exe
  C:\Windows\System\jjdvIXm.exe
  2⤵
  PID:5376
- C:\Windows\System\DqszlyU.exe
  C:\Windows\System\DqszlyU.exe
  2⤵
  PID:5136
- C:\Windows\System\PQJFnkI.exe
  C:\Windows\System\PQJFnkI.exe
  2⤵
  PID:5276
- C:\Windows\System\SDajnhf.exe
  C:\Windows\System\SDajnhf.exe
  2⤵
  PID:5436
- C:\Windows\System\rlZjrJO.exe
  C:\Windows\System\rlZjrJO.exe
  2⤵
  PID:4716
- C:\Windows\System\irwtXWv.exe
  C:\Windows\System\irwtXWv.exe
  2⤵
  PID:5420
- C:\Windows\System\qRzgpIU.exe
  C:\Windows\System\qRzgpIU.exe
  2⤵
  PID:5664
- C:\Windows\System\jDgKxdl.exe
  C:\Windows\System\jDgKxdl.exe
  2⤵
  PID:5680
- C:\Windows\System\PeyqYXq.exe
  C:\Windows\System\PeyqYXq.exe
  2⤵
  PID:3988
- C:\Windows\System\XBlDWIn.exe
  C:\Windows\System\XBlDWIn.exe
  2⤵
  PID:6012
- C:\Windows\System\iSiWMAO.exe
  C:\Windows\System\iSiWMAO.exe
  2⤵
  PID:5468
- C:\Windows\System\eARiUaL.exe
  C:\Windows\System\eARiUaL.exe
  2⤵
  PID:6032
- C:\Windows\System\aPVIWvq.exe
  C:\Windows\System\aPVIWvq.exe
  2⤵
  PID:6132
- C:\Windows\System\PTFozBu.exe
  C:\Windows\System\PTFozBu.exe
  2⤵
  PID:1124
- C:\Windows\System\HuBYGxf.exe
  C:\Windows\System\HuBYGxf.exe
  2⤵
  PID:1976
- C:\Windows\System\wSVakUR.exe
  C:\Windows\System\wSVakUR.exe
  2⤵
  PID:5096
- C:\Windows\System\uSTKpUN.exe
  C:\Windows\System\uSTKpUN.exe
  2⤵
  PID:5168
- C:\Windows\System\QonbaIM.exe
  C:\Windows\System\QonbaIM.exe
  2⤵
  PID:5516
- C:\Windows\System\NBcAkdT.exe
  C:\Windows\System\NBcAkdT.exe
  2⤵
  PID:5964
- C:\Windows\System\XMkHhUZ.exe
  C:\Windows\System\XMkHhUZ.exe
  2⤵
  PID:5996
- C:\Windows\System\iwieiMm.exe
  C:\Windows\System\iwieiMm.exe
  2⤵
  PID:5216
- C:\Windows\System\NNTDufx.exe
  C:\Windows\System\NNTDufx.exe
  2⤵
  PID:5772
- C:\Windows\System\qjmONzr.exe
  C:\Windows\System\qjmONzr.exe
  2⤵
  PID:5488
- C:\Windows\System\AfDuwDG.exe
  C:\Windows\System\AfDuwDG.exe
  2⤵
  PID:5308
- C:\Windows\System\gkxPaTB.exe
  C:\Windows\System\gkxPaTB.exe
  2⤵
  PID:5580
- C:\Windows\System\RVobcQZ.exe
  C:\Windows\System\RVobcQZ.exe
  2⤵
  PID:4968
- C:\Windows\System\sDBHSYt.exe
  C:\Windows\System\sDBHSYt.exe
  2⤵
  PID:5456
- C:\Windows\System\FCSeUKQ.exe
  C:\Windows\System\FCSeUKQ.exe
  2⤵
  PID:5724
- C:\Windows\System\EuFSKQr.exe
  C:\Windows\System\EuFSKQr.exe
  2⤵
  PID:5552
- C:\Windows\System\OvsRVHl.exe
  C:\Windows\System\OvsRVHl.exe
  2⤵
  PID:1596
- C:\Windows\System\RwpRfMD.exe
  C:\Windows\System\RwpRfMD.exe
  2⤵
  PID:5440
- C:\Windows\System\kypRPwT.exe
  C:\Windows\System\kypRPwT.exe
  2⤵
  PID:6148
- C:\Windows\System\qMxUpkW.exe
  C:\Windows\System\qMxUpkW.exe
  2⤵
  PID:6164
- C:\Windows\System\irJkxdt.exe
  C:\Windows\System\irJkxdt.exe
  2⤵
  PID:6180
- C:\Windows\System\SWrYbcC.exe
  C:\Windows\System\SWrYbcC.exe
  2⤵
  PID:6196
- C:\Windows\System\HJShsWK.exe
  C:\Windows\System\HJShsWK.exe
  2⤵
  PID:6212
- C:\Windows\System\bsRYCwB.exe
  C:\Windows\System\bsRYCwB.exe
  2⤵
  PID:6228
- C:\Windows\System\oGnDIDu.exe
  C:\Windows\System\oGnDIDu.exe
  2⤵
  PID:6244
- C:\Windows\System\wDVWHNF.exe
  C:\Windows\System\wDVWHNF.exe
  2⤵
  PID:6260
- C:\Windows\System\VDibLXR.exe
  C:\Windows\System\VDibLXR.exe
  2⤵
  PID:6276
- C:\Windows\System\IMDYHPy.exe
  C:\Windows\System\IMDYHPy.exe
  2⤵
  PID:6292
- C:\Windows\System\chrDVFg.exe
  C:\Windows\System\chrDVFg.exe
  2⤵
  PID:6308
- C:\Windows\System\fQxHadH.exe
  C:\Windows\System\fQxHadH.exe
  2⤵
  PID:6324
- C:\Windows\System\wVYsSqf.exe
  C:\Windows\System\wVYsSqf.exe
  2⤵
  PID:6340
- C:\Windows\System\OHoSKOK.exe
  C:\Windows\System\OHoSKOK.exe
  2⤵
  PID:6356
- C:\Windows\System\pZWYjis.exe
  C:\Windows\System\pZWYjis.exe
  2⤵
  PID:6372
- C:\Windows\System\QctMJWc.exe
  C:\Windows\System\QctMJWc.exe
  2⤵
  PID:6388
- C:\Windows\System\yGbTkKc.exe
  C:\Windows\System\yGbTkKc.exe
  2⤵
  PID:6404
- C:\Windows\System\XIjJHmS.exe
  C:\Windows\System\XIjJHmS.exe
  2⤵
  PID:6420
- C:\Windows\System\WdKLggc.exe
  C:\Windows\System\WdKLggc.exe
  2⤵
  PID:6436
- C:\Windows\System\pTrYomo.exe
  C:\Windows\System\pTrYomo.exe
  2⤵
  PID:6452
- C:\Windows\System\MbMPyEm.exe
  C:\Windows\System\MbMPyEm.exe
  2⤵
  PID:6468
- C:\Windows\System\NgMzOqE.exe
  C:\Windows\System\NgMzOqE.exe
  2⤵
  PID:6484
- C:\Windows\System\LBUjXkb.exe
  C:\Windows\System\LBUjXkb.exe
  2⤵
  PID:6500
- C:\Windows\System\sRLYWeX.exe
  C:\Windows\System\sRLYWeX.exe
  2⤵
  PID:6516
- C:\Windows\System\NxDGFyy.exe
  C:\Windows\System\NxDGFyy.exe
  2⤵
  PID:6532
- C:\Windows\System\NLSmbas.exe
  C:\Windows\System\NLSmbas.exe
  2⤵
  PID:6548
- C:\Windows\System\JjUsehl.exe
  C:\Windows\System\JjUsehl.exe
  2⤵
  PID:6564
- C:\Windows\System\STWbAWR.exe
  C:\Windows\System\STWbAWR.exe
  2⤵
  PID:6580
- C:\Windows\System\iEybUvV.exe
  C:\Windows\System\iEybUvV.exe
  2⤵
  PID:6596
- C:\Windows\System\iQNhogd.exe
  C:\Windows\System\iQNhogd.exe
  2⤵
  PID:6612
- C:\Windows\System\TXpQUpk.exe
  C:\Windows\System\TXpQUpk.exe
  2⤵
  PID:6628
- C:\Windows\System\JjzUYMP.exe
  C:\Windows\System\JjzUYMP.exe
  2⤵
  PID:6644
- C:\Windows\System\aNTsLjf.exe
  C:\Windows\System\aNTsLjf.exe
  2⤵
  PID:6660
- C:\Windows\System\cCcdwpD.exe
  C:\Windows\System\cCcdwpD.exe
  2⤵
  PID:6676
- C:\Windows\System\sJQfOMa.exe
  C:\Windows\System\sJQfOMa.exe
  2⤵
  PID:6692
- C:\Windows\System\PIlVuzD.exe
  C:\Windows\System\PIlVuzD.exe
  2⤵
  PID:6708
- C:\Windows\System\SbRtDcM.exe
  C:\Windows\System\SbRtDcM.exe
  2⤵
  PID:6724
- C:\Windows\System\ToMonRJ.exe
  C:\Windows\System\ToMonRJ.exe
  2⤵
  PID:6740
- C:\Windows\System\DiWatZV.exe
  C:\Windows\System\DiWatZV.exe
  2⤵
  PID:6756
- C:\Windows\System\armMcIT.exe
  C:\Windows\System\armMcIT.exe
  2⤵
  PID:6772
- C:\Windows\System\oonnxaH.exe
  C:\Windows\System\oonnxaH.exe
  2⤵
  PID:6788
- C:\Windows\System\fnQQidu.exe
  C:\Windows\System\fnQQidu.exe
  2⤵
  PID:6804
- C:\Windows\System\gajKbKY.exe
  C:\Windows\System\gajKbKY.exe
  2⤵
  PID:6820
- C:\Windows\System\DcanJnL.exe
  C:\Windows\System\DcanJnL.exe
  2⤵
  PID:6836
- C:\Windows\System\PNDbjLx.exe
  C:\Windows\System\PNDbjLx.exe
  2⤵
  PID:6852
- C:\Windows\System\puXVYBx.exe
  C:\Windows\System\puXVYBx.exe
  2⤵
  PID:6868
- C:\Windows\System\SxIPuGS.exe
  C:\Windows\System\SxIPuGS.exe
  2⤵
  PID:6884
- C:\Windows\System\LxWvdig.exe
  C:\Windows\System\LxWvdig.exe
  2⤵
  PID:6900
- C:\Windows\System\XkgNOAE.exe
  C:\Windows\System\XkgNOAE.exe
  2⤵
  PID:6916
- C:\Windows\System\NSqRxsx.exe
  C:\Windows\System\NSqRxsx.exe
  2⤵
  PID:6932
- C:\Windows\System\JTNliXa.exe
  C:\Windows\System\JTNliXa.exe
  2⤵
  PID:6948
- C:\Windows\System\zCzrBhN.exe
  C:\Windows\System\zCzrBhN.exe
  2⤵
  PID:6964
- C:\Windows\System\JNPexIQ.exe
  C:\Windows\System\JNPexIQ.exe
  2⤵
  PID:6980
- C:\Windows\System\VvKkTMg.exe
  C:\Windows\System\VvKkTMg.exe
  2⤵
  PID:6996
- C:\Windows\System\ZBTrOZf.exe
  C:\Windows\System\ZBTrOZf.exe
  2⤵
  PID:7012
- C:\Windows\System\svNqIKw.exe
  C:\Windows\System\svNqIKw.exe
  2⤵
  PID:7028
- C:\Windows\System\JooezpF.exe
  C:\Windows\System\JooezpF.exe
  2⤵
  PID:7044
- C:\Windows\System\ehmicSg.exe
  C:\Windows\System\ehmicSg.exe
  2⤵
  PID:7060
- C:\Windows\System\nQgBUdo.exe
  C:\Windows\System\nQgBUdo.exe
  2⤵
  PID:7076
- C:\Windows\System\EHCXEWm.exe
  C:\Windows\System\EHCXEWm.exe
  2⤵
  PID:7092
- C:\Windows\System\qabjKDm.exe
  C:\Windows\System\qabjKDm.exe
  2⤵
  PID:7136
- C:\Windows\System\FHEPtSN.exe
  C:\Windows\System\FHEPtSN.exe
  2⤵
  PID:7152
- C:\Windows\System\hkJAeAV.exe
  C:\Windows\System\hkJAeAV.exe
  2⤵
  PID:5824
- C:\Windows\System\grDZgFc.exe
  C:\Windows\System\grDZgFc.exe
  2⤵
  PID:6076
- C:\Windows\System\FrRCbcm.exe
  C:\Windows\System\FrRCbcm.exe
  2⤵
  PID:6160
- C:\Windows\System\xzfsMkH.exe
  C:\Windows\System\xzfsMkH.exe
  2⤵
  PID:6240
- C:\Windows\System\pybORry.exe
  C:\Windows\System\pybORry.exe
  2⤵
  PID:6256
- C:\Windows\System\EuBrqQx.exe
  C:\Windows\System\EuBrqQx.exe
  2⤵
  PID:6224
- C:\Windows\System\krmXeDV.exe
  C:\Windows\System\krmXeDV.exe
  2⤵
  PID:472
- C:\Windows\System\UFAhjns.exe
  C:\Windows\System\UFAhjns.exe
  2⤵
  PID:6380
- C:\Windows\System\KGmAjiO.exe
  C:\Windows\System\KGmAjiO.exe
  2⤵
  PID:6304
- C:\Windows\System\KUqgkCu.exe
  C:\Windows\System\KUqgkCu.exe
  2⤵
  PID:6364
- C:\Windows\System\Ibzuncv.exe
  C:\Windows\System\Ibzuncv.exe
  2⤵
  PID:1224
- C:\Windows\System\NPZCPlh.exe
  C:\Windows\System\NPZCPlh.exe
  2⤵
  PID:6396
- C:\Windows\System\lTUCvBW.exe
  C:\Windows\System\lTUCvBW.exe
  2⤵
  PID:6476
- C:\Windows\System\ZtbhUQT.exe
  C:\Windows\System\ZtbhUQT.exe
  2⤵
  PID:6524
- C:\Windows\System\viNnExk.exe
  C:\Windows\System\viNnExk.exe
  2⤵
  PID:6560
- C:\Windows\System\rdgiDlU.exe
  C:\Windows\System\rdgiDlU.exe
  2⤵
  PID:6620
- C:\Windows\System\aHnyaJc.exe
  C:\Windows\System\aHnyaJc.exe
  2⤵
  PID:3020
- C:\Windows\System\sluONhb.exe
  C:\Windows\System\sluONhb.exe
  2⤵
  PID:6604
- C:\Windows\System\MqaCPsU.exe
  C:\Windows\System\MqaCPsU.exe
  2⤵
  PID:6576
- C:\Windows\System\kwZffjR.exe
  C:\Windows\System\kwZffjR.exe
  2⤵
  PID:6720
- C:\Windows\System\UkeueEO.exe
  C:\Windows\System\UkeueEO.exe
  2⤵
  PID:6848
- C:\Windows\System\RwVVwvK.exe
  C:\Windows\System\RwVVwvK.exe
  2⤵
  PID:6796
- C:\Windows\System\SGgmvHX.exe
  C:\Windows\System\SGgmvHX.exe
  2⤵
  PID:6892
- C:\Windows\System\AAUxxdT.exe
  C:\Windows\System\AAUxxdT.exe
  2⤵
  PID:7008
- C:\Windows\System\kowoZmT.exe
  C:\Windows\System\kowoZmT.exe
  2⤵
  PID:7072
- C:\Windows\System\PEkFwus.exe
  C:\Windows\System\PEkFwus.exe
  2⤵
  PID:7164
- C:\Windows\System\fiKHHAQ.exe
  C:\Windows\System\fiKHHAQ.exe
  2⤵
  PID:6912
- C:\Windows\System\nyEeTRE.exe
  C:\Windows\System\nyEeTRE.exe
  2⤵
  PID:6316
- C:\Windows\System\fjNtDot.exe
  C:\Windows\System\fjNtDot.exe
  2⤵
  PID:7024
- C:\Windows\System\HGtoMPg.exe
  C:\Windows\System\HGtoMPg.exe
  2⤵
  PID:6220
- C:\Windows\System\lNOvRlI.exe
  C:\Windows\System\lNOvRlI.exe
  2⤵
  PID:6204
- C:\Windows\System\xUyQBiu.exe
  C:\Windows\System\xUyQBiu.exe
  2⤵
  PID:6288
- C:\Windows\System\ZVlalUV.exe
  C:\Windows\System\ZVlalUV.exe
  2⤵
  PID:6352
- C:\Windows\System\QshzlrS.exe
  C:\Windows\System\QshzlrS.exe
  2⤵
  PID:6460
- C:\Windows\System\HguIHhH.exe
  C:\Windows\System\HguIHhH.exe
  2⤵
  PID:6556
- C:\Windows\System\yKUrqCf.exe
  C:\Windows\System\yKUrqCf.exe
  2⤵
  PID:6448
- C:\Windows\System\ZWEChvO.exe
  C:\Windows\System\ZWEChvO.exe
  2⤵
  PID:6332
- C:\Windows\System\nxmCthi.exe
  C:\Windows\System\nxmCthi.exe
  2⤵
  PID:6636
- C:\Windows\System\AReYCNN.exe
  C:\Windows\System\AReYCNN.exe
  2⤵
  PID:6732
- C:\Windows\System\XurQJaF.exe
  C:\Windows\System\XurQJaF.exe
  2⤵
  PID:6812
- C:\Windows\System\WQSUfwr.exe
  C:\Windows\System\WQSUfwr.exe
  2⤵
  PID:6832
- C:\Windows\System\lzJEwtE.exe
  C:\Windows\System\lzJEwtE.exe
  2⤵
  PID:7040
- C:\Windows\System\gvTYvTQ.exe
  C:\Windows\System\gvTYvTQ.exe
  2⤵
  PID:6988
- C:\Windows\System\oMPfoOO.exe
  C:\Windows\System\oMPfoOO.exe
  2⤵
  PID:7056
- C:\Windows\System\ttYUSaT.exe
  C:\Windows\System\ttYUSaT.exe
  2⤵
  PID:7088
- C:\Windows\System\tPQSJpx.exe
  C:\Windows\System\tPQSJpx.exe
  2⤵
  PID:7160
- C:\Windows\System\NaPxpvu.exe
  C:\Windows\System\NaPxpvu.exe
  2⤵
  PID:7148
- C:\Windows\System\EEiDQhP.exe
  C:\Windows\System\EEiDQhP.exe
  2⤵
  PID:6652
- C:\Windows\System\irsMojF.exe
  C:\Windows\System\irsMojF.exe
  2⤵
  PID:6716
- C:\Windows\System\LrjeFrs.exe
  C:\Windows\System\LrjeFrs.exe
  2⤵
  PID:6880
- C:\Windows\System\dceFpNt.exe
  C:\Windows\System\dceFpNt.exe
  2⤵
  PID:6896
- C:\Windows\System\puwnFOs.exe
  C:\Windows\System\puwnFOs.exe
  2⤵
  PID:6700
- C:\Windows\System\JWuiSLn.exe
  C:\Windows\System\JWuiSLn.exe
  2⤵
  PID:6268
- C:\Windows\System\hQRHAwX.exe
  C:\Windows\System\hQRHAwX.exe
  2⤵
  PID:6768
- C:\Windows\System\YKvLENb.exe
  C:\Windows\System\YKvLENb.exe
  2⤵
  PID:6992
- C:\Windows\System\soSGGVU.exe
  C:\Windows\System\soSGGVU.exe
  2⤵
  PID:5504
- C:\Windows\System\bKxFaiN.exe
  C:\Windows\System\bKxFaiN.exe
  2⤵
  PID:6784
- C:\Windows\System\FOImZaP.exe
  C:\Windows\System\FOImZaP.exe
  2⤵
  PID:6588
- C:\Windows\System\wUhIznC.exe
  C:\Windows\System\wUhIznC.exe
  2⤵
  PID:7176
- C:\Windows\System\AKJXhfW.exe
  C:\Windows\System\AKJXhfW.exe
  2⤵
  PID:7288
- C:\Windows\System\Zdhpyuc.exe
  C:\Windows\System\Zdhpyuc.exe
  2⤵
  PID:7360
- C:\Windows\System\GImxKPv.exe
  C:\Windows\System\GImxKPv.exe
  2⤵
  PID:7484
- C:\Windows\System\ceOurqx.exe
  C:\Windows\System\ceOurqx.exe
  2⤵
  PID:7500
- C:\Windows\System\lnnAowp.exe
  C:\Windows\System\lnnAowp.exe
  2⤵
  PID:7608
- C:\Windows\System\Vmgxfcy.exe
  C:\Windows\System\Vmgxfcy.exe
  2⤵
  PID:7624
- C:\Windows\System\jNhcpLE.exe
  C:\Windows\System\jNhcpLE.exe
  2⤵
  PID:7640
- C:\Windows\System\mkoGzyb.exe
  C:\Windows\System\mkoGzyb.exe
  2⤵
  PID:7776
- C:\Windows\System\qLTayCM.exe
  C:\Windows\System\qLTayCM.exe
  2⤵
  PID:7792
- C:\Windows\System\vHBneax.exe
  C:\Windows\System\vHBneax.exe
  2⤵
  PID:7808
- C:\Windows\System\XDiPsCV.exe
  C:\Windows\System\XDiPsCV.exe
  2⤵
  PID:7824
- C:\Windows\System\LnkPDQI.exe
  C:\Windows\System\LnkPDQI.exe
  2⤵
  PID:7840
- C:\Windows\System\bzDGhfa.exe
  C:\Windows\System\bzDGhfa.exe
  2⤵
  PID:7856
- C:\Windows\System\FQHXynu.exe
  C:\Windows\System\FQHXynu.exe
  2⤵
  PID:7872
- C:\Windows\System\WjLaXvi.exe
  C:\Windows\System\WjLaXvi.exe
  2⤵
  PID:7900
- C:\Windows\System\ltRRHtv.exe
  C:\Windows\System\ltRRHtv.exe
  2⤵
  PID:7916
- C:\Windows\System\KzCjyxb.exe
  C:\Windows\System\KzCjyxb.exe
  2⤵
  PID:7932
- C:\Windows\System\ZYuDibC.exe
  C:\Windows\System\ZYuDibC.exe
  2⤵
  PID:7948
- C:\Windows\System\LCGcSpa.exe
  C:\Windows\System\LCGcSpa.exe
  2⤵
  PID:7964
- C:\Windows\System\bjwIaCW.exe
  C:\Windows\System\bjwIaCW.exe
  2⤵
  PID:7980
- C:\Windows\System\fyRlxtZ.exe
  C:\Windows\System\fyRlxtZ.exe
  2⤵
  PID:7996
- C:\Windows\System\FavZsPz.exe
  C:\Windows\System\FavZsPz.exe
  2⤵
  PID:8012
- C:\Windows\System\cIHttQE.exe
  C:\Windows\System\cIHttQE.exe
  2⤵
  PID:8028
- C:\Windows\System\tckxOsj.exe
  C:\Windows\System\tckxOsj.exe
  2⤵
  PID:8044
- C:\Windows\System\rhWzaHt.exe
  C:\Windows\System\rhWzaHt.exe
  2⤵
  PID:8060
- C:\Windows\System\uFqJeES.exe
  C:\Windows\System\uFqJeES.exe
  2⤵
  PID:8076
- C:\Windows\System\amKgDoI.exe
  C:\Windows\System\amKgDoI.exe
  2⤵
  PID:8092
- C:\Windows\System\KqhkUYI.exe
  C:\Windows\System\KqhkUYI.exe
  2⤵
  PID:8108
- C:\Windows\System\SXEzElY.exe
  C:\Windows\System\SXEzElY.exe
  2⤵
  PID:8128
- C:\Windows\System\jnvedyP.exe
  C:\Windows\System\jnvedyP.exe
  2⤵
  PID:8144
- C:\Windows\System\KvaDPKe.exe
  C:\Windows\System\KvaDPKe.exe
  2⤵
  PID:8160
- C:\Windows\System\wdJjRjk.exe
  C:\Windows\System\wdJjRjk.exe
  2⤵
  PID:8180
- C:\Windows\System\iKkUWSt.exe
  C:\Windows\System\iKkUWSt.exe
  2⤵
  PID:6400
- C:\Windows\System\VWhqNMK.exe
  C:\Windows\System\VWhqNMK.exe
  2⤵
  PID:1624
- C:\Windows\System\xmGPfzQ.exe
  C:\Windows\System\xmGPfzQ.exe
  2⤵
  PID:6640
- C:\Windows\System\GOnAeqG.exe
  C:\Windows\System\GOnAeqG.exe
  2⤵
  PID:6656
- C:\Windows\System\XUTDvJF.exe
  C:\Windows\System\XUTDvJF.exe
  2⤵
  PID:7184
- C:\Windows\System\bDzqdti.exe
  C:\Windows\System\bDzqdti.exe
  2⤵
  PID:7212
- C:\Windows\System\CnHOnDC.exe
  C:\Windows\System\CnHOnDC.exe
  2⤵
  PID:7228
- C:\Windows\System\zaecklF.exe
  C:\Windows\System\zaecklF.exe
  2⤵
  PID:7248
- C:\Windows\System\xirIEJg.exe
  C:\Windows\System\xirIEJg.exe
  2⤵
  PID:7264
- C:\Windows\System\YSflciY.exe
  C:\Windows\System\YSflciY.exe
  2⤵
  PID:7284
- C:\Windows\System\cWFiXRh.exe
  C:\Windows\System\cWFiXRh.exe
  2⤵
  PID:7300
- C:\Windows\System\XySFktG.exe
  C:\Windows\System\XySFktG.exe
  2⤵
  PID:7328
- C:\Windows\System\bqypwgD.exe
  C:\Windows\System\bqypwgD.exe
  2⤵
  PID:7340
- C:\Windows\System\iQFUnkJ.exe
  C:\Windows\System\iQFUnkJ.exe
  2⤵
  PID:7356
- C:\Windows\System\syYXBHm.exe
  C:\Windows\System\syYXBHm.exe
  2⤵
  PID:7392
- C:\Windows\System\HFCxaBb.exe
  C:\Windows\System\HFCxaBb.exe
  2⤵
  PID:7388
- C:\Windows\System\HStMVmT.exe
  C:\Windows\System\HStMVmT.exe
  2⤵
  PID:6236
- C:\Windows\System\JEmFVtl.exe
  C:\Windows\System\JEmFVtl.exe
  2⤵
  PID:7416
- C:\Windows\System\QvBKMyu.exe
  C:\Windows\System\QvBKMyu.exe
  2⤵
  PID:7468
- C:\Windows\System\vFxtTBb.exe
  C:\Windows\System\vFxtTBb.exe
  2⤵
  PID:7432
- C:\Windows\System\BURgQti.exe
  C:\Windows\System\BURgQti.exe
  2⤵
  PID:7456
- C:\Windows\System\zjnGpJN.exe
  C:\Windows\System\zjnGpJN.exe
  2⤵
  PID:7540
- C:\Windows\System\OokoWtm.exe
  C:\Windows\System\OokoWtm.exe
  2⤵
  PID:7524
- C:\Windows\System\ioJLCHp.exe
  C:\Windows\System\ioJLCHp.exe
  2⤵
  PID:7532
- C:\Windows\System\aUnBIwQ.exe
  C:\Windows\System\aUnBIwQ.exe
  2⤵
  PID:7552
- C:\Windows\System\wzMTkkO.exe
  C:\Windows\System\wzMTkkO.exe
  2⤵
  PID:7568
- C:\Windows\System\NPBYHCi.exe
  C:\Windows\System\NPBYHCi.exe
  2⤵
  PID:7584
- C:\Windows\System\kAGdWem.exe
  C:\Windows\System\kAGdWem.exe
  2⤵
  PID:7672
- C:\Windows\System\qoKLKjq.exe
  C:\Windows\System\qoKLKjq.exe
  2⤵
  PID:7656
- C:\Windows\System\yMkIotj.exe
  C:\Windows\System\yMkIotj.exe
  2⤵
  PID:7616
- C:\Windows\System\RvoJCzU.exe
  C:\Windows\System\RvoJCzU.exe
  2⤵
  PID:7676
- C:\Windows\System\nOiLpWe.exe
  C:\Windows\System\nOiLpWe.exe
  2⤵
  PID:7708
- C:\Windows\System\ABCtdgN.exe
  C:\Windows\System\ABCtdgN.exe
  2⤵
  PID:7728
- C:\Windows\System\SZGSJoX.exe
  C:\Windows\System\SZGSJoX.exe
  2⤵
  PID:7800
- C:\Windows\System\gWEpruh.exe
  C:\Windows\System\gWEpruh.exe
  2⤵
  PID:7864
- C:\Windows\System\jTLeLMX.exe
  C:\Windows\System\jTLeLMX.exe
  2⤵
  PID:7912
- C:\Windows\System\JSGddcT.exe
  C:\Windows\System\JSGddcT.exe
  2⤵
  PID:8004
- C:\Windows\System\zkacTDf.exe
  C:\Windows\System\zkacTDf.exe
  2⤵
  PID:8068
- C:\Windows\System\hmTjvph.exe
  C:\Windows\System\hmTjvph.exe
  2⤵
  PID:8136
- C:\Windows\System\yXYpUYW.exe
  C:\Windows\System\yXYpUYW.exe
  2⤵
  PID:2288
- C:\Windows\System\nzNZUfR.exe
  C:\Windows\System\nzNZUfR.exe
  2⤵
  PID:6176
- C:\Windows\System\ISHAsqK.exe
  C:\Windows\System\ISHAsqK.exe
  2⤵
  PID:7208
- C:\Windows\System\bJsRdUw.exe
  C:\Windows\System\bJsRdUw.exe
  2⤵
  PID:7240
- C:\Windows\System\iHIdqzb.exe
  C:\Windows\System\iHIdqzb.exe
  2⤵
  PID:7312
- C:\Windows\System\yleWwyl.exe
  C:\Windows\System\yleWwyl.exe
  2⤵
  PID:7308
- C:\Windows\System\VVmcpXK.exe
  C:\Windows\System\VVmcpXK.exe
  2⤵
  PID:7428
- C:\Windows\System\WtdzfVY.exe
  C:\Windows\System\WtdzfVY.exe
  2⤵
  PID:8088
- C:\Windows\System\NiKfkPo.exe
  C:\Windows\System\NiKfkPo.exe
  2⤵
  PID:7880
- C:\Windows\System\qXAsccK.exe
  C:\Windows\System\qXAsccK.exe
  2⤵
  PID:7528
- C:\Windows\System\FkkVitk.exe
  C:\Windows\System\FkkVitk.exe
  2⤵
  PID:7820
- C:\Windows\System\LAMFmJS.exe
  C:\Windows\System\LAMFmJS.exe
  2⤵
  PID:7560
- C:\Windows\System\pyBHLxX.exe
  C:\Windows\System\pyBHLxX.exe
  2⤵
  PID:7600
- C:\Windows\System\fGiwgNb.exe
  C:\Windows\System\fGiwgNb.exe
  2⤵
  PID:7224
- C:\Windows\System\gmsKczT.exe
  C:\Windows\System\gmsKczT.exe
  2⤵
  PID:7256
- C:\Windows\System\eqIbXhf.exe
  C:\Windows\System\eqIbXhf.exe
  2⤵
  PID:7784
- C:\Windows\System\eIzArUT.exe
  C:\Windows\System\eIzArUT.exe
  2⤵
  PID:7988
- C:\Windows\System\vLsNZhh.exe
  C:\Windows\System\vLsNZhh.exe
  2⤵
  PID:7576
- C:\Windows\System\bZOsSlP.exe
  C:\Windows\System\bZOsSlP.exe
  2⤵
  PID:8052
- C:\Windows\System\UltwhPj.exe
  C:\Windows\System\UltwhPj.exe
  2⤵
  PID:7132
- C:\Windows\System\fmlvbEx.exe
  C:\Windows\System\fmlvbEx.exe
  2⤵
  PID:6908
- C:\Windows\System\ckskgpH.exe
  C:\Windows\System\ckskgpH.exe
  2⤵
  PID:7604
- C:\Windows\System\ufYHttr.exe
  C:\Windows\System\ufYHttr.exe
  2⤵
  PID:7332
- C:\Windows\System\PjbEbHe.exe
  C:\Windows\System\PjbEbHe.exe
  2⤵
  PID:7420
- C:\Windows\System\lzpXJGT.exe
  C:\Windows\System\lzpXJGT.exe
  2⤵
  PID:7580
- C:\Windows\System\KyKDENe.exe
  C:\Windows\System\KyKDENe.exe
  2⤵
  PID:7688
- C:\Windows\System\pbyudwS.exe
  C:\Windows\System\pbyudwS.exe
  2⤵
  PID:7680
- C:\Windows\System\wCdjRSv.exe
  C:\Windows\System\wCdjRSv.exe
  2⤵
  PID:7724
- C:\Windows\System\nrzbRpM.exe
  C:\Windows\System\nrzbRpM.exe
  2⤵
  PID:7740
- C:\Windows\System\cqoWXIK.exe
  C:\Windows\System\cqoWXIK.exe
  2⤵
  PID:7832
- C:\Windows\System\rqMUxVT.exe
  C:\Windows\System\rqMUxVT.exe
  2⤵
  PID:8008
- C:\Windows\System\PpZxuvE.exe
  C:\Windows\System\PpZxuvE.exe
  2⤵
  PID:8100
- C:\Windows\System\mSmvWNx.exe
  C:\Windows\System\mSmvWNx.exe
  2⤵
  PID:7272
- C:\Windows\System\pHBWFwx.exe
  C:\Windows\System\pHBWFwx.exe
  2⤵
  PID:7884
- C:\Windows\System\PdjDdec.exe
  C:\Windows\System\PdjDdec.exe
  2⤵
  PID:8056
- C:\Windows\System\rYDSsEF.exe
  C:\Windows\System\rYDSsEF.exe
  2⤵
  PID:7892
- C:\Windows\System\PNLDybz.exe
  C:\Windows\System\PNLDybz.exe
  2⤵
  PID:8084
- C:\Windows\System\pdhhHOk.exe
  C:\Windows\System\pdhhHOk.exe
  2⤵
  PID:7316
- C:\Windows\System\zQxuDIL.exe
  C:\Windows\System\zQxuDIL.exe
  2⤵
  PID:7452
- C:\Windows\System\ZXgesJD.exe
  C:\Windows\System\ZXgesJD.exe
  2⤵
  PID:7564
- C:\Windows\System\thVlWAM.exe
  C:\Windows\System\thVlWAM.exe
  2⤵
  PID:7368
- C:\Windows\System\OtMfIkc.exe
  C:\Windows\System\OtMfIkc.exe
  2⤵
  PID:2968
- C:\Windows\System\tkvquOc.exe
  C:\Windows\System\tkvquOc.exe
  2⤵
  PID:7704
- C:\Windows\System\pffIqJY.exe
  C:\Windows\System\pffIqJY.exe
  2⤵
  PID:7296
- C:\Windows\System\LTZSHOx.exe
  C:\Windows\System\LTZSHOx.exe
  2⤵
  PID:7448
- C:\Windows\System\qvkwaxE.exe
  C:\Windows\System\qvkwaxE.exe
  2⤵
  PID:7720
- C:\Windows\System\JjIeprx.exe
  C:\Windows\System\JjIeprx.exe
  2⤵
  PID:7756
- C:\Windows\System\MLZVRjm.exe
  C:\Windows\System\MLZVRjm.exe
  2⤵
  PID:8140
- C:\Windows\System\iiLijya.exe
  C:\Windows\System\iiLijya.exe
  2⤵
  PID:8188
- C:\Windows\System\dqZmmXM.exe
  C:\Windows\System\dqZmmXM.exe
  2⤵
  PID:7960
- C:\Windows\System\iKKnTBr.exe
  C:\Windows\System\iKKnTBr.exe
  2⤵
  PID:6336
- C:\Windows\System\yCDsJaU.exe
  C:\Windows\System\yCDsJaU.exe
  2⤵
  PID:7636
- C:\Windows\System\BLbBzda.exe
  C:\Windows\System\BLbBzda.exe
  2⤵
  PID:8024
- C:\Windows\System\fCSUrSi.exe
  C:\Windows\System\fCSUrSi.exe
  2⤵
  PID:7732
- C:\Windows\System\OKCtljV.exe
  C:\Windows\System\OKCtljV.exe
  2⤵
  PID:7380
- C:\Windows\System\MrDEhsQ.exe
  C:\Windows\System\MrDEhsQ.exe
  2⤵
  PID:7188
- C:\Windows\System\FjUtXyn.exe
  C:\Windows\System\FjUtXyn.exe
  2⤵
  PID:8104
- C:\Windows\System\ZnZNhGw.exe
  C:\Windows\System\ZnZNhGw.exe
  2⤵
  PID:7852
- C:\Windows\System\OoaORLw.exe
  C:\Windows\System\OoaORLw.exe
  2⤵
  PID:7924
- C:\Windows\System\opYqOUT.exe
  C:\Windows\System\opYqOUT.exe
  2⤵
  PID:6416
- C:\Windows\System\TdZXmRK.exe
  C:\Windows\System\TdZXmRK.exe
  2⤵
  PID:8152
- C:\Windows\System\YwpSPzv.exe
  C:\Windows\System\YwpSPzv.exe
  2⤵
  PID:8208
- C:\Windows\System\tLBFCQQ.exe
  C:\Windows\System\tLBFCQQ.exe
  2⤵
  PID:8224
- C:\Windows\System\CRdOXnQ.exe
  C:\Windows\System\CRdOXnQ.exe
  2⤵
  PID:8252
- C:\Windows\System\FUAVzur.exe
  C:\Windows\System\FUAVzur.exe
  2⤵
  PID:8272
- C:\Windows\System\mEBStbi.exe
  C:\Windows\System\mEBStbi.exe
  2⤵
  PID:8296
- C:\Windows\System\IUhgEqN.exe
  C:\Windows\System\IUhgEqN.exe
  2⤵
  PID:8336
- C:\Windows\System\UTxFSIP.exe
  C:\Windows\System\UTxFSIP.exe
  2⤵
  PID:8352
- C:\Windows\System\rkHotdO.exe
  C:\Windows\System\rkHotdO.exe
  2⤵
  PID:8368
- C:\Windows\System\YFKFRPb.exe
  C:\Windows\System\YFKFRPb.exe
  2⤵
  PID:8384
- C:\Windows\System\CIwCuef.exe
  C:\Windows\System\CIwCuef.exe
  2⤵
  PID:8400
- C:\Windows\System\huSgMDI.exe
  C:\Windows\System\huSgMDI.exe
  2⤵
  PID:8416
- C:\Windows\System\RGglviB.exe
  C:\Windows\System\RGglviB.exe
  2⤵
  PID:8432
- C:\Windows\System\KERkdSF.exe
  C:\Windows\System\KERkdSF.exe
  2⤵
  PID:8448
- C:\Windows\System\cKhukYQ.exe
  C:\Windows\System\cKhukYQ.exe
  2⤵
  PID:8476
- C:\Windows\System\QTToOzK.exe
  C:\Windows\System\QTToOzK.exe
  2⤵
  PID:8492
- C:\Windows\System\bZhnzot.exe
  C:\Windows\System\bZhnzot.exe
  2⤵
  PID:8508
- C:\Windows\System\NcLeoyA.exe
  C:\Windows\System\NcLeoyA.exe
  2⤵
  PID:8524
- C:\Windows\System\pOUJwWL.exe
  C:\Windows\System\pOUJwWL.exe
  2⤵
  PID:8540
- C:\Windows\System\QfqkOdE.exe
  C:\Windows\System\QfqkOdE.exe
  2⤵
  PID:8556
- C:\Windows\System\urKWhke.exe
  C:\Windows\System\urKWhke.exe
  2⤵
  PID:8576
- C:\Windows\System\AVdAeuF.exe
  C:\Windows\System\AVdAeuF.exe
  2⤵
  PID:8596
- C:\Windows\System\zguaArb.exe
  C:\Windows\System\zguaArb.exe
  2⤵
  PID:8632
- C:\Windows\System\TdKumUp.exe
  C:\Windows\System\TdKumUp.exe
  2⤵
  PID:8648
- C:\Windows\System\sPXjWSP.exe
  C:\Windows\System\sPXjWSP.exe
  2⤵
  PID:8668
- C:\Windows\System\cokkGSA.exe
  C:\Windows\System\cokkGSA.exe
  2⤵
  PID:8684
- C:\Windows\System\TMTwwus.exe
  C:\Windows\System\TMTwwus.exe
  2⤵
  PID:8700
- C:\Windows\System\AThVYpF.exe
  C:\Windows\System\AThVYpF.exe
  2⤵
  PID:8716
- C:\Windows\System\oTwTaib.exe
  C:\Windows\System\oTwTaib.exe
  2⤵
  PID:8732
- C:\Windows\System\AsPwlvC.exe
  C:\Windows\System\AsPwlvC.exe
  2⤵
  PID:8748
- C:\Windows\System\FTvGdZE.exe
  C:\Windows\System\FTvGdZE.exe
  2⤵
  PID:8764
- C:\Windows\System\MPmtzPr.exe
  C:\Windows\System\MPmtzPr.exe
  2⤵
  PID:8780
- C:\Windows\System\uNlrAnH.exe
  C:\Windows\System\uNlrAnH.exe
  2⤵
  PID:8800
- C:\Windows\System\szJFTJd.exe
  C:\Windows\System\szJFTJd.exe
  2⤵
  PID:8816
- C:\Windows\System\ktyHoLo.exe
  C:\Windows\System\ktyHoLo.exe
  2⤵
  PID:8832
- C:\Windows\System\UBHgWcJ.exe
  C:\Windows\System\UBHgWcJ.exe
  2⤵
  PID:9016
- C:\Windows\System\xpFqdCn.exe
  C:\Windows\System\xpFqdCn.exe
  2⤵
  PID:9032
- C:\Windows\System\KEYqOsK.exe
  C:\Windows\System\KEYqOsK.exe
  2⤵
  PID:9048
- C:\Windows\System\QvvWPXi.exe
  C:\Windows\System\QvvWPXi.exe
  2⤵
  PID:8584
- C:\Windows\System\CLSRoNg.exe
  C:\Windows\System\CLSRoNg.exe
  2⤵
  PID:8644
- C:\Windows\System\YMDzeAo.exe
  C:\Windows\System\YMDzeAo.exe
  2⤵
  PID:8740
- C:\Windows\System\eikYUhr.exe
  C:\Windows\System\eikYUhr.exe
  2⤵
  PID:8760
- C:\Windows\System\sdzhaCp.exe
  C:\Windows\System\sdzhaCp.exe
  2⤵
  PID:8660
- C:\Windows\System\yXLpDUX.exe
  C:\Windows\System\yXLpDUX.exe
  2⤵
  PID:8824
- C:\Windows\System\KkdNXPj.exe
  C:\Windows\System\KkdNXPj.exe
  2⤵
  PID:9108
- C:\Windows\System\LIKHDNB.exe
  C:\Windows\System\LIKHDNB.exe
  2⤵
  PID:9088
- C:\Windows\System\XYZXIrx.exe
  C:\Windows\System\XYZXIrx.exe
  2⤵
  PID:9132
- C:\Windows\System\OkYDbHu.exe
  C:\Windows\System\OkYDbHu.exe
  2⤵
  PID:9064
- C:\Windows\System\kTYZLqK.exe
  C:\Windows\System\kTYZLqK.exe
  2⤵
  PID:9112
- C:\Windows\System\iNvRwjM.exe
  C:\Windows\System\iNvRwjM.exe
  2⤵
  PID:9160
- C:\Windows\System\cTfghvp.exe
  C:\Windows\System\cTfghvp.exe
  2⤵
  PID:8808
- C:\Windows\System\BFvLUbE.exe
  C:\Windows\System\BFvLUbE.exe
  2⤵
  PID:9172
- C:\Windows\System\NuKQOke.exe
  C:\Windows\System\NuKQOke.exe
  2⤵
  PID:8840
- C:\Windows\System\pYtEfmw.exe
  C:\Windows\System\pYtEfmw.exe
  2⤵
  PID:8860
- C:\Windows\System\MosnIbW.exe
  C:\Windows\System\MosnIbW.exe
  2⤵
  PID:8872
- C:\Windows\System\cmPhRhn.exe
  C:\Windows\System\cmPhRhn.exe
  2⤵
  PID:8888
- C:\Windows\System\EeeqXLJ.exe
  C:\Windows\System\EeeqXLJ.exe
  2⤵
  PID:8912
- C:\Windows\System\fffoBVV.exe
  C:\Windows\System\fffoBVV.exe
  2⤵
  PID:8928
- C:\Windows\System\YJGAGEM.exe
  C:\Windows\System\YJGAGEM.exe
  2⤵
  PID:8944
- C:\Windows\System\ieHftud.exe
  C:\Windows\System\ieHftud.exe
  2⤵
  PID:8960
- C:\Windows\System\arFLeiX.exe
  C:\Windows\System\arFLeiX.exe
  2⤵
  PID:8980
- C:\Windows\System\vHrnAUe.exe
  C:\Windows\System\vHrnAUe.exe
  2⤵
  PID:8996
- C:\Windows\System\ZxPiSOX.exe
  C:\Windows\System\ZxPiSOX.exe
  2⤵
  PID:9040
- C:\Windows\System\JcbdZhp.exe
  C:\Windows\System\JcbdZhp.exe
  2⤵
  PID:8156
- C:\Windows\System\EMyvUUA.exe
  C:\Windows\System\EMyvUUA.exe
  2⤵
  PID:8328
- C:\Windows\System\ZcYaeUt.exe
  C:\Windows\System\ZcYaeUt.exe
  2⤵
  PID:8292
- C:\Windows\System\BfTfFDR.exe
  C:\Windows\System\BfTfFDR.exe
  2⤵
  PID:7684
- C:\Windows\System\xOAQwLu.exe
  C:\Windows\System\xOAQwLu.exe
  2⤵
  PID:9200
- C:\Windows\System\zAPAjdu.exe
  C:\Windows\System\zAPAjdu.exe
  2⤵
  PID:9204
- C:\Windows\System\SKMBIVj.exe
  C:\Windows\System\SKMBIVj.exe
  2⤵
  PID:8408
- C:\Windows\System\DBrEMjT.exe
  C:\Windows\System\DBrEMjT.exe
  2⤵
  PID:8288
- C:\Windows\System\COIWByj.exe
  C:\Windows\System\COIWByj.exe
  2⤵
  PID:8376
- C:\Windows\System\wZXJTNW.exe
  C:\Windows\System\wZXJTNW.exe
  2⤵
  PID:8536
- C:\Windows\System\dMhRiQn.exe
  C:\Windows\System\dMhRiQn.exe
  2⤵
  PID:8548
- C:\Windows\System\hTXXCjT.exe
  C:\Windows\System\hTXXCjT.exe
  2⤵
  PID:8892
- C:\Windows\System\nZQRaGm.exe
  C:\Windows\System\nZQRaGm.exe
  2⤵
  PID:8924
- C:\Windows\System\sgtnzaH.exe
  C:\Windows\System\sgtnzaH.exe
  2⤵
  PID:8956
- C:\Windows\System\jFAJOiI.exe
  C:\Windows\System\jFAJOiI.exe
  2⤵
  PID:9176
- C:\Windows\System\WrbjWrr.exe
  C:\Windows\System\WrbjWrr.exe
  2⤵
  PID:8900
- C:\Windows\System\iqpYpFt.exe
  C:\Windows\System\iqpYpFt.exe
  2⤵
  PID:8972
- C:\Windows\System\LcCoaJO.exe
  C:\Windows\System\LcCoaJO.exe
  2⤵
  PID:9184
- C:\Windows\System\XZYQCYr.exe
  C:\Windows\System\XZYQCYr.exe
  2⤵
  PID:8204
- C:\Windows\System\LfaSbDk.exe
  C:\Windows\System\LfaSbDk.exe
  2⤵
  PID:8220
- C:\Windows\System\lqTpiPj.exe
  C:\Windows\System\lqTpiPj.exe
  2⤵
  PID:9012
- C:\Windows\System\dVNcomK.exe
  C:\Windows\System\dVNcomK.exe
  2⤵
  PID:8176
- C:\Windows\System\CEwpHCp.exe
  C:\Windows\System\CEwpHCp.exe
  2⤵
  PID:8364
- C:\Windows\System\mGWcbNV.exe
  C:\Windows\System\mGWcbNV.exe
  2⤵
  PID:8440
- C:\Windows\System\QtKCnFs.exe
  C:\Windows\System\QtKCnFs.exe
  2⤵
  PID:8348
- C:\Windows\System\fIjKYHI.exe
  C:\Windows\System\fIjKYHI.exe
  2⤵
  PID:8568
- C:\Windows\System\IKJNtbb.exe
  C:\Windows\System\IKJNtbb.exe
  2⤵
  PID:8640
- C:\Windows\System\dJQYfOU.exe
  C:\Windows\System\dJQYfOU.exe
  2⤵
  PID:8616
- C:\Windows\System\UUaRLDq.exe
  C:\Windows\System\UUaRLDq.exe
  2⤵
  PID:8680
- C:\Windows\System\bmQzsPC.exe
  C:\Windows\System\bmQzsPC.exe
  2⤵
  PID:8664
- C:\Windows\System\jxpaloL.exe
  C:\Windows\System\jxpaloL.exe
  2⤵
  PID:9060
- C:\Windows\System\LmUijuU.exe
  C:\Windows\System\LmUijuU.exe
  2⤵
  PID:9220
- C:\Windows\System\pAiZzrb.exe
  C:\Windows\System\pAiZzrb.exe
  2⤵
  PID:9236
- C:\Windows\System\CwNSuji.exe
  C:\Windows\System\CwNSuji.exe
  2⤵
  PID:9252
- C:\Windows\System\nKuDdpC.exe
  C:\Windows\System\nKuDdpC.exe
  2⤵
  PID:9268
- C:\Windows\System\zFjAtEZ.exe
  C:\Windows\System\zFjAtEZ.exe
  2⤵
  PID:9284
- C:\Windows\System\rcmyYqw.exe
  C:\Windows\System\rcmyYqw.exe
  2⤵
  PID:9308
- C:\Windows\System\nqxtFHP.exe
  C:\Windows\System\nqxtFHP.exe
  2⤵
  PID:9324
- C:\Windows\System\BytHZoT.exe
  C:\Windows\System\BytHZoT.exe
  2⤵
  PID:9340
- C:\Windows\System\BfYbyEP.exe
  C:\Windows\System\BfYbyEP.exe
  2⤵
  PID:9356
- C:\Windows\System\PCsVvlE.exe
  C:\Windows\System\PCsVvlE.exe
  2⤵
  PID:9372
- C:\Windows\System\DLEtOIe.exe
  C:\Windows\System\DLEtOIe.exe
  2⤵
  PID:9392
- C:\Windows\System\rmUrqFg.exe
  C:\Windows\System\rmUrqFg.exe
  2⤵
  PID:9408
- C:\Windows\System\LSEyYXk.exe
  C:\Windows\System\LSEyYXk.exe
  2⤵
  PID:9424
- C:\Windows\System\RZTzYPY.exe
  C:\Windows\System\RZTzYPY.exe
  2⤵
  PID:9440
- C:\Windows\System\meZwdPw.exe
  C:\Windows\System\meZwdPw.exe
  2⤵
  PID:9460
- C:\Windows\System\VgGlVpJ.exe
  C:\Windows\System\VgGlVpJ.exe
  2⤵
  PID:9484
- C:\Windows\System\wmXULcd.exe
  C:\Windows\System\wmXULcd.exe
  2⤵
  PID:9500
- C:\Windows\System\FWTYfYQ.exe
  C:\Windows\System\FWTYfYQ.exe
  2⤵
  PID:9516
- C:\Windows\System\nHxBWIY.exe
  C:\Windows\System\nHxBWIY.exe
  2⤵
  PID:9532
- C:\Windows\System\lNelwJi.exe
  C:\Windows\System\lNelwJi.exe
  2⤵
  PID:9548
- C:\Windows\System\FoMfHKa.exe
  C:\Windows\System\FoMfHKa.exe
  2⤵
  PID:9564
- C:\Windows\System\OmUMJGs.exe
  C:\Windows\System\OmUMJGs.exe
  2⤵
  PID:9588
- C:\Windows\System\IRlBVMn.exe
  C:\Windows\System\IRlBVMn.exe
  2⤵
  PID:9604
- C:\Windows\System\tPvcLLs.exe
  C:\Windows\System\tPvcLLs.exe
  2⤵
  PID:9624
- C:\Windows\System\spzDlNT.exe
  C:\Windows\System\spzDlNT.exe
  2⤵
  PID:9684
- C:\Windows\System\fmSTRrV.exe
  C:\Windows\System\fmSTRrV.exe
  2⤵
  PID:9708
- C:\Windows\System\fazRfrM.exe
  C:\Windows\System\fazRfrM.exe
  2⤵
  PID:9724
- C:\Windows\System\WTTdkxh.exe
  C:\Windows\System\WTTdkxh.exe
  2⤵
  PID:9740
- C:\Windows\System\ikQYmDS.exe
  C:\Windows\System\ikQYmDS.exe
  2⤵
  PID:9764
- C:\Windows\System\MrfBWlB.exe
  C:\Windows\System\MrfBWlB.exe
  2⤵
  PID:9780
- C:\Windows\System\CpnMTbZ.exe
  C:\Windows\System\CpnMTbZ.exe
  2⤵
  PID:9796
- C:\Windows\System\KPuWxox.exe
  C:\Windows\System\KPuWxox.exe
  2⤵
  PID:9812
- C:\Windows\System\fZYlwWQ.exe
  C:\Windows\System\fZYlwWQ.exe
  2⤵
  PID:9828
- C:\Windows\System\nwjusYX.exe
  C:\Windows\System\nwjusYX.exe
  2⤵
  PID:9844
- C:\Windows\System\XDGISyn.exe
  C:\Windows\System\XDGISyn.exe
  2⤵
  PID:9860
- C:\Windows\System\yPHKaBB.exe
  C:\Windows\System\yPHKaBB.exe
  2⤵
  PID:9876
- C:\Windows\System\SvGGiuT.exe
  C:\Windows\System\SvGGiuT.exe
  2⤵
  PID:9892
- C:\Windows\System\dbWmeCC.exe
  C:\Windows\System\dbWmeCC.exe
  2⤵
  PID:9908
- C:\Windows\System\APfeQJn.exe
  C:\Windows\System\APfeQJn.exe
  2⤵
  PID:9928
- C:\Windows\System\btYxjRQ.exe
  C:\Windows\System\btYxjRQ.exe
  2⤵
  PID:9944
- C:\Windows\System\aEBgOFf.exe
  C:\Windows\System\aEBgOFf.exe
  2⤵
  PID:9960
- C:\Windows\System\RuEZgMf.exe
  C:\Windows\System\RuEZgMf.exe
  2⤵
  PID:9976
- C:\Windows\System\LvmrpMB.exe
  C:\Windows\System\LvmrpMB.exe
  2⤵
  PID:9992
- C:\Windows\System\llMclul.exe
  C:\Windows\System\llMclul.exe
  2⤵
  PID:10012
- C:\Windows\System\ECdcCTg.exe
  C:\Windows\System\ECdcCTg.exe
  2⤵
  PID:10028
- C:\Windows\System\AHmJxyb.exe
  C:\Windows\System\AHmJxyb.exe
  2⤵
  PID:10044
- C:\Windows\System\OFvMrST.exe
  C:\Windows\System\OFvMrST.exe
  2⤵
  PID:10064
- C:\Windows\System\NMpzdNj.exe
  C:\Windows\System\NMpzdNj.exe
  2⤵
  PID:10080
- C:\Windows\System\fSBTSzz.exe
  C:\Windows\System\fSBTSzz.exe
  2⤵
  PID:10096
- C:\Windows\System\dqxinUR.exe
  C:\Windows\System\dqxinUR.exe
  2⤵
  PID:10112
- C:\Windows\System\wdyIZEc.exe
  C:\Windows\System\wdyIZEc.exe
  2⤵
  PID:10128
- C:\Windows\System\fctmgeY.exe
  C:\Windows\System\fctmgeY.exe
  2⤵
  PID:10144
- C:\Windows\System\GwqkBzs.exe
  C:\Windows\System\GwqkBzs.exe
  2⤵
  PID:10160
- C:\Windows\System\kMRqrRs.exe
  C:\Windows\System\kMRqrRs.exe
  2⤵
  PID:10176
- C:\Windows\System\XOwdlMh.exe
  C:\Windows\System\XOwdlMh.exe
  2⤵
  PID:10192
- C:\Windows\System\avFImtu.exe
  C:\Windows\System\avFImtu.exe
  2⤵
  PID:10216
- C:\Windows\System\YiqhHol.exe
  C:\Windows\System\YiqhHol.exe
  2⤵
  PID:10232
- C:\Windows\System\RJbvSAz.exe
  C:\Windows\System\RJbvSAz.exe
  2⤵
  PID:9128
- C:\Windows\System\wWadRba.exe
  C:\Windows\System\wWadRba.exe
  2⤵
  PID:9148
- C:\Windows\System\DnpkcRR.exe
  C:\Windows\System\DnpkcRR.exe
  2⤵
  PID:9008
- C:\Windows\System\QHvRUVR.exe
  C:\Windows\System\QHvRUVR.exe
  2⤵
  PID:8772
- C:\Windows\System\LdYFCWk.exe
  C:\Windows\System\LdYFCWk.exe
  2⤵
  PID:1580
- C:\Windows\System\cMoejAv.exe
  C:\Windows\System\cMoejAv.exe
  2⤵
  PID:8484
- C:\Windows\System\ygpmAgw.exe
  C:\Windows\System\ygpmAgw.exe
  2⤵
  PID:8724
- C:\Windows\System\BDhFKEe.exe
  C:\Windows\System\BDhFKEe.exe
  2⤵
  PID:9028
- C:\Windows\System\UOXGTdz.exe
  C:\Windows\System\UOXGTdz.exe
  2⤵
  PID:9056
- C:\Windows\System\TkINHTJ.exe
  C:\Windows\System\TkINHTJ.exe
  2⤵
  PID:9080
- C:\Windows\System\OdPoXLK.exe
  C:\Windows\System\OdPoXLK.exe
  2⤵
  PID:9348
- C:\Windows\System\qqlaesm.exe
  C:\Windows\System\qqlaesm.exe
  2⤵
  PID:9384
- C:\Windows\System\uWpPucp.exe
  C:\Windows\System\uWpPucp.exe
  2⤵
  PID:9448
- C:\Windows\System\XnhXvaV.exe
  C:\Windows\System\XnhXvaV.exe
  2⤵
  PID:9496
- C:\Windows\System\FthScuh.exe
  C:\Windows\System\FthScuh.exe
  2⤵
  PID:8776
- C:\Windows\System\RGgxumO.exe
  C:\Windows\System\RGgxumO.exe
  2⤵
  PID:9656
- C:\Windows\System\ZWwnBbc.exe
  C:\Windows\System\ZWwnBbc.exe
  2⤵
  PID:8968
- C:\Windows\System\mYEsceM.exe
  C:\Windows\System\mYEsceM.exe
  2⤵
  PID:7620
- C:\Windows\System\iFTOZxn.exe
  C:\Windows\System\iFTOZxn.exe
  2⤵
  PID:8260
- C:\Windows\System\UsHFhmW.exe
  C:\Windows\System\UsHFhmW.exe
  2⤵
  PID:8216
- C:\Windows\System\sHXBazX.exe
  C:\Windows\System\sHXBazX.exe
  2⤵
  PID:8280
- C:\Windows\System\aOkfZbz.exe
  C:\Windows\System\aOkfZbz.exe
  2⤵
  PID:8608
- C:\Windows\System\kEAsSHb.exe
  C:\Windows\System\kEAsSHb.exe
  2⤵
  PID:9380
- C:\Windows\System\lPFIHTP.exe
  C:\Windows\System\lPFIHTP.exe
  2⤵
  PID:9560
- C:\Windows\System\AQYvnLm.exe
  C:\Windows\System\AQYvnLm.exe
  2⤵
  PID:8904
- C:\Windows\System\iTTYYRW.exe
  C:\Windows\System\iTTYYRW.exe
  2⤵
  PID:9884
- C:\Windows\System\gzukxzu.exe
  C:\Windows\System\gzukxzu.exe
  2⤵
  PID:9696
- C:\Windows\System\qKHYtva.exe
  C:\Windows\System\qKHYtva.exe
  2⤵
  PID:10256
- C:\Windows\System\pdmsmPv.exe
  C:\Windows\System\pdmsmPv.exe
  2⤵
  PID:10272
- C:\Windows\System\xTAPGcL.exe
  C:\Windows\System\xTAPGcL.exe
  2⤵
  PID:10296
- C:\Windows\System\bDLxCjJ.exe
  C:\Windows\System\bDLxCjJ.exe
  2⤵
  PID:10316
- C:\Windows\System\UkJSLAq.exe
  C:\Windows\System\UkJSLAq.exe
  2⤵
  PID:10332
- C:\Windows\System\znSXsDU.exe
  C:\Windows\System\znSXsDU.exe
  2⤵
  PID:10348
- C:\Windows\System\sWaSRqU.exe
  C:\Windows\System\sWaSRqU.exe
  2⤵
  PID:10364
- C:\Windows\System\txQgldj.exe
  C:\Windows\System\txQgldj.exe
  2⤵
  PID:10380
- C:\Windows\System\JwgitVF.exe
  C:\Windows\System\JwgitVF.exe
  2⤵
  PID:10396
- C:\Windows\System\wHPTUEj.exe
  C:\Windows\System\wHPTUEj.exe
  2⤵
  PID:10412
- C:\Windows\System\laNBANI.exe
  C:\Windows\System\laNBANI.exe
  2⤵
  PID:10428
- C:\Windows\System\rrHDaXA.exe
  C:\Windows\System\rrHDaXA.exe
  2⤵
  PID:10444
- C:\Windows\System\JLRYrqr.exe
  C:\Windows\System\JLRYrqr.exe
  2⤵
  PID:10460
- C:\Windows\System\mEJAtGp.exe
  C:\Windows\System\mEJAtGp.exe
  2⤵
  PID:10476
- C:\Windows\System\qbjOviS.exe
  C:\Windows\System\qbjOviS.exe
  2⤵
  PID:10568
- C:\Windows\System\asiBEvs.exe
  C:\Windows\System\asiBEvs.exe
  2⤵
  PID:10588
- C:\Windows\System\nsYomXI.exe
  C:\Windows\System\nsYomXI.exe
  2⤵
  PID:10604
- C:\Windows\System\jyVblng.exe
  C:\Windows\System\jyVblng.exe
  2⤵
  PID:10620
- C:\Windows\System\wdwEWdS.exe
  C:\Windows\System\wdwEWdS.exe
  2⤵
  PID:10636
- C:\Windows\System\tcXjBdV.exe
  C:\Windows\System\tcXjBdV.exe
  2⤵
  PID:10656
- C:\Windows\System\zqUfkzI.exe
  C:\Windows\System\zqUfkzI.exe
  2⤵
  PID:10672
- C:\Windows\System\mqnGuUz.exe
  C:\Windows\System\mqnGuUz.exe
  2⤵
  PID:10688
- C:\Windows\System\blfjRmJ.exe
  C:\Windows\System\blfjRmJ.exe
  2⤵
  PID:10704
- C:\Windows\System\YFgSsdp.exe
  C:\Windows\System\YFgSsdp.exe
  2⤵
  PID:10720
- C:\Windows\System\VzlfAGQ.exe
  C:\Windows\System\VzlfAGQ.exe
  2⤵
  PID:10736
- C:\Windows\System\tYMoiTV.exe
  C:\Windows\System\tYMoiTV.exe
  2⤵
  PID:10752
- C:\Windows\System\zhpphWt.exe
  C:\Windows\System\zhpphWt.exe
  2⤵
  PID:10768
- C:\Windows\System\xWUMsme.exe
  C:\Windows\System\xWUMsme.exe
  2⤵
  PID:10784
- C:\Windows\System\jwnXyoe.exe
  C:\Windows\System\jwnXyoe.exe
  2⤵
  PID:10800
- C:\Windows\System\ynjqgDK.exe
  C:\Windows\System\ynjqgDK.exe
  2⤵
  PID:10816
- C:\Windows\System\mygRCuC.exe
  C:\Windows\System\mygRCuC.exe
  2⤵
  PID:10832
- C:\Windows\System\HefDsdT.exe
  C:\Windows\System\HefDsdT.exe
  2⤵
  PID:10848
- C:\Windows\System\OqdoHes.exe
  C:\Windows\System\OqdoHes.exe
  2⤵
  PID:10864
- C:\Windows\System\vtfymUc.exe
  C:\Windows\System\vtfymUc.exe
  2⤵
  PID:10880
- C:\Windows\System\UNXiyqu.exe
  C:\Windows\System\UNXiyqu.exe
  2⤵
  PID:10896
- C:\Windows\System\yTQMlym.exe
  C:\Windows\System\yTQMlym.exe
  2⤵
  PID:10912
- C:\Windows\System\JIrykrs.exe
  C:\Windows\System\JIrykrs.exe
  2⤵
  PID:10928
- C:\Windows\System\wrzmlhO.exe
  C:\Windows\System\wrzmlhO.exe
  2⤵
  PID:10944

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AEmBPcy.exe

Filesize
1.7MB

MD5
ef1aaa177ab321377db3b92d86d40f2d

SHA1
37c8a89d0b53d02870fa4b743ccb3688257cf5f7

SHA256
5a5bc0410675b180dc287b159c2287371984dbc0b8191ea8734fa3325db00f1b

SHA512
1c545d6117794685a89254d16d7f51baa114b3318538fc8c41d113105430c476bac44b19f8c5c121fc5fc1b46ac3841daa7508103b16e6ccb77b53b83d9e9e78

Download Submit
C:\Windows\system\BJKdYOd.exe

Filesize
1.7MB

MD5
5b140b5757bbcec4ee6083374980aa4e

SHA1
d1438e7b41149ae454e847be87dcae7488b523a2

SHA256
9579d91472269e972dc49913898c15adb0c13ef42b7b269dd5298b80672f674f

SHA512
31ec8ab0720adba731c2509ca81760082a761bb4164a2aef5272aa161224541109f98facdc5faa225c2dbfa51eade79bb4f3b4b0a44c4c6549c81d1b92c74c8c

Download Submit
C:\Windows\system\BZNptkd.exe

Filesize
1.7MB

MD5
2c574256e9700554d28b4742712ae3d3

SHA1
3e63a0aaaee9519c6d693f67d317723c6a17bbac

SHA256
64c441d70d90699853fd9ba899dc7a45a031e44936fb29c61540c34402ecf03f

SHA512
f23a9d5e85f63b7f7619295fd6db72cb0b9a951ed990b362a13fa65f9b69d208bffdc7e9724535f16a7cf2fbfb797fac6ed5bfc6c33d17b1b69bc78d1b252770

Download Submit
C:\Windows\system\CecaILZ.exe

Filesize
1.7MB

MD5
596d5160ca0b4f726a98714f3b07e0ed

SHA1
52176a8f7567a4211ce571768469736b9ee4c430

SHA256
e7f320997575158cdd3685b1dd8e3478f935468e75fad5b53f62501e28cca9de

SHA512
321ff758f9d0d8a0fc0c5feb7624aa02367ea6c58ed26030dfd04cc7363fae4238db3c830cbbe4f65a44b9f567929a0e524eb65bd8587455d27f25d001eb8e1b

Download Submit
C:\Windows\system\EbznwSs.exe

Filesize
1.7MB

MD5
20b9b44cd0590cebaab1e5cba19decab

SHA1
4283746386f287de5b45999709f1bf50fb1b2394

SHA256
f4fb8ccabd681812a72a959d6ca96cd30da7d93f4b810ab27d511480de00b845

SHA512
ec210e31aabd82ad6dd9b3cbedf0cf0a3d652b12aefea7013a172ddb95f1fed409d80884c11e2294792a0618ff5b675b028c511b54871e34ddea3acb2eb014cc

Download Submit
C:\Windows\system\OOXjhBl.exe

Filesize
1.7MB

MD5
c88197228e3487e4b5f6aab7f90a8c54

SHA1
6064fbcd8e3441e22bce4fc74f3c2a9a2840824c

SHA256
92989f3b0941d76a8067e26a85cadc24daf76604ab1c30e355460d82cc63d3bb

SHA512
c5831d668c976378a6e8e5c31bf56428ada9b688cd26a5b8bfa90cbe808aa3e375a9504e52c70a39e5c6f5a966b9ad886c7109ea93d48a6b3d2f63e7c8bbf18a

Download Submit
C:\Windows\system\SYKKXAJ.exe

Filesize
1.7MB

MD5
32dfd6f83d6c889bdfab587dfb51ab2b

SHA1
8928e92746a56d3a87ce1fcab23bac99d3ee9581

SHA256
5724fac36814fbb11968ef9f6bc93aee0eb783ee0cfb69568fc8b62b74a78187

SHA512
0ae6c38240b0aed97d029a1fddd454f25b5611da069faa93a5cc68fe1c9dbfd8808e32804b3ab22b2063f6688b827c5f0102eeaed6854cd2e21a9a7d685d1652

Download Submit
C:\Windows\system\WgsMGLh.exe

Filesize
1.7MB

MD5
b05c69e34ef4c4e1f62cc2d53073cd38

SHA1
9f4127b275fac08f999ad50e450507d424328b85

SHA256
692d564bbc527bf619b57ca902febbe97157eccb4140ac407da75d7d16b463f3

SHA512
fad5c2da2f93e9687fccfb770ecc492ee9e82472058e51dca2af9a820210c6b9226b4d4739f460ed2d1849490994c1daabe8933d1cd93a4ac6259f0f845d50f9

Download Submit
C:\Windows\system\XceuFEE.exe

Filesize
1.7MB

MD5
ab5d709b11eae4ff5b30d9d9f9cc0382

SHA1
32212643a6c760fbc5cf4d66c7e4e2750b315eec

SHA256
adddb85c40c6e33384b64eae1ac1b8ab0ec830063da2a3e76880469943530238

SHA512
59bbf8de7aa585257d2d5063199ffacb067f87ea21c2d7406feb7be8f51a5d53ce5558d7e9d732f5935b9240af969b1741dc50c94b2f99ff995d0c2bdcb1db55

Download Submit
C:\Windows\system\dZtukbQ.exe

Filesize
1.7MB

MD5
2294d37b7d6314616674f728b3505520

SHA1
89efba561eb93295c39f3e941a213f78479f7c2c

SHA256
bac4903590809c2999108345590be13622401a1f64db89502ca4fb74e9f455da

SHA512
bcbe672708f3e1728d7402b6e8c356d5891f1f4b7c80d38b7577be60927828dd89202771b23817a592f90efc1e703e519289e462043ebcb21b093325158da678

Download Submit
C:\Windows\system\jFITDoY.exe

Filesize
1.7MB

MD5
6ad106a4cb79405d41c6ea6a046053bd

SHA1
37a38764d1c381a451ea7bb6c7df3907e3e02223

SHA256
049ae448933db9656bb10f71cc3f04bbf79eea9f9a921666b4eb3002ec194f7b

SHA512
42cd3c3c9eba6e835af4436c1a84072f9b1e3040a60cc13901f0ae965204b62d5972ea1e71fb55deafc00d8daa055fc64db4d55db922de2506ecc76fe45b7a47

Download Submit
C:\Windows\system\kUUMLLm.exe

Filesize
1.7MB

MD5
e8c00346521c565cf73797345b01a956

SHA1
6e0f0f6c3451e3f26a6e5a150d9da616a817bd4b

SHA256
ad5b1e3fd23cd06bdbf9a521b8a9c135ed63648da541c50a7db977983e87bcaf

SHA512
c68745e9dbfc0dc8ba47b3d6ab23e7988aa8fc005376e2521e9c678fbc74d1c120afd3661a003596e146e32acf4d05bf6b9fbdefa46c9305e66bd25378970919

Download Submit
C:\Windows\system\kdfJpQt.exe

Filesize
1.7MB

MD5
40d23de967de23a9fac120be38ef134a

SHA1
60f802c346eeba7a104e90ae38264f12e214ae2e

SHA256
57ba7266e7b6b9ec85221fa5de05e088127cd3ed905aca88f48b538f4eb3eb06

SHA512
f6a8be7732c04071a5232e940eb3df35bec89f416f5d571709134bf649848fccb9efcd712f60f192893d4446f34ef28f48d82586a1b268e893289672c11f766e

Download Submit
C:\Windows\system\lndfOyE.exe

Filesize
1.7MB

MD5
a32c8fc7f0e2e0ca7c59ea95a1371e01

SHA1
2b253ec23fa9d5f779d517ce7af4cab81bfc738e

SHA256
ffaf57300b05c8afbc9f64419aeaf81ae1d02f28f6d688d41dbf5cb9e39a570a

SHA512
443d0fa8ce2756d1d1070b26171e60acdb859c36c8d6689401e59447ac98bf8cdef124fa43cde3d9c1bc13f2bf51def130d5e036e83b290b2f3c655bedbdbe32

Download Submit
C:\Windows\system\mYvYFnl.exe

Filesize
1.7MB

MD5
f8ceb08951106ef5d96dd70ae36f6cdc

SHA1
c69bbe3caa667b167afd4043d72ef84cdb0bcf41

SHA256
59e9dbb9384230434f6fa7c0f61b6d8b73a87c69a74a8fc37dc9ed13b182748f

SHA512
229ae211a6bbd689928de9dd5789243b8bac91a8fb2e2e5b3a0c62ad00bd64e88098289b07c4f453e99bed7254ab11a46bdc4c1a1e34e43f83f77c935a567781

Download Submit
C:\Windows\system\mmVjLWv.exe

Filesize
1.7MB

MD5
160bb1b9e1c6b67f93ad46b2519971da

SHA1
60f4a34b5a4a3d18f921669da078c32e7238ac21

SHA256
d640df77e3caf873bf7880c926ab51a985a28465695567830ab820cdf6fe1bec

SHA512
512aa8bb474b873cf9f2acf58fd53d95af77e8578440c72b04adea4547a8751f90e9b15c5d85e606cb4e8c31ef113d8108783bd51a4a2f96fb84c9120e358da5

Download Submit
C:\Windows\system\pJHWXfA.exe

Filesize
1.7MB

MD5
61c59455cfab0bb6fba7c0b1ae32573e

SHA1
3ab5199832d336dc5dbdcd6160b68151d845634d

SHA256
f56e695a53a4188e42366904ce5b7af442d63f5c014203c85b38652b99776fc6

SHA512
0698d7d236df51a3919552ae49a8cb50fd9d119bc46b207e2a0d921b8b4c5e33dc207d9264597988cdda38cbb59d5008b3a5d906b159ae8949b7dcb5732d2da2

Download Submit
C:\Windows\system\pWNoXHi.exe

Filesize
1.7MB

MD5
980d0c4a607390c15028633d79870306

SHA1
ed9cf9e082730d3df518b1817a4dba54cdfe0732

SHA256
4f6382500d3563811b4ec09f81005b55525c213f71328154e7dd9ad481979b81

SHA512
61c162226e0380aab77cb6bc746b3ed72dc0d5f9cdf476df441e64f97bdfeae28304fc2a76afa8429110202e3915887ed111d99e78743ee6fc15367e2918d689

Download Submit
C:\Windows\system\sHfkmWq.exe

Filesize
1.7MB

MD5
ffc5c95d2564ac984d3b43a7e86f8148

SHA1
f9fda2c1e728f7fad2742781b913df1a6c6f72ef

SHA256
d2c59196fb16829d664f3c2d8872f7463ca21f46235b6e999da92ef6325e11b1

SHA512
bfc17f09c049d61bf7173344da93b78b07d523d048f1c122410264f01b309ccb007c6786e13ddf2137838d449af49618bf1e22c197d4eea7a16b04a4fd291635

Download Submit
C:\Windows\system\uwNRrML.exe

Filesize
1.7MB

MD5
5702ed3ba59ef8904aa331033102df09

SHA1
6e2417da6f4eeaa3e09d849a5d9277106b000e84

SHA256
7e109ff28784cfe7bddea8c5611dddbe2a91a52044b6e36b57120217213f4629

SHA512
8411bdc3208583d561370b78cb2e1011316fe8038841cbb538b0709252130f676845cd022c1f9194fa0f45ce9e563bd8c16577eecfd671b18fefce146e879d40

Download Submit
C:\Windows\system\vQmJVoo.exe

Filesize
1.7MB

MD5
979051994a72cc94856d956fc1a18247

SHA1
d0ddd9ec2910a42a43838f2094642926e73a6743

SHA256
657bebf2d99e7d7299fc40aba3c439ce56c897587e6307fcde642667b92cf2ba

SHA512
8613b6adf4cad6ce72e04fd76678bb6b76959e31ea6c8fb8e39f1ca73b39c89455c701d0511fb595ef41d3699b0ff495180a0a1a44e969c5edfc9e0dd4b097ee

Download Submit
C:\Windows\system\vtfXYYb.exe

Filesize
1.7MB

MD5
483225e64fcfbcd5d59a7edd17b767cc

SHA1
fce7a30e4e39a9219cf0e75083e195da648dcb6d

SHA256
9c0c81bd2fd7126bb80238cc96a9c4c8cc455a7a0320680de2ac04dd5018f84f

SHA512
1a82dcf0758409112ab5d7fd428c56b753ccd4a11ebf6e8091f2e1e0f8d00d7d78fe0b5d1ec381bcd68f6513916ae5a254702cf930dc9790037fde194e6b3334

Download Submit
C:\Windows\system\xBeVFgp.exe

Filesize
1.7MB

MD5
66db64e56ce09463b226c00a261a441a

SHA1
2c55c2188ac7afafa3b1cc0a4163052afbd004ea

SHA256
8ff114f4e57c66fc16227c1d26837bb55327aa4badbefa41ffba8e9563b01324

SHA512
f7299850bff0f6d5974c2e4deec7864b002e834ea0871b69ef66b1ab07ba22a6dceccd16455b3cb27e2d432b814fecfc7811aa692a89c444917f2b59075c751d

Download Submit
\Windows\system\DKcDtob.exe

Filesize
1.7MB

MD5
8785b18c0e413b789a0365c18d7562f3

SHA1
185692538c5016c812a973daf30228635a67711c

SHA256
2060f6de4feed0be67d82ff4927746271b55630b4f8ad56dc672fc1a8ab2b03f

SHA512
5682cbff3d8f88a61c613210d98d67fb69c4bff70b2a324a1fb50ed85c96287ff4e084dfdaf46f5762e5e50cd91355c3f3bfb7a9d585b86660ba8fb89953b524

Download Submit
\Windows\system\JkhfxnV.exe

Filesize
1.7MB

MD5
a4c937218ddc789ec776969363c83a7d

SHA1
98bc3808e518b63ca300d75bd1a5b27a78306d59

SHA256
e286d54d226f9109a0b14dfd74720a657f473ba30f2fa82c5fb6fa304c4a5af0

SHA512
fbccf3d162d3f28bbe36d27ea4fddb6d2a46c0e3ad3ee91fdd6b7460de5e790dd8dc23741ef59b72b51748bd1649a6e048ad77770e6853b64e5a3552e746cb48

Download Submit
\Windows\system\PxuoePz.exe

Filesize
1.7MB

MD5
17c779ed38255af0a2296993de8f53eb

SHA1
92b1f20e694acfe0be89e695b1673b874c5e2ce9

SHA256
ccb2ef1e6dace1df881353769b23683b996ef2d528233ca2e072c3edcd609913

SHA512
18c127c768ae7acd2759b5fd9732856fd621d6fe761601ca02a23fde50d09d068af916bb0e144f4df8b7379a93fa36941dd470eba9bcd8d52fa4865fb237fbdd

Download Submit
\Windows\system\QDTlNFH.exe

Filesize
1.7MB

MD5
bf6c7b8609535d454bf955fd4ca57138

SHA1
43922075b99914c69d6386e5d2b996bdc8591056

SHA256
258943f1ddd0f84c02231e24a80dfb24f75a5ec0e9468afb707e47e404acf201

SHA512
e1d30b80fe95ae83fb5c7b9ba72f18f5fd9f5a45a861d6fd000d3f9e5ced69d6db969948b92034aee5bc1cd29ac3413d4b6fc9cc8cd20378d727003fbdfb1b5a

Download Submit
\Windows\system\SRGpqmx.exe

Filesize
1.7MB

MD5
0e15b3035d5540721bd54587108c503f

SHA1
183677b93b5b800e990d273339142c2ed75041c5

SHA256
504dba1b638904d904dbc37d8f8bf4ee8dcff3fd0bf8cc3f86bcd734fe4824a9

SHA512
f7413d0b770ba4eca05226bcf04ab71f539342b69bdd69637a7474e8987faca551bfeaa7240d59f9e3044394ceb8bd4df07bc4395054c8de20a29101c92b25e5

Download Submit
\Windows\system\awWIXja.exe

Filesize
1.7MB

MD5
f3e53af4929a78afe135244f648e2910

SHA1
af3972681971937405820497c60ffc56f6fcf8b2

SHA256
725aef22cdb6567b877b3277da3421bd7a0ae75061593858675f5b7bb72a6fa7

SHA512
0c6a84979e41aec230770fa9dc5daf411a4fefd4ead3613f9f9f6052aa4b34885a072309f5c5de5812a114803962dc6aa4ff5c6e7ffd5ef42153cac4ad88888a

Download Submit
\Windows\system\cRYoKAa.exe

Filesize
1.7MB

MD5
7af5213756a5472e43279db2b5f20e6e

SHA1
758fc733483d4fb5d114c174118c81570ec1a957

SHA256
58dd71681ab6af574beb828b802dda8ae2f1b0be806255c4f3c8e1b3a451cdb2

SHA512
eb79d50ceca0e96925285a3ffc5202df30d2029b0caf396842a694c1656662871cb2c0f0191544c96d8f68dda28262bea89e3ce36f05452f966156ed9bfab1ea

Download Submit
\Windows\system\cUJYrVC.exe

Filesize
1.7MB

MD5
62d12844d800cb45d853f9a5b405ef03

SHA1
05bb9aba5a889104fa449a74f73101ba5dd34038

SHA256
60bcfe1fad75543e3e421a1d38657bfcebcc7379bdf6bd6ba9eb3b65ce79d51e

SHA512
a3a06ad88ebaf24a46a33fdbc7b25a6b619f9986326d1b57e93c5262753953f3a95490548295d9b933dae782cc497827138d47942b5319ae271f4465fddb415c

Download Submit
\Windows\system\dQSjizG.exe

Filesize
1.7MB

MD5
c7d195845c6407852d8acf7571797164

SHA1
35c3da5e033ffe281518c5a7c6c72b020f676d6d

SHA256
b4749bbf3324c7c7b8aa5424eee292c8d19f65fd0569b113fa75273fdf1e8a27

SHA512
2eac284e9878d0ea37d4cb76a7c189ab12cb39b0487c59f04c73ef7f3b977347e32e0aed57b37c86e1c2110f22b502bbd2b963cd55d044b9576db948f9e9c81d

Download Submit
\Windows\system\lbgdZCx.exe

Filesize
1.7MB

MD5
e89a93e6dc448b31abf7136786c61adc

SHA1
468a615d29671ddca069b3f6c5ba896da6559922

SHA256
d4377f80d34863e692c45003c8766060271559d090cd748b3d4866ea4642ad81

SHA512
f56b42420253ee182074a929e6ad7065d333059ec09236ba580f9b772361825ab5032eb9eae26d1020589fe5209fbea8c022e4e136fb0f4244cfd41e91fd8bc5

Download Submit
\Windows\system\mJRtjXw.exe

Filesize
1.7MB

MD5
110410014903c9b3cba280daa685e98f

SHA1
6b592a176983b518c45f5f3c7d116d6631cea5e4

SHA256
8ea499248745e626a0fdfe4c9273bb1ee54db569b01b91fd2ad3cc67ca56cc40

SHA512
27f0e35e2873cce010e1d2c2214a1aba9d9f004783badef08b252bbe2f3a09a29e569a406f2e70a52867e961dea145e9b9c7674cd10689ae48252d49516a608d

Download Submit
\Windows\system\qOJcUXM.exe

Filesize
1.7MB

MD5
6401dadfadfa783b0035b67ccd4d7790

SHA1
f345b3682b6a25b4c160844fc4674132c562f559

SHA256
7208df80dbd249abc0e81bab76804de2c12bc77e4bfe4fc935975c96148aa588

SHA512
4d57fda01db583bcabe7c26d08e63daa8fffb844584b0a85b5a255079de398750e16e3e9ca31474b2ad56b66ca64e7851806f15d08aef31bca0c3253b6ec00d0

Download Submit
\Windows\system\sioLcta.exe

Filesize
1.7MB

MD5
d49dd82a145c9be4206eea7ad79cea04

SHA1
31207097433a4424c4078cb28f1d499d58ff9076

SHA256
6a96b97ddd352b5740a256ad3c5e93c0561c8e675533167db0ec41d550787907

SHA512
65d9b4e446e22c275ddc70e1f231385217738d05e8c78b7ad04c92d098462b97fa1952491ff8d696aa4757248989929c0584b376a229f3ec85174bc7fb36b2e4

Download Submit
memory/1160-189-0x000000013FFA0000-0x0000000140392000-memory.dmp

Filesize
3.9MB

Download
memory/1160-186-0x000000013F860000-0x000000013FC52000-memory.dmp

Filesize
3.9MB

Download
memory/1160-162-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-188-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-0-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/1160-1-0x000000013F330000-0x000000013F722000-memory.dmp

Filesize
3.9MB

Download
memory/1160-88-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-190-0x000000013F8B0000-0x000000013FCA2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-6-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/1160-187-0x000000013F7D0000-0x000000013FBC2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-193-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-110-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-184-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-36-0x0000000002FD0000-0x00000000033C2000-memory.dmp

Filesize
3.9MB

Download
memory/1160-191-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1664-151-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

Filesize
2.9MB

Download
memory/1664-153-0x00000000026D0000-0x00000000026D8000-memory.dmp

Filesize
32KB

Download
memory/1664-170-0x0000000002BB0000-0x0000000002C30000-memory.dmp

Filesize
512KB

Download
memory/2184-49-0x000000013F570000-0x000000013F962000-memory.dmp

Filesize
3.9MB

Download
memory/2396-9-0x000000013FC60000-0x0000000140052000-memory.dmp

Filesize
3.9MB

Download
memory/2448-185-0x000000013FF40000-0x0000000140332000-memory.dmp

Filesize
3.9MB

Download
memory/2592-182-0x000000013F080000-0x000000013F472000-memory.dmp

Filesize
3.9MB

Download
memory/2692-192-0x000000013F340000-0x000000013F732000-memory.dmp

Filesize
3.9MB

Download
memory/2700-183-0x000000013FB00000-0x000000013FEF2000-memory.dmp

Filesize
3.9MB

Download
memory/2784-169-0x000000013F470000-0x000000013F862000-memory.dmp

Filesize
3.9MB

Download