xmrig | f78838c8d146ebc80d404dcb66a95291bdfc47512d40d806cb5434cd40c76e03

Analysis

max time kernel
9s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 04:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
Size

1.8MB
MD5

026e03ae7e11f421ba84bdd83bd0a729
SHA1

ffb28268302192a1cd7ff534245f905c44f671fb
SHA256

f78838c8d146ebc80d404dcb66a95291bdfc47512d40d806cb5434cd40c76e03
SHA512

b823fff418f3ea0e61e90155b04e6dd1c47b9042b46008724d97c74042f37d30ddca5902f66b1f69ae9f79ff7b60f9b86cdfa40f9956d97f8ff687cd1e8ef0e9
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82SflDrlL:NABk

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2888-8-0x000000013F270000-0x000000013F662000-memory.dmp	xmrig
behavioral1/memory/2588-27-0x000000013F100000-0x000000013F4F2000-memory.dmp	xmrig
behavioral1/memory/2372-48-0x000000013F950000-0x000000013FD42000-memory.dmp	xmrig
behavioral1/memory/2384-39-0x000000013FC20000-0x0000000140012000-memory.dmp	xmrig
behavioral1/memory/2244-809-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	xmrig
behavioral1/memory/1252-810-0x000000013FC00000-0x000000013FFF2000-memory.dmp	xmrig
behavioral1/memory/1248-812-0x000000013FFE0000-0x00000001403D2000-memory.dmp	xmrig
behavioral1/memory/1040-2112-0x000000013F900000-0x000000013FCF2000-memory.dmp	xmrig
behavioral1/memory/2816-55-0x000000013F620000-0x000000013FA12000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2888	ztvqafO.exe
2564	KmFOoOc.exe
2588	iTugGXo.exe
2384	IijZhRT.exe
2372	GCGymZy.exe
2816	ZyFFrWz.exe
2244	TAdlBbY.exe
1252	ilVJNWL.exe
1248	zmnQkBr.exe
2592	SVMLzuz.exe
1232	qvYwASk.exe
112	TzZrOGy.exe
2248	uBwzqFz.exe
300	PrvADZI.exe
376	NSPFiXr.exe
1560	xUMKAjZ.exe
1596	CoGEvUK.exe
1644	flUnloL.exe
1648	ASEvzVX.exe
780	JtBeKez.exe
2044	hoEnJRl.exe
2688	pHRbtGr.exe
2024	LDchFtr.exe
2968	oXucioe.exe
2400	LkrikEW.exe
3020	xtVcUdA.exe
2204	riPbYLW.exe
1204	GBDvfkr.exe
2208	qXkwUPq.exe
1420	AKgnyNk.exe
3000	pvmMqPo.exe
2340	yLqgksq.exe
2596	yqhZBrJ.exe
2064	QThgcQW.exe
2316	VKPyhmO.exe
1012	bdkyitI.exe
2932	PSaMCrZ.exe
2848	WbbEuEA.exe
1160	ioIKOxf.exe
2880	grDHNri.exe
2620	fFsyAxv.exe
880	FuUfLLZ.exe
2300	xheydhW.exe
1496	CrltbOU.exe
2324	PBAirnh.exe
1312	AYjkDoZ.exe
936	LWXANHk.exe
808	LjcBgIR.exe
804	oOOkfRj.exe
1924	dzkFzrR.exe
960	YjPLOOy.exe
1052	FxwqRkq.exe
2060	DTtoOSI.exe
1708	yiIMood.exe
2232	SClbafn.exe
1932	fGiaRSA.exe
1996	VojTbFS.exe
616	TwoVJBl.exe
2892	CehGizv.exe
2980	mqjTDFQ.exe
2692	Xwhcfig.exe
892	iSaMncC.exe
2288	iYrBmon.exe
2712	CALmKwm.exe

Loads dropped DLL 64 IoCs

pid	Process
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1040-0-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x000a0000000143fa-5.dat	upx
behavioral1/memory/2888-8-0x000000013F270000-0x000000013F662000-memory.dmp	upx
behavioral1/files/0x000c0000000167ef-17.dat	upx
behavioral1/memory/2564-19-0x000000013FDF0000-0x00000001401E2000-memory.dmp	upx
behavioral1/memory/2588-27-0x000000013F100000-0x000000013F4F2000-memory.dmp	upx
behavioral1/files/0x0008000000016cfe-29.dat	upx
behavioral1/files/0x001400000000549e-16.dat	upx
behavioral1/files/0x0007000000016d06-45.dat	upx
behavioral1/memory/2372-48-0x000000013F950000-0x000000013FD42000-memory.dmp	upx
behavioral1/memory/2384-39-0x000000013FC20000-0x0000000140012000-memory.dmp	upx
behavioral1/files/0x0007000000016d0e-51.dat	upx
behavioral1/files/0x0034000000016cc9-59.dat	upx
behavioral1/files/0x000a000000016d1f-61.dat	upx
behavioral1/files/0x0006000000017474-71.dat	upx
behavioral1/files/0x0009000000018648-76.dat	upx
behavioral1/files/0x00050000000186c4-91.dat	upx
behavioral1/files/0x00050000000186cf-95.dat	upx
behavioral1/files/0x0005000000018717-103.dat	upx
behavioral1/files/0x0006000000018ffa-119.dat	upx
behavioral1/files/0x0005000000019250-131.dat	upx
behavioral1/files/0x0005000000019316-139.dat	upx
behavioral1/files/0x00050000000193e7-155.dat	upx
behavioral1/memory/2244-809-0x000000013F6B0000-0x000000013FAA2000-memory.dmp	upx
behavioral1/memory/1252-810-0x000000013FC00000-0x000000013FFF2000-memory.dmp	upx
behavioral1/memory/1248-812-0x000000013FFE0000-0x00000001403D2000-memory.dmp	upx
behavioral1/memory/1040-2112-0x000000013F900000-0x000000013FCF2000-memory.dmp	upx
behavioral1/files/0x00050000000193eb-159.dat	upx
behavioral1/files/0x00050000000193a1-151.dat	upx
behavioral1/files/0x000500000001938d-147.dat	upx
behavioral1/files/0x0005000000019383-143.dat	upx
behavioral1/files/0x0005000000019260-135.dat	upx
behavioral1/files/0x0005000000019233-127.dat	upx
behavioral1/files/0x000500000001922d-123.dat	upx
behavioral1/files/0x000500000001876e-115.dat	upx
behavioral1/files/0x0005000000018765-111.dat	upx
behavioral1/files/0x0005000000018756-107.dat	upx
behavioral1/files/0x00050000000186dd-99.dat	upx
behavioral1/files/0x0005000000018664-87.dat	upx
behavioral1/files/0x000500000001865b-83.dat	upx
behavioral1/files/0x0031000000018649-79.dat	upx
behavioral1/files/0x0008000000017465-67.dat	upx
behavioral1/memory/2816-55-0x000000013F620000-0x000000013FA12000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\wXOugHa.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\JgkRJbF.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\JmclPEY.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ViMrWhc.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\QVblDSW.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\VaAOcOp.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\qHPGKFJ.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\PLZNkJl.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\jtpEiPb.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\UyRDzay.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\qHWqFPU.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\kksGkMN.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\zJifzxu.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\YwlJwEf.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ADrVnpM.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\qWOGQiw.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\kiXBhuD.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\STEOJXX.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\yUOyrQB.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\dnncPEg.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\JakXBCz.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\hpYJutj.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\elHafYq.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\RSashvP.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ZrvhoAE.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ZJGepcA.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\eNkWKIp.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\jsEBFss.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\LMRtnRF.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\JohHZgE.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ZZqkIrP.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\zFHgJaw.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\HPYPeUz.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\OyifQDB.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\Nzepktx.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\CZKvNdX.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\lRHdRGL.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\QdJZDCk.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\URdltik.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\NrRRdfA.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\YLdotKc.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\gGRxEPY.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\mOpvgNG.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\fGiaRSA.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\iSaMncC.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\sDMuhkZ.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\nOymiHB.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\WbbEuEA.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\CALmKwm.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ORZVKrM.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\RcDlLwb.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ubLfNnL.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\PuecJwi.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\mwDxQvn.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\ERgaurG.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\CwzREIE.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\THMrVmK.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\vgJrXvw.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\vJFnQEr.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\PHXQiAv.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\gKELBCQ.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\hTHaJsM.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\hdDcMzP.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
File created	C:\Windows\System\zkswSNE.exe	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2176	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
Token: SeDebugPrivilege	2176	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2176	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	29
PID 1040 wrote to memory of 2176	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	29
PID 1040 wrote to memory of 2176	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	29
PID 1040 wrote to memory of 2888	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	30
PID 1040 wrote to memory of 2888	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	30
PID 1040 wrote to memory of 2888	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	30
PID 1040 wrote to memory of 2564	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	31
PID 1040 wrote to memory of 2564	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	31
PID 1040 wrote to memory of 2564	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	31
PID 1040 wrote to memory of 2588	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	32
PID 1040 wrote to memory of 2588	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	32
PID 1040 wrote to memory of 2588	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	32
PID 1040 wrote to memory of 2384	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	33
PID 1040 wrote to memory of 2384	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	33
PID 1040 wrote to memory of 2384	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	33
PID 1040 wrote to memory of 2372	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	34
PID 1040 wrote to memory of 2372	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	34
PID 1040 wrote to memory of 2372	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	34
PID 1040 wrote to memory of 2816	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	35
PID 1040 wrote to memory of 2816	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	35
PID 1040 wrote to memory of 2816	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	35
PID 1040 wrote to memory of 2244	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	36
PID 1040 wrote to memory of 2244	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	36
PID 1040 wrote to memory of 2244	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	36
PID 1040 wrote to memory of 1252	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	37
PID 1040 wrote to memory of 1252	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	37
PID 1040 wrote to memory of 1252	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	37
PID 1040 wrote to memory of 1248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	38
PID 1040 wrote to memory of 1248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	38
PID 1040 wrote to memory of 1248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	38
PID 1040 wrote to memory of 2592	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	39
PID 1040 wrote to memory of 2592	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	39
PID 1040 wrote to memory of 2592	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	39
PID 1040 wrote to memory of 1232	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	40
PID 1040 wrote to memory of 1232	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	40
PID 1040 wrote to memory of 1232	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	40
PID 1040 wrote to memory of 112	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	41
PID 1040 wrote to memory of 112	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	41
PID 1040 wrote to memory of 112	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	41
PID 1040 wrote to memory of 2248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	42
PID 1040 wrote to memory of 2248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	42
PID 1040 wrote to memory of 2248	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	42
PID 1040 wrote to memory of 300	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	43
PID 1040 wrote to memory of 300	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	43
PID 1040 wrote to memory of 300	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	43
PID 1040 wrote to memory of 376	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	44
PID 1040 wrote to memory of 376	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	44
PID 1040 wrote to memory of 376	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	44
PID 1040 wrote to memory of 1560	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	45
PID 1040 wrote to memory of 1560	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	45
PID 1040 wrote to memory of 1560	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	45
PID 1040 wrote to memory of 1596	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	46
PID 1040 wrote to memory of 1596	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	46
PID 1040 wrote to memory of 1596	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	46
PID 1040 wrote to memory of 1644	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	47
PID 1040 wrote to memory of 1644	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	47
PID 1040 wrote to memory of 1644	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	47
PID 1040 wrote to memory of 1648	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	48
PID 1040 wrote to memory of 1648	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	48
PID 1040 wrote to memory of 1648	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	48
PID 1040 wrote to memory of 780	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	49
PID 1040 wrote to memory of 780	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	49
PID 1040 wrote to memory of 780	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	49
PID 1040 wrote to memory of 2044	1040	026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\026e03ae7e11f421ba84bdd83bd0a729_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2176
- C:\Windows\System\ztvqafO.exe
  C:\Windows\System\ztvqafO.exe
  2⤵
  - Executes dropped EXE
  PID:2888
- C:\Windows\System\KmFOoOc.exe
  C:\Windows\System\KmFOoOc.exe
  2⤵
  - Executes dropped EXE
  PID:2564
- C:\Windows\System\iTugGXo.exe
  C:\Windows\System\iTugGXo.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\IijZhRT.exe
  C:\Windows\System\IijZhRT.exe
  2⤵
  - Executes dropped EXE
  PID:2384
- C:\Windows\System\GCGymZy.exe
  C:\Windows\System\GCGymZy.exe
  2⤵
  - Executes dropped EXE
  PID:2372
- C:\Windows\System\ZyFFrWz.exe
  C:\Windows\System\ZyFFrWz.exe
  2⤵
  - Executes dropped EXE
  PID:2816
- C:\Windows\System\TAdlBbY.exe
  C:\Windows\System\TAdlBbY.exe
  2⤵
  - Executes dropped EXE
  PID:2244
- C:\Windows\System\ilVJNWL.exe
  C:\Windows\System\ilVJNWL.exe
  2⤵
  - Executes dropped EXE
  PID:1252
- C:\Windows\System\zmnQkBr.exe
  C:\Windows\System\zmnQkBr.exe
  2⤵
  - Executes dropped EXE
  PID:1248
- C:\Windows\System\SVMLzuz.exe
  C:\Windows\System\SVMLzuz.exe
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\System\qvYwASk.exe
  C:\Windows\System\qvYwASk.exe
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\System\TzZrOGy.exe
  C:\Windows\System\TzZrOGy.exe
  2⤵
  - Executes dropped EXE
  PID:112
- C:\Windows\System\uBwzqFz.exe
  C:\Windows\System\uBwzqFz.exe
  2⤵
  - Executes dropped EXE
  PID:2248
- C:\Windows\System\PrvADZI.exe
  C:\Windows\System\PrvADZI.exe
  2⤵
  - Executes dropped EXE
  PID:300
- C:\Windows\System\NSPFiXr.exe
  C:\Windows\System\NSPFiXr.exe
  2⤵
  - Executes dropped EXE
  PID:376
- C:\Windows\System\xUMKAjZ.exe
  C:\Windows\System\xUMKAjZ.exe
  2⤵
  - Executes dropped EXE
  PID:1560
- C:\Windows\System\CoGEvUK.exe
  C:\Windows\System\CoGEvUK.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\System\flUnloL.exe
  C:\Windows\System\flUnloL.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\System\ASEvzVX.exe
  C:\Windows\System\ASEvzVX.exe
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Windows\System\JtBeKez.exe
  C:\Windows\System\JtBeKez.exe
  2⤵
  - Executes dropped EXE
  PID:780
- C:\Windows\System\hoEnJRl.exe
  C:\Windows\System\hoEnJRl.exe
  2⤵
  - Executes dropped EXE
  PID:2044
- C:\Windows\System\pHRbtGr.exe
  C:\Windows\System\pHRbtGr.exe
  2⤵
  - Executes dropped EXE
  PID:2688
- C:\Windows\System\LDchFtr.exe
  C:\Windows\System\LDchFtr.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\oXucioe.exe
  C:\Windows\System\oXucioe.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\LkrikEW.exe
  C:\Windows\System\LkrikEW.exe
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Windows\System\xtVcUdA.exe
  C:\Windows\System\xtVcUdA.exe
  2⤵
  - Executes dropped EXE
  PID:3020
- C:\Windows\System\riPbYLW.exe
  C:\Windows\System\riPbYLW.exe
  2⤵
  - Executes dropped EXE
  PID:2204
- C:\Windows\System\GBDvfkr.exe
  C:\Windows\System\GBDvfkr.exe
  2⤵
  - Executes dropped EXE
  PID:1204
- C:\Windows\System\qXkwUPq.exe
  C:\Windows\System\qXkwUPq.exe
  2⤵
  - Executes dropped EXE
  PID:2208
- C:\Windows\System\AKgnyNk.exe
  C:\Windows\System\AKgnyNk.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\pvmMqPo.exe
  C:\Windows\System\pvmMqPo.exe
  2⤵
  - Executes dropped EXE
  PID:3000
- C:\Windows\System\yLqgksq.exe
  C:\Windows\System\yLqgksq.exe
  2⤵
  - Executes dropped EXE
  PID:2340
- C:\Windows\System\yqhZBrJ.exe
  C:\Windows\System\yqhZBrJ.exe
  2⤵
  - Executes dropped EXE
  PID:2596
- C:\Windows\System\QThgcQW.exe
  C:\Windows\System\QThgcQW.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\VKPyhmO.exe
  C:\Windows\System\VKPyhmO.exe
  2⤵
  - Executes dropped EXE
  PID:2316
- C:\Windows\System\bdkyitI.exe
  C:\Windows\System\bdkyitI.exe
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Windows\System\PSaMCrZ.exe
  C:\Windows\System\PSaMCrZ.exe
  2⤵
  - Executes dropped EXE
  PID:2932
- C:\Windows\System\WbbEuEA.exe
  C:\Windows\System\WbbEuEA.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\ioIKOxf.exe
  C:\Windows\System\ioIKOxf.exe
  2⤵
  - Executes dropped EXE
  PID:1160
- C:\Windows\System\grDHNri.exe
  C:\Windows\System\grDHNri.exe
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\System\fFsyAxv.exe
  C:\Windows\System\fFsyAxv.exe
  2⤵
  - Executes dropped EXE
  PID:2620
- C:\Windows\System\FuUfLLZ.exe
  C:\Windows\System\FuUfLLZ.exe
  2⤵
  - Executes dropped EXE
  PID:880
- C:\Windows\System\xheydhW.exe
  C:\Windows\System\xheydhW.exe
  2⤵
  - Executes dropped EXE
  PID:2300
- C:\Windows\System\CrltbOU.exe
  C:\Windows\System\CrltbOU.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\PBAirnh.exe
  C:\Windows\System\PBAirnh.exe
  2⤵
  - Executes dropped EXE
  PID:2324
- C:\Windows\System\AYjkDoZ.exe
  C:\Windows\System\AYjkDoZ.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\LWXANHk.exe
  C:\Windows\System\LWXANHk.exe
  2⤵
  - Executes dropped EXE
  PID:936
- C:\Windows\System\LjcBgIR.exe
  C:\Windows\System\LjcBgIR.exe
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Windows\System\oOOkfRj.exe
  C:\Windows\System\oOOkfRj.exe
  2⤵
  - Executes dropped EXE
  PID:804
- C:\Windows\System\dzkFzrR.exe
  C:\Windows\System\dzkFzrR.exe
  2⤵
  - Executes dropped EXE
  PID:1924
- C:\Windows\System\YjPLOOy.exe
  C:\Windows\System\YjPLOOy.exe
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Windows\System\FxwqRkq.exe
  C:\Windows\System\FxwqRkq.exe
  2⤵
  - Executes dropped EXE
  PID:1052
- C:\Windows\System\DTtoOSI.exe
  C:\Windows\System\DTtoOSI.exe
  2⤵
  - Executes dropped EXE
  PID:2060
- C:\Windows\System\yiIMood.exe
  C:\Windows\System\yiIMood.exe
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\System\SClbafn.exe
  C:\Windows\System\SClbafn.exe
  2⤵
  - Executes dropped EXE
  PID:2232
- C:\Windows\System\fGiaRSA.exe
  C:\Windows\System\fGiaRSA.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- C:\Windows\System\VojTbFS.exe
  C:\Windows\System\VojTbFS.exe
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Windows\System\TwoVJBl.exe
  C:\Windows\System\TwoVJBl.exe
  2⤵
  - Executes dropped EXE
  PID:616
- C:\Windows\System\CehGizv.exe
  C:\Windows\System\CehGizv.exe
  2⤵
  - Executes dropped EXE
  PID:2892
- C:\Windows\System\mqjTDFQ.exe
  C:\Windows\System\mqjTDFQ.exe
  2⤵
  - Executes dropped EXE
  PID:2980
- C:\Windows\System\Xwhcfig.exe
  C:\Windows\System\Xwhcfig.exe
  2⤵
  - Executes dropped EXE
  PID:2692
- C:\Windows\System\iSaMncC.exe
  C:\Windows\System\iSaMncC.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\iYrBmon.exe
  C:\Windows\System\iYrBmon.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\CALmKwm.exe
  C:\Windows\System\CALmKwm.exe
  2⤵
  - Executes dropped EXE
  PID:2712
- C:\Windows\System\tdfJnmU.exe
  C:\Windows\System\tdfJnmU.exe
  2⤵
  PID:1352
- C:\Windows\System\cvPbtYB.exe
  C:\Windows\System\cvPbtYB.exe
  2⤵
  PID:2080
- C:\Windows\System\KAYOthA.exe
  C:\Windows\System\KAYOthA.exe
  2⤵
  PID:2056
- C:\Windows\System\qCIXGnY.exe
  C:\Windows\System\qCIXGnY.exe
  2⤵
  PID:1540
- C:\Windows\System\vgJrXvw.exe
  C:\Windows\System\vgJrXvw.exe
  2⤵
  PID:2708
- C:\Windows\System\kjFgHot.exe
  C:\Windows\System\kjFgHot.exe
  2⤵
  PID:2636
- C:\Windows\System\wxKEIaN.exe
  C:\Windows\System\wxKEIaN.exe
  2⤵
  PID:2548
- C:\Windows\System\qKbJmNY.exe
  C:\Windows\System\qKbJmNY.exe
  2⤵
  PID:2088
- C:\Windows\System\gXqzZlD.exe
  C:\Windows\System\gXqzZlD.exe
  2⤵
  PID:2508
- C:\Windows\System\QOnCmdF.exe
  C:\Windows\System\QOnCmdF.exe
  2⤵
  PID:2356
- C:\Windows\System\yynqfiN.exe
  C:\Windows\System\yynqfiN.exe
  2⤵
  PID:2392
- C:\Windows\System\TUMXvXQ.exe
  C:\Windows\System\TUMXvXQ.exe
  2⤵
  PID:1512
- C:\Windows\System\OMLYmxx.exe
  C:\Windows\System\OMLYmxx.exe
  2⤵
  PID:856
- C:\Windows\System\HcUXeza.exe
  C:\Windows\System\HcUXeza.exe
  2⤵
  PID:2604
- C:\Windows\System\muZGKIr.exe
  C:\Windows\System\muZGKIr.exe
  2⤵
  PID:2148
- C:\Windows\System\GRZLDGo.exe
  C:\Windows\System\GRZLDGo.exe
  2⤵
  PID:1356
- C:\Windows\System\lMcxcLB.exe
  C:\Windows\System\lMcxcLB.exe
  2⤵
  PID:1228
- C:\Windows\System\waeLVDr.exe
  C:\Windows\System\waeLVDr.exe
  2⤵
  PID:380
- C:\Windows\System\uxEyfFQ.exe
  C:\Windows\System\uxEyfFQ.exe
  2⤵
  PID:544
- C:\Windows\System\PVltRyO.exe
  C:\Windows\System\PVltRyO.exe
  2⤵
  PID:2272
- C:\Windows\System\CFXzSPV.exe
  C:\Windows\System\CFXzSPV.exe
  2⤵
  PID:860
- C:\Windows\System\tMethYt.exe
  C:\Windows\System\tMethYt.exe
  2⤵
  PID:2524
- C:\Windows\System\OwjcElc.exe
  C:\Windows\System\OwjcElc.exe
  2⤵
  PID:2700
- C:\Windows\System\kjJLBLV.exe
  C:\Windows\System\kjJLBLV.exe
  2⤵
  PID:2012
- C:\Windows\System\jdMgNYU.exe
  C:\Windows\System\jdMgNYU.exe
  2⤵
  PID:3036
- C:\Windows\System\jAufSee.exe
  C:\Windows\System\jAufSee.exe
  2⤵
  PID:596
- C:\Windows\System\MyzxPAD.exe
  C:\Windows\System\MyzxPAD.exe
  2⤵
  PID:2680
- C:\Windows\System\MDBiYla.exe
  C:\Windows\System\MDBiYla.exe
  2⤵
  PID:2312
- C:\Windows\System\aukbybS.exe
  C:\Windows\System\aukbybS.exe
  2⤵
  PID:2732
- C:\Windows\System\XHAiCgP.exe
  C:\Windows\System\XHAiCgP.exe
  2⤵
  PID:2736
- C:\Windows\System\wOGciwl.exe
  C:\Windows\System\wOGciwl.exe
  2⤵
  PID:2752
- C:\Windows\System\PSLgFOj.exe
  C:\Windows\System\PSLgFOj.exe
  2⤵
  PID:496
- C:\Windows\System\lTurkQm.exe
  C:\Windows\System\lTurkQm.exe
  2⤵
  PID:1604
- C:\Windows\System\LexRUdu.exe
  C:\Windows\System\LexRUdu.exe
  2⤵
  PID:1292
- C:\Windows\System\bdrYTXV.exe
  C:\Windows\System\bdrYTXV.exe
  2⤵
  PID:768
- C:\Windows\System\CZKvNdX.exe
  C:\Windows\System\CZKvNdX.exe
  2⤵
  PID:772
- C:\Windows\System\hzmAXOp.exe
  C:\Windows\System\hzmAXOp.exe
  2⤵
  PID:2992
- C:\Windows\System\aBnTwgU.exe
  C:\Windows\System\aBnTwgU.exe
  2⤵
  PID:1364
- C:\Windows\System\JkBzoYc.exe
  C:\Windows\System\JkBzoYc.exe
  2⤵
  PID:1964
- C:\Windows\System\WhMfJAV.exe
  C:\Windows\System\WhMfJAV.exe
  2⤵
  PID:2768
- C:\Windows\System\aICWtFw.exe
  C:\Windows\System\aICWtFw.exe
  2⤵
  PID:1944
- C:\Windows\System\fjQZGvB.exe
  C:\Windows\System\fjQZGvB.exe
  2⤵
  PID:1208
- C:\Windows\System\AMOSKWF.exe
  C:\Windows\System\AMOSKWF.exe
  2⤵
  PID:2268
- C:\Windows\System\ZTgawCa.exe
  C:\Windows\System\ZTgawCa.exe
  2⤵
  PID:1856
- C:\Windows\System\ZqCjiuW.exe
  C:\Windows\System\ZqCjiuW.exe
  2⤵
  PID:1656
- C:\Windows\System\AYHdJWc.exe
  C:\Windows\System\AYHdJWc.exe
  2⤵
  PID:2632
- C:\Windows\System\NuStwej.exe
  C:\Windows\System\NuStwej.exe
  2⤵
  PID:2684
- C:\Windows\System\FLOIZop.exe
  C:\Windows\System\FLOIZop.exe
  2⤵
  PID:2540
- C:\Windows\System\VexpGKc.exe
  C:\Windows\System\VexpGKc.exe
  2⤵
  PID:2132
- C:\Windows\System\ppxdiEI.exe
  C:\Windows\System\ppxdiEI.exe
  2⤵
  PID:2348
- C:\Windows\System\RLuacJT.exe
  C:\Windows\System\RLuacJT.exe
  2⤵
  PID:2104
- C:\Windows\System\vTSECCr.exe
  C:\Windows\System\vTSECCr.exe
  2⤵
  PID:1588
- C:\Windows\System\sDMuhkZ.exe
  C:\Windows\System\sDMuhkZ.exe
  2⤵
  PID:2124
- C:\Windows\System\bjPySMN.exe
  C:\Windows\System\bjPySMN.exe
  2⤵
  PID:2420
- C:\Windows\System\EeEsebm.exe
  C:\Windows\System\EeEsebm.exe
  2⤵
  PID:1972
- C:\Windows\System\dAXxXUv.exe
  C:\Windows\System\dAXxXUv.exe
  2⤵
  PID:1404
- C:\Windows\System\bfkapWE.exe
  C:\Windows\System\bfkapWE.exe
  2⤵
  PID:1480
- C:\Windows\System\qWOGQiw.exe
  C:\Windows\System\qWOGQiw.exe
  2⤵
  PID:712
- C:\Windows\System\qKKLbxB.exe
  C:\Windows\System\qKKLbxB.exe
  2⤵
  PID:3052
- C:\Windows\System\YLdotKc.exe
  C:\Windows\System\YLdotKc.exe
  2⤵
  PID:1888
- C:\Windows\System\BtnbQtA.exe
  C:\Windows\System\BtnbQtA.exe
  2⤵
  PID:1660
- C:\Windows\System\MyBozOO.exe
  C:\Windows\System\MyBozOO.exe
  2⤵
  PID:920
- C:\Windows\System\yMIIVbm.exe
  C:\Windows\System\yMIIVbm.exe
  2⤵
  PID:1624
- C:\Windows\System\yPdXobg.exe
  C:\Windows\System\yPdXobg.exe
  2⤵
  PID:2920
- C:\Windows\System\qnKeQZg.exe
  C:\Windows\System\qnKeQZg.exe
  2⤵
  PID:2292
- C:\Windows\System\ufepYwR.exe
  C:\Windows\System\ufepYwR.exe
  2⤵
  PID:3084
- C:\Windows\System\zpOpOgg.exe
  C:\Windows\System\zpOpOgg.exe
  2⤵
  PID:3100
- C:\Windows\System\yrVwTVG.exe
  C:\Windows\System\yrVwTVG.exe
  2⤵
  PID:3116
- C:\Windows\System\ZNxRdXm.exe
  C:\Windows\System\ZNxRdXm.exe
  2⤵
  PID:3132
- C:\Windows\System\gKPXPCr.exe
  C:\Windows\System\gKPXPCr.exe
  2⤵
  PID:3148
- C:\Windows\System\mkDWngC.exe
  C:\Windows\System\mkDWngC.exe
  2⤵
  PID:3164
- C:\Windows\System\TCOFtdT.exe
  C:\Windows\System\TCOFtdT.exe
  2⤵
  PID:3180
- C:\Windows\System\mhUkGpd.exe
  C:\Windows\System\mhUkGpd.exe
  2⤵
  PID:3196
- C:\Windows\System\BToOiZX.exe
  C:\Windows\System\BToOiZX.exe
  2⤵
  PID:3212
- C:\Windows\System\JpTIhAl.exe
  C:\Windows\System\JpTIhAl.exe
  2⤵
  PID:3228
- C:\Windows\System\pXntTDb.exe
  C:\Windows\System\pXntTDb.exe
  2⤵
  PID:3244
- C:\Windows\System\uDQpTqa.exe
  C:\Windows\System\uDQpTqa.exe
  2⤵
  PID:3260
- C:\Windows\System\OTQdRll.exe
  C:\Windows\System\OTQdRll.exe
  2⤵
  PID:3276
- C:\Windows\System\tXGzHhA.exe
  C:\Windows\System\tXGzHhA.exe
  2⤵
  PID:3292
- C:\Windows\System\MxYlpyW.exe
  C:\Windows\System\MxYlpyW.exe
  2⤵
  PID:3308
- C:\Windows\System\XJtxdiJ.exe
  C:\Windows\System\XJtxdiJ.exe
  2⤵
  PID:3324
- C:\Windows\System\CKhTDrq.exe
  C:\Windows\System\CKhTDrq.exe
  2⤵
  PID:3340
- C:\Windows\System\lvhOJio.exe
  C:\Windows\System\lvhOJio.exe
  2⤵
  PID:3356
- C:\Windows\System\isOWAeW.exe
  C:\Windows\System\isOWAeW.exe
  2⤵
  PID:3372
- C:\Windows\System\OFOXqWE.exe
  C:\Windows\System\OFOXqWE.exe
  2⤵
  PID:3388
- C:\Windows\System\QjWylBP.exe
  C:\Windows\System\QjWylBP.exe
  2⤵
  PID:3404
- C:\Windows\System\XAaKYsv.exe
  C:\Windows\System\XAaKYsv.exe
  2⤵
  PID:3420
- C:\Windows\System\lbQOzEP.exe
  C:\Windows\System\lbQOzEP.exe
  2⤵
  PID:3436
- C:\Windows\System\ordFnFn.exe
  C:\Windows\System\ordFnFn.exe
  2⤵
  PID:3452
- C:\Windows\System\SWQDaIr.exe
  C:\Windows\System\SWQDaIr.exe
  2⤵
  PID:3468
- C:\Windows\System\lONPgLn.exe
  C:\Windows\System\lONPgLn.exe
  2⤵
  PID:3484
- C:\Windows\System\FKqYGKK.exe
  C:\Windows\System\FKqYGKK.exe
  2⤵
  PID:3500
- C:\Windows\System\uNhnuBS.exe
  C:\Windows\System\uNhnuBS.exe
  2⤵
  PID:3516
- C:\Windows\System\UeLveiM.exe
  C:\Windows\System\UeLveiM.exe
  2⤵
  PID:3532
- C:\Windows\System\tjcPHNq.exe
  C:\Windows\System\tjcPHNq.exe
  2⤵
  PID:3548
- C:\Windows\System\wCNMIWX.exe
  C:\Windows\System\wCNMIWX.exe
  2⤵
  PID:3564
- C:\Windows\System\mqPPrRY.exe
  C:\Windows\System\mqPPrRY.exe
  2⤵
  PID:3580
- C:\Windows\System\TsanyXe.exe
  C:\Windows\System\TsanyXe.exe
  2⤵
  PID:3596
- C:\Windows\System\qktfvFw.exe
  C:\Windows\System\qktfvFw.exe
  2⤵
  PID:3612
- C:\Windows\System\PnQXYlz.exe
  C:\Windows\System\PnQXYlz.exe
  2⤵
  PID:3628
- C:\Windows\System\TdKsHGv.exe
  C:\Windows\System\TdKsHGv.exe
  2⤵
  PID:3644
- C:\Windows\System\odXFejV.exe
  C:\Windows\System\odXFejV.exe
  2⤵
  PID:3660
- C:\Windows\System\fpAePWW.exe
  C:\Windows\System\fpAePWW.exe
  2⤵
  PID:3676
- C:\Windows\System\BnSzIPw.exe
  C:\Windows\System\BnSzIPw.exe
  2⤵
  PID:3692
- C:\Windows\System\YpLYOxy.exe
  C:\Windows\System\YpLYOxy.exe
  2⤵
  PID:3708
- C:\Windows\System\sEZbIAP.exe
  C:\Windows\System\sEZbIAP.exe
  2⤵
  PID:3724
- C:\Windows\System\kTvXNUe.exe
  C:\Windows\System\kTvXNUe.exe
  2⤵
  PID:3740
- C:\Windows\System\yhKRoSm.exe
  C:\Windows\System\yhKRoSm.exe
  2⤵
  PID:3756
- C:\Windows\System\zyRUHaz.exe
  C:\Windows\System\zyRUHaz.exe
  2⤵
  PID:3772
- C:\Windows\System\hdDcMzP.exe
  C:\Windows\System\hdDcMzP.exe
  2⤵
  PID:3788
- C:\Windows\System\pwBEudn.exe
  C:\Windows\System\pwBEudn.exe
  2⤵
  PID:3804
- C:\Windows\System\PLZNkJl.exe
  C:\Windows\System\PLZNkJl.exe
  2⤵
  PID:3820
- C:\Windows\System\skcUiaL.exe
  C:\Windows\System\skcUiaL.exe
  2⤵
  PID:3836
- C:\Windows\System\xHuGfnr.exe
  C:\Windows\System\xHuGfnr.exe
  2⤵
  PID:3852
- C:\Windows\System\eINORVu.exe
  C:\Windows\System\eINORVu.exe
  2⤵
  PID:3868
- C:\Windows\System\IKgcHza.exe
  C:\Windows\System\IKgcHza.exe
  2⤵
  PID:3884
- C:\Windows\System\xPgASUG.exe
  C:\Windows\System\xPgASUG.exe
  2⤵
  PID:3900
- C:\Windows\System\fSkKMMj.exe
  C:\Windows\System\fSkKMMj.exe
  2⤵
  PID:3916
- C:\Windows\System\IwirKeF.exe
  C:\Windows\System\IwirKeF.exe
  2⤵
  PID:3932
- C:\Windows\System\gGRxEPY.exe
  C:\Windows\System\gGRxEPY.exe
  2⤵
  PID:3948
- C:\Windows\System\QdJZDCk.exe
  C:\Windows\System\QdJZDCk.exe
  2⤵
  PID:3964
- C:\Windows\System\YbMAcJr.exe
  C:\Windows\System\YbMAcJr.exe
  2⤵
  PID:3980
- C:\Windows\System\LZkXlJX.exe
  C:\Windows\System\LZkXlJX.exe
  2⤵
  PID:3996
- C:\Windows\System\cldDGXJ.exe
  C:\Windows\System\cldDGXJ.exe
  2⤵
  PID:4012
- C:\Windows\System\rhnQzJL.exe
  C:\Windows\System\rhnQzJL.exe
  2⤵
  PID:4028
- C:\Windows\System\wgsDHcT.exe
  C:\Windows\System\wgsDHcT.exe
  2⤵
  PID:4044
- C:\Windows\System\ghNuzWm.exe
  C:\Windows\System\ghNuzWm.exe
  2⤵
  PID:4060
- C:\Windows\System\fCPehnG.exe
  C:\Windows\System\fCPehnG.exe
  2⤵
  PID:4076
- C:\Windows\System\sDYqZgE.exe
  C:\Windows\System\sDYqZgE.exe
  2⤵
  PID:4092
- C:\Windows\System\Hvxfuqs.exe
  C:\Windows\System\Hvxfuqs.exe
  2⤵
  PID:2512
- C:\Windows\System\QpKAptK.exe
  C:\Windows\System\QpKAptK.exe
  2⤵
  PID:2428
- C:\Windows\System\tucsdjc.exe
  C:\Windows\System\tucsdjc.exe
  2⤵
  PID:1664
- C:\Windows\System\PuecJwi.exe
  C:\Windows\System\PuecJwi.exe
  2⤵
  PID:1632
- C:\Windows\System\DnYALPz.exe
  C:\Windows\System\DnYALPz.exe
  2⤵
  PID:2368
- C:\Windows\System\XIOPyeE.exe
  C:\Windows\System\XIOPyeE.exe
  2⤵
  PID:1952
- C:\Windows\System\nOymiHB.exe
  C:\Windows\System\nOymiHB.exe
  2⤵
  PID:1756
- C:\Windows\System\ftFsjoE.exe
  C:\Windows\System\ftFsjoE.exe
  2⤵
  PID:2952
- C:\Windows\System\HEiDUYH.exe
  C:\Windows\System\HEiDUYH.exe
  2⤵
  PID:2832
- C:\Windows\System\NnQzRfM.exe
  C:\Windows\System\NnQzRfM.exe
  2⤵
  PID:1436
- C:\Windows\System\OoMykPb.exe
  C:\Windows\System\OoMykPb.exe
  2⤵
  PID:1668
- C:\Windows\System\SFliLxq.exe
  C:\Windows\System\SFliLxq.exe
  2⤵
  PID:3096
- C:\Windows\System\ujDBrqG.exe
  C:\Windows\System\ujDBrqG.exe
  2⤵
  PID:3144
- C:\Windows\System\PaapXKm.exe
  C:\Windows\System\PaapXKm.exe
  2⤵
  PID:3176
- C:\Windows\System\SVXjtsH.exe
  C:\Windows\System\SVXjtsH.exe
  2⤵
  PID:3208
- C:\Windows\System\fIRTPUa.exe
  C:\Windows\System\fIRTPUa.exe
  2⤵
  PID:3224
- C:\Windows\System\oyNMLdM.exe
  C:\Windows\System\oyNMLdM.exe
  2⤵
  PID:3256
- C:\Windows\System\oRbCBpo.exe
  C:\Windows\System\oRbCBpo.exe
  2⤵
  PID:3288
- C:\Windows\System\gQByQpf.exe
  C:\Windows\System\gQByQpf.exe
  2⤵
  PID:3332
- C:\Windows\System\XNroULm.exe
  C:\Windows\System\XNroULm.exe
  2⤵
  PID:3352
- C:\Windows\System\YfFmlbH.exe
  C:\Windows\System\YfFmlbH.exe
  2⤵
  PID:3384
- C:\Windows\System\yUAKkfD.exe
  C:\Windows\System\yUAKkfD.exe
  2⤵
  PID:3412
- C:\Windows\System\BPxmreY.exe
  C:\Windows\System\BPxmreY.exe
  2⤵
  PID:3448
- C:\Windows\System\fcEhphv.exe
  C:\Windows\System\fcEhphv.exe
  2⤵
  PID:3492
- C:\Windows\System\NfbzMAw.exe
  C:\Windows\System\NfbzMAw.exe
  2⤵
  PID:3512
- C:\Windows\System\WljigrZ.exe
  C:\Windows\System\WljigrZ.exe
  2⤵
  PID:3560
- C:\Windows\System\UrCtXfM.exe
  C:\Windows\System\UrCtXfM.exe
  2⤵
  PID:3572
- C:\Windows\System\uvKIoIZ.exe
  C:\Windows\System\uvKIoIZ.exe
  2⤵
  PID:3608
- C:\Windows\System\HPIzNQd.exe
  C:\Windows\System\HPIzNQd.exe
  2⤵
  PID:3652
- C:\Windows\System\jReMLuN.exe
  C:\Windows\System\jReMLuN.exe
  2⤵
  PID:3672
- C:\Windows\System\JgkRJbF.exe
  C:\Windows\System\JgkRJbF.exe
  2⤵
  PID:3720
- C:\Windows\System\qGreSyU.exe
  C:\Windows\System\qGreSyU.exe
  2⤵
  PID:3732
- C:\Windows\System\vdUluTd.exe
  C:\Windows\System\vdUluTd.exe
  2⤵
  PID:3780
- C:\Windows\System\RyPbtsq.exe
  C:\Windows\System\RyPbtsq.exe
  2⤵
  PID:3816
- C:\Windows\System\KLVeEQJ.exe
  C:\Windows\System\KLVeEQJ.exe
  2⤵
  PID:3848
- C:\Windows\System\dKcJgdF.exe
  C:\Windows\System\dKcJgdF.exe
  2⤵
  PID:3880
- C:\Windows\System\kfGtkCf.exe
  C:\Windows\System\kfGtkCf.exe
  2⤵
  PID:3912
- C:\Windows\System\HsnwqAV.exe
  C:\Windows\System\HsnwqAV.exe
  2⤵
  PID:3928
- C:\Windows\System\rJVgUsu.exe
  C:\Windows\System\rJVgUsu.exe
  2⤵
  PID:3972
- C:\Windows\System\kksGkMN.exe
  C:\Windows\System\kksGkMN.exe
  2⤵
  PID:3988
- C:\Windows\System\aAzhzMV.exe
  C:\Windows\System\aAzhzMV.exe
  2⤵
  PID:4024
- C:\Windows\System\ppQAdwz.exe
  C:\Windows\System\ppQAdwz.exe
  2⤵
  PID:4052
- C:\Windows\System\NQzkRJv.exe
  C:\Windows\System\NQzkRJv.exe
  2⤵
  PID:4084
- C:\Windows\System\hfZiZvf.exe
  C:\Windows\System\hfZiZvf.exe
  2⤵
  PID:2480
- C:\Windows\System\NgelfkI.exe
  C:\Windows\System\NgelfkI.exe
  2⤵
  PID:2876
- C:\Windows\System\PwOGhMo.exe
  C:\Windows\System\PwOGhMo.exe
  2⤵
  PID:2568
- C:\Windows\System\FvytMIH.exe
  C:\Windows\System\FvytMIH.exe
  2⤵
  PID:952
- C:\Windows\System\tABSZHS.exe
  C:\Windows\System\tABSZHS.exe
  2⤵
  PID:2184
- C:\Windows\System\FZtDCkE.exe
  C:\Windows\System\FZtDCkE.exe
  2⤵
  PID:3124
- C:\Windows\System\XsGmwLJ.exe
  C:\Windows\System\XsGmwLJ.exe
  2⤵
  PID:2108
- C:\Windows\System\zPIQJsR.exe
  C:\Windows\System\zPIQJsR.exe
  2⤵
  PID:3204
- C:\Windows\System\SnVTFSe.exe
  C:\Windows\System\SnVTFSe.exe
  2⤵
  PID:3252
- C:\Windows\System\EnhiOHN.exe
  C:\Windows\System\EnhiOHN.exe
  2⤵
  PID:3300
- C:\Windows\System\uEQQiQV.exe
  C:\Windows\System\uEQQiQV.exe
  2⤵
  PID:3364
- C:\Windows\System\GvIBfox.exe
  C:\Windows\System\GvIBfox.exe
  2⤵
  PID:3460
- C:\Windows\System\qUcZmCY.exe
  C:\Windows\System\qUcZmCY.exe
  2⤵
  PID:3524
- C:\Windows\System\jVMnLlZ.exe
  C:\Windows\System\jVMnLlZ.exe
  2⤵
  PID:3640
- C:\Windows\System\lRHdRGL.exe
  C:\Windows\System\lRHdRGL.exe
  2⤵
  PID:3604
- C:\Windows\System\dhZpQHH.exe
  C:\Windows\System\dhZpQHH.exe
  2⤵
  PID:3716
- C:\Windows\System\ZZjxlUW.exe
  C:\Windows\System\ZZjxlUW.exe
  2⤵
  PID:3768
- C:\Windows\System\aDJMOKy.exe
  C:\Windows\System\aDJMOKy.exe
  2⤵
  PID:3844
- C:\Windows\System\TkkfqoL.exe
  C:\Windows\System\TkkfqoL.exe
  2⤵
  PID:3892
- C:\Windows\System\QVblDSW.exe
  C:\Windows\System\QVblDSW.exe
  2⤵
  PID:3944
- C:\Windows\System\QAyYrOi.exe
  C:\Windows\System\QAyYrOi.exe
  2⤵
  PID:4020
- C:\Windows\System\dHGxZJb.exe
  C:\Windows\System\dHGxZJb.exe
  2⤵
  PID:1544
- C:\Windows\System\ZRffTng.exe
  C:\Windows\System\ZRffTng.exe
  2⤵
  PID:2328
- C:\Windows\System\pWLyeoQ.exe
  C:\Windows\System\pWLyeoQ.exe
  2⤵
  PID:2308
- C:\Windows\System\ZbYfcjh.exe
  C:\Windows\System\ZbYfcjh.exe
  2⤵
  PID:3076
- C:\Windows\System\YNdMbQX.exe
  C:\Windows\System\YNdMbQX.exe
  2⤵
  PID:3188
- C:\Windows\System\maYqYow.exe
  C:\Windows\System\maYqYow.exe
  2⤵
  PID:3140
- C:\Windows\System\olInlaD.exe
  C:\Windows\System\olInlaD.exe
  2⤵
  PID:3236
- C:\Windows\System\mGdmArn.exe
  C:\Windows\System\mGdmArn.exe
  2⤵
  PID:3348
- C:\Windows\System\BAJEVoi.exe
  C:\Windows\System\BAJEVoi.exe
  2⤵
  PID:3480
- C:\Windows\System\elHafYq.exe
  C:\Windows\System\elHafYq.exe
  2⤵
  PID:1688
- C:\Windows\System\kipSYqN.exe
  C:\Windows\System\kipSYqN.exe
  2⤵
  PID:3752
- C:\Windows\System\ivYgFJh.exe
  C:\Windows\System\ivYgFJh.exe
  2⤵
  PID:3812
- C:\Windows\System\xtqIeyH.exe
  C:\Windows\System\xtqIeyH.exe
  2⤵
  PID:3940
- C:\Windows\System\qaBiUym.exe
  C:\Windows\System\qaBiUym.exe
  2⤵
  PID:2660
- C:\Windows\System\AtEjrAT.exe
  C:\Windows\System\AtEjrAT.exe
  2⤵
  PID:2616
- C:\Windows\System\RMAQgKU.exe
  C:\Windows\System\RMAQgKU.exe
  2⤵
  PID:3056
- C:\Windows\System\elqGFYF.exe
  C:\Windows\System\elqGFYF.exe
  2⤵
  PID:4104
- C:\Windows\System\rDKbWyW.exe
  C:\Windows\System\rDKbWyW.exe
  2⤵
  PID:4120
- C:\Windows\System\ASbZnMZ.exe
  C:\Windows\System\ASbZnMZ.exe
  2⤵
  PID:4136
- C:\Windows\System\wJwGwdE.exe
  C:\Windows\System\wJwGwdE.exe
  2⤵
  PID:4152
- C:\Windows\System\jsEBFss.exe
  C:\Windows\System\jsEBFss.exe
  2⤵
  PID:4168
- C:\Windows\System\YHShgeo.exe
  C:\Windows\System\YHShgeo.exe
  2⤵
  PID:4184
- C:\Windows\System\eeuyBho.exe
  C:\Windows\System\eeuyBho.exe
  2⤵
  PID:4200
- C:\Windows\System\dmHfAtE.exe
  C:\Windows\System\dmHfAtE.exe
  2⤵
  PID:4216
- C:\Windows\System\PUXsElr.exe
  C:\Windows\System\PUXsElr.exe
  2⤵
  PID:4232
- C:\Windows\System\PArKliz.exe
  C:\Windows\System\PArKliz.exe
  2⤵
  PID:4248
- C:\Windows\System\RSashvP.exe
  C:\Windows\System\RSashvP.exe
  2⤵
  PID:4264
- C:\Windows\System\GtmBRhT.exe
  C:\Windows\System\GtmBRhT.exe
  2⤵
  PID:4280
- C:\Windows\System\URdltik.exe
  C:\Windows\System\URdltik.exe
  2⤵
  PID:4296
- C:\Windows\System\chjwkeB.exe
  C:\Windows\System\chjwkeB.exe
  2⤵
  PID:4312
- C:\Windows\System\STEOJXX.exe
  C:\Windows\System\STEOJXX.exe
  2⤵
  PID:4328
- C:\Windows\System\HkasqyY.exe
  C:\Windows\System\HkasqyY.exe
  2⤵
  PID:4344
- C:\Windows\System\HrowdxP.exe
  C:\Windows\System\HrowdxP.exe
  2⤵
  PID:4360
- C:\Windows\System\MPyXSZn.exe
  C:\Windows\System\MPyXSZn.exe
  2⤵
  PID:4376
- C:\Windows\System\QQtPXDL.exe
  C:\Windows\System\QQtPXDL.exe
  2⤵
  PID:4392
- C:\Windows\System\XqnDIAG.exe
  C:\Windows\System\XqnDIAG.exe
  2⤵
  PID:4408
- C:\Windows\System\eiEcShy.exe
  C:\Windows\System\eiEcShy.exe
  2⤵
  PID:4424
- C:\Windows\System\NBtclpN.exe
  C:\Windows\System\NBtclpN.exe
  2⤵
  PID:4440
- C:\Windows\System\SKAuyyD.exe
  C:\Windows\System\SKAuyyD.exe
  2⤵
  PID:4456
- C:\Windows\System\iMjZJOK.exe
  C:\Windows\System\iMjZJOK.exe
  2⤵
  PID:4472
- C:\Windows\System\MYOhJAO.exe
  C:\Windows\System\MYOhJAO.exe
  2⤵
  PID:4488
- C:\Windows\System\xDfSgie.exe
  C:\Windows\System\xDfSgie.exe
  2⤵
  PID:4504
- C:\Windows\System\LRvBupB.exe
  C:\Windows\System\LRvBupB.exe
  2⤵
  PID:4520
- C:\Windows\System\DCSNjDR.exe
  C:\Windows\System\DCSNjDR.exe
  2⤵
  PID:4536
- C:\Windows\System\SlLxOJj.exe
  C:\Windows\System\SlLxOJj.exe
  2⤵
  PID:4552
- C:\Windows\System\zxfTIWW.exe
  C:\Windows\System\zxfTIWW.exe
  2⤵
  PID:4568
- C:\Windows\System\bjvLbNp.exe
  C:\Windows\System\bjvLbNp.exe
  2⤵
  PID:4584
- C:\Windows\System\YFOiYvD.exe
  C:\Windows\System\YFOiYvD.exe
  2⤵
  PID:4600
- C:\Windows\System\xuAdrSx.exe
  C:\Windows\System\xuAdrSx.exe
  2⤵
  PID:4616
- C:\Windows\System\wfMsFWD.exe
  C:\Windows\System\wfMsFWD.exe
  2⤵
  PID:4632
- C:\Windows\System\YJIeytS.exe
  C:\Windows\System\YJIeytS.exe
  2⤵
  PID:4648
- C:\Windows\System\THTvWRw.exe
  C:\Windows\System\THTvWRw.exe
  2⤵
  PID:4664
- C:\Windows\System\YitfNBR.exe
  C:\Windows\System\YitfNBR.exe
  2⤵
  PID:4680
- C:\Windows\System\jtpEiPb.exe
  C:\Windows\System\jtpEiPb.exe
  2⤵
  PID:4696
- C:\Windows\System\lYAGEmx.exe
  C:\Windows\System\lYAGEmx.exe
  2⤵
  PID:4712
- C:\Windows\System\DxqlUCm.exe
  C:\Windows\System\DxqlUCm.exe
  2⤵
  PID:4728
- C:\Windows\System\iWkLccS.exe
  C:\Windows\System\iWkLccS.exe
  2⤵
  PID:4744
- C:\Windows\System\inLvMBS.exe
  C:\Windows\System\inLvMBS.exe
  2⤵
  PID:4760
- C:\Windows\System\xGwNyHa.exe
  C:\Windows\System\xGwNyHa.exe
  2⤵
  PID:4776
- C:\Windows\System\olduVLL.exe
  C:\Windows\System\olduVLL.exe
  2⤵
  PID:4792
- C:\Windows\System\eEmcSDh.exe
  C:\Windows\System\eEmcSDh.exe
  2⤵
  PID:4808
- C:\Windows\System\xtCGtSK.exe
  C:\Windows\System\xtCGtSK.exe
  2⤵
  PID:4824
- C:\Windows\System\RHTtvOl.exe
  C:\Windows\System\RHTtvOl.exe
  2⤵
  PID:4840
- C:\Windows\System\HiGFYcR.exe
  C:\Windows\System\HiGFYcR.exe
  2⤵
  PID:4856
- C:\Windows\System\ASkNTto.exe
  C:\Windows\System\ASkNTto.exe
  2⤵
  PID:4872
- C:\Windows\System\mhdICPM.exe
  C:\Windows\System\mhdICPM.exe
  2⤵
  PID:4888
- C:\Windows\System\zEUiglq.exe
  C:\Windows\System\zEUiglq.exe
  2⤵
  PID:4904
- C:\Windows\System\DjgDsQs.exe
  C:\Windows\System\DjgDsQs.exe
  2⤵
  PID:4920
- C:\Windows\System\UhpWwlF.exe
  C:\Windows\System\UhpWwlF.exe
  2⤵
  PID:4936
- C:\Windows\System\rSewwdV.exe
  C:\Windows\System\rSewwdV.exe
  2⤵
  PID:4952
- C:\Windows\System\lQGlDvb.exe
  C:\Windows\System\lQGlDvb.exe
  2⤵
  PID:4968
- C:\Windows\System\DdUbdGw.exe
  C:\Windows\System\DdUbdGw.exe
  2⤵
  PID:4984
- C:\Windows\System\LMRtnRF.exe
  C:\Windows\System\LMRtnRF.exe
  2⤵
  PID:5000
- C:\Windows\System\qDmWfiT.exe
  C:\Windows\System\qDmWfiT.exe
  2⤵
  PID:5016
- C:\Windows\System\VyhgVdX.exe
  C:\Windows\System\VyhgVdX.exe
  2⤵
  PID:5032
- C:\Windows\System\PtgPJTj.exe
  C:\Windows\System\PtgPJTj.exe
  2⤵
  PID:5048
- C:\Windows\System\tQbRBDW.exe
  C:\Windows\System\tQbRBDW.exe
  2⤵
  PID:5064
- C:\Windows\System\jQDGdyz.exe
  C:\Windows\System\jQDGdyz.exe
  2⤵
  PID:5080
- C:\Windows\System\GMCWTGa.exe
  C:\Windows\System\GMCWTGa.exe
  2⤵
  PID:5096
- C:\Windows\System\BmbQeMD.exe
  C:\Windows\System\BmbQeMD.exe
  2⤵
  PID:5112
- C:\Windows\System\EIElBlN.exe
  C:\Windows\System\EIElBlN.exe
  2⤵
  PID:2608
- C:\Windows\System\iACoKkf.exe
  C:\Windows\System\iACoKkf.exe
  2⤵
  PID:3416
- C:\Windows\System\qtsWHLx.exe
  C:\Windows\System\qtsWHLx.exe
  2⤵
  PID:3748
- C:\Windows\System\ZwjAqtE.exe
  C:\Windows\System\ZwjAqtE.exe
  2⤵
  PID:3908
- C:\Windows\System\UYRudUu.exe
  C:\Windows\System\UYRudUu.exe
  2⤵
  PID:2032
- C:\Windows\System\LnGGgwy.exe
  C:\Windows\System\LnGGgwy.exe
  2⤵
  PID:2628
- C:\Windows\System\XxZYVXA.exe
  C:\Windows\System\XxZYVXA.exe
  2⤵
  PID:4128
- C:\Windows\System\EBVHaMq.exe
  C:\Windows\System\EBVHaMq.exe
  2⤵
  PID:4160
- C:\Windows\System\eNkWKIp.exe
  C:\Windows\System\eNkWKIp.exe
  2⤵
  PID:4176
- C:\Windows\System\kHMSVRI.exe
  C:\Windows\System\kHMSVRI.exe
  2⤵
  PID:4208
- C:\Windows\System\gKgmXba.exe
  C:\Windows\System\gKgmXba.exe
  2⤵
  PID:4256
- C:\Windows\System\SOmbsvc.exe
  C:\Windows\System\SOmbsvc.exe
  2⤵
  PID:4272
- C:\Windows\System\TZGnKHo.exe
  C:\Windows\System\TZGnKHo.exe
  2⤵
  PID:4320
- C:\Windows\System\zrzqRau.exe
  C:\Windows\System\zrzqRau.exe
  2⤵
  PID:4336
- C:\Windows\System\XFlkOPs.exe
  C:\Windows\System\XFlkOPs.exe
  2⤵
  PID:1564
- C:\Windows\System\bHIUGRW.exe
  C:\Windows\System\bHIUGRW.exe
  2⤵
  PID:4388
- C:\Windows\System\zkswSNE.exe
  C:\Windows\System\zkswSNE.exe
  2⤵
  PID:4404
- C:\Windows\System\TFXLskz.exe
  C:\Windows\System\TFXLskz.exe
  2⤵
  PID:4500
- C:\Windows\System\UjgLDmT.exe
  C:\Windows\System\UjgLDmT.exe
  2⤵
  PID:4528
- C:\Windows\System\xazhROT.exe
  C:\Windows\System\xazhROT.exe
  2⤵
  PID:4560
- C:\Windows\System\inqWAgr.exe
  C:\Windows\System\inqWAgr.exe
  2⤵
  PID:4564
- C:\Windows\System\xomwQHD.exe
  C:\Windows\System\xomwQHD.exe
  2⤵
  PID:4640
- C:\Windows\System\JnKsHdr.exe
  C:\Windows\System\JnKsHdr.exe
  2⤵
  PID:1528
- C:\Windows\System\WmCMCpz.exe
  C:\Windows\System\WmCMCpz.exe
  2⤵
  PID:4656
- C:\Windows\System\mwDxQvn.exe
  C:\Windows\System\mwDxQvn.exe
  2⤵
  PID:4660
- C:\Windows\System\BgTwZxd.exe
  C:\Windows\System\BgTwZxd.exe
  2⤵
  PID:4724
- C:\Windows\System\GsCMbvE.exe
  C:\Windows\System\GsCMbvE.exe
  2⤵
  PID:4756
- C:\Windows\System\xSNomXb.exe
  C:\Windows\System\xSNomXb.exe
  2⤵
  PID:4820
- C:\Windows\System\mDwsVBy.exe
  C:\Windows\System\mDwsVBy.exe
  2⤵
  PID:4884
- C:\Windows\System\yUOyrQB.exe
  C:\Windows\System\yUOyrQB.exe
  2⤵
  PID:4948
- C:\Windows\System\tiZpozm.exe
  C:\Windows\System\tiZpozm.exe
  2⤵
  PID:5012
- C:\Windows\System\FQGpwWt.exe
  C:\Windows\System\FQGpwWt.exe
  2⤵
  PID:5076
- C:\Windows\System\RjdQGeZ.exe
  C:\Windows\System\RjdQGeZ.exe
  2⤵
  PID:3764
- C:\Windows\System\ZrvhoAE.exe
  C:\Windows\System\ZrvhoAE.exe
  2⤵
  PID:4144
- C:\Windows\System\PKnmwqM.exe
  C:\Windows\System\PKnmwqM.exe
  2⤵
  PID:4260
- C:\Windows\System\cuffBKe.exe
  C:\Windows\System\cuffBKe.exe
  2⤵
  PID:4964
- C:\Windows\System\WGMAfAx.exe
  C:\Windows\System\WGMAfAx.exe
  2⤵
  PID:4596
- C:\Windows\System\xIVHydV.exe
  C:\Windows\System\xIVHydV.exe
  2⤵
  PID:2812
- C:\Windows\System\gBtjnHs.exe
  C:\Windows\System\gBtjnHs.exe
  2⤵
  PID:2460
- C:\Windows\System\qXAHOto.exe
  C:\Windows\System\qXAHOto.exe
  2⤵
  PID:4944
- C:\Windows\System\ZOyvgXO.exe
  C:\Windows\System\ZOyvgXO.exe
  2⤵
  PID:2536
- C:\Windows\System\HKktwut.exe
  C:\Windows\System\HKktwut.exe
  2⤵
  PID:4704
- C:\Windows\System\AFKFMTD.exe
  C:\Windows\System\AFKFMTD.exe
  2⤵
  PID:4768
- C:\Windows\System\OoAlOMo.exe
  C:\Windows\System\OoAlOMo.exe
  2⤵
  PID:4864
- C:\Windows\System\sXhqTcR.exe
  C:\Windows\System\sXhqTcR.exe
  2⤵
  PID:2100
- C:\Windows\System\lzAUMgt.exe
  C:\Windows\System\lzAUMgt.exe
  2⤵
  PID:4868
- C:\Windows\System\ORZVKrM.exe
  C:\Windows\System\ORZVKrM.exe
  2⤵
  PID:3048
- C:\Windows\System\ITCFaJx.exe
  C:\Windows\System\ITCFaJx.exe
  2⤵
  PID:1308
- C:\Windows\System\OVstKsJ.exe
  C:\Windows\System\OVstKsJ.exe
  2⤵
  PID:3508
- C:\Windows\System\PMMJcks.exe
  C:\Windows\System\PMMJcks.exe
  2⤵
  PID:5060
- C:\Windows\System\YsNqVJo.exe
  C:\Windows\System\YsNqVJo.exe
  2⤵
  PID:2432
- C:\Windows\System\tzNILuu.exe
  C:\Windows\System\tzNILuu.exe
  2⤵
  PID:1800
- C:\Windows\System\Brsbgpc.exe
  C:\Windows\System\Brsbgpc.exe
  2⤵
  PID:4228
- C:\Windows\System\ajHgnKr.exe
  C:\Windows\System\ajHgnKr.exe
  2⤵
  PID:4356
- C:\Windows\System\CriEbhP.exe
  C:\Windows\System\CriEbhP.exe
  2⤵
  PID:764
- C:\Windows\System\zWCPLsm.exe
  C:\Windows\System\zWCPLsm.exe
  2⤵
  PID:4624
- C:\Windows\System\lLqHAlD.exe
  C:\Windows\System\lLqHAlD.exe
  2⤵
  PID:2276
- C:\Windows\System\qYPzBuk.exe
  C:\Windows\System\qYPzBuk.exe
  2⤵
  PID:4980
- C:\Windows\System\PgcByAL.exe
  C:\Windows\System\PgcByAL.exe
  2⤵
  PID:1936
- C:\Windows\System\vyZqIPV.exe
  C:\Windows\System\vyZqIPV.exe
  2⤵
  PID:308
- C:\Windows\System\MFrdVfa.exe
  C:\Windows\System\MFrdVfa.exe
  2⤵
  PID:2168
- C:\Windows\System\jMJpOuo.exe
  C:\Windows\System\jMJpOuo.exe
  2⤵
  PID:2284
- C:\Windows\System\ofFPlls.exe
  C:\Windows\System\ofFPlls.exe
  2⤵
  PID:4736
- C:\Windows\System\sawuDJw.exe
  C:\Windows\System\sawuDJw.exe
  2⤵
  PID:4916
- C:\Windows\System\jvwQHMg.exe
  C:\Windows\System\jvwQHMg.exe
  2⤵
  PID:4772
- C:\Windows\System\FlYftQU.exe
  C:\Windows\System\FlYftQU.exe
  2⤵
  PID:5028
- C:\Windows\System\OKFmqFR.exe
  C:\Windows\System\OKFmqFR.exe
  2⤵
  PID:5056
- C:\Windows\System\KvfKerk.exe
  C:\Windows\System\KvfKerk.exe
  2⤵
  PID:4548
- C:\Windows\System\iFytCwh.exe
  C:\Windows\System\iFytCwh.exe
  2⤵
  PID:4132
- C:\Windows\System\ZMNWAGt.exe
  C:\Windows\System\ZMNWAGt.exe
  2⤵
  PID:4900
- C:\Windows\System\MYFJHqO.exe
  C:\Windows\System\MYFJHqO.exe
  2⤵
  PID:4996
- C:\Windows\System\WuunFQt.exe
  C:\Windows\System\WuunFQt.exe
  2⤵
  PID:4276
- C:\Windows\System\hdGRSpP.exe
  C:\Windows\System\hdGRSpP.exe
  2⤵
  PID:4148
- C:\Windows\System\KZRnCbR.exe
  C:\Windows\System\KZRnCbR.exe
  2⤵
  PID:840
- C:\Windows\System\BMCWdLP.exe
  C:\Windows\System\BMCWdLP.exe
  2⤵
  PID:4608
- C:\Windows\System\vfTKsXA.exe
  C:\Windows\System\vfTKsXA.exe
  2⤵
  PID:5136
- C:\Windows\System\VCxOmUx.exe
  C:\Windows\System\VCxOmUx.exe
  2⤵
  PID:5152
- C:\Windows\System\EqePqNo.exe
  C:\Windows\System\EqePqNo.exe
  2⤵
  PID:5168
- C:\Windows\System\YHznuWE.exe
  C:\Windows\System\YHznuWE.exe
  2⤵
  PID:5184
- C:\Windows\System\JohHZgE.exe
  C:\Windows\System\JohHZgE.exe
  2⤵
  PID:5200
- C:\Windows\System\comoNuI.exe
  C:\Windows\System\comoNuI.exe
  2⤵
  PID:5216
- C:\Windows\System\aqpENoj.exe
  C:\Windows\System\aqpENoj.exe
  2⤵
  PID:5232
- C:\Windows\System\hrmOHwk.exe
  C:\Windows\System\hrmOHwk.exe
  2⤵
  PID:5248
- C:\Windows\System\rqEwdtG.exe
  C:\Windows\System\rqEwdtG.exe
  2⤵
  PID:5264
- C:\Windows\System\klCujew.exe
  C:\Windows\System\klCujew.exe
  2⤵
  PID:5280
- C:\Windows\System\PEnVfHR.exe
  C:\Windows\System\PEnVfHR.exe
  2⤵
  PID:5296
- C:\Windows\System\QvEzivH.exe
  C:\Windows\System\QvEzivH.exe
  2⤵
  PID:5312
- C:\Windows\System\JCMdUje.exe
  C:\Windows\System\JCMdUje.exe
  2⤵
  PID:5328
- C:\Windows\System\ALdJmnC.exe
  C:\Windows\System\ALdJmnC.exe
  2⤵
  PID:5344
- C:\Windows\System\CuQDVyr.exe
  C:\Windows\System\CuQDVyr.exe
  2⤵
  PID:5360
- C:\Windows\System\ktRuMuQ.exe
  C:\Windows\System\ktRuMuQ.exe
  2⤵
  PID:5376
- C:\Windows\System\YRsnPSE.exe
  C:\Windows\System\YRsnPSE.exe
  2⤵
  PID:5392
- C:\Windows\System\snAFwsK.exe
  C:\Windows\System\snAFwsK.exe
  2⤵
  PID:5408
- C:\Windows\System\jAdAWdJ.exe
  C:\Windows\System\jAdAWdJ.exe
  2⤵
  PID:5424
- C:\Windows\System\jAhckba.exe
  C:\Windows\System\jAhckba.exe
  2⤵
  PID:5440
- C:\Windows\System\QkVzwJk.exe
  C:\Windows\System\QkVzwJk.exe
  2⤵
  PID:5456
- C:\Windows\System\dDPPbjg.exe
  C:\Windows\System\dDPPbjg.exe
  2⤵
  PID:5472
- C:\Windows\System\WZHwRms.exe
  C:\Windows\System\WZHwRms.exe
  2⤵
  PID:5488
- C:\Windows\System\wfxGuyT.exe
  C:\Windows\System\wfxGuyT.exe
  2⤵
  PID:5504
- C:\Windows\System\BYLBGQH.exe
  C:\Windows\System\BYLBGQH.exe
  2⤵
  PID:5520
- C:\Windows\System\CgmPCGb.exe
  C:\Windows\System\CgmPCGb.exe
  2⤵
  PID:5536
- C:\Windows\System\KYkgmSl.exe
  C:\Windows\System\KYkgmSl.exe
  2⤵
  PID:5552
- C:\Windows\System\XVcNUsi.exe
  C:\Windows\System\XVcNUsi.exe
  2⤵
  PID:5568
- C:\Windows\System\CzgTlEQ.exe
  C:\Windows\System\CzgTlEQ.exe
  2⤵
  PID:5584
- C:\Windows\System\AuVEFlh.exe
  C:\Windows\System\AuVEFlh.exe
  2⤵
  PID:5600
- C:\Windows\System\RcDlLwb.exe
  C:\Windows\System\RcDlLwb.exe
  2⤵
  PID:5616
- C:\Windows\System\wKvKSOU.exe
  C:\Windows\System\wKvKSOU.exe
  2⤵
  PID:5632
- C:\Windows\System\JHkXiHs.exe
  C:\Windows\System\JHkXiHs.exe
  2⤵
  PID:5648
- C:\Windows\System\VnwzzZv.exe
  C:\Windows\System\VnwzzZv.exe
  2⤵
  PID:5664
- C:\Windows\System\YTVVbdS.exe
  C:\Windows\System\YTVVbdS.exe
  2⤵
  PID:5680
- C:\Windows\System\UDkyfjq.exe
  C:\Windows\System\UDkyfjq.exe
  2⤵
  PID:5700
- C:\Windows\System\HwJnoav.exe
  C:\Windows\System\HwJnoav.exe
  2⤵
  PID:5716
- C:\Windows\System\sDMBYXp.exe
  C:\Windows\System\sDMBYXp.exe
  2⤵
  PID:5732
- C:\Windows\System\sStuAIX.exe
  C:\Windows\System\sStuAIX.exe
  2⤵
  PID:5748
- C:\Windows\System\zxhTbFX.exe
  C:\Windows\System\zxhTbFX.exe
  2⤵
  PID:5764
- C:\Windows\System\nDCBMyn.exe
  C:\Windows\System\nDCBMyn.exe
  2⤵
  PID:5780
- C:\Windows\System\sGtTFBs.exe
  C:\Windows\System\sGtTFBs.exe
  2⤵
  PID:5796
- C:\Windows\System\Xqqjimi.exe
  C:\Windows\System\Xqqjimi.exe
  2⤵
  PID:5812
- C:\Windows\System\DpDHECW.exe
  C:\Windows\System\DpDHECW.exe
  2⤵
  PID:5828
- C:\Windows\System\MBsFMqJ.exe
  C:\Windows\System\MBsFMqJ.exe
  2⤵
  PID:5844
- C:\Windows\System\rmUGjis.exe
  C:\Windows\System\rmUGjis.exe
  2⤵
  PID:5872
- C:\Windows\System\LtYVRwP.exe
  C:\Windows\System\LtYVRwP.exe
  2⤵
  PID:5888
- C:\Windows\System\UveEryr.exe
  C:\Windows\System\UveEryr.exe
  2⤵
  PID:5908
- C:\Windows\System\cqbPskZ.exe
  C:\Windows\System\cqbPskZ.exe
  2⤵
  PID:5924
- C:\Windows\System\pIrMYGf.exe
  C:\Windows\System\pIrMYGf.exe
  2⤵
  PID:5940
- C:\Windows\System\pFhaflT.exe
  C:\Windows\System\pFhaflT.exe
  2⤵
  PID:5960
- C:\Windows\System\eZhoFda.exe
  C:\Windows\System\eZhoFda.exe
  2⤵
  PID:5976
- C:\Windows\System\cflLZyB.exe
  C:\Windows\System\cflLZyB.exe
  2⤵
  PID:5992
- C:\Windows\System\dhsXLAj.exe
  C:\Windows\System\dhsXLAj.exe
  2⤵
  PID:6008
- C:\Windows\System\kiXBhuD.exe
  C:\Windows\System\kiXBhuD.exe
  2⤵
  PID:6024
- C:\Windows\System\tJBZOjL.exe
  C:\Windows\System\tJBZOjL.exe
  2⤵
  PID:6040
- C:\Windows\System\cyQuhOK.exe
  C:\Windows\System\cyQuhOK.exe
  2⤵
  PID:6056
- C:\Windows\System\fPCYyUi.exe
  C:\Windows\System\fPCYyUi.exe
  2⤵
  PID:6072
- C:\Windows\System\JAItwHZ.exe
  C:\Windows\System\JAItwHZ.exe
  2⤵
  PID:6088
- C:\Windows\System\teucDKo.exe
  C:\Windows\System\teucDKo.exe
  2⤵
  PID:6104
- C:\Windows\System\uNWJXGS.exe
  C:\Windows\System\uNWJXGS.exe
  2⤵
  PID:6120
- C:\Windows\System\ZZqkIrP.exe
  C:\Windows\System\ZZqkIrP.exe
  2⤵
  PID:6136
- C:\Windows\System\nvAFKWQ.exe
  C:\Windows\System\nvAFKWQ.exe
  2⤵
  PID:4056
- C:\Windows\System\EkntvGR.exe
  C:\Windows\System\EkntvGR.exe
  2⤵
  PID:4308
- C:\Windows\System\EEdZDBH.exe
  C:\Windows\System\EEdZDBH.exe
  2⤵
  PID:2016
- C:\Windows\System\Yhrhusz.exe
  C:\Windows\System\Yhrhusz.exe
  2⤵
  PID:5072
- C:\Windows\System\IjsbbsT.exe
  C:\Windows\System\IjsbbsT.exe
  2⤵
  PID:4292
- C:\Windows\System\FwLiIuU.exe
  C:\Windows\System\FwLiIuU.exe
  2⤵
  PID:5132
- C:\Windows\System\NrRRdfA.exe
  C:\Windows\System\NrRRdfA.exe
  2⤵
  PID:5196
- C:\Windows\System\gIdtdhH.exe
  C:\Windows\System\gIdtdhH.exe
  2⤵
  PID:5260
- C:\Windows\System\VaAOcOp.exe
  C:\Windows\System\VaAOcOp.exe
  2⤵
  PID:5352
- C:\Windows\System\dtIrjCO.exe
  C:\Windows\System\dtIrjCO.exe
  2⤵
  PID:5416
- C:\Windows\System\tdDjXCY.exe
  C:\Windows\System\tdDjXCY.exe
  2⤵
  PID:5512
- C:\Windows\System\BFKNOzT.exe
  C:\Windows\System\BFKNOzT.exe
  2⤵
  PID:5576
- C:\Windows\System\DFmSrsx.exe
  C:\Windows\System\DFmSrsx.exe
  2⤵
  PID:5640
- C:\Windows\System\TLTrXSl.exe
  C:\Windows\System\TLTrXSl.exe
  2⤵
  PID:1184
- C:\Windows\System\ZjlclUB.exe
  C:\Windows\System\ZjlclUB.exe
  2⤵
  PID:1852
- C:\Windows\System\iqTaapM.exe
  C:\Windows\System\iqTaapM.exe
  2⤵
  PID:4832
- C:\Windows\System\eGznuEA.exe
  C:\Windows\System\eGznuEA.exe
  2⤵
  PID:4788
- C:\Windows\System\EHabxwd.exe
  C:\Windows\System\EHabxwd.exe
  2⤵
  PID:3316
- C:\Windows\System\XvRQHKA.exe
  C:\Windows\System\XvRQHKA.exe
  2⤵
  PID:5144
- C:\Windows\System\UkzRYAY.exe
  C:\Windows\System\UkzRYAY.exe
  2⤵
  PID:5740
- C:\Windows\System\pvjYxuz.exe
  C:\Windows\System\pvjYxuz.exe
  2⤵
  PID:5804
- C:\Windows\System\yiKnJQl.exe
  C:\Windows\System\yiKnJQl.exe
  2⤵
  PID:5208
- C:\Windows\System\mKbPgsw.exe
  C:\Windows\System\mKbPgsw.exe
  2⤵
  PID:5788
- C:\Windows\System\OwTLrvK.exe
  C:\Windows\System\OwTLrvK.exe
  2⤵
  PID:5272
- C:\Windows\System\zcsfoHb.exe
  C:\Windows\System\zcsfoHb.exe
  2⤵
  PID:5340
- C:\Windows\System\MbfzguI.exe
  C:\Windows\System\MbfzguI.exe
  2⤵
  PID:5400
- C:\Windows\System\TrJKGRs.exe
  C:\Windows\System\TrJKGRs.exe
  2⤵
  PID:5820
- C:\Windows\System\wncMgre.exe
  C:\Windows\System\wncMgre.exe
  2⤵
  PID:5532
- C:\Windows\System\hTuUzoS.exe
  C:\Windows\System\hTuUzoS.exe
  2⤵
  PID:5596
- C:\Windows\System\qpbwgof.exe
  C:\Windows\System\qpbwgof.exe
  2⤵
  PID:5656
- C:\Windows\System\NVcbnOh.exe
  C:\Windows\System\NVcbnOh.exe
  2⤵
  PID:5696
- C:\Windows\System\TqNVQsn.exe
  C:\Windows\System\TqNVQsn.exe
  2⤵
  PID:5932
- C:\Windows\System\CBiYcsw.exe
  C:\Windows\System\CBiYcsw.exe
  2⤵
  PID:6000
- C:\Windows\System\eNEjQtz.exe
  C:\Windows\System\eNEjQtz.exe
  2⤵
  PID:6064
- C:\Windows\System\vJFnQEr.exe
  C:\Windows\System\vJFnQEr.exe
  2⤵
  PID:5920
- C:\Windows\System\zJifzxu.exe
  C:\Windows\System\zJifzxu.exe
  2⤵
  PID:6016
- C:\Windows\System\AdsgmaI.exe
  C:\Windows\System\AdsgmaI.exe
  2⤵
  PID:5884
- C:\Windows\System\NgorqsD.exe
  C:\Windows\System\NgorqsD.exe
  2⤵
  PID:4880
- C:\Windows\System\oYHESvl.exe
  C:\Windows\System\oYHESvl.exe
  2⤵
  PID:5956
- C:\Windows\System\bJpGQZw.exe
  C:\Windows\System\bJpGQZw.exe
  2⤵
  PID:1748
- C:\Windows\System\ddqleNd.exe
  C:\Windows\System\ddqleNd.exe
  2⤵
  PID:5192
- C:\Windows\System\MQkAVxg.exe
  C:\Windows\System\MQkAVxg.exe
  2⤵
  PID:5484
- C:\Windows\System\OyhjrEn.exe
  C:\Windows\System\OyhjrEn.exe
  2⤵
  PID:5452
- C:\Windows\System\eXLVJkF.exe
  C:\Windows\System\eXLVJkF.exe
  2⤵
  PID:5772
- C:\Windows\System\TWhxWXG.exe
  C:\Windows\System\TWhxWXG.exe
  2⤵
  PID:5304
- C:\Windows\System\gnFzgsY.exe
  C:\Windows\System\gnFzgsY.exe
  2⤵
  PID:5468
- C:\Windows\System\ERgaurG.exe
  C:\Windows\System\ERgaurG.exe
  2⤵
  PID:4580
- C:\Windows\System\BpLKEcs.exe
  C:\Windows\System\BpLKEcs.exe
  2⤵
  PID:6128
- C:\Windows\System\fyDnfPm.exe
  C:\Windows\System\fyDnfPm.exe
  2⤵
  PID:6152
- C:\Windows\System\HcTiskp.exe
  C:\Windows\System\HcTiskp.exe
  2⤵
  PID:6168
- C:\Windows\System\sDuvjrF.exe
  C:\Windows\System\sDuvjrF.exe
  2⤵
  PID:6184
- C:\Windows\System\QcuBbtt.exe
  C:\Windows\System\QcuBbtt.exe
  2⤵
  PID:6200
- C:\Windows\System\NoxOYkb.exe
  C:\Windows\System\NoxOYkb.exe
  2⤵
  PID:6216
- C:\Windows\System\RnqqfAP.exe
  C:\Windows\System\RnqqfAP.exe
  2⤵
  PID:6232
- C:\Windows\System\yaQmXvQ.exe
  C:\Windows\System\yaQmXvQ.exe
  2⤵
  PID:6248
- C:\Windows\System\fbisSaF.exe
  C:\Windows\System\fbisSaF.exe
  2⤵
  PID:6264
- C:\Windows\System\naGVrla.exe
  C:\Windows\System\naGVrla.exe
  2⤵
  PID:6280
- C:\Windows\System\JdjauNy.exe
  C:\Windows\System\JdjauNy.exe
  2⤵
  PID:6296
- C:\Windows\System\VMSuBjE.exe
  C:\Windows\System\VMSuBjE.exe
  2⤵
  PID:6312
- C:\Windows\System\CoFBvLf.exe
  C:\Windows\System\CoFBvLf.exe
  2⤵
  PID:6328
- C:\Windows\System\WdaKpsr.exe
  C:\Windows\System\WdaKpsr.exe
  2⤵
  PID:6344
- C:\Windows\System\qIwXmdI.exe
  C:\Windows\System\qIwXmdI.exe
  2⤵
  PID:6360
- C:\Windows\System\UJWZCBz.exe
  C:\Windows\System\UJWZCBz.exe
  2⤵
  PID:6376
- C:\Windows\System\MVSrBfD.exe
  C:\Windows\System\MVSrBfD.exe
  2⤵
  PID:6392
- C:\Windows\System\lQhrsjK.exe
  C:\Windows\System\lQhrsjK.exe
  2⤵
  PID:6408
- C:\Windows\System\OBDnlpI.exe
  C:\Windows\System\OBDnlpI.exe
  2⤵
  PID:6424
- C:\Windows\System\IwRtIIy.exe
  C:\Windows\System\IwRtIIy.exe
  2⤵
  PID:6440
- C:\Windows\System\qmdCHsr.exe
  C:\Windows\System\qmdCHsr.exe
  2⤵
  PID:6456
- C:\Windows\System\tBBuMPL.exe
  C:\Windows\System\tBBuMPL.exe
  2⤵
  PID:6472
- C:\Windows\System\DlPaYwm.exe
  C:\Windows\System\DlPaYwm.exe
  2⤵
  PID:6488
- C:\Windows\System\jLxZlWd.exe
  C:\Windows\System\jLxZlWd.exe
  2⤵
  PID:6504
- C:\Windows\System\wQJWEZK.exe
  C:\Windows\System\wQJWEZK.exe
  2⤵
  PID:6520
- C:\Windows\System\ZaoJZaX.exe
  C:\Windows\System\ZaoJZaX.exe
  2⤵
  PID:6536
- C:\Windows\System\LFoXfPd.exe
  C:\Windows\System\LFoXfPd.exe
  2⤵
  PID:6552
- C:\Windows\System\cEGbfwW.exe
  C:\Windows\System\cEGbfwW.exe
  2⤵
  PID:6568
- C:\Windows\System\sHgncsi.exe
  C:\Windows\System\sHgncsi.exe
  2⤵
  PID:6584
- C:\Windows\System\WlRhuLt.exe
  C:\Windows\System\WlRhuLt.exe
  2⤵
  PID:6600
- C:\Windows\System\ubLfNnL.exe
  C:\Windows\System\ubLfNnL.exe
  2⤵
  PID:6616
- C:\Windows\System\UyRDzay.exe
  C:\Windows\System\UyRDzay.exe
  2⤵
  PID:6632
- C:\Windows\System\gwTUsAa.exe
  C:\Windows\System\gwTUsAa.exe
  2⤵
  PID:6648
- C:\Windows\System\vXyzpIE.exe
  C:\Windows\System\vXyzpIE.exe
  2⤵
  PID:6664
- C:\Windows\System\aWLWCGM.exe
  C:\Windows\System\aWLWCGM.exe
  2⤵
  PID:6680
- C:\Windows\System\VlnJsIv.exe
  C:\Windows\System\VlnJsIv.exe
  2⤵
  PID:6696
- C:\Windows\System\WjGgrva.exe
  C:\Windows\System\WjGgrva.exe
  2⤵
  PID:6712
- C:\Windows\System\OiRPEjh.exe
  C:\Windows\System\OiRPEjh.exe
  2⤵
  PID:6728
- C:\Windows\System\MULzQXn.exe
  C:\Windows\System\MULzQXn.exe
  2⤵
  PID:6744
- C:\Windows\System\OGAWMTJ.exe
  C:\Windows\System\OGAWMTJ.exe
  2⤵
  PID:6760
- C:\Windows\System\iHPgMbn.exe
  C:\Windows\System\iHPgMbn.exe
  2⤵
  PID:6776
- C:\Windows\System\dqaPylp.exe
  C:\Windows\System\dqaPylp.exe
  2⤵
  PID:6792
- C:\Windows\System\RsbIqRx.exe
  C:\Windows\System\RsbIqRx.exe
  2⤵
  PID:6808
- C:\Windows\System\wRgZDaH.exe
  C:\Windows\System\wRgZDaH.exe
  2⤵
  PID:6824
- C:\Windows\System\oAUsjwO.exe
  C:\Windows\System\oAUsjwO.exe
  2⤵
  PID:6840
- C:\Windows\System\KCzXPcc.exe
  C:\Windows\System\KCzXPcc.exe
  2⤵
  PID:6860
- C:\Windows\System\KhQPRBU.exe
  C:\Windows\System\KhQPRBU.exe
  2⤵
  PID:6876
- C:\Windows\System\yMPhWZH.exe
  C:\Windows\System\yMPhWZH.exe
  2⤵
  PID:6892
- C:\Windows\System\vySjWpw.exe
  C:\Windows\System\vySjWpw.exe
  2⤵
  PID:6908
- C:\Windows\System\MHfNzOo.exe
  C:\Windows\System\MHfNzOo.exe
  2⤵
  PID:6924
- C:\Windows\System\vpraKMG.exe
  C:\Windows\System\vpraKMG.exe
  2⤵
  PID:6940
- C:\Windows\System\iYnPsaZ.exe
  C:\Windows\System\iYnPsaZ.exe
  2⤵
  PID:6956
- C:\Windows\System\QIvVkRm.exe
  C:\Windows\System\QIvVkRm.exe
  2⤵
  PID:6972
- C:\Windows\System\CcPlFXW.exe
  C:\Windows\System\CcPlFXW.exe
  2⤵
  PID:6988
- C:\Windows\System\blFNLmj.exe
  C:\Windows\System\blFNLmj.exe
  2⤵
  PID:7004
- C:\Windows\System\TdUHgQx.exe
  C:\Windows\System\TdUHgQx.exe
  2⤵
  PID:7020
- C:\Windows\System\ZDsEqQe.exe
  C:\Windows\System\ZDsEqQe.exe
  2⤵
  PID:7036
- C:\Windows\System\DPxbSjy.exe
  C:\Windows\System\DPxbSjy.exe
  2⤵
  PID:7052
- C:\Windows\System\HoqXncJ.exe
  C:\Windows\System\HoqXncJ.exe
  2⤵
  PID:7068
- C:\Windows\System\wFBBYje.exe
  C:\Windows\System\wFBBYje.exe
  2⤵
  PID:7084
- C:\Windows\System\exnSWzz.exe
  C:\Windows\System\exnSWzz.exe
  2⤵
  PID:7100
- C:\Windows\System\klLdZuf.exe
  C:\Windows\System\klLdZuf.exe
  2⤵
  PID:7116
- C:\Windows\System\CkQbazR.exe
  C:\Windows\System\CkQbazR.exe
  2⤵
  PID:7132
- C:\Windows\System\ZukagYL.exe
  C:\Windows\System\ZukagYL.exe
  2⤵
  PID:7148
- C:\Windows\System\jPsejAr.exe
  C:\Windows\System\jPsejAr.exe
  2⤵
  PID:7164
- C:\Windows\System\MSjpggY.exe
  C:\Windows\System\MSjpggY.exe
  2⤵
  PID:2720
- C:\Windows\System\cCLDeZk.exe
  C:\Windows\System\cCLDeZk.exe
  2⤵
  PID:5128
- C:\Windows\System\dnncPEg.exe
  C:\Windows\System\dnncPEg.exe
  2⤵
  PID:5388
- C:\Windows\System\JmclPEY.exe
  C:\Windows\System\JmclPEY.exe
  2⤵
  PID:5676
- C:\Windows\System\zFHgJaw.exe
  C:\Windows\System\zFHgJaw.exe
  2⤵
  PID:1468
- C:\Windows\System\olJsYMW.exe
  C:\Windows\System\olJsYMW.exe
  2⤵
  PID:5180
- C:\Windows\System\vDLMhrc.exe
  C:\Windows\System\vDLMhrc.exe
  2⤵
  PID:5404
- C:\Windows\System\OFZtnmx.exe
  C:\Windows\System\OFZtnmx.exe
  2⤵
  PID:5628
- C:\Windows\System\vOXhgeo.exe
  C:\Windows\System\vOXhgeo.exe
  2⤵
  PID:5860
- C:\Windows\System\MHVSiSp.exe
  C:\Windows\System\MHVSiSp.exe
  2⤵
  PID:5864
- C:\Windows\System\zRByAiJ.exe
  C:\Windows\System\zRByAiJ.exe
  2⤵
  PID:5904
- C:\Windows\System\slzAMSq.exe
  C:\Windows\System\slzAMSq.exe
  2⤵
  PID:5984
- C:\Windows\System\qHPGKFJ.exe
  C:\Windows\System\qHPGKFJ.exe
  2⤵
  PID:4852
- C:\Windows\System\cFLuyww.exe
  C:\Windows\System\cFLuyww.exe
  2⤵
  PID:5324
- C:\Windows\System\ErcUNie.exe
  C:\Windows\System\ErcUNie.exe
  2⤵
  PID:5436
- C:\Windows\System\jIwwYBK.exe
  C:\Windows\System\jIwwYBK.exe
  2⤵
  PID:5972
- C:\Windows\System\rdqasJg.exe
  C:\Windows\System\rdqasJg.exe
  2⤵
  PID:6196
- C:\Windows\System\xcGnYHB.exe
  C:\Windows\System\xcGnYHB.exe
  2⤵
  PID:5952
- C:\Windows\System\JselcVT.exe
  C:\Windows\System\JselcVT.exe
  2⤵
  PID:5420
- C:\Windows\System\tYRZPkz.exe
  C:\Windows\System\tYRZPkz.exe
  2⤵
  PID:5692
- C:\Windows\System\YhWLqth.exe
  C:\Windows\System\YhWLqth.exe
  2⤵
  PID:6180
- C:\Windows\System\smNGKDc.exe
  C:\Windows\System\smNGKDc.exe
  2⤵
  PID:6244
- C:\Windows\System\XNjXpoz.exe
  C:\Windows\System\XNjXpoz.exe
  2⤵
  PID:6308
- C:\Windows\System\xsSMebr.exe
  C:\Windows\System\xsSMebr.exe
  2⤵
  PID:6372
- C:\Windows\System\MeBUAjD.exe
  C:\Windows\System\MeBUAjD.exe
  2⤵
  PID:6436
- C:\Windows\System\vaENDIh.exe
  C:\Windows\System\vaENDIh.exe
  2⤵
  PID:6288
- C:\Windows\System\PHXQiAv.exe
  C:\Windows\System\PHXQiAv.exe
  2⤵
  PID:6352
- C:\Windows\System\ESiLbJb.exe
  C:\Windows\System\ESiLbJb.exe
  2⤵
  PID:6416
- C:\Windows\System\emqOqHv.exe
  C:\Windows\System\emqOqHv.exe
  2⤵
  PID:6480
- C:\Windows\System\COtoflb.exe
  C:\Windows\System\COtoflb.exe
  2⤵
  PID:6516
- C:\Windows\System\gKELBCQ.exe
  C:\Windows\System\gKELBCQ.exe
  2⤵
  PID:6544
- C:\Windows\System\HvojoJD.exe
  C:\Windows\System\HvojoJD.exe
  2⤵
  PID:6612
- C:\Windows\System\wrOonGQ.exe
  C:\Windows\System\wrOonGQ.exe
  2⤵
  PID:6528
- C:\Windows\System\GPvwXXj.exe
  C:\Windows\System\GPvwXXj.exe
  2⤵
  PID:6628
- C:\Windows\System\wXOugHa.exe
  C:\Windows\System\wXOugHa.exe
  2⤵
  PID:6656
- C:\Windows\System\OgjdXdK.exe
  C:\Windows\System\OgjdXdK.exe
  2⤵
  PID:6736
- C:\Windows\System\dEZBgfJ.exe
  C:\Windows\System\dEZBgfJ.exe
  2⤵
  PID:6800
- C:\Windows\System\DuGQCsw.exe
  C:\Windows\System\DuGQCsw.exe
  2⤵
  PID:6692
- C:\Windows\System\LAFbQBU.exe
  C:\Windows\System\LAFbQBU.exe
  2⤵
  PID:6900
- C:\Windows\System\zPkBYaL.exe
  C:\Windows\System\zPkBYaL.exe
  2⤵
  PID:6932
- C:\Windows\System\iExPpFH.exe
  C:\Windows\System\iExPpFH.exe
  2⤵
  PID:6916
- C:\Windows\System\pmOjEgr.exe
  C:\Windows\System\pmOjEgr.exe
  2⤵
  PID:6996
- C:\Windows\System\WyILDGy.exe
  C:\Windows\System\WyILDGy.exe
  2⤵
  PID:7032
- C:\Windows\System\yjcnCtv.exe
  C:\Windows\System\yjcnCtv.exe
  2⤵
  PID:2440
- C:\Windows\System\REQIYhH.exe
  C:\Windows\System\REQIYhH.exe
  2⤵
  PID:6820
- C:\Windows\System\tsevBwD.exe
  C:\Windows\System\tsevBwD.exe
  2⤵
  PID:6888
- C:\Windows\System\aNVlZKj.exe
  C:\Windows\System\aNVlZKj.exe
  2⤵
  PID:7016
- C:\Windows\System\iVkOanV.exe
  C:\Windows\System\iVkOanV.exe
  2⤵
  PID:7080
- C:\Windows\System\awZiMBH.exe
  C:\Windows\System\awZiMBH.exe
  2⤵
  PID:7124
- C:\Windows\System\lGSctyP.exe
  C:\Windows\System\lGSctyP.exe
  2⤵
  PID:7160
- C:\Windows\System\NxqQeSu.exe
  C:\Windows\System\NxqQeSu.exe
  2⤵
  PID:7140
- C:\Windows\System\ntLqhlv.exe
  C:\Windows\System\ntLqhlv.exe
  2⤵
  PID:2496
- C:\Windows\System\DlhKVLK.exe
  C:\Windows\System\DlhKVLK.exe
  2⤵
  PID:5712
- C:\Windows\System\YNHYSSO.exe
  C:\Windows\System\YNHYSSO.exe
  2⤵
  PID:5856
- C:\Windows\System\QEMBarp.exe
  C:\Windows\System\QEMBarp.exe
  2⤵
  PID:1408
- C:\Windows\System\IcwrDFj.exe
  C:\Windows\System\IcwrDFj.exe
  2⤵
  PID:5824
- C:\Windows\System\FEUPELy.exe
  C:\Windows\System\FEUPELy.exe
  2⤵
  PID:6116
- C:\Windows\System\Eujpdrg.exe
  C:\Windows\System\Eujpdrg.exe
  2⤵
  PID:5936
- C:\Windows\System\PXScnLc.exe
  C:\Windows\System\PXScnLc.exe
  2⤵
  PID:2552
- C:\Windows\System\HxeqPmj.exe
  C:\Windows\System\HxeqPmj.exe
  2⤵
  PID:5164
- C:\Windows\System\gARMlui.exe
  C:\Windows\System\gARMlui.exe
  2⤵
  PID:6148
- C:\Windows\System\rVgFeIV.exe
  C:\Windows\System\rVgFeIV.exe
  2⤵
  PID:6176
- C:\Windows\System\BRuUKZC.exe
  C:\Windows\System\BRuUKZC.exe
  2⤵
  PID:6368
- C:\Windows\System\CphDcGx.exe
  C:\Windows\System\CphDcGx.exe
  2⤵
  PID:6384
- C:\Windows\System\hOsZTzp.exe
  C:\Windows\System\hOsZTzp.exe
  2⤵
  PID:6320
- C:\Windows\System\nWuCrac.exe
  C:\Windows\System\nWuCrac.exe
  2⤵
  PID:6608
- C:\Windows\System\KXwCGmm.exe
  C:\Windows\System\KXwCGmm.exe
  2⤵
  PID:6532
- C:\Windows\System\phEIjyQ.exe
  C:\Windows\System\phEIjyQ.exe
  2⤵
  PID:6596
- C:\Windows\System\HXRlPcf.exe
  C:\Windows\System\HXRlPcf.exe
  2⤵
  PID:6768
- C:\Windows\System\KqkXHZR.exe
  C:\Windows\System\KqkXHZR.exe
  2⤵
  PID:6752
- C:\Windows\System\ChlNMjh.exe
  C:\Windows\System\ChlNMjh.exe
  2⤵
  PID:6920
- C:\Windows\System\BStClrl.exe
  C:\Windows\System\BStClrl.exe
  2⤵
  PID:6856
- C:\Windows\System\DKBtnQh.exe
  C:\Windows\System\DKBtnQh.exe
  2⤵
  PID:6868
- C:\Windows\System\oWGgbDq.exe
  C:\Windows\System\oWGgbDq.exe
  2⤵
  PID:6720
- C:\Windows\System\lLegZmx.exe
  C:\Windows\System\lLegZmx.exe
  2⤵
  PID:7076
- C:\Windows\System\vVASVFt.exe
  C:\Windows\System\vVASVFt.exe
  2⤵
  PID:7108
- C:\Windows\System\MrzVOth.exe
  C:\Windows\System\MrzVOth.exe
  2⤵
  PID:6100
- C:\Windows\System\JakXBCz.exe
  C:\Windows\System\JakXBCz.exe
  2⤵
  PID:5624
- C:\Windows\System\nnCWUQm.exe
  C:\Windows\System\nnCWUQm.exe
  2⤵
  PID:5372
- C:\Windows\System\nrfxYUs.exe
  C:\Windows\System\nrfxYUs.exe
  2⤵
  PID:5900
- C:\Windows\System\RGsFOFE.exe
  C:\Windows\System\RGsFOFE.exe
  2⤵
  PID:5688
- C:\Windows\System\XIoKKZG.exe
  C:\Windows\System\XIoKKZG.exe
  2⤵
  PID:6240
- C:\Windows\System\OIAqVwE.exe
  C:\Windows\System\OIAqVwE.exe
  2⤵
  PID:6212
- C:\Windows\System\bAJowLJ.exe
  C:\Windows\System\bAJowLJ.exe
  2⤵
  PID:6580
- C:\Windows\System\WHaOfzv.exe
  C:\Windows\System\WHaOfzv.exe
  2⤵
  PID:6784
- C:\Windows\System\CisTmQg.exe
  C:\Windows\System\CisTmQg.exe
  2⤵
  PID:7096
- C:\Windows\System\ZRpluOj.exe
  C:\Windows\System\ZRpluOj.exe
  2⤵
  PID:5176
- C:\Windows\System\WncTlOs.exe
  C:\Windows\System\WncTlOs.exe
  2⤵
  PID:6208
- C:\Windows\System\AtTIRqb.exe
  C:\Windows\System\AtTIRqb.exe
  2⤵
  PID:7184
- C:\Windows\System\NBrebRq.exe
  C:\Windows\System\NBrebRq.exe
  2⤵
  PID:7200
- C:\Windows\System\dhwyCtn.exe
  C:\Windows\System\dhwyCtn.exe
  2⤵
  PID:7216
- C:\Windows\System\TrXeeyN.exe
  C:\Windows\System\TrXeeyN.exe
  2⤵
  PID:7232
- C:\Windows\System\RcfSqOy.exe
  C:\Windows\System\RcfSqOy.exe
  2⤵
  PID:7248
- C:\Windows\System\hpYJutj.exe
  C:\Windows\System\hpYJutj.exe
  2⤵
  PID:7264
- C:\Windows\System\XYrjzrb.exe
  C:\Windows\System\XYrjzrb.exe
  2⤵
  PID:7280
- C:\Windows\System\doaSHHz.exe
  C:\Windows\System\doaSHHz.exe
  2⤵
  PID:7296
- C:\Windows\System\pKYqTpe.exe
  C:\Windows\System\pKYqTpe.exe
  2⤵
  PID:7312
- C:\Windows\System\cGupdok.exe
  C:\Windows\System\cGupdok.exe
  2⤵
  PID:7328
- C:\Windows\System\jZqBmMT.exe
  C:\Windows\System\jZqBmMT.exe
  2⤵
  PID:7344
- C:\Windows\System\pqkxnIL.exe
  C:\Windows\System\pqkxnIL.exe
  2⤵
  PID:7360
- C:\Windows\System\aXwVbvW.exe
  C:\Windows\System\aXwVbvW.exe
  2⤵
  PID:7376
- C:\Windows\System\qrjROSh.exe
  C:\Windows\System\qrjROSh.exe
  2⤵
  PID:7392
- C:\Windows\System\jfIvoqP.exe
  C:\Windows\System\jfIvoqP.exe
  2⤵
  PID:7408
- C:\Windows\System\MGvjiyn.exe
  C:\Windows\System\MGvjiyn.exe
  2⤵
  PID:7424
- C:\Windows\System\otOEnKH.exe
  C:\Windows\System\otOEnKH.exe
  2⤵
  PID:7440
- C:\Windows\System\efNFqXv.exe
  C:\Windows\System\efNFqXv.exe
  2⤵
  PID:7456
- C:\Windows\System\vfQrtLX.exe
  C:\Windows\System\vfQrtLX.exe
  2⤵
  PID:7472
- C:\Windows\System\yvSZNOV.exe
  C:\Windows\System\yvSZNOV.exe
  2⤵
  PID:7488
- C:\Windows\System\WLXcJZH.exe
  C:\Windows\System\WLXcJZH.exe
  2⤵
  PID:7504
- C:\Windows\System\RbRQHEC.exe
  C:\Windows\System\RbRQHEC.exe
  2⤵
  PID:7520
- C:\Windows\System\TvyooMn.exe
  C:\Windows\System\TvyooMn.exe
  2⤵
  PID:7536
- C:\Windows\System\ufMxYTw.exe
  C:\Windows\System\ufMxYTw.exe
  2⤵
  PID:7552
- C:\Windows\System\MUkgrdp.exe
  C:\Windows\System\MUkgrdp.exe
  2⤵
  PID:7568
- C:\Windows\System\qmIUnwR.exe
  C:\Windows\System\qmIUnwR.exe
  2⤵
  PID:7584
- C:\Windows\System\sjSVrzS.exe
  C:\Windows\System\sjSVrzS.exe
  2⤵
  PID:7600
- C:\Windows\System\vQXGlQR.exe
  C:\Windows\System\vQXGlQR.exe
  2⤵
  PID:7616
- C:\Windows\System\anfNgbc.exe
  C:\Windows\System\anfNgbc.exe
  2⤵
  PID:7632
- C:\Windows\System\mtyQfsU.exe
  C:\Windows\System\mtyQfsU.exe
  2⤵
  PID:7648
- C:\Windows\System\DUjGMTT.exe
  C:\Windows\System\DUjGMTT.exe
  2⤵
  PID:7664
- C:\Windows\System\TZVGtDr.exe
  C:\Windows\System\TZVGtDr.exe
  2⤵
  PID:7680
- C:\Windows\System\mOpvgNG.exe
  C:\Windows\System\mOpvgNG.exe
  2⤵
  PID:7696
- C:\Windows\System\LesBMWU.exe
  C:\Windows\System\LesBMWU.exe
  2⤵
  PID:7712
- C:\Windows\System\WBRUBam.exe
  C:\Windows\System\WBRUBam.exe
  2⤵
  PID:7728
- C:\Windows\System\XfNswoP.exe
  C:\Windows\System\XfNswoP.exe
  2⤵
  PID:7744
- C:\Windows\System\ZKJOBJl.exe
  C:\Windows\System\ZKJOBJl.exe
  2⤵
  PID:7760
- C:\Windows\System\laVuxDJ.exe
  C:\Windows\System\laVuxDJ.exe
  2⤵
  PID:7776
- C:\Windows\System\LiwhoBN.exe
  C:\Windows\System\LiwhoBN.exe
  2⤵
  PID:7792
- C:\Windows\System\FngsoJD.exe
  C:\Windows\System\FngsoJD.exe
  2⤵
  PID:7808
- C:\Windows\System\aBqcTjh.exe
  C:\Windows\System\aBqcTjh.exe
  2⤵
  PID:7824
- C:\Windows\System\IAlUdHa.exe
  C:\Windows\System\IAlUdHa.exe
  2⤵
  PID:7840
- C:\Windows\System\zGfBDyr.exe
  C:\Windows\System\zGfBDyr.exe
  2⤵
  PID:7856
- C:\Windows\System\WfBprYR.exe
  C:\Windows\System\WfBprYR.exe
  2⤵
  PID:7872
- C:\Windows\System\FTSZUCq.exe
  C:\Windows\System\FTSZUCq.exe
  2⤵
  PID:7888
- C:\Windows\System\xPJrjov.exe
  C:\Windows\System\xPJrjov.exe
  2⤵
  PID:7904
- C:\Windows\System\jlqBOvD.exe
  C:\Windows\System\jlqBOvD.exe
  2⤵
  PID:7920
- C:\Windows\System\wbeoyaU.exe
  C:\Windows\System\wbeoyaU.exe
  2⤵
  PID:7936
- C:\Windows\System\WVkWPdx.exe
  C:\Windows\System\WVkWPdx.exe
  2⤵
  PID:7952
- C:\Windows\System\bsGxfbx.exe
  C:\Windows\System\bsGxfbx.exe
  2⤵
  PID:7968
- C:\Windows\System\CwzREIE.exe
  C:\Windows\System\CwzREIE.exe
  2⤵
  PID:7984
- C:\Windows\System\MuoTOvm.exe
  C:\Windows\System\MuoTOvm.exe
  2⤵
  PID:8000
- C:\Windows\System\JtaWXVW.exe
  C:\Windows\System\JtaWXVW.exe
  2⤵
  PID:8016
- C:\Windows\System\LnlsOtq.exe
  C:\Windows\System\LnlsOtq.exe
  2⤵
  PID:8032
- C:\Windows\System\vsOTjdn.exe
  C:\Windows\System\vsOTjdn.exe
  2⤵
  PID:8048
- C:\Windows\System\yqHmjRV.exe
  C:\Windows\System\yqHmjRV.exe
  2⤵
  PID:8064
- C:\Windows\System\fisJDKA.exe
  C:\Windows\System\fisJDKA.exe
  2⤵
  PID:8080
- C:\Windows\System\bGdsNTd.exe
  C:\Windows\System\bGdsNTd.exe
  2⤵
  PID:8096
- C:\Windows\System\HrCgAIA.exe
  C:\Windows\System\HrCgAIA.exe
  2⤵
  PID:8112
- C:\Windows\System\XKEkZeb.exe
  C:\Windows\System\XKEkZeb.exe
  2⤵
  PID:8128
- C:\Windows\System\WikFVhP.exe
  C:\Windows\System\WikFVhP.exe
  2⤵
  PID:8144
- C:\Windows\System\kioJYPw.exe
  C:\Windows\System\kioJYPw.exe
  2⤵
  PID:8160
- C:\Windows\System\SiSBybj.exe
  C:\Windows\System\SiSBybj.exe
  2⤵
  PID:8176
- C:\Windows\System\XyYWSMc.exe
  C:\Windows\System\XyYWSMc.exe
  2⤵
  PID:4400
- C:\Windows\System\oBSMJbK.exe
  C:\Windows\System\oBSMJbK.exe
  2⤵
  PID:6708
- C:\Windows\System\WNBKbBd.exe
  C:\Windows\System\WNBKbBd.exe
  2⤵
  PID:7000
- C:\Windows\System\crXUwpd.exe
  C:\Windows\System\crXUwpd.exe
  2⤵
  PID:6192
- C:\Windows\System\wxvjRCQ.exe
  C:\Windows\System\wxvjRCQ.exe
  2⤵
  PID:6952
- C:\Windows\System\xBnNyBO.exe
  C:\Windows\System\xBnNyBO.exe
  2⤵
  PID:7180
- C:\Windows\System\NYoDPGW.exe
  C:\Windows\System\NYoDPGW.exe
  2⤵
  PID:6816
- C:\Windows\System\gsMBdTw.exe
  C:\Windows\System\gsMBdTw.exe
  2⤵
  PID:7192
- C:\Windows\System\UeWdbMd.exe
  C:\Windows\System\UeWdbMd.exe
  2⤵
  PID:6048
- C:\Windows\System\SGHolig.exe
  C:\Windows\System\SGHolig.exe
  2⤵
  PID:7288
- C:\Windows\System\wbgUjsq.exe
  C:\Windows\System\wbgUjsq.exe
  2⤵
  PID:7320
- C:\Windows\System\eyLrizo.exe
  C:\Windows\System\eyLrizo.exe
  2⤵
  PID:7384
- C:\Windows\System\RunwDZB.exe
  C:\Windows\System\RunwDZB.exe
  2⤵
  PID:7448
- C:\Windows\System\aTPkraA.exe
  C:\Windows\System\aTPkraA.exe
  2⤵
  PID:7484
- C:\Windows\System\tUwXYik.exe
  C:\Windows\System\tUwXYik.exe
  2⤵
  PID:7548
- C:\Windows\System\hTHaJsM.exe
  C:\Windows\System\hTHaJsM.exe
  2⤵
  PID:7612
- C:\Windows\System\VIfqGbm.exe
  C:\Windows\System\VIfqGbm.exe
  2⤵
  PID:7496
- C:\Windows\System\KqUxbJT.exe
  C:\Windows\System\KqUxbJT.exe
  2⤵
  PID:7560
- C:\Windows\System\yRzVZtE.exe
  C:\Windows\System\yRzVZtE.exe
  2⤵
  PID:7276
- C:\Windows\System\hkvXNhM.exe
  C:\Windows\System\hkvXNhM.exe
  2⤵
  PID:7340
- C:\Windows\System\xlkhYGs.exe
  C:\Windows\System\xlkhYGs.exe
  2⤵
  PID:7644
- C:\Windows\System\lbSjSts.exe
  C:\Windows\System\lbSjSts.exe
  2⤵
  PID:7404
- C:\Windows\System\kZhpquD.exe
  C:\Windows\System\kZhpquD.exe
  2⤵
  PID:7596
- C:\Windows\System\OfSOntp.exe
  C:\Windows\System\OfSOntp.exe
  2⤵
  PID:7740
- C:\Windows\System\pyMhItb.exe
  C:\Windows\System\pyMhItb.exe
  2⤵
  PID:7804
- C:\Windows\System\OwgeNIe.exe
  C:\Windows\System\OwgeNIe.exe
  2⤵
  PID:7868
- C:\Windows\System\ViMrWhc.exe
  C:\Windows\System\ViMrWhc.exe
  2⤵
  PID:7932
- C:\Windows\System\HccfVqF.exe
  C:\Windows\System\HccfVqF.exe
  2⤵
  PID:7996
- C:\Windows\System\zZlkenc.exe
  C:\Windows\System\zZlkenc.exe
  2⤵
  PID:8056
- C:\Windows\System\mnHCQKS.exe
  C:\Windows\System\mnHCQKS.exe
  2⤵
  PID:8012
- C:\Windows\System\YFvgmjB.exe
  C:\Windows\System\YFvgmjB.exe
  2⤵
  PID:7688
- C:\Windows\System\dytVHim.exe
  C:\Windows\System\dytVHim.exe
  2⤵
  PID:7756
- C:\Windows\System\eVWlxTC.exe
  C:\Windows\System\eVWlxTC.exe
  2⤵
  PID:7820
- C:\Windows\System\sCvIiEQ.exe
  C:\Windows\System\sCvIiEQ.exe
  2⤵
  PID:7884
- C:\Windows\System\FHjsmIx.exe
  C:\Windows\System\FHjsmIx.exe
  2⤵
  PID:7944
- C:\Windows\System\VfoYUCW.exe
  C:\Windows\System\VfoYUCW.exe
  2⤵
  PID:8088
- C:\Windows\System\luuxlGx.exe
  C:\Windows\System\luuxlGx.exe
  2⤵
  PID:8152
- C:\Windows\System\VhYmJDG.exe
  C:\Windows\System\VhYmJDG.exe
  2⤵
  PID:8188
- C:\Windows\System\aKzJpHj.exe
  C:\Windows\System\aKzJpHj.exe
  2⤵
  PID:6836
- C:\Windows\System\HNZgypO.exe
  C:\Windows\System\HNZgypO.exe
  2⤵
  PID:8108
- C:\Windows\System\rsgWJyn.exe
  C:\Windows\System\rsgWJyn.exe
  2⤵
  PID:7416
- C:\Windows\System\XAuZOwE.exe
  C:\Windows\System\XAuZOwE.exe
  2⤵
  PID:7464
- C:\Windows\System\UrjxWkc.exe
  C:\Windows\System\UrjxWkc.exe
  2⤵
  PID:7272
- C:\Windows\System\QxHEabX.exe
  C:\Windows\System\QxHEabX.exe
  2⤵
  PID:7628
- C:\Windows\System\GBEJmaE.exe
  C:\Windows\System\GBEJmaE.exe
  2⤵
  PID:7900
- C:\Windows\System\xECnOvL.exe
  C:\Windows\System\xECnOvL.exe
  2⤵
  PID:7260
- C:\Windows\System\IcnPeNc.exe
  C:\Windows\System\IcnPeNc.exe
  2⤵
  PID:7244
- C:\Windows\System\COaroaO.exe
  C:\Windows\System\COaroaO.exe
  2⤵
  PID:7528
- C:\Windows\System\THMrVmK.exe
  C:\Windows\System\THMrVmK.exe
  2⤵
  PID:7964
- C:\Windows\System\mcsoyyx.exe
  C:\Windows\System\mcsoyyx.exe
  2⤵
  PID:6592
- C:\Windows\System\gqmdToE.exe
  C:\Windows\System\gqmdToE.exe
  2⤵
  PID:7676
- C:\Windows\System\sYSclne.exe
  C:\Windows\System\sYSclne.exe
  2⤵
  PID:8172
- C:\Windows\System\sNTrLpE.exe
  C:\Windows\System\sNTrLpE.exe
  2⤵
  PID:6704
- C:\Windows\System\zJwigME.exe
  C:\Windows\System\zJwigME.exe
  2⤵
  PID:8044
- C:\Windows\System\ZjMdFmH.exe
  C:\Windows\System\ZjMdFmH.exe
  2⤵
  PID:8072
- C:\Windows\System\SPSSGGN.exe
  C:\Windows\System\SPSSGGN.exe
  2⤵
  PID:7916
- C:\Windows\System\KAkIcjq.exe
  C:\Windows\System\KAkIcjq.exe
  2⤵
  PID:8124
- C:\Windows\System\ZiAWVaz.exe
  C:\Windows\System\ZiAWVaz.exe
  2⤵
  PID:7880
- C:\Windows\System\ZGagjkM.exe
  C:\Windows\System\ZGagjkM.exe
  2⤵
  PID:8184
- C:\Windows\System\YOXieuT.exe
  C:\Windows\System\YOXieuT.exe
  2⤵
  PID:7544
- C:\Windows\System\FtSwOZr.exe
  C:\Windows\System\FtSwOZr.exe
  2⤵
  PID:8168
- C:\Windows\System\srOybSk.exe
  C:\Windows\System\srOybSk.exe
  2⤵
  PID:8104
- C:\Windows\System\KJhjRfz.exe
  C:\Windows\System\KJhjRfz.exe
  2⤵
  PID:7240
- C:\Windows\System\oVWIqMo.exe
  C:\Windows\System\oVWIqMo.exe
  2⤵
  PID:7336
- C:\Windows\System\MsQuSDP.exe
  C:\Windows\System\MsQuSDP.exe
  2⤵
  PID:7852
- C:\Windows\System\ojLFiFk.exe
  C:\Windows\System\ojLFiFk.exe
  2⤵
  PID:7720
- C:\Windows\System\sDOYsBI.exe
  C:\Windows\System\sDOYsBI.exe
  2⤵
  PID:8136
- C:\Windows\System\LtfOhFw.exe
  C:\Windows\System\LtfOhFw.exe
  2⤵
  PID:7724
- C:\Windows\System\rRyzEGw.exe
  C:\Windows\System\rRyzEGw.exe
  2⤵
  PID:7752
- C:\Windows\System\saWvODj.exe
  C:\Windows\System\saWvODj.exe
  2⤵
  PID:7292
- C:\Windows\System\VagCPtg.exe
  C:\Windows\System\VagCPtg.exe
  2⤵
  PID:7864
- C:\Windows\System\DRBinLp.exe
  C:\Windows\System\DRBinLp.exe
  2⤵
  PID:7356
- C:\Windows\System\fLCemxU.exe
  C:\Windows\System\fLCemxU.exe
  2⤵
  PID:7736
- C:\Windows\System\DQXDZVM.exe
  C:\Windows\System\DQXDZVM.exe
  2⤵
  PID:7624
- C:\Windows\System\nJFOsRh.exe
  C:\Windows\System\nJFOsRh.exe
  2⤵
  PID:8204
- C:\Windows\System\KbGbETI.exe
  C:\Windows\System\KbGbETI.exe
  2⤵
  PID:8220
- C:\Windows\System\MAOVXXw.exe
  C:\Windows\System\MAOVXXw.exe
  2⤵
  PID:8236
- C:\Windows\System\zCoSPij.exe
  C:\Windows\System\zCoSPij.exe
  2⤵
  PID:8252
- C:\Windows\System\IQaCUUD.exe
  C:\Windows\System\IQaCUUD.exe
  2⤵
  PID:8268
- C:\Windows\System\dCwLxlh.exe
  C:\Windows\System\dCwLxlh.exe
  2⤵
  PID:8284
- C:\Windows\System\GfjRgDL.exe
  C:\Windows\System\GfjRgDL.exe
  2⤵
  PID:8300
- C:\Windows\System\sGyohNe.exe
  C:\Windows\System\sGyohNe.exe
  2⤵
  PID:8316
- C:\Windows\System\gMjoHLF.exe
  C:\Windows\System\gMjoHLF.exe
  2⤵
  PID:8332
- C:\Windows\System\jQOwzNY.exe
  C:\Windows\System\jQOwzNY.exe
  2⤵
  PID:8348
- C:\Windows\System\GFlYrlx.exe
  C:\Windows\System\GFlYrlx.exe
  2⤵
  PID:8364
- C:\Windows\System\TFcMnwD.exe
  C:\Windows\System\TFcMnwD.exe
  2⤵
  PID:8380
- C:\Windows\System\kXqTMlU.exe
  C:\Windows\System\kXqTMlU.exe
  2⤵
  PID:8396
- C:\Windows\System\gdayzZz.exe
  C:\Windows\System\gdayzZz.exe
  2⤵
  PID:8412
- C:\Windows\System\tQWxOUt.exe
  C:\Windows\System\tQWxOUt.exe
  2⤵
  PID:8428
- C:\Windows\System\YwlJwEf.exe
  C:\Windows\System\YwlJwEf.exe
  2⤵
  PID:8444
- C:\Windows\System\GtIwhfh.exe
  C:\Windows\System\GtIwhfh.exe
  2⤵
  PID:8460
- C:\Windows\System\rYOGqzA.exe
  C:\Windows\System\rYOGqzA.exe
  2⤵
  PID:8476
- C:\Windows\System\ADrVnpM.exe
  C:\Windows\System\ADrVnpM.exe
  2⤵
  PID:8492
- C:\Windows\System\tNWjUZJ.exe
  C:\Windows\System\tNWjUZJ.exe
  2⤵
  PID:8508
- C:\Windows\System\qQtYIoW.exe
  C:\Windows\System\qQtYIoW.exe
  2⤵
  PID:8524
- C:\Windows\System\oyjLdBi.exe
  C:\Windows\System\oyjLdBi.exe
  2⤵
  PID:8540
- C:\Windows\System\VJCGohd.exe
  C:\Windows\System\VJCGohd.exe
  2⤵
  PID:8556
- C:\Windows\System\OXOZTFu.exe
  C:\Windows\System\OXOZTFu.exe
  2⤵
  PID:8572
- C:\Windows\System\syGmBWX.exe
  C:\Windows\System\syGmBWX.exe
  2⤵
  PID:8588
- C:\Windows\System\YENlCTW.exe
  C:\Windows\System\YENlCTW.exe
  2⤵
  PID:8604
- C:\Windows\System\urbsXAb.exe
  C:\Windows\System\urbsXAb.exe
  2⤵
  PID:8620
- C:\Windows\System\TdLhtCn.exe
  C:\Windows\System\TdLhtCn.exe
  2⤵
  PID:8636
- C:\Windows\System\gKfEcBN.exe
  C:\Windows\System\gKfEcBN.exe
  2⤵
  PID:8652
- C:\Windows\System\ZJGepcA.exe
  C:\Windows\System\ZJGepcA.exe
  2⤵
  PID:8668
- C:\Windows\System\uFllphj.exe
  C:\Windows\System\uFllphj.exe
  2⤵
  PID:8684
- C:\Windows\System\xDCmbgO.exe
  C:\Windows\System\xDCmbgO.exe
  2⤵
  PID:8700
- C:\Windows\System\BkvEMgc.exe
  C:\Windows\System\BkvEMgc.exe
  2⤵
  PID:8716
- C:\Windows\System\GbUgLSa.exe
  C:\Windows\System\GbUgLSa.exe
  2⤵
  PID:8732
- C:\Windows\System\vGaYTbU.exe
  C:\Windows\System\vGaYTbU.exe
  2⤵
  PID:8748
- C:\Windows\System\sztYIUs.exe
  C:\Windows\System\sztYIUs.exe
  2⤵
  PID:8764
- C:\Windows\System\HEusPLd.exe
  C:\Windows\System\HEusPLd.exe
  2⤵
  PID:8780
- C:\Windows\System\ntprzkm.exe
  C:\Windows\System\ntprzkm.exe
  2⤵
  PID:8796
- C:\Windows\System\uPMXyow.exe
  C:\Windows\System\uPMXyow.exe
  2⤵
  PID:8812
- C:\Windows\System\GmyfPuT.exe
  C:\Windows\System\GmyfPuT.exe
  2⤵
  PID:8828
- C:\Windows\System\fTEjkbs.exe
  C:\Windows\System\fTEjkbs.exe
  2⤵
  PID:8844
- C:\Windows\System\GlaTsAk.exe
  C:\Windows\System\GlaTsAk.exe
  2⤵
  PID:8860
- C:\Windows\System\aNKVduP.exe
  C:\Windows\System\aNKVduP.exe
  2⤵
  PID:8876
- C:\Windows\System\EaFQFwf.exe
  C:\Windows\System\EaFQFwf.exe
  2⤵
  PID:8892
- C:\Windows\System\HPYPeUz.exe
  C:\Windows\System\HPYPeUz.exe
  2⤵
  PID:8908
- C:\Windows\System\OwBwZSM.exe
  C:\Windows\System\OwBwZSM.exe
  2⤵
  PID:8924
- C:\Windows\System\OyifQDB.exe
  C:\Windows\System\OyifQDB.exe
  2⤵
  PID:8940
- C:\Windows\System\PKSLSeB.exe
  C:\Windows\System\PKSLSeB.exe
  2⤵
  PID:8956
- C:\Windows\System\FrFnCFx.exe
  C:\Windows\System\FrFnCFx.exe
  2⤵
  PID:8972
- C:\Windows\System\yUIJuRp.exe
  C:\Windows\System\yUIJuRp.exe
  2⤵
  PID:8988
- C:\Windows\System\iuvGbnk.exe
  C:\Windows\System\iuvGbnk.exe
  2⤵
  PID:9004
- C:\Windows\System\QZndIbG.exe
  C:\Windows\System\QZndIbG.exe
  2⤵
  PID:9020
- C:\Windows\System\YAreDRd.exe
  C:\Windows\System\YAreDRd.exe
  2⤵
  PID:9036
- C:\Windows\System\tOpxHJv.exe
  C:\Windows\System\tOpxHJv.exe
  2⤵
  PID:9052
- C:\Windows\System\xumbgDZ.exe
  C:\Windows\System\xumbgDZ.exe
  2⤵
  PID:9068
- C:\Windows\System\wJNLGlJ.exe
  C:\Windows\System\wJNLGlJ.exe
  2⤵
  PID:9084
- C:\Windows\System\Nzepktx.exe
  C:\Windows\System\Nzepktx.exe
  2⤵
  PID:9100
- C:\Windows\System\eWwCAkN.exe
  C:\Windows\System\eWwCAkN.exe
  2⤵
  PID:9116
- C:\Windows\System\lvQKElK.exe
  C:\Windows\System\lvQKElK.exe
  2⤵
  PID:9132
- C:\Windows\System\FGYjOSK.exe
  C:\Windows\System\FGYjOSK.exe
  2⤵
  PID:9148
- C:\Windows\System\ZgjFsGd.exe
  C:\Windows\System\ZgjFsGd.exe
  2⤵
  PID:9164
- C:\Windows\System\MYcNyif.exe
  C:\Windows\System\MYcNyif.exe
  2⤵
  PID:9180
- C:\Windows\System\yLITyph.exe
  C:\Windows\System\yLITyph.exe
  2⤵
  PID:9196
- C:\Windows\System\sLEKTRE.exe
  C:\Windows\System\sLEKTRE.exe
  2⤵
  PID:9212
- C:\Windows\System\joRXOkx.exe
  C:\Windows\System\joRXOkx.exe
  2⤵
  PID:6852
- C:\Windows\System\VfBfAdW.exe
  C:\Windows\System\VfBfAdW.exe
  2⤵
  PID:8260
- C:\Windows\System\ZXQxzcI.exe
  C:\Windows\System\ZXQxzcI.exe
  2⤵
  PID:5896
- C:\Windows\System\rexmLUz.exe
  C:\Windows\System\rexmLUz.exe
  2⤵
  PID:8076
- C:\Windows\System\vUadSPl.exe
  C:\Windows\System\vUadSPl.exe
  2⤵
  PID:8248
- C:\Windows\System\PhZviFs.exe
  C:\Windows\System\PhZviFs.exe
  2⤵
  PID:8280
- C:\Windows\System\PgZZMsk.exe
  C:\Windows\System\PgZZMsk.exe
  2⤵
  PID:8356
- C:\Windows\System\qHWqFPU.exe
  C:\Windows\System\qHWqFPU.exe
  2⤵
  PID:8376
- C:\Windows\System\QBXyyQY.exe
  C:\Windows\System\QBXyyQY.exe
  2⤵
  PID:8392
- C:\Windows\System\GleZbzX.exe
  C:\Windows\System\GleZbzX.exe
  2⤵
  PID:8456
- C:\Windows\System\MuBNfFi.exe
  C:\Windows\System\MuBNfFi.exe
  2⤵
  PID:8516
- C:\Windows\System\KdlsUHH.exe
  C:\Windows\System\KdlsUHH.exe
  2⤵
  PID:8404
- C:\Windows\System\YJhecWY.exe
  C:\Windows\System\YJhecWY.exe
  2⤵
  PID:8548
- C:\Windows\System\MwQNuKX.exe
  C:\Windows\System\MwQNuKX.exe
  2⤵
  PID:8612
- C:\Windows\System\FdJSWJm.exe
  C:\Windows\System\FdJSWJm.exe
  2⤵
  PID:8676
- C:\Windows\System\PHrlqVm.exe
  C:\Windows\System\PHrlqVm.exe
  2⤵
  PID:8568
- C:\Windows\System\JhYVQDW.exe
  C:\Windows\System\JhYVQDW.exe
  2⤵
  PID:8628
- C:\Windows\System\OtGlVpx.exe
  C:\Windows\System\OtGlVpx.exe
  2⤵
  PID:8740
- C:\Windows\System\LerQYLW.exe
  C:\Windows\System\LerQYLW.exe
  2⤵
  PID:8532
- C:\Windows\System\CIVFswu.exe
  C:\Windows\System\CIVFswu.exe
  2⤵
  PID:8776
- C:\Windows\System\grjCYjt.exe
  C:\Windows\System\grjCYjt.exe
  2⤵
  PID:8728
- C:\Windows\System\inDIcYv.exe
  C:\Windows\System\inDIcYv.exe
  2⤵
  PID:8808
- C:\Windows\System\glOmNsG.exe
  C:\Windows\System\glOmNsG.exe
  2⤵
  PID:8840
- C:\Windows\System\QTOTiIj.exe
  C:\Windows\System\QTOTiIj.exe
  2⤵
  PID:8900
- C:\Windows\System\OHbOfbC.exe
  C:\Windows\System\OHbOfbC.exe
  2⤵
  PID:8932
- C:\Windows\System\TtWHybd.exe
  C:\Windows\System\TtWHybd.exe
  2⤵
  PID:8964
- C:\Windows\System\gGLeMNn.exe
  C:\Windows\System\gGLeMNn.exe
  2⤵
  PID:9000
- C:\Windows\System\DMduRTu.exe
  C:\Windows\System\DMduRTu.exe
  2⤵
  PID:8884
- C:\Windows\System\WSLPEZp.exe
  C:\Windows\System\WSLPEZp.exe
  2⤵
  PID:9012
- C:\Windows\System\tXBbbgr.exe
  C:\Windows\System\tXBbbgr.exe
  2⤵
  PID:9032
- C:\Windows\System\RubAvha.exe
  C:\Windows\System\RubAvha.exe
  2⤵
  PID:9064
- C:\Windows\System\CNcgSZf.exe
  C:\Windows\System\CNcgSZf.exe
  2⤵
  PID:9080
- C:\Windows\System\dOXyazQ.exe
  C:\Windows\System\dOXyazQ.exe
  2⤵
  PID:9128
- C:\Windows\System\fpmsGPV.exe
  C:\Windows\System\fpmsGPV.exe
  2⤵
  PID:9176
- C:\Windows\System\nQslHQM.exe
  C:\Windows\System\nQslHQM.exe
  2⤵
  PID:9192
- C:\Windows\System\QsoHWFP.exe
  C:\Windows\System\QsoHWFP.exe
  2⤵
  PID:8228
- C:\Windows\System\eUOlPnI.exe
  C:\Windows\System\eUOlPnI.exe
  2⤵
  PID:8216
- C:\Windows\System\WOcqWzg.exe
  C:\Windows\System\WOcqWzg.exe
  2⤵
  PID:8360
- C:\Windows\System\pbgjugM.exe
  C:\Windows\System\pbgjugM.exe
  2⤵
  PID:7308
- C:\Windows\System\LYICfrV.exe
  C:\Windows\System\LYICfrV.exe
  2⤵
  PID:8276
- C:\Windows\System\olKQBXu.exe
  C:\Windows\System\olKQBXu.exe
  2⤵
  PID:8504
- C:\Windows\System\tMvzFTk.exe
  C:\Windows\System\tMvzFTk.exe
  2⤵
  PID:8520
- C:\Windows\System\qrDBmEj.exe
  C:\Windows\System\qrDBmEj.exe
  2⤵
  PID:8440
- C:\Windows\System\mYemPaP.exe
  C:\Windows\System\mYemPaP.exe
  2⤵
  PID:8584
- C:\Windows\System\lKtiZoz.exe
  C:\Windows\System\lKtiZoz.exe
  2⤵
  PID:8468
- C:\Windows\System\JibApvk.exe
  C:\Windows\System\JibApvk.exe
  2⤵
  PID:8696
- C:\Windows\System\GzyuZto.exe
  C:\Windows\System\GzyuZto.exe
  2⤵
  PID:8996
- C:\Windows\System\qVNhsBa.exe
  C:\Windows\System\qVNhsBa.exe
  2⤵
  PID:9048
- C:\Windows\System\vCYNVNX.exe
  C:\Windows\System\vCYNVNX.exe
  2⤵
  PID:8836
- C:\Windows\System\zmeRjDa.exe
  C:\Windows\System\zmeRjDa.exe
  2⤵
  PID:7048
- C:\Windows\System\gorXApi.exe
  C:\Windows\System\gorXApi.exe
  2⤵
  PID:8452
- C:\Windows\System\qxHTeTN.exe
  C:\Windows\System\qxHTeTN.exe
  2⤵
  PID:1572
- C:\Windows\System\ebqywAK.exe
  C:\Windows\System\ebqywAK.exe
  2⤵
  PID:8952
- C:\Windows\System\EYLxUFr.exe
  C:\Windows\System\EYLxUFr.exe
  2⤵
  PID:9172
- C:\Windows\System\WnNYnRy.exe
  C:\Windows\System\WnNYnRy.exe
  2⤵
  PID:8372
- C:\Windows\System\oLfJfKm.exe
  C:\Windows\System\oLfJfKm.exe
  2⤵
  PID:8436
- C:\Windows\System\DRFRNEn.exe
  C:\Windows\System\DRFRNEn.exe
  2⤵
  PID:8708
- C:\Windows\System\ZXCVIsp.exe
  C:\Windows\System\ZXCVIsp.exe
  2⤵
  PID:8692
- C:\Windows\System\MWifTEE.exe
  C:\Windows\System\MWifTEE.exe
  2⤵
  PID:8632
- C:\Windows\System\tvhmKbN.exe
  C:\Windows\System\tvhmKbN.exe
  2⤵
  PID:9060
- C:\Windows\System\tFeZktF.exe
  C:\Windows\System\tFeZktF.exe
  2⤵
  PID:9232
- C:\Windows\System\EBDjsBD.exe
  C:\Windows\System\EBDjsBD.exe
  2⤵
  PID:9248
- C:\Windows\System\tUmIxyZ.exe
  C:\Windows\System\tUmIxyZ.exe
  2⤵
  PID:9264
- C:\Windows\System\qNqPjrP.exe
  C:\Windows\System\qNqPjrP.exe
  2⤵
  PID:9280
- C:\Windows\System\KqRKIEi.exe
  C:\Windows\System\KqRKIEi.exe
  2⤵
  PID:9296
- C:\Windows\System\InOUOQo.exe
  C:\Windows\System\InOUOQo.exe
  2⤵
  PID:9312
- C:\Windows\System\YUtPrZN.exe
  C:\Windows\System\YUtPrZN.exe
  2⤵
  PID:9328
- C:\Windows\System\czxlfLQ.exe
  C:\Windows\System\czxlfLQ.exe
  2⤵
  PID:9344
- C:\Windows\System\uImAiIO.exe
  C:\Windows\System\uImAiIO.exe
  2⤵
  PID:9360
- C:\Windows\System\QTNOXVI.exe
  C:\Windows\System\QTNOXVI.exe
  2⤵
  PID:9376
- C:\Windows\System\QWsBjec.exe
  C:\Windows\System\QWsBjec.exe
  2⤵
  PID:9392
- C:\Windows\System\EmTqTnZ.exe
  C:\Windows\System\EmTqTnZ.exe
  2⤵
  PID:9408
- C:\Windows\System\vYLulWw.exe
  C:\Windows\System\vYLulWw.exe
  2⤵
  PID:9424
- C:\Windows\System\UMEfKPl.exe
  C:\Windows\System\UMEfKPl.exe
  2⤵
  PID:9440
- C:\Windows\System\RhcNaDB.exe
  C:\Windows\System\RhcNaDB.exe
  2⤵
  PID:9456
- C:\Windows\System\YbBKJiX.exe
  C:\Windows\System\YbBKJiX.exe
  2⤵
  PID:9472
- C:\Windows\System\kyolfZb.exe
  C:\Windows\System\kyolfZb.exe
  2⤵
  PID:9488
- C:\Windows\System\eVmbeVM.exe
  C:\Windows\System\eVmbeVM.exe
  2⤵
  PID:9504
- C:\Windows\System\NmpYwvO.exe
  C:\Windows\System\NmpYwvO.exe
  2⤵
  PID:9520
- C:\Windows\System\hXLJOJt.exe
  C:\Windows\System\hXLJOJt.exe
  2⤵
  PID:9536
- C:\Windows\System\mLKDvYg.exe
  C:\Windows\System\mLKDvYg.exe
  2⤵
  PID:9552
- C:\Windows\System\CczdSJq.exe
  C:\Windows\System\CczdSJq.exe
  2⤵
  PID:9568
- C:\Windows\System\QvzGKRk.exe
  C:\Windows\System\QvzGKRk.exe
  2⤵
  PID:9584
- C:\Windows\System\yVqHUuf.exe
  C:\Windows\System\yVqHUuf.exe
  2⤵
  PID:9600
- C:\Windows\System\vxHIdvs.exe
  C:\Windows\System\vxHIdvs.exe
  2⤵
  PID:9616
- C:\Windows\System\uOXHzCN.exe
  C:\Windows\System\uOXHzCN.exe
  2⤵
  PID:9632
- C:\Windows\System\wJnoQZX.exe
  C:\Windows\System\wJnoQZX.exe
  2⤵
  PID:9648
- C:\Windows\System\nbUNOQe.exe
  C:\Windows\System\nbUNOQe.exe
  2⤵
  PID:9664
- C:\Windows\System\Zxsleov.exe
  C:\Windows\System\Zxsleov.exe
  2⤵
  PID:9680
- C:\Windows\System\uaNpIEe.exe
  C:\Windows\System\uaNpIEe.exe
  2⤵
  PID:9696
- C:\Windows\System\oOeLqGY.exe
  C:\Windows\System\oOeLqGY.exe
  2⤵
  PID:9712
- C:\Windows\System\dseSRNS.exe
  C:\Windows\System\dseSRNS.exe
  2⤵
  PID:9728
- C:\Windows\System\AFFwLCR.exe
  C:\Windows\System\AFFwLCR.exe
  2⤵
  PID:9744
- C:\Windows\System\smnWmir.exe
  C:\Windows\System\smnWmir.exe
  2⤵
  PID:9760
- C:\Windows\System\UKmwWzz.exe
  C:\Windows\System\UKmwWzz.exe
  2⤵
  PID:9776
- C:\Windows\System\HHyWIMA.exe
  C:\Windows\System\HHyWIMA.exe
  2⤵
  PID:9792
- C:\Windows\System\XXybcuO.exe
  C:\Windows\System\XXybcuO.exe
  2⤵
  PID:9808
- C:\Windows\System\dPdNste.exe
  C:\Windows\System\dPdNste.exe
  2⤵
  PID:9824
- C:\Windows\System\RHMMvZe.exe
  C:\Windows\System\RHMMvZe.exe
  2⤵
  PID:9840
- C:\Windows\System\fvpVMxT.exe
  C:\Windows\System\fvpVMxT.exe
  2⤵
  PID:9856
- C:\Windows\System\ifbTcNi.exe
  C:\Windows\System\ifbTcNi.exe
  2⤵
  PID:9872
- C:\Windows\System\UQxsBRu.exe
  C:\Windows\System\UQxsBRu.exe
  2⤵
  PID:9888
- C:\Windows\System\dWusrJk.exe
  C:\Windows\System\dWusrJk.exe
  2⤵
  PID:9904
- C:\Windows\System\XOsqgpF.exe
  C:\Windows\System\XOsqgpF.exe
  2⤵
  PID:9920
- C:\Windows\System\MgCgeag.exe
  C:\Windows\System\MgCgeag.exe
  2⤵
  PID:9936
- C:\Windows\System\nkdXhDM.exe
  C:\Windows\System\nkdXhDM.exe
  2⤵
  PID:9952
- C:\Windows\System\YXAxsYc.exe
  C:\Windows\System\YXAxsYc.exe
  2⤵
  PID:9968
- C:\Windows\System\rlFZMFw.exe
  C:\Windows\System\rlFZMFw.exe
  2⤵
  PID:9984
- C:\Windows\System\DhjVuWh.exe
  C:\Windows\System\DhjVuWh.exe
  2⤵
  PID:10000
- C:\Windows\System\OyIngmq.exe
  C:\Windows\System\OyIngmq.exe
  2⤵
  PID:10016
- C:\Windows\System\SQuGEcp.exe
  C:\Windows\System\SQuGEcp.exe
  2⤵
  PID:10032
- C:\Windows\System\gUFEdFD.exe
  C:\Windows\System\gUFEdFD.exe
  2⤵
  PID:10052
- C:\Windows\System\jLOxQOS.exe
  C:\Windows\System\jLOxQOS.exe
  2⤵
  PID:10068
- C:\Windows\System\xglpfBi.exe
  C:\Windows\System\xglpfBi.exe
  2⤵
  PID:10088
- C:\Windows\System\gEzOByN.exe
  C:\Windows\System\gEzOByN.exe
  2⤵
  PID:10104
- C:\Windows\System\mDWQpQt.exe
  C:\Windows\System\mDWQpQt.exe
  2⤵
  PID:10184
- C:\Windows\System\JGbWTZD.exe
  C:\Windows\System\JGbWTZD.exe
  2⤵
  PID:10200
- C:\Windows\System\pXQXplr.exe
  C:\Windows\System\pXQXplr.exe
  2⤵
  PID:10216
- C:\Windows\System\gZVCRJu.exe
  C:\Windows\System\gZVCRJu.exe
  2⤵
  PID:10232
- C:\Windows\System\QpLILtV.exe
  C:\Windows\System\QpLILtV.exe
  2⤵
  PID:8664
- C:\Windows\System\cMcveXm.exe
  C:\Windows\System\cMcveXm.exe
  2⤵
  PID:9224
- C:\Windows\System\hbCWzKd.exe
  C:\Windows\System\hbCWzKd.exe
  2⤵
  PID:8328
- C:\Windows\System\RbOXHnY.exe
  C:\Windows\System\RbOXHnY.exe
  2⤵
  PID:9240
- C:\Windows\System\qOmfCNi.exe
  C:\Windows\System\qOmfCNi.exe
  2⤵
  PID:8648
- C:\Windows\System\hWiGytF.exe
  C:\Windows\System\hWiGytF.exe
  2⤵
  PID:9404
- C:\Windows\System\VXxUbMQ.exe
  C:\Windows\System\VXxUbMQ.exe
  2⤵
  PID:9592
- C:\Windows\System\kMiaaRp.exe
  C:\Windows\System\kMiaaRp.exe
  2⤵
  PID:9644
- C:\Windows\System\fjFbBvd.exe
  C:\Windows\System\fjFbBvd.exe
  2⤵
  PID:9708
- C:\Windows\System\TNnQCLE.exe
  C:\Windows\System\TNnQCLE.exe
  2⤵
  PID:9692
- C:\Windows\System\MSLZXex.exe
  C:\Windows\System\MSLZXex.exe
  2⤵
  PID:9772
- C:\Windows\System\paxALhg.exe
  C:\Windows\System\paxALhg.exe
  2⤵
  PID:9836
- C:\Windows\System\oGESLtj.exe
  C:\Windows\System\oGESLtj.exe
  2⤵
  PID:9928
- C:\Windows\System\BzQhYrO.exe
  C:\Windows\System\BzQhYrO.exe
  2⤵
  PID:9992
- C:\Windows\System\ySInMNV.exe
  C:\Windows\System\ySInMNV.exe
  2⤵
  PID:9944
- C:\Windows\System\mvsefeH.exe
  C:\Windows\System\mvsefeH.exe
  2⤵
  PID:9820
- C:\Windows\System\byFeEhF.exe
  C:\Windows\System\byFeEhF.exe
  2⤵
  PID:9756
- C:\Windows\System\rBtpbqq.exe
  C:\Windows\System\rBtpbqq.exe
  2⤵
  PID:10060
- C:\Windows\System\WDeOOUu.exe
  C:\Windows\System\WDeOOUu.exe
  2⤵
  PID:10136
- C:\Windows\System\EtrImaF.exe
  C:\Windows\System\EtrImaF.exe
  2⤵
  PID:9096
- C:\Windows\System\YWEnDQB.exe
  C:\Windows\System\YWEnDQB.exe
  2⤵
  PID:10208
- C:\Windows\System\wTtMLaV.exe
  C:\Windows\System\wTtMLaV.exe
  2⤵
  PID:8196
- C:\Windows\System\aMKvJdO.exe
  C:\Windows\System\aMKvJdO.exe
  2⤵
  PID:9272
- C:\Windows\System\mfWWJbJ.exe
  C:\Windows\System\mfWWJbJ.exe
  2⤵
  PID:9452
- C:\Windows\System\gxfuHOj.exe
  C:\Windows\System\gxfuHOj.exe
  2⤵
  PID:9304
- C:\Windows\System\uqvVScY.exe
  C:\Windows\System\uqvVScY.exe
  2⤵
  PID:9544
- C:\Windows\System\RkFBtDu.exe
  C:\Windows\System\RkFBtDu.exe
  2⤵
  PID:9372
- C:\Windows\System\IOGnnmA.exe
  C:\Windows\System\IOGnnmA.exe
  2⤵
  PID:9468

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AKgnyNk.exe

Filesize
1.8MB

MD5
499cc5a936f1a1ee91cc0cddd3307262

SHA1
0e5eefd964667ea721e0f1cc151822c49c16fbd2

SHA256
9d935ddac70702645f088cbe7a9b03aa3d42f0415b2a693351b7cebcc2873b49

SHA512
804faf555630356add700323e9ee2e4ae946fe18be452d640df5dfb25e7d4be91efe8576457bb1b41ab78e9e2ca2b91cd92347a7bc94b9a7433e8e9b8097f7e1

Download Submit
C:\Windows\system\ASEvzVX.exe

Filesize
1.8MB

MD5
3ea5702696543a85086bb202ed71f7b1

SHA1
55c5686794f463dfefc497d670a4ef542191f89c

SHA256
6f489a610499e327de0ec087d2f80c2a62110262a554e5dc9db7b2726c3299cd

SHA512
205febbca5f1f2158eca8829b140d32c6dcab14e3bc0e20f842016d140f9b2cd65132f1bb83247d361da4b2af54b8a412f48eff4542096ef44a99c361c4cde89

Download Submit
C:\Windows\system\CoGEvUK.exe

Filesize
1.8MB

MD5
de56676bfe49045486a215ca3997a97e

SHA1
c05a3f6ca312548440b2eb68e3725e2dba285c6a

SHA256
96fffe2045dc36552af2d8c4060fd73b0f8a792ed37e95fb148c9b35713d2533

SHA512
020abd5243d6f571e76b2381ab0cdf8e3d22b15e64d67b42de5677ae5a6e8c38cc3e5f721df16c7e21d74c6e4a2e51a1961e99a3632fe99d678fb07f966384ce

Download Submit
C:\Windows\system\GBDvfkr.exe

Filesize
1.8MB

MD5
51a28fd9791cd0fe48ac0e4de45c8542

SHA1
c2ceac11a9a7be53bbc140717b6c2ba21b087e53

SHA256
ca4541743e93c024fe5db5c0c3a58a0c448bb829a9b01ef36ebf2ba9e96c6251

SHA512
19569a92d7bc0472a73e903760e214934b70f2bd7fed72a3e0aca8e0ab447c89d01baa3b4b7d6ff0675a80cc58a3dfff76c93d64143bdd47918ce1078e92ea08

Download Submit
C:\Windows\system\GCGymZy.exe

Filesize
1.8MB

MD5
be57696f9f89dccd76b41a4e1861efd0

SHA1
52b09df3b608ad9355089de2ddf63de2a844ccd0

SHA256
b46a6999099a5c7c8e05eb6f794485138ec345a8932f705176a5540b436dc921

SHA512
6cc634466b8fe4670d72728f8f769e57cc6926ae27a99865887d0ba0d65aa67aa9f51f2d5beef74b9a7ef7a55502bc4abfb565084f11434556115aac6c3f1e10

Download Submit
C:\Windows\system\JtBeKez.exe

Filesize
1.8MB

MD5
fa1730926eba8a668c227d686dcf0fe4

SHA1
2f41950c20987e329ab6100bcc0df0796cb0b742

SHA256
0bb6c242fd6e3a324b2f9db0d1038786d31f3f3125f59b816825e89d82dcc7d6

SHA512
928e6c525f9f3e96f303ff174ca2e23e036feeea38ef7db12a2e7dd1723404d0bf68e6ce34bb302980fb6c04f2108f2a52e7e77b14e847b45ba7e8a44d41d12f

Download Submit
C:\Windows\system\KmFOoOc.exe

Filesize
1.8MB

MD5
6bf1d51373f4ba6687fd976ae83a95d7

SHA1
cf9b9c7eb652fca3809c35095895165e148c4958

SHA256
773e2daa52a5dbc76f3389fdc2fd79ea7f097e679162fefefb0c406f09057cc8

SHA512
d602da451333c7845f925fa2f86211ec9d8580e638f1f797539612883acdec9ad04b1c9a45611efe6f8ad9f102801d966df80555681e9bf7e67c183eff0ed3e0

Download Submit
C:\Windows\system\LDchFtr.exe

Filesize
1.8MB

MD5
6ed7e929db0d471e179d112503295674

SHA1
c01f62ead07978592f1bf9c60e38e9088c8e09e9

SHA256
9db97c45c500350e2b16f5c75297886600d2327843979175e3be8434b73ad9af

SHA512
bedbf7733d5f96baad0bde2e1877c2d1df9be7dc5c702c5dc9f62849040fc8259836ee6f82da15130b3ac69d180d26476458f3dcedd969a5916b51ad9e894817

Download Submit
C:\Windows\system\LkrikEW.exe

Filesize
1.8MB

MD5
1ef340cc9629530d3e635815cd6ef6ce

SHA1
c7331d40c32654e1e8255bab9e854160851e4b45

SHA256
052ba356026913ff98f57a2d065fc16f4902ad941e711ae67791c2c04653cd04

SHA512
843b656d19f46e27d39aec563b84394e6f28d8f72daaee2b386647562b7a8cb1e52f0a036e8cdc395532a12cf4961e9e5f55dc10e4efb545774f7631ec0c2b8d

Download Submit
C:\Windows\system\NSPFiXr.exe

Filesize
1.8MB

MD5
941fbbe30c3103c149520c26f94f5b12

SHA1
d9d3723b2dcc44a4bdc99892ebe6471726251ba1

SHA256
acbaa1949cc1b792448a32d6354e0586041c7122c63d488740aa6281c7f8c8da

SHA512
4a50027b22e3389b5d2c7b8ba8ff5b35a4f68af473227aec4f3777aae13c2aed76f47110eaab6c67d50a2f522325caf59e195f2b830e164c5a3d25e46574bb97

Download Submit
C:\Windows\system\PrvADZI.exe

Filesize
1.8MB

MD5
5f468654b70a6e11184057f90521cef2

SHA1
f2859f555be9203f150d33e4720fad6435386990

SHA256
c7a65aedb36e01b59a114ff92513bf29d0da04d6c0dbab5347b30164271da248

SHA512
08a499aeeee201b336144174d571c0f598f6e0ba33c7b15f060e0a63e2420576268b4f35223c0e5f1c9d2acec23a30654efd5374bc63a3b080d2165ed0395e88

Download Submit
C:\Windows\system\SVMLzuz.exe

Filesize
1.8MB

MD5
810154ade6843805ca94a102958bfd6f

SHA1
4dec16c8c405ca7945bca200e593c6586dc322a3

SHA256
525cb1d31233b36b6dfca687b20f4922a3565f2db3bd5c36e7b212e789ddb4bc

SHA512
bbd9df8d38e58170465fed499abb6a196cae48419ae9297c0c39634583fe4c134c75d983bb187d37a38ecad30d137aa29a93209ea5f8061fcd8ddb6bbb14cad7

Download Submit
C:\Windows\system\TAdlBbY.exe

Filesize
1.8MB

MD5
35dd0bc0889f47aad1aaf7a3ff83c327

SHA1
b02ac90cced0f6f723a103eb746841af3f4a5cba

SHA256
63f15cfe6dc3becd91ee76655bb1bc1af9d404263650dc284054e119a158c232

SHA512
c86b33f347e3234cab8f5848025a63d64f77cef7fcda0bdd01379e69a8303d6ece32999a36fa7937360c916c29b57062aa6f6687c7dd443bbe6e98a041e95144

Download Submit
C:\Windows\system\TzZrOGy.exe

Filesize
1.8MB

MD5
87e97c6d82fc67387ada411ab0938716

SHA1
b1431a397ae23220f1dfdf260d41cbb25b705b69

SHA256
7c412b099f45499e7cb12631b0e1c49236c03b651661d178b554831936f24ed1

SHA512
61c25d3c6154bd3ffe577257b36f1f7a405bc491e500b8c364966cd36bf9d9fb264797f16d148d86a2d7cafc763717233fb9908b00ceae7ee5f3901e55785559

Download Submit
C:\Windows\system\ZyFFrWz.exe

Filesize
1.8MB

MD5
7ec862497f7bd79a8e2934ead4e9f93a

SHA1
4d5416203ef330122f4ea3f010a08e4403b39328

SHA256
4aeab6bbb18c4886c179b6588e13a162fb84c68f925a94ac695c868c25c4806c

SHA512
25c42ca4f29bd563929d8f30315f7295dd15ec967c447097f685a285597f43f33688ad19855dc5f4c2eaa525dd5a98fb29d5f06073f4462f8375c7f1b9751958

Download Submit
C:\Windows\system\flUnloL.exe

Filesize
1.8MB

MD5
26e9a94e1f59c371368e84b8ac28f3e5

SHA1
c5317846bd4f95ad9ae7874bf1d8b766a9330181

SHA256
6b4bfca5d091bf0ce7ec706a50dbf942ab20386cf2d4c8dcc337108216937920

SHA512
6659670130689c14eadbbf50eff5224e5bec25e4d0f3d761b4dc5e8b1e77ed5fb8d5c68221299c0e11dc1f08d9b270aec89d49afa1c2d150fbde92f9bfd081d1

Download Submit
C:\Windows\system\hoEnJRl.exe

Filesize
1.8MB

MD5
b6209356465bf4cd922d2b0cd9b4d8b0

SHA1
d68ff2f39effaf97f1d15f5a83a1bcdebdd25c8e

SHA256
32b1428ef152731ba7a6f1e1c78b53e307a6047ada277b69e120e9dff4d8a130

SHA512
ebfd328f0900d0ad0b1ca469c15ef37fb56eb3039989793505e4b36cf33e69b51c0510c021cd9282b51c6cc703680b0fd0db46aa2a950cd53db9368f318a8b65

Download Submit
C:\Windows\system\iTugGXo.exe

Filesize
1.8MB

MD5
70fb762f06bb71f538ace54a2e796ad7

SHA1
b63efbd403f2868d2ba5ee4578bbc94b49c1fd00

SHA256
7603be3dc577f7670ecc95711119d24824ae43ea6b47bd149e8a339999ba11b8

SHA512
90b526e6b0603b17ecbddd6dd2bba416bd3081a7776adb4f978a6c74daf207824b55b9ea9ab3cd0d889e3093d01c54514f6f604a1fcf145f1860b69535e1e778

Download Submit
C:\Windows\system\oXucioe.exe

Filesize
1.8MB

MD5
be0983331efa0876e7084cd6fdbc71e7

SHA1
be9b549d6c11e1ae55a5f2b01f408cd8bb999a7a

SHA256
5f411ed8f74fa050670979cf96976f48b2c513313c38b2a020e640b396ee45da

SHA512
240efbcd0a81d88ced70ec02198cf2bf8c283111bac3a6c195515b379ea83539cdbe08acaba0dda5b2753423129f505854ae8ca277190a6f14c8449e57c768f4

Download Submit
C:\Windows\system\pHRbtGr.exe

Filesize
1.8MB

MD5
6055f6db652253daa79f7e889423337b

SHA1
f979374410b0e5ce4f5ecee491467dadd47e4e81

SHA256
f42ea4611a997922eafa574b8e525f37c29b35c2dd9948cb1620514a523cf70a

SHA512
5cfc956a891e4eb2bfb681e801ffba3bc7a871241452d965fee5eefa24ef9b32a875a26817ef9a5f676337d7fa5dc298e07da4f8551e34e682e67bfa108ef300

Download Submit
C:\Windows\system\pvmMqPo.exe

Filesize
1.8MB

MD5
1d213972f92f9761c260e350c668f7e9

SHA1
c55d917fa4e861b6f62c07a03a9a3a5592d0ad08

SHA256
5624697d293bba0483c8f7e86b1f313e72cf7564e201d8a54aa94255ec0e06db

SHA512
6c63e724da660a7b6857f1ecfdca318ea8bd03133be036abb96d828c84a37172d66611a77be184998ba83d306a59d97487a9550e38d29bf178a1340956f1b5c0

Download Submit
C:\Windows\system\qXkwUPq.exe

Filesize
1.8MB

MD5
44589d6aa8e9c7b347aebfaf836b698f

SHA1
88616b1b3ab8fa7167e3ad120403958a412774e8

SHA256
7205c61b24175b43e13236dcf56e5840bd1e3b96f491c7111be7063f87ed2b19

SHA512
ca30b8b6b1c84dd901033f2eb78a93a94ca5f0a6a054fa53458a018b4668a7b0f60a979c238a6389069ce8e745eca6c54853685c60116e8aa444e3ac07f01adf

Download Submit
C:\Windows\system\qvYwASk.exe

Filesize
1.8MB

MD5
24f17cc984cebab1e9aba022bb298c1e

SHA1
03325aab26cab5209122c67351e255423f0ce9e8

SHA256
34746ede68eba9806fa64a26ac4be6ac5bcd79ca8ffc8dc88d961e7c6e8b6539

SHA512
ce67307c0085b14ef0018ac50606b926a5a4e38c33c41a728ee3a39cfa80998c06261afd0a63e0027ba0ee5238fba2c7d7cd7f18fca75f6327f403fa7beaf26e

Download Submit
C:\Windows\system\riPbYLW.exe

Filesize
1.8MB

MD5
01955c21b63408dbc4a084d821ca668f

SHA1
96aead81cf1fe5ec19d68575f5cea5042a631fa8

SHA256
67cf3f1301c637445c830311358410b515d4ae1f5dc566028311f8388bfb3a12

SHA512
78a8c5232e35854bb0179fc2e2f830a83721b69cd32ec2b125a0c9015b7815cb618f47af3e1538f8f12c8509f5bbb2d6366f0c45de86e97483b1d1cce5c2255f

Download Submit
C:\Windows\system\uBwzqFz.exe

Filesize
1.8MB

MD5
37771a74168b24b0cfee478d2e10f907

SHA1
a91636bd67e64d7ceef95c1ef2c8a1bf9d93cf67

SHA256
8614274fe4931f26fc2816f3b2edf69013f07490ae7cc72b19ec57e55918844d

SHA512
70e9f6851f77dfcb9cbe2ddf0c62a30ab320309ac4b051cd1fa37331f06037bae330c2f090ad7c88c49f0b685dc54bf7bb7c522fdc61c258bc06fad2c11177c2

Download Submit
C:\Windows\system\xUMKAjZ.exe

Filesize
1.8MB

MD5
92f6f5b5d046afa869a0c84ab5fe7244

SHA1
c09d567a1702c010597e163f3a0373472b68f49e

SHA256
a961b036b39cbdffa084b976819c6ac207023f863bf5697a789e08eab6b34e28

SHA512
9a1ea6a3bd8700804e34d95d21ab280caa4ae49a921f0659179bef5720cb77e09cfcaf6ad774cb6fbba5992046aa469b8d68db856023f06c3aa13189bbb8900e

Download Submit
C:\Windows\system\xtVcUdA.exe

Filesize
1.8MB

MD5
085e8c2f9755a33c12f3be993f69e025

SHA1
087910e9e00471b763c39f285f0db670d78d927e

SHA256
72fbe9a09fc7d3b236f8e23b3c22106e65e4268bfceca33afb83677b581454b8

SHA512
d147862e6226d1476397ba2de8a51c2d94f1b3e08abdb24265901a355d7ba160fda942e474c0309b7dc296d8e3180fb8207b0528a61addc7f56a3efc9f4928d8

Download Submit
C:\Windows\system\yLqgksq.exe

Filesize
1.8MB

MD5
9615d6c6ad10e918e1012604857beb2f

SHA1
1311f9e98da6cf2fb55ecd09d86aeddf76b78354

SHA256
7b92c5a89b8e21690322e2ff333aba8754f0d4bc16561bc153bf01ab3de52922

SHA512
782be96cfb75f89272a50bffdb6412389487de26a12531d7eb37d983fa9542bae62cbd7eee04792c39c71cac3434e7301b1daa061217f7179519764a9ddc9034

Download Submit
C:\Windows\system\zmnQkBr.exe

Filesize
1.8MB

MD5
ae99f571739bbbd58c9e7363825b9563

SHA1
735a31b6664ec1a76318c05487528793a6063a86

SHA256
08299cfc6d17b48a00c6f8a3e09a3e15701bab857f27878a6ab6df15ff418e98

SHA512
d4e5cf406909cd3f83143c83d0372495f96000dfa719ae017e7f876bf879e1e60eb6a4274796e7d2cd7d773772dec8b405cccf30f256e1cf085b4e78611153e5

Download Submit
C:\Windows\system\ztvqafO.exe

Filesize
1.8MB

MD5
677f6994bf8681fdc64ccfd7ac29dde5

SHA1
4e491f933a883ef6b92b44c2d9e1dde33c1013b5

SHA256
fa547b309c9f2c3963bfd1dc94dc82a43a62cbe28e69d3278979f353ee9ef2f4

SHA512
225b7b69c07453ab191e3602c8653028c41a13138c5f4c51d55e8623bbf891c72aa44d86d98f291c6db2664991a905dd02d8a8d4b764ea7844753fa2554b2603

Download Submit
\Windows\system\IijZhRT.exe

Filesize
1.8MB

MD5
06984aa926852e521da3c0e74d54f90c

SHA1
ea9478523598b3b742cb235ad092beea8123d3db

SHA256
170d2f847c0d91de015849ccd3853bca75627b695635e578bd08ecfb887c02b8

SHA512
a16d5dc3a0237385f0b1b127005c4692799e484bb4a8b448f49872ac0cab8f0ffa5291e3ecc04d703a0153ba53c980191bedc790d8176ae483afa761e25de975

Download Submit
\Windows\system\ilVJNWL.exe

Filesize
1.8MB

MD5
2cea7fe5f60bc160abb3feee10144bb3

SHA1
916d17bc2654a2cfd8b6ce9b9b4a929f69447d81

SHA256
8efda60c9ef84b4c5e2b45612db0ebf7cff5ac0a84c11bc2275f500064a10414

SHA512
fab430324dd663f5313359052900e25896c9d3cc78b3602bafd3ad84dd32a662ac361a4e8bb440e2ecc8ddff4ba0ad1cc859cce75ed5cad544656bdfc7b79584

Download Submit
memory/1040-33-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-808-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-47-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-814-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-7-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download
memory/1040-811-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-54-0x00000000034C0000-0x00000000038B2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-813-0x000000013F250000-0x000000013F642000-memory.dmp

Filesize
3.9MB

Download
memory/1040-1-0x0000000000080000-0x0000000000090000-memory.dmp

Filesize
64KB

Download
memory/1040-18-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-24-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-2112-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1040-0-0x000000013F900000-0x000000013FCF2000-memory.dmp

Filesize
3.9MB

Download
memory/1248-812-0x000000013FFE0000-0x00000001403D2000-memory.dmp

Filesize
3.9MB

Download
memory/1252-810-0x000000013FC00000-0x000000013FFF2000-memory.dmp

Filesize
3.9MB

Download
memory/2176-36-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-2418-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-28-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/2176-32-0x000007FEF5A60000-0x000007FEF63FD000-memory.dmp

Filesize
9.6MB

Download
memory/2176-37-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/2176-38-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/2176-41-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/2176-40-0x0000000002DC0000-0x0000000002E40000-memory.dmp

Filesize
512KB

Download
memory/2244-809-0x000000013F6B0000-0x000000013FAA2000-memory.dmp

Filesize
3.9MB

Download
memory/2372-48-0x000000013F950000-0x000000013FD42000-memory.dmp

Filesize
3.9MB

Download
memory/2384-39-0x000000013FC20000-0x0000000140012000-memory.dmp

Filesize
3.9MB

Download
memory/2564-19-0x000000013FDF0000-0x00000001401E2000-memory.dmp

Filesize
3.9MB

Download
memory/2588-27-0x000000013F100000-0x000000013F4F2000-memory.dmp

Filesize
3.9MB

Download
memory/2816-55-0x000000013F620000-0x000000013FA12000-memory.dmp

Filesize
3.9MB

Download
memory/2888-8-0x000000013F270000-0x000000013F662000-memory.dmp

Filesize
3.9MB

Download