xmrig | ce0abcc67984e483e5855fa8ea970150d34852df522d377d4dde1c2d328e2495

Analysis

max time kernel
27s
max time network
27s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
Size

1.6MB
MD5

02adffe5741ed1daa163c2d389378050
SHA1

5138f7ba3321342370c40672963e1e6e71d3e768
SHA256

ce0abcc67984e483e5855fa8ea970150d34852df522d377d4dde1c2d328e2495
SHA512

1c38fab248cbd9cff8ee878cbaf81dabb60f77e234c48d97eed246409431745b2986e42d0476cd70c5268863360bece54b6b43485a9218c6a8ec1897452fbc0d
SSDEEP

49152:Lz071uv4BPMkibTIA5sf6r+WVc2HhG82S7t:NABK

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2160-18-0x000000013F730000-0x000000013FB22000-memory.dmp	xmrig
behavioral1/memory/2604-47-0x000000013F5A0000-0x000000013F992000-memory.dmp	xmrig
behavioral1/memory/2288-39-0x000000013F480000-0x000000013F872000-memory.dmp	xmrig
behavioral1/memory/2876-37-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	xmrig
behavioral1/memory/2668-35-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	xmrig
behavioral1/memory/2504-59-0x000000013F060000-0x000000013F452000-memory.dmp	xmrig
behavioral1/memory/2960-74-0x000000013F160000-0x000000013F552000-memory.dmp	xmrig
behavioral1/memory/2740-317-0x000000013F640000-0x000000013FA32000-memory.dmp	xmrig
behavioral1/memory/2968-73-0x000000013FEC0000-0x00000001402B2000-memory.dmp	xmrig

Executes dropped EXE 64 IoCs

pid	Process
2288	hJLXjes.exe
2160	iUUXOIh.exe
2668	eqLVdlH.exe
2876	ixiuIUi.exe
2604	GuyHnkj.exe
2444	LoWuNay.exe
2504	eEWCrPM.exe
2968	jwPLghV.exe
2960	DSVwJEv.exe
2700	QyQEolb.exe
1528	YRPyfWZ.exe
2864	XdPUafZ.exe
1864	EmYkFVw.exe
312	cyDggLN.exe
1196	oVMsMSb.exe
1532	gOIvVvk.exe
2948	INUQmiQ.exe
2500	yXyhJgc.exe
1356	YPHqULy.exe
1420	MqBDQUc.exe
1984	rxTeRtL.exe
2984	KbrEknE.exe
2000	CssNDHB.exe
1912	wuuYGoy.exe
2904	gkFLdlh.exe
2024	PdWGmae.exe
564	JgsCgyH.exe
1496	CxfBtaE.exe
2292	INklRKD.exe
2848	rIlgCcW.exe
1792	AOLGzQa.exe
2016	NAfrwQK.exe
2132	GmCIdFE.exe
2088	kdweUDo.exe
1320	puNtHwB.exe
1748	MBgLQKd.exe
1544	MHssTcL.exe
1068	eAdFrxg.exe
1060	tAVUmOT.exe
2912	QDUEwGj.exe
1692	gieXCDm.exe
916	yZeQEJC.exe
1028	otlnUZe.exe
2140	akIQLus.exe
2920	GgJLawN.exe
2944	AAmHVag.exe
2072	GFSeilJ.exe
1732	zAmrUCR.exe
1696	zowdsho.exe
892	acviLBN.exe
1064	dJvRAaT.exe
2996	hEDcevR.exe
1600	WPezVUQ.exe
1720	nQGJnaj.exe
3048	ENuYkFw.exe
2584	TCCbSIn.exe
2588	DYGBrLZ.exe
3044	pFjMNJx.exe
1312	xdeeUHI.exe
2456	OCukyQm.exe
2660	PTZajLW.exe
2772	BjsTmVK.exe
2064	EkbjirZ.exe
2784	NPjsrmn.exe

Loads dropped DLL 64 IoCs

pid	Process
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x000b00000001565d-3.dat	upx
behavioral1/files/0x0034000000015cb6-8.dat	upx
behavioral1/files/0x0007000000015cff-19.dat	upx
behavioral1/memory/2160-18-0x000000013F730000-0x000000013FB22000-memory.dmp	upx
behavioral1/files/0x000e0000000054ab-23.dat	upx
behavioral1/files/0x0008000000015d42-41.dat	upx
behavioral1/memory/2604-47-0x000000013F5A0000-0x000000013F992000-memory.dmp	upx
behavioral1/memory/2288-39-0x000000013F480000-0x000000013F872000-memory.dmp	upx
behavioral1/memory/2876-37-0x000000013F6C0000-0x000000013FAB2000-memory.dmp	upx
behavioral1/memory/2668-35-0x000000013F0D0000-0x000000013F4C2000-memory.dmp	upx
behavioral1/files/0x0009000000015d56-56.dat	upx
behavioral1/memory/2444-52-0x000000013FEB0000-0x00000001402A2000-memory.dmp	upx
behavioral1/files/0x0007000000015d4e-50.dat	upx
behavioral1/memory/2504-59-0x000000013F060000-0x000000013F452000-memory.dmp	upx
behavioral1/files/0x0006000000016616-66.dat	upx
behavioral1/files/0x000800000001658a-60.dat	upx
behavioral1/memory/2960-74-0x000000013F160000-0x000000013F552000-memory.dmp	upx
behavioral1/files/0x0006000000016c44-93.dat	upx
behavioral1/files/0x0006000000016cdc-113.dat	upx
behavioral1/files/0x0006000000016d07-118.dat	upx
behavioral1/files/0x0006000000016d20-128.dat	upx
behavioral1/files/0x0006000000016d3e-143.dat	upx
behavioral1/files/0x0006000000016d5f-152.dat	upx
behavioral1/files/0x0006000000016d8e-163.dat	upx
behavioral1/files/0x0006000000016da5-172.dat	upx
behavioral1/files/0x0006000000016db9-182.dat	upx
behavioral1/memory/2740-317-0x000000013F640000-0x000000013FA32000-memory.dmp	upx
behavioral1/files/0x0006000000016dbe-189.dat	upx
behavioral1/files/0x0006000000016db1-179.dat	upx
behavioral1/files/0x0006000000016d9d-168.dat	upx
behavioral1/files/0x0006000000016d74-158.dat	upx
behavioral1/files/0x0006000000016d43-149.dat	upx
behavioral1/files/0x0006000000016d3a-138.dat	upx
behavioral1/files/0x0006000000016d34-133.dat	upx
behavioral1/files/0x0006000000016d18-123.dat	upx
behavioral1/files/0x0006000000016cb0-108.dat	upx
behavioral1/files/0x0006000000016c64-103.dat	upx
behavioral1/files/0x0006000000016c5e-98.dat	upx
behavioral1/files/0x0006000000016adc-88.dat	upx
behavioral1/files/0x0034000000015ccd-83.dat	upx
behavioral1/files/0x0006000000016851-78.dat	upx
behavioral1/memory/2968-73-0x000000013FEC0000-0x00000001402B2000-memory.dmp	upx

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System\byFYtTB.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\QSSSTbB.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\DQVCApE.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\LNNwCMH.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\uwIgwYM.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\YOsSDkY.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\njSoJPd.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\RhJdBaW.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\ifuCncd.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\BgtUJFt.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\CLzleca.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\zaoBPXi.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\NLcSfrH.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\rESpwjk.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\BnRlJfn.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\SRYMHPp.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\HXeeppg.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\MwwCXar.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\HSCxEvI.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\nqCqTDX.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\gIAbLyK.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\OtKubeo.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\zJppzel.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\IKGrCAb.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\STvjxKz.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\vRXHLsW.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\mwCiOBe.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\SlCojXF.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\PHqGVQz.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\hLyuNND.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\pVHRdQI.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\MUWxuOy.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\KdxzvoM.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\pJFdelK.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\PdWGmae.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\zowdsho.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\VNDajqc.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\TuUGMBG.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\UtYqbWz.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\mQdNLxh.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\mvgvbMX.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\sKhmdim.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\uRipKDG.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\vshBPkb.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\OuVELCC.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\rCFfNHc.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\eAdFrxg.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\KtRKBxJ.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\OepSPsP.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\mFCerHy.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\IGPyfZx.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\dVihQXv.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\JOgTVht.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\JmpxBgt.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\DwGEXQP.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\XCRKeGp.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\aWGtwaj.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\cJbTGYL.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\jFBlbca.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\AhRifND.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\YbPntrW.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\aUDHFms.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\txiLFAN.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
File created	C:\Windows\System\AcNzyNH.exe	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	29
PID 2740 wrote to memory of 2196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	29
PID 2740 wrote to memory of 2196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	29
PID 2740 wrote to memory of 2288	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2288	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2288	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	30
PID 2740 wrote to memory of 2160	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2160	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2160	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	31
PID 2740 wrote to memory of 2668	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2668	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2668	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	32
PID 2740 wrote to memory of 2876	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2876	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2876	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	33
PID 2740 wrote to memory of 2604	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2604	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2604	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	34
PID 2740 wrote to memory of 2444	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2444	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2444	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	35
PID 2740 wrote to memory of 2504	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2504	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2504	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	36
PID 2740 wrote to memory of 2960	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	37
PID 2740 wrote to memory of 2960	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	37
PID 2740 wrote to memory of 2960	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	37
PID 2740 wrote to memory of 2968	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	38
PID 2740 wrote to memory of 2968	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	38
PID 2740 wrote to memory of 2968	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	38
PID 2740 wrote to memory of 2700	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	39
PID 2740 wrote to memory of 2700	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	39
PID 2740 wrote to memory of 2700	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	39
PID 2740 wrote to memory of 1528	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	40
PID 2740 wrote to memory of 1528	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	40
PID 2740 wrote to memory of 1528	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	40
PID 2740 wrote to memory of 2864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	41
PID 2740 wrote to memory of 2864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	41
PID 2740 wrote to memory of 2864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	41
PID 2740 wrote to memory of 1864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	42
PID 2740 wrote to memory of 1864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	42
PID 2740 wrote to memory of 1864	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	42
PID 2740 wrote to memory of 312	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	43
PID 2740 wrote to memory of 312	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	43
PID 2740 wrote to memory of 312	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	43
PID 2740 wrote to memory of 1196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	44
PID 2740 wrote to memory of 1196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	44
PID 2740 wrote to memory of 1196	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	44
PID 2740 wrote to memory of 1532	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	45
PID 2740 wrote to memory of 1532	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	45
PID 2740 wrote to memory of 1532	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	45
PID 2740 wrote to memory of 2948	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2948	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2948	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	46
PID 2740 wrote to memory of 2500	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	47
PID 2740 wrote to memory of 2500	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	47
PID 2740 wrote to memory of 2500	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	47
PID 2740 wrote to memory of 1356	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	48
PID 2740 wrote to memory of 1356	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	48
PID 2740 wrote to memory of 1356	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	48
PID 2740 wrote to memory of 1420	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	49
PID 2740 wrote to memory of 1420	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	49
PID 2740 wrote to memory of 1420	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	49
PID 2740 wrote to memory of 1984	2740	02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe	50

C:\Users\Admin\AppData\Local\Temp\02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\02adffe5741ed1daa163c2d389378050_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -command "Invoke-WebRequest "https://raw.githubusercontent.com/" "
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2196
- C:\Windows\System\hJLXjes.exe
  C:\Windows\System\hJLXjes.exe
  2⤵
  - Executes dropped EXE
  PID:2288
- C:\Windows\System\iUUXOIh.exe
  C:\Windows\System\iUUXOIh.exe
  2⤵
  - Executes dropped EXE
  PID:2160
- C:\Windows\System\eqLVdlH.exe
  C:\Windows\System\eqLVdlH.exe
  2⤵
  - Executes dropped EXE
  PID:2668
- C:\Windows\System\ixiuIUi.exe
  C:\Windows\System\ixiuIUi.exe
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Windows\System\GuyHnkj.exe
  C:\Windows\System\GuyHnkj.exe
  2⤵
  - Executes dropped EXE
  PID:2604
- C:\Windows\System\LoWuNay.exe
  C:\Windows\System\LoWuNay.exe
  2⤵
  - Executes dropped EXE
  PID:2444
- C:\Windows\System\eEWCrPM.exe
  C:\Windows\System\eEWCrPM.exe
  2⤵
  - Executes dropped EXE
  PID:2504
- C:\Windows\System\DSVwJEv.exe
  C:\Windows\System\DSVwJEv.exe
  2⤵
  - Executes dropped EXE
  PID:2960
- C:\Windows\System\jwPLghV.exe
  C:\Windows\System\jwPLghV.exe
  2⤵
  - Executes dropped EXE
  PID:2968
- C:\Windows\System\QyQEolb.exe
  C:\Windows\System\QyQEolb.exe
  2⤵
  - Executes dropped EXE
  PID:2700
- C:\Windows\System\YRPyfWZ.exe
  C:\Windows\System\YRPyfWZ.exe
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Windows\System\XdPUafZ.exe
  C:\Windows\System\XdPUafZ.exe
  2⤵
  - Executes dropped EXE
  PID:2864
- C:\Windows\System\EmYkFVw.exe
  C:\Windows\System\EmYkFVw.exe
  2⤵
  - Executes dropped EXE
  PID:1864
- C:\Windows\System\cyDggLN.exe
  C:\Windows\System\cyDggLN.exe
  2⤵
  - Executes dropped EXE
  PID:312
- C:\Windows\System\oVMsMSb.exe
  C:\Windows\System\oVMsMSb.exe
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Windows\System\gOIvVvk.exe
  C:\Windows\System\gOIvVvk.exe
  2⤵
  - Executes dropped EXE
  PID:1532
- C:\Windows\System\INUQmiQ.exe
  C:\Windows\System\INUQmiQ.exe
  2⤵
  - Executes dropped EXE
  PID:2948
- C:\Windows\System\yXyhJgc.exe
  C:\Windows\System\yXyhJgc.exe
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\System\YPHqULy.exe
  C:\Windows\System\YPHqULy.exe
  2⤵
  - Executes dropped EXE
  PID:1356
- C:\Windows\System\MqBDQUc.exe
  C:\Windows\System\MqBDQUc.exe
  2⤵
  - Executes dropped EXE
  PID:1420
- C:\Windows\System\rxTeRtL.exe
  C:\Windows\System\rxTeRtL.exe
  2⤵
  - Executes dropped EXE
  PID:1984
- C:\Windows\System\KbrEknE.exe
  C:\Windows\System\KbrEknE.exe
  2⤵
  - Executes dropped EXE
  PID:2984
- C:\Windows\System\CssNDHB.exe
  C:\Windows\System\CssNDHB.exe
  2⤵
  - Executes dropped EXE
  PID:2000
- C:\Windows\System\wuuYGoy.exe
  C:\Windows\System\wuuYGoy.exe
  2⤵
  - Executes dropped EXE
  PID:1912
- C:\Windows\System\gkFLdlh.exe
  C:\Windows\System\gkFLdlh.exe
  2⤵
  - Executes dropped EXE
  PID:2904
- C:\Windows\System\PdWGmae.exe
  C:\Windows\System\PdWGmae.exe
  2⤵
  - Executes dropped EXE
  PID:2024
- C:\Windows\System\JgsCgyH.exe
  C:\Windows\System\JgsCgyH.exe
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Windows\System\CxfBtaE.exe
  C:\Windows\System\CxfBtaE.exe
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Windows\System\INklRKD.exe
  C:\Windows\System\INklRKD.exe
  2⤵
  - Executes dropped EXE
  PID:2292
- C:\Windows\System\rIlgCcW.exe
  C:\Windows\System\rIlgCcW.exe
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Windows\System\AOLGzQa.exe
  C:\Windows\System\AOLGzQa.exe
  2⤵
  - Executes dropped EXE
  PID:1792
- C:\Windows\System\NAfrwQK.exe
  C:\Windows\System\NAfrwQK.exe
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Windows\System\GmCIdFE.exe
  C:\Windows\System\GmCIdFE.exe
  2⤵
  - Executes dropped EXE
  PID:2132
- C:\Windows\System\kdweUDo.exe
  C:\Windows\System\kdweUDo.exe
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Windows\System\puNtHwB.exe
  C:\Windows\System\puNtHwB.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Windows\System\MBgLQKd.exe
  C:\Windows\System\MBgLQKd.exe
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Windows\System\MHssTcL.exe
  C:\Windows\System\MHssTcL.exe
  2⤵
  - Executes dropped EXE
  PID:1544
- C:\Windows\System\eAdFrxg.exe
  C:\Windows\System\eAdFrxg.exe
  2⤵
  - Executes dropped EXE
  PID:1068
- C:\Windows\System\tAVUmOT.exe
  C:\Windows\System\tAVUmOT.exe
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\System\QDUEwGj.exe
  C:\Windows\System\QDUEwGj.exe
  2⤵
  - Executes dropped EXE
  PID:2912
- C:\Windows\System\gieXCDm.exe
  C:\Windows\System\gieXCDm.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- C:\Windows\System\yZeQEJC.exe
  C:\Windows\System\yZeQEJC.exe
  2⤵
  - Executes dropped EXE
  PID:916
- C:\Windows\System\otlnUZe.exe
  C:\Windows\System\otlnUZe.exe
  2⤵
  - Executes dropped EXE
  PID:1028
- C:\Windows\System\akIQLus.exe
  C:\Windows\System\akIQLus.exe
  2⤵
  - Executes dropped EXE
  PID:2140
- C:\Windows\System\GgJLawN.exe
  C:\Windows\System\GgJLawN.exe
  2⤵
  - Executes dropped EXE
  PID:2920
- C:\Windows\System\AAmHVag.exe
  C:\Windows\System\AAmHVag.exe
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Windows\System\GFSeilJ.exe
  C:\Windows\System\GFSeilJ.exe
  2⤵
  - Executes dropped EXE
  PID:2072
- C:\Windows\System\zowdsho.exe
  C:\Windows\System\zowdsho.exe
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Windows\System\zAmrUCR.exe
  C:\Windows\System\zAmrUCR.exe
  2⤵
  - Executes dropped EXE
  PID:1732
- C:\Windows\System\acviLBN.exe
  C:\Windows\System\acviLBN.exe
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Windows\System\dJvRAaT.exe
  C:\Windows\System\dJvRAaT.exe
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Windows\System\hEDcevR.exe
  C:\Windows\System\hEDcevR.exe
  2⤵
  - Executes dropped EXE
  PID:2996
- C:\Windows\System\WPezVUQ.exe
  C:\Windows\System\WPezVUQ.exe
  2⤵
  - Executes dropped EXE
  PID:1600
- C:\Windows\System\nQGJnaj.exe
  C:\Windows\System\nQGJnaj.exe
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\System\ENuYkFw.exe
  C:\Windows\System\ENuYkFw.exe
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Windows\System\TCCbSIn.exe
  C:\Windows\System\TCCbSIn.exe
  2⤵
  - Executes dropped EXE
  PID:2584
- C:\Windows\System\DYGBrLZ.exe
  C:\Windows\System\DYGBrLZ.exe
  2⤵
  - Executes dropped EXE
  PID:2588
- C:\Windows\System\pFjMNJx.exe
  C:\Windows\System\pFjMNJx.exe
  2⤵
  - Executes dropped EXE
  PID:3044
- C:\Windows\System\xdeeUHI.exe
  C:\Windows\System\xdeeUHI.exe
  2⤵
  - Executes dropped EXE
  PID:1312
- C:\Windows\System\OCukyQm.exe
  C:\Windows\System\OCukyQm.exe
  2⤵
  - Executes dropped EXE
  PID:2456
- C:\Windows\System\PTZajLW.exe
  C:\Windows\System\PTZajLW.exe
  2⤵
  - Executes dropped EXE
  PID:2660
- C:\Windows\System\BjsTmVK.exe
  C:\Windows\System\BjsTmVK.exe
  2⤵
  - Executes dropped EXE
  PID:2772
- C:\Windows\System\EkbjirZ.exe
  C:\Windows\System\EkbjirZ.exe
  2⤵
  - Executes dropped EXE
  PID:2064
- C:\Windows\System\NPjsrmn.exe
  C:\Windows\System\NPjsrmn.exe
  2⤵
  - Executes dropped EXE
  PID:2784
- C:\Windows\System\IHobiuu.exe
  C:\Windows\System\IHobiuu.exe
  2⤵
  PID:1552
- C:\Windows\System\lLXbDXo.exe
  C:\Windows\System\lLXbDXo.exe
  2⤵
  PID:1504
- C:\Windows\System\csGPbFc.exe
  C:\Windows\System\csGPbFc.exe
  2⤵
  PID:1944
- C:\Windows\System\TBBKPta.exe
  C:\Windows\System\TBBKPta.exe
  2⤵
  PID:2328
- C:\Windows\System\ZwkbUMm.exe
  C:\Windows\System\ZwkbUMm.exe
  2⤵
  PID:2696
- C:\Windows\System\bIMtAdF.exe
  C:\Windows\System\bIMtAdF.exe
  2⤵
  PID:2712
- C:\Windows\System\scuDZdr.exe
  C:\Windows\System\scuDZdr.exe
  2⤵
  PID:2932
- C:\Windows\System\XrgEInp.exe
  C:\Windows\System\XrgEInp.exe
  2⤵
  PID:2076
- C:\Windows\System\wZuRkGW.exe
  C:\Windows\System\wZuRkGW.exe
  2⤵
  PID:1456
- C:\Windows\System\BCKeLgP.exe
  C:\Windows\System\BCKeLgP.exe
  2⤵
  PID:2656
- C:\Windows\System\nSBQmEC.exe
  C:\Windows\System\nSBQmEC.exe
  2⤵
  PID:684
- C:\Windows\System\SObQuHM.exe
  C:\Windows\System\SObQuHM.exe
  2⤵
  PID:1704
- C:\Windows\System\zOgrSwG.exe
  C:\Windows\System\zOgrSwG.exe
  2⤵
  PID:840
- C:\Windows\System\CUKInuH.exe
  C:\Windows\System\CUKInuH.exe
  2⤵
  PID:2408
- C:\Windows\System\fSNcdsP.exe
  C:\Windows\System\fSNcdsP.exe
  2⤵
  PID:2152
- C:\Windows\System\kncpPdQ.exe
  C:\Windows\System\kncpPdQ.exe
  2⤵
  PID:1680
- C:\Windows\System\hRFGlMZ.exe
  C:\Windows\System\hRFGlMZ.exe
  2⤵
  PID:1560
- C:\Windows\System\bkwfFJJ.exe
  C:\Windows\System\bkwfFJJ.exe
  2⤵
  PID:1332
- C:\Windows\System\YtblInv.exe
  C:\Windows\System\YtblInv.exe
  2⤵
  PID:404
- C:\Windows\System\hpjkyNd.exe
  C:\Windows\System\hpjkyNd.exe
  2⤵
  PID:1616
- C:\Windows\System\JroUoeK.exe
  C:\Windows\System\JroUoeK.exe
  2⤵
  PID:3032
- C:\Windows\System\QUuZnzq.exe
  C:\Windows\System\QUuZnzq.exe
  2⤵
  PID:2008
- C:\Windows\System\sWmGWwb.exe
  C:\Windows\System\sWmGWwb.exe
  2⤵
  PID:1980
- C:\Windows\System\aMMbRJl.exe
  C:\Windows\System\aMMbRJl.exe
  2⤵
  PID:2188
- C:\Windows\System\lwhUbFu.exe
  C:\Windows\System\lwhUbFu.exe
  2⤵
  PID:1512
- C:\Windows\System\TAtXhQY.exe
  C:\Windows\System\TAtXhQY.exe
  2⤵
  PID:2460
- C:\Windows\System\hwWEsbP.exe
  C:\Windows\System\hwWEsbP.exe
  2⤵
  PID:1604
- C:\Windows\System\sFVtUNI.exe
  C:\Windows\System\sFVtUNI.exe
  2⤵
  PID:2992
- C:\Windows\System\EbLGiIT.exe
  C:\Windows\System\EbLGiIT.exe
  2⤵
  PID:1156
- C:\Windows\System\wheHQiM.exe
  C:\Windows\System\wheHQiM.exe
  2⤵
  PID:2640
- C:\Windows\System\ZlQSNnF.exe
  C:\Windows\System\ZlQSNnF.exe
  2⤵
  PID:2760
- C:\Windows\System\hmtWksD.exe
  C:\Windows\System\hmtWksD.exe
  2⤵
  PID:2608
- C:\Windows\System\vJeiLeS.exe
  C:\Windows\System\vJeiLeS.exe
  2⤵
  PID:856
- C:\Windows\System\fVkdFEo.exe
  C:\Windows\System\fVkdFEo.exe
  2⤵
  PID:2704
- C:\Windows\System\SmYPFCb.exe
  C:\Windows\System\SmYPFCb.exe
  2⤵
  PID:1040
- C:\Windows\System\TRKGGlq.exe
  C:\Windows\System\TRKGGlq.exe
  2⤵
  PID:832
- C:\Windows\System\ZxgufcY.exe
  C:\Windows\System\ZxgufcY.exe
  2⤵
  PID:2508
- C:\Windows\System\RVibYFU.exe
  C:\Windows\System\RVibYFU.exe
  2⤵
  PID:2060
- C:\Windows\System\snSyBUr.exe
  C:\Windows\System\snSyBUr.exe
  2⤵
  PID:1368
- C:\Windows\System\AxIcUky.exe
  C:\Windows\System\AxIcUky.exe
  2⤵
  PID:1728
- C:\Windows\System\qOKpwDF.exe
  C:\Windows\System\qOKpwDF.exe
  2⤵
  PID:1632
- C:\Windows\System\BZOPZoF.exe
  C:\Windows\System\BZOPZoF.exe
  2⤵
  PID:556
- C:\Windows\System\sKhmdim.exe
  C:\Windows\System\sKhmdim.exe
  2⤵
  PID:1828
- C:\Windows\System\mDyAhlR.exe
  C:\Windows\System\mDyAhlR.exe
  2⤵
  PID:2320
- C:\Windows\System\hFxtYiP.exe
  C:\Windows\System\hFxtYiP.exe
  2⤵
  PID:1520
- C:\Windows\System\DhmUyMU.exe
  C:\Windows\System\DhmUyMU.exe
  2⤵
  PID:2252
- C:\Windows\System\QeZqrwp.exe
  C:\Windows\System\QeZqrwp.exe
  2⤵
  PID:2964
- C:\Windows\System\FNmoRIn.exe
  C:\Windows\System\FNmoRIn.exe
  2⤵
  PID:3040
- C:\Windows\System\WwPIjkN.exe
  C:\Windows\System\WwPIjkN.exe
  2⤵
  PID:2776
- C:\Windows\System\meqQsAT.exe
  C:\Windows\System\meqQsAT.exe
  2⤵
  PID:1344
- C:\Windows\System\FAfMsoV.exe
  C:\Windows\System\FAfMsoV.exe
  2⤵
  PID:660
- C:\Windows\System\UwczfZG.exe
  C:\Windows\System\UwczfZG.exe
  2⤵
  PID:2136
- C:\Windows\System\GdEfvBO.exe
  C:\Windows\System\GdEfvBO.exe
  2⤵
  PID:320
- C:\Windows\System\pyLFVIB.exe
  C:\Windows\System\pyLFVIB.exe
  2⤵
  PID:2940
- C:\Windows\System\KtRKBxJ.exe
  C:\Windows\System\KtRKBxJ.exe
  2⤵
  PID:2304
- C:\Windows\System\ktUpJPg.exe
  C:\Windows\System\ktUpJPg.exe
  2⤵
  PID:896
- C:\Windows\System\ALArXrs.exe
  C:\Windows\System\ALArXrs.exe
  2⤵
  PID:1724
- C:\Windows\System\mnMAmDa.exe
  C:\Windows\System\mnMAmDa.exe
  2⤵
  PID:1100
- C:\Windows\System\XsNJSkH.exe
  C:\Windows\System\XsNJSkH.exe
  2⤵
  PID:2728
- C:\Windows\System\VMNkGKo.exe
  C:\Windows\System\VMNkGKo.exe
  2⤵
  PID:2552
- C:\Windows\System\vKUrgfa.exe
  C:\Windows\System\vKUrgfa.exe
  2⤵
  PID:3052
- C:\Windows\System\ECqfgSK.exe
  C:\Windows\System\ECqfgSK.exe
  2⤵
  PID:2756
- C:\Windows\System\kuHJkLf.exe
  C:\Windows\System\kuHJkLf.exe
  2⤵
  PID:1764
- C:\Windows\System\LczWPKW.exe
  C:\Windows\System\LczWPKW.exe
  2⤵
  PID:816
- C:\Windows\System\PSbQXcE.exe
  C:\Windows\System\PSbQXcE.exe
  2⤵
  PID:908
- C:\Windows\System\QYWKBLh.exe
  C:\Windows\System\QYWKBLh.exe
  2⤵
  PID:2120
- C:\Windows\System\xkBJChH.exe
  C:\Windows\System\xkBJChH.exe
  2⤵
  PID:2828
- C:\Windows\System\EOTEhJP.exe
  C:\Windows\System\EOTEhJP.exe
  2⤵
  PID:2976
- C:\Windows\System\ndySXca.exe
  C:\Windows\System\ndySXca.exe
  2⤵
  PID:2212
- C:\Windows\System\BRsidCR.exe
  C:\Windows\System\BRsidCR.exe
  2⤵
  PID:1784
- C:\Windows\System\nZhdBiF.exe
  C:\Windows\System\nZhdBiF.exe
  2⤵
  PID:1416
- C:\Windows\System\XdznhvJ.exe
  C:\Windows\System\XdznhvJ.exe
  2⤵
  PID:1480
- C:\Windows\System\fsbQEqL.exe
  C:\Windows\System\fsbQEqL.exe
  2⤵
  PID:1968
- C:\Windows\System\mVVvWDM.exe
  C:\Windows\System\mVVvWDM.exe
  2⤵
  PID:2764
- C:\Windows\System\pNiSWlR.exe
  C:\Windows\System\pNiSWlR.exe
  2⤵
  PID:1208
- C:\Windows\System\KQqxamj.exe
  C:\Windows\System\KQqxamj.exe
  2⤵
  PID:1044
- C:\Windows\System\eVIZgJJ.exe
  C:\Windows\System\eVIZgJJ.exe
  2⤵
  PID:2476
- C:\Windows\System\OMzemIN.exe
  C:\Windows\System\OMzemIN.exe
  2⤵
  PID:2536
- C:\Windows\System\rYDvaYb.exe
  C:\Windows\System\rYDvaYb.exe
  2⤵
  PID:2264
- C:\Windows\System\nXUamcD.exe
  C:\Windows\System\nXUamcD.exe
  2⤵
  PID:1648
- C:\Windows\System\jFBlbca.exe
  C:\Windows\System\jFBlbca.exe
  2⤵
  PID:944
- C:\Windows\System\KXjVuSs.exe
  C:\Windows\System\KXjVuSs.exe
  2⤵
  PID:2872
- C:\Windows\System\QFvnwEC.exe
  C:\Windows\System\QFvnwEC.exe
  2⤵
  PID:2124
- C:\Windows\System\bJCuKIP.exe
  C:\Windows\System\bJCuKIP.exe
  2⤵
  PID:2324
- C:\Windows\System\PJURprL.exe
  C:\Windows\System\PJURprL.exe
  2⤵
  PID:2672
- C:\Windows\System\MTbNlqh.exe
  C:\Windows\System\MTbNlqh.exe
  2⤵
  PID:2208
- C:\Windows\System\SZSEIvK.exe
  C:\Windows\System\SZSEIvK.exe
  2⤵
  PID:2080
- C:\Windows\System\eAuygzH.exe
  C:\Windows\System\eAuygzH.exe
  2⤵
  PID:1452
- C:\Windows\System\XgkGdcf.exe
  C:\Windows\System\XgkGdcf.exe
  2⤵
  PID:452
- C:\Windows\System\BKnNliU.exe
  C:\Windows\System\BKnNliU.exe
  2⤵
  PID:2156
- C:\Windows\System\GecpsQN.exe
  C:\Windows\System\GecpsQN.exe
  2⤵
  PID:964
- C:\Windows\System\ocVdlqr.exe
  C:\Windows\System\ocVdlqr.exe
  2⤵
  PID:1752
- C:\Windows\System\UPmEbus.exe
  C:\Windows\System\UPmEbus.exe
  2⤵
  PID:1400
- C:\Windows\System\bHBIkWO.exe
  C:\Windows\System\bHBIkWO.exe
  2⤵
  PID:2472
- C:\Windows\System\YczrDBo.exe
  C:\Windows\System\YczrDBo.exe
  2⤵
  PID:2452
- C:\Windows\System\wGrOKkR.exe
  C:\Windows\System\wGrOKkR.exe
  2⤵
  PID:1020
- C:\Windows\System\tkIOoiI.exe
  C:\Windows\System\tkIOoiI.exe
  2⤵
  PID:2676
- C:\Windows\System\xcfwcGT.exe
  C:\Windows\System\xcfwcGT.exe
  2⤵
  PID:2908
- C:\Windows\System\bzjdVRA.exe
  C:\Windows\System\bzjdVRA.exe
  2⤵
  PID:2424
- C:\Windows\System\nqPPvei.exe
  C:\Windows\System\nqPPvei.exe
  2⤵
  PID:1836
- C:\Windows\System\kllXUoc.exe
  C:\Windows\System\kllXUoc.exe
  2⤵
  PID:1032
- C:\Windows\System\hOFGNUs.exe
  C:\Windows\System\hOFGNUs.exe
  2⤵
  PID:2348
- C:\Windows\System\UeyZwII.exe
  C:\Windows\System\UeyZwII.exe
  2⤵
  PID:2836
- C:\Windows\System\bpTTWWf.exe
  C:\Windows\System\bpTTWWf.exe
  2⤵
  PID:1508
- C:\Windows\System\KXAJdqI.exe
  C:\Windows\System\KXAJdqI.exe
  2⤵
  PID:2820
- C:\Windows\System\ALbKLkx.exe
  C:\Windows\System\ALbKLkx.exe
  2⤵
  PID:2336
- C:\Windows\System\gtJukYk.exe
  C:\Windows\System\gtJukYk.exe
  2⤵
  PID:2632
- C:\Windows\System\KTRquHG.exe
  C:\Windows\System\KTRquHG.exe
  2⤵
  PID:2172
- C:\Windows\System\fpJXbxE.exe
  C:\Windows\System\fpJXbxE.exe
  2⤵
  PID:1916
- C:\Windows\System\fXVGemA.exe
  C:\Windows\System\fXVGemA.exe
  2⤵
  PID:2416
- C:\Windows\System\aBnfDqh.exe
  C:\Windows\System\aBnfDqh.exe
  2⤵
  PID:1092
- C:\Windows\System\qIhnTjY.exe
  C:\Windows\System\qIhnTjY.exe
  2⤵
  PID:1484
- C:\Windows\System\XZBSFFu.exe
  C:\Windows\System\XZBSFFu.exe
  2⤵
  PID:3120
- C:\Windows\System\JiUGBgf.exe
  C:\Windows\System\JiUGBgf.exe
  2⤵
  PID:3136
- C:\Windows\System\UhjyxnF.exe
  C:\Windows\System\UhjyxnF.exe
  2⤵
  PID:3156
- C:\Windows\System\VwrMvOg.exe
  C:\Windows\System\VwrMvOg.exe
  2⤵
  PID:3172
- C:\Windows\System\JmTCODe.exe
  C:\Windows\System\JmTCODe.exe
  2⤵
  PID:3188
- C:\Windows\System\blvHzQo.exe
  C:\Windows\System\blvHzQo.exe
  2⤵
  PID:3204
- C:\Windows\System\tSnQRLx.exe
  C:\Windows\System\tSnQRLx.exe
  2⤵
  PID:3220
- C:\Windows\System\wfnwOHH.exe
  C:\Windows\System\wfnwOHH.exe
  2⤵
  PID:3236
- C:\Windows\System\HNnuGgP.exe
  C:\Windows\System\HNnuGgP.exe
  2⤵
  PID:3252
- C:\Windows\System\XYcHsmZ.exe
  C:\Windows\System\XYcHsmZ.exe
  2⤵
  PID:3268
- C:\Windows\System\FqhYlVg.exe
  C:\Windows\System\FqhYlVg.exe
  2⤵
  PID:3284
- C:\Windows\System\dWGJNDd.exe
  C:\Windows\System\dWGJNDd.exe
  2⤵
  PID:3304
- C:\Windows\System\qDnMGUg.exe
  C:\Windows\System\qDnMGUg.exe
  2⤵
  PID:3320
- C:\Windows\System\XGmhSiO.exe
  C:\Windows\System\XGmhSiO.exe
  2⤵
  PID:3336
- C:\Windows\System\VKaNVLO.exe
  C:\Windows\System\VKaNVLO.exe
  2⤵
  PID:3352
- C:\Windows\System\LEDvnWU.exe
  C:\Windows\System\LEDvnWU.exe
  2⤵
  PID:3368
- C:\Windows\System\QKBKwdG.exe
  C:\Windows\System\QKBKwdG.exe
  2⤵
  PID:3384
- C:\Windows\System\KUSdAXJ.exe
  C:\Windows\System\KUSdAXJ.exe
  2⤵
  PID:3400
- C:\Windows\System\kzQOPWF.exe
  C:\Windows\System\kzQOPWF.exe
  2⤵
  PID:3420
- C:\Windows\System\PbezWDv.exe
  C:\Windows\System\PbezWDv.exe
  2⤵
  PID:3436
- C:\Windows\System\sUpFSEB.exe
  C:\Windows\System\sUpFSEB.exe
  2⤵
  PID:3452
- C:\Windows\System\PLesVWZ.exe
  C:\Windows\System\PLesVWZ.exe
  2⤵
  PID:3468
- C:\Windows\System\kCCFVdE.exe
  C:\Windows\System\kCCFVdE.exe
  2⤵
  PID:3484
- C:\Windows\System\dHTvbnE.exe
  C:\Windows\System\dHTvbnE.exe
  2⤵
  PID:3500
- C:\Windows\System\HTmgvkc.exe
  C:\Windows\System\HTmgvkc.exe
  2⤵
  PID:3520
- C:\Windows\System\aHcMOPY.exe
  C:\Windows\System\aHcMOPY.exe
  2⤵
  PID:3536
- C:\Windows\System\eoknXEP.exe
  C:\Windows\System\eoknXEP.exe
  2⤵
  PID:3552
- C:\Windows\System\nKDYVgv.exe
  C:\Windows\System\nKDYVgv.exe
  2⤵
  PID:3568
- C:\Windows\System\secPfej.exe
  C:\Windows\System\secPfej.exe
  2⤵
  PID:3584
- C:\Windows\System\CYrVrtv.exe
  C:\Windows\System\CYrVrtv.exe
  2⤵
  PID:3600
- C:\Windows\System\xLkDenr.exe
  C:\Windows\System\xLkDenr.exe
  2⤵
  PID:3616
- C:\Windows\System\tugvrED.exe
  C:\Windows\System\tugvrED.exe
  2⤵
  PID:3636
- C:\Windows\System\KavGMab.exe
  C:\Windows\System\KavGMab.exe
  2⤵
  PID:3652
- C:\Windows\System\REhrBBQ.exe
  C:\Windows\System\REhrBBQ.exe
  2⤵
  PID:3668
- C:\Windows\System\aMriCtW.exe
  C:\Windows\System\aMriCtW.exe
  2⤵
  PID:3684
- C:\Windows\System\iVUquKJ.exe
  C:\Windows\System\iVUquKJ.exe
  2⤵
  PID:3700
- C:\Windows\System\MxVKiZz.exe
  C:\Windows\System\MxVKiZz.exe
  2⤵
  PID:3716
- C:\Windows\System\tZNpLEc.exe
  C:\Windows\System\tZNpLEc.exe
  2⤵
  PID:3860
- C:\Windows\System\uEEXiNU.exe
  C:\Windows\System\uEEXiNU.exe
  2⤵
  PID:3880
- C:\Windows\System\FrNcJdX.exe
  C:\Windows\System\FrNcJdX.exe
  2⤵
  PID:3896
- C:\Windows\System\aOBmphk.exe
  C:\Windows\System\aOBmphk.exe
  2⤵
  PID:3912
- C:\Windows\System\naSxBRm.exe
  C:\Windows\System\naSxBRm.exe
  2⤵
  PID:3928
- C:\Windows\System\NLhmqtE.exe
  C:\Windows\System\NLhmqtE.exe
  2⤵
  PID:3944
- C:\Windows\System\QNIsVmK.exe
  C:\Windows\System\QNIsVmK.exe
  2⤵
  PID:3960
- C:\Windows\System\OyFslRj.exe
  C:\Windows\System\OyFslRj.exe
  2⤵
  PID:3976
- C:\Windows\System\rdWbrBE.exe
  C:\Windows\System\rdWbrBE.exe
  2⤵
  PID:3996
- C:\Windows\System\rcgVLlf.exe
  C:\Windows\System\rcgVLlf.exe
  2⤵
  PID:4012
- C:\Windows\System\uNFRBRe.exe
  C:\Windows\System\uNFRBRe.exe
  2⤵
  PID:4028
- C:\Windows\System\lclwYca.exe
  C:\Windows\System\lclwYca.exe
  2⤵
  PID:4048
- C:\Windows\System\KVDjXQn.exe
  C:\Windows\System\KVDjXQn.exe
  2⤵
  PID:4064
- C:\Windows\System\mwCiOBe.exe
  C:\Windows\System\mwCiOBe.exe
  2⤵
  PID:4080
- C:\Windows\System\UAZJYFr.exe
  C:\Windows\System\UAZJYFr.exe
  2⤵
  PID:3084
- C:\Windows\System\bDlEapG.exe
  C:\Windows\System\bDlEapG.exe
  2⤵
  PID:2780
- C:\Windows\System\jETfJNg.exe
  C:\Windows\System\jETfJNg.exe
  2⤵
  PID:3096
- C:\Windows\System\EFUahqB.exe
  C:\Windows\System\EFUahqB.exe
  2⤵
  PID:3112
- C:\Windows\System\dfuyQUq.exe
  C:\Windows\System\dfuyQUq.exe
  2⤵
  PID:3148
- C:\Windows\System\GEJyNIM.exe
  C:\Windows\System\GEJyNIM.exe
  2⤵
  PID:3212
- C:\Windows\System\VowlaEE.exe
  C:\Windows\System\VowlaEE.exe
  2⤵
  PID:3132
- C:\Windows\System\beZccTp.exe
  C:\Windows\System\beZccTp.exe
  2⤵
  PID:3316
- C:\Windows\System\IUvqucA.exe
  C:\Windows\System\IUvqucA.exe
  2⤵
  PID:3380
- C:\Windows\System\QoZduYD.exe
  C:\Windows\System\QoZduYD.exe
  2⤵
  PID:3444
- C:\Windows\System\kBBuVBw.exe
  C:\Windows\System\kBBuVBw.exe
  2⤵
  PID:3516
- C:\Windows\System\asbuOKh.exe
  C:\Windows\System\asbuOKh.exe
  2⤵
  PID:3612
- C:\Windows\System\OJfmKvv.exe
  C:\Windows\System\OJfmKvv.exe
  2⤵
  PID:3300
- C:\Windows\System\xuOiatf.exe
  C:\Windows\System\xuOiatf.exe
  2⤵
  PID:3364
- C:\Windows\System\HpLgIVJ.exe
  C:\Windows\System\HpLgIVJ.exe
  2⤵
  PID:3432
- C:\Windows\System\ilbBTOb.exe
  C:\Windows\System\ilbBTOb.exe
  2⤵
  PID:3528
- C:\Windows\System\WNsHzlC.exe
  C:\Windows\System\WNsHzlC.exe
  2⤵
  PID:3624
- C:\Windows\System\TpltWhh.exe
  C:\Windows\System\TpltWhh.exe
  2⤵
  PID:3664
- C:\Windows\System\CgVrYzH.exe
  C:\Windows\System\CgVrYzH.exe
  2⤵
  PID:3740
- C:\Windows\System\hMitAhC.exe
  C:\Windows\System\hMitAhC.exe
  2⤵
  PID:3712
- C:\Windows\System\nXBaHwQ.exe
  C:\Windows\System\nXBaHwQ.exe
  2⤵
  PID:3776
- C:\Windows\System\SZBzYVX.exe
  C:\Windows\System\SZBzYVX.exe
  2⤵
  PID:3792
- C:\Windows\System\GflZUtT.exe
  C:\Windows\System\GflZUtT.exe
  2⤵
  PID:3816
- C:\Windows\System\auZjSnD.exe
  C:\Windows\System\auZjSnD.exe
  2⤵
  PID:3832
- C:\Windows\System\ipCEDmn.exe
  C:\Windows\System\ipCEDmn.exe
  2⤵
  PID:3728
- C:\Windows\System\AAPQpet.exe
  C:\Windows\System\AAPQpet.exe
  2⤵
  PID:3892
- C:\Windows\System\PfERjBq.exe
  C:\Windows\System\PfERjBq.exe
  2⤵
  PID:3868
- C:\Windows\System\HmqjlBR.exe
  C:\Windows\System\HmqjlBR.exe
  2⤵
  PID:3984
- C:\Windows\System\PaXLILA.exe
  C:\Windows\System\PaXLILA.exe
  2⤵
  PID:3968
- C:\Windows\System\uaUzDco.exe
  C:\Windows\System\uaUzDco.exe
  2⤵
  PID:4024
- C:\Windows\System\rLqDNXe.exe
  C:\Windows\System\rLqDNXe.exe
  2⤵
  PID:4088
- C:\Windows\System\XlDnwcI.exe
  C:\Windows\System\XlDnwcI.exe
  2⤵
  PID:2012
- C:\Windows\System\jhjMaEM.exe
  C:\Windows\System\jhjMaEM.exe
  2⤵
  PID:1628
- C:\Windows\System\ombkKty.exe
  C:\Windows\System\ombkKty.exe
  2⤵
  PID:4040
- C:\Windows\System\ryfYhZY.exe
  C:\Windows\System\ryfYhZY.exe
  2⤵
  PID:3128
- C:\Windows\System\ZgkjUDO.exe
  C:\Windows\System\ZgkjUDO.exe
  2⤵
  PID:596
- C:\Windows\System\HXGChEw.exe
  C:\Windows\System\HXGChEw.exe
  2⤵
  PID:3280
- C:\Windows\System\gvgeBxq.exe
  C:\Windows\System\gvgeBxq.exe
  2⤵
  PID:2720
- C:\Windows\System\hzbRkvS.exe
  C:\Windows\System\hzbRkvS.exe
  2⤵
  PID:3348
- C:\Windows\System\bsWPGbe.exe
  C:\Windows\System\bsWPGbe.exe
  2⤵
  PID:3648
- C:\Windows\System\ZdSsTAm.exe
  C:\Windows\System\ZdSsTAm.exe
  2⤵
  PID:3232
- C:\Windows\System\FqEQMjb.exe
  C:\Windows\System\FqEQMjb.exe
  2⤵
  PID:3292
- C:\Windows\System\AIoeMox.exe
  C:\Windows\System\AIoeMox.exe
  2⤵
  PID:3428
- C:\Windows\System\jWjBxkv.exe
  C:\Windows\System\jWjBxkv.exe
  2⤵
  PID:3492
- C:\Windows\System\PPssNEJ.exe
  C:\Windows\System\PPssNEJ.exe
  2⤵
  PID:3660
- C:\Windows\System\GMXxZrM.exe
  C:\Windows\System\GMXxZrM.exe
  2⤵
  PID:3724
- C:\Windows\System\fdYIwkL.exe
  C:\Windows\System\fdYIwkL.exe
  2⤵
  PID:3764
- C:\Windows\System\IZDPdHt.exe
  C:\Windows\System\IZDPdHt.exe
  2⤵
  PID:3812
- C:\Windows\System\SykzVvm.exe
  C:\Windows\System\SykzVvm.exe
  2⤵
  PID:3848
- C:\Windows\System\YjRCBzU.exe
  C:\Windows\System\YjRCBzU.exe
  2⤵
  PID:3952
- C:\Windows\System\PNbIPUi.exe
  C:\Windows\System\PNbIPUi.exe
  2⤵
  PID:3904
- C:\Windows\System\DwcVOKv.exe
  C:\Windows\System\DwcVOKv.exe
  2⤵
  PID:3992
- C:\Windows\System\cxLSwst.exe
  C:\Windows\System\cxLSwst.exe
  2⤵
  PID:4060
- C:\Windows\System\egcMBIS.exe
  C:\Windows\System\egcMBIS.exe
  2⤵
  PID:1304
- C:\Windows\System\AhRifND.exe
  C:\Windows\System\AhRifND.exe
  2⤵
  PID:1796
- C:\Windows\System\fHrHxXi.exe
  C:\Windows\System\fHrHxXi.exe
  2⤵
  PID:3180
- C:\Windows\System\RWoklBW.exe
  C:\Windows\System\RWoklBW.exe
  2⤵
  PID:3412
- C:\Windows\System\UYAFdJB.exe
  C:\Windows\System\UYAFdJB.exe
  2⤵
  PID:2708
- C:\Windows\System\MolfaTu.exe
  C:\Windows\System\MolfaTu.exe
  2⤵
  PID:3248
- C:\Windows\System\IksNnAa.exe
  C:\Windows\System\IksNnAa.exe
  2⤵
  PID:3200
- C:\Windows\System\TPPftqR.exe
  C:\Windows\System\TPPftqR.exe
  2⤵
  PID:3264
- C:\Windows\System\ZJDDnxY.exe
  C:\Windows\System\ZJDDnxY.exe
  2⤵
  PID:3332
- C:\Windows\System\blfdszZ.exe
  C:\Windows\System\blfdszZ.exe
  2⤵
  PID:3592
- C:\Windows\System\onuDlRC.exe
  C:\Windows\System\onuDlRC.exe
  2⤵
  PID:3752
- C:\Windows\System\HSCxEvI.exe
  C:\Windows\System\HSCxEvI.exe
  2⤵
  PID:3760
- C:\Windows\System\BdOphSK.exe
  C:\Windows\System\BdOphSK.exe
  2⤵
  PID:3840
- C:\Windows\System\hLyuNND.exe
  C:\Windows\System\hLyuNND.exe
  2⤵
  PID:3844
- C:\Windows\System\ftQlFcR.exe
  C:\Windows\System\ftQlFcR.exe
  2⤵
  PID:3548
- C:\Windows\System\LNGtfoc.exe
  C:\Windows\System\LNGtfoc.exe
  2⤵
  PID:4056
- C:\Windows\System\XyDhlUL.exe
  C:\Windows\System\XyDhlUL.exe
  2⤵
  PID:4104
- C:\Windows\System\SDBHOZx.exe
  C:\Windows\System\SDBHOZx.exe
  2⤵
  PID:4120
- C:\Windows\System\tKZfhyn.exe
  C:\Windows\System\tKZfhyn.exe
  2⤵
  PID:4136
- C:\Windows\System\XpjfWHB.exe
  C:\Windows\System\XpjfWHB.exe
  2⤵
  PID:4152
- C:\Windows\System\BhJmvwU.exe
  C:\Windows\System\BhJmvwU.exe
  2⤵
  PID:4168
- C:\Windows\System\uwIgwYM.exe
  C:\Windows\System\uwIgwYM.exe
  2⤵
  PID:4184
- C:\Windows\System\DjBnddN.exe
  C:\Windows\System\DjBnddN.exe
  2⤵
  PID:4200
- C:\Windows\System\dqBgzUF.exe
  C:\Windows\System\dqBgzUF.exe
  2⤵
  PID:4216
- C:\Windows\System\kAxHeYp.exe
  C:\Windows\System\kAxHeYp.exe
  2⤵
  PID:4340
- C:\Windows\System\kHyNBKl.exe
  C:\Windows\System\kHyNBKl.exe
  2⤵
  PID:4356
- C:\Windows\System\UMbeHnn.exe
  C:\Windows\System\UMbeHnn.exe
  2⤵
  PID:4372
- C:\Windows\System\pyzfVPD.exe
  C:\Windows\System\pyzfVPD.exe
  2⤵
  PID:4408
- C:\Windows\System\VjMbXHZ.exe
  C:\Windows\System\VjMbXHZ.exe
  2⤵
  PID:4424
- C:\Windows\System\fUpMAce.exe
  C:\Windows\System\fUpMAce.exe
  2⤵
  PID:4444
- C:\Windows\System\bSnzCoL.exe
  C:\Windows\System\bSnzCoL.exe
  2⤵
  PID:4460
- C:\Windows\System\heYveOX.exe
  C:\Windows\System\heYveOX.exe
  2⤵
  PID:4484
- C:\Windows\System\zlptpES.exe
  C:\Windows\System\zlptpES.exe
  2⤵
  PID:4500
- C:\Windows\System\AdmcYZu.exe
  C:\Windows\System\AdmcYZu.exe
  2⤵
  PID:4516
- C:\Windows\System\hVBNHSc.exe
  C:\Windows\System\hVBNHSc.exe
  2⤵
  PID:4544
- C:\Windows\System\IgflgMA.exe
  C:\Windows\System\IgflgMA.exe
  2⤵
  PID:4560
- C:\Windows\System\dbilJIX.exe
  C:\Windows\System\dbilJIX.exe
  2⤵
  PID:4580
- C:\Windows\System\VYwKzmn.exe
  C:\Windows\System\VYwKzmn.exe
  2⤵
  PID:4596
- C:\Windows\System\muFiBxI.exe
  C:\Windows\System\muFiBxI.exe
  2⤵
  PID:4612
- C:\Windows\System\GHkwjBy.exe
  C:\Windows\System\GHkwjBy.exe
  2⤵
  PID:4628
- C:\Windows\System\GnCgeGW.exe
  C:\Windows\System\GnCgeGW.exe
  2⤵
  PID:4652
- C:\Windows\System\fsuxKVe.exe
  C:\Windows\System\fsuxKVe.exe
  2⤵
  PID:4672
- C:\Windows\System\JByknSO.exe
  C:\Windows\System\JByknSO.exe
  2⤵
  PID:4688
- C:\Windows\System\EMfTFMl.exe
  C:\Windows\System\EMfTFMl.exe
  2⤵
  PID:4704
- C:\Windows\System\QzuagnJ.exe
  C:\Windows\System\QzuagnJ.exe
  2⤵
  PID:4720
- C:\Windows\System\cgqGYKY.exe
  C:\Windows\System\cgqGYKY.exe
  2⤵
  PID:4736
- C:\Windows\System\AuFjiIR.exe
  C:\Windows\System\AuFjiIR.exe
  2⤵
  PID:4756
- C:\Windows\System\chqshen.exe
  C:\Windows\System\chqshen.exe
  2⤵
  PID:4772
- C:\Windows\System\anLOWln.exe
  C:\Windows\System\anLOWln.exe
  2⤵
  PID:4788
- C:\Windows\System\sKuJzsu.exe
  C:\Windows\System\sKuJzsu.exe
  2⤵
  PID:4848
- C:\Windows\System\TMgUqew.exe
  C:\Windows\System\TMgUqew.exe
  2⤵
  PID:4864
- C:\Windows\System\sczDQeO.exe
  C:\Windows\System\sczDQeO.exe
  2⤵
  PID:4884
- C:\Windows\System\QJFNBNp.exe
  C:\Windows\System\QJFNBNp.exe
  2⤵
  PID:4908
- C:\Windows\System\eKIRsNX.exe
  C:\Windows\System\eKIRsNX.exe
  2⤵
  PID:4940
- C:\Windows\System\POYpvEr.exe
  C:\Windows\System\POYpvEr.exe
  2⤵
  PID:4964
- C:\Windows\System\oGdwgVe.exe
  C:\Windows\System\oGdwgVe.exe
  2⤵
  PID:4980
- C:\Windows\System\EqxFBTp.exe
  C:\Windows\System\EqxFBTp.exe
  2⤵
  PID:5000
- C:\Windows\System\vwLJBLF.exe
  C:\Windows\System\vwLJBLF.exe
  2⤵
  PID:5016
- C:\Windows\System\VxLddxL.exe
  C:\Windows\System\VxLddxL.exe
  2⤵
  PID:5036
- C:\Windows\System\DwCSHGQ.exe
  C:\Windows\System\DwCSHGQ.exe
  2⤵
  PID:5060
- C:\Windows\System\nQerJGs.exe
  C:\Windows\System\nQerJGs.exe
  2⤵
  PID:5084
- C:\Windows\System\SlCojXF.exe
  C:\Windows\System\SlCojXF.exe
  2⤵
  PID:5100
- C:\Windows\System\NhfwSVu.exe
  C:\Windows\System\NhfwSVu.exe
  2⤵
  PID:3108
- C:\Windows\System\aleXrQZ.exe
  C:\Windows\System\aleXrQZ.exe
  2⤵
  PID:3260
- C:\Windows\System\UKBrTDr.exe
  C:\Windows\System\UKBrTDr.exe
  2⤵
  PID:3580
- C:\Windows\System\IakaeBJ.exe
  C:\Windows\System\IakaeBJ.exe
  2⤵
  PID:3392
- C:\Windows\System\hZZTYmr.exe
  C:\Windows\System\hZZTYmr.exe
  2⤵
  PID:3480
- C:\Windows\System\wvDlAqm.exe
  C:\Windows\System\wvDlAqm.exe
  2⤵
  PID:3144
- C:\Windows\System\xYIsixs.exe
  C:\Windows\System\xYIsixs.exe
  2⤵
  PID:4192
- C:\Windows\System\eTmNUQI.exe
  C:\Windows\System\eTmNUQI.exe
  2⤵
  PID:3564
- C:\Windows\System\GZhLOKJ.exe
  C:\Windows\System\GZhLOKJ.exe
  2⤵
  PID:4132
- C:\Windows\System\PbulCUy.exe
  C:\Windows\System\PbulCUy.exe
  2⤵
  PID:4212
- C:\Windows\System\fuATVkK.exe
  C:\Windows\System\fuATVkK.exe
  2⤵
  PID:4256
- C:\Windows\System\PgjzqHG.exe
  C:\Windows\System\PgjzqHG.exe
  2⤵
  PID:4240
- C:\Windows\System\CVFHUBp.exe
  C:\Windows\System\CVFHUBp.exe
  2⤵
  PID:4288
- C:\Windows\System\GZMbLwt.exe
  C:\Windows\System\GZMbLwt.exe
  2⤵
  PID:4296
- C:\Windows\System\pVHRdQI.exe
  C:\Windows\System\pVHRdQI.exe
  2⤵
  PID:4324
- C:\Windows\System\YOsSDkY.exe
  C:\Windows\System\YOsSDkY.exe
  2⤵
  PID:4352
- C:\Windows\System\WCSZJru.exe
  C:\Windows\System\WCSZJru.exe
  2⤵
  PID:4392
- C:\Windows\System\HJWvAMI.exe
  C:\Windows\System\HJWvAMI.exe
  2⤵
  PID:4432
- C:\Windows\System\mZUSnPH.exe
  C:\Windows\System\mZUSnPH.exe
  2⤵
  PID:4452
- C:\Windows\System\OtKubeo.exe
  C:\Windows\System\OtKubeo.exe
  2⤵
  PID:4524
- C:\Windows\System\vVxFTWs.exe
  C:\Windows\System\vVxFTWs.exe
  2⤵
  PID:4512
- C:\Windows\System\WHVeExj.exe
  C:\Windows\System\WHVeExj.exe
  2⤵
  PID:4532
- C:\Windows\System\cVObhon.exe
  C:\Windows\System\cVObhon.exe
  2⤵
  PID:4604
- C:\Windows\System\BgtUJFt.exe
  C:\Windows\System\BgtUJFt.exe
  2⤵
  PID:4680
- C:\Windows\System\ljdxXOR.exe
  C:\Windows\System\ljdxXOR.exe
  2⤵
  PID:4748
- C:\Windows\System\rZQOEdt.exe
  C:\Windows\System\rZQOEdt.exe
  2⤵
  PID:4712
- C:\Windows\System\QaCatNK.exe
  C:\Windows\System\QaCatNK.exe
  2⤵
  PID:4732
- C:\Windows\System\hbFNeTv.exe
  C:\Windows\System\hbFNeTv.exe
  2⤵
  PID:4696
- C:\Windows\System\sJrsnbp.exe
  C:\Windows\System\sJrsnbp.exe
  2⤵
  PID:4816
- C:\Windows\System\hQAdbUh.exe
  C:\Windows\System\hQAdbUh.exe
  2⤵
  PID:4828
- C:\Windows\System\uIDZyrU.exe
  C:\Windows\System\uIDZyrU.exe
  2⤵
  PID:4844
- C:\Windows\System\RQcnTAx.exe
  C:\Windows\System\RQcnTAx.exe
  2⤵
  PID:4892
- C:\Windows\System\hNjbXnI.exe
  C:\Windows\System\hNjbXnI.exe
  2⤵
  PID:4880
- C:\Windows\System\ykqdaAU.exe
  C:\Windows\System\ykqdaAU.exe
  2⤵
  PID:4952
- C:\Windows\System\xmrdVlS.exe
  C:\Windows\System\xmrdVlS.exe
  2⤵
  PID:4924
- C:\Windows\System\ymgqaGA.exe
  C:\Windows\System\ymgqaGA.exe
  2⤵
  PID:4972
- C:\Windows\System\gSFPBJj.exe
  C:\Windows\System\gSFPBJj.exe
  2⤵
  PID:4992
- C:\Windows\System\LATgIRy.exe
  C:\Windows\System\LATgIRy.exe
  2⤵
  PID:5032
- C:\Windows\System\CVmwWuQ.exe
  C:\Windows\System\CVmwWuQ.exe
  2⤵
  PID:5068
- C:\Windows\System\rpShjtL.exe
  C:\Windows\System\rpShjtL.exe
  2⤵
  PID:5108
- C:\Windows\System\DcZqjEU.exe
  C:\Windows\System\DcZqjEU.exe
  2⤵
  PID:5116
- C:\Windows\System\kTYcDES.exe
  C:\Windows\System\kTYcDES.exe
  2⤵
  PID:1488
- C:\Windows\System\CNVksbd.exe
  C:\Windows\System\CNVksbd.exe
  2⤵
  PID:3596
- C:\Windows\System\eEqvIPP.exe
  C:\Windows\System\eEqvIPP.exe
  2⤵
  PID:3168
- C:\Windows\System\WFCobZh.exe
  C:\Windows\System\WFCobZh.exe
  2⤵
  PID:4128
- C:\Windows\System\intPYSm.exe
  C:\Windows\System\intPYSm.exe
  2⤵
  PID:3828
- C:\Windows\System\OuVELCC.exe
  C:\Windows\System\OuVELCC.exe
  2⤵
  PID:4176
- C:\Windows\System\OgGZmSZ.exe
  C:\Windows\System\OgGZmSZ.exe
  2⤵
  PID:4208
- C:\Windows\System\khpQnPc.exe
  C:\Windows\System\khpQnPc.exe
  2⤵
  PID:4268
- C:\Windows\System\oPiaKwb.exe
  C:\Windows\System\oPiaKwb.exe
  2⤵
  PID:4308
- C:\Windows\System\VERoqLp.exe
  C:\Windows\System\VERoqLp.exe
  2⤵
  PID:4276
- C:\Windows\System\JLJVPWE.exe
  C:\Windows\System\JLJVPWE.exe
  2⤵
  PID:4368
- C:\Windows\System\FWaPeLf.exe
  C:\Windows\System\FWaPeLf.exe
  2⤵
  PID:4416
- C:\Windows\System\ZUSakbK.exe
  C:\Windows\System\ZUSakbK.exe
  2⤵
  PID:4492
- C:\Windows\System\sWViowV.exe
  C:\Windows\System\sWViowV.exe
  2⤵
  PID:4508
- C:\Windows\System\CQilvGJ.exe
  C:\Windows\System\CQilvGJ.exe
  2⤵
  PID:4840
- C:\Windows\System\POTuwvD.exe
  C:\Windows\System\POTuwvD.exe
  2⤵
  PID:4916
- C:\Windows\System\jNJwYXx.exe
  C:\Windows\System\jNJwYXx.exe
  2⤵
  PID:4956
- C:\Windows\System\ilFzXdX.exe
  C:\Windows\System\ilFzXdX.exe
  2⤵
  PID:4928
- C:\Windows\System\fFOWvjY.exe
  C:\Windows\System\fFOWvjY.exe
  2⤵
  PID:5024
- C:\Windows\System\xccuKtG.exe
  C:\Windows\System\xccuKtG.exe
  2⤵
  PID:5044
- C:\Windows\System\xjfDRIy.exe
  C:\Windows\System\xjfDRIy.exe
  2⤵
  PID:2580
- C:\Windows\System\NsrreOF.exe
  C:\Windows\System\NsrreOF.exe
  2⤵
  PID:2204
- C:\Windows\System\uuThBkZ.exe
  C:\Windows\System\uuThBkZ.exe
  2⤵
  PID:4100
- C:\Windows\System\kmwkBHt.exe
  C:\Windows\System\kmwkBHt.exe
  2⤵
  PID:4436
- C:\Windows\System\HQNkjZD.exe
  C:\Windows\System\HQNkjZD.exe
  2⤵
  PID:4636
- C:\Windows\System\OVMIBkJ.exe
  C:\Windows\System\OVMIBkJ.exe
  2⤵
  PID:4404
- C:\Windows\System\HqgeDWe.exe
  C:\Windows\System\HqgeDWe.exe
  2⤵
  PID:4144
- C:\Windows\System\JOgTVht.exe
  C:\Windows\System\JOgTVht.exe
  2⤵
  PID:4384
- C:\Windows\System\omzcSux.exe
  C:\Windows\System\omzcSux.exe
  2⤵
  PID:4236
- C:\Windows\System\ErMcAGC.exe
  C:\Windows\System\ErMcAGC.exe
  2⤵
  PID:4592
- C:\Windows\System\BnRlJfn.exe
  C:\Windows\System\BnRlJfn.exe
  2⤵
  PID:4648
- C:\Windows\System\BXdzUzA.exe
  C:\Windows\System\BXdzUzA.exe
  2⤵
  PID:4624
- C:\Windows\System\DmQfgDm.exe
  C:\Windows\System\DmQfgDm.exe
  2⤵
  PID:4768
- C:\Windows\System\yQCGDWR.exe
  C:\Windows\System\yQCGDWR.exe
  2⤵
  PID:4812
- C:\Windows\System\FpnVNfN.exe
  C:\Windows\System\FpnVNfN.exe
  2⤵
  PID:4820
- C:\Windows\System\XxpLcCC.exe
  C:\Windows\System\XxpLcCC.exe
  2⤵
  PID:4948
- C:\Windows\System\nBRaBki.exe
  C:\Windows\System\nBRaBki.exe
  2⤵
  PID:4876
- C:\Windows\System\xLYRqTc.exe
  C:\Windows\System\xLYRqTc.exe
  2⤵
  PID:5048
- C:\Windows\System\BSQwchw.exe
  C:\Windows\System\BSQwchw.exe
  2⤵
  PID:5012
- C:\Windows\System\yIyLkWb.exe
  C:\Windows\System\yIyLkWb.exe
  2⤵
  PID:5080
- C:\Windows\System\jzudtkN.exe
  C:\Windows\System\jzudtkN.exe
  2⤵
  PID:3956
- C:\Windows\System\aQKoFxu.exe
  C:\Windows\System\aQKoFxu.exe
  2⤵
  PID:4576
- C:\Windows\System\ByXvqEq.exe
  C:\Windows\System\ByXvqEq.exe
  2⤵
  PID:4380
- C:\Windows\System\bnVfTvH.exe
  C:\Windows\System\bnVfTvH.exe
  2⤵
  PID:4960
- C:\Windows\System\TdiPaWB.exe
  C:\Windows\System\TdiPaWB.exe
  2⤵
  PID:5056
- C:\Windows\System\zYfvwBI.exe
  C:\Windows\System\zYfvwBI.exe
  2⤵
  PID:4716
- C:\Windows\System\WAXFeoN.exe
  C:\Windows\System\WAXFeoN.exe
  2⤵
  PID:4780
- C:\Windows\System\RYrNwax.exe
  C:\Windows\System\RYrNwax.exe
  2⤵
  PID:3876
- C:\Windows\System\cmycLnC.exe
  C:\Windows\System\cmycLnC.exe
  2⤵
  PID:3908
- C:\Windows\System\VJafLgb.exe
  C:\Windows\System\VJafLgb.exe
  2⤵
  PID:5124
- C:\Windows\System\wqMqkSf.exe
  C:\Windows\System\wqMqkSf.exe
  2⤵
  PID:5140
- C:\Windows\System\IVgsJJZ.exe
  C:\Windows\System\IVgsJJZ.exe
  2⤵
  PID:5160
- C:\Windows\System\VbrtQLI.exe
  C:\Windows\System\VbrtQLI.exe
  2⤵
  PID:5176
- C:\Windows\System\tvibBzN.exe
  C:\Windows\System\tvibBzN.exe
  2⤵
  PID:5192
- C:\Windows\System\DFsHRPg.exe
  C:\Windows\System\DFsHRPg.exe
  2⤵
  PID:5208
- C:\Windows\System\hZVQsIF.exe
  C:\Windows\System\hZVQsIF.exe
  2⤵
  PID:5224
- C:\Windows\System\LAlNTjH.exe
  C:\Windows\System\LAlNTjH.exe
  2⤵
  PID:5240
- C:\Windows\System\UzcHYKJ.exe
  C:\Windows\System\UzcHYKJ.exe
  2⤵
  PID:5256
- C:\Windows\System\rCFfNHc.exe
  C:\Windows\System\rCFfNHc.exe
  2⤵
  PID:5272
- C:\Windows\System\TmVptkY.exe
  C:\Windows\System\TmVptkY.exe
  2⤵
  PID:5288
- C:\Windows\System\HAhsoYA.exe
  C:\Windows\System\HAhsoYA.exe
  2⤵
  PID:5304
- C:\Windows\System\BptUpNL.exe
  C:\Windows\System\BptUpNL.exe
  2⤵
  PID:5320
- C:\Windows\System\jgjBlwf.exe
  C:\Windows\System\jgjBlwf.exe
  2⤵
  PID:5336
- C:\Windows\System\Umoxler.exe
  C:\Windows\System\Umoxler.exe
  2⤵
  PID:5352
- C:\Windows\System\FFtLjXd.exe
  C:\Windows\System\FFtLjXd.exe
  2⤵
  PID:5368
- C:\Windows\System\vLHxlOT.exe
  C:\Windows\System\vLHxlOT.exe
  2⤵
  PID:5384
- C:\Windows\System\UyWsMFD.exe
  C:\Windows\System\UyWsMFD.exe
  2⤵
  PID:5404
- C:\Windows\System\bWlwglz.exe
  C:\Windows\System\bWlwglz.exe
  2⤵
  PID:5420
- C:\Windows\System\ZfxJxLv.exe
  C:\Windows\System\ZfxJxLv.exe
  2⤵
  PID:5436
- C:\Windows\System\QwQeORG.exe
  C:\Windows\System\QwQeORG.exe
  2⤵
  PID:5452
- C:\Windows\System\NAVmXYV.exe
  C:\Windows\System\NAVmXYV.exe
  2⤵
  PID:5468
- C:\Windows\System\RtSHzBf.exe
  C:\Windows\System\RtSHzBf.exe
  2⤵
  PID:5484
- C:\Windows\System\vWugZfq.exe
  C:\Windows\System\vWugZfq.exe
  2⤵
  PID:5500
- C:\Windows\System\hFBvlcv.exe
  C:\Windows\System\hFBvlcv.exe
  2⤵
  PID:5520
- C:\Windows\System\FrlscVl.exe
  C:\Windows\System\FrlscVl.exe
  2⤵
  PID:5536
- C:\Windows\System\XzpXgvN.exe
  C:\Windows\System\XzpXgvN.exe
  2⤵
  PID:5552
- C:\Windows\System\SRYMHPp.exe
  C:\Windows\System\SRYMHPp.exe
  2⤵
  PID:5568
- C:\Windows\System\ueKqrTQ.exe
  C:\Windows\System\ueKqrTQ.exe
  2⤵
  PID:5584
- C:\Windows\System\nKKLpdk.exe
  C:\Windows\System\nKKLpdk.exe
  2⤵
  PID:5604
- C:\Windows\System\lYhAVof.exe
  C:\Windows\System\lYhAVof.exe
  2⤵
  PID:5620
- C:\Windows\System\CCCDVxG.exe
  C:\Windows\System\CCCDVxG.exe
  2⤵
  PID:5636
- C:\Windows\System\aUDHFms.exe
  C:\Windows\System\aUDHFms.exe
  2⤵
  PID:5652
- C:\Windows\System\jlRiCoR.exe
  C:\Windows\System\jlRiCoR.exe
  2⤵
  PID:5668
- C:\Windows\System\AJUrIMD.exe
  C:\Windows\System\AJUrIMD.exe
  2⤵
  PID:5684
- C:\Windows\System\JmpxBgt.exe
  C:\Windows\System\JmpxBgt.exe
  2⤵
  PID:5704
- C:\Windows\System\mzQmMaV.exe
  C:\Windows\System\mzQmMaV.exe
  2⤵
  PID:5720
- C:\Windows\System\MjSgbkg.exe
  C:\Windows\System\MjSgbkg.exe
  2⤵
  PID:5736
- C:\Windows\System\ckGmTfo.exe
  C:\Windows\System\ckGmTfo.exe
  2⤵
  PID:5752
- C:\Windows\System\DlkVJec.exe
  C:\Windows\System\DlkVJec.exe
  2⤵
  PID:5768
- C:\Windows\System\aVKCGLb.exe
  C:\Windows\System\aVKCGLb.exe
  2⤵
  PID:5784
- C:\Windows\System\VRzVYoB.exe
  C:\Windows\System\VRzVYoB.exe
  2⤵
  PID:5800
- C:\Windows\System\pZKSged.exe
  C:\Windows\System\pZKSged.exe
  2⤵
  PID:5816
- C:\Windows\System\pIadrQt.exe
  C:\Windows\System\pIadrQt.exe
  2⤵
  PID:5832
- C:\Windows\System\vRXHLsW.exe
  C:\Windows\System\vRXHLsW.exe
  2⤵
  PID:5848
- C:\Windows\System\BMPKsoB.exe
  C:\Windows\System\BMPKsoB.exe
  2⤵
  PID:5868
- C:\Windows\System\RBLMRyw.exe
  C:\Windows\System\RBLMRyw.exe
  2⤵
  PID:5884
- C:\Windows\System\GsfYwar.exe
  C:\Windows\System\GsfYwar.exe
  2⤵
  PID:5900
- C:\Windows\System\iqruHfj.exe
  C:\Windows\System\iqruHfj.exe
  2⤵
  PID:5916
- C:\Windows\System\HFXKBMK.exe
  C:\Windows\System\HFXKBMK.exe
  2⤵
  PID:5936
- C:\Windows\System\fAojish.exe
  C:\Windows\System\fAojish.exe
  2⤵
  PID:5952
- C:\Windows\System\dhQuaef.exe
  C:\Windows\System\dhQuaef.exe
  2⤵
  PID:5968
- C:\Windows\System\RsdAcWm.exe
  C:\Windows\System\RsdAcWm.exe
  2⤵
  PID:5984
- C:\Windows\System\GfKkxUg.exe
  C:\Windows\System\GfKkxUg.exe
  2⤵
  PID:6000
- C:\Windows\System\ESUHFbR.exe
  C:\Windows\System\ESUHFbR.exe
  2⤵
  PID:6016
- C:\Windows\System\iMmfoph.exe
  C:\Windows\System\iMmfoph.exe
  2⤵
  PID:6032
- C:\Windows\System\zgDUGdK.exe
  C:\Windows\System\zgDUGdK.exe
  2⤵
  PID:6048
- C:\Windows\System\byFYtTB.exe
  C:\Windows\System\byFYtTB.exe
  2⤵
  PID:6068
- C:\Windows\System\ufdIfkf.exe
  C:\Windows\System\ufdIfkf.exe
  2⤵
  PID:6084
- C:\Windows\System\acItPtL.exe
  C:\Windows\System\acItPtL.exe
  2⤵
  PID:6100
- C:\Windows\System\sVYLtLI.exe
  C:\Windows\System\sVYLtLI.exe
  2⤵
  PID:6120
- C:\Windows\System\bNobpPi.exe
  C:\Windows\System\bNobpPi.exe
  2⤵
  PID:6136
- C:\Windows\System\tdDzzpu.exe
  C:\Windows\System\tdDzzpu.exe
  2⤵
  PID:4640
- C:\Windows\System\lLNBOaK.exe
  C:\Windows\System\lLNBOaK.exe
  2⤵
  PID:4644
- C:\Windows\System\PZrBlXF.exe
  C:\Windows\System\PZrBlXF.exe
  2⤵
  PID:5184
- C:\Windows\System\HjPqAZy.exe
  C:\Windows\System\HjPqAZy.exe
  2⤵
  PID:4800
- C:\Windows\System\CopZcfg.exe
  C:\Windows\System\CopZcfg.exe
  2⤵
  PID:4232
- C:\Windows\System\smFewpS.exe
  C:\Windows\System\smFewpS.exe
  2⤵
  PID:4244
- C:\Windows\System\sRZIyHs.exe
  C:\Windows\System\sRZIyHs.exe
  2⤵
  PID:4860
- C:\Windows\System\fDORnEw.exe
  C:\Windows\System\fDORnEw.exe
  2⤵
  PID:5200
- C:\Windows\System\tNRDPoi.exe
  C:\Windows\System\tNRDPoi.exe
  2⤵
  PID:5316
- C:\Windows\System\WzgiFCN.exe
  C:\Windows\System\WzgiFCN.exe
  2⤵
  PID:5300
- C:\Windows\System\gtSarZJ.exe
  C:\Windows\System\gtSarZJ.exe
  2⤵
  PID:5380
- C:\Windows\System\jkqYtxK.exe
  C:\Windows\System\jkqYtxK.exe
  2⤵
  PID:5400
- C:\Windows\System\sVeauxg.exe
  C:\Windows\System\sVeauxg.exe
  2⤵
  PID:5396
- C:\Windows\System\VKZdSSG.exe
  C:\Windows\System\VKZdSSG.exe
  2⤵
  PID:5416
- C:\Windows\System\wMJLUFf.exe
  C:\Windows\System\wMJLUFf.exe
  2⤵
  PID:5592
- C:\Windows\System\obFnXhA.exe
  C:\Windows\System\obFnXhA.exe
  2⤵
  PID:5600
- C:\Windows\System\bQlRlCK.exe
  C:\Windows\System\bQlRlCK.exe
  2⤵
  PID:5508
- C:\Windows\System\BiGWhWh.exe
  C:\Windows\System\BiGWhWh.exe
  2⤵
  PID:5632
- C:\Windows\System\SubkNcK.exe
  C:\Windows\System\SubkNcK.exe
  2⤵
  PID:5612
- C:\Windows\System\mAepZMp.exe
  C:\Windows\System\mAepZMp.exe
  2⤵
  PID:5676
- C:\Windows\System\uKpjOpP.exe
  C:\Windows\System\uKpjOpP.exe
  2⤵
  PID:5712
- C:\Windows\System\VHjlSeJ.exe
  C:\Windows\System\VHjlSeJ.exe
  2⤵
  PID:5692
- C:\Windows\System\gQrHPAf.exe
  C:\Windows\System\gQrHPAf.exe
  2⤵
  PID:5792
- C:\Windows\System\FBKkLJt.exe
  C:\Windows\System\FBKkLJt.exe
  2⤵
  PID:5780
- C:\Windows\System\ztNLyZH.exe
  C:\Windows\System\ztNLyZH.exe
  2⤵
  PID:5812
- C:\Windows\System\qNWxAnf.exe
  C:\Windows\System\qNWxAnf.exe
  2⤵
  PID:5908
- C:\Windows\System\TEWUbUg.exe
  C:\Windows\System\TEWUbUg.exe
  2⤵
  PID:5976
- C:\Windows\System\hSorSwj.exe
  C:\Windows\System\hSorSwj.exe
  2⤵
  PID:6040
- C:\Windows\System\IGPyfZx.exe
  C:\Windows\System\IGPyfZx.exe
  2⤵
  PID:6080
- C:\Windows\System\hCLHxiq.exe
  C:\Windows\System\hCLHxiq.exe
  2⤵
  PID:5896
- C:\Windows\System\fBHSUrw.exe
  C:\Windows\System\fBHSUrw.exe
  2⤵
  PID:5960
- C:\Windows\System\dRUuiub.exe
  C:\Windows\System\dRUuiub.exe
  2⤵
  PID:5856
- C:\Windows\System\ktQtkcc.exe
  C:\Windows\System\ktQtkcc.exe
  2⤵
  PID:5252
- C:\Windows\System\MpHmTER.exe
  C:\Windows\System\MpHmTER.exe
  2⤵
  PID:5344
- C:\Windows\System\vooseWG.exe
  C:\Windows\System\vooseWG.exe
  2⤵
  PID:6064
- C:\Windows\System\BUsOyVB.exe
  C:\Windows\System\BUsOyVB.exe
  2⤵
  PID:6056
- C:\Windows\System\mZhjMtj.exe
  C:\Windows\System\mZhjMtj.exe
  2⤵
  PID:5312
- C:\Windows\System\dVihQXv.exe
  C:\Windows\System\dVihQXv.exe
  2⤵
  PID:5644
- C:\Windows\System\vYxJPHL.exe
  C:\Windows\System\vYxJPHL.exe
  2⤵
  PID:5476
- C:\Windows\System\WpYdoPD.exe
  C:\Windows\System\WpYdoPD.exe
  2⤵
  PID:5580
- C:\Windows\System\hvLWImn.exe
  C:\Windows\System\hvLWImn.exe
  2⤵
  PID:5576
- C:\Windows\System\yBbtfDa.exe
  C:\Windows\System\yBbtfDa.exe
  2⤵
  PID:5944
- C:\Windows\System\fRFDahd.exe
  C:\Windows\System\fRFDahd.exe
  2⤵
  PID:6076
- C:\Windows\System\bGnEiKO.exe
  C:\Windows\System\bGnEiKO.exe
  2⤵
  PID:5728
- C:\Windows\System\ErthrGA.exe
  C:\Windows\System\ErthrGA.exe
  2⤵
  PID:5928
- C:\Windows\System\LsHsDhJ.exe
  C:\Windows\System\LsHsDhJ.exe
  2⤵
  PID:5864
- C:\Windows\System\VNDajqc.exe
  C:\Windows\System\VNDajqc.exe
  2⤵
  PID:6112
- C:\Windows\System\bJuFERY.exe
  C:\Windows\System\bJuFERY.exe
  2⤵
  PID:5216
- C:\Windows\System\qYuTpLf.exe
  C:\Windows\System\qYuTpLf.exe
  2⤵
  PID:6060
- C:\Windows\System\zkKBsiT.exe
  C:\Windows\System\zkKBsiT.exe
  2⤵
  PID:5444
- C:\Windows\System\XqmTjmu.exe
  C:\Windows\System\XqmTjmu.exe
  2⤵
  PID:3804
- C:\Windows\System\oDXareJ.exe
  C:\Windows\System\oDXareJ.exe
  2⤵
  PID:5136
- C:\Windows\System\SaEKUTK.exe
  C:\Windows\System\SaEKUTK.exe
  2⤵
  PID:5268
- C:\Windows\System\LuxNqDE.exe
  C:\Windows\System\LuxNqDE.exe
  2⤵
  PID:5748
- C:\Windows\System\zkevIiH.exe
  C:\Windows\System\zkevIiH.exe
  2⤵
  PID:5628
- C:\Windows\System\xwOFFfg.exe
  C:\Windows\System\xwOFFfg.exe
  2⤵
  PID:5548
- C:\Windows\System\SUtQCbK.exe
  C:\Windows\System\SUtQCbK.exe
  2⤵
  PID:5880
- C:\Windows\System\EsuogLv.exe
  C:\Windows\System\EsuogLv.exe
  2⤵
  PID:5892
- C:\Windows\System\NkmiRQS.exe
  C:\Windows\System\NkmiRQS.exe
  2⤵
  PID:5156
- C:\Windows\System\UImdCaX.exe
  C:\Windows\System\UImdCaX.exe
  2⤵
  PID:5660
- C:\Windows\System\lJmBRiW.exe
  C:\Windows\System\lJmBRiW.exe
  2⤵
  PID:5544
- C:\Windows\System\lItZfiB.exe
  C:\Windows\System\lItZfiB.exe
  2⤵
  PID:6028
- C:\Windows\System\FNMTGFl.exe
  C:\Windows\System\FNMTGFl.exe
  2⤵
  PID:5152
- C:\Windows\System\mXvHAQO.exe
  C:\Windows\System\mXvHAQO.exe
  2⤵
  PID:4272
- C:\Windows\System\qfmufiq.exe
  C:\Windows\System\qfmufiq.exe
  2⤵
  PID:5464
- C:\Windows\System\oiwSzNk.exe
  C:\Windows\System\oiwSzNk.exe
  2⤵
  PID:5376
- C:\Windows\System\WZqNlsP.exe
  C:\Windows\System\WZqNlsP.exe
  2⤵
  PID:5844
- C:\Windows\System\BbiNEte.exe
  C:\Windows\System\BbiNEte.exe
  2⤵
  PID:5824
- C:\Windows\System\sxFhkBo.exe
  C:\Windows\System\sxFhkBo.exe
  2⤵
  PID:5432
- C:\Windows\System\vOspTFg.exe
  C:\Windows\System\vOspTFg.exe
  2⤵
  PID:6160
- C:\Windows\System\utMxUkx.exe
  C:\Windows\System\utMxUkx.exe
  2⤵
  PID:6176
- C:\Windows\System\kFrFzAP.exe
  C:\Windows\System\kFrFzAP.exe
  2⤵
  PID:6192
- C:\Windows\System\XGTQKCs.exe
  C:\Windows\System\XGTQKCs.exe
  2⤵
  PID:6208
- C:\Windows\System\pYIKsOU.exe
  C:\Windows\System\pYIKsOU.exe
  2⤵
  PID:6228
- C:\Windows\System\pwrbZup.exe
  C:\Windows\System\pwrbZup.exe
  2⤵
  PID:6248
- C:\Windows\System\hgQVKvO.exe
  C:\Windows\System\hgQVKvO.exe
  2⤵
  PID:6264
- C:\Windows\System\QSKXjeN.exe
  C:\Windows\System\QSKXjeN.exe
  2⤵
  PID:6280
- C:\Windows\System\bjLpkKc.exe
  C:\Windows\System\bjLpkKc.exe
  2⤵
  PID:6296
- C:\Windows\System\RhJdBaW.exe
  C:\Windows\System\RhJdBaW.exe
  2⤵
  PID:6316
- C:\Windows\System\OKunfAl.exe
  C:\Windows\System\OKunfAl.exe
  2⤵
  PID:6332
- C:\Windows\System\bvseRRy.exe
  C:\Windows\System\bvseRRy.exe
  2⤵
  PID:6348
- C:\Windows\System\cmHFsnc.exe
  C:\Windows\System\cmHFsnc.exe
  2⤵
  PID:6364
- C:\Windows\System\OxJglZo.exe
  C:\Windows\System\OxJglZo.exe
  2⤵
  PID:6384
- C:\Windows\System\ifuCncd.exe
  C:\Windows\System\ifuCncd.exe
  2⤵
  PID:6400
- C:\Windows\System\phRixCJ.exe
  C:\Windows\System\phRixCJ.exe
  2⤵
  PID:6416
- C:\Windows\System\rNDGmAy.exe
  C:\Windows\System\rNDGmAy.exe
  2⤵
  PID:6432
- C:\Windows\System\sPCkNBe.exe
  C:\Windows\System\sPCkNBe.exe
  2⤵
  PID:6448
- C:\Windows\System\HPFEyle.exe
  C:\Windows\System\HPFEyle.exe
  2⤵
  PID:6468
- C:\Windows\System\CKDZZMu.exe
  C:\Windows\System\CKDZZMu.exe
  2⤵
  PID:6488
- C:\Windows\System\TWKuovW.exe
  C:\Windows\System\TWKuovW.exe
  2⤵
  PID:6504
- C:\Windows\System\larGpea.exe
  C:\Windows\System\larGpea.exe
  2⤵
  PID:6520
- C:\Windows\System\kbYmdPU.exe
  C:\Windows\System\kbYmdPU.exe
  2⤵
  PID:6536
- C:\Windows\System\dMShXrv.exe
  C:\Windows\System\dMShXrv.exe
  2⤵
  PID:6556
- C:\Windows\System\RcRsXza.exe
  C:\Windows\System\RcRsXza.exe
  2⤵
  PID:6572
- C:\Windows\System\TawCiYn.exe
  C:\Windows\System\TawCiYn.exe
  2⤵
  PID:6588
- C:\Windows\System\hNwDbDN.exe
  C:\Windows\System\hNwDbDN.exe
  2⤵
  PID:6604
- C:\Windows\System\IkNjjTZ.exe
  C:\Windows\System\IkNjjTZ.exe
  2⤵
  PID:6620
- C:\Windows\System\NrYFqcO.exe
  C:\Windows\System\NrYFqcO.exe
  2⤵
  PID:6640
- C:\Windows\System\BViHmcw.exe
  C:\Windows\System\BViHmcw.exe
  2⤵
  PID:6656
- C:\Windows\System\OdIlnrW.exe
  C:\Windows\System\OdIlnrW.exe
  2⤵
  PID:6672
- C:\Windows\System\HEmjsys.exe
  C:\Windows\System\HEmjsys.exe
  2⤵
  PID:6692
- C:\Windows\System\HKQvzJF.exe
  C:\Windows\System\HKQvzJF.exe
  2⤵
  PID:6708
- C:\Windows\System\DwGEXQP.exe
  C:\Windows\System\DwGEXQP.exe
  2⤵
  PID:6724
- C:\Windows\System\OssAksP.exe
  C:\Windows\System\OssAksP.exe
  2⤵
  PID:6740
- C:\Windows\System\wSuYFwj.exe
  C:\Windows\System\wSuYFwj.exe
  2⤵
  PID:6764
- C:\Windows\System\IkCtbaX.exe
  C:\Windows\System\IkCtbaX.exe
  2⤵
  PID:6780
- C:\Windows\System\QGToCeH.exe
  C:\Windows\System\QGToCeH.exe
  2⤵
  PID:6796
- C:\Windows\System\jyerCJt.exe
  C:\Windows\System\jyerCJt.exe
  2⤵
  PID:6812
- C:\Windows\System\KQbYjcU.exe
  C:\Windows\System\KQbYjcU.exe
  2⤵
  PID:6832
- C:\Windows\System\yQTsqda.exe
  C:\Windows\System\yQTsqda.exe
  2⤵
  PID:6848
- C:\Windows\System\TAXMsZo.exe
  C:\Windows\System\TAXMsZo.exe
  2⤵
  PID:6868
- C:\Windows\System\tnsJmfD.exe
  C:\Windows\System\tnsJmfD.exe
  2⤵
  PID:6884
- C:\Windows\System\ADIfhEn.exe
  C:\Windows\System\ADIfhEn.exe
  2⤵
  PID:6900
- C:\Windows\System\sbpOWzE.exe
  C:\Windows\System\sbpOWzE.exe
  2⤵
  PID:6916
- C:\Windows\System\xNvzGwJ.exe
  C:\Windows\System\xNvzGwJ.exe
  2⤵
  PID:6932
- C:\Windows\System\wMHXNYW.exe
  C:\Windows\System\wMHXNYW.exe
  2⤵
  PID:6948
- C:\Windows\System\YmkBsuB.exe
  C:\Windows\System\YmkBsuB.exe
  2⤵
  PID:6964
- C:\Windows\System\rvEBieu.exe
  C:\Windows\System\rvEBieu.exe
  2⤵
  PID:6980
- C:\Windows\System\oKbKova.exe
  C:\Windows\System\oKbKova.exe
  2⤵
  PID:6996
- C:\Windows\System\dKQEAMN.exe
  C:\Windows\System\dKQEAMN.exe
  2⤵
  PID:7012
- C:\Windows\System\GQjjmZr.exe
  C:\Windows\System\GQjjmZr.exe
  2⤵
  PID:7028
- C:\Windows\System\RPOxxKk.exe
  C:\Windows\System\RPOxxKk.exe
  2⤵
  PID:7044
- C:\Windows\System\ciXFACC.exe
  C:\Windows\System\ciXFACC.exe
  2⤵
  PID:7060
- C:\Windows\System\YsgiAua.exe
  C:\Windows\System\YsgiAua.exe
  2⤵
  PID:7076
- C:\Windows\System\vnKiXQM.exe
  C:\Windows\System\vnKiXQM.exe
  2⤵
  PID:7092
- C:\Windows\System\FYTLeDH.exe
  C:\Windows\System\FYTLeDH.exe
  2⤵
  PID:7108
- C:\Windows\System\xkiOJsx.exe
  C:\Windows\System\xkiOJsx.exe
  2⤵
  PID:7124
- C:\Windows\System\GVZliXX.exe
  C:\Windows\System\GVZliXX.exe
  2⤵
  PID:7140
- C:\Windows\System\FyqHhaz.exe
  C:\Windows\System\FyqHhaz.exe
  2⤵
  PID:7156
- C:\Windows\System\HXLnFgF.exe
  C:\Windows\System\HXLnFgF.exe
  2⤵
  PID:6200
- C:\Windows\System\rCsrZfF.exe
  C:\Windows\System\rCsrZfF.exe
  2⤵
  PID:6236
- C:\Windows\System\mCBFKVN.exe
  C:\Windows\System\mCBFKVN.exe
  2⤵
  PID:6216
- C:\Windows\System\xROtdVL.exe
  C:\Windows\System\xROtdVL.exe
  2⤵
  PID:6220
- C:\Windows\System\XfqJRwz.exe
  C:\Windows\System\XfqJRwz.exe
  2⤵
  PID:6288
- C:\Windows\System\HkMCXqA.exe
  C:\Windows\System\HkMCXqA.exe
  2⤵
  PID:6324
- C:\Windows\System\vkiCTvr.exe
  C:\Windows\System\vkiCTvr.exe
  2⤵
  PID:6392
- C:\Windows\System\SjbeEXt.exe
  C:\Windows\System\SjbeEXt.exe
  2⤵
  PID:5744
- C:\Windows\System\DlXyMny.exe
  C:\Windows\System\DlXyMny.exe
  2⤵
  PID:6380
- C:\Windows\System\EzxmFSB.exe
  C:\Windows\System\EzxmFSB.exe
  2⤵
  PID:6444
- C:\Windows\System\gYGaAGM.exe
  C:\Windows\System\gYGaAGM.exe
  2⤵
  PID:6516
- C:\Windows\System\kqbEeXR.exe
  C:\Windows\System\kqbEeXR.exe
  2⤵
  PID:6312
- C:\Windows\System\rindVSO.exe
  C:\Windows\System\rindVSO.exe
  2⤵
  PID:4764
- C:\Windows\System\SRxLjvA.exe
  C:\Windows\System\SRxLjvA.exe
  2⤵
  PID:6824
- C:\Windows\System\hXZEPyW.exe
  C:\Windows\System\hXZEPyW.exe
  2⤵
  PID:6500
- C:\Windows\System\vTlBgLW.exe
  C:\Windows\System\vTlBgLW.exe
  2⤵
  PID:6896
- C:\Windows\System\LMIQFYA.exe
  C:\Windows\System\LMIQFYA.exe
  2⤵
  PID:6428
- C:\Windows\System\OepSPsP.exe
  C:\Windows\System\OepSPsP.exe
  2⤵
  PID:6664
- C:\Windows\System\yOHOeVv.exe
  C:\Windows\System\yOHOeVv.exe
  2⤵
  PID:6876
- C:\Windows\System\OfBFiDd.exe
  C:\Windows\System\OfBFiDd.exe
  2⤵
  PID:6564
- C:\Windows\System\pSRdltv.exe
  C:\Windows\System\pSRdltv.exe
  2⤵
  PID:6700
- C:\Windows\System\DJBYZqY.exe
  C:\Windows\System\DJBYZqY.exe
  2⤵
  PID:6772
- C:\Windows\System\NBXexTu.exe
  C:\Windows\System\NBXexTu.exe
  2⤵
  PID:6956
- C:\Windows\System\qQyBvyG.exe
  C:\Windows\System\qQyBvyG.exe
  2⤵
  PID:7020
- C:\Windows\System\IKGrCAb.exe
  C:\Windows\System\IKGrCAb.exe
  2⤵
  PID:6908
- C:\Windows\System\letOVnp.exe
  C:\Windows\System\letOVnp.exe
  2⤵
  PID:7052
- C:\Windows\System\CLzleca.exe
  C:\Windows\System\CLzleca.exe
  2⤵
  PID:7084
- C:\Windows\System\IVsPwmr.exe
  C:\Windows\System\IVsPwmr.exe
  2⤵
  PID:7100
- C:\Windows\System\OPlanjG.exe
  C:\Windows\System\OPlanjG.exe
  2⤵
  PID:7068
- C:\Windows\System\nSFVhVb.exe
  C:\Windows\System\nSFVhVb.exe
  2⤵
  PID:7120
- C:\Windows\System\dFuKOSw.exe
  C:\Windows\System\dFuKOSw.exe
  2⤵
  PID:6184
- C:\Windows\System\tbZiZgd.exe
  C:\Windows\System\tbZiZgd.exe
  2⤵
  PID:5860
- C:\Windows\System\tUBXbwJ.exe
  C:\Windows\System\tUBXbwJ.exe
  2⤵
  PID:6276
- C:\Windows\System\siLTtNu.exe
  C:\Windows\System\siLTtNu.exe
  2⤵
  PID:6308
- C:\Windows\System\HtPwVGi.exe
  C:\Windows\System\HtPwVGi.exe
  2⤵
  PID:6272
- C:\Windows\System\YNHzuXQ.exe
  C:\Windows\System\YNHzuXQ.exe
  2⤵
  PID:6376
- C:\Windows\System\WrhGphw.exe
  C:\Windows\System\WrhGphw.exe
  2⤵
  PID:6484
- C:\Windows\System\BmgilqO.exe
  C:\Windows\System\BmgilqO.exe
  2⤵
  PID:6148
- C:\Windows\System\PTBorMf.exe
  C:\Windows\System\PTBorMf.exe
  2⤵
  PID:6612
- C:\Windows\System\PGwDIQO.exe
  C:\Windows\System\PGwDIQO.exe
  2⤵
  PID:6684
- C:\Windows\System\JudwEVq.exe
  C:\Windows\System\JudwEVq.exe
  2⤵
  PID:6652
- C:\Windows\System\fsmMUyh.exe
  C:\Windows\System\fsmMUyh.exe
  2⤵
  PID:6720
- C:\Windows\System\DpKNDcq.exe
  C:\Windows\System\DpKNDcq.exe
  2⤵
  PID:6892
- C:\Windows\System\jHWylFD.exe
  C:\Windows\System\jHWylFD.exe
  2⤵
  PID:6108
- C:\Windows\System\ypkdsMK.exe
  C:\Windows\System\ypkdsMK.exe
  2⤵
  PID:6992
- C:\Windows\System\PpTOyQq.exe
  C:\Windows\System\PpTOyQq.exe
  2⤵
  PID:7040
- C:\Windows\System\pmwjvpS.exe
  C:\Windows\System\pmwjvpS.exe
  2⤵
  PID:7116
- C:\Windows\System\YfxZHWH.exe
  C:\Windows\System\YfxZHWH.exe
  2⤵
  PID:6496
- C:\Windows\System\gEcqFQo.exe
  C:\Windows\System\gEcqFQo.exe
  2⤵
  PID:6844
- C:\Windows\System\paXPYZI.exe
  C:\Windows\System\paXPYZI.exe
  2⤵
  PID:6972
- C:\Windows\System\wkczhHh.exe
  C:\Windows\System\wkczhHh.exe
  2⤵
  PID:6172
- C:\Windows\System\tJkrpuK.exe
  C:\Windows\System\tJkrpuK.exe
  2⤵
  PID:6440
- C:\Windows\System\hBRTsoT.exe
  C:\Windows\System\hBRTsoT.exe
  2⤵
  PID:6360
- C:\Windows\System\JbNASoC.exe
  C:\Windows\System\JbNASoC.exe
  2⤵
  PID:5996
- C:\Windows\System\mABxGDi.exe
  C:\Windows\System\mABxGDi.exe
  2⤵
  PID:6460
- C:\Windows\System\vAcHeqp.exe
  C:\Windows\System\vAcHeqp.exe
  2⤵
  PID:6788
- C:\Windows\System\VMapTJO.exe
  C:\Windows\System\VMapTJO.exe
  2⤵
  PID:1664
- C:\Windows\System\gbriLSe.exe
  C:\Windows\System\gbriLSe.exe
  2⤵
  PID:6736
- C:\Windows\System\QTyejPY.exe
  C:\Windows\System\QTyejPY.exe
  2⤵
  PID:6860
- C:\Windows\System\gSDWrsn.exe
  C:\Windows\System\gSDWrsn.exe
  2⤵
  PID:7176
- C:\Windows\System\PJgqUua.exe
  C:\Windows\System\PJgqUua.exe
  2⤵
  PID:7192
- C:\Windows\System\BRLhkAS.exe
  C:\Windows\System\BRLhkAS.exe
  2⤵
  PID:7208
- C:\Windows\System\bfAVbNk.exe
  C:\Windows\System\bfAVbNk.exe
  2⤵
  PID:7224
- C:\Windows\System\xxdBilQ.exe
  C:\Windows\System\xxdBilQ.exe
  2⤵
  PID:7240
- C:\Windows\System\FjuXsBf.exe
  C:\Windows\System\FjuXsBf.exe
  2⤵
  PID:7256
- C:\Windows\System\ZsUioZu.exe
  C:\Windows\System\ZsUioZu.exe
  2⤵
  PID:7272
- C:\Windows\System\yPVstCi.exe
  C:\Windows\System\yPVstCi.exe
  2⤵
  PID:7288
- C:\Windows\System\NPrgXRf.exe
  C:\Windows\System\NPrgXRf.exe
  2⤵
  PID:7304
- C:\Windows\System\IECXaKp.exe
  C:\Windows\System\IECXaKp.exe
  2⤵
  PID:7320
- C:\Windows\System\EKzmngZ.exe
  C:\Windows\System\EKzmngZ.exe
  2⤵
  PID:7336
- C:\Windows\System\mgjhSwW.exe
  C:\Windows\System\mgjhSwW.exe
  2⤵
  PID:7352
- C:\Windows\System\mZhGxrb.exe
  C:\Windows\System\mZhGxrb.exe
  2⤵
  PID:7368
- C:\Windows\System\EPqROUS.exe
  C:\Windows\System\EPqROUS.exe
  2⤵
  PID:7384
- C:\Windows\System\HbimNxB.exe
  C:\Windows\System\HbimNxB.exe
  2⤵
  PID:7400
- C:\Windows\System\hyLWfaQ.exe
  C:\Windows\System\hyLWfaQ.exe
  2⤵
  PID:7416
- C:\Windows\System\GhwwzOn.exe
  C:\Windows\System\GhwwzOn.exe
  2⤵
  PID:7432
- C:\Windows\System\sBhMFDN.exe
  C:\Windows\System\sBhMFDN.exe
  2⤵
  PID:7448
- C:\Windows\System\GAGNGRX.exe
  C:\Windows\System\GAGNGRX.exe
  2⤵
  PID:7464
- C:\Windows\System\pgNbuvD.exe
  C:\Windows\System\pgNbuvD.exe
  2⤵
  PID:7480
- C:\Windows\System\dsoqOvG.exe
  C:\Windows\System\dsoqOvG.exe
  2⤵
  PID:7496
- C:\Windows\System\YphuGtr.exe
  C:\Windows\System\YphuGtr.exe
  2⤵
  PID:7512
- C:\Windows\System\sSzixmS.exe
  C:\Windows\System\sSzixmS.exe
  2⤵
  PID:7528
- C:\Windows\System\JHbyCSs.exe
  C:\Windows\System\JHbyCSs.exe
  2⤵
  PID:7544
- C:\Windows\System\LztQfJM.exe
  C:\Windows\System\LztQfJM.exe
  2⤵
  PID:7560
- C:\Windows\System\VFhCLYJ.exe
  C:\Windows\System\VFhCLYJ.exe
  2⤵
  PID:7576
- C:\Windows\System\VhVshvk.exe
  C:\Windows\System\VhVshvk.exe
  2⤵
  PID:7592
- C:\Windows\System\lLeNacX.exe
  C:\Windows\System\lLeNacX.exe
  2⤵
  PID:7608
- C:\Windows\System\IGQWvCJ.exe
  C:\Windows\System\IGQWvCJ.exe
  2⤵
  PID:7624
- C:\Windows\System\gsjLhJP.exe
  C:\Windows\System\gsjLhJP.exe
  2⤵
  PID:7640
- C:\Windows\System\SWZUhSH.exe
  C:\Windows\System\SWZUhSH.exe
  2⤵
  PID:7656
- C:\Windows\System\bmDzHoD.exe
  C:\Windows\System\bmDzHoD.exe
  2⤵
  PID:7672
- C:\Windows\System\KUfBXpC.exe
  C:\Windows\System\KUfBXpC.exe
  2⤵
  PID:7688
- C:\Windows\System\IKeSvtq.exe
  C:\Windows\System\IKeSvtq.exe
  2⤵
  PID:7704
- C:\Windows\System\yoKzNvG.exe
  C:\Windows\System\yoKzNvG.exe
  2⤵
  PID:7720
- C:\Windows\System\OyCmtTv.exe
  C:\Windows\System\OyCmtTv.exe
  2⤵
  PID:7736
- C:\Windows\System\cufLlgu.exe
  C:\Windows\System\cufLlgu.exe
  2⤵
  PID:7752
- C:\Windows\System\pMiVgkG.exe
  C:\Windows\System\pMiVgkG.exe
  2⤵
  PID:7768
- C:\Windows\System\ckeJsdc.exe
  C:\Windows\System\ckeJsdc.exe
  2⤵
  PID:7784
- C:\Windows\System\GIbTFlM.exe
  C:\Windows\System\GIbTFlM.exe
  2⤵
  PID:7800
- C:\Windows\System\zhoaFpe.exe
  C:\Windows\System\zhoaFpe.exe
  2⤵
  PID:7816
- C:\Windows\System\ycgrakv.exe
  C:\Windows\System\ycgrakv.exe
  2⤵
  PID:7836
- C:\Windows\System\zHJYgNO.exe
  C:\Windows\System\zHJYgNO.exe
  2⤵
  PID:7852
- C:\Windows\System\hjpyuTS.exe
  C:\Windows\System\hjpyuTS.exe
  2⤵
  PID:7868
- C:\Windows\System\AKfXSPS.exe
  C:\Windows\System\AKfXSPS.exe
  2⤵
  PID:7884
- C:\Windows\System\CiFgiMm.exe
  C:\Windows\System\CiFgiMm.exe
  2⤵
  PID:7900
- C:\Windows\System\bCoFFIn.exe
  C:\Windows\System\bCoFFIn.exe
  2⤵
  PID:7916
- C:\Windows\System\iumnAYG.exe
  C:\Windows\System\iumnAYG.exe
  2⤵
  PID:7932
- C:\Windows\System\PBVMQws.exe
  C:\Windows\System\PBVMQws.exe
  2⤵
  PID:7948
- C:\Windows\System\jWXxiNe.exe
  C:\Windows\System\jWXxiNe.exe
  2⤵
  PID:7964
- C:\Windows\System\rxwAKse.exe
  C:\Windows\System\rxwAKse.exe
  2⤵
  PID:7980
- C:\Windows\System\FNuDgxp.exe
  C:\Windows\System\FNuDgxp.exe
  2⤵
  PID:7996
- C:\Windows\System\AMbpxYD.exe
  C:\Windows\System\AMbpxYD.exe
  2⤵
  PID:8012
- C:\Windows\System\XcrGteC.exe
  C:\Windows\System\XcrGteC.exe
  2⤵
  PID:8028
- C:\Windows\System\VHQaVUv.exe
  C:\Windows\System\VHQaVUv.exe
  2⤵
  PID:8044
- C:\Windows\System\GqEmZqG.exe
  C:\Windows\System\GqEmZqG.exe
  2⤵
  PID:8060
- C:\Windows\System\NOIWDKN.exe
  C:\Windows\System\NOIWDKN.exe
  2⤵
  PID:8076
- C:\Windows\System\jQNyqBl.exe
  C:\Windows\System\jQNyqBl.exe
  2⤵
  PID:8092
- C:\Windows\System\sLmGlCd.exe
  C:\Windows\System\sLmGlCd.exe
  2⤵
  PID:8108
- C:\Windows\System\ILXPDhD.exe
  C:\Windows\System\ILXPDhD.exe
  2⤵
  PID:8124
- C:\Windows\System\xkbZcqj.exe
  C:\Windows\System\xkbZcqj.exe
  2⤵
  PID:8140
- C:\Windows\System\UvLRGAq.exe
  C:\Windows\System\UvLRGAq.exe
  2⤵
  PID:8156
- C:\Windows\System\NCwgAYD.exe
  C:\Windows\System\NCwgAYD.exe
  2⤵
  PID:8172
- C:\Windows\System\KdoyTwM.exe
  C:\Windows\System\KdoyTwM.exe
  2⤵
  PID:8188
- C:\Windows\System\kpcaIPc.exe
  C:\Windows\System\kpcaIPc.exe
  2⤵
  PID:6412
- C:\Windows\System\JOfOBQQ.exe
  C:\Windows\System\JOfOBQQ.exe
  2⤵
  PID:6748
- C:\Windows\System\TgQIlgC.exe
  C:\Windows\System\TgQIlgC.exe
  2⤵
  PID:7172
- C:\Windows\System\FvBaAmV.exe
  C:\Windows\System\FvBaAmV.exe
  2⤵
  PID:7236
- C:\Windows\System\CRedLCp.exe
  C:\Windows\System\CRedLCp.exe
  2⤵
  PID:7300
- C:\Windows\System\uqdfkSH.exe
  C:\Windows\System\uqdfkSH.exe
  2⤵
  PID:6532
- C:\Windows\System\TKSLZCN.exe
  C:\Windows\System\TKSLZCN.exe
  2⤵
  PID:7216
- C:\Windows\System\hTdqFjI.exe
  C:\Windows\System\hTdqFjI.exe
  2⤵
  PID:7332
- C:\Windows\System\wVUYSdy.exe
  C:\Windows\System\wVUYSdy.exe
  2⤵
  PID:6356
- C:\Windows\System\PyMLfGE.exe
  C:\Windows\System\PyMLfGE.exe
  2⤵
  PID:7220
- C:\Windows\System\ryjxsDs.exe
  C:\Windows\System\ryjxsDs.exe
  2⤵
  PID:7424
- C:\Windows\System\KcaKAQG.exe
  C:\Windows\System\KcaKAQG.exe
  2⤵
  PID:7456
- C:\Windows\System\EsZzdFE.exe
  C:\Windows\System\EsZzdFE.exe
  2⤵
  PID:7164
- C:\Windows\System\YNWQEaw.exe
  C:\Windows\System\YNWQEaw.exe
  2⤵
  PID:7376
- C:\Windows\System\sANsYCS.exe
  C:\Windows\System\sANsYCS.exe
  2⤵
  PID:7440
- C:\Windows\System\ReNFrzn.exe
  C:\Windows\System\ReNFrzn.exe
  2⤵
  PID:7504
- C:\Windows\System\ICNYgkn.exe
  C:\Windows\System\ICNYgkn.exe
  2⤵
  PID:7552
- C:\Windows\System\GlygMAH.exe
  C:\Windows\System\GlygMAH.exe
  2⤵
  PID:7568
- C:\Windows\System\dluTmzM.exe
  C:\Windows\System\dluTmzM.exe
  2⤵
  PID:7600
- C:\Windows\System\qtYrMXM.exe
  C:\Windows\System\qtYrMXM.exe
  2⤵
  PID:7648
- C:\Windows\System\htBprCq.exe
  C:\Windows\System\htBprCq.exe
  2⤵
  PID:7712
- C:\Windows\System\twajUzY.exe
  C:\Windows\System\twajUzY.exe
  2⤵
  PID:7728
- C:\Windows\System\PwIvVah.exe
  C:\Windows\System\PwIvVah.exe
  2⤵
  PID:7696
- C:\Windows\System\zaoBPXi.exe
  C:\Windows\System\zaoBPXi.exe
  2⤵
  PID:7780
- C:\Windows\System\fatROMI.exe
  C:\Windows\System\fatROMI.exe
  2⤵
  PID:7848
- C:\Windows\System\uUwgUGL.exe
  C:\Windows\System\uUwgUGL.exe
  2⤵
  PID:7732
- C:\Windows\System\iwxkmVS.exe
  C:\Windows\System\iwxkmVS.exe
  2⤵
  PID:7764
- C:\Windows\System\JPQyzoE.exe
  C:\Windows\System\JPQyzoE.exe
  2⤵
  PID:7864
- C:\Windows\System\ypwRbJV.exe
  C:\Windows\System\ypwRbJV.exe
  2⤵
  PID:7944
- C:\Windows\System\GVXDRrE.exe
  C:\Windows\System\GVXDRrE.exe
  2⤵
  PID:7956
- C:\Windows\System\IHTrcoB.exe
  C:\Windows\System\IHTrcoB.exe
  2⤵
  PID:8004
- C:\Windows\System\bvTcGeq.exe
  C:\Windows\System\bvTcGeq.exe
  2⤵
  PID:8036
- C:\Windows\System\sOWDSZy.exe
  C:\Windows\System\sOWDSZy.exe
  2⤵
  PID:8020
- C:\Windows\System\jSmHmuT.exe
  C:\Windows\System\jSmHmuT.exe
  2⤵
  PID:8056
- C:\Windows\System\UtYqbWz.exe
  C:\Windows\System\UtYqbWz.exe
  2⤵
  PID:8088
- C:\Windows\System\BIVkrzG.exe
  C:\Windows\System\BIVkrzG.exe
  2⤵
  PID:8136
- C:\Windows\System\rmLyZXT.exe
  C:\Windows\System\rmLyZXT.exe
  2⤵
  PID:8180
- C:\Windows\System\navLnWS.exe
  C:\Windows\System\navLnWS.exe
  2⤵
  PID:6168
- C:\Windows\System\yGDlRDK.exe
  C:\Windows\System\yGDlRDK.exe
  2⤵
  PID:7296
- C:\Windows\System\llbpldI.exe
  C:\Windows\System\llbpldI.exe
  2⤵
  PID:7204
- C:\Windows\System\uTRFEoq.exe
  C:\Windows\System\uTRFEoq.exe
  2⤵
  PID:7280
- C:\Windows\System\XCRKeGp.exe
  C:\Windows\System\XCRKeGp.exe
  2⤵
  PID:6944
- C:\Windows\System\sfXaroo.exe
  C:\Windows\System\sfXaroo.exe
  2⤵
  PID:6928
- C:\Windows\System\QHPNjwK.exe
  C:\Windows\System\QHPNjwK.exe
  2⤵
  PID:7412
- C:\Windows\System\uTYuglW.exe
  C:\Windows\System\uTYuglW.exe
  2⤵
  PID:7536
- C:\Windows\System\NgomFsl.exe
  C:\Windows\System\NgomFsl.exe
  2⤵
  PID:7348
- C:\Windows\System\ldoPeBl.exe
  C:\Windows\System\ldoPeBl.exe
  2⤵
  PID:7620
- C:\Windows\System\bCyRzZb.exe
  C:\Windows\System\bCyRzZb.exe
  2⤵
  PID:7664
- C:\Windows\System\KBYqnzT.exe
  C:\Windows\System\KBYqnzT.exe
  2⤵
  PID:7684
- C:\Windows\System\mUdeTcv.exe
  C:\Windows\System\mUdeTcv.exe
  2⤵
  PID:7812
- C:\Windows\System\RIsFeBZ.exe
  C:\Windows\System\RIsFeBZ.exe
  2⤵
  PID:7860
- C:\Windows\System\XpWEbEs.exe
  C:\Windows\System\XpWEbEs.exe
  2⤵
  PID:8068
- C:\Windows\System\WVfmOov.exe
  C:\Windows\System\WVfmOov.exe
  2⤵
  PID:8084
- C:\Windows\System\OXalCVa.exe
  C:\Windows\System\OXalCVa.exe
  2⤵
  PID:7880
- C:\Windows\System\HNXyxOe.exe
  C:\Windows\System\HNXyxOe.exe
  2⤵
  PID:8116
- C:\Windows\System\ojlenmK.exe
  C:\Windows\System\ojlenmK.exe
  2⤵
  PID:8052
- C:\Windows\System\tCQPuPn.exe
  C:\Windows\System\tCQPuPn.exe
  2⤵
  PID:7268
- C:\Windows\System\ujGPKAH.exe
  C:\Windows\System\ujGPKAH.exe
  2⤵
  PID:7344
- C:\Windows\System\HtUfpNq.exe
  C:\Windows\System\HtUfpNq.exe
  2⤵
  PID:7928
- C:\Windows\System\cHcHTOE.exe
  C:\Windows\System\cHcHTOE.exe
  2⤵
  PID:7828
- C:\Windows\System\wRMBhsw.exe
  C:\Windows\System\wRMBhsw.exe
  2⤵
  PID:7972
- C:\Windows\System\zizZTNp.exe
  C:\Windows\System\zizZTNp.exe
  2⤵
  PID:7312
- C:\Windows\System\UBvcQSf.exe
  C:\Windows\System\UBvcQSf.exe
  2⤵
  PID:7136
- C:\Windows\System\QeKJoOi.exe
  C:\Windows\System\QeKJoOi.exe
  2⤵
  PID:6840
- C:\Windows\System\LGRxCcI.exe
  C:\Windows\System\LGRxCcI.exe
  2⤵
  PID:7760
- C:\Windows\System\xFMBRoL.exe
  C:\Windows\System\xFMBRoL.exe
  2⤵
  PID:7632
- C:\Windows\System\QrJOvlM.exe
  C:\Windows\System\QrJOvlM.exe
  2⤵
  PID:7748
- C:\Windows\System\YnJQfWn.exe
  C:\Windows\System\YnJQfWn.exe
  2⤵
  PID:6804
- C:\Windows\System\UWtfmKi.exe
  C:\Windows\System\UWtfmKi.exe
  2⤵
  PID:6372
- C:\Windows\System\ijtatEq.exe
  C:\Windows\System\ijtatEq.exe
  2⤵
  PID:7556
- C:\Windows\System\TlCKeyL.exe
  C:\Windows\System\TlCKeyL.exe
  2⤵
  PID:7492
- C:\Windows\System\viMsmpF.exe
  C:\Windows\System\viMsmpF.exe
  2⤵
  PID:8204
- C:\Windows\System\aUGiLmf.exe
  C:\Windows\System\aUGiLmf.exe
  2⤵
  PID:8220
- C:\Windows\System\jxAwqVf.exe
  C:\Windows\System\jxAwqVf.exe
  2⤵
  PID:8236
- C:\Windows\System\uRipKDG.exe
  C:\Windows\System\uRipKDG.exe
  2⤵
  PID:8252
- C:\Windows\System\wNzIVTe.exe
  C:\Windows\System\wNzIVTe.exe
  2⤵
  PID:8268
- C:\Windows\System\OrUWUSq.exe
  C:\Windows\System\OrUWUSq.exe
  2⤵
  PID:8284
- C:\Windows\System\DpxvcoY.exe
  C:\Windows\System\DpxvcoY.exe
  2⤵
  PID:8300
- C:\Windows\System\upSnPqW.exe
  C:\Windows\System\upSnPqW.exe
  2⤵
  PID:8316
- C:\Windows\System\VxrFhPb.exe
  C:\Windows\System\VxrFhPb.exe
  2⤵
  PID:8332
- C:\Windows\System\lWqDiAR.exe
  C:\Windows\System\lWqDiAR.exe
  2⤵
  PID:8348
- C:\Windows\System\RFMOyTe.exe
  C:\Windows\System\RFMOyTe.exe
  2⤵
  PID:8468
- C:\Windows\System\bxuEHaM.exe
  C:\Windows\System\bxuEHaM.exe
  2⤵
  PID:8492
- C:\Windows\System\VXmhZFp.exe
  C:\Windows\System\VXmhZFp.exe
  2⤵
  PID:8508
- C:\Windows\System\letFwjq.exe
  C:\Windows\System\letFwjq.exe
  2⤵
  PID:8524
- C:\Windows\System\luEBcmj.exe
  C:\Windows\System\luEBcmj.exe
  2⤵
  PID:8540
- C:\Windows\System\DiWShJh.exe
  C:\Windows\System\DiWShJh.exe
  2⤵
  PID:8560
- C:\Windows\System\kMlwuqH.exe
  C:\Windows\System\kMlwuqH.exe
  2⤵
  PID:8576
- C:\Windows\System\CvxTpTL.exe
  C:\Windows\System\CvxTpTL.exe
  2⤵
  PID:8592
- C:\Windows\System\sfAfset.exe
  C:\Windows\System\sfAfset.exe
  2⤵
  PID:8608
- C:\Windows\System\zSMXRoK.exe
  C:\Windows\System\zSMXRoK.exe
  2⤵
  PID:8624
- C:\Windows\System\rnLZjOR.exe
  C:\Windows\System\rnLZjOR.exe
  2⤵
  PID:8644
- C:\Windows\System\CVuZCzZ.exe
  C:\Windows\System\CVuZCzZ.exe
  2⤵
  PID:8660
- C:\Windows\System\IpoXpSs.exe
  C:\Windows\System\IpoXpSs.exe
  2⤵
  PID:8676
- C:\Windows\System\rosgmVI.exe
  C:\Windows\System\rosgmVI.exe
  2⤵
  PID:8696
- C:\Windows\System\yvjJKwL.exe
  C:\Windows\System\yvjJKwL.exe
  2⤵
  PID:8716
- C:\Windows\System\xitAPOd.exe
  C:\Windows\System\xitAPOd.exe
  2⤵
  PID:8732
- C:\Windows\System\UOEnESg.exe
  C:\Windows\System\UOEnESg.exe
  2⤵
  PID:8748
- C:\Windows\System\ppxgtxy.exe
  C:\Windows\System\ppxgtxy.exe
  2⤵
  PID:8764
- C:\Windows\System\pGCTsqW.exe
  C:\Windows\System\pGCTsqW.exe
  2⤵
  PID:8780
- C:\Windows\System\wHtHBEQ.exe
  C:\Windows\System\wHtHBEQ.exe
  2⤵
  PID:8796
- C:\Windows\System\JeJEnQX.exe
  C:\Windows\System\JeJEnQX.exe
  2⤵
  PID:8816
- C:\Windows\System\olSKSjE.exe
  C:\Windows\System\olSKSjE.exe
  2⤵
  PID:8832
- C:\Windows\System\vdWDfVe.exe
  C:\Windows\System\vdWDfVe.exe
  2⤵
  PID:8852
- C:\Windows\System\UQSTmAo.exe
  C:\Windows\System\UQSTmAo.exe
  2⤵
  PID:8868
- C:\Windows\System\FZEKJic.exe
  C:\Windows\System\FZEKJic.exe
  2⤵
  PID:8884
- C:\Windows\System\ExBTYYp.exe
  C:\Windows\System\ExBTYYp.exe
  2⤵
  PID:8900
- C:\Windows\System\wwUWsce.exe
  C:\Windows\System\wwUWsce.exe
  2⤵
  PID:8916
- C:\Windows\System\FJYNtpm.exe
  C:\Windows\System\FJYNtpm.exe
  2⤵
  PID:8932
- C:\Windows\System\UGYhJpf.exe
  C:\Windows\System\UGYhJpf.exe
  2⤵
  PID:8948
- C:\Windows\System\ncGkCcw.exe
  C:\Windows\System\ncGkCcw.exe
  2⤵
  PID:8964
- C:\Windows\System\QMyKDer.exe
  C:\Windows\System\QMyKDer.exe
  2⤵
  PID:8980
- C:\Windows\System\NcvXEvk.exe
  C:\Windows\System\NcvXEvk.exe
  2⤵
  PID:8996
- C:\Windows\System\mHIYObI.exe
  C:\Windows\System\mHIYObI.exe
  2⤵
  PID:9012
- C:\Windows\System\HZpWAON.exe
  C:\Windows\System\HZpWAON.exe
  2⤵
  PID:9028
- C:\Windows\System\eJYTGxn.exe
  C:\Windows\System\eJYTGxn.exe
  2⤵
  PID:9044
- C:\Windows\System\JHONSDn.exe
  C:\Windows\System\JHONSDn.exe
  2⤵
  PID:9060
- C:\Windows\System\fUytAgY.exe
  C:\Windows\System\fUytAgY.exe
  2⤵
  PID:9076
- C:\Windows\System\FLlQhSF.exe
  C:\Windows\System\FLlQhSF.exe
  2⤵
  PID:9092
- C:\Windows\System\AKSwmzw.exe
  C:\Windows\System\AKSwmzw.exe
  2⤵
  PID:9108
- C:\Windows\System\fhIxDtz.exe
  C:\Windows\System\fhIxDtz.exe
  2⤵
  PID:9124
- C:\Windows\System\LrKpGep.exe
  C:\Windows\System\LrKpGep.exe
  2⤵
  PID:9140
- C:\Windows\System\NimAyYV.exe
  C:\Windows\System\NimAyYV.exe
  2⤵
  PID:9156
- C:\Windows\System\IHqwOSl.exe
  C:\Windows\System\IHqwOSl.exe
  2⤵
  PID:9172
- C:\Windows\System\QHTaiNi.exe
  C:\Windows\System\QHTaiNi.exe
  2⤵
  PID:9188
- C:\Windows\System\weAAYKl.exe
  C:\Windows\System\weAAYKl.exe
  2⤵
  PID:9204
- C:\Windows\System\QwdqwqI.exe
  C:\Windows\System\QwdqwqI.exe
  2⤵
  PID:8164
- C:\Windows\System\BNkUPMm.exe
  C:\Windows\System\BNkUPMm.exe
  2⤵
  PID:8244
- C:\Windows\System\ZiOgFhd.exe
  C:\Windows\System\ZiOgFhd.exe
  2⤵
  PID:7184
- C:\Windows\System\SbTptTV.exe
  C:\Windows\System\SbTptTV.exe
  2⤵
  PID:8232
- C:\Windows\System\pIDgGOs.exe
  C:\Windows\System\pIDgGOs.exe
  2⤵
  PID:8264
- C:\Windows\System\MTPdJAk.exe
  C:\Windows\System\MTPdJAk.exe
  2⤵
  PID:8356
- C:\Windows\System\PHqGVQz.exe
  C:\Windows\System\PHqGVQz.exe
  2⤵
  PID:8364
- C:\Windows\System\JbUhUub.exe
  C:\Windows\System\JbUhUub.exe
  2⤵
  PID:8380
- C:\Windows\System\AYUqbUR.exe
  C:\Windows\System\AYUqbUR.exe
  2⤵
  PID:8396
- C:\Windows\System\hncqIAx.exe
  C:\Windows\System\hncqIAx.exe
  2⤵
  PID:8412
- C:\Windows\System\MbLRoIP.exe
  C:\Windows\System\MbLRoIP.exe
  2⤵
  PID:1572
- C:\Windows\System\LQmrdSC.exe
  C:\Windows\System\LQmrdSC.exe
  2⤵
  PID:8440
- C:\Windows\System\njSoJPd.exe
  C:\Windows\System\njSoJPd.exe
  2⤵
  PID:8456
- C:\Windows\System\bWaUVIW.exe
  C:\Windows\System\bWaUVIW.exe
  2⤵
  PID:8488
- C:\Windows\System\mvALySY.exe
  C:\Windows\System\mvALySY.exe
  2⤵
  PID:8520
- C:\Windows\System\tjVthHK.exe
  C:\Windows\System\tjVthHK.exe
  2⤵
  PID:8616
- C:\Windows\System\hzhEgVL.exe
  C:\Windows\System\hzhEgVL.exe
  2⤵
  PID:8776
- C:\Windows\System\LDBIfFa.exe
  C:\Windows\System\LDBIfFa.exe
  2⤵
  PID:8860
- C:\Windows\System\FkDeiUh.exe
  C:\Windows\System\FkDeiUh.exe
  2⤵
  PID:8572
- C:\Windows\System\tSpZXcF.exe
  C:\Windows\System\tSpZXcF.exe
  2⤵
  PID:8876
- C:\Windows\System\oUftdCO.exe
  C:\Windows\System\oUftdCO.exe
  2⤵
  PID:8844
- C:\Windows\System\cadNNui.exe
  C:\Windows\System\cadNNui.exe
  2⤵
  PID:8940
- C:\Windows\System\mFCerHy.exe
  C:\Windows\System\mFCerHy.exe
  2⤵
  PID:8360
- C:\Windows\System\wHFqduY.exe
  C:\Windows\System\wHFqduY.exe
  2⤵
  PID:8372
- C:\Windows\System\BMTPEnk.exe
  C:\Windows\System\BMTPEnk.exe
  2⤵
  PID:8448
- C:\Windows\System\gZiXBZB.exe
  C:\Windows\System\gZiXBZB.exe
  2⤵
  PID:8404
- C:\Windows\System\IPCIWnb.exe
  C:\Windows\System\IPCIWnb.exe
  2⤵
  PID:8652
- C:\Windows\System\LYbRwGX.exe
  C:\Windows\System\LYbRwGX.exe
  2⤵
  PID:8808
- C:\Windows\System\qmoeFsU.exe
  C:\Windows\System\qmoeFsU.exe
  2⤵
  PID:8944
- C:\Windows\System\yjlJKni.exe
  C:\Windows\System\yjlJKni.exe
  2⤵
  PID:8756
- C:\Windows\System\vhiDcPx.exe
  C:\Windows\System\vhiDcPx.exe
  2⤵
  PID:8908
- C:\Windows\System\hvMOklS.exe
  C:\Windows\System\hvMOklS.exe
  2⤵
  PID:8712
- C:\Windows\System\vmfeHEq.exe
  C:\Windows\System\vmfeHEq.exe
  2⤵
  PID:8636
- C:\Windows\System\cNXmrTr.exe
  C:\Windows\System\cNXmrTr.exe
  2⤵
  PID:8668
- C:\Windows\System\kJMVxPm.exe
  C:\Windows\System\kJMVxPm.exe
  2⤵
  PID:8504
- C:\Windows\System\RINzZYY.exe
  C:\Windows\System\RINzZYY.exe
  2⤵
  PID:8724
- C:\Windows\System\dTvttBD.exe
  C:\Windows\System\dTvttBD.exe
  2⤵
  PID:8928
- C:\Windows\System\WBkhwLh.exe
  C:\Windows\System\WBkhwLh.exe
  2⤵
  PID:8992
- C:\Windows\System\ddZJzPq.exe
  C:\Windows\System\ddZJzPq.exe
  2⤵
  PID:9008
- C:\Windows\System\aWGtwaj.exe
  C:\Windows\System\aWGtwaj.exe
  2⤵
  PID:9056
- C:\Windows\System\UlvlFjS.exe
  C:\Windows\System\UlvlFjS.exe
  2⤵
  PID:9120
- C:\Windows\System\MUWxuOy.exe
  C:\Windows\System\MUWxuOy.exe
  2⤵
  PID:9184
- C:\Windows\System\FgICMgM.exe
  C:\Windows\System\FgICMgM.exe
  2⤵
  PID:8276
- C:\Windows\System\JtpEnln.exe
  C:\Windows\System\JtpEnln.exe
  2⤵
  PID:8340
- C:\Windows\System\XObUKxQ.exe
  C:\Windows\System\XObUKxQ.exe
  2⤵
  PID:7832
- C:\Windows\System\dqytPeu.exe
  C:\Windows\System\dqytPeu.exe
  2⤵
  PID:9168
- C:\Windows\System\xTJTRMm.exe
  C:\Windows\System\xTJTRMm.exe
  2⤵
  PID:9040
- C:\Windows\System\aRsTDSK.exe
  C:\Windows\System\aRsTDSK.exe
  2⤵
  PID:8216
- C:\Windows\System\zoqOtCH.exe
  C:\Windows\System\zoqOtCH.exe
  2⤵
  PID:8328
- C:\Windows\System\txiLFAN.exe
  C:\Windows\System\txiLFAN.exe
  2⤵
  PID:8432
- C:\Windows\System\CiisSzL.exe
  C:\Windows\System\CiisSzL.exe
  2⤵
  PID:8588
- C:\Windows\System\qCKtlrM.exe
  C:\Windows\System\qCKtlrM.exe
  2⤵
  PID:8460
- C:\Windows\System\gdJfLIA.exe
  C:\Windows\System\gdJfLIA.exe
  2⤵
  PID:8568
- C:\Windows\System\nmoUINf.exe
  C:\Windows\System\nmoUINf.exe
  2⤵
  PID:8536
- C:\Windows\System\hmjhJwv.exe
  C:\Windows\System\hmjhJwv.exe
  2⤵
  PID:8708
- C:\Windows\System\DklbvXU.exe
  C:\Windows\System\DklbvXU.exe
  2⤵
  PID:8600
- C:\Windows\System\ZCVjzlJ.exe
  C:\Windows\System\ZCVjzlJ.exe
  2⤵
  PID:9004
- C:\Windows\System\cJbTGYL.exe
  C:\Windows\System\cJbTGYL.exe
  2⤵
  PID:8184
- C:\Windows\System\JuBekDU.exe
  C:\Windows\System\JuBekDU.exe
  2⤵
  PID:9196
- C:\Windows\System\EooJFCX.exe
  C:\Windows\System\EooJFCX.exe
  2⤵
  PID:8420
- C:\Windows\System\aOIBsYq.exe
  C:\Windows\System\aOIBsYq.exe
  2⤵
  PID:8632
- C:\Windows\System\icrbxAi.exe
  C:\Windows\System\icrbxAi.exe
  2⤵
  PID:8772
- C:\Windows\System\WOAFhow.exe
  C:\Windows\System\WOAFhow.exe
  2⤵
  PID:9036
- C:\Windows\System\pyVXHPw.exe
  C:\Windows\System\pyVXHPw.exe
  2⤵
  PID:8392
- C:\Windows\System\gNJlWAc.exe
  C:\Windows\System\gNJlWAc.exe
  2⤵
  PID:8656
- C:\Windows\System\NzSzCHw.exe
  C:\Windows\System\NzSzCHw.exe
  2⤵
  PID:8848
- C:\Windows\System\aAzXeyN.exe
  C:\Windows\System\aAzXeyN.exe
  2⤵
  PID:8976
- C:\Windows\System\cbZmQAE.exe
  C:\Windows\System\cbZmQAE.exe
  2⤵
  PID:9180
- C:\Windows\System\gvlxOMj.exe
  C:\Windows\System\gvlxOMj.exe
  2⤵
  PID:9072
- C:\Windows\System\yxnTTcZ.exe
  C:\Windows\System\yxnTTcZ.exe
  2⤵
  PID:8744
- C:\Windows\System\bBJrfpo.exe
  C:\Windows\System\bBJrfpo.exe
  2⤵
  PID:8196
- C:\Windows\System\PqQwPtB.exe
  C:\Windows\System\PqQwPtB.exe
  2⤵
  PID:8516
- C:\Windows\System\ykETugM.exe
  C:\Windows\System\ykETugM.exe
  2⤵
  PID:9220
- C:\Windows\System\tnQDkgO.exe
  C:\Windows\System\tnQDkgO.exe
  2⤵
  PID:9240
- C:\Windows\System\UkpWfPE.exe
  C:\Windows\System\UkpWfPE.exe
  2⤵
  PID:9256
- C:\Windows\System\JjuILGJ.exe
  C:\Windows\System\JjuILGJ.exe
  2⤵
  PID:9272
- C:\Windows\System\onGDGQD.exe
  C:\Windows\System\onGDGQD.exe
  2⤵
  PID:9288
- C:\Windows\System\SUrtsUP.exe
  C:\Windows\System\SUrtsUP.exe
  2⤵
  PID:9304
- C:\Windows\System\GsXNkIa.exe
  C:\Windows\System\GsXNkIa.exe
  2⤵
  PID:9320
- C:\Windows\System\XERrvvu.exe
  C:\Windows\System\XERrvvu.exe
  2⤵
  PID:9336
- C:\Windows\System\plmPsWA.exe
  C:\Windows\System\plmPsWA.exe
  2⤵
  PID:9352
- C:\Windows\System\NLcSfrH.exe
  C:\Windows\System\NLcSfrH.exe
  2⤵
  PID:9368
- C:\Windows\System\syUNqNz.exe
  C:\Windows\System\syUNqNz.exe
  2⤵
  PID:9384
- C:\Windows\System\yXAOscz.exe
  C:\Windows\System\yXAOscz.exe
  2⤵
  PID:9404
- C:\Windows\System\BNgRJqZ.exe
  C:\Windows\System\BNgRJqZ.exe
  2⤵
  PID:9424
- C:\Windows\System\lpaOhJg.exe
  C:\Windows\System\lpaOhJg.exe
  2⤵
  PID:9440
- C:\Windows\System\FUeiyKu.exe
  C:\Windows\System\FUeiyKu.exe
  2⤵
  PID:9456
- C:\Windows\System\iifqCOI.exe
  C:\Windows\System\iifqCOI.exe
  2⤵
  PID:9476
- C:\Windows\System\XUitCrP.exe
  C:\Windows\System\XUitCrP.exe
  2⤵
  PID:9492
- C:\Windows\System\AhTduMC.exe
  C:\Windows\System\AhTduMC.exe
  2⤵
  PID:9508
- C:\Windows\System\amaVwou.exe
  C:\Windows\System\amaVwou.exe
  2⤵
  PID:9524
- C:\Windows\System\fUIkmDR.exe
  C:\Windows\System\fUIkmDR.exe
  2⤵
  PID:9540
- C:\Windows\System\BRsRNsk.exe
  C:\Windows\System\BRsRNsk.exe
  2⤵
  PID:9556
- C:\Windows\System\KYlroqT.exe
  C:\Windows\System\KYlroqT.exe
  2⤵
  PID:9572
- C:\Windows\System\VOMbGVF.exe
  C:\Windows\System\VOMbGVF.exe
  2⤵
  PID:9588
- C:\Windows\System\mQdNLxh.exe
  C:\Windows\System\mQdNLxh.exe
  2⤵
  PID:9608
- C:\Windows\System\oInGDGN.exe
  C:\Windows\System\oInGDGN.exe
  2⤵
  PID:9624
- C:\Windows\System\yiEbZOA.exe
  C:\Windows\System\yiEbZOA.exe
  2⤵
  PID:9640
- C:\Windows\System\fPIOslY.exe
  C:\Windows\System\fPIOslY.exe
  2⤵
  PID:9656
- C:\Windows\System\wxzSZhR.exe
  C:\Windows\System\wxzSZhR.exe
  2⤵
  PID:9672
- C:\Windows\System\AcNzyNH.exe
  C:\Windows\System\AcNzyNH.exe
  2⤵
  PID:9692
- C:\Windows\System\URdHzjd.exe
  C:\Windows\System\URdHzjd.exe
  2⤵
  PID:9708
- C:\Windows\System\ULrBkqv.exe
  C:\Windows\System\ULrBkqv.exe
  2⤵
  PID:9724
- C:\Windows\System\xQsuqBR.exe
  C:\Windows\System\xQsuqBR.exe
  2⤵
  PID:9740
- C:\Windows\System\gaqNQlF.exe
  C:\Windows\System\gaqNQlF.exe
  2⤵
  PID:9760
- C:\Windows\System\IJeyawk.exe
  C:\Windows\System\IJeyawk.exe
  2⤵
  PID:9776
- C:\Windows\System\JytjLwW.exe
  C:\Windows\System\JytjLwW.exe
  2⤵
  PID:9792
- C:\Windows\System\lFBfQqD.exe
  C:\Windows\System\lFBfQqD.exe
  2⤵
  PID:9808
- C:\Windows\System\iJxwpSY.exe
  C:\Windows\System\iJxwpSY.exe
  2⤵
  PID:9824
- C:\Windows\System\fxKZGbL.exe
  C:\Windows\System\fxKZGbL.exe
  2⤵
  PID:9840
- C:\Windows\System\aKROAhW.exe
  C:\Windows\System\aKROAhW.exe
  2⤵
  PID:9856
- C:\Windows\System\XEgttBT.exe
  C:\Windows\System\XEgttBT.exe
  2⤵
  PID:9872
- C:\Windows\System\zJppzel.exe
  C:\Windows\System\zJppzel.exe
  2⤵
  PID:9888
- C:\Windows\System\kRKXvPo.exe
  C:\Windows\System\kRKXvPo.exe
  2⤵
  PID:9904
- C:\Windows\System\THxYZEZ.exe
  C:\Windows\System\THxYZEZ.exe
  2⤵
  PID:9920
- C:\Windows\System\QSSSTbB.exe
  C:\Windows\System\QSSSTbB.exe
  2⤵
  PID:9940
- C:\Windows\System\YEaLnnR.exe
  C:\Windows\System\YEaLnnR.exe
  2⤵
  PID:9956
- C:\Windows\System\IALOtoa.exe
  C:\Windows\System\IALOtoa.exe
  2⤵
  PID:9972
- C:\Windows\System\KdxzvoM.exe
  C:\Windows\System\KdxzvoM.exe
  2⤵
  PID:9988
- C:\Windows\System\DDlKHUH.exe
  C:\Windows\System\DDlKHUH.exe
  2⤵
  PID:10004
- C:\Windows\System\GdTwdbk.exe
  C:\Windows\System\GdTwdbk.exe
  2⤵
  PID:10020
- C:\Windows\System\nRMJIyF.exe
  C:\Windows\System\nRMJIyF.exe
  2⤵
  PID:10036
- C:\Windows\System\OiaSDGo.exe
  C:\Windows\System\OiaSDGo.exe
  2⤵
  PID:10056
- C:\Windows\System\HxoLvRx.exe
  C:\Windows\System\HxoLvRx.exe
  2⤵
  PID:10072
- C:\Windows\System\qYKxAoS.exe
  C:\Windows\System\qYKxAoS.exe
  2⤵
  PID:10088
- C:\Windows\System\wNSoaZT.exe
  C:\Windows\System\wNSoaZT.exe
  2⤵
  PID:10104
- C:\Windows\System\YFDysWD.exe
  C:\Windows\System\YFDysWD.exe
  2⤵
  PID:10120
- C:\Windows\System\AEiKPip.exe
  C:\Windows\System\AEiKPip.exe
  2⤵
  PID:10136
- C:\Windows\System\aSDGQWV.exe
  C:\Windows\System\aSDGQWV.exe
  2⤵
  PID:10152
- C:\Windows\System\AfUpLfB.exe
  C:\Windows\System\AfUpLfB.exe
  2⤵
  PID:10168
- C:\Windows\System\bhFxbQH.exe
  C:\Windows\System\bhFxbQH.exe
  2⤵
  PID:10184
- C:\Windows\System\jfEWBtH.exe
  C:\Windows\System\jfEWBtH.exe
  2⤵
  PID:10200
- C:\Windows\System\nqCqTDX.exe
  C:\Windows\System\nqCqTDX.exe
  2⤵
  PID:10216
- C:\Windows\System\IaZOgEn.exe
  C:\Windows\System\IaZOgEn.exe
  2⤵
  PID:9264
- C:\Windows\System\IjHFEpe.exe
  C:\Windows\System\IjHFEpe.exe
  2⤵
  PID:9328
- C:\Windows\System\xTnCYQq.exe
  C:\Windows\System\xTnCYQq.exe
  2⤵
  PID:9284
- C:\Windows\System\aNCDAoO.exe
  C:\Windows\System\aNCDAoO.exe
  2⤵
  PID:9348
- C:\Windows\System\xxVoYwR.exe
  C:\Windows\System\xxVoYwR.exe
  2⤵
  PID:9412
- C:\Windows\System\cbqETGb.exe
  C:\Windows\System\cbqETGb.exe
  2⤵
  PID:8324
- C:\Windows\System\oslCcpc.exe
  C:\Windows\System\oslCcpc.exe
  2⤵
  PID:9484
- C:\Windows\System\IKShwuX.exe
  C:\Windows\System\IKShwuX.exe
  2⤵
  PID:9548
- C:\Windows\System\rbroKGb.exe
  C:\Windows\System\rbroKGb.exe
  2⤵
  PID:9552
- C:\Windows\System\QRQJcoZ.exe
  C:\Windows\System\QRQJcoZ.exe
  2⤵
  PID:9432
- C:\Windows\System\DcdQKDR.exe
  C:\Windows\System\DcdQKDR.exe
  2⤵
  PID:9536
- C:\Windows\System\OsCDwyU.exe
  C:\Windows\System\OsCDwyU.exe
  2⤵
  PID:9684
- C:\Windows\System\aOSBcyi.exe
  C:\Windows\System\aOSBcyi.exe
  2⤵
  PID:9720
- C:\Windows\System\KFmvISX.exe
  C:\Windows\System\KFmvISX.exe
  2⤵
  PID:9632
- C:\Windows\System\lKBRHja.exe
  C:\Windows\System\lKBRHja.exe
  2⤵
  PID:9596
- C:\Windows\System\cBMNJfP.exe
  C:\Windows\System\cBMNJfP.exe
  2⤵
  PID:9636
- C:\Windows\System\TJCtrzh.exe
  C:\Windows\System\TJCtrzh.exe
  2⤵
  PID:9732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\AOLGzQa.exe

Filesize
1.6MB

MD5
c7f8ce8bb7eb536fa04af9fb5a8fdf36

SHA1
d0d5988ec0bd568e7c8f05fc657ef2b43fa3c080

SHA256
29f0fcaaf26ea88822fa98d6fa155e8f0f5d9731d8b8801c8f5e78e023d63f63

SHA512
9f497f2c182adfc5b17a97872a7dd794e03a507a6008e27d12a22d1e33987faa4a93c1e0e4433ef4bdc734b4c0f27086c04b22f0691c20d17b7c292b0d568805

Download Submit
C:\Windows\system\CssNDHB.exe

Filesize
1.6MB

MD5
a1fa08d3c4e9ea45d4842ed6509ec26a

SHA1
736419ae138675045fd4bc5fe444ad42d5e8ca17

SHA256
55bae88ffb392c0e83db0e089522e219adf66f923e954049b4a3b429bf25e4cb

SHA512
229f3b3e882ef81ca3e5acf5a57e9dc335a5f22fc67eb66efbb3ab49e262bb04b6b146750c08212a79b5d5b735da3f598fcac6a66419adedca689517ad68ce49

Download Submit
C:\Windows\system\CxfBtaE.exe

Filesize
1.6MB

MD5
041384671861639097e12c71868d96b6

SHA1
799de7fded654925940cf8992ee1d1aec166151d

SHA256
5ee3da4e65b7f170c6e4e950f2cba53d1e2d8ade3d7b9bf6b271586eb859bede

SHA512
502cc6a330133bf3258e31587e7213ab952b94dd994aadbe19fb8a216b7f7034f9946460bbdfef00c8a615c662ff1ab6f0b39ae1dcac274decfd728eabd6851f

Download Submit
C:\Windows\system\EmYkFVw.exe

Filesize
1.6MB

MD5
d8e0460ebf2252875c07ef026c8f472e

SHA1
7615e0a937ef2c47546b65bfde807001b5b80e92

SHA256
5782fe69cebee2edf81a81973ee6918c083ce23a361b31b60e25bae1a8d493cd

SHA512
16b0c76de4cbb07d256e55494b40ffed9949d9ed110b064f9134d14355c7f0eb7248369d04d82449d333e6ce36fd1990519402ee4884419da8fa871cc54d292c

Download Submit
C:\Windows\system\INUQmiQ.exe

Filesize
1.6MB

MD5
bbb916b1f588778444b3e52150f7f96e

SHA1
4a27792c18f570aae63cd9c5b6d44b6e7592dd38

SHA256
78d453be924f9a384f99f11651e34f6e7356174044f04697e0305fec6a83ad12

SHA512
696165ad0e9fd7b1a0c234c8eb333bc48cb8df2fb0b54a03975331c32b50fb253f8fef335762fbf2cfff21f52cc8b4f003f83ca1e8b150ecdf715bf0763aee2b

Download Submit
C:\Windows\system\INklRKD.exe

Filesize
1.6MB

MD5
ac8bf2d9033bb03d7d61c8b3a3365cc9

SHA1
44fdb886e1028a4b022595b147292be633d120e9

SHA256
6b9fd80521f53bf32463d1a05dce851ea6e41fe914902896eb7281c3178d3f7b

SHA512
acf97d2d3362d0b6b95186a83d6bead27a691f041164cbcb61879a9aec616761a38b8822ca6ec543ff74c63e5b04fbfc23bce534e2f5a69033d443bbf263ff80

Download Submit
C:\Windows\system\JgsCgyH.exe

Filesize
1.6MB

MD5
974330883bdd9f8189a59fde157c73a4

SHA1
6595ce44479710c252619f2fadba475c33bcc07c

SHA256
d95d764dd2ad3866f3c23dc44ec813538fa3f7c4eb9a419a2bc507fdd1eca761

SHA512
27de3655fafc02f6166547d6cb31b884a9e50db652c33ec6d166c5d25a40b208fc6c2ec65401395afeb0d3890413c2b429bcb95a868bafc34dabde34dd4041be

Download Submit
C:\Windows\system\KbrEknE.exe

Filesize
1.6MB

MD5
b83d490568ab59d0a71f3895fd090b23

SHA1
23f11da209ddcc0ef394be93183130c9c03b1674

SHA256
ae02569c5ba7fa04db9d8ac8b35ceb9ac6972d211e7a6534705cf1a453b465da

SHA512
61a94640c1e658c5dcae5daa2035a4168ab8502e09d22b4d7f87bd4ff9898143be2d12662de49f13f903e003a849be718ee4d3a3f7fc8f3b63a1b706e01c231e

Download Submit
C:\Windows\system\LoWuNay.exe

Filesize
1.6MB

MD5
cc155cb8dfc5e48aed53ff367fabe1b8

SHA1
2b7053c1ec2c1215f5f75c5b7cf72560e26a3249

SHA256
3f1afe3bf0911169136e450d0f84e27893f3fe2a6e24d88b47b77d147d70f050

SHA512
840b6065b4e65a8212be14ac00cef7344464e7665f43a3d8311613d6add0562a926b5c3d1e4b65abfd56c4b47d7e43061241d6f1ccc00e88dd2305c597cb9244

Download Submit
C:\Windows\system\MqBDQUc.exe

Filesize
1.6MB

MD5
fa3a6c2fbad77f05c61c98132c4927d9

SHA1
9db04b6cd9b3d93846b8f2bfbfe88b0301dc223b

SHA256
30483d575f9091e4d72e4ed76a8ec725d9c855f8238d0279c0491911ae064f1b

SHA512
b984458eacbf78e17f2e3773afb8f564db21cee189ad73639cfe486822b83b1993311d2473983d3dd7f1d1bb6150a2b10185490ea3a1d826b95dc2e79a68c485

Download Submit
C:\Windows\system\NAfrwQK.exe

Filesize
1.6MB

MD5
964fac9adbb4a052a642fa5b012a4666

SHA1
e0ac01c4fd857fa228d457f93251597570d764ce

SHA256
fc1543fef1d02487bea113c109aabef8bcb9382e173f532bb664cde7e43fb40f

SHA512
fd3a771703a6d5a755728715adc6b270275a7c41e93e02ee8fbaf90d55b391562e00c560123b1e641ad61a047244516f3997b8885930cf66ccbde8cb13c461b6

Download Submit
C:\Windows\system\PdWGmae.exe

Filesize
1.6MB

MD5
7bbc938c381068aa220d84418d7fd92f

SHA1
e729e5e3ba36aa32d9eaee39e6ceda0508542fd5

SHA256
df46a3e5358a504652e67602fbb05adb3e3d35c0bd345d0f196fb9fcefd87123

SHA512
ed9153a624bdeda2f45ab45136072bb0f3c435897ab70d43c8e1ede08641b2ba0defa52c8ed557c0b80ef9107d63ff721e9a7510fb7c3118ce357d7326353fa4

Download Submit
C:\Windows\system\QyQEolb.exe

Filesize
1.6MB

MD5
453c944517f306b2aa35814a8e4ef5ce

SHA1
cc0256829650dc34c3dfacb23eebd315b65112ed

SHA256
b63bb81098a60f388bc77bc775dd7f513461a4206c344d26c1c7cf91d1661ed2

SHA512
4c62fbd25575c1e540146491e54ec810d114e67e6c1de94e64e556a09052f0fc22831da33e30034f9d7c51832393abcda12d0ee5be1fdd7a4174bc8ae479efa6

Download Submit
C:\Windows\system\XdPUafZ.exe

Filesize
1.6MB

MD5
95b411545539a90b75ddba4168e0f245

SHA1
a2753cb85dae00874f0aecbf26d5023803690693

SHA256
eba3ecdecea573018a8f8ce8b7e5971b3dc5d1e04f664842a96509bba81d410f

SHA512
7c8aee17a15910479433ac933d17d6d66209fb5a4af8ebe63ade85ac560aa0a9115b0f0a11ee36b20ac0af5c782dc87aa30c29a7096eba542df28797cf56fe2f

Download Submit
C:\Windows\system\YPHqULy.exe

Filesize
1.6MB

MD5
96d2cce0bd736b1708775bf37d8427a3

SHA1
1062a13b09744ceb30bfceaab56cdb08f724e9f2

SHA256
2a272d16970d18ec4e24ea5a6bfb0f78c84f1632990f27e0026ce145ca307865

SHA512
5528ed349b4ff76c74a8e65efc5ca8ecff25f5d31188c4ca6db153ad6140f5486b9b05d223f1880ceb87144f2f32286b1a28547c3c5f6dae5cd14b21de07160f

Download Submit
C:\Windows\system\YRPyfWZ.exe

Filesize
1.6MB

MD5
69e7a20deaf9a9aa94b00868bf58472c

SHA1
80a62df94751d0d9b7a7957ccd2ad98f6e93e51b

SHA256
440db07b3f82cfe50697546deb618885de58d4871a7ee257b8c6342196c2d4af

SHA512
ae44fed681fe5caaee2ea57d73427139dc47a1f6b803e4ad7c7cee204e6e8e63a971cdca360797402dd195bec44da8d24c33aa8a5691a52f6da0d0d78768ecee

Download Submit
C:\Windows\system\cyDggLN.exe

Filesize
1.6MB

MD5
9a37389820f60b4c6453667d947de10f

SHA1
d30b0e2fa294923eb14a6de1fba57167eb4ffab2

SHA256
63486092e0c525e1020a0035bf6afa932d6771d76dae2a4d633e19ff020001f1

SHA512
ca5b72374e4b4db44205b5ab79a997b1f5d8d3fd64b257a4a2d2f5901fc9b7496e7baa3bfa4b25d90c7ae6d01b615c18f327cf0c82aee7502617a291cf3e97be

Download Submit
C:\Windows\system\eEWCrPM.exe

Filesize
1.6MB

MD5
afa599921f02a23c4ef22a01d75e09b7

SHA1
2d77cb39a2d7aa08a58acd99c15d691d2f4eea6e

SHA256
f4d55ff1f6353a3926b179bc849115405c7a4c062ef155657026d515f0be66b7

SHA512
9d3ab73f562828c4c4d1638dd46689b03bfee8608dfc0311a90b48988e3739a25c345a359cc4b45be3b13123f248300d4dd440bff8d1bd92f5dd6aaf9c748243

Download Submit
C:\Windows\system\gOIvVvk.exe

Filesize
1.6MB

MD5
0c5d275222524d258cedb223bd21d376

SHA1
b1c388dc5b75d658b6185c96afb21628c27445f9

SHA256
375e9f6b91272473cf5ba65636864a0ba246551c90887fc86e50c8174b15f792

SHA512
66c1011242df7fedf554d38e402fc3b3fd25ec89994838ea92edb8fb03da7412244b2aae2c680084452b1d2658686f0ef3cc1eb71d267d42054370f6784adf49

Download Submit
C:\Windows\system\gkFLdlh.exe

Filesize
1.6MB

MD5
33f4f7b004df304995f76579acc5e888

SHA1
742ea02e0348c379a9593b53b943a1c41c91e721

SHA256
7e7a7d8a755863e753ccd0b90efd7224454ca37d9ecc07a92354954ead35b08b

SHA512
f1a9be08604e7172f43b6e759c82c71497b2a7e9e05a6d4cc9e27c27918e023b315483d354d43a5e4ff8755b8543a85f92647b8b89cb21acf681ed6473750083

Download Submit
C:\Windows\system\jwPLghV.exe

Filesize
1.6MB

MD5
c68edb25699f016599eb0ba551919144

SHA1
c0d11547ac927507ed34a185c547e88b98242e86

SHA256
16e746ddcfa03da8823b5bcdd7776666ab0c374519cdff6b0241071dbee3be61

SHA512
4b83a5f6b26b051a24a7b2ab6c7b6f3753c34d69da37ca18b85f84203cb90a987cf110ea5062fc4246558b8607a15eab262ff3b70997d72debe74ef57bbcbd9d

Download Submit
C:\Windows\system\oVMsMSb.exe

Filesize
1.6MB

MD5
12068bff008eb6ec209638e375e5d69a

SHA1
063bfe8952157ee7e85922b3231f3dc40aefb60e

SHA256
adeecaff9b9c17d48302420c2bcb9f3e3cae342cd094d353b8dc9b37538c20b5

SHA512
c36ac8ee3e3ee5bbab7017be63c572143aab0ecd07798e364920257b4d56400c24980ab14a246d6be3257058b40ceb5f0cac347caaf049b4b03e34ac57482a4e

Download Submit
C:\Windows\system\rIlgCcW.exe

Filesize
1.6MB

MD5
e072ed430f4797c2f98347aa20f66ece

SHA1
827e6be11f21395e5f1743af50c64bb260bec397

SHA256
472c5d7f693fb177fbe2c206d2d2150a12ab3be9c0c2387470527a217b75c4b9

SHA512
35a33b9ce66c098312ad5642e73ae8e89d933c6a6f30e4a408d2214e2d4dceb2b33b0c84887327fcc5448a85b92c027d5209b685da8c4afeb7d52dd01ba1f93f

Download Submit
C:\Windows\system\rxTeRtL.exe

Filesize
1.6MB

MD5
69b38a38267b21c4812f5fae94b05bf7

SHA1
5750f91715b915b215e3580fcc4b0d6ac7cbea41

SHA256
ced47af1c399e30135e60e33ee15bb821fcf472cc3fa8ef93561ba6a2a9becef

SHA512
ea1a187bfc92fb092a5b7293faa6c20cebbdb0d5d873faac45e72ecf79b28d1950249cf87b1d31e9380ae8b7b664a99b0b946d565f47845669c6458919eb48cc

Download Submit
C:\Windows\system\wuuYGoy.exe

Filesize
1.6MB

MD5
0398458e5cdd624be5676f5ae76ee0fa

SHA1
9e27899ca9f5aeb300da452fe3e141fe42b1f482

SHA256
eaff2abff7f1fd35611a696fab1e0867b160d5658e124d645fa983c531103394

SHA512
b4347a74a7479d17d55bc12982f6956ba4e2da773f1d24137e544ef6be7c80632c8a17735eb39ed45cbb1e8b063beb856fed278bd4c2c5be6f73eb617c12cbfd

Download Submit
C:\Windows\system\yXyhJgc.exe

Filesize
1.6MB

MD5
5447fbc40e2507dea1f27cd11fb25e5b

SHA1
6bce2aa4f49fd2086fbeffa393c7ca226b8b51c8

SHA256
177eeba74ad93738290cdf3a4f3df27881ef9c38a5a10720fd1ea8741ddf8298

SHA512
9090e05e48c1fbe71b9d2aca885fd1e638a81486c95b2851c5ea7fa5244c46a0f8cfc2fc1c97feca701e996e5d30ba08c8f4375923086a682eba0ef0f7aa6cc1

Download Submit
\Windows\system\DSVwJEv.exe

Filesize
1.6MB

MD5
04bfd60ce2501938707f33627e09f344

SHA1
5501729ae56ebf1f8e68c14a67517f2088eaf5f9

SHA256
d12cc3ce19027ad24d7e82ecd661f76cae19a17d153e4d3d95ea7b6c5edc8972

SHA512
49e144ab91d51b0d3be326405649b26dc3b8e69ecec56d55868be5efa7b4efde984da53ae3694c49704ddc169e20132ac2fb236ae3d8011ef3cc445ecb3852a9

Download Submit
\Windows\system\GuyHnkj.exe

Filesize
1.6MB

MD5
a6387fe662449517b0ef237d68c1f132

SHA1
65999813c2ee14535696bc40aaa0c2535b7c4008

SHA256
77debb8cbf1d82f4a1e4e6388a113c0fa9dd1089f228869cdd5d5e1e8d8767bb

SHA512
e98e8bed07ec150e51d8443563f3b590bc0606ca17ffbef61635e84797625226e086a3f733fe55de0f1f2232c2bd2e4a2bee12a44f3182f17d941342b9f7bd8a

Download Submit
\Windows\system\eqLVdlH.exe

Filesize
1.6MB

MD5
0c9967fd08b8c512e45f2827b256a70f

SHA1
b6463f37f14062cca5ecbf56b004845dcd39dea7

SHA256
70c9e94e419659d0dab578cd121fa1883c2517208137602163fd11247c4484cc

SHA512
c608e2ae70f66eec4113c1086c53b84283e336146bfeebae78b0bcae3528ebcfce9619d962f4112f96482dd25f3897b3d4fb617130e2e66d4180f601a976d164

Download Submit
\Windows\system\hJLXjes.exe

Filesize
1.6MB

MD5
0b2995bbbc1822d0bcb5fb1c899cd264

SHA1
91dd153fe6ed73cb30eeb6bfa5a2db171a82c125

SHA256
ff1a1f084d03cd3e97aebc850bd93f9199e2d721169dbc6cf248333a19cb2ad6

SHA512
705ad7a7f472895cb848bab1a0a7639d7447f4b9b1abef85476763028ef13002d6db45288a071bfe7c5d7f86c2af6350627580fd8ea12cb8d41ac2e5219905d4

Download Submit
\Windows\system\iUUXOIh.exe

Filesize
1.6MB

MD5
4f2515cf94c8796a6c35140214bdb329

SHA1
6823dd8ca0b3af9c19d046f0cc5b23b3b5c87b18

SHA256
9431318cc50eff2f9c254cd3c04071547be458076288786b9172c0bf88e75859

SHA512
e51314a3ea69c4a8f29f49e98af67ad57308742c14696b25f40f093c35d4c79ae28f5be87f9b9fad22b60a4a6ee117c96f47186f2f5efe91004af9163e92a107

Download Submit
\Windows\system\ixiuIUi.exe

Filesize
1.6MB

MD5
104cc747c0be527cb9e96af6b75735b0

SHA1
e1c0ddf6425fc69a04f4ea73f9565c60c2569153

SHA256
dd62c6728f3983876013bae1bfc4f9e7f3e1810dc17eac6a456315a56ede097e

SHA512
9e1b7081685d1ed6e1fb871ca9b93a09114425cd19f822c31863abf1a01fa40e185c4dbf8fe038c7bee0ca75053cd98159d561309aa74f975dcad166dbe8d8b1

Download Submit
memory/2160-18-0x000000013F730000-0x000000013FB22000-memory.dmp

Filesize
3.9MB

Download
memory/2196-38-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2196-29-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-28-0x0000000002230000-0x0000000002238000-memory.dmp

Filesize
32KB

Download
memory/2196-30-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2196-33-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-332-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-34-0x0000000002D60000-0x0000000002DE0000-memory.dmp

Filesize
512KB

Download
memory/2196-318-0x000007FEF5D60000-0x000007FEF66FD000-memory.dmp

Filesize
9.6MB

Download
memory/2196-27-0x000000001B6F0000-0x000000001B9D2000-memory.dmp

Filesize
2.9MB

Download
memory/2288-39-0x000000013F480000-0x000000013F872000-memory.dmp

Filesize
3.9MB

Download
memory/2444-52-0x000000013FEB0000-0x00000001402A2000-memory.dmp

Filesize
3.9MB

Download
memory/2504-59-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2604-47-0x000000013F5A0000-0x000000013F992000-memory.dmp

Filesize
3.9MB

Download
memory/2668-35-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-40-0x000000013F0D0000-0x000000013F4C2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-46-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-61-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2740-57-0x000000013F060000-0x000000013F452000-memory.dmp

Filesize
3.9MB

Download
memory/2740-319-0x0000000002E70000-0x0000000003262000-memory.dmp

Filesize
3.9MB

Download
memory/2740-36-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-1-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2740-317-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2740-79-0x00000000034E0000-0x00000000038D2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-72-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download
memory/2740-0-0x000000013F640000-0x000000013FA32000-memory.dmp

Filesize
3.9MB

Download
memory/2740-16-0x0000000002A80000-0x0000000002E72000-memory.dmp

Filesize
3.9MB

Download
memory/2876-37-0x000000013F6C0000-0x000000013FAB2000-memory.dmp

Filesize
3.9MB

Download
memory/2960-74-0x000000013F160000-0x000000013F552000-memory.dmp

Filesize
3.9MB

Download
memory/2968-73-0x000000013FEC0000-0x00000001402B2000-memory.dmp

Filesize
3.9MB

Download